commit e5f0a698b34ed76002dc5cff3804a61c80233a7a Author: Linus Torvalds Date: Sun Sep 28 14:39:22 2025 -0700 Linux 6.17 commit c68472b46416573fa2af4851b2dad94971f544d4 Merge: 6855f06042ae8d 44a375e8aaff36 Author: Linus Torvalds Date: Sun Sep 28 13:24:43 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM fix from Russell King: "Just one fix to the module freeing function that was declared __weak when it should not have been. Thanks to Petr Pavlu for spotting this" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9458/1: module: Ensure the override of module_arch_freeing_init() commit 6855f06042ae8d134f96c63feb5dfb3943c6d789 Merge: 8f9736633f8ca0 095530512152e6 Author: Linus Torvalds Date: Sun Sep 28 13:19:23 2025 -0700 Merge tag 'i2c-for-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - various MAINTAINERS updates - fix an off-by-one error in riic - fix k1 DT schema to allow validation - rtl9300: fix faulty merge conflict resolution * tag 'i2c-for-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: rtl9300: Drop unsupported I2C_FUNC_SMBUS_I2C_BLOCK MAINTAINERS: add entry for SpacemiT K1 I2C driver MAINTAINERS: Add me as maintainer of Synopsys DesignWare I2C driver MAINTAINERS: delete email for Tharun Kumar P dt-bindings: i2c: spacemit: extend and validate all properties i2c: riic: Allow setting frequencies lower than 50KHz MAINTAINERS: Remove myself as Synopsys DesignWare I2C maintainer MAINTAINERS: Update email address for Qualcomm's I2C GENI maintainers commit 8f9736633f8ca0224d6dd0cf6826044b7b5f9737 Merge: a5b2a9f5056b64 0db0934e7f9bb6 Author: Linus Torvalds Date: Sun Sep 28 10:26:35 2025 -0700 Merge tag 'trace-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix buffer overflow in osnoise_cpu_write() The allocated buffer to read user space did not add a nul terminating byte after copying from user the string. It then reads the string, and if user space did not add a nul byte, the read will continue beyond the string. Add a nul terminating byte after reading the string. - Fix missing check for lockdown on tracing There's a path from kprobe events or uprobe events that can update the tracing system even if lockdown on tracing is activate. Add a check in the dynamic event path. - Add a recursion check for the function graph return path Now that fprobes can hook to the function graph tracer and call different code between the entry and the exit, the exit code may now call functions that are not called in entry. This means that the exit handler can possibly trigger recursion that is not caught and cause the system to crash. Add the same recursion checks in the function exit handler as exists in the entry handler path. * tag 'trace-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: fgraph: Protect return handler from recursion loop tracing: dynevent: Add a missing lockdown check on dynevent tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit() commit a5b2a9f5056b64aa41bd11d9166d836df30b0897 Merge: 09d95bc8023569 398a8a4e51dbd0 Author: Linus Torvalds Date: Sun Sep 28 09:56:05 2025 -0700 Merge tag 'spi-fix-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A few final driver specific fixes that have been sitting in -next for a bit. The OMAP issue is likely to come up very infrequently since mixed configuration SPI buses are rare and the Cadence issue is specific to SoCFPGA systems" * tag 'spi-fix-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: omap2-mcspi: drive SPI_CLK on transfer_setup() spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled commit 09d95bc8023569a56078950f2fc6f1a12a94ee08 Merge: 51a24b7deaae5c 7e89979f6695fb Author: Linus Torvalds Date: Sun Sep 28 09:32:00 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-09-27-22-35' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "7 hotfixes. 4 are cc:stable and the remainder address post-6.16 issues or aren't considered necessary for -stable kernels. 6 of these fixes are for MM. All singletons, please see the changelogs for details" * tag 'mm-hotfixes-stable-2025-09-27-22-35' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: include/linux/pgtable.h: convert arch_enter_lazy_mmu_mode() and friends to static inlines mm/damon/sysfs: do not ignore callback's return value in damon_sysfs_damon_call() mailmap: add entry for Bence Csókás fs/proc/task_mmu: check p->vec_buf for NULL kmsan: fix out-of-bounds access to shadow memory mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count mm/hugetlb: fix folio is still mapped when deleted commit 095530512152e6811278de9c30f170f0ac9705eb Author: Sven Eckelmann Date: Sat Sep 27 11:52:16 2025 +0200 i2c: rtl9300: Drop unsupported I2C_FUNC_SMBUS_I2C_BLOCK While applying the patch for commit ede965fd555a ("i2c: rtl9300: remove broken SMBus Quick operation support"), a conflict was incorrectly solved by adding the I2C_FUNC_SMBUS_I2C_BLOCK feature flag. But the code to handle I2C_SMBUS_I2C_BLOCK_DATA requests will be added by a separate commit. Fixes: ede965fd555a ("i2c: rtl9300: remove broken SMBus Quick operation support") Signed-off-by: Sven Eckelmann Signed-off-by: Wolfram Sang commit ed45b7a4da175539cd7ede514e4626e12a6d50ca Author: Troy Mitchell Date: Fri Sep 26 22:51:52 2025 +0800 MAINTAINERS: add entry for SpacemiT K1 I2C driver Add a MAINTAINERS entry for the SpacemiT K1 I2C driver and its DT binding. Signed-off-by: Troy Mitchell Signed-off-by: Wolfram Sang commit 9036d0882cdc366644ec1c70c37701631837f3b8 Author: Mika Westerberg Date: Fri Sep 26 13:50:57 2025 +0200 MAINTAINERS: Add me as maintainer of Synopsys DesignWare I2C driver I volunteered as maintainer of the DesignWare I2C driver, so update my entry from reviewer to maintainer. Signed-off-by: Mika Westerberg Acked-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit b49dde7aa4e0a85f104faa6c6987e0d9ca8d9a0d Author: Wolfram Sang Date: Thu Sep 25 22:39:44 2025 +0200 MAINTAINERS: delete email for Tharun Kumar P The email address bounced. I couldn't find a newer one in recent git history, so delete this email entry. Signed-off-by: Wolfram Sang commit 51a24b7deaae5c3561965f5b4b27bb9d686add1c Merge: fec734e8d564d5 2227f273b7dc25 Author: Linus Torvalds Date: Sat Sep 27 09:50:46 2025 -0700 Merge tag 'trace-tools-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull rtla tool fixes from Steven Rostedt: - Fix a buffer overflow in actions_parse() The "trigger_c" variable did not account for the nul byte when determining its size - Fix a compare that had the values reversed actions_destroy() is supposed to reallocate when len is greater than the current size, but the compare was testing if size is greater than the new length * tag 'trace-tools-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla/actions: Fix condition for buffer reallocation rtla: Fix buffer overflow in actions_parse commit 0db0934e7f9bb624ed98a665890dbe249f65b8fd Author: Masami Hiramatsu (Google) Date: Mon Sep 22 15:35:22 2025 +0900 tracing: fgraph: Protect return handler from recursion loop function_graph_enter_regs() prevents itself from recursion by ftrace_test_recursion_trylock(), but __ftrace_return_to_handler(), which is called at the exit, does not prevent such recursion. Therefore, while it can prevent recursive calls from fgraph_ops::entryfunc(), it is not able to prevent recursive calls to fgraph from fgraph_ops::retfunc(), resulting in a recursive loop. This can lead an unexpected recursion bug reported by Menglong. is_endbr() is called in __ftrace_return_to_handler -> fprobe_return -> kprobe_multi_link_exit_handler -> is_endbr. To fix this issue, acquire ftrace_test_recursion_trylock() in the __ftrace_return_to_handler() after unwind the shadow stack to mark this section must prevent recursive call of fgraph inside user-defined fgraph_ops::retfunc(). This is essentially a fix to commit 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer"), because before that fgraph was only used from the function graph tracer. Fprobe allowed user to run any callbacks from fgraph after that commit. Reported-by: Menglong Dong Closes: https://lore.kernel.org/all/20250918120939.1706585-1-dongml2@chinatelecom.cn/ Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer") Cc: stable@vger.kernel.org Cc: Peter Zijlstra Link: https://lore.kernel.org/175852292275.307379.9040117316112640553.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Acked-by: Jiri Olsa Tested-by: Menglong Dong Acked-by: Menglong Dong Signed-off-by: Steven Rostedt (Google) commit 2227f273b7dc25a791ae6b152550098aa6934b2f Author: Wander Lairson Costa Date: Mon Sep 15 15:10:56 2025 -0300 rtla/actions: Fix condition for buffer reallocation The condition to check if the actions buffer needs to be resized was incorrect. The check `self->size >= self->len` would evaluate to true on almost every call to `actions_new()`, causing the buffer to be reallocated unnecessarily each time an action was added. Fix the condition to `self->len >= self.size`, ensuring that the buffer is only resized when it is actually full. Cc: John Kacur Cc: Luis Goncalves Cc: Arnaldo Carvalho de Melo Cc: Chang Yin Cc: Costa Shulyupin Cc: Crystal Wood Cc: Gabriele Monaco Link: https://lore.kernel.org/20250915181101.52513-1-wander@redhat.com Fixes: 6ea082b171e00 ("rtla/timerlat: Add action on threshold feature") Signed-off-by: Wander Lairson Costa Reviewed-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit b1e0ff7209e952bdb4f9a85a8450546700b4affa Author: Ivan Pravdin Date: Sun Sep 7 22:05:57 2025 -0400 rtla: Fix buffer overflow in actions_parse Currently, tests 3 and 13-22 in tests/timerlat.t fail with error: *** buffer overflow detected ***: terminated timeout: the monitored command dumped core The result of running `sudo make check` is tests/timerlat.t (Wstat: 0 Tests: 22 Failed: 11) Failed tests: 3, 13-22 Files=3, Tests=34, 140 wallclock secs ( 0.07 usr 0.01 sys + 27.63 cusr 27.96 csys = 55.67 CPU) Result: FAIL Fix buffer overflow in actions_parse to avoid this error. After this change, the tests results are tests/hwnoise.t ... ok tests/osnoise.t ... ok tests/timerlat.t .. ok All tests successful. Files=3, Tests=34, 186 wallclock secs ( 0.06 usr 0.01 sys + 41.10 cusr 44.38 csys = 85.55 CPU) Result: PASS Link: https://lore.kernel.org/164ffc2ec8edacaf1295789dad82a07817b6263d.1757034919.git.ipravdin.official@gmail.com Fixes: 6ea082b171e0 ("rtla/timerlat: Add action on threshold feature") Signed-off-by: Ivan Pravdin Reviewed-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit fec734e8d564d55fb6bd4909ae2e68814d21d0a1 Merge: d4df17482e963e e24108012ce966 Author: Linus Torvalds Date: Fri Sep 26 14:39:12 2025 -0700 Merge tag 'riscv-for-linus-v6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - A race-free implementation of pudp_huge_get_and_clear() (based on the x86 code) - A MAINTAINERS update to my E-mail address * tag 'riscv-for-linus-v6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: MAINTAINERS: Update Paul Walmsley's E-mail address riscv: Use an atomic xchg in pudp_huge_get_and_clear() commit d4df17482e963e5424da63f22010976d1656a4b0 Merge: 083fc6d7fa0d97 2066f00e5b2dc0 Author: Linus Torvalds Date: Fri Sep 26 13:44:21 2025 -0700 Merge tag 'x86-urgent-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Fix a CPU topology code regression that caused the mishandling of certain boot command line options, and re-enable CONFIG_PTDUMP on i386 that was mistakenly turned off in the Kconfig" * tag 'x86-urgent-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/topology: Implement topology_is_core_online() to address SMT regression x86/Kconfig: Reenable PTDUMP on i386 commit 083fc6d7fa0d974a3663b97c8b0466737a544236 Merge: 2cea0ed9796381 a3a70caf790670 Author: Linus Torvalds Date: Fri Sep 26 12:30:23 2025 -0700 Merge tag 'sched-urgent-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Ingo Molnar: "Fix two dl_server regressions: a race that can end up leaving the dl_server stuck, and a dl_server throttling bug causing lag to fair tasks" * tag 'sched-urgent-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Fix dl_server behaviour sched/deadline: Fix dl_server getting stuck commit 2cea0ed9796381b142f46bd8de97bb6b54b1df61 Merge: 8b07f74c23a089 4ec3c15462b9f4 Author: Linus Torvalds Date: Fri Sep 26 12:28:32 2025 -0700 Merge tag 'locking-urgent-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Ingo Molnar: "Fix a PI-futexes race, and fix a copy_process() futex cleanup bug" * tag 'locking-urgent-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Use correct exit on failure from futex_hash_allocate_default() futex: Prevent use-after-free during requeue-PI commit 8b07f74c23a0890977a5ae3c0b2c105d7ac3b584 Merge: f26a24662cd287 e2ffa15b9baa44 Author: Linus Torvalds Date: Fri Sep 26 12:27:17 2025 -0700 Merge tag 'core-urgent-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull core fix from Ingo Molnar: "Fix a CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y bug on older Clang versions" * tag 'core-urgent-2025-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17 commit f26a24662cd2875f82029e28879a20cea212214c Merge: d8743676b12add fbe2dc6a9c7318 Author: Linus Torvalds Date: Fri Sep 26 11:05:06 2025 -0700 Merge tag 'v6.17rc7-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix unlink bug - Fix potential out of bounds access in processing compound requests * tag 'v6.17rc7-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix wrong index reference in smb2_compound_op() smb: client: handle unlink(2) of files open by different clients commit d8743676b12addb982f5d501e9f8def042ef9bdb Merge: 0d97ef77425e59 4d428dca252c85 Author: Linus Torvalds Date: Fri Sep 26 10:57:25 2025 -0700 Merge tag 'vfs-6.17-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Prevent double unlock in netfs - Fix a NULL pointer dereference in afs_put_server() - Fix a reference leak in netfs * tag 'vfs-6.17-rc8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: netfs: fix reference leak afs: Fix potential null pointer dereference in afs_put_server netfs: Prevent duplicate unlocking commit 0d97ef77425e591669111ebf819ceb5d5e2dc329 Merge: bb97142197df73 5fc4ab3269dea6 Author: Linus Torvalds Date: Fri Sep 26 10:32:22 2025 -0700 Merge tag 'pmdomain-v6.17-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fix from Ulf Hansson: - mediatek: Make sure MT8195 AUDIO power domain isn't left powered-on * tag 'pmdomain-v6.17-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: mediatek: set default off flag for MT8195 AUDIO power domain commit bb97142197df73fbbb0e6f8629dc1f89ef6960f7 Merge: df2837012f7e29 3ed17349f18774 Author: Linus Torvalds Date: Fri Sep 26 10:28:11 2025 -0700 Merge tag 'platform-drivers-x86-v6.17-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: "Fixes and New HW Supoort - amd/pmc: Use 8042 quirk for Stellaris Slim Gen6 AMD - dell: Set USTT mode according to BIOS after reboot - dell-lis3lv02d: Add Latitude E6530 - lg-laptop: Fix setting the fan mode" * tag 'platform-drivers-x86-v6.17-5' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() platform/x86: dell-lis3lv02d: Add Latitude E6530 platform/x86/dell: Set USTT mode according to BIOS after reboot platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list commit df2837012f7e29fc80ea673268643ec472ee0e61 Merge: 3a654ee549210f 3bd44edd6c5582 Author: Linus Torvalds Date: Fri Sep 26 10:23:58 2025 -0700 Merge tag 'gpio-fixes-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - allow looking up GPIOs by the secondary firmware node too - fix memory leak in gpio-regmap * tag 'gpio-fixes-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: regmap: fix memory leak of gpio_regmap structure gpiolib: Extend software-node support to support secondary software-nodes commit 3a654ee549210f8aecfbebc7c699557666d17a4b Merge: 3170244bc5cfe2 285213a65e91d0 Author: Linus Torvalds Date: Fri Sep 26 09:46:51 2025 -0700 Merge tag 'block-6.17-20250925' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: "A regression fix for this series where an attempt to silence an EOD error got messed up a bit, and then a change of git trees for the block and io_uring trees. Switching the git trees to kernel.org now, as I've just about had it trying to battle AI bots that bring the box to its knees, continually. At least I don't have to maintain the kernel.org side" * tag 'block-6.17-20250925' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: MAINTAINERS: update io_uring and block tree git trees block: fix EOD return for device with nr_sectors == 0 commit 3170244bc5cfe2a93d105aa57ff7e04ab19f78fc Merge: 4ff71af020ae59 ec73e5984e01bf Author: Linus Torvalds Date: Fri Sep 26 09:42:57 2025 -0700 Merge tag 'drm-fixes-2025-09-26' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes, some fbcon font handling fixes, then amdgpu/xe/i915 with a few, and a few misc fixes for other drivers. Seems about right for this stage, and I don't know of anything outstanding. fbcon: - fix OOB access in font allocation - fix integer overflow in font handling amdgpu: - Backlight fix - DC preblend fix - DCN 3.5 fix - Cleanup output_tf_change xe: - Don't expose sysfs attributes not applicable for VFs - Fix build with CONFIG_MODULES=n - Don't copy pinned kernel bos twice on suspend i915: - Set O_LARGEFILE in __create_shmem() - Guard reg_val against a INVALID_TRANSCODER [ddi] ast: - sleeps causing cpu stall fix panthor: - scheduler race condition fix gma500: - NULL ptr deref in hdmi teardown fix" * tag 'drm-fixes-2025-09-26' of https://gitlab.freedesktop.org/drm/kernel: drm/panthor: Defer scheduler entitiy destruction to queue release drm/amd/display: remove output_tf_change flag drm/amd/display: Init DCN35 clocks from pre-os HW values drm/amd/display: Use mpc.preblend flag to indicate preblend drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume fbcon: Fix OOB access in font allocation drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODER drm/i915: set O_LARGEFILE in __create_shmem() drm/xe: Don't copy pinned kernel bos twice on suspend drm/xe: Fix build with CONFIG_MODULES=n drm/xe/vf: Don't expose sysfs attributes not applicable for VFs fbcon: fix integer overflow in fbcon_do_set_font drm/gma500: Fix null dereference in hdmi teardown drm/ast: Use msleep instead of mdelay for edid read commit fbe2dc6a9c7318f7263f5e4d50f6272b931c5756 Author: Sang-Heon Jeon Date: Tue Sep 23 17:16:45 2025 +0900 smb: client: fix wrong index reference in smb2_compound_op() In smb2_compound_op(), the loop that processes each command's response uses wrong indices when accessing response bufferes. This incorrect indexing leads to improper handling of command results. Also, if incorrectly computed index is greather than or equal to MAX_COMPOUND, it can cause out-of-bounds accesses. Fixes: 3681c74d342d ("smb: client: handle lack of EA support in smb2_query_path_info()") # 6.14 Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Sang-Heon Jeon Signed-off-by: Steve French commit 4d428dca252c858bfac691c31fa95d26cd008706 Author: Max Kellermann Date: Thu Sep 25 14:08:20 2025 +0100 netfs: fix reference leak Commit 20d72b00ca81 ("netfs: Fix the request's work item to not require a ref") modified netfs_alloc_request() to initialize the reference counter to 2 instead of 1. The rationale was that the requet's "work" would release the second reference after completion (via netfs_{read,write}_collection_worker()). That works most of the time if all goes well. However, it leaks this additional reference if the request is released before the I/O operation has been submitted: the error code path only decrements the reference counter once and the work item will never be queued because there will never be a completion. This has caused outages of our whole server cluster today because tasks were blocked in netfs_wait_for_outstanding_io(), leading to deadlocks in Ceph (another bug that I will address soon in another patch). This was caused by a netfs_pgpriv2_begin_copy_to_cache() call which failed in fscache_begin_write_operation(). The leaked netfs_io_request was never completed, leaving `netfs_inode.io_count` with a positive value forever. All of this is super-fragile code. Finding out which code paths will lead to an eventual completion and which do not is hard to see: - Some functions like netfs_create_write_req() allocate a request, but will never submit any I/O. - netfs_unbuffered_read_iter_locked() calls netfs_unbuffered_read() and then netfs_put_request(); however, netfs_unbuffered_read() can also fail early before submitting the I/O request, therefore another netfs_put_request() call must be added there. A rule of thumb is that functions that return a `netfs_io_request` do not submit I/O, and all of their callers must be checked. For my taste, the whole netfs code needs an overhaul to make reference counting easier to understand and less fragile & obscure. But to fix this bug here and now and produce a patch that is adequate for a stable backport, I tried a minimal approach that quickly frees the request object upon early failure. I decided against adding a second netfs_put_request() each time because that would cause code duplication which obscures the code further. Instead, I added the function netfs_put_failed_request() which frees such a failed request synchronously under the assumption that the reference count is exactly 2 (as initially set by netfs_alloc_request() and never touched), verified by a WARN_ON_ONCE(). It then deinitializes the request object (without going through the "cleanup_work" indirection) and frees the allocation (with RCU protection to protect against concurrent access by netfs_requests_seq_start()). All code paths that fail early have been changed to call netfs_put_failed_request() instead of netfs_put_request(). Additionally, I have added a netfs_put_request() call to netfs_unbuffered_read() as explained above because the netfs_put_failed_request() approach does not work there. Fixes: 20d72b00ca81 ("netfs: Fix the request's work item to not require a ref") Signed-off-by: Max Kellermann Signed-off-by: David Howells cc: Paulo Alcantara cc: netfs@lists.linux.dev cc: linux-fsdevel@vger.kernel.org cc: stable@vger.kernel.org Signed-off-by: Christian Brauner commit ec73e5984e01bfdf92234eaf5a2c3e54aa67f2aa Merge: 366a9295079731 77c8ede611c6a7 Author: Dave Airlie Date: Fri Sep 26 14:12:28 2025 +1000 Merge tag 'drm-xe-fixes-2025-09-25' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Don't expose sysfs attributes not applicable for VFs (Michal) - Fix build with CONFIG_MODULES=n (Lucas) - Don't copy pinned kernel bos twice on suspend (Thomas) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aNU-FkJEcA3T4aDB@intel.com commit 366a9295079731654bf0e0c6c5ac47b1f346b410 Merge: 4d486a51772421 7d9c3442b02ab7 Author: Dave Airlie Date: Fri Sep 26 14:05:01 2025 +1000 Merge tag 'drm-misc-fixes-2025-09-25' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A CPU stall fix for ast, a NULL pointer dereference fix for gma500, an OOB and overflow fixes for fbcon, and a race condition fix for panthor. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250925-smilodon-of-luxurious-genius-4ebee7@penduick commit 4d486a51772421b1c6e37e6bfec9b3c60af58dba Merge: 29ecd47927754e 7f97a0a871d953 Author: Dave Airlie Date: Fri Sep 26 13:56:21 2025 +1000 Merge tag 'drm-intel-fixes-2025-09-25' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Set O_LARGEFILE in __create_shmem() (Taotao Chen) - Guard reg_val against a INVALID_TRANSCODER [ddi] (Suraj Kandpal) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://lore.kernel.org/r/aNTxWfhsMkFZ3Q-a@linux commit 29ecd47927754e88f9f9a75bb2a497dd5e38301b Merge: 07e27ad16399af 41b1f9fcba62b0 Author: Dave Airlie Date: Fri Sep 26 13:36:24 2025 +1000 Merge tag 'amd-drm-fixes-6.17-2025-09-24' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.17-2025-09-24: amdgpu: - Backlight fix - DC preblend fix - DCN 3.5 fix - Cleanup output_tf_change Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250924200632.531102-1-alexander.deucher@amd.com commit 7e89979f6695fb56e8739b7d19614256e637131d Author: Andrew Morton Date: Sat Sep 13 17:03:39 2025 -0700 include/linux/pgtable.h: convert arch_enter_lazy_mmu_mode() and friends to static inlines commit c519c3c0a113 ("mm/kasan: avoid lazy MMU mode hazards") introduced the use of arch_enter_lazy_mmu_mode(), which results in the compiler complaining about "statement has no effect", when __HAVE_ARCH_LAZY_MMU_MODE is not defined in include/linux/pgtable.h The exact warning/error is: In file included from ./include/linux/kasan.h:37, from mm/kasan/shadow.c:14: mm/kasan/shadow.c: In function kasan_populate_vmalloc_pte: ./include/linux/pgtable.h:247:41: error: statement with no effect [-Werror=unused-value] 247 | #define arch_enter_lazy_mmu_mode() (LAZY_MMU_DEFAULT) | ^ mm/kasan/shadow.c:322:9: note: in expansion of macro arch_enter_lazy_mmu_mode> 322 | arch_enter_lazy_mmu_mode(); | ^~~~~~~~~~~~~~~~~~~~~~~~ switching these "functions" to static inlines fixes this up. Fixes: c519c3c0a113 ("mm/kasan: avoid lazy MMU mode hazards") Reported-by: Balbir Singh Closes: https://lkml.kernel.org/r/20250912235515.367061-1-balbirs@nvidia.com Cc: Alexander Gordeev Cc: Andrey Ryabinin Signed-off-by: Andrew Morton commit 06195ee967d06ead757f9291bbaf1a0b30fa10b8 Author: Akinobu Mita Date: Sat Sep 20 22:25:46 2025 +0900 mm/damon/sysfs: do not ignore callback's return value in damon_sysfs_damon_call() The callback return value is ignored in damon_sysfs_damon_call(), which means that it is not possible to detect invalid user input when writing commands such as 'commit' to /sys/kernel/mm/damon/admin/kdamonds//state. Fix it. Link: https://lkml.kernel.org/r/20250920132546.5822-1-akinobu.mita@gmail.com Fixes: f64539dcdb87 ("mm/damon/sysfs: use damon_call() for update_schemes_stats") Signed-off-by: Akinobu Mita Reviewed-by: SeongJae Park Cc: [6.14+] Signed-off-by: Andrew Morton commit 87e1c7c9a09604ac6a8f6ccf3086aec24a76e5a9 Author: Bence Csókás Date: Mon Sep 15 11:05:42 2025 +0200 mailmap: add entry for Bence Csókás I will be leaving Prolan this week. You can reach me by my personal email for now. Link: https://lkml.kernel.org/r/20250915-mailmap-v1-1-9ebdea93c6a7@prolan.hu Signed-off-by: Bence Csókás Cc: Arnd Bergmann Signed-off-by: Andrew Morton commit 28aa29986dde79e8466bc87569141291053833f5 Author: Jakub Acs Date: Mon Sep 22 08:22:05 2025 +0000 fs/proc/task_mmu: check p->vec_buf for NULL When the PAGEMAP_SCAN ioctl is invoked with vec_len = 0 reaches pagemap_scan_backout_range(), kernel panics with null-ptr-deref: [ 44.936808] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 44.937797] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 44.938391] CPU: 1 UID: 0 PID: 2480 Comm: reproducer Not tainted 6.17.0-rc6 #22 PREEMPT(none) [ 44.939062] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 44.939935] RIP: 0010:pagemap_scan_thp_entry.isra.0+0x741/0xa80 [ 44.946828] Call Trace: [ 44.947030] [ 44.949219] pagemap_scan_pmd_entry+0xec/0xfa0 [ 44.952593] walk_pmd_range.isra.0+0x302/0x910 [ 44.954069] walk_pud_range.isra.0+0x419/0x790 [ 44.954427] walk_p4d_range+0x41e/0x620 [ 44.954743] walk_pgd_range+0x31e/0x630 [ 44.955057] __walk_page_range+0x160/0x670 [ 44.956883] walk_page_range_mm+0x408/0x980 [ 44.958677] walk_page_range+0x66/0x90 [ 44.958984] do_pagemap_scan+0x28d/0x9c0 [ 44.961833] do_pagemap_cmd+0x59/0x80 [ 44.962484] __x64_sys_ioctl+0x18d/0x210 [ 44.962804] do_syscall_64+0x5b/0x290 [ 44.963111] entry_SYSCALL_64_after_hwframe+0x76/0x7e vec_len = 0 in pagemap_scan_init_bounce_buffer() means no buffers are allocated and p->vec_buf remains set to NULL. This breaks an assumption made later in pagemap_scan_backout_range(), that page_region is always allocated for p->vec_buf_index. Fix it by explicitly checking p->vec_buf for NULL before dereferencing. Other sites that might run into same deref-issue are already (directly or transitively) protected by checking p->vec_buf. Note: From PAGEMAP_SCAN man page, it seems vec_len = 0 is valid when no output is requested and it's only the side effects caller is interested in, hence it passes check in pagemap_scan_get_args(). This issue was found by syzkaller. Link: https://lkml.kernel.org/r/20250922082206.6889-1-acsjakub@amazon.de Fixes: 52526ca7fdb9 ("fs/proc/task_mmu: implement IOCTL to get and optionally clear info about PTEs") Signed-off-by: Jakub Acs Reviewed-by: Muhammad Usama Anjum Acked-by: David Hildenbrand Cc: Vlastimil Babka Cc: Lorenzo Stoakes Cc: Jinjiang Tu Cc: Suren Baghdasaryan Cc: Penglei Jiang Cc: Mark Brown Cc: Baolin Wang Cc: Ryan Roberts Cc: Andrei Vagin Cc: "Michał Mirosław" Cc: Stephen Rothwell Cc: Signed-off-by: Andrew Morton commit 85e1ff61060a765d91ee62dc5606d4d547d9d105 Author: Eric Biggers Date: Thu Sep 11 12:58:58 2025 -0700 kmsan: fix out-of-bounds access to shadow memory Running sha224_kunit on a KMSAN-enabled kernel results in a crash in kmsan_internal_set_shadow_origin(): BUG: unable to handle page fault for address: ffffbc3840291000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 1810067 P4D 1810067 PUD 192d067 PMD 3c17067 PTE 0 Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 81 Comm: kunit_try_catch Tainted: G N 6.17.0-rc3 #10 PREEMPT(voluntary) Tainted: [N]=TEST Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 RIP: 0010:kmsan_internal_set_shadow_origin+0x91/0x100 [...] Call Trace: __msan_memset+0xee/0x1a0 sha224_final+0x9e/0x350 test_hash_buffer_overruns+0x46f/0x5f0 ? kmsan_get_shadow_origin_ptr+0x46/0xa0 ? __pfx_test_hash_buffer_overruns+0x10/0x10 kunit_try_run_case+0x198/0xa00 This occurs when memset() is called on a buffer that is not 4-byte aligned and extends to the end of a guard page, i.e. the next page is unmapped. The bug is that the loop at the end of kmsan_internal_set_shadow_origin() accesses the wrong shadow memory bytes when the address is not 4-byte aligned. Since each 4 bytes are associated with an origin, it rounds the address and size so that it can access all the origins that contain the buffer. However, when it checks the corresponding shadow bytes for a particular origin, it incorrectly uses the original unrounded shadow address. This results in reads from shadow memory beyond the end of the buffer's shadow memory, which crashes when that memory is not mapped. To fix this, correctly align the shadow address before accessing the 4 shadow bytes corresponding to each origin. Link: https://lkml.kernel.org/r/20250911195858.394235-1-ebiggers@kernel.org Fixes: 2ef3cec44c60 ("kmsan: do not wipe out origin when doing partial unpoisoning") Signed-off-by: Eric Biggers Tested-by: Alexander Potapenko Reviewed-by: Alexander Potapenko Cc: Dmitriy Vyukov Cc: Marco Elver Cc: Signed-off-by: Andrew Morton commit 14967a9c7d247841b0312c48dcf8cd29e55a4cc8 Author: Jane Chu Date: Mon Sep 15 18:45:20 2025 -0600 mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count commit 59d9094df3d79 ("mm: hugetlb: independent PMD page table shared count") introduced ->pt_share_count dedicated to hugetlb PMD share count tracking, but omitted fixing copy_hugetlb_page_range(), leaving the function relying on page_count() for tracking that no longer works. When lazy page table copy for hugetlb is disabled, that is, revert commit bcd51a3c679d ("hugetlb: lazy page table copies in fork()") fork()'ing with hugetlb PMD sharing quickly lockup - [ 239.446559] watchdog: BUG: soft lockup - CPU#75 stuck for 27s! [ 239.446611] RIP: 0010:native_queued_spin_lock_slowpath+0x7e/0x2e0 [ 239.446631] Call Trace: [ 239.446633] [ 239.446636] _raw_spin_lock+0x3f/0x60 [ 239.446639] copy_hugetlb_page_range+0x258/0xb50 [ 239.446645] copy_page_range+0x22b/0x2c0 [ 239.446651] dup_mmap+0x3e2/0x770 [ 239.446654] dup_mm.constprop.0+0x5e/0x230 [ 239.446657] copy_process+0xd17/0x1760 [ 239.446660] kernel_clone+0xc0/0x3e0 [ 239.446661] __do_sys_clone+0x65/0xa0 [ 239.446664] do_syscall_64+0x82/0x930 [ 239.446668] ? count_memcg_events+0xd2/0x190 [ 239.446671] ? syscall_trace_enter+0x14e/0x1f0 [ 239.446676] ? syscall_exit_work+0x118/0x150 [ 239.446677] ? arch_exit_to_user_mode_prepare.constprop.0+0x9/0xb0 [ 239.446681] ? clear_bhb_loop+0x30/0x80 [ 239.446684] ? clear_bhb_loop+0x30/0x80 [ 239.446686] entry_SYSCALL_64_after_hwframe+0x76/0x7e There are two options to resolve the potential latent issue: 1. warn against PMD sharing in copy_hugetlb_page_range(), 2. fix it. This patch opts for the second option. While at it, simplify the comment, the details are not actually relevant anymore. Link: https://lkml.kernel.org/r/20250916004520.1604530-1-jane.chu@oracle.com Fixes: 59d9094df3d7 ("mm: hugetlb: independent PMD page table shared count") Signed-off-by: Jane Chu Reviewed-by: Harry Yoo Acked-by: Oscar Salvador Acked-by: David Hildenbrand Cc: Jann Horn Cc: Liu Shixin Cc: Muchun Song Signed-off-by: Andrew Morton commit 7b7387650dcf2881fd8bb55bcf3c8bd6c9542dd7 Author: Jinjiang Tu Date: Fri Sep 12 15:41:39 2025 +0800 mm/hugetlb: fix folio is still mapped when deleted Migration may be raced with fallocating hole. remove_inode_single_folio will unmap the folio if the folio is still mapped. However, it's called without folio lock. If the folio is migrated and the mapped pte has been converted to migration entry, folio_mapped() returns false, and won't unmap it. Due to extra refcount held by remove_inode_single_folio, migration fails, restores migration entry to normal pte, and the folio is mapped again. As a result, we triggered BUG in filemap_unaccount_folio. The log is as follows: BUG: Bad page cache in process hugetlb pfn:156c00 page: refcount:515 mapcount:0 mapping:0000000099fef6e1 index:0x0 pfn:0x156c00 head: order:9 mapcount:1 entire_mapcount:1 nr_pages_mapped:0 pincount:0 aops:hugetlbfs_aops ino:dcc dentry name(?):"my_hugepage_file" flags: 0x17ffffc00000c1(locked|waiters|head|node=0|zone=2|lastcpupid=0x1fffff) page_type: f4(hugetlb) page dumped because: still mapped when deleted CPU: 1 UID: 0 PID: 395 Comm: hugetlb Not tainted 6.17.0-rc5-00044-g7aac71907bde-dirty #484 NONE Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 Call Trace: dump_stack_lvl+0x4f/0x70 filemap_unaccount_folio+0xc4/0x1c0 __filemap_remove_folio+0x38/0x1c0 filemap_remove_folio+0x41/0xd0 remove_inode_hugepages+0x142/0x250 hugetlbfs_fallocate+0x471/0x5a0 vfs_fallocate+0x149/0x380 Hold folio lock before checking if the folio is mapped to avold race with migration. Link: https://lkml.kernel.org/r/20250912074139.3575005-1-tujinjiang@huawei.com Fixes: 4aae8d1c051e ("mm/hugetlbfs: unmap pages if page fault raced with hole punch") Signed-off-by: Jinjiang Tu Cc: David Hildenbrand Cc: Kefeng Wang Cc: Matthew Wilcox (Oracle) Cc: Muchun Song Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit 4ff71af020ae59ae2d83b174646fc2ad9fcd4dc4 Merge: 93a274456158f1 d9c70e93ec5988 Author: Linus Torvalds Date: Thu Sep 25 08:23:52 2025 -0700 Merge tag 'net-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth, IPsec and CAN. No known regressions at this point. Current release - regressions: - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI Previous releases - regressions: - xfrm: fix offloading of cross-family tunnels - bluetooth: fix several races leading to UaFs - dsa: lantiq_gswip: fix FDB entries creation for the CPU port - eth: - tun: update napi->skb after XDP process - mlx: fix UAF in flow counter release Previous releases - always broken: - core: forbid FDB status change while nexthop is in a group - smc: fix warning in smc_rx_splice() when calling get_page() - can: provide missing ndo_change_mtu(), to prevent buffer overflow. - eth: - i40e: fix VF config validation - broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl" * tag 'net-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (40 commits) octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() libie: fix string names for AQ error codes net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD net/mlx5: HWS, ignore flow level for multi-dest table net/mlx5: fs, fix UAF in flow counter release selftests: fib_nexthops: Add test cases for FDB status change selftests: fib_nexthops: Fix creation of non-FDB nexthops nexthop: Forbid FDB status change while nexthop is in a group net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS bnxt_en: correct offset handling for IPv6 destination address ptp: document behavior of PTP_STRICT_FLAGS broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl broadcom: fix support for PTP_PEROUT_DUTY_CYCLE Bluetooth: MGMT: Fix possible UAFs Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue Bluetooth: hci_sync: Fix hci_resume_advertising_sync Bluetooth: Fix build after header cleanup ... commit 93a274456158f178aa713fbb60642e0094e6065e Merge: bf40f4b87761e2 cde7e7c3f8745a Author: Linus Torvalds Date: Thu Sep 25 08:06:03 2025 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio fixes from Michael Tsirkin: "virtio,vhost: last minute fixes More small fixes. Most notably this fixes crashes and hangs in vhost-net" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: MAINTAINERS, mailmap: Update address for Peter Hilber virtio_config: clarify output parameters uapi: vduse: fix typo in comment vhost: Take a reference on the task in struct vhost_task. vhost-net: flush batched before enabling notifications Revert "vhost/net: Defer TX queue re-enable until after sendmsg" vhost-net: unbreak busy polling vhost-scsi: fix argument order in tport allocation error message commit 3ed17349f18774c24505b0c21dfbd3cc4f126518 Author: Daniel Lee Date: Wed Sep 24 14:17:17 2025 -0400 platform/x86: lg-laptop: Fix WMAB call in fan_mode_store() When WMAB is called to set the fan mode, the new mode is read from either bits 0-1 or bits 4-5 (depending on the value of some other EC register). Thus when WMAB is called with bits 4-5 zeroed and called again with bits 0-1 zeroed, the second call undoes the effect of the first call. This causes writes to /sys/devices/platform/lg-laptop/fan_mode to have no effect (and causes reads to always report a status of zero). Fix this by calling WMAB once, with the mode set in bits 0,1 and 4,5. When the fan mode is returned from WMAB it always has this form, so there is no need to preserve the other bits. As a bonus, the driver now supports the "Performance" fan mode seen in the LG-provided Windows control app, which provides less aggressive CPU throttling but louder fan noise and shorter battery life. Also, correct the documentation to reflect that 0 corresponds to the default mode (what the Windows app calls "Optimal") and 1 corresponds to the silent mode. Fixes: dbf0c5a6b1f8 ("platform/x86: Add LG Gram laptop special features driver") Link: https://bugzilla.kernel.org/show_bug.cgi?id=204913#c4 Signed-off-by: Daniel Lee Link: https://patch.msgid.link/MN2PR06MB55989CB10E91C8DA00EE868DDC1CA@MN2PR06MB5598.namprd06.prod.outlook.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d9c70e93ec5988ab07ad2a92d9f9d12867f02c56 Author: Dan Carpenter Date: Tue Sep 23 14:19:11 2025 +0300 octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() This code calls kfree_rcu(new_node, rcu) and then dereferences "new_node" and then dereferences it on the next line. Two lines later, we take a mutex so I don't think this is an RCU safe region. Re-order it to do the dereferences before queuing up the free. Fixes: 68fbff68dbea ("octeontx2-pf: Add police action for TC flower") Signed-off-by: Dan Carpenter Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/aNKCL1jKwK8GRJHh@stanley.mountain Signed-off-by: Paolo Abeni commit 7d9c3442b02ab7dd3c44e20095a178fd57d2eccb Author: Adrián Larumbe Date: Fri Sep 19 17:43:48 2025 +0100 drm/panthor: Defer scheduler entitiy destruction to queue release Commit de8548813824 ("drm/panthor: Add the scheduler logical block") handled destruction of a group's queues' drm scheduler entities early into the group destruction procedure. However, that races with the group submit ioctl, because by the time entities are destroyed (through the group destroy ioctl), the submission procedure might've already obtained a group handle, and therefore the ability to push jobs into entities. This is met with a DRM error message within the drm scheduler core as a situation that should never occur. Fix by deferring drm scheduler entity destruction to queue release time. Fixes: de8548813824 ("drm/panthor: Add the scheduler logical block") Signed-off-by: Adrián Larumbe Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250919164436.531930-1-adrian.larumbe@collabora.com commit 764a47a639c73e8d941cbbb10696a0eb98d10d7b Merge: b7e32ae6664285 987afe147965ef Author: Paolo Abeni Date: Thu Sep 25 10:29:22 2025 +0200 Merge branch 'lantiq_gswip-fixes' Vladimir Oltean says: ==================== lantiq_gswip fixes This is a small set of fixes which I believe should be backported for the lantiq_gswip driver. Daniel Golle asked me to submit them here: https://lore.kernel.org/netdev/aLiDfrXUbw1O5Vdi@pidgin.makrotopia.org/ As mentioned there, a merge conflict with net-next is expected, due to the movement of the driver to the 'drivers/net/dsa/lantiq' folder there. Good luck :-/ Patch 2/2 fixes an old regression and is the minimal fix for that, as discussed here: https://lore.kernel.org/netdev/aJfNMLNoi1VOsPrN@pidgin.makrotopia.org/ Patch 1/2 was identified by me through static analysis, and I consider it to be a serious deficiency. It needs a test tag. ==================== Link: https://patch.msgid.link/20250918072142.894692-1-vladimir.oltean@nxp.com Signed-off-by: Paolo Abeni commit 987afe147965ef7a8e7d144ffef0d70af14bb1d4 Author: Vladimir Oltean Date: Thu Sep 18 10:21:42 2025 +0300 net: dsa: lantiq_gswip: suppress -EINVAL errors for bridge FDB entries added to the CPU port The blamed commit and others in that patch set started the trend of reusing existing DSA driver API for a new purpose: calling ds->ops->port_fdb_add() on the CPU port. The lantiq_gswip driver was not prepared to handle that, as can be seen from the many errors that Daniel presents in the logs: [ 174.050000] gswip 1e108000.switch: port 2 failed to add fa:aa:72:f4:8b:1e vid 1 to fdb: -22 [ 174.060000] gswip 1e108000.switch lan2: entered promiscuous mode [ 174.070000] gswip 1e108000.switch: port 2 failed to add 00:01:02:03:04:02 vid 0 to fdb: -22 [ 174.090000] gswip 1e108000.switch: port 2 failed to add 00:01:02:03:04:02 vid 1 to fdb: -22 [ 174.090000] gswip 1e108000.switch: port 2 failed to delete fa:aa:72:f4:8b:1e vid 1 from fdb: -2 The errors are because gswip_port_fdb() wants to get a handle to the bridge that originated these FDB events, to associate it with a FID. Absolutely honourable purpose, however this only works for user ports. To get the bridge that generated an FDB entry for the CPU port, one would need to look at the db.bridge.dev argument. But this was introduced in commit c26933639b54 ("net: dsa: request drivers to perform FDB isolation"), first appeared in v5.18, and when the blamed commit was introduced in v5.14, no such API existed. So the core DSA feature was introduced way too soon for lantiq_gswip. Not acting on these host FDB entries and suppressing any errors has no other negative effect, and practically returns us to not supporting the host filtering feature at all - peacefully, this time. Fixes: 10fae4ac89ce ("net: dsa: include bridge addresses which are local in the host fdb list") Reported-by: Daniel Golle Closes: https://lore.kernel.org/netdev/aJfNMLNoi1VOsPrN@pidgin.makrotopia.org/ Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250918072142.894692-3-vladimir.oltean@nxp.com Tested-by: Daniel Golle Reviewed-by: Daniel Golle Signed-off-by: Paolo Abeni commit c0054b25e2f1045f47b4954cf13a539e5e6047df Author: Vladimir Oltean Date: Thu Sep 18 10:21:41 2025 +0300 net: dsa: lantiq_gswip: move gswip_add_single_port_br() call to port_setup() A port added to a "single port bridge" operates as standalone, and this is mutually exclusive to being part of a Linux bridge. In fact, gswip_port_bridge_join() calls gswip_add_single_port_br() with add=false, i.e. removes the port from the "single port bridge" to enable autonomous forwarding. The blamed commit seems to have incorrectly thought that ds->ops->port_enable() is called one time per port, during the setup phase of the switch. However, it is actually called during the ndo_open() implementation of DSA user ports, which is to say that this sequence of events: 1. ip link set swp0 down 2. ip link add br0 type bridge 3. ip link set swp0 master br0 4. ip link set swp0 up would cause swp0 to join back the "single port bridge" which step 3 had just removed it from. The correct DSA hook for one-time actions per port at switch init time is ds->ops->port_setup(). This is what seems to match the coder's intention; also see the comment at the beginning of the file: * At the initialization the driver allocates one bridge table entry for ~~~~~~~~~~~~~~~~~~~~~ * each switch port which is used when the port is used without an * explicit bridge. Fixes: 8206e0ce96b3 ("net: dsa: lantiq: Add VLAN unaware bridge offloading") Signed-off-by: Vladimir Oltean Link: https://patch.msgid.link/20250918072142.894692-2-vladimir.oltean@nxp.com Tested-by: Daniel Golle Reviewed-by: Daniel Golle Signed-off-by: Paolo Abeni commit a3a70caf7906708bf9bbc80018752a6b36543808 Author: Peter Zijlstra Date: Wed Sep 17 12:03:20 2025 +0200 sched/deadline: Fix dl_server behaviour John reported undesirable behaviour with the dl_server since commit: cccb45d7c4295 ("sched/deadline: Less agressive dl_server handling"). When starving fair tasks on purpose (starting spinning FIFO tasks), his fair workload, which often goes (briefly) idle, would delay fair invocations for a second, running one invocation per second was both unexpected and terribly slow. The reason this happens is that when dl_se->server_pick_task() returns NULL, indicating no runnable tasks, it would yield, pushing any later jobs out a whole period (1 second). Instead simply stop the server. This should restore behaviour in that a later wakeup (which restarts the server) will be able to continue running (subject to the CBS wakeup rules). Notably, this does not re-introduce the behaviour cccb45d7c4295 set out to solve, any start/stop cycle is naturally throttled by the timer period (no active cancel). Fixes: cccb45d7c4295 ("sched/deadline: Less agressive dl_server handling") Reported-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Peter Zijlstra (Intel) Tested-by: John Stultz commit 4ae8d9aa9f9dc7137ea5e564d79c5aa5af1bc45c Author: Peter Zijlstra Date: Tue Sep 16 23:02:41 2025 +0200 sched/deadline: Fix dl_server getting stuck John found it was easy to hit lockup warnings when running locktorture on a 2 CPU VM, which he bisected down to: commit cccb45d7c429 ("sched/deadline: Less agressive dl_server handling"). While debugging it seems there is a chance where we end up with the dl_server dequeued, with dl_se->dl_server_active. This causes dl_server_start() to return without enqueueing the dl_server, thus it fails to run when RT tasks starve the cpu. When this happens, dl_server_timer() catches the '!dl_se->server_has_tasks(dl_se)' case, which then calls replenish_dl_entity() and dl_server_stopped() and finally return HRTIMER_NO_RESTART. This ends in no new timer and also no enqueue, leaving the dl_server 'dead', allowing starvation. What should have happened is for the bandwidth timer to start the zero-laxity timer, which in turn would enqueue the dl_server and cause dl_se->server_pick_task() to be called -- which will stop the dl_server if no fair tasks are observed for a whole period. IOW, it is totally irrelevant if there are fair tasks at the moment of bandwidth refresh. This removes all dl_se->server_has_tasks() users, so remove the whole thing. Fixes: cccb45d7c4295 ("sched/deadline: Less agressive dl_server handling") Reported-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Peter Zijlstra (Intel) Tested-by: John Stultz commit 9158c6bb245113d4966df9b2ba602197a379412e Author: Zhen Ni Date: Tue Sep 23 15:51:04 2025 +0800 afs: Fix potential null pointer dereference in afs_put_server afs_put_server() accessed server->debug_id before the NULL check, which could lead to a null pointer dereference. Move the debug_id assignment, ensuring we never dereference a NULL server pointer. Fixes: 2757a4dc1849 ("afs: Fix access after dec in put functions") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni Acked-by: David Howells Reviewed-by: Jeffrey Altman Signed-off-by: Christian Brauner commit bf40f4b87761e2ec16efc8e49b9ca0d81f4115d8 Merge: d0ca0df179c4b2 456c32e3c43166 Author: Linus Torvalds Date: Wed Sep 24 19:17:07 2025 -0700 Merge tag 'probes-fixes-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fixes from Masami Hiramatsu: - fprobe: Even if there is a memory allocation failure, try to remove the addresses recorded until then from the filter. Previously we just skipped it. - tracing: dynevent: Add a missing lockdown check on dynevent. This dynevent is the interface for all probe events. Thus if there is no check, any probe events can be added after lock down the tracefs. * tag 'probes-fixes-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: dynevent: Add a missing lockdown check on dynevent tracing: fprobe: Fix to remove recorded module addresses from filter commit b7e32ae6664285e156e9f0cd821e63e19798baf7 Author: Jacob Keller Date: Tue Sep 23 13:56:56 2025 -0700 libie: fix string names for AQ error codes The LIBIE_AQ_STR macro() introduced by commit 5feaa7a07b85 ("libie: add adminq helper for converting err to str") is used in order to generate strings for printing human readable error codes. Its definition is missing the separating underscore ('_') character which makes the resulting strings difficult to read. Additionally, the string won't match the source code, preventing search tools from working properly. Add the missing underscore character, fixing the error string names. Signed-off-by: Jacob Keller Fixes: 5feaa7a07b85 ("libie: add adminq helper for converting err to str") Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20250923205657.846759-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit d0ca0df179c4b21e2a6c4a4fb637aa8fa14575cb Author: Eric Biggers Date: Wed Sep 24 13:18:22 2025 -0700 crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg") changed some fields from bool to 1-bit bitfields of type u32. However, some assignments to these fields, specifically 'more' and 'merge', assign values greater than 1. These relied on C's implicit conversion to bool, such that zero becomes false and nonzero becomes true. With a 1-bit bitfields of type u32 instead, mod 2 of the value is taken instead, resulting in 0 being assigned in some cases when 1 was intended. Fix this by restoring the bool type. Fixes: 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Linus Torvalds commit ea78c190810ecd2c9dfb6d22b52fc670a38e8836 Merge: 4ea5af08590825 13923775d5b0b4 Author: Linus Torvalds Date: Wed Sep 24 14:37:44 2025 -0700 Merge tag 'soc-fixes-6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "There are a few minor code fixes for tegra firmware, i.MX firmware and the eyeq reset controller, and a MAINTAINERS update as Alyssa Rosenzweig moves on to non-kernel projects. The other changes are all for devicetree files: - Multiple Marvell Armada SoCs need changes to fix PCIe, audio and SATA - A socfpga board fails to probe the ethernet phy - The two temperature sensors on i.MX8MP are swapped - Allwinner devicetree files cause build-time warnings - Two Rockchip based boards need corrections for headphone detection and SPI flash" * tag 'soc-fixes-6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: MAINTAINERS: remove Alyssa Rosenzweig firmware: tegra: Do not warn on missing memory-region property arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes arm64: dts: marvell: cn913x-solidrun: fix sata ports status ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients arm64: dts: imx8mp: Correct thermal sensor index ARM: imx: Kconfig: Adjust select after renamed config option firmware: imx: Add stub functions for SCMI CPU API firmware: imx: Add stub functions for SCMI LMM API firmware: imx: Add stub functions for SCMI MISC API riscv: dts: allwinner: rename devterm i2c-gpio node to comply with binding arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 arm64: dts: rockchip: Add vcc supply for SPI Flash on NanoPC-T6 ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address reset: eyeq: fix OF node leak ARM64: dts: mcbin: fix SATA ports on Macchiatobin ARM: dts: armada-370-db: Fix stereo audio input routing on Armada 370 ARM: dts: allwinner: Minor whitespace cleanup commit 4ea5af08590825c79ba2f146482ed54443e22c28 Merge: 74c7cc79aadf40 8ffe28b4e8d8b1 Author: Linus Torvalds Date: Wed Sep 24 11:14:53 2025 -0700 Merge tag 'pm-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Rafael: "Fix a locking issue in the cpufreq core introduced recently and caught by lockdep (Christian Loehle)" * tag 'pm-6.17-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: Initialize cpufreq-based invariance before subsys commit 74c7cc79aadf40fc14cfa04379693d2a3751e6e5 Merge: fd7d927587c7db 53de7ee4e28f6e Author: Linus Torvalds Date: Wed Sep 24 11:09:09 2025 -0700 Merge tag 'for-6.17-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "One more regression fix for a problem in zoned mode: mounting would fail if the number of open and active zones reached a common limit that didn't use to be checked" * tag 'for-6.17-rc7-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: zoned: don't fail mount needlessly due to too many active zones commit fd7d927587c7db5005d90623447c5d3b7750533d Merge: cec1e6e5d1ab33 f7f89250175e0a Author: Linus Torvalds Date: Wed Sep 24 10:44:50 2025 -0700 Merge tag '6.17-rc7-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - free_transport fix for disconnect races - minor delayed work fix * tag '6.17-rc7-ksmbd-server-fixes' of git://git.samba.org/ksmbd: smb: server: use disable_work_sync in transport_rdma.c smb: server: don't use delayed_work for post_recv_credits_work commit 456c32e3c4316654f95f9d49c12cbecfb77d5660 Author: Masami Hiramatsu (Google) Date: Fri Sep 19 10:15:56 2025 +0900 tracing: dynevent: Add a missing lockdown check on dynevent Since dynamic_events interface on tracefs is compatible with kprobe_events and uprobe_events, it should also check the lockdown status and reject if it is set. Link: https://lore.kernel.org/all/175824455687.45175.3734166065458520748.stgit@devnote2/ Fixes: 17911ff38aa5 ("tracing: Add locked_down checks to the open calls of files created for tracefs") Signed-off-by: Masami Hiramatsu (Google) Cc: stable@vger.kernel.org commit c539feff3c8f8c86213eee2b237410714712c326 Author: Masami Hiramatsu (Google) Date: Wed Sep 24 09:26:39 2025 +0900 tracing: fprobe: Fix to remove recorded module addresses from filter Even if there is a memory allocation failure in fprobe_addr_list_add(), there is a partial list of module addresses. So remove the recorded addresses from filter if exists. This also removes the redundant ret local variable. Fixes: a3dc2983ca7b ("tracing: fprobe: Cleanup fprobe hash when module unloading") Signed-off-by: Masami Hiramatsu (Google) Cc: stable@vger.kernel.org Reviewed-by: Menglong Dong commit e2ffa15b9baa447e444d654ffd47123ba6443ae4 Author: Thomas Gleixner Date: Tue Sep 16 15:21:51 2025 +0200 kbuild: Disable CC_HAS_ASM_GOTO_OUTPUT on clang < 17 clang < 17 fails to use scope local labels with CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y: { __label__ local_lbl; ... unsafe_get_user(uval, uaddr, local_lbl); ... return 0; local_lbl: return -EFAULT; } when two such scopes exist in the same function: error: cannot jump from this asm goto statement to one of its possible targets There are other failure scenarios. Shuffling code around slightly makes it worse and fail even with one instance. That issue prevents using local labels for a cleanup based user access mechanism. After failed attempts to provide a simple enough test case for the 'depends on' test in Kconfig, the initial cure was to mark ASM goto broken on clang versions < 17 to get this road block out of the way. But Nathan pointed out that this is a known clang issue and indeed affects clang < version 17 in combination with cleanup(). It's not even required to use local labels for that. The clang issue tracker has a small enough test case, which can be used as a test in the 'depends on' section of CC_HAS_ASM_GOTO_OUTPUT: void bar(void **); void* baz(void); int foo (void) { { asm goto("jmp %l0"::::l0); return 0; l0: return 1; } void *x __attribute__((cleanup(bar))) = baz(); { asm goto("jmp %l0"::::l1); return 42; l1: return 0xff; } } Add another dependency to config CC_HAS_ASM_GOTO_OUTPUT for it and use the clang issue tracker test case for detection by condensing it to obfuscated C-code contest format. This reliably catches the problem on clang < 17 and did not show any issues on the non broken GCC versions. That test might be sufficient to catch all issues and therefore could replace the existing test, but keeping that around does no harm either. Thanks to Nathan for pointing to the relevant clang issue! Suggested-by: Nathan Chancellor Signed-off-by: Thomas Gleixner Cc: Nathan Chancellor Reviewed-by: Nathan Chancellor Link: https://github.com/ClangBuiltLinux/linux/issues/1886 Link: https://github.com/llvm/llvm-project/commit/f023f5cdb2e6c19026f04a15b5a935c041835d14 commit 4ec3c15462b9f44562f45723a92e2807746ba7d1 Author: Sebastian Andrzej Siewior Date: Thu Sep 18 15:09:45 2025 +0200 futex: Use correct exit on failure from futex_hash_allocate_default() copy_process() uses the wrong error exit path from futex_hash_allocate_default(). After exiting from futex_hash_allocate_default(), neither tasklist_lock nor siglock has been acquired. The exit label bad_fork_core_free unlocks both of these locks which is wrong. The next exit label, bad_fork_cancel_cgroup, is the correct exit. sched_cgroup_fork() did not allocate any resources that need to freed. Use bad_fork_cancel_cgroup on error exit from futex_hash_allocate_default(). Fixes: 7c4f75a21f636 ("futex: Allow automatic allocation of process wide futex hash") Reported-by: syzbot+80cb3cc5c14fad191a10@syzkaller.appspotmail.com Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Reviewed-by: Steven Rostedt (Google) Closes: https://lore.kernel.org/all/68cb1cbd.050a0220.2ff435.0599.GAE@google.com commit e24108012ce9662d90093f91d5ffebcbf78da7de Author: Paul Walmsley Date: Tue Sep 23 18:25:52 2025 -0600 MAINTAINERS: Update Paul Walmsley's E-mail address My experiment with using corporate Gmail for Linux kernel list interaction has come to an end. For my MAINTAINERS entries that use that E-mail address, let's switch those to use the k.org E-mail forwarding. Signed-off-by: Paul Walmsley Signed-off-by: Paul Walmsley commit 546e42c8c6d9498d5eac14bf2aca0383a11b145a Author: Alexandre Ghiti Date: Tue Sep 23 18:25:52 2025 -0600 riscv: Use an atomic xchg in pudp_huge_get_and_clear() Make sure we return the right pud value and not a value that could have been overwritten in between by a different core. Fixes: c3cc2a4a3a23 ("riscv: Add support for PUD THP") Cc: stable@vger.kernel.org Signed-off-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250814-dev-alex-thp_pud_xchg-v1-1-b4704dfae206@rivosinc.com [pjw@kernel.org: use xchg rather than atomic_long_xchg; avoid atomic op for !CONFIG_SMP like x86] Signed-off-by: Paul Walmsley commit 181d981b14bf0722d879d5d69ea4e5e0b61c5d92 Merge: 0efdfbba2e5962 6d0477d0d067a5 Author: Jakub Kicinski Date: Tue Sep 23 17:17:32 2025 -0700 Merge branch 'mlx5-misc-fixes-2025-09-22' Tariq Toukan says: ==================== mlx5 misc fixes 2025-09-22 This patchset provides misc bug fixes from the team to the mlx5 Eth and core drivers. ==================== Link: https://patch.msgid.link/1758525094-816583-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6d0477d0d067a53c1d48d0aff1fd52e151721871 Author: Carolina Jubran Date: Mon Sep 22 10:11:34 2025 +0300 net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD Include MLX5E_FEC_RS_544_514_INTERLEAVED_QUAD in the FEC RS stats handling. This addresses a gap introduced when adding support for 200G/lane link modes. Fixes: 4e343c11efbb ("net/mlx5e: Support FEC settings for 200G per lane link modes") Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Reviewed-by: Yael Chemla Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758525094-816583-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit efb877cf27e300e47e1c051f4e8fd80fc42325d5 Author: Yevgeny Kliteynik Date: Mon Sep 22 10:11:33 2025 +0300 net/mlx5: HWS, ignore flow level for multi-dest table When HWS creates multi-dest FW table and adds rules to forward to other tables, ignore the flow level enforcement in FW, because HWS is responsible for table levels. This fixes the following error: mlx5_core 0000:08:00.0: mlx5_cmd_out_err:818:(pid 192306): SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, status bad parameter(0x3), syndrome (0x6ae84c), err(-22) Fixes: 504e536d9010 ("net/mlx5: HWS, added actions handling") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Moshe Shemesh Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758525094-816583-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6043819e707cefb1c9e59d6e431dcfa735c4f975 Author: Moshe Shemesh Date: Mon Sep 22 10:11:32 2025 +0300 net/mlx5: fs, fix UAF in flow counter release Fix a kernel trace [1] caused by releasing an HWS action of a local flow counter in mlx5_cmd_hws_delete_fte(), where the HWS action refcount and mutex were not initialized and the counter struct could already be freed when deleting the rule. Fix it by adding the missing initializations and adding refcount for the local flow counter struct. [1] Kernel log: Call Trace: dump_stack_lvl+0x34/0x48 mlx5_fs_put_hws_action.part.0.cold+0x21/0x94 [mlx5_core] mlx5_fc_put_hws_action+0x96/0xad [mlx5_core] mlx5_fs_destroy_fs_actions+0x8b/0x152 [mlx5_core] mlx5_cmd_hws_delete_fte+0x5a/0xa0 [mlx5_core] del_hw_fte+0x1ce/0x260 [mlx5_core] mlx5_del_flow_rules+0x12d/0x240 [mlx5_core] ? ttwu_queue_wakelist+0xf4/0x110 mlx5_ib_destroy_flow+0x103/0x1b0 [mlx5_ib] uverbs_free_flow+0x20/0x50 [ib_uverbs] destroy_hw_idr_uobject+0x1b/0x50 [ib_uverbs] uverbs_destroy_uobject+0x34/0x1a0 [ib_uverbs] uobj_destroy+0x3c/0x80 [ib_uverbs] ib_uverbs_run_method+0x23e/0x360 [ib_uverbs] ? uverbs_finalize_object+0x60/0x60 [ib_uverbs] ib_uverbs_cmd_verbs+0x14f/0x2c0 [ib_uverbs] ? do_tty_write+0x1a9/0x270 ? file_tty_write.constprop.0+0x98/0xc0 ? new_sync_write+0xfc/0x190 ib_uverbs_ioctl+0xd7/0x160 [ib_uverbs] __x64_sys_ioctl+0x87/0xc0 do_syscall_64+0x59/0x90 Fixes: b581f4266928 ("net/mlx5: fs, manage flow counters HWS action sharing by refcount") Signed-off-by: Moshe Shemesh Reviewed-by: Yevgeny Kliteynik Reviewed-by: Mark Bloch Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1758525094-816583-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 0efdfbba2e59626b9e924efba2a50b36d14bc276 Merge: ca9f9cdc4de97d 00af023d90f908 Author: Jakub Kicinski Date: Tue Sep 23 17:01:08 2025 -0700 Merge branch 'nexthop-various-fixes' Ido Schimmel says: ==================== nexthop: Various fixes Patch #1 fixes a NPD that was recently reported by syzbot. Patch #2 fixes an issue in the existing FIB nexthop selftest. Patch #3 extends the selftest with test cases for the bug that was fixed in the first patch. ==================== Link: https://patch.msgid.link/20250921150824.149157-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 00af023d90f9087ed5a371302ab442ed5736c3b7 Author: Ido Schimmel Date: Sun Sep 21 18:08:24 2025 +0300 selftests: fib_nexthops: Add test cases for FDB status change Add the following test cases for both IPv4 and IPv6: * Can change from FDB nexthop to non-FDB nexthop and vice versa. * Can change FDB nexthop address while in a group. * Cannot change from FDB nexthop to non-FDB nexthop and vice versa while in a group. Output without "nexthop: Forbid FDB status change while nexthop is in a group": # ./fib_nexthops.sh -t "ipv6_fdb_grp_fcnal ipv4_fdb_grp_fcnal" IPv6 fdb groups functional -------------------------- [...] TEST: Replace FDB nexthop to non-FDB nexthop [ OK ] TEST: Replace non-FDB nexthop to FDB nexthop [ OK ] TEST: Replace FDB nexthop address while in a group [ OK ] TEST: Replace FDB nexthop to non-FDB nexthop while in a group [FAIL] TEST: Replace non-FDB nexthop to FDB nexthop while in a group [FAIL] [...] IPv4 fdb groups functional -------------------------- [...] TEST: Replace FDB nexthop to non-FDB nexthop [ OK ] TEST: Replace non-FDB nexthop to FDB nexthop [ OK ] TEST: Replace FDB nexthop address while in a group [ OK ] TEST: Replace FDB nexthop to non-FDB nexthop while in a group [FAIL] TEST: Replace non-FDB nexthop to FDB nexthop while in a group [FAIL] [...] Tests passed: 36 Tests failed: 4 Tests skipped: 0 Output with "nexthop: Forbid FDB status change while nexthop is in a group": # ./fib_nexthops.sh -t "ipv6_fdb_grp_fcnal ipv4_fdb_grp_fcnal" IPv6 fdb groups functional -------------------------- [...] TEST: Replace FDB nexthop to non-FDB nexthop [ OK ] TEST: Replace non-FDB nexthop to FDB nexthop [ OK ] TEST: Replace FDB nexthop address while in a group [ OK ] TEST: Replace FDB nexthop to non-FDB nexthop while in a group [ OK ] TEST: Replace non-FDB nexthop to FDB nexthop while in a group [ OK ] [...] IPv4 fdb groups functional -------------------------- [...] TEST: Replace FDB nexthop to non-FDB nexthop [ OK ] TEST: Replace non-FDB nexthop to FDB nexthop [ OK ] TEST: Replace FDB nexthop address while in a group [ OK ] TEST: Replace FDB nexthop to non-FDB nexthop while in a group [ OK ] TEST: Replace non-FDB nexthop to FDB nexthop while in a group [ OK ] [...] Tests passed: 40 Tests failed: 0 Tests skipped: 0 Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20250921150824.149157-4-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit c29913109c70383cdf90b6fc792353e1009f24f5 Author: Ido Schimmel Date: Sun Sep 21 18:08:23 2025 +0300 selftests: fib_nexthops: Fix creation of non-FDB nexthops The test creates non-FDB nexthops without a nexthop device which leads to the expected failure, but for the wrong reason: # ./fib_nexthops.sh -t "ipv6_fdb_grp_fcnal ipv4_fdb_grp_fcnal" -v IPv6 fdb groups functional -------------------------- [...] COMMAND: ip -netns me-nRsN3E nexthop add id 63 via 2001:db8:91::4 Error: Device attribute required for non-blackhole and non-fdb nexthops. COMMAND: ip -netns me-nRsN3E nexthop add id 64 via 2001:db8:91::5 Error: Device attribute required for non-blackhole and non-fdb nexthops. COMMAND: ip -netns me-nRsN3E nexthop add id 103 group 63/64 fdb Error: Invalid nexthop id. TEST: Fdb Nexthop group with non-fdb nexthops [ OK ] [...] IPv4 fdb groups functional -------------------------- [...] COMMAND: ip -netns me-nRsN3E nexthop add id 14 via 172.16.1.2 Error: Device attribute required for non-blackhole and non-fdb nexthops. COMMAND: ip -netns me-nRsN3E nexthop add id 15 via 172.16.1.3 Error: Device attribute required for non-blackhole and non-fdb nexthops. COMMAND: ip -netns me-nRsN3E nexthop add id 103 group 14/15 fdb Error: Invalid nexthop id. TEST: Fdb Nexthop group with non-fdb nexthops [ OK ] COMMAND: ip -netns me-nRsN3E nexthop add id 16 via 172.16.1.2 fdb COMMAND: ip -netns me-nRsN3E nexthop add id 17 via 172.16.1.3 fdb COMMAND: ip -netns me-nRsN3E nexthop add id 104 group 14/15 Error: Invalid nexthop id. TEST: Non-Fdb Nexthop group with fdb nexthops [ OK ] [...] COMMAND: ip -netns me-0dlhyd ro add 172.16.0.0/22 nhid 15 Error: Nexthop id does not exist. TEST: Route add with fdb nexthop [ OK ] In addition, as can be seen in the above output, a couple of IPv4 test cases used the non-FDB nexthops (14 and 15) when they intended to use the FDB nexthops (16 and 17). These test cases only passed because failure was expected, but they failed for the wrong reason. Fix the test to create the non-FDB nexthops with a nexthop device and adjust the IPv4 test cases to use the FDB nexthops instead of the non-FDB nexthops. Output after the fix: # ./fib_nexthops.sh -t "ipv6_fdb_grp_fcnal ipv4_fdb_grp_fcnal" -v IPv6 fdb groups functional -------------------------- [...] COMMAND: ip -netns me-lNzfHP nexthop add id 63 via 2001:db8:91::4 dev veth1 COMMAND: ip -netns me-lNzfHP nexthop add id 64 via 2001:db8:91::5 dev veth1 COMMAND: ip -netns me-lNzfHP nexthop add id 103 group 63/64 fdb Error: FDB nexthop group can only have fdb nexthops. TEST: Fdb Nexthop group with non-fdb nexthops [ OK ] [...] IPv4 fdb groups functional -------------------------- [...] COMMAND: ip -netns me-lNzfHP nexthop add id 14 via 172.16.1.2 dev veth1 COMMAND: ip -netns me-lNzfHP nexthop add id 15 via 172.16.1.3 dev veth1 COMMAND: ip -netns me-lNzfHP nexthop add id 103 group 14/15 fdb Error: FDB nexthop group can only have fdb nexthops. TEST: Fdb Nexthop group with non-fdb nexthops [ OK ] COMMAND: ip -netns me-lNzfHP nexthop add id 16 via 172.16.1.2 fdb COMMAND: ip -netns me-lNzfHP nexthop add id 17 via 172.16.1.3 fdb COMMAND: ip -netns me-lNzfHP nexthop add id 104 group 16/17 Error: Non FDB nexthop group cannot have fdb nexthops. TEST: Non-Fdb Nexthop group with fdb nexthops [ OK ] [...] COMMAND: ip -netns me-lNzfHP ro add 172.16.0.0/22 nhid 16 Error: Route cannot point to a fdb nexthop. TEST: Route add with fdb nexthop [ OK ] [...] Tests passed: 30 Tests failed: 0 Tests skipped: 0 Fixes: 0534c5489c11 ("selftests: net: add fdb nexthop tests") Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20250921150824.149157-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 390b3a300d7872cef9588f003b204398be69ce08 Author: Ido Schimmel Date: Sun Sep 21 18:08:22 2025 +0300 nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the creation of non-FDB nexthop groups with FDB nexthops: # ip nexthop add id 1 via 192.0.2.1 fdb # ip nexthop add id 2 group 1 Error: Non FDB nexthop group cannot have fdb nexthops. And vice versa: # ip nexthop add id 3 via 192.0.2.2 dev dummy1 # ip nexthop add id 4 group 3 fdb Error: FDB nexthop group can only have fdb nexthops. However, as long as no routes are pointing to a non-FDB nexthop group, the kernel allows changing the type of a nexthop from FDB to non-FDB and vice versa: # ip nexthop add id 5 via 192.0.2.2 dev dummy1 # ip nexthop add id 6 group 5 # ip nexthop replace id 5 via 192.0.2.2 fdb # echo $? 0 This configuration is invalid and can result in a NPD [1] since FDB nexthops are not associated with a nexthop device: # ip route add 198.51.100.1/32 nhid 6 # ping 198.51.100.1 Fix by preventing nexthop FDB status change while the nexthop is in a group: # ip nexthop add id 7 via 192.0.2.2 dev dummy1 # ip nexthop add id 8 group 7 # ip nexthop replace id 7 via 192.0.2.2 fdb Error: Cannot change nexthop FDB status while in a group. [1] BUG: kernel NULL pointer dereference, address: 00000000000003c0 [...] Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:fib_lookup_good_nhc+0x1e/0x80 [...] Call Trace: fib_table_lookup+0x541/0x650 ip_route_output_key_hash_rcu+0x2ea/0x970 ip_route_output_key_hash+0x55/0x80 __ip4_datagram_connect+0x250/0x330 udp_connect+0x2b/0x60 __sys_connect+0x9c/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0xa4/0x2a0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: 38428d68719c ("nexthop: support for fdb ecmp nexthops") Reported-by: syzbot+6596516dd2b635ba2350@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68c9a4d2.050a0220.3c6139.0e63.GAE@google.com/ Tested-by: syzbot+6596516dd2b635ba2350@syzkaller.appspotmail.com Signed-off-by: Ido Schimmel Reviewed-by: David Ahern Link: https://patch.msgid.link/20250921150824.149157-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit ca9f9cdc4de97d0221100b11224738416696163c Author: Jason Baron Date: Mon Sep 22 15:19:57 2025 -0400 net: allow alloc_skb_with_frags() to use MAX_SKB_FRAGS Currently, alloc_skb_with_frags() will only fill (MAX_SKB_FRAGS - 1) slots. I think it should use all MAX_SKB_FRAGS slots, as callers of alloc_skb_with_frags() will size their allocation of frags based on MAX_SKB_FRAGS. This issue was discovered via a test patch that sets 'order' to 0 in alloc_skb_with_frags(), which effectively tests/simulates high fragmentation. In this case sendmsg() on unix sockets will fail every time for large allocations. If the PAGE_SIZE is 4K, then data_len will request 68K or 17 pages, but alloc_skb_with_frags() can only allocate 64K in this case or 16 pages. Fixes: 09c2c90705bb ("net: allow alloc_skb_with_frags() to allocate bigger packets") Signed-off-by: Jason Baron Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250922191957.2855612-1-jbaron@akamai.com Signed-off-by: Jakub Kicinski commit 16d93558e12a03488d59562343e944f27ff4b9f3 Merge: 3d3aa9472c6dd0 c443be70aaee42 Author: Jakub Kicinski Date: Tue Sep 23 16:42:42 2025 -0700 Merge tag 'linux-can-fixes-for-6.17-20250923' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-09-23 The 1st patch is by Chen Yufeng and fixes a potential NULL pointer deref in the hi311x driver. Duy Nguyen contributes a patch for the rcar_canfd driver to fix the controller mode setting. The next 4 patches are by Vincent Mailhol and populate the ndo_change_mtu(( callback in the etas_es58x, hi311x, sun4i_can and mcba_usb driver to prevent buffer overflows. Stéphane Grosjean's patch for the peak_usb driver fixes a shift-out-of-bounds issue. * tag 'linux-can-fixes-for-6.17-20250923' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: peak_usb: fix shift-out-of-bounds issue can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow can: hi311x: populate ndo_change_mtu() to prevent buffer overflow can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow can: rcar_canfd: Fix controller mode setting can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled ==================== Link: https://patch.msgid.link/20250923073427.493034-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 13923775d5b0b47656e800bec7baf50a20474aaf Merge: 6866b785666030 6131690df4adae Author: Arnd Bergmann Date: Tue Sep 23 22:34:09 2025 +0200 Merge tag 'tegra-for-6.17-firmware-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes firmware: tegra: Fixes for v6.17 This contains a simple patch to avoid a warning in the case where the optional memory-region property is missing. * tag 'tegra-for-6.17-firmware-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: firmware: tegra: Do not warn on missing memory-region property Signed-off-by: Arnd Bergmann commit 6866b785666030e73ceb25d6754880568b33bfa7 Merge: ea38dfdd38e150 0f860eef417df9 Author: Arnd Bergmann Date: Tue Sep 23 22:32:48 2025 +0200 Merge tag 'v6.17-rockchip-dtsfixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes Another missing supply and a wrong headphone gpio level. * tag 'v6.17-rockchip-dtsfixes2' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 arm64: dts: rockchip: Add vcc supply for SPI Flash on NanoPC-T6 commit ea38dfdd38e150130779defc01fd0f58b570a5be Merge: 5eba504bb2b387 07db1def8f0aad Author: Arnd Bergmann Date: Tue Sep 23 22:31:44 2025 +0200 Merge tag 'apple-soc-fixes-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into arm/fixes Apple SoC fixes for 6.17 Just a single commit that drops Alyssa from MAINTAINERS at her own wish and adds here to .get_maintainer.ignore Signed-off-by: Sven Peter * tag 'apple-soc-fixes-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: MAINTAINERS: remove Alyssa Rosenzweig Link: https://lore.kernel.org/r/20250918192241.29374-1-sven@kernel.org Signed-off-by: Arnd Bergmann commit 5eba504bb2b387404901deb5932da835ee74ba8b Merge: 6865ed7ddc8158 a5d7a8ab4b2174 Author: Arnd Bergmann Date: Tue Sep 23 22:30:55 2025 +0200 Merge tag 'sunxi-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into arm/fixes Allwinner fixes for 6.17 Two device tree style cleanups from the device tree maintainers. * tag 'sunxi-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: riscv: dts: allwinner: rename devterm i2c-gpio node to comply with binding ARM: dts: allwinner: Minor whitespace cleanup Link: https://lore.kernel.org/r/aMrsUfkTWx8g3bJ7@wens.tw Signed-off-by: Arnd Bergmann commit 8d13f91d7fce4e842dfc7edbcba0690f7ed11c18 Author: Yixun Lan Date: Wed Sep 17 11:38:13 2025 +0800 dt-bindings: i2c: spacemit: extend and validate all properties Extend the K1 I2C properties by including generic i2c-controller schema. and this will enable it to do the DT validation check later. Signed-off-by: Yixun Lan Reviewed-by: Troy Mitchell Tested-by: Alex Elder Acked-by: Conor Dooley Signed-off-by: Wolfram Sang commit dde9a38195b0c268ff55d3a8aa62faefd0e988c8 Author: Claudiu Beznea Date: Tue Sep 23 17:18:26 2025 +0300 i2c: riic: Allow setting frequencies lower than 50KHz The MR1.CKS field is 3 bits wide and all the possible values (from 0 to 7) are valid. This is true for all the SoCs currently integrated in upstream Linux. Take into account CKS=7 which allows setting bus frequencies lower than 50KHz. This may be useful at least for debugging. Fixes: d982d6651419 ("i2c: riic: remove clock and frequency restrictions") Signed-off-by: Claudiu Beznea Signed-off-by: Wolfram Sang commit 2f6aa0acdc5d09d1fee3049593c81affa9c58838 Author: Jarkko Nikula Date: Tue Sep 23 16:26:03 2025 +0300 MAINTAINERS: Remove myself as Synopsys DesignWare I2C maintainer My address is going to bounce soon and I won't have access to the Synopsys datasheets so I'm going step down being a maintainer for this driver. Signed-off-by: Jarkko Nikula Signed-off-by: Wolfram Sang commit 41b1f9fcba62b06195e625bb88c1031102892439 Author: Melissa Wen Date: Mon Sep 1 18:51:05 2025 -0300 drm/amd/display: remove output_tf_change flag Remove this flag as the driver stopped managing it individually since commit a4056c2a6344 ("drm/amd/display: use HW hdr mult for brightness boost"). After some back and forth it was reintroduced as a condition to `set_output_transfer_func()` in [1]. Without direct management, this flag only changes value when all surface update flags are set true on UPDATE_TYPE_FULL with no output TF status meaning. Fixes: bb622e0c0044 ("drm/amd/display: program output tf when required") [1] Signed-off-by: Melissa Wen Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 752e6f283ec59ae007aa15a93d5a4b2eefa8cec9) commit 361ee85e980c16c9b9e236ccfac33014e8602485 Author: Leo Li Date: Fri Sep 12 11:01:50 2025 -0400 drm/amd/display: Init DCN35 clocks from pre-os HW values [Why] We did not initialize dc clocks with boot-time hw values during init. This lead to incorrect clock values in dc, causing `dcn35_update_clocks` to make incorrect updates. [How] Correctly initialize DC with pre-os clk values from HW. s/dump/save/ as that accurately reflects the purpose of the functions. Fixes: 8774029f76b9 ("drm/amd/display: Add DCN35 CLK_MGR") Reviewed-by: Aurabindo Pillai Signed-off-by: Leo Li Signed-off-by: Fangzhi Zuo Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit d43cc4ea1f9d720ab4bf06806f79260bfe981508) commit 1c3217dd557d4f04eb4c2afcd7c76de6b4d66ccb Author: Alvin Lee Date: Tue Sep 9 16:03:08 2025 -0400 drm/amd/display: Use mpc.preblend flag to indicate preblend [Description] Modifications in per asic capability means mpc.preblend flag should be used to indicate preblend. Update relevant paths to use this flag. Fixes: 39923050615c ("drm/amd/display: Clear DPP 3DLUT Cap") Reviewed-by: Dillon Varone Signed-off-by: Alvin Lee Signed-off-by: Ivan Lipski Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 9e5d4a5e27c6dc4e1b4fc9d654d13de12b8ce156) Cc: stable@vger.kernel.org commit 44b0fed0a5947f54fd14255cd0766df952267bc5 Author: Matthew Schwartz Date: Thu Sep 11 10:48:51 2025 -0700 drm/amd/display: Only restore backlight after amdgpu_dm_init or dm_resume On clients that utilize AMD_PRIVATE_COLOR properties for HDR support, brightness sliders can include a hardware controlled portion and a gamma-based portion. This is the case on the Steam Deck OLED when using gamescope with Steam as a client. When a user sets a brightness level while HDR is active, the gamma-based portion and/or hardware portion are adjusted to achieve the desired brightness. However, when a modeset takes place while the gamma-based portion is in-use, restoring the hardware brightness level overrides the user's overall brightness level and results in a mismatch between what the slider reports and the display's current brightness. To avoid overriding gamma-based brightness, only restore HW backlight level after boot or resume. This ensures that the backlight level is set correctly after the DC layer resets it while avoiding interference with subsequent modesets. Fixes: 7875afafba84 ("drm/amd/display: Fix brightness level not retained over reboot") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4551 Signed-off-by: Matthew Schwartz Reviewed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit a490c8d77d500b5981e739be3d59c60cfe382536) Cc: stable@vger.kernel.org commit 1da3f145ede481607a93472d2a1f597d6e998eb4 Author: Masami Hiramatsu (Google) Date: Fri Sep 19 10:15:56 2025 +0900 tracing: dynevent: Add a missing lockdown check on dynevent Since dynamic_events interface on tracefs is compatible with kprobe_events and uprobe_events, it should also check the lockdown status and reject if it is set. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/175824455687.45175.3734166065458520748.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit a2501032de0d1bc7971b2e43c03da534ac10ee9b Author: Wang Liang Date: Tue Sep 16 14:39:48 2025 +0800 tracing/osnoise: Fix slab-out-of-bounds in _parse_integer_limit() When config osnoise cpus by write() syscall, the following KASAN splat may be observed: BUG: KASAN: slab-out-of-bounds in _parse_integer_limit+0x103/0x130 Read of size 1 at addr ffff88810121e3a1 by task test/447 CPU: 1 UID: 0 PID: 447 Comm: test Not tainted 6.17.0-rc6-dirty #288 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x55/0x70 print_report+0xcb/0x610 kasan_report+0xb8/0xf0 _parse_integer_limit+0x103/0x130 bitmap_parselist+0x16d/0x6f0 osnoise_cpus_write+0x116/0x2d0 vfs_write+0x21e/0xcc0 ksys_write+0xee/0x1c0 do_syscall_64+0xa8/0x2a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f This issue can be reproduced by below code: const char *cpulist = "1"; int fd=open("/sys/kernel/debug/tracing/osnoise/cpus", O_WRONLY); write(fd, cpulist, strlen(cpulist)); Function bitmap_parselist() was called to parse cpulist, it require that the parameter 'buf' must be terminated with a '\0' or '\n'. Fix this issue by adding a '\0' to 'buf' in osnoise_cpus_write(). Cc: Cc: Cc: Link: https://lore.kernel.org/20250916063948.3154627-1-wangliang74@huawei.com Fixes: 17f89102fe23 ("tracing/osnoise: Allow arbitrarily long CPU string") Signed-off-by: Wang Liang Signed-off-by: Steven Rostedt (Google) commit 5fc4ab3269dea6a0b00c7256cb6f6c0101b6a44b Author: Louis-Alexis Eyraud Date: Tue Sep 23 10:52:12 2025 +0200 pmdomain: mediatek: set default off flag for MT8195 AUDIO power domain In MT8195 power domain data array, set the KEEP_DEFAULT_OFF and ACTIVE_WAKEUP flags for the AUDIO power domain entry to avoid having this domain being on during boot sequence when unneeded. Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state") Fixes: 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Ulf Hansson commit 285213a65e91d0295751d740e2320d8fcd75d56e Author: Jens Axboe Date: Tue Sep 23 05:19:16 2025 -0600 MAINTAINERS: update io_uring and block tree git trees Move to using the git.kernel.org trees as the canonical trees for both the block and io_uring tree. Signed-off-by: Jens Axboe commit 9b2f5ef00e852f8e8902a4d4f73aeedc60220c12 Author: Thomas Zimmermann Date: Mon Sep 22 15:45:54 2025 +0200 fbcon: Fix OOB access in font allocation Commit 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font") introduced an out-of-bounds access by storing data and allocation sizes in the same variable. Restore the old size calculation and use the new variable 'alloc_size' for the allocation. Signed-off-by: Thomas Zimmermann Fixes: 1a194e6c8e1e ("fbcon: fix integer overflow in fbcon_do_set_font") Reported-by: Jani Nikula Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/15020 Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6201 Cc: Samasth Norway Ananda Cc: Thomas Zimmermann Cc: George Kennedy Cc: Greg Kroah-Hartman Cc: Simona Vetter Cc: Helge Deller Cc: "Ville Syrjälä" Cc: Sam Ravnborg Cc: Qianqiang Liu Cc: Shixiong Ou Cc: Kees Cook Cc: # v5.9+ Cc: Zsolt Kajtar Reviewed-by: Lucas De Marchi Reviewed-by: Qianqiang Liu Link: https://lore.kernel.org/r/20250922134619.257684-1-tzimmermann@suse.de commit 53de7ee4e28f6e866ac319b9db6e6c1b05664c32 Author: Johannes Thumshirn Date: Thu Sep 18 12:51:19 2025 +0200 btrfs: zoned: don't fail mount needlessly due to too many active zones Previously BTRFS did not look at a device's reported max_open_zones limit, but starting with commit 04147d8394e8 ("btrfs: zoned: limit active zones to max_open_zones"), zoned BTRFS limited the number of concurrently used block-groups to the number of max_open_zones a device reported, if it hadn't already reported a number of max_active_zones. Starting with commit 04147d8394e8 the number of open zones is treated the same way as active zones. But this leads to mount failures on filesystems which have been used before 04147d8394e8 because too many zones are in an open state. Ignore the new limitations on these filesystems, so zones can be finished or evacuated. Reported-by: Yuwei Han Link: https://lore.kernel.org/all/2F48A90AF7DDF380+1790bcfd-cb6f-456b-870d-7982f21b5eae@bupt.moe/ Fixes: 04147d8394e8 ("btrfs: zoned: limit active zones to max_open_zones") Reviewed-by: Naohiro Aota Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit a15b5aefa8178846ed614745569fed0d1fb6cb87 Author: Nickolay Goppen Date: Wed Sep 17 22:10:01 2025 +0300 platform/x86: dell-lis3lv02d: Add Latitude E6530 Add 0x29 as the accelerometer address for the Dell Latitude E6530 to lis3lv02d_devices[]. The address was verified as below: $ cd /sys/bus/pci/drivers/i801_smbus/0000:00:1f.3 $ ls -d i2c-* i2c-20 $ sudo modprobe i2c-dev $ sudo i2cdetect 20 WARNING! This program can confuse your I2C bus, cause data loss and worse! I will probe file /dev/i2c-20. I will probe address range 0x08-0x77. Continue? [Y/n] Y 0 1 2 3 4 5 6 7 8 9 a b c d e f 00: 08 -- -- -- -- -- -- -- 10: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 20: -- -- -- -- -- -- -- -- -- UU -- 2b -- -- -- -- 30: -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- 40: -- -- -- -- 44 -- -- -- -- -- -- -- -- -- -- -- 50: UU -- 52 -- -- -- -- -- -- -- -- -- -- -- -- -- 60: -- 61 -- -- -- -- -- -- -- -- -- -- -- -- -- -- 70: -- -- -- -- -- -- -- -- $ cat /proc/cmdline BOOT_IMAGE=/vmlinuz-linux-cachyos-bore root=UUID= rw loglevel=3 quiet dell_lis3lv02d.probe_i2c_addr=1 $ sudo dmesg [ 0.000000] Linux version 6.16.6-2-cachyos-bore (linux-cachyos-bore@cachyos) (gcc (GCC) 15.2.1 20250813, GNU ld (GNU Binutils) 2.45.0) #1 SMP PREEMPT_DYNAMIC Thu, 11 Sep 2025 16:01:12 +0000 […] [ 0.000000] DMI: Dell Inc. Latitude E6530/07Y85M, BIOS A22 11/30/2018 […] [ 5.166442] i2c i2c-20: Probing for lis3lv02d on address 0x29 [ 5.167854] i2c i2c-20: Detected lis3lv02d on address 0x29, please report this upstream to platform-driver-x86@vger.kernel.org so that a quirk can be added Signed-off-by: Nickolay Goppen Reviewed-by: Hans de Goede Link: https://patch.msgid.link/20250917-dell-lis3lv02d-latitude-e6530-v1-1-8a6dec4e51e9@mainlining.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 2c61c45af153243baf591a77ec187be2b9cfe302 Author: Shyam Sundar S K Date: Tue Sep 16 17:21:42 2025 +0530 platform/x86/dell: Set USTT mode according to BIOS after reboot After a reboot, if the user changes the thermal setting in the BIOS, the BIOS applies this change. However, the current `dell-pc` driver does not recognize the updated USTT value, resulting in inconsistent thermal profiles between Windows and Linux. To ensure alignment with Windows behavior, read the current USTT settings during driver initialization and update the dell-pc USTT profile accordingly whenever a change is detected. Cc: Yijun Shen Co-developed-by: Patil Rajesh Reddy Signed-off-by: Patil Rajesh Reddy Signed-off-by: Shyam Sundar S K Reviewed-by: Lyndon Sanche Reviewed-by: Mario Limonciello (AMD) Tested-By: Yijun Shen Link: https://patch.msgid.link/20250916115142.188535-1-Shyam-sundar.S-k@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 12a3dd4d2cd9232d4e4df3b9a5b3d745db559941 Author: Christoffer Sandberg Date: Tue Sep 16 18:46:49 2025 +0200 platform/x86/amd/pmc: Add Stellaris Slim Gen6 AMD to spurious 8042 quirks list Prevents instant wakeup ~1s after suspend Signed-off-by: Christoffer Sandberg Signed-off-by: Werner Sembach Link: https://patch.msgid.link/20250916164700.32896-1-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 7f97a0a871d9532f2e1a5ee7d16d0e364215bcac Author: Suraj Kandpal Date: Mon Sep 8 09:52:08 2025 +0530 drm/i915/ddi: Guard reg_val against a INVALID_TRANSCODER Currently we check if the encoder is INVALID or -1 and throw a WARN_ON but we still end up writing the temp value which will overflow and corrupt the whole programmed value. --v2 -Assign a bogus transcoder to master in case we get a INVALID TRANSCODER [Jani] Fixes: 6671c367a9bea ("drm/i915/tgl: Select master transcoder for MST stream") Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250908042208.1011144-1-suraj.kandpal@intel.com (cherry picked from commit c8e8e9ab14a6ea926641d161768e1e3ef286a853) Signed-off-by: Tvrtko Ursulin commit c1e7254935c0414e7a31737bd357872d1b0f346b Author: Taotao Chen Date: Fri Aug 22 03:06:59 2025 +0000 drm/i915: set O_LARGEFILE in __create_shmem() Without O_LARGEFILE, file->f_op->write_iter calls generic_write_check_limits(), which enforces a 2GB (MAX_NON_LFS) limit, causing -EFBIG on large writes. In shmem_pwrite(), this error is later masked as -EIO due to the error handling order, leading to igt failures like gen9_exec_parse(bb-large). Set O_LARGEFILE in __create_shmem() to prevent -EFBIG on large writes. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202508081029.343192ec-lkp@intel.com Fixes: 048832a3f400 ("drm/i915: Refactor shmem_pwrite() to use kiocb and write_iter") Signed-off-by: Taotao Chen Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250822030651.28099-1-chentaotao@didiglobal.com (cherry picked from commit e296a2266c572a7537e638b0dbbfc66d11df46f9) Signed-off-by: Tvrtko Ursulin commit 3d3aa9472c6dd0704e9961ed4769caac5b1c8d52 Author: Alok Tiwari Date: Sat Sep 20 05:11:17 2025 -0700 bnxt_en: correct offset handling for IPv6 destination address In bnxt_tc_parse_pedit(), the code incorrectly writes IPv6 destination values to the source address field (saddr) when processing pedit offsets within the destination address range. This patch corrects the assignment to use daddr instead of saddr, ensuring that pedit operations on IPv6 destination addresses are applied correctly. Fixes: 9b9eb518e338 ("bnxt_en: Add support for NAT(L3/L4 rewrite)") Signed-off-by: Alok Tiwari Reviewed-by: Somnath Kotur Link: https://patch.msgid.link/20250920121157.351921-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit a461b2fe3e0f5264d11bed6039b2531b8f5ec648 Merge: 91fc61775c57da 91d8a53db2199e Author: Jakub Kicinski Date: Mon Sep 22 17:02:22 2025 -0700 Merge tag 'ipsec-2025-09-22' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2025-09-22 1) Fix 0 assignment for SPIs. 0 is not a valid SPI, it means no SPI assigned. 2) Fix offloading for inter address family tunnels. * tag 'ipsec-2025-09-22' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: xfrm: fix offloading of cross-family tunnels xfrm: xfrm_alloc_spi shouldn't use 0 as SPI ==================== Link: https://patch.msgid.link/20250922073512.62703-1-steffen.klassert@secunet.com Signed-off-by: Jakub Kicinski commit 91fc61775c57da3f5145abf80d047c4eb181c68a Merge: 3491bb7dae5c38 b99dd77076bd3f Author: Jakub Kicinski Date: Mon Sep 22 16:53:44 2025 -0700 Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== i40e: virtchnl improvements Przemek Kitszel says: Improvements hardening PF-VF communication for i40e driver. This patchset targets several issues that can cause undefined behavior or be exploited in some other way. * '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: improve VF MAC filters accounting i40e: add mask to apply valid bits for itr_idx i40e: add max boundary check for VF filters i40e: fix validation of VF state in get resources i40e: fix input validation logic for action_meta i40e: fix idx validation in config queues msg i40e: fix idx validation in i40e_validate_queue_map i40e: add validation for ring_len param ==================== Link: https://patch.msgid.link/20250919184959.656681-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 3491bb7dae5c3899b52f9a2329a9d25b79c2b0fb Merge: 207b45e8533f9a 302a1f674c00dd Author: Jakub Kicinski Date: Mon Sep 22 12:29:54 2025 -0700 Merge tag 'for-net-2025-09-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - Fix build after header cleanup - hci_sync: Fix hci_resume_advertising_sync - hci_event: Fix UAF in hci_conn_tx_dequeue - hci_event: Fix UAF in hci_acl_create_conn_sync - MGMT: Fix possible UAFs * tag 'for-net-2025-09-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: MGMT: Fix possible UAFs Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue Bluetooth: hci_sync: Fix hci_resume_advertising_sync Bluetooth: Fix build after header cleanup ==================== Link: https://patch.msgid.link/20250922143315.3007176-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 2066f00e5b2dc061fb6d8c88fadaebc97f11feaa Author: Thomas Gleixner Date: Sun Sep 21 10:56:40 2025 +0200 x86/topology: Implement topology_is_core_online() to address SMT regression Christian reported that commit a430c11f4015 ("intel_idle: Rescan "dead" SMT siblings during initialization") broke the use case in which both 'nosmt' and 'maxcpus' are on the kernel command line because it onlines primary threads, which were offline due to the maxcpus limit. The initially proposed fix to skip primary threads in the loop is inconsistent. While it prevents the primary thread to be onlined, it then onlines the corresponding hyperthread(s), which does not really make sense. The CPU iterator in cpuhp_smt_enable() contains a check which excludes all threads of a core, when the primary thread is offline. The default implementation is a NOOP and therefore not effective on x86. Implement topology_is_core_online() on x86 to address this issue. This makes the behaviour consistent between x86 and PowerPC. Fixes: a430c11f4015 ("intel_idle: Rescan "dead" SMT siblings during initialization") Fixes: f694481b1d31 ("ACPI: processor: Rescan "dead" SMT siblings during initialization") Closes: https://lore.kernel.org/linux-pm/724616a2-6374-4ba3-8ce3-ea9c45e2ae3b@arm.com/ Reported-by: Christian Loehle Signed-off-by: Thomas Gleixner Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Rafael J. Wysocki (Intel) Tested-by: Christian Loehle Cc: stable@vger.kernel.org Link: https://lore.kernel.org/12740505.O9o76ZdvQC@rafael.j.wysocki commit 207b45e8533f9a5b3206b6a85a984464e646b0e1 Merge: b65678cacc030e cd875625b475dc Author: Jakub Kicinski Date: Mon Sep 22 11:36:32 2025 -0700 Merge branch 'broadcom-report-the-supported-flags-for-ancillary-features' Jacob Keller says: ==================== broadcom: report the supported flags for ancillary features James Clark reported off list that the broadcom PHY PTP driver was incorrectly handling PTP_EXTTS_REQUEST and PTP_PEROUT_REQUEST ioctls since the conversion to the .supported_*_flags fields. This series fixes the driver to correctly report its flags through the .supported_perout_flags and .supported_extts_flags fields. It also contains an update to comment the behavior of the PTP_STRICT_FLAGS being always enabled for PTP_EXTTS_REQUEST2. I plan to follow up this series with some improvements to the PTP documentation better explaining each flag and the expectation of the driver APIs. ==================== Link: https://patch.msgid.link/20250918-jk-fix-bcm-phy-supported-flags-v1-0-747b60407c9c@intel.com Signed-off-by: Jakub Kicinski commit cd875625b475dc4e28ac302ccb3422cc9f678f89 Author: Jacob Keller Date: Thu Sep 18 17:33:18 2025 -0700 ptp: document behavior of PTP_STRICT_FLAGS Commit 6138e687c7b6 ("ptp: Introduce strict checking of external time stamp options.") added the PTP_STRICT_FLAGS to the set of flags supported for the external timestamp request ioctl. It is only supported by PTP_EXTTS_REQUEST2, as it was introduced the introduction of the new ioctls. Further, the kernel has always set this flag for PTP_EXTTS_REQUEST2 regardless of whether or not the user requested the behavior. This effectively means that the flag is not useful for userspace. If the user issues a PTP_EXTTS_REQUEST ioctl, the flag is ignored due to not being supported on the old ioctl. If the user issues a PTP_EXTTS_REQUEST2 ioctl, the flag will be set by the kernel regardless of whether the user set the flag in their structure. Add a comment documenting this behavior in the uAPI header file. Signed-off-by: Jacob Keller Reviewed-by: Vadim Fedorenko Acked-by: Richard Cochran Reviewed-by: Kory Maincent Tested-by: James Clark Link: https://patch.msgid.link/20250918-jk-fix-bcm-phy-supported-flags-v1-3-747b60407c9c@intel.com Signed-off-by: Jakub Kicinski commit 3200fdd4021de1d182fa3b6db5ad936d519f3848 Author: Jacob Keller Date: Thu Sep 18 17:33:17 2025 -0700 broadcom: fix support for PTP_EXTTS_REQUEST2 ioctl Commit 7c571ac57d9d ("net: ptp: introduce .supported_extts_flags to ptp_clock_info") modified the PTP core kernel logic to validate the supported flags for the PTP_EXTTS_REQUEST ioctls, rather than relying on each individual driver correctly checking its flags. The bcm_ptp_enable() function implements support for PTP_CLK_REQ_EXTTS, but does not check the flags, and does not forward the request structure into bcm_ptp_extts_locked(). When originally converting the bcm-phy-ptp.c code, it was unclear what edges the hardware actually timestamped. Thus, no flags were initialized in the .supported_extts_flags field. This results in the kernel automatically rejecting all userspace requests for the PTP_EXTTS_REQUEST2 ioctl. This occurs because the PTP_STRICT_FLAGS is always assumed when operating under PTP_EXTTS_REQUEST2. This has been the case since the flags introduction by commit 6138e687c7b6 ("ptp: Introduce strict checking of external time stamp options."). The bcm-phy-ptp.c logic never properly supported strict flag validation, as it previously ignored all flags including both PTP_STRICT_FLAGS and the PTP_FALLING_EDGE and PTP_RISING_EDGE flags. Reports from users in the field prove that the hardware timestamps the rising edge. Encode this in the .supported_extts_flags field. This re-enables support for the PTP_EXTTS_REQUEST2 ioctl. Reported-by: James Clark Fixes: 7c571ac57d9d ("net: ptp: introduce .supported_extts_flags to ptp_clock_info") Signed-off-by: Jacob Keller Reviewed-by: Vadim Fedorenko Acked-by: Richard Cochran Reviewed-by: Kory Maincent Tested-by: James Clark Link: https://patch.msgid.link/20250918-jk-fix-bcm-phy-supported-flags-v1-2-747b60407c9c@intel.com Signed-off-by: Jakub Kicinski commit 6e6c88d85623dc0c5c3faf185c12bd723efde5ee Author: Jacob Keller Date: Thu Sep 18 17:33:16 2025 -0700 broadcom: fix support for PTP_PEROUT_DUTY_CYCLE The bcm_ptp_perout_locked() function has support for handling PTP_PEROUT_DUTY_CYCLE, but its not listed in the supported_perout_flags. Attempts to use the duty cycle support will be rejected since commit d9f3e9ecc456 ("net: ptp: introduce .supported_perout_flags to ptp_clock_info"), as this flag accidentally missed while doing the conversion. Drop the unnecessary supported flags check from the bcm_ptp_perout_locked() function and correctly set the supported_perout_flags. This fixes use of the PTP_PEROUT_DUTY_CYCLE support for the broadcom driver. Reported-by: James Clark Fixes: d9f3e9ecc456 ("net: ptp: introduce .supported_perout_flags to ptp_clock_info") Signed-off-by: Jacob Keller Reviewed-by: Vadim Fedorenko Acked-by: Richard Cochran Reviewed-by: Kory Maincent Tested-by: James Clark Link: https://patch.msgid.link/20250918-jk-fix-bcm-phy-supported-flags-v1-1-747b60407c9c@intel.com Signed-off-by: Jakub Kicinski commit cec1e6e5d1ab33403b809f79cd20d6aff124ccfe Merge: d4c7fccfa784da 55ed11b181c43d Author: Linus Torvalds Date: Mon Sep 22 11:28:52 2025 -0700 Merge tag 'sched_ext-for-6.17-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fix from jun Heo: "This contains a fix for sched_ext idle CPU selection that likely fixes a substantial performance regression. The scx_bpf_select_cpu_dfl/and() kfuncs were incorrectly detecting all tasks as migration-disabled when called outside ops.select_cpu(), causing them to always return -EBUSY instead of finding idle CPUs. The fix properly distinguishes between genuinely migration-disabled tasks vs. the current task whose migration is temporarily disabled by BPF execution" * tag 'sched_ext-for-6.17-rc7-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: idle: Handle migration-disabled tasks in BPF code commit d4c7fccfa784da0583fed9c8f98ed78236c030fb Merge: b183f251e20245 43f6bee02196e5 Author: Linus Torvalds Date: Mon Sep 22 11:16:14 2025 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: "Fix two user triggerable use-after-free issues: - Possible race UAF setting up mmaps - Syzkaller found UAF when erroring an file descriptor creation ioctl due to the fput() work queue" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd/selftest: Update the fail_nth limit iommufd: WARN if an object is aborted with an elevated refcount iommufd: Fix race during abort for file descriptors iommufd: Fix refcounting race during mmap commit b183f251e2024531c2262829e97907b0e623cc41 Merge: 32d27cf535ead3 85fe9f565d2d5a Author: Linus Torvalds Date: Mon Sep 22 11:12:29 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fix from Jason Gunthorpe: "Just a one line change, was expecting more rc stuff, but it has been quiet. - Fix mlx5 devx event delivery to userspace for certain kinds of SRQs" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions commit 32d27cf535ead3b10e926c76dc5b6301920328b0 Merge: 33468b56f4e2d5 bba920e6f80313 Author: Linus Torvalds Date: Mon Sep 22 11:01:37 2025 -0700 Merge tag 'hid-for-linus-2025092201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - work data memory corruption fix in amd_sfh (Basavaraj Natikar) - fix for regression in cp2112 where setting a GPIO value would always fail (Sébastien Szymanski) - fix for regression in hid-lenovo causing driver to fail on non-ACPI systems (Janne Grunau) - a couple device ID additions and tiny device-specific quirks * tag 'hid-for-linus-2025092201' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: amd_sfh: Add sync across amd sfh work functions HID: asus: add support for missing PX series fn keys HID: cp2112: fix setter callbacks return value HID: lenovo: Use KEY_PERFORMANCE instead of ACPI's platform_profile HID: intel-thc-hid: intel-quickspi: Add WCL Device IDs HID: intel-thc-hid: intel-quicki2c: Add WCL Device IDs commit 33468b56f4e2d55be4b49dab92daddf5e28cc14b Merge: 07e27ad16399af a061e739d36220 Author: Linus Torvalds Date: Mon Sep 22 10:52:34 2025 -0700 Merge tag 'pinctrl-v6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: "Two small driver fixes for the Airhoa driver: - Correct a PHY LED mux value so the PHY LED will blink as it should - Fix the MDIO function bitmasks, working around a HW bug to force-enable the MDIO pins" * tag 'pinctrl-v6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: airoha: fix wrong MDIO function bitmaks pinctrl: airoha: fix wrong PHY LED mux value for LED1 GPIO46 commit 55ed11b181c43d81ce03b50209e4e7c4a14ba099 Author: Andrea Righi Date: Sat Sep 20 15:26:21 2025 +0200 sched_ext: idle: Handle migration-disabled tasks in BPF code When scx_bpf_select_cpu_dfl()/and() kfuncs are invoked outside of ops.select_cpu() we can't rely on @p->migration_disabled to determine if migration is disabled for the task @p. In fact, migration is always disabled for the current task while running BPF code: __bpf_prog_enter() disables migration and __bpf_prog_exit() re-enables it. To handle this, when @p->migration_disabled == 1, check whether @p is the current task. If so, migration was not disabled before entering the callback, otherwise migration was disabled. This ensures correct idle CPU selection in all cases. The behavior of ops.select_cpu() remains unchanged, because this callback is never invoked for the current task and migration-disabled tasks are always excluded. Example: without this change scx_bpf_select_cpu_and() called from ops.enqueue() always returns -EBUSY; with this change applied, it correctly returns idle CPUs. Fixes: 06efc9fe0b8de ("sched_ext: idle: Handle migration-disabled tasks in idle selection") Cc: stable@vger.kernel.org # v6.16+ Signed-off-by: Andrea Righi Acked-by: Changwoo Min Signed-off-by: Tejun Heo commit 77c8ede611c6a70a95f7b15648551d0121b40d6c Author: Thomas Hellström Date: Thu Sep 18 11:22:05 2025 +0200 drm/xe: Don't copy pinned kernel bos twice on suspend We were copying the bo content the bos on the list "xe->pinned.late.kernel_bo_present" twice on suspend. Presumingly the intent is to copy the pinned external bos on the first pass. This is harmless since we (currently) should have no pinned external bos needing copy since a) exernal system bos don't have compressed content, b) We do not (yet) allow pinning of VRAM bos. Still, fix this up so that we copy pinned external bos on the first pass. We're about to allow bos pinned in VRAM. Fixes: c6a4d46ec1d7 ("drm/xe: evict user memory in PM notifier") Cc: Matthew Auld Cc: # v6.16+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250918092207.54472-2-thomas.hellstrom@linux.intel.com (cherry picked from commit 9e69bafece43dcefec864f00b3ec7e088aa7fcbc) Signed-off-by: Rodrigo Vivi commit b67e7422d229dead0dddaad7e7c05558f24d552f Author: Lucas De Marchi Date: Fri Sep 12 14:54:51 2025 -0700 drm/xe: Fix build with CONFIG_MODULES=n When building with CONFIG_MODULES=n, the __exit functions are dropped. However our init functions may call them for error handling, so they are not good candidates for the exit sections. Fix this error reported by 0day: ld.lld: error: relocation refers to a symbol in a discarded section: xe_configfs_exit >>> defined in vmlinux.a(drivers/gpu/drm/xe/xe_configfs.o) >>> referenced by xe_module.c >>> drivers/gpu/drm/xe/xe_module.o:(init_funcs) in archive vmlinux.a This is the only exit function using __exit. Drop it to fix the build. Cc: Riana Tauro Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506092221.1FmUQmI8-lkp@intel.com/ Fixes: 16280ded45fb ("drm/xe: Add configfs to enable survivability mode") Reviewed-by: Balasubramani Vivekanandan Link: https://lore.kernel.org/r/20250912-fix-nomodule-build-v1-1-d11b70a92516@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit d9b2623319fa20c2206754284291817488329648) Signed-off-by: Rodrigo Vivi commit 500dad428e5b0de4c1bdfa893822a6e06ddad0b5 Author: Michal Wajdeczko Date: Tue Sep 16 19:00:28 2025 +0200 drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMG_PCIE_CAP(0x138340) register nor access PCODE (already guarded by the info.skip_pcode flag) so we shouldn't expose attributes that require any of them to avoid errors like: [] xe 0000:03:00.1: [drm] Tile0: GT0: VF is trying to read an \ inaccessible register 0x138340+0x0 [] RIP: 0010:xe_gt_sriov_vf_read32+0x6c2/0x9a0 [xe] [] Call Trace: [] xe_mmio_read32+0x110/0x280 [xe] [] auto_link_downgrade_capable_show+0x2e/0x70 [xe] [] dev_attr_show+0x1a/0x70 [] sysfs_kf_seq_show+0xaa/0x120 [] kernfs_seq_show+0x41/0x60 Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes") Fixes: cdc36b66cd41 ("drm/xe: Expose fan control and voltage regulator version") Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Lukasz Laguna Reviewed-by: Raag Jadav Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250916170029.3313-2-michal.wajdeczko@intel.com (cherry picked from commit a2d6223d224f333f705ed8495bf8bebfbc585c35) Signed-off-by: Rodrigo Vivi commit ab073abf6d974d3fe998fc6731ca80e2b57ffd69 Author: Jens Axboe Date: Mon Sep 22 05:55:41 2025 -0600 block: fix EOD return for device with nr_sectors == 0 A recent commit skipped dumping the usual "attempt to access beyond end of device" message if the device size is 0 sectors, as that's a common pattern for devices that have been hot removed. But while it stopped that message, it also prevented returning -EIO for that condition. Reinstate the -EIO return, while retaining the quiet operation for triggering EOD for a device with 0 sectors. Reported-by: syzbot+4b12286339fe4c2700c1@syzkaller.appspotmail.com Reported-by: Sahil Chandna Fixes: d0a2b527d8c3 ("block: tone down bio_check_eod") Tested-by: Sahil Chandna Signed-off-by: Jens Axboe commit 3bd44edd6c55828fd4e11cb0efce5b7160bfa2de Author: Ioana Ciornei Date: Mon Sep 22 17:24:21 2025 +0300 gpio: regmap: fix memory leak of gpio_regmap structure The gpio_regmap structure is leaked on the error path. Fix this by jumping to the appropriate kfree instead of returning directly. Fixes: db305161880a ("gpio: regmap: Allow ngpio to be read from the property") Signed-off-by: Ioana Ciornei Suggested-by: Michael Walle Reviewed-by: Michael Walle Link: https://lore.kernel.org/r/20250922142427.3310221-7-ioana.ciornei@nxp.com Signed-off-by: Bartosz Golaszewski commit 302a1f674c00dd5581ab8e493ef44767c5101aab Author: Luiz Augusto von Dentz Date: Mon Aug 25 10:03:07 2025 -0400 Bluetooth: MGMT: Fix possible UAFs This attemps to fix possible UAFs caused by struct mgmt_pending being freed while still being processed like in the following trace, in order to fix mgmt_pending_valid is introduce and use to check if the mgmt_pending hasn't been removed from the pending list, on the complete callbacks it is used to check and in addtion remove the cmd from the list while holding mgmt_pending_lock to avoid TOCTOU problems since if the cmd is left on the list it can still be accessed and freed. BUG: KASAN: slab-use-after-free in mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 Read of size 8 at addr ffff8880709d4dc0 by task kworker/u11:0/55 CPU: 0 UID: 0 PID: 55 Comm: kworker/u11:0 Not tainted 6.16.4 #2 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 mgmt_add_adv_patterns_monitor_sync+0x35/0x50 net/bluetooth/mgmt.c:5223 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x711/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16.4/arch/x86/entry/entry_64.S:245 Allocated by task 12210: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4364 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] mgmt_pending_new+0x65/0x1e0 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x35/0x140 net/bluetooth/mgmt_util.c:296 __add_adv_patterns_monitor+0x130/0x200 net/bluetooth/mgmt.c:5247 add_adv_patterns_monitor+0x214/0x360 net/bluetooth/mgmt.c:5364 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 sock_write_iter+0x258/0x330 net/socket.c:1133 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 12221: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4648 [inline] kfree+0x18e/0x440 mm/slub.c:4847 mgmt_pending_free net/bluetooth/mgmt_util.c:311 [inline] mgmt_pending_foreach+0x30d/0x380 net/bluetooth/mgmt_util.c:257 __mgmt_power_off+0x169/0x350 net/bluetooth/mgmt.c:9444 hci_dev_close_sync+0x754/0x1330 net/bluetooth/hci_sync.c:5290 hci_dev_do_close net/bluetooth/hci_core.c:501 [inline] hci_dev_close+0x108/0x200 net/bluetooth/hci_core.c:526 sock_do_ioctl+0xd9/0x300 net/socket.c:1192 sock_ioctl+0x576/0x790 net/socket.c:1313 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: cf75ad8b41d2 ("Bluetooth: hci_sync: Convert MGMT_SET_POWERED") Fixes: 2bd1b237616b ("Bluetooth: hci_sync: Convert MGMT_OP_SET_DISCOVERABLE to use cmd_sync") Fixes: f056a65783cc ("Bluetooth: hci_sync: Convert MGMT_OP_SET_CONNECTABLE to use cmd_sync") Fixes: 3244845c6307 ("Bluetooth: hci_sync: Convert MGMT_OP_SSP") Fixes: d81a494c43df ("Bluetooth: hci_sync: Convert MGMT_OP_SET_LE") Fixes: b338d91703fa ("Bluetooth: Implement support for Mesh") Fixes: 6f6ff38a1e14 ("Bluetooth: hci_sync: Convert MGMT_OP_SET_LOCAL_NAME") Fixes: 71efbb08b538 ("Bluetooth: hci_sync: Convert MGMT_OP_SET_PHY_CONFIGURATION") Fixes: b747a83690c8 ("Bluetooth: hci_sync: Refactor add Adv Monitor") Fixes: abfeea476c68 ("Bluetooth: hci_sync: Convert MGMT_OP_START_DISCOVERY") Fixes: 26ac4c56f03f ("Bluetooth: hci_sync: Convert MGMT_OP_SET_ADVERTISING") Reported-by: cen zhang Signed-off-by: Luiz Augusto von Dentz commit c6ccc4dde17676dfe617b9a37bd9ba19a8fc87ee Author: Hans de Goede Date: Sat Sep 20 22:09:55 2025 +0200 gpiolib: Extend software-node support to support secondary software-nodes When a software-node gets added to a device which already has another fwnode as primary node it will become the secondary fwnode for that device. Currently if a software-node with GPIO properties ends up as the secondary fwnode then gpiod_find_by_fwnode() will fail to find the GPIOs. Add a new gpiod_fwnode_lookup() helper which falls back to calling gpiod_find_by_fwnode() with the secondary fwnode if the GPIO was not found in the primary fwnode. Fixes: e7f9ff5dc90c ("gpiolib: add support for software nodes") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Reviewed-by: Dmitry Torokhov Link: https://lore.kernel.org/r/20250920200955.20403-1-hansg@kernel.org Signed-off-by: Bartosz Golaszewski commit 4f115596133fa168bac06bb34c6efd8f4d84c22e Author: Alexander Popov Date: Sun Sep 21 23:58:15 2025 +0300 x86/Kconfig: Reenable PTDUMP on i386 The commit f9aad622006bd64c ("mm: rename GENERIC_PTDUMP and PTDUMP_CORE") has broken PTDUMP and the Kconfig options that use it on ARCH=i386, including CONFIG_DEBUG_WX. CONFIG_GENERIC_PTDUMP was renamed into CONFIG_ARCH_HAS_PTDUMP, but it was mistakenly moved from "config X86" to "config X86_64". That made PTDUMP unavailable for i386. Move CONFIG_ARCH_HAS_PTDUMP back to "config X86" to fix it. [ bp: Massage commit message. ] Fixes: f9aad622006bd64c ("mm: rename GENERIC_PTDUMP and PTDUMP_CORE") Signed-off-by: Alexander Popov Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org commit 398a8a4e51dbd03e4103ea596ea4ea037fe67175 Author: Bastien Curutchet (Schneider Electric) Date: Fri Sep 12 09:08:58 2025 +0200 spi: omap2-mcspi: drive SPI_CLK on transfer_setup() If the cached contents of the CHCONF register doesn't have the FORCE bit set, the setup() function failed to set the relevant idle state of the SPI_CLK pin. In such case, the SPI_CLK's idle state is reached later with set_cs(), but it's too late for the first SPI transfer which fails since the CS is asserted before the clock reaching its idle state. Add a first write in setup() that always sets the FORCE bit. Keep the current write afterwards to ensure the FORCE bit won't stay in the cached contents of the CHCONF register unless it's intended. Signed-off-by: Bastien Curutchet (Schneider Electric) Link: https://patch.msgid.link/20250912-omap-spi-fix-v1-1-f925b0d27ede@bootlin.com Signed-off-by: Mark Brown commit 1a194e6c8e1ee745e914b0b7f50fa86c89ed13fe Author: Samasth Norway Ananda Date: Fri Sep 12 10:00:23 2025 -0700 fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font parameters. The vulnerabilities occur when: 1. CALC_FONTSZ(h, pitch, charcount) performs h * pith * charcount multiplication with user-controlled values that can overflow. 2. FONT_EXTRA_WORDS * sizeof(int) + size addition can also overflow 3. This results in smaller allocations than expected, leading to buffer overflows during font data copying. Add explicit overflow checking using check_mul_overflow() and check_add_overflow() kernel helpers to safety validate all size calculations before allocation. Signed-off-by: Samasth Norway Ananda Reviewed-by: Thomas Zimmermann Fixes: 39b3cffb8cf3 ("fbcon: prevent user font height or width change from causing potential out-of-bounds access") Cc: George Kennedy Cc: stable Cc: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com Cc: Greg Kroah-Hartman Cc: Simona Vetter Cc: Helge Deller Cc: Thomas Zimmermann Cc: "Ville Syrjälä" Cc: Sam Ravnborg Cc: Qianqiang Liu Cc: Shixiong Ou Cc: Kees Cook Cc: # v5.9+ Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250912170023.3931881-1-samasth.norway.ananda@oracle.com commit 1cf9f2a6a544288516a7b9e883a48eba6246bcf2 Author: Paulo Alcantara Date: Fri Sep 19 14:13:15 2025 -0300 smb: client: handle unlink(2) of files open by different clients In order to identify whether a certain file is open by a different client, start the unlink process by sending a compound request of CREATE(DELETE_ON_CLOSE) + CLOSE with only FILE_SHARE_DELETE bit set in smb2_create_req::ShareAccess. If the file is currently open, then the server will fail the request with STATUS_SHARING_VIOLATION, in which case we'll map it to -EBUSY, so __cifs_unlink() will fall back to silly-rename the file. This fixes the following case where open(O_CREAT) fails with -ENOENT (STATUS_DELETE_PENDING) due to file still open by a different client. * Before patch $ mount.cifs //srv/share /mnt/1 -o ...,nosharesock $ mount.cifs //srv/share /mnt/2 -o ...,nosharesock $ cd /mnt/1 $ touch foo $ exec 3<>foo $ cd /mnt/2 $ rm foo $ touch foo touch: cannot touch 'foo': No such file or directory $ exec 3>&- * After patch $ mount.cifs //srv/share /mnt/1 -o ...,nosharesock $ mount.cifs //srv/share /mnt/2 -o ...,nosharesock $ cd /mnt/1 $ touch foo $ exec 3<>foo $ cd /mnt/2 $ rm foo $ touch foo $ exec 3>&- Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: Frank Sorenson Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit f7f89250175e0a82e99ed66da7012e869c36497d Author: Stefan Metzmacher Date: Wed Aug 13 08:48:42 2025 +0200 smb: server: use disable_work_sync in transport_rdma.c This makes it safer during the disconnect and avoids requeueing. It's ok to call disable_work[_sync]() more than once. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 1cde0a74a7a8951b3097417847a458e557be0b5b Author: Stefan Metzmacher Date: Fri Aug 8 17:55:17 2025 +0200 smb: server: don't use delayed_work for post_recv_credits_work If we are using a hardcoded delay of 0 there's no point in using delayed_work it only adds confusion. The client also uses a normal work_struct and now it is easier to move it to the common smbdirect_socket. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 07e27ad16399afcd693be20211b0dfae63e0615f Author: Linus Torvalds Date: Sun Sep 21 15:08:52 2025 -0700 Linux 6.17-rc7 commit cde7e7c3f8745a61458cea61aa28f37c3f5ae2b4 Author: Peter Hilber Date: Tue Aug 26 15:00:15 2025 +0200 MAINTAINERS, mailmap: Update address for Peter Hilber Going forward, I will use another Qualcomm address, peter.hilber@oss.qualcomm.com. Map past contributions on behalf of Qualcomm to the new address as well. Signed-off-by: Peter Hilber Message-Id: <20250826130015.6218-1-peter.hilber@oss.qualcomm.com> Signed-off-by: Michael S. Tsirkin commit a05e4e935a6689542d86162b33a484cc704ce39a Author: Alyssa Ross Date: Fri Aug 29 17:09:44 2025 +0200 virtio_config: clarify output parameters This was ambiguous enough for a broken patch (206cc44588f7 ("virtio: reject shm region if length is zero")) to make it into the kernel, so make it clearer. Link: https://lore.kernel.org/r/20250816071600-mutt-send-email-mst@kernel.org/ Signed-off-by: Alyssa Ross Message-Id: <20250829150944.233505-1-hi@alyssa.is> Signed-off-by: Michael S. Tsirkin commit d6d673dd1e92b2bed0096e7e7e9fe5d7e7d2156c Author: Ashwini Sahu Date: Mon Sep 8 15:26:45 2025 +0530 uapi: vduse: fix typo in comment Fix a spelling mistake in vduse.h: "regsion" → "region" in the documentation for struct vduse_iova_info. No functional change. Signed-off-by: Ashwini Sahu Message-Id: <20250908095645.610336-1-ashwini@wisig.com> Signed-off-by: Michael S. Tsirkin commit afe16653e05db07d658b55245c7a2e0603f136c0 Author: Sebastian Andrzej Siewior Date: Thu Sep 18 20:11:44 2025 +0200 vhost: Take a reference on the task in struct vhost_task. vhost_task_create() creates a task and keeps a reference to its task_struct. That task may exit early via a signal and its task_struct will be released. A pending vhost_task_wake() will then attempt to wake the task and access a task_struct which is no longer there. Acquire a reference on the task_struct while creating the thread and release the reference while the struct vhost_task itself is removed. If the task exits early due to a signal, then the vhost_task_wake() will still access a valid task_struct. The wake is safe and will be skipped in this case. Fixes: f9010dbdce911 ("fork, vhost: Use CLONE_THREAD to fix freezer/ps regression") Reported-by: Sean Christopherson Closes: https://lore.kernel.org/all/aKkLEtoDXKxAAWju@google.com/ Signed-off-by: Sebastian Andrzej Siewior Message-Id: <20250918181144.Ygo8BZ-R@linutronix.de> Signed-off-by: Michael S. Tsirkin Tested-by: Sean Christopherson commit 2d5bd41a45050d9bcd2de9c049beaf7dc5c45aa6 Merge: f975f08c2e899a 764c921bf0c5ff Author: Linus Torvalds Date: Sun Sep 21 11:11:07 2025 -0700 Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk fixes from Stephen Boyd: "Fixes to the Allwinner and Renesas clk drivers: - Do the math properly in Allwinner's ccu_mp_recalc_rate() so clk rates aren't bogus - Fix a clock domain regression on Renesas R-Car M1A, R-Car H1, and RZ/A1 by registering the domain after the pmdomain bus is registered instead of before" * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: clk: sunxi-ng: mp: Fix dual-divider clock rate readback clk: renesas: mstp: Add genpd OF provider at postcore_initcall() commit f975f08c2e899ae2484407d7bba6bb7f8b6d9d40 Merge: fce24200cbddb5 b98b208300573f Author: Linus Torvalds Date: Sat Sep 20 21:41:26 2025 -0700 Merge tag 'for-6.17-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull a few more btrfs fixes from David Sterba: - in tree-checker, fix wrong size of check for inode ref item - in ref-verify, handle combination of mount options that allow partially damaged extent tree (reported by syzbot) - additional validation of compression mount option to catch invalid string as level * tag 'for-6.17-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: reject invalid compression level btrfs: ref-verify: handle damaged extent root tree btrfs: tree-checker: fix the incorrect inode ref size check commit fce24200cbddb5a333a157eecf0a8020c1d36d7c Merge: 0f46486981e7c3 5cb782ff3c62c8 Author: Linus Torvalds Date: Sat Sep 20 19:48:16 2025 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fix from James Bottomley: "One driver fix for a dma error checking thinko" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE commit 0f46486981e7c3109aab71623eab3ce26dcadbdf Merge: 3b08f56fbbb9ef 853a57ba263adf Author: Linus Torvalds Date: Sat Sep 20 19:46:57 2025 -0700 Merge tag 'firewire-fixes-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fix from Takashi Sakamoto: "When new structures and events were added to UAPI in v6.5 kernel, the required update to the subsystem ABI version returned to userspace client was overlooked. The version is now updated" * tag 'firewire-fixes-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: fix overlooked update of subsystem ABI version commit 3b08f56fbbb9ef75c7454487f8d3db80a84deef7 Merge: cd89d487374c49 7f830e126dc357 Author: Linus Torvalds Date: Sat Sep 20 09:27:15 2025 -0700 Merge tag 'x86-urgent-2025-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: "Fix a SEV-SNP regression when CONFIG_KVM_AMD_SEV is disabled" * tag 'x86-urgent-2025-09-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT commit b549113738e8c751b613118032a724b772aa83f2 Author: Sebastian Andrzej Siewior Date: Wed Sep 10 12:42:43 2025 +0200 futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue() futex_proxy_trylock_atomic() futex_requeue_pi_prepare() requeue_pi_wake_futex() futex_requeue_pi_complete() /* preempt */ * timeout/ signal wakes T1 * futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED futex_hash_put() // back to userland, on stack futex_q is garbage /* back */ wake_up_state(q->task, TASK_NORMAL); In this scenario futex_wait_requeue_pi() is able to leave without using futex_q::lock_ptr for synchronization. This can be prevented by reading futex_q::task before updating the futex_q::requeue_state. A reference on the task_struct is not needed because requeue_pi_wake_futex() is invoked with a spinlock_t held which implies a RCU read section. Even if T1 terminates immediately after, the task_struct will remain valid during T2's wake_up_state(). A READ_ONCE on futex_q::task before futex_requeue_pi_complete() is enough because it ensures that the variable is read before the state is updated. Read futex_q::task before updating the requeue state, use it for the following wakeup. Fixes: 07d91ef510fb1 ("futex: Prevent requeue_pi() lock nesting issue on RT") Reported-by: syzbot+034246a838a10d181e78@syzkaller.appspotmail.com Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Closes: https://lore.kernel.org/all/68b75989.050a0220.3db4df.01dd.GAE@google.com/ commit 9e622804d57e2d08f0271200606bd1270f75126f Author: Luiz Augusto von Dentz Date: Mon Aug 25 11:10:20 2025 -0400 Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync This fixes the following UFA in hci_acl_create_conn_sync where a connection still pending is command submission (conn->state == BT_OPEN) maybe freed, also since this also can happen with the likes of hci_le_create_conn_sync fix it as well: BUG: KASAN: slab-use-after-free in hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861 Write of size 2 at addr ffff88805ffcc038 by task kworker/u11:2/9541 CPU: 1 UID: 0 PID: 9541 Comm: kworker/u11:2 Not tainted 6.16.0-rc7 #3 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueue: hci3 hci_cmd_sync_work Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x230 mm/kasan/report.c:480 kasan_report+0x118/0x150 mm/kasan/report.c:593 hci_acl_create_conn_sync+0x5ef/0x790 net/bluetooth/hci_sync.c:6861 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245 Allocated by task 123736: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] __hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939 hci_conn_add_unset net/bluetooth/hci_conn.c:1051 [inline] hci_connect_acl+0x16c/0x4e0 net/bluetooth/hci_conn.c:1634 pair_device+0x418/0xa70 net/bluetooth/mgmt.c:3556 hci_mgmt_cmd+0x9c9/0xef0 net/bluetooth/hci_sock.c:1719 hci_sock_sendmsg+0x6ca/0xef0 net/bluetooth/hci_sock.c:1839 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:727 sock_write_iter+0x258/0x330 net/socket.c:1131 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x54b/0xa90 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 103680: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4643 [inline] kfree+0x18e/0x440 mm/slub.c:4842 device_release+0x9c/0x1c0 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x22b/0x480 lib/kobject.c:737 hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline] hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173 hci_conn_complete_evt+0x3c7/0x1040 net/bluetooth/hci_event.c:3199 hci_event_func net/bluetooth/hci_event.c:7477 [inline] hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531 hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245 Last potentially related work creation: kasan_save_stack+0x3e/0x60 mm/kasan/common.c:47 kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:548 insert_work+0x3d/0x330 kernel/workqueue.c:2183 __queue_work+0xbd9/0xfe0 kernel/workqueue.c:2345 queue_delayed_work_on+0x18b/0x280 kernel/workqueue.c:2561 pairing_complete+0x1e7/0x2b0 net/bluetooth/mgmt.c:3451 pairing_complete_cb+0x1ac/0x230 net/bluetooth/mgmt.c:3487 hci_connect_cfm include/net/bluetooth/hci_core.h:2064 [inline] hci_conn_failed+0x24d/0x310 net/bluetooth/hci_conn.c:1275 hci_conn_complete_evt+0x3c7/0x1040 net/bluetooth/hci_event.c:3199 hci_event_func net/bluetooth/hci_event.c:7477 [inline] hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531 hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245 Fixes: aef2aa4fa98e ("Bluetooth: hci_event: Fix creating hci_conn object on error status") Reported-by: Junvyyang, Tencent Zhuque Lab Signed-off-by: Luiz Augusto von Dentz commit 2e128683176a56459cef8705fc7c35f438f88abd Author: Luiz Augusto von Dentz Date: Mon Aug 25 10:27:29 2025 -0400 Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue This fixes the following UAF caused by not properly locking hdev when processing HCI_EV_NUM_COMP_PKTS: BUG: KASAN: slab-use-after-free in hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036 Read of size 4 at addr ffff8880740f0940 by task kworker/u11:0/54 CPU: 1 UID: 0 PID: 54 Comm: kworker/u11:0 Not tainted 6.16.0-rc7 #3 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Workqueue: hci1 hci_rx_work Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x230 mm/kasan/report.c:480 kasan_report+0x118/0x150 mm/kasan/report.c:593 hci_conn_tx_dequeue+0x1be/0x220 net/bluetooth/hci_conn.c:3036 hci_num_comp_pkts_evt+0x1c8/0xa50 net/bluetooth/hci_event.c:4404 hci_event_func net/bluetooth/hci_event.c:7477 [inline] hci_event_packet+0x7e0/0x1200 net/bluetooth/hci_event.c:7531 hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245 Allocated by task 54: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x230/0x3d0 mm/slub.c:4359 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] __hci_conn_add+0x233/0x1b30 net/bluetooth/hci_conn.c:939 le_conn_complete_evt+0x3d6/0x1220 net/bluetooth/hci_event.c:5628 hci_le_enh_conn_complete_evt+0x189/0x470 net/bluetooth/hci_event.c:5794 hci_event_func net/bluetooth/hci_event.c:7474 [inline] hci_event_packet+0x78c/0x1200 net/bluetooth/hci_event.c:7531 hci_rx_work+0x46a/0xe80 net/bluetooth/hci_core.c:4070 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245 Freed by task 9572: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x62/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2381 [inline] slab_free mm/slub.c:4643 [inline] kfree+0x18e/0x440 mm/slub.c:4842 device_release+0x9c/0x1c0 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x22b/0x480 lib/kobject.c:737 hci_conn_cleanup net/bluetooth/hci_conn.c:175 [inline] hci_conn_del+0x8ff/0xcb0 net/bluetooth/hci_conn.c:1173 hci_abort_conn_sync+0x5d1/0xdf0 net/bluetooth/hci_sync.c:5689 hci_cmd_sync_work+0x210/0x3a0 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3238 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3321 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3402 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 home/kwqcheii/source/fuzzing/kernel/kasan/linux-6.16-rc7/arch/x86/entry/entry_64.S:245 Fixes: 134f4b39df7b ("Bluetooth: add support for skb TX SND/COMPLETION timestamping") Reported-by: Junvyyang, Tencent Zhuque Lab Signed-off-by: Luiz Augusto von Dentz commit 1488af7b8b5f9896ea88ee35aa3301713f72737c Author: Luiz Augusto von Dentz Date: Fri Sep 5 10:29:18 2025 -0400 Bluetooth: hci_sync: Fix hci_resume_advertising_sync hci_resume_advertising_sync is suppose to resume all instance paused by hci_pause_advertising_sync, this logic is used for procedures are only allowed when not advertising, but instance 0x00 was not being re-enabled. Fixes: ad383c2c65a5 ("Bluetooth: hci_sync: Enable advertising when LL privacy is enabled") Signed-off-by: Luiz Augusto von Dentz commit 1c5091a9b4c990a6fcf8de7d0e97dba4cf878f17 Author: Calvin Owens Date: Tue Sep 2 08:43:44 2025 -0700 Bluetooth: Fix build after header cleanup Some Kconfig dependencies are needed after my recent cleanup, since the core code has its own option. Since btmtksdio does not actually call h4_recv_buf(), move the definitions it uses outside the BT_HCIUART_H4 gate in hci_uart.h to avoid adding a dependency for btmtksdio. The rest I touched (bpa10x, btmtkuart, and btnxpuart) do really call h4_recv_buf(), so the dependency is required, add it for them. Fixes: 0e272fc7e17d ("Bluetooth: remove duplicate h4_recv_buf() in header") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508300413.OnIedvRh-lkp@intel.com/ Signed-off-by: Calvin Owens Signed-off-by: Luiz Augusto von Dentz commit 8ffe28b4e8d8b18cb2f2933410322c24f039d5d6 Author: Christian Loehle Date: Thu Sep 18 11:15:52 2025 +0100 cpufreq: Initialize cpufreq-based invariance before subsys commit 2a6c72738706 ("cpufreq: Initialize cpufreq-based frequency-invariance later") postponed the frequency invariance initialization to avoid disabling it in the error case. This isn't locking safe, instead move the initialization up before the subsys interface is registered (which will rebuild the sched_domains) and add the corresponding disable on the error path. Observed lockdep without this patch: [ 0.989686] ====================================================== [ 0.989688] WARNING: possible circular locking dependency detected [ 0.989690] 6.17.0-rc4-cix-build+ #31 Tainted: G S [ 0.989691] ------------------------------------------------------ [ 0.989692] swapper/0/1 is trying to acquire lock: [ 0.989693] ffff800082ada7f8 (sched_energy_mutex){+.+.}-{4:4}, at: rebuild_sched_domains_energy+0x30/0x58 [ 0.989705] but task is already holding lock: [ 0.989706] ffff000088c89bc8 (&policy->rwsem){+.+.}-{4:4}, at: cpufreq_online+0x7f8/0xbe0 [ 0.989713] which lock already depends on the new lock. Fixes: 2a6c72738706 ("cpufreq: Initialize cpufreq-based frequency-invariance later") Signed-off-by: Christian Loehle Signed-off-by: Rafael J. Wysocki commit 764c921bf0c5ff125989a6c039a344ed211ffda9 Merge: 6d8042baa80c99 25fbbaf515acd1 Author: Stephen Boyd Date: Fri Sep 19 21:28:01 2025 -0700 Merge tag 'sunxi-clk-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-fixes Pull an Allwinner clk driver fix from Chen-Yu Tsai: - One fix for the clock rate readback on the recently added dual divider clocks * tag 'sunxi-clk-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: mp: Fix dual-divider clock rate readback commit 853a57ba263adfecf4430b936d6862bc475b4bb5 Author: Takashi Sakamoto Date: Sat Sep 20 11:51:48 2025 +0900 firewire: core: fix overlooked update of subsystem ABI version In kernel v6.5, several functions were added to the cdev layer. This required updating the default version of subsystem ABI up to 6, but this requirement was overlooked. This commit updates the version accordingly. Fixes: 6add87e9764d ("firewire: cdev: add new version of ABI to notify time stamp at request/response subaction of transaction#") Link: https://lore.kernel.org/r/20250920025148.163402-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit b65678cacc030efd53c38c089fb9b741a2ee34c8 Author: Petr Malat Date: Thu Sep 18 17:21:07 2025 +0200 ethernet: rvu-af: Remove slash from the driver name Having a slash in the driver name leads to EIO being returned while reading /sys/module/rvu_af/drivers content. Remove DRV_STRING as it's not used anywhere. Fixes: 91c6945ea1f9 ("octeontx2-af: cn10k: Add RPM MAC support") Signed-off-by: Petr Malat Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250918152106.1798299-1-oss@malat.biz Signed-off-by: Jakub Kicinski commit a35c04de2565db191726b5741e6b66a35002c652 Author: Sidraya Jayagond Date: Wed Sep 17 20:42:20 2025 +0200 net/smc: fix warning in smc_rx_splice() when calling get_page() smc_lo_register_dmb() allocates DMB buffers with kzalloc(), which are later passed to get_page() in smc_rx_splice(). Since kmalloc memory is not page-backed, this triggers WARN_ON_ONCE() in get_page() and prevents holding a refcount on the buffer. This can lead to use-after-free if the memory is released before splice_to_pipe() completes. Use folio_alloc() instead, ensuring DMBs are page-backed and safe for get_page(). WARNING: CPU: 18 PID: 12152 at ./include/linux/mm.h:1330 smc_rx_splice+0xaf8/0xe20 [smc] CPU: 18 UID: 0 PID: 12152 Comm: smcapp Kdump: loaded Not tainted 6.17.0-rc3-11705-g9cf4672ecfee #10 NONE Hardware name: IBM 3931 A01 704 (z/VM 7.4.0) Krnl PSW : 0704e00180000000 000793161032696c (smc_rx_splice+0xafc/0xe20 [smc]) R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000000000000000 001cee80007d3001 00077400000000f8 0000000000000005 0000000000000001 001cee80007d3006 0007740000001000 001c000000000000 000000009b0c99e0 0000000000001000 001c0000000000f8 001c000000000000 000003ffcc6f7c88 0007740003e98000 0007931600000005 000792969b2ff7b8 Krnl Code: 0007931610326960: af000000 mc 0,0 0007931610326964: a7f4ff43 brc 15,00079316103267ea #0007931610326968: af000000 mc 0,0 >000793161032696c: a7f4ff3f brc 15,00079316103267ea 0007931610326970: e320f1000004 lg %r2,256(%r15) 0007931610326976: c0e53fd1b5f5 brasl %r14,000793168fd5d560 000793161032697c: a7f4fbb5 brc 15,00079316103260e6 0007931610326980: b904002b lgr %r2,%r11 Call Trace: smc_rx_splice+0xafc/0xe20 [smc] smc_rx_splice+0x756/0xe20 [smc]) smc_rx_recvmsg+0xa74/0xe00 [smc] smc_splice_read+0x1ce/0x3b0 [smc] sock_splice_read+0xa2/0xf0 do_splice_read+0x198/0x240 splice_file_to_pipe+0x7e/0x110 do_splice+0x59e/0xde0 __do_splice+0x11a/0x2d0 __s390x_sys_splice+0x140/0x1f0 __do_syscall+0x122/0x280 system_call+0x6e/0x90 Last Breaking-Event-Address: smc_rx_splice+0x960/0xe20 [smc] ---[ end trace 0000000000000000 ]--- Fixes: f7a22071dbf3 ("net/smc: implement DMB-related operations of loopback-ism") Reviewed-by: Mahanta Jambigi Signed-off-by: Sidraya Jayagond Link: https://patch.msgid.link/20250917184220.801066-1-sidraya@linux.ibm.com Signed-off-by: Jakub Kicinski commit 1091860a16a86ccdd77c09f2b21a5f634f5ab9ec Author: Wang Liang Date: Wed Sep 17 19:39:19 2025 +0800 net: tun: Update napi->skb after XDP process The syzbot report a UAF issue: BUG: KASAN: slab-use-after-free in skb_reset_mac_header include/linux/skbuff.h:3150 [inline] BUG: KASAN: slab-use-after-free in napi_frags_skb net/core/gro.c:723 [inline] BUG: KASAN: slab-use-after-free in napi_gro_frags+0x6e/0x1030 net/core/gro.c:758 Read of size 8 at addr ffff88802ef22c18 by task syz.0.17/6079 CPU: 0 UID: 0 PID: 6079 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 skb_reset_mac_header include/linux/skbuff.h:3150 [inline] napi_frags_skb net/core/gro.c:723 [inline] napi_gro_frags+0x6e/0x1030 net/core/gro.c:758 tun_get_user+0x28cb/0x3e20 drivers/net/tun.c:1920 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Allocated by task 6079: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:330 [inline] __kasan_mempool_unpoison_object+0xa0/0x170 mm/kasan/common.c:558 kasan_mempool_unpoison_object include/linux/kasan.h:388 [inline] napi_skb_cache_get+0x37b/0x6d0 net/core/skbuff.c:295 __alloc_skb+0x11e/0x2d0 net/core/skbuff.c:657 napi_alloc_skb+0x84/0x7d0 net/core/skbuff.c:811 napi_get_frags+0x69/0x140 net/core/gro.c:673 tun_napi_alloc_frags drivers/net/tun.c:1404 [inline] tun_get_user+0x77c/0x3e20 drivers/net/tun.c:1784 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6079: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2422 [inline] slab_free mm/slub.c:4695 [inline] kmem_cache_free+0x18f/0x400 mm/slub.c:4797 skb_pp_cow_data+0xdd8/0x13e0 net/core/skbuff.c:969 netif_skb_check_for_xdp net/core/dev.c:5390 [inline] netif_receive_generic_xdp net/core/dev.c:5431 [inline] do_xdp_generic+0x699/0x11a0 net/core/dev.c:5499 tun_get_user+0x2523/0x3e20 drivers/net/tun.c:1872 tun_chr_write_iter+0x113/0x200 drivers/net/tun.c:1996 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x5c9/0xb30 fs/read_write.c:686 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f After commit e6d5dbdd20aa ("xdp: add multi-buff support for xdp running in generic mode"), the original skb may be freed in skb_pp_cow_data() when XDP program was attached, which was allocated in tun_napi_alloc_frags(). However, the napi->skb still point to the original skb, update it after XDP process. Reported-by: syzbot+64e24275ad95a915a313@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=64e24275ad95a915a313 Fixes: e6d5dbdd20aa ("xdp: add multi-buff support for xdp running in generic mode") Signed-off-by: Wang Liang Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250917113919.3991267-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit cd89d487374c49f18a8c4af312ecc74d997f3b07 Merge: 497b9a7b8df955 daac51c7032036 Author: Linus Torvalds Date: Fri Sep 19 16:11:30 2025 -0700 Merge tag '6.17-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Two unlink fixes: one for rename and one for deferred close - Four smbdirect/RDMA fixes: fix buffer leak in negotiate, two fixes for races in smbd_destroy, fix offset and length checks in recv_done * tag '6.17-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path smb: client: fix file open check in __cifs_unlink() smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) smb: client: use disable[_delayed]_work_sync in smbdirect.c smb: client: fix filename matching of deferred files smb: client: let recv_done verify data_offset, data_length and remaining_data_length commit 497b9a7b8df955fffd612d0d4aaf315b03556b10 Merge: 1522b530ac3e2d 1e56310b40fd2e Author: Linus Torvalds Date: Fri Sep 19 16:02:48 2025 -0700 Merge tag 'iommu-fixes-v6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - Fixes for memory leak and memory corruption bugs on S390 and AMD-Vi - Race condition fix in AMD-Vi page table code and S390 device attach code - Intel VT-d: Fix alignment checks in __domain_mapping() - AMD-Vi: Fix potentially incorrect DTE settings when device has aliases * tag 'iommu-fixes-v6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/amd/pgtbl: Fix possible race while increase page table level iommu/amd: Fix alias device DTE setting iommu/s390: Make attach succeed when the device was surprise removed iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() iommu/s390: Fix memory corruption when using identity domain iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() commit 1522b530ac3e2dadd75ccb351b88d3c7c4cf584e Merge: 0d64ebf676bdee 027a7a9c07d0d7 Author: Linus Torvalds Date: Fri Sep 19 12:26:20 2025 -0700 Merge tag 'block-6.17-20250918' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "A set of fixes for an issue with md array assembly and drbd for devices supporting write zeros" * tag 'block-6.17-20250918' of git://git.kernel.dk/linux: drbd: init queue_limits->max_hw_wzeroes_unmap_sectors parameter md: init queue_limits->max_hw_wzeroes_unmap_sectors parameter commit 0d64ebf676bdeeb2df99377193830f01f92702bd Merge: 0903d0985ab0bb 2c139a47eff8de Author: Linus Torvalds Date: Fri Sep 19 12:10:49 2025 -0700 Merge tag 'io_uring-6.17-20250919' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Fix for a regression introduced in the io-wq worker creation logic. - Remove the allocation cache for the msg_ring io_kiocb allocations. I have a suspicion that there's a bug there, and since we just fixed one in that area, let's just yank the use of that cache entirely. It's not that important, and it kills some code. - Treat a closed ring like task exiting in that any requests that trigger post that condition should just get canceled. Doesn't fix any real issues, outside of having tasks being able to rely on that guarantee. - Fix for a bug in the network zero-copy notification mechanism, where a comparison for matching tctx/ctx for notifications was buggy in that it didn't correctly compare with the previous notification. * tag 'io_uring-6.17-20250919' of git://git.kernel.dk/linux: io_uring: fix incorrect io_kiocb reference in io_link_skb io_uring/msg_ring: kill alloc_cache for io_kiocb allocations io_uring: include dying ring in task_work "should cancel" state io_uring/io-wq: fix `max_workers` breakage and `nr_workers` underflow commit 0903d0985ab0bb4f41bf611f686af1791d0301e4 Merge: ffa7119cd1294d 2b464fd599c583 Author: Linus Torvalds Date: Fri Sep 19 11:39:26 2025 -0700 Merge tag 'gpio-fixes-for-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix an ACPI I2C HID driver breakage due to not initializing a structure on the stack and passing garbage down to GPIO core - ignore touchpad wakeup on GPD G1619-05 - fix debouncing configuration when looking up GPIOs in ACPI * tag 'gpio-fixes-for-v6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpiolib: acpi: initialize acpi_gpio_info struct gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-05 gpiolib: acpi: Program debounce when finding GPIO commit ffa7119cd1294dc1814e582dc07ffeb953ae7b26 Merge: 46d2affdfbb92c 77a436c93d10d6 Author: Linus Torvalds Date: Fri Sep 19 10:30:16 2025 -0700 Merge tag 'mmc-v6.17-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC host fixes from Ulf Hansson: - mvsdio: Fix dma_unmap_sg() nents value - sdhci: Fix clock management for UHS-II - sdhci-pci-gli: Fix initialization of UHS-II for GL9767 * tag 'mmc-v6.17-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci-pci-gli: GL9767: Fix initializing the UHS-II interface during a power-on mmc: sdhci-uhs2: Fix calling incorrect sdhci_set_clock() function mmc: sdhci: Move the code related to setting the clock from sdhci_set_ios_common() into sdhci_set_ios() mmc: mvsdio: Fix dma_unmap_sg() nents value commit c443be70aaee42c2d1d251e0329e0a69dd96ae54 Author: Stéphane Grosjean Date: Thu Sep 18 15:23:57 2025 +0200 can: peak_usb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 (which is the case for PC CAN FD interfaces supported by this driver). Signed-off-by: Stéphane Grosjean Link: https://patch.msgid.link/20250918132413.30071-1-stephane.grosjean@free.fr Reported-by: Marc Kleine-Budde Closes: https://lore.kernel.org/20250917-aboriginal-refined-honeybee-82b1aa-mkl@pengutronix.de Fixes: bb4785551f64 ("can: usb: PEAK-System Technik USB adapters driver core") [mkl: update subject, apply manually] Signed-off-by: Marc Kleine-Budde commit 46d2affdfbb92c383325dec35cef9abe844eda05 Merge: 39879e3a41061e 303010f4658cb1 Author: Linus Torvalds Date: Fri Sep 19 10:14:11 2025 -0700 Merge tag 'pmdomain-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: "pmdomain core: - Restore behaviour for disabling unused PM domains and introduce the GENPD_FLAG_NO_STAY_ON configuration bit pmdomain providers: - renesas: Don't keep unused PM domains powered-on - rockchip: Fix regulator dependency with GENPD_FLAG_NO_STAY_ON" * tag 'pmdomain-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: pmdomain: renesas: rmobile-sysc: Don't keep unused PM domains powered-on pmdomain: renesas: rcar-gen4-sysc: Don't keep unused PM domains powered-on pmdomain: renesas: rcar-sysc: Don't keep unused PM domains powered-on pmdomain: rockchip: Fix regulator dependency with GENPD_FLAG_NO_STAY_ON pmdomain: core: Restore behaviour for disabling unused PM domains pmdomain: renesas: rcar-sysc: Make rcar_sysc_onecell_np __initdata commit 39879e3a41061e2fc8313d55bcdbed6f458ae75d Merge: dcf7d9e0aee523 8dc5245673cf7f Author: Linus Torvalds Date: Fri Sep 19 10:06:51 2025 -0700 Merge tag 'loongarch-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Fix some build warnings for RUST-enabled objtool check, align ACPI structures for ARCH_STRICT_ALIGN, fix an unreliable stack for live patching, add some NULL pointer checkings, and fix some bugs around KVM" * tag 'loongarch-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_pch_pic_regs_access() LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_sw_status_access() LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_regs_access() LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_ctrl_access() LoongArch: KVM: Fix VM migration failure with PTW enabled LoongArch: KVM: Remove unused returns and semicolons LoongArch: vDSO: Check kcalloc() result in init_vdso() LoongArch: Fix unreliable stack for live patching LoongArch: Replace sprintf() with sysfs_emit() LoongArch: Check the return value when creating kobj LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled LoongArch: Update help info of ARCH_STRICT_ALIGN LoongArch: Handle jump tables options for RUST LoongArch: Make LTO case independent in Makefile objtool/LoongArch: Mark special atomic instruction as INSN_BUG type objtool/LoongArch: Mark types based on break immediate code commit a3ed215cb2147e98981de5321fd1b1d0e3dceb1c Merge: 5cff263606a101 17c8d794527f01 Author: Marc Kleine-Budde Date: Fri Sep 19 19:03:04 2025 +0200 Merge patch series "can: populate ndo_change_mtu() to prevent buffer overflow" Vincent Mailhol says: Four drivers, namely etas_es58x, hi311x, sun4i_can and mcba_usb forgot to populate their net_device_ops->ndo_change_mtu(). Because of that, the user is free to configure any MTU on these interfaces. This can be abused by an attacker who could craft some skbs and send them through PF_PACKET to perform a buffer overflow of up to 247 bytes in each of these drivers. This series contains four patches, one for each of the drivers, to add the missing ndo_change_mtu() callback. The descriptions contain detailed explanations of how the buffer overflow could be triggered. Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-0-0d1cada9393b@kernel.org Signed-off-by: Marc Kleine-Budde commit 17c8d794527f01def0d1c8b7dc2d7b8d34fed0e6 Author: Vincent Mailhol Date: Thu Sep 18 18:00:27 2025 +0900 can: mcba_usb: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU. Unfortunately, because the mcba_usb driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doing so, the attacker could open a PF_PACKET socket using the ETH_P_CANXL protocol: socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL)) to inject a malicious CAN XL frames. For example: struct canxl_frame frame = { .flags = 0xff, .len = 2048, }; The CAN drivers' xmit() function are calling can_dev_dropped_skb() to check that the skb is valid, unfortunately under above conditions, the malicious packet is able to go through can_dev_dropped_skb() checks: 1. the skb->protocol is set to ETH_P_CANXL which is valid (the function does not check the actual device capabilities). 2. the length is a valid CAN XL length. And so, mcba_usb_start_xmit() receives a CAN XL frame which it is not able to correctly handle and will thus misinterpret it as a CAN frame. This can result in a buffer overflow. The driver will consume cf->len as-is with no further checks on these lines: usb_msg.dlc = cf->len; memcpy(usb_msg.data, cf->data, usb_msg.dlc); Here, cf->len corresponds to the flags field of the CAN XL frame. In our previous example, we set canxl_frame->flags to 0xff. Because the maximum expected length is 8, a buffer overflow of 247 bytes occurs! Populate net_device_ops->ndo_change_mtu() to ensure that the interface's MTU can not be set to anything bigger than CAN_MTU. By fixing the root cause, this prevents the buffer overflow. Fixes: 51f3baad7de9 ("can: mcba_usb: Add support for Microchip CAN BUS Analyzer") Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-4-0d1cada9393b@kernel.org Signed-off-by: Marc Kleine-Budde commit 61da0bd4102c459823fbe6b8b43b01fb6ace4a22 Author: Vincent Mailhol Date: Thu Sep 18 18:00:26 2025 +0900 can: sun4i_can: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU. Unfortunately, because the sun4i_can driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doing so, the attacker could open a PF_PACKET socket using the ETH_P_CANXL protocol: socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL)) to inject a malicious CAN XL frames. For example: struct canxl_frame frame = { .flags = 0xff, .len = 2048, }; The CAN drivers' xmit() function are calling can_dev_dropped_skb() to check that the skb is valid, unfortunately under above conditions, the malicious packet is able to go through can_dev_dropped_skb() checks: 1. the skb->protocol is set to ETH_P_CANXL which is valid (the function does not check the actual device capabilities). 2. the length is a valid CAN XL length. And so, sun4ican_start_xmit() receives a CAN XL frame which it is not able to correctly handle and will thus misinterpret it as a CAN frame. This can result in a buffer overflow. The driver will consume cf->len as-is with no further checks on this line: dlc = cf->len; Here, cf->len corresponds to the flags field of the CAN XL frame. In our previous example, we set canxl_frame->flags to 0xff. Because the maximum expected length is 8, a buffer overflow of 247 bytes occurs a couple line below when doing: for (i = 0; i < dlc; i++) writel(cf->data[i], priv->base + (dreg + i * 4)); Populate net_device_ops->ndo_change_mtu() to ensure that the interface's MTU can not be set to anything bigger than CAN_MTU. By fixing the root cause, this prevents the buffer overflow. Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module") Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-3-0d1cada9393b@kernel.org Signed-off-by: Marc Kleine-Budde commit ac1c7656fa717f29fac3ea073af63f0b9919ec9a Author: Vincent Mailhol Date: Thu Sep 18 18:00:25 2025 +0900 can: hi311x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU. Unfortunately, because the sun4i_can driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doing so, the attacker could open a PF_PACKET socket using the ETH_P_CANXL protocol: socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL)) to inject a malicious CAN XL frames. For example: struct canxl_frame frame = { .flags = 0xff, .len = 2048, }; The CAN drivers' xmit() function are calling can_dev_dropped_skb() to check that the skb is valid, unfortunately under above conditions, the malicious packet is able to go through can_dev_dropped_skb() checks: 1. the skb->protocol is set to ETH_P_CANXL which is valid (the function does not check the actual device capabilities). 2. the length is a valid CAN XL length. And so, hi3110_hard_start_xmit() receives a CAN XL frame which it is not able to correctly handle and will thus misinterpret it as a CAN frame. The driver will consume frame->len as-is with no further checks. This can result in a buffer overflow later on in hi3110_hw_tx() on this line: memcpy(buf + HI3110_FIFO_EXT_DATA_OFF, frame->data, frame->len); Here, frame->len corresponds to the flags field of the CAN XL frame. In our previous example, we set canxl_frame->flags to 0xff. Because the maximum expected length is 8, a buffer overflow of 247 bytes occurs! Populate net_device_ops->ndo_change_mtu() to ensure that the interface's MTU can not be set to anything bigger than CAN_MTU. By fixing the root cause, this prevents the buffer overflow. Fixes: 57e83fb9b746 ("can: hi311x: Add Holt HI-311x CAN driver") Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-2-0d1cada9393b@kernel.org Signed-off-by: Marc Kleine-Budde commit 38c0abad45b190a30d8284a37264d2127a6ec303 Author: Vincent Mailhol Date: Thu Sep 18 18:00:24 2025 +0900 can: etas_es58x: populate ndo_change_mtu() to prevent buffer overflow Sending an PF_PACKET allows to bypass the CAN framework logic and to directly reach the xmit() function of a CAN driver. The only check which is performed by the PF_PACKET framework is to make sure that skb->len fits the interface's MTU. Unfortunately, because the etas_es58x driver does not populate its net_device_ops->ndo_change_mtu(), it is possible for an attacker to configure an invalid MTU by doing, for example: $ ip link set can0 mtu 9999 After doing so, the attacker could open a PF_PACKET socket using the ETH_P_CANXL protocol: socket(PF_PACKET, SOCK_RAW, htons(ETH_P_CANXL)); to inject a malicious CAN XL frames. For example: struct canxl_frame frame = { .flags = 0xff, .len = 2048, }; The CAN drivers' xmit() function are calling can_dev_dropped_skb() to check that the skb is valid, unfortunately under above conditions, the malicious packet is able to go through can_dev_dropped_skb() checks: 1. the skb->protocol is set to ETH_P_CANXL which is valid (the function does not check the actual device capabilities). 2. the length is a valid CAN XL length. And so, es58x_start_xmit() receives a CAN XL frame which it is not able to correctly handle and will thus misinterpret it as a CAN(FD) frame. This can result in a buffer overflow. For example, using the es581.4 variant, the frame will be dispatched to es581_4_tx_can_msg(), go through the last check at the beginning of this function: if (can_is_canfd_skb(skb)) return -EMSGSIZE; and reach this line: memcpy(tx_can_msg->data, cf->data, cf->len); Here, cf->len corresponds to the flags field of the CAN XL frame. In our previous example, we set canxl_frame->flags to 0xff. Because the maximum expected length is 8, a buffer overflow of 247 bytes occurs! Populate net_device_ops->ndo_change_mtu() to ensure that the interface's MTU can not be set to anything bigger than CAN_MTU or CANFD_MTU (depending on the device capabilities). By fixing the root cause, this prevents the buffer overflow. Fixes: 8537257874e9 ("can: etas_es58x: add core support for ETAS ES58X CAN USB interfaces") Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250918-can-fix-mtu-v1-1-0d1cada9393b@kernel.org Signed-off-by: Marc Kleine-Budde commit 5cff263606a10102a0ea19ff579eaa18fd5577ad Author: Duy Nguyen Date: Thu Sep 18 07:03:45 2025 +0000 can: rcar_canfd: Fix controller mode setting Driver configures register to choose controller mode before setting all channels to reset mode leading to failure. The patch corrects operation of mode setting. Signed-off-by: Duy Nguyen Signed-off-by: Tranh Ha Link: https://patch.msgid.link/TYWPR01MB87434739F83E27EDCD23DF44B416A@TYWPR01MB8743.jpnprd01.prod.outlook.com Signed-off-by: Marc Kleine-Budde commit 6b696808472197b77b888f50bc789a3bae077743 Author: Chen Yufeng Date: Thu Sep 11 23:08:20 2025 +0800 can: hi311x: fix null pointer dereference when resuming from sleep before interface was enabled This issue is similar to the vulnerability in the `mcp251x` driver, which was fixed in commit 03c427147b2d ("can: mcp251x: fix resume from sleep before interface was brought up"). In the `hi311x` driver, when the device resumes from sleep, the driver schedules `priv->restart_work`. However, if the network interface was not previously enabled, the `priv->wq` (workqueue) is not allocated and initialized, leading to a null pointer dereference. To fix this, we move the allocation and initialization of the workqueue from the `hi3110_open` function to the `hi3110_can_probe` function. This ensures that the workqueue is properly initialized before it is used during device resume. And added logic to destroy the workqueue in the error handling paths of `hi3110_can_probe` and in the `hi3110_can_remove` function to prevent resource leaks. Signed-off-by: Chen Yufeng Link: https://patch.msgid.link/20250911150820.250-1-chenyufeng@iie.ac.cn Signed-off-by: Marc Kleine-Budde commit dcf7d9e0aee523e588aa3d5ce7394043cd2dea9e Merge: e8442d5b7bc633 1b34cbbf4f011a Author: Linus Torvalds Date: Fri Sep 19 09:58:21 2025 -0700 Merge tag 'v6.17-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fixes from Herbert Xu: "This fixes a NULL pointer dereference in ccp and a couple of bugs in the af_alg interface" * tag 'v6.17-p3' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg crypto: af_alg - Set merge to zero early in af_alg_sendmsg crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() commit bba920e6f803138587248079de47ad3464a396f6 Author: Basavaraj Natikar Date: Thu Sep 18 18:02:02 2025 +0530 HID: amd_sfh: Add sync across amd sfh work functions The process of the report is delegated across different work functions. Hence, add a sync mechanism to protect SFH work data across functions. Fixes: 4b2c53d93a4b ("SFH:Transport Driver to add support of AMD Sensor Fusion Hub (SFH)") Reported-by: Matthew Schwartz Closes: https://lore.kernel.org/all/a21abca5-4268-449d-95f1-bdd7a25894a5@linux.dev/ Tested-by: Prakruthi SP Co-developed-by: Akshata MukundShetty Signed-off-by: Akshata MukundShetty Signed-off-by: Basavaraj Natikar Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Jiri Kosina commit e8442d5b7bc6338d553040f5b1f7bd43f5ab30e0 Merge: f2738f5660f5c4 d33c3471047fc5 Author: Linus Torvalds Date: Fri Sep 19 08:22:07 2025 -0700 Merge tag 'sound-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes. The volume became higher than wished, but nothing really stands out -- all small, nice and smooth. A slightly large change is found in qcom USB-audio offload stuff, but this is a regression fix specific to this device, hence it should be safe to apply at this late stage. - Various small fixes for ASoC Cirrus, Realtek, lpass, Intel and Qualcomm drivers - ASoC SoundWire fixes - A few TAS2781 HD-audio side-codec driver fixes - A fix for Qualcomm USB-audio offload breakage - Usual a few HD-audio quirks" * tag 'sound-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (35 commits) ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx ALSA: hda: intel-dsp-config: Prevent SEGFAULT if ACPI_HANDLE() is NULL ALSA: usb: qcom: Fix false-positive address space check ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue ASoC: Intel: PTL: Add entry for HDMI-In capture support to non-I2S codec boards. ASoC: amd: acp: Fix incorrect retrival of acp_chip_info ASoC: Intel: sof_sdw: use PRODUCT_FAMILY for Fatcat series ASoC: qcom: sc8280xp: Fix sound card driver name match data for QCS8275 ALSA: hda/realtek: Fix volume control on Lenovo Thinkbook 13x Gen 4 ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 5 ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 5 ALSA: hda/realtek: Add ALC295 Dell TAS2781 I2C fixup ALSA: hda/tas2781: Fix a potential race condition that causes a NULL pointer in case no efi.get_variable exsits ASoC: qcom: sc8280xp: Enable DAI format configuration for MI2S interfaces ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface ASoC: Intel: catpt: Expose correct bit depth to userspace ALSA: hda/tas2781: Fix the order of TAS2781 calibrated-data ASoC: codecs: lpass-wsa-macro: Fix speaker quality distortion ASoC: codecs: lpass-rx-macro: Fix playback quality distortion ... commit f2738f5660f5c48eb9254689b569640091d3674f Merge: 097a6c336d0080 feb96ccb331892 Author: Linus Torvalds Date: Fri Sep 19 08:13:46 2025 -0700 Merge tag 'drm-fixes-2025-09-19' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes for drm, it's a bit busier than I'd like on the xe side this week, but otherwise amdgpu and some smaller fixes for i915/bridge and a revert on docs. docs: - fix docs build regression i915: - Honor VESA eDP backlight luminance control capability bridge: - anx7625: Fix NULL pointer dereference with early IRQ - cdns-mhdp8546: Fix missing mutex unlock on error path xe: - Release kobject for the failure path - SRIOV PF: Drop rounddown_pow_of_two fair - Remove type casting on hwmon - Defer free of NVM auxiliary container to device release - Fix a NULL vs IS_ERR - Add cleanup action in xe_device_sysfs_init - Fix error handling if PXP fails to start - Set GuC RCS/CCS yield policy amdgpu: - GC 11.0.1/4 cleaner shader support - DC irq fix - OD fix amdkfd: - S0ix fix" * tag 'drm-fixes-2025-09-19' of https://gitlab.freedesktop.org/drm/kernel: drm/amdgpu: suspend KFD and KGD user queues for S0ix drm/amdkfd: add proper handling for S0ix drm/xe/guc: Set RCS/CCS yield policy drm/xe: Fix error handling if PXP fails to start drm/xe/sysfs: Add cleanup action in xe_device_sysfs_init drm/amd: Only restore cached manual clock settings in restore if OD enabled drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path drm/i915/backlight: Honor VESA eDP backlight luminance control capability drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put drm/amdgpu/gfx11: Add Cleaner Shader Support for GFX11.0.1/11.0.4 GPUs drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ drm/xe: defer free of NVM auxiliary container to device release callback drm/xe/hwmon: Remove type casting drm/xe/pf: Drop rounddown_pow_of_two fair LMEM limitation drm/xe/tile: Release kobject for the failure path Revert "drm: Add directive to format code in comment" commit 43f6bee02196e56720dd68eea847d213c6e69328 Author: Jason Gunthorpe Date: Wed Sep 17 16:55:51 2025 -0300 iommufd/selftest: Update the fail_nth limit There are more failure conditions now so 400 iterations is not enough pass them all, up it to 1000. The limit exists so it doesn't infinite loop. Link: https://patch.msgid.link/r/3-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 53d0584eeb2c85a46c83656246d61a89558d74b3 Author: Jason Gunthorpe Date: Wed Sep 17 15:59:59 2025 -0300 iommufd: WARN if an object is aborted with an elevated refcount If something holds a refcount then it is at risk of UAFing. For abort paths we expect the caller to never share the object with a parallel thread and to clean up any refcounts it obtained on its own. Add the missing dec inside iommufd_hwpt_paging_alloc() during error unwind by making iommufd_hw_pagetable_attach/detach() proper pairs. Link: https://patch.msgid.link/r/2-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Tested-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 4e034bf045b12852a24d5d33f2451850818ba0c1 Author: Jason Gunthorpe Date: Tue Sep 16 20:47:10 2025 -0300 iommufd: Fix race during abort for file descriptors fput() doesn't actually call file_operations release() synchronously, it puts the file on a work queue and it will be released eventually. This is normally fine, except for iommufd the file and the iommufd_object are tied to gether. The file has the object as it's private_data and holds a users refcount, while the object is expected to remain alive as long as the file is. When the allocation of a new object aborts before installing the file it will fput() the file and then go on to immediately kfree() the obj. This causes a UAF once the workqueue completes the fput() and tries to decrement the users refcount. Fix this by putting the core code in charge of the file lifetime, and call __fput_sync() during abort to ensure that release() is called before kfree. __fput_sync() is a bit too tricky to open code in all the object implementations. Instead the objects tell the core code where the file pointer is and the core will take care of the life cycle. If the object is successfully allocated then the file will hold a users refcount and the iommufd_object cannot be destroyed. It is worth noting that close(); ioctl(IOMMU_DESTROY); doesn't have an issue because close() is already using a synchronous version of fput(). The UAF looks like this: BUG: KASAN: slab-use-after-free in iommufd_eventq_fops_release+0x45/0xc0 drivers/iommu/iommufd/eventq.c:376 Write of size 4 at addr ffff888059c97804 by task syz.0.46/6164 CPU: 0 UID: 0 PID: 6164 Comm: syz.0.46 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x100/0x1b0 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] __refcount_dec include/linux/refcount.h:455 [inline] refcount_dec include/linux/refcount.h:476 [inline] iommufd_eventq_fops_release+0x45/0xc0 drivers/iommu/iommufd/eventq.c:376 __fput+0x402/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x41c/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Link: https://patch.msgid.link/r/1-v1-02cd136829df+31-iommufd_syz_fput_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: 07838f7fd529 ("iommufd: Add iommufd fault object") Reviewed-by: Nicolin Chen Reviewed-by: Nirmoy Das Reviewed-by: Kevin Tian Tested-by: Nicolin Chen Reported-by: syzbot+80620e2d0d0a33b09f93@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/68c8583d.050a0220.2ff435.03a2.GAE@google.com Signed-off-by: Jason Gunthorpe commit 7a425ec75d2bb30a1c959a8676ef8c5ef285095d Author: Jason Gunthorpe Date: Tue Sep 16 12:42:56 2025 -0300 iommufd: Fix refcounting race during mmap The owner object of the imap can be destroyed while the imap remains in the mtree. So access to the imap pointer without holding locks is racy with destruction. The imap is safe to access outside the lock once a users refcount is obtained, the owner object cannot start destruction until users is 0. Thus the users refcount should not be obtained at the end of iommufd_fops_mmap() but instead inside the mtree lock held around the mtree_load(). Move the refcount there and use refcount_inc_not_zero() as we can have a 0 refcount inside the mtree during destruction races. Link: https://patch.msgid.link/r/0-v1-e6faace50971+3cc-iommufd_mmap_fix_jgg@nvidia.com Cc: stable@vger.kernel.org Fixes: 56e9a0d8e53f ("iommufd: Add mmap interface") Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 2c139a47eff8de24e3350dadb4c9d5e3426db826 Author: Yang Xiuwei Date: Fri Sep 19 17:03:52 2025 +0800 io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the context validation check to compare the current notification with itself instead of comparing it with the previous notification. Fix by using the correct prev_nd parameter when obtaining prev_notif. Signed-off-by: Yang Xiuwei Reviewed-by: Pavel Begunkov Fixes: 6fe4220912d19 ("io_uring/notif: implement notification stacking") Signed-off-by: Jens Axboe commit 352e66900cde63f3dadb142364d3c35170bbaaff Author: Zabelin Nikita Date: Thu Sep 18 18:06:59 2025 +0300 drm/gma500: Fix null dereference in hdmi teardown pci_set_drvdata sets the value of pdev->driver_data to NULL, after which the driver_data obtained from the same dev is dereferenced in oaktrail_hdmi_i2c_exit, and the i2c_dev is extracted from it. To prevent this, swap these calls. Found by Linux Verification Center (linuxtesting.org) with Svacer. Fixes: 1b082ccf5901 ("gma500: Add Oaktrail support") Signed-off-by: Zabelin Nikita Signed-off-by: Patrik Jakobsson Link: https://lore.kernel.org/r/20250918150703.2562604-1-n.zabelin@mt-integration.ru commit e430451613c7a27beeadd00d707bcf7ceec6328e Author: Jason Wang Date: Wed Sep 17 14:30:45 2025 +0800 vhost-net: flush batched before enabling notifications Commit 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after sendmsg") tries to defer the notification enabling by moving the logic out of the loop after the vhost_tx_batch() when nothing new is spotted. This caused unexpected side effects as the new logic is reused for several other error conditions. A previous patch reverted 8c2e6b26ffe2. Now, bring the performance back up by flushing batched buffers before enabling notifications. Reported-by: Jon Kohler Cc: stable@vger.kernel.org Fixes: 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after sendmsg") Signed-off-by: Jason Wang Signed-off-by: Michael S. Tsirkin Message-Id: <20250917063045.2042-3-jasowang@redhat.com> commit 4174152771bf0d014d58f7d7e148bb0c8830fe53 Author: Michael S. Tsirkin Date: Wed Sep 17 14:30:44 2025 +0800 Revert "vhost/net: Defer TX queue re-enable until after sendmsg" This reverts commit 8c2e6b26ffe243be1e78f5a4bfb1a857d6e6f6d6. It tries to defer the notification enabling by moving the logic out of the loop after the vhost_tx_batch() when nothing new is spotted. This will bring side effects as the new logic would be reused for several other error conditions. One example is the IOTLB: when there's an IOTLB miss, get_tx_bufs() might return -EAGAIN and exit the loop and see there's still available buffers, so it will queue the tx work again until userspace feed the IOTLB entry correctly. This will slowdown the tx processing and trigger the TX watchdog in the guest as reported in https://lkml.org/lkml/2025/9/10/1596. To fix, revert the change. A follow up patch will bring the performance back in a safe way. Reported-by: Jon Kohler Cc: stable@vger.kernel.org Fixes: 8c2e6b26ffe2 ("vhost/net: Defer TX queue re-enable until after sendmsg") Signed-off-by: Jason Wang Signed-off-by: Michael S. Tsirkin Message-Id: <20250917063045.2042-2-jasowang@redhat.com> commit 90beccb3e1287b8d596c4816530ef54df01aa11f Author: Jason Wang Date: Wed Sep 17 14:30:43 2025 +0800 vhost-net: unbreak busy polling Commit 67a873df0c41 ("vhost: basic in order support") pass the number of used elem to vhost_net_rx_peek_head_len() to make sure it can signal the used correctly before trying to do busy polling. But it forgets to clear the count, this would cause the count run out of sync with handle_rx() and break the busy polling. Fixing this by passing the pointer of the count and clearing it after the signaling the used. Acked-by: Michael S. Tsirkin Cc: stable@vger.kernel.org Fixes: 67a873df0c41 ("vhost: basic in order support") Signed-off-by: Jason Wang Message-Id: <20250917063045.2042-1-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin commit 1e56310b40fd2e7e0b9493da9ff488af145bdd0c Author: Vasant Hegde Date: Sat Sep 13 06:26:57 2025 +0000 iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels (up to 6 levels), starting with a 3-level configuration that expands based on IOVA address. The kernel maintains a root pointer and current page table level to enable proper page table walks in alloc_pte()/fetch_pte() operations. The IOMMU IOVA allocator initially starts with 32-bit address and onces its exhuasted it switches to 64-bit address (max address is determined based on IOMMU and device DMA capability). To support larger IOVA, AMD IOMMU driver increases page table level. But in unmap path (iommu_v1_unmap_pages()), fetch_pte() reads pgtable->[root/mode] without lock. So its possible that in exteme corner case, when increase_address_space() is updating pgtable->[root/mode], fetch_pte() reads wrong page table level (pgtable->mode). It does compare the value with level encoded in page table and returns NULL. This will result is iommu_unmap ops to fail and upper layer may retry/log WARN_ON. CPU 0 CPU 1 ------ ------ map pages unmap pages alloc_pte() -> increase_address_space() iommu_v1_unmap_pages() -> fetch_pte() pgtable->root = pte (new root value) READ pgtable->[mode/root] Reads new root, old mode Updates mode (pgtable->mode += 1) Since Page table level updates are infrequent and already synchronized with a spinlock, implement seqcount to enable lock-free read operations on the read path. Fixes: 754265bcab7 ("iommu/amd: Fix race in increase_address_space()") Reported-by: Alejandro Jimenez Cc: stable@vger.kernel.org Cc: Joao Martins Cc: Suravee Suthikulpanit Signed-off-by: Vasant Hegde Signed-off-by: Joerg Roedel commit c7c31f8dc54aa3c9b2c994b5f1ff7e740a654e97 Author: Nirmoy Das Date: Wed Sep 17 12:43:46 2025 -0700 drm/ast: Use msleep instead of mdelay for edid read The busy-waiting in `mdelay()` can cause CPU stalls and kernel timeouts during boot. Signed-off-by: Nirmoy Das Reviewed-by: Thomas Zimmermann Tested-by: Carol L Soto csoto@nvidia.com Fixes: 594e9c04b586 ("drm/ast: Create the driver for ASPEED proprietory Display-Port") Cc: KuoHsiang Chou Cc: Thomas Zimmermann Cc: Dave Airlie Cc: Jocelyn Falempe Cc: dri-devel@lists.freedesktop.org Cc: # v5.19+ Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250917194346.2905522-1-nirmoyd@nvidia.com commit feb96ccb33189244eaa5a7e8064e623976dbbfe3 Merge: b55caa69c50dd6 9272bb34b06699 Author: Dave Airlie Date: Fri Sep 19 11:53:08 2025 +1000 Merge tag 'amd-drm-fixes-6.17-2025-09-18' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.17-2025-09-18: amdgpu: - GC 11.0.1/4 cleaner shader support - DC irq fix - OD fix amdkfd: - S0ix fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250918191428.2553105-1-alexander.deucher@amd.com commit b55caa69c50dd62206afab745defcca6aef31ae8 Merge: f5a9c2b49ffd5e 26caeae9fb482e Author: Dave Airlie Date: Fri Sep 19 11:19:36 2025 +1000 Merge tag 'drm-xe-fixes-2025-09-18' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Release kobject for the failure path (Shuicheng) - SRIOV PF: Drop rounddown_pow_of_two fair (Michal) - Remove type casting on hwmon (Mallesh) - Defer free of NVM auxiliary container to device release (Nitin) - Fix a NULL vs IS_ERR (Dan) - Add cleanup action in xe_device_sysfs_init (Zongyao) - Fix error handling if PXP fails to start (Daniele) - Set GuC RCS/CCS yield policy (Daniele) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aMwL7vxFP1L94IML@intel.com commit f5a9c2b49ffd5e859a812aeb0792f87d561ba555 Merge: 5349f295341aa6 288dac9fb60843 Author: Dave Airlie Date: Fri Sep 19 10:27:57 2025 +1000 Merge tag 'drm-misc-fixes-2025-09-18' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes One fix for a documentation warning, a null pointer dereference fix for anx7625, and a mutex unlock fix for cdns-mhdp8546 Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250918-orthodox-pretty-puma-1ddeea@houat commit b99dd77076bd3fddac6f7f1cbfa081c38fde17f5 Author: Lukasz Czapnik Date: Wed Aug 13 12:45:18 2025 +0200 i40e: improve VF MAC filters accounting When adding new VM MAC, driver checks only *active* filters in vsi->mac_filter_hash. Each MAC, even in non-active state is using resources. To determine number of MACs VM uses, count VSI filters in *any* state. Add i40e_count_all_filters() to simply count all filters, and rename i40e_count_filters() to i40e_count_active_filters() to avoid ambiguity. Fixes: cfb1d572c986 ("i40e: Add ensurance of MacVlan resources for every trusted VF") Cc: stable@vger.kernel.org Signed-off-by: Lukasz Czapnik Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit eac04428abe9f9cb203ffae4600791ea1d24eb18 Author: Lukasz Czapnik Date: Wed Aug 13 12:45:17 2025 +0200 i40e: add mask to apply valid bits for itr_idx The ITR index (itr_idx) is only 2 bits wide. When constructing the register value for QINT_RQCTL, all fields are ORed together. Without masking, higher bits from itr_idx may overwrite adjacent fields in the register. Apply I40E_QINT_RQCTL_ITR_INDX_MASK to ensure only the intended bits are set. Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface") Cc: stable@vger.kernel.org Signed-off-by: Lukasz Czapnik Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit cb79fa7118c150c3c76a327894bb2eb878c02619 Author: Lukasz Czapnik Date: Wed Aug 13 12:45:16 2025 +0200 i40e: add max boundary check for VF filters There is no check for max filters that VF can request. Add it. Fixes: e284fc280473 ("i40e: Add and delete cloud filter") Cc: stable@vger.kernel.org Signed-off-by: Lukasz Czapnik Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 877b7e6ffc23766448236e8732254534c518ba42 Author: Lukasz Czapnik Date: Wed Aug 13 12:45:15 2025 +0200 i40e: fix validation of VF state in get resources VF state I40E_VF_STATE_ACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed to obtain resources. Use I40E_VF_STATE_RESOURCES_LOADED that is set only in i40e_vc_get_vf_resources_msg() and cleared during reset. Fixes: 61125b8be85d ("i40e: Fix failed opcode appearing if handling messages from VF") Cc: stable@vger.kernel.org Signed-off-by: Lukasz Czapnik Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 9739d5830497812b0bdeaee356ddefbe60830b88 Author: Lukasz Czapnik Date: Wed Aug 13 12:45:14 2025 +0200 i40e: fix input validation logic for action_meta Fix condition to check 'greater or equal' to prevent OOB dereference. Fixes: e284fc280473 ("i40e: Add and delete cloud filter") Cc: stable@vger.kernel.org Signed-off-by: Lukasz Czapnik Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit f1ad24c5abe1eaef69158bac1405a74b3c365115 Author: Lukasz Czapnik Date: Wed Aug 13 12:45:13 2025 +0200 i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg(). Fixes: c27eac48160d ("i40e: Enable ADq and create queue channel/s on VF") Cc: stable@vger.kernel.org Signed-off-by: Lukasz Czapnik Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Kamakshi Nellore (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit aa68d3c3ac8d1dcec40d52ae27e39f6d32207009 Author: Lukasz Czapnik Date: Wed Aug 13 12:45:12 2025 +0200 i40e: fix idx validation in i40e_validate_queue_map Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_validate_queue_map(). Fixes: c27eac48160d ("i40e: Enable ADq and create queue channel/s on VF") Cc: stable@vger.kernel.org Signed-off-by: Lukasz Czapnik Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Kamakshi Nellore (A Contingent Worker at Intel) Signed-off-by: Tony Nguyen commit 55d225670def06b01af2e7a5e0446fbe946289e8 Author: Lukasz Czapnik Date: Wed Aug 13 12:45:11 2025 +0200 i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To address this, introduce an upper boundary check for both Tx and Rx queue lengths. The maximum number of descriptors supported by the hardware is 8k-32. Additionally, enforce alignment constraints: Tx rings must be a multiple of 8, and Rx rings must be a multiple of 32. Fixes: 5c3c48ac6bf5 ("i40e: implement virtual device interface") Cc: stable@vger.kernel.org Signed-off-by: Lukasz Czapnik Reviewed-by: Aleksandr Loktionov Signed-off-by: Przemek Kitszel Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 097a6c336d0080725c626fda118ecfec448acd0f Merge: cbf658dd09419f ef442fc5c1a9a2 Author: Linus Torvalds Date: Thu Sep 18 15:22:00 2025 -0700 Merge tag 'trace-rv-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull runtime verifier fixes from Steven Rostedt: - Fix build in some RISC-V flavours Some system calls only are available for the 64bit RISC-V machines. #ifdef out the cases of clock_nanosleep and futex in the sleep monitor if they are not supported by the architecture. - Fix wrong cast, obsolete after refactoring Use container_of() to get to the rv_monitor structure from the enable_monitors_next() 'p' pointer. The assignment worked only because the list field used happened to be the first field of the structure. - Remove redundant include files Some include files were listed twice. Remove the extra ones and sort the includes. - Fix missing unlock on failure There was an error path that exited the rv_register_monitor() function without releasing a lock. Change that to goto the lock release. - Add Gabriele Monaco to be Runtime Verifier maintainer Gabriele is doing most of the work on RV as well as collecting patches. Add him to the maintainers file for Runtime Verification. * tag 'trace-rv-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rv: Add Gabriele Monaco as maintainer for Runtime Verification rv: Fix missing mutex unlock in rv_register_monitor() include/linux/rv.h: remove redundant include file rv: Fix wrong type cast in enabled_monitors_next() rv: Support systems with time64-only syscalls commit daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 Author: Stefan Metzmacher Date: Thu Sep 18 03:06:46 2025 +0200 smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path During tests of another unrelated patch I was able to trigger this error: Objects remaining on __kmem_cache_shutdown() Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 251090e2c2c1be60607d1c521af2c993f04d4f61 Author: Paulo Alcantara Date: Thu Sep 18 12:30:32 2025 -0300 smb: client: fix file open check in __cifs_unlink() Fix the file open check to decide whether or not silly-rename the file in SMB2+. Fixes: c5ea3065586d ("smb: client: fix data loss due to broken rename(2)") Signed-off-by: Paulo Alcantara (Red Hat) Cc: Frank Sorenson Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 30dbc1c8d50f13c1581b49abe46fe89f393eacbf Author: Khairul Anuar Romli Date: Wed Sep 10 16:06:32 2025 +0800 spi: cadence-qspi: defer runtime support on socfpga if reset bit is enabled Enabling runtime PM allows the kernel to gate clocks and power to idle devices. On SoCFPGA, a warm reset does not fully reinitialize these domains.This leaves devices suspended and powered down, preventing U-Boot or the kernel from reusing them after a warm reset, which breaks the boot process. Fixes: 4892b374c9b7 ("mtd: spi-nor: cadence-quadspi: Add runtime PM support") CC: stable@vger.kernel.org # 6.12+ Signed-off-by: Khairul Anuar Romli Signed-off-by: Adrian Ng Ho Yin Reviewed-by: Niravkumar L Rabara Reviewed-by: Matthew Gerlach Link: https://patch.msgid.link/910aad68ba5d948919a7b90fa85a2fadb687229b.1757491372.git.khairul.anuar.romli@altera.com Signed-off-by: Mark Brown commit ef442fc5c1a9a2a232de85a0e6967f388b6c0c8e Author: Steven Rostedt Date: Thu Sep 11 11:57:44 2025 -0400 rv: Add Gabriele Monaco as maintainer for Runtime Verification Gabriele will start taking over managing the changes to the Runtime Verification. Make him officially one of the maintainers. Cc: Gabriele Monaco Cc: Linus Torvalds Link: https://lore.kernel.org/20250911115744.66ccade3@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit df8922afc37aa2111ca79a216653a629146763ad Author: Jens Axboe Date: Thu Sep 18 13:59:15 2025 -0600 io_uring/msg_ring: kill alloc_cache for io_kiocb allocations A recent commit: fc582cd26e88 ("io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU") fixed an issue with not deferring freeing of io_kiocb structs that msg_ring allocates to after the current RCU grace period. But this only covers requests that don't end up in the allocation cache. If a request goes into the alloc cache, it can get reused before it is sane to do so. A recent syzbot report would seem to indicate that there's something there, however it may very well just be because of the KASAN poisoning that the alloc_cache handles manually. Rather than attempt to make the alloc_cache sane for that use case, just drop the usage of the alloc_cache for msg_ring request payload data. Fixes: 50cf5f3842af ("io_uring/msg_ring: add an alloc cache for io_kiocb entries") Link: https://lore.kernel.org/io-uring/68cc2687.050a0220.139b6.0005.GAE@google.com/ Reported-by: syzbot+baa2e0f4e02df602583e@syzkaller.appspotmail.com Signed-off-by: Jens Axboe commit 07db1def8f0aad25612b35377b63aa20b032c86d Author: Alyssa Rosenzweig Date: Mon Sep 8 09:04:19 2025 -0400 MAINTAINERS: remove Alyssa Rosenzweig I'm moving on to other projects [1] and no longer wish to be copied on kernel patches. Remove my MAINTAINERS entries: both related to Apple driver support. So long and thanks for all the fish. [1] https://rosenzweig.io/blog/asahi-gpu-part-n.html Reviewed-by: Neal Gompa Signed-off-by: Alyssa Rosenzweig Signed-off-by: Sven Peter commit d33c3471047fc54966621d19329e6a23ebc8ec50 Author: Praful Adiga Date: Thu Sep 18 12:40:18 2025 -0400 ALSA: hda/realtek: Fix mute led for HP Laptop 15-dw4xx This laptop uses the ALC236 codec with COEF 0x7 and idx 1 to control the mute LED. Enable the existing quirk for this device. Signed-off-by: Praful Adiga Cc: Signed-off-by: Takashi Iwai commit 9272bb34b066993f5f468b219b4a26ba3f2b25a1 Author: Alex Deucher Date: Wed Sep 17 12:42:11 2025 -0400 drm/amdgpu: suspend KFD and KGD user queues for S0ix We need to make sure the user queues are preempted so GFX can enter gfxoff. Reviewed-by: Mario Limonciello (AMD) Tested-by: David Perry Signed-off-by: Alex Deucher (cherry picked from commit f8b367e6fa1716cab7cc232b9e3dff29187fc99d) Cc: stable@vger.kernel.org commit 2ade36eaa9ac05e4913e9785df19c2cde8f912fb Author: Alex Deucher Date: Wed Sep 17 12:42:09 2025 -0400 drm/amdkfd: add proper handling for S0ix When in S0i3, the GFX state is retained, so all we need to do is stop the runlist so GFX can enter gfxoff. Reviewed-by: Mario Limonciello (AMD) Tested-by: David Perry Signed-off-by: Alex Deucher (cherry picked from commit 4bfa8609934dbf39bbe6e75b4f971469384b50b1) Cc: stable@vger.kernel.org commit cbf658dd09419f1ef9de11b9604e950bdd5c170b Merge: 86cc796e5e9bff f8b4687151021d Author: Linus Torvalds Date: Thu Sep 18 10:22:02 2025 -0700 Merge tag 'net-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from wireless. No known regressions at this point. Current release - fix to a fix: - eth: Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" - wifi: iwlwifi: pcie: fix byte count table for 7000/8000 devices - net: clear sk->sk_ino in sk_set_socket(sk, NULL), fix CRIU Previous releases - regressions: - bonding: set random address only when slaves already exist - rxrpc: fix untrusted unsigned subtract - eth: - ice: fix Rx page leak on multi-buffer frames - mlx5: don't return mlx5_link_info table when speed is unknown Previous releases - always broken: - tls: make sure to abort the stream if headers are bogus - tcp: fix null-deref when using TCP-AO with TCP_REPAIR - dpll: fix skipping last entry in clock quality level reporting - eth: qed: don't collect too many protection override GRC elements, fix memory corruption" * tag 'net-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (51 commits) octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() cnic: Fix use-after-free bugs in cnic_delete_task devlink rate: Remove unnecessary 'static' from a couple places MAINTAINERS: update sundance entry net: liquidio: fix overflow in octeon_init_instr_queue() net: clear sk->sk_ino in sk_set_socket(sk, NULL) Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" selftests: tls: test skb copy under mem pressure and OOB tls: make sure to abort the stream if headers are bogus selftest: packetdrill: Add tcp_fastopen_server_reset-after-disconnect.pkt. tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). octeon_ep: fix VF MAC address lifecycle handling selftests: bonding: add vlan over bond testing bonding: don't set oif to bond dev when getting NS target destination net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer net/mlx5e: Add a miss level for ipsec crypto offload net/mlx5e: Harden uplink netdev access against device unbind MAINTAINERS: make the DPLL entry cover drivers doc/netlink: Fix typos in operation attributes igc: don't fail igc_probe() on LED setup error ... commit 86cc796e5e9bff0c3993607f4301b8188095516c Merge: 604530cd9a5b0c ecd42dd170ea7b Author: Linus Torvalds Date: Thu Sep 18 09:42:55 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "These are mostly Oliver's Arm changes: lock ordering fixes for the vGIC, and reverts for a buggy attempt to avoid RCU stalls on large VMs. Arm: - Invalidate nested MMUs upon freeing the PGD to avoid WARNs when visiting from an MMU notifier - Fixes to the TLB match process and TLB invalidation range for managing the VCNR pseudo-TLB - Prevent SPE from erroneously profiling guests due to UNKNOWN reset values in PMSCR_EL1 - Fix save/restore of host MDCR_EL2 to account for eagerly programming at vcpu_load() on VHE systems - Correct lock ordering when dealing with VGIC LPIs, avoiding scenarios where an xarray's spinlock was nested with a *raw* spinlock - Permit stage-2 read permission aborts which are possible in the case of NV depending on the guest hypervisor's stage-2 translation - Call raw_spin_unlock() instead of the internal spinlock API - Fix parameter ordering when assigning VBAR_EL1 - Reverted a couple of fixes for RCU stalls when destroying a stage-2 page table. There appears to be some nasty refcounting / UAF issues lurking in those patches and the band-aid we tried to apply didn't hold. s390: - mm fixes, including userfaultfd bug fix x86: - Sync the vTPR from the local APIC to the VMCB even when AVIC is active. This fixes a bug where host updates to the vTPR, e.g. via KVM_SET_LAPIC or emulation of a guest access, are lost and result in interrupt delivery issues in the guest" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active Revert "KVM: arm64: Split kvm_pgtable_stage2_destroy()" Revert "KVM: arm64: Reschedule as needed when destroying the stage-2 page-tables" KVM: arm64: vgic: fix incorrect spinlock API usage KVM: arm64: Remove stage 2 read fault check KVM: arm64: Fix parameter ordering for VBAR_EL1 assignment KVM: arm64: nv: Fix incorrect VNCR invalidation range calculation KVM: arm64: vgic-v3: Indicate vgic_put_irq() may take LPI xarray lock KVM: arm64: vgic-v3: Don't require IRQs be disabled for LPI xarray lock KVM: arm64: vgic-v3: Erase LPIs from xarray outside of raw spinlocks KVM: arm64: Spin off release helper from vgic_put_irq() KVM: arm64: vgic-v3: Use bare refcount for VGIC LPIs KVM: arm64: vgic: Drop stale comment on IRQ active state KVM: arm64: VHE: Save and restore host MDCR_EL2 value correctly KVM: arm64: Initialize PMSCR_EL1 when in VHE KVM: arm64: nv: fix VNCR TLB ASID match logic for non-Global entries KVM: s390: Fix FOLL_*/FAULT_FLAG_* confusion KVM: s390: Fix incorrect usage of mmu_notifier_register() KVM: s390: Fix access to unavailable adapter indicator pages during postcopy KVM: arm64: Mark freed S2 MMUs as invalid commit 3539b1467e94336d5854ebf976d9627bfb65d6c3 Author: Jens Axboe Date: Thu Sep 18 10:21:14 2025 -0600 io_uring: include dying ring in task_work "should cancel" state When running task_work for an exiting task, rather than perform the issue retry attempt, the task_work is canceled. However, this isn't done for a ring that has been closed. This can lead to requests being successfully completed post the ring being closed, which is somewhat confusing and surprising to an application. Rather than just check the task exit state, also include the ring ref state in deciding whether or not to terminate a given request when run from task_work. Cc: stable@vger.kernel.org # 6.1+ Link: https://github.com/axboe/liburing/discussions/1459 Reported-by: Benedek Thaler Signed-off-by: Jens Axboe commit 604530cd9a5b0c603038dfbe9e82b3e4dad11350 Merge: f03e578c8afe51 225d1ee0f5ba32 Author: Linus Torvalds Date: Thu Sep 18 09:22:34 2025 -0700 Merge tag 'platform-drivers-x86-v6.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: "Fixes and new HW support: - amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list - amd/pmf: Support new ACPI ID AMDI0108 - asus-wmi: Re-add extra keys to ignore_key_wlan quirk - oxpec: Add support for AOKZOE A1X and OneXPlayer X1Pro EVA-02" * tag 'platform-drivers-x86-v6.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk platform/x86/amd/pmf: Support new ACPI ID AMDI0108 platform/x86: oxpec: Add support for AOKZOE A1X platform/x86: oxpec: Add support for OneXPlayer X1Pro EVA-02 platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list commit f03e578c8afe514c82ec9bd9af548b8fe08694e5 Merge: 8b789f2b7602a8 df447a3b4a4b96 Author: Linus Torvalds Date: Thu Sep 18 09:18:27 2025 -0700 Merge tag 'uml-for-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull UML fixes from Johannes Berg: "A few fixes for UML, which I'd meant to send earlier but then forgot. All of them are pretty long-standing issues that are either not really happening (the UAF), in rarely used code (the FD buffer issue), or an issue only for some host configurations (the executable stack): - mark stack not executable to work on more modern systems with selinux - fix use-after-free in a virtio error path - fix stack buffer overflow in external unix socket FD receive function" * tag 'uml-for-6.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: Fix FD copy size in os_rcv_fd_msg() um: virtio_uml: Fix use-after-free after put_device in probe um: Don't mark stack executable commit f8b4687151021db61841af983f1cb7be6915d4ef Author: Duoming Zhou Date: Wed Sep 17 14:38:53 2025 +0800 octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp() The original code relies on cancel_delayed_work() in otx2_ptp_destroy(), which does not ensure that the delayed work item synctstamp_work has fully completed if it was already running. This leads to use-after-free scenarios where otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work remains active and attempts to dereference otx2_ptp in otx2_sync_tstamp(). Furthermore, the synctstamp_work is cyclic, the likelihood of triggering the bug is nonnegligible. A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) otx2_remove() | otx2_ptp_destroy() | otx2_sync_tstamp() cancel_delayed_work() | kfree(ptp) | | ptp = container_of(...); //UAF | ptp-> //UAF This is confirmed by a KASAN report: BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0 Write of size 8 at addr ffff88800aa09a18 by task bash/136 ... Call Trace: dump_stack_lvl+0x55/0x70 print_report+0xcf/0x610 ? __run_timer_base.part.0+0x7d7/0x8c0 kasan_report+0xb8/0xf0 ? __run_timer_base.part.0+0x7d7/0x8c0 __run_timer_base.part.0+0x7d7/0x8c0 ? __pfx___run_timer_base.part.0+0x10/0x10 ? __pfx_read_tsc+0x10/0x10 ? ktime_get+0x60/0x140 ? lapic_next_event+0x11/0x20 ? clockevents_program_event+0x1d4/0x2a0 run_timer_softirq+0xd1/0x190 handle_softirqs+0x16a/0x550 irq_exit_rcu+0xaf/0xe0 sysvec_apic_timer_interrupt+0x70/0x80 ... Allocated by task 1: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x7f/0x90 otx2_ptp_init+0xb1/0x860 otx2_probe+0x4eb/0xc30 local_pci_probe+0xdc/0x190 pci_device_probe+0x2fe/0x470 really_probe+0x1ca/0x5c0 __driver_probe_device+0x248/0x310 driver_probe_device+0x44/0x120 __driver_attach+0xd2/0x310 bus_for_each_dev+0xed/0x170 bus_add_driver+0x208/0x500 driver_register+0x132/0x460 do_one_initcall+0x89/0x300 kernel_init_freeable+0x40d/0x720 kernel_init+0x1a/0x150 ret_from_fork+0x10c/0x1a0 ret_from_fork_asm+0x1a/0x30 Freed by task 136: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3a/0x60 __kasan_slab_free+0x3f/0x50 kfree+0x137/0x370 otx2_ptp_destroy+0x38/0x80 otx2_remove+0x10d/0x4c0 pci_device_remove+0xa6/0x1d0 device_release_driver_internal+0xf8/0x210 pci_stop_bus_device+0x105/0x150 pci_stop_and_remove_bus_device_locked+0x15/0x30 remove_store+0xcc/0xe0 kernfs_fop_write_iter+0x2c3/0x440 vfs_write+0x871/0xd70 ksys_write+0xee/0x1c0 do_syscall_64+0xac/0x280 entry_SYSCALL_64_after_hwframe+0x77/0x7f ... Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the delayed work item is properly canceled before the otx2_ptp is deallocated. This bug was initially identified through static analysis. To reproduce and test it, I simulated the OcteonTX2 PCI device in QEMU and introduced artificial delays within the otx2_sync_tstamp() function to increase the likelihood of triggering the bug. Fixes: 2958d17a8984 ("octeontx2-pf: Add support for ptp 1-step mode on CN10K silicon") Signed-off-by: Duoming Zhou Reviewed-by: Vadim Fedorenko Signed-off-by: Jakub Kicinski commit cfa7d9b1e3a8604afc84e9e51d789c29574fb216 Author: Duoming Zhou Date: Wed Sep 17 13:46:02 2025 +0800 cnic: Fix use-after-free bugs in cnic_delete_task The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' has fully completed if it was already running. Additionally, the delayed work item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only blocks and waits for work items that were already queued to the workqueue prior to its invocation. Any work items submitted after flush_workqueue() is called are not included in the set of tasks that the flush operation awaits. This means that after the cyclic work items have finished executing, a delayed work item may still exist in the workqueue. This leads to use-after-free scenarios where the cnic_dev is deallocated by cnic_free_dev(), while delete_task remains active and attempt to dereference cnic_dev in cnic_delete_task(). A typical race condition is illustrated below: CPU 0 (cleanup) | CPU 1 (delayed work callback) cnic_netdev_event() | cnic_stop_hw() | cnic_delete_task() cnic_cm_stop_bnx2x_hw() | ... cancel_delayed_work() | /* the queue_delayed_work() flush_workqueue() | executes after flush_workqueue()*/ | queue_delayed_work() cnic_free_dev(dev)//free | cnic_delete_task() //new instance | dev = cp->dev; //use Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure that the cyclic delayed work item is properly canceled and that any ongoing execution of the work item completes before the cnic_dev is deallocated. Furthermore, since cancel_delayed_work_sync() uses __flush_work(work, true) to synchronously wait for any currently executing instance of the work item to finish, the flush_workqueue() becomes redundant and should be removed. This bug was identified through static analysis. To reproduce the issue and validate the fix, I simulated the cnic PCI device in QEMU and introduced intentional delays — such as inserting calls to ssleep() within the cnic_delete_task() function — to increase the likelihood of triggering the bug. Fixes: fdf24086f475 ("cnic: Defer iscsi connection cleanup") Signed-off-by: Duoming Zhou Signed-off-by: Jakub Kicinski commit 3191df0a4882c827cac29925e80ecb1775b904bd Author: Cosmin Ratiu Date: Thu Sep 18 13:15:06 2025 +0300 devlink rate: Remove unnecessary 'static' from a couple places devlink_rate_node_get_by_name() and devlink_rate_nodes_destroy() have a couple of unnecessary static variables for iterating over devlink rates. This could lead to races/corruption/unhappiness if two concurrent operations execute the same function. Remove 'static' from both. It's amazing this was missed for 4+ years. While at it, I confirmed there are no more examples of this mistake in net/ with 1, 2 or 3 levels of indentation. Fixes: a8ecb93ef03d ("devlink: Introduce rate nodes") Signed-off-by: Cosmin Ratiu Signed-off-by: Jakub Kicinski commit 7736aff4704188d4483b7b36ff06d201c8be4844 Author: Denis Kirjanov Date: Thu Sep 18 12:15:56 2025 +0300 MAINTAINERS: update sundance entry Signed-off-by: Denis Kirjanov Signed-off-by: Jakub Kicinski commit cca7b1cfd7b8a0eff2a3510c5e0f10efe8fa3758 Author: Alexey Nepomnyashih Date: Wed Sep 17 15:30:58 2025 +0000 net: liquidio: fix overflow in octeon_init_instr_queue() The expression `(conf->instr_type == 64) << iq_no` can overflow because `iq_no` may be as high as 64 (`CN23XX_MAX_RINGS_PER_PF`). Casting the operand to `u64` ensures correct 64-bit arithmetic. Fixes: f21fb3ed364b ("Add support of Cavium Liquidio ethernet adapters") Signed-off-by: Alexey Nepomnyashih Signed-off-by: Jakub Kicinski commit 87ebb628a5acb892eba41ef1d8989beb8f036034 Author: Eric Dumazet Date: Wed Sep 17 13:53:37 2025 +0000 net: clear sk->sk_ino in sk_set_socket(sk, NULL) Andrei Vagin reported that blamed commit broke CRIU. Indeed, while we want to keep sk_uid unchanged when a socket is cloned, we want to clear sk->sk_ino. Otherwise, sock_diag might report multiple sockets sharing the same inode number. Move the clearing part from sock_orphan() to sk_set_socket(sk, NULL), called both from sock_orphan() and sk_clone_lock(). Fixes: 5d6b58c932ec ("net: lockless sock_i_ino()") Closes: https://lore.kernel.org/netdev/aMhX-VnXkYDpKd9V@google.com/ Closes: https://github.com/checkpoint-restore/criu/issues/2744 Reported-by: Andrei Vagin Signed-off-by: Eric Dumazet Acked-by: Andrei Vagin Link: https://patch.msgid.link/20250917135337.1736101-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3fbfe251cc9f6d391944282cdb9bcf0bd02e01f8 Author: Tariq Toukan Date: Wed Sep 17 16:48:54 2025 +0300 Revert "net/mlx5e: Update and set Xon/Xoff upon port speed set" This reverts commit d24341740fe48add8a227a753e68b6eedf4b385a. It causes errors when trying to configure QoS, as well as loss of L2 connectivity (on multi-host devices). Reported-by: Jakub Kicinski Link: https://lore.kernel.org/20250910170011.70528106@kernel.org Fixes: d24341740fe4 ("net/mlx5e: Update and set Xon/Xoff upon port speed set") Signed-off-by: Tariq Toukan Signed-off-by: Jakub Kicinski commit 8dc5245673cf7f33743e5c0d2a4207c0b8df3067 Author: Bibo Mao Date: Thu Sep 18 19:44:25 2025 +0800 LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_pch_pic_regs_access() Function copy_from_user() and copy_to_user() may sleep because of page fault, and they cannot be called in spin_lock hold context. Here move function calling of copy_from_user() and copy_to_user() out of spinlock context in function kvm_pch_pic_regs_access(). Otherwise there will be possible warning such as: BUG: sleeping function called from invalid context at include/linux/uaccess.h:192 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 6292, name: qemu-system-loo preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [<9000000004c4a554>] copy_process+0x90c/0x1d40 softirqs last enabled at (0): [<9000000004c4a554>] copy_process+0x90c/0x1d40 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 41 UID: 0 PID: 6292 Comm: qemu-system-loo Tainted: G W 6.17.0-rc3+ #31 PREEMPT(full) Tainted: [W]=WARN Stack : 0000000000000076 0000000000000000 9000000004c28264 9000100092ff4000 9000100092ff7b80 9000100092ff7b88 0000000000000000 9000100092ff7cc8 9000100092ff7cc0 9000100092ff7cc0 9000100092ff7a00 0000000000000001 0000000000000001 9000100092ff7b88 947d2f9216a5e8b9 900010008773d880 00000000ffff8b9f fffffffffffffffe 0000000000000ba1 fffffffffffffffe 000000000000003e 900000000825a15b 000010007ad38000 9000100092ff7ec0 0000000000000000 0000000000000000 9000000006f3ac60 9000000007252000 0000000000000000 00007ff746ff2230 0000000000000053 9000200088a021b0 0000555556c9d190 0000000000000000 9000000004c2827c 000055556cfb5f40 00000000000000b0 0000000000000007 0000000000000007 0000000000071c1d Call Trace: [<9000000004c2827c>] show_stack+0x5c/0x180 [<9000000004c20fac>] dump_stack_lvl+0x94/0xe4 [<9000000004c99c7c>] __might_resched+0x26c/0x290 [<9000000004f68968>] __might_fault+0x20/0x88 [] kvm_pch_pic_regs_access.isra.0+0x88/0x380 [kvm] [] kvm_device_ioctl+0x194/0x290 [kvm] [<900000000506b0d8>] sys_ioctl+0x388/0x1010 [<90000000063ed210>] do_syscall+0xb0/0x2d8 [<9000000004c25ef8>] handle_syscall+0xb8/0x158 Cc: stable@vger.kernel.org Fixes: d206d95148732 ("LoongArch: KVM: Add PCHPIC user mode read and write functions") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 01a8e68396a6d51f5ba92021ad1a4b8eaabdd0e7 Author: Bibo Mao Date: Thu Sep 18 19:44:22 2025 +0800 LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_sw_status_access() Function copy_from_user() and copy_to_user() may sleep because of page fault, and they cannot be called in spin_lock hold context. Here move funtcion calling of copy_from_user() and copy_to_user() out of function kvm_eiointc_sw_status_access(). Otherwise there will be possible warning such as: BUG: sleeping function called from invalid context at include/linux/uaccess.h:192 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 6292, name: qemu-system-loo preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [<9000000004c4a554>] copy_process+0x90c/0x1d40 softirqs last enabled at (0): [<9000000004c4a554>] copy_process+0x90c/0x1d40 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 41 UID: 0 PID: 6292 Comm: qemu-system-loo Tainted: G W 6.17.0-rc3+ #31 PREEMPT(full) Tainted: [W]=WARN Stack : 0000000000000076 0000000000000000 9000000004c28264 9000100092ff4000 9000100092ff7b80 9000100092ff7b88 0000000000000000 9000100092ff7cc8 9000100092ff7cc0 9000100092ff7cc0 9000100092ff7a00 0000000000000001 0000000000000001 9000100092ff7b88 947d2f9216a5e8b9 900010008773d880 00000000ffff8b9f fffffffffffffffe 0000000000000ba1 fffffffffffffffe 000000000000003e 900000000825a15b 000010007ad38000 9000100092ff7ec0 0000000000000000 0000000000000000 9000000006f3ac60 9000000007252000 0000000000000000 00007ff746ff2230 0000000000000053 9000200088a021b0 0000555556c9d190 0000000000000000 9000000004c2827c 000055556cfb5f40 00000000000000b0 0000000000000007 0000000000000007 0000000000071c1d Call Trace: [<9000000004c2827c>] show_stack+0x5c/0x180 [<9000000004c20fac>] dump_stack_lvl+0x94/0xe4 [<9000000004c99c7c>] __might_resched+0x26c/0x290 [<9000000004f68968>] __might_fault+0x20/0x88 [] kvm_eiointc_sw_status_access.isra.0+0x88/0x380 [kvm] [] kvm_device_ioctl+0x194/0x290 [kvm] [<900000000506b0d8>] sys_ioctl+0x388/0x1010 [<90000000063ed210>] do_syscall+0xb0/0x2d8 [<9000000004c25ef8>] handle_syscall+0xb8/0x158 Cc: stable@vger.kernel.org Fixes: 1ad7efa552fd5 ("LoongArch: KVM: Add EIOINTC user mode read and write functions") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 62f11796a0dfa1a2ef5f50a2d1bc81c81628fb8e Author: Bibo Mao Date: Thu Sep 18 19:44:22 2025 +0800 LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_regs_access() Function copy_from_user() and copy_to_user() may sleep because of page fault, and they cannot be called in spin_lock hold context. Here move function calling of copy_from_user() and copy_to_user() before spinlock context in function kvm_eiointc_ctrl_access(). Otherwise there will be possible warning such as: BUG: sleeping function called from invalid context at include/linux/uaccess.h:192 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 6292, name: qemu-system-loo preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [<9000000004c4a554>] copy_process+0x90c/0x1d40 softirqs last enabled at (0): [<9000000004c4a554>] copy_process+0x90c/0x1d40 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 41 UID: 0 PID: 6292 Comm: qemu-system-loo Tainted: G W 6.17.0-rc3+ #31 PREEMPT(full) Tainted: [W]=WARN Stack : 0000000000000076 0000000000000000 9000000004c28264 9000100092ff4000 9000100092ff7b80 9000100092ff7b88 0000000000000000 9000100092ff7cc8 9000100092ff7cc0 9000100092ff7cc0 9000100092ff7a00 0000000000000001 0000000000000001 9000100092ff7b88 947d2f9216a5e8b9 900010008773d880 00000000ffff8b9f fffffffffffffffe 0000000000000ba1 fffffffffffffffe 000000000000003e 900000000825a15b 000010007ad38000 9000100092ff7ec0 0000000000000000 0000000000000000 9000000006f3ac60 9000000007252000 0000000000000000 00007ff746ff2230 0000000000000053 9000200088a021b0 0000555556c9d190 0000000000000000 9000000004c2827c 000055556cfb5f40 00000000000000b0 0000000000000007 0000000000000007 0000000000071c1d Call Trace: [<9000000004c2827c>] show_stack+0x5c/0x180 [<9000000004c20fac>] dump_stack_lvl+0x94/0xe4 [<9000000004c99c7c>] __might_resched+0x26c/0x290 [<9000000004f68968>] __might_fault+0x20/0x88 [] kvm_eiointc_regs_access.isra.0+0x88/0x380 [kvm] [] kvm_device_ioctl+0x194/0x290 [kvm] [<900000000506b0d8>] sys_ioctl+0x388/0x1010 [<90000000063ed210>] do_syscall+0xb0/0x2d8 [<9000000004c25ef8>] handle_syscall+0xb8/0x158 Cc: stable@vger.kernel.org Fixes: 1ad7efa552fd5 ("LoongArch: KVM: Add EIOINTC user mode read and write functions") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 47256c4c8b1bfbc63223a0da2d4fa90b6ede5cbb Author: Bibo Mao Date: Thu Sep 18 19:44:22 2025 +0800 LoongArch: KVM: Avoid copy_*_user() with lock hold in kvm_eiointc_ctrl_access() Function copy_from_user() and copy_to_user() may sleep because of page fault, and they cannot be called in spin_lock hold context. Here move function calling of copy_from_user() and copy_to_user() before spinlock context in function kvm_eiointc_ctrl_access(). Otherwise there will be possible warning such as: BUG: sleeping function called from invalid context at include/linux/uaccess.h:192 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 6292, name: qemu-system-loo preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 INFO: lockdep is turned off. irq event stamp: 0 hardirqs last enabled at (0): [<0000000000000000>] 0x0 hardirqs last disabled at (0): [<9000000004c4a554>] copy_process+0x90c/0x1d40 softirqs last enabled at (0): [<9000000004c4a554>] copy_process+0x90c/0x1d40 softirqs last disabled at (0): [<0000000000000000>] 0x0 CPU: 41 UID: 0 PID: 6292 Comm: qemu-system-loo Tainted: G W 6.17.0-rc3+ #31 PREEMPT(full) Tainted: [W]=WARN Stack : 0000000000000076 0000000000000000 9000000004c28264 9000100092ff4000 9000100092ff7b80 9000100092ff7b88 0000000000000000 9000100092ff7cc8 9000100092ff7cc0 9000100092ff7cc0 9000100092ff7a00 0000000000000001 0000000000000001 9000100092ff7b88 947d2f9216a5e8b9 900010008773d880 00000000ffff8b9f fffffffffffffffe 0000000000000ba1 fffffffffffffffe 000000000000003e 900000000825a15b 000010007ad38000 9000100092ff7ec0 0000000000000000 0000000000000000 9000000006f3ac60 9000000007252000 0000000000000000 00007ff746ff2230 0000000000000053 9000200088a021b0 0000555556c9d190 0000000000000000 9000000004c2827c 000055556cfb5f40 00000000000000b0 0000000000000007 0000000000000007 0000000000071c1d Call Trace: [<9000000004c2827c>] show_stack+0x5c/0x180 [<9000000004c20fac>] dump_stack_lvl+0x94/0xe4 [<9000000004c99c7c>] __might_resched+0x26c/0x290 [<9000000004f68968>] __might_fault+0x20/0x88 [] kvm_eiointc_ctrl_access.isra.0+0x88/0x380 [kvm] [] kvm_device_ioctl+0x194/0x290 [kvm] [<900000000506b0d8>] sys_ioctl+0x388/0x1010 [<90000000063ed210>] do_syscall+0xb0/0x2d8 [<9000000004c25ef8>] handle_syscall+0xb8/0x158 Cc: stable@vger.kernel.org Fixes: 1ad7efa552fd5 ("LoongArch: KVM: Add EIOINTC user mode read and write functions") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit f58c9aa1065f73d243904b267c71f6a9d1e9f90e Author: Bibo Mao Date: Thu Sep 18 19:44:22 2025 +0800 LoongArch: KVM: Fix VM migration failure with PTW enabled With PTW disabled system, bit _PAGE_DIRTY is a HW bit for page writing. However with PTW enabled system, bit _PAGE_WRITE is also a "HW bit" for page writing, because hardware synchronizes _PAGE_WRITE to _PAGE_DIRTY automatically. Previously, _PAGE_WRITE is treated as a SW bit to record the page writeable attribute for the fast page fault handling in the secondary MMU, however with PTW enabled machine, this bit is used by HW already (so setting it will silence the TLB modify exception). Here define KVM_PAGE_WRITEABLE with the SW bit _PAGE_MODIFIED, so that it can work on both PTW disabled and enabled machines. And for HW write bits, both _PAGE_DIRTY and _PAGE_WRITE are set or clear together. Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 091b29d53fe645781c5c1f405bc9fcd50ce5792b Author: Tao Cui Date: Thu Sep 18 19:44:22 2025 +0800 LoongArch: KVM: Remove unused returns and semicolons The default branch has already handled all undefined cases, so the final return statement is redundant. Redundant semicolons are removed, too. Cc: stable@vger.kernel.org Reviewed-by: Bibo Mao Signed-off-by: Tao Cui Signed-off-by: Huacai Chen commit ac398f570724c41e5e039d54e4075519f6af7408 Author: Guangshuo Li <202321181@mail.sdu.edu.cn> Date: Thu Sep 18 19:44:10 2025 +0800 LoongArch: vDSO: Check kcalloc() result in init_vdso() Add a NULL-pointer check after the kcalloc() call in init_vdso(). If allocation fails, return -ENOMEM to prevent a possible dereference of vdso_info.code_mapping.pages when it is NULL. Cc: stable@vger.kernel.org Fixes: 2ed119aef60d ("LoongArch: Set correct size for vDSO code mapping") Signed-off-by: Guangshuo Li <202321181@mail.sdu.edu.cn> Signed-off-by: Huacai Chen commit 677d4a52d4dc4a147d5e84af9ff207832578be70 Author: Tiezhu Yang Date: Thu Sep 18 19:44:08 2025 +0800 LoongArch: Fix unreliable stack for live patching When testing the kernel live patching with "modprobe livepatch-sample", there is a timeout over 15 seconds from "starting patching transition" to "patching complete". The dmesg command shows "unreliable stack" for user tasks in debug mode, here is one of the messages: livepatch: klp_try_switch_task: bash:1193 has an unreliable stack The "unreliable stack" is because it can not unwind from do_syscall() to its previous frame handle_syscall(). It should use fp to find the original stack top due to secondary stack in do_syscall(), but fp is not used for some other functions, then fp can not be restored by the next frame of do_syscall(), so it is necessary to save fp if task is not current, in order to get the stack top of do_syscall(). Here are the call chains: klp_enable_patch() klp_try_complete_transition() klp_try_switch_task() klp_check_and_switch_task() klp_check_stack() stack_trace_save_tsk_reliable() arch_stack_walk_reliable() When executing "rmmod livepatch-sample", there exists a similar issue. With this patch, it takes a short time for patching and unpatching. Before: # modprobe livepatch-sample # dmesg -T | tail -3 [Sat Sep 6 11:00:20 2025] livepatch: 'livepatch_sample': starting patching transition [Sat Sep 6 11:00:35 2025] livepatch: signaling remaining tasks [Sat Sep 6 11:00:36 2025] livepatch: 'livepatch_sample': patching complete # echo 0 > /sys/kernel/livepatch/livepatch_sample/enabled # rmmod livepatch_sample rmmod: ERROR: Module livepatch_sample is in use # rmmod livepatch_sample # dmesg -T | tail -3 [Sat Sep 6 11:06:05 2025] livepatch: 'livepatch_sample': starting unpatching transition [Sat Sep 6 11:06:20 2025] livepatch: signaling remaining tasks [Sat Sep 6 11:06:21 2025] livepatch: 'livepatch_sample': unpatching complete After: # modprobe livepatch-sample # dmesg -T | tail -2 [Tue Sep 16 16:19:30 2025] livepatch: 'livepatch_sample': starting patching transition [Tue Sep 16 16:19:31 2025] livepatch: 'livepatch_sample': patching complete # echo 0 > /sys/kernel/livepatch/livepatch_sample/enabled # rmmod livepatch_sample # dmesg -T | tail -2 [Tue Sep 16 16:19:36 2025] livepatch: 'livepatch_sample': starting unpatching transition [Tue Sep 16 16:19:37 2025] livepatch: 'livepatch_sample': unpatching complete Cc: stable@vger.kernel.org # v6.9+ Fixes: 199cc14cb4f1 ("LoongArch: Add kernel livepatching support") Reported-by: Xi Zhang Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit d6d69f0edde63b553345d4efaceb7daed89fe04c Author: Tao Cui Date: Thu Sep 18 19:44:04 2025 +0800 LoongArch: Replace sprintf() with sysfs_emit() As Documentation/filesystems/sysfs.rst suggested, show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. No functional change intended. Cc: stable@vger.kernel.org Signed-off-by: Tao Cui Signed-off-by: Huacai Chen commit 51adb03e6b865c0c6790f29659ff52d56742de2e Author: Tao Cui Date: Thu Sep 18 19:44:04 2025 +0800 LoongArch: Check the return value when creating kobj Add a check for the return value of kobject_create_and_add(), to ensure that the kobj allocation succeeds for later use. Cc: stable@vger.kernel.org Signed-off-by: Tao Cui Signed-off-by: Huacai Chen commit a9d13433fe17be0e867e51e71a1acd2731fbef8d Author: Huacai Chen Date: Thu Sep 18 19:44:01 2025 +0800 LoongArch: Align ACPI structures if ARCH_STRICT_ALIGN enabled ARCH_STRICT_ALIGN is used for hardware without UAL, now it only control the -mstrict-align flag. However, ACPI structures are packed by default so will cause unaligned accesses. To avoid this, define ACPI_MISALIGNMENT_NOT_SUPPORTED in asm/acenv.h to align ACPI structures if ARCH_STRICT_ALIGN enabled. Cc: stable@vger.kernel.org Reported-by: Binbin Zhou Suggested-by: Xi Ruoyao Suggested-by: Jiaxun Yang Signed-off-by: Huacai Chen commit f5003098e2f337d8e8a87dc636250e3fa978d9ad Author: Tiezhu Yang Date: Thu Sep 18 19:43:42 2025 +0800 LoongArch: Update help info of ARCH_STRICT_ALIGN Loongson-3A6000 and 3C6000 CPUs also support unaligned memory access, so the current description is out of date to some extent. Actually, all of Loongson-3 series processors based on LoongArch support unaligned memory access, this hardware capability is indicated by the bit 20 (UAL) of CPUCFG1 register, update the help info to reflect the reality. Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 74f8295c6fb8436bec9995baf6ba463151b6fb68 Author: Tiezhu Yang Date: Thu Sep 18 19:43:42 2025 +0800 LoongArch: Handle jump tables options for RUST When compiling with LLVM and CONFIG_RUST is set, there exist objtool warnings in rust/core.o and rust/kernel.o, like this: rust/core.o: warning: objtool: _RNvXs1_NtNtCs5QSdWC790r4_4core5ascii10ascii_charNtB5_9AsciiCharNtNtB9_3fmt5Debug3fmt+0x54: sibling call from callable instruction with modified stack frame For this special case, the related object file shows that there is no generated relocation section '.rela.discard.tablejump_annotate' for the table jump instruction jirl, thus objtool can not know that what is the actual destination address. If rustc has the option "-Cllvm-args=--loongarch-annotate-tablejump", pass the option to enable jump tables for objtool, otherwise it should pass "-Zno-jump-tables" to keep compatibility with older rustc. How to test: $ rustup component add rust-src $ make LLVM=1 rustavailable $ make ARCH=loongarch LLVM=1 clean defconfig $ scripts/config -d MODVERSIONS \ -e RUST -e SAMPLES -e SAMPLES_RUST \ -e SAMPLE_RUST_CONFIGFS -e SAMPLE_RUST_MINIMAL \ -e SAMPLE_RUST_MISC_DEVICE -e SAMPLE_RUST_PRINT \ -e SAMPLE_RUST_DMA -e SAMPLE_RUST_DRIVER_PCI \ -e SAMPLE_RUST_DRIVER_PLATFORM -e SAMPLE_RUST_DRIVER_FAUX \ -e SAMPLE_RUST_DRIVER_AUXILIARY -e SAMPLE_RUST_HOSTPROGS $ make ARCH=loongarch LLVM=1 olddefconfig all Cc: stable@vger.kernel.org Acked-by: Miguel Ojeda Reported-by: Miguel Ojeda Closes: https://lore.kernel.org/rust-for-linux/CANiq72mNeCuPkCDrG2db3w=AX+O-zYrfprisDPmRac_qh65Dmg@mail.gmail.com/ Suggested-by: WANG Rui Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit b15212824a01cb0b62f7b522f4ee334622cf982a Author: Tiezhu Yang Date: Thu Sep 18 19:43:42 2025 +0800 LoongArch: Make LTO case independent in Makefile LTO is not only used for Clang, but maybe also used for Rust, make LTO case out of CONFIG_CC_HAS_ANNOTATE_TABLEJUMP in Makefile. This is preparation for later patch, no function changes. Cc: stable@vger.kernel.org Suggested-by: WANG Rui Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 539d7344d4feaea37e05863e9aa86bd31f28e46f Author: Tiezhu Yang Date: Thu Sep 18 19:43:36 2025 +0800 objtool/LoongArch: Mark special atomic instruction as INSN_BUG type When compiling with LLVM and CONFIG_RUST is set, there exists the following objtool warning: rust/compiler_builtins.o: warning: objtool: __rust__unordsf2(): unexpected end of section .text.unlikely. objdump shows that the end of section .text.unlikely is an atomic instruction: amswap.w $zero, $ra, $zero According to the LoongArch Reference Manual, if the amswap.w atomic memory access instruction has the same register number as rd and rj, the execution will trigger an Instruction Non-defined Exception, so mark the above instruction as INSN_BUG type to fix the warning. Cc: stable@vger.kernel.org Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit baad7830ee9a56756b3857348452fe756cb0a702 Author: Tiezhu Yang Date: Thu Sep 18 19:43:36 2025 +0800 objtool/LoongArch: Mark types based on break immediate code If the break immediate code is 0, it should mark the type as INSN_TRAP. If the break immediate code is 1, it should mark the type as INSN_BUG. While at it, format the code style and add the code comment for nop. Cc: stable@vger.kernel.org Suggested-by: WANG Rui Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit b98b208300573f4ab29507f81194a6030b208444 Author: Qu Wenruo Date: Mon Aug 25 19:56:26 2025 +0930 btrfs: reject invalid compression level Inspired by recent changes to compression level parsing in 6db1df415d73fc ("btrfs: accept and ignore compression level for lzo") it turns out that we do not do any extra validation for compression level input string, thus allowing things like "compress=lzo:invalid" to be accepted without warnings. Although we accept levels that are beyond the supported algorithm ranges, accepting completely invalid level specification is not correct. Fix the too loose checks for compression level, by doing proper error handling of kstrtoint(), so that we will reject not only too large values (beyond int range) but also completely wrong levels like "lzo:invalid". Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4c05c7ed880fb58790731fb53571af67b7632d87 Author: Jakub Kicinski Date: Tue Sep 16 17:28:14 2025 -0700 selftests: tls: test skb copy under mem pressure and OOB Add a test which triggers mem pressure via OOB writes. Reviewed-by: Sabrina Dubroca Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250917002814.1743558-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit 0aeb54ac4cd5cf8f60131b4d9ec0b6dc9c27b20d Author: Jakub Kicinski Date: Tue Sep 16 17:28:13 2025 -0700 tls: make sure to abort the stream if headers are bogus Normally we wait for the socket to buffer up the whole record before we service it. If the socket has a tiny buffer, however, we read out the data sooner, to prevent connection stalls. Make sure that we abort the connection when we find out late that the record is actually invalid. Retrying the parsing is fine in itself but since we copy some more data each time before we parse we can overflow the allocated skb space. Constructing a scenario in which we're under pressure without enough data in the socket to parse the length upfront is quite hard. syzbot figured out a way to do this by serving us the header in small OOB sends, and then filling in the recvbuf with a large normal send. Make sure that tls_rx_msg_size() aborts strp, if we reach an invalid record there's really no way to recover. Reported-by: Lee Jones Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Reviewed-by: Sabrina Dubroca Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250917002814.1743558-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit 1b34cbbf4f011a121ef7b2d7d6e6920a036d5285 Author: Herbert Xu Date: Tue Sep 16 17:20:59 2025 +0800 crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing. Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") Reported-by: Muhammad Alifa Ramdhan Reported-by: Bing-Jhong Billy Jheng Signed-off-by: Herbert Xu commit 9574b2330dbd2b5459b74d3b5e9619d39299fc6f Author: Herbert Xu Date: Tue Sep 16 15:42:41 2025 +0800 crypto: af_alg - Set merge to zero early in af_alg_sendmsg If an error causes af_alg_sendmsg to abort, ctx->merge may contain a garbage value from the previous loop. This may then trigger a crash on the next entry into af_alg_sendmsg when it attempts to do a merge that can't be done. Fix this by setting ctx->merge to zero near the start of the loop. Fixes: 8ff590903d5 ("crypto: algif_skcipher - User-space interface for skcipher operations") Reported-by: Muhammad Alifa Ramdhan Reported-by: Bing-Jhong Billy Jheng Signed-off-by: Herbert Xu commit 5349f295341aa61e117771bc4384fbdb3598fe11 Merge: f83ec76bf285be 35e526398bd0fa Author: Dave Airlie Date: Thu Sep 18 17:36:23 2025 +1000 Merge tag 'drm-intel-fixes-2025-09-17' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Honor VESA eDP backlight luminance control capability (Aaron Ma) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://lore.kernel.org/r/aMrPx4FZ66t1Kfe-@linux commit acff093287fb7f1d179162e531bae4ccd0ec8d65 Merge: 7dd670db9afdca 1dd28fd86c3fa4 Author: Takashi Iwai Date: Thu Sep 18 09:11:12 2025 +0200 Merge tag 'asoc-fix-v6.17-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.17 A pile of fixes that accumilated over the past few -rcs, this is all driver specifics including a small pile of quirks for new systems. commit 8b789f2b7602a818e7c7488c74414fae21392b63 Merge: 592a93fea16bd8 ce4be9e4307c5a Author: Linus Torvalds Date: Wed Sep 17 21:34:26 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-09-17-21-10' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "15 hotfixes. 11 are cc:stable and the remainder address post-6.16 issues or aren't considered necessary for -stable kernels. 13 of these fixes are for MM. The usual shower of singletons, plus - fixes from Hugh to address various misbehaviors in get_user_pages() - patches from SeongJae to address a quite severe issue in DAMON - another series also from SeongJae which completes some fixes for a DAMON startup issue" * tag 'mm-hotfixes-stable-2025-09-17-21-10' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: zram: fix slot write race condition nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* samples/damon/mtier: avoid starting DAMON before initialization samples/damon/prcl: avoid starting DAMON before initialization samples/damon/wsse: avoid starting DAMON before initialization MAINTAINERS: add Lance Yang as a THP reviewer MAINTAINERS: add Jann Horn as rmap reviewer mm/damon/sysfs: use dynamically allocated repeat mode damon_call_control mm/damon/core: introduce damon_call_control->dealloc_on_cancel mm: folio_may_be_lru_cached() unless folio_test_large() mm: revert "mm: vmscan.c: fix OOM on swap stress test" mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" mm/gup: local lru_add_drain() to avoid lru_add_drain_all() mm/gup: check ref_count instead of lru before migration commit ed4e6b5d644c4dd2bc2872ffec036b7da0ec2e27 Author: David Sterba Date: Mon Sep 15 08:37:47 2025 +0200 btrfs: ref-verify: handle damaged extent root tree Syzbot hits a problem with enabled ref-verify, ignorebadroots and a fuzzed/damaged extent tree. There's no fallback option like in other places that can deal with it so disable the whole ref-verify as it is just a debugging feature. Reported-by: syzbot+9c3e0cdfbfe351b0bc0e@syzkaller.appspotmail.com Link: https://lore.kernel.org/all/0000000000001b6052062139be1c@google.com/ Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit 96fa515e70f3e4b98685ef8cac9d737fc62f10e1 Author: Qu Wenruo Date: Tue Sep 16 07:54:06 2025 +0930 btrfs: tree-checker: fix the incorrect inode ref size check [BUG] Inside check_inode_ref(), we need to make sure every structure, including the btrfs_inode_extref header, is covered by the item. But our code is incorrectly using "sizeof(iref)", where @iref is just a pointer. This means "sizeof(iref)" will always be "sizeof(void *)", which is much smaller than "sizeof(struct btrfs_inode_extref)". This will allow some bad inode extrefs to sneak in, defeating tree-checker. [FIX] Fix the typo by calling "sizeof(*iref)", which is the same as "sizeof(struct btrfs_inode_extref)", and will be the correct behavior we want. Fixes: 71bf92a9b877 ("btrfs: tree-checker: Add check for INODE_REF") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Johannes Thumshirn Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit d9dcbbcf9145b68aa85c40947311a6907277e097 Author: Stefan Metzmacher Date: Tue Aug 12 13:03:19 2025 +0200 smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work) In smbd_destroy() we may destroy the memory so we better wait until post_send_credits_work is no longer pending and will never be started again. I actually just hit the case using rxe: WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe] ... [ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs] [ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs] [ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60 [ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs] [ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs] [ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs] [ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10 [ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0 [ 5305.687889] [ T138] process_one_work+0x629/0xf80 [ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687933] [ T138] worker_thread+0x87f/0x1570 ... It means rxe_post_recv was called after rdma_destroy_qp(). This happened because put_receive_buffer() was triggered by ib_drain_qp() and called: queue_work(info->workqueue, &info->post_send_credits_work); Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit bac28f604c7699727b2fecf14c3a54668bbe458e Author: Stefan Metzmacher Date: Tue Aug 12 12:58:21 2025 +0200 smb: client: use disable[_delayed]_work_sync in smbdirect.c This makes it safer during the disconnect and avoids requeueing. It's ok to call disable[delayed_]work[_sync]() more than once. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: 050b8c374019 ("smbd: Make upper layer decide when to destroy the transport") Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Fixes: c7398583340a ("CIFS: SMBD: Implement RDMA memory registration") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 93ed9a2951308db374cba4562533dde97bac70d3 Author: Paulo Alcantara Date: Wed Sep 17 16:03:22 2025 -0300 smb: client: fix filename matching of deferred files Fix the following case where the client would end up closing both deferred files (foo.tmp & foo) after unlink(foo) due to strstr() call in cifs_close_deferred_file_under_dentry(): fd1 = openat(AT_FDCWD, "foo", O_WRONLY|O_CREAT|O_TRUNC, 0666); fd2 = openat(AT_FDCWD, "foo.tmp", O_WRONLY|O_CREAT|O_TRUNC, 0666); close(fd1); close(fd2); unlink("foo"); Fixes: e3fc065682eb ("cifs: Deferred close performance improvements") Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: Enzo Matsumiya Cc: Frank Sorenson Cc: David Howells Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit f57e53ea252363234f86674db475839e5b87102e Author: Stefan Metzmacher Date: Wed Sep 10 11:49:05 2025 +0200 smb: client: let recv_done verify data_offset, data_length and remaining_data_length This is inspired by the related server fixes. Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Reviewed-by: Namjae Jeon Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 592a93fea16bd86a605a1b4ce9aed16e22d124d2 Merge: 992d4e481e958c e1868ba37fd27c Author: Linus Torvalds Date: Wed Sep 17 18:23:01 2025 -0700 Merge tag '6.17-rc6-ksmbd-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Two fixes for remaining_data_length and offset checks in receive path - Don't go over max SGEs which caused smbdirect send to fail (and trigger disconnect) * tag '6.17-rc6-ksmbd-fixes' of git://git.samba.org/ksmbd: ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer smb: server: let smb_direct_writev() respect SMB_DIRECT_MAX_SEND_SGES commit 26caeae9fb482ec443753b4e3307e5122b60b850 Author: Daniele Ceraolo Spurio Date: Fri Sep 5 16:56:33 2025 -0700 drm/xe/guc: Set RCS/CCS yield policy All recent platforms (including all the ones officially supported by the Xe driver) do not allow concurrent execution of RCS and CCS workloads from different address spaces, with the HW blocking the context switch when it detects such a scenario. The DUAL_QUEUE flag helps with this, by causing the GuC to not submit a context it knows will not be able to execute. This, however, causes a new problem: if RCS and CCS queues have pending workloads from different address spaces, the GuC needs to choose from which of the 2 queues to pick the next workload to execute. By default, the GuC prioritizes RCS submissions over CCS ones, which can lead to CCS workloads being significantly (or completely) starved of execution time. The driver can tune this by setting a dedicated scheduling policy KLV; this KLV allows the driver to specify a quantum (in ms) and a ratio (percentage value between 0 and 100), and the GuC will prioritize the CCS for that percentage of each quantum. Given that we want to guarantee enough RCS throughput to avoid missing frames, we set the yield policy to 20% of each 80ms interval. v2: updated quantum and ratio, improved comment, use xe_guc_submit_disable in gt_sanitize Fixes: d9a1ae0d17bd ("drm/xe/guc: Enable WA_DUAL_QUEUE for newer platforms") Signed-off-by: Daniele Ceraolo Spurio Cc: Matthew Brost Cc: John Harrison Cc: Vinay Belgaumkar Reviewed-by: John Harrison Tested-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250905235632.3333247-2-daniele.ceraolospurio@intel.com (cherry picked from commit 88434448438e4302e272b2a2b810b42e05ea024b) Signed-off-by: Rodrigo Vivi [Rodrigo added #include "xe_guc_submit.h" while backporting] commit 992d4e481e958c6898fe750afd429d1b585fff93 Merge: 37889ceadde032 dc3382fffdec2c Author: Linus Torvalds Date: Wed Sep 17 16:52:26 2025 -0700 Merge tag 'probes-fixes-v6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probe fix from Masami Hiramatsu: - kprobe-event: Fix null-ptr-deref in trace_kprobe_create_internal(), by handling NULL return of kmemdup() correctly * tag 'probes-fixes-v6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: kprobe-event: Fix null-ptr-deref in trace_kprobe_create_internal() commit 09847108971a97417b03af1f81b0adc8c586ab42 Merge: 934da21f99c022 528eb4e19ec0df Author: Jakub Kicinski Date: Wed Sep 17 16:14:25 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-09-16 (ice, i40e, ixgbe, igc) For ice: Jake resolves leaking pages with multi-buffer frames when a 0-sized descriptor is encountered. For i40e: Maciej removes a redundant, and incorrect, memory barrier. For ixgbe: Jedrzej adjusts lifespan of ACI lock to ensure uses are while it is valid. For igc: Kohei Enju does not fail probe on LED setup failure which resolves a kernel panic in the cleanup path, if we were to fail. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: igc: don't fail igc_probe() on LED setup error ixgbe: destroy aci.lock later within ixgbe_remove path ixgbe: initialize aci.lock before it's used i40e: remove redundant memory barrier when cleaning Tx descs ice: fix Rx page leak on multi-buffer frames ==================== Link: https://patch.msgid.link/20250916212801.2818440-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 934da21f99c0222bf1dc1bed9fe2d76d0ea17486 Merge: d7995c2b91a570 b6f56a44e4c101 Author: Jakub Kicinski Date: Wed Sep 17 16:12:46 2025 -0700 Merge tag 'wireless-2025-09-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just two fixes: - fix crash in rfkill due to uninitialized type_name - fix aggregation in iwlwifi 7000/8000 devices * tag 'wireless-2025-09-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer wifi: iwlwifi: pcie: fix byte count table for some devices ==================== Link: https://patch.msgid.link/20250917105159.161583-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit d7995c2b91a5709a959f689b33655029814149b3 Merge: a72175c9851328 1fd0362262baff Author: Jakub Kicinski Date: Wed Sep 17 16:01:54 2025 -0700 Merge branch 'tcp-clear-tcp_sk-sk-fastopen_rsk-in-tcp_disconnect' Kuniyuki Iwashima says: ==================== tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported a warning in tcp_retransmit_timer() for TCP Fast Open socket. Patch 1 fixes the issue and Patch 2 adds a test for the scenario. ==================== Link: https://patch.msgid.link/20250915175800.118793-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 1fd0362262baff9381615a5b346298abbc165ba3 Author: Kuniyuki Iwashima Date: Mon Sep 15 17:56:47 2025 +0000 selftest: packetdrill: Add tcp_fastopen_server_reset-after-disconnect.pkt. The test reproduces the scenario explained in the previous patch. Without the patch, the test triggers the warning and cannot see the last retransmitted packet. # ./ksft_runner.sh tcp_fastopen_server_reset-after-disconnect.pkt TAP version 13 1..2 [ 29.229250] ------------[ cut here ]------------ [ 29.231414] WARNING: CPU: 26 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer+0x32/0x9f0 ... tcp_fastopen_server_reset-after-disconnect.pkt:26: error handling packet: Timed out waiting for packet not ok 1 ipv4 tcp_fastopen_server_reset-after-disconnect.pkt:26: error handling packet: Timed out waiting for packet not ok 2 ipv6 # Totals: pass:0 fail:2 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250915175800.118793-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 45c8a6cc2bcd780e634a6ba8e46bffbdf1fc5c01 Author: Kuniyuki Iwashima Date: Mon Sep 15 17:56:46 2025 +0000 tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk in the TCP_ESTABLISHED state. [0] syzbot reused the server-side TCP Fast Open socket as a new client before the TFO socket completes 3WHS: 1. accept() 2. connect(AF_UNSPEC) 3. connect() to another destination As of accept(), sk->sk_state is TCP_SYN_RECV, and tcp_disconnect() changes it to TCP_CLOSE and makes connect() possible, which restarts timers. Since tcp_disconnect() forgot to clear tcp_sk(sk)->fastopen_rsk, the retransmit timer triggered the warning and the intended packet was not retransmitted. Let's call reqsk_fastopen_remove() in tcp_disconnect(). [0]: WARNING: CPU: 2 PID: 0 at net/ipv4/tcp_timer.c:542 tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7)) Modules linked in: CPU: 2 UID: 0 PID: 0 Comm: swapper/2 Not tainted 6.17.0-rc5-g201825fb4278 #62 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:tcp_retransmit_timer (net/ipv4/tcp_timer.c:542 (discriminator 7)) Code: 41 55 41 54 55 53 48 8b af b8 08 00 00 48 89 fb 48 85 ed 0f 84 55 01 00 00 0f b6 47 12 3c 03 74 0c 0f b6 47 12 3c 04 74 04 90 <0f> 0b 90 48 8b 85 c0 00 00 00 48 89 ef 48 8b 40 30 e8 6a 4f 06 3e RSP: 0018:ffffc900002f8d40 EFLAGS: 00010293 RAX: 0000000000000002 RBX: ffff888106911400 RCX: 0000000000000017 RDX: 0000000002517619 RSI: ffffffff83764080 RDI: ffff888106911400 RBP: ffff888106d5c000 R08: 0000000000000001 R09: ffffc900002f8de8 R10: 00000000000000c2 R11: ffffc900002f8ff8 R12: ffff888106911540 R13: ffff888106911480 R14: ffff888106911840 R15: ffffc900002f8de0 FS: 0000000000000000(0000) GS:ffff88907b768000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8044d69d90 CR3: 0000000002c30003 CR4: 0000000000370ef0 Call Trace: tcp_write_timer (net/ipv4/tcp_timer.c:738) call_timer_fn (kernel/time/timer.c:1747) __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2372) timer_expire_remote (kernel/time/timer.c:2385 kernel/time/timer.c:2376 kernel/time/timer.c:2135) tmigr_handle_remote_up (kernel/time/timer_migration.c:944 kernel/time/timer_migration.c:1035) __walk_groups.isra.0 (kernel/time/timer_migration.c:533 (discriminator 1)) tmigr_handle_remote (kernel/time/timer_migration.c:1096) handle_softirqs (./arch/x86/include/asm/jump_label.h:36 ./include/trace/events/irq.h:142 kernel/softirq.c:580) irq_exit_rcu (kernel/softirq.c:614 kernel/softirq.c:453 kernel/softirq.c:680 kernel/softirq.c:696) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1050 (discriminator 35) arch/x86/kernel/apic/apic.c:1050 (discriminator 35)) Fixes: 8336886f786f ("tcp: TCP Fast Open Server - support TFO listeners") Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250915175800.118793-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit a72175c985132885573593222a7b088cf49b07ae Author: Sathesh B Edara Date: Tue Sep 16 06:32:07 2025 -0700 octeon_ep: fix VF MAC address lifecycle handling Currently, VF MAC address info is not updated when the MAC address is configured from VF, and it is not cleared when the VF is removed. This leads to stale or missing MAC information in the PF, which may cause incorrect state tracking or inconsistencies when VFs are hot-plugged or reassigned. Fix this by: - storing the VF MAC address in the PF when it is set from VF - clearing the stored VF MAC address when the VF is removed This ensures that the PF always has correct VF MAC state. Fixes: cde29af9e68e ("octeon_ep: add PF-VF mailbox communication") Signed-off-by: Sathesh B Edara Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250916133207.21737-1-sedara@marvell.com Signed-off-by: Jakub Kicinski commit dc3382fffdec2c1d6df5836c88fa37b39cd8651e Author: Wang Liang Date: Tue Sep 16 15:58:16 2025 +0800 tracing: kprobe-event: Fix null-ptr-deref in trace_kprobe_create_internal() A crash was observed with the following output: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 1 UID: 0 PID: 2899 Comm: syz.2.399 Not tainted 6.17.0-rc5+ #5 PREEMPT(none) RIP: 0010:trace_kprobe_create_internal+0x3fc/0x1440 kernel/trace/trace_kprobe.c:911 Call Trace: trace_kprobe_create_cb+0xa2/0xf0 kernel/trace/trace_kprobe.c:1089 trace_probe_create+0xf1/0x110 kernel/trace/trace_probe.c:2246 dyn_event_create+0x45/0x70 kernel/trace/trace_dynevent.c:128 create_or_delete_trace_kprobe+0x5e/0xc0 kernel/trace/trace_kprobe.c:1107 trace_parse_run_command+0x1a5/0x330 kernel/trace/trace.c:10785 vfs_write+0x2b6/0xd00 fs/read_write.c:684 ksys_write+0x129/0x240 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5d/0x2d0 arch/x86/entry/syscall_64.c:94 Function kmemdup() may return NULL in trace_kprobe_create_internal(), add check for it's return value. Link: https://lore.kernel.org/all/20250916075816.3181175-1-wangliang74@huawei.com/ Fixes: 33b4e38baa03 ("tracing: kprobe-event: Allocate string buffers from heap") Signed-off-by: Wang Liang Signed-off-by: Masami Hiramatsu (Google) commit dc5f94b1ec8f9f65d1ad7a5f45fcac740544e35f Author: Hangbin Liu Date: Tue Sep 16 08:01:27 2025 +0000 selftests: bonding: add vlan over bond testing Add a vlan over bond testing to make sure arp/ns target works. Also change all the configs to mudules. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250916080127.430626-2-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit a8ba87f04ca9cdec06776ce92dce1395026dc3bb Author: Hangbin Liu Date: Tue Sep 16 08:01:26 2025 +0000 bonding: don't set oif to bond dev when getting NS target destination Unlike IPv4, IPv6 routing strictly requires the source address to be valid on the outgoing interface. If the NS target is set to a remote VLAN interface, and the source address is also configured on a VLAN over a bond interface, setting the oif to the bond device will fail to retrieve the correct destination route. Fix this by not setting the oif to the bond device when retrieving the NS target destination. This allows the correct destination device (the VLAN interface) to be determined, so that bond_verify_device_path can return the proper VLAN tags for sending NS messages. Reported-by: David Wilder Closes: https://lore.kernel.org/netdev/aGOKggdfjv0cApTO@fedora/ Suggested-by: Jay Vosburgh Tested-by: David Wilder Acked-by: Jay Vosburgh Fixes: 4e24be018eb9 ("bonding: add new parameter ns_targets") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250916080127.430626-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 37889ceadde0329621a1a1f253febb2019dfdec2 Merge: 05950213a9717d a1eab4d813f7b6 Author: Linus Torvalds Date: Wed Sep 17 13:27:31 2025 -0700 Merge tag 'sched_ext-for-6.17-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix build failure when !FAIR_GROUP_SCHED && EXT_GROUP_SCHED - Revert "sched_ext: Skip per-CPU tasks in scx_bpf_reenqueue_local()" which was causing issues with per-CPU task scheduling and reenqueuing behavior * tag 'sched_ext-for-6.17-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext, sched/core: Fix build failure when !FAIR_GROUP_SCHED && EXT_GROUP_SCHED Revert "sched_ext: Skip per-CPU tasks in scx_bpf_reenqueue_local()" commit 05950213a9717dc8d83ba90538a87b7a9e140ff8 Merge: d4b779985a6c85 94a4acfec14615 Author: Linus Torvalds Date: Wed Sep 17 13:22:08 2025 -0700 Merge tag 'cgroup-for-6.17-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: "This contains two cgroup changes. Both are pretty low risk. - Fix deadlock in cgroup destruction when repeatedly mounting/unmounting perf_event and net_prio controllers. The issue occurs because cgroup_destroy_wq has max_active=1, causing root destruction to wait for CSS offline operations that are queued behind it. The fix splits cgroup_destroy_wq into three separate workqueues to eliminate the blocking. - Set of->priv to NULL upon file release to make potential bugs to manifest as NULL pointer dereferences rather than use-after-free errors" * tag 'cgroup-for-6.17-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup/psi: Set of->priv to NULL upon file release cgroup: split cgroup_destroy_wq into 3 workqueues commit ecd42dd170ea7bacdd9d01d8e74658df8dff621d Merge: f6f43a5338751d 5f9df945d4e862 Author: Paolo Bonzini Date: Wed Sep 17 19:45:21 2025 +0200 Merge tag 'kvm-s390-master-6.17-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD - KVM mm fixes - Postcopy fix commit f6f43a5338751d40817859bc09a60c22d4c42bb5 Merge: 7d862707d6af86 d02e48830e3fce Author: Paolo Bonzini Date: Wed Sep 17 19:45:02 2025 +0200 Merge tag 'kvm-x86-fixes-6.17-rcN' of https://github.com/kvm-x86/linux into HEAD KVM x86 fix for 6.17-rcN Sync the vTPR from the local APIC to the VMCB even when AVIC is active, to fix a bug where host updates to the vTPR, e.g. via KVM_SET_LAPIC or emulation of a guest access, effectively get lost and result in interrupt delivery issues in the guest. commit 7d862707d6af86a31720f31fc1949112df4abadc Merge: f83ec76bf285be e6157256ee1a6a Author: Paolo Bonzini Date: Wed Sep 17 19:44:40 2025 +0200 Merge tag 'kvmarm-fixes-6.17-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 changes for 6.17, round #3 - Invalidate nested MMUs upon freeing the PGD to avoid WARNs when visiting from an MMU notifier - Fixes to the TLB match process and TLB invalidation range for managing the VCNR pseudo-TLB - Prevent SPE from erroneously profiling guests due to UNKNOWN reset values in PMSCR_EL1 - Fix save/restore of host MDCR_EL2 to account for eagerly programming at vcpu_load() on VHE systems - Correct lock ordering when dealing with VGIC LPIs, avoiding scenarios where an xarray's spinlock was nested with a *raw* spinlock - Permit stage-2 read permission aborts which are possible in the case of NV depending on the guest hypervisor's stage-2 translation - Call raw_spin_unlock() instead of the internal spinlock API - Fix parameter ordering when assigning VBAR_EL1 commit ae5fbbda341f92e605a9508a0fb18456155517f0 Author: Daniele Ceraolo Spurio Date: Tue Sep 9 15:12:40 2025 -0700 drm/xe: Fix error handling if PXP fails to start Since the PXP start comes after __xe_exec_queue_init() has completed, we need to cleanup what was done in that function in case of a PXP start error. __xe_exec_queue_init calls the submission backend init() function, so we need to introduce an opposite for that. Unfortunately, while we already have a fini() function pointer, it performs other operations in addition to cleaning up what was done by the init(). Therefore, for clarity, the existing fini() has been renamed to destroy(), while a new fini() has been added to only clean up what was done by the init(), with the latter being called by the former (via xe_exec_queue_fini). Fixes: 72d479601d67 ("drm/xe/pxp/uapi: Add userspace and LRC support for PXP-using queues") Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Cc: Matthew Brost Reviewed-by: John Harrison Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250909221240.3711023-3-daniele.ceraolospurio@intel.com (cherry picked from commit 626667321deb4c7a294725406faa3dd71c3d445d) Signed-off-by: Rodrigo Vivi commit ff89a4d285c82813faa0e2e386d07120ae1f9c85 Author: Zongyao Bai Date: Tue Sep 16 05:47:15 2025 +0800 drm/xe/sysfs: Add cleanup action in xe_device_sysfs_init On partial failure, some sysfs files created before the failure might not be removed. Add common cleanup step to remove them all immediately, as is should be harmless to attempt to remove non-existing files. Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes") Cc: Lucas De Marchi Cc: Stuart Summers Cc: Shuicheng Lin Cc: Michal Wajdeczko Signed-off-by: Zongyao Bai Reviewed-by: Shuicheng Lin Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250915214716.1327379-2-zongyao.bai@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 1a869168d91f1a1a2b0db22cea0295c67908e5d8) Signed-off-by: Rodrigo Vivi commit 7dd670db9afdca6aed4a9f99776cb72e6ed5a1f5 Author: Richard Fitzgerald Date: Wed Sep 17 17:06:09 2025 +0100 ALSA: hda: intel-dsp-config: Prevent SEGFAULT if ACPI_HANDLE() is NULL Check in snd_intel_dsp_check_soundwire() that the pointer returned by ACPI_HANDLE() is not NULL, before passing it on to other functions. The original code assumed a non-NULL return, but if it was unexpectedly NULL it would end up passed to acpi_walk_namespace() as the start point, and would result in [ 3.219028] BUG: kernel NULL pointer dereference, address: 0000000000000018 [ 3.219029] #PF: supervisor read access in kernel mode [ 3.219030] #PF: error_code(0x0000) - not-present page [ 3.219031] PGD 0 P4D 0 [ 3.219032] Oops: Oops: 0000 [#1] SMP NOPTI [ 3.219035] CPU: 2 UID: 0 PID: 476 Comm: (udev-worker) Tainted: G S AW E 6.17.0-rc5-test #1 PREEMPT(voluntary) [ 3.219038] Tainted: [S]=CPU_OUT_OF_SPEC, [A]=OVERRIDDEN_ACPI_TABLE, [W]=WARN, [E]=UNSIGNED_MODULE [ 3.219040] RIP: 0010:acpi_ns_walk_namespace+0xb5/0x480 This problem was triggered by a bugged DSDT that the kernel couldn't parse. But it shouldn't be possible to SEGFAULT the kernel just because of some bugs in ACPI. Fixes: 0650857570d1 ("ALSA: hda: add autodetection for SoundWire") Signed-off-by: Richard Fitzgerald Signed-off-by: Takashi Iwai commit d4b779985a6c853be5693fa6e8994034f8492abc Merge: b6f456a76f7379 a86556264696b7 Author: Linus Torvalds Date: Wed Sep 17 08:07:02 2025 -0700 Merge tag 'for-6.17/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper fixes from Mikulas Patocka: - fix integer overflow in dm-stripe - limit tag size in dm-integrity to 255 bytes - fix 'alignment inconsistency' warning in dm-raid * tag 'for-6.17/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-raid: don't set io_min and io_opt for raid1 dm-integrity: limit MAX_TAG_SIZE to 255 dm-stripe: fix a possible integer overflow commit b6f456a76f7379fa4e30371e548f40b10a76b60f Merge: 5aca7966d2a725 80eb65ccf6f72d Author: Linus Torvalds Date: Wed Sep 17 07:55:45 2025 -0700 Merge tag 'for-6.17-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - in zoned mode, turn assertion to proper code when reserving space in relocation block group - fix search key of extended ref (hardlink) when replaying log - fix initialization of file extent tree on filesystems without no-holes feature - add harmless data race annotation to block group comparator * tag 'for-6.17-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: annotate block group access with data_race() when sorting for reclaim btrfs: initialize inode::file_extent_tree after i_mode has been set btrfs: zoned: fix incorrect ASSERT in btrfs_zoned_reserve_data_reloc_bg() btrfs: fix invalid extref key setup when replaying dentry commit 027a7a9c07d0d759ab496a7509990aa33a4b689c Author: Zhang Yi Date: Wed Sep 10 19:11:07 2025 +0800 drbd: init queue_limits->max_hw_wzeroes_unmap_sectors parameter The parameter max_hw_wzeroes_unmap_sectors in queue_limits should be equal to max_write_zeroes_sectors if it is set to a non-zero value. However, when the backend bdev is specified, this parameter is initialized to UINT_MAX during the call to blk_set_stacking_limits(), while only max_write_zeroes_sectors is adjusted. Therefore, this discrepancy triggers a value check failure in blk_validate_limits(). Since the drvd driver doesn't yet support unmap write zeroes, so fix this failure by explicitly setting max_hw_wzeroes_unmap_sectors to zero. Fixes: 0c40d7cb5ef3 ("block: introduce max_{hw|user}_wzeroes_unmap_sectors to queue limits") Signed-off-by: Zhang Yi Reviewed-by: Martin K. Petersen Reviewed-by: Yu Kuai Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit a86556264696b797d94238d99d8284d0d34ed960 Author: Mikulas Patocka Date: Mon Sep 15 16:12:40 2025 +0200 dm-raid: don't set io_min and io_opt for raid1 These commands modprobe brd rd_size=1048576 vgcreate vg /dev/ram* lvcreate -m4 -L10 -n lv vg trigger the following warnings: device-mapper: table: 252:10: adding target device (start sect 0 len 24576) caused an alignment inconsistency device-mapper: table: 252:10: adding target device (start sect 0 len 24576) caused an alignment inconsistency The warnings are caused by the fact that io_min is 512 and physical block size is 4096. If there's chunk-less raid, such as raid1, io_min shouldn't be set to zero because it would be raised to 512 and it would trigger the warning. Signed-off-by: Mikulas Patocka Reviewed-by: Martin K. Petersen Cc: stable@vger.kernel.org commit de09bcb81874b1c92bc624482e8d028dd454603f Merge: 743bf030947169 f0bd03832f5c84 Author: Jens Axboe Date: Wed Sep 17 07:20:42 2025 -0600 Merge tag 'md-6.17-20250917' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into block-6.17 Pull MD fixes from Yu Kuai: "For 6.17 on drivers supporting write zeros, raid{0,1,10,5} are broken and can't be assembled." * tag 'md-6.17-20250917' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: md: init queue_limits->max_hw_wzeroes_unmap_sectors parameter commit 44499ecb4f2817743c37d861bdb3e95f37d3d9cd Author: Takashi Iwai Date: Wed Sep 17 15:09:01 2025 +0200 ALSA: usb: qcom: Fix false-positive address space check The sanity check previously added to uaudio_transfer_buffer_setup() assumed the allocated buffer being linear-mapped. But the buffer allocated via usb_alloc_coherent() isn't always so, rather to be used with (SG-)DMA API. This leaded to a false-positive warning and the driver failed to work. Actually uaudio_transfer_buffer_setup() deals only with the DMA-API addresses for MEM_XFER_BUF type, while other callers of uaudio_iommu_map() are with pages with physical addresses for MEM_EVENT_RING and MEM_XFER_RING types. So this patch splits the mapping helper function to two different ones, uaudio_iommu_map() for the DMA pages and uaudio_iommu_map_pa() for the latter, in order to handle mapping differently for each type. Along with it, the unnecessary address check that caused probe error is dropped, too. Fixes: 3335a1bbd624 ("ALSA: qc_audio_offload: try to reduce address space confusion") Suggested-by: Arnd Bergmann Acked-by: Arnd Bergmann Reported-and-tested-by: Luca Weiss Closes: https://lore.kernel.org/DBR2363A95M1.L9XBNC003490@fairphone.com Signed-off-by: Takashi Iwai commit 1dd28fd86c3fa4e395031dd6f2ba920242107010 Author: Jack Yu Date: Wed Sep 17 08:11:43 2025 +0000 ASoC: rt5682s: Adjust SAR ADC button mode to fix noise issue Adjust register settings for SAR adc button detection mode to fix noise issue in headset. Signed-off-by: Jack Yu Link: https://patch.msgid.link/766cd1d2dd7a403ba65bb4cc44845f71@realtek.com Signed-off-by: Mark Brown commit b6f56a44e4c1014b08859dcf04ed246500e310e5 Author: Hans de Goede Date: Sat Sep 13 13:35:15 2025 +0200 net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property") rfkill_find_type() gets called with the possibly uninitialized "const char *type_name;" local variable. On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752" acpi_device, the rfkill->type is set based on the ACPI acpi_device_id: rfkill->type = (unsigned)id->driver_data; and there is no "type" property so device_property_read_string() will fail and leave type_name uninitialized, leading to a potential crash. rfkill_find_type() does accept a NULL pointer, fix the potential crash by initializing type_name to NULL. Note likely sofar this has not been caught because: 1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device 2. The stack happened to contain NULL where type_name is stored Fixes: 7d5e9737efda ("net: rfkill: gpio: get the name and type from device property") Cc: stable@vger.kernel.org Cc: Heikki Krogerus Signed-off-by: Hans de Goede Reviewed-by: Heikki Krogerus Link: https://patch.msgid.link/20250913113515.21698-1-hansg@kernel.org Signed-off-by: Johannes Berg commit e882985b09b2469b7d48389e08fb790dc9497d60 Merge: db87bd2ad1f736 a38108a23ab558 Author: Johannes Berg Date: Wed Sep 17 12:35:38 2025 +0200 Merge tag 'iwlwifi-fixes-2025-09-15' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi fix ==================== The fix is for byte count tables in 7000/8000 family devices. Signed-off-by: Johannes Berg commit a1eab4d813f7b6e606ed21381b8cfda5c59a87e5 Author: Tejun Heo Date: Tue Sep 16 11:06:42 2025 -1000 sched_ext, sched/core: Fix build failure when !FAIR_GROUP_SCHED && EXT_GROUP_SCHED While collecting SCX related fields in struct task_group into struct scx_task_group, 6e6558a6bc41 ("sched_ext, sched/core: Factor out struct scx_task_group") forgot update tg->scx_weight usage in tg_weight(), which leads to build failure when CONFIG_FAIR_GROUP_SCHED is disabled but CONFIG_EXT_GROUP_SCHED is enabled. Fix it. Fixes: 6e6558a6bc41 ("sched_ext, sched/core: Factor out struct scx_task_group") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509170230.MwZsJSWa-lkp@intel.com/ Tested-by: Andrea Righi Signed-off-by: Tejun Heo commit 8c4748539985489b59a00b4c2ae919253b3d2762 Merge: 94ff1ed3030e88 7601a0a46216f4 Author: Jakub Kicinski Date: Tue Sep 16 17:19:14 2025 -0700 Merge branch 'mlx5e-misc-fixes-2025-09-15' Tariq Toukan says: ==================== mlx5e misc fixes 2025-09-15 This patchset provides misc bug fixes from the team to the mlx5 Eth driver. ==================== Link: https://patch.msgid.link/1757939074-617281-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 7601a0a46216f4ba05adff2de75923b4e8e585c2 Author: Lama Kayal Date: Mon Sep 15 15:24:34 2025 +0300 net/mlx5e: Add a miss level for ipsec crypto offload The cited commit adds a miss table for switchdev mode. But it uses the same level as policy table. Will hit the following error when running command: # ip xfrm state add src 192.168.1.22 dst 192.168.1.21 proto \ esp spi 1001 reqid 10001 aead 'rfc4106(gcm(aes))' \ 0x3a189a7f9374955d3817886c8587f1da3df387ff 128 \ mode tunnel offload dev enp8s0f0 dir in Error: mlx5_core: Device failed to offload this state. The dmesg error is: mlx5_core 0000:03:00.0: ipsec_miss_create:578:(pid 311797): fail to create IPsec miss_rule err=-22 Fix it by adding a new miss level to avoid the error. Fixes: 7d9e292ecd67 ("net/mlx5e: Move IPSec policy check after decryption") Signed-off-by: Jianbo Liu Signed-off-by: Chris Mi Signed-off-by: Lama Kayal Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1757939074-617281-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6b4be64fd9fec16418f365c2d8e47a7566e9eba5 Author: Jianbo Liu Date: Mon Sep 15 15:24:32 2025 +0300 net/mlx5e: Harden uplink netdev access against device unbind The function mlx5_uplink_netdev_get() gets the uplink netdevice pointer from mdev->mlx5e_res.uplink_netdev. However, the netdevice can be removed and its pointer cleared when unbound from the mlx5_core.eth driver. This results in a NULL pointer, causing a kernel panic. BUG: unable to handle page fault for address: 0000000000001300 at RIP: 0010:mlx5e_vport_rep_load+0x22a/0x270 [mlx5_core] Call Trace: mlx5_esw_offloads_rep_load+0x68/0xe0 [mlx5_core] esw_offloads_enable+0x593/0x910 [mlx5_core] mlx5_eswitch_enable_locked+0x341/0x420 [mlx5_core] mlx5_devlink_eswitch_mode_set+0x17e/0x3a0 [mlx5_core] devlink_nl_eswitch_set_doit+0x60/0xd0 genl_family_rcv_msg_doit+0xe0/0x130 genl_rcv_msg+0x183/0x290 netlink_rcv_skb+0x4b/0xf0 genl_rcv+0x24/0x40 netlink_unicast+0x255/0x380 netlink_sendmsg+0x1f3/0x420 __sock_sendmsg+0x38/0x60 __sys_sendto+0x119/0x180 do_syscall_64+0x53/0x1d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Ensure the pointer is valid before use by checking it for NULL. If it is valid, immediately call netdev_hold() to take a reference, and preventing the netdevice from being freed while it is in use. Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") Signed-off-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Reviewed-by: Jiri Pirko Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1757939074-617281-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 94ff1ed3030e88cfe4e34c1d47c5832995c953c8 Author: Jakub Kicinski Date: Mon Sep 15 16:42:55 2025 -0700 MAINTAINERS: make the DPLL entry cover drivers DPLL maintainers should probably be CCed on driver patches, too. Remove the *, which makes the pattern only match files directly under drivers/dpll but not its sub-directories. Acked-by: Jiri Pirko Acked-by: Vadim Fedorenko Acked-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20250915234255.1306612-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 109f8b51543d106aee50dfe911f439e43fb30c7a Author: Remy D. Farley Date: Sat Sep 13 14:05:28 2025 +0000 doc/netlink: Fix typos in operation attributes I'm trying to generate Rust bindings for netlink using the yaml spec. It looks like there's a typo in conntrack spec: attribute set conntrack-attrs defines attributes "counters-{orig,reply}" (plural), while get operation references "counter-{orig,reply}" (singular). The latter should be fixed, as it denotes multiple counters (packet and byte). The corresonding C define is CTA_COUNTERS_ORIG. Also, dump request references "nfgen-family" attribute, which neither exists in conntrack-attrs attrset nor ctattr_type enum. There's member of nfgenmsg struct with the same name, which is where family value is actually taken from. > static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl, > struct sk_buff *skb, > const struct nlmsghdr *nlh, > const struct nlattr * const cda[], > struct netlink_ext_ack *extack) > { > int err; > struct nfgenmsg *nfmsg = nlmsg_data(nlh); > u_int8_t u3 = nfmsg->nfgen_family; ^^^^^^^^^^^^ Signed-off-by: Remy D. Farley Fixes: 23fc9311a526 ("netlink: specs: add conntrack dump and stats dump support") Link: https://patch.msgid.link/20250913140515.1132886-1-one-d-wide@protonmail.com Signed-off-by: Jakub Kicinski commit 5aca7966d2a7255ba92fd5e63268dd767b223aa5 Merge: 46a51f4f5edade 20c9ccffccd61b Author: Linus Torvalds Date: Tue Sep 16 15:15:54 2025 -0700 Merge tag 'perf-tools-fixes-for-v6.17-2025-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Namhyung Kim: "A small set of fixes for crashes in different commands and conditions" * tag 'perf-tools-fixes-for-v6.17-2025-09-16' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf maps: Ensure kmap is set up for all inserts perf lock: Provide a host_env for session new perf subcmd: avoid crash in exclude_cmds when excludes is empty commit f9b80514a7227c589291792cb6743b0ddf41c2bc Author: Mario Limonciello Date: Mon Sep 15 20:59:02 2025 -0500 drm/amd: Only restore cached manual clock settings in restore if OD enabled If OD is not enabled then restoring cached clock settings doesn't make sense and actually leads to errors in resume. Check if enabled before restoring settings. Fixes: 4e9526924d09 ("drm/amd: Restore cached manual clock settings during resume") Reported-by: Jérôme Lécuyer Closes: https://lore.kernel.org/amd-gfx/0ffe2692-7bfa-4821-856e-dd0f18e2c32b@amd.com/T/#me6db8ddb192626360c462b7570ed7eba0c6c9733 Suggested-by: Jérôme Lécuyer Acked-by: Alex Deucher Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 1a4dd33cc6e1baaa81efdbe68227a19f51c50f20) Cc: stable@vger.kernel.org commit 528eb4e19ec0df30d0c9ae4074ce945667dde919 Author: Kohei Enju Date: Wed Sep 10 22:47:21 2025 +0900 igc: don't fail igc_probe() on LED setup error When igc_led_setup() fails, igc_probe() fails and triggers kernel panic in free_netdev() since unregister_netdev() is not called. [1] This behavior can be tested using fault-injection framework, especially the failslab feature. [2] Since LED support is not mandatory, treat LED setup failures as non-fatal and continue probe with a warning message, consequently avoiding the kernel panic. [1] kernel BUG at net/core/dev.c:12047! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 937 Comm: repro-igc-led-e Not tainted 6.17.0-rc4-enjuk-tnguy-00865-gc4940196ab02 #64 PREEMPT(voluntary) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:free_netdev+0x278/0x2b0 [...] Call Trace: igc_probe+0x370/0x910 local_pci_probe+0x3a/0x80 pci_device_probe+0xd1/0x200 [...] [2] #!/bin/bash -ex FAILSLAB_PATH=/sys/kernel/debug/failslab/ DEVICE=0000:00:05.0 START_ADDR=$(grep " igc_led_setup" /proc/kallsyms \ | awk '{printf("0x%s", $1)}') END_ADDR=$(printf "0x%x" $((START_ADDR + 0x100))) echo $START_ADDR > $FAILSLAB_PATH/require-start echo $END_ADDR > $FAILSLAB_PATH/require-end echo 1 > $FAILSLAB_PATH/times echo 100 > $FAILSLAB_PATH/probability echo N > $FAILSLAB_PATH/ignore-gfp-wait echo $DEVICE > /sys/bus/pci/drivers/igc/bind Fixes: ea578703b03d ("igc: Add support for LEDs on i225/i226") Signed-off-by: Kohei Enju Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Reviewed-by: Vitaly Lifshits Reviewed-by: Kurt Kanzenbach Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit 316ba68175b04a9f6f75295764789ea94e31d48c Author: Jedrzej Jagielski Date: Mon Sep 8 13:26:29 2025 +0200 ixgbe: destroy aci.lock later within ixgbe_remove path There's another issue with aci.lock and previous patch uncovers it. aci.lock is being destroyed during removing ixgbe while some of the ixgbe closing routines are still ongoing. These routines use Admin Command Interface which require taking aci.lock which has been already destroyed what leads to call trace. [ +0.000004] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ +0.000007] WARNING: CPU: 12 PID: 10277 at kernel/locking/mutex.c:155 mutex_lock+0x5f/0x70 [ +0.000002] Call Trace: [ +0.000003] [ +0.000006] ixgbe_aci_send_cmd+0xc8/0x220 [ixgbe] [ +0.000049] ? try_to_wake_up+0x29d/0x5d0 [ +0.000009] ixgbe_disable_rx_e610+0xc4/0x110 [ixgbe] [ +0.000032] ixgbe_disable_rx+0x3d/0x200 [ixgbe] [ +0.000027] ixgbe_down+0x102/0x3b0 [ixgbe] [ +0.000031] ixgbe_close_suspend+0x28/0x90 [ixgbe] [ +0.000028] ixgbe_close+0xfb/0x100 [ixgbe] [ +0.000025] __dev_close_many+0xae/0x220 [ +0.000005] dev_close_many+0xc2/0x1a0 [ +0.000004] ? kernfs_should_drain_open_files+0x2a/0x40 [ +0.000005] unregister_netdevice_many_notify+0x204/0xb00 [ +0.000006] ? __kernfs_remove.part.0+0x109/0x210 [ +0.000006] ? kobj_kset_leave+0x4b/0x70 [ +0.000008] unregister_netdevice_queue+0xf6/0x130 [ +0.000006] unregister_netdev+0x1c/0x40 [ +0.000005] ixgbe_remove+0x216/0x290 [ixgbe] [ +0.000021] pci_device_remove+0x42/0xb0 [ +0.000007] device_release_driver_internal+0x19c/0x200 [ +0.000008] driver_detach+0x48/0x90 [ +0.000003] bus_remove_driver+0x6d/0xf0 [ +0.000006] pci_unregister_driver+0x2e/0xb0 [ +0.000005] ixgbe_exit_module+0x1c/0xc80 [ixgbe] Same as for the previous commit, the issue has been highlighted by the commit 337369f8ce9e ("locking/mutex: Add MUTEX_WARN_ON() into fast path"). Move destroying aci.lock to the end of ixgbe_remove(), as this simply fixes the issue. Fixes: 4600cdf9f5ac ("ixgbe: Enable link management in E610 device") Signed-off-by: Jedrzej Jagielski Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit b85936e95a4bd2a07e134af71e2c0750a69d2b8b Author: Jedrzej Jagielski Date: Mon Sep 8 13:26:28 2025 +0200 ixgbe: initialize aci.lock before it's used Currently aci.lock is initialized too late. A bunch of ACI callbacks using the lock are called prior it's initialized. Commit 337369f8ce9e ("locking/mutex: Add MUTEX_WARN_ON() into fast path") highlights that issue what results in call trace. [ 4.092899] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 4.092910] WARNING: CPU: 0 PID: 578 at kernel/locking/mutex.c:154 mutex_lock+0x6d/0x80 [ 4.098757] Call Trace: [ 4.098847] [ 4.098922] ixgbe_aci_send_cmd+0x8c/0x1e0 [ixgbe] [ 4.099108] ? hrtimer_try_to_cancel+0x18/0x110 [ 4.099277] ixgbe_aci_get_fw_ver+0x52/0xa0 [ixgbe] [ 4.099460] ixgbe_check_fw_error+0x1fc/0x2f0 [ixgbe] [ 4.099650] ? usleep_range_state+0x69/0xd0 [ 4.099811] ? usleep_range_state+0x8c/0xd0 [ 4.099964] ixgbe_probe+0x3b0/0x12d0 [ixgbe] [ 4.100132] local_pci_probe+0x43/0xa0 [ 4.100267] work_for_cpu_fn+0x13/0x20 [ 4.101647] Move aci.lock mutex initialization to ixgbe_sw_init() before any ACI command is sent. Along with that move also related SWFW semaphore in order to reduce size of ixgbe_probe() and that way all locks are initialized in ixgbe_sw_init(). Reviewed-by: Michal Swiatkowski Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Reviewed-by: Aleksandr Loktionov Fixes: 4600cdf9f5ac ("ixgbe: Enable link management in E610 device") Signed-off-by: Jedrzej Jagielski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit e37084a26070c546ae7961ee135bbfb15fbe13fd Author: Maciej Fijalkowski Date: Fri Aug 22 17:16:17 2025 +0200 i40e: remove redundant memory barrier when cleaning Tx descs i40e has a feature which writes to memory location last descriptor successfully sent. Memory barrier in i40e_clean_tx_irq() was used to avoid forward-reading descriptor fields in case DD bit was not set. Having mentioned feature in place implies that such situation will not happen as we know in advance how many descriptors HW has dealt with. Besides, this barrier placement was wrong. Idea is to have this protection *after* reading DD bit from HW descriptor, not before. Digging through git history showed me that indeed barrier was before DD bit check, anyways the commit introducing i40e_get_head() should have wiped it out altogether. Also, there was one commit doing s/read_barrier_depends/smp_rmb when get head feature was already in place, but it was only theoretical based on ixgbe experiences, which is different in these terms as that driver has to read DD bit from HW descriptor. Fixes: 1943d8ba9507 ("i40e/i40evf: enable hardware feature head write back") Signed-off-by: Maciej Fijalkowski Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b Author: Jacob Keller Date: Mon Aug 25 16:00:14 2025 -0700 ice: fix Rx page leak on multi-buffer frames The ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each buffer in the current frame. This function was introduced as part of handling multi-buffer XDP support in the ice driver. It works by iterating over the buffers from first_desc up to 1 plus the total number of fragments in the frame, cached from before the XDP program was executed. If the hardware posts a descriptor with a size of 0, the logic used in ice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added as fragments in ice_add_xdp_frag. Since the buffer isn't counted as a fragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't call ice_put_rx_buf(). Because we don't call ice_put_rx_buf(), we don't attempt to re-use the page or free it. This leaves a stale page in the ring, as we don't increment next_to_alloc. The ice_reuse_rx_page() assumes that the next_to_alloc has been incremented properly, and that it always points to a buffer with a NULL page. Since this function doesn't check, it will happily recycle a page over the top of the next_to_alloc buffer, losing track of the old page. Note that this leak only occurs for multi-buffer frames. The ice_put_rx_mbuf() function always handles at least one buffer, so a single-buffer frame will always get handled correctly. It is not clear precisely why the hardware hands us descriptors with a size of 0 sometimes, but it happens somewhat regularly with "jumbo frames" used by 9K MTU. To fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on all buffers between first_desc and next_to_clean. Borrow the logic of a similar function in i40e used for this same purpose. Use the same logic also in ice_get_pgcnts(). Instead of iterating over just the number of fragments, use a loop which iterates until the current index reaches to the next_to_clean element just past the current frame. Unlike i40e, the ice_put_rx_mbuf() function does call ice_put_rx_buf() on the last buffer of the frame indicating the end of packet. For non-linear (multi-buffer) frames, we need to take care when adjusting the pagecnt_bias. An XDP program might release fragments from the tail of the frame, in which case that fragment page is already released. Only update the pagecnt_bias for the first descriptor and fragments still remaining post-XDP program. Take care to only access the shared info for fragmented buffers, as this avoids a significant cache miss. The xdp_xmit value only needs to be updated if an XDP program is run, and only once per packet. Drop the xdp_xmit pointer argument from ice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function directly. This avoids needing to pass the argument and avoids an extra bit-wise OR for each buffer in the frame. Move the increment of the ntc local variable to ensure its updated *before* all calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic requires the index of the element just after the current frame. Now that we use an index pointer in the ring to identify the packet, we no longer need to track or cache the number of fragments in the rx_ring. Cc: Christoph Petrausch Cc: Jesper Dangaard Brouer Reported-by: Jaroslav Pulchart Closes: https://lore.kernel.org/netdev/CAK8fFZ4hY6GUJNENz3wY9jaYLZXGfpr7dnZxzGMYoE44caRbgw@mail.gmail.com/ Fixes: 743bbd93cf29 ("ice: put Rx buffers after being done with current frame") Tested-by: Michal Kubiak Signed-off-by: Jacob Keller Acked-by: Jesper Dangaard Brouer Tested-by: Priya Singh Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0b47b6c3543efd65f2e620e359b05f4938314fbd Author: Andrea Righi Date: Fri Sep 12 18:14:38 2025 +0200 Revert "sched_ext: Skip per-CPU tasks in scx_bpf_reenqueue_local()" scx_bpf_reenqueue_local() can be called from ops.cpu_release() when a CPU is taken by a higher scheduling class to give tasks queued to the CPU's local DSQ a chance to be migrated somewhere else, instead of waiting indefinitely for that CPU to become available again. In doing so, we decided to skip migration-disabled tasks, under the assumption that they cannot be migrated anyway. However, when a higher scheduling class preempts a CPU, the running task is always inserted at the head of the local DSQ as a migration-disabled task. This means it is always skipped by scx_bpf_reenqueue_local(), and ends up being confined to the same CPU even if that CPU is heavily contended by other higher scheduling class tasks. As an example, let's consider the following scenario: $ schedtool -a 0,1, -e yes > /dev/null $ sudo schedtool -F -p 99 -a 0, -e \ stress-ng -c 1 --cpu-load 99 --cpu-load-slice 1000 The first task (SCHED_EXT) can run on CPU0 or CPU1. The second task (SCHED_FIFO) is pinned to CPU0 and consumes ~99% of it. If the SCHED_EXT task initially runs on CPU0, it will remain there because it always sees CPU0 as "idle" in the short gaps left by the RT task, resulting in ~1% utilization while CPU1 stays idle: 0[||||||||||||||||||||||100.0%] 8[ 0.0%] 1[ 0.0%] 9[ 0.0%] 2[ 0.0%] 10[ 0.0%] 3[ 0.0%] 11[ 0.0%] 4[ 0.0%] 12[ 0.0%] 5[ 0.0%] 13[ 0.0%] 6[ 0.0%] 14[ 0.0%] 7[ 0.0%] 15[ 0.0%] PID USER PRI NI S CPU CPU%▽MEM% TIME+ Command 1067 root RT 0 R 0 99.0 0.2 0:31.16 stress-ng-cpu [run] 975 arighi 20 0 R 0 1.0 0.0 0:26.32 yes By allowing scx_bpf_reenqueue_local() to re-enqueue migration-disabled tasks, the scheduler can choose to migrate them to other CPUs (CPU1 in this case) via ops.enqueue(), leading to better CPU utilization: 0[||||||||||||||||||||||100.0%] 8[ 0.0%] 1[||||||||||||||||||||||100.0%] 9[ 0.0%] 2[ 0.0%] 10[ 0.0%] 3[ 0.0%] 11[ 0.0%] 4[ 0.0%] 12[ 0.0%] 5[ 0.0%] 13[ 0.0%] 6[ 0.0%] 14[ 0.0%] 7[ 0.0%] 15[ 0.0%] PID USER PRI NI S CPU CPU%▽MEM% TIME+ Command 577 root RT 0 R 0 100.0 0.2 0:23.17 stress-ng-cpu [run] 555 arighi 20 0 R 1 100.0 0.0 0:28.67 yes It's debatable whether per-CPU tasks should be re-enqueued as well, but doing so is probably safer: the scheduler can recognize re-enqueued tasks through the %SCX_ENQ_REENQ flag, reassess their placement, and either put them back at the head of the local DSQ or let another task attempt to take the CPU. This also prevents giving per-CPU tasks an implicit priority boost, which would otherwise make them more likely to reclaim CPUs preempted by higher scheduling classes. Fixes: 97e13ecb02668 ("sched_ext: Skip per-CPU tasks in scx_bpf_reenqueue_local()") Cc: stable@vger.kernel.org # v6.15+ Signed-off-by: Andrea Righi Acked-by: Changwoo Min Signed-off-by: Tejun Heo commit f0bd03832f5c84f90919bd018156b1b6eb911692 Author: Zhang Yi Date: Wed Sep 10 19:11:06 2025 +0800 md: init queue_limits->max_hw_wzeroes_unmap_sectors parameter The parameter max_hw_wzeroes_unmap_sectors in queue_limits should be equal to max_write_zeroes_sectors if it is set to a non-zero value. However, the stacked md drivers call md_init_stacking_limits() to initialize this parameter to UINT_MAX but only adjust max_write_zeroes_sectors when setting limits. Therefore, this discrepancy triggers a value check failure in blk_validate_limits(). $ modprobe scsi_debug num_parts=2 dev_size_mb=8 lbprz=1 lbpws=1 $ mdadm --create /dev/md0 --level=0 --raid-device=2 /dev/sda1 /dev/sda2 mdadm: Defaulting to version 1.2 metadata mdadm: RUN_ARRAY failed: Invalid argument Fix this failure by explicitly setting max_hw_wzeroes_unmap_sectors to max_write_zeroes_sectors. Since the linear and raid0 drivers support write zeroes, so they can support unmap write zeroes operation if all of the backend devices support it. However, the raid1/10/5 drivers don't support write zeroes, so we have to set it to zero. Fixes: 0c40d7cb5ef3 ("block: introduce max_{hw|user}_wzeroes_unmap_sectors to queue limits") Reported-by: John Garry Closes: https://lore.kernel.org/linux-block/803a2183-a0bb-4b7a-92f1-afc5097630d2@oracle.com/ Signed-off-by: Zhang Yi Tested-by: John Garry Reviewed-by: Li Nan Reviewed-by: Martin K. Petersen Reviewed-by: Yu Kuai Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/linux-raid/20250910111107.3247530-2-yi.zhang@huaweicloud.com Signed-off-by: Yu Kuai commit cbc7f3b4f6ca19320e2eacf8fc1403d6f331ce14 Author: Dan Carpenter Date: Thu Aug 7 18:53:41 2025 +0300 drm/xe: Fix a NULL vs IS_ERR() in xe_vm_add_compute_exec_queue() The xe_preempt_fence_create() function returns error pointers. It never returns NULL. Update the error checking to match. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Dan Carpenter Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/aJTMBdX97cof_009@stanley.mountain Signed-off-by: Rodrigo Vivi (cherry picked from commit 75cc23ffe5b422bc3cbd5cf0956b8b86e4b0e162) Signed-off-by: Rodrigo Vivi commit 288dac9fb6084330d968459c750c838fd06e10e6 Author: Qi Xi Date: Thu Sep 4 11:44:47 2025 +0800 drm: bridge: cdns-mhdp8546: Fix missing mutex unlock on error path Add missing mutex unlock before returning from the error path in cdns_mhdp_atomic_enable(). Fixes: 935a92a1c400 ("drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference") Reported-by: Hulk Robot Signed-off-by: Qi Xi Reviewed-by: Luca Ceresoli Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250904034447.665427-1-xiqi2@huawei.com Signed-off-by: Luca Ceresoli commit f7a5195c2d28925f09dc8f01addfdab44c0e3997 Merge: cc648f4dde2ffb 596e8ba2faf0d2 Author: Mark Brown Date: Tue Sep 16 13:09:08 2025 +0100 Fix lpaif_type and DAI configuration for I2S Merge series from Mohammad Rafi Shaik : Fix the lpaif_type configuration for the I2S interface. The proper lpaif interface type required to allow DSP to vote appropriate clock setting for I2S interface and also Add support for configuring the DAI format on MI2S interfaces to allow setting the appropriate bit clock and frame clock polarity, ensuring correct audio data transmissionover MI2S. commit 2b464fd599c583e53fb35dbdc3b4851e30895ff2 Merge: f83ec76bf285be 19c839a98c7311 Author: Bartosz Golaszewski Date: Tue Sep 16 11:36:37 2025 +0200 Merge tag 'intel-gpio-v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/andy/linux-gpio-intel into gpio/for-current intel-gpio fixes for v6.17-rc7 * Fix a regression to make GpioInt() by index work again * Ingnore spurious wakeups from touchpad on GPD G1619-05 * Accept debounce from GpioIo() resources commit 225d1ee0f5ba3218d1814d36564fdb5f37b50474 Author: Antheas Kapenekakis Date: Tue Sep 16 09:28:18 2025 +0200 platform/x86: asus-wmi: Re-add extra keys to ignore_key_wlan quirk It turns out that the dual screen models use 0x5E for attaching and detaching the keyboard instead of 0x5F. So, re-add the codes by reverting commit cf3940ac737d ("platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk"). For our future reference, add a comment next to 0x5E indicating that it is used for that purpose. Fixes: cf3940ac737d ("platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk") Reported-by: Rahul Chandra Closes: https://lore.kernel.org/all/10020-68c90c80-d-4ac6c580@106290038/ Cc: stable@kernel.org Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20250916072818.196462-1-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1b09d08866277677d11726116f5e786d5ba00173 Author: Shyam Sundar S K Date: Mon Sep 15 14:35:46 2025 +0530 platform/x86/amd/pmf: Support new ACPI ID AMDI0108 Include the ACPI ID AMDI0108, which is used on upcoming AMD platforms, in the PMF driver's list of supported devices. Signed-off-by: Shyam Sundar S K Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20250915090546.2759130-1-Shyam-sundar.S-k@amd.com Signed-off-by: Ilpo Järvinen commit 35e526398bd0faddef3396d71760e4c5ea75868f Author: Aaron Ma Date: Sat Aug 23 20:16:47 2025 +0800 drm/i915/backlight: Honor VESA eDP backlight luminance control capability The VESA AUX backlight fails to be enable luminance based backlight mainpulation becaused luminance_set is false by default. Fix it by using luminance support control capabitliy. Fixes: e13af5166a359 ("drm/i915/backlight: Use drm helper to initialize edp backlight") Signed-off-by: Aaron Ma Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250823121647.275834-1-aaron.ma@canonical.com (cherry picked from commit 72136efb875d8438c20b9c8ab72945d474933471) Signed-off-by: Tvrtko Ursulin commit ce4be9e4307c5a60701ff6e0cafa74caffdc54ce Author: Sergey Senozhatsky Date: Tue Sep 9 13:48:35 2025 +0900 zram: fix slot write race condition Parallel concurrent writes to the same zram index result in leaked zsmalloc handles. Schematically we can have something like this: CPU0 CPU1 zram_slot_lock() zs_free(handle) zram_slot_lock() zram_slot_lock() zs_free(handle) zram_slot_lock() compress compress handle = zs_malloc() handle = zs_malloc() zram_slot_lock zram_set_handle(handle) zram_slot_lock zram_slot_lock zram_set_handle(handle) zram_slot_lock Either CPU0 or CPU1 zsmalloc handle will leak because zs_free() is done too early. In fact, we need to reset zram entry right before we set its new handle, all under the same slot lock scope. Link: https://lkml.kernel.org/r/20250909045150.635345-1-senozhatsky@chromium.org Fixes: 71268035f5d7 ("zram: free slot memory early during write") Signed-off-by: Sergey Senozhatsky Reported-by: Changhui Zhong Closes: https://lore.kernel.org/all/CAGVVp+UtpGoW5WEdEU7uVTtsSCjPN=ksN6EcvyypAtFDOUf30A@mail.gmail.com/ Tested-by: Changhui Zhong Cc: Jens Axboe Cc: Minchan Kim Cc: Signed-off-by: Andrew Morton commit 93ab4881a4e2b9657bdce4b8940073bfb4ed5eab Author: Yeounsu Moon Date: Sat Sep 13 15:01:36 2025 +0900 net: natsemi: fix `rx_dropped` double accounting on `netif_rx()` failure `netif_rx()` already increments `rx_dropped` core stat when it fails. The driver was also updating `ndev->stats.rx_dropped` in the same path. Since both are reported together via `ip -s -s` command, this resulted in drops being counted twice in user-visible stats. Keep the driver update on `if (unlikely(!skb))`, but skip it after `netif_rx()` errors. Fixes: caf586e5f23c ("net: add a core netdev->rx_dropped counter") Signed-off-by: Yeounsu Moon Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250913060135.35282-3-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski commit 97499e281823cbe622addad348779b889e99226e Merge: 33a09c64c2f5a2 b86418beade11d Author: Jakub Kicinski Date: Mon Sep 15 18:12:08 2025 -0700 Merge branch 'mptcp-pm-nl-announce-deny-join-id0-flag' Matthieu Baerts says: ==================== mptcp: pm: nl: announce deny-join-id0 flag During the connection establishment, a peer can tell the other one that it cannot establish new subflows to the initial IP address and port by setting the 'C' flag [1]. Doing so makes sense when the sender is behind a strict NAT, operating behind a legacy Layer 4 load balancer, or using anycast IP address for example. When this 'C' flag is set, the path-managers must then not try to establish new subflows to the other peer's initial IP address and port. The in-kernel PM has access to this info, but the userspace PM didn't, not letting the userspace daemon able to respect the RFC8684. Here are a few fixes related to this 'C' flag (aka 'deny-join-id0'): - Patch 1: add remote_deny_join_id0 info on passive connections. A fix for v5.14. - Patch 2: let the userspace PM daemon know about the deny_join_id0 attribute, so when set, it can avoid creating new subflows to the initial IP address and port. A fix for v5.19. - Patch 3: a validation for the previous commit. - Patch 4: record the deny_join_id0 info when TFO is used. A fix for v6.2. - Patch 5: not related to deny-join-id0, but it fixes errors messages in the sockopt selftests, not to create confusions. A fix for v6.5. ==================== Link: https://patch.msgid.link/20250912-net-mptcp-pm-uspace-deny_join_id0-v1-0-40171884ade8@kernel.org Signed-off-by: Jakub Kicinski commit b86418beade11d45540a2d20c4ec1128849b6c27 Author: Geliang Tang Date: Fri Sep 12 14:52:24 2025 +0200 selftests: mptcp: sockopt: fix error messages This patch fixes several issues in the error reporting of the MPTCP sockopt selftest: 1. Fix diff not printed: The error messages for counter mismatches had the actual difference ('diff') as argument, but it was missing in the format string. Displaying it makes the debugging easier. 2. Fix variable usage: The error check for 'mptcpi_bytes_acked' incorrectly used 'ret2' (sent bytes) for both the expected value and the difference calculation. It now correctly uses 'ret' (received bytes), which is the expected value for bytes_acked. 3. Fix off-by-one in diff: The calculation for the 'mptcpi_rcv_delta' diff was 's.mptcpi_rcv_delta - ret', which is off-by-one. It has been corrected to 's.mptcpi_rcv_delta - (ret + 1)' to match the expected value in the condition above it. Fixes: 5dcff89e1455 ("selftests: mptcp: explicitly tests aggregate counters") Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-pm-uspace-deny_join_id0-v1-5-40171884ade8@kernel.org Signed-off-by: Jakub Kicinski commit 92da495cb65719583aa06bc946aeb18a10e1e6e2 Author: Matthieu Baerts (NGI0) Date: Fri Sep 12 14:52:23 2025 +0200 mptcp: tfo: record 'deny join id0' info When TFO is used, the check to see if the 'C' flag (deny join id0) was set was bypassed. This flag can be set when TFO is used, so the check should also be done when TFO is used. Note that the set_fully_established label is also used when a 4th ACK is received. In this case, deny_join_id0 will not be set. Fixes: dfc8d0603033 ("mptcp: implement delayed seq generation for passive fastopen") Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-pm-uspace-deny_join_id0-v1-4-40171884ade8@kernel.org Signed-off-by: Jakub Kicinski commit 24733e193a0d68f20d220e86da0362460c9aa812 Author: Matthieu Baerts (NGI0) Date: Fri Sep 12 14:52:22 2025 +0200 selftests: mptcp: userspace pm: validate deny-join-id0 flag The previous commit adds the MPTCP_PM_EV_FLAG_DENY_JOIN_ID0 flag. Make sure it is correctly announced by the other peer when it has been received. pm_nl_ctl will now display 'deny_join_id0:1' when monitoring the events, and when this flag was set by the other peer. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-pm-uspace-deny_join_id0-v1-3-40171884ade8@kernel.org Signed-off-by: Jakub Kicinski commit 2293c57484ae64c9a3c847c8807db8c26a3a4d41 Author: Matthieu Baerts (NGI0) Date: Fri Sep 12 14:52:21 2025 +0200 mptcp: pm: nl: announce deny-join-id0 flag During the connection establishment, a peer can tell the other one that it cannot establish new subflows to the initial IP address and port by setting the 'C' flag [1]. Doing so makes sense when the sender is behind a strict NAT, operating behind a legacy Layer 4 load balancer, or using anycast IP address for example. When this 'C' flag is set, the path-managers must then not try to establish new subflows to the other peer's initial IP address and port. The in-kernel PM has access to this info, but the userspace PM didn't. The RFC8684 [1] is strict about that: (...) therefore the receiver MUST NOT try to open any additional subflows toward this address and port. So it is important to tell the userspace about that as it is responsible for the respect of this flag. When a new connection is created and established, the Netlink events now contain the existing but not currently used 'flags' attribute. When MPTCP_PM_EV_FLAG_DENY_JOIN_ID0 is set, it means no other subflows to the initial IP address and port -- info that are also part of the event -- can be established. Link: https://datatracker.ietf.org/doc/html/rfc8684#section-3.1-20.6 [1] Fixes: 702c2f646d42 ("mptcp: netlink: allow userspace-driven subflow establishment") Reported-by: Marek Majkowski Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/532 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-pm-uspace-deny_join_id0-v1-2-40171884ade8@kernel.org Signed-off-by: Jakub Kicinski commit 96939cec994070aa5df852c10fad5fc303a97ea3 Author: Matthieu Baerts (NGI0) Date: Fri Sep 12 14:52:20 2025 +0200 mptcp: set remote_deny_join_id0 on SYN recv When a SYN containing the 'C' flag (deny join id0) was received, this piece of information was not propagated to the path-manager. Even if this flag is mainly set on the server side, a client can also tell the server it cannot try to establish new subflows to the client's initial IP address and port. The server's PM should then record such info when received, and before sending events about the new connection. Fixes: df377be38725 ("mptcp: add deny_join_id0 in mptcp_options_received") Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-pm-uspace-deny_join_id0-v1-1-40171884ade8@kernel.org Signed-off-by: Jakub Kicinski commit 33a09c64c2f5a25e88636bf177c0971d5b688bfe Merge: 71379e1c95af2c cf74e0aa0eb024 Author: Jakub Kicinski Date: Mon Sep 15 18:10:40 2025 -0700 Merge branch 'selftests-mptcp-avoid-spurious-errors-on-tcp-disconnect' Matthieu Baerts says: ==================== selftests: mptcp: avoid spurious errors on TCP disconnect This series should fix the recent instabilities seen by MPTCP and NIPA CIs where the 'mptcp_connect.sh' tests fail regularly when running the 'disconnect' subtests with "plain" TCP sockets, e.g. # INFO: disconnect # 63 ns1 MPTCP -> ns1 (10.0.1.1:20001 ) MPTCP (duration 996ms) [ OK ] # 64 ns1 MPTCP -> ns1 (10.0.1.1:20002 ) TCP (duration 851ms) [ OK ] # 65 ns1 TCP -> ns1 (10.0.1.1:20003 ) MPTCP Unexpected revents: POLLERR/POLLNVAL(19) # (duration 896ms) [FAIL] file received by server does not match (in, out): # -rw-r--r-- 1 root root 11112852 Aug 19 09:16 /tmp/tmp.hlJe5DoMoq.disconnect # Trailing bytes are: # /{ga 6@=#.8:-rw------- 1 root root 10085368 Aug 19 09:16 /tmp/tmp.blClunilxx # Trailing bytes are: # /{ga 6@=#.8:66 ns1 MPTCP -> ns1 (dead:beef:1::1:20004) MPTCP (duration 987ms) [ OK ] # 67 ns1 MPTCP -> ns1 (dead:beef:1::1:20005) TCP (duration 911ms) [ OK ] # 68 ns1 TCP -> ns1 (dead:beef:1::1:20006) MPTCP (duration 980ms) [ OK ] # [FAIL] Tests of the full disconnection have failed These issues started to be visible after some behavioural changes in TCP, where too quick re-connections after a shutdown() can now be more easily rejected. Patch 3 modifies the selftests to wait, but this resolution revealed an issue in MPTCP which is fixed by patch 1 (a fix for v5.9 kernel). Patches 2 and 4 improve some errors reported by the selftests, and patch 5 helps with the debugging of such issues. ==================== Link: https://patch.msgid.link/20250912-net-mptcp-fix-sft-connect-v1-0-d40e77cbbf02@kernel.org Signed-off-by: Jakub Kicinski commit cf74e0aa0eb024741c8b5cb7e839d2824ca77336 Author: Matthieu Baerts (NGI0) Date: Fri Sep 12 14:25:54 2025 +0200 selftests: mptcp: connect: print pcap prefix To be able to find which capture files have been produced after several runs. This prefix was not printed anywhere before. While at it, always use the same prefix by taking info from ns1, instead of "$connector_ns", which is sometimes ns1, sometimes ns2 in the subtests. Reviewed-by: Mat Martineau Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-fix-sft-connect-v1-5-d40e77cbbf02@kernel.org Signed-off-by: Jakub Kicinski commit a17c5aa3a32373f80b4714b411bd8d4ffee6fc6a Author: Matthieu Baerts (NGI0) Date: Fri Sep 12 14:25:53 2025 +0200 selftests: mptcp: print trailing bytes with od This is better than printing random bytes in the terminal. Note that Jakub suggested 'hexdump', but Mat found out this tool is not often installed by default. 'od' can do a similar job, and it is in the POSIX specs and available in coreutils, so it should be on more systems. While at it, display a few more bytes, just to fill in the two lines. And no need to display the 3rd only line showing the next number of bytes: 0000040. Suggested-by: Jakub Kicinski Suggested-by: Mat Martineau Reviewed-by: Mat Martineau Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-fix-sft-connect-v1-4-d40e77cbbf02@kernel.org Signed-off-by: Jakub Kicinski commit 8708c5d8b3fb3f6d5d3b9e6bfe01a505819f519a Author: Matthieu Baerts (NGI0) Date: Fri Sep 12 14:25:52 2025 +0200 selftests: mptcp: avoid spurious errors on TCP disconnect The disconnect test-case, with 'plain' TCP sockets generates spurious errors, e.g. 07 ns1 TCP -> ns1 (dead:beef:1::1:10006) MPTCP read: Connection reset by peer read: Connection reset by peer (duration 155ms) [FAIL] client exit code 3, server 3 netns ns1-FloSdv (listener) socket stat for 10006: TcpActiveOpens 2 0.0 TcpPassiveOpens 2 0.0 TcpEstabResets 2 0.0 TcpInSegs 274 0.0 TcpOutSegs 276 0.0 TcpOutRsts 3 0.0 TcpExtPruneCalled 2 0.0 TcpExtRcvPruned 1 0.0 TcpExtTCPPureAcks 104 0.0 TcpExtTCPRcvCollapsed 2 0.0 TcpExtTCPBacklogCoalesce 42 0.0 TcpExtTCPRcvCoalesce 43 0.0 TcpExtTCPChallengeACK 1 0.0 TcpExtTCPFromZeroWindowAdv 42 0.0 TcpExtTCPToZeroWindowAdv 41 0.0 TcpExtTCPWantZeroWindowAdv 13 0.0 TcpExtTCPOrigDataSent 164 0.0 TcpExtTCPDelivered 165 0.0 TcpExtTCPRcvQDrop 1 0.0 In the failing scenarios (TCP -> MPTCP), the involved sockets are actually plain TCP ones, as fallbacks for passive sockets at 2WHS time cause the MPTCP listeners to actually create 'plain' TCP sockets. Similar to commit 218cc166321f ("selftests: mptcp: avoid spurious errors on disconnect"), the root cause is in the user-space bits: the test program tries to disconnect as soon as all the pending data has been spooled, generating an RST. If such option reaches the peer before the connection has reached the closed status, the TCP socket will report an error to the user-space, as per protocol specification, causing the above failure. Note that it looks like this issue got more visible since the "tcp: receiver changes" series from commit 06baf9bfa6ca ("Merge branch 'tcp-receiver-changes'"). Address the issue by explicitly waiting for the TCP sockets (-t) to reach a closed status before performing the disconnect. More precisely, the test program now waits for plain TCP sockets or TCP subflows in addition to the MPTCP sockets that were already monitored. While at it, use 'ss' with '-n' to avoid resolving service names, which is not needed here. Fixes: 218cc166321f ("selftests: mptcp: avoid spurious errors on disconnect") Cc: stable@vger.kernel.org Suggested-by: Paolo Abeni Reviewed-by: Mat Martineau Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-fix-sft-connect-v1-3-d40e77cbbf02@kernel.org Signed-off-by: Jakub Kicinski commit 14e22b43df25dbd4301351b882486ea38892ae4f Author: Matthieu Baerts (NGI0) Date: Fri Sep 12 14:25:51 2025 +0200 selftests: mptcp: connect: catch IO errors on listen side IO errors were correctly printed to stderr, and propagated up to the main loop for the server side, but the returned value was ignored. As a consequence, the program for the listener side was no longer exiting with an error code in case of IO issues. Because of that, some issues might not have been seen. But very likely, most issues either had an effect on the client side, or the file transfer was not the expected one, e.g. the connection got reset before the end. Still, it is better to fix this. The main consequence of this issue is the error that was reported by the selftests: the received and sent files were different, and the MIB counters were not printed. Also, when such errors happened during the 'disconnect' tests, the program tried to continue until the timeout. Now when an IO error is detected, the program exits directly with an error. Fixes: 05be5e273c84 ("selftests: mptcp: add disconnect tests") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-fix-sft-connect-v1-2-d40e77cbbf02@kernel.org Signed-off-by: Jakub Kicinski commit f755be0b1ff429a2ecf709beeb1bcd7abc111c2b Author: Matthieu Baerts (NGI0) Date: Fri Sep 12 14:25:50 2025 +0200 mptcp: propagate shutdown to subflows when possible When the MPTCP DATA FIN have been ACKed, there is no more MPTCP related metadata to exchange, and all subflows can be safely shutdown. Before this patch, the subflows were actually terminated at 'close()' time. That's certainly fine most of the time, but not when the userspace 'shutdown()' a connection, without close()ing it. When doing so, the subflows were staying in LAST_ACK state on one side -- and consequently in FIN_WAIT2 on the other side -- until the 'close()' of the MPTCP socket. Now, when the DATA FIN have been ACKed, all subflows are shutdown. A consequence of this is that the TCP 'FIN' flag can be set earlier now, but the end result is the same. This affects the packetdrill tests looking at the end of the MPTCP connections, but for a good reason. Note that tcp_shutdown() will check the subflow state, so no need to do that again before calling it. Fixes: 3721b9b64676 ("mptcp: Track received DATA_FIN sequence number and add related helpers") Cc: stable@vger.kernel.org Fixes: 16a9a9da1723 ("mptcp: Add helper to process acks of DATA_FIN") Reviewed-by: Mat Martineau Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250912-net-mptcp-fix-sft-connect-v1-1-d40e77cbbf02@kernel.org Signed-off-by: Jakub Kicinski commit 71379e1c95af2c57567fcac24184c94cb7de4cd6 Author: Hangbin Liu Date: Wed Sep 10 02:43:35 2025 +0000 selftests: bonding: add fail_over_mac testing Add a test to check each value of bond fail_over_mac option. Also fix a minor garp_test print issue. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250910024336.400253-2-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 35ae4e86292ef7dfe4edbb9942955c884e984352 Author: Hangbin Liu Date: Wed Sep 10 02:43:34 2025 +0000 bonding: set random address only when slaves already exist After commit 5c3bf6cba791 ("bonding: assign random address if device address is same as bond"), bonding will erroneously randomize the MAC address of the first interface added to the bond if fail_over_mac = follow. Correct this by additionally testing for the bond being empty before randomizing the MAC. Fixes: 5c3bf6cba791 ("bonding: assign random address if device address is same as bond") Reported-by: Qiuling Ren Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250910024336.400253-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 4351ca3fcb3ffecf12631b4996bf085a2dad0db6 Author: Håkon Bugge Date: Thu Sep 11 15:33:34 2025 +0200 rds: ib: Increment i_fastreg_wrs before bailing out We need to increment i_fastreg_wrs before we bail out from rds_ib_post_reg_frmr(). We have a fixed budget of how many FRWR operations that can be outstanding using the dedicated QP used for memory registrations and de-registrations. This budget is enforced by the atomic_t i_fastreg_wrs. If we bail out early in rds_ib_post_reg_frmr(), we will "leak" the possibility of posting an FRWR operation, and if that accumulates, no FRWR operation can be carried out. Fixes: 1659185fb4d0 ("RDS: IB: Support Fastreg MR (FRMR) memory registration mode") Fixes: 3a2886cca703 ("net/rds: Keep track of and wait for FRWR segments in use upon shutdown") Cc: stable@vger.kernel.org Signed-off-by: Håkon Bugge Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250911133336.451212-1-haakon.bugge@oracle.com Signed-off-by: Jakub Kicinski commit a318eb807825d71900e212f5aab3469e86feff8e Author: Alok Tiwari Date: Sat Sep 13 08:40:53 2025 -0700 vhost-scsi: fix argument order in tport allocation error message The error log in vhost_scsi_make_tport() prints the arguments in the wrong order, producing confusing output. For example, when creating a target with a name in WWNN format such as "fc.port1234", the log looks like: Emulated fc.port1234 Address: FCP, exceeds max: 64 Instead, the message should report the emulated protocol type first, followed by the configfs name as: Emulated FCP Address: fc.port1234, exceeds max: 64 Fix the argument order so the error log is consistent and clear. Signed-off-by: Alok Tiwari Message-Id: <20250913154106.3995856-1-alok.a.tiwari@oracle.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi commit 29a2f430475357f760679b249f33e7282688e292 Author: Ivan Lipski Date: Tue Sep 2 16:20:09 2025 -0400 drm/amd/display: Allow RX6xxx & RX7700 to invoke amdgpu_irq_get/put [Why&How] As reported on https://gitlab.freedesktop.org/drm/amd/-/issues/3936, SMU hang can occur if the interrupts are not enabled appropriately, causing a vblank timeout. This patch reverts commit 5009628d8509 ("drm/amd/display: Remove unnecessary amdgpu_irq_get/put"), but only for RX6xxx & RX7700 GPUs, on which the issue was observed. This will re-enable interrupts regardless of whether the user space needed it or not. Fixes: 5009628d8509 ("drm/amd/display: Remove unnecessary amdgpu_irq_get/put") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3936 Suggested-by: Sun peng Li Reviewed-by: Sun peng Li Signed-off-by: Ivan Lipski Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 95d168b367aa28a59f94fc690ff76ebf69312c6d) Cc: stable@vger.kernel.org commit c1b6b8c7706354b73196649c46b5e6d4d61c2f5c Author: Srinivasan Shanmugam Date: Wed Sep 10 12:27:05 2025 +0530 drm/amdgpu/gfx11: Add Cleaner Shader Support for GFX11.0.1/11.0.4 GPUs Enable the cleaner shader for additional GFX11.0.1/11.0.4 series GPUs to ensure data isolation among GPU tasks. The cleaner shader is tasked with clearing the Local Data Store (LDS), Vector General Purpose Registers (VGPRs), and Scalar General Purpose Registers (SGPRs), which helps avoid data leakage and guarantees the accuracy of computational results. This update extends cleaner shader support to GFX11.0.1/11.0.4 GPUs, previously available for GFX11.0.3. It enhances security by clearing GPU memory between processes and maintains a consistent GPU state across KGD and KFD workloads. Cc: Wasee Alam Cc: Mario Sopena-Novales Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 0a71ceb27f88a944c2de2808b67b2f46ac75076b) commit a10f910c77f280327b481e77eab909934ec508f0 Author: Loic Poulain Date: Wed Jul 9 10:54:38 2025 +0200 drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ If the interrupt occurs before resource initialization is complete, the interrupt handler/worker may access uninitialized data such as the I2C tcpc_client device, potentially leading to NULL pointer dereference. Signed-off-by: Loic Poulain Fixes: 8bdfc5dae4e3 ("drm/bridge: anx7625: Add anx7625 MIPI DSI/DPI to DP") Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250709085438.56188-1-loic.poulain@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 7926ba2143d8fef40bb940232818c7363e33598c Author: Nitin Gote Date: Thu Sep 11 10:58:23 2025 +0530 drm/xe: defer free of NVM auxiliary container to device release callback Do not kfree the intel_dg_nvm_dev in xe_nvm_fini() right after auxiliary_device_delete/uninit. The auxiliary_device embeds the device/kobject (and its name); freeing it too early can race with asynchronous device_del/udev processing and cause a use-after-free. Signed-off-by: Nitin Gote Fixes: c28bfb107dac ("drm/xe/nvm: add on-die non-volatile memory device") Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250911052823.226696-1-nitin.r.gote@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit d4c3ed963e41d488695cf91068eabb8eb9f538ec) Signed-off-by: Rodrigo Vivi commit dcfd151d3277cc3bc73c94114e360556d47b992d Author: Mallesh Koujalagi Date: Fri Sep 12 17:04:58 2025 +0530 drm/xe/hwmon: Remove type casting Refactor: eliminate type casts by using proper u32 declarations. v2: - Address review comments. (Karthik) v3: - Use the proper u32 type and drop cast. (Lucas De Marchi) - Modify variable when actually using u64 value. - Change r value to reg_value with u32 type. v4: - Remove newline between trailer and Signed-off-by. (Lucas De Marchi) - Change reg_val to val for more user-friendly logging. - Use mul_u32_u32 function since both values are u32. v5: - mul_u32_u32 function with shift. (Lucas De Marchi) Fixes: 7596d839f6228 ("drm/xe/hwmon: Add support to manage power limits though mailbox") Signed-off-by: Mallesh Koujalagi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250912113458.2815172-1-mallesh.koujalagi@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 4e1d3b5e6423dc841acd8691d75626b3d3b2b6a8) Signed-off-by: Rodrigo Vivi commit 20c9ccffccd61b37325a0519fb6d485caeecf7fa Author: Ian Rogers Date: Sun Sep 14 11:18:08 2025 -0700 perf maps: Ensure kmap is set up for all inserts __maps__fixup_overlap_and_insert may split or directly insert a map, when doing this the map may need to have a kmap set up for the sake of the kmaps. The missing kmap set up fails the check_invariants test in maps, later "Internal error" reports from map__kmap and ultimately causes segfaults. Similar fixes were added in commit e0e4e0b8b7fa ("perf maps: Add missing map__set_kmap_maps() when replacing a kernel map") and commit 25d9c0301d36 ("perf maps: Set the kmaps for newly created/added kernel maps") but they missed cases. To try to reduce the risk of this, update the kmap directly following any manual insert. This identified another problem in maps__copy_from. Fixes: e0e4e0b8b7fa ("perf maps: Add missing map__set_kmap_maps() when replacing a kernel map") Fixes: 25d9c0301d36 ("perf maps: Set the kmaps for newly created/added kernel maps") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit cd4ea81be3eb94047ad023c631afd9bd6c295400 Author: Max Kellermann Date: Fri Sep 12 02:06:09 2025 +0200 io_uring/io-wq: fix `max_workers` breakage and `nr_workers` underflow Commit 88e6c42e40de ("io_uring/io-wq: add check free worker before create new worker") reused the variable `do_create` for something else, abusing it for the free worker check. This caused the value to effectively always be `true` at the time `nr_workers < max_workers` was checked, but it should really be `false`. This means the `max_workers` setting was ignored, and worse: if the limit had already been reached, incrementing `nr_workers` was skipped even though another worker would be created. When later lots of workers exit, the `nr_workers` field could easily underflow, making the problem worse because more and more workers would be created without incrementing `nr_workers`. The simple solution is to use a different variable for the free worker check instead of using one variable for two different things. Cc: stable@vger.kernel.org Fixes: 88e6c42e40de ("io_uring/io-wq: add check free worker before create new worker") Signed-off-by: Max Kellermann Reviewed-by: Fengnan Chang Signed-off-by: Jens Axboe commit 7f830e126dc357fc086905ce9730140fd4528d66 Author: Tom Lendacky Date: Mon Sep 15 11:04:12 2025 -0500 x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT The sev_evict_cache() is guest-related code and should be guarded by CONFIG_AMD_MEM_ENCRYPT, not CONFIG_KVM_AMD_SEV. CONFIG_AMD_MEM_ENCRYPT=y is required for a guest to run properly as an SEV-SNP guest, but a guest kernel built with CONFIG_KVM_AMD_SEV=n would get the stub function of sev_evict_cache() instead of the version that performs the actual eviction. Move the function declarations under the appropriate #ifdef. Fixes: 7b306dfa326f ("x86/sev: Evict cache lines during SNP memory validation") Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Cc: stable@kernel.org # 6.16.x Link: https://lore.kernel.org/r/70e38f2c4a549063de54052c9f64929705313526.1757708959.git.thomas.lendacky@amd.com commit 6131690df4adae33e01c0b51b9b78b3e8ed3b76f Author: Thierry Reding Date: Tue Jul 29 16:28:02 2025 +0200 firmware: tegra: Do not warn on missing memory-region property The IPC shared memory can reside in system memory or SRAM. In the latter case the memory-region property is expected not to be present, so do not warn about it. Reported-by: Jonathan Hunter Fixes: dbe4efea38d0 ("firmware: tegra: bpmp: Use of_reserved_mem_region_to_resource() for "memory-region"") Signed-off-by: Thierry Reding commit 46a51f4f5edade43ba66b3c151f0e25ec8b69cb6 Merge: f83ec76bf285be 1e451977e1703b Author: Linus Torvalds Date: Mon Sep 15 08:15:11 2025 -0700 Merge tag 'for-v6.17-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply fixes from Sebastian Reichel: - bq27xxx: avoid spamming the log for missing bq27000 battery * tag 'for-v6.17-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: power: supply: bq27xxx: restrict no-battery detection to bq27000 power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery commit fef8b64e48e836344574b85132a1c317f4260022 Author: Michal Wajdeczko Date: Thu Sep 11 00:24:39 2025 +0200 drm/xe/pf: Drop rounddown_pow_of_two fair LMEM limitation This effectively reverts commit 4c3fe5eae46b ("drm/xe/pf: Limit fair VF LMEM provisioning") since we don't need it any more after non-contig VRAM allocations were fixed. This allows larger LMEM auto-provisioning for VFs, so instead: [ ] GT0: PF: LMEM available(14096M) fair(1 x 8192M) [ ] GT0: PF: VF1 provisioned with 8589934592 (8.00 GiB) LMEM or [ ] GT0: PF: LMEM available(14096M) fair(2 x 4096M) [ ] GT0: PF: VF1..VF2 provisioned with 4294967296 (4.00 GiB) LMEM we may get: [ ] GT0: PF: LMEM available(14096M) fair(1 x 14096M) [ ] GT0: PF: VF1 provisioned with 14780727296 (13.8 GiB) LMEM and [ ] GT0: PF: LMEM available(14096M) fair(2 x 7048M) [ ] GT0: PF: VF1..VF2 provisioned with 7390363648 (6.88 GiB) LMEM Fixes: 1e32ffbc9dc8 ("drm/xe/sriov: support non-contig VRAM provisioning") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250910222439.32869-1-michal.wajdeczko@intel.com (cherry picked from commit 95c1cfa306087142989bff34ea0e05dcd95ddc58) Signed-off-by: Rodrigo Vivi commit 013e484dbd687a9174acf8f4450217bdb86ad788 Author: Shuicheng Lin Date: Tue Aug 19 15:39:51 2025 +0000 drm/xe/tile: Release kobject for the failure path Call kobject_put() for the failure path to release the kobject v2: remove extra newline. (Matt) Fixes: e3d0839aa501 ("drm/xe/tile: Abort driver load for sysfs creation failure") Cc: Himal Prasad Ghimiray Reviewed-by: Matthew Brost Signed-off-by: Shuicheng Lin Link: https://lore.kernel.org/r/20250819153950.2973344-2-shuicheng.lin@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit b98775bca99511cc22ab459a2de646cd2fa7241f) Signed-off-by: Rodrigo Vivi commit 66d938e89e940e512f4c3deac938ecef399c13f9 Author: Lizhi Xu Date: Fri Sep 5 09:59:25 2025 +0800 netfs: Prevent duplicate unlocking The filio lock has been released here, so there is no need to jump to error_folio_unlock to release it again. Reported-by: syzbot+b73c7d94a151e2ee1e9b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b73c7d94a151e2ee1e9b Signed-off-by: Lizhi Xu Acked-by: David Howells Reviewed-by: Paulo Alcantara (Red Hat) Signed-off-by: Christian Brauner commit cc648f4dde2ffbb74b9c1626e3eaaac89c6fbe16 Author: Balamurugan C Date: Mon Sep 15 10:56:54 2025 +0800 ASoC: Intel: PTL: Add entry for HDMI-In capture support to non-I2S codec boards. Adding HDMI-In capture support for the PTL products which doesn't have onboard I2S codec. But need to support HDMI-In capture via I2S and audio playback through HDMI/DP monitor. Signed-off-by: Balamurugan C Signed-off-by: Bard Liao Link: https://patch.msgid.link/20250915025655.1154279-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit d7871f400cad1da376f1d7724209a1c49226c456 Author: Venkata Prasad Potturu Date: Wed Sep 10 22:43:59 2025 +0530 ASoC: amd: acp: Fix incorrect retrival of acp_chip_info Use dev_get_drvdata(dev->parent) instead of dev_get_platdata(dev) to correctly obtain acp_chip_info members in the acp I2S driver. Previously, some members were not updated properly due to incorrect data access, which could potentially lead to null pointer dereferences. This issue was missed in the earlier commit ("ASoC: amd: acp: Fix NULL pointer deref in acp_i2s_set_tdm_slot"), which only addressed set_tdm_slot(). This change ensures that all relevant functions correctly retrieve acp_chip_info, preventing further null pointer dereference issues. Fixes: e3933683b25e ("ASoC: amd: acp: Remove redundant acp_dev_data structure") Signed-off-by: Venkata Prasad Potturu Reviewed-by: Cezary Rojewski Link: https://patch.msgid.link/20250910171419.3682468-1-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown commit 73caf2bcf3f0a3843c091b78b0711e356f8a2ef9 Author: Mac Chiang Date: Mon Sep 15 10:54:56 2025 +0800 ASoC: Intel: sof_sdw: use PRODUCT_FAMILY for Fatcat series PRODUCT_NAME is machine-specific. Use PRODUCT_FAMILY to ensure the machine quirk is applied with consistent audio configurations across Fatcat series products. Signed-off-by: Mac Chiang Reviewed-by: Kai Vehmanen Signed-off-by: Bard Liao Link: https://patch.msgid.link/20250915025456.1154200-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit c7a321e4e90e1bd072697bc050b9426e04cffc6a Author: Mohammad Rafi Shaik Date: Sun Sep 14 18:45:49 2025 +0530 ASoC: qcom: sc8280xp: Fix sound card driver name match data for QCS8275 The QCS8275 board is based on Qualcomm's QCS8300 SoC family, and all supported firmware files are located in the qcs8300 directory. The sound topology and ALSA UCM configuration files have also been migrated from the qcs8275 directory to the actual SoC qcs8300 directory in linux-firmware. With the current setup, the sound topology fails to load, resulting in sound card registration failure. This patch updates the driver match data to use the correct driver name qcs8300 for the qcs8275-sndcard, ensuring that the sound card driver correctly loads the sound topology and ALSA UCM configuration files from the qcs8300 directory. Fixes: 34d340d48e595 ("ASoC: qcom: sc8280xp: Add support for QCS8275") Cc: stable@vger.kernel.org Signed-off-by: Mohammad Rafi Shaik Reviewed-by: Srinivas Kandagatla Reviewed-by: Dmitry Baryshkov Link: https://patch.msgid.link/20250914131549.1198740-1-mohammad.rafi.shaik@oss.qualcomm.com Signed-off-by: Mark Brown commit 91d8a53db2199eefc73ecf3682e0665ea6895696 Author: Sabrina Dubroca Date: Wed Sep 10 17:22:13 2025 +0200 xfrm: fix offloading of cross-family tunnels Xiumei reported a regression in IPsec offload tests over xfrmi, where the traffic for IPv6 over IPv4 tunnels is processed in SW instead of going through crypto offload, after commit cc18f482e8b6 ("xfrm: provide common xdo_dev_offload_ok callback implementation"). Commit cc18f482e8b6 added a generic version of existing checks attempting to prevent packets with IPv4 options or IPv6 extension headers from being sent to HW that doesn't support offloading such packets. The check mistakenly uses x->props.family (the outer family) to determine the inner packet's family and verify if options/extensions are present. In the case of IPv6 over IPv4, the check compares some of the traffic class bits to the expected no-options ihl value (5). The original check was introduced in commit 2ac9cfe78223 ("net/mlx5e: IPSec, Add Innova IPSec offload TX data path"), and then duplicated in the other drivers. Before commit cc18f482e8b6, the loose check (ihl > 5) passed because those traffic class bits were not set to a value that triggered the no-offload codepath. Packets with options/extension headers that should have been handled in SW went through the offload path, and were likely dropped by the NIC or incorrectly processed. Since commit cc18f482e8b6, the check is now strict (ihl != 5), and in a basic setup (no traffic class configured), all packets go through the no-offload codepath. The commits that introduced the incorrect family checks in each driver are: 2ac9cfe78223 ("net/mlx5e: IPSec, Add Innova IPSec offload TX data path") 8362ea16f69f ("crypto: chcr - ESN for Inline IPSec Tx") 859a497fe80c ("nfp: implement xfrm callbacks and expose ipsec offload feature to upper layer") 32188be805d0 ("cn10k-ipsec: Allow ipsec crypto offload for skb with SA") [ixgbe/ixgbevf commits are ignored, as that HW does not support tunnel mode, thus no cross-family setups are possible] Fixes: cc18f482e8b6 ("xfrm: provide common xdo_dev_offload_ok callback implementation") Reported-by: Xiumei Mu Signed-off-by: Sabrina Dubroca Reviewed-by: Leon Romanovsky Reviewed-by: Zhu Yanjun Signed-off-by: Steffen Klassert commit a38108a23ab558b834d71d542d32c05ab0fb64d4 Author: Johannes Berg Date: Mon Sep 15 10:30:52 2025 +0300 wifi: iwlwifi: pcie: fix byte count table for some devices In my previous fix for this condition, I erroneously listed 9000 instead of 7000 family, when 7000/8000 were already using iwlmvm. Thus the condition ended up wrong, causing the issue I had fixed for older devices to suddenly appear on 7000/8000 family devices. Correct the condition accordingly. Reported-by: David Wang <00107082@163.com> Closes: https://lore.kernel.org/r/20250909165811.10729-1-00107082@163.com/ Fixes: 586e3cb33ba6 ("wifi: iwlwifi: fix byte count table for old devices") Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250915102743.777aaafbcc6c.I84404edfdfbf400501f6fb06def5b86c501da198@changeid Signed-off-by: Miri Korenblit commit d99c203034989c3652cc8e7330ba5750fc74c04f Author: Bou-Saan Che Date: Sun Sep 14 22:17:50 2025 +0300 ALSA: hda/realtek: Fix volume control on Lenovo Thinkbook 13x Gen 4 The issue was caused by incorrect configuration in the driver, which prevented proper volume control on certain systems. Signed-off-by: Bou-Saan Che Signed-off-by: Takashi Iwai commit c1d31894d892a88454eee6530c99f3c4fcbc9397 Author: Bou-Saan Che Date: Sun Sep 14 22:17:38 2025 +0300 ALSA: hda/realtek: Support Lenovo Thinkbook 13x Gen 5 The laptop does not contain valid _DSD for these amps, so requires entries into the CS35L41 configuration table to function correctly. Signed-off-by: Bou-Saan Che Signed-off-by: Takashi Iwai commit f205ed23f0687ea8b14c140e0af9643eed683691 Author: Bou-Saan Che Date: Sun Sep 14 22:15:37 2025 +0300 ALSA: hda: cs35l41: Support Lenovo Thinkbook 13x Gen 5 This laptop does not contain _DSD so needs to be supported using the configuration table. Signed-off-by: Bou-Saan Che Signed-off-by: Takashi Iwai commit 19c839a98c731169f06d32e7c9e00c78a0086ebe Author: Sébastien Szymanski Date: Fri Sep 12 22:18:50 2025 +0200 gpiolib: acpi: initialize acpi_gpio_info struct Since commit 7c010d463372 ("gpiolib: acpi: Make sure we fill struct acpi_gpio_info"), uninitialized acpi_gpio_info struct are passed to __acpi_find_gpio() and later in the call stack info->quirks is used in acpi_populate_gpio_lookup. This breaks the i2c_hid_cpi driver: [ 58.122916] i2c_hid_acpi i2c-UNIW0001:00: HID over i2c has not been provided an Int IRQ [ 58.123097] i2c_hid_acpi i2c-UNIW0001:00: probe with driver i2c_hid_acpi failed with error -22 Fix this by initializing the acpi_gpio_info pass to __acpi_find_gpio() Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220388 Fixes: 7c010d463372 ("gpiolib: acpi: Make sure we fill struct acpi_gpio_info") Signed-off-by: Sébastien Szymanski Tested-by: Hans de Goede Reviewed-by: Hans de Goede Acked-by: Mika Westerberg Tested-By: Calvin Owens Cc: stable@vger.kernel.org Signed-off-by: Andy Shevchenko commit 9b5096761c184b3923ae45c5e82da31005a765c7 Author: Zhen Ni Date: Wed Sep 3 14:51:12 2025 +0800 rv: Fix missing mutex unlock in rv_register_monitor() If create_monitor_dir() fails, the function returns directly without releasing rv_interface_lock. This leaves the mutex locked and causes subsequent monitor registration attempts to deadlock. Fix it by making the error path jump to out_unlock, ensuring that the mutex is always released before returning. Fixes: 24cbfe18d55a ("rv: Merge struct rv_monitor_def into struct rv_monitor") Signed-off-by: Zhen Ni Reviewed-by: Gabriele Monaco Reviewed-by: Nam Cao Link: https://lore.kernel.org/r/20250903065112.1878330-1-zhen.ni@easystack.cn Signed-off-by: Gabriele Monaco commit 3afaff7a0ce97457c8ab46862f2c06603a89962e Author: Akhilesh Patil Date: Mon Aug 11 17:42:53 2025 +0530 include/linux/rv.h: remove redundant include file Remove redundant include to clean up the code. Move all unique include files inside CONFIG_RV as they are only needed when CONFIG_RV is enabled. Arrange include files alphabetically. Fixes: 24cbfe18d55a ("rv: Merge struct rv_monitor_def into struct rv_monitor") [1] Reported-by: kernel test robot Closes: https://lore.kernel.org/r/202507312017.oyD08TL5-lkp@intel.com/ Signed-off-by: Akhilesh Patil Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/aJneRbHGlNFg7lr9@bhairav-test.ee.iitb.ac.in Signed-off-by: Gabriele Monaco commit de090d1ccae1e191af4beb92964591c6e4f31f28 Author: Nam Cao Date: Wed Aug 6 14:09:11 2025 +0200 rv: Fix wrong type cast in enabled_monitors_next() Argument 'p' of enabled_monitors_next() is not a pointer to struct rv_monitor, it is actually a pointer to the list_head inside struct rv_monitor. Therefore it is wrong to cast 'p' to struct rv_monitor *. This wrong type cast has been there since the beginning. But it still worked because the list_head was the first field in struct rv_monitor_def. This is no longer true since commit 24cbfe18d55a ("rv: Merge struct rv_monitor_def into struct rv_monitor") moved the list_head, and this wrong type cast became a functional problem. Properly use container_of() instead. Fixes: 24cbfe18d55a ("rv: Merge struct rv_monitor_def into struct rv_monitor") Signed-off-by: Nam Cao Reviewed-by: Gabriele Monaco Link: https://lore.kernel.org/r/20250806120911.989365-1-namcao@linutronix.de Signed-off-by: Gabriele Monaco commit 03ee64b5e525c40e9bc723885c6b0b9c6188b55b Author: Palmer Dabbelt Date: Mon Aug 4 12:45:19 2025 -0700 rv: Support systems with time64-only syscalls Some systems (like 32-bit RISC-V) only have the 64-bit time_t versions of syscalls. So handle the 32-bit time_t version of those being undefined. Fixes: f74f8bb246cf ("rv: Add rtapp_sleep monitor") Closes: https://lore.kernel.org/oe-kbuild-all/202508160204.SsFyNfo6-lkp@intel.com Signed-off-by: Palmer Dabbelt Acked-by: Nam Cao Link: https://lore.kernel.org/r/20250804194518.97620-2-palmer@dabbelt.com Signed-off-by: Gabriele Monaco commit 80eb65ccf6f72dc37b972583fe71cd8a50ff7e51 Author: Filipe Manana Date: Mon Sep 8 12:51:11 2025 +0100 btrfs: annotate block group access with data_race() when sorting for reclaim When sorting the block group list for reclaim we are using a block group's used bytes counter without taking the block group's spinlock, so we can race with a concurrent task updating it (at btrfs_update_block_group()), which makes tools like KCSAN unhappy and report a race. Since the sorting is not strictly needed from a functional perspective and such races should rarely cause any ordering changes (only load/store tearing could cause them), not to mention that after the sorting the ordering may no longer be accurate due to concurrent allocations and deallocations of extents in a block group, annotate the accesses to the used counter with data_race() to silence KCSAN and similar tools. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8679d2687c351824d08cf1f0e86f3b65f22a00fe Author: austinchang Date: Thu Sep 11 06:06:29 2025 +0000 btrfs: initialize inode::file_extent_tree after i_mode has been set btrfs_init_file_extent_tree() uses S_ISREG() to determine if the file is a regular file. In the beginning of btrfs_read_locked_inode(), the i_mode hasn't been read from inode item, then file_extent_tree won't be used at all in volumes without NO_HOLES. Fix this by calling btrfs_init_file_extent_tree() after i_mode is initialized in btrfs_read_locked_inode(). Fixes: 3d7db6e8bd22e6 ("btrfs: don't allocate file extent tree for non regular files") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Filipe Manana Signed-off-by: austinchang Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 5b8d2964754102323ca24495ba94892426284e3a Author: Johannes Thumshirn Date: Fri Sep 5 15:54:43 2025 +0200 btrfs: zoned: fix incorrect ASSERT in btrfs_zoned_reserve_data_reloc_bg() When moving a block-group to the dedicated data relocation space-info in btrfs_zoned_reserve_data_reloc_bg() it is asserted that the newly created block group for data relocation does not contain any zone_unusable bytes. But on disks with zone_capacity < zone_size, the difference between zone_size and zone_capacity is accounted as zone_unusable. Instead of asserting that the block-group does not contain any zone_unusable bytes, remove them from the block-groups total size. Reported-by: Yi Zhang Link: https://lore.kernel.org/linux-block/CAHj4cs8-cS2E+-xQ-d2Bj6vMJZ+CwT_cbdWBTju4BV35LsvEYw@mail.gmail.com/ Fixes: daa0fde322350 ("btrfs: zoned: fix data relocation block group reservation") Reviewed-by: Naohiro Aota Tested-by: Yi Zhang Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit b62fd63ade7cb573b114972ef8f9fa505be8d74a Author: Filipe Manana Date: Wed Sep 3 16:53:21 2025 +0100 btrfs: fix invalid extref key setup when replaying dentry The offset for an extref item's key is not the object ID of the parent dir, otherwise we would not need the extref item and would use plain ref items. Instead the offset is the result of a hash computation that uses the object ID of the parent dir and the name associated to the entry. So fix this by setting the key offset at replay_one_name() to be the result of calling btrfs_extref_hash(). Fixes: 725af92a6251 ("btrfs: Open-code name_in_log_ref in replay_one_name") Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e1868ba37fd27c6a68e31565402b154beaa65df0 Author: Stefan Metzmacher Date: Thu Sep 11 10:05:23 2025 +0900 ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size This is inspired by the check for data_offset + data_length. Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: stable@vger.kernel.org Fixes: 2ea086e35c3d ("ksmbd: add buffer validation for smb direct") Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5282491fc49d5614ac6ddcd012e5743eecb6a67c Author: Namjae Jeon Date: Wed Sep 10 11:22:52 2025 +0900 ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer If data_offset and data_length of smb_direct_data_transfer struct are invalid, out of bounds issue could happen. This patch validate data_offset and data_length field in recv_done. Cc: stable@vger.kernel.org Fixes: 2ea086e35c3d ("ksmbd: add buffer validation for smb direct") Reviewed-by: Stefan Metzmacher Reported-by: Luigino Camastra, Aisle Research Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit d162694037215fe25f1487999c58d70df809a2fd Author: Stefan Metzmacher Date: Thu Sep 4 13:06:41 2025 +0200 smb: server: let smb_direct_writev() respect SMB_DIRECT_MAX_SEND_SGES We should not use more sges for ib_post_send() than we told the rdma device in rdma_create_qp()! Otherwise ib_post_send() will return -EINVAL, so we disconnect the connection. Or with the current siw.ko we'll get 0 from ib_post_send(), but will never ever get a completion for the request. I've already sent a fix for siw.ko... So we need to make sure smb_direct_writev() limits the number of vectors we pass to individual smb_direct_post_send_data() calls, so that we don't go over the queue pair limits. Commit 621433b7e25d ("ksmbd: smbd: relax the count of sges required") was very strange and I guess only needed because SMB_DIRECT_MAX_SEND_SGES was 8 at that time. It basically removed the check that the rdma device is able to handle the number of sges we try to use. While the real problem was added by commit ddbdc861e37c ("ksmbd: smbd: introduce read/write credits for RDMA read/write") as it used the minumun of device->attrs.max_send_sge and device->attrs.max_sge_rd, with the problem that device->attrs.max_sge_rd is always 1 for iWarp. And that limitation should only apply to RDMA Read operations. For now we keep that limitation for RDMA Write operations too, fixing that is a task for another day as it's not really required a bug fix. Commit 2b4eeeaa9061 ("ksmbd: decrease the number of SMB3 smbdirect server SGEs") lowered SMB_DIRECT_MAX_SEND_SGES to 6, which is also used by our client code. And that client code enforces device->attrs.max_send_sge >= 6 since commit d2e81f92e5b7 ("Decrease the number of SMB3 smbdirect client SGEs") and (briefly looking) only the i40w driver provides only 3, see I40IW_MAX_WQ_FRAGMENT_COUNT. But currently we'd require 4 anyway, so that would not work anyway, but now it fails early. Cc: Steve French Cc: Tom Talpey Cc: Hyunchul Lee Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Cc: linux-rdma@vger.kernel.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Fixes: ddbdc861e37c ("ksmbd: smbd: introduce read/write credits for RDMA read/write") Fixes: 621433b7e25d ("ksmbd: smbd: relax the count of sges required") Fixes: 2b4eeeaa9061 ("ksmbd: decrease the number of SMB3 smbdirect server SGEs") Acked-by: Namjae Jeon Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 2e5fb2ff31730786c05e0f18949143b05efa1212 Merge: 56c0a2a9ddc2f5 6cafb93c1f2aec Author: Jakub Kicinski Date: Sun Sep 14 14:28:14 2025 -0700 Merge branch 'net-dst_metadata-fix-df-flag-extraction-on-tunnel-rx' Ilya Maximets says: ==================== net: dst_metadata: fix DF flag extraction on tunnel rx Two patches here, first fixes the issue where tunnel core doesn't actually extract DF bit from the outer IP header, even though both OVS and TC flower allow matching on it. More details in the commit message. The second is a selftest for openvswitch that reproduces the issue, but also just adds some basic coverage for the tunnel metadata extraction and related openvswitch uAPI. ==================== Link: https://patch.msgid.link/20250909165440.229890-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 6cafb93c1f2aec7875f7a024a53e15f0683df699 Author: Ilya Maximets Date: Tue Sep 9 18:54:16 2025 +0200 selftests: openvswitch: add a simple test for tunnel metadata This test ensures that upon receiving decapsulated packets from a tunnel interface in openvswitch, the tunnel metadata fields are properly populated. This partially covers interoperability of the kernel tunnel ports and openvswitch tunnels (LWT) and parsing and formatting of the tunnel metadata fields of the openvswitch netlink uAPI. Doing so, this test also ensures that fields and flags are properly extracted during decapsulation by the tunnel core code, serving as a regression test for the previously fixed issue with the DF bit not being extracted from the outer IP header. The ovs-dpctl.py script already supports all that is necessary for the tunnel ports for this test, so we only need to adjust the ovs_add_if() function to pass the '-t' port type argument in order to be able to create tunnel ports in the openvswitch datapath. Reviewed-by: Aaron Conole Signed-off-by: Ilya Maximets Link: https://patch.msgid.link/20250909165440.229890-3-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit a9888628cb2c768202a4530e2816da1889cc3165 Author: Ilya Maximets Date: Tue Sep 9 18:54:15 2025 +0200 net: dst_metadata: fix IP_DF bit not extracted from tunnel headers Both OVS and TC flower allow extracting and matching on the DF bit of the outer IP header via OVS_TUNNEL_KEY_ATTR_DONT_FRAGMENT in the OVS_KEY_ATTR_TUNNEL and TCA_FLOWER_KEY_FLAGS_TUNNEL_DONT_FRAGMENT in the TCA_FLOWER_KEY_ENC_FLAGS respectively. Flow dissector extracts this information as FLOW_DIS_F_TUNNEL_DONT_FRAGMENT from the tunnel info key. However, the IP_TUNNEL_DONT_FRAGMENT_BIT in the tunnel key is never actually set, because the tunneling code doesn't actually extract it from the IP header. OAM and CRIT_OPT are extracted by the tunnel implementation code, same code also sets the KEY flag, if present. UDP tunnel core takes care of setting the CSUM flag if the checksum is present in the UDP header, but the DONT_FRAGMENT is not handled at any layer. Fix that by checking the bit and setting the corresponding flag while populating the tunnel info in the IP layer where it belongs. Not using __assign_bit as we don't really need to clear the bit in a just initialized field. It also doesn't seem like using __assign_bit will make the code look better. Clearly, users didn't rely on this functionality for anything very important until now. The reason why this doesn't break OVS logic is that it only matches on what kernel previously parsed out and if kernel consistently reports this bit as zero, OVS will only match on it to be zero, which sort of works. But it is still a bug that the uAPI reports and allows matching on the field that is not actually checked in the packet. And this is causing misleading -df reporting in OVS datapath flows, while the tunnel traffic actually has the bit set in most cases. This may also cause issues if a hardware properly implements support for tunnel flag matching as it will disagree with the implementation in a software path of TC flower. Fixes: 7d5437c709de ("openvswitch: Add tunneling interface.") Fixes: 1d17568e74de ("net/sched: cls_flower: add support for matching tunnel control flags") Signed-off-by: Ilya Maximets Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20250909165440.229890-2-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 56c0a2a9ddc2f5b5078c5fb0f81ab76bbc3d4c37 Author: Jamie Bainbridge Date: Wed Sep 10 16:29:16 2025 +1000 qed: Don't collect too many protection override GRC elements In the protection override dump path, the firmware can return far too many GRC elements, resulting in attempting to write past the end of the previously-kmalloc'ed dump buffer. This will result in a kernel panic with reason: BUG: unable to handle kernel paging request at ADDRESS where "ADDRESS" is just past the end of the protection override dump buffer. The start address of the buffer is: p_hwfn->cdev->dbg_features[DBG_FEATURE_PROTECTION_OVERRIDE].dump_buf and the size of the buffer is buf_size in the same data structure. The panic can be arrived at from either the qede Ethernet driver path: [exception RIP: qed_grc_dump_addr_range+0x108] qed_protection_override_dump at ffffffffc02662ed [qed] qed_dbg_protection_override_dump at ffffffffc0267792 [qed] qed_dbg_feature at ffffffffc026aa8f [qed] qed_dbg_all_data at ffffffffc026b211 [qed] qed_fw_fatal_reporter_dump at ffffffffc027298a [qed] devlink_health_do_dump at ffffffff82497f61 devlink_health_report at ffffffff8249cf29 qed_report_fatal_error at ffffffffc0272baf [qed] qede_sp_task at ffffffffc045ed32 [qede] process_one_work at ffffffff81d19783 or the qedf storage driver path: [exception RIP: qed_grc_dump_addr_range+0x108] qed_protection_override_dump at ffffffffc068b2ed [qed] qed_dbg_protection_override_dump at ffffffffc068c792 [qed] qed_dbg_feature at ffffffffc068fa8f [qed] qed_dbg_all_data at ffffffffc0690211 [qed] qed_fw_fatal_reporter_dump at ffffffffc069798a [qed] devlink_health_do_dump at ffffffff8aa95e51 devlink_health_report at ffffffff8aa9ae19 qed_report_fatal_error at ffffffffc0697baf [qed] qed_hw_err_notify at ffffffffc06d32d7 [qed] qed_spq_post at ffffffffc06b1011 [qed] qed_fcoe_destroy_conn at ffffffffc06b2e91 [qed] qedf_cleanup_fcport at ffffffffc05e7597 [qedf] qedf_rport_event_handler at ffffffffc05e7bf7 [qedf] fc_rport_work at ffffffffc02da715 [libfc] process_one_work at ffffffff8a319663 Resolve this by clamping the firmware's return value to the maximum number of legal elements the firmware should return. Fixes: d52c89f120de8 ("qed*: Utilize FW 8.37.2.0") Signed-off-by: Jamie Bainbridge Link: https://patch.msgid.link/f8e1182934aa274c18d0682a12dbaf347595469c.1757485536.git.jamie.bainbridge@gmail.com Signed-off-by: Jakub Kicinski commit f83ec76bf285bea5727f478a68b894f5543ca76e Author: Linus Torvalds Date: Sun Sep 14 14:21:14 2025 -0700 Linux 6.17-rc6 commit 79e8447ec66289745d1b38679b16dd6c654ff578 Merge: 0676181a87540f 6cb8c1f957f674 Author: Linus Torvalds Date: Sun Sep 14 13:17:30 2025 -0700 Merge tag 'phy-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull generic phy driver fixes from Vinod Koul: - Qualcomm repeater override properties, qmp pcie bindings fix for clocks and initialization sequence for firmware power down case - Marvell comphy bindings clock and child node constraints - Tegra xusb device reference leaks fix - TI omap usb device ref leak on unbind and RGMII IS settings fix * tag 'phy-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: phy: qcom: qmp-pcie: Fix PHY initialization when powered down by firmware phy: ti: gmii-sel: Always write the RGMII ID setting dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Update pcie phy bindings phy: ti-pipe3: fix device leak at unbind phy: ti: omap-usb2: fix device leak at unbind phy: tegra: xusb: fix device and OF node leak at probe dt-bindings: phy: marvell,comphy-cp110: Fix clock and child node constraints phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties commit af82e857df5dd883a4867bcaf5dde041e57a4e33 Author: Kamal Heib Date: Thu Sep 11 18:36:10 2025 -0400 octeon_ep: Validate the VF ID Add a helper to validate the VF ID and use it in the VF ndo ops to prevent accessing out-of-range entries. Without this check, users can run commands such as: # ip link show dev enp135s0 2: enp135s0: mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 link/ether 00:00:00:01:01:00 brd ff:ff:ff:ff:ff:ff vf 0 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state enable, trust off vf 1 link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff, spoof checking on, link-state enable, trust off # ip link set dev enp135s0 vf 4 mac 00:00:00:00:00:14 # echo $? 0 even though VF 4 does not exist, which results in silent success instead of returning an error. Fixes: 8a241ef9b9b8 ("octeon_ep: add ndo ops for VFs in PF driver") Signed-off-by: Kamal Heib Reviewed-by: Michal Swiatkowski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250911223610.1803144-1-kheib@redhat.com Signed-off-by: Jakub Kicinski commit 0676181a87540fa2aabc8920dc30bca5071b8f1a Merge: 1519fc7cd3e129 aa2e1e4563d3ab Author: Linus Torvalds Date: Sun Sep 14 13:06:06 2025 -0700 Merge tag 'dmaengine-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine fixes from Vinod Koul: - Intel idxd fixes for idxd_free() handling, refcount underflow on module unload, double free in idxd_setup_wqs() - Qualcomm bam dma missing properties and handing for channels with ees - dw device reference leak in rzn1_dmamux_route_allocate() * tag 'dmaengine-fix-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate dmaengine: ti: edma: Fix memory allocation size for queue_priority_map dmaengine: idxd: Fix double free in idxd_setup_wqs() dmaengine: idxd: Fix refcount underflow on module unload dmaengine: idxd: Remove improper idxd_free dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees dt-bindings: dma: qcom: bam-dma: Add missing required properties commit 2429a197648178cd4dc930a9d87c13c547460564 Author: David Howells Date: Fri Sep 12 00:06:17 2025 +0100 rxrpc: Fix untrusted unsigned subtract Fix the following Smatch static checker warning: net/rxrpc/rxgk_app.c:65 rxgk_yfs_decode_ticket() warn: untrusted unsigned subtract. 'ticket_len - 10 * 4' by prechecking the length of what we're trying to extract in two places in the token and decoding for a response packet. Also use sizeof() on the struct we're extracting rather specifying the size numerically to be consistent with the other related statements. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") Reported-by: Dan Carpenter Closes: https://lists.infradead.org/pipermail/linux-afs/2025-September/010135.html Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Reviewed-by: Simon Horman Link: https://patch.msgid.link/2039268.1757631977@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit 64863f4ca4945bdb62ce2b30823f39ea9fe95415 Author: David Howells Date: Thu Sep 11 23:58:16 2025 +0100 rxrpc: Fix unhandled errors in rxgk_verify_packet_integrity() rxgk_verify_packet_integrity() may get more errors than just -EPROTO from rxgk_verify_mic_skb(). Pretty much anything other than -ENOMEM constitutes an unrecoverable error. In the case of -ENOMEM, we can just drop the packet and wait for a retransmission. Similar happens with rxgk_decrypt_skb() and its callers. Fix rxgk_decrypt_skb() or rxgk_verify_mic_skb() to return a greater variety of abort codes and fix their callers to abort the connection on any error apart from -ENOMEM. Also preclear the variables used to hold the abort code returned from rxgk_decrypt_skb() or rxgk_verify_mic_skb() to eliminate uninitialised variable warnings. Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)") Reported-by: Dan Carpenter Closes: https://lists.infradead.org/pipermail/linux-afs/2025-April/009739.html Closes: https://lists.infradead.org/pipermail/linux-afs/2025-April/009740.html Signed-off-by: David Howells cc: Marc Dionne cc: linux-afs@lists.infradead.org Reviewed-by: Simon Horman Link: https://patch.msgid.link/2038804.1757631496@warthog.procyon.org.uk Signed-off-by: Jakub Kicinski commit 70d99623d5c11e1a9bcc564b8fbad6fa916913d8 Author: Ivan Vecera Date: Fri Sep 12 11:33:31 2025 +0200 dpll: fix clock quality level reporting The DPLL_CLOCK_QUALITY_LEVEL_ITU_OPT1_EPRC is not reported via netlink due to bug in dpll_msg_add_clock_quality_level(). The usage of DPLL_CLOCK_QUALITY_LEVEL_MAX for both DECLARE_BITMAP() and for_each_set_bit() is not correct because these macros requires bitmap size and not the highest valid bit in the bitmap. Use correct bitmap size to fix this issue. Fixes: a1afb959add1 ("dpll: add clock quality level attribute and op") Signed-off-by: Ivan Vecera Reviewed-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20250912093331.862333-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 2e7bba08923ebc675b1f0e0e0959e68e53047838 Author: Anderson Nascimento Date: Thu Sep 11 20:07:44 2025 -0300 net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR A NULL pointer dereference can occur in tcp_ao_finish_connect() during a connect() system call on a socket with a TCP-AO key added and TCP_REPAIR enabled. The function is called with skb being NULL and attempts to dereference it on tcp_hdr(skb)->seq without a prior skb validation. Fix this by checking if skb is NULL before dereferencing it. The commentary is taken from bpf_skops_established(), which is also called in the same flow. Unlike the function being patched, bpf_skops_established() validates the skb before dereferencing it. int main(void){ struct sockaddr_in sockaddr; struct tcp_ao_add tcp_ao; int sk; int one = 1; memset(&sockaddr,'\0',sizeof(sockaddr)); memset(&tcp_ao,'\0',sizeof(tcp_ao)); sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP); sockaddr.sin_family = AF_INET; memcpy(tcp_ao.alg_name,"cmac(aes128)",12); memcpy(tcp_ao.key,"ABCDEFGHABCDEFGH",16); tcp_ao.keylen = 16; memcpy(&tcp_ao.addr,&sockaddr,sizeof(sockaddr)); setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tcp_ao, sizeof(tcp_ao)); setsockopt(sk, IPPROTO_TCP, TCP_REPAIR, &one, sizeof(one)); sockaddr.sin_family = AF_INET; sockaddr.sin_port = htobe16(123); inet_aton("127.0.0.1", &sockaddr.sin_addr); connect(sk,(struct sockaddr *)&sockaddr,sizeof(sockaddr)); return 0; } $ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall $ unshare -Urn BUG: kernel NULL pointer dereference, address: 00000000000000b6 PGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0 Oops: Oops: 0000 [#1] SMP NOPTI Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 RIP: 0010:tcp_ao_finish_connect (net/ipv4/tcp_ao.c:1182) Fixes: 7c2ffaf21bd6 ("net/tcp: Calculate TCP-AO traffic keys") Signed-off-by: Anderson Nascimento Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com> Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250911230743.2551-3-anderson@allelesecurity.com Signed-off-by: Jakub Kicinski commit 1519fc7cd3e129f6a95143cdc92f01ba21a3c266 Merge: d6b42787f30d86 b5e3277c0f1c34 Author: Linus Torvalds Date: Sun Sep 14 10:54:54 2025 -0700 Merge tag 'tty-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty/serial fixes from Greg KH: "Here are some small tty and serial driver fixes for 6.17-rc6 that resolve some reported problems. Included in here are: - 8250 driver dt bindings fixes - broadcom serial driver binding fixes - hvc_console bugfix - xilinx serial driver bugfix - sc16is7xx serial driver bugfix All of these have been in linux-next for the past week with no reported issues" * tag 'tty-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: serial: xilinx_uartps: read reg size from DTS tty: hvc_console: Call hvc_kick in hvc_write unconditionally dt-bindings: serial: 8250: allow "main" and "uart" as clock names dt-bindings: serial: 8250: move a constraint dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks serial: sc16is7xx: fix bug in flow control levels init commit d6b42787f30d86ef3aa5313c8a43c0b228d1f11b Merge: df86f912b45c20 9dfec4a51df9cf Author: Linus Torvalds Date: Sun Sep 14 10:28:15 2025 -0700 Merge tag 'usb-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB driver fixes and new device ids for 6.17-rc6. Included in here are: - new usb-serial driver device ids - dummy-hcd locking bugfix for rt-enabled systems (which is crazy, but people have odd testing requirements at times...) - xhci driver bugfixes for reported issues - typec driver bugfix - midi2 gadget driver bugfixes - usb core sysfs file regression fix from -rc1 All of these, except for the last usb sysfs file fix, have been in linux-next with no reported issues. The sysfs fix was added to the tree on Friday, and is "obviously correct" and should not have any problems either, it just didn't have any time for linux-next to pick up (0-day had no problems with it)" * tag 'usb-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: USB: core: remove the move buf action usb: gadget: midi2: Fix MIDI2 IN EP max packet size usb: gadget: midi2: Fix missing UMP group attributes initialization usb: typec: tcpm: properly deliver cable vdms to altmode drivers USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels xhci: fix memory leak regression when freeing xhci vdev devices depth first xhci: dbc: Fix full DbC transfer ring after several reconnects xhci: dbc: decouple endpoint allocation from initialization USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions USB: serial: option: add Telit Cinterion FN990A w/audio compositions commit df86f912b45c20e236060321c85fe35437e9325d Merge: 8378c891726df0 d2e1b84c5141ff Author: Linus Torvalds Date: Sun Sep 14 08:39:48 2025 -0700 Merge tag 'x86-urgent-2025-09-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: "Fix a CPU topology parsing bug on AMD guests, and address a lockdep warning in the resctrl filesystem" * tag 'x86-urgent-2025-09-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: fs/resctrl: Eliminate false positive lockdep warning when reading SNC counters x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon commit 8378c891726df0ec78dfcd94160c9b1b428e9f4d Merge: 563b3f6ef52189 e895f8e29119c8 Author: Linus Torvalds Date: Sun Sep 14 08:38:05 2025 -0700 Merge tag 'timers-urgent-2025-09-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix a lost-timeout CPU hotplug bug in the hrtimer code, which can trigger with certain hardware configs and regular HZ" * tag 'timers-urgent-2025-09-14' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: hrtimers: Unconditionally update target CPU base after offline timer migration commit 563b3f6ef521895045117055bf3ee08fbe27a8a7 Merge: f83a4f2a4d8c48 30989f67650cbf Author: Linus Torvalds Date: Sun Sep 14 08:09:37 2025 -0700 Merge tag 'input-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input fixes from Dmitry Torokhov: - a quirk to i8042 for yet another TUXEDO laptop - a fix to mtk-pmic-keys driver to properly handle MT6359 - a fix to iqs7222 driver to only enable proximity interrupt if it is mapped to a key or a switch event - an update to xpad controller driver to recognize Flydigi Apex 5 controller - an update to maintainers file to drop bounding entry for Melfas touch controller * tag 'input-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: MAINTAINERS: Input: Drop melfas-mip4 section Input: mtk-pmic-keys - MT6359 has a specific release irq Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table Input: iqs7222 - avoid enabling unused interrupts Input: xpad - add support for Flydigi Apex 5 commit ec8f26092e525ee3cb1a56d455109fd40bfff3ef Author: Donald Menig Date: Sun Sep 14 09:43:33 2025 +0200 ALSA: hda/realtek: Add ALC295 Dell TAS2781 I2C fixup This patch adds a new fixup for the ALC295 codec on some Dell laptops that use the TAS2781 I2C amplifier. The fixup correctly initializes the amplifier and pins, allowing sound to work on all speakers of these devices. The fixup chain is added to the relevant quirk entries for Dell Polaris models. [ adjusted for 6.17 kernel code by tiwai ] Fixes: 1e9c708dc3ae ("ALSA: hda/tas2781: Add new quirk for Lenovo, ASUS, Dell projects") Link: https://bugzilla.suse.com/show_bug.cgi?id=1249575 Signed-off-by: Donald Menig Signed-off-by: Takashi Iwai commit 30989f67650cbf8dc763f7c22e3a210f70a8d7d0 Author: Krzysztof Kozlowski Date: Wed Sep 10 16:25:27 2025 +0200 MAINTAINERS: Input: Drop melfas-mip4 section Emails to the sole melfas-mip4 driver maintainer bounce: 550 No such user here (connected from melfas.com) so clearly this is not a supported driver anymore. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250910142526.105286-2-krzysztof.kozlowski@linaro.org Signed-off-by: Dmitry Torokhov commit f83a4f2a4d8c485922fba3018a64fc8f4cfd315f Merge: 5cd64d4f92683a 1fcf686def1906 Author: Linus Torvalds Date: Sat Sep 13 17:16:52 2025 -0700 Merge tag 'erofs-for-6.17-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Fix invalid algorithm dereference in encoded extents - Add missing dax_break_layout_final(), since recent FSDAX fixes didn't cover EROFS - Arrange long xattr name prefixes more properly * tag 'erofs-for-6.17-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix long xattr name prefix placement erofs: fix runtime warning on truncate_folio_batch_exceptionals() erofs: fix invalid algorithm for encoded extents commit 6d8042baa80c993cfdc6795384f32e37213b2ec9 Merge: 8f5ae30d69d754 f63aaf6e71de89 Author: Stephen Boyd Date: Sat Sep 13 14:31:20 2025 -0700 Merge tag 'renesas-clk-fixes-for-v6.17-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-fixes Pull a Renesas clk driver fix from Geert Uytterhoeven: - Fix a Clock Domain regression on R-Car M1A, R-Car H1, and RZ/A1 * tag 'renesas-clk-fixes-for-v6.17-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: clk: renesas: mstp: Add genpd OF provider at postcore_initcall() commit 025e87f8ea2ae3a28bf1fe2b052bfa412c27ed4a Author: Nathan Chancellor Date: Sat Sep 6 23:43:34 2025 +0900 nilfs2: fix CFI failure when accessing /sys/fs/nilfs2/features/* When accessing one of the files under /sys/fs/nilfs2/features when CONFIG_CFI_CLANG is enabled, there is a CFI violation: CFI failure at kobj_attr_show+0x59/0x80 (target: nilfs_feature_revision_show+0x0/0x30; expected type: 0xfc392c4d) ... Call Trace: sysfs_kf_seq_show+0x2a6/0x390 ? __cfi_kobj_attr_show+0x10/0x10 kernfs_seq_show+0x104/0x15b seq_read_iter+0x580/0xe2b ... When the kobject of the kset for /sys/fs/nilfs2 is initialized, its ktype is set to kset_ktype, which has a ->sysfs_ops of kobj_sysfs_ops. When nilfs_feature_attr_group is added to that kobject via sysfs_create_group(), the kernfs_ops of each files is sysfs_file_kfops_rw, which will call sysfs_kf_seq_show() when ->seq_show() is called. sysfs_kf_seq_show() in turn calls kobj_attr_show() through ->sysfs_ops->show(). kobj_attr_show() casts the provided attribute out to a 'struct kobj_attribute' via container_of() and calls ->show(), resulting in the CFI violation since neither nilfs_feature_revision_show() nor nilfs_feature_README_show() match the prototype of ->show() in 'struct kobj_attribute'. Resolve the CFI violation by adjusting the second parameter in nilfs_feature_{revision,README}_show() from 'struct attribute' to 'struct kobj_attribute' to match the expected prototype. Link: https://lkml.kernel.org/r/20250906144410.22511-1-konishi.ryusuke@gmail.com Fixes: aebe17f68444 ("nilfs2: add /sys/fs/nilfs2/features group") Signed-off-by: Nathan Chancellor Signed-off-by: Ryusuke Konishi Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202509021646.bc78d9ef-lkp@intel.com/ Cc: Signed-off-by: Andrew Morton commit c62cff40481c037307a13becbda795f7afdcfebd Author: SeongJae Park Date: Mon Sep 8 19:22:38 2025 -0700 samples/damon/mtier: avoid starting DAMON before initialization Commit 964314344eab ("samples/damon/mtier: support boot time enable setup") is somehow incompletely applying the origin patch [1]. It is missing the part that avoids starting DAMON before module initialization. Probably a mistake during a merge has happened. Fix it by applying the missed part again. Link: https://lkml.kernel.org/r/20250909022238.2989-4-sj@kernel.org Link: https://lore.kernel.org/20250706193207.39810-4-sj@kernel.org [1] Fixes: 964314344eab ("samples/damon/mtier: support boot time enable setup") Signed-off-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit e6b733ca2f99e968d696c2e812c8eb8e090bf37b Author: SeongJae Park Date: Mon Sep 8 19:22:37 2025 -0700 samples/damon/prcl: avoid starting DAMON before initialization Commit 2780505ec2b4 ("samples/damon/prcl: fix boot time enable crash") is somehow incompletely applying the origin patch [1]. It is missing the part that avoids starting DAMON before module initialization. Probably a mistake during a merge has happened. Fix it by applying the missed part again. Link: https://lkml.kernel.org/r/20250909022238.2989-3-sj@kernel.org Link: https://lore.kernel.org/20250706193207.39810-3-sj@kernel.org [1] Fixes: 2780505ec2b4 ("samples/damon/prcl: fix boot time enable crash") Signed-off-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit f826edeb888c5a8bd1b6e95ae6a50b0db2b21902 Author: SeongJae Park Date: Mon Sep 8 19:22:36 2025 -0700 samples/damon/wsse: avoid starting DAMON before initialization Patch series "samples/damon: fix boot time enable handling fixup merge mistakes". First three patches of the patch series "mm/damon: fix misc bugs in DAMON modules" [1] were trying to fix boot time DAMON sample modules enabling issues. The issues are the modules can crash if those are enabled before DAMON is enabled, like using boot time parameter options. The three patches were fixing the issues by avoiding starting DAMON before the module initialization phase. However, probably by a mistake during a merge, only half of the change is merged, and the part for avoiding the starting of DAMON before the module initialized is missed. So the problem is not solved and thus the modules can still crash if enabled before DAMON is initialized. Fix those by applying the unmerged parts again. Note that the broken commits are merged into 6.17-rc1, but also backported to relevant stable kernels. So this series also needs to be merged into the stable kernels. Hence Cc-ing stable@. This patch (of 3): Commit 0ed1165c3727 ("samples/damon/wsse: fix boot time enable handling") is somehow incompletely applying the origin patch [2]. It is missing the part that avoids starting DAMON before module initialization. Probably a mistake during a merge has happened. Fix it by applying the missed part again. Link: https://lkml.kernel.org/r/20250909022238.2989-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250909022238.2989-2-sj@kernel.org Link: https://lkml.kernel.org/r/20250706193207.39810-1-sj@kernel.org [1] Link: https://lore.kernel.org/20250706193207.39810-2-sj@kernel.org [2] Fixes: 0ed1165c3727 ("samples/damon/wsse: fix boot time enable handling") Signed-off-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit 72291a5a0ead8686e3cbfd35baa7d7b1cfdbf6ea Author: Lance Yang Date: Mon Sep 8 18:48:57 2025 +0800 MAINTAINERS: add Lance Yang as a THP reviewer I've been actively digging into the MM/THP subsystem for over a year now, and there's a real interest in contributing more and getting further involved. Well, missing out on any more cool THP things is really a pain ;) Link: https://lkml.kernel.org/r/20250908104857.35397-1-lance.yang@linux.dev Signed-off-by: Lance Yang Acked-by: David Hildenbrand Acked-by: Lorenzo Stoakes Acked-by: Zi Yan Acked-by: Barry Song Acked-by: Baolin Wang Cc: Liam R. Howlett Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Signed-off-by: Andrew Morton commit 615cd3705d204680f4ae8d0ad0dec8b778dc2753 Author: Lorenzo Stoakes Date: Mon Sep 8 20:49:59 2025 +0100 MAINTAINERS: add Jann Horn as rmap reviewer Jann has been an excellent contributor in all areas of memory management, and has demonstrated great expertise in the reverse mapping. It's therefore appropriate for him to become a reviewer. Link: https://lkml.kernel.org/r/20250908194959.820913-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Harry Yoo Acked-by: SeongJae Park Acked-by: Vlastimil Babka Acked-by: Liam R. Howlett Cc: Jann Horn Cc: Rik van Riel Signed-off-by: Andrew Morton commit 04a06b139ec08aa63d7377f6d3e5218f8ddb1c5d Author: SeongJae Park Date: Mon Sep 8 13:15:13 2025 -0700 mm/damon/sysfs: use dynamically allocated repeat mode damon_call_control DAMON sysfs interface is using a single global repeat mode damon_call_control variable for refresh_ms handling, for all DAMON contexts. As a result, when there are more than one context, the single global damon_call_control is unexpectedly over-written (corrupted). Particularly the ->link field is overwritten by the multiple contexts and this can cause a user hangup, and/or a kernel crash. Fix it by using dynamically allocated damon_call_control object per DAMON context. Link: https://lkml.kernel.org/r/20250908201513.60802-3-sj@kernel.org Link: https://lore.kernel.org/20250904011738.930-1-yunjeong.mun@sk.com [1] Link: https://lore.kernel.org/20250905035411.39501-1-sj@kernel.org [2] Fixes: d809a7c64ba8 ("mm/damon/sysfs: implement refresh_ms file internal work") Signed-off-by: SeongJae Park Reported-by: Yunjeong Mun Closes: https://lore.kernel.org/20250904011738.930-1-yunjeong.mun@sk.com Signed-off-by: Andrew Morton commit e6a0deb6fa5b0fc134ee2aa127d1cfc9456d8445 Author: SeongJae Park Date: Mon Sep 8 13:15:12 2025 -0700 mm/damon/core: introduce damon_call_control->dealloc_on_cancel Patch series "mm/damon/sysfs: fix refresh_ms control overwriting on multi-kdamonds usages". Automatic esssential DAMON/DAMOS status update feature of DAMON sysfs interface (refresh_ms) is broken [1] for multiple DAMON contexts (kdamonds) use case, since it uses a global single damon_call_control object for all created DAMON contexts. The fields of the object, particularly the list field is over-written for the contexts and it makes unexpected results including user-space hangup and kernel crashes [2]. Fix it by extending damon_call_control for the use case and updating the usage on DAMON sysfs interface to use per-context dynamically allocated damon_call_control object. This patch (of 2): When damon_call_control->repeat is set, damon_call() is executed asynchronously, and is eventually canceled when kdamond finishes. If the damon_call_control object is dynamically allocated, finding the place to deallocate the object is difficult. Introduce a new damon_call_control field, namely dealloc_on_cancel, to ask the kdamond deallocates those dynamically allocated objects when those are canceled. Link: https://lkml.kernel.org/r/20250908201513.60802-3-sj@kernel.org Link: https://lkml.kernel.org/r/20250908201513.60802-2-sj@kernel.org Fixes: d809a7c64ba8 ("mm/damon/sysfs: implement refresh_ms file internal work") Signed-off-by: SeongJae Park Cc: Yunjeong Mun Signed-off-by: Andrew Morton commit 2da6de30e60dd9bb14600eff1cc99df2fa2ddae3 Author: Hugh Dickins Date: Mon Sep 8 15:23:15 2025 -0700 mm: folio_may_be_lru_cached() unless folio_test_large() mm/swap.c and mm/mlock.c agree to drain any per-CPU batch as soon as a large folio is added: so collect_longterm_unpinnable_folios() just wastes effort when calling lru_add_drain[_all]() on a large folio. But although there is good reason not to batch up PMD-sized folios, we might well benefit from batching a small number of low-order mTHPs (though unclear how that "small number" limitation will be implemented). So ask if folio_may_be_lru_cached() rather than !folio_test_large(), to insulate those particular checks from future change. Name preferred to "folio_is_batchable" because large folios can well be put on a batch: it's just the per-CPU LRU caches, drained much later, which need care. Marked for stable, to counter the increase in lru_add_drain_all()s from "mm/gup: check ref_count instead of lru before migration". Link: https://lkml.kernel.org/r/57d2eaf8-3607-f318-e0c5-be02dce61ad0@google.com Fixes: 9a4e9f3b2d73 ("mm: update get_user_pages_longterm to migrate pages allocated from CMA region") Signed-off-by: Hugh Dickins Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: "Aneesh Kumar K.V" Cc: Axel Rasmussen Cc: Chris Li Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Johannes Weiner Cc: John Hubbard Cc: Keir Fraser Cc: Konstantin Khlebnikov Cc: Li Zhe Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Rik van Riel Cc: Shivank Garg Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: yangge Cc: Yuanchu Xie Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit 8d79ed36bfc83d0583ab72216b7980340478cdfb Author: Hugh Dickins Date: Mon Sep 8 15:21:12 2025 -0700 mm: revert "mm: vmscan.c: fix OOM on swap stress test" This reverts commit 0885ef470560: that was a fix to the reverted 33dfe9204f29b415bbc0abb1a50642d1ba94f5e9. Link: https://lkml.kernel.org/r/aa0e9d67-fbcd-9d79-88a1-641dfbe1d9d1@google.com Signed-off-by: Hugh Dickins Acked-by: David Hildenbrand Cc: "Aneesh Kumar K.V" Cc: Axel Rasmussen Cc: Chris Li Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Johannes Weiner Cc: John Hubbard Cc: Keir Fraser Cc: Konstantin Khlebnikov Cc: Li Zhe Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Rik van Riel Cc: Shivank Garg Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: yangge Cc: Yuanchu Xie Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit afb99e9f500485160f34b8cad6d3763ada3e80e8 Author: Hugh Dickins Date: Mon Sep 8 15:19:17 2025 -0700 mm: revert "mm/gup: clear the LRU flag of a page before adding to LRU batch" This reverts commit 33dfe9204f29: now that collect_longterm_unpinnable_folios() is checking ref_count instead of lru, and mlock/munlock do not participate in the revised LRU flag clearing, those changes are misleading, and enlarge the window during which mlock/munlock may miss an mlock_count update. It is possible (I'd hesitate to claim probable) that the greater likelihood of missed mlock_count updates would explain the "Realtime threads delayed due to kcompactd0" observed on 6.12 in the Link below. If that is the case, this reversion will help; but a complete solution needs also a further patch, beyond the scope of this series. Included some 80-column cleanup around folio_batch_add_and_move(). The role of folio_test_clear_lru() (before taking per-memcg lru_lock) is questionable since 6.13 removed mem_cgroup_move_account() etc; but perhaps there are still some races which need it - not examined here. Link: https://lore.kernel.org/linux-mm/DU0PR01MB10385345F7153F334100981888259A@DU0PR01MB10385.eurprd01.prod.exchangelabs.com/ Link: https://lkml.kernel.org/r/05905d7b-ed14-68b1-79d8-bdec30367eba@google.com Signed-off-by: Hugh Dickins Acked-by: David Hildenbrand Cc: "Aneesh Kumar K.V" Cc: Axel Rasmussen Cc: Chris Li Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Johannes Weiner Cc: John Hubbard Cc: Keir Fraser Cc: Konstantin Khlebnikov Cc: Li Zhe Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Rik van Riel Cc: Shivank Garg Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: yangge Cc: Yuanchu Xie Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit a09a8a1fbb374e0053b97306da9dbc05bd384685 Author: Hugh Dickins Date: Mon Sep 8 15:16:53 2025 -0700 mm/gup: local lru_add_drain() to avoid lru_add_drain_all() In many cases, if collect_longterm_unpinnable_folios() does need to drain the LRU cache to release a reference, the cache in question is on this same CPU, and much more efficiently drained by a preliminary local lru_add_drain(), than the later cross-CPU lru_add_drain_all(). Marked for stable, to counter the increase in lru_add_drain_all()s from "mm/gup: check ref_count instead of lru before migration". Note for clean backports: can take 6.16 commit a03db236aebf ("gup: optimize longterm pin_user_pages() for large folio") first. Link: https://lkml.kernel.org/r/66f2751f-283e-816d-9530-765db7edc465@google.com Signed-off-by: Hugh Dickins Acked-by: David Hildenbrand Cc: "Aneesh Kumar K.V" Cc: Axel Rasmussen Cc: Chris Li Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Johannes Weiner Cc: John Hubbard Cc: Keir Fraser Cc: Konstantin Khlebnikov Cc: Li Zhe Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Rik van Riel Cc: Shivank Garg Cc: Vlastimil Babka Cc: Wei Xu Cc: Will Deacon Cc: yangge Cc: Yuanchu Xie Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit 98c6d259319ecf6e8d027abd3f14b81324b8c0ad Author: Hugh Dickins Date: Mon Sep 8 15:15:03 2025 -0700 mm/gup: check ref_count instead of lru before migration Patch series "mm: better GUP pin lru_add_drain_all()", v2. Series of lru_add_drain_all()-related patches, arising from recent mm/gup migration report from Will Deacon. This patch (of 5): Will Deacon reports:- When taking a longterm GUP pin via pin_user_pages(), __gup_longterm_locked() tries to migrate target folios that should not be longterm pinned, for example because they reside in a CMA region or movable zone. This is done by first pinning all of the target folios anyway, collecting all of the longterm-unpinnable target folios into a list, dropping the pins that were just taken and finally handing the list off to migrate_pages() for the actual migration. It is critically important that no unexpected references are held on the folios being migrated, otherwise the migration will fail and pin_user_pages() will return -ENOMEM to its caller. Unfortunately, it is relatively easy to observe migration failures when running pKVM (which uses pin_user_pages() on crosvm's virtual address space to resolve stage-2 page faults from the guest) on a 6.15-based Pixel 6 device and this results in the VM terminating prematurely. In the failure case, 'crosvm' has called mlock(MLOCK_ONFAULT) on its mapping of guest memory prior to the pinning. Subsequently, when pin_user_pages() walks the page-table, the relevant 'pte' is not present and so the faulting logic allocates a new folio, mlocks it with mlock_folio() and maps it in the page-table. Since commit 2fbb0c10d1e8 ("mm/munlock: mlock_page() munlock_page() batch by pagevec"), mlock/munlock operations on a folio (formerly page), are deferred. For example, mlock_folio() takes an additional reference on the target folio before placing it into a per-cpu 'folio_batch' for later processing by mlock_folio_batch(), which drops the refcount once the operation is complete. Processing of the batches is coupled with the LRU batch logic and can be forcefully drained with lru_add_drain_all() but as long as a folio remains unprocessed on the batch, its refcount will be elevated. This deferred batching therefore interacts poorly with the pKVM pinning scenario as we can find ourselves in a situation where the migration code fails to migrate a folio due to the elevated refcount from the pending mlock operation. Hugh Dickins adds:- !folio_test_lru() has never been a very reliable way to tell if an lru_add_drain_all() is worth calling, to remove LRU cache references to make the folio migratable: the LRU flag may be set even while the folio is held with an extra reference in a per-CPU LRU cache. 5.18 commit 2fbb0c10d1e8 may have made it more unreliable. Then 6.11 commit 33dfe9204f29 ("mm/gup: clear the LRU flag of a page before adding to LRU batch") tried to make it reliable, by moving LRU flag clearing; but missed the mlock/munlock batches, so still unreliable as reported. And it turns out to be difficult to extend 33dfe9204f29's LRU flag clearing to the mlock/munlock batches: if they do benefit from batching, mlock/munlock cannot be so effective when easily suppressed while !LRU. Instead, switch to an expected ref_count check, which was more reliable all along: some more false positives (unhelpful drains) than before, and never a guarantee that the folio will prove migratable, but better. Note on PG_private_2: ceph and nfs are still using the deprecated PG_private_2 flag, with the aid of netfs and filemap support functions. Although it is consistently matched by an increment of folio ref_count, folio_expected_ref_count() intentionally does not recognize it, and ceph folio migration currently depends on that for PG_private_2 folios to be rejected. New references to the deprecated flag are discouraged, so do not add it into the collect_longterm_unpinnable_folios() calculation: but longterm pinning of transiently PG_private_2 ceph and nfs folios (an uncommon case) may invoke a redundant lru_add_drain_all(). And this makes easy the backport to earlier releases: up to and including 6.12, btrfs also used PG_private_2, but without a ref_count increment. Note for stable backports: requires 6.16 commit 86ebd50224c0 ("mm: add folio_expected_ref_count() for reference count calculation"). Link: https://lkml.kernel.org/r/41395944-b0e3-c3ac-d648-8ddd70451d28@google.com Link: https://lkml.kernel.org/r/bd1f314a-fca1-8f19-cac0-b936c9614557@google.com Fixes: 9a4e9f3b2d73 ("mm: update get_user_pages_longterm to migrate pages allocated from CMA region") Signed-off-by: Hugh Dickins Reported-by: Will Deacon Closes: https://lore.kernel.org/linux-mm/20250815101858.24352-1-will@kernel.org/ Acked-by: Kiryl Shutsemau Acked-by: David Hildenbrand Cc: "Aneesh Kumar K.V" Cc: Axel Rasmussen Cc: Chris Li Cc: Christoph Hellwig Cc: Jason Gunthorpe Cc: Johannes Weiner Cc: John Hubbard Cc: Keir Fraser Cc: Konstantin Khlebnikov Cc: Li Zhe Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Rik van Riel Cc: Shivank Garg Cc: Vlastimil Babka Cc: Wei Xu Cc: yangge Cc: Yuanchu Xie Cc: Yu Zhao Cc: Signed-off-by: Andrew Morton commit 5cd64d4f92683afa691a6b83dcad5adfb2165ed0 Merge: 395d68e5dd6374 cdbc9836c7afad Author: Linus Torvalds Date: Sat Sep 13 10:45:11 2025 -0700 Merge tag 'ceph-for-6.17-rc6' of https://github.com/ceph/ceph-client Pull ceph fixes from Ilya Dryomov: "A fix for a race condition around r_parent tracking that took a long time to track down from Alex and some fixes for potential crashes on accessing invalid memory from Max and myself. All marked for stable" * tag 'ceph-for-6.17-rc6' of https://github.com/ceph/ceph-client: libceph: fix invalid accesses to ceph_connection_v1_info ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error ceph: always call ceph_shift_unused_folios_left() ceph: fix race condition where r_parent becomes stale before sending message ceph: fix race condition validating r_parent before applying state commit 395d68e5dd63745a424b1b3bdee095b500c7cf83 Merge: b891d11b74b447 c05d0b32eebadc Author: Linus Torvalds Date: Sat Sep 13 10:40:50 2025 -0700 Merge tag 'regulator-fix-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One fix for sy7636a which got confused about which device to use to manage the lifecycle of the power good GPIO because it's looked up from the parent device due to the way DT bindings work" * tag 'regulator-fix-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: sy7636a: fix lifecycle of power good gpio commit b891d11b74b447df6e18104199148e420c985ac1 Merge: 22f20375f5b71f f6d2900f2806d5 Author: Linus Torvalds Date: Sat Sep 13 10:36:06 2025 -0700 Merge tag 'driver-core-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Fix UAF in cgroup pressure polling by using kernfs_get_active_of() to prevent operations on released file descriptors - Fix unresolved intra-doc link in the documentation of struct Device when CONFIG_DRM != y - Update the DMA Rust MAINTAINERS entry * tag 'driver-core-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: MAINTAINERS: Update the DMA Rust entry kernfs: Fix UAF in polling when open file is released rust: device: fix unresolved link to drm::Device commit 44a375e8aaff360944606b3bb2df89f1376cbaf3 Author: Petr Pavlu Date: Mon Sep 1 09:53:04 2025 +0100 ARM: 9458/1: module: Ensure the override of module_arch_freeing_init() The function module_arch_freeing_init() defined in arch/arm/kernel/module.c is supposed to override a weak function of the same name defined in kernel/module/main.c. However, the ARM override is also marked as weak, which means that selecting the correct function unnecessarily depends on the order in which object files with both functions are passed to the linker. Although it happens to be correct at the moment, the proper pattern is to make the ARM override a strong definition. Fixes: cdcb07e45a91 ("ARM: 8975/1: module: fix handling of unwind init sections") Signed-off-by: Petr Pavlu Signed-off-by: Russell King (Oracle) commit 07c24945cafc810bcce3ea6c336a6495e813b47f Author: Bagas Sanjaya Date: Fri Sep 12 20:06:50 2025 +0700 Revert "drm: Add directive to format code in comment" Commit 6cc44e9618f03f ("drm: Add directive to format code in comment") fixes original Sphinx indentation warning as introduced in 471920ce25d50b ("drm/gpuvm: Add locking helpers"), by means of using code-block:: directive. It semantically conflicts with earlier bb324f85f72284 ("drm/gpuvm: Wrap drm_gpuvm_sm_map_exec_lock() expected usage in literal code block") that did the same using double colon syntax instead. These duplicated literal code block directives causes the original warnings not being fixed. Revert 6cc44e9618f03f to keep things rolling without these warnings. Fixes: 6cc44e9618f0 ("drm: Add directive to format code in comment") Fixes: 471920ce25d5 ("drm/gpuvm: Add locking helpers") Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Danilo Krummrich commit a0c17ed907ac3326cf3c9d6007ea222a746f5cc2 Author: Vasant Hegde Date: Thu Sep 11 13:14:06 2025 +0000 iommu/amd: Fix alias device DTE setting Commit 7bea695ada0 restructured DTE flag handling but inadvertently changed the alias device configuration logic. This may cause incorrect DTE settings for certain devices. Add alias flag check before calling set_dev_entry_from_acpi(). Also move the device iteration loop inside the alias check to restrict execution to cases where alias devices are present. Fixes: 7bea695ada0 ("iommu/amd: Introduce struct ivhd_dte_flags to store persistent DTE flags") Cc: Suravee Suthikulpanit Signed-off-by: Vasant Hegde Signed-off-by: Joerg Roedel commit 46834d90a9a13549264b9581067d8f746b4b36cc Author: Borislav Petkov (AMD) Date: Sat Sep 6 14:21:45 2025 +0200 crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() When 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown") moved the error messages dumping so that they don't need to be issued by the callers, it missed the case where __sev_firmware_shutdown() calls __sev_platform_shutdown_locked() with a NULL argument which leads to a NULL ptr deref on the shutdown path, during suspend to disk: #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 983 Comm: hib.sh Not tainted 6.17.0-rc4+ #1 PREEMPT(voluntary) Hardware name: Supermicro Super Server/H12SSL-i, BIOS 2.5 09/08/2022 RIP: 0010:__sev_platform_shutdown_locked.cold+0x0/0x21 [ccp] That rIP is: 00000000000006fd <__sev_platform_shutdown_locked.cold>: 6fd: 8b 13 mov (%rbx),%edx 6ff: 48 8b 7d 00 mov 0x0(%rbp),%rdi 703: 89 c1 mov %eax,%ecx Code: 74 05 31 ff 41 89 3f 49 8b 3e 89 ea 48 c7 c6 a0 8e 54 a0 41 bf 92 ff ff ff e8 e5 2e 09 e1 c6 05 2a d4 38 00 01 e9 26 af ff ff <8b> 13 48 8b 7d 00 89 c1 48 c7 c6 18 90 54 a0 89 44 24 04 e8 c1 2e RSP: 0018:ffffc90005467d00 EFLAGS: 00010282 RAX: 00000000ffffff92 RBX: 0000000000000000 RCX: 0000000000000000 ^^^^^^^^^^^^^^^^ and %rbx is nice and clean. Call Trace: __sev_firmware_shutdown.isra.0 sev_dev_destroy psp_dev_destroy sp_destroy pci_device_shutdown device_shutdown kernel_power_off hibernate.cold state_store kernfs_fop_write_iter vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Pass in a pointer to the function-local error var in the caller. With that addressed, suspending the ccp shows the error properly at least: ccp 0000:47:00.1: sev command 0x2 timed out, disabling PSP ccp 0000:47:00.1: SEV: failed to SHUTDOWN error 0x0, rc -110 SEV-SNP: Leaking PFN range 0x146800-0x146a00 SEV-SNP: PFN 0x146800 unassigned, dumping non-zero entries in 2M PFN region: [0x146800 - 0x146a00] ... ccp 0000:47:00.1: SEV-SNP firmware shutdown failed, rc -16, error 0x0 ACPI: PM: Preparing to enter system sleep state S5 kvm: exiting hardware virtualization reboot: Power down Btw, this driver is crying to be cleaned up to pass in a proper I/O struct which can be used to store information between the different functions, otherwise stuff like that will happen in the future again. Fixes: 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown") Signed-off-by: Borislav Petkov (AMD) Cc: Reviewed-by: Ashish Kalra Acked-by: Tom Lendacky Signed-off-by: Herbert Xu commit 7947ad15614ce897f47ce8ae123b82445d1861d0 Author: Ian Rogers Date: Fri Sep 12 17:01:29 2025 -0700 perf lock: Provide a host_env for session new When "perf lock con" is run in a live mode, with no data file, a host environment must be provided. Testing missed this as a failing assert was creating the 1 line of expected stderr output. $ sudo perf lock con -ab true perf: util/session.c:195: __perf_session__new: Assertion `host_env != NULL' failed. Aborted Fixes: 525a599badeeafba ("perf env: Remove global perf_env") Signed-off-by: Ian Rogers Signed-off-by: Namhyung Kim commit a5edf3550f4260504b7e0ab3d40d13ffe924b773 Author: hupu Date: Wed Sep 10 16:16:55 2025 +0800 perf subcmd: avoid crash in exclude_cmds when excludes is empty When cross-compiling the perf tool for ARM64, `perf help` may crash with the following assertion failure: help.c:122: exclude_cmds: Assertion `cmds->names[ci] == NULL' failed. This happens when the perf binary is not named exactly "perf" or when multiple "perf-*" binaries exist in the same directory. In such cases, the `excludes` command list can be empty, which leads to the final assertion in exclude_cmds() being triggered. Add a simple guard at the beginning of exclude_cmds() to return early if excludes->cnt is zero, preventing the crash. Signed-off-by: hupu Reported-by: Guilherme Amadio Reviewed-by: Namhyung Kim Link: https://lore.kernel.org/r/20250909094953.106706-1-amadio@gentoo.org Signed-off-by: Namhyung Kim commit 201825fb4278accb6ace42915566c22391a0900d Author: Russell King (Oracle) Date: Thu Sep 11 15:43:15 2025 +0100 net: ethtool: handle EOPNOTSUPP from ethtool get_ts_info() method Network drivers sometimes return -EOPNOTSUPP from their get_ts_info() method, and this should not cause the reporting of PHY timestamping information to be prohibited. Handle this error code, and also arrange for ethtool_net_get_ts_info_by_phc() to return -EOPNOTSUPP when the method is not implemented. This allows e.g. PHYs connected to DSA switches which support timestamping to report their timestamping capabilities. Fixes: b9e3f7dc9ed9 ("net: ethtool: tsinfo: Enhance tsinfo to support several hwtstamp by net topology") Signed-off-by: Russell King (Oracle) Reviewed-by: Kory Maincent Link: https://patch.msgid.link/E1uwiW3-00000004jRF-3CnC@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 5b7c90ef646d175e8c85a6d31ce3794789bbb925 Author: Mukesh Kumar Savaliya Date: Wed Aug 27 00:27:18 2025 +0530 MAINTAINERS: Update email address for Qualcomm's I2C GENI maintainers Update email address to @oss.qualcomm.com for both the maintainers from qualcomm, Viken dadhani and Mukesh Kumar Savaliya. Signed-off-by: Mukesh Kumar Savaliya Signed-off-by: Wolfram Sang commit 22f20375f5b71f30c0d6896583b93b6e4bba7279 Merge: 965c995c9a4b39 b816265396daf1 Author: Linus Torvalds Date: Fri Sep 12 10:46:10 2025 -0700 Merge tag 'pci-v6.17-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fix from Bjorn Helgaas: - Fix mvebu PCI enumeration regression caused by converting to for_each_of_range() iterator (Klaus Kudielka) * tag 'pci-v6.17-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: mvebu: Fix use of for_each_of_range() iterator commit 965c995c9a4b395471ff48790a0155ee986ca405 Merge: cb780b79b236db 9a3f210737e958 Author: Linus Torvalds Date: Fri Sep 12 09:29:59 2025 -0700 Merge tag 'drm-fixes-2025-09-12' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly pull fixes for drm, mostly amdgpu and xe, with a revert for nouveau and some maintainers updates, and misc bits, doesn't seem too out of the normal. MAINTAINERS: - add rust tree to MAINTAINERS - fix X entries for nova/nouveau nova: - depend on 64-bit i915: - Fix size for for_each_set_bit() in abox iteration xe: - Don't touch survivability_mode on fini - Fixes around eviction and suspend - Extend Wa_13011645652 to PTL-H, WCL amdgpu: - PSP 11.x fix - DPCD quirk handing fix - DCN 3.5 PG fix - Audio suspend fix - OEM i2c clean up fix - Module unload memory leak fix - DC delay fix - ISP firmware fix - VCN fixes amdkfd: - P2P topology fix - APU mem limit calculation fix mediatek: - fix potential OF node use-after-free panthor: - out-of-bounds check nouveau: - revert waitqueue removal for sched teardown * tag 'drm-fixes-2025-09-12' of https://gitlab.freedesktop.org/drm/kernel: (25 commits) MAINTAINERS: drm-misc: fix X: entries for nova/nouveau drm/mediatek: clean up driver data initialisation drm/mediatek: fix potential OF node use-after-free drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages drm/amd/amdgpu: Declare isp firmware binary file drm/amd/display: use udelay rather than fsleep drm/amdgpu: fix a memory leak in fence cleanup when unloading drm/xe: Extend Wa_13011645652 to PTL-H, WCL drm/xe: Block exec and rebind worker while evicting for suspend / hibernate drm/xe: Allow the pm notifier to continue on failure drm/xe: Attempt to bring bos back to VRAM after eviction drm/xe/configfs: Don't touch survivability_mode on fini amd/amdkfd: correct mem limit calculation for small APUs drm/amdkfd: fix p2p links bug in topology drm/amd/display: remove oem i2c adapter on finish drm/amd/display: Drop dm_prepare_suspend() and dm_complete() drm/amd/display: Correct sequences and delays for DCN35 PG & RCG drm/amd/display: Disable DPCD Probe Quirk drm/i915/power: fix size for for_each_set_bit() in abox iteration ... commit cb780b79b236db9a036a4b7975361dd44a0b4d29 Merge: 320475fbd590dc c5ea3065586d79 Author: Linus Torvalds Date: Fri Sep 12 09:03:01 2025 -0700 Merge tag 'v6.17-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: "Two smb3 client fixes, both for stable: - Fix encryption problem with multiple compounded ops - Fix rename error cases that could lead to data corruption" * tag 'v6.17-rc5-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: fix data loss due to broken rename(2) smb: client: fix compound alignment with encryption commit 6865ed7ddc815861e52f3692890852fe6043baea Merge: 32687c06637562 a50342f976d25a Author: Arnd Bergmann Date: Fri Sep 12 18:00:26 2025 +0200 Merge tag 'imx-fixes-6.17-2' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.17, round 2: - Fix mach-imx Kconfig to select the correct PIT timer option (Lukas Bulwahn) - Correct thermal sensor index for i.MX8MP device tree (Peng Fan) - Fix i.MX SCMI build error by adding stub API functions (Peng Fan) * tag 'imx-fixes-6.17-2' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx8mp: Correct thermal sensor index ARM: imx: Kconfig: Adjust select after renamed config option firmware: imx: Add stub functions for SCMI CPU API firmware: imx: Add stub functions for SCMI LMM API firmware: imx: Add stub functions for SCMI MISC API Link: https://lore.kernel.org/r/aMQs2zr4fYl2DYVr@dragon Signed-off-by: Arnd Bergmann commit 32687c06637562511f7a1c1a651c0d9964aa144c Merge: bab62f5bdce4d8 ea9da67e2add7b Author: Arnd Bergmann Date: Fri Sep 12 17:57:23 2025 +0200 Merge tag 'socfpga_dts_fix_for_v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into arm/fixes SoCFPGA DTS fix for v6.17 - Fix midio bus probe and PHY address for cylone5 sodia board * tag 'socfpga_dts_fix_for_v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address Link: https://lore.kernel.org/r/20250907123058.175447-1-dinguyen@kernel.org Signed-off-by: Arnd Bergmann commit bab62f5bdce4d88e8adb7deb1b9632c93ad1f205 Merge: f1a43af7a9ecf2 9a52827a9bbbab Author: Arnd Bergmann Date: Fri Sep 12 17:57:03 2025 +0200 Merge tag 'reset-fixes-for-v6.17' of https://git.pengutronix.de/git/pza/linux into arm/fixes Reset controller fixes for v6.17 * Fix an OF node reference leak in the EyeQ reset controller driver. * tag 'reset-fixes-for-v6.17' of https://git.pengutronix.de/git/pza/linux: reset: eyeq: fix OF node leak Link: https://lore.kernel.org/r/20250904153345.2374313-1-p.zabel@pengutronix.de Signed-off-by: Arnd Bergmann commit f1a43af7a9ecf276e698cd4c32f6bacee0b6df49 Merge: 875691ceb8bd61 794a066688038d Author: Arnd Bergmann Date: Fri Sep 12 17:55:31 2025 +0200 Merge tag 'mvebu-fixes-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into arm/fixes mvebu fixes for 6.17 (part 1) Fix SATA ports on various boards: Macchiatobin, CN913x-solidrun. Fix audio on Armada 370 DB and OpenRD. Disable eMMC high-speed modes on the CN9132 CEX-7 module. Disable runtime reconfiguration for PCIe lanes on the CN9132 CEX-7 module. * tag 'mvebu-fixes-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes arm64: dts: marvell: cn913x-solidrun: fix sata ports status ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients ARM64: dts: mcbin: fix SATA ports on Macchiatobin ARM: dts: armada-370-db: Fix stereo audio input routing on Armada 370 Link: https://lore.kernel.org/r/87ikhnn1pl.fsf@BLaptop.bootlin.com Signed-off-by: Arnd Bergmann commit 831f70a5b93bd2d9e858ced2c12fab5766ede5e7 Author: Amit Chaudhari Date: Tue Aug 19 17:49:19 2025 -0400 HID: asus: add support for missing PX series fn keys Add support for missing hotkey keycodes affecting Asus PX13 and PX16 families so userspace can use them. Signed-off-by: Amit Chaudhari Signed-off-by: Jiri Kosina commit 2a5e76b9a0efc44807ff0e6b141649fac65a55ac Author: Sébastien Szymanski Date: Thu Sep 4 18:42:07 2025 +0200 HID: cp2112: fix setter callbacks return value Since commit 6485543488a6 ("HID: cp2112: use new line value setter callbacks"), setting a GPIO value always fails with error -EBADE. That's because the returned value by the setter callbacks is the returned value by the hid_hw_raw_request() function which is the number of bytes sent on success or a negative value on error. The function gpiochip_set() returns -EBADE if the setter callbacks return a value > 0. Fix this by making the setter callbacks return 0 on success or a negative value on error. While at it, use the returned value by cp2112_gpio_set_unlocked() in the direction_output callback. Fixes: 6485543488a6 ("HID: cp2112: use new line value setter callbacks") Signed-off-by: Sébastien Szymanski Reviewed-by: Bartosz Golaszewski Signed-off-by: Jiri Kosina commit 8599049a96850ac96a64c0c6e5cfdec5b94d9207 Author: Janne Grunau Date: Mon Sep 1 12:20:07 2025 +0200 HID: lenovo: Use KEY_PERFORMANCE instead of ACPI's platform_profile Commit 84c9d2a968c82 ("HID: lenovo: Support for ThinkPad-X12-TAB-1/2 Kbd Fn keys") added a dependency on ACPI's platform_profile. This should not be done for generic USB devices as this prevents using the devices on non ACPI devices like Apple silicon Macs and other non-ACPI arm64 systems. An attempt to allow using platform_profile on non-ACPI systems was rejected in [1] and instead platform_profile was made to fail during init in commit dd133162c9cf ("ACPI: platform_profile: Avoid initializing on non-ACPI platforms"). So remove the broken dependency and instead let's user space handle this keycode by sending the new KEY_PERFORMANCE. Stable backport depends on commit 89c5214639294 ("Input: add keycode for performance mode key"). [1]: https://lore.kernel.org/linux-acpi/CAJZ5v0icRdTSToaKbdf=MdRin4NyB2MstUVaQo8VR6-n7DkVMQ@mail.gmail.com/ Cc: regressions@lists.linux.dev Cc: stable@vger.kernel.org Fixes: 84c9d2a968c82 ("HID: lenovo: Support for ThinkPad-X12-TAB-1/2 Kbd Fn keys") Signed-off-by: Janne Grunau Signed-off-by: Jiri Kosina commit 12a0d4109d6ee25e5aa1cfd150c1fad607751a18 Merge: cc54ed51c76172 89c52146392948 Author: Jiri Kosina Date: Fri Sep 12 16:58:28 2025 +0200 Merge commit '89c5214639294' into for-6.17/upstream-fixes This bringig in a KEY_PERFORMANCE definition, which a followup fix will depend on. Signed-off-by: Jiri Kosina commit cc54ed51c761728f6933cca889b684ed7fbaaf07 Author: Xinpeng Sun Date: Thu Aug 28 10:09:59 2025 +0800 HID: intel-thc-hid: intel-quickspi: Add WCL Device IDs Add THC SPI WildcatLake device IDs. Signed-off-by: Xinpeng Sun Reviewed-by: Even Xu Signed-off-by: Jiri Kosina commit 510f05bb73c68809efcd54ee6339f82bfbe83782 Author: Xinpeng Sun Date: Thu Aug 28 10:09:58 2025 +0800 HID: intel-thc-hid: intel-quicki2c: Add WCL Device IDs Add THC I2C WildcatLake device IDs. Signed-off-by: Xinpeng Sun Reviewed-by: Even Xu Signed-off-by: Jiri Kosina commit 77a436c93d10d68201bfd4941d1ca3230dfd1f40 Author: Ben Chuang Date: Thu Sep 11 10:42:42 2025 +0800 mmc: sdhci-pci-gli: GL9767: Fix initializing the UHS-II interface during a power-on According to the power structure of IC hardware design for UHS-II interface, reset control and timing must be added to the initialization process of powering on the UHS-II interface. Fixes: 27dd3b82557a ("mmc: sdhci-pci-gli: enable UHS-II mode for GL9767") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Ben Chuang Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 09c2b628f6403ad467fc73326a50020590603871 Author: Ben Chuang Date: Thu Sep 11 10:41:01 2025 +0800 mmc: sdhci-uhs2: Fix calling incorrect sdhci_set_clock() function Fix calling incorrect sdhci_set_clock() in __sdhci_uhs2_set_ios() when the vendor defines its own sdhci_set_clock(). Fixes: 10c8298a052b ("mmc: sdhci-uhs2: add set_ios()") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Ben Chuang Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 7b7e71683b4ccbe0dbd7d434707623327e852f20 Author: Ben Chuang Date: Thu Sep 11 10:40:20 2025 +0800 mmc: sdhci: Move the code related to setting the clock from sdhci_set_ios_common() into sdhci_set_ios() The sdhci_set_clock() is called in sdhci_set_ios_common() and __sdhci_uhs2_set_ios(). According to Section 3.13.2 "Card Interface Detection Sequence" of the SD Host Controller Standard Specification Version 7.00, the SD clock is supplied after power is supplied, so we only need one in __sdhci_uhs2_set_ios(). Let's move the code related to setting the clock from sdhci_set_ios_common() into sdhci_set_ios() and modify the parameters passed to sdhci_set_clock() in __sdhci_uhs2_set_ios(). Fixes: 10c8298a052b ("mmc: sdhci-uhs2: add set_ios()") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Ben Chuang Acked-by: Adrian Hunter Signed-off-by: Ulf Hansson commit 794a066688038df46c01e177cc6faebded0acba4 Author: Josua Mayer Date: Thu Sep 11 20:28:06 2025 +0200 arm64: dts: marvell: cn9132-clearfog: fix multi-lane pci x2 and x4 ports The mvebu-comphy driver does not currently know how to pass correct lane-count to ATF while configuring the serdes lanes. This causes the system to hard reset during reconfiguration, if a pci card is present and has established a link during bootloader. Remove the comphy handles from the respective pci nodes to avoid runtime reconfiguration, relying solely on bootloader configuration - while avoiding the hard reset. When bootloader has configured the lanes correctly, the pci ports are functional under Linux. This issue may be addressed in the comphy driver at a future point. Fixes: e9ff907f4076 ("arm64: dts: add description for solidrun cn9132 cex7 module and clearfog board") Cc: stable@vger.kernel.org Signed-off-by: Josua Mayer Signed-off-by: Gregory CLEMENT commit 48b51799a5461707705454568453618cdd7307f4 Author: Josua Mayer Date: Thu Sep 11 20:28:05 2025 +0200 arm64: dts: marvell: cn9132-clearfog: disable eMMC high-speed modes Similar to MacchiatoBIN the high-speed modes are unstable on the CN9132 CEX-7 module, leading to failed transactions under normal use. Disable all high-speed modes including UHS. Additionally add no-sdio and non-removable properties as appropriate for eMMC. Fixes: e9ff907f4076 ("arm64: dts: add description for solidrun cn9132 cex7 module and clearfog board") Cc: stable@vger.kernel.org Signed-off-by: Josua Mayer Signed-off-by: Gregory CLEMENT commit d3021e6aa11fecdafa85038a037c04d5bfeda9d5 Author: Josua Mayer Date: Thu Sep 11 20:28:04 2025 +0200 arm64: dts: marvell: cn913x-solidrun: fix sata ports status Commit "arm64: dts: marvell: only enable complete sata nodes" changed armada-cp11x.dtsi disabling all sata ports status by default. The author missed some dts which relied on the dtsi enabling all ports, and just disabled unused ones instead. Update dts for SolidRun cn913x based boards to enable the available ports, rather than disabling the unvavailable one. Further according to dt bindings the serdes phys are to be specified in the port node, not the controller node. Move those phys properties accordingly in clearfog base/pro/solidwan. Fixes: 30023876aef4 ("arm64: dts: marvell: only enable complete sata nodes") Cc: stable@vger.kernel.org Signed-off-by: Josua Mayer Signed-off-by: Gregory CLEMENT commit 8ab2f1c35669bff7d7ed1bb16bf5cc989b3e2e17 Author: Thomas Fourier Date: Tue Aug 26 09:58:08 2025 +0200 mmc: mvsdio: Fix dma_unmap_sg() nents value The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: 236caa7cc351 ("mmc: SDIO driver for Marvell SoCs") Signed-off-by: Thomas Fourier Reviewed-by: Linus Walleij Cc: stable@vger.kernel.org Signed-off-by: Ulf Hansson commit 9dfec4a51df9cf0dcc23cb4ac6fc314bf9e999d0 Author: Edward Adam Davis Date: Wed Sep 10 15:58:47 2025 +0800 USB: core: remove the move buf action The buffer size of sysfs is fixed at PAGE_SIZE, and the page offset of the buf parameter of sysfs_emit_at() must be 0, there is no need to manually manage the buf pointer offset. Fixes: 711d41ab4a0e ("usb: core: Use sysfs_emit_at() when showing dynamic IDs") Reported-by: syzbot+b6445765657b5855e869@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b6445765657b5855e869 Tested-by: syzbot+b6445765657b5855e869@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Link: https://lore.kernel.org/r/tencent_B32D6D8C9450EBFEEE5ACC2C7B0E6C402D0A@qq.com Signed-off-by: Greg Kroah-Hartman commit 7609fb63cead022a748b59ecbf0d45a2862f0287 Merge: 116e79c679a153 a5a261bea9bf84 Author: Greg Kroah-Hartman Date: Fri Sep 12 10:41:15 2025 +0200 Merge tag 'usb-serial-6.17-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-linus Johan writes: USB serial device ids for 6.17-rc6 Here are some new modem device ids. Everything has been in linux-next with no reported issues. * tag 'usb-serial-6.17-rc6' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions USB: serial: option: add Telit Cinterion FN990A w/audio compositions commit 29341c6c18b8ad2a9a4a68a61be7e1272d842f21 Author: Jihed Chaibi Date: Sat Aug 30 22:37:50 2025 +0200 ARM: dts: kirkwood: Fix sound DAI cells for OpenRD clients A previous commit changed the '#sound-dai-cells' property for the kirkwood audio controller from 1 to 0 in the kirkwood.dtsi file, but did not update the corresponding 'sound-dai' property in the kirkwood-openrd-client.dts file. This created a mismatch, causing a dtbs_check validation error where the dts provides one cell (<&audio0 0>) while the .dtsi expects zero. Remove the extraneous cell from the 'sound-dai' property to fix the schema validation warning and align with the updated binding. Fixes: e662e70fa419 ("arm: dts: kirkwood: fix error in #sound-dai-cells size") Signed-off-by: Jihed Chaibi Reviewed-by: Krzysztof Kozlowski Signed-off-by: Gregory CLEMENT commit 2690cb089502b80b905f2abdafd1bf2d54e1abef Author: Ioana Ciornei Date: Wed Sep 10 17:48:25 2025 +0300 dpaa2-switch: fix buffer pool seeding for control traffic Starting with commit c50e7475961c ("dpaa2-switch: Fix error checking in dpaa2_switch_seed_bp()"), the probing of a second DPSW object errors out like below. fsl_dpaa2_switch dpsw.1: fsl_mc_driver_probe failed: -12 fsl_dpaa2_switch dpsw.1: probe with driver fsl_dpaa2_switch failed with error -12 The aforementioned commit brought to the surface the fact that seeding buffers into the buffer pool destined for control traffic is not successful and an access violation recoverable error can be seen in the MC firmware log: [E, qbman_rec_isr:391, QBMAN] QBMAN recoverable event 0x1000000 This happens because the driver incorrectly used the ID of the DPBP object instead of the hardware buffer pool ID when trying to release buffers into it. This is because any DPSW object uses two buffer pools, one managed by the Linux driver and destined for control traffic packet buffers and the other one managed by the MC firmware and destined only for offloaded traffic. And since the buffer pool managed by the MC firmware does not have an external facing DPBP equivalent, any subsequent DPBP objects created after the first DPSW will have a DPBP id different to the underlying hardware buffer ID. The issue was not caught earlier because these two numbers can be identical when all DPBP objects are created before the DPSW objects are. This is the case when the DPL file is used to describe the entire DPAA2 object layout and objects are created at boot time and it's also true for the first DPSW being created dynamically using ls-addsw. Fix this by using the buffer pool ID instead of the DPBP id when releasing buffers into the pool. Fixes: 2877e4f7e189 ("staging: dpaa2-switch: setup buffer pool and RX path rings") Signed-off-by: Ioana Ciornei Link: https://patch.msgid.link/20250910144825.2416019-1-ioana.ciornei@nxp.com Signed-off-by: Jakub Kicinski commit 5577352b55833d0f4350eb5d62eda2df09e84922 Author: Li Tian Date: Wed Sep 10 08:37:32 2025 +0800 net/mlx5: Not returning mlx5_link_info table when speed is unknown Because mlx5e_link_info and mlx5e_ext_link_info have holes e.g. Azure mlx5 reports PTYS 19. Do not return it unless speed is retrieved successfully. Fixes: 65a5d35571849 ("net/mlx5: Refactor link speed handling with mlx5_link_info struct") Suggested-by: Vitaly Kuznetsov Signed-off-by: Li Tian Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20250910003732.5973-1-litian@redhat.com Signed-off-by: Jakub Kicinski commit 247981eecd3dd6ff51bd0a0223deba8af39c5498 Author: Samiullah Khawaja Date: Wed Sep 10 20:37:16 2025 +0000 net: Use NAPI_* in test_bit when stopping napi kthread napi_stop_kthread waits for the NAPI_STATE_SCHED_THREADED to be unset before stopping the kthread. But it uses test_bit with the NAPIF_STATE_SCHED_THREADED and that might stop the kthread early before the flag is unset. Use the NAPI_* variant of the NAPI state bits in test_bit instead. Tested: ./tools/testing/selftests/net/nl_netdev.py TAP version 13 1..7 ok 1 nl_netdev.empty_check ok 2 nl_netdev.lo_check ok 3 nl_netdev.page_pool_check ok 4 nl_netdev.napi_list_check ok 5 nl_netdev.dev_set_threaded ok 6 nl_netdev.napi_set_threaded ok 7 nl_netdev.nsim_rxq_reset_down # Totals: pass:7 fail:0 xfail:0 xpass:0 skip:0 error:0 ./tools/testing/selftests/drivers/net/napi_threaded.py TAP version 13 1..2 ok 1 napi_threaded.change_num_queues ok 2 napi_threaded.enable_dev_threaded_disable_napi_threaded # Totals: pass:2 fail:0 xfail:0 xpass:0 skip:0 error:0 Fixes: 689883de94dd ("net: stop napi kthreads when THREADED napi is disabled") Signed-off-by: Samiullah Khawaja Link: https://patch.msgid.link/20250910203716.1016546-1-skhawaja@google.com Signed-off-by: Jakub Kicinski commit 9a3f210737e958c3f45a4ce0d7f1ff330af3965f Merge: dab1f85526a454 fd99415ec8a808 Author: Dave Airlie Date: Fri Sep 12 09:39:06 2025 +1000 Merge tag 'drm-xe-fixes-2025-09-11' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Don't touch survivability_mode on fini (Michal) - Fixes around eviction and suspend (Thomas) - Extend Wa_13011645652 to PTL-H, WCL (Julia) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aMLq7QlaEPHGKXKX@intel.com commit 320475fbd590dc94a0a3d9173f81e0797ee1a232 Merge: db87bd2ad1f736 4550d33e18112a Author: Linus Torvalds Date: Thu Sep 11 16:35:06 2025 -0700 Merge tag 'mtd/fixes-for-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd fixes from Miquel Raynal: "SPI NAND fix: - Wrong OOB layout for Winbond W25N01JW SPI NAND devices Raw NAND fixes: - Atmel raw NAND controller timings - Buffer handling in stm32_fmc2 driver - Error handling in Nuvoton's driver MTD devices fixes: - Wrong depends-on dependencies on the Intel DRM driver * tag 'mtd/fixes-for-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: mtd: spinand: winbond: Fix oob_layout for W25N01JW mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing mtd: rawnand: stm32_fmc2: fix ECC overwrite mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer mtd: rawnand: nuvoton: Fix an error handling path in ma35_nand_chips_init() mtd: MTD_INTEL_DG should depend on DRM_I915 or DRM_XE commit dab1f85526a454cd81174a9df70961169222efa2 Merge: f2c8bbb6e97180 87b90cee22d865 Author: Dave Airlie Date: Fri Sep 12 09:34:36 2025 +1000 Merge tag 'drm-misc-fixes-2025-09-11' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A maintainer update, an out-of-bound check for panthor and a revert for nouveau to fix a race. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250911-glistening-uakari-of-serendipity-06ceb1@houat commit f2c8bbb6e971802d169a43f1f90f351600561055 Merge: 1d00adb873a0ee 9ba2556cef1df7 Author: Dave Airlie Date: Fri Sep 12 09:31:23 2025 +1000 Merge tag 'mediatek-drm-fixes-20250910' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20250910 1. fix potential OF node use-after-free Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://lore.kernel.org/r/20250910231813.3526-1-chunkuang.hu@kernel.org commit 1d00adb873a0ee9139c35d40b7b55fe8d940f376 Merge: 467360e2959595 3318f2d20ce488 Author: Dave Airlie Date: Fri Sep 12 09:24:50 2025 +1000 Merge tag 'amd-drm-fixes-6.17-2025-09-10' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.17-2025-09-10: amdgpu: - PSP 11.x fix - DPCD quirk handing fix - DCN 3.5 PG fix - Audio suspend fix - OEM i2c clean up fix - Module unload memory leak fix - DC delay fix - ISP firmware fix - VCN fixes amdkfd: - P2P topology fix - APU mem limit calculation fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250910162855.2507853-1-alexander.deucher@amd.com commit 467360e2959595d812c4eb553115a8b5c49cb14f Merge: 2c38074c3667ca cfa7b7659757f8 Author: Dave Airlie Date: Fri Sep 12 09:21:19 2025 +1000 Merge tag 'drm-intel-fixes-2025-09-10' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix size for for_each_set_bit() in abox iteration [display] (Jani Nikula) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://lore.kernel.org/r/aMFUtRdJ46qK-EXl@linux commit 2c38074c3667ca6940a1ea29930e2cd86efce348 Merge: 76eeb9b8de9880 349510052f765b Author: Dave Airlie Date: Fri Sep 12 08:40:15 2025 +1000 Merge tag 'drm-rust-fixes-2025-09-05' of https://gitlab.freedesktop.org/drm/rust/kernel into drm-fixes - Add drm-rust tree to MAINTAINERS - Require CONFIG_64BIT for Nova Signed-off-by: Dave Airlie From: Alice Ryhl Link: https://lore.kernel.org/r/aLquN1YvdyI_6PJS@google.com commit f6d2900f2806d584303db689d9e18f0443610514 Author: Danilo Krummrich Date: Wed Sep 10 11:40:03 2025 +0200 MAINTAINERS: Update the DMA Rust entry Update the DMA Rust maintainers entry in the following two aspects: (1) Change Abdiel's entry to 'Reviewer'. (2) Take patches through the driver-core tree. Abdiel won't do any more maintainer work on the DMA (or scatterlist) infrastructure, but he'd like to be kept in the loop, hence change is entry to 'R:'. Analogous to [1], the DMA (and scatterlist) helpers are closely coupled with the core device infrastructure and the device lifecycle, hence take patches through the driver-core tree by default. Cc: Abdiel Janulgue Link: https://lore.kernel.org/r/20250725202840.2251768-1-ojeda@kernel.org [1] Acked-by: Abdiel Janulgue Acked-by: Greg Kroah-Hartman Signed-off-by: Danilo Krummrich commit 1fcf686def19064a7b5cfaeb28c1f1a119900a2b Author: Gao Xiang Date: Fri Sep 12 03:27:11 2025 +0800 erofs: fix long xattr name prefix placement Currently, xattr name prefixes are forcibly placed into the packed inode if the fragments feature is enabled, and users have no option to put them in plain form directly on disk. This is inflexible. First, as mentioned above, users should be able to store unwrapped long xattr name prefixes unconditionally (COMPAT_PLAIN_XATTR_PFX). Second, since we now have the new metabox inode to store metadata, it should be used when available instead of the packed inode. Fixes: 414091322c63 ("erofs: implement metadata compression") Signed-off-by: Gao Xiang commit b0035df56dcd210d735e90ecd16817693f1a2ed9 Author: Shenghao Ding Date: Thu Sep 11 15:11:31 2025 +0800 ALSA: hda/tas2781: Fix a potential race condition that causes a NULL pointer in case no efi.get_variable exsits A a potential race condition reported by one of my customers that leads to a NULL pointer dereference, where the call to efi.get_variable should be guarded with efi_rt_services_supported() to ensure that function exists. Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib") Signed-off-by: Shenghao Ding Signed-off-by: Takashi Iwai commit db87bd2ad1f736c2f7ab231f9b40c885934f6b2c Merge: e59a039119c3ec 63a796558bc22e Author: Linus Torvalds Date: Thu Sep 11 08:54:42 2025 -0700 Merge tag 'net-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from CAN, netfilter and wireless. We have an IPv6 routing regression with the relevant fix still a WiP. This includes a last-minute revert to avoid more problems. Current release - new code bugs: - wifi: nl80211: completely disable per-link stats for now Previous releases - regressions: - dev_ioctl: take ops lock in hwtstamp lower paths - netfilter: - fix spurious set lookup failures - fix lockdep splat due to missing annotation - genetlink: fix genl_bind() invoking bind() after -EPERM - phy: transfer phy_config_inband() locking responsibility to phylink - can: xilinx_can: fix use-after-free of transmitted SKB - hsr: fix lock warnings - eth: - igb: fix NULL pointer dereference in ethtool loopback test - i40e: fix Jumbo Frame support after iPXE boot - macsec: sync features on RTM_NEWLINK Previous releases - always broken: - tunnels: reset the GSO metadata before reusing the skb - mptcp: make sync_socket_options propagate SOCK_KEEPOPEN - can: j1939: implement NETDEV_UNREGISTER notification hanidler - wifi: ath12k: fix WMI TLV header misalignment" * tag 'net-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits) Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" hsr: hold rcu and dev lock for hsr_get_port_ndev hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr hsr: use rtnl lock when iterating over ports wifi: nl80211: completely disable per-link stats for now net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups net: ethtool: fix wrong type used in struct kernel_ethtool_ts_info MAINTAINERS: add Phil as netfilter reviewer netfilter: nf_tables: restart set lookup on base_seq change netfilter: nf_tables: make nft_set_do_lookup available unconditionally netfilter: nf_tables: place base_seq in struct net netfilter: nft_set_rbtree: continue traversal if element is inactive netfilter: nft_set_pipapo: don't check genbit from packetpath lookups netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation can: rcar_can: rcar_can_resume(): fix s2ram with PSCI can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed can: j1939: implement NETDEV_UNREGISTER notification handler selftests: can: enable CONFIG_CAN_VCAN as a module ... commit e59a039119c3ec241228adf12dca0dd4398104d0 Merge: a1228f048a314b ce971233242b53 Author: Linus Torvalds Date: Thu Sep 11 08:46:30 2025 -0700 Merge tag 's390-6.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - ptep_modify_prot_start() may be called in a loop, which might lead to the preempt_count overflow due to the unnecessary preemption disabling. Do not disable preemption to prevent the overflow - Events of type PERF_TYPE_HARDWARE are not tested for sampling and return -EOPNOTSUPP eventually. Instead, deny all sampling events by CPUMF counter facility and return -ENOENT to allow other PMUs to be tried - The PAI PMU driver returns -EINVAL if an event out of its range. That aborts a search for an alternative PMU driver. Instead, return -ENOENT to allow other PMUs to be tried * tag 's390-6.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/cpum_cf: Deny all sampling events by counter PMU s390/pai: Deny all events not handled by this PMU s390/mm: Prevent possible preempt_count overflow commit a1228f048a314b9280784a2cbd757cac74705589 Merge: b10c31b70bf00b bddce1c7a5ab3e Author: Linus Torvalds Date: Thu Sep 11 08:11:16 2025 -0700 Merge tag 'pm-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix a nasty hibernation regression introduced during the 6.16 cycle, an issue related to energy model management occurring on Intel hybrid systems where some CPUs are offline to start with, and two regressions in the amd-pstate driver: - Restore a pm_restrict_gfp_mask() call in hibernation_snapshot() that was removed incorrectly during the 6.16 development cycle (Rafael Wysocki) - Introduce a function for registering a perf domain without triggering a system-wide CPU capacity update and make the intel_pstate driver use it to avoid reocurring unsuccessful attempts to update capacities of all CPUs in the system (Rafael Wysocki) - Fix setting of CPPC.min_perf in the active mode with performance governor in the amd-pstate driver to restore its expected behavior changed recently (Gautham Shenoy) - Avoid mistakenly setting EPP to 0 in the amd-pstate driver after system resume as a result of recent code changes (Mario Limonciello)" * tag 'pm-6.17-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: hibernate: Restrict GFP mask in hibernation_snapshot() PM: EM: Add function for registering a PD without capacity update cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume cpufreq/amd-pstate: Fix setting of CPPC.min_perf in active mode for performance governor commit b10c31b70bf00ba4688c4b364691640a92b7f4bf Merge: 02ffd6f89c50ca 3d1267475b94b3 Author: Linus Torvalds Date: Thu Sep 11 08:01:18 2025 -0700 Merge tag 'for-6.17-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix delayed inode tracking in xarray, eviction can race with insertion and leave behind a disconnected inode - on systems with large page (64K) and small block size (4K) fix compression read that can return partially filled folio - slightly relax compression option format for backward compatibility, allow to specify level for LZO although there's only one - fix simple quota accounting of compressed extents - validate minimum device size in 'device add' - update maintainers' entry * tag 'for-6.17-rc5-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: don't allow adding block device of less than 1 MB MAINTAINERS: update btrfs entry btrfs: fix subvolume deletion lockup caused by inodes xarray race btrfs: fix corruption reading compressed range when block size is smaller than page size btrfs: accept and ignore compression level for lzo btrfs: fix squota compressed stats leak commit 02ffd6f89c50ca0bff0c4578949ff99e70451757 Merge: 4f553c1e2c7b81 91f34aaae06e42 Author: Linus Torvalds Date: Thu Sep 11 07:54:16 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: "A number of fixes accumulated due to summer vacations - Fix out-of-bounds dynptr write in bpf_crypto_crypt() kfunc which was misidentified as a security issue (Daniel Borkmann) - Update the list of BPF selftests maintainers (Eduard Zingerman) - Fix selftests warnings with icecc compiler (Ilya Leoshkevich) - Disable XDP/cpumap direct return optimization (Jesper Dangaard Brouer) - Fix unexpected get_helper_proto() result in unusual configuration BPF_SYSCALL=y and BPF_EVENTS=n (Jiri Olsa) - Allow fallback to interpreter when JIT support is limited (KaFai Wan) - Fix rqspinlock and choose trylock fallback for NMI waiters. Pick the simplest fix. More involved fix is targeted bpf-next (Kumar Kartikeya Dwivedi) - Fix cleanup when tcp_bpf_send_verdict() fails to allocate psock->cork (Kuniyuki Iwashima) - Disallow bpf_timer in PREEMPT_RT for now. Proper solution is being discussed for bpf-next. (Leon Hwang) - Fix XSK cq descriptor production (Maciej Fijalkowski) - Tell memcg to use allow_spinning=false path in bpf_timer_init() to avoid lockup in cgroup_file_notify() (Peilin Ye) - Fix bpf_strnstr() to handle suffix match cases (Rong Tao)" * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Skip timer cases when bpf_timer is not supported bpf: Reject bpf_timer for PREEMPT_RT tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() bpf: Allow fall back to interpreter for programs with stack size <= 512 rqspinlock: Choose trylock fallback for NMI waiters xsk: Fix immature cq descriptor production bpf: Update the list of BPF selftests maintainers selftests/bpf: Add tests for bpf_strnstr selftests/bpf: Fix "expression result unused" warnings with icecc bpf: Fix bpf_strnstr() to handle suffix match cases better selftests/bpf: Extend crypto_sanity selftest with invalid dst buffer bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt bpf: Check the helper function is valid in get_helper_proto bpf, cpumap: Disable page_pool direct xdp_return need larger scope commit 63a796558bc22ec699e4193d5c75534757ddf2e6 Author: Paolo Abeni Date: Thu Sep 11 16:33:31 2025 +0200 Revert "net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups" This reverts commit 5537a4679403 ("net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups"), it breaks operation of asix ethernet usb dongle after system suspend-resume cycle. Link: https://lore.kernel.org/all/b5ea8296-f981-445d-a09a-2f389d7f6fdd@samsung.com/ Fixes: 5537a4679403 ("net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups") Reported-by: Marek Szyprowski Acked-by: Jakub Kicinski Link: https://patch.msgid.link/2945b9dbadb8ee1fee058b19554a5cb14f1763c1.1757601118.git.pabeni@redhat.com Signed-off-by: Paolo Abeni commit bddce1c7a5ab3ec2dd0fc404f4155c0c17e847b2 Merge: 971e2c87e4a9f6 449c9c02537a14 e0423541477dfb Author: Rafael J. Wysocki Date: Thu Sep 11 14:22:35 2025 +0200 Merge branches 'pm-sleep' and 'pm-em' Merge a hibernation regression fix and an fix related to energy model management for 6.17-rc6 * pm-sleep: PM: hibernate: Restrict GFP mask in hibernation_snapshot() * pm-em: PM: EM: Add function for registering a PD without capacity update commit 62e1de1d3352d4c64ebc0335a01186f421cbe6e7 Merge: 9b1fbd3539698e c3f8d13357deab Author: Paolo Abeni Date: Thu Sep 11 12:49:52 2025 +0200 Merge tag 'wireless-2025-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Some more fixes: - iwlwifi: fix 130/1030 devices - ath12k: fix alignment, power save - virt_wifi: fix crash - cfg80211: disable per-link stats due to buffer size issues * tag 'wireless-2025-09-11' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: nl80211: completely disable per-link stats for now wifi: virt_wifi: Fix page fault on connect wifi: cfg80211: Fix "no buffer space available" error in nl80211_get_station() for MLO wifi: iwlwifi: fix 130/1030 configs wifi: ath12k: fix WMI TLV header misalignment wifi: ath12k: Fix missing station power save configuration ==================== Link: https://patch.msgid.link/20250911100345.20025-3-johannes@sipsolutions.net Signed-off-by: Paolo Abeni commit 303010f4658cb134eb27cee88026fb5d065a48cd Author: Ulf Hansson Date: Tue Sep 9 13:11:24 2025 +0200 pmdomain: renesas: rmobile-sysc: Don't keep unused PM domains powered-on The recent changes to genpd makes a genpd OF provider that is powered-on at initialization to stay powered-on, until the ->sync_state() callback is invoked for it. This may not happen at all, if we wait for a consumer device to be probed, leading to wasting energy. There are ways to enforce the ->sync_state() callback to be invoked, through sysfs or via the probe-defer-timeout, but none of them in its current form are a good fit for rmobile-sysc PM domains. Let's therefore opt-out from this behaviour of genpd for now, by using the GENPD_FLAG_NO_STAY_ON. Link: https://lore.kernel.org/all/20250701114733.636510-1-ulf.hansson@linaro.org/ Reported-by: Geert Uytterhoeven Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state") Fixes: 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") Reviewed-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson commit d929e42deaf7e2d165ac702421d02eeb9d544c70 Author: Ulf Hansson Date: Tue Sep 9 13:11:23 2025 +0200 pmdomain: renesas: rcar-gen4-sysc: Don't keep unused PM domains powered-on The recent changes to genpd makes a genpd OF provider that is powered-on at initialization to stay powered-on, until the ->sync_state() callback is invoked for it. This may not happen at all, if we wait for a consumer device to be probed, leading to wasting energy. There are ways to enforce the ->sync_state() callback to be invoked, through sysfs or via the probe-defer-timeout, but none of them in its current form are a good fit for rcar-gen4-sysc PM domains. Let's therefore opt-out from this behaviour of genpd for now, by using the GENPD_FLAG_NO_STAY_ON. Link: https://lore.kernel.org/all/20250701114733.636510-1-ulf.hansson@linaro.org/ Reported-by: Geert Uytterhoeven Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state") Fixes: 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") Reviewed-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson commit 36bbaec460db0fb2f6d2641470b4a6f3891a492a Author: Ulf Hansson Date: Tue Sep 9 13:11:22 2025 +0200 pmdomain: renesas: rcar-sysc: Don't keep unused PM domains powered-on The recent changes to genpd makes a genpd OF provider that is powered-on at initialization to stay powered-on, until the ->sync_state() callback is invoked for it. This may not happen at all, if we wait for a consumer device to be probed, leading to wasting energy. There are ways to enforce the ->sync_state() callback to be invoked, through sysfs or via the probe-defer-timeout, but none of them in its current form are a good fit for rcar-sysc PM domains. Let's therefore opt-out from this behaviour of genpd for now, by using the GENPD_FLAG_NO_STAY_ON. Link: https://lore.kernel.org/all/20250701114733.636510-1-ulf.hansson@linaro.org/ Reported-by: Geert Uytterhoeven Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state") Fixes: 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") Reviewed-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson commit 2bc12a8199a0f954d003faa4ad8d100a0b19d85a Author: Ulf Hansson Date: Tue Sep 9 13:11:21 2025 +0200 pmdomain: rockchip: Fix regulator dependency with GENPD_FLAG_NO_STAY_ON The deferred regulator retrieval for Rockchip PM domains are causing some weird dependencies. More precisely, if the power-domain is powered-on from the HW perspective, its corresponding regulator must not be powered-off via regulator_init_complete(), which is a late_initcall_sync. Even on platforms that don't have the domain-supply regulator specified for the power-domain provider, may suffer from these problems. More precisely, things just happen to work before, because genpd_power_off_unused() (also a late_initcall_sync) managed to power-off the PM domain before regulator_init_complete() powered-off the regulator. Ideally this fragile dependency must be fixed properly for the Rockchip PM domains, but until then, let's fallback to the previous behaviour by using the GENPD_FLAG_NO_STAY_ON flag. Link: https://lore.kernel.org/all/20250902-rk3576-lockup-regression-v1-1-c4a0c9daeb00@collabora.com/ Reported-by: Nicolas Frattaroli Cc: Heiko Stuebner Cc: Sebastian Reichel Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state") Fixes: 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") Tested-by: Nicolas Frattaroli Tested-by: Heiko Stuebner Acked-by: Heiko Stuebner Signed-off-by: Ulf Hansson commit 002ebddd695a53999550e241b71950f1aa0e1ac4 Author: Ulf Hansson Date: Tue Sep 9 13:11:20 2025 +0200 pmdomain: core: Restore behaviour for disabling unused PM domains Recent changes to genpd prevents those PM domains being powered-on during initialization from being powered-off during the boot sequence. Based upon whether CONFIG_PM_CONFIG_PM_GENERIC_DOMAINS_OF is set of not, genpd relies on the sync_state mechanism or the genpd_power_off_unused() (which is a late_initcall_sync), to understand when it's okay to allow these PM domains to be powered-off. This new behaviour in genpd has lead to problems on different platforms. Let's therefore restore the behavior of genpd_power_off_unused(). Moreover, let's introduce GENPD_FLAG_NO_STAY_ON, to allow genpd OF providers to opt-out from the new behaviour. Link: https://lore.kernel.org/all/20250701114733.636510-1-ulf.hansson@linaro.org/ Reported-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/20250902-rk3576-lockup-regression-v1-1-c4a0c9daeb00@collabora.com/ Reported-by: Nicolas Frattaroli Fixes: 0e789b491ba0 ("pmdomain: core: Leave powered-on genpds on until sync_state") Fixes: 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") Tested-by: Heiko Stuebner Reviewed-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson commit 9b1fbd3539698e56b2616f9cd83ee1ef8b35a74f Merge: 3a1a66d124547f 847748fc66d08a Author: Paolo Abeni Date: Thu Sep 11 11:49:29 2025 +0200 Merge branch 'hsr-fix-lock-warnings' Hangbin Liu says: ==================== hsr: fix lock warnings hsr_for_each_port is called in many places without holding the RCU read lock, this may trigger warnings on debug kernels like: [ 40.457015] [ T201] WARNING: suspicious RCU usage [ 40.457020] [ T201] 6.17.0-rc2-virtme #1 Not tainted [ 40.457025] [ T201] ----------------------------- [ 40.457029] [ T201] net/hsr/hsr_main.c:137 RCU-list traversed in non-reader section!! [ 40.457036] [ T201] other info that might help us debug this: [ 40.457040] [ T201] rcu_scheduler_active = 2, debug_locks = 1 [ 40.457045] [ T201] 2 locks held by ip/201: [ 40.457050] [ T201] #0: ffffffff93040a40 (&ops->srcu){.+.+}-{0:0}, at: rtnl_link_ops_get+0xf2/0x280 [ 40.457080] [ T201] #1: ffffffff92e7f968 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x5e1/0xb20 [ 40.457102] [ T201] stack backtrace: [ 40.457108] [ T201] CPU: 2 UID: 0 PID: 201 Comm: ip Not tainted 6.17.0-rc2-virtme #1 PREEMPT(full) [ 40.457114] [ T201] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 40.457117] [ T201] Call Trace: [ 40.457120] [ T201] [ 40.457126] [ T201] dump_stack_lvl+0x6f/0xb0 [ 40.457136] [ T201] lockdep_rcu_suspicious.cold+0x4f/0xb1 [ 40.457148] [ T201] hsr_port_get_hsr+0xfe/0x140 [ 40.457158] [ T201] hsr_add_port+0x192/0x940 [ 40.457167] [ T201] ? __pfx_hsr_add_port+0x10/0x10 [ 40.457176] [ T201] ? lockdep_init_map_type+0x5c/0x270 [ 40.457189] [ T201] hsr_dev_finalize+0x4bc/0xbf0 [ 40.457204] [ T201] hsr_newlink+0x3c3/0x8f0 [ 40.457212] [ T201] ? __pfx_hsr_newlink+0x10/0x10 [ 40.457222] [ T201] ? rtnl_create_link+0x173/0xe40 [ 40.457233] [ T201] rtnl_newlink_create+0x2cf/0x750 [ 40.457243] [ T201] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 40.457247] [ T201] ? __dev_get_by_name+0x12/0x50 [ 40.457252] [ T201] ? rtnl_dev_get+0xac/0x140 [ 40.457259] [ T201] ? __pfx_rtnl_dev_get+0x10/0x10 [ 40.457285] [ T201] __rtnl_newlink+0x22c/0xa50 [ 40.457305] [ T201] rtnl_newlink+0x637/0xb20 Adding rcu_read_lock() for all hsr_for_each_port() looks confusing. Introduce a new helper, hsr_for_each_port_rtnl(), that assumes the RTNL lock is held. This allows callers in suitable contexts to iterate ports safely without explicit RCU locking. Other code paths that rely on RCU protection continue to use hsr_for_each_port() with rcu_read_lock(). ==================== Link: https://patch.msgid.link/20250905091533.377443-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 847748fc66d08a89135a74e29362a66ba4e3ab15 Author: Hangbin Liu Date: Fri Sep 5 09:15:33 2025 +0000 hsr: hold rcu and dev lock for hsr_get_port_ndev hsr_get_port_ndev calls hsr_for_each_port, which need to hold rcu lock. On the other hand, before return the port device, we need to hold the device reference to avoid UaF in the caller function. Suggested-by: Paolo Abeni Fixes: 9c10dd8eed74 ("net: hsr: Create and export hsr_get_port_ndev()") Signed-off-by: Hangbin Liu Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250905091533.377443-4-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 393c841fe4333cdd856d0ca37b066d72746cfaa6 Author: Hangbin Liu Date: Fri Sep 5 09:15:32 2025 +0000 hsr: use hsr_for_each_port_rtnl in hsr_port_get_hsr hsr_port_get_hsr() iterates over ports using hsr_for_each_port(), but many of its callers do not hold the required RCU lock. Switch to hsr_for_each_port_rtnl(), since most callers already hold the rtnl lock. After review, all callers are covered by either the rtnl lock or the RCU lock, except hsr_dev_xmit(). Fix this by adding an RCU read lock there. Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.") Signed-off-by: Hangbin Liu Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250905091533.377443-3-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 8884c693991333ae065830554b9b0c96590b1bb2 Author: Hangbin Liu Date: Fri Sep 5 09:15:31 2025 +0000 hsr: use rtnl lock when iterating over ports hsr_for_each_port is called in many places without holding the RCU read lock, this may trigger warnings on debug kernels. Most of the callers are actually hold rtnl lock. So add a new helper hsr_for_each_port_rtnl to allow callers in suitable contexts to iterate ports safely without explicit RCU locking. This patch only fixed the callers that is hold rtnl lock. Other caller issues will be fixed in later patches. Fixes: c5a759117210 ("net/hsr: Use list_head (and rcu) instead of array for slave devices.") Signed-off-by: Hangbin Liu Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250905091533.377443-2-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit c3f8d13357deab1e04f8a52b499d6b9b704e578e Author: Johannes Berg Date: Wed Sep 10 15:11:21 2025 +0200 wifi: nl80211: completely disable per-link stats for now After commit 8cc71fc3b82b ("wifi: cfg80211: Fix "no buffer space available" error in nl80211_get_station() for MLO"), the per-link data is only included in station dumps, where the size limit is somewhat less of an issue. However, it's still an issue, depending on how many links a station has and how much per-link data there is. Thus, for now, disable per-link statistics entirely. A complete fix will need to take this into account, make it opt-in by userspace, and change the dump format to be able to split a single station's data across multiple netlink dump messages, which all together is too much development for a fix. Fixes: 82d7f841d9bd ("wifi: cfg80211: extend to embed link level statistics in NL message") Signed-off-by: Johannes Berg commit 4f553c1e2c7b81e957b5463bd7efad2465a586f8 Merge: 223ba8ee0a3986 a68172d95c2845 Author: Linus Torvalds Date: Wed Sep 10 21:19:34 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-09-10-20-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "20 hotfixes. 15 are cc:stable and the remainder address post-6.16 issues or aren't considered necessary for -stable kernels. 14 of these fixes are for MM. This includes - kexec fixes from Breno for a recently introduced use-uninitialized bug - DAMON fixes from Quanmin Yan to avoid div-by-zero crashes which can occur if the operator uses poorly-chosen insmod parameters and misc singleton fixes" * tag 'mm-hotfixes-stable-2025-09-10-20-00' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: MAINTAINERS: add tree entry to numa memblocks and emulation block mm/damon/sysfs: fix use-after-free in state_show() proc: fix type confusion in pde_set_flags() compiler-clang.h: define __SANITIZE_*__ macros only when undefined mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() ocfs2: fix recursive semaphore deadlock in fiemap call mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory mm/mremap: fix regression in vrm->new_addr check percpu: fix race on alloc failed warning limit mm/memory-failure: fix redundant updates for already poisoned pages s390: kexec: initialize kexec_buf struct riscv: kexec: initialize kexec_buf struct arm64: kexec: initialize kexec_buf struct in load_other_segments() mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() mm/damon/core: set quota->charged_from to jiffies at first charge window mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() init/main.c: fix boot time tracing crash mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range() mm/khugepaged: fix the address passed to notifier on testing young commit 223ba8ee0a3986718c874b66ed24e7f87f6b8124 Merge: 7aac71907bdea1 8a68d64bb10334 Author: Linus Torvalds Date: Wed Sep 10 20:52:16 2025 -0700 Merge tag 'vmscape-for-linus-20250904' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull vmescape mitigation fixes from Dave Hansen: "Mitigate vmscape issue with indirect branch predictor flushes. vmscape is a vulnerability that essentially takes Spectre-v2 and attacks host userspace from a guest. It particularly affects hypervisors like QEMU. Even if a hypervisor may not have any sensitive data like disk encryption keys, guest-userspace may be able to attack the guest-kernel using the hypervisor as a confused deputy. There are many ways to mitigate vmscape using the existing Spectre-v2 defenses like IBRS variants or the IBPB flushes. This series focuses solely on IBPB because it works universally across vendors and all vulnerable processors. Further work doing vendor and model-specific optimizations can build on top of this if needed / wanted. Do the normal issue mitigation dance: - Add the CPU bug boilerplate - Add a list of vulnerable CPUs - Use IBPB to flush the branch predictors after running guests" * tag 'vmscape-for-linus-20250904' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/vmscape: Add old Intel CPUs to affected list x86/vmscape: Warn when STIBP is disabled with SMT x86/bugs: Move cpu_bugs_smt_update() down x86/vmscape: Enable the mitigation x86/vmscape: Add conditional IBPB mitigation x86/vmscape: Enumerate VMSCAPE bug Documentation/hw-vuln: Add VMSCAPE documentation commit a50342f976d25aace73ff551845ce89406f48f35 Author: Peng Fan Date: Fri Sep 5 11:01:09 2025 +0800 arm64: dts: imx8mp: Correct thermal sensor index The TMU has two temperature measurement sites located on the chip. The probe 0 is located inside of the ANAMIX, while the probe 1 is located near the ARM core. This has been confirmed by checking with HW design team and checking RTL code. So correct the {cpu,soc}-thermal sensor index. Fixes: 30cdd62dce6b ("arm64: dts: imx8mp: Add thermal zones support") Signed-off-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 3a1a66d124547f2a4896bf346a33ebe6eb301bf4 Merge: ccf78f7f05ce2f 37a9675e61a2a2 Author: Jakub Kicinski Date: Wed Sep 10 19:33:55 2025 -0700 Merge tag 'nf-25-09-10-v2' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westpha says: ==================== netfilter pull request nf-25-09-10 First patch adds a lockdep annotation for a false-positive splat. Last patch adds formal reviewer tag for Phil Sutter to MAINTAINERS. Rest of the patches resolve spurious false negative results during set lookups while another CPU is processing a transaction. This has been broken at least since v4.18 when an unconditional synchronize_rcu call was removed from the commit phase of nf_tables. Quoting from Stefan Hanreichs original report: It seems like we've found an issue with atomicity when reloading nftables rulesets. Sometimes there is a small window where rules containing sets do not seem to apply to incoming traffic, due to the set apparently being empty for a short amount of time when flushing / adding elements. Exanple ruleset: table ip filter { set match { type ipv4_addr flags interval elements = { 0.0.0.0-192.168.2.19, 192.168.2.21-255.255.255.255 } } chain pre { type filter hook prerouting priority filter; policy accept; ip saddr @match accept counter comment "must never match" } } Reproducer transaction: while true: nft -f -< commit ccf78f7f05ce2f5f18ab69b39e236292e384625c Merge: a2ddf8a51c86f4 5c793afa07da6d Author: Jakub Kicinski Date: Wed Sep 10 19:29:40 2025 -0700 Merge tag 'linux-can-fixes-for-6.17-20250910' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-09-10 The 1st patch is by Alex Tran and fixes the Documentation of the struct bcm_msg_head. Davide Caratti's patch enabled the VCAN driver as a module for the Linux self tests. Tetsuo Handa contributes 3 patches that fix various problems in the CAN j1939 protocol. Anssi Hannula's patch fixes a potential use-after-free in the xilinx_can driver. Geert Uytterhoeven's patch fixes the rcan_can's suspend to RAM on R-Car Gen3 using PSCI. * tag 'linux-can-fixes-for-6.17-20250910' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: rcar_can: rcar_can_resume(): fix s2ram with PSCI can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed can: j1939: implement NETDEV_UNREGISTER notification handler selftests: can: enable CONFIG_CAN_VCAN as a module docs: networking: can: change bcm_msg_head frames member to support flexible array ==================== Link: https://patch.msgid.link/20250910162907.948454-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit a2ddf8a51c86f461679fa7b6b335d492f978bd39 Merge: 5537a467940342 503f1c72c31bbe Author: Jakub Kicinski Date: Wed Sep 10 19:21:11 2025 -0700 Merge branch '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-09-09 (igb, i40e) For igb: Tianyu Xu removes passing of, no longer needed, NAPI id to avoid NULL pointer dereference on ethtool loopback testing. Kohei Enju corrects reporting/testing of link state when interface is down. For i40e: Michal Schmidt corrects value being passed to free_irq(). Jake sets hardware maximum frame size on probe to ensure expected/consistent state. * '1GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: i40e: fix Jumbo Frame support after iPXE boot i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path igb: fix link test skipping when interface is admin down igb: Fix NULL pointer dereference in ethtool loopback test ==================== Link: https://patch.msgid.link/20250909203236.3603960-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit d79c3eb59780369e57fc9cd325c703e4f3c55210 Author: Lukas Bulwahn Date: Tue Aug 26 11:29:01 2025 +0200 ARM: imx: Kconfig: Adjust select after renamed config option Commit 3f490a74a8a1 ("clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT") renames the config VF_PIT_TIMER to NXP_PIT_TIMER, but it misses adjusting a reference to VF_PIT_TIMER in arch/arm/mach-imx/Kconfig. Adjust the config reference to the new name. Fixes: 3f490a74a8a1 ("clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT") Signed-off-by: Lukas Bulwahn Signed-off-by: Shawn Guo commit 222accf05fc42f68ae02065d9c1542c20315118b Author: Peng Fan Date: Mon Aug 25 15:00:32 2025 +0800 firmware: imx: Add stub functions for SCMI CPU API To ensure successful builds when CONFIG_IMX_SCMI_CPU_DRV is not enabled, this patch adds static inline stub implementations for the following functions: - scmi_imx_cpu_start() - scmi_imx_cpu_started() - scmi_imx_cpu_reset_vector_set() These stubs return -EOPNOTSUPP to indicate that the functionality is not supported in the current configuration. This avoids potential build or link errors in code that conditionally calls these functions based on feature availability. Fixes: 1055faa5d660 ("firmware: imx: Add i.MX95 SCMI CPU driver") Reviewed-by: Cristian Marussi Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 3fb91b5c86d0fb5ff6f65c30a4f20193166e22fe Author: Peng Fan Date: Mon Aug 25 15:00:31 2025 +0800 firmware: imx: Add stub functions for SCMI LMM API To ensure successful builds when CONFIG_IMX_SCMI_LMM_DRV is not enabled, this patch adds static inline stub implementations for the following functions: - scmi_imx_lmm_operation() - scmi_imx_lmm_info() - scmi_imx_lmm_reset_vector_set() These stubs return -EOPNOTSUPP to indicate that the functionality is not supported in the current configuration. This avoids potential build or link errors in code that conditionally calls these functions based on feature availability. Fixes: 7242bbf418f0 ("firmware: imx: Add i.MX95 SCMI LMM driver") Reviewed-by: Cristian Marussi Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit b2461e20fa9ac18b1305bba5bc7e22ebf644ea01 Author: Peng Fan Date: Mon Aug 25 15:00:30 2025 +0800 firmware: imx: Add stub functions for SCMI MISC API To ensure successful builds when CONFIG_IMX_SCMI_MISC_DRV is not enabled, this patch adds static inline stub implementations for the following functions: - scmi_imx_misc_ctrl_get() - scmi_imx_misc_ctrl_set() These stubs return -EOPNOTSUPP to indicate that the functionality is not supported in the current configuration. This avoids potential build or link errors in code that conditionally calls these functions based on feature availability. This patch also drops the changes in commit 540c830212ed ("firmware: imx: remove duplicate scmi_imx_misc_ctrl_get()"). The original change aimed to simplify the handling of optional features by removing conditional stubs. However, the use of conditional stubs is necessary when CONFIG_IMX_SCMI_MISC_DRV is n, while consumer driver is set to y. This is not a matter of preserving legacy patterns, but rather to ensure that there is no link error whether for module or built-in. Fixes: 0b4f8a68b292 ("firmware: imx: Add i.MX95 MISC driver") Reviewed-by: Cristian Marussi Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 5537a4679403423e0b49c95b619983a4583d69c5 Author: Oleksij Rempel Date: Mon Sep 8 13:26:19 2025 +0200 net: usb: asix: ax88772: drop phylink use in PM to avoid MDIO runtime PM wakeups Drop phylink_{suspend,resume}() from ax88772 PM callbacks. MDIO bus accesses have their own runtime-PM handling and will try to wake the device if it is suspended. Such wake attempts must not happen from PM callbacks while the device PM lock is held. Since phylink {sus|re}sume may trigger MDIO, it must not be called in PM context. No extra phylink PM handling is required for this driver: - .ndo_open/.ndo_stop control the phylink start/stop lifecycle. - ethtool/phylib entry points run in process context, not PM. - phylink MAC ops program the MAC on link changes after resume. Fixes: e0bffe3e6894 ("net: asix: ax88772: migrate to phylink") Reported-by: Hubert Wiśniewski Cc: stable@vger.kernel.org Signed-off-by: Oleksij Rempel Tested-by: Hubert Wiśniewski Tested-by: Xu Yang Link: https://patch.msgid.link/20250908112619.2900723-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 6fef6ae764be8a77f61ad3b6937ba82fe8358045 Author: Russell King (Oracle) Date: Sun Sep 7 21:43:20 2025 +0100 net: ethtool: fix wrong type used in struct kernel_ethtool_ts_info In C, enumerated types do not have a defined size, apart from being compatible with one of the standard types. This allows an ABI / compiler to choose the type of an enum depending on the values it needs to store, and storing larger values in it can lead to undefined behaviour. The tx_type and rx_filters members of struct kernel_ethtool_ts_info are defined as enumerated types, but are bit arrays, where each bit is defined by the enumerated type. This means they typically store values in excess of the maximum value of the enumerated type, in fact (1 << max_value) and thus must not be declared using the enumated type. Fix both of these to use u32, as per the corresponding __u32 UAPI type. Fixes: 2111375b85ad ("net: Add struct kernel_ethtool_ts_info") Signed-off-by: Russell King (Oracle) Reviewed-by: Kory Maincent Link: https://patch.msgid.link/E1uvMEK-00000003Amd-2pWR@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7aac71907bdea16e2754a782b9d9155449a9d49d Merge: 1b5d4661c7ee79 dd2fa824734536 Author: Linus Torvalds Date: Wed Sep 10 12:38:41 2025 -0700 Merge tag 'nfs-for-6.17-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client fixes from Trond Myklebust: "Stable patches: - Revert "SUNRPC: Don't allow waiting for exiting tasks" as it is breaking ltp tests Bugfixes: - Another set of fixes to the tracking of NFSv4 server capabilities when crossing filesystem boundaries - Localio fix to restore credentials and prevent triggering a BUG_ON() - Fix to prevent flapping of the localio on/off trigger - Protections against 'eof page pollution' as demonstrated in xfstests generic/363 - Series of patches to ensure correct ordering of O_DIRECT i/o and truncate, fallocate and copy functions - Fix a NULL pointer check in flexfiles reads that regresses 6.17 - Correct a typo that breaks flexfiles layout segment processing" * tag 'nfs-for-6.17-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFSv4/flexfiles: Fix layout merge mirror check. SUNRPC: call xs_sock_process_cmsg for all cmsg Revert "SUNRPC: Don't allow waiting for exiting tasks" NFS: Fix the marking of the folio as up to date NFS: nfs_invalidate_folio() must observe the offset and size arguments NFSv4.2: Serialise O_DIRECT i/o and copy range NFSv4.2: Serialise O_DIRECT i/o and clone range NFSv4.2: Serialise O_DIRECT i/o and fallocate() NFS: Serialise O_DIRECT i/o and truncate() NFSv4.2: Protect copy offload and clone against 'eof page pollution' NFS: Protect against 'eof page pollution' flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read nfs/localio: avoid bouncing LOCALIO if nfs_client_is_local() nfs/localio: restore creds before releasing pageio data NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set NFSv4: Don't clear capabilities that won't be reset commit 91f34aaae06e425e4644afde92ddff949b6abb54 Merge: a3967baad4d533 fbdd61c94bcb09 Author: Alexei Starovoitov Date: Wed Sep 10 12:34:09 2025 -0700 Merge branch 'bpf-reject-bpf_timer-for-preempt_rt' Leon Hwang says: ==================== bpf: Reject bpf_timer for PREEMPT_RT While running './test_progs -t timer' to validate the test case from "selftests/bpf: Introduce experimental bpf_in_interrupt()"[0] for PREEMPT_RT, I encountered a kernel warning: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 To address this, reject bpf_timer usage in the verifier when PREEMPT_RT is enabled, and skip the corresponding timer selftests. Changes: v2 -> v3: * Drop skipping test case 'timer_interrupt'. * Address comments from Alexei: * Respin targeting bpf tree. * Trim commit log. v1 -> v2: * Skip test case 'timer_interrupt'. Links: [0] https://lore.kernel.org/bpf/20250903140438.59517-1-leon.hwang@linux.dev/ ==================== Link: https://patch.msgid.link/20250910125740.52172-1-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit fbdd61c94bcb09b0c0eb0655917bf4193d07aac1 Author: Leon Hwang Date: Wed Sep 10 20:57:40 2025 +0800 selftests/bpf: Skip timer cases when bpf_timer is not supported When enable CONFIG_PREEMPT_RT, verifier will reject bpf_timer with returning -EOPNOTSUPP. Therefore, skip test cases when errno is EOPNOTSUPP. cd tools/testing/selftests/bpf ./test_progs -t timer 125 free_timer:SKIP 456 timer:SKIP 457/1 timer_crash/array:SKIP 457/2 timer_crash/hash:SKIP 457 timer_crash:SKIP 458 timer_lockup:SKIP 459 timer_mim:SKIP Summary: 5/0 PASSED, 6 SKIPPED, 0 FAILED Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20250910125740.52172-3-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit e25ddfb388c8b7e5f20e3bf38d627fb485003781 Author: Leon Hwang Date: Wed Sep 10 20:57:39 2025 +0800 bpf: Reject bpf_timer for PREEMPT_RT When enable CONFIG_PREEMPT_RT, the kernel will warn when run timer selftests by './test_progs -t timer': BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 In order to avoid such warning, reject bpf_timer in verifier when PREEMPT_RT is enabled. Signed-off-by: Leon Hwang Link: https://lore.kernel.org/r/20250910125740.52172-2-leon.hwang@linux.dev Signed-off-by: Alexei Starovoitov commit cdbc9836c7afadad68f374791738f118263c5371 Author: Ilya Dryomov Date: Thu Jul 3 12:10:50 2025 +0200 libceph: fix invalid accesses to ceph_connection_v1_info There is a place where generic code in messenger.c is reading and another place where it is writing to con->v1 union member without checking that the union member is active (i.e. msgr1 is in use). On 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter, so such a read is almost guaranteed to return a bogus value instead of 0 when msgr2 is in use. This ends up being fairly benign because the side effect is just the invalidation of the authorizer and successive fetching of new tickets. con->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that it's being written to can cause more serious consequences, but luckily it's not something that happens often. Cc: stable@vger.kernel.org Fixes: cd1a677cad99 ("libceph, ceph: implement msgr2.1 protocol (crc and secure modes)") Signed-off-by: Ilya Dryomov Reviewed-by: Viacheslav Dubeyko commit d02e48830e3fce9701265f6c5a58d9bdaf906a76 Author: Maciej S. Szmigiero Date: Mon Aug 25 18:44:28 2025 +0200 KVM: SVM: Sync TPR from LAPIC into VMCB::V_TPR even if AVIC is active Commit 3bbf3565f48c ("svm: Do not intercept CR8 when enable AVIC") inhibited pre-VMRUN sync of TPR from LAPIC into VMCB::V_TPR in sync_lapic_to_cr8() when AVIC is active. AVIC does automatically sync between these two fields, however it does so only on explicit guest writes to one of these fields, not on a bare VMRUN. This meant that when AVIC is enabled host changes to TPR in the LAPIC state might not get automatically copied into the V_TPR field of VMCB. This is especially true when it is the userspace setting LAPIC state via KVM_SET_LAPIC ioctl() since userspace does not have access to the guest VMCB. Practice shows that it is the V_TPR that is actually used by the AVIC to decide whether to issue pending interrupts to the CPU (not TPR in TASKPRI), so any leftover value in V_TPR will cause serious interrupt delivery issues in the guest when AVIC is enabled. Fix this issue by doing pre-VMRUN TPR sync from LAPIC into VMCB::V_TPR even when AVIC is enabled. Fixes: 3bbf3565f48c ("svm: Do not intercept CR8 when enable AVIC") Cc: stable@vger.kernel.org Signed-off-by: Maciej S. Szmigiero Reviewed-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/c231be64280b1461e854e1ce3595d70cde3a2e9d.1756139678.git.maciej.szmigiero@oracle.com [sean: tag for stable@] Signed-off-by: Sean Christopherson commit 1b5d4661c7ee7937d062a00bd336761a237870b4 Merge: 9dd1835ecda5b9 cd4453c5e983cf Author: Linus Torvalds Date: Wed Sep 10 12:03:47 2025 -0700 Merge tag 'trace-v6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Remove redundant __GFP_NOWARN flag is kmalloc As now __GFP_NOWARN is part of __GFP_NOWAIT, it can be removed from kmalloc as it is redundant. - Use copy_from_user_nofault() instead of _inatomic() for trace markers The trace_marker files are written to to allow user space to quickly write into the tracing ring buffer. Back in 2016, the get_user_pages_fast() and the kmap() logic was replaced by a __copy_from_user_inatomic(), but didn't properly disable page faults around it. Since the time this was added, copy_from_user_nofault() was added which does the required page fault disabling for us. - Fix the assembly markup in the ftrace direct sample code The ftrace direct sample code (which is also used for selftests), had the size directive between the "leave" and the "ret" instead of after the ret. This caused objtool to think the code was unreachable. - Only call unregister_pm_notifier() on outer most fgraph registration There was an error path in register_ftrace_graph() that did not call unregister_pm_notifier() on error, so it was added in the error path. The problem with that fix, is that register_pm_notifier() is only called by the initial user of fgraph. If that succeeds, but another fgraph registration were to fail, then unregister_pm_notifier() would be called incorrectly. - Fix a crash in osnoise when zero size cpumask is passed in If a zero size CPU mask is passed in, the kmalloc() would return ZERO_SIZE_PTR which is not checked, and the code would continue thinking it had real memory and crash. If zero is passed in as the size of the write, simply return 0. - Fix possible warning in trace_pid_write() If while processing a series of numbers passed to the "set_event_pid" file, and one of the updates fails to allocate (triggered by a fault injection), it can cause a warning to trigger. Check the return value of the call to trace_pid_list_set() and break out early with an error code if it fails. * tag 'trace-v6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Silence warning when chunk allocation fails in trace_pid_write tracing/osnoise: Fix null-ptr-deref in bitmap_parselist() trace/fgraph: Fix error handling ftrace/samples: Fix function size computation tracing: Fix tracing_marker may trigger page fault during preempt_disable trace: Remove redundant __GFP_NOWARN commit 449c9c02537a146ac97ef962327a221e21c9cab3 Author: Rafael J. Wysocki Date: Wed Sep 10 11:41:59 2025 +0200 PM: hibernate: Restrict GFP mask in hibernation_snapshot() Commit 12ffc3b1513e ("PM: Restrict swap use to later in the suspend sequence") incorrectly removed a pm_restrict_gfp_mask() call from hibernation_snapshot(), so memory allocations involving swap are not prevented from being carried out in this code path any more which may lead to serious breakage. The symptoms of such breakage have become visible after adding a shrink_shmem_memory() call to hibernation_snapshot() in commit 2640e819474f ("PM: hibernate: shrink shmem pages after dev_pm_ops.prepare()") which caused this problem to be much more likely to manifest itself. However, since commit 2640e819474f was initially present in the DRM tree that did not include commit 12ffc3b1513e, the symptoms of this issue were not visible until merge commit 260f6f4fda93 ("Merge tag 'drm-next-2025-07-30' of https://gitlab.freedesktop.org/drm/kernel") that exposed it through an entirely reasonable merge conflict resolution. Fixes: 12ffc3b1513e ("PM: Restrict swap use to later in the suspend sequence") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220555 Reported-by: Todd Brandt Tested-by: Todd Brandt Cc: 6.16+ # 6.16+ Signed-off-by: Rafael J. Wysocki Reviewed-by: Mario Limonciello (AMD) commit 37a9675e61a2a2a721a28043ffdf2c8ec81eba37 Author: Florian Westphal Date: Tue Sep 9 23:52:31 2025 +0200 MAINTAINERS: add Phil as netfilter reviewer Phil has contributed to netfilter with features, fixes and patch reviews for a long time. Make this more formal and add Reviewer tag. Acked-by: Jozsef Kadlecsik Acked-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit b2f742c846cab9afc5953a5d8f17b54922dcc723 Author: Florian Westphal Date: Wed Sep 10 10:02:22 2025 +0200 netfilter: nf_tables: restart set lookup on base_seq change The hash, hash_fast, rhash and bitwise sets may indicate no result even though a matching element exists during a short time window while other cpu is finalizing the transaction. This happens when the hash lookup/bitwise lookup function has picked up the old genbit, right before it was toggled by nf_tables_commit(), but then the same cpu managed to unlink the matching old element from the hash table: cpu0 cpu1 has added new elements to clone has marked elements as being inactive in new generation perform lookup in the set enters commit phase: A) observes old genbit increments base_seq I) increments the genbit II) removes old element from the set B) finds matching element C) returns no match: found element is not valid in old generation Next lookup observes new genbit and finds matching e2. Consider a packet matching element e1, e2. cpu0 processes following transaction: 1. remove e1 2. adds e2, which has same key as e1. P matches both e1 and e2. Therefore, cpu1 should always find a match for P. Due to above race, this is not the case: cpu1 observed the old genbit. e2 will not be considered once it is found. The element e1 is not found anymore if cpu0 managed to unlink it from the hlist before cpu1 found it during list traversal. The situation only occurs for a brief time period, lookups happening after I) observe new genbit and return e2. This problem exists in all set types except nft_set_pipapo, so fix it once in nft_lookup rather than each set ops individually. Sample the base sequence counter, which gets incremented right before the genbit is changed. Then, if no match is found, retry the lookup if the base sequence was altered in between. If the base sequence hasn't changed: - No update took place: no-match result is expected. This is the common case. or: - nf_tables_commit() hasn't progressed to genbit update yet. Old elements were still visible and nomatch result is expected, or: - nf_tables_commit updated the genbit: We picked up the new base_seq, so the lookup function also picked up the new genbit, no-match result is expected. If the old genbit was observed, then nft_lookup also picked up the old base_seq: nft_lookup_should_retry() returns true and relookup is performed in the new generation. This problem was added when the unconditional synchronize_rcu() call that followed the current/next generation bit toggle was removed. Thanks to Pablo Neira Ayuso for reviewing an earlier version of this patchset, for suggesting re-use of existing base_seq and placement of the restart loop in nft_set_do_lookup(). Fixes: 0cbc06b3faba ("netfilter: nf_tables: remove synchronize_rcu in commit phase") Signed-off-by: Florian Westphal commit 11fe5a82e53ac3581a80c88e0e35fb8a80e15f48 Author: Florian Westphal Date: Wed Sep 10 10:02:21 2025 +0200 netfilter: nf_tables: make nft_set_do_lookup available unconditionally This function was added for retpoline mitigation and is replaced by a static inline helper if mitigations are not enabled. Enable this helper function unconditionally so next patch can add a lookup restart mechanism to fix possible false negatives while transactions are in progress. Adding lookup restarts in nft_lookup_eval doesn't work as nft_objref would then need the same copypaste loop. This patch is separate to ease review of the actual bug fix. Suggested-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit 64102d9bbc3d41dac5188b8fba75b1344c438970 Author: Florian Westphal Date: Wed Sep 10 10:02:20 2025 +0200 netfilter: nf_tables: place base_seq in struct net This will soon be read from packet path around same time as the gencursor. Both gencursor and base_seq get incremented almost at the same time, so it makes sense to place them in the same structure. This doesn't increase struct net size on 64bit due to padding. Signed-off-by: Florian Westphal commit a60f7bf4a1524d8896b76ba89623080aebf44272 Author: Florian Westphal Date: Wed Sep 10 10:02:19 2025 +0200 netfilter: nft_set_rbtree: continue traversal if element is inactive When the rbtree lookup function finds a match in the rbtree, it sets the range start interval to a potentially inactive element. Then, after tree lookup, if the matching element is inactive, it returns NULL and suppresses a matching result. This is wrong and leads to false negative matches when a transaction has already entered the commit phase. cpu0 cpu1 has added new elements to clone has marked elements as being inactive in new generation perform lookup in the set enters commit phase: I) increments the genbit A) observes new genbit B) finds matching range C) returns no match: found range invalid in new generation II) removes old elements from the tree C New nft_lookup happening now will find matching element, because it is no longer obscured by old, inactive one. Consider a packet matching range r1-r2: cpu0 processes following transaction: 1. remove r1-r2 2. add r1-r3 P is contained in both ranges. Therefore, cpu1 should always find a match for P. Due to above race, this is not the case: cpu1 does find r1-r2, but then ignores it due to the genbit indicating the range has been removed. It does NOT test for further matches. The situation persists for all lookups until after cpu0 hits II) after which r1-r3 range start node is tested for the first time. Move the "interval start is valid" check ahead so that tree traversal continues if the starting interval is not valid in this generation. Thanks to Stefan Hanreich for providing an initial reproducer for this bug. Reported-by: Stefan Hanreich Fixes: c1eda3c6394f ("netfilter: nft_rbtree: ignore inactive matching element with no descendants") Signed-off-by: Florian Westphal commit c4eaca2e1052adfd67bed0a36a9d4b8e515666e4 Author: Florian Westphal Date: Wed Sep 10 10:02:18 2025 +0200 netfilter: nft_set_pipapo: don't check genbit from packetpath lookups The pipapo set type is special in that it has two copies of its datastructure: one live copy containing only valid elements and one on-demand clone used during transaction where adds/deletes happen. This clone is not visible to the datapath. This is unlike all other set types in nftables, those all link new elements into their live hlist/tree. For those sets, the lookup functions must skip the new elements while the transaction is ongoing to ensure consistency. As the clone is shallow, removal does have an effect on the packet path: once the transaction enters the commit phase the 'gencursor' bit that determines which elements are active and which elements should be ignored (because they are no longer valid) is flipped. This causes the datapath lookup to ignore these elements if they are found during lookup. This opens up a small race window where pipapo has an inconsistent view of the dataset from when the transaction-cpu flipped the genbit until the transaction-cpu calls nft_pipapo_commit() to swap live/clone pointers: cpu0 cpu1 has added new elements to clone has marked elements as being inactive in new generation perform lookup in the set enters commit phase: I) increments the genbit A) observes new genbit removes elements from the clone so they won't be found anymore B) lookup in datastructure can't see new elements yet, but old elements are ignored -> Only matches elements that were not changed in the transaction II) calls nft_pipapo_commit(), clone and live pointers are swapped. C New nft_lookup happening now will find matching elements. Consider a packet matching range r1-r2: cpu0 processes following transaction: 1. remove r1-r2 2. add r1-r3 P is contained in both ranges. Therefore, cpu1 should always find a match for P. Due to above race, this is not the case: cpu1 does find r1-r2, but then ignores it due to the genbit indicating the range has been removed. At the same time, r1-r3 is not visible yet, because it can only be found in the clone. The situation persists for all lookups until after cpu0 hits II). The fix is easy: Don't check the genbit from pipapo lookup functions. This is possible because unlike the other set types, the new elements are not reachable from the live copy of the dataset. The clone/live pointer swap is enough to avoid matching on old elements while at the same time all new elements are exposed in one go. After this change, step B above returns a match in r1-r2. This is fine: r1-r2 only becomes truly invalid the moment they get freed. This happens after a synchronize_rcu() call and rcu read lock is held via netfilter hook traversal (nf_hook_slow()). Cc: Stefano Brivio Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges") Signed-off-by: Florian Westphal commit 5e13f2c491a4100d208e77e92fe577fe3dbad6c2 Author: Florian Westphal Date: Tue Sep 9 14:45:21 2025 +0200 netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation Running new 'set_flush_add_atomic_bitmap' test case for nftables.git with CONFIG_PROVE_RCU_LIST=y yields: net/netfilter/nft_set_bitmap.c:231 RCU-list traversed in non-reader section!! rcu_scheduler_active = 2, debug_locks = 1 1 lock held by nft/4008: #0: ffff888147f79cd8 (&nft_net->commit_mutex){+.+.}-{4:4}, at: nf_tables_valid_genid+0x2f/0xd0 lockdep_rcu_suspicious+0x116/0x160 nft_bitmap_walk+0x22d/0x240 nf_tables_delsetelem+0x1010/0x1a00 .. This is a false positive, the list cannot be altered while the transaction mutex is held, so pass the relevant argument to the iterator. Fixes tag intentionally wrong; no point in picking this up if earlier false-positive-fixups were not applied. Fixes: 28b7a6b84c0a ("netfilter: nf_tables: avoid false-positive lockdep splats in set walker") Signed-off-by: Florian Westphal commit e6157256ee1a6a500da42556e059d4dec2ade871 Author: Oliver Upton Date: Wed Sep 10 11:09:29 2025 -0700 Revert "KVM: arm64: Split kvm_pgtable_stage2_destroy()" This reverts commit 0e89ca13ee5ff41b437bb2a003c0eaf34ea43555. The functional change that depended on this refactoring has been found to be quite problematic. Reverting the whole pile to start fresh when new fixes are available. Message-ID: <20250910180930.3679473-3-oliver.upton@linux.dev> Signed-off-by: Oliver Upton commit fc670ad5966f999b970b2767f55ce9e978e44d9c Author: Oliver Upton Date: Wed Sep 10 11:09:28 2025 -0700 Revert "KVM: arm64: Reschedule as needed when destroying the stage-2 page-tables" This reverts commit e9abe311f35631a999fe38c86f26f0e48ffe46d5. syzkaller has managed to tease out multiple bugs in this change and fixing-forward didn't remedy the situation. Considering newly-introduced memory safety issues the potential for scheduler stalls don't seem that bad in comparison Link: https://lore.kernel.org/kvmarm/68c09802.050a0220.3c6139.000d.GAE@google.com/ Message-ID: <20250910180930.3679473-2-oliver.upton@linux.dev> Signed-off-by: Oliver Upton commit 25fbbaf515acd13399589bd5ee6de5f35740cef2 Author: Chen-Yu Tsai Date: Sun Aug 31 01:08:56 2025 +0800 clk: sunxi-ng: mp: Fix dual-divider clock rate readback When dual-divider clock support was introduced, the P divider offset was left out of the .recalc_rate readback function. This causes the clock rate to become bogus or even zero (possibly due to the P divider being 1, leading to a divide-by-zero). Fix this by incorporating the P divider offset into the calculation. Fixes: 45717804b75e ("clk: sunxi-ng: mp: introduce dual-divider clock") Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250830170901.1996227-4-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 5c793afa07da6d2d4595f6c73a2a543a471bb055 Author: Geert Uytterhoeven Date: Thu Aug 14 13:26:37 2025 +0200 can: rcar_can: rcar_can_resume(): fix s2ram with PSCI On R-Car Gen3 using PSCI, s2ram powers down the SoC. After resume, the CAN interface no longer works, until it is brought down and up again. Fix this by calling rcar_can_start() from the PM resume callback, to fully initialize the controller instead of just restarting it. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/699b2f7fcb60b31b6f976a37f08ce99c5ffccb31.1755165227.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit ef79f00be72bd81d2e1e6f060d83cf7e425deee4 Author: Anssi Hannula Date: Fri Aug 22 12:50:02 2025 +0300 can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB can_put_echo_skb() takes ownership of the SKB and it may be freed during or after the call. However, xilinx_can xcan_write_frame() keeps using SKB after the call. Fix that by only calling can_put_echo_skb() after the code is done touching the SKB. The tx_lock is held for the entire xcan_write_frame() execution and also on the can_get_echo_skb() side so the order of operations does not matter. An earlier fix commit 3d3c817c3a40 ("can: xilinx_can: Fix usage of skb memory") did not move the can_put_echo_skb() call far enough. Signed-off-by: Anssi Hannula Fixes: 1598efe57b3e ("can: xilinx_can: refactor code in preparation for CAN FD support") Link: https://patch.msgid.link/20250822095002.168389-1-anssi.hannula@bitwise.fi [mkl: add "commit" in front of sha1 in patch description] [mkl: fix indention] Signed-off-by: Marc Kleine-Budde commit 06e02da29f6f1a45fc07bd60c7eaf172dc21e334 Author: Tetsuo Handa Date: Sun Aug 24 19:27:40 2025 +0900 can: j1939: j1939_local_ecu_get(): undo increment when j1939_local_ecu_get() fails Since j1939_sk_bind() and j1939_sk_release() call j1939_local_ecu_put() when J1939_SOCK_BOUND was already set, but the error handling path for j1939_sk_bind() will not set J1939_SOCK_BOUND when j1939_local_ecu_get() fails, j1939_local_ecu_get() needs to undo priv->ents[sa].nusers++ when j1939_local_ecu_get() returns an error. Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Signed-off-by: Tetsuo Handa Tested-by: Oleksij Rempel Acked-by: Oleksij Rempel Link: https://patch.msgid.link/e7f80046-4ff7-4ce2-8ad8-7c3c678a42c9@I-love.SAKURA.ne.jp Signed-off-by: Marc Kleine-Budde commit f214744c8a27c3c1da6b538c232da22cd027530e Author: Tetsuo Handa Date: Sun Aug 24 19:30:09 2025 +0900 can: j1939: j1939_sk_bind(): call j1939_priv_put() immediately when j1939_local_ecu_get() failed Commit 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct callback") expects that a call to j1939_priv_put() can be unconditionally delayed until j1939_sk_sock_destruct() is called. But a refcount leak will happen when j1939_sk_bind() is called again after j1939_local_ecu_get() from previous j1939_sk_bind() call returned an error. We need to call j1939_priv_put() before j1939_sk_bind() returns an error. Fixes: 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct callback") Signed-off-by: Tetsuo Handa Tested-by: Oleksij Rempel Acked-by: Oleksij Rempel Link: https://patch.msgid.link/4f49a1bc-a528-42ad-86c0-187268ab6535@I-love.SAKURA.ne.jp Signed-off-by: Marc Kleine-Budde commit 7fcbe5b2c6a4b5407bf2241fdb71e0a390f6ab9a Author: Tetsuo Handa Date: Mon Aug 25 23:07:24 2025 +0900 can: j1939: implement NETDEV_UNREGISTER notification handler syzbot is reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 problem, for j1939 protocol did not have NETDEV_UNREGISTER notification handler for undoing changes made by j1939_sk_bind(). Commit 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct callback") expects that a call to j1939_priv_put() can be unconditionally delayed until j1939_sk_sock_destruct() is called. But we need to call j1939_priv_put() against an extra ref held by j1939_sk_bind() call (as a part of undoing changes made by j1939_sk_bind()) as soon as NETDEV_UNREGISTER notification fires (i.e. before j1939_sk_sock_destruct() is called via j1939_sk_release()). Otherwise, the extra ref on "struct j1939_priv" held by j1939_sk_bind() call prevents "struct net_device" from dropping the usage count to 1; making it impossible for unregister_netdevice() to continue. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=881d65229ca4f9ae8c84 Tested-by: syzbot Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Fixes: 25fe97cb7620 ("can: j1939: move j1939_priv_put() into sk_destruct callback") Signed-off-by: Tetsuo Handa Tested-by: Oleksij Rempel Acked-by: Oleksij Rempel Link: https://patch.msgid.link/ac9db9a4-6c30-416e-8b94-96e6559d55b2@I-love.SAKURA.ne.jp [mkl: remove space in front of label] Signed-off-by: Marc Kleine-Budde commit d013ebc3499fd87cb9dee1dafd0c58aeb05c27c1 Author: Davide Caratti Date: Wed Sep 10 16:56:06 2025 +0200 selftests: can: enable CONFIG_CAN_VCAN as a module A proper kernel configuration for running kselftest can be obtained with: $ yes | make kselftest-merge Build of 'vcan' driver is currently missing, while the other required knobs are already there because of net/link_netns.py [1]. Add a config file in selftests/net/can to store the minimum set of kconfig needed for CAN selftests. [1] https://patch.msgid.link/20250219125039.18024-14-shaw.leon@gmail.com Fixes: 77442ffa83e8 ("selftests: can: Import tst-filter from can-tests") Reviewed-by: Vincent Mailhol Signed-off-by: Davide Caratti Link: https://patch.msgid.link/fa4c0ea262ec529f25e5f5aa9269d84764c67321.1757516009.git.dcaratti@redhat.com Signed-off-by: Marc Kleine-Budde commit a3967baad4d533dc254c31e0d221e51c8d223d58 Author: Kuniyuki Iwashima Date: Tue Sep 9 23:26:12 2025 +0000 tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. syzbot reported the splat below. [0] The repro does the following: 1. Load a sk_msg prog that calls bpf_msg_cork_bytes(msg, cork_bytes) 2. Attach the prog to a SOCKMAP 3. Add a socket to the SOCKMAP 4. Activate fault injection 5. Send data less than cork_bytes At 5., the data is carried over to the next sendmsg() as it is smaller than the cork_bytes specified by bpf_msg_cork_bytes(). Then, tcp_bpf_send_verdict() tries to allocate psock->cork to hold the data, but this fails silently due to fault injection + __GFP_NOWARN. If the allocation fails, we need to revert the sk->sk_forward_alloc change done by sk_msg_alloc(). Let's call sk_msg_free() when tcp_bpf_send_verdict fails to allocate psock->cork. The "*copied" also needs to be updated such that a proper error can be returned to the caller, sendmsg. It fails to allocate psock->cork. Nothing has been corked so far, so this patch simply sets "*copied" to 0. [0]: WARNING: net/ipv4/af_inet.c:156 at inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156, CPU#1: syz-executor/5983 Modules linked in: CPU: 1 UID: 0 PID: 5983 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:inet_sock_destruct+0x623/0x730 net/ipv4/af_inet.c:156 Code: 0f 0b 90 e9 62 fe ff ff e8 7a db b5 f7 90 0f 0b 90 e9 95 fe ff ff e8 6c db b5 f7 90 0f 0b 90 e9 bb fe ff ff e8 5e db b5 f7 90 <0f> 0b 90 e9 e1 fe ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 9f fc RSP: 0018:ffffc90000a08b48 EFLAGS: 00010246 RAX: ffffffff8a09d0b2 RBX: dffffc0000000000 RCX: ffff888024a23c80 RDX: 0000000000000100 RSI: 0000000000000fff RDI: 0000000000000000 RBP: 0000000000000fff R08: ffff88807e07c627 R09: 1ffff1100fc0f8c4 R10: dffffc0000000000 R11: ffffed100fc0f8c5 R12: ffff88807e07c380 R13: dffffc0000000000 R14: ffff88807e07c60c R15: 1ffff1100fc0f872 FS: 00005555604c4500(0000) GS:ffff888125af1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555604df5c8 CR3: 0000000032b06000 CR4: 00000000003526f0 Call Trace: __sk_destruct+0x86/0x660 net/core/sock.c:2339 rcu_do_batch kernel/rcu/tree.c:2605 [inline] rcu_core+0xca8/0x1770 kernel/rcu/tree.c:2861 handle_softirqs+0x286/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052 Fixes: 4f738adba30a ("bpf: create tcp_bpf_ulp allowing BPF to monitor socket TX/RX data") Reported-by: syzbot+4cabd1d2fa917a456db8@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68c0b6b5.050a0220.3c6139.0013.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250909232623.4151337-1-kuniyu@google.com commit 87b90cee22d8658a69c0fbd43633839b75f8f05f Author: Danilo Krummrich Date: Tue Sep 2 21:02:22 2025 +0200 MAINTAINERS: drm-misc: fix X: entries for nova/nouveau Nouveau patches usually flow through the drm-misc tree, while nova (and nova-core) are maintained through a dedicated driver tree and soon through drm-rust. Hence, fix up the corresponding X: entries to list nova instead of nouveau. Reported-by: Maxime Ripard Closes: https://lore.kernel.org/dri-devel/enuksb2qk5wyrilz3l2vnog45lghgmplrav5to6pd5k5owi36h@pxdq6y5dpgpt/ Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250902190247.435340-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 9c600589e14f5fc01b8be9a5d0ad1f094b8b304b Author: James Guan Date: Wed Sep 10 19:19:29 2025 +0800 wifi: virt_wifi: Fix page fault on connect This patch prevents page fault in __cfg80211_connect_result()[1] when connecting a virt_wifi device, while ensuring that virt_wifi can connect properly. [1] https://lore.kernel.org/linux-wireless/20250909063213.1055024-1-guan_yufei@163.com/ Closes: https://lore.kernel.org/linux-wireless/20250909063213.1055024-1-guan_yufei@163.com/ Signed-off-by: James Guan Link: https://patch.msgid.link/20250910111929.137049-1-guan_yufei@163.com [remove irrelevant network-manager instructions] Signed-off-by: Johannes Berg commit a5d7a8ab4b21747173a2f8f0ebf71d72692793c3 Author: Conor Dooley Date: Tue Sep 9 20:58:17 2025 +0100 riscv: dts: allwinner: rename devterm i2c-gpio node to comply with binding The i2c controller binding does not permit permit the node name to contain "gpio", resulting in two warnings: i2c-gpio-0 (i2c-gpio): $nodename:0: 'i2c-gpio-0' does not match '^i2c(@.+|-[a-z0-9]+)?$' i2c-gpio-0 (i2c-gpio): Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'adc@54' were unexpected) Drop it to satisfy dtbs_check. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20250909-frown-wrinkle-f16df243a970@spud Signed-off-by: Chen-Yu Tsai commit 9ba2556cef1df746fad4d691c8290e235b23c7d1 Author: Johan Hovold Date: Fri Aug 29 11:03:45 2025 +0200 drm/mediatek: clean up driver data initialisation The platform and drm devices are only used to look up the drm device and its driver data respectively when initialising the driver data during bind(). Drop the reference counts as soon as they have been used to make the code more readable. Note that the crtc count is never incremented on lookup failures. Signed-off-by: Johan Hovold Reviewed-by: CK Hu Reviewed-by: AngeloGioacchino Del Regno Link: https://patchwork.kernel.org/project/dri-devel/patch/20250829090345.21075-3-johan@kernel.org/ Signed-off-by: Chun-Kuang Hu commit 4de37a48b6b58faaded9eb765047cf0d8785ea18 Author: Johan Hovold Date: Fri Aug 29 11:03:44 2025 +0200 drm/mediatek: fix potential OF node use-after-free The for_each_child_of_node() helper drops the reference it takes to each node as it iterates over children and an explicit of_node_put() is only needed when exiting the loop early. Drop the recently introduced bogus additional reference count decrement at each iteration that could potentially lead to a use-after-free. Fixes: 1f403699c40f ("drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv") Cc: Ma Ke Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Reviewed-by: CK Hu Reviewed-by: AngeloGioacchino Del Regno Link: https://patchwork.kernel.org/project/dri-devel/patch/20250829090345.21075-2-johan@kernel.org/ Signed-off-by: Chun-Kuang Hu commit df447a3b4a4b961c9979b4b3ffb74317394b9b40 Author: Tiwei Bie Date: Mon Sep 1 08:27:15 2025 +0800 um: Fix FD copy size in os_rcv_fd_msg() When copying FDs, the copy size should not include the control message header (cmsghdr). Fix it. Fixes: 5cde6096a4dd ("um: generalize os_rcv_fd") Signed-off-by: Tiwei Bie Signed-off-by: Johannes Berg commit 7ebf70cf181651fe3f2e44e95e7e5073d594c9c0 Author: Miaoqian Lin Date: Thu Aug 28 15:00:51 2025 +0800 um: virtio_uml: Fix use-after-free after put_device in probe When register_virtio_device() fails in virtio_uml_probe(), the code sets vu_dev->registered = 1 even though the device was not successfully registered. This can lead to use-after-free or other issues. Fixes: 04e5b1fb0183 ("um: virtio: Remove device on disconnect") Signed-off-by: Miaoqian Lin Signed-off-by: Johannes Berg commit c45601306aa5831c3e59158f95b8e34f27e9ea09 Author: Richard Weinberger Date: Sat Jul 26 14:29:30 2025 +0200 um: Don't mark stack executable On one of my machines UML failed to start after enabling SELinux. UML failed to start because SELinux's execmod rule denies executable pages on a modified file mapping. Historically UML marks it's stack rwx. AFAICT, these days this is no longer needed, so let's remove PROT_EXEC. Signed-off-by: Richard Weinberger Signed-off-by: Johannes Berg commit d857d09fb653f081f5730e5549fce397513b0ef9 Author: Antheas Kapenekakis Date: Thu Sep 4 15:22:52 2025 +0200 platform/x86: oxpec: Add support for AOKZOE A1X Very similar to OneXFly devices. Uses the same registers. Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20250904132252.3041613-2-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit fba9d5448bd45b0ff7199c47023e9308ea4f1730 Author: Antheas Kapenekakis Date: Thu Sep 4 15:22:51 2025 +0200 platform/x86: oxpec: Add support for OneXPlayer X1Pro EVA-02 It is a special edition of X1Pro with a different color. Signed-off-by: Antheas Kapenekakis Link: https://patch.msgid.link/20250904132252.3041613-1-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8822e8be86d40410ddd2ac8ff44f3050c9ecf9c6 Author: aprilgrimoire Date: Sun Sep 7 09:06:11 2025 +0000 platform/x86/amd/pmc: Add MECHREVO Yilong15Pro to spurious_8042 list The firmware of Mechrevo Yilong15Pro emits a spurious keyboard interrupt on events including closing the lid. When a user closes the lid on an already suspended system this causes the system to wake up. Add Mechrevo Yilong15Pro Series (GM5HG7A) to the list of quirk spurious_8042 to work around this issue. Link: https://lore.kernel.org/linux-pm/6ww4uu6Gl4F5n6VY5dl1ufASfKzs4DhMxAN8BuqUpCoqU3PQukVSVSBCl_lKIzkQ-S8kt1acPd58eyolhkWN32lMLFj4ViI0Tdu2jwhnYZ8=@proton.me/ Signed-off-by: April Grimoire Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/IvSc_IN5Pa0wRXElTk_fEl-cTpMZxg6TCQk_7aRUkTd9vJUp_ZeC0NdXZ0z6Tn7B-XiqqqQvCH65lq6FqhuECBMEYWcHQmWm1Jo7Br8kpeg=@proton.me Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e0423541477dfb684fbc6e6b5386054bc650f264 Author: Rafael J. Wysocki Date: Fri Sep 5 15:44:45 2025 +0200 PM: EM: Add function for registering a PD without capacity update The intel_pstate driver manages CPU capacity changes itself and it does not need an update of the capacity of all CPUs in the system to be carried out after registering a PD. Moreover, in some configurations (for instance, an SMT-capable hybrid x86 system booted with nosmt in the kernel command line) the em_check_capacity_update() call at the end of em_dev_register_perf_domain() always fails and reschedules itself to run once again in 1 s, so effectively it runs in vain every 1 s forever. To address this, introduce a new variant of em_dev_register_perf_domain(), called em_dev_register_pd_no_update(), that does not invoke em_check_capacity_update(), and make intel_pstate use it instead of the original. Fixes: 7b010f9b9061 ("cpufreq: intel_pstate: EAS support for hybrid platforms") Closes: https://lore.kernel.org/linux-pm/40212796-734c-4140-8a85-854f72b8144d@panix.com/ Reported-by: Kenneth R. Crudup Tested-by: Kenneth R. Crudup Cc: 6.16+ # 6.16+ Signed-off-by: Rafael J. Wysocki commit c04f17412991af9471629023017bf969ea19e60f Author: Alok Tiwari Date: Mon Sep 8 11:04:11 2025 -0700 KVM: arm64: vgic: fix incorrect spinlock API usage The function vgic_flush_lr_state() is calling _raw_spin_unlock() instead of the proper raw_spin_unlock(). _raw_spin_unlock() is an internal low-level API and should not be used directly; using raw_spin_unlock() ensures proper locking semantics in the vgic code. Fixes: 8fa3adb8c6be ("KVM: arm/arm64: vgic: Make vgic_irq->irq_lock a raw_spinlock") Signed-off-by: Alok Tiwari Acked-by: Marc Zyngier Message-ID: <20250908180413.3655546-1-alok.a.tiwari@oracle.com> Signed-off-by: Oliver Upton commit 51d165e92a701012a11e726217a5c51e367563e4 Author: Wei-Lin Chang Date: Mon Sep 8 14:48:06 2025 +0800 KVM: arm64: Remove stage 2 read fault check In the non-NV case, read permission is always granted when mapping stage-2, so checking for it doesn't bring much. On the other hand, shadow stage-2 for NV guests could potentially have non-readable mappings when we align the permissions with those that L1 set for L2, we shouldn't be checking for read faults in this case either. So just remove this check. Suggested-by: Oliver Upton Suggested-by: Marc Zyngier Signed-off-by: Wei-Lin Chang Link: https://lore.kernel.org/r/20250908064806.4093081-1-r09922117@csie.ntu.edu.tw Signed-off-by: Oliver Upton commit 2dc720e606319eae6990c31b7cc8fd188f442ce4 Author: Fuad Tabba Date: Mon Sep 8 17:35:57 2025 +0100 KVM: arm64: Fix parameter ordering for VBAR_EL1 assignment The __vcpu_assign_sys_reg() helper expects the register ID as the second argument and the value to be assigned as the third. However, the existing code was passing these parameters in the incorrect order. Fix the function call to properly read the live value of VBAR_EL1 from the guest and update the vCPU value immediately before pending the exception. This ensures the vCPU's value is the same as the guest's and that the exception will be handled at the correct address upon resuming the guest. Fixes: 798eb5978700 ("KVM: arm64: Sync protected guest VBAR_EL1 on injecting an undef exception") Signed-off-by: Fuad Tabba Link: https://lore.kernel.org/r/20250908163557.2419780-1-tabba@google.com Signed-off-by: Oliver Upton commit ebb2d8fd81b82c8a57f88add118108b1c4408670 Author: Dongha Lee Date: Sat Sep 6 13:07:24 2025 +0900 KVM: arm64: nv: Fix incorrect VNCR invalidation range calculation The code for invalidating VNCR entries in both kvm_invalidate_vncr_ipa() and invalidate_vncr_va() incorrectly uses a bitwise AND with `(size - 1)` instead of `~(size - 1)` to align the start address. This results in masking the address bits instead of aligning them down to the start of the block. This bug may cause stale VNCR TLB entries to remain valid even after a TLBI or MMU notifier, leading to incorrect memory translation and unexpected guest behavior. Credit to Team 0xB6 in bob14: DongHa Lee, Gyujeong Jin, Daehyeon Ko, Geonha Lee, Hyungyu Oh, and Jaewon Yang. Reviewed-by: Marc Zyngier Signed-off-by: Dongha Lee Link: https://lore.kernel.org/r/20250906040724.72960-1-p@sswd.pw Signed-off-by: Oliver Upton commit 13bba09beb5ffa1a4f307c48576c09d5c69f4c31 Author: Oliver Upton Date: Fri Sep 5 03:05:31 2025 -0700 KVM: arm64: vgic-v3: Indicate vgic_put_irq() may take LPI xarray lock The release path on LPIs is quite rare, meaning it can be difficult to find lock ordering bugs on the LPI xarray's spinlock. Tell lockdep that vgic_put_irq() might acquire the xa_lock to make unsafe patterns more obvious. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250905100531.282980-7-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 982f31bbb5b0adc79a9126c0f970e7801c6e8342 Author: Oliver Upton Date: Fri Sep 5 03:05:30 2025 -0700 KVM: arm64: vgic-v3: Don't require IRQs be disabled for LPI xarray lock Now that releases of LPIs have been unnested from the ap_list_lock there are no xarray writers that exist in a context where IRQs are already disabled. As such we can relax the locking to the non-IRQ disabling spinlock to guard the LPI xarray. Note that there are still readers of the LPI xarray where IRQs are disabled however the readers rely on RCU protection instead of the lock. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250905100531.282980-6-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit d54594accf732d17891d276aa1f545ef25606555 Author: Oliver Upton Date: Fri Sep 5 03:05:29 2025 -0700 KVM: arm64: vgic-v3: Erase LPIs from xarray outside of raw spinlocks syzkaller has caught us red-handed once more, this time nesting regular spinlocks behind raw spinlocks: ============================= [ BUG: Invalid wait context ] 6.16.0-rc3-syzkaller-g7b8346bd9fce #0 Not tainted ----------------------------- syz.0.29/3743 is trying to lock: a3ff80008e2e9e18 (&xa->xa_lock#20){....}-{3:3}, at: vgic_put_irq+0xb4/0x190 arch/arm64/kvm/vgic/vgic.c:137 other info that might help us debug this: context-{5:5} 3 locks held by syz.0.29/3743: #0: a3ff80008e2e90a8 (&kvm->slots_lock){+.+.}-{4:4}, at: kvm_vgic_destroy+0x50/0x624 arch/arm64/kvm/vgic/vgic-init.c:499 #1: a3ff80008e2e9fa0 (&kvm->arch.config_lock){+.+.}-{4:4}, at: kvm_vgic_destroy+0x5c/0x624 arch/arm64/kvm/vgic/vgic-init.c:500 #2: 58f0000021be1428 (&vgic_cpu->ap_list_lock){....}-{2:2}, at: vgic_flush_pending_lpis+0x3c/0x31c arch/arm64/kvm/vgic/vgic.c:150 stack backtrace: CPU: 0 UID: 0 PID: 3743 Comm: syz.0.29 Not tainted 6.16.0-rc3-syzkaller-g7b8346bd9fce #0 PREEMPT Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 dump_stack+0x1c/0x28 lib/dump_stack.c:129 print_lock_invalid_wait_context kernel/locking/lockdep.c:4833 [inline] check_wait_context kernel/locking/lockdep.c:4905 [inline] __lock_acquire+0x978/0x299c kernel/locking/lockdep.c:5190 lock_acquire+0x14c/0x2e0 kernel/locking/lockdep.c:5871 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162 vgic_put_irq+0xb4/0x190 arch/arm64/kvm/vgic/vgic.c:137 vgic_flush_pending_lpis+0x24c/0x31c arch/arm64/kvm/vgic/vgic.c:158 __kvm_vgic_vcpu_destroy+0x44/0x500 arch/arm64/kvm/vgic/vgic-init.c:455 kvm_vgic_destroy+0x100/0x624 arch/arm64/kvm/vgic/vgic-init.c:505 kvm_arch_destroy_vm+0x80/0x138 arch/arm64/kvm/arm.c:244 kvm_destroy_vm virt/kvm/kvm_main.c:1308 [inline] kvm_put_kvm+0x800/0xff8 virt/kvm/kvm_main.c:1344 kvm_vm_release+0x58/0x78 virt/kvm/kvm_main.c:1367 __fput+0x4ac/0x980 fs/file_table.c:465 ____fput+0x20/0x58 fs/file_table.c:493 task_work_run+0x1bc/0x254 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] do_notify_resume+0x1b4/0x270 arch/arm64/kernel/entry-common.c:151 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline] el0_svc+0xb4/0x160 arch/arm64/kernel/entry-common.c:768 el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:786 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:600 This is of course no good, but is at odds with how LPI refcounts are managed. Solve the locking mess by deferring the release of unreferenced LPIs after the ap_list_lock is released. Mark these to-be-released LPIs specially to avoid racing with vgic_put_irq() and causing a double-free. Since references can only be taken on LPIs with a nonzero refcount, extending the lifetime of freed LPIs is still safe. Reviewed-by: Marc Zyngier Reported-by: syzbot+cef594105ac7e60c6d93@syzkaller.appspotmail.com Closes: https://lore.kernel.org/kvmarm/68acd0d9.a00a0220.33401d.048b.GAE@google.com/ Link: https://lore.kernel.org/r/20250905100531.282980-5-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 0a4aedf2bd3031ce83eb31f2cec8905938082b24 Author: Oliver Upton Date: Fri Sep 5 03:05:28 2025 -0700 KVM: arm64: Spin off release helper from vgic_put_irq() Spin off the release implementation from vgic_put_irq() to prepare for a more involved fix for lock ordering such that it may be unnested from raw spinlocks. This has the minor functional change of doing call_rcu() behind the xa_lock although it shouldn't be consequential. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250905100531.282980-4-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 3a08a6ca7c373198c84e2a8c025c395ee966ff8a Author: Oliver Upton Date: Fri Sep 5 03:05:27 2025 -0700 KVM: arm64: vgic-v3: Use bare refcount for VGIC LPIs KVM's use of krefs to manage LPIs isn't adding much, especially considering vgic_irq_release() is a noop due to the lack of sufficient context. Switch to using a regular refcount in anticipation of adding a meaningful release concept for LPIs. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250905100531.282980-3-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 7d6ca84aa985fc940f5544ed7feedb1b4a82b96b Author: Oliver Upton Date: Fri Sep 5 03:05:26 2025 -0700 KVM: arm64: vgic: Drop stale comment on IRQ active state While LPIs lack an active state, KVM unconditionally folds the active state from the LR into the vgic_irq struct meaning this field cannot be 'creatively' reused for something else. Drop the misleading comment to reflect this. Link: https://lore.kernel.org/r/20250905100531.282980-2-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit da2e743419cb5f4ee88cd66c4363951b444207cf Author: Alexandru Elisei Date: Tue Sep 2 14:08:33 2025 +0100 KVM: arm64: VHE: Save and restore host MDCR_EL2 value correctly Prior to commit 75a5fbaf6623 ("KVM: arm64: Compute MDCR_EL2 at vcpu_load()"), host MDCR_EL2 was saved correctly: kvm_arch_vcpu_load() kvm_vcpu_load_debug() /* Doesn't touch hardware MDCR_EL2. */ kvm_vcpu_load_vhe() __activate_traps_common() /* Saves host MDCR_EL2. */ *host_data_ptr(host_debug_state.mdcr_el2) = read_sysreg(mdcr_el2) /* Writes VCPU MDCR_EL2. */ write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2) The MDCR_EL2 value saved previously was restored in kvm_arch_vcpu_put() -> kvm_vcpu_put_vhe(). After the aforementioned commit, host MDCR_EL2 is never saved: kvm_arch_vcpu_load() kvm_vcpu_load_debug() /* Writes VCPU MDCR_EL2 */ kvm_vcpu_load_vhe() __activate_traps_common() /* Saves **VCPU** MDCR_EL2. */ *host_data_ptr(host_debug_state.mdcr_el2) = read_sysreg(mdcr_el2) /* Writes VCPU MDCR_EL2 a second time. */ write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2) kvm_arch_vcpu_put() -> kvm_vcpu_put_vhe() then restores the VCPU MDCR_EL2 value. Also VCPU's MDCR_EL2 value gets written to hardware twice now. Fix this by saving the host MDCR_EL2 in kvm_arch_vcpu_load() before it gets overwritten by the VCPU's MDCR_EL2 value, and restore it on VCPU put. Signed-off-by: Alexandru Elisei Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20250902130833.338216-3-alexandru.elisei@arm.com Signed-off-by: Oliver Upton commit efad60e4605721b829a49bcaa6afc517a80a7247 Author: Alexandru Elisei Date: Tue Sep 2 14:08:32 2025 +0100 KVM: arm64: Initialize PMSCR_EL1 when in VHE According to the pseudocode for StatisticalProfilingEnabled() from Arm DDI0487L.b, PMSCR_EL1 controls profiling at EL1 and EL0: - PMSCR_EL1.E1SPE controls profiling at EL1. - PMSCR_EL1.E0SPE controls profiling at EL0 if HCR_EL2.TGE=0. These two fields reset to UNKNOWN values. When KVM runs in VHE mode and profiling is enabled in the host, before entering a guest, KVM does not touch any of the SPE registers, leaving the buffer enabled, and it clears HCR_EL2.TGE. As a result, depending on the reset value for the E1SPE and E0SPE fields, KVM might unintentionally profile a guest. Make the behaviour consistent and predictable by clearing PMSCR_EL1 when KVM initialises the host debug configuration. Note that this is not a problem for nVHE, because KVM clears PMSCR_EL1.{E1SPE,E0SPE} before entering the guest. Signed-off-by: Alexandru Elisei Link: https://lore.kernel.org/r/20250902130833.338216-2-alexandru.elisei@arm.com Signed-off-by: Oliver Upton commit 860b21c31d16f99b8c37b77993682f7bc8c211d7 Author: Geonha Lee Date: Thu Sep 4 00:04:21 2025 +0900 KVM: arm64: nv: fix VNCR TLB ASID match logic for non-Global entries kvm_vncr_tlb_lookup() is supposed to return true when the cached VNCR TLB entry is valid for the current context. For non-Global entries, that means the entry’s ASID must match the current ASID. The current code returns true when the ASIDs do *not* match, which inverts the logic. This is a potential vulnerability: - Valid entries are ignored and we fall back to kvm_translate_vncr(), hurting performance. - Mismatched entries are treated as permission faults (-EPERM) instead of triggering a fresh translation. - This can also cause stale translations to be (wrongly) considered valid across address spaces. Flip the predicate so non-Global entries only hit when ASIDs match. Special credit to Team 0xB6 for reporting: DongHa Lee, Gyujeong Jin, Daehyeon Ko, Geonha Lee, Hyungyu Oh, and Jaewon Yang. Signed-off-by: Geonha Lee Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250903150421.90752-1-w1nsom3gna@korea.ac.kr Signed-off-by: Oliver Upton commit 8cc71fc3b82b51e155fbe20876b1aa17a315ac4c Author: Nithyanantham Paramasivam Date: Fri Sep 5 18:18:00 2025 +0530 wifi: cfg80211: Fix "no buffer space available" error in nl80211_get_station() for MLO Currently, nl80211_get_station() allocates a fixed buffer size using NLMSG_DEFAULT_SIZE. In multi-link scenarios - particularly when the number of links exceeds two - this buffer size is often insufficient to accommodate complete station statistics, resulting in "no buffer space available" errors. To address this, modify nl80211_get_station() to return only accumulated station statistics and exclude per link stats. Pass a new flag (link_stats) to nl80211_send_station() to control the inclusion of per link statistics. This allows retaining detailed output with per link data in dump commands, while excluding it from other commands where it is not needed. This change modifies the handling of per link stats introduced in commit 82d7f841d9bd ("wifi: cfg80211: extend to embed link level statistics in NL message") to enable them only for nl80211_dump_station(). Apply the same fix to cfg80211_del_sta_sinfo() by skipping per link stats to avoid buffer issues. cfg80211_new_sta() doesn't include stats and is therefore not impacted. Fixes: 82d7f841d9bd ("wifi: cfg80211: extend to embed link level statistics in NL message") Signed-off-by: Nithyanantham Paramasivam Link: https://patch.msgid.link/20250905124800.1448493-1-nithyanantham.paramasivam@oss.qualcomm.com Signed-off-by: Johannes Berg commit a814c36cc6738ae61a4bcda6d948935a6da51ae1 Merge: bda605962c0798 2682e7a317504a Author: Johannes Berg Date: Wed Sep 10 09:09:54 2025 +0200 Merge tag 'iwlwifi-fixes-2025-09-09' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi fix ==================== Which is a fix for (old) 130/1030 devices to work again. Signed-off-by: Johannes Berg commit bda605962c0798617172eb17348a43002e3595b7 Merge: d69eb204c255c3 82e2be57d544ff Author: Johannes Berg Date: Wed Sep 10 09:08:27 2025 +0200 Merge tag 'ath-current-20250909' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.17-rc6 ================== There's a firmware API alignment fix, and a fix for powersave, both for ath12k. Signed-off-by: Johannes Berg commit 181993bb0d626cf88cc803f4356ce5c5abe86278 Author: Yuezhang Mo Date: Wed Sep 10 13:33:40 2025 +0800 erofs: fix runtime warning on truncate_folio_batch_exceptionals() Commit 0e2f80afcfa6("fs/dax: ensure all pages are idle prior to filesystem unmount") introduced the WARN_ON_ONCE to capture whether the filesystem has removed all DAX entries or not and applied the fix to xfs and ext4. Apply the missed fix on erofs to fix the runtime warning: [ 5.266254] ------------[ cut here ]------------ [ 5.266274] WARNING: CPU: 6 PID: 3109 at mm/truncate.c:89 truncate_folio_batch_exceptionals+0xff/0x260 [ 5.266294] Modules linked in: [ 5.266999] CPU: 6 UID: 0 PID: 3109 Comm: umount Tainted: G S 6.16.0+ #6 PREEMPT(voluntary) [ 5.267012] Tainted: [S]=CPU_OUT_OF_SPEC [ 5.267017] Hardware name: Dell Inc. OptiPlex 5000/05WXFV, BIOS 1.5.1 08/24/2022 [ 5.267024] RIP: 0010:truncate_folio_batch_exceptionals+0xff/0x260 [ 5.267076] Code: 00 00 41 39 df 7f 11 eb 78 83 c3 01 49 83 c4 08 41 39 df 74 6c 48 63 f3 48 83 fe 1f 0f 83 3c 01 00 00 43 f6 44 26 08 01 74 df <0f> 0b 4a 8b 34 22 4c 89 ef 48 89 55 90 e8 ff 54 1f 00 48 8b 55 90 [ 5.267083] RSP: 0018:ffffc900013f36c8 EFLAGS: 00010202 [ 5.267095] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 5.267101] RDX: ffffc900013f3790 RSI: 0000000000000000 RDI: ffff8882a1407898 [ 5.267108] RBP: ffffc900013f3740 R08: 0000000000000000 R09: 0000000000000000 [ 5.267113] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 5.267119] R13: ffff8882a1407ab8 R14: ffffc900013f3888 R15: 0000000000000001 [ 5.267125] FS: 00007aaa8b437800(0000) GS:ffff88850025b000(0000) knlGS:0000000000000000 [ 5.267132] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 5.267138] CR2: 00007aaa8b3aac10 CR3: 000000024f764000 CR4: 0000000000f52ef0 [ 5.267144] PKRU: 55555554 [ 5.267150] Call Trace: [ 5.267154] [ 5.267181] truncate_inode_pages_range+0x118/0x5e0 [ 5.267193] ? save_trace+0x54/0x390 [ 5.267296] truncate_inode_pages_final+0x43/0x60 [ 5.267309] evict+0x2a4/0x2c0 [ 5.267339] dispose_list+0x39/0x80 [ 5.267352] evict_inodes+0x150/0x1b0 [ 5.267376] generic_shutdown_super+0x41/0x180 [ 5.267390] kill_block_super+0x1b/0x50 [ 5.267402] erofs_kill_sb+0x81/0x90 [erofs] [ 5.267436] deactivate_locked_super+0x32/0xb0 [ 5.267450] deactivate_super+0x46/0x60 [ 5.267460] cleanup_mnt+0xc3/0x170 [ 5.267475] __cleanup_mnt+0x12/0x20 [ 5.267485] task_work_run+0x5d/0xb0 [ 5.267499] exit_to_user_mode_loop+0x144/0x170 [ 5.267512] do_syscall_64+0x2b9/0x7c0 [ 5.267523] ? __lock_acquire+0x665/0x2ce0 [ 5.267535] ? __lock_acquire+0x665/0x2ce0 [ 5.267560] ? lock_acquire+0xcd/0x300 [ 5.267573] ? find_held_lock+0x31/0x90 [ 5.267582] ? mntput_no_expire+0x97/0x4e0 [ 5.267606] ? mntput_no_expire+0xa1/0x4e0 [ 5.267625] ? mntput+0x24/0x50 [ 5.267634] ? path_put+0x1e/0x30 [ 5.267647] ? do_faccessat+0x120/0x2f0 [ 5.267677] ? do_syscall_64+0x1a2/0x7c0 [ 5.267686] ? from_kgid_munged+0x17/0x30 [ 5.267703] ? from_kuid_munged+0x13/0x30 [ 5.267711] ? __do_sys_getuid+0x3d/0x50 [ 5.267724] ? do_syscall_64+0x1a2/0x7c0 [ 5.267732] ? irqentry_exit+0x77/0xb0 [ 5.267743] ? clear_bhb_loop+0x30/0x80 [ 5.267752] ? clear_bhb_loop+0x30/0x80 [ 5.267765] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 5.267772] RIP: 0033:0x7aaa8b32a9fb [ 5.267781] Code: c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 f3 0f 1e fa 31 f6 e9 05 00 00 00 0f 1f 44 00 00 f3 0f 1e fa b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 05 c3 0f 1f 40 00 48 8b 15 e9 83 0d 00 f7 d8 [ 5.267787] RSP: 002b:00007ffd7c4c9468 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 [ 5.267796] RAX: 0000000000000000 RBX: 00005a61592a8b00 RCX: 00007aaa8b32a9fb [ 5.267802] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00005a61592b2080 [ 5.267806] RBP: 00007ffd7c4c9540 R08: 00007aaa8b403b20 R09: 0000000000000020 [ 5.267812] R10: 0000000000000001 R11: 0000000000000246 R12: 00005a61592a8c00 [ 5.267817] R13: 0000000000000000 R14: 00005a61592b2080 R15: 00005a61592a8f10 [ 5.267849] [ 5.267854] irq event stamp: 4721 [ 5.267859] hardirqs last enabled at (4727): [] __up_console_sem+0x90/0xa0 [ 5.267873] hardirqs last disabled at (4732): [] __up_console_sem+0x75/0xa0 [ 5.267884] softirqs last enabled at (3044): [] kernel_fpu_end+0x53/0x70 [ 5.267895] softirqs last disabled at (3042): [] kernel_fpu_begin_mask+0xc4/0x120 [ 5.267905] ---[ end trace 0000000000000000 ]--- Fixes: bde708f1a65d ("fs/dax: always remove DAX page-cache entries when breaking layouts") Signed-off-by: Yuezhang Mo Reviewed-by: Friendy Su Reviewed-by: Daniel Palmer Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 5cb782ff3c62c837e4984b6ae9f5d9a423cd5088 Author: Alok Tiwari Date: Sun Sep 7 12:40:16 2025 -0700 scsi: ufs: mcq: Fix memory allocation checks for SQE and CQE Previous checks incorrectly tested the DMA addresses (dma_handle) for NULL. Since dma_alloc_coherent() returns the CPU (virtual) address, the NULL check should be performed on the *_base_addr pointer to correctly detect allocation failures. Update the checks to validate sqe_base_addr and cqe_base_addr instead of sqe_dma_addr and cqe_dma_addr. Fixes: 4682abfae2eb ("scsi: ufs: core: mcq: Allocate memory for MCQ mode") Signed-off-by: Alok Tiwari Reviewed-by: Alim Akhtar Reviewed-by: Manivannan Sadhasivam Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit 78dd8ad62cad4f5af22afc842890d531312bbb8a Merge: 648de37416b301 ef1bd93b3b9240 Author: Jakub Kicinski Date: Tue Sep 9 18:39:54 2025 -0700 Merge branch 'mptcp-misc-fixes-for-v6-17-rc6' Matthieu Baerts says: ==================== mptcp: misc fixes for v6.17-rc6 Here are various unrelated fixes: - Patch 1: Fix a wrong attribute type in the MPTCP Netlink specs. A fix for v6.7. - Patch 2: Avoid mentioning a deprecated MPTCP sysctl knob in the doc. A fix for v6.15. - Patch 3: Handle new warnings from ShellCheck v0.11.0. This prevents some warnings reported by some CIs. If it is not a good material for 'net', please drop. ==================== Link: https://patch.msgid.link/20250908-net-mptcp-misc-fixes-6-17-rc5-v1-0-5f2168a66079@kernel.org Signed-off-by: Jakub Kicinski commit ef1bd93b3b924086088b7818d9e5d89ede944f1f Author: Matthieu Baerts (NGI0) Date: Mon Sep 8 23:27:29 2025 +0200 selftests: mptcp: shellcheck: support v0.11.0 This v0.11.0 version introduces SC2329: Warn when (non-escaping) functions are never invoked. Except that, similar to SC2317, ShellCheck is currently unable to figure out functions that are invoked via trap, or indirectly, when calling functions via variables. It is then needed to disable this new SC2329. Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250908-net-mptcp-misc-fixes-6-17-rc5-v1-3-5f2168a66079@kernel.org Signed-off-by: Jakub Kicinski commit 6f021e95d0828edc8ed104a294594c2f9569383a Author: Matthieu Baerts (NGI0) Date: Mon Sep 8 23:27:28 2025 +0200 doc: mptcp: net.mptcp.pm_type is deprecated The net.mptcp.pm_type sysctl knob has been deprecated in v6.15, net.mptcp.path_manager should be used instead. Adapt the section about path managers to suggest using the new sysctl knob instead of the deprecated one. Fixes: 595c26d122d1 ("mptcp: sysctl: set path manager by name") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250908-net-mptcp-misc-fixes-6-17-rc5-v1-2-5f2168a66079@kernel.org Signed-off-by: Jakub Kicinski commit 7094b84863e5832cb1cd9c4b9d648904775b6bd9 Author: Matthieu Baerts (NGI0) Date: Mon Sep 8 23:27:27 2025 +0200 netlink: specs: mptcp: fix if-idx attribute type This attribute is used as a signed number in the code in pm_netlink.c: nla_put_s32(skb, MPTCP_ATTR_IF_IDX, ssk->sk_bound_dev_if)) The specs should then reflect that. Note that other 'if-idx' attributes from the same .yaml file use a signed number as well. Fixes: bc8aeb2045e2 ("Documentation: netlink: add a YAML spec for mptcp") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250908-net-mptcp-misc-fixes-6-17-rc5-v1-1-5f2168a66079@kernel.org Signed-off-by: Jakub Kicinski commit 648de37416b301f046f62f1b65715c7fa8ebaa67 Author: Krister Johansen Date: Mon Sep 8 11:16:01 2025 -0700 mptcp: sockopt: make sync_socket_options propagate SOCK_KEEPOPEN Users reported a scenario where MPTCP connections that were configured with SO_KEEPALIVE prior to connect would fail to enable their keepalives if MTPCP fell back to TCP mode. After investigating, this affects keepalives for any connection where sync_socket_options is called on a socket that is in the closed or listening state. Joins are handled properly. For connects, sync_socket_options is called when the socket is still in the closed state. The tcp_set_keepalive() function does not act on sockets that are closed or listening, hence keepalive is not immediately enabled. Since the SO_KEEPOPEN flag is absent, it is not enabled later in the connect sequence via tcp_finish_connect. Setting the keepalive via sockopt after connect does work, but would not address any subsequently created flows. Fortunately, the fix here is straight-forward: set SOCK_KEEPOPEN on the subflow when calling sync_socket_options. The fix was valdidated both by using tcpdump to observe keepalive packets not being sent before the fix, and being sent after the fix. It was also possible to observe via ss that the keepalive timer was not enabled on these sockets before the fix, but was enabled afterwards. Fixes: 1b3e7ede1365 ("mptcp: setsockopt: handle SO_KEEPALIVE and SO_PRIORITY") Cc: stable@vger.kernel.org Signed-off-by: Krister Johansen Reviewed-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/aL8dYfPZrwedCIh9@templeofstupid.com Signed-off-by: Jakub Kicinski commit 0f82c3ba66c6b2e3cde0f255156a753b108ee9dc Author: Stanislav Fomichev Date: Mon Sep 8 10:36:14 2025 -0700 macsec: sync features on RTM_NEWLINK Syzkaller managed to lock the lower device via ETHTOOL_SFEATURES: netdev_lock include/linux/netdevice.h:2761 [inline] netdev_lock_ops include/net/netdev_lock.h:42 [inline] netdev_sync_lower_features net/core/dev.c:10649 [inline] __netdev_update_features+0xcb1/0x1be0 net/core/dev.c:10819 netdev_update_features+0x6d/0xe0 net/core/dev.c:10876 macsec_notify+0x2f5/0x660 drivers/net/macsec.c:4533 notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline] call_netdevice_notifiers net/core/dev.c:2281 [inline] netdev_features_change+0x85/0xc0 net/core/dev.c:1570 __dev_ethtool net/ethtool/ioctl.c:3469 [inline] dev_ethtool+0x1536/0x19b0 net/ethtool/ioctl.c:3502 dev_ioctl+0x392/0x1150 net/core/dev_ioctl.c:759 It happens because lower features are out of sync with the upper: __dev_ethtool (real_dev) netdev_lock_ops(real_dev) ETHTOOL_SFEATURES __netdev_features_change netdev_sync_upper_features disable LRO on the lower if (old_features != dev->features) netdev_features_change fires NETDEV_FEAT_CHANGE macsec_notify NETDEV_FEAT_CHANGE netdev_update_features (for each macsec dev) netdev_sync_lower_features if (upper_features != lower_features) netdev_lock_ops(lower) # lower == real_dev stuck ... netdev_unlock_ops(real_dev) Per commit af5f54b0ef9e ("net: Lock lower level devices when updating features"), we elide the lock/unlock when the upper and lower features are synced. Makes sure the lower (real_dev) has proper features after the macsec link has been created. This makes sure we never hit the situation where we need to sync upper flags to the lower. Reported-by: syzbot+7e0f89fb6cae5d002de0@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7e0f89fb6cae5d002de0 Fixes: 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations") Signed-off-by: Stanislav Fomichev Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250908173614.3358264-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 686cab5a18e443e1d5f2abb17bed45837836425f Author: Carolina Jubran Date: Sun Sep 7 11:08:21 2025 +0300 net: dev_ioctl: take ops lock in hwtstamp lower paths ndo hwtstamp callbacks are expected to run under the per-device ops lock. Make the lower get/set paths consistent with the rest of ndo invocations. Kernel log: WARNING: CPU: 13 PID: 51364 at ./include/net/netdev_lock.h:70 __netdev_update_features+0x4bd/0xe60 ... RIP: 0010:__netdev_update_features+0x4bd/0xe60 ... Call Trace: netdev_update_features+0x1f/0x60 mlx5_hwtstamp_set+0x181/0x290 [mlx5_core] mlx5e_hwtstamp_set+0x19/0x30 [mlx5_core] dev_set_hwtstamp_phylib+0x9f/0x220 dev_set_hwtstamp_phylib+0x9f/0x220 dev_set_hwtstamp+0x13d/0x240 dev_ioctl+0x12f/0x4b0 sock_ioctl+0x171/0x370 __x64_sys_ioctl+0x3f7/0x900 ? __sys_setsockopt+0x69/0xb0 do_syscall_64+0x6f/0x2e0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 ... .... ---[ end trace 0000000000000000 ]--- Note that the mlx5_hwtstamp_set and mlx5e_hwtstamp_set functions shown in the trace come from an in progress patch converting the legacy ioctl to ndo_hwtstamp_get/set and are not present in mainline. Fixes: ffb7ed19ac0a ("net: hold netdev instance lock during ioctl operations") Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Link: https://patch.msgid.link/20250907080821.2353388-1-cjubran@nvidia.com Signed-off-by: Jakub Kicinski commit c5ea3065586d790ea5193a679b85585173d59866 Author: Paulo Alcantara Date: Sun Sep 7 21:24:06 2025 -0300 smb: client: fix data loss due to broken rename(2) Rename of open files in SMB2+ has been broken for a very long time, resulting in data loss as the CIFS client would fail the rename(2) call with -ENOENT and then removing the target file. Fix this by implementing ->rename_pending_delete() for SMB2+, which will rename busy files to random filenames (e.g. silly rename) during unlink(2) or rename(2), and then marking them to delete-on-close. Besides, introduce a FIND_WR_NO_PENDING_DELETE flag to prevent open(2) from reusing open handles that had been marked as delete pending. Handle it in cifs_get_readable_path() as well. Reported-by: Jean-Baptiste Denis Closes: https://marc.info/?i=16aeb380-30d4-4551-9134-4e7d1dc833c0@pasteur.fr Reviewed-by: David Howells Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (Red Hat) Cc: Frank Sorenson Cc: Olga Kornievskaia Cc: Benjamin Coddington Cc: Scott Mayhew Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit e0d1c55501d377163eb57feed863777ed1c973ad Author: Russell King (Oracle) Date: Sun Sep 7 21:44:01 2025 +0100 net: phy: fix phy_uses_state_machine() The blamed commit changed the conditions which phylib uses to stop and start the state machine in the suspend and resume paths, and while improving it, has caused two issues. The original code used this test: phydev->attached_dev && phydev->adjust_link and if true, the paths would handle the PHY state machine. This test evaluates true for normal drivers that are using phylib directly while the PHY is attached to the network device, but false in all other cases, which include the following cases: - when the PHY has never been attached to a network device. - when the PHY has been detached from a network device (as phy_detach() sets phydev->attached_dev to NULL, phy_disconnect() calls phy_detach() and additionally sets phydev->adjust_link NULL.) - when phylink is using the driver (as phydev->adjust_link is NULL.) Only the third case was incorrect, and the blamed commit attempted to fix this by changing this test to (simplified for brevity, see phy_uses_state_machine()): phydev->phy_link_change == phy_link_change ? phydev->attached_dev && phydev->adjust_link : true However, this also incorrectly evaluates true in the first two cases. Fix the first case by ensuring that phy_uses_state_machine() returns false when phydev->phy_link_change is NULL. Fix the second case by ensuring that phydev->phy_link_change is set to NULL when phy_detach() is called. Reported-by: Xu Yang Link: https://lore.kernel.org/r/20250806082931.3289134-1-xu.yang_2@nxp.com Fixes: fc75ea20ffb4 ("net: phy: allow MDIO bus PM ops to start/stop state machine for phylink-controlled PHY") Signed-off-by: Russell King (Oracle) Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/E1uvMEz-00000003Aoe-3qWe@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 90f7c100d2dd99d5cd5be950d553edd2647e6cc8 Author: Paulo Alcantara Date: Sat Sep 6 21:19:29 2025 -0300 smb: client: fix compound alignment with encryption The encryption layer can't handle the padding iovs, so flatten the compound request into a single buffer with required padding to prevent the server from dropping the connection when finding unaligned compound requests. Fixes: bc925c1216f0 ("smb: client: improve compound padding in encryption") Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: linux-cifs@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 6d78b4473cdb08b74662355a9e8510bde09c511e Author: Peilin Ye Date: Tue Sep 9 09:52:20 2025 +0000 bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() Currently, calling bpf_map_kmalloc_node() from __bpf_async_init() can cause various locking issues; see the following stack trace (edited for style) as one example: ... [10.011566] do_raw_spin_lock.cold [10.011570] try_to_wake_up (5) double-acquiring the same [10.011575] kick_pool rq_lock, causing a hardlockup [10.011579] __queue_work [10.011582] queue_work_on [10.011585] kernfs_notify [10.011589] cgroup_file_notify [10.011593] try_charge_memcg (4) memcg accounting raises an [10.011597] obj_cgroup_charge_pages MEMCG_MAX event [10.011599] obj_cgroup_charge_account [10.011600] __memcg_slab_post_alloc_hook [10.011603] __kmalloc_node_noprof ... [10.011611] bpf_map_kmalloc_node [10.011612] __bpf_async_init [10.011615] bpf_timer_init (3) BPF calls bpf_timer_init() [10.011617] bpf_prog_xxxxxxxxxxxxxxxx_fcg_runnable [10.011619] bpf__sched_ext_ops_runnable [10.011620] enqueue_task_scx (2) BPF runs with rq_lock held [10.011622] enqueue_task [10.011626] ttwu_do_activate [10.011629] sched_ttwu_pending (1) grabs rq_lock ... The above was reproduced on bpf-next (b338cf849ec8) by modifying ./tools/sched_ext/scx_flatcg.bpf.c to call bpf_timer_init() during ops.runnable(), and hacking the memcg accounting code a bit to make a bpf_timer_init() call more likely to raise an MEMCG_MAX event. We have also run into other similar variants (both internally and on bpf-next), including double-acquiring cgroup_file_kn_lock, the same worker_pool::lock, etc. As suggested by Shakeel, fix this by using __GFP_HIGH instead of GFP_ATOMIC in __bpf_async_init(), so that e.g. if try_charge_memcg() raises an MEMCG_MAX event, we call __memcg_memory_event() with @allow_spinning=false and avoid calling cgroup_file_notify() there. Depends on mm patch "memcg: skip cgroup_file_notify if spinning is not allowed": https://lore.kernel.org/bpf/20250905201606.66198-1-shakeel.butt@linux.dev/ v0 approach s/bpf_map_kmalloc_node/bpf_mem_alloc/ https://lore.kernel.org/bpf/20250905061919.439648-1-yepeilin@google.com/ v1 approach: https://lore.kernel.org/bpf/20250905234547.862249-1-yepeilin@google.com/ Fixes: b00628b1c7d5 ("bpf: Introduce bpf timers.") Suggested-by: Shakeel Butt Signed-off-by: Peilin Ye Link: https://lore.kernel.org/r/20250909095222.2121438-1-yepeilin@google.com Signed-off-by: Alexei Starovoitov commit df0cb5cb50bd54d3cd4d0d83417ceec6a66404aa Author: KaFai Wan Date: Tue Sep 9 22:46:14 2025 +0800 bpf: Allow fall back to interpreter for programs with stack size <= 512 OpenWRT users reported regression on ARMv6 devices after updating to latest HEAD, where tcpdump filter: tcpdump "not ether host 3c37121a2b3c and not ether host 184ecbca2a3a \ and not ether host 14130b4d3f47 and not ether host f0f61cf440b7 \ and not ether host a84b4dedf471 and not ether host d022be17e1d7 \ and not ether host 5c497967208b and not ether host 706655784d5b" fails with warning: "Kernel filter failed: No error information" when using config: # CONFIG_BPF_JIT_ALWAYS_ON is not set CONFIG_BPF_JIT_DEFAULT_ON=y The issue arises because commits: 1. "bpf: Fix array bounds error with may_goto" changed default runtime to __bpf_prog_ret0_warn when jit_requested = 1 2. "bpf: Avoid __bpf_prog_ret0_warn when jit fails" returns error when jit_requested = 1 but jit fails This change restores interpreter fallback capability for BPF programs with stack size <= 512 bytes when jit fails. Reported-by: Felix Fietkau Closes: https://lore.kernel.org/bpf/2e267b4b-0540-45d8-9310-e127bf95fc63@nbd.name/ Fixes: 6ebc5030e0c5 ("bpf: Fix array bounds error with may_goto") Signed-off-by: KaFai Wan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250909144614.2991253-1-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit 0d80e7f951be1bdd08d328fd87694be0d6e8aaa8 Author: Kumar Kartikeya Dwivedi Date: Tue Sep 9 18:49:59 2025 +0000 rqspinlock: Choose trylock fallback for NMI waiters Currently, out of all 3 types of waiters in the rqspinlock slow path (i.e., pending bit waiter, wait queue head waiter, and wait queue non-head waiter), only the pending bit waiter and wait queue head waiters apply deadlock checks and a timeout on their waiting loop. The assumption here was that the wait queue head's forward progress would be sufficient to identify cases where the lock owner or pending bit waiter is stuck, and non-head waiters relying on the head waiter would prove to be sufficient for their own forward progress. However, the head waiter itself can be preempted by a non-head waiter for the same lock (AA) or a different lock (ABBA) in a manner that impedes its forward progress. In such a case, non-head waiters not performing deadlock and timeout checks becomes insufficient, and the system can enter a state of lockup. This is typically not a concern with non-NMI lock acquisitions, as lock holders which in run in different contexts (IRQ, non-IRQ) use "irqsave" variants of the lock APIs, which naturally excludes such lock holders from preempting one another on the same CPU. It might seem likely that a similar case may occur for rqspinlock when programs are attached to contention tracepoints (begin, end), however, these tracepoints either precede the enqueue into the wait queue, or succeed it, therefore cannot be used to preempt a head waiter's waiting loop. We must still be careful against nested kprobe and fentry programs that may attach to the middle of the head's waiting loop to stall forward progress and invoke another rqspinlock acquisition that proceeds as a non-head waiter. To this end, drop CC_FLAGS_FTRACE from the rqspinlock.o object file. For now, this issue is resolved by falling back to a repeated trylock on the lock word from NMI context, while performing the deadlock checks to break out early in case forward progress is impossible, and use the timeout as a final fallback. A more involved fix to terminate the queue when such a condition occurs will be made as a follow up. A selftest to stress this aspect of nested NMI/non-NMI locking attempts will be added in a subsequent patch to the bpf-next tree when this fix lands and trees are synchronized. Reported-by: Josef Bacik Fixes: 164c246571e9 ("rqspinlock: Protect waiters in queue from stalls") Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250909184959.3509085-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 30f241fcf52aaaef7ac16e66530faa11be78a865 Author: Maciej Fijalkowski Date: Thu Sep 4 21:49:07 2025 +0200 xsk: Fix immature cq descriptor production Eryk reported an issue that I have put under Closes: tag, related to umem addrs being prematurely produced onto pool's completion queue. Let us make the skb's destructor responsible for producing all addrs that given skb used. Commit from fixes tag introduced the buggy behavior, it was not broken from day 1, but rather when xsk multi-buffer got introduced. In order to mitigate performance impact as much as possible, mimic the linear and frag parts within skb by storing the first address from XSK descriptor at sk_buff::destructor_arg. For fragments, store them at ::cb via list. The nodes that will go onto list will be allocated via kmem_cache. xsk_destruct_skb() will consume address stored at ::destructor_arg and optionally go through list from ::cb, if count of descriptors associated with this particular skb is bigger than 1. Previous approach where whole array for storing UMEM addresses from XSK descriptors was pre-allocated during first fragment processing yielded too big performance regression for 64b traffic. In current approach impact is much reduced on my tests and for jumbo frames I observed traffic being slower by at most 9%. Magnus suggested to have this way of processing special cased for XDP_SHARED_UMEM, so we would identify this during bind and set different hooks for 'backpressure mechanism' on CQ and for skb destructor, but given that results looked promising on my side I decided to have a single data path for XSK generic Tx. I suppose other auxiliary stuff would have to land as well in order to make it work. Fixes: b7f72a30e9ac ("xsk: introduce wrappers and helpers for supporting multi-buffer in Tx path") Reported-by: Eryk Kubanski Closes: https://lore.kernel.org/netdev/20250530103456.53564-1-e.kubanski@partner.samsung.com/ Acked-by: Stanislav Fomichev Signed-off-by: Maciej Fijalkowski Tested-by: Jason Xing Reviewed-by: Jason Xing Link: https://lore.kernel.org/r/20250904194907.2342177-1-maciej.fijalkowski@intel.com Signed-off-by: Alexei Starovoitov commit 6c6f5c19e67c89e974ef0dd8601804eaa4ae868d Author: Eduard Zingerman Date: Tue Sep 9 10:16:38 2025 -0700 bpf: Update the list of BPF selftests maintainers Unfortunately Mykola won't participate in BPF selftests maintenance anymore. Remove the entry on his behalf. Acked-by: Mykola Lysenko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250909171638.2417272-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 813104c192740ca58ce7131faf31a7f118645ae1 Merge: 387be23a95b147 6624fb2f338227 Author: Andrii Nakryiko Date: Fri Aug 29 11:32:03 2025 -0700 Merge branch 'fix-bpf_strnstr-len-error' Rong Tao says: ==================== Fix bpf_strnstr() wrong 'len' parameter, bpf_strnstr("open", "open", 4) should return 0 instead of -ENOENT. And fix a more general case when s2 is a suffix of the first len characters of s1. ==================== Link: https://patch.msgid.link/tencent_E72A37AF03A3B18853066E421B5969976208@qq.com Signed-off-by: Andrii Nakryiko Signed-off-by: Alexei Starovoitov commit 387be23a95b14705a804900c3a0db5a12bf19636 Merge: 3aa9b9a165d5e9 5d40c038c879ee Author: Alexei Starovoitov Date: Fri Aug 29 11:22:15 2025 -0700 Merge branch 'selftests-bpf-fix-expression-result-unused-warnings-with-icecc' Ilya Leoshkevich says: ==================== selftests/bpf: Fix "expression result unused" warnings with icecc v3: https://lore.kernel.org/bpf/20250827194929.416969-1-iii@linux.ibm.com/ v3 -> v4: Go back to the original solution (Yonghong, Alexei). v2: https://lore.kernel.org/bpf/20250827130519.411700-1-iii@linux.ibm.com/ v2 -> v3: Do not touch libbpf, explain how having two function declarations works (Andrii). Fix bpf-gcc build (CI). v1: https://lore.kernel.org/bpf/20250508113804.304665-1-iii@linux.ibm.com/ v1 -> v2: Annotate bpf_obj_new_impl() with __must_check (Alexei). Add an explanation about icecc. I took another look at the "expression result unused" warnings I've been seeing, and it turned out that the root cause was the icecc compiler wrapper and what I consider a clang bug. Back then I've reported that the problem was reproducible with plain clang, but now I see that it was clearly a mixup, sorry about that. The solution is to add a few awkward (void) casts. I've added a detailed explanation of why they are helpful to the commit message. ==================== Link: https://patch.msgid.link/20250829030017.102615-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 6624fb2f3382271953f951d46f2ea30415a0917e Author: Rong Tao Date: Sat Aug 30 00:32:13 2025 +0800 selftests/bpf: Add tests for bpf_strnstr Add tests for bpf_strnstr(): bpf_strnstr("", "", 0) = 0 bpf_strnstr("hello world", "hello", 5) = 0 bpf_strnstr(str, "hello", 4) = -ENOENT bpf_strnstr("", "a", 0) = -ENOENT Signed-off-by: Rong Tao Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/tencent_2ED218F8082565C95D86A804BDDA8DBA200A@qq.com Signed-off-by: Alexei Starovoitov commit 5d40c038c879eeb910039adeaf6102e1c4dda807 Author: Ilya Leoshkevich Date: Fri Aug 29 04:53:57 2025 +0200 selftests/bpf: Fix "expression result unused" warnings with icecc icecc is a compiler wrapper that distributes compile jobs over a build farm [1]. It works by sending toolchain binaries and preprocessed source code to remote machines. Unfortunately using it with BPF selftests causes build failures due to a clang bug [2]. The problem is that clang suppresses the -Wunused-value warning if the unused expression comes from a macro expansion. Since icecc compiles preprocessed source code, this information is not available. This leads to -Wunused-value false positives. obj_new_no_struct() and obj_new_acq() use the bpf_obj_new() macro and discard the result. arena_spin_lock_slowpath() uses two macros that produce values and ignores the results. Add (void) casts to explicitly indicate that this is intentional and suppress the warning. An alternative solution is to change the macros to not produce values. This would work today for the arena_spin_lock_slowpath() issue, but in the future there may appear users who need them. Another potential solution is to replace these macros with functions. Unfortunately this would not work, because these macros work with unknown types and control flow. [1] https://github.com/icecc/icecream [2] https://github.com/llvm/llvm-project/issues/142614 Signed-off-by: Ilya Leoshkevich Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250829030017.102615-2-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 7edfc024708258d75f65fadffd7e5f6ac46810b6 Author: Rong Tao Date: Sat Aug 30 00:31:58 2025 +0800 bpf: Fix bpf_strnstr() to handle suffix match cases better bpf_strnstr() should not treat the ending '\0' of s2 as a matching character if the parameter 'len' equal to s2 string length, for example: 1. bpf_strnstr("openat", "open", 4) = -ENOENT 2. bpf_strnstr("openat", "open", 5) = 0 This patch makes (1) return 0, fix just the `len == strlen(s2)` case. And fix a more general case when s2 is a suffix of the first len characters of s1. Fixes: e91370550f1f ("bpf: Add kfuncs for read-only string operations") Signed-off-by: Rong Tao Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/tencent_17DC57B9D16BC443837021BEACE84B7C1507@qq.com Signed-off-by: Alexei Starovoitov commit 3aa9b9a165d5e9afc7d8b5dbcd508810c05c8e89 Author: Daniel Borkmann Date: Fri Aug 29 16:36:57 2025 +0200 selftests/bpf: Extend crypto_sanity selftest with invalid dst buffer Small cleanup and test extension to probe the bpf_crypto_{encrypt,decrypt}() kfunc when a bad dst buffer is passed in to assert that an error is returned. Also, encrypt_sanity() and skb_crypto_setup() were explicit to set the global status variable to zero before any test, so do the same for decrypt_sanity(). Do not explicitly zero the on-stack err before bpf_crypto_ctx_create() given the kfunc is expected to do it internally for the success case. Before kernel fix: # ./vmtest.sh -- ./test_progs -t crypto [...] [ 1.531200] bpf_testmod: loading out-of-tree module taints kernel. [ 1.533388] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel #87/1 crypto_basic/crypto_release:OK #87/2 crypto_basic/crypto_acquire:OK #87 crypto_basic:OK test_crypto_sanity:PASS:skel open 0 nsec test_crypto_sanity:PASS:ip netns add crypto_sanity_ns 0 nsec test_crypto_sanity:PASS:ip -net crypto_sanity_ns -6 addr add face::1/128 dev lo nodad 0 nsec test_crypto_sanity:PASS:ip -net crypto_sanity_ns link set dev lo up 0 nsec test_crypto_sanity:PASS:open_netns 0 nsec test_crypto_sanity:PASS:AF_ALG init fail 0 nsec test_crypto_sanity:PASS:if_nametoindex lo 0 nsec test_crypto_sanity:PASS:skb_crypto_setup fd 0 nsec test_crypto_sanity:PASS:skb_crypto_setup 0 nsec test_crypto_sanity:PASS:skb_crypto_setup retval 0 nsec test_crypto_sanity:PASS:skb_crypto_setup status 0 nsec test_crypto_sanity:PASS:create qdisc hook 0 nsec test_crypto_sanity:PASS:make_sockaddr 0 nsec test_crypto_sanity:PASS:attach encrypt filter 0 nsec test_crypto_sanity:PASS:encrypt socket 0 nsec test_crypto_sanity:PASS:encrypt send 0 nsec test_crypto_sanity:FAIL:encrypt status unexpected error: -5 (errno 95) #88 crypto_sanity:FAIL Summary: 1/2 PASSED, 0 SKIPPED, 1 FAILED After kernel fix: # ./vmtest.sh -- ./test_progs -t crypto [...] [ 1.540963] bpf_testmod: loading out-of-tree module taints kernel. [ 1.542404] bpf_testmod: module verification failed: signature and/or required key missing - tainting kernel #87/1 crypto_basic/crypto_release:OK #87/2 crypto_basic/crypto_acquire:OK #87 crypto_basic:OK #88 crypto_sanity:OK Summary: 2/2 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Daniel Borkmann Cc: Vadim Fedorenko Link: https://lore.kernel.org/r/20250829143657.318524-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit f9bb6ffa7f5ad0f8ee0f53fc4a10655872ee4a14 Author: Daniel Borkmann Date: Fri Aug 29 16:36:56 2025 +0200 bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt Stanislav reported that in bpf_crypto_crypt() the destination dynptr's size is not validated to be at least as large as the source dynptr's size before calling into the crypto backend with 'len = src_len'. This can result in an OOB write when the destination is smaller than the source. Concretely, in mentioned function, psrc and pdst are both linear buffers fetched from each dynptr: psrc = __bpf_dynptr_data(src, src_len); [...] pdst = __bpf_dynptr_data_rw(dst, dst_len); [...] err = decrypt ? ctx->type->decrypt(ctx->tfm, psrc, pdst, src_len, piv) : ctx->type->encrypt(ctx->tfm, psrc, pdst, src_len, piv); The crypto backend expects pdst to be large enough with a src_len length that can be written. Add an additional src_len > dst_len check and bail out if it's the case. Note that these kfuncs are accessible under root privileges only. Fixes: 3e1c6f35409f ("bpf: make common crypto API for TC/XDP programs") Reported-by: Stanislav Fort Signed-off-by: Daniel Borkmann Cc: Vadim Fedorenko Reviewed-by: Vadim Fedorenko Link: https://lore.kernel.org/r/20250829143657.318524-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 3318f2d20ce48849855df5e190813826d0bc3653 Author: David Rosca Date: Mon Aug 18 09:18:37 2025 +0200 drm/amdgpu/vcn: Allow limiting ctx to instance 0 for AV1 at any time There is no reason to require this to happen on first submitted IB only. We need to wait for the queue to be idle, but it can be done at any time (including when there are multiple video sessions active). Signed-off-by: David Rosca Reviewed-by: Leo Liu Signed-off-by: Alex Deucher (cherry picked from commit 8908fdce0634a623404e9923ed2f536101a39db5) Cc: stable@vger.kernel.org commit 2b10cb58d7a3fd621ec9b2ba765a092e562ef998 Author: David Rosca Date: Mon Aug 18 09:06:58 2025 +0200 drm/amdgpu/vcn4: Fix IB parsing with multiple engine info packages There can be multiple engine info packages in one IB and the first one may be common engine, not decode/encode. We need to parse the entire IB instead of stopping after finding first engine info. Signed-off-by: David Rosca Reviewed-by: Leo Liu Signed-off-by: Alex Deucher (cherry picked from commit dc8f9f0f45166a6b37864e7a031c726981d6e5fc) Cc: stable@vger.kernel.org commit 857ccfc19f9be1269716f3d681650c1bd149a656 Author: Pratap Nirujogi Date: Wed Sep 3 16:00:24 2025 -0400 drm/amd/amdgpu: Declare isp firmware binary file Declare isp firmware file isp_4_1_1.bin required by isp4.1.1 device. Suggested-by: Alexey Zagorodnikov Reviewed-by: Mario Limonciello Signed-off-by: Pratap Nirujogi Signed-off-by: Alex Deucher (cherry picked from commit d97b74a833eba1f4f69f67198fd98ef036c0e5f9) Cc: stable@vger.kernel.org commit 1d66c3f2b8c0b5c51f3f4fe29b362c9851190c5a Author: Alex Deucher Date: Wed Sep 3 09:11:12 2025 -0400 drm/amd/display: use udelay rather than fsleep This function can be called from an atomic context so we can't use fsleep(). Fixes: 01f60348d8fb ("drm/amd/display: Fix 'failed to blank crtc!'") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4549 Cc: Wen Chen Cc: Fangzhi Zuo Cc: Nicholas Kazlauskas Cc: Harry Wentland Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher (cherry picked from commit 27e4dc2c0543fd1808cc52bd888ee1e0533c4a2e) commit 7838fb5f119191403560eca2e23613380c0e425e Author: Alex Deucher Date: Thu Sep 4 12:35:05 2025 -0400 drm/amdgpu: fix a memory leak in fence cleanup when unloading Commit b61badd20b44 ("drm/amdgpu: fix usage slab after free") reordered when amdgpu_fence_driver_sw_fini() was called after that patch, amdgpu_fence_driver_sw_fini() effectively became a no-op as the sched entities we never freed because the ring pointers were already set to NULL. Remove the NULL setting. Reported-by: Lin.Cao Cc: Vitaly Prosyak Cc: Christian König Fixes: b61badd20b44 ("drm/amdgpu: fix usage slab after free") Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit a525fa37aac36c4591cc8b07ae8957862415fbd5) Cc: stable@vger.kernel.org commit 9dd1835ecda5b96ac88c166f4a87386f3e727bd9 Merge: f777d1112ee597 7e2368a21741e2 Author: Linus Torvalds Date: Tue Sep 9 11:03:04 2025 -0700 Merge tag 'dma-mapping-6.17-2025-09-09' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fix from Marek Szyprowski: - one more fix for DMA API debugging infrastructure (Baochen Qiang) * tag 'dma-mapping-6.17-2025-09-09' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma-debug: don't enforce dma mapping check on noncoherent allocations commit 503f1c72c31bbee21e669a08cf65c49e96d42755 Author: Jacob Keller Date: Wed Aug 27 14:17:36 2025 -0700 i40e: fix Jumbo Frame support after iPXE boot The i40e hardware has multiple hardware settings which define the Maximum Frame Size (MFS) of the physical port. The firmware has an AdminQ command (0x0603) to configure the MFS, but the i40e Linux driver never issues this command. In most cases this is no problem, as the NVM default value has the device configured for its maximum value of 9728. Unfortunately, recent versions of the iPXE intelxl driver now issue the 0x0603 Set Mac Config command, modifying the MFS and reducing it from its default value of 9728. This occurred as part of iPXE commit 6871a7de705b ("[intelxl] Use admin queue to set port MAC address and maximum frame size"), a prerequisite change for supporting the E800 series hardware in iPXE. Both the E700 and E800 firmware support the AdminQ command, and the iPXE code shares much of the logic between the two device drivers. The ice E800 Linux driver already issues the 0x0603 Set Mac Config command early during probe, and is thus unaffected by the iPXE change. Since commit 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set"), the i40e driver does check the I40E_PRTGL_SAH register, but it only logs a warning message if its value is below the 9728 default. This register also only covers received packets and not transmitted packets. A warning can inform system administrators, but does not correct the issue. No interactions from userspace cause the driver to write to PRTGL_SAH or issue the 0x0603 AdminQ command. Only a GLOBR reset will restore the value to its default value. There is no obvious method to trigger a GLOBR reset from user space. To fix this, introduce the i40e_aq_set_mac_config() function, similar to the one from the ice driver. Call this during early probe to ensure that the device configuration matches driver expectation. Unlike E800, the E700 firmware also has a bit to control whether the MAC should append CRC data. It is on by default, but setting a 0 to this bit would disable CRC. The i40e implementation must set this bit to ensure CRC will be appended by the MAC. In addition to the AQ command, instead of just checking the I40E_PRTGL_SAH register, update its value to the 9728 default and write it back. This ensures that the hardware is in the expected state, regardless of whether the iPXE (or any other early boot driver) has modified this state. This is a better user experience, as we now fix the issues with larger MTU instead of merely warning. It also aligns with the way the ice E800 series driver works. A final note: The Fixes tag provided here is not strictly accurate. The issue occurs as a result of an external entity (the iPXE intelxl driver), and this is not a regression specifically caused by the mentioned change. However, I believe the original change to just warn about PRTGL_SAH being too low was an insufficient fix. Fixes: 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") Link: https://github.com/ipxe/ipxe/commit/6871a7de705b6f6a4046f0d19da9bcd689c3bc8e Signed-off-by: Jacob Keller Signed-off-by: Aleksandr Loktionov Reviewed-by: Michal Schmidt Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit fd99415ec8a80866e5e19f7835876e7b4f294946 Author: Julia Filipchuk Date: Wed Sep 3 12:00:38 2025 -0700 drm/xe: Extend Wa_13011645652 to PTL-H, WCL Expand workaround to additional graphics architectures. Cc: Vinay Belgaumkar Cc: Stuart Summers Cc: Daniele Ceraolo Spurio Cc: Lucas De Marchi Cc: Thomas Hellström Cc: Rodrigo Vivi Cc: intel-xe@lists.freedesktop.org Cc: # v6.17+ Signed-off-by: Julia Filipchuk Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250903190122.1028373-2-julia.filipchuk@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 6fc957185e1691bb6dfa4193698a229db537c2a2) Signed-off-by: Rodrigo Vivi commit eb5723a75104605b7d2207a7d598e314166fbef4 Author: Thomas Hellström Date: Thu Sep 4 18:07:15 2025 +0200 drm/xe: Block exec and rebind worker while evicting for suspend / hibernate When the xe pm_notifier evicts for suspend / hibernate, there might be racing tasks trying to re-validate again. This can lead to suspend taking excessive time or get stuck in a live-lock. This behaviour becomes much worse with the fix that actually makes re-validation bring back bos to VRAM rather than letting them remain in TT. Prevent that by having exec and the rebind worker waiting for a completion that is set to block by the pm_notifier before suspend and is signaled by the pm_notifier after resume / wakeup. It's probably still possible to craft malicious applications that block suspending. More work is pending to fix that. v3: - Avoid wait_for_completion() in the kernel worker since it could potentially cause work item flushes from freezable processes to wait forever. Instead terminate the rebind workers if needed and re-launch at resume. (Matt Auld) v4: - Fix some bad naming and leftover debug printouts. - Fix kerneldoc. - Use drmm_mutex_init() for the xe->rebind_resume_lock (Matt Auld). - Rework the interface of xe_vm_rebind_resume_worker (Matt Auld). Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4288 Fixes: c6a4d46ec1d7 ("drm/xe: evict user memory in PM notifier") Cc: Matthew Auld Cc: Rodrigo Vivi Cc: # v6.16+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250904160715.2613-4-thomas.hellstrom@linux.intel.com (cherry picked from commit 599334572a5a99111015fbbd5152ce4dedc2f8b7) Signed-off-by: Rodrigo Vivi commit d84820309ed34cc412ce76ecfa9471dae7d7d144 Author: Thomas Hellström Date: Thu Sep 4 18:07:14 2025 +0200 drm/xe: Allow the pm notifier to continue on failure Its actions are opportunistic anyway and will be completed on device suspend. Marking as a fix to simplify backporting of the fix that follows in the series. v2: - Keep the runtime pm reference over suspend / hibernate and document why. (Matt Auld, Rodrigo Vivi): Fixes: c6a4d46ec1d7 ("drm/xe: evict user memory in PM notifier") Cc: Matthew Auld Cc: Rodrigo Vivi Cc: # v6.16+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250904160715.2613-3-thomas.hellstrom@linux.intel.com (cherry picked from commit ebd546fdffddfcaeab08afdd68ec93052c8fa740) Signed-off-by: Rodrigo Vivi commit 5c87fee3c96ce898ad681552404a66c7605193c0 Author: Thomas Hellström Date: Thu Sep 4 18:07:13 2025 +0200 drm/xe: Attempt to bring bos back to VRAM after eviction VRAM+TT bos that are evicted from VRAM to TT may remain in TT also after a revalidation following eviction or suspend. This manifests itself as applications becoming sluggish after buffer objects get evicted or after a resume from suspend or hibernation. If the bo supports placement in both VRAM and TT, and we are on DGFX, mark the TT placement as fallback. This means that it is tried only after VRAM + eviction. This flaw has probably been present since the xe module was upstreamed but use a Fixes: commit below where backporting is likely to be simple. For earlier versions we need to open- code the fallback algorithm in the driver. v2: - Remove check for dgfx. (Matthew Auld) - Update the xe_dma_buf kunit test for the new strategy (CI) - Allow dma-buf to pin in current placement (CI) - Make xe_bo_validate() for pinned bos a NOP. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5995 Fixes: a78a8da51b36 ("drm/ttm: replace busy placement with flags v6") Cc: Matthew Brost Cc: Matthew Auld Cc: # v6.9+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250904160715.2613-2-thomas.hellstrom@linux.intel.com (cherry picked from commit cb3d7b3b46b799c96b54f8e8fe36794a55a77f0b) Signed-off-by: Rodrigo Vivi commit 7934fdc25ad642ab3dbc16d734ab58638520ea60 Author: Michal Wajdeczko Date: Thu Sep 4 12:35:21 2025 +0200 drm/xe/configfs: Don't touch survivability_mode on fini This is a user controlled configfs attribute, we should not modify that outside the configfs attr.store() implementation. Fixes: bc417e54e24b ("drm/xe: Enable configfs support for survivability mode") Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Riana Tauro Reviewed-by: Stuart Summers Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250904103521.7130-1-michal.wajdeczko@intel.com (cherry picked from commit 079a5c83dbd23db7a6eed8f558cf75e264d8a17b) Signed-off-by: Rodrigo Vivi commit 915470e1b44e71d1dd07ee067276f003c3521ee3 Author: Michal Schmidt Date: Mon Aug 18 17:39:03 2025 +0200 i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path If request_irq() in i40e_vsi_request_irq_msix() fails in an iteration later than the first, the error path wants to free the IRQs requested so far. However, it uses the wrong dev_id argument for free_irq(), so it does not free the IRQs correctly and instead triggers the warning: Trying to free already-free IRQ 173 WARNING: CPU: 25 PID: 1091 at kernel/irq/manage.c:1829 __free_irq+0x192/0x2c0 Modules linked in: i40e(+) [...] CPU: 25 UID: 0 PID: 1091 Comm: NetworkManager Not tainted 6.17.0-rc1+ #1 PREEMPT(lazy) Hardware name: [...] RIP: 0010:__free_irq+0x192/0x2c0 [...] Call Trace: free_irq+0x32/0x70 i40e_vsi_request_irq_msix.cold+0x63/0x8b [i40e] i40e_vsi_request_irq+0x79/0x80 [i40e] i40e_vsi_open+0x21f/0x2f0 [i40e] i40e_open+0x63/0x130 [i40e] __dev_open+0xfc/0x210 __dev_change_flags+0x1fc/0x240 netif_change_flags+0x27/0x70 do_setlink.isra.0+0x341/0xc70 rtnl_newlink+0x468/0x860 rtnetlink_rcv_msg+0x375/0x450 netlink_rcv_skb+0x5c/0x110 netlink_unicast+0x288/0x3c0 netlink_sendmsg+0x20d/0x430 ____sys_sendmsg+0x3a2/0x3d0 ___sys_sendmsg+0x99/0xe0 __sys_sendmsg+0x8a/0xf0 do_syscall_64+0x82/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] ---[ end trace 0000000000000000 ]--- Use the same dev_id for free_irq() as for request_irq(). I tested this with inserting code to fail intentionally. Fixes: 493fb30011b3 ("i40e: Move q_vectors from pointer to array to array of pointers") Signed-off-by: Michal Schmidt Reviewed-by: Aleksandr Loktionov Reviewed-by: Subbaraya Sundeep Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit d709f178abca22a4d3642513df29afe4323a594b Author: Kohei Enju Date: Fri Aug 15 15:26:31 2025 +0900 igb: fix link test skipping when interface is admin down The igb driver incorrectly skips the link test when the network interface is admin down (if_running == false), causing the test to always report PASS regardless of the actual physical link state. This behavior is inconsistent with other drivers (e.g. i40e, ice, ixgbe, etc.) which correctly test the physical link state regardless of admin state. Remove the if_running check to ensure link test always reflects the physical link state. Fixes: 8d420a1b3ea6 ("igb: correct link test not being run when link is down") Signed-off-by: Kohei Enju Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 75871a525a596ff4d16c4aebc0018f8d0923c9b1 Author: Tianyu Xu Date: Tue Aug 12 21:10:56 2025 +0800 igb: Fix NULL pointer dereference in ethtool loopback test The igb driver currently causes a NULL pointer dereference when executing the ethtool loopback test. This occurs because there is no associated q_vector for the test ring when it is set up, as interrupts are typically not added to the test rings. Since commit 5ef44b3cb43b removed the napi_id assignment in __xdp_rxq_info_reg(), there is no longer a need to pass a napi_id to it. Therefore, simply use 0 as the last parameter. Fixes: 2c6196013f84 ("igb: Add AF_XDP zero-copy Rx support") Reviewed-by: Aleksandr Loktionov Reviewed-by: Joe Damato Signed-off-by: Tianyu Xu Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 53503556273a5ead8b75534085e2dcb46e96f883 Author: Yifan Zhang Date: Wed Aug 20 16:10:51 2025 +0800 amd/amdkfd: correct mem limit calculation for small APUs Current mem limit check leaks some GTT memory (reserved_for_pt reserved_for_ras + adev->vram_pin_size) for small APUs. Since carveout VRAM is tunable on APUs, there are three case regarding the carveout VRAM size relative to GTT: 1. 0 < carveout < gtt apu_prefer_gtt = true, is_app_apu = false 2. carveout > gtt / 2 apu_prefer_gtt = false, is_app_apu = false 3. 0 = carveout apu_prefer_gtt = true, is_app_apu = true It doesn't make sense to check below limitation in case 1 (default case, small carveout) because the values in the below expression are mixed with carveout and gtt. adev->kfd.vram_used[xcp_id] + vram_needed > vram_size - reserved_for_pt - reserved_for_ras - atomic64_read(&adev->vram_pin_size) gtt: kfd.vram_used, vram_needed, vram_size carveout: reserved_for_pt, reserved_for_ras, adev->vram_pin_size In case 1, vram allocation will go to gtt domain, skip vram check since ttm_mem_limit check already cover this allocation. Signed-off-by: Yifan Zhang Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit fa7c99f04f6dd299388e9282812b14e95558ac8e) commit ce42a3b581a9db10765eb835840b04dbe7972135 Author: Eric Huang Date: Mon Aug 25 09:50:49 2025 -0400 drm/amdkfd: fix p2p links bug in topology When creating p2p links, KFD needs to check XGMI link with two conditions, hive_id and is_sharing_enabled, but it is missing to check is_sharing_enabled, so add it to fix the error. Signed-off-by: Eric Huang Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 36cc7d13178d901982da7a122c883861d98da624) commit 1dfd2864a1c4909147663e5a27c055f50f7c2796 Author: Geoffrey McRae Date: Thu Aug 28 22:26:22 2025 +1000 drm/amd/display: remove oem i2c adapter on finish Fixes a bug where unbinding of the GPU would leave the oem i2c adapter registered resulting in a null pointer dereference when applications try to access the invalid device. Fixes: 3d5470c97314 ("drm/amd/display/dm: add support for OEM i2c bus") Cc: Harry Wentland Reviewed-by: Alex Deucher Signed-off-by: Geoffrey McRae Signed-off-by: Alex Deucher (cherry picked from commit 89923fb7ead4fdd37b78dd49962d9bb5892403e6) Cc: stable@vger.kernel.org commit 60f71f0db7b12f303789ef59949e38ee5838ee8b Author: Mario Limonciello (AMD) Date: Fri Sep 5 10:36:27 2025 -0500 drm/amd/display: Drop dm_prepare_suspend() and dm_complete() [Why] dm_prepare_suspend() was added in commit 50e0bae34fa6b ("drm/amd/display: Add and use new dm_prepare_suspend() callback") to allow display to turn off earlier in the suspend sequence. This caused a regression that HDMI audio sometimes didn't work properly after resume unless audio was playing during suspend. [How] Drop dm_prepare_suspend() callback. All code in it will still run during dm_suspend(). Also drop unnecessary dm_complete() callback. dm_complete() was used for failed prepare and also for any case of successful resume. The code in it already runs in dm_resume(). This change will introduce more time that the display is turned on during suspend sequence. The compositor can turn it off sooner if desired. Cc: Harry Wentland Reported-by: Przemysław Kopa Closes: https://lore.kernel.org/amd-gfx/1cea0d56-7739-4ad9-bf8e-c9330faea2bb@kernel.org/T/#m383d9c08397043a271b36c32b64bb80e524e4b0f Reported-by: Kalvin Closes: https://github.com/alsa-project/alsa-lib/issues/465 Closes: https://gitlab.freedesktop.org/pipewire/pipewire/-/issues/4809 Fixes: 50e0bae34fa6b ("drm/amd/display: Add and use new dm_prepare_suspend() callback") Signed-off-by: Mario Limonciello Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 2fd653b9bb5aacec5d4c421ab290905898fe85a2) Cc: stable@vger.kernel.org commit 70f0b051f82d0234ade2f6753f72a2610048db3b Author: Ovidiu Bunea Date: Mon Aug 25 14:45:33 2025 -0400 drm/amd/display: Correct sequences and delays for DCN35 PG & RCG [why] The current PG & RCG programming in driver has some gaps and incorrect sequences. [how] Added delays after ungating clocks to allow ramp up, increased polling to allow more time for power up, and removed the incorrect sequences. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Charlene Liu Signed-off-by: Ovidiu Bunea Signed-off-by: Wayne Lin Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 1bde5584e297921f45911ae874b0175dce5ed4b5) Cc: stable@vger.kernel.org commit f5c32370dba668c171c73684f489a3ea0b9503c5 Author: Fangzhi Zuo Date: Thu Sep 4 15:13:51 2025 -0400 drm/amd/display: Disable DPCD Probe Quirk Disable dpcd probe quirk to native aux. Signed-off-by: Fangzhi Zuo Reviewed-by: Imre Deak Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4500 Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20250904191351.746707-1-Jerry.Zuo@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit c5f4fb40584ee591da9fa090c6f265d11cbb1acf) Cc: stable@vger.kernel.org # 6.16.y: 5281cbe0b55a Cc: stable@vger.kernel.org # 6.16.y: 0b4aa85e8981 Cc: stable@vger.kernel.org # 6.16.y: b87ed522b364 Cc: stable@vger.kernel.org # 6.16.y commit 596e8ba2faf0d2beb9bb68801622fa6461918c1d Author: Mohammad Rafi Shaik Date: Mon Sep 8 11:06:31 2025 +0530 ASoC: qcom: sc8280xp: Enable DAI format configuration for MI2S interfaces Add support for configuring the DAI format on MI2S interfaces, this enhancement allows setting the appropriate bit clock and frame clock polarity, ensuring correct audio data transmission over MI2S. Reviewed-by: Srinivas Kandagatla Signed-off-by: Mohammad Rafi Shaik Rule: add Link: https://lore.kernel.org/stable/20250908053631.70978-4-mohammad.rafi.shaik%40oss.qualcomm.com Message-ID: <20250908053631.70978-4-mohammad.rafi.shaik@oss.qualcomm.com> Signed-off-by: Mark Brown commit 33b55b94bca904ca25a9585e3cd43d15f0467969 Author: Mohammad Rafi Shaik Date: Mon Sep 8 11:06:30 2025 +0530 ASoC: qcom: q6apm-lpass-dais: Fix missing set_fmt DAI op for I2S The q6i2s_set_fmt() function was defined but never linked into the I2S DAI operations, resulting DAI format settings is being ignored during stream setup. This change fixes the issue by properly linking the .set_fmt handler within the DAI ops. Fixes: 30ad723b93ade ("ASoC: qdsp6: audioreach: add q6apm lpass dai support") Cc: stable@vger.kernel.org Reviewed-by: Srinivas Kandagatla Signed-off-by: Mohammad Rafi Shaik Message-ID: <20250908053631.70978-3-mohammad.rafi.shaik@oss.qualcomm.com> Signed-off-by: Mark Brown commit 5f1af203ef964e7f7bf9d32716dfa5f332cc6f09 Author: Mohammad Rafi Shaik Date: Mon Sep 8 11:06:29 2025 +0530 ASoC: qcom: audioreach: Fix lpaif_type configuration for the I2S interface Fix missing lpaif_type configuration for the I2S interface. The proper lpaif interface type required to allow DSP to vote appropriate clock setting for I2S interface. Fixes: 25ab80db6b133 ("ASoC: qdsp6: audioreach: add module configuration command helpers") Cc: stable@vger.kernel.org Reviewed-by: Srinivas Kandagatla Signed-off-by: Mohammad Rafi Shaik Message-ID: <20250908053631.70978-2-mohammad.rafi.shaik@oss.qualcomm.com> Signed-off-by: Mark Brown commit 641427d5bf90af0625081bf27555418b101274cd Author: Alex Tran Date: Wed Sep 3 20:17:09 2025 -0700 docs: networking: can: change bcm_msg_head frames member to support flexible array The documentation of the 'bcm_msg_head' struct does not match how it is defined in 'bcm.h'. Changed the frames member to a flexible array, matching the definition in the header file. See commit 94dfc73e7cf4 ("treewide: uapi: Replace zero-length arrays with flexible-array members") Signed-off-by: Alex Tran Acked-by: Oliver Hartkopp Link: https://patch.msgid.link/20250904031709.1426895-1-alex.t.tran@gmail.com Fixes: 94dfc73e7cf4 ("treewide: uapi: Replace zero-length arrays with flexible-array members") Link: https://bugzilla.kernel.org/show_bug.cgi?id=217783 Signed-off-by: Marc Kleine-Budde commit e895f8e29119c8c966ea794af9e9100b10becb88 Author: Xiongfeng Wang Date: Tue Aug 5 16:10:25 2025 +0800 hrtimers: Unconditionally update target CPU base after offline timer migration When testing softirq based hrtimers on an ARM32 board, with high resolution mode and NOHZ inactive, softirq based hrtimers fail to expire after being moved away from an offline CPU: CPU0 CPU1 hrtimer_start(..., HRTIMER_MODE_SOFT); cpu_down(CPU1) ... hrtimers_cpu_dying() // Migrate timers to CPU0 smp_call_function_single(CPU0, returgger_next_event); retrigger_next_event() if (!highres && !nohz) return; As retrigger_next_event() is a NOOP when both high resolution timers and NOHZ are inactive CPU0's hrtimer_cpu_base::softirq_expires_next is not updated and the migrated softirq timers never expire unless there is a softirq based hrtimer queued on CPU0 later. Fix this by removing the hrtimer_hres_active() and tick_nohz_active() check in retrigger_next_event(), which enforces a full update of the CPU base. As this is not a fast path the extra cost does not matter. [ tglx: Massaged change log ] Fixes: 5c0930ccaad5 ("hrtimers: Push pending hrtimers away from outgoing CPU earlier") Co-developed-by: Frederic Weisbecker Signed-off-by: Frederic Weisbecker Signed-off-by: Xiongfeng Wang Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250805081025.54235-1-wangxiongfeng2@huawei.com commit 690aa09b1845c0d5c3c29dabd50a9d0488c97c48 Author: Amadeusz Sławiński Date: Tue Sep 9 11:28:29 2025 +0200 ASoC: Intel: catpt: Expose correct bit depth to userspace Currently wrong bit depth is exposed in hw params, causing clipped volume during playback. Expose correct parameters. Fixes: a126750fc865 ("ASoC: Intel: catpt: PCM operations") Reported-by: Andy Shevchenko Tested-by: Andy Shevchenko Reviewed-by: Cezary Rojewski Signed-off-by: Amadeusz Sławiński Message-ID: <20250909092829.375953-1-amadeuszx.slawinski@linux.intel.com> Signed-off-by: Mark Brown commit e3c674db356c4303804b2415e7c2b11776cdd8c3 Author: Antoine Tenart Date: Thu Sep 4 14:53:50 2025 +0200 tunnels: reset the GSO metadata before reusing the skb If a GSO skb is sent through a Geneve tunnel and if Geneve options are added, the split GSO skb might not fit in the MTU anymore and an ICMP frag needed packet can be generated. In such case the ICMP packet might go through the segmentation logic (and dropped) later if it reaches a path were the GSO status is checked and segmentation is required. This is especially true when an OvS bridge is used with a Geneve tunnel attached to it. The following set of actions could lead to the ICMP packet being wrongfully segmented: 1. An skb is constructed by the TCP layer (e.g. gso_type SKB_GSO_TCPV4, segs >= 2). 2. The skb hits the OvS bridge where Geneve options are added by an OvS action before being sent through the tunnel. 3. When the skb is xmited in the tunnel, the split skb does not fit anymore in the MTU and iptunnel_pmtud_build_icmp is called to generate an ICMP fragmentation needed packet. This is done by reusing the original (GSO!) skb. The GSO metadata is not cleared. 4. The ICMP packet being sent back hits the OvS bridge again and because skb_is_gso returns true, it goes through queue_gso_packets... 5. ...where __skb_gso_segment is called. The skb is then dropped. 6. Note that in the above example on re-transmission the skb won't be a GSO one as it would be segmented (len > MSS) and the ICMP packet should go through. Fix this by resetting the GSO information before reusing an skb in iptunnel_pmtud_build_icmp and iptunnel_pmtud_build_icmpv6. Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets") Reported-by: Adrian Moreno Signed-off-by: Antoine Tenart Reviewed-by: Stefano Brivio Link: https://patch.msgid.link/20250904125351.159740-1-atenart@kernel.org Signed-off-by: Paolo Abeni commit 249e0a47cdb46bb9eae65511c569044bd8698d7d Author: Max Kellermann Date: Thu Aug 28 13:15:52 2025 +0200 ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error The function move_dirty_folio_in_page_array() was created by commit ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method") by moving code from ceph_writepages_start() to this function. This new function is supposed to return an error code which is checked by the caller (now ceph_process_folio_batch()), and on error, the caller invokes redirty_page_for_writepage() and then breaks from the loop. However, the refactoring commit has gone wrong, and it by accident, it always returns 0 (= success) because it first NULLs the pointer and then returns PTR_ERR(NULL) which is always 0. This means errors are silently ignored, leaving NULL entries in the page array, which may later crash the kernel. The simple solution is to call PTR_ERR() before clearing the pointer. Cc: stable@vger.kernel.org Fixes: ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method") Link: https://lore.kernel.org/ceph-devel/aK4v548CId5GIKG1@swift.blarg.de/ Signed-off-by: Max Kellermann Reviewed-by: Ilya Dryomov Signed-off-by: Ilya Dryomov commit cce7c15faaac79b532a07ed6ab8332280ad83762 Author: Max Kellermann Date: Wed Aug 27 20:17:08 2025 +0200 ceph: always call ceph_shift_unused_folios_left() The function ceph_process_folio_batch() sets folio_batch entries to NULL, which is an illegal state. Before folio_batch_release() crashes due to this API violation, the function ceph_shift_unused_folios_left() is supposed to remove those NULLs from the array. However, since commit ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method"), this shifting doesn't happen anymore because the "for" loop got moved to ceph_process_folio_batch(), and now the `i` variable that remains in ceph_writepages_start() doesn't get incremented anymore, making the shifting effectively unreachable much of the time. Later, commit 1551ec61dc55 ("ceph: introduce ceph_submit_write() method") added more preconditions for doing the shift, replacing the `i` check (with something that is still just as broken): - if ceph_process_folio_batch() fails, shifting never happens - if ceph_move_dirty_page_in_page_array() was never called (because ceph_process_folio_batch() has returned early for some of various reasons), shifting never happens - if `processed_in_fbatch` is zero (because ceph_process_folio_batch() has returned early for some of the reasons mentioned above or because ceph_move_dirty_page_in_page_array() has failed), shifting never happens Since those two commits, any problem in ceph_process_folio_batch() could crash the kernel, e.g. this way: BUG: kernel NULL pointer dereference, address: 0000000000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] SMP NOPTI CPU: 172 UID: 0 PID: 2342707 Comm: kworker/u778:8 Not tainted 6.15.10-cm4all1-es #714 NONE Hardware name: Dell Inc. PowerEdge R7615/0G9DHV, BIOS 1.6.10 12/08/2023 Workqueue: writeback wb_workfn (flush-ceph-1) RIP: 0010:folios_put_refs+0x85/0x140 Code: 83 c5 01 39 e8 7e 76 48 63 c5 49 8b 5c c4 08 b8 01 00 00 00 4d 85 ed 74 05 41 8b 44 ad 00 48 8b 15 b0 > RSP: 0018:ffffb880af8db778 EFLAGS: 00010207 RAX: 0000000000000001 RBX: 0000000000000000 RCX: 0000000000000003 RDX: ffffe377cc3b0000 RSI: 0000000000000000 RDI: ffffb880af8db8c0 RBP: 0000000000000000 R08: 000000000000007d R09: 000000000102b86f R10: 0000000000000001 R11: 00000000000000ac R12: ffffb880af8db8c0 R13: 0000000000000000 R14: 0000000000000000 R15: ffff9bd262c97000 FS: 0000000000000000(0000) GS:ffff9c8efc303000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000034 CR3: 0000000160958004 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: ceph_writepages_start+0xeb9/0x1410 The crash can be reproduced easily by changing the ceph_check_page_before_write() return value to `-E2BIG`. (Interestingly, the crash happens only if `huge_zero_folio` has already been allocated; without `huge_zero_folio`, is_huge_zero_folio(NULL) returns true and folios_put_refs() skips NULL entries instead of dereferencing them. That makes reproducing the bug somewhat unreliable. See https://lore.kernel.org/20250826231626.218675-1-max.kellermann@ionos.com for a discussion of this detail.) My suggestion is to move the ceph_shift_unused_folios_left() to right after ceph_process_folio_batch() to ensure it always gets called to fix up the illegal folio_batch state. Cc: stable@vger.kernel.org Fixes: ce80b76dd327 ("ceph: introduce ceph_process_folio_batch() method") Link: https://lore.kernel.org/ceph-devel/aK4v548CId5GIKG1@swift.blarg.de/ Signed-off-by: Max Kellermann Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit bec324f33d1ed346394b2eee25bf6dbf3511f727 Author: Alex Markuze Date: Tue Aug 12 09:57:39 2025 +0000 ceph: fix race condition where r_parent becomes stale before sending message When the parent directory's i_rwsem is not locked, req->r_parent may become stale due to concurrent operations (e.g. rename) between dentry lookup and message creation. Validate that r_parent matches the encoded parent inode and update to the correct inode if a mismatch is detected. [ idryomov: folded a follow-up fix from Alex to drop extra reference from ceph_get_reply_dir() in ceph_fill_trace(): ceph_get_reply_dir() may return a different, referenced inode when r_parent is stale and the parent directory lock is not held. ceph_fill_trace() used that inode but failed to drop the reference when it differed from req->r_parent, leaking an inode reference. Keep the directory inode in a local variable and iput() it at function end if it does not match req->r_parent. ] Cc: stable@vger.kernel.org Signed-off-by: Alex Markuze Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 15f519e9f883b316d86e2bb6b767a023aafd9d83 Author: Alex Markuze Date: Tue Aug 12 09:57:38 2025 +0000 ceph: fix race condition validating r_parent before applying state Add validation to ensure the cached parent directory inode matches the directory info in MDS replies. This prevents client-side race conditions where concurrent operations (e.g. rename) cause r_parent to become stale between request initiation and reply processing, which could lead to applying state changes to incorrect directory inodes. [ idryomov: folded a kerneldoc fixup and a follow-up fix from Alex to move CEPH_CAP_PIN reference when r_parent is updated: When the parent directory lock is not held, req->r_parent can become stale and is updated to point to the correct inode. However, the associated CEPH_CAP_PIN reference was not being adjusted. The CEPH_CAP_PIN is a reference on an inode that is tracked for accounting purposes. Moving this pin is important to keep the accounting balanced. When the pin was not moved from the old parent to the new one, it created two problems: The reference on the old, stale parent was never released, causing a reference leak. A reference for the new parent was never acquired, creating the risk of a reference underflow later in ceph_mdsc_release_request(). This patch corrects the logic by releasing the pin from the old parent and acquiring it for the new parent when r_parent is switched. This ensures reference accounting stays balanced. ] Cc: stable@vger.kernel.org Signed-off-by: Alex Markuze Reviewed-by: Viacheslav Dubeyko Signed-off-by: Ilya Dryomov commit 2682e7a317504a9d81cbb397249d4299e84dfadd Author: Johannes Berg Date: Tue Sep 9 12:17:34 2025 +0300 wifi: iwlwifi: fix 130/1030 configs The 130/1030 devices are really derivatives of 6030, with some small differences not pertaining to the MAC, so they must use the 6030 MAC config. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220472 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220517 Fixes: 35ac275ebe0c ("wifi: iwlwifi: cfg: finish config split") Cc: stable@vger.kernel.org Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250909121728.8e4911f12528.I3aa7194012a4b584fbd5ddaa3a77e483280f1de4@changeid Signed-off-by: Miri Korenblit commit d2e1b84c5141ff2ad465279acfc3cf943c960b78 Author: Reinette Chatre Date: Mon Sep 8 15:15:51 2025 -0700 fs/resctrl: Eliminate false positive lockdep warning when reading SNC counters Running resctrl_tests on an SNC-2 system with lockdep debugging enabled triggers several warnings with following trace: WARNING: CPU: 0 PID: 1914 at kernel/cpu.c:528 lockdep_assert_cpus_held ... Call Trace: __mon_event_count ? __lock_acquire ? __pfx___mon_event_count mon_event_count ? __pfx_smp_mon_event_count smp_mon_event_count smp_call_on_cpu_callback get_cpu_cacheinfo_level() called from __mon_event_count() requires CPU hotplug lock to be held. The hotplug lock is indeed held during this time, as confirmed by the lockdep_assert_cpus_held() within mon_event_read() that calls mon_event_count() via IPI, but the lockdep tracking is not able to follow the IPI. Fresh CPU cache information via get_cpu_cacheinfo_level() from __mon_event_count() was added to support the fix for the issue where resctrl inappropriately maintained links to L3 cache information that will be stale in the case when the associated CPU goes offline. Keep the cacheinfo ID in struct rdt_mon_domain to ensure that resctrl does not maintain stale cache information while CPUs can go offline. Return to using a pointer to the L3 cache information (struct cacheinfo) in struct rmid_read, rmid_read::ci. Initialize rmid_read::ci before the IPI where it is used. CPU hotplug lock is held across rmid_read::ci initialization and use to ensure that it points to accurate cache information. Fixes: 594902c986e2 ("x86,fs/resctrl: Remove inappropriate references to cacheinfo in the resctrl subsystem") Signed-off-by: Reinette Chatre Signed-off-by: Borislav Petkov (AMD) commit bf59028ea8d42e8d10bb3d847c9982488ee9e3a0 Author: Oscar Maes Date: Tue Sep 2 17:02:40 2025 +0200 selftests: net: add test for destination in broadcast packets Add test to check the broadcast ethernet destination field is set correctly. This test sends a broadcast ping, captures it using tcpdump and ensures that all bits of the 6 octet ethernet destination address are correctly set by examining the output capture file. Co-developed-by: Brett A C Sheffield Signed-off-by: Brett A C Sheffield Signed-off-by: Oscar Maes Link: https://patch.msgid.link/20250902150240.4272-1-oscmaes92@gmail.com Signed-off-by: Paolo Abeni commit 5f9df945d4e862979b50e4ecaba3dc81fb06e8ed Author: Claudio Imbrenda Date: Mon Aug 25 17:18:31 2025 +0200 KVM: s390: Fix FOLL_*/FAULT_FLAG_* confusion Pass the right type of flag to vcpu_dat_fault_handler(); it expects a FOLL_* flag (in particular FOLL_WRITE), but FAULT_FLAG_WRITE is passed instead. This still works because they happen to have the same integer value, but it's a mistake, thus the fix. Signed-off-by: Claudio Imbrenda Fixes: 05066cafa925 ("s390/mm/fault: Handle guest-related program interrupts in KVM") Acked-by: Christian Borntraeger Reviewed-by: David Hildenbrand Reviewed-by: Steffen Eiden Reviewed-by: Christoph Schlameuss Signed-off-by: Janosch Frank commit 185d903064f8680c2de43514c94fddc0d75ed00a Author: Claudio Imbrenda Date: Mon Aug 25 17:18:30 2025 +0200 KVM: s390: Fix incorrect usage of mmu_notifier_register() If mmu_notifier_register() fails, for example because a signal was pending, the mmu_notifier will not be registered. But when the VM gets destroyed, it will get unregistered anyway and that will cause one extra mmdrop(), which will eventually cause the mm of the process to be freed too early, and cause a use-after free. This bug happens rarely, and only when secure guests are involved. The solution is to check the return value of mmu_notifier_register() and return it to the caller (ultimately it will be propagated all the way to userspace). In case of -EINTR, userspace will try again. Fixes: ca2fd0609b5d ("KVM: s390: pv: add mmu_notifier") Signed-off-by: Claudio Imbrenda Reviewed-by: Christian Borntraeger Reviewed-by: David Hildenbrand Reviewed-by: Steffen Eiden Reviewed-by: Christoph Schlameuss Signed-off-by: Janosch Frank commit de4da7bd5c5172f6362b5994f541d830119840dc Author: Thomas Huth Date: Thu Aug 21 17:23:09 2025 +0200 KVM: s390: Fix access to unavailable adapter indicator pages during postcopy When you run a KVM guest with vhost-net and migrate that guest to another host, and you immediately enable postcopy after starting the migration, there is a big chance that the network connection of the guest won't work anymore on the destination side after the migration. With a debug kernel v6.16.0, there is also a call trace that looks like this: FAULT_FLAG_ALLOW_RETRY missing 881 CPU: 6 UID: 0 PID: 549 Comm: kworker/6:2 Kdump: loaded Not tainted 6.16.0 #56 NONE Hardware name: IBM 3931 LA1 400 (LPAR) Workqueue: events irqfd_inject [kvm] Call Trace: [<00003173cbecc634>] dump_stack_lvl+0x104/0x168 [<00003173cca69588>] handle_userfault+0xde8/0x1310 [<00003173cc756f0c>] handle_pte_fault+0x4fc/0x760 [<00003173cc759212>] __handle_mm_fault+0x452/0xa00 [<00003173cc7599ba>] handle_mm_fault+0x1fa/0x6a0 [<00003173cc73409a>] __get_user_pages+0x4aa/0xba0 [<00003173cc7349e8>] get_user_pages_remote+0x258/0x770 [<000031734be6f052>] get_map_page+0xe2/0x190 [kvm] [<000031734be6f910>] adapter_indicators_set+0x50/0x4a0 [kvm] [<000031734be7f674>] set_adapter_int+0xc4/0x170 [kvm] [<000031734be2f268>] kvm_set_irq+0x228/0x3f0 [kvm] [<000031734be27000>] irqfd_inject+0xd0/0x150 [kvm] [<00003173cc00c9ec>] process_one_work+0x87c/0x1490 [<00003173cc00dda6>] worker_thread+0x7a6/0x1010 [<00003173cc02dc36>] kthread+0x3b6/0x710 [<00003173cbed2f0c>] __ret_from_fork+0xdc/0x7f0 [<00003173cdd737ca>] ret_from_fork+0xa/0x30 3 locks held by kworker/6:2/549: #0: 00000000800bc958 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x7ee/0x1490 #1: 000030f3d527fbd0 ((work_completion)(&irqfd->inject)){+.+.}-{0:0}, at: process_one_work+0x81c/0x1490 #2: 00000000f99862b0 (&mm->mmap_lock){++++}-{3:3}, at: get_map_page+0xa8/0x190 [kvm] The "FAULT_FLAG_ALLOW_RETRY missing" indicates that handle_userfaultfd() saw a page fault request without ALLOW_RETRY flag set, hence userfaultfd cannot remotely resolve it (because the caller was asking for an immediate resolution, aka, FAULT_FLAG_NOWAIT, while remote faults can take time). With that, get_map_page() failed and the irq was lost. We should not be strictly in an atomic environment here and the worker should be sleepable (the call is done during an ioctl from userspace), so we can allow adapter_indicators_set() to just sleep waiting for the remote fault instead. Link: https://issues.redhat.com/browse/RHEL-42486 Signed-off-by: Peter Xu [thuth: Assembled patch description and fixed some cosmetical issues] Signed-off-by: Thomas Huth Reviewed-by: Claudio Imbrenda Acked-by: Janosch Frank Fixes: f65470661f36 ("KVM: s390/interrupt: do not pin adapter interrupt pages") [frankja: Added fixes tag] Signed-off-by: Janosch Frank commit cfa7b7659757f8d0fc4914429efa90d0d2577dd7 Author: Jani Nikula Date: Fri Sep 5 13:41:49 2025 +0300 drm/i915/power: fix size for for_each_set_bit() in abox iteration for_each_set_bit() expects size to be in bits, not bytes. The abox mask iteration uses bytes, but it works by coincidence, because the local variable holding the mask is unsigned long, and the mask only ever has bit 2 as the highest bit. Using a smaller type could lead to subtle and very hard to track bugs. Fixes: 62afef2811e4 ("drm/i915/rkl: RKL uses ABOX0 for pixel transfers") Cc: Ville Syrjälä Cc: Matt Roper Cc: stable@vger.kernel.org # v5.9+ Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250905104149.1144751-1-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit 7ea3baa6efe4bb93d11e1c0e6528b1468d7debf6) Signed-off-by: Tvrtko Ursulin commit a68172d95c2845d2b5455b072b4ff51ba32650e9 Author: Mike Rapoport (Microsoft) Date: Fri Sep 5 12:15:57 2025 +0300 MAINTAINERS: add tree entry to numa memblocks and emulation block Link: https://lkml.kernel.org/r/20250905091557.3529937-1-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Vlastimil Babka Acked-by: Lorenzo Stoakes Acked-by: Liam R. Howlett Cc: David Hildenbrand Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3260a3f0828e06f5f13fac69fb1999a6d60d9cff Author: Stanislav Fort Date: Fri Sep 5 13:10:46 2025 +0300 mm/damon/sysfs: fix use-after-free in state_show() state_show() reads kdamond->damon_ctx without holding damon_sysfs_lock. This allows a use-after-free race: CPU 0 CPU 1 ----- ----- state_show() damon_sysfs_turn_damon_on() ctx = kdamond->damon_ctx; mutex_lock(&damon_sysfs_lock); damon_destroy_ctx(kdamond->damon_ctx); kdamond->damon_ctx = NULL; mutex_unlock(&damon_sysfs_lock); damon_is_running(ctx); /* ctx is freed */ mutex_lock(&ctx->kdamond_lock); /* UAF */ (The race can also occur with damon_sysfs_kdamonds_rm_dirs() and damon_sysfs_kdamond_release(), which free or replace the context under damon_sysfs_lock.) Fix by taking damon_sysfs_lock before dereferencing the context, mirroring the locking used in pid_show(). The bug has existed since state_show() first accessed kdamond->damon_ctx. Link: https://lkml.kernel.org/r/20250905101046.2288-1-disclosure@aisle.com Fixes: a61ea561c871 ("mm/damon/sysfs: link DAMON for virtual address spaces monitoring") Signed-off-by: Stanislav Fort Reported-by: Stanislav Fort Reviewed-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit 0ce9398aa0830f15f92bbed73853f9861c3e74ff Author: wangzijie Date: Thu Sep 4 21:57:15 2025 +0800 proc: fix type confusion in pde_set_flags() Commit 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files") missed a key part in the definition of proc_dir_entry: union { const struct proc_ops *proc_ops; const struct file_operations *proc_dir_ops; }; So dereference of ->proc_ops assumes it is a proc_ops structure results in type confusion and make NULL check for 'proc_ops' not work for proc dir. Add !S_ISDIR(dp->mode) test before calling pde_set_flags() to fix it. Link: https://lkml.kernel.org/r/20250904135715.3972782-1-wangzijie1@honor.com Fixes: 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files") Signed-off-by: wangzijie Reported-by: Brad Spengler Closes: https://lore.kernel.org/all/20250903065758.3678537-1-wangzijie1@honor.com/ Cc: Alexey Dobriyan Cc: Al Viro Cc: Christian Brauner Cc: Jiri Slaby Cc: Stefano Brivio Cc: Signed-off-by: Andrew Morton commit 3fac212fe489aa0dbe8d80a42a7809840ca7b0f9 Author: Nathan Chancellor Date: Tue Sep 2 15:49:26 2025 -0700 compiler-clang.h: define __SANITIZE_*__ macros only when undefined Clang 22 recently added support for defining __SANITIZE__ macros similar to GCC [1], which causes warnings (or errors with CONFIG_WERROR=y or W=e) with the existing defines that the kernel creates to emulate this behavior with existing clang versions. In file included from :3: In file included from include/linux/compiler_types.h:171: include/linux/compiler-clang.h:37:9: error: '__SANITIZE_THREAD__' macro redefined [-Werror,-Wmacro-redefined] 37 | #define __SANITIZE_THREAD__ | ^ :352:9: note: previous definition is here 352 | #define __SANITIZE_THREAD__ 1 | ^ Refactor compiler-clang.h to only define the sanitizer macros when they are undefined and adjust the rest of the code to use these macros for checking if the sanitizers are enabled, clearing up the warnings and allowing the kernel to easily drop these defines when the minimum supported version of LLVM for building the kernel becomes 22.0.0 or newer. Link: https://lkml.kernel.org/r/20250902-clang-update-sanitize-defines-v1-1-cf3702ca3d92@kernel.org Link: https://github.com/llvm/llvm-project/commit/568c23bbd3303518c5056d7f03444dae4fdc8a9c [1] Signed-off-by: Nathan Chancellor Reviewed-by: Justin Stitt Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Bill Wendling Cc: Dmitriy Vyukov Cc: Marco Elver Cc: Signed-off-by: Andrew Morton commit 79357cd06d41d0f5a11b17d7c86176e395d10ef2 Author: Uladzislau Rezki (Sony) Date: Sun Aug 31 14:10:58 2025 +0200 mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc() kasan_populate_vmalloc() and its helpers ignore the caller's gfp_mask and always allocate memory using the hardcoded GFP_KERNEL flag. This makes them inconsistent with vmalloc(), which was recently extended to support GFP_NOFS and GFP_NOIO allocations. Page table allocations performed during shadow population also ignore the external gfp_mask. To preserve the intended semantics of GFP_NOFS and GFP_NOIO, wrap the apply_to_page_range() calls into the appropriate memalloc scope. xfs calls vmalloc with GFP_NOFS, so this bug could lead to deadlock. There was a report here https://lkml.kernel.org/r/686ea951.050a0220.385921.0016.GAE@google.com This patch: - Extends kasan_populate_vmalloc() and helpers to take gfp_mask; - Passes gfp_mask down to alloc_pages_bulk() and __get_free_page(); - Enforces GFP_NOFS/NOIO semantics with memalloc_*_save()/restore() around apply_to_page_range(); - Updates vmalloc.c and percpu allocator call sites accordingly. Link: https://lkml.kernel.org/r/20250831121058.92971-1-urezki@gmail.com Fixes: 451769ebb7e7 ("mm/vmalloc: alloc GFP_NO{FS,IO} for vmalloc") Signed-off-by: Uladzislau Rezki (Sony) Reported-by: syzbot+3470c9ffee63e4abafeb@syzkaller.appspotmail.com Reviewed-by: Andrey Ryabinin Cc: Baoquan He Cc: Michal Hocko Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Vincenzo Frascino Cc: Signed-off-by: Andrew Morton commit 04100f775c2ea501927f508f17ad824ad1f23c8d Author: Mark Tinguely Date: Fri Aug 29 10:18:15 2025 -0500 ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on a FS_IOC_FIEMAP of the extent list on a specially crafted mmap file. context_switch kernel/sched/core.c:5357 [inline] __schedule+0x1798/0x4cc0 kernel/sched/core.c:6961 __schedule_loop kernel/sched/core.c:7043 [inline] schedule+0x165/0x360 kernel/sched/core.c:7058 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7115 rwsem_down_write_slowpath+0x872/0xfe0 kernel/locking/rwsem.c:1185 __down_write_common kernel/locking/rwsem.c:1317 [inline] __down_write kernel/locking/rwsem.c:1326 [inline] down_write+0x1ab/0x1f0 kernel/locking/rwsem.c:1591 ocfs2_page_mkwrite+0x2ff/0xc40 fs/ocfs2/mmap.c:142 do_page_mkwrite+0x14d/0x310 mm/memory.c:3361 wp_page_shared mm/memory.c:3762 [inline] do_wp_page+0x268d/0x5800 mm/memory.c:3981 handle_pte_fault mm/memory.c:6068 [inline] __handle_mm_fault+0x1033/0x5440 mm/memory.c:6195 handle_mm_fault+0x40a/0x8e0 mm/memory.c:6364 do_user_addr_fault+0x764/0x1390 arch/x86/mm/fault.c:1387 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:copy_user_generic arch/x86/include/asm/uaccess_64.h:126 [inline] RIP: 0010:raw_copy_to_user arch/x86/include/asm/uaccess_64.h:147 [inline] RIP: 0010:_inline_copy_to_user include/linux/uaccess.h:197 [inline] RIP: 0010:_copy_to_user+0x85/0xb0 lib/usercopy.c:26 Code: e8 00 bc f7 fc 4d 39 fc 72 3d 4d 39 ec 77 38 e8 91 b9 f7 fc 4c 89 f7 89 de e8 47 25 5b fd 0f 01 cb 4c 89 ff 48 89 d9 4c 89 f6 a4 0f 1f 00 48 89 cb 0f 01 ca 48 89 d8 5b 41 5c 41 5d 41 5e 41 RSP: 0018:ffffc9000403f950 EFLAGS: 00050256 RAX: ffffffff84c7f101 RBX: 0000000000000038 RCX: 0000000000000038 RDX: 0000000000000000 RSI: ffffc9000403f9e0 RDI: 0000200000000060 RBP: ffffc9000403fa90 R08: ffffc9000403fa17 R09: 1ffff92000807f42 R10: dffffc0000000000 R11: fffff52000807f43 R12: 0000200000000098 R13: 00007ffffffff000 R14: ffffc9000403f9e0 R15: 0000200000000060 copy_to_user include/linux/uaccess.h:225 [inline] fiemap_fill_next_extent+0x1c0/0x390 fs/ioctl.c:145 ocfs2_fiemap+0x888/0xc90 fs/ocfs2/extent_map.c:806 ioctl_fiemap fs/ioctl.c:220 [inline] do_vfs_ioctl+0x1173/0x1430 fs/ioctl.c:532 __do_sys_ioctl fs/ioctl.c:596 [inline] __se_sys_ioctl+0x82/0x170 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f5f13850fd9 RSP: 002b:00007ffe3b3518b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f5f13850fd9 RDX: 0000200000000040 RSI: 00000000c020660b RDI: 0000000000000004 RBP: 6165627472616568 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffe3b3518f0 R13: 00007ffe3b351b18 R14: 431bde82d7b634db R15: 00007f5f1389a03b ocfs2_fiemap() takes a read lock of the ip_alloc_sem semaphore (since v2.6.22-527-g7307de80510a) and calls fiemap_fill_next_extent() to read the extent list of this running mmap executable. The user supplied buffer to hold the fiemap information page faults calling ocfs2_page_mkwrite() which will take a write lock (since v2.6.27-38-g00dc417fa3e7) of the same semaphore. This recursive semaphore will hold filesystem locks and causes a hang of the fileystem. The ip_alloc_sem protects the inode extent list and size. Release the read semphore before calling fiemap_fill_next_extent() in ocfs2_fiemap() and ocfs2_fiemap_inline(). This does an unnecessary semaphore lock/unlock on the last extent but simplifies the error path. Link: https://lkml.kernel.org/r/61d1a62b-2631-4f12-81e2-cd689914360b@oracle.com Fixes: 00dc417fa3e7 ("ocfs2: fiemap support") Signed-off-by: Mark Tinguely Reported-by: syzbot+541dcc6ee768f77103e7@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=541dcc6ee768f77103e7 Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit d613f53c83ec47089c4e25859d5e8e0359f6f8da Author: Miaohe Lin Date: Thu Aug 28 10:46:18 2025 +0800 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory When I did memory failure tests, below panic occurs: page dumped because: VM_BUG_ON_PAGE(PagePoisoned(page)) kernel BUG at include/linux/page-flags.h:616! Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 3 PID: 720 Comm: bash Not tainted 6.10.0-rc1-00195-g148743902568 #40 RIP: 0010:unpoison_memory+0x2f3/0x590 RSP: 0018:ffffa57fc8787d60 EFLAGS: 00000246 RAX: 0000000000000037 RBX: 0000000000000009 RCX: ffff9be25fcdc9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0 RBP: 0000000000300000 R08: ffffffffb4956f88 R09: 0000000000009ffb R10: 0000000000000284 R11: ffffffffb4926fa0 R12: ffffe6b00c000000 R13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe FS: 00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0 Call Trace: unpoison_memory+0x2f3/0x590 simple_attr_write_xsigned.constprop.0.isra.0+0xb3/0x110 debugfs_attr_write+0x42/0x60 full_proxy_write+0x5b/0x80 vfs_write+0xd5/0x540 ksys_write+0x64/0xe0 do_syscall_64+0xb9/0x1d0 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f08f0314887 RSP: 002b:00007ffece710078 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f08f0314887 RDX: 0000000000000009 RSI: 0000564787a30410 RDI: 0000000000000001 RBP: 0000564787a30410 R08: 000000000000fefe R09: 000000007fffffff R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009 R13: 00007f08f041b780 R14: 00007f08f0417600 R15: 00007f08f0416a00 Modules linked in: hwpoison_inject ---[ end trace 0000000000000000 ]--- RIP: 0010:unpoison_memory+0x2f3/0x590 RSP: 0018:ffffa57fc8787d60 EFLAGS: 00000246 RAX: 0000000000000037 RBX: 0000000000000009 RCX: ffff9be25fcdc9c8 RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0 RBP: 0000000000300000 R08: ffffffffb4956f88 R09: 0000000000009ffb R10: 0000000000000284 R11: ffffffffb4926fa0 R12: ffffe6b00c000000 R13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe FS: 00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x31c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) ---[ end Kernel panic - not syncing: Fatal exception ]--- The root cause is that unpoison_memory() tries to check the PG_HWPoison flags of an uninitialized page. So VM_BUG_ON_PAGE(PagePoisoned(page)) is triggered. This can be reproduced by below steps: 1.Offline memory block: echo offline > /sys/devices/system/memory/memory12/state 2.Get offlined memory pfn: page-types -b n -rlN 3.Write pfn to unpoison-pfn echo > /sys/kernel/debug/hwpoison/unpoison-pfn This scenario can be identified by pfn_to_online_page() returning NULL. And ZONE_DEVICE pages are never expected, so we can simply fail if pfn_to_online_page() == NULL to fix the bug. Link: https://lkml.kernel.org/r/20250828024618.1744895-1-linmiaohe@huawei.com Fixes: f1dd2cd13c4b ("mm, memory_hotplug: do not associate hotadded memory to zones until online") Signed-off-by: Miaohe Lin Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Naoya Horiguchi Cc: Signed-off-by: Andrew Morton commit 78d2d32f0b789d67cbe5cfea0c0714cb2446c37e Author: Carlos Llamas Date: Thu Aug 28 14:26:56 2025 +0000 mm/mremap: fix regression in vrm->new_addr check Commit 3215eaceca87 ("mm/mremap: refactor initial parameter sanity checks") moved the sanity check for vrm->new_addr from mremap_to() to check_mremap_params(). However, this caused a regression as vrm->new_addr is now checked even when MREMAP_FIXED and MREMAP_DONTUNMAP flags are not specified. In this case, vrm->new_addr can be garbage and create unexpected failures. Fix this by moving the new_addr check after the vrm_implies_new_addr() guard. This ensures that the new_addr is only checked when the user has specified one explicitly. Link: https://lkml.kernel.org/r/20250828142657.770502-1-cmllamas@google.com Fixes: 3215eaceca87 ("mm/mremap: refactor initial parameter sanity checks") Signed-off-by: Carlos Llamas Reviewed-by: Liam R. Howlett Reviewed-by: Vlastimil Babka Reviewed-by: Lorenzo Stoakes Cc: Carlos Llamas Cc: Jann Horn Signed-off-by: Andrew Morton commit 7989fdce69ec0a928e136477da2aa208a191fba2 Author: Vlad Dumitrescu Date: Fri Aug 22 15:55:16 2025 -0700 percpu: fix race on alloc failed warning limit The 'allocation failed, ...' warning messages can cause unlimited log spam, contrary to the implementation's intent. The warn_limit variable is accessed without synchronization. If more than threads enter the warning path at the same time, the variable will get decremented past 0. Once it becomes negative, the non-zero check will always return true leading to unlimited log spam. Use atomic operation to access warn_limit and change condition to test for non-negative (>= 0) - atomic_dec_if_positive will return -1 once warn_limit becomes 0. Continue to print disable message alongside the last warning. While the change cited in Fixes is only adjacent, the warning limit implementation was correct before it. Only non-atomic allocations were considered for warnings, and those happened to hold pcpu_alloc_mutex while accessing warn_limit. [vdumitrescu@nvidia.com: prevent warn_limit from going negative, per Christoph Lameter] Link: https://lkml.kernel.org/r/ee87cc59-2717-4dbb-8052-1d2692c5aaaa@nvidia.com Link: https://lkml.kernel.org/r/ab22061a-a62f-4429-945b-744e5cc4ba35@nvidia.com Fixes: f7d77dfc91f7 ("mm/percpu.c: print error message too if atomic alloc failed") Signed-off-by: Vlad Dumitrescu Reviewed-by: Baoquan He Cc: Christoph Lameter (Ampere) Cc: Dennis Zhou Cc: Tejun Heo Signed-off-by: Andrew Morton commit d3b28612bc5500133260aaf36794a0a0c287d61b Author: Jonas Rebmann Date: Fri Sep 5 14:20:50 2025 +0200 net: phy: NXP_TJA11XX: Update Kconfig with TJA1102 support Update the Kconfig description to indicate support for the TJA1102. Signed-off-by: Jonas Rebmann Link: https://patch.msgid.link/20250905-tja1102-kconfig-v1-1-a57e6ac4e264@pengutronix.de Signed-off-by: Jakub Kicinski commit 8625f5748fea960d2af4f3c3e9891ee8f6f80906 Author: Petr Machata Date: Fri Sep 5 13:12:33 2025 +0200 net: bridge: Bounce invalid boolopts The bridge driver currently tolerates options that it does not recognize. Instead, it should bounce them. Fixes: a428afe82f98 ("net: bridge: add support for user-controlled bool options") Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/e6fdca3b5a8d54183fbda075daffef38bdd7ddce.1757070067.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 674b34c4c770551e916ae707829c7faea4782d3a Author: Jonas Gorski Date: Fri Sep 5 14:45:07 2025 +0200 net: dsa: b53: fix ageing time for BCM53101 For some reason Broadcom decided that BCM53101 uses 0.5s increments for the ageing time register, but kept the field width the same [1]. Due to this, the actual ageing time was always half of what was configured. Fix this by adapting the limits and value calculation for BCM53101. So far it looks like this is the only chip with the increased tick speed: $ grep -l -r "Specifies the aging time in 0.5 seconds" cdk/PKG/chip | sort cdk/PKG/chip/bcm53101/bcm53101_a0_defs.h $ grep -l -r "Specifies the aging time in seconds" cdk/PKG/chip | sort cdk/PKG/chip/bcm53010/bcm53010_a0_defs.h cdk/PKG/chip/bcm53020/bcm53020_a0_defs.h cdk/PKG/chip/bcm53084/bcm53084_a0_defs.h cdk/PKG/chip/bcm53115/bcm53115_a0_defs.h cdk/PKG/chip/bcm53118/bcm53118_a0_defs.h cdk/PKG/chip/bcm53125/bcm53125_a0_defs.h cdk/PKG/chip/bcm53128/bcm53128_a0_defs.h cdk/PKG/chip/bcm53134/bcm53134_a0_defs.h cdk/PKG/chip/bcm53242/bcm53242_a0_defs.h cdk/PKG/chip/bcm53262/bcm53262_a0_defs.h cdk/PKG/chip/bcm53280/bcm53280_a0_defs.h cdk/PKG/chip/bcm53280/bcm53280_b0_defs.h cdk/PKG/chip/bcm53600/bcm53600_a0_defs.h cdk/PKG/chip/bcm89500/bcm89500_a0_defs.h [1] https://github.com/Broadcom/OpenMDK/blob/a5d3fc9b12af3eeb68f2ca0ce7ec4056cd14d6c2/cdk/PKG/chip/bcm53101/bcm53101_a0_defs.h#L28966 Fixes: e39d14a760c0 ("net: dsa: b53: implement setting ageing time") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250905124507.59186-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 1dbfb0363224f6da56f6655d596dc5097308d6f5 Author: Alok Tiwari Date: Fri Sep 5 06:57:27 2025 -0700 genetlink: fix genl_bind() invoking bind() after -EPERM Per family bind/unbind callbacks were introduced to allow families to track multicast group consumer presence, e.g. to start or stop producing events depending on listeners. However, in genl_bind() the bind() callback was invoked even if capability checks failed and ret was set to -EPERM. This means that callbacks could run on behalf of unauthorized callers while the syscall still returned failure to user space. Fix this by only invoking bind() after "if (ret) break;" check i.e. after permission checks have succeeded. Fixes: 3de21a8990d3 ("genetlink: Add per family bind/unbind callbacks") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250905135731.3026965-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit a061e739d36220c002da8b2429d5f16f637eb59a Author: Christian Marangi Date: Mon Sep 8 13:37:19 2025 +0200 pinctrl: airoha: fix wrong MDIO function bitmaks With further testing with an attached Aeonsemi it was discovered that the pinctrl MDIO function applied the wrong bitmask. The error was probably caused by the confusing documentation related to these bits. Inspecting what the bootloader actually configure, the SGMII_MDIO_MODE is never actually set but instead it's set force enable to the 2 GPIO (gpio 1-2) for MDC and MDIO pin. The usage of GPIO might be confusing but this is just to instruct the SoC to not mess with those 2 PIN and as Benjamin reported it's also an Errata of 7581. The FORCE_GPIO_EN doesn't set them as GPIO function (that is configured by a different register) but it's really to actually ""enable"" those lines. Normally the SoC should autodetect this by HW but it seems AN7581 have problem with this and require this workaround to force enable the 2 pin. Applying this configuration permits correct functionality of any externally attached PHY. Cc: stable@vger.kernel.org Fixes: 1c8ace2d0725 ("pinctrl: airoha: Add support for EN7581 SoC") Signed-off-by: Christian Marangi Acked-by: Benjamin Larsson Signed-off-by: Linus Walleij commit b816265396daf1beb915e0ffbfd7f3906c2bf4a4 Author: Klaus Kudielka Date: Sun Sep 7 12:21:46 2025 +0200 PCI: mvebu: Fix use of for_each_of_range() iterator 5da3d94a23c6 ("PCI: mvebu: Use for_each_of_range() iterator for parsing "ranges"") simplified code by using the for_each_of_range() iterator, but it broke PCI enumeration on Turris Omnia (and probably other mvebu targets). Issue #1: To determine range.flags, of_pci_range_parser_one() uses bus->get_flags(), which resolves to of_bus_pci_get_flags(), which already returns an IORESOURCE bit field, and NOT the original flags from the "ranges" resource. Then mvebu_get_tgt_attr() attempts the very same conversion again. Remove the misinterpretation of range.flags in mvebu_get_tgt_attr(), to restore the intended behavior. Issue #2: The driver needs target and attributes, which are encoded in the raw address values of the "/soc/pcie/ranges" resource. According to of_pci_range_parser_one(), the raw values are stored in range.bus_addr and range.parent_bus_addr, respectively. range.cpu_addr is a translated version of range.parent_bus_addr, and not relevant here. Use the correct range structure member, to extract target and attributes. This restores the intended behavior. Fixes: 5da3d94a23c6 ("PCI: mvebu: Use for_each_of_range() iterator for parsing "ranges"") Reported-by: Jan Palus Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220479 Signed-off-by: Klaus Kudielka Signed-off-by: Bjorn Helgaas Tested-by: Tony Dinh Tested-by: Jan Palus Link: https://patch.msgid.link/20250907102303.29735-1-klaus.kudielka@gmail.com commit cd4453c5e983cf1fd5757e9acb915adb1e4602b6 Author: Pu Lehui Date: Mon Sep 8 02:46:58 2025 +0000 tracing: Silence warning when chunk allocation fails in trace_pid_write Syzkaller trigger a fault injection warning: WARNING: CPU: 1 PID: 12326 at tracepoint_add_func+0xbfc/0xeb0 Modules linked in: CPU: 1 UID: 0 PID: 12326 Comm: syz.6.10325 Tainted: G U 6.14.0-rc5-syzkaller #0 Tainted: [U]=USER Hardware name: Google Compute Engine/Google Compute Engine RIP: 0010:tracepoint_add_func+0xbfc/0xeb0 kernel/tracepoint.c:294 Code: 09 fe ff 90 0f 0b 90 0f b6 74 24 43 31 ff 41 bc ea ff ff ff RSP: 0018:ffffc9000414fb48 EFLAGS: 00010283 RAX: 00000000000012a1 RBX: ffffffff8e240ae0 RCX: ffffc90014b78000 RDX: 0000000000080000 RSI: ffffffff81bbd78b RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffffffffffef R13: 0000000000000000 R14: dffffc0000000000 R15: ffffffff81c264f0 FS: 00007f27217f66c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e80dff8 CR3: 00000000268f8000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: tracepoint_probe_register_prio+0xc0/0x110 kernel/tracepoint.c:464 register_trace_prio_sched_switch include/trace/events/sched.h:222 [inline] register_pid_events kernel/trace/trace_events.c:2354 [inline] event_pid_write.isra.0+0x439/0x7a0 kernel/trace/trace_events.c:2425 vfs_write+0x24c/0x1150 fs/read_write.c:677 ksys_write+0x12b/0x250 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f We can reproduce the warning by following the steps below: 1. echo 8 >> set_event_notrace_pid. Let tr->filtered_pids owns one pid and register sched_switch tracepoint. 2. echo ' ' >> set_event_pid, and perform fault injection during chunk allocation of trace_pid_list_alloc. Let pid_list with no pid and assign to tr->filtered_pids. 3. echo ' ' >> set_event_pid. Let pid_list is NULL and assign to tr->filtered_pids. 4. echo 9 >> set_event_pid, will trigger the double register sched_switch tracepoint warning. The reason is that syzkaller injects a fault into the chunk allocation in trace_pid_list_alloc, causing a failure in trace_pid_list_set, which may trigger double register of the same tracepoint. This only occurs when the system is about to crash, but to suppress this warning, let's add failure handling logic to trace_pid_list_set. Link: https://lore.kernel.org/20250908024658.2390398-1-pulehui@huaweicloud.com Fixes: 8d6e90983ade ("tracing: Create a sparse bitmask for pid filtering") Reported-by: syzbot+161412ccaeff20ce4dde@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67cb890e.050a0220.d8275.022e.GAE@google.com Signed-off-by: Pu Lehui Signed-off-by: Steven Rostedt (Google) commit dd2fa82473453661d12723c46c9f43d9876a7efd Author: Jonathan Curley Date: Mon Sep 8 17:35:16 2025 +0000 NFSv4/flexfiles: Fix layout merge mirror check. Typo in ff_lseg_match_mirrors makes the diff ineffective. This results in merge happening all the time. Merge happening all the time is problematic because it marks lsegs invalid. Marking lsegs invalid causes all outstanding IO to get restarted with EAGAIN and connections to get closed. Closing connections constantly triggers race conditions in the RDMA implementation... Fixes: 660d1eb22301c ("pNFS/flexfile: Don't merge layout segments if the mirrors don't match") Signed-off-by: Jonathan Curley Signed-off-by: Trond Myklebust commit 82e2be57d544ff9ad4696c85600827b39be8ce9e Author: Miaoqing Pan Date: Mon Sep 8 09:51:39 2025 +0800 wifi: ath12k: fix WMI TLV header misalignment When buf_len is not 4-byte aligned in ath12k_wmi_mgmt_send(), the firmware asserts and triggers a recovery. The following error messages are observed: ath12k_pci 0004:01:00.0: failed to submit WMI_MGMT_TX_SEND_CMDID cmd ath12k_pci 0004:01:00.0: failed to send mgmt frame: -108 ath12k_pci 0004:01:00.0: failed to tx mgmt frame, vdev_id 0 :-108 ath12k_pci 0004:01:00.0: waiting recovery start... This issue was observed when running 'iw wlanx set power_save off/on' in MLO station mode, which triggers the sending of an SMPS action frame with a length of 27 bytes to the AP. To resolve the misalignment, use buf_len_aligned instead of buf_len when constructing the WMI TLV header. Tested-on: WCN7850 hw2.0 PCI WLAN.IOE_HMT.1.1-00011-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Miaoqing Pan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250908015139.1301437-1-miaoqing.pan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 4b66d18918f8e4d85e51974a9e3ce9abad5c7c3d Author: Miaoqing Pan Date: Mon Sep 8 09:50:25 2025 +0800 wifi: ath12k: Fix missing station power save configuration Commit afbab6e4e88d ("wifi: ath12k: modify ath12k_mac_op_bss_info_changed() for MLO") replaced the bss_info_changed() callback with vif_cfg_changed() and link_info_changed() to support Multi-Link Operation (MLO). As a result, the station power save configuration is no longer correctly applied in ath12k_mac_bss_info_changed(). Move the handling of 'BSS_CHANGED_PS' into ath12k_mac_op_vif_cfg_changed() to align with the updated callback structure introduced for MLO, ensuring proper power-save behavior for station interfaces. Tested-on: WCN7850 hw2.0 PCI WLAN.IOE_HMT.1.1-00011-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Fixes: afbab6e4e88d ("wifi: ath12k: modify ath12k_mac_op_bss_info_changed() for MLO") Signed-off-by: Miaoqing Pan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250908015025.1301398-1-miaoqing.pan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit c05d0b32eebadc8be6e53196e99c64cf2bed1d99 Author: Andreas Kemnade Date: Sat Sep 6 11:09:13 2025 +0200 regulator: sy7636a: fix lifecycle of power good gpio Attach the power good gpio to the regulator device devres instead of the parent device to fix problems if probe is run multiple times (rmmod/insmod or some deferral). Fixes: 8c485bedfb785 ("regulator: sy7636a: Initial commit") Signed-off-by: Andreas Kemnade Reviewed-by: Alistair Francis Reviewed-by: Peng Fan Message-ID: <20250906-sy7636-rsrc-v1-2-e2886a9763a7@kernel.org> Signed-off-by: Mark Brown commit 440cec4ca1c242d72e309a801995584a55af25c6 Author: Lijo Lazar Date: Fri Jul 18 18:50:58 2025 +0530 drm/amdgpu: Wait for bootloader after PSPv11 reset Some PSPv11 SOCs take a longer time for PSP based mode-1 reset. Instead of checking for C2PMSG_33 status, add the callback wait_for_bootloader. Wait for bootloader to be back to steady state is already part of the generic mode-1 reset flow. Increase the retry count for bootloader wait and also fix the mask to prevent fake pass. Fixes: 8345a71fc54b ("drm/amdgpu: Add more checks to PSP mailbox") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4531 Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 32f73741d6ee41fd5db8791c1163931e313d0fdc) commit f777d1112ee597d7f7dd3ca232220873a34ad0c8 Merge: 76eeb9b8de9880 e1bf212d0604d2 Author: Linus Torvalds Date: Mon Sep 8 07:53:01 2025 -0700 Merge tag 'vfs-6.17-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: "fuse: - Prevent opening of non-regular backing files. Fuse doesn't support non-regular files anyway. - Check whether copy_file_range() returns a larger size than requested. - Prevent overflow in copy_file_range() as fuse currently only supports 32-bit sized copies. - Cache the blocksize value if the server returned a new value as inode->i_blkbits isn't modified directly anymore. - Fix i_blkbits handling for iomap partial writes. By default i_blkbits is set to PAGE_SIZE which causes iomap to mark the whole folio as uptodate even on a partial write. But fuseblk filesystems support choosing a blocksize smaller than PAGE_SIZE risking data corruption. Simply enforce PAGE_SIZE as blocksize for fuseblk's internal inode for now. - Prevent out-of-bounds acces in fuse_dev_write() when the number of bytes to be retrieved is truncated to the fc->max_pages limit. virtiofs: - Fix page faults for DAX page addresses. Misc: - Tighten file handle decoding from userns. Check that the decoded dentry itself has a valid idmapping in the user namespace. - Fix mount-notify selftests. - Fix some indentation errors. - Add an FMODE_ flag to indicate IOCB_HAS_METADATA availability. This will be moved to an FOP_* flag with a bit more rework needed for that to happen not suitable for a fix. - Don't silently ignore metadata for sync read/write. - Don't pointlessly log warning when reading coredump sysctls" * tag 'vfs-6.17-rc6.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fuse: virtio_fs: fix page fault for DAX page address selftests/fs/mount-notify: Fix compilation failure. fhandle: use more consistent rules for decoding file handle from userns fuse: Block access to folio overlimit fuse: fix fuseblk i_blkbits for iomap partial writes fuse: reflect cached blocksize if blocksize was changed fuse: prevent overflow in copy_file_range return value fuse: check if copy_file_range() returns larger than requested size fuse: do not allow mapping a non-regular backing file coredump: don't pointlessly check and spew warnings fs: fix indentation style block: don't silently ignore metadata for sync read/write fs: add a FMODE_ flag to indicate IOCB_HAS_METADATA availability Please enter a commit message to explain why this merge is necessary, especially if it merges an updated upstream into a topic branch. commit 971e2c87e4a9f6321523cf1b4a00d1d4d1aa39b3 Merge: 76eeb9b8de9880 ba3319e5905710 Author: Rafael J. Wysocki Date: Mon Sep 8 16:23:21 2025 +0200 Merge tag 'amd-pstate-v6.17-2025-09-04' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Merge amd-pstate content for 6.17 (09/04/25) from Mario Limonciello: "Fixes for regressions found from refactor around EPP handling at suspend/resume and minimum frequency while using the performance governor." * tag 'amd-pstate-v6.17-2025-09-04' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume cpufreq/amd-pstate: Fix setting of CPPC.min_perf in active mode for performance governor commit 77b8e6fbf9848d651f5cb7508f18ad0971f3ffdb Author: Mikulas Patocka Date: Mon Sep 8 15:52:02 2025 +0200 dm-integrity: limit MAX_TAG_SIZE to 255 MAX_TAG_SIZE was 0x1a8 and it may be truncated in the "bi->metadata_size = ic->tag_size" assignment. We need to limit it to 255. Signed-off-by: Mikulas Patocka commit 6f9674aa69ad0178ca8fc6995942ba9848c324f4 Author: Christian Marangi Date: Mon Sep 8 13:34:24 2025 +0200 pinctrl: airoha: fix wrong PHY LED mux value for LED1 GPIO46 In all the MUX value for LED1 GPIO46 there is a Copy-Paste error where the MUX value is set to LED0_MODE_MASK instead of LED1_MODE_MASK. This wasn't notice as there were no board that made use of the secondary PHY LED but looking at the internal Documentation the actual value should be LED1_MODE_MASK similar to the other GPIO entry. Fix the wrong value to apply the correct MUX configuration. Cc: stable@vger.kernel.org Fixes: 1c8ace2d0725 ("pinctrl: airoha: Add support for EN7581 SoC") Signed-off-by: Christian Marangi Acked-by: Lorenzo Bianconi Signed-off-by: Linus Walleij commit cba4262a19afae21665ee242b3404bcede5a94d7 Author: K Prateek Nayak Date: Mon Sep 1 17:04:15 2025 +0000 x86/cpu/topology: Always try cpu_parse_topology_ext() on AMD/Hygon Support for parsing the topology on AMD/Hygon processors using CPUID leaf 0xb was added in 3986a0a805e6 ("x86/CPU/AMD: Derive CPU topology from CPUID function 0xB when available"). In an effort to keep all the topology parsing bits in one place, this commit also introduced a pseudo dependency on the TOPOEXT feature to parse the CPUID leaf 0xb. The TOPOEXT feature (CPUID 0x80000001 ECX[22]) advertises the support for Cache Properties leaf 0x8000001d and the CPUID leaf 0x8000001e EAX for "Extended APIC ID" however support for 0xb was introduced alongside the x2APIC support not only on AMD [1], but also historically on x86 [2]. Similar to 0xb, the support for extended CPU topology leaf 0x80000026 too does not depend on the TOPOEXT feature. The support for these leaves is expected to be confirmed by ensuring leaf <= {extended_}cpuid_level and then parsing the level 0 of the respective leaf to confirm EBX[15:0] (LogProcAtThisLevel) is non-zero as stated in the definition of "CPUID_Fn0000000B_EAX_x00 [Extended Topology Enumeration] (Core::X86::Cpuid::ExtTopEnumEax0)" in Processor Programming Reference (PPR) for AMD Family 19h Model 01h Rev B1 Vol1 [3] Sec. 2.1.15.1 "CPUID Instruction Functions". This has not been a problem on baremetal platforms since support for TOPOEXT (Fam 0x15 and later) predates the support for CPUID leaf 0xb (Fam 0x17[Zen2] and later), however, for AMD guests on QEMU, the "x2apic" feature can be enabled independent of the "topoext" feature where QEMU expects topology and the initial APICID to be parsed using the CPUID leaf 0xb (especially when number of cores > 255) which is populated independent of the "topoext" feature flag. Unconditionally call cpu_parse_topology_ext() on AMD and Hygon processors to first parse the topology using the XTOPOLOGY leaves (0x80000026 / 0xb) before using the TOPOEXT leaf (0x8000001e). While at it, break down the single large comment in parse_topology_amd() to better highlight the purpose of each CPUID leaf. Fixes: 3986a0a805e6 ("x86/CPU/AMD: Derive CPU topology from CPUID function 0xB when available") Suggested-by: Naveen N Rao (AMD) Signed-off-by: K Prateek Nayak Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org # Only v6.9 and above; depends on x86 topology rewrite Link: https://lore.kernel.org/lkml/1529686927-7665-1-git-send-email-suravee.suthikulpanit@amd.com/ [1] Link: https://lore.kernel.org/lkml/20080818181435.523309000@linux-os.sc.intel.com/ [2] Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 [3] commit 71d2893a235bf3b95baccead27b3d47f2f2cdc4c Author: Shenghao Ding Date: Mon Sep 8 06:27:27 2025 +0800 ALSA: hda/tas2781: Fix the order of TAS2781 calibrated-data A bug reported by one of my customers that the order of TAS2781 calibrated-data is incorrect, the correct way is to move R0_Low and insert it between R0 and InvR0. Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib") Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20250907222728.988-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai commit 76eeb9b8de9880ca38696b2fb56ac45ac0a25c6c Author: Linus Torvalds Date: Sun Sep 7 14:22:57 2025 -0700 Linux 6.17-rc5 commit bd8f3bff4a5d4a2e7a414b033e5abb3c643c59db Merge: 2c3bac60853ed8 d035b4baebfc51 Author: Linus Torvalds Date: Sun Sep 7 12:30:31 2025 -0700 Merge tag 'i2c-for-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - i801: drop superfluous WDT entry for Birch - rtl9300: - fix channel number check in probe - check data length boundaries in xfer - drop broken SMBus quick operation * tag 'i2c-for-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: rtl9300: remove broken SMBus Quick operation support i2c: rtl9300: ensure data length is within supported range i2c: rtl9300: fix channel number bound check i2c: i801: Hide Intel Birch Stream SoC TCO WDT commit 0f860eef417df93eb0ae70bbfa8d26cb7e29244d Author: Jimmy Hon Date: Thu Sep 4 03:01:50 2025 +0000 arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 The logic of the headphone detect pin seems to be inverted, with this change headphones actually output sound when plugged in. Does not need workaround of using pin-switches to enable output. Verified by checking /sys/kernel/debug/gpio. Fixes: ae46756faff8 ("arm64: dts: rockchip: analog audio on Orange Pi 5") Signed-off-by: Jimmy Hon Link: https://lore.kernel.org/r/20250904030150.986042-1-honyuenkwun@gmail.com Signed-off-by: Heiko Stuebner commit 41194ee115685ec2dbbb80e20d1090cc3a4c64d8 Author: Marcin Juszkiewicz Date: Fri Sep 5 21:01:51 2025 +0200 arm64: dts: rockchip: Add vcc supply for SPI Flash on NanoPC-T6 FriendlyELEC NanoPC-T6 LTS schematics shows VCC_1V8_S3 being used to power SPI NOR chip. This fixes the following kernel message: spi-nor spi5.0: supply vcc not found, using dummy regulator Signed-off-by: Marcin Juszkiewicz Link: https://lore.kernel.org/r/20250905-nanopc-t6-spi-nor-v2-1-098b476d9509@juszkiewicz.com.pl Signed-off-by: Heiko Stuebner commit 2c3bac60853ed8f67e42451c7810321ff1df9c7c Merge: 6ab41fca2e8059 ff2a66d21fd236 Author: Linus Torvalds Date: Sun Sep 7 08:41:32 2025 -0700 Merge tag 'edac_urgent_for_v6.17_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC fix from Borislav Petkov: - Remove a misplaced dma_free_coherent() call in altera_edac * tag 'edac_urgent_for_v6.17_rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/altera: Delete an inappropriate dma_free_coherent() call commit 6ab41fca2e8059803b27cef336d2abe7c936ba0b Merge: b7369eb7319d0c 762af5a2aa0ad1 Author: Linus Torvalds Date: Sun Sep 7 08:29:44 2025 -0700 Merge tag 'timers-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer fix from Ingo Molnar: "Fix a severe slowdown regression in the timer vDSO code related to the while() loop in __iter_div_u64_rem(), when the AUX-clock is enabled" * tag 'timers-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: vdso/vsyscall: Avoid slow division loop in auxiliary clock update commit b7369eb7319d0cb94ad2ea5b5486e276339c595a Merge: 6a8a34a56a07eb d9b05321e21e4b Author: Linus Torvalds Date: Sun Sep 7 08:26:28 2025 -0700 Merge tag 'locking-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Ingo Molnar: "Fix an 'allocation from atomic context' regression in the futex vmalloc variant" * tag 'locking-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Move futex_hash_free() back to __mmput() commit 6a8a34a56a07eb5f0b9c41b1f1e6909e372122cd Merge: 00e69828220782 18dbcbfabfffc4 Author: Linus Torvalds Date: Sun Sep 7 08:24:20 2025 -0700 Merge tag 'perf-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf event fix from Ingo Molnar: "Fix regression where PERF_EVENT_IOC_REFRESH counters miss a PMU-stop" * tag 'perf-urgent-2025-09-07' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix the POLL_HUP delivery breakage commit 00e69828220782cae5df67d1546d4969770c9753 Merge: b236920731dd90 a03ee11b8f850b Author: Linus Torvalds Date: Sun Sep 7 08:15:56 2025 -0700 Merge tag 'riscv-for-linus-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux Pull RISC-V fixes from Paul Walmsley: - LTO fix for clang when building with CONFIG_CMODEL_MEDLOW - Fix for ACPI CPPC CSR read/write return values - Several fixes for incorrect access widths in thread_info.cpu reads - Fix an issue in __put_user_nocheck() that was causing the glibc tst-socket-timestamp test to fail - Initialize struct kexec_buf records in several kexec-related functions, which were generating UBSAN warnings - Two fixes for sparse warnings * tag 'riscv-for-linus-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: riscv: Fix sparse warning about different address spaces riscv: Fix sparse warning in __get_user_error() riscv: kexec: Initialize kexec_buf struct riscv: use lw when reading int cpu in asm_per_cpu riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG riscv: uaccess: fix __put_user_nocheck for unaligned accesses riscv: use lw when reading int cpu in new_vmalloc_check ACPI: RISC-V: Fix FFH_CPPC_CSR error handling riscv: Only allow LTO with CMODEL_MEDANY commit ea9da67e2add7bd5f1e4b38dc2404480e711f4d8 Author: Nobuhiro Iwamatsu Date: Thu Nov 21 16:13:25 2024 +0900 ARM: dts: socfpga: sodia: Fix mdio bus probe and PHY address On SoCFPGA/Sodia board, mdio bus cannot be probed, so the PHY cannot be found and the network device does not work. ``` stmmaceth ff702000.ethernet eth0: __stmmac_open: Cannot attach to PHY (error: -19) ``` To probe the mdio bus, add "snps,dwmac-mdio" as compatible string of the mdio bus. Also the PHY address connected to this board is 4. Therefore, change to 4. Cc: stable@vger.kernel.org # 6.3+ Signed-off-by: Nobuhiro Iwamatsu Signed-off-by: Dinh Nguyen commit 9559d2fffd4f9b892165eed48198a0e5cb8504e6 Author: Justin Worrell Date: Thu Sep 4 16:09:57 2025 -0500 SUNRPC: call xs_sock_process_cmsg for all cmsg xs_sock_recv_cmsg was failing to call xs_sock_process_cmsg for any cmsg type other than TLS_RECORD_TYPE_ALERT (TLS_RECORD_TYPE_DATA, and other values not handled.) Based on my reading of the previous commit (cc5d5908: sunrpc: fix client side handling of tls alerts), it looks like only iov_iter_revert should be conditional on TLS_RECORD_TYPE_ALERT (but that other cmsg types should still call xs_sock_process_cmsg). On my machine, I was unable to connect (over mtls) to an NFS share hosted on FreeBSD. With this patch applied, I am able to mount the share again. Fixes: cc5d59081fa2 ("sunrpc: fix client side handling of tls alerts") Signed-off-by: Justin Worrell Reviewed-and-tested-by: Scott Mayhew Link: https://lore.kernel.org/r/20250904211038.12874-3-jworrell@gmail.com Signed-off-by: Trond Myklebust commit 199cd9e8d14bc14bdbd1fa3031ce26dac9781507 Author: Trond Myklebust Date: Wed Sep 3 09:49:33 2025 -0400 Revert "SUNRPC: Don't allow waiting for exiting tasks" This reverts commit 14e41b16e8cb677bb440dca2edba8b041646c742. This patch breaks the LTP acct02 test, so let's revert and look for a better solution. Reported-by: Mark Brown Reported-by: Harshvardhan Jha Link: https://lore.kernel.org/linux-nfs/7d4d57b0-39a3-49f1-8ada-60364743e3b4@sirena.org.uk/ Cc: stable@vger.kernel.org # 6.15.x Signed-off-by: Trond Myklebust commit c12b6a7b12a13ccd3aece6be09345c1944e18d3e Author: Trond Myklebust Date: Wed Sep 3 20:11:03 2025 -0400 NFS: Fix the marking of the folio as up to date Since all callers of nfs_page_group_covers_page() have already ensured that there is only one group member, all that is required is to check that the entire folio contains dirty data. Signed-off-by: Trond Myklebust commit b7b8574225e9d2b5f1fb5483886ab797892f43b5 Author: Trond Myklebust Date: Wed Sep 3 11:48:57 2025 -0400 NFS: nfs_invalidate_folio() must observe the offset and size arguments If we're truncating part of the folio, then we need to write out the data on the part that is not covered by the cancellation. Fixes: d47992f86b30 ("mm: change invalidatepage prototype to accept length") Signed-off-by: Trond Myklebust commit ca247c89900ae90207f4d321e260cd93b7c7d104 Author: Trond Myklebust Date: Sat Sep 6 10:54:13 2025 -0400 NFSv4.2: Serialise O_DIRECT i/o and copy range Ensure that all O_DIRECT reads and writes complete before copying a file range, so that the destination is up to date. Fixes: a5864c999de6 ("NFS: Do not serialise O_DIRECT reads and writes") Signed-off-by: Trond Myklebust commit c80ebeba1198eac8811ab0dba36ecc13d51e4438 Author: Trond Myklebust Date: Sat Sep 6 10:40:24 2025 -0400 NFSv4.2: Serialise O_DIRECT i/o and clone range Ensure that all O_DIRECT reads and writes complete before cloning a file range, so that both the source and destination are up to date. Fixes: a5864c999de6 ("NFS: Do not serialise O_DIRECT reads and writes") Signed-off-by: Trond Myklebust commit b93128f29733af5d427a335978a19884c2c230e2 Author: Trond Myklebust Date: Fri Sep 5 12:11:17 2025 -0400 NFSv4.2: Serialise O_DIRECT i/o and fallocate() Ensure that all O_DIRECT reads and writes complete before calling fallocate so that we don't race w.r.t. attribute updates. Fixes: 99f237832243 ("NFSv4.2: Always flush out writes in nfs42_proc_fallocate()") Signed-off-by: Trond Myklebust commit 9eb90f435415c7da4800974ed943e39b5578ee7f Author: Trond Myklebust Date: Fri Sep 5 12:06:23 2025 -0400 NFS: Serialise O_DIRECT i/o and truncate() Ensure that all O_DIRECT reads and writes are complete, and prevent the initiation of new i/o until the setattr operation that will truncate the file is complete. Fixes: a5864c999de6 ("NFS: Do not serialise O_DIRECT reads and writes") Signed-off-by: Trond Myklebust commit b2036bb65114c01caf4a1afe553026e081703c8c Author: Trond Myklebust Date: Sat Sep 6 10:25:35 2025 -0400 NFSv4.2: Protect copy offload and clone against 'eof page pollution' The NFSv4.2 copy offload and clone functions can also end up extending the size of the destination file, so they too need to call nfs_truncate_last_folio(). Reported-by: Olga Kornievskaia Signed-off-by: Trond Myklebust commit b1817b18ff20e69f5accdccefaf78bf5454bede2 Author: Trond Myklebust Date: Thu Sep 4 18:46:16 2025 -0400 NFS: Protect against 'eof page pollution' This commit fixes the failing xfstest 'generic/363'. When the user mmaps() an area that extends beyond the end of file, and proceeds to write data into the folio that straddles that eof, we're required to discard that folio data if the user calls some function that extends the file length. Signed-off-by: Trond Myklebust commit 5a46d2339a5ae268ede53a221f20433d8ea4f2f9 Author: Tigran Mkrtchyan Date: Thu Aug 28 16:51:00 2025 +0200 flexfiles/pNFS: fix NULL checks on result of ff_layout_choose_ds_for_read Recent commit f06bedfa62d5 ("pNFS/flexfiles: don't attempt pnfs on fatal DS errors") has changed the error return type of ff_layout_choose_ds_for_read() from NULL to an error pointer. However, not all code paths have been updated to match the change. Thus, some non-NULL checks will accept error pointers as a valid return value. Reported-by: Dan Carpenter Suggested-by: Dan Carpenter Fixes: f06bedfa62d5 ("pNFS/flexfiles: don't attempt pnfs on fatal DS errors") Signed-off-by: Tigran Mkrtchyan Signed-off-by: Trond Myklebust commit d3684397ea9ba2edf02be0aa2b4dcab3bd74c503 Author: Mike Snitzer Date: Fri Aug 15 19:29:55 2025 -0400 nfs/localio: avoid bouncing LOCALIO if nfs_client_is_local() Previously nfs_local_probe() was made to disable and then attempt to re-enable LOCALIO (via LOCALIO protocol handshake) if/when it was called and LOCALIO already enabled. Vague memory for _why_ this was the case is that this was useful if/when a local NFS server were to be restarted with a local NFS client connected to it. But as it happens this causes an absurd amount of LOCALIO flapping which has a side-effect of too much IO being needlessly sent to NFSD (using RPC over the loopback network interface). This is the definition of "serious performance loss" (that negates the point of having LOCALIO). So remove this mis-optimization for re-enabling LOCALIO if/when an NFS server is restarted (which is an extremely rare thing to do). Will revisit testing that scenario again but in the meantime this patch restores the full benefit of LOCALIO. Signed-off-by: Mike Snitzer Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Trond Myklebust commit b236920731dd90c3fba8c227aa0c4dee5351a639 Merge: d1d10cea089526 8851e27d2cb947 Author: Linus Torvalds Date: Sat Sep 6 12:33:09 2025 -0700 Merge tag 'rust-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rust fixes from Miguel Ojeda: - Two changes to prepare for the future Rust 1.91.0 release (expected 2025-10-30, currently in nightly): a target specification format change and a renamed, soon-to-be-stabilized 'core' function. * tag 'rust-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: support Rust >= 1.91.0 target spec rust: use the new name Location::file_as_c_str() in Rust >= 1.91.0 commit 3c9ba2777d6c86025e1ba4186dc5cd930e40ec5f Author: Chen Ridong Date: Fri Aug 22 07:07:14 2025 +0000 kernfs: Fix UAF in polling when open file is released A use-after-free (UAF) vulnerability was identified in the PSI (Pressure Stall Information) monitoring mechanism: BUG: KASAN: slab-use-after-free in psi_trigger_poll+0x3c/0x140 Read of size 8 at addr ffff3de3d50bd308 by task systemd/1 psi_trigger_poll+0x3c/0x140 cgroup_pressure_poll+0x70/0xa0 cgroup_file_poll+0x8c/0x100 kernfs_fop_poll+0x11c/0x1c0 ep_item_poll.isra.0+0x188/0x2c0 Allocated by task 1: cgroup_file_open+0x88/0x388 kernfs_fop_open+0x73c/0xaf0 do_dentry_open+0x5fc/0x1200 vfs_open+0xa0/0x3f0 do_open+0x7e8/0xd08 path_openat+0x2fc/0x6b0 do_filp_open+0x174/0x368 Freed by task 8462: cgroup_file_release+0x130/0x1f8 kernfs_drain_open_files+0x17c/0x440 kernfs_drain+0x2dc/0x360 kernfs_show+0x1b8/0x288 cgroup_file_show+0x150/0x268 cgroup_pressure_write+0x1dc/0x340 cgroup_file_write+0x274/0x548 Reproduction Steps: 1. Open test/cpu.pressure and establish epoll monitoring 2. Disable monitoring: echo 0 > test/cgroup.pressure 3. Re-enable monitoring: echo 1 > test/cgroup.pressure The race condition occurs because: 1. When cgroup.pressure is disabled (echo 0 > cgroup.pressure), it: - Releases PSI triggers via cgroup_file_release() - Frees of->priv through kernfs_drain_open_files() 2. While epoll still holds reference to the file and continues polling 3. Re-enabling (echo 1 > cgroup.pressure) accesses freed of->priv epolling disable/enable cgroup.pressure fd=open(cpu.pressure) while(1) ... epoll_wait kernfs_fop_poll kernfs_get_active = true echo 0 > cgroup.pressure ... cgroup_file_show kernfs_show // inactive kn kernfs_drain_open_files cft->release(of); kfree(ctx); ... kernfs_get_active = false echo 1 > cgroup.pressure kernfs_show kernfs_activate_one(kn); kernfs_fop_poll kernfs_get_active = true cgroup_file_poll psi_trigger_poll // UAF ... end: close(fd) To address this issue, introduce kernfs_get_active_of() for kernfs open files to obtain active references. This function will fail if the open file has been released. Replace kernfs_get_active() with kernfs_get_active_of() to prevent further operations on released file descriptors. Fixes: 34f26a15611a ("sched/psi: Per-cgroup PSI accounting disable/re-enable interface") Cc: stable Reported-by: Zhang Zhaotian Signed-off-by: Chen Ridong Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20250822070715.1565236-2-chenridong@huaweicloud.com Signed-off-by: Greg Kroah-Hartman commit 5f9efb6b7667043527d377421af2070cc0aa2ecd Author: Julien Massot Date: Fri Sep 5 13:51:58 2025 +0200 Input: mtk-pmic-keys - MT6359 has a specific release irq Support for MT6359 PMIC keys has been added recently. However, the key release event is not properly handled: only key press events are generated, leaving key states stuck in "pressed". This patch ensures that both key press and key release events are properly emitted by handling the release logic correctly. Introduce a 'key_release_irq' member to the 'mtk_pmic_regs' to identify the devices that have a separate irq for the release event. Fixes: bc25e6bf032e ("Input: mtk-pmic-keys - add support for MT6359 PMIC keys") Signed-off-by: Julien Massot Link: https://lore.kernel.org/r/20250905-radxa-nio-12-l-gpio-v3-1-40f11377fb55@collabora.com Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit c1628c00c4351dd0727ef7f670694f68d9e663d8 Author: Wang Liang Date: Sat Sep 6 11:56:10 2025 +0800 tracing/osnoise: Fix null-ptr-deref in bitmap_parselist() A crash was observed with the following output: BUG: kernel NULL pointer dereference, address: 0000000000000010 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 92 Comm: osnoise_cpus Not tainted 6.17.0-rc4-00201-gd69eb204c255 #138 PREEMPT(voluntary) RIP: 0010:bitmap_parselist+0x53/0x3e0 Call Trace: osnoise_cpus_write+0x7a/0x190 vfs_write+0xf8/0x410 ? do_sys_openat2+0x88/0xd0 ksys_write+0x60/0xd0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f This issue can be reproduced by below code: fd=open("/sys/kernel/debug/tracing/osnoise/cpus", O_WRONLY); write(fd, "0-2", 0); When user pass 'count=0' to osnoise_cpus_write(), kmalloc() will return ZERO_SIZE_PTR (16) and cpulist_parse() treat it as a normal value, which trigger the null pointer dereference. Add check for the parameter 'count'. Cc: Cc: Cc: Link: https://lore.kernel.org/20250906035610.3880282-1-wangliang74@huawei.com Fixes: 17f89102fe23 ("tracing/osnoise: Allow arbitrarily long CPU string") Signed-off-by: Wang Liang Signed-off-by: Steven Rostedt (Google) commit ab1396af7595e7d49a3850481b24d7fe7cbdfd31 Author: Guenter Roeck Date: Fri Sep 5 22:06:18 2025 -0700 trace/fgraph: Fix error handling Commit edede7a6dcd7 ("trace/fgraph: Fix the warning caused by missing unregister notifier") added a call to unregister the PM notifier if register_ftrace_graph() failed. It does so unconditionally. However, the PM notifier is only registered with the first call to register_ftrace_graph(). If the first registration was successful and a subsequent registration failed, the notifier is now unregistered even if ftrace graphs are still registered. Fix the problem by only unregistering the PM notifier during error handling if there are no active fgraph registrations. Fixes: edede7a6dcd7 ("trace/fgraph: Fix the warning caused by missing unregister notifier") Closes: https://lore.kernel.org/all/63b0ba5a-a928-438e-84f9-93028dd72e54@roeck-us.net/ Cc: Ye Weihua Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250906050618.2634078-1-linux@roeck-us.net Signed-off-by: Guenter Roeck Signed-off-by: Steven Rostedt (Google) commit b5e3277c0f1c3439dd02b58997c06201d0ee8dbf Author: Harshit Shah Date: Tue Sep 2 12:16:29 2025 -0700 serial: xilinx_uartps: read reg size from DTS Current implementation uses `CDNS_UART_REGISTER_SPACE(0x1000)` for request_mem_region() and ioremap() in cdns_uart_request_port() API. The cadence/xilinx IP has register space defined from offset 0x0 to 0x48. It also mentions that the register map is defined as [6:0]. So, the upper region may/maynot be used based on the IP integration. In Axiado AX3000 SoC two UART instances are defined 0x100 apart. That is creating issue in some other instance due to overlap with addresses. Since, this address space is already being defined in the devicetree, use the same when requesting the register space. Fixes: 1f7055779001 ("arm64: dts: axiado: Add initial support for AX3000 SoC and eval board") Acked-by: Michal Simek Signed-off-by: Harshit Shah Link: https://lore.kernel.org/r/20250902-xilinx-uartps-reg-size-v3-1-d11cfa7258e3@axiado.com Signed-off-by: Greg Kroah-Hartman commit 116e79c679a1530cf833d0ff3007061d7a716bd9 Author: Takashi Iwai Date: Fri Sep 5 15:32:34 2025 +0200 usb: gadget: midi2: Fix MIDI2 IN EP max packet size The EP-IN of MIDI2 (altset 1) wasn't initialized in f_midi2_create_usb_configs() as it's an INT EP unlike others BULK EPs. But this leaves rather the max packet size unchanged no matter which speed is used, resulting in the very slow access. And the wMaxPacketSize values set there look legit for INT EPs, so let's initialize the MIDI2 EP-IN there for achieving the equivalent speed as well. Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver") Cc: stable Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20250905133240.20966-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman commit 21d8525d2e061cde034277d518411b02eac764e2 Author: Takashi Iwai Date: Thu Sep 4 17:39:24 2025 +0200 usb: gadget: midi2: Fix missing UMP group attributes initialization The gadget card driver forgot to call snd_ump_update_group_attrs() after adding FBs, and this leaves the UMP group attributes uninitialized. As a result, -ENODEV error is returned at opening a legacy rawmidi device as an inactive group. This patch adds the missing call to address the behavior above. Fixes: 8b645922b223 ("usb: gadget: Add support for USB MIDI 2.0 function driver") Cc: stable Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20250904153932.13589-1-tiwai@suse.de Signed-off-by: Greg Kroah-Hartman commit f34bfcc77b18375a87091c289c2eb53c249787b4 Author: RD Babiera Date: Thu Aug 21 20:37:57 2025 +0000 usb: typec: tcpm: properly deliver cable vdms to altmode drivers tcpm_handle_vdm_request delivers messages to the partner altmode or the cable altmode depending on the SVDM response type, which is incorrect. The partner or cable should be chosen based on the received message type instead. Also add this filter to ADEV_NOTIFY_USB_AND_QUEUE_VDM, which is used when the Enter Mode command is responded to by a NAK on SOP or SOP' and when the Exit Mode command is responded to by an ACK on SOP. Fixes: 7e7877c55eb1 ("usb: typec: tcpm: add alt mode enter/exit/vdm support for sop'") Cc: stable@vger.kernel.org Signed-off-by: RD Babiera Reviewed-by: Badhri Jagan Sridharan Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250821203759.1720841-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman commit 8d63c83d8eb922f6c316320f50c82fa88d099bea Author: Alan Stern Date: Mon Aug 25 12:00:22 2025 -0400 USB: gadget: dummy-hcd: Fix locking bug in RT-enabled kernels Yunseong Kim and the syzbot fuzzer both reported a problem in RT-enabled kernels caused by the way dummy-hcd mixes interrupt management and spin-locking. The pattern was: local_irq_save(flags); spin_lock(&dum->lock); ... spin_unlock(&dum->lock); ... // calls usb_gadget_giveback_request() local_irq_restore(flags); The code was written this way because usb_gadget_giveback_request() needs to be called with interrupts disabled and the private lock not held. While this pattern works fine in non-RT kernels, it's not good when RT is enabled. RT kernels handle spinlocks much like mutexes; in particular, spin_lock() may sleep. But sleeping is not allowed while local interrupts are disabled. To fix the problem, rewrite the code to conform to the pattern used elsewhere in dummy-hcd and other UDC drivers: spin_lock_irqsave(&dum->lock, flags); ... spin_unlock(&dum->lock); usb_gadget_giveback_request(...); spin_lock(&dum->lock); ... spin_unlock_irqrestore(&dum->lock, flags); This approach satisfies the RT requirements. Signed-off-by: Alan Stern Cc: stable Fixes: b4dbda1a22d2 ("USB: dummy-hcd: disable interrupts during req->complete") Reported-by: Yunseong Kim Closes: Reported-by: syzbot+8baacc4139f12fa77909@syzkaller.appspotmail.com Closes: Tested-by: syzbot+8baacc4139f12fa77909@syzkaller.appspotmail.com CC: Sebastian Andrzej Siewior CC: stable@vger.kernel.org Reviewed-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/bb192ae2-4eee-48ee-981f-3efdbbd0d8f0@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit edcbe06453ddfde21f6aa763f7cab655f26133cc Author: Mathias Nyman Date: Tue Sep 2 13:53:06 2025 +0300 xhci: fix memory leak regression when freeing xhci vdev devices depth first Suspend-resume cycle test revealed a memory leak in 6.17-rc3 Turns out the slot_id race fix changes accidentally ends up calling xhci_free_virt_device() with an incorrect vdev parameter. The vdev variable was reused for temporary purposes right before calling xhci_free_virt_device(). Fix this by passing the correct vdev parameter. The slot_id race fix that caused this regression was targeted for stable, so this needs to be applied there as well. Fixes: 2eb03376151b ("usb: xhci: Fix slot_id resource race conflict") Reported-by: David Wang <00107082@163.com> Closes: https://lore.kernel.org/linux-usb/20250829181354.4450-1-00107082@163.com Suggested-by: Michal Pecio Suggested-by: David Wang <00107082@163.com> Cc: stable@vger.kernel.org Tested-by: David Wang <00107082@163.com> Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250902105306.877476-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit a5c98e8b1398534ae1feb6e95e2d3ee5215538ed Author: Mathias Nyman Date: Tue Sep 2 13:53:05 2025 +0300 xhci: dbc: Fix full DbC transfer ring after several reconnects Pending requests will be flushed on disconnect, and the corresponding TRBs will be turned into No-op TRBs, which are ignored by the xHC controller once it starts processing the ring. If the USB debug cable repeatedly disconnects before ring is started then the ring will eventually be filled with No-op TRBs. No new transfers can be queued when the ring is full, and driver will print the following error message: "xhci_hcd 0000:00:14.0: failed to queue trbs" This is a normal case for 'in' transfers where TRBs are always enqueued in advance, ready to take on incoming data. If no data arrives, and device is disconnected, then ring dequeue will remain at beginning of the ring while enqueue points to first free TRB after last cancelled No-op TRB. s Solve this by reinitializing the rings when the debug cable disconnects and DbC is leaving the configured state. Clear the whole ring buffer and set enqueue and dequeue to the beginning of ring, and set cycle bit to its initial state. Cc: stable@vger.kernel.org Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250902105306.877476-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 220a0ffde02f962c13bc752b01aa570b8c65a37b Author: Mathias Nyman Date: Tue Sep 2 13:53:04 2025 +0300 xhci: dbc: decouple endpoint allocation from initialization Decouple allocation of endpoint ring buffer from initialization of the buffer, and initialization of endpoint context parts from from the rest of the contexts. It allows driver to clear up and reinitialize endpoint rings after disconnect without reallocating everything. This is a prerequisite for the next patch that prevents the transfer ring from filling up with cancelled (no-op) TRBs if a debug cable is reconnected several times without transferring anything. Cc: stable@vger.kernel.org Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver") Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250902105306.877476-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit d035b4baebfc5112b128b66cafd45d2522a9c8f1 Merge: 1b237f190eb3d3 ede965fd555ac2 Author: Wolfram Sang Date: Sat Sep 6 10:17:35 2025 +0200 Merge tag 'i2c-host-fixes-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v6.17-rc5 - i801: fix device IDs - in rtl9300: - fix channel number check in probe - check data length boundaries in xfer - drop unsupported SMBus quick operation commit e2a10daba84968f6b5777d150985fd7d6abc9c84 Author: Vladimir Oltean Date: Thu Sep 4 15:52:38 2025 +0300 net: phy: transfer phy_config_inband() locking responsibility to phylink Problem description =================== Lockdep reports a possible circular locking dependency (AB/BA) between &pl->state_mutex and &phy->lock, as follows. phylink_resolve() // acquires &pl->state_mutex -> phylink_major_config() -> phy_config_inband() // acquires &pl->phydev->lock whereas all the other call sites where &pl->state_mutex and &pl->phydev->lock have the locking scheme reversed. Everywhere else, &pl->phydev->lock is acquired at the top level, and &pl->state_mutex at the lower level. A clear example is phylink_bringup_phy(). The outlier is the newly introduced phy_config_inband() and the existing lock order is the correct one. To understand why it cannot be the other way around, it is sufficient to consider phylink_phy_change(), phylink's callback from the PHY device's phy->phy_link_change() virtual method, invoked by the PHY state machine. phy_link_up() and phy_link_down(), the (indirect) callers of phylink_phy_change(), are called with &phydev->lock acquired. Then phylink_phy_change() acquires its own &pl->state_mutex, to serialize changes made to its pl->phy_state and pl->link_config. So all other instances of &pl->state_mutex and &phydev->lock must be consistent with this order. Problem impact ============== I think the kernel runs a serious deadlock risk if an existing phylink_resolve() thread, which results in a phy_config_inband() call, is concurrent with a phy_link_up() or phy_link_down() call, which will deadlock on &pl->state_mutex in phylink_phy_change(). Practically speaking, the impact may be limited by the slow speed of the medium auto-negotiation protocol, which makes it unlikely for the current state to still be unresolved when a new one is detected, but I think the problem is there. Nonetheless, the problem was discovered using lockdep. Proposed solution ================= Practically speaking, the phy_config_inband() requirement of having phydev->lock acquired must transfer to the caller (phylink is the only caller). There, it must bubble up until immediately before &pl->state_mutex is acquired, for the cases where that takes place. Solution details, considerations, notes ======================================= This is the phy_config_inband() call graph: sfp_upstream_ops :: connect_phy() | v phylink_sfp_connect_phy() | v phylink_sfp_config_phy() | | sfp_upstream_ops :: module_insert() | | | v | phylink_sfp_module_insert() | | | | sfp_upstream_ops :: module_start() | | | | | v | | phylink_sfp_module_start() | | | | v v | phylink_sfp_config_optical() phylink_start() | | | phylink_resume() v v | | phylink_sfp_set_config() | | | v v v phylink_mac_initial_config() | phylink_resolve() | | phylink_ethtool_ksettings_set() v v v phylink_major_config() | v phy_config_inband() phylink_major_config() caller #1, phylink_mac_initial_config(), does not acquire &pl->state_mutex nor do its callers. It must acquire &pl->phydev->lock prior to calling phylink_major_config(). phylink_major_config() caller #2, phylink_resolve() acquires &pl->state_mutex, thus also needs to acquire &pl->phydev->lock. phylink_major_config() caller #3, phylink_ethtool_ksettings_set(), is completely uninteresting, because it only calls phylink_major_config() if pl->phydev is NULL (otherwise it calls phy_ethtool_ksettings_set()). We need to change nothing there. Other solutions =============== The lock inversion between &pl->state_mutex and &pl->phydev->lock has occurred at least once before, as seen in commit c718af2d00a3 ("net: phylink: fix ethtool -A with attached PHYs"). The solution there was to simply not call phy_set_asym_pause() under the &pl->state_mutex. That cannot be extended to our case though, where the phy_config_inband() call is much deeper inside the &pl->state_mutex section. Fixes: 5fd0f1a02e75 ("net: phylink: add negotiation of in-band capabilities") Signed-off-by: Vladimir Oltean Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250904125238.193990-2-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 0ba5b2f2c381dbec9ed9e4ab3ae5d3e667de0dc3 Author: Vladimir Oltean Date: Thu Sep 4 15:52:37 2025 +0300 net: phylink: add lock for serializing concurrent pl->phydev writes with resolver Currently phylink_resolve() protects itself against concurrent phylink_bringup_phy() or phylink_disconnect_phy() calls which modify pl->phydev by relying on pl->state_mutex. The problem is that in phylink_resolve(), pl->state_mutex is in a lock inversion state with pl->phydev->lock. So pl->phydev->lock needs to be acquired prior to pl->state_mutex. But that requires dereferencing pl->phydev in the first place, and without pl->state_mutex, that is racy. Hence the reason for the extra lock. Currently it is redundant, but it will serve a functional purpose once mutex_lock(&phy->lock) will be moved outside of the mutex_lock(&pl->state_mutex) section. Another alternative considered would have been to let phylink_resolve() acquire the rtnl_mutex, which is also held when phylink_bringup_phy() and phylink_disconnect_phy() are called. But since phylink_disconnect_phy() runs under rtnl_lock(), it would deadlock with phylink_resolve() when calling flush_work(&pl->resolve). Additionally, it would have been undesirable because it would have unnecessarily blocked many other call paths as well in the entire kernel, so the smaller-scoped lock was preferred. Link: https://lore.kernel.org/netdev/aLb6puGVzR29GpPx@shell.armlinux.org.uk/ Signed-off-by: Vladimir Oltean Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250904125238.193990-1-vladimir.oltean@nxp.com Signed-off-by: Jakub Kicinski commit 03e79de4608bdd48ad6eec272e196124cefaf798 Author: Stefan Wahren Date: Thu Sep 4 11:13:34 2025 +0200 net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() The function of_phy_find_device may return NULL, so we need to take care before dereferencing phy_dev. Fixes: 64a632da538a ("net: fec: Fix phy_device lookup for phy_reset_after_clk_enable()") Signed-off-by: Stefan Wahren Cc: Christoph Niedermaier Cc: Richard Leitner Reviewed-by: Simon Horman Reviewed-by: Wei Fang Link: https://patch.msgid.link/20250904091334.53965-1-wahrenst@gmx.net Signed-off-by: Jakub Kicinski commit 1e451977e1703b6db072719b37cd1b8e250b9cc9 Author: H. Nikolaus Schaller Date: Sat Aug 23 12:34:57 2025 +0200 power: supply: bq27xxx: restrict no-battery detection to bq27000 There are fuel gauges in the bq27xxx series (e.g. bq27z561) which may in some cases report 0xff as the value of BQ27XXX_REG_FLAGS that should not be interpreted as "no battery" like for a disconnected battery with some built in bq27000 chip. So restrict the no-battery detection originally introduced by commit 3dd843e1c26a ("bq27000: report missing device better.") to the bq27000. There is no need to backport further because this was hidden before commit f16d9fb6cf03 ("power: supply: bq27xxx: Retrieve again when busy") Fixes: f16d9fb6cf03 ("power: supply: bq27xxx: Retrieve again when busy") Suggested-by: Jerry Lv Cc: stable@vger.kernel.org Signed-off-by: H. Nikolaus Schaller Link: https://lore.kernel.org/r/dd979fa6855fd051ee5117016c58daaa05966e24.1755945297.git.hns@goldelico.com Signed-off-by: Sebastian Reichel commit 2c334d038466ac509468fbe06905a32d202117db Author: H. Nikolaus Schaller Date: Sat Aug 23 12:34:56 2025 +0200 power: supply: bq27xxx: fix error return in case of no bq27000 hdq battery Since commit commit f16d9fb6cf03 ("power: supply: bq27xxx: Retrieve again when busy") the console log of some devices with hdq enabled but no bq27000 battery (like e.g. the Pandaboard) is flooded with messages like: [ 34.247833] power_supply bq27000-battery: driver failed to report 'status' property: -1 as soon as user-space is finding a /sys entry and trying to read the "status" property. It turns out that the offending commit changes the logic to now return the value of cache.flags if it is <0. This is likely under the assumption that it is an error number. In normal errors from bq27xxx_read() this is indeed the case. But there is special code to detect if no bq27000 is installed or accessible through hdq/1wire and wants to report this. In that case, the cache.flags are set historically by commit 3dd843e1c26a ("bq27000: report missing device better.") to constant -1 which did make reading properties return -ENODEV. So everything appeared to be fine before the return value was passed upwards. Now the -1 is returned as -EPERM instead of -ENODEV, triggering the error condition in power_supply_format_property() which then floods the console log. So we change the detection of missing bq27000 battery to simply set cache.flags = -ENODEV instead of -1. Fixes: f16d9fb6cf03 ("power: supply: bq27xxx: Retrieve again when busy") Cc: Jerry Lv Cc: stable@vger.kernel.org Signed-off-by: H. Nikolaus Schaller Link: https://lore.kernel.org/r/692f79eb6fd541adb397038ea6e750d4de2deddf.1755945297.git.hns@goldelico.com Signed-off-by: Sebastian Reichel commit 80d03a40837a9b26750a25122b906c052cc846c9 Author: Vladimir Riabchun Date: Tue Aug 26 18:16:46 2025 +0200 ftrace/samples: Fix function size computation In my_tramp1 function .size directive was placed above ASM_RET instruction, leading to a wrong function size. Link: https://lore.kernel.org/aK3d7vxNcO52kEmg@vova-pc Fixes: 9d907f1ae80b ("samples/ftrace: Fix asm function ELF annotations") Signed-off-by: Vladimir Riabchun Signed-off-by: Steven Rostedt (Google) commit d1d10cea0895264cc3769e4d9719baa94f4b250b Merge: d3e45016f75e3e ca81e74dc34734 Author: Linus Torvalds Date: Fri Sep 5 15:01:46 2025 -0700 Merge tag 'perf-tools-fixes-for-v6.17-2025-09-05' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools fixes from Namhyung Kim: "Fixes for use-after-free that resulted in segfaults after merging the bpf tree. Also a couple of build and test fixes" * tag 'perf-tools-fixes-for-v6.17-2025-09-05' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf symbol-elf: Add support for the block argument for libbfd perf test: Checking BPF metadata collection fails on version string perf tests: Fix "PE file support" test build perf bpf-utils: Harden get_bpf_prog_info_linear perf bpf-utils: Constify bpil_array_desc perf bpf-event: Fix use-after-free in synthesis commit a03ee11b8f850bd008226c6d392da24163dfb56e Author: Alexandre Ghiti Date: Wed Sep 3 18:53:09 2025 +0000 riscv: Fix sparse warning about different address spaces We did not propagate the __user attribute of the pointers in __get_kernel_nofault() and __put_kernel_nofault(), which results in sparse complaining: >> mm/maccess.c:41:17: sparse: sparse: incorrect type in argument 2 (different address spaces) @@ expected void const [noderef] __user *from @@ got unsigned long long [usertype] * @@ mm/maccess.c:41:17: sparse: expected void const [noderef] __user *from mm/maccess.c:41:17: sparse: got unsigned long long [usertype] * So fix this by correctly casting those pointers. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508161713.RWu30Lv1-lkp@intel.com/ Suggested-by: Al Viro Fixes: f6bff7827a48 ("riscv: uaccess: use 'asm_goto_output' for get_user()") Cc: stable@vger.kernel.org Signed-off-by: Alexandre Ghiti Reviewed-by: Cyril Bur Link: https://lore.kernel.org/r/20250903-dev-alex-sparse_warnings_v1-v1-2-7e6350beb700@rivosinc.com Signed-off-by: Paul Walmsley commit fef7ded169ed7e133612f90a032dc2af1ce19bef Author: Alexandre Ghiti Date: Wed Sep 3 18:53:08 2025 +0000 riscv: Fix sparse warning in __get_user_error() We used to assign 0 to x without an appropriate cast which results in sparse complaining when x is a pointer: >> block/ioctl.c:72:39: sparse: sparse: Using plain integer as NULL pointer So fix this by casting 0 to the correct type of x. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508062321.gHv4kvuY-lkp@intel.com/ Fixes: f6bff7827a48 ("riscv: uaccess: use 'asm_goto_output' for get_user()") Cc: stable@vger.kernel.org Signed-off-by: Alexandre Ghiti Reviewed-by: Clément Léger Reviewed-by: Cyril Bur Link: https://lore.kernel.org/r/20250903-dev-alex-sparse_warnings_v1-v1-1-7e6350beb700@rivosinc.com Signed-off-by: Paul Walmsley commit 95c54cd9c769a198118772e196adfaa1f002e365 Author: Breno Leitao Date: Wed Aug 27 03:42:22 2025 -0700 riscv: kexec: Initialize kexec_buf struct The kexec_buf structure was previously declared without initialization. commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly") added a field that is always read but not consistently populated by all architectures. This un-initialized field will contain garbage. This is also triggering a UBSAN warning when the uninitialized data was accessed: ------------[ cut here ]------------ UBSAN: invalid-load in ./include/linux/kexec.h:210:10 load of value 252 is not a valid value for type '_Bool' Zero-initializing kexec_buf at declaration ensures all fields are cleanly set, preventing future instances of uninitialized memory being used. Fixes: bf454ec31add ("kexec_file: allow to place kexec_buf randomly") Signed-off-by: Breno Leitao Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250827-kbuf_all-v1-2-1df9882bb01a@debian.org Signed-off-by: Paul Walmsley commit f4ea67a722e8c9e1fb8109adebb9fb881ff0793a Author: Radim Krčmář Date: Fri Jul 25 18:54:10 2025 +0200 riscv: use lw when reading int cpu in asm_per_cpu REG_L is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide. The struct currently has a hole after cpu, so little endian accesses seemed fine. Fixes: be97d0db5f44 ("riscv: VMAP_STACK overflow detection thread-safe") Cc: stable@vger.kernel.org Reviewed-by: Alexandre Ghiti Signed-off-by: Radim Krčmář Link: https://lore.kernel.org/r/20250725165410.2896641-5-rkrcmar@ventanamicro.com Signed-off-by: Paul Walmsley commit 8a16586fa7b8a01360890d284896b90c217dca44 Author: Radim Krčmář Date: Tue Aug 12 11:02:56 2025 +0200 riscv, bpf: use lw when reading int cpu in bpf_get_smp_processor_id emit_ld is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide. The struct currently has a hole after cpu, so little endian accesses seemed fine. Fixes: 2ddec2c80b44 ("riscv, bpf: inline bpf_get_smp_processor_id()") Cc: stable@vger.kernel.org Signed-off-by: Radim Krčmář Reviewed-by: Pu Lehui Link: https://lore.kernel.org/r/20250812090256.757273-4-rkrcmar@ventanamicro.com Signed-off-by: Paul Walmsley commit ad5348c765914766a98ad26cf7a8c28d51a16bdd Author: Radim Krčmář Date: Tue Aug 12 11:02:55 2025 +0200 riscv, bpf: use lw when reading int cpu in BPF_MOV64_PERCPU_REG emit_ld is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide. The struct currently has a hole after cpu, so little endian accesses seemed fine. Fixes: 19c56d4e5be1 ("riscv, bpf: add internal-only MOV instruction to resolve per-CPU addrs") Cc: stable@vger.kernel.org Signed-off-by: Radim Krčmář Reviewed-by: Pu Lehui Acked-by: Björn Töpel Tested-by: Björn Töpel # QEMU Reviewed-by: Alexandre Ghiti Link: https://lore.kernel.org/r/20250812090256.757273-3-rkrcmar@ventanamicro.com Signed-off-by: Paul Walmsley commit 1046791390af6703a5e24718a16f37974adb11db Author: Aurelien Jarno Date: Fri Jul 25 00:08:52 2025 +0200 riscv: uaccess: fix __put_user_nocheck for unaligned accesses The type of the value to write should be determined by the size of the destination, not by the value itself, which may be a constant. This aligns the behavior with x86_64, where __typeof__(*(__gu_ptr)) is used to infer the correct type. This fixes an issue in put_cmsg, which was only writing 4 out of 8 bytes to the cmsg_len field, causing the glibc tst-socket-timestamp test to fail. Fixes: ca1a66cdd685 ("riscv: uaccess: do not do misaligned accesses in get/put_user()") Signed-off-by: Aurelien Jarno Reviewed-by: Alexandre Ghiti Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250724220853.1969954-1-aurelien@aurel32.net Signed-off-by: Paul Walmsley commit e108c8a94f3f958c877f6ec7a6052a893ae4aa98 Author: Radim Krčmář Date: Fri Jul 25 18:54:09 2025 +0200 riscv: use lw when reading int cpu in new_vmalloc_check REG_L is wrong, because thread_info.cpu is 32-bit, not xlen-bit wide. The struct currently has a hole after cpu, so little endian accesses seemed fine. Fixes: 503638e0babf ("riscv: Stop emitting preventive sfence.vma for new vmalloc mappings") Cc: stable@vger.kernel.org Reviewed-by: Alexandre Ghiti Signed-off-by: Radim Krčmář Link: https://lore.kernel.org/r/20250725165410.2896641-4-rkrcmar@ventanamicro.com Signed-off-by: Paul Walmsley commit d3e45016f75e3efc2366e9060241d38e3fd03a8f Merge: 53b48f62f29dce 708e2371f77a9d Author: Linus Torvalds Date: Fri Sep 5 14:26:03 2025 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "Obvious driver patch plus update to sr to add back rotational media flag since CDROMS are rotational" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: sr: Reinstate rotational media flag scsi: lpfc: Fix buffer free/clear order in deferred receive path commit 53b48f62f29dce6dcad490dc1994286994098837 Merge: e5d5d23319565a 1991a458528588 Author: Linus Torvalds Date: Fri Sep 5 13:29:31 2025 -0700 Merge tag 'spi-fix-v6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "The largest batch of fixes here is a series of fixes for the Freescale LPSPI driver which James Clark pulled out of their BSP while looking at support for the NXP S32G version of the controller. The majority of this turned out to be bug fixes that affect existing systems with the actual S32G support being just a small quirk that would be unremarkable by itself, the whole series has had a good amount of testing and review and the individual patches are all pretty straightforward by themselves. We also have a few other driver specific fixes, including a relatively large but simple one for the Cadence QuadSPI driver" * tag 'spi-fix-v6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: spi-qpic-snand: unregister ECC engine on probe error and device remove spi: cadence-quadspi: Implement refcount to handle unbind during busy spi: spi-fsl-lpspi: Add compatible for S32G spi: spi-fsl-lpspi: Parameterize reading num-cs from hardware spi: spi-fsl-lpspi: Treat prescale_max == 0 as no erratum spi: spi-fsl-lpspi: Constify devtype datas dt-bindings: lpspi: Document support for S32G spi: spi-fsl-lpspi: Clear status register after disabling the module spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort spi: spi-fsl-lpspi: Set correct chip-select polarity bit spi: spi-fsl-lpspi: Fix transmissions when using CONT spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback commit e5d5d23319565a7e48232707c3fe30bd4eb638cd Merge: 730c1451fbc394 a7ed7b9d0ebb03 Author: Linus Torvalds Date: Fri Sep 5 13:11:10 2025 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - Incorrect __BITS_PER_LONG as 64 when compiling the compat vDSO - Unreachable PLT for ftrace_caller() in a module's .init.text following past reworking of the module VA range selection - Memory leak in the ACPI iort_rmr_alloc_sids() after a failed krealloc_array() * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() arm64: uapi: Provide correct __BITS_PER_LONG for the compat vDSO commit 730c1451fbc3942d434a4203bd4616ad0b71b23d Merge: c2f3b108c09d1a 4540f1d23e7f38 Author: Linus Torvalds Date: Fri Sep 5 12:35:25 2025 -0700 Merge tag 'audit-pr-20250905' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit fix from Paul Moore: "A single small audit patch to fix a potential out-of-bounds read caused by a negative array index when comparing paths" * tag 'audit-pr-20250905' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit: fix out-of-bounds read in audit_compare_dname_path() commit 992203a1fba51b025c60ec0c8b0d9223343dea95 Author: Scott Mayhew Date: Thu Aug 7 12:49:38 2025 -0400 nfs/localio: restore creds before releasing pageio data Otherwise if the nfsd filecache code releases the nfsd_file immediately, it can trigger the BUG_ON(cred == current->cred) in __put_cred() when it puts the nfsd_file->nf_file->f-cred. Fixes: b9f5dd57f4a5 ("nfs/localio: use dedicated workqueues for filesystem read and write") Signed-off-by: Scott Mayhew Reviewed-by: Mike Snitzer Link: https://lore.kernel.org/r/20250807164938.2395136-1-smayhew@redhat.com Signed-off-by: Trond Myklebust commit c2f3b108c09d1a8e2b20ce691df6a59d30351b7d Merge: 260aa8d5f0e6c8 70bccd9855dae5 Author: Linus Torvalds Date: Fri Sep 5 11:14:23 2025 -0700 Merge tag '6.17-RC4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix two potential NULL pointer references - Two debugging improvements (to help debug recent issues) a new tracepoint, and minor improvement to DebugData - Trivial comment cleanup * tag '6.17-RC4-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: cifs: prevent NULL pointer dereference in UTF16 conversion smb: client: show negotiated cipher in DebugData smb: client: add new tracepoint to trace lease break notification smb: client: fix spellings in comments smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show() commit 260aa8d5f0e6c858b985b0813091f3a270619983 Merge: 3d1e36499e0245 c2623573178bab Author: Linus Torvalds Date: Fri Sep 5 11:08:06 2025 -0700 Merge tag 'hwmon-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: - ina238: Various value range fixes when writing limit attributes - mlxreg-fan: Prevent fans from getting stuck at 0 RPM * tag 'hwmon-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (ina238) Correctly clamp power limits hwmon: (ina238) Correctly clamp shunt voltage limit hwmon: (ina238) Correctly clamp temperature hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM commit 3d1267475b94b3df7a61e4ea6788c7c5d9e473c4 Author: Mark Harmstone Date: Tue Sep 2 11:34:10 2025 +0100 btrfs: don't allow adding block device of less than 1 MB Commit 15ae0410c37a79 ("btrfs-progs: add error handling for device_get_partition_size_fd_stat()") in btrfs-progs inadvertently changed it so that if the BLKGETSIZE64 ioctl on a block device returned a size of 0, this was no longer seen as an error condition. Unfortunately this is how disconnected NBD devices behave, meaning that with btrfs-progs 6.16 it's now possible to add a device you can't remove: # btrfs device add /dev/nbd0 /root/temp # btrfs device remove /dev/nbd0 /root/temp ERROR: error removing device '/dev/nbd0': Invalid argument This check should always have been done kernel-side anyway, so add a check in btrfs_init_new_device() that the new device doesn't have a size less than BTRFS_DEVICE_RANGE_RESERVED (i.e. 1 MB). Reviewed-by: Qu Wenruo Signed-off-by: Mark Harmstone Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3d1e36499e02457f8de0edc9d87783cce97e8677 Merge: dd6cbcc589dd0f ed42d80f3bae89 Author: Linus Torvalds Date: Fri Sep 5 10:33:46 2025 -0700 Merge tag 'gpio-fixes-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix GPIO submenu regression in Kconfig - fix make clean under tools/gpio/ * tag 'gpio-fixes-for-v6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: tools: gpio: remove the include directory on make clean gpio: fix GPIO submenu in Kconfig commit dd6cbcc589dd0f22f2b7676c92d0058348c192de Merge: e9eaca6bf69d3f aa28991fd5dc4c Author: Linus Torvalds Date: Fri Sep 5 10:28:48 2025 -0700 Merge tag 'platform-drivers-x86-v6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - acer-wmi: Stop using ACPI bitmap for platform profile choices - amd/hfi: Fix pcct_tbl leak - amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks - asus-wmi: - Fix registration races - Fix ROG button mapping, tablet mode on ASUS ROG Z13 - Support more keys on ExpertBook B9 - hp-wmi: Add support for Fn+P hotkey - intel/pmc: Add Bartlett Lake support - intel/power-domains: Use topology_logical_package_id() for package ID * tag 'platform-drivers-x86-v6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID platform/x86: acer-wmi: Stop using ACPI bitmap for platform profile choices platform/x86: hp-wmi: Add support for Fn+P hotkey platform/x86/intel/pmc: Add Bartlett Lake support to intel_pmc_core platform/x86: asus-wmi: Fix racy registrations platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list platform/x86: asus-wmi: map more keys on ExpertBook B9 platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk platform/x86/amd: hfi: Fix pcct_tbl leak in amd_hfi_metadata_parser() commit e9eaca6bf69d3f261b9bd51637420b05c9352965 Merge: c8ed9b5c02a5ce 743bf030947169 Author: Linus Torvalds Date: Fri Sep 5 10:25:57 2025 -0700 Merge tag 'block-6.17-20250905' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - NVMe pull request via Keith - Fix protection information ref tag for device side gen/strip (Christoph) - MD pull request via Yu - fix data loss for writemostly in raid1 (Yu Kuai) - fix potentional data loss by skipping recovery (Li Nan) * tag 'block-6.17-20250905' of git://git.kernel.dk/linux: md: prevent incorrect update of resync/recovery offset md/raid1: fix data lost for writemostly rdev nvme: fix PI insert on write commit 5a91f52c8650334aaf8c4c7c90f40c6906994225 Author: Josef Bacik Date: Tue Aug 12 10:29:23 2025 -0400 MAINTAINERS: update btrfs entry This is an update to reflect reality, not a signal of any seismic change. Dave Sterba has been the acting maintainer for almost a decade, I've simply been here as a backstop in case he gets hit by a bus. The fact is we have a strong and thriving community with any number of more active developers that can take on that role if it's necessary. I'm exceedingly happy and proud of the work that Dave has done in keeping us all in line, and know that if further changes need to be made it'll be with the development community we've built throughout the lifetime of btrfs. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba commit a7ed7b9d0ebb038db9963d574da0311cab0b666a Author: panfan Date: Thu Sep 4 20:22:36 2025 -0700 arm64: ftrace: fix unreachable PLT for ftrace_caller in init_module with CONFIG_DYNAMIC_FTRACE On arm64, it has been possible for a module's sections to be placed more than 128M away from each other since commit: commit 3e35d303ab7d ("arm64: module: rework module VA range selection") Due to this, an ftrace callsite in a module's .init.text section can be out of branch range for the module's ftrace PLT entry (in the module's .text section). Any attempt to enable tracing of that callsite will result in a BRK being patched into the callsite, resulting in a fatal exception when the callsite is later executed. Fix this by adding an additional trampoline for .init.text, which will be within range. No additional trampolines are necessary due to the way a given module's executable sections are packed together. Any executable section beginning with ".init" will be placed in MOD_INIT_TEXT, and any other executable section, including those beginning with ".exit", will be placed in MOD_TEXT. Fixes: 3e35d303ab7d ("arm64: module: rework module VA range selection") Cc: # 6.5.x Signed-off-by: panfan Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250905032236.3220885-1-panfan@qti.qualcomm.com Signed-off-by: Catalin Marinas commit c8ed9b5c02a5ceb3d8244f3862a7e64cf0b5648e Merge: 01c93aa01c75e7 8b556ddeee8da9 Author: Linus Torvalds Date: Fri Sep 5 08:50:25 2025 -0700 Merge tag 'drm-fixes-2025-09-05' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly drm fixes roundup, nouveau has two fixes for fence/irq racing problems that should fix a bunch of instability in userspace. Otherwise amdgpu along with some single fixes to bridge, xe, ivpu. Looks about usual for this time in the release. scheduler: - fix race in unschedulable tracepoint bridge: - ti-sn65dsi86: fix REFCLK setting xe: - Fix incorrect migration of backed-up object to VRAM amdgpu: - UserQ fixes - MES 11 fix - eDP/LVDS fix - Fix non-DC audio clean up - Fix duplicate cursor issue - Fix error path in PSP init nouveau: - fix nonstall interrupt handling - fix race on fence vs irq emission - update MAINTAINERS entry ivpu: - prevent recovery work during device remove" * tag 'drm-fixes-2025-09-05' of https://gitlab.freedesktop.org/drm/kernel: drm/amd/amdgpu: Fix missing error return on kzalloc failure drm/bridge: ti-sn65dsi86: fix REFCLK setting MAINTAINERS: Update git entry for nouveau drm/xe: Fix incorrect migration of backed-up object to VRAM drm/sched: Fix racy access to drm_sched_entity.dependency accel/ivpu: Prevent recovery work from being queued during device removal nouveau: Membar before between semaphore writes and the interrupt nouveau: fix disabling the nonstall irq due to storm code drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG drm/amdgpu: drop hw access in non-DC audio fini drm/amd: Re-enable common modes for eDP and LVDS drm/amdgpu/mes11: make MES_MISC_OP_CHANGE_CONFIG failure non-fatal drm/amdgpu/sdma: bump firmware version checks for user queue support commit 4550d33e18112a11a740424c4eec063cd58e918c Author: Santhosh Kumar K Date: Thu Sep 4 18:47:41 2025 +0530 mtd: spinand: winbond: Fix oob_layout for W25N01JW Fix the W25N01JW's oob_layout according to the datasheet [1] [1] https://www.winbond.com/hq/product/code-storage-flash-memory/qspinand-flash/?__locale=en&partNo=W25N01JW Fixes: 6a804fb72de5 ("mtd: spinand: winbond: add support for serial NAND flash") Cc: Sridharan S N Cc: stable@vger.kernel.org Signed-off-by: Santhosh Kumar K Signed-off-by: Miquel Raynal commit 01c93aa01c75e7a43f7f53229bcbecffac75eb84 Merge: 4e47e46718c466 cdb03b6d1896c2 Author: Linus Torvalds Date: Fri Sep 5 07:57:07 2025 -0700 Merge tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: "Fix a regression caused by my commits that reimplemented the sha1, sha256, and sha512 crypto_shash algorithms on top of the library API. Specifically, the export_core and import_core methods stopped being supported, which broke some hardware offload drivers (such as qat) that recently started depending on these for fallback functionality. Later I'd like to make these drivers just use the library API for their fallback. Then these methods won't be needed anymore. But for now, this fixes the regression for 6.17" * tag 'libcrypto-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: crypto: sha512 - Implement export_core() and import_core() crypto: sha256 - Implement export_core() and import_core() crypto: sha1 - Implement export_core() and import_core() commit 4e47e46718c466d90f7a452579f9ed1a7c250553 Merge: d69eb204c255c3 4a81f78caa53e0 Author: Linus Torvalds Date: Fri Sep 5 07:52:44 2025 -0700 Merge tag 'pcmcia-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux Pull PCMCIA fixes and cleanups from Dominik Brodowski: "A number of minor PCMCIA bugfixes and cleanups, including the removal of unused code paths" [ Dominik suggested this might be 6.18 material, but having looked through this, it looks appropriate early: minor trivial fixes and then one slightly bigger patch that removes dead code - Linus ] * tag 'pcmcia-6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/brodo/linux: pcmcia: Add error handling for add_interval() in do_validate_mem() pcmcia: cs: Remove unused pcmcia_get_socket_by_nr pcmcia: omap: Add missing check for platform_get_resource pcmcia: Use str_off_on() and str_yes_no() helpers pcmcia: remove PCCARD_IODYN pcmcia: ds: Emphasize "really" epizeuxis pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch commit e1bf212d0604d2cbb5514e47ccec252b656071fb Author: Haiyue Wang Date: Thu Sep 4 20:01:19 2025 +0800 fuse: virtio_fs: fix page fault for DAX page address The commit ced17ee32a99 ("Revert "virtio: reject shm region if length is zero"") exposes the following DAX page fault bug (this fix the failure that getting shm region alway returns false because of zero length): The commit 21aa65bf82a7 ("mm: remove callers of pfn_t functionality") handles the DAX physical page address incorrectly: the removed macro 'phys_to_pfn_t()' should be replaced with 'PHYS_PFN()'. [ 1.390321] BUG: unable to handle page fault for address: ffffd3fb40000008 [ 1.390875] #PF: supervisor read access in kernel mode [ 1.391257] #PF: error_code(0x0000) - not-present page [ 1.391509] PGD 0 P4D 0 [ 1.391626] Oops: Oops: 0000 [#1] SMP NOPTI [ 1.391806] CPU: 6 UID: 1000 PID: 162 Comm: weston Not tainted 6.17.0-rc3-WSL2-STABLE #2 PREEMPT(none) [ 1.392361] RIP: 0010:dax_to_folio+0x14/0x60 [ 1.392653] Code: 52 c9 c3 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 c1 ef 05 48 c1 e7 06 48 03 3d 34 b5 31 01 <48> 8b 57 08 48 89 f8 f6 c2 01 75 2b 66 90 c3 cc cc cc cc f7 c7 ff [ 1.393727] RSP: 0000:ffffaf7d04407aa8 EFLAGS: 00010086 [ 1.394003] RAX: 000000a000000000 RBX: ffffaf7d04407bb0 RCX: 0000000000000000 [ 1.394524] RDX: ffffd17b40000008 RSI: 0000000000000083 RDI: ffffd3fb40000000 [ 1.394967] RBP: 0000000000000011 R08: 000000a000000000 R09: 0000000000000000 [ 1.395400] R10: 0000000000001000 R11: ffffaf7d04407c10 R12: 0000000000000000 [ 1.395806] R13: ffffa020557be9c0 R14: 0000014000000001 R15: 0000725970e94000 [ 1.396268] FS: 000072596d6d2ec0(0000) GS:ffffa0222dc59000(0000) knlGS:0000000000000000 [ 1.396715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.397100] CR2: ffffd3fb40000008 CR3: 000000011579c005 CR4: 0000000000372ef0 [ 1.397518] Call Trace: [ 1.397663] [ 1.397900] dax_insert_entry+0x13b/0x390 [ 1.398179] dax_fault_iter+0x2a5/0x6c0 [ 1.398443] dax_iomap_pte_fault+0x193/0x3c0 [ 1.398750] __fuse_dax_fault+0x8b/0x270 [ 1.398997] ? vm_mmap_pgoff+0x161/0x210 [ 1.399175] __do_fault+0x30/0x180 [ 1.399360] do_fault+0xc4/0x550 [ 1.399547] __handle_mm_fault+0x8e3/0xf50 [ 1.399731] ? do_syscall_64+0x72/0x1e0 [ 1.399958] handle_mm_fault+0x192/0x2f0 [ 1.400204] do_user_addr_fault+0x20e/0x700 [ 1.400418] exc_page_fault+0x66/0x150 [ 1.400602] asm_exc_page_fault+0x26/0x30 [ 1.400831] RIP: 0033:0x72596d1bf703 [ 1.401076] Code: 31 f6 45 31 e4 48 8d 15 b3 73 00 00 e8 06 03 00 00 8b 83 68 01 00 00 e9 8e fa ff ff 0f 1f 00 48 8b 44 24 08 4c 89 ee 48 89 df 00 21 43 34 12 e8 72 09 00 00 e9 6a fa ff ff 0f 1f 44 00 00 e8 [ 1.402172] RSP: 002b:00007ffc350f6dc0 EFLAGS: 00010202 [ 1.402488] RAX: 0000725970e94000 RBX: 00005b7c642c2560 RCX: 0000725970d359a7 [ 1.402898] RDX: 0000000000000003 RSI: 00007ffc350f6dc0 RDI: 00005b7c642c2560 [ 1.403284] RBP: 00007ffc350f6e90 R08: 000000000000000d R09: 0000000000000000 [ 1.403634] R10: 00007ffc350f6dd8 R11: 0000000000000246 R12: 0000000000000001 [ 1.404078] R13: 00007ffc350f6dc0 R14: 0000725970e29ce0 R15: 0000000000000003 [ 1.404450] [ 1.404570] Modules linked in: [ 1.404821] CR2: ffffd3fb40000008 [ 1.405029] ---[ end trace 0000000000000000 ]--- [ 1.405323] RIP: 0010:dax_to_folio+0x14/0x60 [ 1.405556] Code: 52 c9 c3 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 c1 ef 05 48 c1 e7 06 48 03 3d 34 b5 31 01 <48> 8b 57 08 48 89 f8 f6 c2 01 75 2b 66 90 c3 cc cc cc cc f7 c7 ff [ 1.406639] RSP: 0000:ffffaf7d04407aa8 EFLAGS: 00010086 [ 1.406910] RAX: 000000a000000000 RBX: ffffaf7d04407bb0 RCX: 0000000000000000 [ 1.407379] RDX: ffffd17b40000008 RSI: 0000000000000083 RDI: ffffd3fb40000000 [ 1.407800] RBP: 0000000000000011 R08: 000000a000000000 R09: 0000000000000000 [ 1.408246] R10: 0000000000001000 R11: ffffaf7d04407c10 R12: 0000000000000000 [ 1.408666] R13: ffffa020557be9c0 R14: 0000014000000001 R15: 0000725970e94000 [ 1.409170] FS: 000072596d6d2ec0(0000) GS:ffffa0222dc59000(0000) knlGS:0000000000000000 [ 1.409608] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.409977] CR2: ffffd3fb40000008 CR3: 000000011579c005 CR4: 0000000000372ef0 [ 1.410437] Kernel panic - not syncing: Fatal exception [ 1.410857] Kernel Offset: 0xc000000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Fixes: 21aa65bf82a7 ("mm: remove callers of pfn_t functionality") Signed-off-by: Haiyue Wang Link: https://lore.kernel.org/20250904120339.972-1-haiyuewa@163.com Acked-by: David Hildenbrand Reviewed-by: Miklos Szeredi Signed-off-by: Christian Brauner commit 9ffaf5229055fcfbb3b3d6f1c7e58d63715c3f73 Author: Niklas Schnelle Date: Thu Sep 4 10:59:49 2025 +0200 iommu/s390: Make attach succeed when the device was surprise removed When a PCI device is removed with surprise hotplug, there may still be attempts to attach the device to the default domain as part of tear down via (__iommu_release_dma_ownership()), or because the removal happens during probe (__iommu_probe_device()). In both cases zpci_register_ioat() fails with a cc value indicating that the device handle is invalid. This is because the device is no longer part of the instance as far as the hypervisor is concerned. Currently this leads to an error return and s390_iommu_attach_device() fails. This triggers the WARN_ON() in __iommu_group_set_domain_nofail() because attaching to the default domain must never fail. With the device fenced by the hypervisor no DMAs to or from memory are possible and the IOMMU translations have no effect. Proceed as if the registration was successful and let the hotplug event handling clean up the device. This is similar to how devices in the error state are handled since commit 59bbf596791b ("iommu/s390: Make attach succeed even if the device is in error state") except that for removal the domain will not be registered later. This approach was also previously discussed at the link. Handle both cases, error state and removal, in a helper which checks if the error needs to be propagated or ignored. Avoid magic number condition codes by using the pre-existing, but never used, defines for PCI load/store condition codes and rename them to reflect that they apply to all PCI instructions. Cc: stable@vger.kernel.org # v6.2 Link: https://lore.kernel.org/linux-iommu/20240808194155.GD1985367@ziepe.ca/ Suggested-by: Jason Gunthorpe Signed-off-by: Niklas Schnelle Reviewed-by: Matthew Rosato Reviewed-by: Benjamin Block Link: https://lore.kernel.org/r/20250904-iommu_succeed_attach_removed-v1-1-e7f333d2f80f@linux.ibm.com Signed-off-by: Joerg Roedel commit dce043c07ca1ac19cfbe2844a6dc71e35c322353 Author: Eugene Koira Date: Wed Sep 3 13:53:29 2025 +0800 iommu/vt-d: Fix __domain_mapping()'s usage of switch_to_super_page() switch_to_super_page() assumes the memory range it's working on is aligned to the target large page level. Unfortunately, __domain_mapping() doesn't take this into account when using it, and will pass unaligned ranges ultimately freeing a PTE range larger than expected. Take for example a mapping with the following iov_pfn range [0x3fe400, 0x4c0600), which should be backed by the following mappings: iov_pfn [0x3fe400, 0x3fffff] covered by 2MiB pages iov_pfn [0x400000, 0x4bffff] covered by 1GiB pages iov_pfn [0x4c0000, 0x4c05ff] covered by 2MiB pages Under this circumstance, __domain_mapping() will pass [0x400000, 0x4c05ff] to switch_to_super_page() at a 1 GiB granularity, which will in turn free PTEs all the way to iov_pfn 0x4fffff. Mitigate this by rounding down the iov_pfn range passed to switch_to_super_page() in __domain_mapping() to the target large page level. Additionally add range alignment checks to switch_to_super_page. Fixes: 9906b9352a35 ("iommu/vt-d: Avoid duplicate removing in __domain_mapping()") Signed-off-by: Eugene Koira Cc: stable@vger.kernel.org Reviewed-by: Nicolas Saenz Julienne Reviewed-by: David Woodhouse Link: https://lore.kernel.org/r/20250826143816.38686-1-eugkoira@amazon.com Signed-off-by: Lu Baolu Signed-off-by: Joerg Roedel commit b3506e9bcc777ed6af2ab631c86a9990ed97b474 Author: Matthew Rosato Date: Wed Aug 27 17:08:27 2025 -0400 iommu/s390: Fix memory corruption when using identity domain zpci_get_iommu_ctrs() returns counter information to be reported as part of device statistics; these counters are stored as part of the s390_domain. The problem, however, is that the identity domain is not backed by an s390_domain and so the conversion via to_s390_domain() yields a bad address that is zero'd initially and read on-demand later via a sysfs read. These counters aren't necessary for the identity domain; just return NULL in this case. This issue was discovered via KASAN with reports that look like: BUG: KASAN: global-out-of-bounds in zpci_fmb_enable_device when using the identity domain for a device on s390. Cc: stable@vger.kernel.org Fixes: 64af12c6ec3a ("iommu/s390: implement iommu passthrough via identity domain") Reported-by: Cam Miller Signed-off-by: Matthew Rosato Tested-by: Cam Miller Reviewed-by: Farhan Ali Reviewed-by: Niklas Schnelle Link: https://lore.kernel.org/r/20250827210828.274527-1-mjrosato@linux.ibm.com Signed-off-by: Joerg Roedel commit 923b70581cb6acede90f8aaf4afe5d1c58c67b71 Author: Zhen Ni Date: Fri Aug 22 10:49:15 2025 +0800 iommu/amd: Fix ivrs_base memleak in early_amd_iommu_init() Fix a permanent ACPI table memory leak in early_amd_iommu_init() when CMPXCHG16B feature is not supported Fixes: 82582f85ed22 ("iommu/amd: Disable AMD IOMMU if CMPXCHG16B feature is not supported") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni Reviewed-by: Suravee Suthikulpanit Link: https://lore.kernel.org/r/20250822024915.673427-1-zhen.ni@easystack.cn Signed-off-by: Joerg Roedel commit 743bf030947169c413a711f60cebe73f837e649f Merge: 1f6b281ac501ce 7202082b7b7a25 Author: Jens Axboe Date: Fri Sep 5 05:08:27 2025 -0600 Merge tag 'md-6.17-20250905' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into block-6.17 Pull MD fixes from Yu: "- fix data loss for writemostly in raid1, by Yu Kuai; - fix potentional data lost by skipping recovery, by Li Nan;" * tag 'md-6.17-20250905' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: md: prevent incorrect update of resync/recovery offset md/raid1: fix data lost for writemostly rdev commit 34b8f4adedd54c19b0008914d2bb6311e1fb0d3b Author: Marc Zyngier Date: Fri Sep 5 08:28:59 2025 +0100 KVM: arm64: Mark freed S2 MMUs as invalid When freeing an S2 MMU, we free the associated pgd, but omit to mark the structure as invalid. Subsequently, a call to kvm_nested_s2_unmap() would pick these invalid S2 MMUs and pass them down the teardown path. This ends up with a nasty warning as we try to unmap an unallocated set of page tables. Fix this by making the S2 MMU invalid on freeing the pgd by calling kvm_init_nested_s2_mmu(). Fixes: 4f128f8e1aaa ("KVM: arm64: nv: Support multiple nested Stage-2 mmu structures") Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250905072859.211369-1-maz@kernel.org Signed-off-by: Oliver Upton commit 349510052f765b6eb9c2a21d0ffe08ba61fa683c Author: Danilo Krummrich Date: Mon Sep 1 22:26:39 2025 +0200 MAINTAINERS: Add drm-rust tree for Rust DRM drivers and infrastructure Multiple DRM Rust drivers (e.g. nova-core, nova-drm, Tyr, rvkms) are in development, with at least Nova and (soon) Tyr already upstream. Having a shared tree will ease and accelerate development, since all drivers can consume new infrastructure in the same release cycle. This includes infrastructure shared with other subsystem trees (e.g. Rust or driver-core). By consolidating in drm-rust, we avoid adding extra burden to drm-misc maintainers, e.g. dealing with cross-tree topic branches. The drm-misc tree is not a good fit for this stage of development, since its documented scope is small drivers with occasional large series. Rust drivers in development upstream, however, regularly involve large patch series, new infrastructure, and shared topic branches, which may not align well with drm-misc at this stage. The drm-rust tree may not be a permanent solution. Once the core Rust, DRM, and KMS infrastructure have stabilized, drivers and infrastructure changes are expected to transition into drm-misc or standalone driver trees respectively. Until then, drm-rust provides a dedicated place to coordinate development without disrupting existing workflows too much. Cc: David Airlie Cc: Simona Vetter Cc: Maarten Lankhorst Cc: Thomas Zimmermann Signed-off-by: Danilo Krummrich Acked-by: Janne Grunau Acked-by: Maxime Ripard Acked-by: Alexandre Courbot Acked-by: Jani Nikula Acked-by: Daniel Almeida Acked-by: Alice Ryhl Link: https://lore.kernel.org/r/20250901202850.208116-1-dakr@kernel.org Signed-off-by: Alice Ryhl commit ca81e74dc34734078d34485d4aa123561ba75b15 Author: Ian Rogers Date: Thu Sep 4 09:17:31 2025 -0700 perf symbol-elf: Add support for the block argument for libbfd James Clark caught that the BUILD_NONDISTRO=1 build with libbfd was broken due to an update to the read_build_id function adding a blocking argument. Add support for this argument by first opening the file blocking or non-blocking, then switching from bfd_openr to bfd_fdopenr and passing the opened fd. bfd_fdopenr closes the fd on error and when bfd_close are called. Reported-by: James Clark Closes: https://lore.kernel.org/lkml/20250903-james-perf-read-build-id-fix-v1-2-6a694d0a980f@linaro.org/ Fixes: 2c369d91d093 ("perf symbol: Add blocking argument to filename__read_build_id") Signed-off-by: Ian Rogers Reviewed-by: James Clark Link: https://lore.kernel.org/r/20250904161731.1193729-1-irogers@google.com Signed-off-by: Namhyung Kim commit 744175e972ac7c1f1be53556e186e5976e39f735 Author: Thomas Richter Date: Fri Aug 22 14:25:39 2025 +0200 perf test: Checking BPF metadata collection fails on version string commit edf2cadf01e8f ("perf test: add test for BPF metadata collection") fails consistently on the version string check. The perf version string on some of the constant integration test machines contains characters with special meaning in grep's extended regular expression matching algorithm. The output of perf version is: # perf version perf version 6.17.0-20250814.rc1.git20.24ea63ea3877.63.fc42.s390x+git # and the '+' character has special meaning in egrep command. Also the use of egrep is deprecated. Change the perf version string check to fixed character matching and get rid of egrep's warning being deprecated. Use grep -F instead. Output before: # perf test -F 102 Checking BPF metadata collection egrep: warning: egrep is obsolescent; using grep -E Basic BPF metadata test [Failed invalid output] 102: BPF metadata collection test : FAILED! # Output after: # perf test -F 102 Checking BPF metadata collection Basic BPF metadata test [Success] 102: BPF metadata collection test : Ok # Fixes: edf2cadf01e8f ("perf test: add test for BPF metadata collection") Signed-off-by: Thomas Richter Reviewed-by: Ian Rogers Reviewed-by: Arnaldo Carvalho de Melo Acked-by: Sumanth Korikkar Cc: Blake Jones Link: https://lore.kernel.org/r/20250822122540.4104658-1-tmricht@linux.ibm.com Signed-off-by: Namhyung Kim commit 1f6b281ac501ceaa121a9bece11260aecca70865 Merge: 95a7c5000956f9 7ac3c2889bc060 Author: Jens Axboe Date: Thu Sep 4 17:21:28 2025 -0600 Merge tag 'nvme-6.17-2025-09-04' of git://git.infradead.org/nvme into block-6.17 Pull NVMe fix from Keith: "nvme fixes for 6.17 - Fix protection information ref tag for device side gen/strip (Christoph)" * tag 'nvme-6.17-2025-09-04' of git://git.infradead.org/nvme: nvme: fix PI insert on write commit 5b3706597b90a7b6c9ae148edd07a43531dcd49e Author: Anup Patel Date: Mon Aug 18 20:05:59 2025 +0530 ACPI: RISC-V: Fix FFH_CPPC_CSR error handling The cppc_ffh_csr_read() and cppc_ffh_csr_write() returns Linux error code in "data->ret.error" so cpc_read_ffh() and cpc_write_ffh() must not use sbi_err_map_linux_errno() for FFH_CPPC_CSR. Fixes: 30f3ffbee86b ("ACPI: RISC-V: Add CPPC driver") Signed-off-by: Anup Patel Reviewed-by: Andrew Jones Reviewed-by: Troy Mitchell Reviewed-by: Sunil V L Reviewed-by: Nutty Liu Reviewed-by: Atish Patra Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250818143600.894385-2-apatel@ventanamicro.com Signed-off-by: Paul Walmsley commit 41f9049cff324b7033e6ed1ded7dfff803cf550a Author: Nathan Chancellor Date: Thu Jul 10 13:25:26 2025 -0700 riscv: Only allow LTO with CMODEL_MEDANY When building with CONFIG_CMODEL_MEDLOW and CONFIG_LTO_CLANG, there is a series of errors due to some files being unconditionally compiled with '-mcmodel=medany', mismatching with the rest of the kernel built with '-mcmodel=medlow': ld.lld: error: Function Import: link error: linking module flags 'Code Model': IDs have conflicting values: 'i32 3' from vmlinux.a(init.o at 899908), and 'i32 1' from vmlinux.a(net-traces.o at 1014628) Only allow LTO to be performed when CONFIG_CMODEL_MEDANY is enabled to ensure there will be no code model mismatch errors. An alternative solution would be disabling LTO for the files with a different code model than the main kernel like some specialized areas of the kernel do but doing that for individual files is not as sustainable than forbidding the combination altogether. Cc: stable@vger.kernel.org Fixes: 021d23428bdb ("RISC-V: build: Allow LTO to be selected") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506290255.KBVM83vZ-lkp@intel.com/ Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250710-riscv-restrict-lto-to-medany-v1-1-b1dac9871ecf@kernel.org Signed-off-by: Paul Walmsley commit 8b556ddeee8da9420699ce221b6267f395e7d72b Merge: 40bcf6ecf9f019 467e00b30dfe75 Author: Dave Airlie Date: Thu Sep 4 18:12:11 2025 +1000 Merge tag 'amd-drm-fixes-6.17-2025-09-03' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.17-2025-09-03: amdgpu: - UserQ fixes - MES 11 fix - eDP/LVDS fix - Fix non-DC audio clean up - Fix duplicate cursor issue - Fix error path in PSP init Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250903221656.251254-1-alexander.deucher@amd.com commit 157cf360c4a8751f7f511a71cc3a283b5d27f889 Author: Jiawen Wu Date: Thu Sep 4 10:43:22 2025 +0800 net: libwx: fix to enable RSS Now when SRIOV is enabled, PF with multiple queues can only receive all packets on queue 0. This is caused by an incorrect flag judgement, which prevents RSS from being enabled. In fact, RSS is supported for the functions when SRIOV is enabled. Remove the flag judgement to fix it. Fixes: c52d4b898901 ("net: libwx: Redesign flow when sriov is enabled") Cc: stable@vger.kernel.org Signed-off-by: Jiawen Wu Reviewed-by: Simon Horman Link: https://patch.msgid.link/A3B7449A08A044D0+20250904024322.87145-1-jiawenwu@trustnetic.com Signed-off-by: Jakub Kicinski commit bfa4d097f24e416b59a2d6146b29079928afbfea Merge: 9004a450fccbeb ec630c2c8ce215 Author: Mark Brown Date: Thu Sep 4 19:31:51 2025 +0100 More minor SDCA bug fixes Merge series from Charles Keepax : Just some minor SDCA bug fixes and some minor structure reordering to improve the padding. commit d69eb204c255c35abd9e8cb621484e8074c75eaa Merge: 68f285e2647814 9b2bfdbf43adb9 Author: Linus Torvalds Date: Thu Sep 4 09:59:15 2025 -0700 Merge tag 'net-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from netfilter, wireless and Bluetooth. We're reverting the removal of a Sundance driver, a user has appeared. This makes the PR rather large in terms of LoC. There's a conspicuous absence of real, user-reported 6.17 issues. Slightly worried that the summer distracted people from testing. Previous releases - regressions: - ax25: properly unshare skbs in ax25_kiss_rcv() Previous releases - always broken: - phylink: disable autoneg for interfaces that have no inband, fix regression on pcs-lynx (NXP LS1088) - vxlan: fix null-deref when using nexthop objects - batman-adv: fix OOB read/write in network-coding decode - icmp: icmp_ndo_send: fix reversing address translation for replies - tcp: fix socket ref leak in TCP-AO failure handling for IPv6 - mctp: - mctp_fraq_queue should take ownership of passed skb - usb: initialise mac header in RX path, avoid WARN - wifi: mac80211: do not permit 40 MHz EHT operation on 5/6 GHz, respect device limitations - wifi: wilc1000: avoid buffer overflow in WID string configuration - wifi: mt76: - fix regressions from mt7996 MLO support rework - fix offchannel handling issues on mt7996 - fix multiple wcid linked list corruption issues - mt7921: don't disconnect when AP requests switch to a channel which requires radar detection - mt7925u: use connac3 tx aggr check in tx complete - wifi: intel: - improve validation of ACPI DSM data - cfg: restore some 1000 series configs - wifi: ath: - ath11k: a fix for GTK rekeying - ath12k: a missed WiFi7 capability (multi-link EMLSR) - eth: intel: - ice: fix races in "low latency" firmware interface for Tx timestamps - idpf: set mac type when adding and removing MAC filters - i40e: remove racy read access to some debugfs files Misc: - Revert "eth: remove the DLink/Sundance (ST201) driver" - netfilter: conntrack: helper: Replace -EEXIST by -EBUSY, avoid confusing modprobe" * tag 'net-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (99 commits) phy: mscc: Stop taking ts_lock for tx_queue and use its own lock selftest: net: Fix weird setsockopt() in bind_bhash.c. MAINTAINERS: add Sabrina to TLS maintainers gve: update MAINTAINERS ppp: fix memory leak in pad_compress_skb net: xilinx: axienet: Add error handling for RX metadata pointer retrieval net: atm: fix memory leak in atm_register_sysfs when device_register fail netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX selftests: netfilter: fix udpclash tool hang ax25: properly unshare skbs in ax25_kiss_rcv() mctp: return -ENOPROTOOPT for unknown getsockopt options net/smc: Remove validation of reserved bits in CLC Decline message ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() net: thunder_bgx: decrement cleanup index before use net: thunder_bgx: add a missing of_node_put net: phylink: move PHY interrupt request to non-fail path net: lockless sock_i_ino() tools: ynl-gen: fix nested array counting wifi: wilc1000: avoid buffer overflow in WID string configuration wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() ... commit 68f285e2647814754b9ba77b79cb32c9be2146aa Merge: 08b06c30a44555 850470a8413a8a Author: Linus Torvalds Date: Thu Sep 4 09:54:20 2025 -0700 Merge tag 'slab-for-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab fixes from Vlastimil Babka: - Stable fix to make slub_debug code not access invalid pointers in the process of reporting issues (Li Qiong) - Stable fix to make object tracking pass gfp flags to stackdepot to avoid deadlock in contexts that can't even wake up kswapd due to e.g. timers debugging enabled (yangshiguang) * tag 'slab-for-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: mm: slub: avoid wake up kswapd in set_track_prepare mm/slub: avoid accessing metadata when pointer is invalid in object_err() commit 9004a450fccbeb40a71cc173747da37a459fd4dc Author: Krzysztof Kozlowski Date: Sun Aug 31 17:14:02 2025 +0200 ASoC: codecs: lpass-wsa-macro: Fix speaker quality distortion Commit bb4a0f497bc1 ("ASoC: codecs: lpass: Drop unused AIF_INVALID first DAI identifier") removed first entry in enum with DAI identifiers, because it looked unused. Turns out that there is a relation between DAI ID and "WSA RX0 Mux"-like kcontrols (which use "rx_mux_text" array). That "rx_mux_text" array used first three entries of DAI IDs enum, with value '0' being invalid. The value passed tp "WSA RX0 Mux"-like kcontrols was used as DAI ID and set to configure active channel count and mask, which are arrays indexed by DAI ID. After removal of first AIF_INVALID DAI identifier, this kcontrol was updating wrong entries in active channel count and mask arrays which was visible in reduced quality (distortions) during speaker playback on several boards like Lenovo T14s laptop and Qualcomm SM8550-based boards. Reported-by: Alexey Klimov Fixes: bb4a0f497bc1 ("ASoC: codecs: lpass: Drop unused AIF_INVALID first DAI identifier") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Tested-by: Srinivas Kandagatla Message-ID: <20250831151401.30897-2-krzysztof.kozlowski@linaro.org> Signed-off-by: Mark Brown commit d0f61658db58583b3acd1ada70a5352c39cd0388 Author: Krzysztof Kozlowski Date: Mon Sep 1 09:44:04 2025 +0200 ASoC: codecs: lpass-rx-macro: Fix playback quality distortion Commit bb4a0f497bc1 ("ASoC: codecs: lpass: Drop unused AIF_INVALID first DAI identifier") removed first entry in enum with DAI identifiers, because it looked unused. Turns out that there is a relation between DAI ID and "RX_MACRO RX0 MUX"-like kcontrols which use "rx_macro_mux_text" array. That "rx_macro_mux_text" array used first three entries of DAI IDs enum, with value '0' being invalid. The value passed tp "RX_MACRO RX0 MUX"-like kcontrols was used as DAI ID and set to configure active channel count and mask, which are arrays indexed by DAI ID. After removal of first AIF_INVALID DAI identifier, this kcontrol was updating wrong entries in active channel count and mask arrays which was visible in reduced quality (distortions) during headset playback on the Qualcomm SM8750 MTP8750 board. It seems it also fixes recording silence (instead of actual sound) via headset, even though that's different macro codec. Reported-by: Alexey Klimov Fixes: bb4a0f497bc1 ("ASoC: codecs: lpass: Drop unused AIF_INVALID first DAI identifier") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Tested-by: Srinivas Kandagatla Message-ID: <20250901074403.137263-2-krzysztof.kozlowski@linaro.org> Signed-off-by: Mark Brown commit 70bccd9855dae56942f2b18a08ba137bb54093a0 Author: Makar Semyonov Date: Thu Sep 4 15:28:41 2025 +0300 cifs: prevent NULL pointer dereference in UTF16 conversion There can be a NULL pointer dereference bug here. NULL is passed to __cifs_sfu_make_node without checks, which passes it unchecked to cifs_strndup_to_utf16, which in turn passes it to cifs_local_to_utf16_bytes where '*from' is dereferenced, causing a crash. This patch adds a check for NULL 'src' in cifs_strndup_to_utf16 and returns NULL early to prevent dereferencing NULL pointer. Found by Linux Verification Center (linuxtesting.org) with SVACE Signed-off-by: Makar Semyonov Cc: stable@vger.kernel.org Signed-off-by: Steve French commit 7202082b7b7a256d04ec96131c7f859df0a79f64 Author: Li Nan Date: Thu Sep 4 15:34:52 2025 +0800 md: prevent incorrect update of resync/recovery offset In md_do_sync(), when md_sync_action returns ACTION_FROZEN, subsequent call to md_sync_position() will return MaxSector. This causes 'curr_resync' (and later 'recovery_offset') to be set to MaxSector too, which incorrectly signals that recovery/resync has completed, even though disk data has not actually been updated. To fix this issue, skip updating any offset values when the sync action is FROZEN. The same holds true for IDLE. Fixes: 7d9f107a4e94 ("md: use new helpers in md_do_sync()") Signed-off-by: Li Nan Link: https://lore.kernel.org/linux-raid/20250904073452.3408516-1-linan666@huaweicloud.com Signed-off-by: Yu Kuai commit 93dec51e716db88f32d770dc9ab268964fff320b Author: Yu Kuai Date: Wed Sep 3 09:41:40 2025 +0800 md/raid1: fix data lost for writemostly rdev If writemostly is enabled, alloc_behind_master_bio() will allocate a new bio for rdev, with bi_opf set to 0. Later, raid1_write_request() will clone from this bio, hence bi_opf is still 0 for the cloned bio. Submit this cloned bio will end up to be read, causing write data lost. Fix this problem by inheriting bi_opf from original bio for behind_mast_bio. Fixes: e879a0d9cb08 ("md/raid1,raid10: don't ignore IO flags") Reported-and-tested-by: Ian Dall Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220507 Link: https://lore.kernel.org/linux-raid/20250903014140.3690499-1-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Li Nan commit f3ef7110924b897f4b79db9f7ac75d319ec09c4a Author: Miaoqian Lin Date: Thu Aug 28 19:22:43 2025 +0800 ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() If krealloc_array() fails in iort_rmr_alloc_sids(), the function returns NULL but does not free the original 'sids' allocation. This results in a memory leak since the caller overwrites the original pointer with the NULL return value. Fixes: 491cf4a6735a ("ACPI/IORT: Add support to retrieve IORT RMR reserved regions") Cc: # 6.0.x Signed-off-by: Miaoqian Lin Reviewed-by: Hanjun Guo Link: https://lore.kernel.org/r/20250828112243.61460-1-linmq006@gmail.com Signed-off-by: Catalin Marinas commit a00f2015acdbd8a4b3d2382eaeebe11db1925fad Author: Chia-I Wu Date: Wed Sep 3 12:21:33 2025 -0700 drm/panthor: validate group queue count A panthor group can have at most MAX_CS_PER_CSG panthor queues. Fixes: 4bdca11507928 ("drm/panthor: Add the driver frontend block") Signed-off-by: Chia-I Wu Reviewed-by: Boris Brezillon # v1 Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250903192133.288477-1-olvaffe@gmail.com commit 9b2bfdbf43adb9929c5ddcdd96efedbf1c88cf53 Author: Horatiu Vultur Date: Tue Sep 2 14:12:59 2025 +0200 phy: mscc: Stop taking ts_lock for tx_queue and use its own lock When transmitting a PTP frame which is timestamp using 2 step, the following warning appears if CONFIG_PROVE_LOCKING is enabled: ============================= [ BUG: Invalid wait context ] 6.17.0-rc1-00326-ge6160462704e #427 Not tainted ----------------------------- ptp4l/119 is trying to lock: c2a44ed4 (&vsc8531->ts_lock){+.+.}-{3:3}, at: vsc85xx_txtstamp+0x50/0xac other info that might help us debug this: context-{4:4} 4 locks held by ptp4l/119: #0: c145f068 (rcu_read_lock_bh){....}-{1:2}, at: __dev_queue_xmit+0x58/0x1440 #1: c29df974 (dev->qdisc_tx_busylock ?: &qdisc_tx_busylock){+...}-{2:2}, at: __dev_queue_xmit+0x5c4/0x1440 #2: c2aaaad0 (_xmit_ETHER#2){+.-.}-{2:2}, at: sch_direct_xmit+0x108/0x350 #3: c2aac170 (&lan966x->tx_lock){+.-.}-{2:2}, at: lan966x_port_xmit+0xd0/0x350 stack backtrace: CPU: 0 UID: 0 PID: 119 Comm: ptp4l Not tainted 6.17.0-rc1-00326-ge6160462704e #427 NONE Hardware name: Generic DT based system Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x7c/0xac dump_stack_lvl from __lock_acquire+0x8e8/0x29dc __lock_acquire from lock_acquire+0x108/0x38c lock_acquire from __mutex_lock+0xb0/0xe78 __mutex_lock from mutex_lock_nested+0x1c/0x24 mutex_lock_nested from vsc85xx_txtstamp+0x50/0xac vsc85xx_txtstamp from lan966x_fdma_xmit+0xd8/0x3a8 lan966x_fdma_xmit from lan966x_port_xmit+0x1bc/0x350 lan966x_port_xmit from dev_hard_start_xmit+0xc8/0x2c0 dev_hard_start_xmit from sch_direct_xmit+0x8c/0x350 sch_direct_xmit from __dev_queue_xmit+0x680/0x1440 __dev_queue_xmit from packet_sendmsg+0xfa4/0x1568 packet_sendmsg from __sys_sendto+0x110/0x19c __sys_sendto from sys_send+0x18/0x20 sys_send from ret_fast_syscall+0x0/0x1c Exception stack(0xf0b05fa8 to 0xf0b05ff0) 5fa0: 00000001 0000000e 0000000e 0004b47a 0000003a 00000000 5fc0: 00000001 0000000e 00000000 00000121 0004af58 00044874 00000000 00000000 5fe0: 00000001 bee9d420 00025a10 b6e75c7c So, instead of using the ts_lock for tx_queue, use the spinlock that skb_buff_head has. Reviewed-by: Vadim Fedorenko Fixes: 7d272e63e0979d ("net: phy: mscc: timestamping and PHC support") Signed-off-by: Horatiu Vultur Link: https://patch.msgid.link/20250902121259.3257536-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 1939a9fcb80353dd8b111aa1e79c691afbde08b4 Author: Christoffer Sandberg Date: Tue Aug 26 16:26:06 2025 +0200 Input: i8042 - add TUXEDO InfinityBook Pro Gen10 AMD to i8042 quirk table Occasionally wakes up from suspend with missing input on the internal keyboard. Setting the quirks appears to fix the issue for this device as well. Signed-off-by: Christoffer Sandberg Signed-off-by: Werner Sembach Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250826142646.13516-1-wse@tuxedocomputers.com Signed-off-by: Dmitry Torokhov commit fd2004d82d8d8faa94879e3de3096c8511728637 Author: Kuniyuki Iwashima Date: Wed Sep 3 22:28:51 2025 +0000 selftest: net: Fix weird setsockopt() in bind_bhash.c. bind_bhash.c passes (SO_REUSEADDR | SO_REUSEPORT) to setsockopt(). In the asm-generic definition, the value happens to match with the bare SO_REUSEPORT, (2 | 15) == 15, but not on some arch. arch/alpha/include/uapi/asm/socket.h:18:#define SO_REUSEADDR 0x0004 arch/alpha/include/uapi/asm/socket.h:24:#define SO_REUSEPORT 0x0200 arch/mips/include/uapi/asm/socket.h:24:#define SO_REUSEADDR 0x0004 /* Allow reuse of local addresses. */ arch/mips/include/uapi/asm/socket.h:33:#define SO_REUSEPORT 0x0200 /* Allow local address and port reuse. */ arch/parisc/include/uapi/asm/socket.h:12:#define SO_REUSEADDR 0x0004 arch/parisc/include/uapi/asm/socket.h:18:#define SO_REUSEPORT 0x0200 arch/sparc/include/uapi/asm/socket.h:13:#define SO_REUSEADDR 0x0004 arch/sparc/include/uapi/asm/socket.h:20:#define SO_REUSEPORT 0x0200 include/uapi/asm-generic/socket.h:12:#define SO_REUSEADDR 2 include/uapi/asm-generic/socket.h:27:#define SO_REUSEPORT 15 Let's pass SO_REUSEPORT only. Fixes: c35ecb95c448 ("selftests/net: Add test for timing a bind request to a port with a populated bhash entry") Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250903222938.2601522-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit ed42d80f3bae89592fbb2ffaf8b6b2e720d53f6a Author: zhang jiao Date: Wed Sep 3 14:36:20 2025 +0800 tools: gpio: remove the include directory on make clean Remove the generated include directory when running make clean. Fixes: 8674cea84dc6 ("tools/gpio: move to tools buildsystem") Signed-off-by: Zhang Jiao Link: https://lore.kernel.org/r/20250903063621.2424-1-zhangjiao2@cmss.chinamobile.com [Bartosz: add Fixes tag, improve the commit message] Signed-off-by: Bartosz Golaszewski commit 6a989d37302a41a8a8d6231a4c265fdb6b09d6eb Author: Jakub Kicinski Date: Wed Sep 3 14:20:54 2025 -0700 MAINTAINERS: add Sabrina to TLS maintainers Sabrina has been very helpful reviewing TLS patches, fixing bugs, and, I believe, the last one to implement any major feature in the TLS code base (rekeying). Add her as a maintainer. Acked-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250903212054.1885058-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b1ab3b029ff137f124c547452d0795e9de20ca63 Author: Jeroen de Borst Date: Wed Sep 3 10:56:49 2025 -0700 gve: update MAINTAINERS Jeroen is leaving Google and Josh is taking his place as a maintainer. Signed-off-by: Jeroen de Borst Link: https://patch.msgid.link/20250903175649.23246-1-jeroendb@google.com Signed-off-by: Jakub Kicinski commit 4844123fe0b853a4982c02666cb3fd863d701d50 Author: Qingfang Deng Date: Wed Sep 3 18:07:26 2025 +0800 ppp: fix memory leak in pad_compress_skb If alloc_skb() fails in pad_compress_skb(), it returns NULL without releasing the old skb. The caller does: skb = pad_compress_skb(ppp, skb); if (!skb) goto drop; drop: kfree_skb(skb); When pad_compress_skb() returns NULL, the reference to the old skb is lost and kfree_skb(skb) ends up doing nothing, leading to a memory leak. Align pad_compress_skb() semantics with realloc(): only free the old skb if allocation and compression succeed. At the call site, use the new_skb variable so the original skb is not lost when pad_compress_skb() fails. Fixes: b3f9b92a6ec1 ("[PPP]: add PPP MPPE encryption module") Signed-off-by: Qingfang Deng Reviewed-by: Eric Dumazet Reviewed-by: Yue Haibing Link: https://patch.msgid.link/20250903100726.269839-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit 8bbceba7dc5090c00105e006ce28d1292cfda8dd Author: Abin Joseph Date: Wed Sep 3 08:22:13 2025 +0530 net: xilinx: axienet: Add error handling for RX metadata pointer retrieval Add proper error checking for dmaengine_desc_get_metadata_ptr() which can return an error pointer and lead to potential crashes or undefined behaviour if the pointer retrieval fails. Properly handle the error by unmapping DMA buffer, freeing the skb and returning early to prevent further processing with invalid data. Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support") Signed-off-by: Abin Joseph Reviewed-by: Radhey Shyam Pandey Link: https://patch.msgid.link/20250903025213.3120181-1-abin.joseph@amd.com Signed-off-by: Jakub Kicinski commit d93b10e89471002d16556f14b804b5a7d9924142 Merge: 0a228624bcc00a 4039ce7ef40474 Author: Jakub Kicinski Date: Thu Sep 4 06:59:27 2025 -0700 Merge tag 'nf-25-09-04' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter: updates for net 1) Fix a silly bug in conntrack selftest, busyloop may get optimized to for (;;), reported by Yi Chen. 2) Introduce new NFTA_DEVICE_PREFIX attribute in nftables netlink api, re-using old NFTA_DEVICE_NAME led to confusion with different kernel/userspace versions. This refines the wildcard interface support added in 6.16 release. From Phil Sutter. * tag 'nf-25-09-04' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX selftests: netfilter: fix udpclash tool hang ==================== Link: https://patch.msgid.link/20250904072548.3267-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit c9ddc41cdd522f2db5d492eda3df8994d928be34 Author: Jeff LaBundy Date: Sun Aug 17 19:20:22 2025 -0500 Input: iqs7222 - avoid enabling unused interrupts If a proximity event node is defined so as to specify the wake-up properties of the touch surface, the proximity event interrupt is enabled unconditionally. This may result in unwanted interrupts. Solve this problem by enabling the interrupt only if the event is mapped to a key or switch code. Signed-off-by: Jeff LaBundy Link: https://lore.kernel.org/r/aKJxxgEWpNaNcUaW@nixie71 Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit ec630c2c8ce215dd365b8c3644f004f645714a0f Author: Charles Keepax Date: Wed Aug 20 17:37:17 2025 +0100 ASoC: SDCA: Reorder members of hide struct to remove holes Remove some padding holes in the sdca_entity_hide struct by reordering the members. Signed-off-by: Charles Keepax Message-ID: <20250820163717.1095846-4-ckeepax@opensource.cirrus.com> Signed-off-by: Mark Brown commit 16c912ec34edc4d7daecde58e40d480858830a12 Author: Charles Keepax Date: Wed Aug 20 17:37:16 2025 +0100 ASoC: SDCA: Fix return value in detected_mode_handler() The detected mode IRQ handler should return an irqreturn_t not a regular error code. Correct the return value in detected_mode_handler(). Fixes: b9ab3b618241 ("ASoC: SDCA: Add some initial IRQ handlers") Signed-off-by: Charles Keepax Message-ID: <20250820163717.1095846-3-ckeepax@opensource.cirrus.com> Signed-off-by: Mark Brown commit f81e63047600d023cbfda372b6de8f2821ff6839 Author: Charles Keepax Date: Wed Aug 20 17:37:15 2025 +0100 ASoC: SDCA: Fix return value in sdca_regmap_mbq_size() The MBQ size function returns an integer representing the size of a Control. Currently if the Control is not found the function will return false which makes little sense. Correct this typo to return -EINVAL. Fixes: e3f7caf74b79 ("ASoC: SDCA: Add generic regmap SDCA helpers") Signed-off-by: Charles Keepax Message-ID: <20250820163717.1095846-2-ckeepax@opensource.cirrus.com> Signed-off-by: Mark Brown commit 68f27f7c7708183e7873c585ded2f1b057ac5b97 Author: Krzysztof Kozlowski Date: Thu Sep 4 12:18:50 2025 +0200 ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed If earlier opening of source graph fails (e.g. ADSP rejects due to incorrect audioreach topology), the graph is closed and "dai_data->graph[dai->id]" is assigned NULL. Preparing the DAI for sink graph continues though and next call to q6apm_lpass_dai_prepare() receives dai_data->graph[dai->id]=NULL leading to NULL pointer exception: qcom-apm gprsvc:service:2:1: Error (1) Processing 0x01001002 cmd qcom-apm gprsvc:service:2:1: DSP returned error[1001002] 1 q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: fail to start APM port 78 q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: ASoC: error at snd_soc_pcm_dai_prepare on TX_CODEC_DMA_TX_3: -22 Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8 ... Call trace: q6apm_graph_media_format_pcm+0x48/0x120 (P) q6apm_lpass_dai_prepare+0x110/0x1b4 snd_soc_pcm_dai_prepare+0x74/0x108 __soc_pcm_prepare+0x44/0x160 dpcm_be_dai_prepare+0x124/0x1c0 Fixes: 30ad723b93ad ("ASoC: qdsp6: audioreach: add q6apm lpass dai support") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Message-ID: <20250904101849.121503-2-krzysztof.kozlowski@linaro.org> Signed-off-by: Mark Brown commit 47ddf62b43eced739b56422cd55e86b9b4bb7dac Author: Antheas Kapenekakis Date: Wed Sep 3 18:51:14 2025 +0200 Input: xpad - add support for Flydigi Apex 5 Add Flydigi Apex 5 to the list of recognized controllers. Reported-by: Brandon Lin Reported-by: Sergey Belozyorcev Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250903165114.2987905-1-lkml@antheas.dev Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov commit 0a228624bcc00af41f281a2a84c928595a74c17d Author: Wang Liang Date: Mon Sep 1 14:35:37 2025 +0800 net: atm: fix memory leak in atm_register_sysfs when device_register fail When device_register() return error in atm_register_sysfs(), which can be triggered by kzalloc fail in device_private_init() or other reasons, kmemleak reports the following memory leaks: unreferenced object 0xffff88810182fb80 (size 8): comm "insmod", pid 504, jiffies 4294852464 hex dump (first 8 bytes): 61 64 75 6d 6d 79 30 00 adummy0. backtrace (crc 14dfadaf): __kmalloc_node_track_caller_noprof+0x335/0x450 kvasprintf+0xb3/0x130 kobject_set_name_vargs+0x45/0x120 dev_set_name+0xa9/0xe0 atm_register_sysfs+0xf3/0x220 atm_dev_register+0x40b/0x780 0xffffffffa000b089 do_one_initcall+0x89/0x300 do_init_module+0x27b/0x7d0 load_module+0x54cd/0x5ff0 init_module_from_file+0xe4/0x150 idempotent_init_module+0x32c/0x610 __x64_sys_finit_module+0xbd/0x120 do_syscall_64+0xa8/0x270 entry_SYSCALL_64_after_hwframe+0x77/0x7f When device_create_file() return error in atm_register_sysfs(), the same issue also can be triggered. Function put_device() should be called to release kobj->name memory and other device resource, instead of kfree(). Fixes: 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array") Signed-off-by: Wang Liang Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250901063537.1472221-1-wangliang74@huawei.com Signed-off-by: Paolo Abeni commit 4039ce7ef40474d5ba46f414c50cc7020b9cf8ae Author: Phil Sutter Date: Thu Aug 7 15:49:59 2025 +0200 netfilter: nf_tables: Introduce NFTA_DEVICE_PREFIX This new attribute is supposed to be used instead of NFTA_DEVICE_NAME for simple wildcard interface specs. It holds a NUL-terminated string representing an interface name prefix to match on. While kernel code to distinguish full names from prefixes in NFTA_DEVICE_NAME is simpler than this solution, reusing the existing attribute with different semantics leads to confusion between different versions of kernel and user space though: * With old kernels, wildcards submitted by user space are accepted yet silently treated as regular names. * With old user space, wildcards submitted by kernel may cause crashes since libnftnl expects NUL-termination when there is none. Using a distinct attribute type sanitizes these situations as the receiving part detects and rejects the unexpected attribute nested in *_HOOK_DEVS attributes. Fixes: 6d07a289504a ("netfilter: nf_tables: Support wildcard netdev hook specs") Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal commit 661a4f307fe0f80c1d544e09476ccba9037e8e65 Author: Florian Westphal Date: Wed Aug 27 19:17:32 2025 +0200 selftests: netfilter: fix udpclash tool hang Yi Chen reports that 'udpclash' loops forever depending on compiler (and optimization level used); while (x == 1) gets optimized into for (;;). Add volatile qualifier to avoid that. While at it, also run it under timeout(1) and fix the resize script to not ignore the timeout passed as second parameter to insert_flood. Reported-by: Yi Chen Suggested-by: Yi Chen Fixes: 78a588363587 ("selftests: netfilter: add conntrack clash resolution test case") Signed-off-by: Florian Westphal commit 08b06c30a44555a8b1d14950e4462a52bfa0758b Merge: b9a10f876409bf b5ee94ac651aa4 Author: Linus Torvalds Date: Wed Sep 3 20:44:15 2025 -0700 Merge tag 'v6.17-rc4-ksmbd-fix' of git://git.samba.org/ksmbd Pull smb server fix from Steve French: - fix handling filenames with ":" (colon) in them * tag 'v6.17-rc4-ksmbd-fix' of git://git.samba.org/ksmbd: ksmbd: allow a filename to contain colons on SMB3.1.1 posix extensions commit 40bcf6ecf9f019c5e996332b2bc8c339f62e246b Merge: 42e0a73bf788e2 379b3c983fc025 Author: Dave Airlie Date: Thu Sep 4 12:51:58 2025 +1000 Merge tag 'drm-xe-fixes-2025-09-03' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Fix incorrect migration of backed-up object to VRAM (Thomas) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aLiP26TiHkYxtBXL@intel.com commit 42e0a73bf788e2d042753bf0322b0b7e80a7a538 Merge: b320789d6883cc bdd5a14e660062 Author: Dave Airlie Date: Thu Sep 4 12:36:03 2025 +1000 Merge tag 'drm-misc-fixes-2025-09-03' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Two nouveau interrupt handling fixes, one race fix for ivpu, a race fix for drm_sched, and a clock fix for ti-sn65dsi86. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/qc2rd7bskgufjtyspbjflyjpswcnhyja6s7nm2yb67j7hezyey@yfn2w6n5trff commit 3be306cccdccede13e3cefd0c14e430cc2b7c9c7 Author: Kyle Meyer Date: Thu Aug 28 13:38:20 2025 -0500 mm/memory-failure: fix redundant updates for already poisoned pages Duplicate memory errors can be reported by multiple sources. Passing an already poisoned page to action_result() causes issues: * The amount of hardware corrupted memory is incorrectly updated. * Per NUMA node MF stats are incorrectly updated. * Redundant "already poisoned" messages are printed. Avoid those issues by: * Skipping hardware corrupted memory updates for already poisoned pages. * Skipping per NUMA node MF stats updates for already poisoned pages. * Dropping redundant "already poisoned" messages. Make MF_MSG_ALREADY_POISONED consistent with other action_page_types and make calls to action_result() consistent for already poisoned normal pages and huge pages. Link: https://lkml.kernel.org/r/aLCiHMy12Ck3ouwC@hpe.com Fixes: b8b9488d50b7 ("mm/memory-failure: improve memory failure action_result messages") Signed-off-by: Kyle Meyer Reviewed-by: Jiaqi Yan Acked-by: David Hildenbrand Reviewed-by: Jane Chu Acked-by: Miaohe Lin Cc: Borislav Betkov Cc: Kyle Meyer Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: "Luck, Tony" Cc: Michal Hocko Cc: Mike Rapoport Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Russ Anderson Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit e67f0bd05519012eaabaae68618ffc4ed30ab680 Author: Breno Leitao Date: Wed Aug 27 03:42:23 2025 -0700 s390: kexec: initialize kexec_buf struct The kexec_buf structure was previously declared without initialization. commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly") added a field that is always read but not consistently populated by all architectures. This un-initialized field will contain garbage. This is also triggering a UBSAN warning when the uninitialized data was accessed: ------------[ cut here ]------------ UBSAN: invalid-load in ./include/linux/kexec.h:210:10 load of value 252 is not a valid value for type '_Bool' Zero-initializing kexec_buf at declaration ensures all fields are cleanly set, preventing future instances of uninitialized memory being used. Link: https://lkml.kernel.org/r/20250827-kbuf_all-v1-3-1df9882bb01a@debian.org Fixes: bf454ec31add ("kexec_file: allow to place kexec_buf randomly") Signed-off-by: Breno Leitao Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Baoquan He Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Coiby Xu Cc: Heiko Carstens Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Will Deacon Cc: Signed-off-by: Andrew Morton commit 8afbd0045922b8146acf1a78ae818693e0468dbd Author: Breno Leitao Date: Wed Aug 27 03:42:22 2025 -0700 riscv: kexec: initialize kexec_buf struct The kexec_buf structure was previously declared without initialization. commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly") added a field that is always read but not consistently populated by all architectures. This un-initialized field will contain garbage. This is also triggering a UBSAN warning when the uninitialized data was accessed: ------------[ cut here ]------------ UBSAN: invalid-load in ./include/linux/kexec.h:210:10 load of value 252 is not a valid value for type '_Bool' Zero-initializing kexec_buf at declaration ensures all fields are cleanly set, preventing future instances of uninitialized memory being used. Link: https://lkml.kernel.org/r/20250827-kbuf_all-v1-2-1df9882bb01a@debian.org Fixes: bf454ec31add ("kexec_file: allow to place kexec_buf randomly") Signed-off-by: Breno Leitao Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Baoquan He Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Coiby Xu Cc: Heiko Carstens Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Will Deacon Cc: Signed-off-by: Andrew Morton commit 04d3cd43700a2d0fe4bfb1012a8ec7f2e34a3507 Author: Breno Leitao Date: Wed Aug 27 03:42:21 2025 -0700 arm64: kexec: initialize kexec_buf struct in load_other_segments() Patch series "kexec: Fix invalid field access". The kexec_buf structure was previously declared without initialization. commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly") added a field that is always read but not consistently populated by all architectures. This un-initialized field will contain garbage. This is also triggering a UBSAN warning when the uninitialized data was accessed: ------------[ cut here ]------------ UBSAN: invalid-load in ./include/linux/kexec.h:210:10 load of value 252 is not a valid value for type '_Bool' Zero-initializing kexec_buf at declaration ensures all fields are cleanly set, preventing future instances of uninitialized memory being used. An initial fix was already landed for arm64[0], and this patchset fixes the problem on the remaining arm64 code and on riscv, as raised by Mark. Discussions about this problem could be found at[1][2]. This patch (of 3): The kexec_buf structure was previously declared without initialization. commit bf454ec31add ("kexec_file: allow to place kexec_buf randomly") added a field that is always read but not consistently populated by all architectures. This un-initialized field will contain garbage. This is also triggering a UBSAN warning when the uninitialized data was accessed: ------------[ cut here ]------------ UBSAN: invalid-load in ./include/linux/kexec.h:210:10 load of value 252 is not a valid value for type '_Bool' Zero-initializing kexec_buf at declaration ensures all fields are cleanly set, preventing future instances of uninitialized memory being used. Link: https://lkml.kernel.org/r/20250827-kbuf_all-v1-0-1df9882bb01a@debian.org Link: https://lkml.kernel.org/r/20250827-kbuf_all-v1-1-1df9882bb01a@debian.org Link: https://lore.kernel.org/all/20250826180742.f2471131255ec1c43683ea07@linux-foundation.org/ [0] Link: https://lore.kernel.org/all/oninomspajhxp4omtdapxnckxydbk2nzmrix7rggmpukpnzadw@c67o7njgdgm3/ [1] Link: https://lore.kernel.org/all/20250826-akpm-v1-1-3c831f0e3799@debian.org/ [2] Fixes: bf454ec31add ("kexec_file: allow to place kexec_buf randomly") Signed-off-by: Breno Leitao Acked-by: Baoquan He Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Coiby Xu Cc: Heiko Carstens Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Will Deacon Cc: Signed-off-by: Andrew Morton commit e6b543ca9806d7bced863f43020e016ee996c057 Author: Quanmin Yan Date: Wed Aug 27 19:58:58 2025 +0800 mm/damon/reclaim: avoid divide-by-zero in damon_reclaim_apply_parameters() When creating a new scheme of DAMON_RECLAIM, the calculation of 'min_age_region' uses 'aggr_interval' as the divisor, which may lead to division-by-zero errors. Fix it by directly returning -EINVAL when such a case occurs. Link: https://lkml.kernel.org/r/20250827115858.1186261-3-yanquanmin1@huawei.com Fixes: f5a79d7c0c87 ("mm/damon: introduce struct damos_access_pattern") Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: Kefeng Wang Cc: ze zuo Cc: [6.1+] Signed-off-by: Andrew Morton commit 711f19dfd783ffb37ca4324388b9c4cb87e71363 Author: Quanmin Yan Date: Wed Aug 27 19:58:57 2025 +0800 mm/damon/lru_sort: avoid divide-by-zero in damon_lru_sort_apply_parameters() Patch series "mm/damon: avoid divide-by-zero in DAMON module's parameters application". DAMON's RECLAIM and LRU_SORT modules perform no validation on user-configured parameters during application, which may lead to division-by-zero errors. Avoid the divide-by-zero by adding validation checks when DAMON modules attempt to apply the parameters. This patch (of 2): During the calculation of 'hot_thres' and 'cold_thres', either 'sample_interval' or 'aggr_interval' is used as the divisor, which may lead to division-by-zero errors. Fix it by directly returning -EINVAL when such a case occurs. Additionally, since 'aggr_interval' is already required to be set no smaller than 'sample_interval' in damon_set_attrs(), only the case where 'sample_interval' is zero needs to be checked. Link: https://lkml.kernel.org/r/20250827115858.1186261-2-yanquanmin1@huawei.com Fixes: 40e983cca927 ("mm/damon: introduce DAMON-based LRU-lists Sorting") Signed-off-by: Quanmin Yan Reviewed-by: SeongJae Park Cc: Kefeng Wang Cc: ze zuo Cc: [6.0+] Signed-off-by: Andrew Morton commit ce652aac9c90a96c6536681d17518efb1f660fb8 Author: Sang-Heon Jeon Date: Fri Aug 22 11:50:57 2025 +0900 mm/damon/core: set quota->charged_from to jiffies at first charge window Kernel initializes the "jiffies" timer as 5 minutes below zero, as shown in include/linux/jiffies.h /* * Have the 32 bit jiffies value wrap 5 minutes after boot * so jiffies wrap bugs show up earlier. */ #define INITIAL_JIFFIES ((unsigned long)(unsigned int) (-300*HZ)) And jiffies comparison help functions cast unsigned value to signed to cover wraparound #define time_after_eq(a,b) \ (typecheck(unsigned long, a) && \ typecheck(unsigned long, b) && \ ((long)((a) - (b)) >= 0)) When quota->charged_from is initialized to 0, time_after_eq() can incorrectly return FALSE even after reset_interval has elapsed. This occurs when (jiffies - reset_interval) produces a value with MSB=1, which is interpreted as negative in signed arithmetic. This issue primarily affects 32-bit systems because: On 64-bit systems: MSB=1 values occur after ~292 million years from boot (assuming HZ=1000), almost impossible. On 32-bit systems: MSB=1 values occur during the first 5 minutes after boot, and the second half of every jiffies wraparound cycle, starting from day 25 (assuming HZ=1000) When above unexpected FALSE return from time_after_eq() occurs, the charging window will not reset. The user impact depends on esz value at that time. If esz is 0, scheme ignores configured quotas and runs without any limits. If esz is not 0, scheme stops working once the quota is exhausted. It remains until the charging window finally resets. So, change quota->charged_from to jiffies at damos_adjust_quota() when it is considered as the first charge window. By this change, we can avoid unexpected FALSE return from time_after_eq() Link: https://lkml.kernel.org/r/20250822025057.1740854-1-ekffu200098@gmail.com Fixes: 2b8a248d5873 ("mm/damon/schemes: implement size quota for schemes application speed control") # 5.16 Signed-off-by: Sang-Heon Jeon Reviewed-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit 21cc2b5c5062a256ae9064442d37ebbc23f5aef7 Author: Jeongjun Park Date: Sun Aug 24 03:21:15 2025 +0900 mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() When restoring a reservation for an anonymous page, we need to check to freeing a surplus. However, __unmap_hugepage_range() causes data race because it reads h->surplus_huge_pages without the protection of hugetlb_lock. And adjust_reservation is a boolean variable that indicates whether reservations for anonymous pages in each folio should be restored. Therefore, it should be initialized to false for each round of the loop. However, this variable is not initialized to false except when defining the current adjust_reservation variable. This means that once adjust_reservation is set to true even once within the loop, reservations for anonymous pages will be restored unconditionally in all subsequent rounds, regardless of the folio's state. To fix this, we need to add the missing hugetlb_lock, unlock the page_table_lock earlier so that we don't lock the hugetlb_lock inside the page_table_lock lock, and initialize adjust_reservation to false on each round within the loop. Link: https://lkml.kernel.org/r/20250823182115.1193563-1-aha310510@gmail.com Fixes: df7a6d1f6405 ("mm/hugetlb: restore the reservation if needed") Signed-off-by: Jeongjun Park Reported-by: syzbot+417aeb05fd190f3a6da9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=417aeb05fd190f3a6da9 Reviewed-by: Sidhartha Kumar Cc: Breno Leitao Cc: David Hildenbrand Cc: Muchun Song Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit 669602b5b7386e4fa00fc67b045ca3fd816e685d Author: Mike Rapoport (Microsoft) Date: Sun Aug 24 16:07:59 2025 +0300 init/main.c: fix boot time tracing crash Steven Rostedt reported a crash with "ftrace=function" kernel command line: [ 0.159269] BUG: kernel NULL pointer dereference, address: 000000000000001c [ 0.160254] #PF: supervisor read access in kernel mode [ 0.160975] #PF: error_code(0x0000) - not-present page [ 0.161697] PGD 0 P4D 0 [ 0.162055] Oops: Oops: 0000 [#1] SMP PTI [ 0.162619] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.17.0-rc2-test-00006-g48d06e78b7cb-dirty #9 PREEMPT(undef) [ 0.164141] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 0.165439] RIP: 0010:kmem_cache_alloc_noprof (mm/slub.c:4237) [ 0.166186] Code: 90 90 90 f3 0f 1e fa 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41 55 41 54 49 89 fc 53 48 83 e4 f0 48 83 ec 20 8b 05 c9 b6 7e 01 <44> 8b 77 1c 65 4c 8b 2d b5 ea 20 02 4c 89 6c 24 18 41 89 f5 21 f0 [ 0.168811] RSP: 0000:ffffffffb2e03b30 EFLAGS: 00010086 [ 0.169545] RAX: 0000000001fff33f RBX: 0000000000000000 RCX: 0000000000000000 [ 0.170544] RDX: 0000000000002800 RSI: 0000000000002800 RDI: 0000000000000000 [ 0.171554] RBP: ffffffffb2e03b80 R08: 0000000000000004 R09: ffffffffb2e03c90 [ 0.172549] R10: ffffffffb2e03c90 R11: 0000000000000000 R12: 0000000000000000 [ 0.173544] R13: ffffffffb2e03c90 R14: ffffffffb2e03c90 R15: 0000000000000001 [ 0.174542] FS: 0000000000000000(0000) GS:ffff9d2808114000(0000) knlGS:0000000000000000 [ 0.175684] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 0.176486] CR2: 000000000000001c CR3: 000000007264c001 CR4: 00000000000200b0 [ 0.177483] Call Trace: [ 0.177828] [ 0.178123] mas_alloc_nodes (lib/maple_tree.c:176 (discriminator 2) lib/maple_tree.c:1255 (discriminator 2)) [ 0.178692] mas_store_gfp (lib/maple_tree.c:5468) [ 0.179223] execmem_cache_add_locked (mm/execmem.c:207) [ 0.179870] execmem_alloc (mm/execmem.c:213 mm/execmem.c:313 mm/execmem.c:335 mm/execmem.c:475) [ 0.180397] ? ftrace_caller (arch/x86/kernel/ftrace_64.S:169) [ 0.180922] ? __pfx_ftrace_caller (arch/x86/kernel/ftrace_64.S:158) [ 0.181517] execmem_alloc_rw (mm/execmem.c:487) [ 0.182052] arch_ftrace_update_trampoline (arch/x86/kernel/ftrace.c:266 arch/x86/kernel/ftrace.c:344 arch/x86/kernel/ftrace.c:474) [ 0.182778] ? ftrace_caller_op_ptr (arch/x86/kernel/ftrace_64.S:182) [ 0.183388] ftrace_update_trampoline (kernel/trace/ftrace.c:7947) [ 0.184024] __register_ftrace_function (kernel/trace/ftrace.c:368) [ 0.184682] ftrace_startup (kernel/trace/ftrace.c:3048) [ 0.185205] ? __pfx_function_trace_call (kernel/trace/trace_functions.c:210) [ 0.185877] register_ftrace_function_nolock (kernel/trace/ftrace.c:8717) [ 0.186595] register_ftrace_function (kernel/trace/ftrace.c:8745) [ 0.187254] ? __pfx_function_trace_call (kernel/trace/trace_functions.c:210) [ 0.187924] function_trace_init (kernel/trace/trace_functions.c:170) [ 0.188499] tracing_set_tracer (kernel/trace/trace.c:5916 kernel/trace/trace.c:6349) [ 0.189088] register_tracer (kernel/trace/trace.c:2391) [ 0.189642] early_trace_init (kernel/trace/trace.c:11075 kernel/trace/trace.c:11149) [ 0.190204] start_kernel (init/main.c:970) [ 0.190732] x86_64_start_reservations (arch/x86/kernel/head64.c:307) [ 0.191381] x86_64_start_kernel (??:?) [ 0.191955] common_startup_64 (arch/x86/kernel/head_64.S:419) [ 0.192534] [ 0.192839] Modules linked in: [ 0.193267] CR2: 000000000000001c [ 0.193730] ---[ end trace 0000000000000000 ]--- The crash happens because on x86 ftrace allocations from execmem require maple tree to be initialized. Move maple tree initialization that depends only on slab availability earlier in boot so that it will happen right after mm_core_init(). Link: https://lkml.kernel.org/r/20250824130759.1732736-1-rppt@kernel.org Fixes: 5d79c2be5081 ("x86/ftrace: enable EXECMEM_ROX_CACHE for ftrace allocations") Signed-off-by: Mike Rapoport (Microsoft) Reported-by: Steven Rostedt (Google) Tested-by: Steven Rostedt (Google) Closes: https://lore.kernel.org/all/20250820184743.0302a8b5@gandalf.local.home/ Reviewed-by: Masami Hiramatsu (Google) Reviewed-by: Liam R. Howlett Cc: Borislav Betkov Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 397f6d14f9c370e4910e6885294c340f39dedbf5 Author: Jinjiang Tu Date: Fri Jun 27 20:57:47 2025 +0800 mm/memory_hotplug: fix hwpoisoned large folio handling in do_migrate_range() In do_migrate_range(), the hwpoisoned folio may be large folio, which can't be handled by unmap_poisoned_folio(). I can reproduce this issue in qemu after adding delay in memory_failure() BUG: kernel NULL pointer dereference, address: 0000000000000000 Workqueue: kacpi_hotplug acpi_hotplug_work_fn RIP: 0010:try_to_unmap_one+0x16a/0xfc0 rmap_walk_anon+0xda/0x1f0 try_to_unmap+0x78/0x80 ? __pfx_try_to_unmap_one+0x10/0x10 ? __pfx_folio_not_mapped+0x10/0x10 ? __pfx_folio_lock_anon_vma_read+0x10/0x10 unmap_poisoned_folio+0x60/0x140 do_migrate_range+0x4d1/0x600 ? slab_memory_callback+0x6a/0x190 ? notifier_call_chain+0x56/0xb0 offline_pages+0x3e6/0x460 memory_subsys_offline+0x130/0x1f0 device_offline+0xba/0x110 acpi_bus_offline+0xb7/0x130 acpi_scan_hot_remove+0x77/0x290 acpi_device_hotplug+0x1e0/0x240 acpi_hotplug_work_fn+0x1a/0x30 process_one_work+0x186/0x340 Besides, do_migrate_range() may be called between memory_failure set hwpoison flag and isolate the folio from lru, so remove WARN_ON(). In other places, unmap_poisoned_folio() is called when the folio is isolated, obey it in do_migrate_range() too. [david@redhat.com: don't abort offlining, fixed typo, add comment] Link: https://lkml.kernel.org/r/3c214dff-9649-4015-840f-10de0e03ebe4@redhat.com Fixes: b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined") Signed-off-by: Jinjiang Tu Signed-off-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Miaohe Lin Cc: Kefeng Wang Cc: Luis Chamberalin Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Oscar Salvador Cc: Pankaj Raghav Signed-off-by: Andrew Morton commit 394bfac1c7f7b701c2c93834c5761b9c9ceeebcf Author: Wei Yang Date: Fri Aug 22 06:33:18 2025 +0000 mm/khugepaged: fix the address passed to notifier on testing young Commit 8ee53820edfd ("thp: mmu_notifier_test_young") introduced mmu_notifier_test_young(), but we are passing the wrong address. In xxx_scan_pmd(), the actual iteration address is "_address" not "address". We seem to misuse the variable on the very beginning. Change it to the right one. [akpm@linux-foundation.org fix whitespace, per everyone] Link: https://lkml.kernel.org/r/20250822063318.11644-1-richard.weiyang@gmail.com Fixes: 8ee53820edfd ("thp: mmu_notifier_test_young") Signed-off-by: Wei Yang Reviewed-by: Dev Jain Reviewed-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Liam R. Howlett Cc: Nico Pache Cc: Ryan Roberts Cc: Barry Song Cc: Signed-off-by: Andrew Morton commit 8156210d36a43e76372312c87eb5ea3dbb405a85 Author: Eric Dumazet Date: Tue Sep 2 12:46:42 2025 +0000 ax25: properly unshare skbs in ax25_kiss_rcv() Bernard Pidoux reported a regression apparently caused by commit c353e8983e0d ("net: introduce per netns packet chains"). skb->dev becomes NULL and we crash in __netif_receive_skb_core(). Before above commit, different kind of bugs or corruptions could happen without a major crash. But the root cause is that ax25_kiss_rcv() can queue/mangle input skb without checking if this skb is shared or not. Many thanks to Bernard Pidoux for his help, diagnosis and tests. We had a similar issue years ago fixed with commit 7aaed57c5c28 ("phonet: properly unshare skbs in phonet_rcv()"). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Bernard Pidoux Closes: https://lore.kernel.org/netdev/1713f383-c538-4918-bc64-13b3288cd542@free.fr/ Tested-by: Bernard Pidoux Signed-off-by: Eric Dumazet Cc: Joerg Reuter Cc: David Ranch Cc: Folkert van Heusden Reviewed-by: Dan Cross Link: https://patch.msgid.link/20250902124642.212705-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a125c8fb9ddbcb0602103a50727a476fd30dec01 Author: Alok Tiwari Date: Tue Sep 2 03:20:55 2025 -0700 mctp: return -ENOPROTOOPT for unknown getsockopt options In mctp_getsockopt(), unrecognized options currently return -EINVAL. In contrast, mctp_setsockopt() returns -ENOPROTOOPT for unknown options. Update mctp_getsockopt() to also return -ENOPROTOOPT for unknown options. This aligns the behavior of getsockopt() and setsockopt(), and matches the standard kernel socket API convention for handling unsupported options. Fixes: 99ce45d5e7db ("mctp: Implement extended addressing") Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250902102059.1370008-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit cc282f73bc0cbdf3ee7af2f2d3a2ef4e6b19242d Author: Mahanta Jambigi Date: Tue Sep 2 10:20:41 2025 +0200 net/smc: Remove validation of reserved bits in CLC Decline message Currently SMC code is validating the reserved bits while parsing the incoming CLC decline message & when this validation fails, its treated as a protocol error. As a result, the SMC connection is terminated instead of falling back to TCP. As per RFC7609[1] specs we shouldn't be validating the reserved bits that is part of CLC message. This patch fixes this issue. CLC Decline message format can viewed here[2]. [1] https://datatracker.ietf.org/doc/html/rfc7609#page-92 [2] https://datatracker.ietf.org/doc/html/rfc7609#page-105 Fixes: 8ade200c269f ("net/smc: add v2 format of CLC decline message") Signed-off-by: Mahanta Jambigi Reviewed-by: Sidraya Jayagond Reviewed-by: Alexandra Winter Reviewed-by: Dust Li Link: https://patch.msgid.link/20250902082041.98996-1-mjambigi@linux.ibm.com Signed-off-by: Jakub Kicinski commit a51160f8da850a65afbf165f5bbac7ffb388bf74 Author: Dan Carpenter Date: Tue Sep 2 09:36:08 2025 +0300 ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() The inetdev_init() function never returns NULL. Check for error pointers instead. Fixes: 22600596b675 ("ipv4: give an IPv4 dev to blackhole_netdev") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/aLaQWL9NguWmeM1i@stanley.mountain Signed-off-by: Jakub Kicinski commit 9e3d71a92e561ccc77025689dab25d201fee7a3e Author: Rosen Penev Date: Mon Sep 1 14:33:14 2025 -0700 net: thunder_bgx: decrement cleanup index before use All paths in probe that call goto defer do so before assigning phydev and thus it makes sense to cleanup the prior index. It also fixes a bug where index 0 does not get cleaned up. Fixes: b7d3e3d3d21a ("net: thunderx: Don't leak phy device references on -EPROBE_DEFER condition.") Signed-off-by: Rosen Penev Reviewed-by: Vadim Fedorenko Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250901213314.48599-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski commit 9d28f94912589f04ab51fbccaef287d4f40e0d1f Author: Rosen Penev Date: Mon Sep 1 14:30:18 2025 -0700 net: thunder_bgx: add a missing of_node_put phy_np needs to get freed, just like the other child nodes. Fixes: 5fc7cf179449 ("net: thunderx: Cleanup PHY probing code.") Signed-off-by: Rosen Penev Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250901213018.47392-1-rosenp@gmail.com Signed-off-by: Jakub Kicinski commit 3bc32fd9db47a20f38b0783364fdb2f2f1c97220 Author: Russell King (Oracle) Date: Mon Sep 1 12:52:56 2025 +0100 net: phylink: move PHY interrupt request to non-fail path The blamed commit added code which could return an error after we requested the PHY interrupt. When we return an error, the caller will call phy_detach() which fails to free the interrupt. Rearrange the code such that failing operations happen before the interrupt is requested, thereby allowing phy_detach() to be used. Note that replacing phy_detach() with phy_disconnect() in these paths could lead to freeing an interrupt which was never requested. Fixes: 1942b1c6f687 ("net: phylink: make configuring clock-stop dependent on MAC support") Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1ut35k-00000001UEl-0iq6@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1de95db1242632e121a07f8034273782a5a39656 Merge: 5d6b58c932ec45 90fb7db49c6dba Author: Jakub Kicinski Date: Wed Sep 3 16:31:59 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-09-02 (ice, idpf, i40e, ixgbe, e1000e) For ice: Jake adds checks for initialization of Tx timestamp tracking structure to prevent NULL pointer dereferences. For idpf: Josh moves freeing of auxiliary device id to prevent use-after-free issue. Emil sets, expected, MAC type value when sending virtchnl add/delete MAC commands. For i40e: Jake removes read debugfs access as 'netdev_ops' has the possibility to overflow. Zhen Ni adds handling for when MAC list is empty. For ixgbe: Alok Tiwari corrects bitmap being used for link speeds. For e1000e: Vitaly adds check to ensure overflow does not occur in e1000_set_eeprom(). * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: e1000e: fix heap overflow in e1000_set_eeprom ixgbe: fix incorrect map used in eee linkmode i40e: Fix potential invalid access when MAC list is empty i40e: remove read access to debugfs files idpf: set mac type when adding and removing MAC filters idpf: fix UAF in RDMA core aux dev deinitialization ice: fix NULL access of tx->in_use in ice_ll_ts_intr ice: fix NULL access of tx->in_use in ice_ptp_ts_irq ==================== Link: https://patch.msgid.link/20250902232131.2739555-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 5d6b58c932ec451a5c41482790eb5b1ecf165a94 Author: Eric Dumazet Date: Tue Sep 2 18:36:03 2025 +0000 net: lockless sock_i_ino() Followup of commit c51da3f7a161 ("net: remove sock_i_uid()") A recent syzbot report was the trigger for this change. Over the years, we had many problems caused by the read_lock[_bh](&sk->sk_callback_lock) in sock_i_uid(). We could fix smc_diag_dump_proto() or make a more radical move: Instead of waiting for new syzbot reports, cache the socket inode number in sk->sk_ino, so that we no longer need to acquire sk->sk_callback_lock in sock_i_ino(). This makes socket dumps faster (one less cache line miss, and two atomic ops avoided). Prior art: commit 25a9c8a4431c ("netlink: Add __sock_i_ino() for __netlink_diag_dump().") commit 4f9bf2a2f5aa ("tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH.") commit efc3dbc37412 ("rds: Make rds_sock_lock BH rather than IRQ safe.") Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.") Reported-by: syzbot+50603c05bbdf4dfdaffa@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68b73804.050a0220.3db4df.01d8.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20250902183603.740428-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit ede965fd555ac2536cf651893a998dbfd8e57b86 Author: Jonas Jelonek Date: Sun Aug 31 10:04:48 2025 +0000 i2c: rtl9300: remove broken SMBus Quick operation support Remove the SMBus Quick operation from this driver because it is not natively supported by the hardware and is wrongly implemented in the driver. The I2C controllers in Realtek RTL9300 and RTL9310 are SMBus-compliant but there doesn't seem to be native support for the SMBus Quick operation. It is not explicitly mentioned in the documentation but looking at the registers which configure an SMBus transaction, one can see that the data length cannot be set to 0. This suggests that the hardware doesn't allow any SMBus message without data bytes (except for those it does on it's own, see SMBus Block Read). The current implementation of SMBus Quick operation passes a length of 0 (which is actually invalid). Before the fix of a bug in a previous commit, this led to a read operation of 16 bytes from any register (the one of a former transaction or any other value. This caused issues like soft-bricked SFP modules after a simple probe with i2cdetect which uses Quick by default. Running this with SFP modules whose EEPROM isn't write-protected, some of the initial bytes are overwritten because a 16-byte write operation is executed instead of a Quick Write. (This temporarily soft-bricked one of my DAC cables.) Because SMBus Quick operation is obviously not supported on these controllers (because a length of 0 cannot be set, even when no register address is set), remove that instead of claiming there is support. There also shouldn't be any kind of emulated 'Quick' which just does another kind of operation in the background. Otherwise, specific issues occur in case of a 'Quick' Write which actually writes unknown data to an unknown register. Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250831100457.3114-4-jelonek.jonas@gmail.com commit 06418cb5a1a542a003fdb4ad8e76ea542d57cfba Author: Jonas Jelonek Date: Sun Aug 31 10:04:47 2025 +0000 i2c: rtl9300: ensure data length is within supported range Add an explicit check for the xfer length to 'rtl9300_i2c_config_xfer' to ensure the data length isn't within the supported range. In particular a data length of 0 is not supported by the hardware and causes unintended or destructive behaviour. This limitation becomes obvious when looking at the register documentation [1]. 4 bits are reserved for DATA_WIDTH and the value of these 4 bits is used as N + 1, allowing a data length range of 1 <= len <= 16. Affected by this is the SMBus Quick Operation which works with a data length of 0. Passing 0 as the length causes an underflow of the value due to: (len - 1) & 0xf and effectively specifying a transfer length of 16 via the registers. This causes a 16-byte write operation instead of a Quick Write. For example, on SFP modules without write-protected EEPROM this soft-bricks them by overwriting some initial bytes. For completeness, also add a quirk for the zero length. [1] https://svanheule.net/realtek/longan/register/i2c_mst1_ctrl2 Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250831100457.3114-3-jelonek.jonas@gmail.com commit cd6c956fbc13156bcbcca084b46a8380caebc2a8 Author: Jonas Jelonek Date: Sun Aug 31 10:04:46 2025 +0000 i2c: rtl9300: fix channel number bound check Fix the current check for number of channels (child nodes in the device tree). Before, this was: if (device_get_child_node_count(dev) >= RTL9300_I2C_MUX_NCHAN) RTL9300_I2C_MUX_NCHAN gives the maximum number of channels so checking with '>=' isn't correct because it doesn't allow the last channel number. Thus, fix it to: if (device_get_child_node_count(dev) > RTL9300_I2C_MUX_NCHAN) Issue occured on a TP-Link TL-ST1008F v2.0 device (8 SFP+ ports) and fix is tested there. Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Jonas Jelonek Tested-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham # On RTL9302C based board Tested-by: Markus Stockhausen Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250831100457.3114-2-jelonek.jonas@gmail.com commit b4ada0618eed0fbd1b1630f73deb048c592b06a1 Author: Asbjørn Sloth Tønnesen Date: Tue Sep 2 15:59:59 2025 +0000 tools: ynl-gen: fix nested array counting The blamed commit introduced the concept of split attribute counting, and later allocating an array to hold them, however TypeArrayNest wasn't updated to use the new counting variable. Abbreviated example from tools/net/ynl/generated/nl80211-user.c: nl80211_if_combination_attributes_parse(...): unsigned int n_limits = 0; [...] ynl_attr_for_each(attr, nlh, yarg->ys->family->hdr_len) if (type == NL80211_IFACE_COMB_LIMITS) ynl_attr_for_each_nested(attr2, attr) dst->_count.limits++; if (n_limits) { dst->_count.limits = n_limits; /* allocate and parse attributes */ } In the above example n_limits is guaranteed to always be 0, hence the conditional is unsatisfiable and is optimized out. This patch changes the attribute counting to use n_limits++ in the attribute counting loop in the above example. Fixes: 58da455b31ba ("tools: ynl-gen: improve unwind on parsing errors") Signed-off-by: Asbjørn Sloth Tønnesen Link: https://patch.msgid.link/20250902160001.760953-1-ast@fiberby.net Signed-off-by: Jakub Kicinski commit c5142df58d5a19a0615414037f256cd5ca39f7c5 Merge: f63e7c8a838927 27893dd6341b92 Author: Jakub Kicinski Date: Wed Sep 3 14:56:14 2025 -0700 Merge tag 'wireless-2025-09-03' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Just a few updates: - a set of buffer overflow fixes - ath11k: a fix for GTK rekeying - ath12k: a missed WiFi7 capability * tag 'wireless-2025-09-03' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: wifi: wilc1000: avoid buffer overflow in WID string configuration wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() wifi: libertas: cap SSID len in lbs_associate() wifi: cw1200: cap SSID length in cw1200_do_join() wifi: ath11k: fix group data packet drops during rekey wifi: ath12k: Set EMLSR support flag in MLO flags for EML-capable stations ==================== Link: https://patch.msgid.link/20250903075602.30263-4-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit b9a10f876409bf3768178f4aded199e193ddbe33 Merge: ec299e4dc21e8c 875691ceb8bd61 Author: Linus Torvalds Date: Wed Sep 3 14:44:34 2025 -0700 Merge tag 'soc-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "These are mainly devicetree fixes for the rockchip and nxp platforms on arm64, addressing mistakes in the board and soc specific descriptions. In particular the newly added Rock 5T board required multiple bugfixes for PCIe and USB, while on the i.MX platform there are a number of regulator related fixes. The only other platforms with devicetree fixes are at91 with a fixup for SD/MMC and a change to enable all the available UARTS on the Axiado reference board. Also on the at91 platform, a Kconfig change addresses a regression that stopped the DMA engine from working in 6.17-rc. Three drivers each have a simple bugfix, stopping incorrect behavior in op-tee firmware, the tee subsystem and the qualcomm mdt_loader. Two trivial MAINTAINERS file changes are needed to make sure that patches reach the correct maintainer, but don't change the actual responsibilities" * tag 'soc-fixes-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (27 commits) ARM: dts: microchip: sama7d65: Force SDMMC Legacy mode ARM: at91: select ARCH_MICROCHIP arm64: dts: rockchip: fix second M.2 slot on ROCK 5T arm64: dts: rockchip: fix USB on RADXA ROCK 5T MAINTAINERS: exclude defconfig from ARM64 PORT arm64: dts: axiado: Add missing UART aliases MAINTAINERS: Update Nobuhiro Iwamatsu's email address arm64: dts: rockchip: Add vcc-supply to SPI flash on Pinephone Pro arm64: dts: rockchip: fix es8388 address on rk3588s-roc-pc arm64: dts: rockchip: Fix Bluetooth interrupts flag on Neardi LBA3368 arm64: dts: rockchip: correct network description on Sige5 arm64: dts: rockchip: Minor whitespace cleanup ARM: dts: rockchip: Minor whitespace cleanup arm64: dts: rockchip: Add supplies for eMMC on rk3588-orangepi-5 arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 plus arm64: dts: imx95: Fix JPEG encoder node assigned clock arm64: dts: imx95-19x19-evk: correct the phy setting for flexcan1/2 arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM arm64: dts: imx8mp-tqma8mpql: remove virtual 3.3V regulator ... commit d5067034725b1a0b2c785cea9cfce68776a94042 Author: Philipp Stanner Date: Mon Sep 1 10:31:08 2025 +0200 Revert "drm/nouveau: Remove waitque for sched teardown" This reverts: commit bead88002227 ("drm/nouveau: Remove waitque for sched teardown") commit 5f46f5c7af8c ("drm/nouveau: Add new callback for scheduler teardown") from the drm/sched teardown leak fix series: https://lore.kernel.org/dri-devel/20250710125412.128476-2-phasta@kernel.org/ The aforementioned series removed a blocking waitqueue from nouveau_sched_fini(). It was mistakenly assumed that this waitqueue only prevents jobs from leaking, which the series fixed. The waitqueue, however, also guarantees that all VM_BIND related jobs are finished in order, cleaning up mappings in the GPU's MMU. These jobs must be executed sequentially. Without the waitqueue, this is no longer guaranteed, because entity and scheduler teardown can race with each other. Revert all patches related to the waitqueue removal. Fixes: bead88002227 ("drm/nouveau: Remove waitque for sched teardown") Suggested-by: Danilo Krummrich Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250901083107.10206-2-phasta@kernel.org Signed-off-by: Danilo Krummrich commit 875691ceb8bd619de7791243b1cf6184ab534865 Merge: f2e8f1f5f5c810 217efb440933bf Author: Arnd Bergmann Date: Wed Sep 3 23:02:49 2025 +0200 Merge tag 'at91-fixes-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes Microchip AT91 fixes for v6.17 This update includes: - adaptation to the SDHCI capabilities on sama7d65 curiosity board DT as SDHCI quirks are not in place yet. SD/MMC don't work without these - addition of one Kconfig symbol that is already used in DMA tree for 6.17. XDMA cannot be selected if not present. * tag 'at91-fixes-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: dts: microchip: sama7d65: Force SDMMC Legacy mode ARM: at91: select ARCH_MICROCHIP Link: https://lore.kernel.org/r/20250903173403.113604-1-nicolas.ferre@microchip.com Signed-off-by: Arnd Bergmann commit 4540f1d23e7f387880ce46d11b5cd3f27248bf8d Author: Stanislav Fort Date: Tue Sep 2 14:00:49 2025 +0300 audit: fix out-of-bounds read in audit_compare_dname_path() When a watch on dir=/ is combined with an fsnotify event for a single-character name directly under / (e.g., creating /a), an out-of-bounds read can occur in audit_compare_dname_path(). The helper parent_len() returns 1 for "/". In audit_compare_dname_path(), when parentlen equals the full path length (1), the code sets p = path + 1 and pathlen = 1 - 1 = 0. The subsequent loop then dereferences p[pathlen - 1] (i.e., p[-1]), causing an out-of-bounds read. Fix this by adding a pathlen > 0 check to the while loop condition to prevent the out-of-bounds access. Cc: stable@vger.kernel.org Fixes: e92eebb0d611 ("audit: fix suffixed '/' filename matching") Reported-by: Stanislav Fort Suggested-by: Linus Torvalds Signed-off-by: Stanislav Fort [PM: subject tweak, sign-off email fixes] Signed-off-by: Paul Moore commit 467e00b30dfe75c4cfc2197ceef1fddca06adc25 Author: Colin Ian King Date: Tue Sep 2 13:40:50 2025 +0100 drm/amd/amdgpu: Fix missing error return on kzalloc failure Currently the kzalloc failure check just sets reports the failure and sets the variable ret to -ENOMEM, which is not checked later for this specific error. Fix this by just returning -ENOMEM rather than setting ret. Fixes: 4fb930715468 ("drm/amd/amdgpu: remove redundant host to psp cmd buf allocations") Signed-off-by: Colin Ian King Signed-off-by: Alex Deucher (cherry picked from commit 1ee9d1a0962c13ba5ab7e47d33a80e3b8dc4b52e) commit ec299e4dc21e8cc476c2c848813919db79492dda Merge: e6b9dce0aeeb91 5ebf512f335053 Author: Linus Torvalds Date: Wed Sep 3 11:10:36 2025 -0700 Merge tag 'bitmap-for-6.17-rc5' of https://github.com/norov/linux Pull bitmap fix from Yury Norov: "Fix sched_numa_find_nth_cpu() if mask offline sched_numa_find_nth_cpu() uses a bsearch to look for the 'closest' CPU in sched_domains_numa_masks and given cpus mask. However they might not intersect if all CPUs in the cpus mask are offline. bsearch will return NULL in that case, bail out instead of dereferencing a bogus pointer" * tag 'bitmap-for-6.17-rc5' of https://github.com/norov/linux: sched: Fix sched_numa_find_nth_cpu() if mask offline commit 666d2206f1ee8a4f21ffbec438381a524a62815b Author: James Clark Date: Wed Sep 3 16:15:26 2025 +0100 perf tests: Fix "PE file support" test build filename__read_build_id() now takes a blocking/non-blocking argument. The original behavior of filename__read_build_id() was blocking so add block=true to fix the build. Fixes: 2c369d91d093 ("perf symbol: Add blocking argument to filename__read_build_id") Signed-off-by: James Clark Reviewed-by: Ian Rogers Reviewed-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250903-james-perf-read-build-id-fix-v1-1-6a694d0a980f@linaro.org Signed-off-by: Namhyung Kim commit 3254959b4dd065eae396cf78ccc1361460b2f53e Author: Syed Saba Kareem Date: Wed Sep 3 22:47:47 2025 +0530 ASoC: amd: amd_sdw: Add quirks for some new Dell laptops Add a quirk to include the codec amplifier function for Dell SKU's listed in quirk table. Note: In these SKU's, the RT722 codec amplifier is excluded, and an external amplifier is used instead. Signed-off-by: Syed Saba Kareem Message-ID: <20250903171817.2549507-1-syed.sabakareem@amd.com> Signed-off-by: Mark Brown commit 217efb440933bf97a78ef328b211d8a39f4ff171 Author: Ryan Wanner Date: Tue Aug 19 10:05:24 2025 -0700 ARM: dts: microchip: sama7d65: Force SDMMC Legacy mode The SDMMC in this IP currently only supports legacy mode due to a hardware quirk, setting the flags to reflect the limitation. Fixes: deaa14ab6b06 ("ARM: dts: microchip: add support for sama7d65_curiosity board") Signed-off-by: Ryan Wanner Acked-by: Nicolas Ferre Link: https://lore.kernel.org/r/20250819170528.126010-1-Ryan.Wanner@microchip.com Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre commit d302effafae5a6a632bf581ced97ef91c95a2ac6 Author: Robert Marko Date: Wed Aug 13 19:44:38 2025 +0200 ARM: at91: select ARCH_MICROCHIP Like with the ARM64 Microchip platforms, lets add a generic ARCH_MICROCHIP symbol and select it so that drivers that are reused for multiple product generation or lines, can just depend on it instead of adding each SoC symbol as their dependencies. Signed-off-by: Robert Marko Acked-by: Nicolas Ferre Acked-by: Daniel Machon Link: https://lore.kernel.org/r/20250813174720.540015-3-robert.marko@sartura.hr Signed-off-by: Claudiu Beznea Signed-off-by: Nicolas Ferre commit 5ebf512f335053a42482ebff91e46c6dc156bf8c Author: Christian Loehle Date: Wed Sep 3 16:48:32 2025 +0100 sched: Fix sched_numa_find_nth_cpu() if mask offline sched_numa_find_nth_cpu() uses a bsearch to look for the 'closest' CPU in sched_domains_numa_masks and given cpus mask. However they might not intersect if all CPUs in the cpus mask are offline. bsearch will return NULL in that case, bail out instead of dereferencing a bogus pointer. The previous behaviour lead to this bug when using maxcpus=4 on an rk3399 (LLLLbb) (i.e. booting with all big CPUs offline): [ 1.422922] Unable to handle kernel paging request at virtual address ffffff8000000000 [ 1.423635] Mem abort info: [ 1.423889] ESR = 0x0000000096000006 [ 1.424227] EC = 0x25: DABT (current EL), IL = 32 bits [ 1.424715] SET = 0, FnV = 0 [ 1.424995] EA = 0, S1PTW = 0 [ 1.425279] FSC = 0x06: level 2 translation fault [ 1.425735] Data abort info: [ 1.425998] ISV = 0, ISS = 0x00000006, ISS2 = 0x00000000 [ 1.426499] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 1.426952] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 1.427428] swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000004a9f000 [ 1.428038] [ffffff8000000000] pgd=18000000f7fff403, p4d=18000000f7fff403, pud=18000000f7fff403, pmd=0000000000000000 [ 1.429014] Internal error: Oops: 0000000096000006 [#1] SMP [ 1.429525] Modules linked in: [ 1.429813] CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc4-dirty #343 PREEMPT [ 1.430559] Hardware name: Pine64 RockPro64 v2.1 (DT) [ 1.431012] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 1.431634] pc : sched_numa_find_nth_cpu+0x2a0/0x488 [ 1.432094] lr : sched_numa_find_nth_cpu+0x284/0x488 [ 1.432543] sp : ffffffc084e1b960 [ 1.432843] x29: ffffffc084e1b960 x28: ffffff80078a8800 x27: ffffffc0846eb1d0 [ 1.433495] x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000 [ 1.434144] x23: 0000000000000000 x22: fffffffffff7f093 x21: ffffffc081de6378 [ 1.434792] x20: 0000000000000000 x19: 0000000ffff7f093 x18: 00000000ffffffff [ 1.435441] x17: 3030303866666666 x16: 66663d736b73616d x15: ffffffc104e1b5b7 [ 1.436091] x14: 0000000000000000 x13: ffffffc084712860 x12: 0000000000000372 [ 1.436739] x11: 0000000000000126 x10: ffffffc08476a860 x9 : ffffffc084712860 [ 1.437389] x8 : 00000000ffffefff x7 : ffffffc08476a860 x6 : 0000000000000000 [ 1.438036] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000 [ 1.438683] x2 : 0000000000000000 x1 : ffffffc0846eb000 x0 : ffffff8000407b68 [ 1.439332] Call trace: [ 1.439559] sched_numa_find_nth_cpu+0x2a0/0x488 (P) [ 1.440016] smp_call_function_any+0xc8/0xd0 [ 1.440416] armv8_pmu_init+0x58/0x27c [ 1.440770] armv8_cortex_a72_pmu_init+0x20/0x2c [ 1.441199] arm_pmu_device_probe+0x1e4/0x5e8 [ 1.441603] armv8_pmu_device_probe+0x1c/0x28 [ 1.442007] platform_probe+0x5c/0xac [ 1.442347] really_probe+0xbc/0x298 [ 1.442683] __driver_probe_device+0x78/0x12c [ 1.443087] driver_probe_device+0xdc/0x160 [ 1.443475] __driver_attach+0x94/0x19c [ 1.443833] bus_for_each_dev+0x74/0xd4 [ 1.444190] driver_attach+0x24/0x30 [ 1.444525] bus_add_driver+0xe4/0x208 [ 1.444874] driver_register+0x60/0x128 [ 1.445233] __platform_driver_register+0x24/0x30 [ 1.445662] armv8_pmu_driver_init+0x28/0x4c [ 1.446059] do_one_initcall+0x44/0x25c [ 1.446416] kernel_init_freeable+0x1dc/0x3bc [ 1.446820] kernel_init+0x20/0x1d8 [ 1.447151] ret_from_fork+0x10/0x20 [ 1.447493] Code: 90022e21 f000e5f5 910de2b5 2a1703e2 (f8767803) [ 1.448040] ---[ end trace 0000000000000000 ]--- [ 1.448483] note: swapper/0[1] exited with preempt_count 1 [ 1.449047] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b [ 1.449741] SMP: stopping secondary CPUs [ 1.450105] Kernel Offset: disabled [ 1.450419] CPU features: 0x000000,00080000,20002001,0400421b [ 1.450935] Memory Limit: none [ 1.451217] ---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b ]--- Yury: with the fix, the function returns cpu == nr_cpu_ids, and later in smp_call_function_any -> smp_call_function_single -> generic_exec_single we test the cpu for '>= nr_cpu_ids' and return -ENXIO. So everything is handled correctly. Fixes: cd7f55359c90 ("sched: add sched_numa_find_nth_cpu()") Cc: stable@vger.kernel.org Signed-off-by: Christian Loehle Signed-off-by: Yury Norov (NVIDIA) commit f2e8f1f5f5c81037fc0b2d78eb75aeb80a0ee507 Merge: 750b54513f69f1 dcc6785caffad2 Author: Arnd Bergmann Date: Wed Sep 3 17:29:35 2025 +0200 Merge tag 'v6.17-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes The newly added Rock 5T board needed slightly bigger fixes to make the PCIe and USB actually work, because the PCIe does share its lanes between two ports and the usb needs to toggle a gpio to supply power. The other interesting fix is the headphone detection on the Orange Pi 5+. The rest are some added supplies to make the boot log less scary and a number of styling fixes. * tag 'v6.17-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: dts: rockchip: fix second M.2 slot on ROCK 5T arm64: dts: rockchip: fix USB on RADXA ROCK 5T arm64: dts: rockchip: Add vcc-supply to SPI flash on Pinephone Pro arm64: dts: rockchip: fix es8388 address on rk3588s-roc-pc arm64: dts: rockchip: Fix Bluetooth interrupts flag on Neardi LBA3368 arm64: dts: rockchip: correct network description on Sige5 arm64: dts: rockchip: Minor whitespace cleanup ARM: dts: rockchip: Minor whitespace cleanup arm64: dts: rockchip: Add supplies for eMMC on rk3588-orangepi-5 arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 plus arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro arm64: dts: rockchip: mark eeprom as read-only for Radxa E52C Link: https://lore.kernel.org/r/5909239.Y6S9NjorxK@phil Signed-off-by: Arnd Bergmann commit ba3319e5905710abe495b11a1aaf03ebb51d62e2 Author: Mario Limonciello (AMD) Date: Tue Aug 26 00:27:47 2025 -0500 cpufreq/amd-pstate: Fix a regression leading to EPP 0 after resume During the suspend sequence the cached CPPC request is destroyed with the expectation that it's restored during resume. This assumption broke when the separate cache EPP variable was removed, and then it was broken again by commit 608a76b65288 ("cpufreq/amd-pstate: Add support for the "Requested CPU Min frequency" BIOS option") which explicitly set it to zero during suspend. Remove the invalidation and set the value during the suspend call to update limits so that the cached variable can be used to restore on resume. Fixes: 608a76b65288 ("cpufreq/amd-pstate: Add support for the "Requested CPU Min frequency" BIOS option") Fixes: b7a41156588a ("cpufreq/amd-pstate: Invalidate cppc_req_cached during suspend") Reported-by: goldens Closes: https://community.frame.work/t/increased-power-usage-after-resuming-from-suspend-on-ryzen-7040-kernel-6-15-regression/ Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2391221 Tested-by: goldens Tested-by: Willian Wang Reported-by: Vincent Mauirn Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219981 Tested-by: Alex De Lorenzo Reviewed-by: Gautham R. Shenoy Link: https://lore.kernel.org/r/20250826052747.2240670-1-superm1@kernel.org Signed-off-by: Mario Limonciello (AMD) commit 1991a458528588ff34e98b6365362560d208710f Author: Gabor Juhos Date: Wed Sep 3 13:56:24 2025 +0200 spi: spi-qpic-snand: unregister ECC engine on probe error and device remove The on-host hardware ECC engine remains registered both when the spi_register_controller() function returns with an error and also on device removal. Change the qcom_spi_probe() function to unregister the engine on the error path, and add the missing unregistering call to qcom_spi_remove() to avoid possible use-after-free issues. Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface") Signed-off-by: Gabor Juhos Message-ID: <20250903-qpic-snand-unregister-ecceng-v1-1-ef5387b0abdc@gmail.com> Signed-off-by: Mark Brown commit 9a6d3ff10f7f538835cae4799562004ee46922c5 Author: Thomas Weißschuh Date: Thu Aug 21 09:56:44 2025 +0200 arm64: uapi: Provide correct __BITS_PER_LONG for the compat vDSO The generic vDSO library uses the UAPI headers. On arm64 __BITS_PER_LONG is always '64' even when used from the compat vDSO. In that case __GENMASK() does an illegal bitshift, invoking undefined behaviour. Change __BITS_PER_LONG to also work when used from the comapt vDSO. To not confuse real userspace, only do this when building the kernel. Reported-by: John Stultz Closes: https://lore.kernel.org/lkml/CANDhNCqvKOc9JgphQwr0eDyJiyG4oLFS9R8rSFvU0fpurrJFDg@mail.gmail.com/ Fixes: cd3557a7618b ("vdso/gettimeofday: Add support for auxiliary clocks") Signed-off-by: Thomas Weißschuh Acked-by: Arnd Bergmann Tested-by: John Stultz Link: https://lore.kernel.org/r/20250821-vdso-arm64-compat-bitsperlong-v1-1-700bcabe7732@linutronix.de Signed-off-by: Catalin Marinas commit ad64c073c9a031850de1542e6e976b0249e7e650 Author: Paul Menzel Date: Wed Sep 3 12:08:41 2025 +0200 ALSA: docs: Remove 3rd person singular s in *to indicate* Fixes: 78811dd56def ("ALSA: docs: Add documents for recently changes in snd-usb-audio") Signed-off-by: Paul Menzel Link: https://patch.msgid.link/20250903100842.267194-1-pmenzel@molgen.mpg.de Signed-off-by: Takashi Iwai commit 762af5a2aa0ad18da1316666dae30d369268d44c Author: Thomas Weißschuh Date: Mon Aug 25 15:26:35 2025 +0200 vdso/vsyscall: Avoid slow division loop in auxiliary clock update The call to __iter_div_u64_rem() in vdso_time_update_aux() is a wrapper around subtraction. It cannot be used to divide large numbers, as that introduces long, computationally expensive delays. A regular u64 division is also not possible in the timekeeper update path as it can be too slow. Instead of splitting the ktime_t offset into into second and subsecond components during the timekeeper update fast-path, do it together with the adjustment of tk->offs_aux in the slow-path. Equivalent to the handling of offs_boot and monotonic_to_boot. Reuse the storage of monotonic_to_boot for the new field, as it is not used by auxiliary timekeepers. Fixes: 380b84e168e5 ("vdso/vsyscall: Update auxiliary clock data in the datapage") Reported-by: Miroslav Lichvar Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250825-vdso-auxclock-division-v1-1-a1d32a16a313@linutronix.de Closes: https://lore.kernel.org/lkml/aKwsNNWsHJg8IKzj@localhost/ commit 18dbcbfabfffc4a5d3ea10290c5ad27f22b0d240 Author: Kan Liang Date: Mon Aug 11 11:26:44 2025 -0700 perf: Fix the POLL_HUP delivery breakage The event_limit can be set by the PERF_EVENT_IOC_REFRESH to limit the number of events. When the event_limit reaches 0, the POLL_HUP signal should be sent. But it's missed. The corresponding counter should be stopped when the event_limit reaches 0. It was implemented in the ARCH-specific code. However, since the commit 9734e25fbf5a ("perf: Fix the throttle logic for a group"), all the ARCH-specific code has been moved to the generic code. The code to handle the event_limit was lost. Add the event->pmu->stop(event, 0); back. Fixes: 9734e25fbf5a ("perf: Fix the throttle logic for a group") Closes: https://lore.kernel.org/lkml/aICYAqM5EQUlTqtX@li-2b55cdcc-350b-11b2-a85c-a78bff51fc11.ibm.com/ Reported-by: Sumanth Korikkar Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Tested-by: Sumanth Korikkar Link: https://lkml.kernel.org/r/20250811182644.1305952-1-kan.liang@linux.intel.com commit 27893dd6341b929f87d45fc4d65c5778179319dd Merge: fe9e4d0c39311d 97acb0259cc9cb Author: Johannes Berg Date: Wed Sep 3 09:40:04 2025 +0200 Merge tag 'ath-current-20250902' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git update for v6.17-rc5 Fix a long-standing issue with ath11k dropping group data packets during GTK rekey, and fix an omission in the ath12k multi-link EMLSR support introduced in v6.16. ================== Signed-off-by: Johannes Berg commit fe9e4d0c39311d0f97b024147a0d155333f388b5 Author: Ajay.Kathat@microchip.com Date: Fri Aug 29 22:58:43 2025 +0000 wifi: wilc1000: avoid buffer overflow in WID string configuration Fix the following copy overflow warning identified by Smatch checker. drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame() error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537) This patch introduces size check before accessing the memory buffer. The checks are base on the WID type of received data from the firmware. For WID string configuration, the size limit is determined by individual element size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field of 'struct wilc_cfg_str'. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-wireless/aLFbr9Yu9j_TQTey@stanley.mountain Suggested-by: Dan Carpenter Signed-off-by: Ajay Singh Link: https://patch.msgid.link/20250829225829.5423-1-ajay.kathat@microchip.com Signed-off-by: Johannes Berg commit 62b635dcd69c4fde7ce1de4992d71420a37e51e3 Author: Dan Carpenter Date: Fri Aug 29 15:48:45 2025 +0300 wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would lead to memory corruption so add some bounds checking. Fixes: c38c70185101 ("wifi: cfg80211: Set SSID if it is not already set") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/0aaaae4a3ed37c6252363c34ae4904b1604e8e32.1756456951.git.dan.carpenter@linaro.org Signed-off-by: Johannes Berg commit c786794bd27b0d7a5fd9063695df83206009be59 Author: Dan Carpenter Date: Fri Aug 29 15:48:35 2025 +0300 wifi: libertas: cap SSID len in lbs_associate() If the ssid_eid[1] length is more that 32 it leads to memory corruption. Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/2a40f5ec7617144aef412034c12919a4927d90ad.1756456951.git.dan.carpenter@linaro.org Signed-off-by: Johannes Berg commit f8f15f6742b8874e59c9c715d0af3474608310ad Author: Dan Carpenter Date: Fri Aug 29 15:48:28 2025 +0300 wifi: cw1200: cap SSID length in cw1200_do_join() If the ssidie[1] length is more that 32 it leads to memory corruption. Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/e91fb43fcedc4893b604dfb973131661510901a7.1756456951.git.dan.carpenter@linaro.org Signed-off-by: Johannes Berg commit cdb03b6d1896c2d23f9c47dc779edba0a9241115 Author: Eric Biggers Date: Mon Sep 1 09:50:13 2025 -0700 crypto: sha512 - Implement export_core() and import_core() Since commit 9d7a0ab1c753 ("crypto: ahash - Handle partial blocks in API"), the recently-added export_core() and import_core() methods in struct shash_alg have effectively become mandatory (even though it is not tested or enforced), since legacy drivers that need a fallback depend on them. Make crypto/sha512.c compatible with these legacy drivers by adding export_core() and import_core() methods to it. Reported-by: Giovanni Cabiddu Reported-by: Ovidiu Panait Closes: https://lore.kernel.org/r/aLSnCc9Ws5L9y+8X@gcabiddu-mobl.ger.corp.intel.com Fixes: 4bc7f7b687a2 ("crypto: sha512 - Use same state format as legacy drivers") Tested-by: Giovanni Cabiddu Tested-by: Ovidiu Panait Link: https://lore.kernel.org/r/20250901165013.48649-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 30b2a8c4f2f3833f4f813d3e0d003f7c50cdf275 Author: Eric Biggers Date: Mon Sep 1 09:50:12 2025 -0700 crypto: sha256 - Implement export_core() and import_core() Since commit 9d7a0ab1c753 ("crypto: ahash - Handle partial blocks in API"), the recently-added export_core() and import_core() methods in struct shash_alg have effectively become mandatory (even though it is not tested or enforced), since legacy drivers that need a fallback depend on them. Make crypto/sha256.c compatible with these legacy drivers by adding export_core() and import_core() methods to it. Reported-by: Giovanni Cabiddu Reported-by: Ovidiu Panait Closes: https://lore.kernel.org/r/aLSnCc9Ws5L9y+8X@gcabiddu-mobl.ger.corp.intel.com Fixes: 07f090959bba ("crypto: sha256 - Use same state format as legacy drivers") Tested-by: Giovanni Cabiddu Tested-by: Ovidiu Panait Link: https://lore.kernel.org/r/20250901165013.48649-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 827733acbe4c3a0e117b6ebde5ed269fb7686427 Author: Eric Biggers Date: Mon Sep 1 09:50:11 2025 -0700 crypto: sha1 - Implement export_core() and import_core() Since commit 9d7a0ab1c753 ("crypto: ahash - Handle partial blocks in API"), the recently-added export_core() and import_core() methods in struct shash_alg have effectively become mandatory (even though it is not tested or enforced), since legacy drivers that need a fallback depend on them. Make crypto/sha1.c compatible with these legacy drivers by adding export_core() and import_core() methods to it. Reported-by: Giovanni Cabiddu Reported-by: Ovidiu Panait Closes: https://lore.kernel.org/r/aLSnCc9Ws5L9y+8X@gcabiddu-mobl.ger.corp.intel.com Fixes: b10a74abcfc5 ("crypto: sha1 - Use same state format as legacy drivers") Tested-by: Giovanni Cabiddu Tested-by: Ovidiu Panait Link: https://lore.kernel.org/r/20250901165013.48649-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 91be128b496c0de60a7dceb70d34935a29d38bbd Author: Bharath SM Date: Tue Sep 2 15:28:57 2025 +0530 smb: client: show negotiated cipher in DebugData Print the negotiated encryption cipher type in DebugData Signed-off-by: Bharath SM Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 72595cb6da1841b355644fe8882d60e725205c32 Author: Bharath SM Date: Tue Sep 2 20:10:25 2025 +0530 smb: client: add new tracepoint to trace lease break notification Add smb3_lease_break_enter to trace lease break notifications, recording lease state, flags, epoch, and lease key. Align smb3_lease_not_found to use the same payload and print format. Signed-off-by: Bharath SM Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 0c3813d855b2006f021f7b5055f231977a58c784 Author: Bharath SM Date: Tue Sep 2 00:02:24 2025 +0530 smb: client: fix spellings in comments correct spellings in comments Signed-off-by: Bharath SM Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit f63e7c8a83892781f6ceb55566f9497639c44555 Author: Miaoqian Lin Date: Mon Sep 1 15:32:23 2025 +0800 net: dsa: mv88e6xxx: Fix fwnode reference leaks in mv88e6xxx_port_setup_leds Fix multiple fwnode reference leaks: 1. The function calls fwnode_get_named_child_node() to get the "leds" node, but never calls fwnode_handle_put(leds) to release this reference. 2. Within the fwnode_for_each_child_node() loop, the early return paths that don't properly release the "led" fwnode reference. This fix follows the same pattern as commit d029edefed39 ("net dsa: qca8k: fix usages of device_get_named_child_node()") Fixes: 94a2a84f5e9e ("net: dsa: mv88e6xxx: Support LED control") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20250901073224.2273103-1-linmq006@gmail.com Signed-off-by: Jakub Kicinski commit 3a5f55500f3e93cf4d62351c753452279b088b4b Author: Yue Haibing Date: Mon Sep 1 20:37:25 2025 +0800 ipv6: annotate data-races around devconf->rpl_seg_enabled devconf->rpl_seg_enabled can be changed concurrently from /proc/sys/net/ipv6/conf, annotate lockless reads on it. Signed-off-by: Yue Haibing Link: https://patch.msgid.link/20250901123726.1972881-2-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 41ec374bdece1f59f2511e8a3046bb6efa1ed48d Merge: a7195a3d67dace 2c9fb925c2ccc6 Author: Jakub Kicinski Date: Tue Sep 2 16:56:07 2025 -0700 Merge branch 'vxlan-fix-npds-when-using-nexthop-objects' Ido Schimmel says: ==================== vxlan: Fix NPDs when using nexthop objects With FDB nexthop groups, VXLAN FDB entries do not necessarily point to a remote destination but rather to an FDB nexthop group. This means that first_remote_{rcu,rtnl}() can return NULL and a few places in the driver were not ready for that, resulting in NULL pointer dereferences. Patches #1-#2 fix these NPDs. Note that vxlan_fdb_find_uc() still dereferences the remote returned by first_remote_rcu() without checking that it is not NULL, but this function is only invoked by a single driver which vetoes the creation of FDB nexthop groups. I will patch this in net-next to make the code less fragile. Patch #3 adds a selftests which exercises these code paths and tests basic Tx functionality with FDB nexthop groups. I verified that the test crashes the kernel without the first two patches. ==================== Link: https://patch.msgid.link/20250901065035.159644-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 2c9fb925c2ccc6ee475134840cff6c6b73851730 Author: Ido Schimmel Date: Mon Sep 1 09:50:35 2025 +0300 selftests: net: Add a selftest for VXLAN with FDB nexthop groups Add test cases for VXLAN with FDB nexthop groups, testing both IPv4 and IPv6. Test basic Tx functionality as well as some corner cases. Example output: # ./test_vxlan_nh.sh TEST: VXLAN FDB nexthop: IPv4 basic Tx [ OK ] TEST: VXLAN FDB nexthop: IPv6 basic Tx [ OK ] TEST: VXLAN FDB nexthop: learning [ OK ] TEST: VXLAN FDB nexthop: IPv4 proxy [ OK ] TEST: VXLAN FDB nexthop: IPv6 proxy [ OK ] Signed-off-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250901065035.159644-4-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 1f5d2fd1ca04a23c18b1bde9a43ce2fa2ffa1bce Author: Ido Schimmel Date: Mon Sep 1 09:50:34 2025 +0300 vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects When the "proxy" option is enabled on a VXLAN device, the device will suppress ARP requests and IPv6 Neighbor Solicitation messages if it is able to reply on behalf of the remote host. That is, if a matching and valid neighbor entry is configured on the VXLAN device whose MAC address is not behind the "any" remote (0.0.0.0 / ::). The code currently assumes that the FDB entry for the neighbor's MAC address points to a valid remote destination, but this is incorrect if the entry is associated with an FDB nexthop group. This can result in a NPD [1][3] which can be reproduced using [2][4]. Fix by checking that the remote destination exists before dereferencing it. [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 4 UID: 0 PID: 365 Comm: arping Not tainted 6.17.0-rc2-virtme-g2a89cb21162c #2 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_xmit+0xb58/0x15f0 [...] Call Trace: dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip nexthop add id 1 via 192.0.2.2 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 4789 proxy ip neigh add 192.0.2.3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 arping -b -c 1 -s 192.0.2.1 -I vx0 192.0.2.3 [3] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 372 Comm: ndisc6 Not tainted 6.17.0-rc2-virtmne-g6ee90cb26014 #3 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1v996), BIOS 1.17.0-4.fc41 04/01/2x014 RIP: 0010:vxlan_xmit+0x803/0x1600 [...] Call Trace: dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 ip6_finish_output2+0x210/0x6c0 ip6_finish_output+0x1af/0x2b0 ip6_mr_output+0x92/0x3e0 ip6_send_skb+0x30/0x90 rawv6_sendmsg+0xe6e/0x12e0 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f383422ec77 [4] #!/bin/bash ip address add 2001:db8:1::1/128 dev lo ip nexthop add id 1 via 2001:db8:1::1 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 2001:db8:1::1 dstport 4789 proxy ip neigh add 2001:db8:1::3 lladdr 00:11:22:33:44:55 nud perm dev vx0 bridge fdb add 00:11:22:33:44:55 dev vx0 self static nhid 10 ndisc6 -r 1 -s 2001:db8:1::1 -w 1 2001:db8:1::3 vx0 Fixes: 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries") Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250901065035.159644-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 6ead38147ebb813f08be6ea8ef547a0e4c09559a Author: Ido Schimmel Date: Mon Sep 1 09:50:33 2025 +0300 vxlan: Fix NPD when refreshing an FDB entry with a nexthop object VXLAN FDB entries can point to either a remote destination or an FDB nexthop group. The latter is usually used in EVPN deployments where learning is disabled. However, when learning is enabled, an incoming packet might try to refresh an FDB entry that points to an FDB nexthop group and therefore does not have a remote. Such packets should be dropped, but they are only dropped after dereferencing the non-existent remote, resulting in a NPD [1] which can be reproduced using [2]. Fix by dropping such packets earlier. Remove the misleading comment from first_remote_rcu(). [1] BUG: kernel NULL pointer dereference, address: 0000000000000000 [...] CPU: 13 UID: 0 PID: 361 Comm: mausezahn Not tainted 6.17.0-rc1-virtme-g9f6b606b6b37 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:vxlan_snoop+0x98/0x1e0 [...] Call Trace: vxlan_encap_bypass+0x209/0x240 encap_bypass_if_local+0xb1/0x100 vxlan_xmit_one+0x1375/0x17e0 vxlan_xmit+0x6b4/0x15f0 dev_hard_start_xmit+0x5d/0x1c0 __dev_queue_xmit+0x246/0xfd0 packet_sendmsg+0x113a/0x1850 __sock_sendmsg+0x38/0x70 __sys_sendto+0x126/0x180 __x64_sys_sendto+0x24/0x30 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] #!/bin/bash ip address add 192.0.2.1/32 dev lo ip address add 192.0.2.2/32 dev lo ip nexthop add id 1 via 192.0.2.3 fdb ip nexthop add id 10 group 1 fdb ip link add name vx0 up type vxlan id 10010 local 192.0.2.1 dstport 12345 localbypass ip link add name vx1 up type vxlan id 10020 local 192.0.2.2 dstport 54321 learning bridge fdb add 00:11:22:33:44:55 dev vx0 self static dst 192.0.2.2 port 54321 vni 10020 bridge fdb add 00:aa:bb:cc:dd:ee dev vx1 self static nhid 10 mausezahn vx0 -a 00:aa:bb:cc:dd:ee -b 00:11:22:33:44:55 -c 1 -q Fixes: 1274e1cc4226 ("vxlan: ecmp support for mac fdb entries") Reported-by: Marlin Cremers Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250901065035.159644-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit a7195a3d67dace056af7ca65144a11874df79562 Author: Lad Prabhakar Date: Mon Sep 1 12:20:19 2025 +0100 net: pcs: rzn1-miic: Correct MODCTRL register offset Correct the Mode Control Register (MODCTRL) offset for RZ/N MIIC. According to the R-IN Engine and Ethernet Peripherals Manual (Rev.1.30) [0], Table 10.1 "Ethernet Accessory Register List", MODCTRL is at offset 0x8, not 0x20 as previously defined. Offset 0x20 actually maps to the Port Trigger Control Register (PTCTRL), which controls PTP_MODE[3:0] and RGMII_CLKSEL[4]. Using this incorrect definition prevented the driver from configuring the SW_MODE[4:0] bits in MODCTRL, which control the internal connection of Ethernet ports. As a result, the MIIC could not be switched into the correct mode, leading to link setup failures and non-functional Ethernet ports on affected systems. [0] https://www.renesas.com/en/document/mah/rzn1d-group-rzn1s-group-rzn1l-group-users-manual-r-engine-and-ethernet-peripherals?r=1054571 Fixes: 7dc54d3b8d91 ("net: pcs: add Renesas MII converter driver") Cc: stable@kernel.org Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Reviewed-by: Russell King (Oracle) Reviewed-by: Geert Uytterhoeven Tested-by: Wolfram Sang Link: https://patch.msgid.link/20250901112019.16278-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Jakub Kicinski commit d4736737110ffa83d29f1c5d17b26113864205f6 Author: Felix Fietkau Date: Sun Aug 31 20:20:07 2025 +0200 net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets When sending llc packets with vlan tx offload, the hardware fails to actually add the tag. Deal with this by fixing it up in software. Fixes: 656e705243fd ("net-next: mediatek: add support for MT7623 ethernet") Reported-by: Thibaut VARENE Signed-off-by: Felix Fietkau Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250831182007.51619-1-nbd@nbd.name Signed-off-by: Jakub Kicinski commit c06ca8ce90bae91744ac93c7e09ebeec6ac3df90 Merge: fa390321aba0a5 a21202743f9ce4 Author: Jakub Kicinski Date: Tue Sep 2 16:23:16 2025 -0700 Merge branch 'net-fix-optical-sfp-failures' Russell King says: ==================== net: fix optical SFP failures A regression was reported back in April concerning pcs-lynx and 10G optical SFPs. This patch series addresses that regression, and likely similar unreported regressions. These patches: - Add phy_interface_weight() which will be used in the solution. - Split out the code that determines the inband "type" for an interface mode. - Clear the Autoneg bit in the advertising mask, or the Autoneg bit in the support mask and the entire advertising mask if the selected interface mode has no inband capabilties. Tested with the mvpp2 patch posted earlier today. ==================== Link: https://patch.msgid.link/aLSHmddAqiCISeK3@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a21202743f9ce4063e86b99cccaef48ef9813379 Author: Russell King (Oracle) Date: Sun Aug 31 18:34:43 2025 +0100 net: phylink: disable autoneg for interfaces that have no inband Mathew reports that as a result of commit 6561f0e547be ("net: pcs: pcs-lynx: implement pcs_inband_caps() method"), 10G SFP modules no longer work with the Lynx PCS. This problem is not specific to the Lynx PCS, but is caused by commit df874f9e52c3 ("net: phylink: add pcs_inband_caps() method") which added validation of the autoneg state to the optical SFP configuration path. Fix this by handling interface modes that fundamentally have no inband negotiation more correctly - if we only have a single interface mode, clear the Autoneg support bit and the advertising mask. If the module can operate with several different interface modes, autoneg may be supported for other modes, so leave the support mask alone and just clear the Autoneg bit in the advertising mask. This restores 10G optical module functionality with PCS that supply their inband support, and makes ethtool output look sane. Reported-by: Mathew McBride Closes: https://lore.kernel.org/r/025c0ebe-5537-4fa3-b05a-8b835e5ad317@app.fastmail.com Fixes: df874f9e52c3 ("net: phylink: add pcs_inband_caps() method") Signed-off-by: Russell King (Oracle) Tested-by: Vladimir Oltean Link: https://patch.msgid.link/E1uslwx-00000001SPB-2kiM@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1bd905dfea9897eafef532000702e63a66849f54 Author: Russell King (Oracle) Date: Sun Aug 31 18:34:38 2025 +0100 net: phylink: provide phylink_get_inband_type() Provide a function to get the type of the inband signalling used for a PHY interface type. This will be used in the subsequent patch to address problems with 10G optical modules. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uslws-00000001SP5-1R2R@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 4beb44a2d62dddfe450f310aa1a950901731cb3a Author: Russell King (Oracle) Date: Sun Aug 31 18:34:33 2025 +0100 net: phy: add phy_interface_weight() Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uslwn-00000001SOx-0a7H@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit fa390321aba0a54d0f7ae95ee4ecde1358bb9234 Author: Christoph Paasch Date: Sat Aug 30 15:55:38 2025 -0700 net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcp_ao_copy_all_matching() fails in tcp_v6_syn_recv_sock() it just exits the function. This ends up causing a memory-leak: unreferenced object 0xffff0000281a8200 (size 2496): comm "softirq", pid 0, jiffies 4295174684 hex dump (first 32 bytes): 7f 00 00 06 7f 00 00 06 00 00 00 00 cb a8 88 13 ................ 0a 00 03 61 00 00 00 00 00 00 00 00 00 00 00 00 ...a............ backtrace (crc 5ebdbe15): kmemleak_alloc+0x44/0xe0 kmem_cache_alloc_noprof+0x248/0x470 sk_prot_alloc+0x48/0x120 sk_clone_lock+0x38/0x3b0 inet_csk_clone_lock+0x34/0x150 tcp_create_openreq_child+0x3c/0x4a8 tcp_v6_syn_recv_sock+0x1c0/0x620 tcp_check_req+0x588/0x790 tcp_v6_rcv+0x5d0/0xc18 ip6_protocol_deliver_rcu+0x2d8/0x4c0 ip6_input_finish+0x74/0x148 ip6_input+0x50/0x118 ip6_sublist_rcv+0x2fc/0x3b0 ipv6_list_rcv+0x114/0x170 __netif_receive_skb_list_core+0x16c/0x200 netif_receive_skb_list_internal+0x1f0/0x2d0 This is because in tcp_v6_syn_recv_sock (and the IPv4 counterpart), when exiting upon error, inet_csk_prepare_forced_close() and tcp_done() need to be called. They make sure the newsk will end up being correctly free'd. tcp_v4_syn_recv_sock() makes this very clear by having the put_and_exit label that takes care of things. So, this patch here makes sure tcp_v4_syn_recv_sock and tcp_v6_syn_recv_sock have similar error-handling and thus fixes the leak for TCP-AO. Fixes: 06b22ef29591 ("net/tcp: Wire TCP-AO to request sockets") Signed-off-by: Christoph Paasch Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com> Link: https://patch.msgid.link/20250830-tcpao_leak-v1-1-e5878c2c3173@openai.com Signed-off-by: Jakub Kicinski commit d2644cbc736f737142a7595fa9346f63e6fc9b33 Author: Jakub Kicinski Date: Mon Sep 1 14:08:18 2025 -0700 eth: sundance: fix endian issues Fix sparse warnings about endianness. Store DMA addr to a variable of correct type and then only convert it when writing to the descriptor. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250901210818.1025316-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8b3332c1331c7c260bdff89bfdfd24ea263be764 Author: Jakub Kicinski Date: Mon Sep 1 14:08:17 2025 -0700 Revert "eth: remove the DLink/Sundance (ST201) driver" This reverts commit 8401a108a63302a5a198c7075d857895ca624851. I got a report from an (anonymous) Sundance user: Ethernet controller: Sundance Technology Inc / IC Plus Corp IC Plus IP100A Integrated 10/100 Ethernet MAC + PHY (rev 31) Revert the driver back in. Make following changes: - update Denis's email address in MAINTAINERS - adjust to timer API renames: - del_timer_sync() -> timer_delete_sync() - from_timer() -> timer_container_of() Fixes: 8401a108a633 ("eth: remove the DLink/Sundance (ST201) driver") Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250901210818.1025316-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 97acb0259cc9cbfbd7ab689e25684f3d8ce10e26 Author: Rameshkumar Sundaram Date: Sun Aug 10 22:30:18 2025 +0530 wifi: ath11k: fix group data packet drops during rekey During GTK rekey, mac80211 issues a clear key (if the old key exists) followed by an install key operation in the same context. This causes ath11k to send two WMI commands in quick succession: one to clear the old key and another to install the new key in the same slot. Under certain conditions—especially under high load or time sensitive scenarios, firmware may process these commands asynchronously in a way that firmware assumes the key is cleared whereas hardware has a valid key. This inconsistency between hardware and firmware leads to group addressed packet drops. Only setting the same key again can restore a valid key in firmware and allow packets to be transmitted. This issue remained latent because the host's clear key commands were not effective in firmware until commit 436a4e886598 ("ath11k: clear the keys properly via DISABLE_KEY"). That commit enabled the host to explicitly clear group keys, which inadvertently exposed the race. To mitigate this, restrict group key clearing across all modes (AP, STA, MESH). During rekey, the new key can simply be set on top of the previous one, avoiding the need for a clear followed by a set. However, in AP mode specifically, permit group key clearing when no stations are associated. This exception supports transitions from secure modes (e.g., WPA2/WPA3) to open mode, during which all associated peers are removed and the group key is cleared as part of the transition. Add a per-BSS station counter to track the presence of stations during set key operations. Also add a reset_group_keys flag to track the key re-installation state and avoid repeated installation of the same key when the number of connected stations transitions to non-zero within a rekey period. Additionally, for AP and Mesh modes, when the first station associates, reinstall the same group key that was last set. This ensures that the firmware recovers from any race that may have occurred during a previous key clear when no stations were associated. This change ensures that key clearing is permitted only when no clients are connected, avoiding packet loss while enabling dynamic security mode transitions. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.9.0.1-02146-QCAHKSWPL_SILICONZ-1 Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Reported-by: Steffen Moser Closes: https://lore.kernel.org/linux-wireless/c6366409-9928-4dd7-bf7b-ba7fcf20eabf@steffen-moser.de Fixes: 436a4e886598 ("ath11k: clear the keys properly via DISABLE_KEY") Signed-off-by: Rameshkumar Sundaram Tested-by: Nicolas Escande Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250810170018.1124014-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 22c55fb9eb92395d999b8404d73e58540d11bdd8 Author: Ramya Gnanasekar Date: Fri Aug 1 16:19:20 2025 +0530 wifi: ath12k: Set EMLSR support flag in MLO flags for EML-capable stations Currently, when updating EMLSR capabilities of a multi-link (ML) station, only the EMLSR parameters (e.g., padding delay, transition delay, and timeout) are sent to firmware. However, firmware also requires the EMLSR support flag to be set in the MLO flags of the peer assoc WMI command to properly handle EML operating mode notification frames. Set the ATH12K_WMI_FLAG_MLO_EMLSR_SUPPORT flag in the peer assoc WMI command when the ML station is EMLSR-capable, so that the firmware can respond to EHT EML action frames from associated stations. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: 4bcf9525bc49 ("wifi: ath12k: update EMLSR capabilities of ML Station") Signed-off-by: Ramya Gnanasekar Signed-off-by: Rameshkumar Sundaram Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250801104920.3326352-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 01be43f2a0eaeed83e94dee054742f37625c86d9 Author: Ian Rogers Date: Tue Sep 2 11:17:13 2025 -0700 perf bpf-utils: Harden get_bpf_prog_info_linear In get_bpf_prog_info_linear two calls to bpf_obj_get_info_by_fd are made, the first to compute memory requirements for a struct perf_bpil and the second to fill it in. Previously the code would warn when the second call didn't match the first. Such races can be common place in things like perf test, whose perf trace tests will frequently load BPF programs. Rather than a debug message, return actual errors for this case. Out of paranoia also validate the read bpf_prog_info array value. Change the type of ptr to avoid mismatched pointer type compiler warnings. Add some additional debug print outs and sanity asserts. Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/ Fixes: 6ac22d036f86 ("perf bpf: Pull in bpf_program__get_prog_info_linear()") Reviewed-by: Namhyung Kim Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250902181713.309797-4-irogers@google.com Signed-off-by: Namhyung Kim commit 1654a0e4d576d9e43fbb10ccf6a1b307c5c18566 Author: Ian Rogers Date: Tue Sep 2 11:17:12 2025 -0700 perf bpf-utils: Constify bpil_array_desc The array's contents is a compile time constant. Constify to make the code more intention revealing and avoid unintended errors. Reviewed-by: Namhyung Kim Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250902181713.309797-3-irogers@google.com Signed-off-by: Namhyung Kim commit d7b67dd6f9db7bd2c49b415e901849b182ff0735 Author: Ian Rogers Date: Tue Sep 2 11:17:11 2025 -0700 perf bpf-event: Fix use-after-free in synthesis Calls to perf_env__insert_bpf_prog_info may fail as a sideband thread may already have inserted the bpf_prog_info. Such failures may yield info_linear being freed which then causes use-after-free issues with the internal bpf_prog_info info struct. Make it so that perf_env__insert_bpf_prog_info trigger early non-error paths and fix the use-after-free in perf_event__synthesize_one_bpf_prog. Add proper return error handling to perf_env__add_bpf_info (that calls perf_env__insert_bpf_prog_info) and propagate the return value in its callers. Closes: https://lore.kernel.org/lkml/CAP-5=fWJQcmUOP7MuCA2ihKnDAHUCOBLkQFEkQES-1ZZTrgf8Q@mail.gmail.com/ Fixes: 03edb7020bb9 ("perf bpf: Fix two memory leakages when calling perf_env__insert_bpf_prog_info()") Reviewed-by: Namhyung Kim Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250902181713.309797-2-irogers@google.com Signed-off-by: Namhyung Kim commit ddbf0e78a8b20ec18d314d31336a0230fdc9b394 Author: Aleksander Jan Bajkowski Date: Sun Aug 31 12:59:07 2025 +0200 net: sfp: add quirk for FLYPRO copper SFP+ module Add quirk for a copper SFP that identifies itself as "FLYPRO" "SFP-10GT-CS-30M". It uses RollBall protocol to talk to the PHY. Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250831105910.3174-1-olek2@wp.pl Signed-off-by: Jakub Kicinski commit e6b9dce0aeeb91dfc0974ab87f02454e24566182 Merge: 8026aed072e122 bcd6659d4911c5 Author: Linus Torvalds Date: Tue Sep 2 13:38:07 2025 -0700 Merge tag 'sound-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small changes including a few regression fixes: - Regression fix for Intel SKL/KBL HD-audio bindings - Regression fix for missing Nvidia HDMI codec entries after the recent code reorganization - A few TAS2781 codec regression fixes - Fix for ASoC component lookup breakage - Usual HD-audio, USB-audio and SOF quirk entries" * tag 'sound-6.17-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model ALSA: usb-audio: Allow Focusrite devices to use low samplerates ALSA: hda: tas2781: reorder tas2563 calibration variables ALSA: hda: tas2781: fix tas2563 EFI data endianness ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported ALSA: docs: Add documents for recently changes in snd-usb-audio ALSA: usb-audio: Add mute TLV for playback volumes on more devices ASoC: SOF: Intel: WCL: Add the sdw_process_wakeen op ALSA: hda: Avoid binding with SOF for SKL/KBL platforms ASoC: rsnd: tidyup direction name on rsnd_dai_connect() ALSA: hda/tas2781: Fix EFI name for calibration beginning with 1 instead of 0 ALSA: usb-audio: move mixer_quirks' min_mute into common quirk ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY ALSA: hda/hdmi: Restore missing HDMI codec entries ASoC: codecs: idt821034: fix wrong log in idt821034_chip_direction_output() ASoC: soc-core: tidyup snd_soc_lookup_component_nolocked() ASoC: soc-core: care NULL dirver name on snd_soc_lookup_component_nolocked() ALSA: hda: intel-dsp-config: Select SOF driver on MTL Chromebooks ALSA: usb-audio: Add mute TLV for playback volumes on some devices commit 8026aed072e1221f0a61e5acc48c64546341bd4d Merge: e3c94a539e767c c873ccbb2f8db4 Author: Linus Torvalds Date: Tue Sep 2 13:18:00 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-09-01-17-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "17 hotfixes. 13 are cc:stable and the remainder address post-6.16 issues or aren't considered necessary for -stable kernels. 11 of these fixes are for MM. This includes a three-patch series from Harry Yoo which fixes an intermittent boot failure which can occur on x86 systems. And a two-patch series from Alexander Gordeev which fixes a KASAN crash on S390 systems" * tag 'mm-hotfixes-stable-2025-09-01-17-20' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm: fix possible deadlock in kmemleak x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() mm: introduce and use {pgd,p4d}_populate_kernel() mm: move page table sync declarations to linux/pgtable.h proc: fix missing pde_set_flags() for net proc files mm: fix accounting of memmap pages mm/damon/core: prevent unnecessary overflow in damos_set_effective_quota() kexec: add KEXEC_FILE_NO_CMA as a legal flag kasan: fix GCC mem-intrinsic prefix with sw tags mm/kasan: avoid lazy MMU mode hazards mm/kasan: fix vmalloc shadow memory (de-)population races kunit: kasan_test: disable fortify string checker on kasan_strings() test selftests/mm: fix FORCE_READ to read input value correctly mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE ocfs2: prevent release journal inode after journal shutdown rust: mm: mark VmaNew as transparent of_numa: fix uninitialized memory nodes causing kernel panic commit e3c94a539e767c7bf055be4ed6911246812fcb6e Merge: b320789d6883cc 986bf6ed44dff7 Author: Linus Torvalds Date: Tue Sep 2 13:13:22 2025 -0700 Merge tag 'for-6.17-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix a few races related to inode link count - fix inode leak on failure to add link to inode - move transaction aborts closer to where they happen * tag 'for-6.17-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: avoid load/store tearing races when checking if an inode was logged btrfs: fix race between setting last_dir_index_offset and inode logging btrfs: fix race between logging inode and checking if it was logged before btrfs: simplify error handling logic for btrfs_link() btrfs: fix inode leak on failure to add link to inode btrfs: abort transaction on failure to add link to inode commit 7ac3c2889bc060c3f67cf44df0dbb093a835c176 Author: Christoph Hellwig Date: Mon Aug 25 15:32:49 2025 +0200 nvme: fix PI insert on write I recently ran into an issue where the PI generated using the block layer integrity code differs from that from a kernel using the PRACT fallback when the block layer integrity code is disabled, and I tracked this down to us using PRACT incorrectly. The NVM Command Set Specification (section 5.33 in 1.2, similar in older versions) specifies the PRACT insert behavior as: Inserted protection information consists of the computed CRC for the protection information format (refer to section 5.3.1) in the Guard field, the LBAT field value in the Application Tag field, the LBST field value in the Storage Tag field, if defined, and the computed reference tag in the Logical Block Reference Tag. Where the computed reference tag is defined as following for type 1 and type 2 using the text below that is duplicated in the respective bullet points: the value of the computed reference tag for the first logical block of the command is the value contained in the Initial Logical Block Reference Tag (ILBRT) or Expected Initial Logical Block Reference Tag (EILBRT) field in the command, and the computed reference tag is incremented for each subsequent logical block. So we need to set ILBRT field, but we currently don't. Interestingly this works fine on my older type 1 formatted SSD, but Qemu trips up on this. We already set ILBRT for Write Same since commit aeb7bb061be5 ("nvme: set the PRACT bit when using Write Zeroes with T10 PI"). To ease this, move the PI type check into nvme_set_ref_tag. Reviewed-by: Martin K. Petersen Signed-off-by: Christoph Hellwig Signed-off-by: Keith Busch commit f6a6c280059c4ddc23e12e3de1b01098e240036f Author: Omar Sandoval Date: Tue Aug 26 11:24:38 2025 -0700 btrfs: fix subvolume deletion lockup caused by inodes xarray race There is a race condition between inode eviction and inode caching that can cause a live struct btrfs_inode to be missing from the root->inodes xarray. Specifically, there is a window during evict() between the inode being unhashed and deleted from the xarray. If btrfs_iget() is called for the same inode in that window, it will be recreated and inserted into the xarray, but then eviction will delete the new entry, leaving nothing in the xarray: Thread 1 Thread 2 --------------------------------------------------------------- evict() remove_inode_hash() btrfs_iget_path() btrfs_iget_locked() btrfs_read_locked_inode() btrfs_add_inode_to_root() destroy_inode() btrfs_destroy_inode() btrfs_del_inode_from_root() __xa_erase In turn, this can cause issues for subvolume deletion. Specifically, if an inode is in this lost state, and all other inodes are evicted, then btrfs_del_inode_from_root() will call btrfs_add_dead_root() prematurely. If the lost inode has a delayed_node attached to it, then when btrfs_clean_one_deleted_snapshot() calls btrfs_kill_all_delayed_nodes(), it will loop forever because the delayed_nodes xarray will never become empty (unless memory pressure forces the inode out). We saw this manifest as soft lockups in production. Fix it by only deleting the xarray entry if it matches the given inode (using __xa_cmpxchg()). Fixes: 310b2f5d5a94 ("btrfs: use an xarray to track open inodes in a root") Cc: stable@vger.kernel.org # 6.11+ Reviewed-by: Josef Bacik Reviewed-by: Filipe Manana Co-authored-by: Leo Martins Signed-off-by: Leo Martins Signed-off-by: Omar Sandoval Signed-off-by: David Sterba commit 9786531399a679fc2f4630d2c0a186205282ab2f Author: Qu Wenruo Date: Fri Aug 22 16:06:13 2025 +0930 btrfs: fix corruption reading compressed range when block size is smaller than page size [BUG] With 64K page size (aarch64 with 64K page size config) and 4K btrfs block size, the following workload can easily lead to a corrupted read: mkfs.btrfs -f -s 4k $dev > /dev/null mount -o compress $dev $mnt xfs_io -f -c "pwrite -S 0xff 0 64k" $mnt/base > /dev/null echo "correct result:" od -Ad -t x1 $mnt/base xfs_io -f -c "reflink $mnt/base 32k 0 32k" \ -c "reflink $mnt/base 0 32k 32k" \ -c "pwrite -S 0xff 60k 4k" $mnt/new > /dev/null echo "incorrect result:" od -Ad -t x1 $mnt/new umount $mnt This shows the following result: correct result: 0000000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff * 0065536 incorrect result: 0000000 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff * 0032768 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 * 0061440 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff * 0065536 Notice the zero in the range [32K, 60K), which is incorrect. [CAUSE] With extra trace printk, it shows the following events during od: (some unrelated info removed like CPU and context) od-3457 btrfs_do_readpage: enter r/i=5/258 folio=0(65536) prev_em_start=0000000000000000 The "r/i" is indicating the root and inode number. In our case the file "new" is using ino 258 from fs tree (root 5). Here notice the @prev_em_start pointer is NULL. This means the btrfs_do_readpage() is called from btrfs_read_folio(), not from btrfs_readahead(). od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=0 got em start=0 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=4096 got em start=0 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=8192 got em start=0 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=12288 got em start=0 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=16384 got em start=0 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=20480 got em start=0 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=24576 got em start=0 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=28672 got em start=0 len=32768 These above 32K blocks will be read from the first half of the compressed data extent. od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=32768 got em start=32768 len=32768 Note here there is no btrfs_submit_compressed_read() call. Which is incorrect now. Although both extent maps at 0 and 32K are pointing to the same compressed data, their offsets are different thus can not be merged into the same read. So this means the compressed data read merge check is doing something wrong. od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=36864 got em start=32768 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=40960 got em start=32768 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=45056 got em start=32768 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=49152 got em start=32768 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=53248 got em start=32768 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=57344 got em start=32768 len=32768 od-3457 btrfs_do_readpage: r/i=5/258 folio=0(65536) cur=61440 skip uptodate od-3457 btrfs_submit_compressed_read: cb orig_bio: file off=0 len=61440 The function btrfs_submit_compressed_read() is only called at the end of folio read. The compressed bio will only have an extent map of range [0, 32K), but the original bio passed in is for the whole 64K folio. This will cause the decompression part to only fill the first 32K, leaving the rest untouched (aka, filled with zero). This incorrect compressed read merge leads to the above data corruption. There were similar problems that happened in the past, commit 808f80b46790 ("Btrfs: update fix for read corruption of compressed and shared extents") is doing pretty much the same fix for readahead. But that's back to 2015, where btrfs still only supports bs (block size) == ps (page size) cases. This means btrfs_do_readpage() only needs to handle a folio which contains exactly one block. Only btrfs_readahead() can lead to a read covering multiple blocks. Thus only btrfs_readahead() passes a non-NULL @prev_em_start pointer. With v5.15 kernel btrfs introduced bs < ps support. This breaks the above assumption that a folio can only contain one block. Now btrfs_read_folio() can also read multiple blocks in one go. But btrfs_read_folio() doesn't pass a @prev_em_start pointer, thus the existing bio force submission check will never be triggered. In theory, this can also happen for btrfs with large folios, but since large folio is still experimental, we don't need to bother it, thus only bs < ps support is affected for now. [FIX] Instead of passing @prev_em_start to do the proper compressed extent check, introduce one new member, btrfs_bio_ctrl::last_em_start, so that the existing bio force submission logic will always be triggered. CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 6db1df415d73fcad12134a54f97dc6c8a64ab181 Author: Calvin Owens Date: Mon Aug 25 18:32:04 2025 +0930 btrfs: accept and ignore compression level for lzo The compression level is meaningless for lzo, but before commit 3f093ccb95f30 ("btrfs: harden parsing of compression mount options"), it was silently ignored if passed. After that commit, passing a level with lzo fails to mount: BTRFS error: unrecognized compression value lzo:1 It seems reasonable for users to expect that lzo would permit a numeric level option, as all the other algos do, even though the kernel's implementation of LZO currently only supports a single level. Because it has always worked to pass a level, it seems likely to me that users in the real world are relying on doing so. This patch restores the old behavior, giving "lzo:N" the same semantics as all of the other compression algos. To be clear, silly variants like "lzo:one", "lzo:the_first_option", or "lzo:armageddon" also used to work. This isn't meant to suggest that any possible mis-interpretation of mount options that once worked must continue to work forever. This is an exceptional case where it makes sense to preserve compatibility, both because the mis-interpretation is reasonable, and because nothing tangible is sacrificed. Finally update btrfs_show_options() to ignore the level of LZO, as it is only the default level without any extra meaning. Fixes: 3f093ccb95f30 ("btrfs: harden parsing of compression mount options") Reviewed-by: Daniel Vacek Reviewed-by: Qu Wenruo Signed-off-by: Calvin Owens Reviewed-by: David Sterba Signed-off-by: David Sterba commit de134cb54c3a67644ff95b1c9bffe545e752c912 Author: Boris Burkov Date: Wed Aug 20 14:52:05 2025 -0700 btrfs: fix squota compressed stats leak The following workload on a squota enabled fs: btrfs subvol create mnt/subvol # ensure subvol extents get accounted sync btrfs qgroup create 1/1 mnt btrfs qgroup assign mnt/subvol 1/1 mnt btrfs qgroup delete mnt/subvol # make the cleaner thread run btrfs filesystem sync mnt sleep 1 btrfs filesystem sync mnt btrfs qgroup destroy 1/1 mnt will fail with EBUSY. The reason is that 1/1 does the quick accounting when we assign subvol to it, gaining its exclusive usage as excl and excl_cmpr. But then when we delete subvol, the decrement happens via record_squota_delta() which does not update excl_cmpr, as squotas does not make any distinction between compressed and normal extents. Thus, we increment excl_cmpr but never decrement it, and are unable to delete 1/1. The two possible fixes are to make squota always mirror excl and excl_cmpr or to make the fast accounting separately track the plain and cmpr numbers. The latter felt cleaner to me so that is what I opted for. Fixes: 1e0e9d5771c3 ("btrfs: add helper for recording simple quota deltas") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Qu Wenruo Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 90fb7db49c6dbac961c6b8ebfd741141ffbc8545 Author: Vitaly Lifshits Date: Sun Aug 17 12:25:47 2025 +0300 e1000e: fix heap overflow in e1000_set_eeprom Fix a possible heap overflow in e1000_set_eeprom function by adding input validation for the requested length of the change in the EEPROM. In addition, change the variable type from int to size_t for better code practices and rearrange declarations to RCT. Cc: stable@vger.kernel.org Fixes: bc7f75fa9788 ("[E1000E]: New pci-express e1000 driver (currently for ICH9 devices only)") Co-developed-by: Mikael Wessel Signed-off-by: Mikael Wessel Signed-off-by: Vitaly Lifshits Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit b7e5c3e3bfa9dc8af75ff6d8633ad7070e1985e4 Author: Alok Tiwari Date: Sun Aug 10 10:01:14 2025 -0700 ixgbe: fix incorrect map used in eee linkmode incorrectly used ixgbe_lp_map in loops intended to populate the supported and advertised EEE linkmode bitmaps based on ixgbe_ls_map. This results in incorrect bit setting and potential out-of-bounds access, since ixgbe_lp_map and ixgbe_ls_map have different sizes and purposes. ixgbe_lp_map[i] -> ixgbe_ls_map[i] Use ixgbe_ls_map for supported and advertised linkmodes, and keep ixgbe_lp_map usage only for link partner (lp_advertised) mapping. Fixes: 9356b6db9d05 ("net: ethernet: ixgbe: Convert EEE to use linkmodes") Signed-off-by: Alok Tiwari Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit a556f06338e1d5a85af0e32ecb46e365547f92b9 Author: Zhen Ni Date: Wed Aug 27 19:56:31 2025 +0800 i40e: Fix potential invalid access when MAC list is empty list_first_entry() never returns NULL - if the list is empty, it still returns a pointer to an invalid object, leading to potential invalid memory access when dereferenced. Fix this by using list_first_entry_or_null instead of list_first_entry. Fixes: e3219ce6a775 ("i40e: Add support for client interface for IWARP driver") Signed-off-by: Zhen Ni Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen commit 9fcdb1c3c4ba134434694c001dbff343f1ffa319 Author: Jacob Keller Date: Tue Jul 22 17:14:37 2025 -0700 i40e: remove read access to debugfs files The 'command' and 'netdev_ops' debugfs files are a legacy debugging interface supported by the i40e driver since its early days by commit 02e9c290814c ("i40e: debugfs interface"). Both of these debugfs files provide a read handler which is mostly useless, and which is implemented with questionable logic. They both use a static 256 byte buffer which is initialized to the empty string. In the case of the 'command' file this buffer is literally never used and simply wastes space. In the case of the 'netdev_ops' file, the last command written is saved here. On read, the files contents are presented as the name of the device followed by a colon and then the contents of their respective static buffer. For 'command' this will always be ": ". For 'netdev_ops', this will be ": ". But note the buffer is shared between all devices operated by this module. At best, it is mostly meaningless information, and at worse it could be accessed simultaneously as there doesn't appear to be any locking mechanism. We have also recently received multiple reports for both read functions about their use of snprintf and potential overflow that could result in reading arbitrary kernel memory. For the 'command' file, this is definitely impossible, since the static buffer is always zero and never written to. For the 'netdev_ops' file, it does appear to be possible, if the user carefully crafts the command input, it will be copied into the buffer, which could be large enough to cause snprintf to truncate, which then causes the copy_to_user to read beyond the length of the buffer allocated by kzalloc. A minimal fix would be to replace snprintf() with scnprintf() which would cap the return to the number of bytes written, preventing an overflow. A more involved fix would be to drop the mostly useless static buffers, saving 512 bytes and modifying the read functions to stop needing those as input. Instead, lets just completely drop the read access to these files. These are debug interfaces exposed as part of debugfs, and I don't believe that dropping read access will break any script, as the provided output is pretty useless. You can find the netdev name through other more standard interfaces, and the 'netdev_ops' interface can easily result in garbage if you issue simultaneous writes to multiple devices at once. In order to properly remove the i40e_dbg_netdev_ops_buf, we need to refactor its write function to avoid using the static buffer. Instead, use the same logic as the i40e_dbg_command_write, with an allocated buffer. Update the code to use this instead of the static buffer, and ensure we free the buffer on exit. This fixes simultaneous writes to 'netdev_ops' on multiple devices, and allows us to remove the now unused static buffer along with removing the read access. Fixes: 02e9c290814c ("i40e: debugfs interface") Reported-by: Kunwu Chan Closes: https://lore.kernel.org/intel-wired-lan/20231208031950.47410-1-chentao@kylinos.cn/ Reported-by: Wang Haoran Closes: https://lore.kernel.org/all/CANZ3JQRRiOdtfQJoP9QM=6LS1Jto8PGBGw6y7-TL=BcnzHQn1Q@mail.gmail.com/ Reported-by: Amir Mohammad Jahangirzad Closes: https://lore.kernel.org/all/20250722115017.206969-1-a.jahangirzad@gmail.com/ Signed-off-by: Jacob Keller Reviewed-by: Dawid Osuchowski Reviewed-by: Aleksandr Loktionov Reviewed-by: Simon Horman Reviewed-by: Kunwu Chan Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit acf3a5c8be80fe238c1a7629db1c21c74a1f9dd4 Author: Emil Tantilov Date: Thu Aug 14 16:43:00 2025 -0700 idpf: set mac type when adding and removing MAC filters On control planes that allow changing the MAC address of the interface, the driver must provide a MAC type to avoid errors such as: idpf 0000:0a:00.0: Transaction failed (op 535) idpf 0000:0a:00.0: Received invalid MAC filter payload (op 535) (len 0) idpf 0000:0a:00.0: Transaction failed (op 536) These errors occur during driver load or when changing the MAC via: ip link set address Add logic to set the MAC type when sending ADD/DEL (opcodes 535/536) to the control plane. Since only one primary MAC is supported per vport, the driver only needs to send an ADD opcode when setting it. Remove the old address by calling __idpf_del_mac_filter(), which skips the message and just clears the entry from the internal list. This avoids an error on DEL as it attempts to remove an address already cleared by the preceding ADD opcode. Fixes: ce1b75d0635c ("idpf: add ptypes and MAC filter support") Reported-by: Jian Liu Signed-off-by: Emil Tantilov Reviewed-by: Aleksandr Loktionov Reviewed-by: Paul Menzel Reviewed-by: Simon Horman Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 65637c3a181184ae25bd10d37bc83f8bb97708b5 Author: Joshua Hay Date: Mon Aug 11 17:19:21 2025 -0700 idpf: fix UAF in RDMA core aux dev deinitialization Free the adev->id before auxiliary_device_uninit. The call to uninit triggers the release callback, which frees the iadev memory containing the adev. The previous flow results in a UAF during rmmod due to the adev->id access. [264939.604077] ================================================================== [264939.604093] BUG: KASAN: slab-use-after-free in idpf_idc_deinit_core_aux_device+0xe4/0x100 [idpf] [264939.604134] Read of size 4 at addr ff1100109eb6eaf8 by task rmmod/17842 ... [264939.604635] Allocated by task 17597: [264939.604643] kasan_save_stack+0x20/0x40 [264939.604654] kasan_save_track+0x14/0x30 [264939.604663] __kasan_kmalloc+0x8f/0xa0 [264939.604672] idpf_idc_init_aux_core_dev+0x4bd/0xb60 [idpf] [264939.604700] idpf_idc_init+0x55/0xd0 [idpf] [264939.604726] process_one_work+0x658/0xfe0 [264939.604742] worker_thread+0x6e1/0xf10 [264939.604750] kthread+0x382/0x740 [264939.604762] ret_from_fork+0x23a/0x310 [264939.604772] ret_from_fork_asm+0x1a/0x30 [264939.604785] Freed by task 17842: [264939.604790] kasan_save_stack+0x20/0x40 [264939.604799] kasan_save_track+0x14/0x30 [264939.604808] kasan_save_free_info+0x3b/0x60 [264939.604820] __kasan_slab_free+0x37/0x50 [264939.604830] kfree+0xf1/0x420 [264939.604840] device_release+0x9c/0x210 [264939.604850] kobject_put+0x17c/0x4b0 [264939.604860] idpf_idc_deinit_core_aux_device+0x4f/0x100 [idpf] [264939.604886] idpf_vc_core_deinit+0xba/0x3a0 [idpf] [264939.604915] idpf_remove+0xb0/0x7c0 [idpf] [264939.604944] pci_device_remove+0xab/0x1e0 [264939.604955] device_release_driver_internal+0x371/0x530 [264939.604969] driver_detach+0xbf/0x180 [264939.604981] bus_remove_driver+0x11b/0x2a0 [264939.604991] pci_unregister_driver+0x2a/0x250 [264939.605005] __do_sys_delete_module.constprop.0+0x2eb/0x540 [264939.605014] do_syscall_64+0x64/0x2c0 [264939.605024] entry_SYSCALL_64_after_hwframe+0x76/0x7e Fixes: f4312e6bfa2a ("idpf: implement core RDMA auxiliary dev create, init, and destroy") Signed-off-by: Joshua Hay Reviewed-by: Aleksandr Loktionov Reviewed-by: Vadim Fedorenko Tested-by: Samuel Salin Reviewed-by: Jacob Keller Signed-off-by: Tony Nguyen commit f6486338fde3f04ed0ec59fe67a69a208c32734f Author: Jacob Keller Date: Thu Aug 7 10:35:27 2025 -0700 ice: fix NULL access of tx->in_use in ice_ll_ts_intr Recent versions of the E810 firmware have support for an extra interrupt to handle report of the "low latency" Tx timestamps coming from the specialized low latency firmware interface. Instead of polling the registers, software can wait until the low latency interrupt is fired. This logic makes use of the Tx timestamp tracking structure, ice_ptp_tx, as it uses the same "ready" bitmap to track which Tx timestamps complete. Unfortunately, the ice_ll_ts_intr() function does not check if the tracker is initialized before its first access. This results in NULL dereference or use-after-free bugs similar to the issues fixed in the ice_ptp_ts_irq() function. Fix this by only checking the in_use bitmap (and other fields) if the tracker is marked as initialized. The reset flow will clear the init field under lock before it tears the tracker down, thus preventing any use-after-free or NULL access. Fixes: 82e71b226e0e ("ice: Enable SW interrupt from FW for LL TS") Signed-off-by: Jacob Keller Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 403bf043d9340196e06769065169df7444b91f7a Author: Jacob Keller Date: Thu Aug 7 10:35:26 2025 -0700 ice: fix NULL access of tx->in_use in ice_ptp_ts_irq The E810 device has support for a "low latency" firmware interface to access and read the Tx timestamps. This interface does not use the standard Tx timestamp logic, due to the latency overhead of proxying sideband command requests over the firmware AdminQ. The logic still makes use of the Tx timestamp tracking structure, ice_ptp_tx, as it uses the same "ready" bitmap to track which Tx timestamps complete. Unfortunately, the ice_ptp_ts_irq() function does not check if the tracker is initialized before its first access. This results in NULL dereference or use-after-free bugs similar to the following: [245977.278756] BUG: kernel NULL pointer dereference, address: 0000000000000000 [245977.278774] RIP: 0010:_find_first_bit+0x19/0x40 [245977.278796] Call Trace: [245977.278809] ? ice_misc_intr+0x364/0x380 [ice] This can occur if a Tx timestamp interrupt races with the driver reset logic. Fix this by only checking the in_use bitmap (and other fields) if the tracker is marked as initialized. The reset flow will clear the init field under lock before it tears the tracker down, thus preventing any use-after-free or NULL access. Fixes: f9472aaabd1f ("ice: Process TSYN IRQ in a separate function") Signed-off-by: Jacob Keller Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit bdd5a14e660062114bdebaef9ad52adf04970a89 Author: Michael Walle Date: Thu Aug 21 14:23:41 2025 +0200 drm/bridge: ti-sn65dsi86: fix REFCLK setting The bridge has three bootstrap pins which are sampled to determine the frequency of the external reference clock. The driver will also (over)write that setting. But it seems this is racy after the bridge is enabled. It was observed that although the driver write the correct value (by sniffing on the I2C bus), the register has the wrong value. The datasheet states that the GPIO lines have to be stable for at least 5us after asserting the EN signal. Thus, there seems to be some logic which samples the GPIO lines and this logic appears to overwrite the register value which was set by the driver. Waiting 20us after asserting the EN line resolves this issue. Fixes: a095f15c00e2 ("drm/bridge: add support for sn65dsi86 bridge driver") Signed-off-by: Michael Walle Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250821122341.1257286-1-mwalle@kernel.org commit 85a71323753cbb16f4dcb5b3e2b3fd0acc05f130 Merge: 35fc531a59694f 9b17d3724df55e Author: Mark Brown Date: Tue Sep 2 17:55:00 2025 +0100 Minor bug fixes for some older Wolfson devices Merge series from Charles Keepax : Minor bug fixes for a couple of older devices reported by some users. Mostly this centers around the automatic PLL configuration getting the wrong values due to rounding. commit 664596bd98bb251dd417dfd3f9b615b661e1e44a Author: Chiasheng Lee Date: Mon Sep 1 20:59:43 2025 +0800 i2c: i801: Hide Intel Birch Stream SoC TCO WDT Hide the Intel Birch Stream SoC TCO WDT feature since it was removed. On platforms with PCH TCO WDT, this redundant device might be rendering errors like this: [ 28.144542] sysfs: cannot create duplicate filename '/bus/platform/devices/iTCO_wdt' Fixes: 8c56f9ef25a3 ("i2c: i801: Add support for Intel Birch Stream SoC") Link: https://bugzilla.kernel.org/show_bug.cgi?id=220320 Signed-off-by: Chiasheng Lee Cc: # v6.7+ Reviewed-by: Mika Westerberg Reviewed-by: Jarkko Nikula Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250901125943.916522-1-chiasheng.lee@linux.intel.com commit 3d62ab32df065e4a7797204a918f6489ddb8a237 Author: Luo Gengkun Date: Tue Aug 19 10:51:52 2025 +0000 tracing: Fix tracing_marker may trigger page fault during preempt_disable Both tracing_mark_write and tracing_mark_raw_write call __copy_from_user_inatomic during preempt_disable. But in some case, __copy_from_user_inatomic may trigger page fault, and will call schedule() subtly. And if a task is migrated to other cpu, the following warning will be trigger: if (RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))) An example can illustrate this issue: process flow CPU --------------------------------------------------------------------- tracing_mark_raw_write(): cpu:0 ... ring_buffer_lock_reserve(): cpu:0 ... cpu = raw_smp_processor_id() cpu:0 cpu_buffer = buffer->buffers[cpu] cpu:0 ... ... __copy_from_user_inatomic(): cpu:0 ... # page fault do_mem_abort(): cpu:0 ... # Call schedule schedule() cpu:0 ... # the task schedule to cpu1 __buffer_unlock_commit(): cpu:1 ... ring_buffer_unlock_commit(): cpu:1 ... cpu = raw_smp_processor_id() cpu:1 cpu_buffer = buffer->buffers[cpu] cpu:1 As shown above, the process will acquire cpuid twice and the return values are not the same. To fix this problem using copy_from_user_nofault instead of __copy_from_user_inatomic, as the former performs 'access_ok' before copying. Link: https://lore.kernel.org/20250819105152.2766363-1-luogengkun@huaweicloud.com Fixes: 656c7f0d2d2b ("tracing: Replace kmap with copy_from_user() in trace_marker writing") Signed-off-by: Luo Gengkun Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 81ac63321eb936b1a1f7045b37674661f8ffb4a5 Author: Qianfeng Rong Date: Tue Aug 5 10:36:29 2025 +0800 trace: Remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. No functional changes. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250805023630.335719-1-rongqianfeng@vivo.com Signed-off-by: Qianfeng Rong Signed-off-by: Steven Rostedt (Google) commit 304f455b648d68ba47135583b644ee72ac48d544 Author: James Jones Date: Tue Aug 26 12:57:16 2025 -0700 MAINTAINERS: Update git entry for nouveau The gitlab repository previously associated with the nouveau module has fallen out of use. The drm-misc tree here: https://gitlab.freedesktop.org/drm/misc/kernel.git Is now where most nouveau-related patches are applied. This change updates the MAINTAINERS file to reflect this. Signed-off-by: James Jones Link: https://lore.kernel.org/r/20250826195716.1897-1-jajones@nvidia.com Signed-off-by: Danilo Krummrich commit 35fc531a59694f24a2456569cf7d1a9c6436841c Author: Colin Ian King Date: Tue Sep 2 13:06:39 2025 +0100 ASoC: SOF: Intel: hda-stream: Fix incorrect variable used in error message The dev_err message is reporting an error about capture streams however it is using the incorrect variable num_playback instead of num_capture. Fix this by using the correct variable num_capture. Fixes: a1d1e266b445 ("ASoC: SOF: Intel: Add Intel specific HDA stream operations") Signed-off-by: Colin Ian King Acked-by: Peter Ujfalusi Link: https://patch.msgid.link/20250902120639.2626861-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit 379b3c983fc0257c183052278832ac68e3ccd33b Author: Thomas Hellström Date: Thu Aug 28 15:48:37 2025 +0200 drm/xe: Fix incorrect migration of backed-up object to VRAM If an object is backed up to shmem it is incorrectly identified as not having valid data by the move code. This means moving to VRAM skips the -EMULTIHOP step and the bo is cleared. This causes all sorts of weird behaviour on DGFX if an already evicted object is targeted by the shrinker. Fix this by using ttm_tt_is_swapped() to identify backed-up objects. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5996 Fixes: 00c8efc3180f ("drm/xe: Add a shrinker for xe bos") Cc: Matthew Brost Cc: Matthew Auld Cc: # v6.15+ Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250828134837.5709-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 1047bd82794a1eab64d643f196d09171ce983f44) Signed-off-by: Rodrigo Vivi commit a6099f263e1f408bcc7913c9df24b0677164fc5d Author: Nishanth Menon Date: Fri Aug 29 17:40:51 2025 +0530 net: ethernet: ti: am65-cpsw-nuss: Fix null pointer dereference for ndev In the TX completion packet stage of TI SoCs with CPSW2G instance, which has single external ethernet port, ndev is accessed without being initialized if no TX packets have been processed. It results into null pointer dereference, causing kernel to crash. Fix this by having a check on the number of TX packets which have been processed. Fixes: 9a369ae3d143 ("net: ethernet: ti: am65-cpsw: remove am65_cpsw_nuss_tx_compl_packets_2g()") Signed-off-by: Nishanth Menon Signed-off-by: Chintan Vankar Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250829121051.2031832-1-c-vankar@ti.com Signed-off-by: Paolo Abeni commit e27e34bc99413a29cafae02ad572ea3c9beba2ce Author: Jeremy Kerr Date: Fri Aug 29 15:40:23 2025 +0800 net: mctp: usb: initialise mac header in RX path We're not currently setting skb->mac_header on ingress, and the netdev core rx path expects it. Without it, we'll hit a warning on DEBUG_NETDEV from commit 1e4033b53db4 ("net: skb_reset_mac_len() must check if mac_header was set") Initialise the mac_header to refer to the USB transport header. Fixes: 0791c0327a6e ("net: mctp: Add MCTP USB transport driver") Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250829-mctp-usb-mac-header-v1-1-338ad725e183@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 773b27a8a2f00ce3134e92e50ea4794a98ba2b76 Author: Jeremy Kerr Date: Fri Aug 29 15:28:26 2025 +0800 net: mctp: mctp_fraq_queue should take ownership of passed skb As of commit f5d83cf0eeb9 ("net: mctp: unshare packets when reassembling"), we skb_unshare() in mctp_frag_queue(). The unshare may invalidate the original skb pointer, so we need to treat the skb as entirely owned by the fraq queue, even on failure. Fixes: f5d83cf0eeb9 ("net: mctp: unshare packets when reassembling") Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250829-mctp-skb-unshare-v1-1-1c28fe10235a@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 0c28431f6fe13f3a3be0978f79c1a7ae8a93d028 Author: Daniel Baluta Date: Tue Sep 2 13:21:00 2025 +0300 ASoC: SOF: imx: Fix devm_ioremap_resource check devm_ioremap_resource does not return NULL on error but an error pointer so we need to use IS_ERR to check the return code. While at it also pass the error code to dev_err_probe to improve logging. Fixes: bc163baef570 ("ASoC: Use of_reserved_mem_region_to_resource() for "memory-region"") Signed-off-by: Daniel Baluta Link: https://patch.msgid.link/20250902102101.378809-1-daniel.baluta@nxp.com Signed-off-by: Mark Brown commit 232674e1a6dd2f7a68b0d496a7ed1a57d79533da Author: Pierre-Eric Pelloux-Prayer Date: Mon Sep 1 14:40:32 2025 +0200 drm/sched: Fix racy access to drm_sched_entity.dependency The drm_sched_job_unschedulable trace point can access entity->dependency after it was cleared by the callback installed in drm_sched_entity_add_dependency_cb, causing: BUG: kernel NULL pointer dereference, address: 0000000000000020 [...] Workqueue: comp_1.1.0 drm_sched_run_job_work [gpu_sched] RIP: 0010:trace_event_raw_event_drm_sched_job_unschedulable+0x70/0xd0 [gpu_sched] To fix this we either need to keep a reference to the fence before setting up the callbacks, or move the trace_drm_sched_job_unschedulable calls into drm_sched_entity_add_dependency_cb where they can be done earlier. Fixes: 76d97c870f29 ("drm/sched: Trace dependencies for GPU jobs") Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250901124032.1955-1-pierre-eric.pelloux-prayer@amd.com (cherry picked from commit b2b8af21fec35be417a3199b5a6c354605dd222a) Signed-off-by: Maxime Ripard commit 28edfaa10ca1b370b1a27fde632000d35c43402c Author: Maciej Strozek Date: Mon Sep 1 16:15:07 2025 +0100 ASoC: SDCA: Add quirk for incorrect function types for 3 systems Certain systems have CS42L43 DisCo that claims to conform to version 0.6.28 but uses the function types from the 1.0 spec. Add a quirk as a workaround. Closes: https://github.com/thesofproject/linux/issues/5515 Cc: stable@vger.kernel.org Signed-off-by: Maciej Strozek Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250901151518.3197941-1-mstrozek@opensource.cirrus.com Signed-off-by: Mark Brown commit f1d0260362d72f9f454dc1f9db2eeb80cb801f28 Author: Venkata Prasad Potturu Date: Thu Aug 21 11:15:47 2025 +0530 ASoC: amd: acp: Adjust pdm gain value Set pdm gain value by setting PDM_MISC_CTRL_MASK value. To avoid low pdm gain value. Signed-off-by: Venkata Prasad Potturu Reviewed-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20250821054606.1279178-1-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown commit 78338108b5a856dc98223a335f147846a8a18c51 Author: Dan Carpenter Date: Fri Aug 29 15:57:34 2025 +0300 ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded() The sma1307->set.header_size is how many integers are in the header (there are 8 of them) but instead of allocating space of 8 integers we allocate 8 bytes. This leads to memory corruption when we copy data it on the next line: memcpy(sma1307->set.header, data, sma1307->set.header_size * sizeof(int)); Also since we're immediately copying over the memory in ->set.header, there is no need to zero it in the allocator. Use devm_kmalloc_array() to allocate the memory instead. Fixes: 576c57e6b4c1 ("ASoC: sma1307: Add driver for Iron Device SMA1307") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aLGjvjpueVstekXP@stanley.mountain Signed-off-by: Mark Brown commit aa2e1e4563d3ab689ffa86ca1412ecbf9fd3b308 Author: Miaoqian Lin Date: Tue Sep 2 17:03:58 2025 +0800 dmaengine: dw: dmamux: Fix device reference leak in rzn1_dmamux_route_allocate The reference taken by of_find_device_by_node() must be released when not needed anymore. Add missing put_device() call to fix device reference leaks. Fixes: 134d9c52fca2 ("dmaengine: dw: dmamux: Introduce RZN1 DMA router support") Cc: stable@vger.kernel.org Signed-off-by: Miaoqian Lin Reviewed-by: Miquel Raynal Link: https://lore.kernel.org/r/20250902090358.2423285-1-linmq006@gmail.com Signed-off-by: Vinod Koul commit ef9f21c3f370bcd45688a3a573b788e39b364e80 Author: Bartosz Golaszewski Date: Mon Sep 1 14:55:13 2025 +0200 gpio: fix GPIO submenu in Kconfig Commit a86240a37d43 ("gpiolib: enable CONFIG_GPIOLIB_LEGACY even for !GPIOLIB") accidentally pulled all items from within the GPIOLIB submenu into the main driver menu. Put them back under the top-level GPIO entry. Suggested-by: Rob Herring Fixes: a86240a37d43 ("gpiolib: enable CONFIG_GPIOLIB_LEGACY even for !GPIOLIB") Reported-by: Rob Herring Closes: https://lore.kernel.org/all/20250813222649.GA965895-robh@kernel.org/ Reviewed-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250901125513.108691-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit f1b55db08d527240fbc3b8c84229134a98d8d080 Author: Danilo Krummrich Date: Fri Aug 29 21:57:42 2025 +0200 rust: device: fix unresolved link to drm::Device drm::Device is only available when CONFIG_DRM=y, which we have to consider for intra-doc links, otherwise the rustdoc make target produces the following warning. >> warning: unresolved link to `kernel::drm::Device` --> rust/kernel/device.rs:154:22 | 154 | /// [`drm::Device`]: kernel::drm::Device | ^^^^^^^^^^^^^^^^^^^ no item named `drm` in module `kernel` | = note: `#[warn(rustdoc::broken_intra_doc_links)]` on by default Fix this by making the intra-doc link conditional on CONFIG_DRM being enabled. Fixes: d6e26c1ae4a6 ("device: rust: expand documentation for Device") Suggested-by: Alice Ryhl Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508261644.9LclwUgt-lkp@intel.com/ Reviewed-by: Alice Ryhl Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250829195745.31174-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit ba1e9421cf1a8369d25c3832439702a015d6b5f9 Author: Liu Jian Date: Thu Aug 28 20:41:17 2025 +0800 net/smc: fix one NULL pointer dereference in smc_ib_is_sg_need_sync() BUG: kernel NULL pointer dereference, address: 00000000000002ec PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP PTI CPU: 28 UID: 0 PID: 343 Comm: kworker/28:1 Kdump: loaded Tainted: G OE 6.17.0-rc2+ #9 NONE Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014 Workqueue: smc_hs_wq smc_listen_work [smc] RIP: 0010:smc_ib_is_sg_need_sync+0x9e/0xd0 [smc] ... Call Trace: smcr_buf_map_link+0x211/0x2a0 [smc] __smc_buf_create+0x522/0x970 [smc] smc_buf_create+0x3a/0x110 [smc] smc_find_rdma_v2_device_serv+0x18f/0x240 [smc] ? smc_vlan_by_tcpsk+0x7e/0xe0 [smc] smc_listen_find_device+0x1dd/0x2b0 [smc] smc_listen_work+0x30f/0x580 [smc] process_one_work+0x18c/0x340 worker_thread+0x242/0x360 kthread+0xe7/0x220 ret_from_fork+0x13a/0x160 ret_from_fork_asm+0x1a/0x30 If the software RoCE device is used, ibdev->dma_device is a null pointer. As a result, the problem occurs. Null pointer detection is added to prevent problems. Fixes: 0ef69e788411c ("net/smc: optimize for smc_sndbuf_sync_sg_for_device and smc_rmb_sync_sg_for_cpu") Signed-off-by: Liu Jian Reviewed-by: Guangguan Wang Reviewed-by: Zhu Yanjun Reviewed-by: D. Wythe Link: https://patch.msgid.link/20250828124117.2622624-1-liujian56@huawei.com Signed-off-by: Paolo Abeni commit e51bd0e595476c1527bb0b4def095a6fd16b2563 Author: Xing Guo Date: Wed Aug 13 11:16:47 2025 +0800 selftests/fs/mount-notify: Fix compilation failure. Commit c6d9775c2066 ("selftests/fs/mount-notify: build with tools include dir") introduces the struct __kernel_fsid_t to decouple dependency with headers_install. The commit forgets to define a macro for __kernel_fsid_t and it will cause type re-definition issue. Signed-off-by: Xing Guo Link: https://lore.kernel.org/20250813031647.96411-1-higuoxing@gmail.com Acked-by: Amir Goldstein Closes: https://lore.kernel.org/oe-lkp/202508110628.65069d92-lkp@intel.com Signed-off-by: Christian Brauner commit 7e2368a21741e2db542330b32aa6fdd8908e7cff Author: Baochen Qiang Date: Thu Aug 28 16:17:33 2025 +0800 dma-debug: don't enforce dma mapping check on noncoherent allocations As discussed in [1], there is no need to enforce dma mapping check on noncoherent allocations, a simple test on the returned CPU address is good enough. Add a new pair of debug helpers and use them for noncoherent alloc/free to fix this issue. Fixes: efa70f2fdc84 ("dma-mapping: add a new dma_alloc_pages API") Link: https://lore.kernel.org/all/ff6c1fe6-820f-4e58-8395-df06aa91706c@oss.qualcomm.com # 1 Signed-off-by: Baochen Qiang Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20250828-dma-debug-fix-noncoherent-dma-check-v1-1-76e9be0dd7fc@oss.qualcomm.com commit e63419dbf2ceb083c1651852209c7f048089ac0f Author: Anders Roxell Date: Sat Aug 30 11:49:53 2025 +0200 dmaengine: ti: edma: Fix memory allocation size for queue_priority_map Fix a critical memory allocation bug in edma_setup_from_hw() where queue_priority_map was allocated with insufficient memory. The code declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8), but allocated memory using sizeof(s8) instead of the correct size. This caused out-of-bounds memory writes when accessing: queue_priority_map[i][0] = i; queue_priority_map[i][1] = i; The bug manifested as kernel crashes with "Oops - undefined instruction" on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the memory corruption triggered kernel hardening features on Clang. Change the allocation to use sizeof(*queue_priority_map) which automatically gets the correct size for the 2D array structure. Fixes: 2b6b3b742019 ("ARM/dmaengine: edma: Merge the two drivers under drivers/dma/") Signed-off-by: Anders Roxell Link: https://lore.kernel.org/r/20250830094953.3038012-1-anders.roxell@linaro.org Signed-off-by: Vinod Koul commit dcc6785caffad27f2ea601fdd2f9782036e1faed Author: Nicolas Frattaroli Date: Tue Aug 26 10:08:36 2025 +0200 arm64: dts: rockchip: fix second M.2 slot on ROCK 5T The Radxa ROCK 5T has two M.2 slots, much like the Radxa Rock 5B+. As it stands, the board won't be able to use PCIe3 if the second M.2 slot is in use. Fix this by adding the necessary node enablement and data-lanes property to the ROCK 5T device tree, mirroring what's in the ROCK 5B+ device tree. Reported-by: FUKAUMI Naoki Closes: https://libera.catirclogs.org/linux-rockchip/2025-08-25#38610630; Fixes: 0ea651de9b79 ("arm64: dts: rockchip: add ROCK 5T device tree") Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250826-rock5t-second-m2-fix-v1-1-8252124f9cc8@collabora.com Signed-off-by: Heiko Stuebner commit c873ccbb2f8db46ad9b4a989ea924b6d8f19abf1 Author: Gu Bowen Date: Fri Aug 22 15:35:41 2025 +0800 mm: fix possible deadlock in kmemleak There are some AA deadlock issues in kmemleak, similar to the situation reported by Breno [1]. The deadlock path is as follows: mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); To solve this problem, switch to printk_safe mode before printing warning message, this will redirect all printk()-s to a special per-CPU buffer, which will be flushed later from a safe context (irq work), and this deadlock problem can be avoided. The proper API to use should be printk_deferred_enter()/printk_deferred_exit() [2]. Another way is to place the warn print after kmemleak is released. Link: https://lkml.kernel.org/r/20250822073541.1886469-1-gubowen5@huawei.com Link: https://lore.kernel.org/all/20250731-kmemleak_lock-v1-1-728fd470198f@debian.org/#t [1] Link: https://lore.kernel.org/all/5ca375cd-4a20-4807-b897-68b289626550@redhat.com/ [2] Signed-off-by: Gu Bowen Reviewed-by: Waiman Long Reviewed-by: Catalin Marinas Reviewed-by: Breno Leitao Cc: Greg Kroah-Hartman Cc: John Ogness Cc: Lu Jialin Cc: Petr Mladek Cc: Signed-off-by: Andrew Morton commit 4de51e81379aa3acbceddb7aec18a36b733fb6cb Merge: 7446284023e8ef 431f6c88cb5d2d Author: Mark Brown Date: Mon Sep 1 23:47:23 2025 +0100 spi: spi-fsl-lpspi: Generic fixes and support for Merge series from James Clark : Various fixes for LPSI along with some refactorings. None of the fixes are strictly related to S32G, however these changes all originate from the work to support S32G devices. The only commits that are strictly related are for the new s32g2 and s32g3 compatible strings. commit aca701c61822d996f38b328d38d3b5d62a9f49b5 Merge: 030e1c45666629 d77b6ff0ce35a6 Author: Jakub Kicinski Date: Mon Sep 1 13:35:36 2025 -0700 Merge tag 'batadv-net-pullrequest-20250901' of https://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== Here is a batman-adv bugfix: - fix OOB read/write in network-coding decode, by Stanislav Fort * tag 'batadv-net-pullrequest-20250901' of https://git.open-mesh.org/linux-merge: batman-adv: fix OOB read/write in network-coding decode ==================== Link: https://patch.msgid.link/ Signed-off-by: Jakub Kicinski commit 030e1c45666629f72d0fc1d040f9d2915680de8e Author: Sabrina Dubroca Date: Fri Aug 29 20:55:40 2025 +0200 macsec: read MACSEC_SA_ATTR_PN with nla_get_uint The code currently reads both U32 attributes and U64 attributes as U64, so when a U32 attribute is provided by userspace (ie, when not using XPN), on big endian systems, we'll load that value into the upper 32bits of the next_pn field instead of the lower 32bits. This means that the value that userspace provided is ignored (we only care about the lower 32bits for non-XPN), and we'll start using PNs from 0. Switch to nla_get_uint, which will read the value correctly on all arches, whether it's 32b or 64b. Fixes: 48ef50fa866a ("macsec: Netlink support of XPN cipher suites (IEEE 802.1AEbw)") Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Link: https://patch.msgid.link/1c1df1661b89238caf5beefb84a10ebfd56c66ea.1756459839.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski commit 6bc8a5098bf4a365c4086a4a4130bfab10a58260 Author: Sean Anderson Date: Fri Aug 29 10:35:21 2025 -0400 net: macb: Fix tx_ptr_lock locking macb_start_xmit and macb_tx_poll can be called with bottom-halves disabled (e.g. from softirq) as well as with interrupts disabled (with netpoll). Because of this, all other functions taking tx_ptr_lock must use spin_lock_irqsave. Fixes: 138badbc21a0 ("net: macb: use NAPI for TX completion path") Reported-by: Mike Galbraith Signed-off-by: Sean Anderson Link: https://patch.msgid.link/20250829143521.1686062-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski commit b434a3772dca1c90a40e8ec69230caa55c18ef84 Author: Kohei Enju Date: Fri Aug 29 15:48:42 2025 +0900 docs: remove obsolete description about threaded NAPI Commit 2677010e7793 ("Add support to set NAPI threaded for individual NAPI") introduced threaded NAPI configuration per individual NAPI instance, however obsolete description that threaded NAPI is per device has remained. Remove the old description and clarify that only NAPI instances running in threaded mode spawn kernel threads by changing "Each NAPI instance" to "Each threaded NAPI instance". Signed-off-by: Kohei Enju Reviewed-by: Samiullah Khawaja Link: https://patch.msgid.link/20250829064857.51503-1-enjuk@amazon.com Signed-off-by: Jakub Kicinski commit e580beaf43d563aaf457f1c7f934002355ebfe7b Author: Miaoqian Lin Date: Thu Aug 28 20:18:58 2025 +0800 eth: mlx4: Fix IS_ERR() vs NULL check bug in mlx4_en_create_rx_ring Replace NULL check with IS_ERR() check after calling page_pool_create() since this function returns error pointers (ERR_PTR). Using NULL check could lead to invalid pointer dereference. Fixes: 8533b14b3d65 ("eth: mlx4: create a page pool for Rx") Signed-off-by: Miaoqian Lin Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250828121858.67639-1-linmq006@gmail.com Signed-off-by: Jakub Kicinski commit c6dd1aa2cbb72b33e0569f3e71d95792beab5042 Author: Fabian Bläse Date: Thu Aug 28 11:14:35 2025 +0200 icmp: fix icmp_ndo_send address translation for reply direction The icmp_ndo_send function was originally introduced to ensure proper rate limiting when icmp_send is called by a network device driver, where the packet's source address may have already been transformed by SNAT. However, the original implementation only considers the IP_CT_DIR_ORIGINAL direction for SNAT and always replaced the packet's source address with that of the original-direction tuple. This causes two problems: 1. For SNAT: Reply-direction packets were incorrectly translated using the source address of the CT original direction, even though no translation is required. 2. For DNAT: Reply-direction packets were not handled at all. In DNAT, the original direction's destination is translated. Therefore, in the reply direction the source address must be set to the reply-direction source, so rate limiting works as intended. Fix this by using the connection direction to select the correct tuple for source address translation, and adjust the pre-checks to handle reply-direction packets in case of DNAT. Additionally, wrap the `ct->status` access in READ_ONCE(). This avoids possible KCSAN reports about concurrent updates to `ct->status`. Fixes: 0b41713b6066 ("icmp: introduce helper for nat'd source address in network device context") Signed-off-by: Fabian Bläse Cc: Jason A. Donenfeld Reviewed-by: Florian Westphal Signed-off-by: Jakub Kicinski commit 7000f4fa9b24ae2511b07babd0d49e888db5d265 Author: Alok Tiwari Date: Fri Aug 29 23:23:27 2025 -0700 bnxt_en: fix incorrect page count in RX aggr ring log The warning in bnxt_alloc_one_rx_ring_netmem() reports the number of pages allocated for the RX aggregation ring. However, it mistakenly used bp->rx_ring_size instead of bp->rx_agg_ring_size, leading to confusing or misleading log output. Use the correct bp->rx_agg_ring_size value to fix this. Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") Signed-off-by: Alok Tiwari Reviewed-by: Jacob Keller Reviewed-by: Michael Chan Reviewed-by: Somnath Kotur Link: https://patch.msgid.link/20250830062331.783783-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 49c2502b5946ebf454d7e16fd0189769a82b6117 Author: Jakub Kicinski Date: Sat Aug 30 11:38:42 2025 -0700 selftests: drv-net: csum: fix interface name for remote host Use cfg.remote_ifname for arguments of remote command. Without this UDP tests fail in NIPA where local interface is called enp1s0 and remote enp0s4. Fixes: 1d0dc857b5d8 ("selftests: drv-net: add checksum tests") Reviewed-by: Willem de Bruijn Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250830183842.688935-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 0dffd938db37333bd7cc4946feb8c2c5262197ad Merge: 788bc43d833051 862c628108562d Author: Jakub Kicinski Date: Mon Sep 1 12:32:05 2025 -0700 Merge tag 'for-net-2025-08-29' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - vhci: Prevent use-after-free by removing debugfs files early - L2CAP: Fix use-after-free in l2cap_sock_cleanup_listen() * tag 'for-net-2025-08-29' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() Bluetooth: vhci: Prevent use-after-free by removing debugfs files early ==================== Link: https://patch.msgid.link/20250829191210.1982163-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 6cb8c1f957f674ca20b7d7c96b1f1bb11b83b679 Author: Stephan Gerhold Date: Thu Aug 21 10:01:47 2025 +0200 phy: qcom: qmp-pcie: Fix PHY initialization when powered down by firmware Commit 0cc22f5a861c ("phy: qcom: qmp-pcie: Add PHY register retention support") added support for using the "no_csr" reset to skip configuration of the PHY if the init sequence was already applied by the boot firmware. The expectation is that the PHY is only turned on/off by using the "no_csr" reset, instead of powering it down and re-programming it after a full reset. The boot firmware on X1E does not fully conform to this expectation: If the PCIe3 link fails to come up (e.g. because no PCIe card is inserted), the firmware powers down the PHY using the QPHY_PCS_POWER_DOWN_CONTROL register. The QPHY_START_CTRL register is kept as-is, so the driver assumes the PHY is already initialized and skips the configuration/power up sequence. The PHY won't come up again without clearing the QPHY_PCS_POWER_DOWN_CONTROL, so eventually initialization fails: qcom-qmp-pcie-phy 1be0000.phy: phy initialization timed-out phy phy-1be0000.phy.0: phy poweron failed --> -110 qcom-pcie 1bd0000.pcie: cannot initialize host qcom-pcie 1bd0000.pcie: probe with driver qcom-pcie failed with error -110 This can be reliably reproduced on the X1E CRD, QCP and Devkit when no card is inserted for PCIe3. Fix this by checking the QPHY_PCS_POWER_DOWN_CONTROL register in addition to QPHY_START_CTRL. If the PHY is powered down with the register, it doesn't conform to the expectations for using the "no_csr" reset, so we fully re-initialize with the normal reset sequence. Also check the register more carefully to ensure all of the bits we expect are actually set. A simple !!(readl()) is not enough, because the PHY might be only partially set up with some of the expected bits set. Cc: stable@vger.kernel.org Fixes: 0cc22f5a861c ("phy: qcom: qmp-pcie: Add PHY register retention support") Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250821-phy-qcom-qmp-pcie-nocsr-fix-v3-1-4898db0cc07c@linaro.org Signed-off-by: Vinod Koul commit a22d3b0d49d411e64ed07e30c2095035ecb30ed2 Author: Michael Walle Date: Tue Aug 19 08:56:22 2025 +0200 phy: ti: gmii-sel: Always write the RGMII ID setting Some SoCs are just validated with the TX delay enabled. With commit ca13b249f291 ("net: ethernet: ti: am65-cpsw: fixup PHY mode for fixed RGMII TX delay"), the network driver will patch the delay setting on the fly assuming that the TX delay setting is fixed. In reality, the TX delay is configurable and just skipped in the documentation. There are bootloaders, which will disable the TX delay and this will lead to a transmit path which doesn't add any delays at all. Fix that by always writing the RGMII_ID setting and report an error for unsupported RGMII delay modes. This is safe to do and shouldn't break any boards in mainline because the fixed delay is only introduced for gmii-sel compatibles which are used together with the am65-cpsw-nuss driver and also contains the commit above. Fixes: ca13b249f291 ("net: ethernet: ti: am65-cpsw: fixup PHY mode for fixed RGMII TX delay") Signed-off-by: Michael Walle Reviewed-by: Maxime Chevallier Link: https://lore.kernel.org/r/20250819065622.1019537-1-mwalle@kernel.org Signed-off-by: Vinod Koul commit c2623573178bab32990695fb729e9b69710ed66d Author: Guenter Roeck Date: Fri Aug 29 11:51:20 2025 -0700 hwmon: (ina238) Correctly clamp power limits ina238_write_power() was attempting to clamp the user input but was throwing away the result. Ensure that we clamp the value to the appropriate range before it is converted into a register value. Fixes: 0d9f596b1fe34 ("hwmon: (ina238) Modify the calculation formula to adapt to different chips") Cc: Wenliang Yan Cc: Chris Packham Signed-off-by: Guenter Roeck commit bd7e7bc2cc2024035dfbc8239c9f4d8675793445 Author: Guenter Roeck Date: Fri Aug 29 06:49:51 2025 -0700 hwmon: (ina238) Correctly clamp shunt voltage limit When clamping a register value, the result needs to be masked against the register size. This was missing, resulting in errors when trying to write negative limits. Fix by masking the clamping result against the register size. Fixes: eacb52f010a80 ("hwmon: Driver for Texas Instruments INA238") Cc: Nathan Rossi Cc: Chris Packham Signed-off-by: Guenter Roeck commit 9b17d3724df55ecc2bc67978822585f2b023be48 Author: Charles Keepax Date: Thu Aug 21 09:26:39 2025 +0100 ASoC: wm8974: Correct PLL rate rounding Using a single value of 22500000 for both 48000Hz and 44100Hz audio will sometimes result in returning wrong dividers due to rounding. Update the code to use the actual value for both. Fixes: 51b2bb3f2568 ("ASoC: wm8974: configure pll and mclk divider automatically") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20250821082639.1301453-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit b4799520dcd6fe1e14495cecbbe9975d847cd482 Author: Charles Keepax Date: Thu Aug 21 09:26:38 2025 +0100 ASoC: wm8940: Correct typo in control name Fixes: 0b5e92c5e020 ("ASoC WM8940 Driver") Reported-by: Ankur Tyagi Signed-off-by: Charles Keepax Tested-by: Ankur Tyagi Link: https://patch.msgid.link/20250821082639.1301453-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit d05afb53c683ef7ed1228b593c3360f4d3126c58 Author: Charles Keepax Date: Thu Aug 21 09:26:37 2025 +0100 ASoC: wm8940: Correct PLL rate rounding Using a single value of 22500000 for both 48000Hz and 44100Hz audio will sometimes result in returning wrong dividers due to rounding. Update the code to use the actual value for both. Fixes: 294833fc9eb4 ("ASoC: wm8940: Rewrite code to set proper clocks") Reported-by: Ankur Tyagi Signed-off-by: Charles Keepax Tested-by: Ankur Tyagi Link: https://patch.msgid.link/20250821082639.1301453-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 7446284023e8ef694fb392348185349c773eefb3 Author: Khairul Anuar Romli Date: Tue Aug 26 08:33:58 2025 +0800 spi: cadence-quadspi: Implement refcount to handle unbind during busy driver support indirect read and indirect write operation with assumption no force device removal(unbind) operation. However force device removal(removal) is still available to root superuser. Unbinding driver during operation causes kernel crash. This changes ensure driver able to handle such operation for indirect read and indirect write by implementing refcount to track attached devices to the controller and gracefully wait and until attached devices remove operation completed before proceed with removal operation. Signed-off-by: Khairul Anuar Romli Reviewed-by: Matthew Gerlach Reviewed-by: Niravkumar L Rabara Link: https://patch.msgid.link/8704fd6bd2ff4d37bba4a0eacf5eba3ba001079e.1756168074.git.khairul.anuar.romli@altera.com Signed-off-by: Mark Brown commit 431f6c88cb5d2d62d579d4d78f5c1a2583465ffb Author: Larisa Grigore Date: Thu Aug 28 11:14:48 2025 +0100 spi: spi-fsl-lpspi: Add compatible for S32G S32G doesn't have the max prescale erratum (default) and it can query the max number of CS from hardware, so add those settings. Signed-off-by: Larisa Grigore Signed-off-by: Ciprian Marian Costea Signed-off-by: James Clark Reviewed-by: Frank Li Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-9-6262b9aa9be4@linaro.org Signed-off-by: Mark Brown commit 41c91c2eed83cb93781078108077b7e34f867fc2 Author: James Clark Date: Thu Aug 28 11:14:47 2025 +0100 spi: spi-fsl-lpspi: Parameterize reading num-cs from hardware Add query_hw_for_num_cs in devtype to avoid directly checking compatible string "fsl,imx93-spi". No functionality change. Signed-off-by: James Clark Reviewed-by: Frank Li Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-8-6262b9aa9be4@linaro.org Signed-off-by: Mark Brown commit 9bbfb1ec959ce95f91cfab544f705e5257be3be1 Author: James Clark Date: Thu Aug 28 11:14:46 2025 +0100 spi: spi-fsl-lpspi: Treat prescale_max == 0 as no erratum This erratum only ever results in a max value of 1, otherwise the full 3 bits are available. To avoid repeating the same default prescale value for every new device's devdata, treat 0 as no limit (7) and only set a value when the erratum is present. Change the field to be 3 bits to catch out of range definitions. No functionality change. Signed-off-by: James Clark Reviewed-by: Frank Li Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-7-6262b9aa9be4@linaro.org Signed-off-by: Mark Brown commit fb4273faa4d0eeca8cb7265531d48eb084bcceea Author: James Clark Date: Thu Aug 28 11:14:45 2025 +0100 spi: spi-fsl-lpspi: Constify devtype datas Add const for all devtype_data. Signed-off-by: James Clark Reviewed-by: Frank Li Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-6-6262b9aa9be4@linaro.org Signed-off-by: Mark Brown commit b663fd4532699cc24f5d1094f3859198ee1ed4b6 Author: Larisa Grigore Date: Thu Aug 28 11:14:44 2025 +0100 dt-bindings: lpspi: Document support for S32G Add compatible strings 'nxp,s32g2-lpspi' and 'nxp,s32g3-lpspi' for S32G2 and S32G3. Require nxp,s32g3-lpspi to fallback to nxp,s32g2-lpspi since they are currently compatible. Signed-off-by: Larisa Grigore Signed-off-by: James Clark Reviewed-by: Rob Herring (Arm) Reviewed-by: Frank Li Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-5-6262b9aa9be4@linaro.org Signed-off-by: Mark Brown commit dedf9c93dece441e9a0a4836458bc93677008ddd Author: Larisa Grigore Date: Thu Aug 28 11:14:43 2025 +0100 spi: spi-fsl-lpspi: Clear status register after disabling the module Clear the error flags after disabling the module to avoid the case when a flag is set again between flag clear and module disable. And use SR_CLEAR_MASK to replace hardcoded value for improved readability. Although fsl_lpspi_reset() was only introduced in commit a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer"), the original driver only reset SR in the interrupt handler, making it vulnerable to the same issue. Therefore the fixes commit is set at the introduction of the driver. Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") Signed-off-by: Larisa Grigore Signed-off-by: Ciprian Marian Costea Reviewed-by: Frank Li Signed-off-by: James Clark Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-4-6262b9aa9be4@linaro.org Signed-off-by: Mark Brown commit e811b088a3641861fc9d2b2b840efc61a0f1907d Author: Larisa Grigore Date: Thu Aug 28 11:14:42 2025 +0100 spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort In DMA mode fsl_lpspi_reset() is always called at the end, even when the transfer is aborted. In PIO mode aborts skip the reset leaving the FIFO filled and the module enabled. Fix it by always calling fsl_lpspi_reset(). Fixes: a15dc3d657fa ("spi: lpspi: Fix CLK pin becomes low before one transfer") Signed-off-by: Larisa Grigore Reviewed-by: Frank Li Signed-off-by: James Clark Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-3-6262b9aa9be4@linaro.org Signed-off-by: Mark Brown commit cbe33705864ba2697a2939de715b81538cf32430 Author: Larisa Grigore Date: Thu Aug 28 11:14:41 2025 +0100 spi: spi-fsl-lpspi: Set correct chip-select polarity bit The driver currently supports multiple chip-selects, but only sets the polarity for the first one (CS 0). Fix it by setting the PCSPOL bit for the desired chip-select. Fixes: 5314987de5e5 ("spi: imx: add lpspi bus driver") Signed-off-by: Larisa Grigore Signed-off-by: James Clark Reviewed-by: Frank Li Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-2-6262b9aa9be4@linaro.org Signed-off-by: Mark Brown commit 782a7c73078e1301c0c427f21c06377d77dfa541 Author: Larisa Grigore Date: Thu Aug 28 11:14:40 2025 +0100 spi: spi-fsl-lpspi: Fix transmissions when using CONT Commit 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT") breaks transmissions when CONT is used. The TDIE interrupt should not be disabled in all cases. If CONT is used and the TX transfer is not yet completed yet, but the interrupt handler is called because there are characters to be received, TDIE is replaced with FCIE. When the transfer is finally completed, SR_TDF is set but the interrupt handler isn't called again. Fixes: 6a130448498c ("spi: lpspi: Fix wrong transmission when don't use CONT") Signed-off-by: Larisa Grigore Signed-off-by: James Clark Reviewed-by: Frank Li Link: https://patch.msgid.link/20250828-james-nxp-lpspi-v2-1-6262b9aa9be4@linaro.org Signed-off-by: Mark Brown commit f54d87dad7619c8026e95b848d6ef677b9f2b55f Author: Shuming Fan Date: Mon Sep 1 16:57:57 2025 +0800 ASoC: rt712: avoid skipping the blind write Some devices might not use the DMIC function of the RT712VB. Therefore, this patch avoids skipping the blind write with RT712VB. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20250901085757.1287945-1-shumingf@realtek.com Signed-off-by: Mark Brown commit bcd6659d4911c528381531472a0cefbd4003e29e Author: Takashi Iwai Date: Mon Sep 1 13:50:08 2025 +0200 ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model It was reported that HP EliteDesk 800 G4 DM 65W (SSID 103c:845a) needs the similar quirk for enabling HDMI outputs, too. This patch adds the corresponding quirk entry. Cc: Link: https://patch.msgid.link/20250901115009.27498-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit cc8e91054c0a778074ecffaf12bd0944e884d71c Author: Tina Wuest Date: Mon Sep 1 12:20:24 2025 +0300 ALSA: usb-audio: Allow Focusrite devices to use low samplerates Commit 05f254a6369ac020fc0382a7cbd3ef64ad997c92 ("ALSA: usb-audio: Improve filtering of sample rates on Focusrite devices") changed the check for max_rate in a way which was overly restrictive, forcing devices to use very high samplerates if they support them, despite support existing for lower rates as well. This maintains the intended outcome (ensuring samplerates selected are supported) while allowing devices with higher maximum samplerates to be opened at all supported samplerates. This patch was tested with a Clarett+ 8Pre USB Fixes: 05f254a6369a ("ALSA: usb-audio: Improve filtering of sample rates on Focusrite devices") Signed-off-by: Tina Wuest Link: https://patch.msgid.link/20250901092024.140993-1-tina@wuest.me Signed-off-by: Takashi Iwai commit e23654f5b12b1aa3384d0565ce1eb5ff860a5592 Merge: bb585591ebf00f 9d81ba6d49a745 Author: Christian Brauner Date: Mon Sep 1 12:47:05 2025 +0200 Merge tag 'fuse-fixes-6.17-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse into vfs.fixes fuse fixes for 6.17-rc5 * tag 'fuse-fixes-6.17-rc5' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse: (6 commits) fuse: Block access to folio overlimit fuse: fix fuseblk i_blkbits for iomap partial writes fuse: reflect cached blocksize if blocksize was changed fuse: prevent overflow in copy_file_range return value fuse: check if copy_file_range() returns larger than requested size fuse: do not allow mapping a non-regular backing file Link: https://lore.kernel.org/CAJfpeguEVMMyw_zCb+hbOuSxdE2Z3Raw=SJsq=Y56Ae6dn2W3g@mail.gmail.com Signed-off-by: Christian Brauner commit 63ddc0a75b3b071f04f4bc277b2510eb06d21648 Author: Nicolas Frattaroli Date: Mon Aug 25 09:27:08 2025 +0200 arm64: dts: rockchip: fix USB on RADXA ROCK 5T The RADXA ROCK 5T board uses the same GPIO pin for controlling the USB host port regulator. This control pin was mistakenly left out of the ROCK 5T device tree. Reported-by: FUKAUMI Naoki Closes: https://libera.catirclogs.org/linux-rockchip/2025-08-25#38609886; Fixes: 0ea651de9b79 ("arm64: dts: rockchip: add ROCK 5T device tree") Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250825-rock5t-usb-fix-v1-1-de71954a1bb5@collabora.com Signed-off-by: Heiko Stuebner commit 69a79ada8eb034ce016b5b78fb7d08d8687223de Author: Karol Wachowski Date: Fri Aug 8 13:09:39 2025 +0200 accel/ivpu: Prevent recovery work from being queued during device removal Use disable_work_sync() instead of cancel_work_sync() in ivpu_dev_fini() to ensure that no new recovery work items can be queued after device removal has started. Previously, recovery work could be scheduled even after canceling existing work, potentially leading to use-after-free bugs if recovery accessed freed resources. Rename ivpu_pm_cancel_recovery() to ivpu_pm_disable_recovery() to better reflect its new behavior. Fixes: 58cde80f45a2 ("accel/ivpu: Use dedicated work for job timeout detection") Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Karol Wachowski Reviewed-by: Lizhi Hou Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250808110939.328366-1-jacek.lawrynowicz@linux.intel.com commit 750b54513f69f1046895346ea97cc3d96584355e Author: Sebastian Reichel Date: Mon Aug 18 23:08:04 2025 +0200 MAINTAINERS: exclude defconfig from ARM64 PORT Patches for the arm64 defconfig are supposed to be sent to the SoC maintainers (e.g. a change in the generic arm64 defconfig required for Rockchip devices should be send to Heiko Stübner as he is listed as maintainer for "ARM/Rockchip SoC support") and not the ARM64 PORT maintainers. While we cannot easily describe this in MAINTAINERS, we can at least stop it from giving false information and make it behave the same way as for the MAINTAINERS file itself (which basically has the same rules), so that it just outputs the LKML for the ARM64 defconfig. Signed-off-by: Sebastian Reichel Acked-by: Will Deacon Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250818-arm64-defconfig-v1-1-f589553c3d72@collabora.com Signed-off-by: Arnd Bergmann commit 75e81743e3815a934f5ec688a9837bc5fa56dbb3 Author: Harshit Shah Date: Thu Aug 28 11:27:49 2025 -0700 arm64: dts: axiado: Add missing UART aliases Axiado AX3000 EVK has total of 4 UART ports. Add missing alias for uart0, uart1, uart2. This fixes the probe failures on the remaining UARTs. Fixes: 1f7055779001 ("arm64: dts: axiado: Add initial support for AX3000 SoC and eval board") Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit 850470a8413a8a78e772c4f6bd9fe81ec6bd5b0f Author: yangshiguang Date: Sat Aug 30 10:09:46 2025 +0800 mm: slub: avoid wake up kswapd in set_track_prepare set_track_prepare() can incur lock recursion. The issue is that it is called from hrtimer_start_range_ns holding the per_cpu(hrtimer_bases)[n].lock, but when enabled CONFIG_DEBUG_OBJECTS_TIMERS, may wake up kswapd in set_track_prepare, and try to hold the per_cpu(hrtimer_bases)[n].lock. Avoid deadlock caused by implicitly waking up kswapd by passing in allocation flags, which do not contain __GFP_KSWAPD_RECLAIM in the debug_objects_fill_pool() case. Inside stack depot they are processed by gfp_nested_mask(). Since ___slab_alloc() has preemption disabled, we mask out __GFP_DIRECT_RECLAIM from the flags there. The oops looks something like: BUG: spinlock recursion on CPU#3, swapper/3/0 lock: 0xffffff8a4bf29c80, .magic: dead4ead, .owner: swapper/3/0, .owner_cpu: 3 Hardware name: Qualcomm Technologies, Inc. Popsicle based on SM8850 (DT) Call trace: spin_bug+0x0 _raw_spin_lock_irqsave+0x80 hrtimer_try_to_cancel+0x94 task_contending+0x10c enqueue_dl_entity+0x2a4 dl_server_start+0x74 enqueue_task_fair+0x568 enqueue_task+0xac do_activate_task+0x14c ttwu_do_activate+0xcc try_to_wake_up+0x6c8 default_wake_function+0x20 autoremove_wake_function+0x1c __wake_up+0xac wakeup_kswapd+0x19c wake_all_kswapds+0x78 __alloc_pages_slowpath+0x1ac __alloc_pages_noprof+0x298 stack_depot_save_flags+0x6b0 stack_depot_save+0x14 set_track_prepare+0x5c ___slab_alloc+0xccc __kmalloc_cache_noprof+0x470 __set_page_owner+0x2bc post_alloc_hook[jt]+0x1b8 prep_new_page+0x28 get_page_from_freelist+0x1edc __alloc_pages_noprof+0x13c alloc_slab_page+0x244 allocate_slab+0x7c ___slab_alloc+0x8e8 kmem_cache_alloc_noprof+0x450 debug_objects_fill_pool+0x22c debug_object_activate+0x40 enqueue_hrtimer[jt]+0xdc hrtimer_start_range_ns+0x5f8 ... Signed-off-by: yangshiguang Fixes: 5cf909c553e9 ("mm/slub: use stackdepot to save stack trace in objects") Cc: stable@vger.kernel.org Signed-off-by: Vlastimil Babka commit 5c5a41a75452e9eb5810a7d0d9916b61fe9fd1c5 Author: Danilo Krummrich Date: Fri Aug 29 00:39:40 2025 +0200 gpu: nova-core: depend on CONFIG_64BIT If built on architectures with CONFIG_ARCH_DMA_ADDR_T_64BIT=y nova-core produces that following build failures: error[E0308]: mismatched types --> drivers/gpu/nova-core/fb.rs:49:59 | 49 | hal::fb_hal(chipset).write_sysmem_flush_page(bar, page.dma_handle())?; | ----------------------- ^^^^^^^^^^^^^^^^^ expected `u64`, found `u32` | | | arguments to this method are incorrect | note: method defined here --> drivers/gpu/nova-core/fb/hal.rs:19:8 | 19 | fn write_sysmem_flush_page(&self, bar: &Bar0, addr: u64) -> Result; | ^^^^^^^^^^^^^^^^^^^^^^^ help: you can convert a `u32` to a `u64` | 49 | hal::fb_hal(chipset).write_sysmem_flush_page(bar, page.dma_handle().into())?; | +++++++ error[E0308]: mismatched types --> drivers/gpu/nova-core/fb.rs:65:47 | 65 | if hal.read_sysmem_flush_page(bar) == self.page.dma_handle() { | ------------------------------- ^^^^^^^^^^^^^^^^^^^^^^ expected `u64`, found `u32` | | | expected because this is `u64` | help: you can convert a `u32` to a `u64` | 65 | if hal.read_sysmem_flush_page(bar) == self.page.dma_handle().into() { | +++++++ error: this arithmetic operation will overflow --> drivers/gpu/nova-core/falcon.rs:469:23 | 469 | .set_base((dma_start >> 40) as u16) | ^^^^^^^^^^^^^^^^^ attempt to shift right by `40_i32`, which would overflow | = note: `#[deny(arithmetic_overflow)]` on by default This is due to the code making assumptions on the width of dma_addr_t to be 64 bit. While this could technically be handled, it is rather painful to deal with, as the following example illustrates: pub(super) fn read_sysmem_flush_page_ga100(bar: &Bar0) -> DmaAddress { let addr = u64::from(regs::NV_PFB_NISO_FLUSH_SYSMEM_ADDR::read(bar).adr_39_08()) << FLUSH_SYSMEM_ADDR_SHIFT | u64::from(regs::NV_PFB_NISO_FLUSH_SYSMEM_ADDR_HI::read(bar).adr_63_40()) << FLUSH_SYSMEM_ADDR_SHIFT_HI; addr.try_into().unwrap_or_else(|_| { kernel::warn_on!(true); 0 }) } At the same time there's not much value for nova-core to support 32-bit, given that the supported GPU architectures are Turing and later, hence depend on CONFIG_64BIT. Cc: John Hubbard Reported-by: Miguel Ojeda Closes: https://lore.kernel.org/lkml/20250828160247.37492-1-ojeda@kernel.org/ Fixes: 6554ad65b589 ("gpu: nova-core: register sysmem flush page") Fixes: 69f5cd67ce41 ("gpu: nova-core: add falcon register definitions and base code") Reviewed-by: Alexandre Courbot Reviewed-by: John Hubbard Link: https://lore.kernel.org/r/20250828223954.351348-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 3712ce9fa501617cdc4466d30ae3894d50887743 Author: Antheas Kapenekakis Date: Wed Aug 27 19:58:42 2025 +0200 gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-05 Same issue as G1619-04 in commit 805c74eac8cb ("gpiolib: acpi: Ignore touchpad wakeup on GPD G1619-04"), Strix Point lineup uses 05. Signed-off-by: Antheas Kapenekakis Reviewed-by: Mika Westerberg Reviewed-by: Mario Limonciello Signed-off-by: Andy Shevchenko commit e019bbd8e440fd5a47158e1e337d3731468620d5 Merge: 0aee6faf5b2e7e 37e5caa5571b5a Author: Arnd Bergmann Date: Mon Sep 1 10:41:20 2025 +0200 Merge tag 'imx-fixes-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes i.MX fixes for 6.17: - Correct FlexCAN PHY settings on imx95-19x19-evk board (Haibo Chen) - Add missing microSD slot supplies for DH electronics i.MX8M Plus boards (Marek Vasut) - Fix assigned clocks for JPEG encoder node on i.MX95 (Marek Vasut) - A couple of regulator setting fixes for imx8mp-tqma8mpql board (Markus Niebel) * tag 'imx-fixes-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: arm64: dts: imx95: Fix JPEG encoder node assigned clock arm64: dts: imx95-19x19-evk: correct the phy setting for flexcan1/2 arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM arm64: dts: imx8mp-tqma8mpql: remove virtual 3.3V regulator arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off Link: https://lore.kernel.org/r/aK6BuzIYwUBRU1GW@dragon Signed-off-by: Arnd Bergmann commit 0aee6faf5b2e7eacff632dc63bc9b25c5a19dd1d Author: Nobuhiro Iwamatsu Date: Mon Aug 25 11:05:56 2025 +0900 MAINTAINERS: Update Nobuhiro Iwamatsu's email address The company's email address has been changed, so update my email address in MAINTAINERS and .mailmap files. Signed-off-by: Nobuhiro Iwamatsu Signed-off-by: Arnd Bergmann commit 2050458610b50dc49d28341953b4ec1f7d54e612 Merge: 84bc3c0b584818 75dbd4304afe57 Author: Arnd Bergmann Date: Mon Sep 1 10:35:03 2025 +0200 Merge tag 'optee-typo-fix-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes OP-TEE driver fix for v6.17 Fixing a typo in a function name. * tag 'optee-typo-fix-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" Link: https://lore.kernel.org/r/20250819122917.GB3486750@rayden Signed-off-by: Arnd Bergmann commit 84bc3c0b584818c3f2e22ebf5bb179bda463d42f Merge: e6e709901c330a 50a74d0095cd23 Author: Arnd Bergmann Date: Mon Sep 1 10:34:33 2025 +0200 Merge tag 'tee-fixes-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes TEE fixes for v6.17 - Fixing a memory leak in the error path for tee_dyn_shm_alloc_helper() - Fixing a NULL pointer dereference in tee_shm_put() * tag 'tee-fixes-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee: tee: fix memory leak in tee_dyn_shm_alloc_helper tee: fix NULL pointer dereference in tee_shm_put Link: https://lore.kernel.org/r/20250819122641.GA3486750@rayden Signed-off-by: Arnd Bergmann commit e6e709901c330ac9bbcc05567d7702ee0f228f04 Merge: 1b237f190eb3d3 25daf9af0ac1bf Author: Arnd Bergmann Date: Mon Sep 1 10:08:39 2025 +0200 Merge tag 'qcom-drivers-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm driver fixes for v6.17-rc1 The recently extended sanity checks for the Qualcomm firmware files turned out to be too restrictive, preventing a variety of firmware images from being loaded. Adjust the checks to allow section header sizes of 0 when sections aren't used. * tag 'qcom-drivers-fixes-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: mdt_loader: Deal with zero e_shentsize Link: https://lore.kernel.org/r/20250811145613.120917-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit cd8ae32e4e4652db55bce6b9c79267d8946765a9 Author: Sabrina Dubroca Date: Fri Aug 29 10:54:15 2025 +0200 xfrm: xfrm_alloc_spi shouldn't use 0 as SPI x->id.spi == 0 means "no SPI assigned", but since commit 94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states and add them to the byspi list with this value. __xfrm_state_delete doesn't remove those states from the byspi list, since they shouldn't be there, and this shows up as a UAF the next time we go through the byspi list. Reported-by: syzbot+a25ee9d20d31e483ba7b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a25ee9d20d31e483ba7b Fixes: 94f39804d891 ("xfrm: Duplicate SPI Handling") Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit b5ee94ac651aa42612095c4a75ff7f5c47cd9315 Author: Philipp Kerling Date: Wed Aug 20 16:24:13 2025 +0200 ksmbd: allow a filename to contain colons on SMB3.1.1 posix extensions If the client sends SMB2_CREATE_POSIX_CONTEXT to ksmbd, allow the filename to contain a colon (':'). This requires disabling the support for Alternate Data Streams (ADS), which are denoted by a colon-separated suffix to the filename on Windows. This should not be an issue, since this concept is not known to POSIX anyway and the client has to explicitly request a POSIX context to get this behavior. Link: https://lore.kernel.org/all/f9401718e2be2ab22058b45a6817db912784ef61.camel@rx2.rx-server.de/ Signed-off-by: Philipp Kerling Acked-by: Namjae Jeon Signed-off-by: Steve French commit 6976c7a69dafbb34a0d4814e2def9d3d7114836d Author: Wang Zhaolong Date: Fri Aug 29 08:59:59 2025 +0800 smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show() Reading /proc/fs/cifs/open_dirs may hit a NULL dereference when tcon->cfids is NULL. Add NULL check before accessing cfids to prevent the crash. Reproduction: - Mount CIFS share - cat /proc/fs/cifs/open_dirs Fixes: 844e5c0eb176 ("smb3 client: add way to show directory leases for improved debugging") Signed-off-by: Wang Zhaolong Signed-off-by: Steve French commit b320789d6883cc00ac78ce83bccbfe7ed58afcf0 Author: Linus Torvalds Date: Sun Aug 31 15:33:07 2025 -0700 Linux 6.17-rc4 commit 8851e27d2cb947ea8bbbe8e812068f7bf5cbd00b Author: Miguel Ojeda Date: Fri Aug 29 21:55:25 2025 +0200 rust: support Rust >= 1.91.0 target spec Starting with Rust 1.91.0 (expected 2025-10-30), the target spec format has changed the type of the `target-pointer-width` key from string to integer [1]. Thus conditionally use one or the other depending on the version. Cc: Waffle Maybe Link: https://github.com/rust-lang/rust/pull/144443 [1] Link: https://lore.kernel.org/r/20250829195525.721664-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit c09461a0d24fba8a847a37a381626141da22d8ee Author: Alice Ryhl Date: Wed Aug 27 13:12:16 2025 +0000 rust: use the new name Location::file_as_c_str() in Rust >= 1.91.0 As part of the stabilization of Location::file_with_nul(), it was brought up that the with_nul() suffix usually means something else in Rust APIs, so the API is being renamed prior to stabilization [1]. Thus, use the new name on new rustc versions. Link: https://www.github.com/rust-lang/rust/pull/145928 [1] Signed-off-by: Alice Ryhl Reviewed-by: Boqun Feng Link: https://lore.kernel.org/r/20250827-file_as_c_str-v1-1-d3f5a3916a9c@google.com [ Kept `cfg` separation. Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 5c3b3264e5858813632031ba58bcd6e1eeb3b214 Merge: fe3ad7a58b5818 8b3641dfb6f902 Author: Linus Torvalds Date: Sun Aug 31 09:20:17 2025 -0700 Merge tag 'x86_urgent_for_v6.17_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Convert the SSB mitigation to the attack vector controls which got forgotten at the time - Prevent the CPUID topology hierarchy detection on AMD from overwriting the correct initial APIC ID - Fix the case of a machine shipping without microcode in the BIOS, in the AMD microcode loader - Correct the Pentium 4 model range which has a constant TSC * tag 'x86_urgent_for_v6.17_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Add attack vector controls for SSB x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON x86/microcode/AMD: Handle the case of no BIOS microcode x86/cpu/intel: Fix the constant_tsc model check for Pentium 4 commit fe3ad7a58b581859a1a7c237b670f8bcbf5b253c Merge: c9e4e96185f45f 52d15521eb75f9 Author: Linus Torvalds Date: Sun Aug 31 09:13:00 2025 -0700 Merge tag 'sched_urgent_for_v6.17_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler fixes from Borislav Petkov: - Fix a stall on the CPU offline path due to mis-counting a deadline server task twice as part of the runqueue's running tasks count - Fix a realtime tasks starvation case where failure to enqueue a timer whose expiration time is already in the past would cause repeated attempts to re-enqueue a deadline server task which leads to starving the former, realtime one - Prevent a delayed deadline server task stop from breaking the per-runqueue bandwidth tracking - Have a function checking whether the deadline server task has stopped, return the correct value * tag 'sched_urgent_for_v6.17_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: sched/deadline: Don't count nr_running for dl_server proxy tasks sched/deadline: Fix RT task potential starvation when expiry time passed sched/deadline: Always stop dl-server before changing parameters sched/deadline: Fix dl_server_stopped() commit c9e4e96185f45f410b3d0b09c9273c7da5a5c660 Merge: 9acd5b8bebea61 35c23871be0072 Author: Linus Torvalds Date: Sun Aug 31 09:07:37 2025 -0700 Merge tag 'irq_urgent_for_v6.17_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Remove unnecessary and noisy WARN_ONs in gic-v5's init path - Avoid a kmemleak false positive for the gic-v5's L2 IST table entries - Fix a retval check in mvebu-gicp's probe function - Fix a wrong conversion to guards in atmel-aic[5] irqchip * tag 'irq_urgent_for_v6.17_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/gic-v5: Remove undue WARN_ON()s in the IRS affinity parsing irqchip/gic-v5: Fix kmemleak L2 IST table entries false positives irqchip/mvebu-gicp: Fix an IS_ERR() vs NULL check in probe() irqchip/atmel-aic[5]: Fix incorrect lock guard conversion commit 9acd5b8bebea619d414cc6cccc7d13a4e6f02ec2 Merge: 1c99e3e9f33add 86a9b1250602d8 Author: Linus Torvalds Date: Sun Aug 31 08:56:45 2025 -0700 Merge tag 'hardening-v6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: - ARM: stacktrace: include asm/sections.h in asm/stacktrace.h (Arnd Bergmann) - ubsan: Fix incorrect hand-side used in handle (Junhui Pei) - hardening: Require clang 20.1.0 for __counted_by (Nathan Chancellor) * tag 'hardening-v6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: hardening: Require clang 20.1.0 for __counted_by ARM: stacktrace: include asm/sections.h in asm/stacktrace.h ubsan: Fix incorrect hand-side used in handle commit 1c99e3e9f33add5e193591e051735b1179a4382a Merge: c8bc81a52d5a2a 6fe31c8b530031 Author: Linus Torvalds Date: Sun Aug 31 08:49:55 2025 -0700 Merge tag 'gpio-fixes-for-v6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fixes from Bartosz Golaszewski: - fix an off-by-one bug in interrupt handling in gpio-timberdale - update MAINTAINERS * tag 'gpio-fixes-for-v6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: MAINTAINERS: Change Altera-PIO driver maintainer gpio: timberdale: fix off-by-one in IRQ type boundary check commit d77b6ff0ce35a6d0b0b7b9581bc3f76d041d4087 Author: Stanislav Fort Date: Sun Aug 31 16:56:23 2025 +0200 batman-adv: fix OOB read/write in network-coding decode batadv_nc_skb_decode_packet() trusts coded_len and checks only against skb->len. XOR starts at sizeof(struct batadv_unicast_packet), reducing payload headroom, and the source skb length is not verified, allowing an out-of-bounds read and a small out-of-bounds write. Validate that coded_len fits within the payload area of both destination and source sk_buffs before XORing. Fixes: 2df5278b0267 ("batman-adv: network coding - receive coded packets and decode them") Cc: stable@vger.kernel.org Reported-by: Stanislav Fort Signed-off-by: Stanislav Fort Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit d9b05321e21e4b218de4ce8a590bf375f58b6346 Author: Sebastian Andrzej Siewior Date: Fri Aug 22 16:12:38 2025 +0200 futex: Move futex_hash_free() back to __mmput() To avoid a memory leak via mm_alloc() + mmdrop() the futex cleanup code has been moved to __mmdrop(). This resulted in a warnings if the futex hash table has been allocated via vmalloc() the mmdrop() was invoked from atomic context. The free path must stay in __mmput() to ensure it is invoked from preemptible context. In order to avoid the memory leak, delay the allocation of mm_struct::mm->futex_ref to futex_hash_allocate(). This works because neither the per-CPU counter nor the private hash has been allocated and therefore - futex_private_hash() callers (such as exit_pi_state_list()) don't acquire reference if there is no private hash yet. There is also no reference put. - Regular callers (futex_hash()) fallback to global hash. No reference counting here. The futex_ref member can be allocated in futex_hash_allocate() before the private hash itself is allocated. This happens either while the first thread is created or on request. In both cases the process has just a single thread so there can be either futex operation in progress or the request to create a private hash. Move futex_hash_free() back to __mmput(); Move the allocation of mm_struct::futex_ref to futex_hash_allocate(). [ bp: Fold a follow-up fix to prevent a use-after-free: https://lore.kernel.org/r/20250830213806.sEKuuGSm@linutronix.de ] Fixes: e703b7e247503 ("futex: Move futex cleanup to __mmdrop()") Closes: https://lore.kernel.org/all/20250821102721.6deae493@kernel.org/ Reported-by: Jakub Kicinski Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Borislav Petkov (AMD) Link: https://lkml.kernel.org/r/20250822141238.PfnkTjFb@linutronix.de commit 708e2371f77a9d3f2f1d54d1ec835d71b9d0dafe Author: Ming Lei Date: Wed Aug 27 19:35:50 2025 +0800 scsi: sr: Reinstate rotational media flag Reinstate the rotational media flag for the CD-ROM driver. The flag has been cleared since commit bd4a633b6f7c ("block: move the nonrot flag to queue_limits") and this breaks some applications. Move queue limit configuration from get_sectorsize() to sr_revalidate_disk() and set the rotational flag. Cc: Christoph Hellwig Fixes: bd4a633b6f7c ("block: move the nonrot flag to queue_limits") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250827113550.2614535-1-ming.lei@redhat.com Signed-off-by: Martin K. Petersen commit 9dba9a45c348e8460da97c450cddf70b2056deb3 Author: John Evans Date: Thu Aug 28 12:40:08 2025 +0800 scsi: lpfc: Fix buffer free/clear order in deferred receive path Fix a use-after-free window by correcting the buffer release sequence in the deferred receive path. The code freed the RQ buffer first and only then cleared the context pointer under the lock. Concurrent paths (e.g., ABTS and the repost path) also inspect and release the same pointer under the lock, so the old order could lead to double-free/UAF. Note that the repost path already uses the correct pattern: detach the pointer under the lock, then free it after dropping the lock. The deferred path should do the same. Fixes: 472e146d1cf3 ("scsi: lpfc: Correct upcalling nvmet_fc transport during io done downcall") Cc: stable@vger.kernel.org Signed-off-by: John Evans Link: https://lore.kernel.org/r/20250828044008.743-1-evans1210144@gmail.com Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen commit c8bc81a52d5a2ac2e4b257ae123677cf94112755 Merge: 11e7861d680c37 d82aa5d3501b25 Author: Linus Torvalds Date: Sat Aug 30 10:43:53 2025 -0700 Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Catalin Marinas: - CFI failure due to kpti_ng_pgd_alloc() signature mismatch - Underallocation bug in the SVE ptrace kselftest * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: kselftest/arm64: Don't open code SVE_PT_SIZE() in fp-ptrace arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature commit d82aa5d3501b25bfb7bc2a24a68ad0a83b2ad10b Author: Mark Brown Date: Tue Aug 12 15:49:27 2025 +0100 kselftest/arm64: Don't open code SVE_PT_SIZE() in fp-ptrace In fp-trace when allocating a buffer to write SVE register data we open code the addition of the header size to the VL depeendent register data size, which lead to an underallocation bug when we cut'n'pasted the code for FPSIMD format writes. Use the SVE_PT_SIZE() macro that the kernel UAPI provides for this. Fixes: b84d2b27954f ("kselftest/arm64: Test FPSIMD format data writes via NT_ARM_SVE in fp-ptrace") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250812-arm64-fp-trace-macro-v1-1-317cfff986a5@kernel.org Signed-off-by: Catalin Marinas commit ceca927c86e6f72f72d45487a34368bc9509431d Author: Kees Cook Date: Fri Aug 29 12:07:25 2025 -0700 arm64: mm: Fix CFI failure due to kpti_ng_pgd_alloc function signature Seen during KPTI initialization: CFI failure at create_kpti_ng_temp_pgd+0x124/0xce8 (target: kpti_ng_pgd_alloc+0x0/0x14; expected type: 0xd61b88b6) The call site is alloc_init_pud() at arch/arm64/mm/mmu.c: pud_phys = pgtable_alloc(TABLE_PUD); alloc_init_pud() has the prototype: static void alloc_init_pud(p4d_t *p4dp, unsigned long addr, unsigned long end, phys_addr_t phys, pgprot_t prot, phys_addr_t (*pgtable_alloc)(enum pgtable_type), int flags) where the pgtable_alloc() prototype is declared. The target (kpti_ng_pgd_alloc) is used in arch/arm64/kernel/cpufeature.c: create_kpti_ng_temp_pgd(kpti_ng_temp_pgd, __pa(alloc), KPTI_NG_TEMP_VA, PAGE_SIZE, PAGE_KERNEL, kpti_ng_pgd_alloc, 0); which is an alias for __create_pgd_mapping_locked() with prototype: extern __alias(__create_pgd_mapping_locked) void create_kpti_ng_temp_pgd(pgd_t *pgdir, phys_addr_t phys, unsigned long virt, phys_addr_t size, pgprot_t prot, phys_addr_t (*pgtable_alloc)(enum pgtable_type), int flags); __create_pgd_mapping_locked() passes the function pointer down: __create_pgd_mapping_locked() -> alloc_init_p4d() -> alloc_init_pud() But the target function (kpti_ng_pgd_alloc) has the wrong signature: static phys_addr_t __init kpti_ng_pgd_alloc(int shift); The "int" should be "enum pgtable_type". To make "enum pgtable_type" available to cpufeature.c, move enum pgtable_type definition from arch/arm64/mm/mmu.c to arch/arm64/include/asm/mmu.h. Adjust kpti_ng_pgd_alloc to use "enum pgtable_type" instead of "int". The function behavior remains identical (parameter is unused). Fixes: c64f46ee1377 ("arm64: mm: use enum to identify pgtable level instead of *_SHIFT") Cc: # 6.16.x Signed-off-by: Kees Cook Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250829190721.it.373-kees@kernel.org Reviewed-by: Ryan Roberts Signed-off-by: Catalin Marinas commit d5f8458e34a331e5b228de142145e62ac5bfda34 Author: Gergo Koteles Date: Fri Aug 29 18:04:50 2025 +0200 ALSA: hda: tas2781: reorder tas2563 calibration variables The tasdev_load_calibrated_data() function expects the calibration data values in the cali_data buffer as R0, R0Low, InvR0, Power, TLim which is not the same as what tas2563_save_calibration() writes to the buffer. Reorder the EFI variables in the tas2563_save_calibration() function to put the values in the buffer in the correct order. Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib") Cc: Signed-off-by: Gergo Koteles Link: https://patch.msgid.link/20250829160450.66623-2-soyer@irl.hu Signed-off-by: Takashi Iwai commit e5a00dafc7e06ab1b20fd4c1535cfa9b9940061e Author: Gergo Koteles Date: Fri Aug 29 18:04:49 2025 +0200 ALSA: hda: tas2781: fix tas2563 EFI data endianness Before conversion to unify the calibration data management, the tas2563_apply_calib() function performed the big endian conversion and wrote the calibration data to the device. The writing is now done by the common tasdev_load_calibrated_data() function, but without conversion. Put the values into the calibration data buffer with the expected endianness. Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib") Cc: Signed-off-by: Gergo Koteles Link: https://patch.msgid.link/20250829160450.66623-1-soyer@irl.hu Signed-off-by: Takashi Iwai commit aea3493246c474bc917d124d6fb627663ab6bef0 Author: Takashi Sakamoto Date: Sat Aug 30 08:37:49 2025 +0900 ALSA: firewire-motu: drop EPOLLOUT from poll return values as write is not supported The ALSA HwDep character device of the firewire-motu driver incorrectly returns EPOLLOUT in poll(2), even though the driver implements no operation for write(2). This misleads userspace applications to believe write() is allowed, potentially resulting in unnecessarily wakeups. This issue dates back to the driver's initial code added by a commit 71c3797779d3 ("ALSA: firewire-motu: add hwdep interface"), and persisted when POLLOUT was updated to EPOLLOUT by a commit a9a08845e9ac ('vfs: do bulk POLL* -> EPOLL* replacement("").'). This commit fixes the bug. Signed-off-by: Takashi Sakamoto Link: https://patch.msgid.link/20250829233749.366222-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Iwai commit 788bc43d8330511af433bf282021a8fecb6b9009 Merge: 0704a3da7ce50f ca47c44d36a9ad Author: Jakub Kicinski Date: Fri Aug 29 19:42:10 2025 -0700 Merge branch 'microchip-lan865x-fix-probing-issues' Stefan Wahren says: ==================== microchip: lan865x: Fix probing issues Recently I setup a customer i.MX93 board which contains a LAN8651 chip. During this process I discovered some probing related issues. ==================== Link: https://patch.msgid.link/20250827115341.34608-1-wahrenst@gmx.net Signed-off-by: Jakub Kicinski commit ca47c44d36a9ad3268d17f89789104a471c07f81 Author: Stefan Wahren Date: Wed Aug 27 13:53:41 2025 +0200 microchip: lan865x: Fix LAN8651 autoloading Add missing IDs for LAN8651 devices, which are also defined in the DT bindings. Fixes: 5cd2340cb6a3 ("microchip: lan865x: add driver support for Microchip's LAN865X MAC-PHY") Signed-off-by: Stefan Wahren Cc: stable@kernel.org Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250827115341.34608-4-wahrenst@gmx.net Signed-off-by: Jakub Kicinski commit c7217963eb779be0a7627dd2121152fa6786ecf7 Author: Stefan Wahren Date: Wed Aug 27 13:53:40 2025 +0200 microchip: lan865x: Fix module autoloading Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from spi_device_id table. While at this, fix the misleading variable name (spidev is unrelated to this driver). Fixes: 5cd2340cb6a3 ("microchip: lan865x: add driver support for Microchip's LAN865X MAC-PHY") Signed-off-by: Stefan Wahren Cc: stable@kernel.org Reviewed-by: Andrew Lunn Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250827115341.34608-3-wahrenst@gmx.net Signed-off-by: Jakub Kicinski commit b3852ae3105ec1048535707545d23c1e519c190f Author: Stefan Wahren Date: Wed Aug 27 13:53:39 2025 +0200 net: ethernet: oa_tc6: Handle failure of spi_setup There is no guarantee that spi_setup succeed, so properly handle the error case. Fixes: aa58bec064ab ("net: ethernet: oa_tc6: implement register write operation") Signed-off-by: Stefan Wahren Cc: stable@kernel.org Reviewed-by: Andrew Lunn Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250827115341.34608-2-wahrenst@gmx.net Signed-off-by: Jakub Kicinski commit 0704a3da7ce50f972e898bbda88d2692a22922d9 Author: Miaoqian Lin Date: Thu Aug 28 16:14:57 2025 +0800 mISDN: Fix memory leak in dsp_hwec_enable() dsp_hwec_enable() allocates dup pointer by kstrdup(arg), but then it updates dup variable by strsep(&dup, ","). As a result when it calls kfree(dup), the dup variable may be a modified pointer that no longer points to the original allocated memory, causing a memory leak. The issue is the same pattern as fixed in commit c6a502c22999 ("mISDN: Fix memory leak in dsp_pipeline_build()"). Fixes: 9a4381618262 ("mISDN: Remove VLAs") Signed-off-by: Miaoqian Lin Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250828081457.36061-1-linmq006@gmail.com Signed-off-by: Jakub Kicinski commit 8bf935cf789872350b04c1a6468b0a509f67afb2 Author: Duoming Zhou Date: Thu Aug 28 16:29:49 2025 +0800 ptp: ocp: fix use-after-free bugs causing by ptp_ocp_watchdog The ptp_ocp_detach() only shuts down the watchdog timer if it is pending. However, if the timer handler is already running, the timer_delete_sync() is not called. This leads to race conditions where the devlink that contains the ptp_ocp is deallocated while the timer handler is still accessing it, resulting in use-after-free bugs. The following details one of the race scenarios. (thread 1) | (thread 2) ptp_ocp_remove() | ptp_ocp_detach() | ptp_ocp_watchdog() if (timer_pending(&bp->watchdog))| bp = timer_container_of() timer_delete_sync() | | devlink_free(devlink) //free | | bp-> //use Resolve this by unconditionally calling timer_delete_sync() to ensure the timer is reliably deactivated, preventing any access after free. Fixes: 773bda964921 ("ptp: ocp: Expose various resources on the timecard.") Signed-off-by: Duoming Zhou Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250828082949.28189-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski commit b79e498080b170fd94fc83bca2471f450811549b Author: Alok Tiwari Date: Wed Aug 27 12:26:43 2025 -0700 xirc2ps_cs: fix register access when enabling FullDuplex The current code incorrectly passes (XIRCREG1_ECR | FullDuplex) as the register address to GetByte(), instead of fetching the register value and OR-ing it with FullDuplex. This results in an invalid register access. Fix it by reading XIRCREG1_ECR first, then or-ing with FullDuplex before writing it back. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250827192645.658496-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 9f74c0ea9b26d1505d55b61e36b1623dd347e1d1 Author: Eric Dumazet Date: Wed Aug 27 16:23:52 2025 +0000 net_sched: gen_estimator: fix est_timer() vs CONFIG_PREEMPT_RT=y syzbot reported a WARNING in est_timer() [1] Problem here is that with CONFIG_PREEMPT_RT=y, timer callbacks can be preempted. Adopt preempt_disable_nested()/preempt_enable_nested() to fix this. [1] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 __seqprop_assert include/linux/seqlock.h:221 [inline] WARNING: CPU: 0 PID: 16 at ./include/linux/seqlock.h:221 est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Modules linked in: CPU: 0 UID: 0 PID: 16 Comm: ktimers/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:__seqprop_assert include/linux/seqlock.h:221 [inline] RIP: 0010:est_timer+0x6dc/0x9f0 net/core/gen_estimator.c:93 Call Trace: call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22c/0x710 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1043 smpboot_thread_fn+0x53f/0xa60 kernel/smpboot.c:160 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Fixes: d2d6422f8bd1 ("x86: Allow to enable PREEMPT_RT.") Reported-by: syzbot+72db9ee39db57c3fecc5@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68adf6fa.a70a0220.3cafd4.0000.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20250827162352.3960779-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit c407beb5b883b8b89c9372e588bad5634a30927a Merge: d6a367ec6c96fc 54416fd76770bd Author: Jakub Kicinski Date: Fri Aug 29 18:57:22 2025 -0700 Merge tag 'nf-25-08-27' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== netfilter updates for net 1) Remove bogus WARN_ON in br_netfilter that came in 6.8. This is now more prominent due to commit 2d72afb34065 ("netfilter: nf_conntrack: fix crash due to removal of uninitialised entry"). From Wang Liang. 2) Better error reporting when a helper module clashes with an existing helper name: -EEXIST makes modprobe believe that the module is already loaded, so error message is elided. From Phil Sutter. * tag 'nf-25-08-27' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: conntrack: helper: Replace -EEXIST by -EBUSY netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm ==================== Link: https://patch.msgid.link/20250827133900.16552-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit d6a367ec6c96fc8e61b4d67e69df03565ec69fb7 Author: Florian Westphal Date: Thu Aug 28 23:49:18 2025 +0200 netfilter: nft_flowtable.sh: re-run with random mtu sizes Jakub says: nft_flowtable.sh is one of the most flake-atious test for netdev CI currently :( The root cause is two-fold: 1. the failing part of the test is supposed to make sure that ip fragments are forwarded for offloaded flows. (flowtable has to pass them to classic forward path). path mtu discovery for these subtests is disabled. 2. nft_flowtable.sh has two passes. One with fixed mtus/file size and one where link mtus and file sizes are random. The CI failures all have same pattern: re-run with random mtus and file size: -o 27663 -l 4117 -r 10089 -s 54384840 [..] PASS: dscp_egress: dscp packet counters match FAIL: file mismatch for ns1 -> ns2 In some cases this error triggers a bit ealier, sometimes in a later subtest: re-run with random mtus and file size: -o 20201 -l 4555 -r 12657 -s 9405856 [..] PASS: dscp_egress: dscp packet counters match PASS: dscp_fwd: dscp packet counters match 2025/08/17 20:37:52 socat[18954] E write(7, 0x560716b96000, 8192): Broken pipe FAIL: file mismatch for ns1 -> ns2 -rw------- 1 root root 9405856 Aug 17 20:36 /tmp/tmp.2n63vlTrQe But all logs I saw show same scenario: 1. Failing tests have pmtu discovery off (i.e., ip fragmentation) 2. The test file is much larger than first-pass default (2M Byte) 3. peers have much larger MTUs compared to the 'network'. These errors are very reproducible when re-running the test with the same commandline arguments. The timeout became much more prominent with 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks"): reassembled packets typically have a skb->truesize more than double the skb length. As that commit is intentional and pmtud-off with large-tcp-packets-as-fragments is not normal adjust the test to use a smaller file for the pmtu-off subtests. While at it, add more information to pass/fail messages and also run the dscp alteration subtest with pmtu discovery enabled. Link: https://netdev.bots.linux.dev/contest.html?test=nft-flowtable-sh Fixes: f84ab634904c ("selftests: netfilter: nft_flowtable.sh: re-run with random mtu sizes") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20250822071330.4168f0db@kernel.org/ Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20250828214918.3385-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 8a68d64bb10334426834e8c273319601878e961e Author: Pawan Gupta Date: Fri Aug 29 15:28:52 2025 -0700 x86/vmscape: Add old Intel CPUs to affected list These old CPUs are not tested against VMSCAPE, but are likely vulnerable. Signed-off-by: Pawan Gupta Signed-off-by: Dave Hansen commit 11e7861d680c3757eab18ec0a474ff680e007dc4 Merge: fb679c832b6497 42a0305ab11497 Author: Linus Torvalds Date: Fri Aug 29 13:54:26 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm fixes from Paolo Bonzini: "ARM: - Correctly handle 'invariant' system registers for protected VMs - Improved handling of VNCR data aborts, including external aborts - Fixes for handling of FEAT_RAS for NV guests, providing a sane fault context during SEA injection and preventing the use of RASv1p1 fault injection hardware - Ensure that page table destruction when a VM is destroyed gives an opportunity to reschedule - Large fix to KVM's infrastructure for managing guest context loaded on the CPU, addressing issues where the output of AT emulation doesn't get reflected to the guest - Fix AT S12 emulation to actually perform stage-2 translation when necessary - Avoid attempting vLPI irqbypass when GICv4 has been explicitly disabled for a VM - Minor KVM + selftest fixes RISC-V: - Fix pte settings within kvm_riscv_gstage_ioremap() - Fix comments in kvm_riscv_check_vcpu_requests() - Fix stack overrun when setting vlenb via ONE_REG x86: - Use array_index_nospec() to sanitize the target vCPU ID when handling PV IPIs and yields as the ID is guest-controlled. - Drop a superfluous cpumask_empty() check when reclaiming SEV memory, as the common case, by far, is that at least one CPU will have entered the VM, and wbnoinvd_on_cpus_mask() will naturally handle the rare case where the set of have_run_cpus is empty. Selftests (not KVM): - Rename the is_signed_type() macro in kselftest_harness.h to is_signed_var() to fix a collision with linux/overflow.h. The collision generates compiler warnings due to the two macros having different meaning" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (29 commits) KVM: arm64: nv: Fix ATS12 handling of single-stage translation KVM: arm64: Remove __vcpu_{read,write}_sys_reg_{from,to}_cpu() KVM: arm64: Fix vcpu_{read,write}_sys_reg() accessors KVM: arm64: Simplify sysreg access on exception delivery KVM: arm64: Check for SYSREGS_ON_CPU before accessing the 32bit state RISC-V: KVM: fix stack overrun when loading vlenb RISC-V: KVM: Correct kvm_riscv_check_vcpu_requests() comment RISC-V: KVM: Fix pte settings within kvm_riscv_gstage_ioremap() KVM: arm64: selftests: Sync ID_AA64MMFR3_EL1 in set_id_regs KVM: arm64: Get rid of ARM64_FEATURE_MASK() KVM: arm64: Make ID_AA64PFR1_EL1.RAS_frac writable KVM: arm64: Make ID_AA64PFR0_EL1.RAS writable KVM: arm64: Ignore HCR_EL2.FIEN set by L1 guest's EL2 KVM: arm64: Handle RASv1p1 registers arm64: Add capability denoting FEAT_RASv1p1 KVM: arm64: Reschedule as needed when destroying the stage-2 page-tables KVM: arm64: Split kvm_pgtable_stage2_destroy() selftests: harness: Rename is_signed_type() to avoid collision with overflow.h KVM: SEV: don't check have_run_cpus in sev_writeback_caches() KVM: arm64: Correctly populate FAR_EL2 on nested SEA injection ... commit 629840e208bfe10008da3e8366493f3d71b21251 Merge: 9c736ace0666ef 2c72c8d356db40 Author: Jakub Kicinski Date: Fri Aug 29 13:35:12 2025 -0700 Merge tag 'wireless-2025-08-28' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless Johannes Berg says: ==================== Some fixes for the current cycle: - mt76: MLO regressions, offchannel handling, list corruption - mac80211: scan allocation size, no 40 MHz EHT, signed type - rt2x00: (randconfig) build - cfg80211: use-after-free - iwlwifi: config/old devices, BIOS compatibility - mwifiex: vmalloc content leak * tag 'wireless-2025-08-28' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (29 commits) wifi: iwlwifi: cfg: add back more lost PCI IDs wifi: iwlwifi: fix byte count table for old devices wifi: iwlwifi: cfg: restore some 1000 series configs wifi: mwifiex: Initialize the chan_stats array to zero wifi: mac80211: do not permit 40 MHz EHT operation on 5/6 GHz wifi: iwlwifi: uefi: check DSM item validity wifi: iwlwifi: acpi: check DSM func validity wifi: iwlwifi: if scratch is ~0U, consider it a failure wifi: mt76: fix linked list corruption wifi: mt76: free pending offchannel tx frames on wcid cleanup wifi: mt76: mt7915: fix list corruption after hardware restart wifi: mt76: mt7996: add missing check for rx wcid entries wifi: mt76: do not add non-sta wcid entries to the poll list wifi: mt76: mt7996: fix crash on some tx status reports wifi: mt76: mt7996: use the correct vif link for scanning/roc wifi: mt76: mt7996: disable beacons when going offchannel wifi: mt76: prevent non-offchannel mgmt tx during scan/roc wifi: mt76: mt7925: skip EHT MLD TLV on non-MLD and pass conn_state for sta_cmd wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete wifi: mt76: mt7925: fix the wrong bss cleanup for SAP ... ==================== Link: https://patch.msgid.link/20250828122654.1167754-8-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 86a9b1250602d877a393dcbab5f42472f77ac0f7 Author: Nathan Chancellor Date: Thu Aug 7 14:36:28 2025 -0700 hardening: Require clang 20.1.0 for __counted_by After an innocuous change in -next that modified a structure that contains __counted_by, clang-19 start crashing when building certain files in drivers/gpu/drm/xe. When assertions are enabled, the more descriptive failure is: clang: clang/lib/AST/RecordLayoutBuilder.cpp:3335: const ASTRecordLayout &clang::ASTContext::getASTRecordLayout(const RecordDecl *) const: Assertion `D && "Cannot get layout of forward declarations!"' failed. According to a reverse bisect, a tangential change to the LLVM IR generation phase of clang during the LLVM 20 development cycle [1] resolves this problem. Bump the version of clang that enables CONFIG_CC_HAS_COUNTED_BY to 20.1.0 to ensure that this issue cannot be hit. Link: https://github.com/llvm/llvm-project/commit/160fb1121cdf703c3ef5e61fb26c5659eb581489 [1] Signed-off-by: Nathan Chancellor Reviewed-by: Justin Stitt Link: https://lore.kernel.org/r/20250807-fix-counted_by-clang-19-v1-1-902c86c1d515@kernel.org Signed-off-by: Kees Cook commit 862c628108562d8c7a516a900034823b381d3cba Author: Kuniyuki Iwashima Date: Wed Aug 27 20:40:14 2025 +0000 Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the "Freed by task" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_noprof+0x223/0x510 mm/slub.c:4377 kmalloc_noprof include/linux/slab.h:909 [inline] sk_prot_alloc+0x1a8/0x2a0 net/core/sock.c:2239 sk_alloc+0x36/0xc20 net/core/sock.c:2295 bt_sock_alloc+0x3b/0x3a0 net/bluetooth/af_bluetooth.c:151 l2cap_sock_alloc.constprop.0+0x33/0x1d0 net/bluetooth/l2cap_sock.c:1894 l2cap_sock_new_connection_cb+0x101/0x240 net/bluetooth/l2cap_sock.c:1482 l2cap_connect_cfm+0x4c4/0xf80 net/bluetooth/l2cap_core.c:7287 hci_connect_cfm include/net/bluetooth/hci_core.h:2050 [inline] hci_remote_features_evt+0x4dd/0x970 net/bluetooth/hci_event.c:3712 hci_event_func net/bluetooth/hci_event.c:7519 [inline] hci_event_packet+0xa0d/0x11c0 net/bluetooth/hci_event.c:7573 hci_rx_work+0x2c5/0x16b0 net/bluetooth/hci_core.c:4071 process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:463 ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 16995: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x60/0x70 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2417 [inline] slab_free mm/slub.c:4680 [inline] kfree+0x2b4/0x4d0 mm/slub.c:4879 sk_prot_free net/core/sock.c:2278 [inline] __sk_destruct+0x75f/0x9a0 net/core/sock.c:2373 sk_destruct+0xc2/0xf0 net/core/sock.c:2401 __sk_free+0xf4/0x3e0 net/core/sock.c:2412 sk_free+0x6a/0x90 net/core/sock.c:2423 sock_put include/net/sock.h:1960 [inline] bt_accept_unlink+0x245/0x2e0 net/bluetooth/af_bluetooth.c:262 bt_accept_dequeue+0x517/0x600 net/bluetooth/af_bluetooth.c:308 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: 1728137b33c0 ("Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb") Reported-by: syzbot+e5e64cdf8e92046dd3e1@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-bluetooth/68af6b9d.a70a0220.3cafd4.0032.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Signed-off-by: Luiz Augusto von Dentz commit 28010791193a4503f054e8d69a950ef815deb539 Author: Ivan Pravdin Date: Wed Aug 27 10:53:25 2025 -0400 Bluetooth: vhci: Prevent use-after-free by removing debugfs files early Move the creation of debugfs files into a dedicated function, and ensure they are explicitly removed during vhci_release(), before associated data structures are freed. Previously, debugfs files such as "force_suspend", "force_wakeup", and others were created under hdev->debugfs but not removed in vhci_release(). Since vhci_release() frees the backing vhci_data structure, any access to these files after release would result in use-after-free errors. Although hdev->debugfs is later freed in hci_release_dev(), user can access files after vhci_data is freed but before hdev->debugfs is released. Fixes: ab4e4380d4e1 ("Bluetooth: Add vhci devcoredump support") Signed-off-by: Ivan Pravdin Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 42a0305ab114975dbad3fe9efea06976dd62d381 Merge: 085e899aa19be2 ee372e64517880 Author: Paolo Bonzini Date: Fri Aug 29 12:57:31 2025 -0400 Merge tag 'kvmarm-fixes-6.17-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 changes for 6.17, take #2 - Correctly handle 'invariant' system registers for protected VMs - Improved handling of VNCR data aborts, including external aborts - Fixes for handling of FEAT_RAS for NV guests, providing a sane fault context during SEA injection and preventing the use of RASv1p1 fault injection hardware - Ensure that page table destruction when a VM is destroyed gives an opportunity to reschedule - Large fix to KVM's infrastructure for managing guest context loaded on the CPU, addressing issues where the output of AT emulation doesn't get reflected to the guest - Fix AT S12 emulation to actually perform stage-2 translation when necessary - Avoid attempting vLPI irqbypass when GICv4 has been explicitly disabled for a VM - Minor KVM + selftest fixes commit 085e899aa19be2ca512302077346d22736174e6d Merge: 22b2ca023fc41e 799766208f09f9 Author: Paolo Bonzini Date: Fri Aug 29 12:57:18 2025 -0400 Merge tag 'kvm-riscv-fixes-6.17-1' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv fixes for 6.17, take #1 - Fix pte settings within kvm_riscv_gstage_ioremap() - Fix comments in kvm_riscv_check_vcpu_requests() - Fix stack overrun when setting vlenb via ONE_REG commit 4fb2b677fc1f70ee642c0beecc3cabf226ef5707 Author: Trond Myklebust Date: Fri Aug 29 09:15:12 2025 -0700 NFSv4: Clear the NFS_CAP_XATTR flag if not supported by the server nfs_server_set_fsinfo() shouldn't assume that NFS_CAP_XATTR is unset on entry to the function. Fixes: b78ef845c35d ("NFSv4.2: query the server for extended attribute support") Signed-off-by: Trond Myklebust commit b3ac33436030bce37ecb3dcae581ecfaad28078c Author: Trond Myklebust Date: Fri Aug 29 09:12:30 2025 -0700 NFSv4: Clear NFS_CAP_OPEN_XOR and NFS_CAP_DELEGTIME if not supported _nfs4_server_capabilities() should clear capabilities that are not supported by the server. Fixes: d2a00cceb93a ("NFSv4: Detect support for OPEN4_SHARE_ACCESS_WANT_OPEN_XOR_DELEGATION") Signed-off-by: Trond Myklebust commit dd5a8621b886b02f8341c5d4ea68eb2c552ebd3e Author: Trond Myklebust Date: Fri Aug 29 09:07:22 2025 -0700 NFSv4: Clear the NFS_CAP_FS_LOCATIONS flag if it is not set _nfs4_server_capabilities() is expected to clear any flags that are not supported by the server. Fixes: 8a59bb93b7e3 ("NFSv4 store server support for fs_location attribute") Signed-off-by: Trond Myklebust commit 31f1a960ad1a14def94fa0b8c25d62b4c032813f Author: Trond Myklebust Date: Fri Aug 29 09:02:16 2025 -0700 NFSv4: Don't clear capabilities that won't be reset Don't clear the capabilities that are not going to get reset by the call to _nfs4_server_capabilities(). Reported-by: Scott Haiden Fixes: b01f21cacde9 ("NFS: Fix the setting of capabilities when automounting a new filesystem") Signed-off-by: Trond Myklebust commit 2cb66ae6040fd3cb058c3391b180f378fc0e3e2f Author: Faith Ekstrand Date: Fri Aug 29 12:16:33 2025 +1000 nouveau: Membar before between semaphore writes and the interrupt This ensures that the memory write and the interrupt are properly ordered and we won't wake up the kernel before the semaphore write has hit memory. Fixes: b1ca384772b6 ("drm/nouveau/gv100-: switch to volta semaphore methods") Cc: stable@vger.kernel.org Signed-off-by: Faith Ekstrand Signed-off-by: Dave Airlie Link: https://lore.kernel.org/r/20250829021633.1674524-2-airlied@gmail.com Signed-off-by: Danilo Krummrich commit 0ef5c4e4dbbfcebaa9b2eca18097b43016727dfe Author: Dave Airlie Date: Fri Aug 29 12:16:32 2025 +1000 nouveau: fix disabling the nonstall irq due to storm code Nouveau has code that when it gets an IRQ with no allowed handler it disables it to avoid storms. However with nonstall interrupts, we often disable them from the drm driver, but still request their emission via the push submission. Just don't disable nonstall irqs ever in normal operation, the event handling code will filter them out, and the driver will just enable/disable them at load time. This fixes timeouts we've been seeing on/off for a long time, but they became a lot more noticeable on Blackwell. This doesn't fix all of them, there is a subsequent fence emission fix to fix the last few. Fixes: 3ebd64aa3c4f ("drm/nouveau/intr: support multiple trees, and explicit interfaces") Cc: stable@vger.kernel.org Signed-off-by: Dave Airlie Link: https://lore.kernel.org/r/20250829021633.1674524-1-airlied@gmail.com [ Fix a typo and a minor checkpatch.pl warning; remove "v2" from commit subject. - Danilo ] Signed-off-by: Danilo Krummrich commit fb679c832b6497f19fffb8274c419783909c0912 Merge: 2575e638e2d9c7 a6358f8cf64850 Author: Linus Torvalds Date: Fri Aug 29 09:15:46 2025 -0700 Merge tag 'efi-fixes-for-v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fixes from Ard Biesheuvel: - Assorted fixes for the OP-TEE based pseudo-EFI variable store - Fix for an OOB access when looking up the same non-existing efivarfs entry multiple times in parallel * tag 'efi-fixes-for-v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare efi: stmm: Drop unneeded null pointer check efi: stmm: Drop unused EFI error from setup_mm_hdr arguments efi: stmm: Do not return EFI_OUT_OF_RESOURCES on internal errors efi: stmm: Fix incorrect buffer allocation method commit 2575e638e2d9c70971e5232398ca22afa6f06293 Merge: 469447200aed04 ab529e6ca1f67b Author: Linus Torvalds Date: Fri Aug 29 08:51:34 2025 -0700 Merge tag 'v6.17-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix possible refcount leak in compound operations - Fix remap_file_range() return code mapping, found by generic/157 * tag 'v6.17-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: fs/smb: Fix inconsistent refcnt update smb3 client: fix return code mapping of remap_file_range commit 3ebf766c35464ebdeefb6068246267147503dc04 Author: Ivan Lipski Date: Wed Aug 20 15:46:52 2025 -0400 drm/amd/display: Clear the CUR_ENABLE register on DCN314 w/out DPP PG [Why&How] ON DCN314, clearing DPP SW structure without power gating it can cause a double cursor in full screen with non-native scaling. A W/A that clears CURSOR0_CONTROL cursor_enable flag if dcn10_plane_atomic_power_down is called and DPP power gating is disabled. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4168 Reviewed-by: Sun peng (Leo) Li Signed-off-by: Ivan Lipski Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 645f74f1dc119dad5a2c7bbc05cc315e76883011) Cc: stable@vger.kernel.org commit 71403f58b4bb6c13b71c05505593a355f697fd94 Author: Alex Deucher Date: Wed Aug 6 10:47:50 2025 -0400 drm/amdgpu: drop hw access in non-DC audio fini We already disable the audio pins in hw_fini so there is no need to do it again in sw_fini. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4481 Cc: oushixiong Signed-off-by: Alex Deucher (cherry picked from commit 5eeb16ca727f11278b2917fd4311a7d7efb0bbd6) Cc: stable@vger.kernel.org commit a8b79b09185de868e478eb1b6f1fd8deddb0604d Author: Mario Limonciello Date: Thu Aug 28 09:37:05 2025 -0500 drm/amd: Re-enable common modes for eDP and LVDS [Why] Although compositors will add their own modes, Xorg won't use it's own modes and will only stick to modes advertised by the driver. This mean a user that used to pick 1024x768 could no longer access it unless the panel's native resolution was 1024x768. [How] Revert commit 6d396e7ac1ce3 ("drm/amd/display: Disable common modes for LVDS") and commit 7948afb46af92 ("drm/amd/display: Disable common modes for eDP"). The panel will still use scaling for any non-native modes due to commit 978fa2f6d0b12 ("drm/amd/display: Use scaling for non-native resolutions on eDP") Reported-by: Marek Marczykowski-Górecki Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4538 Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250828140856.2887993-1-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit c2fbf72fe3c2d08856e834ca43328a8829a261d8) commit 5171848bdfb8bf87f38331d3f8c0fd5e2b676d3e Author: Alex Deucher Date: Wed Aug 27 14:24:31 2025 -0400 drm/amdgpu/mes11: make MES_MISC_OP_CHANGE_CONFIG failure non-fatal If the firmware is too old, just warn and return success. Fixes: 27b791514789 ("drm/amdgpu/mes: keep enforce isolation up to date") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4414 Cc: shaoyun.Liu@amd.com Reviewed-by: Shaoyun.liu Signed-off-by: Alex Deucher (cherry picked from commit 9f28af76fab0948b59673f69c10aeec47de11c60) Cc: stable@vger.kernel.org commit 2d41a4bfee6e9941ff19728c691ab00d19cf882a Author: Jesse.Zhang Date: Wed Aug 27 13:29:17 2025 +0800 drm/amdgpu/sdma: bump firmware version checks for user queue support Using the previous firmware could lead to problems with PROTECTED_FENCE_SIGNAL commands, specifically causing register conflicts between MCU_DBG0 and MCU_DBG1. The updated firmware versions ensure proper alignment and unification of the SDMA_SUBOP_PROTECTED_FENCE_SIGNAL value with SDMA 7.x, resolving these hardware coordination issues Fixes: e8cca30d8b34 ("drm/amdgpu/sdma6: add ucode version checks for userq support") Acked-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit aab8b689aded255425db3d80c0030d1ba02fe2ef) Cc: stable@vger.kernel.org commit 469447200aed04c383189b64aa07070be052c48a Merge: 02d6eeedbc36d4 ae668cd567a6a7 Author: Linus Torvalds Date: Fri Aug 29 08:09:34 2025 -0700 Merge tag 'xfs-fixes-6.17-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: "The highlight I'd like to point here is related to the XFS_RT Kconfig, which has been updated to be enabled by default now if CONFIG_BLK_DEV_ZONED is enabled. This also contains a few fixes for zoned devices support in XFS, specially related to swapon requests in inodes belonging to the zoned FS. A null-ptr dereference fix in the xattr data, due to a mishandling of medium errors generated by block devices is also included" * tag 'xfs-fixes-6.17-rc4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: do not propagate ENODATA disk errors into xattr code xfs: reject swapon for inodes on a zoned file system earlier xfs: kick off inodegc when failing to reserve zoned blocks xfs: remove xfs_last_used_zone xfs: Default XFS_RT to Y if CONFIG_BLK_DEV_ZONED is enabled commit 02d6eeedbc36d4b309d5518778071a749ef79c4e Merge: ec1abfc8333110 1f3214aae9f49f Author: Linus Torvalds Date: Fri Aug 29 07:44:14 2025 -0700 Merge tag 'hid-for-linus-2025082901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID fixes from Jiri Kosina: - fixes for memory corruption in intel-thc-hid, hid-multitouch, hid-mcp2221 and hid-asus (Aaron Ma, Qasim Ijaz, Arnaud Lecomte) - power management/resume fix for intel-ish-hid (Zhang Lixu) - driver reinitialization fix for intel-thc-hid (Even Xu) - ensure that battery level status is reported as soon as possible, which is required at least for some Android use-cases (José Expósito) - quite a few new device ID additions and device-specific quirks * tag 'hid-for-linus-2025082901' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: HID: quirks: add support for Legion Go dual dinput modes HID: elecom: add support for ELECOM M-DT2DRBK HID: logitech: Add ids for G PRO 2 LIGHTSPEED HID: input: report battery status changes immediately HID: input: rename hidinput_set_battery_charge_status() HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flow HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() HID: asus: fix UAF via HID_CLAIMED_INPUT validation hid: fix I2C read buffer overflow in raw_event() for mcp2221 HID: wacom: Add a new Art Pen 2 HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() HID: Kconfig: Fix spelling mistake "enthropy" -> "entropy" HID: intel-ish-hid: Increase ISHTP resume ack timeout to 300ms HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length commit ec1abfc8333110b9e645cd59eb3bc0541fd5bd2c Merge: 2bd3731542af4d ef3e9c91ed87f1 Author: Linus Torvalds Date: Fri Aug 29 07:37:21 2025 -0700 Merge tag 'regulator-fix-v6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "One simple fix for the pm8008 driver for poor error handling, switching to use a helper which does the right thing in the affected case" * tag 'regulator-fix-v6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: pm8008: fix probe failure due to negative voltage selector commit 2bd3731542af4d32402fdc0e247153a94efeb682 Merge: 18ee2b9b7bd4e2 82b8166171bdeb Author: Linus Torvalds Date: Fri Aug 29 07:29:17 2025 -0700 Merge tag 'ata-6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Damien Le Moal: - Fix the type of return values to be signed in the ahci_xgen driver (Qianfeng) - Add the mask_port_ext module parameter to the ahci driver. This is to allow a user to ignore ports that are advertized as external (hotplug capable) in favor of lower link power management policies instead of the default max_performance for these ports. This is useful to allow e.g. laptops to go into low power states when hooked up to docking station with sata slots, connected with an external port for hotplug (me) * tag 'ata-6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: ahci_xgene: Use int type for 'rc' to store error codes ata: ahci: Allow ignoring the external/hotplug capability of ports commit 98fd069dd87386d87eaf439e3c7b5767618926d2 Author: Chris Packham Date: Fri Aug 29 15:05:10 2025 +1200 hwmon: (ina238) Correctly clamp temperature ina238_write_temp() was attempting to clamp the user input but was throwing away the result. Ensure that we clamp the value to the appropriate range before it is converted into a register value. Fixes: 0d9f596b1fe3 ("hwmon: (ina238) Modify the calculation formula to adapt to different chips") Signed-off-by: Chris Packham Link: https://lore.kernel.org/r/20250829030512.1179998-3-chris.packham@alliedtelesis.co.nz Signed-off-by: Guenter Roeck commit 1180c79fbf36e4c02e76ae4658509523437e52a4 Author: Vadim Pasternak Date: Wed Jul 30 23:17:15 2025 +0300 hwmon: mlxreg-fan: Prevent fans from getting stuck at 0 RPM The fans controlled by the driver can get stuck at 0 RPM if they are configured below a 20% duty cycle. The driver tries to avoid this by enforcing a minimum duty cycle of 20%, but this is done after the fans are registered with the thermal subsystem. This is too late as the thermal subsystem can set their current state before the driver is able to enforce the minimum duty cycle. Fix by setting the minimum duty cycle before registering the fans with the thermal subsystem. Fixes: d7efb2ebc7b3 ("hwmon: (mlxreg-fan) Extend driver to support multiply cooling devices") Reported-by: Nikolay Aleksandrov Tested-by: Nikolay Aleksandrov Signed-off-by: Ido Schimmel Signed-off-by: Vadim Pasternak Link: https://lore.kernel.org/r/20250730201715.1111133-1-vadimp@nvidia.com Signed-off-by: Guenter Roeck commit aa28991fd5dc4c01a40caab2bd9af8c5e06f9899 Author: David Arcari Date: Fri Aug 29 07:38:59 2025 -0400 platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID Currently, tpmi_get_logical_id() calls topology_physical_package_id() to set the pkg_id of the info structure. Since some VM hosts assign non contiguous package IDs, topology_physical_package_id() can return a larger value than topology_max_packages(). This will result in an invalid reference into tpmi_power_domain_mask[] as that is allocatead based on topology_max_packages() as the maximum package ID. Fixes: 17ca2780458c ("platform/x86/intel: TPMI domain id and CPU mapping") Signed-off-by: David Arcari Acked-by: Srinivas Pandruvada Link: https://lore.kernel.org/r/20250829113859.1772827-1-darcari@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 89e7353f522f5cf70cb48c01ce2dcdcb275b8022 Author: Conor Dooley Date: Mon Aug 25 12:53:28 2025 +0100 spi: microchip-core-qspi: stop checking viability of op->max_freq in supports_op callback In commit 13529647743d9 ("spi: microchip-core-qspi: Support per spi-mem operation frequency switches") the logic for checking the viability of op->max_freq in mchp_coreqspi_setup_clock() was copied into mchp_coreqspi_supports_op(). Unfortunately, op->max_freq is not valid when this function is called during probe but is instead zero. Accordingly, baud_rate_val is calculated to be INT_MAX due to division by zero, causing probe of the attached memory device to fail. Seemingly spi-microchip-core-qspi was the only driver that had such a modification made to its supports_op callback when the per_op_freq capability was added, so just remove it to restore prior functionality. CC: stable@vger.kernel.org Reported-by: Valentina Fernandez Fixes: 13529647743d9 ("spi: microchip-core-qspi: Support per spi-mem operation frequency switches") Signed-off-by: Conor Dooley Message-ID: <20250825-during-ploy-939bdd068593@spud> Signed-off-by: Mark Brown commit 78811dd56def1479777c9823f3c2139739ef5bf5 Author: Cryolitia PukNgae Date: Fri Aug 29 16:46:06 2025 +0800 ALSA: docs: Add documents for recently changes in snd-usb-audio Changed: - ignore_ctl_error - lowlatency - skip_validation - quirk_flags[19:24] [ corrected a typo -- tiwai ] Signed-off-by: Cryolitia PukNgae Link: https://patch.msgid.link/20250829-sound-doc-v1-1-e0110452b03d@uniontech.com Signed-off-by: Takashi Iwai commit 3e93d5bbcbfc3808f83712c0701f9d4c148cc8ed Merge: 2cbe4ac193ed71 3e7fd1febc3156 Author: Takashi Iwai Date: Fri Aug 29 11:13:09 2025 +0200 Merge tag 'asoc-fix-v6.17-rc3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.17 The main fixes here are for some of the cleanups done in the core in this release, we had broken component lookup in the case with a single bus and DMA controller. Otherwise it's driver specific changes, the shortlogs for the Intel WCL and rsnd drivers look like minor cleanups but are actually bugfixes (adding an op needed for correct functionality and reverting an inappropriate helper usage). commit 2cbe4ac193ed7172cfd825c0cc46ce4a41be4ba1 Author: qaqland Date: Fri Aug 29 14:40:48 2025 +0800 ALSA: usb-audio: Add mute TLV for playback volumes on more devices Applying the quirk of that, the lowest Playback mixer volume setting mutes the audio output, on more devices. Suggested-by: Cryolitia PukNgae Signed-off-by: qaqland Link: https://patch.msgid.link/20250829-sound_quirk-v1-1-745529b44440@uniontech.com Signed-off-by: Takashi Iwai commit bb585591ebf00fb1f6a1fdd1ea96b5848bd9112d Author: Amir Goldstein Date: Wed Aug 27 21:43:09 2025 +0200 fhandle: use more consistent rules for decoding file handle from userns Commit 620c266f39493 ("fhandle: relax open_by_handle_at() permission checks") relaxed the coditions for decoding a file handle from non init userns. The conditions are that that decoded dentry is accessible from the user provided mountfd (or to fs root) and that all the ancestors along the path have a valid id mapping in the userns. These conditions are intentionally more strict than the condition that the decoded dentry should be "lookable" by path from the mountfd. For example, the path /home/amir/dir/subdir is lookable by path from unpriv userns of user amir, because /home perms is 755, but the owner of /home does not have a valid id mapping in unpriv userns of user amir. The current code did not check that the decoded dentry itself has a valid id mapping in the userns. There is no security risk in that, because that final open still performs the needed permission checks, but this is inconsistent with the checks performed on the ancestors, so the behavior can be a bit confusing. Add the check for the decoded dentry itself, so that the entire path, including the last component has a valid id mapping in the userns. Fixes: 620c266f39493 ("fhandle: relax open_by_handle_at() permission checks") Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/20250827194309.1259650-1-amir73il@gmail.com Signed-off-by: Christian Brauner commit 18ee2b9b7bd4e2346e467101c973d62300c8ba85 Merge: d1cf752d58d59f 42d2abbfa8c402 Author: Linus Torvalds Date: Thu Aug 28 19:56:32 2025 -0700 Merge tag 'drm-fixes-2025-08-29' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly fixes, feels a bit big. The major piece is msm fixes, then the usual amdgpu/xe along with some mediatek and nouveau fixes and a tegra revert. gpuvm: - fix some typos xe: - Fix user-fence race issue - Couple xe_vm fixes - Don't trigger rebind on initial dma-buf validation - Fix a build issue related to basename() posix vs gnu discrepancy amdgpu: - pin buffers while vmapping - UserQ fixes - Revert CSA fix - SR-IOV fix nouveau: - fix linear modifier - remove some dead code msm: - Core/GPU: - fix comment doc warning in gpuvm - fix build with KMS disabled - fix pgtable setup/teardown race - global fault counter fix - various error path fixes - GPU devcoredump snapshot fixes - handle in-place VM_BIND remaps to solve turnip vm update race - skip re-emitting IBs for unusable VMs - Don't use %pK through printk - moved display snapshot init earlier, fixing a crash - DPU: - Fixed crash in virtual plane checking code - Fixed mode comparison in virtual plane checking code - DSI: - Adjusted width of resulution-related registers - Fixed locking issue on 14nm PLLs - UBWC (per Bjorn's ack) - Added UBWC configuration for several missing platforms (fixing regression) mediatek: - Add error handling for old state CRTC in atomic_disable - Fix DSI host and panel bridge pre-enable order - Fix device/node reference count leaks in mtk_drm_get_all_drm_priv - mtk_hdmi: Fix inverted parameters in some regmap_update_bits calls tegra: - revert dma-buf change" * tag 'drm-fixes-2025-08-29' of https://gitlab.freedesktop.org/drm/kernel: (56 commits) drm/mediatek: mtk_hdmi: Fix inverted parameters in some regmap_update_bits calls drm/amdgpu/userq: fix error handling of invalid doorbell drm/amdgpu: update firmware version checks for user queue support drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode Revert "drm/amdgpu: fix incorrect vm flags to map bo" drm/amdgpu/gfx12: set MQD as appriopriate for queue types drm/amdgpu/gfx11: set MQD as appriopriate for queue types drm/xe: switch to local xbasename() helper drm/xe: Don't trigger rebind on initial dma-buf validation drm/xe/vm: Clear the scratch_pt pointer on error drm/xe/vm: Don't pin the vm_resv during validation drm/xe/xe_sync: avoid race during ufence signaling Revert "drm/tegra: Use dma_buf from GEM object instance" soc: qcom: use no-UBWC config for MSM8956/76 soc: qcom: add configuration for MSM8929 soc: qcom: ubwc: add more missing platforms soc: qcom: ubwc: use no-uwbc config for MSM8917 drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset dt-bindings: display/msm: qcom,mdp5: drop lut clock drm/gpuvm: fix various typos in .c and .h gpuvm file ... commit d1cf752d58d59f9222389c14d67951da8e7fbd2b Merge: 220374ab2be5a0 95a7c5000956f9 Author: Linus Torvalds Date: Thu Aug 28 18:51:28 2025 -0700 Merge tag 'block-6.17-20250828' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Fix a lockdep spotted issue on recursive locking for zoned writes, in case of errors - Update bcache MAINTAINERS entry address for Coly - Fix for a ublk release issue, with selftests - Fix for a regression introduced in this cycle, where it assumed q->rq_qos was always set if the bio flag indicated that - Fix for a regression introduced in this cycle, where loop retrieving block device sizes got broken * tag 'block-6.17-20250828' of git://git.kernel.dk/linux: bcache: change maintainer's email address ublk selftests: add --no_ublk_fixed_fd for not using registered ublk char device ublk: avoid ublk_io_release() called after ublk char dev is closed block: validate QoS before calling __rq_qos_done_bio() blk-zoned: Fix a lockdep complaint about recursive locking loop: fix zero sized loop for block special file commit 220374ab2be5a05dc5e35c9a5337698c942916e1 Merge: 9c736ace0666ef 98b6fa62c84f2e Author: Linus Torvalds Date: Thu Aug 28 18:41:53 2025 -0700 Merge tag 'io_uring-6.17-20250828' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Use the proper type for min_t() in getting the min of the leftover bytes and the buffer length. - As good practice, use READ_ONCE() consistently for reading ring provided buffer lengths. Additionally, stop looping for incremental commits if a zero sized buffer is hit, as no further progress can be made at that point. * tag 'io_uring-6.17-20250828' of git://git.kernel.dk/linux: io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths io_uring/kbuf: fix signedness in this_len calculation commit 9c736ace0666efe68efd53fcdfa2c6653c3e0e72 Merge: fa58e4f6e1a410 5189446ba99555 Author: Linus Torvalds Date: Thu Aug 28 17:35:51 2025 -0700 Merge tag 'net-6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Bluetooth. Current release - regressions: - ipv4: fix regression in local-broadcast routes - vsock: fix error-handling regression introduced in v6.17-rc1 Previous releases - regressions: - bluetooth: - mark connection as closed during suspend disconnect - fix set_local_name race condition - eth: - ice: fix NULL pointer dereference on reset - mlx5: fix memory leak in hws_pool_buddy_init error path - bnxt_en: fix stats context reservation logic - hv: fix loss of receive events from host during channel open Previous releases - always broken: - page_pool: fix incorrect mp_ops error handling - sctp: initialize more fields in sctp_v6_from_sk() - eth: - octeontx2-vf: fix max packet length errors - idpf: fix Tx flow scheduling to avoid Tx timeouts - bnxt_en: fix memory corruption during ifdown - ice: fix incorrect counter for buffer allocation failures - mlx5: fix lockdep assertion on sync reset unload event - fbnic: fixup rtnl_lock and devl_lock handling - xgmac: do not enable RX FIFO overflow interrupts - phy: mscc: fix when PTP clock is register and unregister Misc: - add Telit Cinterion LE910C4-WWX new compositions" * tag 'net-6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (60 commits) net: ipv4: fix regression in local-broadcast routes net: macb: Disable clocks once fbnic: Move phylink resume out of service_task and into open/close fbnic: Fixup rtnl_lock and devl_lock handling related to mailbox code net: rose: fix a typo in rose_clear_routes() l2tp: do not use sock_hold() in pppol2tp_session_get_sock() sctp: initialize more fields in sctp_v6_from_sk() MAINTAINERS: rmnet: Update email addresses net: rose: include node references in rose_neigh refcount net: rose: convert 'use' field to refcount_t net: rose: split remove and free operations in rose_remove_neigh() net: hv_netvsc: fix loss of early receive events from host during channel open. net: stmmac: Set CIC bit only for TX queues with COE net: stmmac: xgmac: Correct supported speed modes net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts net/mlx5e: Set local Xoff after FW update net/mlx5e: Update and set Xon/Xoff upon port speed set net/mlx5e: Update and set Xon/Xoff upon MTU set net/mlx5: Prevent flow steering mode changes in switchdev mode net/mlx5: Nack sync reset when SFs are present ... commit 42d2abbfa8c40299e047a9b3e5578fdd309dd2ff Merge: 49862587fa27db c34414883f7734 Author: Dave Airlie Date: Fri Aug 29 10:04:26 2025 +1000 Merge tag 'mediatek-drm-fixes-20250829' of https://git.kernel.org/pub/scm/linux/kernel/git/chunkuang.hu/linux into drm-fixes Mediatek DRM Fixes - 20250829 1. Add error handling for old state CRTC in atomic_disable 2. Fix DSI host and panel bridge pre-enable order 3. Fix device/node reference count leaks in mtk_drm_get_all_drm_priv 4. mtk_hdmi: Fix inverted parameters in some regmap_update_bits calls Signed-off-by: Dave Airlie From: Chun-Kuang Hu Link: https://lore.kernel.org/r/20250828234116.4960-1-chunkuang.hu@kernel.org commit fa58e4f6e1a410fc06fcffd84b38b61426509605 Merge: 4d28e280981337 e246518aa24f14 Author: Linus Torvalds Date: Thu Aug 28 16:34:32 2025 -0700 Merge tag 'pm-6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fix from Rafael Wysocki: "Add missing locking annotations to two recently introduced list_for_each_entry_rcu() loops in the core device suspend/resume code (Johannes Berg)" * tag 'pm-6.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: PM: sleep: annotate RCU list iterations commit c34414883f773412964404d77cd2fea04c6f7d60 Author: Louis-Alexis Eyraud Date: Mon Aug 18 16:17:52 2025 +0200 drm/mediatek: mtk_hdmi: Fix inverted parameters in some regmap_update_bits calls In mtk_hdmi driver, a recent change replaced custom register access function calls by regmap ones, but two replacements by regmap_update_bits were done incorrectly, because original offset and mask parameters were inverted, so fix them. Fixes: d6e25b3590a0 ("drm/mediatek: hdmi: Use regmap instead of iomem for main registers") Signed-off-by: Louis-Alexis Eyraud Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20250818-mt8173-fix-hdmi-issue-v1-1-55aff9b0295d@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 49862587fa27db253751aadd65a5c9fc1eda1cc7 Merge: 4b1c24ef50bc1d 3cf6147f2b51a5 Author: Dave Airlie Date: Fri Aug 29 09:05:16 2025 +1000 Merge tag 'drm-msm-fixes-2025-08-26' of https://gitlab.freedesktop.org/drm/msm into drm-fixes Fixes for v6.17-rc4 Core/GPU: - fix comment doc warning in gpuvm - fix build with KMS disabled - fix pgtable setup/teardown race - global fault counter fix - various error path fixes - GPU devcoredump snapshot fixes - handle in-place VM_BIND remaps to solve turnip vm update race - skip re-emitting IBs for unusable VMs - Don't use %pK through printk - moved display snapshot init earlier, fixing a crash DPU: - Fixed crash in virtual plane checking code - Fixed mode comparison in virtual plane checking code DSI: - Adjusted width of resulution-related registers - Fixed locking issue on 14nm PLLs UBWC (per Bjorn's ack) - Added UBWC configuration for several missing platforms (fixing regression) Signed-off-by: Dave Airlie From: Rob Clark Link: https://lore.kernel.org/r/CACSVV02+u1VW1dzuz6JWwVEfpgTj6Y-JXMH+vX43KsKTVsW+Yg@mail.gmail.com commit 4d28e280981337360b20ac9812bf0eab9224d5a3 Merge: 5b9f3b013b33e7 89a2d212bdb4bc Author: Linus Torvalds Date: Thu Aug 28 16:04:14 2025 -0700 Merge tag 'dma-mapping-6.17-2025-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux Pull dma-mapping fixes from Marek Szyprowski: - another small fix for arm64 systems with memory encryption (Shanker Donthineni) - fix for arm32 systems with non-standard CMA configuration (Oreoluwa Babatunde) * tag 'dma-mapping-6.17-2025-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() commit 4b1c24ef50bc1d4f0b17d85749809d61cbe45be2 Merge: 60d98e1a8dec15 c767d74a9cdd10 Author: Dave Airlie Date: Fri Aug 29 08:50:27 2025 +1000 Merge tag 'amd-drm-fixes-6.17-2025-08-28' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.17-2025-08-28: amdgpu: - UserQ fixes - Revert CSA fix - SR-IOV fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250828173904.75850-1-alexander.deucher@amd.com commit 5b9f3b013b33e73c6f8f2bbdc6b3fd87745b40af Merge: 606c2cf67b6b84 b3dcc9d1d806fb Author: Linus Torvalds Date: Thu Aug 28 15:46:06 2025 -0700 Merge tag 'fixes-2025-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock fixes from Mike Rapoport: - printk cleanups in memblock and numa_memblks - update kernel-doc for MEMBLOCK_RSRV_NOINIT to be more accurate and detailed * tag 'fixes-2025-08-28' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: memblock: fix kernel-doc for MEMBLOCK_RSRV_NOINIT mm: numa,memblock: Use SZ_1M macro to denote bytes to MB conversion mm/numa_memblks: Use pr_debug instead of printk(KERN_DEBUG) commit 60d98e1a8dec15f6b9b3fb4174645d1e48a64c79 Merge: 59b00024ce5bae 16fdb3cc6af846 Author: Dave Airlie Date: Fri Aug 29 08:44:10 2025 +1000 Merge tag 'drm-misc-fixes-2025-08-28' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Several nouveau fixes to remove unused code, fix an error path and be less restrictive with the formats it accepts. A fix for amdgpu to pin vmapped dma-buf, and a revert for tegra for a regression in the dma-buf / GEM code. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250828-hypersonic-colorful-squirrel-64f04b@houat commit 606c2cf67b6b8421ec40769f03d8b30759df27c2 Merge: ebf2bfec412ad2 8763d2257f5231 Author: Linus Torvalds Date: Thu Aug 28 15:39:06 2025 -0700 Merge tag 'powerpc-6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Merge two CONFIG_POWERPC64_CPU entries in Kconfig.cputype - Replace extra-y to always-y in Makefile - Cleanup to use dev_fwnode helper - Fix misleading comment in kvmppc_prepare_to_enter() - misc cleanup and fixes Thanks to Amit Machhiwal, Andrew Donnellan, Christophe Leroy, Gautam Menghani, Jiri Slaby (SUSE), Masahiro Yamada, Shrikanth Hegde, Stephen Rothwell, Venkat Rao Bagalkote, and Xichao Zhao * tag 'powerpc-6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc/boot/install.sh: Fix shellcheck warnings powerpc/prom_init: Fix shellcheck warnings powerpc/kvm: Fix ifdef to remove build warning powerpc: unify two CONFIG_POWERPC64_CPU entries in the same choice block powerpc: use always-y instead of extra-y in Makefiles powerpc/64: Drop unnecessary 'rc' variable powerpc: Use dev_fwnode() KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() commit ebf2bfec412ad293a0b118fb1a20a551088ebc9b Author: Linus Torvalds Date: Thu Aug 28 15:16:16 2025 -0700 MAINTAINERS: mark bcachefs externally maintained As per many long discussion threads, public and private. Signed-off-by: Linus Torvalds commit 59b00024ce5baeecb3a7becf11271bbee8a85f62 Merge: 1b237f190eb3d3 75671d90fde8c7 Author: Dave Airlie Date: Fri Aug 29 07:06:31 2025 +1000 Merge tag 'drm-xe-fixes-2025-08-27' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Fix user-fence race issue (Zbigniew) - Couple xe_vm fixes (Thomas) - Don't trigger rebind on initial dma-buf validation (Brost) - Fix a build issue related to basename() posix vs gnu discrepancy (Carlos) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aK8oalcIU-zQOfws@intel.com commit ee372e645178802be7cb35263de941db7b2c5354 Author: Marc Zyngier Date: Sat Aug 9 15:48:10 2025 +0100 KVM: arm64: nv: Fix ATS12 handling of single-stage translation Volodymyr reports that using a Xen DomU as a nested guest (where HCR_EL2.E2H == 0), ATS12 results in a translation that stops at the L2's S1, which isn't something you'd normally expects. Comparing the code against the spec proves to be illuminating, and suggests that the author of such code must have been tired, cross-eyed, drunk, or maybe all of the above. The gist of it is that, apart from HCR_EL2.VM or HCR_EL2.DC being 0, only the use of the EL2&0 translation regime limits the walk to S1 only, and that we must finish the S2 walk in any other case. Which solves the above issue, as E2H==0 indicates that ATS12 walks the EL1&0 translation regime. Explicitly checking for EL2&0 fixes this. Reported-by: Volodymyr Babchuk Suggested-by: Oliver Upton Signed-off-by: Marc Zyngier Fixes: be04cebf3e788 ("KVM: arm64: nv: Add emulation of AT S12E{0,1}{R,W}") Link: https://lore.kernel.org/r/20250806141707.3479194-2-volodymyr_babchuk@epam.com Link: https://lore.kernel.org/r/20250809144811.2314038-2-maz@kernel.org Signed-off-by: Oliver Upton commit 3e7fd1febc3156d3d98fba229399a13b12d69707 Author: Ajye Huang Date: Tue Aug 26 23:40:40 2025 +0800 ASoC: SOF: Intel: WCL: Add the sdw_process_wakeen op Add the missing op in the device description to avoid issues with jack detection. Fixes: 6b04629ae97a ("ASoC: SOF: Intel: add initial support for WCL") Acked-by: Peter Ujfalusi Signed-off-by: Ajye Huang Message-ID: <20250826154040.2723998-1-ajye_huang@compal.corp-partner.google.com> Signed-off-by: Mark Brown commit 3328d17e70545f83515b07851302d48c85c466b0 Author: Marc Zyngier Date: Sun Aug 17 13:19:26 2025 +0100 KVM: arm64: Remove __vcpu_{read,write}_sys_reg_{from,to}_cpu() There is no point having __vcpu_{read,write}_sys_reg_{from,to}_cpu() exposed to the rest of the kernel, as the only callers are in sys_regs.c. Move them where they below, which is another opportunity to simplify things a bit. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250817121926.217900-5-maz@kernel.org Signed-off-by: Oliver Upton commit ec0ab059d4359b2dad69f4ef90fa58a0bcdef525 Author: Marc Zyngier Date: Sun Aug 17 13:19:25 2025 +0100 KVM: arm64: Fix vcpu_{read,write}_sys_reg() accessors Volodymyr reports (again!) that under some circumstances (E2H==0, walking S1 PTs), PAR_EL1 doesn't report the value of the latest walk in the CPU register, but that instead the value is written to the backing store. Further investigation indicates that the root cause of this is that a group of registers (PAR_EL1, TPIDR*_EL{0,1}, the *32_EL2 dregs) should always be considered as "on CPU", as they are not remapped between EL1 and EL2. We fail to treat them accordingly, and end-up considering that the register (PAR_EL1 in this example) should be written to memory instead of in the register. While it would be possible to quickly work around it, it is obvious that the way we track these things at the moment is pretty horrible, and could do with some improvement. Revamp the whole thing by: - defining a location for a register (memory, cpu), potentially depending on the state of the vcpu - define a transformation for this register (mapped register, potential translation, special register needing some particular attention) - convey this information in a structure that can be easily passed around As a result, the accessors themselves become much simpler, as the state is explicit instead of being driven by hard-to-understand conventions. We get rid of the "pure EL2 register" notion, which wasn't very useful, and add sanitisation of the values by applying the RESx masks as required, something that was missing so far. And of course, we add the missing registers to the list, with the indication that they are always loaded. Reported-by: Volodymyr Babchuk Signed-off-by: Marc Zyngier Fixes: fedc612314acf ("KVM: arm64: nv: Handle virtual EL2 registers in vcpu_read/write_sys_reg()") Link: https://lore.kernel.org/r/20250806141707.3479194-3-volodymyr_babchuk@epam.com Link: https://lore.kernel.org/r/20250817121926.217900-4-maz@kernel.org Signed-off-by: Oliver Upton commit e3f6836a632e6d68201b6bc6e02bda92b00f3f57 Author: Marc Zyngier Date: Sun Aug 17 13:19:24 2025 +0100 KVM: arm64: Simplify sysreg access on exception delivery Distinguishing between NV and VHE is slightly pointless, and only serves as an extra complication, or a way to introduce bugs, such as the way SPSR_EL1 gets written without checking for the state being resident. Get rid if this silly distinction, and fix the bug in one go. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250817121926.217900-3-maz@kernel.org Signed-off-by: Oliver Upton commit b720269334f55f2e683fbb8f1f065a12f2c72eb6 Author: Marc Zyngier Date: Sun Aug 17 13:19:23 2025 +0100 KVM: arm64: Check for SYSREGS_ON_CPU before accessing the 32bit state Just like c6e35dff58d3 ("KVM: arm64: Check for SYSREGS_ON_CPU before accessing the CPU state") fixed the 64bit state access, add a check for the 32bit state actually being on the CPU before writing it. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250817121926.217900-2-maz@kernel.org Signed-off-by: Oliver Upton commit 112f7d3cff02e357c2f7a116fd7ab6a366ed27f4 Author: Takashi Iwai Date: Thu Aug 28 16:11:00 2025 +0200 ALSA: hda: Avoid binding with SOF for SKL/KBL platforms For Intel SKL and KBL platforms, it may be bound with one of three HD-audio drivers (AVS, SOF and legacy). AVS is the preferred one when DMIC is detected, and that's how it's defined in the snd-intel-dspcfg config table. But, when AVS driver is disabled (CONFIG_SND_SOC_INTEL_AVS=n), the device may be bound freely with either SOF or legacy driver. Before 6.17, the legacy driver took it primarily, but on 6.17, likely due to the recent code shuffling, SOF driver seems taking it at first, and fails to probe. For avoiding the regression, we should enforce to bind those with the legacy HD-audio drvier when AVS is disabled. This patch adds the extra two entries in intel-dspcfg table that are applied only when CONFIG_SND_SOC_INTEL_AVS=n, for binding with the legacy driver. Note that there are entries for APL in that config table block, but APL may be supported by SOF for certain setups, so the choice can't be exclusive. Hence this patch includes only SKL and KBL. Link: https://bugzilla.suse.com/show_bug.cgi?id=1248121 Reviewed-by: Cezary Rojewski Link: https://patch.msgid.link/20250828141101.16294-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 95a7c5000956f939b86d8b00b8e6b8345f4a9b65 Author: Coly Li Date: Thu Aug 28 23:48:35 2025 +0800 bcache: change maintainer's email address Change to my new email address on fnnas.com. Signed-off-by: Coly Li Link: https://lore.kernel.org/r/20250828154835.32926-1-colyli@kernel.org Signed-off-by: Jens Axboe commit b0908e03fdd488a5ffd5b80d86dcfc77207464e7 Author: Armin Wolf Date: Tue Aug 26 22:40:07 2025 +0200 platform/x86: acer-wmi: Stop using ACPI bitmap for platform profile choices It turns out that the platform firmware on some models does not return valid data when reading the bitmap of supported platform profiles. This prevents the driver from loading on said models, even when the platform profile interface itself works. Fix this by stop using said bitmap until we have figured out how the OEM software itself detects available platform profiles. Tested-by: Lynne Megido Reported-by: Lynne Megido Closes: https://lore.kernel.org/platform-driver-x86/3f56e68f-85df-4c0a-982c-43f9d635be38@bune.city/ Fixes: 191e21f1a4c3 ("platform/x86: acer-wmi: use an ACPI bitmap to set the platform profile choices") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250826204007.5088-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 23408874e90ee299ab731bc0e0a9b3339dfc3c6e Author: Edip Hazuri Date: Thu Aug 14 23:45:32 2025 +0300 platform/x86: hp-wmi: Add support for Fn+P hotkey Add support for the Fn+P hotkey found on newer HP Victus (and probably newer Omen) laptops. This hotkey is intended for use with Omen Gaming Hub to change the performance profile (see [1]). Pressing Fn+P under linux produced the following warning in dmesg: > hp_wmi: Unknown event_id - 27 - 0x7 Implemented a handling for this event so that the hotkey cycles between the platform profiles when triggered. Tested on Victus 16-s1011nt (9Z791EA, MB 8C9C). Changes in v2: - Make the key just switches between platform profiles instead of assigning a key event code. - v1: https://lore.kernel.org/all/20250802213541.18791-2-edip@medip.dev/ [1]: https://jpcdn.it/img/adadf6c927ffeb75afd8038f95db400a.png Signed-off-by: Edip Hazuri Link: https://lore.kernel.org/r/20250814204529.18467-4-edip@medip.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 3010da6ecf2225e41a79b06bc5f4c9750a4d35cb Author: Li Yifan Date: Mon Aug 25 23:45:50 2025 -0400 platform/x86/intel/pmc: Add Bartlett Lake support to intel_pmc_core Add Bartlett Lake P-core only product support to intel_pmc_core driver. Bartlett Lake hybrid product reuses Raptor Lake model name so it is already enabled. Acked-by: Xi Pardee Signed-off-by: Li Yifan Link: https://lore.kernel.org/r/20250826034550.2284738-1-yifan2.li@intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5549202b9c02c2ecbc8634768a3da8d9e82d548d Author: Takashi Iwai Date: Wed Aug 27 07:24:33 2025 +0200 platform/x86: asus-wmi: Fix racy registrations asus_wmi_register_driver() may be called from multiple drivers concurrently, which can lead to the racy list operations, eventually corrupting the memory and hitting Oops on some ASUS machines. Also, the error handling is missing, and it forgot to unregister ACPI lps0 dev ops in the error case. This patch covers those issues by introducing a simple mutex at acpi_wmi_register_driver() & *_unregister_driver, and adding the proper call of asus_s2idle_check_unregister() in the error path. Fixes: feea7bd6b02d ("platform/x86: asus-wmi: Refactor Ally suspend/resume") Link: https://bugzilla.suse.com/show_bug.cgi?id=1246924 Link: https://lore.kernel.org/07815053-0e31-4e8e-8049-b652c929323b@kernel.org Signed-off-by: Takashi Iwai Link: https://lore.kernel.org/r/20250827052441.23382-1-tiwai@suse.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c96f86217bb28e019403bb8f59eacd8ad5a7ad1a Author: Christoffer Sandberg Date: Wed Aug 27 15:13:51 2025 +0200 platform/x86/amd/pmc: Add TUXEDO IB Pro Gen10 AMD to spurious 8042 quirks list Prevents instant wakeup ~1s after suspend. It seems to be kernel/system dependent if the IRQ actually manages to wake the system every time or if it gets ignored (and everything works as expected). Signed-off-by: Christoffer Sandberg Signed-off-by: Werner Sembach Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250827131424.16436-1-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 3c75dc44ad11c347596aa81af3c8d4a7547dd517 Author: Anton Khirnov Date: Wed Aug 27 17:29:54 2025 +0200 platform/x86: asus-wmi: map more keys on ExpertBook B9 * there is a dedicated "noise cancel" key in top row, between mic mute and PrintScreen; it sends 0xCA when pressed by itself (mapped to F13), 0xCB with Fn (mapped to F14) * Fn+f sends 0x9D; it is not documented in the manual, but some web search results mention "asus intelligent performance"; mapped to FN_F Signed-off-by: Anton Khirnov Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250827152954.4844-1-anton@khirnov.net Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ce971233242b5391d99442271f3ca096fb49818d Author: Thomas Richter Date: Fri Aug 22 14:05:57 2025 +0200 s390/cpum_cf: Deny all sampling events by counter PMU Deny all sampling event by the CPUMF counter facility device driver and return -ENOENT. This return value is used to try other PMUs. Up to now events for type PERF_TYPE_HARDWARE were not tested for sampling and returned later on -EOPNOTSUPP. This ends the search for alternative PMUs. Change that behavior and try other PMUs instead. Fixes: 613a41b0d16e ("s390/cpum_cf: Reject request for sampling in event initialization") Acked-by: Sumanth Korikkar Signed-off-by: Thomas Richter Signed-off-by: Alexander Gordeev commit 85941afd2c404247e583c827fae0a45da1c1d92c Author: Thomas Richter Date: Mon Aug 25 09:53:27 2025 +0200 s390/pai: Deny all events not handled by this PMU Each PAI PMU device driver returns -EINVAL when an event is out of its accepted range. This return value aborts the search for an alternative PMU device driver to handle this event. Change the return value to -ENOENT. This return value is used to try other PMUs instead. This makes the PMUs more robust when the sequence of PMU device driver initialization changes (at boot time) or by using modules. Fixes: 39d62336f5c12 ("s390/pai: add support for cryptography counters") Acked-by: Sumanth Korikkar Signed-off-by: Thomas Richter Signed-off-by: Alexander Gordeev commit 9b2785ea8592f239836405de023c75c4f3f5ce00 Author: Ming Lei Date: Wed Aug 27 20:16:00 2025 +0800 ublk selftests: add --no_ublk_fixed_fd for not using registered ublk char device Add a new command line option --no_ublk_fixed_fd that excludes the ublk control device (/dev/ublkcN) from io_uring's registered files array. When this option is used, only backing files are registered starting from index 1, while the ublk control device is accessed using its raw file descriptor. Add ublk_get_registered_fd() helper function that returns the appropriate file descriptor for use with io_uring operations. Key optimizations implemented: - Cache UBLKS_Q_NO_UBLK_FIXED_FD flag in ublk_queue.flags to avoid reading dev->no_ublk_fixed_fd in fast path - Cache ublk char device fd in ublk_queue.ublk_fd for fast access - Update ublk_get_registered_fd() to use ublk_queue * parameter - Update io_uring_prep_buf_register/unregister() to use ublk_queue * - Replace ublk_device * access with ublk_queue * access in fast paths Also pass --no_ublk_fixed_fd to test_stress_04.sh for covering plain ublk char device mode. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250827121602.2619736-3-ming.lei@redhat.com Signed-off-by: Jens Axboe commit c5c5eb24ed6177fc0ef4bb75fc18d07a99c1d3f0 Author: Ming Lei Date: Wed Aug 27 20:15:59 2025 +0800 ublk: avoid ublk_io_release() called after ublk char dev is closed When running test_stress_04.sh, the following warning is triggered: WARNING: CPU: 1 PID: 135 at drivers/block/ublk_drv.c:1933 ublk_ch_release+0x423/0x4b0 [ublk_drv] This happens when the daemon is abruptly killed: - some references may still be held, because registering IO buffer doesn't grab ublk char device reference OR - io->task_registered_buffers won't be cleared because io buffer is released from non-daemon context For zero-copy and auto buffer register modes, I/O reference crosses syscalls, so IO reference may not be dropped naturally when ublk server is killed abruptly. However, when releasing io_uring context, it is guaranteed that the reference is dropped finally, see io_sqe_buffers_unregister() from io_ring_ctx_free(). Fix this by adding ublk_drain_io_references() that: - Waits for active I/O references dropped in async way by scheduling work function, for avoiding ublk dev and io_uring file's release dependency - Reinitializes io->ref and io->task_registered_buffers to clean state This ensures the reference count state is clean when ublk_queue_reinit() is called, preventing the warning and potential use-after-free. Fixes: 1f6540e2aabb ("ublk: zc register/unregister bvec") Fixes: 1ceeedb59749 ("ublk: optimize UBLK_IO_UNREGISTER_IO_BUF on daemon task") Fixes: 8a8fe42d765b ("ublk: optimize UBLK_IO_REGISTER_IO_BUF on daemon task") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250827121602.2619736-2-ming.lei@redhat.com Signed-off-by: Jens Axboe commit fd779eac2d659668be4d3dbdac0710afd5d6db12 Author: Alexander Sverdlin Date: Thu Aug 21 14:00:57 2025 +0200 mtd: nand: raw: atmel: Respect tAR, tCLR in read setup timing Having setup time 0 violates tAR, tCLR of some chips, for instance TOSHIBA TC58NVG2S3ETAI0 cannot be detected successfully (first ID byte being read duplicated, i.e. 98 98 dc 90 15 76 14 03 instead of 98 dc 90 15 76 ...). Atmel Application Notes postulated 1 cycle NRD_SETUP without explanation [1], but it looks more appropriate to just calculate setup time properly. [1] Link: https://ww1.microchip.com/downloads/aemDocuments/documents/MPU32/ApplicationNotes/ApplicationNotes/doc6255.pdf Cc: stable@vger.kernel.org Fixes: f9ce2eddf176 ("mtd: nand: atmel: Add ->setup_data_interface() hooks") Signed-off-by: Alexander Sverdlin Tested-by: Alexander Dahl Signed-off-by: Miquel Raynal commit 811c0da4542df3c065f6cb843ced68780e27bb44 Author: Christophe Kerello Date: Tue Aug 12 09:30:08 2025 +0200 mtd: rawnand: stm32_fmc2: fix ECC overwrite In case OOB write is requested during a data write, ECC is currently lost. Avoid this issue by only writing in the free spare area. This issue has been seen with a YAFFS2 file system. Signed-off-by: Christophe Kerello Cc: stable@vger.kernel.org Fixes: 2cd457f328c1 ("mtd: rawnand: stm32_fmc2: add STM32 FMC2 NAND flash controller driver") Signed-off-by: Miquel Raynal commit 513c40e59d5a414ab763a9c84797534b5e8c208d Author: Christophe Kerello Date: Tue Aug 12 09:26:58 2025 +0200 mtd: rawnand: stm32_fmc2: avoid overlapping mappings on ECC buffer Avoid below overlapping mappings by using a contiguous non-cacheable buffer. [ 4.077708] DMA-API: stm32_fmc2_nfc 48810000.nand-controller: cacheline tracking EEXIST, overlapping mappings aren't supported [ 4.089103] WARNING: CPU: 1 PID: 44 at kernel/dma/debug.c:568 add_dma_entry+0x23c/0x300 [ 4.097071] Modules linked in: [ 4.100101] CPU: 1 PID: 44 Comm: kworker/u4:2 Not tainted 6.1.82 #1 [ 4.106346] Hardware name: STMicroelectronics STM32MP257F VALID1 SNOR / MB1704 (LPDDR4 Power discrete) + MB1703 + MB1708 (SNOR MB1730) (DT) [ 4.118824] Workqueue: events_unbound deferred_probe_work_func [ 4.124674] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 4.131624] pc : add_dma_entry+0x23c/0x300 [ 4.135658] lr : add_dma_entry+0x23c/0x300 [ 4.139792] sp : ffff800009dbb490 [ 4.143016] x29: ffff800009dbb4a0 x28: 0000000004008022 x27: ffff8000098a6000 [ 4.150174] x26: 0000000000000000 x25: ffff8000099e7000 x24: ffff8000099e7de8 [ 4.157231] x23: 00000000ffffffff x22: 0000000000000000 x21: ffff8000098a6a20 [ 4.164388] x20: ffff000080964180 x19: ffff800009819ba0 x18: 0000000000000006 [ 4.171545] x17: 6361727420656e69 x16: 6c6568636163203a x15: 72656c6c6f72746e [ 4.178602] x14: 6f632d646e616e2e x13: ffff800009832f58 x12: 00000000000004ec [ 4.185759] x11: 00000000000001a4 x10: ffff80000988af58 x9 : ffff800009832f58 [ 4.192916] x8 : 00000000ffffefff x7 : ffff80000988af58 x6 : 80000000fffff000 [ 4.199972] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000 [ 4.207128] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0000812d2c40 [ 4.214185] Call trace: [ 4.216605] add_dma_entry+0x23c/0x300 [ 4.220338] debug_dma_map_sg+0x198/0x350 [ 4.224373] __dma_map_sg_attrs+0xa0/0x110 [ 4.228411] dma_map_sg_attrs+0x10/0x2c [ 4.232247] stm32_fmc2_nfc_xfer.isra.0+0x1c8/0x3fc [ 4.237088] stm32_fmc2_nfc_seq_read_page+0xc8/0x174 [ 4.242127] nand_read_oob+0x1d4/0x8e0 [ 4.245861] mtd_read_oob_std+0x58/0x84 [ 4.249596] mtd_read_oob+0x90/0x150 [ 4.253231] mtd_read+0x68/0xac Signed-off-by: Christophe Kerello Cc: stable@vger.kernel.org Fixes: 2cd457f328c1 ("mtd: rawnand: stm32_fmc2: add STM32 FMC2 NAND flash controller driver") Signed-off-by: Miquel Raynal commit 1eae113dd5ff5192cfd3e11b6ab7b96193b42c01 Author: Christophe JAILLET Date: Wed Jul 30 21:47:46 2025 +0200 mtd: rawnand: nuvoton: Fix an error handling path in ma35_nand_chips_init() If a ma35_nand_chip_init() call fails, then a reference to 'nand_np' still needs to be released. Use for_each_child_of_node_scoped() to fix the issue. Fixes: 5abb5d414d55 ("mtd: rawnand: nuvoton: add new driver for the Nuvoton MA35 SoC") Signed-off-by: Christophe JAILLET Signed-off-by: Miquel Raynal commit f544bf03a771ee746b908e9a08ecb97c65a35055 Author: Geert Uytterhoeven Date: Thu Jul 31 10:35:14 2025 +0200 mtd: MTD_INTEL_DG should depend on DRM_I915 or DRM_XE Intel Discrete Graphics non-volatile memory is only present on Intel discrete graphics devices, and its auxiliary device is instantiated by the Intel i915 and Xe2 DRM drivers. Hence add dependencies on DRM_I915 and DRM_XE, to prevent asking the user about this driver when configuring a kernel without Intel graphics support. Fixes: ceb5ab3cb6463795 ("mtd: add driver for intel graphics non-volatile memory device") Signed-off-by: Geert Uytterhoeven Signed-off-by: Miquel Raynal commit 497aa80ec7ee145b3606e7434d57091974d78598 Author: Peter Robinson Date: Wed Aug 27 15:34:58 2025 +0100 arm64: dts: rockchip: Add vcc-supply to SPI flash on Pinephone Pro As documented in the PinephonePro-Schematic-V1.0-20211127.pdf, page 11, the SPI Flash's VCC pin is connected to VCC_1V8 power source. This fixes the following warning: spi-nor spi1.0: supply vcc not found, using dummy regulator Signed-off-by: Peter Robinson Reviewed-by: Ondřej Jirman Link: https://lore.kernel.org/r/20250827143501.1646163-1-pbrobinson@gmail.com Signed-off-by: Heiko Stuebner commit 2c72c8d356db40178be558bbbd43a1d0b5bd0c27 Merge: b3bf3dcb24ce39 019f71a6760a6f Author: Johannes Berg Date: Thu Aug 28 14:03:18 2025 +0200 Merge tag 'iwlwifi-fixes-2025-08-28' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== a few fixes, mainly of the cfg rework. ==================== Signed-off-by: Johannes Berg commit 019f71a6760a6f89d388c3cd45622d1aae7d3641 Author: Johannes Berg Date: Thu Aug 28 09:55:31 2025 +0300 wifi: iwlwifi: cfg: add back more lost PCI IDs Add back a few more PCI IDs to the config match table that evidently I lost during the cleanups. Fixes: 1fb053d9876f ("wifi: iwlwifi: cfg: remove unnecessary configs") Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828095500.46fee422651e.I8f6c3e9eea9523bb1658f5690b715eb443740e07@changeid commit 586e3cb33ba6890054b95aa0ade0a165890efabd Author: Johannes Berg Date: Thu Aug 28 09:55:30 2025 +0300 wifi: iwlwifi: fix byte count table for old devices For devices handled by iwldvm, bc_table_dword was never set, but I missed that during the removal thereof. Change the logic to not treat the byte count table as dwords for devices older than 9000 series to fix that. Fixes: 6570ea227826 ("wifi: iwlwifi: remove bc_table_dword transport config") Signed-off-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828095500.eccd7d3939f1.Ibaffa06d0b3aa5f35a9451d94af34de208b8a2bc@changeid commit 22e6bdb129ec64e640f5cccef9686f7c1a7d559b Author: Johannes Berg Date: Thu Aug 28 09:55:29 2025 +0300 wifi: iwlwifi: cfg: restore some 1000 series configs In the fixed commit, I inadvertently removed two configurations while combining the 0x0083/0x0084 device IDs. Replace the fixed matches for the BG versions by a masked match and add the BGN version back with a similar masked match. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220477 Fixes: 1fb053d9876f ("wifi: iwlwifi: cfg: remove unnecessary configs") Signed-off-by: Johannes Berg Link: https://patch.msgid.link/20250828095500.fabb99c2df9e.If0ad87bf9ab360da5f613e879fd416c17c544733@changeid Signed-off-by: Miri Korenblit commit 98b6fa62c84f2e129161e976a5b9b3cb4ccd117b Author: Jens Axboe Date: Wed Aug 27 15:27:30 2025 -0600 io_uring/kbuf: always use READ_ONCE() to read ring provided buffer lengths Since the buffers are mapped from userspace, it is prudent to use READ_ONCE() to read the value into a local variable, and use that for any other actions taken. Having a stable read of the buffer length avoids worrying about it changing after checking, or being read multiple times. Similarly, the buffer may well change in between it being picked and being committed. Ensure the looping for incremental ring buffer commit stops if it hits a zero sized buffer, as no further progress can be made at that point. Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption") Link: https://lore.kernel.org/io-uring/tencent_000C02641F6250C856D0C26228DE29A3D30A@qq.com/ Reported-by: Qingyue Zhang Reported-by: Suoxing Zhang Signed-off-by: Jens Axboe commit b3bf3dcb24ce3995ded2ad1656dc4fd4a7b002cd Merge: 0e20450829ca3c 49fba87205bec1 Author: Johannes Berg Date: Thu Aug 28 13:41:09 2025 +0200 Merge tag 'mt76-fixes-2025-08-27' of https://github.com/nbd168/wireless Felix Fietkay says: =================== mt76 fixes for 6.17 - fix regressions from mt7996 MLO support rework - fix offchannel handling issues on mt7996 - mt792x fixes - fix multiple wcid linked list corruption issues =================== Change-Id: Ib3e9a3217a40b9da69e122514d47fa46699c864b Signed-off-by: Johannes Berg commit 0e20450829ca3c1dbc2db536391537c57a40fe0b Author: Qianfeng Rong Date: Fri Aug 15 10:30:50 2025 +0800 wifi: mwifiex: Initialize the chan_stats array to zero The adapter->chan_stats[] array is initialized in mwifiex_init_channel_scan_gap() with vmalloc(), which doesn't zero out memory. The array is filled in mwifiex_update_chan_statistics() and then the user can query the data in mwifiex_cfg80211_dump_survey(). There are two potential issues here. What if the user calls mwifiex_cfg80211_dump_survey() before the data has been filled in. Also the mwifiex_update_chan_statistics() function doesn't necessarily initialize the whole array. Since the array was not initialized at the start that could result in an information leak. Also this array is pretty small. It's a maximum of 900 bytes so it's more appropriate to use kcalloc() instead vmalloc(). Cc: stable@vger.kernel.org Fixes: bf35443314ac ("mwifiex: channel statistics support for mwifiex") Suggested-by: Dan Carpenter Signed-off-by: Qianfeng Rong Reviewed-by: Dan Carpenter Link: https://patch.msgid.link/20250815023055.477719-1-rongqianfeng@vivo.com Signed-off-by: Johannes Berg commit 75575e2d252afb29fdbcbeec4d67e042007add52 Author: Benjamin Berg Date: Tue Aug 26 20:26:01 2025 +0300 wifi: mac80211: do not permit 40 MHz EHT operation on 5/6 GHz The EHT PHY requirements state that 80 MHz must be supported on the 5 and 6 GHz bands unless the STA is 20 MHz only. So if the channel width is limited to 40 MHz on a band other than 2.4 GHz, then disable EHT and downgrade to HE. The primary case where this can happen is if the hardware disables puncturing using IEEE80211_HW_DISALLOW_PUNCTURING. Signed-off-by: Benjamin Berg Cc: stable@vger.kernel.org Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250826202553.a6582f3abf57.Ic670429dc7127f68c818b4290d950ebfb5a0b9e1@changeid Signed-off-by: Johannes Berg commit 1d33694462fa7da451846c39d653585b61375992 Author: Johannes Berg Date: Thu Aug 28 09:55:28 2025 +0300 wifi: iwlwifi: uefi: check DSM item validity The first array index is a bitmap indicating which of the other values are valid. Check that bitmap before returning a value. Fixes: fc7214c3c986 ("wifi: iwlwifi: read DSM functions from UEFI") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220085 Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828095500.59ec52ff865e.I9e11f497a029eb38f481b2c90c43c0935285216d@changeid commit 7bf2dfccc2dd70821104d15cbab7b6fca21872be Author: Johannes Berg Date: Thu Aug 28 09:55:27 2025 +0300 wifi: iwlwifi: acpi: check DSM func validity The DSM func 0 (DSM_FUNC_QUERY) returns a bitmap of which other functions contain valid data, query and check it before returning other functions data. Fixes: 9db93491f29e ("iwlwifi: acpi: support device specific method (DSM)") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220085 Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828095500.881e17ff8f6a.Ic6d92997d9d5fad127919d6e1b830cd3fe944468@changeid commit 224476613c8499f00ce4de975dd65749c5ca498c Author: Emmanuel Grumbach Date: Thu Aug 28 09:55:26 2025 +0300 wifi: iwlwifi: if scratch is ~0U, consider it a failure We want to see bits being set in the scratch register upon resume, but if all the bits are set, it means that we were kicked out of the PCI bus and that clearly doesn't mean we can assume the firmware is still alive after the suspend / resume cycle. Fixes: cb347bd29d0d ("wifi: iwlwifi: mvm: fix hibernation") Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250828095500.0f203e559242.I59eff718cb5fda575db41081a1a389f7af488717@changeid commit 8022629548949eb4d2e2207b893bfb6d486700cb Author: Kuninori Morimoto Date: Tue Aug 26 06:30:01 2025 +0000 ASoC: rsnd: tidyup direction name on rsnd_dai_connect() commit 2c6b6a3e8b93 ("ASoC: rsnd: use snd_pcm_direction_name()") uses snd_pcm_direction_name() instead of original method to get string "Playback" or "Capture". But io->substream might be NULL in this timing. Let's re-use original method. Fixes: 2c6b6a3e8b93 ("ASoC: rsnd: use snd_pcm_direction_name()") Reported-by: Thuan Nguyen Tested-by: Thuan Nguyen Signed-off-by: Kuninori Morimoto Message-ID: <87zfbmwq6v.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit 5189446ba995556eaa3755a6e875bc06675b88bd Author: Oscar Maes Date: Wed Aug 27 08:23:21 2025 +0200 net: ipv4: fix regression in local-broadcast routes Commit 9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes") introduced a regression where local-broadcast packets would have their gateway set in __mkroute_output, which was caused by fi = NULL being removed. Fix this by resetting the fib_info for local-broadcast packets. This preserves the intended changes for directed-broadcast packets. Cc: stable@vger.kernel.org Fixes: 9e30ecf23b1b ("net: ipv4: fix incorrect MTU in broadcast routes") Reported-by: Brett A C Sheffield Closes: https://lore.kernel.org/regressions/20250822165231.4353-4-bacs@librecast.net Signed-off-by: Oscar Maes Reviewed-by: David Ahern Link: https://patch.msgid.link/20250827062322.4807-1-oscmaes92@gmail.com Signed-off-by: Paolo Abeni commit dac978e51cce0c1f00a14c4a82f81d387f79b2d4 Author: Neil Mandir Date: Tue Aug 26 10:30:22 2025 -0400 net: macb: Disable clocks once When the driver is removed the clocks are disabled twice: once in macb_remove and a second time by runtime pm. Disable wakeup in remove so all the clocks are disabled and skip the second call to macb_clks_disable. Always suspend the device as we always set it active in probe. Fixes: d54f89af6cc4 ("net: macb: Add pm runtime support") Signed-off-by: Neil Mandir Co-developed-by: Sean Anderson Signed-off-by: Sean Anderson Link: https://patch.msgid.link/20250826143022.935521-1-sean.anderson@linux.dev Signed-off-by: Paolo Abeni commit a6358f8cf64850f3f27857b8ed8c1b08cfc4685c Author: Li Nan Date: Wed Aug 27 15:39:54 2025 +0800 efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare Observed on kernel 6.6 (present on master as well): BUG: KASAN: slab-out-of-bounds in memcmp+0x98/0xd0 Call trace: kasan_check_range+0xe8/0x190 __asan_loadN+0x1c/0x28 memcmp+0x98/0xd0 efivarfs_d_compare+0x68/0xd8 __d_lookup_rcu_op_compare+0x178/0x218 __d_lookup_rcu+0x1f8/0x228 d_alloc_parallel+0x150/0x648 lookup_open.isra.0+0x5f0/0x8d0 open_last_lookups+0x264/0x828 path_openat+0x130/0x3f8 do_filp_open+0x114/0x248 do_sys_openat2+0x340/0x3c0 __arm64_sys_openat+0x120/0x1a0 If dentry->d_name.len < EFI_VARIABLE_GUID_LEN , 'guid' can become negative, leadings to oob. The issue can be triggered by parallel lookups using invalid filename: T1 T2 lookup_open ->lookup simple_lookup d_add // invalid dentry is added to hash list lookup_open d_alloc_parallel __d_lookup_rcu __d_lookup_rcu_op_compare hlist_bl_for_each_entry_rcu // invalid dentry can be retrieved ->d_compare efivarfs_d_compare // oob Fix it by checking 'guid' before cmp. Fixes: da27a24383b2 ("efivarfs: guid part of filenames are case-insensitive") Signed-off-by: Li Nan Signed-off-by: Wu Guanghao Signed-off-by: Ard Biesheuvel commit 6659d027998083fbb6d42a165b0c90dc2e8ba989 Author: Harry Yoo Date: Mon Aug 18 11:02:06 2025 +0900 x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() Define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to ensure page tables are properly synchronized when calling p*d_populate_kernel(). For 5-level paging, synchronization is performed via pgd_populate_kernel(). In 4-level paging, pgd_populate() is a no-op, so synchronization is instead performed at the P4D level via p4d_populate_kernel(). This fixes intermittent boot failures on systems using 4-level paging and a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It also fixes a crash in vmemmap_set_pmd() caused by accessing vmemmap before sync_global_pgds() [1]: BUG: unable to handle page fault for address: ffffeb3ff1200000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: Oops: 0002 [#1] PREEMPT SMP NOPTI Tainted: [W]=WARN RIP: 0010:vmemmap_set_pmd+0xff/0x230 vmemmap_populate_hugepages+0x176/0x180 vmemmap_populate+0x34/0x80 __populate_section_memmap+0x41/0x90 sparse_add_section+0x121/0x3e0 __add_pages+0xba/0x150 add_pages+0x1d/0x70 memremap_pages+0x3dc/0x810 devm_memremap_pages+0x1c/0x60 xe_devm_add+0x8b/0x100 [xe] xe_tile_init_noalloc+0x6a/0x70 [xe] xe_device_probe+0x48c/0x740 [xe] [... snip ...] Link: https://lkml.kernel.org/r/20250818020206.4517-4-harry.yoo@oracle.com Fixes: 8d400913c231 ("x86/vmemmap: handle unpopulated sub-pmd ranges") Signed-off-by: Harry Yoo Closes: https://lore.kernel.org/linux-mm/20250311114420.240341-1-gwan-gyeong.mun@intel.com [1] Suggested-by: Dave Hansen Acked-by: Kiryl Shutsemau Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Alexander Potapenko Cc: Alistair Popple Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Andy Lutomirski Cc: "Aneesh Kumar K.V" Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: bibo mao Cc: Borislav Betkov Cc: Christoph Lameter (Ampere) Cc: Dennis Zhou Cc: Dev Jain Cc: Dmitriy Vyukov Cc: Ingo Molnar Cc: Jane Chu Cc: Joao Martins Cc: Joerg Roedel Cc: John Hubbard Cc: Kevin Brodsky Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Peter Xu Cc: Peter Zijlstra Cc: Qi Zheng Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Huth Cc: "Uladzislau Rezki (Sony)" Cc: Vincenzo Frascino Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit f2d2f9598ebb0158a3fe17cda0106d7752e654a2 Author: Harry Yoo Date: Mon Aug 18 11:02:05 2025 +0900 mm: introduce and use {pgd,p4d}_populate_kernel() Introduce and use {pgd,p4d}_populate_kernel() in core MM code when populating PGD and P4D entries for the kernel address space. These helpers ensure proper synchronization of page tables when updating the kernel portion of top-level page tables. Until now, the kernel has relied on each architecture to handle synchronization of top-level page tables in an ad-hoc manner. For example, see commit 9b861528a801 ("x86-64, mem: Update all PGDs for direct mapping and vmemmap mapping changes"). However, this approach has proven fragile for following reasons: 1) It is easy to forget to perform the necessary page table synchronization when introducing new changes. For instance, commit 4917f55b4ef9 ("mm/sparse-vmemmap: improve memory savings for compound devmaps") overlooked the need to synchronize page tables for the vmemmap area. 2) It is also easy to overlook that the vmemmap and direct mapping areas must not be accessed before explicit page table synchronization. For example, commit 8d400913c231 ("x86/vmemmap: handle unpopulated sub-pmd ranges")) caused crashes by accessing the vmemmap area before calling sync_global_pgds(). To address this, as suggested by Dave Hansen, introduce _kernel() variants of the page table population helpers, which invoke architecture-specific hooks to properly synchronize page tables. These are introduced in a new header file, include/linux/pgalloc.h, so they can be called from common code. They reuse existing infrastructure for vmalloc and ioremap. Synchronization requirements are determined by ARCH_PAGE_TABLE_SYNC_MASK, and the actual synchronization is performed by arch_sync_kernel_mappings(). This change currently targets only x86_64, so only PGD and P4D level helpers are introduced. Currently, these helpers are no-ops since no architecture sets PGTBL_{PGD,P4D}_MODIFIED in ARCH_PAGE_TABLE_SYNC_MASK. In theory, PUD and PMD level helpers can be added later if needed by other architectures. For now, 32-bit architectures (x86-32 and arm) only handle PGTBL_PMD_MODIFIED, so p*d_populate_kernel() will never affect them unless we introduce a PMD level helper. [harry.yoo@oracle.com: fix KASAN build error due to p*d_populate_kernel()] Link: https://lkml.kernel.org/r/20250822020727.202749-1-harry.yoo@oracle.com Link: https://lkml.kernel.org/r/20250818020206.4517-3-harry.yoo@oracle.com Fixes: 8d400913c231 ("x86/vmemmap: handle unpopulated sub-pmd ranges") Signed-off-by: Harry Yoo Suggested-by: Dave Hansen Acked-by: Kiryl Shutsemau Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Alexander Potapenko Cc: Alistair Popple Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Andy Lutomirski Cc: "Aneesh Kumar K.V" Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: bibo mao Cc: Borislav Betkov Cc: Christoph Lameter (Ampere) Cc: Dennis Zhou Cc: Dev Jain Cc: Dmitriy Vyukov Cc: Gwan-gyeong Mun Cc: Ingo Molnar Cc: Jane Chu Cc: Joao Martins Cc: Joerg Roedel Cc: John Hubbard Cc: Kevin Brodsky Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Peter Xu Cc: Peter Zijlstra Cc: Qi Zheng Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Huth Cc: "Uladzislau Rezki (Sony)" Cc: Vincenzo Frascino Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton commit 7cc183f2e67d19b03ee5c13a6664b8c6cc37ff9d Author: Harry Yoo Date: Mon Aug 18 11:02:04 2025 +0900 mm: move page table sync declarations to linux/pgtable.h During our internal testing, we started observing intermittent boot failures when the machine uses 4-level paging and has a large amount of persistent memory: BUG: unable to handle page fault for address: ffffe70000000034 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP NOPTI RIP: 0010:__init_single_page+0x9/0x6d Call Trace: __init_zone_device_page+0x17/0x5d memmap_init_zone_device+0x154/0x1bb pagemap_range+0x2e0/0x40f memremap_pages+0x10b/0x2f0 devm_memremap_pages+0x1e/0x60 dev_dax_probe+0xce/0x2ec [device_dax] dax_bus_probe+0x6d/0xc9 [... snip ...] It turns out that the kernel panics while initializing vmemmap (struct page array) when the vmemmap region spans two PGD entries, because the new PGD entry is only installed in init_mm.pgd, but not in the page tables of other tasks. And looking at __populate_section_memmap(): if (vmemmap_can_optimize(altmap, pgmap)) // does not sync top level page tables r = vmemmap_populate_compound_pages(pfn, start, end, nid, pgmap); else // sync top level page tables in x86 r = vmemmap_populate(start, end, nid, altmap); In the normal path, vmemmap_populate() in arch/x86/mm/init_64.c synchronizes the top level page table (See commit 9b861528a801 ("x86-64, mem: Update all PGDs for direct mapping and vmemmap mapping changes")) so that all tasks in the system can see the new vmemmap area. However, when vmemmap_can_optimize() returns true, the optimized path skips synchronization of top-level page tables. This is because vmemmap_populate_compound_pages() is implemented in core MM code, which does not handle synchronization of the top-level page tables. Instead, the core MM has historically relied on each architecture to perform this synchronization manually. We're not the first party to encounter a crash caused by not-sync'd top level page tables: earlier this year, Gwan-gyeong Mun attempted to address the issue [1] [2] after hitting a kernel panic when x86 code accessed the vmemmap area before the corresponding top-level entries were synced. At that time, the issue was believed to be triggered only when struct page was enlarged for debugging purposes, and the patch did not get further updates. It turns out that current approach of relying on each arch to handle the page table sync manually is fragile because 1) it's easy to forget to sync the top level page table, and 2) it's also easy to overlook that the kernel should not access the vmemmap and direct mapping areas before the sync. # The solution: Make page table sync more code robust and harder to miss To address this, Dave Hansen suggested [3] [4] introducing {pgd,p4d}_populate_kernel() for updating kernel portion of the page tables and allow each architecture to explicitly perform synchronization when installing top-level entries. With this approach, we no longer need to worry about missing the sync step, reducing the risk of future regressions. The new interface reuses existing ARCH_PAGE_TABLE_SYNC_MASK, PGTBL_P*D_MODIFIED and arch_sync_kernel_mappings() facility used by vmalloc and ioremap to synchronize page tables. pgd_populate_kernel() looks like this: static inline void pgd_populate_kernel(unsigned long addr, pgd_t *pgd, p4d_t *p4d) { pgd_populate(&init_mm, pgd, p4d); if (ARCH_PAGE_TABLE_SYNC_MASK & PGTBL_PGD_MODIFIED) arch_sync_kernel_mappings(addr, addr); } It is worth noting that vmalloc() and apply_to_range() carefully synchronizes page tables by calling p*d_alloc_track() and arch_sync_kernel_mappings(), and thus they are not affected by this patch series. This series was hugely inspired by Dave Hansen's suggestion and hence added Suggested-by: Dave Hansen. Cc stable because lack of this series opens the door to intermittent boot failures. This patch (of 3): Move ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() to linux/pgtable.h so that they can be used outside of vmalloc and ioremap. Link: https://lkml.kernel.org/r/20250818020206.4517-1-harry.yoo@oracle.com Link: https://lkml.kernel.org/r/20250818020206.4517-2-harry.yoo@oracle.com Link: https://lore.kernel.org/linux-mm/20250220064105.808339-1-gwan-gyeong.mun@intel.com [1] Link: https://lore.kernel.org/linux-mm/20250311114420.240341-1-gwan-gyeong.mun@intel.com [2] Link: https://lore.kernel.org/linux-mm/d1da214c-53d3-45ac-a8b6-51821c5416e4@intel.com [3] Link: https://lore.kernel.org/linux-mm/4d800744-7b88-41aa-9979-b245e8bf794b@intel.com [4] Fixes: 8d400913c231 ("x86/vmemmap: handle unpopulated sub-pmd ranges") Signed-off-by: Harry Yoo Acked-by: Kiryl Shutsemau Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: "Uladzislau Rezki (Sony)" Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Alexander Potapenko Cc: Alistair Popple Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Andy Lutomirski Cc: "Aneesh Kumar K.V" Cc: Anshuman Khandual Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: bibo mao Cc: Borislav Betkov Cc: Christoph Lameter (Ampere) Cc: Dennis Zhou Cc: Dev Jain Cc: Dmitriy Vyukov Cc: Gwan-gyeong Mun Cc: Ingo Molnar Cc: Jane Chu Cc: Joao Martins Cc: Joerg Roedel Cc: John Hubbard Cc: Kevin Brodsky Cc: Liam Howlett Cc: Michal Hocko Cc: Oscar Salvador Cc: Peter Xu Cc: Peter Zijlstra Cc: Qi Zheng Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Thomas Gleinxer Cc: Thomas Huth Cc: Vincenzo Frascino Cc: Vlastimil Babka Cc: Dave Hansen Cc: Signed-off-by: Andrew Morton commit 2ce3d282bd5050fca8577defeff08ada0d55d062 Author: wangzijie Date: Mon Aug 18 20:31:02 2025 +0800 proc: fix missing pde_set_flags() for net proc files To avoid potential UAF issues during module removal races, we use pde_set_flags() to save proc_ops flags in PDE itself before proc_register(), and then use pde_has_proc_*() helpers instead of directly dereferencing pde->proc_ops->*. However, the pde_set_flags() call was missing when creating net related proc files. This omission caused incorrect behavior which FMODE_LSEEK was being cleared inappropriately in proc_reg_open() for net proc files. Lars reported it in this link[1]. Fix this by ensuring pde_set_flags() is called when register proc entry, and add NULL check for proc_ops in pde_set_flags(). [wangzijie1@honor.com: stash pde->proc_ops in a local const variable, per Christian] Link: https://lkml.kernel.org/r/20250821105806.1453833-1-wangzijie1@honor.com Link: https://lkml.kernel.org/r/20250818123102.959595-1-wangzijie1@honor.com Link: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/ [1] Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al") Signed-off-by: wangzijie Reported-by: Lars Wendler Tested-by: Stefano Brivio Tested-by: Petr Vaněk Tested by: Lars Wendler Cc: Alexei Starovoitov Cc: Alexey Dobriyan Cc: Al Viro Cc: "Edgecombe, Rick P" Cc: Greg Kroah-Hartman Cc: Jiri Slaby Cc: Kirill A. Shutemov Cc: wangzijie Cc: Signed-off-by: Andrew Morton commit c3576889d87b603cb66b417e08844a53c1077a37 Author: Sumanth Korikkar Date: Thu Aug 7 20:35:45 2025 +0200 mm: fix accounting of memmap pages For !CONFIG_SPARSEMEM_VMEMMAP, memmap page accounting is currently done upfront in sparse_buffer_init(). However, sparse_buffer_alloc() may return NULL in failure scenario. Also, memmap pages may be allocated either from the memblock allocator during early boot or from the buddy allocator. When removed via arch_remove_memory(), accounting of memmap pages must reflect the original allocation source. To ensure correctness: * Account memmap pages after successful allocation in sparse_init_nid() and section_activate(). * Account memmap pages in section_deactivate() based on allocation source. Link: https://lkml.kernel.org/r/20250807183545.1424509-1-sumanthk@linux.ibm.com Fixes: 15995a352474 ("mm: report per-page metadata information") Signed-off-by: Sumanth Korikkar Suggested-by: David Hildenbrand Reviewed-by: Wei Yang Cc: Alexander Gordeev Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Signed-off-by: Andrew Morton commit 9f68eabab9d9aaa764a8d234c4170119e6518102 Author: Quanmin Yan Date: Thu Aug 21 20:55:55 2025 +0800 mm/damon/core: prevent unnecessary overflow in damos_set_effective_quota() On 32-bit systems, the throughput calculation in damos_set_effective_quota() is prone to unnecessary multiplication overflow. Using mult_frac() to fix it. Andrew Paniakin also recently found and privately reported this issue, on 64 bit systems. This can also happen on 64-bit systems, once the charged size exceeds ~17 TiB. On systems running for long time in production, this issue can actually happen. More specifically, when a DAMOS scheme having the time quota run for longtime, throughput calculation can overflow and set esz too small. As a result, speed of the scheme get unexpectedly slow. Link: https://lkml.kernel.org/r/20250821125555.3020951-1-yanquanmin1@huawei.com Fixes: 1cd243030059 ("mm/damon/schemes: implement time quota") Signed-off-by: Quanmin Yan Reported-by: Andrew Paniakin Reviewed-by: SeongJae Park Cc: Kefeng Wang Cc: ze zuo Cc: [5.16+] Signed-off-by: Andrew Morton commit 6310c149e5dede74bb47110e0d7a38c78772c152 Author: Brian Mak Date: Tue Aug 5 14:15:26 2025 -0700 kexec: add KEXEC_FILE_NO_CMA as a legal flag Commit 07d24902977e ("kexec: enable CMA based contiguous allocation") introduces logic to use CMA-based allocation in kexec by default. As part of the changes, it introduces a kexec_file_load flag to disable the use of CMA allocations from userspace. However, this flag is broken since it is missing from the list of legal flags for kexec_file_load. kexec_file_load returns EINVAL when attempting to use the flag. Fix this by adding the KEXEC_FILE_NO_CMA flag to the list of legal flags for kexec_file_load. Without this fix, kexec_file_load syscall will failed and return '-EINVAL' when KEXEC_FILE_NO_CMA is specified. Link: https://lkml.kernel.org/r/20250805211527.122367-2-makb@juniper.net Fixes: 07d24902977e ("kexec: enable CMA based contiguous allocation") Signed-off-by: Brian Mak Acked-by: Baoquan He Cc: Alexander Graf Cc: Borislav Betkov Cc: Dave Young Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Rob Herring Cc: Saravana Kannan Cc: Thomas Gleinxer Signed-off-by: Andrew Morton commit 51337a9a3a404fde0f5337662ffc7699793dfeb5 Author: Ada Couprie Diaz Date: Thu Aug 21 13:07:35 2025 +0100 kasan: fix GCC mem-intrinsic prefix with sw tags GCC doesn't support "hwasan-kernel-mem-intrinsic-prefix", only "asan-kernel-mem-intrinsic-prefix"[0], while LLVM supports both. This is already taken into account when checking "CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX", but not in the KASAN Makefile adding those parameters when "CONFIG_KASAN_SW_TAGS" is enabled. Replace the version check with "CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX", which already validates that mem-intrinsic prefix parameter can be used, and choose the correct name depending on compiler. GCC 13 and above trigger "CONFIG_CC_HAS_KASAN_MEMINTRINSIC_PREFIX" which prevents `mem{cpy,move,set}()` being redefined in "mm/kasan/shadow.c" since commit 36be5cba99f6 ("kasan: treat meminstrinsic as builtins in uninstrumented files"), as we expect the compiler to prefix those calls with `__(hw)asan_` instead. But as the option passed to GCC has been incorrect, the compiler has not been emitting those prefixes, effectively never calling the instrumented versions of `mem{cpy,move,set}()` with "CONFIG_KASAN_SW_TAGS" enabled. If "CONFIG_FORTIFY_SOURCES" is enabled, this issue would be mitigated as it redefines `mem{cpy,move,set}()` and properly aliases the `__underlying_mem*()` that will be called to the instrumented versions. Link: https://lkml.kernel.org/r/20250821120735.156244-1-ada.coupriediaz@arm.com Link: https://gcc.gnu.org/onlinedocs/gcc-13.4.0/gcc/Optimize-Options.html [0] Signed-off-by: Ada Couprie Diaz Fixes: 36be5cba99f6 ("kasan: treat meminstrinsic as builtins in uninstrumented files") Reviewed-by: Yeoreum Yun Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitriy Vyukov Cc: Marco Elver Cc: Marc Rutland Cc: Michael Ellerman Cc: Nathan Chancellor Cc: Vincenzo Frascino Cc: Signed-off-by: Andrew Morton commit c519c3c0a1133c408e83a383aa4dd30010aa5d71 Author: Alexander Gordeev Date: Mon Aug 18 18:39:13 2025 +0200 mm/kasan: avoid lazy MMU mode hazards Functions __kasan_populate_vmalloc() and __kasan_depopulate_vmalloc() use apply_to_pte_range(), which enters lazy MMU mode. In that mode updating PTEs may not be observed until the mode is left. That may lead to a situation in which otherwise correct reads and writes to a PTE using ptep_get(), set_pte(), pte_clear() and other access primitives bring wrong results when the vmalloc shadow memory is being (de-)populated. To avoid these hazards leave the lazy MMU mode before and re-enter it after each PTE manipulation. Link: https://lkml.kernel.org/r/0d2efb7ddddbff6b288fbffeeb10166e90771718.1755528662.git.agordeev@linux.ibm.com Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") Signed-off-by: Alexander Gordeev Cc: Andrey Ryabinin Cc: Daniel Axtens Cc: Marc Rutland Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 08c7c253e032863199da4f089bd0ccab5d1a4876 Author: Alexander Gordeev Date: Mon Aug 18 18:39:12 2025 +0200 mm/kasan: fix vmalloc shadow memory (de-)population races While working on the lazy MMU mode enablement for s390 I hit pretty curious issues in the kasan code. The first is related to a custom kasan-based sanitizer aimed at catching invalid accesses to PTEs and is inspired by [1] conversation. The kasan complains on valid PTE accesses, while the shadow memory is reported as unpoisoned: [ 102.783993] ================================================================== [ 102.784008] BUG: KASAN: out-of-bounds in set_pte_range+0x36c/0x390 [ 102.784016] Read of size 8 at addr 0000780084cf9608 by task vmalloc_test/0/5542 [ 102.784019] [ 102.784040] CPU: 1 UID: 0 PID: 5542 Comm: vmalloc_test/0 Kdump: loaded Tainted: G OE 6.16.0-gcc-ipte-kasan-11657-gb2d930c4950e #340 PREEMPT [ 102.784047] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE [ 102.784049] Hardware name: IBM 8561 T01 703 (LPAR) [ 102.784052] Call Trace: [ 102.784054] [<00007fffe0147ac0>] dump_stack_lvl+0xe8/0x140 [ 102.784059] [<00007fffe0112484>] print_address_description.constprop.0+0x34/0x2d0 [ 102.784066] [<00007fffe011282c>] print_report+0x10c/0x1f8 [ 102.784071] [<00007fffe090785a>] kasan_report+0xfa/0x220 [ 102.784078] [<00007fffe01d3dec>] set_pte_range+0x36c/0x390 [ 102.784083] [<00007fffe01d41c2>] leave_ipte_batch+0x3b2/0xb10 [ 102.784088] [<00007fffe07d3650>] apply_to_pte_range+0x2f0/0x4e0 [ 102.784094] [<00007fffe07e62e4>] apply_to_pmd_range+0x194/0x3e0 [ 102.784099] [<00007fffe07e820e>] __apply_to_page_range+0x2fe/0x7a0 [ 102.784104] [<00007fffe07e86d8>] apply_to_page_range+0x28/0x40 [ 102.784109] [<00007fffe090a3ec>] __kasan_populate_vmalloc+0xec/0x310 [ 102.784114] [<00007fffe090aa36>] kasan_populate_vmalloc+0x96/0x130 [ 102.784118] [<00007fffe0833a04>] alloc_vmap_area+0x3d4/0xf30 [ 102.784123] [<00007fffe083a8ba>] __get_vm_area_node+0x1aa/0x4c0 [ 102.784127] [<00007fffe083c4f6>] __vmalloc_node_range_noprof+0x126/0x4e0 [ 102.784131] [<00007fffe083c980>] __vmalloc_node_noprof+0xd0/0x110 [ 102.784135] [<00007fffe083ca32>] vmalloc_noprof+0x32/0x40 [ 102.784139] [<00007fff608aa336>] fix_size_alloc_test+0x66/0x150 [test_vmalloc] [ 102.784147] [<00007fff608aa710>] test_func+0x2f0/0x430 [test_vmalloc] [ 102.784153] [<00007fffe02841f8>] kthread+0x3f8/0x7a0 [ 102.784159] [<00007fffe014d8b4>] __ret_from_fork+0xd4/0x7d0 [ 102.784164] [<00007fffe299c00a>] ret_from_fork+0xa/0x30 [ 102.784173] no locks held by vmalloc_test/0/5542. [ 102.784176] [ 102.784178] The buggy address belongs to the physical page: [ 102.784186] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x84cf9 [ 102.784198] flags: 0x3ffff00000000000(node=0|zone=1|lastcpupid=0x1ffff) [ 102.784212] page_type: f2(table) [ 102.784225] raw: 3ffff00000000000 0000000000000000 0000000000000122 0000000000000000 [ 102.784234] raw: 0000000000000000 0000000000000000 f200000000000001 0000000000000000 [ 102.784248] page dumped because: kasan: bad access detected [ 102.784250] [ 102.784252] Memory state around the buggy address: [ 102.784260] 0000780084cf9500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.784274] 0000780084cf9580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.784277] >0000780084cf9600: fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.784290] ^ [ 102.784293] 0000780084cf9680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.784303] 0000780084cf9700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 102.784306] ================================================================== The second issue hits when the custom sanitizer above is not implemented, but the kasan itself is still active: [ 1554.438028] Unable to handle kernel pointer dereference in virtual kernel address space [ 1554.438065] Failing address: 001c0ff0066f0000 TEID: 001c0ff0066f0403 [ 1554.438076] Fault in home space mode while using kernel ASCE. [ 1554.438103] AS:00000000059d400b R2:0000000ffec5c00b R3:00000000c6c9c007 S:0000000314470001 P:00000000d0ab413d [ 1554.438158] Oops: 0011 ilc:2 [#1]SMP [ 1554.438175] Modules linked in: test_vmalloc(E+) nft_fib_inet(E) nft_fib_ipv4(E) nft_fib_ipv6(E) nft_fib(E) nft_reject_inet(E) nf_reject_ipv4(E) nf_reject_ipv6(E) nft_reject(E) nft_ct(E) nft_chain_nat(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) nf_tables(E) sunrpc(E) pkey_pckmo(E) uvdevice(E) s390_trng(E) rng_core(E) eadm_sch(E) vfio_ccw(E) mdev(E) vfio_iommu_type1(E) vfio(E) sch_fq_codel(E) drm(E) loop(E) i2c_core(E) drm_panel_orientation_quirks(E) nfnetlink(E) ctcm(E) fsm(E) zfcp(E) scsi_transport_fc(E) diag288_wdt(E) watchdog(E) ghash_s390(E) prng(E) aes_s390(E) des_s390(E) libdes(E) sha3_512_s390(E) sha3_256_s390(E) sha512_s390(E) sha1_s390(E) sha_common(E) pkey(E) autofs4(E) [ 1554.438319] Unloaded tainted modules: pkey_uv(E):1 hmac_s390(E):2 [ 1554.438354] CPU: 1 UID: 0 PID: 1715 Comm: vmalloc_test/0 Kdump: loaded Tainted: G E 6.16.0-gcc-ipte-kasan-11657-gb2d930c4950e #350 PREEMPT [ 1554.438368] Tainted: [E]=UNSIGNED_MODULE [ 1554.438374] Hardware name: IBM 8561 T01 703 (LPAR) [ 1554.438381] Krnl PSW : 0704e00180000000 00007fffe1d3d6ae (memset+0x5e/0x98) [ 1554.438396] R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 [ 1554.438409] Krnl GPRS: 0000000000000001 001c0ff0066f0000 001c0ff0066f0000 00000000000000f8 [ 1554.438418] 00000000000009fe 0000000000000009 0000000000000000 0000000000000002 [ 1554.438426] 0000000000005000 000078031ae655c8 00000feffdcf9f59 0000780258672a20 [ 1554.438433] 0000780243153500 00007f8033780000 00007fffe083a510 00007f7fee7cfa00 [ 1554.438452] Krnl Code: 00007fffe1d3d6a0: eb540008000c srlg %r5,%r4,8 00007fffe1d3d6a6: b9020055 ltgr %r5,%r5 #00007fffe1d3d6aa: a784000b brc 8,00007fffe1d3d6c0 >00007fffe1d3d6ae: 42301000 stc %r3,0(%r1) 00007fffe1d3d6b2: d2fe10011000 mvc 1(255,%r1),0(%r1) 00007fffe1d3d6b8: 41101100 la %r1,256(%r1) 00007fffe1d3d6bc: a757fff9 brctg %r5,00007fffe1d3d6ae 00007fffe1d3d6c0: 42301000 stc %r3,0(%r1) [ 1554.438539] Call Trace: [ 1554.438545] [<00007fffe1d3d6ae>] memset+0x5e/0x98 [ 1554.438552] ([<00007fffe083a510>] remove_vm_area+0x220/0x400) [ 1554.438562] [<00007fffe083a9d6>] vfree.part.0+0x26/0x810 [ 1554.438569] [<00007fff6073bd50>] fix_align_alloc_test+0x50/0x90 [test_vmalloc] [ 1554.438583] [<00007fff6073c73a>] test_func+0x46a/0x6c0 [test_vmalloc] [ 1554.438593] [<00007fffe0283ac8>] kthread+0x3f8/0x7a0 [ 1554.438603] [<00007fffe014d8b4>] __ret_from_fork+0xd4/0x7d0 [ 1554.438613] [<00007fffe299ac0a>] ret_from_fork+0xa/0x30 [ 1554.438622] INFO: lockdep is turned off. [ 1554.438627] Last Breaking-Event-Address: [ 1554.438632] [<00007fffe1d3d65c>] memset+0xc/0x98 [ 1554.438644] Kernel panic - not syncing: Fatal exception: panic_on_oops This series fixes the above issues and is a pre-requisite for the s390 lazy MMU mode implementation. test_vmalloc was used to stress-test the fixes. This patch (of 2): When vmalloc shadow memory is established the modification of the corresponding page tables is not protected by any locks. Instead, the locking is done per-PTE. This scheme however has defects. kasan_populate_vmalloc_pte() - while ptep_get() read is atomic the sequence pte_none(ptep_get()) is not. Doing that outside of the lock might lead to a concurrent PTE update and what could be seen as a shadow memory corruption as result. kasan_depopulate_vmalloc_pte() - by the time a page whose address was extracted from ptep_get() read and cached in a local variable outside of the lock is attempted to get free, could actually be freed already. To avoid these put ptep_get() itself and the code that manipulates the result of the read under lock. In addition, move freeing of the page out of the atomic context. Link: https://lkml.kernel.org/r/cover.1755528662.git.agordeev@linux.ibm.com Link: https://lkml.kernel.org/r/adb258634194593db294c0d1fb35646e894d6ead.1755528662.git.agordeev@linux.ibm.com Link: https://lore.kernel.org/linux-mm/5b0609c9-95ee-4e48-bb6d-98f57c5d2c31@arm.com/ [1] Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory") Signed-off-by: Alexander Gordeev Cc: Andrey Ryabinin Cc: Daniel Axtens Cc: Marc Rutland Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 7a19afee6fb39df63ddea7ce78976d8c521178c6 Author: Yeoreum Yun Date: Fri Aug 1 13:02:36 2025 +0100 kunit: kasan_test: disable fortify string checker on kasan_strings() test Similar to commit 09c6304e38e4 ("kasan: test: fix compatibility with FORTIFY_SOURCE") the kernel is panicing in kasan_string(). This is due to the `src` and `ptr` not being hidden from the optimizer which would disable the runtime fortify string checker. Call trace: __fortify_panic+0x10/0x20 (P) kasan_strings+0x980/0x9b0 kunit_try_run_case+0x68/0x190 kunit_generic_run_threadfn_adapter+0x34/0x68 kthread+0x1c4/0x228 ret_from_fork+0x10/0x20 Code: d503233f a9bf7bfd 910003fd 9424b243 (d4210000) ---[ end trace 0000000000000000 ]--- note: kunit_try_catch[128] exited with irqs disabled note: kunit_try_catch[128] exited with preempt_count 1 # kasan_strings: try faulted: last ** replaying previous printk message ** # kasan_strings: try faulted: last line seen mm/kasan/kasan_test_c.c:1600 # kasan_strings: internal error occurred preventing test case from running: -4 Link: https://lkml.kernel.org/r/20250801120236.2962642-1-yeoreum.yun@arm.com Fixes: 73228c7ecc5e ("KASAN: port KASAN Tests to KUnit") Signed-off-by: Yeoreum Yun Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitriy Vyukov Cc: Vincenzo Frascino Cc: Signed-off-by: Andrew Morton commit 5bbc2b785e63699cfcaa7adbf739f6e9b771028a Author: Zi Yan Date: Tue Aug 5 13:51:40 2025 -0400 selftests/mm: fix FORCE_READ to read input value correctly FORCE_READ() converts input value x to its pointer type then reads from address x. This is wrong. If x is a non-pointer, it would be caught it easily. But all FORCE_READ() callers are trying to read from a pointer and FORCE_READ() basically reads a pointer to a pointer instead of the original typed pointer. Almost no access violation was found, except the one from split_huge_page_test. Fix it by implementing a simplified READ_ONCE() instead. Link: https://lkml.kernel.org/r/20250805175140.241656-1-ziy@nvidia.com Fixes: 3f6bfd4789a0 ("selftests/mm: reuse FORCE_READ to replace "asm volatile("" : "+r" (XXX));"") Signed-off-by: Zi Yan Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: wang lian Reviewed-by: Wei Yang Cc: Christian Brauner Cc: Jann Horn Cc: Kairui Song Cc: Liam Howlett Cc: Mark Brown Cc: SeongJae Park Cc: Shuah Khan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 9614d8bee66387501f48718fa306e17f2aa3f2f3 Author: Sasha Levin Date: Thu Jul 31 10:44:31 2025 -0400 mm/userfaultfd: fix kmap_local LIFO ordering for CONFIG_HIGHPTE With CONFIG_HIGHPTE on 32-bit ARM, move_pages_pte() maps PTE pages using kmap_local_page(), which requires unmapping in Last-In-First-Out order. The current code maps dst_pte first, then src_pte, but unmaps them in the same order (dst_pte, src_pte), violating the LIFO requirement. This causes the warning in kunmap_local_indexed(): WARNING: CPU: 0 PID: 604 at mm/highmem.c:622 kunmap_local_indexed+0x178/0x17c addr \!= __fix_to_virt(FIX_KMAP_BEGIN + idx) Fix this by reversing the unmap order to respect LIFO ordering. This issue follows the same pattern as similar fixes: - commit eca6828403b8 ("crypto: skcipher - fix mismatch between mapping and unmapping order") - commit 8cf57c6df818 ("nilfs2: eliminate staggered calls to kunmap in nilfs_rename") Both of which addressed the same fundamental requirement that kmap_local operations must follow LIFO ordering. Link: https://lkml.kernel.org/r/20250731144431.773923-1-sashal@kernel.org Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI") Signed-off-by: Sasha Levin Acked-by: David Hildenbrand Reviewed-by: Suren Baghdasaryan Cc: Andrea Arcangeli Cc: Signed-off-by: Andrew Morton commit f46e8ef8bb7b452584f2e75337b619ac51a7cadf Author: Edward Adam Davis Date: Tue Aug 19 21:41:02 2025 +0800 ocfs2: prevent release journal inode after journal shutdown Before calling ocfs2_delete_osb(), ocfs2_journal_shutdown() has already been executed in ocfs2_dismount_volume(), so osb->journal must be NULL. Therefore, the following calltrace will inevitably fail when it reaches jbd2_journal_release_jbd_inode(). ocfs2_dismount_volume()-> ocfs2_delete_osb()-> ocfs2_free_slot_info()-> __ocfs2_free_slot_info()-> evict()-> ocfs2_evict_inode()-> ocfs2_clear_inode()-> jbd2_journal_release_jbd_inode(osb->journal->j_journal, Adding osb->journal checks will prevent null-ptr-deref during the above execution path. Link: https://lkml.kernel.org/r/tencent_357489BEAEE4AED74CBD67D246DBD2C4C606@qq.com Fixes: da5e7c87827e ("ocfs2: cleanup journal init and shutdown") Signed-off-by: Edward Adam Davis Reported-by: syzbot+47d8cb2f2cc1517e515a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=47d8cb2f2cc1517e515a Tested-by: syzbot+47d8cb2f2cc1517e515a@syzkaller.appspotmail.com Reviewed-by: Mark Tinguely Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit 5cc5e030bce2ec97ae5cdb2c1b94a98b1047b3fa Author: Baptiste Lepers Date: Tue Aug 12 15:26:56 2025 +0200 rust: mm: mark VmaNew as transparent Unsafe code in VmaNew's methods assumes that the type has the same layout as the inner `bindings::vm_area_struct`. This is not guaranteed by the default struct representation in Rust, but requires specifying the `transparent` representation. Link: https://lkml.kernel.org/r/20250812132712.61007-1-baptiste.lepers@gmail.com Fixes: dcb81aeab406 ("mm: rust: add VmaNew for f_ops->mmap()") Signed-off-by: Baptiste Lepers Reviewed-by: Alice Ryhl Cc: Alex Gaynor Cc: Andreas Hindborg Cc: Björn Roy Baron Cc: Boqun Feng Cc: Danilo Krummrich Cc: Gary Guo Cc: Jann Horn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Miguel Ojeda Cc: Trevor Gross Cc: Signed-off-by: Andrew Morton commit ee4d098cbc9160f573b5c1b5a51d6158efdb2896 Author: Yin Tirui Date: Tue Aug 19 15:55:10 2025 +0800 of_numa: fix uninitialized memory nodes causing kernel panic When there are memory-only nodes (nodes without CPUs), these nodes are not properly initialized, causing kernel panic during boot. of_numa_init of_numa_parse_cpu_nodes node_set(nid, numa_nodes_parsed); of_numa_parse_memory_nodes In of_numa_parse_cpu_nodes, numa_nodes_parsed gets updated only for nodes containing CPUs. Memory-only nodes should have been updated in of_numa_parse_memory_nodes, but they weren't. Subsequently, when free_area_init() attempts to access NODE_DATA() for these uninitialized memory nodes, the kernel panics due to NULL pointer dereference. This can be reproduced on ARM64 QEMU with 1 CPU and 2 memory nodes: qemu-system-aarch64 \ -cpu host -nographic \ -m 4G -smp 1 \ -machine virt,accel=kvm,gic-version=3,iommu=smmuv3 \ -object memory-backend-ram,size=2G,id=mem0 \ -object memory-backend-ram,size=2G,id=mem1 \ -numa node,nodeid=0,memdev=mem0 \ -numa node,nodeid=1,memdev=mem1 \ -kernel $IMAGE \ -hda $DISK \ -append "console=ttyAMA0 root=/dev/vda rw earlycon" [ 0.000000] Booting Linux on physical CPU 0x0000000000 [0x481fd010] [ 0.000000] Linux version 6.17.0-rc1-00001-gabb4b3daf18c-dirty (yintirui@local) (gcc (GCC) 12.3.1, GNU ld (GNU Binutils) 2.41) #52 SMP PREEMPT Mon Aug 18 09:49:40 CST 2025 [ 0.000000] KASLR enabled [ 0.000000] random: crng init done [ 0.000000] Machine model: linux,dummy-virt [ 0.000000] efi: UEFI not found. [ 0.000000] earlycon: pl11 at MMIO 0x0000000009000000 (options '') [ 0.000000] printk: legacy bootconsole [pl11] enabled [ 0.000000] OF: reserved mem: Reserved memory: No reserved-memory node in the DT [ 0.000000] NODE_DATA(0) allocated [mem 0xbfffd9c0-0xbfffffff] [ 0.000000] node 1 must be removed before remove section 23 [ 0.000000] Zone ranges: [ 0.000000] DMA [mem 0x0000000040000000-0x00000000ffffffff] [ 0.000000] DMA32 empty [ 0.000000] Normal [mem 0x0000000100000000-0x000000013fffffff] [ 0.000000] Movable zone start for each node [ 0.000000] Early memory node ranges [ 0.000000] node 0: [mem 0x0000000040000000-0x00000000bfffffff] [ 0.000000] node 1: [mem 0x00000000c0000000-0x000000013fffffff] [ 0.000000] Initmem setup node 0 [mem 0x0000000040000000-0x00000000bfffffff] [ 0.000000] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a0 [ 0.000000] Mem abort info: [ 0.000000] ESR = 0x0000000096000004 [ 0.000000] EC = 0x25: DABT (current EL), IL = 32 bits [ 0.000000] SET = 0, FnV = 0 [ 0.000000] EA = 0, S1PTW = 0 [ 0.000000] FSC = 0x04: level 0 translation fault [ 0.000000] Data abort info: [ 0.000000] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 0.000000] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 0.000000] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 0.000000] [00000000000000a0] user address but active_mm is swapper [ 0.000000] Internal error: Oops: 0000000096000004 [#1] SMP [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 6.17.0-rc1-00001-g760c6dabf762-dirty #54 PREEMPT [ 0.000000] Hardware name: linux,dummy-virt (DT) [ 0.000000] pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.000000] pc : free_area_init+0x50c/0xf9c [ 0.000000] lr : free_area_init+0x5c0/0xf9c [ 0.000000] sp : ffffa02ca0f33c00 [ 0.000000] x29: ffffa02ca0f33cb0 x28: 0000000000000000 x27: 0000000000000000 [ 0.000000] x26: 4ec4ec4ec4ec4ec5 x25: 00000000000c0000 x24: 00000000000c0000 [ 0.000000] x23: 0000000000040000 x22: 0000000000000000 x21: ffffa02ca0f3b368 [ 0.000000] x20: ffffa02ca14c7b98 x19: 0000000000000000 x18: 0000000000000002 [ 0.000000] x17: 000000000000cacc x16: 0000000000000001 x15: 0000000000000001 [ 0.000000] x14: 0000000080000000 x13: 0000000000000018 x12: 0000000000000002 [ 0.000000] x11: ffffa02ca0fd4f00 x10: ffffa02ca14bab20 x9 : ffffa02ca14bab38 [ 0.000000] x8 : 00000000000c0000 x7 : 0000000000000001 x6 : 0000000000000002 [ 0.000000] x5 : 0000000140000000 x4 : ffffa02ca0f33c90 x3 : ffffa02ca0f33ca0 [ 0.000000] x2 : ffffa02ca0f33c98 x1 : 0000000080000000 x0 : 0000000000000001 [ 0.000000] Call trace: [ 0.000000] free_area_init+0x50c/0xf9c (P) [ 0.000000] bootmem_init+0x110/0x1dc [ 0.000000] setup_arch+0x278/0x60c [ 0.000000] start_kernel+0x70/0x748 [ 0.000000] __primary_switched+0x88/0x90 [ 0.000000] Code: d503201f b98093e0 52800016 f8607a93 (f9405260) [ 0.000000] ---[ end trace 0000000000000000 ]--- [ 0.000000] Kernel panic - not syncing: Attempted to kill the idle task! [ 0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]--- Link: https://lkml.kernel.org/r/20250819075510.2079961-1-yintirui@huawei.com Fixes: 767507654c22 ("arch_numa: switch over to numa_memblks") Signed-off-by: Yin Tirui Acked-by: David Hildenbrand Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Kefeng Wang Cc: Chen Jun Cc: Dan Williams Cc: Joanthan Cameron Cc: Rob Herring Cc: Saravana Kannan Cc: Signed-off-by: Andrew Morton commit 82b8166171bdebbc74717e4a0cfb4b89cd0510aa Author: Qianfeng Rong Date: Tue Aug 26 15:54:18 2025 +0800 ata: ahci_xgene: Use int type for 'rc' to store error codes Use int instead of u32 for the 'rc' variable in xgene_ahci_softreset() to store negative error codes returned by ahci_do_softreset(). In xgene_ahci_pmp_softreset(), remove the redundant 'rc' variable and directly return the result of the ahci_do_softreset() call instead. Signed-off-by: Qianfeng Rong Signed-off-by: Damien Le Moal commit 131897c65e2b86cf14bec7379f44aa8fbb407526 Author: Gao Xiang Date: Sun Aug 24 23:11:57 2025 +0800 erofs: fix invalid algorithm for encoded extents The current algorithm sanity checks do not properly apply to new encoded extents. Unify the algorithm check with Z_EROFS_COMPRESSION(_RUNTIME)_MAX and ensure consistency with sbi->available_compr_algs. Reported-and-tested-by: syzbot+5a398eb460ddaa6f242f@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/68a8bd20.050a0220.37038e.005a.GAE@google.com Fixes: 1d191b4ca51d ("erofs: implement encoded extent metadata") Thanks-to: Edward Adam Davis Signed-off-by: Gao Xiang commit 07d9df80082b8d1f37e05658371b087cb6738770 Merge: 39f90c19672153 2c369d91d0933a Author: Linus Torvalds Date: Wed Aug 27 19:18:51 2025 -0700 Merge tag 'perf-tools-fixes-for-v6.17-2025-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf-tools fixes from Namhyung Kim: "A number of kernel header sync changes and two build-id fixes" * tag 'perf-tools-fixes-for-v6.17-2025-08-27' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: perf symbol: Add blocking argument to filename__read_build_id perf symbol-minimal: Fix ehdr reading in filename__read_build_id tools headers: Sync uapi/linux/vhost.h with the kernel source tools headers: Sync uapi/linux/prctl.h with the kernel source tools headers: Sync uapi/linux/fs.h with the kernel source tools headers: Sync uapi/linux/fcntl.h with the kernel source tools headers: Sync syscall tables with the kernel source tools headers: Sync powerpc headers with the kernel source tools headers: Sync arm64 headers with the kernel source tools headers: Sync x86 headers with the kernel source tools headers: Sync linux/cfi_types.h with the kernel source tools headers: Sync linux/bits.h with the kernel source tools headers: Sync KVM headers with the kernel source perf test: Fix a build error in x86 topdown test commit bd2902e0bcac8e4daf9cf630517cda4448665667 Merge: 1cc8a5b534e5f9 6ede14a2c6365e Author: Jakub Kicinski Date: Wed Aug 27 18:57:13 2025 -0700 Merge branch 'locking-fixes-for-fbnic-driver' Alexander Duyck says: ==================== Locking fixes for fbnic driver Address a few locking issues that were reported on the fbnic driver. Specifically in one case we were seeing locking leaks due to us not releasing the locks in certain exception paths. In another case we were using phylink_resume outside of a section in which we held the RTNL mutex and as a result we were throwing an assert. ==================== Link: https://patch.msgid.link/175616242563.1963577.7257712519613275567.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski commit 6ede14a2c6365e7e5d855643c7c8390b5268c467 Author: Alexander Duyck Date: Mon Aug 25 15:56:13 2025 -0700 fbnic: Move phylink resume out of service_task and into open/close The fbnic driver was presenting with the following locking assert coming out of a PM resume: [ 42.208116][ T164] RTNL: assertion failed at drivers/net/phy/phylink.c (2611) [ 42.208492][ T164] WARNING: CPU: 1 PID: 164 at drivers/net/phy/phylink.c:2611 phylink_resume+0x190/0x1e0 [ 42.208872][ T164] Modules linked in: [ 42.209140][ T164] CPU: 1 UID: 0 PID: 164 Comm: bash Not tainted 6.17.0-rc2-virtme #134 PREEMPT(full) [ 42.209496][ T164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-5.fc42 04/01/2014 [ 42.209861][ T164] RIP: 0010:phylink_resume+0x190/0x1e0 [ 42.210057][ T164] Code: 83 e5 01 0f 85 b0 fe ff ff c6 05 1c cd 3e 02 01 90 ba 33 0a 00 00 48 c7 c6 20 3a 1d a5 48 c7 c7 e0 3e 1d a5 e8 21 b8 90 fe 90 <0f> 0b 90 90 e9 86 fe ff ff e8 42 ea 1f ff e9 e2 fe ff ff 48 89 ef [ 42.210708][ T164] RSP: 0018:ffffc90000affbd8 EFLAGS: 00010296 [ 42.210983][ T164] RAX: 0000000000000000 RBX: ffff8880078d8400 RCX: 0000000000000000 [ 42.211235][ T164] RDX: 0000000000000000 RSI: 1ffffffff4f10938 RDI: 0000000000000001 [ 42.211466][ T164] RBP: 0000000000000000 R08: ffffffffa2ae79ea R09: fffffbfff4b3eb84 [ 42.211707][ T164] R10: 0000000000000003 R11: 0000000000000000 R12: ffff888007ad8000 [ 42.211997][ T164] R13: 0000000000000002 R14: ffff888006a18800 R15: ffffffffa34c59e0 [ 42.212234][ T164] FS: 00007f0dc8e39740(0000) GS:ffff88808f51f000(0000) knlGS:0000000000000000 [ 42.212505][ T164] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.212704][ T164] CR2: 00007f0dc8e9fe10 CR3: 000000000b56d003 CR4: 0000000000772ef0 [ 42.213227][ T164] PKRU: 55555554 [ 42.213366][ T164] Call Trace: [ 42.213483][ T164] [ 42.213565][ T164] __fbnic_pm_attach.isra.0+0x8e/0xa0 [ 42.213725][ T164] pci_reset_function+0x116/0x1d0 [ 42.213895][ T164] reset_store+0xa0/0x100 [ 42.214025][ T164] ? pci_dev_reset_attr_is_visible+0x50/0x50 [ 42.214221][ T164] ? sysfs_file_kobj+0xc1/0x1e0 [ 42.214374][ T164] ? sysfs_kf_write+0x65/0x160 [ 42.214526][ T164] kernfs_fop_write_iter+0x2f8/0x4c0 [ 42.214677][ T164] ? kernfs_vma_page_mkwrite+0x1f0/0x1f0 [ 42.214836][ T164] new_sync_write+0x308/0x6f0 [ 42.214987][ T164] ? __lock_acquire+0x34c/0x740 [ 42.215135][ T164] ? new_sync_read+0x6f0/0x6f0 [ 42.215288][ T164] ? lock_acquire.part.0+0xbc/0x260 [ 42.215440][ T164] ? ksys_write+0xff/0x200 [ 42.215590][ T164] ? perf_trace_sched_switch+0x6d0/0x6d0 [ 42.215742][ T164] vfs_write+0x65e/0xbb0 [ 42.215876][ T164] ksys_write+0xff/0x200 [ 42.215994][ T164] ? __ia32_sys_read+0xc0/0xc0 [ 42.216141][ T164] ? do_user_addr_fault+0x269/0x9f0 [ 42.216292][ T164] ? rcu_is_watching+0x15/0xd0 [ 42.216442][ T164] do_syscall_64+0xbb/0x360 [ 42.216591][ T164] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 42.216784][ T164] RIP: 0033:0x7f0dc8ea9986 A bit of digging showed that we were invoking the phylink_resume as a part of the fbnic_up path when we were enabling the service task while not holding the RTNL lock. We should be enabling this sooner as a part of the ndo_open path and then just letting the service task come online later. This will help to enforce the correct locking and brings the phylink interface online at the same time as the network interface, instead of at a later time. I tested this on QEMU to verify this was working by putting the system to sleep using "echo mem > /sys/power/state" to put the system to sleep in the guest and then using the command "system_wakeup" in the QEMU monitor. Fixes: 69684376eed5 ("eth: fbnic: Add link detection") Signed-off-by: Alexander Duyck Reviewed-by: Przemek Kitszel Link: https://patch.msgid.link/175616257316.1963577.12238158800417771119.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski commit 2ddaa562b465921a5d1da3fc939993b92b953e20 Author: Alexander Duyck Date: Mon Aug 25 15:56:06 2025 -0700 fbnic: Fixup rtnl_lock and devl_lock handling related to mailbox code The exception handling path for the __fbnic_pm_resume function had a bug in that it was taking the devlink lock and then exiting to exception handling instead of waiting until after it released the lock to do so. In order to handle that I am swapping the placement of the unlock and the exception handling jump to label so that we don't trigger a deadlock by holding the lock longer than we need to. In addition this change applies the same ordering to the rtnl_lock/unlock calls in the same function as it should make the code easier to follow if it adheres to a consistent pattern. Fixes: 82534f446daa ("eth: fbnic: Add devlink dev flash support") Signed-off-by: Alexander Duyck Reviewed-by: Przemek Kitszel Link: https://patch.msgid.link/175616256667.1963577.5543500806256052549.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Jakub Kicinski commit 1cc8a5b534e5f9b5e129e54ee2e63c9f5da4f39a Author: Eric Dumazet Date: Wed Aug 27 17:21:49 2025 +0000 net: rose: fix a typo in rose_clear_routes() syzbot crashed in rose_clear_routes(), after a recent patch typo. KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 0 UID: 0 PID: 10591 Comm: syz.3.1856 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:rose_clear_routes net/rose/rose_route.c:565 [inline] RIP: 0010:rose_rt_ioctl+0x162/0x1250 net/rose/rose_route.c:760 rose_ioctl+0x3ce/0x8b0 net/rose/af_rose.c:1381 sock_do_ioctl+0xd9/0x300 net/socket.c:1238 sock_ioctl+0x576/0x790 net/socket.c:1359 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: da9c9c877597 ("net: rose: include node references in rose_neigh refcount") Reported-by: syzbot+2eb8d1719f7cfcfa6840@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68af3e29.a70a0220.3cafd4.002e.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Takamitsu Iwai Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250827172149.5359-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9b8c88f875c04d4cb9111bd5dd9291c7e9691bf5 Author: Eric Dumazet Date: Tue Aug 26 13:44:35 2025 +0000 l2tp: do not use sock_hold() in pppol2tp_session_get_sock() pppol2tp_session_get_sock() is using RCU, it must be ready for sk_refcnt being zero. Commit ee40fb2e1eb5 ("l2tp: protect sock pointer of struct pppol2tp_session with RCU") was correct because it had a call_rcu(..., pppol2tp_put_sk) which was later removed in blamed commit. pppol2tp_recv() can use pppol2tp_session_get_sock() as well. Fixes: c5cbaef992d6 ("l2tp: refactor ppp socket/session relationship") Signed-off-by: Eric Dumazet Cc: James Chapman Reviewed-by: Guillaume Nault Link: https://patch.msgid.link/20250826134435.1683435-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2e8750469242cad8f01f320131fd5a6f540dbb99 Author: Eric Dumazet Date: Tue Aug 26 14:13:14 2025 +0000 sctp: initialize more fields in sctp_v6_from_sk() syzbot found that sin6_scope_id was not properly initialized, leading to undefined behavior. Clear sin6_scope_id and sin6_flowinfo. BUG: KMSAN: uninit-value in __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 __sctp_v6_cmp_addr+0x887/0x8c0 net/sctp/ipv6.c:649 sctp_inet6_cmp_addr+0x4f2/0x510 net/sctp/ipv6.c:983 sctp_bind_addr_conflict+0x22a/0x3b0 net/sctp/bind_addr.c:390 sctp_get_port_local+0x21eb/0x2440 net/sctp/socket.c:8452 sctp_get_port net/sctp/socket.c:8523 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x710/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 x64_sys_call+0x271d/0x3e20 arch/x86/include/generated/asm/syscalls_64.h:51 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xd9/0x210 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Local variable addr.i.i created at: sctp_get_port net/sctp/socket.c:8515 [inline] sctp_listen_start net/sctp/socket.c:8567 [inline] sctp_inet_listen+0x650/0xfd0 net/sctp/socket.c:8636 __sys_listen_socket net/socket.c:1912 [inline] __sys_listen net/socket.c:1927 [inline] __do_sys_listen net/socket.c:1932 [inline] __se_sys_listen net/socket.c:1930 [inline] __x64_sys_listen+0x343/0x4c0 net/socket.c:1930 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+e69f06a0f30116c68056@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68adc0a2.050a0220.37038e.00c4.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Marcelo Ricardo Leitner Acked-by: Xin Long Link: https://patch.msgid.link/20250826141314.1802610-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit bcd6f8954dc4a3aa32edda5602e43a0174dc8f0f Author: Subash Abhinov Kasiviswanathan Date: Tue Aug 26 14:50:46 2025 -0700 MAINTAINERS: rmnet: Update email addresses Switch to oss.qualcomm.com ids. Signed-off-by: Sean Tranchetti Signed-off-by: Subash Abhinov Kasiviswanathan Link: https://patch.msgid.link/20250826215046.865530-1-subash.a.kasiviswanathan@oss.qualcomm.com Signed-off-by: Jakub Kicinski commit ab529e6ca1f67bcf31f3ea80c72bffde2e9e053e Author: Shuhao Fu Date: Thu Aug 28 02:24:19 2025 +0800 fs/smb: Fix inconsistent refcnt update A possible inconsistent update of refcount was identified in `smb2_compound_op`. Such inconsistent update could lead to possible resource leaks. Why it is a possible bug: 1. In the comment section of the function, it clearly states that the reference to `cfile` should be dropped after calling this function. 2. Every control flow path would check and drop the reference to `cfile`, except the patched one. 3. Existing callers would not handle refcount update of `cfile` if -ENOMEM is returned. To fix the bug, an extra goto label "out" is added, to make sure that the cleanup logic would always be respected. As the problem is caused by the allocation failure of `vars`, the cleanup logic between label "finished" and "out" can be safely ignored. According to the definition of function `is_replayable_error`, the error code of "-ENOMEM" is not recoverable. Therefore, the replay logic also gets ignored. Signed-off-by: Shuhao Fu Acked-by: Paulo Alcantara (Red Hat) Cc: stable@vger.kernel.org Signed-off-by: Steve French commit c767d74a9cdd1042046d02319d16b85d9aa8a8aa Author: Alex Deucher Date: Fri Aug 22 12:12:37 2025 -0400 drm/amdgpu/userq: fix error handling of invalid doorbell If the doorbell is invalid, be sure to set the r to an error state so the function returns an error. Reviewed-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher (cherry picked from commit 7e2a5b0a9a165a7c51274aa01b18be29491b4345) Cc: stable@vger.kernel.org commit ee38ea0ae4ed13fe33e033dc98d11e76bc7167cd Author: Jesse.Zhang Date: Tue Aug 26 17:30:58 2025 +0800 drm/amdgpu: update firmware version checks for user queue support The minimum firmware versions required for user queue functionality have been increased to address an issue where the queue privilege state was lost during queue connect operations. The problem occurred because the privilege state was being restored to its initial value at the beginning of the function, overwriting the state that was properly set during the queue connect case. This commit updates the minimum version requirements: - ME firmware from 2390 to 2420 - PFP firmware from 2530 to 2580 - MEC firmware from 2600 to 2650 - MES firmware remains at 120 These updated firmware versions contain the necessary fixes to properly maintain queue privilege state throughout connect operations. Fixes: 61ca97e9590c ("drm/amdgpu: Add fw minimum version check for usermode queue") Acked-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 5f976c9939f0d5916d2b8ef3156a6d1799781df1) Cc: stable@vger.kernel.org commit 5dff50802b285da8284a7bf17ae2fdc6f1357023 Author: Yang Wang Date: Mon Aug 25 12:54:01 2025 +0800 drm/amd/amdgpu: disable hwmon power1_cap* for gfx 11.0.3 on vf mode the PPSMC_MSG_GetPptLimit msg is not valid for gfx 11.0.3 on vf mode, so skiped to create power1_cap* hwmon sysfs node. Signed-off-by: Yang Wang Reviewed-by: Asad Kamal Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit e82a8d441038d8cb10b63047a9e705c42479d156) Cc: stable@vger.kernel.org commit ac4ed2da4c1305a1a002415058aa7deaf49ffe3e Author: Alex Deucher Date: Mon Aug 25 13:40:22 2025 -0400 Revert "drm/amdgpu: fix incorrect vm flags to map bo" This reverts commit b08425fa77ad2f305fe57a33dceb456be03b653f. Revert this to align with 6.17 because the fixes tag was wrong on this commit. Signed-off-by: Alex Deucher (cherry picked from commit be33e8a239aac204d7e9e673c4220ef244eb1ba3) commit 29f155c5e82fe35ff85b1f13612cb8c2dbe1dca3 Author: Alex Deucher Date: Tue Jun 24 11:38:14 2025 -0400 drm/amdgpu/gfx12: set MQD as appriopriate for queue types Set the MQD as appropriate for the kernel vs user queues. Acked-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 7b9110f2897957efd9715b52fc01986509729db3) Cc: stable@vger.kernel.org commit 27f5e0c1321ee280189cea16044de2e157dc4bb9 Author: Alex Deucher Date: Tue Jun 24 11:37:16 2025 -0400 drm/amdgpu/gfx11: set MQD as appriopriate for queue types Set the MQD as appropriate for the kernel vs user queues. Acked-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher (cherry picked from commit 063d6683208722b1875f888a45084e3d112701ac) Cc: stable@vger.kernel.org commit 39f90c1967215375f7d87b81d14b0f3ed6b40c29 Merge: 518b21ba139cef 45d8ef6322b8a8 Author: Linus Torvalds Date: Wed Aug 27 10:19:35 2025 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio/vhost fixes from Michael Tsirkin: "More small fixes. Most notably this fixes a messed up ioctl number, and a regression in shmem affecting drm users" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: virtio_net: adjust the execution order of function `virtnet_close` during freeze virtio_input: Improve freeze handling vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER Revert "virtio: reject shm region if length is zero" vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() virtio_pci: Fix misleading comment for queue vector commit 518b21ba139cefa2ee7f9fcf516fdc6743e8db68 Merge: fab1beda7597fa 6f6fbd9a0c5a75 Author: Linus Torvalds Date: Wed Aug 27 10:10:50 2025 -0700 Merge tag 'media/v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: - drop the redundant pm_runtime_mark_last_busy() in rkvdec - fix probing error handling in rkvdec - fix an issue affecting lt6911uxe/lt6911uxc related to CSI-2 GPIO pins in int3472 * tag 'media/v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: media: Remove redundant pm_runtime_mark_last_busy() calls platform/x86: int3472: add hpd pin support media: rkvdec: Remove redundant pm_runtime_mark_last_busy() calls media: rkvdec: Fix an error handling path in rkvdec_probe() media: rkvdec: Fix a NULL vs IS_ERR() bug in probe() commit 8b3641dfb6f902407495c63b9b64482b32319b66 Author: David Kaplan Date: Tue Aug 19 14:21:59 2025 -0500 x86/bugs: Add attack vector controls for SSB Attack vector controls for SSB were missed in the initial attack vector series. The default mitigation for SSB requires user-space opt-in so it is only relevant for user->user attacks. Check with attack vector controls when the command is auto - i.e., no explicit user selection has been done. Fixes: 2d31d2874663 ("x86/bugs: Define attack vectors relevant for each bug") Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250819192200.2003074-5-david.kaplan@amd.com commit ceb9515524046252c522b16f38881e8837ec0d91 Merge: 9448ccd8533685 da9c9c87759717 Author: Jakub Kicinski Date: Wed Aug 27 07:43:20 2025 -0700 Merge branch 'introduce-refcount_t-for-reference-counting-of-rose_neigh' Takamitsu Iwai says: ==================== Introduce refcount_t for reference counting of rose_neigh The current implementation of rose_neigh uses 'use' and 'count' field of type unsigned short as a reference count. This approach lacks atomicity, leading to potential race conditions. As a result, syzbot has reported slab-use-after-free errors due to unintended removals. This series introduces refcount_t for reference counting to ensure atomicity and prevent race conditions. The patches are structured as follows: 1. Refactor rose_remove_neigh() to separate removal and freeing operations 2. Convert 'use' field to refcount_t for appropriate reference counting 3. Include references from rose_node to 'use' field These changes should resolve the reported slab-use-after-free issues and improve the overall stability of the ROSE network layer. v1: https://lore.kernel.org/20250820174707.83372-1-takamitz@amazon.co.jp ==================== Link: https://patch.msgid.link/20250823085857.47674-1-takamitz@amazon.co.jp Signed-off-by: Jakub Kicinski commit da9c9c877597170b929a6121a68dcd3dd9a80f45 Author: Takamitsu Iwai Date: Sat Aug 23 17:58:57 2025 +0900 net: rose: include node references in rose_neigh refcount Current implementation maintains two separate reference counting mechanisms: the 'count' field in struct rose_neigh tracks references from rose_node structures, while the 'use' field (now refcount_t) tracks references from rose_sock. This patch merges these two reference counting systems using 'use' field for proper reference management. Specifically, this patch adds incrementing and decrementing of rose_neigh->use when rose_neigh->count is incremented or decremented. This patch also modifies rose_rt_free(), rose_rt_device_down() and rose_clear_route() to properly release references to rose_neigh objects before freeing a rose_node through rose_remove_node(). These changes ensure rose_neigh structures are properly freed only when all references, including those from rose_node structures, are released. As a result, this resolves a slab-use-after-free issue reported by Syzbot. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+942297eecf7d2d61d1f1@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=942297eecf7d2d61d1f1 Signed-off-by: Takamitsu Iwai Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250823085857.47674-4-takamitz@amazon.co.jp Signed-off-by: Jakub Kicinski commit d860d1faa6b2ce3becfdb8b0c2b048ad31800061 Author: Takamitsu Iwai Date: Sat Aug 23 17:58:56 2025 +0900 net: rose: convert 'use' field to refcount_t The 'use' field in struct rose_neigh is used as a reference counter but lacks atomicity. This can lead to race conditions where a rose_neigh structure is freed while still being referenced by other code paths. For example, when rose_neigh->use becomes zero during an ioctl operation via rose_rt_ioctl(), the structure may be removed while its timer is still active, potentially causing use-after-free issues. This patch changes the type of 'use' from unsigned short to refcount_t and updates all code paths to use rose_neigh_hold() and rose_neigh_put() which operate reference counts atomically. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Takamitsu Iwai Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250823085857.47674-3-takamitz@amazon.co.jp Signed-off-by: Jakub Kicinski commit dcb34659028f856c423a29ef9b4e2571d203444d Author: Takamitsu Iwai Date: Sat Aug 23 17:58:55 2025 +0900 net: rose: split remove and free operations in rose_remove_neigh() The current rose_remove_neigh() performs two distinct operations: 1. Removes rose_neigh from rose_neigh_list 2. Frees the rose_neigh structure Split these operations into separate functions to improve maintainability and prepare for upcoming refcount_t conversion. The timer cleanup remains in rose_remove_neigh() because free operations can be called from timer itself. This patch introduce rose_neigh_put() to handle the freeing of rose_neigh structures and modify rose_remove_neigh() to handle removal only. Signed-off-by: Takamitsu Iwai Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250823085857.47674-2-takamitz@amazon.co.jp Signed-off-by: Jakub Kicinski commit 9a52827a9bbbabb461e87bb41174a96a82c0e8ae Author: Johan Hovold Date: Tue Jul 8 10:56:13 2025 +0200 reset: eyeq: fix OF node leak Make sure to drop the OF node reference taken when probing the auxiliary device when the device is later unbound. Fixes: 487b1b32e317 ("reset: eyeq: add platform driver") Cc: Théo Lebrun Signed-off-by: Johan Hovold Reviewed-by: Philipp Zabel Link: https://lore.kernel.org/r/20250708085613.15823-1-johan@kernel.org Signed-off-by: Philipp Zabel commit c64eff368ac676e8540344d27a3de47e0ad90d21 Author: Qingyue Zhang Date: Wed Aug 27 19:43:39 2025 +0800 io_uring/kbuf: fix signedness in this_len calculation When importing and using buffers, buf->len is considered unsigned. However, buf->len is converted to signed int when committing. This can lead to unexpected behavior if the buffer is large enough to be interpreted as a negative value. Make min_t calculation unsigned. Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption") Co-developed-by: Suoxing Zhang Signed-off-by: Suoxing Zhang Signed-off-by: Qingyue Zhang Link: https://lore.kernel.org/r/tencent_4DBB3674C0419BEC2C0C525949DA410CA307@qq.com Signed-off-by: Jens Axboe commit f600bddbcf79acd13d4a0d93aed4ee2fe29f927d Author: Shenghao Ding Date: Wed Aug 27 12:34:03 2025 +0800 ALSA: hda/tas2781: Fix EFI name for calibration beginning with 1 instead of 0 A bug reported by one of my customers that EFI name beginning with 0 instead of 1. Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib") Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20250827043404.644-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai commit 9d81ba6d49a7457784f0b6a71046818b86ec7e44 Author: Edward Adam Davis Date: Wed Aug 27 09:45:55 2025 +0800 fuse: Block access to folio overlimit syz reported a slab-out-of-bounds Write in fuse_dev_do_write. When the number of bytes to be retrieved is truncated to the upper limit by fc->max_pages and there is an offset, the oob is triggered. Add a loop termination condition to prevent overruns. Fixes: 3568a9569326 ("fuse: support large folios for retrieves") Reported-by: syzbot+2d215d165f9354b9c4ea@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=2d215d165f9354b9c4ea Tested-by: syzbot+2d215d165f9354b9c4ea@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Reviewed-by: Joanne Koong Signed-off-by: Miklos Szeredi commit 54416fd76770bd04fc3c501810e8d673550bab26 Author: Phil Sutter Date: Mon Aug 18 13:22:20 2025 +0200 netfilter: conntrack: helper: Replace -EEXIST by -EBUSY The helper registration return value is passed-through by module_init callbacks which modprobe confuses with the harmless -EEXIST returned when trying to load an already loaded module. Make sure modprobe fails so users notice their helper has not been registered and won't work. Suggested-by: Christophe Leroy Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Phil Sutter Signed-off-by: Florian Westphal commit 479a54ab92087318514c82428a87af2d7af1a576 Author: Wang Liang Date: Fri Aug 22 11:52:19 2025 +0800 netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm When send a broadcast packet to a tap device, which was added to a bridge, br_nf_local_in() is called to confirm the conntrack. If another conntrack with the same hash value is added to the hash table, which can be triggered by a normal packet to a non-bridge device, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200 CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary) RIP: 0010:br_nf_local_in+0x168/0x200 Call Trace: nf_hook_slow+0x3e/0xf0 br_pass_frame_up+0x103/0x180 br_handle_frame_finish+0x2de/0x5b0 br_nf_hook_thresh+0xc0/0x120 br_nf_pre_routing_finish+0x168/0x3a0 br_nf_pre_routing+0x237/0x5e0 br_handle_frame+0x1ec/0x3c0 __netif_receive_skb_core+0x225/0x1210 __netif_receive_skb_one_core+0x37/0xa0 netif_receive_skb+0x36/0x160 tun_get_user+0xa54/0x10c0 tun_chr_write_iter+0x65/0xb0 vfs_write+0x305/0x410 ksys_write+0x60/0xd0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f ---[ end trace 0000000000000000 ]--- To solve the hash conflict, nf_ct_resolve_clash() try to merge the conntracks, and update skb->_nfct. However, br_nf_local_in() still use the old ct from local variable 'nfct' after confirm(), which leads to this warning. If confirm() does not insert the conntrack entry and return NF_DROP, the warning may also occur. There is no need to reserve the WARN_ON_ONCE, just remove it. Link: https://lore.kernel.org/netdev/20250820043329.2902014-1-wangliang74@huawei.com/ Fixes: 62e7151ae3eb ("netfilter: bridge: confirm multicast packets before passing them up the stack") Suggested-by: Florian Westphal Signed-off-by: Wang Liang Signed-off-by: Florian Westphal commit c2415c407a2cde01290d52ce2a1f81b0616379a3 Author: K Prateek Nayak Date: Mon Aug 25 07:57:29 2025 +0000 x86/cpu/topology: Use initial APIC ID from XTOPOLOGY leaf on AMD/HYGON Prior to the topology parsing rewrite and the switchover to the new parsing logic for AMD processors in c749ce393b8f ("x86/cpu: Use common topology code for AMD"), the initial_apicid on these platforms was: - First initialized to the LocalApicId from CPUID leaf 0x1 EBX[31:24]. - Then overwritten by the ExtendedLocalApicId in CPUID leaf 0xb EDX[31:0] on processors that supported topoext. With the new parsing flow introduced in f7fb3b2dd92c ("x86/cpu: Provide an AMD/HYGON specific topology parser"), parse_8000_001e() now unconditionally overwrites the initial_apicid already parsed during cpu_parse_topology_ext(). Although this has not been a problem on baremetal platforms, on virtualized AMD guests that feature more than 255 cores, QEMU zeros out the CPUID leaf 0x8000001e on CPUs with CoreID > 255 to prevent collision of these IDs in EBX[7:0] which can only represent a maximum of 255 cores [1]. This results in the following FW_BUG being logged when booting a guest with more than 255 cores: [Firmware Bug]: CPU 512: APIC ID mismatch. CPUID: 0x0000 APIC: 0x0200 AMD64 Architecture Programmer's Manual Volume 2: System Programming Pub. 24593 Rev. 3.42 [2] Section 16.12 "x2APIC_ID" mentions the Extended Enumeration leaf 0xb (Fn0000_000B_EDX[31:0])(which was later superseded by the extended leaf 0x80000026) provides the full x2APIC ID under all circumstances unlike the one reported by CPUID leaf 0x8000001e EAX which depends on the mode in which APIC is configured. Rely on the APIC ID parsed during cpu_parse_topology_ext() from CPUID leaf 0x80000026 or 0xb and only use the APIC ID from leaf 0x8000001e if cpu_parse_topology_ext() failed (has_topoext is false). On platforms that support the 0xb leaf (Zen2 or later, AMD guests on QEMU) or the extended leaf 0x80000026 (Zen4 or later), the initial_apicid is now set to the value parsed from EDX[31:0]. On older AMD/Hygon platforms that do not support the 0xb leaf but support the TOPOEXT extension (families 0x15, 0x16, 0x17[Zen1], and Hygon), retain current behavior where the initial_apicid is set using the 0x8000001e leaf. Issue debugged by Naveen N Rao (AMD) and Sairaj Kodilkar . [ bp: Massage commit message. ] Fixes: c749ce393b8f ("x86/cpu: Use common topology code for AMD") Suggested-by: Thomas Gleixner Signed-off-by: K Prateek Nayak Signed-off-by: Borislav Petkov (AMD) Tested-by: Naveen N Rao (AMD) Cc: stable@vger.kernel.org Link: https://github.com/qemu/qemu/commit/35ac5dfbcaa4b [1] Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 [2] Link: https://lore.kernel.org/20250825075732.10694-2-kprateek.nayak@amd.com commit 49fba87205bec14a0f6bd997635bf3968408161e Author: Felix Fietkau Date: Wed Aug 27 10:53:52 2025 +0200 wifi: mt76: fix linked list corruption Never leave scheduled wcid entries on the temporary on-stack list Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx") Link: https://patch.msgid.link/20250827085352.51636-6-nbd@nbd.name Signed-off-by: Felix Fietkau commit bdeac7815629c1a32b8784922368742e183747ea Author: Felix Fietkau Date: Wed Aug 27 10:53:51 2025 +0200 wifi: mt76: free pending offchannel tx frames on wcid cleanup Avoid leaking them or keeping the wcid on the tx list Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx") Link: https://patch.msgid.link/20250827085352.51636-5-nbd@nbd.name Signed-off-by: Felix Fietkau commit 065c79df595af21d6d1b27d642860faa1d938774 Author: Felix Fietkau Date: Wed Aug 27 10:53:50 2025 +0200 wifi: mt76: mt7915: fix list corruption after hardware restart Since stations are recreated from scratch, all lists that wcids are added to must be cleared before calling ieee80211_restart_hw. Set wcid->sta = 0 for each wcid entry in order to ensure that they are not added again before they are ready. Fixes: 8a55712d124f ("wifi: mt76: mt7915: enable full system reset support") Link: https://patch.msgid.link/20250827085352.51636-4-nbd@nbd.name Signed-off-by: Felix Fietkau commit 4a522b01e368eec58d182ecc47d24f49a39e440d Author: Felix Fietkau Date: Wed Aug 27 10:53:49 2025 +0200 wifi: mt76: mt7996: add missing check for rx wcid entries Non-station wcid entries must not be passed to the rx functions. In case of the global wcid entry, it could even lead to corruption in the wcid array due to pointer being casted to struct mt7996_sta_link using container_of. Fixes: 7464b12b7d92 ("wifi: mt76: mt7996: rework mt7996_rx_get_wcid to support MLO") Link: https://patch.msgid.link/20250827085352.51636-3-nbd@nbd.name Signed-off-by: Felix Fietkau commit a3c99ef88a084e1c2b99dd56bbfa7f89c9be3e92 Author: Felix Fietkau Date: Wed Aug 27 10:53:48 2025 +0200 wifi: mt76: do not add non-sta wcid entries to the poll list Polling and airtime reporting is valid for station entries only Link: https://patch.msgid.link/20250827085352.51636-2-nbd@nbd.name Signed-off-by: Felix Fietkau commit 0300545b8a113e96ee260a7c142be846d391a620 Author: Felix Fietkau Date: Wed Aug 27 10:53:47 2025 +0200 wifi: mt76: mt7996: fix crash on some tx status reports When a wcid can't be found, link_sta can be stale from a previous batch. The code currently assumes that if link_sta is set, wcid is also non-zero. Fix wcid NULL pointer dereference by resetting link_sta when a wcid entry can't be found. Fixes: 62da647a2b20 ("wifi: mt76: mt7996: Add MLO support to mt7996_tx_check_aggr()") Link: https://patch.msgid.link/20250827085352.51636-1-nbd@nbd.name Signed-off-by: Felix Fietkau commit 4be3b46ec5190dc79cd38e3750480b2c66a791ad Author: Chad Monroe Date: Fri Aug 8 13:29:48 2025 +0000 wifi: mt76: mt7996: use the correct vif link for scanning/roc restore fix which was dropped during MLO rework Fixes: f0b0b239b8f3 ("wifi: mt76: mt7996: rework mt7996_mac_write_txwi() for MLO support") Signed-off-by: Chad Monroe Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/180fffd409aa57f535a3d2c1951e41ae398ce09e.1754659732.git.chad@monroe.io Signed-off-by: Felix Fietkau commit f30906c55a400a9b7fc677e3f4c614b9069bd4a8 Author: Felix Fietkau Date: Wed Aug 13 14:11:05 2025 +0200 wifi: mt76: mt7996: disable beacons when going offchannel Avoid leaking beacons on unrelated channels during scanning/roc Fixes: c56d6edebc1f ("wifi: mt76: mt7996: use emulated hardware scan support") Reported-by: Chad Monroe Link: https://patch.msgid.link/20250813121106.81559-1-nbd@nbd.name Signed-off-by: Felix Fietkau commit 4c2334587b0a13b8f4eda1336ae657297fcd743b Author: Felix Fietkau Date: Wed Aug 13 14:11:06 2025 +0200 wifi: mt76: prevent non-offchannel mgmt tx during scan/roc Only put probe request packets in the offchannel queue if IEEE80211_TX_CTRL_DONT_USE_RATE_MASK is set and IEEE80211_TX_CTL_TX_OFFCHAN is unset. Fixes: 0b3be9d1d34e ("wifi: mt76: add separate tx scheduling queue for off-channel tx") Reported-by: Chad Monroe Link: https://patch.msgid.link/20250813121106.81559-2-nbd@nbd.name Signed-off-by: Felix Fietkau commit dd6e89cad9951acef3723f3f21b2e892a23b371b Author: Ming Yen Hsieh Date: Mon Aug 18 11:02:01 2025 +0800 wifi: mt76: mt7925: skip EHT MLD TLV on non-MLD and pass conn_state for sta_cmd Return early in mt7925_mcu_sta_eht_mld_tlv() for non-MLD vifs to avoid bogus MLD TLVs, and pass the proper connection state to sta_basic TLV. Cc: stable@vger.kernel.org Fixes: cb1353ef3473 ("wifi: mt76: mt7925: integrate *mlo_sta_cmd and *sta_cmd") Reported-by: Tal Inbar Tested-by: Tal Inbar Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250818030201.997940-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit c22769de25095c6777e8acb68a1349a3257fc955 Author: Ming Yen Hsieh Date: Mon Aug 18 10:02:03 2025 +0800 wifi: mt76: mt7925u: use connac3 tx aggr check in tx complete MT7925 is a connac3 device; using the connac2 helper mis-parses TXWI and breaks AMPDU/BA accounting. Use the connac3-specific helper mt7925_tx_check_aggr() instead, Cc: stable@vger.kernel.org Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips") Reported-by: Nick Morrow Tested-by: Nick Morrow Tested-on: Netgear A9000 USB WiFi adapter Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250818020203.992338-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 55424e7b9eeb141d9c8d8a8740ee131c28490425 Author: Ming Yen Hsieh Date: Mon Jul 28 13:26:12 2025 +0800 wifi: mt76: mt7925: fix the wrong bss cleanup for SAP When in SAP mode, if a STA disconnect, the SAP's BSS should not be cleared. Fixes: 0ebb60da8416 ("wifi: mt76: mt7925: adjust rm BSS flow to prevent next connection failure") Cc: stable@vger.kernel.org Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250728052612.39751-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 9f15701370ec15fbf1f6a1cbbf584b0018d036b5 Author: Harshit Mogalapalli Date: Sun Jul 27 07:04:13 2025 -0700 wifi: mt76: mt7925: fix locking in mt7925_change_vif_links() &dev->mt76.mutex lock is taken using mt792x_mutex_acquire(dev) but not released in one of the error paths, add the unlock to fix it. Fixes: 5cd0bd815c8a ("wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202503031055.3ZRqxhAl-lkp@intel.com/ Signed-off-by: Harshit Mogalapalli Link: https://patch.msgid.link/20250727140416.1153406-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Felix Fietkau commit 87f38519d27a514c9909f84b8f1334125df9778e Author: Janusz Dziedzic Date: Wed Jul 16 18:54:01 2025 +0200 wifi: mt76: mt7921: don't disconnect when CSA to DFS chan When station mode, don't disconnect when we get channel switch from AP to DFS channel. Most APs send CSA request after pass background CAC. In other case we should disconnect after detect beacon miss. Without patch when we get CSA to DFS channel get: "kernel: wlo1: preparing for channel switch failed, disconnecting" Fixes: 8aa2f59260eb ("wifi: mt76: mt7921: introduce CSA support") Signed-off-by: Janusz Dziedzic Link: https://patch.msgid.link/20250716165443.28354-1-janusz.dziedzic@gmail.com Signed-off-by: Felix Fietkau commit 87b07a1fbc6b5c23d3b3584ab4288bc9106d3274 Author: Nathan Chancellor Date: Tue Jul 15 15:33:25 2025 -0700 wifi: mt76: mt7996: Initialize hdr before passing to skb_put_data() A new warning in clang [1] points out a couple of places where a hdr variable is not initialized then passed along to skb_put_data(). drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:1894:21: warning: variable 'hdr' is uninitialized when passed as a const pointer argument here [-Wuninitialized-const-pointer] 1894 | skb_put_data(skb, &hdr, sizeof(hdr)); | ^~~ drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:3386:21: warning: variable 'hdr' is uninitialized when passed as a const pointer argument here [-Wuninitialized-const-pointer] 3386 | skb_put_data(skb, &hdr, sizeof(hdr)); | ^~~ Zero initialize these headers as done in other places in the driver when there is nothing stored in the header. Cc: stable@vger.kernel.org Fixes: 98686cd21624 ("wifi: mt76: mt7996: add driver for MediaTek Wi-Fi 7 (802.11be) devices") Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] Closes: https://github.com/ClangBuiltLinux/linux/issues/2104 Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20250715-mt7996-fix-uninit-const-pointer-v1-1-b5d8d11d7b78@kernel.org Signed-off-by: Felix Fietkau commit fcf8239ad6a5de54fa7ce18e464c6b5951b982cb Author: Borislav Petkov (AMD) Date: Wed Aug 20 11:58:57 2025 +0200 x86/microcode/AMD: Handle the case of no BIOS microcode Machines can be shipped without any microcode in the BIOS. Which means, the microcode patch revision is 0. Handle that gracefully. Fixes: 94838d230a6c ("x86/microcode/AMD: Use the family,model,stepping encoded in the patch ID") Reported-by: Vítek Vávra Signed-off-by: Borislav Petkov (AMD) Cc: commit 22b2ca023fc41e95afb3c58c16c2418b1ca85d75 Merge: 1b237f190eb3d3 dce1b33ed7430c Author: Paolo Bonzini Date: Wed Aug 27 04:18:01 2025 -0400 Merge tag 'kvm-x86-fixes-6.17-rc7' of https://github.com/kvm-x86/linux into HEAD KVM x86 fixes and a selftest fix for 6.17-rcN - Use array_index_nospec() to sanitize the target vCPU ID when handling PV IPIs and yields as the ID is guest-controlled. - Drop a superfluous cpumask_empty() check when reclaiming SEV memory, as the common case, by far, is that at least one CPU will have entered the VM, and wbnoinvd_on_cpus_mask() will naturally handle the rare case where the set of have_run_cpus is empty. - Rename the is_signed_type() macro in kselftest_harness.h to is_signed_var() to fix a collision with linux/overflow.h. The collision generates compiler warnings due to the two macros having different implementations. commit 2c3ca8cc55a3afc7a4fa99ed8f5f5d05dd2e65b3 Author: Cryolitia PukNgae Date: Wed Aug 27 11:29:02 2025 +0800 ALSA: usb-audio: move mixer_quirks' min_mute into common quirk We have found more and more devices that have the same problem, that the mixer's minimum value is muted. Accroding to pipewire's MR[1] and Arch Linux wiki[2], this should be a very common problem in USB audio devices. Move the quirk into common quirk,as a preparation of more devices' quirk's patch coming on the road[3]. 1. https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2514 2. https://wiki.archlinux.org/index.php?title=PipeWire&oldid=804138#No_sound_from_USB_DAC_until_30%_volume 3. On the road, in the physical sense. We have been buying ton of these devices for testing the problem. Tested-by: Guoli An Signed-off-by: Cryolitia PukNgae Link: https://patch.msgid.link/20250827-sound-quirk-min-mute-v1-1-4717aa8a4f6a@uniontech.com Signed-off-by: Takashi Iwai commit 9448ccd853368582efa9db05db344f8bb9dffe0f Author: Dipayaan Roy Date: Mon Aug 25 04:56:27 2025 -0700 net: hv_netvsc: fix loss of early receive events from host during channel open. The hv_netvsc driver currently enables NAPI after opening the primary and subchannels. This ordering creates a race: if the Hyper-V host places data in the host -> guest ring buffer and signals the channel before napi_enable() has been called, the channel callback will run but napi_schedule_prep() will return false. As a result, the NAPI poller never gets scheduled, the data in the ring buffer is not consumed, and the receive queue may remain permanently stuck until another interrupt happens to arrive. Fix this by enabling NAPI and registering it with the RX/TX queues before vmbus channel is opened. This guarantees that any early host signal after open will correctly trigger NAPI scheduling and the ring buffer will be drained. Fixes: 76bb5db5c749d ("netvsc: fix use after free on module removal") Signed-off-by: Dipayaan Roy Link: https://patch.msgid.link/20250825115627.GA32189@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Jakub Kicinski commit 4b4a8ec21ab8581f57d747b8e7eac65d3c295cd4 Merge: 24be0900478dd8 b1eded580ab281 Author: Jakub Kicinski Date: Tue Aug 26 18:12:45 2025 -0700 Merge branch 'net-stmmac-xgmac-minor-fixes' Rohan G Thomas says: ==================== net: stmmac: xgmac: Minor fixes This patch series includes following minor fixes for stmmac dwxgmac driver: 1. Disable Rx FIFO overflow interrupt for dwxgmac 2. Correct supported speed modes for dwxgmac 3. Check for coe-unsupported flag before setting CIC bit of Tx Desc3 in the AF_XDP flow v2: https://lore.kernel.org/20250816-xgmac-minor-fixes-v2-0-699552cf8a7f@altera.com v1: https://lore.kernel.org/20250714-xgmac-minor-fixes-v1-0-c34092a88a72@altera.com ==================== Link: https://patch.msgid.link/20250825-xgmac-minor-fixes-v3-0-c225fe4444c0@altera.com Signed-off-by: Jakub Kicinski commit b1eded580ab28119de0b0f21efe37ee2b4419144 Author: Rohan G Thomas Date: Mon Aug 25 12:36:54 2025 +0800 net: stmmac: Set CIC bit only for TX queues with COE Currently, in the AF_XDP transmit paths, the CIC bit of TX Desc3 is set for all packets. Setting this bit for packets transmitting through queues that don't support checksum offloading causes the TX DMA to get stuck after transmitting some packets. This patch ensures the CIC bit of TX Desc3 is set only if the TX queue supports checksum offloading. Fixes: 132c32ee5bc0 ("net: stmmac: Add TX via XDP zero-copy socket") Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Link: https://patch.msgid.link/20250825-xgmac-minor-fixes-v3-3-c225fe4444c0@altera.com Signed-off-by: Jakub Kicinski commit 42ef11b2bff5b6a2910c28d2ea47cc00e0fbcaec Author: Rohan G Thomas Date: Mon Aug 25 12:36:53 2025 +0800 net: stmmac: xgmac: Correct supported speed modes Correct supported speed modes as per the XGMAC databook. Commit 9cb54af214a7 ("net: stmmac: Fix IP-cores specific MAC capabilities") removes support for 10M, 100M and 1000HD. 1000HD is not supported by XGMAC IP, but it does support 10M and 100M FD mode for XGMAC version >= 2_20, and it also supports 10M and 100M HD mode if the HDSEL bit is set in the MAC_HW_FEATURE0 reg. This commit enables support for 10M and 100M speed modes for XGMAC IP based on XGMAC version and MAC capabilities. Fixes: 9cb54af214a7 ("net: stmmac: Fix IP-cores specific MAC capabilities") Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Link: https://patch.msgid.link/20250825-xgmac-minor-fixes-v3-2-c225fe4444c0@altera.com Signed-off-by: Jakub Kicinski commit 4f23382841e67174211271a454811dd17c0ef3c5 Author: Rohan G Thomas Date: Mon Aug 25 12:36:52 2025 +0800 net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts Enabling RX FIFO Overflow interrupts is counterproductive and causes an interrupt storm when RX FIFO overflows. Disabling this interrupt has no side effect and eliminates interrupt storms when the RX FIFO overflows. Commit 8a7cb245cf28 ("net: stmmac: Do not enable RX FIFO overflow interrupts") disables RX FIFO overflow interrupts for DWMAC4 IP and removes the corresponding handling of this interrupt. This patch is doing the same thing for XGMAC IP. Fixes: 2142754f8b9c ("net: stmmac: Add MAC related callbacks for XGMAC2") Signed-off-by: Rohan G Thomas Reviewed-by: Matthew Gerlach Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250825-xgmac-minor-fixes-v3-1-c225fe4444c0@altera.com Signed-off-by: Jakub Kicinski commit 24be0900478dd87b945c7809e343fa07888a24b4 Merge: aa125f08cb8e9b aca0c31af61e0d Author: Jakub Kicinski Date: Tue Aug 26 18:00:29 2025 -0700 Merge branch 'mlx5-misc-fixes-2025-08-25' Mark Bloch says: ==================== mlx5 misc fixes 2025-08-25 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. v1: https://lore.kernel.org/20250824083944.523858-1-mbloch@nvidia.com ==================== Link: https://patch.msgid.link/20250825143435.598584-1-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit aca0c31af61e0d5cf1675a0cbd29460b95ae693c Author: Alexei Lazar Date: Mon Aug 25 17:34:34 2025 +0300 net/mlx5e: Set local Xoff after FW update The local Xoff value is being set before the firmware (FW) update. In case of a failure where the FW is not updated with the new value, there is no fallback to the previous value. Update the local Xoff value after the FW has been successfully set. Fixes: 0696d60853d5 ("net/mlx5e: Receive buffer configuration") Signed-off-by: Alexei Lazar Reviewed-by: Tariq Toukan Reviewed-by: Dragos Tatulea Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-12-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit d24341740fe48add8a227a753e68b6eedf4b385a Author: Alexei Lazar Date: Mon Aug 25 17:34:33 2025 +0300 net/mlx5e: Update and set Xon/Xoff upon port speed set Xon/Xoff sizes are derived from calculations that include the port speed. These settings need to be updated and applied whenever the port speed is changed. The port speed is typically set after the physical link goes down and is negotiated as part of the link-up process between the two connected interfaces. Xon/Xoff parameters being updated at the point where the new negotiated speed is established. Fixes: 0696d60853d5 ("net/mlx5e: Receive buffer configuration") Signed-off-by: Alexei Lazar Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-11-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit ceddedc969f0532b7c62ca971ee50d519d2bc0cb Author: Alexei Lazar Date: Mon Aug 25 17:34:32 2025 +0300 net/mlx5e: Update and set Xon/Xoff upon MTU set Xon/Xoff sizes are derived from calculation that include the MTU size. Set Xon/Xoff when MTU is set. If Xon/Xoff fails, set the previous MTU. Fixes: 0696d60853d5 ("net/mlx5e: Receive buffer configuration") Signed-off-by: Alexei Lazar Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-10-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit cf9a8627b9a369ba01d37be6f71b297beb688faa Author: Moshe Shemesh Date: Mon Aug 25 17:34:31 2025 +0300 net/mlx5: Prevent flow steering mode changes in switchdev mode Changing flow steering modes is not allowed when eswitch is in switchdev mode. This fix ensures that any steering mode change, including to firmware steering, is correctly blocked while eswitch mode is switchdev. Fixes: e890acd5ff18 ("net/mlx5: Add devlink flow_steering_mode parameter") Signed-off-by: Moshe Shemesh Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-9-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 26e42ec7712d392d561964514b1f253b1a96f42d Author: Moshe Shemesh Date: Mon Aug 25 17:34:30 2025 +0300 net/mlx5: Nack sync reset when SFs are present If PF (Physical Function) has SFs (Sub-Functions), since the SFs are not taking part in the synchronization flow, sync reset can lead to fatal error on the SFs, as the function will be closed unexpectedly from the SF point of view. Add a check to prevent sync reset when there are SFs on a PF device which is not ECPF, as ECPF is teardowned gracefully before reset. Fixes: 92501fa6e421 ("net/mlx5: Ack on sync_reset_request only if PF can do reset_now") Signed-off-by: Moshe Shemesh Reviewed-by: Parav Pandit Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-8-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 902a8bc23a24882200f57cadc270e15a2cfaf2bb Author: Moshe Shemesh Date: Mon Aug 25 17:34:29 2025 +0300 net/mlx5: Fix lockdep assertion on sync reset unload event Fix lockdep assertion triggered during sync reset unload event. When the sync reset flow is initiated using the devlink reload fw_activate option, the PF already holds the devlink lock while handling unload event. In this case, delegate sync reset unload event handling back to the devlink callback process to avoid double-locking and resolve the lockdep warning. Kernel log: WARNING: CPU: 9 PID: 1578 at devl_assert_locked+0x31/0x40 [...] Call Trace: mlx5_unload_one_devl_locked+0x2c/0xc0 [mlx5_core] mlx5_sync_reset_unload_event+0xaf/0x2f0 [mlx5_core] process_one_work+0x222/0x640 worker_thread+0x199/0x350 kthread+0x10b/0x230 ? __pfx_worker_thread+0x10/0x10 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x8e/0x100 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Fixes: 7a9770f1bfea ("net/mlx5: Handle sync reset unload event") Signed-off-by: Moshe Shemesh Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-7-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 34cc6a54914f478c93e176450fae6313404f9f74 Author: Moshe Shemesh Date: Mon Aug 25 17:34:28 2025 +0300 net/mlx5: Reload auxiliary drivers on fw_activate The devlink reload fw_activate command performs firmware activation followed by driver reload, while devlink reload driver_reinit triggers only driver reload. However, the driver reload logic differs between the two modes, as on driver_reinit mode mlx5 also reloads auxiliary drivers, while in fw_activate mode the auxiliary drivers are suspended where applicable. Additionally, following the cited commit, if the device has multiple PFs, the behavior during fw_activate may vary between PFs: one PF may suspend auxiliary drivers, while another reloads them. Align devlink dev reload fw_activate behavior with devlink dev reload driver_reinit, to reload all auxiliary drivers. Fixes: 72ed5d5624af ("net/mlx5: Suspend auxiliary devices only in case of PCI device suspend") Signed-off-by: Moshe Shemesh Reviewed-by: Tariq Toukan Reviewed-by: Akiva Goldberger Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-6-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 00a50e4e8974cbf5d6a1dc91cfa5cce4aa7af05a Author: Lama Kayal Date: Mon Aug 25 17:34:27 2025 +0300 net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path In mlx5hws_pat_get_pattern(), when mlx5hws_pat_add_pattern_to_cache() fails, the function attempts to clean up the pattern created by mlx5hws_cmd_header_modify_pattern_create(). However, it incorrectly uses *pattern_id which hasn't been set yet, instead of the local ptrn_id variable that contains the actual pattern ID. This results in attempting to destroy a pattern using uninitialized data from the output parameter, rather than the valid pattern ID returned by the firmware. Use ptrn_id instead of *pattern_id in the cleanup path to properly destroy the created pattern. Fixes: aefc15a0fa1c ("net/mlx5: HWS, added modify header pattern and args handling") Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-5-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 24b6e53140475b56cadcccd4e82a93aa5bacf1eb Author: Lama Kayal Date: Mon Aug 25 17:34:26 2025 +0300 net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow In mlx5hws_pat_calc_nop(), src_field and dst_field are passed to hws_action_modify_get_target_fields() which should set their values. However, if an invalid action type is encountered, these variables remain uninitialized and are later used to update prev_src_field and prev_dst_field. Initialize both variables to INVALID_FIELD to ensure they have defined values in all code paths. Fixes: 01e035fd0380 ("net/mlx5: HWS, handle modify header actions dependency") Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-4-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit a630f83592cdad1253523a1b760cfe78fef6cd9c Author: Lama Kayal Date: Mon Aug 25 17:34:25 2025 +0300 net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow When an invalid stc_type is provided, the function allocates memory for shared_stc but jumps to unlock_and_out without freeing it, causing a memory leak. Fix by jumping to free_shared_stc label instead to ensure proper cleanup. Fixes: 504e536d9010 ("net/mlx5: HWS, added actions handling") Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 2c0a959bebdc1ada13cf9a8242f177c5400299e6 Author: Lama Kayal Date: Mon Aug 25 17:34:24 2025 +0300 net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path In the error path of hws_pool_buddy_init(), the buddy allocator cleanup doesn't free the allocator structure itself, causing a memory leak. Add the missing kfree() to properly release all allocated memory. Fixes: c61afff94373 ("net/mlx5: HWS, added memory management handling") Signed-off-by: Lama Kayal Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250825143435.598584-2-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit aa125f08cb8e9bc7f08aa7094b78beaeab9bea71 Merge: e69880cbf623dc ed913b343dcf9f Author: Jakub Kicinski Date: Tue Aug 26 17:50:33 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-08-25 (ice, ixgbe) For ice: Emil adds a check to ensure auxiliary device was created before tear down to prevent NULL a pointer dereference. Jake reworks flow for failed Tx scheduler configuration to allow for proper recovery and operation. He also adjusts ice_adapter index for E825C devices as use of DSN is incompatible with this device. Michal corrects tracking of buffer allocation failure in ice_clean_rx_irq(). For ixgbe: Jedrzej adds __packed attribute to ixgbe_orom_civd_info to compatibility with device OROM data. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ixgbe: fix ixgbe_orom_civd_info struct layout ice: fix incorrect counter for buffer allocation failures ice: use fixed adapter index for E825C embedded devices ice: don't leave device non-functional if Tx scheduler config fails ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset ==================== Link: https://patch.msgid.link/20250825215019.3442873-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit e69880cbf623dc6283ae798aa5b8fb930063591c Merge: d9b0ca1334d8a9 b4fc8faacfea25 Author: Jakub Kicinski Date: Tue Aug 26 17:48:37 2025 -0700 Merge branch 'bnxt_en-3-bug-fixes' Michael Chan says: ==================== bnxt_en: 3 bug fixes The first one fixes a memory corruption issue that can happen when FW resources change during ifdown with TCs created. The next two fix FW resource reservation logic for TX rings and stats context. ==================== Link: https://patch.msgid.link/20250825175927.459987-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit b4fc8faacfea2538184a1dbd616ae9447a361f3d Author: Michael Chan Date: Mon Aug 25 10:59:27 2025 -0700 bnxt_en: Fix stats context reservation logic The HW resource reservation logic allows the L2 driver to use the RoCE resources if the RoCE driver is not registered. When calculating the stats contexts available for L2, we should not blindly subtract the stats contexts reserved for RoCE unless the RoCE driver is registered. This bug may cause the L2 rings to be less than the number requested when we are close to running out of stats contexts. Fixes: 2e4592dc9bee ("bnxt_en: Change MSIX/NQs allocation policy") Reviewed-by: Kalesh AP Reviewed-by: Somnath Kotur Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250825175927.459987-4-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 1ee581c24dfdcbc6de25aac95a48c1f08e9a542c Author: Michael Chan Date: Mon Aug 25 10:59:26 2025 -0700 bnxt_en: Adjust TX rings if reservation is less than requested Before we accept an ethtool request to increase a resource (such as rings), we call the FW to check that the requested resource is likely available first before we commit. But it is still possible that the actual reservation or allocation can fail. The existing code is missing the logic to adjust the TX rings in case the reserved TX rings are less than requested. Add a warning message (a similar message for RX rings already exists) and add the logic to adjust the TX rings. Without this fix, the number of TX rings reported to the stack can exceed the actual TX rings and ethtool -l will report more than the actual TX rings. Fixes: 674f50a5b026 ("bnxt_en: Implement new method to reserve rings.") Reviewed-by: Kalesh AP Reviewed-by: Somnath Kotur Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250825175927.459987-3-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 2747328ba2714f1a7454208dbbc1dc0631990b4a Author: Sreekanth Reddy Date: Mon Aug 25 10:59:25 2025 -0700 bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings(). Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc. Fixes: ec5d31e3c15d ("bnxt_en: Handle firmware reset status during IF_UP.") Reviewed-by: Kalesh AP Reviewed-by: Andy Gospodarek Signed-off-by: Sreekanth Reddy Signed-off-by: Michael Chan Link: https://patch.msgid.link/20250825175927.459987-2-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit d9b0ca1334d8a9a03bef45e95825564c56ca3367 Author: Boon Khai Ng Date: Mon Aug 25 15:13:21 2025 +0800 MAINTAINERS: Update maintainer information for Altera Triple Speed Ethernet Driver The previous maintainer, Joyce Ooi, is no longer with the company, and her email is no longer reachable. As a result, the maintainer information for the Altera Triple Speed Ethernet Driver has been updated. Changes: - Replaced Joyce Ooi's email with Boon Khai Ng's email address. - Kept the component's status as "Maintained". Signed-off-by: Boon Khai Ng Link: https://patch.msgid.link/20250825071321.30131-1-boon.khai.ng@altera.com Signed-off-by: Jakub Kicinski commit 16c8a3a67ec799fc731919e3e51be9af6cdf541d Author: Sean Anderson Date: Mon Aug 25 13:21:34 2025 -0400 net: macb: Fix offset error in gem_update_stats hw_stats now has only one variable for tx_octets/rx_octets, so we should only increment p once, not twice. This would cause the statistics to be reported under the wrong categories in `ethtool -S --all-groups` (which uses hw_stats) but not `ethtool -S` (which uses ethtool_stats). Signed-off-by: Sean Anderson Fixes: f6af690a295a ("net: cadence: macb: Report standard stats") Link: https://patch.msgid.link/20250825172134.681861-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski commit 26c1f55f7ec8d1a4bde8c50e4ee04e3c8c6b27e8 Author: Jakub Kicinski Date: Mon Aug 25 08:57:53 2025 -0700 MAINTAINERS: retire Boris from TLS maintainers There's a steady stream of TLS changes and bugs. We need active maintainers in this area, and Boris hasn't been participating much in upstream work. Move him to CREDITS. While at it also add Dave Watson there who was the author of the initial SW implementation, AFAIU. Link: https://patch.msgid.link/20250825155753.2178045-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 882e57cbc7204662f6c5672d5b04336c1d790b03 Author: Horatiu Vultur Date: Mon Aug 25 08:55:43 2025 +0200 phy: mscc: Fix when PTP clock is register and unregister It looks like that every time when the interface was set down and up the driver was creating a new ptp clock. On top of this the function ptp_clock_unregister was never called. Therefore fix this by calling ptp_clock_register and initialize the mii_ts struct inside the probe function and call ptp_clock_unregister when driver is removed. Fixes: 7d272e63e0979d ("net: phy: mscc: timestamping and PHC support") Signed-off-by: Horatiu Vultur Reviewed-by: Vadim Fedorenko Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20250825065543.2916334-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit e81a7f65288c7e2cfb7e7890f648e099fd885ab3 Author: Fabio Porcedda Date: Fri Aug 22 11:13:24 2025 +0200 net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions Add the following Telit Cinterion LE910C4-WWX new compositions: 0x1034: tty (AT) + tty (AT) + rmnet T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1034 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x1037: tty (diag) + tty (Telit custom) + tty (AT) + tty (AT) + rmnet T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 15 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1037 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x1038: tty (Telit custom) + tty (AT) + tty (AT) + rmnet T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1038 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable@vger.kernel.org Signed-off-by: Fabio Porcedda Link: https://patch.msgid.link/20250822091324.39558-1-Fabio.Porcedda@telit.com Signed-off-by: Jakub Kicinski commit e3ef9445cd9d90e43de0bd3cd55d437773dfd139 Author: Nilay Shroff Date: Tue Aug 26 22:00:32 2025 +0530 block: validate QoS before calling __rq_qos_done_bio() If a bio has BIO_QOS_xxx set, it doesn't guarantee that q->rq_qos is also present at-least for stacked block devices. For instance, in case of NVMe when multipath is enabled, the bottom device may have QoS enabled but top device doesn't. So always validate QoS is enabled and q->rq_qos is present before calling __rq_qos_done_bio(). Fixes: 370ac285f23a ("block: avoid cpu_hotplug_lock depedency on freeze_lock") Reported-by: Venkat Rao Bagalkote Closes: https://lore.kernel.org/all/3a07b752-06a4-4eee-b302-f4669feb859d@linux.ibm.com/ Signed-off-by: Nilay Shroff Link: https://lore.kernel.org/r/20250826163128.1952394-1-nilay@linux.ibm.com Signed-off-by: Jens Axboe commit 051b02b17a8b383ee033db211f90f24b91ac7006 Author: Aaron Erhardt Date: Tue Aug 26 16:10:54 2025 +0200 ALSA: hda/realtek: Fix headset mic for TongFang X6[AF]R5xxY Add a PCI quirk to enable microphone detection on the headphone jack of TongFang X6AR5xxY and X6FR5xxY devices. Signed-off-by: Aaron Erhardt Cc: Link: https://patch.msgid.link/20250826141054.1201482-1-aer@tuxedocomputers.com Signed-off-by: Takashi Iwai commit 198f36f902ec7e99b645382505f74b87a4523ed9 Author: Bart Van Assche Date: Mon Aug 25 11:27:19 2025 -0700 blk-zoned: Fix a lockdep complaint about recursive locking If preparing a write bio fails then blk_zone_wplug_bio_work() calls bio_endio() with zwplug->lock held. If a device mapper driver is stacked on top of the zoned block device then this results in nested locking of zwplug->lock. The resulting lockdep complaint is a false positive because this is nested locking and not recursive locking. Suppress this false positive by calling blk_zone_wplug_bio_io_error() without holding zwplug->lock. This is safe because no code in blk_zone_wplug_bio_io_error() depends on zwplug->lock being held. This patch suppresses the following lockdep complaint: WARNING: possible recursive locking detected -------------------------------------------- kworker/3:0H/46 is trying to acquire lock: ffffff882968b830 (&zwplug->lock){-...}-{2:2}, at: blk_zone_write_plug_bio_endio+0x64/0x1f0 but task is already holding lock: ffffff88315bc230 (&zwplug->lock){-...}-{2:2}, at: blk_zone_wplug_bio_work+0x8c/0x48c other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&zwplug->lock); lock(&zwplug->lock); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by kworker/3:0H/46: #0: ffffff8809486758 ((wq_completion)sdd_zwplugs){+.+.}-{0:0}, at: process_one_work+0x1bc/0x65c #1: ffffffc085de3d70 ((work_completion)(&zwplug->bio_work)){+.+.}-{0:0}, at: process_one_work+0x1e4/0x65c #2: ffffff88315bc230 (&zwplug->lock){-...}-{2:2}, at: blk_zone_wplug_bio_work+0x8c/0x48c stack backtrace: CPU: 3 UID: 0 PID: 46 Comm: kworker/3:0H Tainted: G W OE 6.12.38-android16-5-maybe-dirty-4k #1 8b362b6f76e3645a58cd27d86982bce10d150025 Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Spacecraft board based on MALIBU (DT) Workqueue: sdd_zwplugs blk_zone_wplug_bio_work Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0xa0 dump_stack+0x18/0x24 print_deadlock_bug+0x38c/0x398 __lock_acquire+0x13e8/0x2e1c lock_acquire+0x134/0x2b4 _raw_spin_lock_irqsave+0x5c/0x80 blk_zone_write_plug_bio_endio+0x64/0x1f0 bio_endio+0x9c/0x240 __dm_io_complete+0x214/0x260 clone_endio+0xe8/0x214 bio_endio+0x218/0x240 blk_zone_wplug_bio_work+0x204/0x48c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20 Cc: stable@vger.kernel.org Cc: Damien Le Moal Cc: Christoph Hellwig Fixes: dd291d77cc90 ("block: Introduce zone write plugging") Signed-off-by: Bart Van Assche Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20250825182720.1697203-1-bvanassche@acm.org Signed-off-by: Jens Axboe commit 75671d90fde8c78e940e15a1366a50ece56c6b69 Author: Carlos Llamas Date: Mon Aug 25 15:57:42 2025 +0000 drm/xe: switch to local xbasename() helper Commit b0a2ee5567ab ("drm/xe: prepare xe_gen_wa_oob to be multi-use") introduced a call to basename(). The GNU version of this function is not portable and fails to build with alternative libc implementations like musl or bionic. This causes the following build error: drivers/gpu/drm/xe/xe_gen_wa_oob.c:130:12: error: assignment to ‘const char *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion] 130 | fn = basename(fn); | ^ While a POSIX version of basename() could be used, it would require a separate header plus the behavior differs from GNU version in that it might modify its argument. Not great. Instead, implement a local xbasename() helper based on strrchr() that provides the same functionality and avoids portability issues. Fixes: b0a2ee5567ab ("drm/xe: prepare xe_gen_wa_oob to be multi-use") Suggested-by: Lucas De Marchi Reviewed-by: Tiffany Yang Signed-off-by: Carlos Llamas Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250825155743.1132433-1-cmllamas@google.com Signed-off-by: Lucas De Marchi (cherry picked from commit 41be792f5baaf90d744a9a9e82994ce560ca9582) Signed-off-by: Rodrigo Vivi commit 16ca06aa2c2218cb21907c0c45a746958c944def Author: Matthew Brost Date: Mon Aug 25 08:28:41 2025 -0700 drm/xe: Don't trigger rebind on initial dma-buf validation On the first validate of an imported dma-buf (initial bind), the device has no GPU mappings, so a rebind is unnecessary. Rebinding here is harmful in multi-GPU setups and for VMs using preempt-fence mode, as it would evict in-flight GPU work. v2: - Drop dma_buf_validated, check for XE_PL_SYSTEM (Thomas) Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20250825152841.3837378-1-matthew.brost@intel.com (cherry picked from commit ffdf968762e4fb3cdae54e811ec3525e67440a60) Signed-off-by: Rodrigo Vivi commit 2b55ddf36229e0278c956215784ab1feeff510aa Author: Thomas Hellström Date: Thu Aug 21 16:30:45 2025 +0200 drm/xe/vm: Clear the scratch_pt pointer on error Avoid triggering a dereference of an error pointer on cleanup in xe_vm_free_scratch() by clearing any scratch_pt error pointer. Signed-off-by: Thomas Hellström Fixes: 06951c2ee72d ("drm/xe: Use NULL PTEs as scratch PTEs") Cc: Brian Welty Cc: Rodrigo Vivi Cc: Lucas De Marchi Cc: # v6.8+ Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821143045.106005-4-thomas.hellstrom@linux.intel.com (cherry picked from commit 358ee50ab565f3c8ea32480e9d03127a81ba32f8) Signed-off-by: Rodrigo Vivi commit 7551865cd12af2dc47e5a174eebcfb0b94b5449b Author: Thomas Hellström Date: Thu Aug 21 16:30:43 2025 +0200 drm/xe/vm: Don't pin the vm_resv during validation The pinning has the odd side-effect that unlocking *any* resv during validation triggers an "unlocking pinned lock" warning. Cc: Matthew Brost Fixes: 5cc3325584c4 ("drm/xe: Rework eviction rejection of bound external bos") Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250821143045.106005-2-thomas.hellstrom@linux.intel.com (cherry picked from commit 0a51bf3e54dd8b77e6f1febbbb66def0660862d2) Signed-off-by: Rodrigo Vivi commit 04e1f683cd28dc9407b238543871a6e09a570dc0 Author: Zbigniew Kempczyński Date: Wed Aug 20 10:39:04 2025 +0200 drm/xe/xe_sync: avoid race during ufence signaling Marking ufence as signalled after copy_to_user() is too late. Worker thread which signals ufence by memory write might be raced with another userspace vm-bind call. In map/unmap scenario unmap may still see ufence is not signalled causing -EBUSY. Change the order of marking / write to user-fence fixes this issue. Fixes: 977e5b82e090 ("drm/xe: Expose user fence from xe_sync_entry") Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5536 Signed-off-by: Zbigniew Kempczyński Cc: Matthew Brost Cc: Matthew Auld Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250820083903.2109891-2-zbigniew.kempczynski@intel.com (cherry picked from commit 8ae04fe9ffc93d6bc3bc63ac08375427d69cee06) Signed-off-by: Rodrigo Vivi commit e246518aa24f1460902725e97d0abf574aec6ade Author: Johannes Berg Date: Tue Aug 26 13:43:47 2025 +0200 PM: sleep: annotate RCU list iterations These iterations require the read lock, otherwise RCU lockdep will splat: ============================= WARNING: suspicious RCU usage 6.17.0-rc3-00014-g31419c045d64 #6 Tainted: G O ----------------------------- drivers/base/power/main.c:1333 RCU-list traversed in non-reader section!! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 5 locks held by rtcwake/547: #0: 00000000643ab418 (sb_writers#6){.+.+}-{0:0}, at: file_start_write+0x2b/0x3a #1: 0000000067a0ca88 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x181/0x24b #2: 00000000631eac40 (kn->active#3){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x191/0x24b #3: 00000000609a1308 (system_transition_mutex){+.+.}-{4:4}, at: pm_suspend+0xaf/0x30b #4: 0000000060c0fdb0 (device_links_srcu){.+.+}-{0:0}, at: device_links_read_lock+0x75/0x98 stack backtrace: CPU: 0 UID: 0 PID: 547 Comm: rtcwake Tainted: G O 6.17.0-rc3-00014-g31419c045d64 #6 VOLUNTARY Tainted: [O]=OOT_MODULE Stack: 223721b3a80 6089eac6 00000001 00000001 ffffff00 6089eac6 00000535 6086e528 721b3ac0 6003c294 00000000 60031fc0 Call Trace: [<600407ed>] show_stack+0x10e/0x127 [<6003c294>] dump_stack_lvl+0x77/0xc6 [<6003c2fd>] dump_stack+0x1a/0x20 [<600bc2f8>] lockdep_rcu_suspicious+0x116/0x13e [<603d8ea1>] dpm_async_suspend_superior+0x117/0x17e [<603d980f>] device_suspend+0x528/0x541 [<603da24b>] dpm_suspend+0x1a2/0x267 [<603da837>] dpm_suspend_start+0x5d/0x72 [<600ca0c9>] suspend_devices_and_enter+0xab/0x736 [...] Add the fourth argument to the iteration to annotate this and avoid the splat. Fixes: 06799631d522 ("PM: sleep: Make async suspend handle suppliers like parents") Fixes: ed18738fff02 ("PM: sleep: Make async resume handle consumers like children") Signed-off-by: Johannes Berg Link: https://patch.msgid.link/20250826134348.aba79f6e6299.I9ecf55da46ccf33778f2c018a82e1819d815b348@changeid Signed-off-by: Rafael J. Wysocki commit 134ed1093907a79e5d98087513f13fd7652c4df9 Author: Jan Kiszka Date: Mon Aug 25 18:07:13 2025 +0200 efi: stmm: Drop unneeded null pointer check The API documenation of setup_mm_hdr does not mention that dptr can be NULL, this is a local function, and no caller passes NULL. So drop the unneeded check. Signed-off-by: Jan Kiszka Reviewed-by: Ilias Apalodimas Acked-by: Sumit Garg Signed-off-by: Ard Biesheuvel commit 01a3044af5d910e1f8b0bee53b2e0eccee8f9a5c Author: Jan Kiszka Date: Mon Aug 25 18:07:12 2025 +0200 efi: stmm: Drop unused EFI error from setup_mm_hdr arguments No caller ever evaluates what we return in 'ret'. They only use the return code of the function. Signed-off-by: Jan Kiszka Reviewed-by: Ilias Apalodimas Acked-by: Sumit Garg Signed-off-by: Ard Biesheuvel commit 80c6c1048625712200ab9cdc665d792b85594e2c Author: Jan Kiszka Date: Mon Aug 25 18:07:11 2025 +0200 efi: stmm: Do not return EFI_OUT_OF_RESOURCES on internal errors When we are low on memory or when the internal API is violated, we cannot return EFI_OUT_OF_RESOURCES. According to the UEFI standard, that error code is either related to persistent storage used for the variable or even not foreseen as possible error (GetVariable e.g.). Use the not fully accurate but compliant error code EFI_DEVICE_ERROR in those cases. Signed-off-by: Jan Kiszka Reviewed-by: Ilias Apalodimas Acked-by: Sumit Garg Signed-off-by: Ard Biesheuvel commit c5e81e672699e0c5557b2b755cc8f7a69aa92bff Author: Jan Kiszka Date: Mon Aug 25 18:07:10 2025 +0200 efi: stmm: Fix incorrect buffer allocation method The communication buffer allocated by setup_mm_hdr() is later on passed to tee_shm_register_kernel_buf(). The latter expects those buffers to be contiguous pages, but setup_mm_hdr() just uses kmalloc(). That can cause various corruptions or BUGs, specifically since commit 9aec2fb0fd5e ("slab: allocate frozen pages"), though it was broken before as well. Fix this by using alloc_pages_exact() instead of kmalloc(). Fixes: c44b6be62e8d ("efi: Add tee-based EFI variable driver") Signed-off-by: Jan Kiszka Acked-by: Ilias Apalodimas Acked-by: Sumit Garg Signed-off-by: Ard Biesheuvel commit 7e2f3213e85eba00acb4cfe6d71647892d63c3a1 Author: Lachlan Hodges Date: Tue Aug 26 18:54:37 2025 +1000 wifi: mac80211: increase scan_ies_len for S1G Currently the S1G capability element is not taken into account for the scan_ies_len, which leads to a buffer length validation failure in ieee80211_prep_hw_scan() and subsequent WARN in __ieee80211_start_scan(). This prevents hw scanning from functioning. To fix ensure we accommodate for the S1G capability length. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250826085437.3493-1-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit a33b375ab5b3a9897a0ab76be8258d9f6b748628 Author: Liao Yuanhong Date: Mon Aug 25 10:29:11 2025 +0800 wifi: mac80211: fix incorrect type for ret The variable ret is declared as a u32 type, but it is assigned a value of -EOPNOTSUPP. Since unsigned types cannot correctly represent negative values, the type of ret should be changed to int. Signed-off-by: Liao Yuanhong Link: https://patch.msgid.link/20250825022911.139377-1-liaoyuanhong@vivo.com Signed-off-by: Johannes Berg commit 9cb83d4be0b9b697eae93d321e0da999f9cdfcfc Author: Duoming Zhou Date: Fri Aug 22 13:08:39 2025 +0800 wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work The brcmf_btcoex_detach() only shuts down the btcoex timer, if the flag timer_on is false. However, the brcmf_btcoex_timerfunc(), which runs as timer handler, sets timer_on to false. This creates critical race conditions: 1.If brcmf_btcoex_detach() is called while brcmf_btcoex_timerfunc() is executing, it may observe timer_on as false and skip the call to timer_shutdown_sync(). 2.The brcmf_btcoex_timerfunc() may then reschedule the brcmf_btcoex_info worker after the cancel_work_sync() has been executed, resulting in use-after-free bugs. The use-after-free bugs occur in two distinct scenarios, depending on the timing of when the brcmf_btcoex_info struct is freed relative to the execution of its worker thread. Scenario 1: Freed before the worker is scheduled The brcmf_btcoex_info is deallocated before the worker is scheduled. A race condition can occur when schedule_work(&bt_local->work) is called after the target memory has been freed. The sequence of events is detailed below: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | kfree(cfg->btcoex); // FREE | | schedule_work(&bt_local->work); // USE Scenario 2: Freed after the worker is scheduled The brcmf_btcoex_info is freed after the worker has been scheduled but before or during its execution. In this case, statements within the brcmf_btcoex_handler() — such as the container_of macro and subsequent dereferences of the brcmf_btcoex_info object will cause a use-after-free access. The following timeline illustrates this scenario: CPU0 | CPU1 brcmf_btcoex_detach | brcmf_btcoex_timerfunc | bt_local->timer_on = false; if (cfg->btcoex->timer_on) | ... | cancel_work_sync(); | ... | schedule_work(); // Reschedule | kfree(cfg->btcoex); // FREE | brcmf_btcoex_handler() // Worker /* | btci = container_of(....); // USE The kfree() above could | ... also occur at any point | btci-> // USE during the worker's execution| */ | To resolve the race conditions, drop the conditional check and call timer_shutdown_sync() directly. It can deactivate the timer reliably, regardless of its current state. Once stopped, the timer_on state is then set to false. Fixes: 61730d4dfffc ("brcmfmac: support critical protocol API for DHCP") Acked-by: Arend van Spriel Signed-off-by: Duoming Zhou Link: https://patch.msgid.link/20250822050839.4413-1-duoming@zju.edu.cn Signed-off-by: Johannes Berg commit 26e84445f02ce6b2fe5f3e0e28ff7add77f35e08 Author: Dmitry Antipov Date: Wed Aug 13 16:52:36 2025 +0300 wifi: cfg80211: fix use-after-free in cmp_bss() Following bss_free() quirk introduced in commit 776b3580178f ("cfg80211: track hidden SSID networks properly"), adjust cfg80211_update_known_bss() to free the last beacon frame elements only if they're not shared via the corresponding 'hidden_beacon_bss' pointer. Reported-by: syzbot+30754ca335e6fb7e3092@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=30754ca335e6fb7e3092 Fixes: 3ab8227d3e7d ("cfg80211: refactor cfg80211_bss_update") Signed-off-by: Dmitry Antipov Link: https://patch.msgid.link/20250813135236.799384-1-dmantipov@yandex.ru Signed-off-by: Johannes Berg commit f64768bec0d57988782d26d1ea7ae21f959309dd Author: Arnd Bergmann Date: Thu Jul 31 09:58:33 2025 +0200 wifi: rt2x00: fix CRC_CCITT dependency Compile-testing this driver on Arm platforms shows a link failure when the CRC functions are not part of the kernel: x86_64-linux-ld: drivers/net/wireless/ralink/rt2x00/rt2800lib.o: in function `rt2800_check_firmware': rt2800lib.c:(.text+0x20e5): undefined reference to `crc_ccitt' Move the select statement to the correct Kconfig symbol to match the call site. Fixes: 311b05e235cf ("wifi: rt2x00: add COMPILE_TEST") Signed-off-by: Arnd Bergmann Acked-by: Stanislaw Gruszka Reviewed-by: Sergio Paracuellos Link: https://patch.msgid.link/20250731075837.1969136-1-arnd@kernel.org Signed-off-by: Johannes Berg commit 2d52c9e43a48387a323ab6a4fed755d55040e625 Author: Arnd Bergmann Date: Tue Jul 29 17:29:21 2025 +0200 wifi: rt2800: select CONFIG_RT2X00_LIB as needed The rt2800 specific code requires the more general library code: ERROR: modpost: "rt2x00queue_get_entry" [drivers/net/wireless/ralink/rt2x00/rt2x00mmio.ko] undefined! ERROR: modpost: "rt2x00lib_dmastart" [drivers/net/wireless/ralink/rt2x00/rt2x00mmio.ko] undefined! ERROR: modpost: "rt2x00lib_dmadone" [drivers/net/wireless/ralink/rt2x00/rt2x00mmio.ko] undefined! ERROR: modpost: "rt2x00lib_rxdone" [drivers/net/wireless/ralink/rt2x00/rt2x00mmio.ko] undefined! ERROR: modpost: "rt2x00lib_txdone_nomatch" [drivers/net/wireless/ralink/rt2x00/rt2800lib.ko] undefined! ERROR: modpost: "rt2x00lib_txdone" [drivers/net/wireless/ralink/rt2x00/rt2800lib.ko] undefined! ERROR: modpost: "rt2x00queue_get_entry" [drivers/net/wireless/ralink/rt2x00/rt2800lib.ko] undefined! ERROR: modpost: "rt2x00lib_get_bssidx" [drivers/net/wireless/ralink/rt2x00/rt2800lib.ko] undefined! ERROR: modpost: "rt2x00mac_conf_tx" [drivers/net/wireless/ralink/rt2x00/rt2800lib.ko] undefined! ERROR: modpost: "rt2x00lib_txdone_noinfo" [drivers/net/wireless/ralink/rt2x00/rt2800lib.ko] undefined! Select the symbol to avoid this build failure. Fixes: 7f6109086c9e ("wifi: rt2800: move 2x00soc to 2800soc") Signed-off-by: Arnd Bergmann Acked-by: Stanislaw Gruszka Reviewed-by: Sergio Paracuellos Link: https://patch.msgid.link/20250729152924.2462423-1-arnd@kernel.org Signed-off-by: Johannes Berg commit 1f3214aae9f49faf495f3836216afbc6c5400b2e Author: Antheas Kapenekakis Date: Sun Aug 3 18:02:53 2025 +0200 HID: quirks: add support for Legion Go dual dinput modes The Legion Go features detachable controllers which support a dual dinput mode. In this mode, the controllers appear under a single HID device with two applications. Currently, both controllers appear under the same event device, causing their controls to be mixed up. This patch separates the two so that they can be used independently. In addition, the latest firmware update for the Legion Go swaps the IDs to the ones used by the Legion Go 2, so add those IDs as well. [jkosina@suse.com: improved shortlog] Signed-off-by: Antheas Kapenekakis Signed-off-by: Jiri Kosina commit bd24d2108e9c8459d2c9f3d6d910b0053887df57 Author: Joanne Koong Date: Fri Aug 15 11:25:39 2025 -0700 fuse: fix fuseblk i_blkbits for iomap partial writes On regular fuse filesystems, i_blkbits is set to PAGE_SHIFT which means any iomap partial writes will mark the entire folio as uptodate. However fuseblk filesystems work differently and allow the blocksize to be less than the page size. As such, this may lead to data corruption if fuseblk sets its blocksize to less than the page size, uses the writeback cache, and does a partial write, then a read and the read happens before the write has undergone writeback, since the folio will not be marked uptodate from the partial write so the read will read in the entire folio from disk, which will overwrite the partial write. The long-term solution for this, which will also be needed for fuse to enable large folios with the writeback cache on, is to have fuse also use iomap for folio reads, but until that is done, the cleanest workaround is to use the page size for fuseblk's internal kernel inode blksize/blkbits values while maintaining current behavior for stat(). This was verified using ntfs-3g: $ sudo mkfs.ntfs -f -c 512 /dev/vdd1 $ sudo ntfs-3g /dev/vdd1 ~/fuseblk $ stat ~/fuseblk/hi.txt IO Block: 512 Fixes: a4c9ab1d4975 ("fuse: use iomap for buffered writes") Signed-off-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit 79569946502258ef53984f3000bffa77e469d8dc Author: Joanne Koong Date: Fri Aug 15 11:25:38 2025 -0700 fuse: reflect cached blocksize if blocksize was changed As pointed out by Miklos[1], in the fuse_update_get_attr() path, the attributes returned to stat may be cached values instead of fresh ones fetched from the server. In the case where the server returned a modified blocksize value, we need to cache it and reflect it back to stat if values are not re-fetched since we now no longer directly change inode->i_blkbits. Link: https://lore.kernel.org/linux-fsdevel/CAJfpeguCOxeVX88_zPd1hqziB_C+tmfuDhZP5qO2nKmnb-dTUA@mail.gmail.com/ [1] Fixes: 542ede096e48 ("fuse: keep inode->i_blkbits constant") Signed-off-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Miklos Szeredi commit 1e08938c3694f707bb165535df352ac97a8c75c9 Author: Miklos Szeredi Date: Tue Aug 12 14:46:34 2025 +0200 fuse: prevent overflow in copy_file_range return value The FUSE protocol uses struct fuse_write_out to convey the return value of copy_file_range, which is restricted to uint32_t. But the COPY_FILE_RANGE interface supports a 64-bit size copies. Currently the number of bytes copied is silently truncated to 32-bit, which may result in poor performance or even failure to copy in case of truncation to zero. Reported-by: Florian Weimer Closes: https://lore.kernel.org/all/lhuh5ynl8z5.fsf@oldenburg.str.redhat.com/ Fixes: 88bc7d5097a1 ("fuse: add support for copy_file_range()") Cc: # v4.20 Signed-off-by: Miklos Szeredi commit e5203209b3935041dac541bc5b37efb44220cc0b Author: Miklos Szeredi Date: Tue Aug 12 14:07:54 2025 +0200 fuse: check if copy_file_range() returns larger than requested size Just like write(), copy_file_range() should check if the return value is less or equal to the requested number of bytes. Reported-by: Chunsheng Luo Closes: https://lore.kernel.org/all/20250807062425.694-1-luochunsheng@ustc.edu/ Fixes: 88bc7d5097a1 ("fuse: add support for copy_file_range()") Cc: # v4.20 Signed-off-by: Miklos Szeredi commit e9c8da670e749f7dedc53e3af54a87b041918092 Author: Amir Goldstein Date: Thu Jul 10 12:08:30 2025 +0200 fuse: do not allow mapping a non-regular backing file We do not support passthrough operations other than read/write on regular file, so allowing non-regular backing files makes no sense. Fixes: efad7153bf93 ("fuse: allow O_PATH fd for FUSE_DEV_IOC_BACKING_OPEN") Cc: stable@vger.kernel.org Signed-off-by: Amir Goldstein Reviewed-by: Bernd Schubert Signed-off-by: Miklos Szeredi commit 832e5777143e799a97e8f9b96f002a90f06ba548 Author: Martin Hilgendorf Date: Sat Aug 2 13:45:55 2025 +0000 HID: elecom: add support for ELECOM M-DT2DRBK The DT2DRBK trackball has 8 buttons, but the report descriptor only specifies 5. This patch adds the device ID and performs a similar fixup as for other ELECOM devices to enable the remaining 3 buttons. Signed-off-by: Martin Hilgendorf Signed-off-by: Jiri Kosina commit 6fe31c8b53003134e5573cfb89aea85f96a43afd Author: Adrian Ng Ho Yin Date: Mon Aug 25 15:16:37 2025 +0800 MAINTAINERS: Change Altera-PIO driver maintainer Update Altera-PIO Driver maintainer from to as Mun Yew is no longer with Altera. Signed-off-by: Adrian Ng Ho Yin Acked-by: Mun Yew Tham Link: https://lore.kernel.org/r/20250825071637.40441-1-adrianhoyin.ng@altera.com Signed-off-by: Bartosz Golaszewski commit 810e154d90f44127239957b06ee51a55553a5815 Author: Junjie Cao Date: Mon Aug 25 17:08:50 2025 +0800 gpio: timberdale: fix off-by-one in IRQ type boundary check timbgpio_irq_type() currently accepts offset == ngpio, violating gpiolib's [0..ngpio-1] contract. This can lead to undefined behavior when computing '1 << offset', and it is also inconsistent with users that iterate with for_each_set_bit(..., ngpio). Tighten the upper bound to reject offset == ngpio. No functional change for in-range offsets. Signed-off-by: Junjie Cao Link: https://lore.kernel.org/r/20250825090850.127163-1-junjie.cao@intel.com Signed-off-by: Bartosz Golaszewski commit a5a261bea9bf8444300d1067b4a73bedee5b5227 Author: Fabio Porcedda Date: Fri Aug 22 11:08:39 2025 +0200 USB: serial: option: add Telit Cinterion LE910C4-WWX new compositions Add the following Telit Cinterion LE910C4-WWX new compositions: 0x1034: tty (AT) + tty (AT) + rmnet T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1034 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x1036: tty (AT) + tty (AT) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1036 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x1037: tty (diag) + tty (Telit custom) + tty (AT) + tty (AT) + rmnet T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 15 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1037 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x1038: tty (Telit custom) + tty (AT) + tty (AT) + rmnet T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1038 Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x103b: tty (diag) + tty (Telit custom) + tty (AT) + tty (AT) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 10 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=103b Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms 0x103c: tty (Telit custom) + tty (AT) + tty (AT) T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=103c Rev=00.00 S: Manufacturer=Telit S: Product=LE910C4-WWX S: SerialNumber=93f617e7 C: #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=84(I) Atr=03(Int.) MxPS= 64 Ivl=2ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable@vger.kernel.org Signed-off-by: Fabio Porcedda Signed-off-by: Johan Hovold commit 57834ce5a6a47df282c8419019ba5495eac58fb9 Author: Gerald Schaefer Date: Thu Aug 21 19:00:03 2025 +0200 s390/mm: Prevent possible preempt_count overflow The s390 implementation of ptep_modify_prot_start() currently does preempt_disable(), and the preempt_enable() is done later in ptep_modify_prot_commit(). This logic is not really required, because the PTE lock must be held over the complete prot_start/commit transaction, as described in the comment of the generic implementation of ptep_modify_prot_start(). That comment also mentions that this interface should be batchable, and modify_prot_start_ptes() might start a transaction over a batch of PTEs, implemented as a simple loop over ptep_modify_prot_start(). In this case, the preempt_disable() in ptep_modify_prot_start() would be called multiple times, before the corresponding preempt_enable() calls happen, and this can lead to a preempt_count overflow. To fix this, simply remove the preempt_disable/enable() calls in ptep_modify_prot_start/commit(), and rely on the PTE lock being held. Commit cac1db8c3aad ("mm: optimize mprotect() by PTE batching") made use of this PTE batching for the first time, and triggers warnings like this: DEBUG_LOCKS_WARN_ON((preempt_count() & PREEMPT_MASK) >= PREEMPT_MASK - 10) BUG: sleeping function called from invalid context at mm/mprotect.c:576 Hence, add a Fixes tag on that commit. Not because it is broken, but to make sure that it won't get backported w/o also this fix for s390. Fixes: cac1db8c3aad ("mm: optimize mprotect() by PTE batching") Reviewed-by: Alexander Gordeev Signed-off-by: Gerald Schaefer Signed-off-by: Alexander Gordeev commit cba70aff623b104085ab5613fedd21f6ea19095a Author: Fabio Porcedda Date: Wed Aug 6 14:09:26 2025 +0200 USB: serial: option: add Telit Cinterion FN990A w/audio compositions Add the following Telit Cinterion FN990A w/audio compositions: 0x1077: tty (diag) + adb + rmnet + audio + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1077 Rev=05.04 S: Manufacturer=Telit Wireless Solutions S: Product=FN990 S: SerialNumber=67e04c35 C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 0 Cls=01(audio) Sub=01 Prot=20 Driver=snd-usb-audio I: If#= 4 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio E: Ad=03(O) Atr=0d(Isoc) MxPS= 68 Ivl=1ms I: If#= 5 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio E: Ad=84(I) Atr=0d(Isoc) MxPS= 68 Ivl=1ms I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 9 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8c(I) Atr=03(Int.) MxPS= 10 Ivl=32ms 0x1078: tty (diag) + adb + MBIM + audio + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 21 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1078 Rev=05.04 S: Manufacturer=Telit Wireless Solutions S: Product=FN990 S: SerialNumber=67e04c35 C: #Ifs=11 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#=10 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8c(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=32ms I: If#= 3 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 0 Cls=01(audio) Sub=01 Prot=20 Driver=snd-usb-audio I: If#= 5 Alt= 0 #EPs= 0 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio I: If#= 6 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio E: Ad=84(I) Atr=0d(Isoc) MxPS= 68 Ivl=1ms I: If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 9 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms 0x1079: RNDIS + tty (diag) + adb + audio + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 23 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1079 Rev=05.04 S: Manufacturer=Telit Wireless Solutions S: Product=FN990 S: SerialNumber=67e04c35 C: #Ifs=11 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 1 Cls=ef(misc ) Sub=04 Prot=01 Driver=rndis_host E: Ad=81(I) Atr=03(Int.) MxPS= 8 Ivl=32ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#=10 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8c(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 4 Alt= 0 #EPs= 0 Cls=01(audio) Sub=01 Prot=20 Driver=snd-usb-audio I: If#= 5 Alt= 0 #EPs= 0 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio I: If#= 6 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio E: Ad=84(I) Atr=0d(Isoc) MxPS= 68 Ivl=1ms I: If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 9 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms Cc: stable@vger.kernel.org Signed-off-by: Fabio Porcedda Signed-off-by: Johan Hovold commit ae668cd567a6a7622bc813ee0bb61c42bed61ba7 Author: Eric Sandeen Date: Fri Aug 22 12:55:56 2025 -0500 xfs: do not propagate ENODATA disk errors into xattr code ENODATA (aka ENOATTR) has a very specific meaning in the xfs xattr code; namely, that the requested attribute name could not be found. However, a medium error from disk may also return ENODATA. At best, this medium error may escape to userspace as "attribute not found" when in fact it's an IO (disk) error. At worst, we may oops in xfs_attr_leaf_get() when we do: error = xfs_attr_leaf_hasname(args, &bp); if (error == -ENOATTR) { xfs_trans_brelse(args->trans, bp); return error; } because an ENODATA/ENOATTR error from disk leaves us with a null bp, and the xfs_trans_brelse will then null-deref it. As discussed on the list, we really need to modify the lower level IO functions to trap all disk errors and ensure that we don't let unique errors like this leak up into higher xfs functions - many like this should be remapped to EIO. However, this patch directly addresses a reported bug in the xattr code, and should be safe to backport to stable kernels. A larger-scope patch to handle more unique errors at lower levels can follow later. (Note, prior to 07120f1abdff we did not oops, but we did return the wrong error code to userspace.) Signed-off-by: Eric Sandeen Fixes: 07120f1abdff ("xfs: Add xfs_has_attr and subroutines") Cc: stable@vger.kernel.org # v5.9+ Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 52d15521eb75f9b521744db675bee61025d2fa52 Author: Yicong Yang Date: Fri Jun 27 11:54:20 2025 +0800 sched/deadline: Don't count nr_running for dl_server proxy tasks On CPU offline the kernel stalled with below call trace: INFO: task kworker/0:1:11 blocked for more than 120 seconds. cpuhp hold the cpu hotplug lock endless and stalled vmstat_shepherd. This is because we count nr_running twice on cpuhp enqueuing and failed the wait condition of cpuhp: enqueue_task_fair() // pick cpuhp from idle, rq->nr_running = 0 dl_server_start() [...] add_nr_running() // rq->nr_running = 1 add_nr_running() // rq->nr_running = 2 [switch to cpuhp, waiting on balance_hotplug_wait()] rcuwait_wait_event(rq->nr_running == 1 && ...) // failed, rq->nr_running=2 schedule() // wait again It doesn't make sense to count the dl_server towards runnable tasks, since it runs other tasks. Fixes: 63ba8422f876 ("sched/deadline: Introduce deadline servers") Signed-off-by: Yicong Yang Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250627035420.37712-1-yangyicong@huawei.com commit 421fc59cf58c64f898cafbbbbda0bc705837e7df Author: kuyo chang Date: Sun Jun 15 21:10:56 2025 +0800 sched/deadline: Fix RT task potential starvation when expiry time passed [Symptom] The fair server mechanism, which is intended to prevent fair starvation when higher-priority tasks monopolize the CPU. Specifically, RT tasks on the runqueue may not be scheduled as expected. [Analysis] The log "sched: DL replenish lagged too much" triggered. By memory dump of dl_server: curr = 0xFFFFFF80D6A0AC00 ( dl_server = 0xFFFFFF83CD5B1470( dl_runtime = 0x02FAF080, dl_deadline = 0x3B9ACA00, dl_period = 0x3B9ACA00, dl_bw = 0xCCCC, dl_density = 0xCCCC, runtime = 0x02FAF080, deadline = 0x0000082031EB0E80, flags = 0x0, dl_throttled = 0x0, dl_yielded = 0x0, dl_non_contending = 0x0, dl_overrun = 0x0, dl_server = 0x1, dl_server_active = 0x1, dl_defer = 0x1, dl_defer_armed = 0x0, dl_defer_running = 0x1, dl_timer = ( node = ( expires = 0x000008199756E700), _softexpires = 0x000008199756E700, function = 0xFFFFFFDB9AF44D30 = dl_task_timer, base = 0xFFFFFF83CD5A12C0, state = 0x0, is_rel = 0x0, is_soft = 0x0, clock_update_flags = 0x4, clock = 0x000008204A496900, - The timer expiration time (rq->curr->dl_server->dl_timer->expires) is already in the past, indicating the timer has expired. - The timer state (rq->curr->dl_server->dl_timer->state) is 0. [Suspected Root Cause] The relevant code flow in the throttle path of update_curr_dl_se() as follows: dequeue_dl_entity(dl_se, 0); // the DL entity is dequeued if (unlikely(is_dl_boosted(dl_se) || !start_dl_timer(dl_se))) { if (dl_server(dl_se)) // timer registration fails enqueue_dl_entity(dl_se, ENQUEUE_REPLENISH);//enqueue immediately ... } The failure of `start_dl_timer` is caused by attempting to register a timer with an expiration time that is already in the past. When this situation persists, the code repeatedly re-enqueues the DL entity without properly replenishing or restarting the timer, resulting in RT task may not be scheduled as expected. [Proposed Solution]: Instead of immediately re-enqueuing the DL entity on timer registration failure, this change ensures the DL entity is properly replenished and the timer is restarted, preventing RT potential starvation. Fixes: 63ba8422f876 ("sched/deadline: Introduce deadline servers") Signed-off-by: kuyo chang Signed-off-by: Peter Zijlstra (Intel) Closes: https://lore.kernel.org/CAMuHMdXn4z1pioTtBGMfQM0jsLviqS2jwysaWXpoLxWYoGa82w@mail.gmail.com Tested-by: Geert Uytterhoeven Tested-by: Jiri Slaby Tested-by: Diederik de Haas Link: https://lkml.kernel.org/r/20250615131129.954975-1-kuyo.chang@mediatek.com commit bb4700adc3abec34c0a38b64f66258e4e233fc16 Author: Juri Lelli Date: Mon Jul 21 15:01:42 2025 +0200 sched/deadline: Always stop dl-server before changing parameters Commit cccb45d7c4295 ("sched/deadline: Less agressive dl_server handling") reduced dl-server overhead by delaying disabling servers only after there are no fair task around for a whole period, which means that deadline entities are not dequeued right away on a server stop event. However, the delay opens up a window in which a request for changing server parameters can break per-runqueue running_bw tracking, as reported by Yuri. Close the problematic window by unconditionally calling dl_server_stop() before applying the new parameters (ensuring deadline entities go through an actual dequeue). Fixes: cccb45d7c4295 ("sched/deadline: Less agressive dl_server handling") Reported-by: Yuri Andriaccio Signed-off-by: Juri Lelli Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Valentin Schneider Link: https://lore.kernel.org/r/20250721-upstream-fix-dlserver-lessaggressive-b4-v1-1-4ebc10c87e40@redhat.com commit 4717432dfd99bbd015b6782adca216c6f9340038 Author: Huacai Chen Date: Sat Aug 9 21:04:19 2025 +0800 sched/deadline: Fix dl_server_stopped() Commit cccb45d7c429 ("sched/deadline: Less agressive dl_server handling") introduces dl_server_stopped(). But it is obvious that dl_server_stopped() should return true if dl_se->dl_server_active is 0. Fixes: cccb45d7c429 ("sched/deadline: Less agressive dl_server handling") Signed-off-by: Huacai Chen Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250809130419.1980742-1-chenhuacai@loongson.cn commit 16fdb3cc6af8460f23a706512c6f5e7dfdd4f338 Author: Thomas Zimmermann Date: Tue Jul 15 10:45:39 2025 +0200 Revert "drm/tegra: Use dma_buf from GEM object instance" This reverts commit 482c7e296edc0f594e8869a789a40be53c49bd6a. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. Signed-off-by: Thomas Zimmermann Reviewed-by: Simona Vetter Link: https://lore.kernel.org/r/20250715084549.41473-1-tzimmermann@suse.de commit 1148bb0c5827e4b6fcc50358783608b0f2080302 Author: Daniel Dadap Date: Mon Aug 25 21:48:38 2025 -0500 ALSA: hda/hdmi: Restore missing HDMI codec entries Commit ad781b550f9a ("ALSA: hda/hdmi: Rewrite to new probe method") rewrote the HDMI codec ID tables to a new format. In doing so, recently added codec IDs from commit e0a911ac868 ("ALSA: hda: Add missing NVIDIA HDA codec IDs") were dropped from the tables. These tables had recently been split from the unified table that existed in patch_hdmi.c, and did contain the entries in question after the split but before the codec ID entries were rewritten to the new format. Restore the missing codec ID entries to nvhdmi.c and tegrahdmi.c. There do not appear to be any additional missing entries in any of the other codec ID tables when compared to the patch_hdmi.c at the final revision before the split. Fixes: ad781b550f9a ("ALSA: hda/hdmi: Rewrite to new probe method") Signed-off-by: Daniel Dadap Link: https://patch.msgid.link/aK0ghvagXy740rxd@ddadap-lakeline.nvidia.com Signed-off-by: Takashi Iwai commit b3dcc9d1d806fb1e175f85978713eef868531da4 Author: Mike Rapoport (Microsoft) Date: Tue Aug 26 10:19:46 2025 +0300 memblock: fix kernel-doc for MEMBLOCK_RSRV_NOINIT The kernel-doc description of MEMBLOCK_RSRV_NOINIT and memblock_reserved_mark_noinit() do not accurately describe their functionality. Expand their kernel doc to make it clear that the user of MEMBLOCK_RSRV_NOINIT is responsible to properly initialize the struct pages for such regions and add more details about effects of using this flag. Reviewed-by: David Hildenbrand Link: https://lore.kernel.org/r/f8140a17-c4ec-489b-b314-d45abe48bf36@redhat.com Link: https://lore.kernel.org/r/20250826071947.1949725-1-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) commit 45d8ef6322b8a828d3b1e2cfb8893e2ff882cb23 Author: Junnan Wu Date: Tue Aug 12 17:08:17 2025 +0800 virtio_net: adjust the execution order of function `virtnet_close` during freeze "Use after free" issue appears in suspend once race occurs when napi poll scheduls after `netif_device_detach` and before napi disables. For details, during suspend flow of virtio-net, the tx queue state is set to "__QUEUE_STATE_DRV_XOFF" by CPU-A. And at some coincidental times, if a TCP connection is still working, CPU-B does `virtnet_poll` before napi disable. In this flow, the state "__QUEUE_STATE_DRV_XOFF" of tx queue will be cleared. This is not the normal process it expects. After that, CPU-A continues to close driver then virtqueue is removed. Sequence likes below: -------------------------------------------------------------------------- CPU-A CPU-B ----- ----- suspend is called A TCP based on virtio-net still work virtnet_freeze |- virtnet_freeze_down | |- netif_device_detach | | |- netif_tx_stop_all_queues | | |- netif_tx_stop_queue | | |- set_bit | | (__QUEUE_STATE_DRV_XOFF,...) | | softirq rasied | | |- net_rx_action | | |- napi_poll | | |- virtnet_poll | | |- virtnet_poll_cleantx | | |- netif_tx_wake_queue | | |- test_and_clear_bit | | (__QUEUE_STATE_DRV_XOFF,...) | |- virtnet_close | |- virtnet_disable_queue_pair | |- virtnet_napi_tx_disable |- remove_vq_common -------------------------------------------------------------------------- When TCP delayack timer is up, a cpu gets softirq and irq handler `tcp_delack_timer_handler` will be called, which will finally call `start_xmit` in virtio net driver. Then the access to tx virtq will cause panic. The root cause of this issue is that napi tx is not disable before `netif_tx_stop_queue`, once `virnet_poll` schedules in such coincidental time, the tx queue state will be cleared. To solve this issue, adjusts the order of function `virtnet_close` in `virtnet_freeze_down`. Co-developed-by: Ying Xu Signed-off-by: Ying Xu Signed-off-by: Junnan Wu Message-Id: <20250812090817.3463403-1-junnan01.wu@samsung.com> Signed-off-by: Michael S. Tsirkin commit 528d92bfc0937a6a1ec837dbbcb3612a8545cd37 Author: Ying Gao Date: Tue Aug 12 17:51:18 2025 +0800 virtio_input: Improve freeze handling When executing suspend to ram, if lacking the operations to reset device and free unused buffers before deleting a vq, resource leaks and inconsistent device status will appear. According to chapter "3.3.1 Driver Requirements: Device Cleanup:" of virtio-specification: Driver MUST ensure a virtqueue isn’t live (by device reset) before removing exposed buffers. Therefore, modify the virtinput_freeze function to reset the device and delete the unused buffers before deleting the virtqueue, just like virtinput_remove does. Co-developed-by: Ying Xu Signed-off-by: Ying Xu Co-developed-by: Junnan Wu Signed-off-by: Junnan Wu Signed-off-by: Ying Gao Message-Id: <20250812095118.3622717-1-ying01.gao@samsung.com> Signed-off-by: Michael S. Tsirkin commit 24fc631539cc78225f5c61f99c7666fcff48024d Author: Namhyung Kim Date: Mon Aug 18 23:39:57 2025 -0700 vhost: Fix ioctl # for VHOST_[GS]ET_FORK_FROM_OWNER The VHOST_[GS]ET_FEATURES_ARRAY ioctl already took 0x83 and it would result in a build error when the vhost uapi header is used for perf tool build like below. In file included from trace/beauty/ioctl.c:93: tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c: In function ‘ioctl__scnprintf_vhost_virtio_cmd’: tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c:36:18: error: initialized field overwritten [-Werror=override-init] 36 | [0x83] = "SET_FORK_FROM_OWNER", | ^~~~~~~~~~~~~~~~~~~~~ tools/perf/trace/beauty/generated/ioctl/vhost_virtio_ioctl_array.c:36:18: note: (near initialization for ‘vhost_virtio_ioctl_cmds[131]’) Fixes: 7d9896e9f6d02d8a ("vhost: Reintroduce kthread API and add mode selection") Signed-off-by: Namhyung Kim Message-Id: <20250819063958.833770-1-namhyung@kernel.org> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang commit ced17ee32a9988b8a260628e7c31a100d7dc082e Author: Igor Torrente Date: Thu Aug 7 09:41:45 2025 -0300 Revert "virtio: reject shm region if length is zero" The commit 206cc44588f7 ("virtio: reject shm region if length is zero") breaks the Virtio-gpu `host_visible` feature. As you can see in the snippet below, host_visible_region is zero because of the `kzalloc`. It's using the `vm_get_shm_region` (drivers/virtio/virtio_mmio.c:536) to read the `addr` and `len` from qemu/crosvm. ``` drivers/gpu/drm/virtio/virtgpu_kms.c 132 vgdev = drmm_kzalloc(dev, sizeof(struct virtio_gpu_device), GFP_KERNEL); [...] 177 if (virtio_get_shm_region(vgdev->vdev, &vgdev->host_visible_region, 178 VIRTIO_GPU_SHM_ID_HOST_VISIBLE)) { ``` Now it always fails. To fix, revert the offending commit. Fixes: 206cc44588f7 ("virtio: reject shm region if length is zero") Signed-off-by: Igor Torrente Message-Id: <20250807124145.81816-1-igor.torrente@collabora.com> Signed-off-by: Michael S. Tsirkin commit dd54bcf86c91a4455b1f95cbc8e9ac91205f3193 Author: Nikolay Kuratov Date: Tue Aug 5 16:09:17 2025 +0300 vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() When operating on struct vhost_net_ubuf_ref, the following execution sequence is theoretically possible: CPU0 is finalizing DMA operation CPU1 is doing VHOST_NET_SET_BACKEND // ubufs->refcount == 2 vhost_net_ubuf_put() vhost_net_ubuf_put_wait_and_free(oldubufs) vhost_net_ubuf_put_and_wait() vhost_net_ubuf_put() int r = atomic_sub_return(1, &ubufs->refcount); // r = 1 int r = atomic_sub_return(1, &ubufs->refcount); // r = 0 wait_event(ubufs->wait, !atomic_read(&ubufs->refcount)); // no wait occurs here because condition is already true kfree(ubufs); if (unlikely(!r)) wake_up(&ubufs->wait); // use-after-free This leads to use-after-free on ubufs access. This happens because CPU1 skips waiting for wake_up() when refcount is already zero. To prevent that use a read-side RCU critical section in vhost_net_ubuf_put(), as suggested by Hillf Danton. For this lock to take effect, free ubufs with kfree_rcu(). Cc: stable@vger.kernel.org Fixes: 0ad8b480d6ee9 ("vhost: fix ref cnt checking deadlock") Reported-by: Andrey Ryabinin Suggested-by: Hillf Danton Signed-off-by: Nikolay Kuratov Message-Id: <20250805130917.727332-1-kniv@yandex-team.ru> Signed-off-by: Michael S. Tsirkin commit a39d13e291c2681e475d9fd41655764dab09be7b Author: Liming Wu Date: Thu Jul 31 17:27:57 2025 +0800 virtio_pci: Fix misleading comment for queue vector This patch fixes misleading comments in both legacy and modern virtio-pci device implementations. The comments previously referred to the "config vector" for parameters and return values of the `vp_legacy_queue_vector()` and `vp_modern_queue_vector()` functions, which is incorrect. Signed-off-by: Liming Wu Message-Id: <20250731092757.1000-1-liming.wu@jaguarmicro.com> Signed-off-by: Michael S. Tsirkin commit fab1beda7597fac1cecc01707d55eadb6bbe773c Merge: b6add54ba61890 80af3745ca465c Author: Linus Torvalds Date: Mon Aug 25 18:47:58 2025 -0700 Merge tag 'devicetree-fixes-for-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree fixes from Rob Herring: - Fix a memory leak for of_pci_add_properties() failure case. Then fix the introduced UAF. - Add missing IORESOURCE_MEM flag on of_reserved_mem_region_to_resource() - Add already in use vendor prefix "eswin" - Clarify "of of" comment in of_match_device(). After many years of drive-by patches dropping the 2nd "of" (which referred to OpenFirmware), a correct patch finally arrived * tag 'devicetree-fixes-for-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: of: dynamic: Fix use after free in of_changeset_add_prop_helper() dt-bindings: vendor-prefixes: add eswin of: reserved_mem: Add missing IORESOURCE_MEM flag on resources of: dynamic: Fix memleak when of_pci_add_properties() failed of: Clarify OF device context in of_match_device() comment commit 007a5ffadc4fd51739527f1503b7cf048f31c413 Author: Yeounsu Moon Date: Sun Aug 24 03:29:24 2025 +0900 net: dlink: fix multicast stats being counted incorrectly `McstFramesRcvdOk` counts the number of received multicast packets, and it reports the value correctly. However, reading `McstFramesRcvdOk` clears the register to zero. As a result, the driver was reporting only the packets since the last read, instead of the accumulated total. Fix this by updating the multicast statistics accumulatively instaed of instantaneously. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Tested-on: D-Link DGE-550T Rev-A3 Signed-off-by: Yeounsu Moon Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250823182927.6063-3-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski commit 97766512a9951b9fd6fc97f1b93211642bb0b220 Author: Vladimir Riabchun Date: Fri Aug 22 20:11:36 2025 +0200 mISDN: hfcpci: Fix warning when deleting uninitialized timer With CONFIG_DEBUG_OBJECTS_TIMERS unloading hfcpci module leads to the following splat: [ 250.215892] ODEBUG: assert_init not available (active state 0) object: ffffffffc01a3dc0 object type: timer_list hint: 0x0 [ 250.217520] WARNING: CPU: 0 PID: 233 at lib/debugobjects.c:612 debug_print_object+0x1b6/0x2c0 [ 250.218775] Modules linked in: hfcpci(-) mISDN_core [ 250.219537] CPU: 0 UID: 0 PID: 233 Comm: rmmod Not tainted 6.17.0-rc2-g6f713187ac98 #2 PREEMPT(voluntary) [ 250.220940] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 250.222377] RIP: 0010:debug_print_object+0x1b6/0x2c0 [ 250.223131] Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 4f 41 56 48 8b 14 dd a0 4e 01 9f 48 89 ee 48 c7 c7 20 46 01 9f e8 cb 84d [ 250.225805] RSP: 0018:ffff888015ea7c08 EFLAGS: 00010286 [ 250.226608] RAX: 0000000000000000 RBX: 0000000000000005 RCX: ffffffff9be93a95 [ 250.227708] RDX: 1ffff1100d945138 RSI: 0000000000000008 RDI: ffff88806ca289c0 [ 250.228993] RBP: ffffffff9f014a00 R08: 0000000000000001 R09: ffffed1002bd4f39 [ 250.230043] R10: ffff888015ea79cf R11: 0000000000000001 R12: 0000000000000001 [ 250.231185] R13: ffffffff9eea0520 R14: 0000000000000000 R15: ffff888015ea7cc8 [ 250.232454] FS: 00007f3208f01540(0000) GS:ffff8880caf5a000(0000) knlGS:0000000000000000 [ 250.233851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 250.234856] CR2: 00007f32090a7421 CR3: 0000000004d63000 CR4: 00000000000006f0 [ 250.236117] Call Trace: [ 250.236599] [ 250.236967] ? trace_irq_enable.constprop.0+0xd4/0x130 [ 250.237920] debug_object_assert_init+0x1f6/0x310 [ 250.238762] ? __pfx_debug_object_assert_init+0x10/0x10 [ 250.239658] ? __lock_acquire+0xdea/0x1c70 [ 250.240369] __try_to_del_timer_sync+0x69/0x140 [ 250.241172] ? __pfx___try_to_del_timer_sync+0x10/0x10 [ 250.242058] ? __timer_delete_sync+0xc6/0x120 [ 250.242842] ? lock_acquire+0x30/0x80 [ 250.243474] ? __timer_delete_sync+0xc6/0x120 [ 250.244262] __timer_delete_sync+0x98/0x120 [ 250.245015] HFC_cleanup+0x10/0x20 [hfcpci] [ 250.245704] __do_sys_delete_module+0x348/0x510 [ 250.246461] ? __pfx___do_sys_delete_module+0x10/0x10 [ 250.247338] do_syscall_64+0xc1/0x360 [ 250.247924] entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix this by initializing hfc_tl timer with DEFINE_TIMER macro. Also, use mod_timer instead of manual timeout update. Fixes: 87c5fa1bb426 ("mISDN: Add different different timer settings for hfc-pci") Fixes: 175302f6b79e ("mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq") Signed-off-by: Vladimir Riabchun Link: https://patch.msgid.link/aKiy2D_LiWpQ5kXq@vova-pc Signed-off-by: Jakub Kicinski commit d280233fc86692f495d5e08092e5422bc2f583a8 Author: Hariprasad Kelam Date: Fri Aug 22 16:28:05 2025 +0530 Octeontx2-af: Fix NIX X2P calibration failures Before configuring the NIX block, the AF driver initiates the "NIX block X2P bus calibration" and verifies that NIX interfaces such as CGX and LBK are active and functioning correctly. On few silicon variants(CNF10KA and CNF10KB), X2P calibration failures have been observed on some CGX blocks that are not mapped to the NIX block. Since both NIX-mapped and non-NIX-mapped CGX blocks share the same VENDOR,DEVICE,SUBSYS_DEVID, it's not possible to skip probe based on these parameters. This patch introuduces "is_cgx_mapped_to_nix" API to detect and skip probe of non NIX mapped CGX blocks. Fixes: aba53d5dbcea ("octeontx2-af: NIX block admin queue init") Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20250822105805.2236528-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit 70c1595c181c48a022756116a6c46d5e8bad2c6f Author: Damien Le Moal Date: Thu Aug 21 16:23:14 2025 +0900 ata: ahci: Allow ignoring the external/hotplug capability of ports Commit 4edf1505b76d ("ata: ahci: Disallow LPM policy control for external ports") introduced disabling link power management (LPM) for ports that are advertized as external/hotplug capable. This is necessary to force the maximum power policy (ATA_LPM_MAX_POWER) onto the port link to ensure that the hotplug capability of the port is functional. However, doing so blindly for all ports can prevent systems from going into a low power state, even if the external/hotplug ports on the system are unused. E.g., a laptop may see the internal SATA slot of a docking station as an external hotplug capable port, and in such case, the user may prefer to not use the port and to favor instead enabling LPM to allow the laptop to transition to low power states. Since there is no easy method to automatically detect such choice, introduce the new mask_port_ext module parameter to allow a user to ignore the external/hotplug capability of a port. The format for this parameter value is identical to the format used for the mask_port_map parameter: a mask can be defined for all AHCI adapters of a system or for a particular adapters identified with their PCI IDs (bus:dev.func format). The function ahci_get_port_map_mask() is renamed to ahci_get_port_mask() and modified to return a mask, either for the port map mask of an adapter (to ignore ports) or for the external/hotplug capability of an adapter. Differentiation between map_port_mask and map_port_ext_mask is done by passing the parameter string to ahci_get_port_mask() as a second argument. To be consistent with this change, the function ahci_apply_port_map_mask() is renamed ahci_port_mask() and changed to return a mask value. The mask for the external/hotplug capability for an adapter, if defined by the map_port_ext_mask parameter, is stored in the new field mask_port_ext of struct ahci_host_priv. ahci_mark_external_port() is modified to not set the ATA_PFLAG_EXTERNAL flag for a port if hpriv->mask_port_ext includes the number of the port. In such case, an information message is printed to notify that the external/hotplug capability is being ignored. Reported-by: Dieter Mummenschanz Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220465 Fixes: 4edf1505b76d ("ata: ahci: Disallow LPM policy control for external ports") Signed-off-by: Damien Le Moal Tested-by: Dieter Mummenschanz commit 2c369d91d0933aaff96b6b807b22363e6a38a625 Author: Ian Rogers Date: Fri Aug 22 17:00:24 2025 -0700 perf symbol: Add blocking argument to filename__read_build_id When synthesizing build-ids, for build ID mmap2 events, they will be added for data mmaps if -d/--data is specified. The files opened for their build IDs may block on the open causing perf to hang during synthesis. There is some robustness in existing calls to filename__read_build_id by checking the file path is to a regular file, which unfortunately fails for symlinks. Rather than adding more is_regular_file calls, switch filename__read_build_id to take a "block" argument and specify O_NONBLOCK when this is false. The existing is_regular_file checking callers and the event synthesis callers are made to pass false and thereby avoiding the hang. Fixes: 53b00ff358dc ("perf record: Make --buildid-mmap the default") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250823000024.724394-3-irogers@google.com Signed-off-by: Namhyung Kim commit ba0b7081f7a521d7c28b527a4f18666a148471e7 Author: Ian Rogers Date: Fri Aug 22 17:00:23 2025 -0700 perf symbol-minimal: Fix ehdr reading in filename__read_build_id The e_ident is part of the ehdr and so reading it a second time would mean the read ehdr was displaced by 16-bytes. Switch from stdio to open/read/lseek syscalls for similarity with the symbol-elf version of the function and so that later changes can alter then open flags. Fixes: fef8f648bb47 ("perf symbol: Fix use-after-free in filename__read_build_id") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250823000024.724394-2-irogers@google.com Signed-off-by: Namhyung Kim commit 3cf6147f2b51a569761e1ef010efbd891e3a3a15 Author: Dmitry Baryshkov Date: Thu Aug 14 10:22:23 2025 +0300 soc: qcom: use no-UBWC config for MSM8956/76 Both MSM8956 and MSM8976 have MDSS 1.11 which doesn't support UBWC (although they also have Adreno 510, which might support UBWC). Disable UBWC support for those platforms. Fixes: 1924272b9ce1 ("soc: qcom: Add UBWC config provider") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/668503/ Signed-off-by: Rob Clark commit ec770bb2e19196b28868698a81321d3a3c74da9d Author: Dmitry Baryshkov Date: Thu Aug 14 10:22:22 2025 +0300 soc: qcom: add configuration for MSM8929 MSM8929 is similar to MSM8939, it doesn't support UBWC. Provide no-UBWC config for the platform. Fixes: 197713d0cf01 ("soc: qcom: ubwc: provide no-UBWC configuration") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/668502/ Signed-off-by: Rob Clark commit 61f3c19af5ce6606a8f50ba9a0661881925d28c2 Author: Dmitry Baryshkov Date: Thu Aug 14 10:22:21 2025 +0300 soc: qcom: ubwc: add more missing platforms Add UBWC configuration for SDA660 (modem-less variant of SDM660), SDM450 (similar to MSM8953), SDM632 (similar to MSM8953) and SM7325 (similar to SC7280). Fixes: 1924272b9ce1 ("soc: qcom: Add UBWC config provider") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/668501/ Signed-off-by: Rob Clark commit 5cfd298cc0359697f26b2b6e25385c665e431a7e Author: Dmitry Baryshkov Date: Thu Aug 14 10:22:20 2025 +0300 soc: qcom: ubwc: use no-uwbc config for MSM8917 MSM8917 has MDSS 1.15 and Adreno 308, neither of which support UBWC. Change UBWC configuration to point out that UBWC is not supported on this platform. Fixes: 1924272b9ce1 ("soc: qcom: Add UBWC config provider") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/668500/ Signed-off-by: Rob Clark commit abebfed208515726760d79cf4f9f1a76b9a10a84 Author: Chenyuan Yang Date: Tue Jul 22 16:17:40 2025 -0500 drm/msm/dpu: Add a null ptr check for dpu_encoder_needs_modeset The drm_atomic_get_new_connector_state() can return NULL if the connector is not part of the atomic state. Add a check to prevent a NULL pointer dereference. This follows the same pattern used in dpu_encoder_update_topology() within the same file, which checks for NULL before using conn_state. Signed-off-by: Chenyuan Yang Fixes: 1ce69c265a53 ("drm/msm/dpu: move resource allocation to CRTC") Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/665188/ Signed-off-by: Rob Clark commit 7ab3b7579a6d2660a3425b9ea93b9a140b07f49c Author: Dmitry Baryshkov Date: Sat Aug 9 11:36:54 2025 +0300 dt-bindings: display/msm: qcom,mdp5: drop lut clock None of MDP5 platforms have a LUT clock on the display-controller, it was added by the mistake. Drop it, fixing DT warnings on MSM8976 / MSM8956 platforms. Technically it's an ABI break, but no other platforms are affected. Fixes: 385c8ac763b3 ("dt-bindings: display/msm: convert MDP5 schema to YAML format") Signed-off-by: Dmitry Baryshkov Acked-by: Rob Herring (Arm) Patchwork: https://patchwork.freedesktop.org/patch/667822/ Signed-off-by: Rob Clark commit ebba78e34d47d7866bf62c3970487651797ae20d Merge: b1c99d5bd24ce0 b833b412a522e5 Author: Mark Brown Date: Mon Aug 25 21:16:07 2025 +0100 ASoC: fixup snd_soc_lookup_component_nolocked() Merge series from Kuninori Morimoto : Because snd_dmaengine_pcm is sharing same dev with CPU and Platform, snd_soc_lookup_component_nolocked() might be call with NULL driver name (= CPU). This patch fixup and cleanup it. commit e228e7d382fa85005ee2ebf303e1bf194aca49a8 Author: Alice Ryhl Date: Mon Aug 25 09:22:09 2025 +0000 drm/gpuvm: fix various typos in .c and .h gpuvm file After working with this code for a while, I came across several typos. This patch fixes them. Signed-off-by: Alice Ryhl Link: https://lore.kernel.org/r/20250825-gpuvm-typo-fix-v1-1-14e9e78e28e6@google.com Signed-off-by: Danilo Krummrich commit 85fe9f565d2d5af95ac2bbaa5082b8ce62b039f5 Author: Or Har-Toov Date: Wed Aug 13 15:43:20 2025 +0300 IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions Fix a bug where the driver's event subscription logic for SRQ-related events incorrectly sets obj_type for RMP objects. When subscribing to SRQ events, get_legacy_obj_type() did not handle the MLX5_CMD_OP_CREATE_RMP case, which caused obj_type to be 0 (default). This led to a mismatch between the obj_type used during subscription (0) and the value used during notification (1, taken from the event's type field). As a result, event mapping for SRQ objects could fail and event notification would not be delivered correctly. This fix adds handling for MLX5_CMD_OP_CREATE_RMP in get_legacy_obj_type, returning MLX5_EVENT_QUEUE_TYPE_RQ so obj_type is consistent between subscription and notification. Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX") Link: https://patch.msgid.link/r/8f1048e3fdd1fde6b90607ce0ed251afaf8a148c.1755088962.git.leon@kernel.org Signed-off-by: Or Har-Toov Reviewed-by: Edward Srouji Signed-off-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe commit ed913b343dcf9f623e7436fa1a153c89b22d109b Author: Jedrzej Jagielski Date: Thu Jul 31 14:45:33 2025 +0200 ixgbe: fix ixgbe_orom_civd_info struct layout The current layout of struct ixgbe_orom_civd_info causes incorrect data storage due to compiler-inserted padding. This results in issues when writing OROM data into the structure. Add the __packed attribute to ensure the structure layout matches the expected binary format without padding. Fixes: 70db0788a262 ("ixgbe: read the OROM version information") Reviewed-by: Aleksandr Loktionov Signed-off-by: Jedrzej Jagielski Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit b1a0c977c6f1130f7dd125ee3db8c2435d7e3d41 Author: Michal Kubiak Date: Fri Aug 8 17:53:10 2025 +0200 ice: fix incorrect counter for buffer allocation failures Currently, the driver increments `alloc_page_failed` when buffer allocation fails in `ice_clean_rx_irq()`. However, this counter is intended for page allocation failures, not buffer allocation issues. This patch corrects the counter by incrementing `alloc_buf_failed` instead, ensuring accurate statistics reporting for buffer allocation failures. Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side") Reported-by: Jacob Keller Suggested-by: Paul Menzel Signed-off-by: Michal Kubiak Reviewed-by: Paul Menzel Reviewed-by: Jason Xing Reviewed-by: Aleksandr Loktionov Tested-by: Priya Singh Signed-off-by: Tony Nguyen commit 5c5e5b52bf05c7fe88768318c041052c5fac36b8 Author: Jacob Keller Date: Fri Aug 1 15:27:12 2025 -0700 ice: use fixed adapter index for E825C embedded devices The ice_adapter structure is used by the ice driver to connect multiple physical functions of a device in software. It was introduced by commit 0e2bddf9e5f9 ("ice: add ice_adapter for shared data across PFs on the same NIC") and is primarily used for PTP support, as well as for handling certain cross-PF synchronization. The original design of ice_adapter used PCI address information to determine which devices should be connected. This was extended to support E825C devices by commit fdb7f54700b1 ("ice: Initial support for E825C hardware in ice_adapter"), which used the device ID for E825C devices instead of the PCI address. Later, commit 0093cb194a75 ("ice: use DSN instead of PCI BDF for ice_adapter index") replaced the use of Bus/Device/Function addressing with use of the device serial number. E825C devices may appear in "Dual NAC" configuration which has multiple physical devices tied to the same clock source and which need to use the same ice_adapter. Unfortunately, each "NAC" has its own NVM which has its own unique Device Serial Number. Thus, use of the DSN for connecting ice_adapter does not work properly. It "worked" in the pre-production systems because the DSN was not initialized on the test NVMs and all the NACs had the same zero'd serial number. Since we cannot rely on the DSN, lets fall back to the logic in the original E825C support which used the device ID. This is safe for E825C only because of the embedded nature of the device. It isn't a discreet adapter that can be plugged into an arbitrary system. All E825C devices on a given system are connected to the same clock source and need to be configured through the same PTP clock. To make this separation clear, reserve bit 63 of the 64-bit index values as a "fixed index" indicator. Always clear this bit when using the device serial number as an index. For E825C, use a fixed value defined as the 0x579C E825C backplane device ID bitwise ORed with the fixed index indicator. This is slightly different than the original logic of just using the device ID directly. Doing so prevents a potential issue with systems where only one of the NACs is connected with an external PHY over SGMII. In that case, one NAC would have the E825C_SGMII device ID, but the other would not. Separate the determination of the full 64-bit index from the 32-bit reduction logic. Provide both ice_adapter_index() and a wrapping ice_adapter_xa_index() which handles reducing the index to a long on 32-bit systems. As before, cache the full index value in the adapter structure to warn about collisions. This fixes issues with E825C not initializing PTP on both NACs, due to failure to connect the appropriate devices to the same ice_adapter. Fixes: 0093cb194a75 ("ice: use DSN instead of PCI BDF for ice_adapter index") Signed-off-by: Jacob Keller Reviewed-by: Grzegorz Nitka Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 86aae43f21cf784c1d7f6a9af93e5116b0f232ab Author: Jacob Keller Date: Thu Jul 17 09:57:09 2025 -0700 ice: don't leave device non-functional if Tx scheduler config fails The ice_cfg_tx_topo function attempts to apply Tx scheduler topology configuration based on NVM parameters, selecting either a 5 or 9 layer topology. As part of this flow, the driver acquires the "Global Configuration Lock", which is a hardware resource associated with programming the DDP package to the device. This "lock" is implemented by firmware as a way to guarantee that only one PF can program the DDP for a device. Unlike a traditional lock, once a PF has acquired this lock, no other PF will be able to acquire it again (including that PF) until a CORER of the device. Future requests to acquire the lock report that global configuration has already completed. The following flow is used to program the Tx topology: * Read the DDP package for scheduler configuration data * Acquire the global configuration lock * Program Tx scheduler topology according to DDP package data * Trigger a CORER which clears the global configuration lock This is followed by the flow for programming the DDP package: * Acquire the global configuration lock (again) * Download the DDP package to the device * Release the global configuration lock. However, if configuration of the Tx topology fails, (i.e. ice_get_set_tx_topo returns an error code), the driver exits ice_cfg_tx_topo() immediately, and fails to trigger CORER. While the global configuration lock is held, the firmware rejects most AdminQ commands, as it is waiting for the DDP package download (or Tx scheduler topology programming) to occur. The current driver flows assume that the global configuration lock has been reset by CORER after programming the Tx topology. Thus, the same PF attempts to acquire the global lock again, and fails. This results in the driver reporting "an unknown error occurred when loading the DDP package". It then attempts to enter safe mode, but ultimately fails to finish ice_probe() since nearly all AdminQ command report error codes, and the driver stops loading the device at some point during its initialization. The only currently known way that ice_get_set_tx_topo() can fail is with certain older DDP packages which contain invalid topology configuration, on firmware versions which strictly validate this data. The most recent releases of the DDP have resolved the invalid data. However, it is still poor practice to essentially brick the device, and prevent access to the device even through safe mode or recovery mode. It is also plausible that this command could fail for some other reason in the future. We cannot simply release the global lock after a failed call to ice_get_set_tx_topo(). Releasing the lock indicates to firmware that global configuration (downloading of the DDP) has completed. Future attempts by this or other PFs to load the DDP will fail with a report that the DDP package has already been downloaded. Then, PFs will enter safe mode as they realize that the package on the device does not meet the minimum version requirement to load. The reported error messages are confusing, as they indicate the version of the default "safe mode" package in the NVM, rather than the version of the file loaded from /lib/firmware. Instead, we need to trigger CORER to clear global configuration. This is the lowest level of hardware reset which clears the global configuration lock and related state. It also clears any already downloaded DDP. Crucially, it does *not* clear the Tx scheduler topology configuration. Refactor ice_cfg_tx_topo() to always trigger a CORER after acquiring the global lock, regardless of success or failure of the topology configuration. We need to re-initialize the HW structure when we trigger the CORER. Thus, it makes sense for this to be the responsibility of ice_cfg_tx_topo() rather than its caller, ice_init_tx_topology(). This avoids needless re-initialization in cases where we don't attempt to update the Tx scheduler topology, such as if it has already been programmed. There is one catch: failure to re-initialize the HW struct should stop ice_probe(). If this function fails, we won't have a valid HW structure and cannot ensure the device is functioning properly. To handle this, ensure ice_cfg_tx_topo() returns a limited set of error codes. Set aside one specifically, -ENODEV, to indicate that the ice_init_tx_topology() should fail and stop probe. Other error codes indicate failure to apply the Tx scheduler topology. This is treated as a non-fatal error, with an informational message informing the system administrator that the updated Tx topology did not apply. This allows the device to load and function with the default Tx scheduler topology, rather than failing to load entirely. Note that this use of CORER will not result in loops with future PFs attempting to also load the invalid Tx topology configuration. The first PF will acquire the global configuration lock as part of programming the DDP. Each PF after this will attempt to acquire the global lock as part of programming the Tx topology, and will fail with the indication from firmware that global configuration is already complete. Tx scheduler topology configuration is only performed during driver init (probe or devlink reload) and not during cleanup for a CORER that happens after probe completes. Fixes: 91427e6d9030 ("ice: Support 5 layer topology") Signed-off-by: Jacob Keller Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 60dfe2434eed13082f26eb7409665dfafb38fa51 Author: Emil Tantilov Date: Tue Jun 24 07:26:40 2025 -0700 ice: fix NULL pointer dereference in ice_unplug_aux_dev() on reset Issuing a reset when the driver is loaded without RDMA support, will results in a crash as it attempts to remove RDMA's non-existent auxbus device: echo 1 > /sys/class/net//device/reset BUG: kernel NULL pointer dereference, address: 0000000000000008 ... RIP: 0010:ice_unplug_aux_dev+0x29/0x70 [ice] ... Call Trace: ice_prepare_for_reset+0x77/0x260 [ice] pci_dev_save_and_disable+0x2c/0x70 pci_reset_function+0x88/0x130 reset_store+0x5a/0xa0 kernfs_fop_write_iter+0x15e/0x210 vfs_write+0x273/0x520 ksys_write+0x6b/0xe0 do_syscall_64+0x79/0x3b0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ice_unplug_aux_dev() checks pf->cdev_info->adev for NULL pointer, but pf->cdev_info will also be NULL, leading to the deref in the trace above. Introduce a flag to be set when the creation of the auxbus device is successful, to avoid multiple NULL pointer checks in ice_unplug_aux_dev(). Fixes: c24a65b6a27c7 ("iidc/ice/irdma: Update IDC to support multiple consumers") Signed-off-by: Emil Tantilov Reviewed-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 64c722b5e7f6b909b0e448e580f64628a0d76208 Author: Timur Tabi Date: Tue Aug 12 19:10:04 2025 -0500 drm/nouveau: remove unused memory target test The memory target check is a hold-over from a refactor. It's harmless but distracting, so just remove it. Fixes: 2541626cfb79 ("drm/nouveau/acr: use common falcon HS FW code for ACR FWs") Signed-off-by: Timur Tabi Link: https://lore.kernel.org/r/20250813001004.2986092-3-ttabi@nvidia.com Signed-off-by: Danilo Krummrich commit f529b8915543fb9ceb732cec5571f7fe12bc9530 Author: Timur Tabi Date: Tue Aug 12 19:10:03 2025 -0500 drm/nouveau: remove unused increment in gm200_flcn_pio_imem_wr The 'tag' parameter is passed by value and is not actually used after being incremented, so remove the increment. It's the function that calls gm200_flcn_pio_imem_wr that is supposed to (and does) increment 'tag'. Fixes: 0e44c2170876 ("drm/nouveau/flcn: new code to load+boot simple HS FWs (VPR scrubber)") Reviewed-by: Philipp Stanner Signed-off-by: Timur Tabi Link: https://lore.kernel.org/r/20250813001004.2986092-2-ttabi@nvidia.com Signed-off-by: Danilo Krummrich commit 66e82b6e0a28d4970383e1ee5d60f431001128cd Author: Timur Tabi Date: Tue Aug 12 19:10:02 2025 -0500 drm/nouveau: fix error path in nvkm_gsp_fwsec_v2 Function nvkm_gsp_fwsec_v2() sets 'ret' if the kmemdup() call fails, but it never uses or returns 'ret' after that point. We always need to release the firmware regardless, so do that and then check for error. Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") Cc: stable@vger.kernel.org # v6.7+ Signed-off-by: Timur Tabi Link: https://lore.kernel.org/r/20250813001004.2986092-1-ttabi@nvidia.com Signed-off-by: Danilo Krummrich commit 24963ae1b0b6596dc36e352c18593800056251d8 Author: Suchit Karunakaran Date: Sat Aug 16 12:21:26 2025 +0530 x86/cpu/intel: Fix the constant_tsc model check for Pentium 4 Pentium 4's which are INTEL_P4_PRESCOTT (model 0x03) and later have a constant TSC. This was correctly captured until commit fadb6f569b10 ("x86/cpu/intel: Limit the non-architectural constant_tsc model checks"). In that commit, an error was introduced while selecting the last P4 model (0x06) as the upper bound. Model 0x06 was transposed to INTEL_P4_WILLAMETTE, which is just plain wrong. That was presumably a simple typo, probably just copying and pasting the wrong P4 model. Fix the constant TSC logic to cover all later P4 models. End at INTEL_P4_CEDARMILL which accurately corresponds to the last P4 model. Fixes: fadb6f569b10 ("x86/cpu/intel: Limit the non-architectural constant_tsc model checks") Signed-off-by: Suchit Karunakaran Signed-off-by: Dave Hansen Reviewed-by: Sohil Mehta Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20250816065126.5000-1-suchitkarunakaran%40gmail.com commit b4efccec8d06ceb10a7d34d7b1c449c569d53770 Author: Li Qiong Date: Mon Aug 4 10:57:59 2025 +0800 mm/slub: avoid accessing metadata when pointer is invalid in object_err() object_err() reports details of an object for further debugging, such as the freelist pointer, redzone, etc. However, if the pointer is invalid, attempting to access object metadata can lead to a crash since it does not point to a valid object. One known path to the crash is when alloc_consistency_checks() determines the pointer to the allocated object is invalid because of a freelist corruption, and calls object_err() to report it. The debug code should report and handle the corruption gracefully and not crash in the process. In case the pointer is NULL or check_valid_pointer() returns false for the pointer, only print the pointer value and skip accessing metadata. Fixes: 81819f0fc828 ("SLUB core") Cc: Signed-off-by: Li Qiong Reviewed-by: Harry Yoo Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Vlastimil Babka commit b6add54ba61890450fa54fd9327d10fdfd653439 Merge: 1b237f190eb3d3 563fcd6475931c Author: Linus Torvalds Date: Mon Aug 25 10:44:48 2025 -0400 Merge tag 'pinctrl-v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control fixes from Linus Walleij: - Module macro parameter fix for the meson driver so that it actually modprobes - ACPI quirk for the ASUS ProArt PX13 - Build dependency for the STMFX driver - Proper return value for the pinconf callbacks in the Airhoa driver * tag 'pinctrl-v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: airoha: Fix return value in pinconf callbacks pinctrl: STMFX: add missing HAS_IOMEM dependency gpiolib: acpi: Add quirk for ASUS ProArt PX13 pinctrl: meson: Fix typo in device table macro commit 0e08fa789d39aa01923e3ba144bd808291895c3c Author: Steve French Date: Sat Aug 23 21:15:59 2025 -0500 smb3 client: fix return code mapping of remap_file_range We were returning -EOPNOTSUPP for various remap_file_range cases but for some of these the copy_file_range_syscall() requires -EINVAL to be returned (e.g. where source and target file ranges overlap when source and target are the same file). This fixes xfstest generic/157 which was expecting EINVAL for that (and also e.g. for when the src offset is beyond end of file). Cc: stable@vger.kernel.org Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit d14469ed7c00314fe8957b2841bda329e4eaf4ab Author: Yu Kuai Date: Mon Aug 25 17:32:05 2025 +0800 loop: fix zero sized loop for block special file By default, /dev/sda is block special file from devtmpfs, getattr will return file size as zero, causing loop failed for raw block device. We can add bdev_statx() to return device size, however this may introduce changes that are not acknowledged by user. Fix this problem by reverting changes for block special file, file mapping host is set to bdev inode while opening, and use i_size_read() directly to get device size. Fixes: 47b71abd5846 ("loop: use vfs_getattr_nosec for accurate file size") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202508200409.b2459c02-lkp@intel.com Signed-off-by: Yu Kuai Reviewed-by: Ming Lei Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250825093205.3684121-1-yukuai1@huaweicloud.com [axboe: fix spelling error] Signed-off-by: Jens Axboe commit f05995cc6d3bb742a10996036043ade8d1c65ab7 Author: Arnd Bergmann Date: Thu Aug 7 09:18:58 2025 +0200 ARM: stacktrace: include asm/sections.h in asm/stacktrace.h The recent kstack erase changes appear to have uncovered an existing issue with a missing header inclusion: In file included from drivers/misc/lkdtm/kstack_erase.c:12: In file included from include/linux/kstack_erase.h:16: arch/arm/include/asm/stacktrace.h:48:21: error: call to undeclared function 'in_entry_text'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration] 48 | frame->ex_frame = in_entry_text(frame->pc); | ^ Include asm/sections.h here so the compiler can see the in_entry_text() declaration. Fixes: 752ec621ef5c ("ARM: 9234/1: stacktrace: Avoid duplicate saving of exception PC value") Cc: Kees Cook Signed-off-by: Arnd Bergmann Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250807071902.4077714-1-arnd@kernel.org Signed-off-by: Kees Cook commit ae91aea2d2265c88dbed65a07bbaf3c133fe970c Author: Junhui Pei Date: Mon Jun 2 23:38:41 2025 +0800 ubsan: Fix incorrect hand-side used in handle __ubsan_handle_divrem_overflow() incorrectly uses the RHS to report. It always reports the same log: division of -1 by -1. But it should report division of LHS by -1. Signed-off-by: Junhui Pei Fixes: c6d308534aef ("UBSAN: run-time undefined behavior sanity checker") Link: https://lore.kernel.org/r/20250602153841.62935-1-paradoxskin233@gmail.com Signed-off-by: Kees Cook commit ff2a66d21fd2364ed9396d151115eec59612b200 Author: Salah Triki Date: Thu Jul 31 04:15:27 2025 +0100 EDAC/altera: Delete an inappropriate dma_free_coherent() call dma_free_coherent() must only be called if the corresponding dma_alloc_coherent() call has succeeded. Calling it when the allocation fails leads to undefined behavior. Delete the wrong call. [ bp: Massage commit message. ] Fixes: 71bcada88b0f3 ("edac: altera: Add Altera SDRAM EDAC support") Signed-off-by: Salah Triki Signed-off-by: Borislav Petkov (AMD) Acked-by: Dinh Nguyen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/aIrfzzqh4IzYtDVC@pc commit 132bfcd24925d4d4531a19b87acb8474be82a017 Author: Antheas Kapenekakis Date: Fri Aug 8 17:47:10 2025 +0200 platform/x86: asus-wmi: Fix ROG button mapping, tablet mode on ASUS ROG Z13 On commit 9286dfd5735b ("platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA"), Mathieu adds a quirk for the Zenbook Duo to ignore the code 0x5f (WLAN button disable). On that laptop, this code is triggered when the device keyboard is attached. On the ASUS ROG Z13 2025, this code is triggered when pressing the side button of the device, which is used to open Armoury Crate in Windows. As this is becoming a pattern, where newer Asus laptops use this keycode for emitting events, let's convert the wlan ignore quirk to instead allow emitting codes, so that userspace programs can listen to it and so that it does not interfere with the rfkill state. With this patch, the Z13 wil emit KEY_PROG3 and the Duo will remain unchanged and emit no event. While at it, add a quirk for the Z13 to switch into tablet mode when removing the keyboard. Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250808154710.8981-2-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit cf3940ac737d05c85395f343fe33a3cfcadb47db Author: Antheas Kapenekakis Date: Fri Aug 8 17:47:09 2025 +0200 platform/x86: asus-wmi: Remove extra keys from ignore_key_wlan quirk Currently, the ignore_key_wlan quirk applies to keycodes 0x5D, 0x5E, and 0x5F. However, the relevant code for the Asus Zenbook Duo is only 0x5F. Since this code is emitted by other Asus devices, such as from the Z13 for its ROG button, remove the extra codes before expanding the quirk. For the Duo devices, which are the only ones that use this quirk, there should be no effect. Fixes: 9286dfd5735b ("platform/x86: asus-wmi: Fix spurious rfkill on UX8406MA") Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250808154710.8981-1-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d3a8ca2ebe6e3f2b1fb0e8e74f909d109a1d77c7 Author: Zhen Ni Date: Fri Aug 22 16:33:29 2025 +0800 platform/x86/amd: hfi: Fix pcct_tbl leak in amd_hfi_metadata_parser() Fix a permanent ACPI table memory leak when amd_hfi_metadata_parser() fails due to invalid PCCT table length or memory allocation errors. Fixes: d4e95ea7a78e ("platform/x86: hfi: Parse CPU core ranking data from shared memory") Cc: stable@vger.kernel.org Signed-off-by: Zhen Ni Reviewed-by: Mario Limonciello (AMD) Link: https://lore.kernel.org/r/20250822083329.710857-1-zhen.ni@easystack.cn Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 799766208f09f95677a9ab111b93872d414fbad7 Author: Radim Krčmář Date: Tue Aug 5 12:44:21 2025 +0200 RISC-V: KVM: fix stack overrun when loading vlenb The userspace load can put up to 2048 bits into an xlen bit stack buffer. We want only xlen bits, so check the size beforehand. Fixes: 2fa290372dfe ("RISC-V: KVM: add 'vlenb' Vector CSR") Cc: stable@vger.kernel.org Signed-off-by: Radim Krčmář Reviewed-by: Nutty Liu Reviewed-by: Daniel Henrique Barboza Link: https://lore.kernel.org/r/20250805104418.196023-4-rkrcmar@ventanamicro.com Signed-off-by: Anup Patel commit e61a12a4baf06a4c71e15f522bb5c4345c2ba198 Author: Quan Zhou Date: Mon Aug 11 10:18:29 2025 +0800 RISC-V: KVM: Correct kvm_riscv_check_vcpu_requests() comment Correct `check_vcpu_requests` to `kvm_riscv_check_vcpu_requests` in comments. Fixes: f55ffaf89636 ("RISC-V: KVM: Enable ring-based dirty memory tracking") Signed-off-by: Quan Zhou Reviewed-by: Nutty Liu Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/49680363098c45516ec4b305283d662d26fa9386.1754326285.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit 9bca8be646e043d1fc6cd426fef05558c02de3df Author: Fangyu Yu Date: Thu Aug 7 15:07:29 2025 +0800 RISC-V: KVM: Fix pte settings within kvm_riscv_gstage_ioremap() Currently, kvm_riscv_gstage_ioremap() is used to map IMSIC gpa to the spa of IMSIC guest interrupt file. The PAGE_KERNEL_IO property includes global setting whereas it does not include user mode settings, so when accessing the IMSIC address in the virtual machine, a guest page fault will occur, this is not expected. According to the RISC-V Privileged Architecture Spec, for G-stage address translation, all memory accesses are considered to be user-level accesses as though executed in U-mode. Fixes: 659ad6d82c31 ("RISC-V: KVM: Use PAGE_KERNEL_IO in kvm_riscv_gstage_ioremap()") Signed-off-by: Fangyu Yu Reviewed-by: Radim Krčmář Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250807070729.89701-1-fangyu.yu@linux.alibaba.com Signed-off-by: Anup Patel commit ef3e9c91ed87f13dba877a20569f4a0accf0612c Author: Kamal Wadhwa Date: Sat Aug 23 01:56:39 2025 +0530 regulator: pm8008: fix probe failure due to negative voltage selector In the current design, the `pm8008_regulator_get_voltage_sel()` callback can return a negative value if the raw voltage value is read as 0 uV from the PMIC HW register. This can cause the probe to fail when the `machine_constraints_voltage()` check is called during the regulator registration flow. Fix this by using the helper `regulator_map_voltage_linear_range()` to convert the raw value to a voltage selector inside the mentioned get voltage selector function. This ensures that the value returned is always within the defined range. Signed-off-by: Kamal Wadhwa Message-ID: <20250823-pm8008-negitive-selector-v1-1-52b026a4b5e8@quicinc.com> Signed-off-by: Mark Brown commit b1c99d5bd24ce0a1193d8476d83bf8c8bc633266 Author: Cryolitia PukNgae Date: Fri Aug 22 18:28:33 2025 +0800 ASoC: codecs: idt821034: fix wrong log in idt821034_chip_direction_output() Change `dir in` to `dir out` Suggested-by: Jun Zhan Signed-off-by: Cryolitia PukNgae Acked-by: Herve Codina Message-ID: <20250822-idt821034-v1-1-e2bfffbde56f@uniontech.com> Signed-off-by: Mark Brown commit b833b412a522e58b790abe79b6ec46e8ba1f312a Author: Kuninori Morimoto Date: Tue Aug 19 01:59:01 2025 +0000 ASoC: soc-core: tidyup snd_soc_lookup_component_nolocked() snd_soc_lookup_component_nolocked() is very complex today. Let's tidyup the code. Signed-off-by: Kuninori Morimoto Message-ID: <87cy8sysuy.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit 168873ca1799d3f23442b9e79eae55f907b9b126 Author: Kuninori Morimoto Date: Tue Aug 19 01:58:51 2025 +0000 ASoC: soc-core: care NULL dirver name on snd_soc_lookup_component_nolocked() soc-generic-dmaengine-pcm.c uses same dev for both CPU and Platform. In such case, CPU component driver might not have driver->name, then snd_soc_lookup_component_nolocked() will be NULL pointer access error. Care NULL driver name. Call trace: strcmp from snd_soc_lookup_component_nolocked+0x64/0xa4 snd_soc_lookup_component_nolocked from snd_soc_unregister_component_by_driver+0x2c/0x44 snd_soc_unregister_component_by_driver from snd_dmaengine_pcm_unregister+0x28/0x64 snd_dmaengine_pcm_unregister from devres_release_all+0x98/0xfc devres_release_all from device_unbind_cleanup+0xc/0x60 device_unbind_cleanup from really_probe+0x220/0x2c8 really_probe from __driver_probe_device+0x88/0x1a0 __driver_probe_device from driver_probe_device+0x30/0x110 driver_probe_device from __driver_attach+0x90/0x178 __driver_attach from bus_for_each_dev+0x7c/0xcc bus_for_each_dev from bus_add_driver+0xcc/0x1ec bus_add_driver from driver_register+0x80/0x11c driver_register from do_one_initcall+0x58/0x23c do_one_initcall from kernel_init_freeable+0x198/0x1f4 kernel_init_freeable from kernel_init+0x1c/0x12c kernel_init from ret_from_fork+0x14/0x28 Fixes: 144d6dfc7482 ("ASoC: soc-core: merge snd_soc_unregister_component() and snd_soc_unregister_component_by_driver()") Reported-by: J. Neuschäfer Closes: https://lore.kernel.org/r/aJb311bMDc9x-dpW@probook Signed-off-by: Kuninori Morimoto Reported-by: Ondřej Jirman Closes: https://lore.kernel.org/r/arxpwzu6nzgjxvsndct65ww2wz4aezb5gjdzlgr24gfx7xvyih@natjg6dg2pj6 Tested-by: J. Neuschäfer Message-ID: <87ect8ysv8.wl-kuninori.morimoto.gx@renesas.com> Signed-off-by: Mark Brown commit 1b237f190eb3d36f52dffe07a40b5eb210280e00 Author: Linus Torvalds Date: Sun Aug 24 12:04:12 2025 -0400 Linux 6.17-rc3 commit c330cb607721bae34c404604e2867be53e6c6949 Merge: 69fd6b99b8f85e 3dd22078026c7c Author: Linus Torvalds Date: Sun Aug 24 10:32:04 2025 -0400 Merge tag 'i2c-for-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c fixes from Wolfram Sang: - hisi: update maintainership - fix several issues in rtl9300 xfer: - check message length boundaries - correct multi-byte value composition on write - increase polling timeout - fix block transfer protocol * tag 'i2c-for-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: rtl9300: Add missing count byte for SMBus Block Ops i2c: rtl9300: Increase timeout for transfer polling i2c: rtl9300: Fix multi-byte I2C write i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer MAINTAINERS: i2c: Update i2c_hisi entry commit 69fd6b99b8f85eaa5d784e4840e982ca59c04250 Merge: 0f74d9cf52f5f4 b64fdd422a8502 Author: Linus Torvalds Date: Sun Aug 24 10:13:05 2025 -0400 Merge tag 'perf_urgent_for_v6.17_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf fix from Borislav Petkov: - Fix a case where the events throttling logic operates on inactive events * tag 'perf_urgent_for_v6.17_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Avoid undefined behavior from stopping/starting inactive events commit 0f74d9cf52f5f4437c92dd94a3b2ef007450d419 Merge: a69dfb4e0acb22 d4932a1b148bb6 Author: Linus Torvalds Date: Sun Aug 24 09:52:28 2025 -0400 Merge tag 'x86_urgent_for_v6.17_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Fix the GDS mitigation detection on some machines after the recent attack vectors conversion - Filter out the invalid machine reset reason value -1 when running as a guest as in such cases the reason why the machine was rebooted does not make a whole lot of sense - Init the resource control machinery on Hygon hw in order to avoid a division by zero and to actually enable the feature on hw which supports it * tag 'x86_urgent_for_v6.17_rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/bugs: Fix GDS mitigation selecting when mitigation is off x86/CPU/AMD: Ignore invalid reset reason value x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper commit a69dfb4e0acb22fb6347656626520157948b3aa8 Merge: 14f84cd318bed3 8c431ea8f3f795 Author: Linus Torvalds Date: Sun Aug 24 09:47:03 2025 -0400 Merge tag 'mips-fixes_6.17_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS fixes from Thomas Bogendoerfer: "Fix ethernet on Lantiq boards" * tag 'mips-fixes_6.17_1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: mips: lantiq: xway: sysctrl: rename the etop node mips: dts: lantiq: danube: add missing burst length property commit 14f84cd318bed3fc64c6e4ee6b251f9b6a8e2a05 Merge: 8d245acc1e884e 5eb4b9a4cdbb70 Author: Linus Torvalds Date: Sun Aug 24 09:43:50 2025 -0400 Merge tag 'modules-6.17-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull modules fix from Daniel Gomez: "This includes a fix part of the KSPP (Kernel Self Protection Project) to replace the deprecated and unsafe strcpy() calls in the kernel parameter string handler and sysfs parameters for built-in modules. Single commit, no functional changes" * tag 'modules-6.17-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: params: Replace deprecated strcpy() with strscpy() and memcpy() commit 35c23871be0072738ccc7ca00354c791711e5640 Author: Lorenzo Pieralisi Date: Thu Aug 14 11:41:38 2025 +0200 irqchip/gic-v5: Remove undue WARN_ON()s in the IRS affinity parsing In gicv5_irs_of_init_affinity() a WARN_ON() is triggered if: 1) a phandle in the "cpus" property does not correspond to a valid OF node 2 a CPU logical id does not exist for a given OF cpu_node #1 is a firmware bug and should be reported as such but does not warrant a WARN_ON() backtrace. #2 is not necessarily an error condition (eg a kernel can be booted with nr_cpus=X limiting the number of cores artificially) and therefore there is no reason to clutter the kernel log with WARN_ON() output when the condition is hit. Rework the IRS affinity parsing code to remove undue WARN_ON()s thus making it less noisy. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250814094138.1611017-1-lpieralisi@kernel.org commit 4138adfd3594ebe957c6cb640372c93e354aa171 Author: Kaison Deng Date: Thu Aug 14 12:32:30 2025 +0800 arm64: dts: rockchip: fix es8388 address on rk3588s-roc-pc Use the correct es8388 address for rk3588s-roc-ps Signed-off-by: Kaison Deng Link: https://lore.kernel.org/r/20250814043230.2774813-1-dkx@t-chip.com.cn Signed-off-by: Heiko Stuebner commit c9f986a54d4031a9b9dff1eb616b0796aa28c730 Author: Krzysztof Kozlowski Date: Mon Aug 18 11:04:47 2025 +0200 arm64: dts: rockchip: Fix Bluetooth interrupts flag on Neardi LBA3368 GPIO_ACTIVE_x flags are not correct in the context of interrupt flags. These are simple defines so they could be used in DTS but they will not have the same meaning: GPIO_ACTIVE_HIGH = 0 = IRQ_TYPE_NONE. Correct the interrupt flags, assuming the author of the code wanted same logical behavior behind the name "ACTIVE_xxx", this is: ACTIVE_HIGH => IRQ_TYPE_LEVEL_HIGH Fixes: 7b4a8097e58b ("arm64: dts: rockchip: Add Neardi LBA3368 board") Cc: stable+noautosel@kernel.org # Needs testing, because actual level is just a guess Signed-off-by: Krzysztof Kozlowski Tested-By: Alex Bee Link: https://lore.kernel.org/r/20250818090445.28112-4-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit 09cce878427962a5c2a3a37d6cc52485a0134ac1 Author: Sebastian Reichel Date: Mon Aug 18 19:12:23 2025 +0200 arm64: dts: rockchip: correct network description on Sige5 Both network PHYs have dedicated crystals for the 25 MHz clock and do not source it from the RK3576. Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250818-sige5-network-phy-clock-v1-1-87a9122d41c2@kernel.org Signed-off-by: Heiko Stuebner commit 1a2cce5b91eeeac24104cbccd8cd3a4dfbdbaa7a Author: Lorenzo Pieralisi Date: Mon Aug 11 15:50:01 2025 +0200 irqchip/gic-v5: Fix kmemleak L2 IST table entries false positives L2 IST table entries are allocated with the kmalloc interface and their physical addresses are programmed in the GIC (either IST base address register or L1 IST table entries) but their virtual addresses are not stored in any kernel data structure because they are not needed at runtime - the L2 IST table entries are managed through system instructions but never dereferenced directly by the driver. This triggers kmemleak false positive reports: unreferenced object 0xffff00080039a000 (size 4096): comm "swapper/0", pid 0, jiffies 4294892296 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 0): kmemleak_alloc+0x34/0x40 __kmalloc_noprof+0x320/0x464 gicv5_irs_iste_alloc+0x1a4/0x484 gicv5_irq_lpi_domain_alloc+0xe4/0x194 irq_domain_alloc_irqs_parent+0x78/0xd8 gicv5_irq_ipi_domain_alloc+0x180/0x238 irq_domain_alloc_irqs_locked+0x238/0x7d4 __irq_domain_alloc_irqs+0x88/0x114 gicv5_of_init+0x284/0x37c of_irq_init+0x3b8/0xb18 irqchip_init+0x18/0x40 init_IRQ+0x104/0x164 start_kernel+0x1a4/0x3d4 __primary_switched+0x8c/0x94 Instruct kmemleak to ignore L2 IST table memory allocation virtual addresses to prevent these false positive reports. Reported-by: Jinjie Ruan Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Reviewed-by: Jinjie Ruan Reviewed-by: Zenghui Yu Acked-by: Marc Zyngier Link: https://lore.kernel.org/all/20250811135001.1333684-1-lpieralisi@kernel.org Closes: https://lore.kernel.org/lkml/cc611dda-d1e4-4793-9bb2-0eaa47277584@huawei.com/ commit c8bb0f00a4886b24d933ffaabcdc09bf9a370dca Author: Dan Carpenter Date: Tue Aug 19 12:40:02 2025 +0300 irqchip/mvebu-gicp: Fix an IS_ERR() vs NULL check in probe() ioremap() never returns error pointers, it returns NULL on error. Fix the check to match. Fixes: 3c3d7dbab2c7 ("irqchip/mvebu-gicp: Clear pending interrupts on init") Signed-off-by: Dan Carpenter Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aKRGcgMeaXm2TMIC@stanley.mountain commit 521b36e5a243d94e843c0f03285fc49ee88c37b6 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:16:09 2025 +0200 arm64: dts: rockchip: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' or '{' characters. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250819131607.86338-4-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit 106bdca970c1f66e2d4ee53675df1575b01c65ce Author: Krzysztof Kozlowski Date: Tue Aug 19 15:16:08 2025 +0200 ARM: dts: rockchip: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' character. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250819131607.86338-3-krzysztof.kozlowski@linaro.org Signed-off-by: Heiko Stuebner commit 2dea24df234940b27d378f786933dc10f33de6b8 Author: Chen-Yu Tsai Date: Thu Aug 21 13:29:39 2025 +0800 arm64: dts: rockchip: Add supplies for eMMC on rk3588-orangepi-5 The eMMC description is missing both vmmc and vqmmc supplies. Add them to complete the description. Fixes: 236d225e1ee7 ("arm64: dts: rockchip: Add board device tree for rk3588-orangepi-5-plus") Fixes: ea63f4666e48 ("arm64: dts: rockchip: refactor common rk3588-orangepi-5.dtsi") Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250821052939.1869171-1-wens@kernel.org Signed-off-by: Heiko Stuebner commit 8976583832579fe7e450034d6143d74d9f8c8608 Author: Maud Spierings Date: Sat Aug 23 14:43:50 2025 +0200 arm64: dts: rockchip: Fix the headphone detection on the orangepi 5 plus The logic of the headphone detect pin seems to be inverted, with this change headphones actually output sound when plugged in. Verified by checking /sys/kernel/debug/gpio and by listening. Fixes: 236d225e1ee7 ("arm64: dts: rockchip: Add board device tree for rk3588-orangepi-5-plus") Signed-off-by: Maud Spierings Reviewed-by: Ondřej Jirman Link: https://lore.kernel.org/r/20250823-orangepi5-v1-1-ae77dd0e06d7@hotmail.com Signed-off-by: Heiko Stuebner commit c2bac68067bba5edda09112c09f2f670792dcdc8 Author: Edgar Bonet Date: Thu Aug 14 14:59:42 2025 +0200 irqchip/atmel-aic[5]: Fix incorrect lock guard conversion Commit b00bee8afaca ("irqchip: Convert generic irqchip locking to guards") replaced calls to irq_gc_lock_irq{save,restore}() with guard(raw_spinlock_irq). However, in irq-atmel-aic5.c and irq-atmel-aic.c, the xlate callback is used in the early boot process, before interrupts are initially enabled. As its destructor enables interrupts, this triggers the warning in start_kernel(): WARNING: CPU: 0 PID: 0 at init/main.c:1024 start_kernel+0x4d0/0x5dc Interrupts were enabled early Fix this by using guard(raw_spinlock_irqsave) instead. [ tglx: Folded the equivivalent fix for atmel-aic ] Fixes: b00bee8afaca ("irqchip: Convert generic irqchip locking to guards") Signed-off-by: Edgar Bonet Signed-off-by: Thomas Gleixner Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/280dd506-e1fc-4d2e-bdc4-98dd9dca6138@grenoble.cnrs.fr commit 8d245acc1e884e89f0808f64d6af3fc91d4903a0 Merge: 8004d08330e1aa fe85261d7d554f Author: Linus Torvalds Date: Sat Aug 23 11:27:31 2025 -0400 Merge tag 'char-misc-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc/iio fixes from Greg KH: "Here are a small number of char/misc/iio and other driver fixes for 6.17-rc3. Included in here are: - IIO driver bugfixes for reported issues - bunch of comedi driver fixes - most core bugfix - fpga driver bugfix - cdx driver bugfix All of these have been in linux-next this week with no reported issues" * tag 'char-misc-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: most: core: Drop device reference after usage in get_channel() comedi: Make insn_rw_emulate_bits() do insn->n samples comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() comedi: pcl726: Prevent invalid irq number cdx: Fix off-by-one error in cdx_rpmsg_probe() fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() iio: light: as73211: Ensure buffer holes are zeroed iio: adc: rzg2l_adc: Set driver data before enabling runtime PM iio: adc: rzg2l: Cleanup suspend/resume path iio: adc: ad7380: fix missing max_conversion_rate_hz on adaq4381-4 iio: adc: bd79124: Add GPIOLIB dependency iio: imu: inv_icm42600: change invalid data error to -EBUSY iio: adc: ad7124: fix channel lookup in syscalib functions iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() iio: adc: ad7173: prevent scan if too many setups requested iio: proximity: isl29501: fix buffered read on big-endian systems iio: accel: sca3300: fix uninitialized iio scan data commit 8004d08330e1aa7ae797778509e864f7ac3da687 Merge: e1d8f9ccb24ecd ff9a09b3e09c7b Author: Linus Torvalds Date: Sat Aug 23 11:21:56 2025 -0400 Merge tag 'usb-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB fixes from Greg KH: "Here are some small USB driver fixes for 6.17-rc3 to resolve a bunch of reported issues. Included in here are: - typec driver fixes - dwc3 new device id - dwc3 driver fixes - new usb-storage driver quirks - xhci driver fixes - other tiny USB driver fixes to resolve bugs All of these have been in linux-next this week with no reported issues" * tag 'usb-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: usb: xhci: fix host not responding after suspend and resume usb: xhci: Fix slot_id resource race conflict usb: typec: fusb302: Revert incorrect threaded irq fix USB: core: Update kerneldoc for usb_hcd_giveback_urb() usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean usb: typec: maxim_contaminant: disable low power mode when reading comparator values usb: dwc3: Remove WARN_ON for device endpoint command timeouts USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles usb: storage: realtek_cr: Use correct byte order for bcs->Residue usb: chipidea: imx: improve usbmisc_imx7d_pullup() kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() usb: dwc3: pci: add support for the Intel Wildcat Lake usb: dwc3: Ignore late xferNotReady event to prevent halt timeout USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test usb: renesas-xhci: Fix External ROM access timeouts usb: gadget: tegra-xudc: fix PM use count underflow usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive commit e1d8f9ccb24ecd969fb1062886b20200acc60009 Merge: 52025b8fc99297 bfb336cf97df7b Author: Linus Torvalds Date: Sat Aug 23 10:11:34 2025 -0400 Merge tag 'trace-v6.17-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix rtla and latency tooling pkg-config errors If libtraceevent and libtracefs is installed, but their corresponding '.pc' files are not installed, it reports that the libraries are missing and confuses the developer. Instead, report that the pkg-config files are missing and should be installed. - Fix overflow bug of the parser in trace_get_user() trace_get_user() uses the parsing functions to parse the user space strings. If the parser fails due to incorrect processing, it doesn't terminate the buffer with a nul byte. Add a "failed" flag to the parser that gets set when parsing fails and is used to know if the buffer is fine to use or not. - Remove a semicolon that was at an end of a comment line - Fix register_ftrace_graph() to unregister the pm notifier on error The register_ftrace_graph() registers a pm notifier but there's an error path that can exit the function without unregistering it. Since the function returns an error, it will never be unregistered. - Allocate and copy ftrace hash for reader of ftrace filter files When the set_ftrace_filter or set_ftrace_notrace files are open for read, an iterator is created and sets its hash pointer to the associated hash that represents filtering or notrace filtering to it. The issue is that the hash it points to can change while the iteration is happening. All the locking used to access the tracer's hashes are released which means those hashes can change or even be freed. Using the hash pointed to by the iterator can cause UAF bugs or similar. Have the read of these files allocate and copy the corresponding hashes and use that as that will keep them the same while the iterator is open. This also simplifies the code as opening it for write already does an allocate and copy, and now that the read is doing the same, there's no need to check which way it was opened on the release of the file, and the iterator hash can always be freed. - Fix function graph to copy args into temp storage The output of the function graph tracer shows both the entry and the exit of a function. When the exit is right after the entry, it combines the two events into one with the output of "function();", instead of showing: function() { } In order to do this, the iterator descriptor that reads the events includes storage that saves the entry event while it peaks at the next event in the ring buffer. The peek can free the entry event so the iterator must store the information to use it after the peek. With the addition of function graph tracer recording the args, where the args are a dynamic array in the entry event, the temp storage does not save them. This causes the args to be corrupted or even cause a read of unsafe memory. Add space to save the args in the temp storage of the iterator. - Fix race between ftrace_dump and reading trace_pipe ftrace_dump() is used when a crash occurs where the ftrace buffer will be printed to the console. But it can also be triggered by sysrq-z. If a sysrq-z is triggered while a task is reading trace_pipe it can cause a race in the ftrace_dump() where it checks if the buffer has content, then it checks if the next event is available, and then prints the output (regardless if the next event was available or not). Reading trace_pipe at the same time can cause it to not be available, and this triggers a WARN_ON in the print. Move the printing into the check if the next event exists or not * tag 'trace-v6.17-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace: Also allocate and copy hash for reading of filter files ftrace: Fix potential warning in trace_printk_seq during ftrace_dump fgraph: Copy args in intermediate storage with entry trace/fgraph: Fix the warning caused by missing unregister notifier ring-buffer: Remove redundant semicolons tracing: Limit access to parser->buffer when trace_get_user failed rtla: Check pkg-config install tools/latency-collector: Check pkg-config install commit 52025b8fc992972168128be40bffee7eafa532b5 Merge: 6debb69041724b 3a68841d1d9b6e Author: Linus Torvalds Date: Sat Aug 23 09:04:32 2025 -0400 Merge tag 'driver-core-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core fixes from Danilo Krummrich: - Fix swapped handling of lru_gen and lru_gen_full debugfs files in vmscan - Fix debugfs mount options (uid, gid, mode) being silently ignored - Fix leak of devres action in the unwind path of Devres::new() - Documentation: - Expand and fix documentation of (outdated) Device, DeviceContext and generic driver infrastructure - Fix C header link of faux device abstractions - Clarify expected interaction with the security team - Smooth text flow in the security bug reporting process documentation * tag 'driver-core-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: Documentation: smooth the text flow in the security bug reporting process Documentation: clarify the expected collaboration with security bugs reporters debugfs: fix mount options not being applied rust: devres: fix leaking call to devm_add_action() rust: faux: fix C header link driver: rust: expand documentation for driver infrastructure device: rust: expand documentation for Device device: rust: expand documentation for DeviceContext mm/vmscan: fix inverted polarity in lru_gen_seq_show() commit 3dd22078026c7cad4d4a3f32c5dc5452c7180de8 Merge: c17b750b3ad9f4 82b350dd8185ce Author: Wolfram Sang Date: Sat Aug 23 07:57:28 2025 +0200 Merge tag 'i2c-host-fixes-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-current i2c-host-fixes for v6.17-rc3 - hisi: update maintainership - rtl9300: fix several issues in xfer - check message length boundaries - correct multi-byte value composition on write - increase polling timeout - fix block transfer protocol commit ec79003c5f9d2c7f9576fc69b8dbda80305cbe3a Author: Kuniyuki Iwashima Date: Thu Aug 21 02:18:24 2025 +0000 atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). syzbot reported the splat below. [0] When atmtcp_v_open() or atmtcp_v_close() is called via connect() or close(), atmtcp_send_control() is called to send an in-kernel special message. The message has ATMTCP_HDR_MAGIC in atmtcp_control.hdr.length. Also, a pointer of struct atm_vcc is set to atmtcp_control.vcc. The notable thing is struct atmtcp_control is uAPI but has a space for an in-kernel pointer. struct atmtcp_control { struct atmtcp_hdr hdr; /* must be first */ ... atm_kptr_t vcc; /* both directions */ ... } __ATM_API_ALIGN; typedef struct { unsigned char _[8]; } __ATM_API_ALIGN atm_kptr_t; The special message is processed in atmtcp_recv_control() called from atmtcp_c_send(). atmtcp_c_send() is vcc->dev->ops->send() and called from 2 paths: 1. .ndo_start_xmit() (vcc->send() == atm_send_aal0()) 2. vcc_sendmsg() The problem is sendmsg() does not validate the message length and userspace can abuse atmtcp_recv_control() to overwrite any kptr by atmtcp_control. Let's add a new ->pre_send() hook to validate messages from sendmsg(). [0]: Oops: general protection fault, probably for non-canonical address 0xdffffc00200000ab: 0000 [#1] SMP KASAN PTI KASAN: probably user-memory-access in range [0x0000000100000558-0x000000010000055f] CPU: 0 UID: 0 PID: 5865 Comm: syz-executor331 Not tainted 6.17.0-rc1-syzkaller-00215-gbab3ce404553 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:atmtcp_recv_control drivers/atm/atmtcp.c:93 [inline] RIP: 0010:atmtcp_c_send+0x1da/0x950 drivers/atm/atmtcp.c:297 Code: 4d 8d 75 1a 4c 89 f0 48 c1 e8 03 42 0f b6 04 20 84 c0 0f 85 15 06 00 00 41 0f b7 1e 4d 8d b7 60 05 00 00 4c 89 f0 48 c1 e8 03 <42> 0f b6 04 20 84 c0 0f 85 13 06 00 00 66 41 89 1e 4d 8d 75 1c 4c RSP: 0018:ffffc90003f5f810 EFLAGS: 00010203 RAX: 00000000200000ab RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff88802a510000 RSI: 00000000ffffffff RDI: ffff888030a6068c RBP: ffff88802699fb40 R08: ffff888030a606eb R09: 1ffff1100614c0dd R10: dffffc0000000000 R11: ffffffff8718fc40 R12: dffffc0000000000 R13: ffff888030a60680 R14: 000000010000055f R15: 00000000ffffffff FS: 00007f8d7e9236c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000045ad50 CR3: 0000000075bde000 CR4: 00000000003526f0 Call Trace: vcc_sendmsg+0xa10/0xc60 net/atm/common.c:645 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8d7e96a4a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8d7e923198 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f8d7e9f4308 RCX: 00007f8d7e96a4a9 RDX: 0000000000000000 RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8d7e9f4300 R08: 65732f636f72702f R09: 65732f636f72702f R10: 65732f636f72702f R11: 0000000000000246 R12: 00007f8d7e9c10ac R13: 00007f8d7e9231a0 R14: 0000200000000200 R15: 0000200000000250 Modules linked in: Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+1741b56d54536f4ec349@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68a6767c.050a0220.3d78fd.0011.GAE@google.com/ Tested-by: syzbot+1741b56d54536f4ec349@syzkaller.appspotmail.com Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250821021901.2814721-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit bfb336cf97df7b37b2b2edec0f69773e06d11955 Author: Steven Rostedt Date: Fri Aug 22 18:36:06 2025 -0400 ftrace: Also allocate and copy hash for reading of filter files Currently the reader of set_ftrace_filter and set_ftrace_notrace just adds the pointer to the global tracer hash to its iterator. Unlike the writer that allocates a copy of the hash, the reader keeps the pointer to the filter hashes. This is problematic because this pointer is static across function calls that release the locks that can update the global tracer hashes. This can cause UAF and similar bugs. Allocate and copy the hash for reading the filter files like it is done for the writers. This not only fixes UAF bugs, but also makes the code a bit simpler as it doesn't have to differentiate when to free the iterator's hash between writers and readers. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nathan Chancellor Cc: Linus Torvalds Link: https://lore.kernel.org/20250822183606.12962cc3@batman.local.home Fixes: c20489dad156 ("ftrace: Assign iter->hash to filter or notrace hashes on seq read") Closes: https://lore.kernel.org/all/20250813023044.2121943-1-wutengda@huaweicloud.com/ Closes: https://lore.kernel.org/all/20250822192437.GA458494@ax162/ Reported-by: Tengda Wu Tested-by: Tengda Wu Tested-by: Nathan Chancellor Signed-off-by: Steven Rostedt (Google) commit e2fe0c54fb7401e6ecd3c10348519ab9e23bd639 Author: James Jones Date: Mon Aug 11 15:00:16 2025 -0700 drm/nouveau/disp: Always accept linear modifier On some chipsets, which block-linear modifiers are supported is format-specific. However, linear modifiers are always be supported. The prior modifier filtering logic was not accounting for the linear case. Cc: stable@vger.kernel.org Fixes: c586f30bf74c ("drm/nouveau/kms: Add format mod prop to base/ovly/nvdisp") Signed-off-by: James Jones Link: https://lore.kernel.org/r/20250811220017.1337-3-jajones@nvidia.com Signed-off-by: Danilo Krummrich commit 1559c9c231105e272db7033a406d7c457d45f8f0 Merge: c61ac2ec102bb6 6bbd0d3f0c23fc Author: Jakub Kicinski Date: Fri Aug 22 16:09:12 2025 -0700 Merge tag 'for-net-2025-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: * tag 'for-net-2025-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_sync: fix set_local_name race condition Bluetooth: hci_event: Disconnect device when BIG sync is lost Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced Bluetooth: hci_event: Mark connection as closed during suspend disconnect Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success Bluetooth: hci_conn: Make unacked packet handling more robust ==================== Link: https://patch.msgid.link/20250822180230.345979-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit c61ac2ec102bb659e7d2e7c0f3553f9356341682 Merge: a64494aafc5693 6c4e6848023827 Author: Jakub Kicinski Date: Fri Aug 22 15:59:52 2025 -0700 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== idpf: replace Tx flow scheduling buffer ring with buffer pool Joshua Hay says: This series fixes a stability issue in the flow scheduling Tx send/clean path that results in a Tx timeout. The existing guardrails in the Tx path were not sufficient to prevent the driver from reusing completion tags that were still in flight (held by the HW). This collision would cause the driver to erroneously clean the wrong packet thus leaving the descriptor ring in a bad state. The main point of this fix is to replace the flow scheduling buffer ring with a large pool/array of buffers. The completion tag then simply is the index into this array. The driver tracks the free tags and pulls the next free one from a refillq. The cleaning routines simply use the completion tag from the completion descriptor to index into the array to quickly find the buffers to clean. All of the code to support this is added first to ensure traffic still passes with each patch. The final patch then removes all of the obsolete stashing code. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: idpf: remove obsolete stashing code idpf: stop Tx if there are insufficient buffer resources idpf: replace flow scheduling buffer ring with buffer pool idpf: simplify and fix splitq Tx packet rollback error path idpf: improve when to set RE bit logic idpf: add support for Tx refillqs in flow scheduling mode ==================== Link: https://patch.msgid.link/20250821180100.401955-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit a64494aafc56939564e3e9e57f99df5c27204e04 Author: Hariprasad Kelam Date: Thu Aug 21 11:55:28 2025 +0530 Octeontx2-vf: Fix max packet length errors Once driver submits the packets to the hardware, each packet traverse through multiple transmit levels in the following order: SMQ -> TL4 -> TL3 -> TL2 -> TL1 The SMQ supports configurable minimum and maximum packet sizes. It enters to a hang state, if driver submits packets with out of bound lengths. To avoid the same, implement packet length validation before submitting packets to the hardware. Increment tx_dropped counter on failure. Fixes: 3184fb5ba96e ("octeontx2-vf: Virtual function driver support") Fixes: 22f858796758 ("octeontx2-pf: Add basic net_device_ops") Fixes: 3ca6c4c882a7 ("octeontx2-pf: Add packet transmission support") Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20250821062528.1697992-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit abadf0ff63be488dc502ecfc9f622929a21b7117 Author: Mina Almasry Date: Thu Aug 21 03:03:46 2025 +0000 page_pool: fix incorrect mp_ops error handling Minor fix to the memory provider error handling, we should be jumping to free_ptr_ring in this error case rather than returning directly. Found by code-inspection. Cc: skhawaja@google.com Fixes: b400f4b87430 ("page_pool: Set `dma_sync` to false for devmem memory provider") Signed-off-by: Mina Almasry Reviewed-by: Samiullah Khawaja Link: https://patch.msgid.link/20250821030349.705244-1-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 6debb69041724bae8a8a4d0ac60502754c1cd945 Merge: 471b25a2fcbb25 a60f5ee68efd91 Author: Linus Torvalds Date: Fri Aug 22 18:16:54 2025 -0400 Merge tag 'drm-fixes-2025-08-23-1' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Weekly drm fixes. Looks like things did indeed get busier after rc2, nothing seems too major, but stuff scattered all over the place, amdgpu, xe, i915, hibmc, rust support code, and other small fixes. rust: - drm device memory layout and safety fixes tests: - Endianness fixes gpuvm: - docs warning fix panic: - fix division on 32-bit arm i915: - TypeC DP display Fixes - Silence rpm wakeref asserts on GEN11_GU_MISC_IIR access - Relocate compression repacking WA for JSL/EHL xe: - xe_vm_create fixes - fix vm bind ioctl double free amdgpu: - Replay fixes - SMU14 fix - Null check DC fixes - DCE6 DC fixes - Misc DC fixes bridge: - analogix_dp: devm_drm_bridge_alloc() error handling fix habanalabs: - Memory deallocation fix hibmc: - modesetting black screen fixes - fix UAF on irq - fix leak on i2c failure path nouveau: - memory leak fixes - typos rockchip: - Kconfig fix - register caching fix" * tag 'drm-fixes-2025-08-23-1' of https://gitlab.freedesktop.org/drm/kernel: (49 commits) drm/xe: Fix vm_bind_ioctl double free bug drm/xe: Move ASID allocation and user PT BO tracking into xe_vm_create drm/xe: Assign ioctl xe file handler to vm in xe_vm_create drm/i915/gt: Relocate compression repacking WA for JSL/EHL drm/i915: silence rpm wakeref asserts on GEN11_GU_MISC_IIR access drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 drm/amd/display: Don't print errors for nonexistent connectors drm/amd/display: Don't warn when missing DCE encoder caps drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15% drm/amd/display: Don't overclock DCE 6 by 15% drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() drm/amd/display: Fix Xorg desktop unresponsive on Replay panel drm/amd/display: Avoid a NULL pointer dereference drm/amdgpu/swm14: Update power limit logic drm/amd/display: Revert Add HPO encoder support to Replay drm/i915/icl+/tc: Convert AUX powered WARN to a debug message drm/i915/lnl+/tc: Use the cached max lane count value ... commit 4013aef2ced9b756a410f50d12df9ebe6a883e4a Author: Tengda Wu Date: Fri Aug 22 03:33:43 2025 +0000 ftrace: Fix potential warning in trace_printk_seq during ftrace_dump When calling ftrace_dump_one() concurrently with reading trace_pipe, a WARN_ON_ONCE() in trace_printk_seq() can be triggered due to a race condition. The issue occurs because: CPU0 (ftrace_dump) CPU1 (reader) echo z > /proc/sysrq-trigger !trace_empty(&iter) trace_iterator_reset(&iter) <- len = size = 0 cat /sys/kernel/tracing/trace_pipe trace_find_next_entry_inc(&iter) __find_next_entry ring_buffer_empty_cpu <- all empty return NULL trace_printk_seq(&iter.seq) WARN_ON_ONCE(s->seq.len >= s->seq.size) In the context between trace_empty() and trace_find_next_entry_inc() during ftrace_dump, the ring buffer data was consumed by other readers. This caused trace_find_next_entry_inc to return NULL, failing to populate `iter.seq`. At this point, due to the prior trace_iterator_reset, both `iter.seq.len` and `iter.seq.size` were set to 0. Since they are equal, the WARN_ON_ONCE condition is triggered. Move the trace_printk_seq() into the if block that checks to make sure the return value of trace_find_next_entry_inc() is non-NULL in ftrace_dump_one(), ensuring the 'iter.seq' is properly populated before subsequent operations. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Ingo Molnar Link: https://lore.kernel.org/20250822033343.3000289-1-wutengda@huaweicloud.com Fixes: d769041f8653 ("ring_buffer: implement new locking") Signed-off-by: Tengda Wu Signed-off-by: Steven Rostedt (Google) commit e3d01979e4bff5c87eb4054a22e7568bb679b1fe Author: Steven Rostedt Date: Wed Aug 20 19:55:22 2025 -0400 fgraph: Copy args in intermediate storage with entry The output of the function graph tracer has two ways to display its entries. One way for leaf functions with no events recorded within them, and the other is for functions with events recorded inside it. As function graph has an entry and exit event, to simplify the output of leaf functions it combines the two, where as non leaf functions are separate: 2) | invoke_rcu_core() { 2) | raise_softirq() { 2) 0.391 us | __raise_softirq_irqoff(); 2) 1.191 us | } 2) 2.086 us | } The __raise_softirq_irqoff() function above is really two events that were merged into one. Otherwise it would have looked like: 2) | invoke_rcu_core() { 2) | raise_softirq() { 2) | __raise_softirq_irqoff() { 2) 0.391 us | } 2) 1.191 us | } 2) 2.086 us | } In order to do this merge, the reading of the trace output file needs to look at the next event before printing. But since the pointer to the event is on the ring buffer, it needs to save the entry event before it looks at the next event as the next event goes out of focus as soon as a new event is read from the ring buffer. After it reads the next event, it will print the entry event with either the '{' (non leaf) or ';' and timestamps (leaf). The iterator used to read the trace file has storage for this event. The problem happens when the function graph tracer has arguments attached to the entry event as the entry now has a variable length "args" field. This field only gets set when funcargs option is used. But the args are not recorded in this temp data and garbage could be printed. The entry field is copied via: data->ent = *curr; Where "curr" is the entry field. But this method only saves the non variable length fields from the structure. Add a helper structure to the iterator data that adds the max args size to the data storage in the iterator. Then simply copy the entire entry into this storage (with size protection). Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Mark Rutland Link: https://lore.kernel.org/20250820195522.51d4a268@gandalf.local.home Reported-by: Sasha Levin Tested-by: Sasha Levin Closes: https://lore.kernel.org/all/aJaxRVKverIjF4a6@lappy/ Fixes: ff5c9c576e75 ("ftrace: Add support for function argument to graph tracer") Signed-off-by: Steven Rostedt (Google) commit a60f5ee68efd91b4507eacbb40d4024ecf363304 Merge: f9915c391cf727 111fb43a557726 Author: Dave Airlie Date: Sat Aug 23 07:22:43 2025 +1000 Merge tag 'drm-xe-fixes-2025-08-21-1' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - xe_vm_create fixes (Piotr) - Fix vm_bind_ioctl double free (Christoph) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aKdxiw9hvO6mcyKs@intel.com commit 471b25a2fcbb25dccd7c9bece30313f2440a554e Merge: cf6fc5eefc5bbb 447c6141e8ea68 Author: Linus Torvalds Date: Fri Aug 22 17:24:48 2025 -0400 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd fixes from Jason Gunthorpe: "Two very minor fixes: - Fix mismatched kvalloc()/kfree() - Spelling fixes in documentation" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: iommufd: Fix spelling errors in iommufd.rst iommufd: viommu: free memory allocated by kvcalloc() using kvfree() commit 80af3745ca465c6c47e833c1902004a7fa944f37 Author: Dan Carpenter Date: Fri Aug 22 11:08:46 2025 +0300 of: dynamic: Fix use after free in of_changeset_add_prop_helper() If the of_changeset_add_property() function call fails, then this code frees "new_pp" and then dereference it on the next line. Return the error code directly instead. Fixes: c81f6ce16785 ("of: dynamic: Fix memleak when of_pci_add_properties() failed") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/aKgljjhnpa4lVpdx@stanley.mountain Signed-off-by: Rob Herring (Arm) commit f9915c391cf72789ec5b6d5966ba82c2bca5daa7 Merge: dbb2c3adc4a641 1a2cf179e2973f Author: Dave Airlie Date: Sat Aug 23 06:45:22 2025 +1000 Merge tag 'drm-misc-fixes-2025-08-21' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes A bunch of fixes for 6.17: - analogix_dp: devm_drm_bridge_alloc() error handling fix - gaudi: Memory deallocation fix - gpuvm: Documentation warning fix - hibmc: Various misc fixes - nouveau: Memory leak fixes, typos - panic: u64 division handling on 32 bits architecture fix - rockchip: Kconfig fix, register caching fix - rust: memory layout and safety fixes - tests: Endianness fixes Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250821-economic-dandelion-rooster-c57fa9@houat commit 8c431ea8f3f795c4b9cfa57a85bc4166b9cce0ac Author: Aleksander Jan Bajkowski Date: Sun Aug 17 14:49:07 2025 +0200 mips: lantiq: xway: sysctrl: rename the etop node Bindig requires a node name matching ‘^ethernet@[0-9a-f]+$’. This patch changes the clock name from “etop” to “ethernet”. This fixes the following warning: arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): $nodename:0: 'etop@e180000' does not match '^ethernet@[0-9a-f]+$' from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml# Fixes: dac0bad93741 ("dt-bindings: net: lantiq,etop-xway: Document Lantiq Xway ETOP bindings") Signed-off-by: Aleksander Jan Bajkowski Acked-by: Jakub Kicinski commit 7b28232921782aa38048249132899c337405eaa8 Author: Aleksander Jan Bajkowski Date: Sun Aug 17 14:49:06 2025 +0200 mips: dts: lantiq: danube: add missing burst length property The upstream dts lacks the lantiq,{rx/tx}-burst-length property. Other issues were also fixed: arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'interrupt-names' is a required property from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml# arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'lantiq,tx-burst-length' is a required property from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml# arch/mips/boot/dts/lantiq/danube_easy50712.dtb: etop@e180000 (lantiq,etop-xway): 'lantiq,rx-burst-length' is a required property from schema $id: http://devicetree.org/schemas/net/lantiq,etop-xway.yaml# Fixes: 14d4e308e0aa ("net: lantiq: configure the burst length in ethernet drivers") Signed-off-by: Aleksander Jan Bajkowski Acked-by: Jakub Kicinski commit 6bbd0d3f0c23fc53c17409dd7476f38ae0ff0cd9 Author: Pavel Shpakovskiy Date: Fri Aug 22 12:20:55 2025 +0300 Bluetooth: hci_sync: fix set_local_name race condition Function set_name_sync() uses hdev->dev_name field to send HCI_OP_WRITE_LOCAL_NAME command, but copying from data to hdev->dev_name is called after mgmt cmd was queued, so it is possible that function set_name_sync() will read old name value. This change adds name as a parameter for function hci_update_name_sync() to avoid race condition. Fixes: 6f6ff38a1e14 ("Bluetooth: hci_sync: Convert MGMT_OP_SET_LOCAL_NAME") Signed-off-by: Pavel Shpakovskiy Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 55b9551fcdf6a2fe7f3422918d5697b56794da72 Author: Yang Li Date: Wed Aug 20 10:16:17 2025 +0800 Bluetooth: hci_event: Disconnect device when BIG sync is lost When a BIG sync is lost, the device should be set to "disconnected". This ensures symmetry with the ISO path setup, where the device is marked as "connected" once the path is established. Without this change, the device state remains inconsistent and may lead to a memory leak. Fixes: b2a5f2e1c127 ("Bluetooth: hci_event: Add support for handling LE BIG Sync Lost event") Signed-off-by: Yang Li Signed-off-by: Luiz Augusto von Dentz commit 15bf2c6391bafb14a3020d06ec0761bce0803463 Author: Luiz Augusto von Dentz Date: Wed Aug 20 17:04:00 2025 -0400 Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced This attempts to detect if HCI_EV_NUM_COMP_PKTS contain an unbalanced (more than currently considered outstanding) number of packets otherwise it could cause the hcon->sent to underflow and loop around breaking the tracking of the outstanding packets pending acknowledgment. Fixes: f42809185896 ("Bluetooth: Simplify num_comp_pkts_evt function") Signed-off-by: Luiz Augusto von Dentz commit b7fafbc499b5ee164018eb0eefe9027f5a6aaad2 Author: Ludovico de Nittis Date: Tue Aug 12 17:55:27 2025 +0200 Bluetooth: hci_event: Mark connection as closed during suspend disconnect When suspending, the disconnect command for an active Bluetooth connection could be issued, but the corresponding `HCI_EV_DISCONN_COMPLETE` event might not be received before the system completes the suspend process. This can lead to an inconsistent state. On resume, the controller may auto-accept reconnections from the same device (due to suspend event filters), but these new connections are rejected by the kernel which still has connection objects from before suspend. Resulting in errors like: ``` kernel: Bluetooth: hci0: ACL packet for unknown connection handle 1 kernel: Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection ``` This is a btmon snippet that shows the issue: ``` < HCI Command: Disconnect (0x01|0x0006) plen 3 Handle: 1 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd) Reason: Remote User Terminated Connection (0x13) > HCI Event: Command Status (0x0f) plen 4 Disconnect (0x01|0x0006) ncmd 2 Status: Success (0x00) [...] // Host suspends with the event filter set for the device // On resume, the device tries to reconnect with a new handle > HCI Event: Connect Complete (0x03) plen 11 Status: Success (0x00) Handle: 2 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd) // Kernel ignores this event because there is an existing connection with // handle 1 ``` By explicitly setting the connection state to BT_CLOSED we can ensure a consistent state, even if we don't receive the disconnect complete event in time. Link: https://github.com/bluez/bluez/issues/1226 Fixes: 182ee45da083 ("Bluetooth: hci_sync: Rework hci_suspend_notifier") Signed-off-by: Ludovico de Nittis Signed-off-by: Luiz Augusto von Dentz commit 2f050a5392b7a0928bf836d9891df4851463512c Author: Ludovico de Nittis Date: Tue Aug 12 17:55:26 2025 +0200 Bluetooth: hci_event: Treat UNKNOWN_CONN_ID on disconnect as success When the host sends an HCI_OP_DISCONNECT command, the controller may respond with the status HCI_ERROR_UNKNOWN_CONN_ID (0x02). E.g. this can happen on resume from suspend, if the link was terminated by the remote device before the event mask was correctly set. This is a btmon snippet that shows the issue: ``` > ACL Data RX: Handle 3 flags 0x02 dlen 12 L2CAP: Disconnection Request (0x06) ident 5 len 4 Destination CID: 65 Source CID: 72 < ACL Data TX: Handle 3 flags 0x00 dlen 12 L2CAP: Disconnection Response (0x07) ident 5 len 4 Destination CID: 65 Source CID: 72 > ACL Data RX: Handle 3 flags 0x02 dlen 12 L2CAP: Disconnection Request (0x06) ident 6 len 4 Destination CID: 64 Source CID: 71 < ACL Data TX: Handle 3 flags 0x00 dlen 12 L2CAP: Disconnection Response (0x07) ident 6 len 4 Destination CID: 64 Source CID: 71 < HCI Command: Set Event Mask (0x03|0x0001) plen 8 Mask: 0x3dbff807fffbffff Inquiry Complete Inquiry Result Connection Complete Connection Request Disconnection Complete Authentication Complete [...] < HCI Command: Disconnect (0x01|0x0006) plen 3 Handle: 3 Address: 78:20:A5:4A:DF:28 (Nintendo Co.,Ltd) Reason: Remote User Terminated Connection (0x13) > HCI Event: Command Status (0x0f) plen 4 Disconnect (0x01|0x0006) ncmd 1 Status: Unknown Connection Identifier (0x02) ``` Currently, the hci_cs_disconnect function treats any non-zero status as a command failure. This can be misleading because the connection is indeed being terminated and the controller is confirming that is has no knowledge of that connection handle. Meaning that the initial request of disconnecting a device should be treated as done. With this change we allow the function to proceed, following the success path, which correctly calls `mgmt_device_disconnected` and ensures a consistent state. Link: https://github.com/bluez/bluez/issues/1226 Fixes: 182ee45da083 ("Bluetooth: hci_sync: Rework hci_suspend_notifier") Signed-off-by: Ludovico de Nittis Signed-off-by: Luiz Augusto von Dentz commit 94a4acfec14615e971eb2c9e1fa6c992c85ff6c6 Author: Chen Ridong Date: Fri Aug 22 07:07:15 2025 +0000 cgroup/psi: Set of->priv to NULL upon file release Setting of->priv to NULL when the file is released enables earlier bug detection. This allows potential bugs to manifest as NULL pointer dereferences rather than use-after-free errors[1], which are generally more difficult to diagnose. [1] https://lore.kernel.org/cgroups/38ef3ff9-b380-44f0-9315-8b3714b0948d@huaweicloud.com/T/#m8a3b3f88f0ff3da5925d342e90043394f8b2091b Signed-off-by: Chen Ridong Signed-off-by: Tejun Heo commit 79f919a89c9d06816dbdbbd168fa41d27411a7f9 Author: Chen Ridong Date: Tue Aug 19 01:07:24 2025 +0000 cgroup: split cgroup_destroy_wq into 3 workqueues A hung task can occur during [1] LTP cgroup testing when repeatedly mounting/unmounting perf_event and net_prio controllers with systemd.unified_cgroup_hierarchy=1. The hang manifests in cgroup_lock_and_drain_offline() during root destruction. Related case: cgroup_fj_function_perf_event cgroup_fj_function.sh perf_event cgroup_fj_function_net_prio cgroup_fj_function.sh net_prio Call Trace: cgroup_lock_and_drain_offline+0x14c/0x1e8 cgroup_destroy_root+0x3c/0x2c0 css_free_rwork_fn+0x248/0x338 process_one_work+0x16c/0x3b8 worker_thread+0x22c/0x3b0 kthread+0xec/0x100 ret_from_fork+0x10/0x20 Root Cause: CPU0 CPU1 mount perf_event umount net_prio cgroup1_get_tree cgroup_kill_sb rebind_subsystems // root destruction enqueues // cgroup_destroy_wq // kill all perf_event css // one perf_event css A is dying // css A offline enqueues cgroup_destroy_wq // root destruction will be executed first css_free_rwork_fn cgroup_destroy_root cgroup_lock_and_drain_offline // some perf descendants are dying // cgroup_destroy_wq max_active = 1 // waiting for css A to die Problem scenario: 1. CPU0 mounts perf_event (rebind_subsystems) 2. CPU1 unmounts net_prio (cgroup_kill_sb), queuing root destruction work 3. A dying perf_event CSS gets queued for offline after root destruction 4. Root destruction waits for offline completion, but offline work is blocked behind root destruction in cgroup_destroy_wq (max_active=1) Solution: Split cgroup_destroy_wq into three dedicated workqueues: cgroup_offline_wq – Handles CSS offline operations cgroup_release_wq – Manages resource release cgroup_free_wq – Performs final memory deallocation This separation eliminates blocking in the CSS free path while waiting for offline operations to complete. [1] https://github.com/linux-test-project/ltp/blob/master/runtest/controllers Fixes: 334c3679ec4b ("cgroup: reimplement rebind_subsystems() using cgroup_apply_control() and friends") Reported-by: Gao Yingjie Signed-off-by: Chen Ridong Suggested-by: Teju Heo Signed-off-by: Tejun Heo commit 5d7eba62e5eb68347de59b31b347b24f304cf21c Author: Luiz Augusto von Dentz Date: Fri Aug 22 13:40:18 2025 -0400 Bluetooth: hci_conn: Make unacked packet handling more robust This attempts to make unacked packet handling more robust by detecting if there are no connections left then restore all buffers of the respective pool. Fixes: 5638d9ea9c01 ("Bluetooth: hci_conn: Fix not restoring ISO buffer count on disconnect") Signed-off-by: Luiz Augusto von Dentz commit dc88b77113d75a8fd5818355f8e313bec144ea5d Author: Brady Norander Date: Wed Aug 20 21:47:30 2025 -0400 ALSA: hda: intel-dsp-config: Select SOF driver on MTL Chromebooks The SOF driver is required for functional audio on MTL Chromebooks Signed-off-by: Brady Norander Link: https://patch.msgid.link/20250821014730.8843-1-bradynorander@gmail.com Signed-off-by: Takashi Iwai commit 9c6182843b0d02ca04cc1d946954a65a2286c7db Author: Cryolitia PukNgae Date: Fri Aug 22 20:58:08 2025 +0800 ALSA: usb-audio: Add mute TLV for playback volumes on some devices Applying the quirk of that, the lowest Playback mixer volume setting mutes the audio output, on more devices. Link: https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/2514 Cc: Tested-by: Guoli An Signed-off-by: Cryolitia PukNgae Link: https://patch.msgid.link/20250822-mixer-quirk-v1-1-b19252239c1c@uniontech.com Signed-off-by: Takashi Iwai commit cf6fc5eefc5bbbbff92a085039ff74cdbd065c29 Merge: b3d80535e213ad 3868f910440c47 Author: Linus Torvalds Date: Fri Aug 22 10:16:47 2025 -0400 Merge tag 's390-6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 fixes from Alexander Gordeev: - When kernel lockdown is active userspace tools that rely on read operations only are unnecessarily blocked. Fix that by avoiding ioctl registration during lockdown - Invalid NULL pointer accesses succeed due to the lowcore is always mapped the identity mapping pinned to zero. To fix that never map the first two pages of physical memory with identity mapping - Fix invalid SCCB present check in the SCLP interrupt handler - Update defconfigs * tag 's390-6.17-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/hypfs: Enable limited access during lockdown s390/hypfs: Avoid unnecessary ioctl registration in debugfs s390/mm: Do not map lowcore with identity mapping s390/sclp: Fix SCCB present check s390/configs: Set HZ=1000 s390/configs: Update defconfigs commit b3d80535e213ad6584577b0f20d9d49ccf233206 Merge: 272aa18fea29f3 efdaa61d73a1de Author: Linus Torvalds Date: Fri Aug 22 09:50:17 2025 -0400 Merge tag 'for-linus-6.17-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen fixes from Juergen Gross: "Two small cleanups which are both relevant only when running as a Xen guest" * tag 'for-linus-6.17-rc3-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: drivers/xen/xenbus: remove quirk for Xen 3.x compiler: remove __ADDRESSABLE_ASM{_STR,}() again commit 272aa18fea29f3299960b62e2c24efb049b540ea Merge: a2e94e80790bb1 748f897511446c Author: Linus Torvalds Date: Fri Aug 22 09:35:21 2025 -0400 Merge tag 'platform-drivers-x86-v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform driver fixes from Ilpo Järvinen: - amd/hsmp: - Ensure sock->metric_tbl_addr is non-NULL - Register driver even if hwmon registration fails - amd/pmc: Drop SMU F/W match for Cezanne - dell-smbios-wmi: Separate "priority" from WMI device ID - hp-wmi: mark Victus 16-r1xxx for Victus s fan and thermal profile support - intel-uncore-freq: Check write blocked for efficiency latency control * tag 'platform-drivers-x86-v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: platform/x86: hp-wmi: mark Victus 16-r1xxx for victus_s fan and thermal profile support platform/x86/amd/hsmp: Ensure success even if hwmon registration fails platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL platform/x86/intel-uncore-freq: Check write blocked for ELC platform/x86/amd: pmc: Drop SMU F/W match for Cezanne platform/x86: dell-smbios-wmi: Stop touching WMI device ID commit a2e94e80790bb103ca72f8a2991f43c80474a4b6 Merge: d28de4fc0aaa8d 370ac285f23aec Author: Linus Torvalds Date: Fri Aug 22 09:29:51 2025 -0400 Merge tag 'block-6.17-20250822' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: "A set of fixes for block that should go into this tree. A bit larger than what I usually have at this point in time, a lot of that is the continued fixing of the lockdep annotation for queue freezing that we recently added, which has highlighted a number of little issues here and there. This contains: - MD pull request via Yu: - Add a legacy_async_del_gendisk mode, to prevent a user tools regression. New user tools releases will not use such a mode, the old release with a new kernel now will have warning about deprecated behavior, and we prepare to remove this legacy mode after about a year later - The rename in kernel causing user tools build failure, revert the rename in mdp_superblock_s - Fix a regression that interrupted resync can be shown as recover from mdstat or sysfs - Improve file size detection for loop, particularly for networked file systems, by using getattr to get the size rather than the cached inode size. - Hotplug CPU lock vs queue freeze fix - Lockdep fix while updating the number of hardware queues - Fix stacking for PI devices - Silence bio_check_eod() for the known case of device removal where the size is truncated to 0 sectors" * tag 'block-6.17-20250822' of git://git.kernel.dk/linux: block: avoid cpu_hotplug_lock depedency on freeze_lock block: decrement block_rq_qos static key in rq_qos_del() block: skip q->rq_qos check in rq_qos_done_bio() blk-mq: fix lockdep warning in __blk_mq_update_nr_hw_queues block: tone down bio_check_eod loop: use vfs_getattr_nosec for accurate file size loop: Consolidate size calculation logic into lo_calculate_size() block: remove newlines from the warnings in blk_validate_integrity_limits block: handle pi_tuple_size in queue_limits_stack_integrity selftests: ublk: Use ARRAY_SIZE() macro to improve code md: fix sync_action incorrect display during resync md: add helper rdev_needs_recovery() md: keep recovery_cp in mdp_superblock_s md: add legacy_async_del_gendisk mode commit d28de4fc0aaa8db6c0163e37c6d4d07f062a08db Merge: edeee68c42747c e4e6aaea46b7be Author: Linus Torvalds Date: Fri Aug 22 09:25:59 2025 -0400 Merge tag 'io_uring-6.17-20250822' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: "Just two small fixes - one that fixes inconsistent ->async_data vs REQ_F_ASYNC_DATA handling in futex, and a followup that just ensures that if other opcode handlers mess this up, it won't cause any issues" * tag 'io_uring-6.17-20250822' of git://git.kernel.dk/linux: io_uring: clear ->async_data as part of normal init io_uring/futex: ensure io_futex_wait() cleans up properly on failure commit edeee68c42747c9d9b237f06fbc4cd1a2348fefb Merge: afd58777de7f87 6300d5c5438724 Author: Linus Torvalds Date: Fri Aug 22 09:20:42 2025 -0400 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "All fixes in drivers. The largest diffstat in ufs is caused by the doc update with the next being the qcom null pointer deref fix" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: ufs-qcom: Fix ESI null pointer dereference scsi: ufs: core: Rename ufshcd_wait_for_doorbell_clr() scsi: ufs: core: Fix the return value documentation scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl() scsi: ufs: core: Fix IRQ lock inversion for the SCSI host lock scsi: qla4xxx: Prevent a potential error pointer dereference scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake scsi: fnic: Remove a useless struct mempool forward declaration commit afd58777de7f87c5f6a430c281907f0a66fd08ab Merge: e2d324af56f703 d2d7a96b29ea6a Author: Linus Torvalds Date: Fri Aug 22 09:17:49 2025 -0400 Merge tag 'mmc-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC fixes from Ulf Hansson: "MMC host: - sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 - sdhci-of-arasan: Ensure CD logic stabilization before power-up - sdhci-pci-gli: Mask the replay timer timeout of AER for GL9763e MEMSTICK: - Fix deadlock by moving removing flag earlier" * tag 'mmc-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 memstick: Fix deadlock by moving removing flag earlier mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency mmc: sdhci-pci-gli: Add a new function to simplify the code commit e2d324af56f703eb1491a9530c026bad2f700bbb Merge: c37d2bc92b90ef fa2e2d31ee3b72 Author: Linus Torvalds Date: Fri Aug 22 09:13:24 2025 -0400 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fixes from Jason Gunthorpe: - syzkaller found a WARN_ON in rxe due to poor lifecycle management of resources linked to skbs - Missing error path handling in erdma qp creation - Initialize the qp number for the GSI QP in erdma - Mismatching of DIP, SCC and QP numbers in hns - SRQ bug fixes in bnxt_re - Memory leak and possibly uninited memory in bnxt_re - Remove retired irdma maintainer - Fix kfree() for kvalloc() in ODP - Fix memory leak in hns * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/hns: Fix dip entries leak on devices newer than hip09 RDMA/core: Free pfn_list with appropriate kvfree call MAINTAINERS: Remove bouncing irdma maintainer RDMA/bnxt_re: Fix to initialize the PBL array RDMA/bnxt_re: Fix a possible memory leak in the driver RDMA/bnxt_re: Fix to remove workload check in SRQ limit path RDMA/bnxt_re: Fix to do SRQ armena by default RDMA/hns: Fix querying wrong SCC context for DIP algorithm RDMA/erdma: Fix unset QPN of GSI QP RDMA/erdma: Fix ignored return value of init_kernel_qp RDMA/rxe: Flush delayed SKBs while releasing RXE resources commit c37d2bc92b90ef4df898d1aa7a3ffed34e4043b8 Merge: f28ad47b669224 99d4d1a070870a Author: Linus Torvalds Date: Fri Aug 22 09:10:30 2025 -0400 Merge tag 'iommu-fixes-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu fixes from Joerg Roedel: - AMD-Vi: Fix potential stack buffer overflow via command line - NVidia-Tegra: Fix endianess sparse warning - ARM-SMMU: Fix ATS-masters reference count issue - Virtio-IOMMU: Fix race condition on instance lookup - RISC-V IOMMU: Fix potential NULL-ptr dereference in riscv_iommu_iova_to_phys() * tag 'iommu-fixes-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: iommu/riscv: prevent NULL deref in iova_to_phys iommu/virtio: Make instance lookup robust iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement iommu/tegra241-cmdqv: Fix missing cpu_to_le64 at lvcmdq_err_map iommu/amd: Avoid stack buffer overflow from kernel cmdline commit 563fcd6475931c5c8c652a4dd548256314cc87ed Author: Lorenzo Bianconi Date: Fri Aug 22 14:14:18 2025 +0200 pinctrl: airoha: Fix return value in pinconf callbacks Pinctrl stack requires ENOTSUPP error code if the parameter is not supported by the pinctrl driver. Fix the returned error code in pinconf callbacks if the operation is not supported. Fixes: 1c8ace2d0725 ("pinctrl: airoha: Add support for EN7581 SoC") Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/20250822-airoha-pinconf-err-val-fix-v1-1-87b4f264ced2@kernel.org Signed-off-by: Linus Walleij commit f28ad47b6692241bf85db82beaf24783b926a4d5 Merge: 3cfcd57def3395 8410fe81093ff2 Author: Linus Torvalds Date: Fri Aug 22 09:05:37 2025 -0400 Merge tag 'sound-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "Only small fixes. - ASoC Cirrus codec fixes - A regression fix for the recent TAS2781 codec refactoring - A fix for user-timer error handling - Fixes for USB-audio descriptor validators - Usual HD-audio and ASoC device-specific quirks" * tag 'sound-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation ALSA: timer: fix ida_free call while not allocated ASoC: cs35l56: Remove SoundWire Clock Divider workaround for CS35L63 ASoC: cs35l56: Handle new algorithms IDs for CS35L63 ASoC: cs35l56: Update Firmware Addresses for CS35L63 for production silicon ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 ASoC: codecs: ES9389: Modify the standby configuration ALSA: usb-audio: Fix size validation in convert_chmap_v3() ALSA: hda/tas2781: Add name prefix tas2781 for tas2781's dvc_tlv and amp_vol_tlv ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 commit 3cfcd57def3395d8e767698f3fb20146cb0c4ba0 Merge: e86ba12cf84ab9 453a6d2a68e54a Author: Linus Torvalds Date: Fri Aug 22 09:02:32 2025 -0400 Merge tag '6.17-rc2-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fix from Steve French: "Fix for netfs smb3 oops" * tag '6.17-rc2-smb3-client-fix' of git://git.samba.org/sfrench/cifs-2.6: cifs: Fix oops due to uninitialised variable commit 2aeadea47f5bdec94d04b890bc9a0d25a1340fa8 Author: Russell King (Oracle) Date: Thu Aug 21 18:43:28 2025 +0100 ARM64: dts: mcbin: fix SATA ports on Macchiatobin Booting 6.16 on the Macchiatobin, I discover that I can no longer access my disks, and thus the userspace boot fails. The cause appears to be that one of the SATA controllers doesn't have any ports: [ 1.190312] ahci f4540000.sata: supply ahci not found, using dummy regulator [ 1.196255] ahci f4540000.sata: supply phy not found, using dummy regulator [ 1.202026] ahci f4540000.sata: No port enabled This is as a result of the blamed commit below which added a default disabled status to the .dtsi, but didn't properly update the mcbin dtsi file. Fix this regression. Fixes: 30023876aef4 ("arm64: dts: marvell: only enable complete sata nodes") Signed-off-by: Russell King (Oracle) Signed-off-by: Gregory CLEMENT commit 85f5d8e369c24d678442f6bb4ec5bbdc431a09d9 Author: Jihed Chaibi Date: Thu Jul 24 00:45:04 2025 +0200 ARM: dts: armada-370-db: Fix stereo audio input routing on Armada 370 The simple-audio-card configuration for the Armada 370 development board incorrectly routed the left channel signal ("AIN1L") to both sides of the stereo "In Jack". This commit corrects the typo for the right channel, changing the second "AIN1L" entry to "AIN1R" to enable proper stereo input recording. Signed-off-by: Jihed Chaibi Signed-off-by: Gregory CLEMENT commit e86ba12cf84ab9cf42fbc2382235fa7ba616e18b Merge: 6eba757ce90483 76d2e3890fb169 Author: Linus Torvalds Date: Fri Aug 22 08:58:58 2025 -0400 Merge tag 'nfs-for-6.17-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client fix from Trond Myklebust: - NFS: Fix a data corrupting race when updating an existing write * tag 'nfs-for-6.17-2' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: NFS: Fix a race when updating an existing write commit 6eba757ce90483b76da4e7eda962d8b8b8930f2c Merge: 3957a572015726 772e5b4a5e8360 Author: Linus Torvalds Date: Fri Aug 22 08:54:34 2025 -0400 Merge tag 'mm-hotfixes-stable-2025-08-21-18-17' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "20 hotfixes. 10 are cc:stable and the remainder address post-6.16 issues or aren't considered necessary for -stable kernels. 17 of these fixes are for MM. As usual, singletons all over the place, apart from a three-patch series of KHO followup work from Pasha which is actually also a bunch of singletons" * tag 'mm-hotfixes-stable-2025-08-21-18-17' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: mm/mremap: fix WARN with uffd that has remap events disabled mm/damon/sysfs-schemes: put damos dests dir after removing its files mm/migrate: fix NULL movable_ops if CONFIG_ZSMALLOC=m mm/damon/core: fix damos_commit_filter not changing allow mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn MAINTAINERS: mark MGLRU as maintained mm: rust: add page.rs to MEMORY MANAGEMENT - RUST iov_iter: iterate_folioq: fix handling of offset >= folio size selftests/damon: fix selftests by installing drgn related script .mailmap: add entry for Easwar Hariharan selftests/mm: add test for invalid multi VMA operations mm/mremap: catch invalid multi VMA moves earlier mm/mremap: allow multi-VMA move when filesystem uses thp_get_unmapped_area mm/damon/core: fix commit_ops_filters by using correct nth function tools/testing: add linux/args.h header and fix radix, VMA tests mm/debug_vm_pgtable: clear page table entries at destroy_args() squashfs: fix memory leak in squashfs_fill_super kho: warn if KHO is disabled due to an error kho: mm: don't allow deferred struct page with KHO kho: init new_physxa->phys_bits to fix lockdep commit 08fb45446ebf1e2e435f95163c59d692acb0b514 Author: Thomas Zimmermann Date: Thu Aug 21 08:40:12 2025 +0200 drm/amdgpu: Pin buffers while vmap'ing exported dma-buf objects Current dma-buf vmap semantics require that the mapped buffer remains in place until the corresponding vunmap has completed. For GEM-SHMEM, this used to be guaranteed by a pin operation while creating an S/G table in import. GEM-SHMEN can now import dma-buf objects without creating the S/G table, so the pin is missing. Leads to page-fault errors, such as the one shown below. [ 102.101726] BUG: unable to handle page fault for address: ffffc90127000000 [...] [ 102.157102] RIP: 0010:udl_compress_hline16+0x219/0x940 [udl] [...] [ 102.243250] Call Trace: [ 102.245695] [ 102.2477V95] ? validate_chain+0x24e/0x5e0 [ 102.251805] ? __lock_acquire+0x568/0xae0 [ 102.255807] udl_render_hline+0x165/0x341 [udl] [ 102.260338] ? __pfx_udl_render_hline+0x10/0x10 [udl] [ 102.265379] ? local_clock_noinstr+0xb/0x100 [ 102.269642] ? __lock_release.isra.0+0x16c/0x2e0 [ 102.274246] ? mark_held_locks+0x40/0x70 [ 102.278177] udl_primary_plane_helper_atomic_update+0x43e/0x680 [udl] [ 102.284606] ? __pfx_udl_primary_plane_helper_atomic_update+0x10/0x10 [udl] [ 102.291551] ? lockdep_hardirqs_on_prepare.part.0+0x92/0x170 [ 102.297208] ? lockdep_hardirqs_on+0x88/0x130 [ 102.301554] ? _raw_spin_unlock_irq+0x24/0x50 [ 102.305901] ? wait_for_completion_timeout+0x2bb/0x3a0 [ 102.311028] ? drm_atomic_helper_calc_timestamping_constants+0x141/0x200 [ 102.317714] ? drm_atomic_helper_commit_planes+0x3b6/0x1030 [ 102.323279] drm_atomic_helper_commit_planes+0x3b6/0x1030 [ 102.328664] drm_atomic_helper_commit_tail+0x41/0xb0 [ 102.333622] commit_tail+0x204/0x330 [...] [ 102.529946] ---[ end trace 0000000000000000 ]--- [ 102.651980] RIP: 0010:udl_compress_hline16+0x219/0x940 [udl] In this stack strace, udl (based on GEM-SHMEM) imported and vmap'ed a dma-buf from amdgpu. Amdgpu relocated the buffer, thereby invalidating the mapping. Provide a custom dma-buf vmap method in amdgpu that pins the object before mapping it's buffer's pages into kernel address space. Do the opposite in vunmap. Note that dma-buf vmap differs from GEM vmap in how it handles relocation. While dma-buf vmap keeps the buffer in place, GEM vmap requires the caller to keep the buffer in place. Hence, this fix is in amdgpu's dma-buf code instead of its GEM code. A discussion of various approaches to solving the problem is available at [1]. v3: - try (GTT | VRAM); drop CPU domain (Christian) v2: - only use mapable domains (Christian) - try pinning to domains in preferred order Signed-off-by: Thomas Zimmermann Fixes: 660cd44659a0 ("drm/shmem-helper: Import dmabuf without mapping its sg_table") Reported-by: Thomas Zimmermann Closes: https://lore.kernel.org/dri-devel/ba1bdfb8-dbf7-4372-bdcb-df7e0511c702@suse.de/ Cc: Shixiong Ou Cc: Thomas Zimmermann Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Simona Vetter Cc: Sumit Semwal Cc: "Christian König" Cc: dri-devel@lists.freedesktop.org Cc: linux-media@vger.kernel.org Cc: linaro-mm-sig@lists.linaro.org Link: https://lore.kernel.org/dri-devel/9792c6c3-a2b8-4b2b-b5ba-fba19b153e21@suse.de/ # [1] Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250821064031.39090-1-tzimmermann@suse.de commit 37e5caa5571b5a60b0c835a0bc09ab1e53f57bfe Author: Marek Vasut Date: Wed Aug 20 18:27:26 2025 +0200 arm64: dts: imx95: Fix JPEG encoder node assigned clock The assigned clock for JPEG encoder IP has to be IMX95_CLK_VPUBLK_JPEG_ENC and not IMX95_CLK_VPUBLK_JPEG_DEC (_ENC at the end, not _DEC). This is a simple copy-paste error, fix it. Fixes: 153c039a7357 ("arm64: dts: imx95: add jpeg encode and decode nodes") Signed-off-by: Marek Vasut Reviewed-by: Laurent Pinchart Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit e35318d8d2d2dccc50454e3fc0bd9caaf2a797cd Author: Haibo Chen Date: Tue Aug 19 10:43:37 2025 +0800 arm64: dts: imx95-19x19-evk: correct the phy setting for flexcan1/2 1, the phy support up to 8Mbit/s databitrate for CAN FD. refer to product data sheet: https://www.nxp.com/docs/en/data-sheet/TJA1463.pdf 2, the standby pin of the phy is ACTIVE_LOW. 3, the phy of flexcan2 connect the standby/en pin to PCAL6408 on i2c4 bus. Fixes: 02b7adb791e1 ("arm64: dts: imx95-19x19-evk: add adc0 flexcan[1,2] i2c[2,3] uart5 spi3 and tpm3") Signed-off-by: Haibo Chen Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 80733306290f6d2e05f0632e5d3e98cd16105c3c Author: Marek Vasut Date: Sun Aug 10 18:04:32 2025 +0200 arm64: dts: imx8mp: Fix missing microSD slot vqmmc on Data Modul i.MX8M Plus eDM SBC Add missing microSD slot vqmmc-supply property, otherwise the kernel might shut down LDO5 regulator and that would power off the microSD card slot, possibly while it is in use. Add the property to make sure the kernel is aware of the LDO5 regulator which supplies the microSD slot and keeps the LDO5 enabled. Fixes: 562d222f23f0 ("arm64: dts: imx8mp: Add support for Data Modul i.MX8M Plus eDM SBC") Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit c53cf8ce3bfe1309cb4fd4d74c5be27c26a86e52 Author: Marek Vasut Date: Sun Aug 10 18:03:07 2025 +0200 arm64: dts: imx8mp: Fix missing microSD slot vqmmc on DH electronics i.MX8M Plus DHCOM Add missing microSD slot vqmmc-supply property, otherwise the kernel might shut down LDO5 regulator and that would power off the microSD card slot, possibly while it is in use. Add the property to make sure the kernel is aware of the LDO5 regulator which supplies the microSD slot and keeps the LDO5 enabled. Fixes: 8d6712695bc8 ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2") Signed-off-by: Marek Vasut Signed-off-by: Shawn Guo commit 917baa75e376084240ca1696ab29589006563128 Author: Markus Niebel Date: Thu Jul 31 11:16:53 2025 +0200 arm64: dts: imx8mp-tqma8mpql: remove virtual 3.3V regulator BUCK4 rail supplies the 3.3V rail. Use the actual regulator instead of a virtual fixed regulator. Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 5245dc5ff9b1f6c02ef948f623432805ea148fca Author: Markus Niebel Date: Thu Jul 31 11:16:52 2025 +0200 arm64: dts: imx8mp-tqma8mpql: fix LDO5 power off Fix SD card removal caused by automatic LDO5 power off after boot: LDO5: disabling mmc1: card 59b4 removed EXT4-fs (mmcblk1p2): shut down requested (2) Aborting journal on device mmcblk1p2-8. JBD2: I/O error when updating journal superblock for mmcblk1p2-8. To prevent this, add vqmmc regulator for USDHC, using a GPIO-controlled regulator that is supplied by LDO5. Since this is implemented on SoM but used on baseboards with SD-card interface, implement the functionality on SoM part and optionally enable it on baseboards if needed. Fixes: 418d1d840e42 ("arm64: dts: freescale: add initial device tree for TQMa8MPQL with i.MX8MP") Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 99d4d1a070870aa08163af8ce0522992b7f35d8c Author: XianLiang Huang Date: Wed Aug 20 15:22:48 2025 +0800 iommu/riscv: prevent NULL deref in iova_to_phys The riscv_iommu_pte_fetch() function returns either NULL for unmapped/never-mapped iova, or a valid leaf pte pointer that requires no further validation. riscv_iommu_iova_to_phys() failed to handle NULL returns. Prevent null pointer dereference in riscv_iommu_iova_to_phys(), and remove the pte validation. Fixes: 488ffbf18171 ("iommu/riscv: Paging domain support") Cc: Tomasz Jeznach Signed-off-by: XianLiang Huang Link: https://lore.kernel.org/r/20250820072248.312-1-huangxianliang@lanxincomputing.com Signed-off-by: Joerg Roedel commit 72b6f7cd89cea8251979b65528d302f9c0ed37bf Author: Robin Murphy Date: Thu Aug 14 17:47:16 2025 +0100 iommu/virtio: Make instance lookup robust Much like arm-smmu in commit 7d835134d4e1 ("iommu/arm-smmu: Make instance lookup robust"), virtio-iommu appears to have the same issue where iommu_device_register() makes the IOMMU instance visible to other API callers (including itself) straight away, but internally the instance isn't ready to recognise itself for viommu_probe_device() to work correctly until after viommu_probe() has returned. This matters a lot more now that bus_iommu_probe() has the DT/VIOT knowledge to probe client devices the way that was always intended. Tweak the lookup and initialisation in much the same way as for arm-smmu, to ensure that what we register is functional and ready to go. Cc: stable@vger.kernel.org Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path") Signed-off-by: Robin Murphy Tested-by: Eric Auger Link: https://lore.kernel.org/r/308911aaa1f5be32a3a709996c7bd6cf71d30f33.1755190036.git.robin.murphy@arm.com Signed-off-by: Joerg Roedel commit 685ca577b408ffd9c5a4057a2acc0cd3e6978b36 Author: Nicolin Chen Date: Thu Jul 31 20:01:27 2025 -0700 iommu/arm-smmu-v3: Fix smmu_domain->nr_ats_masters decrement The arm_smmu_attach_commit() updates master->ats_enabled before calling arm_smmu_remove_master_domain() that is supposed to clean up everything in the old domain, including the old domain's nr_ats_masters. So, it is supposed to use the old ats_enabled state of the device, not an updated state. This isn't a problem if switching between two domains where: - old ats_enabled = false; new ats_enabled = false - old ats_enabled = true; new ats_enabled = true but can fail cases where: - old ats_enabled = false; new ats_enabled = true (old domain should keep the counter but incorrectly decreased it) - old ats_enabled = true; new ats_enabled = false (old domain needed to decrease the counter but incorrectly missed it) Update master->ats_enabled after arm_smmu_remove_master_domain() to fix this. Fixes: 7497f4211f4f ("iommu/arm-smmu-v3: Make changing domains be hitless for ATS") Cc: stable@vger.kernel.org Signed-off-by: Nicolin Chen Acked-by: Will Deacon Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Link: https://lore.kernel.org/r/20250801030127.2006979-1-nicolinc@nvidia.com Signed-off-by: Joerg Roedel commit a12946bef0407cf2db0899c83d42c47c00af3fbc Author: Randy Dunlap Date: Thu Aug 14 19:27:21 2025 -0700 pinctrl: STMFX: add missing HAS_IOMEM dependency When building on ARCH=um (which does not set HAS_IOMEM), kconfig reports an unmet dependency caused by PINCTRL_STMFX. It selects MFD_STMFX, which depends on HAS_IOMEM. To stop this warning, PINCTRL_STMFX should also depend on HAS_IOMEM. kconfig warning: WARNING: unmet direct dependencies detected for MFD_STMFX Depends on [n]: HAS_IOMEM [=n] && I2C [=y] && OF [=y] Selected by [y]: - PINCTRL_STMFX [=y] && PINCTRL [=y] && I2C [=y] && OF_GPIO [=y] Fixes: 1490d9f841b1 ("pinctrl: Add STMFX GPIO expander Pinctrl/GPIO driver") Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/20250815022721.1650885-1-rdunlap@infradead.org Signed-off-by: Linus Walleij commit 01b9128c5db1b470575d07b05b67ffa3cb02ebf1 Author: luoguangfei <15388634752@163.com> Date: Tue Aug 19 07:25:27 2025 +0800 net: macb: fix unregister_netdev call order in macb_remove() When removing a macb device, the driver calls phy_exit() before unregister_netdev(). This leads to a WARN from kernfs: ------------[ cut here ]------------ kernfs: can not remove 'attached_dev', no directory WARNING: CPU: 1 PID: 27146 at fs/kernfs/dir.c:1683 Call trace: kernfs_remove_by_name_ns+0xd8/0xf0 sysfs_remove_link+0x24/0x58 phy_detach+0x5c/0x168 phy_disconnect+0x4c/0x70 phylink_disconnect_phy+0x6c/0xc0 [phylink] macb_close+0x6c/0x170 [macb] ... macb_remove+0x60/0x168 [macb] platform_remove+0x5c/0x80 ... The warning happens because the PHY is being exited while the netdev is still registered. The correct order is to unregister the netdev before shutting down the PHY and cleaning up the MDIO bus. Fix this by moving unregister_netdev() ahead of phy_exit() in macb_remove(). Fixes: 8b73fa3ae02b ("net: macb: Added ZynqMP-specific initialization") Signed-off-by: luoguangfei <15388634752@163.com> Link: https://patch.msgid.link/20250818232527.1316-1-15388634752@163.com Signed-off-by: Jakub Kicinski commit e959fe7863ec4faa10d3b48f4a4e0ff16c85bfb4 Merge: 6439a0e64c355d 7fb1291257ea1e Author: Jakub Kicinski Date: Thu Aug 21 17:47:59 2025 -0700 Merge branch 'fix-vsock-error-handling-regression-introduced-in-v6-17-rc1' Will Deacon says: ==================== Fix vsock error-handling regression introduced in v6.17-rc1 Here are a couple of patches fixing the vsock error-handling regression found by syzbot that I introduced during the recent merge window. ==================== Link: https://patch.msgid.link/20250818180355.29275-1-will@kernel.org Signed-off-by: Jakub Kicinski commit 7fb1291257ea1e27dbc3f34c6a37b4d640aafdd7 Author: Will Deacon Date: Mon Aug 18 19:03:55 2025 +0100 vsock/virtio: Fix message iterator handling on transmit path Commit 6693731487a8 ("vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers") converted the virtio vsock transmit path to utilise nonlinear SKBs when handling large buffers. As part of this change, virtio_transport_fill_skb() was updated to call skb_copy_datagram_from_iter() instead of memcpy_from_msg() as the latter expects a single destination buffer and cannot handle nonlinear SKBs correctly. Unfortunately, during this conversion, I overlooked the error case when the copying function returns -EFAULT due to a fault on the input buffer in userspace. In this case, memcpy_from_msg() reverts the iterator to its initial state thanks to copy_from_iter_full() whereas skb_copy_datagram_from_iter() leaves the iterator partially advanced. This results in a WARN_ONCE() from the vsock code, which expects the iterator to stay in sync with the number of bytes transmitted so that virtio_transport_send_pkt_info() can return -EFAULT when it is called again: ------------[ cut here ]------------ 'send_pkt()' returns 0, but 65536 expected WARNING: CPU: 0 PID: 5503 at net/vmw_vsock/virtio_transport_common.c:428 virtio_transport_send_pkt_info+0xd11/0xf00 net/vmw_vsock/virtio_transport_common.c:426 Modules linked in: CPU: 0 UID: 0 PID: 5503 Comm: syz.0.17 Not tainted 6.16.0-syzkaller-12063-g37816488247d #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call virtio_transport_fill_skb_full() to restore the previous iterator behaviour. Cc: Jason Wang Cc: Stefano Garzarella Fixes: 6693731487a8 ("vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers") Reported-by: syzbot+b4d960daf7a3c7c2b7b1@syzkaller.appspotmail.com Signed-off-by: Will Deacon Acked-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi Link: https://patch.msgid.link/20250818180355.29275-3-will@kernel.org Signed-off-by: Jakub Kicinski commit b08a784a5d1495c42ff9b0c70887d49211cddfe0 Author: Will Deacon Date: Mon Aug 18 19:03:54 2025 +0100 net: Introduce skb_copy_datagram_from_iter_full() In a similar manner to copy_from_iter()/copy_from_iter_full(), introduce skb_copy_datagram_from_iter_full() which reverts the iterator to its initial state when returning an error. A subsequent fix for a vsock regression will make use of this new function. Cc: Christian Brauner Cc: Alexander Viro Signed-off-by: Will Deacon Acked-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi Link: https://patch.msgid.link/20250818180355.29275-2-will@kernel.org Signed-off-by: Jakub Kicinski commit 01860bcc53432d8b9b92a72939b35679ac24059f Author: Mark Brown Date: Mon Aug 18 17:41:00 2025 +0100 KVM: arm64: selftests: Sync ID_AA64MMFR3_EL1 in set_id_regs When we added coverage for ID_AA64MMFR3_EL1 we didn't add it to the list of registers we read in the guest, do so. Fixes: 0b593ef12afc ("KVM: arm64: selftests: Catch up set_id_regs with the kernel") Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250818-kvm-arm64-selftests-mmfr3-idreg-v1-1-2f85114d0163@kernel.org Signed-off-by: Oliver Upton commit 0843e0ced338d07c8bcec5675c560a94d05a4d41 Author: Marc Zyngier Date: Sun Aug 17 21:21:58 2025 +0100 KVM: arm64: Get rid of ARM64_FEATURE_MASK() The ARM64_FEATURE_MASK() macro was a hack introduce whilst the automatic generation of sysreg encoding was introduced, and was too unreliable to be entirely trusted. We are in a better place now, and we could really do without this macro. Get rid of it altogether. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250817202158.395078-7-maz@kernel.org Signed-off-by: Oliver Upton commit 7a765aa88e345782d3e4ed4c82e49f1ea82fd29c Author: Marc Zyngier Date: Sun Aug 17 21:21:57 2025 +0100 KVM: arm64: Make ID_AA64PFR1_EL1.RAS_frac writable Allow userspace to write to RAS_frac, under the condition that the host supports RASv1p1 with RAS_frac==1. Other configurations will result in RAS_frac being exposed as 0, and therefore implicitly not writable. To avoid the clutter, the ID_AA64PFR1_EL1 sanitisation is moved to its own function. Signed-off-by: Marc Zyngier Reviewed-by: Cornelia Huck Link: https://lore.kernel.org/r/20250817202158.395078-6-maz@kernel.org Signed-off-by: Oliver Upton commit 1fab657cb2a07889c343302fbebca035e702683e Author: Marc Zyngier Date: Sun Aug 17 21:21:56 2025 +0100 KVM: arm64: Make ID_AA64PFR0_EL1.RAS writable Make ID_AA64PFR0_EL1.RAS writable so that we can restore a VM from a system without RAS to a RAS-equipped machine (or disable RAS in the guest). Signed-off-by: Marc Zyngier Reviewed-by: Cornelia Huck Link: https://lore.kernel.org/r/20250817202158.395078-5-maz@kernel.org Signed-off-by: Oliver Upton commit 9049fb1227a2d1ab8515788c8553232966380248 Author: Marc Zyngier Date: Sun Aug 17 21:21:55 2025 +0100 KVM: arm64: Ignore HCR_EL2.FIEN set by L1 guest's EL2 An EL2 guest can set HCR_EL2.FIEN, which gives access to the RASv1p1 fault injection mechanism. This would allow an EL1 guest to inject error records into the system, which does sound like a terrible idea. Prevent this situation by added FIEN to the list of bits we silently exclude from being inserted into the host configuration. Signed-off-by: Marc Zyngier Reviewed-by: Joey Gouly Link: https://lore.kernel.org/r/20250817202158.395078-4-maz@kernel.org Signed-off-by: Oliver Upton commit d7b3e23f945b36aec3938e5ea954bc125f38562e Author: Marc Zyngier Date: Sun Aug 17 21:21:54 2025 +0100 KVM: arm64: Handle RASv1p1 registers FEAT_RASv1p1 system registeres are not handled at all so far. KVM will give an embarassed warning on the console and inject an UNDEF, despite RASv1p1 being exposed to the guest on suitable HW. Handle these registers similarly to FEAT_RAS, with the added fun that there are *two* way to indicate the presence of FEAT_RASv1p1. Reviewed-by: Joey Gouly Signed-off-by: Marc Zyngier Reviewed-by: Cornelia Huck Link: https://lore.kernel.org/r/20250817202158.395078-3-maz@kernel.org Signed-off-by: Oliver Upton commit 8049164653c6e6e7b347da773098d8660a26a6f6 Author: Marc Zyngier Date: Sun Aug 17 21:21:53 2025 +0100 arm64: Add capability denoting FEAT_RASv1p1 Detecting FEAT_RASv1p1 is rather complicated, as there are two ways for the architecture to advertise the same thing (always a delight...). Add a capability that will advertise this in a synthetic way to the rest of the kernel. Acked-by: Catalin Marinas Signed-off-by: Marc Zyngier Reviewed-by: Cornelia Huck Link: https://lore.kernel.org/r/20250817202158.395078-2-maz@kernel.org Signed-off-by: Oliver Upton commit e9abe311f35631a999fe38c86f26f0e48ffe46d5 Author: Raghavendra Rao Ananta Date: Wed Aug 20 16:22:42 2025 +0000 KVM: arm64: Reschedule as needed when destroying the stage-2 page-tables When a large VM, specifically one that holds a significant number of PTEs, gets abruptly destroyed, the following warning is seen during the page-table walk: sched: CPU 0 need_resched set for > 100018840 ns (100 ticks) without schedule CPU: 0 UID: 0 PID: 9617 Comm: kvm_page_table_ Tainted: G O 6.16.0-smp-DEV #3 NONE Tainted: [O]=OOT_MODULE Call trace: show_stack+0x20/0x38 (C) dump_stack_lvl+0x3c/0xb8 dump_stack+0x18/0x30 resched_latency_warn+0x7c/0x88 sched_tick+0x1c4/0x268 update_process_times+0xa8/0xd8 tick_nohz_handler+0xc8/0x168 __hrtimer_run_queues+0x11c/0x338 hrtimer_interrupt+0x104/0x308 arch_timer_handler_phys+0x40/0x58 handle_percpu_devid_irq+0x8c/0x1b0 generic_handle_domain_irq+0x48/0x78 gic_handle_irq+0x1b8/0x408 call_on_irq_stack+0x24/0x30 do_interrupt_handler+0x54/0x78 el1_interrupt+0x44/0x88 el1h_64_irq_handler+0x18/0x28 el1h_64_irq+0x84/0x88 stage2_free_walker+0x30/0xa0 (P) __kvm_pgtable_walk+0x11c/0x258 __kvm_pgtable_walk+0x180/0x258 __kvm_pgtable_walk+0x180/0x258 __kvm_pgtable_walk+0x180/0x258 kvm_pgtable_walk+0xc4/0x140 kvm_pgtable_stage2_destroy+0x5c/0xf0 kvm_free_stage2_pgd+0x6c/0xe8 kvm_uninit_stage2_mmu+0x24/0x48 kvm_arch_flush_shadow_all+0x80/0xa0 kvm_mmu_notifier_release+0x38/0x78 __mmu_notifier_release+0x15c/0x250 exit_mmap+0x68/0x400 __mmput+0x38/0x1c8 mmput+0x30/0x68 exit_mm+0xd4/0x198 do_exit+0x1a4/0xb00 do_group_exit+0x8c/0x120 get_signal+0x6d4/0x778 do_signal+0x90/0x718 do_notify_resume+0x70/0x170 el0_svc+0x74/0xd8 el0t_64_sync_handler+0x60/0xc8 el0t_64_sync+0x1b0/0x1b8 The warning is seen majorly on the host kernels that are configured not to force-preempt, such as CONFIG_PREEMPT_NONE=y. To avoid this, instead of walking the entire page-table in one go, split it into smaller ranges, by checking for cond_resched() between each range. Since the path is executed during VM destruction, after the page-table structure is unlinked from the KVM MMU, relying on cond_resched_rwlock_write() isn't necessary. Signed-off-by: Raghavendra Rao Ananta Suggested-by: Oliver Upton Link: https://lore.kernel.org/r/20250820162242.2624752-3-rananta@google.com Signed-off-by: Oliver Upton commit 0e89ca13ee5ff41b437bb2a003c0eaf34ea43555 Author: Raghavendra Rao Ananta Date: Wed Aug 20 16:22:41 2025 +0000 KVM: arm64: Split kvm_pgtable_stage2_destroy() Split kvm_pgtable_stage2_destroy() into two: - kvm_pgtable_stage2_destroy_range(), that performs the page-table walk and free the entries over a range of addresses. - kvm_pgtable_stage2_destroy_pgd(), that frees the PGD. This refactoring enables subsequent patches to free large page-tables in chunks, calling cond_resched() between each chunk, to yield the CPU as necessary. Existing callers of kvm_pgtable_stage2_destroy(), that probably cannot take advantage of this (such as nVMHE), will continue to function as is. Signed-off-by: Raghavendra Rao Ananta Suggested-by: Oliver Upton Link: https://lore.kernel.org/r/20250820162242.2624752-2-rananta@google.com Signed-off-by: Oliver Upton commit 986bf6ed44dff7fbae7b43a0882757ee7f5ba21b Author: Filipe Manana Date: Wed Aug 6 12:11:32 2025 +0100 btrfs: avoid load/store tearing races when checking if an inode was logged At inode_logged() we do a couple lockless checks for ->logged_trans, and these are generally safe except the second one in case we get a load or store tearing due to a concurrent call updating ->logged_trans (either at btrfs_log_inode() or later at inode_logged()). In the first case it's safe to compare to the current transaction ID since once ->logged_trans is set the current transaction, we never set it to a lower value. In the second case, where we check if it's greater than zero, we are prone to load/store tearing races, since we can have a concurrent task updating to the current transaction ID with store tearing for example, instead of updating with a single 64 bits write, to update with two 32 bits writes or four 16 bits writes. In that case the reading side at inode_logged() could see a positive value that does not match the current transaction and then return a false negative. Fix this by doing the second check while holding the inode's spinlock, add some comments about it too. Also add the data_race() annotation to the first check to avoid any reports from KCSAN (or similar tools) and comment about it. Fixes: 0f8ce49821de ("btrfs: avoid inode logging during rename and link when possible") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 59a0dd4ab98970086fd096281b1606c506ff2698 Author: Filipe Manana Date: Wed Aug 6 12:11:31 2025 +0100 btrfs: fix race between setting last_dir_index_offset and inode logging At inode_logged() if we find that the inode was not logged before we update its ->last_dir_index_offset to (u64)-1 with the goal that the next directory log operation will see the (u64)-1 and then figure out it must check what was the index of the last logged dir index key and update ->last_dir_index_offset to that key's offset (this is done in update_last_dir_index_offset()). This however has a possibility for a time window where a race can happen and lead to directory logging skipping dir index keys that should be logged. The race happens like this: 1) Task A calls inode_logged(), sees ->logged_trans as 0 and then checks that the inode item was logged before, but before it sets the inode's ->last_dir_index_offset to (u64)-1... 2) Task B is at btrfs_log_inode() which calls inode_logged() early, and that has set ->last_dir_index_offset to (u64)-1; 3) Task B then enters log_directory_changes() which calls update_last_dir_index_offset(). There it sees ->last_dir_index_offset is (u64)-1 and that the inode was logged before (ctx->logged_before is true), and so it searches for the last logged dir index key in the log tree and it finds that it has an offset (index) value of N, so it sets ->last_dir_index_offset to N, so that we can skip index keys that are less than or equal to N (later at process_dir_items_leaf()); 4) Task A now sets ->last_dir_index_offset to (u64)-1, undoing the update that task B just did; 5) Task B will now skip every index key when it enters process_dir_items_leaf(), since ->last_dir_index_offset is (u64)-1. Fix this by making inode_logged() not touch ->last_dir_index_offset and initializing it to 0 when an inode is loaded (at btrfs_alloc_inode()) and then having update_last_dir_index_offset() treat a value of 0 as meaning we must check the log tree and update with the index of the last logged index key. This is fine since the minimum possible value for ->last_dir_index_offset is 1 (BTRFS_DIR_START_INDEX - 1 = 2 - 1 = 1). This also simplifies the management of ->last_dir_index_offset and now all accesses to it are done under the inode's log_mutex. Fixes: 0f8ce49821de ("btrfs: avoid inode logging during rename and link when possible") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit ef07b74e1be56f9eafda6aadebb9ebba0743c9f0 Author: Filipe Manana Date: Wed Aug 6 12:11:30 2025 +0100 btrfs: fix race between logging inode and checking if it was logged before There's a race between checking if an inode was logged before and logging an inode that can cause us to mark an inode as not logged just after it was logged by a concurrent task: 1) We have inode X which was not logged before neither in the current transaction not in past transaction since the inode was loaded into memory, so it's ->logged_trans value is 0; 2) We are at transaction N; 3) Task A calls inode_logged() against inode X, sees that ->logged_trans is 0 and there is a log tree and so it proceeds to search in the log tree for an inode item for inode X. It doesn't see any, but before it sets ->logged_trans to N - 1... 3) Task B calls btrfs_log_inode() against inode X, logs the inode and sets ->logged_trans to N; 4) Task A now sets ->logged_trans to N - 1; 5) At this point anyone calling inode_logged() gets 0 (inode not logged) since ->logged_trans is greater than 0 and less than N, but our inode was really logged. As a consequence operations like rename, unlink and link that happen afterwards in the current transaction end up not updating the log when they should. Fix this by ensuring inode_logged() only updates ->logged_trans in case the inode item is not found in the log tree if after tacking the inode's lock (spinlock struct btrfs_inode::lock) the ->logged_trans value is still zero, since the inode lock is what protects setting ->logged_trans at btrfs_log_inode(). Fixes: 0f8ce49821de ("btrfs: avoid inode logging during rename and link when possible") Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 5bb00879cb23db7e5e2fc0aa47b5ce3b1c713d8a Author: Filipe Manana Date: Fri Jul 25 17:08:13 2025 +0100 btrfs: simplify error handling logic for btrfs_link() Instead of incrementing the inode's link count and refcount early before adding the link, updating the inode and deleting orphan item, do it after all those steps succeeded right before calling d_instantiate(). This makes the error handling logic simpler by avoiding the need for the 'drop_inode' variable to signal if we need to undo the link count increment and the inode refcount increase under the 'fail' label. This also reduces the level of indentation by one, making the code easier to read. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit e87e953bb20629ca1f008f8146c38e313e5ed319 Author: Filipe Manana Date: Fri Jul 25 16:54:49 2025 +0100 btrfs: fix inode leak on failure to add link to inode If we fail to update the inode or delete the orphan item we leak the inode since we update its refcount with the ihold() call to account for the d_instantiate() call which never happens in case we fail those steps. Fix this by setting 'drop_inode' to true in case we fail those steps. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 2b3979624c3e34dcdd77d910c6490939727d91b2 Author: Filipe Manana Date: Fri Jul 25 16:51:49 2025 +0100 btrfs: abort transaction on failure to add link to inode If we fail to update the inode or delete the orphan item, we must abort the transaction to prevent persisting an inconsistent state. For example if we fail to update the inode item, we have the inconsistency of having a persisted inode item with a link count of N but we have N + 1 inode ref items and N + 1 directory entries pointing to our inode in case the transaction gets committed. Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 3957a5720157264dcc41415fbec7c51c4000fc2d Merge: 9a36b58a88f623 6563623e604e3e Author: Linus Torvalds Date: Thu Aug 21 16:31:27 2025 -0400 Merge tag 'cgroup-for-6.17-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup fixes from Tejun Heo: - Fix NULL de-ref in css_rstat_exit() which could happen after allocation failure - Fix a cpuset partition handling bug and a couple other misc issues - Doc spelling fix * tag 'cgroup-for-6.17-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: docs: cgroup: fixed spelling mistakes in documentation cgroup: avoid null de-ref in css_rstat_exit() cgroup/cpuset: Remove the unnecessary css_get/put() in cpuset_partition_write() cgroup/cpuset: Fix a partition error with CPU hotplug cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key commit 9a36b58a88f62398dbd005e5f3648f257ae2b9b4 Merge: f43e6ba0b45fb4 7c7cda81159b1a Author: Linus Torvalds Date: Thu Aug 21 16:28:00 2025 -0400 Merge tag 'spi-fix-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "A small collection of fixes that came in during the past week, a few driver specifics plus one fix for the spi-mem core where we weren't taking account of the frequency capabilities of the system when determining if it can support an operation" * tag 'spi-fix-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: st: fix PM macros to use CONFIG_PM instead of CONFIG_PM_SLEEP spi: spi-qpic-snand: fix calculating of ECC OOB regions' properties spi: spi-fsl-lpspi: Clamp too high speed_hz spi: spi-mem: add spi_mem_adjust_op_freq() in spi_mem_supports_op() spi: spi-mem: Add missing kdoc argument spi: spi-qpic-snand: use correct CW_PER_PAGE value for OOB write commit f43e6ba0b45fb486cc7d51be70972395dd3ebea4 Merge: f70e1e7980f361 11cd7a5c21db02 Author: Linus Torvalds Date: Thu Aug 21 16:26:18 2025 -0400 Merge tag 'regulator-fix-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fixes from Mark Brown: "A couple of fairly minor device specific fixes that came in over the past week or so, plus the addition of an actual maintainer for the IR38060" * tag 'regulator-fix-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: tps65219: regulator: tps65219: Fix error codes in probe() regulator: pca9450: Use devm_register_sys_off_handler regulator: dt-bindings: infineon,ir38060: Add Guenter as maintainer from IBM commit f70e1e7980f3611039d7b9a1b34beaaba1054af7 Merge: 26d6ed49cd008a 670b51121ed09f Author: Linus Torvalds Date: Thu Aug 21 16:07:15 2025 -0400 Merge tag 'acpi-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These fix three new issues in the ACPI APEI error injection code and an ACPI platform firmware runtime update interface issue: - Make ACPI APEI error injection check the version of the request when mapping the EINJ parameter structure in the BIOS reserved memory to prevent injecting errors based on an uninitialized field (Tony Luck) - Fix potential NULL dereference in __einj_error_inject() that may occur when memory allocation fails (Charles Han) - Remove the __exit annotation from einj_remove(), so it can be called on errors during faux device probe (Uwe Kleine-König) - Use a security-version-number check instead of a runtime version check during ACPI platform firmware runtime driver updates to prevent those updates from failing due to false-positive driver version check failures (Chen Yu)" * tag 'acpi-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: pfr_update: Fix the driver update version check ACPI: APEI: EINJ: Fix resource leak by remove callback in .exit.text ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() ACPI: APEI: EINJ: Check if user asked for EINJV2 injection commit 26d6ed49cd008a326063d82bd731c2a82f2f4378 Merge: d72052ac09ceba 094a7c318b29ca Author: Linus Torvalds Date: Thu Aug 21 16:04:58 2025 -0400 Merge tag 'pm-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These fix a cpuidle menu governor issue and two issues in the cpupower utility: - Prevent the menu cpuidle governor from selecting idle states with exit latency exceeding the current PM QoS limit after stopping the scheduler tick (Rafael Wysocki) - Make the set subcommand's -t option in the cpupower utility work as documented and allow it to control the CPU boost feature of cpufreq beyond x86 (Shinji Nomoto)" * tag 'pm-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpuidle: governors: menu: Avoid selecting states with too much latency cpupower: Allow control of boost feature on non-x86 based systems with boost support. cpupower: Fix a bug where the -t option of the set subcommand was not working. commit d72052ac09ceba6e49230ea9d7e37675d5bab789 Merge: 6439a0e64c355d e69980bd16f264 Author: Linus Torvalds Date: Thu Aug 21 16:02:35 2025 -0400 Merge tag 'sched_ext-for-6.17-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext fixes from Tejun Heo: - Fix a subtle bug during SCX enabling where a dead task skips init but doesn't skip sched class switch leading to invalid task state transition warning - Cosmetic fix in selftests * tag 'sched_ext-for-6.17-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: selftests/sched_ext: Remove duplicate sched.h header sched/ext: Fix invalid task state transitions on class switch commit e4e6aaea46b7be818eba0510ba68d30df8689ea3 Author: Jens Axboe Date: Thu Aug 21 13:24:57 2025 -0600 io_uring: clear ->async_data as part of normal init Opcode handlers like POLL_ADD will use ->async_data as the pointer for double poll handling, which is a bit different than the usual case where it's strictly gated by the REQ_F_ASYNC_DATA flag. Be a bit more proactive in handling ->async_data, and clear it to NULL as part of regular init. Init is touching that cacheline anyway, so might as well clear it. Signed-off-by: Jens Axboe commit 508c1314b342b78591f51c4b5dadee31a88335df Author: Jens Axboe Date: Thu Aug 21 13:23:21 2025 -0600 io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at that point. Those two should always go together, as the flag tells io_uring whether the field is valid or not. Additionally, on failure cleanup, the futex handler frees the data but does not clear ->async_data. Clear the data and the flag in the error path as well. Thanks to Trend Micro Zero Day Initiative and particularly ReDress for reporting this. Cc: stable@vger.kernel.org Fixes: 194bb58c6090 ("io_uring: add support for futex wake and wait") Signed-off-by: Jens Axboe commit ac29e4487aa20a21b7c3facbd1f14f5093835dc9 Author: Pritesh Patel Date: Mon Jun 16 16:53:12 2025 +0530 dt-bindings: vendor-prefixes: add eswin Add new vendor string to dt bindings. This new vendor string is used by - ESWIN EIC770X SoC - HiFive Premier P550 board which uses EIC7700 SoC. Link: https://www.eswin.com/en/ Signed-off-by: Pritesh Patel Reviewed-by: Samuel Holland Signed-off-by: Pinkesh Vaghela Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250616112316.3833343-4-pinkesh.vaghela@einfochips.com Signed-off-by: Rob Herring (Arm) commit 111fb43a557726079a67ce3ab51f602ddbf7097e Author: Christoph Manszewski Date: Wed Aug 13 12:12:30 2025 +0200 drm/xe: Fix vm_bind_ioctl double free bug If the argument check during an array bind fails, the bind_ops are freed twice as seen below. Fix this by setting bind_ops to NULL after freeing. ================================================================== BUG: KASAN: double-free in xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] Free of addr ffff88813bb9b800 by task xe_vm/14198 CPU: 5 UID: 0 PID: 14198 Comm: xe_vm Not tainted 6.16.0-xe-eudebug-cmanszew+ #520 PREEMPT(full) Hardware name: Intel Corporation Alder Lake Client Platform/AlderLake-P DDR5 RVP, BIOS ADLPFWI1.R00.2411.A02.2110081023 10/08/2021 Call Trace: dump_stack_lvl+0x82/0xd0 print_report+0xcb/0x610 ? __virt_addr_valid+0x19a/0x300 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] kasan_report_invalid_free+0xc8/0xf0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] check_slab_allocation+0x102/0x130 kfree+0x10d/0x440 ? should_fail_ex+0x57/0x2f0 ? xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] xe_vm_bind_ioctl+0x1b2/0x21f0 [xe] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? __lock_acquire+0xab9/0x27f0 ? lock_acquire+0x165/0x300 ? drm_dev_enter+0x53/0xe0 [drm] ? find_held_lock+0x2b/0x80 ? drm_dev_exit+0x30/0x50 [drm] ? drm_ioctl_kernel+0x128/0x1c0 [drm] drm_ioctl_kernel+0x128/0x1c0 [drm] ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] ? find_held_lock+0x2b/0x80 ? __pfx_drm_ioctl_kernel+0x10/0x10 [drm] ? should_fail_ex+0x57/0x2f0 ? __pfx_xe_vm_bind_ioctl+0x10/0x10 [xe] drm_ioctl+0x352/0x620 [drm] ? __pfx_drm_ioctl+0x10/0x10 [drm] ? __pfx_rpm_resume+0x10/0x10 ? do_raw_spin_lock+0x11a/0x1b0 ? find_held_lock+0x2b/0x80 ? __pm_runtime_resume+0x61/0xc0 ? rcu_is_watching+0x20/0x50 ? trace_irq_enable.constprop.0+0xac/0xe0 xe_drm_ioctl+0x91/0xc0 [xe] __x64_sys_ioctl+0xb2/0x100 ? rcu_is_watching+0x20/0x50 do_syscall_64+0x68/0x2e0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fa9acb24ded Fixes: b43e864af0d4 ("drm/xe/uapi: Add DRM_XE_VM_BIND_FLAG_CPU_ADDR_MIRROR") Cc: Matthew Brost Cc: Himal Prasad Ghimiray Cc: Thomas Hellström Signed-off-by: Christoph Manszewski Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250813101231.196632-2-christoph.manszewski@intel.com (cherry picked from commit a01b704527c28a2fd43a17a85f8996b75ec8492a) Signed-off-by: Rodrigo Vivi commit 8a30114073639fd97f2c7390abbc34fb8711327a Author: Piotr Piórkowski Date: Mon Aug 11 12:43:58 2025 +0200 drm/xe: Move ASID allocation and user PT BO tracking into xe_vm_create Currently, ASID assignment for user VMs and page-table BO accounting for client memory tracking are performed in xe_vm_create_ioctl. To consolidate VM object initialization, move this logic to xe_vm_create. v2: - removed unnecessary duplicate BO tracking code - using the local variable xef to verify whether the VM is being created by userspace Fixes: 658a1c8e0a66 ("drm/xe: Assign ioctl xe file handler to vm in xe_vm_create") Suggested-by: Matthew Auld Signed-off-by: Piotr Piórkowski Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250811104358.2064150-3-piotr.piorkowski@intel.com Signed-off-by: Michał Winiarski (cherry picked from commit 30e0c3f43a414616e0b6ca76cf7f7b2cd387e1d4) Signed-off-by: Rodrigo Vivi [Rodrigo: Added fixes tag] commit 670b51121ed09ff3a41539243407e4bd52eea9f4 Merge: b21d1fbb97c814 8151320c747efb Author: Rafael J. Wysocki Date: Thu Aug 21 20:47:23 2025 +0200 Merge branches 'acpi-apei' and 'acpi-pfrut' Merge ACPI APEI fixes and an ACPI platform firmware runtime update fix for 6.17-rc3. * acpi-apei: ACPI: APEI: EINJ: Fix resource leak by remove callback in .exit.text ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() ACPI: APEI: EINJ: Check if user asked for EINJV2 injection * acpi-pfrut: ACPI: pfr_update: Fix the driver update version check commit 094a7c318b29ca792fcee28e448da1ab6627ccea Merge: 2bc1adb05e360f 779b1a1cb13ae1 Author: Rafael J. Wysocki Date: Thu Aug 21 20:32:25 2025 +0200 Merge branch 'pm-cpuidle' Merge a menu governor fix for 6.17-rc3 * pm-cpuidle: cpuidle: governors: menu: Avoid selecting states with too much latency commit 6439a0e64c355d2e375bd094f365d56ce81faba3 Merge: 1c656b1efde6ce 91a79b79220431 Author: Linus Torvalds Date: Thu Aug 21 13:51:15 2025 -0400 Merge tag 'net-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Including fixes from Bluetooth. Current release - fix to a fix: - usb: asix_devices: fix PHY address mask in MDIO bus initialization Current release - regressions: - Bluetooth: fixes for the split between BIS_LINK and PA_LINK - Revert "net: cadence: macb: sama7g5_emac: Remove USARIO CLKEN flag", breaks compatibility with some existing device tree blobs - dsa: b53: fix reserved register access in b53_fdb_dump() Current release - new code bugs: - sched: dualpi2: run probability update timer in BH to avoid deadlock - eth: libwx: fix the size in RSS hash key population - pse-pd: pd692x0: improve power budget error paths and handling Previous releases - regressions: - tls: fix handling of zero-length records on the rx_list - hsr: reject HSR frame if skb can't hold tag - bonding: fix negotiation flapping in 802.3ad passive mode Previous releases - always broken: - gso: forbid IPv6 TSO with extensions on devices with only IPV6_CSUM - sched: make cake_enqueue return NET_XMIT_CN when past buffer_limit, avoid packet drops with low buffer_limit, remove unnecessary WARN() - sched: fix backlog accounting after modifying config of a qdisc in the middle of the hierarchy - mptcp: improve handling of skb extension allocation failures - eth: mlx5: - fixes for the "HW Steering" flow management method - fixes for QoS and device buffer management" * tag 'net-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (81 commits) netfilter: nf_reject: don't leak dst refcount for loopback packets net/mlx5e: Preserve shared buffer capacity during headroom updates net/mlx5e: Query FW for buffer ownership net/mlx5: Restore missing scheduling node cleanup on vport enable failure net/mlx5: Fix QoS reference leak in vport enable error path net/mlx5: Destroy vport QoS element when no configuration remains net/mlx5e: Preserve tc-bw during parent changes net/mlx5: Remove default QoS group and attach vports directly to root TSAR net/mlx5: Base ECVF devlink port attrs from 0 net: pse-pd: pd692x0: Skip power budget configuration when undefined net: pse-pd: pd692x0: Fix power budget leak in manager setup error path Octeontx2-af: Skip overlap check for SPI field selftests: tls: add tests for zero-length records tls: fix handling of zero-length records on the rx_list net: airoha: ppe: Do not invalid PPE entries in case of SW hash collision selftests: bonding: add test for passive LACP mode bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU bonding: update LACP activity flag after setting lacp_active Revert "net: cadence: macb: sama7g5_emac: Remove USARIO CLKEN flag" ipv6: sr: Fix MAC comparison to be constant-time ... commit aea70964b5a7ca491a3701f2dde6c9d05d51878d Author: Rob Herring (Arm) Date: Wed Aug 20 14:28:04 2025 -0500 of: reserved_mem: Add missing IORESOURCE_MEM flag on resources Commit f4fcfdda2fd8 ('of: reserved_mem: Add functions to parse "memory-region"') failed to set IORESOURCE_MEM flag on the resources. The result is functions such as devm_ioremap_resource_wc() will fail. Add the missing flag. Fixes: f4fcfdda2fd8 ('of: reserved_mem: Add functions to parse "memory-region"') Reported-by: Iuliana Prodan Reported-by: Daniel Baluta Tested-by: Iuliana Prodan Reviewed-by: Iuliana Prodan Reviewed-by: Saravana Kannan Link: https://lore.kernel.org/r/20250820192805.565568-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 91a79b792204313153e1bdbbe5acbfc28903b3a5 Author: Florian Westphal Date: Wed Aug 20 14:37:07 2025 +0200 netfilter: nf_reject: don't leak dst refcount for loopback packets recent patches to add a WARN() when replacing skb dst entry found an old bug: WARNING: include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1210 [inline] WARNING: include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 [..] Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] .. This is because blamed commit forgot about loopback packets. Such packets already have a dst_entry attached, even at PRE_ROUTING stage. Instead of checking hook just check if the skb already has a route attached to it. Fixes: f53b9b0bdc59 ("netfilter: introduce support for reject at prerouting stage") Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20250820123707.10671-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit 6c4e68480238274f84aa50d54da0d9e262df6284 Author: Joshua Hay Date: Fri Jul 25 11:42:23 2025 -0700 idpf: remove obsolete stashing code With the new Tx buffer management scheme, there is no need for all of the stashing mechanisms, the hash table, the reserve buffer stack, etc. Remove all of that. Signed-off-by: Joshua Hay Reviewed-by: Madhu Chittim Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 0c3f135e840d4a2ba4253e15d530ec61bc30718e Author: Joshua Hay Date: Fri Jul 25 11:42:22 2025 -0700 idpf: stop Tx if there are insufficient buffer resources The Tx refillq logic will cause packets to be silently dropped if there are not enough buffer resources available to send a packet in flow scheduling mode. Instead, determine how many buffers are needed along with number of descriptors. Make sure there are enough of both resources to send the packet, and stop the queue if not. Fixes: 7292af042bcf ("idpf: fix a race in txq wakeup") Signed-off-by: Joshua Hay Reviewed-by: Madhu Chittim Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 5f417d551324d2894168b362f2429d120ab06243 Author: Joshua Hay Date: Fri Jul 25 11:42:21 2025 -0700 idpf: replace flow scheduling buffer ring with buffer pool Replace the TxQ buffer ring with one large pool/array of buffers (only for flow scheduling). This eliminates the tag generation and makes it impossible for a tag to be associated with more than one packet. The completion tag passed to HW through the descriptor is the index into the array. That same completion tag is posted back to the driver in the completion descriptor, and used to index into the array to quickly retrieve the buffer during cleaning. In this way, the tags are treated as a fix sized resource. If all tags are in use, no more packets can be sent on that particular queue (until some are freed up). The tag pool size is 64K since the completion tag width is 16 bits. For each packet, the driver pulls a free tag from the refillq to get the next free buffer index. When cleaning is complete, the tag is posted back to the refillq. A multi-frag packet spans multiple buffers in the driver, therefore it uses multiple buffer indexes/tags from the pool. Each frag pulls from the refillq to get the next free buffer index. These are tracked in a next_buf field that replaces the completion tag field in the buffer struct. This chains the buffers together so that the packet can be cleaned from the starting completion tag taken from the completion descriptor, then from the next_buf field for each subsequent buffer. In case of a dma_mapping_error occurs or the refillq runs out of free buf_ids, the packet will execute the rollback error path. This unmaps any buffers previously mapped for the packet. Since several free buf_ids could have already been pulled from the refillq, we need to restore its original state as well. Otherwise, the buf_ids/tags will be leaked and not used again until the queue is reallocated. Descriptor completions only advance the descriptor ring index to "clean" the descriptors. The packet completions only clean the buffers associated with the given packet completion tag and do not update the descriptor ring index. When operating in queue based scheduling mode, the array still acts as a ring and will only have TxQ descriptor count entries. The tx_bufs are still associated 1:1 with the descriptor ring entries and we can use the conventional indexing mechanisms. Fixes: c2d548cad150 ("idpf: add TX splitq napi poll support") Signed-off-by: Luigi Rizzo Signed-off-by: Brian Vazquez Signed-off-by: Joshua Hay Reviewed-by: Madhu Chittim Reviewed-by: Aleksandr Loktionov Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit b61dfa9bc4430ad82b96d3a7c1c485350f91b467 Author: Joshua Hay Date: Fri Jul 25 11:42:20 2025 -0700 idpf: simplify and fix splitq Tx packet rollback error path Move (and rename) the existing rollback logic to singleq.c since that will be the only consumer. Create a simplified splitq specific rollback function to loop through and unmap tx_bufs based on the completion tag. This is critical before replacing the Tx buffer ring with the buffer pool since the previous rollback indexing will not work to unmap the chained buffers from the pool. Cache the next_to_use index before any portion of the packet is put on the descriptor ring. In case of an error, the rollback will bump tail to the correct next_to_use value. Because the splitq path now supports different types of context descriptors (and potentially multiple in the future), this will take care of rolling back any and all context descriptors encoded on the ring for the erroneous packet. The previous rollback logic was broken for PTP packets since it would not account for the PTP context descriptor. Fixes: 1a49cf814fe1 ("idpf: add Tx timestamp flows") Signed-off-by: Joshua Hay Reviewed-by: Madhu Chittim Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit f2d18e16479cac7a708d77cbfb4220a9114a71fc Author: Joshua Hay Date: Fri Jul 25 11:42:19 2025 -0700 idpf: improve when to set RE bit logic Track the gap between next_to_use and the last RE index. Set RE again if the gap is large enough to ensure RE bit is set frequently. This is critical before removing the stashing mechanisms because the opportunistic descriptor ring cleaning from the out-of-order completions will go away. Previously the descriptors would be "cleaned" by both the descriptor (RE) completion and the out-of-order completions. Without the latter, we must ensure the RE bit is set more frequently. Otherwise, it's theoretically possible for the descriptor ring next_to_clean to never advance. The previous implementation was dependent on the start of a packet falling on a 64th index in the descriptor ring, which is not guaranteed with large packets. Signed-off-by: Luigi Rizzo Signed-off-by: Brian Vazquez Signed-off-by: Joshua Hay Reviewed-by: Madhu Chittim Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit cb83b559bea39f207ee214ee2972657e8576ed18 Author: Joshua Hay Date: Fri Jul 25 11:42:18 2025 -0700 idpf: add support for Tx refillqs in flow scheduling mode In certain production environments, it is possible for completion tags to collide, meaning N packets with the same completion tag are in flight at the same time. In this environment, any given Tx queue is effectively used to send both slower traffic and higher throughput traffic simultaneously. This is the result of a customer's specific configuration in the device pipeline, the details of which Intel cannot provide. This configuration results in a small number of out-of-order completions, i.e., a small number of packets in flight. The existing guardrails in the driver only protect against a large number of packets in flight. The slower flow completions are delayed which causes the out-of-order completions. The fast flow will continue sending traffic and generating tags. Because tags are generated on the fly, the fast flow eventually uses the same tag for a packet that is still in flight from the slower flow. The driver has no idea which packet it should clean when it processes the completion with that tag, but it will look for the packet on the buffer ring before the hash table. If the slower flow packet completion is processed first, it will end up cleaning the fast flow packet on the ring prematurely. This leaves the descriptor ring in a bad state resulting in a crash or Tx timeout. In summary, generating a tag when a packet is sent can lead to the same tag being associated with multiple packets. This can lead to resource leaks, crashes, and/or Tx timeouts. Before we can replace the tag generation, we need a new mechanism for the send path to know what tag to use next. The driver will allocate and initialize a refillq for each TxQ with all of the possible free tag values. During send, the driver grabs the next free tag from the refillq from next_to_clean. While cleaning the packet, the clean routine posts the tag back to the refillq's next_to_use to indicate that it is now free to use. This mechanism works exactly the same way as the existing Rx refill queues, which post the cleaned buffer IDs back to the buffer queue to be reposted to HW. Since we're using the refillqs for both Rx and Tx now, genericize some of the existing refillq support. Note: the refillqs will not be used yet. This is only demonstrating how they will be used to pass free tags back to the send path. Signed-off-by: Joshua Hay Reviewed-by: Madhu Chittim Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit 3868f910440c47cd5d158776be4ba4e2186beda7 Author: Peter Oberparleiter Date: Thu Aug 21 15:12:37 2025 +0200 s390/hypfs: Enable limited access during lockdown When kernel lockdown is active, debugfs_locked_down() blocks access to hypfs files that register ioctl callbacks, even if the ioctl interface is not required for a function. This unnecessarily breaks userspace tools that only rely on read operations. Resolve this by registering a minimal set of file operations during lockdown, avoiding ioctl registration and preserving access for affected tooling. Note that this change restores hypfs functionality when lockdown is active from early boot (e.g. via lockdown=integrity kernel parameter), but does not apply to scenarios where lockdown is enabled dynamically while Linux is running. Tested-by: Mete Durlu Reviewed-by: Vasily Gorbik Fixes: 5496197f9b08 ("debugfs: Restrict debugfs when the kernel is locked down") Signed-off-by: Peter Oberparleiter Signed-off-by: Alexander Gordeev commit fec7bdfe7f8694a0c39e6c3ec026ff61ca1058b9 Author: Peter Oberparleiter Date: Thu Aug 21 14:35:40 2025 +0200 s390/hypfs: Avoid unnecessary ioctl registration in debugfs Currently, hypfs registers ioctl callbacks for all debugfs files, despite only one file requiring them. This leads to unintended exposure of unused interfaces to user space and can trigger side effects such as restricted access when kernel lockdown is enabled. Restrict ioctl registration to only those files that implement ioctl functionality to avoid interface clutter and unnecessary access restrictions. Tested-by: Mete Durlu Reviewed-by: Vasily Gorbik Fixes: 5496197f9b08 ("debugfs: Restrict debugfs when the kernel is locked down") Signed-off-by: Peter Oberparleiter Signed-off-by: Alexander Gordeev commit 8410fe81093ff231e964891e215b624dabb734b0 Author: Takashi Iwai Date: Thu Aug 21 17:08:34 2025 +0200 ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation The entry of the validators table for UAC3 feature unit is defined with a wrong sub-type UAC_FEATURE (= 0x06) while it should have been UAC3_FEATURE (= 0x07). This patch corrects the entry value. Fixes: 57f8770620e9 ("ALSA: usb-audio: More validations of descriptor units") Link: https://patch.msgid.link/20250821150835.8894-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 1b78236a059310db58c22fe92ddd11dbf0552266 Merge: 7ef353879f7146 8b0587a885fdb3 Author: Jakub Kicinski Date: Thu Aug 21 07:58:35 2025 -0700 Merge branch 'mlx5-misx-fixes-2025-08-20' Mark Bloch says: ==================== mlx5 misx fixes 2025-08-20 This patchset provides misc bug fixes from the team to the mlx5 core and Eth drivers. v1: https://lore.kernel.org/1755095476-414026-1-git-send-email-tariqt@nvidia.com ==================== Link: https://patch.msgid.link/20250820133209.389065-1-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 8b0587a885fdb34fd6090a3f8625cb7ac1444826 Author: Armen Ratner Date: Wed Aug 20 16:32:09 2025 +0300 net/mlx5e: Preserve shared buffer capacity during headroom updates When port buffer headroom changes, port_update_shared_buffer() recalculates the shared buffer size and splits it in a 3:1 ratio (lossy:lossless) - Currently, the calculation is: lossless = shared / 4; lossy = (shared / 4) * 3; Meaning, the calculation dropped the remainder of shared % 4 due to integer division, unintentionally reducing the total shared buffer by up to three cells on each update. Over time, this could shrink the buffer below usable size. Fix it by changing the calculation to: lossless = shared / 4; lossy = shared - lossless; This retains all buffer cells while still approximating the intended 3:1 split, preventing capacity loss over time. While at it, perform headroom calculations in units of cells rather than in bytes for more accurate calculations avoiding extra divisions. Fixes: a440030d8946 ("net/mlx5e: Update shared buffer along with device buffer changes") Signed-off-by: Armen Ratner Signed-off-by: Maher Sanalla Reviewed-by: Tariq Toukan Signed-off-by: Alexei Lazar Signed-off-by: Mark Bloch Reviewed-by: Przemek Kitszel Link: https://patch.msgid.link/20250820133209.389065-9-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 451d2849ea66659040b59ae3cb7e50cc97404733 Author: Alexei Lazar Date: Wed Aug 20 16:32:08 2025 +0300 net/mlx5e: Query FW for buffer ownership The SW currently saves local buffer ownership when setting the buffer. This means that the SW assumes it has ownership of the buffer after the command is set. If setting the buffer fails and we remain in FW ownership, the local buffer ownership state incorrectly remains as SW-owned. This leads to incorrect behavior in subsequent PFC commands, causing failures. Instead of saving local buffer ownership in SW, query the FW for buffer ownership when setting the buffer. This ensures that the buffer ownership state is accurately reflected, avoiding the issues caused by incorrect ownership states. Fixes: ecdf2dadee8e ("net/mlx5e: Receive buffer support for DCBX") Signed-off-by: Alexei Lazar Reviewed-by: Shahar Shitrit Reviewed-by: Dragos Tatulea Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250820133209.389065-8-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 51b17c98e3dbb2093a81b0490050a0eaa919ebee Author: Carolina Jubran Date: Wed Aug 20 16:32:07 2025 +0300 net/mlx5: Restore missing scheduling node cleanup on vport enable failure Restore the __esw_qos_free_node() call removed by the offending commit. Fixes: 97733d1e00a0 ("net/mlx5: Add traffic class scheduling support for vport QoS") Signed-off-by: Carolina Jubran Reviewed-by: Tariq Toukan Reviewed-by: Cosmin Ratiu Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250820133209.389065-7-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 3c114fb2afe493066df5b9e560ef37216b153c90 Author: Carolina Jubran Date: Wed Aug 20 16:32:06 2025 +0300 net/mlx5: Fix QoS reference leak in vport enable error path Add missing esw_qos_put() call when __esw_qos_alloc_node() fails in mlx5_esw_qos_vport_enable(). Fixes: be034baba83e ("net/mlx5: Make vport QoS enablement more flexible for future extensions") Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250820133209.389065-6-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit b697ef4d1d136948d282384e6cc3d1af469ea123 Author: Carolina Jubran Date: Wed Aug 20 16:32:05 2025 +0300 net/mlx5: Destroy vport QoS element when no configuration remains If a VF has been configured and the user later clears all QoS settings, the vport element remains in the firmware QoS tree. This leads to inconsistent behavior compared to VFs that were never configured, since the FW assumes that unconfigured VFs are outside the QoS hierarchy. As a result, the bandwidth share across VFs may differ, even though none of them appear to have any configuration. Align the driver behavior with the FW expectation by destroying the vport QoS element when all configurations are removed. Fixes: c9497c98901c ("net/mlx5: Add support for setting VF min rate") Fixes: cf7e73770d1b ("net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw") Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Mark Bloch Reviewed-by: Przemek Kitszel Link: https://patch.msgid.link/20250820133209.389065-5-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit e8f973576ca5387ffd2917b8ae661d3f9acde526 Author: Carolina Jubran Date: Wed Aug 20 16:32:04 2025 +0300 net/mlx5e: Preserve tc-bw during parent changes When changing parent of a node/leaf with tc-bw configured, the code saves and restores tc-bw values. However, it was reading the converted hardware bw_share values (where 0 becomes 1) instead of the original user values, causing incorrect tc-bw calculations after parent change. Store original tc-bw values in the node structure and use them directly for save/restore operations. Fixes: cf7e73770d1b ("net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw") Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250820133209.389065-4-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 330f0f6713a39581936decac72331e6ab7f13529 Author: Carolina Jubran Date: Wed Aug 20 16:32:03 2025 +0300 net/mlx5: Remove default QoS group and attach vports directly to root TSAR Currently, the driver creates a default group (`node0`) and attaches all vports to it unless the user explicitly sets a parent group. As a result, when a user configures tx_share on a group and tx_share on a VF, the expectation is for the group and the VF to share bandwidth relatively. However, since the VF is not connected to the same parent (but to the default node), the proportional share logic is not applied correctly. To fix this, remove the default group (`node0`) and instead connect vports directly to the root TSAR when no parent is specified. This ensures that vports and groups share the same root scheduler and their tx_share values are compared directly under the same hierarchy. Fixes: 0fe132eac38c ("net/mlx5: E-switch, Allow to add vports to rate groups") Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250820133209.389065-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit bc17455bc843b2f4b206e0bb8139013eb3d3c08b Author: Daniel Jurgens Date: Wed Aug 20 16:32:02 2025 +0300 net/mlx5: Base ECVF devlink port attrs from 0 Adjust the vport number by the base ECVF vport number so the port attributes start at 0. Previously the port attributes would start 1 after the maximum number of host VFs. Fixes: dc13180824b7 ("net/mlx5: Enable devlink port for embedded cpu VF vports") Signed-off-by: Daniel Jurgens Reviewed-by: Parav Pandit Reviewed-by: Saeed Mahameed Signed-off-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250820133209.389065-2-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 7ef353879f714602b43f98662069f4fb86536761 Author: Kory Maincent Date: Wed Aug 20 15:33:21 2025 +0200 net: pse-pd: pd692x0: Skip power budget configuration when undefined If the power supply's power budget is not defined in the device tree, the current code still requests power and configures the PSE manager with a 0W power limit, which is undesirable behavior. Skip power budget configuration entirely when the budget is zero, avoiding unnecessary power requests and preventing invalid 0W limits from being set on the PSE manager. Fixes: 359754013e6a ("net: pse-pd: pd692x0: Add support for PSE PI priority feature") Signed-off-by: Kory Maincent Acked-by: Oleksij Rempel Link: https://patch.msgid.link/20250820133321.841054-1-kory.maincent@bootlin.com Signed-off-by: Jakub Kicinski commit 1c67f9c54cdc70627e3f6472b89cd3d895df974c Author: Kory Maincent Date: Wed Aug 20 15:27:07 2025 +0200 net: pse-pd: pd692x0: Fix power budget leak in manager setup error path Fix a resource leak where manager power budgets were freed on both success and error paths during manager setup. Power budgets should only be freed on error paths after regulator registration or during driver removal. Refactor cleanup logic by extracting OF node cleanup and power budget freeing into separate helper functions for better maintainability. Fixes: 359754013e6a ("net: pse-pd: pd692x0: Add support for PSE PI priority feature") Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20250820132708.837255-1-kory.maincent@bootlin.com Signed-off-by: Jakub Kicinski commit 8c5d95988c34f0aeba1f34cd5e4ba69494c90c5f Author: Hariprasad Kelam Date: Wed Aug 20 12:09:18 2025 +0530 Octeontx2-af: Skip overlap check for SPI field Octeontx2/CN10K silicon supports generating a 256-bit key per packet. The specific fields to be extracted from a packet for key generation are configurable via a Key Extraction (MKEX) Profile. The AF driver scans the configured extraction profile to ensure that fields from upper layers do not overwrite fields from lower layers in the key. Example Packet Field Layout: LA: DMAC + SMAC LB: VLAN LC: IPv4/IPv6 LD: TCP/UDP Valid MKEX Profile Configuration: LA -> DMAC -> key_offset[0-5] LC -> SIP -> key_offset[20-23] LD -> SPORT -> key_offset[30-31] Invalid MKEX profile configuration: LA -> DMAC -> key_offset[0-5] LC -> SIP -> key_offset[20-23] LD -> SPORT -> key_offset[2-3] // Overlaps with DMAC field In another scenario, if the MKEX profile is configured to extract the SPI field from both AH and ESP headers at the same key offset, the driver rejecting this configuration. In a regular traffic, ipsec packet will be having either AH(LD) or ESP (LE). This patch relaxes the check for the same. Fixes: 12aa0a3b93f3 ("octeontx2-af: Harden rule validation.") Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20250820063919.1463518-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit a61a3e961baff65b0a49f862fe21ce304f279b24 Author: Jakub Kicinski Date: Tue Aug 19 19:19:52 2025 -0700 selftests: tls: add tests for zero-length records Test various combinations of zero-length records. Unfortunately, kernel cannot be coerced into producing those, so hardcode the ciphertext messages in the test. Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250820021952.143068-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 62708b9452f8eb77513115b17c4f8d1a22ebf843 Author: Jakub Kicinski Date: Tue Aug 19 19:19:51 2025 -0700 tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record has different type than what has already been processed we break out of the main processing loop. If the record has already been decrypted (which may be the case for TLS 1.3 where we don't know type until decryption) we queue the pending record to the rx_list. Next recvmsg() will pick it up from there. Queuing the skb to rx_list after zero-copy decrypt is not possible, since in that case we decrypted directly to the user space buffer, and we don't have an skb to queue (darg.skb points to the ciphertext skb for access to metadata like length). Only data records are allowed zero-copy, and we break the processing loop after each non-data record. So we should never zero-copy and then find out that the record type has changed. The corner case we missed is when the initial record comes from rx_list, and it's zero length. Reported-by: Muhammad Alifa Ramdhan Reported-by: Billy Jheng Bing-Jhong Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Reviewed-by: Sabrina Dubroca Link: https://patch.msgid.link/20250820021952.143068-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1c656b1efde6ce86a6c810d27a5f925e938d568d Merge: 32b7144f806e23 538c06e3964a8e Author: Linus Torvalds Date: Thu Aug 21 10:37:33 2025 -0400 Merge tag 'loongarch-fixes-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch fixes from Huacai Chen: "Fix a lot of build warnings for LTO-enabled objtool check, increase COMMAND_LINE_SIZE up to 4096, rename a missing GCC_PLUGIN_STACKLEAK to KSTACK_ERASE, and fix some bugs about arch timer, module loading, LBT and KVM" * tag 'loongarch-fixes-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: KVM: Add address alignment check in pch_pic register access LoongArch: KVM: Use kvm_get_vcpu_by_id() instead of kvm_get_vcpu() LoongArch: KVM: Fix stack protector issue in send_ipi_data() LoongArch: KVM: Make function kvm_own_lbt() robust LoongArch: Rename GCC_PLUGIN_STACKLEAK to KSTACK_ERASE LoongArch: Save LBT before FPU in setup_sigcontext() LoongArch: Optimize module load time by optimizing PLT/GOT counting LoongArch: Add cpuhotplug hooks to fix high cpu usage of vCPU threads LoongArch: Increase COMMAND_LINE_SIZE up to 4096 LoongArch: Pass annotate-tablejump option if LTO is enabled objtool/LoongArch: Get table size correctly if LTO is enabled commit 220abf77e7c2835cc63ea8cd7158cf83952640af Author: Gautham R. Shenoy Date: Thu Aug 21 09:56:38 2025 +0530 cpufreq/amd-pstate: Fix setting of CPPC.min_perf in active mode for performance governor In the "active" mode of the amd-pstate driver with performance governor, the CPPC.min_perf is expected to be the nominal_perf. However after commit a9b9b4c2a4cd ("cpufreq/amd-pstate: Drop min and max cached frequencies"), this is not the case when the governor is switched from performance to powersave and back to performance, and the CPPC.min_perf will be equal to the scaling_min_freq that was set for the powersave governor. This is because prior to commit a9b9b4c2a4cd ("cpufreq/amd-pstate: Drop min and max cached frequencies"), amd_pstate_epp_update_limit() would unconditionally call amd_pstate_update_min_max_limit() and the latter function would enforce the CPPC.min_perf constraint when the governor is performance. However, after the aforementioned commit, amd_pstate_update_min_max_limit() is called by amd_pstate_epp_update_limit() only when either the scaling_{min/max}_freq is different from the cached value of cpudata->{min/max}_limit_freq, which wouldn't have changed on a governor transition from powersave to performance, thus missing out on enforcing the CPPC.min_perf constraint for the performance governor. Fix this by invoking amd_pstate_epp_udpate_limit() not only when the {min/max} limits have changed from the cached values, but also when the policy itself has changed. Fixes: a9b9b4c2a4cd ("cpufreq/amd-pstate: Drop min and max cached frequencies") Signed-off-by: Gautham R. Shenoy Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20250821042638.356-1-gautham.shenoy@amd.com Signed-off-by: Mario Limonciello (AMD) commit 370ac285f23aecae40600851fb4a1a9e75e50973 Author: Nilay Shroff Date: Thu Aug 14 13:54:59 2025 +0530 block: avoid cpu_hotplug_lock depedency on freeze_lock A recent lockdep[1] splat observed while running blktest block/005 reveals a potential deadlock caused by the cpu_hotplug_lock dependency on ->freeze_lock. This dependency was introduced by commit 033b667a823e ("block: blk-rq-qos: guard rq-qos helpers by static key"). That change added a static key to avoid fetching q->rq_qos when neither blk-wbt nor blk-iolatency is configured. The static key dynamically patches kernel text to a NOP when disabled, eliminating overhead of fetching q->rq_qos in the I/O hot path. However, enabling a static key at runtime requires acquiring both cpu_hotplug_lock and jump_label_mutex. When this happens after the queue has already been frozen (i.e., while holding ->freeze_lock), it creates a locking dependency from cpu_hotplug_lock to ->freeze_lock, which leads to a potential deadlock reported by lockdep [1]. To resolve this, replace the static key mechanism with q->queue_flags: QUEUE_FLAG_QOS_ENABLED. This flag is evaluated in the fast path before accessing q->rq_qos. If the flag is set, we proceed to fetch q->rq_qos; otherwise, the access is skipped. Since q->queue_flags is commonly accessed in IO hotpath and resides in the first cacheline of struct request_queue, checking it imposes minimal overhead while eliminating the deadlock risk. This change avoids the lockdep splat without introducing performance regressions. [1] https://lore.kernel.org/linux-block/4fdm37so3o4xricdgfosgmohn63aa7wj3ua4e5vpihoamwg3ui@fq42f5q5t5ic/ Reported-by: Shinichiro Kawasaki Closes: https://lore.kernel.org/linux-block/4fdm37so3o4xricdgfosgmohn63aa7wj3ua4e5vpihoamwg3ui@fq42f5q5t5ic/ Fixes: 033b667a823e ("block: blk-rq-qos: guard rq-qos helpers by static key") Tested-by: Shin'ichiro Kawasaki Signed-off-by: Nilay Shroff Reviewed-by: Ming Lei Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20250814082612.500845-4-nilay@linux.ibm.com Signed-off-by: Jens Axboe commit ade1beea1c27657712aa8f594226d461639382ff Author: Nilay Shroff Date: Thu Aug 14 13:54:58 2025 +0530 block: decrement block_rq_qos static key in rq_qos_del() rq_qos_add() increments the block_rq_qos static key when a QoS policy is attached. When a QoS policy is removed via rq_qos_del(), we must symmetrically decrement the static key. If this removal drops the last QoS policy from the queue (q->rq_qos becomes NULL), the static branch can be disabled and the jump label patched to a NOP, avoiding overhead on the hot path. This change ensures rq_qos_add()/rq_qos_del() keep the block_rq_qos static key balanced and prevents leaving the branch permanently enabled after the last policy is removed. Fixes: 033b667a823e ("block: blk-rq-qos: guard rq-qos helpers by static key") Signed-off-by: Nilay Shroff Reviewed-by: Ming Lei Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20250814082612.500845-3-nilay@linux.ibm.com Signed-off-by: Jens Axboe commit 275332877e2fa9d6efa7402b1e897f6c6ee695bb Author: Nilay Shroff Date: Thu Aug 14 13:54:57 2025 +0530 block: skip q->rq_qos check in rq_qos_done_bio() If a bio has BIO_QOS_THROTTLED or BIO_QOS_MERGED set, it implicitly guarantees that q->rq_qos is present. Avoid re-checking q->rq_qos in this case and call __rq_qos_done_bio() directly as a minor optimization. Suggested-by : Yu Kuai Signed-off-by: Nilay Shroff Reviewed-by: Ming Lei Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20250814082612.500845-2-nilay@linux.ibm.com Signed-off-by: Jens Axboe commit 7c7cda81159b1abe7d50bcef2ccc6f662e225c8b Author: Raphael Gallais-Pou Date: Wed Aug 20 20:03:10 2025 +0200 spi: st: fix PM macros to use CONFIG_PM instead of CONFIG_PM_SLEEP pm_sleep_ptr() depends on CONFIG_PM_SLEEP while pm_ptr() depends on CONFIG_PM. Since ST SSC4 implements runtime PM it makes sense using pm_ptr() here. For the same reason replace PM macros that use CONFIG_PM. Doing so prevents from using __maybe_unused attribute of runtime PM functions. Link: https://lore.kernel.org/lkml/CAMuHMdX9nkROkAJJ5odv4qOWe0bFTmaFs=Rfxsfuc9+DT-bsEQ@mail.gmail.com Fixes: 6f8584a4826f ("spi: st: Switch from CONFIG_PM_SLEEP guards to pm_sleep_ptr()") Signed-off-by: Raphael Gallais-Pou Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250820180310.9605-1-rgallaispou@gmail.com Signed-off-by: Mark Brown commit be1e0283021ec73c2eb92839db9a471a068709d9 Author: Christian Brauner Date: Thu Aug 21 13:50:47 2025 +0200 coredump: don't pointlessly check and spew warnings When a write happens it doesn't make sense to check perform checks on the input. Skip them. Whether a fixes tag is licensed is a bit of a gray area here but I'll add one for the socket validation part I added recently. Link: https://lore.kernel.org/20250821-moosbedeckt-denunziant-7908663f3563@brauner Fixes: 16195d2c7dd2 ("coredump: validate socket name as it is written") Reported-by: Brad Spengler Signed-off-by: Christian Brauner commit 32b7144f806e231a3fb619d4ddc5a6bffb731715 Merge: eb4a0992ddae04 fd7e5de4b2eddd Author: Linus Torvalds Date: Thu Aug 21 04:54:01 2025 -0700 Merge tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library fixes from Eric Biggers: "Fix a regression where 'make clean' stopped removing some of the generated assembly files on arm and arm64" * tag 'libcrypto-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: ensure generated *.S files are removed on make clean lib/crypto: sha: Update Kconfig help for SHA1 and SHA256 commit eb4a0992ddae04ad5b402029a430b2fa06c81647 Merge: 068a56e56fa81e 89bb430f621124 Author: Linus Torvalds Date: Thu Aug 21 04:48:41 2025 -0700 Merge tag '6.17-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - fix refcount issue that can cause memory leak - rate limit repeated connections from IPv6, not just IPv4 addresses - fix potential null pointer access of smb direct work queue * tag '6.17-rc2-ksmbd-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix refcount leak causing resource not released ksmbd: extend the connection limiting mechanism to support IPv6 smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() commit 2d82f3bd8910eb65e30bb2a3c9b945bfb3b6d661 Author: Ming Lei Date: Fri Aug 15 21:17:37 2025 +0800 blk-mq: fix lockdep warning in __blk_mq_update_nr_hw_queues Commit 5989bfe6ac6b ("block: restore two stage elevator switch while running nr_hw_queue update") reintroduced a lockdep warning by calling blk_mq_freeze_queue_nomemsave() before switching the I/O scheduler. The function blk_mq_elv_switch_none() calls elevator_change_done(). Running this while the queue is frozen causes a lockdep warning. Fix this by reordering the operations: first, switch the I/O scheduler to 'none', and then freeze the queue. This ensures that elevator_change_done() is not called on an already frozen queue. And this way is safe because elevator_set_none() does freeze queue before switching to none. Also we still have to rely on blk_mq_elv_switch_back() for switching back, and it has to cover unfrozen queue case. Cc: Nilay Shroff Cc: Yu Kuai Fixes: 5989bfe6ac6b ("block: restore two stage elevator switch while running nr_hw_queue update") Signed-off-by: Ming Lei Reviewed-by: Yu Kuai Reviewed-by: Nilay Shroff Link: https://lore.kernel.org/r/20250815131737.331692-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 16c07342b5425b86547146a6e51d9e32cee8d300 Author: Mario Limonciello (AMD) Date: Wed Aug 20 18:33:11 2025 -0500 gpiolib: acpi: Program debounce when finding GPIO When soc-button-array looks up the GPIO to use it calls acpi_find_gpio() which will parse _CRS. acpi_find_gpio.cold (drivers/gpio/gpiolib-acpi-core.c:953) gpiod_find_and_request (drivers/gpio/gpiolib.c:4598 drivers/gpio/gpiolib.c:4625) gpiod_get_index (drivers/gpio/gpiolib.c:4877) The GPIO is setup basically, but the debounce information is discarded. The platform will assert what debounce should be in _CRS, so program it at the time it's available. Reviewed-by: Mika Westerberg Signed-off-by: Mario Limonciello (AMD) Signed-off-by: Andy Shevchenko commit 9f6b606b6b37e61427412708411e8e04b1a858e8 Author: Lorenzo Bianconi Date: Mon Aug 18 11:58:25 2025 +0200 net: airoha: ppe: Do not invalid PPE entries in case of SW hash collision SW hash computed by airoha_ppe_foe_get_entry_hash routine (used for foe_flow hlist) can theoretically produce collisions between two different HW PPE entries. In airoha_ppe_foe_insert_entry() if the collision occurs we will mark the second PPE entry in the list as stale (setting the hw hash to 0xffff). Stale entries are no more updated in airoha_ppe_foe_flow_entry_update routine and so they are removed by Netfilter. Fix the problem not marking the second entry as stale in airoha_ppe_foe_insert_entry routine if we have already inserted the brand new entry in the PPE table and let Netfilter remove real stale entries according to their timestamp. Please note this is just a theoretical issue spotted reviewing the code and not faced running the system. Fixes: cd53f622611f9 ("net: airoha: Add L2 hw acceleration support") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250818-airoha-en7581-hash-collision-fix-v1-1-d190c4b53d1c@kernel.org Signed-off-by: Paolo Abeni commit d2d7a96b29ea6ab093973a1a37d26126db70c79f Author: Judith Mendez Date: Wed Aug 20 14:30:47 2025 -0500 mmc: sdhci_am654: Disable HS400 for AM62P SR1.0 and SR1.1 This adds SDHCI_AM654_QUIRK_DISABLE_HS400 quirk which shall be used to disable HS400 support. AM62P SR1.0 and SR1.1 do not support HS400 due to errata i2458 [0] so disable HS400 for these SoC revisions. [0] https://www.ti.com/lit/er/sprz574a/sprz574a.pdf Fixes: 37f28165518f ("arm64: dts: ti: k3-am62p: Add ITAP/OTAP values for MMC") Cc: stable@vger.kernel.org Signed-off-by: Judith Mendez Reviewed-by: Andrew Davis Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250820193047.4064142-1-jm@ti.com Signed-off-by: Ulf Hansson commit 41a86f62424ac436cb51e3de612ef1e1ddb0c873 Author: Guopeng Zhang Date: Wed Aug 20 21:34:24 2025 +0800 fs: fix indentation style Replace 8 leading spaces with a tab to follow kernel coding style. Signed-off-by: Guopeng Zhang Link: https://lore.kernel.org/20250820133424.1667467-1-zhangguopeng@kylinos.cn Signed-off-by: Christian Brauner commit 184fa9d704bd6b96979ff57eed9e8c51203bec57 Merge: c42be534547d6e 87951b566446da Author: Paolo Abeni Date: Thu Aug 21 09:35:24 2025 +0200 Merge branch 'bonding-fix-negotiation-flapping-in-802-3ad-passive-mode' Hangbin Liu says: ==================== bonding: fix negotiation flapping in 802.3ad passive mode This patch fixes unstable LACP negotiation when bonding is configured in passive mode (`lacp_active=off`). Previously, the actor would stop sending LACPDUs after initial negotiation succeeded, leading to the partner timing out and restarting the negotiation cycle. This resulted in continuous LACP state flapping. The fix ensures the passive actor starts sending periodic LACPDUs after receiving the first LACPDU from the partner, in accordance with IEEE 802.1AX-2020 section 6.4.1. ==================== Link: https://patch.msgid.link/20250815062000.22220-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 87951b566446da04eed1fe8100f99a512ef02756 Author: Hangbin Liu Date: Fri Aug 15 06:20:00 2025 +0000 selftests: bonding: add test for passive LACP mode Add a selftest to verify bonding behavior when `lacp_active` is set to `off`. The test checks the following: - The passive LACP bond should not send LACPDUs before receiving a partner's LACPDU. - The transmitted LACPDUs must not include the active flag. - After transitioning to EXPIRED and DEFAULTED states, the passive side should still not initiate LACPDUs. Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250815062000.22220-4-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 0599640a21e98f0d6a3e9ff85c0a687c90a8103b Author: Hangbin Liu Date: Fri Aug 15 06:19:59 2025 +0000 bonding: send LACPDUs periodically in passive mode after receiving partner's LACPDU When `lacp_active` is set to `off`, the bond operates in passive mode, meaning it only "speaks when spoken to." However, the current kernel implementation only sends an LACPDU in response when the partner's state changes. As a result, once LACP negotiation succeeds, the actor stops sending LACPDUs until the partner times out and sends an "expired" LACPDU. This causes continuous LACP state flapping. According to IEEE 802.1AX-2014, 6.4.13 Periodic Transmission machine. The values of Partner_Oper_Port_State.LACP_Activity and Actor_Oper_Port_State.LACP_Activity determine whether periodic transmissions take place. If either or both parameters are set to Active LACP, then periodic transmissions occur; if both are set to Passive LACP, then periodic transmissions do not occur. To comply with this, we remove the `!bond->params.lacp_active` check in `ad_periodic_machine()`. Instead, we initialize the actor's port's `LACP_STATE_LACP_ACTIVITY` state based on `lacp_active` setting. Additionally, we avoid setting the partner's state to `LACP_STATE_LACP_ACTIVITY` in the EXPIRED state, since we should not assume the partner is active by default. This ensures that in passive mode, the bond starts sending periodic LACPDUs after receiving one from the partner, and avoids flapping due to inactivity. Fixes: 3a755cd8b7c6 ("bonding: add new option lacp_active") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250815062000.22220-3-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit b64d035f77b1f02ab449393342264b44950a75ae Author: Hangbin Liu Date: Fri Aug 15 06:19:58 2025 +0000 bonding: update LACP activity flag after setting lacp_active The port's actor_oper_port_state activity flag should be updated immediately after changing the lacp_active option to reflect the current mode correctly. Fixes: 3a755cd8b7c6 ("bonding: add new option lacp_active") Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250815062000.22220-2-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 5003a65790ed66be882d1987cc2ca86af0de3db1 Author: Dewei Meng Date: Thu Aug 21 09:43:17 2025 +0800 ALSA: timer: fix ida_free call while not allocated In the snd_utimer_create() function, if the kasprintf() function return NULL, snd_utimer_put_id() will be called, finally use ida_free() to free the unallocated id 0. the syzkaller reported the following information: ------------[ cut here ]------------ ida_free called for id=0 which is not allocated. WARNING: CPU: 1 PID: 1286 at lib/idr.c:592 ida_free+0x1fd/0x2f0 lib/idr.c:592 Modules linked in: CPU: 1 UID: 0 PID: 1286 Comm: syz-executor164 Not tainted 6.15.8 #3 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.fc42 04/01/2014 RIP: 0010:ida_free+0x1fd/0x2f0 lib/idr.c:592 Code: f8 fc 41 83 fc 3e 76 69 e8 70 b2 f8 (...) RSP: 0018:ffffc900007f79c8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 1ffff920000fef3b RCX: ffffffff872176a5 RDX: ffff88800369d200 RSI: 0000000000000000 RDI: ffff88800369d200 RBP: 0000000000000000 R08: ffffffff87ba60a5 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000 FS: 00007f6f1abc1740(0000) GS:ffff8880d76a0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6f1ad7a784 CR3: 000000007a6e2000 CR4: 00000000000006f0 Call Trace: snd_utimer_put_id sound/core/timer.c:2043 [inline] [snd_timer] snd_utimer_create+0x59b/0x6a0 sound/core/timer.c:2184 [snd_timer] snd_utimer_ioctl_create sound/core/timer.c:2202 [inline] [snd_timer] __snd_timer_user_ioctl.isra.0+0x724/0x1340 sound/core/timer.c:2287 [snd_timer] snd_timer_user_ioctl+0x75/0xc0 sound/core/timer.c:2298 [snd_timer] vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __x64_sys_ioctl+0x198/0x200 fs/ioctl.c:893 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x7b/0x160 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e [...] The utimer->id should be set properly before the kasprintf() function, ensures the snd_utimer_put_id() function will free the allocated id. Fixes: 37745918e0e75 ("ALSA: timer: Introduce virtual userspace-driven timers") Signed-off-by: Dewei Meng Link: https://patch.msgid.link/20250821014317.40786-1-mengdewei@cqsoftware.com.cn Signed-off-by: Takashi Iwai commit 279eb50aa8b6b6b69a57a2a7f0bba24dda44f102 Merge: 3f4422e7c9436a 7c15e4cabfa96e Author: Takashi Iwai Date: Thu Aug 21 09:02:28 2025 +0200 Merge tag 'asoc-fix-v6.17-rc2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.17 A few fixes that came in during the past week, there's some updates for the CS35L56 which adjust the driver for production silicon and a fix for buggy resume of the ES9389. commit dbb2c3adc4a641d9f136005285bcbba15227249c Merge: 98c4a3f4ae01c9 297a4833a68aac Author: Dave Airlie Date: Thu Aug 21 16:26:47 2025 +1000 Merge tag 'amd-drm-fixes-6.17-2025-08-20' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.17-2025-08-20: amdgpu: - Replay fixes - SMU14 fix - Null check DC fixes - DCE6 DC fixes - Misc DC fixes Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250820194636.101975-1-alexander.deucher@amd.com commit c42be534547d6e45c155c347dd792b6ad9c24def Author: Ryan Wanner Date: Tue Aug 19 09:32:30 2025 -0700 Revert "net: cadence: macb: sama7g5_emac: Remove USARIO CLKEN flag" This reverts commit db400061b5e7cc55f9b4dd15443e9838964119ea. This commit can cause a Devicetree ABI break for older DTS files that rely this flag for RMII configuration. Adding this back in ensures that the older DTBs will not break. Fixes: db400061b5e7 ("net: cadence: macb: sama7g5_emac: Remove USARIO CLKEN flag") Signed-off-by: Ryan Wanner Link: https://patch.msgid.link/20250819163236.100680-1-Ryan.Wanner@microchip.com Signed-off-by: Jakub Kicinski commit a458b2902115b26a25d67393b12ddd57d1216aaa Author: Eric Biggers Date: Mon Aug 18 13:27:24 2025 -0700 ipv6: sr: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this. Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Reviewed-by: Andrea Mayer Link: https://patch.msgid.link/20250818202724.15713-1-ebiggers@kernel.org Signed-off-by: Jakub Kicinski commit 7af76e9d18a9fd6f8611b3313c86c190f9b6a5a7 Author: Jakub Acs Date: Tue Aug 19 08:28:42 2025 +0000 net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 [ 45.392559] ------------[ cut here ]------------ [ 45.392912] kernel BUG at net/core/skbuff.c:211! [ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) [ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 [ 45.402911] Call Trace: [ 45.403105] [ 45.404470] skb_push+0xcd/0xf0 [ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 [ 45.406513] br_forward_finish+0x128/0x260 [ 45.408483] __br_forward+0x42d/0x590 [ 45.409464] maybe_deliver+0x2eb/0x420 [ 45.409763] br_flood+0x174/0x4a0 [ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 [ 45.411618] br_handle_frame+0xac3/0x1230 [ 45.413674] __netif_receive_skb_core.constprop.0+0x808/0x3df0 [ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 [ 45.424478] __netif_receive_skb+0x22/0x170 [ 45.424806] process_backlog+0x242/0x6d0 [ 45.425116] __napi_poll+0xbb/0x630 [ 45.425394] net_rx_action+0x4d1/0xcc0 [ 45.427613] handle_softirqs+0x1a4/0x580 [ 45.427926] do_softirq+0x74/0x90 [ 45.428196] This issue was found by syzkaller. The panic happens in br_dev_queue_push_xmit() once it receives a corrupted skb with ETH header already pushed in linear data. When it attempts the skb_push() call, there's not enough headroom and skb_push() panics. The corrupted skb is put on the queue by HSR layer, which makes a sequence of unintended transformations when it receives a specific corrupted HSR frame (with incomplete TAG). Fix it by dropping and consuming frames that are not long enough to contain both ethernet and hsr headers. Alternative fix would be to check for enough headroom before skb_push() in br_dev_queue_push_xmit(). In the reproducer, this is injected via AF_PACKET, but I don't easily see why it couldn't be sent over the wire from adjacent network. Further Details: In the reproducer, the following network interface chain is set up: ┌────────────────┐ ┌────────────────┐ │ veth0_to_hsr ├───┤ hsr_slave0 ┼───┐ └────────────────┘ └────────────────┘ │ │ ┌──────┐ ├─┤ hsr0 ├───┐ │ └──────┘ │ ┌────────────────┐ ┌────────────────┐ │ │┌────────┐ │ veth1_to_hsr ┼───┤ hsr_slave1 ├───┘ └┤ │ └────────────────┘ └────────────────┘ ┌┼ bridge │ ││ │ │└────────┘ │ ┌───────┐ │ │ ... ├──────┘ └───────┘ To trigger the events leading up to crash, reproducer sends a corrupted HSR frame with incomplete TAG, via AF_PACKET socket on 'veth0_to_hsr'. The first HSR-layer function to process this frame is hsr_handle_frame(). It and then checks if the protocol is ETH_P_PRP or ETH_P_HSR. If it is, it calls skb_set_network_header(skb, ETH_HLEN + HSR_HLEN), without checking that the skb is long enough. For the crashing frame it is not, and hence the skb->network_header and skb->mac_len fields are set incorrectly, pointing after the end of the linear buffer. I will call this a BUG#1 and it is what is addressed by this patch. In the crashing scenario before the fix, the skb continues to go down the hsr path as follows. hsr_handle_frame() then calls this sequence hsr_forward_skb() fill_frame_info() hsr->proto_ops->fill_frame_info() hsr_fill_frame_info() hsr_fill_frame_info() contains a check that intends to check whether the skb actually contains the HSR header. But the check relies on the skb->mac_len field which was erroneously setup due to BUG#1, so the check passes and the execution continues back in the hsr_forward_skb(): hsr_forward_skb() hsr_forward_do() hsr->proto_ops->get_untagged_frame() hsr_get_untagged_frame() create_stripped_skb_hsr() In create_stripped_skb_hsr(), a copy of the skb is created and is further corrupted by operation that attempts to strip the HSR tag in a call to __pskb_copy(). The skb enters create_stripped_skb_hsr() with ethernet header pushed in linear buffer. The skb_pull(skb_in, HSR_HLEN) thus pulls 6 bytes of ethernet header into the headroom, creating skb_in with a headroom of size 8. The subsequent __pskb_copy() then creates an skb with headroom of just 2 and skb->len of just 12, this is how it looks after the copy: gdb) p skb->len $10 = 12 (gdb) p skb->data $11 = (unsigned char *) 0xffff888041e45382 "\252\252\252\252\252!\210\373", (gdb) p skb->head $12 = (unsigned char *) 0xffff888041e45380 "" It seems create_stripped_skb_hsr() assumes that ETH header is pulled in the headroom when it's entered, because it just pulls HSR header on top. But that is not the case in our code-path and we end up with the corrupted skb instead. I will call this BUG#2 *I got confused here because it seems that under no conditions can create_stripped_skb_hsr() work well, the assumption it makes is not true during the processing of hsr frames - since the skb_push() in hsr_handle_frame to skb_pull in hsr_deliver_master(). I wonder whether I missed something here.* Next, the execution arrives in hsr_deliver_master(). It calls skb_pull(ETH_HLEN), which just returns NULL - the SKB does not have enough space for the pull (as it only has 12 bytes in total at this point). *The skb_pull() here further suggests that ethernet header is meant to be pushed through the whole hsr processing and create_stripped_skb_hsr() should pull it before doing the HSR header pull.* hsr_deliver_master() then puts the corrupted skb on the queue, it is then picked up from there by bridge frame handling layer and finally lands in br_dev_queue_push_xmit where it panics. Cc: stable@kernel.org Fixes: 48b491a5cc74 ("net: hsr: fix mac_len checks") Reported-by: syzbot+a81f2759d022496b40ab@syzkaller.appspotmail.com Signed-off-by: Jakub Acs Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250819082842.94378-1-acsjakub@amazon.de Signed-off-by: Jakub Kicinski commit 2c2192e5f9c7c2892fe2363244d1387f62710d83 Author: William Liu Date: Tue Aug 19 03:36:59 2025 +0000 net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate The WARN_ON trigger based on !cl->leaf.q->q.qlen is unnecessary in htb_activate. htb_dequeue_tree already accounts for that scenario. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: William Liu Reviewed-by: Savino Dicanosa Link: https://patch.msgid.link/20250819033632.579854-1-will@willsroot.io Signed-off-by: Jakub Kicinski commit 15de71d06a400f7fdc15bf377a2552b0ec437cf5 Author: William Liu Date: Tue Aug 19 03:36:28 2025 +0000 net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit The following setup can trigger a WARNING in htb_activate due to the condition: !cl->leaf.q->q.qlen tc qdisc del dev lo root tc qdisc add dev lo root handle 1: htb default 1 tc class add dev lo parent 1: classid 1:1 \ htb rate 64bit tc qdisc add dev lo parent 1:1 handle f: \ cake memlimit 1b ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 This is because the low memlimit leads to a low buffer_limit, which causes packet dropping. However, cake_enqueue still returns NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an empty child qdisc. We should return NET_XMIT_CN when packets are dropped from the same tin and flow. I do not believe return value of NET_XMIT_CN is necessary for packet drops in the case of ack filtering, as that is meant to optimize performance, not to signal congestion. Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") Signed-off-by: William Liu Reviewed-by: Savino Dicanosa Acked-by: Toke Høiland-Jørgensen Reviewed-by: Jamal Hadi Salim Link: https://patch.msgid.link/20250819033601.579821-1-will@willsroot.io Signed-off-by: Jakub Kicinski commit e318cd6714592fb762fcab59c5684a442243a12f Author: Tristram Ha Date: Mon Aug 18 18:04:57 2025 -0700 net: dsa: microchip: Fix KSZ9477 HSR port setup issue ksz9477_hsr_join() is called once to setup the HSR port membership, but the port can be enabled later, or disabled and enabled back and the port membership is not set correctly inside ksz_update_port_member(). The added code always use the correct HSR port membership for HSR port that is enabled. Fixes: 2d61298fdd7b ("net: dsa: microchip: Enable HSR offloading for KSZ9477") Reported-by: Frieder Schrempf Signed-off-by: Tristram Ha Reviewed-by: Łukasz Majewski Tested-by: Frieder Schrempf Reviewed-by: Frieder Schrempf Link: https://patch.msgid.link/20250819010457.563286-1-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit f7b0b97c2d38707ab8a7975feeefb4a047bbb3b9 Merge: 51f27beeb79f9f 1468c1f97cf324 Author: Jakub Kicinski Date: Wed Aug 20 18:46:31 2025 -0700 Merge branch 'intel-wired-lan-driver-updates-2025-08-15-ice-ixgbe-igc' Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-08-15 (ice, ixgbe, igc) For ixgbe: Jason Xing corrects a condition in which improper decrement can cause improper budget value. Maciej extends down states in which XDP cannot transmit and excludes XDP rings from Tx hang checks. For igc: VladikSS moves setting of hardware device information to allow for proper check of device ID. v1: https://lore.kernel.org/20250815204205.1407768-1-anthony.l.nguyen@intel.com ==================== Link: https://patch.msgid.link/20250819222000.3504873-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 1468c1f97cf32418e34dbb40b784ed9333b9e123 Author: ValdikSS Date: Tue Aug 19 15:19:59 2025 -0700 igc: fix disabling L1.2 PCI-E link substate on I226 on init Device ID comparison in igc_is_device_id_i226 is performed before the ID is set, resulting in always failing check on init. Before the patch: * L1.2 is not disabled on init * L1.2 is properly disabled after suspend-resume cycle With the patch: * L1.2 is properly disabled both on init and after suspend-resume How to test: Connect to the 1G link with 300+ mbit/s Internet speed, and run the download speed test, such as: curl -o /dev/null http://speedtest.selectel.ru/1GB Without L1.2 disabled, the speed would be no more than ~200 mbit/s. With L1.2 disabled, the speed would reach 1 gbit/s. Note: it's required that the latency between your host and the remote be around 3-5 ms, the test inside LAN (<1 ms latency) won't trigger the issue. Link: https://lore.kernel.org/intel-wired-lan/15248b4f-3271-42dd-8e35-02bfc92b25e1@intel.com Fixes: 0325143b59c6 ("igc: disable L1.2 PCI-E link substate to avoid performance issue") Signed-off-by: ValdikSS Reviewed-by: Vitaly Lifshits Reviewed-by: Paul Menzel Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20250819222000.3504873-6-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit f3d9f7fa7f5dbfd4fdb1e69c25fc5627700d19dd Author: Maciej Fijalkowski Date: Tue Aug 19 15:19:58 2025 -0700 ixgbe: fix ndo_xdp_xmit() workloads Currently ixgbe driver checks periodically in its watchdog subtask if there is anything to be transmitted (considering both Tx and XDP rings) under state of carrier not being 'ok'. Such event is interpreted as Tx hang and therefore results in interface reset. This is currently problematic for ndo_xdp_xmit() as it is allowed to produce descriptors when interface is going through reset or its carrier is turned off. Furthermore, XDP rings should not really be objects of Tx hang detection. This mechanism is rather a matter of ndo_tx_timeout() being called from dev_watchdog against Tx rings exposed to networking stack. Taking into account issues described above, let us have a two fold fix - do not respect XDP rings in local ixgbe watchdog and do not produce Tx descriptors in ndo_xdp_xmit callback when there is some problem with carrier currently. For now, keep the Tx hang checks in clean Tx irq routine, but adjust it to not execute for XDP rings. Cc: Tobias Böhm Reported-by: Marcus Wichelmann Closes: https://lore.kernel.org/netdev/eca1880f-253a-4955-afe6-732d7c6926ee@hetzner-cloud.de/ Fixes: 6453073987ba ("ixgbe: add initial support for xdp redirect") Fixes: 33fdc82f0883 ("ixgbe: add support for XDP_TX action") Reviewed-by: Aleksandr Loktionov Tested-by: Marcus Wichelmann Signed-off-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20250819222000.3504873-5-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 4d4d9ef9dfee877d494e5418f68a1016ef08cad6 Author: Jason Xing Date: Tue Aug 19 15:19:57 2025 -0700 ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc Resolve the budget negative overflow which leads to returning true in ixgbe_xmit_zc even when the budget of descs are thoroughly consumed. Before this patch, when the budget is decreased to zero and finishes sending the last allowed desc in ixgbe_xmit_zc, it will always turn back and enter into the while() statement to see if it should keep processing packets, but in the meantime it unexpectedly decreases the value again to 'unsigned int (0--)', namely, UINT_MAX. Finally, the ixgbe_xmit_zc returns true, showing 'we complete cleaning the budget'. That also means 'clean_complete = true' in ixgbe_poll. The true theory behind this is if that budget number of descs are consumed, it implies that we might have more descs to be done. So we should return false in ixgbe_xmit_zc to tell napi poll to find another chance to start polling to handle the rest of descs. On the contrary, returning true here means job done and we know we finish all the possible descs this time and we don't intend to start a new napi poll. It is apparently against our expectations. Please also see how ixgbe_clean_tx_irq() handles the problem: it uses do..while() statement to make sure the budget can be decreased to zero at most and the negative overflow never happens. The patch adds 'likely' because we rarely would not hit the loop condition since the standard budget is 256. Fixes: 8221c5eba8c1 ("ixgbe: add AF_XDP zero-copy Tx support") Signed-off-by: Jason Xing Reviewed-by: Larysa Zaremba Reviewed-by: Paul Menzel Reviewed-by: Aleksandr Loktionov Tested-by: Priya Singh Signed-off-by: Tony Nguyen Link: https://patch.msgid.link/20250819222000.3504873-4-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 98c4a3f4ae01c9f67a231bacf58924744feaa0b3 Merge: c17b750b3ad9f4 8236820fd767f4 Author: Dave Airlie Date: Thu Aug 21 11:29:26 2025 +1000 Merge tag 'drm-intel-fixes-2025-08-20' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - TypeC DP display Fixes [lnl] (Imre Deak) - Silence rpm wakeref asserts on GEN11_GU_MISC_IIR access (Jani Nikula) - Relocate compression repacking WA for JSL/EHL [gt] (Sebastian Brzezinka) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://lore.kernel.org/r/aKW2CAy37usxTrzn@linux commit c81f6ce16785cc07ae81f53deb07b662ed0bb3a5 Author: Lizhi Hou Date: Mon Aug 18 08:22:21 2025 -0700 of: dynamic: Fix memleak when of_pci_add_properties() failed When of_pci_add_properties() failed, of_changeset_destroy() is called to free the changeset. And of_changeset_destroy() puts device tree node in each entry but does not free property in the entry. This leads to memory leak in the failure case. In of_changeset_add_prop_helper(), add the property to the device tree node deadprops list. Thus, the property will also be freed along with device tree node. Fixes: b544fc2b8606 ("of: dynamic: Add interfaces for creating device node dynamically") Reported-by: Lorenzo Pieralisi Closes: https://lore.kernel.org/all/aJms+YT8TnpzpCY8@lpieralisi/ Tested-by: Lorenzo Pieralisi Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250818152221.3685724-1-lizhi.hou@amd.com Signed-off-by: Rob Herring (Arm) commit 068a56e56fa81e42fc5f08dff34fab149bb60a09 Merge: 43f981b7a72bd3 ec879e1a0be800 Author: Linus Torvalds Date: Wed Aug 20 16:29:30 2025 -0700 Merge tag 'probes-fixes-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fix from Masami Hiramatsu: "Sanitize wildcard for fprobe event name Fprobe event accepts wildcards for the target functions, but unless the user specifies its event name, it makes an event with the wildcards. Replace the wildcard '*' with the underscore '_'" * tag 'probes-fixes-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: fprobe-event: Sanitize wildcard for fprobe event name commit 43f981b7a72bd39358b876f801ffee463536dea5 Merge: 41cd3fd1526342 729dc340a4ed12 Author: Linus Torvalds Date: Wed Aug 20 16:27:38 2025 -0700 Merge tag 'bootconfig-fixes-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig fix from Masami Hiramatsu: "Fix negative seeks on 32-bit with LFS enabled On 32bit architecture, -BOOTCONFIG_FOOTER_SIZE (size_t, 32bit) becomes a positive value when it is passed to lseek() because it is cast to off_t (64bit). Thus, add type casts" * tag 'bootconfig-fixes-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: bootconfig: Fix negative seeks on 32-bit with LFS enabled commit 729dc340a4ed1267774fc8518284e976e2210bdc Author: Ben Hutchings Date: Sun Aug 17 16:21:46 2025 +0200 bootconfig: Fix negative seeks on 32-bit with LFS enabled Commit 26dda5769509 "tools/bootconfig: Cleanup bootconfig footer size calculations" replaced some expressions of type int with the BOOTCONFIG_FOOTER_SIZE macro, which expands to an expression of type size_t, which is unsigned. On 32-bit architectures with LFS enabled (i.e. off_t is 64-bit), the seek offset of -BOOTCONFIG_FOOTER_SIZE now turns into a positive value. Fix this by casting the size to off_t before negating it. Just in case someone changes BOOTCONFIG_MAGIC_LEN to have type size_t later, do the same thing to the seek offset of -BOOTCONFIG_MAGIC_LEN. Link: https://lore.kernel.org/all/aKHlevxeg6Y7UQrz@decadent.org.uk/ Fixes: 26dda5769509 ("tools/bootconfig: Cleanup bootconfig footer size calculations") Signed-off-by: Ben Hutchings Signed-off-by: Masami Hiramatsu (Google) commit 41cd3fd152634250fdd09a52a35352b3f323800d Merge: b19a97d57c1564 5149bbb56bdcf5 Author: Linus Torvalds Date: Wed Aug 20 13:26:33 2025 -0700 Merge tag 'pci-v6.17-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fixes from Bjorn Helgaas: - Remove vmd restriction on children using MSI-X because VMD does in fact support both MSI and MSI-X for children (Nam Cao) - Fix a NULL pointer dereference in the xilinx interrupt handler (Nam Cao) * tag 'pci-v6.17-fixes-2' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: vmd: Remove MSI-X check on child devices PCI: xilinx: Fix NULL pointer dereference in xilinx_pcie_intr_handler() commit 7c15e4cabfa96ed3cd717a2ed7a9961268ab21f7 Merge: af24c20c4633a6 8d13d1bdb59d0a Author: Mark Brown Date: Wed Aug 20 19:56:20 2025 +0100 ASoC: cs35l56: Fixes for CS35L63 for production Merge series from Stefan Binding : Production silicon for CS36L63 has some small differences compared to pre-production silicon. This requires small fixes in driver. Update firmware addresses, tuning algorithm IDs and remove soundwire clock workaround as no longer necessary. No product was ever released using pre-production silicon, therefore there is no need to keep support for it. commit ab1bb82f3db20e23eace06db52031b1164a110c2 Author: Matt Coffin Date: Wed Aug 20 01:49:51 2025 -0600 HID: logitech: Add ids for G PRO 2 LIGHTSPEED Adds support for the G PRO 2 LIGHTSPEED Wireless via it's nano receiver or directly. This nano receiver appears to work identically to the 1_1 receiver for the case I've verified, which is the battery status through lg-hidpp. The same appears to be the case wired, sharing much with the Pro X Superlight 2; differences seemed to lie in userland configuration rather than in interfaces used by hid_logitech_hidpp on the kernel side. I verified the sysfs interface for battery charge/discharge status, and capacity read to be working on my 910-007290 device (white). Signed-off-by: Matt Coffin Reviewed-by: Bastien Nocera Signed-off-by: Jiri Kosina commit e94536e1d1818b0989aa19b443b7089f50133c35 Author: José Expósito Date: Thu Aug 14 12:39:40 2025 +0200 HID: input: report battery status changes immediately Previously, the battery status (charging/discharging) was not reported immediately to user-space.  For most input devices, this wasn't problematic because changing their battery status requires connecting them to a different bus. For example, a gamepad would report a discharging status while connected via Bluetooth and a charging status while connected via USB. However, certain devices are not connected or disconnected when their battery status changes. For example, a phone battery changes its status without connecting or disconnecting it. In these cases, the battery status was not reported immediately to user space. Report battery status changes immediately to user space to support these kinds of devices. Fixes: a608dc1c0639 ("HID: input: map battery system charging") Reported-by: 卢国宏 Closes: https://lore.kernel.org/linux-input/aI49Im0sGb6fpgc8@fedora/T/ Tested-by: 卢国宏 Signed-off-by: José Expósito Signed-off-by: Jiri Kosina commit a82231b2a8712d0218fc286a9b0da328d419a3f4 Author: José Expósito Date: Thu Aug 14 12:39:39 2025 +0200 HID: input: rename hidinput_set_battery_charge_status() In preparation for a patch fixing a bug affecting hidinput_set_battery_charge_status(), rename the function to hidinput_update_battery_charge_status() and move it up so it can be used by hidinput_update_battery(). Refactor, no functional changes. Tested-by: 卢国宏 Signed-off-by: José Expósito Signed-off-by: Jiri Kosina commit 39aaa337449e71a41d4813be0226a722827ba606 Author: Dan Carpenter Date: Mon Aug 11 13:43:39 2025 +0300 dmaengine: idxd: Fix double free in idxd_setup_wqs() The clean up in idxd_setup_wqs() has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are: 1) If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when "conf_dev" hasn't been initialized. 2) If kzalloc_node() fails then again "conf_dev" is invalid. It's either uninitialized or it points to the "conf_dev" from the previous iteration so it leads to a double free. It's better to free partial loop iterations within the loop and then the unwinding at the end can handle whole loop iterations. I also renamed the labels to describe what the goto does and not where the goto was located. Fixes: 3fd2f4bc010c ("dmaengine: idxd: fix memory leak in error handling path of idxd_setup_wqs") Reported-by: Colin Ian King Closes: https://lore.kernel.org/all/20250811095836.1642093-1-colin.i.king@gmail.com/ Signed-off-by: Dan Carpenter Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/aJnJW3iYTDDCj9sk@stanley.mountain Signed-off-by: Vinod Koul commit b7cb9a034305d52222433fad10c3de10204f29e7 Author: Yi Sun Date: Tue Jul 29 23:03:13 2025 +0800 dmaengine: idxd: Fix refcount underflow on module unload A recent refactor introduced a misplaced put_device() call, resulting in a reference count underflow during module unload. There is no need to add additional put_device() calls for idxd groups, engines, or workqueues. Although the commit claims: "Note, this also fixes the missing put_device() for idxd groups, engines, and wqs." It appears no such omission actually existed. The required cleanup is already handled by the call chain: idxd_unregister_devices() -> device_unregister() -> put_device() Extend idxd_cleanup() to handle the remaining necessary cleanup and remove idxd_cleanup_internals(), which duplicates deallocation logic for idxd, engines, groups, and workqueues. Memory management is also properly handled through the Linux device model. Fixes: a409e919ca32 ("dmaengine: idxd: Refactor remove call with idxd_cleanup() helper") Signed-off-by: Yi Sun Tested-by: Shuai Xue Reviewed-by: Dave Jiang Acked-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20250729150313.1934101-3-yi.sun@intel.com Signed-off-by: Vinod Koul commit f41c538881eec4dcf5961a242097d447f848cda6 Author: Yi Sun Date: Tue Jul 29 23:03:12 2025 +0800 dmaengine: idxd: Remove improper idxd_free The call to idxd_free() introduces a duplicate put_device() leading to a reference count underflow: refcount_t: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... Call Trace: idxd_remove+0xe4/0x120 [idxd] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x197/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x74/0xf0 pci_unregister_driver+0x2e/0xb0 idxd_exit_module+0x34/0x7a0 [idxd] __do_sys_delete_module.constprop.0+0x183/0x280 do_syscall_64+0x54/0xd70 entry_SYSCALL_64_after_hwframe+0x76/0x7e The idxd_unregister_devices() which is invoked at the very beginning of idxd_remove(), already takes care of the necessary put_device() through the following call path: idxd_unregister_devices() -> device_unregister() -> put_device() In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is called immediately after, it can result in a use-after-free. Remove the improper idxd_free() to avoid both the refcount underflow and potential memory corruption during module unload. Fixes: d5449ff1b04d ("dmaengine: idxd: Add missing idxd cleanup to fix memory leak in remove call") Signed-off-by: Yi Sun Tested-by: Shuai Xue Reviewed-by: Dave Jiang Acked-by: Vinicius Costa Gomes Link: https://lore.kernel.org/r/20250729150313.1934101-2-yi.sun@intel.com Signed-off-by: Vinod Koul commit 06ea48beece831a8447758e5432ad1cd60765363 Author: Krzysztof Kozlowski Date: Tue Aug 19 15:17:53 2025 +0200 ARM: dts: allwinner: Minor whitespace cleanup The DTS code coding style expects exactly one space around '=' or '{' characters. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250819131752.86948-2-krzysztof.kozlowski@linaro.org Signed-off-by: Chen-Yu Tsai commit dce1b33ed7430c7189b8cc1567498f9e6bf12731 Author: Sean Christopherson Date: Tue Jun 24 16:19:30 2025 -0700 selftests: harness: Rename is_signed_type() to avoid collision with overflow.h Rename is_signed_type() to is_signed_var() to avoid colliding with a macro of the same name defined by tools' linux/overflow.h. This fixes warnings (and presumably potential test failures) in tests that utilize the selftests harness and happen to (indirectly) include overflow.h. In file included from tools/include/linux/bits.h:34, from tools/include/linux/bitops.h:14, from tools/include/linux/hashtable.h:13, from include/kvm_util.h:11, from x86/userspace_msr_exit_test.c:11: tools/include/linux/overflow.h:31:9: error: "is_signed_type" redefined [-Werror] 31 | #define is_signed_type(type) (((type)(-1)) < (type)1) | ^~~~~~~~~~~~~~ In file included from include/kvm_test_harness.h:11, from x86/userspace_msr_exit_test.c:9: ../kselftest_harness.h:754:9: note: this is the location of the previous definition 754 | #define is_signed_type(var) (!!(((__typeof__(var))(-1)) < (__typeof__(var))1)) | ^~~~~~~~~~~~~~ Use a separate definition, at least for now, as many selftests build without tools/include in their include path. Fixes: fc92099902fb ("tools headers: Synchronize linux/bits.h with the kernel sources") Cc: Vincent Mailhol Cc: Arnaldo Carvalho de Melo Cc: Mark Brown Link: https://lore.kernel.org/r/20250624231930.583689-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 538c06e3964a8e94b645686cc58ccc4a06fa6330 Author: Bibo Mao Date: Wed Aug 20 22:51:15 2025 +0800 LoongArch: KVM: Add address alignment check in pch_pic register access With pch_pic device, its register is based on MMIO address space, different access size 1/2/4/8 is supported. And base address should be naturally aligned with its access size, here add alignment check in its register access emulation function. Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 0dfd9ea7bf80fabe11f5b775d762a5cd168cdf41 Author: Song Gao Date: Wed Aug 20 22:51:15 2025 +0800 LoongArch: KVM: Use kvm_get_vcpu_by_id() instead of kvm_get_vcpu() Since using kvm_get_vcpu() may fail to retrieve the vCPU context, kvm_get_vcpu_by_id() should be used instead. Fixes: 8e3054261bc3 ("LoongArch: KVM: Add IPI user mode read and write function") Fixes: 3956a52bc05b ("LoongArch: KVM: Add EIOINTC read and write functions") Reviewed-by: Yanteng Si Signed-off-by: Song Gao Signed-off-by: Huacai Chen commit 5c68549c81bcca70fc464e305ffeefd9af968287 Author: Bibo Mao Date: Wed Aug 20 22:51:15 2025 +0800 LoongArch: KVM: Fix stack protector issue in send_ipi_data() Function kvm_io_bus_read() is called in function send_ipi_data(), buffer size of parameter *val should be at least 8 bytes. Since some emulation functions like loongarch_ipi_readl() and kvm_eiointc_read() will write the buffer *val with 8 bytes signed extension regardless parameter len. Otherwise there will be buffer overflow issue when CONFIG_STACKPROTECTOR is enabled. The bug report is shown as follows: Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: send_ipi_data+0x194/0x1a0 [kvm] CPU: 11 UID: 107 PID: 2692 Comm: CPU 0/KVM Not tainted 6.17.0-rc1+ #102 PREEMPT(full) Stack : 9000000005901568 0000000000000000 9000000003af371c 900000013c68c000 900000013c68f850 900000013c68f858 0000000000000000 900000013c68f998 900000013c68f990 900000013c68f990 900000013c68f6c0 fffffffffffdb058 fffffffffffdb0e0 900000013c68f858 911e1d4d39cf0ec2 9000000105657a00 0000000000000001 fffffffffffffffe 0000000000000578 282049464555206e 6f73676e6f6f4c20 0000000000000001 00000000086b4000 0000000000000000 0000000000000000 0000000000000000 9000000005709968 90000000058f9000 900000013c68fa68 900000013c68fab4 90000000029279f0 900000010153f940 900000010001f360 0000000000000000 9000000003af3734 000000004390000c 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d ... Call Trace: [<9000000003af3734>] show_stack+0x5c/0x180 [<9000000003aed168>] dump_stack_lvl+0x6c/0x9c [<9000000003ad0ab0>] vpanic+0x108/0x2c4 [<9000000003ad0ca8>] panic+0x3c/0x40 [<9000000004eb0a1c>] __stack_chk_fail+0x14/0x18 [] send_ipi_data+0x190/0x1a0 [kvm] [] __kvm_io_bus_write+0xa4/0xe8 [kvm] [] kvm_io_bus_write+0x54/0x90 [kvm] [] kvm_emu_iocsr+0x180/0x310 [kvm] [] kvm_handle_gspr+0x280/0x478 [kvm] [] kvm_handle_exit+0xc0/0x130 [kvm] Cc: stable@vger.kernel.org Fixes: daee2f9cae551 ("LoongArch: KVM: Add IPI read and write function") Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 4be8cefc132606b4a6e851f37f8e8c40c406c910 Author: Bibo Mao Date: Wed Aug 20 22:51:14 2025 +0800 LoongArch: KVM: Make function kvm_own_lbt() robust Add the flag KVM_LARCH_LBT checking in function kvm_own_lbt(), so that it can be called safely rather than duplicated enabling again. Cc: stable@vger.kernel.org Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit ec879e1a0be8007aa232ffedcf6a6445dfc1a3d7 Author: Masami Hiramatsu (Google) Date: Sat Aug 16 23:10:51 2025 +0900 tracing: fprobe-event: Sanitize wildcard for fprobe event name Fprobe event accepts wildcards for the target functions, but unless user specifies its event name, it makes an event with the wildcards. /sys/kernel/tracing # echo 'f mutex*' >> dynamic_events /sys/kernel/tracing # cat dynamic_events f:fprobes/mutex*__entry mutex* /sys/kernel/tracing # ls events/fprobes/ enable filter mutex*__entry To fix this, replace the wildcard ('*') with an underscore. Link: https://lore.kernel.org/all/175535345114.282990.12294108192847938710.stgit@devnote2/ Fixes: 334e5519c375 ("tracing/probes: Add fprobe events for tracing function entry and exit.") Signed-off-by: Masami Hiramatsu (Google) Cc: stable@vger.kernel.org commit 93f616ff870a1fb7e84d472cad0af651b18f9f87 Author: Heiko Carstens Date: Thu Aug 7 17:04:27 2025 +0200 s390/mm: Do not map lowcore with identity mapping Since the identity mapping is pinned to address zero the lowcore is always also mapped to address zero, this happens regardless of the relocate_lowcore command line option. If the option is specified the lowcore is mapped twice, instead of only once. This means that NULL pointer accesses will succeed instead of causing an exception (low address protection still applies, but covers only parts). To fix this never map the first two pages of physical memory with the identity mapping. Fixes: 32db401965f1 ("s390/mm: Pin identity mapping base to zero") Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 430fa71027b6ac9bb0ce5532b8d0676777d4219a Author: Peter Oberparleiter Date: Mon Aug 18 12:21:52 2025 +0200 s390/sclp: Fix SCCB present check Tracing code called by the SCLP interrupt handler contains early exits if the SCCB address associated with an interrupt is NULL. This check is performed after physical to virtual address translation. If the kernel identity mapping does not start at address zero, the resulting virtual address is never zero, so that the NULL checks won't work. Subsequently this may result in incorrect accesses to the first page of the identity mapping. Fix this by introducing a function that handles the NULL case before address translation. Fixes: ada1da31ce34 ("s390/sclp: sort out physical vs virtual pointers usage") Cc: stable@vger.kernel.org Reviewed-by: Alexander Gordeev Signed-off-by: Peter Oberparleiter Signed-off-by: Alexander Gordeev commit fcc43a7e294f877021c4fa71276920f543e8e298 Author: Heiko Carstens Date: Thu Aug 14 10:48:53 2025 +0200 s390/configs: Set HZ=1000 Similar to powerpc set HZ to 1000. See also commit a206d2334012 ("powerpc/defconfigs: Set HZ=1000 on ppc64 and powernv defconfigs"). Besides other this will reduce the latency seen with synchronize_rcu(). Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit eb173ce0e23502e397eae75453936b3ecfb1fd84 Author: Heiko Carstens Date: Thu Aug 14 10:48:52 2025 +0200 s390/configs: Update defconfigs The usual defconfig updates. Notable changes: - Enable ZONE_DEVICE, and with that DEV_DAX, FS_DAX, and FUSE_DAX - Enable CRYPTO_SELFTESTS_FULL for debug_defconfig - Enable CRASH_DM_CRYPT - Disable legacy IP_NF_FILTER Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 8d13d1bdb59d0a2c526869ee571ec51a3a887463 Author: Stefan Binding Date: Wed Aug 20 15:22:02 2025 +0100 ASoC: cs35l56: Remove SoundWire Clock Divider workaround for CS35L63 Production silicon for CS36L63 has some small differences compared to pre-production silicon. Remove soundwire clock workaround as no longer necessary. We don't want to do tricks with low-level clocking controls if we don't need to. Fixes: 978858791ced ("ASoC: cs35l56: Add initial support for CS35L63 for I2C and SoundWire") Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20250820142209.127575-4-sbinding@opensource.cirrus.com Signed-off-by: Mark Brown commit 8dadc11b67d4b83deff45e4889b3b5540b9c0a7f Author: Richard Fitzgerald Date: Wed Aug 20 15:22:01 2025 +0100 ASoC: cs35l56: Handle new algorithms IDs for CS35L63 CS35L63 uses different algorithm IDs from CS35L56. Add a new mechanism to handle different alg IDs between parts in the CS35L56 driver. Fixes: 978858791ced ("ASoC: cs35l56: Add initial support for CS35L63 for I2C and SoundWire") Signed-off-by: Richard Fitzgerald Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20250820142209.127575-3-sbinding@opensource.cirrus.com Signed-off-by: Mark Brown commit f135fb24ef29335b94921077588cae445bc7f099 Author: Stefan Binding Date: Wed Aug 20 15:22:00 2025 +0100 ASoC: cs35l56: Update Firmware Addresses for CS35L63 for production silicon Production silicon for CS36L63 has some small differences compared to pre-production silicon. Update firmware addresses, which are different. No product was ever released with pre-production silicon so there is no need for the driver to include support for it. Fixes: 978858791ced ("ASoC: cs35l56: Add initial support for CS35L63 for I2C and SoundWire") Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20250820142209.127575-2-sbinding@opensource.cirrus.com Signed-off-by: Mark Brown commit 0078e94a4733454d1ffa3888afe88bf19c81b91c Author: Huacai Chen Date: Wed Aug 20 22:23:44 2025 +0800 LoongArch: Rename GCC_PLUGIN_STACKLEAK to KSTACK_ERASE Commit 57fbad15c2eee772 ("stackleak: Rename STACKLEAK to KSTACK_ERASE") misses the stackframe.h part for LoongArch, so fix it. Fixes: 57fbad15c2eee772 ("stackleak: Rename STACKLEAK to KSTACK_ERASE") Signed-off-by: Huacai Chen commit 112ca94f6c3b3e0b2002a240de43c487a33e0234 Author: Huacai Chen Date: Wed Aug 20 22:23:44 2025 +0800 LoongArch: Save LBT before FPU in setup_sigcontext() Now if preemption happens between protected_save_fpu_context() and protected_save_lbt_context(), FTOP context is lost. Because FTOP is saved by protected_save_lbt_context() but protected_save_fpu_context() disables TM before that. So save LBT before FPU in setup_sigcontext() to avoid this potential risk. Signed-off-by: Hanlu Li Signed-off-by: Huacai Chen commit 63dbd8fb2af3a89466538599a9acb2d11ef65c06 Author: Kanglong Wang Date: Wed Aug 20 22:23:44 2025 +0800 LoongArch: Optimize module load time by optimizing PLT/GOT counting When enabling CONFIG_KASAN, CONFIG_PREEMPT_VOLUNTARY_BUILD and CONFIG_PREEMPT_VOLUNTARY at the same time, there will be soft deadlock, the relevant logs are as follows: rcu: INFO: rcu_sched self-detected stall on CPU ... Call Trace: [<900000000024f9e4>] show_stack+0x5c/0x180 [<90000000002482f4>] dump_stack_lvl+0x94/0xbc [<9000000000224544>] rcu_dump_cpu_stacks+0x1fc/0x280 [<900000000037ac80>] rcu_sched_clock_irq+0x720/0xf88 [<9000000000396c34>] update_process_times+0xb4/0x150 [<90000000003b2474>] tick_nohz_handler+0xf4/0x250 [<9000000000397e28>] __hrtimer_run_queues+0x1d0/0x428 [<9000000000399b2c>] hrtimer_interrupt+0x214/0x538 [<9000000000253634>] constant_timer_interrupt+0x64/0x80 [<9000000000349938>] __handle_irq_event_percpu+0x78/0x1a0 [<9000000000349a78>] handle_irq_event_percpu+0x18/0x88 [<9000000000354c00>] handle_percpu_irq+0x90/0xf0 [<9000000000348c74>] handle_irq_desc+0x94/0xb8 [<9000000001012b28>] handle_cpu_irq+0x68/0xa0 [<9000000001def8c0>] handle_loongarch_irq+0x30/0x48 [<9000000001def958>] do_vint+0x80/0xd0 [<9000000000268a0c>] kasan_mem_to_shadow.part.0+0x2c/0x2a0 [<90000000006344f4>] __asan_load8+0x4c/0x120 [<900000000025c0d0>] module_frob_arch_sections+0x5c8/0x6b8 [<90000000003895f0>] load_module+0x9e0/0x2958 [<900000000038b770>] __do_sys_init_module+0x208/0x2d0 [<9000000001df0c34>] do_syscall+0x94/0x190 [<900000000024d6fc>] handle_syscall+0xbc/0x158 After analysis, this is because the slow speed of loading the amdgpu module leads to the long time occupation of the cpu and then the soft deadlock. When loading a module, module_frob_arch_sections() tries to figure out the number of PLTs/GOTs that will be needed to handle all the RELAs. It will call the count_max_entries() to find in an out-of-order date which counting algorithm has O(n^2) complexity. To make it faster, we sort the relocation list by info and addend. That way, to check for a duplicate relocation, it just needs to compare with the previous entry. This reduces the complexity of the algorithm to O(n log n), as done in commit d4e0340919fb ("arm64/module: Optimize module load time by optimizing PLT counting"). This gives sinificant reduction in module load time for modules with large number of relocations. After applying this patch, the soft deadlock problem has been solved, and the kernel starts normally without "Call Trace". Using the default configuration to test some modules, the results are as follows: Module Size ip_tables 36K fat 143K radeon 2.5MB amdgpu 16MB Without this patch: Module Module load time (ms) Count(PLTs/GOTs) ip_tables 18 59/6 fat 0 162/14 radeon 54 1221/84 amdgpu 1411 4525/1098 With this patch: Module Module load time (ms) Count(PLTs/GOTs) ip_tables 18 59/6 fat 0 162/14 radeon 22 1221/84 amdgpu 45 4525/1098 Fixes: fcdfe9d22bed ("LoongArch: Add ELF and module support") Signed-off-by: Kanglong Wang Signed-off-by: Huacai Chen commit 8ef7f3132e4005a103b382e71abea7ad01fbeb86 Author: Xianglai Li Date: Wed Aug 20 22:23:44 2025 +0800 LoongArch: Add cpuhotplug hooks to fix high cpu usage of vCPU threads When the CPU is offline, the timer of LoongArch is not correctly closed. This is harmless for real machines, but resulting in an excessively high cpu usage rate of the offline vCPU thread in the virtual machines. To correctly close the timer, we have made the following modifications: Register the cpu hotplug event (CPUHP_AP_LOONGARCH_ARCH_TIMER_STARTING) for LoongArch. This event's hooks will be called to close the timer when the CPU is offline. Clear the timer interrupt when the timer is turned off. Since before the timer is turned off, there may be a timer interrupt that has already been in the pending state due to the interruption of the disabled, which also affects the halt state of the offline vCPU. Signed-off-by: Xianglai Li Signed-off-by: Huacai Chen commit f7794a4d92ade518c813de69a01b27ca6d8d86f3 Author: Ming Wang Date: Wed Aug 20 22:23:16 2025 +0800 LoongArch: Increase COMMAND_LINE_SIZE up to 4096 The default COMMAND_LINE_SIZE of 512, inherited from asm-generic, is too small for modern use cases. For example, kdump configurations or extensive debugging parameters can easily exceed this limit. Therefore, increase the command line size to 4096 bytes, aligning LoongArch with the MIPS architecture. This change follows a broader trend among architectures to raise this limit to support modern needs; for instance, PowerPC increased its value for similar reasons in the commit a5980d064fe2 ("powerpc: Bump COMMAND_LINE_SIZE to 2048"). Similar to the change made for RISC-V in the commit 61fc1ee8be26 ("riscv: Bump COMMAND_LINE_SIZE value to 1024"), this is considered a safe change. The broader kernel community has reached a consensus that modifying COMMAND_LINE_SIZE from UAPI headers does not constitute a uABI breakage, as well-behaved userspace applications should not rely on this macro. Suggested-by: Huang Cun Signed-off-by: Ming Wang Signed-off-by: Huacai Chen commit 5dfea6644d201bfeffaa7e0d79d62309856613b7 Author: Tiezhu Yang Date: Wed Aug 20 22:23:15 2025 +0800 LoongArch: Pass annotate-tablejump option if LTO is enabled When compiling with LLVM and CONFIG_LTO_CLANG is set, there exist many objtool warnings "sibling call from callable instruction with modified stack frame". For this special case, the related object file shows that there is no generated relocation section '.rela.discard.tablejump_annotate' for the table jump instruction jirl, thus objtool can not know that what is the actual destination address. It needs to do something on the LLVM side to make sure that there is the relocation section '.rela.discard.tablejump_annotate' if LTO is enabled, but in order to maintain compatibility for the current LLVM compiler, this can be done in the kernel Makefile for now. Ensure it is aware of linker with LTO, '--loongarch-annotate-tablejump' needs to be passed via '-mllvm' to ld.lld. Note that it should also pass the compiler option -mannotate-tablejump rather than only pass '-mllvm --loongarch-annotate-tablejump' to ld.lld if LTO is enabled, otherwise there are no jump info for some table jump instructions. Fixes: e20ab7d454ee ("LoongArch: Enable jump table for objtool") Closes: https://lore.kernel.org/loongarch/20250731175655.GA1455142@ax162/ Reported-by: Nathan Chancellor Tested-by: Nathan Chancellor Co-developed-by: WANG Rui Signed-off-by: WANG Rui Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit a47bc954cf0eb51f2828e1607d169d487df7f11f Author: Tiezhu Yang Date: Wed Aug 20 22:23:15 2025 +0800 objtool/LoongArch: Get table size correctly if LTO is enabled When compiling with LLVM and CONFIG_LTO_CLANG is set, there exist many objtool warnings "sibling call from callable instruction with modified stack frame". For this special case, the related object file shows that there is no generated relocation section '.rela.discard.tablejump_annotate' for the table jump instruction jirl, thus objtool can not know that what is the actual destination address. It needs to do something on the LLVM side to make sure that there is the relocation section '.rela.discard.tablejump_annotate' if LTO is enabled, but in order to maintain compatibility for the current LLVM compiler, this can be done in the kernel Makefile for now. Ensure it is aware of linker with LTO, '--loongarch-annotate-tablejump' needs to be passed via '-mllvm' to ld.lld. Before doing the above changes, it should handle the special case of the relocation section '.rela.discard.tablejump_annotate' to get the correct table size first, otherwise there are many objtool warnings and errors if LTO is enabled. There are many different rodata for each function if LTO is enabled, it is necessary to enhance get_rodata_table_size_by_table_annotate(). Fixes: b95f852d3af2 ("objtool/LoongArch: Add support for switch table") Closes: https://lore.kernel.org/loongarch/20250731175655.GA1455142@ax162/ Reported-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit 1a2cf179e2973f6801c67397ecc987391b084bcf Merge: 3271faf42d135b c17b750b3ad9f4 Author: Maxime Ripard Date: Wed Aug 20 16:08:49 2025 +0200 Merge drm/drm-fixes into drm-misc-fixes Update drm-misc-fixes to -rc2. Signed-off-by: Maxime Ripard commit efdaa61d73a1deb066ccc3b4d56257cc63ab5be9 Author: Juergen Gross Date: Fri Aug 15 09:40:52 2025 +0200 drivers/xen/xenbus: remove quirk for Xen 3.x The kernel is not supported to run as a Xen guest on Xen versions older than 4.0. Remove xen_strict_xenbus_quirk() which is testing the Xen version to be at least 4.0. Acked-by: Stefano Stabellini Reviewed-by: Jason Andryuk Signed-off-by: Juergen Gross Message-ID: <20250815074052.13792-1-jgross@suse.com> commit 4647c4deadcc17f40858be06bcf416369a8f1d57 Author: Pratyush Brahma Date: Wed Aug 20 06:29:34 2025 +0530 mm: numa,memblock: Use SZ_1M macro to denote bytes to MB conversion Replace the manual bitwise conversion of bytes to MB with SZ_1M macro, a standard macro used within the mm subsystem, to improve readability. Signed-off-by: Pratyush Brahma Link: https://lore.kernel.org/r/20250820-numa-memblks-refac-v2-1-43bf1af02acd@oss.qualcomm.com Signed-off-by: Mike Rapoport (Microsoft) commit 8151320c747efb22d30b035af989fed0d502176e Author: Chen Yu Date: Tue Jul 22 22:32:33 2025 +0800 ACPI: pfr_update: Fix the driver update version check The security-version-number check should be used rather than the runtime version check for driver updates. Otherwise, the firmware update would fail when the update binary had a lower runtime version number than the current one. Fixes: 0db89fa243e5 ("ACPI: Introduce Platform Firmware Runtime Update device driver") Cc: 5.17+ # 5.17+ Reported-by: "Govindarajulu, Hariganesh" Signed-off-by: Chen Yu Link: https://patch.msgid.link/20250722143233.3970607-1-yu.c.chen@intel.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit edede7a6dcd7435395cf757d053974aaab6ab1c2 Author: Ye Weihua Date: Mon Aug 18 07:33:32 2025 +0000 trace/fgraph: Fix the warning caused by missing unregister notifier This warning was triggered during testing on v6.16: notifier callback ftrace_suspend_notifier_call already registered WARNING: CPU: 2 PID: 86 at kernel/notifier.c:23 notifier_chain_register+0x44/0xb0 ... Call Trace: blocking_notifier_chain_register+0x34/0x60 register_ftrace_graph+0x330/0x410 ftrace_profile_write+0x1e9/0x340 vfs_write+0xf8/0x420 ? filp_flush+0x8a/0xa0 ? filp_close+0x1f/0x30 ? do_dup2+0xaf/0x160 ksys_write+0x65/0xe0 do_syscall_64+0xa4/0x260 entry_SYSCALL_64_after_hwframe+0x77/0x7f When writing to the function_profile_enabled interface, the notifier was not unregistered after start_graph_tracing failed, causing a warning the next time function_profile_enabled was written. Fixed by adding unregister_pm_notifier in the exception path. Link: https://lore.kernel.org/20250818073332.3890629-1-yeweihua4@huawei.com Fixes: 4a2b8dda3f870 ("tracing/function-graph-tracer: fix a regression while suspend to disk") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Ye Weihua Signed-off-by: Steven Rostedt (Google) commit cd6e4faba96fe41d6b686e144b96dad5e6f2e771 Author: Liao Yuanhong Date: Wed Aug 13 17:51:14 2025 +0800 ring-buffer: Remove redundant semicolons Remove unnecessary semicolons. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250813095114.559530-1-liaoyuanhong@vivo.com Signed-off-by: Liao Yuanhong Signed-off-by: Steven Rostedt (Google) commit 6a909ea83f226803ea0e718f6e88613df9234d58 Author: Pu Lehui Date: Wed Aug 13 04:02:32 2025 +0000 tracing: Limit access to parser->buffer when trace_get_user failed When the length of the string written to set_ftrace_filter exceeds FTRACE_BUFF_MAX, the following KASAN alarm will be triggered: BUG: KASAN: slab-out-of-bounds in strsep+0x18c/0x1b0 Read of size 1 at addr ffff0000d00bd5ba by task ash/165 CPU: 1 UID: 0 PID: 165 Comm: ash Not tainted 6.16.0-g6bcdbd62bd56-dirty Hardware name: linux,dummy-virt (DT) Call trace: show_stack+0x34/0x50 (C) dump_stack_lvl+0xa0/0x158 print_address_description.constprop.0+0x88/0x398 print_report+0xb0/0x280 kasan_report+0xa4/0xf0 __asan_report_load1_noabort+0x20/0x30 strsep+0x18c/0x1b0 ftrace_process_regex.isra.0+0x100/0x2d8 ftrace_regex_release+0x484/0x618 __fput+0x364/0xa58 ____fput+0x28/0x40 task_work_run+0x154/0x278 do_notify_resume+0x1f0/0x220 el0_svc+0xec/0xf0 el0t_64_sync_handler+0xa0/0xe8 el0t_64_sync+0x1ac/0x1b0 The reason is that trace_get_user will fail when processing a string longer than FTRACE_BUFF_MAX, but not set the end of parser->buffer to 0. Then an OOB access will be triggered in ftrace_regex_release-> ftrace_process_regex->strsep->strpbrk. We can solve this problem by limiting access to parser->buffer when trace_get_user failed. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250813040232.1344527-1-pulehui@huaweicloud.com Fixes: 8c9af478c06b ("ftrace: Handle commands when closing set_ftrace_filter file") Signed-off-by: Pu Lehui Signed-off-by: Steven Rostedt (Google) commit b1b5b825892bc309810fe57af708503a90a49fa6 Merge: b19a97d57c1564 2729a60bbfb921 Author: Christian Brauner Date: Wed Aug 20 11:13:06 2025 +0200 Merge patch series "io_uring / dio metadata fixes" Christoph Hellwig says: Hi all, while trying to add XFS support for passing through metadata I ran into a few issues with how that support is wire up for the current block device use cases, and this fixes it. * patches from https://lore.kernel.org/20250819082517.2038819-1-hch@lst.de: block: don't silently ignore metadata for sync read/write fs: add a FMODE_ flag to indicate IOCB_HAS_METADATA availability Link: https://lore.kernel.org/20250819082517.2038819-1-hch@lst.de Signed-off-by: Christian Brauner commit 2729a60bbfb9215997f25372ebe9b7964f038296 Author: Christoph Hellwig Date: Tue Aug 19 10:25:01 2025 +0200 block: don't silently ignore metadata for sync read/write The block fops don't try to handle metadata for synchronous requests, probably because the completion handler looks at dio->iocb which is not valid for synchronous requests. But silently ignoring metadata (or warning in case of __blkdev_direct_IO_simple) is a really bad idea as that can cause silent data corruption if a user ever shows up. Instead simply handle metadata for synchronous requests as the completion handler can simply check for bio_integrity() as the block layer default integrity will already be freed at this point, and thus bio_integrity() will only return true for user mapped integrity. Fixes: 3d8b5a22d404 ("block: add support to pass user meta buffer") Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250819082517.2038819-3-hch@lst.de Reviewed-by: Martin K. Petersen Signed-off-by: Christian Brauner commit d072148a8631f102de60ed5a3a827e85d09d24f0 Author: Christoph Hellwig Date: Tue Aug 19 10:25:00 2025 +0200 fs: add a FMODE_ flag to indicate IOCB_HAS_METADATA availability Currently the kernel will happily route io_uring requests with metadata to file operations that don't support it. Add a FMODE_ flag to guard that. Fixes: 4de2ce04c862 ("fs: introduce IOCB_HAS_METADATA for metadata") Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250819082517.2038819-2-hch@lst.de Signed-off-by: Christian Brauner commit fe85261d7d554f54693f205898260ef1d44cbd8b Merge: b47b493d6387ae 43c0f6456f8011 Author: Greg Kroah-Hartman Date: Wed Aug 20 11:05:00 2025 +0200 Merge tag 'iio-fixes-for-6.17a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-linus Jonathan writes: IIO: 1st set of fixes for 6.17 Usual mixed bunch of ancient issues and relatively new ones. adi,ad7124 - Fix channel lookup to use chan->address for indexing array. adi,ad7173 - Stop accidentally enabling more configs than supported at one time. adi,ad7380 - Fill in missing max_conversion_rate_hz for adaq4381-4 ams,as73211 - Fix uninitialized holes in scan data exposed to userspace. bosch,bmp280 - Check for error when requesting optional GPIO rather than simply assuming success or a NULL return when no GPIO provided. invensense,icm42600 - Change error code returned to -EBUSY on a temperature read with neither accelerometer nor gyroscope in use. Reduces chance of misinterpretation by userspace. kionix,sca3300 - Fix uninitialized holes in scan data exposed to userspace. maxim,thermocouple - Use a DMA-safe buffer for spi_read(). renesas,isl29501 - Fix ordering issue for big endian systems renesas,rsg2l - Fix an underflow issue around suspend/resume. - Make sure driver data is in place before enabling runtime PM that uses it. rohm,bd79124 - Add missing GPIOLIB dependency. May rework in future to allow this to be optional in future but for now this is the least invasive build fix. * tag 'iio-fixes-for-6.17a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() iio: light: as73211: Ensure buffer holes are zeroed iio: adc: rzg2l_adc: Set driver data before enabling runtime PM iio: adc: rzg2l: Cleanup suspend/resume path iio: adc: ad7380: fix missing max_conversion_rate_hz on adaq4381-4 iio: adc: bd79124: Add GPIOLIB dependency iio: imu: inv_icm42600: change invalid data error to -EBUSY iio: adc: ad7124: fix channel lookup in syscalib functions iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() iio: adc: ad7173: prevent scan if too many setups requested iio: proximity: isl29501: fix buffered read on big-endian systems iio: accel: sca3300: fix uninitialized iio scan data commit 8763d2257f5231cfdfd8a53594647927dbf8bb06 Author: Madhavan Srinivasan Date: Sun May 18 10:11:07 2025 +0530 powerpc/boot/install.sh: Fix shellcheck warnings Fix shellcheck warning such as "Double quote to prevent globbing and word splitting." and Use $(...) notation instead of legacy backticks `...`. Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250518044107.39928-4-maddy@linux.ibm.com commit d40ae9033418095642f65f4fd54dc5a7d292ee39 Author: Madhavan Srinivasan Date: Sun May 18 10:11:06 2025 +0530 powerpc/prom_init: Fix shellcheck warnings Fix "Double quote to prevent globbing and word splitting." warning from shellcheck Tested-by: Venkat Rao Bagalkote Reviewed-by: Stephen Rothwell Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250518044107.39928-3-maddy@linux.ibm.com commit 88688a2c8ac6c8036d983ad8b34ce191c46a10aa Author: Madhavan Srinivasan Date: Sun May 18 10:11:04 2025 +0530 powerpc/kvm: Fix ifdef to remove build warning When compiling for pseries or powernv defconfig with "make C=1", these warning were reported bu sparse tool in powerpc/kernel/kvm.c arch/powerpc/kernel/kvm.c:635:9: warning: switch with no cases arch/powerpc/kernel/kvm.c:646:9: warning: switch with no cases Currently #ifdef were added after the switch case which are specific for BOOKE and PPC_BOOK3S_32. These are not enabled in pseries/powernv defconfig. Fix it by moving the #ifdef before switch(){} Fixes: cbe487fac7fc0 ("KVM: PPC: Add mtsrin PV code") Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250518044107.39928-1-maddy@linux.ibm.com commit 6a859f1a19d1f8756ffb097f5973dfebbca4811a Author: Masahiro Yamada Date: Sat Jun 7 19:13:51 2025 +0900 powerpc: unify two CONFIG_POWERPC64_CPU entries in the same choice block There are two CONFIG_POWERPC64_CPU entries in the "CPU selection" choice block. I guess the intent is to display a different prompt depending on CPU_LITTLE_ENDIAN: "Generic (POWER5 and PowerPC 970 and above)" for big endian, and "Generic (POWER8 and above)" for little endian. I stumbled on this tricky use case, and worked around it on Kconfig with commit 4d46b5b623e0 ("kconfig: fix infinite loop in sym_calc_choice()"). However, I doubt that supporting multiple entries with the same symbol in a choice block is worth the complexity - this is the only such case in the kernel tree. This commit merges the two entries. Once this cleanup is accepted in the powerpc subsystem, I will proceed to refactor the Kconfig parser. Signed-off-by: Masahiro Yamada Reviewed-by: Christophe Leroy Acked-by: Michael Ellerman Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250607102005.1965409-1-masahiroy@kernel.org commit eb59d4c5948d93e940b5dde9d1bf3b33367fbcb8 Author: Masahiro Yamada Date: Tue Jun 3 01:32:24 2025 +0900 powerpc: use always-y instead of extra-y in Makefiles The extra-y syntax is planned for deprecation because it is similar to always-y. When building the boot wrapper, always-y and extra-y are equivalent. Use always-y instead. In arch/powerpc/kernel/Makefile, I added ifdef KBUILD_BUILTIN to keep the current behavior: prom_init_check is skipped when building only modular objects. Signed-off-by: Masahiro Yamada Acked-by: Michael Ellerman Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250602163302.478765-1-masahiroy@kernel.org commit 8b5d86a63bc9510e094a15d7268c60bd4347b95c Author: Xichao Zhao Date: Fri Aug 1 11:59:08 2025 +0800 powerpc/64: Drop unnecessary 'rc' variable Simplify the code to enhance readability and maintain a consistent coding style. Signed-off-by: Xichao Zhao Acked-by: Gautam Menghani Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250801035908.370463-1-zhao.xichao@vivo.com commit b018bb26c42049e05d3d65b057cc1250d17d9b0a Author: Jiri Slaby (SUSE) Date: Wed Jul 23 08:28:42 2025 +0200 powerpc: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) Acked-by: Christophe Leroy Link: https://lore.kernel.org/all/4bc0e1ca-a523-424a-8759-59e353317fba@kernel.org/ Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250723062842.1831271-1-jirislaby@kernel.org commit 02c1b0824eb1873b15676257cf1dc80070927e1e Author: Andrew Donnellan Date: Wed Aug 6 15:56:07 2025 +1000 KVM: PPC: Fix misleading interrupts comment in kvmppc_prepare_to_enter() Until commit 6c85f52b10fd ("kvm/ppc: IRQ disabling cleanup"), kvmppc_prepare_to_enter() was called with interrupts already disabled by the caller, which was documented in the comment above the function. Post-cleanup, the function is now called with interrupts enabled, and disables interrupts itself. Fix the comment to reflect the current behaviour. Fixes: 6c85f52b10fd ("kvm/ppc: IRQ disabling cleanup") Signed-off-by: Andrew Donnellan Reviewed-by: Amit Machhiwal Reviewed-by: Gautam Menghani Reviewed-by: Shrikanth Hegde [Fixed the double colon in Reviewed-by line] Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250806055607.17081-1-ajd@linux.ibm.com commit 3f4422e7c9436abf81a00270be7e4d6d3760ec0e Author: Takashi Iwai Date: Wed Aug 20 07:19:01 2025 +0200 ALSA: hda: tas2781: Fix wrong reference of tasdevice_priv During the conversion to unify the calibration data management, the reference to tasdevice_priv was wrongly set to h->hda_priv instead of h->priv. This resulted in memory corruption and crashes eventually. Unfortunately it's a void pointer, hence the compiler couldn't know that it's wrong. Fixes: 4fe238513407 ("ALSA: hda/tas2781: Move and unified the calibrated-data getting function for SPI and I2C into the tas2781_hda lib") Link: https://bugzilla.suse.com/show_bug.cgi?id=1248270 Cc: Link: https://patch.msgid.link/20250820051902.4523-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 51f27beeb79f9f92682158999bab489ff4fa16f6 Merge: 4f953be88224f5 2cd58fec912ace Author: Jakub Kicinski Date: Tue Aug 19 19:38:28 2025 -0700 Merge branch 'fixes-on-the-microchip-s-lan865x-driver' Parthiban Veerasooran says: ==================== Fixes on the Microchip's LAN865x driver This patch series includes two bug fixes for the LAN865x Ethernet MAC-PHY driver: 1. Fix missing transmit queue restart on device reopen This patch addresses an issue where the transmit queue is not restarted when the network interface is brought back up after being taken down (e.g., via ip or ifconfig). As a result, packet transmission hangs after the first down/up cycle. The fix ensures netif_start_queue() is explicitly called in lan865x_net_open() to properly restart the queue on every reopen. 2. Fix missing configuration in the Microchip LAN865x driver for silicon revisions B0 and B1, as documented in Microchip Application Note AN1760 (Rev F, June 2024). These revisions require the MAC to be configured for timestamping at the end of the Start of Frame Delimiter (SFD) and the Timer Increment register to be set to 40 ns, corresponding to a 25 MHz internal clock. Both patches address issues introduced with the initial driver support and are marked with the appropriate Fixes: tag. ==================== Link: https://patch.msgid.link/20250818060514.52795-1-parthiban.veerasooran@microchip.com Signed-off-by: Jakub Kicinski commit 2cd58fec912acec273cb155911ab8f06ddbb131a Author: Parthiban Veerasooran Date: Mon Aug 18 11:35:14 2025 +0530 microchip: lan865x: fix missing Timer Increment config for Rev.B0/B1 Fix missing configuration for LAN865x silicon revisions B0 and B1 as per Microchip Application Note AN1760 (Rev F, June 2024). The Timer Increment register was not being set, which is required for accurate timestamping. As per the application note, configure the MAC to set timestamping at the end of the Start of Frame Delimiter (SFD), and set the Timer Increment register to 40 ns (corresponding to a 25 MHz internal clock). Link: https://www.microchip.com/en-us/application-notes/an1760 Fixes: 5cd2340cb6a3 ("microchip: lan865x: add driver support for Microchip's LAN865X MAC-PHY") Signed-off-by: Parthiban Veerasooran Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250818060514.52795-3-parthiban.veerasooran@microchip.com Signed-off-by: Jakub Kicinski commit 1683fd1b2fa79864d3c7a951d9cea0a9ba1a1923 Author: Parthiban Veerasooran Date: Mon Aug 18 11:35:13 2025 +0530 microchip: lan865x: fix missing netif_start_queue() call on device open This fixes an issue where the transmit queue is started implicitly only the very first time the device is registered. When the device is taken down and brought back up again (using `ip` or `ifconfig`), the transmit queue is not restarted, causing packet transmission to hang. Adding an explicit call to netif_start_queue() in lan865x_net_open() ensures the transmit queue is properly started every time the device is reopened. Fixes: 5cd2340cb6a3 ("microchip: lan865x: add driver support for Microchip's LAN865X MAC-PHY") Signed-off-by: Parthiban Veerasooran Link: https://patch.msgid.link/20250818060514.52795-2-parthiban.veerasooran@microchip.com Signed-off-by: Jakub Kicinski commit 4f953be88224f57d29db2a0da7c62194e37abc81 Merge: d9cef55ed49117 d2d6f950cb43be Author: Jakub Kicinski Date: Tue Aug 19 19:35:16 2025 -0700 Merge branch 'mlx5-hws-fixes-2025-08-17' Mark Bloch says: ==================== mlx5 HWS fixes 2025-08-17 The following patch set focuses on hardware steering fixes found by the team. ==================== Link: https://patch.msgid.link/20250817202323.308604-1-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit d2d6f950cb43be6845a41cac5956cb2a10e657e5 Author: Vlad Dogaru Date: Sun Aug 17 23:23:23 2025 +0300 net/mlx5: CT: Use the correct counter offset Specifying the counter action is not enough, as it is used by multiple counters that were allocated in a bulk. By omitting the offset, rules will be associated with a different counter from the same bulk. Subsequently, the CT subsystem checks the correct counter, assumes that no traffic has triggered the rule, and ages out the rule. The end result is intermittent offloading of long lived connections, as rules are aged out then promptly re-added. Fix this by specifying the correct offset along with the counter rule. Fixes: 34eea5b12a10 ("net/mlx5e: CT: Add initial support for Hardware Steering") Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250817202323.308604-8-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 8a51507320ebddaab32610199774f69cd7d53e78 Author: Alex Vesker Date: Sun Aug 17 23:23:22 2025 +0300 net/mlx5: HWS, Fix table creation UID During table creation, caller passes a UID using ft_attr. The UID value was ignored, which leads to problems when the caller sets the UID to a non-zero value, such as SHARED_RESOURCE_UID (0xffff) - the internal FT objects will be created with UID=0. Fixes: 0869701cba3d ("net/mlx5: HWS, added FW commands handling") Signed-off-by: Alex Vesker Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250817202323.308604-7-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 7c60952f83584bc4950057cfed2cc3c87343b5db Author: Yevgeny Kliteynik Date: Sun Aug 17 23:23:21 2025 +0300 net/mlx5: HWS, don't rehash on every kind of insertion failure If rule creation failed due to a full queue, due to timeout in polling for completion, or due to matcher being in resize, don't try to initiate rehash sequence - rehash would have failed anyway. Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Vlad Dogaru Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250817202323.308604-6-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 1a72298d27ce4d41b3fd405f6921e8711815767a Author: Yevgeny Kliteynik Date: Sun Aug 17 23:23:20 2025 +0300 net/mlx5: HWS, prevent rehash from filling up the queues While moving the rules during rehash, CQ is not drained. The flush and drain happens only when all the rules of a certain queue have been moved. This behaviour can lead to accumulating large quantity of rules that haven't got their completion yet, and eventually will fill up the queue and will cause the rehash to fail. Fix this problem by requiring drain once the number of outstanding completions reaches a certain threshold. Fixes: ef94799a8741 ("net/mlx5: HWS, rework rehash loop") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Vlad Dogaru Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250817202323.308604-5-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 4a842b1bf18a32ee0c25dd6dd98728b786a76fe4 Author: Yevgeny Kliteynik Date: Sun Aug 17 23:23:19 2025 +0300 net/mlx5: HWS, fix complex rules rehash error flow Moving rules from matcher to matcher should not fail. However, if it does fail due to various reasons, the error flow should allow the kernel to continue functioning (albeit with broken steering rules) instead of going into series of soft lock-ups or some other problematic behaviour. Similar to the simple rules, complex rules rehash logic suffers from the same problems. This patch fixes the error flow for moving complex rules: - If new rule creation fails before it was even enqeued, do not poll for completion - If TIMEOUT happened while moving the rule, no point trying to poll for completions for other rules. Something is broken, completion won't come, just abort the rehash sequence. - If some other completion with error received, don't give up. Continue handling rest of the rules to minimize the damage. - Make sure that the first error code that was received will be actually returned to the caller instead of replacing it with the generic error code. All the aforementioned issues stem from the same bad error flow, so no point fixing them one by one and leaving partially broken code - fixing them in one patch. Fixes: 17e0accac577 ("net/mlx5: HWS, support complex matchers") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Vlad Dogaru Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250817202323.308604-4-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 615b690612b7785ab8632f6a5a941550622e4e36 Author: Yevgeny Kliteynik Date: Sun Aug 17 23:23:18 2025 +0300 net/mlx5: HWS, fix simple rules rehash error flow Moving rules from matcher to matcher should not fail. However, if it does fail due to various reasons, the error flow should allow the kernel to continue functioning (albeit with broken steering rules) instead of going into series of soft lock-ups or some other problematic behaviour. This patch fixes the error flow for moving simple rules: - If new rule creation fails before it was even enqeued, do not poll for completion - If TIMEOUT happened while moving the rule, no point trying to poll for completions for other rules. Something is broken, completion won't come, just abort the rehash sequence. - If some other completion with error received, don't give up. Continue handling rest of the rules to minimize the damage. - Make sure that the first error code that was received will be actually returned to the caller instead of replacing it with the generic error code. All the aforementioned issues stem from the same bad error flow, so no point fixing them one by one and leaving partially broken code - fixing them in one patch. Fixes: ef94799a8741 ("net/mlx5: HWS, rework rehash loop") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Vlad Dogaru Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250817202323.308604-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 2462c1b9217246a889ec318b3894d84e4dd709c6 Author: Yevgeny Kliteynik Date: Sun Aug 17 23:23:17 2025 +0300 net/mlx5: HWS, fix bad parameter in CQ creation 'cqe_sz' valid value should be 0 for 64-byte CQE. Fixes: 2ca62599aa0b ("net/mlx5: HWS, added send engine and context handling") Signed-off-by: Yevgeny Kliteynik Reviewed-by: Vlad Dogaru Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250817202323.308604-2-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit d9cef55ed49117bd63695446fb84b4b91815c0b4 Author: D. Wythe Date: Mon Aug 18 13:46:18 2025 +0800 net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: error_code(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [ 16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT I [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2 [ 16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL E [ 16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201 4 [ 16.450201] Workqueue: smc_hs_wq smc_listen_wor k [ 16.450531] RIP: 0010:smc_listen_work+0xc02/0x159 0 [ 16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024 6 [ 16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030 0 [ 16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000 0 [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5 [ 16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640 0 [ 16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092 0 [ 16.454996] FS: 0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000 0 [ 16.455557] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3 [ 16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef 0 [ 16.456459] PKRU: 5555555 4 [ 16.456654] Call Trace : [ 16.456832] [ 16.456989] ? __die+0x23/0x7 0 [ 16.457215] ? page_fault_oops+0x180/0x4c 0 [ 16.457508] ? __lock_acquire+0x3e6/0x249 0 [ 16.457801] ? exc_page_fault+0x68/0x20 0 [ 16.458080] ? asm_exc_page_fault+0x26/0x3 0 [ 16.458389] ? smc_listen_work+0xc02/0x159 0 [ 16.458689] ? smc_listen_work+0xc02/0x159 0 [ 16.458987] ? lock_is_held_type+0x8f/0x10 0 [ 16.459284] process_one_work+0x1ea/0x6d 0 [ 16.459570] worker_thread+0x1c3/0x38 0 [ 16.459839] ? __pfx_worker_thread+0x10/0x1 0 [ 16.460144] kthread+0xe0/0x11 0 [ 16.460372] ? __pfx_kthread+0x10/0x1 0 [ 16.460640] ret_from_fork+0x31/0x5 0 [ 16.460896] ? __pfx_kthread+0x10/0x1 0 [ 16.461166] ret_from_fork_asm+0x1a/0x3 0 [ 16.461453] [ 16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE) ] [ 16.462134] CR2: 000000000000003 0 [ 16.462380] ---[ end trace 0000000000000000 ]--- [ 16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590 The direct cause of this issue is that after smc_listen_out_connected(), newclcsock->sk may be NULL since it will releases the smcsk. Therefore, if the application closes the socket immediately after accept, newclcsock->sk can be NULL. A possible execution order could be as follows: smc_listen_work | userspace ----------------------------------------------------------------- lock_sock(sk) | smc_listen_out_connected() | | \- smc_listen_out | | | \- release_sock | | |- sk->sk_data_ready() | | fd = accept(); | close(fd); | \- socket->sk = NULL; /* newclcsock->sk is NULL now */ SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk)) Since smc_listen_out_connected() will not fail, simply swapping the order of the code can easily fix this issue. Fixes: 3b2dec2603d5 ("net/smc: restructure client and server code in af_smc") Signed-off-by: D. Wythe Reviewed-by: Guangguan Wang Reviewed-by: Alexandra Winter Reviewed-by: Dust Li Link: https://patch.msgid.link/20250818054618.41615-1-alibuda@linux.alibaba.com Signed-off-by: Jakub Kicinski commit 6d6714bf0c4e8eb2274081b4b023dfa01581c123 Author: Yao Zi Date: Fri Aug 15 10:48:03 2025 +0000 net: stmmac: thead: Enable TX clock before MAC initialization The clk_tx_i clock must be supplied to the MAC for successful initialization. On TH1520 SoC, the clock is provided by an internal divider configured through GMAC_PLLCLK_DIV register when using RGMII interface. However, currently we don't setup the divider before initialization of the MAC, resulting in DMA reset failures if the bootloader/firmware doesn't enable the divider, [ 7.839601] thead-dwmac ffe7060000.ethernet eth0: Register MEM_TYPE_PAGE_POOL RxQ-0 [ 7.938338] thead-dwmac ffe7060000.ethernet eth0: PHY [stmmac-0:02] driver [RTL8211F Gigabit Ethernet] (irq=POLL) [ 8.160746] thead-dwmac ffe7060000.ethernet eth0: Failed to reset the dma [ 8.170118] thead-dwmac ffe7060000.ethernet eth0: stmmac_hw_setup: DMA engine initialization failed [ 8.179384] thead-dwmac ffe7060000.ethernet eth0: __stmmac_open: Hw setup failed Let's simply write GMAC_PLLCLK_DIV_EN to GMAC_PLLCLK_DIV to enable the divider before MAC initialization. Note that for reconfiguring the divisor, the divider must be disabled first and re-enabled later to make sure the new divisor take effect. The exact clock rate doesn't affect MAC's initialization according to my test. It's set to the speed required by RGMII when the linkspeed is 1Gbps and could be reclocked later after link is up if necessary. Fixes: 33a1a01e3afa ("net: stmmac: Add glue layer for T-HEAD TH1520 SoC") Signed-off-by: Yao Zi Reviewed-by: Drew Fustini Link: https://patch.msgid.link/20250815104803.55294-1-ziyao@disroot.org Signed-off-by: Jakub Kicinski commit 75a9a46d67f46d608205888f9b34e315c1786345 Author: Jordan Rhee Date: Mon Aug 18 14:12:45 2025 -0700 gve: prevent ethtool ops after shutdown A crash can occur if an ethtool operation is invoked after shutdown() is called. shutdown() is invoked during system shutdown to stop DMA operations without performing expensive deallocations. It is discouraged to unregister the netdev in this path, so the device may still be visible to userspace and kernel helpers. In gve, shutdown() tears down most internal data structures. If an ethtool operation is dispatched after shutdown(), it will dereference freed or NULL pointers, leading to a kernel panic. While graceful shutdown normally quiesces userspace before invoking the reboot syscall, forced shutdowns (as observed on GCP VMs) can still trigger this path. Fix by calling netif_device_detach() in shutdown(). This marks the device as detached so the ethtool ioctl handler will skip dispatching operations to the driver. Fixes: 974365e51861 ("gve: Implement suspend/resume/shutdown") Signed-off-by: Jordan Rhee Signed-off-by: Jeroen de Borst Link: https://patch.msgid.link/20250818211245.1156919-1-jeroendb@google.com Signed-off-by: Jakub Kicinski commit 24ef2f53c07f273bad99173e27ee88d44d135b1c Author: Yuichiro Tsuji Date: Mon Aug 18 17:45:07 2025 +0900 net: usb: asix_devices: Fix PHY address mask in MDIO bus initialization Syzbot reported shift-out-of-bounds exception on MDIO bus initialization. The PHY address should be masked to 5 bits (0-31). Without this mask, invalid PHY addresses could be used, potentially causing issues with MDIO bus operations. Fix this by masking the PHY address with 0x1f (31 decimal) to ensure it stays within the valid range. Fixes: 4faff70959d5 ("net: usb: asix_devices: add phy_mask for ax88772 mdio bus") Reported-by: syzbot+20537064367a0f98d597@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=20537064367a0f98d597 Tested-by: syzbot+20537064367a0f98d597@syzkaller.appspotmail.com Signed-off-by: Yuichiro Tsuji Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250818084541.1958-1-yuichtsu@amazon.com Signed-off-by: Jakub Kicinski commit bc1a59cff9f797bfbf8f3104507584d89e9ecf2e Author: Horatiu Vultur Date: Mon Aug 18 10:10:29 2025 +0200 phy: mscc: Fix timestamping for vsc8584 There was a problem when we received frames and the frames were timestamped. The driver is configured to store the nanosecond part of the timestmap in the ptp reserved bits and it would take the second part by reading the LTC. The problem is that when reading the LTC we are in atomic context and to read the second part will go over mdio bus which might sleep, so we get an error. The fix consists in actually put all the frames in a queue and start the aux work and in that work to read the LTC and then calculate the full received time. Fixes: 7d272e63e0979d ("net: phy: mscc: timestamping and PHC support") Signed-off-by: Horatiu Vultur Reviewed-by: Vadim Fedorenko Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20250818081029.1300780-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit f179f5bc158f07693b74c264f8933c8b0f07503f Author: Victor Nogueira Date: Fri Aug 15 10:53:17 2025 -0300 net/sched: sch_dualpi2: Run prob update timer in softirq to avoid deadlock When a user creates a dualpi2 qdisc it automatically sets a timer. This timer will run constantly and update the qdisc's probability field. The issue is that the timer acquires the qdisc root lock and runs in hardirq. The qdisc root lock is also acquired in dev.c whenever a packet arrives for this qdisc. Since the dualpi2 timer callback runs in hardirq, it may interrupt the packet processing running in softirq. If that happens and it runs on the same CPU, it will acquire the same lock and cause a deadlock. The following splat shows up when running a kernel compiled with lock debugging: [ +0.000224] WARNING: inconsistent lock state [ +0.000224] 6.16.0+ #10 Not tainted [ +0.000169] -------------------------------- [ +0.000029] inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. [ +0.000000] ping/156 [HC0[0]:SC0[2]:HE1:SE0] takes: [ +0.000000] ffff897841242110 (&sch->root_lock_key){?.-.}-{3:3}, at: __dev_queue_xmit+0x86d/0x1140 [ +0.000000] {IN-HARDIRQ-W} state was registered at: [ +0.000000] lock_acquire.part.0+0xb6/0x220 [ +0.000000] _raw_spin_lock+0x31/0x80 [ +0.000000] dualpi2_timer+0x6f/0x270 [ +0.000000] __hrtimer_run_queues+0x1c5/0x360 [ +0.000000] hrtimer_interrupt+0x115/0x260 [ +0.000000] __sysvec_apic_timer_interrupt+0x6d/0x1a0 [ +0.000000] sysvec_apic_timer_interrupt+0x6e/0x80 [ +0.000000] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ +0.000000] pv_native_safe_halt+0xf/0x20 [ +0.000000] default_idle+0x9/0x10 [ +0.000000] default_idle_call+0x7e/0x1e0 [ +0.000000] do_idle+0x1e8/0x250 [ +0.000000] cpu_startup_entry+0x29/0x30 [ +0.000000] rest_init+0x151/0x160 [ +0.000000] start_kernel+0x6f3/0x700 [ +0.000000] x86_64_start_reservations+0x24/0x30 [ +0.000000] x86_64_start_kernel+0xc8/0xd0 [ +0.000000] common_startup_64+0x13e/0x148 [ +0.000000] irq event stamp: 6884 [ +0.000000] hardirqs last enabled at (6883): [] neigh_resolve_output+0x223/0x270 [ +0.000000] hardirqs last disabled at (6882): [] neigh_resolve_output+0x1e8/0x270 [ +0.000000] softirqs last enabled at (6880): [] neigh_resolve_output+0x1db/0x270 [ +0.000000] softirqs last disabled at (6884): [] __dev_queue_xmit+0x73/0x1140 [ +0.000000] other info that might help us debug this: [ +0.000000] Possible unsafe locking scenario: [ +0.000000] CPU0 [ +0.000000] ---- [ +0.000000] lock(&sch->root_lock_key); [ +0.000000] [ +0.000000] lock(&sch->root_lock_key); [ +0.000000] *** DEADLOCK *** [ +0.000000] 4 locks held by ping/156: [ +0.000000] #0: ffff897842332e08 (sk_lock-AF_INET){+.+.}-{0:0}, at: raw_sendmsg+0x41e/0xf40 [ +0.000000] #1: ffffffffa816f880 (rcu_read_lock){....}-{1:3}, at: ip_output+0x2c/0x190 [ +0.000000] #2: ffffffffa816f880 (rcu_read_lock){....}-{1:3}, at: ip_finish_output2+0xad/0x950 [ +0.000000] #3: ffffffffa816f840 (rcu_read_lock_bh){....}-{1:3}, at: __dev_queue_xmit+0x73/0x1140 I am able to reproduce it consistently when running the following: tc qdisc add dev lo handle 1: root dualpi2 ping -f 127.0.0.1 To fix it, make the timer run in softirq. Fixes: 320d031ad6e4 ("sched: Struct definition and parsing of dualpi2 qdisc") Reviewed-by: Jamal Hadi Salim Signed-off-by: Victor Nogueira Link: https://patch.msgid.link/20250815135317.664993-1-victor@mojatatu.com Signed-off-by: Jakub Kicinski commit 7b128f1d53dcaa324d4aa05d821a6bf4a7b203e7 Author: Tao Chen Date: Fri Aug 8 12:05:27 2025 +0800 rtla: Check pkg-config install The tool pkg-config used to check libtraceevent and libtracefs, if not installed, it will report the libs not found, even though they have already been installed. Before: libtraceevent is missing. Please install libtraceevent-dev/libtraceevent-devel libtracefs is missing. Please install libtracefs-dev/libtracefs-devel After: Makefile.config:10: *** Error: pkg-config needed by libtraceevent/libtracefs is missing on this system, please install it. Link: https://lore.kernel.org/20250808040527.2036023-2-chen.dylane@linux.dev Fixes: 01474dc706ca ("tools/rtla: Use tools/build makefiles to build rtla") Signed-off-by: Tao Chen Signed-off-by: Steven Rostedt (Google) commit 26ebba25e210116053609f4c7ee701bffa7ebd7d Author: Tao Chen Date: Fri Aug 8 12:05:26 2025 +0800 tools/latency-collector: Check pkg-config install The tool pkg-config used to check libtraceevent and libtracefs, if not installed, it will report the libs not found, even though they have already been installed. Before: libtraceevent is missing. Please install libtraceevent-dev/libtraceevent-devel libtracefs is missing. Please install libtracefs-dev/libtracefs-devel After: Makefile.config:10: *** Error: pkg-config needed by libtraceevent/libtracefs is missing on this system, please install it. Link: https://lore.kernel.org/20250808040527.2036023-1-chen.dylane@linux.dev Fixes: 9d56c88e5225 ("tools/tracing: Use tools/build makefiles on latency-collector") Signed-off-by: Tao Chen Signed-off-by: Steven Rostedt (Google) commit 4a73a36cb704813f588af13d9842d0ba5a185758 Author: Lubomir Rintel Date: Thu Aug 14 17:42:14 2025 +0200 cdc_ncm: Flag Intel OEM version of Fibocom L850-GL as WWAN This lets NetworkManager/ModemManager know that this is a modem and needs to be connected first. Signed-off-by: Lubomir Rintel Link: https://patch.msgid.link/20250814154214.250103-1-lkundrak@v3.sk Signed-off-by: Jakub Kicinski commit 772e5b4a5e8360743645b9a466842d16092c4f94 Author: David Hildenbrand Date: Mon Aug 18 19:53:58 2025 +0200 mm/mremap: fix WARN with uffd that has remap events disabled Registering userfaultd on a VMA that spans at least one PMD and then mremap()'ing that VMA can trigger a WARN when recovering from a failed page table move due to a page table allocation error. The code ends up doing the right thing (recurse, avoiding moving actual page tables), but triggering that WARN is unpleasant: WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_normal_pmd mm/mremap.c:357 [inline] WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_pgt_entry mm/mremap.c:595 [inline] WARNING: CPU: 2 PID: 6133 at mm/mremap.c:357 move_page_tables+0x3832/0x44a0 mm/mremap.c:852 Modules linked in: CPU: 2 UID: 0 PID: 6133 Comm: syz.0.19 Not tainted 6.17.0-rc1-syzkaller-00004-g53e760d89498 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:move_normal_pmd mm/mremap.c:357 [inline] RIP: 0010:move_pgt_entry mm/mremap.c:595 [inline] RIP: 0010:move_page_tables+0x3832/0x44a0 mm/mremap.c:852 Code: ... RSP: 0018:ffffc900037a76d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000032930007 RCX: ffffffff820c6645 RDX: ffff88802e56a440 RSI: ffffffff820c7201 RDI: 0000000000000007 RBP: ffff888037728fc0 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000032930007 R11: 0000000000000000 R12: 0000000000000000 R13: ffffc900037a79a8 R14: 0000000000000001 R15: dffffc0000000000 FS: 000055556316a500(0000) GS:ffff8880d68bc000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30863fff CR3: 0000000050171000 CR4: 0000000000352ef0 Call Trace: copy_vma_and_data+0x468/0x790 mm/mremap.c:1215 move_vma+0x548/0x1780 mm/mremap.c:1282 mremap_to+0x1b7/0x450 mm/mremap.c:1406 do_mremap+0xfad/0x1f80 mm/mremap.c:1921 __do_sys_mremap+0x119/0x170 mm/mremap.c:1977 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f00d0b8ebe9 Code: ... RSP: 002b:00007ffe5ea5ee98 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 RAX: ffffffffffffffda RBX: 00007f00d0db5fa0 RCX: 00007f00d0b8ebe9 RDX: 0000000000400000 RSI: 0000000000c00000 RDI: 0000200000000000 RBP: 00007ffe5ea5eef0 R08: 0000200000c00000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000002 R13: 00007f00d0db5fa0 R14: 00007f00d0db5fa0 R15: 0000000000000005 The underlying issue is that we recurse during the original page table move, but not during the recovery move. Fix it by checking for both VMAs and performing the check before the pmd_none() sanity check. Add a new helper where we perform+document that check for the PMD and PUD level. Thanks to Harry for bisecting. Link: https://lkml.kernel.org/r/20250818175358.1184757-1-david@redhat.com Fixes: 0cef0bb836e3 ("mm: clear uffd-wp PTE/PMD state on mremap()") Signed-off-by: David Hildenbrand Reported-by: syzbot+4d9a13f0797c46a29e42@syzkaller.appspotmail.com Closes: https://lkml.kernel.org/r/689bb893.050a0220.7f033.013a.GAE@google.com Tested-by: Harry Yoo Cc: "Liam R. Howlett" Cc: Lorenzo Stoakes Cc: Vlastimil Babka Cc: Jann Horn Cc: Pedro Falcato Cc: Signed-off-by: Andrew Morton commit ba1dd7ac735d604249f1e614d997dc66b30844ab Author: SeongJae Park Date: Sat Aug 16 09:55:59 2025 -0700 mm/damon/sysfs-schemes: put damos dests dir after removing its files damon_sysfs_scheme_rm_dirs() puts dests directory kobject before removing its internal files. Sincee putting the kobject frees its container struct, and the internal files removal accesses the container, use-after-free happens. Fix it by putting the reference _after_ removing the files. Link: https://lkml.kernel.org/r/20250816165559.2601-1-sj@kernel.org Fixes: 2cd0bf85a203 ("mm/damon/sysfs-schemes: implement DAMOS action destinations directory") Signed-off-by: SeongJae Park Reported-by: Alexandre Ghiti Closes: https://lore.kernel.org/2d39a734-320d-4341-8f8a-4019eec2dbf2@ghiti.fr Tested-by: Alexandre Ghiti Signed-off-by: Andrew Morton commit 053c8ebe74f7e1f4c072e59428da80b9d78bc4b7 Author: Huacai Chen Date: Sun Aug 17 23:17:59 2025 +0800 mm/migrate: fix NULL movable_ops if CONFIG_ZSMALLOC=m After commit 84caf98838a3e5f4bdb34 ("mm: stop storing migration_ops in page->mapping") we get such an error message if CONFIG_ZSMALLOC=m: WARNING: CPU: 3 PID: 42 at mm/migrate.c:142 isolate_movable_ops_page+0xa8/0x1c0 CPU: 3 UID: 0 PID: 42 Comm: kcompactd0 Not tainted 6.16.0-rc5+ #2133 PREEMPT pc 9000000000540bd8 ra 9000000000540b84 tp 9000000100420000 sp 9000000100423a60 a0 9000000100193a80 a1 000000000000000c a2 000000000000001b a3 ffffffffffffffff a4 ffffffffffffffff a5 0000000000000267 a6 0000000000000000 a7 9000000100423ae0 t0 00000000000000f1 t1 00000000000000f6 t2 0000000000000000 t3 0000000000000001 t4 ffffff00010eb834 t5 0000000000000040 t6 900000010c89d380 t7 90000000023fcc70 t8 0000000000000018 u0 0000000000000000 s9 ffffff00010eb800 s0 ffffff00010eb800 s1 000000000000000c s2 0000000000043ae0 s3 0000800000000000 s4 900000000219cc40 s5 0000000000000000 s6 ffffff00010eb800 s7 0000000000000001 s8 90000000025b4000 ra: 9000000000540b84 isolate_movable_ops_page+0x54/0x1c0 ERA: 9000000000540bd8 isolate_movable_ops_page+0xa8/0x1c0 CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE) PRMD: 00000004 (PPLV0 +PIE -PWE) EUEN: 00000000 (-FPE -SXE -ASXE -BTE) ECFG: 00071c1d (LIE=0,2-4,10-12 VS=7) ESTAT: 000c0000 [BRK] (IS= ECode=12 EsubCode=0) PRID: 0014c010 (Loongson-64bit, Loongson-3A5000) CPU: 3 UID: 0 PID: 42 Comm: kcompactd0 Not tainted 6.16.0-rc5+ #2133 PREEMPT Stack : 90000000021fd000 0000000000000000 9000000000247720 9000000100420000 90000001004236a0 90000001004236a8 0000000000000000 90000001004237e8 90000001004237e0 90000001004237e0 9000000100423550 0000000000000001 0000000000000001 90000001004236a8 725a84864a19e2d9 90000000023fcc58 9000000100420000 90000000024c6848 9000000002416848 0000000000000001 0000000000000000 000000000000000a 0000000007fe0000 ffffff00010eb800 0000000000000000 90000000021fd000 0000000000000000 900000000205cf30 000000000000008e 0000000000000009 ffffff00010eb800 0000000000000001 90000000025b4000 0000000000000000 900000000024773c 00007ffff103d748 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1d ... Call Trace: [<900000000024773c>] show_stack+0x5c/0x190 [<90000000002415e0>] dump_stack_lvl+0x70/0x9c [<90000000004abe6c>] isolate_migratepages_block+0x3bc/0x16e0 [<90000000004af408>] compact_zone+0x558/0x1000 [<90000000004b0068>] compact_node+0xa8/0x1e0 [<90000000004b0aa4>] kcompactd+0x394/0x410 [<90000000002b3c98>] kthread+0x128/0x140 [<9000000001779148>] ret_from_kernel_thread+0x28/0xc0 [<9000000000245528>] ret_from_kernel_thread_asm+0x10/0x88 The reason is that defined(CONFIG_ZSMALLOC) evaluates to 1 only when CONFIG_ZSMALLOC=y, we should use IS_ENABLED(CONFIG_ZSMALLOC) instead. But when I use IS_ENABLED(CONFIG_ZSMALLOC), page_movable_ops() cannot access zsmalloc_mops because zsmalloc_mops is in a module. To solve this problem, we define a set_movable_ops() interface to register and unregister offline_movable_ops / zsmalloc_movable_ops in mm/migrate.c, and call them at mm/balloon_compaction.c & mm/zsmalloc.c. Since offline_movable_ops / zsmalloc_movable_ops are always accessible, all #ifdef / #endif are removed in page_movable_ops(). Link: https://lkml.kernel.org/r/20250817151759.2525174-1-chenhuacai@loongson.cn Fixes: 84caf98838a3 ("mm: stop storing migration_ops in page->mapping") Signed-off-by: Huacai Chen Acked-by: Zi Yan Acked-by: David Hildenbrand Cc: Huacai Chen Cc: Huacai Chen Cc: Lorenzo Stoakes Cc: "Michael S. Tsirkin" Cc: Minchan Kim Cc: Sergey Senozhatsky Signed-off-by: Andrew Morton commit b3dee902b6c26b7d8031a4df19753e27dcfcba01 Author: Sang-Heon Jeon Date: Sat Aug 16 10:51:16 2025 +0900 mm/damon/core: fix damos_commit_filter not changing allow Current damos_commit_filter() does not persist the `allow' value of the filter. As a result, changing the `allow' value of a filter and committing doesn't change the `allow' value. Add the missing `allow' value update, so committing the filter persistently changes the `allow' value well. Link: https://lkml.kernel.org/r/20250816015116.194589-1-ekffu200098@gmail.com Fixes: fe6d7fdd6249 ("mm/damon/core: add damos_filter->allow field") Signed-off-by: Sang-Heon Jeon Reviewed-by: SeongJae Park Cc: [6.14.x] Signed-off-by: Andrew Morton commit 2e6053fea379806269c4f7f5e36b523c9c0fb35c Author: Jinjiang Tu Date: Fri Aug 15 15:32:09 2025 +0800 mm/memory-failure: fix infinite UCE for VM_PFNMAP pfn When memory_failure() is called for a already hwpoisoned pfn, kill_accessing_process() will be called to kill current task. However, if the vma of the accessing vaddr is VM_PFNMAP, walk_page_range() will skip the vma in walk_page_test() and return 0. Before commit aaf99ac2ceb7 ("mm/hwpoison: do not send SIGBUS to processes with recovered clean pages"), kill_accessing_process() will return EFAULT. For x86, the current task will be killed in kill_me_maybe(). However, after this commit, kill_accessing_process() simplies return 0, that means UCE is handled properly, but it doesn't actually. In such case, the user task will trigger UCE infinitely. To fix it, add .test_walk callback for hwpoison_walk_ops to scan all vmas. Link: https://lkml.kernel.org/r/20250815073209.1984582-1-tujinjiang@huawei.com Fixes: aaf99ac2ceb7 ("mm/hwpoison: do not send SIGBUS to processes with recovered clean pages") Signed-off-by: Jinjiang Tu Acked-by: David Hildenbrand Acked-by: Miaohe Lin Reviewed-by: Jane Chu Cc: Kefeng Wang Cc: Naoya Horiguchi Cc: Oscar Salvador Cc: Shuai Xue Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit 44958000badae5488d91431de194f747acc5dcac Author: Axel Rasmussen Date: Fri Aug 15 14:59:14 2025 -0700 MAINTAINERS: mark MGLRU as maintained The three folks being added here are actively working on MGLRU within Google, so we can review patches for this feature and plan to contribute some improvements / extensions to it on an ongoing basis. With three of us we may have some hope filling Yu Zhao's shoes, since he has moved on to other projects these days. Link: https://lkml.kernel.org/r/20250815215914.3671925-1-axelrasmussen@google.com Signed-off-by: Axel Rasmussen Cc: Lorenzo Stoakes Cc: Axel Rasmussen Cc: Shakeel Butt Cc: Wei Xu Cc: Yuanchu Xie Cc: Yu Zhao Signed-off-by: Andrew Morton commit c7b70f76db0703a93b39a85b540d5b3911e166e8 Author: Alice Ryhl Date: Thu Aug 14 07:54:54 2025 +0000 mm: rust: add page.rs to MEMORY MANAGEMENT - RUST The page.rs file currently isn't included anywhere, and I think it's a good fit for the MEMORY MANAGEMENT - RUST entry. The file was originally added for use by Rust Binder, but I believe there is also work to use it in the upcoming scatterlist abstractions. Link: https://lkml.kernel.org/r/20250814075454.1596482-1-aliceryhl@google.com Signed-off-by: Alice Ryhl Acked-by: Danilo Krummrich Cc: Danilo Krummrich Cc: Liam Howlett Cc: "Uladzislau Rezki (Sony)" Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 808471ddb0fa785559c3e7aee59be20a13b46ef5 Author: Dominique Martinet Date: Wed Aug 13 15:04:55 2025 +0900 iov_iter: iterate_folioq: fix handling of offset >= folio size It's apparently possible to get an iov advanced all the way up to the end of the current page we're looking at, e.g. (gdb) p *iter $24 = {iter_type = 4 '\004', nofault = false, data_source = false, iov_offset = 4096, {__ubuf_iovec = { iov_base = 0xffff88800f5bc000, iov_len = 655}, {{__iov = 0xffff88800f5bc000, kvec = 0xffff88800f5bc000, bvec = 0xffff88800f5bc000, folioq = 0xffff88800f5bc000, xarray = 0xffff88800f5bc000, ubuf = 0xffff88800f5bc000}, count = 655}}, {nr_segs = 2, folioq_slot = 2 '\002', xarray_start = 2}} Where iov_offset is 4k with 4k-sized folios This should have been fine because we're only in the 2nd slot and there's another one after this, but iterate_folioq should not try to map a folio that skips the whole size, and more importantly part here does not end up zero (because 'PAGE_SIZE - skip % PAGE_SIZE' ends up PAGE_SIZE and not zero..), so skip forward to the "advance to next folio" code Link: https://lkml.kernel.org/r/20250813-iot_iter_folio-v3-0-a0ffad2b665a@codewreck.org Link: https://lkml.kernel.org/r/20250813-iot_iter_folio-v3-1-a0ffad2b665a@codewreck.org Signed-off-by: Dominique Martinet Fixes: db0aa2e9566f ("mm: Define struct folio_queue and ITER_FOLIOQ to handle a sequence of folios") Reported-by: Maximilian Bosch Reported-by: Ryan Lahfa Reported-by: Christian Theune Reported-by: Arnout Engelen Link: https://lkml.kernel.org/r/D4LHHUNLG79Y.12PI0X6BEHRHW@mbosch.me/ Acked-by: David Howells Cc: Al Viro Cc: Christian Brauner Cc: Matthew Wilcox (Oracle) Cc: [6.12+] Signed-off-by: Andrew Morton commit 0cc2a4880ced1486acc34898cd85edc6ee109c4c Author: Sang-Heon Jeon Date: Tue Aug 12 23:00:46 2025 +0900 selftests/damon: fix selftests by installing drgn related script drgn_dump_damon_status is not installed during kselftest setup. It can break other tests which depend on drgn_dump_damon_status. Install drgn_dump_damon_status files to fix broken test. Link: https://lkml.kernel.org/r/20250812140046.660486-1-ekffu200098@gmail.com Fixes: f3e8e1e51362 ("selftests/damon: add drgn script for extracting damon status") Signed-off-by: Sang-Heon Jeon Reviewed-by: SeongJae Park Cc: Alexandre Ghiti Cc: Honggyu Kim Signed-off-by: Andrew Morton commit 8b26f0a8b4f220c1ec410e1350e8594911ec5742 Author: Easwar Hariharan Date: Tue Aug 12 18:02:14 2025 +0000 .mailmap: add entry for Easwar Hariharan Map my old, obsolete work email address to my current one. Link: https://lkml.kernel.org/r/20250812180218.92755-1-easwar.hariharan@linux.microsoft.com Signed-off-by: Easwar Hariharan Cc: Carlos Bilbao Cc: Jarkko Sakkinen Cc: Shannon Nelson Cc: Dmitry Baryshkov Cc: Hans Verkuil Signed-off-by: Andrew Morton commit 742d3663a5775cb7b957f4ca2ddb4ccd26badb94 Author: Lorenzo Stoakes Date: Sun Aug 3 12:11:23 2025 +0100 selftests/mm: add test for invalid multi VMA operations We can use UFFD to easily assert invalid multi VMA moves, so do so, asserting expected behaviour when VMAs invalid for a multi VMA operation are encountered. We assert both that such operations are not permitted, and that we do not even attempt to move the first VMA under these circumstances. We also assert that we can still move a single VMA regardless. We then assert that a partial failure can occur if the invalid VMA appears later in the range of multiple VMAs, both at the very next VMA, and also at the end of the range. As part of this change, we are using the is_range_valid() helper more aggressively. Therefore, fix a bug where stale buffered data would hang around on success, causing subsequent calls to is_range_valid() to potentially give invalid results. We simply have to fflush() the stream on success to resolve this issue. Link: https://lkml.kernel.org/r/c4fb86dd5ba37610583ad5fc0e0c2306ddf318b9.1754218667.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: David Hildenbrand Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d5f416c7c36456676c2cf5ab98776db2e7601f27 Author: Lorenzo Stoakes Date: Sun Aug 3 12:11:22 2025 +0100 mm/mremap: catch invalid multi VMA moves earlier Previously, any attempt to solely move a VMA would require that the span specified reside within the span of that single VMA, with no gaps before or afterwards. After commit d23cb648e365 ("mm/mremap: permit mremap() move of multiple VMAs"), the multi VMA move permitted a gap to exist only after VMAs. This was done to provide maximum flexibility. However, We have consequently permitted this behaviour for the move of a single VMA including those not eligible for multi VMA move. The change introduced here means that we no longer permit non-eligible VMAs from being moved in this way. This is consistent, as it means all eligible VMA moves are treated the same, and all non-eligible moves are treated as they were before. This change does not break previous behaviour, which equally would have disallowed such a move (only in all cases). [lorenzo.stoakes@oracle.com: do not incorrectly reference invalid VMA in VM_WARN_ON_ONCE()] Link: https://lkml.kernel.org/r/b6dbda20-667e-4053-abae-8ed4fa84bb6c@lucifer.local Link: https://lkml.kernel.org/r/2b5aad5681573be85b5b8fac61399af6fb6b68b6.1754218667.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: David Hildenbrand Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 7c91e0b91aaa3fa1f897efb06565af0ceb75195c Author: Lorenzo Stoakes Date: Sun Aug 3 12:11:21 2025 +0100 mm/mremap: allow multi-VMA move when filesystem uses thp_get_unmapped_area The multi-VMA move functionality introduced in commit d23cb648e365 ("mm/mremap: permit mremap() move of multiple VMA") doesn't allow moves of file-backed mappings which specify a custom f_op->get_unmapped_area handler excepting hugetlb and shmem. We expand this to include thp_get_unmapped_area to support file-backed mappings for filesystems which use large folios. Additionally, when the first VMA in a range is not compatible with a multi-VMA move, instead of moving the first VMA and returning an error, this series results in us not moving anything and returning an error immediately. Examining this second change in detail: The semantics of multi-VMA moves in mremap() very clearly indicate that a failure can result in a partial move of VMAs. This is in line with other aggregate operations within the kernel, which share these semantics. There are two classes of failures we're concerned with - eligiblity for mutli-VMA move, and transient failures that would occur even if the user individually moved each VMA. The latter is due to out-of-memory conditions (which, given the allocations involved are small, would likely be fatal in any case), or hitting the mapping limit. Regardless of the cause, transient issues would be fatal anyway, so it isn't really material which VMAs succeeded at being moved or not. However with when it comes to multi-VMA move eligiblity, we face another issue - we must allow a single VMA to succeed regardless of this eligiblity (as, of course, it is not a multi-VMA move) - but we must then fail multi-VMA operations. The two means by which VMAs may fail the eligbility test are - the VMAs being UFFD-armed, or the VMA being file-backed and providing its own f_op->get_unmapped_area() helper (because this may result in MREMAP_FIXED being disregarded), excepting those known to correctly handle MREMAP_FIXED. It is therefore conceivable that a user could erroneously try to use this functionality in these instances, and would prefer to not perform any move at all should that occur. This series therefore avoids any move of subsequent VMAs should the first be multi-VMA move ineligble and the input span exceeds that of the first VMA. We also add detailed test logic to assert that multi VMA move with ineligible VMAs functions as expected. This patch (of 3): We currently restrict multi-VMA move to avoid filesystems or drivers which provide a custom f_op->get_unmapped_area handler unless it is known to correctly handle MREMAP_FIXED. We do this so we do not get unexpected result when moving from one area to another (for instance, if the handler would align things resulting in the moved VMAs having different gaps than the original mapping). More and more filesystems are moving to using large folios, and typically do so (in part) by setting f_op->get_unmapped_area to thp_get_unmapped_area. When mremap() invokes the file system's get_unmapped MREMAP_FIXED, it does so via get_unmapped_area(), called in vrm_set_new_addr(). In order to do so, it converts the MREMAP_FIXED flag to a MAP_FIXED flag and passes this to the unmapped area handler. The __get_unmapped_area() function (called by get_unmapped_area()) in turn invokes the filesystem or driver's f_op->get_unmapped_area() handler. Therefore this is a point at which thp_get_unmapped_area() may be called (also, this is the case for anonymous mappings where the size is huge page aligned). thp_get_unmapped_area() calls thp_get_unmapped_area_vmflags() and __thp_get_unmapped_area() in turn (falling back to mm_get_unmapped_area_vm_flags() which is known to handle MAP_FIXED correctly). The __thp_get_unmapped_area() function in turn does nothing to change the address hint, nor the MAP_FIXED flag, only adjusting alignment parameters. It hten calls mm_get_unmapped_area_vmflags(), and in turn arch-specific unmapped area functions, all of which honour MAP_FIXED correctly. Therefore, we can safely add thp_get_unmapped_area to the known-good handlers. Link: https://lkml.kernel.org/r/cover.1754218667.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/4f2542340c29c84d3d470b0c605e916b192f6c81.1754218667.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: David Hildenbrand Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 63f5dec16760f2cd7d3f9034d18fc1fa0d83652f Author: Sang-Heon Jeon Date: Sun Aug 10 21:42:01 2025 +0900 mm/damon/core: fix commit_ops_filters by using correct nth function damos_commit_ops_filters() incorrectly uses damos_nth_filter() which iterates core_filters. As a result, performing a commit unintentionally corrupts ops_filters. Add damos_nth_ops_filter() which iterates ops_filters. Use this function to fix issues caused by wrong iteration. Link: https://lkml.kernel.org/r/20250810124201.15743-1-ekffu200098@gmail.com Fixes: 3607cc590f18 ("mm/damon/core: support committing ops_filters") # 6.15.x Signed-off-by: Sang-Heon Jeon Reviewed-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit 9a6a6a3191574a01dcf7a7d9385246d7bc8736bc Author: Lorenzo Stoakes Date: Mon Aug 11 06:26:54 2025 +0100 tools/testing: add linux/args.h header and fix radix, VMA tests Commit 857d18f23ab1 ("cleanup: Introduce ACQUIRE() and ACQUIRE_ERR() for conditional locks") accidentally broke the radix tree, VMA userland tests by including linux/args.h which is not present in the tools/include directory. This patch copies this over and adds an #ifdef block to avoid duplicate __CONCAT declaration in conflict with system headers when we ultimately include this. Link: https://lkml.kernel.org/r/20250811052654.33286-1-lorenzo.stoakes@oracle.com Fixes: 857d18f23ab1 ("cleanup: Introduce ACQUIRE() and ACQUIRE_ERR() for conditional locks") Signed-off-by: Lorenzo Stoakes Cc: Jann Horn Cc: John Hubbard Cc: Liam Howlett Cc: Sidhartha Kumar Cc: Vlastimil Babka Cc: Dan Williams Cc: Peter Zijlstra Signed-off-by: Andrew Morton commit dde30854bddfb5d69f30022b53c5955a41088b33 Author: Herton R. Krzesinski Date: Thu Jul 31 18:40:51 2025 -0300 mm/debug_vm_pgtable: clear page table entries at destroy_args() The mm/debug_vm_pagetable test allocates manually page table entries for the tests it runs, using also its manually allocated mm_struct. That in itself is ok, but when it exits, at destroy_args() it fails to clear those entries with the *_clear functions. The problem is that leaves stale entries. If another process allocates an mm_struct with a pgd at the same address, it may end up running into the stale entry. This is happening in practice on a debug kernel with CONFIG_DEBUG_VM_PGTABLE=y, for example this is the output with some extra debugging I added (it prints a warning trace if pgtables_bytes goes negative, in addition to the warning at check_mm() function): [ 2.539353] debug_vm_pgtable: [get_random_vaddr ]: random_vaddr is 0x7ea247140000 [ 2.539366] kmem_cache info [ 2.539374] kmem_cachep 0x000000002ce82385 - freelist 0x0000000000000000 - offset 0x508 [ 2.539447] debug_vm_pgtable: [init_args ]: args->mm is 0x000000002267cc9e (...) [ 2.552800] WARNING: CPU: 5 PID: 116 at include/linux/mm.h:2841 free_pud_range+0x8bc/0x8d0 [ 2.552816] Modules linked in: [ 2.552843] CPU: 5 UID: 0 PID: 116 Comm: modprobe Not tainted 6.12.0-105.debug_vm2.el10.ppc64le+debug #1 VOLUNTARY [ 2.552859] Hardware name: IBM,9009-41A POWER9 (architected) 0x4e0202 0xf000005 of:IBM,FW910.00 (VL910_062) hv:phyp pSeries [ 2.552872] NIP: c0000000007eef3c LR: c0000000007eef30 CTR: c0000000003d8c90 [ 2.552885] REGS: c0000000622e73b0 TRAP: 0700 Not tainted (6.12.0-105.debug_vm2.el10.ppc64le+debug) [ 2.552899] MSR: 800000000282b033 CR: 24002822 XER: 0000000a [ 2.552954] CFAR: c0000000008f03f0 IRQMASK: 0 [ 2.552954] GPR00: c0000000007eef30 c0000000622e7650 c000000002b1ac00 0000000000000001 [ 2.552954] GPR04: 0000000000000008 0000000000000000 c0000000007eef30 ffffffffffffffff [ 2.552954] GPR08: 00000000ffff00f5 0000000000000001 0000000000000048 0000000000004000 [ 2.552954] GPR12: 00000003fa440000 c000000017ffa300 c0000000051d9f80 ffffffffffffffdb [ 2.552954] GPR16: 0000000000000000 0000000000000008 000000000000000a 60000000000000e0 [ 2.552954] GPR20: 4080000000000000 c0000000113af038 00007fffcf130000 0000700000000000 [ 2.552954] GPR24: c000000062a6a000 0000000000000001 8000000062a68000 0000000000000001 [ 2.552954] GPR28: 000000000000000a c000000062ebc600 0000000000002000 c000000062ebc760 [ 2.553170] NIP [c0000000007eef3c] free_pud_range+0x8bc/0x8d0 [ 2.553185] LR [c0000000007eef30] free_pud_range+0x8b0/0x8d0 [ 2.553199] Call Trace: [ 2.553207] [c0000000622e7650] [c0000000007eef30] free_pud_range+0x8b0/0x8d0 (unreliable) [ 2.553229] [c0000000622e7750] [c0000000007f40b4] free_pgd_range+0x284/0x3b0 [ 2.553248] [c0000000622e7800] [c0000000007f4630] free_pgtables+0x450/0x570 [ 2.553274] [c0000000622e78e0] [c0000000008161c0] exit_mmap+0x250/0x650 [ 2.553292] [c0000000622e7a30] [c0000000001b95b8] __mmput+0x98/0x290 [ 2.558344] [c0000000622e7a80] [c0000000001d1018] exit_mm+0x118/0x1b0 [ 2.558361] [c0000000622e7ac0] [c0000000001d141c] do_exit+0x2ec/0x870 [ 2.558376] [c0000000622e7b60] [c0000000001d1ca8] do_group_exit+0x88/0x150 [ 2.558391] [c0000000622e7bb0] [c0000000001d1db8] sys_exit_group+0x48/0x50 [ 2.558407] [c0000000622e7be0] [c00000000003d810] system_call_exception+0x1e0/0x4c0 [ 2.558423] [c0000000622e7e50] [c00000000000d05c] system_call_vectored_common+0x15c/0x2ec (...) [ 2.558892] ---[ end trace 0000000000000000 ]--- [ 2.559022] BUG: Bad rss-counter state mm:000000002267cc9e type:MM_ANONPAGES val:1 [ 2.559037] BUG: non-zero pgtables_bytes on freeing mm: -6144 Here the modprobe process ended up with an allocated mm_struct from the mm_struct slab that was used before by the debug_vm_pgtable test. That is not a problem, since the mm_struct is initialized again etc., however, if it ends up using the same pgd table, it bumps into the old stale entry when clearing/freeing the page table entries, so it tries to free an entry already gone (that one which was allocated by the debug_vm_pgtable test), which also explains the negative pgtables_bytes since it's accounting for not allocated entries in the current process. As far as I looked pgd_{alloc,free} etc. does not clear entries, and clearing of the entries is explicitly done in the free_pgtables-> free_pgd_range->free_p4d_range->free_pud_range->free_pmd_range-> free_pte_range path. However, the debug_vm_pgtable test does not call free_pgtables, since it allocates mm_struct and entries manually for its test and eg. not goes through page faults. So it also should clear manually the entries before exit at destroy_args(). This problem was noticed on a reboot X number of times test being done on a powerpc host, with a debug kernel with CONFIG_DEBUG_VM_PGTABLE enabled. Depends on the system, but on a 100 times reboot loop the problem could manifest once or twice, if a process ends up getting the right mm->pgd entry with the stale entries used by mm/debug_vm_pagetable. After using this patch, I couldn't reproduce/experience the problems anymore. I was able to reproduce the problem as well on latest upstream kernel (6.16). I also modified destroy_args() to use mmput() instead of mmdrop(), there is no reason to hold mm_users reference and not release the mm_struct entirely, and in the output above with my debugging prints I already had patched it to use mmput, it did not fix the problem, but helped in the debugging as well. Link: https://lkml.kernel.org/r/20250731214051.4115182-1-herton@redhat.com Fixes: 3c9b84f044a9 ("mm/debug_vm_pgtable: introduce struct pgtable_debug_args") Signed-off-by: Herton R. Krzesinski Cc: Anshuman Khandual Cc: Christophe Leroy Cc: Gavin Shan Cc: Gerald Schaefer Cc: Signed-off-by: Andrew Morton commit b64700d41bdc4e9f82f1346c15a3678ebb91a89c Author: Phillip Lougher Date: Mon Aug 11 23:37:40 2025 +0100 squashfs: fix memory leak in squashfs_fill_super If sb_min_blocksize returns 0, squashfs_fill_super exits without freeing allocated memory (sb->s_fs_info). Fix this by moving the call to sb_min_blocksize to before memory is allocated. Link: https://lkml.kernel.org/r/20250811223740.110392-1-phillip@squashfs.org.uk Fixes: 734aa85390ea ("Squashfs: check return result of sb_min_blocksize") Signed-off-by: Phillip Lougher Reported-by: Scott GUO Closes: https://lore.kernel.org/all/20250811061921.3807353-1-scott_gzh@163.com Cc: Signed-off-by: Andrew Morton commit 44958f2025ed3f29fc3e93bb1f6c16121d7847ad Author: Pasha Tatashin Date: Fri Aug 8 20:18:04 2025 +0000 kho: warn if KHO is disabled due to an error During boot scratch area is allocated based on command line parameters or auto calculated. However, scratch area may fail to allocate, and in that case KHO is disabled. Currently, no warning is printed that KHO is disabled, which makes it confusing for the end user to figure out why KHO is not available. Add the missing warning message. Link: https://lkml.kernel.org/r/20250808201804.772010-4-pasha.tatashin@soleen.com Signed-off-by: Pasha Tatashin Acked-by: Mike Rapoport (Microsoft) Acked-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Changyuan Lyu Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Cc: Signed-off-by: Andrew Morton commit 8b66ed2c3f42cc462e05704af6b94e6a7bad2f5e Author: Pasha Tatashin Date: Fri Aug 8 20:18:03 2025 +0000 kho: mm: don't allow deferred struct page with KHO KHO uses struct pages for the preserved memory early in boot, however, with deferred struct page initialization, only a small portion of memory has properly initialized struct pages. This problem was detected where vmemmap is poisoned, and illegal flag combinations are detected. Don't allow them to be enabled together, and later we will have to teach KHO to work properly with deferred struct page init kernel feature. Link: https://lkml.kernel.org/r/20250808201804.772010-3-pasha.tatashin@soleen.com Fixes: 4e1d010e3bda ("kexec: add config option for KHO") Signed-off-by: Pasha Tatashin Acked-by: Mike Rapoport (Microsoft) Acked-by: Pratyush Yadav Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Changyuan Lyu Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Cc: Signed-off-by: Andrew Morton commit 63b17b653df30e90f95338083cb44c35d64bcae4 Author: Pasha Tatashin Date: Fri Aug 8 20:18:02 2025 +0000 kho: init new_physxa->phys_bits to fix lockdep Patch series "Several KHO Hotfixes". Three unrelated fixes for Kexec Handover. This patch (of 3): Lockdep shows the following warning: INFO: trying to register non-static key. The code is fine but needs lockdep annotation, or maybe you didn't initialize this object before use? turning off the locking correctness validator. [] dump_stack_lvl+0x66/0xa0 [] assign_lock_key+0x10c/0x120 [] register_lock_class+0xf4/0x2f0 [] __lock_acquire+0x7f/0x2c40 [] ? __pfx_hlock_conflict+0x10/0x10 [] ? native_flush_tlb_global+0x8e/0xa0 [] ? __flush_tlb_all+0x4e/0xa0 [] ? __kernel_map_pages+0x112/0x140 [] ? xa_load_or_alloc+0x67/0xe0 [] lock_acquire+0xe6/0x280 [] ? xa_load_or_alloc+0x67/0xe0 [] _raw_spin_lock+0x30/0x40 [] ? xa_load_or_alloc+0x67/0xe0 [] xa_load_or_alloc+0x67/0xe0 [] kho_preserve_folio+0x90/0x100 [] __kho_finalize+0xcf/0x400 [] kho_finalize+0x34/0x70 This is becase xa has its own lock, that is not initialized in xa_load_or_alloc. Modifiy __kho_preserve_order(), to properly call xa_init(&new_physxa->phys_bits); Link: https://lkml.kernel.org/r/20250808201804.772010-2-pasha.tatashin@soleen.com Fixes: fc33e4b44b27 ("kexec: enable KHO support for memory preservation") Signed-off-by: Pasha Tatashin Acked-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Arnd Bergmann Cc: Baoquan He Cc: Changyuan Lyu Cc: Coiby Xu Cc: Dave Vasilevsky Cc: Eric Biggers Cc: Kees Cook Cc: Pratyush Yadav Cc: Signed-off-by: Andrew Morton commit 82b350dd8185ce790e61555c436f90b6501af23c Author: Sven Eckelmann Date: Sun Aug 10 20:05:16 2025 +0200 i2c: rtl9300: Add missing count byte for SMBus Block Ops The expected on-wire format of an SMBus Block Write is S Addr Wr [A] Comm [A] Count [A] Data [A] Data [A] ... [A] Data [A] P Everything starting from the Count byte is provided by the I2C subsystem in the array data->block. But the driver was skipping the Count byte (data->block[0]) when sending it to the RTL93xx I2C controller. Only the actual data could be seen on the wire: S Addr Wr [A] Comm [A] Data [A] Data [A] ... [A] Data [A] P This wire format is not SMBus Block Write compatible but matches the format of an I2C Block Write. Simply adding the count byte to the buffer for the I2C controller is enough to fix the transmission. This also affects read because the I2C controller must receive the count byte + $count * data bytes. Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller") Signed-off-by: Sven Eckelmann Cc: # v6.13+ Reviewed-by: Chris Packham Tested-by: Chris Packham Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250810-i2c-rtl9300-multi-byte-v5-4-cd9dca0db722@narfation.org commit ceee7776c010c5f09d30985c9e5223b363a6172a Author: Sven Eckelmann Date: Sun Aug 10 20:05:15 2025 +0200 i2c: rtl9300: Increase timeout for transfer polling The timeout for transfers was only set to 2ms. Because of this relatively low limit, 12-byte read operations to the frontend MCU of a RTL8239 POE PSE chip cluster was consistently resulting in a timeout. The original OpenWrt downstream driver [1] was not using any timeout limit at all. This is also possible by setting the timeout_us parameter of regmap_read_poll_timeout() to 0. But since the driver currently implements the ETIMEDOUT error, it is more sensible to increase the timeout in such a way that communication with the (quite common) Realtek I2C-connected POE management solution is possible. [1] https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=target/linux/realtek/files-6.12/drivers/i2c/busses/i2c-rtl9300.c;h=c4d973195ef39dc56d6207e665d279745525fcac#l202 Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller") Signed-off-by: Sven Eckelmann Cc: # v6.13+ Reviewed-by: Chris Packham Tested-by: Chris Packham Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250810-i2c-rtl9300-multi-byte-v5-3-cd9dca0db722@narfation.org commit d67b740b9edfa46310355e2b68050f79ebf05a4c Author: Harshal Gohel Date: Sun Aug 10 20:05:14 2025 +0200 i2c: rtl9300: Fix multi-byte I2C write The RTL93xx I2C controller has 4 32 bit registers to store the bytes for the upcoming I2C transmission. The first byte is stored in the least-significant byte of the first register. And the last byte in the most significant byte of the last register. A map of the transferred bytes to their order in the registers is: reg 0: 0x04_03_02_01 reg 1: 0x08_07_06_05 reg 2: 0x0c_0b_0a_09 reg 3: 0x10_0f_0e_0d The i2c_read() function basically demonstrates how the hardware would pick up bytes from this register set. But the i2c_write() function was just pushing bytes one after another to the least significant byte of a register AFTER shifting the last one to the next more significant byte position. If you would then have tried to send a buffer with numbers 1-11 using i2c_write(), you would have ended up with following register content: reg 0: 0x01_02_03_04 reg 1: 0x05_06_07_08 reg 2: 0x00_09_0a_0b reg 3: 0x00_00_00_00 On the wire, you would then have seen: Sr Addr Wr [A] 04 A 03 A 02 A 01 A 08 A 07 A 06 A 05 A 0b A 0a A 09 A P But the correct data transmission was expected to be Sr Addr Wr [A] 01 A 02 A 03 A 04 A 05 A 06 A 07 A 08 A 09 A 0a A 0b A P Because of this multi-byte ordering problem, only single byte i2c_write() operations were executed correctly (on the wire). By shifting the byte directly to the correct end position in the register, it is possible to avoid this incorrect byte ordering and fix multi-byte transmissions. The second initialization (to 0) of vals was also be dropped because this array is initialized to 0 on the stack by using `= {};`. This makes the fix a lot more readable. Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller") Signed-off-by: Harshal Gohel Cc: # v6.13+ Co-developed-by: Sven Eckelmann Signed-off-by: Sven Eckelmann Reviewed-by: Chris Packham Tested-by: Chris Packham Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250810-i2c-rtl9300-multi-byte-v5-2-cd9dca0db722@narfation.org commit 57f312b955938fc4663f430cb57a71f2414f601b Author: Alex Guo Date: Sun Aug 10 20:05:13 2025 +0200 i2c: rtl9300: Fix out-of-bounds bug in rtl9300_i2c_smbus_xfer The data->block[0] variable comes from user. Without proper check, the variable may be very large to cause an out-of-bounds bug. Fix this bug by checking the value of data->block[0] first. 1. commit 39244cc75482 ("i2c: ismt: Fix an out-of-bounds bug in ismt_access()") 2. commit 92fbb6d1296f ("i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()") Fixes: c366be720235 ("i2c: Add driver for the RTL9300 I2C controller") Signed-off-by: Alex Guo Cc: # v6.13+ Reviewed-by: Chris Packham Tested-by: Chris Packham Reviewed-by: Wolfram Sang Signed-off-by: Sven Eckelmann Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250810-i2c-rtl9300-multi-byte-v5-1-cd9dca0db722@narfation.org commit d41e327582e172f30e4e15f9124796a10fd1b0f9 Author: Devyn Liu Date: Tue Aug 19 10:03:49 2025 +0800 MAINTAINERS: i2c: Update i2c_hisi entry Because Yicong Yang will no longer work on i2c_hisi driver, update the maintainer information for i2c_hisi. Signed-off-by: Devyn Liu Acked-by: Yicong Yang Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250819020349.4027842-1-liudingyuan@h-partners.com commit 76d2e3890fb169168c73f2e4f8375c7cc24a765e Author: Trond Myklebust Date: Sat Aug 16 07:25:20 2025 -0700 NFS: Fix a race when updating an existing write After nfs_lock_and_join_requests() tests for whether the request is still attached to the mapping, nothing prevents a call to nfs_inode_remove_request() from succeeding until we actually lock the page group. The reason is that whoever called nfs_inode_remove_request() doesn't necessarily have a lock on the page group head. So in order to avoid races, let's take the page group lock earlier in nfs_lock_and_join_requests(), and hold it across the removal of the request in nfs_inode_remove_request(). Reported-by: Jeff Layton Tested-by: Joe Quanaim Tested-by: Andrew Steffen Reviewed-by: Jeff Layton Fixes: bd37d6fce184 ("NFSv4: Convert nfs_lock_and_join_requests() to use nfs_page_find_head_request()") Cc: stable@vger.kernel.org Signed-off-by: Trond Myklebust commit b19a97d57c15643494ac8bfaaa35e3ee472d41da Merge: 7cca555b94a219 fb924b7b866950 Author: Linus Torvalds Date: Tue Aug 19 10:12:10 2025 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull mount fixes from Al Viro: "Fixes for several recent mount-related regressions" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: change_mnt_propagation(): calculate propagation source only if we'll need it use uniform permission checks for all mount propagation changes propagate_umount(): only surviving overmounts should be reparented fix the softlockups in attach_recursive_mnt() commit 7cca555b94a2191d012837a37c891eca4e876c6b Merge: 055f213075fbfa e8bd877fb76bb9 Author: Linus Torvalds Date: Tue Aug 19 10:08:05 2025 -0700 Merge tag 'ovl-fixes-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs Pull overlayfs fixes from Amir Goldstein: "Fixes for two fallouts from Neil's directory locking changes" * tag 'ovl-fixes-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/overlayfs/vfs: ovl: fix possible double unlink ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() commit 055f213075fbfa8e950bed8f2c50d01ac71bbf37 Merge: be48bcf004f9d0 a2c1f82618b0b6 Author: Linus Torvalds Date: Tue Aug 19 09:54:47 2025 -0700 Merge tag 'vfs-6.17-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - Fix two memory leaks in pidfs - Prevent changing the idmapping of an already idmapped mount without OPEN_TREE_CLONE through open_tree_attr() - Don't fail listing extended attributes in kernfs when no extended attributes are set - Fix the return value in coredump_parse() - Fix the error handling for unbuffered writes in netfs - Fix broken data integrity guarantees for O_SYNC writes via iomap - Fix UAF in __mark_inode_dirty() - Keep inode->i_blkbits constant in fuse - Fix coredump selftests - Fix get_unused_fd_flags() usage in do_handle_open() - Rename EXPORT_SYMBOL_GPL_FOR_MODULES to EXPORT_SYMBOL_FOR_MODULES - Fix use-after-free in bh_read() - Fix incorrect lflags value in the move_mount() syscall * tag 'vfs-6.17-rc3.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: signal: Fix memory leak for PIDFD_SELF* sentinels kernfs: don't fail listing extended attributes coredump: Fix return value in coredump_parse() fs/buffer: fix use-after-free when call bh_read() helper pidfs: Fix memory leak in pidfd_info() netfs: Fix unbuffered write error handling fhandle: do_handle_open() should get FD with user flags module: Rename EXPORT_SYMBOL_GPL_FOR_MODULES to EXPORT_SYMBOL_FOR_MODULES fs: fix incorrect lflags value in the move_mount syscall selftests/coredump: Remove the read() that fails the test fuse: keep inode->i_blkbits constant iomap: Fix broken data integrity guarantees for O_SYNC writes selftests/mount_setattr: add smoke tests for open_tree_attr(2) bug open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE fs: writeback: fix use-after-free in __mark_inode_dirty() commit 453a6d2a68e54a483d67233c6e1e24c4095ee4be Author: David Howells Date: Tue Aug 19 16:27:36 2025 +0100 cifs: Fix oops due to uninitialised variable Fix smb3_init_transform_rq() to initialise buffer to NULL before calling netfs_alloc_folioq_buffer() as netfs assumes it can append to the buffer it is given. Setting it to NULL means it should start a fresh buffer, but the value is currently undefined. Fixes: a2906d3316fc ("cifs: Switch crypto buffer to use a folio_queue rather than an xarray") Signed-off-by: David Howells cc: Steve French cc: Paulo Alcantara cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit fb924b7b8669503582e003dd7b7340ee49029801 Author: Al Viro Date: Fri Aug 15 15:23:08 2025 -0400 change_mnt_propagation(): calculate propagation source only if we'll need it We only need it when mount in question was sending events downstream (then recepients need to switch to new master) or the mount is being turned into slave (then we need a new master for it). That wouldn't be a big deal, except that it causes quite a bit of work when umount_tree() is taking a large peer group out. Adding a trivial "don't bother calling propagation_source() unless we are going to use its results" logics improves the things quite a bit. We are still doing unnecessary work on bulk removals from propagation graph, but the full solution for that will have to wait for the next merge window. Fixes: 955336e204ab "do_make_slave(): choose new master sanely" Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit cffd0441872e7f6b1fce5e78fb1c99187a291330 Author: Al Viro Date: Thu Aug 14 01:44:31 2025 -0400 use uniform permission checks for all mount propagation changes do_change_type() and do_set_group() are operating on different aspects of the same thing - propagation graph. The latter asks for mounts involved to be mounted in namespace(s) the caller has CAP_SYS_ADMIN for. The former is a mess - originally it didn't even check that mount *is* mounted. That got fixed, but the resulting check turns out to be too strict for userland - in effect, we check that mount is in our namespace, having already checked that we have CAP_SYS_ADMIN there. What we really need (in both cases) is * only touch mounts that are mounted. That's a must-have constraint - data corruption happens if it get violated. * don't allow to mess with a namespace unless you already have enough permissions to do so (i.e. CAP_SYS_ADMIN in its userns). That's an equivalent of what do_set_group() does; let's extract that into a helper (may_change_propagation()) and use it in both do_set_group() and do_change_type(). Fixes: 12f147ddd6de "do_change_type(): refuse to operate on unmounted/not ours mounts" Acked-by: Andrei Vagin Reviewed-by: Pavel Tikhomirov Tested-by: Pavel Tikhomirov Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit da025cdb97a23c1916d8491925b878f3e1de0bca Author: Al Viro Date: Thu Aug 14 23:32:26 2025 -0400 propagate_umount(): only surviving overmounts should be reparented ... as the comments in reparent() clearly say. As it is, we reparent *all* overmounts of the mounts being taken out, including those that are taken out themselves. It's not only a potentially massive slowdown (on a pathological setup we might end up with O(N^2) time for N mounts being kicked out), it can end up with incorrect ->overmount in the surviving mounts. Fixes: f0d0ba19985d "Rewrite of propagate_umount()" Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 0ddfb62f5d018edcb571a3d8ea30ad5332cf2a69 Author: Al Viro Date: Fri Aug 15 15:38:14 2025 -0400 fix the softlockups in attach_recursive_mnt() In case when we mounting something on top of a large stack of overmounts, all of them being peers of each other, we get quadratic time by the depth of overmount stack. Easily fixed by doing commit_tree() before reparenting the overmount; simplifies commit_tree() as well - it doesn't need to skip the already mounted stuff that had been reparented on top of the new mounts. Since we are holding mount_lock through both reparenting and call of commit_tree(), the order does not matter from the mount hash point of view. Reported-by: "Lai, Yi" Tested-by: "Lai, Yi" Reviewed-by: Christian Brauner Fixes: 663206854f02 "copy_tree(): don't link the mounts via mnt_list" Signed-off-by: Al Viro commit 11cd7a5c21db020b8001aedcae27bd3fa9e1e901 Author: Dan Carpenter Date: Tue Aug 19 12:40:41 2025 +0300 regulator: tps65219: regulator: tps65219: Fix error codes in probe() There is a copy and paste error and we accidentally use "PTR_ERR(rdev)" instead of "error". The "rdev" pointer is valid at this point. Also there is no need to print the error code in the error message because dev_err_probe() already prints that. So clean up the error message a bit. Fixes: 38c9f98db20a ("regulator: tps65219: Add support for TPS65215 Regulator IRQs") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aKRGmVdbvT1HBvm8@stanley.mountain Signed-off-by: Mark Brown commit 658a1c8e0a66d0777e0e37a11ba19f27a81e77f4 Author: Piotr Piórkowski Date: Mon Aug 11 12:43:57 2025 +0200 drm/xe: Assign ioctl xe file handler to vm in xe_vm_create In several code paths, such as xe_pt_create(), the vm->xef field is used to determine whether a VM originates from userspace or the kernel. Previously, this handler was only assigned in xe_vm_create_ioctl(), after the VM was created by xe_vm_create(). However, xe_vm_create() triggers page table creation, and that function assumes vm->xef should be already set. This could lead to incorrect origin detection. To fix this problem and ensure consistency in the initialization of the VM object, let's move the assignment of this handler to xe_vm_create. v2: - take reference to the xe file object only when xef is not NULL - release the reference to the xe file object on the error path (Matthew) Fixes: 7f387e6012b6 ("drm/xe: add XE_BO_FLAG_PINNED_LATE_RESTORE") Signed-off-by: Piotr Piórkowski Cc: Matthew Auld Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250811104358.2064150-2-piotr.piorkowski@intel.com Signed-off-by: Michał Winiarski (cherry picked from commit 9337166fa1d80f7bb7c7d3a8f901f21c348c0f2a) Signed-off-by: Rodrigo Vivi commit ff9a09b3e09c7b794b56f2f5858f5ce42ba46cb3 Author: Niklas Neronin Date: Tue Aug 19 15:58:44 2025 +0300 usb: xhci: fix host not responding after suspend and resume Partially revert commit e1db856bd288 ("usb: xhci: remove '0' write to write-1-to-clear register") because the patch cleared the Interrupt Pending bit during interrupt enabling and disabling. The Interrupt Pending bit should only be cleared when the driver has handled the interrupt. Ideally, all interrupts should be handled before disabling the interrupt; consequently, no interrupt should be pending when enabling the interrupt. For this reason, keep the debug message informing if an interrupt is still pending when an interrupt is disabled. Because the Interrupt Pending bit is write-1-to-clear, writing '0' to it ensures that the state does not change. Link: https://lore.kernel.org/linux-usb/20250818231103.672ec7ed@foxbook Fixes: e1db856bd288 ("usb: xhci: remove '0' write to write-1-to-clear register") Closes: https://bbs.archlinux.org/viewtopic.php?id=307641 cc: stable@vger.kernel.org # 6.16+ Signed-off-by: Niklas Neronin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250819125844.2042452-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 2eb03376151bb8585caa23ed2673583107bb5193 Author: Weitao Wang Date: Tue Aug 19 15:58:43 2025 +0300 usb: xhci: Fix slot_id resource race conflict xHC controller may immediately reuse a slot_id after it's disabled, giving it to a new enumerating device before the xhci driver freed all resources related to the disabled device. In such a scenario, device-A with slot_id equal to 1 is disconnecting while device-B is enumerating, device-B will fail to enumerate in the follow sequence. 1.[device-A] send disable slot command 2.[device-B] send enable slot command 3.[device-A] disable slot command completed and wakeup waiting thread 4.[device-B] enable slot command completed with slot_id equal to 1 and wakeup waiting thread 5.[device-B] driver checks that slot_id is still in use (by device-A) in xhci_alloc_virt_device, and fail to enumerate due to this conflict 6.[device-A] xhci->devs[slot_id] set to NULL in xhci_free_virt_device To fix driver's slot_id resources conflict, clear xhci->devs[slot_id] and xhci->dcbba->dev_context_ptrs[slot_id] pointers in the interrupt context when disable slot command completes successfully. Simultaneously, adjust function xhci_free_virt_device to accurately handle device release. [minor smatch warning and commit message fix -Mathias] Cc: stable@vger.kernel.org Fixes: 7faac1953ed1 ("xhci: avoid race between disable slot command and host runtime suspend") Signed-off-by: Weitao Wang Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250819125844.2042452-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8e5a2441e18640fb22a25fd097368957bf5cab91 Author: Christoph Hellwig Date: Mon Aug 18 07:06:45 2025 +0200 xfs: reject swapon for inodes on a zoned file system earlier No point in going down into the iomap mapping loop when we know it will be rejected. Signed-off-by: Christoph Hellwig Reviewed-by: Damien Le Moal Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit 7d523255f524c95208cefef4edaed149615ff96c Author: Christoph Hellwig Date: Mon Aug 18 07:06:44 2025 +0200 xfs: kick off inodegc when failing to reserve zoned blocks XFS processes truncating unlinked inodes asynchronously and thus the free space pool only sees them with a delay. The non-zoned write path thus calls into inodegc to accelerate this processing before failing an allocation due the lack of free blocks. Do the same for the zoned space reservation. Fixes: 0bb2193056b5 ("xfs: add support for zoned space reservations") Signed-off-by: Christoph Hellwig Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit d004d70d6cdf03928da0d05c8c15c2ccc15657cd Author: Christoph Hellwig Date: Mon Aug 18 07:06:43 2025 +0200 xfs: remove xfs_last_used_zone This was my first attempt at caching the last used zone. But it turns out for O_DIRECT or RWF_DONTCACHE that operate concurrently or in very short sequence, the bmap btree does not record a written extent yet, so it fails. Because it then still finds the last written zone it can lead to a weird ping-pong around a few zones with writers seeing different values. Remove it entirely as the later added xfs_cached_zone actually does a much better job enforcing the locality as the zone is associated with the inode in the MRU cache as soon as the zone is selected. Fixes: 4e4d52075577 ("xfs: add the zoned space allocator") Signed-off-by: Christoph Hellwig Tested-by: Damien Le Moal Reviewed-by: Hans Holmberg Signed-off-by: Carlos Maiolino commit 9ce43caa4b7be707638d49ad4fb358b6ff646e91 Author: Damien Le Moal Date: Tue Aug 12 11:55:19 2025 +0900 xfs: Default XFS_RT to Y if CONFIG_BLK_DEV_ZONED is enabled XFS support for zoned block devices requires the realtime subvolume support (XFS_RT) to be enabled. Change the default configuration value of XFS_RT from N to CONFIG_BLK_DEV_ZONED to align with this requirement. This change still allows the user to disable XFS_RT if this feature is not desired for the user use case. Suggested-by: Christoph Hellwig Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 23800ad1265f10c2bc6f42154ce4d20e59f2900e Author: Mario Limonciello (AMD) Date: Thu Aug 14 13:34:29 2025 -0500 gpiolib: acpi: Add quirk for ASUS ProArt PX13 The ASUS ProArt PX13 has a spurious wakeup event from the touchpad a few moments after entering hardware sleep. This can be avoided by preventing the touchpad from being a wake source. Add to the wakeup ignore list. Reported-by: Amit Chaudhari Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4482 Tested-by: Amit Chaudhari Signed-off-by: Mario Limonciello (AMD) Reviewed-by: Mika Westerberg Link: https://lore.kernel.org/20250814183430.3887973-1-superm1@kernel.org Signed-off-by: Linus Walleij commit a2c1f82618b0b65f1ef615aa9cfdac8122537d69 Author: Adrian Huang (Lenovo) Date: Mon Aug 18 21:43:10 2025 +0800 signal: Fix memory leak for PIDFD_SELF* sentinels Commit f08d0c3a7111 ("pidfd: add PIDFD_SELF* sentinels to refer to own thread/process") introduced a leak by acquiring a pid reference through get_task_pid(), which increments pid->count but never drops it with put_pid(). As a result, kmemleak reports unreferenced pid objects after running tools/testing/selftests/pidfd/pidfd_test, for example: unreferenced object 0xff1100206757a940 (size 160): comm "pidfd_test", pid 16965, jiffies 4294853028 hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 fd 57 50 04 .............WP. 5e 44 00 00 00 00 00 00 18 de 34 17 01 00 11 ff ^D........4..... backtrace (crc cd8844d4): kmem_cache_alloc_noprof+0x2f4/0x3f0 alloc_pid+0x54/0x3d0 copy_process+0xd58/0x1740 kernel_clone+0x99/0x3b0 __do_sys_clone3+0xbe/0x100 do_syscall_64+0x7b/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix this by calling put_pid() after do_pidfd_send_signal() returns. Fixes: f08d0c3a7111 ("pidfd: add PIDFD_SELF* sentinels to refer to own thread/process") Signed-off-by: Adrian Huang (Lenovo) Link: https://lore.kernel.org/20250818134310.12273-1-adrianhuang0701@gmail.com Tested-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Signed-off-by: Christian Brauner commit c237aa9884f238e1480897463ca034877ca7530b Author: Christian Brauner Date: Tue Aug 19 12:08:58 2025 +0200 kernfs: don't fail listing extended attributes Userspace doesn't expect a failure to list extended attributes: $ ls -lA /sys/ ls: /sys/: No data available ls: /sys/kernel: No data available ls: /sys/power: No data available ls: /sys/class: No data available ls: /sys/devices: No data available ls: /sys/dev: No data available ls: /sys/hypervisor: No data available ls: /sys/fs: No data available ls: /sys/bus: No data available ls: /sys/firmware: No data available ls: /sys/block: No data available ls: /sys/module: No data available total 0 drwxr-xr-x 2 root root 0 Jan 1 1970 block drwxr-xr-x 52 root root 0 Jan 1 1970 bus drwxr-xr-x 88 root root 0 Jan 1 1970 class drwxr-xr-x 4 root root 0 Jan 1 1970 dev drwxr-xr-x 11 root root 0 Jan 1 1970 devices drwxr-xr-x 3 root root 0 Jan 1 1970 firmware drwxr-xr-x 10 root root 0 Jan 1 1970 fs drwxr-xr-x 2 root root 0 Jul 2 09:43 hypervisor drwxr-xr-x 14 root root 0 Jan 1 1970 kernel drwxr-xr-x 251 root root 0 Jan 1 1970 module drwxr-xr-x 3 root root 0 Jul 2 09:43 power Fix it by simply reporting success when no extended attributes are available instead of reporting ENODATA. Link: https://lore.kernel.org/78b13bcdae82ade95e88f315682966051f461dde.camel@linaro.org Fixes: d1f4e9026007 ("kernfs: remove iattr_mutex") # mainline only Reported-by: André Draszik Link: https://lore.kernel.org/20250819-ahndung-abgaben-524a535f8101@brauner Signed-off-by: Christian Brauner commit 589c12edcd8a7b3b24f407b58443bab3560125e4 Author: Dan Carpenter Date: Tue Aug 19 12:41:15 2025 +0300 coredump: Fix return value in coredump_parse() The coredump_parse() function is bool type. It should return true on success and false on failure. The cn_printf() returns zero on success or negative error codes. This mismatch means that when "return err;" here, it is treated as success instead of failure. Change it to return false instead. Fixes: a5715af549b2 ("coredump: make coredump_parse() return bool") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/aKRGu14w5vPSZLgv@stanley.mountain Signed-off-by: Christian Brauner commit 7375f22495e7cd1c5b3b5af9dcc4f6dffe34ce49 Author: Ye Bin Date: Mon Aug 11 22:18:30 2025 +0800 fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x2c/0x390 print_report+0xb4/0x270 kasan_report+0xb8/0xf0 end_buffer_read_sync+0xe3/0x110 end_bio_bh_io_sync+0x56/0x80 blk_update_request+0x30a/0x720 scsi_end_request+0x51/0x2b0 scsi_io_completion+0xe3/0x480 ? scsi_device_unbusy+0x11e/0x160 blk_complete_reqs+0x7b/0x90 handle_softirqs+0xef/0x370 irq_exit_rcu+0xa5/0xd0 sysvec_apic_timer_interrupt+0x6e/0x90 Above issue happens when do ntfs3 filesystem mount, issue may happens as follows: mount IRQ ntfs_fill_super read_cache_page do_read_cache_folio filemap_read_folio mpage_read_folio do_mpage_readpage ntfs_get_block_vbo bh_read submit_bh wait_on_buffer(bh); blk_complete_reqs scsi_io_completion scsi_end_request blk_update_request end_bio_bh_io_sync end_buffer_read_sync __end_buffer_read_notouch unlock_buffer wait_on_buffer(bh);--> return will return to caller put_bh --> trigger stack-out-of-bounds In the mpage_read_folio() function, the stack variable 'map_bh' is passed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and wait_on_buffer() returns to continue processing, the stack variable is likely to be reclaimed. Consequently, during the end_buffer_read_sync() process, calling put_bh() may result in stack overrun. If the bh is not allocated on the stack, it belongs to a folio. Freeing a buffer head which belongs to a folio is done by drop_buffers() which will fail to free buffers which are still locked. So it is safe to call put_bh() before __end_buffer_read_notouch(). Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ye Bin Link: https://lore.kernel.org/20250811141830.343774-1-yebin@huaweicloud.com Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Christian Brauner commit b47b493d6387ae437098112936f32be27f73516c Author: Miaoqian Lin Date: Mon Aug 4 12:29:55 2025 +0400 most: core: Drop device reference after usage in get_channel() In get_channel(), the reference obtained by bus_find_device_by_name() was dropped via put_device() before accessing the device's driver data Move put_device() after usage to avoid potential issues. Fixes: 2485055394be ("staging: most: core: drop device reference") Cc: stable Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20250804082955.3621026-1-linmq006@gmail.com Signed-off-by: Greg Kroah-Hartman commit 7afba9221f70d4cbce0f417c558879cba0eb5e66 Author: Ian Abbott Date: Fri Jul 25 15:10:34 2025 +0100 comedi: Make insn_rw_emulate_bits() do insn->n samples The `insn_rw_emulate_bits()` function is used as a default handler for `INSN_READ` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_READ`. Similarly, it is used as a default handler for `INSN_WRITE` instructions for subdevices that have a handler for `INSN_BITS` but not for `INSN_WRITE`. It works by emulating the `INSN_READ` or `INSN_WRITE` instruction handling with a constructed `INSN_BITS` instruction. However, `INSN_READ` and `INSN_WRITE` instructions are supposed to be able read or write multiple samples, indicated by the `insn->n` value, but `insn_rw_emulate_bits()` currently only handles a single sample. For `INSN_READ`, the comedi core will copy `insn->n` samples back to user-space. (That triggered KASAN kernel-infoleak errors when `insn->n` was greater than 1, but that is being fixed more generally elsewhere in the comedi core.) Make `insn_rw_emulate_bits()` either handle `insn->n` samples, or return an error, to conform to the general expectation for `INSN_READ` and `INSN_WRITE` handlers. Fixes: ed9eccbe8970 ("Staging: add comedi core") Cc: stable # 5.13+ Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250725141034.87297-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 3cd212e895ca2d58963fdc6422502b10dd3966bb Author: Ian Abbott Date: Fri Jul 25 13:53:24 2025 +0100 comedi: Fix use of uninitialized memory in do_insn_ioctl() and do_insnlist_ioctl() syzbot reports a KMSAN kernel-infoleak in `do_insn_ioctl()`. A kernel buffer is allocated to hold `insn->n` samples (each of which is an `unsigned int`). For some instruction types, `insn->n` samples are copied back to user-space, unless an error code is being returned. The problem is that not all the instruction handlers that need to return data to userspace fill in the whole `insn->n` samples, so that there is an information leak. There is a similar syzbot report for `do_insnlist_ioctl()`, although it does not have a reproducer for it at the time of writing. One culprit is `insn_rw_emulate_bits()` which is used as the handler for `INSN_READ` or `INSN_WRITE` instructions for subdevices that do not have a specific handler for that instruction, but do have an `INSN_BITS` handler. For `INSN_READ` it only fills in at most 1 sample, so if `insn->n` is greater than 1, the remaining `insn->n - 1` samples copied to userspace will be uninitialized kernel data. Another culprit is `vm80xx_ai_insn_read()` in the "vm80xx" driver. It never returns an error, even if it fails to fill the buffer. Fix it in `do_insn_ioctl()` and `do_insnlist_ioctl()` by making sure that uninitialized parts of the allocated buffer are zeroed before handling each instruction. Thanks to Arnaud Lecomte for their fix to `do_insn_ioctl()`. That fix replaced the call to `kmalloc_array()` with `kcalloc()`, but it is not always necessary to clear the whole buffer. Fixes: ed9eccbe8970 ("Staging: add comedi core") Reported-by: syzbot+a5e45f768aab5892da5d@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a5e45f768aab5892da5d Reported-by: syzbot+fb4362a104d45ab09cf9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fb4362a104d45ab09cf9 Cc: stable # 5.13+ Cc: Arnaud Lecomte Signed-off-by: Ian Abbott Link: https://lore.kernel.org/r/20250725125324.80276-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 96cb948408b3adb69df7e451ba7da9d21f814d00 Author: Edward Adam Davis Date: Mon Jul 7 20:39:58 2025 +0800 comedi: pcl726: Prevent invalid irq number The reproducer passed in an irq number(0x80008000) that was too large, which triggered the oob. Added an interrupt number check to prevent users from passing in an irq number that was too large. If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid because it shifts a 1-bit into the sign bit (which is UB in C). Possible solutions include reducing the upper bound on the `it->options[1]` value to 30 or lower, or using `1U << it->options[1]`. The old code would just not attempt to request the IRQ if the `options[1]` value were invalid. And it would still configure the device without interrupts even if the call to `request_irq` returned an error. So it would be better to combine this test with the test below. Fixes: fff46207245c ("staging: comedi: pcl726: enable the interrupt support code") Cc: stable # 5.13+ Reported-by: syzbot+5cd373521edd68bebcb3@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=5cd373521edd68bebcb3 Tested-by: syzbot+5cd373521edd68bebcb3@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Reviewed-by: Ian Abbott Link: https://lore.kernel.org/r/tencent_3C66983CC1369E962436264A50759176BF09@qq.com Signed-off-by: Greg Kroah-Hartman commit 300a0cfe9f375b2843bcb331bcfa7503475ef5dd Author: Thorsten Blum Date: Wed Aug 6 11:05:09 2025 +0200 cdx: Fix off-by-one error in cdx_rpmsg_probe() In cdx_rpmsg_probe(), strscpy() is incorrectly called with the length of the source string (excluding the NUL terminator) rather than the size of the destination buffer. This results in one character less being copied from 'cdx_rpmsg_id_table[0].name' to 'chinfo.name'. Use the destination buffer size instead to ensure the name is copied correctly. Cc: stable Fixes: 2a226927d9b8 ("cdx: add rpmsg communication channel for CDX") Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250806090512.121260-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit 1ca61060de92a4320d73adfe5dc8d335653907ac Author: Xu Yilun Date: Wed Aug 6 15:06:05 2025 +0800 fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() dma_map_sgtable() returns only 0 or the error code. Read sgt->nents to get the number of mapped segments. Fixes: 37e00703228a ("zynq_fpga: use sgtable-based scatterlist wrappers") Reported-by: Pavel Pisa Closes: https://lore.kernel.org/linux-fpga/202508041548.22955.pisa@fel.cvut.cz/ Reviewed-by: Jason Gunthorpe Reviewed-by: Marek Szyprowski Signed-off-by: Xu Yilun Tested-by: Pavel Pisa Link: https://lore.kernel.org/r/20250806070605.1920909-2-yilun.xu@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 309b6341d5570fb2b41b923de2fc9bb147106b80 Author: Sebastian Reichel Date: Mon Aug 18 18:50:19 2025 +0200 usb: typec: fusb302: Revert incorrect threaded irq fix The fusb302 irq handler has been carefully optimized by Hans de Goede in commit 207338ec5a27 ("usb: typec: fusb302: Improve suspend/resume handling"). A recent 'fix' undid most of that work to avoid a virtio-gpio driver bug. This reverts the incorrect fix, since it is of very low quality. It reverts the quirks from Hans change (and thus reintroduces the problems fixed by Hans) while keeping the overhead from the original change. The proper fix to support using fusb302 with an interrupt line provided by virtio-gpio must be implemented in the virtio driver instead, which should support disabling the IRQ from the fusb302 interrupt routine. Cc: Hans de Goede Cc: Yongbo Zhang Fixes: 1c2d81bded19 ("usb: typec: fusb302: fix scheduling while atomic when using virtio-gpio") Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250818-fusb302-unthreaded-irq-v1-1-3a9a11a9f56f@kernel.org Signed-off-by: Greg Kroah-Hartman commit 70fb252a84a47430240d924528a40e84c2b027e4 Author: Alan Stern Date: Mon Aug 18 10:59:07 2025 -0400 USB: core: Update kerneldoc for usb_hcd_giveback_urb() The kerneldoc added for usb_hcd_giveback_urb() by commit 41631d3616c3 ("usb: core: Replace in_interrupt() in comments") is unclear and incorrect. Update the text for greater clarity and to say that URBs for a root hub will always use a BH context for their completion. Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/41eaae05-116a-4568-940c-eeb94ab6baa0@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman commit 01792bc3e5bdafa171dd83c7073f00e7de93a653 Author: MD Danish Anwar Date: Thu Aug 14 16:21:06 2025 +0530 net: ti: icssg-prueth: Fix HSR and switch offload Enablement during firwmare reload. To enable HSR / Switch offload, certain configurations are needed. Currently they are done inside icssg_change_mode(). This function only gets called if we move from one mode to another without bringing the links up / down. Once in HSR / Switch mode, if we bring the links down and bring it back up again. The callback sequence is, - emac_ndo_stop() Firmwares are stopped - emac_ndo_open() Firmwares are loaded In this path icssg_change_mode() doesn't get called and as a result the configurations needed for HSR / Switch is not done. To fix this, put all these configurations in a separate function icssg_enable_fw_offload() and call this from both icssg_change_mode() and emac_ndo_open() Fixes: 56375086d093 ("net: ti: icssg-prueth: Enable HSR Tx duplication, Tx Tag and Rx Tag offload") Signed-off-by: MD Danish Anwar Link: https://patch.msgid.link/20250814105106.1491871-1-danishanwar@ti.com Signed-off-by: Paolo Abeni commit d8f3ae7b38fea546e64a6cfcdc7d061c85f086e2 Author: Geert Uytterhoeven Date: Wed Aug 13 15:04:24 2025 +0200 pmdomain: renesas: rcar-sysc: Make rcar_sysc_onecell_np __initdata rcar_sysc_onecell_np() is only used by functions marked __init, so it can be freed when init memory is freed. Fixes: c5ae5a0c6112 ("pmdomain: renesas: rcar-sysc: Add genpd OF provider at postcore_initcall") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/e20a848ff952924f8f58c335f9a0242cb2565921.1755090234.git.geert+renesas@glider.be Signed-off-by: Ulf Hansson commit 0417adf367a0af11adf7ace849af4638cfb573f7 Author: Qingfang Deng Date: Thu Aug 14 09:25:58 2025 +0800 ppp: fix race conditions in ppp_fill_forward_path ppp_fill_forward_path() has two race conditions: 1. The ppp->channels list can change between list_empty() and list_first_entry(), as ppp_lock() is not held. If the only channel is deleted in ppp_disconnect_channel(), list_first_entry() may access an empty head or a freed entry, and trigger a panic. 2. pch->chan can be NULL. When ppp_unregister_channel() is called, pch->chan is set to NULL before pch is removed from ppp->channels. Fix these by using a lockless RCU approach: - Use list_first_or_null_rcu() to safely test and access the first list entry. - Convert list modifications on ppp->channels to their RCU variants and add synchronize_net() after removal. - Check for a NULL pch->chan before dereferencing it. Fixes: f6efc675c9dd ("net: ppp: resolve forwarding path for bridge pppoe devices") Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20250814012559.3705-2-dqfext@gmail.com Signed-off-by: Paolo Abeni commit 62c30c544359aa18b8fb2734166467a07d435c2d Author: Qingfang Deng Date: Thu Aug 14 09:25:57 2025 +0800 net: ethernet: mtk_ppe: add RCU lock around dev_fill_forward_path Ensure ndo_fill_forward_path() is called with RCU lock held. Fixes: 2830e314778d ("net: ethernet: mtk-ppe: fix traffic offload with bridged wlan") Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20250814012559.3705-1-dqfext@gmail.com Signed-off-by: Paolo Abeni commit d4932a1b148bb6121121e56bad312c4339042d70 Author: Li RongQing Date: Tue Aug 19 10:33:56 2025 +0800 x86/bugs: Fix GDS mitigation selecting when mitigation is off The current GDS mitigation logic incorrectly returns early when the attack vector mitigation is turned off, which leads to two problems: 1. CPUs without ARCH_CAP_GDS_CTRL support are incorrectly marked with GDS_MITIGATION_OFF when they should be marked as GDS_MITIGATION_UCODE_NEEDED. 2. The mitigation state checks and locking verification that follow are skipped, which means: - fail to detect if the mitigation was locked - miss the warning when trying to disable a locked mitigation Remove the early return to ensure proper mitigation state handling. This allows: - Proper mitigation classification for non-ARCH_CAP_GDS_CTRL CPUs - Complete mitigation state verification This also addresses the failed MSR 0x123 write attempt at boot on non-ARCH_CAP_GDS_CTRL CPUs: unchecked MSR access error: WRMSR to 0x123 (tried to write 0x0000000000000010) at rIP: ... (update_gds_msr) Call Trace: identify_secondary_cpu start_secondary common_startup_64 WARNING: CPU: 1 PID: 0 at arch/x86/kernel/cpu/bugs.c:1053 update_gds_msr [ bp: Massage, zap superfluous braces. ] Fixes: 8c7261abcb7ad ("x86/bugs: Add attack vector controls for GDS") Suggested-by: Pawan Gupta Signed-off-by: Li RongQing Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Pawan Gupta Link: https://lore.kernel.org/20250819023356.2012-1-lirongqing@baidu.com commit 8236820fd767f400d1baefb71bc7e36e37730a1e Author: Sebastian Brzezinka Date: Mon Aug 11 09:12:31 2025 +0000 drm/i915/gt: Relocate compression repacking WA for JSL/EHL CACHE_MODE_0 registers should be saved and restored as part of the context, not during engine reset. Move the related workaround (Disable Repacking for Compression) from rcs_engine_wa_init() to icl_ctx_workarounds_init() for Jasper Lake and Elkhart Lake platforms. This ensures the WA is applied during context initialisation. BSPEC: 11322 Fixes: 0ddae025ab6c ("drm/i915: Disable compression tricks on JSL") Closes: Fixes: 0ddae025ab6c ("drm/i915: Disable compression tricks on JSL") Signed-off-by: Sebastian Brzezinka Cc: stable@vger.kernel.org # v6.13+ Reviewed-by: Andi Shyti Reviewed-by: Krzysztof Karas Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/4feaa24094e019e000ceb6011d8cd419b0361b3f.1754902406.git.sebastian.brzezinka@intel.com (cherry picked from commit c9932f0d604e4c8f2c6018e598a322acb43c68a2) Signed-off-by: Tvrtko Ursulin commit ff646d033783068cc5b38924873cab4a536b17c1 Author: Jani Nikula Date: Tue Aug 5 14:56:56 2025 +0300 drm/i915: silence rpm wakeref asserts on GEN11_GU_MISC_IIR access Commit 8d9908e8fe9c ("drm/i915/display: remove small micro-optimizations in irq handling") not only removed the optimizations, it also enabled wakeref asserts for the GEN11_GU_MISC_IIR access. Silence the asserts by wrapping the access inside intel_display_rpm_assert_{block,unblock}(). Reported-by: "Jason A. Donenfeld" Closes: https://lore.kernel.org/r/aG0tWkfmxWtxl_xc@zx2c4.com Fixes: 8d9908e8fe9c ("drm/i915/display: remove small micro-optimizations in irq handling") Cc: stable@vger.kernel.org # v6.13+ Suggested-by: Ville Syrjälä Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/20250805115656.832235-1-jani.nikula@intel.com Signed-off-by: Jani Nikula (cherry picked from commit cbd3baeffbc08052ce7dc53f11bf5524b4411056) Signed-off-by: Tvrtko Ursulin commit f4b3cef55f5f96fdb4e7f9ca90b7d6213689faeb Author: Kailang Yang Date: Tue Aug 19 14:03:44 2025 +0800 ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again There was a similar bug in the past (Bug 217440), which was fixed for this laptop. The same issue is occurring again as of kernel v.6.12.2. The symptoms are very similar - initially audio works but after a warm reboot, the audio completely disappears until the computer is powered off (there is no audio output at all). The issue is also related by caused by a different change now. By bisecting different kernel versions, I found that reverting cc3d0b5dd989 in patch_realtek.c[*] restores the sound and it works fine after the reboot. [*] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/sound/pci/hda/patch_realtek.c?h=v6.12.2&id=4ed7f16070a8475c088ff423b2eb11ba15eb89b6 [ patch description reformatted by tiwai ] Fixes: cc3d0b5dd989 ("ALSA: hda/realtek: Update ALC256 depop procedure") Link: https://bugzilla.kernel.org/show_bug.cgi?id=220109 Signed-off-by: Kailang Yang Link: https://lore.kernel.org/5317ca723c82447a938414fcca85cbf5@realtek.com Signed-off-by: Takashi Iwai commit 018f659753fd38bb6fdba7fa8c751121b495e1f4 Author: Vasiliy Kovalev Date: Mon Aug 18 23:42:43 2025 +0300 ALSA: hda/realtek: Fix headset mic on ASUS Zenbook 14 Add a PCI quirk to enable microphone input on the headphone jack on the ASUS Zenbook 14 UM3406HA laptop. This model uses an ALC294 codec with CS35L41 amplifiers over I2C, and the existing fixup for it did not enable the headset microphone. A new fix is introduced to get the mic working while keeping the amplifier settings correct. Fixes: 61cbc08fdb04 ("ALSA: hda/realtek: Add quirks for ASUS 2024 Zenbooks") Signed-off-by: Vasiliy Kovalev Link: https://patch.msgid.link/20250818204243.247297-1-kovalev@altlinux.org Signed-off-by: Takashi Iwai commit 6300d5c5438724c0876828da2f6e2c1a661871fc Author: Nitin Rawat Date: Mon Aug 11 13:03:30 2025 +0530 scsi: ufs: ufs-qcom: Fix ESI null pointer dereference ESI/MSI is a performance optimization feature that provides dedicated interrupts per MCQ hardware queue. This is optional feature and UFS MCQ should work with and without ESI feature. Commit e46a28cea29a ("scsi: ufs: qcom: Remove the MSI descriptor abuse") brings a regression in ESI (Enhanced System Interrupt) configuration that causes a null pointer dereference when Platform MSI allocation fails. The issue occurs in when platform_device_msi_init_and_alloc_irqs() in ufs_qcom_config_esi() fails (returns -EINVAL) but the current code uses __free() macro for automatic cleanup free MSI resources that were never successfully allocated. Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 Call trace: mutex_lock+0xc/0x54 (P) platform_device_msi_free_irqs_all+0x1c/0x40 ufs_qcom_config_esi+0x1d0/0x220 [ufs_qcom] ufshcd_config_mcq+0x28/0x104 ufshcd_init+0xa3c/0xf40 ufshcd_pltfrm_init+0x504/0x7d4 ufs_qcom_probe+0x20/0x58 [ufs_qcom] Fix by restructuring the ESI configuration to try MSI allocation first, before any other resource allocation and instead use explicit cleanup instead of __free() macro to avoid cleanup of unallocated resources. Tested on SM8750 platform with MCQ enabled, both with and without Platform ESI support. Fixes: e46a28cea29a ("scsi: ufs: qcom: Remove the MSI descriptor abuse") Cc: Manivannan Sadhasivam Cc: Thomas Gleixner Cc: James Bottomley Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250811073330.20230-1-quic_nitirawa@quicinc.com Signed-off-by: Martin K. Petersen commit 09d57d68ba9a36117eadb75d3ecf817a3c091acc Author: Bart Van Assche Date: Fri Aug 15 08:58:26 2025 -0700 scsi: ufs: core: Rename ufshcd_wait_for_doorbell_clr() The name ufshcd_wait_for_doorbell_clr() refers to legacy mode. Commit 8d077ede48c1 ("scsi: ufs: Optimize the command queueing code") added support for MCQ mode in this function. Since then the name of this function is misleading. Hence change the name of this function into something that is appropriate for both legacy and MCQ mode. Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250815155842.472867-5-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 9ee35fd43f94bf19dbd27cffc213a31314b623d2 Author: Bart Van Assche Date: Fri Aug 15 08:58:25 2025 -0700 scsi: ufs: core: Fix the return value documentation ufshcd_wait_for_dev_cmd() and all its callers can return an OCS error. OCS errors are represented by positive integers. Remove the WARN_ONCE() statements that complain about positive error codes and update the documentation. Keep the behavior of ufshcd_wait_for_dev_cmd() because this return value may end be passed as the second argument of bsg_job_done() and bsg_job_done() handles positive and negative error codes differently. Cc: Peter Wang Fixes: cc59f3b68542 ("scsi: ufs: core: Improve return value documentation") Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250815155842.472867-4-bvanassche@acm.org Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit e5203d89d59bfcbe1f348aa0d2dc4449a8ba644c Author: Bart Van Assche Date: Fri Aug 15 08:58:24 2025 -0700 scsi: ufs: core: Remove WARN_ON_ONCE() call from ufshcd_uic_cmd_compl() The UIC completion interrupt may be disabled while an UIC command is being processed. When the UIC completion interrupt is reenabled, an UIC interrupt is triggered and the WARN_ON_ONCE(!cmd) statement is hit. Hence this patch that removes this kernel warning. Fixes: fcd8b0450a9a ("scsi: ufs: core: Make ufshcd_uic_cmd_compl() easier to analyze") Reviewed-by: Peter Wang Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250815155842.472867-3-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit eabcac808ca3ee9878223d4b49b750979029016b Author: Bart Van Assche Date: Fri Aug 15 08:58:23 2025 -0700 scsi: ufs: core: Fix IRQ lock inversion for the SCSI host lock Commit 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler") introduced an IRQ lock inversion issue. Fix this lock inversion by changing the spin_lock_irq() calls into spin_lock_irqsave() calls in code that can be called either from interrupt context or from thread context. This patch fixes the following lockdep complaint: WARNING: possible irq lock inversion dependency detected 6.12.30-android16-5-maybe-dirty-4k #1 Tainted: G W OE -------------------------------------------------------- kworker/u28:0/12 just changed the state of lock: ffffff881e29dd60 (&hba->clk_gating.lock){-...}-{2:2}, at: ufshcd_release_scsi_cmd+0x60/0x110 but this lock took another, HARDIRQ-unsafe lock in the past: (shost->host_lock){+.+.}-{2:2} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(shost->host_lock); local_irq_disable(); lock(&hba->clk_gating.lock); lock(shost->host_lock); lock(&hba->clk_gating.lock); *** DEADLOCK *** 4 locks held by kworker/u28:0/12: #0: ffffff8800ac6158 ((wq_completion)async){+.+.}-{0:0}, at: process_one_work+0x1bc/0x65c #1: ffffffc085c93d70 ((work_completion)(&entry->work)){+.+.}-{0:0}, at: process_one_work+0x1e4/0x65c #2: ffffff881e29c0e0 (&shost->scan_mutex){+.+.}-{3:3}, at: __scsi_add_device+0x74/0x120 #3: ffffff881960ea00 (&hwq->cq_lock){-...}-{2:2}, at: ufshcd_mcq_poll_cqe_lock+0x28/0x104 the shortest dependencies between 2nd lock and 1st lock: -> (shost->host_lock){+.+.}-{2:2} { HARDIRQ-ON-W at: lock_acquire+0x134/0x2b4 _raw_spin_lock+0x48/0x64 ufshcd_sl_intr+0x4c/0xa08 ufshcd_threaded_intr+0x70/0x12c irq_thread_fn+0x48/0xa8 irq_thread+0x130/0x1ec kthread+0x110/0x134 ret_from_fork+0x10/0x20 SOFTIRQ-ON-W at: lock_acquire+0x134/0x2b4 _raw_spin_lock+0x48/0x64 ufshcd_sl_intr+0x4c/0xa08 ufshcd_threaded_intr+0x70/0x12c irq_thread_fn+0x48/0xa8 irq_thread+0x130/0x1ec kthread+0x110/0x134 ret_from_fork+0x10/0x20 INITIAL USE at: lock_acquire+0x134/0x2b4 _raw_spin_lock+0x48/0x64 ufshcd_sl_intr+0x4c/0xa08 ufshcd_threaded_intr+0x70/0x12c irq_thread_fn+0x48/0xa8 irq_thread+0x130/0x1ec kthread+0x110/0x134 ret_from_fork+0x10/0x20 } ... key at: [] scsi_host_alloc.__key+0x0/0x10 ... acquired at: _raw_spin_lock_irqsave+0x5c/0x80 __ufshcd_release+0x78/0x118 ufshcd_send_uic_cmd+0xe4/0x118 ufshcd_dme_set_attr+0x88/0x1c8 ufs_google_phy_initialization+0x68/0x418 [ufs] ufs_google_link_startup_notify+0x78/0x27c [ufs] ufshcd_link_startup+0x84/0x720 ufshcd_init+0xf3c/0x1330 ufshcd_pltfrm_init+0x728/0x7d8 ufs_google_probe+0x30/0x84 [ufs] platform_probe+0xa0/0xe0 really_probe+0x114/0x454 __driver_probe_device+0xa4/0x160 driver_probe_device+0x44/0x23c __driver_attach_async_helper+0x60/0xd4 async_run_entry_fn+0x4c/0x17c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20 -> (&hba->clk_gating.lock){-...}-{2:2} { IN-HARDIRQ-W at: lock_acquire+0x134/0x2b4 _raw_spin_lock_irqsave+0x5c/0x80 ufshcd_release_scsi_cmd+0x60/0x110 ufshcd_compl_one_cqe+0x2c0/0x3f4 ufshcd_mcq_poll_cqe_lock+0xb0/0x104 ufs_google_mcq_intr+0x80/0xa0 [ufs] __handle_irq_event_percpu+0x104/0x32c handle_irq_event+0x40/0x9c handle_fasteoi_irq+0x170/0x2e8 generic_handle_domain_irq+0x58/0x80 gic_handle_irq+0x48/0x104 call_on_irq_stack+0x3c/0x50 do_interrupt_handler+0x7c/0xd8 el1_interrupt+0x34/0x58 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x68/0x6c _raw_spin_unlock_irqrestore+0x3c/0x6c debug_object_assert_init+0x16c/0x21c __mod_timer+0x4c/0x48c schedule_timeout+0xd4/0x16c io_schedule_timeout+0x48/0x70 do_wait_for_common+0x100/0x194 wait_for_completion_io_timeout+0x48/0x6c blk_execute_rq+0x124/0x17c scsi_execute_cmd+0x18c/0x3f8 scsi_probe_and_add_lun+0x204/0xd74 __scsi_add_device+0xbc/0x120 ufshcd_async_scan+0x80/0x3c0 async_run_entry_fn+0x4c/0x17c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20 INITIAL USE at: lock_acquire+0x134/0x2b4 _raw_spin_lock_irqsave+0x5c/0x80 ufshcd_hold+0x34/0x14c ufshcd_send_uic_cmd+0x28/0x118 ufshcd_dme_set_attr+0x88/0x1c8 ufs_google_phy_initialization+0x68/0x418 [ufs] ufs_google_link_startup_notify+0x78/0x27c [ufs] ufshcd_link_startup+0x84/0x720 ufshcd_init+0xf3c/0x1330 ufshcd_pltfrm_init+0x728/0x7d8 ufs_google_probe+0x30/0x84 [ufs] platform_probe+0xa0/0xe0 really_probe+0x114/0x454 __driver_probe_device+0xa4/0x160 driver_probe_device+0x44/0x23c __driver_attach_async_helper+0x60/0xd4 async_run_entry_fn+0x4c/0x17c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20 } ... key at: [] ufshcd_init.__key+0x0/0x10 ... acquired at: mark_lock+0x1c4/0x224 __lock_acquire+0x438/0x2e1c lock_acquire+0x134/0x2b4 _raw_spin_lock_irqsave+0x5c/0x80 ufshcd_release_scsi_cmd+0x60/0x110 ufshcd_compl_one_cqe+0x2c0/0x3f4 ufshcd_mcq_poll_cqe_lock+0xb0/0x104 ufs_google_mcq_intr+0x80/0xa0 [ufs] __handle_irq_event_percpu+0x104/0x32c handle_irq_event+0x40/0x9c handle_fasteoi_irq+0x170/0x2e8 generic_handle_domain_irq+0x58/0x80 gic_handle_irq+0x48/0x104 call_on_irq_stack+0x3c/0x50 do_interrupt_handler+0x7c/0xd8 el1_interrupt+0x34/0x58 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x68/0x6c _raw_spin_unlock_irqrestore+0x3c/0x6c debug_object_assert_init+0x16c/0x21c __mod_timer+0x4c/0x48c schedule_timeout+0xd4/0x16c io_schedule_timeout+0x48/0x70 do_wait_for_common+0x100/0x194 wait_for_completion_io_timeout+0x48/0x6c blk_execute_rq+0x124/0x17c scsi_execute_cmd+0x18c/0x3f8 scsi_probe_and_add_lun+0x204/0xd74 __scsi_add_device+0xbc/0x120 ufshcd_async_scan+0x80/0x3c0 async_run_entry_fn+0x4c/0x17c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20 stack backtrace: CPU: 6 UID: 0 PID: 12 Comm: kworker/u28:0 Tainted: G W OE 6.12.30-android16-5-maybe-dirty-4k #1 ccd4020fe444bdf629efc3b86df6be920b8df7d0 Tainted: [W]=WARN, [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Spacecraft board based on MALIBU (DT) Workqueue: async async_run_entry_fn Call trace: dump_backtrace+0xfc/0x17c show_stack+0x18/0x28 dump_stack_lvl+0x40/0xa0 dump_stack+0x18/0x24 print_irq_inversion_bug+0x2fc/0x304 mark_lock_irq+0x388/0x4fc mark_lock+0x1c4/0x224 __lock_acquire+0x438/0x2e1c lock_acquire+0x134/0x2b4 _raw_spin_lock_irqsave+0x5c/0x80 ufshcd_release_scsi_cmd+0x60/0x110 ufshcd_compl_one_cqe+0x2c0/0x3f4 ufshcd_mcq_poll_cqe_lock+0xb0/0x104 ufs_google_mcq_intr+0x80/0xa0 [ufs dd6f385554e109da094ab91d5f7be18625a2222a] __handle_irq_event_percpu+0x104/0x32c handle_irq_event+0x40/0x9c handle_fasteoi_irq+0x170/0x2e8 generic_handle_domain_irq+0x58/0x80 gic_handle_irq+0x48/0x104 call_on_irq_stack+0x3c/0x50 do_interrupt_handler+0x7c/0xd8 el1_interrupt+0x34/0x58 el1h_64_irq_handler+0x18/0x24 el1h_64_irq+0x68/0x6c _raw_spin_unlock_irqrestore+0x3c/0x6c debug_object_assert_init+0x16c/0x21c __mod_timer+0x4c/0x48c schedule_timeout+0xd4/0x16c io_schedule_timeout+0x48/0x70 do_wait_for_common+0x100/0x194 wait_for_completion_io_timeout+0x48/0x6c blk_execute_rq+0x124/0x17c scsi_execute_cmd+0x18c/0x3f8 scsi_probe_and_add_lun+0x204/0xd74 __scsi_add_device+0xbc/0x120 ufshcd_async_scan+0x80/0x3c0 async_run_entry_fn+0x4c/0x17c process_one_work+0x26c/0x65c worker_thread+0x33c/0x498 kthread+0x110/0x134 ret_from_fork+0x10/0x20 Cc: Neil Armstrong Cc: André Draszik Reviewed-by: Peter Wang Fixes: 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler") Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250815155842.472867-2-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit 4611d88a37cfc18cbabc6978aaf7325d1ae3f53a Author: Michael Chan Date: Sat Aug 16 11:38:50 2025 -0700 bnxt_en: Fix lockdep warning during rmmod The commit under the Fixes tag added a netdev_assert_locked() in bnxt_free_ntp_fltrs(). The lock should be held during normal run-time but the assert will be triggered (see below) during bnxt_remove_one() which should not need the lock. The netdev is already unregistered by then. Fix it by calling netdev_assert_locked_or_invisible() which will not assert if the netdev is unregistered. WARNING: CPU: 5 PID: 2241 at ./include/net/netdev_lock.h:17 bnxt_free_ntp_fltrs+0xf8/0x100 [bnxt_en] Modules linked in: rpcrdma rdma_cm iw_cm ib_cm configfs ib_core bnxt_en(-) bridge stp llc x86_pkg_temp_thermal xfs tg3 [last unloaded: bnxt_re] CPU: 5 UID: 0 PID: 2241 Comm: rmmod Tainted: G S W 6.16.0 #2 PREEMPT(voluntary) Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN Hardware name: Dell Inc. PowerEdge R730/072T6D, BIOS 2.4.3 01/17/2017 RIP: 0010:bnxt_free_ntp_fltrs+0xf8/0x100 [bnxt_en] Code: 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 8b 47 60 be ff ff ff ff 48 8d b8 28 0c 00 00 e8 d0 cf 41 c3 85 c0 0f 85 2e ff ff ff <0f> 0b e9 27 ff ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffa92082387da0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff9e5b593d8000 RCX: 0000000000000001 RDX: 0000000000000001 RSI: ffffffff83dc9a70 RDI: ffffffff83e1a1cf RBP: ffff9e5b593d8c80 R08: 0000000000000000 R09: ffffffff8373a2b3 R10: 000000008100009f R11: 0000000000000001 R12: 0000000000000001 R13: ffffffffc01c4478 R14: dead000000000122 R15: dead000000000100 FS: 00007f3a8a52c740(0000) GS:ffff9e631ad1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055bb289419c8 CR3: 000000011274e001 CR4: 00000000003706f0 Call Trace: bnxt_remove_one+0x57/0x180 [bnxt_en] pci_device_remove+0x39/0xc0 device_release_driver_internal+0xa5/0x130 driver_detach+0x42/0x90 bus_remove_driver+0x61/0xc0 pci_unregister_driver+0x38/0x90 bnxt_exit+0xc/0x7d0 [bnxt_en] Fixes: 004b5008016a ("eth: bnxt: remove most dependencies on RTNL") Reviewed-by: Pavan Chebbi Signed-off-by: Michael Chan Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250816183850.4125033-1-michael.chan@broadcom.com Signed-off-by: Jakub Kicinski commit 89eb9a62aed77b409663ba1eac152e8f758815b7 Author: Jonas Gorski Date: Fri Aug 15 22:18:09 2025 +0200 net: dsa: b53: fix reserved register access in b53_fdb_dump() When BCM5325 support was added in c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365"), the register used for ARL access was made conditional on the chip. But in b53_fdb_dump(), instead of the register argument the page argument was replaced, causing it to write to a reserved page 0x50 on !BCM5325*. Writing to this page seems to completely lock the switch up: [ 89.680000] b53-switch spi0.1 lan2: Link is Down [ 89.680000] WARNING: CPU: 1 PID: 26 at drivers/net/phy/phy.c:1350 _phy_state_machine+0x1bc/0x454 [ 89.720000] phy_check_link_status+0x0/0x114: returned: -5 [ 89.730000] Modules linked in: nft_fib_inet nf_flow_table_inet nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet nft_reject nft_redir nft_quota nft_numgen nft_nat nft_masq nft_log nft_limit nft_hash nft_flow_offload nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_chain_nat nf_tables nf_nat nf_flow_table nf_conntrack nfnetlink nf_reject_ipv6 nf_reject_ipv4 nf_log_syslog nf_defrag_ipv6 nf_defrag_ipv4 cls_flower sch_tbf sch_ingress sch_htb sch_hfsc em_u32 cls_u32 cls_route cls_matchall cls_fw cls_flow cls_basic act_skbedit act_mirred act_gact vrf md5 crc32c_cryptoapi [ 89.780000] CPU: 1 UID: 0 PID: 26 Comm: kworker/u10:0 Tainted: G W 6.16.0-rc1+ #0 NONE [ 89.780000] Tainted: [W]=WARN [ 89.780000] Hardware name: Netgear DGND3700 v1 [ 89.780000] Workqueue: events_power_efficient phy_state_machine [ 89.780000] Stack : 809c762c 8006b050 00000001 820a9ce3 0000114c 000affff 805d22d0 8200ba00 [ 89.780000] 82005000 6576656e 74735f70 6f776572 5f656666 10008b00 820a9cb8 82088700 [ 89.780000] 00000000 00000000 809c762c 820a9a98 00000000 00000000 ffffefff 80a7a76c [ 89.780000] 80a70000 820a9af8 80a70000 80a70000 80a70000 00000000 809c762c 820a9dd4 [ 89.780000] 00000000 805d1494 80a029e4 80a70000 00000003 00000000 00000004 81a60004 [ 89.780000] ... [ 89.780000] Call Trace: [ 89.780000] [<800228b8>] show_stack+0x38/0x118 [ 89.780000] [<8001afc4>] dump_stack_lvl+0x6c/0xac [ 89.780000] [<80046b90>] __warn+0x9c/0x114 [ 89.780000] [<80046da8>] warn_slowpath_fmt+0x1a0/0x1b0 [ 89.780000] [<805d1494>] _phy_state_machine+0x1bc/0x454 [ 89.780000] [<805d22fc>] phy_state_machine+0x2c/0x70 [ 89.780000] [<80066b08>] process_one_work+0x1e8/0x3e0 [ 89.780000] [<80067a1c>] worker_thread+0x354/0x4e4 [ 89.780000] [<800706cc>] kthread+0x130/0x274 [ 89.780000] [<8001d808>] ret_from_kernel_thread+0x14/0x1c And any further accesses fail: [ 120.790000] b53-switch spi0.1: timeout waiting for ARL to finish: 0x81 [ 120.800000] b53-switch spi0.1: port 2 failed to add 2c:b0:5d:27:9a:bd vid 3 to fdb: -145 [ 121.010000] b53-switch spi0.1: timeout waiting for ARL to finish: 0xbf [ 121.020000] b53-switch spi0.1: port 3 failed to add 2c:b0:5d:27:9a:bd vid 3 to fdb: -145 Restore the correct page B53_ARLIO_PAGE again, and move the offset argument to the correct place. *On BCM5325, this became a write to the MIB page of Port 1. Still a reserved offset, but likely less brokenness from that write. Fixes: c45655386e53 ("net: dsa: b53: add support for FDB operations on 5325/5365") Signed-off-by: Jonas Gorski Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250815201809.549195-1-jonas.gorski@gmail.com Signed-off-by: Jakub Kicinski commit 8cd3709b3985df5638558605ac79daba709a4344 Merge: 84967deee9d987 3259889fd3c0cc Author: Jakub Kicinski Date: Mon Aug 18 17:40:03 2025 -0700 Merge branch 'mptcp-misc-fixes-for-v6-17-rc' Matthieu Baerts says: ==================== mptcp: misc fixes for v6.17-rc Here are various fixes: - Patch 1: Better handling SKB extension allocation failures. A fix for v5.7. - Patches 2, 3: Avoid resetting MPTCP limits when flushing MPTCP endpoints. With a validation in the selftests. Fixes for v5.7. - Patches 4, 5, 6: Disallow '0' as ADD_ADDR retransmission timeout. With a preparation patch, and a validation in the selftests. Fixes for v5.11. - Patches 8, 9: Fix C23 extension warnings in the selftests, spotted by GCC. Fixes for v6.16. ==================== Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-0-521fe9957892@kernel.org Signed-off-by: Jakub Kicinski commit 3259889fd3c0cc165b7e9ee375c789875dd32326 Author: Matthieu Baerts (NGI0) Date: Fri Aug 15 19:28:26 2025 +0200 selftests: mptcp: sockopt: fix C23 extension warning GCC was complaining about the new label: mptcp_inq.c:79:2: warning: label followed by a declaration is a C23 extension [-Wc23-extensions] 79 | int err = getaddrinfo(node, service, hints, res); | ^ mptcp_sockopt.c:166:2: warning: label followed by a declaration is a C23 extension [-Wc23-extensions] 166 | int err = getaddrinfo(node, service, hints, res); | ^ Simply declare 'err' before the label to avoid this warning. Fixes: dd367e81b79a ("selftests: mptcp: sockopt: use IPPROTO_MPTCP for getaddrinfo") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-8-521fe9957892@kernel.org Signed-off-by: Jakub Kicinski commit 2eefbed30d46d5e68593baf6b52923e00e7678af Author: Matthieu Baerts (NGI0) Date: Fri Aug 15 19:28:25 2025 +0200 selftests: mptcp: connect: fix C23 extension warning GCC was complaining about the new label: mptcp_connect.c:187:2: warning: label followed by a declaration is a C23 extension [-Wc23-extensions] 187 | int err = getaddrinfo(node, service, hints, res); | ^ Simply declare 'err' before the label to avoid this warning. Fixes: a862771d1aa4 ("selftests: mptcp: use IPPROTO_MPTCP for getaddrinfo") Cc: stable@vger.kernel.org Reviewed-by: Geliang Tang Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-7-521fe9957892@kernel.org Signed-off-by: Jakub Kicinski commit f92199f551e617fae028c5c5905ddd63e3616e18 Author: Geliang Tang Date: Fri Aug 15 19:28:24 2025 +0200 selftests: mptcp: disable add_addr retrans in endpoint_tests To prevent test instability in the "delete re-add signal" test caused by ADD_ADDR retransmissions, disable retransmissions for this test by setting net.mptcp.add_addr_timeout to 0. Suggested-by: Matthieu Baerts Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-6-521fe9957892@kernel.org Signed-off-by: Jakub Kicinski commit f5ce0714623cffd00bf2a83e890d09c609b7f50a Author: Geliang Tang Date: Fri Aug 15 19:28:23 2025 +0200 mptcp: disable add_addr retransmission when timeout is 0 When add_addr_timeout was set to 0, this caused the ADD_ADDR to be retransmitted immediately, which looks like a buggy behaviour. Instead, interpret 0 as "no retransmissions needed". The documentation is updated to explicitly state that setting the timeout to 0 disables retransmission. Fixes: 93f323b9cccc ("mptcp: add a new sysctl add_addr_timeout") Cc: stable@vger.kernel.org Suggested-by: Matthieu Baerts Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-5-521fe9957892@kernel.org Signed-off-by: Jakub Kicinski commit 5d13349472ac8abcbcb94407969aa0fdc2e1f1be Author: Geliang Tang Date: Fri Aug 15 19:28:22 2025 +0200 mptcp: remove duplicate sk_reset_timer call sk_reset_timer() was called twice in mptcp_pm_alloc_anno_list. Simplify the code by using a 'goto' statement to eliminate the duplication. Note that this is not a fix, but it will help backporting the following patch. The same "Fixes" tag has been added for this reason. Fixes: 93f323b9cccc ("mptcp: add a new sysctl add_addr_timeout") Cc: stable@vger.kernel.org Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-4-521fe9957892@kernel.org Signed-off-by: Jakub Kicinski commit 452690be7de2f91cc0de68cb9e95252875b33503 Author: Matthieu Baerts (NGI0) Date: Fri Aug 15 19:28:21 2025 +0200 selftests: mptcp: pm: check flush doesn't reset limits This modification is linked to the parent commit where the received ADD_ADDR limit was accidentally reset when the endpoints were flushed. To validate that, the test is now flushing endpoints after having set new limits, and before checking them. The 'Fixes' tag here below is the same as the one from the previous commit: this patch here is not fixing anything wrong in the selftests, but it validates the previous fix for an issue introduced by this commit ID. Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-3-521fe9957892@kernel.org Signed-off-by: Jakub Kicinski commit 68fc0f4b0d25692940cdc85c68e366cae63e1757 Author: Matthieu Baerts (NGI0) Date: Fri Aug 15 19:28:20 2025 +0200 mptcp: pm: kernel: flush: do not reset ADD_ADDR limit A flush of the MPTCP endpoints should not affect the MPTCP limits. In other words, 'ip mptcp endpoint flush' should not change 'ip mptcp limits'. But it was the case: the MPTCP_PM_ATTR_RCV_ADD_ADDRS (add_addr_accepted) limit was reset by accident. Removing the reset of this counter during a flush fixes this issue. Fixes: 01cacb00b35c ("mptcp: add netlink-based PM") Cc: stable@vger.kernel.org Reported-by: Thomas Dreibholz Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/579 Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-2-521fe9957892@kernel.org Signed-off-by: Jakub Kicinski commit ccab044697980c6c01ab51f43f48f13b8a3e5c33 Author: Christoph Paasch Date: Fri Aug 15 19:28:19 2025 +0200 mptcp: drop skb if MPTCP skb extension allocation fails When skb_ext_add(skb, SKB_EXT_MPTCP) fails in mptcp_incoming_options(), we used to return true, letting the segment proceed through the TCP receive path without a DSS mapping. Such segments can leave inconsistent mapping state and trigger a mid-stream fallback to TCP, which in testing collapsed (by artificially forcing failures in skb_ext_add) throughput to zero. Return false instead so the TCP input path drops the skb (see tcp_data_queue() and step-7 processing). This is the safer choice under memory pressure: it preserves MPTCP correctness and provides backpressure to the sender. Control packets remain unaffected: ACK updates and DATA_FIN handling happen before attempting the extension allocation, and tcp_reset() continues to ignore the return value. With this change, MPTCP continues to work at high throughput if we artificially inject failures into skb_ext_add. Fixes: 6787b7e350d3 ("mptcp: avoid processing packet if a subflow reset") Cc: stable@vger.kernel.org Signed-off-by: Christoph Paasch Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250815-net-mptcp-misc-fixes-6-17-rc2-v1-1-521fe9957892@kernel.org Signed-off-by: Jakub Kicinski commit 84967deee9d9870b15bc4c3acb50f1d401807902 Author: Minhong He Date: Fri Aug 15 14:38:45 2025 +0800 ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add The seg6_genl_sethmac() directly uses the algorithm ID provided by the userspace without verifying whether it is an HMAC algorithm supported by the system. If an unsupported HMAC algorithm ID is configured, packets using SRv6 HMAC will be dropped during encapsulation or decapsulation. Fixes: 4f4853dc1c9c ("ipv6: sr: implement API to control SR HMAC structure") Signed-off-by: Minhong He Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250815063845.85426-1-heminhong@kylinos.cn Signed-off-by: Jakub Kicinski commit 864e3396976ef41de6cc7bc366276bf4e084fff2 Author: Jakub Ramaseuski Date: Thu Aug 14 12:51:19 2025 +0200 net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM When performing Generic Segmentation Offload (GSO) on an IPv6 packet that contains extension headers, the kernel incorrectly requests checksum offload if the egress device only advertises NETIF_F_IPV6_CSUM feature, which has a strict contract: it supports checksum offload only for plain TCP or UDP over IPv6 and explicitly does not support packets with extension headers. The current GSO logic violates this contract by failing to disable the feature for packets with extension headers, such as those used in GREoIPv6 tunnels. This violation results in the device being asked to perform an operation it cannot support, leading to a `skb_warn_bad_offload` warning and a collapse of network throughput. While device TSO/USO is correctly bypassed in favor of software GSO for these packets, the GSO stack must be explicitly told not to request checksum offload. Mask NETIF_F_IPV6_CSUM, NETIF_F_TSO6 and NETIF_F_GSO_UDP_L4 in gso_features_check if the IPv6 header contains extension headers to compute checksum in software. The exception is a BIG TCP extension, which, as stated in commit 68e068cabd2c6c53 ("net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets"): "The feature is only enabled on devices that support BIG TCP TSO. The header is only present for PF_PACKET taps like tcpdump, and not transmitted by physical devices." kernel log output (truncated): WARNING: CPU: 1 PID: 5273 at net/core/dev.c:3535 skb_warn_bad_offload+0x81/0x140 ... Call Trace: skb_checksum_help+0x12a/0x1f0 validate_xmit_skb+0x1a3/0x2d0 validate_xmit_skb_list+0x4f/0x80 sch_direct_xmit+0x1a2/0x380 __dev_xmit_skb+0x242/0x670 __dev_queue_xmit+0x3fc/0x7f0 ip6_finish_output2+0x25e/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_tnl_xmit+0x608/0xc00 [ip6_tunnel] ip6gre_tunnel_xmit+0x1c0/0x390 [ip6_gre] dev_hard_start_xmit+0x63/0x1c0 __dev_queue_xmit+0x6d0/0x7f0 ip6_finish_output2+0x214/0x5d0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 ip6_finish_output+0x1fc/0x3f0 ip6_xmit+0x2ca/0x6f0 inet6_csk_xmit+0xeb/0x150 __tcp_transmit_skb+0x555/0xa80 tcp_write_xmit+0x32a/0xe90 tcp_sendmsg_locked+0x437/0x1110 tcp_sendmsg+0x2f/0x50 ... skb linear: 00000000: e4 3d 1a 7d ec 30 e4 3d 1a 7e 5d 90 86 dd 60 0e skb linear: 00000010: 00 0a 1b 34 3c 40 20 11 00 00 00 00 00 00 00 00 skb linear: 00000020: 00 00 00 00 00 12 20 11 00 00 00 00 00 00 00 00 skb linear: 00000030: 00 00 00 00 00 11 2f 00 04 01 04 01 01 00 00 00 skb linear: 00000040: 86 dd 60 0e 00 0a 1b 00 06 40 20 23 00 00 00 00 skb linear: 00000050: 00 00 00 00 00 00 00 00 00 12 20 23 00 00 00 00 skb linear: 00000060: 00 00 00 00 00 00 00 00 00 11 bf 96 14 51 13 f9 skb linear: 00000070: ae 27 a0 a8 2b e3 80 18 00 40 5b 6f 00 00 01 01 skb linear: 00000080: 08 0a 42 d4 50 d5 4b 70 f8 1a Fixes: 04c20a9356f283da ("net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension") Reported-by: Tianhao Zhao Suggested-by: Michal Schmidt Suggested-by: Willem de Bruijn Signed-off-by: Jakub Ramaseuski Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250814105119.1525687-1-jramaseu@redhat.com Signed-off-by: Jakub Kicinski commit 297a4833a68aac3316eb808b4123eb016ef242d7 Author: Timur Kristóf Date: Sat Aug 2 17:51:53 2025 +0200 drm/amd/display: Fix DP audio DTO1 clock source on DCE 6. On DCE 6, DP audio was not working. However, it worked when an HDMI monitor was also plugged in. Looking at dce_aud_wall_dto_setup it seems that the main difference is that we use DTO1 when only DP is plugged in. When programming DTO1, it uses audio_dto_source_clock_in_khz which is set from get_dp_ref_freq_khz The dce60_get_dp_ref_freq_khz implementation looks incorrect, because DENTIST_DISPCLK_CNTL seems to be always zero on DCE 6, so it isn't usable. I compared dce60_get_dp_ref_freq_khz to the legacy display code, specifically dce_v6_0_audio_set_dto, and it turns out that in case of DCE 6, it needs to use the display clock. With that, DP audio started working on Pitcairn, Oland and Cape Verde. However, it still didn't work on Tahiti. Despite having the same DCE version, Tahiti seems to have a different audio device. After some trial and error I realized that it works with the default display clock as reported by the VBIOS, not the current display clock. The patch was tested on all four SI GPUs: * Pitcairn (DCE 6.0) * Oland (DCE 6.4) * Cape Verde (DCE 6.0) * Tahiti (DCE 6.0 but different) The testing was done on Samsung Odyssey G7 LS28BG700EPXEN on each of the above GPUs, at the following settings: * 4K 60 Hz * 1080p 60 Hz * 1080p 144 Hz Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 645cc7863da5de700547d236697dffd6760cf051) Cc: stable@vger.kernel.org commit 10507478468f165ea681605d133991ed05cdff62 Author: Timur Kristóf Date: Thu Jul 31 11:43:52 2025 +0200 drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 For later VBIOS versions, the fractional feedback divider is calculated as the remainder of dividing the feedback divider by a factor, which is set to 1000000. For reference, see: - calculate_fb_and_fractional_fb_divider - calc_pll_max_vco_construct However, in case of old VBIOS versions that have set_pixel_clock_v3, they only have 1 byte available for the fractional feedback divider, and it's expected to be set to the remainder from dividing the feedback divider by 10. For reference see the legacy display code: - amdgpu_pll_compute - amdgpu_atombios_crtc_program_pll This commit fixes set_pixel_clock_v3 by dividing the fractional feedback divider passed to the function by 100000. Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 027e7acc7e17802ebf28e1edb88a404836ad50d6) Cc: stable@vger.kernel.org commit f14ee2e7a86c5e57295b48b8e198cae7189b3b93 Author: Timur Kristóf Date: Thu Jul 31 11:43:51 2025 +0200 drm/amd/display: Don't print errors for nonexistent connectors When getting the number of connectors, the VBIOS reports the number of valid indices, but it doesn't say which indices are valid, and not every valid index has an actual connector. If we don't find a connector on an index, that is not an error. Considering these are not actual errors, don't litter the logs. Fixes: 60df5628144b ("drm/amd/display: handle invalid connector indices") Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 249d4bc5f1935f04bb45b3b63c0f8922565124f7) commit 8246147f1fbaed522b8bcc02ca34e4260747dcfb Author: Timur Kristóf Date: Thu Jul 31 11:43:50 2025 +0200 drm/amd/display: Don't warn when missing DCE encoder caps On some GPUs the VBIOS just doesn't have encoder caps, or maybe not for every encoder. This isn't really a problem and it's handled well, so let's not litter the logs with it. Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 33e0227ee96e62d034781e91f215e32fd0b1d512) commit 7d07140d37f792f01cfdb8ca9a6a792ab1d29126 Author: Timur Kristóf Date: Thu Jul 31 11:43:49 2025 +0200 drm/amd/display: Fill display clock and vblank time in dce110_fill_display_configs Also needed by DCE 6. This way the code that gathers this info can be shared between different DCE versions and doesn't have to be repeated. Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 8107432dff37db26fcb641b6cebeae8981cd73a0) Cc: stable@vger.kernel.org commit 669f73a26f6112eedbadac53a2f2707ac6d0b9c8 Author: Timur Kristóf Date: Thu Jul 31 11:43:48 2025 +0200 drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs dce110_fill_display_configs is shared between DCE 6-11, and finding the first CRTC and its line time is relevant to DCE 6 too. Move the code to find it from DCE 11 specific code. Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 4ab09785f8d5d03df052827af073d5c508ff5f63) Cc: stable@vger.kernel.org commit 1fc931be2f47fde23ca5aff6f19421375c312fb2 Author: Timur Kristóf Date: Thu Jul 31 11:43:47 2025 +0200 drm/amd/display: Adjust DCE 8-10 clock, don't overclock by 15% Adjust the nominal (and performance) clocks for DCE 8-10, and set them to 625 MHz, which is the value used by the legacy display code in amdgpu_atombios_get_clock_info. This was tested with Hawaii, Tonga and Fiji. These GPUs can output 4K 60Hz (10-bit depth) at 625 MHz. The extra 15% clock was added as a workaround for a Polaris issue which uses DCE 11, and should not have been used on DCE 8-10 which are already hardcoded to the highest possible display clock. Unfortunately, the extra 15% was mistakenly copied and kept even on code paths which don't affect Polaris. This commit fixes that and also adds a check to make sure not to exceed the maximum DCE 8-10 display clock. Fixes: 8cd61c313d8b ("drm/amd/display: Raise dispclk value for Polaris") Fixes: dc88b4a684d2 ("drm/amd/display: make clk mgr soc specific") Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 1ae45b5d4f371af8ae51a3827d0ec9fe27eeb867) commit cb7b7ae53b557d168b4af5cd8549f3eff920bfb5 Author: Timur Kristóf Date: Thu Jul 31 11:43:46 2025 +0200 drm/amd/display: Don't overclock DCE 6 by 15% The extra 15% clock was added as a workaround for a Polaris issue which uses DCE 11, and should not have been used on DCE 6 which is already hardcoded to the highest possible display clock. Unfortunately, the extra 15% was mistakenly copied and kept even on code paths which don't affect Polaris. This commit fixes that and also adds a check to make sure not to exceed the maximum DCE 6 display clock. Fixes: 8cd61c313d8b ("drm/amd/display: Raise dispclk value for Polaris") Fixes: dc88b4a684d2 ("drm/amd/display: make clk mgr soc specific") Fixes: 3ecb3b794e2c ("drm/amd/display: dc/clk_mgr: add support for SI parts (v2)") Signed-off-by: Timur Kristóf Acked-by: Alex Deucher Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Hung Signed-off-by: Alex Deucher (cherry picked from commit 427980c1cbd22bb256b9385f5ce73c0937562408) Cc: stable@vger.kernel.org commit 7a2ca2ea64b1b63c8baa94a8f5deb70b2248d119 Author: Chenyuan Yang Date: Wed Jul 23 21:36:41 2025 -0500 drm/amd/display: Add null pointer check in mod_hdcp_hdcp1_create_session() The function mod_hdcp_hdcp1_create_session() calls the function get_first_active_display(), but does not check its return value. The return value is a null pointer if the display list is empty. This will lead to a null pointer dereference. Add a null pointer check for get_first_active_display() and return MOD_HDCP_STATUS_DISPLAY_NOT_FOUND if the function return null. This is similar to the commit c3e9826a2202 ("drm/amd/display: Add null pointer check for get_first_active_display()"). Fixes: 2deade5ede56 ("drm/amd/display: Remove hdcp display state with mst fix") Signed-off-by: Chenyuan Yang Reviewed-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 5e43eb3cd731649c4f8b9134f857be62a416c893) commit 66af73a1c319336694a8610fe4c2943f7b33066c Author: Tom Chung Date: Fri Jul 18 18:25:08 2025 +0800 drm/amd/display: Fix Xorg desktop unresponsive on Replay panel [WHY & HOW] IPS & self-fresh feature can cause vblank counter resets between vblank disable and enable. It may cause system stuck due to wait the vblank counter. Call the drm_crtc_vblank_restore() during vblank enable to estimate missed vblanks by using timestamps and update the vblank counter in DRM. It can make the vblank counter increase smoothly and resolve this issue. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Sun peng (Leo) Li Signed-off-by: Tom Chung Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 34d66bc7ff10e146a4cec76cf286979740a10954) Cc: stable@vger.kernel.org commit 07b93a5704b0b72002f0c4bd1076214af67dc661 Author: Mario Limonciello Date: Thu Jul 24 15:00:43 2025 -0500 drm/amd/display: Avoid a NULL pointer dereference [WHY] Although unlikely drm_atomic_get_new_connector_state() or drm_atomic_get_old_connector_state() can return NULL. [HOW] Check returns before dereference. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Harry Wentland Signed-off-by: Mario Limonciello Signed-off-by: Alex Hung Tested-by: Dan Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 1e5e8d672fec9f2ab352be121be971877bff2af9) Cc: stable@vger.kernel.org commit 79e25cd06e85105c75701ef1773c6c64bb304091 Author: Alex Deucher Date: Fri Aug 8 13:12:07 2025 -0400 drm/amdgpu/swm14: Update power limit logic Take into account the limits from the vbios. Ported from the SMU13 code. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4352 Reviewed-by: Jesse Zhang Reviewed-by: Kenneth Feng Signed-off-by: Alex Deucher (cherry picked from commit 203cc7f1dd86f2c8de5c3c6182f19adac7c9c206) Cc: stable@vger.kernel.org commit 0aa86640ebd98d77fb64acef5684e42fba517d2d Author: Gabe Teeger Date: Wed Jul 9 14:12:22 2025 -0400 drm/amd/display: Revert Add HPO encoder support to Replay This reverts commits: commit 1f26214d268b ("drm/amd/display: Add HPO encoder support to Replay") commit 3bfce48b109f ("drm/amd/display: Add support for Panel Replay on DP1 eDP (panel_inst=1)") due to visual confirm issue. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Gabe Teeger Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 92f68f6a1b297633159a3f3759e4dfc7e5b58abb) commit 923fcb3dbc0246fc5207093c0049af4c56f20e41 Author: Yury Norov Date: Mon Aug 11 16:30:39 2025 -0400 KVM: SEV: don't check have_run_cpus in sev_writeback_caches() Drop KVM's check on an empty cpumask when flushing caches when memory is being reclaimed from an SEV VM, as smp_call_function_many_cond() naturally (and correctly) handles an empty cpumask. This avoids an extra O(n) lookup in the common case where at least one pCPU has enterred the guest, which could be noticeable in some setups, e.g. if a small VM is pinned to the last few pCPUs in the system. Fixes: 6f38f8c57464 ("KVM: SVM: Flush cache only on CPUs running SEV guest") Signed-off-by: Yury Norov (NVIDIA) [sean: rewrite changelog to capture performance angle] Signed-off-by: Sean Christopherson commit f79a62f4b3c750759e60a402e8fe5180fc5771f0 Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync uapi/linux/vhost.h with the kernel source To pick up the changes in this cset: 7d9896e9f6d02d8a vhost: Reintroduce kthread API and add mode selection 333c515d189657c9 vhost-net: allow configuring extended features This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/vhost.h include/uapi/linux/vhost.h Please see tools/include/uapi/README for further details. Cc: "Michael S. Tsirkin" Cc: Jason Wang Cc: kvm@vger.kernel.org Cc: virtualization@lists.linux.dev Signed-off-by: Namhyung Kim commit e7e79e99726190a5a83d158576cd448896d68102 Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync uapi/linux/prctl.h with the kernel source To pick up the changes in this cset: b1fabef37bd504f3 prctl: Introduce PR_MTE_STORE_ONLY a2fc422ed75748ee syscall_user_dispatch: Add PR_SYS_DISPATCH_INCLUSIVE_ON This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/prctl.h include/uapi/linux/prctl.h Please see tools/include/uapi/README for further details. Signed-off-by: Namhyung Kim commit 4a4083af03a7a75a86c392fd60cb37ce23ed87b6 Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync uapi/linux/fs.h with the kernel source To pick up the changes in this cset: 76fdb7eb4e1c9108 uapi: export PROCFS_ROOT_INO ca115d7e754691c0 tree-wide: s/struct fileattr/struct file_kattr/g be7efb2d20d67f33 fs: introduce file_getattr and file_setattr syscalls 9eb22f7fedfc9eb1 fs: add ioctl to query metadata and protection info capabilities This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/fs.h include/uapi/linux/fs.h Please see tools/include/uapi/README for further details. Cc: Christian Brauner Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim commit b18aabe283a10774977d698c075d2296a2336aef Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync uapi/linux/fcntl.h with the kernel source To pick up the changes in this cset: 3941e37f62fe2c3c uapi/fcntl: add FD_PIDFS_ROOT cd5d2006327b6d84 uapi/fcntl: add FD_INVALID 67fcec2919e4ed31 fcntl/pidfd: redefine PIDFD_SELF_THREAD_GROUP a4c746f06853f91d uapi/fcntl: mark range as reserved This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/perf/trace/beauty/include/uapi/linux/fcntl.h include/uapi/linux/fcntl.h Please see tools/include/uapi/README for further details. Cc: Christian Brauner Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Namhyung Kim commit 52174e0eb13876654f56701c26a672890aa5e7e3 Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync syscall tables with the kernel source To pick up the changes in this cset: be7efb2d20d67f33 fs: introduce file_getattr and file_setattr syscalls This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/asm-generic/unistd.h include/uapi/asm-generic/unistd.h diff -u tools/scripts/syscall.tbl scripts/syscall.tbl diff -u tools/perf/arch/x86/entry/syscalls/syscall_32.tbl arch/x86/entry/syscalls/syscall_32.tbl diff -u tools/perf/arch/x86/entry/syscalls/syscall_64.tbl arch/x86/entry/syscalls/syscall_64.tbl diff -u tools/perf/arch/powerpc/entry/syscalls/syscall.tbl arch/powerpc/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/s390/entry/syscalls/syscall.tbl arch/s390/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/mips/entry/syscalls/syscall_n64.tbl arch/mips/kernel/syscalls/syscall_n64.tbl diff -u tools/perf/arch/arm/entry/syscalls/syscall.tbl arch/arm/tools/syscall.tbl diff -u tools/perf/arch/sh/entry/syscalls/syscall.tbl arch/sh/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/sparc/entry/syscalls/syscall.tbl arch/sparc/kernel/syscalls/syscall.tbl diff -u tools/perf/arch/xtensa/entry/syscalls/syscall.tbl arch/xtensa/kernel/syscalls/syscall.tbl Please see tools/include/uapi/README for further details. Cc: Arnd Bergmann CC: linux-api@vger.kernel.org Signed-off-by: Namhyung Kim commit c85538c4e3c7111958057d15ea8ee444116891c3 Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync powerpc headers with the kernel source To pick up the changes in this cset: 69bf2053608423cb powerpc: Drop GPL boilerplate text with obsolete FSF address This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/arch/powerpc/include/uapi/asm/kvm.h arch/powerpc/include/uapi/asm/kvm.h Please see tools/include/uapi/README for further details. Cc: Madhavan Srinivasan Cc: linuxppc-dev@lists.ozlabs.org Signed-off-by: Namhyung Kim commit 14ec8ce45611c767656e4fa575f17b05344aa80a Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync arm64 headers with the kernel source To pick up the changes in this cset: efe676a1a7554219 arm64: proton-pack: Add new CPUs 'k' values for branch mitigation e18c09b204e81702 arm64: Add support for HIP09 Spectre-BHB mitigation a9b5bd81b294d30a arm64: cputype: Add MIDR_CORTEX_A76AE 53a52a0ec7680287 arm64: cputype: Add comments about Qualcomm Kryo 5XX and 6XX cores 401c3333bb2396aa arm64: cputype: Add QCOM_CPU_PART_KRYO_3XX_GOLD 86edf6bdcf0571c0 smccc/kvm_guest: Enable errata based on implementation CPUs 0bc9a9e85fcf4ffb KVM: arm64: Work around x1e's CNTVOFF_EL2 bogosity This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/arch/arm64/include/asm/cputype.h arch/arm64/include/asm/cputype.h But the following two changes cannot be applied since they introduced new build errors in util/arm-spe.c. So it still has the warning after this change. c8c2647e69bedf80 arm64: Make  _midr_in_range_list() an exported function e3121298c7fcaf48 arm64: Modify _midr_range() functions to read MIDR/REVIDR internally Please see tools/include/uapi/README for further details. Cc: Catalin Marinas Cc: Will Deacon Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Namhyung Kim perf build: [WIP] Fix arm-spe build errors Signed-off-by: Namhyung Kim commit 619f55c859014e2235f83ba6cde8c59edc492f39 Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync x86 headers with the kernel source To pick up the changes in this cset: 7b306dfa326f7011 x86/sev: Evict cache lines during SNP memory validation 65f55a30176662ee x86/CPU/AMD: Add CPUID faulting support d8010d4ba43e9f79 x86/bugs: Add a Transient Scheduler Attacks mitigation a3c4f3396b82849a x86/msr-index: Add AMD workload classification MSRs 17ec2f965344ee3f KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/arch/x86/include/asm/cpufeatures.h arch/x86/include/asm/cpufeatures.h diff -u tools/arch/x86/include/asm/msr-index.h arch/x86/include/asm/msr-index.h Please see tools/include/uapi/README for further details. Cc: x86@kernel.org Signed-off-by: Namhyung Kim commit aa34642f6fc36a436de5ae5b30d414578b3622f5 Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync linux/cfi_types.h with the kernel source To pick up the changes in this cset: 5ccaeedb489b41ce cfi: add C CFI type macro This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/linux/cfi_types.h include/linux/cfi_types.h Please see tools/include/uapi/README for further details. Cc: Mark Rutland Signed-off-by: Namhyung Kim commit 6cb8607934d937f4ad24ec9ad26aeb669e266937 Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync linux/bits.h with the kernel source To pick up the changes in this cset: 104ea1c84b91c9f4 bits: unify the non-asm GENMASK*() 6d4471252ccc1722 bits: split the definition of the asm and non-asm GENMASK*() This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/linux/bits.h include/linux/bits.h Please see tools/include/uapi/README for further details. Cc: Yury Norov Signed-off-by: Namhyung Kim commit d0a2b527d8c32e46ccb8a34053468d4ff0c27e5c Author: Christoph Hellwig Date: Mon Aug 18 12:11:02 2025 +0200 block: tone down bio_check_eod bdev_nr_sectors() == 0 is a pattern used for block devices that have been hot removed, don't spam the log about them. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250818101102.1604551-1-hch@lst.de Signed-off-by: Jens Axboe commit 47b71abd58461a67cae71d2f2a9d44379e4e2fcf Author: Rajeev Mishra Date: Mon Aug 18 18:48:21 2025 +0000 loop: use vfs_getattr_nosec for accurate file size Use vfs_getattr_nosec() in lo_calculate_size() for getting the file size, rather than just read the cached inode size via i_size_read(). This provides better results than cached inode data, particularly for network filesystems where metadata may be stale. Signed-off-by: Rajeev Mishra Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20250818184821.115033-3-rajeevm@hpe.com [axboe: massage commit message] Signed-off-by: Jens Axboe commit 8aa5a3b68ad144da49a3d17f165e6561255e3529 Author: Rajeev Mishra Date: Mon Aug 18 18:48:20 2025 +0000 loop: Consolidate size calculation logic into lo_calculate_size() Renamed get_size to lo_calculate_size and merged the logic from get_size and get_loop_size into a single function. Update all callers to use lo_calculate_size. This is done in preparation for improving the size detection logic. Signed-off-by: Rajeev Mishra Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20250818184821.115033-2-rajeevm@hpe.com [axboe: massage commit message] Signed-off-by: Jens Axboe commit bd842ff41543af424c2473dc16c678ac8ba2b43f Author: Namhyung Kim Date: Mon Aug 18 10:32:18 2025 -0700 tools headers: Sync KVM headers with the kernel source To pick up the changes in this cset: f55ce5a6cd33211c KVM: arm64: Expose new KVM cap for cacheable PFNMAP 28224ef02b56fcee KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities 4580dbef5ce0f95a KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt 25e8b1dd4883e6c2 KVM: TDX: Exit to userspace for GetTdVmCallInfo cf207eac06f661fb KVM: TDX: Handle TDG.VP.VMCALL This addresses these perf build warnings: Warning: Kernel ABI header differences: diff -u tools/include/uapi/linux/kvm.h include/uapi/linux/kvm.h diff -u tools/arch/x86/include/uapi/asm/kvm.h arch/x86/include/uapi/asm/kvm.h Please see tools/include/uapi/README for further details. Cc: Paolo Bonzini Cc: kvm@vger.kernel.org Signed-off-by: Namhyung Kim commit 22ec0faa0eda30acdd6dcb3c29c872629da677bb Author: Namhyung Kim Date: Fri Aug 15 09:41:22 2025 -0700 perf test: Fix a build error in x86 topdown test There's an environment that caused the following build error. Include "debug.h" (under util directory) to fix it. arch/x86/tests/topdown.c: In function 'event_cb': arch/x86/tests/topdown.c:53:25: error: implicit declaration of function 'pr_debug' [-Werror=implicit-function-declaration] 53 | pr_debug("Broken topdown information for '%s'\n", evsel__name(evsel)); | ^~~~~~~~ cc1: all warnings being treated as errors Link: https://lore.kernel.org/r/20250815164122.289651-1-namhyung@kernel.org Fixes: 5b546de9cc177936 ("perf topdown: Use attribute to see an event is a topdown metic or slots") Reported-by: Naresh Kamboju Signed-off-by: Namhyung Kim commit 43c0f6456f801181a80b73d95def0e0fd134e1cc Author: Salah Triki Date: Mon Aug 18 10:27:30 2025 +0100 iio: pressure: bmp280: Use IS_ERR() in bmp280_common_probe() `devm_gpiod_get_optional()` may return non-NULL error pointer on failure. Check its return value using `IS_ERR()` and propagate the error if necessary. Fixes: df6e71256c84 ("iio: pressure: bmp280: Explicitly mark GPIO optional") Signed-off-by: Salah Triki Reviewed-by: David Lechner Link: https://patch.msgid.link/20250818092740.545379-2-salah.triki@gmail.com Cc: Signed-off-by: Jonathan Cameron commit 724216903700c7bee56464ab4634310fd4ede46b Merge: f4ae1744033d54 b7ee30f0efd12f Author: Jens Axboe Date: Mon Aug 18 11:13:38 2025 -0600 Merge tag 'md-6.17-20250819' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux into block-6.17 Pull MD fixes from Yu: "- Add a legacy_async_del_gendisk mode, to prevent a user tools regression. New user tools releases will not use such a mode, the old release with a new kernel now will have warning about deprecated behavior, and we prepare to remove this legacy mode after about a year later. - The rename in kernel causing user tools build failure, revert the rename in mdp_superblock_s. - Fix a regression that interrupted resync can be shown as recover from mdstat or sysfs." * tag 'md-6.17-20250819' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux: md: fix sync_action incorrect display during resync md: add helper rdev_needs_recovery() md: keep recovery_cp in mdp_superblock_s md: add legacy_async_del_gendisk mode commit af24c20c4633a667ac5b5e20cf9d96f6176a0ca3 Author: Zhang Yi Date: Fri Aug 15 10:47:29 2025 +0800 ASoC: codecs: ES9389: Modify the standby configuration Modify the standby configuration Signed-off-by: Zhang Yi Link: https://patch.msgid.link/20250815024729.3051-1-zhangyi@everest-semi.com Signed-off-by: Mark Brown commit 779b1a1cb13ae17028aeddb2fbbdba97357a1e15 Author: Rafael J. Wysocki Date: Wed Aug 13 12:25:58 2025 +0200 cpuidle: governors: menu: Avoid selecting states with too much latency Occasionally, the exit latency of the idle state selected by the menu governor may exceed the PM QoS CPU wakeup latency limit. Namely, if the scheduler tick has been stopped already and predicted_ns is greater than the tick period length, the governor may return an idle state whose exit latency exceeds latency_req because that decision is made before checking the current idle state's exit latency. For instance, say that there are 3 idle states, 0, 1, and 2. For idle states 0 and 1, the exit latency is equal to the target residency and the values are 0 and 5 us, respectively. State 2 is deeper and has the exit latency and target residency of 200 us and 2 ms (which is greater than the tick period length), respectively. Say that predicted_ns is equal to TICK_NSEC and the PM QoS latency limit is 20 us. After the first two iterations of the main loop in menu_select(), idx becomes 1 and in the third iteration of it the target residency of the current state (state 2) is greater than predicted_ns. State 2 is not a polling one and predicted_ns is not less than TICK_NSEC, so the check on whether or not the tick has been stopped is done. Say that the tick has been stopped already and there are no imminent timers (that is, delta_tick is greater than the target residency of state 2). In that case, idx becomes 2 and it is returned immediately, but the exit latency of state 2 exceeds the latency limit. Address this issue by modifying the code to compare the exit latency of the current idle state (idle state i) with the latency limit before comparing its target residency with predicted_ns, which allows one more exit_latency_ns check that becomes redundant to be dropped. However, after the above change, latency_req cannot take the predicted_ns value any more, which takes place after commit 38f83090f515 ("cpuidle: menu: Remove iowait influence"), because it may cause a polling state to be returned prematurely. In the context of the previous example say that predicted_ns is 3000 and the PM QoS latency limit is still 20 us. Additionally, say that idle state 0 is a polling one. Moving the exit_latency_ns check before the target_residency_ns one causes the loop to terminate in the second iteration, before the target_residency_ns check, so idle state 0 will be returned even though previously state 1 would be returned if there were no imminent timers. For this reason, remove the assignment of the predicted_ns value to latency_req from the code. Fixes: 5ef499cd571c ("cpuidle: menu: Handle stopped tick more aggressively") Cc: 4.17+ # 4.17+ Signed-off-by: Rafael J. Wysocki Reviewed-by: Christian Loehle Link: https://patch.msgid.link/5043159.31r3eYUQgx@rafael.j.wysocki commit 2bc1adb05e360fe0b78065d0ae43c47e336940c3 Merge: c17b750b3ad9f4 357d1fc38aad2c Author: Rafael J. Wysocki Date: Mon Aug 18 18:40:02 2025 +0200 Merge tag 'linux-cpupower-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Merge a cpupower utility fix for 6.17-rc3 from Shuah Khan: "Fixes set subcommand -t option and enables boost control feature on non-x86 platforms that support boost control." * tag 'linux-cpupower-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: Allow control of boost feature on non-x86 based systems with boost support. cpupower: Fix a bug where the -t option of the set subcommand was not working. commit b21d1fbb97c814c76ffa392cd603f8cd3ecc0355 Author: Uwe Kleine-König Date: Thu Aug 14 07:11:57 2025 +0200 ACPI: APEI: EINJ: Fix resource leak by remove callback in .exit.text The .remove() callback is also used during error handling in faux_probe(). As einj_remove() was marked with __exit it's not linked into the kernel if the driver is built-in, potentially resulting in resource leaks. Also remove the comment justifying the __exit annotation which doesn't apply any more since the driver was converted to the faux device interface. Fixes: 6cb9441bfe8d ("ACPI: APEI: EINJ: Transition to the faux device interface") Signed-off-by: Uwe Kleine-König Cc: 6.16+ # 6.16+ Link: https://patch.msgid.link/20250814051157.35867-2-u.kleine-koenig@baylibre.com Signed-off-by: Rafael J. Wysocki commit f4ae1744033d54b63c31a3664a4fdf5cebec7f27 Author: Christoph Hellwig Date: Mon Aug 18 06:54:51 2025 +0200 block: remove newlines from the warnings in blk_validate_integrity_limits Otherwise they are very hard to read in the kernel log. Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250818045456.1482889-3-hch@lst.de Signed-off-by: Jens Axboe commit 61ca3b891b4b9667334c1356a73f28954c92d43a Author: Christoph Hellwig Date: Mon Aug 18 06:54:50 2025 +0200 block: handle pi_tuple_size in queue_limits_stack_integrity queue_limits_stack_integrity needs to handle the new pi_tuple_size field, otherwise stacking PI-capable devices will always fail. Fixes: 76e45252a4ce ("block: introduce pi_tuple_size field in blk_integrity") Signed-off-by: Christoph Hellwig Reviewed-by: Anuj Gupta Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250818045456.1482889-2-hch@lst.de Signed-off-by: Jens Axboe commit be48bcf004f9d0c9207ff21d0edb3b42f253829e Merge: 074e461d9ed5bb 74857fdc5dd2cd Author: Linus Torvalds Date: Mon Aug 18 09:17:42 2025 -0700 Merge tag 'for-6.17-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: "Several zoned mode fixes, mount option printing fixups, folio state handling fixes and one log replay fix. - zoned mode: - zone activation and finish fixes - block group reservation fixes - mount option fixes: - bring back printing of mount options with key=value that got accidentally dropped during mount option parsing in 6.8 - fix inverse logic or typos when printing nodatasum/nodatacow - folio status fixes: - writeback fixes in zoned mode - properly reset dirty/writeback if submission fails - properly handle TOWRITE xarray mark/tag - do not set mtime/ctime to current time when unlinking for log replay" * tag 'for-6.17-rc2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix printing of mount info messages for NODATACOW/NODATASUM btrfs: restore mount option info messages during mount btrfs: fix incorrect log message for nobarrier mount option btrfs: fix buffer index in wait_eb_writebacks() btrfs: subpage: keep TOWRITE tag until folio is cleaned btrfs: clear TAG_TOWRITE from buffer tree when submitting a tree block btrfs: do not set mtime/ctime to current time when unlinking for log replay btrfs: clear block dirty if btrfs_writepage_cow_fixup() failed btrfs: clear block dirty if submit_one_sector() failed btrfs: zoned: limit active zones to max_open_zones btrfs: zoned: fix write time activation failure for metadata block group btrfs: zoned: fix data relocation block group reservation btrfs: zoned: skip ZONE FINISH of conventional zones commit 7459e87ae1d78ba27b728172fa2aa912a5b8640d Author: Charles Han Date: Fri Aug 15 10:42:06 2025 +0800 ACPI: APEI: EINJ: fix potential NULL dereference in __einj_error_inject() The __einj_error_inject() function allocates memory via kmalloc() without checking for allocation failure, which could lead to a NULL pointer dereference. Return -ENOMEM in case allocation fails. Fixes: b47610296d17 ("ACPI: APEI: EINJ: Enable EINJv2 error injections") Signed-off-by: Charles Han Reviewed-by: Tony Luck Reviewed-by: Hanjun Guo Link: https://patch.msgid.link/20250815024207.3038-1-hanchunchao@inspur.com Signed-off-by: Rafael J. Wysocki commit 6c705851499172c0ce863e816946fb5a564ff69f Author: Tony Luck Date: Thu Aug 14 09:17:06 2025 -0700 ACPI: APEI: EINJ: Check if user asked for EINJV2 injection On an EINJV2 capable system, users may still use the old injection interface but einj_get_parameter_address() takes the EINJV2 path to map the parameter structure. This results in the address the user supplied being stored to the wrong location and the BIOS injecting based on an uninitialized field (0x0 in the reported case). Check the version of the request when mapping the EINJ parameter structure in BIOS reserved memory. Fixes: 691a0f0a557b ("ACPI: APEI: EINJ: Discover EINJv2 parameters") Reported-by: Lai, Yi1 Signed-off-by: Tony Luck Reviewed-by: Zaid Alali Reviewed-by: Hanjun Guo Link: https://patch.msgid.link/20250814161706.4489-1-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki commit 074e461d9ed5bbd393a76ae42caa2a5a55add23b Merge: c17b750b3ad9f4 9d98cf46322587 Author: Linus Torvalds Date: Mon Aug 18 09:01:00 2025 -0700 Merge tag 'ext4_for_linus-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 fixes from Ted Ts'o: - Fix fast commit checks for file systems with ea_inode enabled - Don't drop the i_version mount option on a remount - Fix FIEMAP reporting when there are holes in a bigalloc file system - Don't fail when mounting read-only when there are inodes in the orphan file - Fix hole length overflow for indirect mapped files on file systems with an 8k or 16k block file system * tag 'ext4_for_linus-6.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: jbd2: prevent softlockup in jbd2_log_do_checkpoint() ext4: fix incorrect function name in comment ext4: use kmalloc_array() for array space allocation ext4: fix hole length calculation overflow in non-extent inodes ext4: don't try to clear the orphan_present feature block device is r/o ext4: fix reserved gdt blocks handling in fsmap ext4: fix fsmap end of range reporting with bigalloc ext4: remove redundant __GFP_NOWARN ext4: fix unused variable warning in ext4_init_new_dir ext4: remove useless if check ext4: check fast symlink for ea_inode correctly ext4: preserve SB_I_VERSION on remount ext4: show the default enabled i_version option commit 4876b391654142dcf31ac6da619ace357b6b902d Author: Antonino Maniscalco Date: Wed Aug 13 15:04:44 2025 +0200 drm/msm: skip re-emitting IBs for unusable VMs When a VM is marked as an usuable we disallow new submissions from it, however submissions that where already scheduled on the ring would still be re-sent. Since this can lead to further hangs, avoid emitting the actual IBs. Fixes: 6a4d287a1ae6 ("drm/msm: Mark VM as unusable on GPU hangs") Signed-off-by: Antonino Maniscalco Reviewed-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/668314/ Signed-off-by: Rob Clark commit 1ba9fbe40337e448b32e2831a7051191d61f0382 Author: Thomas Weißschuh Date: Mon Aug 11 09:44:42 2025 +0200 drm/msm: Don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/667895/ Signed-off-by: Rob Clark commit e9576e078220c50ace9e9087355423de23e25fa5 Author: Yazen Ghannam Date: Mon Jul 21 18:11:54 2025 +0000 x86/CPU/AMD: Ignore invalid reset reason value The reset reason value may be "all bits set", e.g. 0xFFFFFFFF. This is a commonly used error response from hardware. This may occur due to a real hardware issue or when running in a VM. The user will see all reset reasons reported in this case. Check for an error response value and return early to avoid decoding invalid data. Also, adjust the data variable type to match the hardware register size. Fixes: ab8131028710 ("x86/CPU/AMD: Print the reason for the last reset") Reported-by: Libing He Signed-off-by: Yazen Ghannam Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Mario Limonciello Cc: stable@vger.kernel.org Link: https://lore.kernel.org/20250721181155.3536023-1-yazen.ghannam@amd.com commit 447c6141e8ea68ef4e56c55144fd18f43e6c8dca Author: Alessandro Ratti Date: Fri Aug 15 17:37:26 2025 +0200 iommufd: Fix spelling errors in iommufd.rst This patch corrects two minor spelling issues found in Documentation/userspace-api/iommufd.rst: - "primarly" -> "primarily" - "sharable" -> "shareable" Found using codespell(1). Link: https://patch.msgid.link/r/20250815153840.188213-2-alessandro@0x65c.net Signed-off-by: Alessandro Ratti Signed-off-by: Jason Gunthorpe commit 8fe8a092043f28d3c8e467cb2bbfe1e1ccf7f996 Author: Akhilesh Patil Date: Sun Aug 10 19:04:01 2025 +0530 iommufd: viommu: free memory allocated by kvcalloc() using kvfree() Use kvfree() instead of kfree() to free pages allocated by kvcalloc() in iommufs_hw_queue_alloc_phys() to fix potential memory corruption. Ensure the memory is properly freed, as kvcalloc may internally use vmalloc or kmalloc depending on available memory in the system. Fixes: 2238ddc2b056 ("iommufd/viommu: Add IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl") Link: https://patch.msgid.link/r/aJifyVV2PL6WGEs6@bhairav-test.ee.iitb.ac.in Signed-off-by: Akhilesh Patil Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe commit 75dbd4304afe574fcfc4118a5b78776a9f48fdc4 Author: Sungbae Yoo Date: Wed Aug 6 12:47:35 2025 +0000 tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible" Fixes optee_ffa_api_is_compatbile() to optee_ffa_api_is_compatible() because compatbile is a typo of compatible. Fixes: 4615e5a34b95 ("optee: add FF-A support") Signed-off-by: Sungbae Yoo Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 8ea815399c3fcce1889bd951fec25b5b9a3979c1 Author: Jan Beulich Date: Mon Apr 14 16:41:07 2025 +0200 compiler: remove __ADDRESSABLE_ASM{_STR,}() again __ADDRESSABLE_ASM_STR() is where the necessary stringification happens. As long as "sym" doesn't contain any odd characters, no quoting is required for its use with .quad / .long. In fact the quotation gets in the way with gas 2.25; it's only from 2.26 onwards that quoted symbols are half-way properly supported. However, assembly being different from C anyway, drop __ADDRESSABLE_ASM_STR() and its helper macro altogether. A simple .global directive will suffice to get the symbol "declared", i.e. into the symbol table. While there also stop open-coding STATIC_CALL_TRAMP() and STATIC_CALL_KEY(). Fixes: 0ef8047b737d ("x86/static-call: provide a way to do very early static-call updates") Signed-off-by: Jan Beulich Acked-by: Josh Poimboeuf Cc: stable@vger.kernel.org Signed-off-by: Juergen Gross Message-ID: <609d2c74-de13-4fae-ab1a-1ec44afb948d@suse.com> commit 447be50598c05499f7ccc2b1f6ddb3da30f8099a Author: Peng Fan Date: Fri Aug 15 12:52:09 2025 +0800 regulator: pca9450: Use devm_register_sys_off_handler With module test, there is error dump: ------------[ cut here ]------------ notifier callback pca9450_i2c_restart_handler already registered WARNING: kernel/notifier.c:23 at notifier_chain_register+0x5c/0x88, CPU#0: kworker/u16:3/50 Call trace: notifier_chain_register+0x5c/0x88 (P) atomic_notifier_chain_register+0x30/0x58 register_restart_handler+0x1c/0x28 pca9450_i2c_probe+0x418/0x538 i2c_device_probe+0x220/0x3d0 really_probe+0x114/0x410 __driver_probe_device+0xa0/0x150 driver_probe_device+0x40/0x114 __device_attach_driver+0xd4/0x12c So use devm_register_sys_off_handler to let kernel handle the resource free to avoid kernel dump. Fixes: 6157e62b07d9 ("regulator: pca9450: Add restart handler") Signed-off-by: Peng Fan Link: https://patch.msgid.link/20250815-pca9450-v1-1-7748e362dc97@nxp.com Signed-off-by: Mark Brown commit 0227af355b50c526bf83ca52d67aef5d102e9b07 Author: Akhilesh Patil Date: Sun Aug 17 15:06:05 2025 +0530 selftests: ublk: Use ARRAY_SIZE() macro to improve code Use ARRAY_SIZE() macro while calculating size of an array to improve code readability and reduce potential sizing errors. Implement this suggestion given by spatch tool by running coccinelle script - scripts/coccinelle/misc/array_size.cocci Follow ARRAY_SIZE() macro usage pattern in ublk.c introduced by, commit ec120093180b9 ("selftests: ublk: fix ublk_find_tgt()") wherever appropriate to maintain consistency. Signed-off-by: Akhilesh Patil Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/aKGihYui6/Pcijbk@bhairav-test.ee.iitb.ac.in Signed-off-by: Jens Axboe commit e8bd877fb76bb9f35253e8f41ce0c772269934dd Author: Amir Goldstein Date: Mon Aug 18 11:23:55 2025 +0200 ovl: fix possible double unlink commit 9d23967b18c6 ("ovl: simplify an error path in ovl_copy_up_workdir()") introduced the helper ovl_cleanup_unlocked(), which is later used in several following patches to re-acquire the parent inode lock and unlink a dentry that was earlier found using lookup. This helper was eventually renamed to ovl_cleanup(). The helper ovl_parent_lock() is used to re-acquire the parent inode lock. After acquiring the parent inode lock, the helper verifies that the dentry has not since been moved to another parent, but it failed to verify that the dentry wasn't unlinked from the parent. This means that now every call to ovl_cleanup() could potentially race with another thread, unlinking the dentry to be cleaned up underneath overlayfs and trigger a vfs assertion. Reported-by: syzbot+ec9fab8b7f0386b98a17@syzkaller.appspotmail.com Tested-by: syzbot+ec9fab8b7f0386b98a17@syzkaller.appspotmail.com Fixes: 9d23967b18c6 ("ovl: simplify an error path in ovl_copy_up_workdir()") Suggested-by: NeilBrown Signed-off-by: Amir Goldstein commit 5f1c8965e748c150d580a2ea8fbee1bd80d07a24 Author: NeilBrown Date: Mon Aug 4 22:11:28 2025 +1000 ovl: use I_MUTEX_PARENT when locking parent in ovl_create_temp() ovl_create_temp() treats "workdir" as a parent in which it creates an object so it should use I_MUTEX_PARENT. Prior to the commit identified below the lock was taken by the caller which sometimes used I_MUTEX_PARENT and sometimes used I_MUTEX_NORMAL. The use of I_MUTEX_NORMAL was incorrect but unfortunately copied into ovl_create_temp(). Note to backporters: This patch only applies after the last Fixes given below (post v6.16). To fix the bug in v6.7 and later the inode_lock() call in ovl_copy_up_workdir() needs to nest using I_MUTEX_PARENT. Link: https://lore.kernel.org/all/67a72070.050a0220.3d72c.0022.GAE@google.com/ Cc: stable@vger.kernel.org Reported-by: syzbot+7836a68852a10ec3d790@syzkaller.appspotmail.com Tested-by: syzbot+7836a68852a10ec3d790@syzkaller.appspotmail.com Fixes: c63e56a4a652 ("ovl: do not open/llseek lower file with upper sb_writers held") Fixes: d2c995581c7c ("ovl: Call ovl_create_temp() without lock held.") Signed-off-by: NeilBrown Signed-off-by: Amir Goldstein commit 89f0addeee3cb2dc49837599330ed9c4612f05b0 Author: Dan Carpenter Date: Mon Aug 18 12:59:45 2025 +0300 ALSA: usb-audio: Fix size validation in convert_chmap_v3() The "p" pointer is void so sizeof(*p) is 1. The intent was to check sizeof(*cs_desc), which is 3, instead. Fixes: ecfd41166b72 ("ALSA: usb-audio: Validate UAC3 cluster segment descriptors") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aKL5kftC1qGt6lpv@stanley.mountain Signed-off-by: Takashi Iwai commit d8df126349dad855cdfedd6bbf315bad2e901c2f Author: Tianxiang Peng Date: Mon Jun 23 17:31:53 2025 +0800 x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper Since 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") resctrl_cpu_detect() has been moved from common CPU initialization code to the vendor-specific BSP init helper, while Hygon didn't put that call in their code. This triggers a division by zero fault during early booting stage on our machines with X86_FEATURE_CQM* supported, where get_rdt_mon_resources() tries to calculate mon_l3_config with uninitialized boot_cpu_data.x86_cache_occ_scale. Add the missing resctrl_cpu_detect() in the Hygon BSP init helper. [ bp: Massage commit message. ] Fixes: 923f3a2b48bd ("x86/resctrl: Query LLC monitoring properties once during boot") Signed-off-by: Tianxiang Peng Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Hui Li Cc: Link: https://lore.kernel.org/20250623093153.3016937-1-txpeng@tencent.com commit 99d7ab8db9d8230b243f5ed20ba0229e54cc0dfa Author: Jiayi Li Date: Mon Aug 4 09:36:04 2025 +0800 memstick: Fix deadlock by moving removing flag earlier The existing memstick core patch: commit 62c59a8786e6 ("memstick: Skip allocating card when removing host") sets host->removing in memstick_remove_host(),but still exists a critical time window where memstick_check can run after host->eject is set but before removing is set. In the rtsx_usb_ms driver, the problematic sequence is: rtsx_usb_ms_drv_remove: memstick_check: host->eject = true cancel_work_sync(handle_req) if(!host->removing) ... memstick_alloc_card() memstick_set_rw_addr() memstick_new_req() rtsx_usb_ms_request() if(!host->eject) skip schedule_work wait_for_completion() memstick_remove_host: [blocks indefinitely] host->removing = true flush_workqueue() [block] 1. rtsx_usb_ms_drv_remove sets host->eject = true 2. cancel_work_sync(&host->handle_req) runs 3. memstick_check work may be executed here <-- danger window 4. memstick_remove_host sets removing = 1 During this window (step 3), memstick_check calls memstick_alloc_card, which may indefinitely waiting for mrq_complete completion that will never occur because rtsx_usb_ms_request sees eject=true and skips scheduling work, memstick_set_rw_addr waits forever for completion. This causes a deadlock when memstick_remove_host tries to flush_workqueue, waiting for memstick_check to complete, while memstick_check is blocked waiting for mrq_complete completion. Fix this by setting removing=true at the start of rtsx_usb_ms_drv_remove, before any work cancellation. This ensures memstick_check will see the removing flag immediately and exit early, avoiding the deadlock. Fixes: 62c59a8786e6 ("memstick: Skip allocating card when removing host") Signed-off-by: Jiayi Li Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250804013604.1311218-1-lijiayi@kylinos.cn Signed-off-by: Ulf Hansson commit e251709aaddb3ee1e8ac1ed5e361a608a1cc92de Author: Sai Krishna Potthuri Date: Wed Jul 30 11:35:43 2025 +0530 mmc: sdhci-of-arasan: Ensure CD logic stabilization before power-up During SD suspend/resume without a full card rescan (when using non-removable SD cards for rootfs), the SD card initialization may fail after resume. This occurs because, after a host controller reset, the card detect logic may take time to stabilize due to debounce logic. Without waiting for stabilization, the host may attempt powering up the card prematurely, leading to command timeouts during resume flow. Add sdhci_arasan_set_power_and_bus_voltage() to wait for the card detect stable bit before power up the card. Since the stabilization time is not fixed, a maximum timeout of one second is used to ensure sufficient wait time for the card detect signal to stabilize. Signed-off-by: Sai Krishna Potthuri Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250730060543.1735971-1-sai.krishna.potthuri@amd.com Signed-off-by: Ulf Hansson commit 340be332e420ed37d15d4169a1b4174e912ad6cb Author: Victor Shih Date: Thu Jul 31 14:57:52 2025 +0800 mmc: sdhci-pci-gli: GL9763e: Mask the replay timer timeout of AER Due to a flaw in the hardware design, the GL9763e replay timer frequently times out when ASPM is enabled. As a result, the warning messages will often appear in the system log when the system accesses the GL9763e PCI config. Therefore, the replay timer timeout must be masked. Signed-off-by: Victor Shih Fixes: 1ae1d2d6e555 ("mmc: sdhci-pci-gli: Add Genesys Logic GL9763E support") Cc: stable@vger.kernel.org Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250731065752.450231-4-victorshihgli@gmail.com Signed-off-by: Ulf Hansson commit 293ed0f5f34e1e9df888456af4b0a021f57b5f54 Author: Victor Shih Date: Thu Jul 31 14:57:51 2025 +0800 mmc: sdhci-pci-gli: GL9763e: Rename the gli_set_gl9763e() for consistency In preparation to fix replay timer timeout, rename the gli_set_gl9763e() to gl9763e_hw_setting() for consistency. Signed-off-by: Victor Shih Fixes: 1ae1d2d6e555 ("mmc: sdhci-pci-gli: Add Genesys Logic GL9763E support") Cc: stable@vger.kernel.org Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250731065752.450231-3-victorshihgli@gmail.com Signed-off-by: Ulf Hansson commit dec8b38be4b35cae5f7fa086daf2631e2cfa09c1 Author: Victor Shih Date: Thu Jul 31 14:57:50 2025 +0800 mmc: sdhci-pci-gli: Add a new function to simplify the code In preparation to fix replay timer timeout, add sdhci_gli_mask_replay_timer_timeout() function to simplify some of the code, allowing it to be re-used. Signed-off-by: Victor Shih Fixes: 1ae1d2d6e555 ("mmc: sdhci-pci-gli: Add Genesys Logic GL9763E support") Cc: stable@vger.kernel.org Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250731065752.450231-2-victorshihgli@gmail.com Signed-off-by: Ulf Hansson commit c0ed3c2edc7692c6b8af7578b41012694dc8c671 Author: Shenghao Ding Date: Sat Aug 16 12:27:41 2025 +0800 ALSA: hda/tas2781: Add name prefix tas2781 for tas2781's dvc_tlv and amp_vol_tlv With some new devices adding into the driver, dvc_tlv and amp_vol_tlv will cause confusion for customers on which devices they support. Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver") Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20250816042741.1659-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai commit bd7c2312128e31d056d30d34d60503de056e15f0 Author: Alexey Gladkov Date: Thu Aug 14 15:07:13 2025 +0200 pinctrl: meson: Fix typo in device table macro The typo when using the MODULE_DEVICE_TABLE macro was not noticeable because the macro was defined only if the module was built as a separate module. Cc: Xianwei Zhao Cc: Linus Walleij Cc: Neil Armstrong Cc: Kevin Hilman Cc: linux-amlogic@lists.infradead.org Cc: linux-gpio@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507220009.8HKbNP16-lkp@intel.com/ Signed-off-by: Alexey Gladkov Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/e548b7761302defec15aa2098172eabb1ce1ad4a.1755170493.git.legion@kernel.org Signed-off-by: Linus Walleij commit 6f6fbd9a0c5a75eee0618c1499cf73cc770b3f52 Author: Sakari Ailus Date: Wed Jul 9 22:53:48 2025 +0300 media: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Reviewed-by: Laurent Pinchart Acked-by: Thierry Reding (tegra-vde/h264.c) Acked-by: Tommaso Merciai (alvium-csi2.c) Reviewed-by: Dikshita Agarwal (iris_hfi_queue.c) Reviewed-by: Sean Young Acked-by: Dave Stevenson (imx219.c) Acked-by: Benjamin Mugnier Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit a032fe30cf09b6723ab61a05aee057311b00f9e1 Author: Dongcheng Yan Date: Fri Apr 25 18:43:30 2025 +0800 platform/x86: int3472: add hpd pin support Typically HDMI to MIPI CSI-2 bridges have a pin to signal image data is being received. On the host side this is wired to a GPIO for polling or interrupts. This includes the Lontium HDMI to MIPI CSI-2 bridges lt6911uxe and lt6911uxc. The GPIO "hpd" is used already by other HDMI to CSI-2 bridges, use it here as well. Signed-off-by: Dongcheng Yan Reviewed-by: Sakari Ailus Acked-by: Ilpo Järvinen Reviewed-by: Hans de Goede Reviewed-by: Andy Shevchenko Fixes: 20244cbafbd6 ("media: i2c: change lt6911uxe irq_gpio name to "hpd"") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit da3fa08a89dc1cb33ed57d097239b9c7cd9e7a60 Author: Sakari Ailus Date: Mon Aug 11 11:00:19 2025 -0400 media: rkvdec: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Reviewed-by: Nicolas Dufresne Reviewed-by: Heiko Stuebner Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 0d58a72b66ec4c24128395e408348c2c84221605 Author: Christophe JAILLET Date: Wed Jul 30 20:24:44 2025 +0200 media: rkvdec: Fix an error handling path in rkvdec_probe() If an error occurs after a successful iommu_paging_domain_alloc() call, it should be undone by a corresponding iommu_domain_free() call, as already done in the remove function. In order to fix the issue, move the corresponding call at the end of the function, because it is safe to allocate 'empty_domain' later. Fixes: ff8c5622f9f7 ("media: rkvdec: Restore iommu addresses on errors") Signed-off-by: Christophe JAILLET Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 6347dc7fb967521a77f9ff0774d25ef0cca4c6cd Author: Dan Carpenter Date: Mon Aug 11 10:18:07 2025 -0400 media: rkvdec: Fix a NULL vs IS_ERR() bug in probe() The iommu_paging_domain_alloc() function doesn't return NULL on error it returns error pointers. Update the check and then set ->empty_domain to NULL because the rest of the driver assumes it can be NULL. Fixes: ff8c5622f9f7 ("media: rkvdec: Restore iommu addresses on errors") Signed-off-by: Dan Carpenter Tested-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit f63aaf6e71de897954fbde4e4a17a9dcdbe5e7e1 Author: Geert Uytterhoeven Date: Wed Aug 13 10:20:22 2025 +0200 clk: renesas: mstp: Add genpd OF provider at postcore_initcall() Genpd OF providers must now be registered after genpd bus registration. However, cpg_mstp_add_clk_domain() is only called from CLK_OF_DECLARE(), which is too early. Hence on R-Car M1A, R-Car H1, and RZ/A1, the CPG/MSTP Clock Domain fails to register, and any devices residing in that clock domain fail to probe. Fix this by splitting initialization into two steps: - The first part keeps on registering the PM domain with genpd at CLK_OF_DECLARE(), - The second and new part moves the registration of the genpd OF provider to a postcore_initcall(). See also commit c5ae5a0c61120d0c ("pmdomain: renesas: rcar-sysc: Add genpd OF provider at postcore_initcall"). Fixes: 18a3a510ecfd0e50 ("pmdomain: core: Add the genpd->dev to the genpd provider bus") Signed-off-by: Geert Uytterhoeven Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/81ef5f8d5d31374b7852b05453c52d2f735062a2.1755073087.git.geert+renesas@glider.be commit d7fa5754e83cd36c4327eb2d806064e598a72ff6 Author: Imre Deak Date: Mon Aug 11 11:01:52 2025 +0300 drm/i915/icl+/tc: Convert AUX powered WARN to a debug message The BIOS can leave the AUX power well enabled on an output, even if this isn't required (on platforms where the AUX power is only needed for an AUX access). This was observed at least on PTL. To avoid the WARN which would be triggered by this during the HW readout, convert the WARN to a debug message. Cc: stable@vger.kernel.org # v6.8+ Reported-by: Charlton Lin Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250811080152.906216-6-imre.deak@intel.com (cherry picked from commit 6cb52cba474b2bec1a3018d3dbf75292059a29a1) Signed-off-by: Tvrtko Ursulin commit c5c2b4b3841666be3a45346d0ffa96b4b143504e Author: Imre Deak Date: Mon Aug 11 11:01:51 2025 +0300 drm/i915/lnl+/tc: Use the cached max lane count value Use the cached max lane count value on LNL+, to account for scenarios where this value is queried after the HW cleared the corresponding pin assignment value in the TCSS_DDI_STATUS register after the sink got disconnected. For consistency, follow-up changes will use the cached max lane count value on other platforms as well and will also cache the pin assignment value in a similar way. Cc: stable@vger.kernel.org # v6.8+ Reported-by: Charlton Lin Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250811080152.906216-5-imre.deak@intel.com (cherry picked from commit afc4e84388079f4d5ba05271632b7a4d8d85165c) Signed-off-by: Tvrtko Ursulin commit c87514a0bb0a64507412a2d98264060dc0c1562a Author: Imre Deak Date: Mon Aug 11 11:01:50 2025 +0300 drm/i915/lnl+/tc: Fix max lane count HW readout On LNL+ for a disconnected sink the pin assignment value gets cleared by the HW/FW as soon as the sink gets disconnected, even if the PHY ownership got acquired already by the BIOS/driver (and hence the PHY itself is still connected and used by the display). During HW readout this can result in detecting the PHY's max lane count as 0 - matching the above cleared aka NONE pin assignment HW state. For a connected PHY the driver in general (outside of intel_tc.c) expects the max lane count value to be valid for the video mode enabled on the corresponding output (1, 2 or 4). Ensure this by setting the max lane count to 4 in this case. Note, that it doesn't matter if this lane count happened to be more than the max lane count with which the PHY got connected and enabled, since the only thing the driver can do with such an output - where the DP-alt sink is disconnected - is to disable the output. v2: Rebased on change reading out the pin configuration only if the PHY is connected. Cc: stable@vger.kernel.org # v6.8+ Reported-by: Charlton Lin Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250811080152.906216-4-imre.deak@intel.com (cherry picked from commit 33cf70bc0fe760224f892bc1854a33665f27d482) Signed-off-by: Tvrtko Ursulin commit 5fd35236546abe780eaadb7561e09953719d4fc3 Author: Imre Deak Date: Mon Aug 11 11:01:49 2025 +0300 drm/i915/icl+/tc: Cache the max lane count value The PHY's pin assignment value in the TCSS_DDI_STATUS register - as set by the HW/FW based on the connected DP-alt sink's TypeC/PD pin assignment negotiation - gets cleared by the HW/FW on LNL+ as soon as the sink gets disconnected, even if the PHY ownership got acquired already by the driver (and hence the PHY itself is still connected and used by the display). This is similar to how the PHY Ready flag gets cleared on LNL+ in the same register. To be able to query the max lane count value on LNL+ - which is based on the above pin assignment - at all times even after the sink gets disconnected, the max lane count must be determined and cached during the PHY's HW readout and connect sequences. Do that here, leaving the actual use of the cached value to a follow-up change. v2: Don't read out the pin configuration if the PHY is disconnected. Cc: stable@vger.kernel.org # v6.8+ Reported-by: Charlton Lin Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250811080152.906216-3-imre.deak@intel.com (cherry picked from commit 3e32438fc406761f81b1928d210b3d2a5e7501a0) Signed-off-by: Tvrtko Ursulin commit f52d6aa98379842fc255d93282655566f2114e0c Author: Imre Deak Date: Mon Aug 11 11:01:48 2025 +0300 drm/i915/lnl+/tc: Fix handling of an enabled/disconnected dp-alt sink The TypeC PHY HW readout during driver loading and system resume determines which TypeC mode the PHY is in (legacy/DP-alt/TBT-alt) and whether the PHY is connected, based on the PHY's Owned and Ready flags. For the PHY to be in DP-alt or legacy mode and for the PHY to be in the connected state in these modes, both the Owned (set by the BIOS/driver) and the Ready (set by the HW) flags should be set. On ICL-MTL the HW kept the PHY's Ready flag set after the driver connected the PHY by acquiring the PHY ownership (by setting the Owned flag), until the driver disconnected the PHY by releasing the PHY ownership (by clearing the Owned flag). On LNL+ this has changed, in that the HW clears the Ready flag as soon as the sink gets disconnected, even if the PHY ownership was acquired already and hence the PHY is being used by the display. When inheriting the HW state from BIOS for a PHY connected in DP-alt mode on which the sink got disconnected - i.e. in a case where the sink was connected while BIOS/GOP was running and so the sink got enabled connecting the PHY, but the user disconnected the sink by the time the driver loaded - the PHY Owned but not Ready state must be accounted for on LNL+ according to the above. Do that by assuming on LNL+ that the PHY is connected in DP-alt mode whenever the PHY Owned flag is set, regardless of the PHY Ready flag. This fixes a problem on LNL+, where the PHY TypeC mode / connected state was detected incorrectly for a DP-alt sink, which got connected and then disconnected by the user in the above way. v2: Rename tc_phy_in_legacy_or_dp_alt_mode() to tc_phy_owned_by_display(). (Luca, Jani) Cc: Jani Nikula Cc: stable@vger.kernel.org # v6.8+ Reported-by: Charlton Lin Tested-by: Khaled Almahallawy Reviewed-by: Mika Kahola Reviewed-by: Luca Coelho [Imre: Add one-liner function documentation for tc_phy_owned_by_display()] Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250811080152.906216-2-imre.deak@intel.com (cherry picked from commit 89f4b196ee4b056e0e8c179b247b29d4a71a4e7e) Signed-off-by: Tvrtko Ursulin commit 89bb430f621124af39bb31763c4a8b504c9651e2 Author: Ziyan Xu Date: Sat Aug 16 10:20:05 2025 +0900 ksmbd: fix refcount leak causing resource not released When ksmbd_conn_releasing(opinfo->conn) returns true,the refcount was not decremented properly, causing a refcount leak that prevents the count from reaching zero and the memory from being released. Cc: stable@vger.kernel.org Signed-off-by: Ziyan Xu Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit c0d41112f1a5828c194b59cca953114bc3776ef2 Author: Namjae Jeon Date: Sun Aug 17 09:48:40 2025 +0900 ksmbd: extend the connection limiting mechanism to support IPv6 Update the connection tracking logic to handle both IPv4 and IPv6 address families. Cc: stable@vger.kernel.org Fixes: e6bb91939740 ("ksmbd: limit repeated connections from clients with the same IP") Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit bac7b996d42e458a94578f4227795a0d4deef6fa Author: Stefan Metzmacher Date: Tue Aug 12 18:45:46 2025 +0200 smb: server: split ksmbd_rdma_stop_listening() out of ksmbd_rdma_destroy() We can't call destroy_workqueue(smb_direct_wq); before stop_sessions()! Otherwise already existing connections try to use smb_direct_wq as a NULL pointer. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit c17b750b3ad9f45f2b6f7e6f7f4679844244f0b9 Author: Linus Torvalds Date: Sun Aug 17 15:22:10 2025 -0700 Linux 6.17-rc2 commit 3271faf42d135bcf569c3ff6af55c21858eec212 Author: Baihan Li Date: Wed Aug 13 17:42:34 2025 +0800 drm/hisilicon/hibmc: fix dp and vga cannot show together If VGA and DP connected together, there will be only one can get crtc. Add encoder possible_clones to support two connectors enable. Fixes: 3c7623fb5bb6 ("drm/hisilicon/hibmc: Enable this hot plug detect of irq feature") Signed-off-by: Baihan Li Signed-off-by: Yongbang Shi Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250813094238.3722345-8-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov commit 9f98b429ba67d430b873e06bcfb90afa22888978 Author: Baihan Li Date: Wed Aug 13 17:42:32 2025 +0800 drm/hisilicon/hibmc: fix rare monitors cannot display problem In some case, the dp link training success at 8.1Gbps, but the sink's maximum supported rate is less than 8.1G. So change the default 8.1Gbps link rate to the rate that reads from devices' capabilities. Fixes: 54063d86e036 ("drm/hisilicon/hibmc: add dp link moduel in hibmc drivers") Signed-off-by: Baihan Li Signed-off-by: Yongbang Shi Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250813094238.3722345-6-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov commit 93a08f856fcc5aaeeecad01f71bef3088588216a Author: Baihan Li Date: Wed Aug 13 17:42:31 2025 +0800 drm/hisilicon/hibmc: fix the hibmc loaded failed bug When hibmc loaded failed, the driver use hibmc_unload to free the resource, but the mutexes in mode.config are not init, which will access an NULL pointer. Just change goto statement to return, because hibnc_hw_init() doesn't need to free anything. Fixes: b3df5e65cc03 ("drm/hibmc: Drop drm_vblank_cleanup") Signed-off-by: Baihan Li Signed-off-by: Yongbang Shi Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250813094238.3722345-5-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov commit 8bed4ec42a4e0dc8113172696ff076d1eb6d8bcb Author: Baihan Li Date: Wed Aug 13 17:42:30 2025 +0800 drm/hisilicon/hibmc: fix irq_request()'s irq name variable is local The local variable is passed in request_irq (), and there will be use after free problem, which will make request_irq failed. Using the global irq name instead of it to fix. Fixes: b11bc1ae4658 ("drm/hisilicon/hibmc: Add MSI irq getting and requesting for HPD") Signed-off-by: Baihan Li Signed-off-by: Yongbang Shi Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250813094238.3722345-4-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov commit e5f48bfa2ae0806d5f51fb8061afc619a73599a7 Author: Baihan Li Date: Wed Aug 13 17:42:28 2025 +0800 drm/hisilicon/hibmc: fix the i2c device resource leak when vdac init failed Currently the driver missed to clean the i2c adapter when vdac init failed. It may cause resource leak. Fixes: a0d078d06e516 ("drm/hisilicon: Features to support reading resolutions from EDID") Signed-off-by: Baihan Li Signed-off-by: Yongbang Shi Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250813094238.3722345-2-shiyongbang@huawei.com Signed-off-by: Dmitry Baryshkov commit 8d561baae505bab6b3f133e10dc48e27e4505cbe Merge: 0a9ee9ce49a66b ed6c4b657bca3b Author: Linus Torvalds Date: Sun Aug 17 06:53:15 2025 -0700 Merge tag 'x86_urgent_for_v6.17_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Remove a transitional asm/cpuid.h header which was added only as a fallback during cpuid helpers reorg - Initialize reserved fields in the SVSM page validation calls structure to zero in order to allow for future structure extensions - Have the sev-guest driver's buffers used in encryption operations be in linear mapping space as the encryption operation can be offloaded to an accelerator - Have a read-only MSR write when in an AMD SNP guest trap to the hypervisor as it is usually done. This makes the guest user experience better by simply raising a #GP instead of terminating said guest - Do not output AVX512 elapsed time for kernel threads because the data is wrong and fix a NULL pointer dereferencing in the process - Adjust the SRSO mitigation selection to the new attack vectors * tag 'x86_urgent_for_v6.17_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/cpuid: Remove transitional header x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero virt: sev-guest: Satisfy linear mapping requirement in get_derived_key() x86/sev: Improve handling of writes to intercepted TSC MSRs x86/fpu: Fix NULL dereference in avx512_status() x86/bugs: Select best SRSO mitigation commit 0a9ee9ce49a66bfdf12e34130b45fafe170dfc84 Merge: 99bade344cfa15 21924af67d69d7 Author: Linus Torvalds Date: Sun Aug 17 05:57:47 2025 -0700 Merge tag 'locking_urgent_for_v6.17_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fixes from Borislav Petkov: - Make sure sanity checks down in the mutex lock path happen on the correct type of task so that they don't trigger falsely - Use the write unsafe user access pairs when writing a futex value to prevent an error on PowerPC which does user read and write accesses differently * tag 'locking_urgent_for_v6.17_rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: locking: Fix __clear_task_blocked_on() warning from __ww_mutex_wound() path futex: Use user_write_access_begin/_end() in futex_put_value() commit cfd956dcb101aa3d25bac321fae923323a47c607 Author: Fabian Vogt Date: Fri Aug 15 13:33:28 2025 +0200 tty: hvc_console: Call hvc_kick in hvc_write unconditionally After hvc_write completes, call hvc_kick also in the case the output buffer has been drained, to ensure tty_wakeup gets called. This fixes that functions which wait for a drained buffer got stuck occasionally. Cc: stable Closes: https://bugzilla.opensuse.org/show_bug.cgi?id=1230062 Signed-off-by: Fabian Vogt Link: https://lore.kernel.org/r/2011735.PYKUYFuaPT@fvogt-thinkpad Signed-off-by: Greg Kroah-Hartman commit 3a68841d1d9b6eb32b2652bbb83acd17d5eb9135 Author: Willy Tarreau Date: Thu Aug 14 21:27:30 2025 +0200 Documentation: smooth the text flow in the security bug reporting process The text was presenting the team, the the e-mail address, then some of the expectations, then what form of e-mail is expected. By switching the e-mail paragraph two paragraphs later and dropping the "Contact" sub-section, we can have a more natural flow that presents the team, then its expectation, then how to best contribute, then where to send. And more importantly, it increases the chances that reporters have read the prerequisites before finding the e-mail address. Signed-off-by: Willy Tarreau Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250814192730.19252-2-w@1wt.eu Signed-off-by: Greg Kroah-Hartman commit d49172bbd7eb07e4ba5e52238eaa9caf692c1cea Author: Willy Tarreau Date: Thu Aug 14 21:27:29 2025 +0200 Documentation: clarify the expected collaboration with security bugs reporters Some bug reports sent to the security team sometimes lack any explanation, are only AI-generated without verification, or sometimes it can simply be difficult to have a conversation with an invisible reporter belonging to an opaque team. This fortunately remains rare but the trend has been steadily increasing over the last years and it seems important to clarify what developers expect from reporters to avoid frustration on any side and keep the process efficient. Signed-off-by: Willy Tarreau Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250814192730.19252-1-w@1wt.eu Signed-off-by: Greg Kroah-Hartman commit ba6cc29351b1fa0cb9adce91b88b9f3c3cbe9c46 Author: Charalampos Mitrodimas Date: Sat Aug 16 14:14:37 2025 +0000 debugfs: fix mount options not being applied Mount options (uid, gid, mode) are silently ignored when debugfs is mounted. This is a regression introduced during the conversion to the new mount API. When the mount API conversion was done, the parsed options were never applied to the superblock when it was reused. As a result, the mount options were ignored when debugfs was mounted. Fix this by following the same pattern as the tracefs fix in commit e4d32142d1de ("tracing: Fix tracefs mount options"). Call debugfs_reconfigure() in debugfs_get_tree() to apply the mount options to the superblock after it has been created or reused. As an example, with the bug the "mode" mount option is ignored: $ mount -o mode=0666 -t debugfs debugfs /tmp/debugfs_test $ mount | grep debugfs_test debugfs on /tmp/debugfs_test type debugfs (rw,relatime) $ ls -ld /tmp/debugfs_test drwx------ 25 root root 0 Aug 4 14:16 /tmp/debugfs_test With the fix applied, it works as expected: $ mount -o mode=0666 -t debugfs debugfs /tmp/debugfs_test $ mount | grep debugfs_test debugfs on /tmp/debugfs_test type debugfs (rw,relatime,mode=666) $ ls -ld /tmp/debugfs_test drw-rw-rw- 37 root root 0 Aug 2 17:28 /tmp/debugfs_test Fixes: a20971c18752 ("vfs: Convert debugfs to use the new mount API") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220406 Cc: stable Reviewed-by: Eric Sandeen Signed-off-by: Charalampos Mitrodimas Link: https://lore.kernel.org/r/20250816-debugfs-mount-opts-v3-1-d271dad57b5b@posteo.net Signed-off-by: Greg Kroah-Hartman commit a381c6d6f646226924809d0ad01a9465786da463 Author: Amit Sunil Dhamne Date: Fri Aug 15 11:31:52 2025 -0700 usb: typec: maxim_contaminant: re-enable cc toggle if cc is open and port is clean Presently in `max_contaminant_is_contaminant()` if there's no contaminant detected previously, CC is open & stopped toggling and no contaminant is currently present, TCPC.RC would be programmed to do DRP toggling. However, it didn't actively look for a connection. This would lead to Type-C not detect *any* new connections. Hence, in the above situation, re-enable toggling & program TCPC to look for a new connection. Also, return early if TCPC was looking for connection as this indicates TCPC has neither detected a potential connection nor a change in contaminant state. In addition, once dry detection is complete (port is dry), restart toggling. Fixes: 02b332a06397e ("usb: typec: maxim_contaminant: Implement check_contaminant callback") Cc: stable Signed-off-by: Amit Sunil Dhamne Reviewed-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20250815-fix-upstream-contaminant-v2-2-6c8d6c3adafb@google.com Signed-off-by: Greg Kroah-Hartman commit cabb6c5f4d9e7f49bdf8c0a13c74bd93ee35f45a Author: Amit Sunil Dhamne Date: Fri Aug 15 11:31:51 2025 -0700 usb: typec: maxim_contaminant: disable low power mode when reading comparator values Low power mode is enabled when reading CC resistance as part of `max_contaminant_read_resistance_kohm()` and left in that state. However, it's supposed to work with 1uA current source. To read CC comparator values current source is changed to 80uA. This causes a storm of CC interrupts as it (falsely) detects a potential contaminant. To prevent this, disable low power mode current sourcing before reading comparator values. Fixes: 02b332a06397 ("usb: typec: maxim_contaminant: Implement check_contaminant callback") Cc: stable Signed-off-by: Amit Sunil Dhamne Reviewed-by: Badhri Jagan Sridharan Rule: add Link: https://lore.kernel.org/stable/20250814-fix-upstream-contaminant-v1-1-801ce8089031%40google.com Link: https://lore.kernel.org/r/20250815-fix-upstream-contaminant-v2-1-6c8d6c3adafb@google.com Signed-off-by: Greg Kroah-Hartman commit 45eae113dccaf8e502090ecf5b3d9e9b805add6f Author: Selvarasu Ganesan Date: Fri Aug 8 18:23:05 2025 +0530 usb: dwc3: Remove WARN_ON for device endpoint command timeouts This commit addresses a rarely observed endpoint command timeout which causes kernel panic due to warn when 'panic_on_warn' is enabled and unnecessary call trace prints when 'panic_on_warn' is disabled. It is seen during fast software-controlled connect/disconnect testcases. The following is one such endpoint command timeout that we observed: 1. Connect ======= ->dwc3_thread_interrupt ->dwc3_ep0_interrupt ->configfs_composite_setup ->composite_setup ->usb_ep_queue ->dwc3_gadget_ep0_queue ->__dwc3_gadget_ep0_queue ->__dwc3_ep0_do_control_data ->dwc3_send_gadget_ep_cmd 2. Disconnect ========== ->dwc3_thread_interrupt ->dwc3_gadget_disconnect_interrupt ->dwc3_ep0_reset_state ->dwc3_ep0_end_control_data ->dwc3_send_gadget_ep_cmd In the issue scenario, in Exynos platforms, we observed that control transfers for the previous connect have not yet been completed and end transfer command sent as a part of the disconnect sequence and processing of USB_ENDPOINT_HALT feature request from the host timeout. This maybe an expected scenario since the controller is processing EP commands sent as a part of the previous connect. It maybe better to remove WARN_ON in all places where device endpoint commands are sent to avoid unnecessary kernel panic due to warn. Cc: stable Co-developed-by: Akash M Signed-off-by: Akash M Signed-off-by: Selvarasu Ganesan Acked-by: Thinh Nguyen Reviewed-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20250808125315.1607-1-selvarasu.g@samsung.com Signed-off-by: Greg Kroah-Hartman commit a3dc32c635bae0ae569f489e00de0e8f015bfc25 Author: Zenm Chen Date: Thu Aug 14 00:24:15 2025 +0800 USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles Many Realtek USB Wi-Fi dongles released in recent years have two modes: one is driver CD mode which has Windows driver onboard, another one is Wi-Fi mode. Add the US_FL_IGNORE_DEVICE quirk for these multi-mode devices. Otherwise, usb_modeswitch may fail to switch them to Wi-Fi mode. Currently there are only two USB IDs known to be used by these multi-mode Wi-Fi dongles: 0bda:1a2b and 0bda:a192. Information about Mercury MW310UH in /sys/kernel/debug/usb/devices. T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 12 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0bda ProdID=a192 Rev= 2.00 S: Manufacturer=Realtek S: Product=DISK C:* #Ifs= 1 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=8a(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Information about D-Link AX9U rev. A1 in /sys/kernel/debug/usb/devices. T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 55 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0bda ProdID=1a2b Rev= 0.00 S: Manufacturer=Realtek S: Product=DISK C:* #Ifs= 1 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable Signed-off-by: Zenm Chen Acked-by: Alan Stern Link: https://lore.kernel.org/r/20250813162415.2630-1-zenmchen@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0f580d5d3d9d9cd0953695cd32e43aac3a946338 Author: Miguel Ojeda Date: Sat Aug 16 22:42:15 2025 +0200 rust: alloc: fix `rusttest` by providing `Cmalloc::aligned_layout` too Commit fde578c86281 ("rust: alloc: replace aligned_size() with Kmalloc::aligned_layout()") provides a public `aligned_layout` function in `Kamlloc`, but not in `Cmalloc`, and thus uses of it will trigger an error in `rusttest`. Such a user appeared in the following commit 22ab0641b939 ("rust: drm: ensure kmalloc() compatible Layout"): error[E0599]: no function or associated item named `aligned_layout` found for struct `alloc::allocator_test::Cmalloc` in the current scope --> rust/kernel/drm/device.rs:100:31 | 100 | let layout = Kmalloc::aligned_layout(Layout::new::()); | ^^^^^^^^^^^^^^ function or associated item not found in `Cmalloc` | ::: rust/kernel/alloc/allocator_test.rs:19:1 | 19 | pub struct Cmalloc; | ------------------ function or associated item `aligned_layout` not found for this struct Thus add an equivalent one for `Cmalloc`. Fixes: fde578c86281 ("rust: alloc: replace aligned_size() with Kmalloc::aligned_layout()") Signed-off-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250816204215.2719559-1-ojeda@kernel.org Signed-off-by: Danilo Krummrich commit 99bade344cfa1577c6dd658e10a3d64b119bddf4 Merge: 90d970cade8e67 252fea131e15ab Author: Linus Torvalds Date: Sat Aug 16 15:49:24 2025 -0700 Merge tag 'rust-fixes-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull rust fixes from Miguel Ojeda: - Workaround 'rustdoc' target modifiers bug in Rust >= 1.88.0. It will be fixed in Rust 1.90.0 (expected 2025-09-18). - Clean 'rustdoc' output before running it to avoid confusing the tool when files from previous versions remain. * tag 'rust-fixes-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: rust: kbuild: clean output before running `rustdoc` rust: workaround `rustdoc` target modifiers bug commit 5eb4b9a4cdbb70d70377fe8fb2920b75910e5024 Author: Thorsten Blum Date: Wed Aug 13 15:21:59 2025 +0200 params: Replace deprecated strcpy() with strscpy() and memcpy() strcpy() is deprecated; use strscpy() and memcpy() instead. In param_set_copystring(), we can safely use memcpy() because we already know the length of the source string 'val' and that it is guaranteed to be NUL-terminated within the first 'kps->maxlen' bytes. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Reviewed-by: Daniel Gomez Reviewed-by: Petr Pavlu Link: https://lore.kernel.org/r/20250813132200.184064-2-thorsten.blum@linux.dev Signed-off-by: Daniel Gomez commit 90d970cade8e67e20b09bbfdc2f0b52064322921 Merge: c5f3e78d35c005 58768b0563916d Author: Linus Torvalds Date: Sat Aug 16 06:59:13 2025 -0700 Merge tag 'ata-ata-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Damien Le Moal: - Fix a regression affecting old IDE/PATA device scan and introduced by the recent link power management cleanups & fixes. The regression prevented devices from being properly detected (me) - Fix command duration limits (CDL) feature control: attempting to enable the feature while NCQ commands are being executed resulted in a silent failure to enable CDL when needed (Igor) * tag 'ata-ata-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-scsi: Fix CDL control ata: libata-eh: Fix link state check for IDE/PATA ports commit 433b99e922943efdfd62b9a8e3ad1604838181f2 Author: Jonathan Cameron Date: Sat Aug 2 17:44:21 2025 +0100 iio: light: as73211: Ensure buffer holes are zeroed Given that the buffer is copied to a kfifo that ultimately user space can read, ensure we zero it. Fixes: 403e5586b52e ("iio: light: as73211: New driver") Reviewed-by: Matti Vaittinen Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250802164436.515988-2-jic23@kernel.org Cc: Signed-off-by: Jonathan Cameron commit c69e13965f26b8058f538ea8bdbd2d7718cf1fbe Author: Claudiu Beznea Date: Sun Aug 10 15:33:28 2025 +0300 iio: adc: rzg2l_adc: Set driver data before enabling runtime PM When stress-testing the system by repeatedly unbinding and binding the ADC device in a loop, and the ADC is a supplier for another device (e.g., a thermal hardware block that reads temperature through the ADC), it may happen that the ADC device is runtime-resumed immediately after runtime PM is enabled, triggered by its consumer. At this point, since drvdata is not yet set and the driver's runtime PM callbacks rely on it, a crash can occur. To avoid this, set drvdata just after it was allocated. Fixes: 89ee8174e8c8 ("iio: adc: rzg2l_adc: Simplify the runtime PM code") Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20250810123328.800104-3-claudiu.beznea.uj@bp.renesas.com Cc: Signed-off-by: Jonathan Cameron commit a3c6eabe3bbd6b0e7124d68b2d3bc32fed17362e Author: Claudiu Beznea Date: Sun Aug 10 15:33:27 2025 +0300 iio: adc: rzg2l: Cleanup suspend/resume path There is no need to manually track the runtime PM status in the driver. The pm_runtime_force_suspend() and pm_runtime_force_resume() functions already call pm_runtime_status_suspended() to check the runtime PM state. Additionally, avoid calling pm_runtime_put_autosuspend() during the suspend/resume path, as this would decrease the usage counter of a potential user that had the ADC open before the suspend/resume cycle. Fixes: 563cf94f9329 ("iio: adc: rzg2l_adc: Add suspend/resume support") Reviewed-by: Ulf Hansson Reviewed-by: Lad Prabhakar Signed-off-by: Claudiu Beznea Link: https://patch.msgid.link/20250810123328.800104-2-claudiu.beznea.uj@bp.renesas.com Cc: Signed-off-by: Jonathan Cameron commit 4a81f78caa53e0633cf311ca1526377d9bff7479 Author: Wentao Liang Date: Mon Jan 20 21:10:06 2025 +0800 pcmcia: Add error handling for add_interval() in do_validate_mem() In the do_validate_mem(), the call to add_interval() does not handle errors. If kmalloc() fails in add_interval(), it could result in a null pointer being inserted into the linked list, leading to illegal memory access when sub_interval() is called next. This patch adds an error handling for the add_interval(). If add_interval() returns an error, the function will return early with the error code. Fixes: 7b4884ca8853 ("pcmcia: validate late-added resources") Signed-off-by: Wentao Liang Signed-off-by: Dominik Brodowski commit 750da5029fd914b647d3063dacdadf56b9a9a046 Author: Dr. David Alan Gilbert Date: Mon Mar 3 01:01:25 2025 +0000 pcmcia: cs: Remove unused pcmcia_get_socket_by_nr The last use of pcmcia_get_socket_by_nr() was removed in 2010 by commit 5716d415f8c5 ("pcmcia: remove obsolete ioctl") Remove it. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Dominik Brodowski commit ecef14f70ec9344a10c817248d2ac6cddee5921e Author: Chen Ni Date: Thu Mar 20 14:39:56 2025 +0800 pcmcia: omap: Add missing check for platform_get_resource Add missing check for platform_get_resource() and return error if it fails to catch the error. Fixes: d87d44f7ab35 ("ARM: omap1: move CF chipselect setup to board file") Signed-off-by: Chen Ni Signed-off-by: Dominik Brodowski commit 9e1ee333631a6d2b5f4ed9449ee2d595b6a87b81 Author: Thorsten Blum Date: Fri Apr 11 10:44:29 2025 +0200 pcmcia: Use str_off_on() and str_yes_no() helpers Remove hard-coded strings by using the str_off_on() and str_yes_no() helper functions. Signed-off-by: Thorsten Blum Signed-off-by: Dominik Brodowski commit 4bf1541e41d0540f9fcce8a32424ab05ae26fdca Author: Lukas Bulwahn Date: Mon Jun 30 11:32:56 2025 +0200 pcmcia: remove PCCARD_IODYN The config PCCARD_IODYN was last used in the config option PCMCIA_M8XX with its m8xx_pcmcia driver. This driver was removed with commit 39eb56da2b53 ("pcmcia: Remove m8xx_pcmcia driver"), included in v3.17, back in 2014. Since then, the config PCCARD_IODYN is unused. Remove the config option, the corresponding file included with this config and the corresponding definition in the pcmcia header file. Signed-off-by: Lukas Bulwahn Signed-off-by: Dominik Brodowski commit ce0e8efb8438469aedb94746603a66e2de91852b Author: Bagas Sanjaya Date: Mon Aug 11 09:04:37 2025 +0700 pcmcia: ds: Emphasize "really" epizeuxis pcmcia_dev_present() comment writes about small timeframe where the function returns NULL (racy condition), in epizeuxis device. In the past, it tripped contributors who misunderstood it for "really" duplicate ([1], [2]). Add comma between "really" words to emphasize the epizeuxis. Link: https://lore.kernel.org/all/YxT1As38WRZcyH0%2F@shine.dominikbrodowski.net/ [1] Link: https://lore.kernel.org/all/20220831083623.GA25639@isilmar-4.linta.de/ [2] Signed-off-by: Bagas Sanjaya Signed-off-by: Dominik Brodowski commit b04e4551893fb8a06106a175ed7055d41a9279c4 Author: David Lechner Date: Mon Aug 11 13:32:31 2025 -0500 iio: adc: ad7380: fix missing max_conversion_rate_hz on adaq4381-4 Add max_conversion_rate_hz to the chip info for "adaq4381-4". Without this, the driver fails to probe because it tries to set the initial sample rate to 0 Hz, which is not valid. Fixes: bbeaec81a03e ("iio: ad7380: add support for SPI offload") Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250811-iio-adc-ad7380-fix-missing-max_conversion_rate_hs-on-ad4381-4-v1-1-ffb728d7a71c@baylibre.com Signed-off-by: Jonathan Cameron commit 44822df89e8f3386871d9cad563ece8e2fd8f0e7 Author: Ma Ke Date: Tue Aug 12 15:25:09 2025 +0800 pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() In __iodyn_find_io_region(), pcmcia_make_resource() is assigned to res and used in pci_bus_alloc_resource(). There is a dereference of res in pci_bus_alloc_resource(), which could lead to a NULL pointer dereference on failure of pcmcia_make_resource(). Fix this bug by adding a check of res. Cc: stable@vger.kernel.org Fixes: 49b1153adfe1 ("pcmcia: move all pcmcia_resource_ops providers into one module") Signed-off-by: Ma Ke Signed-off-by: Dominik Brodowski commit d1dfcdd30140c031ae091868fb5bed084132bca1 Author: Geert Uytterhoeven Date: Wed Aug 13 17:50:14 2025 +0200 pcmcia: omap_cf: Mark driver struct with __refdata to prevent section mismatch As described in the added code comment, a reference to .exit.text is ok for drivers registered via platform_driver_probe(). Make this explicit to prevent the following section mismatch warning WARNING: modpost: drivers/pcmcia/omap_cf: section mismatch in reference: omap_cf_driver+0x4 (section: .data) -> omap_cf_remove (section: .exit.text) that triggers on an omap1_defconfig + CONFIG_OMAP_CF=m build. Signed-off-by: Geert Uytterhoeven Acked-by: Aaro Koskinen Reviewed-by: Uwe Kleine-König Signed-off-by: Dominik Brodowski commit c5f3e78d35c00599673e9ba9f2b641969f8667e4 Merge: dfd4b508c8c610 c6b819e0058e5f Author: Linus Torvalds Date: Sat Aug 16 06:20:49 2025 -0700 Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "One core change removing the 'w' access flag of attributes that don't have a set routine (and therefore can't be written to) which should have no practical impact. The big scsi_debug update is caused by reformatting lots of arrays and the rest of the bug fixes in drivers are trivial" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: ufs: core: Remove error print for devm_add_action_or_reset() scsi: ufs: mediatek: Fix out-of-bounds access in MCQ IRQ mapping scsi: lpfc: Remove redundant assignment to avoid memory leak scsi: lpfc: Fix wrong function reference in a comment scsi: ufs: core: Fix interrupt handling for MCQ Mode scsi: scsi_debug: Make read-only arrays static const scsi: core: sysfs: Correct sysfs attributes access rights commit 8a6ededaad2d2dcaac8e545bffee1073dca9db95 Author: Matti Vaittinen Date: Wed Aug 13 12:16:06 2025 +0300 iio: adc: bd79124: Add GPIOLIB dependency The bd79124 has ADC inputs which can be muxed to be GPIOs. The driver supports this by registering a GPIO-chip for channels which aren't used as ADC. The Kconfig entry does not handle the dependency to GPIOLIB, which causes errors: ERROR: modpost: "devm_gpiochip_add_data_with_key" [drivers/iio/adc/rohm-bd79124.ko] undefined! ERROR: modpost: "gpiochip_get_data" [drivers/iio/adc/rohm-bd79124.ko] undefined! at linking phase if GPIOLIB is not configured to be used. Fix this by adding dependency to the GPIOLIB. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508131533.5sSkq80B-lkp@intel.com/ Fixes: 3f57a3b9ab74 ("iio: adc: Support ROHM BD79124 ADC") Signed-off-by: Matti Vaittinen Reviewed-by: Bartosz Golaszewski Link: https://patch.msgid.link/6837249bddf358924e67566293944506206d2d62.1755076369.git.mazziesaccount@gmail.com Cc: Signed-off-by: Jonathan Cameron commit a44458dfd5bc0c79c6739c3f4c658361d3a5126b Author: Thorsten Blum Date: Wed Aug 21 01:10:28 2024 +0200 accel/habanalabs/gaudi2: Use kvfree() for memory allocated with kvcalloc() Use kvfree() to fix the following Coccinelle/coccicheck warning reported by kfree_mismatch.cocci: WARNING kvmalloc is used to allocate this memory at line 10398 Fixes: f728c17fc97a ("accel/habanalabs/gaudi2: move HMMU page tables to device memory") Reported-by: Qianfeng Rong Closes: https://patch.msgid.link/20250808085530.233737-1-rongqianfeng@vivo.com Signed-off-by: Thorsten Blum [lukas: acknowledge Qianfeng, adjust Thorsten's domain, add Fixes tag] Signed-off-by: Lukas Wunner Reviewed-by: Tomer Tayar Cc: stable@vger.kernel.org # v6.9+ Link: https://patch.msgid.link/20240820231028.136126-1-thorsten.blum@toblux.com commit 39ca24675b7e351b8e681d924f417e455d4a7fc1 Author: Avizrat, Yaron Date: Thu Aug 14 10:44:07 2025 +0000 MAINTAINERS: Change habanalabs maintainers I will be leaving Intel soon, Koby Elbaz & Konstantin Sinyuk will take the role of habanalabs driver maintainers. Signed-off-by: Yaron Avizrat Reviewed-by: Koby Elbaz Reviewed-by: Konstantin Sinyuk Link: https://patch.msgid.link/DM4PR11MB55491ACAA33DF29CEF3C67DAE935A@DM4PR11MB5549.namprd11.prod.outlook.com [lukas: wrap to 72 chars] Signed-off-by: Lukas Wunner commit 715c7a36d59f54162a26fac1d1ed8dc087a24cf1 Author: Jakub Kicinski Date: Thu Aug 14 12:43:23 2025 -0700 selftests: tls: make the new data_steal test less flaky The CI has hit a couple of cases of: RUN global.data_steal ... tls.c:2762:data_steal:Expected recv(cfd, buf2, sizeof(buf2), MSG_DONTWAIT) (20000) == -1 (-1) data_steal: Test terminated by timeout FAIL global.data_steal Looks like the 2msec sleep is not long enough. Make the sleep longer, and then instead of second sleep wait for the thieving process to exit. That way we can be sure it called recv() before us. While at it also avoid trying to steal more than a record, this seems to be causing issues in manual testing as well. Fixes: d7e82594a45c ("selftests: tls: test TCP stealing data from under the TLS socket") Link: https://patch.msgid.link/20250814194323.2014650-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b7ee30f0efd12f42735ae233071015389407966c Author: Zheng Qixing Date: Sat Aug 16 08:25:34 2025 +0800 md: fix sync_action incorrect display during resync During raid resync, if a disk becomes faulty, the operation is briefly interrupted. The MD_RECOVERY_RECOVER flag triggered by the disk failure causes sync_action to incorrectly show "recover" instead of "resync". The same issue affects reshape operations. Reproduction steps: mdadm -Cv /dev/md1 -l1 -n4 -e1.2 /dev/sd{a..d} // -> resync happened mdadm -f /dev/md1 /dev/sda // -> resync interrupted cat sync_action -> recover Add progress checks in md_sync_action() for resync/recover/reshape to ensure the interface correctly reports the actual operation type. Fixes: 4b10a3bc67c1 ("md: ensure resync is prioritized over recovery") Signed-off-by: Zheng Qixing Link: https://lore.kernel.org/linux-raid/20250816002534.1754356-3-zhengqixing@huaweicloud.com Signed-off-by: Yu Kuai commit cb0780ad4333040a98e10f014b593ef738a3f31e Author: Zheng Qixing Date: Sat Aug 16 08:25:33 2025 +0800 md: add helper rdev_needs_recovery() Add a helper for checking if an rdev needs recovery. Signed-off-by: Zheng Qixing Link: https://lore.kernel.org/linux-raid/20250816002534.1754356-2-zhengqixing@huaweicloud.com Signed-off-by: Yu Kuai commit c27973211ffcdf0a092eec265d5993e64b89adaf Author: Xiao Ni Date: Fri Aug 15 12:00:28 2025 +0800 md: keep recovery_cp in mdp_superblock_s commit 907a99c314a5 ("md: rename recovery_cp to resync_offset") replaces recovery_cp with resync_offset in mdp_superblock_s which is in md_p.h. md_p.h is used in userspace too. So mdadm building fails because of this. This patch revert this change. Fixes: 907a99c314a5 ("md: rename recovery_cp to resync_offset") Signed-off-by: Xiao Ni Link: https://lore.kernel.org/linux-raid/20250815040028.18085-1-xni@redhat.com Signed-off-by: Yu Kuai commit 1f403699c40f0806a707a9a6eed3b8904224021a Author: Ma Ke Date: Tue Aug 12 15:19:32 2025 +0800 drm/mediatek: Fix device/node reference count leaks in mtk_drm_get_all_drm_priv Using device_find_child() and of_find_device_by_node() to locate devices could cause an imbalance in the device's reference count. device_find_child() and of_find_device_by_node() both call get_device() to increment the reference count of the found device before returning the pointer. In mtk_drm_get_all_drm_priv(), these references are never released through put_device(), resulting in permanent reference count increments. Additionally, the for_each_child_of_node() iterator fails to release node references in all code paths. This leaks device node references when loop termination occurs before reaching MAX_CRTC. These reference count leaks may prevent device/node resources from being properly released during driver unbind operations. As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use'. Cc: stable@vger.kernel.org Fixes: 1ef7ed48356c ("drm/mediatek: Modify mediatek-drm for mt8195 multi mmsys support") Signed-off-by: Ma Ke Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20250812071932.471730-1-make24@iscas.ac.cn/ Signed-off-by: Chun-Kuang Hu commit dfd4b508c8c6106083698a0dd5e35aecc7c48725 Merge: d0efc9e4276cda 00062ea01d35ea Author: Linus Torvalds Date: Fri Aug 15 14:52:36 2025 -0700 Merge tag 'drm-fixes-2025-08-16' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Relatively quiet week, usual amdgpu/i915/xe fixes along with a set of fixes for fbdev format info, which fix some regressions seen in with rc1. bridge: - fix OF-node leak - fix documentation fbdev-emulation: - pass correct format info to drm_helper_mode_fill_fb_struct() panfrost: - print correct RSS size amdgpu: - PSP fix - VRAM reservation fix - CSA fix - Process kill fix i915: - Fix the implementation of wa_18038517565 [fbc] - Do not trigger Frame Change events from frontbuffer flush [psr] xe: - Some more xe_migrate_access_memory fixes (Auld) - Defer buffer object shrinker write-backs and GPU waits (Thomas) - HWMON fix for clamping limits (Karthik) - SRIOV-PF: Set VF LMEM BAR size (Michal)" * tag 'drm-fixes-2025-08-16' of https://gitlab.freedesktop.org/drm/kernel: drm/xe/pf: Set VF LMEM BAR size drm/amdgpu: fix task hang from failed job submission during process kill drm/amdgpu: fix incorrect vm flags to map bo drm/amdgpu: fix vram reservation issue drm/amdgpu: Add PSP fw version check for fw reserve GFX command drm/xe/hwmon: Add SW clamp for power limits writes drm/xe: Defer buffer object shrinker write-backs and GPU waits drm/xe/migrate: prevent potential UAF drm/xe/migrate: don't overflow max copy size drm/xe/migrate: prevent infinite recursion drm/i915/psr: Do not trigger Frame Change events from frontbuffer flush drm/i915/fbc: fix the implementation of wa_18038517565 drm/panfrost: Print RSS for tiler heap BO's in debugfs GEMS file drm/radeon: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() drm/nouveau: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() drm/omap: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() drm/bridge: document HDMI CEC callbacks drm/bridge: Describe the newly introduced drm_connector parameter for drm_bridge_detect drm/bridge: fix OF node leak commit db2e7bcee11cd57f95fef3c6cbb562d0577eb84a Author: Miguel Ojeda Date: Thu Jul 24 18:54:41 2025 +0200 drm: nova-drm: fix 32-bit arm build In 32-bit arm, the build fails with: error[E0308]: mismatched types --> drivers/gpu/drm/nova/file.rs:42:28 | 42 | getparam.set_value(value); | --------- ^^^^^ expected `u64`, found `u32` | | | arguments to this method are incorrect | note: method defined here --> drivers/gpu/drm/nova/uapi.rs:29:12 | 29 | pub fn set_value(&self, v: u64) { | ^^^^^^^^^ ------ help: you can convert a `u32` to a `u64` | 42 | getparam.set_value(value.into()); | +++++++ The reason is that `Getparam::set_value` takes a `u64` (from the UAPI), but `pci::Device::resource_len()` returns a `resource_size_t`, which is a `phys_addr_t`, which may be 32- or 64-bit. Thus add an `into()` call to support the 32-bit case, while allowing the Clippy lint that complains in the 64-bit case where the type is the same. Fixes: cdeaeb9dd762 ("drm: nova-drm: add initial driver skeleton") Signed-off-by: Miguel Ojeda Reviewed-by: Christian Schrefl Link: https://lore.kernel.org/r/20250724165441.2105632-1-ojeda@kernel.org Signed-off-by: Danilo Krummrich commit d0efc9e4276cda07c2f76652d240b165c30b05b8 Merge: ee94b00c1a6485 f76823e3b284aa Author: Linus Torvalds Date: Fri Aug 15 12:50:12 2025 -0700 Merge tag 'xfs-fixes-6.17-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs fixes from Carlos Maiolino: - Fix an assert trigger introduced during the merge window - Prevent atomic writes to be used with DAX - Prevent users from using the max_atomic_write mount option without reflink, as atomic writes > 1block are not supported without reflink - Fix a null-pointer-deref in a tracepoint * tag 'xfs-fixes-6.17-rc2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: xfs: split xfs_zone_record_blocks xfs: fix scrub trace with null pointer in quotacheck xfs: reject max_atomic_write mount option for no reflink xfs: disallow atomic writes on DAX fs/dax: Reject IOCB_ATOMIC in dax_iomap_rw() xfs: remove XFS_IBULK_SAME_AG xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags xfs: fix frozen file system assert in xfs_trans_alloc commit 12da2b92ad50e6602b4c5e9073d71f2368b70b63 Author: Chandra Mohan Sundar Date: Thu Aug 14 22:00:10 2025 +0530 net: libwx: Fix the size in RSS hash key population While trying to fill a random RSS key, the size of the pointer is being used rather than the actual size of the RSS key. Fix by passing an appropriate value of the RSS key. This issue was reported by static coverity analyser. Fixes: eb4898fde1de8 ("net: libwx: add wangxun vf common api") Signed-off-by: Chandra Mohan Sundar Link: https://patch.msgid.link/20250814163014.613004-1-chandramohan.explore@gmail.com Signed-off-by: Jakub Kicinski commit d19c541d269eddd9702b687fd4ba587c7da497a2 Author: Marc Zyngier Date: Wed Aug 13 17:37:47 2025 +0100 KVM: arm64: Correctly populate FAR_EL2 on nested SEA injection vcpu_write_sys_reg()'s signature is not totally obvious, and it is rather easy to write something that looks correct, except that... Oh wait... Swap addr and FAR_EL2 to restore some sanity in the nested SEA department. Fixes: 9aba641b9ec2a ("KVM: arm64: nv: Respect exception routing rules for SEAs") Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250813163747.2591317-1-maz@kernel.org Signed-off-by: Oliver Upton commit 6cc44e9618f03f1deb9a092698c0b0ce20990221 Author: Javier Garcia Date: Sun Aug 10 17:07:06 2025 +0200 drm: Add directive to format code in comment Add formatting directive line in function `drm_gpuvm_sm_map_exec_lock()` comment to clear warning messages shown bellow that appears generating documentation `make htmldocs`. Warning: ./drivers/gpu/drm/drm_gpuvm.c:2444: Unexpected indentation. Warning: ./drivers/gpu/drm/drm_gpuvm.c:2446: Block quote ends without a blank line; unexpected unindent. Warning: ./drivers/gpu/drm/drm_gpuvm.c:2450: Definition list ends without a blank line; unexpected unindent. Warning: ./drivers/gpu/drm/drm_gpuvm.c:2451: Definition list ends without a blank line; unexpected unindent. Warning: ./drivers/gpu/drm/drm_gpuvm.c:2455: Unexpected indentation. Warning: ./drivers/gpu/drm/drm_gpuvm.c:2456: Definition list ends without a blank line; unexpected unindent. Warning: ./drivers/gpu/drm/drm_gpuvm.c:2457: Definition list ends without a blank line; unexpected unindent. Warning: ./drivers/gpu/drm/drm_gpuvm.c:2458: Definition list ends without a blank line; unexpected unindent. Fixes: 471920ce25d5 ("drm/gpuvm: Add locking helpers") Signed-off-by: Javier Garcia Reviewed-by: Bagas Sanjaya Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250810150706.305040-1-rampxxxx@gmail.com [ Fix typo in commit message. - Danilo ] Signed-off-by: Danilo Krummrich commit 989fe6771266bdb82a815d78802c5aa7c918fdfd Author: Qianfeng Rong Date: Wed Aug 13 20:54:04 2025 +0800 drm/nouveau/gsp: fix mismatched alloc/free for kvmalloc() Replace kfree() with kvfree() for memory allocated by kvmalloc(). Compile-tested only. Cc: stable@vger.kernel.org Fixes: 8a8b1ec5261f ("drm/nouveau/gsp: split rpc handling out on its own") Signed-off-by: Qianfeng Rong Reviewed-by: Timur Tabi Acked-by: Zhi Wang Link: https://lore.kernel.org/r/20250813125412.96178-1-rongqianfeng@vivo.com Signed-off-by: Danilo Krummrich commit c87bd4dd43a624109c3cc42d843138378a7f4548 Author: Thijs Raymakers Date: Mon Aug 4 08:44:05 2025 +0200 KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels. Signed-off-by: Thijs Raymakers Cc: stable@vger.kernel.org Cc: Sean Christopherson Cc: Paolo Bonzini Cc: Greg Kroah-Hartman Fixes: 715062970f37 ("KVM: X86: Implement PV sched yield hypercall") Fixes: bdf7ffc89922 ("KVM: LAPIC: Fix pv ipis out-of-bounds access") Fixes: 4180bf1b655a ("KVM: X86: Implement "send IPI" hypercall") Link: https://lore.kernel.org/r/20250804064405.4802-1-thijs@raymakers.nl Signed-off-by: Sean Christopherson commit 79116acb75e11f7781fde8171e6d4a0e52de3e5d Merge: 08947318871cf3 9d4b01a0bf8d21 Author: Jakub Kicinski Date: Fri Aug 15 10:56:11 2025 -0700 Merge tag 'for-net-2025-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK - hci_conn: Fix not cleaning up Broadcaster/Broadcast Source - hci_core: Fix using {cis,bis}_capable for current settings - hci_core: Fix using ll_privacy_capable for current settings - hci_core: Fix not accounting for BIS/CIS/PA links separately - hci_conn: do return error from hci_enhanced_setup_sync() - hci_event: fix MTU for BN == 0 in CIS Established - hci_sync: Fix scan state after PA Sync has been established - hci_sync: Avoid adding default advertising on startup - hci_sync: Prevent unintended PA sync when SID is 0xFF - ISO: Fix getname not returning broadcast fields - btmtk: Fix wait_on_bit_timeout interruption during shutdown - btnxpuart: Uses threaded IRQ for host wakeup handling * tag 'for-net-2025-08-15' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately Bluetooth: btnxpuart: Uses threaded IRQ for host wakeup handling Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF Bluetooth: hci_core: Fix using ll_privacy_capable for current settings Bluetooth: hci_core: Fix using {cis,bis}_capable for current settings Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK Bluetooth: ISO: Fix getname not returning broadcast fields Bluetooth: hci_sync: Fix scan state after PA Sync has been established Bluetooth: hci_sync: Avoid adding default advertising on startup ==================== Link: https://patch.msgid.link/20250815142229.253052-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 08947318871cf3fcfea194f427db0b5797545281 Merge: 065c31f2c6915b 5e0b2177bdba99 Author: Jakub Kicinski Date: Fri Aug 15 10:44:50 2025 -0700 Merge branch 'mlxsw-spectrum-forward-packets-with-an-ipv4-link-local-source-ip' Petr Machata says: ==================== mlxsw: spectrum: Forward packets with an IPv4 link-local source IP By default, Spectrum devices do not forward IPv4 packets with a link-local source IP (i.e., 169.254.0.0/16). This behavior does not align with the kernel which does forward them. Fix the issue and add a selftest. ==================== Link: https://patch.msgid.link/cover.1755174341.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 5e0b2177bdba99c2487480e9864825f742b684ee Author: Ido Schimmel Date: Thu Aug 14 15:06:41 2025 +0200 selftest: forwarding: router: Add a test case for IPv4 link-local source IP Add a test case which checks that packets with an IPv4 link-local source IP are forwarded and not dropped. Signed-off-by: Ido Schimmel Signed-off-by: Petr Machata Link: https://patch.msgid.link/3c2e0b17d99530f57bef5ddff9af284fa0c9b667.1755174341.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit f604d3aaf64ff0d90cc875295474d3abf4155629 Author: Ido Schimmel Date: Thu Aug 14 15:06:40 2025 +0200 mlxsw: spectrum: Forward packets with an IPv4 link-local source IP By default, the device does not forward IPv4 packets with a link-local source IP (i.e., 169.254.0.0/16). This behavior does not align with the kernel which does forward them. Fix by instructing the device to forward such packets instead of dropping them. Fixes: ca360db4b825 ("mlxsw: spectrum: Disable DIP_LINK_LOCAL check in hardware pipeline") Reported-by: Zoey Mertes Signed-off-by: Ido Schimmel Reviewed-by: Petr Machata Signed-off-by: Petr Machata Link: https://patch.msgid.link/6721e6b2c96feb80269e72ce8d0b426e2f32d99c.1755174341.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 357d1fc38aad2cf4ea6626138cbf68299d20170c Author: Shinji Nomoto Date: Thu May 22 15:10:59 2025 +0900 cpupower: Allow control of boost feature on non-x86 based systems with boost support. The cpufreq subsystem has a generic sysfs interface for controlling boost (/sys/devices/system/cpu/cpufreq/boost). The sysfs interface can be used to enable boost control from the cpupower command on non-x86 platforms as well. So, allow boost controlling on non-x86 system if boost sysfs file exists. The set subcommand enables/disables the boost feature using the following syntax: cpupower set --boost 1 cpupower set --boost 0 The --boost option is an alias for --turbo-boost. We provided the neutral option name because the name "turbo boost" is specific to Intel technology. The frequency-info subcommand displays the enabled/disabled state of the boost feature as follows: boost state support: Active: yes (or no) Link: https://lore.kernel.org/r/20250522061122.2149188-3-fj5851bi@fujitsu.com Signed-off-by: Shinji Nomoto Signed-off-by: Shuah Khan commit b3eaf14f4c63fd6abc7b68c6d7a07c5680a6d8e5 Author: Shinji Nomoto Date: Thu May 22 15:10:58 2025 +0900 cpupower: Fix a bug where the -t option of the set subcommand was not working. The set subcommand's -t option is documented as being available for boost configuration, but it was not actually functioning due to a bug in the option handling. Link: https://lore.kernel.org/r/20250522061122.2149188-2-fj5851bi@fujitsu.com Signed-off-by: Shinji Nomoto Signed-off-by: Shuah Khan commit eafae0fdd115a71b3a200ef1a31f86da04bac77f Author: Evgeniy Harchenko Date: Fri Aug 15 12:58:14 2025 +0300 ALSA: hda/realtek: Add support for HP EliteBook x360 830 G6 and EliteBook 830 G6 The HP EliteBook x360 830 G6 and HP EliteBook 830 G6 have Realtek HDA codec ALC215. It needs the ALC285_FIXUP_HP_GPIO_LED quirk to enable the mute LED. Cc: Signed-off-by: Evgeniy Harchenko Link: https://patch.msgid.link/20250815095814.75845-1-evgeniyharchenko.dev@gmail.com Signed-off-by: Takashi Iwai commit ee94b00c1a648530333d9734200be7a45e6e00cd Merge: 4ad976b0e8ea32 8f5845e0743bf3 Author: Linus Torvalds Date: Fri Aug 15 08:20:36 2025 -0700 Merge tag 'block-6.17-20250815' of git://git.kernel.dk/linux Pull block fixes from Jens Axboe: - Fix for unprivileged daemons in ublk - Speedup ublk release by removing unnecessary quiesce - Fix for blk-wbt, where a regression caused it to not be possible to enable at runtime - blk-wbt cleanups - Kill the page pool from drbd - Remove redundant __GFP_NOWARN uses in a few spots - Fix for a kobject double initialization issues * tag 'block-6.17-20250815' of git://git.kernel.dk/linux: block: restore default wbt enablement Docs: admin-guide: Correct spelling mistake blk-wbt: doc: Update the doc of the wbt_lat_usec interface blk-wbt: Eliminate ambiguity in the comments of struct rq_wb blk-wbt: Optimize wbt_done() for non-throttled writes block: fix kobject double initialization in add_disk blk-cgroup: remove redundant __GFP_NOWARN block, bfq: remove redundant __GFP_NOWARN ublk: check for unprivileged daemon on each I/O fetch ublk: don't quiesce in ublk_ch_release drbd: Remove the open-coded page pool commit ed6c4b657bca3b39f7b11cba1405931aeb490f3d Author: Ahmed S. Darwish Date: Fri Aug 15 09:01:54 2025 +0200 x86/cpuid: Remove transitional header All CPUID call sites were updated at commit: 968e30006807 ("x86/cpuid: Set as the main CPUID header") to include instead of . The header was still retained as a wrapper, just in case some new code in -next started using it. Now that everything is merged to Linus' tree, remove the header. Signed-off-by: Ahmed S. Darwish Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250815070227.19981-2-darwi@linutronix.de commit 3ee9cebd0a5e7ea47eb35cec95eaa1a866af982d Author: Tom Lendacky Date: Wed Aug 13 10:26:59 2025 -0500 x86/sev: Ensure SVSM reserved fields in a page validation entry are initialized to zero In order to support future versions of the SVSM_CORE_PVALIDATE call, all reserved fields within a PVALIDATE entry must be set to zero as an SVSM should be ensuring all reserved fields are zero in order to support future usage of reserved areas based on the protocol version. Fixes: fcd042e86422 ("x86/sev: Perform PVALIDATE using the SVSM when not at VMPL0") Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Joerg Roedel Cc: Link: https://lore.kernel.org/7cde412f8b057ea13a646fb166b1ca023f6a5031.1755098819.git.thomas.lendacky@amd.com commit c08ba63078dd6046c279df37795cb77e784e1ec9 Author: Tom Lendacky Date: Wed Jul 16 15:41:35 2025 -0500 virt: sev-guest: Satisfy linear mapping requirement in get_derived_key() Commit 7ffeb2fc2670 ("x86/sev: Document requirement for linear mapping of guest request buffers") added a check that requires the guest request buffers to be in the linear mapping. The get_derived_key() function was passing a buffer that was allocated on the stack, resulting in the call to snp_send_guest_request() returning an error. Update the get_derived_key() function to use an allocated buffer instead of a stack buffer. Fixes: 7ffeb2fc2670 ("x86/sev: Document requirement for linear mapping of guest request buffers") Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Cc: Link: https://lore.kernel.org/9b764ca9fc79199a091aac684c4926e2080ca7a8.1752698495.git.thomas.lendacky@amd.com commit 4ad976b0e8ea3247c607cd37abb09440806f898d Merge: 8d084337a32fde 9d83e1f05c98ba Author: Linus Torvalds Date: Fri Aug 15 08:02:34 2025 -0700 Merge tag 'io_uring-6.17-20250815' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Tweak for the fairly recent changes of minimizing io-wq worker creations when it's pointless to create them. - Fix for an issue with ring provided buffers, which could cause issues with reuse or corrupt application data. * tag 'io_uring-6.17-20250815' of git://git.kernel.dk/linux: io_uring/io-wq: add check free worker before create new worker io_uring/net: commit partial buffers on retry commit 9d4b01a0bf8d2163ae129c9c537cb0753ad5a2aa Author: Luiz Augusto von Dentz Date: Thu Aug 14 11:57:19 2025 -0400 Bluetooth: hci_core: Fix not accounting for BIS/CIS/PA links separately This fixes the likes of hci_conn_num(CIS_LINK) returning the total of ISO connection which includes BIS_LINK as well, so this splits the iso_num into each link type and introduces hci_iso_num that can be used in places where the total number of ISO connection still needs to be used. Fixes: 23205562ffc8 ("Bluetooth: separate CIS_LINK and BIS_LINK link types") Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") Signed-off-by: Luiz Augusto von Dentz commit e489317d2fd9a51a81bdcbe15a73ddde8246e6d6 Author: Neeraj Sanjay Kale Date: Mon Aug 4 16:00:15 2025 +0530 Bluetooth: btnxpuart: Uses threaded IRQ for host wakeup handling This replaces devm_request_irq() with devm_request_threaded_irq(). On iMX93 11x11 EVK platform, the BT chip's BT_WAKE_OUT pin is connected to an I2C GPIO expander instead of directly been connected to iMX GPIO. When I2C GPIO expander's (PCAL6524) host driver receives an interrupt on it's INTR line, the driver's interrupt handler needs to query the interrupt source with PCAL6524 first, and then call the actual interrupt handler, in this case the IRQ handler in BTNXPUART. In order to handle interrupts when such I2C GPIO expanders are between the host and interrupt source, devm_request_threaded_irq() is needed. This commit also removes the IRQF_TRIGGER_FALLING flag, to allow setting the IRQ trigger type from the device tree setting instead of hardcoding in the driver. Signed-off-by: Neeraj Sanjay Kale Reviewed-by: Sherry Sun Signed-off-by: Luiz Augusto von Dentz commit 0eaf7c7e85da7495c0e03a99375707fc954f5e7b Author: Sergey Shtylyov Date: Tue Aug 5 22:14:51 2025 +0300 Bluetooth: hci_conn: do return error from hci_enhanced_setup_sync() The commit e07a06b4eb41 ("Bluetooth: Convert SCO configure_datapath to hci_sync") missed to update the *return* statement under the *case* of BT_CODEC_TRANSPARENT in hci_enhanced_setup_sync(), which led to returning success (0) instead of the negative error code (-EINVAL). However, the result of hci_enhanced_setup_sync() seems to be ignored anyway, since NULL gets passed to hci_cmd_sync_queue() as the last argument in that case and the only function interested in that result is specified by that argument. Fixes: e07a06b4eb41 ("Bluetooth: Convert SCO configure_datapath to hci_sync") Signed-off-by: Sergey Shtylyov Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 0b2d71a7c82628bb36fd43e80193bcc2693c239a Author: Adrian Huang (Lenovo) Date: Thu Aug 14 17:44:53 2025 +0800 pidfs: Fix memory leak in pidfd_info() After running the program 'ioctl_pidfd03' of Linux Test Project (LTP) or the program 'pidfd_info_test' in 'tools/testing/selftests/pidfd' of the kernel source, kmemleak reports the following memory leaks: # cat /sys/kernel/debug/kmemleak unreferenced object 0xff110020e5988000 (size 8216): comm "ioctl_pidfd03", pid 10853, jiffies 4294800031 hex dump (first 32 bytes): 02 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00 .@.............. 00 00 00 00 af 01 00 00 80 00 00 00 00 00 00 00 ................ backtrace (crc 69483047): kmem_cache_alloc_node_noprof+0x2fb/0x410 copy_process+0x178/0x1740 kernel_clone+0x99/0x3b0 __do_sys_clone3+0xbe/0x100 do_syscall_64+0x7b/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... unreferenced object 0xff11002097b70000 (size 8216): comm "pidfd_info_test", pid 11840, jiffies 4294889165 hex dump (first 32 bytes): 06 40 00 00 00 00 00 00 10 00 00 00 00 00 00 00 .@.............. 00 00 00 00 b5 00 00 00 80 00 00 00 00 00 00 00 ................ backtrace (crc a6286bb7): kmem_cache_alloc_node_noprof+0x2fb/0x410 copy_process+0x178/0x1740 kernel_clone+0x99/0x3b0 __do_sys_clone3+0xbe/0x100 do_syscall_64+0x7b/0x2c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e ... The leak occurs because pidfd_info() obtains a task_struct via get_pid_task() but never calls put_task_struct() to drop the reference, leaving task->usage unbalanced. Fix the issue by adding '__free(put_task) = NULL' to the local variable 'task', ensuring that put_task_struct() is automatically invoked when the variable goes out of scope. Fixes: 7477d7dce48a ("pidfs: allow to retrieve exit information") Signed-off-by: Adrian Huang (Lenovo) Link: https://lore.kernel.org/20250814094453.15232-1-adrianhuang0701@gmail.com Signed-off-by: Christian Brauner commit 8d084337a32fde0ffa59d5f70d07a54987911ba1 Merge: 7bb7780e3c8450 c345102d1feed3 Author: Linus Torvalds Date: Fri Aug 15 07:02:57 2025 -0700 Merge tag 'sound-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: "A collection of small fixes: - Potential OOB access fixes in USB-audio driver - ASoC kconfig menu fix for improving the generic drivers - HD-audio quirks and a fix revert - Codec and platform-specific small fixes for ASoC" * tag 'sound-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/tas2781: Normalize the volume kcontrol name ALSA: usb-audio: Validate UAC3 cluster segment descriptors ALSA: usb-audio: Validate UAC3 power domain descriptors, too Revert "ALSA: hda: Add ASRock X670E Taichi to denylist" ALSA: azt3328: Put __maybe_unused for inline functions for gameport ASoC: tas2781: Normalize the volume kcontrol name ASoC: stm: stm32_i2s: Fix calc_clk_div() error handling in determine_rate() ASoC: codecs: Call strscpy() with correct size argument ALSA: hda/realtek: Fix headset mic on HONOR BRB-X ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks ASoC: tas2781: Fix spelling mistake "dismatch" -> "mismatch" ASoC: rt1320: fix random cycle mute issue ASoC: rt721: fix FU33 Boost Volume control not working ASoC: generic: tidyup standardized ASoC menu for generic ASoC: codec: sma1307: replace spelling mistake with new error message ASoC: codecs: tx-macro: correct tx_macro_component_drv name ASoC: fsl_sai: replace regmap_write with regmap_update_bits commit a3de58b12ce074ec05b8741fa28d62ccb1070468 Author: David Howells Date: Thu Aug 14 22:45:50 2025 +0100 netfs: Fix unbuffered write error handling If all the subrequests in an unbuffered write stream fail, the subrequest collector doesn't update the stream->transferred value and it retains its initial LONG_MAX value. Unfortunately, if all active streams fail, then we take the smallest value of { LONG_MAX, LONG_MAX, ... } as the value to set in wreq->transferred - which is then returned from ->write_iter(). LONG_MAX was chosen as the initial value so that all the streams can be quickly assessed by taking the smallest value of all stream->transferred - but this only works if we've set any of them. Fix this by adding a flag to indicate whether the value in stream->transferred is valid and checking that when we integrate the values. stream->transferred can then be initialised to zero. This was found by running the generic/750 xfstest against cifs with cache=none. It splices data to the target file. Once (if) it has used up all the available scratch space, the writes start failing with ENOSPC. This causes ->write_iter() to fail. However, it was returning wreq->transferred, i.e. LONG_MAX, rather than an error (because it thought the amount transferred was non-zero) and iter_file_splice_write() would then try to clean up that amount of pipe bufferage - leading to an oops when it overran. The kernel log showed: CIFS: VFS: Send error in write = -28 followed by: BUG: kernel NULL pointer dereference, address: 0000000000000008 with: RIP: 0010:iter_file_splice_write+0x3a4/0x520 do_splice+0x197/0x4e0 or: RIP: 0010:pipe_buf_release (include/linux/pipe_fs_i.h:282) iter_file_splice_write (fs/splice.c:755) Also put a warning check into splice to announce if ->write_iter() returned that it had written more than it was asked to. Fixes: 288ace2f57c9 ("netfs: New writeback implementation") Reported-by: Xiaoli Feng Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220445 Signed-off-by: David Howells Link: https://lore.kernel.org/915443.1755207950@warthog.procyon.org.uk cc: Paulo Alcantara cc: Steve French cc: Shyam Prasad N cc: netfs@lists.linux.dev cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org cc: stable@vger.kernel.org Signed-off-by: Christian Brauner commit 7bb7780e3c845009d37f61e3a8a29c0f962a4806 Merge: 66ba63d4d87bb3 810bd9066fb187 Author: Linus Torvalds Date: Fri Aug 15 06:54:37 2025 -0700 Merge tag 'gpio-fixes-for-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio fix from Bartosz Golaszewski: - fix the way optional interrupts are retrieved from firmware in gpio-mlxbf3 * tag 'gpio-fixes-for-v6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: gpio: mlxbf3: use platform_get_irq_optional() Revert "gpio: mlxbf3: only get IRQ for device instance 0" commit b5ca88927e353185b3d9ac4362d33e5aeb25771f Author: Thomas Bertschinger Date: Thu Aug 14 17:54:28 2025 -0600 fhandle: do_handle_open() should get FD with user flags In f07c7cc4684a, do_handle_open() was switched to use the automatic cleanup method for getting a FD. In that change it was also switched to pass O_CLOEXEC unconditionally to get_unused_fd_flags() instead of passing the user-specified flags. I don't see anything in that commit description that indicates this was intentional, so I am assuming it was an oversight. With this fix, the FD will again be opened with, or without, O_CLOEXEC according to what the user requested. Fixes: f07c7cc4684a ("fhandle: simplify error handling") Signed-off-by: Thomas Bertschinger Link: https://lore.kernel.org/20250814235431.995876-4-tahbertschinger@gmail.com Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 0b3725dbf61b51e7c663834811b3691157ae17d6 Author: Pauli Virtanen Date: Sat Aug 9 11:36:20 2025 +0300 Bluetooth: hci_event: fix MTU for BN == 0 in CIS Established BN == 0x00 in CIS Established means no isochronous data for the corresponding direction (Core v6.1 pp. 2394). In this case SDU MTU should be 0. However, the specification does not say the Max_PDU_C_To_P or P_To_C are then zero. Intel AX210 in Framed CIS mode sets nonzero Max_PDU for direction with zero BN. This causes failure later when we try to LE Setup ISO Data Path for disabled direction, which is disallowed (Core v6.1 pp. 2750). Fix by setting SDU MTU to 0 if BN == 0. Fixes: 2be22f1941d5f ("Bluetooth: hci_event: Fix parsing of CIS Established Event") Signed-off-by: Pauli Virtanen Reviewed-by: Paul Menzel Signed-off-by: Luiz Augusto von Dentz commit 4d19cd228bbe8ff84a63fe7b11bc756b4b4370c7 Author: Yang Li Date: Thu Aug 7 15:56:03 2025 +0800 Bluetooth: hci_sync: Prevent unintended PA sync when SID is 0xFF After LE Extended Scan times out, conn->sid remains 0xFF, so the PA sync creation process should be aborted. Btmon snippet from PA sync with SID=0xFF: < HCI Command: LE Set Extended.. (0x08|0x0042) plen 6 #74726 [hci0] 863.107927 Extended scan: Enabled (0x01) Filter duplicates: Enabled (0x01) Duration: 0 msec (0x0000) Period: 0.00 sec (0x0000) > HCI Event: Command Complete (0x0e) plen 4 #74727 [hci0] 863.109389 LE Set Extended Scan Enable (0x08|0x0042) ncmd 1 Status: Success (0x00) < HCI Command: LE Periodic Ad.. (0x08|0x0044) plen 14 #74728 [hci0] 865.141168 Options: 0x0000 Use advertising SID, Advertiser Address Type and address Reporting initially enabled SID: 0xff Adv address type: Random (0x01) Adv address: 0D:D7:2C:E7:42:46 (Non-Resolvable) Skip: 0x0000 Sync timeout: 20000 msec (0x07d0) Sync CTE type: 0x0000 > HCI Event: Command Status (0x0f) plen 4 #74729 [hci0] 865.143223 LE Periodic Advertising Create Sync (0x08|0x0044) ncmd 1 Status: Success (0x00) Fixes: e2d471b7806b ("Bluetooth: ISO: Fix not using SID from adv report") Signed-off-by: Yang Li Signed-off-by: Luiz Augusto von Dentz commit 3dcf7175f2c04bd3a7d50db3fa42a0bd933b6e23 Author: Luiz Augusto von Dentz Date: Mon Aug 4 14:05:03 2025 -0400 Bluetooth: hci_core: Fix using ll_privacy_capable for current settings ll_privacy_capable only indicates that the controller supports the feature but it doesnt' check that LE is enabled so it end up being marked as active in the current settings when it shouldn't. Fixes: ad383c2c65a5 ("Bluetooth: hci_sync: Enable advertising when LL privacy is enabled") Signed-off-by: Luiz Augusto von Dentz commit 709788b154caf042874d765628ffa860f0bb0d1e Author: Luiz Augusto von Dentz Date: Mon Aug 4 09:54:05 2025 -0400 Bluetooth: hci_core: Fix using {cis,bis}_capable for current settings {cis,bis}_capable only indicates the controller supports the feature since it doesn't check that LE is enabled so it shall not be used for current setting, instead this introduces {cis,bis}_enabled macros that can be used to indicate that these features are currently enabled. Fixes: 26afbd826ee3 ("Bluetooth: Add initial implementation of CIS connections") Fixes: eca0ae4aea66 ("Bluetooth: Add initial implementation of BIS connections") Fixes: ae7533613133 ("Bluetooth: Check for ISO support in controller") Signed-off-by: Luiz Augusto von Dentz commit 099799fa9b76c5c02b49e07005a85117a25b01ea Author: Jiande Lu Date: Thu Jul 24 16:51:17 2025 +0800 Bluetooth: btmtk: Fix wait_on_bit_timeout interruption during shutdown During the shutdown process, an interrupt occurs that prematurely terminates the wait for the expected event. This change replaces TASK_INTERRUPTIBLE with TASK_UNINTERRUPTIBLE in the wait_on_bit_timeout call to ensure the shutdown process completes as intended without being interrupted by signals. Fixes: d019930b0049 ("Bluetooth: btmtk: move btusb_mtk_hci_wmt_sync to btmtk.c") Signed-off-by: Jiande Lu Signed-off-by: Luiz Augusto von Dentz commit 3ba486c5f3ce2c22ffd29c0103404cdbe21912b3 Author: Luiz Augusto von Dentz Date: Tue Jul 29 12:11:09 2025 -0400 Bluetooth: hci_conn: Fix not cleaning up Broadcaster/Broadcast Source This fixes Broadcaster/Broadcast Source not sending HCI_OP_LE_TERM_BIG because HCI_CONN_PER_ADV where not being set. Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") Signed-off-by: Luiz Augusto von Dentz commit d36349ea73d805bb72cbc24ab90cb1da4ad5c379 Author: Luiz Augusto von Dentz Date: Mon Jul 28 13:51:01 2025 -0400 Bluetooth: hci_conn: Fix running bis_cleanup for hci_conn->type PA_LINK Connections with type of PA_LINK shall be considered temporary just to track the lifetime of PA Sync setup, once the BIG Sync is established and connection are created with BIS_LINK the existing PA_LINK connection shall not longer use bis_cleanup otherwise it terminates the PA Sync when that shall be left to BIS_LINK connection to do it. Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") Signed-off-by: Luiz Augusto von Dentz commit aee29c18a38d479c2f058c9b6a39b0527cf81d10 Author: Luiz Augusto von Dentz Date: Thu Jul 24 16:36:27 2025 -0400 Bluetooth: ISO: Fix getname not returning broadcast fields getname shall return iso_bc fields for both BIS_LINK and PA_LINK since the likes of bluetoothd do use the getpeername to retrieve the SID both when enumerating the broadcasters and when synchronizing. Fixes: a7bcffc673de ("Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections") Signed-off-by: Luiz Augusto von Dentz commit ca88be1a2725a42f8dbad579181611d9dcca8e88 Author: Luiz Augusto von Dentz Date: Thu Jul 24 16:43:18 2025 -0400 Bluetooth: hci_sync: Fix scan state after PA Sync has been established Passive scanning is used to program the address of the peer to be synchronized, so once HCI_EV_LE_PA_SYNC_ESTABLISHED is received it needs to be updated after clearing HCI_PA_SYNC then call hci_update_passive_scan_sync to return it to its original state. Fixes: 6d0417e4e1cf ("Bluetooth: hci_conn: Fix not setting conn_timeout for Broadcast Receiver") Signed-off-by: Luiz Augusto von Dentz commit de5d7d3f27ddd4046736f558a40e252ddda82013 Author: Yang Li Date: Mon Jul 28 17:08:44 2025 +0800 Bluetooth: hci_sync: Avoid adding default advertising on startup list_empty(&hdev->adv_instances) is always true during startup, so an advertising instance is added by default. Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x24 hci_setup_ext_adv_instance_sync+0x17c/0x328 hci_powered_update_adv_sync+0xb4/0x12c hci_powered_update_sync+0x54/0x70 hci_power_on_sync+0xe4/0x278 hci_set_powered_sync+0x28/0x34 set_powered_sync+0x40/0x58 hci_cmd_sync_work+0x94/0x100 process_one_work+0x168/0x444 worker_thread+0x378/0x3f4 kthread+0x108/0x10c ret_from_fork+0x10/0x20 Link: https://github.com/bluez/bluez/issues/1442 Signed-off-by: Yang Li Signed-off-by: Luiz Augusto von Dentz commit 66ba63d4d87bb3b1c3b5f0f09610c4c16748bbf0 Merge: 55ddcff7358aa7 b6bcbce3359619 Author: Linus Torvalds Date: Fri Aug 15 06:30:53 2025 -0700 Merge tag 'pmdomain-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fix from Ulf Hansson: - tegra: Ensure pmc power-domains are in a known state * tag 'pmdomain-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: soc/tegra: pmc: Ensure power-domains are in a known state commit 55ddcff7358aa7cb20ff71fd2ec3131133b1fc3d Merge: d7ee5bdce78926 e19d8dd694d261 Author: Linus Torvalds Date: Fri Aug 15 05:58:19 2025 -0700 Merge tag '6.17-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client fixes from Steve French: - Fix unlink race and rename races - SMB3.1.1 compression fix - Avoid unneeded strlen calls in cifs_get_spnego_key - Fix slab out of bounds in parse_server_interfaces() - Fix mid leak and server buffer leak - smbdirect send error path fix - update internal version # - Fix unneeded response time update in negotiate protocol * tag '6.17-rc1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb: client: remove redundant lstrp update in negotiate protocol cifs: update internal version number smb: client: don't wait for info->send_pending == 0 on error smb: client: fix mid_q_entry memleak leak with per-mid locking smb3: fix for slab out of bounds on mount to ksmbd cifs: avoid extra calls to strlen() in cifs_get_spnego_key() cifs: Fix collect_sample() to handle any iterator type smb: client: fix race with concurrent opens in rename(2) smb: client: fix race with concurrent opens in unlink(2) commit b64fdd422a85025b5e91ead794db9d3ef970e369 Author: Yunseong Kim Date: Tue Aug 12 18:10:47 2025 +0000 perf: Avoid undefined behavior from stopping/starting inactive events Calling pmu->start()/stop() on perf events in PERF_EVENT_STATE_OFF can leave event->hw.idx at -1. When PMU drivers later attempt to use this negative index as a shift exponent in bitwise operations, it leads to UBSAN shift-out-of-bounds reports. The issue is a logical flaw in how event groups handle throttling when some members are intentionally disabled. Based on the analysis and the reproducer provided by Mark Rutland (this issue on both arm64 and x86-64). The scenario unfolds as follows: 1. A group leader event is configured with a very aggressive sampling period (e.g., sample_period = 1). This causes frequent interrupts and triggers the throttling mechanism. 2. A child event in the same group is created in a disabled state (.disabled = 1). This event remains in PERF_EVENT_STATE_OFF. Since it hasn't been scheduled onto the PMU, its event->hw.idx remains initialized at -1. 3. When throttling occurs, perf_event_throttle_group() and later perf_event_unthrottle_group() iterate through all siblings, including the disabled child event. 4. perf_event_throttle()/unthrottle() are called on this inactive child event, which then call event->pmu->start()/stop(). 5. The PMU driver receives the event with hw.idx == -1 and attempts to use it as a shift exponent. e.g., in macros like PMCNTENSET(idx), leading to the UBSAN report. The throttling mechanism attempts to start/stop events that are not actively scheduled on the hardware. Move the state check into perf_event_throttle()/perf_event_unthrottle() so that inactive events are skipped entirely. This ensures only active events with a valid hw.idx are processed, preventing undefined behavior and silencing UBSAN warnings. The corrected check ensures true before proceeding with PMU operations. The problem can be reproduced with the syzkaller reproducer: Fixes: 9734e25fbf5a ("perf: Fix the throttle logic for a group") Signed-off-by: Yunseong Kim Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Kan Liang Link: https://lore.kernel.org/r/20250812181046.292382-2-ysk@kzalloc.com commit 41f0200c718cf1826959a082a5374838c15bd242 Author: Nicolin Chen Date: Thu Aug 14 12:30:38 2025 -0700 iommu/tegra241-cmdqv: Fix missing cpu_to_le64 at lvcmdq_err_map Sparse reported a warning: drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c:305:47: sparse: expected restricted __le64 sparse: got unsigned long long Add cpu_to_le64() to fix that. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508142105.Jb5Smjsg-lkp@intel.com/ Suggested-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Link: https://lore.kernel.org/r/20250814193039.2265813-1-nicolinc@nvidia.com Signed-off-by: Joerg Roedel commit 8503d0fcb1086a7cfe26df67ca4bd9bd9e99bdec Author: Kees Cook Date: Mon Aug 4 08:40:27 2025 -0700 iommu/amd: Avoid stack buffer overflow from kernel cmdline While the kernel command line is considered trusted in most environments, avoid writing 1 byte past the end of "acpiid" if the "str" argument is maximum length. Reported-by: Simcha Kosman Closes: https://lore.kernel.org/all/AS8P193MB2271C4B24BCEDA31830F37AE84A52@AS8P193MB2271.EURP193.PROD.OUTLOOK.COM Fixes: b6b26d86c61c ("iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter") Signed-off-by: Kees Cook Reviewed-by: Ankit Soni Link: https://lore.kernel.org/r/20250804154023.work.970-kees@kernel.org Signed-off-by: Joerg Roedel commit e4414b01c1cd9887bbde92f946c1ba94e40d6d64 Author: Jiri Olsa Date: Thu Aug 14 22:06:55 2025 +0200 bpf: Check the helper function is valid in get_helper_proto kernel test robot reported verifier bug [1] where the helper func pointer could be NULL due to disabled config option. As Alexei suggested we could check on that in get_helper_proto directly. Marking tail_call helper func with BPF_PTR_POISON, because it is unused by design. [1] https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com Reported-by: kernel test robot Reported-by: syzbot+a9ed3d9132939852d0df@syzkaller.appspotmail.com Suggested-by: Alexei Starovoitov Signed-off-by: Jiri Olsa Signed-off-by: Daniel Borkmann Acked-by: Paul Chaignon Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250814200655.945632-1-jolsa@kernel.org Closes: https://lore.kernel.org/oe-lkp/202507160818.68358831-lkp@intel.com commit 2b986b9e917bc88f81aa1ed386af63b26c983f1d Author: Jesper Dangaard Brouer Date: Thu Aug 14 20:24:37 2025 +0200 bpf, cpumap: Disable page_pool direct xdp_return need larger scope When running an XDP bpf_prog on the remote CPU in cpumap code then we must disable the direct return optimization that xdp_return can perform for mem_type page_pool. This optimization assumes code is still executing under RX-NAPI of the original receiving CPU, which isn't true on this remote CPU. The cpumap code already disabled this via helpers xdp_set_return_frame_no_direct() and xdp_clear_return_frame_no_direct(), but the scope didn't include xdp_do_flush(). When doing XDP_REDIRECT towards e.g devmap this causes the function bq_xmit_all() to run with direct return optimization enabled. This can lead to hard to find bugs. The issue only happens when bq_xmit_all() cannot ndo_xdp_xmit all frames and them frees them via xdp_return_frame_rx_napi(). Fix by expanding scope to include xdp_do_flush(). This was found by Dragos Tatulea. Fixes: 11941f8a8536 ("bpf: cpumap: Implement generic cpumap") Reported-by: Dragos Tatulea Reported-by: Chris Arges Signed-off-by: Jesper Dangaard Brouer Signed-off-by: Martin KaFai Lau Signed-off-by: Daniel Borkmann Tested-by: Chris Arges Link: https://patch.msgid.link/175519587755.3008742.1088294435150406835.stgit@firesoul commit 9dcf111dd3e7ed5fce82bb108e3a3fc001c07225 Author: Dan Carpenter Date: Wed Aug 13 08:49:08 2025 +0300 scsi: qla4xxx: Prevent a potential error pointer dereference The qla4xxx_get_ep_fwdb() function is supposed to return NULL on error, but qla4xxx_ep_connect() returns error pointers. Propagating the error pointers will lead to an Oops in the caller, so change the error pointers to NULL. Fixes: 13483730a13b ("[SCSI] qla4xxx: fix flash/ddb support") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/aJwnVKS9tHsw1tEu@stanley.mountain Reviewed-by: Chris Leech Signed-off-by: Martin K. Petersen commit 823f95575d85454ccad7d5b684aec42e57b962f6 Author: Adrian Hunter Date: Tue Aug 12 16:02:59 2025 +0300 scsi: ufs: ufs-pci: Add support for Intel Wildcat Lake Add PCI ID to support Intel Wildcat Lake, same as MTL. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20250812130259.109645-1-adrian.hunter@intel.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 50a8c08b8b69399a09c2dbcad8ef3fef9d9349d2 Author: Liu Ying Date: Wed Aug 6 17:52:24 2025 +0800 drm/bridge: analogix_dp: Fix bailout for devm_drm_bridge_alloc() devm_drm_bridge_alloc() returns ERR_PTR on failure instead of a NULL pointer, so use IS_ERR() to check the returned pointer. While at it, on failure, return ERR_CAST(dp) instead of ERR_PTR(-ENOMEM) in order not to depend on devm_drm_bridge_alloc() error code implementation. Fixes: 48f05c3b4b70 ("drm/bridge: analogix_dp: Use devm_drm_bridge_alloc() API") Signed-off-by: Liu Ying Reviewed-by: Luca Ceresoli Link: https://lore.kernel.org/r/20250806095224.527938-1-victor.liu@nxp.com commit fad2cf04e91fd3c4310731537bf98d1f8a0b4137 Author: Christoph Hellwig Date: Tue Aug 12 10:28:05 2025 +0200 scsi: fnic: Remove a useless struct mempool forward declaration struct mempool doesn't currently exist, and thus also isn't used in fnic.h, remove it. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250812082808.371119-1-hch@lst.de Reviewed-by: Karan Tilak Kumar Signed-off-by: Martin K. Petersen commit d7ee5bdce7892643409dea7266c34977e651b479 Merge: 24ea63ea387714 0342273e14c259 Author: Linus Torvalds Date: Thu Aug 14 19:15:22 2025 -0700 Merge tag 'firewire-fixes-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire fixes from Takashi Sakamoto: "This fixes a potential call to schedule() within an RCU read-side critical section. The solution applies reference counting to ensure that handlers which may call schedule() are invoked safely outside of the critical section" * tag 'firewire-fixes-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: core: reallocate buffer for FCP address handlers when more than 4 are registered firewire: core: call FCP address handlers outside RCU read-side critical section firewire: core: call handler for exclusive regions outside RCU read-side critical section firewire: core: use reference counting to invoke address handlers safely commit fd7e5de4b2eddd34e3567cd419812d8869ef4f13 Author: Tal Zussman Date: Thu Aug 14 02:51:57 2025 -0400 lib/crypto: ensure generated *.S files are removed on make clean make clean does not check the kernel config when removing files. As such, additions to clean-files under CONFIG_ARM or CONFIG_ARM64 are not evaluated. For example, when building on arm64, this means that lib/crypto/arm64/sha{256,512}-core.S are left over after make clean. Set clean-files unconditionally to ensure that make clean removes these files. Fixes: e96cb9507f2d ("lib/crypto: sha256: Consolidate into single module") Fixes: 24c91b62ac50 ("lib/crypto: arm/sha512: Migrate optimized SHA-512 code to library") Fixes: 60e3f1e9b7a5 ("lib/crypto: arm64/sha512: Migrate optimized SHA-512 code to library") Signed-off-by: Tal Zussman Link: https://lore.kernel.org/r/20250814-crypto_clean-v2-1-659a2dc86302@columbia.edu Signed-off-by: Eric Biggers commit d73915fdc0011d536c03856be7ec451f6a5fb4ff Author: Eric Biggers Date: Thu Jul 31 15:42:18 2025 -0700 lib/crypto: sha: Update Kconfig help for SHA1 and SHA256 Update the help text for CRYPTO_LIB_SHA1 and CRYPTO_LIB_SHA256 to reflect the addition of HMAC support, and to be consistent with CRYPTO_LIB_SHA512. Link: https://lore.kernel.org/r/20250731224218.137947-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 065c31f2c6915b38f45b1c817b31f41f62eaa774 Author: Justin Lai Date: Wed Aug 13 15:16:31 2025 +0800 rtase: Fix Rx descriptor CRC error bit definition The CRC error bit is located at bit 17 in the Rx descriptor, but the driver was incorrectly using bit 16. Fix it. Fixes: a36e9f5cfe9e ("rtase: Add support for a pci table in this module") Signed-off-by: Justin Lai Link: https://patch.msgid.link/20250813071631.7566-1-justinlai0215@realtek.com Signed-off-by: Jakub Kicinski commit 8c06cbdcbaea34d7b96d76df4d6669275c1d291a Author: William Liu Date: Tue Aug 12 23:58:26 2025 +0000 selftests/tc-testing: Check backlog stats in gso_skb case Add tests to ensure proper backlog accounting in hhf, codel, pie, fq, fq_pie, and fq_codel qdiscs. We check for the bug pattern originally found in fq, fq_pie, and fq_codel, which was an underflow in the tbf parent backlog stats upon child qdisc removal. Signed-off-by: William Liu Reviewed-by: Savino Dicanosa Link: https://patch.msgid.link/20250812235808.45281-1-will@willsroot.io Signed-off-by: Jakub Kicinski commit 52bf272636bda69587952b35ae97690b8dc89941 Author: William Liu Date: Tue Aug 12 23:57:57 2025 +0000 net/sched: Fix backlog accounting in qdisc_dequeue_internal This issue applies for the following qdiscs: hhf, fq, fq_codel, and fq_pie, and occurs in their change handlers when adjusting to the new limit. The problem is the following in the values passed to the subsequent qdisc_tree_reduce_backlog call given a tbf parent: When the tbf parent runs out of tokens, skbs of these qdiscs will be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued, which accounts for both qlen and backlog. However, in the case of qdisc_dequeue_internal, ONLY qlen is accounted for when pulling from gso_skb. This means that these qdiscs are missing a qdisc_qstats_backlog_dec when dropping packets to satisfy the new limit in their change handlers. One can observe this issue with the following (with tc patched to support a limit of 0): export TARGET=fq tc qdisc del dev lo root tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000 echo ''; echo 'add child'; tc -s -d qdisc show dev lo ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null echo ''; echo 'after ping'; tc -s -d qdisc show dev lo tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0 echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo tc qdisc replace dev lo handle 2: parent 1:1 sfq echo ''; echo 'post graft'; tc -s -d qdisc show dev lo The second to last show command shows 0 packets but a positive number (74) of backlog bytes. The problem becomes clearer in the last show command, where qdisc_purge_queue triggers qdisc_tree_reduce_backlog with the positive backlog and causes an underflow in the tbf parent's backlog (4096 Mb instead of 0). To fix this issue, the codepath for all clients of qdisc_dequeue_internal has been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel. qdisc_dequeue_internal handles the backlog adjustments for all cases that do not directly use the dequeue handler. The old fq_codel_change limit adjustment loop accumulated the arguments to the subsequent qdisc_tree_reduce_backlog call through the cstats field. However, this is confusing and error prone as fq_codel_dequeue could also potentially mutate this field (which qdisc_dequeue_internal calls in the non gso_skb case), so we have unified the code here with other qdiscs. Fixes: 2d3cbfd6d54a ("net_sched: Flush gso_skb list too during ->change()") Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM") Fixes: 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc") Signed-off-by: William Liu Reviewed-by: Savino Dicanosa Link: https://patch.msgid.link/20250812235725.45243-1-will@willsroot.io Signed-off-by: Jakub Kicinski commit d1547bf460baec718b3398365f8de33d25c5f36f Author: Wang Liang Date: Wed Aug 13 10:10:54 2025 +0800 net: bridge: fix soft lockup in br_multicast_query_expired() When set multicast_query_interval to a large value, the local variable 'time' in br_multicast_send_query() may overflow. If the time is smaller than jiffies, the timer will expire immediately, and then call mod_timer() again, which creates a loop and may trigger the following soft lockup issue. watchdog: BUG: soft lockup - CPU#1 stuck for 221s! [rb_consumer:66] CPU: 1 UID: 0 PID: 66 Comm: rb_consumer Not tainted 6.16.0+ #259 PREEMPT(none) Call Trace: __netdev_alloc_skb+0x2e/0x3a0 br_ip6_multicast_alloc_query+0x212/0x1b70 __br_multicast_send_query+0x376/0xac0 br_multicast_send_query+0x299/0x510 br_multicast_query_expired.constprop.0+0x16d/0x1b0 call_timer_fn+0x3b/0x2a0 __run_timers+0x619/0x950 run_timer_softirq+0x11c/0x220 handle_softirqs+0x18e/0x560 __irq_exit_rcu+0x158/0x1a0 sysvec_apic_timer_interrupt+0x76/0x90 This issue can be reproduced with: ip link add br0 type bridge echo 1 > /sys/class/net/br0/bridge/multicast_querier echo 0xffffffffffffffff > /sys/class/net/br0/bridge/multicast_query_interval ip link set dev br0 up The multicast_startup_query_interval can also cause this issue. Similar to the commit 99b40610956a ("net: bridge: mcast: add and enforce query interval minimum"), add check for the query interval maximum to fix this issue. Link: https://lore.kernel.org/netdev/20250806094941.1285944-1-wangliang74@huawei.com/ Link: https://lore.kernel.org/netdev/20250812091818.542238-1-wangliang74@huawei.com/ Fixes: d902eee43f19 ("bridge: Add multicast count/interval sysfs entries") Suggested-by: Nikolay Aleksandrov Signed-off-by: Wang Liang Reviewed-by: Ido Schimmel Acked-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250813021054.1643649-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit fd980bf6e9cdae885105685259421164f843ca55 Author: Suraj Gupta Date: Wed Aug 13 19:25:59 2025 +0530 net: xilinx: axienet: Fix RX skb ring management in DMAengine mode Submit multiple descriptors in axienet_rx_cb() to fill Rx skb ring. This ensures the ring "catches up" on previously missed allocations. Increment Rx skb ring head pointer after BD is successfully allocated. Previously, head pointer was incremented before verifying if descriptor is successfully allocated and has valid entries, which could lead to ring state inconsistency if descriptor setup failed. These changes improve reliability by maintaining adequate descriptor availability and ensuring proper ring buffer state management. Fixes: 6a91b846af85 ("net: axienet: Introduce dmaengine support") Signed-off-by: Suraj Gupta Link: https://patch.msgid.link/20250813135559.1555652-1-suraj.gupta2@amd.com Signed-off-by: Jakub Kicinski commit 1548549e17e374a126e9a4e9edab8bb041fbd67e Author: Alexandra Winter Date: Wed Aug 13 13:16:33 2025 +0200 MAINTAINERS: update s390/net Remove Thorsten Winkler as maintainer and add Aswin Karuvally as reviewer. Thank you Thorsten for your support, welcome Aswin! Signed-off-by: Alexandra Winter Acked-by: Thorsten Winkler Acked-by: Aswin Karuvally Link: https://patch.msgid.link/20250813111633.241111-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski commit 00062ea01d35eaca34d561e5c76cd988dc8c3b83 Merge: 4699c04b68ed5c 94eae6ee4c2df2 Author: Dave Airlie Date: Fri Aug 15 09:50:17 2025 +1000 Merge tag 'drm-xe-fixes-2025-08-14' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes - Some more xe_migrate_access_memory fixes (Auld) - Defer buffer object shrinker write-backs and GPU waits (Thomas) - HWMON fix for clamping limits (Karthik) - SRIOV-PF: Set VF LMEM BAR size (Michal) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aJ4MIZQurSo0uNxn@intel.com commit 4699c04b68ed5c30ca3b4439458dae9f1acf6cfb Merge: 68ad07df92faf4 184889dfe05685 Author: Dave Airlie Date: Fri Aug 15 09:05:04 2025 +1000 Merge tag 'drm-intel-fixes-2025-08-13' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-fixes - Fix the implementation of wa_18038517565 [fbc] (Vinod Govindapillai) - Do not trigger Frame Change events from frontbuffer flush [psr] (Jouni Högander) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://lore.kernel.org/r/aJ0HAh06VHWVdv63@linux commit b7cc9887231526ca4fa89f3fa4119e47c2dc7b1e Author: Pawan Gupta Date: Thu Aug 14 10:20:43 2025 -0700 x86/vmscape: Warn when STIBP is disabled with SMT Cross-thread attacks are generally harder as they require the victim to be co-located on a core. However, with VMSCAPE the adversary targets belong to the same guest execution, that are more likely to get co-located. In particular, a thread that is currently executing userspace hypervisor (after the IBPB) may still be targeted by a guest execution from a sibling thread. Issue a warning about the potential risk, except when: - SMT is disabled - STIBP is enabled system-wide - Intel eIBRS is enabled (which implies STIBP protection) Signed-off-by: Pawan Gupta Signed-off-by: Dave Hansen commit 6449f5baf9c78a7a442d64f4a61378a21c5db113 Author: Pawan Gupta Date: Thu Aug 14 10:20:43 2025 -0700 x86/bugs: Move cpu_bugs_smt_update() down cpu_bugs_smt_update() uses global variables from different mitigations. For SMT updates it can't currently use vmscape_mitigation that is defined after it. Since cpu_bugs_smt_update() depends on many other mitigations, move it after all mitigations are defined. With that, it can use vmscape_mitigation in a moment. No functional change. Signed-off-by: Pawan Gupta Signed-off-by: Dave Hansen Reviewed-by: Dave Hansen commit 556c1ad666ad90c50ec8fccb930dd5046cfbecfb Author: Pawan Gupta Date: Thu Aug 14 10:20:42 2025 -0700 x86/vmscape: Enable the mitigation Enable the previously added mitigation for VMscape. Add the cmdline vmscape={off|ibpb|force} and sysfs reporting. Signed-off-by: Pawan Gupta Signed-off-by: Dave Hansen Reviewed-by: Borislav Petkov (AMD) Reviewed-by: Dave Hansen commit 2f8f173413f1cbf52660d04df92d0069c4306d25 Author: Pawan Gupta Date: Thu Aug 14 10:20:42 2025 -0700 x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ] Suggested-by: Dave Hansen Signed-off-by: Pawan Gupta Signed-off-by: Dave Hansen Reviewed-by: Dave Hansen Reviewed-by: Borislav Petkov (AMD) Acked-by: Sean Christopherson commit a508cec6e5215a3fbc7e73ae86a5c5602187934d Author: Pawan Gupta Date: Thu Aug 14 10:20:42 2025 -0700 x86/vmscape: Enumerate VMSCAPE bug The VMSCAPE vulnerability may allow a guest to cause Branch Target Injection (BTI) in userspace hypervisors. Kernels (both host and guest) have existing defenses against direct BTI attacks from guests. There are also inter-process BTI mitigations which prevent processes from attacking each other. However, the threat in this case is to a userspace hypervisor within the same process as the attacker. Userspace hypervisors have access to their own sensitive data like disk encryption keys and also typically have access to all guest data. This means guest userspace may use the hypervisor as a confused deputy to attack sensitive guest kernel data. There are no existing mitigations for these attacks. Introduce X86_BUG_VMSCAPE for this vulnerability and set it on affected Intel and AMD CPUs. Signed-off-by: Pawan Gupta Signed-off-by: Dave Hansen Reviewed-by: Borislav Petkov (AMD) commit 9969779d0803f5dcd4460ae7aca2bc3fd91bff12 Author: Pawan Gupta Date: Thu Aug 14 10:20:42 2025 -0700 Documentation/hw-vuln: Add VMSCAPE documentation VMSCAPE is a vulnerability that may allow a guest to influence the branch prediction in host userspace, particularly affecting hypervisors like QEMU. Add the documentation. Signed-off-by: Pawan Gupta Signed-off-by: Dave Hansen Reviewed-by: Borislav Petkov (AMD) Reviewed-by: Dave Hansen commit 24ea63ea387714634813359e2c8e0e6c36952f73 Merge: c28d28a7b005dd 40f2f1aa625785 Author: Linus Torvalds Date: Thu Aug 14 08:20:58 2025 -0700 Merge tag 'acpi-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI fixes from Rafael Wysocki: "These restore corner case behavior of the EC driver related to the handling of defective ACPI tables and fix a recent regression in the ACPI processor driver: - Prevent the ACPI EC driver from ignoring ECDT information in the cases when the ID string in the ECDT is invalid, but not empty, to fix thouchpad detection on ThinkBook 14 G7 IML (Armin Wolf) - Rearrange checks in acpi_processor_ppc_init() to restore the handling of frequency QoS requests related to _PPC limits inadvertently broken by a recent update (Rafael Wysocki)" * tag 'acpi-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI: EC: Relax sanity check of the ECDT ID string ACPI: processor: perflib: Move problematic pr->performance check commit c28d28a7b005dd6459a6059dc7eff684bf0b7464 Merge: 63467137ecc0ff 5302e2a3886c83 Author: Linus Torvalds Date: Thu Aug 14 07:55:31 2025 -0700 Merge tag 'pm-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management fixes from Rafael Wysocki: "These remove an artificial limitation from the intel_idle driver, update the menu cpuidle governor to restore its previous behavior in a corner case and add one more supported platform configuration to the intel_pstate driver: - Allow intel_idle to use _CST information from ACPI tables for idle states enumeration on any family of processors (Len Brown) - Restore corner case behavior of the menu cpuidle governor, related to the handling of systems where idle states selected by the governor are rejected by the cpuidle driver, inadvertently changed during the 6.15 development cycle (Rafael Wysocki) - Add support for Clearwater Forest in the out-of-band (OOB) mode to the intel_pstate driver (Srinivas Pandruvada)" * tag 'pm-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: cpufreq: intel_pstate: Support Clearwater Forest OOB mode cpuidle: governors: menu: Avoid using invalid recent intervals data intel_idle: Allow loading ACPI tables for any family commit 94eae6ee4c2df2031bca586405e9ec36e0b9ccf8 Author: Michał Winiarski Date: Tue May 27 14:06:37 2025 +0200 drm/xe/pf: Set VF LMEM BAR size LMEM is partitioned between multiple VFs and we expect that the more VFs we have, the less LMEM is assigned to each VF. This means that we can achieve full LMEM BAR access without the need to attempt full VF LMEM BAR resize via pci_resize_resource(). Always try to set the largest possible BAR size that allows to fit the number of enabled VFs and inform the user in case the resize attempt is not successful. Signed-off-by: Michał Winiarski Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250527120637.665506-7-michal.winiarski@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 32a4d1b98e6663101fd0abfaf151c48feea7abb1) Signed-off-by: Rodrigo Vivi commit 63467137ecc0ff6f804d53903ad87a2f0397a18b Merge: 0cc53520e68bea 4faff70959d510 Author: Linus Torvalds Date: Thu Aug 14 07:14:30 2025 -0700 Merge tag 'net-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from Netfilter and IPsec. Current release - regressions: - netfilter: nft_set_pipapo: - don't return bogus extension pointer - fix null deref for empty set Current release - new code bugs: - core: prevent deadlocks when enabling NAPIs with mixed kthread config - eth: netdevsim: Fix wild pointer access in nsim_queue_free(). Previous releases - regressions: - page_pool: allow enabling recycling late, fix false positive warning - sched: ets: use old 'nbands' while purging unused classes - xfrm: - restore GSO for SW crypto - bring back device check in validate_xmit_xfrm - tls: handle data disappearing from under the TLS ULP - ptp: prevent possible ABBA deadlock in ptp_clock_freerun() - eth: - bnxt: fill data page pool with frags if PAGE_SIZE > BNXT_RX_PAGE_SIZE - hv_netvsc: fix panic during namespace deletion with VF Previous releases - always broken: - netfilter: fix refcount leak on table dump - vsock: do not allow binding to VMADDR_PORT_ANY - sctp: linearize cloned gso packets in sctp_rcv - eth: - hibmcge: fix the division by zero issue - microchip: fix KSZ8863 reset problem" * tag 'net-6.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (54 commits) net: usb: asix_devices: add phy_mask for ax88772 mdio bus net: kcm: Fix race condition in kcm_unattach() selftests: net/forwarding: test purge of active DWRR classes net/sched: ets: use old 'nbands' while purging unused classes bnxt: fill data page pool with frags if PAGE_SIZE > BNXT_RX_PAGE_SIZE netdevsim: Fix wild pointer access in nsim_queue_free(). net: mctp: Fix bad kfree_skb in bind lookup test netfilter: nf_tables: reject duplicate device on updates ipvs: Fix estimator kthreads preferred affinity netfilter: nft_set_pipapo: fix null deref for empty set selftests: tls: test TCP stealing data from under the TLS socket tls: handle data disappearing from under the TLS ULP ptp: prevent possible ABBA deadlock in ptp_clock_freerun() ixgbe: prevent from unwanted interface name changes devlink: let driver opt out of automatic phys_port_name generation net: prevent deadlocks when enabling NAPIs with mixed kthread config net: update NAPI threaded config even for disabled NAPIs selftests: drv-net: don't assume device has only 2 queues docs: Fix name for net.ipv4.udp_child_hash_entries riscv: dts: thead: Add APB clocks for TH1520 GMACs ... commit f5b1819193667bf62c3c99d3921b9429997a14b2 Author: Louis-Alexis Eyraud Date: Tue Jul 1 09:30:40 2025 +0200 drm/mediatek: dsi: Fix DSI host and panel bridge pre-enable order Since commit c9b1150a68d9 ("drm/atomic-helper: Re-order bridge chain pre-enable and post-disable"), the bridge pre_enable callbacks are now called before crtc enable, and the bridge post_disable callbacks after the crtc disable. In the mediatek-drm driver, this change leads to transfer errors on mtk_dsi_host_transfer callback processing during the panel bridge pre-enable sequence because the DSI host bridge pre_enable and CRTC enable sequences, that are enabling the required clocks and PHY using mtk_dsi_poweron function, are called after. So, in order to fix this call order issue, request the DSI host bridge be pre-enabled before panel bridge by setting pre_enable_prev_first flag on DSI device bridge in the mtk_dsi_host_attach function. Fixes: c9b1150a68d9 ("drm/atomic-helper: Re-order bridge chain pre-enable and post-disable") Signed-off-by: Louis-Alexis Eyraud Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/dri-devel/patch/20250701-mediatek-drm-fix-dsi-panel-init-v1-1-7af4adb9fdeb@collabora.com/ Signed-off-by: Chun-Kuang Hu commit 40f2f1aa62578547e2977e8c0516048e0b71018c Merge: 963e22c084c2b6 d405ec23df13e6 Author: Rafael J. Wysocki Date: Thu Aug 14 13:09:27 2025 +0200 Merge branches 'acpi-ec' and 'acpi-processor' * acpi-ec: ACPI: EC: Relax sanity check of the ECDT ID string * acpi-processor: ACPI: processor: perflib: Move problematic pr->performance check commit 5302e2a3886c830b803ae3390b9d41d35832f315 Merge: fa3fa55de0d617 3ead77989c20cb Author: Rafael J. Wysocki Date: Thu Aug 14 12:57:11 2025 +0200 Merge branches 'pm-cpuidle' and 'pm-cpufreq' * pm-cpuidle: cpuidle: governors: menu: Avoid using invalid recent intervals data intel_idle: Allow loading ACPI tables for any family * pm-cpufreq: cpufreq: intel_pstate: Support Clearwater Forest OOB mode commit a1b51534b532dd4f0499907865553ee9251bebc3 Author: Alex Elder Date: Tue Aug 12 22:13:35 2025 -0500 dt-bindings: serial: 8250: allow "main" and "uart" as clock names There are two compatible strings defined in "8250.yaml" that require two clocks to be specified, along with their names: - "spacemit,k1-uart", used in "spacemit/k1.dtsi" - "nxp,lpc1850-uart", used in "lpc/lpc18xx.dtsi" When only one clock is used, the name is not required. However there are two places that do specify a name: - In "mediatek/mt7623.dtsi", the clock for the "mediatek,mtk-btif" compatible serial device is named "main" - In "qca/ar9132.dtsi", the clock for the "ns8250" compatible serial device is named "uart" In commit d2db0d7815444 ("dt-bindings: serial: 8250: allow clock 'uartclk' and 'reg' for nxp,lpc1850-uart"), Frank Li added the restriction that two named clocks be used for the NXP platform mentioned above. Change that logic, so that an additional condition for (only) the SpacemiT platform similarly restricts the two clocks to have the names "core" and "bus". Finally, add "main" and "uart" as allowed names when a single clock is specified. Fixes: 2c0594f9f0629 ("dt-bindings: serial: 8250: support an optional second clock") Cc: stable Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507160314.wrC51lXX-lkp@intel.com/ Signed-off-by: Alex Elder Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250813031338.2328392-1-elder@riscstar.com Signed-off-by: Greg Kroah-Hartman commit 387d00028cccee7575f6416953bef62f849d83e3 Author: Alex Elder Date: Tue Aug 12 22:21:50 2025 -0500 dt-bindings: serial: 8250: move a constraint A block that required a "spacemit,k1-uart" compatible node to specify two clocks was placed in the wrong spot in the binding. Conor Dooley pointed out it belongs earlier in the file, as part of the initial "allOf". Fixes: 2c0594f9f0629 ("dt-bindings: serial: 8250: support an optional second clock") Cc: stable Reported-by: Conor Dooley Closes: https://lore.kernel.org/lkml/20250729-reshuffle-contented-e6def76b540b@spud/ Signed-off-by: Alex Elder Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250813032151.2330616-1-elder@riscstar.com Signed-off-by: Greg Kroah-Hartman commit ee047e1d85d73496541c54bd4f432c9464e13e65 Author: Krzysztof Kozlowski Date: Tue Aug 12 14:16:31 2025 +0200 dt-bindings: serial: brcm,bcm7271-uart: Constrain clocks Lists should have fixed constraints, because binding must be specific in respect to hardware, thus add missing constraints to number of clocks. Cc: stable Fixes: 88a499cd70d4 ("dt-bindings: Add support for the Broadcom UART driver") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250812121630.67072-2-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 535fd4c98452c87537a40610abba45daf5761ec6 Author: Hugo Villeneuve Date: Thu Jul 31 08:44:50 2025 -0400 serial: sc16is7xx: fix bug in flow control levels init When trying to set MCR[2], XON1 is incorrectly accessed instead. And when writing to the TCR register to configure flow control levels, we are incorrectly writing to the MSR register. The default value of $00 is then used for TCR, which means that selectable trigger levels in FCR are used in place of TCR. TCR/TLR access requires EFR[4] (enable enhanced functions) and MCR[2] to be set. EFR[4] is already set in probe(). MCR access requires LCR[7] to be zero. Since LCR is set to $BF when trying to set MCR[2], XON1 is incorrectly accessed instead because MCR shares the same address space as XON1. Since MCR[2] is unmodified and still zero, when writing to TCR we are in fact writing to MSR because TCR/TLR registers share the same address space as MSR/SPR. Fix by first removing useless reconfiguration of EFR[4] (enable enhanced functions), as it is already enabled in sc16is7xx_probe() since commit 43c51bb573aa ("sc16is7xx: make sure device is in suspend once probed"). Now LCR is $00, which means that MCR access is enabled. Also remove regcache_cache_bypass() calls since we no longer access the enhanced registers set, and TCR is already declared as volatile (in fact by declaring MSR as volatile, which shares the same address). Finally disable access to TCR/TLR registers after modifying them by clearing MCR[2]. Note: the comment about "... and internal clock div" is wrong and can be ignored/removed as access to internal clock div registers (DLL/DLH) is permitted only when LCR[7] is logic 1, not when enhanced features is enabled. And DLL/DLH access is not needed in sc16is7xx_startup(). Fixes: dfeae619d781 ("serial: sc16is7xx") Cc: stable@vger.kernel.org Signed-off-by: Hugo Villeneuve Link: https://lore.kernel.org/r/20250731124451.1108864-1-hugo@hugovil.com Signed-off-by: Greg Kroah-Hartman commit 58768b0563916ddcb73d8ed26ede664915f8df31 Author: Igor Pylypiv Date: Wed Aug 13 19:22:56 2025 -0700 ata: libata-scsi: Fix CDL control Delete extra checks for the ATA_DFLAG_CDL_ENABLED flag that prevent SET FEATURES command from being issued to a drive when NCQ commands are active. ata_mselect_control_ata_feature() sets / clears the ATA_DFLAG_CDL_ENABLED flag during the translation of MODE SELECT to SET FEATURES. If SET FEATURES gets deferred due to outstanding NCQ commands, the original MODE SELECT command will be re-queued. When the re-queued MODE SELECT goes through the ata_mselect_control_ata_feature() translation again, SET FEATURES will not be issued because ATA_DFLAG_CDL_ENABLED has been already set or cleared by the initial translation of MODE SELECT. The ATA_DFLAG_CDL_ENABLED checks in ata_mselect_control_ata_feature() are safe to remove because scsi_cdl_enable() implements a similar logic that avoids enabling CDL if it has been enabled already. Fixes: 17e897a45675 ("ata: libata-scsi: Improve CDL control") Cc: stable@vger.kernel.org Signed-off-by: Igor Pylypiv Reviewed-by: Niklas Cassel Signed-off-by: Damien Le Moal commit a52dffaa46c2c5ff0b311c4dc1288581f7b9109e Author: Piotr Zalewski Date: Sun Jul 6 08:36:58 2025 +0000 drm/rockchip: vop2: make vp registers nonvolatile Make video port registers nonvolatile. As DSP_CTRL register is written to twice due to gamma LUT enable bit which is set outside of the main DSP_CTRL initialization within atomic_enable (for rk356x case it is also necessary to always disable gamma LUT before writing a new LUT) there is a chance that DSP_CTRL value read-out in gamma LUT init/update code is not the one which was written by the preceding DSP_CTRL initialization code within atomic_enable. This might result in misconfigured DSP_CTRL which leads to no visual output[1]. Since DSP_CTRL write takes effect after VSYNC[1] the issue is not always present. When tested on Pinetab2 with kernel 6.14 it happenes only when DRM is compiled as a module[1]. In order to confirm that it is a timing issue I inserted 18ms udelay before vop2_crtc_atomic_try_set_gamma in atomic enable and compiled DRM as module - this has also fixed the issue. [1] https://lore.kernel.org/linux-rockchip/562b38e5.a496.1975f09f983.Coremail.andyshrk@163.com/ Reported-by: Diederik de Haas Closes: https://lore.kernel.org/linux-rockchip/DAEVDSTMWI1E.J454VZN0R9MA@cknow.org/ Suggested-by: Andy Yan Signed-off-by: Piotr Zalewski Tested-by: Diederik de Haas Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250706083629.140332-2-pZ010001011111@proton.me commit ea177a1b1efc6e42e73ee4a17581842cd254e006 Author: Rudi Heitbaum Date: Tue Aug 12 06:55:15 2025 +0000 drm/rockchip: cdn-dp: select bridge for cdp-dp Select drm bridge connector when building cdp-dp. This was missed in previous commit causing build failure. Fixes: afbbca25d06e ("drm/rockchip: cdn-dp: Convert to drm bridge") Signed-off-by: Rudi Heitbaum Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/aJrlUzV1u4i65NRe@8eba3d7b3083 commit 35f6bedccf4c4280f02d48e4f7d194e64e9a62d8 Author: Damien Le Moal Date: Wed Aug 13 18:08:53 2025 +0900 ata: libata-eh: Fix link state check for IDE/PATA ports Commit 4371fe1ba400 ("ata: libata-eh: Avoid unnecessary resets when revalidating devices") replaced the call to ata_phys_link_offline() in ata_eh_revalidate_and_attach() with the new function ata_eh_link_established() which relaxes the checks on a device link state to account for low power mode transitions. However, this change assumed that the device port has a valid scr_read method to obtain the SStatus register for the port. This is not always the case, especially with older IDE/PATA adapters (e.g. PATA/IDE devices emulated with QEMU). For such adapter, ata_eh_link_established() will always return false, causing ata_eh_revalidate_and_attach() to go into its error path and ultimately to the device being disabled. Avoid this by restoring the previous behavior, which is to assume that the link is online if reading the port SStatus register fails. While at it, also fix the spelling of SStatus in the comment describing the function ata_eh_link_established(). Reported-by: Shin'ichiro Kawasaki Fixes: 4371fe1ba400 ("ata: libata-eh: Avoid unnecessary resets when revalidating devices") Signed-off-by: Damien Le Moal Tested-by: Shin'ichiro Kawasaki Reviewed-by: Niklas Cassel commit c345102d1feed3de8aa9b9ec7d18b3fbba62deb7 Author: Baojun Xu Date: Wed Aug 13 18:08:42 2025 +0800 ALSA: hda/tas2781: Normalize the volume kcontrol name Change the name of the kcontrol from "Gain" to "Volume". Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20250813100842.12224-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit ecfd41166b72b67d3bdeb88d224ff445f6163869 Author: Takashi Iwai Date: Thu Aug 14 10:12:43 2025 +0200 ALSA: usb-audio: Validate UAC3 cluster segment descriptors UAC3 class segment descriptors need to be verified whether their sizes match with the declared lengths and whether they fit with the allocated buffer sizes, too. Otherwise malicious firmware may lead to the unexpected OOB accesses. Fixes: 11785ef53228 ("ALSA: usb-audio: Initial Power Domain support") Reported-and-tested-by: Youngjun Lee Cc: Link: https://patch.msgid.link/20250814081245.8902-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit d832ccbc301fbd9e5a1d691bdcf461cdb514595f Author: Takashi Iwai Date: Thu Aug 14 10:12:42 2025 +0200 ALSA: usb-audio: Validate UAC3 power domain descriptors, too UAC3 power domain descriptors need to be verified with its variable bLength for avoiding the unexpected OOB accesses by malicious firmware, too. Fixes: 9a2fe9b801f5 ("ALSA: usb: initial USB Audio Device Class 3.0 support") Reported-and-tested-by: Youngjun Lee Cc: Link: https://patch.msgid.link/20250814081245.8902-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 4faff70959d51078f9ee8372f8cff0d7045e4114 Author: Xu Yang Date: Mon Aug 11 17:29:31 2025 +0800 net: usb: asix_devices: add phy_mask for ax88772 mdio bus Without setting phy_mask for ax88772 mdio bus, current driver may create at most 32 mdio phy devices with phy address range from 0x00 ~ 0x1f. DLink DUB-E100 H/W Ver B1 is such a device. However, only one main phy device will bind to net phy driver. This is creating issue during system suspend/resume since phy_polling_mode() in phy_state_machine() will directly deference member of phydev->drv for non-main phy devices. Then NULL pointer dereference issue will occur. Due to only external phy or internal phy is necessary, add phy_mask for ax88772 mdio bus to workarnoud the issue. Closes: https://lore.kernel.org/netdev/20250806082931.3289134-1-xu.yang_2@nxp.com Fixes: e532a096be0e ("net: usb: asix: ax88772: add phylib support") Cc: stable@vger.kernel.org Signed-off-by: Xu Yang Tested-by: Oleksij Rempel Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250811092931.860333-1-xu.yang_2@nxp.com Signed-off-by: Paolo Abeni commit e26ad671172fb1ee4294a10183ad48fd42e94ccc Merge: ee8f1613596ad4 47ed64db8c17eb Author: Takashi Iwai Date: Thu Aug 14 08:33:44 2025 +0200 Merge tag 'asoc-fix-v6.17-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.17 A reasonably small collection of fixes that came in since the merge window, mostly small and driver specific plus a cleanup of the menu reorganisation to address some user confusion with the way the generic drivers had been handled. commit 0cc53520e68bea7fb80fdc6bdf8d226d1b6a98d9 Merge: dfc0f6373094dd e2f9ae91619add Author: Linus Torvalds Date: Wed Aug 13 20:23:32 2025 -0700 Merge tag 'probes-fixes-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fix from Masami Hiramatsu: - MAINTAINERS: Remove bouncing kprobes maintainer * tag 'probes-fixes-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: MAINTAINERS: Remove bouncing kprobes maintainer commit e2f9ae91619add9884428d095c3c630b6b120a61 Author: Dave Hansen Date: Thu Aug 14 11:38:58 2025 +0900 MAINTAINERS: Remove bouncing kprobes maintainer The kprobes MAINTAINERS entry includes anil.s.keshavamurthy@intel.com. That address is bouncing. Remove it. This still leaves three other listed maintainers. Link: https://lore.kernel.org/all/20250808180124.7DDE2ECD@davehans-spike.ostc.intel.com/ Signed-off-by: Dave Hansen Cc: Naveen N Rao Cc: "David S. Miller" Cc: Masami Hiramatsu Cc: linux-trace-kernel@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit 52565a935213cd6a8662ddb8efe5b4219343a25d Author: Sven Stegemann Date: Tue Aug 12 21:18:03 2025 +0200 net: kcm: Fix race condition in kcm_unattach() syzbot found a race condition when kcm_unattach(psock) and kcm_release(kcm) are executed at the same time. kcm_unattach() is missing a check of the flag kcm->tx_stopped before calling queue_work(). If the kcm has a reserved psock, kcm_unattach() might get executed between cancel_work_sync() and unreserve_psock() in kcm_release(), requeuing kcm->tx_work right before kcm gets freed in kcm_done(). Remove kcm->tx_stopped and replace it by the less error-prone disable_work_sync(). Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Reported-by: syzbot+e62c9db591c30e174662@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e62c9db591c30e174662 Reported-by: syzbot+d199b52665b6c3069b94@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=d199b52665b6c3069b94 Reported-by: syzbot+be6b1fdfeae512726b4e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=be6b1fdfeae512726b4e Signed-off-by: Sven Stegemann Link: https://patch.msgid.link/20250812191810.27777-1-sven@stegemann.de Signed-off-by: Jakub Kicinski commit 1c756093cdc1fd9973e156f527a08731795d41a2 Merge: 212122775ea78f 774a2ae6617b30 Author: Jakub Kicinski Date: Wed Aug 13 18:11:56 2025 -0700 Merge branch 'ets-use-old-nbands-while-purging-unused-classes' Davide Caratti says: ==================== ets: use old 'nbands' while purging unused classes - patch 1/2 fixes a NULL dereference in the control path of sch_ets qdisc - patch 2/2 extends kselftests to verify effectiveness of the above fix ==================== Link: https://patch.msgid.link/cover.1755016081.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 774a2ae6617b30a4dcc7ebaf178ef05da05b2a47 Author: Davide Caratti Date: Tue Aug 12 18:40:30 2025 +0200 selftests: net/forwarding: test purge of active DWRR classes Extend sch_ets.sh to add a reproducer for problematic list deletions when active DWRR class are purged by ets_qdisc_change() [1] [2]. [1] https://lore.kernel.org/netdev/e08c7f4a6882f260011909a868311c6e9b54f3e4.1639153474.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/f3b9bacc73145f265c19ab80785933da5b7cbdec.1754581577.git.dcaratti@redhat.com/ Suggested-by: Victor Nogueira Signed-off-by: Davide Caratti Acked-by: Victor Nogueira Link: https://patch.msgid.link/489497cb781af7389011ca1591fb702a7391f5e7.1755016081.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 87c6efc5ce9c126ae4a781bc04504b83780e3650 Author: Davide Caratti Date: Tue Aug 12 18:40:29 2025 +0200 net/sched: ets: use old 'nbands' while purging unused classes Shuang reported sch_ets test-case [1] crashing in ets_class_qlen_notify() after recent changes from Lion [2]. The problem is: in ets_qdisc_change() we purge unused DWRR queues; the value of 'q->nbands' is the new one, and the cleanup should be done with the old one. The problem is here since my first attempts to fix ets_qdisc_change(), but it surfaced again after the recent qdisc len accounting fixes. Fix it purging idle DWRR queues before assigning a new value of 'q->nbands', so that all purge operations find a consistent configuration: - old 'q->nbands' because it's needed by ets_class_find() - old 'q->nstrict' because it's needed by ets_class_is_strict() BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 62 UID: 0 PID: 39457 Comm: tc Kdump: loaded Not tainted 6.12.0-116.el10.x86_64 #1 PREEMPT(voluntary) Hardware name: Dell Inc. PowerEdge R640/06DKY5, BIOS 2.12.2 07/09/2021 RIP: 0010:__list_del_entry_valid_or_report+0x4/0x80 Code: ff 4c 39 c7 0f 84 39 19 8e ff b8 01 00 00 00 c3 cc cc cc cc 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa <48> 8b 17 48 8b 4f 08 48 85 d2 0f 84 56 19 8e ff 48 85 c9 0f 84 ab RSP: 0018:ffffba186009f400 EFLAGS: 00010202 RAX: 00000000000000d6 RBX: 0000000000000000 RCX: 0000000000000004 RDX: ffff9f0fa29b69c0 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffffc12c2400 R08: 0000000000000008 R09: 0000000000000004 R10: ffffffffffffffff R11: 0000000000000004 R12: 0000000000000000 R13: ffff9f0f8cfe0000 R14: 0000000000100005 R15: 0000000000000000 FS: 00007f2154f37480(0000) GS:ffff9f269c1c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000001530be001 CR4: 00000000007726f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: ets_class_qlen_notify+0x65/0x90 [sch_ets] qdisc_tree_reduce_backlog+0x74/0x110 ets_qdisc_change+0x630/0xa40 [sch_ets] __tc_modify_qdisc.constprop.0+0x216/0x7f0 tc_modify_qdisc+0x7c/0x120 rtnetlink_rcv_msg+0x145/0x3f0 netlink_rcv_skb+0x53/0x100 netlink_unicast+0x245/0x390 netlink_sendmsg+0x21b/0x470 ____sys_sendmsg+0x39d/0x3d0 ___sys_sendmsg+0x9a/0xe0 __sys_sendmsg+0x7a/0xd0 do_syscall_64+0x7d/0x160 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f2155114084 Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d 25 f0 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 RSP: 002b:00007fff1fd7a988 EFLAGS: 00000202 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000560ec063e5e0 RCX: 00007f2155114084 RDX: 0000000000000000 RSI: 00007fff1fd7a9f0 RDI: 0000000000000003 RBP: 00007fff1fd7aa60 R08: 0000000000000010 R09: 000000000000003f R10: 0000560ee9b3a010 R11: 0000000000000202 R12: 00007fff1fd7aae0 R13: 000000006891ccde R14: 0000560ec063e5e0 R15: 00007fff1fd7aad0 [1] https://lore.kernel.org/netdev/e08c7f4a6882f260011909a868311c6e9b54f3e4.1639153474.git.dcaratti@redhat.com/ [2] https://lore.kernel.org/netdev/d912cbd7-193b-4269-9857-525bee8bbb6a@gmail.com/ Cc: stable@vger.kernel.org Fixes: 103406b38c60 ("net/sched: Always pass notifications when child class becomes empty") Fixes: c062f2a0b04d ("net/sched: sch_ets: don't remove idle classes from the round-robin list") Fixes: dcc68b4d8084 ("net: sch_ets: Add a new Qdisc") Reported-by: Li Shuang Closes: https://issues.redhat.com/browse/RHEL-108026 Reviewed-by: Petr Machata Co-developed-by: Ivan Vecera Signed-off-by: Ivan Vecera Signed-off-by: Davide Caratti Link: https://patch.msgid.link/7928ff6d17db47a2ae7cc205c44777b1f1950545.1755016081.git.dcaratti@redhat.com Signed-off-by: Jakub Kicinski commit 212122775ea78ffe0508ee7ed08a9c2b980f09e2 Merge: 39f8fcda208838 e67a0bc3ed4fd8 Author: Jakub Kicinski Date: Wed Aug 13 17:31:46 2025 -0700 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue Tony Nguyen says: ==================== ixgbe: bypass devlink phys_port_name generation Jedrzej adds option to skip phys_port_name generation and opts ixgbe into it as some configurations rely on pre-devlink naming which could end up broken as a result. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue: ixgbe: prevent from unwanted interface name changes devlink: let driver opt out of automatic phys_port_name generation ==================== Link: https://patch.msgid.link/20250812205226.1984369-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 39f8fcda2088382a4aa70b258d6f7225aa386f11 Author: David Wei Date: Tue Aug 12 11:29:07 2025 -0700 bnxt: fill data page pool with frags if PAGE_SIZE > BNXT_RX_PAGE_SIZE The data page pool always fills the HW rx ring with pages. On arm64 with 64K pages, this will waste _at least_ 32K of memory per entry in the rx ring. Fix by fragmenting the pages if PAGE_SIZE > BNXT_RX_PAGE_SIZE. This makes the data page pool the same as the header pool. Tested with iperf3 with a small (64 entries) rx ring to encourage buffer circulation. Fixes: cd1fafe7da1f ("eth: bnxt: add support rx side device memory TCP") Reviewed-by: Michael Chan Signed-off-by: David Wei Link: https://patch.msgid.link/20250812182907.1540755-1-dw@davidwei.uk Signed-off-by: Jakub Kicinski commit b2cafefaf0473bafb0c3502a8530167d35e06113 Author: Kuniyuki Iwashima Date: Tue Aug 12 16:21:26 2025 +0000 netdevsim: Fix wild pointer access in nsim_queue_free(). syzbot reported the splat below. [0] When nsim_queue_uninit() is called from nsim_init_netdevsim(), register_netdevice() has not been called, thus dev->dstats has not been allocated. Let's not call dev_dstats_rx_dropped_add() in such a case. [0] BUG: unable to handle page fault for address: ffff88809782c020 PF: supervisor write access in kernel mode PF: error_code(0x0002) - not-present page PGD 1b401067 P4D 1b401067 PUD 0 Oops: Oops: 0002 [#1] SMP KASAN NOPTI CPU: 3 UID: 0 PID: 8476 Comm: syz.1.251 Not tainted 6.16.0-syzkaller-06699-ge8d780dcd957 #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:local_add arch/x86/include/asm/local.h:33 [inline] RIP: 0010:u64_stats_add include/linux/u64_stats_sync.h:89 [inline] RIP: 0010:dev_dstats_rx_dropped_add include/linux/netdevice.h:3027 [inline] RIP: 0010:nsim_queue_free+0xba/0x120 drivers/net/netdevsim/netdev.c:714 Code: 07 77 6c 4a 8d 3c ed 20 7e f1 8d 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 46 4a 03 1c ed 20 7e f1 8d <4c> 01 63 20 be 00 02 00 00 48 8d 3d 00 00 00 00 e8 61 2f 58 fa 48 RSP: 0018:ffffc900044af150 EFLAGS: 00010286 RAX: dffffc0000000000 RBX: ffff88809782c000 RCX: 00000000000079c3 RDX: 1ffffffff1be2fc7 RSI: ffffffff8c15f380 RDI: ffffffff8df17e38 RBP: ffff88805f59d000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000003 R14: ffff88806ceb3d00 R15: ffffed100dfd308e FS: 0000000000000000(0000) GS:ffff88809782c000(0063) knlGS:00000000f505db40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: ffff88809782c020 CR3: 000000006fc6a000 CR4: 0000000000352ef0 Call Trace: nsim_queue_uninit drivers/net/netdevsim/netdev.c:993 [inline] nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1049 [inline] nsim_create+0xd0a/0x1260 drivers/net/netdevsim/netdev.c:1101 __nsim_dev_port_add+0x435/0x7d0 drivers/net/netdevsim/dev.c:1438 nsim_dev_port_add_all drivers/net/netdevsim/dev.c:1494 [inline] nsim_dev_reload_create drivers/net/netdevsim/dev.c:1546 [inline] nsim_dev_reload_up+0x5b8/0x860 drivers/net/netdevsim/dev.c:1003 devlink_reload+0x322/0x7c0 net/devlink/dev.c:474 devlink_nl_reload_doit+0xe31/0x1410 net/devlink/dev.c:584 genl_family_rcv_msg_doit+0x206/0x2f0 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x55c/0x800 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg net/socket.c:729 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2614 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2668 __sys_sendmsg+0x16d/0x220 net/socket.c:2700 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0x7c/0x3a0 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x32/0x80 arch/x86/entry/syscall_32.c:331 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf708e579 Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f505d55c EFLAGS: 00000296 ORIG_RAX: 0000000000000172 RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000080 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: CR2: ffff88809782c020 Fixes: 2a68a22304f9 ("netdevsim: account dropped packet length in stats on queue free") Reported-by: syzbot+8aa80c6232008f7b957d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/688bb9ca.a00a0220.26d0e1.0050.GAE@google.com/ Suggested-by: Jakub Kicinski Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250812162130.4129322-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit a58893aa173923fdc49c2d35d638d8133065e952 Author: Matt Johnston Date: Tue Aug 12 13:08:58 2025 +0800 net: mctp: Fix bad kfree_skb in bind lookup test The kunit test's skb_pkt is consumed by mctp_dst_input() so shouldn't be freed separately. Fixes: e6d8e7dbc5a3 ("net: mctp: Add bind lookup test") Reported-by: Alexandre Ghiti Closes: https://lore.kernel.org/all/734b02a3-1941-49df-a0da-ec14310d41e4@ghiti.fr/ Signed-off-by: Matt Johnston Tested-by: Alexandre Ghiti Link: https://patch.msgid.link/20250812-fix-mctp-bind-test-v1-1-5e2128664eb3@codeconstruct.com.au Signed-off-by: Jakub Kicinski commit 75a7b151e808355a1fdf972e85da137612b8f2ae Author: Danilo Krummrich Date: Tue Aug 12 15:09:06 2025 +0200 rust: devres: fix leaking call to devm_add_action() When the data argument of Devres::new() is Err(), we leak the preceding call to devm_add_action(). In order to fix this, call devm_add_action() in a unit type initializer in try_pin_init!() after the initializers of all other fields. Fixes: f5d3ef25d238 ("rust: devres: get rid of Devres' inner Arc") Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250812130928.11075-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 0c6b24d70da21201ed009a2aca740d2dfddc7ab5 Author: Jason-JH Lin Date: Mon Jul 28 10:48:50 2025 +0800 drm/mediatek: Add error handling for old state CRTC in atomic_disable Introduce error handling to address an issue where, after a hotplug event, the cursor continues to update. This situation can lead to a kernel panic due to accessing the NULL `old_state->crtc`. E,g. Unable to handle kernel NULL pointer dereference at virtual address Call trace: mtk_crtc_plane_disable+0x24/0x140 mtk_plane_atomic_update+0x8c/0xa8 drm_atomic_helper_commit_planes+0x114/0x2c8 drm_atomic_helper_commit_tail_rpm+0x4c/0x158 commit_tail+0xa0/0x168 drm_atomic_helper_commit+0x110/0x120 drm_atomic_commit+0x8c/0xe0 drm_atomic_helper_update_plane+0xd4/0x128 __setplane_atomic+0xcc/0x110 drm_mode_cursor_common+0x250/0x440 drm_mode_cursor_ioctl+0x44/0x70 drm_ioctl+0x264/0x5d8 __arm64_sys_ioctl+0xd8/0x510 invoke_syscall+0x6c/0xe0 do_el0_svc+0x68/0xe8 el0_svc+0x34/0x60 el0t_64_sync_handler+0x1c/0xf8 el0t_64_sync+0x180/0x188 Adding NULL pointer checks to ensure stability by preventing operations on an invalid CRTC state. Fixes: d208261e9f7c ("drm/mediatek: Add wait_event_timeout when disabling plane") Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: CK Hu Link: https://patchwork.kernel.org/project/linux-mediatek/patch/20250728025036.24953-1-jason-jh.lin@mediatek.com/ Signed-off-by: Chun-Kuang Hu commit 68ad07df92faf4d7842199820ffb2b96702d0cfa Merge: f858f63e1df68b aa5fc4362fac93 Author: Dave Airlie Date: Thu Aug 14 08:16:25 2025 +1000 Merge tag 'amd-drm-fixes-6.17-2025-08-13' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes amd-drm-fixes-6.17-2025-08-13: amdgpu: - PSP fix - VRAM reservation fix - CSA fix - Process kill fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250813151905.2040816-1-alexander.deucher@amd.com commit 3bfc778297ecf9348056cec65e2ac6c26a1419d1 Merge: d7e82594a45c5c cf5fb87fcdaaaa Author: Jakub Kicinski Date: Wed Aug 13 14:51:51 2025 -0700 Merge tag 'nf-25-08-13' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Florian Westphal says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for *net*: 1) I managed to add a null dereference crash in nft_set_pipapo in the current development cycle, was not caught by CI because the avx2 implementation is fine, but selftest splats when run on non-avx2 host. 2) Fix the ipvs estimater kthread affinity, was incorrect since 6.14. From Frederic Weisbecker. 3) nf_tables should not allow to add a device to a flowtable or netdev chain more than once -- reject this. From Pablo Neira Ayuso. This has been broken for long time, blamed commit dates from v5.8. * tag 'nf-25-08-13' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nf_tables: reject duplicate device on updates ipvs: Fix estimator kthreads preferred affinity netfilter: nft_set_pipapo: fix null deref for empty set ==================== Link: https://patch.msgid.link/20250813113800.20775-1-fw@strlen.de Signed-off-by: Jakub Kicinski commit f858f63e1df68bfe4aaa251746e7a0baff53fece Merge: 8f5ae30d69d754 54d4f445517fe8 Author: Dave Airlie Date: Thu Aug 14 07:50:40 2025 +1000 Merge tag 'drm-misc-next-fixes-2025-08-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes Short summary of fixes pull: bridge: - fix OF-node leak - fix documentation fbdev-emulation: - pass correct format info to drm_helper_mode_fill_fb_struct() panfrost: - print correct RSS size Signed-off-by: Dave Airlie From: Thomas Zimmermann Link: https://lore.kernel.org/r/20250812064712.GA14554@2a02-2454-fd5e-fd00-2c49-c639-c55f-a125.dyn6.pyur.net commit dfc0f6373094dd88e1eaf76c44f2ff01b65db851 Merge: 3a4a0367c9f45b 0b96d9bed324a1 Author: Linus Torvalds Date: Wed Aug 13 11:29:27 2025 -0700 Merge tag 'erofs-for-6.17-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs fixes from Gao Xiang: - Align FSDAX enablement among multiple devices - Fix EROFS_FS_ZIP_ACCEL build dependency again to prevent forcing CRYPTO{,_DEFLATE}=y even if EROFS=m - Fix atomic context detection to properly launch kworkers on demand - Fix block count statistics for 48-bit addressing support * tag 'erofs-for-6.17-rc2-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: fix block count report when 48-bit layout is on erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC erofs: Do not select tristate symbols from bool symbols erofs: Fallback to normal access if DAX is not supported on extra device commit 9d98cf4632258720f18265a058e62fde120c0151 Author: Baokun Li Date: Tue Aug 12 14:37:52 2025 +0800 jbd2: prevent softlockup in jbd2_log_do_checkpoint() Both jbd2_log_do_checkpoint() and jbd2_journal_shrink_checkpoint_list() periodically release j_list_lock after processing a batch of buffers to avoid long hold times on the j_list_lock. However, since both functions contend for j_list_lock, the combined time spent waiting and processing can be significant. jbd2_journal_shrink_checkpoint_list() explicitly calls cond_resched() when need_resched() is true to avoid softlockups during prolonged operations. But jbd2_log_do_checkpoint() only exits its loop when need_resched() is true, relying on potentially sleeping functions like __flush_batch() or wait_on_buffer() to trigger rescheduling. If those functions do not sleep, the kernel may hit a softlockup. watchdog: BUG: soft lockup - CPU#3 stuck for 156s! [kworker/u129:2:373] CPU: 3 PID: 373 Comm: kworker/u129:2 Kdump: loaded Not tainted 6.6.0+ #10 Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.27 06/13/2017 Workqueue: writeback wb_workfn (flush-7:2) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : native_queued_spin_lock_slowpath+0x358/0x418 lr : jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] Call trace: native_queued_spin_lock_slowpath+0x358/0x418 jbd2_log_do_checkpoint+0x31c/0x438 [jbd2] __jbd2_log_wait_for_space+0xfc/0x2f8 [jbd2] add_transaction_credits+0x3bc/0x418 [jbd2] start_this_handle+0xf8/0x560 [jbd2] jbd2__journal_start+0x118/0x228 [jbd2] __ext4_journal_start_sb+0x110/0x188 [ext4] ext4_do_writepages+0x3dc/0x740 [ext4] ext4_writepages+0xa4/0x190 [ext4] do_writepages+0x94/0x228 __writeback_single_inode+0x48/0x318 writeback_sb_inodes+0x204/0x590 __writeback_inodes_wb+0x54/0xf8 wb_writeback+0x2cc/0x3d8 wb_do_writeback+0x2e0/0x2f8 wb_workfn+0x80/0x2a8 process_one_work+0x178/0x3e8 worker_thread+0x234/0x3b8 kthread+0xf0/0x108 ret_from_fork+0x10/0x20 So explicitly call cond_resched() in jbd2_log_do_checkpoint() to avoid softlockup. Cc: stable@kernel.org Signed-off-by: Baokun Li Link: https://patch.msgid.link/20250812063752.912130-1-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o commit 757fc66da91b54d4fbc414bee5c440b52560d3b7 Author: Baolin Liu Date: Tue Aug 12 10:17:09 2025 +0800 ext4: fix incorrect function name in comment Since commit 6b730a405037 “ext4: hoist ext4_block_write_begin and replace the __block_write_begin”, the comment should be updated accordingly from "__block_write_begin" to "ext4_block_write_begin". Fixes: 6b730a405037 (“ext4: hoist ext4_block_write_begin and replace...") Signed-off-by: Baolin Liu Reviewed-by: Darrick J. Wong Link: https://patch.msgid.link/20250812021709.1120716-1-liubaolin12138@163.com Signed-off-by: Theodore Ts'o commit 0b6974bb4134ca6396752a0b122026b41300592f Author: Luca Weiss Date: Wed Jul 23 16:19:22 2025 +0200 soc: qcom: ubwc: Add missing UBWC config for SM7225 SM7225 is a variation of SM6350, and also needs an entry in the table. Fixes: 1924272b9ce1 ("soc: qcom: Add UBWC config provider") Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Acked-by: Bjorn Andersson Signed-off-by: Dmitry Baryshkov commit 197713d0cf018e7d58a63a83cc43035b56678a50 Author: Dmitry Baryshkov Date: Wed Jul 23 16:33:43 2025 +0300 soc: qcom: ubwc: provide no-UBWC configuration After the commit 45a2974157d2 ("drm/msm: Use the central UBWC config database") the MDSS driver errors out if UBWC database didn't provide it with the UBWC configuration. Make UBWC database return zero data for MSM8916 / APQ8016, MSM8974 / APQ8074, MSM8226 and MSM8939. Fixes: 1924272b9ce1 ("soc: qcom: Add UBWC config provider") Acked-by: Bjorn Andersson Reviewed-by: Rob Clark Reviewed-by: Konrad Dybcio Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/665313/ Link: https://lore.kernel.org/r/20250723-ubwc-no-ubwc-v3-1-81bdb75685bf@oss.qualcomm.com commit daab47925c06a04792ca720d8438abd37775e357 Author: Nathan Chancellor Date: Tue Jul 15 16:27:35 2025 -0700 drm/msm/dpu: Initialize crtc_state to NULL in dpu_plane_virtual_atomic_check() After a recent change in clang to expose uninitialized warnings from const variables and pointers [1], there is a warning around crtc_state in dpu_plane_virtual_atomic_check(): drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1145:6: error: variable 'crtc_state' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] 1145 | if (plane_state->crtc) | ^~~~~~~~~~~~~~~~~ drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1149:58: note: uninitialized use occurs here 1149 | ret = dpu_plane_atomic_check_nosspp(plane, plane_state, crtc_state); | ^~~~~~~~~~ drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1145:2: note: remove the 'if' if its condition is always true 1145 | if (plane_state->crtc) | ^~~~~~~~~~~~~~~~~~~~~~ 1146 | crtc_state = drm_atomic_get_new_crtc_state(state, drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c:1139:35: note: initialize the variable 'crtc_state' to silence this warning 1139 | struct drm_crtc_state *crtc_state; | ^ | = NULL Initialize crtc_state to NULL like other places in the driver do, so that it is consistently initialized. Cc: stable@vger.kernel.org Closes: https://github.com/ClangBuiltLinux/linux/issues/2106 Fixes: 774bcfb73176 ("drm/msm/dpu: add support for virtual planes") Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] Signed-off-by: Nathan Chancellor Reviewed-by: Jessica Zhang Signed-off-by: Dmitry Baryshkov commit 494045c561e68945b1183ff416b8db8e37a122d6 Author: Ayushi Makhija Date: Wed Jul 30 18:09:38 2025 +0530 drm/msm: update the high bitfield of certain DSI registers Currently, the high bitfield of certain DSI registers do not align with the configuration of the SWI registers description. This can lead to wrong programming these DSI registers, for example for 4k resloution where H_TOTAL is taking 13 bits but software is programming only 12 bits because of the incorrect bitmask for H_TOTAL bitfeild, this is causing DSI FIFO errors. To resolve this issue, increase the high bitfield of the DSI registers from 12 bits to 16 bits in dsi.xml to match the SWI register configuration. Signed-off-by: Ayushi Makhija Fixes: 4f52f5e63b62 ("drm/msm: import XML display registers database") Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/666229/ Link: https://lore.kernel.org/r/20250730123938.1038640-1-quic_amakhija@quicinc.com Signed-off-by: Dmitry Baryshkov commit 3a4a0367c9f45b025ec57e1ba492512d5479d361 Merge: 91325f31afc102 61399e0c541056 Author: Linus Torvalds Date: Wed Aug 13 10:23:28 2025 -0700 Merge tag 'rcu.fixes.6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU fix from Neeraj Upadhyay: "Fix a regression introduced by commit b41642c87716 ("rcu: Fix rcu_read_unlock() deadloop due to IRQ work") which results in boot hang as reported by kernel test bot at [1]. This issue happens because RCU re-initializes the deferred QS IRQ work everytime it is queued. With commit b41642c87716, the IRQ work re-initialization can happen while it is already queued. This results in IRQ work being requeued to itself. When IRQ work finally fires, as it is requeued to itself, it is repeatedly executed and results in hang. Fix this with initializing the IRQ work only once before the CPU boots" Link: https://lore.kernel.org/rcu/202508071303.c1134cce-lkp@intel.com/ [1] * tag 'rcu.fixes.6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: rcu: Fix racy re-initialization of irq_work causing hangs commit 1a76b255eceb9c570c6228f6393e1d63d97a22ba Author: Dmitry Baryshkov Date: Tue Jul 15 20:28:18 2025 +0300 drm/msm/dpu: correct dpu_plane_virtual_atomic_check() Fix c&p error in dpu_plane_virtual_atomic_check(), compare CRTC width too, in addition to CRTC height. Fixes: 8c62a31607f6 ("drm/msm/dpu: allow using two SSPP blocks for a single plane") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507150432.U0cALR6W-lkp@intel.com/ Signed-off-by: Dmitry Baryshkov Reviewed-by: Jessica Zhang Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/664170/ Link: https://lore.kernel.org/r/20250715-msm-fix-virt-atomic-check-v1-1-9bab02c9f952@oss.qualcomm.com commit 553666f839b86545300773954df7426a45c169c4 Author: Dmitry Baryshkov Date: Tue Jul 15 18:50:37 2025 +0300 drm/msm/kms: move snapshot init earlier in KMS init Various parts of the display driver can be triggering the display snapshot (including the IOMMU fault handlers). Move the call to msm_disp_snapshot_init() before KMS initialization, otherwise it is possible to ocassionally trigger the kernel fault during init: __lock_acquire+0x44/0x2798 (P) lock_acquire+0x114/0x25c _raw_spin_lock_irqsave+0x6c/0x90 kthread_queue_work+0x2c/0xac msm_disp_snapshot_state+0x2c/0x4c msm_kms_fault_handler+0x2c/0x74 msm_disp_fault_handler+0x30/0x48 report_iommu_fault+0x54/0x128 arm_smmu_context_fault+0x74/0x184 __handle_irq_event_percpu+0xa4/0x24c handle_irq_event_percpu+0x20/0x5c handle_irq_event+0x48/0x84 handle_fasteoi_irq+0xcc/0x170 generic_handle_domain_irq+0x48/0x70 gic_handle_irq+0x54/0x11c call_on_irq_stack+0x3c/0x50 do_interrupt_handler+0x54/0x78 el1_interrupt+0x3c/0x5c el1h_64_irq_handler+0x20/0x30 el1h_64_irq+0x6c/0x70 _raw_spin_unlock_irqrestore+0x44/0x68 (P) klist_next+0xc4/0x124 bus_for_each_drv+0x9c/0xe8 __device_attach+0xfc/0x190 device_initial_probe+0x1c/0x2c bus_probe_device+0x44/0xa0 device_add+0x204/0x3e4 platform_device_add+0x170/0x244 platform_device_register_full+0x130/0x138 drm_connector_hdmi_audio_init+0xc0/0x108 drm_bridge_connector_init+0x318/0x394 msm_dsi_manager_connector_init+0xac/0xdc msm_dsi_modeset_init+0x78/0xc0 _dpu_kms_drm_obj_init+0x198/0x75c dpu_kms_hw_init+0x2f8/0x494 msm_drm_kms_init+0xb0/0x230 msm_drm_init+0x218/0x250 msm_drm_bind+0x3c/0x4c try_to_bring_up_aggregate_device+0x208/0x2a4 __component_add+0xa8/0x188 component_add+0x1c/0x2c dsi_dev_attach+0x24/0x34 dsi_host_attach+0x68/0xa0 devm_mipi_dsi_attach+0x40/0xcc lt9611_attach_dsi+0x94/0x118 lt9611_probe+0x368/0x3c8 i2c_device_probe+0x2d0/0x3d8 really_probe+0x130/0x354 __driver_probe_device+0xac/0x110 driver_probe_device+0x44/0x110 __device_attach_driver+0xb0/0x138 bus_for_each_drv+0x90/0xe8 __device_attach+0xfc/0x190 device_initial_probe+0x1c/0x2c bus_probe_device+0x44/0xa0 deferred_probe_work_func+0xac/0x110 process_one_work+0x20c/0x51c process_scheduled_works+0x58/0x88 worker_thread+0x1ec/0x304 kthread+0x194/0x1d4 ret_from_fork+0x10/0x20 Reported-by: Konrad Dybcio Fixes: 98659487b845 ("drm/msm: add support to take dpu snapshot") Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/664149/ Link: https://lore.kernel.org/r/20250715-msm-move-snapshot-init-v1-1-f39c396192ab@oss.qualcomm.com commit 0b3ccb76b95bd06cf80124d8adda647c82a6cc0f Author: Loic Poulain Date: Wed Jul 9 16:08:36 2025 +0200 drm/msm/dsi: Fix 14nm DSI PHY PLL Lock issue To configure and enable the DSI PHY PLL clocks, the MDSS AHB clock must be active for MMIO operations. Typically, this AHB clock is enabled as part of the DSI PHY interface enabling (dsi_phy_enable_resource). However, since these PLL clocks are registered as clock entities, they can be enabled independently of the DSI PHY interface, leading to enabling failures and subsequent warnings: ``` msm_dsi_phy 5e94400.phy: [drm:dsi_pll_14nm_vco_prepare] *ERROR* DSI PLL lock failed ------------[ cut here ]------------ dsi0pllbyte already disabled WARNING: CPU: 3 PID: 1 at drivers/clk/clk.c:1194 clk_core_disable+0xa4/0xac CPU: 3 UID: 0 PID: 1 Comm: swapper/0 Tainted: Tainted: [W]=WARN Hardware name: Qualcomm Technologies, Inc. Robotics RB1 (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [...] ``` This issue is particularly prevalent at boot time during the disabling of unused clocks (clk_disable_unused()) which includes enabling the parent clock(s) when CLK_OPS_PARENT_ENABLE flag is set (this is the case for the 14nm DSI PHY PLL consumers). To resolve this issue, we move the AHB clock as a PM dependency of the DSI PHY device (via pm_clk). Since the DSI PHY device is the parent of the PLL clocks, this resolves the PLL/AHB dependency. Now the AHB clock is enabled prior the PLL clk_prepare callback, as part of the runtime-resume chain. We also eliminate dsi_phy_[enable|disable]_resource functions, which are superseded by runtime PM. Note that it breaks compatibility with kernels before 6.0, as we do not support anymore the legacy `iface_clk` name. Signed-off-by: Loic Poulain Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/663239/ Link: https://lore.kernel.org/r/20250709140836.124143-1-loic.poulain@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit e19d8dd694d261ac26adb2a26121a37c107c81ad Author: Wang Zhaolong Date: Fri Aug 1 17:07:24 2025 +0800 smb: client: remove redundant lstrp update in negotiate protocol Commit 34331d7beed7 ("smb: client: fix first command failure during re-negotiation") addressed a race condition by updating lstrp before entering negotiate state. However, this approach may have some unintended side effects. The lstrp field is documented as "when we got last response from this server", and updating it before actually receiving a server response could potentially affect other mechanisms that rely on this timestamp. For example, the SMB echo detection logic also uses lstrp as a reference point. In scenarios with frequent user operations during reconnect states, the repeated calls to cifs_negotiate_protocol() might continuously update lstrp, which could interfere with the echo detection timing. Additionally, commit 266b5d02e14f ("smb: client: fix race condition in negotiate timeout by using more precise timing") introduced a dedicated neg_start field specifically for tracking negotiate start time. This provides a more precise solution for the original race condition while preserving the intended semantics of lstrp. Since the race condition is now properly handled by the neg_start mechanism, the lstrp update in cifs_negotiate_protocol() is no longer necessary and can be safely removed. Fixes: 266b5d02e14f ("smb: client: fix race condition in negotiate timeout by using more precise timing") Cc: stable@vger.kernel.org Acked-by: Paulo Alcantara (Red Hat) Signed-off-by: Wang Zhaolong Signed-off-by: Steve French commit e3f776d30a56286aaf882b96c92e797b7587a6ab Author: Steve French Date: Sat Aug 9 09:17:46 2025 -0500 cifs: update internal version number to 2.56 Signed-off-by: Steve French commit 8c48e1c7520321cc87ff651e96093e2f412785fb Author: Stefan Metzmacher Date: Tue Aug 12 18:45:06 2025 +0200 smb: client: don't wait for info->send_pending == 0 on error We already called ib_drain_qp() before and that makes sure send_done() was called with IB_WC_WR_FLUSH_ERR, but didn't called atomic_dec_and_test(&sc->send_io.pending.count) So we may never reach the info->send_pending == 0 condition. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: 5349ae5e05fa ("smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection()") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit e3835731e169a48a2c73018d135b5c08c39ea61d Author: Wang Zhaolong Date: Mon Aug 11 22:07:37 2025 +0800 smb: client: fix mid_q_entry memleak leak with per-mid locking This is step 4/4 of a patch series to fix mid_q_entry memory leaks caused by race conditions in callback execution. In compound_send_recv(), when wait_for_response() is interrupted by signals, the code attempts to cancel pending requests by changing their callbacks to cifs_cancelled_callback. However, there's a race condition between signal interruption and network response processing that causes both mid_q_entry and server buffer leaks: ``` User foreground process cifsd cifs_readdir open_cached_dir cifs_send_recv compound_send_recv smb2_setup_request smb2_mid_entry_alloc smb2_get_mid_entry smb2_mid_entry_alloc mempool_alloc // alloc mid kref_init(&temp->refcount); // refcount = 1 mid[0]->callback = cifs_compound_callback; mid[1]->callback = cifs_compound_last_callback; smb_send_rqst rc = wait_for_response wait_event_state TASK_KILLABLE cifs_demultiplex_thread allocate_buffers server->bigbuf = cifs_buf_get() standard_receive3 ->find_mid() smb2_find_mid __smb2_find_mid kref_get(&mid->refcount) // +1 cifs_handle_standard handle_mid /* bigbuf will also leak */ mid->resp_buf = server->bigbuf server->bigbuf = NULL; dequeue_mid /* in for loop */ mids[0]->callback cifs_compound_callback /* Signal interrupts wait: rc = -ERESTARTSYS */ /* if (... || midQ[i]->mid_state == MID_RESPONSE_RECEIVED) *? midQ[0]->callback = cifs_cancelled_callback; cancelled_mid[i] = true; /* The change comes too late */ mid->mid_state = MID_RESPONSE_READY release_mid // -1 /* cancelled_mid[i] == true causes mid won't be released in compound_send_recv cleanup */ /* cifs_cancelled_callback won't executed to release mid */ ``` The root cause is that there's a race between callback assignment and execution. Fix this by introducing per-mid locking: - Add spinlock_t mid_lock to struct mid_q_entry - Add mid_execute_callback() for atomic callback execution - Use mid_lock in cancellation paths to ensure atomicity This ensures that either the original callback or the cancellation callback executes atomically, preventing reference count leaks when requests are interrupted by signals. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220404 Fixes: ee258d79159a ("CIFS: Move credit processing to mid callbacks for SMB3") Signed-off-by: Wang Zhaolong Signed-off-by: Steve French commit 7d34ec36abb84fdfb6632a0f2cbda90379ae21fc Author: Steve French Date: Mon Aug 11 23:14:55 2025 -0500 smb3: fix for slab out of bounds on mount to ksmbd With KASAN enabled, it is possible to get a slab out of bounds during mount to ksmbd due to missing check in parse_server_interfaces() (see below): BUG: KASAN: slab-out-of-bounds in parse_server_interfaces+0x14ee/0x1880 [cifs] Read of size 4 at addr ffff8881433dba98 by task mount/9827 CPU: 5 UID: 0 PID: 9827 Comm: mount Tainted: G OE 6.16.0-rc2-kasan #2 PREEMPT(voluntary) Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE Hardware name: Dell Inc. Precision Tower 3620/0MWYPT, BIOS 2.13.1 06/14/2019 Call Trace: dump_stack_lvl+0x9f/0xf0 print_report+0xd1/0x670 __virt_addr_valid+0x22c/0x430 ? parse_server_interfaces+0x14ee/0x1880 [cifs] ? kasan_complete_mode_report_info+0x2a/0x1f0 ? parse_server_interfaces+0x14ee/0x1880 [cifs] kasan_report+0xd6/0x110 parse_server_interfaces+0x14ee/0x1880 [cifs] __asan_report_load_n_noabort+0x13/0x20 parse_server_interfaces+0x14ee/0x1880 [cifs] ? __pfx_parse_server_interfaces+0x10/0x10 [cifs] ? trace_hardirqs_on+0x51/0x60 SMB3_request_interfaces+0x1ad/0x3f0 [cifs] ? __pfx_SMB3_request_interfaces+0x10/0x10 [cifs] ? SMB2_tcon+0x23c/0x15d0 [cifs] smb3_qfs_tcon+0x173/0x2b0 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] ? cifs_get_tcon+0x105d/0x2120 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_get_tcon+0x105d/0x2120 [cifs] ? __pfx_smb3_qfs_tcon+0x10/0x10 [cifs] cifs_mount_get_tcon+0x369/0xb90 [cifs] ? dfs_cache_find+0xe7/0x150 [cifs] dfs_mount_share+0x985/0x2970 [cifs] ? check_path.constprop.0+0x28/0x50 ? save_trace+0x54/0x370 ? __pfx_dfs_mount_share+0x10/0x10 [cifs] ? __lock_acquire+0xb82/0x2ba0 ? __kasan_check_write+0x18/0x20 cifs_mount+0xbc/0x9e0 [cifs] ? __pfx_cifs_mount+0x10/0x10 [cifs] ? do_raw_spin_unlock+0x5d/0x200 ? cifs_setup_cifs_sb+0x29d/0x810 [cifs] cifs_smb3_do_mount+0x263/0x1990 [cifs] Reported-by: Namjae Jeon Tested-by: Namjae Jeon Cc: stable@vger.kernel.org Signed-off-by: Steve French commit ee8f1613596ad44c7cff4805d65a8a705998db11 Author: Mario Limonciello (AMD) Date: Wed Aug 13 09:03:08 2025 -0500 Revert "ALSA: hda: Add ASRock X670E Taichi to denylist" On a motherboard with an AMD Granite Ridge CPU there is a report that 3.5mm microphone and headphones aren't working. In the log it's observed: snd_hda_intel 0000:02:00.6: Skipping the device on the denylist This was because of commit df42ee7e22f03 ("ALSA: hda: Add ASRock X670E Taichi to denylist"). Reverting this commit allows the microphone and headphones to work again. As at least some combinations of this motherboard do have applicable devices, revert so that they can be probed. Cc: Richard Gong Cc: Juan Martinez Signed-off-by: Mario Limonciello (AMD) Link: https://patch.msgid.link/20250813140427.1577172-1-superm1@kernel.org Signed-off-by: Takashi Iwai commit 23cbfd6fed78715459a4395c034c4e76b8c85320 Author: Takashi Iwai Date: Wed Aug 13 17:36:27 2025 +0200 ALSA: azt3328: Put __maybe_unused for inline functions for gameport Some inline functions are unused depending on kconfig, and the recent change for clang builds made those handled as errors with W=1. For avoiding pitfalls, mark those with __maybe_unused attributes. Link: https://patch.msgid.link/20250813153628.12303-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a5ba9ad417254c49ecf06ac5ab36ec4b12ee133f Author: Miguel Ojeda Date: Mon Aug 4 19:13:11 2025 +0200 rust: faux: fix C header link Starting with Rust 1.91.0 (expected 2025-10-30), `rustdoc` has improved some false negatives around intra-doc links [1], and it found a broken intra-doc link we currently have: error: unresolved link to `include/linux/device/faux.h` --> rust/kernel/faux.rs:7:17 | 7 | //! C header: [`include/linux/device/faux.h`] | ^^^^^^^^^^^^^^^^^^^^^^^^^^^ no item named `include/linux/device/faux.h` in scope | = help: to escape `[` and `]` characters, add '\' before them like `\[` or `\]` = note: `-D rustdoc::broken-intra-doc-links` implied by `-D warnings` = help: to override `-D warnings` add `#[allow(rustdoc::broken_intra_doc_links)]` Our `srctree/` C header links are not intra-doc links, thus they need the link destination. Thus fix it. Cc: stable Link: https://github.com/rust-lang/rust/pull/132748 [1] Fixes: 78418f300d39 ("rust/kernel: Add faux device bindings") Signed-off-by: Miguel Ojeda Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250804171311.1186538-1-ojeda@kernel.org Signed-off-by: Greg Kroah-Hartman commit 91325f31afc1026de28665cf1a7b6e157fa4d39d Merge: 8742b2d8935f47 c0e1b774f68bdb Author: Linus Torvalds Date: Wed Aug 13 08:28:33 2025 -0700 Merge tag 'mm-hotfixes-stable-2025-08-12-20-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull misc fixes from Andrew Morton: "12 hotfixes. 5 are cc:stable and the remainder address post-6.16 issues or aren't considered necessary for -stable kernels. 10 of these fixes are for MM" * tag 'mm-hotfixes-stable-2025-08-12-20-50' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: proc: proc_maps_open allow proc_mem_open to return NULL mm/mremap: avoid expensive folio lookup on mremap folio pte batch userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry mm: pass page directly instead of using folio_page selftests/proc: fix string literal warning in proc-maps-race.c fs/proc/task_mmu: hold PTL in pagemap_hugetlb_range and gather_hugetlb_stats mm/smaps: fix race between smaps_hugetlb_range and migration mm: fix the race between collapse and PT_RECLAIM under per-vma lock mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() MAINTAINERS: add Masami as a reviewer of hung task detector mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock kasan/test: fix protection against compiler elision commit 98da66a70ad2396e5a508c4245367797ebc052ce Author: Thorsten Blum Date: Wed Aug 13 16:52:49 2025 +0200 usb: storage: realtek_cr: Use correct byte order for bcs->Residue Since 'bcs->Residue' has the data type '__le32', convert it to the correct byte order of the CPU using this driver when assigning it to the local variable 'residue'. Cc: stable Fixes: 50a6cb932d5c ("USB: usb_storage: add ums-realtek driver") Suggested-by: Alan Stern Acked-by: Alan Stern Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250813145247.184717-3-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman commit 421255afa2a58eee2109dda56c137a7b61c4b05f Author: Xu Yang Date: Mon Aug 11 18:08:33 2025 +0800 usb: chipidea: imx: improve usbmisc_imx7d_pullup() When add workaround for ERR051725, the usbmisc will put PHY to Non-driving mode (OPMODE = 01) after stopping the device controller and put PHY back to Normal mode (OPMODE = 00) after starting the device controller. However, this will bring issue for host controller. Because the PHY may stay in Non-driving mode after switching the role from device to host. Then the port will not work if USB device is attached. To fix this issue, improving the workaround by putting PHY to Non-driving mode for a certain period and back to Normal mode finally. To make host detect a disconnect signal, the period should be at least 125us (a micro-frame time) for high-speed link. And only working as high-speed mode will need workaround for ERR051725. So this will also filter the pullup event for high-speed. Fixes: 11992b410083 ("usb: chipidea: imx: implement workaround for ERR051725") Reviewed-by: Jun Li Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250811100833.862876-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 9528d32873b38281ae105f2f5799e79ae9d086c2 Author: Sebastian Andrzej Siewior Date: Mon Aug 11 10:27:45 2025 +0200 kcov, usb: Don't disable interrupts in kcov_remote_start_usb_softirq() kcov_remote_start_usb_softirq() the begin of urb's completion callback. HCDs marked HCD_BH will invoke this function from the softirq and in_serving_softirq() will detect this properly. Root-HUB (RH) requests will not be delayed to softirq but complete immediately in IRQ context. This will confuse kcov because in_serving_softirq() will report true if the softirq is served after the hardirq and if the softirq got interrupted by the hardirq in which currently runs. This was addressed by simply disabling interrupts in kcov_remote_start_usb_softirq() which avoided the interruption by the RH while a regular completion callback was invoked. This not only changes the behaviour while kconv is enabled but also breaks PREEMPT_RT because now sleeping locks can no longer be acquired. Revert the previous fix. Address the issue by invoking kcov_remote_start_usb() only if the context is just "serving softirqs" which is identified by checking in_serving_softirq() and in_hardirq() must be false. Fixes: f85d39dd7ed89 ("kcov, usb: disable interrupts in kcov_remote_start_usb_softirq") Cc: stable Reported-by: Yunseong Kim Closes: https://lore.kernel.org/all/20250725201400.1078395-2-ysk@kzalloc.com/ Tested-by: Yunseong Kim Signed-off-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20250811082745.ycJqBXMs@linutronix.de Signed-off-by: Greg Kroah-Hartman commit 86f390ba59cd8d5755bafe2b163c3e6b89d6bbd9 Author: Heikki Krogerus Date: Tue Aug 12 16:11:00 2025 +0300 usb: dwc3: pci: add support for the Intel Wildcat Lake This patch adds the necessary PCI ID for Intel Wildcat Lake devices. Signed-off-by: Heikki Krogerus Cc: stable Link: https://lore.kernel.org/r/20250812131101.2930199-1-heikki.krogerus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 58577118cc7cec9eb7c1836bf88f865ff2c5e3a3 Author: Kuen-Han Tsai Date: Thu Aug 7 17:06:55 2025 +0800 usb: dwc3: Ignore late xferNotReady event to prevent halt timeout During a device-initiated disconnect, the End Transfer command resets the event filter, allowing a new xferNotReady event to be generated before the controller is fully halted. Processing this late event incorrectly triggers a Start Transfer, which prevents the controller from halting and results in a DSTS.DEVCTLHLT bit polling timeout. Ignore the late xferNotReady event if the controller is already in a disconnected state. Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") Cc: stable Signed-off-by: Kuen-Han Tsai Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20250807090700.2397190-1-khtsai@google.com Signed-off-by: Greg Kroah-Hartman commit 6ca8af3c8fb584f3424a827f554ff74f898c27cd Author: Mael GUERIN Date: Wed Aug 6 18:44:03 2025 +0200 USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera Add the US_FL_BULK_IGNORE_TAG quirk for Novatek NTK96550-based camera to fix USB resets after sending SCSI vendor commands due to CBW and CSW tags difference, leading to undesired slowness while communicating with the device. Please find below the copy of /sys/kernel/debug/usb/devices with my device plugged in (listed as TechSys USB mass storage here, the underlying chipset being the Novatek NTK96550-based camera): T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=0603 ProdID=8611 Rev= 0.01 S: Manufacturer=TechSys S: Product=USB Mass Storage S: SerialNumber=966110000000100 C:* #Ifs= 1 Cfg#= 1 Atr=c0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Signed-off-by: Mael GUERIN Cc: stable Acked-by: Alan Stern Link: https://lore.kernel.org/r/20250806164406.43450-1-mael.guerin@murena.io Signed-off-by: Greg Kroah-Hartman commit 8fe06185e11ae753414aa6117f0e798aa77567ff Author: Xu Yang Date: Wed Aug 6 16:39:55 2025 +0800 usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test The USB core will unmap urb->transfer_dma after SETUP stage completes. Then the USB controller will access unmapped memory when it received device descriptor. If iommu is equipped, the entire test can't be completed due to the memory accessing is blocked. Fix it by calling map_urb_for_dma() again for IN stage. To reduce redundant map for urb->transfer_buffer, this will also set URB_NO_TRANSFER_DMA_MAP flag before first map_urb_for_dma() to skip dma map for urb->transfer_buffer and clear URB_NO_TRANSFER_DMA_MAP flag before second map_urb_for_dma(). Fixes: 216e0e563d81 ("usb: core: hcd: use map_urb_for_dma for single step set feature urb") Cc: stable Reviewed-by: Jun Li Signed-off-by: Xu Yang Acked-by: Alan Stern Link: https://lore.kernel.org/r/20250806083955.3325299-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit f9420f4757752f056144896024d5ea89e5a611f1 Author: Marek Vasut Date: Sun Aug 3 00:55:20 2025 +0200 usb: renesas-xhci: Fix External ROM access timeouts Increase the External ROM access timeouts to prevent failures during programming of External SPI EEPROM chips. The current timeouts are too short for some SPI EEPROMs used with uPD720201 controllers. The current timeout for Chip Erase in renesas_rom_erase() is 100 ms , the current timeout for Sector Erase issued by the controller before Page Program in renesas_fw_download_image() is also 100 ms. Neither timeout is sufficient for e.g. the Macronix MX25L5121E or MX25V5126F. MX25L5121E reference manual [1] page 35 section "ERASE AND PROGRAMMING PERFORMANCE" and page 23 section "Table 8. AC CHARACTERISTICS (Temperature = 0°C to 70°C for Commercial grade, VCC = 2.7V ~ 3.6V)" row "tCE" indicate that the maximum time required for Chip Erase opcode to complete is 2 s, and for Sector Erase it is 300 ms . MX25V5126F reference manual [2] page 47 section "13. ERASE AND PROGRAMMING PERFORMANCE (2.3V - 3.6V)" and page 42 section "Table 8. AC CHARACTERISTICS (Temperature = -40°C to 85°C for Industrial grade, VCC = 2.3V - 3.6V)" row "tCE" indicate that the maximum time required for Chip Erase opcode to complete is 3.2 s, and for Sector Erase it is 400 ms . Update the timeouts such, that Chip Erase timeout is set to 5 seconds, and Sector Erase timeout is set to 500 ms. Such lengthy timeouts ought to be sufficient for majority of SPI EEPROM chips. [1] https://www.macronix.com/Lists/Datasheet/Attachments/8634/MX25L5121E,%203V,%20512Kb,%20v1.3.pdf [2] https://www.macronix.com/Lists/Datasheet/Attachments/8750/MX25V5126F,%202.5V,%20512Kb,%20v1.1.pdf Fixes: 2478be82de44 ("usb: renesas-xhci: Add ROM loader for uPD720201") Cc: stable Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20250802225526.25431-1-marek.vasut+renesas@mailbox.org Signed-off-by: Greg Kroah-Hartman commit 202ad1aaca777dc7fd24f459f5f808f5abd2bfda Author: Russell King (Oracle) Date: Fri Aug 1 18:40:41 2025 +0100 usb: gadget: tegra-xudc: fix PM use count underflow Upon resume from system suspend, the PM runtime core issues the following warning: tegra-xudc 3550000.usb: Runtime PM usage count underflow! This is because tegra_xudc_resume() unconditionally calls schedule_work(&xudc->usb_role_sw_work) whether or not anything has changed, which causes tegra_xudc_device_mode_off() to be called even when we're already in that mode. Keep track of the current state of "device_mode", and only schedule this work if it has changed from the hardware state on resume. Signed-off-by: "Russell King (Oracle)" Link: https://lore.kernel.org/r/E1uhtkH-007KDZ-JT@rmk-PC.armlinux.org.uk Signed-off-by: Greg Kroah-Hartman commit e664036cf36480414936cd91f4cfa2179a3d8367 Author: Miao Li Date: Fri Aug 1 16:27:28 2025 +0800 usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive Another SanDisk 3.2Gen1 Flash Drive also need DELAY_INIT quick, or it will randomly work incorrectly on Huawei hisi platforms when doing reboot test. Signed-off-by: Miao Li Cc: stable Link: https://lore.kernel.org/r/20250801082728.469406-1-limiao870622@163.com Signed-off-by: Greg Kroah-Hartman commit 47ed64db8c17eb16541098add865178fb7e68744 Author: Baojun Xu Date: Wed Aug 13 18:07:08 2025 +0800 ASoC: tas2781: Normalize the volume kcontrol name Change the name of the kcontrol from "Gain" to "Volume". Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20250813100708.12197-1-baojun.xu@ti.com Signed-off-by: Mark Brown commit 9d83e1f05c98bab5de350bef89177e2be8b34db0 Author: Fengnan Chang Date: Wed Aug 13 20:02:14 2025 +0800 io_uring/io-wq: add check free worker before create new worker After commit 0b2b066f8a85 ("io_uring/io-wq: only create a new worker if it can make progress"), in our produce environment, we still observe that part of io_worker threads keeps creating and destroying. After analysis, it was confirmed that this was due to a more complex scenario involving a large number of fsync operations, which can be abstracted as frequent write + fsync operations on multiple files in a single uring instance. Since write is a hash operation while fsync is not, and fsync is likely to be suspended during execution, the action of checking the hash value in io_wqe_dec_running cannot handle such scenarios. Similarly, if hash-based work and non-hash-based work are sent at the same time, similar issues are likely to occur. Returning to the starting point of the issue, when a new work arrives, io_wq_enqueue may wake up free worker A, while io_wq_dec_running may create worker B. Ultimately, only one of A and B can obtain and process the task, leaving the other in an idle state. In the end, the issue is caused by inconsistent logic in the checks performed by io_wq_enqueue and io_wq_dec_running. Therefore, the problem can be resolved by checking for available workers in io_wq_dec_running. Signed-off-by: Fengnan Chang Reviewed-by: Diangang Li Link: https://lore.kernel.org/r/20250813120214.18729-1-changfengnan@bytedance.com Signed-off-by: Jens Axboe commit 74857fdc5dd2cdcdeb6e99bdf26976fd9299d2bb Author: Kyoji Ogasawara Date: Wed Aug 13 03:00:07 2025 +0900 btrfs: fix printing of mount info messages for NODATACOW/NODATASUM The NODATASUM message was printed twice by mistake and the NODATACOW was missing from the 'unset' part. Fix the duplication and make the output look the same. Fixes: eddb1a433f26 ("btrfs: add reconfigure callback for fs_context") CC: stable@vger.kernel.org # 6.8+ Reviewed-by: Qu Wenruo Signed-off-by: Kyoji Ogasawara Reviewed-by: David Sterba Signed-off-by: David Sterba commit b435ab556bea875c088485f271ef2709ca1d75f5 Author: Kyoji Ogasawara Date: Wed Aug 13 03:00:06 2025 +0900 btrfs: restore mount option info messages during mount After the fsconfig migration in 6.8, mount option info messages are no longer displayed during mount operations because btrfs_emit_options() is only called during remount, not during initial mount. Fix this by calling btrfs_emit_options() in btrfs_fill_super() after open_ctree() succeeds. Additionally, prevent log duplication by ensuring btrfs_check_options() handles validation with warn-level and err-level messages, while btrfs_emit_options() provides info-level messages. Fixes: eddb1a433f26 ("btrfs: add reconfigure callback for fs_context") CC: stable@vger.kernel.org # 6.8+ Reviewed-by: Qu Wenruo Signed-off-by: Kyoji Ogasawara Reviewed-by: David Sterba Signed-off-by: David Sterba commit edf842abe4368ce3c423343cf4b23b210fcf1622 Author: Kyoji Ogasawara Date: Wed Jul 23 00:38:37 2025 +0900 btrfs: fix incorrect log message for nobarrier mount option Fix a wrong log message that appears when the "nobarrier" mount option is unset. When "nobarrier" is unset, barrier is actually enabled. However, the log incorrectly stated "turning off barriers". Fixes: eddb1a433f26 ("btrfs: add reconfigure callback for fs_context") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Qu Wenruo Signed-off-by: Kyoji Ogasawara Reviewed-by: David Sterba Signed-off-by: David Sterba commit dc61d97b0ba064fb21b01fbfa7436873948277bd Author: Naohiro Aota Date: Tue Aug 12 01:32:58 2025 +0900 btrfs: fix buffer index in wait_eb_writebacks() The commit f2cb97ee964a ("btrfs: index buffer_tree using node size") changed the index of buffer_tree from "start >> sectorsize_bits" to "start >> nodesize_bits". However, the change is not applied for wait_eb_writebacks() and caused IO failures by writing in a full zone. Use the index properly. Fixes: f2cb97ee964a ("btrfs: index buffer_tree using node size") Reviewed-by: Qu Wenruo Reviewed-by: Boris Burkov Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit b1511360c8ac882b0c52caa263620538e8d73220 Author: Naohiro Aota Date: Thu Jul 31 12:46:56 2025 +0900 btrfs: subpage: keep TOWRITE tag until folio is cleaned btrfs_subpage_set_writeback() calls folio_start_writeback() the first time a folio is written back, and it also clears the PAGECACHE_TAG_TOWRITE tag even if there are still dirty blocks in the folio. This can break ordering guarantees, such as those required by btrfs_wait_ordered_extents(). That ordering breakage leads to a real failure. For example, running generic/464 on a zoned setup will hit the following ASSERT. This happens because the broken ordering fails to flush existing dirty pages before the file size is truncated. assertion failed: !list_empty(&ordered->list) :: 0, in fs/btrfs/zoned.c:1899 ------------[ cut here ]------------ kernel BUG at fs/btrfs/zoned.c:1899! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 1906169 Comm: kworker/u130:2 Kdump: loaded Not tainted 6.16.0-rc6-BTRFS-ZNS+ #554 PREEMPT(voluntary) Hardware name: Supermicro Super Server/H12SSL-NT, BIOS 2.0 02/22/2021 Workqueue: btrfs-endio-write btrfs_work_helper [btrfs] RIP: 0010:btrfs_finish_ordered_zoned.cold+0x50/0x52 [btrfs] RSP: 0018:ffffc9002efdbd60 EFLAGS: 00010246 RAX: 000000000000004c RBX: ffff88811923c4e0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff827e38b1 RDI: 00000000ffffffff RBP: ffff88810005d000 R08: 00000000ffffdfff R09: ffffffff831051c8 R10: ffffffff83055220 R11: 0000000000000000 R12: ffff8881c2458c00 R13: ffff88811923c540 R14: ffff88811923c5e8 R15: ffff8881c1bd9680 FS: 0000000000000000(0000) GS:ffff88a04acd0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f907c7a918c CR3: 0000000004024000 CR4: 0000000000350ef0 Call Trace: ? srso_return_thunk+0x5/0x5f btrfs_finish_ordered_io+0x4a/0x60 [btrfs] btrfs_work_helper+0xf9/0x490 [btrfs] process_one_work+0x204/0x590 ? srso_return_thunk+0x5/0x5f worker_thread+0x1d6/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0x118/0x230 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x205/0x260 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 Consider process A calling writepages() with WB_SYNC_NONE. In zoned mode or for compressed writes, it locks several folios for delalloc and starts writing them out. Let's call the last locked folio folio X. Suppose the write range only partially covers folio X, leaving some pages dirty. Process A calls btrfs_subpage_set_writeback() when building a bio. This function call clears the TOWRITE tag of folio X, whose size = 8K and the block size = 4K. It is following state. 0 4K 8K |/////|/////| (flag: DIRTY, tag: DIRTY) <-----> Process A will write this range. Now suppose process B concurrently calls writepages() with WB_SYNC_ALL. It calls tag_pages_for_writeback() to tag dirty folios with PAGECACHE_TAG_TOWRITE. Since folio X is still dirty, it gets tagged. Then, B collects tagged folios using filemap_get_folios_tag() and must wait for folio X to be written before returning from writepages(). 0 4K 8K |/////|/////| (flag: DIRTY, tag: DIRTY|TOWRITE) However, between tagging and collecting, process A may call btrfs_subpage_set_writeback() and clear folio X's TOWRITE tag. 0 4K 8K | |/////| (flag: DIRTY|WRITEBACK, tag: DIRTY) As a result, process B won't see folio X in its batch, and returns without waiting for it. This breaks the WB_SYNC_ALL ordering requirement. Fix this by using btrfs_subpage_set_writeback_keepwrite(), which retains the TOWRITE tag. We now manually clear the tag only after the folio becomes clean, via the xas operation. Fixes: 3470da3b7d87 ("btrfs: subpage: introduce helpers for writeback status") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 1f3d56db694cce6dfbffba0f398a06a222204487 Author: Qu Wenruo Date: Thu Jul 31 08:20:01 2025 +0930 btrfs: clear TAG_TOWRITE from buffer tree when submitting a tree block [POSSIBLE BUG] After commit 5e121ae687b8 ("btrfs: use buffer xarray for extent buffer writeback operations"), we have a dedicated xarray for extent buffers, and a lot of tags are migrated to that buffer tree, like PAGECACHE_TAG_TOWRITE/DIRTY/WRITEBACK. This frees us from the limits of page flags, but there is a new asymmetric behavior, we call buffer_tree_tag_for_writeback() to set PAGECACHE_TAG_TOWRITE for the involved ranges, but there is no one to clear that tag. Before that rework, we relied on the page cache tag which was cleared when folio_start_writeback() was called. Although this has its own problems (e.g. the first one calling folio_start_writeback() will clear the tag for the whole page), it at least cleared the tag. But now our real tags are stored in the buffer tree, no one is really clearing the PAGECACHE_TAG_TOWRITE tag now. [FIX] Thankfully this is not going to cause any real bug, but just some inefficiency iterating the extent buffers. As if we hit an extent buffer which is not dirty but still has the PAGECACHE_TAG_TOWRITE tag, lock_extent_buffer_for_io() will skip it so we won't writeback the extent buffer again. To properly fix the inefficiency, just clear the PAGECACHE_TAG_TOWRITE inside lock_extent_buffer_for_io(). There is no error path between lock_extent_buffer_for_io() and write_one_eb(), so we're safe to clear the tag there. Reviewed-by: Naohiro Aota Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit f022499f24e520706b9a8238746e1cacc37eb4e0 Author: Filipe Manana Date: Fri Aug 1 16:39:49 2025 +0100 btrfs: do not set mtime/ctime to current time when unlinking for log replay If we are doing an unlink for log replay, we are updating the directory's mtime and ctime to the current time, and this is incorrect since it should stay with the mtime and ctime that were set when the directory was logged. This is the same as when adding a link to an inode during log replay (with btrfs_add_link()), where we want the mtime and ctime to be the values that were in place when the inode was logged. This was found with generic/547 using LOAD_FACTOR=20 and TIME_FACTOR=20, where due to large log trees we have longer log replay times and fssum could detect a mismatch of the mtime and ctime of a directory. Fix this by skipping the mtime and ctime update at __btrfs_unlink_inode() if we are in log replay context (just like btrfs_add_link()). Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 05b372862600e551bbf86e7f24a1caeed5e06150 Author: Qu Wenruo Date: Tue Jul 29 19:01:46 2025 +0930 btrfs: clear block dirty if btrfs_writepage_cow_fixup() failed [BUG] If btrfs_writepage_cow_fixup() failed (returning value -EUCLEAN), the block will be kept dirty, but with its corresponding range finished in the ordered extent. Currently that error pattern is only possible for experimental builds, which places extra check to ensure we shouldn't hit a dirty block without a corresponding ordered extent. This means if later a writeback happens again, we can hit the following problems: - ASSERT(block_start != EXTENT_MAP_HOLE) in submit_one_sector() If the original extent map is a hole, then we can hit this case, as the new ordered extent failed, we will drop the new extent map and re-read one from the disk. - DEBUG_WARN() in btrfs_writepage_cow_fixup() This is because we no longer have an ordered extent for those dirty blocks. The original for them is already finished with error. [CAUSE] The function btrfs_writepage_cow_fixup() is not following the regular error handling of writeback. The common practice is to clear the folio dirty, start and finish the writeback for the block. This is normally done by extent_clear_unlock_delalloc() with PAGE_START_WRITEBACK | PAGE_END_WRITEBACK flags during run_delalloc_range(). So if we keep those failed blocks dirty, they will stay in the page cache and wait for the next writeback. And since the original ordered extent is already finished and removed, depending on the original extent map, we either hit the ASSERT() inside submit_one_sector(), or hit the DEBUG_WARN() in btrfs_writepage_cow_fixup() again (and very ironic). [FIX] Follow the regular error handling to clear the dirty flag for the block range, start and finish writeback for that block range instead. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 4bcd3061e8154606af7f721cb75ca04ffe191a12 Author: Qu Wenruo Date: Tue Jul 29 19:01:45 2025 +0930 btrfs: clear block dirty if submit_one_sector() failed [BUG] If submit_one_sector() failed, the block will be kept dirty, but with their corresponding range finished in the ordered extent. This means if a writeback happens later again, we can hit the following problems: - ASSERT(block_start != EXTENT_MAP_HOLE) in submit_one_sector() If the original extent map is a hole, then we can hit this case, as the new ordered extent failed, we will drop the new extent map and re-read one from the disk. - DEBUG_WARN() in btrfs_writepage_cow_fixup() This is because we no longer have an ordered extent for those dirty blocks. The original for them is already finished with error. [CAUSE] The function submit_one_sector() is not following the regular error handling of writeback. The common practice is to clear the folio dirty, start and finish the writeback for the block. This is normally done by extent_clear_unlock_delalloc() with PAGE_START_WRITEBACK | PAGE_END_WRITEBACK flags during run_delalloc_range(). So if we keep those failed blocks dirty, they will stay in the page cache and wait for the next writeback. And since the original ordered extent is already finished and removed, depending on the original extent map, we either hit the ASSERT() inside submit_one_sector(), or hit the DEBUG_WARN() in btrfs_writepage_cow_fixup(). [FIX] Follow the regular error handling to clear the dirty flag for the block, start and finish writeback for that block instead. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit afa17a09c699410113199dc15256c6ea2b4133f7 Author: Even Xu Date: Wed Aug 6 08:23:32 2025 +0800 HID: intel-thc-hid: Intel-quicki2c: Enhance driver re-install flow After driver module is removed and during re-install stage, if there is continueous user touching on the screen, it is a risk impacting THC hardware initialization which causes driver installation failure. This patch enhances this flow by quiescing the external touch interrupt after driver is removed which keeps THC hardware ignore external interrupt during this remove and re-install stage. Signed-off-by: Even Xu Tested-by: Rui Zhang Fixes: 66b59bfce6d9 ("HID: intel-thc-hid: intel-quicki2c: Complete THC QuickI2C driver") Signed-off-by: Jiri Kosina commit 25db5f284fb8f30222146ca15b3ab8265789da38 Author: Xiao Ni Date: Wed Aug 13 11:29:29 2025 +0800 md: add legacy_async_del_gendisk mode commit 9e59d609763f ("md: call del_gendisk in control path") changes the async way to sync way of calling del_gendisk. But it breaks mdadm --assemble command. The assemble command runs like this: 1. create the array 2. stop the array 3. access the sysfs files after stopping The sync way calls del_gendisk in step 2, so all sysfs files are removed. Now to avoid breaking mdadm assemble command, this patch adds the parameter legacy_async_del_gendisk that can be used to choose which way. The default is async way. In future, we plan to change default to sync way in kernel 7.0. Then users need to upgrade to mdadm 4.5+ which removes step 2. Fixes: 9e59d609763f ("md: call del_gendisk in control path") Reported-by: Mikulas Patocka Closes: https://lore.kernel.org/linux-raid/CAMw=ZnQ=ET2St-+hnhsuq34rRPnebqcXqP1QqaHW5Bh4aaaZ4g@mail.gmail.com/T/#t Suggested-and-reviewed-by: Yu Kuai Signed-off-by: Xiao Ni Reviewed-by: Paul Menzel Link: https://lore.kernel.org/linux-raid/20250813032929.54978-1-xni@redhat.com Signed-off-by: Yu Kuai commit 8f5845e0743bf3512b71b3cb8afe06c192d6acc4 Author: Julian Sun Date: Tue Aug 12 23:42:57 2025 +0800 block: restore default wbt enablement The commit 245618f8e45f ("block: protect wbt_lat_usec using q->elevator_lock") protected wbt_enable_default() with q->elevator_lock; however, it also placed wbt_enable_default() before blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);, resulting in wbt failing to be enabled. Moreover, the protection of wbt_enable_default() by q->elevator_lock was removed in commit 78c271344b6f ("block: move wbt_enable_default() out of queue freezing from sched ->exit()"), so we can directly fix this issue by placing wbt_enable_default() after blk_queue_flag_set(QUEUE_FLAG_REGISTERED, q);. Additionally, this issue also causes the inability to read the wbt_lat_usec file, and the scenario is as follows: root@q:/sys/block/sda/queue# cat wbt_lat_usec cat: wbt_lat_usec: Invalid argument root@q:/data00/sjc/linux# ls /sys/kernel/debug/block/sda/rqos cannot access '/sys/kernel/debug/block/sda/rqos': No such file or directory root@q:/data00/sjc/linux# find /sys -name wbt /sys/kernel/debug/tracing/events/wbt After testing with this patch, wbt can be enabled normally. Signed-off-by: Julian Sun Cc: stable@vger.kernel.org Fixes: 245618f8e45f ("block: protect wbt_lat_usec using q->elevator_lock") Reviewed-by: Nilay Shroff Reviewed-by: Yu Kuai Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250812154257.57540-1-sunjunchao@bytedance.com Signed-off-by: Jens Axboe commit f7a2e1c08727384cde1c686dd57172f99b5f2e6e Author: Erick Karanja Date: Wed Aug 13 10:18:36 2025 +0300 Docs: admin-guide: Correct spelling mistake Fix spelling mistake directoy to directory Reported-by: codespell Signed-off-by: Erick Karanja Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20250813071837.668613-1-karanja99erick@gmail.com Signed-off-by: Jens Axboe commit fa2e2d31ee3b7212079323b4b09201ef68af3a97 Author: Junxian Huang Date: Tue Aug 12 20:26:02 2025 +0800 RDMA/hns: Fix dip entries leak on devices newer than hip09 DIP algorithm is also supported on devices newer than hip09, so free dip entries too. Fixes: f91696f2f053 ("RDMA/hns: Support congestion control type selection according to the FW") Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20250812122602.3524602-1-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 185c926283da67a72df20a63a5046b3b4631b7d9 Author: Minjong Kim Date: Wed Aug 13 19:30:22 2025 +0900 HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() in ntrig_report_version(), hdev parameter passed from hid_probe(). sending descriptor to /dev/uhid can make hdev->dev.parent->parent to null if hdev->dev.parent->parent is null, usb_dev has invalid address(0xffffffffffffff58) that hid_to_usb_dev(hdev) returned when usb_rcvctrlpipe() use usb_dev,it trigger page fault error for address(0xffffffffffffff58) add null check logic to ntrig_report_version() before calling hid_to_usb_dev() Signed-off-by: Minjong Kim Link: https://patch.msgid.link/20250813-hid-ntrig-page-fault-fix-v2-1-f98581f35106@samsung.com Signed-off-by: Benjamin Tissoires commit 111aea0464c20f3eb25a48d5ff6c036e6b416123 Author: Akhilesh Patil Date: Sun Aug 10 23:21:58 2025 +0530 RDMA/core: Free pfn_list with appropriate kvfree call Ensure that pfn_list allocated by kvcalloc() is freed using corresponding kvfree() function. Match memory allocation and free routines kvcalloc -> kvfree. Fixes: 259e9bd07c57 ("RDMA/core: Avoid hmm_dma_map_alloc() for virtual DMA devices") Signed-off-by: Akhilesh Patil Link: https://patch.msgid.link/aJjcPjL1BVh8QrMN@bhairav-test.ee.iitb.ac.in Signed-off-by: Leon Romanovsky commit 2186e8c39eb156b3557a467ce4e5dc3f24826609 Author: Dave Hansen Date: Fri Aug 8 10:56:01 2025 -0700 MAINTAINERS: Remove bouncing irdma maintainer This maintainer's email no longer works. Remove it from MAINTAINERS. This still leaves one maintainer for the driver. Signed-off-by: Dave Hansen Cc: Tatyana Nikolova Cc: linux-rdma@vger.kernel.org Link: https://patch.msgid.link/20250808175601.EF0AF767@davehans-spike.ostc.intel.com Signed-off-by: Leon Romanovsky commit 806b9f494f62791ee6d68f515a8056c615a0e7b2 Author: Anantha Prabhu Date: Tue Aug 5 15:40:00 2025 +0530 RDMA/bnxt_re: Fix to initialize the PBL array memset the PBL page pointer and page map arrays before populating the SGL addresses of the HWQ. Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation") Signed-off-by: Anantha Prabhu Reviewed-by: Saravanan Vajravel Reviewed-by: Selvin Xavier Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250805101000.233310-5-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit ba60a1e8cbbd396c69ff9c8bc3242f5ab133e38a Author: Kalesh AP Date: Tue Aug 5 15:39:59 2025 +0530 RDMA/bnxt_re: Fix a possible memory leak in the driver The GID context reuse logic requires the context memory to be not freed if and when DEL_GID firmware command fails. But, if there's no subsequent ADD_GID to reuse it, the context memory must be freed when the driver is unloaded. Otherwise it leads to a memory leak. Below is the kmemleak trace reported: unreferenced object 0xffff88817a4f34d0 (size 8): comm "insmod", pid 1072504, jiffies 4402561550 hex dump (first 8 bytes): 01 00 00 00 00 00 00 00 ........ backtrace (crc ccaa009e): __kmalloc_cache_noprof+0x33e/0x400 0xffffffffc2db9d48 add_modify_gid+0x5e0/0xb60 [ib_core] __ib_cache_gid_add+0x213/0x350 [ib_core] update_gid+0xf2/0x180 [ib_core] enum_netdev_ipv4_ips+0x3f3/0x690 [ib_core] enum_all_gids_of_dev_cb+0x125/0x1b0 [ib_core] ib_enum_roce_netdev+0x14b/0x250 [ib_core] ib_cache_setup_one+0x2e5/0x540 [ib_core] ib_register_device+0x82c/0xf10 [ib_core] 0xffffffffc2df5ad9 0xffffffffc2da8b07 0xffffffffc2db174d auxiliary_bus_probe+0xa5/0x120 really_probe+0x1e4/0x850 __driver_probe_device+0x18f/0x3d0 Fixes: 4a62c5e9e2e1 ("RDMA/bnxt_re: Do not free the ctx_tbl entry if delete GID fails") Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250805101000.233310-4-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Sriharsha Basavapatna Signed-off-by: Leon Romanovsky commit 666bce0bd7e771127cb0cda125cc9d32d9f9f15d Author: Kashyap Desai Date: Tue Aug 5 15:39:58 2025 +0530 RDMA/bnxt_re: Fix to remove workload check in SRQ limit path There should not be any checks of current workload to set srq_limit value to SRQ hw context. Remove all such workload checks and make a direct call to set srq_limit via doorbell SRQ_ARM. Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters") Signed-off-by: Kashyap Desai Signed-off-by: Saravanan Vajravel Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250805101000.233310-3-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 6296f9a5293ada28558f2867ac54c487e1e2b9f2 Author: Kashyap Desai Date: Tue Aug 5 15:39:57 2025 +0530 RDMA/bnxt_re: Fix to do SRQ armena by default Whenever SRQ is created, make sure SRQ arm enable is always set. Driver is always ready to receive SRQ ASYNC event. Additional note - There is no need to do srq arm enable conditionally. See bnxt_qplib_armen_db in bnxt_qplib_create_cq(). Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters") Signed-off-by: Kashyap Desai Signed-off-by: Saravanan Vajravel Link: https://patch.msgid.link/20250805101000.233310-2-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Kalesh AP Signed-off-by: Leon Romanovsky commit 085a1b42e52750769a3fa29d4da6c05ab56f18f8 Author: wenglianfa Date: Sat Jul 26 15:53:45 2025 +0800 RDMA/hns: Fix querying wrong SCC context for DIP algorithm When using DIP algorithm, all QPs establishing connections with the same destination IP share the same SCC, which is indexed by dip_idx, but dip_idx isn't necessarily equal to qpn. Therefore, dip_idx should be used to query SCC context instead of qpn. Fixes: 124a9fbe43aa ("RDMA/hns: Append SCC context to the raw dump of QPC") Signed-off-by: wenglianfa Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20250726075345.846957-1-huangjunxian6@hisilicon.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 04147d8394e80acaaebf0365f112339e8b606c05 Author: Naohiro Aota Date: Wed Jul 16 16:59:55 2025 +0900 btrfs: zoned: limit active zones to max_open_zones When there is no active zone limit, we can technically write into any number of zones at the same time. However, exceeding the max open zones can degrade performance. To prevent this, set the max_active_zones to bdev_max_open_zones() if there is no active zone limit. Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 5c4b93f4c8e5c53574c1a48d66a27a2c68b414af Author: Naohiro Aota Date: Wed Jul 16 16:59:54 2025 +0900 btrfs: zoned: fix write time activation failure for metadata block group Since commit 13bb483d32ab ("btrfs: zoned: activate metadata block group on write time"), we activate a metadata block group at the write time. If the zone capacity is small enough, we can allocate the entire region before the first write. Then, we hit the btrfs_zoned_bg_is_full() in btrfs_zone_activate() and the activation fails. For a data block group, we activate it at the allocation time and we should check the fullness condition in the caller side. Add, a WARN to check the fullness condition. For a metadata block group, we don't need the fullness check because we activate it at the write time. Instead, activating it once it is written should be invalid. Catch that with a WARN too. Fixes: 13bb483d32ab ("btrfs: zoned: activate metadata block group on write time") CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit daa0fde322350b467bc62bc1b141bf62df6123f8 Author: Naohiro Aota Date: Wed Jul 16 16:59:53 2025 +0900 btrfs: zoned: fix data relocation block group reservation btrfs_zoned_reserve_data_reloc_bg() is called on mount and at that point, all data block groups belong to the primary data space_info. So, we don't find anything in the data relocation space_info. Also, the condition "bg->used > 0" can select a block group with full of zone_unusable bytes for the candidate. As we cannot allocate from the block group, it is useless to reserve it as the data relocation block group. Furthermore, because of the space_info separation, we need to migrate the selected block group to the data relocation space_info. If not, the extent allocator cannot use the block group to do the allocation. This commit fixes these three issues. Fixes: e606ff985ec7 ("btrfs: zoned: reserve data_reloc block group on mount") Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit f0ba0e7172a222ea6043b61ecd86723c46d7bcf2 Author: Johannes Thumshirn Date: Wed Jul 23 15:38:10 2025 +0200 btrfs: zoned: skip ZONE FINISH of conventional zones Don't call ZONE FINISH for conventional zones as this will result in I/O errors. Instead check if the zone that needs finishing is a conventional zone and if yes skip it. Also factor out the actual handling of finishing a single zone into a helper function, as do_zone_finish() is growing ever bigger and the indentations levels are getting higher. Reviewed-by: Naohiro Aota Reviewed-by: Anand Jain Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit d4ac86b47563c7895dae28658abd1879d266b2b4 Author: Boshi Yu Date: Fri Jul 25 13:53:56 2025 +0800 RDMA/erdma: Fix unset QPN of GSI QP The QPN of the GSI QP was not set, which may cause issues. Set the QPN to 1 when creating the GSI QP. Fixes: 999a0a2e9b87 ("RDMA/erdma: Support UD QPs and UD WRs") Reviewed-by: Cheng Xu Signed-off-by: Boshi Yu Link: https://patch.msgid.link/20250725055410.67520-4-boshiyu@linux.alibaba.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit d5c74713f0117d07f91eb48b10bc2ad44e23c9b9 Author: Boshi Yu Date: Fri Jul 25 13:53:55 2025 +0800 RDMA/erdma: Fix ignored return value of init_kernel_qp The init_kernel_qp interface may fail. Check its return value and free related resources properly when it does. Fixes: 155055771704 ("RDMA/erdma: Add verbs implementation") Reviewed-by: Cheng Xu Signed-off-by: Boshi Yu Link: https://patch.msgid.link/20250725055410.67520-3-boshiyu@linux.alibaba.com Signed-off-by: Leon Romanovsky commit 3c3e9a9f2972b364e8c2cfbfdeb23c6d6be4f87f Author: Zhu Yanjun Date: Fri Jul 25 18:31:04 2025 -0700 RDMA/rxe: Flush delayed SKBs while releasing RXE resources When skb packets are sent out, these skb packets still depends on the rxe resources, for example, QP, sk, when these packets are destroyed. If these rxe resources are released when the skb packets are destroyed, the call traces will appear. To avoid skb packets hang too long time in some network devices, a timestamp is added when these skb packets are created. If these skb packets hang too long time in network devices, these network devices can free these skb packets to release rxe resources. Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153 Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com Fixes: 1a633bdc8fd9 ("RDMA/rxe: Let destroy qp succeed with stuck packet") Signed-off-by: Zhu Yanjun Link: https://patch.msgid.link/20250726013104.463570-1-yanjun.zhu@linux.dev Signed-off-by: Leon Romanovsky commit 3eb61d7cb74cea2ea697363669fa256937164758 Author: Thomas Zimmermann Date: Tue Jul 15 10:26:22 2025 +0200 Revert "drm/amdgpu: Use dma_buf from GEM object instance" This reverts commit 515986100d176663d0a03219a3056e4252f729e6. The dma_buf field in struct drm_gem_object is not stable over the object instance's lifetime. The field becomes NULL when user space releases the final GEM handle on the buffer object. This resulted in a NULL-pointer deref. Workarounds in commit 5307dce878d4 ("drm/gem: Acquire references on GEM handles for framebuffers") and commit f6bfc9afc751 ("drm/framebuffer: Acquire internal references on GEM handles") only solved the problem partially. They especially don't work for buffer objects without a DRM framebuffer associated. Hence, this revert to going back to using .import_attach->dmabuf. Signed-off-by: Thomas Zimmermann Reviewed-by: Simona Vetter Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250715082635.34974-1-tzimmermann@suse.de commit d3af6ca9a8c34bbd8cff32b469b84c9021c9e7e4 Author: Qasim Ijaz Date: Sun Aug 10 19:10:41 2025 +0100 HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfree+0xcf/0x350 [ 21.673700] input_dev_release+0xab/0xd0 [ 21.673700] device_release+0x9f/0x220 [ 21.673700] kobject_put+0x12b/0x220 [ 21.673700] put_device+0x12/0x20 [ 21.673700] input_free_device+0x4c/0xb0 [ 21.673700] hidinput_connect+0x1862/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] Fixes: 9ce12d8be12c ("HID: asus: Add i2c touchpad support") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz Link: https://patch.msgid.link/20250810181041.44874-1-qasdev00@gmail.com Signed-off-by: Benjamin Tissoires commit 89a2d212bdb4bc29bed8e7077abe054b801137ea Author: Shanker Donthineni Date: Mon Aug 11 13:17:59 2025 -0500 dma/pool: Ensure DMA_DIRECT_REMAP allocations are decrypted When CONFIG_DMA_DIRECT_REMAP is enabled, atomic pool pages are remapped via dma_common_contiguous_remap() using the supplied pgprot. Currently, the mapping uses pgprot_dmacoherent(PAGE_KERNEL), which leaves the memory encrypted on systems with memory encryption enabled (e.g., ARM CCA Realms). This can cause the DMA layer to fail or crash when accessing the memory, as the underlying physical pages are not configured as expected. Fix this by requesting a decrypted mapping in the vmap() call: pgprot_decrypted(pgprot_dmacoherent(PAGE_KERNEL)) This ensures that atomic pool memory is consistently mapped unencrypted. Cc: stable@vger.kernel.org Signed-off-by: Shanker Donthineni Reviewed-by: Catalin Marinas Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20250811181759.998805-1-sdonthineni@nvidia.com commit b56cc41a3ae7323aa3c6165f93c32e020538b6d2 Author: Arnaud Lecomte Date: Sat Jul 26 23:09:31 2025 +0100 hid: fix I2C read buffer overflow in raw_event() for mcp2221 As reported by syzbot, mcp2221_raw_event lacked validation of incoming I2C read data sizes, risking buffer overflows in mcp->rxbuf during multi-part transfers. As highlighted in the DS20005565B spec, p44, we have: "The number of read-back data bytes to follow in this packet: from 0 to a maximum of 60 bytes of read-back bytes." This patch enforces we don't exceed this limit. Reported-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=52c1a7d3e5b361ccd346 Tested-by: syzbot+52c1a7d3e5b361ccd346@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte Link: https://patch.msgid.link/20250726220931.7126-1-contact@arnaud-lcm.com Signed-off-by: Benjamin Tissoires commit 21924af67d69d7c9fdaf845be69043cfe75196a1 Author: John Stultz Date: Tue Aug 5 00:10:02 2025 +0000 locking: Fix __clear_task_blocked_on() warning from __ww_mutex_wound() path The __clear_task_blocked_on() helper added a number of sanity checks ensuring we hold the mutex wait lock and that the task we are clearing blocked_on pointer (if set) matches the mutex. However, there is an edge case in the _ww_mutex_wound() logic where we need to clear the blocked_on pointer for the task that owns the mutex, not the task that is waiting on the mutex. For this case the sanity checks aren't valid, so handle this by allowing a NULL lock to skip the additional checks. K Prateek Nayak and Maarten Lankhorst also pointed out that in this case where we don't hold the owner's mutex wait_lock, we need to be a bit more careful using READ_ONCE/WRITE_ONCE in both the __clear_task_blocked_on() and __set_task_blocked_on() implementations to avoid accidentally tripping WARN_ONs if two instances race. So do that here as well. This issue was easier to miss, I realized, as the test-ww_mutex driver only exercises the wait-die class of ww_mutexes. I've sent a patch[1] to address this so the logic will be easier to test. [1]: https://lore.kernel.org/lkml/20250801023358.562525-2-jstultz@google.com/ Fixes: a4f0b6fef4b0 ("locking/mutex: Add p->blocked_on wrappers for correctness checks") Closes: https://lore.kernel.org/lkml/68894443.a00a0220.26d0e1.0015.GAE@google.com/ Reported-by: syzbot+602c4720aed62576cd79@syzkaller.appspotmail.com Reported-by: Maarten Lankhorst Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Acked-by: Maarten Lankhorst Tested-by: K Prateek Nayak Link: https://lore.kernel.org/r/20250805001026.2247040-1-jstultz@google.com commit d045c3154080a04beb07726fa311b89d21608981 Author: Pratyush Brahma Date: Wed Aug 13 12:51:02 2025 +0530 mm/numa_memblks: Use pr_debug instead of printk(KERN_DEBUG) Replace the direct usage of printk(KERN_DEBUG ...) with pr_debug(...) to align with the consistent `pr_*` API usage within the file. Reviewed-by: Joshua Hahn Signed-off-by: Pratyush Brahma Link: https://lore.kernel.org/r/20250813-numa-dbg-v3-1-1dcd1234fcc5@oss.qualcomm.com Signed-off-by: Mike Rapoport (Microsoft) commit cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973 Author: Pablo Neira Ayuso Date: Wed Aug 13 02:38:50 2025 +0200 netfilter: nf_tables: reject duplicate device on updates A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the first device that is found, leaving unregistered the hook of the duplicated device. Check if a duplicated device exists in the transaction batch, bail out with EEXIST in such case. WARNING is hit when unregistering the hook: [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150 [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full) [...] [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150 Fixes: 78d9f48f7f44 ("netfilter: nf_tables: add devices to existing flowtable") Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain") Signed-off-by: Pablo Neira Ayuso Signed-off-by: Florian Westphal commit c0a23bbc98e93704a1f4fb5e7e7bb2d7c0fb6eb3 Author: Frederic Weisbecker Date: Tue Jul 29 14:26:11 2025 +0200 ipvs: Fix estimator kthreads preferred affinity The estimator kthreads' affinity are defined by sysctl overwritten preferences and applied through a plain call to the scheduler's affinity API. However since the introduction of managed kthreads preferred affinity, such a practice shortcuts the kthreads core code which eventually overwrites the target to the default unbound affinity. Fix this with using the appropriate kthread's API. Fixes: d1a89197589c ("kthread: Default affine kthread to its preferred NUMA node") Signed-off-by: Frederic Weisbecker Acked-by: Julian Anastasov Signed-off-by: Florian Westphal commit 30c1d25b9870d551be42535067d5481668b5e6f3 Author: Florian Westphal Date: Mon Aug 11 12:26:10 2025 +0200 netfilter: nft_set_pipapo: fix null deref for empty set Blamed commit broke the check for a null scratch map: - if (unlikely(!m || !*raw_cpu_ptr(m->scratch))) + if (unlikely(!raw_cpu_ptr(m->scratch))) This should have been "if (!*raw_ ...)". Use the pattern of the avx2 version which is more readable. This can only be reproduced if avx2 support isn't available. Fixes: d8d871a35ca9 ("netfilter: nft_set_pipapo: merge pipapo_get/lookup") Signed-off-by: Florian Westphal commit 76dba1fe277f6befd6ef650e1946f626c547387a Author: Liao Yuanhong Date: Mon Aug 11 20:58:16 2025 +0800 ext4: use kmalloc_array() for array space allocation Replace kmalloc(size * sizeof) with kmalloc_array() for safer memory allocation and overflow prevention. Cc: stable@kernel.org Signed-off-by: Liao Yuanhong Link: https://patch.msgid.link/20250811125816.570142-1-liaoyuanhong@vivo.com Signed-off-by: Theodore Ts'o commit 02c7f7219ac0e2277b3379a3a0e9841ef464b6d4 Author: Zhang Yi Date: Mon Aug 11 14:45:32 2025 +0800 ext4: fix hole length calculation overflow in non-extent inodes In a filesystem with a block size larger than 4KB, the hole length calculation for a non-extent inode in ext4_ind_map_blocks() can easily exceed INT_MAX. Then it could return a zero length hole and trigger the following waring and infinite in the iomap infrastructure. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 434101 at fs/iomap/iter.c:34 iomap_iter_done+0x148/0x190 CPU: 3 UID: 0 PID: 434101 Comm: fsstress Not tainted 6.16.0-rc7+ #128 PREEMPT(voluntary) Hardware name: QEMU KVM Virtual Machine, BIOS unknown 2/2/2022 pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : iomap_iter_done+0x148/0x190 lr : iomap_iter+0x174/0x230 sp : ffff8000880af740 x29: ffff8000880af740 x28: ffff0000db8e6840 x27: 0000000000000000 x26: 0000000000000000 x25: ffff8000880af830 x24: 0000004000000000 x23: 0000000000000002 x22: 000001bfdbfa8000 x21: ffffa6a41c002e48 x20: 0000000000000001 x19: ffff8000880af808 x18: 0000000000000000 x17: 0000000000000000 x16: ffffa6a495ee6cd0 x15: 0000000000000000 x14: 00000000000003d4 x13: 00000000fa83b2da x12: 0000b236fc95f18c x11: ffffa6a4978b9c08 x10: 0000000000001da0 x9 : ffffa6a41c1a2a44 x8 : ffff8000880af5c8 x7 : 0000000001000000 x6 : 0000000000000000 x5 : 0000000000000004 x4 : 000001bfdbfa8000 x3 : 0000000000000000 x2 : 0000000000000000 x1 : 0000004004030000 x0 : 0000000000000000 Call trace: iomap_iter_done+0x148/0x190 (P) iomap_iter+0x174/0x230 iomap_fiemap+0x154/0x1d8 ext4_fiemap+0x110/0x140 [ext4] do_vfs_ioctl+0x4b8/0xbc0 __arm64_sys_ioctl+0x8c/0x120 invoke_syscall+0x6c/0x100 el0_svc_common.constprop.0+0x48/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x38/0x120 el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x1a0 ---[ end trace 0000000000000000 ]--- Cc: stable@kernel.org Fixes: facab4d9711e ("ext4: return hole from ext4_map_blocks()") Reported-by: Qu Wenruo Closes: https://lore.kernel.org/linux-ext4/9b650a52-9672-4604-a765-bb6be55d1e4a@gmx.com/ Tested-by: Qu Wenruo Signed-off-by: Zhang Yi Link: https://patch.msgid.link/20250811064532.1788289-1-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit c5e104a91e7b6fa12c1dc2d8bf84abb7ef9b89ad Author: Theodore Ts'o Date: Thu Aug 7 09:35:20 2025 -0400 ext4: don't try to clear the orphan_present feature block device is r/o When the file system is frozen in preparation for taking an LVM snapshot, the journal is checkpointed and if the orphan_file feature is enabled, and the orphan file is empty, we clear the orphan_present feature flag. But if there are pending inodes that need to be removed the orphan_present feature flag can't be cleared. The problem comes if the block device is read-only. In that case, we can't process the orphan inode list, so it is skipped in ext4_orphan_cleanup(). But then in ext4_mark_recovery_complete(), this results in the ext4 error "Orphan file not empty on read-only fs" firing and the file system mount is aborted. Fix this by clearing the needs_recovery flag in the block device is read-only. We do this after the call to ext4_load_and_init-journal() since there are some error checks need to be done in case the journal needs to be replayed and the block device is read-only, or if the block device containing the externa journal is read-only, etc. Cc: stable@kernel.org Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1108271 Cc: stable@vger.kernel.org Fixes: 02f310fcf47f ("ext4: Speedup ext4 orphan inode handling") Signed-off-by: Theodore Ts'o commit 3ffbdd1f1165f1b2d6a94d1b1aabef57120deaf7 Author: Ojaswin Mujoo Date: Tue Aug 5 14:00:31 2025 +0530 ext4: fix reserved gdt blocks handling in fsmap In some cases like small FSes with no meta_bg and where the resize doesn't need extra gdt blocks as it can fit in the current one, s_reserved_gdt_blocks is set as 0, which causes fsmap to emit a 0 length entry, which is incorrect. $ mkfs.ext4 -b 65536 -O bigalloc /dev/sda 5G $ mount /dev/sda /mnt/scratch $ xfs_io -c "fsmap -d" /mnt/scartch 0: 253:48 [0..127]: static fs metadata 128 1: 253:48 [128..255]: special 102:1 128 2: 253:48 [256..255]: special 102:2 0 <---- 0 len entry 3: 253:48 [256..383]: special 102:3 128 Fix this by adding a check for this case. Cc: stable@kernel.org Fixes: 0c9ec4beecac ("ext4: support GETFSMAP ioctls") Signed-off-by: Ojaswin Mujoo Reviewed-by: Darrick J. Wong Link: https://patch.msgid.link/08781b796453a5770112aa96ad14c864fbf31935.1754377641.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit bae76c035bf0852844151e68098c9b7cd63ef238 Author: Ojaswin Mujoo Date: Tue Aug 5 14:00:30 2025 +0530 ext4: fix fsmap end of range reporting with bigalloc With bigalloc enabled, the logic to report last extent has a bug since we try to use cluster units instead of block units. This can cause an issue where extra incorrect entries might be returned back to the user. This was flagged by generic/365 with 64k bs and -O bigalloc. ** Details of issue ** The issue was noticed on 5G 64k blocksize FS with -O bigalloc which has only 1 bg. $ xfs_io -c "fsmap -d" /mnt/scratch 0: 253:48 [0..127]: static fs metadata 128 /* sb */ 1: 253:48 [128..255]: special 102:1 128 /* gdt */ 3: 253:48 [256..383]: special 102:3 128 /* block bitmap */ 4: 253:48 [384..2303]: unknown 1920 /* flex bg empty space */ 5: 253:48 [2304..2431]: special 102:4 128 /* inode bitmap */ 6: 253:48 [2432..4351]: unknown 1920 /* flex bg empty space */ 7: 253:48 [4352..6911]: inodes 2560 8: 253:48 [6912..538623]: unknown 531712 9: 253:48 [538624..10485759]: free space 9947136 The issue can be seen with: $ xfs_io -c "fsmap -d 0 3" /mnt/scratch 0: 253:48 [0..127]: static fs metadata 128 1: 253:48 [384..2047]: unknown 1664 Only the first entry was expected to be returned but we get 2. This is because: ext4_getfsmap_datadev() first_cluster, last_cluster = 0 ... info->gfi_last = true; ext4_getfsmap_datadev_helper(sb, end_ag, last_cluster + 1, 0, info); fsb = C2B(1) = 16 fslen = 0 ... /* Merge in any relevant extents from the meta_list */ list_for_each_entry_safe(p, tmp, &info->gfi_meta_list, fmr_list) { ... // since fsb = 16, considers all metadata which starts before 16 blockno iter 1: error = ext4_getfsmap_helper(sb, info, p); // p = sb (0,1), nop info->gfi_next_fsblk = 1 iter 2: error = ext4_getfsmap_helper(sb, info, p); // p = gdt (1,2), nop info->gfi_next_fsblk = 2 iter 3: error = ext4_getfsmap_helper(sb, info, p); // p = blk bitmap (2,3), nop info->gfi_next_fsblk = 3 iter 4: error = ext4_getfsmap_helper(sb, info, p); // p = ino bitmap (18,19) if (rec_blk > info->gfi_next_fsblk) { // (18 > 3) // emits an extra entry ** BUG ** } } Fix this by directly calling ext4_getfsmap_datadev() with a dummy record that has fmr_physical set to (end_fsb + 1) instead of last_cluster + 1. By using the block instead of cluster we get the correct behavior. Replacing ext4_getfsmap_datadev_helper() with ext4_getfsmap_helper() is okay since the gfi_lastfree and metadata checks in ext4_getfsmap_datadev_helper() are anyways redundant when we only want to emit the last allocated block of the range, as we have already taken care of emitting metadata and any last free blocks. Cc: stable@kernel.org Reported-by: Disha Goel Fixes: 4a622e4d477b ("ext4: fix FS_IOC_GETFSMAP handling") Signed-off-by: Ojaswin Mujoo Reviewed-by: Darrick J. Wong Link: https://patch.msgid.link/e7472c8535c9c5ec10f425f495366864ea12c9da.1754377641.git.ojaswin@linux.ibm.com Signed-off-by: Theodore Ts'o commit 4ba97589ed19210ff808929052696f5636139823 Author: Qianfeng Rong Date: Sun Aug 3 18:22:41 2025 +0800 ext4: remove redundant __GFP_NOWARN GFP_NOWAIT already includes __GFP_NOWARN, so let's remove the redundant __GFP_NOWARN. Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250803102243.623705-4-rongqianfeng@vivo.com Signed-off-by: Theodore Ts'o commit 59d8731c887bf2f5bb8406ace26cbb6f6b36d6cc Author: Theodore Ts'o Date: Thu Jul 31 16:00:07 2025 -0400 ext4: fix unused variable warning in ext4_init_new_dir Cc: stable@kernel.org Fixes: 90f097b1403f ("ext4: refactor the inline directory conversion and...") Signed-off-by: Theodore Ts'o commit f3fbaa74d999c16b5caeca779e6d7e6e6e7feed8 Author: Antonio Quartulli Date: Mon Jul 21 22:09:02 2025 +0200 ext4: remove useless if check This if branch is only jumping to 'out' which is defined just after the branch itself. Hence this is if-check is a no-op and can be removed. Address-Coverity-ID: 1647981 ("Incorrect expression (IDENTICAL_BRANCHES)") Signed-off-by: Antonio Quartulli Link: https://patch.msgid.link/20250721200902.1071-1-antonio@mandelbit.com Signed-off-by: Theodore Ts'o commit b4cc4a4077268522e3d0d34de4b2dc144e2330fa Author: Andreas Dilger Date: Wed Jul 16 19:36:42 2025 -0600 ext4: check fast symlink for ea_inode correctly The check for a fast symlink in the presence of only an external xattr inode is incorrect. If a fast symlink does not have an xattr block (i_file_acl == 0), but does have an external xattr inode that increases inode i_blocks, then the check for a fast symlink will incorrectly fail and __ext4_iget()->ext4_ind_check_inode() will report the inode is corrupt when it "validates" i_data[] on the next read: # ln -s foo /mnt/tmp/bar # setfattr -h -n trusted.test \ -v "$(yes | head -n 4000)" /mnt/tmp/bar # umount /mnt/tmp # mount /mnt/tmp # ls -l /mnt/tmp ls: cannot access '/mnt/tmp/bar': Structure needs cleaning total 4 ? l?????????? ? ? ? ? ? bar # dmesg | tail -1 EXT4-fs error (device dm-8): __ext4_iget:5098: inode #24578: block 7303014: comm ls: invalid block (note that "block 7303014" = 0x6f6f66 = "foo" in LE order). ext4_inode_is_fast_symlink() should check the superblock EXT4_FEATURE_INCOMPAT_EA_INODE feature flag, not the inode EXT4_EA_INODE_FL, since the latter is only set on the xattr inode itself, and not on the inode that uses this xattr. Cc: stable@vger.kernel.org Fixes: fc82228a5e38 ("ext4: support fast symlinks from ext3 file systems") Signed-off-by: Andreas Dilger Reviewed-by: Li Dongyang Reviewed-by: Alex Zhuravlev Reviewed-by: Oleg Drokin Reviewed-on: https://review.whamcloud.com/59879 Lustre-bug-id: https://jira.whamcloud.com/browse/LU-19121 Link: https://patch.msgid.link/20250717063709.757077-1-adilger@dilger.ca Signed-off-by: Theodore Ts'o commit f2326fd14a224e4cccbab89e14c52279ff79b7ec Author: Baokun Li Date: Thu Jul 3 15:39:03 2025 +0800 ext4: preserve SB_I_VERSION on remount IMA testing revealed that after an ext4 remount, file accesses triggered full measurements even without modifications, instead of skipping as expected when i_version is unchanged. Debugging showed `SB_I_VERSION` was cleared in reconfigure_super() during remount due to commit 1ff20307393e ("ext4: unconditionally enable the i_version counter") removing the fix from commit 960e0ab63b2e ("ext4: fix i_version handling on remount"). To rectify this, `SB_I_VERSION` is always set for `fc->sb_flags` in ext4_init_fs_context(), instead of `sb->s_flags` in __ext4_fill_super(), ensuring it persists across all mounts. Cc: stable@kernel.org Fixes: 1ff20307393e ("ext4: unconditionally enable the i_version counter") Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250703073903.6952-2-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o commit d7e82594a45c5cb270940ac469846e8026c7db0f Author: Jakub Kicinski Date: Thu Aug 7 16:29:07 2025 -0700 selftests: tls: test TCP stealing data from under the TLS socket Check a race where data disappears from the TCP socket after TLS signaled that its ready to receive. ok 6 global.data_steal # RUN tls_basic.base_base ... # OK tls_basic.base_base Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250807232907.600366-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6db015fc4b5d5f63a64a193f65d98da3a7fc811d Author: Jakub Kicinski Date: Thu Aug 7 16:29:06 2025 -0700 tls: handle data disappearing from under the TLS ULP TLS expects that it owns the receive queue of the TCP socket. This cannot be guaranteed in case the reader of the TCP socket entered before the TLS ULP was installed, or uses some non-standard read API (eg. zerocopy ones). Replace the WARN_ON() and a buggy early exit (which leaves anchor pointing to a freed skb) with real error handling. Wipe the parsing state and tell the reader to retry. We already reload the anchor every time we (re)acquire the socket lock, so the only condition we need to avoid is an out of bounds read (not having enough bytes in the socket for previously parsed record len). If some data was read from under TLS but there's enough in the queue we'll reload and decrypt what is most likely not a valid TLS record. Leading to some undefined behavior from TLS perspective (corrupting a stream? missing an alert? missing an attack?) but no kernel crash should take place. Reported-by: William Liu Reported-by: Savino Dicanosa Link: https://lore.kernel.org/tFjq_kf7sWIG3A7CrCg_egb8CVsT_gsmHAK0_wxDPJXfIzxFAMxqmLwp3MlU5EHiet0AwwJldaaFdgyHpeIUCS-3m3llsmRzp9xIOBR4lAI=@syst3mfailure.io Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250807232907.600366-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c6b819e0058e5f34cb274018e1f5cd5b671cec7e Merge: 8f5ae30d69d754 72fc388d8bc0b4 Author: Martin K. Petersen Date: Tue Aug 12 21:36:18 2025 -0400 Merge branch '6.17/scsi-queue' into 6.17/scsi-fixes Pull in outstanding commits for 6.17. Signed-off-by: Martin K. Petersen commit 6a912e8aa2b2fba2519e93a2eac197d16f137c9a Author: Baokun Li Date: Thu Jul 3 15:39:02 2025 +0800 ext4: show the default enabled i_version option Display `i_version` in `/proc/fs/ext4/sdx/options`, even though it's default enabled. This aids users managing multi-version scenarios and simplifies debugging. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250703073903.6952-1-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o commit 2efe41234dbd0a83fdb7cd38226c2f70039a2cd3 Author: Jeongjun Park Date: Mon Jul 28 15:26:49 2025 +0900 ptp: prevent possible ABBA deadlock in ptp_clock_freerun() syzbot reported the following ABBA deadlock: CPU0 CPU1 ---- ---- n_vclocks_store() lock(&ptp->n_vclocks_mux) [1] (physical clock) pc_clock_adjtime() lock(&clk->rwsem) [2] (physical clock) ... ptp_clock_freerun() ptp_vclock_in_use() lock(&ptp->n_vclocks_mux) [3] (physical clock) ptp_clock_unregister() posix_clock_unregister() lock(&clk->rwsem) [4] (virtual clock) Since ptp virtual clock is registered only under ptp physical clock, both ptp_clock and posix_clock must be physical clocks for ptp_vclock_in_use() to lock &ptp->n_vclocks_mux and check ptp->n_vclocks. However, when unregistering vclocks in n_vclocks_store(), the locking ptp->n_vclocks_mux is a physical clock lock, but clk->rwsem of ptp_clock_unregister() called through device_for_each_child_reverse() is a virtual clock lock. Therefore, clk->rwsem used in CPU0 and clk->rwsem used in CPU1 are different locks, but in lockdep, a false positive occurs because the possibility of deadlock is determined through lock-class. To solve this, lock subclass annotation must be added to the posix_clock rwsem of the vclock. Reported-by: syzbot+7cfb66a237c4a5fb22ad@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7cfb66a237c4a5fb22ad Fixes: 73f37068d540 ("ptp: support ptp physical/virtual clocks conversion") Signed-off-by: Jeongjun Park Acked-by: Richard Cochran Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20250728062649.469882-1-aha310510@gmail.com Signed-off-by: Jakub Kicinski commit 6563623e604e3e235b2cee71190a4972be8f986b Author: Soham Metha Date: Wed Aug 13 02:19:46 2025 +0530 docs: cgroup: fixed spelling mistakes in documentation found/fixed the following typo - Availablity -> Availability in `Documentation/admin-guide/cgroup-v2.rst` Signed-off-by: Soham Metha Signed-off-by: Tejun Heo commit e67a0bc3ed4fd8ee1697cb6d937e2b294ec13b5e Author: Jedrzej Jagielski Date: Thu Jul 3 12:41:15 2025 +0200 ixgbe: prevent from unwanted interface name changes Users of the ixgbe driver report that after adding devlink support by the commit a0285236ab93 ("ixgbe: add initial devlink support") their configs got broken due to unwanted changes of interface names. It's caused by automatic phys_port_name generation during devlink port initialization flow. To prevent from that set no_phys_port_name flag for ixgbe devlink ports. Reported-by: David Howells Closes: https://lore.kernel.org/netdev/3452224.1745518016@warthog.procyon.org.uk/ Reported-by: David Kaplan Closes: https://lore.kernel.org/netdev/LV3PR12MB92658474624CCF60220157199470A@LV3PR12MB9265.namprd12.prod.outlook.com/ Fixes: a0285236ab93 ("ixgbe: add initial devlink support") Signed-off-by: Jedrzej Jagielski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit c5ec7f49b480db0dfc83f395755b1c2a7c979920 Author: Jedrzej Jagielski Date: Fri Jul 4 13:17:47 2025 +0200 devlink: let driver opt out of automatic phys_port_name generation Currently when adding devlink port, phys_port_name is automatically generated within devlink port initialization flow. As a result adding devlink port support to driver may result in forced changes of interface names, which breaks already existing network configs. This is an expected behavior but in some scenarios it would not be preferable to provide such limitation for legacy driver not being able to keep 'pre-devlink' interface name. Add flag no_phys_port_name to devlink_port_attrs struct which indicates if devlink should not alter name of interface. Suggested-by: Jiri Pirko Link: https://lore.kernel.org/all/nbwrfnjhvrcduqzjl4a2jafnvvud6qsbxlvxaxilnryglf4j7r@btuqrimnfuly/ Signed-off-by: Jedrzej Jagielski Signed-off-by: Tony Nguyen commit aa5fc4362fac9351557eb27c745579159a2e4520 Author: Liu01 Tong Date: Mon Aug 11 14:52:37 2025 +0800 drm/amdgpu: fix task hang from failed job submission during process kill During process kill, drm_sched_entity_flush() will kill the vm entities. The following job submissions of this process will fail, and the resources of these jobs have not been released, nor have the fences been signalled, causing tasks to hang and timeout. Fix by check entity status in amdgpu_vm_ready() and avoid submit jobs to stopped entity. v2: add amdgpu_vm_ready() check before amdgpu_vm_clear_freed() in function amdgpu_cs_vm_handling(). Fixes: 1f02f2044bda ("drm/amdgpu: Avoid extra evict-restore process.") Signed-off-by: Liu01 Tong Signed-off-by: Lin.Cao Reviewed-by: Christian König Signed-off-by: Alex Deucher (cherry picked from commit f101c13a8720c73e67f8f9d511fbbeda95bcedb1) commit 0ebbab41fba1bae6ccd96c0eec17026700ac6534 Author: Sergio Perez Gonzalez Date: Mon Jul 28 20:00:49 2025 -0600 ASoC: stm: stm32_i2s: Fix calc_clk_div() error handling in determine_rate() calc_clk_div() will only return a non-zero value (-EINVAL) in case of error. On the other hand, req->rate is an unsigned long. It seems quite odd that req->rate would be assigned a negative value, which is clearly not a rate, and success would be returned. Reinstate previous logic, which would just return error. Fixes: afd529d74002 ("ASoC: stm: stm32_i2s: convert from round_rate() to determine_rate()") Link: https://scan7.scan.coverity.com/#/project-view/53936/11354?selectedIssue=1647702 Signed-off-by: Sergio Perez Gonzalez Link: https://patch.msgid.link/20250729020052.404617-1-sperezglz@gmail.com Signed-off-by: Mark Brown commit 040bc6d0e0e9c814c9c663f6f1544ebaff6824a8 Author: Jack Xiao Date: Mon Aug 11 15:20:55 2025 +0800 drm/amdgpu: fix incorrect vm flags to map bo It should use vm flags instead of pte flags to specify bo vm attributes. Fixes: 7946340fa389 ("drm/amdgpu: Move csa related code to separate file") Signed-off-by: Jack Xiao Reviewed-by: Likun Gao Signed-off-by: Alex Deucher (cherry picked from commit b08425fa77ad2f305fe57a33dceb456be03b653f) commit 10ef476aad1c848449934e7bec2ab2374333c7b6 Author: YiPeng Chai Date: Tue Aug 12 09:17:58 2025 +0800 drm/amdgpu: fix vram reservation issue The vram block allocation flag must be cleared before making vram reservation, otherwise reserving addresses within the currently freed memory range will always fail. Fixes: c9cad937c0c5 ("drm/amdgpu: add drm buddy support to amdgpu") Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit d38eaf27de1b8584f42d6fb3f717b7ec44b3a7a1) commit e67b8afcb6d86f1bc6a69e4e52cf9dcfe636f995 Author: Frank Min Date: Tue Aug 5 22:30:54 2025 +0800 drm/amdgpu: Add PSP fw version check for fw reserve GFX command The fw reserved GFX command is only supported starting from PSP fw version 0x3a0e14 and 0x3b0e0d. Older versions do not support this command. Add a version guard to ensure the command is only used when the running PSP fw meets the minimum version requirement. This ensures backward compatibility and safe operation across fw revisions. Fixes: a3b7f9c306e1 ("drm/amdgpu: reclaim psp fw reservation memory region") Signed-off-by: Frank Min Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit 065e23170a1e09bc9104b761183e59562a029619) commit 41b70df5b38bc80967d2e0ed55cc3c3896bba781 Author: Jens Axboe Date: Tue Aug 12 08:30:11 2025 -0600 io_uring/net: commit partial buffers on retry Ring provided buffers are potentially only valid within the single execution context in which they were acquired. io_uring deals with this and invalidates them on retry. But on the networking side, if MSG_WAITALL is set, or if the socket is of the streaming type and too little was processed, then it will hang on to the buffer rather than recycle or commit it. This is problematic for two reasons: 1) If someone unregisters the provided buffer ring before a later retry, then the req->buf_list will no longer be valid. 2) If multiple sockers are using the same buffer group, then multiple receives can consume the same memory. This can cause data corruption in the application, as either receive could land in the same userspace buffer. Fix this by disallowing partial retries from pinning a provided buffer across multiple executions, if ring provided buffers are used. Cc: stable@vger.kernel.org Reported-by: pt x Fixes: c56e022c0a27 ("io_uring: add support for user mapped provided buffer ring") Signed-off-by: Jens Axboe commit 252fea131e15aba2cd487119d1a8f546471199e2 Author: Miguel Ojeda Date: Sat Jul 26 15:34:35 2025 +0200 rust: kbuild: clean output before running `rustdoc` `rustdoc` can get confused when generating documentation into a folder that contains generated files from other `rustdoc` versions. For instance, running something like: rustup default 1.78.0 make LLVM=1 rustdoc rustup default 1.88.0 make LLVM=1 rustdoc may generate errors like: error: couldn't generate documentation: invalid template: last line expected to start with a comment | = note: failed to create or modify "./Documentation/output/rust/rustdoc/src-files.js" Thus just always clean the output folder before generating the documentation -- we are anyway regenerating it every time the `rustdoc` target gets called, at least for the time being. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Reported-by: Daniel Almeida Closes: https://rust-for-linux.zulipchat.com/#narrow/channel/288089/topic/x/near/527201113 Reviewed-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250726133435.2460085-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 8742b2d8935f476449ef37e263bc4da3295c7b58 Merge: 0e39a731820ad2 33927f3d0ecdcf Author: Linus Torvalds Date: Tue Aug 12 12:10:33 2025 -0700 Merge tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull habanalabs fix from Al Viro: "Yet another use-after-free fix due to dma_buf_fd() misuse" * tag 'pull-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: habanalabs: fix UAF in export_dmabuf() commit abbf9a44944171ca99c150adad9361a2f517d3b6 Author: Miguel Ojeda Date: Sun Jul 27 11:23:17 2025 +0200 rust: workaround `rustdoc` target modifiers bug Starting with Rust 1.88.0 (released 2025-06-26), `rustdoc` complains about a target modifier mismatch in configurations where `-Zfixed-x18` is passed: error: mixing `-Zfixed-x18` will cause an ABI mismatch in crate `rust_out` | = help: the `-Zfixed-x18` flag modifies the ABI so Rust crates compiled with different values of this flag cannot be used together safely = note: unset `-Zfixed-x18` in this crate is incompatible with `-Zfixed-x18=` in dependency `core` = help: set `-Zfixed-x18=` in this crate or unset `-Zfixed-x18` in `core` = help: if you are sure this will not cause problems, you may use `-Cunsafe-allow-abi-mismatch=fixed-x18` to silence this error The reason is that `rustdoc` was not passing the target modifiers when configuring the session options, and thus it would report a mismatch that did not exist as soon as a target modifier is used in a dependency. We did not notice it in the kernel until now because `-Zfixed-x18` has been a target modifier only since 1.88.0 (and it is the only one we use so far). The issue has been reported upstream [1] and a fix has been submitted [2], including a test similar to the kernel case. [ This is now fixed upstream (thanks Guillaume for the quick review), so it will be fixed in Rust 1.90.0 (expected 2025-09-18). - Miguel ] Meanwhile, conditionally pass `-Cunsafe-allow-abi-mismatch=fixed-x18` to workaround the issue on our side. Cc: stable@vger.kernel.org # Needed in 6.12.y and later (Rust is pinned in older LTSs). Reported-by: Konrad Dybcio Closes: https://lore.kernel.org/rust-for-linux/36cdc798-524f-4910-8b77-d7b9fac08d77@oss.qualcomm.com/ Link: https://github.com/rust-lang/rust/issues/144521 [1] Link: https://github.com/rust-lang/rust/pull/144523 [2] Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250727092317.2930617-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 5149bbb56bdcf5c5f72904025fbb502217580b63 Author: Nam Cao Date: Mon Aug 11 07:39:35 2025 +0200 PCI: vmd: Remove MSI-X check on child devices d7d8ab87e3e7 ("PCI: vmd: Switch to msi_create_parent_irq_domain()") added a WARN_ON sanity check that child devices support MSI-X, because VMD document says [1]: Intel VMD only supports MSIx Interrupts from child devices and therefore the BIOS must enable PCIe Hot Plug and MSIx interrups [sic]. However, the VMD device can't even tell the difference between a child device using MSI and one using MSI-X. Per 185a383ada2e ("x86/PCI: Add driver for Intel Volume Management Device (VMD)"), VMD does not support INTx interrupts, but does support child devices using either MSI or MSI-X. Remove the sanity check to avoid the WARN_ON and allow child devices to use MSI, reported by Ammar. Fixes: d7d8ab87e3e7 ("PCI: vmd: Switch to msi_create_parent_irq_domain()") Link: https://cdrdv2-public.intel.com/776857/VMD_White_Paper.pdf [1] Reported-by: Ammar Faizi Closes: https://lore.kernel.org/linux-pci/aJXYhfc%2F6DfcqfqF@linux.gnuweeb.org/ Signed-off-by: Nam Cao [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Tested-by: Ammar Faizi Link: https://patch.msgid.link/20250811053935.4049211-1-namcao@linutronix.de commit 963e22c084c2b6097e1e635d29c6336881f67708 Author: Armin Wolf Date: Tue Jul 29 08:20:38 2025 +0200 ACPI: EC: Relax sanity check of the ECDT ID string It turns out that the ECDT table inside the ThinkBook 14 G7 IML contains a valid EC description but an invalid ID string ("_SB.PC00.LPCB.EC0"). Ignoring this ECDT based on the invalid ID string prevents the kernel from detecting the built-in touchpad, so relax the sanity check of the ID string and only reject ECDTs with empty ID strings. Reported-by: Ilya K Fixes: 7a0d59f6a913 ("ACPI: EC: Ignore ECDT tables with an invalid ID string") Signed-off-by: Armin Wolf Tested-by: Ilya K Link: https://patch.msgid.link/20250729062038.303734-1-W_Armin@gmx.de Cc: 6.16+ # 6.16+ Signed-off-by: Rafael J. Wysocki commit 55d49f06162e45686399df4ae6292167f0deab7c Author: Karthik Poosa Date: Sat Aug 9 00:23:10 2025 +0530 drm/xe/hwmon: Add SW clamp for power limits writes Clamp writes to power limits powerX_crit/currX_crit, powerX_cap, powerX_max, to the maximum supported by the pcode mailbox when sysfs-provided values exceed this limit. Although the pcode already performs clamping, values beyond the pcode mailbox's supported range get truncated, leading to incorrect critical power settings. This patch ensures proper clamping to prevent such truncation. v2: - Address below review comments. (Riana) - Split comments into multiple sentences. - Use local variables for readability. - Add a debug log. - Use u64 instead of unsigned long. v3: - Change drm_dbg logs to drm_info. (Badal) v4: - Rephrase the drm_info log. (Rodrigo, Riana) - Rename variable max_mbx_power_limit to max_supp_power_limit, as limit is same for platforms with and without mailbox power limit support. Signed-off-by: Karthik Poosa Fixes: 92d44a422d0d ("drm/xe/hwmon: Expose card reactive critical power") Fixes: fb1b70607f73 ("drm/xe/hwmon: Expose power attributes") Reviewed-by: Riana Tauro Link: https://lore.kernel.org/r/20250808185310.3466529-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit d301eb950da59f962bafe874cf5eb6d61a85b2c2) Signed-off-by: Rodrigo Vivi commit 2dd7a47669ae6c1da18c55f8e89c4a44418c7006 Author: Thomas Hellström Date: Tue Aug 5 09:48:42 2025 +0200 drm/xe: Defer buffer object shrinker write-backs and GPU waits When the xe buffer-object shrinker allows GPU waits and write-back, (typically from kswapd), perform multiple passes, skipping subsequent passes if the shrinker number of scanned objects target is reached. 1) Without GPU waits and write-back 2) Without write-back 3) With both GPU-waits and write-back This is to avoid stalls and costly write- and readbacks unless they are really necessary. v2: - Don't test for scan completion twice. (Stuart Summers) - Update tags. Reported-by: melvyn Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5557 Cc: Summers Stuart Fixes: 00c8efc3180f ("drm/xe: Add a shrinker for xe bos") Cc: # v6.15+ Signed-off-by: Thomas Hellström Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250805074842.11359-1-thomas.hellstrom@linux.intel.com (cherry picked from commit 80944d334182ce5eb27d00e2bf20a88bfc32dea1) Signed-off-by: Rodrigo Vivi commit 145832fbdd17b1d77ffd6cdd1642259e101d1b7e Author: Matthew Auld Date: Thu Jul 31 10:38:11 2025 +0100 drm/xe/migrate: prevent potential UAF If we hit the error path, the previous fence (if there is one) has already been put() prior to this, so doing a fence_wait could lead to UAF. Tweak the flow to do to the put() until after we do the wait. Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access") Signed-off-by: Matthew Auld Cc: Maciej Patelczyk Cc: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250731093807.207572-8-matthew.auld@intel.com (cherry picked from commit 9b7ca35ed28fe5fad86e9d9c24ebd1271e4c9c3e) Signed-off-by: Rodrigo Vivi commit 4126cb327a2e3273c81fcef1c594c5b7b645c44c Author: Matthew Auld Date: Thu Jul 31 10:38:10 2025 +0100 drm/xe/migrate: don't overflow max copy size With non-page aligned copy, we need to use 4 byte aligned pitch, however the size itself might still be close to our maximum of ~8M, and so the dimensions of the copy can easily exceed the S16_MAX limit of the copy command leading to the following assert: xe 0000:03:00.0: [drm] Assertion `size / pitch <= ((s16)(((u16)~0U) >> 1))` failed! platform: BATTLEMAGE subplatform: 1 graphics: Xe2_HPG 20.01 step A0 media: Xe2_HPM 13.01 step A1 tile: 0 VRAM 10.0 GiB GT: 0 type 1 WARNING: CPU: 23 PID: 10605 at drivers/gpu/drm/xe/xe_migrate.c:673 emit_copy+0x4b5/0x4e0 [xe] To fix this account for the pitch when calculating the number of current bytes to copy. Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access") Signed-off-by: Matthew Auld Cc: Maciej Patelczyk Cc: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250731093807.207572-7-matthew.auld@intel.com (cherry picked from commit 8c2d61e0e916e077fda7e7b8e67f25ffe0f361fc) Signed-off-by: Rodrigo Vivi commit 9d7a1cbebbb691891671def57407ba2f8ee914e8 Author: Matthew Auld Date: Thu Jul 31 10:38:09 2025 +0100 drm/xe/migrate: prevent infinite recursion If the buf + offset is not aligned to XE_CAHELINE_BYTES we fallback to using a bounce buffer. However the bounce buffer here is allocated on the stack, and the only alignment requirement here is that it's naturally aligned to u8, and not XE_CACHELINE_BYTES. If the bounce buffer is also misaligned we then recurse back into the function again, however the new bounce buffer might also not be aligned, and might never be until we eventually blow through the stack, as we keep recursing. Instead of using the stack use kmalloc, which should respect the power-of-two alignment request here. Fixes a kernel panic when triggering this path through eudebug. v2 (Stuart): - Add build bug check for power-of-two restriction - s/EINVAL/ENOMEM/ Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access") Signed-off-by: Matthew Auld Cc: Maciej Patelczyk Cc: Stuart Summers Cc: Matthew Brost Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250731093807.207572-6-matthew.auld@intel.com (cherry picked from commit 38b34e928a08ba594c4bbf7118aa3aadacd62fff) Signed-off-by: Rodrigo Vivi commit 3f69f2e78799bf76e5dfe74f2eda4d67812d4edc Author: Nam Cao Date: Mon Aug 11 07:41:44 2025 +0200 PCI: xilinx: Fix NULL pointer dereference in xilinx_pcie_intr_handler() f29861aa301c5 ("PCI: xilinx: Switch to msi_create_parent_irq_domain()") changed xilinx_pcie::msi_domain from child devices' interrupt domain to Xilinx AXI bridge's interrupt domain. However, xilinx_pcie_intr_handler() wasn't changed and still reads Xilinx AXI bridge's interrupt domain from xilinx_pcie::msi_domain->parent. This pointer is NULL now. Update xilinx_pcie_intr_handler() to read the correct interrupt domain pointer. Fixes: f29861aa301c5 ("PCI: xilinx: Switch to msi_create_parent_irq_domain()") Signed-off-by: Nam Cao Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250811054144.4049448-1-namcao@linutronix.de commit aac1256a41cfbbaca12d6c0a5753d1e3b8d2d8bf Author: Ziyue Zhang Date: Fri Jul 25 18:22:29 2025 +0800 dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Update pcie phy bindings The gcc_aux_clk is required by the PCIe controller but not by the PCIe PHY. In PCIe PHY, the source of aux_clk used in low-power mode should be gcc_phy_aux_clk. Hence, remove gcc_aux_clk and replace it with gcc_phy_aux_clk. Fixes: fd2d4e4c1986 ("dt-bindings: phy: qcom,qmp: Add sa8775p QMP PCIe PHY") Signed-off-by: Ziyue Zhang Acked-by: Rob Herring (Arm) Reviewed-by: Johan Hovold Link: https://lore.kernel.org/r/20250725102231.3608298-2-ziyue.zhang@oss.qualcomm.com Signed-off-by: Vinod Koul commit e19bcea99749ce8e8f1d359f68ae03210694ad56 Author: Johan Hovold Date: Thu Jul 24 15:12:06 2025 +0200 phy: ti-pipe3: fix device leak at unbind Make sure to drop the reference to the control device taken by of_find_device_by_node() during probe when the driver is unbound. Fixes: 918ee0d21ba4 ("usb: phy: omap-usb3: Don't use omap_get_control_dev()") Cc: stable@vger.kernel.org # 3.13 Cc: Roger Quadros Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250724131206.2211-4-johan@kernel.org Signed-off-by: Vinod Koul commit 64961557efa1b98f375c0579779e7eeda1a02c42 Author: Johan Hovold Date: Thu Jul 24 15:12:05 2025 +0200 phy: ti: omap-usb2: fix device leak at unbind Make sure to drop the reference to the control device taken by of_find_device_by_node() during probe when the driver is unbound. Fixes: 478b6c7436c2 ("usb: phy: omap-usb2: Don't use omap_get_control_dev()") Cc: stable@vger.kernel.org # 3.13 Cc: Roger Quadros Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250724131206.2211-3-johan@kernel.org Signed-off-by: Vinod Koul commit bca065733afd1e3a89a02f05ffe14e966cd5f78e Author: Johan Hovold Date: Thu Jul 24 15:12:04 2025 +0200 phy: tegra: xusb: fix device and OF node leak at probe Make sure to drop the references taken to the PMC OF node and device by of_parse_phandle() and of_find_device_by_node() during probe. Note the holding a reference to the PMC device does not prevent the PMC regmap from going away (e.g. if the PMC driver is unbound) so there is no need to keep the reference. Fixes: 2d1021487273 ("phy: tegra: xusb: Add wake/sleepwalk for Tegra210") Cc: stable@vger.kernel.org # 5.14 Cc: JC Kuo Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250724131206.2211-2-johan@kernel.org Signed-off-by: Vinod Koul commit 0e39a731820ad26533eb988cef27ad2506063b5b Merge: 20e0d8576484c6 7b632596188e19 Author: Linus Torvalds Date: Tue Aug 12 08:52:05 2025 -0700 Merge tag 'for-6.17-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fixes from David Sterba: - fix bug in qgroups reporting incorrect usage for higher level qgroups - in zoned mode, do not select metadata group as finish target - convert xarray lock to RCU when trying to release extent buffer to avoid a deadlock - do not allow relocation on partially dropped subvolumes, which is normally not possible but has been reported on old filesystems - in tree-log, report errors on missing block group when unaccounting log tree extent buffers - with large folios, fix range length when processing ordered extents * tag 'for-6.17-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix iteration bug in __qgroup_excl_accounting() btrfs: zoned: do not select metadata BG as finish target btrfs: do not allow relocation of partially dropped subvolumes btrfs: error on missing block group when unaccounting log tree extent buffers btrfs: fix wrong length parameter for btrfs_cleanup_ordered_extents() btrfs: make btrfs_cleanup_ordered_extents() support large folios btrfs: fix subpage deadlock in try_release_subpage_extent_buffer() commit 20e0d8576484c60c8c0c9d5d6665541c37dee327 Merge: 53e760d8949895 7b306dfa326f70 Author: Linus Torvalds Date: Tue Aug 12 08:19:23 2025 -0700 Merge tag 'snp_cache_coherency' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip - Add a mitigation for a cache coherency vulnerability when running an SNP guest which makes sure all cache lines belonging to a 4K page are evicted after latter has been converted to a guest-private page [ SNP: Secure Nested Paging - not to be confused with Single Nucleotide Polymorphism, which is the more common use of that TLA. I am on a mission to write out the more obscure TLAs in order to keep track of them. Because while math tells us that there are only about 17k different combinations of three-letter acronyms using English letters (26^3), I am convinced that somehow Intel, AMD and ARM have together figured out new mathematics, and have at least a million different TLAs that they use. - Linus ] * tag 'snp_cache_coherency' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Evict cache lines during SNP memory validation commit 5cfdfc623835d40664f642b75a56d9934f24c5ff Author: Rob Herring (Arm) Date: Wed Aug 6 15:01:37 2025 -0500 dt-bindings: phy: marvell,comphy-cp110: Fix clock and child node constraints In converting marvell,comphy-cp110 to schema, the constraints for clocks on marvell,comphy-a3700 are wrong, the maximum number of child nodes are wrong, and the phy nodes may have a 'connector' child node: phy@18300 (marvell,comphy-a3700): clock-names: False schema does not allow ['xtal'] phy@120000 (marvell,comphy-cp110): 'phy@3', 'phy@4', 'phy@5' do not match any of the regexes: '^phy@[0-2]$', '^pinctrl-[0-9]+$' phy@120000 (marvell,comphy-cp110): phy@2: 'connector' does not match any of the regexes: '^pinctrl-[0-9]+$' Fixes: 50355ac70d4f ("dt-bindings: phy: Convert marvell,comphy-cp110 to DT schema") Signed-off-by: Rob Herring (Arm) Reviewed-by: Miquel Raynal Link: https://lore.kernel.org/r/20250806200138.1366189-1-robh@kernel.org Signed-off-by: Vinod Koul commit 810bd9066fb1871b8a9528f31f2fdbf2a8b73bf2 Author: David Thompson Date: Mon Aug 11 13:50:45 2025 -0400 gpio: mlxbf3: use platform_get_irq_optional() The gpio-mlxbf3 driver interfaces with two GPIO controllers, device instance 0 and 1. There is a single IRQ resource shared between the two controllers, and it is found in the ACPI table for device instance 0. The driver should not use platform_get_irq(), otherwise this error is logged when probing instance 1: mlxbf3_gpio MLNXBF33:01: error -ENXIO: IRQ index 0 not found Cc: stable@vger.kernel.org Fixes: cd33f216d241 ("gpio: mlxbf3: Add gpio driver support") Signed-off-by: David Thompson Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/ce70b98a201ce82b9df9aa80ac7a5eeaa2268e52.1754928650.git.davthompson@nvidia.com Signed-off-by: Bartosz Golaszewski commit 56bdf7270ff4f870e2d4bfacdc00161e766dba2d Author: David Thompson Date: Mon Aug 11 13:50:44 2025 -0400 Revert "gpio: mlxbf3: only get IRQ for device instance 0" This reverts commit 10af0273a35ab4513ca1546644b8c853044da134. While this change was merged, it is not the preferred solution. During review of a similar change to the gpio-mlxbf2 driver, the use of "platform_get_irq_optional" was identified as the preferred solution, so let's use it for gpio-mlxbf3 driver as well. Cc: stable@vger.kernel.org Fixes: 10af0273a35a ("gpio: mlxbf3: only get IRQ for device instance 0") Signed-off-by: David Thompson Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/8d2b630c71b3742f2c74242cf7d602706a6108e6.1754928650.git.davthompson@nvidia.com Signed-off-by: Bartosz Golaszewski commit d405ec23df13e6df599f5bd965a55d13420366b8 Author: Rafael J. Wysocki Date: Tue Aug 12 14:57:06 2025 +0200 ACPI: processor: perflib: Move problematic pr->performance check Commit d33bd88ac0eb ("ACPI: processor: perflib: Fix initial _PPC limit application") added a pr->performance check that prevents the frequency QoS request from being added when the given processor has no performance object. Unfortunately, this causes a WARN() in freq_qos_remove_request() to trigger on an attempt to take the given CPU offline later because the frequency QoS object has not been added for it due to the missing performance object. Address this by moving the pr->performance check before calling acpi_processor_get_platform_limit() so it only prevents a limit from being set for the CPU if the performance object is not present. This way, the frequency QoS request is added as it was before the above commit and it is present all the time along with the CPU's cpufreq policy regardless of whether or not the CPU is online. Fixes: d33bd88ac0eb ("ACPI: processor: perflib: Fix initial _PPC limit application") Tested-by: Rafael J. Wysocki Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2801421.mvXUDI8C0e@rafael.j.wysocki commit 970a7c68788e3fec237713eef22ace46507bcf9c Author: Danilo Krummrich Date: Tue Jul 22 17:00:01 2025 +0200 driver: rust: expand documentation for driver infrastructure Add documentation about generic driver infrastructure, representing a guideline on how the generic driver infrastructure is intended to be used to implement bus specific driver APIs. This covers aspects such as the bus specific driver trait, adapter implementation, driver registration and custom device ID types. Reviewed-by: Daniel Almeida Reviewed-by: Greg Kroah-Hartman Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250722150110.23565-4-dakr@kernel.org Signed-off-by: Danilo Krummrich commit d6e26c1ae4a602d8b7eeb39e23514f6f98d91eb5 Author: Danilo Krummrich Date: Tue Jul 22 17:00:00 2025 +0200 device: rust: expand documentation for Device The documentation for the generic Device type is outdated and deserves much more detail. Hence, expand the documentation and cover topics such as device types, device contexts, as well as information on how to use the generic device infrastructure to implement bus and class specific device types. Reviewed-by: Daniel Almeida Reviewed-by: Greg Kroah-Hartman Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250722150110.23565-3-dakr@kernel.org [ Add empty line after code blocks, "in" -> "within", remove unnecessary pin annotations in class device example. - Danilo ] Signed-off-by: Danilo Krummrich commit 82b3644d3deab496cc09f29f3449ede6824b3e8e Author: Danilo Krummrich Date: Tue Jul 22 16:59:59 2025 +0200 device: rust: expand documentation for DeviceContext Expand the documentation around DeviceContext states and types, in order to provide detailed information about their purpose and relationship with each other. Reviewed-by: Greg Kroah-Hartman Reviewed-by: Alexandre Courbot Reviewed-by: Alice Ryhl Reviewed-by: Daniel Almeida Link: https://lore.kernel.org/r/20250722150110.23565-2-dakr@kernel.org [ Fix two minor typos. - Danilo ] Signed-off-by: Danilo Krummrich commit c04fdca8a98af5fc4eeb6569917f159cfa56b923 Merge: 74078816f8b937 d8369183a01a9f Author: Paolo Abeni Date: Tue Aug 12 14:57:02 2025 +0200 Merge tag 'ipsec-2025-08-11' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec Steffen Klassert says: ==================== pull request (net): ipsec 2025-08-11 1) Fix flushing of all states in xfrm_state_fini. From Sabrina Dubroca. 2) Fix some IPsec software offload features. These got lost with some recent HW offload changes. From Sabrina Dubroca. Please pull or let me know if there are problems. * tag 'ipsec-2025-08-11' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec: udp: also consider secpath when evaluating ipsec use for checksumming xfrm: bring back device check in validate_xmit_xfrm xfrm: restore GSO for SW crypto xfrm: flush all states in xfrm_state_fini ==================== Link: https://patch.msgid.link/20250811092008.731573-1-steffen.klassert@secunet.com Signed-off-by: Paolo Abeni commit 9fc51941d9e7793da969b2c66e6f8213c5b1237f Author: Ping Cheng Date: Sun Aug 10 22:40:30 2025 -0700 HID: wacom: Add a new Art Pen 2 Signed-off-by: Ping Cheng Signed-off-by: Jiri Kosina commit 0379eb8691b9c4477da0277ae0832036ca4410b4 Author: Qasim Ijaz Date: Sun Aug 10 19:09:24 2025 +0100 HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() A malicious HID device can trigger a slab out-of-bounds during mt_report_fixup() by passing in report descriptor smaller than 607 bytes. mt_report_fixup() attempts to patch byte offset 607 of the descriptor with 0x25 by first checking if byte offset 607 is 0x15 however it lacks bounds checks to verify if the descriptor is big enough before conducting this check. Fix this bug by ensuring the descriptor size is at least 608 bytes before accessing it. Below is the KASAN splat after the out of bounds access happens: [ 13.671954] ================================================================== [ 13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110 [ 13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10 [ 13.673297] [ 13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3 [ 13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04 [ 13.673297] Call Trace: [ 13.673297] [ 13.673297] dump_stack_lvl+0x5f/0x80 [ 13.673297] print_report+0xd1/0x660 [ 13.673297] kasan_report+0xe5/0x120 [ 13.673297] __asan_report_load1_noabort+0x18/0x20 [ 13.673297] mt_report_fixup+0x103/0x110 [ 13.673297] hid_open_report+0x1ef/0x810 [ 13.673297] mt_probe+0x422/0x960 [ 13.673297] hid_device_probe+0x2e2/0x6f0 [ 13.673297] really_probe+0x1c6/0x6b0 [ 13.673297] __driver_probe_device+0x24f/0x310 [ 13.673297] driver_probe_device+0x4e/0x220 [ 13.673297] __device_attach_driver+0x169/0x320 [ 13.673297] bus_for_each_drv+0x11d/0x1b0 [ 13.673297] __device_attach+0x1b8/0x3e0 [ 13.673297] device_initial_probe+0x12/0x20 [ 13.673297] bus_probe_device+0x13d/0x180 [ 13.673297] device_add+0xe3a/0x1670 [ 13.673297] hid_add_device+0x31d/0xa40 [...] Fixes: c8000deb6836 ("HID: multitouch: Add support for GT7868Q") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz Reviewed-by: Jiri Slaby Signed-off-by: Jiri Kosina commit ac143d499479ca33b6f8d16395c32394089979cf Author: Colin Ian King Date: Thu Jul 24 12:11:18 2025 +0100 HID: Kconfig: Fix spelling mistake "enthropy" -> "entropy" There is a spelling mistake in the HID_U2FZERO description. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Jiri Kosina commit dfbd535db74df0343ca39670e06326d7aee8c8f4 Author: Zhang Lixu Date: Wed Jul 23 09:31:32 2025 +0800 HID: intel-ish-hid: Increase ISHTP resume ack timeout to 300ms During s2idle suspend/resume testing on some systems, occasional several tens of seconds delays were observed in HID sensor resume handling. Trace analysis revealed repeated "link not ready" timeout errors during set/get_report operations, which were traced to the hid_ishtp_cl_resume_handler() timing out while waiting for the ISHTP resume acknowledgment. The previous timeout was set to 50ms, which proved insufficient on affected machines. Empirical measurements on failing systems showed that the time from ISH resume initiation to receiving the ISHTP resume ack could be as long as 180ms. As a result, the 50ms timeout caused failures. To address this, increase the wait timeout for ISHTP resume ack from 50ms to 300ms, providing a safer margin for slower hardware. Additionally, add error logging when a timeout occurs to aid future debugging and issue triage. No functional changes are made beyond the timeout adjustment and improved error reporting. Signed-off-by: Zhang Lixu Reviewed-by: Andy Shevchenko Acked-by: Srinivas Pandruvada Signed-off-by: Jiri Kosina commit 74078816f8b937afbcc7c2991977527b2c77463d Merge: e93f7af1482223 b3fc08ab9a565e Author: Paolo Abeni Date: Tue Aug 12 14:43:08 2025 +0200 Merge branch 'net-prevent-deadlocks-and-mis-configuration-with-per-napi-threaded-config' Jakub Kicinski says: ==================== net: prevent deadlocks and mis-configuration with per-NAPI threaded config Running the test added with a recent fix on a driver with persistent NAPI config leads to a deadlock. The deadlock is fixed by patch 3, patch 2 is I think a more fundamental problem with the way we implemented the config. I hope the fix makes sense, my own thinking is definitely colored by my preference (IOW how the per-queue config RFC was implemented). v1: https://lore.kernel.org/20250808014952.724762-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250809001205.1147153-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit b3fc08ab9a565efb42fe08be046a0d203b82cdb8 Author: Jakub Kicinski Date: Fri Aug 8 17:12:05 2025 -0700 net: prevent deadlocks when enabling NAPIs with mixed kthread config The following order of calls currently deadlocks if: - device has threaded=1; and - NAPI has persistent config with threaded=0. netif_napi_add_weight_config() dev->threaded == 1 napi_kthread_create() napi_enable() napi_restore_config() napi_set_threaded(0) napi_stop_kthread() while (NAPIF_STATE_SCHED) msleep(20) We deadlock because disabled NAPI has STATE_SCHED set. Creating a thread in netif_napi_add() just to destroy it in napi_disable() is fairly ugly in the first place. Let's read both the device config and the NAPI config in netif_napi_add(). Fixes: e6d76268813d ("net: Update threaded state in napi config in netif_set_threaded") Signed-off-by: Jakub Kicinski Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250809001205.1147153-4-kuba@kernel.org Signed-off-by: Paolo Abeni commit ccba9f6baa900e31ad1a4c36e6f3c176694f9eac Author: Jakub Kicinski Date: Fri Aug 8 17:12:04 2025 -0700 net: update NAPI threaded config even for disabled NAPIs We have to make sure that all future NAPIs will have the right threaded state when the state is configured on the device level. We chose not to have an "unset" state for threaded, and not to wipe the NAPI config clean when channels are explicitly disabled. This means the persistent config structs "exist" even when their NAPIs are not instantiated. Differently put - the NAPI persistent state lives in the net_device (ncfg == struct napi_config): ,--- [napi 0] - [napi 1] [dev] | | `--- [ncfg 0] - [ncfg 1] so say we a device with 2 queues but only 1 enabled: ,--- [napi 0] [dev] | `--- [ncfg 0] - [ncfg 1] now we set the device to threaded=1: ,---------- [napi 0 (thr:1)] [dev(thr:1)] | `---------- [ncfg 0 (thr:1)] - [ncfg 1 (thr:?)] Since [ncfg 1] was not attached to a NAPI during configuration we skipped it. If we create a NAPI for it later it will have the old setting (presumably disabled). One could argue if this is right or not "in principle", but it's definitely not how things worked before per-NAPI config.. Fixes: 2677010e7793 ("Add support to set NAPI threaded for individual NAPI") Signed-off-by: Jakub Kicinski Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250809001205.1147153-3-kuba@kernel.org Signed-off-by: Paolo Abeni commit bda053d6445717f8a4cd76f88caea2e39299fe07 Author: Jakub Kicinski Date: Fri Aug 8 17:12:03 2025 -0700 selftests: drv-net: don't assume device has only 2 queues The test is implicitly assuming the device only has 2 queues. A real device will likely have more. The exact problem is that because NAPIs get added to the list from the head, the netlink dump reports them in reverse order. So the naive napis[0] will actually likely give us the _last_ NAPI, not the first one. Re-enable all the NAPIs instead of hard-coding 2 in the test. This way the NAPIs we operated on will always reappear, doesn't matter where they were in the registration order. Fixes: e6d76268813d ("net: Update threaded state in napi config in netif_set_threaded") Signed-off-by: Jakub Kicinski Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250809001205.1147153-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit 748f897511446c7578ca5f6d2ff099916bad6e28 Author: Edip Hazuri Date: Mon Jul 28 14:58:06 2025 +0300 platform/x86: hp-wmi: mark Victus 16-r1xxx for victus_s fan and thermal profile support This patch adds Victus 16-r1xxx laptop DMI board name into existing list. Tested on 16-r1077nt and works without any problem. Signed-off-by: Edip Hazuri Link: https://lore.kernel.org/r/20250728115805.20954-2-edip@medip.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit de5cec220e4d45d7129e76f7d985c7b01f10f8d9 Author: Suma Hegde Date: Mon Aug 4 10:15:51 2025 +0000 platform/x86/amd/hsmp: Ensure success even if hwmon registration fails Even if hwmon registration fails, HSMP remains accessible through the device file, so the operation should return success. Signed-off-by: Suma Hegde Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250804101551.89866-1-suma.hegde@amd.com Signed-off-by: Ilpo Järvinen commit 2c78fb287e1f430b929f2e49786518350d15605c Author: Suma Hegde Date: Thu Aug 7 10:06:37 2025 +0000 platform/x86/amd/hsmp: Ensure sock->metric_tbl_addr is non-NULL If metric table address is not allocated, accessing metrics_bin will result in a NULL pointer dereference, so add a check. Fixes: 5150542b8ec5 ("platform/x86/amd/hsmp: add support for metrics tbl") Signed-off-by: Suma Hegde Link: https://lore.kernel.org/r/20250807100637.952729-1-suma.hegde@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dff6f36878799a5ffabd15336ce993dc737374dc Author: Srinivas Pandruvada Date: Sun Jul 27 14:05:13 2025 -0700 platform/x86/intel-uncore-freq: Check write blocked for ELC Add the missing write_blocked check for updating sysfs related to uncore efficiency latency control (ELC). If write operation is blocked return error. Fixes: bb516dc79c4a ("platform/x86/intel-uncore-freq: Add support for efficiency latency control") Signed-off-by: Srinivas Pandruvada Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250727210513.2898630-1-srinivas.pandruvada@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5b9e07551faa7bb2f26cb039cc6e8d00bc4d0831 Author: Mario Limonciello Date: Thu Jul 24 13:51:08 2025 -0500 platform/x86/amd: pmc: Drop SMU F/W match for Cezanne Chris reported that even on a BIOS that has a new enough SMU F/W version there is still a spurious IRQ1. Although the solution was added to SMU F/W 64.66.0 it turns out there needs to be a matching SBIOS change to activate it. Thus Linux shouldn't be avoiding the IRQ1 workaround on newer SMU F/W because there is no indication the BIOS change is in place. Drop the match for 64.66.0+ and instead match all RN/CZN/BRC (they all share same SMU F/W). Adjust the quirk infrastructure to allow quirking the workaround on or off and also adjust existing quirks to match properly. Unfortunately this may cause some systems that did have the SBIOS change in place to regress in keyboard wakeup but we don't have a way to know. If a user reports a keyboard wakeup regression they can run with amd_pmc.disable_workarounds=1 to deactivate the workaround and share DMI data so that their system can be quirked not to use the workaround in the upstream kernel. Reported-by: Chris Bainbridge Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4449 Tested-by: Chris Bainbridge Signed-off-by: Mario Limonciello Link: https://lore.kernel.org/r/20250724185156.1827592-1-superm1@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d26a9f4f0a7745f0d5127344379a62007df68dcd Author: Armin Wolf Date: Tue Jul 22 20:38:41 2025 +0200 platform/x86: dell-smbios-wmi: Stop touching WMI device ID The Dell SMBIOS driver uses the "id" field inside struct device for prioritizing the WMI backend over the SMM backend. Because of this the WMI backend modifies the "id" field of the underlying WMI device. However the WMI core itself uses wdev->dev.id internally to track device IDs, so modifying this value will result in a resource leak. Fix this by not using the "id" field inside struct device for SMBIOS prioritization. Instead extend struct smbios_device with a separate "priority" field. Tested on a Dell Inspiron 3505. Fixes: 73f0f2b52c5e ("platform/x86: wmi: Fix WMI device naming issue") Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250722183841.9552-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dcb82900b12f5809e66835918d4043284ce1d39c Author: Thorsten Blum Date: Sun Aug 10 23:41:05 2025 +0200 ASoC: codecs: Call strscpy() with correct size argument In aw8xxxx_profile_info(), strscpy() is called with the length of the source string "null" rather than the size of the destination buffer. This is fine as long as the destination buffer is larger than the source string, but we should still use the destination buffer size instead to call strscpy() as intended. And since 'name' points to the fixed-size buffer 'uinfo->value.enumerated.name', we can safely omit the size argument and let strscpy() infer it using sizeof() and remove 'name'. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250810214144.1985-2-thorsten.blum@linux.dev Signed-off-by: Mark Brown commit e93f7af148222303c4632318536c0f649b4ee5b1 Author: Jordan Rife Date: Fri Aug 8 11:57:56 2025 -0700 docs: Fix name for net.ipv4.udp_child_hash_entries udp_child_ehash_entries -> udp_child_hash_entries Fixes: 9804985bf27f ("udp: Introduce optional per-netns hash table.") Signed-off-by: Jordan Rife Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250808185800.1189042-1-jordan@jrife.io Signed-off-by: Paolo Abeni commit b3e8c3dfce8d31e176584e03e8fa50613c766e47 Merge: 8ea25274ebaf2f a7f75e2883c4bd Author: Paolo Abeni Date: Tue Aug 12 12:52:24 2025 +0200 Merge branch 'fix-broken-link-with-th1520-gmac-when-linkspeed-changes' Yao Zi says: ==================== Fix broken link with TH1520 GMAC when linkspeed changes It's noted that on TH1520 SoC, the GMAC's link becomes broken after the link speed is changed (for example, running ethtool -s eth0 speed 100 on the peer when negotiated to 1Gbps), but the GMAC could function normally if the speed is brought back to the initial. Just like many other SoCs utilizing STMMAC IP, we need to adjust the TX clock supplying TH1520's GMAC through some SoC-specific glue registers when linkspeed changes. But it's found that after the full kernel startup, reading from them results in garbage and writing to them makes no effect, which is the cause of broken link. Further testing shows perisys-apb4-hclk must be ungated for normal access to Th1520 GMAC APB glue registers, which is neither described in dt-binding nor acquired by the driver. This series expands the dt-binding of TH1520's GMAC to allow an extra "APB glue registers interface clock", instructs the driver to acquire and enable the clock, and finally supplies CLK_PERISYS_APB4_HCLK for TH1520's GMACs in SoC devicetree. v2: https://lore.kernel.org/netdev/20250801091240.46114-1-ziyao@disroot.org/ v1: https://lore.kernel.org/all/20250729093734.40132-1-ziyao@disroot.org/ ==================== Link: https://patch.msgid.link/20250808093655.48074-2-ziyao@disroot.org Signed-off-by: Paolo Abeni commit a7f75e2883c4bd57b12c3be61bb926929adad9c0 Author: Yao Zi Date: Fri Aug 8 09:36:56 2025 +0000 riscv: dts: thead: Add APB clocks for TH1520 GMACs Describe perisys-apb4-hclk as the APB clock for TH1520 SoC, which is essential for accessing GMAC glue registers. Fixes: 7e756671a664 ("riscv: dts: thead: Add TH1520 ethernet nodes") Signed-off-by: Yao Zi Reviewed-by: Drew Fustini Tested-by: Drew Fustini Link: https://patch.msgid.link/20250808093655.48074-5-ziyao@disroot.org Signed-off-by: Paolo Abeni commit 4cc339ce482ba78589a2d5cbe1c84b735d263383 Author: Yao Zi Date: Fri Aug 8 09:36:55 2025 +0000 net: stmmac: thead: Get and enable APB clock on initialization It's necessary to adjust the MAC TX clock when the linkspeed changes, but it's noted such adjustment always fails on TH1520 SoC, and reading back from APB glue registers that control clock generation results in garbage, causing broken link. With some testing, it's found a clock must be ungated for access to APB glue registers. Without any consumer, the clock is automatically disabled during late kernel startup. Let's get and enable it if it's described in devicetree. For backward compatibility with older devicetrees, probing won't fail if the APB clock isn't found. In this case, we emit a warning since the link will break if the speed changes. Fixes: 33a1a01e3afa ("net: stmmac: Add glue layer for T-HEAD TH1520 SoC") Signed-off-by: Yao Zi Tested-by: Drew Fustini Reviewed-by: Drew Fustini Link: https://patch.msgid.link/20250808093655.48074-4-ziyao@disroot.org Signed-off-by: Paolo Abeni commit c8a9a619c072e9a45e9a9b4b035269427dc00aa8 Author: Yao Zi Date: Fri Aug 8 09:36:54 2025 +0000 dt-bindings: net: thead,th1520-gmac: Describe APB interface clock Besides ones for GMAC core and peripheral registers, the TH1520 GMAC requires one more clock for configuring APB glue registers. Describe it in the binding. Fixes: f920ce04c399 ("dt-bindings: net: Add T-HEAD dwmac support") Signed-off-by: Yao Zi Acked-by: Krzysztof Kozlowski Reviewed-by: Drew Fustini Link: https://patch.msgid.link/20250808093655.48074-3-ziyao@disroot.org Signed-off-by: Paolo Abeni commit 942e47ab228c7dd27c2ae043c17e7aab2028082c Author: Pengyu Luo Date: Tue Aug 12 17:39:56 2025 +0800 phy: qualcomm: phy-qcom-eusb2-repeater: fix override properties property "qcom,tune-usb2-preem" is for EUSB2_TUNE_USB2_PREEM property "qcom,tune-usb2-amplitude" is for EUSB2_TUNE_IUSB2 The downstream correspondence is as follows: EUSB2_TUNE_USB2_PREEM: Tx pre-emphasis tuning EUSB2_TUNE_IUSB2: HS trasmit amplitude EUSB2_TUNE_SQUELCH_U: Squelch detection threshold EUSB2_TUNE_HSDISC: HS disconnect threshold EUSB2_TUNE_EUSB_SLEW: slew rate Fixes: 31bc94de7602 ("phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers") Signed-off-by: Pengyu Luo Reviewed-by: Konrad Dybcio Reviewed-by: Luca Weiss Link: https://lore.kernel.org/r/20250812093957.32235-1-mitltlatltl@gmail.com Signed-off-by: Vinod Koul commit 5eb1bcdb6a8c088514019c3a9bda5d565beed1af Author: Nikunj A Dadhania Date: Tue Jul 22 13:18:53 2025 +0530 x86/sev: Improve handling of writes to intercepted TSC MSRs Currently, when a Secure TSC enabled SNP guest attempts to write to the intercepted GUEST_TSC_FREQ MSR (a read-only MSR), the guest kernel response incorrectly implies a VMM configuration error, when in fact it is the usual VMM configuration to intercept writes to read-only MSRs, unless explicitly documented. Modify the intercepted TSC MSR #VC handling: * Write to GUEST_TSC_FREQ will generate a #GP instead of terminating the guest * Write to MSR_IA32_TSC will generate a #GP instead of silently ignoring it However, continue to terminate the guest when reading from intercepted GUEST_TSC_FREQ MSR with Secure TSC enabled, as intercepted reads indicate an improper VMM configuration for Secure TSC enabled SNP guests. [ bp: simplify comment. ] Fixes: 38cc6495cdec ("x86/sev: Prevent GUEST_TSC_FREQ MSR interception for Secure TSC enabled guests") Suggested-by: Sean Christopherson Signed-off-by: Nikunj A Dadhania Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/20250722074853.22253-1-nikunj@amd.com commit 8ea25274ebaf2f6be8be374633b2ed8348ec0e70 Author: Buday Csaba Date: Thu Aug 7 15:54:49 2025 +0200 net: mdiobus: release reset_gpio in mdiobus_unregister_device() reset_gpio is claimed in mdiobus_register_device(), but it is not released in mdiobus_unregister_device(). It is instead only released when the whole MDIO bus is unregistered. When a device uses the reset_gpio property, it becomes impossible to unregister it and register it again, because the GPIO remains claimed. This patch resolves that issue. Fixes: bafbdd527d56 ("phylib: Add device reset GPIO support") # see notes Reviewed-by: Andrew Lunn Cc: Csókás Bence [ csokas.bence: Resolve rebase conflict and clarify msg ] Signed-off-by: Buday Csaba Link: https://patch.msgid.link/20250807135449.254254-2-csokas.bence@prolan.hu Signed-off-by: Paolo Abeni commit 8ee90742cf29427683294a6a80f1e2b7f4af1cff Author: Clark Wang Date: Thu Aug 7 12:08:32 2025 +0800 net: phy: nxp-c45-tja11xx: fix the PHY ID mismatch issue when using C45 TJA1103/04/20/21 support both C22 and C45 accessing methods. The TJA11xx driver has implemented the match_phy_device() API. However, it does not handle the C45 ID. If C45 was used to access TJA11xx, match_phy_device() would always return false due to phydev->phy_id only used by C22 being empty, resulting in the generic phy driver being used for TJA11xx PHYs. Therefore, check phydev->c45_ids.device_ids[MDIO_MMD_PMAPMD] when using C45. Fixes: 1b76b2497aba ("net: phy: nxp-c45-tja11xx: simplify .match_phy_device OP") Signed-off-by: Clark Wang Link: https://patch.msgid.link/20250807040832.2455306-1-xiaoning.wang@nxp.com Signed-off-by: Paolo Abeni commit 184889dfe0568528fd6d14bba864dd57ed45bbf2 Author: Jouni Högander Date: Fri Aug 1 09:29:05 2025 +0300 drm/i915/psr: Do not trigger Frame Change events from frontbuffer flush We want to get rid of triggering "Frame Change" events from frontbuffer flush calls. We are about to move using TRANS_PUSH register for this on LunarLake and onwards. Touching TRANS_PUSH register from fronbuffer flush would be problematic as it's written by DSB as well. Fix this by using intel_psr_exit when flush or invalidate is done on LunarLake and onwards. This is not possible on AlderLake and MeteorLake due to HW bug in PSR2 disable. This patch is also fixing problems with cursor plane where cursor is disappearing or duplicate cursor is seen on the screen. v2: Commit message updated Bspec: 68927, 68934, 66624 Reported-by: Janna Martl Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5522 Fixes: 411ad63877bb ("drm/i915/psr: Use SFF_CTL on invalidate/flush for LunarLake onwards") Tested-by: Janna Martl Signed-off-by: Jouni Högander Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250801062905.564453-1-jouni.hogander@intel.com (cherry picked from commit 46fb38cb20c0d185a6391ab524b23e0e0219c41f) Signed-off-by: Tvrtko Ursulin commit fd56b9c9507f32b16159f9a922e1af5628254567 Author: Vinod Govindapillai Date: Tue Jul 29 15:46:48 2025 +0300 drm/i915/fbc: fix the implementation of wa_18038517565 As per the wa_18038517565, we need to disable FBC compressor clock gating before enabling FBC and enable after disabling FBC. Placing the enabling of clock gating in the fbc deactivate function can make the above wa logic go wrong in case of frontbuffer rendering FBC mechanism. FBC deactivate can get called during fb invalidate and then the corresponding FBC activate can get called without properly disabling the clock gating and can result in compression stalled. So move the enable clock gating at the end of one FBC session after FBC is completely disabled for a pipe. Bspec: 74212, 72197, 69741, 65555 Fixes: 010363c46189 ("drm/i915/display: implement wa_18038517565") Signed-off-by: Vinod Govindapillai Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/20250729124648.288497-1-vinod.govindapillai@intel.com (cherry picked from commit 82dde0407ab126f8413fd6c51429e5057ced5ba2) Signed-off-by: Tvrtko Ursulin commit 9af8f2b469c0438620832f3729a3c5c03853b56b Author: Jocelyn Falempe Date: Fri Jun 27 14:38:19 2025 +0200 drm/panic: Add a u64 divide by 10 for arm32 On 32bits ARM, u64 divided by a constant is not optimized to a multiply by inverse by the compiler [1]. So do the multiply by inverse explicitly for this architecture. Link: https://github.com/llvm/llvm-project/issues/37280 [1] Reported-by: Andrei Lalaev Closes: https://lore.kernel.org/dri-devel/c0a2771c-f3f5-4d4c-aa82-d673b3c5cb46@gmail.com/ Fixes: 675008f196ca ("drm/panic: Use a decimal fifo to avoid u64 by u64 divide") Reviewed-by: Alice Ryhl Signed-off-by: Jocelyn Falempe commit 54d4f445517fe8350d735624d7f4225e7511d9eb Author: Adrián Larumbe Date: Fri Aug 8 02:02:34 2025 +0100 drm/panfrost: Print RSS for tiler heap BO's in debugfs GEMS file Otherwise it would display the virtual allocation size, which is often much bigger than the RSS. Signed-off-by: Adrián Larumbe Fixes: e48ade5e23ba ("drm/panfrost: show device-wide list of DRM GEM objects over DebugFS") Tested-by: Christopher Healy Reviewed-by: Daniel Stone Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250808010235.2831853-1-adrian.larumbe@collabora.com commit c0e1b774f68bdbea1618e356e30672c7f1e32509 Author: Jialin Wang Date: Fri Aug 8 00:54:55 2025 +0800 proc: proc_maps_open allow proc_mem_open to return NULL The commit 65c66047259f ("proc: fix the issue of proc_mem_open returning NULL") caused proc_maps_open() to return -ESRCH when proc_mem_open() returns NULL. This breaks legitimate /proc//maps access for kernel threads since kernel threads have NULL mm_struct. The regression causes perf to fail and exit when profiling a kernel thread: # perf record -v -g -p $(pgrep kswapd0) ... couldn't open /proc/65/task/65/maps This patch partially reverts the commit to fix it. Link: https://lkml.kernel.org/r/20250807165455.73656-1-wjl.linux@gmail.com Fixes: 65c66047259f ("proc: fix the issue of proc_mem_open returning NULL") Signed-off-by: Jialin Wang Cc: Penglei Jiang Cc: Signed-off-by: Andrew Morton commit 0b5be138ce00f421bd7cc5a226061bd62c4ab850 Author: Lorenzo Stoakes Date: Thu Aug 7 19:58:19 2025 +0100 mm/mremap: avoid expensive folio lookup on mremap folio pte batch It was discovered in the attached report that commit f822a9a81a31 ("mm: optimize mremap() by PTE batching") introduced a significant performance regression on a number of metrics on x86-64, most notably stress-ng.bigheap.realloc_calls_per_sec - indicating a 37.3% regression in number of mremap() calls per second. I was able to reproduce this locally on an intel x86-64 raptor lake system, noting an average of 143,857 realloc calls/sec (with a stddev of 4,531 or 3.1%) prior to this patch being applied, and 81,503 afterwards (stddev of 2,131 or 2.6%) - a 43.3% regression. During testing I was able to determine that there was no meaningful difference in efforts to optimise the folio_pte_batch() operation, nor checking folio_test_large(). This is within expectation, as a regression this large is likely to indicate we are accessing memory that is not yet in a cache line (and perhaps may even cause a main memory fetch). The expectation by those discussing this from the start was that vm_normal_folio() (invoked by mremap_folio_pte_batch()) would likely be the culprit due to having to retrieve memory from the vmemmap (which mremap() page table moves does not otherwise do, meaning this is inevitably cold memory). I was able to definitively determine that this theory is indeed correct and the cause of the issue. The solution is to restore part of an approach previously discarded on review, that is to invoke pte_batch_hint() which explicitly determines, through reference to the PTE alone (thus no vmemmap lookup), what the PTE batch size may be. On platforms other than arm64 this is currently hardcoded to return 1, so this naturally resolves the issue for x86-64, and for arm64 introduces little to no overhead as the pte cache line will be hot. With this patch applied, we move from 81,503 realloc calls/sec to 138,701 (stddev of 496.1 or 0.4%), which is a -3.6% regression, however accounting for the variance in the original result, this is broadly restoring performance to its prior state. Link: https://lkml.kernel.org/r/20250807185819.199865-1-lorenzo.stoakes@oracle.com Fixes: f822a9a81a31 ("mm: optimize mremap() by PTE batching") Signed-off-by: Lorenzo Stoakes Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202508071609.4e743d7c-lkp@intel.com Acked-by: David Hildenbrand Acked-by: Pedro Falcato Reviewed-by: Barry Song Acked-by: Vlastimil Babka Reviewed-by: Dev Jain Cc: Ryan Roberts Cc: Barry Song Cc: Jann Horn Cc: Liam Howlett Signed-off-by: Andrew Morton commit aba6faec0103ed8f169be8dce2ead41fcb689446 Author: Suren Baghdasaryan Date: Wed Aug 6 15:00:22 2025 -0700 userfaultfd: fix a crash in UFFDIO_MOVE when PMD is a migration entry When UFFDIO_MOVE encounters a migration PMD entry, it proceeds with obtaining a folio and accessing it even though the entry is swp_entry_t. Add the missing check and let split_huge_pmd() handle migration entries. While at it also remove unnecessary folio check. [surenb@google.com: remove extra folio check, per David] Link: https://lkml.kernel.org/r/20250807200418.1963585-1-surenb@google.com Link: https://lkml.kernel.org/r/20250806220022.926763-1-surenb@google.com Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI") Signed-off-by: Suren Baghdasaryan Reported-by: syzbot+b446dbe27035ef6bd6c2@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68794b5c.a70a0220.693ce.0050.GAE@google.com/ Reviewed-by: Peter Xu Acked-by: David Hildenbrand Cc: Andrea Arcangeli Cc: Lokesh Gidra Cc: Signed-off-by: Andrew Morton commit cf1b80dc31a1137b8b4568c138b453bf7453204a Author: Dev Jain Date: Wed Aug 6 20:26:11 2025 +0530 mm: pass page directly instead of using folio_page In commit_anon_folio_batch(), we iterate over all pages pointed to by the PTE batch. Therefore we need to know the first page of the batch; currently we derive that via folio_page(folio, 0), but, that takes us to the first (head) page of the folio instead - our PTE batch may lie in the middle of the folio, leading to incorrectness. Bite the bullet and throw away the micro-optimization of reusing the folio in favour of code simplicity. Derive the page and the folio in change_pte_range, and pass the page too to commit_anon_folio_batch to fix the aforementioned issue. Link: https://lkml.kernel.org/r/20250806145611.3962-1-dev.jain@arm.com Fixes: cac1db8c3aad ("mm: optimize mprotect() by PTE batching") Reported-by: syzbot+57bcc752f0df8bb1365c@syzkaller.appspotmail.com Signed-off-by: Dev Jain Reviewed-by: Lorenzo Stoakes Debugged-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Anshuman Khandual Cc: Barry Song Cc: Catalin Marinas Cc: Christophe Leroy Cc: Hugh Dickins Cc: Jann Horn Cc: Joey Gouly Cc: Kevin Brodsky Cc: Lance Yang Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Ryan Roberts Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Yicong Yang Cc: Zhenhua Huang Cc: Zi Yan Signed-off-by: Andrew Morton commit ab5ac789efa985e42bdb5b5e8a7a4ad84935d44e Author: Sukrut Heroorkar Date: Tue Aug 5 00:56:14 2025 +0200 selftests/proc: fix string literal warning in proc-maps-race.c This change resolves non literal string format warning invoked for proc-maps-race.c while compiling. proc-maps-race.c:205:17: warning: format not a string literal and no format arguments [-Wformat-security] 205 | printf(text); | ^~~~~~ proc-maps-race.c:209:17: warning: format not a string literal and no format arguments [-Wformat-security] 209 | printf(text); | ^~~~~~ proc-maps-race.c: In function `print_last_lines': proc-maps-race.c:224:9: warning: format not a string literal and no format arguments [-Wformat-security] 224 | printf(start); | ^~~~~~ Add string format specifier %s for the printf calls in both print_first_lines() and print_last_lines() thus resolving the warnings. The test executes fine after this change thus causing no effect to the functional behavior of the test. Link: https://lkml.kernel.org/r/20250804225633.841777-1-hsukrut3@gmail.com Fixes: aadc099c480f ("selftests/proc: add verbose mode for /proc/pid/maps tearing tests") Signed-off-by: Sukrut Heroorkar Acked-by: Suren Baghdasaryan Cc: David Hunter Cc: Shuah Khan Signed-off-by: Andrew Morton commit d7f1affc556e07208453224a025bd67583671ae2 Author: Dmitry Antipov Date: Fri Aug 8 17:52:21 2025 +0300 cifs: avoid extra calls to strlen() in cifs_get_spnego_key() Since 'snprintf()' returns the number of characters emitted, an output position may be advanced with this return value rather than using an explicit calls to 'strlen()'. Compile tested only. Signed-off-by: Dmitry Antipov Signed-off-by: Steve French commit b63335fb3d32579c5ff0b7038b9cc23688fff528 Author: David Howells Date: Mon Aug 11 08:34:04 2025 +0100 cifs: Fix collect_sample() to handle any iterator type collect_sample() is used to gather samples of the data in a Write op for analysis to try and determine if the compression algorithm is likely to achieve anything more quickly than actually running the compression algorithm. However, collect_sample() assumes that the data it is going to be sampling is stored in an ITER_XARRAY-type iterator (which it now should never be) and doesn't actually check that it is before accessing the underlying xarray directly. Fix this by replacing the code with a loop that just uses the standard iterator functions to sample every other 2KiB block, skipping the intervening ones. It's not quite the same as the previous algorithm as it doesn't necessarily align to the pages within an ordinary write from the pagecache. Note that the btrfs code from which this was derived samples the inode's pagecache directly rather than the iterator - but that doesn't necessarily work for network filesystems if O_DIRECT is in operation. Fixes: 94ae8c3fee94 ("smb: client: compress: LZ77 code improvements cleanup") Signed-off-by: David Howells Acked-by: Paulo Alcantara (Red Hat) cc: Enzo Matsumiya cc: Shyam Prasad N cc: Tom Talpey cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Signed-off-by: Steve French commit 89886abd073489e26614e4d80fb8eb70d3938a0b Author: Russell King (Oracle) Date: Fri Aug 8 13:16:39 2025 +0100 net: stmmac: dwc-qos: fix clk prepare/enable leak on probe failure dwc_eth_dwmac_probe() gets bulk clocks, and then prepares and enables them. Unfortunately, if dwc_eth_dwmac_config_dt() or stmmac_dvr_probe() fail, we leave the clocks prepared and enabled. Fix this by using devm_clk_bulk_get_all_enabled() to combine the steps and provide devm based release of the prepare and enable state. This also fixes a similar leakin dwc_eth_dwmac_remove() which wasn't correctly retrieving the struct plat_stmmacenet_data. This becomes unnecessary. Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Fixes: a045e40645df ("net: stmmac: refactor clock management in EQoS driver") Link: https://patch.msgid.link/E1ukM1X-0086qu-Td@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit de1e963ad064caf73ee2c7485b925f381a3aefbf Author: Russell King (Oracle) Date: Fri Aug 8 13:16:34 2025 +0100 net: stmmac: rk: put the PHY clock on remove The PHY clock (bsp_priv->clk_phy) is obtained using of_clk_get(), which doesn't take part in the devm release. Therefore, when a device is unbound, this clock needs to be explicitly put. Fix this. Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Fixes: fecd4d7eef8b ("net: stmmac: dwmac-rk: Add integrated PHY support") Link: https://patch.msgid.link/E1ukM1S-0086qo-PC@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 52966bf71de98fef4ca7b3be1349adc7459d6d53 Author: Jeff Layton Date: Fri Aug 8 07:45:23 2025 -0400 ref_tracker: use %p instead of %px in debugfs dentry name As Kees points out, this is a kernel address leak, and debugging is not a sufficiently good reason to expose the real kernel address. Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir") Reported-by: Kees Cook Closes: https://lore.kernel.org/netdev/202507301603.62E553F93@keescook/ Signed-off-by: Jeff Layton Reviewed-by: Eric Dumazet Signed-off-by: Jakub Kicinski commit 61aaca8b89fb98be58b8df19f01181bb983cccff Author: Fabio Porcedda Date: Fri Aug 8 15:31:08 2025 +0200 net: usb: qmi_wwan: add Telit Cinterion FN990A w/audio composition Add the following Telit Cinterion FN990A w/audio composition: 0x1077: tty (diag) + adb + rmnet + audio + tty (AT/NMEA) + tty (AT) + tty (AT) + tty (AT) T: Bus=01 Lev=01 Prnt=01 Port=09 Cnt=01 Dev#= 8 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1bc7 ProdID=1077 Rev=05.04 S: Manufacturer=Telit Wireless Solutions S: Product=FN990 S: SerialNumber=67e04c35 C: #Ifs=10 Cfg#= 1 Atr=e0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=50 Driver=qmi_wwan E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=83(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I: If#= 3 Alt= 0 #EPs= 0 Cls=01(audio) Sub=01 Prot=20 Driver=snd-usb-audio I: If#= 4 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio E: Ad=03(O) Atr=0d(Isoc) MxPS= 68 Ivl=1ms I: If#= 5 Alt= 1 #EPs= 1 Cls=01(audio) Sub=02 Prot=20 Driver=snd-usb-audio E: Ad=84(I) Atr=0d(Isoc) MxPS= 68 Ivl=1ms I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=60 Driver=option E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 7 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=88(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 8 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8a(I) Atr=03(Int.) MxPS= 10 Ivl=32ms I: If#= 9 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8b(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=8c(I) Atr=03(Int.) MxPS= 10 Ivl=32ms Cc: stable@vger.kernel.org Signed-off-by: Fabio Porcedda Acked-by: Bjørn Mork Signed-off-by: Jakub Kicinski commit b132a3b0c228125dfda03ba7c7903ef133e1ee21 Author: Dave Hansen Date: Fri Aug 8 10:39:25 2025 -0700 MAINTAINERS: Remove bouncing T7XX reviewer This reviewer's email no longer works. Remove it from MAINTAINERS. Signed-off-by: Dave Hansen Cc: Chandrashekar Devegowda Cc: Liu Haijun Cc: Ricardo Martinez Link: https://patch.msgid.link/20250808173925.FECE3782@davehans-spike.ostc.intel.com Signed-off-by: Jakub Kicinski commit b56e9fb1c9669ce460dc899cecb09a54a6d71cf4 Author: Dave Hansen Date: Fri Aug 8 10:53:24 2025 -0700 MAINTAINERS: Mark Intel PTP DFL ToD as orphaned This maintainer's email no longer works. Remove it from MAINTAINERS. Also mark the code as an Orphan. Signed-off-by: Dave Hansen Cc: Richard Cochran Cc: Tianfei Zhang Cc: Andrew Lunn Link: https://patch.msgid.link/20250808175324.8C4B7354@davehans-spike.ostc.intel.com Signed-off-by: Jakub Kicinski commit 7573980c7049450a0af22acd4f8e96f37ea30c48 Author: Dave Hansen Date: Fri Aug 8 10:45:05 2025 -0700 MAINTAINERS: Mark Intel WWAN IOSM driver as orphaned This maintainer's email no longer works. Remove it from MAINTAINERS. I've been unable to locate a new maintainer for this at Intel. Mark the driver as Orphaned. Signed-off-by: Dave Hansen Cc: Loic Poulain Cc: Johannes Berg Cc: Andrew Lunn Acked-by: Sergey Ryazanov Link: https://patch.msgid.link/20250808174505.C9FF434F@davehans-spike.ostc.intel.com Signed-off-by: Jakub Kicinski commit 360077278ba62e81310080f075a1a3028e778ef9 Author: Danilo Krummrich Date: Thu Jul 31 17:48:09 2025 +0200 rust: drm: don't pass the address of drm::Device to drm_dev_put() In drm_dev_put() call in AlwaysRefCounted::dec_ref() we rely on struct drm_device to be the first field in drm::Device, whereas everywhere else we correctly obtain the address of the actual struct drm_device. Analogous to the from_drm_device() helper, provide the into_drm_device() helper in order to address this. Fixes: 1e4b8896c0f3 ("rust: drm: add device abstraction") Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250731154919.4132-5-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 0c04a81c1d0214d5b2025f805ccec1ac37c96b08 Author: Danilo Krummrich Date: Thu Jul 31 17:48:08 2025 +0200 rust: drm: remove pin annotations from drm::Device The #[pin_data] and #[pin] annotations are not necessary for drm::Device, since we don't use any pin-init macros, but only __pinned_init() on the impl PinInit argument of drm::Device::new(). Fixes: 1e4b8896c0f3 ("rust: drm: add device abstraction") Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250731154919.4132-4-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 22ab0641b939967f630d108e33a3582841ad6846 Author: Danilo Krummrich Date: Thu Jul 31 17:48:07 2025 +0200 rust: drm: ensure kmalloc() compatible Layout drm::Device is allocated through __drm_dev_alloc() (which uses kmalloc()) and the driver private data, ::Data, is initialized in-place. Due to the order of fields in drm::Device pub struct Device { dev: Opaque, data: T::Data, } even with an arbitrary large alignment requirement of T::Data it can't happen that the size of Device is smaller than its alignment requirement. However, let's not rely on this subtle circumstance and create a proper kmalloc() compatible Layout. Fixes: 1e4b8896c0f3 ("rust: drm: add device abstraction") Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250731154919.4132-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit fde578c86281f27b182680c7642836a0dbbd0be7 Author: Danilo Krummrich Date: Thu Jul 31 17:48:06 2025 +0200 rust: alloc: replace aligned_size() with Kmalloc::aligned_layout() aligned_size() dates back to when Rust did support kmalloc() only, but is now used in ReallocFunc::call() and hence for all allocators. However, the additional padding applied by aligned_size() is only required by the kmalloc() allocator backend. Hence, replace aligned_size() with Kmalloc::aligned_layout() and use it for the affected allocators, i.e. kmalloc() and kvmalloc(), only. While at it, make Kmalloc::aligned_layout() public, such that Rust abstractions, which have to call subsystem specific kmalloc() based allocation primitives directly, can make use of it. Fixes: 8a799831fc63 ("rust: alloc: implement `ReallocFunc`") Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250731154919.4132-2-dakr@kernel.org [ Remove `const` from Kmalloc::aligned_layout(). - Danilo ] Signed-off-by: Danilo Krummrich commit dfdc31e7ccf3ac1d5ec01d5120c71e14745e3dd8 Author: Jean-Baptiste Maneyrol Date: Fri Aug 8 09:40:10 2025 +0200 iio: imu: inv_icm42600: change invalid data error to -EBUSY Temperature sensor returns the temperature of the mechanical parts of the chip. If both accel and gyro are off, the temperature sensor is also automatically turned off and returns invalid data. In this case, returning -EBUSY error code is better then -EINVAL and indicates userspace that it needs to retry reading temperature in another context. Fixes: bc3eb0207fb5 ("iio: imu: inv_icm42600: add temperature sensor support") Signed-off-by: Jean-Baptiste Maneyrol Cc: stable@vger.kernel.org Reviewed-by: Andy Shevchenko Reviewed-by: Sean Nyekjaer Link: https://patch.msgid.link/20250808-inv-icm42600-change-temperature-error-code-v1-1-986fbf63b77d@tdk.com Signed-off-by: Jonathan Cameron commit 197e299aae42ffa19028eaea92b2f30dd9fb8445 Author: David Lechner Date: Sat Jul 26 11:28:48 2025 -0500 iio: adc: ad7124: fix channel lookup in syscalib functions Fix possible incorrect channel lookup in the syscalib functions by using the correct channel address instead of the channel number. In the ad7124 driver, the channel field of struct iio_chan_spec is the input pin number of the positive input of the channel. This can be, but is not always the same as the index in the channels array. The correct index in the channels array is stored in the address field (and also scan_index). We use the address field to perform the correct lookup. Fixes: 47036a03a303 ("iio: adc: ad7124: Implement internal calibration at probe time") Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250726-iio-adc-ad7124-fix-channel-lookup-in-syscalib-v1-1-b9d14bb684af@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit ae5bc07ec9f73a41734270ef3f800c5c8a7e0ad3 Author: David Lechner Date: Mon Jul 21 18:04:04 2025 -0500 iio: temperature: maxim_thermocouple: use DMA-safe buffer for spi_read() Replace using stack-allocated buffers with a DMA-safe buffer for use with spi_read(). This allows the driver to be safely used with DMA-enabled SPI controllers. The buffer array is also converted to a struct with a union to make the usage of the memory in the buffer more clear and ensure proper alignment. Fixes: 1f25ca11d84a ("iio: temperature: add support for Maxim thermocouple chips") Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250721-iio-use-more-iio_declare_buffer_with_ts-3-v2-1-0c68d41ccf6c@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit 1cfb22c277c7274f54babaa5b416dfbc00181e16 Author: David Lechner Date: Tue Jul 22 14:20:07 2025 -0500 iio: adc: ad7173: prevent scan if too many setups requested Add a check to ad7173_update_scan_mode() to ensure that we didn't exceed the maximum number of unique channel configurations. In the AD7173 family of chips, there are some chips that have 16 CHANNELx registers but only 8 setups (combination of CONFIGx, FILTERx, GAINx and OFFSETx registers). Since commit 92c247216918 ("iio: adc: ad7173: fix num_slots"), it is possible to have more than 8 channels enabled in a scan at the same time, so it is possible to get a bad configuration when more than 8 channels are using unique configurations. This happens because the algorithm to allocate the setup slots only takes into account which slot has been least recently used and doesn't know about the maximum number of slots available. Since the algorithm to allocate the setup slots is quite complex, it is simpler to check after the fact if the current state is valid or not. So this patch adds a check in ad7173_update_scan_mode() after setting up all of the configurations to make sure that the actual setup still matches the requested setup for each enabled channel. If not, we prevent the scan from being enabled and return an error. The setup comparison in ad7173_setup_equal() is refactored to a separate function since we need to call it in two places now. Fixes: 92c247216918 ("iio: adc: ad7173: fix num_slots") Signed-off-by: David Lechner Link: https://patch.msgid.link/20250722-iio-adc-ad7173-fix-setup-use-limits-v2-1-8e96bdb72a9c@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit de18e978d0cda23e4c102e18092b63a5b0b3a800 Author: David Lechner Date: Tue Jul 22 15:54:21 2025 -0500 iio: proximity: isl29501: fix buffered read on big-endian systems Fix passing a u32 value as a u16 buffer scan item. This works on little- endian systems, but not on big-endian systems. A new local variable is introduced for getting the register value and the array is changed to a struct to make the data layout more explicit rather than just changing the type and having to recalculate the proper length needed for the timestamp. Fixes: 1c28799257bc ("iio: light: isl29501: Add support for the ISL29501 ToF sensor.") Signed-off-by: David Lechner Link: https://patch.msgid.link/20250722-iio-use-more-iio_declare_buffer_with_ts-7-v2-1-d3ebeb001ed3@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit 4e5b705cc6147f0b9173c6219079f41416bdd3c0 Author: David Lechner Date: Wed Jul 23 10:29:12 2025 -0500 iio: accel: sca3300: fix uninitialized iio scan data Fix potential leak of uninitialized stack data to userspace by ensuring that the `channels` array is zeroed before use. Fixes: edeb67fbbf4b ("iio: accel: sca3300: use IIO_DECLARE_BUFFER_WITH_TS") Signed-off-by: David Lechner Link: https://patch.msgid.link/20250723-iio-accel-sca3300-fix-uninitialized-iio-scan-data-v1-1-12dbfb3307b7@baylibre.com Signed-off-by: Jonathan Cameron commit 31cd31c9e17ece125aad27259501a2af69ccb020 Author: Fushuai Wang Date: Mon Aug 11 11:50:44 2025 -0700 x86/fpu: Fix NULL dereference in avx512_status() Problem ------- With CONFIG_X86_DEBUG_FPU enabled, reading /proc/[kthread]/arch_status causes a warning and a NULL pointer dereference. This is because the AVX-512 timestamp code uses x86_task_fpu() but doesn't check it for NULL. CONFIG_X86_DEBUG_FPU addles that function for kernel threads (PF_KTHREAD specifically), making it return NULL. The point of the warning was to ensure that kernel threads only access task->fpu after going through kernel_fpu_begin()/_end(). Note: all kernel tasks exposed in /proc have a valid task->fpu. Solution -------- One option is to silence the warning and check for NULL from x86_task_fpu(). However, that warning is fairly fresh and seems like a defense against misuse of the FPU state in kernel threads. Instead, stop outputting AVX-512_elapsed_ms for kernel threads altogether. The data was garbage anyway because avx512_timestamp is only updated for user threads, not kernel threads. If anyone ever wants to track kernel thread AVX-512 use, they can come back later and do it properly, separate from this bug fix. [ dhansen: mostly rewrite changelog ] Fixes: 22aafe3bcb67 ("x86/fpu: Remove init_task FPU state dependencies, add debugging warning for PF_KTHREAD tasks") Co-developed-by: Sohil Mehta Signed-off-by: Sohil Mehta Signed-off-by: Fushuai Wang Signed-off-by: Dave Hansen Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20250811185044.2227268-1-sohil.mehta%40intel.com commit 3ead77989c20cb2d774a3b6045d7a928b6fb53ed Author: Srinivas Pandruvada Date: Fri Aug 8 07:51:22 2025 -0700 cpufreq: intel_pstate: Support Clearwater Forest OOB mode Prevent intel_pstate from loading when OOB (Out Of Band) P-states mode is enabled. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250808145122.4057208-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit fa3fa55de0d6177fdcaf6fc254f13cc8f33c3eed Author: Rafael J. Wysocki Date: Mon Aug 11 17:03:11 2025 +0200 cpuidle: governors: menu: Avoid using invalid recent intervals data Marc has reported that commit 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") caused the number of wakeup interrupts to increase on an idle system [1], which was not expected to happen after merely allowing shallower idle states to be selected by the governor in some cases. However, on the system in question, all of the idle states deeper than WFI are rejected by the driver due to a firmware issue [2]. This causes the governor to only consider the recent interval duriation data corresponding to attempts to enter WFI that are successful and the recent invervals table is filled with values lower than the scheduler tick period. Consequently, the governor predicts an idle duration below the scheduler tick period length and avoids stopping the tick more often which leads to the observed symptom. Address it by modifying the governor to update the recent intervals table also when entering the previously selected idle state fails, so it knows that the short idle intervals might have been the minority had the selected idle states been actually entered every time. Fixes: 85975daeaa4d ("cpuidle: menu: Avoid discarding useful information") Link: https://lore.kernel.org/linux-pm/86o6sv6n94.wl-maz@kernel.org/ [1] Link: https://lore.kernel.org/linux-pm/7ffcb716-9a1b-48c2-aaa4-469d0df7c792@arm.com/ [2] Signed-off-by: Rafael J. Wysocki Tested-by: Christian Loehle Tested-by: Marc Zyngier Reviewed-by: Christian Loehle Link: https://patch.msgid.link/2793874.mvXUDI8C0e@rafael.j.wysocki commit e91a158b694d7f4bd937763dde79ed0afa472d8a Author: Len Brown Date: Fri Aug 8 15:37:14 2025 -0400 intel_idle: Allow loading ACPI tables for any family There is no reason to limit intel_idle's loading of ACPI tables to family 6. Upcoming Intel processors are not in family 6. Below "Fixes" really means "applies cleanly until". That syntax commit didn't change the previous logic, but shows this patch applies back 5-years. Fixes: 4a9f45a0533f ("intel_idle: Convert to new X86 CPU match macros") Signed-off-by: Len Brown Link: https://patch.msgid.link/06101aa4fe784e5b0be1cb2c0bdd9afcf16bd9d4.1754681697.git.len.brown@intel.com Signed-off-by: Rafael J. Wysocki commit e69980bd16f264581c3f606bae987e54f0ba8c4a Author: Jiapeng Chong Date: Fri Jul 25 17:04:12 2025 +0800 selftests/sched_ext: Remove duplicate sched.h header ./tools/testing/selftests/sched_ext/hotplug.c: sched.h is included more than once. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22941 Signed-off-by: Jiapeng Chong Acked-by: Andrea Righi Signed-off-by: Tejun Heo commit ddf7233fcab6c247379d0928d46cc316ee122229 Author: Andrea Righi Date: Tue Aug 5 10:59:11 2025 +0200 sched/ext: Fix invalid task state transitions on class switch When enabling a sched_ext scheduler, we may trigger invalid task state transitions, resulting in warnings like the following (which can be easily reproduced by running the hotplug selftest in a loop): sched_ext: Invalid task state transition 0 -> 3 for fish[770] WARNING: CPU: 18 PID: 787 at kernel/sched/ext.c:3862 scx_set_task_state+0x7c/0xc0 ... RIP: 0010:scx_set_task_state+0x7c/0xc0 ... Call Trace: scx_enable_task+0x11f/0x2e0 switching_to_scx+0x24/0x110 scx_enable.isra.0+0xd14/0x13d0 bpf_struct_ops_link_create+0x136/0x1a0 __sys_bpf+0x1edd/0x2c30 __x64_sys_bpf+0x21/0x30 do_syscall_64+0xbb/0x370 entry_SYSCALL_64_after_hwframe+0x77/0x7f This happens because we skip initialization for tasks that are already dead (with their usage counter set to zero), but we don't exclude them during the scheduling class transition phase. Fix this by also skipping dead tasks during class swiching, preventing invalid task state transitions. Fixes: a8532fac7b5d2 ("sched_ext: TASK_DEAD tasks must be switched into SCX on ops_enable") Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 0452f08395f8e7d04fe3744443dad396b3330d0c Author: Tang Yizhou Date: Mon Jul 28 01:39:59 2025 +0800 blk-wbt: doc: Update the doc of the wbt_lat_usec interface The symbol wb_window_usec cannot be found. Update the doc to reflect the latest implementation, in other words, the debugfs interface 'curr_win_nsec'. Signed-off-by: Tang Yizhou Reviewed-by: Jan Kara Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20250727173959.160835-4-yizhou.tang@shopee.com Signed-off-by: Jens Axboe commit bccdfcd56d4b5b78d0d76f46d0e89a51330dfd75 Author: Tang Yizhou Date: Mon Jul 28 01:39:58 2025 +0800 blk-wbt: Eliminate ambiguity in the comments of struct rq_wb In the current implementation, the last_issue and last_comp members of struct rq_wb are used only by read requests and not by non-throttled write requests. Therefore, eliminate the ambiguity here. Signed-off-by: Tang Yizhou Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20250727173959.160835-3-yizhou.tang@shopee.com Signed-off-by: Jens Axboe commit d8b96a79622e03813c221450498ca9742704ebf2 Author: Tang Yizhou Date: Mon Jul 28 01:39:57 2025 +0800 blk-wbt: Optimize wbt_done() for non-throttled writes In the current implementation, the sync_cookie and last_cookie members of struct rq_wb are used only by read requests and not by non-throttled write requests. Based on this, we can optimize wbt_done() by removing one if condition check for non-throttled write requests. Signed-off-by: Tang Yizhou Reviewed-by: Jan Kara Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20250727173959.160835-2-yizhou.tang@shopee.com Signed-off-by: Jens Axboe commit 4b0ad968717eb1862b74c1f549e4225bf95c286f Author: Krzysztof Kozlowski Date: Mon Aug 11 16:15:27 2025 +0200 regulator: dt-bindings: infineon,ir38060: Add Guenter as maintainer from IBM The infineon,ir38060 binding never got maintainer and fake "Not Me" entry have been causing dt_binding_check warnings for 1.5 years now: regulator/infineon,ir38060.yaml: maintainers:0: 'Not Me.' does not match '@' Guenter agreed to keep an eye for this hardware and binding. Cc: Guenter Roeck Cc: Conor Dooley Cc: Andrew Jeffery Cc: Ninad Palsule Signed-off-by: Krzysztof Kozlowski Acked-by: Guenter Roeck Link: https://patch.msgid.link/20250811141526.168752-2-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit dfb36e4a8db0cd56f92d4cb445f54e85a9b40897 Author: Waiman Long Date: Mon Aug 11 10:11:47 2025 -0400 futex: Use user_write_access_begin/_end() in futex_put_value() Commit cec199c5e39b ("futex: Implement FUTEX2_NUMA") introduced the futex_put_value() helper to write a value to the given user address. However, it uses user_read_access_begin() before the write. For architectures that differentiate between read and write accesses, like PowerPC, futex_put_value() fails with -EFAULT. Fix that by using the user_write_access_begin/user_write_access_end() pair instead. Fixes: cec199c5e39b ("futex: Implement FUTEX2_NUMA") Signed-off-by: Waiman Long Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/20250811141147.322261-1-longman@redhat.com commit f87d597e8393f7038de046ed7f13bb176a4ead55 Author: Danilo Krummrich Date: Fri Aug 8 11:20:49 2025 +0200 MAINTAINERS: entry for DRM GPUVM GPUVM deserves a bit more coordination, also given the upcoming Rust work for GPUVM, hence add a dedicated maintainers entry for DRM GPUVM. Cc: Boris Brezillon Cc: Matthew Brost Cc: Thomas Hellström Cc: Alice Ryhl Acked-by: Thomas Hellström Acked-by: Matthew Brost Acked-by: Alice Ryhl Link: https://lore.kernel.org/r/20250808092432.461250-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 4fa7d880aeb8cdbdaa4fb72be3e53ac1d6bcc088 Author: David Kaplan Date: Mon Jul 21 11:03:10 2025 -0500 x86/bugs: Select best SRSO mitigation The SRSO bug can theoretically be used to conduct user->user or guest->guest attacks and requires a mitigation (namely IBPB instead of SBPB on context switch) for these. So mark SRSO as being applicable to the user->user and guest->guest attack vectors. Additionally, SRSO supports multiple mitigations which mitigate different potential attack vectors. Some CPUs are also immune to SRSO from certain attack vectors (like user->kernel). Use the specific attack vectors requiring mitigation to select the best SRSO mitigation to avoid unnecessary performance hits. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250721160310.1804203-1-david.kaplan@amd.com commit 5634c8cb298a7146b4e38873473e280b50e27a2c Author: Nitin Gote Date: Fri Jul 18 16:20:51 2025 +0530 iosys-map: Fix undefined behavior in iosys_map_clear() The current iosys_map_clear() implementation reads the potentially uninitialized 'is_iomem' boolean field to decide which union member to clear. This causes undefined behavior when called on uninitialized structures, as 'is_iomem' may contain garbage values like 0xFF. UBSAN detects this as: UBSAN: invalid-load in include/linux/iosys-map.h:267 load of value 255 is not a valid value for type '_Bool' Fix by unconditionally clearing the entire structure with memset(), eliminating the need to read uninitialized data and ensuring all fields are set to known good values. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14639 Fixes: 01fd30da0474 ("dma-buf: Add struct dma-buf-map for storing struct dma_buf.vaddr_ptr") Signed-off-by: Nitin Gote Reviewed-by: Andi Shyti Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250718105051.2709487-1-nitin.r.gote@intel.com commit 05663d88fd0b8ee1c54ab2d5fb36f9b6a3ed37f7 Author: José Expósito Date: Mon Jun 30 11:00:54 2025 +0200 drm/tests: Fix drm_test_fb_xrgb8888_to_xrgb2101010() on big-endian Fix failures on big-endian architectures on tests cases single_pixel_source_buffer, single_pixel_clip_rectangle, well_known_colors and destination_pitch. Fixes: 15bda1f8de5d ("drm/tests: Add calls to drm_fb_blit() on supported format conversion tests") Signed-off-by: José Expósito Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250630090054.353246-2-jose.exposito89@gmail.com commit d28b9d2925b4f773adb21b1fc20260ddc370fb13 Author: José Expósito Date: Mon Jun 30 11:00:53 2025 +0200 drm/tests: Fix endian warning When compiling with sparse enabled, this warning is thrown: warning: incorrect type in argument 2 (different base types) expected restricted __le32 const [usertype] *buf got unsigned int [usertype] *[assigned] buf Add a cast to fix it. Fixes: 453114319699 ("drm/format-helper: Add KUnit tests for drm_fb_xrgb8888_to_xrgb2101010()") Signed-off-by: José Expósito Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250630090054.353246-1-jose.exposito89@gmail.com commit 8d2b0853add1d7534dc0794e3c8e0b9e8c4ec640 Merge: 01c2afe7358385 8f5ae30d69d754 Author: Thomas Zimmermann Date: Mon Aug 11 16:49:06 2025 +0200 Merge drm/drm-fixes into drm-misc-fixes Updating drm-misc-fixes to the state of v6.17-rc1. Begins a new release cycle. Signed-off-by: Thomas Zimmermann commit 53e760d8949895390e256e723e7ee46618310361 Merge: 8f5ae30d69d754 bee47cb026e762 Author: Linus Torvalds Date: Mon Aug 11 07:38:55 2025 -0700 Merge tag 'nfsd-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd fixes from Chuck Lever: - A correctness fix for delegated timestamps - Address an NFSD shutdown hang when LOCALIO is in use - Prevent a remotely exploitable crasher when TLS is in use * tag 'nfsd-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: sunrpc: fix handling of server side tls alerts nfsd: avoid ref leak in nfsd_open_local_fh() nfsd: don't set the ctime on delegated atime updates commit b26e2afb3834d4a61ce54c8484ff6014bef0b4b7 Author: Vasiliy Kovalev Date: Mon Aug 11 16:27:16 2025 +0300 ALSA: hda/realtek: Fix headset mic on HONOR BRB-X Add a PCI quirk to enable microphone input on the headphone jack on the HONOR BRB-X M1010 laptop. Signed-off-by: Vasiliy Kovalev Cc: Link: https://patch.msgid.link/20250811132716.45076-1-kovalev@altlinux.org Signed-off-by: Takashi Iwai commit 6d3c3ca4c77e93660cce5819bf707f75df03e0c8 Author: Vlastimil Babka Date: Fri Aug 8 15:28:47 2025 +0200 module: Rename EXPORT_SYMBOL_GPL_FOR_MODULES to EXPORT_SYMBOL_FOR_MODULES Christoph suggested that the explicit _GPL_ can be dropped from the module namespace export macro, as it's intended for in-tree modules only. It would be possible to restrict it technically, but it was pointed out [2] that some cases of using an out-of-tree build of an in-tree module with the same name are legitimate. But in that case those also have to be GPL anyway so it's unnecessary to spell it out in the macro name. Link: https://lore.kernel.org/all/aFleJN_fE-RbSoFD@infradead.org/ [1] Link: https://lore.kernel.org/all/CAK7LNATRkZHwJGpojCnvdiaoDnP%2BaeUXgdey5sb_8muzdWTMkA@mail.gmail.com/ [2] Suggested-by: Christoph Hellwig Reviewed-by: Shivank Garg Acked-by: David Hildenbrand Acked-by: Nicolas Schier Reviewed-by: Daniel Gomez Reviewed-by: Christian Brauner Signed-off-by: Vlastimil Babka Link: https://lore.kernel.org/20250808-export_modules-v4-1-426945bcc5e1@suse.cz Signed-off-by: Christian Brauner commit 593d9e4c3d634c370f226f55453c376bf43b3684 Author: Yuntao Wang Date: Mon Aug 11 13:24:26 2025 +0800 fs: fix incorrect lflags value in the move_mount syscall The lflags value used to look up from_path was overwritten by the one used to look up to_path. In other words, from_path was looked up with the wrong lflags value. Fix it. Fixes: f9fde814de37 ("fs: support getname_maybe_null() in move_mount()") Signed-off-by: Yuntao Wang Link: https://lore.kernel.org/20250811052426.129188-1-yuntao.wang@linux.dev [Christian Brauner : massage patch] Signed-off-by: Christian Brauner commit 343dc5423bfe876c12bb80c56f5e44286e442a07 Author: Zheng Qixing Date: Fri Aug 8 13:36:09 2025 +0800 block: fix kobject double initialization in add_disk Device-mapper can call add_disk() multiple times for the same gendisk due to its two-phase creation process (dm create + dm load). This leads to kobject double initialization errors when the underlying iSCSI devices become temporarily unavailable and then reappear. However, if the first add_disk() call fails and is retried, the queue_kobj gets initialized twice, causing: kobject: kobject (ffff88810c27bb90): tried to init an initialized object, something is seriously wrong. Call Trace: dump_stack_lvl+0x5b/0x80 kobject_init.cold+0x43/0x51 blk_register_queue+0x46/0x280 add_disk_fwnode+0xb5/0x280 dm_setup_md_queue+0x194/0x1c0 table_load+0x297/0x2d0 ctl_ioctl+0x2a2/0x480 dm_ctl_ioctl+0xe/0x20 __x64_sys_ioctl+0xc7/0x110 do_syscall_64+0x72/0x390 entry_SYSCALL_64_after_hwframe+0x76/0x7e Fix this by separating kobject initialization from sysfs registration: - Initialize queue_kobj early during gendisk allocation - add_disk() only adds the already-initialized kobject to sysfs - del_gendisk() removes from sysfs but doesn't destroy the kobject - Final cleanup happens when the disk is released Fixes: 2bd85221a625 ("block: untangle request_queue refcounting from sysfs") Reported-by: Li Lingfeng Closes: https://lore.kernel.org/all/83591d0b-2467-433c-bce0-5581298eb161@huawei.com/ Signed-off-by: Zheng Qixing Reviewed-by: Ming Lei Reviewed-by: Yu Kuai Reviewed-by: Nilay Shroff Link: https://lore.kernel.org/r/20250808053609.3237836-1-zhengqixing@huaweicloud.com Signed-off-by: Jens Axboe commit 196447c712dd486f4315356c572a1d13dd743f08 Author: Qianfeng Rong Date: Sat Aug 9 22:13:58 2025 +0800 blk-cgroup: remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. Signed-off-by: Qianfeng Rong Acked-by: Tejun Heo Link: https://lore.kernel.org/r/20250809141358.168781-1-rongqianfeng@vivo.com Signed-off-by: Jens Axboe commit 8f3e4e87b0945aeea8b5a5aa43c419f4a1b4ca6a Author: Qianfeng Rong Date: Mon Aug 11 16:11:35 2025 +0800 block, bfq: remove redundant __GFP_NOWARN Commit 16f5dfbc851b ("gfp: include __GFP_NOWARN in GFP_NOWAIT") made GFP_NOWAIT implicitly include __GFP_NOWARN. Therefore, explicit __GFP_NOWARN combined with GFP_NOWAIT (e.g., `GFP_NOWAIT | __GFP_NOWARN`) is now redundant. Let's clean up these redundant flags across subsystems. Reviewed-by: Yu Kuai Signed-off-by: Qianfeng Rong Link: https://lore.kernel.org/r/20250811081135.374315-1-rongqianfeng@vivo.com Signed-off-by: Jens Axboe commit 5058a62875e1916e5133a1639f0207ea2148c0bc Author: Caleb Sander Mateos Date: Fri Aug 8 09:52:15 2025 -0600 ublk: check for unprivileged daemon on each I/O fetch Commit ab03a61c6614 ("ublk: have a per-io daemon instead of a per-queue daemon") allowed each ublk I/O to have an independent daemon task. However, nr_privileged_daemon is only computed based on whether the last I/O fetched in each ublk queue has an unprivileged daemon task. Fix this by checking whether every fetched I/O's daemon is privileged. Change nr_privileged_daemon from a count of queues to a boolean indicating whether any I/Os have an unprivileged daemon. Signed-off-by: Caleb Sander Mateos Fixes: ab03a61c6614 ("ublk: have a per-io daemon instead of a per-queue daemon") Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250808155216.296170-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 212c928d01e9ea1d1c46a114650b551da8ca823e Author: Uday Shankar Date: Fri Aug 8 15:44:43 2025 -0600 ublk: don't quiesce in ublk_ch_release ublk_ch_release currently quiesces the device's request_queue while setting force_abort/fail_io. This avoids data races by preventing concurrent reads from the I/O path, but is not strictly needed - at this point, canceling is already set and guaranteed to be observed by any concurrently executing I/Os, so they will be handled properly even if the changes to force_abort/fail_io propagate to the I/O path later. Remove the quiesce/unquiesce calls from ublk_ch_release. This makes the writes to force_abort/fail_io concurrent with the reads in the I/O path, so make the accesses atomic. Before this change, the call to blk_mq_quiesce_queue was responsible for most (90%) of the runtime of ublk_ch_release. With that call eliminated, ublk_ch_release runs much faster. Here is a comparison of the total time spent in calls to ublk_ch_release when a server handling 128 devices exits, before and after this change: before: 1.11s after: 0.09s Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250808-ublk_quiesce2-v1-1-f87ade33fa3d@purestorage.com Signed-off-by: Jens Axboe commit d5dd409812eca084e68208926bb629c8f708651f Author: Philipp Reisner Date: Thu Jun 5 12:38:52 2025 +0200 drbd: Remove the open-coded page pool If the network stack keeps a reference for too long, DRBD keeps references on a higher number of pages as a consequence. Fix all that by no longer relying on page reference counts dropping to an expected value. Instead, DRBD gives up its reference and lets the system handle everything else. While at it, remove the open-coded custom page pool mechanism and use the page_pool included in the kernel. Signed-off-by: Philipp Reisner Signed-off-by: Christoph Böhmwalder Tested-by: Eric Hagberg Link: https://lore.kernel.org/r/20250605103852.23029-1-christoph.boehmwalder@linbit.com Signed-off-by: Jens Axboe commit 2319f9d0aa644eb9666c7be903078f50ecc2eb5b Author: Nam Cao Date: Mon Aug 11 09:49:57 2025 +0200 selftests/coredump: Remove the read() that fails the test Resolve a conflict between commit 6a68d28066b6 ("selftests/coredump: Fix "socket_detect_userspace_client" test failure") and commit 994dc26302ed ("selftests/coredump: fix build") The first commit adds a read() to wait for write() from another thread to finish. But the second commit removes the write(). Now that the two commits are in the same tree, the read() now gets EOF and the test fails. Remove this read() so that the test passes. Signed-off-by: Nam Cao Link: https://lore.kernel.org/20250811074957.4079616-1-namcao@linutronix.de Signed-off-by: Christian Brauner commit 542ede096e48436dbd70869640c0d88180565933 Author: Joanne Koong Date: Thu Aug 7 10:50:15 2025 -0700 fuse: keep inode->i_blkbits constant With fuse now using iomap for writeback handling, inode blkbits changes are problematic because iomap relies on inode->i_blkbits for its internal bitmap logic. Currently we change inode->i_blkbits in fuse to match the attr->blksize value passed in by the server. This commit keeps inode->i_blkbits constant in fuse. Any attr->blksize values passed in by the server will not update inode->i_blkbits. The client-side behavior for stat is unaffected, stat will still reflect the blocksize passed in by the server. Signed-off-by: Joanne Koong Link: https://lore.kernel.org/20250807175015.515192-1-joannelkoong@gmail.com Fixes: ef7e7cbb32 ("fuse: use iomap for writeback") Signed-off-by: Christian Brauner commit bef2981bad91d4714b1edf86e95f23bf57496d86 Merge: 6b65028e2b51c0 81e4b9cf365df4 Author: Christian Brauner Date: Fri Aug 8 15:45:26 2025 +0200 Merge patch series "open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE" Aleksa Sarai says: As described in commit 7a54947e727b ('Merge patch series "fs: allow changing idmappings"'), open_tree_attr(2) was necessary in order to allow for a detached mount to be created and have its idmappings changed without the risk of any racing threads operating on it. For this reason, mount_setattr(2) still does not allow for id-mappings to be changed. However, there was a bug in commit 2462651ffa76 ("fs: allow changing idmappings") which allowed users to bypass this restriction by calling open_tree_attr(2) *without* OPEN_TREE_CLONE. can_idmap_mount() prevented this bug from allowing an attached mountpoint's id-mapping from being modified (thanks to an is_anon_ns() check), but this still allows for detached (but visible) mounts to have their be id-mapping changed. This risks the same UAF and locking issues as described in the merge commit, and was likely unintentional. For what it's worth, I found this while working on the open_tree_attr(2) man page, and was trying to figure out what open_tree_attr(2)'s behaviour was in the (slightly fruity) ~OPEN_TREE_CLONE case. * patches from https://lore.kernel.org/20250808-open_tree_attr-bugfix-idmap-v1-0-0ec7bc05646c@cyphar.com: selftests/mount_setattr: add smoke tests for open_tree_attr(2) bug open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE Link: https://lore.kernel.org/20250808-open_tree_attr-bugfix-idmap-v1-0-0ec7bc05646c@cyphar.com Signed-off-by: Christian Brauner commit 6b65028e2b51c023a816eabffea88980fdd5564e Author: Jan Kara Date: Wed Jul 30 12:28:41 2025 +0200 iomap: Fix broken data integrity guarantees for O_SYNC writes Commit d279c80e0bac ("iomap: inline iomap_dio_bio_opflags()") has broken the logic in iomap_dio_bio_iter() in a way that when the device does support FUA (or has no writeback cache) and the direct IO happens to freshly allocated or unwritten extents, we will *not* issue fsync after completing direct IO O_SYNC / O_DSYNC write because the IOMAP_DIO_WRITE_THROUGH flag stays mistakenly set. Fix the problem by clearing IOMAP_DIO_WRITE_THROUGH whenever we do not perform FUA write as it was originally intended. CC: John Garry CC: Ritesh Harjani (IBM) Fixes: d279c80e0bac ("iomap: inline iomap_dio_bio_opflags()") CC: stable@vger.kernel.org Signed-off-by: Jan Kara Link: https://lore.kernel.org/20250730102840.20470-2-jack@suse.cz Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: John Garry Reviewed-by: Darrick J. Wong Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit 81e4b9cf365df4cde30157a85cc9f3d673946118 Author: Aleksa Sarai Date: Fri Aug 8 03:55:06 2025 +1000 selftests/mount_setattr: add smoke tests for open_tree_attr(2) bug There appear to be no other open_tree_attr(2) tests at the moment, but as a minimal solution just add some additional checks in the existing MOUNT_ATTR_IDMAP tests to make sure that open_tree_attr(2) cannot be used to bypass the tested restrictions that apply to mount_setattr(2). Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/20250808-open_tree_attr-bugfix-idmap-v1-2-0ec7bc05646c@cyphar.com Signed-off-by: Christian Brauner commit 9308366f062129d52e0ee3f7a019f7dd41db33df Author: Aleksa Sarai Date: Fri Aug 8 03:55:05 2025 +1000 open_tree_attr: do not allow id-mapping changes without OPEN_TREE_CLONE As described in commit 7a54947e727b ('Merge patch series "fs: allow changing idmappings"'), open_tree_attr(2) was necessary in order to allow for a detached mount to be created and have its idmappings changed without the risk of any racing threads operating on it. For this reason, mount_setattr(2) still does not allow for id-mappings to be changed. However, there was a bug in commit 2462651ffa76 ("fs: allow changing idmappings") which allowed users to bypass this restriction by calling open_tree_attr(2) *without* OPEN_TREE_CLONE. can_idmap_mount() prevented this bug from allowing an attached mountpoint's id-mapping from being modified (thanks to an is_anon_ns() check), but this still allows for detached (but visible) mounts to have their be id-mapping changed. This risks the same UAF and locking issues as described in the merge commit, and was likely unintentional. Fixes: 2462651ffa76 ("fs: allow changing idmappings") Cc: stable@vger.kernel.org # v6.15+ Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/20250808-open_tree_attr-bugfix-idmap-v1-1-0ec7bc05646c@cyphar.com Signed-off-by: Christian Brauner commit d02d2c98d25793902f65803ab853b592c7a96b29 Author: Jiufei Xue Date: Mon Jul 28 18:07:15 2025 +0800 fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirty() get the bdi_writeback that was in the progress of switching. CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1 ...... pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __mark_inode_dirty+0x124/0x418 lr : __mark_inode_dirty+0x118/0x418 sp : ffffffc08c9dbbc0 ........ Call trace: __mark_inode_dirty+0x124/0x418 generic_update_time+0x4c/0x60 file_modified+0xcc/0xd0 ext4_buffered_write_iter+0x58/0x124 ext4_file_write_iter+0x54/0x704 vfs_write+0x1c0/0x308 ksys_write+0x74/0x10c __arm64_sys_write+0x1c/0x28 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x40/0xe4 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x194/0x198 Root cause is: systemd-random-seed kworker ---------------------------------------------------------------------- ___mark_inode_dirty inode_switch_wbs_work_fn spin_lock(&inode->i_lock); inode_attach_wb locked_inode_to_wb_and_lock_list get inode->i_wb spin_unlock(&inode->i_lock); spin_lock(&wb->list_lock) spin_lock(&inode->i_lock) inode_io_list_move_locked spin_unlock(&wb->list_lock) spin_unlock(&inode->i_lock) spin_lock(&old_wb->list_lock) inode_do_switch_wbs spin_lock(&inode->i_lock) inode->i_wb = new_wb spin_unlock(&inode->i_lock) spin_unlock(&old_wb->list_lock) wb_put_many(old_wb, nr_switched) cgwb_release old wb released wb_wakeup_delayed() accesses wb, then trigger the use-after-free issue Fix this race condition by holding inode spinlock until wb_wakeup_delayed() finished. Signed-off-by: Jiufei Xue Link: https://lore.kernel.org/20250728100715.3863241-1-jiufei.xue@samsung.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit f76823e3b284aae30797fded988a807eab2da246 Author: Christoph Hellwig Date: Wed Jul 23 07:35:44 2025 +0200 xfs: split xfs_zone_record_blocks xfs_zone_record_blocks not only records successfully written blocks that now back file data, but is also used for blocks speculatively written by garbage collection that were never linked to an inode and instantly become invalid. Split the latter functionality out to be easier to understand. This also make it clear that we don't need to attach the rmap inode to a transaction for the skipped blocks case as we never dirty any peristent data structure. Also make the argument order to xfs_zone_record_blocks a bit more natural. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 5d94b19f066480addfcdcb5efde66152ad5a7c0e Author: Andrey Albershteyn Date: Thu Jul 31 19:07:22 2025 +0200 xfs: fix scrub trace with null pointer in quotacheck The quotacheck doesn't initialize sc->ip. Cc: stable@vger.kernel.org # v6.8 Fixes: 21d7500929c8a0 ("xfs: improve dquot iteration for scrub") Reviewed-by: Darrick J. Wong Signed-off-by: Andrey Albershteyn Signed-off-by: Carlos Maiolino commit 8dc5e9b037138317c1d3151a7dabe41fa171cee1 Author: John Garry Date: Thu Jul 24 08:12:15 2025 +0000 xfs: reject max_atomic_write mount option for no reflink If the FS has no reflink, then atomic writes greater than 1x block are not supported. As such, for no reflink it is pointless to accept setting max_atomic_write when it cannot be supported, so reject max_atomic_write mount option in this case. It could be still possible to accept max_atomic_write option of size 1x block if HW atomics are supported, so check for this specifically. Fixes: 4528b9052731 ("xfs: allow sysadmins to specify a maximum atomic write limit at mount time") Signed-off-by: John Garry Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 68456d05eb57a5d16b4be2d3caf421bdcf2de72e Author: John Garry Date: Thu Jul 24 08:12:14 2025 +0000 xfs: disallow atomic writes on DAX Atomic writes are not currently supported for DAX, but two problems exist: - we may go down DAX write path for IOCB_ATOMIC, which does not handle IOCB_ATOMIC properly - we report non-zero atomic write limits in statx (for DAX inodes) We may want atomic writes support on DAX in future, but just disallow for now. For this, ensure when IOCB_ATOMIC is set that we check the write size versus the atomic write min and max before branching off to the DAX write path. This is not strictly required for DAX, as we should not get this far in the write path as FMODE_CAN_ATOMIC_WRITE should not be set. In addition, due to reflink being supported for DAX, we automatically get CoW-based atomic writes support being advertised. Remedy this by disallowing atomic writes for a DAX inode for both sw and hw modes. Reported-by: Darrick J. Wong Fixes: 9dffc58f2384 ("xfs: update atomic write limits") Reviewed-by: Darrick J. Wong Signed-off-by: John Garry Signed-off-by: Carlos Maiolino commit e7fb9b71326f43bab25fb8f18c6bfebd7a628696 Author: John Garry Date: Thu Jul 24 08:12:13 2025 +0000 fs/dax: Reject IOCB_ATOMIC in dax_iomap_rw() The DAX write path does not support IOCB_ATOMIC, so reject it when set. Suggested-by: Darrick J. Wong Signed-off-by: John Garry Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 82efde9cf2e4ce25eac96a20e36eae7c338df1e0 Author: Christoph Hellwig Date: Wed Jul 23 14:19:45 2025 +0200 xfs: remove XFS_IBULK_SAME_AG Add a new field to struct xfs_ibulk to directly pass XFS_IWALK* flags, and thus remove the need to indirect the SAME_AG flag through XFS_IBULK*. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit d2845519b0723c5d5a0266cbf410495f9b8fd65c Author: Christoph Hellwig Date: Wed Jul 23 14:19:44 2025 +0200 xfs: fully decouple XFS_IBULK* flags from XFS_IWALK* flags Fix up xfs_inumbers to now pass in the XFS_IBULK* flags into the flags argument to xfs_inobt_walk, which expects the XFS_IWALK* flags. Currently passing the wrong flags works for non-debug builds because the only XFS_IWALK* flag has the same encoding as the corresponding XFS_IBULK* flag, but in debug builds it can trigger an assert that no incorrect flag is passed. Instead just extra the relevant flag. Fixes: 5b35d922c52798 ("xfs: Decouple XFS_IBULK flags from XFS_IWALK flags") Cc: # v5.19 Reported-by: cen zhang Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 647b3d59c768d7638dd17c78c8044178364383ca Author: Christoph Hellwig Date: Thu Jul 31 07:19:41 2025 -0700 xfs: fix frozen file system assert in xfs_trans_alloc Commit 83a80e95e797 ("xfs: decouple xfs_trans_alloc_empty from xfs_trans_alloc") move the place of the assert for a frozen file system after the sb_start_intwrite call that ensures it doesn't run on frozen file systems, and thus allows to incorrect trigger it. Fix that by moving it back to where it belongs. Fixes: 83a80e95e797 ("xfs: decouple xfs_trans_alloc_empty from xfs_trans_alloc") Reported-by: Dave Chinner Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit a7fc15ed629be89e51e09b743277c53e0a0168f5 Author: Aaron Ma Date: Sun Aug 3 14:57:26 2025 +0800 HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save Improper use of secondary pointer (&dev->i2c_subip_regs) caused kernel crash and out-of-bounds error: BUG: KASAN: slab-out-of-bounds in _regmap_bulk_read+0x449/0x510 Write of size 4 at addr ffff888136005dc0 by task kworker/u33:5/5107 CPU: 3 UID: 0 PID: 5107 Comm: kworker/u33:5 Not tainted 6.16.0+ #3 PREEMPT(voluntary) Workqueue: async async_run_entry_fn Call Trace: dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x660 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x26/0x200 kasan_report+0xe1/0x120 ? _regmap_bulk_read+0x449/0x510 ? _regmap_bulk_read+0x449/0x510 __asan_report_store4_noabort+0x17/0x30 _regmap_bulk_read+0x449/0x510 ? __pfx__regmap_bulk_read+0x10/0x10 regmap_bulk_read+0x270/0x3d0 pio_complete+0x1ee/0x2c0 [intel_thc] ? __pfx_pio_complete+0x10/0x10 [intel_thc] ? __pfx_pio_wait+0x10/0x10 [intel_thc] ? regmap_update_bits_base+0x13b/0x1f0 thc_i2c_subip_pio_read+0x117/0x270 [intel_thc] thc_i2c_subip_regs_save+0xc2/0x140 [intel_thc] ? __pfx_thc_i2c_subip_regs_save+0x10/0x10 [intel_thc] [...] The buggy address belongs to the object at ffff888136005d00 which belongs to the cache kmalloc-rnd-12-192 of size 192 The buggy address is located 0 bytes to the right of allocated 192-byte region [ffff888136005d00, ffff888136005dc0) Replaced with direct array indexing (&dev->i2c_subip_regs[i]) to ensure safe memory access. Fixes: 4228966def884 ("HID: intel-thc-hid: intel-thc: Add THC I2C config interfaces") Signed-off-by: Aaron Ma Reviewed-by: Even Xu Tested-by: Even Xu Signed-off-by: Jiri Kosina commit 1db9df89a213318a48d958385dc1b17b379dc32b Author: Aaron Ma Date: Sun Aug 3 14:57:25 2025 +0800 HID: intel-thc-hid: intel-quicki2c: Fix ACPI dsd ICRS/ISUB length The QuickI2C ACPI _DSD methods return ICRS and ISUB data with a trailing byte, making the actual length is one more byte than the structs defined. It caused stack-out-of-bounds and kernel crash: kernel: BUG: KASAN: stack-out-of-bounds in quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: Write of size 12 at addr ffff888106d1f900 by task kworker/u33:2/75 kernel: kernel: CPU: 3 UID: 0 PID: 75 Comm: kworker/u33:2 Not tainted 6.16.0+ #3 PREEMPT(voluntary) kernel: Workqueue: async async_run_entry_fn kernel: Call Trace: kernel: kernel: dump_stack_lvl+0x76/0xa0 kernel: print_report+0xd1/0x660 kernel: ? __pfx__raw_spin_lock_irqsave+0x10/0x10 kernel: ? __kasan_slab_free+0x5d/0x80 kernel: ? kasan_addr_to_slab+0xd/0xb0 kernel: kasan_report+0xe1/0x120 kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: kasan_check_range+0x11c/0x200 kernel: __asan_memcpy+0x3b/0x80 kernel: quicki2c_acpi_get_dsd_property.constprop.0+0x111/0x1b0 [intel_quicki2c] kernel: ? __pfx_quicki2c_acpi_get_dsd_property.constprop.0+0x10/0x10 [intel_quicki2c] kernel: quicki2c_get_acpi_resources+0x237/0x730 [intel_quicki2c] [...] kernel: kernel: kernel: The buggy address belongs to stack of task kworker/u33:2/75 kernel: and is located at offset 48 in frame: kernel: quicki2c_get_acpi_resources+0x0/0x730 [intel_quicki2c] kernel: kernel: This frame has 3 objects: kernel: [32, 36) 'hid_desc_addr' kernel: [48, 59) 'i2c_param' kernel: [80, 224) 'i2c_config' ACPI DSD methods return: \_SB.PC00.THC0.ICRS Buffer 000000003fdc947b 001 Len 0C = 0A 00 80 1A 06 00 00 00 00 00 00 00 \_SB.PC00.THC0.ISUB Buffer 00000000f2fcbdc4 001 Len 91 = 00 00 00 00 00 00 00 00 00 00 00 00 Adding reserved padding to quicki2c_subip_acpi_parameter/config. Fixes: 5282e45ccbfa9 ("HID: intel-thc-hid: intel-quicki2c: Add THC QuickI2C ACPI interfaces") Signed-off-by: Aaron Ma Reviewed-by: Even Xu Tested-by: Even Xu Signed-off-by: Jiri Kosina commit 1071d560afb4c245c2076494226df47db5a35708 Author: Mikulas Patocka Date: Mon Aug 11 13:17:32 2025 +0200 dm-stripe: fix a possible integer overflow There's a possible integer overflow in stripe_io_hints if we have too large chunk size. Test if the overflow happened, and if it did, don't set limits->io_min and limits->io_opt; Signed-off-by: Mikulas Patocka Reviewed-by: John Garry Suggested-by: Dongsheng Yang Cc: stable@vger.kernel.org commit 2c223f7239f376a90d71903ec474ba887cf21d94 Author: Oreoluwa Babatunde Date: Wed Aug 6 10:24:21 2025 -0700 of: reserved_mem: Restructure call site for dma_contiguous_early_fixup() Restructure the call site for dma_contiguous_early_fixup() to where the reserved_mem nodes are being parsed from the DT so that dma_mmu_remap[] is populated before dma_contiguous_remap() is called. Fixes: 8a6e02d0c00e ("of: reserved_mem: Restructure how the reserved memory regions are processed") Signed-off-by: Oreoluwa Babatunde Tested-by: William Zhang Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20250806172421.2748302-1-oreoluwa.babatunde@oss.qualcomm.com commit b6bcbce3359619d05bf387d4f5cc3af63668dbaa Author: Jon Hunter Date: Thu Jul 31 13:18:32 2025 +0100 soc/tegra: pmc: Ensure power-domains are in a known state After commit 13a4b7fb6260 ("pmdomain: core: Leave powered-on genpds on until late_initcall_sync") was applied, the Tegra210 Jetson TX1 board failed to boot. Looking into this issue, before this commit was applied, if any of the Tegra power-domains were in 'on' state when the kernel booted, they were being turned off by the genpd core before any driver had chance to request them. This was purely by luck and a consequence of the power-domains being turned off earlier during boot. After this commit was applied, any power-domains in the 'on' state are kept on for longer during boot and therefore, may never transitioned to the off state before they are requested/used. The hang on the Tegra210 Jetson TX1 is caused because devices in some power-domains are accessed without the power-domain being turned off and on, indicating that the power-domain is not in a completely on state. >From reviewing the Tegra PMC driver code, if a power-domain is in the 'on' state there is no guarantee that all the necessary clocks associated with the power-domain are on and even if they are they would not have been requested via the clock framework and so could be turned off later. Some power-domains also have a 'clamping' register that needs to be configured as well. In short, if a power-domain is already 'on' it is difficult to know if it has been configured correctly. Given that the power-domains happened to be switched off during boot previously, to ensure that they are in a good known state on boot, fix this by switching off any power-domains that are on initially when registering the power-domains with the genpd framework. Note that commit 05cfb988a4d0 ("soc/tegra: pmc: Initialise resets associated with a power partition") updated the tegra_powergate_of_get_resets() function to pass the 'off' to ensure that the resets for the power-domain are in the correct state on boot. However, now that we may power off a domain on boot, if it is on, it is better to move this logic into the tegra_powergate_add() function so that there is a single place where we are handling the initial state of the power-domain. Fixes: a38045121bf4 ("soc/tegra: pmc: Add generic PM domain support") Signed-off-by: Jon Hunter Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250731121832.213671-1-jonathanh@nvidia.com Signed-off-by: Ulf Hansson commit 0db77eccd964b11ab2b757031d1354fcc5a025ea Author: Christopher Eby Date: Sat Aug 9 20:00:06 2025 -0700 ALSA: hda/realtek: Add Framework Laptop 13 (AMD Ryzen AI 300) to quirks Framework Laptop 13 (AMD Ryzen AI 300) requires the same quirk for headset detection as other Framework 13 models. Signed-off-by: Christopher Eby Cc: Link: https://patch.msgid.link/20250810030006.9060-1-kreed@kreed.org Signed-off-by: Takashi Iwai commit d1f9c497618dece06a00e0b2995ed6b38fafe6b5 Author: Peter Robinson Date: Wed Jul 30 11:21:26 2025 +0100 arm64: dts: rockchip: Add vcc-supply to SPI flash on rk3399-pinebook-pro As described in the pinebookpro_v2.1_mainboard_schematic.pdf page 10, he SPI Flash's VCC connector is connected to VCC_3V0 power source. This fixes the following warning: spi-nor spi1.0: supply vcc not found, using dummy regulator Fixes: 5a65505a69884 ("arm64: dts: rockchip: Add initial support for Pinebook Pro") Signed-off-by: Peter Robinson Reviewed-by: Dragan Simic Link: https://lore.kernel.org/r/20250730102129.224468-1-pbrobinson@gmail.com Signed-off-by: Heiko Stuebner commit f18c9e79bbe65627805fff6aac3ea96b6b55b53d Author: Chukun Pan Date: Sun Aug 10 18:00:19 2025 +0800 arm64: dts: rockchip: mark eeprom as read-only for Radxa E52C The eeprom on the Radxa E52C SBC contains manufacturer data such as the mac address, so it should be marked as read-only. Fixes: 9be4171219b6 ("arm64: dts: rockchip: Add Radxa E52C") Signed-off-by: Chukun Pan Link: https://lore.kernel.org/r/20250810100020.445053-2-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 5068b5254812433e841a40886e695633148d362d Author: Stephan Gerhold Date: Wed Feb 12 18:03:54 2025 +0100 dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees When we don't have a clock specified in the device tree, we have no way to ensure the BAM is on. This is often the case for remotely-controlled or remotely-powered BAM instances. In this case, we need to read num-channels from the DT to have all the necessary information to complete probing. However, at the moment invalid device trees without clock and without num-channels still continue probing, because the error handling is missing return statements. The driver will then later try to read the number of channels from the registers. This is unsafe, because it relies on boot firmware and lucky timing to succeed. Unfortunately, the lack of proper error handling here has been abused for several Qualcomm SoCs upstream, causing early boot crashes in several situations [1, 2]. Avoid these early crashes by erroring out when any of the required DT properties are missing. Note that this will break some of the existing DTs upstream (mainly BAM instances related to the crypto engine). However, clearly these DTs have never been tested properly, since the error in the kernel log was just ignored. It's safer to disable the crypto engine for these broken DTBs. [1]: https://lore.kernel.org/r/CY01EKQVWE36.B9X5TDXAREPF@fairphone.com/ [2]: https://lore.kernel.org/r/20230626145959.646747-1-krzysztof.kozlowski@linaro.org/ Cc: stable@vger.kernel.org Fixes: 48d163b1aa6e ("dmaengine: qcom: bam_dma: get num-channels and num-ees from dt") Signed-off-by: Stephan Gerhold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250212-bam-dma-fixes-v1-8-f560889e65d8@linaro.org Signed-off-by: Vinod Koul commit 22571172257a55c443f1a9306e963da4c6187e83 Author: Stephan Gerhold Date: Wed Feb 12 18:03:53 2025 +0100 dt-bindings: dma: qcom: bam-dma: Add missing required properties num-channels and qcom,num-ees are required when there are no clocks specified in the device tree, because we have no reliable way to read them from the hardware registers if we cannot ensure the BAM hardware is up when the device is being probed. This has often been forgotten when adding new SoC device trees, so make this clear by describing this requirement in the schema. Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250212-bam-dma-fixes-v1-7-f560889e65d8@linaro.org Signed-off-by: Vinod Koul commit 61399e0c5410567ef60cb1cda34cca42903842e3 Author: Frederic Weisbecker Date: Fri Aug 8 19:03:22 2025 +0200 rcu: Fix racy re-initialization of irq_work causing hangs RCU re-initializes the deferred QS irq work everytime before attempting to queue it. However there are situations where the irq work is attempted to be queued even though it is already queued. In that case re-initializing messes-up with the irq work queue that is about to be handled. The chances for that to happen are higher when the architecture doesn't support self-IPIs and irq work are then all lazy, such as with the following sequence: 1) rcu_read_unlock() is called when IRQs are disabled and there is a grace period involving blocked tasks on the node. The irq work is then initialized and queued. 2) The related tasks are unblocked and the CPU quiescent state is reported. rdp->defer_qs_iw_pending is reset to DEFER_QS_IDLE, allowing the irq work to be requeued in the future (note the previous one hasn't fired yet). 3) A new grace period starts and the node has blocked tasks. 4) rcu_read_unlock() is called when IRQs are disabled again. The irq work is re-initialized (but it's queued! and its node is cleared) and requeued. Which means it's requeued to itself. 5) The irq work finally fires with the tick. But since it was requeued to itself, it loops and hangs. Fix this with initializing the irq work only once before the CPU boots. Fixes: b41642c87716 ("rcu: Fix rcu_read_unlock() deadloop due to IRQ work") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202508071303.c1134cce-lkp@intel.com Signed-off-by: Frederic Weisbecker Reviewed-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 25daf9af0ac1bf12490b723b5efaf8dcc85980bc Author: Bjorn Andersson Date: Wed Jul 30 15:51:51 2025 -0500 soc: qcom: mdt_loader: Deal with zero e_shentsize Firmware that doesn't provide section headers leave both e_shentsize and e_shnum 0, which obvious isn't compatible with the newly introduced stricter checks. Make the section-related checks conditional on either of these values being non-zero. Fixes: 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read past the ELF header") Reported-by: Val Packett Closes: https://lore.kernel.org/all/ece307c3-7d65-440f-babd-88cf9705b908@packett.cool/ Reported-by: Neil Armstrong Closes: https://lore.kernel.org/all/aec9cd03-6fc2-4dc8-b937-8b7cf7bf4128@linaro.org/ Signed-off-by: Bjorn Andersson Fixes: 9f35ab0e53cc ("soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()") Tested-by: Neil Armstrong # on SM8650-QRD Reviewed-by: Dmitry Baryshkov Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250730-mdt-loader-shentsize-zero-v1-1-04f43186229c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 0b96d9bed324a1c1b7d02bfb9596351ef178428d Author: Gao Xiang Date: Thu Aug 7 16:20:19 2025 +0800 erofs: fix block count report when 48-bit layout is on Fix incorrect shift order when combining the 48-bit block count. Fixes: 2e1473d5195f ("erofs: implement 48-bit block addressing for unencoded inodes") Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250807082019.3093539-1-hsiangkao@linux.alibaba.com commit c99fab6e80b76422741d34aafc2f930a482afbdd Author: Junli Liu Date: Tue Aug 5 09:19:58 2025 +0800 erofs: fix atomic context detection when !CONFIG_DEBUG_LOCK_ALLOC Since EROFS handles decompression in non-atomic contexts due to uncontrollable decompression latencies and vmap() usage, it tries to detect atomic contexts and only kicks off a kworker on demand in order to reduce unnecessary scheduling overhead. However, the current approach is insufficient and can lead to sleeping function calls in invalid contexts, causing kernel warnings and potential system instability. See the stacktrace [1] and previous discussion [2]. The current implementation only checks rcu_read_lock_any_held(), which behaves inconsistently across different kernel configurations: - When CONFIG_DEBUG_LOCK_ALLOC is enabled: correctly detects RCU critical sections by checking rcu_lock_map - When CONFIG_DEBUG_LOCK_ALLOC is disabled: compiles to "!preemptible()", which only checks preempt_count and misses RCU critical sections This patch introduces z_erofs_in_atomic() to provide comprehensive atomic context detection: 1. Check RCU preemption depth when CONFIG_PREEMPTION is enabled, as RCU critical sections may not affect preempt_count but still require atomic handling 2. Always use async processing when CONFIG_PREEMPT_COUNT is disabled, as preemption state cannot be reliably determined 3. Fall back to standard preemptible() check for remaining cases The function replaces the previous complex condition check and ensures that z_erofs always uses (kthread_)work in atomic contexts to minimize scheduling overhead and prevent sleeping in invalid contexts. [1] Problem stacktrace [ 61.266692] BUG: sleeping function called from invalid context at kernel/locking/rtmutex_api.c:510 [ 61.266702] in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 107, name: irq/54-ufshcd [ 61.266704] preempt_count: 0, expected: 0 [ 61.266705] RCU nest depth: 2, expected: 0 [ 61.266710] CPU: 0 UID: 0 PID: 107 Comm: irq/54-ufshcd Tainted: G W O 6.12.17 #1 [ 61.266714] Tainted: [W]=WARN, [O]=OOT_MODULE [ 61.266715] Hardware name: schumacher (DT) [ 61.266717] Call trace: [ 61.266718] dump_backtrace+0x9c/0x100 [ 61.266727] show_stack+0x20/0x38 [ 61.266728] dump_stack_lvl+0x78/0x90 [ 61.266734] dump_stack+0x18/0x28 [ 61.266736] __might_resched+0x11c/0x180 [ 61.266743] __might_sleep+0x64/0xc8 [ 61.266745] mutex_lock+0x2c/0xc0 [ 61.266748] z_erofs_decompress_queue+0xe8/0x978 [ 61.266753] z_erofs_decompress_kickoff+0xa8/0x190 [ 61.266756] z_erofs_endio+0x168/0x288 [ 61.266758] bio_endio+0x160/0x218 [ 61.266762] blk_update_request+0x244/0x458 [ 61.266766] scsi_end_request+0x38/0x278 [ 61.266770] scsi_io_completion+0x4c/0x600 [ 61.266772] scsi_finish_command+0xc8/0xe8 [ 61.266775] scsi_complete+0x88/0x148 [ 61.266777] blk_mq_complete_request+0x3c/0x58 [ 61.266780] scsi_done_internal+0xcc/0x158 [ 61.266782] scsi_done+0x1c/0x30 [ 61.266783] ufshcd_compl_one_cqe+0x12c/0x438 [ 61.266786] __ufshcd_transfer_req_compl+0x2c/0x78 [ 61.266788] ufshcd_poll+0xf4/0x210 [ 61.266789] ufshcd_transfer_req_compl+0x50/0x88 [ 61.266791] ufshcd_intr+0x21c/0x7c8 [ 61.266792] irq_forced_thread_fn+0x44/0xd8 [ 61.266796] irq_thread+0x1a4/0x358 [ 61.266799] kthread+0x12c/0x138 [ 61.266802] ret_from_fork+0x10/0x20 [2] https://lore.kernel.org/r/58b661d0-0ebb-4b45-a10d-c5927fb791cd@paulmck-laptop Signed-off-by: Junli Liu Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/20250805011957.911186-1-liujunli@lixiang.com [ Gao Xiang: Use the original trace in v1. ] Signed-off-by: Gao Xiang commit 74da24f0ac9b8aabfb8d7feeba6c32ddff3065e0 Author: Geert Uytterhoeven Date: Wed Jul 30 14:44:49 2025 +0200 erofs: Do not select tristate symbols from bool symbols The EROFS filesystem has many configurable options, controlled through boolean Kconfig symbols. When enabled, these options may need to enable additional library functionality elsewhere. Currently this is done by selecting the symbol for the additional functionality. However, if EROFS_FS itself is modular, and the target symbol is a tristate symbol, the additional functionality is always forced built-in. Selecting tristate symbols from a tristate symbol does keep modular transitivity. Hence fix this by moving selects of tristate symbols to the main EROFS_FS symbol. Signed-off-by: Geert Uytterhoeven Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/da1b899e511145dd43fd2d398f64b2e03c6a39e7.1753879351.git.geert+renesas@glider.be Signed-off-by: Gao Xiang commit c6993c4cb91803fceb82d6b5e0ec5e0aec2d0ad6 Author: Yuezhang Mo Date: Mon Aug 4 16:20:31 2025 +0800 erofs: Fallback to normal access if DAX is not supported on extra device If using multiple devices, we should check if the extra device support DAX instead of checking the primary device when deciding if to use DAX to access a file. If an extra device does not support DAX we should fallback to normal access otherwise the data on that device will be inaccessible. Signed-off-by: Yuezhang Mo Reviewed-by: Friendy Su Reviewed-by: Jacky Cao Reviewed-by: Daniel Palmer Reviewed-by: Gao Xiang Reviewed-by: Hongbo Li Link: https://lore.kernel.org/r/20250804082030.3667257-2-Yuezhang.Mo@sony.com Signed-off-by: Gao Xiang commit b11f2a9745401d9ccc51c91b5482044d2ea936e8 Author: Colin Ian King Date: Fri Aug 8 11:49:43 2025 +0100 ASoC: tas2781: Fix spelling mistake "dismatch" -> "mismatch" There is a spelling mistake (or neologism of dis and match) in a dev_err message. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250808104943.829668-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit f48d7a1b0bf11d16d8c9f77a5b9c80a82272f625 Author: Shuming Fan Date: Thu Aug 7 17:24:32 2025 +0800 ASoC: rt1320: fix random cycle mute issue This patch fixed the random cycle mute issue that occurs during long-time playback. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20250807092432.997989-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 633e391d45bda3fc848d26bee6bbe57ef2935713 Author: Shuming Fan Date: Fri Aug 8 13:57:06 2025 +0800 ASoC: rt721: fix FU33 Boost Volume control not working This patch fixed FU33 Boost Volume control not working. Signed-off-by: Shuming Fan Link: https://patch.msgid.link/20250808055706.1110766-1-shumingf@realtek.com Signed-off-by: Mark Brown commit f13ab498726bb6c636d6c5cd8c7df911444316dc Author: Kuninori Morimoto Date: Wed Aug 6 23:34:52 2025 +0000 ASoC: generic: tidyup standardized ASoC menu for generic commit acc84d15e45393fb ("ASoC: generic: Standardize ASoC menu") standardized ASoC generic menu. Then, it moved generic menu position under SoC group. It should be kept generic position. Tidyup it. Suggested-by: Geert Uytterhoeven Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87v7n0c9d0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7cdadac0d2b3614d04651be7104a89a1998efec0 Author: Colin Ian King Date: Fri Aug 8 11:53:24 2025 +0100 ASoC: codec: sma1307: replace spelling mistake with new error message There is a spelling mistake in a failure message, replace the message with something a little more meaningful. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250808105324.829883-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit 43e0da37d5cfb23eec6aeee9422f84d86621ce2b Author: Alexey Klimov Date: Wed Aug 6 15:00:30 2025 +0100 ASoC: codecs: tx-macro: correct tx_macro_component_drv name We already have a component driver named "RX-MACRO", which is lpass-rx-macro.c. The tx macro component driver's name should be "TX-MACRO" accordingly. Fix it. Cc: Srinivas Kandagatla Signed-off-by: Alexey Klimov Reviewed-by: Neil Armstrong Link: https://patch.msgid.link/20250806140030.691477-1-alexey.klimov@linaro.org Signed-off-by: Mark Brown commit 0e270f32975fd21874185ba53653630dd40bf560 Author: Shengjiu Wang Date: Thu Aug 7 10:03:18 2025 +0800 ASoC: fsl_sai: replace regmap_write with regmap_update_bits Use the regmap_write() for software reset in fsl_sai_config_disable would cause the FSL_SAI_CSR_BCE bit to be cleared. Refer to commit 197c53c8ecb34 ("ASoC: fsl_sai: Don't disable bitclock for i.MX8MP") FSL_SAI_CSR_BCE should not be cleared. So need to use regmap_update_bits() instead of regmap_write() for these bit operations. Fixes: dc78f7e59169d ("ASoC: fsl_sai: Force a software reset when starting in consumer mode") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20250807020318.2143219-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit d84291fc7453df7881a970716f8256273aca5747 Author: Paulo Alcantara Date: Fri Aug 8 11:43:29 2025 -0300 smb: client: fix race with concurrent opens in rename(2) Besides sending the rename request to the server, the rename process also involves closing any deferred close, waiting for outstanding I/O to complete as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens on the target file. Fix this by unhashing the dentry in advance to prevent any concurrent opens on the target. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: Al Viro Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 0af1561b2d60bab2a2b00720a5c7b292ecc549ec Author: Paulo Alcantara Date: Fri Aug 8 12:20:17 2025 -0300 smb: client: fix race with concurrent opens in unlink(2) According to some logs reported by customers, CIFS client might end up reporting unlinked files as existing in stat(2) due to concurrent opens racing with unlink(2). Besides sending the removal request to the server, the unlink process could involve closing any deferred close as well as marking all existing open handles as deleted to prevent them from deferring closes, which increases the race window for potential concurrent opens. Fix this by unhashing the dentry in cifs_unlink() to prevent any subsequent opens. Any open attempts, while we're still unlinking, will block on parent's i_rwsem. Reported-by: Jay Shin Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Cc: Al Viro Cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit eb5ca9094a18fb98777bf4814ea84c93bf7c271d Author: Danilo Krummrich Date: Sun Jul 27 12:59:06 2025 +0200 mm/vmscan: fix inverted polarity in lru_gen_seq_show() Commit a7694ff11aa9 ("vmscan: don't bother with debugfs_real_fops()") started using debugfs_get_aux_num() to distinguish between the RW "lru_gen" and the RO "lru_gen_full" file [1]. Willy reported the inverted polarity [2] and Al fixed it up in [3]. However, the patch in [1] was applied. Hence, fix this up accordingly. Cc: Alexander Viro Cc: Matthew Wilcox Cc: Greg Kroah-Hartman Link: https://lore.kernel.org/all/20250704040720.GP1880847@ZenIV/ [1] Link: https://lore.kernel.org/all/aGZu3Z730FQtqxsE@casper.infradead.org/ [2] Link: https://lore.kernel.org/all/20250704040720.GP1880847@ZenIV/ [3] Fixes: a7694ff11aa9 ("vmscan: don't bother with debugfs_real_fops()") Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250727105937.7480-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 8f5ae30d69d7543eee0d70083daf4de8fe15d585 Author: Linus Torvalds Date: Sun Aug 10 19:41:16 2025 +0300 Linux 6.17-rc1 commit 2b38afce25c4e1b8f943ff4f0a2b51d6c40f2ed2 Merge: b96ddbc5c88791 5e98a5e73edcc4 Author: Linus Torvalds Date: Sun Aug 10 09:02:36 2025 +0300 Merge tag 'turbostat-2025.09.09' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux Pull turbostat updates from Len Brown: "tools/power turbostat: version 2025.09.09 - Probe and display L3 Cache topology - Add ability to average an added counter (useful for pre-integrated "counters", such as Watts) - Break the limit of 64 built-in counters - Assorted bug fixes and minor feature tweaks" * tag 'turbostat-2025.09.09' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux: tools/power turbostat: version 2025.09.09 tools/power turbostat: Handle non-root legacy-uncore sysfs permissions tools/power turbostat: standardize PER_THREAD_PARAMS tools/power turbostat: Fix DMR support tools/power turbostat: add format "average" for external attributes tools/power turbostat: delete GET_PKG() tools/power turbostat: probe and display L3 cache topology tools/power turbostat: Support more than 64 built-in-counters tools/power turbostat.8: Document Totl%C0, Any%C0, GFX%C0, CPUGFX% columns tools/power turbostat: Fix bogus SysWatt for forked program tools/power turbostat: Handle cap_get_proc() ENOSYS tools/power turbostat: Fix build with musl tools/power turbostat: verify arguments to params --show and --hide tools/power turbostat: regression fix: --show C1E% commit b96ddbc5c88791260ab202e835425dfddbdd60d9 Merge: 7d2fed1f3ce46f da274853fe7dbc Author: Linus Torvalds Date: Sun Aug 10 08:51:37 2025 +0300 Merge tag 'smp_urgent_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull smp fixes from Borislav Petkov: - Remove an obsolete comment and fix spelling * tag 'smp_urgent_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: cpu: Remove obsolete comment from takedown_cpu() smp: Fix spelling in on_each_cpu_cond_mask()'s doc-comment commit 7d2fed1f3ce46f7b161e33626b2cffedfa21767f Merge: acaa21a26f2ffa 9f7488f24c7571 Author: Linus Torvalds Date: Sun Aug 10 08:46:47 2025 +0300 Merge tag 'irq_urgent_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq fixes from Borislav Petkov: - Fix a wrong ioremap size in mvebu-gicp - Remove yet another compile-test case for a driver which needs an additional dependency - Fix a lock inversion scenario in the IRQ unit test suite - Remove an impossible flag situation in gic-v5 - Do not iounmap resources in gic-v5 which are managed by devm - Make sure stale, left-over interrupts in mvebu-gicp are cleared on driver init - Fix a reference counting mishap in msi-lib - Fix a dereference-before-null-ptr-check case in the riscv-imsic irqchip driver * tag 'irq_urgent_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: irqchip/mvebu-gicp: Use resource_size() for ioremap() irqchip: Build IMX_MU_MSI only on ARM genirq/test: Resolve irq lock inversion warnings irqchip/gic-v5: Remove IRQD_RESEND_WHEN_IN_PROGRESS for ITS IRQs irqchip/gic-v5: iwb: Fix iounmap probe failure path irqchip/mvebu-gicp: Clear pending interrupts on init irqchip/msi-lib: Fix fwnode refcount in msi_lib_irq_domain_select() irqchip/riscv-imsic: Don't dereference before NULL pointer check commit acaa21a26f2ffa400aa77423403b357b871dbc28 Merge: 8e8f6b635fae25 ce0b5eedcb7536 Author: Linus Torvalds Date: Sun Aug 10 08:15:32 2025 +0300 Merge tag 'x86_urgent_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Borislav Petkov: - Fix an interrupt vector setup race which leads to a non-functioning device - Add new Intel CPU models *and* a family: 0x12. Finally. Yippie! :-) * tag 'x86_urgent_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/irq: Plug vector setup race x86/cpu: Add new Intel CPU model numbers for Wildcatlake and Novalake commit 8e8f6b635fae254252f7f52dd3e79fb68d06c332 Merge: 561c80369df073 e703b7e247503b Author: Linus Torvalds Date: Sun Aug 10 08:11:39 2025 +0300 Merge tag 'locking_urgent_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking fix from Borislav Petkov: - Prevent a futex hash leak due to different mm lifetimes * tag 'locking_urgent_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: futex: Move futex cleanup to __mmdrop() commit 5e98a5e73edcc4114c5ad10596db87e24f50ee4d Author: Len Brown Date: Sat Aug 9 21:08:26 2025 -0400 tools/power turbostat: version 2025.09.09 Probe and display L3 Cache topology Add ability to average an added counter (useful for pre-integrated "counters", such as Watts) Break the limit of 64 built-in counters. Assorted bug fixes and minor feature tweaks Signed-off-by: Len Brown commit e60a13bcef206795d3ddf82f130fe8f570176d06 Author: Len Brown Date: Sat Aug 9 16:31:31 2025 -0400 tools/power turbostat: Handle non-root legacy-uncore sysfs permissions /sys/devices/system/cpu/intel_uncore_frequency/package_X_die_Y/ may be readable by all, but /sys/devices/system/cpu/intel_uncore_frequency/package_X_die_Y/current_freq_khz may be readable only by root. Non-root turbostat users see complaints in this scenario. Fail probe of the interface if we can't read current_freq_khz. Reported-by: Artem Bityutskiy Original-patch-by: Zhang Rui Signed-off-by: Len Brown commit 378e901160256d2ab66e45ffb97afaca51e65706 Author: Len Brown Date: Fri Aug 8 19:30:07 2025 -0400 tools/power turbostat: standardize PER_THREAD_PARAMS use a macro for PER_THREAD_PARAMS to make adding one later more clear. no functional change Signed-off-by: Len Brown commit 3a088b07c4f10bf577f4a2392111704195a794ba Author: Zhang Rui Date: Wed Jun 11 14:50:26 2025 +0800 tools/power turbostat: Fix DMR support Together with the RAPL MSRs, there are more MSRs gone on DMR, including PLR (Perf Limit Reasons), and IRTL (Package cstate Interrupt Response Time Limit) MSRs. The configurable TDP info should also be retrieved from TPMI based Intel Speed Select Technology feature. Remove the access of these MSRs for DMR. Improve the DMR platform feature table to make it more readable at the same time. Fixes: 83075bd59de2 ("tools/power turbostat: Add initial support for DMR") Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit dcd1c379b0f179763956e8596ad99912165a95ec Author: Michael Hebenstreit Date: Fri Aug 8 15:57:53 2025 -0400 tools/power turbostat: add format "average" for external attributes External atributes with format "raw" are not printed in summary lines for nodes/packages (or with option -S). The new format "average" behaves like "raw" but also adds the summary data Signed-off-by: Michael Hebenstreit Signed-off-by: Len Brown commit a5015d945de6003cf813af2bb11189982f5b3d54 Author: Len Brown Date: Tue Jul 22 00:17:04 2025 -0400 tools/power turbostat: delete GET_PKG() pkg_base[pkg_id] is a simple array of structure pointers, let the compiler treat it that way. Signed-off-by: Len Brown commit 5f961fb2a7d8f4d89d64a9e2cd584738de5f9c58 Author: Len Brown Date: Mon Jul 14 23:33:55 2025 -0400 tools/power turbostat: probe and display L3 cache topology Signed-off-by: Len Brown commit 8d14a098b47cc7e5cfa703b9e015d6ca1074489a Author: Len Brown Date: Sat Jul 12 16:16:56 2025 -0400 tools/power turbostat: Support more than 64 built-in-counters We have out-grown the ability to use a 64-bit memory location to inventory every possible built-in counter. Leverage the the CPU_SET(3) macros to break this barrier. Also, break the Joules & Watts counters into two, since we can no longer 'or' them together... Signed-off-by: Len Brown commit eea51c6e3f6675b795f6439eaa960eb2948d6905 Author: JP Kobryn Date: Wed Aug 6 17:33:50 2025 -0700 cgroup: avoid null de-ref in css_rstat_exit() css_rstat_exit() may be called asynchronously in scenarios where preceding calls to css_rstat_init() have not completed. One such example is this sequence below: css_create(...) { ... init_and_link_css(css, ...); err = percpu_ref_init(...); if (err) goto err_free_css; err = cgroup_idr_alloc(...); if (err) goto err_free_css; err = css_rstat_init(css, ...); if (err) goto err_free_css; ... err_free_css: INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn); queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork); return ERR_PTR(err); } If any of the three goto jumps are taken, async cleanup will begin and css_rstat_exit() will be invoked on an uninitialized css->rstat_cpu. Avoid accessing the unitialized field by returning early in css_rstat_exit() if this is the case. Signed-off-by: JP Kobryn Suggested-by: Michal Koutný Fixes: 5da3bfa029d68 ("cgroup: use separate rstat trees for each subsystem") Cc: stable@vger.kernel.org # v6.16 Reported-by: syzbot+8d052e8b99e40bc625ed@syzkaller.appspotmail.com Acked-by: Shakeel Butt Signed-off-by: Tejun Heo commit 87eba5bc5ab1d99e31c9d3b2c386187da94a5ab1 Author: Waiman Long Date: Wed Aug 6 13:24:30 2025 -0400 cgroup/cpuset: Remove the unnecessary css_get/put() in cpuset_partition_write() The css_get/put() calls in cpuset_partition_write() are unnecessary as an active reference of the kernfs node will be taken which will prevent its removal and guarantee the existence of the css. Only the online check is needed. Signed-off-by: Waiman Long Reviewed-by: Michal Koutný Signed-off-by: Tejun Heo commit 150e298ae0ccbecff2357a72fbabd80f8849ea6e Author: Waiman Long Date: Wed Aug 6 13:24:29 2025 -0400 cgroup/cpuset: Fix a partition error with CPU hotplug It was found during testing that an invalid leaf partition with an empty effective exclusive CPU list can become a valid empty partition with no CPU afer an offline/online operation of an unrelated CPU. An empty partition root is allowed in the special case that it has no task in its cgroup and has distributed out all its CPUs to its child partitions. That is certainly not the case here. The problem is in the cpumask_subsets() test in the hotplug case (update with no new mask) of update_parent_effective_cpumask() as it also returns true if the effective exclusive CPU list is empty. Fix that by addding the cpumask_empty() test to root out this exception case. Also add the cpumask_empty() test in cpuset_hotplug_update_tasks() to avoid calling update_parent_effective_cpumask() for this special case. Fixes: 0c7f293efc87 ("cgroup/cpuset: Add cpuset.cpus.exclusive.effective for v2") Signed-off-by: Waiman Long Signed-off-by: Tejun Heo commit 65f97cc81b0adc5f49cf6cff5d874be0058e3f41 Author: Waiman Long Date: Wed Aug 6 13:24:28 2025 -0400 cgroup/cpuset: Use static_branch_enable_cpuslocked() on cpusets_insane_config_key The following lockdep splat was observed. [ 812.359086] ============================================ [ 812.359089] WARNING: possible recursive locking detected [ 812.359097] -------------------------------------------- [ 812.359100] runtest.sh/30042 is trying to acquire lock: [ 812.359105] ffffffffa7f27420 (cpu_hotplug_lock){++++}-{0:0}, at: static_key_enable+0xe/0x20 [ 812.359131] [ 812.359131] but task is already holding lock: [ 812.359134] ffffffffa7f27420 (cpu_hotplug_lock){++++}-{0:0}, at: cpuset_write_resmask+0x98/0xa70 : [ 812.359267] Call Trace: [ 812.359272] [ 812.359367] cpus_read_lock+0x3c/0xe0 [ 812.359382] static_key_enable+0xe/0x20 [ 812.359389] check_insane_mems_config.part.0+0x11/0x30 [ 812.359398] cpuset_write_resmask+0x9f2/0xa70 [ 812.359411] cgroup_file_write+0x1c7/0x660 [ 812.359467] kernfs_fop_write_iter+0x358/0x530 [ 812.359479] vfs_write+0xabe/0x1250 [ 812.359529] ksys_write+0xf9/0x1d0 [ 812.359558] do_syscall_64+0x5f/0xe0 Since commit d74b27d63a8b ("cgroup/cpuset: Change cpuset_rwsem and hotplug lock order"), the ordering of cpu hotplug lock and cpuset_mutex had been reversed. That patch correctly used the cpuslocked version of the static branch API to enable cpusets_pre_enable_key and cpusets_enabled_key, but it didn't do the same for cpusets_insane_config_key. The cpusets_insane_config_key can be enabled in the check_insane_mems_config() which is called from update_nodemask() or cpuset_hotplug_update_tasks() with both cpu hotplug lock and cpuset_mutex held. Deadlock can happen with a pending hotplug event that tries to acquire the cpu hotplug write lock which will block further cpus_read_lock() attempt from check_insane_mems_config(). Fix that by switching to use static_branch_enable_cpuslocked(). Fixes: d74b27d63a8b ("cgroup/cpuset: Change cpuset_rwsem and hotplug lock order") Signed-off-by: Waiman Long Reviewed-by: Juri Lelli Signed-off-by: Tejun Heo commit d240b441b5cbb389f90fce37edb9ef76a3c9a42b Author: Len Brown Date: Mon Jun 23 13:24:25 2025 -0700 tools/power turbostat.8: Document Totl%C0, Any%C0, GFX%C0, CPUGFX% columns Explain the meaning of the Totl%C0, Any%C0, GFX%C0, CPUGFX% columns. Signed-off-by: Len Brown commit 561c80369df0733ba0574882a1635287b20f9de2 Merge: 402e262d77cd8b 55a984928bfa30 Author: Linus Torvalds Date: Sat Aug 9 18:12:23 2025 +0300 Merge tag 'tty-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull TTY fix from Greg KH: "Here is a single revert of one of the previous patches that went in the last tty/serial merge that is breaking userspace on some platforms (specifically powerpc, probably a few others.) It accidentially changed the ioctl values of some tty ioctls, which breaks xorg. The revert has been in linux-next all this week with no reported issues" * tag 'tty-6.16-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: Revert "tty: vt: use _IO() to define ioctl numbers" commit 402e262d77cd8b075a56809e30e6903ef648ad1a Merge: c30a13538d9f8b 02eb7a8eee20b9 Author: Linus Torvalds Date: Sat Aug 9 18:10:01 2025 +0300 Merge tag 'efi-next-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - Expose the OVMF firmware debug log via sysfs - Lower the default log level for the EFI stub to avoid corrupting any splash screens with unimportant diagnostic output * tag 'efi-next-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi: add API doc entry for ovmf_debug_log efistub: Lower default log level efi: add ovmf debug log driver commit 01c2afe7358385a5381835293dfb6901f11b1691 Author: Madhur Kumar Date: Fri Aug 8 13:08:40 2025 +0530 drm/nouveau: fix typos in comments Fixed three spelling mistakes in nouveau_exec.c comments: - alloctor -> allocator - exectued -> executed - depent -> depend No functional changes. Fixes: b88baab82871 ("drm/nouveau: implement new VM_BIND uAPI") Signed-off-by: Madhur Kumar Link: https://lore.kernel.org/r/20250808073840.376764-1-madhurkumar004@gmail.com Signed-off-by: Danilo Krummrich commit bb8aeaa3191b617c6faf8ae937252e059673b7ea Author: Fanhua Li Date: Mon Jul 28 19:50:27 2025 +0800 drm/nouveau/nvif: Fix potential memory leak in nvif_vmm_ctor(). When the nvif_vmm_type is invalid, we will return error directly without freeing the args in nvif_vmm_ctor(), which leading a memory leak. Fix it by setting the ret -EINVAL and goto done. Reported-by: kernel test robot Closes: https://lore.kernel.org/all/202312040659.4pJpMafN-lkp@intel.com/ Fixes: 6b252cf42281 ("drm/nouveau: nvkm/vmm: implement raw ops to manage uvmm") Signed-off-by: Fanhua Li Link: https://lore.kernel.org/r/20250728115027.50878-1-lifanhua5@huawei.com Signed-off-by: Danilo Krummrich commit c30a13538d9f8b2a60b2f6b26abe046dea10aa12 Merge: 2988dfed8a5dc7 0e260fc798bfef Author: Linus Torvalds Date: Sat Aug 9 09:03:21 2025 +0300 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix memory leak of bpf_scc_info objects (Eduard Zingerman) - Fix a regression in the 'perf' tool caused by moving UID filtering to BPF (Ilya Leoshkevich) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: perf bpf-filter: Enable events manually libbpf: Add the ability to suppress perf event enablement bpf: Fix memory leak of bpf_scc_info objects commit 2988dfed8a5dc752921a5790b81c06e781af51ce Merge: 24bbfb8920d417 45fa9f97e65231 Author: Linus Torvalds Date: Sat Aug 9 08:47:28 2025 +0300 Merge tag 'block-6.17-20250808' of git://git.kernel.dk/linux Pull more block updates from Jens Axboe: - MD pull request via Yu: - mddev null-ptr-dereference fix, by Erkun - md-cluster fail to remove the faulty disk regression fix, by Heming - minor cleanup, by Li Nan and Jinchao - mdadm lifetime regression fix reported by syzkaller, by Yu Kuai - MD pull request via Christoph - add support for getting the FDP featuee in fabrics passthru path (Nitesh Shetty) - add capability to connect to an administrative controller (Kamaljit Singh) - fix a leak on sgl setup error (Keith Busch) - initialize discovery subsys after debugfs is initialized (Mohamed Khalfella) - fix various comment typos (Bjorn Helgaas) - remove unneeded semicolons (Jiapeng Chong) - nvmet debugfs ordering issue fix - Fix UAF in the tag_set in zloop - Ensure sbitmap shallow depth covers entire set - Reduce lock roundtrips in io context lookup - Move scheduler tags alloc/free out of elevator and freeze lock, to fix some lockdep found issues - Improve robustness of queue limits checking - Fix a regression with IO priorities, if no io context exists * tag 'block-6.17-20250808' of git://git.kernel.dk/linux: (26 commits) lib/sbitmap: make sbitmap_get_shallow() internal lib/sbitmap: convert shallow_depth from one word to the whole sbitmap nvmet: exit debugfs after discovery subsystem exits block, bfq: Reorder struct bfq_iocq_bfqq_data md: make rdev_addable usable for rcu mode md/raid1: remove struct pool_info and related code md/raid1: change r1conf->r1bio_pool to a pointer type block: ensure discard_granularity is zero when discard is not supported zloop: fix KASAN use-after-free of tag set block: Fix default IO priority if there is no IO context nvme: fix various comment typos nvme-auth: remove unneeded semicolon nvme-pci: fix leak on sgl setup error nvmet: initialize discovery subsys after debugfs is initialized nvme: add capability to connect to an administrative controller nvmet: add support for FDP in fabrics passthru path md: rename recovery_cp to resync_offset md/md-cluster: handle REMOVE message earlier md: fix create on open mddev lifetime regression block: fix potential deadlock while running nr_hw_queue update ... commit 24bbfb8920d4179775a0255e97566ddb45c33328 Merge: 71a076033b261e 33503c083fda04 Author: Linus Torvalds Date: Sat Aug 9 08:45:08 2025 +0300 Merge tag 'io_uring-6.17-20250808' of git://git.kernel.dk/linux Pull io_uring fixes from Jens Axboe: - Allow vectorized payloads for send/send-zc - like sendmsg, but without the hassle of a msghdr. - Fix for an integer wrap that should go to stable, spotted by syzbot. Nothing alarming here, as you need to be root to hit this. Nevertheless, it should get fixed. FWIW, kudos to the syzbot crew for having much nicer reproducers now, and with nicely annotated source code as well. This is particularly useful as syzbot uses the raw interface rather than liburing, historically it's been difficult to turn a syzbot reproducer into a meaningful test case. With the recent changes, not true anymore! * tag 'io_uring-6.17-20250808' of git://git.kernel.dk/linux: io_uring/memmap: cast nr_pages to size_t before shifting io_uring/net: Allow to do vectorized send commit 71a076033b261e1c6851c2403b598c27847bd28d Merge: c5bf33d778e874 ffcfd071eec797 Author: Linus Torvalds Date: Sat Aug 9 08:43:24 2025 +0300 Merge tag 'spi-fix-v6.17-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi fixes from Mark Brown: "There's one fix here for an issue with the CS42L43 where we were allocating a single property for client devices as just that property rather than a terminated array of properties like we are supposed to. We also have an update to the MAINTAINERS file for some Renesas devices" * tag 'spi-fix-v6.17-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: spi: cs42l43: Property entry should be a null-terminated array MAINTAINERS: Add entries for the RZ/V2H(P) RSPI commit c5bf33d778e8744d081c51061753a8a313d247d0 Merge: 21a1f198273806 10dfd36f078423 Author: Linus Torvalds Date: Sat Aug 9 08:41:53 2025 +0300 Merge tag 'regulator-fix-v6.17-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator fix from Mark Brown: "This fixes an issue with the newly added code for handling large voltage changes on regulators which require that individual voltage changes cover a limited range, the check for convergence was broken" * tag 'regulator-fix-v6.17-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: regulator: core: correct convergence check in regulator_set_voltage() commit 21a1f198273806a20ef0c3c89721617c7dd76ece Merge: 25046d5b005bdd 76b6e14aa7b081 Author: Linus Torvalds Date: Sat Aug 9 08:40:28 2025 +0300 Merge tag 'regmap-fix-v6.17-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap fixes from Mark Brown: "These patches fix a lockdep issue Russell King reported with nested regmap-irqs (unusual since regmap is generally for devices on slow buses so devices don't get nested), plus add a missing mutex free which I noticed while implementing a fix for that issue" * tag 'regmap-fix-v6.17-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: irq: Avoid lockdep warnings with nested regmap-irq chips regmap: irq: Free the regmap-irq mutex commit 25046d5b005bddb927182df9780ef2e99bc19535 Merge: b20b8538b310f5 d5c647b08ee02c Author: Linus Torvalds Date: Sat Aug 9 08:39:05 2025 +0300 Merge tag 'pci-v6.17-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci fix from Bjorn Helgaas: - Fix vmd MSI interrupt domain restructure that caused crash early in boot (Nam Cao) * tag 'pci-v6.17-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: PCI: vmd: Fix wrong kfree() in vmd_msi_free() commit b20b8538b310f5458bd7a08b7ff8a76cc3c28d24 Merge: 0227b49b502766 5378bdf6a611a3 Author: Linus Torvalds Date: Sat Aug 9 08:37:17 2025 +0300 Merge tag 'mailbox-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox Pull mailbox updates from Jassi Brar: - aspeed: add driver and bindings for ast2700 - broadcom: add driver and bindings for bcm74110 - mediatek: fix RPM api usage - qcom: use dev_fwnode - pcc: support shared buffer - misc dt-bindings cleanup * tag 'mailbox-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/jassibrar/mailbox: mailbox/pcc: support mailbox management of the shared buffer mailbox: bcm74110: Fix spelling mistake mailbox: bcm74110: remove unneeded semicolon mailbox: aspeed: add mailbox driver for AST27XX series SoC dt-bindings: mailbox: Add ASPEED AST2700 series SoC dt-bindings: mailbox: Drop consumers example DTS dt-bindings: mailbox: nvidia,tegra186-hsp: Use generic node name dt-bindings: mailbox: Correct example indentation dt-bindings: mailbox: ti,secure-proxy: Add missing reg maxItems dt-bindings: mailbox: amlogic,meson-gxbb-mhu: Add missing interrupts maxItems dt-bindings: mailbox: qcom-ipcc: document the Milos Inter-Processor Communication Controller mailbox: Add support for bcm74110 dt-bindings: mailbox: Add support for bcm74110 mailbox: Use dev_fwnode() mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() commit 0227b49b50276657243e54f5609e65c4f0eaaf4d Merge: c93913c7080989 d9d87d90cc0b10 Author: Linus Torvalds Date: Sat Aug 9 08:15:43 2025 +0300 Merge tag 'gpio-updates-for-v6.17-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "As discussed: there's a small commit that removes the legacy GPIO line value setter callbacks as they're no longer used and a big, treewide commit that renames the new ones to the old names across all GPIO drivers at once. While at it: there are also two fixes that I picked up over the course of the merge window: - remove unused, legacy GPIO line value setters from struct gpio_chip - rename the new set callbacks back to the original names treewide - fix interrupt handling in gpio-mlxbf2 - revert a buggy immutable irqchip conversion" * tag 'gpio-updates-for-v6.17-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: treewide: rename GPIO set callbacks back to their original names gpio: remove legacy GPIO line value setter callbacks gpio: mlxbf2: use platform_get_irq_optional() Revert "gpio: pxa: Make irq_chip immutable" commit c93913c70809898aa5e450e4aad0b99750d9f082 Merge: 61d417921c9390 e8e4f3c242cc26 Author: Linus Torvalds Date: Sat Aug 9 08:12:41 2025 +0300 Merge tag 'sound-fix-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound fixes from Takashi Iwai: - Support for ASoC AMD ACP 7.2 with new IDs - ASoC Intel AVS and SOF fixes - Yet more kconfig adjustments for HD-audio codecs - TAS2781 codec fixes - Fixes for longstanding (rather minor) bugs in Intel LPE audio and USB-audio drivers * tag 'sound-fix-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: ALSA: hda/cirrus: Restrict prompt only for CONFIG_EXPERT ALSA: hda/hdmi: Restrict prompt only for CONFIG_EXPERT ALSA: hda/realtek: Restrict prompt only for CONFIG_EXPERT ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() ASoC: SOF: Intel: hda-sdw-bpt: fix SND_SOF_SOF_HDA_SDW_BPT dependencies ALSA: hda/tas2781: Support L"SmartAmpCalibrationData" to save calibrated data ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table ALSA: usb-audio: Don't use printk_ratelimit for debug prints ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCC SKU ASoC: tas2781: Fix the wrong step for TLV on tas2781 ASoC: amd: acp: Add SoundWire SOF machine driver support for acp7.2 platform ASoC: amd: acp: Add SoundWire legacy machine driver support for acp7.2 platform ASoC: amd: ps: Add SoundWire pci and dma driver support for acp7.2 platform ASoC: SOF: amd: Add sof audio support for acp7.2 platform ASoC: Intel: avs: Fix uninitialized pointer error in probe() ASoC: wm8962: Clear master mode when enter runtime suspend ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context commit 61d417921c9390ee2fb48c697490b6967c9b2034 Merge: 09aae3ecf8f10c 0c952efa0d7cf5 Author: Linus Torvalds Date: Sat Aug 9 07:58:55 2025 +0300 Merge tag 'soc-fixes-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "These are a few patches to fix up bits that went missing during the merge window: The tegra and s3c patches address trivial regressions from conflicts, the bcm7445 makes the dt conform to the binding that was made stricter" * tag 'soc-fixes-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: arm64: tegra: Remove numa-node-id properties ARM: s3c/gpio: complete the conversion to new GPIO value setters ARM: dts: broadcom: Fix bcm7445 memory controller compatible commit 09aae3ecf8f10c60e2ba43ee97f4d6364d8dd2fe Merge: 01b6ba6b097a0c 44a4ef59d5506c Author: Linus Torvalds Date: Sat Aug 9 07:35:03 2025 +0300 Merge tag 'xtensa-20250808' of https://github.com/jcmvbkbc/linux-xtensa Pull xtensa update from Max Filippov: - replace __ASSEMBLY__ with __ASSEMBLER__ in arch headers * tag 'xtensa-20250808' of https://github.com/jcmvbkbc/linux-xtensa: xtensa: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers xtensa: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers commit 01b6ba6b097a0ceeef1975ae37c1660fed1b560c Merge: ccc1ead23c3311 9d9b193ed73a65 Author: Linus Torvalds Date: Sat Aug 9 07:26:19 2025 +0300 Merge tag 'v6.17-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto fix from Herbert Xu: "Fix a regression that broke hmac(sha3-224-s390)" * tag 'v6.17-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: crypto: hash - Increase HASH_MAX_DESCSIZE for hmac(sha3-224-s390) commit ccc1ead23c3311be76e87d1b06620f6cb697b42a Merge: cfaf773b7946fa 4ec752ce6debd5 Author: Linus Torvalds Date: Sat Aug 9 07:20:44 2025 +0300 Merge tag 'nfs-for-6.17-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs Pull NFS client updates from Trond Myklebust: "Highlights include: Stable fixes: - don't inherit NFS filesystem capabilities when crossing from one filesystem to another Bugfixes: - NFS wakeup of __nfs_lookup_revalidate() needs memory barriers - NFS improve bounds checking in nfs_fh_to_dentry() - NFS Fix allocation errors when writing to a NFS file backed loopback device - NFSv4: More listxattr fixes - SUNRPC: fix client handling of TLS alerts - pNFS block/scsi layout fix for an uninitialised pointer dereference - pNFS block/scsi layout fixes for the extent encoding, stripe mapping, and disk offset overflows - pNFS layoutcommit work around for RPC size limitations - pNFS/flexfiles avoid looping when handling fatal errors after layoutget - localio: fix various race conditions Features and cleanups: - Add NFSv4 support for retrieving the btime - NFS: Allow folio migration for the case of mode == MIGRATE_SYNC - NFS: Support using a kernel keyring to store TLS certificates - NFSv4: Speed up delegation lookup using a hash table - Assorted cleanups to remove unused variables and struct fields - Assorted new tracepoints to improve debugging" * tag 'nfs-for-6.17-1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs: (44 commits) NFS/localio: nfs_uuid_put() fix the wake up after unlinking the file NFS/localio: nfs_uuid_put() fix races with nfs_open/close_local_fh() NFS/localio: nfs_close_local_fh() fix check for file closed NFSv4: Remove duplicate lookups, capability probes and fsinfo calls NFS: Fix the setting of capabilities when automounting a new filesystem sunrpc: fix client side handling of tls alerts nfs/localio: use read_seqbegin() rather than read_seqbegin_or_lock() NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY NFSv4.2: another fix for listxattr NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() SUNRPC: Silence warnings about parameters not being described NFS: Clean up pnfs_put_layout_hdr()/pnfs_destroy_layout_final() NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() NFS: use a hash table for delegation lookup NFS: track active delegations per-server NFS: move the delegation_watermark module parameter NFS: cleanup nfs_inode_reclaim_delegation NFS: cleanup error handling in nfs4_server_common_setup pNFS/flexfiles: don't attempt pnfs on fatal DS errors NFS: drop __exit from nfs_exit_keyring ... commit cfaf773b7946fa911e311acd3b82d61c7a9e42c2 Merge: 471025c9f7d601 dfe6f14aedbf59 Author: Linus Torvalds Date: Sat Aug 9 07:12:43 2025 +0300 Merge tag 'v6.17rc-part2-SMB3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull more smb client updates from Steve French: "Non-smbdirect: - Fix null ptr deref caused by delay in global spinlock initialization - Two fixes for native symlink creation with SMB3.1.1 POSIX Extensions - Fix for socket special file creation with SMB3.1.1 POSIX Exensions - Reduce lock contention by splitting out mid_counter_lock - move SMB1 transport code to separate file to reduce module size when support for legacy servers is disabled - Two cleanup patches: rename mid_lock to make it clearer what it protects and one to convert mid flags to bool to make clearer Smbdirect/RDMA restructuring and fixes: - Fix for error handling in send done - Remove unneeded empty packet queue - Fix put_receive_buffer error path - Two fixes to recv_done error paths - Remove unused variable - Improve response and recvmsg type handling - Fix handling of incoming message type - Two cleanup fixes for better handling smbdirect recv io - Two cleanup fixes for socket spinlock - Two patches that add socket reassembly struct - Remove unused connection_status enum - Use flag in common header for SMBDIRECT_RECV_IO_MAX_SGE - Two cleanup patches to introduce and use smbdirect send io - Two cleanup patches to introduce and use smbdirect send_io struct - Fix to return error if rdma connect takes longer than 5 seconds - Error logging improvements - Fix redundand call to init_waitqueue_head - Remove unneeded wait queue" * tag 'v6.17rc-part2-SMB3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: (33 commits) smb: client: only use a single wait_queue to monitor smbdirect connection status smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in _smbd_get_connection smb: client: improve logging in smbd_conn_upcall() smb: client: return an error if rdma_connect does not return within 5 seconds smb: client: make use of smbdirect_socket.{send,recv}_io.mem.{cache,pool} smb: smbdirect: add smbdirect_socket.{send,recv}_io.mem.{cache,pool} smb: client: make use of struct smbdirect_send_io smb: smbdirect: introduce struct smbdirect_send_io smb: client: make use of SMBDIRECT_RECV_IO_MAX_SGE smb: smbdirect: add SMBDIRECT_RECV_IO_MAX_SGE smb: client: remove unused enum smbd_connection_status smb: client: make use of smbdirect_socket.recv_io.reassembly.* smb: smbdirect: introduce smbdirect_socket.recv_io.reassembly.* smb: client: make use of smb: smbdirect_socket.recv_io.free.{list,lock} smb: smbdirect: introduce smbdirect_socket.recv_io.free.{list,lock} smb: client: make use of struct smbdirect_recv_io smb: smbdirect: introduce struct smbdirect_recv_io smb: client: make use of smbdirect_socket->recv_io.expected smb: smbdirect: introduce smbdirect_socket.recv_io.expected smb: client: remove unused smbd_connection->fragment_reassembly_remaining ... commit 471025c9f7d601c1887fdc582b96138b161b802b Merge: 37816488247ddd 8e7d178d06e893 Author: Linus Torvalds Date: Sat Aug 9 06:52:37 2025 +0300 Merge tag 'v6.17rc-part2-ksmbd-server-fixes' of git://git.samba.org/ksmbd Pull smb server fixes from Steve French: - Fix limiting repeated connections from same IP - Fix for extracting shortname when name begins with a dot - Four smbdirect fixes: - three fixes to the receive path: potential unmap bug, potential resource leaks and stale connections, and also potential use after free race - cleanup to remove unneeded queue * tag 'v6.17rc-part2-ksmbd-server-fixes' of git://git.samba.org/ksmbd: smb: server: Fix extension string in ksmbd_extract_shortname() ksmbd: limit repeated connections from clients with the same IP smb: server: let recv_done() avoid touching data_transfer after cleanup/move smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already smb: server: remove separate empty_recvmsg_queue commit 0c952efa0d7cf5258879406077df33d23cb06d5e Merge: 3dca3d51b933be c36049da6c903b Author: Arnd Bergmann Date: Fri Aug 8 22:50:43 2025 +0200 Merge tag 'tegra-for-6.17-arm64-dt-v3' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes arm64: tegra: Device tree changes for v6.17-rc1 This contains an extra patch that drops numa-node-id properties that were added to the Tegra264 DT files by mistake. * tag 'tegra-for-6.17-arm64-dt-v3' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Remove numa-node-id properties arm64: tegra: Add p3971-0089+p3834-0008 support arm64: tegra: Add memory controller on Tegra264 arm64: tegra: Add Tegra264 support dt-bindings: memory: tegra: Add Tegra264 support Link: https://lore.kernel.org/r/20250731162920.3329820-1-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 33caa208dba6fa639e8a92fd0c8320b652e5550c Author: Haiyang Zhang Date: Wed Aug 6 13:21:51 2025 -0700 hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it. Cc: stable@vger.kernel.org Fixes: 4c262801ea60 ("hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event") Signed-off-by: Haiyang Zhang Link: https://patch.msgid.link/1754511711-11188-1-git-send-email-haiyangz@linux.microsoft.com Signed-off-by: Jakub Kicinski commit c64237960819aee1766d03f446ae6de94b1e3f73 Author: Stanislav Fomichev Date: Wed Aug 6 14:37:26 2025 -0700 hamradio: ignore ops-locked netdevs Syzkaller managed to trigger lock dependency in xsk_notify via register_netdevice. As discussed in [0], using register_netdevice in the notifiers is problematic so skip adding hamradio for ops-locked devices. xsk_notifier+0x89/0x230 net/xdp/xsk.c:1664 notifier_call_chain+0x1b6/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline] call_netdevice_notifiers net/core/dev.c:2281 [inline] unregister_netdevice_many_notify+0x14d7/0x1ff0 net/core/dev.c:12156 unregister_netdevice_many net/core/dev.c:12219 [inline] unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:12063 register_netdevice+0x1689/0x1ae0 net/core/dev.c:11241 bpq_new_device drivers/net/hamradio/bpqether.c:481 [inline] bpq_device_event+0x491/0x600 drivers/net/hamradio/bpqether.c:523 notifier_call_chain+0x1b6/0x3e0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2267 [inline] call_netdevice_notifiers net/core/dev.c:2281 [inline] __dev_notify_flags+0x18d/0x2e0 net/core/dev.c:-1 netif_change_flags+0xe8/0x1a0 net/core/dev.c:9608 dev_change_flags+0x130/0x260 net/core/dev_api.c:68 devinet_ioctl+0xbb4/0x1b50 net/ipv4/devinet.c:1200 inet_ioctl+0x3c0/0x4c0 net/ipv4/af_inet.c:1001 0: https://lore.kernel.org/netdev/20250625140357.6203d0af@kernel.org/ Fixes: 4c975fd70002 ("net: hold instance lock during NETDEV_REGISTER/UP") Suggested-by: Jakub Kicinski Reported-by: syzbot+e6300f66a999a6612477@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e6300f66a999a6612477 Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250806213726.1383379-2-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 53898ebabe843bfa7baea9dae152797d5d0563c9 Author: Stanislav Fomichev Date: Wed Aug 6 14:37:25 2025 -0700 net: lapbether: ignore ops-locked netdevs Syzkaller managed to trigger lock dependency in xsk_notify via register_netdevice. As discussed in [0], using register_netdevice in the notifiers is problematic so skip adding lapbeth for ops-locked devices. xsk_notifier+0xa4/0x280 net/xdp/xsk.c:1645 notifier_call_chain+0xbc/0x410 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline] call_netdevice_notifiers net/core/dev.c:2282 [inline] unregister_netdevice_many_notify+0xf9d/0x2700 net/core/dev.c:12077 unregister_netdevice_many net/core/dev.c:12140 [inline] unregister_netdevice_queue+0x305/0x3f0 net/core/dev.c:11984 register_netdevice+0x18f1/0x2270 net/core/dev.c:11149 lapbeth_new_device drivers/net/wan/lapbether.c:420 [inline] lapbeth_device_event+0x5b1/0xbe0 drivers/net/wan/lapbether.c:462 notifier_call_chain+0xbc/0x410 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline] call_netdevice_notifiers net/core/dev.c:2282 [inline] __dev_notify_flags+0x12c/0x2e0 net/core/dev.c:9497 netif_change_flags+0x108/0x160 net/core/dev.c:9526 dev_change_flags+0xba/0x250 net/core/dev_api.c:68 devinet_ioctl+0x11d5/0x1f50 net/ipv4/devinet.c:1200 inet_ioctl+0x3a7/0x3f0 net/ipv4/af_inet.c:1001 0: https://lore.kernel.org/netdev/20250625140357.6203d0af@kernel.org/ Fixes: 4c975fd70002 ("net: hold instance lock during NETDEV_REGISTER/UP") Suggested-by: Jakub Kicinski Reported-by: syzbot+e67ea9c235b13b4f0020@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=e67ea9c235b13b4f0020 Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250806213726.1383379-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 829f45f9d992019b49f08ab425ca11288b084aed Author: Tristram Ha Date: Wed Aug 6 17:54:53 2025 -0700 net: dsa: microchip: Fix KSZ8863 reset problem ksz8873_valid_regs[] was added for register access for KSZ8863/KSZ8873 switches, but the reset register is not in the list so ksz8_reset_switch() does not take any effect. Replace regmap_update_bits() using ksz_regmap_8 with ksz_rmw8() so that an error message will be given if the register is not defined. A side effect of not resetting the switch is the static MAC table is not cleared. Further additions to the table will show write error as there are only 8 entries in the table. Fixes: d0dec3333040 ("net: dsa: microchip: Add register access control for KSZ8873 chip") Signed-off-by: Tristram Ha Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250807005453.8306-1-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit fd60d8a086191fe33c2d719732d2482052fa6805 Author: Xin Long Date: Thu Aug 7 15:40:11 2025 -0400 sctp: linearize cloned gso packets in sctp_rcv A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs caused by this: BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline] and BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] This patch fixes it by linearizing cloned gso packets in sctp_rcv(). Fixes: 90017accff61 ("sctp: Add GSO support") Reported-by: syzbot+773e51afe420baaf0e2b@syzkaller.appspotmail.com Reported-by: syzbot+70a42f45e76bede082be@syzkaller.appspotmail.com Signed-off-by: Xin Long Reviewed-by: Marcelo Ricardo Leitner Link: https://patch.msgid.link/dd7dc337b99876d4132d0961f776913719f7d225.1754595611.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski commit 44207567fa64e995d4f2ec2d45af4c947cb1a465 Author: Zhang Rui Date: Tue Jun 17 20:48:59 2025 +0800 tools/power turbostat: Fix bogus SysWatt for forked program Similar to delta_cpu(), delta_platform() is called in turbostat main loop. This ensures accurate SysWatt readings in periodic monitoring mode $ sudo turbostat -S -q --show power -i 1 CoreTmp PkgTmp PkgWatt CorWatt GFXWatt RAMWatt PKG_% RAM_% SysWatt 60 61 6.21 1.13 0.16 0.00 0.00 0.00 13.07 58 61 6.00 1.07 0.18 0.00 0.00 0.00 12.75 58 61 5.74 1.05 0.17 0.00 0.00 0.00 12.22 58 60 6.27 1.11 0.24 0.00 0.00 0.00 13.55 However, delta_platform() is missing for forked program and causes bogus SysWatt reporting, $ sudo turbostat -S -q --show power sleep 1 1.004736 sec CoreTmp PkgTmp PkgWatt CorWatt GFXWatt RAMWatt PKG_% RAM_% SysWatt 57 58 6.05 1.02 0.16 0.00 0.00 0.00 0.03 Add missing delta_platform() for forked program. Fixes: e5f687b89bc2 ("tools/power turbostat: Add RAPL psys as a built-in counter") Signed-off-by: Zhang Rui Signed-off-by: Len Brown commit d34fe509f5f76d9dc36291242d67c6528027ebbd Author: Calvin Owens Date: Fri Jun 13 19:20:28 2025 -0700 tools/power turbostat: Handle cap_get_proc() ENOSYS Kernels configured with CONFIG_MULTIUSER=n have no cap_get_proc(). Check for ENOSYS to recognize this case, and continue on to attempt to access the requested MSRs (such as temperature). Signed-off-by: Calvin Owens Signed-off-by: Len Brown commit 6ea0ec1b958a84aff9f03fb0ae4613a4d5bed3ea Author: Calvin Owens Date: Fri Jun 13 09:54:23 2025 -0700 tools/power turbostat: Fix build with musl turbostat.c: In function 'parse_int_file': turbostat.c:5567:19: error: 'PATH_MAX' undeclared (first use in this function) 5567 | char path[PATH_MAX]; | ^~~~~~~~ turbostat.c: In function 'probe_graphics': turbostat.c:6787:19: error: 'PATH_MAX' undeclared (first use in this function) 6787 | char path[PATH_MAX]; | ^~~~~~~~ Signed-off-by: Calvin Owens Reviewed-by: Artem Bityutskiy Signed-off-by: Len Brown commit d44c40e4e30f6aa1ca8ed1c8b715d4c5829f0560 Author: Len Brown Date: Tue Jun 10 18:07:49 2025 -0400 tools/power turbostat: verify arguments to params --show and --hide $ sudo turbostat --quiet --show junk turbostat: Counter 'junk' can not be added. Previously, invalid arguments to --show and --hide were silently ignored Acked-by: Zhang Rui Signed-off-by: Len Brown commit aba0c94f61ec05315fa7815d21aefa4c87f6a9f4 Author: Budimir Markovic Date: Thu Aug 7 04:18:11 2025 +0000 vsock: Do not allow binding to VMADDR_PORT_ANY It is possible for a vsock to autobind to VMADDR_PORT_ANY. This can cause a use-after-free when a connection is made to the bound socket. The socket returned by accept() also has port VMADDR_PORT_ANY but is not on the list of unbound sockets. Binding it will result in an extra refcount decrement similar to the one fixed in fcdd2242c023 (vsock: Keep the binding until socket destruction). Modify the check in __vsock_bind_connectible() to also prevent binding to VMADDR_PORT_ANY. Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") Reported-by: Budimir Markovic Signed-off-by: Budimir Markovic Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250807041811.678-1-markovicbudimir@gmail.com Signed-off-by: Jakub Kicinski commit 5f1d1d14db7dabce9c815e7d7cd351f8d58b8585 Author: Alok Tiwari Date: Tue Aug 5 07:23:18 2025 -0700 net: ti: icss-iep: Fix incorrect type for return value in extts_enable() The variable ret in icss_iep_extts_enable() was incorrectly declared as u32, while the function returns int and may return negative error codes. This will cause sign extension issues and incorrect error propagation. Update ret to be int to fix error handling. This change corrects the declaration to avoid potential type mismatch. Fixes: c1e0230eeaab ("net: ti: icss-iep: Add IEP driver") Signed-off-by: Alok Tiwari Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250805142323.1949406-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 64fdaa94bfe0cca3a0f4b2dd922486c5f59fe678 Author: Jakub Kicinski Date: Mon Aug 4 17:36:54 2025 -0700 net: page_pool: allow enabling recycling late, fix false positive warning Page pool can have pages "directly" (locklessly) recycled to it, if the NAPI that owns the page pool is scheduled to run on the same CPU. To make this safe we check that the NAPI is disabled while we destroy the page pool. In most cases NAPI and page pool lifetimes are tied together so this happens naturally. The queue API expects the following order of calls: -> mem_alloc alloc new pp -> stop napi_disable -> start napi_enable -> mem_free free old pp Here we allocate the page pool in ->mem_alloc and free in ->mem_free. But the NAPIs are only stopped between ->stop and ->start. We created page_pool_disable_direct_recycling() to safely shut down the recycling in ->stop. This way the page_pool_destroy() call in ->mem_free doesn't have to worry about recycling any more. Unfortunately, the page_pool_disable_direct_recycling() is not enough to deal with failures which necessitate freeing the _new_ page pool. If we hit a failure in ->mem_alloc or ->stop the new page pool has to be freed while the NAPI is active (assuming driver attaches the page pool to an existing NAPI instance and doesn't reallocate NAPIs). Freeing the new page pool is technically safe because it hasn't been used for any packets, yet, so there can be no recycling. But the check in napi_assert_will_not_race() has no way of knowing that. We could check if page pool is empty but that'd make the check much less likely to trigger during development. Add page_pool_enable_direct_recycling(), pairing with page_pool_disable_direct_recycling(). It will allow us to create the new page pools in "disabled" state and only enable recycling when we know the reconfig operation will not fail. Coincidentally it will also let us re-enable the recycling for the old pool, if the reconfig failed: -> mem_alloc (new) -> stop (old) # disables direct recycling for old -> start (new) # fail!! -> start (old) # go back to old pp but direct recycling is lost :( -> mem_free (new) The new helper is idempotent to make the life easier for drivers, which can operate in HDS mode and support zero-copy Rx. The driver can call the helper twice whether there are two pools or it has multiple references to a single pool. Fixes: 40eca00ae605 ("bnxt_en: unlink page pool when stopping Rx queue") Tested-by: David Wei Link: https://patch.msgid.link/20250805003654.2944974-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 06feac15406f4f66f4c0c6ea60b10d44775d4133 Author: MD Danish Anwar Date: Tue Aug 5 23:08:12 2025 +0530 net: ti: icssg-prueth: Fix emac link speed handling When link settings are changed emac->speed is populated by emac_adjust_link(). The link speed and other settings are then written into the DRAM. However if both ports are brought down after this and brought up again or if the operating mode is changed and a firmware reload is needed, the DRAM is cleared by icssg_config(). As a result the link settings are lost. Fix this by calling emac_adjust_link() after icssg_config(). This re populates the settings in the DRAM after a new firmware load. Fixes: 9facce84f406 ("net: ti: icssg-prueth: Fix firmware load sequence.") Signed-off-by: MD Danish Anwar Reviewed-by: Andrew Lunn Message-ID: <20250805173812.2183161-1-danishanwar@ti.com> Signed-off-by: Jakub Kicinski commit 2182153cfd22974c351711cf1e66ea0b45e2cdbf Merge: f6a2a31043f9e3 62c50180ffda01 Author: Jakub Kicinski Date: Fri Aug 8 11:48:51 2025 -0700 Merge branch 'there-are-some-bugfix-for-hibmcge-ethernet-driver' Jijie Shao says: ==================== There are some bugfix for hibmcge ethernet driver This patch set is intended to fix several issues for hibmcge driver: 1. Holding the rtnl_lock in pci_error_handlers->reset_prepare() may lead to a deadlock issue. 2. A division by zero issue caused by debugfs when the port is down. 3. A probabilistic false positive issue with np_link_fail. v2: https://lore.kernel.org/20250805181446.3deaceb9@kernel.org v1: https://lore.kernel.org/20250731134749.4090041-1-shaojijie@huawei.com ==================== Link: https://patch.msgid.link/20250806102758.3632674-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 62c50180ffda01468e640ac14925503796f255e2 Author: Jijie Shao Date: Wed Aug 6 18:27:58 2025 +0800 net: hibmcge: fix the np_link_fail error reporting issue Currently, after modifying device port mode, the np_link_ok state is immediately checked. At this point, the device may not yet ready, leading to the querying of an intermediate state. This patch will poll to check if np_link is ok after modifying device port mode, and only report np_link_fail upon timeout. Fixes: e0306637e85d ("net: hibmcge: Add support for mac link exception handling feature") Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit 7004b26f0b64331143eb0b312e77a357a11427ce Author: Jijie Shao Date: Wed Aug 6 18:27:57 2025 +0800 net: hibmcge: fix the division by zero issue When the network port is down, the queue is released, and ring->len is 0. In debugfs, hbg_get_queue_used_num() will be called, which may lead to a division by zero issue. This patch adds a check, if ring->len is 0, hbg_get_queue_used_num() directly returns 0. Fixes: 40735e7543f9 ("net: hibmcge: Implement .ndo_start_xmit function") Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit c875503a9b9082928d7d3fc60b5400d16fbfae4e Author: Jijie Shao Date: Wed Aug 6 18:27:56 2025 +0800 net: hibmcge: fix rtnl deadlock issue Currently, the hibmcge netdev acquires the rtnl_lock in pci_error_handlers.reset_prepare() and releases it in pci_error_handlers.reset_done(). However, in the PCI framework: pci_reset_bus - __pci_reset_slot - pci_slot_save_and_disable_locked - pci_dev_save_and_disable - err_handler->reset_prepare(dev); In pci_slot_save_and_disable_locked(): list_for_each_entry(dev, &slot->bus->devices, bus_list) { if (!dev->slot || dev->slot!= slot) continue; pci_dev_save_and_disable(dev); if (dev->subordinate) pci_bus_save_and_disable_locked(dev->subordinate); } This will iterate through all devices under the current bus and execute err_handler->reset_prepare(), causing two devices of the hibmcge driver to sequentially request the rtnl_lock, leading to a deadlock. Since the driver now executes netif_device_detach() before the reset process, it will not concurrently with other netdev APIs, so there is no need to hold the rtnl_lock now. Therefore, this patch removes the rtnl_lock during the reset process and adjusts the position of HBG_NIC_STATE_RESETTING to ensure that multiple resets are not executed concurrently. Fixes: 3f5a61f6d504f ("net: hibmcge: Add reset supported in this module") Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Signed-off-by: Jakub Kicinski commit f6a2a31043f9e3446a322adf66af7a110e7670b9 Merge: 37816488247ddd 1dee968d22eaeb Author: Jakub Kicinski Date: Fri Aug 8 11:45:14 2025 -0700 Merge tag 'nf-25-08-07' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf Pablo Neira Ayuso says: ==================== Netfilter fixes for net The following patchset contains Netfilter fixes for net: 1) Reinstantiate Florian Westphal as a Netfilter maintainer. 2) Depend on both NETFILTER_XTABLES and NETFILTER_XTABLES_LEGACY, from Arnd Bergmann. 3) Use id to annotate last conntrack/expectation visited to resume netlink dump, patches from Florian Westphal. 4) Fix bogus element in nft_pipapo avx2 lookup, introduced in the last nf-next batch of updates, also from Florian. 5) Return 0 instead of recycling ret variable in nf_conntrack_log_invalid_sysctl(), introduced in the last nf-next batch of updates, from Dan Carpenter. 6) Fix WARN_ON_ONCE triggered by syzbot with larger cgroup level in nft_socket. * tag 'nf-25-08-07' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf: netfilter: nft_socket: remove WARN_ON_ONCE with huge level value netfilter: conntrack: clean up returns in nf_conntrack_log_invalid_sysctl() netfilter: nft_set_pipapo: don't return bogus extension pointer netfilter: ctnetlink: remove refcounting in expectation dumpers netfilter: ctnetlink: fix refcount leak on table dump netfilter: add back NETFILTER_XTABLES dependencies MAINTAINERS: resurrect my netfilter maintainer entry ==================== Link: https://patch.msgid.link/20250807112948.1400523-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 33503c083fda048c77903460ac0429e1e2c0e341 Author: Jens Axboe Date: Fri Aug 8 06:35:14 2025 -0600 io_uring/memmap: cast nr_pages to size_t before shifting If the allocated size exceeds UINT_MAX, then it's necessary to cast the mr->nr_pages value to size_t to prevent it from overflowing. In practice this isn't much of a concern as the required memory size will have been validated upfront, and accounted to the user. And > 4GB sizes will be necessary to make the lack of a cast a problem, which greatly exceeds normal user locked_vm settings that are generally in the kb to mb range. However, if root is used, then accounting isn't done, and then it's possible to hit this issue. Link: https://lore.kernel.org/all/6895b298.050a0220.7f033.0059.GAE@google.com/ Cc: stable@vger.kernel.org Reported-by: syzbot+23727438116feb13df15@syzkaller.appspotmail.com Fixes: 087f997870a9 ("io_uring/memmap: implement mmap for regions") Signed-off-by: Jens Axboe commit d8369183a01a9f06f08c5d52e2667035e66b9957 Merge: 42e42562c9cfcd 1118aaa3b35157 Author: Steffen Klassert Date: Fri Aug 8 10:44:23 2025 +0200 Merge branch 'xfrm: some fixes for GSO with SW crypto' Sabrina Dubroca says: ==================== This series fixes a few issues with GSO. Some recent patches made the incorrect assumption that GSO is only used by offload. The first two patches in this series restore the old behavior. The final patch is in the UDP GSO code, but fixes an issue with IPsec that is currently masked by the lack of GSO for SW crypto. With GSO, VXLAN over IPsec doesn't get checksummed. ==================== Signed-off-by: Steffen Klassert commit 85acc29f90e0183997dea27277057c9aec2769aa Author: Marc Zyngier Date: Wed Aug 6 18:13:41 2025 +0100 KVM: arm64: selftest: Add standalone test checking for KVM's own UUID Tinkering with UUIDs is a perilious task, and the KVM UUID gets broken at times. In order to spot this early enough, add a selftest that will shout if the expected value isn't found. Signed-off-by: Marc Zyngier Reviewed-by: Sebastian Ott Link: https://lore.kernel.org/r/20250721130558.50823-1-jackabt.amazon@gmail.com Link: https://lore.kernel.org/r/20250806171341.1521210-1-maz@kernel.org Signed-off-by: Oliver Upton commit f1edb159200ad1ef2fc518c7673cb9559a6f8edd Author: Fuad Tabba Date: Thu Aug 7 13:01:33 2025 +0100 arm64: vgic-v2: Fix guest endianness check in hVHE mode In hVHE when running at the hypervisor, SCTLR_EL1 refers to the hypervisor's System Control Register rather than the guest's. Make sure to access the guest's register to determine its endianness. Reported-by: Will Deacon Signed-off-by: Fuad Tabba Link: https://lore.kernel.org/r/20250807120133.871892-4-tabba@google.com Signed-off-by: Oliver Upton commit 798eb597870064bff28d8a41cb5197725f7dc6f2 Author: Fuad Tabba Date: Thu Aug 7 13:01:32 2025 +0100 KVM: arm64: Sync protected guest VBAR_EL1 on injecting an undef exception In pKVM, a race condition can occur if a guest updates its VBAR_EL1 register and, before a vCPU exit synchronizes this change, the hypervisor needs to inject an undefined exception into a protected guest. In this scenario, the vCPU still holds the stale VBAR_EL1 value from before the guest's update. When pKVM injects the exception, it ends up using the stale value. Explicitly read the live value of VBAR_EL1 from the guest and update the vCPU value immediately before pending the exception. This ensures the vCPU's value is the same as the guest's and that the exception will be handled at the correct address upon resuming the guest. Reported-by: Keir Fraser Signed-off-by: Fuad Tabba Link: https://lore.kernel.org/r/20250807120133.871892-3-tabba@google.com Signed-off-by: Oliver Upton commit eaa43934b412f0381598e308b6a25d6c9a5dce2d Author: Fuad Tabba Date: Thu Aug 7 13:01:31 2025 +0100 KVM: arm64: Handle AIDR_EL1 and REVIDR_EL1 in host for protected VMs Since commit 17efc1acee62 ("arm64: Expose AIDR_EL1 via sysfs"), AIDR_EL1 is read early during boot. Therefore, a guest running as a protected VM will fail to boot because when it attempts to access AIDR_EL1, access to that register is restricted in pKVM for protected guests. Similar to how MIDR_EL1 is handled by the host for protected VMs, let the host handle accesses to AIDR_EL1 as well as REVIDR_EL1. However note that, unlike MIDR_EL1, AIDR_EL1 and REVIDR_EL1 are trapped by HCR_EL2.TID1. Therefore, explicitly mark them as handled by the host for protected VMs. TID1 is always set in pKVM, because it needs to restrict access to SMIDR_EL1, which is also trapped by that bit. Reported-by: Will Deacon Signed-off-by: Fuad Tabba Link: https://lore.kernel.org/r/20250807120133.871892-2-tabba@google.com Signed-off-by: Oliver Upton commit 700d6868fee2d384cbd821d31db3a245d218223c Author: Arnd Bergmann Date: Thu Aug 7 09:21:28 2025 +0200 kvm: arm64: use BUG() instead of BUG_ON(1) The BUG_ON() macro adds a little bit of complexity over BUG(), and in some cases this ends up confusing the compiler's control flow analysis in a way that results in a warning. This one now shows up with clang-21: arch/arm64/kvm/vgic/vgic-mmio.c:1094:3: error: variable 'len' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] 1094 | BUG_ON(1); Change both instances of BUG_ON(1) to a plain BUG() in the arm64 kvm code, to avoid the false-positive warning. Signed-off-by: Arnd Bergmann Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250807072132.4170088-1-arnd@kernel.org Signed-off-by: Oliver Upton commit 5378bdf6a611a32500fccf13d14156f219bb0c85 Author: Adam Young Date: Mon Jul 14 20:10:07 2025 -0400 mailbox/pcc: support mailbox management of the shared buffer Define a new, optional, callback that allows the driver to specify how the return data buffer is allocated. If that callback is set, mailbox/pcc.c is now responsible for reading from and writing to the PCC shared buffer. This also allows for proper checks of the Commnand complete flag between the PCC sender and receiver. For Type 4 channels, initialize the command complete flag prior to accepting messages. Since the mailbox does not know what memory allocation scheme to use for response messages, the client now has an optional callback that allows it to allocate the buffer for a response message. When an outbound message is written to the buffer, the mailbox checks for the flag indicating the client wants an tx complete notification via IRQ. Upon receipt of the interrupt It will pair it with the outgoing message. The expected use is to free the kernel memory buffer for the previous outgoing message. Signed-off-by: Adam Young Signed-off-by: Jassi Brar commit 37816488247ddddbc3de113c78c83572274b1e2e Merge: bec077162bd001 ae633388cae349 Author: Linus Torvalds Date: Fri Aug 8 07:03:25 2025 +0300 Merge tag 'net-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: Previous releases - regressions: - netlink: avoid infinite retry looping in netlink_unicast() Previous releases - always broken: - packet: fix a race in packet_set_ring() and packet_notifier() - ipv6: reject malicious packets in ipv6_gso_segment() - sched: mqprio: fix stack out-of-bounds write in tc entry parsing - net: drop UFO packets (injected via virtio) in udp_rcv_segment() - eth: mlx5: correctly set gso_segs when LRO is used, avoid false positive checksum validation errors - netpoll: prevent hanging NAPI when netcons gets enabled - phy: mscc: fix parsing of unicast frames for PTP timestamping - a number of device tree / OF reference leak fixes" * tag 'net-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (44 commits) pptp: fix pptp_xmit() error path net: ti: icssg-prueth: Fix skb handling for XDP_PASS net: Update threaded state in napi config in netif_set_threaded selftests: netdevsim: Xfail nexthop test on slow machines eth: fbnic: Lock the tx_dropped update eth: fbnic: Fix tx_dropped reporting eth: fbnic: remove the debugging trick of super high page bias net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect dt-bindings: net: Replace bouncing Alexandru Tachici emails dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing Revert "net: mdio_bus: Use devm for getting reset GPIO" selftests: net: packetdrill: xfail all problems on slow machines net/packet: fix a race in packet_set_ring() and packet_notifier() benet: fix BUG when creating VFs net: airoha: npu: Add missing MODULE_FIRMWARE macros net: devmem: fix DMA direction on unmapping ipa: fix compile-testing with qcom-mdt=m eth: fbnic: unlink NAPIs from queues on error to open net: Add locking to protect skb->dev access in ip_output ... commit bec077162bd0017c21288919757809656094a157 Merge: b1e06c19abd2ef 2baf16f381dece Author: Linus Torvalds Date: Fri Aug 8 06:56:55 2025 +0300 Merge tag 's390-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull more s390 updates from Alexander Gordeev: - Support MMIO read/write tracing - Enable THP swapping and THP migration - Unmask SLCF bit ("stateless command filtering") introduced with CEX8 cards, so that user space applications like lszcrypt could evaluate and list this feature - Fix the value of high_memory variable, so it considers possible tailing offline memory blocks - Make vmem_pte_alloc() consistent and always allocate memory of PAGE_SIZE for page tables. This ensures a page table occupies the whole page, as the rest of the code assumes - Fix kernel image end address in the decompressor debug output - Fix a typo in debug_sprintf_format_fn() comment * tag 's390-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/debug: Fix typo in debug_sprintf_format_fn() comment s390/boot: Fix startup debugging log s390/mm: Allocate page table with PAGE_SIZE granularity s390/mm: Enable THP_SWAP and THP_MIGRATION s390: Support CONFIG_TRACE_MMIO_ACCESS s390/mm: Set high_memory at the end of the identity mapping s390/ap: Unmask SLCF bit in card and queue ap functions sysfs commit b1e06c19abd2efbdd080047b2e70195c04ac2139 Merge: ffe8ac927d935d 6a20f9fca30c40 Author: Linus Torvalds Date: Fri Aug 8 06:54:23 2025 +0300 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull vhost fix from Michael Tsirkin: "A single fix for a regression in vhost" * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: vhost: initialize vq->nheads properly commit ffe8ac927d935d7d4a0bd9ac94afd705df79982b Merge: 2939a792c47e55 64c627519474e6 Author: Linus Torvalds Date: Fri Aug 8 06:48:14 2025 +0300 Merge tag 'drm-next-2025-08-08' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "This is the fixes that built up in the merge window, mostly amdgpu and xe with one i915 display fix, seems like things are pretty good for rc1. i915: - DP LPFS fixes xe: - SRIOV: PF fixes and removal of need of module param - Fix driver unbind around Devcoredump - Mark xe driver as BROKEN if kernel page size is not 4kB amdgpu: - GC 9.5.0 fixes - SMU fix - DCE 6 DC fixes - mmhub client ID fixes - VRR fix - Backlight fix - UserQ fix - Legacy reset fix - Misc fixes amdkfd: - CRIU fix - Debugfs fix" * tag 'drm-next-2025-08-08' of https://gitlab.freedesktop.org/drm/kernel: (28 commits) drm/amdgpu: add missing vram lost check for LEGACY RESET drm/amdgpu/discovery: fix fw based ip discovery drm/amdkfd: Destroy KFD debugfs after destroy KFD wq amdgpu/amdgpu_discovery: increase timeout limit for IFWI init drm/amdgpu: Update SDMA firmware version check for user queue support drm/amdgpu: Add NULL check for asic_funcs drm/amd/display: Revert "drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value" drm/amd/display: fix a Null pointer dereference vulnerability drm/amd/display: Add primary plane to commits for correct VRR handling drm/amdgpu: update mmhub 3.3 client id mappings drm/amdgpu: update mmhub 3.0.1 client id mappings drm/amdgpu: Retain job->vm in amdgpu_job_prepare_job drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming. drm/amd/display: Don't overwrite dce60_clk_mgr drm/amdkfd: Fix checkpoint-restore on multi-xcc drm/amd: Restore cached manual clock settings during resume drm/amd: Restore cached power limit during resume drm/amdgpu: Update external revid for GC v9.5.0 drm/amdgpu: Update supported modes for GC v9.5.0 Mark xe driver as BROKEN if kernel page size is not 4kB ... commit 2939a792c47e55fda4ae5b7f9ff47e34ddcef61a Merge: 83affacd18cc22 e4fc307d8e24f1 Author: Linus Torvalds Date: Fri Aug 8 06:43:20 2025 +0300 Merge tag 'fbdev-for-6.17-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev fixes for 6.17-rc1: - Revert a patch which broke VGA console - Fix an out-of-bounds access bug which may happen during console resizing when a console is mapped to a frame buffer * tag 'fbdev-for-6.17-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" fbdev: Fix vmalloc out-of-bounds write in fast_imageblit commit 83affacd18cc225f538e532c6e667d26b3ec69fd Merge: 6e64f4580381e3 d35ec48fa6c8fe Author: Linus Torvalds Date: Fri Aug 8 06:36:48 2025 +0300 Merge tag 'loongarch-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Complete KSave registers definition - Support the mem= kernel parameter - Support BPF dynamic modification & trampoline - Add MMC/SDIO controller nodes in dts - Some bug fixes and other small changes * tag 'loongarch-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: LoongArch: vDSO: Remove -nostdlib complier flag LoongArch: dts: Add eMMC/SDIO controller support to Loongson-2K2000 LoongArch: dts: Add SDIO controller support to Loongson-2K1000 LoongArch: dts: Add SDIO controller support to Loongson-2K0500 LoongArch: BPF: Set bpf_jit_bypass_spec_v1/v4() LoongArch: BPF: Fix the tailcall hierarchy LoongArch: BPF: Fix jump offset calculation in tailcall LoongArch: BPF: Add struct ops support for trampoline LoongArch: BPF: Add basic bpf trampoline support LoongArch: BPF: Add dynamic code modification support LoongArch: BPF: Rename and refactor validate_code() LoongArch: Add larch_insn_gen_{beq,bne} helpers LoongArch: Don't use %pK through printk() in unwinder LoongArch: Avoid in-place string operation on FDT content LoongArch: Support mem= kernel parameter LoongArch: Make relocate_new_kernel_size be a .quad value LoongArch: Complete KSave registers definition commit 8e7d178d06e8937454b6d2f2811fa6a15656a214 Author: Thorsten Blum Date: Wed Aug 6 03:03:49 2025 +0200 smb: server: Fix extension string in ksmbd_extract_shortname() In ksmbd_extract_shortname(), strscpy() is incorrectly called with the length of the source string (excluding the NUL terminator) rather than the size of the destination buffer. This results in "__" being copied to 'extension' rather than "___" (two underscores instead of three). Use the destination buffer size instead to ensure that the string "___" (three underscores) is copied correctly. Cc: stable@vger.kernel.org Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3") Signed-off-by: Thorsten Blum Acked-by: Namjae Jeon Signed-off-by: Steve French commit e6bb9193974059ddbb0ce7763fa3882bd60d4dc3 Author: Namjae Jeon Date: Tue Aug 5 18:13:13 2025 +0900 ksmbd: limit repeated connections from clients with the same IP Repeated connections from clients with the same IP address may exhaust the max connections and prevent other normal client connections. This patch limit repeated connections from clients with the same IP. Reported-by: tianshuo han Cc: stable@vger.kernel.org Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 64c627519474e687b876e6e50cc28ece16d10564 Merge: 10acca927f9f24 81699fe81b0be2 Author: Dave Airlie Date: Fri Aug 8 08:00:45 2025 +1000 Merge tag 'amd-drm-fixes-6.17-2025-08-07' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.17-2025-08-07: amdgpu: - GC 9.5.0 fixes - SMU fix - DCE 6 DC fixes - mmhub client ID fixes - VRR fix - Backlight fix - UserQ fix - Legacy reset fix - Misc fixes amdkfd: - CRIU fix - Debugfs fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250807132030.1168068-1-alexander.deucher@amd.com commit 10acca927f9f245d046ee670f1272e5e2c451553 Merge: 48bb97cff95ead 022906afdf9032 Author: Dave Airlie Date: Fri Aug 8 05:50:02 2025 +1000 Merge tag 'drm-xe-next-fixes-2025-08-06' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next - SRIOV: PF fixes and removal of need of module param (Michal) - Fix driver unbind around Devcoredump (Bala) - Mark xe driver as BROKEN if kernel page size is not 4kB (Simon) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aJNXnIAp2Cq-2pZj@intel.com commit dfe6f14aedbf59bfb7145de5c7da908583ae50fd Author: Stefan Metzmacher Date: Thu Aug 7 18:12:14 2025 +0200 smb: client: only use a single wait_queue to monitor smbdirect connection status There's no need for separate conn_wait and disconn_wait queues. This will simplify the move to common code, the server code already a single wait_queue for this. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 550a194c5998e4e77affc6235e80d3766dc2d27e Author: Stefan Metzmacher Date: Thu Aug 7 18:12:13 2025 +0200 smb: client: don't call init_waitqueue_head(&info->conn_wait) twice in _smbd_get_connection It is already called long before we may hit this cleanup code path. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 761399745710fd37fa4312af1b675b2fe73c1c52 Author: Stefan Metzmacher Date: Thu Aug 7 18:12:12 2025 +0200 smb: client: improve logging in smbd_conn_upcall() Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 03537826f77f1c829d0593d211b38b9c876c1722 Author: Stefan Metzmacher Date: Thu Aug 7 18:12:11 2025 +0200 smb: client: return an error if rdma_connect does not return within 5 seconds This matches the timeout for tcp connections. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit d5c647b08ee02cb7fa50d89414ed0f5dc7c1ca0e Author: Nam Cao Date: Thu Aug 7 10:10:51 2025 +0200 PCI: vmd: Fix wrong kfree() in vmd_msi_free() vmd_msi_alloc() allocates struct vmd_irq and stashes it into irq_data->chip_data associated with the VMD's interrupt domain. vmd_msi_free() extracts the pointer by calling irq_get_chip_data() and frees it. irq_get_chip_data() returns the chip_data associated with the top interrupt domain. This worked in the past because VMD's interrupt domain was the top domain. But d7d8ab87e3e7 ("PCI: vmd: Switch to msi_create_parent_irq_domain()") changed the interrupt domain hierarchy so VMD's interrupt domain is not the top domain anymore. irq_get_chip_data() now returns the chip_data at the MSI devices' interrupt domains. It is therefore broken for vmd_msi_free() to kfree() this chip_data. Fix by extracting the chip_data associated with the VMD's interrupt domain. Fixes: d7d8ab87e3e7 ("PCI: vmd: Switch to msi_create_parent_irq_domain()") Reported-by: Kenneth Crudup Closes: https://lore.kernel.org/linux-pci/dfa40e48-8840-4e61-9fda-25cdb3ad81c1@panix.com/ Reported-by: Ammar Faizi Closes: https://lore.kernel.org/linux-pci/ed53280ed15d1140700b96cca2734bf327ee92539e5eb68e80f5bbbf0f01@linux.gnuweeb.org/ Tested-by: Ammar Faizi Tested-by: Kenneth Crudup Signed-off-by: Nam Cao Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Reviewed-by: Jinjie Ruan Acked-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250807081051.2253962-1-namcao@linutronix.de commit 42464c51ccccb6343a932a7ea8bc9181e589f270 Author: Sasha Levin Date: Thu Aug 7 09:10:58 2025 -0400 drm/msm: Fix objtool warning in submit_lock_objects() Split the vmbind case into a separate helper function submit_lock_objects_vmbind() to fix objtool warning: drivers/gpu/drm/msm/msm.o: warning: objtool: submit_lock_objects+0x451: sibling call from callable instruction with modified stack frame The drm_exec_until_all_locked() macro uses computed gotos internally for its retry loop. Having return statements inside this macro, or immediately after it in certain code paths, confuses objtool's static analysis of stack frames, causing it to incorrectly flag tail call optimizations. Fixes: 92395af63a99 ("drm/msm: Add VM_BIND submitqueue") Signed-off-by: Sasha Levin Patchwork: https://patchwork.freedesktop.org/patch/667539/ Signed-off-by: Rob Clark commit fe2f3b1c702f0e02906419c662ca9446cc789354 Author: Rob Clark Date: Tue Aug 5 09:44:31 2025 -0700 drm/msm: Handle in-place remaps Detect and handle the special case of a MAP op simply updating the vma flags of an existing vma, and skip the pgtable updates. This allows turnip to set the MSM_VMA_DUMP flag on an existing mapping without requiring additional synchronization against commands running on the GPU. Signed-off-by: Rob Clark Tested-by: Connor Abbott Patchwork: https://patchwork.freedesktop.org/patch/667238/ commit ba3afadeb81ebb92ab23546fbd2ec7d9dfe216f8 Author: Rob Clark Date: Tue Aug 5 09:43:08 2025 -0700 drm/msm: Fix a few comments Fix a couple comments which had become (partially) obsolete or incorrect with the gpuvm conversion. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/667237/ commit e9621ef610c4a600678da5d8020d4a0dfe686faa Author: Rob Clark Date: Fri Aug 1 11:00:04 2025 -0700 drm/msm: Fix a7xx TPL1 cluster snapshot Later gens have both a PIPE_BR and PIPE_NONE section. The snapshot tool seems to expect this for x1-85 as well. I guess this was just a bug in downstream kgsl, which went unnoticed? Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/666662/ commit a814ba2d7b847cff15565bbab781df89e190619c Author: Rob Clark Date: Fri Aug 1 11:00:03 2025 -0700 drm/msm: Fix debugbus snapshot We weren't setting the # of captured debugbus blocks. Reported-by: Connor Abbott Suggested-by: Connor Abbott Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/666660/ commit 13ed0a1af263b56a5ebbf38ab7163cbc9dcb009e Author: Rob Clark Date: Fri Aug 1 11:00:02 2025 -0700 drm/msm: Fix a7xx debugbus read The bitfield positions changed in a7xx. v2: Don't open-code the bitfield building v3: Also fix cx_debugbus Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/666659/ commit 2f2cc939ad672361ca81fcb27d76dc8154b17a1c Author: Rob Clark Date: Fri Aug 1 11:00:01 2025 -0700 drm/msm: Constify snapshot tables A bit of divergence from the downstream driver from which these headers were imported. But no need for these tables not to be const. Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/666656/ commit a506578d8909e7e6f0d545af9850ccd4318bf6cf Author: Rob Clark Date: Fri Aug 1 11:00:00 2025 -0700 drm/msm: Fix order of selector programming in cluster snapshot Program the selector _after_ selecting the aperture. This aligns with the downstream driver, and fixes a case where we were failing to capture ctx0 regs (and presumably what we thought were ctx1 regs were actually ctx0). Suggested-by: Akhil P Oommen Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/666655/ commit 9466b45c19f6646787d6249116e52a9c4382e6ad Author: Rob Clark Date: Fri Aug 1 10:59:59 2025 -0700 drm/msm: Fix section names and sizes The section names randomly appended _DATA or _ADDR in many cases, and/or didn't match the reg names. Fix them so crashdec can properly resolve the section names back to reg names. Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/666654/ commit 4a00bf1fd5add1e0da37009cba5b5ffb4de255d9 Author: Rob Clark Date: Fri Aug 1 10:59:58 2025 -0700 drm/msm: Add missing "location"s to devcoredump This is needed to properly interpret some of the sections. v2: Fix missing \n Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/666651/ commit d02d50cb062737f2b0c689fa24ef8b86f14756e5 Author: Colin Ian King Date: Wed Jul 30 15:29:05 2025 +0100 drm/msm: Fix dereference of pointer minor before null check Currently the pointer minor is being dereferenced before it is null checked, leading to a potential null pointer dereference issue. Fix this by dereferencing the pointer only after it has been null checked. Also Replace minor->dev with dev. Fixes: 4f89cf40d01e ("drm/msm: bail out late_init_minor() if it is not a GPU device") Signed-off-by: Colin Ian King Reviewed-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/666259/ Signed-off-by: Rob Clark commit 08c5b422807435cdb79bee60da84262102e5f26a Author: Rob Clark Date: Wed Jul 23 13:28:23 2025 -0700 drm/msm: Defer fd_install in VM_BIND ioctl Avoid fd_install() until there are no more potential error paths, to avoid put_unused_fd() after the fd is made visible to userspace. Fixes: 2e6a8a1fe2b2 ("drm/msm: Add VM_BIND ioctl") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/665365/ commit 0e260fc798bfef6b0dd24627afa01879f901e23e Merge: 1b30d444172781 5e2ac8e8571df5 Author: Alexei Starovoitov Date: Thu Aug 7 09:01:41 2025 -0700 Merge branch 'perf-s390-regression-move-uid-filtering-to-bpf-filters' Ilya Leoshkevich says: ==================== perf/s390: Regression: Move uid filtering to BPF filters v4: https://lore.kernel.org/bpf/20250806114227.14617-1-iii@linux.ibm.com/ v4 -> v5: Fix a typo in the commit message (Yonghong). v3: https://lore.kernel.org/bpf/20250805130346.1225535-1-iii@linux.ibm.com/ v3 -> v4: Rename the new field to dont_enable (Alexei, Eduard). Switch the Fixes: tag in patch 2 (Alexander, Thomas). Fix typos in the cover letter (Thomas). v2: https://lore.kernel.org/bpf/20250728144340.711196-1-tmricht@linux.ibm.com/ v2 -> v3: Use no_ioctl_enable in perf. v1: https://lore.kernel.org/bpf/20250725093405.3629253-1-tmricht@linux.ibm.com/ v1 -> v2: Introduce no_ioctl_enable (Jiri). Hi, This series fixes a regression caused by moving UID filtering to BPF. The regression affects all events that support auxiliary data, most notably, "cycles" events on s390, but also PT events on Intel. The symptom is missing events when UID filtering is enabled. Patch 1 introduces a new option for the bpf_program__attach_perf_event_opts() function. Patch 2 makes use of it in perf, and also contains a lot of technical details of why exactly the problem is occurring. Thanks to Thomas Richter for the investigation and the initial version of this fix, and to Jiri Olsa for suggestions. Best regards, Ilya ==================== Link: https://patch.msgid.link/20250806162417.19666-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 5e2ac8e8571df54d0a9c9d08f287e006269a6674 Author: Ilya Leoshkevich Date: Wed Aug 6 18:22:42 2025 +0200 perf bpf-filter: Enable events manually On s390, and, in general, on all platforms where the respective event supports auxiliary data gathering, the command: # ./perf record -u 0 -aB --synth=no -- ./perf test -w thloop [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.011 MB perf.data ] # ./perf report --stats | grep SAMPLE # does not generate samples in the perf.data file. On x86 the command: # sudo perf record -e intel_pt// -u 0 ls is broken too. Looking at the sequence of calls in 'perf record' reveals this behavior: 1. The event 'cycles' is created and enabled: record__open() +-> evlist__apply_filters() +-> perf_bpf_filter__prepare() +-> bpf_program.attach_perf_event() +-> bpf_program.attach_perf_event_opts() +-> __GI___ioctl(..., PERF_EVENT_IOC_ENABLE, ...) The event 'cycles' is enabled and active now. However the event's ring-buffer to store the samples generated by hardware is not allocated yet. 2. The event's fd is mmap()ed to create the ring buffer: record__open() +-> record__mmap() +-> record__mmap_evlist() +-> evlist__mmap_ex() +-> perf_evlist__mmap_ops() +-> mmap_per_cpu() +-> mmap_per_evsel() +-> mmap__mmap() +-> perf_mmap__mmap() +-> mmap() This allocates the ring buffer for the event 'cycles'. With mmap() the kernel creates the ring buffer: perf_mmap(): kernel function to create the event's ring | buffer to save the sampled data. | +-> ring_buffer_attach(): Allocates memory for ring buffer. | The PMU has auxiliary data setup function. The | has_aux(event) condition is true and the PMU's | stop() is called to stop sampling. It is not | restarted: | | if (has_aux(event)) | perf_event_stop(event, 0); | +-> cpumsf_pmu_stop(): Hardware sampling is stopped. No samples are generated and saved anymore. 3. After the event 'cycles' has been mapped, the event is enabled a second time in: __cmd_record() +-> evlist__enable() +-> __evlist__enable() +-> evsel__enable_cpu() +-> perf_evsel__enable_cpu() +-> perf_evsel__run_ioctl() +-> perf_evsel__ioctl() +-> __GI___ioctl(., PERF_EVENT_IOC_ENABLE, .) The second ioctl(fd, PERF_EVENT_IOC_ENABLE, 0); is just a NOP in this case. The first invocation in (1.) sets the event::state to PERF_EVENT_STATE_ACTIVE. The kernel functions perf_ioctl() +-> _perf_ioctl() +-> _perf_event_enable() +-> __perf_event_enable() return immediately because event::state is already set to PERF_EVENT_STATE_ACTIVE. This happens on s390, because the event 'cycles' offers the possibility to save auxilary data. The PMU callbacks setup_aux() and free_aux() are defined. Without both callback functions, cpumsf_pmu_stop() is not invoked and sampling continues. To remedy this, remove the first invocation of ioctl(..., PERF_EVENT_IOC_ENABLE, ...). in step (1.) Create the event in step (1.) and enable it in step (3.) after the ring buffer has been mapped. Output after: # ./perf record -aB --synth=no -u 0 -- ./perf test -w thloop 2 [ perf record: Woken up 3 times to write data ] [ perf record: Captured and wrote 0.876 MB perf.data ] # ./perf report --stats | grep SAMPLE SAMPLE events: 16200 (99.5%) SAMPLE events: 16200 # The software event succeeded both before and after the patch: # ./perf record -e cpu-clock -aB --synth=no -u 0 -- \ ./perf test -w thloop 2 [ perf record: Woken up 7 times to write data ] [ perf record: Captured and wrote 2.870 MB perf.data ] # ./perf report --stats | grep SAMPLE SAMPLE events: 53506 (99.8%) SAMPLE events: 53506 # Fixes: b4c658d4d63d61 ("perf target: Remove uid from target") Suggested-by: Jiri Olsa Tested-by: Thomas Richter Acked-by: Namhyung Kim Co-developed-by: Thomas Richter Signed-off-by: Thomas Richter Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250806162417.19666-3-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 9474e27a24a41e55d0ac2b77d8171fddec7dbb87 Author: Ilya Leoshkevich Date: Wed Aug 6 18:22:41 2025 +0200 libbpf: Add the ability to suppress perf event enablement Automatically enabling a perf event after attaching a BPF prog to it is not always desirable. Add a new "dont_enable" field to struct bpf_perf_event_opts. While introducing "enable" instead would be nicer in that it would avoid a double negation in the implementation, it would make DECLARE_LIBBPF_OPTS() less efficient. Acked-by: Eduard Zingerman Suggested-by: Jiri Olsa Tested-by: Thomas Richter Co-developed-by: Thomas Richter Signed-off-by: Thomas Richter Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250806162417.19666-2-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 7b632596188e1973c6b3ac1c9f8252f735e1039f Author: Boris Burkov Date: Wed Jul 30 09:29:23 2025 -0700 btrfs: fix iteration bug in __qgroup_excl_accounting() __qgroup_excl_accounting() uses the qgroup iterator machinery to update the account of one qgroups usage for all its parent hierarchy, when we either add or remove a relation and have only exclusive usage. However, there is a small bug there: we loop with an extra iteration temporary qgroup called `cur` but never actually refer to that in the body of the loop. As a result, we redundantly account the same usage to the first qgroup in the list. This can be reproduced in the following way: mkfs.btrfs -f -O squota mount btrfs subvol create /sv dd if=/dev/zero of=/sv/f bs=1M count=1 sync btrfs qgroup create 1/100 btrfs qgroup create 2/200 btrfs qgroup assign 1/100 2/200 btrfs qgroup assign 0/256 1/100 btrfs qgroup show and the broken result is (note the 2MiB on 1/100 and 0Mib on 2/100): Qgroupid Referenced Exclusive Path -------- ---------- --------- ---- 0/5 16.00KiB 16.00KiB 0/256 1.02MiB 1.02MiB sv Qgroupid Referenced Exclusive Path -------- ---------- --------- ---- 0/5 16.00KiB 16.00KiB 0/256 1.02MiB 1.02MiB sv 1/100 2.03MiB 2.03MiB 2/100<1 member qgroup> 2/100 0.00B 0.00B <0 member qgroups> With this fix, which simply re-uses `qgroup` as the iteration variable, we see the expected result: Qgroupid Referenced Exclusive Path -------- ---------- --------- ---- 0/5 16.00KiB 16.00KiB 0/256 1.02MiB 1.02MiB sv Qgroupid Referenced Exclusive Path -------- ---------- --------- ---- 0/5 16.00KiB 16.00KiB 0/256 1.02MiB 1.02MiB sv 1/100 1.02MiB 1.02MiB 2/100<1 member qgroup> 2/100 1.02MiB 1.02MiB <0 member qgroups> The existing fstests did not exercise two layer inheritance so this bug was missed. I intend to add that testing there, as well. Fixes: a0bdc04b0732 ("btrfs: qgroup: use qgroup_iterator in __qgroup_excl_accounting()") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 3a931e9b39c7ff8066657042f5f00d3b7e6ad315 Author: Naohiro Aota Date: Wed Jul 16 16:59:52 2025 +0900 btrfs: zoned: do not select metadata BG as finish target We call btrfs_zone_finish_one_bg() to zone finish one block group and make room to activate another block group. Currently, we can choose a metadata block group as a target. But, as we reserve an active metadata block group, we no longer want to select a metadata block group. So, skip it in the loop. CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Damien Le Moal Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4289b494ac553e74e86fed1c66b2bf9530bc1082 Author: Qu Wenruo Date: Fri Jul 25 20:33:25 2025 +0930 btrfs: do not allow relocation of partially dropped subvolumes [BUG] There is an internal report that balance triggered transaction abort, with the following call trace: item 85 key (594509824 169 0) itemoff 12599 itemsize 33 extent refs 1 gen 197740 flags 2 ref#0: tree block backref root 7 item 86 key (594558976 169 0) itemoff 12566 itemsize 33 extent refs 1 gen 197522 flags 2 ref#0: tree block backref root 7 ... BTRFS error (device loop0): extent item not found for insert, bytenr 594526208 num_bytes 16384 parent 449921024 root_objectid 934 owner 1 offset 0 BTRFS error (device loop0): failed to run delayed ref for logical 594526208 num_bytes 16384 type 182 action 1 ref_mod 1: -117 ------------[ cut here ]------------ BTRFS: Transaction aborted (error -117) WARNING: CPU: 1 PID: 6963 at ../fs/btrfs/extent-tree.c:2168 btrfs_run_delayed_refs+0xfa/0x110 [btrfs] And btrfs check doesn't report anything wrong related to the extent tree. [CAUSE] The cause is a little complex, firstly the extent tree indeed doesn't have the backref for 594526208. The extent tree only have the following two backrefs around that bytenr on-disk: item 65 key (594509824 METADATA_ITEM 0) itemoff 13880 itemsize 33 refs 1 gen 197740 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE item 66 key (594558976 METADATA_ITEM 0) itemoff 13847 itemsize 33 refs 1 gen 197522 flags TREE_BLOCK tree block skinny level 0 (176 0x7) tree block backref root CSUM_TREE But the such missing backref item is not an corruption on disk, as the offending delayed ref belongs to subvolume 934, and that subvolume is being dropped: item 0 key (934 ROOT_ITEM 198229) itemoff 15844 itemsize 439 generation 198229 root_dirid 256 bytenr 10741039104 byte_limit 0 bytes_used 345571328 last_snapshot 198229 flags 0x1000000000001(RDONLY) refs 0 drop_progress key (206324 EXTENT_DATA 2711650304) drop_level 2 level 2 generation_v2 198229 And that offending tree block 594526208 is inside the dropped range of that subvolume. That explains why there is no backref item for that bytenr and why btrfs check is not reporting anything wrong. But this also shows another problem, as btrfs will do all the orphan subvolume cleanup at a read-write mount. So half-dropped subvolume should not exist after an RW mount, and balance itself is also exclusive to subvolume cleanup, meaning we shouldn't hit a subvolume half-dropped during relocation. The root cause is, there is no orphan item for this subvolume. In fact there are 5 subvolumes from around 2021 that have the same problem. It looks like the original report has some older kernels running, and caused those zombie subvolumes. Thankfully upstream commit 8d488a8c7ba2 ("btrfs: fix subvolume/snapshot deletion not triggered on mount") has long fixed the bug. [ENHANCEMENT] For repairing such old fs, btrfs-progs will be enhanced. Considering how delayed the problem will show up (at run delayed ref time) and at that time we have to abort transaction already, it is too late. Instead here we reject any half-dropped subvolume for reloc tree at the earliest time, preventing confusion and extra time wasted on debugging similar bugs. CC: stable@vger.kernel.org # 5.15+ Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit fc5799986fbca957e2e3c0480027f249951b7bcf Author: Filipe Manana Date: Wed Jul 16 11:41:21 2025 +0100 btrfs: error on missing block group when unaccounting log tree extent buffers Currently we only log an error message if we can't find the block group for a log tree extent buffer when unaccounting it (while freeing a log tree). A missing block group means something is seriously wrong and we end up leaking space from the metadata space info. So return -ENOENT in case we don't find the block group. CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit deaf895212da74635a7f0a420e1ecf8f5eca1fe5 Author: Qu Wenruo Date: Sun Jul 20 15:01:39 2025 +0930 btrfs: fix wrong length parameter for btrfs_cleanup_ordered_extents() Inside nocow_one_range(), if the checksum cloning for data reloc inode failed, we call btrfs_cleanup_ordered_extents() to cleanup the just allocated ordered extents. But unlike extent_clear_unlock_delalloc(), btrfs_cleanup_ordered_extents() requires a length, not an inclusive end bytenr. This can be problematic, as the @end is normally way larger than @len. This means btrfs_cleanup_ordered_extents() can be called on folios out of the correct range, and if the out-of-range folio is under writeback, we can incorrectly clear the ordered flag of the folio, and trigger the DEBUG_WARN() inside btrfs_writepage_cow_fixup(). Fix the wrong parameter with correct length instead. Fixes: 94f6c5c17e52 ("btrfs: move ordered extent cleanup to where they are allocated") CC: stable@vger.kernel.org # 6.15+ Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 15fc0bec883c95007a4901fe75f247bd0ca21651 Author: Qu Wenruo Date: Sun Jul 20 07:56:48 2025 +0930 btrfs: make btrfs_cleanup_ordered_extents() support large folios When hitting a large folio, btrfs_cleanup_ordered_extents() will get the same large folio multiple times, and clearing the same range again and again. Thankfully this is not causing anything wrong, just inefficiency. This is caused by the fact that we're iterating folios using the old page index, thus can hit the same large folio again and again. Enhance it by increasing @index to the index of the folio end, and only increase @index by 1 if we failed to grab a folio. Reviewed-by: Boris Burkov Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit ad580dfa388fabb52af033e3f8cc5d04be985e54 Author: Leo Martins Date: Mon Jul 21 10:49:16 2025 -0700 btrfs: fix subpage deadlock in try_release_subpage_extent_buffer() There is a potential deadlock that can happen in try_release_subpage_extent_buffer() because the irq-safe xarray spin lock fs_info->buffer_tree is being acquired before the irq-unsafe eb->refs_lock. This leads to the potential race: // T1 (random eb->refs user) // T2 (release folio) spin_lock(&eb->refs_lock); // interrupt end_bbio_meta_write() btrfs_meta_folio_clear_writeback() btree_release_folio() folio_test_writeback() //false try_release_extent_buffer() try_release_subpage_extent_buffer() xa_lock_irq(&fs_info->buffer_tree) spin_lock(&eb->refs_lock); // blocked; held by T1 buffer_tree_clear_mark() xas_lock_irqsave() // blocked; held by T2 I believe that the spin lock can safely be replaced by an rcu_read_lock. The xa_for_each loop does not need the spin lock as it's already internally protected by the rcu_read_lock. The extent buffer is also protected by the rcu_read_lock so it won't be freed before we take the eb->refs_lock and check the ref count. The rcu_read_lock is taken and released every iteration, just like the spin lock, which means we're not protected against concurrent insertions into the xarray. This is fine because we rely on folio->private to detect if there are any ebs remaining in the folio. There is already some precedent for this with find_extent_buffer_nolock, which loads an extent buffer from the xarray with only rcu_read_lock. lockdep warning: ===================================================== WARNING: HARDIRQ-safe -> HARDIRQ-unsafe lock order detected 6.16.0-0_fbk701_debug_rc0_123_g4c06e63b9203 #1 Tainted: G E N ----------------------------------------------------- kswapd0/66 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: ffff000011ffd600 (&eb->refs_lock){+.+.}-{3:3}, at: try_release_extent_buffer+0x18c/0x560 and this task is already holding: ffff0000c1d91b88 (&buffer_xa_class){-.-.}-{3:3}, at: try_release_extent_buffer+0x13c/0x560 which would create a new lock dependency: (&buffer_xa_class){-.-.}-{3:3} -> (&eb->refs_lock){+.+.}-{3:3} but this new dependency connects a HARDIRQ-irq-safe lock: (&buffer_xa_class){-.-.}-{3:3} ... which became HARDIRQ-irq-safe at: lock_acquire+0x178/0x358 _raw_spin_lock_irqsave+0x60/0x88 buffer_tree_clear_mark+0xc4/0x160 end_bbio_meta_write+0x238/0x398 btrfs_bio_end_io+0x1f8/0x330 btrfs_orig_write_end_io+0x1c4/0x2c0 bio_endio+0x63c/0x678 blk_update_request+0x1c4/0xa00 blk_mq_end_request+0x54/0x88 virtblk_request_done+0x124/0x1d0 blk_mq_complete_request+0x84/0xa0 virtblk_done+0x130/0x238 vring_interrupt+0x130/0x288 __handle_irq_event_percpu+0x1e8/0x708 handle_irq_event+0x98/0x1b0 handle_fasteoi_irq+0x264/0x7c0 generic_handle_domain_irq+0xa4/0x108 gic_handle_irq+0x7c/0x1a0 do_interrupt_handler+0xe4/0x148 el1_interrupt+0x30/0x50 el1h_64_irq_handler+0x14/0x20 el1h_64_irq+0x6c/0x70 _raw_spin_unlock_irq+0x38/0x70 __run_timer_base+0xdc/0x5e0 run_timer_softirq+0xa0/0x138 handle_softirqs.llvm.13542289750107964195+0x32c/0xbd0 ____do_softirq.llvm.17674514681856217165+0x18/0x28 call_on_irq_stack+0x24/0x30 __irq_exit_rcu+0x164/0x430 irq_exit_rcu+0x18/0x88 el1_interrupt+0x34/0x50 el1h_64_irq_handler+0x14/0x20 el1h_64_irq+0x6c/0x70 arch_local_irq_enable+0x4/0x8 do_idle+0x1a0/0x3b8 cpu_startup_entry+0x60/0x80 rest_init+0x204/0x228 start_kernel+0x394/0x3f0 __primary_switched+0x8c/0x8958 to a HARDIRQ-irq-unsafe lock: (&eb->refs_lock){+.+.}-{3:3} ... which became HARDIRQ-irq-unsafe at: ... lock_acquire+0x178/0x358 _raw_spin_lock+0x4c/0x68 free_extent_buffer_stale+0x2c/0x170 btrfs_read_sys_array+0x1b0/0x338 open_ctree+0xeb0/0x1df8 btrfs_get_tree+0xb60/0x1110 vfs_get_tree+0x8c/0x250 fc_mount+0x20/0x98 btrfs_get_tree+0x4a4/0x1110 vfs_get_tree+0x8c/0x250 do_new_mount+0x1e0/0x6c0 path_mount+0x4ec/0xa58 __arm64_sys_mount+0x370/0x490 invoke_syscall+0x6c/0x208 el0_svc_common+0x14c/0x1b8 do_el0_svc+0x4c/0x60 el0_svc+0x4c/0x160 el0t_64_sync_handler+0x70/0x100 el0t_64_sync+0x168/0x170 other info that might help us debug this: Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&eb->refs_lock); local_irq_disable(); lock(&buffer_xa_class); lock(&eb->refs_lock); lock(&buffer_xa_class); *** DEADLOCK *** 2 locks held by kswapd0/66: #0: ffff800085506e40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat+0xe8/0xe50 #1: ffff0000c1d91b88 (&buffer_xa_class){-.-.}-{3:3}, at: try_release_extent_buffer+0x13c/0x560 Link: https://www.kernel.org/doc/Documentation/locking/lockdep-design.rst#:~:text=Multi%2Dlock%20dependency%20rules%3A Fixes: 19d7f65f032f ("btrfs: convert the buffer_radix to an xarray") CC: stable@vger.kernel.org # 6.16+ Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Leo Martins Signed-off-by: David Sterba commit ae633388cae349886f1a3cfb27aa092854b24c1b Author: Eric Dumazet Date: Thu Aug 7 14:21:46 2025 +0000 pptp: fix pptp_xmit() error path I accidentally added a bug in pptp_xmit() that syzbot caught for us. Only call ip_rt_put() if a route has been allocated. BUG: unable to handle page fault for address: ffffffffffffffdb PGD df3b067 P4D df3b067 PUD df3d067 PMD 0 Oops: Oops: 0002 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 6346 Comm: syz.0.336 Not tainted 6.16.0-next-20250804-syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:arch_atomic_add_return arch/x86/include/asm/atomic.h:85 [inline] RIP: 0010:raw_atomic_sub_return_release include/linux/atomic/atomic-arch-fallback.h:846 [inline] RIP: 0010:atomic_sub_return_release include/linux/atomic/atomic-instrumented.h:327 [inline] RIP: 0010:__rcuref_put include/linux/rcuref.h:109 [inline] RIP: 0010:rcuref_put+0x172/0x210 include/linux/rcuref.h:173 Call Trace: dst_release+0x24/0x1b0 net/core/dst.c:167 ip_rt_put include/net/route.h:285 [inline] pptp_xmit+0x14b/0x1a90 drivers/net/ppp/pptp.c:267 __ppp_channel_push+0xf2/0x1c0 drivers/net/ppp/ppp_generic.c:2166 ppp_channel_push+0x123/0x660 drivers/net/ppp/ppp_generic.c:2198 ppp_write+0x2b0/0x400 drivers/net/ppp/ppp_generic.c:544 vfs_write+0x27b/0xb30 fs/read_write.c:684 ksys_write+0x145/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes: de9c4861fb42 ("pptp: ensure minimal skb length in pptp_xmit()") Reported-by: syzbot+27d7cfbc93457e472e00@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/689095a5.050a0220.1fc43d.0009.GAE@google.com/ Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250807142146.2877060-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 13d0fe84a214658254a7412b2b46ec1507dc51f0 Author: Gabor Juhos Date: Tue Aug 5 18:05:42 2025 +0200 spi: spi-qpic-snand: fix calculating of ECC OOB regions' properties The OOB layout used by the driver has two distinct regions which contains hardware specific ECC data, yet the qcom_spi_ooblayout_ecc() function sets the same offset and length values for both regions which is clearly wrong. Change the code to calculate the correct values for both regions. For reference, the following table shows the computed offset and length values for various OOB size/ECC strength configurations: +-----------------+-----------------+ |before the change| after the change| +-------+----------+--------+--------+--------+--------+--------+ | OOB | ECC | region | region | region | region | region | | size | strength | index | offset | length | offset | length | +-------+----------+--------+--------+--------+--------+--------+ | 128 | 8 | 0 | 113 | 15 | 0 | 49 | | | | 1 | 113 | 15 | 65 | 63 | +-------+----------+--------+--------+--------+--------+--------+ | 128 | 4 | 0 | 117 | 11 | 0 | 37 | | | | 1 | 117 | 11 | 53 | 75 | +-------+----------+--------+--------+--------+--------+--------+ | 64 | 4 | 0 | 53 | 11 | 0 | 37 | | | | 1 | 53 | 11 | 53 | 11 | +-------+----------+--------+--------+--------+--------+--------+ Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface") Signed-off-by: Gabor Juhos Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20250805-qpic-snand-oob-ecc-fix-v2-1-e6f811c70d6f@gmail.com Signed-off-by: Mark Brown commit af357a6a3b7d685e7aa621c6fb1d4ed6c349ec9e Author: Stefan Wahren Date: Thu Aug 7 12:07:42 2025 +0200 spi: spi-fsl-lpspi: Clamp too high speed_hz Currently the driver is not able to handle the case that a SPI device specifies a higher spi-max-frequency than half of per-clk: per-clk should be at least two times of transfer speed Fix this by clamping to the max possible value and use the minimum SCK period of 2 cycles. Fixes: 77736a98b859 ("spi: lpspi: add the error info of transfer speed setting") Signed-off-by: Stefan Wahren Link: https://patch.msgid.link/20250807100742.9917-1-wahrenst@gmx.net Signed-off-by: Mark Brown commit 45fa9f97e65231a9fd4f9429489cb74c10ccd0fd Author: Yu Kuai Date: Thu Aug 7 11:24:13 2025 +0800 lib/sbitmap: make sbitmap_get_shallow() internal Because it's only used in sbitmap.c Signed-off-by: Yu Kuai Reviewed-by: Damien Le Moal Reviewed-by: Jan Kara Reviewed-by: Bart Van Assche Link: https://lore.kernel.org/r/20250807032413.1469456-3-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 42e6c6ce03fd3e41e39a0f93f9b1a1d9fa664338 Author: Yu Kuai Date: Thu Aug 7 11:24:12 2025 +0800 lib/sbitmap: convert shallow_depth from one word to the whole sbitmap Currently elevators will record internal 'async_depth' to throttle asynchronous requests, and they both calculate shallow_dpeth based on sb->shift, with the respect that sb->shift is the available tags in one word. However, sb->shift is not the availbale tags in the last word, see __map_depth: if (index == sb->map_nr - 1) return sb->depth - (index << sb->shift); For consequence, if the last word is used, more tags can be get than expected, for example, assume nr_requests=256 and there are four words, in the worst case if user set nr_requests=32, then the first word is the last word, and still use bits per word, which is 64, to calculate async_depth is wrong. One the ohter hand, due to cgroup qos, bfq can allow only one request to be allocated, and set shallow_dpeth=1 will still allow the number of words request to be allocated. Fix this problems by using shallow_depth to the whole sbitmap instead of per word, also change kyber, mq-deadline and bfq to follow this, a new helper __map_depth_with_shallow() is introduced to calculate available bits in each word. Signed-off-by: Yu Kuai Link: https://lore.kernel.org/r/20250807032413.1469456-2-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 80f21806b8e34ae1e24c0fc6a0f0dfd9b055e130 Author: Mohamed Khalfella Date: Wed Aug 6 22:35:07 2025 -0700 nvmet: exit debugfs after discovery subsystem exits Commit 528589947c180 ("nvmet: initialize discovery subsys after debugfs is initialized") changed nvmet_init() to initialize nvme discovery after "nvmet" debugfs directory is initialized. The change broke nvmet_exit() because discovery subsystem now depends on debugfs. Debugfs should be destroyed after discovery subsystem. Fix nvmet_exit() to do that. Reported-by: Yi Zhang Closes: https://lore.kernel.org/all/CAHj4cs96AfFQpyDKF_MdfJsnOEo=2V7dQgqjFv+k3t7H-=yGhA@mail.gmail.com/ Fixes: 528589947c180 ("nvmet: initialize discovery subsys after debugfs is initialized") Signed-off-by: Mohamed Khalfella Reviewed-by: Hannes Reinecke Reviewed-by: Daniel Wagner Link: https://lore.kernel.org/r/20250807053507.2794335-1-mkhalfella@purestorage.com Signed-off-by: Jens Axboe commit 1dee968d22eaeb3eede70df513ab3f8dd1712e3e Author: Pablo Neira Ayuso Date: Thu Aug 7 12:02:42 2025 +0200 netfilter: nft_socket: remove WARN_ON_ONCE with huge level value syzbot managed to reach this WARN_ON_ONCE by passing a huge level value, remove it. WARNING: CPU: 0 PID: 5853 at net/netfilter/nft_socket.c:220 nft_socket_init+0x2f4/0x3d0 net/netfilter/nft_socket.c:220 Reported-by: syzbot+a225fea35d7baf8dbdc3@syzkaller.appspotmail.com Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit f54186df806fb1e9cb262d553f4ff942f9467cf1 Author: Dan Carpenter Date: Mon Aug 4 13:35:15 2025 +0300 netfilter: conntrack: clean up returns in nf_conntrack_log_invalid_sysctl() Smatch complains that these look like error paths with missing error codes, especially the one where we return if nf_log_is_registered() is true: net/netfilter/nf_conntrack_standalone.c:575 nf_conntrack_log_invalid_sysctl() warn: missing error code? 'ret' In fact, all these return zero deliberately. Change them to return a literal instead which helps readability as well as silencing the warning. Fixes: e89a68046687 ("netfilter: load nf_log_syslog on enabling nf_conntrack_log_invalid") Signed-off-by: Dan Carpenter Acked-by: Lance Yang Signed-off-by: Pablo Neira Ayuso commit c8a7c2c608180f3b4e51dc958b3861242dcdd76d Author: Florian Westphal Date: Mon Aug 4 12:10:41 2025 +0200 netfilter: nft_set_pipapo: don't return bogus extension pointer Dan Carpenter says: Commit 17a20e09f086 ("netfilter: nft_set: remove one argument from lookup and update functions") [..] leads to the following Smatch static checker warning: net/netfilter/nft_set_pipapo_avx2.c:1269 nft_pipapo_avx2_lookup() error: uninitialized symbol 'ext'. Fix this by initing ext to NULL and set it only once we've found a match. Fixes: 17a20e09f086 ("netfilter: nft_set: remove one argument from lookup and update functions") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/netfilter-devel/aJBzc3V5wk-yPOnH@stanley.mountain/ Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 1492e3dcb2be3aa46d1963da96aa9593e4e4db5a Author: Florian Westphal Date: Fri Aug 1 17:25:09 2025 +0200 netfilter: ctnetlink: remove refcounting in expectation dumpers Same pattern as previous patch: do not keep the expectation object alive via refcount, only store a cookie value and then use that as the skip hint for dump resumption. AFAICS this has the same issue as the one resolved in the conntrack dumper, when we do if (!refcount_inc_not_zero(&exp->use)) to increment the refcount, there is a chance that exp == last, which causes a double-increment of the refcount and subsequent memory leak. Fixes: cf6994c2b981 ("[NETFILTER]: nf_conntrack_netlink: sync expectation dumping with conntrack table dumping") Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit de788b2e6227462b6dcd0e07474e72c089008f74 Author: Florian Westphal Date: Fri Aug 1 17:25:08 2025 +0200 netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlink_dump_table(): if (res < 0) { nf_conntrack_get(&ct->ct_general); // HERE cb->args[1] = (unsigned long)ct; ... While its very unlikely, its possible that ct == last. If this happens, then the refcount of ct was already incremented. This 2nd increment is never undone. This prevents the conntrack object from being released, which in turn keeps prevents cnet->count from dropping back to 0. This will then block the netns dismantle (or conntrack rmmod) as nf_conntrack_cleanup_net_list() will wait forever. This can be reproduced by running conntrack_resize.sh selftest in a loop. It takes ~20 minutes for me on a preemptible kernel on average before I see a runaway kworker spinning in nf_conntrack_cleanup_net_list. One fix would to change this to: if (res < 0) { if (ct != last) nf_conntrack_get(&ct->ct_general); But this reference counting isn't needed in the first place. We can just store a cookie value instead. A followup patch will do the same for ctnetlink_exp_dump_table, it looks to me as if this has the same problem and like ctnetlink_dump_table, we only need a 'skip hint', not the actual object so we can apply the same cookie strategy there as well. Fixes: d205dc40798d ("[NETFILTER]: ctnetlink: fix deadlock in table dumping") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 25a8b88f000c33a1d580c317e93e40b953dc2fa5 Author: Arnd Bergmann Date: Wed Jul 30 23:45:32 2025 +0200 netfilter: add back NETFILTER_XTABLES dependencies Some Kconfig symbols were changed to depend on the 'bool' symbol NETFILTER_XTABLES_LEGACY, which means they can now be set to built-in when the xtables code itself is in a loadable module: x86_64-linux-ld: vmlinux.o: in function `arpt_unregister_table_pre_exit': (.text+0x1831987): undefined reference to `xt_find_table' x86_64-linux-ld: vmlinux.o: in function `get_info.constprop.0': arp_tables.c:(.text+0x1831aab): undefined reference to `xt_request_find_table_lock' x86_64-linux-ld: arp_tables.c:(.text+0x1831bea): undefined reference to `xt_table_unlock' x86_64-linux-ld: vmlinux.o: in function `do_arpt_get_ctl': arp_tables.c:(.text+0x183205d): undefined reference to `xt_find_table_lock' x86_64-linux-ld: arp_tables.c:(.text+0x18320c1): undefined reference to `xt_table_unlock' x86_64-linux-ld: arp_tables.c:(.text+0x183219a): undefined reference to `xt_recseq' Change these to depend on both NETFILTER_XTABLES and NETFILTER_XTABLES_LEGACY. Fixes: 9fce66583f06 ("netfilter: Exclude LEGACY TABLES on PREEMPT_RT.") Signed-off-by: Arnd Bergmann Acked-by: Florian Westphal Tested-by: Breno Leitao Signed-off-by: Pablo Neira Ayuso commit f752adfaf5f7d796007f9c1a867b9bdccc15cc2c Author: Florian Westphal Date: Fri Jul 25 14:31:34 2025 +0200 MAINTAINERS: resurrect my netfilter maintainer entry This reverts commit b5048d27872a9734d142540ea23c3e897e47e05c. Its been more than a year, hope my motivation lasts a bit longer than last time :-) Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit d9d87d90cc0b10cd56ae353f50b11417e7d21712 Author: Bartosz Golaszewski Date: Thu Jul 17 15:21:26 2025 +0200 treewide: rename GPIO set callbacks back to their original names The conversion of all GPIO drivers to using the .set_rv() and .set_multiple_rv() callbacks from struct gpio_chip (which - unlike their predecessors - return an integer and allow the controller drivers to indicate failures to users) is now complete and the legacy ones have been removed. Rename the new callbacks back to their original names in one sweeping change. Signed-off-by: Bartosz Golaszewski commit 397a46c9aa3343e8efe6847bdaa124945bab1de4 Author: Bartosz Golaszewski Date: Fri Jul 25 09:46:50 2025 +0200 gpio: remove legacy GPIO line value setter callbacks With no more users of the legacy GPIO line value setters - .set() and .set_multiple() - we can now remove them from the kernel. Link: https://lore.kernel.org/r/20250725074651.14002-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 0074281bb6316108e0cff094bd4db78ab3eee236 Merge: 63c7bc53a35e78 6e64f4580381e3 Author: Bartosz Golaszewski Date: Thu Aug 7 09:55:19 2025 +0200 Merge commit '6e64f4580381e32c06ee146ca807c555b8f73e24' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux into gpio/for-next commit e8e4f3c242cc26de9d69bd8b3a678d1e50980abe Author: Takashi Iwai Date: Wed Aug 6 21:25:39 2025 +0200 ALSA: hda/cirrus: Restrict prompt only for CONFIG_EXPERT The split of Cirrus HD-audio codec driver may confuse users when migrating from the previous kernel configs and leave the needed drivers disabled. Although we've already set y as default, it's still safer to paper over the wrong choices. This patch marks the prompt of split CS420x and CS421x codec drivers with CONFIG_EXPERT, so that they are all enabled when the top-level CONFIG_SND_HDA_CODEC_CIRRUS is set. For users who really care about the minimalistic configuration, they can turn each driver on/off individually after setting CONFIG_EXPERT=y. This patch adds the missing help text to the top-level CONFIG_SND_HDA_CIRRUS_CODEC together with the explanation of individual choices, and corrects the help texts that don't fit well nowadays, too. Fixes: 1cb8744a36c7 ("ALSA: hda/cirrus: Split to cs420x and cs421x drivers") Link: https://lore.kernel.org/10172c80-daec-4e20-ab57-a483cf1afc02@molgen.mpg.de Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250806192541.21949-4-tiwai@suse.de commit 606fcab9aa212ba7d99a259663411d665070e317 Author: Takashi Iwai Date: Wed Aug 6 21:25:38 2025 +0200 ALSA: hda/hdmi: Restrict prompt only for CONFIG_EXPERT The split of HDMI codec driver may confuse users when migrating from the previous kernel configs and leave some drivers disabled unexpectedly. Although we've already set y to all HDMI codec drivers as default, it's still safer to paper over the wrong choices. This patch marks the prompt of each HDMI codec driver with CONFIG_EXPERT, so that they are all enabled when the top-level CONFIG_SND_HDA_CODEC_HDMI is set. For users who really care about the minimalistic configuration, they can turn each driver on/off individually after setting CONFIG_EXPERT=y. The patch also adds the missing help text to the top-level CONFIG_SND_HDA_CODEC_HDMI together with the explanation of individual choices, too. Fixes: 73cd0490819d ("ALSA: hda/hdmi: Split vendor codec drivers") Link: https://lore.kernel.org/10172c80-daec-4e20-ab57-a483cf1afc02@molgen.mpg.de Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250806192541.21949-3-tiwai@suse.de commit 6bd05db76751c872970c63be41c97172cfbec4c1 Author: Takashi Iwai Date: Wed Aug 6 21:25:37 2025 +0200 ALSA: hda/realtek: Restrict prompt only for CONFIG_EXPERT The split of Realtek HD-audio codec driver may cause confusions especially when migrating from the previous kernel configurations because it's hard to know which driver to be enabled. Although we've already set default=y for those codec drivers, it may still make people changing the stuff unnecessarily without knowing its side effect. This patch is for avoiding such pitfalls by marking the prompt of each Realtek codec driver with CONFIG_EXPERT. For "normal" users (that is, unless CONFIG_EXPERT is set), all Realtek HD-audio codecs are enabled together with CONFIG_SND_HDA_CODEC_REALTEK; this is the very same situation like the previous kernels, after all. For users who really care about the minimalistic configuration, they can turn each driver on/off individually after setting CONFIG_EXPERT=y. The patch also adds the missing help text to the top-level CONFIG_SND_HDA_CODEC_REALTEK together with the explanation of individual choices, too. Fixes: aeeb85f26c3b ("ALSA: hda: Split Realtek HD-audio codec driver") Link: https://lore.kernel.org/10172c80-daec-4e20-ab57-a483cf1afc02@molgen.mpg.de Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250806192541.21949-2-tiwai@suse.de commit 1118aaa3b35157777890fffab91d8c1da841b20b Author: Sabrina Dubroca Date: Mon Aug 4 11:26:27 2025 +0200 udp: also consider secpath when evaluating ipsec use for checksumming Commit b40c5f4fde22 ("udp: disable inner UDP checksum offloads in IPsec case") tried to fix checksumming in UFO when the packets are going through IPsec, so that we can't rely on offloads because the UDP header and payload will be encrypted. But when doing a TCP test over VXLAN going through IPsec transport mode with GSO enabled (esp4_offload module loaded), I'm seeing broken UDP checksums on the encap after successful decryption. The skbs get to udp4_ufo_fragment/__skb_udp_tunnel_segment via __dev_queue_xmit -> validate_xmit_skb -> skb_gso_segment and at this point we've already dropped the dst (unless the device sets IFF_XMIT_DST_RELEASE, which is not common), so need_ipsec is false and we proceed with checksum offload. Make need_ipsec also check the secpath, which is not dropped on this callpath. Fixes: b40c5f4fde22 ("udp: disable inner UDP checksum offloads in IPsec case") Signed-off-by: Sabrina Dubroca Signed-off-by: Steffen Klassert commit 65f079a6c446a939eefe71e6d5957d5d6365fcf9 Author: Sabrina Dubroca Date: Mon Aug 4 11:26:26 2025 +0200 xfrm: bring back device check in validate_xmit_xfrm This is partial revert of commit d53dda291bbd993a29b84d358d282076e3d01506. This change causes traffic using GSO with SW crypto running through a NIC capable of HW offload to no longer get segmented during validate_xmit_xfrm, and is unrelated to the bonding use case mentioned in the commit. Fixes: d53dda291bbd ("xfrm: Remove unneeded device check from validate_xmit_xfrm") Signed-off-by: Sabrina Dubroca Reviewed-by: Cosmin Ratiu Signed-off-by: Steffen Klassert commit 234d1eff5d4987024be9d40ac07b918a5ae8db1a Author: Sabrina Dubroca Date: Mon Aug 4 11:26:25 2025 +0200 xfrm: restore GSO for SW crypto Commit 49431af6c4ef incorrectly assumes that the GSO path is only used by HW offload, but it's also useful for SW crypto. This patch re-enables GSO for SW crypto. It's not an exact revert to preserve the other changes made to xfrm_dev_offload_ok afterwards, but it reverts all of its effects. Fixes: 49431af6c4ef ("xfrm: rely on XFRM offload") Signed-off-by: Sabrina Dubroca Reviewed-by: Leon Romanovsky Reviewed-by: Zhu Yanjun Signed-off-by: Steffen Klassert commit 6e64f4580381e32c06ee146ca807c555b8f73e24 Merge: d244f9bb591eb9 ab93e0dd72c37d Author: Linus Torvalds Date: Thu Aug 7 07:40:01 2025 +0300 Merge tag 'input-for-v6.17-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull input updates from Dmitry Torokhov: - updates to several drivers consuming GPIO APIs to use setters returning error codes - an infrastructure allowing to define "overlays" for touchscreens carving out regions implementing buttons and other elements from a bigger sensors and a corresponding update to st1232 driver - an update to AT/PS2 keyboard driver to map F13-F24 by default - Samsung keypad driver got a facelift - evdev input handler will now bind to all devices using EV_SYN event instead of abusing id->driver_info - two new sub-drivers implementing 1A (capacitive buttons) and 21 (forcepad button) functions in Synaptics RMI driver - support for polling mode in Goodix touchscreen driver - support for support for FocalTech FT8716 in edt-ft5x06 driver - support for MT6359 in mtk-pmic-keys driver - removal of pcf50633-input driver since platform it was used on is gone - new definitions for game controller "grip" buttons (BTN_GRIP*) and corresponding changes to xpad and hid-steam controller drivers - a new definition for "performance" key * tag 'input-for-v6.17-rc0' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (38 commits) HID: hid-steam: Use new BTN_GRIP* buttons Input: add keycode for performance mode key Input: max77693 - convert to atomic pwm operation Input: st1232 - add touch-overlay handling dt-bindings: input: touchscreen: st1232: add touch-overlay example Input: touch-overlay - add touchscreen overlay handling dt-bindings: touchscreen: add touch-overlay property Input: atkbd - correctly map F13 - F24 Input: xpad - use new BTN_GRIP* buttons Input: Add and document BTN_GRIP* Input: xpad - change buttons the D-Pad gets mapped as to BTN_DPAD_* Documentation: Fix capitalization of XBox -> Xbox Input: synaptics-rmi4 - add support for F1A dt-bindings: input: syna,rmi4: Document F1A function Input: synaptics-rmi4 - add support for Forcepads (F21) Input: mtk-pmic-keys - add support for MT6359 PMIC keys Input: remove special handling of id->driver_info when matching Input: evdev - switch matching to EV_SYN Input: samsung-keypad - use BIT() and GENMASK() where appropriate Input: samsung-keypad - use per-chip parameters ... commit d244f9bb591eb914901a84c79d51975c02f81ea5 Merge: 2095cf558f65d9 ec50ec378e3fd8 Author: Linus Torvalds Date: Thu Aug 7 07:38:25 2025 +0300 Merge tag 'for-linus-6.17-1' of https://github.com/cminyard/linux-ipmi Pull ipmi updates from Corey Minyard: "Some small fixes for the IPMI driver Nothing huge, some rate limiting on logs, a strncpy fix where the source and destination could be the same, and removal of some unused cruft" * tag 'for-linus-6.17-1' of https://github.com/cminyard/linux-ipmi: ipmi: Use dev_warn_ratelimited() for incorrect message warnings char: ipmi: remove redundant variable 'type' and check ipmi: Fix strcpy source and destination the same commit 2095cf558f65d9aad9a945e4fd1077b97bf61383 Merge: e8214ed59b75fa c18646248fed07 Author: Linus Torvalds Date: Thu Aug 7 07:36:23 2025 +0300 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma fix from Jason Gunthorpe: "Single fix to correct the iov_iter construction in soft iwarp. This avoids blktest crashes with recent changes to the allocators" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages commit e8214ed59b75fa794126686370a5e47cb7da5b12 Merge: cca7a0aae8958c b1779e4f209c7f Author: Linus Torvalds Date: Thu Aug 7 07:32:50 2025 +0300 Merge tag 'vfio-v6.17-rc1-v2' of https://github.com/awilliam/linux-vfio Pull VFIO updates from Alex Williamson: - Fix imbalance where the no-iommu/cdev device path skips too much on open, failing to increment a reference, but still decrements the reference on close. Add bounds checking to prevent such underflows (Jacob Pan) - Fill missing detach_ioas op for pds_vfio_pci, fixing probe failure when used with IOMMUFD (Brett Creeley) - Split SR-IOV VFs to separate dev_set, avoiding unnecessary serialization between VFs that appear on the same bus (Alex Williamson) - Fix a theoretical integer overflow is the mlx5-vfio-pci variant driver (Artem Sadovnikov) - Implement missing VF token checking support via vfio cdev/IOMMUFD interface (Jason Gunthorpe) - Update QAT vfio-pci variant driver to claim latest VF devices (Małgorzata Mielnik) - Add a cond_resched() call to avoid holding the CPU too long during DMA mapping operations (Keith Busch) * tag 'vfio-v6.17-rc1-v2' of https://github.com/awilliam/linux-vfio: vfio/type1: conditional rescheduling while pinning vfio/qat: add support for intel QAT 6xxx virtual functions vfio/qat: Remove myself from VFIO QAT PCI driver maintainers vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD vfio/mlx5: fix possible overflow in tracking max message size vfio/pci: Separate SR-IOV VF dev_set vfio/pds: Fix missing detach_ioas op vfio: Prevent open_count decrement to negative vfio: Fix unbalanced vfio_df_close call in no-iommu mode commit 81699fe81b0be287fb28b6210324db48e8458d9f Author: Alex Deucher Date: Mon Aug 4 11:40:20 2025 -0400 drm/amdgpu: add missing vram lost check for LEGACY RESET Legacy resets reset the memory controllers so VRAM contents may be unreliable after reset. Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher (cherry picked from commit aae94897b6661a2a4b1de2d328090fc388b3e0af) Cc: stable@vger.kernel.org commit 514678da56da089b756b4d433efd964fa22b2079 Author: Alex Deucher Date: Wed Jul 30 11:16:05 2025 -0400 drm/amdgpu/discovery: fix fw based ip discovery We only need the fw based discovery table for sysfs. No need to parse it. Additionally parsing some of the board specific tables may result in incorrect data on some boards. just load the binary and don't parse it on those boards. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4441 Fixes: 80a0e8282933 ("drm/amdgpu/discovery: optionally use fw based ip discovery") Reviewed-by: Mario Limonciello (AMD) Signed-off-by: Alex Deucher (cherry picked from commit 62eedd150fa11aefc2d377fc746633fdb1baeb55) Cc: stable@vger.kernel.org commit 2e58401a24e7b2d4ec619104e1a76590c1284a4c Author: Amber Lin Date: Thu Jul 31 20:45:00 2025 -0400 drm/amdkfd: Destroy KFD debugfs after destroy KFD wq Since KFD proc content was moved to kernel debugfs, we can't destroy KFD debugfs before kfd_process_destroy_wq. Move kfd_process_destroy_wq prior to kfd_debugfs_fini to fix a kernel NULL pointer problem. It happens when /sys/kernel/debug/kfd was already destroyed in kfd_debugfs_fini but kfd_process_destroy_wq calls kfd_debugfs_remove_process. This line debugfs_remove_recursive(entry->proc_dentry); tries to remove /sys/kernel/debug/kfd/proc/ while /sys/kernel/debug/kfd is already gone. It hangs the kernel by kernel NULL pointer. Signed-off-by: Amber Lin Reviewed-by: Eric Huang Signed-off-by: Alex Deucher (cherry picked from commit 0333052d90683d88531558dcfdbf2525cc37c233) Cc: stable@vger.kernel.org commit 928587381b54b1b6c62736486b1dc6cb16c568c2 Author: Xaver Hugl Date: Fri Aug 1 00:49:51 2025 +0200 amdgpu/amdgpu_discovery: increase timeout limit for IFWI init With a timeout of only 1 second, my rx 5700XT fails to initialize, so this increases the timeout to 2s. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3697 Signed-off-by: Xaver Hugl Signed-off-by: Alex Deucher (cherry picked from commit 9ed3d7bdf2dcdf1a1196630fab89a124526e9cc2) Cc: stable@vger.kernel.org commit da274853fe7dbc7124e2dd84dad802be52a09321 Author: Waiman Long Date: Tue Jul 29 15:12:32 2025 -0400 cpu: Remove obsolete comment from takedown_cpu() takedown_cpu() has a comment about "all preempt/rcu users must observe !cpu_active()" which is kind of meaningless in this function. This comment was originally introduced by commit 6acce3ef8452 ("sched: Remove get_online_cpus() usage") when _cpu_down() was setting cpu_active_mask and synchronize_rcu()/synchronize_sched() were added after that. Later commit 40190a78f85f ("sched/hotplug: Convert cpu_[in]active notifiers to state machine") added a new CPUHP_AP_ACTIVE hotplug state to set/clear cpu_active_mask. The following commit b2454caa8977 ("sched/hotplug: Move sync_rcu to be with set_cpu_active(false)") move the synchronize_*() calls to sched_cpu_deactivate() associated with the new hotplug state, but left the comment behind. Remove this comment as it is no longer relevant in takedown_cpu(). Signed-off-by: Waiman Long Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250729191232.664931-1-longman@redhat.com commit bef82d5848dadb10c2671970fae2cc4cd2c6a123 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:53 2025 +0200 smb: client: make use of smbdirect_socket.{send,recv}_io.mem.{cache,pool} This will allow common helper functions to be created later. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5ef8278e3734a8817fb0b8d302572dc2f2f5c46c Author: Stefan Metzmacher Date: Wed Aug 6 19:35:52 2025 +0200 smb: smbdirect: add smbdirect_socket.{send,recv}_io.mem.{cache,pool} This will be the common location memory caches and pools. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 977ea06fddda493a8e16e609a408fdd08233793d Author: Stefan Metzmacher Date: Wed Aug 6 19:35:51 2025 +0200 smb: client: make use of struct smbdirect_send_io The server will also use this soon, so that we can split out common helper functions in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 92ac696be763461b575022f06bbd843aadbe9593 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:50 2025 +0200 smb: smbdirect: introduce struct smbdirect_send_io This will be used in client and server soon in order to replace smbd_request/smb_direct_sendmsg. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 8b5964a1188f659afda0c72f7c7b7c9d54aa73cc Author: Stefan Metzmacher Date: Wed Aug 6 19:35:49 2025 +0200 smb: client: make use of SMBDIRECT_RECV_IO_MAX_SGE Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 3515aa6e43077157cf6070ad2cd181b179964856 Author: Stefan Metzmacher Date: Wed Aug 6 19:35:48 2025 +0200 smb: smbdirect: add SMBDIRECT_RECV_IO_MAX_SGE This will allow the client and server specific defines to be replaced. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b126645b79547bd68fb8353ad27841b7408c08bb Author: Stefan Metzmacher Date: Wed Aug 6 19:35:47 2025 +0200 smb: client: remove unused enum smbd_connection_status Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 61b4918e4ea17f3ce14ad13e4c2757c0b6afe708 Author: Stefan Metzmacher Date: Tue Aug 5 18:11:37 2025 +0200 smb: client: make use of smbdirect_socket.recv_io.reassembly.* This will be used by the server too and will allow us to create common helper functions. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b7ffb4d2a0360043d821b612040088ae9299aa8c Author: Stefan Metzmacher Date: Tue Aug 5 18:11:36 2025 +0200 smb: smbdirect: introduce smbdirect_socket.recv_io.reassembly.* This will be used in common between client and server soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 59500450843a5af9ca4fdba0ac2808e929a47584 Author: Stefan Metzmacher Date: Tue Aug 5 18:11:35 2025 +0200 smb: client: make use of smb: smbdirect_socket.recv_io.free.{list,lock} This will be used by the server too in order to have common helper functions in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit d0df32a3025c2de47d7eb8766aaee82644a53581 Author: Stefan Metzmacher Date: Tue Aug 5 18:11:34 2025 +0200 smb: smbdirect: introduce smbdirect_socket.recv_io.free.{list,lock} This will allow the list of free smbdirect_recv_io messages including the spinlock to be in common between client and server in order to split out common helper functions in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5dddf0497445d247e995306daf3b76dd0633831c Author: Stefan Metzmacher Date: Tue Aug 5 18:11:33 2025 +0200 smb: client: make use of struct smbdirect_recv_io This is the shared structure that will be used in the server too and will allow us to move helper functions into common code soon. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 60812d20da82606f0620904c281579a9af0ab452 Author: Stefan Metzmacher Date: Tue Aug 5 18:11:32 2025 +0200 smb: smbdirect: introduce struct smbdirect_recv_io This will be used in client and server soon in order to replace smbd_response/smb_direct_recvmsg. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit bbdbd9ae47155da65aa0c1641698a44d85c2faa2 Author: Stefan Metzmacher Date: Tue Aug 5 18:11:31 2025 +0200 smb: client: make use of smbdirect_socket->recv_io.expected The expected incoming message type can be per connection. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 33dd53a90e3419ea260e9ff2b4aa107385cdf7fa Author: Stefan Metzmacher Date: Tue Aug 5 18:11:30 2025 +0200 smb: smbdirect: introduce smbdirect_socket.recv_io.expected The expected message type can be global as they never change during the after negotiation process. This will replace smbd_response->type and smb_direct_recvmsg->type in future. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: Namjae Jeon Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 0edf9fc0a34436e9f257e8508e795b2caddc74d6 Author: Stefan Metzmacher Date: Tue Aug 5 18:11:29 2025 +0200 smb: client: remove unused smbd_connection->fragment_reassembly_remaining Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 24eff17887cb45c25a427e662dda352973c5c171 Author: Stefan Metzmacher Date: Mon Aug 4 14:10:16 2025 +0200 smb: client: let recv_done() avoid touching data_transfer after cleanup/move Calling enqueue_reassembly() and wake_up_interruptible(&info->wait_reassembly_queue) or put_receive_buffer() means the response/data_transfer pointer might get re-used by another thread, which means these should be the last operations before calling return. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit bdd7afc6dca5e0ebbb75583484aa6ea9e03fbb13 Author: Stefan Metzmacher Date: Mon Aug 4 14:10:15 2025 +0200 smb: client: let recv_done() cleanup before notifying the callers. We should call put_receive_buffer() before waking up the callers. For the internal error case of response->type being unexpected, we now also call smbd_disconnect_rdma_connection() instead of not waking up the callers at all. Note that the SMBD_TRANSFER_DATA case still has problems, which will be addressed in the next commit in order to make it easier to review this one. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 047682c370b6f18fec818b57b0ed8b501bdb79f8 Author: Stefan Metzmacher Date: Mon Aug 4 14:10:14 2025 +0200 smb: client: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already In case of failures either ib_dma_map_single() might not be called yet or ib_dma_unmap_single() was already called. We should make sure put_receive_buffer() only calls ib_dma_unmap_single() if needed. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 24b6afc36db748467e853e166a385df07e443859 Author: Stefan Metzmacher Date: Mon Aug 4 14:10:13 2025 +0200 smb: client: remove separate empty_packet_queue There's no need to maintain two lists, we can just have a single list of receive buffers, which are free to use. It just added unneeded complexity and resulted in ib_dma_unmap_single() not being called from recv_done() for empty keepalive packets. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit 5349ae5e05fa37409fd48a1eb483b199c32c889b Author: Stefan Metzmacher Date: Mon Aug 4 14:10:12 2025 +0200 smb: client: let send_done() cleanup before calling smbd_disconnect_rdma_connection() We should call ib_dma_unmap_single() and mempool_free() before calling smbd_disconnect_rdma_connection(). And smbd_disconnect_rdma_connection() needs to be the last function to call as all other state might already be gone after it returns. Cc: Steve French Cc: Tom Talpey Cc: Long Li Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection") Signed-off-by: Stefan Metzmacher Signed-off-by: Steve French commit b0b73329ebeeb727913f07b5b6bb85e66e03d156 Author: Yunseong Kim Date: Wed Aug 6 13:22:12 2025 +0000 cifs: Fix null-ptr-deref by static initializing global lock A kernel panic can be triggered by reading /proc/fs/cifs/debug_dirs. The crash is a null-ptr-deref inside spin_lock(), caused by the use of the uninitialized global spinlock cifs_tcp_ses_lock. init_cifs() └── cifs_proc_init() └── // User can access /proc/fs/cifs/debug_dirs here └── cifs_debug_dirs_proc_show() └── spin_lock(&cifs_tcp_ses_lock); // Uninitialized! KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Mem abort info: ESR = 0x0000000096000005 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x05: level 1 translation fault Data abort info: ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [dfff800000000000] address between user and kernel address ranges Internal error: Oops: 0000000096000005 [#1] SMP Modules linked in: CPU: 3 UID: 0 PID: 16435 Comm: stress-ng-procf Not tainted 6.16.0-10385-g79f14b5d84c6 #37 PREEMPT Hardware name: QEMU KVM Virtual Machine, BIOS 2025.02-8ubuntu1 06/11/2025 pstate: 23400005 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : do_raw_spin_lock+0x84/0x2cc lr : _raw_spin_lock+0x24/0x34 sp : ffff8000966477e0 x29: ffff800096647860 x28: ffff800096647b88 x27: ffff0001c0c22070 x26: ffff0003eb2b60c8 x25: ffff0001c0c22018 x24: dfff800000000000 x23: ffff0000f624e000 x22: ffff0003eb2b6020 x21: ffff0000f624e768 x20: 0000000000000004 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: ffff8000804b9600 x15: ffff700012cc8f04 x14: 1ffff00012cc8f04 x13: 0000000000000004 x12: ffffffffffffffff x11: 1ffff00012cc8f00 x10: ffff80008d9af0d2 x9 : f3f3f304f1f1f1f1 x8 : 0000000000000000 x7 : 7365733c203e6469 x6 : 20656572743c2023 x5 : ffff0000e0ce0044 x4 : ffff80008a4deb6e x3 : ffff8000804b9718 x2 : 0000000000000001 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: do_raw_spin_lock+0x84/0x2cc (P) _raw_spin_lock+0x24/0x34 cifs_debug_dirs_proc_show+0x1ac/0x4c0 seq_read_iter+0x3b0/0xc28 proc_reg_read_iter+0x178/0x2a8 vfs_read+0x5f8/0x88c ksys_read+0x120/0x210 __arm64_sys_read+0x7c/0x90 invoke_syscall+0x98/0x2b8 el0_svc_common+0x130/0x23c do_el0_svc+0x48/0x58 el0_svc+0x40/0x140 el0t_64_sync_handler+0x84/0x12c el0t_64_sync+0x1ac/0x1b0 Code: aa0003f3 f9000feb f2fe7e69 f8386969 (38f86908) ---[ end trace 0000000000000000 ]--- The root cause is an initialization order problem. The lock is declared as a global variable and intended to be initialized during module startup. However, the procfs entry that uses this lock can be accessed by userspace before the spin_lock_init() call has run. This creates a race window where reading the proc file will attempt to use the lock before it is initialized, leading to the crash. For a global lock with a static lifetime, the correct and robust approach is to use compile-time initialization. Fixes: 844e5c0eb176 ("smb3 client: add way to show directory leases for improved debugging") Signed-off-by: Yunseong Kim Signed-off-by: Steve French commit a6c015b7ac2d8c5233337e5793f50d04fac17669 Author: Stefan Metzmacher Date: Mon Aug 4 14:15:53 2025 +0200 smb: server: let recv_done() avoid touching data_transfer after cleanup/move Calling enqueue_reassembly() and wake_up_interruptible(&t->wait_reassembly_queue) or put_receive_buffer() means the recvmsg/data_transfer pointer might get re-used by another thread, which means these should be the last operations before calling return. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit cfe76fdbb9729c650f3505d9cfb2f70ddda2dbdc Author: Stefan Metzmacher Date: Mon Aug 4 14:15:52 2025 +0200 smb: server: let recv_done() consistently call put_recvmsg/smb_direct_disconnect_rdma_connection We should call put_recvmsg() before smb_direct_disconnect_rdma_connection() in order to call it before waking up the callers. In all error cases we should call smb_direct_disconnect_rdma_connection() in order to avoid stale connections. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit afb4108c92898350e66b9a009692230bcdd2ac73 Author: Stefan Metzmacher Date: Mon Aug 4 14:15:51 2025 +0200 smb: server: make sure we call ib_dma_unmap_single() only if we called ib_dma_map_single already In case of failures either ib_dma_map_single() might not be called yet or ib_dma_unmap_single() was already called. We should make sure put_recvmsg() only calls ib_dma_unmap_single() if needed. Cc: Namjae Jeon Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit 01027a62b508c48c762096f347de925eedcbd008 Author: Stefan Metzmacher Date: Mon Aug 4 14:15:50 2025 +0200 smb: server: remove separate empty_recvmsg_queue There's no need to maintain two lists, we can just have a single list of receive buffers, which are free to use. Cc: Steve French Cc: Tom Talpey Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Fixes: 0626e6641f6b ("cifsd: add server handler for central processing and tranport layers") Signed-off-by: Stefan Metzmacher Acked-by: Namjae Jeon Signed-off-by: Steve French commit ed42668949c6729c235e79a7de462c9ec1e1cae6 Merge: 9f320dfb0ffc55 614d416dd8aee2 Author: Takashi Iwai Date: Wed Aug 6 20:20:25 2025 +0200 Merge tag 'asoc-fix-v6.17-merge-window' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v6.17 This is a relatively small set of fixes and device quirks that came in during the merge window, the AMD changes adding support for ACP 7.2 systems are all just adding IDs for the devices rather than any substantial code - the actual code is the same as for prior versions of the platform. commit 75f1fbc9fd409a0c232dc78871ee7df186da9d57 Author: Colin Ian King Date: Wed Jul 23 10:53:15 2025 +0100 mailbox: bcm74110: Fix spelling mistake There is a spelling mistake in the author's email address. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Justin Chen Signed-off-by: Jassi Brar commit 7fbb5a5672cce49dc0e1d54fd15621eec9d48448 Author: Jiapeng Chong Date: Fri Jul 25 15:56:10 2025 +0800 mailbox: bcm74110: remove unneeded semicolon No functional modification involved. ./drivers/mailbox/bcm74110-mailbox.c:483:2-3: Unneeded semicolon. ./drivers/mailbox/bcm74110-mailbox.c:563:2-3: Unneeded semicolon. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22936 Signed-off-by: Jiapeng Chong Signed-off-by: Jassi Brar commit ae524eb766460a9f7957bf2db0968c9cccb71d90 Author: Jammy Huang Date: Tue Jul 22 09:31:17 2025 +0800 mailbox: aspeed: add mailbox driver for AST27XX series SoC Add mailbox controller driver for AST27XX SoCs, which provides independent tx/rx mailbox between different processors. There are 4 channels for each tx/rx mailbox and each channel has an 32-byte FIFO. Signed-off-by: Jammy Huang Reviewed-by: Andrew Jeffery Signed-off-by: Jassi Brar commit 7d33dd2d0e6825d4d2a61d06ae609dce17b56a3a Author: Jammy Huang Date: Tue Jul 22 09:31:16 2025 +0800 dt-bindings: mailbox: Add ASPEED AST2700 series SoC Introduce the mailbox module for AST27XX series SoC, which is responsible for interchanging messages between asymmetric processors. Signed-off-by: Jammy Huang Reviewed-by: Krzysztof Kozlowski Reviewed-by: Andrew Jeffery Signed-off-by: Jassi Brar commit b92f05bc61e23de4f4bb83647c295a4b84047eef Author: Krzysztof Kozlowski Date: Tue Jun 3 13:57:12 2025 +0200 dt-bindings: mailbox: Drop consumers example DTS Providers DTS examples should not contain consumer nodes, because they are completely redundant, obvious (defined in common schema) and add unnecessary bloat. Drop consumer examples and unneeded node labels. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Nishanth Menon Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit cc0dce769bcedb621f2c5535c31570cd51bc0235 Author: Krzysztof Kozlowski Date: Tue Jun 3 13:57:11 2025 +0200 dt-bindings: mailbox: nvidia,tegra186-hsp: Use generic node name According to Devicetree specifications, device node names should be generic, thus Mailbox provider should be called "mailbox", not "hsp". Signed-off-by: Krzysztof Kozlowski Acked-by: Thierry Reding Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit 5682a215daae506af20d2caf3e9811ccfb24caf3 Author: Krzysztof Kozlowski Date: Tue Jun 3 13:57:10 2025 +0200 dt-bindings: mailbox: Correct example indentation DTS example in the bindings should be indented with 2- or 4-spaces, so correct a mixture of different styles to keep consistent 4-spaces. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Nishanth Menon Reviewed-by: Sven Peter Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit f869e8f7da4d73a6d0d106d6891d81937b52de12 Author: Krzysztof Kozlowski Date: Tue Jun 3 13:57:09 2025 +0200 dt-bindings: mailbox: ti,secure-proxy: Add missing reg maxItems Lists should have fixed constraint, so add missing maxItems to the "reg" property. Since minItems=maxItems, the minItems is implied by dtschema so can be dropped. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Nishanth Menon Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit b8fa5e827f2056c207f5c447e48e33af28bc1c19 Author: Krzysztof Kozlowski Date: Tue Jun 3 13:57:08 2025 +0200 dt-bindings: mailbox: amlogic,meson-gxbb-mhu: Add missing interrupts maxItems Lists should have fixed constraint, so add missing maxItems to the "interrupts" property. Since minItems=maxItems, the minItems is implied by dtschema so can be dropped. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Martin Blumenstingl Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit 9bdaf9a96d04c9c520e720ebb2211550331f15ac Author: Luca Weiss Date: Sun Jul 13 10:05:28 2025 +0200 dt-bindings: mailbox: qcom-ipcc: document the Milos Inter-Processor Communication Controller Document the Inter-Processor Communication Controller on the Milos SoC. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Signed-off-by: Jassi Brar commit 52436007b862a90348ac8efc3a89eaceb2234f53 Author: Justin Chen Date: Mon Jun 2 15:23:11 2025 -0700 mailbox: Add support for bcm74110 The bcm74110 mailbox driver is used to communicate with a co-processor for various power management and firmware related tasks. Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Tested-by: Florian Fainelli Signed-off-by: Jassi Brar commit dfa477b6e674d51f87b342f1d31d9316e44d67d3 Author: Justin Chen Date: Mon Jun 2 15:23:10 2025 -0700 dt-bindings: mailbox: Add support for bcm74110 Add devicetree YAML binding for brcmstb bcm74110 mailbox used for communicating with a co-processor. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Justin Chen Reviewed-by: Florian Fainelli Signed-off-by: Jassi Brar commit fd3a4decb4f8ff1362db16fe42fc1af77d0259c3 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:39 2025 +0200 mailbox: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) Cc: Manivannan Sadhasivam Cc: Jassi Brar Signed-off-by: Jassi Brar commit 472f8a3fccbb579cb98c1821da4cb9cbd51ee3e4 Author: Sakari Ailus Date: Wed Jun 25 11:15:01 2025 +0300 mailbox: mtk-cmdq: Switch to pm_runtime_put_autosuspend() __pm_runtime_put_autosuspend() was meant to be used by callers that needed to put the Runtime PM usage_count without marking the device's last busy timestamp. It was however seen that the Runtime PM autosuspend related functions should include that call. Thus switch the driver to use pm_runtime_put_autosuspend(). Signed-off-by: Sakari Ailus Signed-off-by: Jassi Brar commit 7b306dfa326f70114312b320d083b21fa9481e1e Author: Tom Lendacky Date: Tue Jul 29 13:41:29 2025 -0500 x86/sev: Evict cache lines during SNP memory validation An SNP cache coherency vulnerability requires a cache line eviction mitigation when validating memory after a page state change to private. The specific mitigation is to touch the first and last byte of each 4K page that is being validated. There is no need to perform the mitigation when performing a page state change to shared and rescinding validation. CPUID bit Fn8000001F_EBX[31] defines the COHERENCY_SFW_NO CPUID bit that, when set, indicates that the software mitigation for this vulnerability is not needed. Implement the mitigation and invoke it when validating memory (making it private) and the COHERENCY_SFW_NO bit is not set, indicating the SNP guest is vulnerable. Co-developed-by: Michael Roth Signed-off-by: Michael Roth Signed-off-by: Tom Lendacky Signed-off-by: Borislav Petkov (AMD) Acked-by: Thomas Gleixner commit ab93e0dd72c37d378dd936f031ffb83ff2bd87ce Merge: bcce05041b2188 4f67c41894674d Author: Dmitry Torokhov Date: Wed Aug 6 10:08:54 2025 -0700 Merge branch 'next' into for-linus Prepare input updates for 6.17 merge window. commit 4f67c41894674d351a4b4e7dd3471380b71b5bb3 Author: Vicki Pfau Date: Wed Aug 6 09:53:32 2025 -0700 HID: hid-steam: Use new BTN_GRIP* buttons Make use of the newly defined BTN_GRIP* codes instead of using BTN_TRIGGER_HAPPY* and other less suited button codes. Signed-off-by: Vicki Pfau Acked-by: Jiri Kosina Link: https://lore.kernel.org/r/20250717000143.1902875-4-vi@endrift.com Signed-off-by: Dmitry Torokhov commit 1cdd5a2626d8c9eb059c6b93a628413da833df95 Author: Steve French Date: Tue Aug 5 17:56:33 2025 -0500 cifs: Move the SMB1 transport code out of transport.c Shrink the size of cifs.ko when SMB1 is not enabled in the config by moving the SMB1 transport code to different file. Signed-off-by: David Howells cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French commit 2baf16f381decee303da406ca5a0991134260270 Author: Tigran Mkrtchyan Date: Mon Aug 4 11:33:21 2025 +0200 s390/debug: Fix typo in debug_sprintf_format_fn() comment Signed-off-by: Tigran Mkrtchyan Link: https://lore.kernel.org/r/20250804093321.434674-1-tigran.mkrtchyan@desy.de Signed-off-by: Alexander Gordeev commit e29409faec87ffd2de2ed20b6109f303f129281b Author: Mikhail Zaslonko Date: Tue Aug 5 10:41:33 2025 +0200 s390/boot: Fix startup debugging log Fix 'kernel image' end address for kaslr case. Fixes: ec6f9f7e5bbf ("s390/boot: Add startup debugging support") Reviewed-by: Alexander Gordeev Signed-off-by: Mikhail Zaslonko Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 9f7488f24c7571d349d938061e0ede7a39b65d6b Author: Thomas Gleixner Date: Wed Aug 6 16:53:18 2025 +0200 irqchip/mvebu-gicp: Use resource_size() for ioremap() 0-day reported an off by one in the ioremap() sizing: drivers/irqchip/irq-mvebu-gicp.c:240:45-48: WARNING: Suspicious code. resource_size is maybe missing with gicp -> res Convert it to resource_size(), which does the right thing. Fixes: 3c3d7dbab2c7 ("irqchip/mvebu-gicp: Clear pending interrupts on init") Reported-by: kernel test robot Signed-off-by: Thomas Gleixner Closes: https://lore.kernel.org/oe-kbuild-all/202508062150.mtFQMTXc-lkp@intel.com/ commit bee47cb026e762841f3faece47b51f985e215edb Author: Olga Kornievskaia Date: Tue Jul 29 12:40:20 2025 -0400 sunrpc: fix handling of server side tls alerts Scott Mayhew discovered a security exploit in NFS over TLS in tls_alert_recv() due to its assumption it can read data from the msg iterator's kvec.. kTLS implementation splits TLS non-data record payload between the control message buffer (which includes the type such as TLS aler or TLS cipher change) and the rest of the payload (say TLS alert's level/description) which goes into the msg payload buffer. This patch proposes to rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed msg buffer and read in the control message such as a TLS alert. Msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv. Reported-by: Scott Mayhew Fixes: 5e052dda121e ("SUNRPC: Recognize control messages in server-side TCP socket code") Suggested-by: Trond Myklebust Cc: stable@vger.kernel.org Signed-off-by: Olga Kornievskaia Signed-off-by: Chuck Lever commit cca7a0aae8958c9b1cd14116cb8b2f22ace2205e Merge: d7edcc7c9109f1 0a32e4f0025a74 Author: Linus Torvalds Date: Wed Aug 6 15:52:56 2025 +0300 Merge tag 'for-6.17-fix-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs fix from David Sterba: "A single btrfs commit. It fixes a problem that people started to hit since 6.15.3 during log replay (e.g. after a crash). The bug is old but got more likely to happen since commit 5e85262e542d ("btrfs: fix fsync of files with no hard links not persisting deletion") got backported to stable (6.15 only)" * tag 'for-6.17-fix-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: btrfs: fix log tree replay failure due to file with 0 links and extents commit d7edcc7c9109f165efcf5d767fed21578c37c46c Merge: 479058002c32b7 7038db70331761 Author: Linus Torvalds Date: Wed Aug 6 15:44:25 2025 +0300 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "This is mostly fixes and cleanups and code reworks that trickled in across the merge window and the weeks leading up. The only substantive update is the Mediatek ufs driver which accounts for the bulk of the additions" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (37 commits) scsi: libsas: Use a bool for sas_deform_port() second argument scsi: libsas: Move declarations of internal functions to sas_internal.h scsi: libsas: Make sas_get_ata_info() static scsi: libsas: Simplify sas_ata_wait_eh() scsi: libsas: Refactor dev_is_sata() scsi: sd: Make sd shutdown issue START STOP UNIT appropriately scsi: arm64: dts: mediatek: mt8195: Add UFSHCI node scsi: dt-bindings: mediatek,ufs: add MT8195 compatible and update clock nodes scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host scsi: ufs: ufs-mediatek: Add UFS host support for MT8195 SoC scsi: ufs: ufs-pci: Remove control of UIC Completion interrupt for Intel MTL scsi: ufs: core: Do not write interrupt enable register unnecessarily scsi: ufs: core: Set and clear UIC Completion interrupt as needed scsi: ufs: core: Remove duplicated code in ufshcd_send_bsg_uic_cmd() scsi: ufs: core: Move ufshcd_enable_intr() and ufshcd_disable_intr() scsi: ufs: ufs-pci: Remove UFS PCI driver's ->late_init() call back scsi: ufs: ufs-pci: Fix default runtime and system PM levels scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers scsi: ufs: host: mediatek: Support FDE (AES) clock scaling scsi: ufs: host: mediatek: Support clock scaling with Vcore binding ... commit 9f320dfb0ffc555aa2eac8331dee0c2c16f67633 Author: Takashi Iwai Date: Wed Aug 6 11:44:22 2025 +0200 ALSA: hda/ca0132: Fix missing error handling in ca0132_alt_select_out() There are a couple of cases where the error is ignored or the error code isn't propagated in ca0132_alt_select_out(). Fix those. Fixes: def3f0a5c700 ("ALSA: hda/ca0132 - Add quirk output selection structures.") Link: https://patch.msgid.link/20250806094423.8843-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a4f8e70d75dd11ab1a01894893e0b03f1d0b61fd Author: Tianyu Xu Date: Tue Aug 5 09:54:03 2025 +0800 spi: spi-mem: add spi_mem_adjust_op_freq() in spi_mem_supports_op() The function spi_mem_adjust_op_freq() within spi_mem_exec_op() adjusts the op->max_freq, which will informs the SPI controller of the maximum frequency for each operation. This adjustment is based on combined information from the SPI device and the board's wiring conditions. Similarly, spi_mem_supports_op() will check the capabilities of the SPI controller. It also requires the combined information before it can accurately determine whether the SPI controller supports a given operation. Signed-off-by: Tianyu Xu Reviewed-by: Miquel Raynal Link: https://patch.msgid.link/20250805015403.43928-1-tianyxu@cisco.com Signed-off-by: Mark Brown commit c0a8e4443d768e5c86ddb52a3a744a151e7b72b0 Author: Imre Deak Date: Tue Aug 5 20:57:52 2025 +0300 drm/radeon: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. For the fbdev case a manual drm_get_format_info() lookup is needed. The patch is based on the driver parts of the patchset at Link: below, which missed converting the radeon driver. Due to the absence of this change in the patchset at Link:, after the Fixed: commit below, radeon_framebuffer_init() -> drm_helper_mode_fill_fb_struct() set drm_framebuffer::format incorrectly to NULL, which lead to the !fb->format WARN() in drm_framebuffer_init() and causing framebuffer creation to fail. This patch fixes both of these issues. v2: Amend the commit log mentioning the functional issues the patch fixes. (Tomi) Cc: Ville Syrjälä Cc: Alex Deucher Cc: Christian König Cc: Thomas Zimmermann Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: amd-gfx@lists.freedesktop.org Cc: Tomi Valkeinen Fixes: 41ab92d35ccd ("drm: Make passing of format info to drm_helper_mode_fill_fb_struct() mandatory") Link: https://lore.kernel.org/all/20250701090722.13645-1-ville.syrjala@linux.intel.com Acked-by: Alex Deucher Tested-by: Linux Kernel Functional Testing Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250805175752.690504-4-imre.deak@intel.com commit d2b524c9064301471e8ffe4ffd85ab8870966aa4 Author: Imre Deak Date: Tue Aug 5 20:57:51 2025 +0300 drm/nouveau: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. The patch is based on the driver parts of the patchset at Link: below, which missed converting the nouveau driver. Due to the absence of this change in the patchset at Link:, after the Fixed: commit below, nouveau_framebuffer_new() -> drm_helper_mode_fill_fb_struct() set drm_framebuffer::format incorrectly to NULL, which lead to the !fb->format WARN() in drm_framebuffer_init() and causing framebuffer creation to fail. This patch fixes both of these issues. v2: Amend the commit log mentioning the functional issues the patch fixes. (Tomi) Cc: Ville Syrjälä Cc: Lyude Paul Cc: Danilo Krummrich Cc: Thomas Zimmermann Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Tomi Valkeinen Cc: nouveau@lists.freedesktop.org Fixes: 41ab92d35ccd ("drm: Make passing of format info to drm_helper_mode_fill_fb_struct() mandatory") Link: https://lore.kernel.org/all/20250701090722.13645-1-ville.syrjala@linux.intel.com Acked-by: Alex Deucher Acked-by: Danilo Krummrich Reviewed-by: James Jones Tested-by: Linux Kernel Functional Testing Tested-by: James Jones Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250805175752.690504-3-imre.deak@intel.com commit f8f6e72fe28595969829d63db93ecaa56a0c2811 Author: Imre Deak Date: Tue Aug 5 20:57:50 2025 +0300 drm/omap: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. For the fbdev case a manual drm_get_format_info() lookup is needed. The patch is based on the driver parts of the patchset at Link: below, which missed converting the omap driver. Due to the absence of this change in the patchset at Link:, after the Fixed: commit below, omap_framebuffer_init() -> drm_helper_mode_fill_fb_struct() set drm_framebuffer::format incorrectly to NULL, which lead to the !fb->format WARN() in drm_framebuffer_init() and causing framebuffer creation to fail. This patch fixes both of these issues. v2: Amend the commit log mentioning the functional issues the patch fixes. (Tomi) Cc: Ville Syrjälä Cc: Tomi Valkeinen Cc: Thomas Zimmermann Cc: Maarten Lankhorst Cc: Maxime Ripard Fixes: 41ab92d35ccd ("drm: Make passing of format info to drm_helper_mode_fill_fb_struct() mandatory") Reported-by: Mark Brown Closes: https://lore.kernel.org/all/98b3a62c-91ff-4f91-a58b-e1265f84180b@sirena.org.uk Link: https://lore.kernel.org/all/20250701090722.13645-1-ville.syrjala@linux.intel.com Tested-by: Mark Brown Tested-by: Linux Kernel Functional Testing Acked-by: Alex Deucher Reviewed-by: Tomi Valkeinen Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250805175752.690504-2-imre.deak@intel.com commit 614d416dd8aee2675fb591c598308a901a660db8 Author: Arnd Bergmann Date: Tue Aug 5 18:04:25 2025 +0200 ASoC: SOF: Intel: hda-sdw-bpt: fix SND_SOF_SOF_HDA_SDW_BPT dependencies The hda-sdw-bpt code links against the soundwire driver, but that fails when trying to link from built-in code into loadable module: x86_64-linux-ld: vmlinux.o: in function `intel_ace2x_bpt_close_stream.isra.0': intel_ace2x.c:(.text+0x137a531): undefined reference to `hda_sdw_bpt_close' x86_64-linux-ld: vmlinux.o: in function `intel_ace2x_bpt_send_async': intel_ace2x.c:(.text+0x137aa45): undefined reference to `hda_sdw_bpt_open' x86_64-linux-ld: intel_ace2x.c:(.text+0x137ab67): undefined reference to `hda_sdw_bpt_close' x86_64-linux-ld: intel_ace2x.c:(.text+0x137ac30): undefined reference to `hda_sdw_bpt_send_async' x86_64-linux-ld: vmlinux.o: in function `intel_ace2x_bpt_wait': intel_ace2x.c:(.text+0x137aced): undefined reference to `hda_sdw_bpt_wait' Ensure that both SOUNDWIRE_INTEL and SND_SOF_SOF_HDA_SDW_BPT are selected at the same time by SND_SOC_SOF_INTEL_LNL, and that this happens even if SND_SOC_SOF_INTEL_SOUNDWIRE is a loadable module but SND_SOC_SOF_INTEL_LNL is built-in. This follows the same logic as commit c5a61db9bf89 ("ASoC: SOF: fix intel-soundwire link failure"). Fixes: 5d5cb86fb46e ("ASoC: SOF: Intel: hda-sdw-bpt: add helpers for SoundWire BPT DMA") Signed-off-by: Arnd Bergmann Reviewed-by: Bard Liao Link: https://patch.msgid.link/20250805160451.4004602-1-arnd@kernel.org Signed-off-by: Mark Brown commit 0a32e4f0025a74c70dcab4478e9b29c22f5ecf2f Author: Filipe Manana Date: Wed Jul 30 19:18:37 2025 +0100 btrfs: fix log tree replay failure due to file with 0 links and extents If we log a new inode (not persisted in a past transaction) that has 0 links and extents, then log another inode with an higher inode number, we end up with failing to replay the log tree with -EINVAL. The steps for this are: 1) create new file A 2) write some data to file A 3) open an fd on file A 4) unlink file A 5) fsync file A using the previously open fd 6) create file B (has higher inode number than file A) 7) fsync file B 8) power fail before current transaction commits Now when attempting to mount the fs, the log replay will fail with -ENOENT at replay_one_extent() when attempting to replay the first extent of file A. The failure comes when trying to open the inode for file A in the subvolume tree, since it doesn't exist. Before commit 5f61b961599a ("btrfs: fix inode lookup error handling during log replay"), the returned error was -EIO instead of -ENOENT, since we converted any errors when attempting to read an inode during log replay to -EIO. The reason for this is that the log replay procedure fails to ignore the current inode when we are at the stage LOG_WALK_REPLAY_ALL, our current inode has 0 links and last inode we processed in the previous stage has a non 0 link count. In other words, the issue is that at replay_one_extent() we only update wc->ignore_cur_inode if the current replay stage is LOG_WALK_REPLAY_INODES. Fix this by updating wc->ignore_cur_inode whenever we find an inode item regardless of the current replay stage. This is a simple solution and easy to backport, but later we can do other alternatives like avoid logging extents or inode items other than the inode item for inodes with a link count of 0. The problem with the wc->ignore_cur_inode logic has been around since commit f2d72f42d5fa ("Btrfs: fix warning when replaying log after fsync of a tmpfile") but it only became frequent to hit since the more recent commit 5e85262e542d ("btrfs: fix fsync of files with no hard links not persisting deletion"), because we stopped skipping inodes with a link count of 0 when logging, while before the problem would only be triggered if trying to replay a log tree created with an older kernel which has a logged inode with 0 links. A test case for fstests will be submitted soon. Reported-by: Peter Jung Link: https://lore.kernel.org/linux-btrfs/fce139db-4458-4788-bb97-c29acf6cb1df@cachyos.org/ Reported-by: burneddi Link: https://lore.kernel.org/linux-btrfs/lh4W-Lwc0Mbk-QvBhhQyZxf6VbM3E8VtIvU3fPIQgweP_Q1n7wtlUZQc33sYlCKYd-o6rryJQfhHaNAOWWRKxpAXhM8NZPojzsJPyHMf2qY=@protonmail.com/#t Reported-by: Russell Haley Link: https://lore.kernel.org/linux-btrfs/598ecc75-eb80-41b3-83c2-f2317fbb9864@gmail.com/ Fixes: f2d72f42d5fa ("Btrfs: fix warning when replaying log after fsync of a tmpfile") CC: stable@vger.kernel.org # 5.4+ Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 3b6a18f0da8720d612d8a682ea5c55870da068e0 Author: Arnd Bergmann Date: Tue Aug 5 18:09:49 2025 +0200 irqchip: Build IMX_MU_MSI only on ARM Compile-testing IMX_MU_MSI on x86 without PCI_MSI support results in a build failure: drivers/gpio/gpio-sprd.c:8: include/linux/gpio/driver.h:41:33: error: field 'msiinfo' has incomplete type drivers/iommu/iommufd/viommu.c:4: include/linux/msi.h:528:33: error: field 'alloc_info' has incomplete type Tighten the dependency further to only allow compile testing on Arm. This could be refined further to allow certain x86 configs. This was submitted before to address a different build failure, which was fixed differently, but the problem has now returned in a different form. Fixes: 70afdab904d2d1e6 ("irqchip: Add IMX MU MSI controller driver") Signed-off-by: Arnd Bergmann Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250805160952.4006075-1-arnd@kernel.org Link: https://lore.kernel.org/all/20221215164109.761427-1-arnd@kernel.org/ commit 5b65258229117995eb6c4bd74995e15fb5f2cfe3 Author: Brian Norris Date: Tue Aug 5 11:32:20 2025 -0700 genirq/test: Resolve irq lock inversion warnings irq_shutdown_and_deactivate() is normally called with the descriptor lock held, and interrupts disabled. Nested a few levels down, it grabs the global irq_resend_lock. Lockdep rightfully complains when interrupts are not disabled: CPU0 CPU1 ---- ---- lock(irq_resend_lock); local_irq_disable(); lock(&irq_desc_lock_class); lock(irq_resend_lock); lock(&irq_desc_lock_class); ... _raw_spin_lock+0x2b/0x40 clear_irq_resend+0x14/0x70 irq_shutdown_and_deactivate+0x29/0x80 irq_shutdown_depth_test+0x1ce/0x600 kunit_try_run_case+0x90/0x120 Grab the descriptor lock and disable interrupts, to resolve the problem. Fixes: 66067c3c8a1e ("genirq: Add kunit tests for depth counts") Reported-by: Guenter Roeck Signed-off-by: Brian Norris Signed-off-by: Thomas Gleixner Tested-by: Guenter Roeck Link: https://lore.kernel.org/all/aJJONEIoIiTSDMqc@google.com Closes: https://lore.kernel.org/lkml/31a761e4-8f81-40cf-aaf5-d220ba11911c@roeck-us.net/ commit 42e42562c9cfcdacf000f1b42284a4fad24f8546 Author: Sabrina Dubroca Date: Mon Aug 4 11:05:43 2025 +0200 xfrm: flush all states in xfrm_state_fini While reverting commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path"), I incorrectly changed xfrm_state_flush's "proto" argument back to IPSEC_PROTO_ANY. This reverts some of the changes in commit dbb2483b2a46 ("xfrm: clean up xfrm protocol checks"), and leads to some states not being removed when we exit the netns. Pass 0 instead of IPSEC_PROTO_ANY from both xfrm_state_fini xfrm6_tunnel_net_exit, so that xfrm_state_flush deletes all states. Fixes: 2a198bbec691 ("Revert "xfrm: destroy xfrm_state synchronously on net exit path"") Reported-by: syzbot+6641a61fe0e2e89ae8c5@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6641a61fe0e2e89ae8c5 Tested-by: syzbot+6641a61fe0e2e89ae8c5@syzkaller.appspotmail.com Signed-off-by: Sabrina Dubroca Reviewed-by: Simon Horman Signed-off-by: Steffen Klassert commit cac5f2af13459f6258c4857d2e61ea53d0dfd751 Author: Shenghao Ding Date: Tue Aug 5 15:09:45 2025 +0800 ALSA: hda/tas2781: Support L"SmartAmpCalibrationData" to save calibrated data Some devices save the calibrated data into L"CALI_DATA", and others into L"SmartAmpCalibrationData". Driver code will support both. Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20250805070945.524-1-shenghao-ding@ti.com Signed-off-by: Takashi Iwai commit 8cbe564974248ee980562be02f2b1912769562c7 Author: Thorsten Blum Date: Wed Aug 6 01:41:53 2025 +0200 ALSA: intel_hdmi: Fix off-by-one error in __hdmi_lpe_audio_probe() In __hdmi_lpe_audio_probe(), strscpy() is incorrectly called with the length of the source string (excluding the NUL terminator) rather than the size of the destination buffer. This results in one character less being copied from 'card->shortname' to 'pcm->name'. Use the destination buffer size instead to ensure the card name is copied correctly. Cc: stable@vger.kernel.org Fixes: 75b1a8f9d62e ("ALSA: Convert strlcpy to strscpy when return value is unused") Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250805234156.60294-1-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 479058002c32b77acac43e883b92174e22c4be2d Merge: a530a36bb548bb 6cb43739b93c64 Author: Linus Torvalds Date: Wed Aug 6 08:52:59 2025 +0300 Merge tag 'ata-6.17-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Damien Le Moal: - Cleanup whitespace in messages in libata-core and the pata_pdc2027x, pata_macio drivers (Colin) - Fix ata_to_sense_error() to avoid seeing nonsensical sense data for rare cases where we fail to get sense data from the drive. The complementary fix to this is to ensure that we always return the generic "ABORTED COMMAND" sense data for a failed command for which we have no status or error fields - The recent changes to link power management (LPM) which now prevent the user from attempting to set an LPM policy through the link_power_management_policy caused some regressions in test environments because of the error that is now returned when writing to that attribute when LPM is not supported. To allow users to not trip on this, introduce the new link_power_management_supported attribute to allow simple testing of a port/device LPM support (me) * tag 'ata-6.17-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: pata_pdc2027x: Remove space before newline and abbreviations ata: pata_macio: Remove space before newline ata: libata-core: Remove space before newline ata: libata-sata: Add link_power_management_supported sysfs attribute ata: libata-scsi: Return aborted command when missing sense and result TF ata: libata-scsi: Fix ata_to_sense_error() status handling commit a530a36bb548bbd441402b736f17339183ff53fd Merge: 7881cd6886a89e 8d6841d5cb20dc Author: Linus Torvalds Date: Wed Aug 6 07:32:52 2025 +0300 Merge tag 'kbuild-v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild Pull Kbuild updates from Masahiro Yamada: "This is the last pull request from me. I'm grateful to have been able to continue as a maintainer for eight years. From the next cycle, Nathan and Nicolas will maintain Kbuild. - Fix a shortcut key issue in menuconfig - Fix missing rebuild of kheaders - Sort the symbol dump generated by gendwarfsyms - Support zboot extraction in scripts/extract-vmlinux - Migrate gconfig to GTK 3 - Add TAR variable to allow overriding the default tar command - Hand over Kbuild maintainership" * tag 'kbuild-v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild: (92 commits) MAINTAINERS: hand over Kbuild maintenance kheaders: make it possible to override TAR kbuild: userprogs: use correct linker when mixing clang and GNU ld kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c kconfig: lxdialog: replace strcpy with snprintf in print_autowrap kconfig: gconf: refactor text_insert_help() kconfig: gconf: remove unneeded variable in text_insert_msg kconfig: gconf: use hyphens in signals kconfig: gconf: replace GtkImageMenuItem with GtkMenuItem kconfig: gconf: Fix Back button behavior kconfig: gconf: fix single view to display dependent symbols correctly scripts: add zboot support to extract-vmlinux gendwarfksyms: order -T symtypes output by name gendwarfksyms: use preferred form of sizeof for allocation kconfig: qconf: confine {begin,end}Group to constructor and destructor kconfig: qconf: fix ConfigList::updateListAllforAll() kconfig: add a function to dump all menu entries in a tree-like format kconfig: gconf: show GTK version in About dialog kconfig: gconf: replace GtkHPaned and GtkVPaned with GtkPaned kconfig: gconf: replace GdkColor with GdkRGBA ... commit 72fc388d8bc0b49fd038477b74618cc15ce18b56 Author: Waqar Hameed Date: Tue Aug 5 11:33:36 2025 +0200 scsi: ufs: core: Remove error print for devm_add_action_or_reset() When devm_add_action_or_reset() fails, it is due to a failed memory allocation and will thus return -ENOMEM. dev_err_probe() doesn't do anything when error is -ENOMEM. Therefore, remove the useless call to dev_err_probe() when devm_add_action_or_reset() fails, and just return the value instead. Signed-off-by: Waqar Hameed Link: https://lore.kernel.org/r/pndtt2mkt8v.a.out@axis.com Signed-off-by: Martin K. Petersen commit 7ec2bd6cd2d0ce6d6224519f895cb932ed5af667 Author: Peter Wang Date: Mon Aug 4 14:01:54 2025 +0800 scsi: ufs: mediatek: Fix out-of-bounds access in MCQ IRQ mapping Address a potential out-of-bounds access issue when accessing 'host->mcq_intr_info[q_index]'. The value of 'q_index' might exceed the valid array bounds if 'q_index == nr'. Correct condition to 'q_index >= nr' to prevent accessing invalid memory. Fixes: 66e26a4b8a77 ("scsi: ufs: host: mediatek: Set IRQ affinity policy for MCQ mode") Cc: stable@vger.kernel.org Reported-by: Dan Carpenter Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250804060249.1387057-1-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit eea6cafb5890db488fce1c69d05464214616d800 Author: Jiasheng Jiang Date: Fri Aug 1 18:52:02 2025 +0000 scsi: lpfc: Remove redundant assignment to avoid memory leak Remove the redundant assignment if kzalloc() succeeds to avoid memory leak. Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support") Signed-off-by: Jiasheng Jiang Link: https://lore.kernel.org/r/20250801185202.42631-1-jiashengjiangcool@gmail.com Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen commit 7881cd6886a89eda848192d3f5759ce08672e084 Author: Sasha Levin Date: Tue Aug 5 08:58:20 2025 -0400 media: venus: Fix OPP table error handling The venus driver fails to check if dev_pm_opp_find_freq_{ceil,floor}() returns an error pointer before calling dev_pm_opp_put(). This causes a crash when OPP tables are not present in device tree. Unable to handle kernel access to user memory outside uaccess routines at virtual address 000000000000002e ... pc : dev_pm_opp_put+0x1c/0x4c lr : core_clks_enable+0x4c/0x16c [venus_core] Add IS_ERR() checks before calling dev_pm_opp_put() to avoid dereferencing error pointers. Fixes: b179234b5e59 ("media: venus: pm_helpers: use opp-table for the frequency") Signed-off-by: Sasha Levin Signed-off-by: Linus Torvalds commit a59976116a01dad1c72460f9ed700bf4b3fdbebd Author: Jean Delvare Date: Thu Jul 31 13:33:11 2025 +0200 scsi: lpfc: Fix wrong function reference in a comment Function scsi_host_remove() doesn't exist, the actual function name is scsi_remove_host(). Signed-off-by: Jean Delvare Link: https://lore.kernel.org/r/20250731133311.52034cc4@endymion Reviewed-by: Justin Tee Signed-off-by: Martin K. Petersen commit 034d319c8899e8c5c0a35c6692c7fc7e8c12c374 Author: Nitin Rawat Date: Tue Jul 29 04:27:11 2025 +0530 scsi: ufs: core: Fix interrupt handling for MCQ Mode Commit 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler") introduced a regression where the UFS interrupt status register (IS) was not cleared in ufshcd_intr() when operating in MCQ mode. As a result, the IS register remained uncleared. This led to a persistent issue during UIC interrupts: ufshcd_is_auto_hibern8_error() consistently returned true because the UFSHCD_UIC_HIBERN8_MASK bit was set, while the active command was neither UIC_CMD_DME_HIBER_ENTER nor UIC_CMD_DME_HIBER_EXIT. This caused continuous auto hibern8 enter errors and device failed to boot. To fix this, ensure that the interrupt status register is properly cleared in the ufshcd_intr() function for both MCQ mode with ESI enabled. [ 4.553226] ufshcd-qcom 1d84000.ufs: ufshcd_check_errors: Auto Hibern8 Enter failed - status: 0x00000040, upmcrs: 0x00000001 [ 4.553229] ufshcd-qcom 1d84000.ufs: ufshcd_check_errors: saved_err 0x40 saved_uic_err 0x0 [ 4.553311] host_regs: 00000000: d5c7033f 20e0071f 00000400 00000000 [ 4.553312] host_regs: 00000010: 01000000 00010217 00000c96 00000000 [ 4.553314] host_regs: 00000020: 00000440 00170ef5 00000000 00000000 [ 4.553316] host_regs: 00000030: 0000010f 00000001 00000000 00000000 [ 4.553317] host_regs: 00000040: 00000000 00000000 00000000 00000000 [ 4.553319] host_regs: 00000050: fffdf000 0000000f 00000000 00000000 [ 4.553320] host_regs: 00000060: 00000001 80000000 00000000 00000000 [ 4.553322] host_regs: 00000070: fffde000 0000000f 00000000 00000000 [ 4.553323] host_regs: 00000080: 00000001 00000000 00000000 00000000 [ 4.553325] host_regs: 00000090: 00000002 d0020000 00000000 01930200 Fixes: 3c7ac40d7322 ("scsi: ufs: core: Delegate the interrupt service routine to a threaded IRQ handler") Co-developed-by: Palash Kambar Signed-off-by: Palash Kambar Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250728225711.29273-1-quic_nitirawa@quicinc.com Tested-by: Neil Armstrong # on SM8650-QRD Reviewed-by: Bart Van Assche Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit adf12a394c8eb4b857b8f70cc6594a9ab25e3fc6 Merge: 8466d393700f9c 084d2ac4030c59 Author: Linus Torvalds Date: Wed Aug 6 04:41:21 2025 +0300 Merge tag 'perf-fixes-27504' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git Pull perf fixes from Thomas Gleixner: "Perf fixes for perf_mmap() reference counting to prevent potential reference count leaks which are caused by: - VMA splits, which change the offset or size of a mapping, which causes perf_mmap_close() to ignore the unmap or unmap the wrong buffer. - Several internal issues of perf_mmap(), which can cause reference count leaks in the perf mmap, corrupt accounting or cause leaks in perf drivers. The main fix is to prevent VMA splits by implementing the [may_]split() callback for vm operations. The other issues are addressed by rearranging code, early returns on failure and invocation of cleanups. Also provide a selftest to validate the fixes. The reference counting should be converted to refcount_t, but that requires larger refactoring of the code and will be done once these fixes are upstream" * tag 'perf-fixes-27504' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git: selftests/perf_events: Add a mmap() correctness test perf/core: Prevent VMA split of buffer mappings perf/core: Handle buffer mapping fail correctly in perf_mmap() perf/core: Exit early on perf_mmap() fail perf/core: Don't leak AUX buffer refcount on allocation failure perf/core: Preserve AUX buffer allocation failure result commit 8466d393700f9ccef68134d3349f4e0a087679b9 Author: Ammar Faizi Date: Wed Aug 6 07:31:05 2025 +0700 net: usbnet: Fix the wrong netif_carrier_on() call The commit referenced in the Fixes tag causes usbnet to malfunction (identified via git bisect). Post-commit, my external RJ45 LAN cable fails to connect. Linus also reported the same issue after pulling that commit. The code has a logic error: netif_carrier_on() is only called when the link is already on. Fix this by moving the netif_carrier_on() call outside the if-statement entirely. This ensures it is always called when EVENT_LINK_CARRIER_ON is set and properly clears it regardless of the link state. Cc: stable@vger.kernel.org Cc: Armando Budianto Reviewed-by: Simon Horman Suggested-by: Linus Torvalds Link: https://lore.kernel.org/all/CAHk-=wjqL4uF0MG_c8+xHX1Vv8==sPYQrtzbdA3kzi96284nuQ@mail.gmail.com Closes: https://lore.kernel.org/netdev/CAHk-=wjKh8X4PT_mU1kD4GQrbjivMfPn-_hXa6han_BTDcXddw@mail.gmail.com Closes: https://lore.kernel.org/netdev/0752dee6-43d6-4e1f-81d2-4248142cccd2@gnuweeb.org Fixes: 0d9cfc9b8cb1 ("net: usbnet: Avoid potential RCU stall on LINK_CHANGE event") Signed-off-by: Ammar Faizi Signed-off-by: Linus Torvalds commit 8d6841d5cb20dcee7bf9ba98cb6dbcbf5bccfea5 Author: Masahiro Yamada Date: Mon Aug 4 23:20:07 2025 +0900 MAINTAINERS: hand over Kbuild maintenance I'm stepping down as the maintainer of Kbuild/Kconfig. It was enjoyable to refactor and improve the kernel build system, but due to personal reasons, I believe it's difficult for me to continue in this role any further. I discussed this off-list with Nathan and Nicolas, and they have kindly agreed to take over the maintenance of Kbuild with Odd Fixes. I'm grateful to them for stepping in. As for Kconfig, there are currently no designated reviewers, so the maintainer position will remain vacant for now. I hope someone will step up to take on the role. Signed-off-by: Masahiro Yamada Acked-by: Nathan Chancellor Acked-by: Nicolas Schier commit 73d210e9faf85c36d5c9d2e38cb42c2d9837ee51 Author: Michał Górny Date: Tue Jul 29 15:24:55 2025 +0200 kheaders: make it possible to override TAR Commit 86cdd2fdc4e3 ("kheaders: make headers archive reproducible") introduced a number of options specific to GNU tar to the `tar` invocation in `gen_kheaders.sh` script. This causes the script to fail to work on systems where `tar` is not GNU tar. This can occur e.g. on recent Gentoo Linux installations that support using bsdtar from libarchive instead. Add a `TAR` make variable to make it possible to override the tar executable used, e.g. by specifying: make TAR=gtar Link: https://bugs.gentoo.org/884061 Reported-by: Sam James Tested-by: Sam James Co-developed-by: Masahiro Yamada Signed-off-by: Michał Górny Signed-off-by: Sam James Signed-off-by: Masahiro Yamada commit 936599ca514973d44a766b7376c6bbdc96b6a8cc Author: Thomas Weißschuh Date: Mon Jul 28 15:47:37 2025 +0200 kbuild: userprogs: use correct linker when mixing clang and GNU ld The userprogs infrastructure does not expect clang being used with GNU ld and in that case uses /usr/bin/ld for linking, not the configured $(LD). This fallback is problematic as it will break when cross-compiling. Mixing clang and GNU ld is used for example when building for SPARC64, as ld.lld is not sufficient; see Documentation/kbuild/llvm.rst. Relax the check around --ld-path so it gets used for all linkers. Fixes: dfc1b168a8c4 ("kbuild: userprogs: use correct lld when linking through clang") Cc: stable@vger.kernel.org Signed-off-by: Thomas Weißschuh Reviewed-by: Nathan Chancellor Signed-off-by: Masahiro Yamada commit 5ac726653a1029a2eccba93bbe59e01fc9725828 Author: Suchit Karunakaran Date: Sun Jul 27 22:14:33 2025 +0530 kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c strcpy() performs no bounds checking and can lead to buffer overflows if the input string exceeds the destination buffer size. This patch replaces it with strncpy(), and null terminates the input string. Signed-off-by: Suchit Karunakaran Reviewed-by: Nicolas Schier Signed-off-by: Masahiro Yamada commit 1918f983687aa73bf0e5bc73431898994fce35a8 Author: Suchit Karunakaran Date: Sun Jul 27 01:13:07 2025 +0530 kconfig: lxdialog: replace strcpy with snprintf in print_autowrap strcpy() does not perform bounds checking and can lead to buffer overflows if the source string exceeds the destination buffer size. In print_autowrap(), replace strcpy() with snprintf() to safely copy the prompt string into the fixed-size tempstr buffer. Signed-off-by: Suchit Karunakaran Signed-off-by: Masahiro Yamada commit d942fe13f72bec92f6c689fbd74c5ec38228c16a Author: Meghana Malladi Date: Sun Aug 3 23:32:16 2025 +0530 net: ti: icssg-prueth: Fix skb handling for XDP_PASS emac_rx_packet() is a common function for handling traffic for both xdp and non-xdp use cases. Use common logic for handling skb with or without xdp to prevent any incorrect packet processing. This patch fixes ping working with XDP_PASS for icssg driver. Fixes: 62aa3246f4623 ("net: ti: icssg-prueth: Add XDP support") Signed-off-by: Meghana Malladi Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250803180216.3569139-1-m-malladi@ti.com Signed-off-by: Jakub Kicinski commit e6d76268813dc64cc0b74ea9c274501f2de05344 Author: Samiullah Khawaja Date: Mon Aug 4 16:44:57 2025 +0000 net: Update threaded state in napi config in netif_set_threaded Commit 2677010e7793 ("Add support to set NAPI threaded for individual NAPI") added support to enable/disable threaded napi using netlink. This also extended the napi config save/restore functionality to set the napi threaded state. This breaks netdev reset for drivers that use napi threaded at device level and also use napi config save/restore on napi_disable/napi_enable. Basically on netdev with napi threaded enabled at device level, a napi_enable call will get stuck trying to stop the napi kthread. This is because the napi->config->threaded is set to disabled when threaded is enabled at device level. The issue can be reproduced on virtio-net device using qemu. To reproduce the issue run following, echo 1 > /sys/class/net/threaded ethtool -L eth0 combined 1 Update the threaded state in napi config in netif_set_threaded and add a new test that verifies this scenario. Tested on qemu with virtio-net: NETIF=eth0 ./tools/testing/selftests/drivers/net/napi_threaded.py TAP version 13 1..2 ok 1 napi_threaded.change_num_queues ok 2 napi_threaded.enable_dev_threaded_disable_napi_threaded # Totals: pass:2 fail:0 xfail:0 xpass:0 skip:0 error:0 Fixes: 2677010e7793 ("Add support to set NAPI threaded for individual NAPI") Signed-off-by: Samiullah Khawaja Link: https://patch.msgid.link/20250804164457.2494390-1-skhawaja@google.com Signed-off-by: Jakub Kicinski commit 4ec752ce6debd5a0e7e0febf6bcf780ccda6ab5e Author: Trond Myklebust Date: Tue Jul 15 11:29:51 2025 -0700 NFS/localio: nfs_uuid_put() fix the wake up after unlinking the file Use store_release_wake_up() instead of wake_up_var_locked(), because the waiter cannot retake the nfs_uuid->lock. Acked-by: Mike Snitzer Tested-by: Mike Snitzer Suggested-by: NeilBrown Link: https://lore.kernel.org/all/175262948827.2234665.1891349021754495573@noble.neil.brown.name/ Fixes: 21fb44034695 ("nfs_localio: protect race between nfs_uuid_put() and nfs_close_local_fh()") Signed-off-by: Trond Myklebust commit fdd015de767977f21892329af5e12276eb80375f Author: Trond Myklebust Date: Tue Jul 15 12:49:00 2025 -0700 NFS/localio: nfs_uuid_put() fix races with nfs_open/close_local_fh() In order for the wait in nfs_uuid_put() to be safe, it is necessary to ensure that nfs_uuid_add_file() doesn't add a new entry once the nfs_uuid->net has been NULLed out. Also fix up the wake_up_var_locked() / wait_var_event_spinlock() to both use the nfs_uuid address, since nfl, and &nfl->uuid could be used elsewhere. Acked-by: Mike Snitzer Tested-by: Mike Snitzer Link: https://lore.kernel.org/all/175262893035.2234665.1735173020338594784@noble.neil.brown.name/ Fixes: 21fb44034695 ("nfs_localio: protect race between nfs_uuid_put() and nfs_close_local_fh()") Signed-off-by: Trond Myklebust commit e144d53cf21fb9d02626c669533788c6bdc61ce3 Author: Trond Myklebust Date: Tue Jul 15 12:43:41 2025 -0700 NFS/localio: nfs_close_local_fh() fix check for file closed If the struct nfs_file_localio is closed, its list entry will be empty, but the nfs_uuid->files list might still contain other entries. Acked-by: Mike Snitzer Tested-by: Mike Snitzer Reviewed-by: NeilBrown Fixes: 21fb44034695 ("nfs_localio: protect race between nfs_uuid_put() and nfs_close_local_fh()") Signed-off-by: Trond Myklebust commit 8d22aea8af0d57a1daff046d65b7c18552e35e29 Author: Ido Schimmel Date: Mon Aug 4 14:43:20 2025 +0300 selftests: netdevsim: Xfail nexthop test on slow machines A lot of test cases in the file are related to the idle and unbalanced timers of resilient nexthop groups and these tests are reported to be flaky on slow machines running debug kernels. Rather than marking a lot of individual tests with xfail_on_slow(), simply mark all the tests. Note that the test is stable on non-debug machines and that with debug kernels we are mainly interested in the output of various sanitizers in order to determine pass / fail. Before: # make -C tools/testing/selftests KSFT_MACHINE_SLOW=yes \ TARGETS=drivers/net/netdevsim TEST_PROGS=nexthop.sh \ TEST_GEN_PROGS="" run_tests [...] # TEST: Bucket migration after idle timer (with delete) [FAIL] # Group expected to still be unbalanced [...] not ok 1 selftests: drivers/net/netdevsim: nexthop.sh # exit=1 After: # make -C tools/testing/selftests KSFT_MACHINE_SLOW=yes \ TARGETS=drivers/net/netdevsim TEST_PROGS=nexthop.sh \ TEST_GEN_PROGS="" run_tests [...] # TEST: Bucket migration after idle timer (with delete) [XFAIL] # Group expected to still be unbalanced [...] ok 1 selftests: drivers/net/netdevsim: nexthop.sh Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20250729160609.02e0f157@kernel.org/ Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20250804114320.193203-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit ad21f668e8d4c6e4028571aba566227b62fd8d89 Merge: e407fceeaf1b29 53abd9c86fd086 Author: Jakub Kicinski Date: Tue Aug 5 16:01:47 2025 -0700 Merge branch 'eth-fbnic-fix-drop-stats-support' Mohsin Bashir says: ==================== eth: fbnic: Fix drop stats support Fix hardware drop stats support on the TX path of fbnic by addressing two issues: ensure that tx_dropped stats are correctly copied to the rtnl_link_stats64 struct, and protect the copying of drop stats from fdb->hw_stats to the local variable with the hw_stats_lock to ensure consistency. ==================== Link: https://patch.msgid.link/20250802024636.679317-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 53abd9c86fd086d8448ceec4e9ffbd65b6c17a37 Author: Mohsin Bashir Date: Fri Aug 1 19:46:36 2025 -0700 eth: fbnic: Lock the tx_dropped update Wrap copying of drop stats on TX path from fbd->hw_stats by the hw_stats_lock. Currently, it is being performed outside the lock and another thread accessing fbd->hw_stats can lead to inconsistencies. Fixes: 5f8bd2ce8269 ("eth: fbnic: add support for TMI stats") Signed-off-by: Mohsin Bashir Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250802024636.679317-3-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 2972395d8fad7f4efc8555348f2f988d4941d797 Author: Mohsin Bashir Date: Fri Aug 1 19:46:35 2025 -0700 eth: fbnic: Fix tx_dropped reporting Correctly copy the tx_dropped stats from the fbd->hw_stats to the rtnl_link_stats64 struct. Fixes: 5f8bd2ce8269 ("eth: fbnic: add support for TMI stats") Signed-off-by: Mohsin Bashir Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250802024636.679317-2-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit e407fceeaf1b2959892b4fc9b584843d3f2bfc05 Author: Jakub Kicinski Date: Fri Aug 1 10:07:54 2025 -0700 eth: fbnic: remove the debugging trick of super high page bias Alex added page bias of LONG_MAX, which is admittedly quite a clever way of catching overflows of the pp ref count. The page pool code was "optimized" to leave the ref at 1 for freed pages so it can't catch basic bugs by itself any more. (Something we should probably address under DEBUG_NET...) Unfortunately for fbnic since commit f7dc3248dcfb ("skbuff: Optimization of SKB coalescing for page pool") core _may_ actually take two extra pp refcounts, if one of them is returned before driver gives up the bias the ret < 0 check in page_pool_unref_netmem() will trigger. While at it add a FBNIC_ to the name of the driver constant. Fixes: 0cb4c0a13723 ("eth: fbnic: Implement Rx queue alloc/start/stop/free") Link: https://patch.msgid.link/20250801170754.2439577-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e88fbc30dda1cb7438515303704ceddb3ade4ecd Author: Heiner Kallweit Date: Wed Jul 30 22:23:23 2025 +0200 net: ftgmac100: fix potential NULL pointer access in ftgmac100_phy_disconnect After the call to phy_disconnect() netdev->phydev is reset to NULL. So fixed_phy_unregister() would be called with a NULL pointer as argument. Therefore cache the phy_device before this call. Fixes: e24a6c874601 ("net: ftgmac100: Get link speed and duplex for NC-SI") Cc: stable@vger.kernel.org Signed-off-by: Heiner Kallweit Reviewed-by: Dawid Osuchowski Link: https://patch.msgid.link/2b80a77a-06db-4dd7-85dc-3a8e0de55a1d@gmail.com Signed-off-by: Jakub Kicinski commit 966c529aa177e154722386abc4c46027ce7cf7ce Author: Krzysztof Kozlowski Date: Thu Jul 24 13:37:59 2025 +0200 dt-bindings: net: Replace bouncing Alexandru Tachici emails Emails to alexandru.tachici@analog.com bounce permanently: Remote Server returned '550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup' so replace him with Marcelo Schmitt from Analog. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Signed-off-by: Krzysztof Kozlowski Reviewed-by: Marcelo Schmitt Link: https://patch.msgid.link/20250724113758.61874-2-krzysztof.kozlowski@linaro.org Signed-off-by: Jakub Kicinski commit b1779e4f209c7ff7e32f3c79d69bca4e3a3a68b6 Author: Keith Busch Date: Tue Jul 15 11:46:22 2025 -0700 vfio/type1: conditional rescheduling while pinning A large DMA mapping request can loop through dma address pinning for many pages. In cases where THP can not be used, the repeated vmf_insert_pfn can be costly, so let the task reschedule as need to prevent CPU stalls. Failure to do so has potential harmful side effects, like increased memory pressure as unrelated rcu tasks are unable to make their reclaim callbacks and result in OOM conditions. rcu: INFO: rcu_sched self-detected stall on CPU rcu: 36-....: (20999 ticks this GP) idle=b01c/1/0x4000000000000000 softirq=35839/35839 fqs=3538 rcu: hardirqs softirqs csw/system rcu: number: 0 107 0 rcu: cputime: 50 0 10446 ==> 10556(ms) rcu: (t=21075 jiffies g=377761 q=204059 ncpus=384) ... ? asm_sysvec_apic_timer_interrupt+0x16/0x20 ? walk_system_ram_range+0x63/0x120 ? walk_system_ram_range+0x46/0x120 ? pgprot_writethrough+0x20/0x20 lookup_memtype+0x67/0xf0 track_pfn_insert+0x20/0x40 vmf_insert_pfn_prot+0x88/0x140 vfio_pci_mmap_huge_fault+0xf9/0x1b0 [vfio_pci_core] __do_fault+0x28/0x1b0 handle_mm_fault+0xef1/0x2560 fixup_user_fault+0xf5/0x270 vaddr_get_pfns+0x169/0x2f0 [vfio_iommu_type1] vfio_pin_pages_remote+0x162/0x8e0 [vfio_iommu_type1] vfio_iommu_type1_ioctl+0x1121/0x1810 [vfio_iommu_type1] ? futex_wake+0x1c1/0x260 x64_sys_call+0x234/0x17a0 do_syscall_64+0x63/0x130 ? exc_page_fault+0x63/0x130 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Signed-off-by: Keith Busch Reviewed-by: Paul E. McKenney Link: https://lore.kernel.org/r/20250715184622.3561598-1-kbusch@meta.com Signed-off-by: Alex Williamson commit 1e9c0f1da562651160456e45629f815673c2dd5e Author: Małgorzata Mielnik Date: Tue Jul 15 09:11:50 2025 +0100 vfio/qat: add support for intel QAT 6xxx virtual functions Extend the qat_vfio_pci variant driver to support QAT 6xxx Virtual Functions (VFs). Add the relevant QAT 6xxx VF device IDs to the driver's probe table, enabling proper detection and initialization of these devices. Update the module description to reflect that the driver now supports all QAT generations. Signed-off-by: Małgorzata Mielnik Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Link: https://lore.kernel.org/r/20250715081150.1244466-1-suman.kumar.chakraborty@intel.com Signed-off-by: Alex Williamson commit 27a23faecd5f62c8fea86c5aa67479b559306406 Author: Xin Zeng Date: Mon Jul 14 20:13:57 2025 -0400 vfio/qat: Remove myself from VFIO QAT PCI driver maintainers Remove myself from VFIO QAT PCI driver maintainers as I'm leaving Intel. Signed-off-by: Xin Zeng Link: https://lore.kernel.org/r/20250715001357.33725-1-xin.zeng@intel.com Signed-off-by: Alex Williamson commit 86624ba3b522b6512def25534341da93356c8da4 Author: Jason Gunthorpe Date: Mon Jul 14 13:08:25 2025 -0300 vfio/pci: Do vf_token checks for VFIO_DEVICE_BIND_IOMMUFD This was missed during the initial implementation. The VFIO PCI encodes the vf_token inside the device name when opening the device from the group FD, something like: "0000:04:10.0 vf_token=bd8d9d2b-5a5f-4f5a-a211-f591514ba1f3" This is used to control access to a VF unless there is co-ordination with the owner of the PF. Since we no longer have a device name in the cdev path, pass the token directly through VFIO_DEVICE_BIND_IOMMUFD using an optional field indicated by VFIO_DEVICE_BIND_FLAG_TOKEN. Fixes: 5fcc26969a16 ("vfio: Add VFIO_DEVICE_BIND_IOMMUFD") Tested-by: Shameer Kolothum Reviewed-by: Yi Liu Signed-off-by: Jason Gunthorpe Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/0-v3-bdd8716e85fe+3978a-vfio_token_jgg@nvidia.com Signed-off-by: Alex Williamson commit 89c52146392948f4cdda3853da9d82ec6d1dd1f4 Author: Marcos Alano Date: Tue Aug 5 13:44:29 2025 -0700 Input: add keycode for performance mode key Alienware calls this key "Performance Boost". Dell calls it "G-Mode". The goal is to have a specific keycode to detect when this key is pressed, so userspace can act upon it and do what have to do, usually starting the power profile for performance. Signed-off-by: Marcos Alano Link: https://lore.kernel.org/r/20250509193708.2190586-1-marcoshalano@gmail.com Signed-off-by: Dmitry Torokhov commit aa5a10b070690225317ed4d85413d144abfff750 Author: Jinjiang Tu Date: Thu Jul 24 17:09:57 2025 +0800 fs/proc/task_mmu: hold PTL in pagemap_hugetlb_range and gather_hugetlb_stats Hold PTL in pagemap_hugetlb_range() and gather_hugetlb_stats() to avoid operating on stale page, as pagemap_pmd_range() and gather_pte_stats() have done. Link: https://lkml.kernel.org/r/20250724090958.455887-3-tujinjiang@huawei.com Signed-off-by: Jinjiang Tu Acked-by: David Hildenbrand Cc: Andrei Vagin Cc: Andrii Nakryiko Cc: Baolin Wang Cc: Brahmajit Das Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Rientjes Cc: Dev Jain Cc: Hugh Dickins Cc: Joern Engel Cc: Kefeng Wang Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Ryan Roberts Cc: Thiago Jung Bauermann Signed-off-by: Andrew Morton commit 45d19b4b6c2d422771c29b83462d84afcbb33f01 Author: Jinjiang Tu Date: Thu Jul 24 17:09:56 2025 +0800 mm/smaps: fix race between smaps_hugetlb_range and migration smaps_hugetlb_range() handles the pte without holdling ptl, and may be concurrenct with migration, leaing to BUG_ON in pfn_swap_entry_to_page(). The race is as follows. smaps_hugetlb_range migrate_pages huge_ptep_get remove_migration_ptes folio_unlock pfn_swap_entry_folio BUG_ON To fix it, hold ptl lock in smaps_hugetlb_range(). Link: https://lkml.kernel.org/r/20250724090958.455887-1-tujinjiang@huawei.com Link: https://lkml.kernel.org/r/20250724090958.455887-2-tujinjiang@huawei.com Fixes: 25ee01a2fca0 ("mm: hugetlb: proc: add hugetlb-related fields to /proc/PID/smaps") Signed-off-by: Jinjiang Tu Acked-by: David Hildenbrand Cc: Andrei Vagin Cc: Andrii Nakryiko Cc: Baolin Wang Cc: Brahmajit Das Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Rientjes Cc: Dev Jain Cc: Hugh Dickins Cc: Joern Engel Cc: Kefeng Wang Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Ryan Roberts Cc: Thiago Jung Bauermann Signed-off-by: Andrew Morton commit 366a4532d96fc357998465133db34d34edb79e4c Author: Barry Song Date: Tue Aug 5 11:54:47 2025 +0800 mm: fix the race between collapse and PT_RECLAIM under per-vma lock The check_pmd_still_valid() call during collapse is currently only protected by the mmap_lock in write mode, which was sufficient when pt_reclaim always ran under mmap_lock in read mode. However, since madvise_dontneed can now execute under a per-VMA lock, this assumption is no longer valid. As a result, a race condition can occur between collapse and PT_RECLAIM, potentially leading to a kernel panic. [ 38.151897] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] SMP KASI [ 38.153519] KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] [ 38.154605] CPU: 0 UID: 0 PID: 721 Comm: repro Not tainted 6.16.0-next-20250801-next-2025080 #1 PREEMPT(voluntary) [ 38.155929] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org4 [ 38.157418] RIP: 0010:kasan_byte_accessible+0x15/0x30 [ 38.158125] Code: 03 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 48 b8 00 00 00 00 00 fc0 [ 38.160461] RSP: 0018:ffff88800feef678 EFLAGS: 00010286 [ 38.161220] RAX: dffffc0000000000 RBX: 0000000000000001 RCX: 1ffffffff0dde60c [ 38.162232] RDX: 0000000000000000 RSI: ffffffff85da1e18 RDI: dffffc0000000003 [ 38.163176] RBP: ffff88800feef698 R08: 0000000000000001 R09: 0000000000000000 [ 38.164195] R10: 0000000000000000 R11: ffff888016a8ba58 R12: 0000000000000018 [ 38.165189] R13: 0000000000000018 R14: ffffffff85da1e18 R15: 0000000000000000 [ 38.166100] FS: 0000000000000000(0000) GS:ffff8880e3b40000(0000) knlGS:0000000000000000 [ 38.167137] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 38.167891] CR2: 00007f97fadfe504 CR3: 0000000007088005 CR4: 0000000000770ef0 [ 38.168812] PKRU: 55555554 [ 38.169275] Call Trace: [ 38.169647] [ 38.169975] ? __kasan_check_byte+0x19/0x50 [ 38.170581] lock_acquire+0xea/0x310 [ 38.171083] ? rcu_is_watching+0x19/0xc0 [ 38.171615] ? __sanitizer_cov_trace_const_cmp4+0x1a/0x20 [ 38.172343] ? __sanitizer_cov_trace_const_cmp8+0x1c/0x30 [ 38.173130] _raw_spin_lock+0x38/0x50 [ 38.173707] ? __pte_offset_map_lock+0x1a2/0x3c0 [ 38.174390] __pte_offset_map_lock+0x1a2/0x3c0 [ 38.174987] ? __pfx___pte_offset_map_lock+0x10/0x10 [ 38.175724] ? __pfx_pud_val+0x10/0x10 [ 38.176308] ? __sanitizer_cov_trace_const_cmp1+0x1e/0x30 [ 38.177183] unmap_page_range+0xb60/0x43e0 [ 38.177824] ? __pfx_unmap_page_range+0x10/0x10 [ 38.178485] ? mas_next_slot+0x133a/0x1a50 [ 38.179079] unmap_single_vma.constprop.0+0x15b/0x250 [ 38.179830] unmap_vmas+0x1fa/0x460 [ 38.180373] ? __pfx_unmap_vmas+0x10/0x10 [ 38.180994] ? __sanitizer_cov_trace_const_cmp4+0x1a/0x20 [ 38.181877] exit_mmap+0x1a2/0xb40 [ 38.182396] ? lock_release+0x14f/0x2c0 [ 38.182929] ? __pfx_exit_mmap+0x10/0x10 [ 38.183474] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 38.184188] ? mutex_unlock+0x16/0x20 [ 38.184704] mmput+0x132/0x370 [ 38.185208] do_exit+0x7e7/0x28c0 [ 38.185682] ? __this_cpu_preempt_check+0x21/0x30 [ 38.186328] ? do_group_exit+0x1d8/0x2c0 [ 38.186873] ? __pfx_do_exit+0x10/0x10 [ 38.187401] ? __this_cpu_preempt_check+0x21/0x30 [ 38.188036] ? _raw_spin_unlock_irq+0x2c/0x60 [ 38.188634] ? lockdep_hardirqs_on+0x89/0x110 [ 38.189313] do_group_exit+0xe4/0x2c0 [ 38.189831] __x64_sys_exit_group+0x4d/0x60 [ 38.190413] x64_sys_call+0x2174/0x2180 [ 38.190935] do_syscall_64+0x6d/0x2e0 [ 38.191449] entry_SYSCALL_64_after_hwframe+0x76/0x7e This patch moves the vma_start_write() call to precede check_pmd_still_valid(), ensuring that the check is also properly protected by the per-VMA lock. Link: https://lkml.kernel.org/r/20250805035447.7958-1-21cnbao@gmail.com Fixes: a6fde7add78d ("mm: use per_vma lock for MADV_DONTNEED") Signed-off-by: Barry Song Tested-by: "Lai, Yi" Reported-by: "Lai, Yi" Closes: https://lore.kernel.org/all/aJAFrYfyzGpbm+0m@ly-workstation/ Reviewed-by: Lorenzo Stoakes Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Qi Zheng Cc: Vlastimil Babka Cc: Jann Horn Cc: Suren Baghdasaryan Cc: Lokesh Gidra Cc: Tangquan Zheng Cc: Lance Yang Cc: Zi Yan Cc: Baolin Wang Cc: Liam R. Howlett Cc: Nico Pache Cc: Ryan Roberts Cc: Dev Jain Signed-off-by: Andrew Morton commit d1534ae23c2b6be350c8ab060803fbf6e9682adc Author: Waiman Long Date: Mon Jul 28 15:02:48 2025 -0400 mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() A soft lockup warning was observed on a relative small system x86-64 system with 16 GB of memory when running a debug kernel with kmemleak enabled. watchdog: BUG: soft lockup - CPU#8 stuck for 33s! [kworker/8:1:134] The test system was running a workload with hot unplug happening in parallel. Then kemleak decided to disable itself due to its inability to allocate more kmemleak objects. The debug kernel has its CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE set to 40,000. The soft lockup happened in kmemleak_do_cleanup() when the existing kmemleak objects were being removed and deleted one-by-one in a loop via a workqueue. In this particular case, there are at least 40,000 objects that need to be processed and given the slowness of a debug kernel and the fact that a raw_spinlock has to be acquired and released in __delete_object(), it could take a while to properly handle all these objects. As kmemleak has been disabled in this case, the object removal and deletion process can be further optimized as locking isn't really needed. However, it is probably not worth the effort to optimize for such an edge case that should rarely happen. So the simple solution is to call cond_resched() at periodic interval in the iteration loop to avoid soft lockup. Link: https://lkml.kernel.org/r/20250728190248.605750-1-longman@redhat.com Signed-off-by: Waiman Long Acked-by: Catalin Marinas Cc: Signed-off-by: Andrew Morton commit 5a309dbf1f829de7f8dc84a518d0b6e7e9be9994 Author: Masami Hiramatsu (Google) Date: Wed Jul 30 23:25:08 2025 +0900 MAINTAINERS: add Masami as a reviewer of hung task detector Since I'm actively working on hung task blocker detector, add myself to a reviewer of the HUNG TASK DETECTOR feature. Link: https://lkml.kernel.org/r/175388550841.627474.3260499035226455392.stgit@devnote2 Signed-off-by: Masami Hiramatsu (Google) Acked-by: Lance Yang Signed-off-by: Andrew Morton commit 47b0f6d8f0d2be4d311a49e13d2fd5f152f492b2 Author: Breno Leitao Date: Thu Jul 31 02:57:18 2025 -0700 mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock When netpoll is enabled, calling pr_warn_once() while holding kmemleak_lock in mem_pool_alloc() can cause a deadlock due to lock inversion with the netconsole subsystem. This occurs because pr_warn_once() may trigger netpoll, which eventually leads to __alloc_skb() and back into kmemleak code, attempting to reacquire kmemleak_lock. This is the path for the deadlock. mem_pool_alloc() -> raw_spin_lock_irqsave(&kmemleak_lock, flags); -> pr_warn_once() -> netconsole subsystem -> netpoll -> __alloc_skb -> __create_object -> raw_spin_lock_irqsave(&kmemleak_lock, flags); Fix this by setting a flag and issuing the pr_warn_once() after kmemleak_lock is released. Link: https://lkml.kernel.org/r/20250731-kmemleak_lock-v1-1-728fd470198f@debian.org Fixes: c5665868183f ("mm: kmemleak: use the memory pool for early allocations") Signed-off-by: Breno Leitao Reported-by: Jakub Kicinski Acked-by: Catalin Marinas Cc: Signed-off-by: Andrew Morton commit 475356fe2814f2f0b188da8bf0f1fcc579d81272 Author: Jann Horn Date: Mon Jul 28 22:11:54 2025 +0200 kasan/test: fix protection against compiler elision The kunit test is using assignments to "static volatile void *kasan_ptr_result" to prevent elision of memory loads, but that's not working: In this variable definition, the "volatile" applies to the "void", not to the pointer. To make "volatile" apply to the pointer as intended, it must follow after the "*". This makes the kasan_memchr test pass again on my system. The kasan_strings test is still failing because all the definitions of load_unaligned_zeropad() are lacking explicit instrumentation hooks and ASAN does not instrument asm() memory operands. Link: https://lkml.kernel.org/r/20250728-kasan-kunit-fix-volatile-v1-1-e7157c9af82d@google.com Fixes: 5f1c8108e7ad ("mm:kasan: fix sparse warnings: Should it be static?") Signed-off-by: Jann Horn Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitriy Vyukov Cc: Jann Horn Cc: Nihar Chaithanya Cc: Vincenzo Frascino Cc: Signed-off-by: Andrew Morton commit 48bb97cff95ead07c123896e327f2498050e7a0e Merge: 6531a2cf07ef15 5a569ef4d4ab18 Author: Dave Airlie Date: Wed Aug 6 06:11:28 2025 +1000 Merge tag 'drm-intel-next-fixes-2025-08-05' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 fixes for v6.17-rc1: - Fixes around DP LFPS (Low-Frequency Periodic Signaling) Signed-off-by: Dave Airlie From: Jani Nikula Link: https://lore.kernel.org/r/e1147bede8f219682419d198022cfe8d9d4edc28@intel.com commit 084d2ac4030c5919e85bba1f4af26e33491469cb Author: Lorenzo Stoakes Date: Sat Aug 2 22:55:35 2025 +0200 selftests/perf_events: Add a mmap() correctness test Exercise various mmap(), munmap() and mremap() invocations, which might cause a perf buffer mapping to be split or truncated. To avoid hard coding the perf event and having dependencies on architectures and configuration options, scan through event types in sysfs and try to open them. On success, try to mmap() and if that succeeds try to mmap() the AUX buffer. In case that no AUX buffer supporting event is found, only test the base buffer mapping. If no mappable event is found or permissions are not sufficient, skip the tests. Reserve a PROT_NONE region for both rb and aux tests to allow testing the case where mremap unmaps beyond the end of a mapped VMA to prevent it from unmapping unrelated mappings. Signed-off-by: Lorenzo Stoakes Co-developed-by: Thomas Gleixner Signed-off-by: Thomas Gleixner Reviewed-by: Lorenzo Stoakes commit b024d7b56c77191cde544f838debb7f8451cd0d6 Author: Thomas Gleixner Date: Wed Jul 30 23:01:21 2025 +0200 perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in both cases. The reference counting for the ringbuffer and the auxiliary buffer depends on this being correct. Though perf does not prevent that a related mapping is split via mmap(2), munmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls, which take reference counts, but then the subsequent perf_mmap_close() calls are not longer fulfilling the offset and size checks. This leads to reference count leaks. As perf already has the requirement for subsequent mappings to match the initial mapping, the obvious consequence is that VMA splits, caused by resizing of a mapping or partial unmapping, have to be prevented. Implement the vm_operations_struct::may_split() callback and return unconditionally -EINVAL. That ensures that the mapping offsets and sizes cannot be changed after the fact. Remapping to a different fixed address with the same size is still possible as it takes the references for the new mapping and drops those of the old mapping. Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-27504 Signed-off-by: Thomas Gleixner Reviewed-by: Lorenzo Stoakes Acked-by: Arnaldo Carvalho de Melo Acked-by: Vlastimil Babka Cc: stable@vger.kernel.org commit f74b9f4ba63ffdf597aaaa6cad7e284cb8e04820 Author: Thomas Gleixner Date: Sat Aug 2 12:48:55 2025 +0200 perf/core: Handle buffer mapping fail correctly in perf_mmap() After successful allocation of a buffer or a successful attachment to an existing buffer perf_mmap() tries to map the buffer read only into the page table. If that fails, the already set up page table entries are zapped, but the other perf specific side effects of that failure are not handled. The calling code just cleans up the VMA and does not invoke perf_mmap_close(). This leaks reference counts, corrupts user->vm accounting and also results in an unbalanced invocation of event::event_mapped(). Cure this by moving the event::event_mapped() invocation before the map_range() call so that on map_range() failure perf_mmap_close() can be invoked without causing an unbalanced event::event_unmapped() call. perf_mmap_close() undoes the reference counts and eventually frees buffers. Fixes: b709eb872e19 ("perf: map pages in advance") Signed-off-by: Thomas Gleixner Reviewed-by: Lorenzo Stoakes Cc: stable@vger.kernel.org commit 07091aade394f690e7b655578140ef84d0e8d7b0 Author: Thomas Gleixner Date: Sat Aug 2 12:49:48 2025 +0200 perf/core: Exit early on perf_mmap() fail When perf_mmap() fails to allocate a buffer, it still invokes the event_mapped() callback of the related event. On X86 this might increase the perf_rdpmc_allowed reference counter. But nothing undoes this as perf_mmap_close() is never called in this case, which causes another reference count leak. Return early on failure to prevent that. Fixes: 1e0fb9ec679c ("perf: Add pmu callbacks to track event mapping and unmapping") Signed-off-by: Thomas Gleixner Reviewed-by: Lorenzo Stoakes Cc: stable@vger.kernel.org commit 5468c0fbccbb9d156522c50832244a8b722374fb Author: Thomas Gleixner Date: Sat Aug 2 12:39:39 2025 +0200 perf/core: Don't leak AUX buffer refcount on allocation failure Failure of the AUX buffer allocation leaks the reference count. Set the reference count to 1 only when the allocation succeeds. Fixes: 45bfb2e50471 ("perf: Add AUX area to ring buffer for raw data streams") Signed-off-by: Thomas Gleixner Reviewed-by: Lorenzo Stoakes Cc: stable@vger.kernel.org commit 54473e0ef849f44e5ee43e6d6746c27030c3825b Author: Thomas Gleixner Date: Mon Aug 4 22:22:09 2025 +0200 perf/core: Preserve AUX buffer allocation failure result A recent overhaul sets the return value to 0 unconditionally after the allocations, which causes reference count leaks and corrupts the user->vm accounting. Preserve the AUX buffer allocation failure return value, so that the subsequent code works correctly. Fixes: 0983593f32c4 ("perf/core: Lift event->mmap_mutex in perf_mmap()") Signed-off-by: Thomas Gleixner Reviewed-by: Lorenzo Stoakes Cc: stable@vger.kernel.org commit 3fd8ec2fc93b009e5288b123d77292b8b1b9e1e7 Author: Wang Zhaolong Date: Mon Aug 4 21:40:05 2025 +0800 smb: client: smb: client: eliminate mid_flags field This is step 3/4 of a patch series to fix mid_q_entry memory leaks caused by race conditions in callback execution. Replace the mid_flags bitmask with dedicated boolean fields to simplify locking logic and improve code readability: - Replace MID_DELETED with bool deleted_from_q - Replace MID_WAIT_CANCELLED with bool wait_cancelled - Remove mid_flags field entirely The new boolean fields have clearer semantics: - deleted_from_q: whether mid has been removed from pending_mid_q - wait_cancelled: whether request was cancelled during wait This change reduces memory usage (from 4-byte bitmask to 2 boolean flags) and eliminates confusion about which lock protects which flag bits, preparing for per-mid locking in the next patch. Signed-off-by: Wang Zhaolong Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit 9bd42798d5bf87f56d229a27e40140df95ef743d Author: Wang Zhaolong Date: Mon Aug 4 21:40:04 2025 +0800 smb: client: add mid_counter_lock to protect the mid counter counter This is step 2/4 of a patch series to fix mid_q_entry memory leaks caused by race conditions in callback execution. Add a dedicated mid_counter_lock to protect current_mid counter, separating it from mid_queue_lock which protects pending_mid_q operations. This reduces lock contention and prepares for finer- grained locking in subsequent patches. Changes: - Add TCP_Server_Info->mid_counter_lock spinlock - Rename CurrentMid to current_mid for consistency - Use mid_counter_lock to protect current_mid access - Update locking documentation in cifsglob.h This separation allows mid allocation to proceed without blocking queue operations, improving performance under heavy load. Signed-off-by: Wang Zhaolong Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit f3ba7c9b0421e3935998334a860bd88f2ffdb18e Author: Wang Zhaolong Date: Mon Aug 4 21:40:03 2025 +0800 smb: client: rename server mid_lock to mid_queue_lock This is step 1/4 of a patch series to fix mid_q_entry memory leaks caused by race conditions in callback execution. The current mid_lock name is somewhat ambiguous about what it protects. To prepare for splitting this lock into separate, more granular locks, this patch renames mid_lock to mid_queue_lock to clearly indicate its specific responsibility for protecting the pending_mid_q list and related queue operations. No functional changes are made in this patch - it only prepares the codebase for the lock splitting that follows. - mid_queue_lock for queue operations - mid_counter_lock for mid counter operations - per-mid locks for individual mid state management Signed-off-by: Wang Zhaolong Acked-by: Enzo Matsumiya Signed-off-by: Steve French commit c18646248fed07683d4cee8a8af933fc4fe83c0d Author: Pedro Falcato Date: Tue Jul 29 13:03:48 2025 +0100 RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Ever since commit c2ff29e99a76 ("siw: Inline do_tcp_sendpages()"), we have been doing this: static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset, size_t size) [...] /* Calculate the number of bytes we need to push, for this page * specifically */ size_t bytes = min_t(size_t, PAGE_SIZE - offset, size); /* If we can't splice it, then copy it in, as normal */ if (!sendpage_ok(page[i])) msg.msg_flags &= ~MSG_SPLICE_PAGES; /* Set the bvec pointing to the page, with len $bytes */ bvec_set_page(&bvec, page[i], bytes, offset); /* Set the iter to $size, aka the size of the whole sendpages (!!!) */ iov_iter_bvec(&msg.msg_iter, ITER_SOURCE, &bvec, 1, size); try_page_again: lock_sock(sk); /* Sendmsg with $size size (!!!) */ rv = tcp_sendmsg_locked(sk, &msg, size); This means we've been sending oversized iov_iters and tcp_sendmsg calls for a while. This has a been a benign bug because sendpage_ok() always returned true. With the recent slab allocator changes being slowly introduced into next (that disallow sendpage on large kmalloc allocations), we have recently hit out-of-bounds crashes, due to slight differences in iov_iter behavior between the MSG_SPLICE_PAGES and "regular" copy paths: (MSG_SPLICE_PAGES) skb_splice_from_iter iov_iter_extract_pages iov_iter_extract_bvec_pages uses i->nr_segs to correctly stop in its tracks before OoB'ing everywhere skb_splice_from_iter gets a "short" read (!MSG_SPLICE_PAGES) skb_copy_to_page_nocache copy=iov_iter_count [...] copy_from_iter /* this doesn't help */ if (unlikely(iter->count < len)) len = iter->count; iterate_bvec ... and we run off the bvecs Fix this by properly setting the iov_iter's byte count, plus sending the correct byte count to tcp_sendmsg_locked. Link: https://patch.msgid.link/r/20250729120348.495568-1-pfalcato@suse.de Cc: stable@vger.kernel.org Fixes: c2ff29e99a76 ("siw: Inline do_tcp_sendpages()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202507220801.50a7210-lkp@intel.com Reviewed-by: David Howells Signed-off-by: Pedro Falcato Acked-by: Bernard Metzler Signed-off-by: Jason Gunthorpe commit e5a73150776f18547ee685c9f6bfafe549714899 Author: NeilBrown Date: Fri Jul 18 11:26:14 2025 +1000 nfsd: avoid ref leak in nfsd_open_local_fh() If two calls to nfsd_open_local_fh() race and both successfully call nfsd_file_acquire_local(), they will both get an extra reference to the net to accompany the file reference stored in *pnf. One of them will fail to store (using xchg()) the file reference in *pnf and will drop that reference but WON'T drop the accompanying reference to the net. This leak means that when the nfs server is shut down it will hang in nfsd_shutdown_net() waiting for &nn->nfsd_net_free_done. This patch adds the missing nfsd_net_put(). Reported-by: Mike Snitzer Fixes: e6f7e1487ab5 ("nfs_localio: simplify interface to nfsd for getting nfsd_file") Cc: stable@vger.kernel.org Signed-off-by: NeilBrown Tested-by: Mike Snitzer Reviewed-by: Mike Snitzer Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit f9a348e0de19226fc3c7e81de7677d3fa2c4b2d8 Author: Jeff Layton Date: Wed Jul 16 09:34:29 2025 -0400 nfsd: don't set the ctime on delegated atime updates Clients will typically precede a DELEGRETURN for a delegation with delegated timestamp with a SETATTR to set the timestamps on the server to match what the client has. knfsd implements this by using the nfsd_setattr() infrastructure, which will set ATTR_CTIME on any update that goes to notify_change(). This is problematic as it means that the client will get a spurious ctime update when updating the atime. POSIX unfortunately doesn't phrase it succinctly, but updating the atime due to reads should not update the ctime. In this case, the client is sending a SETATTR to update the atime on the server to match its latest value. The ctime should not be advanced in this case as that would incorrectly indicate a change to the inode. Fix this by not implicitly setting ATTR_CTIME when ATTR_DELEG is set in __nfsd_setattr(). The decoder for FATTR4_WORD2_TIME_DELEG_MODIFY already sets ATTR_CTIME, so this is sufficient to make it skip setting the ctime on atime-only updates. Fixes: 7e13f4f8d27d ("nfsd: handle delegated timestamps in SETATTR") Cc: stable@vger.kernel.org Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 6bcdbd62bd56e6d7383f9e06d9d148935b3c9b73 Merge: 5998f2bca43e07 e60737dbfb92fc Author: Linus Torvalds Date: Tue Aug 5 16:55:03 2025 +0300 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux Pull ARM update from Russell King: "Just one development update this time: - Finish removing Coresight support" * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux: ARM: 9449/1: coresight: Finish removal of Coresight support in arch/arm/kernel commit 5998f2bca43e071e9c5a26cc7e7e00f9a78791c4 Merge: da23ea194db942 99f9a97dce39ad Author: Linus Torvalds Date: Tue Aug 5 16:37:05 2025 +0300 Merge tag 'exfat-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat Pull exfat updates from Namjae Jeon: - Use generic_write_sync instead of vfs_fsync_range in exfat_file_write_iter. It will fix an issue where fdatasync would be set incorrectly. - Fix potential infinite loop by the self-linked chain. * tag 'exfat-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/exfat: exfat: add cluster chain loop check for dir exfat: fdatasync flag should be same like generic_write_sync() commit da23ea194db94257123f1534d487f3cdc9b5626d Merge: 7e161a991ea71e a2152fef29020e Author: Linus Torvalds Date: Tue Aug 5 16:02:07 2025 +0300 Merge tag 'mm-stable-2025-08-03-12-35' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull more MM updates from Andrew Morton: "Significant patch series in this pull request: - "mseal cleanups" (Lorenzo Stoakes) Some mseal cleaning with no intended functional change. - "Optimizations for khugepaged" (David Hildenbrand) Improve khugepaged throughput by batching PTE operations for large folios. This gain is mainly for arm64. - "x86: enable EXECMEM_ROX_CACHE for ftrace and kprobes" (Mike Rapoport) A bugfix, additional debug code and cleanups to the execmem code. - "mm/shmem, swap: bugfix and improvement of mTHP swap in" (Kairui Song) Bugfixes, cleanups and performance improvememnts to the mTHP swapin code" * tag 'mm-stable-2025-08-03-12-35' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (38 commits) mm: mempool: fix crash in mempool_free() for zero-minimum pools mm: correct type for vmalloc vm_flags fields mm/shmem, swap: fix major fault counting mm/shmem, swap: rework swap entry and index calculation for large swapin mm/shmem, swap: simplify swapin path and result handling mm/shmem, swap: never use swap cache and readahead for SWP_SYNCHRONOUS_IO mm/shmem, swap: tidy up swap entry splitting mm/shmem, swap: tidy up THP swapin checks mm/shmem, swap: avoid redundant Xarray lookup during swapin x86/ftrace: enable EXECMEM_ROX_CACHE for ftrace allocations x86/kprobes: enable EXECMEM_ROX_CACHE for kprobes allocations execmem: drop writable parameter from execmem_fill_trapping_insns() execmem: add fallback for failures in vmalloc(VM_ALLOW_HUGE_VMAP) execmem: move execmem_force_rw() and execmem_restore_rox() before use execmem: rework execmem_cache_free() execmem: introduce execmem_alloc_rw() execmem: drop unused execmem_update_copy() mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped mm/rmap: add anon_vma lifetime debug check mm: remove mm/io-mapping.c ... commit daa8af80d283ee9a7d42dd6f164a65036665b9d4 Author: Sumanth Korikkar Date: Mon Aug 4 11:57:03 2025 +0200 s390/mm: Allocate page table with PAGE_SIZE granularity Make vmem_pte_alloc() consistent by always allocating page table of PAGE_SIZE granularity, regardless of whether page_table_alloc() (with slab) or memblock_alloc() is used. This ensures page table can be fully freed when the corresponding page table entries are removed. Fixes: d08d4e7cd6bf ("s390/mm: use full 4KB page for 2KB PTE") Reviewed-by: Heiko Carstens Reviewed-by: Alexander Gordeev Signed-off-by: Sumanth Korikkar Signed-off-by: Alexander Gordeev commit d35ec48fa6c8fe0cfa4a03155109fec7677911d4 Author: Wentao Guan Date: Tue Aug 5 19:00:22 2025 +0800 LoongArch: vDSO: Remove -nostdlib complier flag Since $(LD) is directly used, hence -nostdlib is unneeded, MIPS has removed this, we should remove it too. bdbf2038fbf4 ("MIPS: VDSO: remove -nostdlib compiler flag"). In fact, other architectures also use $(LD) now. fe00e50b2db8 ("ARM: 8858/1: vdso: use $(LD) instead of $(CC) to link VDSO") 691efbedc60d ("arm64: vdso: use $(LD) instead of $(CC) to link VDSO") 2ff906994b6c ("MIPS: VDSO: Use $(LD) instead of $(CC) to link VDSO") 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO") Cc: stable@vger.kernel.org Reviewed-by: Yanteng Si Signed-off-by: Wentao Guan Signed-off-by: Huacai Chen commit d3eece04f3021a782f02fb435c32142d130d5585 Author: Binbin Zhou Date: Tue Aug 5 19:00:22 2025 +0800 LoongArch: dts: Add eMMC/SDIO controller support to Loongson-2K2000 The Loongson-2K2000 integrates one eMMC controller and one SDIO controller. The module is supported now, enable it. Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit df0fbf7fab3025ab80be7760806ecf14bd87a929 Author: Binbin Zhou Date: Tue Aug 5 19:00:22 2025 +0800 LoongArch: dts: Add SDIO controller support to Loongson-2K1000 The Loongson-2K1000 integrates one SDIO controller for SD storage cards and SDIO cards. The module is supported now, enable it. Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit 06d380c470ef987ec703e96cef91681ac13810fe Author: Binbin Zhou Date: Tue Aug 5 19:00:22 2025 +0800 LoongArch: dts: Add SDIO controller support to Loongson-2K0500 The Loongson-2K0500 integrates two SDIO controllers for SD storage cards and SDIO cards, supporting SD storage card boot. The module is supported now, enable it. Signed-off-by: Binbin Zhou Signed-off-by: Huacai Chen commit 8568df83ea7d9afed0b40ee3a5f8287df008b1c9 Author: Tiezhu Yang Date: Tue Aug 5 19:00:22 2025 +0800 LoongArch: BPF: Set bpf_jit_bypass_spec_v1/v4() JITs can set bpf_jit_bypass_spec_v1/v4() if they want the verifier to skip analysis/patching for the respective vulnerability, it is safe to set both bpf_jit_bypass_spec_v1/v4(), because there is no speculation barrier instruction for LoongArch. Suggested-by: Luis Gerhorst Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit c0fcc955ff827431b541b1aa6bcb82bdce4531f7 Author: Haoran Jiang Date: Tue Aug 5 19:00:22 2025 +0800 LoongArch: BPF: Fix the tailcall hierarchy In specific use cases combining tailcalls and BPF-to-BPF calls， MAX_TAIL_CALL_CNT won't work because of missing tail_call_cnt back-propagation from callee to caller. This patch fixes this tailcall issue caused by abusing the tailcall in bpf2bpf feature on LoongArch like the way of "bpf, x64: Fix tailcall hierarchy". Push tail_call_cnt_ptr and tail_call_cnt into the stack, tail_call_cnt_ptr is passed between tailcall and bpf2bpf, uses tail_call_cnt_ptr to increment tail_call_cnt. Fixes: bb035ef0cc91 ("LoongArch: BPF: Support mixing bpf2bpf and tailcalls") Reviewed-by: Geliang Tang Reviewed-by: Hengqi Chen Signed-off-by: Haoran Jiang Signed-off-by: Huacai Chen commit cd39d9e6b7e4c58fa77783e7aedf7ada51d02ea3 Author: Haoran Jiang Date: Tue Aug 5 19:00:22 2025 +0800 LoongArch: BPF: Fix jump offset calculation in tailcall The extra pass of bpf_int_jit_compile() skips JIT context initialization which essentially skips offset calculation leaving out_offset = -1, so the jmp_offset in emit_bpf_tail_call is calculated by "#define jmp_offset (out_offset - (cur_offset))" is a negative number, which is wrong. The final generated assembly are as follow. 54: bgeu $a2, $t1, -8 # 0x0000004c 58: addi.d $a6, $s5, -1 5c: bltz $a6, -16 # 0x0000004c 60: alsl.d $t2, $a2, $a1, 0x3 64: ld.d $t2, $t2, 264 68: beq $t2, $zero, -28 # 0x0000004c Before apply this patch, the follow test case will reveal soft lock issues. cd tools/testing/selftests/bpf/ ./test_progs --allow=tailcalls/tailcall_bpf2bpf_1 dmesg: watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [test_progs:25056] Cc: stable@vger.kernel.org Fixes: 5dc615520c4d ("LoongArch: Add BPF JIT support") Reviewed-by: Hengqi Chen Signed-off-by: Haoran Jiang Signed-off-by: Huacai Chen commit 6abf17d690d83d25f6d00a1a2cd3553c7d20c2d8 Author: Tiezhu Yang Date: Tue Aug 5 19:00:22 2025 +0800 LoongArch: BPF: Add struct ops support for trampoline Use BPF_TRAMP_F_INDIRECT flag to detect struct ops and emit proper prologue and epilogue for this case. With this patch, all of the struct_ops related testcases (except struct_ops_multi_pages) passed on LoongArch. The testcase struct_ops_multi_pages failed is because the actual image_pages_cnt is 40 which is bigger than MAX_TRAMP_IMAGE_PAGES. Before: $ sudo ./test_progs -t struct_ops -d struct_ops_multi_pages ... WATCHDOG: test case struct_ops_module/struct_ops_load executes for 10 seconds... After: $ sudo ./test_progs -t struct_ops -d struct_ops_multi_pages ... #15 bad_struct_ops:OK ... #399 struct_ops_autocreate:OK ... #400 struct_ops_kptr_return:OK ... #401 struct_ops_maybe_null:OK ... #402 struct_ops_module:OK ... #404 struct_ops_no_cfi:OK ... #405 struct_ops_private_stack:SKIP ... #406 struct_ops_refcounted:OK Summary: 8/25 PASSED, 3 SKIPPED, 0 FAILED Signed-off-by: Tiezhu Yang Signed-off-by: Huacai Chen commit f9b6b41f0cf31791541cea9644ddbedb46465801 Author: Chenghao Duan Date: Tue Aug 5 19:00:18 2025 +0800 LoongArch: BPF: Add basic bpf trampoline support BPF trampoline is the critical infrastructure of the BPF subsystem, acting as a mediator between kernel functions and BPF programs. Numerous important features, such as using BPF program for zero overhead kernel introspection, rely on this key component. The related tests have passed, including the following technical points: 1. fentry 2. fmod_ret 3. fexit The following related testcases passed on LoongArch: sudo ./test_progs -a fentry_test/fentry sudo ./test_progs -a fexit_test/fexit sudo ./test_progs -a fentry_fexit sudo ./test_progs -a modify_return sudo ./test_progs -a fexit_sleep sudo ./test_progs -a test_overhead sudo ./test_progs -a trampoline_count This issue was first reported by Geliang Tang in June 2024 while debugging MPTCP BPF selftests on a LoongArch machine (see commit eef0532e900c "selftests/bpf: Null checks for links in bpf_tcp_ca"). Geliang, Huacai, and Tiezhu then worked together to drive the implementation of this feature, encouraging broader collaboration among Chinese kernel engineers. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507100034.wXofj6VX-lkp@intel.com/ Reported-by: Geliang Tang Tested-by: Tiezhu Yang Tested-by: Vincent Li Co-developed-by: George Guo Signed-off-by: George Guo Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit 9fbd18cf4c69f512f7de3ab73235078f3e32ecec Author: Chenghao Duan Date: Tue Aug 5 19:00:18 2025 +0800 LoongArch: BPF: Add dynamic code modification support This commit adds support for BPF dynamic code modification on the LoongArch architecture: 1. Add bpf_arch_text_copy() for instruction block copying. 2. Add bpf_arch_text_poke() for runtime instruction patching. 3. Add bpf_arch_text_invalidate() for code invalidation. On LoongArch, since symbol addresses in the direct mapping region can't be reached via relative jump instructions from the paged mapping region, we use the move_imm+jirl instruction pair as absolute jump instructions. These require 2-5 instructions, so we reserve 5 NOP instructions in the program as placeholders for function jumps. The larch_insn_text_copy() function is solely used for BPF. And the use of larch_insn_text_copy() requires PAGE_SIZE alignment. Currently, only the size of the BPF trampoline is page-aligned. Co-developed-by: George Guo Signed-off-by: George Guo Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit ed1a1fe6ec5e73b23b310b434ace07d1e5060657 Author: Chenghao Duan Date: Tue Aug 5 19:00:18 2025 +0800 LoongArch: BPF: Rename and refactor validate_code() 1. Rename the existing validate_code() to validate_ctx() 2. Factor out the code validation handling into a new helper validate_code() Then: * validate_code() is used to check the validity of code. * validate_ctx() is used to check both code validity and table entry correctness. The new validate_code() will be used in subsequent changes. Reviewed-by: Hengqi Chen Co-developed-by: George Guo Signed-off-by: George Guo Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit eec8e8c048caa826ecbde7bf40f0ac2d11eef99d Author: Dmitry Baryshkov Date: Fri Aug 1 13:46:41 2025 +0300 drm/bridge: document HDMI CEC callbacks Provide documentation for the drm_bridge callbacks related to the DRM_BRIDGE_OP_HDMI_CEC_ADAPTER flag. Fixes: a74288c8ded7 ("drm/display: bridge-connector: handle CEC adapters") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/r/20250611140933.1429a1b8@canb.auug.org.au Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250801-drm-hdmi-cec-docs-v1-1-be63e6008d0e@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 6a20f9fca30c4047488a616b5225acb82367ef6b Author: Jason Wang Date: Tue Jul 29 15:39:16 2025 +0800 vhost: initialize vq->nheads properly Commit 7918bb2d19c9 ("vhost: basic in order support") introduces vq->nheads to store the number of batched used buffers per used elem but it forgets to initialize the vq->nheads to NULL in vhost_dev_init() this will cause kfree() that would try to free it without be allocated if SET_OWNER is not called. Reported-by: JAEHOON KIM Reported-by: Breno Leitao Fixes: 45347e79b544 ("vhost: basic in order support") Signed-off-by: Jason Wang Message-Id: <20250729073916.80647-1-jasowang@redhat.com> Reviewed-by: Dawid Osuchowski Tested-by: Breno Leitao Reviewed-by: Stefano Garzarella Tested-by: Jaehoon Kim Signed-off-by: Michael S. Tsirkin commit 9ba0a63badc8e74ac0d490f9113300dda0ce2c19 Author: Lorenzo Pieralisi Date: Fri Aug 1 09:58:20 2025 +0200 irqchip/gic-v5: Remove IRQD_RESEND_WHEN_IN_PROGRESS for ITS IRQs GICv5 LPI interrupts have an active state hence they cannot retrigger while the interrupt is being handled. Therefore, setting the IRQD_RESEND_WHEN_IN_PROGRESS flag on LPIs is pointless, as the situation this flag caters for cannot happen. Remove it. Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/all/20250801-gic-v5-fixes-6-17-v1-3-4fcedaccf9e6@kernel.org commit a8913d54ab1f9ed871b4e45a7c8a4f7a9949d071 Author: Lorenzo Pieralisi Date: Fri Aug 1 09:58:18 2025 +0200 irqchip/gic-v5: iwb: Fix iounmap probe failure path The 0-day bot reported that on the failure path the driver iounmap()s IWB resources that are managed through devm_ioremap(), which is clearly wrong because the driver would end up unmapping the MMIO resource twice on probing failure. Fix this by removing the error path altogether and by letting devres manage the iounmapping on clean-up. Fixes: 695949d8b16f ("irqchip/gic-v5: Add GICv5 IWB support") Reported-by: kernel test robot Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/all/20250801-gic-v5-fixes-6-17-v1-1-4fcedaccf9e6@kernel.org Closes: https://lore.kernel.org/oe-kbuild-all/202508010038.N3r4ZmII-lkp@intel.com commit 3c3d7dbab2c70a4bca47634d564bf659351c05ca Author: Elad Nachman Date: Sun Aug 3 13:25:48 2025 +0300 irqchip/mvebu-gicp: Clear pending interrupts on init When a kexec'ed kernel boots up, there might be stale unhandled interrupts pending in the interrupt controller. These are delivered as spurious interrupts once the boot CPU enables interrupts. Clear all pending interrupts when the driver is initialized to prevent these spurious interrupts from locking the CPU in an endless loop. Signed-off-by: Elad Nachman Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250803102548.669682-2-enachman@marvell.com commit 02cbf8e0692bd30717b35a3ff5e46460d1d5d471 Author: Lorenzo Pieralisi Date: Mon Aug 4 16:55:53 2025 +0200 irqchip/msi-lib: Fix fwnode refcount in msi_lib_irq_domain_select() Commit 8b65db1e93a2 ("irqchip/msi-lib: Add IRQ_DOMAIN_FLAG_FWNODE_PARENT handling") added logic in msi_lib_irq_domain_select() to match the domain fwnode against the fwnode parent of the fwspec.fwnode. The fwnode_get_parent() caller must call fwnode_handle_put() on the returned pointer value, lest fwnode refcounting for the parent ends up being out of kilter. Fix this by relying on the fwnode_handle clean-up handlers and by incrementing the fwnode refcount regardless of whether parent matching is used or not (the domain selection code already holds a reference before calling msi_lib_irq_domain_select() but to make the exit path more uniform if IRQ_DOMAIN_FLAG_FWNODE_PARENT is not set fwnode_handle_get() is called again on fwspec.fwnode so that the clean-up code is the same for the two matching patterns). Fixes: 8b65db1e93a2 ("irqchip/msi-lib: Add IRQ_DOMAIN_FLAG_FWNODE_PARENT handling") Signed-off-by: Lorenzo Pieralisi Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250804145553.795065-1-lpieralisi@kernel.org commit cb9f6a40382ca7b7a81d6f52285f897b09b5851b Author: Thomas Gleixner Date: Sat Aug 2 12:59:13 2025 +0200 irqchip/riscv-imsic: Don't dereference before NULL pointer check smatch warns about a dereference before check: drivers/irqchip/irq-riscv-imsic-platform.c:317 imsic_irqdomain_init() warn: variable dereferenced before check 'imsic' (see line 311) Cure it by moving the firmware not assignement after the checks. Fixes: 59422904dd98 ("irqchip/riscv-imsic: Convert to msi_create_parent_irq_domain() helper") Reported-by: kernel test robot Reported-by: Dan Carpenter Signed-off-by: Thomas Gleixner Closes: https://lore.kernel.org/r/202507311953.NFVZkr0a-lkp@intel.com/ --- drivers/irqchip/irq-riscv-imsic-platform.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) commit 69f8fe955d0b4a951c3726669ab58360ed562484 Author: Oliver Upton Date: Tue Jul 29 11:23:42 2025 -0700 KVM: arm64: nv: Handle SEAs due to VNCR redirection System register accesses redirected to the VNCR page can also generate external aborts just like any other form of memory access. Route to kvm_handle_guest_sea() for potential APEI handling, falling back to a vSError if the kernel didn't handle the abort. Take the opportunity to throw out the useless kvm_ras.h which provided a helper with a single callsite... Cc: Jiaqi Yan Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250729182342.3281742-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 07f557f60a9a4e15288c29a2924e19e44200db51 Author: Marc Zyngier Date: Wed Jul 30 11:18:28 2025 +0100 KVM: arm64: nv: Properly check ESR_EL2.VNCR on taking a VNCR_EL2 related fault Instead of checking for the ESR_EL2.VNCR bit being set (the only case we should be here), we are actually testing random bits in ESR_EL2.DFSC. 13 obviously being a lucky number, it matches both permission and translation fault status codes, which explains why we never saw it failing. This was found by inspection, while reviewing a vaguely related patch. Whilst we're at it, turn the BUG_ON() into a WARN_ON_ONCE(), as exploding here is just silly. Fixes: 069a05e535496 ("KVM: arm64: nv: Handle VNCR_EL2-triggered faults") Signed-off-by: Marc Zyngier Reviewed-by: Joey Gouly Link: https://lore.kernel.org/r/20250730101828.1168707-1-maz@kernel.org Signed-off-by: Oliver Upton commit 5b432ae5dff5eb2e6acd55473309fdd5c16ff779 Author: Paulo Alcantara Date: Thu Jul 31 20:46:43 2025 -0300 smb: client: fix creating symlinks under POSIX mounts SMB3.1.1 POSIX mounts support native symlinks that are created with IO_REPARSE_TAG_SYMLINK reparse points, so skip the checking of FILE_SUPPORTS_REPARSE_POINTS as some servers might not have it set. Cc: linux-cifs@vger.kernel.org Cc: Ralph Boehme Cc: David Howells Cc: Reported-by: Matthew Richardson Closes: https://marc.info/?i=1124e7cd-6a46-40a6-9f44-b7664a66654b@ed.ac.uk Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 6b445309eec2bc0594f3e24c7777aeef891d386e Author: Paulo Alcantara Date: Thu Jul 31 20:46:42 2025 -0300 smb: client: default to nonativesocket under POSIX mounts SMB3.1.1 POSIX mounts require sockets to be created with NFS reparse points. Cc: linux-cifs@vger.kernel.org Cc: Ralph Boehme Cc: David Howells Cc: Reported-by: Matthew Richardson Closes: https://marc.info/?i=1124e7cd-6a46-40a6-9f44-b7664a66654b@ed.ac.uk Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 4eabe4cc0958e28ceaf592bbb62c234339642e41 Author: Geert Uytterhoeven Date: Sat Aug 2 17:53:02 2025 +0200 dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET When making ZL3073X invisible, it was overlooked that ZL3073X depends on NET, while ZL3073X_I2C and ZL3073X_SPI do not, causing: WARNING: unmet direct dependencies detected for ZL3073X when selected by ZL3073X_I2C WARNING: unmet direct dependencies detected for ZL3073X when selected by ZL3073X_SPI WARNING: unmet direct dependencies detected for ZL3073X Depends on [n]: NET [=n] Selected by [y]: - ZL3073X_I2C [=y] && I2C [=y] Selected by [y]: - ZL3073X_SPI [=y] && SPI [=y] Fix this by adding the missing dependencies to ZL3073X_I2C and ZL3073X_SPI. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202508022110.nTqZ5Ylu-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202508022351.NHIxPF8j-lkp@intel.com/ Fixes: a4f0866e3dbbf3fe ("dpll: Make ZL3073X invisible") Signed-off-by: Geert Uytterhoeven Acked-by: Ivan Vecera Link: https://patch.msgid.link/20250802155302.3673457-1-geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit ffd2dc4c6c49ff4f1e5d34e454a6a55608104c17 Author: Maher Azzouzi Date: Fri Aug 1 17:18:57 2025 -0700 net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing TCA_MQPRIO_TC_ENTRY_INDEX is validated using NLA_POLICY_MAX(NLA_U32, TC_QOPT_MAX_QUEUE), which allows the value TC_QOPT_MAX_QUEUE (16). This leads to a 4-byte out-of-bounds stack write in the fp[] array, which only has room for 16 elements (0–15). Fix this by changing the policy to allow only up to TC_QOPT_MAX_QUEUE - 1. Fixes: f62af20bed2d ("net/sched: mqprio: allow per-TC user input of FP adminStatus") Reviewed-by: Eric Dumazet Signed-off-by: Maher Azzouzi Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20250802001857.2702497-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 175811b8f05f0da3e19b7d3124666649ddde3802 Author: Jakub Kicinski Date: Fri Aug 1 14:27:42 2025 -0700 Revert "net: mdio_bus: Use devm for getting reset GPIO" This reverts commit 3b98c9352511db627b606477fc7944b2fa53a165. Russell says: Using devm_*() [here] is completely wrong, because this is called from mdiobus_register_device(). This is not the probe function for the device, and thus there is no code to trigger the release of the resource on unregistration. Moreover, when the mdiodev is eventually probed, if the driver fails or the driver is unbound, the GPIO will be released, but a reference will be left behind. Using devm* with a struct device that is *not* currently being probed is fundamentally wrong - an abuse of devm. Reported-by: Mark Brown Link: https://lore.kernel.org/95449490-fa58-41d4-9493-c9213c1f2e7d@sirena.org.uk Suggested-by: Russell King (Oracle) Fixes: 3b98c9352511 ("net: mdio_bus: Use devm for getting reset GPIO") Link: https://patch.msgid.link/20250801212742.2607149-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5ef7fdf52c0f2b792802aac3438e67e5ebe7e63d Author: Jakub Kicinski Date: Fri Aug 1 11:16:38 2025 -0700 selftests: net: packetdrill: xfail all problems on slow machines We keep seeing flakes on packetdrill on debug kernels, while non-debug kernels are stable, not a single flake in 200 runs. Time to give up, debug kernels appear to suffer from 10msec latency spikes and any timing-sensitive test is bound to flake. Reviewed-by: Willem de Bruijn Acked-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250801181638.2483531-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 01d3c8417b9c1b884a8a981a3b886da556512f36 Author: Quang Le Date: Fri Aug 1 13:54:16 2025 -0400 net/packet: fix a race in packet_set_ring() and packet_notifier() When packet_set_ring() releases po->bind_lock, another thread can run packet_notifier() and process an NETDEV_UP event. This race and the fix are both similar to that of commit 15fe076edea7 ("net/packet: fix a race in packet_bind() and packet_notifier()"). There too the packet_notifier NETDEV_UP event managed to run while a po->bind_lock critical section had to be temporarily released. And the fix was similarly to temporarily set po->num to zero to keep the socket unhooked until the lock is retaken. The po->bind_lock in packet_set_ring and packet_notifier precede the introduction of git history. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Quang Le Signed-off-by: Willem de Bruijn Link: https://patch.msgid.link/20250801175423.2970334-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit 5a40f8af2ba1b9bdf46e2db10e8c9710538fbc63 Author: Michal Schmidt Date: Fri Aug 1 12:13:37 2025 +0200 benet: fix BUG when creating VFs benet crashes as soon as SRIOV VFs are created: kernel BUG at mm/vmalloc.c:3457! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 4 UID: 0 PID: 7408 Comm: test.sh Kdump: loaded Not tainted 6.16.0+ #1 PREEMPT(voluntary) [...] RIP: 0010:vunmap+0x5f/0x70 [...] Call Trace: __iommu_dma_free+0xe8/0x1c0 be_cmd_set_mac_list+0x3fe/0x640 [be2net] be_cmd_set_mac+0xaf/0x110 [be2net] be_vf_eth_addr_config+0x19f/0x330 [be2net] be_vf_setup+0x4f7/0x990 [be2net] be_pci_sriov_configure+0x3a1/0x470 [be2net] sriov_numvfs_store+0x20b/0x380 kernfs_fop_write_iter+0x354/0x530 vfs_write+0x9b9/0xf60 ksys_write+0xf3/0x1d0 do_syscall_64+0x8c/0x3d0 be_cmd_set_mac_list() calls dma_free_coherent() under a spin_lock_bh. Fix it by freeing only after the lock has been released. Fixes: 1a82d19ca2d6 ("be2net: fix sleeping while atomic bugs in be_ndo_bridge_getlink") Signed-off-by: Michal Schmidt Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250801101338.72502-1-mschmidt@redhat.com Signed-off-by: Jakub Kicinski commit 4e7e471e2e3f9085fe1dbe821c4dd904a917c66a Author: Lorenzo Bianconi Date: Fri Aug 1 09:12:25 2025 +0200 net: airoha: npu: Add missing MODULE_FIRMWARE macros Introduce missing MODULE_FIRMWARE definitions for firmware autoload. Fixes: 23290c7bc190d ("net: airoha: Introduce Airoha NPU support") Signed-off-by: Lorenzo Bianconi Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250801-airoha-npu-missing-module-firmware-v2-1-e860c824d515@kernel.org Signed-off-by: Jakub Kicinski commit fa516c0d8bf90da9d5b168757162205aafe5d0e1 Author: Jakub Kicinski Date: Thu Jul 31 18:13:35 2025 -0700 net: devmem: fix DMA direction on unmapping Looks like we always unmap the DMA_BUF with DMA_FROM_DEVICE direction. While at it unexport __net_devmem_dmabuf_binding_free(), it's internal. Found by code inspection. Fixes: bd61848900bf ("net: devmem: Implement TX path") Acked-by: Stanislav Fomichev Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250801011335.2267515-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2df158047d532d0e2a6b39953656c738872151a3 Author: Arnd Bergmann Date: Thu Jul 31 10:00:20 2025 +0200 ipa: fix compile-testing with qcom-mdt=m There are multiple drivers that use the qualcomm mdt loader, but they have conflicting ideas of how to deal with that dependency when compile-testing for non-qualcomm targets: IPA only enables the MDT loader when the kernel config includes ARCH_QCOM, but the newly added ath12k support always enables it, which leads to a link failure with the combination of IPA=y and ATH12K=m: aarch64-linux-ld: drivers/net/ipa/ipa_main.o: in function `ipa_firmware_load': ipa_main.c:(.text.unlikely+0x134): undefined reference to `qcom_mdt_load The ATH12K method seems more reliable here, so change IPA over to do the same thing. Fixes: 38a4066f593c ("net: ipa: support COMPILE_TEST") Fixes: c0dd3f4f7091 ("wifi: ath12k: enable ath12k AHB support") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250731080024.2054904-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 4b31bcb025cb497da2b01f87173108ff32d350d2 Author: Jakub Kicinski Date: Mon Jul 28 09:31:29 2025 -0700 eth: fbnic: unlink NAPIs from queues on error to open CI hit a UaF in fbnic in the AF_XDP portion of the queues.py test. The UaF is in the __sk_mark_napi_id_once() call in xsk_bind(), NAPI has been freed. Looks like the device failed to open earlier, and we lack clearing the NAPI pointer from the queue. Fixes: 557d02238e05 ("eth: fbnic: centralize the queue count and NAPI<>queue setting") Reviewed-by: Alexander Duyck Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250728163129.117360-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 7e161a991ea71e6ec526abc8f40c6852ebe3d946 Merge: 0974f486f3dde9 33ac5155891cab Author: Linus Torvalds Date: Mon Aug 4 16:37:29 2025 -0700 Merge tag 'i2c-for-6.17-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull more i2c updates from Wolfram Sang: "A few more patches from I2C. Some are fixes which would be nice to have in rc1 already, some patches have nearly been fallen through the cracks, some just needed a bit more testing. - acpi: enable 100kHz workaround for DLL0945 - apple: add support for Apple A7–A11, T2 chips; Kconfig update - mux: mule: fix error handling path - qcom-geni: fix controller frequency mapping - stm32f7: add DMA-safe transfer support - tegra: use controller reset if device reset is missing - tegra: remove unnecessary dma_sync*() calls" * tag 'i2c-for-6.17-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() i2c: Force DLL0945 touchpad i2c freq to 100khz i2c: apple: Drop default ARCH_APPLE in Kconfig i2c: qcom-geni: fix I2C frequency table to achieve accurate bus rates dt-bindings: i2c: apple,i2c: Document Apple A7-A11, T2 compatibles i2c: tegra: Remove dma_sync_*() calls i2c: tegra: Use internal reset when reset property is not available i2c: stm32f7: support i2c_*_dma_safe_msg_buf APIs commit 0974f486f3dde9df1ad979d4ff341dc9c2d545f5 Merge: 35a813e010b998 078cad8212ce4f Author: Linus Torvalds Date: Mon Aug 4 16:27:21 2025 -0700 Merge tag 'f2fs-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs Pull f2fs updates from Jaegeuk Kim: "Three main updates: folio conversion by Matthew, switch to a new mount API by Hongbo and Eric, and several sysfs entries to tune GCs for ZUFS with finer granularity by Daeho. There are also patches to address bugs and issues in the existing features such as GCs, file pinning, write-while-dio-read, contingous block allocation, and memory access violations. Enhancements: - switch to new mount API and folio conversion - add sysfs nodes to controle F2FS GCs for ZUFS - improve performance on the nat entry cache - drop inode from the donation list when the last file is closed - avoid splitting bio when reading multiple pages Bug fixes: - fix to trigger foreground gc during f2fs_map_blocks() in lfs mode - make sure zoned device GC to use FG_GC in shortage of free section - fix to calculate dirty data during has_not_enough_free_secs() - fix to update upper_p in __get_secs_required() correctly - wait for inflight dio completion, excluding pinned files read using dio - don't break allocation when crossing contiguous sections - vm_unmap_ram() may be called from an invalid context - fix to avoid out-of-boundary access in dnode page - fix to avoid panic in f2fs_evict_inode - fix to avoid UAF in f2fs_sync_inode_meta() - fix to use f2fs_is_valid_blkaddr_raw() in do_write_page() - fix UAF of f2fs_inode_info in f2fs_free_dic - fix to avoid invalid wait context issue - fix bio memleak when committing super block - handle nat.blkaddr corruption in f2fs_get_node_info() In addition, there are also clean-ups and minor bug fixes" * tag 'f2fs-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (109 commits) f2fs: drop inode from the donation list when the last file is closed f2fs: add gc_boost_gc_greedy sysfs node f2fs: add gc_boost_gc_multiple sysfs node f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode f2fs: fix to calculate dirty data during has_not_enough_free_secs() f2fs: fix to update upper_p in __get_secs_required() correctly f2fs: directly add newly allocated pre-dirty nat entry to dirty set list f2fs: avoid redundant clean nat entry move in lru list f2fs: zone: wait for inflight dio completion, excluding pinned files read using dio f2fs: ignore valid ratio when free section count is low f2fs: don't break allocation when crossing contiguous sections f2fs: remove unnecessary tracepoint enabled check f2fs: merge the two conditions to avoid code duplication f2fs: vm_unmap_ram() may be called from an invalid context f2fs: fix to avoid out-of-boundary access in dnode page f2fs: switch to the new mount api f2fs: introduce fs_context_operation structure f2fs: separate the options parsing and options checking f2fs: Add f2fs_fs_context to record the mount options f2fs: Allow sbi to be NULL in f2fs_printk ... commit ce0b5eedcb753697d43f61dd2e27d68eb5d3150f Author: Thomas Gleixner Date: Thu Jul 24 12:49:30 2025 +0200 x86/irq: Plug vector setup race Hogan reported a vector setup race, which overwrites the interrupt descriptor in the per CPU vector array resulting in a disfunctional device. CPU0 CPU1 interrupt is raised in APIC IRR but not handled free_irq() per_cpu(vector_irq, CPU1)[vector] = VECTOR_SHUTDOWN; request_irq() common_interrupt() d = this_cpu_read(vector_irq[vector]); per_cpu(vector_irq, CPU1)[vector] = desc; if (d == VECTOR_SHUTDOWN) this_cpu_write(vector_irq[vector], VECTOR_UNUSED); free_irq() cannot observe the pending vector in the CPU1 APIC as there is no way to query the remote CPUs APIC IRR. This requires that request_irq() uses the same vector/CPU as the one which was freed, but this also can be triggered by a spurious interrupt. Interestingly enough this problem managed to be hidden for more than a decade. Prevent this by reevaluating vector_irq under the vector lock, which is held by the interrupt activation code when vector_irq is updated. To avoid ifdeffery or IS_ENABLED() nonsense, move the [un]lock_vector_lock() declarations out under the CONFIG_IRQ_DOMAIN_HIERARCHY guard as it's only provided when CONFIG_X86_LOCAL_APIC=y. The current CONFIG_IRQ_DOMAIN_HIERARCHY guard is selected by CONFIG_X86_LOCAL_APIC, but can also be selected by other parts of the Kconfig system, which makes 32-bit UP builds with CONFIG_X86_LOCAL_APIC=n fail. Can we just get rid of this !APIC nonsense once and forever? Fixes: 9345005f4eed ("x86/irq: Fix do_IRQ() interrupt warning for cpu hotplug retriggered irqs") Reported-by: Hogan Wang Signed-off-by: Thomas Gleixner Tested-by: Hogan Wang Link: https://lore.kernel.org/all/draft-87ikjhrhhh.ffs@tglx commit 124ffa2970087f3b9033a00a4855748514225b9d Author: Jesse.Zhang Date: Mon Aug 4 08:43:15 2025 +0800 drm/amdgpu: Update SDMA firmware version check for user queue support This commit fixes a firmware version check for enabling user queue support in SDMA v7.0. The previous version check (7836028) was incorrect and could lead to issues with PROTECTED_FENCE_SIGNAL commands causing register conflicts between MCU_DBG0 and MCU_DBG1. Fixes: 8c011408ed84 ("drm/amdgpu/sdma7: add ucode version checks for userq support") Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher (cherry picked from commit 92e2449241516c95aab95eea91faecd0fa2b7ed5) Cc: stable@vger.kernel.org commit c2fe914d50ab22defca14ac6fca33888bfb19843 Author: Lijo Lazar Date: Fri Jul 18 09:25:21 2025 +0530 drm/amdgpu: Add NULL check for asic_funcs If driver load fails too early, asic_funcs pointer remains unassigned. Add NULL check to sanitize unwind path. Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit 582bf7c5158dce16f7dc5b8345b7876bd8031224) Cc: stable@vger.kernel.org commit 8e6a18cbf3ee2c1e3d0afd8d3debd0ba8738ad0c Author: Mario Limonciello Date: Sun Jul 20 23:39:41 2025 -0500 drm/amd/display: Revert "drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value" This reverts commit 66abb996999de0d440a02583a6e70c2c24deab45. This broke custom brightness curves but it wasn't obvious because of other related changes. Custom brightness curves are always from a 0-255 input signal. The correct fix was to fix the default value which was done by [1]. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4412 Link: https://lore.kernel.org/amd-gfx/0f094c4b-d2a3-42cd-824c-dc2858a5618d@kernel.org/T/#m69f875a7e69aa22df3370b3e3a9e69f4a61fdaf2 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 6ec8a5cbec751625133461600d0d4950ffd3a214) Cc: stable@vger.kernel.org commit 1bcf63a44381691d6192872801f830ce3250e367 Author: Siyang Liu Date: Fri Jul 4 11:16:22 2025 +0800 drm/amd/display: fix a Null pointer dereference vulnerability [Why] A null pointer dereference vulnerability exists in the AMD display driver's (DC module) cleanup function dc_destruct(). When display control context (dc->ctx) construction fails (due to memory allocation failure), this pointer remains NULL. During subsequent error handling when dc_destruct() is called, there's no NULL check before dereferencing the perf_trace member (dc->ctx->perf_trace), causing a kernel null pointer dereference crash. [How] Check if dc->ctx is non-NULL before dereferencing. Link: https://lore.kernel.org/r/tencent_54FF4252EDFB6533090A491A25EEF3EDBF06@qq.com Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello (Updated commit text and removed unnecessary error message) Signed-off-by: Siyang Liu Signed-off-by: Roman Li Reviewed-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher (cherry picked from commit 9dd8e2ba268c636c240a918e0a31e6feaee19404) Cc: stable@vger.kernel.org commit 3477c1b0972dc1c8a46f78e8fb1fa6966095b5ec Author: Michel Dänzer Date: Wed Jul 30 10:09:02 2025 +0200 drm/amd/display: Add primary plane to commits for correct VRR handling amdgpu_dm_commit_planes calls update_freesync_state_on_stream only for the primary plane. If a commit affects a CRTC but not its primary plane, it would previously not trigger a refresh cycle or affect LFC, violating current UAPI semantics. Fixes e.g. atomic commits affecting only the cursor plane being limited to the minimum refresh rate. Don't do this for the legacy cursor ioctls though, it would break the UAPI semantics for those. Suggested-by: Xaver Hugl Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3034 Signed-off-by: Michel Dänzer Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher (cherry picked from commit cc7bfba95966251b254cb970c21627124da3b7f4) Cc: stable@vger.kernel.org commit 9f9bddfa31d87b084700a6e9eca1a8b4f8ddcdf6 Author: Alex Deucher Date: Fri Jul 18 15:53:21 2025 -0400 drm/amdgpu: update mmhub 3.3 client id mappings Update the client id mapping so the correct clients get printed when there is a mmhub page fault. v2: fix typos spotted by David Wu. v3: fix additional typo spotted by David. Reviewed-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher (cherry picked from commit e932f4779a2d329841bb9ca70bb80a4bb2d707b6) Cc: stable@vger.kernel.org commit 0bae62cc989fa99ac9cb564eb573aad916d1eb61 Author: Alex Deucher Date: Fri Jul 18 15:52:04 2025 -0400 drm/amdgpu: update mmhub 3.0.1 client id mappings Update the client id mapping so the correct clients get printed when there is a mmhub page fault. Reviewed-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher (cherry picked from commit 2a2681eda73b99a2c1ee8cdb006099ea5d0c2505) Cc: stable@vger.kernel.org commit c00d8b79fd2167c6ac65e096619535acdf8678d5 Author: YuanShang Date: Wed Jul 23 16:44:49 2025 +0800 drm/amdgpu: Retain job->vm in amdgpu_job_prepare_job The field job->vm is used in function amdgpu_job_run to get the page table re-generation counter and decide whether the job should be skipped. Specifically, function amdgpu_vm_generation checks if the VM is valid for this job to use. For instance, if a gfx job depends on a cancelled sdma job from entity vm->delayed, then the gfx job should be skipped. Fixes: 26c95e838e63 ("drm/amdgpu: set the VM pointer to NULL in amdgpu_job_prepare") Signed-off-by: YuanShang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher (cherry picked from commit ed76936c6b10b547c6df4ca75412331e9ef6d339) Cc: stable@vger.kernel.org commit 1c8dc3e088e09531bcdfc9fe348204abc3decb6c Author: Timur Kristóf Date: Tue Jul 22 17:58:30 2025 +0200 drm/amd/display: Fix DCE 6.0 and 6.4 PLL programming. Apparently, both DCE 6.0 and 6.4 have 3 PLLs, but PLL0 can only be used for DP. Make sure to initialize the correct amount of PLLs in DC for these DCE versions and use PLL0 only for DP. Also, on DCE 6.0 and 6.4, the PLL0 needs to be powered on at initialization as opposed to DCE 6.1 and 7.x which use a different clock source for DFS. The following functions were used as reference from the old radeon driver implementation of DCE 6.x: - radeon_atom_pick_pll - atombios_crtc_set_disp_eng_pll Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit 35222b5934ec8d762473592ece98659baf6bc48e) Cc: stable@vger.kernel.org commit 4db9cd554883e051df1840d4d58d636043101034 Author: Timur Kristóf Date: Tue Jul 22 17:58:29 2025 +0200 drm/amd/display: Don't overwrite dce60_clk_mgr dc_clk_mgr_create accidentally overwrites the dce60_clk_mgr with the dce_clk_mgr, causing incorrect behaviour on DCE6. Fix it by removing the extra dce_clk_mgr_construct. Fixes: 62eab49faae7 ("drm/amd/display: hide VGH asic specific structs") Reviewed-by: Rodrigo Siqueira Reviewed-by: Alex Deucher Signed-off-by: Timur Kristóf Signed-off-by: Alex Deucher (cherry picked from commit bbddcbe36a686af03e91341b9bbfcca94bd45fb6) Cc: stable@vger.kernel.org commit f6c0f3d24478a0792e50a64c2eba9f34d65519f2 Author: David Yat Sin Date: Wed Jul 16 22:04:28 2025 +0000 drm/amdkfd: Fix checkpoint-restore on multi-xcc GPUs with multi-xcc have multiple MQDs per queue. This patch saves and restores all the MQDs within the partition. Signed-off-by: David Yat Sin Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher (cherry picked from commit a578f2a58c3ab38f0643b1b6e7534af860233cb1) Cc: stable@vger.kernel.org commit 796ff8a7e01bd18738d3bb4111f9d6f963145d29 Author: Mario Limonciello Date: Thu Jul 24 22:12:22 2025 -0500 drm/amd: Restore cached manual clock settings during resume If the SCLK limits have been set before S3 they will not be restored. The limits are however cached in the driver and so they can be restored by running a commit sequence during resume. Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250725031222.3015095-3-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 4e9526924d09057a9ba854305e17eded900ced82) Cc: stable@vger.kernel.org commit ed4efe426a49729952b3dc05d20e33b94409bdd1 Author: Mario Limonciello Date: Thu Jul 24 22:12:21 2025 -0500 drm/amd: Restore cached power limit during resume The power limit will be cached in smu->current_power_limit but if the ASIC goes into S3 this value won't be restored. Restore the value during SMU resume. Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250725031222.3015095-2-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher (cherry picked from commit 26a609e053a6fc494403e95403bc6a2470383bec) Cc: stable@vger.kernel.org commit 05c8b690511854ba31d8d1bff7139a13ec66b9e7 Author: Lijo Lazar Date: Fri Jul 25 10:21:10 2025 +0530 drm/amdgpu: Update external revid for GC v9.5.0 Use different external revid for GC v9.5.0 SOCs. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher (cherry picked from commit 21c6764ed4bfaecad034bc4fd15dd64c5a436325) Cc: stable@vger.kernel.org commit 389d79a195a9f71a103b39097ee8341a7ca60927 Author: Lijo Lazar Date: Tue Jul 8 13:17:18 2025 +0530 drm/amdgpu: Update supported modes for GC v9.5.0 For GC v9.5.0 SOCs, both CPX and QPX compute modes are also supported in NPS2 mode. Signed-off-by: Lijo Lazar Acked-by: Mangesh Gadre Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher (cherry picked from commit 9d1ac25c7f830e0132aa816393b1e9f140e71148) Cc: stable@vger.kernel.org commit 72332439e6b0a39e763d4604e71774ab83423275 Author: Miquel Raynal Date: Mon Aug 4 11:50:13 2025 +0200 spi: spi-mem: Add missing kdoc argument The "*mem" pointer has been added without description, describe it in the kdoc comment in order to fix the following W=1 warning: Warning: drivers/spi/spi-mem.c:594 function parameter 'mem' not described in 'spi_mem_calc_op_duration' Fixes: a11a51896572 ("spi: spi-mem: Take into account the actual maximum frequency") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507310409.fnuQ21qb-lkp@intel.com/ Signed-off-by: Miquel Raynal Link: https://patch.msgid.link/20250804095013.409700-1-miquel.raynal@bootlin.com Signed-off-by: Mark Brown commit 6bc829220b33da8522572cc50fdf5067c51d3bf3 Author: Gabor Juhos Date: Fri Aug 1 09:58:35 2025 +0200 spi: spi-qpic-snand: use correct CW_PER_PAGE value for OOB write The qcom_spi_program_oob() function uses only the last codeword to write the OOB data into the flash, but it sets the CW_PER_PAGE field in the CFG0 register as it would use all codewords. It seems that this confuses the hardware somehow, and any access to the flash fails with a timeout error after the function is called. The problem can be easily reproduced with the following commands: # dd if=/dev/zero bs=2176 count=1 > /tmp/test.bin 1+0 records in 1+0 records out # flash_erase /dev/mtd4 0 0 Erasing 128 Kibyte @ 0 -- 100 % complete # nandwrite -O /dev/mtd4 /tmp/test.bin Writing data to block 0 at offset 0x0 # nanddump -o /dev/mtd4 >/dev/null ECC failed: 0 ECC corrected: 0 Number of bad blocks: 0 Number of bbt blocks: 0 Block size 131072, page size 2048, OOB size 128 Dumping data starting at 0x00000000 and ending at 0x00020000... [ 33.197605] qcom_snand 79b0000.spi: failure to read oob libmtd: error!: MEMREADOOB64 ioctl failed for mtd4, offset 0 (eraseblock 0) error 110 (Operation timed out) [ 35.277582] qcom_snand 79b0000.spi: failure in submitting cmd descriptor libmtd: error!: cannot read 2048 bytes from mtd4 (eraseblock 0, offset 2048) error 110 (Operation timed out) nanddump: error!: mtd_read Change the code to use the correct CW_PER_PAGE value to avoid this. Fixes: 7304d1909080 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface") Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250801-qpic-snand-oob-cwpp-fix-v1-1-f5a41b86af2e@gmail.com Signed-off-by: Mark Brown commit dbe05428c4e54068a86e7e02405f3b30b1d2b3dd Author: Thomas Croft Date: Mon Aug 4 09:12:07 2025 -0600 ALSA: hda/realtek: add LG gram 16Z90R-A to alc269 fixup table Several months ago, Joshua Grisham submitted a patch [1] for several ALC298 based sound cards. The entry for the LG gram 16 in the alc269_fixup_tbl only matches the Subsystem ID for the 16Z90R-Q and 16Z90R-K models [2]. My 16Z90R-A has a different Subsystem ID [3]. I'm not sure why these IDs differ, but I speculate it's due to the NVIDIA GPU included in the 16Z90R-A model that isn't present in the other models. I applied the patch to the latest Arch Linux kernel and the card was initialized as expected. [1]: https://lore.kernel.org/linux-sound/20240909193000.838815-1-josh@joshuagrisham.com/ [2]: https://linux-hardware.org/?id=pci:8086-51ca-1854-0488 [3]: https://linux-hardware.org/?id=pci:8086-51ca-1854-0489 Signed-off-by: Thomas Croft Link: https://patch.msgid.link/20250804151457.134761-2-thomasmcft@gmail.com Signed-off-by: Takashi Iwai commit 35a813e010b99894bb4706c56c16a580bf7959c2 Merge: 99b773d720aeea 3db488c8ed9cb1 Author: Linus Torvalds Date: Mon Aug 4 10:54:36 2025 -0700 Merge tag 'printk-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux Pull printk updates from Petr Mladek: - Add new "hash_pointers=[auto|always|never]" boot parameter to force the hashing even with "slab_debug" enabled - Allow to stop CPU, after losing nbcon console ownership during panic(), even without proper NMI - Allow to use the printk kthread immediately even for the 1st registered nbcon - Compiler warning removal * tag 'printk-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux: printk: nbcon: Allow reacquire during panic printk: Allow to use the printk kthread immediately even for 1st nbcon slab: Decouple slab_debug and no_hash_pointers vsprintf: Use __diag macros to disable '-Wsuggest-attribute=format' compiler-gcc.h: Introduce __diag_GCC_all commit 99b773d720aeea1ef2170dce5fcfa80649e26b78 Author: Peter Zijlstra Date: Tue Jul 15 15:11:14 2025 -0400 sched/psi: Fix psi_seq initialization With the seqcount moved out of the group into a global psi_seq, re-initializing the seqcount on group creation is causing seqcount corruption. Fixes: 570c8efd5eb7 ("sched/psi: Optimize psi_group_change() cpu_clock() usage") Reported-by: Chris Mason Suggested-by: Beata Michalska Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Linus Torvalds commit b9defd611abf3d24354e14c8d85da14c7abaa07e Author: Trond Myklebust Date: Sun Aug 3 16:32:00 2025 -0700 NFSv4: Remove duplicate lookups, capability probes and fsinfo calls When crossing into a new filesystem, the NFSv4 client will look up the new directory, and then call nfs4_server_capabilities() as well as nfs4_do_fsinfo() at least twice. This patch removes the duplicate calls, and reduces the initial lookup to retrieve just a minimal set of attributes. Reviewed-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit b01f21cacde9f2878492cf318fee61bf4ccad323 Author: Trond Myklebust Date: Sun Aug 3 14:31:59 2025 -0700 NFS: Fix the setting of capabilities when automounting a new filesystem Capabilities cannot be inherited when we cross into a new filesystem. They need to be reset to the minimal defaults, and then probed for again. Fixes: 54ceac451598 ("NFS: Share NFS superblocks per-protocol per-server per-FSID") Cc: stable@vger.kernel.org Reviewed-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit 022906afdf90327bce33d52fb4fb41b6c7d618fb Author: Simon Richter Date: Sat Aug 2 11:40:36 2025 +0900 Mark xe driver as BROKEN if kernel page size is not 4kB This driver, for the time being, assumes that the kernel page size is 4kB, so it fails on loong64 and aarch64 with 16kB pages, and ppc64el with 64kB pages. Signed-off-by: Simon Richter Reviewed-by: Thomas Hellström Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org # v6.8+ Signed-off-by: Thomas Hellström Link: https://lore.kernel.org/r/20250802024152.3021-1-Simon.Richter@hogyros.de (cherry picked from commit 0521a868222ffe636bf202b6e9d29292c1e19c62) Signed-off-by: Rodrigo Vivi commit cb7a3f949aa4804ed8e0553d0196a4ce048ff7b8 Author: Michal Wajdeczko Date: Fri Aug 1 16:28:21 2025 +0200 drm/xe/pf: Make sure PF is ready to configure VFs The PF driver might be resumed just to configure VFs, but since it is doing some asynchronous GuC reconfigurations after fresh reset, we should wait until all pending works are completed. This is especially important in case of LMEM provisioning, since we also need to update the LMTT and send invalidation requests to all GuCs, which are expected to be already in the VGT mode. Fixes: 68ae022278a1 ("drm/xe/pf: Force GuC virtualization mode") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Cc: Jonathan Cavitt Link: https://lore.kernel.org/r/20250801142822.180530-3-michal.wajdeczko@intel.com (cherry picked from commit c6c86441c465ea440dfb5039f1c26e629a6fd64c) Signed-off-by: Rodrigo Vivi commit c286ce6b01f633806b4db3e4ec8e0162928299cd Author: Michal Wajdeczko Date: Fri Aug 1 16:28:20 2025 +0200 drm/xe/pf: Disable PF restart worker on device removal We can't let restart worker run once device is removed, since other data that it might want to access could be already released. Explicitly disable worker as part of device cleanup action. Fixes: a4d1c5d0b99b ("drm/xe/pf: Move VFs reprovisioning to worker") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Cc: Jonathan Cavitt Link: https://lore.kernel.org/r/20250801142822.180530-2-michal.wajdeczko@intel.com (cherry picked from commit a424353937c24554bb242a6582ed8f018b4a411c) Signed-off-by: Rodrigo Vivi commit 465f1dba74c010995190bff267ae5a75afcdcfea Author: Balasubramani Vivekanandan Date: Fri Aug 1 10:53:56 2025 +0530 drm/xe/devcoredump: Defer devcoredump initialization during probe Doing devcoredump initializing before GT though look harmless, it leads to problem during driver unbind. Because of this order, GT/Engine release functions will be called before xe devcoredump release function (xe_driver_devcoredump_fini) leading to the following kernel crash[1] because the devcoredump functions might still use GT/Engine datastructures after those are freed. The following crash is observed while running the IGT xe_wedged@wedged-at-any-timeout. The test forces a wedged state by submitting a workload which hangs. Then does a unbind/rebind of the driver to recover from the wedged state. The hanged workload leads to a devcoredump. The following crash is noticed when the devcoredump capture races with the driver unbind. During driver unbind, the release function hw_engine_fini() will be called which assigns NULL to hwe->gt. But the same data structure is accessed during the coredump capture in the function xe_engine_snapshot_print by reading snapshot->hwe->gt. With this patch, we make sure the devcoredump is stopped before deinitializing the core driver functions. [1]: BUG: kernel NULL pointer dereference, address: 0000000000000000 Workqueue: events_unbound xe_devcoredump_deferred_snap_work [xe] RIP: 0010:xe_engine_snapshot_print+0x47/0x420 [xe] Call Trace: ? drm_printf+0x64/0x90 __xe_devcoredump_read+0x23f/0x2d0 [xe] ? __pfx___drm_printfn_coredump+0x10/0x10 ? __pfx___drm_puts_coredump+0x10/0x10 xe_devcoredump_deferred_snap_work+0x17a/0x190 [xe] process_one_work+0x22e/0x6f0 worker_thread+0x1e8/0x3d0 ? __pfx_worker_thread+0x10/0x10 kthread+0x11f/0x250 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x47/0x70 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 v2: Detailed commit description (Rodrigo) v3: FIXME added (Rodrigo, Stuart) Fixes: 4209d635a823 ("drm/xe: Remove devcoredump during driver release") Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250731061300.14320-1-balasubramani.vivekanandan@intel.com Signed-off-by: Balasubramani Vivekanandan Link: https://lore.kernel.org/r/20250801052356.21885-1-balasubramani.vivekanandan@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 1fdc4c381ff765479d76ccf3134717c430c871b8) Signed-off-by: Rodrigo Vivi commit d632ab86aff2cef21f794e337a8e7f2320ac3973 Merge: 69917dbfb67e5e 55a0fbd2ac3fe8 Author: Linus Torvalds Date: Mon Aug 4 08:58:53 2025 -0700 Merge tag 'for-6.17/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mikulas Patocka: - fix checking for request-based stackable devices (dm-table) - fix corrupt_bio_byte setup checks (dm-flakey) - add support for resync w/o metadata devices (dm raid) - small code simplification (dm, dm-mpath, vm-vdo, dm-raid) - remove support for asynchronous hashes (dm-verity) - close smatch warning (dm-zoned-target) - update the documentation and enable inline-crypto passthrough (dm-thin) * tag 'for-6.17/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm: set DM_TARGET_PASSES_CRYPTO feature for dm-thin dm-thin: update the documentation dm-raid: do not include dm-core.h vdo: omit need_resched() before cond_resched() md: dm-zoned-target: Initialize return variable r to avoid uninitialized use dm-verity: remove support for asynchronous hashes dm-mpath: don't print the "loaded" message if registering fails dm-mpath: make dm_unregister_path_selector return void dm: ima: avoid extra calls to strlen() dm: Simplify dm_io_complete() dm: Remove unnecessary return in dm_zone_endio() dm raid: add support for resync w/o metadata devices dm-flakey: Fix corrupt_bio_byte setup checks dm-table: fix checking for rq stackable devices commit df9bdd4381be100a778c63a5dd810dc82b8c2705 Author: Michal Wajdeczko Date: Tue Jul 22 20:26:16 2025 +0200 drm/xe/pf: Enable SR-IOV PF mode by default We already claim official support for SR-IOV PF/VF modes on PTL and BMG platforms, but by default we start the Xe driver on those platforms in non-virtualized mode (native) since we still have max_vfs modparam set to disable creation of the VFs. It's time to let the Xe driver support SR-IOV PF mode by default. We were already testing this on our CI, which was relying on the patch that was enabling it for CONFIG_DRM_XE_DEBUG used by our CI. Signed-off-by: Michal Wajdeczko Cc: Thomas Hellstrom Cc: Lucas De Marchi Cc: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250722182618.30811-3-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit a2b461bd6f3b36bded0a74178dec0e58e4714d3d) Signed-off-by: Rodrigo Vivi commit 69917dbfb67e5e7869b67425e2c799aea4d00874 Merge: 8b45c6c90af670 f0eedcf22581ca Author: Linus Torvalds Date: Mon Aug 4 08:37:46 2025 -0700 Merge tag 'for-linus' of https://github.com/openrisc/linux Pull OpenRISC updates from Stafford Horne: - Replace __ASSEMBLY__ with __ASSEMBLER__ in headers (Thomas Huth) * tag 'for-linus' of https://github.com/openrisc/linux: openrisc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers openrisc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers commit 407728da41cd6450cec6a4277027015a75744d56 Author: Christophe JAILLET Date: Sat Aug 2 09:25:59 2025 +0200 block, bfq: Reorder struct bfq_iocq_bfqq_data The size of struct bfq_iocq_bfqq_data can be reduced by moving a few fields around. On a x86_64, with allmodconfig, this shrinks the size from 144 to 128 bytes. The main benefit is to reduce the size of struct bfq_io_cq from 1360 to 1232. This structure is stored in a dedicated slab cache. So reducing its size improves cache usage. Signed-off-by: Christophe JAILLET Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/79394db1befaa658e8066b8e3348073ce27d9d26.1754119538.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jens Axboe commit 8b45c6c90af6702b2ad716e148b8bcd5231a8070 Merge: d2eedaa3909be9 5f49c2d1f422c6 Author: Linus Torvalds Date: Mon Aug 4 08:17:28 2025 -0700 Merge tag 'apparmor-pr-2025-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor Pull apparmor updates from John Johansen: "This has one major feature, it pulls in a cleaned up version of af_unix mediation that Ubuntu has been carrying for years. It is placed behind a new abi to ensure that it does cause policy regressions. With pulling in the af_unix mediation there have been cleanups and some refactoring of network socket mediation. This accounts for the majority of the changes in the diff. In addition there are a few improvements providing minor code optimizations. several code cleanups, and bug fixes. Features: - improve debug printing - carry mediation check on label (optimization) - improve ability for compiler to optimize __begin_current_label_crit_section - transition for a linked list of rulesets to a vector of rulesets - don't hardcode profile signal, allow it to be set by policy - ability to mediate caps via the state machine instead of lut - Add Ubuntu af_unix mediation, put it behind new v9 abi Cleanups: - fix typos and spelling errors - cleanup kernel doc and code inconsistencies - remove redundant checks/code - remove unused variables - Use str_yes_no() helper function - mark tables static where appropriate - make all generated string array headers const char *const - refactor to doc semantics of file_perm checks - replace macro calls to network/socket fns with explicit calls - refactor/cleanup socket mediation code preparing for finer grained mediation of different network families - several updates to kernel doc comments Bug fixes: - fix incorrect profile->signal range check - idmap mount fixes - policy unpack unaligned access fixes - kfree_sensitive() where appropriate - fix oops when freeing policy - fix conflicting attachment resolution - fix exec table look-ups when stacking isn't first - fix exec auditing - mitigate userspace generating overly large xtables" * tag 'apparmor-pr-2025-08-04' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (60 commits) apparmor: fix: oops when trying to free null ruleset apparmor: fix Regression on linux-next (next-20250721) apparmor: fix test error: WARNING in apparmor_unix_stream_connect apparmor: Remove the unused variable rules apparmor: fix: accept2 being specifie even when permission table is presnt apparmor: transition from a list of rules to a vector of rules apparmor: fix documentation mismatches in val_mask_to_str and socket functions apparmor: remove redundant perms.allow MAY_EXEC bitflag set apparmor: fix kernel doc warnings for kernel test robot apparmor: Fix unaligned memory accesses in KUnit test apparmor: Fix 8-byte alignment for initial dfa blob streams apparmor: shift uid when mediating af_unix in userns apparmor: shift ouid when mediating hard links in userns apparmor: make sure unix socket labeling is correctly updated. apparmor: fix regression in fs based unix sockets when using old abi apparmor: fix AA_DEBUG_LABEL() apparmor: fix af_unix auditing to include all address information apparmor: Remove use of the double lock apparmor: update kernel doc comments for xxx_label_crit_section apparmor: make __begin_current_label_crit_section() indicate whether put is needed ... commit 50a74d0095cd23d2012133e208df45a298868870 Author: Pei Xiao Date: Wed Jul 23 14:22:41 2025 +0800 tee: fix memory leak in tee_dyn_shm_alloc_helper When shm_register() fails in tee_dyn_shm_alloc_helper(), the pre-allocated pages array is not freed, resulting in a memory leak. Fixes: cf4441503e20 ("tee: optee: Move pool_op helper functions") Signed-off-by: Pei Xiao Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 3db488c8ed9cb1275b9dac6b9ce77f9508bdfc77 Merge: 8ac4bf010b908a 571c1ea91a73db Author: Petr Mladek Date: Mon Aug 4 14:18:01 2025 +0200 Merge branch 'rework/fixes' into for-linus commit 8ac4bf010b908a9336c3177ac679e6f1b7c8c09c Merge: 731ae3ad96bce4 cf5543870186d6 Author: Petr Mladek Date: Mon Aug 4 14:17:17 2025 +0200 Merge branch 'rework/optimizations' into for-linus commit 731ae3ad96bce49f9243d20bcabe3a2b85b8a178 Merge: 3bfd34ed362b0a de1c831a7898f1 Author: Petr Mladek Date: Mon Aug 4 14:16:21 2025 +0200 Merge branch 'for-6.17-hash_pointers' into for-linus commit 3bfd34ed362b0a8aa96b54a582f0a32786ceec43 Merge: af54a3a151691a b5960a06b90eeb Author: Petr Mladek Date: Mon Aug 4 14:15:14 2025 +0200 Merge branch 'for-6.15-printf-attribute' into for-linus commit e4a718a3a47e89805c3be9d46a84de1949a98d5d Author: Pei Xiao Date: Wed Jul 23 10:09:07 2025 +0800 tee: fix NULL pointer dereference in tee_shm_put tee_shm_put have NULL pointer dereference: __optee_disable_shm_cache --> shm = reg_pair_to_ptr(...);//shm maybe return NULL tee_shm_free(shm); --> tee_shm_put(shm);//crash Add check in tee_shm_put to fix it. panic log: Unable to handle kernel paging request at virtual address 0000000000100cca Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000002049d07000 [0000000000100cca] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] SMP CPU: 2 PID: 14442 Comm: systemd-sleep Tainted: P OE ------- ---- 6.6.0-39-generic #38 Source Version: 938b255f6cb8817c95b0dd5c8c2944acfce94b07 Hardware name: greatwall GW-001Y1A-FTH, BIOS Great Wall BIOS V3.0 10/26/2022 pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tee_shm_put+0x24/0x188 lr : tee_shm_free+0x14/0x28 sp : ffff001f98f9faf0 x29: ffff001f98f9faf0 x28: ffff0020df543cc0 x27: 0000000000000000 x26: ffff001f811344a0 x25: ffff8000818dac00 x24: ffff800082d8d048 x23: ffff001f850fcd18 x22: 0000000000000001 x21: ffff001f98f9fb88 x20: ffff001f83e76218 x19: ffff001f83e761e0 x18: 000000000000ffff x17: 303a30303a303030 x16: 0000000000000000 x15: 0000000000000003 x14: 0000000000000001 x13: 0000000000000000 x12: 0101010101010101 x11: 0000000000000001 x10: 0000000000000001 x9 : ffff800080e08d0c x8 : ffff001f98f9fb88 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff001f83e761e0 x1 : 00000000ffff001f x0 : 0000000000100cca Call trace: tee_shm_put+0x24/0x188 tee_shm_free+0x14/0x28 __optee_disable_shm_cache+0xa8/0x108 optee_shutdown+0x28/0x38 platform_shutdown+0x28/0x40 device_shutdown+0x144/0x2b0 kernel_power_off+0x3c/0x80 hibernate+0x35c/0x388 state_store+0x64/0x80 kobj_attr_store+0x14/0x28 sysfs_kf_write+0x48/0x60 kernfs_fop_write_iter+0x128/0x1c0 vfs_write+0x270/0x370 ksys_write+0x6c/0x100 __arm64_sys_write+0x20/0x30 invoke_syscall+0x4c/0x120 el0_svc_common.constprop.0+0x44/0xf0 do_el0_svc+0x24/0x38 el0_svc+0x24/0x88 el0t_64_sync_handler+0x134/0x150 el0t_64_sync+0x14c/0x15 Fixes: dfd0743f1d9e ("tee: handle lookup of shm with reference count 0") Signed-off-by: Pei Xiao Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander commit 5f49c2d1f422c660c726ac5e0499c66c901633c2 Author: John Johansen Date: Fri Aug 1 20:36:06 2025 -0700 apparmor: fix: oops when trying to free null ruleset profile allocation is wrongly setting the number of entries on the rules vector before any ruleset is assigned. If profile allocation fails between ruleset allocation and assigning the first ruleset, free_ruleset() will be called with a null pointer resulting in an oops. [ 107.350226] kernel BUG at mm/slub.c:545! [ 107.350912] Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 107.351447] CPU: 1 UID: 0 PID: 27 Comm: ksoftirqd/1 Not tainted 6.14.6-hwe-rlee287-dev+ #5 [ 107.353279] Hardware name:[ 107.350218] -QE-----------[ cutMU here ]--------- Ub--- [ 107.3502untu26] kernel BUG a 24t mm/slub.c:545.!04 P [ 107.350912]C ( Oops: invalid oi4pcode: 0000 [#1]40 PREEMPT SMP NOPFXTI + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 107.356054] RIP: 0010:__slab_free+0x152/0x340 [ 107.356444] Code: 00 4c 89 ff e8 0f ac df 00 48 8b 14 24 48 8b 4c 24 20 48 89 44 24 08 48 8b 03 48 c1 e8 09 83 e0 01 88 44 24 13 e9 71 ff ff ff <0f> 0b 41 f7 44 24 08 87 04 00 00 75 b2 eb a8 41 f7 44 24 08 87 04 [ 107.357856] RSP: 0018:ffffad4a800fbbb0 EFLAGS: 00010246 [ 107.358937] RAX: ffff97ebc2a88e70 RBX: ffffd759400aa200 RCX: 0000000000800074 [ 107.359976] RDX: ffff97ebc2a88e60 RSI: ffffd759400aa200 RDI: ffffad4a800fbc20 [ 107.360600] RBP: ffffad4a800fbc50 R08: 0000000000000001 R09: ffffffff86f02cf2 [ 107.361254] R10: 0000000000000000 R11: 0000000000000000 R12: ffff97ecc0049400 [ 107.361934] R13: ffff97ebc2a88e60 R14: ffff97ecc0049400 R15: 0000000000000000 [ 107.362597] FS: 0000000000000000(0000) GS:ffff97ecfb200000(0000) knlGS:0000000000000000 [ 107.363332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 107.363784] CR2: 000061c9545ac000 CR3: 0000000047aa6000 CR4: 0000000000750ef0 [ 107.364331] PKRU: 55555554 [ 107.364545] Call Trace: [ 107.364761] [ 107.364931] ? local_clock+0x15/0x30 [ 107.365219] ? srso_alias_return_thunk+0x5/0xfbef5 [ 107.365593] ? kfree_sensitive+0x32/0x70 [ 107.365900] kfree+0x29d/0x3a0 [ 107.366144] ? srso_alias_return_thunk+0x5/0xfbef5 [ 107.366510] ? local_clock_noinstr+0xe/0xd0 [ 107.366841] ? srso_alias_return_thunk+0x5/0xfbef5 [ 107.367209] kfree_sensitive+0x32/0x70 [ 107.367502] aa_free_profile.part.0+0xa2/0x400 [ 107.367850] ? rcu_do_batch+0x1e6/0x5e0 [ 107.368148] aa_free_profile+0x23/0x60 [ 107.368438] label_free_switch+0x4c/0x80 [ 107.368751] label_free_rcu+0x1c/0x50 [ 107.369038] rcu_do_batch+0x1e8/0x5e0 [ 107.369324] ? rcu_do_batch+0x157/0x5e0 [ 107.369626] rcu_core+0x1b0/0x2f0 [ 107.369888] rcu_core_si+0xe/0x20 [ 107.370156] handle_softirqs+0x9b/0x3d0 [ 107.370460] ? smpboot_thread_fn+0x26/0x210 [ 107.370790] run_ksoftirqd+0x3a/0x70 [ 107.371070] smpboot_thread_fn+0xf9/0x210 [ 107.371383] ? __pfx_smpboot_thread_fn+0x10/0x10 [ 107.371746] kthread+0x10d/0x280 [ 107.372010] ? __pfx_kthread+0x10/0x10 [ 107.372310] ret_from_fork+0x44/0x70 [ 107.372655] ? __pfx_kthread+0x10/0x10 [ 107.372974] ret_from_fork_asm+0x1a/0x30 [ 107.373316] [ 107.373505] Modules linked in: af_packet_diag mptcp_diag tcp_diag udp_diag raw_diag inet_diag snd_seq_dummy snd_hrtimer snd_seq_midi snd_seq_midi_event snd_rawmidi snd_seq snd_seq_device snd_timer snd soundcore qrtr binfmt_misc intel_rapl_msr intel_rapl_common kvm_amd ccp kvm irqbypass polyval_clmulni polyval_generic ghash_clmulni_intel sha256_ssse3 sha1_ssse3 aesni_intel crypto_simd cryptd i2c_piix4 i2c_smbus input_leds joydev sch_fq_codel msr parport_pc ppdev lp parport efi_pstore nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vsock vmw_vmci dmi_sysfs qemu_fw_cfg ip_tables x_tables autofs4 hid_generic usbhid hid psmouse serio_raw floppy bochs pata_acpi [ 107.379086] ---[ end trace 0000000000000000 ]--- Don't set the count until a ruleset is actually allocated and guard against free_ruleset() being called with a null pointer. Reported-by: Ryan Lee Fixes: 217af7e2f4de ("apparmor: refactor profile rules and attachments") Signed-off-by: John Johansen commit 584460393efbcccb6388b1cd5d37284b5326709c Author: Andy Yan Date: Wed Jul 16 20:55:55 2025 +0800 drm/bridge: Describe the newly introduced drm_connector parameter for drm_bridge_detect This fix the make htmldocs warnings: drivers/gpu/drm/drm_bridge.c:1242: warning: Function parameter or struct member 'connector' not described in 'drm_bridge_detect' Fixes: 5d156a9c3d5e ("drm/bridge: Pass down connector to drm bridge detect hook") Signed-off-by: Andy Yan Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250716125602.3166573-1-andyshrk@163.com Signed-off-by: Dmitry Baryshkov commit 220994d61cebfc04f071d69049127657c7e8191b Merge: be71ce9796c365 6531a2cf07ef15 Author: Maarten Lankhorst Date: Mon Aug 4 09:32:44 2025 +0200 Merge remote-tracking branch 'drm/drm-next' into drm-misc-next-fixes Seems we missed one drm-misc-next pull-request in drm-misc-next-fixes. This is required to pull in 5d156a9c3d5e ("drm/bridge: Pass down connector to drm bridge detect hook") and update its docs. Signed-off-by: Maarten Lankhorst commit a7bee4e7f78089c101be2ad51f4b5ec64782053e Merge: 61c6fef7c4b06b 45ee66c37f9bd8 Author: Dmitry Torokhov Date: Sun Aug 3 23:28:48 2025 -0700 Merge tag 'ib-mfd-gpio-input-pwm-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into next Merge an immutable branch between MFD, GPIO, Input and PWM to resolve conflicts for the merge window pull request. commit 61c6fef7c4b06b4bdbf3142f4e5cace70597e0de Author: Uwe Kleine-König Date: Mon Jun 30 09:27:26 2025 -0700 Input: max77693 - convert to atomic pwm operation The driver called pwm_config() and pwm_enable() separately. Today both are wrappers for pwm_apply_might_sleep() and it's more effective to call this function directly and only once. Also don't configure the duty_cycle and period if the next operation is to disable the PWM so configure the PWM in max77693_haptic_enable(). With the direct use of pwm_apply_might_sleep() the need to call pwm_apply_args() in .probe() is now gone, too, so drop this one. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250630103851.2069952-2-u.kleine-koenig@baylibre.com Signed-off-by: Dmitry Torokhov commit d2eedaa3909be9102d648a4a0a50ccf64f96c54f Merge: 806381e1a24c6e bb5b0b4317c951 Author: Linus Torvalds Date: Sun Aug 3 20:17:34 2025 -0700 Merge tag 'rtc-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux Pull RTC updates from Alexandre Belloni: "Support for a new RTC in an existing driver and all the drivers exposing clocks using the common clock framework have been converted to determine_rate(). Summary: Subsystem: - Convert drivers exposing a clock from round_rate() to determine_rate() Drivers: - ds1307: oscillator stop flag handling for ds1341 - pcf85063: add support for RV8063" * tag 'rtc-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (34 commits) rtc: ds1685: Update Joshua Kinard's email address. rtc: rv3032: convert from round_rate() to determine_rate() rtc: rv3028: convert from round_rate() to determine_rate() rtc: pcf8563: convert from round_rate() to determine_rate() rtc: pcf85063: convert from round_rate() to determine_rate() rtc: nct3018y: convert from round_rate() to determine_rate() rtc: max31335: convert from round_rate() to determine_rate() rtc: m41t80: convert from round_rate() to determine_rate() rtc: hym8563: convert from round_rate() to determine_rate() rtc: ds1307: convert from round_rate() to determine_rate() rtc: rv3028: fix incorrect maximum clock rate handling rtc: pcf8563: fix incorrect maximum clock rate handling rtc: pcf85063: fix incorrect maximum clock rate handling rtc: nct3018y: fix incorrect maximum clock rate handling rtc: hym8563: fix incorrect maximum clock rate handling rtc: ds1307: fix incorrect maximum clock rate handling rtc: pcf85063: scope pcf85063_config structures rtc: Optimize calculations in rtc_time64_to_tm() dt-bindings: rtc: amlogic,a4-rtc: Add compatible string for C3 rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 ... commit 806381e1a24c6eec2b431cbba2ba1b81e518fea8 Merge: e991acf1bce7a4 cf2a6de32cabbf Author: Linus Torvalds Date: Sun Aug 3 19:15:04 2025 -0700 Merge tag 'powerpc-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc fixes from Madhavan Srinivasan: - Fixes for several issues in the powernv PCI hotplug path - Fix htmldoc generation for htm.rst in toctree - Add jit support for load_acquire and store_release in ppc64 bpf jit Thanks to Bjorn Helgaas, Hari Bathini, Puranjay Mohan, Saket Kumar Bhaskar, Shawn Anastasio, Timothy Pearson, and Vishal Parmar * tag 'powerpc-6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: powerpc64/bpf: Add jit support for load_acquire and store_release docs: powerpc: add htm.rst to toctree PCI: pnv_php: Enable third attention indicator state PCI: pnv_php: Fix surprise plug detection and recovery powerpc/eeh: Make EEH driver device hotplug safe powerpc/eeh: Export eeh_unfreeze_pe() PCI: pnv_php: Work around switches with broken presence detection PCI: pnv_php: Clean up allocated IRQs on unplug commit e991acf1bce7a428794514cbbe216973c9c0a3c8 Merge: 3c4a063b1f8ab7 085dece6cc88b5 Author: Linus Torvalds Date: Sun Aug 3 16:23:09 2025 -0700 Merge tag 'mm-nonmm-stable-2025-08-03-12-47' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull non-MM updates from Andrew Morton: "Significant patch series in this pull request: - "squashfs: Remove page->mapping references" (Matthew Wilcox) gets us closer to being able to remove page->mapping - "relayfs: misc changes" (Jason Xing) does some maintenance and minor feature addition work in relayfs - "kdump: crashkernel reservation from CMA" (Jiri Bohac) switches us from static preallocation of the kdump crashkernel's working memory over to dynamic allocation. So the difficulty of a-priori estimation of the second kernel's needs is removed and the first kernel obtains extra memory - "generalize panic_print's dump function to be used by other kernel parts" (Feng Tang) implements some consolidation and rationalization of the various ways in which a failing kernel splats information at the operator * tag 'mm-nonmm-stable-2025-08-03-12-47' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (80 commits) tools/getdelays: add backward compatibility for taskstats version kho: add test for kexec handover delaytop: enhance error logging and add PSI feature description samples: Kconfig: fix spelling mistake "instancess" -> "instances" fat: fix too many log in fat_chain_add() scripts/spelling.txt: add notifer||notifier to spelling.txt xen/xenbus: fix typo "notifer" net: mvneta: fix typo "notifer" drm/xe: fix typo "notifer" cxl: mce: fix typo "notifer" KVM: x86: fix typo "notifer" MAINTAINERS: add maintainers for delaytop ucount: use atomic_long_try_cmpxchg() in atomic_long_inc_below() ucount: fix atomic_long_inc_below() argument type kexec: enable CMA based contiguous allocation stackdepot: make max number of pools boot-time configurable lib/xxhash: remove unused functions init/Kconfig: restore CONFIG_BROKEN help text lib/raid6: update recov_rvv.c zero page usage docs: update docs after introducing delaytop ... commit 3c4a063b1f8ab71352df1421d9668521acb63cd9 Merge: 8877fcb70fd7ae 3ca824369b71d4 Author: Linus Torvalds Date: Sun Aug 3 15:03:04 2025 -0700 Merge tag 'trace-v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull more tracing updates from Steven Rostedt: - Remove unneeded goto out statements Over time, the logic was restructured but left a "goto out" where the out label simply did a "return ret;". Instead of jumping to this out label, simply return immediately and remove the out label. - Add guard(ring_buffer_nest) Some calls to the tracing ring buffer can happen when the ring buffer is already being written to at the same context (for example, a trace_printk() in between a ring_buffer_lock_reserve() and a ring_buffer_unlock_commit()). In order to not trigger the recursion detection, these functions use ring_buffer_nest_start() and ring_buffer_nest_end(). Create a guard() for these functions so that their use cases can be simplified and not need to use goto for the release. - Clean up the tracing code with guard() and __free() logic There were several locations that were prime candidates for using guard() and __free() helpers. Switch them over to use them. - Fix output of function argument traces for unsigned int values The function tracer with "func-args" option set will record up to 6 argument registers and then use BTF to format them for human consumption when the trace file is read. There are several arguments that are "unsigned long" and even "unsigned int" that are either and address or a mask. It is easier to understand if they were printed using hexadecimal instead of decimal. The old method just printed all non-pointer values as signed integers, which made it even worse for unsigned integers. For instance, instead of: __local_bh_disable_ip(ip=-2127311112, cnt=256) <-handle_softirqs show: __local_bh_disable_ip(ip=0xffffffff8133cef8, cnt=0x100) <-handle_softirqs" * tag 'trace-v6.17-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Have unsigned int function args displayed as hexadecimal ring-buffer: Convert ring_buffer_write() to use guard(preempt_notrace) tracing: Use __free(kfree) in trace.c to remove gotos tracing: Add guard() around locks and mutexes in trace.c tracing: Add guard(ring_buffer_nest) tracing: Remove unneeded goto out logic commit 8877fcb70fd7ae0a4d5ac73d250dc255f7ff5a2c Merge: 546b0ad6a87297 40a826bd6c82ae Author: Linus Torvalds Date: Sun Aug 3 14:16:52 2025 -0700 Merge tag 'modules-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Daniel Gomez: "This is a small set of changes for modules, primarily to extend module users to use the module data structures in combination with the already no-op stub module functions, even when support for modules is disabled in the kernel configuration. This change follows the kernel's coding style for conditional compilation and allows kunit code to drop all CONFIG_MODULES ifdefs, which is also part of the changes. This should allow others part of the kernel to do the same cleanup. The remaining changes include a fix for module name length handling which could potentially lead to the removal of an incorrect module, and various cleanups" * tag 'modules-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: module: Rename MAX_PARAM_PREFIX_LEN to __MODULE_NAME_LEN tracing: Replace MAX_PARAM_PREFIX_LEN with MODULE_NAME_LEN module: Restore the moduleparam prefix length check module: Remove unnecessary +1 from last_unloaded_module::name size module: Prevent silent truncation of module name in delete_module(2) kunit: test: Drop CONFIG_MODULE ifdeffery module: make structure definitions always visible module: move 'struct module_use' to internal.h commit 546b0ad6a87297a4268bc336aea57173008428e8 Merge: 352af6a011d586 3b661ca549b9e5 Author: Linus Torvalds Date: Sun Aug 3 14:12:02 2025 -0700 Merge tag 'i3c/for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux Pull i3c updates from Alexandre Belloni: "New driver: - Renesas I3C controller Subsystem: - use adapter timeout value for I2C transfers - don't fail if GETHDRCAP is unsupported - replace ENOTSUPP with SUSV4-compliant EOPNOTSUPP Drivers: - svc: Fix npcm845 FIFO_EMPTY quirk" * tag 'i3c/for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (25 commits) i3c: add missing include to internal header i3c: dw: Remove redundant pm_runtime_mark_last_busy() calls i3c: master: svc: Remove redundant pm_runtime_mark_last_busy() calls i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk i3c: master: Add basic driver for the Renesas I3C controller dt-bindings: i3c: Add Renesas I3C controller i3c: Add more parameters for controllers to the header i3c: Standardize defines for specification parameters i3c: fix module_i3c_i2c_driver() with I3C=n i3c: master: cdns: Simplify handling clocks in probe() i3c: Fix i3c_device_do_priv_xfers() kernel-doc indentation i3c: master: dw: Use i3c_writel_fifo() and i3c_readl_fifo() i3c: master: cdns: Use i3c_writel_fifo() and i3c_readl_fifo() i3c: master: Add inline i3c_readl_fifo() and i3c_writel_fifo() i3c: prefix hexadecimal entries in sysfs i3c: master: cdns: replace ENOTSUPP with SUSV4-compliant EOPNOTSUPP i3c: dw: replace ENOTSUPP with SUSV4-compliant EOPNOTSUPP i3c: master: replace ENOTSUPP with SUSV4-compliant EOPNOTSUPP i3c: don't fail if GETHDRCAP is unsupported i3c: add patchwork entry to MAINTAINERS ... commit 352af6a011d586ff042db4b2d1f7421875eb8a14 Merge: 186f3edfdd41f2 dff64b072708ff Author: Linus Torvalds Date: Sun Aug 3 13:49:10 2025 -0700 Merge tag 'rust-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux Pull Rust updates from Miguel Ojeda: "Toolchain and infrastructure: - Enable a set of Clippy lints: 'ptr_as_ptr', 'ptr_cast_constness', 'as_ptr_cast_mut', 'as_underscore', 'cast_lossless' and 'ref_as_ptr' These are intended to avoid type casts with the 'as' operator, which are quite powerful, into restricted variants that are less powerful and thus should help to avoid mistakes - Remove the 'author' key now that most instances were moved to the plural one in the previous cycle 'kernel' crate: - New 'bug' module: add 'warn_on!' macro which reuses the existing 'BUG'/'WARN' infrastructure, i.e. it respects the usual sysctls and kernel parameters: warn_on!(value == 42); To avoid duplicating the assembly code, the same strategy is followed as for the static branch code in order to share the assembly between both C and Rust This required a few rearrangements on C arch headers -- the existing C macros should still generate the same outputs, thus no functional change expected there - 'workqueue' module: add delayed work items, including a 'DelayedWork' struct, a 'impl_has_delayed_work!' macro and an 'enqueue_delayed' method, e.g.: /// Enqueue the struct for execution on the system workqueue, /// where its value will be printed 42 jiffies later. fn print_later(value: Arc) { let _ = workqueue::system().enqueue_delayed(value, 42); } - New 'bits' module: add support for 'bit' and 'genmask' functions, with runtime- and compile-time variants, e.g.: static_assert!(0b00010000 == bit_u8(4)); static_assert!(0b00011110 == genmask_u8(1..=4)); assert!(checked_bit_u32(u32::BITS).is_none()); - 'uaccess' module: add 'UserSliceReader::strcpy_into_buf', which reads NUL-terminated strings from userspace into a '&CStr' Introduce 'UserPtr' newtype, similar in purpose to '__user' in C, to minimize mistakes handling userspace pointers, including mixing them up with integers and leaking them via the 'Debug' trait. Add it to the prelude, too - Start preparations for the replacement of our custom 'CStr' type with the analogous type in the 'core' standard library. This will take place across several cycles to make it easier. For this one, it includes a new 'fmt' module, using upstream method names and some other cleanups Replace 'fmt!' with a re-export, which helps Clippy lint properly, and clean up the found 'uninlined-format-args' instances - 'dma' module: - Clarify wording and be consistent in 'coherent' nomenclature - Convert the 'read!()' and 'write!()' macros to return a 'Result' - Add 'as_slice()', 'write()' methods in 'CoherentAllocation' - Expose 'count()' and 'size()' in 'CoherentAllocation' and add the corresponding type invariants - Implement 'CoherentAllocation::dma_handle_with_offset()' - 'time' module: - Make 'Instant' generic over clock source. This allows the compiler to assert that arithmetic expressions involving the 'Instant' use 'Instants' based on the same clock source - Make 'HrTimer' generic over the timer mode. 'HrTimer' timers take a 'Duration' or an 'Instant' when setting the expiry time, depending on the timer mode. With this change, the compiler can check the type matches the timer mode - Add an abstraction for 'fsleep'. 'fsleep' is a flexible sleep function that will select an appropriate sleep method depending on the requested sleep time - Avoid 64-bit divisions on 32-bit hardware when calculating timestamps - Seal the 'HrTimerMode' trait. This prevents users of the 'HrTimerMode' from implementing the trait on their own types - Pass the correct timer mode ID to 'hrtimer_start_range_ns()' - 'list' module: remove 'OFFSET' constants, allowing to remove pointer arithmetic; now 'impl_list_item!' invokes 'impl_has_list_links!' or 'impl_has_list_links_self_ptr!'. Other simplifications too - 'types' module: remove 'ForeignOwnable::PointedTo' in favor of a constant, which avoids exposing the type of the opaque pointer, and require 'into_foreign' to return non-null Remove the 'Either' type as well. It is unused, and we want to encourage the use of custom enums for concrete use cases - 'sync' module: implement 'Borrow' and 'BorrowMut' for 'Arc' types to allow them to be used in generic APIs - 'alloc' module: implement 'Borrow' and 'BorrowMut' for 'Box'; and 'Borrow', 'BorrowMut' and 'Default' for 'Vec' - 'Opaque' type: add 'cast_from' method to perform a restricted cast that cannot change the inner type and use it in callers of 'container_of!'. Rename 'raw_get' to 'cast_into' to match it - 'rbtree' module: add 'is_empty' method - 'sync' module: new 'aref' submodule to hold 'AlwaysRefCounted' and 'ARef', which are moved from the too general 'types' module which we want to reduce or eventually remove. Also fix a safety comment in 'static_lock_class' 'pin-init' crate: - Add 'impl [Pin]Init for Result', so results are now (pin-)initializers - Add 'Zeroable::init_zeroed()' that delegates to 'init_zeroed()' - New 'zeroed()', a safe version of 'mem::zeroed()' and also provide it via 'Zeroable::zeroed()' - Implement 'Zeroable' for 'Option<&T>', 'Option<&mut T>' and for 'Option<[unsafe] [extern "abi"] fn(...args...) -> ret>' for '"Rust"' and '"C"' ABIs and up to 20 arguments - Changed blanket impls of 'Init' and 'PinInit' from 'impl [Pin]Init for T' to 'impl [Pin]Init for T' - Renamed 'zeroed()' to 'init_zeroed()' - Upstream dev news: improve CI more to deny warnings, use '--all-targets'. Check the synchronization status of the two '-next' branches in upstream and the kernel MAINTAINERS: - Add Vlastimil Babka, Liam R. Howlett, Uladzislau Rezki and Lorenzo Stoakes as reviewers (thanks everyone) And a few other cleanups and improvements" * tag 'rust-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux: (76 commits) rust: Add warn_on macro arm64/bug: Add ARCH_WARN_ASM macro for BUG/WARN asm code sharing with Rust riscv/bug: Add ARCH_WARN_ASM macro for BUG/WARN asm code sharing with Rust x86/bug: Add ARCH_WARN_ASM macro for BUG/WARN asm code sharing with Rust rust: kernel: move ARef and AlwaysRefCounted to sync::aref rust: sync: fix safety comment for `static_lock_class` rust: types: remove `Either` rust: kernel: use `core::ffi::CStr` method names rust: str: add `CStr` methods matching `core::ffi::CStr` rust: str: remove unnecessary qualification rust: use `kernel::{fmt,prelude::fmt!}` rust: kernel: add `fmt` module rust: kernel: remove `fmt!`, fix clippy::uninlined-format-args scripts: rust: emit path candidates in panic message scripts: rust: replace length checks with match rust: list: remove nonexistent generic parameter in link rust: bits: add support for bits/genmask macros rust: list: remove OFFSET constants rust: list: add `impl_list_item!` examples rust: list: use fully qualified path ... commit 33ac5155891cab165c93b51b0e22e153eacc2ee7 Author: Christophe JAILLET Date: Wed Jul 30 21:38:02 2025 +0200 i2c: muxes: mule: Fix an error handling path in mule_i2c_mux_probe() If an error occurs in the loop that creates the device adapters, then a reference to 'dev' still needs to be released. Use for_each_child_of_node_scoped() to both fix the issue and save one line of code. Fixes: d0f8e97866bf ("i2c: muxes: add support for tsd,mule-i2c multiplexer") Signed-off-by: Christophe JAILLET Signed-off-by: Wolfram Sang commit 0b7c9528facdb5a73ad78fea86d2e95a6c48dbc4 Author: fangzhong.zhou Date: Sun Aug 3 07:15:54 2025 +0800 i2c: Force DLL0945 touchpad i2c freq to 100khz This patch fixes an issue where the touchpad cursor movement becomes slow on the Dell Precision 5560. Force the touchpad freq to 100khz as a workaround. Tested on Dell Precision 5560 with 6.14 to 6.14.6. Cursor movement is now smooth and responsive. Signed-off-by: fangzhong.zhou [wsa: kept sorting and removed unnecessary parts from commit msg] Signed-off-by: Wolfram Sang commit 65cf62cd62af27386606ed25054f78480c2f7fc7 Author: Sven Peter Date: Thu Jun 12 21:11:29 2025 +0000 i2c: apple: Drop default ARCH_APPLE in Kconfig When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Signed-off-by: Sven Peter Signed-off-by: Wolfram Sang commit efb2ad898d693cfa8b2b59f66b68791fc8d6184f Merge: 186f3edfdd41f2 85c34532849dae Author: Wolfram Sang Date: Sun Aug 3 22:25:12 2025 +0200 Merge tag 'i2c-host-6.17-pt2' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v6.17, part 2 - apple: add support for Apple A7–A11, T2 chips - qcom-geni: fix controller frequency mapping - stm32f7: add DMA-safe transfer support - tegra: use controller reset if device reset is missing - tegra: remove unnecessary dma_sync*() calls commit cc5d59081fa26506d02de2127ab822f40d88bc5a Author: Olga Kornievskaia Date: Thu Jul 31 14:00:56 2025 -0400 sunrpc: fix client side handling of tls alerts A security exploit was discovered in NFS over TLS in tls_alert_recv due to its assumption that there is valid data in the msghdr's iterator's kvec. Instead, this patch proposes the rework how control messages are setup and used by sock_recvmsg(). If no control message structure is setup, kTLS layer will read and process TLS data record types. As soon as it encounters a TLS control message, it would return an error. At that point, NFS can setup a kvec backed control buffer and read in the control message such as a TLS alert. Scott found that a msg iterator can advance the kvec pointer as a part of the copy process thus we need to revert the iterator before calling into the tls_alert_recv. Fixes: dea034b963c8 ("SUNRPC: Capture CMSG metadata on client-side receive") Suggested-by: Trond Myklebust Suggested-by: Scott Mayhew Signed-off-by: Olga Kornievskaia Link: https://lore.kernel.org/r/20250731180058.4669-3-okorniev@redhat.com Signed-off-by: Trond Myklebust commit 533210f23936a482010016ac3f57995046c58565 Author: Li RongQing Date: Thu Jul 31 16:10:38 2025 +0800 nfs/localio: use read_seqbegin() rather than read_seqbegin_or_lock() The usage of read_seqbegin_or_lock() in nfs_copy_boot_verifier() is wrong. "seq" is always even and thus "or_lock" has no effect. nfs_copy_boot_verifier() just copies 8 bytes and is supposed to be very rare operation, so we do not need the adaptive locking in this case. Signed-off-by: Li RongQing Link: https://lore.kernel.org/r/20250731081038.3478-1-lirongqing@baidu.com Signed-off-by: Trond Myklebust commit 63c7bc53a35e785accdc2ceab8f72d94501931ab Author: David Thompson Date: Mon Jul 28 10:46:19 2025 -0400 gpio: mlxbf2: use platform_get_irq_optional() The gpio-mlxbf2 driver interfaces with four GPIO controllers, device instances 0-3. There are two IRQ resources shared between the four controllers, and they are found in the ACPI table for instances 0 and 3. The driver should not use platform_get_irq(), otherwise this error is logged when probing instances 1 and 2: mlxbf2_gpio MLNXBF22:01: error -ENXIO: IRQ index 0 not found Fixes: 2b725265cb08 ("gpio: mlxbf2: Introduce IRQ support") Cc: stable@vger.kernel.org Signed-off-by: David Thompson Reviewed-by: Shravan Kumar Ramani Reviewed-by: Mika Westerberg Link: https://lore.kernel.org/r/20250728144619.29894-1-davthompson@nvidia.com Signed-off-by: Bartosz Golaszewski commit b644c640923b625340c603cdb8d8f456406eb4de Author: Bartosz Golaszewski Date: Fri Aug 1 09:18:58 2025 +0200 Revert "gpio: pxa: Make irq_chip immutable" This reverts commit 20117cf426b6 ("gpio: pxa: Make irq_chip immutableas") as it caused a regression on samsung coreprimevelte and we've not been able to fix it so far. Cc: stable@vger.kernel.org # v6.16 Fixes: 20117cf426b6 ("gpio: pxa: Make irq_chip immutableas") Reported-by: Duje Mihanović Closes: https://lore.kernel.org/all/3367665.aeNJFYEL58@radijator/ Tested-by: Duje Mihanović Link: https://lore.kernel.org/r/20250801071858.7554-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 6ab55e0a9eac638ca390bfaef6408c10c127e623 Author: Chenghao Duan Date: Sun Aug 3 22:49:50 2025 +0800 LoongArch: Add larch_insn_gen_{beq,bne} helpers Add larch_insn_gen_beq() and larch_insn_gen_bne() helpers which will be used in BPF trampoline implementation. Reviewed-by: Hengqi Chen Co-developed-by: George Guo Signed-off-by: George Guo Co-developed-by: Youling Tang Signed-off-by: Youling Tang Signed-off-by: Chenghao Duan Signed-off-by: Huacai Chen commit 2362e8124ed21445c6886806e5deaee717629ddd Author: Thomas Weißschuh Date: Sun Aug 3 22:49:47 2025 +0800 LoongArch: Don't use %pK through printk() in unwinder In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Cc: stable@vger.kernel.org Signed-off-by: Thomas Weißschuh Signed-off-by: Huacai Chen commit 70a2365e18affc5ebdaab1ca6a0b3c4f3aac2ee8 Author: Yao Zi Date: Sun Aug 3 22:49:47 2025 +0800 LoongArch: Avoid in-place string operation on FDT content In init_cpu_fullname(), a constant pointer to "model" property is retrieved. It's later modified by the strsep() function, which is illegal and corrupts kernel's FDT copy. This is shown by dmesg, OF: fdt: not creating '/sys/firmware/fdt': CRC check failed Create a mutable copy of the model property and do in-place operations on the mutable copy instead. loongson_sysconf.cpuname lives across the kernel lifetime, thus manually releasing isn't necessary. Also move the of_node_put() call for the root node after the usage of its property, since of_node_put() decreases the reference counter thus usage after the call is unsafe. Cc: stable@vger.kernel.org Fixes: 44a01f1f726a ("LoongArch: Parsing CPU-related information from DTS") Reviewed-by: Jiaxun Yang Signed-off-by: Yao Zi Signed-off-by: Huacai Chen commit 243f8de49f076d56ee88d6f03b6221984cc63668 Author: Ming Wang Date: Sun Aug 3 22:49:47 2025 +0800 LoongArch: Support mem= kernel parameter The LoongArch mem= parameter parser was previously limited to the mem=@ format. This was inconvenient for the common use case of simply capping the total system memory, as it forced users to manually specify a start address. It was also inconsistent with the behavior on other architectures. This patch enhances the parser in early_parse_mem() to also support the more user-friendly mem= format. The implementation now checks for the presence of the '@' symbol to determine the user's intent: - If mem= is provided (no '@'), the kernel now calls memblock_enforce_memory_limit(). This trims memory from the top down to the specified size. - If mem=@ is provided, the original behavior is retained for backward compatibility. This allows for defining specific memory banks. This change introduces an important usage rule reflected in the code's comments: the mem= format should only be specified once on the kernel command line. It acts as a single, global cap on total memory. In contrast, the mem=@ format can be specified multiple times to define several distinct memory regions. Signed-off-by: Ming Wang Signed-off-by: Huacai Chen commit a1a81b5477196ca1290b367404a461e046e647d5 Author: Huacai Chen Date: Sun Aug 3 22:49:47 2025 +0800 LoongArch: Make relocate_new_kernel_size be a .quad value Now relocate_new_kernel_size is a .long value, which means 32bit, so its high 32bit is undefined. This causes memcpy((void *)reboot_code_buffer, relocate_new_kernel, relocate_new_kernel_size) in machine_kexec_prepare() access out of range memories in some cases, and then end up with an ADE exception. So make relocate_new_kernel_size be a .quad value, which means 64bit, to avoid such errors. Cc: stable@vger.kernel.org Signed-off-by: Huacai Chen commit 41fee4f0036734bec427659f749e44cfe1821565 Author: Yanteng Si Date: Sun Aug 3 22:49:47 2025 +0800 LoongArch: Complete KSave registers definition According to the "LoongArch Reference Manual Volume 1: Basic Architecture", the KSave registers (SAVE0-SAVE15) are defined in Section 7.4.16 "Data Save (SAVE)" and listed in Table 7-1 "Control and Status Registers Overview". These registers occupy the CSR addresses from 0x30 to 0x3F, with 16 registers in total. This patch completes the definitions of KS9 to KS15, so as to match the architecture specification. Reviewed-by: Wentao Guan Signed-off-by: Yanteng Si Signed-off-by: Huacai Chen commit 0342273e14c25971f2916de2b598db2e9cfeec15 Author: Takashi Sakamoto Date: Sun Aug 3 21:20:15 2025 +0900 firewire: core: reallocate buffer for FCP address handlers when more than 4 are registered The former commit has a limitation that only up to 4 FCP address handlers could be processed per request. Although it suffices for most use cases, it is technically a regression. This commit lifts the restriction by reallocating the buffer from kernel heap when more than 4 handlers are registered. The allocation is performed within RCU read-side critical section, thus it uses GCP_ATOMIC flag. The buffer size is rounded up to the next power of two to align with kmalloc allocation units. Link: https://lore.kernel.org/r/20250803122015.236493-5-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit e884a8a0c573ca5c191b269f31993733ecb6250e Author: Takashi Sakamoto Date: Sun Aug 3 21:20:14 2025 +0900 firewire: core: call FCP address handlers outside RCU read-side critical section The former commit added reference counting to ensure safe invocations of address handlers. Unlike the exclusive-region address handlers, all FCP address handlers should be called on receiving an FCP request. This commit uses the part of kernel stack to collect address handlers up to 4 within the section, then invoke them outside of the section. Reference counting ensures that each handler remains valid and safe to call. Lifting the limitation of supporting only 4 handlers is left for next work. Link: https://lore.kernel.org/r/20250803122015.236493-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit e8cf6875005b017c293bf1b9be707c43f3eff9f4 Author: Takashi Sakamoto Date: Sun Aug 3 21:20:13 2025 +0900 firewire: core: call handler for exclusive regions outside RCU read-side critical section The previous commit added reference counting to ensure safe invocations of address handlers. This commit moves the invocation of handlers for exclusive regions outside of the RCU read-side critical section. The address handler for the requested region is selected within the critical section, then invoked outside of it. Link: https://lore.kernel.org/r/20250803122015.236493-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 7c527c15cdda2e0a26a05ac15a44d3e14738fc55 Author: Takashi Sakamoto Date: Sun Aug 3 21:20:12 2025 +0900 firewire: core: use reference counting to invoke address handlers safely The lifetime of address handler has been managed by linked list and RCU. This approach was introduced in commit 35202f7d8420 ("firewire: remove global lock around address handlers, convert to RCU"). The invocations of address handler are performed within RCU read-side critical sections. In commit 57e6d9f85fff ("firewire: ohci: use workqueue to handle events of AR request/response contexts"), the invocations are in a workqueue context. The approach still imposes limitation that sleeping is not allowed within RCU read-side critical sections. However, since sleeping is not permitted within RCU read-side critical sections, this approach still has a limitation. This commit adds reference counting to decouple handler invocation from handler discovery. The linked list and RCU is used to discover the handlers, while the reference counting is used to invoke them safely. Link: https://lore.kernel.org/r/20250803122015.236493-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 984ff00c6599e098cffce9e6886fd27aa10efcd4 Merge: fad6551fcf5373 13017b427118f4 Author: Jens Axboe Date: Sun Aug 3 05:56:33 2025 -0600 Merge tag 'md-6.17-20250803' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux into block-6.17 Pull MD changes from Yu: "- mddev null-ptr-dereference fix, by Erkun - md-cluster fail to remove the faulty disk regression fix, by Heming - minor cleanup, by Li Nan and Jinchao - mdadm lifetime regression fix reported by syzkaller, by Yu Kuai" * tag 'md-6.17-20250803' of gitolite.kernel.org:pub/scm/linux/kernel/git/mdraid/linux: md: make rdev_addable usable for rcu mode md/raid1: remove struct pool_info and related code md/raid1: change r1conf->r1bio_pool to a pointer type md: rename recovery_cp to resync_offset md/md-cluster: handle REMOVE message earlier md: fix create on open mddev lifetime regression commit 13017b427118f4311471ee47df74872372ca8482 Author: Yang Erkun Date: Thu Jul 31 19:45:30 2025 +0800 md: make rdev_addable usable for rcu mode Our testcase trigger panic: BUG: kernel NULL pointer dereference, address: 00000000000000e0 ... Oops: Oops: 0000 [#1] SMP NOPTI CPU: 2 UID: 0 PID: 85 Comm: kworker/2:1 Not tainted 6.16.0+ #94 PREEMPT(none) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 Workqueue: md_misc md_start_sync RIP: 0010:rdev_addable+0x4d/0xf0 ... Call Trace: md_start_sync+0x329/0x480 process_one_work+0x226/0x6d0 worker_thread+0x19e/0x340 kthread+0x10f/0x250 ret_from_fork+0x14d/0x180 ret_from_fork_asm+0x1a/0x30 Modules linked in: raid10 CR2: 00000000000000e0 ---[ end trace 0000000000000000 ]--- RIP: 0010:rdev_addable+0x4d/0xf0 md_spares_need_change in md_start_sync will call rdev_addable which protected by rcu_read_lock/rcu_read_unlock. This rcu context will help protect rdev won't be released, but rdev->mddev will be set to NULL before we call synchronize_rcu in md_kick_rdev_from_array. Fix this by using READ_ONCE and check does rdev->mddev still alive. Fixes: bc08041b32ab ("md: suspend array in md_start_sync() if array need reconfiguration") Fixes: 570b9147deb6 ("md: use RCU lock to protect traversal in md_spares_need_change()") Signed-off-by: Yang Erkun Link: https://lore.kernel.org/linux-raid/20250731114530.776670-1-yangerkun@huawei.com Signed-off-by: Yu Kuai commit 178d1391c5ce0fc829f3e748058acab9bd9ca4f4 Author: Wang Jinchao Date: Mon Jul 7 09:26:58 2025 +0800 md/raid1: remove struct pool_info and related code The struct pool_info was originally introduced mainly to support reshape operations, serving as a parameter for mempool_init() when raid_disks changes. Now that mempool_create_kmalloc_pool() is sufficient for this purpose, struct pool_info and its related code are no longer needed. Remove struct pool_info and all associated code. Signed-off-by: Wang Jinchao Link: https://lore.kernel.org/linux-raid/20250707012711.376844-3-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai commit 987ca60637a46882a026ca9cc9f3e5f26e8aec28 Author: Wang Jinchao Date: Mon Jul 7 09:26:57 2025 +0800 md/raid1: change r1conf->r1bio_pool to a pointer type In raid1_reshape(), newpool is a stack variable. mempool_init() initializes newpool->wait with the stack address. After assigning newpool to conf->r1bio_pool, the wait queue need to be reinitialized, which is not ideal. Change raid1_conf->r1bio_pool to a pointer type and replace mempool_init() with mempool_create_kmalloc_pool() to avoid referencing a stack-based wait queue. Signed-off-by: Wang Jinchao Link: https://lore.kernel.org/linux-raid/20250707012711.376844-2-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai commit bb5b0b4317c9516bdc5e9a4235e3b5f1a73b7e48 Author: Joshua Kinard Date: Mon Jul 21 13:00:51 2025 -0400 rtc: ds1685: Update Joshua Kinard's email address. I am switching my address to a personal domain, so need to update the driver's files and the entry in MAINTAINERS. Signed-off-by: Joshua Kinard Link: https://lore.kernel.org/r/20250721170051.32407-1-kumba@gentoo.org Signed-off-by: Alexandre Belloni commit 35d6aae85b3653630b43913aee15d8b35b7190c6 Author: Brian Masney Date: Thu Jul 10 11:20:35 2025 -0400 rtc: rv3032: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-15-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit c4253b0914410fd18eb2fc8558e77c150e329f55 Author: Brian Masney Date: Thu Jul 10 11:20:34 2025 -0400 rtc: rv3028: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-14-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit e6f1af719ea1ec918827d369a80e2176410b0b90 Author: Brian Masney Date: Thu Jul 10 11:20:33 2025 -0400 rtc: pcf8563: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-13-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit ad853657d7913458219df56d060a50993b122acc Author: Brian Masney Date: Thu Jul 10 11:20:32 2025 -0400 rtc: pcf85063: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-12-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit 1251d043f7648fd3210b383fd589d522142b9914 Author: Brian Masney Date: Thu Jul 10 11:20:31 2025 -0400 rtc: nct3018y: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-11-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit 9e0dfc7962b3d0e08af98ffa6859a085dea6fca4 Author: Brian Masney Date: Thu Jul 10 11:20:30 2025 -0400 rtc: max31335: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-10-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit e05d81b75efd500fda90251d745bfd83903d806b Author: Brian Masney Date: Thu Jul 10 11:20:29 2025 -0400 rtc: m41t80: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-9-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit 394a4b920a72b032f531bc9d115ff7f4571547cb Author: Brian Masney Date: Thu Jul 10 11:20:28 2025 -0400 rtc: hym8563: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-8-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit 31b5fea399d57cea6657bc4515d1e93cd528a510 Author: Brian Masney Date: Thu Jul 10 11:20:27 2025 -0400 rtc: ds1307: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-7-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit b574acb3cf7591d2513a9f29f8c2021ad55fb881 Author: Brian Masney Date: Thu Jul 10 11:20:26 2025 -0400 rtc: rv3028: fix incorrect maximum clock rate handling When rv3028_clkout_round_rate() is called with a requested rate higher than the highest supported rate, it currently returns 0, which disables the clock. According to the clk API, round_rate() should instead return the highest supported rate. Update the function to return the maximum supported rate in this case. Fixes: f583c341a515f ("rtc: rv3028: add clkout support") Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-6-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit 906726a5efeefe0ef0103ccff5312a09080c04ae Author: Brian Masney Date: Thu Jul 10 11:20:25 2025 -0400 rtc: pcf8563: fix incorrect maximum clock rate handling When pcf8563_clkout_round_rate() is called with a requested rate higher than the highest supported rate, it currently returns 0, which disables the clock. According to the clk API, round_rate() should instead return the highest supported rate. Update the function to return the maximum supported rate in this case. Fixes: a39a6405d5f94 ("rtc: pcf8563: add CLKOUT to common clock framework") Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-5-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit 186ae1869880e58bb3f142d222abdb35ecb4df0f Author: Brian Masney Date: Thu Jul 10 11:20:24 2025 -0400 rtc: pcf85063: fix incorrect maximum clock rate handling When pcf85063_clkout_round_rate() is called with a requested rate higher than the highest supported rate, it currently returns 0, which disables the clock. According to the clk API, round_rate() should instead return the highest supported rate. Update the function to return the maximum supported rate in this case. Fixes: 8c229ab6048b7 ("rtc: pcf85063: Add pcf85063 clkout control to common clock framework") Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-4-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit 437c59e4b222cd697b4cf95995d933e7d583c5f1 Author: Brian Masney Date: Thu Jul 10 11:20:23 2025 -0400 rtc: nct3018y: fix incorrect maximum clock rate handling When nct3018y_clkout_round_rate() is called with a requested rate higher than the highest supported rate, it currently returns 0, which disables the clock. According to the clk API, round_rate() should instead return the highest supported rate. Update the function to return the maximum supported rate in this case. Fixes: 5adbaed16cc63 ("rtc: Add NCT3018Y real time clock driver") Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-3-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit d0a518eb0a692a2ab8357e844970660c5ea37720 Author: Brian Masney Date: Thu Jul 10 11:20:22 2025 -0400 rtc: hym8563: fix incorrect maximum clock rate handling When hym8563_clkout_round_rate() is called with a requested rate higher than the highest supported rate, it currently returns 0, which disables the clock. According to the clk API, round_rate() should instead return the highest supported rate. Update the function to return the maximum supported rate in this case. Fixes: dcaf038493525 ("rtc: add hym8563 rtc-driver") Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-2-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit cf6eb547a24af7ad7bbd2abe9c5327f956bbeae8 Author: Brian Masney Date: Thu Jul 10 11:20:21 2025 -0400 rtc: ds1307: fix incorrect maximum clock rate handling When ds3231_clk_sqw_round_rate() is called with a requested rate higher than the highest supported rate, it currently returns 0, which disables the clock. According to the clk API, round_rate() should instead return the highest supported rate. Update the function to return the maximum supported rate in this case. Fixes: 6c6ff145b3346 ("rtc: ds1307: add clock provider support for DS3231") Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-rtc-clk-round-rate-v1-1-33140bb2278e@redhat.com Signed-off-by: Alexandre Belloni commit e4fc307d8e24f122402907ebf585248cad52841d Author: Helge Deller Date: Sat Aug 2 21:34:37 2025 +0200 Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" This reverts commit 864f9963ec6b4b76d104d595ba28110b87158003. The patch is wrong as it checks vc_origin against vc_screenbuf, while in text mode it should compare against vga_vram_base. As such it broke VGA text scrolling, which can be reproduced like this: (1) boot a kernel that is configured to use text mode VGA-console (2) type commands: ls -l /usr/bin | less -S (3) scroll up/down with cursor-down/up keys Reported-by: Jari Ruusu Cc: stable@vger.kernel.org Cc: Yi Yang Cc: GONG Ruiqi Signed-off-by: Helge Deller commit af0db3c1f898144846d4c172531a199bb3ca375d Author: Sravan Kumar Gundu Date: Thu Jul 31 15:36:18 2025 -0500 fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs(). Reported-and-tested-by: syzbot+c4b7aa0513823e2ea880@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c4b7aa0513823e2ea880 Signed-off-by: Sravan Kumar Gundu Cc: stable@vger.kernel.org Signed-off-by: Helge Deller commit 186f3edfdd41f2ae87fc40a9ccba52a3bf930994 Merge: eacf91b0c78a71 a3fe1324c3c5c2 Author: Linus Torvalds Date: Sat Aug 2 12:07:09 2025 -0700 Merge tag 'pinctrl-v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pin control updates from Linus Walleij: "Nothing stands out, apart from maybe the interesting Eswin EIC7700, a RISC-V SoC I've never seen before. Core changes: - Open code PINCTRL_FUNCTION_DESC() instead of defining a complex macro only used in one place - Add pinmux_generic_add_pinfunction() helper and use this in a few drivers New drivers: - Amlogic S7, S7D and S6 pin control support - Eswin EIC7700 pin control support - Qualcomm PMIV0104, PM7550 and Milos pin control support Because of unhelpful numbering schemes, the Qualcomm driver now needs to start to rely on SoC codenames - STM32 HDP pin control support - Mediatek MT8189 pin control support Improvements: - Switch remaining pin control drivers over to the new GPIO set callback that provides a return value - Support RSVD (reserved) pins in the STM32 driver - Move many fixed assignments over to pinctrl_desc definitions - Handle multiple TLMM regions in the Qualcomm driver" * tag 'pinctrl-v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (105 commits) pinctrl: mediatek: Add pinctrl driver for mt8189 dt-bindings: pinctrl: mediatek: Add support for mt8189 pinctrl: aspeed-g6: Add PCIe RC PERST pin group pinctrl: ingenic: use pinmux_generic_add_pinfunction() pinctrl: keembay: use pinmux_generic_add_pinfunction() pinctrl: mediatek: moore: use pinmux_generic_add_pinfunction() pinctrl: airoha: use pinmux_generic_add_pinfunction() pinctrl: equilibrium: use pinmux_generic_add_pinfunction() pinctrl: provide pinmux_generic_add_pinfunction() pinctrl: pinmux: open-code PINCTRL_FUNCTION_DESC() pinctrl: ma35: use new GPIO line value setter callbacks MAINTAINERS: add Clément Le Goffic as STM32 HDP maintainer pinctrl: stm32: Introduce HDP driver dt-bindings: pinctrl: stm32: Introduce HDP pinctrl: qcom: Add Milos pinctrl driver dt-bindings: pinctrl: document the Milos Top Level Mode Multiplexer pinctrl: qcom: spmi: Add PM7550 dt-bindings: pinctrl: qcom,pmic-gpio: Add PM7550 support pinctrl: qcom: spmi: Add PMIV0104 dt-bindings: pinctrl: qcom,pmic-gpio: Add PMIV0104 support ... commit a2152fef29020e740ba0276930f3a24440012505 Author: Yadan Fan Date: Fri Aug 1 02:14:45 2025 +0800 mm: mempool: fix crash in mempool_free() for zero-minimum pools The mempool wake-up fix introduced in commit a5867a218d7c ("mm: mempool: fix wake-up edge case bug for zero-minimum pools") inlined the add_element() logic in mempool_free() to return the element to the zero-minimum pool: pool->elements[pool->curr_nr++] = element; This causes crash, because mempool_init_node() does not initialize with real allocation for zero-minimum pool, it only returns ZERO_SIZE_PTR to the elements array which is unable to be dereferenced, and the pre-allocation of this array never happened since the while test: while (pool->curr_nr < pool->min_nr) can never be satisfied as min_nr is zero, so the pool does not actually reserve any buffer, the only way so far is to call alloc_fn() to get buffer from SLUB, but if the memory is under high pressure the alloc_fn() could never get any buffer, the waiting thread would be in an indefinite loop of wake-sleep in a period until there is free memory to get. This patch changes mempool_init_node() to allocate 1 element for the elements array of zero-minimum pool, so that the pool will have reserved buffer to use. This will fix the crash issue and let the waiting thread can get the reserved element when alloc_fn() failed to get buffer under high memory pressure. Also modify add_element() to support zero-minimum pool with simplifying codes of zero-minimum handling in mempool_free(). Link: https://lkml.kernel.org/r/e01f00f3-58d9-4ca7-af54-bfa42fec9527@suse.com Fixes: a5867a218d7c ("mm: mempool: fix wake-up edge case bug for zero-minimum pools") Signed-off-by: Yadan Fan Signed-off-by: Andrew Morton commit f04fd85f15945f3ff189701050e3ce303c1a4d98 Author: Lorenzo Stoakes Date: Tue Jul 29 12:49:06 2025 +0100 mm: correct type for vmalloc vm_flags fields Several functions refer to the unfortunately named 'vm_flags' field when referencing vmalloc flags, which happens to be the precise same name used for VMA flags. As a result these were erroneously changed to use the vm_flags_t type (which currently is a typedef equivalent to unsigned long). Currently this has no impact, but in future when vm_flags_t changes this will result in issues, so change the type to unsigned long to account for this. [lorenzo.stoakes@oracle.com: fixup very disguised vmalloc flags parameter] Link: https://lkml.kernel.org/r/e74dd8de-7e60-47ab-8a45-2c851f3c5d26@lucifer.local Link: https://lkml.kernel.org/r/20250729114906.55347-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reported-by: Harry Yoo Closes: https://lore.kernel.org/all/aIgSpAnU8EaIcqd9@hyeyoo/ Reviewed-by: Pedro Falcato Acked-by: David Hildenbrand Reviewed-by: Harry Yoo Acked-by: Vlastimil Babka Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: "Uladzislau Rezki (Sony)" Signed-off-by: Andrew Morton commit de55be42379cc0561aadfd9e1459239dea70be32 Author: Kairui Song Date: Mon Jul 28 15:53:06 2025 +0800 mm/shmem, swap: fix major fault counting If the swapin failed, don't update the major fault count. There is a long existing comment for doing it this way, now with previous cleanups, we can finally fix it. Link: https://lkml.kernel.org/r/20250728075306.12704-9-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Dev Jain Cc: Hugh Dickins Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 93c0476e705768c7ca902cffea4efb500b9678b4 Author: Kairui Song Date: Mon Jul 28 15:53:05 2025 +0800 mm/shmem, swap: rework swap entry and index calculation for large swapin Instead of calculating the swap entry differently in different swapin paths, calculate it early before the swap cache lookup and use that for the lookup and later swapin. And after swapin have brought a folio, simply round it down against the size of the folio. This is simple and effective enough to verify the swap value. A folio's swap entry is always aligned by its size. Any kind of parallel split or race is acceptable because the final shmem_add_to_page_cache ensures that all entries covered by the folio are correct, and thus there will be no data corruption. This also prevents false positive cache lookup. If a shmem read request's index points to the middle of a large swap entry, previously, shmem will try the swap cache lookup using the large swap entry's starting value (which is the first sub swap entry of this large entry). This will lead to false positive lookup results if only the first few swap entries are cached but the actual requested swap entry pointed by the index is uncached. This is not a rare event, as swap readahead always tries to cache order 0 folios when possible. And this shouldn't cause any increased repeated faults. Instead, no matter how the shmem mapping is split in parallel, as long as the mapping still contains the right entries, the swapin will succeed. The final object size and stack usage are also reduced due to simplified code: ./scripts/bloat-o-meter mm/shmem.o.old mm/shmem.o add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-145 (-145) Function old new delta shmem_swapin_folio 4056 3911 -145 Total: Before=33242, After=33097, chg -0.44% Stack usage (Before vs After): mm/shmem.c:2314:12:shmem_swapin_folio 264 static mm/shmem.c:2314:12:shmem_swapin_folio 256 static And while at it, round down the index too if swap entry is round down. The index is used either for folio reallocation or confirming the mapping content. In either case, it should be aligned with the swap folio. Link: https://lkml.kernel.org/r/20250728075306.12704-8-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Dev Jain Cc: Hugh Dickins Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 1326359f22805b2b0e9567ec0099980b8956fc29 Author: Kairui Song Date: Mon Jul 28 15:53:04 2025 +0800 mm/shmem, swap: simplify swapin path and result handling Slightly tidy up the different handling of swap in and error handling for SWP_SYNCHRONOUS_IO and non-SWP_SYNCHRONOUS_IO devices. Now swapin will always use either shmem_swap_alloc_folio or shmem_swapin_cluster, then check the result. Simplify the control flow and avoid a redundant goto label. Link: https://lkml.kernel.org/r/20250728075306.12704-7-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Dev Jain Cc: Hugh Dickins Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 69805ea79db6634d4e7d596f3f36667924dc6cbf Author: Kairui Song Date: Mon Jul 28 15:53:03 2025 +0800 mm/shmem, swap: never use swap cache and readahead for SWP_SYNCHRONOUS_IO For SWP_SYNCHRONOUS_IO devices, if a cache bypassing THP swapin failed due to reasons like memory pressure, partially conflicting swap cache or ZSWAP enabled, shmem will fallback to cached order 0 swapin. Right now the swap cache still has a non-trivial overhead, and readahead is not helpful for SWP_SYNCHRONOUS_IO devices, so we should always skip the readahead and swap cache even if the swapin falls back to order 0. So handle the fallback logic without falling back to the cached read. Link: https://lkml.kernel.org/r/20250728075306.12704-6-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Dev Jain Cc: Hugh Dickins Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 91ab656ece137c368a3189dfd42f8c9203a6285c Author: Kairui Song Date: Mon Jul 28 15:53:02 2025 +0800 mm/shmem, swap: tidy up swap entry splitting Instead of keeping different paths of splitting the entry before the swap in start, move the entry splitting after the swapin has put the folio in swap cache (or set the SWAP_HAS_CACHE bit). This way we only need one place and one unified way to split the large entry. Whenever swapin brought in a folio smaller than the shmem swap entry, split the entry and recalculate the entry and index for verification. This removes duplicated codes and function calls, reduces LOC, and the split is less racy as it's guarded by swap cache now. So it will have a lower chance of repeated faults due to raced split. The compiler is also able to optimize the coder further: bloat-o-meter results with GCC 14: With DEBUG_SECTION_MISMATCH (-fno-inline-functions-called-once): ./scripts/bloat-o-meter mm/shmem.o.old mm/shmem.o add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-143 (-143) Function old new delta shmem_swapin_folio 2358 2215 -143 Total: Before=32933, After=32790, chg -0.43% With !DEBUG_SECTION_MISMATCH: add/remove: 0/1 grow/shrink: 1/0 up/down: 1069/-749 (320) Function old new delta shmem_swapin_folio 2871 3940 +1069 shmem_split_large_entry.isra 749 - -749 Total: Before=32806, After=33126, chg +0.98% Since shmem_split_large_entry is only called in one place now. The compiler will either generate more compact code, or inlined it for better performance. Link: https://lkml.kernel.org/r/20250728075306.12704-5-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Dev Jain Cc: Hugh Dickins Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit c262ffd72c8539d16ada8641a6348c5a88f0c542 Author: Kairui Song Date: Mon Jul 28 15:53:01 2025 +0800 mm/shmem, swap: tidy up THP swapin checks Move all THP swapin related checks under CONFIG_TRANSPARENT_HUGEPAGE, so they will be trimmed off by the compiler if not needed. And add a WARN if shmem sees a order > 0 entry when CONFIG_TRANSPARENT_HUGEPAGE is disabled, that should never happen unless things went very wrong. There should be no observable feature change except the new added WARN. Link: https://lkml.kernel.org/r/20250728075306.12704-4-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Dev Jain Cc: Hugh Dickins Cc: Kemeng Shi Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 0cfc0e7e3d062b93e9eec6828de000981cdfb152 Author: Kairui Song Date: Mon Jul 28 15:53:00 2025 +0800 mm/shmem, swap: avoid redundant Xarray lookup during swapin Patch series "mm/shmem, swap: bugfix and improvement of mTHP swap in", v6. The current THP swapin path have several problems. It may potentially hang, may cause redundant faults due to false positive swap cache lookup, and it issues redundant Xarray walks. !CONFIG_TRANSPARENT_HUGEPAGE builds may also contain unnecessary THP checks. This series fixes all of the mentioned issues, the code should be more robust and prepared for the swap table series. Now 4 walks is reduced to 3 (get order & confirm, confirm, insert folio), !CONFIG_TRANSPARENT_HUGEPAGE build overhead is also minimized, and comes with a sanity check now. The performance is slightly better after this series, sequential swap in of 24G data from ZRAM, using transparent_hugepage_tmpfs=always (24 samples each): Before: avg: 10.66s, stddev: 0.04 After patch 1: avg: 10.58s, stddev: 0.04 After patch 2: avg: 10.65s, stddev: 0.05 After patch 3: avg: 10.65s, stddev: 0.04 After patch 4: avg: 10.67s, stddev: 0.04 After patch 5: avg: 9.79s, stddev: 0.04 After patch 6: avg: 9.79s, stddev: 0.05 After patch 7: avg: 9.78s, stddev: 0.05 After patch 8: avg: 9.79s, stddev: 0.04 Several patches improve the performance by a little, which is about ~8% faster in total. Build kernel test showed very slightly improvement, testing with make -j48 with defconfig in a 768M memcg also using ZRAM as swap, and transparent_hugepage_tmpfs=always (6 test runs): Before: avg: 3334.66s, stddev: 43.76 After patch 1: avg: 3349.77s, stddev: 18.55 After patch 2: avg: 3325.01s, stddev: 42.96 After patch 3: avg: 3354.58s, stddev: 14.62 After patch 4: avg: 3336.24s, stddev: 32.15 After patch 5: avg: 3325.13s, stddev: 22.14 After patch 6: avg: 3285.03s, stddev: 38.95 After patch 7: avg: 3287.32s, stddev: 26.37 After patch 8: avg: 3295.87s, stddev: 46.24 This patch (of 7): Currently shmem calls xa_get_order to get the swap radix entry order, requiring a full tree walk. This can be easily combined with the swap entry value checking (shmem_confirm_swap) to avoid the duplicated lookup and abort early if the entry is gone already. Which should improve the performance. Link: https://lkml.kernel.org/r/20250728075306.12704-1-ryncsn@gmail.com Link: https://lkml.kernel.org/r/20250728075306.12704-3-ryncsn@gmail.com Signed-off-by: Kairui Song Reviewed-by: Kemeng Shi Reviewed-by: Dev Jain Reviewed-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Hugh Dickins Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 5d79c2be508143559c65ace445e7a951ef92881b Author: Mike Rapoport (Microsoft) Date: Sun Jul 13 10:17:30 2025 +0300 x86/ftrace: enable EXECMEM_ROX_CACHE for ftrace allocations For the most part ftrace uses text poking and can handle ROX memory. The only place that requires writable memory is create_trampoline() that updates the allocated memory and in the end makes it ROX. Use execmem_alloc_rw() in x86::ftrace::alloc_tramp() and enable ROX cache for EXECMEM_FTRACE when configuration and CPU features allow that. Link: https://lkml.kernel.org/r/20250713071730.4117334-9-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Peter Zijlstra (Intel) Acked-by: Steven Rostedt (Google) Cc: Daniel Gomez Cc: Masami Hiramatsu (Google) Cc: Petr Pavlu Signed-off-by: Andrew Morton commit 36de1e4238c1243866eaec515ef59972c490367f Author: Mike Rapoport (Microsoft) Date: Sun Jul 13 10:17:29 2025 +0300 x86/kprobes: enable EXECMEM_ROX_CACHE for kprobes allocations x86::alloc_insn_page() always allocates ROX memory. Instead of overriding this method, add EXECMEM_KPROBES entry in execmem_info with pgprot set to PAGE_KERNEL_ROX and use ROX cache when configuration and CPU features allow it. Link: https://lkml.kernel.org/r/20250713071730.4117334-8-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Peter Zijlstra (Intel) Acked-by: Masami Hiramatsu (Google) Cc: Daniel Gomez Cc: Petr Pavlu Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit ab674b6871b049aab2e86d1d7375526368ed175a Author: Mike Rapoport (Microsoft) Date: Sun Jul 13 10:17:28 2025 +0300 execmem: drop writable parameter from execmem_fill_trapping_insns() After update of execmem_cache_free() that made memory writable before updating it, there is no need to update read only memory, so the writable parameter to execmem_fill_trapping_insns() is not needed. Drop it. Link: https://lkml.kernel.org/r/20250713071730.4117334-7-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Peter Zijlstra (Intel) Cc: Daniel Gomez Cc: Masami Hiramatsu (Google) Cc: Petr Pavlu Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 3bd4e0ac61b2fd87d64572e866f58940d1d5fbdf Author: Mike Rapoport (Microsoft) Date: Sun Jul 13 10:17:27 2025 +0300 execmem: add fallback for failures in vmalloc(VM_ALLOW_HUGE_VMAP) When execmem populates ROX cache it uses vmalloc(VM_ALLOW_HUGE_VMAP). Although vmalloc falls back to allocating base pages if high order allocation fails, it may happen that it still cannot allocate enough memory. Right now ROX cache is only used by modules and in majority of cases the allocations happen at boot time when there's plenty of free memory, but upcoming enabling ROX cache for ftrace and kprobes would mean that execmem allocations can happen when the system is under memory pressure and a failure to allocate large page worth of memory becomes more likely. Fallback to regular vmalloc() if vmalloc(VM_ALLOW_HUGE_VMAP) fails. Link: https://lkml.kernel.org/r/20250713071730.4117334-6-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Peter Zijlstra (Intel) Cc: Daniel Gomez Cc: Masami Hiramatsu (Google) Cc: Petr Pavlu Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 888b5a847ba9650f454cd0842ccf8497268da959 Author: Mike Rapoport (Microsoft) Date: Sun Jul 13 10:17:26 2025 +0300 execmem: move execmem_force_rw() and execmem_restore_rox() before use to avoid static declarations. Link: https://lkml.kernel.org/r/20250713071730.4117334-5-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Peter Zijlstra (Intel) Cc: Daniel Gomez Cc: Masami Hiramatsu (Google) Cc: Petr Pavlu Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 187fd8521dd8b202cbacd7af57f4301da4d5b52d Author: Mike Rapoport (Microsoft) Date: Sun Jul 13 10:17:25 2025 +0300 execmem: rework execmem_cache_free() Currently execmem_cache_free() ignores potential allocation failures that may happen in execmem_cache_add(). Besides, it uses text poking to fill the memory with trapping instructions before returning it to cache although it would be more efficient to make that memory writable, update it using memcpy and then restore ROX protection. Rework execmem_cache_free() so that in case of an error it will defer freeing of the memory to a delayed work. With this the happy fast path will now change permissions to RW, fill the memory with trapping instructions using memcpy, restore ROX permissions, add the memory back to the free cache and clear the relevant entry in busy_areas. If any step in the fast path fails, the entry in busy_areas will be marked as pending_free. These entries will be handled by a delayed work and freed asynchronously. To make the fast path faster, use __GFP_NORETRY for memory allocations and let asynchronous handler try harder with GFP_KERNEL. Link: https://lkml.kernel.org/r/20250713071730.4117334-4-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Peter Zijlstra (Intel) Cc: Daniel Gomez Cc: Masami Hiramatsu (Google) Cc: Petr Pavlu Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 838955f64ae7582f009a3538889bb9244f37ab26 Author: Mike Rapoport (Microsoft) Date: Sun Jul 13 10:17:24 2025 +0300 execmem: introduce execmem_alloc_rw() Some callers of execmem_alloc() require the memory to be temporarily writable even when it is allocated from ROX cache. These callers use execemem_make_temp_rw() right after the call to execmem_alloc(). Wrap this sequence in execmem_alloc_rw() API. Link: https://lkml.kernel.org/r/20250713071730.4117334-3-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Daniel Gomez Reviewed-by: Petr Pavlu Acked-by: Peter Zijlstra (Intel) Cc: Masami Hiramatsu (Google) Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit fcd90ad31e29d0b403f3a074a64cd7f0876175dd Author: Mike Rapoport (Microsoft) Date: Sun Jul 13 10:17:23 2025 +0300 execmem: drop unused execmem_update_copy() Patch series "x86: enable EXECMEM_ROX_CACHE for ftrace and kprobes", v3. These patches enable use of EXECMEM_ROX_CACHE for ftrace and kprobes allocations on x86. They also include some ground work in execmem. Since the execmem model for caching large ROX pages changed from the initial assumption that the memory that is allocated from ROX cache is always ROX to the current state where memory can be temporarily made RW and then restored to ROX, we can stop using text poking to update it. This also saves the hassle of trying lock text_mutex in execmem_cache_free() when kprobes already hold that mutex. This patch (of 8): The execmem_update_copy() that used text poking was required when memory allocated from ROX cache was always read-only. Since now its permissions can be switched to read-write there is no need in a function that updates memory with text poking. Remove it. Link: https://lkml.kernel.org/r/20250713071730.4117334-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20250713071730.4117334-2-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Peter Zijlstra (Intel) Cc: Daniel Gomez Cc: Masami Hiramatsu (Google) Cc: Petr Pavlu Cc: Steven Rostedt (Google) Signed-off-by: Andrew Morton commit 9bbffee67ffd16360179327b57f3b1245579ef08 Author: Suren Baghdasaryan Date: Mon Jul 28 10:53:55 2025 -0700 mm: fix a UAF when vma->mm is freed after vma->vm_refcnt got dropped By inducing delays in the right places, Jann Horn created a reproducer for a hard to hit UAF issue that became possible after VMAs were allowed to be recycled by adding SLAB_TYPESAFE_BY_RCU to their cache. Race description is borrowed from Jann's discovery report: lock_vma_under_rcu() looks up a VMA locklessly with mas_walk() under rcu_read_lock(). At that point, the VMA may be concurrently freed, and it can be recycled by another process. vma_start_read() then increments the vma->vm_refcnt (if it is in an acceptable range), and if this succeeds, vma_start_read() can return a recycled VMA. In this scenario where the VMA has been recycled, lock_vma_under_rcu() will then detect the mismatching ->vm_mm pointer and drop the VMA through vma_end_read(), which calls vma_refcount_put(). vma_refcount_put() drops the refcount and then calls rcuwait_wake_up() using a copy of vma->vm_mm. This is wrong: It implicitly assumes that the caller is keeping the VMA's mm alive, but in this scenario the caller has no relation to the VMA's mm, so the rcuwait_wake_up() can cause UAF. The diagram depicting the race: T1 T2 T3 == == == lock_vma_under_rcu mas_walk mmap vma_start_read __refcount_inc_not_zero_limited_acquire munmap __vma_enter_locked refcount_add_not_zero vma_end_read vma_refcount_put __refcount_dec_and_test rcuwait_wait_event rcuwait_wake_up [UAF] Note that rcuwait_wait_event() in T3 does not block because refcount was already dropped by T1. At this point T3 can exit and free the mm causing UAF in T1. To avoid this we move vma->vm_mm verification into vma_start_read() and grab vma->vm_mm to stabilize it before vma_refcount_put() operation. [surenb@google.com: v3] Link: https://lkml.kernel.org/r/20250729145709.2731370-1-surenb@google.com Link: https://lkml.kernel.org/r/20250728175355.2282375-1-surenb@google.com Fixes: 3104138517fc ("mm: make vma cache SLAB_TYPESAFE_BY_RCU") Signed-off-by: Suren Baghdasaryan Reported-by: Jann Horn Closes: https://lore.kernel.org/all/CAG48ez0-deFbVH=E3jbkWx=X3uVbd8nWeo6kbJPQ0KoUD+m2tA@mail.gmail.com/ Reviewed-by: Vlastimil Babka Acked-by: Lorenzo Stoakes Cc: Jann Horn Cc: Liam Howlett Cc: Signed-off-by: Andrew Morton commit a222439e1e273fa0f4e37ce17aeb109f3e91824f Author: Jann Horn Date: Fri Jul 25 14:16:24 2025 +0200 mm/rmap: add anon_vma lifetime debug check If an anon folio is mapped into userspace, its anon_vma must be alive, otherwise rmap walks can hit UAF. There have been syzkaller reports a few months ago[1][2] of UAF in rmap walks that seems to indicate that there can be pages with elevated mapcount whose anon_vma has already been freed, but I think we never figured out what the cause is; and syzkaller only hit these UAFs when memory pressure randomly caused reclaim to rmap-walk the affected pages, so it of course didn't manage to create a reproducer. Add a VM_WARN_ON_FOLIO() when we add/remove mappings of anonymous folios to hopefully catch such issues more reliably. [1] https://lore.kernel.org/r/67abaeaf.050a0220.110943.0041.GAE@google.com [2] https://lore.kernel.org/r/67a76f33.050a0220.3d72c.0028.GAE@google.com Link: https://lkml.kernel.org/r/20250725-anonvma-uaf-debug-v2-1-bc3c7e5ba5b1@google.com Signed-off-by: Jann Horn Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Acked-by: Harry Yoo Cc: David Hildenbrand Cc: Jann Horn Cc: Liam Howlett Cc: Rik van Riel Signed-off-by: Andrew Morton commit 9a4f90e246615d1f42a9b907deb9b4c0a418d996 Author: Lorenzo Stoakes Date: Fri Jul 25 15:29:01 2025 +0100 mm: remove mm/io-mapping.c This is dead code, which was used from commit b739f125e4eb ("i915: use io_mapping_map_user") but reverted a month later by commit 0e4fe0c9f2f9 ("Revert "i915: use io_mapping_map_user"") back in 2021. Since then nobody has used it, so remove it. [akpm@linux-foundation.org: update Documentation/core-api/mm-api.rst, per Vlastimil] Link: https://lkml.kernel.org/r/20250725142901.81502-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 22d0229093b92db2fe6ca6ba946bad1f246024e8 Author: Dev Jain Date: Thu Jul 24 10:53:01 2025 +0530 khugepaged: optimize collapse_pte_mapped_thp() by PTE batching Use PTE batching to batch process PTEs mapping the same large folio. An improvement is expected due to batching mapcount manipulation on the folios, and for arm64 which supports contig mappings, the number of TLB flushes is also reduced. Note that we do not need to make a change to the check "if (folio_page(folio, i) != page)"; if i'th page of the folio is equal to the first page of our batch, then i + 1, .... i + nr_batch_ptes - 1 pages of the folio will be equal to the corresponding pages of our batch mapping consecutive pages. Link: https://lkml.kernel.org/r/20250724052301.23844-4-dev.jain@arm.com Signed-off-by: Dev Jain Acked-by: David Hildenbrand Reviewed-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Cc: Barry Song Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 4ea3594a47412f9dd20fbda0dc70b0cbec9cba43 Author: Dev Jain Date: Thu Jul 24 10:53:00 2025 +0530 khugepaged: optimize __collapse_huge_page_copy_succeeded() by PTE batching Use PTE batching to batch process PTEs mapping the same large folio. An improvement is expected due to batching refcount-mapcount manipulation on the folios, and for arm64 which supports contig mappings, the number of TLB flushes is also reduced. Link: https://lkml.kernel.org/r/20250724052301.23844-3-dev.jain@arm.com Signed-off-by: Dev Jain Acked-by: David Hildenbrand Reviewed-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Cc: Barry Song Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 3dfde97800e06882960cc926d2c428f2128b7c70 Author: David Hildenbrand Date: Thu Jul 24 10:52:59 2025 +0530 mm: add get_and_clear_ptes() and clear_ptes() Patch series "Optimizations for khugepaged", v4. If the underlying folio mapped by the ptes is large, we can process those ptes in a batch using folio_pte_batch(). For arm64 specifically, this results in a 16x reduction in the number of ptep_get() calls, since on a contig block, ptep_get() on arm64 will iterate through all 16 entries to collect a/d bits. Next, ptep_clear() will cause a TLBI for every contig block in the range via contpte_try_unfold(). Instead, use clear_ptes() to only do the TLBI at the first and last contig block of the range. For split folios, there will be no pte batching; the batch size returned by folio_pte_batch() will be 1. For pagetable split folios, the ptes will still point to the same large folio; for arm64, this results in the optimization described above, and for other arches, a minor improvement is expected due to a reduction in the number of function calls and batching atomic operations. This patch (of 3): Let's add variants to be used where "full" does not apply -- which will be the majority of cases in the future. "full" really only applies if we are about to tear down a full MM. Use get_and_clear_ptes() in existing code, clear_ptes() users will be added next. Link: https://lkml.kernel.org/r/20250724052301.23844-2-dev.jain@arm.com Signed-off-by: David Hildenbrand Signed-off-by: Dev Jain Reviewed-by: Baolin Wang Reviewed-by: Barry Song Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 1623717b057f904d558eb0489fbd592a18750c1e Author: Jinjiang Tu Date: Thu Jul 24 17:09:58 2025 +0800 mm/mincore: hold PTL in mincore_hugetlb Hold PTL in mincore_hugetlb() to avoid operating on stale page, as mincore_pte_range() have done. Link: https://lkml.kernel.org/r/20250724090958.455887-4-tujinjiang@huawei.com Signed-off-by: Jinjiang Tu Acked-by: David Hildenbrand Cc: Andrei Vagin Cc: Andrii Nakryiko Cc: Baolin Wang Cc: Brahmajit Das Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Rientjes Cc: Dev Jain Cc: Hugh Dickins Cc: Joern Engel Cc: Kefeng Wang Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Ryan Roberts Cc: Thiago Jung Bauermann Signed-off-by: Andrew Morton commit 9109bd52559b44a66e4dbde69d0dd36f3e4dcae8 Author: Jinjiang Tu Date: Fri Jul 25 11:31:12 2025 +0800 mm/memory-failure: hold PTL in hwpoison_hugetlb_range Hold PTL in hwpoison_hugetlb_range() to avoid operating on stale page, as hwpoison_pte_range() have done. This change is not known to address any issues which users have experienced. Link: https://lkml.kernel.org/r/20250725033112.2690158-1-tujinjiang@huawei.com Signed-off-by: Jinjiang Tu Acked-by: David Hildenbrand Cc: Andrei Vagin Cc: Andrii Nakryiko Cc: Baolin Wang Cc: Brahmajit Das Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Rientjes Cc: Dev Jain Cc: Hugh Dickins Cc: Joern Engel Cc: Kefeng Wang Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Ryan Roberts Cc: Thiago Jung Bauermann Signed-off-by: Andrew Morton commit 6c2da14ae1e0a0146587381594559027bd46c059 Author: Lorenzo Stoakes Date: Fri Jul 25 09:29:45 2025 +0100 mm/mseal: rework mseal apply logic The logic can be simplified - firstly by renaming the inconsistently named apply_mm_seal() to mseal_apply(). We then wrap mseal_fixup() into the main loop as the logic is simple enough to not require it, equally it isn't a hugely pleasant pattern in mprotect() etc. so it's not something we want to perpetuate. We eliminate the need for invoking vma_iter_end() on each loop by directly determining if the VMA was merged - the only thing we need concern ourselves with is whether the start/end of the (gapless) range are offset into VMAs. This refactoring also avoids the rather horrid 'pass pointer to prev around' pattern used in mprotect() et al. No functional change intended. Link: https://lkml.kernel.org/r/ddfa4376ce29f19a589d7dc8c92cb7d4f7605a4c.1753431105.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Reviewed-by: Liam R. Howlett Acked-by: David Hildenbrand Acked-by: Jeff Xu Cc: Jann Horn Cc: Kees Cook Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 530e090964130d538dfa74874012ca461ef692fa Author: Lorenzo Stoakes Date: Fri Jul 25 09:29:44 2025 +0100 mm/mseal: simplify and rename VMA gap check The check_mm_seal() function is doing something general - checking whether a range contains only VMAs (or rather that it does NOT contain any unmapped regions). So rename this function to range_contains_unmapped(). Additionally simplify the logic, we are simply checking whether the last vma->vm_end has either a VMA starting after it or ends before the end parameter. This check is rather dubious, so it is sensible to keep it local to mm/mseal.c as at a later stage it may be removed, and we don't want any other mm code to perform such a check. No functional change intended. [lorenzo.stoakes@oracle.com: add comment explaining why we disallow gaps on mseal()] Link: https://lkml.kernel.org/r/d85b3d55-09dc-43ba-8204-b48267a96751@lucifer.local Link: https://lkml.kernel.org/r/dd50984eff1e242b5f7f0f070a3360ef760e06b8.1753431105.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Acked-by: David Hildenbrand Acked-by: Jeff Xu Reviewed-by: Pedro Falcato Cc: Jann Horn Cc: Kees Cook Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 8b2914162aa3a56062d4b7c716149946672d48a6 Author: Lorenzo Stoakes Date: Fri Jul 25 09:29:43 2025 +0100 mm/mseal: small cleanups Drop the wholly unnecessary set_vma_sealed() helper(), which is used only once, and place VMA_ITERATOR() declarations in the correct place. Retain vma_is_sealed(), and use it instead of the confusingly named can_modify_vma(), so it's abundantly clear what's being tested, rather then a nebulous sense of 'can the VMA be modified'. No functional change intended. Link: https://lkml.kernel.org/r/98cf28d04583d632a6eb698e9ad23733bb6af26b.1753431105.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Pedro Falcato Acked-by: David Hildenbrand Acked-by: Jeff Xu Cc: Jann Horn Cc: Kees Cook Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d0b47a6866f1047247061f3a38f12a981825b265 Author: Lorenzo Stoakes Date: Fri Jul 25 09:29:42 2025 +0100 mm/mseal: update madvise() logic The madvise() logic is inexplicably performed in mm/mseal.c - this ought to be located in mm/madvise.c. Additionally can_modify_vma_madv() is inconsistently named and, in combination with is_ro_anon(), is very confusing logic. Put a static function in mm/madvise.c instead - can_madvise_modify() - that spells out exactly what's happening. Also explicitly check for an anon VMA. Also add commentary to explain what's going on. Essentially - we disallow discarding of data in mseal()'d mappings in instances where the user couldn't otherwise write to that data. We retain the existing behaviour here regarding MAP_PRIVATE mappings of file-backed mappings, which entails some complexity - while this, strictly speaking - appears to violate mseal() semantics, it may interact badly with users which expect to be able to madvise(MADV_DONTNEED) .text mappings for instance. We may revisit this at a later date. No functional change intended. Link: https://lkml.kernel.org/r/492a98d9189646e92c8f23f4cce41ed323fe01df.1753431105.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Pedro Falcato Acked-by: David Hildenbrand Cc: Jann Horn Cc: Jeff Xu Cc: Kees Cook Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit f225b34f1e6c81c50e48f6207ddb6d290be1b932 Author: Lorenzo Stoakes Date: Fri Jul 25 09:29:41 2025 +0100 mm/mseal: always define VM_SEALED Patch series "mseal cleanups", v4. Perform a number of cleanups to the mseal logic. Firstly, VM_SEALED is treated differently from every other VMA flag, it really doesn't make sense to do this, so we start by making this consistent with everything else. Next we place the madvise logic where it belongs - in mm/madvise.c. It really makes no sense to abstract this elsewhere. In doing so, we go to great lengths to explain very clearly the previously very confusing logic as to what sealed mappings are impacted here. In doing so, we retain existing logic regarding treatment of madvise() discard operations for a sealed, read-only MAP_PRIVATE file-backed mapping. This is something we likely need to revisit. We then abstract out and explain the 'are there are any gaps in this range in the mm?' check being performed as a prerequisite to mseal being performed. Finally, we simplify the actual mseal logic which is really quite straightforward. No functional change is intended. This patch (of 4): There is no reason to treat VM_SEALED in a special way, in each other case in which a VMA flag is unavailable due to configuration, we simply assign that flag to VM_NONE, so make VM_SEALED consistent with all other VMA flags in this respect. Additionally, use the next available bit for VM_SEALED, 42, rather than arbitrarily putting it at 63 and update the declaration to match all other VMA flags. No functional change intended. Link: https://lkml.kernel.org/r/cover.1753431105.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/aeb398a77029b6e7377cd944328bc9bbc3c90537.1753431105.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Liam R. Howlett Reviewed-by: Pedro Falcato Acked-by: David Hildenbrand Cc: Jann Horn Cc: Jeff Xu Cc: Kees Cook Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit dee3ab621f2bab8e58e343bee0302d66c9b035ef Author: Bijan Tabatabai Date: Fri Jul 25 11:33:00 2025 -0500 mm/damon/vaddr: skip isolating folios already in destination nid damos_va_migrate_dests_add() determines the node a folio should be in based on the struct damos_migrate_dests associated with the migration scheme and adds the folio to the linked list corresponding to that node so it can be migrated later. Currently, folios are isolated and added to the list even if they are already in the node they should be in. In using damon weighted interleave more, I've found that the overhead of needlessly adding these folios to the migration lists can be quite high. The overhead comes from isolating folios and placing them in the migration lists inside of damos_va_migrate_dests_add(), as well as the cost of handling those folios in damon_migrate_pages(). This patch eliminates that overhead by simply avoiding the addition of folios that are already in their intended location to the migration list. To show the benefit of this patch, we start the test workload and start a DAMON instance attached to that workload with a migrate_hot scheme that has one dest field sending data to the local node. This way, we are only measuring the overheads of the scheme, and not the cost of migrating pages, since data will be allocated to the local node by default. I tested with two workloads: the embedding reduction workload used in [1] and a microbenchmark that allocates 20GB of data then sleeps, which is similar to the memory usage of the embedding reduction workload. The time taken in damos_va_migrate_dests_add() and damon_migrate_pages() each aggregation interval is shown below. Before this patch: damos_va_migrate_dests_add damon_migrate_pages microbenchmark ~2ms ~3ms embedding reduction ~1s ~3s After this patch: damos_va_migrate_dests_add damon_migrate_pages microbenchmark 0us ~40us embedding reduction 0us ~100us I did not do an in depth analysis for why things are much slower in the embedding reduction workload than the microbenchmark. However, I assume it's because the embedding reduction workload oversaturates the bandwidth of the local memory node, increasing the memory access latency, and in turn making the pointer chasing involved in iterating through a linked list much slower. Regardless of that, this patch results in a significant speedup. [1] https://lore.kernel.org/damon/20250709005952.17776-1-bijan311@gmail.com/ Link: https://lkml.kernel.org/r/20250725163300.4602-1-bijan311@gmail.com Fixes: 19c1dc15c859 ("mm/damon/vaddr: use damos->migrate_dests in migrate_{hot,cold}") Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Reviewed-by: Raghavendra K T Signed-off-by: Andrew Morton commit d6a511dea45ce3e851326b6bdc63f827ebb3e765 Author: Suresh K C Date: Wed Jul 9 23:16:57 2025 +0530 selftests: cachestat: add tests for mmap, refactor and enhance mmap test for cachestat validation Add a cohesive test case that verifies cachestat behavior with memory-mapped files using mmap(). Also refactor the test logic to reduce redundancy, improve error reporting, and clarify failure messages for both shmem and mmap file types. [akpm@linux-foundation.org: coding-style cleanups] Link: https://lkml.kernel.org/r/20250709174657.6916-1-suresh.k.chandrappa@gmail.com Signed-off-by: Suresh K C Reviewed-by: Joshua Hahn Tested-by: Nhat Pham Acked-by: Nhat Pham Cc: Johannes Weiner Cc: Shuah Khan Signed-off-by: Andrew Morton commit 881388f34338197f4ea3adf4d08dc6374c3420c8 Author: Xuanye Liu Date: Wed Jul 23 18:09:00 2025 +0800 mm: add process info to bad rss-counter warning Enhance the debugging information in check_mm() by including the process name and PID when reporting bad rss-counter states. This helps identify which process is associated with the memory accounting issue. Link: https://lkml.kernel.org/r/20250723100901.1909683-1-liuqiye2025@163.com Signed-off-by: Xuanye Liu Acked-by: SeongJae Park Cc: Ben Segall Cc: David Hildenbrand Cc: Dietmar Eggemann Cc: Ingo Molnar Cc: Juri Lelli Cc: Kees Cook Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mel Gorman Cc: Michal Hocko Cc: Mike Rapoport Cc: Peter Zijlstra Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Valentin Schneider Cc: Vincent Guittot Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 56bdf83de7f1151d141e1d020e19cc1c56ff0db4 Author: Jann Horn Date: Wed Jul 23 16:59:19 2025 +0200 kasan: skip quarantine if object is still accessible under RCU Currently, enabling KASAN masks bugs where a lockless lookup path gets a pointer to a SLAB_TYPESAFE_BY_RCU object that might concurrently be recycled and is insufficiently careful about handling recycled objects: KASAN puts freed objects in SLAB_TYPESAFE_BY_RCU slabs onto its quarantine queues, even when it can't actually detect UAF in these objects, and the quarantine prevents fast recycling. When I introduced CONFIG_SLUB_RCU_DEBUG, my intention was that enabling CONFIG_SLUB_RCU_DEBUG should cause KASAN to mark such objects as freed after an RCU grace period and put them on the quarantine, while disabling CONFIG_SLUB_RCU_DEBUG should allow such objects to be reused immediately; but that hasn't actually been working. I discovered such a UAF bug involving SLAB_TYPESAFE_BY_RCU yesterday; I could only trigger this bug in a KASAN build by disabling CONFIG_SLUB_RCU_DEBUG and applying this patch. Link: https://lkml.kernel.org/r/20250723-kasan-tsbrcu-noquarantine-v1-1-846c8645976c@google.com Signed-off-by: Jann Horn Acked-by: Vlastimil Babka Reviewed-by: Alexander Potapenko Acked-by: Andrey Konovalov Cc: Andrey Ryabinin Cc: Dmitriy Vyukov Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit d171b10b2d7b067c16d79e1d069a23a34f088d23 Author: Joanne Koong Date: Tue Jul 22 11:22:30 2025 -0700 mm/page-flags: remove folio_start_writeback_keepwrite() Commit cd57b77197a4 ("ext4: Convert ext4_bio_write_page() to use a folio) removed set_page_writeback_keepwrite() which was the last/only caller of folio_start_writeback_keepwrite(). Link: https://lkml.kernel.org/r/20250722182230.2114587-1-joannelkoong@gmail.com Signed-off-by: Joanne Koong Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton commit b50e37889f9f343b772d9162d00105bb7a26c2f5 Author: wang lian Date: Mon Jul 21 19:46:14 2025 +0800 selftests/mm: add process_madvise() tests Add tests for process_madvise(), focusing on verifying behavior under various conditions including valid usage and error cases. [lianux.mm@gmail.com: v7] Link: https://lkml.kernel.org/r/20250729113109.12272-1-lianux.mm@gmail.com Link: https://lkml.kernel.org/r/20250729113109.12272-1-lianux.mm@gmail.com Link: https://lkml.kernel.org/r/20250721114614.40996-1-lianux.mm@gmail.com Signed-off-by: wang lian Suggested-by: Lorenzo Stoakes Suggested-by: David Hildenbrand Suggested-by: Zi Yan Suggested-by: Mark Brown Acked-by: SeongJae Park Reviewed-by: Zi Yan Tested-by: Zi Yan Cc: Christian Brauner Cc: Jann Horn Cc: Kairui Song Cc: Liam Howlett Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 8d58d65621118fdca3ed6a0b3d658ba7e0e5153c Author: Baolin Wang Date: Thu Jul 31 09:53:43 2025 +0800 mm: shmem: fix the shmem large folio allocation for the i915 driver After commit acd7ccb284b8 ("mm: shmem: add large folio support for tmpfs"), we extend the 'huge=' option to allow any sized large folios for tmpfs, which means tmpfs will allow getting a highest order hint based on the size of write() and fallocate() paths, and then will try each allowable large order. However, when the i915 driver allocates shmem memory, it doesn't provide hint information about the size of the large folio to be allocated, resulting in the inability to allocate PMD-sized shmem, which in turn affects GPU performance. Patryk added: : In my tests, the performance drop ranges from a few percent up to 13% : in Unigine Superposition under heavy memory usage on the CPU Core Ultra : 155H with the Xe 128 EU GPU. Other users have reported performance : impact up to 30% on certain workloads. Please find more in the : regressions reports: : https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14645 : https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13845 : : I believe the change should be backported to all active kernel branches : after version 6.12. To fix this issue, we can use the inode's size as a write size hint in shmem_read_folio_gfp() to help allocate PMD-sized large folios. Link: https://lkml.kernel.org/r/f7e64e99a3a87a8144cc6b2f1dddf7a89c12ce44.1753926601.git.baolin.wang@linux.alibaba.com Fixes: acd7ccb284b8 ("mm: shmem: add large folio support for tmpfs") Signed-off-by: Baolin Wang Reported-by: Patryk Kowalczyk Reported-by: Ville Syrjälä Tested-by: Patryk Kowalczyk Suggested-by: Hugh Dickins Cc: Signed-off-by: Andrew Morton commit 085dece6cc88b5c6fc6f2eca0403bfd2c5fbc7cb Author: Fan Yu Date: Thu Jul 31 22:53:26 2025 +0800 tools/getdelays: add backward compatibility for taskstats version Add version checks to print_delayacct() to handle differences in struct taskstats across kernel versions. Field availability depends on taskstats version (t->version), corresponding to TASKSTATS_VERSION in kernel headers (see include/uapi/linux/taskstats.h). Version feature mapping: - version >= 11 - supports COMPACT statistics - version >= 13 - supports WPCOPY statistics - version >= 14 - supports IRQ statistics - version >= 16 - supports *_max and *_min delay statistics This ensures the tool works correctly with both older and newer kernel versions by conditionally printing fields based on the reported version. eg.1 bash# grep -r "#define TASKSTATS_VERSION" /usr/include/linux/taskstats.h "#define TASKSTATS_VERSION 10" bash# ./getdelays -d -p 1 CPU count real total virtual total delay total delay average 7481 3786181709 3807098291 36393725 0.005ms IO count delay total delay average 369 1116046035 3.025ms SWAP count delay total delay average 0 0 0.000ms RECLAIM count delay total delay average 0 0 0.000ms THRASHING count delay total delay average 0 0 0.000ms eg.2 bash# grep -r "#define TASKSTATS_VERSION" /usr/include/linux/taskstats.h "#define TASKSTATS_VERSION 14" bash# ./getdelays -d -p 1 CPU count real total virtual total delay total delay average 68862 163474790046 174584722267 19962496806 0.290ms IO count delay total delay average 0 0 0.000ms SWAP count delay total delay average 0 0 0.000ms RECLAIM count delay total delay average 0 0 0.000ms THRASHING count delay total delay average 0 0 0.000ms COMPACT count delay total delay average 0 0 0.000ms WPCOPY count delay total delay average 0 0 0.000ms IRQ count delay total delay average 0 0 0.000ms Link: https://lkml.kernel.org/r/20250731225326549CttJ7g9NfjTlaqBwl015T@zte.com.cn Signed-off-by: Fan Yu Cc: Fan Yu Cc: Jonathan Corbet Cc: Wang Yaxin Cc: xu xin Cc: Yang Yang Signed-off-by: Andrew Morton commit b753522bed0b7e388a643f58d91bd81d8849ba43 Author: Mike Rapoport (Microsoft) Date: Sun Jul 27 11:37:33 2025 +0300 kho: add test for kexec handover Testing kexec handover requires a kernel driver that will generate some data and preserve it with KHO on the first boot and then restore that data and verify it was preserved properly after kexec. To facilitate such test, along with the kernel driver responsible for data generation, preservation and restoration add a script that runs a kernel in a VM with a minimal /init. The /init enables KHO, loads a kernel image for kexec and runs kexec reboot. After the boot of the kexeced kernel, the driver verifies that the data was properly preserved. [rppt@kernel.org: fix section mismatch] Link: https://lkml.kernel.org/r/aIiRC8fXiOXKbPM_@kernel.org Link: https://lkml.kernel.org/r/20250727083733.2590139-1-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Cc: Alexander Graf Cc: Changyuan Lyu Cc: Pasha Tatashin Cc: Pratyush Yadav Cc: Shuah Khan Signed-off-by: Andrew Morton commit d92dccd05a20b7a9c2836d4e46e22128f5b73367 Author: fan.yu9@zte.com.cn Date: Mon Jul 28 16:28:34 2025 +0800 delaytop: enhance error logging and add PSI feature description This patch improves error diagnostics and documentation for delaytop: 1) Enhanced error logging: - Added explicit error messages in critical failure paths - Implemented BOOL_FPRINT macro for robust output handling 2) PSI feature documentation: - Updated header comment to reflect PSI monitoring capability - Improved output formatting for PSI information System Pressure Information: (avg10/avg60/avg300/total) CPU some: 0.0%/ 0.0%/ 0.0%/ 345(ms) CPU full: 0.0%/ 0.0%/ 0.0%/ 0(ms) Memory full: 0.0%/ 0.0%/ 0.0%/ 0(ms) Memory some: 0.0%/ 0.0%/ 0.0%/ 0(ms) IO full: 0.0%/ 0.0%/ 0.0%/ 65(ms) IO some: 0.0%/ 0.0%/ 0.0%/ 79(ms) IRQ full: 0.0%/ 0.0%/ 0.0%/ 0(ms) Link: https://lkml.kernel.org/r/202507281628341752gMXCMN7S-Vz_LHYHum9r@zte.com.cn Signed-off-by: Fan Yu Signed-off-by: Wang Yaxin Acked-by: Yang Yang Cc: Fan Yu Cc: Jonathan Corbet Cc: xu xin Signed-off-by: Andrew Morton commit 8c54f7e3e0eab0174683a562051417317c4ea297 Author: Colin Ian King Date: Thu Jul 24 12:17:15 2025 +0100 samples: Kconfig: fix spelling mistake "instancess" -> "instances" There is a spelling mistake in the SAMPLE_TRACE_ARRAY config. Fix it. Link: https://lkml.kernel.org/r/20250724111715.141826-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Signed-off-by: Andrew Morton commit fb0e9db99eefc17cb8693ce93afe5c5dbc5148a5 Author: OGAWA Hirofumi Date: Thu Jul 24 16:42:10 2025 +0900 fat: fix too many log in fat_chain_add() This log was excessive for a serial console. So use the ratelimited version instead. Link: https://lkml.kernel.org/r/87qzy611d9.fsf@mail.parknet.co.jp Signed-off-by: OGAWA Hirofumi Reported-by: syzbot+fa7ef54f66c189c04b73@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fa7ef54f66c189c04b73 Cc: Namjae Jeon Cc: Sungjong Seo Signed-off-by: Andrew Morton commit 53f433891e698e76aaf01b84b30a17a79a53535c Author: WangYuli Date: Tue Jul 22 15:34:31 2025 +0800 scripts/spelling.txt: add notifer||notifier to spelling.txt This typo was not listed in scripts/spelling.txt, thus it was more difficult to detect. Add it for convenience. Link: https://lkml.kernel.org/r/02153C05ED7B49B7+20250722073431.21983-8-wangyuli@uniontech.com Signed-off-by: WangYuli Reviewed-by: Jonathan Cameron Signed-off-by: Andrew Morton commit 004f42dd90b7ef542a51983bdaa5b2ef621ed41d Author: WangYuli Date: Tue Jul 22 15:34:30 2025 +0800 xen/xenbus: fix typo "notifer" There is a spelling mistake of 'notifer' in the comment which should be 'notifier'. Link: https://lkml.kernel.org/r/C6633C66376C709A+20250722073431.21983-7-wangyuli@uniontech.com Signed-off-by: WangYuli Reviewed-by: Juergen Gross Signed-off-by: Andrew Morton commit 545040384e78d6eaabb20e1f4baa85ace864dcfc Author: WangYuli Date: Tue Jul 22 15:34:27 2025 +0800 net: mvneta: fix typo "notifer" There is a spelling mistake of 'notifer' in the comment which should be 'notifier'. Link: https://lkml.kernel.org/r/0CB4300CB6F49007+20250722073431.21983-4-wangyuli@uniontech.com Signed-off-by: WangYuli Reviewed-by: Simon Horman Signed-off-by: Andrew Morton commit 26197b0fd220ceb2b26f2ea2948c00fdd9855fae Author: WangYuli Date: Tue Jul 22 15:34:26 2025 +0800 drm/xe: fix typo "notifer" There is a spelling mistake of 'notifer' in the comment which should be 'notifier'. Link: https://lkml.kernel.org/r/94190C5F54A19F3E+20250722073431.21983-3-wangyuli@uniontech.com Signed-off-by: WangYuli Reviewed-by: Thomas Hellström Signed-off-by: Andrew Morton commit fbedfb051a4c74854c23f9c898fc6b29fab7be60 Author: WangYuli Date: Tue Jul 22 15:34:25 2025 +0800 cxl: mce: fix typo "notifer" According to the context, "mce_notifer" should be "mce_notifier". Link: https://lkml.kernel.org/r/E1EB1BA9FDF07D53+20250722073431.21983-2-wangyuli@uniontech.com Fixes: 516e5bd0b6bf ("cxl: Add mce notifier to emit aliased address for extended linear cache") Signed-off-by: WangYuli Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Andrew Morton commit a30469cac8ce6555284948dab30066ce1ea43548 Author: WangYuli Date: Tue Jul 22 15:34:24 2025 +0800 KVM: x86: fix typo "notifer" Patch series "treewide: Fix typo "notifer"", v3. There are some spelling mistakes of 'notifer' in comments which should be 'notifier'. Fix them and add it to scripts/spelling.txt. This patch (of 8): There are some spelling mistakes of 'notifer' which should be 'notifier'. Link: https://lkml.kernel.org/r/576F0D85F6853074+20250722072734.19367-1-wangyuli@uniontech.com Link: https://lkml.kernel.org/r/7F05778C3A1A9F8B+20250722073431.21983-1-wangyuli@uniontech.com Signed-off-by: WangYuli Signed-off-by: Andrew Morton commit 1f03d55e5ef0b041bd66fbf7803952c901a93fcb Author: Wang Yaxin Date: Mon Jul 21 09:40:49 2025 +0800 MAINTAINERS: add maintainers for delaytop The delaytop tool supports showing system delays and task-level delays, effectively identifying the top-n tasks with high latency in the system, which is highly beneficial for improving system performance. Wang Yaxin and her colleague Fan Yu focus on locating system delay issues. To promote the thriving development of delaytop, we hope to serve as maintainers to continuously improve it, aiming to provide a more effective solution for system latency issues in the future. Link: https://lkml.kernel.org/r/20250721094049958ImB8XG_imntcPqpQn1KfG@zte.com.cn Signed-off-by: Wang Yaxin Signed-off-by: Fan Yu Reviewed-by: Yang Yang Cc: Balbir Singh Cc: xu xin Cc: Krzysztof Kozlowski Signed-off-by: Andrew Morton commit 58b4fba81a2e400a47ddbe7c1dc0a2bc038313b7 Author: Uros Bizjak Date: Mon Jul 21 19:45:58 2025 +0200 ucount: use atomic_long_try_cmpxchg() in atomic_long_inc_below() Use atomic_long_try_cmpxchg() instead of atomic_long_cmpxchg (*ptr, old, new) == old in atomic_long_inc_below(). x86 CMPXCHG instruction returns success in ZF flag, so this change saves a compare after cmpxchg (and related move instruction in front of cmpxchg). Also, atomic_long_try_cmpxchg implicitly assigns old *ptr value to "old" when cmpxchg fails, enabling further code simplifications. No functional change intended. Link: https://lkml.kernel.org/r/20250721174610.28361-2-ubizjak@gmail.com Signed-off-by: Uros Bizjak Reviewed-by: Alexey Gladkov Cc: Sebastian Andrzej Siewior Cc: "Paul E. McKenney" Cc: Alexey Gladkov Cc: Roman Gushchin Cc: MengEn Sun Cc: "Thomas Weißschuh" Signed-off-by: Andrew Morton commit f8cd9193b62e92ad25def5370ca8ea2bc7585381 Author: Uros Bizjak Date: Mon Jul 21 19:45:57 2025 +0200 ucount: fix atomic_long_inc_below() argument type The type of u argument of atomic_long_inc_below() should be long to avoid unwanted truncation to int. The patch fixes the wrong argument type of an internal function to prevent unwanted argument truncation. It fixes an internal locking primitive; it should not have any direct effect on userspace. Mark said : AFAICT there's no problem in practice because atomic_long_inc_below() : is only used by inc_ucount(), and it looks like the value is : constrained between 0 and INT_MAX. : : In inc_ucount() the limit value is taken from : user_namespace::ucount_max[], and AFAICT that's only written by : sysctls, to the table setup by setup_userns_sysctls(), where : UCOUNT_ENTRY() limits the value between 0 and INT_MAX. : : This is certainly a cleanup, but there might be no functional issue in : practice as above. Link: https://lkml.kernel.org/r/20250721174610.28361-1-ubizjak@gmail.com Fixes: f9c82a4ea89c ("Increase size of ucounts to atomic_long_t") Signed-off-by: Uros Bizjak Reviewed-by: "Eric W. Biederman" Cc: Sebastian Andrzej Siewior Cc: "Paul E. McKenney" Cc: Alexey Gladkov Cc: Roman Gushchin Cc: MengEn Sun Cc: "Thomas Weißschuh" Cc: Mark Rutland Signed-off-by: Andrew Morton commit 07d24902977e4704fab8472981e73a0ad6dfa1fd Author: Alexander Graf Date: Tue Jun 10 08:53:27 2025 +0000 kexec: enable CMA based contiguous allocation When booting a new kernel with kexec_file, the kernel picks a target location that the kernel should live at, then allocates random pages, checks whether any of those patches magically happens to coincide with a target address range and if so, uses them for that range. For every page allocated this way, it then creates a page list that the relocation code - code that executes while all CPUs are off and we are just about to jump into the new kernel - copies to their final memory location. We can not put them there before, because chances are pretty good that at least some page in the target range is already in use by the currently running Linux environment. Copying is happening from a single CPU at RAM rate, which takes around 4-50 ms per 100 MiB. All of this is inefficient and error prone. To successfully kexec, we need to quiesce all devices of the outgoing kernel so they don't scribble over the new kernel's memory. We have seen cases where that does not happen properly (*cough* GIC *cough*) and hence the new kernel was corrupted. This started a month long journey to root cause failing kexecs to eventually see memory corruption, because the new kernel was corrupted severely enough that it could not emit output to tell us about the fact that it was corrupted. By allocating memory for the next kernel from a memory range that is guaranteed scribbling free, we can boot the next kernel up to a point where it is at least able to detect corruption and maybe even stop it before it becomes severe. This increases the chance for successful kexecs. Since kexec got introduced, Linux has gained the CMA framework which can perform physically contiguous memory mappings, while keeping that memory available for movable memory when it is not needed for contiguous allocations. The default CMA allocator is for DMA allocations. This patch adds logic to the kexec file loader to attempt to place the target payload at a location allocated from CMA. If successful, it uses that memory range directly instead of creating copy instructions during the hot phase. To ensure that there is a safety net in case anything goes wrong with the CMA allocation, it also adds a flag for user space to force disable CMA allocations. Using CMA allocations has two advantages: 1) Faster by 4-50 ms per 100 MiB. There is no more need to copy in the hot phase. 2) More robust. Even if by accident some page is still in use for DMA, the new kernel image will be safe from that access because it resides in a memory region that is considered allocated in the old kernel and has a chance to reinitialize that component. Link: https://lkml.kernel.org/r/20250610085327.51817-1-graf@amazon.com Signed-off-by: Alexander Graf Acked-by: Baoquan He Reviewed-by: Pasha Tatashin Cc: Zhongkun He Signed-off-by: Andrew Morton commit ed4f142f72a9191b8236778093074c277435bf8a Author: Matt Fleming Date: Fri Jul 18 16:39:28 2025 +0100 stackdepot: make max number of pools boot-time configurable We're hitting the WARN in depot_init_pool() about reaching the stack depot limit because we have long stacks that don't dedup very well. Introduce a new start-up parameter to allow users to set the number of maximum stack depot pools. Link: https://lkml.kernel.org/r/20250718153928.94229-1-matt@readmodwrite.com Signed-off-by: Matt Fleming Acked-by: Vlastimil Babka Acked-by: Marco Elver Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitriy Vyukov Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 6c6d8f8ba7789c221a2e4c43a0ed982c7a41f428 Author: Dr. David Alan Gilbert Date: Wed Jul 16 14:32:45 2025 +0100 lib/xxhash: remove unused functions xxh32_digest() and xxh32_update() were added in 2017 in the original xxhash commit, but have remained unused. Remove them. Link: https://lkml.kernel.org/r/20250716133245.243363-1-linux@treblig.org Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Christoph Hellwig Cc: Dave Gilbert Cc: Nick Terrell Signed-off-by: Andrew Morton commit fefbeed8c6f62dc10f80a6b1787e75de2c64ad0d Author: Andrew Morton Date: Mon Jul 14 17:20:02 2025 -0700 init/Kconfig: restore CONFIG_BROKEN help text Linus added it in 2003, it later was removed. Put it back. Cc: Anshuman Khandual Cc: Borislav Betkov Cc: David S. Miller Cc: Ingo Molnar Cc: Thomas Gleinxer Cc: Christophe Leroy Signed-off-by: Andrew Morton commit 5c241ed8d031693dadf33dd98ed2e7cc363e9b66 Author: Kairui Song Date: Mon Jul 28 15:52:59 2025 +0800 mm/shmem, swap: improve cached mTHP handling and fix potential hang The current swap-in code assumes that, when a swap entry in shmem mapping is order 0, its cached folios (if present) must be order 0 too, which turns out not always correct. The problem is shmem_split_large_entry is called before verifying the folio will eventually be swapped in, one possible race is: CPU1 CPU2 shmem_swapin_folio /* swap in of order > 0 swap entry S1 */ folio = swap_cache_get_folio /* folio = NULL */ order = xa_get_order /* order > 0 */ folio = shmem_swap_alloc_folio /* mTHP alloc failure, folio = NULL */ <... Interrupted ...> shmem_swapin_folio /* S1 is swapped in */ shmem_writeout /* S1 is swapped out, folio cached */ shmem_split_large_entry(..., S1) /* S1 is split, but the folio covering it has order > 0 now */ Now any following swapin of S1 will hang: `xa_get_order` returns 0, and folio lookup will return a folio with order > 0. The `xa_get_order(&mapping->i_pages, index) != folio_order(folio)` will always return false causing swap-in to return -EEXIST. And this looks fragile. So fix this up by allowing seeing a larger folio in swap cache, and check the whole shmem mapping range covered by the swapin have the right swap value upon inserting the folio. And drop the redundant tree walks before the insertion. This will actually improve performance, as it avoids two redundant Xarray tree walks in the hot path, and the only side effect is that in the failure path, shmem may redundantly reallocate a few folios causing temporary slight memory pressure. And worth noting, it may seems the order and value check before inserting might help reducing the lock contention, which is not true. The swap cache layer ensures raced swapin will either see a swap cache folio or failed to do a swapin (we have SWAP_HAS_CACHE bit even if swap cache is bypassed), so holding the folio lock and checking the folio flag is already good enough for avoiding the lock contention. The chance that a folio passes the swap entry value check but the shmem mapping slot has changed should be very low. Link: https://lkml.kernel.org/r/20250728075306.12704-1-ryncsn@gmail.com Link: https://lkml.kernel.org/r/20250728075306.12704-2-ryncsn@gmail.com Fixes: 809bc86517cc ("mm: shmem: support large folio swap out") Signed-off-by: Kairui Song Reviewed-by: Kemeng Shi Reviewed-by: Baolin Wang Tested-by: Baolin Wang Cc: Baoquan He Cc: Barry Song Cc: Chris Li Cc: Hugh Dickins Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Cc: Dev Jain Cc: Signed-off-by: Andrew Morton commit be71ce9796c36517c677ab1d3c6691423dd0bdec Author: Johan Hovold Date: Tue Jul 8 10:51:23 2025 +0200 drm/bridge: fix OF node leak Make sure to drop the OF node reference taken when creating the aux bridge device when the device is later released. Fixes: 6914968a0b52 ("drm/bridge: properly refcount DT nodes in aux bridge drivers") Cc: Dmitry Baryshkov Signed-off-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250708085124.15445-2-johan@kernel.org Signed-off-by: Dmitry Baryshkov commit eacf91b0c78a7113844830ed65ebf543eb9052c5 Merge: 7061835997daba 81b96e4aef9592 Author: Linus Torvalds Date: Sat Aug 2 09:58:11 2025 -0700 Merge tag 'fbdev-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev Pull fbdev updates from Helge Deller: "One potential buffer overflow fix in the framebuffer registration function, some fixes for the imxfb, nvidiafb and simplefb drivers, and a bunch of cleanups for fbcon, kyrofb and svgalib. Framework fixes: - fix potential buffer overflow in do_register_framebuffer() [Yongzhen Zhang] Driver fixes: - imxfb: prevent null-ptr-deref [Chenyuan Yang] - nvidiafb: fix build on 32-bit ARCH=um [Johannes Berg] - nvidiafb: add depends on HAS_IOPORT [Randy Dunlap] - simplefb: Use of_reserved_mem_region_to_resource() for "memory-region" [Rob Herring] Cleanups: - fbcon: various code cleanups wrt blinking [Ville Syrjälä] - kyrofb: Convert to devm_*() functions [Giovanni Di Santi] - svgalib: Coding style cleanups [Darshan R.] - Fix typo in Kconfig text for FB_DEVICE [Daniel Palmer]" * tag 'fbdev-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: fbcon: Use 'bool' where appopriate fbcon: Introduce get_{fg,bg}_color() fbcon: fbcon_is_inactive() -> fbcon_is_active() fbcon: fbcon_cursor_noblink -> fbcon_cursor_blink fbdev: Fix typo in Kconfig text for FB_DEVICE fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref fbdev: svgalib: Clean up coding style fbdev: kyro: Use devm_ioremap_wc() for screen mem fbdev: kyro: Use devm_ioremap() for mmio registers fbdev: kyro: Add missing PCI memory region request fbdev: simplefb: Use of_reserved_mem_region_to_resource() for "memory-region" fbdev: fix potential buffer overflow in do_register_framebuffer() fbdev: nvidiafb: add depends on HAS_IOPORT fbdev: nvidiafb: fix build on 32-bit ARCH=um commit 7061835997daba9e73c723c85bd70bc4c44aef77 Merge: a6923c06a3b2e2 95a042a0c8ecd3 Author: Linus Torvalds Date: Sat Aug 2 09:52:53 2025 -0700 Merge tag 'firewire-updates-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394 Pull firewire updates from Takashi Sakamoto: "This update replaces the remaining tasklet usage in the FireWire subsystem with workqueue for asynchronous packet transmission. With this change, tasklets are now fully eliminated from the subsystem. Asynchronous packet transmission is used for serial bus topology management as well as for the operation of the SBP-2 protocol driver (firewire-sbp2). To ensure reliability during low-memory conditions, the associated workqueue is created with the WQ_MEM_RECLAIM flag, allowing it to participate in memory reclaim paths. Other attributes are aligned with those used for isochronous packet handling, which was migrated to workqueues in v6.12. The workqueues are sleepable and support preemptible work items, making them more suitable for real-time workloads that benefit from timely task preemption at the system level. There remains an issue where 'schedule()' may be called within an RCU read-side critical section, due to a direct replacement of 'tasklet_disable_in_atomic()' with 'disable_work_sync()'. A proposed fix for this has been posted[1], and is currently under review and testing. It is expected to be sent upstream later" Link: https://lore.kernel.org/lkml/20250728015125.17825-1-o-takashi@sakamocchi.jp/ [1] * tag 'firewire-updates-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394: firewire: ohci: reduce the size of common context structure by extracting members into AT structure firewire: core: minor code refactoring to localize table of gap count firewire: ohci: use workqueue to handle events of AT request/response contexts firewire: ohci: use workqueue to handle events of AR request/response contexts firewire: core: allocate workqueue for AR/AT request/response contexts firewire: core: use from_work() macro to expand parent structure of work_struct firewire: ohci: use from_work() macro to expand parent structure of work_struct firewire: ohci: correct code comments about bus_reset tasklet commit 1b30d44417278196a90c79244bb43e8428586345 Author: Eduard Zingerman Date: Fri Aug 1 16:23:30 2025 -0700 bpf: Fix memory leak of bpf_scc_info objects env->scc_info array contains references to bpf_scc_info objects allocated lazily in verifier.c:scc_visit_alloc(). env->scc_cnt was supposed to track env->scc_info array size in order to free referenced objects in verifier.c:free_states(). Fix initialization of env->scc_cnt that was omitted in verifier.c:compute_scc(). To reproduce the bug: - build with CONFIG_DEBUG_KMEMLEAK - boot and load bpf program with loops, e.g.: ./veristat -q pyperf180.bpf.o - initiate memleak scan and check results: echo scan > /sys/kernel/debug/kmemleak cat /sys/kernel/debug/kmemleak Fixes: c9e31900b54c ("bpf: propagate read/precision marks over state graph backedges") Reported-by: Jens Axboe Closes: https://lore.kernel.org/bpf/CAADnVQKXUWg9uRCPD5ebRXwN4dmBCRUFFM7kN=GxymYz3zU25A@mail.gmail.com/T/ Suggested-by: Alexei Starovoitov Tested-by: Jens Axboe Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250801232330.1800436-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 0808da36b982442afc4a34555e492a16f2e5973e Author: Sean Anderson Date: Fri Aug 1 11:47:10 2025 -0400 ALSA: usb-audio: Don't use printk_ratelimit for debug prints printk_ratelimit is deprecated, since it shares state with all other printk sites. Additionally, the suppression message is printed at warning level even though the actual messages are printed at debug and are (usually) invisible! This can result in thousands of messages like retire_capture_urb: 4992 callbacks suppressed in the console, and can inhibit debugging since it is unclear what the source of the suppressed callbacks is. Switch to dev_dbg_ratelimited which doesn't print anything unless debug is enabled. Signed-off-by: Sean Anderson Link: https://patch.msgid.link/20250801154710.739464-1-sean.anderson@linux.dev Signed-off-by: Takashi Iwai commit e703b7e247503b8bf87b62c02a4392749b09eca8 Author: Thomas Gleixner Date: Wed Jul 30 21:44:55 2025 +0200 futex: Move futex cleanup to __mmdrop() Futex hash allocations are done in mm_init() and the cleanup happens in __mmput(). That works most of the time, but there are mm instances which are instantiated via mm_alloc() and freed via mmdrop(), which causes the futex hash to be leaked. Move the cleanup to __mmdrop(). Fixes: 56180dd20c19 ("futex: Use RCU-based per-CPU reference counting instead of rcuref_t") Reported-by: André Draszik Signed-off-by: Thomas Gleixner Tested-by: André Draszik Link: https://lore.kernel.org/all/87ldo5ihu0.ffs@tglx Closes: https://lore.kernel.org/all/0c8cc83bb73abf080faf584f319008b67d0931db.camel@linaro.org commit 83e6384374bac8a9da3411fae7f24376a7dbd2a3 Author: Roman Kisel Date: Tue Jul 22 09:18:18 2025 -0700 smp: Fix spelling in on_each_cpu_cond_mask()'s doc-comment "boolean" is spelt as "blooean". Fix that. Signed-off-by: Roman Kisel Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250722161818.6139-1-romank@linux.microsoft.com commit 0a91336e287ca2557fead5221d2c79e0effd034e Merge: 038d61fd642278 cd7c97f4584a93 Author: Huacai Chen Date: Sat Aug 2 11:07:06 2025 +0800 Merge tag 'bpf-next-6.17' into loongarch-next LoongArch architecture changes for 6.17 have many bpf features such as trampoline, so merge 'bpf-next-6.17' to create a base to make bpf work well. commit a6923c06a3b2e2c534ae28c53a7531e76cc95cfa Merge: f4f346c3465949 d8d2d9d12f1413 Author: Linus Torvalds Date: Fri Aug 1 17:13:26 2025 -0700 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Fix kCFI failures in JITed BPF code on arm64 (Sami Tolvanen, Puranjay Mohan, Mark Rutland, Maxwell Bland) - Disallow tail calls between BPF programs that use different cgroup local storage maps to prevent out-of-bounds access (Daniel Borkmann) - Fix unaligned access in flow_dissector and netfilter BPF programs (Paul Chaignon) - Avoid possible use of uninitialized mod_len in libbpf (Achill Gilgenast) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: selftests/bpf: Test for unaligned flow_dissector ctx access bpf: Improve ctx access verifier error message bpf: Check netfilter ctx accesses are aligned bpf: Check flow_dissector ctx accesses are aligned arm64/cfi,bpf: Support kCFI + BPF on arm64 cfi: Move BPF CFI types and helpers to generic code cfi: add C CFI type macro libbpf: Avoid possible use of uninitialized mod_len bpf: Fix oob access in cgroup local storage bpf: Move cgroup iterator helpers to bpf.h bpf: Move bpf map owner out of common struct bpf: Add cookie object to bpf maps commit f4f346c3465949ebba80c6cc52cd8d2eeaa545fd Merge: 0905809b38bda1 6235ce77749f45 Author: Linus Torvalds Date: Fri Aug 1 16:55:47 2025 -0700 Merge tag 'perf-tools-for-v6.17-2025-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools Pull perf tools updates from Namhyung Kim: "Build-ID processing goodies: Build-IDs are content based hashes to link regions of memory to ELF files in post processing. They have been available in distros for quite a while: $ file /bin/bash /bin/bash: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=707a1c670cd72f8e55ffedfbe94ea98901b7ce3a, for GNU/Linux 3.2.0, stripped It is possible to ask the kernel to get it from mmap executable backing storage at time they are being put in place and send it as metadata at that moment to have in perf.data. Prefer that across the board to speed up 'record' time - it post processes the samples to find binaries touched by any samples and to save them with build-ID. It can skip reading build-ID in userspace if it comes from the kernel. perf record: * Make --buildid-mmap default. The kernel can generate MMAP2 events with a build-ID from ELF header. Use that by default instead of using inode and device ID to identify binaries. It also can be disabled with --no-buildid-mmap. * Use BPF for -u/--uid option to sample processes belong to a user. BPF can track user processes more accurately and the existing logic often fails to get the list of processes due to race with reading the /proc filesystem. * Generate PERF_RECORD_BPF_METADATA when it profiles BPF programs and they have variables starting with "bpf_metadata_". This will help to identify BPF objects used in the profile. This has been supported in bpftool for some time and allows the recording of metadata such as commit hashes, versions, etc, that now gets recorded in perf.data as well. * Collect list of DSOs touched in the sample callchains as well as in the sample itself. This would increase the processing time at the end of record, but can improve the data quality. perf stat: * Add a new 'drm' pseudo-PMU support like in 'hwmon'. It can collect DRM usage stats using fdinfo in /proc. On my Intel laptop, it shows like below: $ perf list drm ... drm: drm-active-stolen-system0 [Total memory active in one or more engines. Unit: drm_i915] drm-active-system0 [Total memory active in one or more engines. Unit: drm_i915] drm-engine-capacity-video [Engine capacity. Unit: drm_i915] drm-engine-copy [Utilization in ns. Unit: drm_i915] drm-engine-render [Utilization in ns. Unit: drm_i915] drm-engine-video [Utilization in ns. Unit: drm_i915] ... $ sudo perf stat -a -e drm-engine-render,drm-engine-video,drm-engine-capacity-video sleep 1 Performance counter stats for 'system wide': 48,137,316,988,873 ns drm-engine-render 34,452,696,746 ns drm-engine-video 20 capacity drm-engine-capacity-video 1.002086194 seconds time elapsed perf list * Add description for software events. The description is in JSON format and the event parser now can handle the software events like others (for example, it's case-insensitive and subject to wildcard matching). $ perf list software List of pre-defined events (to be used in -e or -M): software: alignment-faults [Number of kernel handled memory alignment faults. Unit: software] bpf-output [An event used by BPF programs to write to the perf ring buffer. Unit: software] cgroup-switches [Number of context switches to a task in a different cgroup. Unit: software] context-switches [Number of context switches [This event is an alias of cs]. Unit: software] cpu-clock [Per-CPU high-resolution timer based event. Unit: software] cpu-migrations [Number of times a process has migrated to a new CPU [This event is an alias of migrations]. Unit: software] cs [Number of context switches [This event is an alias of context-switches]. Unit: software] dummy [A placeholder event that doesn't count anything. Unit: software] emulation-faults [Number of kernel handled unimplemented instruction faults handled through emulation. Unit: software] faults [Number of page faults [This event is an alias of page-faults]. Unit: software] major-faults [Number of major page faults. Major faults require I/O to handle. Unit: software] migrations [Number of times a process has migrated to a new CPU [This event is an alias of cpu-migrations]. Unit: software] minor-faults [Number of minor page faults. Minor faults don't require I/O to handle. Unit: software] page-faults [Number of page faults [This event is an alias of faults]. Unit: software] task-clock [Per-task high-resolution timer based event. Unit: software] perf ftrace: * Add -e/--events option to perf ftrace latency to measure latency between the two events instead of a function. $ sudo perf ftrace latency -ab -e i915_request_wait_begin,i915_request_wait_end --hide-empty -- sleep 1 # DURATION | COUNT | GRAPH | 256 - 512 us | 4 | ###### | 2 - 4 ms | 2 | ### | 4 - 8 ms | 12 | ################### | 8 - 16 ms | 10 | ################ | # statistics (in usec) total time: 194915 avg time: 6961 max time: 12855 min time: 373 count: 28 * Add new function graph tracer options (--graph-opts) to display more info like arguments and return value. They will be passed to the kernel ftrace directly. $ sudo perf ftrace -G vfs_write --graph-opts retval,retaddr # tracer: function_graph # # CPU DURATION FUNCTION CALLS # | | | | | | | ... 5) | mutex_unlock() { /* <-rb_simple_write+0xda/0x150 */ 5) 0.188 us | local_clock(); /* <-lock_release+0x2ad/0x440 ret=0x3bf2a3cf90e */ 5) | rt_mutex_slowunlock() { /* <-rb_simple_write+0xda/0x150 */ 5) | _raw_spin_lock_irqsave() { /* <-rt_mutex_slowunlock+0x4f/0x200 */ 5) 0.123 us | preempt_count_add(); /* <-_raw_spin_lock_irqsave+0x23/0x90 ret=0x0 */ 5) 0.128 us | local_clock(); /* <-__lock_acquire.isra.0+0x17a/0x740 ret=0x3bf2a3cfc8b */ 5) 0.086 us | do_raw_spin_trylock(); /* <-_raw_spin_lock_irqsave+0x4a/0x90 ret=0x1 */ 5) 0.845 us | } /* _raw_spin_lock_irqsave ret=0x292 */ ... Misc: * Add perf archive --exclude-buildids option to skip some binaries. The format of the FILE should be same as an output of perf buildid-list. * Get rid of dependency of libcrypto. It was just to get SHA-1 hash so implement it directly like in the kernel. A side effect is that it needs -fno-strict-aliasing compiler option (again, like in the kernel). * Convert all shell script tests to use bash" * tag 'perf-tools-for-v6.17-2025-08-01' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (179 commits) perf record: Cache build-ID of hit DSOs only perf test: Ensure lock contention using pipe mode perf python: Stop using deprecated PyUnicode_AsString() perf list: Skip ABI PMUs when printing pmu values perf list: Remove tracepoint printing code perf tp_pmu: Add event APIs perf tp_pmu: Factor existing tracepoint logic to new file perf parse-events: Remove non-json software events perf jevents: Add common software event json perf tools: Remove libtraceevent in .gitignore perf test: Fix comment ordering perf sort: Use perf_env to set arch sort keys and header perf test: Move PERF_SAMPLE_WEIGHT_STRUCT parsing to common test perf sample: Remove arch notion of sample parsing perf env: Remove global perf_env perf trace: Avoid global perf_env with evsel__env perf auxtrace: Pass perf_env from session through to mmap read perf machine: Explicitly pass in host perf_env perf bench synthesize: Avoid use of global perf_env perf top: Make perf_env locally scoped ... commit 0905809b38bda1fa0b206986c44d846e46f13c1d Merge: d41e5839d80043 89f686a0fb6e47 Author: Linus Torvalds Date: Fri Aug 1 16:15:53 2025 -0700 Merge tag 'parisc-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux Pull parisc updates from Helge Deller: - The parisc kernel wrongly allows reading from read-protected userspace memory without faulting, e.g. when userspace uses mprotect() to read-protect a memory area and then uses a pointer to this memory in a write(2, addr, 1) syscall. To fix this issue, Dave Anglin developed a set of patches which use the proberi assembler instruction to additionally check read access permissions at runtime. - Randy Dunlap contributed two patches to fix a minor typo and to explain why a 32-bit compiler is needed although a 64-bit kernel is built * tag 'parisc-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux: parisc: Revise __get_user() to probe user read access parisc: Revise gateway LWS calls to probe user read access parisc: Drop WARN_ON_ONCE() from flush_cache_vmap parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() parisc: Define and use set_pte_at() parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c parisc: Check region is readable by user in raw_copy_from_user() parisc: Update comments in make_insert_tlb parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers parisc: Makefile: fix a typo in palo.conf commit 3ca824369b71d4b441e1fdcdee8e66bcb05510a9 Author: Steven Rostedt Date: Fri Aug 1 16:56:01 2025 -0400 tracing: Have unsigned int function args displayed as hexadecimal Most function arguments that are passed in as unsigned int or unsigned long are better displayed as hexadecimal than normal integer. For example, the functions: static void __create_object(unsigned long ptr, size_t size, int min_count, gfp_t gfp, unsigned int objflags); static bool stack_access_ok(struct unwind_state *state, unsigned long _addr, size_t len); void __local_bh_disable_ip(unsigned long ip, unsigned int cnt); Show up in the trace as: __create_object(ptr=-131387050520576, size=4096, min_count=1, gfp=3264, objflags=0) <-kmem_cache_alloc_noprof stack_access_ok(state=0xffffc9000233fc98, _addr=-60473102566256, len=8) <-unwind_next_frame __local_bh_disable_ip(ip=-2127311112, cnt=256) <-handle_softirqs Instead, by displaying unsigned as hexadecimal, they look more like this: __create_object(ptr=0xffff8881028d2080, size=0x280, min_count=1, gfp=0x82820, objflags=0x0) <-kmem_cache_alloc_node_noprof stack_access_ok(state=0xffffc90000003938, _addr=0xffffc90000003930, len=0x8) <-unwind_next_frame __local_bh_disable_ip(ip=0xffffffff8133cef8, cnt=0x100) <-handle_softirqs Which is much easier to understand as most unsigned longs are usually just pointers. Even the "unsigned int cnt" in __local_bh_disable_ip() looks better as hexadecimal as a lot of flags are passed as unsigned. Changes since v2: https://lore.kernel.org/20250801111453.01502861@gandalf.local.home - Use btf_int_encoding() instead of open coding it (Martin KaFai Lau) Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Douglas Raillard Cc: Martin KaFai Lau Link: https://lore.kernel.org/20250801165601.7770d65c@gandalf.local.home Acked-by: Yonghong Song Signed-off-by: Steven Rostedt (Google) commit d41e5839d80043beaa63973eab602579ebdb238f Merge: 111857421c93fc f11a5f89910a7a Author: Linus Torvalds Date: Fri Aug 1 15:47:06 2025 -0700 Merge tag 'cxl-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl Pull CXL updates from Dave Jiang: "The most significant changes in this pull request is the series that introduces ACQUIRE() and ACQUIRE_ERR() macros to replace conditional locking and ease the pain points of scoped_cond_guard(). The series also includes follow on changes that refactor the CXL sub-system to utilize the new macros. Detail summary: - Add documentation template for CXL conventions to document CXL platform quirks - Replace mutex_lock_io() with mutex_lock() for mailbox - Add location limit for fake CFMWS range for cxl_test, ARM platform enabling - CXL documentation typo and clarity fixes - Use correct format specifier for function cxl_set_ecs_threshold() - Make cxl_bus_type constant - Introduce new helper cxl_resource_contains_addr() to check address availability - Fix wrong DPA checking for PPR operation - Remove core/acpi.c and CXL core dependency on ACPI - Introduce ACQUIRE() and ACQUIRE_ERR() for conditional locks - Add CXL updates utilizing ACQUIRE() macro to remove gotos and improve readability - Add return for the dummy version of cxl_decoder_detach() without CONFIG_CXL_REGION - CXL events updates for spec r3.2 - Fix return of __cxl_decoder_detach() error path - CXL debugfs documentation fix" * tag 'cxl-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (28 commits) Documentation/ABI/testing/debugfs-cxl: Add 'cxl' to clear_poison path cxl/region: Fix an ERR_PTR() vs NULL bug cxl/events: Trace Memory Sparing Event Record cxl/events: Add extra validity checks for CVME count in DRAM Event Record cxl/events: Add extra validity checks for corrected memory error count in General Media Event Record cxl/events: Update Common Event Record to CXL spec rev 3.2 cxl: Fix -Werror=return-type in cxl_decoder_detach() cleanup: Fix documentation build error for ACQUIRE updates cxl: Convert to ACQUIRE() for conditional rwsem locking cxl/region: Consolidate cxl_decoder_kill_region() and cxl_region_detach() cxl/region: Move ready-to-probe state check to a helper cxl/region: Split commit_store() into __commit() and queue_reset() helpers cxl/decoder: Drop pointless locking cxl/decoder: Move decoder register programming to a helper cxl/mbox: Convert poison list mutex to ACQUIRE() cleanup: Introduce ACQUIRE() and ACQUIRE_ERR() for conditional locks cxl: Remove core/acpi.c and cxl core dependency on ACPI cxl/core: Using cxl_resource_contains_addr() to check address availability cxl/edac: Fix wrong dpa checking for PPR operation cxl/core: Introduce a new helper cxl_resource_contains_addr() ... commit 1dbf1d590d10a6d1978e8184f8dfe20af22d680a Author: Sharath Chandra Vurukala Date: Wed Jul 30 16:21:18 2025 +0530 net: Add locking to protect skb->dev access in ip_output In ip_output() skb->dev is updated from the skb_dst(skb)->dev this can become invalid when the interface is unregistered and freed, Introduced new skb_dst_dev_rcu() function to be used instead of skb_dst_dev() within rcu_locks in ip_output.This will ensure that all the skb's associated with the dev being deregistered will be transnmitted out first, before freeing the dev. Given that ip_output() is called within an rcu_read_lock() critical section or from a bottom-half context, it is safe to introduce an RCU read-side critical section within it. Multiple panic call stacks were observed when UL traffic was run in concurrency with device deregistration from different functions, pasting one sample for reference. [496733.627565][T13385] Call trace: [496733.627570][T13385] bpf_prog_ce7c9180c3b128ea_cgroupskb_egres+0x24c/0x7f0 [496733.627581][T13385] __cgroup_bpf_run_filter_skb+0x128/0x498 [496733.627595][T13385] ip_finish_output+0xa4/0xf4 [496733.627605][T13385] ip_output+0x100/0x1a0 [496733.627613][T13385] ip_send_skb+0x68/0x100 [496733.627618][T13385] udp_send_skb+0x1c4/0x384 [496733.627625][T13385] udp_sendmsg+0x7b0/0x898 [496733.627631][T13385] inet_sendmsg+0x5c/0x7c [496733.627639][T13385] __sys_sendto+0x174/0x1e4 [496733.627647][T13385] __arm64_sys_sendto+0x28/0x3c [496733.627653][T13385] invoke_syscall+0x58/0x11c [496733.627662][T13385] el0_svc_common+0x88/0xf4 [496733.627669][T13385] do_el0_svc+0x2c/0xb0 [496733.627676][T13385] el0_svc+0x2c/0xa4 [496733.627683][T13385] el0t_64_sync_handler+0x68/0xb4 [496733.627689][T13385] el0t_64_sync+0x1a4/0x1a8 Changes in v3: - Replaced WARN_ON() with WARN_ON_ONCE(), as suggested by Willem de Bruijn. - Dropped legacy lines mistakenly pulled in from an outdated branch. Changes in v2: - Addressed review comments from Eric Dumazet - Used READ_ONCE() to prevent potential load/store tearing - Added skb_dst_dev_rcu() and used along with rcu_read_lock() in ip_output Signed-off-by: Sharath Chandra Vurukala Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250730105118.GA26100@hu-sharathv-hyd.qualcomm.com Signed-off-by: Jakub Kicinski commit ae8508b25def57982493c48694ef135973bfabe0 Author: Takamitsu Iwai Date: Tue Jul 29 02:31:49 2025 +0900 net/sched: taprio: enforce minimum value for picos_per_byte Syzbot reported a WARNING in taprio_get_start_time(). When link speed is 470,589 or greater, q->picos_per_byte becomes too small, causing length_to_duration(q, ETH_ZLEN) to return zero. This zero value leads to validation failures in fill_sched_entry() and parse_taprio_schedule(), allowing arbitrary values to be assigned to entry->interval and cycle_time. As a result, sched->cycle can become zero. Since SPEED_800000 is the largest defined speed in include/uapi/linux/ethtool.h, this issue can occur in realistic scenarios. To ensure length_to_duration() returns a non-zero value for minimum-sized Ethernet frames (ETH_ZLEN = 60), picos_per_byte must be at least 17 (60 * 17 > PSEC_PER_NSEC which is 1000). This patch enforces a minimum value of 17 for picos_per_byte when the calculated value would be lower, and adds a warning message to inform users that scheduling accuracy may be affected at very high link speeds. Fixes: fb66df20a720 ("net/sched: taprio: extend minimum interval restriction to entire cycle too") Reported-by: syzbot+398e1ee4ca2cac05fddb@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=398e1ee4ca2cac05fddb Signed-off-by: Takamitsu Iwai Link: https://patch.msgid.link/20250728173149.45585-1-takamitz@amazon.co.jp Signed-off-by: Jakub Kicinski commit d46e51f1c78b9ab9323610feb14238d06d46d519 Author: Wang Liang Date: Wed Jul 30 18:14:58 2025 +0800 net: drop UFO packets in udp_rcv_segment() When sending a packet with virtio_net_hdr to tun device, if the gso_type in virtio_net_hdr is SKB_GSO_UDP and the gso_size is less than udphdr size, below crash may happen. ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:4572! Oops: invalid opcode: 0000 [#1] SMP NOPTI CPU: 0 UID: 0 PID: 62 Comm: mytest Not tainted 6.16.0-rc7 #203 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 RIP: 0010:skb_pull_rcsum+0x8e/0xa0 Code: 00 00 5b c3 cc cc cc cc 8b 93 88 00 00 00 f7 da e8 37 44 38 00 f7 d8 89 83 88 00 00 00 48 8b 83 c8 00 00 00 5b c3 cc cc cc cc <0f> 0b 0f 0b 66 66 2e 0f 1f 84 00 000 RSP: 0018:ffffc900001fba38 EFLAGS: 00000297 RAX: 0000000000000004 RBX: ffff8880040c1000 RCX: ffffc900001fb948 RDX: ffff888003e6d700 RSI: 0000000000000008 RDI: ffff88800411a062 RBP: ffff8880040c1000 R08: 0000000000000000 R09: 0000000000000001 R10: ffff888003606c00 R11: 0000000000000001 R12: 0000000000000000 R13: ffff888004060900 R14: ffff888004050000 R15: ffff888004060900 FS: 000000002406d3c0(0000) GS:ffff888084a19000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020000040 CR3: 0000000004007000 CR4: 00000000000006f0 Call Trace: udp_queue_rcv_one_skb+0x176/0x4b0 net/ipv4/udp.c:2445 udp_queue_rcv_skb+0x155/0x1f0 net/ipv4/udp.c:2475 udp_unicast_rcv_skb+0x71/0x90 net/ipv4/udp.c:2626 __udp4_lib_rcv+0x433/0xb00 net/ipv4/udp.c:2690 ip_protocol_deliver_rcu+0xa6/0x160 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x72/0x90 net/ipv4/ip_input.c:233 ip_sublist_rcv_finish+0x5f/0x70 net/ipv4/ip_input.c:579 ip_sublist_rcv+0x122/0x1b0 net/ipv4/ip_input.c:636 ip_list_rcv+0xf7/0x130 net/ipv4/ip_input.c:670 __netif_receive_skb_list_core+0x21d/0x240 net/core/dev.c:6067 netif_receive_skb_list_internal+0x186/0x2b0 net/core/dev.c:6210 napi_complete_done+0x78/0x180 net/core/dev.c:6580 tun_get_user+0xa63/0x1120 drivers/net/tun.c:1909 tun_chr_write_iter+0x65/0xb0 drivers/net/tun.c:1984 vfs_write+0x300/0x420 fs/read_write.c:593 ksys_write+0x60/0xd0 fs/read_write.c:686 do_syscall_64+0x50/0x1c0 arch/x86/entry/syscall_64.c:63 To trigger gso segment in udp_queue_rcv_skb(), we should also set option UDP_ENCAP_ESPINUDP to enable udp_sk(sk)->encap_rcv. When the encap_rcv hook return 1 in udp_queue_rcv_one_skb(), udp_csum_pull_header() will try to pull udphdr, but the skb size has been segmented to gso size, which leads to this crash. Previous commit cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") introduces segmentation in UDP receive path only for GRO, which was never intended to be used for UFO, so drop UFO packets in udp_rcv_segment(). Link: https://lore.kernel.org/netdev/20250724083005.3918375-1-wangliang74@huawei.com/ Link: https://lore.kernel.org/netdev/20250729123907.3318425-1-wangliang74@huawei.com/ Fixes: cf329aa42b66 ("udp: cope with UDP GRO packet misdirection") Suggested-by: Willem de Bruijn Signed-off-by: Wang Liang Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250730101458.3470788-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit 111857421c93fc88924106436741bd2f5b8bc220 Merge: 821c9e515db512 1c20224123f41e Author: Linus Torvalds Date: Fri Aug 1 15:02:25 2025 -0700 Merge tag 'rproc-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: - Make the Xilinx remoteproc driver support running on only a single core, disable still unsupported remoteproc features, and stop the remoteproc on shutdown to facilitate kexec. - Conclude the renaming of the Qualcomm ADSP driver to "PAS" that was started many years ago. * tag 'rproc-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: remoteproc: xlnx: Fix kernel-doc warnings remoteproc: xlnx: Disable unsupported features remoteproc: xlnx: Add shutdown callback remoteproc: xlnx: Allow single core use in split mode dt-bindings: remoteproc: qcom,sa8775p-pas: Correct the interrupt number remoteproc: Don't use %pK through printk dt-bindings: remoteproc: qcom,sm8150-pas: Document QCS615 remoteproc remoteproc: qcom: pas: Conclude the rename from adsp commit d8d2d9d12f141302aaec3ff9a3a8cbed4ac0546c Author: Paul Chaignon Date: Fri Aug 1 11:49:44 2025 +0200 selftests/bpf: Test for unaligned flow_dissector ctx access This patch adds tests for two context fields where unaligned accesses were not properly rejected. Note the new macro is similar to the existing narrow_load macro, but we need a different description and access offset. Combining the two macros into one is probably doable but I don't think it would help readability. vmlinux.h is included in place of bpf.h so we have the definition of struct bpf_nf_ctx. Signed-off-by: Paul Chaignon Tested-by: Eduard Zingerman Acked-by: Yonghong Song Link: https://lore.kernel.org/r/bf014046ddcf41677fb8b98d150c14027e9fddba.1754039605.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit a81649a4efd382497bf3d34a623360263adc6993 Author: Florian Fainelli Date: Wed Jul 30 13:25:33 2025 -0700 net: mdio: mdio-bcm-unimac: Correct rate fallback logic When the parent clock is a gated clock which has multiple parents, the clock provider (clk-scmi typically) might return a rate of 0 since there is not one of those particular parent clocks that should be chosen for returning a rate. Prior to ee975351cf0c ("net: mdio: mdio-bcm-unimac: Manage clock around I/O accesses"), we would not always be passing a clock reference depending upon how mdio-bcm-unimac was instantiated. In that case, we would take the fallback path where the rate is hard coded to 250MHz. Make sure that we still fallback to using a fixed rate for the divider calculation, otherwise we simply ignore the desired MDIO bus clock frequency which can prevent us from interfacing with Ethernet PHYs properly. Fixes: ee975351cf0c ("net: mdio: mdio-bcm-unimac: Manage clock around I/O accesses") Signed-off-by: Florian Fainelli Reviewed-by: Andrew Lunn Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250730202533.3463529-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit d45cf1e7d7180256e17c9ce88e32e8061a7887fe Author: Eric Dumazet Date: Wed Jul 30 13:17:38 2025 +0000 ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679 Fixes: d1da932ed4ec ("ipv6: Separate ipv6 offload support") Reported-by: syzbot+af43e647fd835acc02df@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/688a1a05.050a0220.5d226.0008.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Dawid Osuchowski Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250730131738.3385939-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7cbd49795d4ca86fba5830084e94fece3b343b79 Author: Eric Dumazet Date: Wed Jul 30 11:53:13 2025 +0000 selftests: avoid using ifconfig ifconfig is deprecated and not always present, use ip command instead. Fixes: e0f3b3e5c77a ("selftests: Add test cases for vlan_filter modification during runtime") Signed-off-by: Eric Dumazet Cc: Dong Chenchen Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20250730115313.3356036-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit a4f0866e3dbbf3fee4078bce0b78d65a0875c0bc Author: Geert Uytterhoeven Date: Wed Jul 30 13:23:32 2025 +0200 dpll: Make ZL3073X invisible Currently, the user is always asked about the Microchip Azurite DPLL/PTP/SyncE core driver, even when I2C and SPI are disabled, and thus the driver cannot be used at all. Fix this by making the Kconfig symbol for the core driver invisible (unless compile-testing), and selecting it by the bus glue sub-drivers. Drop the modular defaults, as drivers should not default to enabled. Fixes: 2df8e64e01c10a4b ("dpll: Add basic Microchip ZL3073x support") Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/97804163aeb262f0e0706d00c29d9bb751844454.1753874405.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 77bf1c55b2acc7fa3734b14f4561e3d75aea1a90 Author: Christoph Paasch Date: Tue Jul 29 11:34:00 2025 -0700 net/mlx5: Correctly set gso_segs when LRO is used When gso_segs is left at 0, a number of assumptions will end up being incorrect throughout the stack. For example, in the GRO-path, we set NAPI_GRO_CB()->count to gso_segs. So, if a non-LRO'ed packet followed by an LRO'ed packet is being processed in GRO, the first one will have NAPI_GRO_CB()->count set to 1 and the next one to 0 (in dev_gro_receive()). Since commit 531d0d32de3e ("net/mlx5: Correctly set gso_size when LRO is used") these packets will get merged (as their gso_size now matches). So, we end up in gro_complete() with NAPI_GRO_CB()->count == 1 and thus don't call inet_gro_complete(). Meaning, checksum-validation in tcp_checksum_complete() will fail with a "hw csum failure". Even before the above mentioned commit, incorrect gso_segs means that other things like TCP's accounting of incoming packets (tp->segs_in, data_segs_in, rcv_ooopack) will be incorrect. Which means that if one does bytes_received/data_segs_in, the result will be bigger than the MTU. Fix this by initializing gso_segs correctly when LRO is used. Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files") Reported-by: Gal Pressman Closes: https://lore.kernel.org/netdev/6583783f-f0fb-4fb1-a415-feec8155bc69@nvidia.com/ Signed-off-by: Christoph Paasch Reviewed-by: Gal Pressman Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250729-mlx5_gso_segs-v1-1-b48c480c1c12@openai.com Signed-off-by: Jakub Kicinski commit 821c9e515db512904250e1d460109a1dc4c7ef6b Merge: 0bd0a41a5120f7 6693731487a814 Author: Linus Torvalds Date: Fri Aug 1 14:17:48 2025 -0700 Merge tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost Pull virtio updates from Michael Tsirkin: - vhost can now support legacy threading if enabled in Kconfig - vsock memory allocation strategies for large buffers have been improved, reducing pressure on kmalloc - vhost now supports the in-order feature. guest bits missed the merge window. - fixes, cleanups all over the place * tag 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (30 commits) vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers vsock/virtio: Rename virtio_vsock_skb_rx_put() vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers vsock/virtio: Move SKB allocation lower-bound check to callers vsock/virtio: Rename virtio_vsock_alloc_skb() vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() vsock/virtio: Validate length in packet header before skb_put() vhost/vsock: Avoid allocating arbitrarily-sized SKBs vhost_net: basic in_order support vhost: basic in order support vhost: fail early when __vhost_add_used() fails vhost: Reintroduce kthread API and add mode selection vdpa: Fix IDR memory leak in VDUSE module exit vdpa/mlx5: Fix release of uninitialized resources on error path vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit virtio: virtio_dma_buf: fix missing parameter documentation vhost: Fix typos vhost: vringh: Remove unused functions vhost: vringh: Remove unused iotlb functions ... commit 60bda1ba062a003efcb96c91c8541c3efb212d69 Author: Edward Cree Date: Thu Jul 31 15:41:38 2025 +0100 sfc: unfix not-a-typo in comment Commit fe09560f8241 ("net: Fix typos") removed duplicated word 'fallback', but this was not a typo and change altered the semantic meaning of the comment. Partially revert, using the phrase 'fallback of the fallback' to make the meaning more clear to future readers so that they won't try to change it again. Signed-off-by: Edward Cree Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250731144138.2637949-1-edward.cree@amd.com Signed-off-by: Jakub Kicinski commit 0bd0a41a5120f78685a132834865b0a631b9026a Merge: 877d94c74e4c66 58d2b6b6b214d8 Author: Linus Torvalds Date: Fri Aug 1 13:59:07 2025 -0700 Merge tag 'pci-v6.17-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull PCI updates from Bjorn Helgaas: "Enumeration: - Allow built-in drivers, not just modular drivers, to use async initial probing (Lukas Wunner) - Support Immediate Readiness even on devices with no PM Capability (Sean Christopherson) - Consolidate definition of PCIE_RESET_CONFIG_WAIT_MS (100ms), the required delay between a reset and sending config requests to a device (Niklas Cassel) - Add pci_is_display() to check for "Display" base class and use it in ALSA hda, vfio, vga_switcheroo, vt-d (Mario Limonciello) - Allow 'isolated PCI functions' (multi-function devices without a function 0) for LoongArch, similar to s390 and jailhouse (Huacai Chen) Power control: - Add ability to enable optional slot clock for cases where the PCIe host controller and the slot are supplied by different clocks (Marek Vasut) PCIe native device hotplug: - Fix runtime PM ref imbalance on Hot-Plug Capable ports caused by misinterpreting a config read failure after a device has been removed (Lukas Wunner) - Avoid creating a useless PCIe port service device for pciehp if the slot is handled by the ACPI hotplug driver (Lukas Wunner) - Ignore ACPI hotplug slots when calculating depth of pciehp hotplug ports (Lukas Wunner) Virtualization: - Save VF resizable BAR state and restore it after reset (Michał Winiarski) - Allow IOV resources (VF BARs) to be resized (Michał Winiarski) - Add pci_iov_vf_bar_set_size() so drivers can control VF BAR size (Michał Winiarski) Endpoint framework: - Add RC-to-EP doorbell support using platform MSI controller, including a test case (Frank Li) - Allow BAR assignment via configfs so platforms have flexibility in determining BAR usage (Jerome Brunet) Native PCIe controller drivers: - Convert amazon,al-alpine-v[23]-pcie, apm,xgene-pcie, axis,artpec6-pcie, marvell,armada-3700-pcie, st,spear1340-pcie to DT schema format (Rob Herring) - Use dev_fwnode() instead of of_fwnode_handle() to remove OF dependency in altera (fixes an unused variable), designware-host, mediatek, mediatek-gen3, mobiveil, plda, xilinx, xilinx-dma, xilinx-nwl (Jiri Slaby, Arnd Bergmann) - Convert aardvark, altera, brcmstb, designware-host, iproc, mediatek, mediatek-gen3, mobiveil, plda, rcar-host, vmd, xilinx, xilinx-dma, xilinx-nwl from using pci_msi_create_irq_domain() to using msi_create_parent_irq_domain() instead; this makes the interrupt controller per-PCI device, allows dynamic allocation of vectors after initialization, and allows support of IMS (Nam Cao) APM X-Gene PCIe controller driver: - Rewrite MSI handling to MSI CPU affinity, drop useless CPU hotplug bits, use device-managed memory allocations, and clean things up (Marc Zyngier) - Probe xgene-msi as a standard platform driver rather than a subsys_initcall (Marc Zyngier) Broadcom STB PCIe controller driver: - Add optional DT 'num-lanes' property and if present, use it to override the Maximum Link Width advertised in Link Capabilities (Jim Quinlan) Cadence PCIe controller driver: - Use PCIe Message routing types from the PCI core rather than defining private ones (Hans Zhang) Freescale i.MX6 PCIe controller driver: - Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu) - Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu) - Configure LUT for MSI/IOMMU in Endpoint mode so Root Complex can trigger doorbel on Endpoint (Frank Li) - Remove apps_reset (LTSSM_EN) from imx_pcie_{assert,deassert}_core_reset(), which fixes a hotplug regression on i.MX8MM (Richard Zhu) - Delay Endpoint link start until configfs 'start' written (Richard Zhu) Intel VMD host bridge driver: - Add Intel Panther Lake (PTL)-H/P/U Vendor ID (George D Sworo) Qualcomm PCIe controller driver: - Add DT binding and driver support for SA8255p, which supports ECAM for Configuration Space access (Mayank Rana) - Update DT binding and driver to describe PHYs and per-Root Port resets in a Root Port stanza and deprecate describing them in the host bridge; this makes it possible to support multiple Root Ports in the future (Krishna Chaitanya Chundru) - Add Qualcomm QCS615 to SM8150 DT binding (Ziyue Zhang) - Add Qualcomm QCS8300 to SA8775p DT binding (Ziyue Zhang) - Drop TBU and ref clocks from Qualcomm SM8150 and SC8180x DT bindings (Konrad Dybcio) - Document 'link_down' reset in Qualcomm SA8775P DT binding (Ziyue Zhang) - Add required PCIE_RESET_CONFIG_WAIT_MS delay after Link up IRQ (Niklas Cassel) Rockchip PCIe controller driver: - Drop unused PCIe Message routing and code definitions (Hans Zhang) - Remove several unused header includes (Hans Zhang) - Use standard PCIe config register definitions instead of rockchip-specific redefinitions (Geraldo Nascimento) - Set Target Link Speed to 5.0 GT/s before retraining so we have a chance to train at a higher speed (Geraldo Nascimento) Rockchip DesignWare PCIe controller driver: - Prevent race between link training and register update via DBI by inhibiting link training after hot reset and link down (Wilfred Mallawa) - Add required PCIE_RESET_CONFIG_WAIT_MS delay after Link up IRQ (Niklas Cassel) Sophgo PCIe controller driver: - Add DT binding and driver for Sophgo SG2044 PCIe controller driver in Root Complex mode (Inochi Amaoto) Synopsys DesignWare PCIe controller driver: - Add required PCIE_RESET_CONFIG_WAIT_MS after waiting for Link up on Ports that support > 5.0 GT/s. Slower Ports still rely on the not-quite-correct PCIE_LINK_WAIT_SLEEP_MS 90ms default delay while waiting for the Link (Niklas Cassel)" * tag 'pci-v6.17-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (116 commits) dt-bindings: PCI: qcom,pcie-sa8775p: Document 'link_down' reset dt-bindings: PCI: Remove 83xx-512x-pci.txt dt-bindings: PCI: Convert amazon,al-alpine-v[23]-pcie to DT schema dt-bindings: PCI: Convert marvell,armada-3700-pcie to DT schema dt-bindings: PCI: Convert apm,xgene-pcie to DT schema dt-bindings: PCI: Convert axis,artpec6-pcie to DT schema dt-bindings: PCI: Convert st,spear1340-pcie to DT schema PCI: Move is_pciehp check out of pciehp_is_native() PCI: pciehp: Use is_pciehp instead of is_hotplug_bridge PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports selftests: pci_endpoint: Add doorbell test case misc: pci_endpoint_test: Add doorbell test case PCI: endpoint: pci-epf-test: Add doorbell test support PCI: endpoint: Add pci_epf_align_inbound_addr() helper for inbound address alignment PCI: endpoint: pci-ep-msi: Add checks for MSI parent and mutability PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller PCI: dwc: Add Sophgo SG2044 PCIe controller driver in Root Complex mode PCI: vmd: Switch to msi_create_parent_irq_domain() PCI: vmd: Convert to lock guards ... commit 38358fa3cc8e16c6862a3e5c5c233f9f652e3a6d Author: Lorenzo Bianconi Date: Thu Jul 31 12:29:08 2025 +0200 net: airoha: Fix PPE table access in airoha_ppe_debugfs_foe_show() In order to avoid any possible race we need to hold the ppe_lock spinlock accessing the hw PPE table. airoha_ppe_foe_get_entry routine is always executed holding ppe_lock except in airoha_ppe_debugfs_foe_show routine. Fix the problem introducing airoha_ppe_foe_get_entry_locked routine. Fixes: 3fe15c640f380 ("net: airoha: Introduce PPE debugfs support") Reviewed-by: Dawid Osuchowski Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250731-airoha_ppe_foe_get_entry_locked-v2-1-50efbd8c0fd6@kernel.org Signed-off-by: Jakub Kicinski commit f8fded7536a9350ce849f21eee124d66056aa54c Author: Ido Schimmel Date: Thu Jul 31 14:09:14 2025 +0300 selftests: net: Fix flaky neighbor garbage collection test The purpose of the "Periodic garbage collection" test case is to make sure that "extern_valid" neighbors are not flushed during periodic garbage collection, unlike regular neighbor entries. The test case is currently doing the following: 1. Changing the base reachable time to 10 seconds so that periodic garbage collection will run every 5 seconds. 2. Changing the garbage collection stale time to 5 seconds so that neighbors that have not been used in the last 5 seconds will be considered for removal. 3. Waiting for the base reachable time change to take effect. 4. Adding an "extern_valid" neighbor, a non-"extern_valid" neighbor and a bunch of other neighbors so that the threshold ("thresh1") will be crossed and stale neighbors will be flushed during garbage collection. 5. Waiting for 10 seconds to give garbage collection a chance to run. 6. Checking that the "extern_valid" neighbor was not flushed and that the non-"extern_valid" neighbor was flushed. The test sometimes fails in the netdev CI because the non-"extern_valid" neighbor was not flushed. I am unable to reproduce this locally, but my theory that since we do not know exactly when the periodic garbage collection runs, it is possible for it to run at a time when the non-"extern_valid" neighbor is still not considered stale. Fix by moving the addition of the two neighbors before step 3 and by reducing the garbage collection stale time to 1 second, to ensure that both neighbors are considered stale when garbage collection runs. Fixes: 171f2ee31a42 ("selftests: net: Add a selftest for externally validated neighbor entries") Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/netdev/20250728093504.4ebbd73c@kernel.org/ Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20250731110914.506890-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit db5f0c3e3e60939bb2ecc2dbdea4e6f32252620b Author: Steven Rostedt Date: Fri Aug 1 16:37:27 2025 -0400 ring-buffer: Convert ring_buffer_write() to use guard(preempt_notrace) The function ring_buffer_write() has a goto out to only do a preempt_enable_notrace(). This can be replaced by a guard. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://lore.kernel.org/20250801203858.205479143@kernel.org Signed-off-by: Steven Rostedt (Google) commit 12d5189615862a9eb06d4aa7c8a990bcde2ebb01 Author: Steven Rostedt Date: Fri Aug 1 16:37:26 2025 -0400 tracing: Use __free(kfree) in trace.c to remove gotos There's a couple of locations that have goto out in trace.c for the only purpose of freeing a variable that was allocated. These can be replaced with __free(kfree). Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://lore.kernel.org/20250801203858.040892777@kernel.org Signed-off-by: Steven Rostedt (Google) commit debe57fbe12cb16881b2db1f1787eb9673a8b8b0 Author: Steven Rostedt Date: Fri Aug 1 16:37:25 2025 -0400 tracing: Add guard() around locks and mutexes in trace.c There's several locations in trace.c that can be simplified by using guards around raw_spin_lock_irqsave, mutexes and preempt disabling. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://lore.kernel.org/20250801203857.879085376@kernel.org Signed-off-by: Steven Rostedt (Google) commit 788fa4b47cdcd9b3d8c2d02ac0b3cd2540305f18 Author: Steven Rostedt Date: Fri Aug 1 16:37:24 2025 -0400 tracing: Add guard(ring_buffer_nest) Some calls to the tracing ring buffer can happen when the ring buffer is already being written to by the same context (for example, a trace_printk() in between a ring_buffer_lock_reserve() and a ring_buffer_unlock_commit()). In order to not trigger the recursion detection, these functions use ring_buffer_nest_start() and ring_buffer_nest_end(). Create a guard() for these functions so that their use cases can be simplified and not need to use goto for the release. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://lore.kernel.org/20250801203857.710501021@kernel.org Signed-off-by: Steven Rostedt (Google) commit c89504a703fb779052213add0e8ed642f4a4f1c8 Author: Steven Rostedt Date: Fri Aug 1 16:37:23 2025 -0400 tracing: Remove unneeded goto out logic Several places in the trace.c file there's a goto out where the out is simply a return. There's no reason to jump to the out label if it's not doing any more logic but simply returning from the function. Replace the goto outs with a return and remove the out labels. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://lore.kernel.org/20250801203857.538726745@kernel.org Signed-off-by: Steven Rostedt (Google) commit 877d94c74e4c6665d2af55c0154363b43b947e60 Merge: 196dacf4541afc 48defdf6b083f7 Author: Linus Torvalds Date: Fri Aug 1 13:32:43 2025 -0700 Merge tag 'linux-watchdog-6.17-rc1' of git://www.linux-watchdog.org/linux-watchdog Pull watchdog updates from Wim Van Sebroeck: - sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition - Various improvements and fixes * tag 'linux-watchdog-6.17-rc1' of git://www.linux-watchdog.org/linux-watchdog: watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition watchdog: dw_wdt: Fix default timeout watchdog: Don't use "proxy" headers watchdog: it87_wdt: Don't use "proxy" headers watchdog: renesas_wdt: Convert to DEFINE_SIMPLE_DEV_PM_OPS() watchdog: iTCO_wdt: Report error if timeout configuration fails watchdog: rti_wdt: Use of_reserved_mem_region_to_resource() for "memory-region" dt-bindings: watchdog: nxp,pnx4008-wdt: allow clocks property watchdog: ziirave_wdt: check record length in ziirave_firm_verify() commit 5bbb3913b7d691d3293fa7cde0a897d44d1e4522 Merge: 1b03391d073dad 1c4c768d068616 Author: Mark Brown Date: Fri Aug 1 21:18:31 2025 +0100 Add audio support for acp7.2 platform Merge series from Venkata Prasad Potturu : This patch series is to add legacy and sof audio support for acp7.2 platform. commit 196dacf4541afcbccbef9c3697231af354bbab13 Merge: 8582976acc8504 e3a9ccd21897a5 Author: Linus Torvalds Date: Fri Aug 1 12:35:12 2025 -0700 Merge tag 'dmaengine-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine Pull dmaengine updates from Vinod Koul: "Core: - Managed API for dma channel request New support: - Sophgo CV18XX/SG200X dmamux driver - Qualcomm Milos GPI, sc8280xp GPI support Updates: - Conversion of brcm,iproc-sba and marvell,orion-xor binding - Unused code cleanup across drivers" * tag 'dmaengine-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (23 commits) dt-bindings: dma: fsl-mxs-dma: allow interrupt-names for fsl,imx23-dma-apbx dmaengine: xdmac: make it selectable for ARCH_MICROCHIP dt-bindings: dma: Convert marvell,orion-xor to DT schema dt-bindings: dma: Convert brcm,iproc-sba to DT schema dmaengine: nbpfaxi: Add missing check after DMA map dmaengine: mv_xor: Fix missing check after DMA map and missing unmap dt-bindings: dma: qcom,gpi: document the Milos GPI DMA Engine dmaengine: idxd: Remove __packed from structures dmaengine: ti: Do not enable by default during compile testing dmaengine: sh: Do not enable SH_DMAE_BASE by default during compile testing dmaengine: idxd: Fix warning for deadcode.deadstore dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning dmaengine: fsl-qdma: Add missing fsl_qdma_format kerneldoc dmaengine: qcom: gpi: Drop unused gpi_write_reg_field() dmaengine: fsl-dpaa2-qdma: Drop unused mc_enc() dmaengine: dw-edma: Drop unused dchan2dev() and chan2dev() dmaengine: stm32: Don't use %pK through printk dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs dmaengine: sun4i: Simplify error handling in probe() dt-bindings: dma: qcom,gpi: Document the sc8280xp GPI DMA engine ... commit 8582976acc8504cec53a7b6fed493435eba8437f Merge: 7a64bdfaf3e641 4a3556b81b99f0 Author: Linus Torvalds Date: Fri Aug 1 12:31:50 2025 -0700 Merge tag 'phy-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy Pull phy updates from Vinod Koul: "New Support: - Qualcomm Milos Synopsys eUSB2 PHY, SM8750 QMP phy support, M31 eUSB2 PHY driver - Samsung Exynos990 usbdrd phy, Exynos7870 MIPI phy support - Renesas RZ/V2N usb2-phy support Updates: - Bulk Yaml binding conversion By Rob H (too many to be listed) - cadence: Sierra PCIe, USB PHY multilink configuration support - Qualcomm refactoring of UFS PHY reset and UFS driver support for phy calibrate API" * tag 'phy-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (74 commits) phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence dt-bindings: phy: Convert brcm,sr-usb-combo-phy to DT schema dt-bindings: phy: Convert ti,da830-usb-phy to DT schema dt-bindings: phy: marvell,mmp2-usb-phy: Drop status from the example dt-bindings: phy: mixel, mipi-dsi-phy: Allow assigned-clock* properties phy: exynos-mipi-video: correct cam0 sysreg property name for exynos7870 phy: qcom: phy-qcom-snps-eusb2: Update init sequence per HPG 1.0.2 phy: qcom: phy-qcom-snps-eusb2: Add missing write from init sequence dt-bindings: phy: qcom,snps-eusb2: document the Milos Synopsys eUSB2 PHY dt-bindings: usb: qcom,snps-dwc3: Add Milos compatible phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal phy: rockchip-pcie: Enable all four lanes if required dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Update pcie phy bindings for QCS615 phy: qcom: qmp-combo: Add missing PLL (VCO) configuration on SM8750 phy: qcom: m31-eusb2: drop registration printk phy: qcom: m31-eusb2: fix match data santity check phy: qcom: qmp-pcie: Update PHY settings for QCS8300 & SA8775P phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers dt-bindings: phy: qcom,snps-eusb2-repeater: Remove default tuning values phy: mediatek: tphy: Cleanup and document slew calibration ... commit 7a64bdfaf3e641862e8088a19205692b8b229753 Merge: 6fac1139d99e28 df485a4b2b3ee5 Author: Linus Torvalds Date: Fri Aug 1 12:26:24 2025 -0700 Merge tag 'sound-6.17-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull more sound updates from Takashi Iwai: "For catching up the remaining stuff for 6.17: only small updates and the rest are mostly small fixes. - Fixes in HD-audio codec driver Kconfig, so that configurations can be more easily/safely carried between different versions - Fixes in ASoC SDCA, FSL xcvr, AW88399 - ASoC IMX WM8524 support - HD-audio and USB-audio quirks and fixes - A minor selftest fix" * tag 'sound-6.17-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (21 commits) ALSA: usb: scarlett2: Fix missing NULL check mips: Update HD-audio configs again LoongArch: Update HD-audio codec configs arm: Update HD-audio configs again selftests: ALSA: fix memory leak in utimer test ALSA: usb-audio: Add DSD support for Comtrue USB Audio device ALSA: hda/hdmi: Enable drivers as default ALSA: hda/cirrus: Enable drivers as default ALSA: hda/realtek: Enable drivers as default ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx ALSA: hda: Fix the wrong register was used for DVC of TAS2770 ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx ASoC: codecs: Add acpi_match_table for aw88399 driver ASoC: dt-bindings: atmel,at91-ssc: add microchip,sam9x7-ssc ASoC: imx-card: Add WM8524 support ASoC: fsl_xcvr: get channel status data with firmware exists ASoC: fsl_xcvr: get channel status data when PHY is not exists ASoC: SDCA: Add support for -cn- value properties ... commit 6fac1139d99e283ba0c7ed2d1acad9ec2807ba3a Merge: d6f38c12396397 34b1cb4ec28660 Author: Linus Torvalds Date: Fri Aug 1 11:09:27 2025 -0700 Merge tag 'soundwire-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire Pull soundwire updates from Vinod Koul: "A couple of small core changes and driver updates: - Core: handling of nesting irqs to outside the lock, stream parameters handing on port prep failures. - AMD driver support for ACP 7.2 platforms and improved handing of slave alerts and resume sequences - Qualcomm updating driver debug spew - Intel BPT message length limitations, rt721 codec as wake capable etc" * tag 'soundwire-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire: soundwire: amd: Add support for acp7.2 platform soundwire: stream: restore params when prepare ports fail soundwire: debugfs: move debug statement outside of error handling soundwire: amd: add check for status update registers soundwire: intel_auxdevice: add rt721 codec to wake_capable_list soundwire: Correct some property names soundwire: update Intel BPT message length limitation soundwire: intel_ace2.x: Use str_read_write() helper soundwire: amd: cancel pending slave status handling workqueue during remove sequence soundwire: amd: serialize amd manager resume sequence during pm_prepare soundwire: qcom: demote probe registration printk ASoC: cs42l43: Remove unnecessary work functions soundwire: Move handle_nested_irq outside of sdw_dev_lock MAINTAINERS: Remove Sanyog Kale as reviewer on SoundWire commit f22853435bbd1e9836d0dce7fd99c040b94c2bf1 Author: Rob Clark Date: Wed Jul 23 13:28:22 2025 -0700 drm/msm: Defer fd_install in SUBMIT ioctl Avoid fd_install() until there are no more potential error paths, to avoid put_unused_fd() after the fd is made visible to userspace. Fixes: 68dc6c2d5eec ("drm/msm: Fix submit error-path leaks") Reported-by: Dan Carpenter Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/665363/ commit ad70e46e130a7f4024961a5dd5ae0ee8e7d9a3c4 Author: Rob Clark Date: Wed Jul 23 12:08:50 2025 -0700 drm/msm: Fix submit error path cleanup submit_unpin_objects() should come before we unlock the objects. This fixes the splat: WARNING: CPU: 2 PID: 2171 at drivers/gpu/drm/msm/msm_gem.h:395 msm_gem_unpin_locked+0x8c/0xd8 [msm] Modules linked in: uinput snd_seq_dummy snd_hrtimer aes_ce_ccm snd_soc_wsa884x regmap_sdw q6prm_clocks q6apm_lpass_dais q6apm_dai snd_q6dsp_common q6prm snd_q6apm qcom_pd_mapper cdc_mbim cdc_wdm cdc_ncm r8153_ecm cdc_ether usbnet sunrpc nls_ascii nls_cp437 vfat fat snd_soc_x1e80100 snd_soc_lpass_rx_macro snd_soc_lpass_tx_macro snd_soc_lpass_va_macro snd_soc_lpass_wsa_macro snd_soc_qcom_common soundwire_qcom snd_soc_lpass_macro_common snd_soc_hdmi_codec snd_soc_qcom_sdw ext4 snd_soc_core snd_compress soundwire_bus snd_pcm_dmaengine snd_seq mbcache jbd2 snd_seq_device snd_pcm pm8941_pwrkey snd_timer r8152 qcom_spmi_temp_alarm industrialio snd lenovo_yoga_slim7x ath12k mii arm_smccc_trng soundcore rng_core evdev loop panel_samsung_atna33xc20 msm ubwc_config drm_client_lib drm_gpuvm drm_exec gpu_sched drm_display_helper pmic_glink_altmode aux_hpd_bridge ucsi_glink qcom_battmgr phy_qcom_qmp_combo ps883x cec aux_bridge drm_dp_aux_bus i2c_hid_of aes_ce_blk drm_kms_helper aes_ce_cipher i2c_hid qcom_q6v5_pas ghash_ce qcom_pil_info drm sha1_ce qcom_common phy_snps_eusb2 qcom_geni_serial qcom_q6v5 qcom_sysmon pinctrl_sm8550_lpass_lpi lpasscc_sc8280xp sbsa_gwdt mdt_loader gpio_keys pmic_glink i2c_dev efivarfs autofs4 CPU: 2 UID: 1000 PID: 2171 Comm: gnome-shell Not tainted 6.16.0-rc4-debug+ #25 PREEMPT(voluntary) Hardware name: LENOVO 83ED/LNVNB161216, BIOS NHCN53WW 08/02/2024 pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : msm_gem_unpin_locked+0x8c/0xd8 [msm] lr : msm_gem_unpin_locked+0x88/0xd8 [msm] sp : ffff80009c963820 x29: ffff80009c963820 x28: ffff80009c9639f8 x27: ffff00080552a830 x26: 0000000000000000 x25: ffff0009d5655800 x24: 0000000000000000 x23: 0000000000000000 x22: 0000000000000000 x21: 0000000000000000 x20: ffff000831db5480 x19: ffff000816e74400 x18: 0000000000000000 x17: 0000000000000000 x16: ffffc1396afdd720 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: ffff0008c065bc00 x11: ffff0008c065c000 x10: 0000000000000000 x9 : ffffc13945b19074 x8 : 0000000000000000 x7 : 0000000000000209 x6 : 0000000000000002 x5 : 0000000000019d01 x4 : ffff0008ba8db080 x3 : 000000000004093f x2 : ffff3ed5e727f000 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: msm_gem_unpin_locked+0x8c/0xd8 [msm] (P) msm_ioctl_gem_submit+0x32c/0x1760 [msm] drm_ioctl_kernel+0xc8/0x138 [drm] drm_ioctl+0x2c8/0x618 [drm] __arm64_sys_ioctl+0xac/0x108 invoke_syscall.constprop.0+0x64/0xe8 el0_svc_common.constprop.0+0x40/0xe8 do_el0_svc+0x24/0x38 el0_svc+0x54/0x1d8 el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x19c/0x1a0 irq event stamp: 2185036 hardirqs last enabled at (2185035): [] _raw_spin_unlock_irqrestore+0x74/0x80 hardirqs last disabled at (2185036): [] el1_dbg+0x24/0x90 softirqs last enabled at (2184778): [] fpsimd_restore_current_state+0x3c/0x328 softirqs last disabled at (2184776): [] fpsimd_restore_current_state+0xc/0x328 ---[ end trace 0000000000000000 ]--- Fixes: 111fdd2198e6 ("drm/msm: drm_gpuvm conversion") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/665357/ commit de651b6e040ba419418a37401e45d24f133e8a59 Author: Rob Clark Date: Wed Jul 23 12:08:49 2025 -0700 drm/msm: Fix refcnt underflow in error path If we hit an error path in GEM obj creation before msm_gem_new_handle() updates obj->resv to point to the gpuvm resv object, then obj->resv still points to &obj->_resv. In this case we don't want to decrement the refcount of the object being freed (since the refcnt is already zero). This fixes the following splat: ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 9 PID: 7013 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x148 Modules linked in: uinput snd_seq_dummy snd_hrtimer aes_ce_ccm snd_soc_wsa884x regmap_sdw q6prm_clocks q6apm_lpass_da> qcom_pil_info i2c_hid drm_kms_helper qcom_common qcom_q6v5 phy_snps_eusb2 qcom_geni_serial drm qcom_sysmon pinctrl_s> CPU: 9 UID: 1000 PID: 7013 Comm: deqp-vk Not tainted 6.16.0-rc4-debug+ #25 PREEMPT(voluntary) Hardware name: LENOVO 83ED/LNVNB161216, BIOS NHCN53WW 08/02/2024 pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0xf4/0x148 lr : refcount_warn_saturate+0xf4/0x148 sp : ffff8000a2073920 x29: ffff8000a2073920 x28: 0000000000000010 x27: 0000000000000010 x26: 0000000000000042 x25: ffff000810e09800 x24: 0000000000000010 x23: ffff8000a2073b94 x22: ffff000ddb22de00 x21: ffff000ddb22dc00 x20: ffff000ddb22ddf8 x19: ffff0008024934e0 x18: 000000000000000a x17: 0000000000000000 x16: ffff9f8c67d77340 x15: 0000000000000000 x14: 00000000ffffffff x13: 2e656572662d7265 x12: 7466612d65737520 x11: 3b776f6c66726564 x10: 00000000ffff7fff x9 : ffff9f8c67506c70 x8 : ffff9f8c69fa26f0 x7 : 00000000000bffe8 x6 : c0000000ffff7fff x5 : ffff000f53e14548 x4 : ffff6082ea2b2000 x3 : ffff0008b86ab080 x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0008b86ab080 Call trace: refcount_warn_saturate+0xf4/0x148 (P) msm_gem_free_object+0x248/0x260 [msm] drm_gem_object_free+0x24/0x40 [drm] msm_gem_new+0x1c4/0x1e0 [msm] msm_gem_new_handle+0x3c/0x1a0 [msm] msm_ioctl_gem_new+0x38/0x70 [msm] drm_ioctl_kernel+0xc8/0x138 [drm] drm_ioctl+0x2c8/0x618 [drm] __arm64_sys_ioctl+0xac/0x108 invoke_syscall.constprop.0+0x64/0xe8 el0_svc_common.constprop.0+0x40/0xe8 do_el0_svc+0x24/0x38 el0_svc+0x54/0x1d8 el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x19c/0x1a0 irq event stamp: 3698694 hardirqs last enabled at (3698693): [] __up_console_sem+0x74/0x90 hardirqs last disabled at (3698694): [] el1_dbg+0x24/0x90 softirqs last enabled at (3697578): [] handle_softirqs+0x454/0x4b0 softirqs last disabled at (3697567): [] __do_softirq+0x1c/0x28 ---[ end trace 0000000000000000 ]--- Fixes: b58e12a66e47 ("drm/msm: Add _NO_SHARE flag") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/665355/ commit 25654a1756a4ace072404e89882d7ba8391900bd Author: Maíra Canal Date: Sun Jul 20 18:42:31 2025 -0300 drm/msm: Update global fault counter when faulty process has already ended The global fault counter is no longer used since commit 12578c075f89 ("drm/msm/gpu: Skip retired submits in recover worker"). However, it's still needed, as we need to handle cases where a GPU fault occurs after the faulting process has already ended. Hence, increment the global fault counter when the submitting process had already ended. This way, the number of faults returned by MSM_PARAM_FAULTS will stay consistent. While here, s/unusuable/unusable. Fixes: 12578c075f89 ("drm/msm/gpu: Skip retired submits in recover worker") Signed-off-by: Maíra Canal Patchwork: https://patchwork.freedesktop.org/patch/664853/ Signed-off-by: Rob Clark commit f4ca529de235791aeeddc32ee6741a6b6872f564 Author: Rob Clark Date: Thu Jul 17 08:19:30 2025 -0700 drm/msm: Fix pagetables setup/teardown serialization An atomic counter is not sufficient, as one task could still be in the process of tearing things down while another task increments the counter back up to one and begins setup again. The race condition existed since commit b145c6e65eb0 ("drm/msm: Add support to create a local pagetable") but got bigger in commit dbbde63c9e9d ("drm/msm: Add PRR support"). Fixes: dbbde63c9e9d ("drm/msm: Add PRR support") Fixes: b145c6e65eb0 ("drm/msm: Add support to create a local pagetable") Signed-off-by: Rob Clark Patchwork: https://patchwork.freedesktop.org/patch/664433/ commit 7abb543ff03e7874eba50a27ab025f09c96f6f7a Author: Rob Clark Date: Wed Jul 9 07:08:38 2025 -0700 drm/msm: Fix build with KMS disabled When commit 98290b0a7d60 ("drm/msm: make it possible to disable KMS-related code.") was rebased on top of commit 3bebfd53af0f ("drm/msm: Defer VMA unmap for fb unpins"), the additional use of msm_kms was overlooked, resulting in a build break when KMS is disabled. Add some additional ifdef to fix that. Reported-by: Arnd Bergmann Fixes: 98290b0a7d60 ("drm/msm: make it possible to disable KMS-related code.") Signed-off-by: Rob Clark Tested-by: Arnd Bergmann Reviewed-by: Jessica Zhang Patchwork: https://patchwork.freedesktop.org/patch/663240/ commit bb324f85f722848f5e5e53325bc00f13302e01d0 Author: Bagas Sanjaya Date: Wed Jul 9 09:45:01 2025 +0700 drm/gpuvm: Wrap drm_gpuvm_sm_map_exec_lock() expected usage in literal code block Stephen Rothwell reports multiple indentation warnings when merging drm-msm tree: Documentation/gpu/drm-mm:506: ./drivers/gpu/drm/drm_gpuvm.c:2445: ERROR: Unexpected indentation. [docutils] Documentation/gpu/drm-mm:506: ./drivers/gpu/drm/drm_gpuvm.c:2447: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils] Documentation/gpu/drm-mm:506: ./drivers/gpu/drm/drm_gpuvm.c:2451: WARNING: Definition list ends without a blank line; unexpected unindent. [docutils] Documentation/gpu/drm-mm:506: ./drivers/gpu/drm/drm_gpuvm.c:2452: WARNING: Definition list ends without a blank line; unexpected unindent. [docutils] Documentation/gpu/drm-mm:506: ./drivers/gpu/drm/drm_gpuvm.c:2456: ERROR: Unexpected indentation. [docutils] Documentation/gpu/drm-mm:506: ./drivers/gpu/drm/drm_gpuvm.c:2457: WARNING: Definition list ends without a blank line; unexpected unindent. [docutils] Documentation/gpu/drm-mm:506: ./drivers/gpu/drm/drm_gpuvm.c:2458: WARNING: Definition list ends without a blank line; unexpected unindent. [docutils] Documentation/gpu/drm-mm:506: ./drivers/gpu/drm/drm_gpuvm.c:2459: WARNING: Definition list ends without a blank line; unexpected unindent. [docutils] Fix these by wrapping drm_gpuvm_sm_map_exec_lock() expected usage example in literal code block. Fixes: 471920ce25d5 ("drm/gpuvm: Add locking helpers") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20250708192038.6b0fd31d@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Acked-by: Randy Dunlap Tested-by: Randy Dunlap Acked-by: Danilo Krummrich Patchwork: https://patchwork.freedesktop.org/patch/663121/ Signed-off-by: Rob Clark commit d6f38c12396397e48092ad9e8a4d7be4de51b942 Merge: 5172a777248e56 623526ba8984ca Author: Linus Torvalds Date: Fri Aug 1 10:29:36 2025 -0700 Merge tag 'trace-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Deprecate auto-mounting tracefs to /sys/kernel/debug/tracing When tracefs was first introduced back in 2014, the directory /sys/kernel/tracing was added and is the designated location to mount tracefs. To keep backward compatibility, tracefs was auto-mounted in /sys/kernel/debug/tracing as well. All distros now mount tracefs on /sys/kernel/tracing. Having it seen in two different locations has lead to various issues and inconsistencies. The VFS folks have to also maintain debugfs_create_automount() for this single user. It's been over 10 years. Tooling and scripts should start replacing the debugfs location with the tracefs one. The reason tracefs was created in the first place was to allow access to the tracing facilities without the need to configure debugfs into the kernel. Using tracefs should now be more robust. A new config is created: CONFIG_TRACEFS_AUTOMOUNT_DEPRECATED which is default y, so that the kernel is still built with the automount. This config allows those that want to remove the automount from debugfs to do so. When tracefs is accessed from /sys/kernel/debug/tracing, the following printk is triggerd: pr_warn("NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030\n"); This gives users another 5 years to fix their scripts. - Use queue_rcu_work() instead of call_rcu() for freeing event filters The number of filters to be free can be many depending on the number of events within an event system. Freeing them from softirq context can potentially cause undesired latency. Use the RCU workqueue to free them instead. - Remove pointless memory barriers in latency code Memory barriers were added to some of the latency code a long time ago with the idea of "making them visible", but that's not what memory barriers are for. They are to synchronize access between different variables. There was no synchronization here making them pointless. - Remove "__attribute__()" from the type field of event format When LLVM is used to compile the kernel with CONFIG_DEBUG_INFO_BTF=y and PAHOLE_HAS_BTF_TAG=y, some of the format fields get expanded with the following: field:const char * filename; offset:24; size:8; signed:0; Turns into: field:const char __attribute__((btf_type_tag("user"))) * filename; offset:24; size:8; signed:0; This confuses parsers. Add code to strip these tags from the strings. - Add eprobe config option CONFIG_EPROBE_EVENTS Eprobes were added back in 5.15 but were only enabled when another probe was enabled (kprobe, fprobe, uprobe, etc). The eprobes had no config option of their own. Add one as they should be a separate entity. It's default y to keep with the old kernels but still has dependencies on TRACING and HAVE_REGS_AND_STACK_ACCESS_API. - Add eprobe documentation When eprobes were added back in 5.15 no documentation was added to describe them. This needs to be rectified. - Replace open coded cpumask_next_wrap() in move_to_next_cpu() - Have preemptirq_delay_run() use off-stack CPU mask - Remove obsolete comment about pelt_cfs event DECLARE_TRACE() appends "_tp" to trace events now, but the comment above pelt_cfs still mentioned appending it manually. - Remove EVENT_FILE_FL_SOFT_MODE flag The SOFT_MODE flag was required when the soft enabling and disabling of trace events was first introduced. But there was a bug with this approach as it only worked for a single instance. When multiple users required soft disabling and disabling the code was changed to have a ref count. The SOFT_MODE flag is now set iff the ref count is non zero. This is redundant and just reading the ref count is good enough. - Fix typo in comment * tag 'trace-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: Documentation: tracing: Add documentation about eprobes tracing: Have eprobes have their own config option tracing: Remove "__attribute__()" from the type field of event format tracing: Deprecate auto-mounting tracefs in debugfs tracing: Fix comment in trace_module_remove_events() tracing: Remove EVENT_FILE_FL_SOFT_MODE flag tracing: Remove pointless memory barriers tracing/sched: Remove obsolete comment on suffixes kernel: trace: preemptirq_delay_test: use offstack cpu mask tracing: Use queue_rcu_work() to free filters tracing: Replace opencoded cpumask_next_wrap() in move_to_next_cpu() commit 5172a777248e56dbae22b55231d24c7ecc6393f9 Merge: c6439bfaabf25b a80db1f85774ae Author: Linus Torvalds Date: Fri Aug 1 10:23:13 2025 -0700 Merge tag 'trace-tools-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing tools updates from Steven Rostedt: - Introduce enum timerlat_tracing_mode Now that BPF based sampling has been added to timerlat, add an enum to represent which mode timerlat is running in - Add action on timelat threshold feature A new option, --on-threshold, is added, taking an argument that further specifies the action. Actions added in this patch are: - trace[,file=]: Saves tracefs buffer, optionally taking a filename - signal,num=,pid=: Sends signal to process. "parent" might be specified instead of number to send signal to parent process - shell,command=: Execute shell command - Allow resuming tracing in timerlat bpf rtla-timerlat BPF program uses a global variable stored in a .bss section to store whether tracing has been stopped. Map it to allow it to resume tracing after it has been stopped - Add continue action to timerlat Introduce option to resume tracing after a latency threshold overflow. The option is implemented as an action named "continue" - Add action on end feature to timerlat Implement actions on end next to actions on threshold. A new option, --on-end is added, parallel to --on-threshold. Instead of being executed whenever a latency threshold is reached, it is executed at the end of the measurement - Have rtla tests check output with grep Add argument to the check command in the test suite that takes a regular expression that the output of rtla command is checked against. This allows testing for specific information in rtla output in addition to checking the return value - Add tests for timerlat actions - Update the documentation for the new features * tag 'trace-tools-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rtla/tests: Test timerlat -P option using actions rtla/tests: Add grep checks for base test cases Documentation/rtla: Add actions feature rtla/tests: Limit duration to maximum of 10s rtla/tests: Add tests for actions rtla/tests: Check rtla output with grep rtla/timerlat: Add action on end feature rtla/timerlat: Add continue action rtla/timerlat_bpf: Allow resuming tracing rtla/timerlat: Add action on threshold feature rtla/timerlat: Introduce enum timerlat_tracing_mode commit c6439bfaabf25b736154ac5640c677da2c085db4 Merge: 89748acdf226fd b3b9cb11aa034c Author: Linus Torvalds Date: Fri Aug 1 09:46:24 2025 -0700 Merge tag 'trace-deferred-unwind-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull initial deferred unwind infrastructure from Steven Rostedt: "This is the core infrastructure for the deferred unwinder that is required for sframes[1]. Several other patch series are based on this work although those patch series are not dependent on each other. In order to simplify the development, having this core series upstream will allow the other series to be worked on in parallel. The other series are: - The two patches to implement x86 support [2] [3] - The s390 work [4] - The perf work [5] - The ftrace work [6] - The sframe work [7] And more is on the way. The core infrastructure adds the following in kernel APIs: - int unwind_user_faultable(struct unwind_stacktrace *trace); Performs a user space stack trace that may fault user pages in. - int unwind_deferred_init(struct unwind_work *work, unwind_callback_t func); Allows a tracer to register with the unwind deferred infrastructure. - int unwind_deferred_request(struct unwind_work *work, u64 *cookie); Used when a tracer request a deferred trace. Can be called from interrupt or NMI context. - void unwind_deferred_cancel(struct unwind_work *work); Called by a tracer to unregister from the deferred unwind infrastructure. - void unwind_deferred_task_exit(struct task_struct *task); Called by task exit code to flush any pending unwind requests. - void unwind_task_init(struct task_struct *task); Called by do_fork() to initialize the task struct for the deferred unwinder. - void unwind_task_free(struct task_struct *task); Called by do_exit() to free up any resources used by the deferred unwinder. None of the above is actually compiled unless an architecture enables it, which none currently do" Link: https://sourceware.org/binutils/wiki/sframe [1] Link: https://lore.kernel.org/linux-trace-kernel/20250717004958.260781923@kernel.org/ [2] Link: https://lore.kernel.org/linux-trace-kernel/20250717004958.432327787@kernel.org/ [3] Link: https://lore.kernel.org/linux-trace-kernel/20250710163522.3195293-1-jremus@linux.ibm.com/ [4] Link: https://lore.kernel.org/linux-trace-kernel/20250718164119.089692174@kernel.org/ [5] Link: https://lore.kernel.org/linux-trace-kernel/20250424192612.505622711@goodmis.org/ [6] Link: https://lore.kernel.org/linux-trace-kernel/20250717012848.927473176@kernel.org/ [7] * tag 'trace-deferred-unwind-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: unwind: Finish up unwind when a task exits unwind deferred: Use SRCU unwind_deferred_task_work() unwind: Add USED bit to only have one conditional on way back to user space unwind deferred: Add unwind_completed mask to stop spurious callbacks unwind deferred: Use bitmask to determine which callbacks to call unwind_user/deferred: Make unwind deferral requests NMI-safe unwind_user/deferred: Add deferred unwinding interface unwind_user/deferred: Add unwind cache unwind_user/deferred: Add unwind_user_faultable() unwind_user: Add user space unwinding API with frame pointer support commit f914876eec9e72ae94b5cee81a9dc7935c255b2f Author: Paul Chaignon Date: Fri Aug 1 11:49:15 2025 +0200 bpf: Improve ctx access verifier error message We've already had two "error during ctx access conversion" warnings triggered by syzkaller. Let's improve the error message by dumping the cnt variable so that we can more easily differentiate between the different error cases. Signed-off-by: Paul Chaignon Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/cc94316c30dd76fae4a75a664b61a2dbfe68e205.1754039605.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 9e6448f7b1efb27f8d508b067ecd33ed664a4246 Author: Paul Chaignon Date: Fri Aug 1 11:48:15 2025 +0200 bpf: Check netfilter ctx accesses are aligned Similarly to the previous patch fixing the flow_dissector ctx accesses, nf_is_valid_access also doesn't check that ctx accesses are aligned. Contrary to flow_dissector programs, netfilter programs don't have context conversion. The unaligned ctx accesses are therefore allowed by the verifier. Fixes: fd9c663b9ad6 ("bpf: minimal support for programs hooked into netfilter framework") Signed-off-by: Paul Chaignon Acked-by: Yonghong Song Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/853ae9ed5edaa5196e8472ff0f1bb1cc24059214.1754039605.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit ead3d7b2b6afa5ee7958620c4329982a7d9c2b78 Author: Paul Chaignon Date: Fri Aug 1 11:47:23 2025 +0200 bpf: Check flow_dissector ctx accesses are aligned flow_dissector_is_valid_access doesn't check that the context access is aligned. As a consequence, an unaligned access within one of the exposed field is considered valid and later rejected by flow_dissector_convert_ctx_access when we try to convert it. The later rejection is problematic because it's reported as a verifier bug with a kernel warning and doesn't point to the right instruction in verifier logs. Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook") Reported-by: syzbot+ccac90e482b2a81d74aa@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ccac90e482b2a81d74aa Signed-off-by: Paul Chaignon Acked-by: Yonghong Song Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/cc1b036be484c99be45eddf48bd78cc6f72839b1.1754039605.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 49f848788a4d157bb6648a57963cb060fed3d56e Author: Tony Luck Date: Wed Jul 30 08:04:37 2025 -0700 x86/cpu: Add new Intel CPU model numbers for Wildcatlake and Novalake Wildcatlake is a mobile CPU. Novalake has both desktop and mobile versions. [ bp: Merge into a single patch. ] Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250730150437.4701-1-tony.luck@intel.com commit ffcfd071eec7973e58c4ffff7da4cb0e9ca7b667 Author: Simon Trimmer Date: Thu Jul 31 16:01:09 2025 +0000 spi: cs42l43: Property entry should be a null-terminated array The software node does not specify a count of property entries, so the array must be null-terminated. When unterminated, this can lead to a fault in the downstream cs35l56 amplifier driver, because the node parse walks off the end of the array into unknown memory. Fixes: 0ca645ab5b15 ("spi: cs42l43: Add speaker id support to the bridge configuration") Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220371 Signed-off-by: Simon Trimmer Link: https://patch.msgid.link/20250731160109.1547131-1-simont@opensource.cirrus.com Signed-off-by: Mark Brown commit 1b03391d073dad748636a1ad9668b837cce58265 Author: Peter Jakubek Date: Thu Jul 31 18:21:04 2025 +0100 ASoC: Intel: sof_sdw: Add quirk for Alienware Area 51 (2025) 0CCC SKU Add DMI quirk entry for Alienware systems with SKU "0CCC" to enable proper speaker codec configuration (SOC_SDW_CODEC_SPKR). This system requires the same audio configuration as some existing Dell systems. Without this patch, the laptop's speakers and microphone will not work. Signed-off-by: Peter Jakubek Link: https://patch.msgid.link/20250731172104.2009007-1-peterjakubek@gmail.com Signed-off-by: Mark Brown commit 9843cf7b6fd6f938c16fde51e86dd0e3ddbefb12 Author: Baojun Xu Date: Fri Aug 1 10:16:18 2025 +0800 ASoC: tas2781: Fix the wrong step for TLV on tas2781 The step for TLV on tas2781, should be 50 (-0.5dB). Fixes: 678f38eba1f2 ("ASoC: tas2781: Add Header file for tas2781 driver") Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20250801021618.64627-1-baojun.xu@ti.com Signed-off-by: Mark Brown commit 1c4c768d068616fa8948826ab714a4ac1f3b9aa9 Author: Venkata Prasad Potturu Date: Fri Aug 1 11:51:38 2025 +0530 ASoC: amd: acp: Add SoundWire SOF machine driver support for acp7.2 platform Add SoundWire SOF machine driver support for acp7.2 platform. Signed-off-by: Venkata Prasad Potturu Link: https://patch.msgid.link/20250801062207.579388-5-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown commit 0df24f34794d2eea4bdc819fba0ba28f226286e6 Author: Venkata Prasad Potturu Date: Fri Aug 1 11:51:37 2025 +0530 ASoC: amd: acp: Add SoundWire legacy machine driver support for acp7.2 platform Add SoundWire legacy machine driver support for acp7.2 platform. Signed-off-by: Venkata Prasad Potturu Link: https://patch.msgid.link/20250801062207.579388-4-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown commit 60e5b2441d7c035e732e4a1166779c6cc316c46b Author: Venkata Prasad Potturu Date: Fri Aug 1 11:51:36 2025 +0530 ASoC: amd: ps: Add SoundWire pci and dma driver support for acp7.2 platform Add SoundWire pci and dma driver support for acp7.2 platform. Signed-off-by: Venkata Prasad Potturu Link: https://patch.msgid.link/20250801062207.579388-3-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown commit 918b744af3d4d11a087814ebb6c390016e5242f2 Author: Venkata Prasad Potturu Date: Fri Aug 1 11:51:35 2025 +0530 ASoC: SOF: amd: Add sof audio support for acp7.2 platform Add pci revision id to support sof audio for acp7.2 platfom. Signed-off-by: Venkata Prasad Potturu Link: https://patch.msgid.link/20250801062207.579388-2-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown commit 6693731487a8145a9b039bc983d77edc47693855 Author: Will Deacon Date: Thu Jul 17 10:01:16 2025 +0100 vsock/virtio: Allocate nonlinear SKBs for handling large transmit buffers When transmitting a vsock packet, virtio_transport_send_pkt_info() calls virtio_transport_alloc_linear_skb() to allocate and fill SKBs with the transmit data. Unfortunately, these are always linear allocations and can therefore result in significant pressure on kmalloc() considering that the maximum packet size (VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM) is a little over 64KiB, resulting in a 128KiB allocation for each packet. Rework the vsock SKB allocation so that, for sizes with page order greater than PAGE_ALLOC_COSTLY_ORDER, a nonlinear SKB is allocated instead with the packet header in the SKB and the transmit data in the fragments. Note that this affects both the vhost and virtio transports. Reviewed-by: Stefano Garzarella Signed-off-by: Will Deacon Message-Id: <20250717090116.11987-10-will@kernel.org> Signed-off-by: Michael S. Tsirkin commit 8ca76151d2c8219edea82f1925a2a25907ff6a9d Author: Will Deacon Date: Thu Jul 17 10:01:15 2025 +0100 vsock/virtio: Rename virtio_vsock_skb_rx_put() In preparation for using virtio_vsock_skb_rx_put() when populating SKBs on the vsock TX path, rename virtio_vsock_skb_rx_put() to virtio_vsock_skb_put(). No functional change. Reviewed-by: Stefano Garzarella Signed-off-by: Will Deacon Message-Id: <20250717090116.11987-9-will@kernel.org> Signed-off-by: Michael S. Tsirkin commit ab9aa2f3afc2713c14f6c4c6b90c9a0933b837f1 Author: Will Deacon Date: Thu Jul 17 10:01:14 2025 +0100 vhost/vsock: Allocate nonlinear SKBs for handling large receive buffers When receiving a packet from a guest, vhost_vsock_handle_tx_kick() calls vhost_vsock_alloc_linear_skb() to allocate and fill an SKB with the receive data. Unfortunately, these are always linear allocations and can therefore result in significant pressure on kmalloc() considering that the maximum packet size (VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + VIRTIO_VSOCK_SKB_HEADROOM) is a little over 64KiB, resulting in a 128KiB allocation for each packet. Rework the vsock SKB allocation so that, for sizes with page order greater than PAGE_ALLOC_COSTLY_ORDER, a nonlinear SKB is allocated instead with the packet header in the SKB and the receive data in the fragments. Finally, add a debug warning if virtio_vsock_skb_rx_put() is ever called on an SKB with a non-zero length, as this would be destructive for the nonlinear case. Reviewed-by: Stefano Garzarella Signed-off-by: Will Deacon Message-Id: <20250717090116.11987-8-will@kernel.org> Signed-off-by: Michael S. Tsirkin commit fac6b82e0f3eaca33c8c67ec401681b21143ae17 Author: Will Deacon Date: Thu Jul 17 10:01:13 2025 +0100 vsock/virtio: Move SKB allocation lower-bound check to callers virtio_vsock_alloc_linear_skb() checks that the requested size is at least big enough for the packet header (VIRTIO_VSOCK_SKB_HEADROOM). Of the three callers of virtio_vsock_alloc_linear_skb(), only vhost_vsock_alloc_skb() can potentially pass a packet smaller than the header size and, as it already has a check against the maximum packet size, extend its bounds checking to consider the minimum packet size and remove the check from virtio_vsock_alloc_linear_skb(). Reviewed-by: Stefano Garzarella Signed-off-by: Will Deacon Message-Id: <20250717090116.11987-7-will@kernel.org> Signed-off-by: Michael S. Tsirkin commit 2304c64a2866c58534560c63dc6e79d09b8f8d8d Author: Will Deacon Date: Thu Jul 17 10:01:12 2025 +0100 vsock/virtio: Rename virtio_vsock_alloc_skb() In preparation for nonlinear allocations for large SKBs, rename virtio_vsock_alloc_skb() to virtio_vsock_alloc_linear_skb() to indicate that it returns linear SKBs unconditionally and switch all callers over to this new interface for now. No functional change. Reviewed-by: Stefano Garzarella Signed-off-by: Will Deacon Message-Id: <20250717090116.11987-6-will@kernel.org> Signed-off-by: Michael S. Tsirkin commit 03a92f036a04fed2b00d69f5f46f1a486e70dc5c Author: Will Deacon Date: Thu Jul 17 10:01:11 2025 +0100 vsock/virtio: Resize receive buffers so that each SKB fits in a 4K page When allocating receive buffers for the vsock virtio RX virtqueue, an SKB is allocated with a 4140 data payload (the 44-byte packet header + VIRTIO_VSOCK_DEFAULT_RX_BUF_SIZE). Even when factoring in the SKB overhead, the resulting 8KiB allocation thanks to the rounding in kmalloc_reserve() is wasteful (~3700 unusable bytes) and results in a higher-order page allocation on systems with 4KiB pages just for the sake of a few hundred bytes of packet data. Limit the vsock virtio RX buffers to 4KiB per SKB, resulting in much better memory utilisation and removing the need to allocate higher-order pages entirely. Reviewed-by: Stefano Garzarella Signed-off-by: Will Deacon Message-Id: <20250717090116.11987-5-will@kernel.org> Signed-off-by: Michael S. Tsirkin commit 87dbae5e36613a6020f3d64a2eaeac0a1e0e6dc6 Author: Will Deacon Date: Thu Jul 17 10:01:10 2025 +0100 vsock/virtio: Move length check to callers of virtio_vsock_skb_rx_put() virtio_vsock_skb_rx_put() only calls skb_put() if the length in the packet header is not zero even though skb_put() handles this case gracefully. Remove the functionally redundant check from virtio_vsock_skb_rx_put() and, on the assumption that this is a worthwhile optimisation for handling credit messages, augment the existing length checks in virtio_transport_rx_work() to elide the call for zero-length payloads. Since the callers all have the length, extend virtio_vsock_skb_rx_put() to take it as an additional parameter rather than fish it back out of the packet header. Note that the vhost code already has similar logic in vhost_vsock_alloc_skb(). Reviewed-by: Stefano Garzarella Signed-off-by: Will Deacon Message-Id: <20250717090116.11987-4-will@kernel.org> Signed-off-by: Michael S. Tsirkin commit 0dab92484474587b82e8e0455839eaf5ac7bf894 Author: Will Deacon Date: Thu Jul 17 10:01:09 2025 +0100 vsock/virtio: Validate length in packet header before skb_put() When receiving a vsock packet in the guest, only the virtqueue buffer size is validated prior to virtio_vsock_skb_rx_put(). Unfortunately, virtio_vsock_skb_rx_put() uses the length from the packet header as the length argument to skb_put(), potentially resulting in SKB overflow if the host has gone wonky. Validate the length as advertised by the packet header before calling virtio_vsock_skb_rx_put(). Cc: Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") Signed-off-by: Will Deacon Message-Id: <20250717090116.11987-3-will@kernel.org> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefano Garzarella commit 10a886aaed293c4db3417951f396827216299e3d Author: Will Deacon Date: Thu Jul 17 10:01:08 2025 +0100 vhost/vsock: Avoid allocating arbitrarily-sized SKBs vhost_vsock_alloc_skb() returns NULL for packets advertising a length larger than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE in the packet header. However, this is only checked once the SKB has been allocated and, if the length in the packet header is zero, the SKB may not be freed immediately. Hoist the size check before the SKB allocation so that an iovec larger than VIRTIO_VSOCK_MAX_PKT_BUF_SIZE + the header size is rejected outright. The subsequent check on the length field in the header can then simply check that the allocated SKB is indeed large enough to hold the packet. Cc: Fixes: 71dc9ec9ac7d ("virtio/vsock: replace virtio_vsock_pkt with sk_buff") Reviewed-by: Stefano Garzarella Signed-off-by: Will Deacon Message-Id: <20250717090116.11987-2-will@kernel.org> Signed-off-by: Michael S. Tsirkin commit 45347e79b544928d8ace9eb07c4d8f4fcc525752 Author: Jason Wang Date: Mon Jul 14 16:47:55 2025 +0800 vhost_net: basic in_order support This patch introduces basic in-order support for vhost-net. By recording the number of batched buffers in an array when calling `vhost_add_used_and_signal_n()`, we can reduce the number of userspace accesses. Note that the vhost-net batching logic is kept as we still count the number of buffers there. Testing Results: With testpmd: - TX: txonly mode + vhost_net with XDP_DROP on TAP shows a 17.5% improvement, from 4.75 Mpps to 5.35 Mpps. - RX: No obvious improvements were observed. With virtio-ring in-order experimental code in the guest: - TX: pktgen in the guest + XDP_DROP on TAP shows a 19% improvement, from 5.2 Mpps to 6.2 Mpps. - RX: pktgen on TAP with vhost_net + XDP_DROP in the guest achieves a 6.1% improvement, from 3.47 Mpps to 3.61 Mpps. Acked-by: Jonah Palmer Acked-by: Eugenio Pérez Signed-off-by: Jason Wang Message-Id: <20250714084755.11921-4-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang commit 67a873df0c410915275f735fedb401b9637d6faf Author: Jason Wang Date: Mon Jul 14 16:47:54 2025 +0800 vhost: basic in order support This patch adds basic in order support for vhost. Two optimizations are implemented in this patch: 1) Since driver uses descriptor in order, vhost can deduce the next avail ring head by counting the number of descriptors that has been used in next_avail_head. This eliminate the need to access the available ring in vhost. 2) vhost_add_used_and_singal_n() is extended to accept the number of batched buffers per used elem. While this increases the times of userspace memory access but it helps to reduce the chance of used ring access of both the driver and vhost. Vhost-net will be the first user for this. Acked-by: Jonah Palmer Signed-off-by: Jason Wang Message-Id: <20250714084755.11921-3-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang commit b4ba1207d45adaafa2982c035898b36af2d3e518 Author: Jason Wang Date: Mon Jul 14 16:47:53 2025 +0800 vhost: fail early when __vhost_add_used() fails This patch fails vhost_add_used_n() early when __vhost_add_used() fails to make sure used idx is not updated with stale used ring information. Reported-by: Eugenio Pérez Signed-off-by: Jason Wang Message-Id: <20250714084755.11921-2-jasowang@redhat.com> Signed-off-by: Michael S. Tsirkin Tested-by: Lei Yang commit 7d9896e9f6d02d8aa85e63f736871f96c59a5263 Author: Cindy Lu Date: Mon Jul 14 15:12:32 2025 +0800 vhost: Reintroduce kthread API and add mode selection Since commit 6e890c5d5021 ("vhost: use vhost_tasks for worker threads"), the vhost uses vhost_task and operates as a child of the owner thread. This is required for correct CPU usage accounting, especially when using containers. However, this change has caused confusion for some legacy userspace applications, and we didn't notice until it's too late. Unfortunately, it's too late to revert - we now have userspace depending both on old and new behaviour :( To address the issue, reintroduce kthread mode for vhost workers and provide a configuration to select between kthread and task worker. - Add 'fork_owner' parameter to vhost_dev to let users select kthread or task mode. Default mode is task mode(VHOST_FORK_OWNER_TASK). - Reintroduce kthread mode support: * Bring back the original vhost_worker() implementation, and renamed to vhost_run_work_kthread_list(). * Add cgroup support for the kthread * Introduce struct vhost_worker_ops: - Encapsulates create / stop / wake‑up callbacks. - vhost_worker_create() selects the proper ops according to inherit_owner. - Userspace configuration interface: * New IOCTLs: - VHOST_SET_FORK_FROM_OWNER lets userspace select task mode (VHOST_FORK_OWNER_TASK) or kthread mode (VHOST_FORK_OWNER_KTHREAD) - VHOST_GET_FORK_FROM_OWNER reads the current worker mode * Expose module parameter 'fork_from_owner_default' to allow system administrators to configure the default mode for vhost workers * Kconfig option CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL controls whether these IOCTLs and the parameter are available - The VHOST_NEW_WORKER functionality requires fork_owner to be set to true, with validation added to ensure proper configuration This partially reverts or improves upon: commit 6e890c5d5021 ("vhost: use vhost_tasks for worker threads") commit 1cdaafa1b8b4 ("vhost: replace single worker pointer with xarray") Fixes: 6e890c5d5021 ("vhost: use vhost_tasks for worker threads"), Signed-off-by: Cindy Lu Message-Id: <20250714071333.59794-2-lulu@redhat.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Tested-by: Lei Yang commit d9ea58b5dc6b4b50fbb6a10c73f840e8b10442b7 Author: Anders Roxell Date: Fri Jul 4 14:53:35 2025 +0200 vdpa: Fix IDR memory leak in VDUSE module exit Add missing idr_destroy() call in vduse_exit() to properly free the vduse_idr radix tree nodes. Without this, module load/unload cycles leak 576-byte radix tree node allocations, detectable by kmemleak as: unreferenced object (size 576): backtrace: [] radix_tree_node_alloc+0xa0/0xf0 [] idr_get_free+0x128/0x280 The vduse_idr is initialized via DEFINE_IDR() at line 136 and used throughout the VDUSE (vDPA Device in Userspace) driver for device ID management. The fix follows the documented pattern in lib/idr.c and matches the cleanup approach used by other drivers. This leak was discovered through comprehensive module testing with cumulative kmemleak detection across 10 load/unload iterations per module. Fixes: c8a6153b6c59 ("vduse: Introduce VDUSE - vDPA Device in Userspace") Signed-off-by: Anders Roxell Message-Id: <20250704125335.1084649-1-anders.roxell@linaro.org> Signed-off-by: Michael S. Tsirkin commit cc51a66815999afb7e9cd845968de4fdf07567b7 Author: Dragos Tatulea Date: Tue Jul 8 12:04:24 2025 +0000 vdpa/mlx5: Fix release of uninitialized resources on error path The commit in the fixes tag made sure that mlx5_vdpa_free() is the single entrypoint for removing the vdpa device resources added in mlx5_vdpa_dev_add(), even in the cleanup path of mlx5_vdpa_dev_add(). This means that all functions from mlx5_vdpa_free() should be able to handle uninitialized resources. This was not the case though: mlx5_vdpa_destroy_mr_resources() and mlx5_cmd_cleanup_async_ctx() were not able to do so. This caused the splat below when adding a vdpa device without a MAC address. This patch fixes these remaining issues: - Makes mlx5_vdpa_destroy_mr_resources() return early if called on uninitialized resources. - Moves mlx5_cmd_init_async_ctx() early on during device addition because it can't fail. This means that mlx5_cmd_cleanup_async_ctx() also can't fail. To mirror this, move the call site of mlx5_cmd_cleanup_async_ctx() in mlx5_vdpa_free(). An additional comment was added in mlx5_vdpa_free() to document the expectations of functions called from this context. Splat: mlx5_core 0000:b5:03.2: mlx5_vdpa_dev_add:3950:(pid 2306) warning: No mac address provisioned? ------------[ cut here ]------------ WARNING: CPU: 13 PID: 2306 at kernel/workqueue.c:4207 __flush_work+0x9a/0xb0 [...] Call Trace: ? __try_to_del_timer_sync+0x61/0x90 ? __timer_delete_sync+0x2b/0x40 mlx5_vdpa_destroy_mr_resources+0x1c/0x40 [mlx5_vdpa] mlx5_vdpa_free+0x45/0x160 [mlx5_vdpa] vdpa_release_dev+0x1e/0x50 [vdpa] device_release+0x31/0x90 kobject_cleanup+0x37/0x130 mlx5_vdpa_dev_add+0x327/0x890 [mlx5_vdpa] vdpa_nl_cmd_dev_add_set_doit+0x2c1/0x4d0 [vdpa] genl_family_rcv_msg_doit+0xd8/0x130 genl_family_rcv_msg+0x14b/0x220 ? __pfx_vdpa_nl_cmd_dev_add_set_doit+0x10/0x10 [vdpa] genl_rcv_msg+0x47/0xa0 ? __pfx_genl_rcv_msg+0x10/0x10 netlink_rcv_skb+0x53/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x27b/0x3b0 netlink_sendmsg+0x1f7/0x430 __sys_sendto+0x1fa/0x210 ? ___pte_offset_map+0x17/0x160 ? next_uptodate_folio+0x85/0x2b0 ? percpu_counter_add_batch+0x51/0x90 ? filemap_map_pages+0x515/0x660 __x64_sys_sendto+0x20/0x30 do_syscall_64+0x7b/0x2c0 ? do_read_fault+0x108/0x220 ? do_pte_missing+0x14a/0x3e0 ? __handle_mm_fault+0x321/0x730 ? count_memcg_events+0x13f/0x180 ? handle_mm_fault+0x1fb/0x2d0 ? do_user_addr_fault+0x20c/0x700 ? syscall_exit_work+0x104/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7f0c25b0feca [...] ---[ end trace 0000000000000000 ]--- Signed-off-by: Dragos Tatulea Fixes: 83e445e64f48 ("vdpa/mlx5: Fix error path during device add") Reported-by: Wenli Quan Closes: https://lore.kernel.org/virtualization/CADZSLS0r78HhZAStBaN1evCSoPqRJU95Lt8AqZNJ6+wwYQ6vPQ@mail.gmail.com/ Reviewed-by: Tariq Toukan Reviewed-by: Cosmin Ratiu Message-Id: <20250708120424.2363354-2-dtatulea@nvidia.com> Tested-by: Wenli Quan Acked-by: Jason Wang Signed-off-by: Michael S. Tsirkin commit 400cad513c78f9af72c5a20f3611c1f1dc71d465 Author: Alok Tiwari Date: Sat Jun 28 11:33:53 2025 -0700 vhost-scsi: Fix check for inline_sg_cnt exceeding preallocated limit The condition comparing ret to VHOST_SCSI_PREALLOC_SGLS was incorrect, as ret holds the result of kstrtouint() (typically 0 on success), not the parsed value. Update the check to use cnt, which contains the actual user-provided value. prevents silently accepting values exceeding the maximum inline_sg_cnt. Fixes: bca939d5bcd0 ("vhost-scsi: Dynamically allocate scatterlists") Signed-off-by: Alok Tiwari Reviewed-by: Mike Christie Reviewed-by: Stefan Hajnoczi Message-Id: <20250628183405.3979538-1-alok.a.tiwari@oracle.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 95109b46764665e3de4a118185e4f732e8e849fd Author: WangYuli Date: Mon Jun 23 14:52:10 2025 +0800 virtio: virtio_dma_buf: fix missing parameter documentation Add missing parameter documentation for virtio_dma_buf_attach() function to fix kernel-doc warnings: Warning: drivers/virtio/virtio_dma_buf.c:41 function parameter 'dma_buf' not described in 'virtio_dma_buf_attach' Warning: drivers/virtio/virtio_dma_buf.c:41 function parameter 'attach' not described in 'virtio_dma_buf_attach' The function documentation was missing descriptions for both the 'dma_buf' and 'attach' parameters. Add proper parameter documentation following kernel-doc format. Signed-off-by: WangYuli Message-Id: <241C7118259DA110+20250623065210.270237-1-wangyuli@uniontech.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Reviewed-by: Xuan Zhuo commit 8a0d18a9348f61c63b33a23b9eece1f66af1d70c Author: Alok Tiwari Date: Sun Jun 15 10:39:11 2025 -0700 vhost: Fix typos Fix multiple typos and improve comment clarity across vhost.c. Spelling errors: "thead" -> "thread", "RUNNUNG" -> "RUNNING" and "available". Signed-off-by: Alok Tiwari Message-Id: <20250615173933.1610324-1-alok.a.tiwari@oracle.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Simon Horman commit 6e9ef6937c726b97d4a6d49332d06e999acc15f5 Author: Dr. David Alan Gilbert Date: Tue Jun 17 01:18:37 2025 +0100 vhost: vringh: Remove unused functions The functions: vringh_abandon_kern() vringh_abandon_user() vringh_iov_pull_kern() and vringh_iov_push_kern() were all added in 2013 by commit f87d0fbb5798 ("vringh: host-side implementation of virtio rings.") but have remained unused. Remove them and the two helper functions they used. Signed-off-by: Dr. David Alan Gilbert Message-Id: <20250617001838.114457-3-linux@treblig.org> Signed-off-by: Michael S. Tsirkin Acked-by: Eugenio Pérez Tested-by: Lei Yang Reviewed-by: Simon Horman commit 569c392e191361cd05fba1fd87ed02ef0d130ef7 Author: Dr. David Alan Gilbert Date: Tue Jun 17 01:18:36 2025 +0100 vhost: vringh: Remove unused iotlb functions The functions: vringh_abandon_iotlb() vringh_notify_disable_iotlb() and vringh_notify_enable_iotlb() were added in 2020 by commit 9ad9c49cfe97 ("vringh: IOTLB support") but have remained unused. Remove them. Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Simon Horman Message-Id: <20250617001838.114457-2-linux@treblig.org> Signed-off-by: Michael S. Tsirkin Acked-by: Eugenio Pérez Tested-by: Lei Yang commit 69cd720a8a5e9ef0f05ce5dd8c9ea6e018245c82 Author: Mike Christie Date: Wed Jun 11 16:01:13 2025 -0500 vhost-scsi: Fix log flooding with target does not exist errors As part of the normal initiator side scanning the guest's scsi layer will loop over all possible targets and send an inquiry. Since the max number of targets for virtio-scsi is 256, this can result in 255 error messages about targets not existing if you only have a single target. When there's more than 1 vhost-scsi device each with a single target, then you get N * 255 log messages. It looks like the log message was added by accident in: commit 3f8ca2e115e5 ("vhost/scsi: Extract common handling code from control queue handler") when we added common helpers. Then in: commit 09d7583294aa ("vhost/scsi: Use common handling code in request queue handler") we converted the scsi command processing path to use the new helpers so we started to see the extra log messages during scanning. The patches were just making some code common but added the vq_err call and I'm guessing the patch author forgot to enable the vq_err call (vq_err is implemented by pr_debug which defaults to off). So this patch removes the call since it's expected to hit this path during device discovery. Fixes: 09d7583294aa ("vhost/scsi: Use common handling code in request queue handler") Signed-off-by: Mike Christie Reviewed-by: Stefan Hajnoczi Reviewed-by: Stefano Garzarella Message-Id: <20250611210113.10912-1-michael.christie@oracle.com> Signed-off-by: Michael S. Tsirkin commit 652abad08571a067b16c5bb47ad5ea7478517e7d Author: Alok Tiwari Date: Wed Jun 11 07:39:21 2025 -0700 vhost-scsi: Fix typos and formatting in comments and logs This patch corrects several minor typos and formatting issues. Changes include: Fixing misspellings like in comments - "explict" -> "explicit" - "infight" -> "inflight", - "with generate" -> "will generate" formatting in logs - Correcting log formatting specifier from "%dd" to "%d" - Adding a missing space in the sysfs emit string to prevent misinterpreted output like "X86_64on ". changing to "X86_64 on " - Cleaning up stray semicolons in struct definition endings These changes improve code readability and consistency. no functionality changes. Signed-off-by: Alok Tiwari Message-Id: <20250611143932.2443796-1-alok.a.tiwari@oracle.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi Reviewed-by: Mike Christie commit 6f0f3d7fc4e05797b801ded4910a64d16db230e9 Author: Dragos Tatulea Date: Wed Jun 4 21:48:01 2025 +0300 vdpa/mlx5: Fix needs_teardown flag calculation needs_teardown is a device flag that indicates when virtual queues need to be recreated. This happens for certain configuration changes: queue size and some specific features. Currently, the needs_teardown state can be incorrectly reset by subsequent .set_vq_num() calls. For example, for 1 rx VQ with size 512 and 1 tx VQ with size 256: .set_vq_num(0, 512) -> sets needs_teardown to true (rx queue has a non-default size) .set_vq_num(1, 256) -> sets needs_teardown to false (tx queue has a default size) This change takes into account the previous value of the needs_teardown flag when re-calculating it during VQ size configuration. Fixes: 0fe963d6fc16 ("vdpa/mlx5: Re-create HW VQs under certain conditions") Signed-off-by: Dragos Tatulea Reviewed-by: Shahar Shitrit Reviewed-by: Si-Wei Liu Tested-by: Si-Wei Liu Message-Id: <20250604184802.2625300-1-dtatulea@nvidia.com> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 32d89a405adc204d82bea6ae2ba27a62d35568b4 Author: Pei Xiao Date: Wed Jun 4 14:55:48 2025 +0800 vhost: Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(...)) cocci warning: ./kernel/vhost_task.c:148:9-16: WARNING: ERR_CAST can be used with tsk Use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(...)). Signed-off-by: Pei Xiao Message-Id: <1a8499a5da53e4f72cf21aca044ae4b26db8b2ad.1749020055.git.xiaopei01@kylinos.cn> Signed-off-by: Michael S. Tsirkin commit c0883c1af14c5d351201ace00b1a46df2b157329 Author: Alok Tiwari Date: Thu May 29 01:42:39 2025 -0700 virtio: Fix typo in register_virtio_device() doc comment Corrected "suceess" to "success" in the function documentation for clarity. Signed-off-by: Alok Tiwari Acked-by: Jason Wang Message-Id: <20250529084350.3145699-1-alok.a.tiwari@oracle.com> Signed-off-by: Michael S. Tsirkin Reviewed-by: Xuan Zhuo commit 4d0efa600ecf30aa61c14681164290f75c328f8a Author: Viresh Kumar Date: Thu May 29 13:00:27 2025 +0530 virtio-vdpa: Remove virtqueue list The virtio vdpa implementation creates a list of virtqueues, while the same is already available in the struct virtio_device. This list is never traversed though, and only the pointer to the struct virtio_vdpa_vq_info is used in the callback, where the virtqueue pointer could be directly used. Remove the unwanted code to simplify the driver. Signed-off-by: Viresh Kumar Message-Id: <7808f2f7e484987b95f172fffb6c71a5da20ed1e.1748503784.git.viresh.kumar@linaro.org> Signed-off-by: Michael S. Tsirkin Acked-by: Eugenio Pérez commit 564a69ad90d15c782176e1a8c9e1c95661e1aed0 Author: Viresh Kumar Date: Wed May 21 17:03:46 2025 +0530 virtio-mmio: Remove virtqueue list from mmio device The MMIO transport implementation creates a list of virtqueues for a virtio device, while the same is already available in the struct virtio_device. Don't create a duplicate list, and use the other one instead. While at it, fix the virtio_device_for_each_vq() macro to accept an argument like "&vm_dev->vdev" (which currently fails to build). Signed-off-by: Viresh Kumar Message-Id: <3e56c6f74002987e22f364d883cbad177cd9ad9c.1747827066.git.viresh.kumar@linaro.org> Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang commit 482bd84f1fab20ac6c4d112945ae2d1bdb36839f Author: Michael S. Tsirkin Date: Tue May 27 10:26:29 2025 -0400 virtio: document ENOSPC drivers handle ENOSPC specially since it's an error one can get from a working VQ. Document the semantics. Message-Id: <2e6ec46b8d5e6755be291cec8e2ec57ef286e97b.1748356035.git.mst@redhat.com> Reported-by: Parav Pandit Signed-off-by: Michael S. Tsirkin Reviewed-by: Stefan Hajnoczi Reviewed-by: Parav Pandit commit 2507789a724d607fa9e162dcadeb9f51b071fc49 Author: Gerd Hoffmann Date: Wed May 7 10:28:21 2025 +0200 drm/virtio: implement virtio_gpu_shutdown Calling drm_dev_unplug() is the drm way to say the device is gone and can not be accessed any more. Cc: Michael S. Tsirkin Signed-off-by: Gerd Hoffmann Reviewed-by: Eric Auger Tested-by: Eric Auger Message-Id: <20250507082821.2710706-1-kraxel@redhat.com> Signed-off-by: Michael S. Tsirkin commit 89a216ed973e49d6f39a6976bcead3b631171b64 Author: Michael S. Tsirkin Date: Wed Jul 9 16:55:31 2025 -0400 virtio: fix comments, readability Fix a couple of comments to match reality. Initialize config_driver_disabled to be consistent with other fields (note: the structure is already zero initialized, so this is not a bugfix as such). Signed-off-by: Michael S. Tsirkin Message-Id: <7b74a55a5f3dc066d954472f5b68c29022f11b43.1752094439.git.mst@redhat.com> Acked-by: Jason Wang commit 76b6e14aa7b081337d118a82397d919b5e072bb4 Author: Mark Brown Date: Thu Jul 31 21:38:19 2025 +0100 regmap: irq: Avoid lockdep warnings with nested regmap-irq chips While handling interrupts through regmap-irq we use a mutex to protect the updates we are caching while genirq runs in atomic context. Russell King reported that while running on the nVidia Jetson Xavier NX this generates lockdep warnings since that platform has a regmap-irq for the max77686 RTC which is a child of a max77620 which also uses regmap-irq. [ 46.723127] rtcwake/3984 is trying to acquire lock: [ 46.723235] ffff0000813b2c68 (&d->lock){+.+.}-{4:4}, at: regmap_irq_lock+0x18/0x24 [ 46.723452] but task is already holding lock: [ 46.723556] ffff00008504dc68 (&d->lock){+.+.}-{4:4}, at: regmap_irq_lock+0x18/0x24 This happens because by default lockdep uses a single lockdep class for all mutexes initialised from a single mutex_init() call and is unable to tell that two distinct mutex are being taken and verify that the ordering of operations is safe. This should be a very rare situation since normally anything using regmap-irq will be a leaf interrupt controller due to being on a slow bus like I2C. We can avoid these warnings by providing the lockdep key for the regmap-irq explicitly, allocating one for each chip so that lockdep can distinguish between them. Thanks to Russell for the report and analysis. Reported-by: Russell King (Oracle) Tested-by: Russell King (Oracle) Reviewed-by: Russell King (Oracle) Signed-off-by: Mark Brown Link: https://patch.msgid.link/20250731-regmap-irq-nesting-v1-2-98b4d1bf20f0@kernel.org Signed-off-by: Mark Brown commit 1da33858af6250184d2ef907494d698af03283de Author: Mark Brown Date: Thu Jul 31 21:38:18 2025 +0100 regmap: irq: Free the regmap-irq mutex We do not currently free the mutex allocated by regmap-irq, do so. Tested-by: Russell King (Oracle) Reviewed-by: Russell King (Oracle) Signed-off-by: Mark Brown Link: https://patch.msgid.link/20250731-regmap-irq-nesting-v1-1-98b4d1bf20f0@kernel.org Signed-off-by: Mark Brown commit 9d9b193ed73a65ec47cf1fd39925b09da8216461 Author: Herbert Xu Date: Thu Jul 31 09:41:47 2025 +0800 crypto: hash - Increase HASH_MAX_DESCSIZE for hmac(sha3-224-s390) The value of HASH_MAX_DESCSIZE is off by one for hmac(sha3-224-s390). Fix this so that hmac(sha3-224-s390) can be registered. Reported-by: Ingo Franzki Reported-by: Eric Biggers Fixes: 6f90ba706551 ("crypto: s390/sha3 - Use API partial block handling") Cc: Signed-off-by: Herbert Xu commit 55a984928bfa30c7877e28f16910e6de1c170f1f Author: Jiri Slaby (SUSE) Date: Fri Aug 1 10:26:13 2025 +0200 Revert "tty: vt: use _IO() to define ioctl numbers" This reverts commit f1180ca37abe3d117e4a19be12142fe722612a7c. Since the commit, the vt ioctl numbers are defined differently on platforms where _IOC_NONE is non-zero: alpha, mips, powerpc, sparc. Signed-off-by: "Jiri Slaby (SUSE)" Reported-by: Christophe Leroy Link: https://lore.kernel.org/all/436489B9-E67B-4630-909F-386C30A2AAC9@xenosoft.de/ Link: https://lore.kernel.org/all/97ec2636-915a-498c-903b-d66957420d21@csgroup.eu/ Cc: Nicolas Pitre Cc: Ilpo Järvinen Link: https://lore.kernel.org/r/20250801082613.2564584-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit a967e758f8e9d8ce5ef096743393df5e6e51644b Author: Paulo Alcantara Date: Thu Jul 31 20:46:41 2025 -0300 smb: client: set symlink type as native for POSIX mounts SMB3.1.1 POSIX mounts require symlinks to be created natively with IO_REPARSE_TAG_SYMLINK reparse point. Cc: linux-cifs@vger.kernel.org Cc: Ralph Boehme Cc: David Howells Cc: Reported-by: Matthew Richardson Closes: https://marc.info/?i=1124e7cd-6a46-40a6-9f44-b7664a66654b@ed.ac.uk Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 89748acdf226fd1a8775ff6fa2703f8412b286c8 Merge: 07b43820437bd9 6531a2cf07ef15 Author: Linus Torvalds Date: Thu Jul 31 21:47:36 2025 -0700 Merge tag 'drm-next-2025-08-01' of https://gitlab.freedesktop.org/drm/kernel Pull drm fixes from Dave Airlie: "Just a bunch of amdgpu and xe fixes. amdgpu: - DSC divide by 0 fix - clang fix - DC debugfs fix - Userq fixes - Avoid extra evict-restore with KFD - Backlight fix - Documentation fix - RAS fix - Add new kicker handling - DSC fix for DCN 3.1.4 - PSR fix - Atomic fix - DC reset fixes - DCN 3.0.1 fix - MMHUB client mapping fix xe: - Fix BMG probe on unsupported mailbox command - Fix OA static checker warning about null gt - Fix a NULL vs IS_ERR() bug in xe_i2c_register_adapter - Fix missing unwind goto in GuC/HuC - Don't register I2C devices if VF - Clear whole GuC g2h_fence during initialization - Avoid call kfree for drmm_kzalloc - Fix pci_dev reference leak on configfs - SRIOV: Disable CSC support on VF * tag 'drm-next-2025-08-01' of https://gitlab.freedesktop.org/drm/kernel: (24 commits) drm/xe/vf: Disable CSC support on VF drm/amdgpu: update mmhub 4.1.0 client id mappings drm/amd/display: Allow DCN301 to clear update flags drm/amd/display: Pass up errors for reset GPU that fails to init HW drm/amd/display: Only finalize atomic_obj if it was initialized drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported drm/amd/display: Disable dsc_power_gate for dcn314 by default drm/amdgpu: add kicker fws loading for gfx12/smu14/psp14 drm/amd/amdgpu: fix missing lock for cper.ring->rptr/wptr access drm/amd/display: Fix misuse of /** to /* in 'dce_i2c_hw.c' drm/amd/display: fix initial backlight brightness calculation drm/amdgpu: Avoid extra evict-restore process. drm/amdgpu: track whether a queue is a kernel queue in amdgpu_mqd_prop drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() drm/amd/display: Fix divide by zero when calculating min ODM factor drm/xe/configfs: Fix pci_dev reference leak drm/xe/hw_engine_group: Avoid call kfree() for drmm_kzalloc() drm/xe/guc: Clear whole g2h_fence during initialization drm/xe/vf: Don't register I2C devices if VF ... commit 07b43820437bd96f31f5d7f9baf4453fcb7dedbf Merge: b80a75cf6999fb 7b41a2341fa62b Author: Linus Torvalds Date: Thu Jul 31 21:39:01 2025 -0700 Merge tag 'for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply Pull power supply and reset updates from Sebastian Reichel: "Power-supply core: - battery-info: replace any DT specific bits with fwnode usage - replace any device-tree code with generic fwnode based handling Power-supply drivers: - ug3105_battery: use battery-info API - qcom_battmgr: report capacity - qcom_battmgr: support LiPo battery reporting - add missing missing power-supply ref to a bunch of DT bindings - update drivers regarding pm_runtime_autosuspend() usage - misc minor fixes and cleanups Reset drivers: - misc minor cleanups" * tag 'for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (32 commits) power: supply: core: fix static checker warning power: supply: twl4030_charger: Remove redundant pm_runtime_mark_last_busy() calls power: supply: bq24190: Remove redundant pm_runtime_mark_last_busy() calls MAINTAINERS: rectify file entry in QUALCOMM SMB CHARGER DRIVER power: supply: max1720x correct capacity computation MAINTAINERS: add myself as smbx charger driver maintainer power: supply: pmi8998_charger: rename to qcom_smbx power: supply: qcom_pmi8998_charger: fix wakeirq power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set power: return the correct error code power: reset: POWER_RESET_TORADEX_EC should depend on ARCH_MXC power: supply: cpcap-charger: Fix null check for power_supply_get_by_name power: supply: bq25980_charger: Constify reg_default array power: supply: bq256xx_charger: Constify reg_default array power: reset: at91-sama5d2_shdwc: Refactor wake-up source logging to use dev_info power: reset: qcom-pon: Rename variables to use generic naming power: supply: qcom_battmgr: Add lithium-polymer entry power: supply: qcom_battmgr: Report battery capacity power: supply: bq24190: Free battery_info power: supply: ug3105_battery: Switch to power_supply_batinfo_ocv2cap() ... commit b80a75cf6999fb79971b41eaec7af2bb4b514714 Merge: db68e4c80d995b c62f87e2b1892f Author: Linus Torvalds Date: Thu Jul 31 21:26:05 2025 -0700 Merge tag 'hid-for-linus-2025073101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid Pull HID updates from Jiri Kosina: - hardening of HID core parser against conversion to 0 bits in s32ton() by buggy/malicious devices (Alan Stern) - fix for potential NULL pointer dereference in hid-apple that could be caused by malicious device with APPLE_MAGIC_BACKLIGHT quirk present triggering overflow in data field (Qasim Ijaz) - support for Wake-on-touch in intel-thc (Even Xu) - support for "Input max input size control" and "Input interrupt delay" I2C features in order to improve compatibility of THC devices with legacy HIDI2C touch devices (Even Xu) - support for Touch Bars on x86 MacBook Pros (Kerem Karabay) - support for XP-PEN Artist 22R Pro (Joshua Goins) - third party trackpart support for MacBookPro15,1 (Aditya Garg) - Apple Magic Keyboard A311[89] USB-C support (Aditya Garg, Grigorii Sokoli) - support for operating modes in amd-sfh (Basavaraj Natikar) - avoid setting up battery timer for Apple and Magicmouse devices without battery (Aditya Garg) - fix for behavior of the hid-mcp2221 driver for !CONFIG_IIO cases (Heiko Schocher) - other assorted fixups and device ID additions * tag 'hid-for-linus-2025073101' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (54 commits) HID: core: Harden s32ton() against conversion to 0 bits HID: apple: validate feature-report field count to prevent NULL pointer dereference HID: core: Improve the kerneldoc for hid_report_len() selftests/hid: sync python tests to hid-tools 0.10 selftests/hid: sync the python tests to hid-tools 0.8 selftests/hid: run ruff format on the python part HID: magicmouse: use secs_to_jiffies() for battery timeout HID: apple: use secs_to_jiffies() for battery timeout HID: magicmouse: avoid setting up battery timer when not needed HID: apple: avoid setting up battery timer for devices without battery HID: amd_sfh: Enable operating mode HID: uclogic: Add support for XP-PEN Artist 22R Pro HID: rate-limit hid_warn to prevent log flooding HID: replace scnprintf() with sysfs_emit() HID: uclogic: make read-only array reconnect_event static const HID: mcp-2221: Replace manual comparison with min() macro HID: intel-thc-hid: Separate max input size control conditional list HID: mcp2221: set gpio pin mode HID: multitouch: add device ID for Apple Touch Bar HID: multitouch: specify that Apple Touch Bar is direct ... commit db68e4c80d995b67a92460711038b9223166bda7 Merge: f2d282e1dfb3d8 844e5c0eb1767d Author: Linus Torvalds Date: Thu Jul 31 21:22:04 2025 -0700 Merge tag 'v6.17-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 Pull smb client updates from Steve French: - Fix network namespace refcount leak - Multichannel reconnect fix - Perf improvement to not do unneeded EA query on native symlinks - Performance improvement for directory leases to allow extending lease for actively queried directories - Improve debugging of directory leases by adding pseudofile to show them - Five minor mount cleanup patches - Minor directory lease cleanup patch - Allow creating special files via reparse points over SMB1 - Two minor improvements to FindFirst over SMB1 - Two NTLMSSP session setup fixes * tag 'v6.17-rc-part1-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6: smb3 client: add way to show directory leases for improved debugging smb: client: get rid of kstrdup() when parsing iocharset mount option smb: client: get rid of kstrdup() when parsing domain mount option smb: client: get rid of kstrdup() when parsing pass2 mount option smb: client: get rid of kstrdup() when parsing pass mount option smb: client: get rid of kstrdup() when parsing user mount option cifs: Add support for creating reparse points over SMB1 cifs: Do not query WSL EAs for native SMB symlink cifs: Optimize CIFSFindFirst() response when not searching cifs: Fix calling CIFSFindFirst() for root path without msearch smb: client: fix session setup against servers that require SPN smb: client: allow parsing zero-length AV pairs cifs: add new field to track the last access time of cfid smb: change return type of cached_dir_lease_break() to bool cifs: reset iface weights when we cannot find a candidate smb: client: fix netns refcount leak after net_passive changes commit 93acc0f43f58743737888985133809634e298753 Merge: 13cb75730b7a8b 710618c760c0a3 Author: Alexei Starovoitov Date: Thu Jul 31 18:23:54 2025 -0700 Merge branch 'support-kcfi-bpf-on-arm64' Sami Tolvanen says: ==================== Support kCFI + BPF on arm64 These patches add KCFI types to arm64 BPF JIT output. Puranjay and Maxwell have been working on this for some time now, but I haven't seen any progress since June 2024, so I decided to pick up the latest version[1] posted by Maxwell and fix the few remaining issues I noticed. I confirmed that with these patches applied, I no longer see CFI failures in jitted code when running BPF self-tests on arm64. [1] https://lore.kernel.org/linux-arm-kernel/ptrugmna4xb5o5lo4xislf4rlz7avdmd4pfho5fjwtjj7v422u@iqrwfrbwuxrq/ Sami --- v14: - Rebased to fix a merge conflict. v13: https://lore.kernel.org/bpf/20250722205357.3347626-5-samitolvanen@google.com/ - Added emit_u32_data to fix type hashes on big-endian systems based on Xu's suggestion. v12: https://lore.kernel.org/bpf/20250721202015.3530876-5-samitolvanen@google.com/ - Fixed sparse warnings and 32-bit ARM build errors. v11: https://lore.kernel.org/bpf/20250718223345.1075521-5-samitolvanen@google.com/ - Moved cfi_get_func_hash to a static inline with an ifdef guard. - Picked by Will's Acked-by tags. v10: https://lore.kernel.org/bpf/20250715225733.3921432-5-samitolvanen@google.com/ - Rebased to bpf-next/master again. - Added a patch to moved duplicate type hash variables and helper functions to common CFI code. v9: https://lore.kernel.org/bpf/20250505223437.3722164-4-samitolvanen@google.com/ - Rebased to bpf-next/master to fix merge x86 merge conflicts. - Fixed checkpatch warnings about Co-developed-by tags and including . - Picked up Tested-by tags. v8: https://lore.kernel.org/bpf/20250310222942.1988975-4-samitolvanen@google.com/ - Changed DEFINE_CFI_TYPE to use .4byte to match __CFI_TYPE. - Changed cfi_get_func_hash() to again use get_kernel_nofault(). - Fixed a panic in bpf_jit_free() by resetting prog->bpf_func before calling bpf_jit_binary_pack_hdr(). --- ==================== Link: https://patch.msgid.link/20250801001004.1859976-5-samitolvanen@google.com Signed-off-by: Alexei Starovoitov commit 710618c760c0a3267221517d78f4cfb65ca7b882 Author: Puranjay Mohan Date: Fri Aug 1 00:10:08 2025 +0000 arm64/cfi,bpf: Support kCFI + BPF on arm64 Currently, bpf_dispatcher_*_func() is marked with `__nocfi` therefore calling BPF programs from this interface doesn't cause CFI warnings. When BPF programs are called directly from C: from BPF helpers or struct_ops, CFI warnings are generated. Implement proper CFI prologues for the BPF programs and callbacks and drop __nocfi for arm64. Fix the trampoline generation code to emit kCFI prologue when a struct_ops trampoline is being prepared. Signed-off-by: Puranjay Mohan Co-developed-by: Maxwell Bland Signed-off-by: Maxwell Bland Co-developed-by: Sami Tolvanen Signed-off-by: Sami Tolvanen Tested-by: Dao Huang Acked-by: Will Deacon Link: https://lore.kernel.org/r/20250801001004.1859976-8-samitolvanen@google.com Signed-off-by: Alexei Starovoitov commit f1befc82addda926c8301436123d041bf3249505 Author: Sami Tolvanen Date: Fri Aug 1 00:10:07 2025 +0000 cfi: Move BPF CFI types and helpers to generic code Instead of duplicating the same code for each architecture, move the CFI type hash variables for BPF function types and related helper functions to generic CFI code, and allow architectures to override the function definitions if needed. Signed-off-by: Sami Tolvanen Link: https://lore.kernel.org/r/20250801001004.1859976-7-samitolvanen@google.com Signed-off-by: Alexei Starovoitov commit 5ccaeedb489b41ce6cb857d0de488992746be282 Author: Mark Rutland Date: Fri Aug 1 00:10:06 2025 +0000 cfi: add C CFI type macro Currently x86 and riscv open-code 4 instances of the same logic to define a u32 variable with the KCFI typeid of a given function. Replace the duplicate logic with a common macro. Signed-off-by: Mark Rutland Co-developed-by: Maxwell Bland Signed-off-by: Maxwell Bland Co-developed-by: Sami Tolvanen Signed-off-by: Sami Tolvanen Tested-by: Dao Huang Acked-by: Will Deacon Link: https://lore.kernel.org/r/20250801001004.1859976-6-samitolvanen@google.com Signed-off-by: Alexei Starovoitov commit f2d282e1dfb3d8cb95b5ccdea43f2411f27201db Merge: 6a68cec16b6477 e2b02d382ae0cb Author: Linus Torvalds Date: Thu Jul 31 16:52:32 2025 -0700 Merge tag 'bitmap-for-6.17' of https://github.com/norov/linux Pull bitmap updates from Yury Norov: - find_random_bit() series (Yury) - GENMASK() consolidation (Vincent) - random cleanups (Shaopeng, Ben, Yury) * tag 'bitmap-for-6.17' of https://github.com/norov/linux: bitfield: Ensure the return values of helper functions are checked test_bits: add tests for __GENMASK() and __GENMASK_ULL() bits: unify the non-asm GENMASK*() bits: split the definition of the asm and non-asm GENMASK*() cpumask: Remove unnecessary cpumask_nth_andnot() watchdog: fix opencoded cpumask_next_wrap() in watchdog_next_cpu() clocksource: Improve randomness in clocksource_verify_choose_cpus() cpumask: introduce cpumask_random() bitmap: generalize node_random() commit 6cb43739b93c64c4a2148222bd606e6920257752 Author: Colin Ian King Date: Thu Jul 31 09:02:03 2025 +0100 ata: pata_pdc2027x: Remove space before newline and abbreviations There is a extraneous space before a newline in handful of ata_port_dbg messages. Remove the spaces. Capitalize pio, udma, mdma. Signed-off-by: Colin Ian King Signed-off-by: Damien Le Moal commit 64c7cac9d64eb3ed1062a59fa77b36bfa293fe4e Author: Colin Ian King Date: Wed Jul 30 12:04:42 2025 +0100 ata: pata_macio: Remove space before newline There is a extraneous space before a newline in a dev_dbg message. Remove the space. Signed-off-by: Colin Ian King Signed-off-by: Damien Le Moal commit c9edbb6aecc532c7d0a9bee990beedb27be33851 Author: Colin Ian King Date: Wed Jul 30 11:59:59 2025 +0100 ata: libata-core: Remove space before newline There is a extraneous space before a newline in a ata_dev_dbg message. Remove the space. Signed-off-by: Colin Ian King Signed-off-by: Damien Le Moal commit 99f9a97dce39ad413c39b92c90393bbd6778f3fd Author: Yuezhang Mo Date: Tue Mar 18 17:00:49 2025 +0800 exfat: add cluster chain loop check for dir An infinite loop may occur if the following conditions occur due to file system corruption. (1) Condition for exfat_count_dir_entries() to loop infinitely. - The cluster chain includes a loop. - There is no UNUSED entry in the cluster chain. (2) Condition for exfat_create_upcase_table() to loop infinitely. - The cluster chain of the root directory includes a loop. - There are no UNUSED entry and up-case table entry in the cluster chain of the root directory. (3) Condition for exfat_load_bitmap() to loop infinitely. - The cluster chain of the root directory includes a loop. - There are no UNUSED entry and bitmap entry in the cluster chain of the root directory. (4) Condition for exfat_find_dir_entry() to loop infinitely. - The cluster chain includes a loop. - The unused directory entries were exhausted by some operation. (5) Condition for exfat_check_dir_empty() to loop infinitely. - The cluster chain includes a loop. - The unused directory entries were exhausted by some operation. - All files and sub-directories under the directory are deleted. This commit adds checks to break the above infinite loop. Signed-off-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 2f2d42a17b5a6711378d39df74f1f69a831c5d4e Author: Zhengxu Zhang Date: Thu Jun 19 09:33:31 2025 +0800 exfat: fdatasync flag should be same like generic_write_sync() Test: androbench by default setting, use 64GB sdcard. the random write speed: without this patch 3.5MB/s with this patch 7MB/s After patch "11a347fb6cef", the random write speed decreased significantly. the .write_iter() interface had been modified, and check the differences with generic_file_write_iter(), when calling generic_write_sync() and exfat_file_write_iter() to call vfs_fsync_range(), the fdatasync flag is wrong, and make not use the fdatasync mode, and make random write speed decreased. So use generic_write_sync() instead of vfs_fsync_range(). Fixes: 11a347fb6cef ("exfat: change to get file size from DataLength") Signed-off-by: Zhengxu Zhang Acked-by: Yuezhang Mo Signed-off-by: Namjae Jeon commit 6a68cec16b647791d448102376a7eec2820e874f Merge: 6aee5aed2edd0a ae96bba1ca0000 Author: Linus Torvalds Date: Thu Jul 31 16:29:46 2025 -0700 Merge tag 'sched_ext-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext Pull sched_ext updates from Tejun Heo: - Add support for cgroup "cpu.max" interface - Code organization cleanup so that ext_idle.c doesn't depend on the source-file-inclusion build method of sched/ - Drop UP paths in accordance with sched core changes - Documentation and other misc changes * tag 'sched_ext-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: sched_ext: Fix scx_bpf_reenqueue_local() reference sched_ext: Drop kfuncs marked for removal in 6.15 sched_ext, rcu: Eject BPF scheduler on RCU CPU stall panic kernel/sched/ext.c: fix typo "occured" -> "occurred" in comments sched_ext: Add support for cgroup bandwidth control interface sched_ext, sched/core: Factor out struct scx_task_group sched_ext: Return NULL in llc_span sched_ext: Always use SMP versions in kernel/sched/ext_idle.h sched_ext: Always use SMP versions in kernel/sched/ext_idle.c sched_ext: Always use SMP versions in kernel/sched/ext.h sched_ext: Always use SMP versions in kernel/sched/ext.c sched_ext: Documentation: Clarify time slice handling in task lifecycle sched_ext: Make scx_locked_rq() inline sched_ext: Make scx_rq_bypassing() inline sched_ext: idle: Make local functions static in ext_idle.c sched_ext: idle: Remove unnecessary ifdef in scx_bpf_cpu_node() commit 6aee5aed2edd0a156bf060abce1bdbbc38171c10 Merge: af5b2619a89d4f 646faf36d7271c Author: Linus Torvalds Date: Thu Jul 31 16:04:19 2025 -0700 Merge tag 'cgroup-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - Allow css_rstat_updated() in NMI context to enable memory accounting for allocations in NMI context. - /proc/cgroups doesn't contain useful information for cgroup2 and was updated to only show v1 controllers. This unfortunately broke something in the wild. Add an option to bring back the old behavior to ease transition. - selftest updates and other cleanups. * tag 'cgroup-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: Add compatibility option for content of /proc/cgroups selftests/cgroup: fix cpu.max tests cgroup: llist: avoid memory tears for llist_node selftests: cgroup: Fix missing newline in test_zswap_writeback_one selftests: cgroup: Allow longer timeout for kmem_dead_cgroups cleanup memcg: cgroup: call css_rstat_updated irrespective of in_nmi() cgroup: remove per-cpu per-subsystem locks cgroup: make css_rstat_updated nmi safe cgroup: support to enable nmi-safe css_rstat_updated selftests: cgroup: Fix compilation on pre-cgroupns kernels selftests: cgroup: Optionally set up v1 environment selftests: cgroup: Add support for named v1 hierarchies in test_core selftests: cgroup_util: Add helpers for testing named v1 hierarchies Documentation: cgroup: add section explaining controller availability cgroup: Drop sock_cgroup_classid() dummy implementation commit af5b2619a89d4f1261ddfc310ffd5d1e630f8fdc Merge: beace86e61e465 df316ab3d44401 Author: Linus Torvalds Date: Thu Jul 31 15:40:22 2025 -0700 Merge tag 'wq-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq Pull workqueue updates from Tejun Heo: - Prepare for defaulting to unbound workqueue. A separate branch was created to ease pulling in from other trees but none of the conversions have landed yet - Memory allocation profiling support added - Misc changes * tag 'wq-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: workqueue: Use atomic_try_cmpxchg_relaxed() in tryinc_node_nr_active() workqueue: Remove unused work_on_cpu_safe workqueue: Add new WQ_PERCPU flag workqueue: Add system_percpu_wq and system_dfl_wq workqueue: Basic memory allocation profiling support workqueue: fix opencoded cpumask_next_and_wrap() in wq_select_unbound_cpu() commit beace86e61e465dba204a268ab3f3377153a4973 Merge: cbbf0a759ff96c af915c3c13b64d Author: Linus Torvalds Date: Thu Jul 31 14:57:54 2025 -0700 Merge tag 'mm-stable-2025-07-30-15-25' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: "As usual, many cleanups. The below blurbiage describes 42 patchsets. 21 of those are partially or fully cleanup work. "cleans up", "cleanup", "maintainability", "rationalizes", etc. I never knew the MM code was so dirty. "mm: ksm: prevent KSM from breaking merging of new VMAs" (Lorenzo Stoakes) addresses an issue with KSM's PR_SET_MEMORY_MERGE mode: newly mapped VMAs were not eligible for merging with existing adjacent VMAs. "mm/damon: introduce DAMON_STAT for simple and practical access monitoring" (SeongJae Park) adds a new kernel module which simplifies the setup and usage of DAMON in production environments. "stop passing a writeback_control to swap/shmem writeout" (Christoph Hellwig) is a cleanup to the writeback code which removes a couple of pointers from struct writeback_control. "drivers/base/node.c: optimization and cleanups" (Donet Tom) contains largely uncorrelated cleanups to the NUMA node setup and management code. "mm: userfaultfd: assorted fixes and cleanups" (Tal Zussman) does some maintenance work on the userfaultfd code. "Readahead tweaks for larger folios" (Ryan Roberts) implements some tuneups for pagecache readahead when it is reading into order>0 folios. "selftests/mm: Tweaks to the cow test" (Mark Brown) provides some cleanups and consistency improvements to the selftests code. "Optimize mremap() for large folios" (Dev Jain) does that. A 37% reduction in execution time was measured in a memset+mremap+munmap microbenchmark. "Remove zero_user()" (Matthew Wilcox) expunges zero_user() in favor of the more modern memzero_page(). "mm/huge_memory: vmf_insert_folio_*() and vmf_insert_pfn_pud() fixes" (David Hildenbrand) addresses some warts which David noticed in the huge page code. These were not known to be causing any issues at this time. "mm/damon: use alloc_migrate_target() for DAMOS_MIGRATE_{HOT,COLD" (SeongJae Park) provides some cleanup and consolidation work in DAMON. "use vm_flags_t consistently" (Lorenzo Stoakes) uses vm_flags_t in places where we were inappropriately using other types. "mm/memfd: Reserve hugetlb folios before allocation" (Vivek Kasireddy) increases the reliability of large page allocation in the memfd code. "mm: Remove pXX_devmap page table bit and pfn_t type" (Alistair Popple) removes several now-unneeded PFN_* flags. "mm/damon: decouple sysfs from core" (SeongJae Park) implememnts some cleanup and maintainability work in the DAMON sysfs layer. "madvise cleanup" (Lorenzo Stoakes) does quite a lot of cleanup/maintenance work in the madvise() code. "madvise anon_name cleanups" (Vlastimil Babka) provides additional cleanups on top or Lorenzo's effort. "Implement numa node notifier" (Oscar Salvador) creates a standalone notifier for NUMA node memory state changes. Previously these were lumped under the more general memory on/offline notifier. "Make MIGRATE_ISOLATE a standalone bit" (Zi Yan) cleans up the pageblock isolation code and fixes a potential issue which doesn't seem to cause any problems in practice. "selftests/damon: add python and drgn based DAMON sysfs functionality tests" (SeongJae Park) adds additional drgn- and python-based DAMON selftests which are more comprehensive than the existing selftest suite. "Misc rework on hugetlb faulting path" (Oscar Salvador) fixes a rather obscure deadlock in the hugetlb fault code and follows that fix with a series of cleanups. "cma: factor out allocation logic from __cma_declare_contiguous_nid" (Mike Rapoport) rationalizes and cleans up the highmem-specific code in the CMA allocator. "mm/migration: rework movable_ops page migration (part 1)" (David Hildenbrand) provides cleanups and future-preparedness to the migration code. "mm/damon: add trace events for auto-tuned monitoring intervals and DAMOS quota" (SeongJae Park) adds some tracepoints to some DAMON auto-tuning code. "mm/damon: fix misc bugs in DAMON modules" (SeongJae Park) does that. "mm/damon: misc cleanups" (SeongJae Park) also does what it claims. "mm: folio_pte_batch() improvements" (David Hildenbrand) cleans up the large folio PTE batching code. "mm/damon/vaddr: Allow interleaving in migrate_{hot,cold} actions" (SeongJae Park) facilitates dynamic alteration of DAMON's inter-node allocation policy. "Remove unmap_and_put_page()" (Vishal Moola) provides a couple of page->folio conversions. "mm: per-node proactive reclaim" (Davidlohr Bueso) implements a per-node control of proactive reclaim - beyond the current memcg-based implementation. "mm/damon: remove damon_callback" (SeongJae Park) replaces the damon_callback interface with a more general and powerful damon_call()+damos_walk() interface. "mm/mremap: permit mremap() move of multiple VMAs" (Lorenzo Stoakes) implements a number of mremap cleanups (of course) in preparation for adding new mremap() functionality: newly permit the remapping of multiple VMAs when the user is specifying MREMAP_FIXED. It still excludes some specialized situations where this cannot be performed reliably. "drop hugetlb_free_pgd_range()" (Anthony Yznaga) switches some sparc hugetlb code over to the generic version and removes the thus-unneeded hugetlb_free_pgd_range(). "mm/damon/sysfs: support periodic and automated stats update" (SeongJae Park) augments the present userspace-requested update of DAMON sysfs monitoring files. Automatic update is now provided, along with a tunable to control the update interval. "Some randome fixes and cleanups to swapfile" (Kemeng Shi) does what is claims. "mm: introduce snapshot_page" (Luiz Capitulino and David Hildenbrand) provides (and uses) a means by which debug-style functions can grab a copy of a pageframe and inspect it locklessly without tripping over the races inherent in operating on the live pageframe directly. "use per-vma locks for /proc/pid/maps reads" (Suren Baghdasaryan) addresses the large contention issues which can be triggered by reads from that procfs file. Latencies are reduced by more than half in some situations. The series also introduces several new selftests for the /proc/pid/maps interface. "__folio_split() clean up" (Zi Yan) cleans up __folio_split()! "Optimize mprotect() for large folios" (Dev Jain) provides some quite large (>3x) speedups to mprotect() when dealing with large folios. "selftests/mm: reuse FORCE_READ to replace "asm volatile("" : "+r" (XXX));" and some cleanup" (wang lian) does some cleanup work in the selftests code. "tools/testing: expand mremap testing" (Lorenzo Stoakes) extends the mremap() selftest in several ways, including adding more checking of Lorenzo's recently added "permit mremap() move of multiple VMAs" feature. "selftests/damon/sysfs.py: test all parameters" (SeongJae Park) extends the DAMON sysfs interface selftest so that it tests all possible user-requested parameters. Rather than the present minimal subset" * tag 'mm-stable-2025-07-30-15-25' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (370 commits) MAINTAINERS: add missing headers to mempory policy & migration section MAINTAINERS: add missing file to cgroup section MAINTAINERS: add MM MISC section, add missing files to MISC and CORE MAINTAINERS: add missing zsmalloc file MAINTAINERS: add missing files to page alloc section MAINTAINERS: add missing shrinker files MAINTAINERS: move memremap.[ch] to hotplug section MAINTAINERS: add missing mm_slot.h file THP section MAINTAINERS: add missing interval_tree.c to memory mapping section MAINTAINERS: add missing percpu-internal.h file to per-cpu section mm/page_alloc: remove trace_mm_alloc_contig_migrate_range_info() selftests/damon: introduce _common.sh to host shared function selftests/damon/sysfs.py: test runtime reduction of DAMON parameters selftests/damon/sysfs.py: test non-default parameters runtime commit selftests/damon/sysfs.py: generalize DAMON context commit assertion selftests/damon/sysfs.py: generalize monitoring attributes commit assertion selftests/damon/sysfs.py: generalize DAMOS schemes commit assertion selftests/damon/sysfs.py: test DAMOS filters commitment selftests/damon/sysfs.py: generalize DAMOS scheme commit assertion selftests/damon/sysfs.py: test DAMOS destinations commitment ... commit 58d2b6b6b214d8b4914cd4c821a8bd0c75436c2c Merge: 0edfffd24c641d 50fcd1c14e364a Author: Bjorn Helgaas Date: Thu Jul 31 16:12:19 2025 -0500 Merge branch 'pci/misc' - Remove resolved hotplug TODO item (Guilherme Giacomo Simoes) - Fix typos (Bjorn Helgaas) * pci/misc: PCI: Fix typos PCI: hotplug: Remove TODO about unused .get_power(), .hardware_test() commit 0edfffd24c641d62cb734223b0185e362935abc2 Merge: 656626e81a7eb9 e612423be33465 Author: Bjorn Helgaas Date: Thu Jul 31 16:12:18 2025 -0500 Merge branch 'pci/controller/xgene' - Teach handle_simple_irq() to resend an in-progress interrupt (Marc Zyngier) - Defer probing if the MSI widget driver hasn't probed yet (Marc Zyngier) - Drop useless conditional compilation, since pci-xgene.c is only compiled when CONFIG_PCI_XGENE is selected (Marc Zyngier) - Drop useless XGENE_PCIE_IP_VER_UNKN IP version (Marc Zyngier) - Simplify and make per-CPU interrupt setup robust (Marc Zyngier) - Drop superfluous struct xgene_msi fields (Marc Zyngier) - Use device-managed memory allocations (Marc Zyngier) - Drop intermediate xgene_msi_group tracking structure (Marc Zyngier) - Rewrite pci-xgene-msi.c to fix MSI CPU affinity and clean things up (Marc Zyngier) - Resend an MSI racing with itself on a different CPU (Marc Zyngier) - Probe xgene-msi as a standard platform driver rather than a subsys_initcall (Marc Zyngier) - Simplify MSI handler setup/teardown by dropping useless CPU hotplug bits (Marc Zyngier) - Remove unused cpuhp_state CPUHP_PCI_XGENE_DEAD (Marc Zyngier) * pci/controller/xgene: cpu/hotplug: Remove unused cpuhp_state CPUHP_PCI_XGENE_DEAD PCI: xgene-msi: Restructure handler setup/teardown PCI: xgene-msi: Probe as a standard platform driver PCI: xgene-msi: Resend an MSI racing with itself on a different CPU PCI: xgene-msi: Sanitise MSI allocation and affinity setting PCI: xgene-msi: Get rid of intermediate tracking structure PCI: xgene-msi: Use device-managed memory allocations PCI: xgene-msi: Drop superfluous fields from xgene_msi structure PCI: xgene-msi: Make per-CPU interrupt setup robust PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN PCI: xgene: Drop useless conditional compilation PCI: xgene: Defer probing if the MSI widget driver hasn't probed yet genirq: Teach handle_simple_irq() to resend an in-progress interrupt commit 656626e81a7eb9f5138445a6e72d81be975446d2 Merge: e070bde5b32385 255c891533d89f Author: Bjorn Helgaas Date: Thu Jul 31 16:12:18 2025 -0500 Merge branch 'pci/controller/vmd' - Add Intel Panther Lake (PTL)-H/P/U Vendor ID (George D Sworo) * pci/controller/vmd: PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U commit e070bde5b3238527b09065c5516aa91b5d4dbfaf Merge: 090fc11428a3c0 467d9c0348d6fd Author: Bjorn Helgaas Date: Thu Jul 31 16:12:17 2025 -0500 Merge branch 'pci/controller/sophgo' - Add DT binding and driver for Sophgo SG2044 PCIe controller driver in Root Complex mode (Inochi Amaoto) * pci/controller/sophgo: PCI: dwc: Add Sophgo SG2044 PCIe controller driver in Root Complex mode dt-bindings: pci: Add Sophgo SG2044 PCIe host commit 090fc11428a3c0636c23b7f8368446b719ee79c2 Merge: 90eb421c46fd7e 1fdb13f92388df Author: Bjorn Helgaas Date: Thu Jul 31 16:12:17 2025 -0500 Merge branch 'pci/controller/rockchip-host' - Fix log message that said "malformed TLP" when it should have said "Unexpected Completion" (Hans Zhang) - Fix log message that said "no fatal error" when it should have said "non fatal error" (Hans Zhang) - Remove several unused header includes (Hans Zhang) * pci/controller/rockchip-host: PCI: rockchip-host: Remove unused header includes PCI: rockchip-host: Correct non-fatal error log message PCI: rockchip-host: Fix "Unexpected Completion" log message commit 90eb421c46fd7e31f03b4e5f8a36eb81ca3f42bb Merge: 81b3be6cc58a43 114b06ee108cab Author: Bjorn Helgaas Date: Thu Jul 31 16:12:16 2025 -0500 Merge branch 'pci/controller/rockchip' - Drop unused PCIe Message routing and code definitions (Hans Zhang) - Use standard PCIe config register definitions instead of rockchip-specific redefinitions (Geraldo Nascimento) - Set Target Link Speed to 5.0 GT/s before retraining so we have a chance to train at a higher speed (Geraldo Nascimento) * pci/controller/rockchip: PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining PCI: rockchip: Use standard PCIe definitions PCI: rockchip: Remove redundant PCIe message routing definitions commit 81b3be6cc58a43c9272ca94c9c0f1ce38b3107cb Merge: d5b0b60ab054ef a2fbecdbbb9d77 Author: Bjorn Helgaas Date: Thu Jul 31 16:12:16 2025 -0500 Merge branch 'pci/controller/qcom' - Export DWC MSI controller related APIs for use by upcoming DWC-based ECAM implementation (Mayank Rana) - Rename gen_pci_init() to pci_host_common_ecam_create() and export for use by controller drivers (Mayank Rana) - Add DT binding and driver support for SA8255p, which supports ECAM for Configuration Space access (Mayank Rana) - Update DT binding and driver to describe PHYs and per-Root Port resets in a Root Port stanza and deprecate describing them in the host bridge; this makes it possible to support multiple Root Ports in the future (Krishna Chaitanya Chundru) * pci/controller/qcom: PCI: qcom: Add support for parsing the new Root Port binding dt-bindings: PCI: qcom: Move PHY & reset GPIO to Root Port node PCI: qcom: Add support for Qualcomm SA8255p based PCIe Root Complex dt-bindings: PCI: qcom,pcie-sa8255p: Document ECAM compliant PCIe root complex PCI: host-generic: Rename and export gen_pci_init() for PCIe controller drivers PCI: dwc: Export DWC MSI controller related APIs commit d5b0b60ab054ef8006a6339ba8f6eeda3ba8a120 Merge: ed1e2002b748a1 c79a7ca8fb72a1 Author: Bjorn Helgaas Date: Thu Jul 31 16:12:15 2025 -0500 Merge branch 'pci/controller/mvebu' - Use devm_add_action_or_reset() when adding port->clk devm cleanup action so we don't have to explicitly call clk_put() (Salah Triki) * pci/controller/mvebu: PCI: mvebu: Use devm_add_action_or_reset() instead of devm_add_action() commit ed1e2002b748a1ae58e94c1ed93051f3d82b71ce Merge: 4cf171327a80fb 2e6ea70690ddd1 Author: Bjorn Helgaas Date: Thu Jul 31 16:12:14 2025 -0500 Merge branch 'pci/controller/imx6' - Add IMX8MQ_EP third 64-bit BAR in epc_features (Richard Zhu) - Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features (Richard Zhu) - Factor imx_pcie_add_lut_by_rid() out of imx_pcie_enable_device() for use by LUT configuration (Frank Li) - Configure LUT for MSI/IOMMU in Endpoint mode so Root Complex can trigger doorbel on Endpoint (Frank Li) - Remove apps_reset (LTSSM_EN) from imx_pcie_{assert,deassert}_core_reset(), which fixes a hotplug regression on i.MX8MM (Richard Zhu) - Delay Endpoint link start until configfs 'start' written (Richard Zhu) * pci/controller/imx6: PCI: imx6: Delay link start until configfs 'start' written PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset PCI: imx6: Add LUT configuration for MSI/IOMMU in Endpoint mode PCI: imx6: Add helper function imx_pcie_add_lut_by_rid() PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features commit 4cf171327a80fb73a039d6e71704364f2e5a916e Merge: f623d50c125d6e c0b93754547dde Author: Bjorn Helgaas Date: Thu Jul 31 16:12:14 2025 -0500 Merge branch 'pci/controller/dw-rockchip' - Prevent race between link training and register update via DBI by inhibiting link training after hot reset and link down (Wilfred Mallawa) * pci/controller/dw-rockchip: PCI: dw-rockchip: Delay link training after hot reset in EP mode commit f623d50c125d6e1c2782daaf694fae185ab7e27c Merge: 4441df6adcb355 c1dc61aede55a5 Author: Bjorn Helgaas Date: Thu Jul 31 16:12:13 2025 -0500 Merge branch 'pci/controller/dwc' - Simplify debugfs 'return' statements (Hans Zhang) - Make dw_pcie_ptm_ops static (Manivannan Sadhasivam) * pci/controller/dwc: PCI: dwc: Make dw_pcie_ptm_ops static PCI: dwc: Simplify the return value of PTM debugfs functions returning bool commit 4441df6adcb355d5ce6e1a94e31ea3296059d53f Merge: dc6061ed6becae f28413fe089959 Author: Bjorn Helgaas Date: Thu Jul 31 16:12:13 2025 -0500 Merge branch 'pci/controller/cadence' - Use PCIe Message routing types from the PCI core rather than defining private ones (Hans Zhang) * pci/controller/cadence: PCI: cadence: Replace private message routing enums with PCI core definitions commit dc6061ed6becae8baabc5c6fd1c4cbf1f8ffa41f Merge: 480b315376eeab e8e7c1e95d6d4c Author: Bjorn Helgaas Date: Thu Jul 31 16:12:05 2025 -0500 Merge branch 'pci/controller/brcmstb' - Add optional DT 'num-lanes' property and if present, use it to override the Maximum Link Width advertised in Link Capabilities (Jim Quinlan) * pci/controller/brcmstb: PCI: brcmstb: Replace open coded value with PCIE_T_RRS_READY_MS MAINTAINERS: Drop Nicolas from maintaining pcie-brcmstb PCI: brcmstb: Set MLW based on "num-lanes" DT property if present dt-bindings: PCI: brcm,stb-pcie: Add num-lanes property commit 480b315376eeabbcd206e41df7e7c1e9ed8d71b9 Merge: 769ce531faa659 d7467bc72ce4e3 Author: Bjorn Helgaas Date: Thu Jul 31 16:11:47 2025 -0500 Merge branch 'pci/controller/linkup-fix' - Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS (the required delay before sending config requests after a reset) (Niklas Cassel) - PCIE_T_RRS_READY_MS and PCIE_RESET_CONFIG_WAIT_MS were two names for the same delay; replace PCIE_T_RRS_READY_MS with PCIE_RESET_CONFIG_WAIT_MS and remove PCIE_T_RRS_READY_MS (Niklas Cassel) - Add required PCIE_RESET_CONFIG_WAIT_MS delay after Link up IRQ to dw-rockchip, qcom (Niklas Cassel) - Add required PCIE_RESET_CONFIG_WAIT_MS after waiting for Link up on Ports that support > 5.0 GT/s in dwc core (Niklas Cassel) - Move LINK_WAIT_SLEEP_MS and LINK_WAIT_MAX_RETRIES to pci.h and prefix with 'PCIE_' for potential sharing across drivers (Niklas Cassel) * pci/controller/linkup-fix: PCI: Move link up wait time and max retries macros to pci.h PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up PCI: qcom: Wait PCIE_RESET_CONFIG_WAIT_MS after link-up IRQ PCI: dw-rockchip: Wait PCIE_RESET_CONFIG_WAIT_MS after link-up IRQ PCI: rockchip-host: Use macro PCIE_RESET_CONFIG_WAIT_MS PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS commit 769ce531faa659ff3cea347d14ff50dcf2d3d4b8 Merge: 7f837a2648a614 d7d8ab87e3e741 Author: Bjorn Helgaas Date: Thu Jul 31 16:11:46 2025 -0500 Merge branch 'pci/controller/msi-parent' - Use dev_fwnode() instead of of_fwnode_handle() to remove OF dependency in altera (fixes an unused variable), designware-host, mediatek, mediatek-gen3, mobiveil, plda, xilinx, xilinx-dma, xilinx-nwl (Jiri Slaby, Arnd Bergmann) - Convert aardvark, altera, brcmstb, designware-host, iproc, mediatek, mediatek-gen3, mobiveil, plda, rcar-host, vmd, xilinx, xilinx-dma, xilinx-nwl from using pci_msi_create_irq_domain() to using msi_create_parent_irq_domain() instead; this makes the interrupt controller per-PCI device, allows dynamic allocation of vectors after initialization, and allows support of IMS (Nam Cao) - Convert vmd to using lock guards to tidy the code (Nam Cao) * pci/controller/msi-parent: PCI: vmd: Switch to msi_create_parent_irq_domain() PCI: vmd: Convert to lock guards PCI: plda: Switch to msi_create_parent_irq_domain() PCI: xilinx: Switch to msi_create_parent_irq_domain() PCI: xilinx-nwl: Switch to msi_create_parent_irq_domain() PCI: xilinx-xdma: Switch to msi_create_parent_irq_domain() PCI: rcar-host: Switch to msi_create_parent_irq_domain() PCI: mediatek: Switch to msi_create_parent_irq_domain() PCI: mediatek-gen3: Switch to msi_create_parent_irq_domain() PCI: iproc: Switch to msi_create_parent_irq_domain() PCI: brcmstb: Switch to msi_create_parent_irq_domain() PCI: altera-msi: Switch to msi_create_parent_irq_domain() PCI: aardvark: Switch to msi_create_parent_irq_domain() PCI: mobiveil: Switch to msi_create_parent_irq_domain() PCI: dwc: Switch to msi_create_parent_irq_domain() PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() commit 7f837a2648a614337a879cc2f7131c3015e8557b Merge: 63e6f0df6a0794 61ae7f8694fb4b Author: Bjorn Helgaas Date: Thu Jul 31 16:11:46 2025 -0500 Merge branch 'pci/endpoint/epf-vntb' - Return -ENOENT (not -1) if pci_epc_get_next_free_bar() fails (Jerome Brunet) - Align MW (memory window) naming with config names (Jerome Brunet) - Allow BAR assignment via configfs so platforms have flexibility in determining BAR usage (Jerome Brunet) - Drop incorrect '__iomem' annotation on the return value of pci_epf_alloc_space(); this also fixes an sparse warning (Manivannan Sadhasivam) * pci/endpoint/epf-vntb: PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute PCI: endpoint: pci-epf-vntb: Allow BAR assignment via configfs PCI: endpoint: pci-epf-vntb: Align MW naming with config names PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails commit 63e6f0df6a07945709c02822e89ec61ce7fe7c9a Merge: b8222fe27cc2b6 b351e9c93a4fc0 Author: Bjorn Helgaas Date: Thu Jul 31 16:11:45 2025 -0500 Merge branch 'pci/endpoint/doorbell' - Add RC-to-EP doorbell support using platform MSI controller (Frank Li) - Check for MSI parent and mutability since we currently don't support mutable MSI controllers (Frank Li) - Add pci_epf_align_inbound_addr() helper (Frank Li) - Add a doorbell test (Frank Li) * pci/endpoint/doorbell: selftests: pci_endpoint: Add doorbell test case misc: pci_endpoint_test: Add doorbell test case PCI: endpoint: pci-epf-test: Add doorbell test support PCI: endpoint: Add pci_epf_align_inbound_addr() helper for inbound address alignment PCI: endpoint: pci-ep-msi: Add checks for MSI parent and mutability PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller commit b8222fe27cc2b68e08989f4b91c6dcd5b69dbc25 Merge: 11fdf08767d101 910bdb8197f932 Author: Bjorn Helgaas Date: Thu Jul 31 16:11:45 2025 -0500 Merge branch 'pci/endpoint/core' - Fix configfs epf_group removal, which incorrectly did a list_del() on a list head, not a list entry (Damien Le Moal) * pci/endpoint/core: PCI: endpoint: Fix configfs group removal on driver teardown PCI: endpoint: Fix configfs group list head handling commit 11fdf08767d101eb72bb1ab1365cde605ebff18b Merge: 29ccb7b97e2734 fbcbd66fddd2e9 Author: Bjorn Helgaas Date: Thu Jul 31 16:11:44 2025 -0500 Merge branch 'pci/dt-bindings' - Add Qualcomm QCS615 to SM8150 DT binding (Ziyue Zhang) - Add Qualcomm QCS8300 to SA8775p DT binding (Ziyue Zhang) - Add '6' (64 GT/s, aka Gen6) as a legal value for the DT endpoint 'max-link-speed' property (Hans Zhang) - Drop TBU and ref clocks from Qualcomm SM8150 and SC8180x DT bindings (Konrad Dybcio) - Convert amazon,al-alpine-v[23]-pcie, apm,xgene-pcie, axis,artpec6-pcie, marvell,armada-3700-pcie, st,spear1340-pcie to DT schema format (Rob Herring) - Document 'link_down' reset in Qualcomm SA8775P DT binding (Ziyue Zhang) * pci/dt-bindings: dt-bindings: PCI: qcom,pcie-sa8775p: Document 'link_down' reset dt-bindings: PCI: Remove 83xx-512x-pci.txt dt-bindings: PCI: Convert amazon,al-alpine-v[23]-pcie to DT schema dt-bindings: PCI: Convert marvell,armada-3700-pcie to DT schema dt-bindings: PCI: Convert apm,xgene-pcie to DT schema dt-bindings: PCI: Convert axis,artpec6-pcie to DT schema dt-bindings: PCI: Convert st,spear1340-pcie to DT schema dt-bindings: PCI: qcom,pcie-sm8150: Drop unrelated clocks from PCIe hosts dt-bindings: PCI: qcom,pcie-sc8180x: Drop unrelated clocks from PCIe hosts dt-bindings: PCI: pci-ep: Extend max-link-speed to PCIe Gen5/Gen6 dt-bindings: PCI: qcom,pcie-sa8775p: Document QCS8300 dt-bindings: PCI: qcom,pcie-sm8150: Document QCS615 commit 29ccb7b97e2734e411a5e8e5cec1c8b7b2686503 Merge: 618c1ead12a44c 84f890414a12b8 Author: Bjorn Helgaas Date: Thu Jul 31 16:11:43 2025 -0500 Merge branch 'pci/resources' - Restore VF resizable BAR state after reset (Michał Winiarski) - Add pci_resource_num_to_vf_bar() and pci_resource_num_from_vf_bar() to convert between VF BAR number and the dev->resource[] index (Michał Winiarski) - Allow IOV resources (VF BARs) to be resized (Michał Winiarski) - Add pci_iov_vf_bar_set_size() so drivers can control VF BAR size (Michał Winiarski) * pci/resources: PCI/IOV: Allow drivers to control VF BAR size PCI/IOV: Check that VF BAR fits within the reservation PCI/IOV: Allow IOV resources to be resized in pci_resize_resource() PCI/IOV: Add pci_resource_num_to_vf_bar() to convert VF BAR number to/from IOV resource PCI/IOV: Restore VF resizable BAR state after reset commit 618c1ead12a44c6a16922e7853943c79b202c995 Merge: 9fef768d867c70 3aa54d162490f1 Author: Bjorn Helgaas Date: Thu Jul 31 16:11:43 2025 -0500 Merge branch 'pci/pwrctrl' - Add optional slot clock for cases where the PCIe host controller and the slot are supplied by different clocks (Marek Vasut) - Fix kerneldoc tag for private fields (Bartosz Golaszewski) * pci/pwrctrl: PCI/pwrctrl: Fix the kerneldoc tag for private fields PCI/pwrctrl: Add optional slot clock for PCI slots commit 9fef768d867c70cdbb43a2152ce539618ce07b2e Merge: 0e142889f47bbb 78447d4545b2ea Author: Bjorn Helgaas Date: Thu Jul 31 16:11:42 2025 -0500 Merge branch 'pci/iommu' - Fix a Time-of-Check to Time-of-Use issue when testing driver_managed_dma in the IOMMU probe path (Robin Murphy) * pci/iommu: PCI: Fix driver_managed_dma check commit 0e142889f47bbb48cb880b79873ad644a9165857 Merge: fc9a7d38d5f44c c2f9de5e2db291 Author: Bjorn Helgaas Date: Thu Jul 31 16:11:42 2025 -0500 Merge branch 'pci/hotplug' - Fix runtime PM ref imbalance on Hot-Plug Capable ports caused by misinterpreting a config read failure after a device has been removed (Lukas Wunner) - Avoid creating a useless PCIe port service device for pciehp if the slot is handled by the ACPI hotplug driver (Lukas Wunner) - Ignore ACPI hotplug slots when calculating depth of pciehp hotplug ports (Lukas Wunner) - Simplify pci_bridge_d3_possible() and clarify comments (Lukas Wunner) * pci/hotplug: PCI: Move is_pciehp check out of pciehp_is_native() PCI: pciehp: Use is_pciehp instead of is_hotplug_bridge PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports commit fc9a7d38d5f44cebd0964fdad67533ad1240cfe3 Merge: e6035a0809e05e 5c0d0ee36f168f Author: Bjorn Helgaas Date: Thu Jul 31 16:11:41 2025 -0500 Merge branch 'pci/enumeration' - Allow 'isolated PCI functions' (multi-function devices without a function 0) for LoongArch, similar to s390 and jailhouse (Huacai Chen) - Mask out unrelated bits in PCIE_LNKCAP_SLS2SPEED() and PCIE_LNKCTL2_TLS2SPEED(), which makes them more robust and fixes a WARN_ON_ONCE() in pcie_set_target_speed() (Jiwei Sun) - Read Link Control 2 again when retraining a link after a training failure so we try to increase the link speed (Jiwei Sun) - Allow built-in drivers, not just modular drivers, to use async initial probing (Lukas Wunner) - Support Immediate Readiness even on devices with no PM Capability (Sean Christopherson) * pci/enumeration: PCI: Support Immediate Readiness on devices without PM capabilities PCI: Allow built-in drivers to use async initial probing PCI: Adjust the position of reading the Link Control 2 register PCI: Fix link speed calculation on retrain failure PCI: Extend isolated function probing to LoongArch commit e6035a0809e05ec093e456c04fa2bad4f8a66e13 Merge: 010c31057776ac 6642adf0c1fbe2 Author: Bjorn Helgaas Date: Thu Jul 31 16:11:40 2025 -0500 Merge branch 'pci/boot-display' - Add pci_is_display() to check for "Display" base class and use it in ALSA hda, vfio, vga_switcheroo, vt-d (Mario Limonciello) * pci/boot-display: ALSA: hda: Use pci_is_display() iommu/vt-d: Use pci_is_display() vga_switcheroo: Use pci_is_display() vfio/pci: Use pci_is_display() PCI: Add pci_is_display() to check if device is a display controller commit 010c31057776ac43cfe773f719eccccbbc3e0f45 Merge: 2de2f9274f7a14 64fd90ef25206b Author: Bjorn Helgaas Date: Thu Jul 31 16:11:40 2025 -0500 Merge branch 'pci/aspm' - Change aspm_disabled and aspm_force from int to bool (Hans Zhang) - Initialize val at declaration (Hans Zhang) * pci/aspm: PCI/ASPM: Consolidate variable declaration and initialization PCI/ASPM: Use boolean type for aspm_disabled and aspm_force commit 2de2f9274f7a1415dd88f71d7565044e1a4b8e79 Merge: 19272b37aa4f83 a6f494becf09c9 Author: Bjorn Helgaas Date: Thu Jul 31 16:11:39 2025 -0500 Merge branch 'pci/aer' - Change pcie_aer_disable from int to bool (Hans Zhang) - Add message if AER interrupt occurs and we find more downstream devices with AER errors logged than we can process (Akshay Jindal) * pci/aer: PCI/AER: Add message when AER_MAX_MULTI_ERR_DEVICES limit is hit PCI/AER: Use bool for AER disable state tracking commit fbcbd66fddd2e9ad295d6e3707e2421f062727d5 Author: Ziyue Zhang Date: Fri Jul 18 16:17:16 2025 +0800 dt-bindings: PCI: qcom,pcie-sa8775p: Document 'link_down' reset Each PCIe controller on SA8775P includes a 'link_down' reset line in hardware. This patch documents the reset in the device tree binding. The 'link_down' reset is used to forcefully bring down the PCIe link layer, which is useful in scenarios such as link recovery after errors, power management transitions, and hotplug events. Including this reset line improves robustness and provides finer control over PCIe controller behavior. As the 'link_down' reset was omitted in the initial submission, it is now being documented. While this reset is not required for most of the block's basic functionality, and device trees lacking it will continue to function correctly in most cases, it is necessary to ensure maximum robustness when shutting down or recovering the PCIe core. Therefore, its inclusion is justified despite the minor ABI change. Signed-off-by: Ziyue Zhang Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring (Arm) Reviewed-by: Johan Hovold Link: https://patch.msgid.link/20250718081718.390790-3-ziyue.zhang@oss.qualcomm.com commit 51e78d97e7bf553c03f47d2c5e9650a1e18f78e7 Author: Rob Herring (Arm) Date: Thu Jul 10 13:08:42 2025 -0500 dt-bindings: PCI: Remove 83xx-512x-pci.txt This binding is already covered by fsl,mpc8xxx-pci.yaml schema. While the MPC512x is mentioned here, its compatible strings aren't actually documented and remain that way. Signed-off-by: Rob Herring (Arm) Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250710180843.2971667-1-robh@kernel.org commit bf9d32f203a23950917d2949c812b89bcb8a0340 Author: Rob Herring (Arm) Date: Thu Jul 10 13:08:23 2025 -0500 dt-bindings: PCI: Convert amazon,al-alpine-v[23]-pcie to DT schema Convert the Amazon Alpine PCIe binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250710180825.2971248-1-robh@kernel.org commit 9e71c41469391c14f8dc5e6242f0d0ed89ce8978 Author: Rob Herring (Arm) Date: Thu Jul 10 13:08:05 2025 -0500 dt-bindings: PCI: Convert marvell,armada-3700-pcie to DT schema Convert the Marvell Armada 3700 PCIe binding to DT schema format. The 'clocks' property was missing and has been added. Signed-off-by: Rob Herring (Arm) Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250710180811.2970846-1-robh@kernel.org commit f6b5ad2c6c10bea11b8e22cfb9732238f921579a Author: Rob Herring (Arm) Date: Thu Jul 10 13:07:48 2025 -0500 dt-bindings: PCI: Convert apm,xgene-pcie to DT schema Convert the Applied Micro X-Gene PCIe binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250710180749.2970379-1-robh@kernel.org commit 5c2796adb127c6569e14afab8f18f8bc8db58fb1 Author: Rob Herring (Arm) Date: Thu Jul 10 13:07:40 2025 -0500 dt-bindings: PCI: Convert axis,artpec6-pcie to DT schema Convert the Axis ARTPEC-6/7 PCIe binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250710180741.2970148-1-robh@kernel.org commit 709580086fbba45c1796c28bab8b4a27887ee32d Author: Rob Herring (Arm) Date: Thu Jul 10 13:07:30 2025 -0500 dt-bindings: PCI: Convert st,spear1340-pcie to DT schema Convert the ST SPEAr1340 PCIe binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) [mani: added the license] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250710180731.2969879-1-robh@kernel.org commit 6531a2cf07ef156956840853692755cc7e1621b7 Merge: bb9ddd99a76b71 f62408efc8669b Author: Dave Airlie Date: Fri Aug 1 07:09:11 2025 +1000 Merge tag 'drm-xe-next-fixes-2025-07-31' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next - Fix BMG probe on unsupported mailbox command (Raag) - Fix OA static checker warning about null gt (Ashutosh) - Fix a NULL vs IS_ERR() bug in xe_i2c_register_adapter (Dan) - Fix missing unwind goto in GuC/HuC (Zhanjun) - Don't register I2C devices if VF (Lukasz) - Clear whole GuC g2h_fence during initialization (Michal) - Avoid call kfree for drmm_kzalloc (Shuicheng) - Fix pci_dev reference leak on configfs (Michal) - SRIOV: Disable CSC support on VF (Lukasz) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aIvIAANnXv-j_bNA@intel.com commit fad6551fcf537375702b9af012508156a16a1ff7 Author: Christoph Hellwig Date: Thu Jul 31 08:22:28 2025 -0700 block: ensure discard_granularity is zero when discard is not supported Documentation/ABI/stable/sysfs-block states: What: /sys/block//queue/discard_granularity [...] A discard_granularity of 0 means that the device does not support discard functionality. but this got broken when sorting out the block limits updates. Fix this by setting the discard_granularity limit to zero when the combined max_discard_sectors is zero. Fixes: 3c407dc723bb ("block: default the discard granularity to sector size") Signed-off-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250731152228.873923-1-hch@lst.de Signed-off-by: Jens Axboe commit 765761851d89c772f482494d452e266795460278 Author: Shin'ichiro Kawasaki Date: Thu Jul 31 20:07:45 2025 +0900 zloop: fix KASAN use-after-free of tag set When a zoned loop device, or zloop device, is removed, KASAN enabled kernel reports "BUG KASAN use-after-free" in blk_mq_free_tag_set(). The BUG happens because zloop_ctl_remove() calls put_disk(), which invokes zloop_free_disk(). The zloop_free_disk() frees the memory allocated for the zlo pointer. However, after the memory is freed, zloop_ctl_remove() calls blk_mq_free_tag_set(&zlo->tag_set), which accesses the freed zlo. Hence the KASAN use-after-free. zloop_ctl_remove() put_disk(zlo->disk) put_device() kobject_put() ... zloop_free_disk() kvfree(zlo) blk_mq_free_tag_set(&zlo->tag_set) To avoid the BUG, move the call to blk_mq_free_tag_set(&zlo->tag_set) from zloop_ctl_remove() into zloop_free_disk(). This ensures that the tag_set is freed before the call to kvfree(zlo). Fixes: eb0570c7df23 ("block: new zoned loop block device driver") CC: stable@vger.kernel.org Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250731110745.165751-1-shinichiro.kawasaki@wdc.com Signed-off-by: Jens Axboe commit e2ba58ccc9099514380c3300cbc0750b5055fc1c Author: Guenter Roeck Date: Wed Jul 30 21:49:53 2025 -0700 block: Fix default IO priority if there is no IO context Upstream commit 53889bcaf536 ("block: make __get_task_ioprio() easier to read") changes the IO priority returned to the caller if no IO context is defined for the task. Prior to this commit, the returned IO priority was determined by task_nice_ioclass() and task_nice_ioprio(). Now it is always IOPRIO_DEFAULT, which translates to IOPRIO_CLASS_NONE with priority 0. However, task_nice_ioclass() returns IOPRIO_CLASS_IDLE, IOPRIO_CLASS_RT, or IOPRIO_CLASS_BE depending on the task scheduling policy, and task_nice_ioprio() returns a value determined by task_nice(). This causes regressions in test code checking the IO priority and class of IO operations on tasks with no IO context. Fix the problem by returning the IO priority calculated from task_nice_ioclass() and task_nice_ioprio() if no IO context is defined to match earlier behavior. Fixes: 53889bcaf536 ("block: make __get_task_ioprio() easier to read") Cc: Jens Axboe Cc: Bart Van Assche Signed-off-by: Guenter Roeck Reviewed-by: Yu Kuai Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20250731044953.1852690-1-linux@roeck-us.net Signed-off-by: Jens Axboe commit c62f87e2b1892fc35ed45597101586e27f70b076 Merge: ddb7a62af2e766 9671854582f971 Author: Jiri Kosina Date: Thu Jul 31 22:54:15 2025 +0200 Merge branch 'for-6.17/uclogic' into for-linus - support for XP-PEN Artist 22R Pro (Joshua Goins) commit ddb7a62af2e766eabb4ab7080e6ed8d6b8915302 Merge: 4859d6f8a54b0e 1aee3a44fad2ad Author: Jiri Kosina Date: Thu Jul 31 22:53:29 2025 +0200 Merge branch 'for-6.17/selftests' into for-linus - upgrade the python scripts in hid-selftests to match hid-tools version 0.10 (Benjamin Tissoires) commit 4859d6f8a54b0e654391da1b70acf13201b4bad8 Merge: bfc7f7b6c1b852 703e55aacbf73d Author: Jiri Kosina Date: Thu Jul 31 22:52:12 2025 +0200 Merge branch 'for-6.17/pidff' into for-linus - bunch of checkpatch fixes for hid-pidff (Tomasz Pakuła) commit bfc7f7b6c1b852c61ad3412d331de4c6ac29dfbe Merge: b46d740fbe9f19 2c31ec923c3232 Author: Jiri Kosina Date: Thu Jul 31 22:51:29 2025 +0200 Merge branch 'for-6.17/multitouch' into for-linus - support for Touch Bars on x86 MacBook Pros (Kerem Karabay) commit b46d740fbe9f19aeab8e3a93139ab7ec1351f00f Merge: 41a6f0e3cd3ef0 a5db1591d0829b Author: Jiri Kosina Date: Thu Jul 31 22:49:19 2025 +0200 Merge branch 'for-6.17/mcp2221' into for-linus - fix for behavior of the hid-mcp2221 driver for !CONFIG_IIO cases (Heiko Schocher) commit 41a6f0e3cd3ef0a288ce260487e4b76d9515e43d Merge: bfb0195705f235 7852beb143509d Author: Jiri Kosina Date: Thu Jul 31 22:47:14 2025 +0200 Merge branch 'for-6.17/intel-thc' into for-linus - support for Wake-on-touch in intel-thc (Even Xu) - support for "Input max input size control" and "Input interrupt delay" I2C features in order to improve compatibility of THC devices with legacy HIDI2C touch devices (Even Xu) commit bfb0195705f23568b77744cefc1cb81fd7a94d59 Merge: 069e79a08103c6 a6b87bfc2ab5bc Author: Jiri Kosina Date: Thu Jul 31 22:43:21 2025 +0200 Merge branch 'for-6.17/core' into for-linus - hardening of HID core parser against conversion to 0 bits in s32ton() by buggy/malicious devices (Alan Stern) commit cbbf0a759ff96c80dfc32192a2cc427b79447f74 Merge: 2d945dde7fa3f1 9cf9db888f3878 Author: Linus Torvalds Date: Thu Jul 31 13:43:02 2025 -0700 Merge tag 'mtd/for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull mtd updates from Miquel Raynal: "MTD changes: - Apart from a binding conversion to yaml, only minor changes/small fixes have been merged. Raw NAND changes: - Minor fixes for various controller drivers like DMA mapping checks, better timing derivations or bitflip statistics. - some Hynix NAND flashes were not supporting read-retries, so don't even try to do it SPI NAND changes: - In order to support high-speed modes, certain chips need extra configuration like adding more dummy cycles. This is now possible, especially on Winbond chips. - Aside from that, Gigadevice gets support for a new chip (GD5F1GM9). SPI NOR changes: - A notable changes is the fix for exiting 4-byte addressing on Infineon SEMPER flashes. These flashes do not support the standard EX4B opcode (E9h), and use a vendor-specific opcode (B8h) instead. - There is also a fix for unlocking flashes that are write-protected at power-on. This was caused by using an uninitialized mtd_info in spi_nor_try_unlock_all()" * tag 'mtd/for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (26 commits) mtd: spinand: winbond: Add comment about the maximum frequency mtd: spinand: winbond: Enable high-speed modes on w35n0xjw mtd: spinand: winbond: Enable high-speed modes on w25n0xjw mtd: spinand: Add a ->configure_chip() hook mtd: spinand: Add a frequency field to all READ_FROM_CACHE variants mtd: spinand: Fix macro alignment spi: spi-mem: Take into account the actual maximum frequency spi: spi-mem: Use picoseconds for calculating the op durations mtd: rawnand: atmel: set pmecc data setup time mtd: spinand: propagate spinand_wait() errors from spinand_write_page() mtd: rawnand: fsmc: Add missing check after DMA map mtd: rawnand: rockchip: Add missing check after DMA map mtd: rawnand: hynix: don't try read-retry on SLC NANDs mtd: rawnand: atmel: Fix dma_mapping_error() address mtd: nand: brcmnand: fix mtd corrected bits stat mtd: rawnand: renesas: Add missing check after DMA map mtd: spinand: gigadevice: Add support for GD5F1GM9 chips mtd: nand: brcmnand: replace manual string choices with standard helpers mtd: map: Don't use "proxy" headers mtd: spi-nor: Fix spi_nor_try_unlock_all() ... commit 069e79a08103c684d31b638cbed82fcc3ac0fad3 Merge: 96ba894dc209cf 230cdd8a5f4bc7 Author: Jiri Kosina Date: Thu Jul 31 22:42:08 2025 +0200 Merge branch 'for-6.17/battery-timer-fixes' into for-linus - avoid setting up battery timer for Apple and Magicmouse devices without battery (Aditya Garg) commit 96ba894dc209cf833abc2ccdca2dc0ad5f01eefe Merge: e9ef810dfee7a2 1bb3363da862e0 Author: Jiri Kosina Date: Thu Jul 31 22:37:59 2025 +0200 Merge branch 'for-6.17/apple' into for-linus - fix for potential NULL pointer dereference in hid-apple that could be caused by malicious device with APPLE_MAGIC_BACKLIGHT quirk present triggering overflow in data field (Qasim Ijaz) - third party trackpart support for MacBookPro15,1 (Aditya Garg) - Apple Magic Keyboard A311[89] USB-C support (Aditya Garg, Grigorii Sokolik) commit 2d945dde7fa3f17f46349360a9f97614de9f47da Merge: be413ec746afc9 64c21f253a3737 Author: Linus Torvalds Date: Thu Jul 31 13:36:27 2025 -0700 Merge tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux Pull clk updates from Stephen Boyd: "This is the usual collection of primarily clk driver updates. The big part of the diff is all the new Qualcomm clk drivers added for a few SoCs they're working on. The other two vendors with significant work this cycle are Renesas and Amlogic. Renesas adds a bunch of clks to existing drivers and supports some new SoCs while Amlogic is starting a significant refactoring to simplify their code. The core framework gained a pair of helpers to get the 'struct device' or 'struct device_node' associated with a 'struct clk_hw'. Some associated KUnit tests were added for these simple helpers as well. Beyond that core change there are lots of little fixes throughout the clk drivers for the stuff we see every day, wrong clk driver data that affects tree topology or supported frequencies, etc. They're not found until the clks are actually used by some consumer device driver. New Drivers: - Global, display, gpu, video, camera, tcsr, and rpmh clock controller for the Qualcomm Milos SoC - Camera, display, GPU, and video clock controllers for Qualcomm QCS615 - Video clock controller driver for Qualcomm SM6350 - Camera clock controller driver for Qualcomm SC8180X - I3C clocks and resets on Renesas RZ/G3E - Expanded Serial Peripheral Interface (xSPI) clocks and resets on Renesas RZ/V2H(P) and RZ/V2N - SPI (RSPI) clocks and resets on Renesas RZ/V2H(P) - SDHI and I2C clocks on Renesas RZ/T2H and RZ/N2H - Ethernet clocks and resets on Renesas RZ/G3E - Initial support for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs - Ethernet clocks and resets on Renesas RZ/V2H and RZ/V2N - Timer, I2C, watchdog, GPU, and USB2.0 clocks and resets on Renesas RZ/V2N Updates: - Support atomic PWMs in the PWM clk driver - clk_hw_get_dev() and clk_hw_get_of_node() helpers - Replace round_rate() with determine_rate() in various clk drivers - Convert clk DT bindings to DT schema format for DT validation - Various clk driver cleanups and refactorings from static analysis tools and possibly real humans - A lot of little fixes here and there to things like clk tree topology, missing frequencies, flagging clks as critical, etc" * tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (216 commits) clk: clocking-wizard: Fix the round rate handling for versal clk: Fix typos clk: spacemit: ccu_pll: fix error return value in recalc_rate callback clk: tegra: periph: Make tegra_clk_periph_ops static clk: tegra: periph: Fix error handling and resolve unsigned compare warning clk: imx: scu: convert from round_rate() to determine_rate() clk: imx: pllv4: convert from round_rate() to determine_rate() clk: imx: pllv3: convert from round_rate() to determine_rate() clk: imx: pllv2: convert from round_rate() to determine_rate() clk: imx: pll14xx: convert from round_rate() to determine_rate() clk: imx: pfd: convert from round_rate() to determine_rate() clk: imx: frac-pll: convert from round_rate() to determine_rate() clk: imx: fracn-gppll: convert from round_rate() to determine_rate() clk: imx: fixup-div: convert from round_rate() to determine_rate() clk: imx: cpu: convert from round_rate() to determine_rate() clk: imx: busy: convert from round_rate() to determine_rate() clk: imx: composite-93: remove round_rate() in favor of determine_rate() clk: imx: composite-8m: remove round_rate() in favor of determine_rate() clk: qcom: Remove redundant pm_runtime_mark_last_busy() calls clk: imx: Remove redundant pm_runtime_mark_last_busy() calls ... commit e9ef810dfee7a2227da9d423aecb0ced35faddbe Merge: 3a1d22bd85381c 3a807f3ff9eaae Author: Jiri Kosina Date: Thu Jul 31 22:36:25 2025 +0200 Merge branch 'for-6.17/amd-sfh' into for-linus - add support for operating modes (Basavaraj Natikar) commit be413ec746afc951c79d5907cf62ab6757330bdb Merge: 602a0672869499 de1fffd88600c5 Author: Linus Torvalds Date: Thu Jul 31 13:34:06 2025 -0700 Merge tag 'hwmon-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon updates from Guenter Roeck: "Updated chip support in existing drivers: - ina238: Support for INA228 - pmbus/tps53679: Support for TPS53685 - pmbus/adp1050: Support for adp1051, adp1055 and ltp8800 - corsair-psu: Support for HX1200i Series 2025 - pmbus/isl68137: Support for RAA229621 - asus-ec-sensors: Support for ProArt X870E-CREATOR WIFI and Other notable changes: - adt7475: Support for #pwm-cells = <3> - amc6821: Cooling device support - emc2305: Support for PWM frequency, polarity and output - Add missing compatible entries to various devicetree bindings And various other minor fixes and improvements" * tag 'hwmon-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (34 commits) dt-bindings: hwmon: Replace bouncing Alexandru Tachici emails hwmon: (ina238) Add support for INA228 dt-bindings: Add INA228 to ina2xx devicetree bindings hwmon: (ina238) Fix inconsistent whitespace dt-bindings: hwmon: adt7475: Allow and recommend #pwm-cells = <3> hwmon: (adt7475) Implement support for #pwm-cells = <3> hwmon: (pmbus/tps53679) Add support for TPS53685 dt-bindings: trivial: Add tps53685 support hwmon: (pmbus/adp1050) Add regulator support for ltp8800 hwmon: (pmbus/adp1050) Add support for adp1051, adp1055 and ltp8800 dt-bindings: hwmon: pmbus/adp1050: Add adp1051, adp1055 and ltp8800 hwmon: (max31827) use sysfs_emit() in temp1_resolution_show() hwmon: (ltc4282) convert from round_rate() to determine_rate() hwmon: (corsair-psu) add support for HX1200i Series 2025 dt-bindings: hwmon: pmbus: ti,ucd90320: Add missing compatibles dt-bindings: hwmon: maxim,max20730: Add maxim,max20710 compatible dt-bindings: hwmon: lltc,ltc2978: Add lltc,ltc713 compatible dt-bindings: hwmon: ti,lm87: Add adi,adm1024 compatible dt-bindings: hwmon: national,lm90: Add missing Dallas max6654 and onsemi nct72, nct214, and nct218 hwmon: (w83627ehf) make the read-only arrays 'bit' static const ... commit 602a0672869499fefa31b7f1e22f9d32c35fc7fe Merge: 924740496b6c51 65c6f742ab14ab Author: Linus Torvalds Date: Thu Jul 31 13:27:00 2025 -0700 Merge tag 'pwm/for-6.17-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm fixes from Uwe Kleine-König: "Two fixes for the mediatek and the imx-tpm driver. Both are old (v4.12-rc1 and v5.2-rc1 respectively). The mediatek issue is that both period and duty_cycle were configured to higher values than requested. For most applications the period part is no tragedy, but a PWM that is configured for duty_cycle = 0 should really emit a constant inactive signal. That was noticed by an LED not being completely off in this case (two commits for one fix: a preparatory one and the actual fix in the second one). For the imx-tpm PWM driver the fixed issue is that the first period is quite a bit too long under some circumstances. So it might take up to UINT32_MAX << 7 clock ticks until the PWM starts toggling. With an assumed input clock rate of 166 MHz (completely made up) that's 55 minutes" * tag 'pwm/for-6.17-rc1-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: pwm: imx-tpm: Reset counter if CMOD is 0 pwm: mediatek: Fix duty and period setting pwm: mediatek: Handle hardware enable and clock enable separately commit 924740496b6c51d4be235f2b169fe93635c0fcee Author: Miguel Ojeda Date: Thu Jul 31 21:41:37 2025 +0200 gpu: nova-core: fix up formatting after merge In the merge 260f6f4fda93 ("Merge tag 'drm-next-2025-07-30' of https://gitlab.freedesktop.org/drm/kernel"), the formatting in the conflict resolution doesn't match what `make rustfmt` wants to make it. Fix it up appropriately. Signed-off-by: Miguel Ojeda Signed-off-by: Linus Torvalds commit 0cdee263bc5e7b20f657ea09f9272f50c568f35b Merge: 27152608dab9af d968e50b5c2664 Author: Linus Torvalds Date: Thu Jul 31 13:16:09 2025 -0700 Merge tag 'media/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media updates from Mauro Carvalho Chehab: - v4l2 core: - sub-device framework routing improvements - NV12M tiled variants added to v4l2_format_info - some fixes at control handler freeing logic - fixed H264 SEPARATE_COLOUR_PLANE check - new staging driver: Intel IPU7 PCI - Rockchip video decoder driver got promoted from staging - iris: added HEVC/VP9 encoder/decoder support - vsp1: driver has gained Renesas VSPX support - uvc: - switched to vb2 ioctl helpers - added MSXU 1.5 metadata support - atomisp: GC0310 sensor driver cleanups in preparation for moving it out of staging - Lots of cleanup, fixes and improvements * tag 'media/v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (310 commits) media: rkvdec: Unstage the driver media: rkvdec: Remove TODO file media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings media: amphion: Support dmabuf and v4l2 buffer without binding media: verisilicon: postproc: 4K support media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() media: uvcvideo: Use a count variable for meta_formats instead of 0 terminating media: uvcvideo: Auto-set UVC_QUIRK_MSXU_META media: uvcvideo: Introduce V4L2_META_FMT_UVC_MSXU_1_5 media: uvcvideo: Introduce dev->meta_formats media: Documentation: Add note about UVCH length field media: uvcvideo: Do not mark valid metadata as invalid media: uvcvideo: uvc_v4l2_unlocked_ioctl: Invert PM logic media: core: export v4l2_translate_cmd media: uvcvideo: Turn on the camera if V4L2_EVENT_SUB_FL_SEND_INITIAL media: uvcvideo: Remove stream->is_streaming field media: uvcvideo: Split uvc_stop_streaming() media: uvcvideo: Handle locks in uvc_queue_return_buffers media: uvcvideo: Use vb2 ioctl and fop helpers ... commit bb9ddd99a76b71382b2b4fb10c4394cbd8ce7b7b Merge: 711fa2667d8b23 a0b34e4c8663b1 Author: Dave Airlie Date: Fri Aug 1 06:15:58 2025 +1000 Merge tag 'amd-drm-fixes-6.17-2025-07-31' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-fixes-6.17-2025-07-31: amdgpu: - DSC divide by 0 fix - clang fix - DC debugfs fix - Userq fixes - Avoid extra evict-restore with KFD - Backlight fix - Documentation fix - RAS fix - Add new kicker handling - DSC fix for DCN 3.1.4 - PSR fix - Atomic fix - DC reset fixes - DCN 3.0.1 fix - MMHUB client mapping fix Signed-off-by: Dave Airlie From: Alex Deucher Link: https://lore.kernel.org/r/20250731191916.255648-1-alexander.deucher@amd.com commit 27152608dab9afe748d6b5fc3437a1831dac77c7 Merge: c93529ad4fa8d8 9f97e61bde6a91 Author: Linus Torvalds Date: Thu Jul 31 13:05:44 2025 -0700 Merge tag 'libnvdimm-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm Pull libnvdimm updates from Ira Weiny: "Header file cleanups. Specifically use specific headers rather than just kernel.h in libnvdimm.h to reduce header file usage. The second patch is a fix to CXL but is going through my tree as a libnvdimm patch caused the issue" * tag 'libnvdimm-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm: cxl: Include range.h in cxl.h libnvdimm: Don't use "proxy" headers commit c93529ad4fa8d8d8cb21649e70a46991a1dda0f8 Merge: 7ce4de1cdaf11c 2c78e74493d33b Author: Linus Torvalds Date: Thu Jul 31 12:43:08 2025 -0700 Merge tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd Pull iommufd updates from Jason Gunthorpe: "This broadly brings the assigned HW command queue support to iommufd. This feature is used to improve SVA performance in VMs by avoiding paravirtualization traps during SVA invalidations. Along the way I think some of the core logic is in a much better state to support future driver backed features. Summary: - IOMMU HW now has features to directly assign HW command queues to a guest VM. In this mode the command queue operates on a limited set of invalidation commands that are suitable for improving guest invalidation performance and easy for the HW to virtualize. This brings the generic infrastructure to allow IOMMU drivers to expose such command queues through the iommufd uAPI, mmap the doorbell pages, and get the guest physical range for the command queue ring itself. - An implementation for the NVIDIA SMMUv3 extension "cmdqv" is built on the new iommufd command queue features. It works with the existing SMMU driver support for cmdqv in guest VMs. - Many precursor cleanups and improvements to support the above cleanly, changes to the general ioctl and object helpers, driver support for VDEVICE, and mmap pgoff cookie infrastructure. - Sequence VDEVICE destruction to always happen before VFIO device destruction. When using the above type features, and also in future confidential compute, the internal virtual device representation becomes linked to HW or CC TSM configuration and objects. If a VFIO device is removed from iommufd those HW objects should also be cleaned up to prevent a sort of UAF. This became important now that we have HW backing the VDEVICE. - Fix one syzkaller found error related to math overflows during iova allocation" * tag 'for-linus-iommufd' of git://git.kernel.org/pub/scm/linux/kernel/git/jgg/iommufd: (57 commits) iommu/arm-smmu-v3: Replace vsmmu_size/type with get_viommu_size iommu/arm-smmu-v3: Do not bother impl_ops if IOMMU_VIOMMU_TYPE_ARM_SMMUV3 iommufd: Rename some shortterm-related identifiers iommufd/selftest: Add coverage for vdevice tombstone iommufd/selftest: Explicitly skip tests for inapplicable variant iommufd/vdevice: Remove struct device reference from struct vdevice iommufd: Destroy vdevice on idevice destroy iommufd: Add a pre_destroy() op for objects iommufd: Add iommufd_object_tombstone_user() helper iommufd/viommu: Roll back to use iommufd_object_alloc() for vdevice iommufd/selftest: Test reserved regions near ULONG_MAX iommufd: Prevent ALIGN() overflow iommu/tegra241-cmdqv: import IOMMUFD module namespace iommufd: Do not allow _iommufd_object_alloc_ucmd if abort op is set iommu/tegra241-cmdqv: Add IOMMU_VEVENTQ_TYPE_TEGRA241_CMDQV support iommu/tegra241-cmdqv: Add user-space use support iommu/tegra241-cmdqv: Do not statically map LVCMDQs iommu/tegra241-cmdqv: Simplify deinit flow in tegra241_cmdqv_remove_vintf() iommu/tegra241-cmdqv: Use request_threaded_irq iommu/arm-smmu-v3-iommufd: Add hw_info to impl_ops ... commit 7ce4de1cdaf11c39b507008dfb5a4e59079d4e8a Merge: 2c8c9aae4492f8 ee235923d205c6 Author: Linus Torvalds Date: Thu Jul 31 12:19:55 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma Pull rdma updates from Jason Gunthorpe: - Various minor code cleanups and fixes for hns, iser, cxgb4, hfi1, rxe, erdma, mana_ib - Prefetch supprot for rxe ODP - Remove memory window support from hns as new device FW is no longer support it - Remove qib, it is very old and obsolete now, Cornelis wishes to restructure the hfi1/qib shared layer - Fix a race in destroying CQs where we can still end up with work running because the work is cancled before the driver stops triggering it - Improve interaction with namespaces: * Follow the devlink namespace for newly spawned RDMA devices * Create iopoib net devces in the parent IB device's namespace * Allow CAP_NET_RAW checks to pass in user namespaces - A new flow control scheme for IB MADs to try and avoid queue overflows in the network - Fix 2G message sizes in bnxt_re - Optimize mkey layout for mlx5 DMABUF - New "DMA Handle" concept to allow controlling PCI TPH and steering tags * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma: (71 commits) RDMA/siw: Change maintainer email address RDMA/mana_ib: add support of multiple ports RDMA/mlx5: Refactor optional counters steering code RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr IB: Extend UVERBS_METHOD_REG_MR to get DMAH RDMA/mlx5: Add DMAH object support RDMA/core: Introduce a DMAH object and its alloc/free APIs IB/core: Add UVERBS_METHOD_REG_MR on the MR object net/mlx5: Add support for device steering tag net/mlx5: Expose IFC bits for TPH PCI/TPH: Expose pcie_tph_get_st_table_size() RDMA/mlx5: Fix incorrect MKEY masking RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() RDMA/mlx5: remove redundant check on err on return expression RDMA/mana_ib: add additional port counters RDMA/mana_ib: Fix DSCP value in modify QP RDMA/efa: Add CQ with external memory support RDMA/core: Add umem "is_contiguous" and "start_dma_addr" helpers RDMA/uverbs: Add a common way to create CQ with umem RDMA/mlx5: Optimize DMABUF mkey page size ... commit 2c8c9aae4492f813b9b9ae95f0931945a693100e Merge: 831462ff3ec61f 3ea3a256ed81f9 Author: Linus Torvalds Date: Thu Jul 31 12:13:53 2025 -0700 Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI updates from James Bottomley: "Smaller set of driver updates than usual (ufs, lpfc, mpi3mr). The rest (including the core file changes) are doc updates and some minor bug fixes" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (49 commits) scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated scsi: scsi_transport_fc: Add comments to describe added 'rport' parameter scsi: bfa: Double-free fix scsi: isci: Fix dma_unmap_sg() nents value scsi: mvsas: Fix dma_unmap_sg() nents value scsi: elx: efct: Fix dma_unmap_sg() nents value scsi: scsi_transport_fc: Change to use per-rport devloss_work_q scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE scsi: core: Fix kernel doc for scsi_track_queue_full() scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value scsi: ibmvscsi_tgt: Fix typo in comment scsi: mpi3mr: Update driver version to 8.14.0.5.50 scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers scsi: mpi3mr: Fix race between config read submit and interrupt completion scsi: ufs: ufs-qcom: Enable QUnipro Internal Clock Gating scsi: ufs: core: Add ufshcd_dme_rmw() to modify DME attributes scsi: ufs: ufs-qcom: Update esi_vec_mask for HW major version >= 6 scsi: core: Use scsi_cmd_priv() instead of open-coding it scsi: qla2xxx: Remove firmware URL ... commit 831462ff3ec61fd2e6726b534a351a1a722bf2ab Merge: 24e5c3241ab643 4903924ac7ef31 Author: Linus Torvalds Date: Thu Jul 31 11:54:01 2025 -0700 Merge tag 'leds-next-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds Pull LED updates from Lee Jones: "Improvements & Fixes: - A fix for QCOM Flash to prevent incorrect register access when the driver is re-bound. This is solved by duplicating a static register array during the probe function, which prevents register addresses from being miscalculated after multiple binds - The LP50xx driver now correctly handles the 'reg' property in device tree child nodes to ensure the multi_index is set correctly. This prevents issues where LEDs could be controlled incorrectly if the device tree nodes were processed in a different order. An error is returned if the reg property is missing or out of range - Add a Kconfig dependency on between TPS6131x and V4L2_FLASH_LED_CLASS to prevent a build failure when the driver is built-in and the V4L2 flash infrastructure is a loadable module - Fix a potential buffer overflow warning in PCA955x reported by older GCC versions by using a more precise format specifier when creating the default LED label. Cleanups & Refactoring: - Correct the MAINTAINERS file entry for the TPS6131X flash LED driver to point to the correct device tree binding file name - Fix a comment in the Flash Class for the flash_timeout setter to "flash timeout" from "flash duration" for accuracy - The of_led_get() function is no longer exported as it has no users outside of its own module. Removals: - Revert the commit to configure LED blink intervals for hardware offload in the Netdev Trigger. This change was found to break existing PHY drivers by putting their LEDs into a permanent, unconditional blinking state. Device Tree Bindings Updates: - Update the binding for LP50xx to document that the child reg property is the index within the LED bank. The example was also updated to use correct values - Update the JNCP5623 binding to add 0x39 as a valid I2C address, as it is used by the NCP5623C variant" * tag 'leds-next-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/leds: dt-bindings: leds: ncp5623: Add 0x39 as a valid I2C address Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" leds: pca955x: Avoid potential overflow when filling default_label (take 2) leds: Unexport of_led_get() leds: tps6131x: Add V4L2_FLASH_LED_CLASS dependency dt-bindings: leds: lp50xx: Document child reg, fix example leds: leds-lp50xx: Handle reg to get correct multi_index leds: led-class-flash:: Fix flash_timeout comment MAINTAINERS: Adjust file entry in TPS6131X FLASH LED DRIVER leds: flash: leds-qcom-flash: Fix registry access after re-bind commit 24e5c3241ab643b133717c34d1f4c78349774cc1 Merge: cfc6d74523efdd 006aa8f57f55dd Author: Linus Torvalds Date: Thu Jul 31 11:50:25 2025 -0700 Merge tag 'mfd-next-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd Pull MFD updates from Lee Jones: "New Support & Features: - Add extensive support for the Analog Devices ADP5589 I/O expander, including core MFD, GPIO, PWM, and a new keypad matrix input driver. This also adds support for handling various events including GPI, keypad, reset and unlock ev ents - Add support for the TI TPS652G1 PMIC, a stripped-down version of the TPS65224, including core MFD, PFSM, pinctrl, and GPIO support - Add support for the Apple Silicon System Management Controller (SMC), including the core MFD driver which handles the RTKit-based protocol, a new GPIO driver for PMU GPIOs, and a new reboot/power-off driver. Improvements & Fixes: - Dynamically add ADP5585 sub-devices based on device tree properties - Move ADP5585 oscillator control from the child PWM driver to the main MFD driver to better handle shared resources - Add support for a hardware reset pin and VDD regulator to the ADP5585 driver - Update the TPS65219 MFD cell's GPIO compatible string for the TPS65214 to reflect hardware capabilities correctly - Separate the ChromeOS EC charge-control probing from the USB-PD subsystem, allowing it to probe independently based on the dedicated EC_FEATURE_CHARGER - Fix an interrupt naming typo in the MT6370 driver - Fix RK806 PMIC reset behavior by allowing the reset mode to be customized via a new device tree property - Fix AXP20X regulator cell ID conflicts for secondary PMICs on boards without an IRQ line connected - Fix MT6397 keypad sub-device creation to use specific names instead of a generic one, ensuring correct driver binding - Fix a build warning in the stm32-timers driver by adding a missing include for export.h. Cleanups & Refactoring: - Refactor the ADP5585 driver to simplify how regmap defaults are handled, making it easier to add new chip variants - Introduce per-chip register map structures for the ADP5585/ADP5589 family to handle differences between the devices - Convert several drivers to use dev_fwnode() instead of of_fwnode_handle() - Make various static structures const in the cs40l50, rohm-bd71828, tps65219, and twl6040 drivers - Remove redundant pm_runtime_mark_last_busy() calls from several drivers - Alphabetize Kconfig entries for Cirrus Logic and Maxim drivers - Remove unused fields from the 'tps65219' struct - Update several MFD-related headers to follow the 'Include What You Use' (IWYU) principle. Removals: - Remove the old, platform-data-based adp5589-keys input driver, which is now superseded by the new MFD-based adp5585-keys driver - Remove the unused twl6030_mmc_card_detect() functions and associated header declarations - Remove the now unused pcf50633/core.h header file - Remove the fsl,imx8qxp-csr device tree binding, which was being used incorrectly. Device Tree Bindings Updates: - Add support for the Analog Devices ADP5589 I/O expander to the adi,adp5585.yaml binding - Add new properties to the adi,adp5585.yaml binding for input events, including keypad pins, unlock events, and reset events - Add a reset-gpios property to the adi,adp5585.yaml binding - Add the TI TPS652G1 PMIC to the ti,tps6594.yaml binding - Add new bindings for the Apple Mac System Management Controller (SMC) and its sub-devices: apple,smc.yaml, apple,smc-gpio.yaml, and apple,smc-reboot.yaml - Convert the Freescale MXS LRADC binding (mxs-lradc) to YAML schema format - Convert and combine the NXP LPC1850 CREG, DMAMUX, and USB OTG PHY bindings into a single YAML schema file - Convert the TI TPS65910 binding to YAML schema format - Add a comment to the samsung,s2mps11.yaml binding to clarify the use of 'oneOf' for interrupt properties - Add the rockchip,reset-mode property to the rockchip,rk806.yaml binding to allow customization of the PMIC's reset behavior" * tag 'mfd-next-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd: (28 commits) mfd: dt-bindings: Convert TPS65910 to DT schema mfd: Minor Cirrus/Maxim Kconfig order fixes mfd: Remove redundant pm_runtime_mark_last_busy() calls mfd: mt6397: Do not use generic name for keypad sub-devices mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present mfd: mt6370: Fix the interrupt naming typo mfd: rk8xx-core: Allow to customize RK806 reset mode dt-bindings: mfd: rk806: Allow to customize PMIC reset mode mfd: syscon: atmel-smc: Don't use "proxy" headers mfd: madera: Don't use "proxy" headers mfd: wm8350-core: Don't use "proxy" headers dt-bindings: mfd: samsung,s2mps11: Add comment about interrupts properties mfd: davinci_voicecodec: Don't use "proxy" headers mfd: pcf50633: Remove the header file core.h mfd: tps65219: Remove another unused field from 'struct tps65219' mfd: tps65219: Remove an unused field from 'struct tps65219' mfd: tps65219: Constify struct regmap_irq_sub_irq_map and tps65219_chip_data mfd: rohm-bd71828: Constify some structures dt-bindings: mfd: fsl,imx8qxp-csr: Remove binding documentation mfd: axp20x: Set explicit ID for AXP313 regulator ... commit cfc6d74523efdd36f5757927ac1c75629a6d8491 Merge: 02523d2d93b9c8 e326371f3002db Author: Linus Torvalds Date: Thu Jul 31 11:46:02 2025 -0700 Merge tag 'gnss-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/gnss Pull GNSS update from Johan Hovold: "Here is a GNSS update adding a compatible string for a new u-blox receiver" * tag 'gnss-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/johan/gnss: dt-bindings: gnss: u-blox: add u-blox,neo-9m compatible commit 02523d2d93b9c825dadc0f93cf77c1622cd64a86 Merge: 12ed593ee88170 aa9bb1b32594cd Author: Linus Torvalds Date: Thu Jul 31 11:42:11 2025 -0700 Merge tag 'integrity-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity Pull integrity update from Mimi Zohar: "A single commit to permit disabling IMA from the boot command line for just the kdump kernel. The exception itself sort of makes sense. My concern is that exceptions do not remain as exceptions, but somehow morph to become the norm" * tag 'integrity-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: ima: add a knob ima= to allow disabling IMA in kdump kernel commit 13cb75730b7a8b2dc8fe32874e159b2c7b75efde Author: Achill Gilgenast Date: Tue Jul 29 11:45:53 2025 +0200 libbpf: Avoid possible use of uninitialized mod_len Though mod_len is only read when mod_name != NULL and both are initialized together, gcc15 produces a warning with -Werror=maybe-uninitialized: libbpf.c: In function 'find_kernel_btf_id.constprop': libbpf.c:10100:33: error: 'mod_len' may be used uninitialized [-Werror=maybe-uninitialized] 10100 | if (mod_name && strncmp(mod->name, mod_name, mod_len) != 0) | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ libbpf.c:10070:21: note: 'mod_len' was declared here 10070 | int ret, i, mod_len; | ^~~~~~~ Silence the false positive. Signed-off-by: Achill Gilgenast Acked-by: Yonghong Song Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250729094611.2065713-1-fossdd@pwned.life Signed-off-by: Alexei Starovoitov commit abad3d0bad72a52137e0c350c59542d75ae4f513 Author: Daniel Borkmann Date: Thu Jul 31 01:47:33 2025 +0200 bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access in cgroup local storage can be crafted via tail calls. Given two programs each utilizing a cgroup local storage with a different value size, and one program doing a tail call into the other. The verifier will validate each of the indivial programs just fine. However, in the runtime context the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the BPF program as well as any cgroup local storage flavor the program uses. Helpers such as bpf_get_local_storage() pick this up from the runtime context: ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx); storage = ctx->prog_item->cgroup_storage[stype]; if (stype == BPF_CGROUP_STORAGE_SHARED) ptr = &READ_ONCE(storage->buf)->data[0]; else ptr = this_cpu_ptr(storage->percpu_buf); For the second program which was called from the originally attached one, this means bpf_get_local_storage() will pick up the former program's map, not its own. With mismatching sizes, this can result in an unintended out-of-bounds access. To fix this issue, we need to extend bpf_map_owner with an array of storage_cookie[] to match on i) the exact maps from the original program if the second program was using bpf_get_local_storage(), or ii) allow the tail call combination if the second program was not using any of the cgroup local storage maps. Fixes: 7d9c3427894f ("bpf: Make cgroup storages shared between programs on the same cgroup") Reported-by: Lonial Con Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250730234733.530041-4-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 9621e60f59eae87eb9ffe88d90f24f391a1ef0f0 Author: Daniel Borkmann Date: Thu Jul 31 01:47:32 2025 +0200 bpf: Move cgroup iterator helpers to bpf.h Move them into bpf.h given we also need them in core code. Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250730234733.530041-3-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit fd1c98f0ef5cbcec842209776505d9e70d8fcd53 Author: Daniel Borkmann Date: Thu Jul 31 01:47:31 2025 +0200 bpf: Move bpf map owner out of common struct Given this is only relevant for BPF tail call maps, it is adding up space and penalizing other map types. We also need to extend this with further objects to track / compare to. Therefore, lets move this out into a separate structure and dynamically allocate it only for BPF tail call maps. Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250730234733.530041-2-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 12df58ad294253ac1d8df0c9bb9cf726397a671d Author: Daniel Borkmann Date: Thu Jul 31 01:47:30 2025 +0200 bpf: Add cookie object to bpf maps Add a cookie to BPF maps to uniquely identify BPF maps for the timespan when the node is up. This is different to comparing a pointer or BPF map id which could get rolled over and reused. Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250730234733.530041-1-daniel@iogearbox.net Signed-off-by: Alexei Starovoitov commit 12ed593ee88170145fff25c7b3325b227731c2a1 Merge: f1aa129d80fddd cdd73b1666079a Author: Linus Torvalds Date: Thu Jul 31 11:19:54 2025 -0700 Merge tag 'caps-pr-20250729' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux Pull capabilities update from Serge Hallyn: - Fix broken link in documentation in capability.h - Correct the permission check for unsafe exec During exec, different effective and real credentials were assumed to mean changed credentials, making it impossible in the no-new-privs case to keep different uid and euid * tag 'caps-pr-20250729' of git://git.kernel.org/pub/scm/linux/kernel/git/sergeh/linux: uapi: fix broken link in linux/capability.h exec: Correct the permission check for unsafe exec commit f1aa129d80fddd2ae33080524bf84dea1c3528de Merge: 5ae8021583b4b4 3ebcbf079c26ab Author: Linus Torvalds Date: Thu Jul 31 11:08:55 2025 -0700 Merge tag 'mips_6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux Pull MIPS updates from Thomas Bogendoerfer: - DT updates for ralink, mobileye and atheros/qualcomm - Clean up of mc146818 usage - Speed up delay calibration for CPS - Other cleanups and fixes * tag 'mips_6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (50 commits) MIPS: Don't use %pK through printk MIPS: Update Joshua Kinard's e-mail address MIPS: mobileye: dts: eyeq5,eyeq6h: rename the emmc controller MIPS: mm: tlb-r4k: Uniquify TLB entries on init MIPS: SGI-IP27: Delete an unnecessary check before kfree() in hub_domain_free() mips/malta,loongson2ef: use generic mc146818_get_time function mips: remove redundant macro mc146818_decode_year mips/mach-rm: remove custom mc146818rtc.h file mips: remove unused function mc146818_set_rtc_mmss MIPS: CPS: Optimise delay CPU calibration for SMP MIPS: CPS: Improve mips_cps_first_online_in_cluster() MIPS: disable MMID when not supported by the hardware MIPS: eyeq5_defconfig: add I2C subsystem, driver and temp sensor driver MIPS: eyeq5_defconfig: add GPIO subsystem & driver MIPS: mobileye: eyeq5: add two GPIO bank nodes MIPS: mobileye: eyeq5: add evaluation board I2C temp sensor MIPS: mobileye: eyeq5: add 5 I2C controller nodes MIPS: eyeq5_defconfig: Update for v6.16-rc1 MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} mips: boot: use 'targets' instead of extra-y in Makefile ... commit 5ae8021583b4b49cd9a1fac635fbed2449b6c4d0 Merge: d6084bb815c453 c32969d0362a79 Author: Linus Torvalds Date: Thu Jul 31 11:05:07 2025 -0700 Merge tag 'sh-for-v6.17-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux Pull sh update from John Paul Adrian Glaubitz: "A single patch by Ben Hutchings replaces the hyphen in the exported shell variable ld-bfd with an underscore to avoid issues with certain shells such as dash which do not pass through environment variables whose name includes a hyphen" * tag 'sh-for-v6.17-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/glaubitz/sh-linux: sh: Do not use hyphen in exported variable name commit 01051012887329ea78eaca19b1d2eac4c9f601b5 Author: Jakub Kicinski Date: Wed Jul 30 10:21:37 2025 -0700 netlink: specs: ethtool: fix module EEPROM input/output arguments Module (SFP) eeprom GET has a lot of input params, they are all mistakenly listed as output in the spec. Looks like kernel doesn't output them at all. Correct what are the inputs and what the outputs. Reported-by: Duo Yi Fixes: a353318ebf24 ("tools: ynl: populate most of the ethtool spec") Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250730172137.1322351-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6235ce77749f45cac27f630337e2fdf04e8a6c73 Author: Namhyung Kim Date: Thu Jul 31 00:03:30 2025 -0700 perf record: Cache build-ID of hit DSOs only It post-processes samples to find which DSO has samples. Based on that info, it can save used DSOs in the build-ID cache directory. But for some reason, it saves all DSOs without checking the hit mark. Skipping unused DSOs can give some speedup especially with --buildid-mmap being default. On my idle machine, `time perf record -a sleep 1` goes down from 3 sec to 1.5 sec with this change. Fixes: e29386c8f7d71fa5 ("perf record: Add --buildid-mmap option to enable PERF_RECORD_MMAP2's build id") Reviewed-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250731070330.57116-1-namhyung@kernel.org Signed-off-by: Namhyung Kim commit d6084bb815c453de27af8071a23163a711586a6c Merge: 440e6d7e1435bb 0d4c4d4ea443ba Author: Linus Torvalds Date: Thu Jul 31 10:31:00 2025 -0700 Merge tag 'fsnotify_for_v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: "A couple of small improvements for fsnotify subsystem. The most interesting is probably Amir's change modifying the meaning of fsnotify fmode bits (and I spell it out specifically because I know you care about those). There's no change for the common cases of no fsnotify watches or no permission event watches. But when there are permission watches (either for open or for pre-content events) but no FAN_ACCESS_PERM watch (which nobody uses in practice) we are now able optimize away unnecessary cache loads from the read path" * tag 'fsnotify_for_v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fsnotify: optimize FMODE_NONOTIFY_PERM for the common cases fsnotify: merge file_set_fsnotify_mode_from_watchers() with open perm hook samples: fix building fs-monitor on musl systems fanotify: sanitize handle_type values when reporting fid commit 440e6d7e1435bb1e1948eeae34ca8bef6c7c5f82 Merge: ac46ff0f77f129 856db37592021e Author: Linus Torvalds Date: Thu Jul 31 10:27:11 2025 -0700 Merge tag 'jfs-6.17' of github.com:kleikamp/linux-shaggy Pull jfs updates from Dave Kleikamp: "Fixes and cleanups for JFS filesystem" * tag 'jfs-6.17' of github.com:kleikamp/linux-shaggy: jfs: fix metapage reference count leak in dbAllocCtl jfs: stop using write_cache_pages jfs: truncate good inode pages when hard link is 0 jfs: jfs_xtree: replace XT_GETPAGE macro with xt_getpage() jfs: Regular file corruption check jfs: upper bound check of tree index in dbAllocAG commit ac46ff0f77f1298892a4a1eeac375ed3db495704 Merge: 4522ae2def5a8e 2138e89cb066b4 Author: Linus Torvalds Date: Thu Jul 31 10:22:48 2025 -0700 Merge tag 'for-linus-6.17-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux Pull orangefs updates from Mike Marshall: "Fixes for string handling in debugfs and sysfs: - change scnprintf to sysfs_emit in sysfs code. - change sprintf to scnprintf in debugfs code. - refactor debugfs mask-to-string code for readability and slightly improved functionality" * tag 'for-linus-6.17-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux: fs/orangefs: Allow 2 more characters in do_c_string() fs: orangefs: replace scnprintf() with sysfs_emit() fs/orangefs: use snprintf() instead of sprintf() commit 4522ae2def5a8ed155642f947131726e427d2f05 Merge: ff7dcfedf9b1c3 99dbb2a1bd6614 Author: Linus Torvalds Date: Thu Jul 31 10:08:44 2025 -0700 Merge tag 'ubifs-for-linus-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs Pull UBI and UBIFS updates from Richard Weinberger: "UBIFS: - No longer use write_cache_pages() UBI: - Remove an unused function" * tag 'ubifs-for-linus-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs: ubifs: stop using write_cache_pages mtd: ubi: Remove unused ubi_flush commit ff7dcfedf9b1c34d9d06588ced4aa588b6444c59 Merge: 44a8c96edd0ee9 099b847ccc6c1a Author: Linus Torvalds Date: Thu Jul 31 10:02:44 2025 -0700 Merge tag 'ext4_for_linus_6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 Pull ext4 updates from Ted Ts'o: "Major ext4 changes for 6.17: - Better scalability for ext4 block allocation - Fix insufficient credits when writing back large folios Miscellaneous bug fixes, especially when handling exteded attriutes, inline data, and fast commit" * tag 'ext4_for_linus_6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (39 commits) ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr ext4: implement linear-like traversal across order xarrays ext4: refactor choose group to scan group ext4: convert free groups order lists to xarrays ext4: factor out ext4_mb_scan_group() ext4: factor out ext4_mb_might_prefetch() ext4: factor out __ext4_mb_scan_group() ext4: fix largest free orders lists corruption on mb_optimize_scan switch ext4: fix zombie groups in average fragment size lists ext4: merge freed extent with existing extents before insertion ext4: convert sbi->s_mb_free_pending to atomic_t ext4: fix typo in CR_GOAL_LEN_SLOW comment ext4: get rid of some obsolete EXT4_MB_HINT flags ext4: utilize multiple global goals to reduce contention ext4: remove unnecessary s_md_lock on update s_mb_last_group ext4: remove unnecessary s_mb_last_start ext4: separate stream goal hits from s_bal_goals for better tracking ext4: add ext4_try_lock_group() to skip busy groups ext4: initialize superblock fields in the kballoc-test.c kunit tests ext4: refactor the inline directory conversion and new directory codepaths ... commit 10dd5a0009898ba35eafeb6087e5c83b84742ff1 Author: Gerald Schaefer Date: Tue Jul 29 13:16:19 2025 +0200 s390/mm: Enable THP_SWAP and THP_MIGRATION After hugetlbfs PTE_MARKER support for s390 introduced region-third and segment table swap entries, it is now possible to also enable THP_SWAP and THP_MIGRATION for s390. s390 has different layout for PTE and region / segment table entries (RSTE). This is also true for swap entries, and their swap type and offset encoding. For hugetlbfs PTE_MARKER support, s390 has internal __swp_type_rste() and __swp_offset_rste() helpers to correctly handle RSTE swap entries. But common swap code does not know about this difference, and only uses __swp_type(), __swp_offset() and __swp_entry() helpers for conversion between arch-dependent and arch-independent representation of swp_entry_t for all pagetable levels. On s390, those helpers only work for PTE swap entries. Therefore, implement __pmd_to_swp_entry() to build a fake PTE swap entry and return the arch-dependent representation of that. Correspondingly, implement __swp_entry_to_pmd() to convert that into a proper PMD swap entry again. With this, the arch-dependent swp_entry_t representation will always look like a PTE swap entry in common code. This is somewhat similar to fake PTEs in hugetlbfs code for s390, but only requires conversion of the swap type and offset, and not all the possible PTE bits. For PMD swap entry SOFT_DIRTY handling, use the same helpers as for normal PMDs. Similar to PTEs, the SOFT_DIRTY bit location is the same for swap and normal entries. Reviewed-by: Heiko Carstens Signed-off-by: Gerald Schaefer Signed-off-by: Alexander Gordeev commit ccb0aa03d046ff84492396d2e90b408fa5b24a00 Author: Steffen Maier Date: Thu Jul 10 17:05:22 2025 +0200 s390: Support CONFIG_TRACE_MMIO_ACCESS Enable the functionality of commits d593d64f043a ("lib: Add register read/write tracing support") 210031971cdd ("asm-generic/io: Add logging support for MMIO accessors"). It only depends on explicit function calls for the tracing. Signed-off-by: Steffen Maier Reviewed-by: Niklas Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 56f4cfab1c93b14da422cdcd23898eb008033696 Author: Alexander Gordeev Date: Tue Jul 29 14:24:36 2025 +0200 s390/mm: Set high_memory at the end of the identity mapping The value of high_memory variable is set by set_high_memory() function to a value returned by memblock_end_of_DRAM(). The latter function returns by default the upper bound of the last online memory block, not the upper bound of the directly mapped memory region. As result, in case the end of memory happens to be offline, high_memory variable is set to a value that is short on the last offline memory blocks size: RANGE SIZE STATE REMOVABLE BLOCK 0x0000000000000000-0x000000ffffffffff 1T online yes 0-511 0x0000010000000000-0x0000011fffffffff 128G offline 512-575 Memory block size: 2G Total online memory: 1T Total offline memory: 128G crash> p/x vm_layout $1 = { kaslr_offset = 0x3453e918000, kaslr_offset_phys = 0xa534218000, identity_base = 0x0, identity_size = 0x12000000000 } crash> p/x high_memory $2 = 0x10000000000 In the past the value of high_memory was derived from max_low_pfn, which in turn was derived from the identity_size. Since identity_size accommodates the whole memory size - including tailing offline blocks, the offlined blocks did not impose any problem. But since commit e120d1bc12da ("arch, mm: set high_memory in free_area_init()") the value of high_memory is derived from the last memblock online region, and that is where the problem comes from. The value of high_memory is used by several drivers and by external tools (e.g. crash tool aborts while loading a dump). Similarily to ARM, use the override path provided by set_high_memory() function and set the value of high_memory at the end of the identity mapping early. That forces set_high_memory() to leave in high_memory the correct value, even when the end of available memory is offline. Fixes: e120d1bc12da ("arch, mm: set high_memory in free_area_init()") Tested-by: Mikhail Zaslonko Reviewed-by: Heiko Carstens Reviewed-by: Gerald Schaefer Signed-off-by: Alexander Gordeev commit 123b7c7c2ba725daf3bfa5ce421d65b92cb5c075 Author: Harald Freudenberger Date: Wed Jul 23 15:39:12 2025 +0200 s390/ap: Unmask SLCF bit in card and queue ap functions sysfs The SLCF bit ("stateless command filtering") introduced with CEX8 cards was because of the function mask's default value suppressed when user space read the ap function for an AP card or queue. Unmask this bit so that user space applications like lszcrypt can evaluate and list this feature. Fixes: d4c53ae8e494 ("s390/ap: store TAPQ hwinfo in struct ap_card") Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 9cf9db888f387844e063efc6296e9fa5c042995e Merge: 3dd8aa0ef78e49 fb2fae70e7e985 Author: Miquel Raynal Date: Thu Jul 31 18:52:16 2025 +0200 Merge tag 'nand/for-6.17' into mtd/next * Raw NAND changes: Various controller drivers received minor fixes like DMA mapping checks, better timing derivations or bitflip statistics. It has also been discovered that some Hynix NAND flashes were not supporting read-retries, which is not properly supported. * SPI NAND changes: In order to support high-speed modes, certain chips need extra configuration like adding more dummy cycles. This is now possible, especially on Winbond chips. Aside from that, Gigadevice gets support for a new chip (GD5F1GM9). Signed-off-by: Miquel Raynal commit 3dd8aa0ef78e4941f4b915d317616c03d08e31b2 Merge: 56eb7c13b97c6f 2e3a7476ec3989 Author: Miquel Raynal Date: Thu Jul 31 18:52:04 2025 +0200 Merge tag 'spi-nor/for-6.17' into mtd/next SPI NOR changes for 6.17 Notable changes: - Fix exiting 4-byte addressing on Infineon SEMPER flashes. These flashes do not support the standard EX4B opcode (E9h), and use a vendor-specific opcode (B8h) instead. - Fix unlocking of flashes that are write-protected at power-on. This was caused by using an uninitialized mtd_info in spi_nor_try_unlock_all(). Signed-off-by: Miquel Raynal commit 44a8c96edd0ee9320a1ad87afc7b10f38e55d5ec Merge: b4efd62564e96d bf24d642685443 Author: Linus Torvalds Date: Thu Jul 31 09:45:28 2025 -0700 Merge tag 'v6.17-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 Pull crypto update from Herbert Xu: "API: - Allow hash drivers without fallbacks (e.g., hardware key) Algorithms: - Add hmac hardware key support (phmac) on s390 - Re-enable sha384 in FIPS mode - Disable sha1 in FIPS mode - Convert zstd to acomp Drivers: - Lower priority of qat skcipher and aead - Convert aspeed to partial block API - Add iMX8QXP support in caam - Add rate limiting support for GEN6 devices in qat - Enable telemetry for GEN6 devices in qat - Implement full backlog mode for hisilicon/sec2" * tag 'v6.17-p1' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6: (116 commits) crypto: keembay - Use min() to simplify ocs_create_linked_list_from_sg() crypto: hisilicon/hpre - fix dma unmap sequence crypto: qat - make adf_dev_autoreset() static crypto: ccp - reduce stack usage in ccp_run_aes_gcm_cmd crypto: qat - refactor ring-related debug functions crypto: qat - fix seq_file position update in adf_ring_next() crypto: qat - fix DMA direction for compression on GEN2 devices crypto: jitter - replace ARRAY_SIZE definition with header include crypto: engine - remove {prepare,unprepare}_crypt_hardware callbacks crypto: engine - remove request batching support crypto: qat - flush misc workqueue during device shutdown crypto: qat - enable rate limiting feature for GEN6 devices crypto: qat - add compression slice count for rate limiting crypto: qat - add get_svc_slice_cnt() in device data structure crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting crypto: qat - relocate service related functions crypto: qat - consolidate service enums crypto: qat - add decompression service for rate limiting crypto: qat - validate service in rate limiting sysfs api crypto: hisilicon/sec2 - implement full backlog mode for sec ... commit d459b164a428eb4bb65a3c01c31696b90190682b Merge: 04225d13aef11b 367c240b0a99c7 Author: Jens Axboe Date: Thu Jul 31 10:45:14 2025 -0600 Merge tag 'nvme-6.17-2025-07-31' of git://git.infradead.org/nvme into block-6.17 Pull NVMe changes from Christoph: "- add support for getting the FDP featuee in fabrics passthru path (Nitesh Shetty) - add capability to connect to an administrative controller (Kamaljit Singh) - fix a leak on sgl setup error (Keith Busch) - initialize discovery subsys after debugfs is initialized (Mohamed Khalfella) - fix various comment typos (Bjorn Helgaas) - remove unneeded semicolons (Jiapeng Chong)" * tag 'nvme-6.17-2025-07-31' of git://git.infradead.org/nvme: nvme: fix various comment typos nvme-auth: remove unneeded semicolon nvme-pci: fix leak on sgl setup error nvmet: initialize discovery subsys after debugfs is initialized nvme: add capability to connect to an administrative controller nvmet: add support for FDP in fabrics passthru path commit b4efd62564e96d1edb99eb00dd0ff620dbd1afab Merge: b1cce98493a095 b90bb6dbf1d60d Author: Linus Torvalds Date: Thu Jul 31 09:42:20 2025 -0700 Merge tag 'ipe-pr-20250728' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe Pull ipe update from Fan Wu: "A single commit from Eric Biggers to simplify the IPE (Integrity Policy Enforcement) policy audit with the SHA-256 library API" * tag 'ipe-pr-20250728' of git://git.kernel.org/pub/scm/linux/kernel/git/wufan/ipe: ipe: use SHA-256 library API instead of crypto_shash API commit c36049da6c903b732f238eb6fd13c2051fac96cd Author: Thierry Reding Date: Thu Jul 31 18:18:02 2025 +0200 arm64: tegra: Remove numa-node-id properties These were initially added because some software was checking for their presence. However, the device is not NUMA, so adding these is wrong and hence they should be removed. Signed-off-by: Thierry Reding commit 64c21f253a3737c15ab745e9276b2352d86aed26 Merge: 3cf186ecc164e1 e4b2a0c2b9be6d Author: Stephen Boyd Date: Thu Jul 31 09:10:06 2025 -0700 Merge branch 'clk-fixes' into clk-next Resolve conflicts with i.MX95 changes 88768d6f8c13 ("clk: imx95-blk-ctl: Rename lvds and displaymix csr blk") in clk-imx and aacc875a448d ("clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data") in clk-fixes. * clk-fixes: clk: sunxi-ng: v3s: Fix TCON clock parents clk: sunxi-ng: v3s: Fix CSI1 MCLK clock name clk: sunxi-ng: v3s: Fix CSI SCLK clock name dt-bindings: clock: mediatek: Add #reset-cells property for MT8188 clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data clk: scmi: Handle case where child clocks are initialized before their parents clk: sunxi-ng: a523: Mark MBUS clock as critical commit b1cce98493a095925fb51be045ccf6e08edb4aa0 Merge: 260f6f4fda93c8 35293ebbb65e02 Author: Linus Torvalds Date: Thu Jul 31 08:36:51 2025 -0700 Merge tag 'docs-6.17' of git://git.lwn.net/linux Pull documentation updates from Jonathan Corbet: "It has been a relatively busy cycle for docs, especially the build system: - The Perl kernel-doc script was added to 2.3.52pre1 just after the turn of the millennium. Over the following 25 years, it accumulated a vast amount of cruft, all in a language few people want to deal with anymore. Mauro's Python replacement in 6.16 faithfully reproduced all of the cruft in the hope of avoiding regressions. Now that we have a more reasonable code base, though, we can work on cleaning it up; many of the changes this time around are toward that end. - A reorganization of the ext4 docs into the usual TOC format. - Various Chinese translations and updates. - A new script from Mauro to help with docs-build testing. - A new document for linked lists - A sweep through MAINTAINERS fixing broken GitHub git:// repository links. ...and lots of fixes and updates" * tag 'docs-6.17' of git://git.lwn.net/linux: (147 commits) scripts: add origin commit identification based on specific patterns sphinx: kernel_abi: fix performance regression with O= Documentation: core-api: entry: Replace deprecated KVM entry/exit functions docs: fault-injection: drop reference to md-faulty docs: document linked lists scripts: kdoc: make it backward-compatible with Python 3.7 docs: kernel-doc: emit warnings for ancient versions of Python Documentation/rtla: Describe exit status Documentation/rtla: Add include common_appendix.rst docs: kernel: Clarify printk_ratelimit_burst reset behavior Documentation: ioctl-number: Don't repeat macro names Documentation: ioctl-number: Shorten macros table Documentation: ioctl-number: Correct full path to papr-physical-attestation.h Documentation: ioctl-number: Extend "Include File" column width Documentation: ioctl-number: Fix linuxppc-dev mailto link overlayfs.rst: fix typos docs: kdoc: emit a warning for ancient versions of Python docs: kdoc: clean up check_sections() docs: kdoc: directly access the always-there KdocItem fields docs: kdoc: straighten up dump_declaration() ... commit e2b02d382ae0cb90697e8529dfd3f93bf8c6905c Author: Ben Horgan Date: Wed Jul 9 10:38:08 2025 +0100 bitfield: Ensure the return values of helper functions are checked As type##_replace_bits() has no side effects it is only useful if its return value is checked. Add __must_check to enforce this usage. To have the bits replaced in-place typep##_replace_bits() can be used instead. Although, type_##_get_bits() and type_##_encode_bits() are harder to misuse they are still only useful if the return value is checked. For consistency, also add __must_check to these. Signed-off-by: Ben Horgan Signed-off-by: Yury Norov (NVIDIA) commit dcb23e1878013dd04122122ed8eba35f354a091b Author: Vincent Mailhol Date: Mon Jun 9 11:45:47 2025 +0900 test_bits: add tests for __GENMASK() and __GENMASK_ULL() The definitions of GENMASK() and GENMASK_ULL() do not depend any more on __GENMASK() and __GENMASK_ULL(). Duplicate the existing unit tests so that __GENMASK{,ULL}() are still covered. Because __GENMASK() and __GENMASK_ULL() do use GENMASK_INPUT_CHECK(), drop the TEST_GENMASK_FAILURES negative tests. It would be good to have a small assembly test case for GENMASK*() in case somebody decides to unify both in the future. However, I lack expertise in assembly to do so. Instead add a FIXME message to highlight the absence of the asm unit test. Signed-off-by: Vincent Mailhol Reviewed-by: Lucas De Marchi Signed-off-by: Yury Norov (NVIDIA) commit 104ea1c84b91c9f452e497ba51602b903711cdd5 Author: Vincent Mailhol Date: Mon Jun 9 11:45:46 2025 +0900 bits: unify the non-asm GENMASK*() The newly introduced GENMASK_TYPE() macro can also be used to generate the pre-existing non-asm GENMASK*() variants. Apply GENMASK_TYPE() to GENMASK(), GENMASK_ULL() and GENMASK_U128(). Signed-off-by: Vincent Mailhol Signed-off-by: Yury Norov (NVIDIA) commit 6d4471252ccc1722d25200fa9b6021ab4e1d6fde Author: Vincent Mailhol Date: Mon Jun 9 11:45:45 2025 +0900 bits: split the definition of the asm and non-asm GENMASK*() In an upcoming change, the non-asm GENMASK*() will all be unified to depend on GENMASK_TYPE() which indirectly depend on sizeof(), something not available in asm. Instead of adding further complexity to GENMASK_TYPE() to make it work for both asm and non asm, just split the definition of the two variants. Signed-off-by: Vincent Mailhol Reviewed-by: Lucas De Marchi Signed-off-by: Yury Norov (NVIDIA) commit b0c85e99458af829c32c225b43f638443bff14e5 Author: Shaopeng Tan Date: Mon Jun 23 16:46:45 2025 +0900 cpumask: Remove unnecessary cpumask_nth_andnot() Commit 94f753143028("x86/resctrl: Optimize cpumask_any_housekeeping()") switched the only user of cpumask_nth_andnot() to other cpumask functions, but left the function cpumask_nth_andnot() unused. This makes function find_nth_andnot_bit() unused as well. Delete them. Signed-off-by: Shaopeng Tan Signed-off-by: Yury Norov [NVIDIA] commit f49a4af3fabce56aaef125f0d959b81afe194afb Author: Yury Norov [NVIDIA] Date: Wed Jun 4 20:12:52 2025 -0400 watchdog: fix opencoded cpumask_next_wrap() in watchdog_next_cpu() The dedicated helper is more verbose and efficient comparing to cpumask_next() followed by cpumask_first(). Signed-off-by: "Yury Norov [NVIDIA]" Reviewed-by: Douglas Anderson commit 8557c8628cf3cf8ebd3b32601ccdde550bbf6c54 Author: Yury Norov [NVIDIA] Date: Thu Jun 19 14:26:25 2025 -0400 clocksource: Improve randomness in clocksource_verify_choose_cpus() The current algorithm of picking a random CPU works OK for dense online cpumask, but if cpumask is non-dense, the distribution of picked CPUs is skewed. For example, on 8-CPU board with CPUs 4-7 offlined, the probability of selecting CPU 0 is 5/8. Accordingly, cpus 1, 2 and 3 are chosen with probability 1/8 each. The proper algorithm should pick each online CPU with probability 1/4. Switch it to cpumask_random(), which has better statistical characteristics. CC: Andrew Morton Acked-by: John Stultz Reviewed-by: Thomas Gleixner Signed-off-by: "Yury Norov [NVIDIA]" commit df485a4b2b3ee5b35c80f990beb554e38a8a5fb1 Author: Takashi Iwai Date: Thu Jul 31 07:37:08 2025 +0200 ALSA: usb: scarlett2: Fix missing NULL check scarlett2_input_select_ctl_info() sets up the string arrays allocated via kasprintf(), but it misses NULL checks, which may lead to NULL dereference Oops. Let's add the proper NULL check. Fixes: 8eba063b5b2b ("ALSA: scarlett2: Simplify linked channel handling") Link: https://patch.msgid.link/20250731053714.29414-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 5e0753df9623559542404e167172ba97e412f45e Author: Takashi Iwai Date: Thu Jul 31 11:11:07 2025 +0200 mips: Update HD-audio configs again The HD-audio codec driver configs have been updated again since the previous change. Correct the types and enable all Realtek HD-audio codecs for loongson, per request. Fixes: 1d8dd982c409 ("ALSA: hda/realtek: Enable drivers as default") Fixes: 81231ad173d8 ("ALSA: hda/hdmi: Enable drivers as default") Cc: linux-mips@vger.kernel.org Reviewed-by: Huacai Chen Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250731091109.16901-4-tiwai@suse.de commit 1e7e0a2df77d919a3c1a58b8a4efd818a1895bd2 Author: Takashi Iwai Date: Thu Jul 31 11:11:06 2025 +0200 LoongArch: Update HD-audio codec configs The HD-audio codec driver configs have been updated again the drivers got split with different kconfigs. Enable all Realtek HD-audio codecs and HDMI codecs (except for NVIDIA_MCP and TEGRA) per request. Fixes: 1d8dd982c409 ("ALSA: hda/realtek: Enable drivers as default") Fixes: 81231ad173d8 ("ALSA: hda/hdmi: Enable drivers as default") Cc: loongarch@lists.linux.dev Reviewed-by: Huacai Chen Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250731091109.16901-3-tiwai@suse.de commit 80d2a9eb9af399fe60a6d0dddab10d75364698b8 Author: Takashi Iwai Date: Thu Jul 31 11:11:05 2025 +0200 arm: Update HD-audio configs again The Realtek and HDMI HD-audio codec configs have been slightly updated again since the previous change. Follow the new kconfig changes for multi_v7_defconfig and tegra_defconfig, and add a few other configs for HDMI codecs, too. Fixes: 1d8dd982c409 ("ALSA: hda/realtek: Enable drivers as default") Fixes: 81231ad173d8 ("ALSA: hda/hdmi: Enable drivers as default") Cc: linux-arm-kernel@lists.infradead.org Cc: linux-tegra@vger.kernel.org Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250731091109.16901-2-tiwai@suse.de commit 6260da046819b7bda828bacae148fc8856fdebd7 Author: WangYuli Date: Thu Jul 31 18:02:22 2025 +0800 selftests: ALSA: fix memory leak in utimer test Free the malloc'd buffer in TEST_F(timer_f, utimer) to prevent memory leak. Fixes: 1026392d10af ("selftests: ALSA: Cover userspace-driven timers with test") Reported-by: Jun Zhan Signed-off-by: WangYuli Link: https://patch.msgid.link/DE4D931FCF54F3DB+20250731100222.65748-1-wangyuli@uniontech.com Signed-off-by: Takashi Iwai commit e9df1755485dd90a89656e8a21ec4d71c909fa30 Author: noble.yang Date: Thu Jul 31 19:06:14 2025 +0800 ALSA: usb-audio: Add DSD support for Comtrue USB Audio device The vendor Comtrue Inc. (0x2fc6) produces USB audio chipsets like the CT7601 which are capable of Native DSD playback. This patch adds QUIRK_FLAG_DSD_RAW for Comtrue (VID 0x2fc6), which enables native DSD playback (DSD_U32_LE) on their USB Audio device. This has been verified under Ubuntu 25.04 with JRiver. Signed-off-by: noble.yang Link: https://patch.msgid.link/20250731110614.4070-1-noble228@gmail.com Signed-off-by: Takashi Iwai commit 844e5c0eb1767d5f971b035f81203f939d8219d4 Author: Steve French Date: Mon Jul 28 12:32:53 2025 -0500 smb3 client: add way to show directory leases for improved debugging When looking at performance issues around directory caching, or debugging directory lease issues, it is helpful to be able to display the current directory leases (as we can e.g. or open files). Create pseudo-file /proc/fs/cifs/open_dirs that displays current directory leases. Here is sample output: cat /proc/fs/cifs/open_dirs Version:1 Format: Num entries: 3 0xce4c1c68 0x7176aa54 0xd95ef58e \dira valid file info, valid dirents 0xce4c1c68 0x7176aa54 0xd031e211 \dir5 valid file info, valid dirents 0xce4c1c68 0x7176aa54 0x96533a90 \dir1 valid file info Reviewed-by: Bharath SM Signed-off-by: Steve French commit 55a0fbd2ac3fe8f61a30ea697b2eb3034f6778c8 Author: LongPing Wei Date: Wed Jul 30 14:17:19 2025 +0800 dm: set DM_TARGET_PASSES_CRYPTO feature for dm-thin dm-thin obviously can pass through inline crypto support. Signed-off-by: LongPing Wei Signed-off-by: Mikulas Patocka commit b3b9cb11aa034cfa9eb880bb9bb3d5aaf732e479 Author: Steven Rostedt Date: Tue Jul 29 14:23:14 2025 -0400 unwind: Finish up unwind when a task exits On do_exit() when a task is exiting, if a unwind is requested and the deferred user stacktrace is deferred via the task_work, the task_work callback is called after exit_mm() is called in do_exit(). This means that the user stack trace will not be retrieved and an empty stack is created. Instead, add a function unwind_deferred_task_exit() and call it just before exit_mm() so that the unwinder can call the requested callbacks with the user space stack. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Josh Poimboeuf Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Thomas Gleixner Cc: Andrii Nakryiko Cc: Indu Bhagat Cc: "Jose E. Marchesi" Cc: Beau Belgrave Cc: Jens Remus Cc: Linus Torvalds Cc: Andrew Morton Cc: Jens Axboe Cc: Florian Weimer Cc: Sam James Link: https://lore.kernel.org/20250729182406.504259474@kernel.org Signed-off-by: Steven Rostedt (Google) commit 357eda2d745054eb737397368bc9b0f84814b0a5 Author: Steven Rostedt Date: Tue Jul 29 14:23:13 2025 -0400 unwind deferred: Use SRCU unwind_deferred_task_work() Instead of using the callback_mutex to protect the link list of callbacks in unwind_deferred_task_work(), use SRCU instead. This gets called every time a task exits that has to record a stack trace that was requested. This can happen for many tasks on several CPUs at the same time. A mutex is a bottleneck and can cause a bit of contention and slow down performance. As the callbacks themselves are allowed to sleep, regular RCU cannot be used to protect the list. Instead use SRCU, as that still allows the callbacks to sleep and the list can be read without needing to hold the callback_mutex. Link: https://lore.kernel.org/all/ca9bd83a-6c80-4ee0-a83c-224b9d60b755@efficios.com/ Cc: "Paul E. McKenney" Cc: Masami Hiramatsu Cc: Josh Poimboeuf Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Thomas Gleixner Cc: Andrii Nakryiko Cc: Indu Bhagat Cc: "Jose E. Marchesi" Cc: Beau Belgrave Cc: Jens Remus Cc: Linus Torvalds Cc: Andrew Morton Cc: Jens Axboe Cc: Florian Weimer Cc: Sam James Link: https://lore.kernel.org/20250729182406.331548065@kernel.org Suggested-by: Mathieu Desnoyers Signed-off-by: Steven Rostedt (Google) commit 858fa8a3b083e862114bb6483b9fb50b3e2bc4c3 Author: Steven Rostedt Date: Tue Jul 29 14:23:12 2025 -0400 unwind: Add USED bit to only have one conditional on way back to user space On the way back to user space, the function unwind_reset_info() is called unconditionally (but always inlined). It currently has two conditionals. One that checks the unwind_mask which is set whenever a deferred trace is called and is used to know that the mask needs to be cleared. The other checks if the cache has been allocated, and if so, it resets the nr_entries so that the unwinder knows it needs to do the work to get a new user space stack trace again (it only does it once per entering the kernel). Use one of the bits in the unwind mask as a "USED" bit that gets set whenever a trace is created. This will make it possible to only check the unwind_mask in the unwind_reset_info() to know if it needs to do work or not and eliminates a conditional that happens every time the task goes back to user space. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Josh Poimboeuf Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Thomas Gleixner Cc: Andrii Nakryiko Cc: Indu Bhagat Cc: "Jose E. Marchesi" Cc: Beau Belgrave Cc: Jens Remus Cc: Linus Torvalds Cc: Andrew Morton Cc: Jens Axboe Cc: Florian Weimer Cc: Sam James Link: https://lore.kernel.org/20250729182406.155422551@kernel.org Signed-off-by: Steven Rostedt (Google) commit 4c75133e745aa95636c9ccbab1603ed363dabcd4 Author: Steven Rostedt Date: Tue Jul 29 14:23:11 2025 -0400 unwind deferred: Add unwind_completed mask to stop spurious callbacks If there's more than one registered tracer to the unwind deferred infrastructure, it is currently possible that one tracer could cause extra callbacks to happen for another tracer if the former requests a deferred stacktrace after the latter's callback was executed and before the task went back to user space. Here's an example of how this could occur: [Task enters kernel] tracer 1 request -> add cookie to its buffer tracer 1 request -> add cookie to its buffer <..> [ task work executes ] tracer 1 callback -> add trace + cookie to its buffer [tracer 2 requests and triggers the task work again] [ task work executes again ] tracer 1 callback -> add trace + cookie to its buffer tracer 2 callback -> add trace + cookie to its buffer [Task exits back to user space] This is because the bit for tracer 1 gets set in the task's unwind_mask when it did its request and does not get cleared until the task returns back to user space. But if another tracer were to request another deferred stacktrace, then the next task work will executed all tracer's callbacks that have their bits set in the task's unwind_mask. To fix this issue, add another mask called unwind_completed and place it into the task's info->cache structure. The cache structure is allocated on the first occurrence of a deferred stacktrace and this unwind_completed mask is not needed until then. It's better to have it in the cache than to permanently waste space in the task_struct. After a tracer's callback is executed, it's bit gets set in this unwind_completed mask. When the task_work enters, it will AND the task's unwind_mask with the inverse of the unwind_completed which will eliminate any work that already had its callback executed since the task entered the kernel. When the task leaves the kernel, it will reset this unwind_completed mask just like it resets the other values as it enters user space. Link: https://lore.kernel.org/all/20250716142609.47f0e4a5@batman.local.home/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Josh Poimboeuf Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Thomas Gleixner Cc: Andrii Nakryiko Cc: Indu Bhagat Cc: "Jose E. Marchesi" Cc: Beau Belgrave Cc: Jens Remus Cc: Linus Torvalds Cc: Andrew Morton Cc: Jens Axboe Cc: Florian Weimer Cc: Sam James Link: https://lore.kernel.org/20250729182405.989222722@kernel.org Signed-off-by: Steven Rostedt (Google) commit be3d526a5b34109cecf3bc23b96f0081ad600a5b Author: Steven Rostedt Date: Tue Jul 29 14:23:10 2025 -0400 unwind deferred: Use bitmask to determine which callbacks to call In order to know which registered callback requested a stacktrace for when the task goes back to user space, add a bitmask to keep track of all registered tracers. The bitmask is the size of long, which means that on a 32 bit machine, it can have at most 32 registered tracers, and on 64 bit, it can have at most 64 registered tracers. This should not be an issue as there should not be more than 10 (unless BPF can abuse this?). When a tracer registers with unwind_deferred_init() it will get a bit number assigned to it. When a tracer requests a stacktrace, it will have its bit set within the task_struct. When the task returns back to user space, it will call the callbacks for all the registered tracers where their bits are set in the task's mask. When a tracer is removed by the unwind_deferred_cancel() all current tasks will clear the associated bit, just in case another tracer gets registered immediately afterward and then gets their callback called unexpectedly. To prevent live locks from happening if an event that happens between the task_work and when the task goes back to user space, triggers the deferred unwind, have the unwind_mask get cleared on exit to user space and not after the callback is made. Move the pending bit from a value on the task_struct to bit zero of the unwind_mask (saves space on the task_struct). This will allow modifying the pending bit along with the work bits atomically. Instead of clearing a work's bit after its callback is called, it is delayed until exit. If the work is requested again, the task_work is not queued again and the request will be notified that the task has already been called by returning a positive number (the same as if it was already pending). The pending bit is cleared before calling the callback functions but the current work bits remain. If one of the called works registers again, it will not trigger a task_work if its bit is still present in the task's unwind_mask. If a new work requests a deferred unwind, then it will set both the pending bit and its own bit. Note this will also cause any work that was previously queued and had their callback already executed to be executed again. Future work will remove these spurious callbacks. The use of atomic_long bit operations were suggested by Peter Zijlstra: Link: https://lore.kernel.org/all/20250715102912.GQ1613200@noisy.programming.kicks-ass.net/ The unwind_mask could not be converted to atomic_long_t do to atomic_long not having all the bit operations needed by unwind_mask. Instead it follows other use cases in the kernel and just typecasts the unwind_mask to atomic_long_t when using the two atomic_long functions. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Josh Poimboeuf Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Thomas Gleixner Cc: Andrii Nakryiko Cc: Indu Bhagat Cc: "Jose E. Marchesi" Cc: Beau Belgrave Cc: Jens Remus Cc: Linus Torvalds Cc: Andrew Morton Cc: Jens Axboe Cc: Florian Weimer Cc: Sam James Link: https://lore.kernel.org/20250729182405.822789300@kernel.org Signed-off-by: Steven Rostedt (Google) commit 055c7060e7ca71bb86da616158fc74254730ae2a Author: Steven Rostedt Date: Tue Jul 29 14:23:09 2025 -0400 unwind_user/deferred: Make unwind deferral requests NMI-safe Make unwind_deferred_request() NMI-safe so tracers in NMI context can call it and safely request a user space stacktrace when the task exits. Note, this is only allowed for architectures that implement a safe cmpxchg. If an architecture requests a deferred stack trace from NMI context that does not support a safe NMI cmpxchg, it will get an -EINVAL and trigger a warning. For those architectures, they would need another method (perhaps an irqwork), to request a deferred user space stack trace. That can be dealt with later if one of theses architectures require this feature. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Josh Poimboeuf Cc: Ingo Molnar Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Thomas Gleixner Cc: Andrii Nakryiko Cc: Indu Bhagat Cc: "Jose E. Marchesi" Cc: Beau Belgrave Cc: Jens Remus Cc: Linus Torvalds Cc: Andrew Morton Cc: Jens Axboe Cc: Florian Weimer Cc: Sam James Link: https://lore.kernel.org/20250729182405.657072238@kernel.org Suggested-by: Peter Zijlstra Signed-off-by: Steven Rostedt (Google) commit 2dffa355f6c279e7d2e574abf9446c41a631c9e5 Author: Josh Poimboeuf Date: Tue Jul 29 14:23:08 2025 -0400 unwind_user/deferred: Add deferred unwinding interface Add an interface for scheduling task work to unwind the user space stack before returning to user space. This solves several problems for its callers: - Ensure the unwind happens in task context even if the caller may be running in interrupt context. - Avoid duplicate unwinds, whether called multiple times by the same caller or by different callers. - Create a "context cookie" which allows trace post-processing to correlate kernel unwinds/traces with the user unwind. A concept of a "cookie" is created to detect when the stacktrace is the same. A cookie is generated the first time a user space stacktrace is requested after the task enters the kernel. As the stacktrace is saved on the task_struct while the task is in the kernel, if another request comes in, if the cookie is still the same, it will use the saved stacktrace, and not have to regenerate one. The cookie is passed to the caller on request, and when the stacktrace is generated upon returning to user space, it calls the requester's callback with the cookie as well as the stacktrace. The cookie is cleared when it goes back to user space. Note, this currently adds another conditional to the unwind_reset_info() path that is always called returning to user space, but future changes will put this back to a single conditional. A global list is created and protected by a global mutex that holds tracers that register with the unwind infrastructure. The number of registered tracers will be limited in future changes. Each perf program or ftrace instance will register its own descriptor to use for deferred unwind stack traces. Note, in the function unwind_deferred_task_work() that gets called when returning to user space, it uses a global mutex for synchronization which will cause a big bottleneck. This will be replaced by SRCU, but that change adds some complex synchronization that deservers its own commit. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Thomas Gleixner Cc: Andrii Nakryiko Cc: Indu Bhagat Cc: "Jose E. Marchesi" Cc: Beau Belgrave Cc: Jens Remus Cc: Linus Torvalds Cc: Andrew Morton Cc: Jens Axboe Cc: Florian Weimer Cc: Sam James Link: https://lore.kernel.org/20250729182405.488066537@kernel.org Co-developed-by: Steven Rostedt (Google) Signed-off-by: Josh Poimboeuf Signed-off-by: Steven Rostedt (Google) commit b9c73524106e1c0c857006fb9ff2e5a510dc4021 Author: Josh Poimboeuf Date: Tue Jul 29 14:23:07 2025 -0400 unwind_user/deferred: Add unwind cache Cache the results of the unwind to ensure the unwind is only performed once, even when called by multiple tracers. The cache nr_entries gets cleared every time the task exits the kernel. When a stacktrace is requested, nr_entries gets set to the number of entries in the stacktrace. If another stacktrace is requested, if nr_entries is not zero, then it contains the same stacktrace that would be retrieved so it is not processed again and the entries is given to the caller. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Thomas Gleixner Cc: Andrii Nakryiko Cc: Indu Bhagat Cc: "Jose E. Marchesi" Cc: Beau Belgrave Cc: Linus Torvalds Cc: Andrew Morton Cc: Jens Axboe Cc: Florian Weimer Cc: Sam James Link: https://lore.kernel.org/20250729182405.319691167@kernel.org Reviewed-by: Jens Remus Reviewed-By: Indu Bhagat Co-developed-by: Steven Rostedt (Google) Signed-off-by: Josh Poimboeuf Signed-off-by: Steven Rostedt (Google) commit 9576e1aecf627ac99c369fc8cd265b4847ed0c50 Author: LongPing Wei Date: Thu Jul 31 16:53:27 2025 +0800 dm-thin: update the documentation 1. convert KB/MB/GB to KiB/MiB/GiB; 2. change the number of sectors for 128MiB from 256000 to 262144 as 256000 sectors is neither 128 MB nor 128 MiB. Signed-off-by: LongPing Wei Signed-off-by: Mikulas Patocka commit 8d05316d79d8afd20ba767efea8706d8238a9d46 Author: Pavel Tikhomirov Date: Mon Jul 21 11:49:13 2025 +0800 dm-raid: do not include dm-core.h In commit 4cc96131afce ("dm: move request-based code out to dm-rq.[hc]") we have a note: "DM targets should _never_ include dm-core.h!". And it is not used in any DM targets except dm-raid now, so let's remove it from dm-raid for consistency, also use special helpers instead of accessing dm_table and mapper_device fields directly. This change is merely a cleanup and should not affect functionality. Signed-off-by: Pavel Tikhomirov Reviewed-by: Yu Kuai Signed-off-by: Mikulas Patocka commit 225b2cb640d7ddbb2df38130f3f34f4a84497426 Author: Mikulas Patocka Date: Mon Jul 14 18:27:46 2025 +0200 vdo: omit need_resched() before cond_resched() There's no need to call need_resched() because cond_resched() will do nothing if need_resched() returns false. Reviewed-by: Matthew Sakai Signed-off-by: Mikulas Patocka commit 487767bff572d46f7c37ad846c4078f6d6c9cc55 Author: Purva Yeshi Date: Thu Jul 10 13:11:57 2025 +0530 md: dm-zoned-target: Initialize return variable r to avoid uninitialized use Fix Smatch-detected error: drivers/md/dm-zoned-target.c:1073 dmz_iterate_devices() error: uninitialized symbol 'r'. Smatch detects a possible use of the uninitialized variable 'r' in dmz_iterate_devices() because if dmz->nr_ddevs is zero, the loop is skipped and 'r' is returned without being set, leading to undefined behavior. Initialize 'r' to 0 before the loop. This ensures that if there are no devices to iterate over, the function still returns a defined value. Signed-off-by: Purva Yeshi Signed-off-by: Mikulas Patocka commit bdf253d580d7d30e7620844c63a5013fe7ba3f87 Author: Eric Biggers Date: Wed Jul 9 12:09:02 2025 -0700 dm-verity: remove support for asynchronous hashes The support for asynchronous hashes in dm-verity has outlived its usefulness. It adds significant code complexity and opportunity for bugs. I don't know of anyone using it in practice. (The original submitter of the code possibly was, but that was 8 years ago.) Data I recently collected for en/decryption shows that using off-CPU crypto "accelerators" is consistently much slower than the CPU (https://lore.kernel.org/r/20250704070322.20692-1-ebiggers@kernel.org/), even on CPUs that lack dedicated cryptographic instructions. Similar results are likely to be seen for hashing. I already removed support for asynchronous hashes from fsverity two years ago, and no one ever complained. Moreover, neither dm-verity, fsverity, nor fscrypt has ever actually used the asynchronous crypto algorithms in a truly asynchronous manner. The lack of interest in such optimizations provides further evidence that it's only the CPU-based crypto that actually matters. Historically, it's also been common for people to forget to enable the optimized SHA-256 code, which could contribute to an off-CPU crypto engine being perceived as more useful than it really is. In 6.16 I fixed that: the optimized SHA-256 code is now enabled by default. Therefore, let's drop the support for asynchronous hashes in dm-verity. Tested with verity-compat-test. Acked-by: Ard Biesheuvel Signed-off-by: Eric Biggers Signed-off-by: Mikulas Patocka commit 367c240b0a99c7ada700a44345dd3144a02b6164 Author: Bjorn Helgaas Date: Wed Jul 30 15:32:45 2025 -0500 nvme: fix various comment typos Fix typos in comments. Signed-off-by: Bjorn Helgaas Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit b6160cd2c45c38d01405d8ee3758e9b8a6f8e595 Author: Jiapeng Chong Date: Fri Jul 25 15:57:22 2025 +0800 nvme-auth: remove unneeded semicolon No functional modification involved. ./drivers/nvme/host/auth.c:745:2-3: Unneeded semicolon. ./drivers/nvme/host/auth.c:755:2-3: Unneeded semicolon. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22937 Signed-off-by: Jiapeng Chong Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 4e6e151cf92bbaa0622a4da351ff444e4fd9b865 Author: Keith Busch Date: Tue Jul 29 11:12:47 2025 -0700 nvme-pci: fix leak on sgl setup error We need to free the descriptor that was allocated. We also don't necessarily need to unmap each sgl entry, which was previously being attempted unconditionally. Signed-off-by: Keith Busch Signed-off-by: Christoph Hellwig commit 528589947c1802b9357c2a9b96d88cc4a11cd88b Author: Mohamed Khalfella Date: Fri Jul 25 13:50:05 2025 -0700 nvmet: initialize discovery subsys after debugfs is initialized During nvme target initialization discovery subsystem is initialized before "nvmet" debugfs directory is created. This results in discovery subsystem debugfs directory to be created in debugfs root directory. nvmet_init() -> nvmet_init_discovery() -> nvmet_subsys_alloc() -> nvmet_debugfs_subsys_setup() In other words, the codepath above is exeucted before nvmet_debugfs is created. We get /sys/kernel/debug/nqn.2014-08.org.nvmexpress.discovery instead of /sys/kernel/debug/nvmet/nqn.2014-08.org.nvmexpress.discovery. Move nvmet_init_discovery() call after nvmet_init_debugfs() to fix it. Fixes: 649fd41420a8 ("nvmet: add debugfs support") Signed-off-by: Mohamed Khalfella Reviewed-by: Chaitanya Kulkarni Reviewed-by: Hannes Reinecke Reviewed-by: Daniel Wagner Signed-off-by: Christoph Hellwig commit e715b8733df60aa3280ab3e0de0560c8a72c5c1d Author: Kamaljit Singh Date: Mon Jul 21 10:36:59 2025 -0700 nvme: add capability to connect to an administrative controller Add capability to connect to an administrative controller by preventing ioq creation for admin-controllers. Add a nvme_admin_ctrl() to check if a controller's CNTRLTYPE indicates that it is an administrative controller and override ctrl->queue_count to 1 for admin controllers, so that only the admin queue and no I/O queues are created for an administrative controller. This override is done in nvme_init_ctrl_finish() after ctrl->cntrltype has been initialized in nvme_init_identify() so nvme_admin_ctrl() will work correctly. Doing this override in generic code (nvme_init_ctrl_finish) makes it transport agnostic and will work properly for nvme/tcp as well as for nvme/rdma. Suggested-by: Niklas Cassel Reviewed-by: Damien Le Moal Reviewed-by: Niklas Cassel Signed-off-by: Kamaljit Singh Signed-off-by: Christoph Hellwig commit c71fc0f457ca1c2cd4dff2d974df724beb14f67e Author: Nitesh Shetty Date: Wed Jul 16 19:09:44 2025 +0530 nvmet: add support for FDP in fabrics passthru path Add support for admin_get_feature FDP(0x1d) feature id, thus enabling FDP at the initiator side for the target controller and namespaces attached to it. Signed-off-by: Nitesh Shetty Signed-off-by: Christoph Hellwig commit 40a826bd6c82ae45cfd3a19cd2a60a10f56b74c0 Author: Petr Pavlu Date: Mon Jun 30 16:32:36 2025 +0200 module: Rename MAX_PARAM_PREFIX_LEN to __MODULE_NAME_LEN The maximum module name length (MODULE_NAME_LEN) is somewhat confusingly defined in terms of the maximum parameter prefix length (MAX_PARAM_PREFIX_LEN), when in fact the dependency is in the opposite direction. This split originates from commit 730b69d22525 ("module: check kernel param length at compile time, not runtime"). The code needed to use MODULE_NAME_LEN in moduleparam.h, but because module.h requires moduleparam.h, this created a circular dependency. It was resolved by introducing MAX_PARAM_PREFIX_LEN in moduleparam.h and defining MODULE_NAME_LEN in module.h in terms of MAX_PARAM_PREFIX_LEN. Rename MAX_PARAM_PREFIX_LEN to __MODULE_NAME_LEN for clarity. This matches the similar approach of defining MODULE_INFO in module.h and __MODULE_INFO in moduleparam.h. Signed-off-by: Petr Pavlu Reviewed-by: Daniel Gomez Link: https://lore.kernel.org/r/20250630143535.267745-6-petr.pavlu@suse.com Signed-off-by: Daniel Gomez commit a7c54b2b41dd1f6ec780e7fbfb13f70c64c9731d Author: Petr Pavlu Date: Mon Jun 30 16:32:35 2025 +0200 tracing: Replace MAX_PARAM_PREFIX_LEN with MODULE_NAME_LEN Use the MODULE_NAME_LEN definition in module_exists() to obtain the maximum size of a module name, instead of using MAX_PARAM_PREFIX_LEN. The values are the same but MODULE_NAME_LEN is more appropriate in this context. MAX_PARAM_PREFIX_LEN was added in commit 730b69d22525 ("module: check kernel param length at compile time, not runtime") only to break a circular dependency between module.h and moduleparam.h, and should mostly be limited to use in moduleparam.h. Signed-off-by: Petr Pavlu Cc: Steven Rostedt Cc: Masami Hiramatsu Reviewed-by: Daniel Gomez Acked-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20250630143535.267745-5-petr.pavlu@suse.com Signed-off-by: Daniel Gomez commit bdc877ba6b7ff1b6d2ebeff11e63da4a50a54854 Author: Petr Pavlu Date: Mon Jun 30 16:32:34 2025 +0200 module: Restore the moduleparam prefix length check The moduleparam code allows modules to provide their own definition of MODULE_PARAM_PREFIX, instead of using the default KBUILD_MODNAME ".". Commit 730b69d22525 ("module: check kernel param length at compile time, not runtime") added a check to ensure the prefix doesn't exceed MODULE_NAME_LEN, as this is what param_sysfs_builtin() expects. Later, commit 58f86cc89c33 ("VERIFY_OCTAL_PERMISSIONS: stricter checking for sysfs perms.") removed this check, but there is no indication this was intentional. Since the check is still useful for param_sysfs_builtin() to function properly, reintroduce it in __module_param_call(), but in a modernized form using static_assert(). While here, clean up the __module_param_call() comments. In particular, remove the comment "Default value instead of permissions?", which comes from commit 9774a1f54f17 ("[PATCH] Compile-time check re world-writeable module params"). This comment was related to the test variable __param_perm_check_##name, which was removed in the previously mentioned commit 58f86cc89c33. Fixes: 58f86cc89c33 ("VERIFY_OCTAL_PERMISSIONS: stricter checking for sysfs perms.") Signed-off-by: Petr Pavlu Reviewed-by: Daniel Gomez Link: https://lore.kernel.org/r/20250630143535.267745-4-petr.pavlu@suse.com Signed-off-by: Daniel Gomez commit 6c171b2ccfe677ca97fc5334f853807959f26589 Author: Petr Pavlu Date: Mon Jun 30 16:32:33 2025 +0200 module: Remove unnecessary +1 from last_unloaded_module::name size The variable last_unloaded_module::name tracks the name of the last unloaded module. It is a string copy of module::name, which is MODULE_NAME_LEN bytes in size and includes the NUL terminator. Therefore, the size of last_unloaded_module::name can also be just MODULE_NAME_LEN, without the need for an extra byte. Fixes: e14af7eeb47e ("debug: track and print last unloaded module in the oops trace") Signed-off-by: Petr Pavlu Reviewed-by: Daniel Gomez Link: https://lore.kernel.org/r/20250630143535.267745-3-petr.pavlu@suse.com Signed-off-by: Daniel Gomez commit a6323bd4e611567913e23df5b58f2d4e4da06789 Author: Petr Pavlu Date: Mon Jun 30 16:32:32 2025 +0200 module: Prevent silent truncation of module name in delete_module(2) Passing a module name longer than MODULE_NAME_LEN to the delete_module syscall results in its silent truncation. This really isn't much of a problem in practice, but it could theoretically lead to the removal of an incorrect module. It is more sensible to return ENAMETOOLONG or ENOENT in such a case. Update the syscall to return ENOENT, as documented in the delete_module(2) man page to mean "No module by that name exists." This is appropriate because a module with a name longer than MODULE_NAME_LEN cannot be loaded in the first place. Signed-off-by: Petr Pavlu Reviewed-by: Daniel Gomez Link: https://lore.kernel.org/r/20250630143535.267745-2-petr.pavlu@suse.com Signed-off-by: Daniel Gomez commit 768da2eae8662ca51102794c32d37c17410acbf5 Author: Thomas Weißschuh Date: Fri Jul 11 15:31:38 2025 +0200 kunit: test: Drop CONFIG_MODULE ifdeffery The function stubs exposed by module.h allow the code to compile properly without the ifdeffery. The generated object code stays the same, as the compiler can optimize away all the dead code. As the code is still typechecked developer errors can be detected faster. Signed-off-by: Thomas Weißschuh Acked-by: David Gow Reviewed-by: Daniel Gomez Link: https://lore.kernel.org/r/20250711-kunit-ifdef-modules-v2-3-39443decb1f8@linutronix.de Signed-off-by: Daniel Gomez commit 818783c804bc051f7faf0ac226b5597f8259c6f8 Author: Thomas Weißschuh Date: Fri Jul 11 15:31:37 2025 +0200 module: make structure definitions always visible To write code that works with both CONFIG_MODULES=y and CONFIG_MODULES=n it is convenient to use "if (IS_ENABLED(CONFIG_MODULES))" over raw #ifdef. The code will still fully typechecked but the unreachable parts are discarded by the compiler. This prevents accidental breakage when a certain kconfig combination was not specifically tested by the developer. This pattern is already supported to some extend by module.h defining empty stub functions if CONFIG_MODULES=n. However some users of module.h work on the structured defined by module.h. Therefore these structure definitions need to be visible, too. Many structure members are still gated by specific configuration settings. The assumption for those is that the code using them will be gated behind the same configuration setting anyways. Signed-off-by: Thomas Weißschuh Reviewed-by: Daniel Gomez Link: https://lore.kernel.org/r/20250711-kunit-ifdef-modules-v2-2-39443decb1f8@linutronix.de Signed-off-by: Daniel Gomez commit 199d9ffb31650f948dd342ade1c1b920e157630f Author: Thomas Weißschuh Date: Fri Jul 11 15:31:36 2025 +0200 module: move 'struct module_use' to internal.h The struct was moved to the public header file in commit c8e21ced08b3 ("module: fix kdb's illicit use of struct module_use."). Back then the structure was used outside of the module core. Nowadays this is not true anymore, so the structure can be made internal. Signed-off-by: Thomas Weißschuh Reviewed-by: Daniel Gomez Reviewed-by: Petr Pavlu Link: https://lore.kernel.org/r/20250711-kunit-ifdef-modules-v2-1-39443decb1f8@linutronix.de Signed-off-by: Daniel Gomez commit 0060beec0bfa647c4b510df188b1c4673a197839 Author: Damien Le Moal Date: Mon Jul 28 13:04:29 2025 +0900 ata: libata-sata: Add link_power_management_supported sysfs attribute A port link power management (LPM) policy can be controlled using the link_power_management_policy sysfs host attribute. However, this attribute exists also for hosts that do not support LPM and in such case, attempting to change the LPM policy for the host (port) will fail with -EOPNOTSUPP. Introduce the new sysfs link_power_management_supported host attribute to indicate to the user if a the port and the devices connected to the port for the host support LPM, which implies that the link_power_management_policy attribute can be used. Since checking that a port and its devices support LPM is common between the new ata_scsi_lpm_supported_show() function and the existing ata_scsi_lpm_store() function, the new helper ata_scsi_lpm_supported() is introduced. Fixes: 413e800cadbf ("ata: libata-sata: Disallow changing LPM state if not supported") Reported-by: Borah, Chaitanya Kumar Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202507251014.a5becc3b-lkp@intel.com Signed-off-by: Damien Le Moal Reviewed-by: Martin K. Petersen commit d2be9ea9a75550a35c5127a6c2633658bc38c76b Author: Damien Le Moal Date: Tue Jul 29 19:37:12 2025 +0900 ata: libata-scsi: Return aborted command when missing sense and result TF ata_gen_ata_sense() is always called for a failed qc missing sense data so that a sense key, code and code qualifier can be generated using ata_to_sense_error() from the qc status and error fields of its result task file. However, if the qc does not have its result task file filled, ata_gen_ata_sense() returns early without setting a sense key. Improve this by defaulting to returning ABORTED COMMAND without any additional sense code, since we do not know the reason for the failure. The same fix is also applied in ata_gen_passthru_sense() with the additional check that the qc failed (qc->err_mask is set). Fixes: 816be86c7993 ("ata: libata-scsi: Check ATA_QCFLAG_RTF_FILLED before using result_tf") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen commit cf3fc037623c54de48d2ec1a1ee686e2d1de2d45 Author: Damien Le Moal Date: Tue Jul 29 18:28:07 2025 +0900 ata: libata-scsi: Fix ata_to_sense_error() status handling Commit 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()") inadvertantly added the entry 0x40 (ATA_DRDY) to the stat_table array in the function ata_to_sense_error(). This entry ties a failed qc which has a status filed equal to ATA_DRDY to the sense key ILLEGAL REQUEST with the additional sense code UNALIGNED WRITE COMMAND. This entry will be used to generate a failed qc sense key and sense code when the qc is missing sense data and there is no match for the qc error field in the sense_table array of ata_to_sense_error(). As a result, for a failed qc for which we failed to get sense data (e.g. read log 10h failed if qc is an NCQ command, or REQUEST SENSE EXT command failed for the non-ncq case, the user very often end up seeing the completely misleading "unaligned write command" error, even if qc was not a write command. E.g.: sd 0:0:0:0: [sda] tag#12 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sd 0:0:0:0: [sda] tag#12 Sense Key : Illegal Request [current] sd 0:0:0:0: [sda] tag#12 Add. Sense: Unaligned write command sd 0:0:0:0: [sda] tag#12 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00 I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 Fix this by removing the ATA_DRDY entry from the stat_table array so that we default to always returning ABORTED COMMAND without any additional sense code, since we do not know any better. The entry 0x08 (ATA_DRQ) is also removed since signaling ABORTED COMMAND with a parity error is also misleading (as a parity error would likely be signaled through a bus error). So for this case, also default to returning ABORTED COMMAND without any additional sense code. With this, the previous example error case becomes: sd 0:0:0:0: [sda] tag#17 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sd 0:0:0:0: [sda] tag#17 Sense Key : Aborted Command [current] sd 0:0:0:0: [sda] tag#17 Add. Sense: No additional sense information sd 0:0:0:0: [sda] tag#17 CDB: Read(10) 28 00 00 00 10 00 00 00 08 00 I/O error, dev sda, sector 4096 op 0x0:(READ) flags 0x80700 phys_seg 1 prio class 0 Together with these fixes, refactor stat_table to make it more readable by putting the entries comments in front of the entries and using the defined status bits macros instead of hardcoded values. Reported-by: Lorenz Brun Reported-by: Brandon Schwartz Fixes: 8ae720449fca ("libata: whitespace fixes in ata_to_sense_error()") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen commit 383cd6d879a18acdaa84c29330b25c49cbc0b490 Author: Colin Ian King Date: Tue Jul 29 07:49:30 2025 +0100 scsi: scsi_debug: Make read-only arrays static const Don't populate the read-only arrays on the stack at run time, instead make them static const. Also reduces overall size. before: text data bss dec hex filename 367439 89582 5952 462973 7107d drivers/scsi/scsi_debug.o after: text data bss dec hex filename 365847 90702 5952 462501 70ea5 drivers/scsi/scsi_debug.o (gcc 14.2.0, x86-64) Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250729064930.1659007-1-colin.i.king@gmail.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 260f6f4fda93c8485c8037865c941b42b9cba5d2 Merge: 63eb28bb140289 711fa2667d8b23 Author: Linus Torvalds Date: Wed Jul 30 19:26:49 2025 -0700 Merge tag 'drm-next-2025-07-30' of https://gitlab.freedesktop.org/drm/kernel Pull drm updates from Dave Airlie: "Highlights: - Intel xe enable Panthor Lake, started adding WildCat Lake - amdgpu has a bunch of reset improvments along with the usual IP updates - msm got VM_BIND support which is important for vulkan sparse memory - more drm_panic users - gpusvm common code to handle a bunch of core SVM work outside drivers. Detail summary: Changes outside drm subdirectory: - 'shrink_shmem_memory()' for better shmem/hibernate interaction - Rust support infrastructure: - make ETIMEDOUT available - add size constants up to SZ_2G - add DMA coherent allocation bindings - mtd driver for Intel GPU non-volatile storage - i2c designware quirk for Intel xe core: - atomic helpers: tune enable/disable sequences - add task info to wedge API - refactor EDID quirks - connector: move HDR sink to drm_display_info - fourcc: half-float and 32-bit float formats - mode_config: pass format info to simplify dma-buf: - heaps: Give CMA heap a stable name ci: - add device tree validation and kunit displayport: - change AUX DPCD access probe address - add quirk for DPCD probe - add panel replay definitions - backlight control helpers fbdev: - make CONFIG_FIRMWARE_EDID available on all arches fence: - fix UAF issues format-helper: - improve tests gpusvm: - introduce devmem only flag for allocation - add timeslicing support to GPU SVM ttm: - improve eviction sched: - tracing improvements - kunit improvements - memory leak fixes - reset handling improvements color mgmt: - add hardware gamma LUT handling helpers bridge: - add destroy hook - switch to reference counted drm_bridge allocations - tc358767: convert to devm_drm_bridge_alloc - improve CEC handling panel: - switch to reference counter drm_panel allocations - fwnode panel lookup - Huiling hl055fhv028c support - Raspberry Pi 7" 720x1280 support - edp: KDC KD116N3730A05, N160JCE-ELL CMN, N116BCJ-EAK - simple: AUO P238HAN01 - st7701: Winstar wf40eswaa6mnn0 - visionox: rm69299-shift - Renesas R61307, Renesas R69328 support - DJN HX83112B hdmi: - add CEC handling - YUV420 output support xe: - WildCat Lake support - Enable PanthorLake by default - mark BMG as SRIOV capable - update firmware recommendations - Expose media OA units - aux-bux support for non-volatile memory - MTD intel-dg driver for non-volatile memory - Expose fan control and voltage regulator in sysfs - restructure migration for multi-device - Restore GuC submit UAF fix - make GEM shrinker drm managed - SRIOV VF Post-migration recovery of GGTT nodes - W/A additions/reworks - Prefetch support for svm ranges - Don't allocate managed BO for each policy change - HWMON fixes for BMG - Create LRC BO without VM - PCI ID updates - make SLPC debugfs files optional - rework eviction rejection of bound external BOs - consolidate PAT programming logic for pre/post Xe2 - init changes for flicker-free boot - Enable GuC Dynamic Inhibit Context switch i915: - drm_panic support for i915/xe - initial flip queue off by default for LNL/PNL - Wildcat Lake Display support - Support for DSC fractional link bpp - Support for simultaneous Panel Replay and Adaptive sync - Support for PTL+ double buffer LUT - initial PIPEDMC event handling - drm_panel_follower support - DPLL interface renames - allocate struct intel_display dynamically - flip queue preperation - abstract DRAM detection better - avoid GuC scheduling stalls - remove DG1 force probe requirement - fix MEI interrupt handler on RT kernels - use backlight control helpers for eDP - more shared display code refactoring amdgpu: - add userq slot to INFO ioctl - SR-IOV hibernation support - Suspend improvements - Backlight improvements - Use scaling for non-native eDP modes - cleaner shader updates for GC 9.x - Remove fence slab - SDMA fw checks for userq support - RAS updates - DMCUB updates - DP tunneling fixes - Display idle D3 support - Per queue reset improvements - initial smartmux support amdkfd: - enable KFD on loongarch - mtype fix for ext coherent system memory radeon: - CS validation additional GL extensions - drop console lock during suspend/resume - bump driver version msm: - VM BIND support - CI: infrastructure updates - UBWC single source of truth - decouple GPU and KMS support - DP: rework I/O accessors - DPU: SM8750 support - DSI: SM8750 support - GPU: X1-45 support and speedbin support for X1-85 - MDSS: SM8750 support nova: - register! macro improvements - DMA object abstraction - VBIOS parser + fwsec lookup - sysmem flush page support - falcon: generic falcon boot code and HAL - FWSEC-FRTS: fb setup and load/execute ivpu: - Add Wildcat Lake support - Add turbo flag ast: - improve hardware generations implementation imx: - IMX8qxq Display Controller support lima: - Rockchip RK3528 GPU support nouveau: - fence handling cleanup panfrost: - MT8370 support - bo labeling - 64-bit register access qaic: - add RAS support rockchip: - convert inno_hdmi to a bridge rz-du: - add RZ/V2H(P) support - MIPI-DSI DCS support sitronix: - ST7567 support sun4i: - add H616 support tidss: - add TI AM62L support - AM65x OLDI bridge support bochs: - drm panic support vkms: - YUV and R* format support - use faux device vmwgfx: - fence improvements hyperv: - move out of simple - add drm_panic support" * tag 'drm-next-2025-07-30' of https://gitlab.freedesktop.org/drm/kernel: (1479 commits) drm/tidss: oldi: convert to devm_drm_bridge_alloc() API drm/tidss: encoder: convert to devm_drm_bridge_alloc() drm/amdgpu: move reset support type checks into the caller drm/amdgpu/sdma7: re-emit unprocessed state on ring reset drm/amdgpu/sdma6: re-emit unprocessed state on ring reset drm/amdgpu/sdma5.2: re-emit unprocessed state on ring reset drm/amdgpu/sdma5: re-emit unprocessed state on ring reset drm/amdgpu/gfx12: re-emit unprocessed state on ring reset drm/amdgpu/gfx11: re-emit unprocessed state on ring reset drm/amdgpu/gfx10: re-emit unprocessed state on ring reset drm/amdgpu/gfx9.4.3: re-emit unprocessed state on kcq reset drm/amdgpu/gfx9: re-emit unprocessed state on kcq reset drm/amdgpu: Add WARN_ON to the resource clear function drm/amd/pm: Use cached metrics data on SMUv13.0.6 drm/amd/pm: Use cached data for min/max clocks gpu: nova-core: fix bounds check in PmuLookupTableEntry::new drm/amdgpu: Replace HQD terminology with slots naming drm/amdgpu: Add user queue instance count in HW IP info drm/amd/amdgpu: Add helper functions for isp buffers drm/amd/amdgpu: Initialize swnode for ISP MFD device ... commit 759dfc7d04bab1b0b86113f1164dc1fec192b859 Author: Fedor Pchelkin Date: Mon Jul 28 11:06:47 2025 +0300 netlink: avoid infinite retry looping in netlink_unicast() netlink_attachskb() checks for the socket's read memory allocation constraints. Firstly, it has: rmem < READ_ONCE(sk->sk_rcvbuf) to check if the just increased rmem value fits into the socket's receive buffer. If not, it proceeds and tries to wait for the memory under: rmem + skb->truesize > READ_ONCE(sk->sk_rcvbuf) The checks don't cover the case when skb->truesize + sk->sk_rmem_alloc is equal to sk->sk_rcvbuf. Thus the function neither successfully accepts these conditions, nor manages to reschedule the task - and is called in retry loop for indefinite time which is caught as: rcu: INFO: rcu_sched self-detected stall on CPU rcu: 0-....: (25999 ticks this GP) idle=ef2/1/0x4000000000000000 softirq=262269/262269 fqs=6212 (t=26000 jiffies g=230833 q=259957) NMI backtrace for cpu 0 CPU: 0 PID: 22 Comm: kauditd Not tainted 5.10.240 #68 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc42 04/01/2014 Call Trace: dump_stack lib/dump_stack.c:120 nmi_cpu_backtrace.cold lib/nmi_backtrace.c:105 nmi_trigger_cpumask_backtrace lib/nmi_backtrace.c:62 rcu_dump_cpu_stacks kernel/rcu/tree_stall.h:335 rcu_sched_clock_irq.cold kernel/rcu/tree.c:2590 update_process_times kernel/time/timer.c:1953 tick_sched_handle kernel/time/tick-sched.c:227 tick_sched_timer kernel/time/tick-sched.c:1399 __hrtimer_run_queues kernel/time/hrtimer.c:1652 hrtimer_interrupt kernel/time/hrtimer.c:1717 __sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1113 asm_call_irq_on_stack arch/x86/entry/entry_64.S:808 netlink_attachskb net/netlink/af_netlink.c:1234 netlink_unicast net/netlink/af_netlink.c:1349 kauditd_send_queue kernel/audit.c:776 kauditd_thread kernel/audit.c:897 kthread kernel/kthread.c:328 ret_from_fork arch/x86/entry/entry_64.S:304 Restore the original behavior of the check which commit in Fixes accidentally missed when restructuring the code. Found by Linux Verification Center (linuxtesting.org). Fixes: ae8f160e7eb2 ("netlink: Fix wraparounds of sk->sk_rmem_alloc.") Cc: stable@vger.kernel.org Signed-off-by: Fedor Pchelkin Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250728080727.255138-1-pchelkin@ispras.ru Signed-off-by: Jakub Kicinski commit de9c4861fb42f0cd72da844c3c34f692d5895b7b Author: Eric Dumazet Date: Tue Jul 29 08:02:07 2025 +0000 pptp: ensure minimal skb length in pptp_xmit() Commit aabc6596ffb3 ("net: ppp: Add bound checking for skb data on ppp_sync_txmung") fixed ppp_sync_txmunge() We need a similar fix in pptp_xmit(), otherwise we might read uninit data as reported by syzbot. BUG: KMSAN: uninit-value in pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 pptp_xmit+0xc34/0x2720 drivers/net/ppp/pptp.c:193 ppp_channel_bridge_input drivers/net/ppp/ppp_generic.c:2290 [inline] ppp_input+0x1d6/0xe60 drivers/net/ppp/ppp_generic.c:2314 pppoe_rcv_core+0x1e8/0x760 drivers/net/ppp/pppoe.c:379 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 pppoe_sendmsg+0x15d/0xcb0 drivers/net/ppp/pppoe.c:904 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0x330/0x3d0 net/socket.c:727 ____sys_sendmsg+0x893/0xd80 net/socket.c:2566 ___sys_sendmsg+0x271/0x3b0 net/socket.c:2620 __sys_sendmmsg+0x2d9/0x7c0 net/socket.c:2709 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+afad90ffc8645324afe5@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/68887d86.a00a0220.b12ec.00cd.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Dawid Osuchowski Link: https://patch.msgid.link/20250729080207.1863408-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3b98c9352511db627b606477fc7944b2fa53a165 Author: Bence Csókás Date: Mon Jul 28 17:34:55 2025 +0200 net: mdio_bus: Use devm for getting reset GPIO Commit bafbdd527d56 ("phylib: Add device reset GPIO support") removed devm_gpiod_get_optional() in favor of the non-devres managed fwnode_get_named_gpiod(). When it was kind-of reverted by commit 40ba6a12a548 ("net: mdio: switch to using gpiod_get_optional()"), the devm functionality was not reinstated. Nor was the GPIO unclaimed on device remove. This leads to the GPIO being claimed indefinitely, even when the device and/or the driver gets removed. Fixes: bafbdd527d56 ("phylib: Add device reset GPIO support") Fixes: 40ba6a12a548 ("net: mdio: switch to using gpiod_get_optional()") Cc: Csaba Buday Signed-off-by: Bence Csókás Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250728153455.47190-2-csokas.bence@prolan.hu Signed-off-by: Jakub Kicinski commit 57ec5a8735dc5dccd1ee68afdb1114956a3fce0d Author: Buday Csaba Date: Mon Jul 28 17:29:16 2025 +0200 net: phy: smsc: add proper reset flags for LAN8710A According to the LAN8710A datasheet (Rev. B, section 3.8.5.1), a hardware reset is required after power-on, and the reference clock (REF_CLK) must be established before asserting reset. Signed-off-by: Buday Csaba Cc: Csókás Bence Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250728152916.46249-2-csokas.bence@prolan.hu Signed-off-by: Jakub Kicinski commit f2aa00e4f65efcf25ff6bc8198e21f031e7b9b1b Author: Luca Weiss Date: Mon Jul 28 10:35:24 2025 +0200 net: ipa: add IPA v5.1 and v5.5 to ipa_version_string() Handle the case for v5.1 and v5.5 instead of returning "0.0". Also reword the comment below since I don't see any evidence of such a check happening, and - since 5.5 has been missing - can happen. Fixes: 3aac8ec1c028 ("net: ipa: add some new IPA versions") Signed-off-by: Luca Weiss Reviewed-by: Dawid Osuchowski Reviewed-by: Alex Elder Link: https://patch.msgid.link/20250728-ipa-5-1-5-5-version_string-v1-1-d7a5623d7ece@fairphone.com Signed-off-by: Jakub Kicinski commit 6fb5ff63b35b7e849cc8510957f25753f87f63d2 Author: Horatiu Vultur Date: Sat Jul 26 16:03:07 2025 +0200 phy: mscc: Fix parsing of unicast frames According to the 1588 standard, it is possible to use both unicast and multicast frames to send the PTP information. It was noticed that if the frames were unicast they were not processed by the analyzer meaning that they were not timestamped. Therefore fix this to match also these unicast frames. Fixes: ab2bf9339357 ("net: phy: mscc: 1588 block initialization") Signed-off-by: Horatiu Vultur Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250726140307.3039694-1-horatiu.vultur@microchip.com Signed-off-by: Jakub Kicinski commit 2da4def0f487f24bbb0cece3bb2bcdcb918a0b72 Author: Jakub Kicinski Date: Fri Jul 25 18:08:46 2025 -0700 netpoll: prevent hanging NAPI when netcons gets enabled Paolo spotted hangs in NIPA running driver tests against virtio. The tests hang in virtnet_close() -> virtnet_napi_tx_disable(). The problem is only reproducible if running multiple of our tests in sequence (I used TEST_PROGS="xdp.py ping.py netcons_basic.sh \ netpoll_basic.py stats.py"). Initial suspicion was that this is a simple case of double-disable of NAPI, but instrumenting the code reveals: Deadlocked on NAPI ffff888007cd82c0 (virtnet_poll_tx): state: 0x37, disabled: false, owner: 0, listed: false, weight: 64 The NAPI was not in fact disabled, owner is 0 (rather than -1), so the NAPI "thinks" it's scheduled for CPU 0 but it's not listed (!list_empty(&n->poll_list) => false). It seems odd that normal NAPI processing would wedge itself like this. Better suspicion is that netpoll gets enabled while NAPI is polling, and also grabs the NAPI instance. This confuses napi_complete_done(): [netpoll] [normal NAPI] napi_poll() have = netpoll_poll_lock() rcu_access_pointer(dev->npinfo) return NULL # no netpoll __napi_poll() ->poll(->weight) poll_napi() cmpxchg(->poll_owner, -1, cpu) poll_one_napi() set_bit(NAPI_STATE_NPSVC, ->state) napi_complete_done() if (NAPIF_STATE_NPSVC) return false # exit without clearing SCHED This feels very unlikely, but perhaps virtio has some interactions with the hypervisor in the NAPI ->poll that makes the race window larger? Best I could to to prove the theory was to add and trigger this warning in napi_poll (just before netpoll_poll_unlock()): WARN_ONCE(!have && rcu_access_pointer(n->dev->npinfo) && napi_is_scheduled(n) && list_empty(&n->poll_list), "NAPI race with netpoll %px", n); If this warning hits the next virtio_close() will hang. This patch survived 30 test iterations without a hang (without it the longest clean run was around 10). Credit for triggering this goes to Breno's recent netconsole tests. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Paolo Abeni Link: https://lore.kernel.org/c5a93ed1-9abe-4880-a3bb-8d1678018b1d@redhat.com Acked-by: Jason Wang Reviewed-by: Xuan Zhuo Link: https://patch.msgid.link/20250726010846.1105875-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 830118b6390a1e4b3057c9e400da37f9408bd67d Merge: 9063de636cee23 e05c54974a05ab Author: Jakub Kicinski Date: Wed Jul 30 18:02:50 2025 -0700 Merge branch 'net-ethernet-fix-device-leaks' Johan Hovold says: ==================== net: ethernet: fix device leaks This series fixes devices leaks stemming from failure to drop the reference taken by of_find_device_by_node(). ==================== Link: https://patch.msgid.link/20250725171213.880-1-johan@kernel.org Signed-off-by: Jakub Kicinski commit e05c54974a05ab19658433545d6ced88d9075cf0 Author: Johan Hovold Date: Fri Jul 25 19:12:13 2025 +0200 net: ti: icss-iep: fix device and OF node leaks at probe Make sure to drop the references to the IEP OF node and device taken by of_parse_phandle() and of_find_device_by_node() when looking up IEP devices during probe. Drop the bogus additional reference taken on successful lookup so that the device is released correctly by icss_iep_put(). Fixes: c1e0230eeaab ("net: ti: icss-iep: Add IEP driver") Cc: stable@vger.kernel.org # 6.6 Cc: Roger Quadros Signed-off-by: Johan Hovold Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250725171213.880-6-johan@kernel.org Signed-off-by: Jakub Kicinski commit 3e13274ca8750823e8b68181bdf185d238febe0d Author: Johan Hovold Date: Fri Jul 25 19:12:12 2025 +0200 net: mtk_eth_soc: fix device leak at probe The reference count to the WED devices has already been incremented when looking them up using of_find_device_by_node() so drop the bogus additional reference taken during probe. Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)") Cc: stable@vger.kernel.org # 5.19 Cc: Felix Fietkau Signed-off-by: Johan Hovold Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250725171213.880-5-johan@kernel.org Signed-off-by: Jakub Kicinski commit da717540acd34e5056e3fa35791d50f6b3303f55 Author: Johan Hovold Date: Fri Jul 25 19:12:11 2025 +0200 net: gianfar: fix device leak when querying time stamp info Make sure to drop the reference to the ptp device taken by of_find_device_by_node() when querying the time stamping capabilities. Note that holding a reference to the ptp device does not prevent its driver data from going away. Fixes: 7349a74ea75c ("net: ethernet: gianfar_ethtool: get phc index through drvdata") Cc: stable@vger.kernel.org # 4.18 Cc: Yangbo Lu Signed-off-by: Johan Hovold Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250725171213.880-4-johan@kernel.org Signed-off-by: Jakub Kicinski commit 70458f8a6b44daf3ad39f0d9b6d1097c8a7780ed Author: Johan Hovold Date: Fri Jul 25 19:12:10 2025 +0200 net: enetc: fix device and OF node leak at probe Make sure to drop the references to the IERB OF node and platform device taken by of_parse_phandle() and of_find_device_by_node() during probe. Fixes: e7d48e5fbf30 ("net: enetc: add a mini driver for the Integrated Endpoint Register Block") Cc: stable@vger.kernel.org # 5.13 Cc: Vladimir Oltean Signed-off-by: Johan Hovold Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250725171213.880-3-johan@kernel.org Signed-off-by: Jakub Kicinski commit 3fa840230f534385b34a4f39c8dd313fbe723f05 Author: Johan Hovold Date: Fri Jul 25 19:12:09 2025 +0200 net: dpaa: fix device leak when querying time stamp info Make sure to drop the reference to the ptp device taken by of_find_device_by_node() when querying the time stamping capabilities. Note that holding a reference to the ptp device does not prevent its driver data from going away. Fixes: 17ae0b0ee9db ("dpaa_eth: add the get_ts_info interface for ethtool") Cc: stable@vger.kernel.org # 4.19 Cc: Yangbo Lu Signed-off-by: Johan Hovold Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250725171213.880-2-johan@kernel.org Signed-off-by: Jakub Kicinski commit 9063de636cee235bd736ab3e4895e2826e606dea Author: Michal Luczaj Date: Fri Jul 25 12:33:04 2025 +0200 kcm: Fix splice support Flags passed in for splice() syscall should not end up in skb_recv_datagram(). As SPLICE_F_NONBLOCK == MSG_PEEK, kernel gets confused: skb isn't unlinked from a receive queue, while strp_msg::offset and strp_msg::full_len are updated. Unbreak the logic a bit more by mapping both O_NONBLOCK and SPLICE_F_NONBLOCK to MSG_DONTWAIT. This way we align with man splice(2) in regard to errno EAGAIN: SPLICE_F_NONBLOCK was specified in flags or one of the file descriptors had been marked as nonblocking (O_NONBLOCK), and the operation would block. Fixes: 5121197ecc5d ("kcm: close race conditions on sk_receive_queue") Fixes: 91687355b927 ("kcm: Splice support") Signed-off-by: Michal Luczaj Link: https://patch.msgid.link/20250725-kcm-splice-v1-1-9a725ad2ee71@rbox.co Signed-off-by: Jakub Kicinski commit 3b661ca549b9e5bb11d0bc97ada6110aac3282d2 Author: Wolfram Sang Date: Thu Jul 17 14:00:47 2025 +0200 i3c: add missing include to internal header LKP found a random config which failed to build because IO accessors were not defined: In file included from drivers/i3c/master.c:21: drivers/i3c/internals.h: In function 'i3c_writel_fifo': >> drivers/i3c/internals.h:35:9: error: implicit declaration of function 'writesl' [-Werror=implicit-function-declaration] Add the proper header to where the IO accessors are used. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507150208.BZDzzJ5E-lkp@intel.com/ Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250717120046.9022-2-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 63eb28bb1402891b1ad2be02a530f29a9dd7f1cd Merge: 7d767a9528f6d2 196d9e72c4b0bd Author: Linus Torvalds Date: Wed Jul 30 17:14:01 2025 -0700 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull kvm updates from Paolo Bonzini: "ARM: - Host driver for GICv5, the next generation interrupt controller for arm64, including support for interrupt routing, MSIs, interrupt translation and wired interrupts - Use FEAT_GCIE_LEGACY on GICv5 systems to virtualize GICv3 VMs on GICv5 hardware, leveraging the legacy VGIC interface - Userspace control of the 'nASSGIcap' GICv3 feature, allowing userspace to disable support for SGIs w/o an active state on hardware that previously advertised it unconditionally - Map supporting endpoints with cacheable memory attributes on systems with FEAT_S2FWB and DIC where KVM no longer needs to perform cache maintenance on the address range - Nested support for FEAT_RAS and FEAT_DoubleFault2, allowing the guest hypervisor to inject external aborts into an L2 VM and take traps of masked external aborts to the hypervisor - Convert more system register sanitization to the config-driven implementation - Fixes to the visibility of EL2 registers, namely making VGICv3 system registers accessible through the VGIC device instead of the ONE_REG vCPU ioctls - Various cleanups and minor fixes LoongArch: - Add stat information for in-kernel irqchip - Add tracepoints for CPUCFG and CSR emulation exits - Enhance in-kernel irqchip emulation - Various cleanups RISC-V: - Enable ring-based dirty memory tracking - Improve perf kvm stat to report interrupt events - Delegate illegal instruction trap to VS-mode - MMU improvements related to upcoming nested virtualization s390x - Fixes x86: - Add CONFIG_KVM_IOAPIC for x86 to allow disabling support for I/O APIC, PIC, and PIT emulation at compile time - Share device posted IRQ code between SVM and VMX and harden it against bugs and runtime errors - Use vcpu_idx, not vcpu_id, for GA log tag/metadata, to make lookups O(1) instead of O(n) - For MMIO stale data mitigation, track whether or not a vCPU has access to (host) MMIO based on whether the page tables have MMIO pfns mapped; using VFIO is prone to false negatives - Rework the MSR interception code so that the SVM and VMX APIs are more or less identical - Recalculate all MSR intercepts from scratch on MSR filter changes, instead of maintaining shadow bitmaps - Advertise support for LKGS (Load Kernel GS base), a new instruction that's loosely related to FRED, but is supported and enumerated independently - Fix a user-triggerable WARN that syzkaller found by setting the vCPU in INIT_RECEIVED state (aka wait-for-SIPI), and then putting the vCPU into VMX Root Mode (post-VMXON). Trying to detect every possible path leading to architecturally forbidden states is hard and even risks breaking userspace (if it goes from valid to valid state but passes through invalid states), so just wait until KVM_RUN to detect that the vCPU state isn't allowed - Add KVM_X86_DISABLE_EXITS_APERFMPERF to allow disabling interception of APERF/MPERF reads, so that a "properly" configured VM can access APERF/MPERF. This has many caveats (APERF/MPERF cannot be zeroed on vCPU creation or saved/restored on suspend and resume, or preserved over thread migration let alone VM migration) but can be useful whenever you're interested in letting Linux guests see the effective physical CPU frequency in /proc/cpuinfo - Reject KVM_SET_TSC_KHZ for vm file descriptors if vCPUs have been created, as there's no known use case for changing the default frequency for other VM types and it goes counter to the very reason why the ioctl was added to the vm file descriptor. And also, there would be no way to make it work for confidential VMs with a "secure" TSC, so kill two birds with one stone - Dynamically allocation the shadow MMU's hashed page list, and defer allocating the hashed list until it's actually needed (the TDP MMU doesn't use the list) - Extract many of KVM's helpers for accessing architectural local APIC state to common x86 so that they can be shared by guest-side code for Secure AVIC - Various cleanups and fixes x86 (Intel): - Preserve the host's DEBUGCTL.FREEZE_IN_SMM when running the guest. Failure to honor FREEZE_IN_SMM can leak host state into guests - Explicitly check vmcs12.GUEST_DEBUGCTL on nested VM-Enter to prevent L1 from running L2 with features that KVM doesn't support, e.g. BTF x86 (AMD): - WARN and reject loading kvm-amd.ko instead of panicking the kernel if the nested SVM MSRPM offsets tracker can't handle an MSR (which is pretty much a static condition and therefore should never happen, but still) - Fix a variety of flaws and bugs in the AVIC device posted IRQ code - Inhibit AVIC if a vCPU's ID is too big (relative to what hardware supports) instead of rejecting vCPU creation - Extend enable_ipiv module param support to SVM, by simply leaving IsRunning clear in the vCPU's physical ID table entry - Disable IPI virtualization, via enable_ipiv, if the CPU is affected by erratum #1235, to allow (safely) enabling AVIC on such CPUs - Request GA Log interrupts if and only if the target vCPU is blocking, i.e. only if KVM needs a notification in order to wake the vCPU - Intercept SPEC_CTRL on AMD if the MSR shouldn't exist according to the vCPU's CPUID model - Accept any SNP policy that is accepted by the firmware with respect to SMT and single-socket restrictions. An incompatible policy doesn't put the kernel at risk in any way, so there's no reason for KVM to care - Drop a superfluous WBINVD (on all CPUs!) when destroying a VM and use WBNOINVD instead of WBINVD when possible for SEV cache maintenance - When reclaiming memory from an SEV guest, only do cache flushes on CPUs that have ever run a vCPU for the guest, i.e. don't flush the caches for CPUs that can't possibly have cache lines with dirty, encrypted data Generic: - Rework irqbypass to track/match producers and consumers via an xarray instead of a linked list. Using a linked list leads to O(n^2) insertion times, which is hugely problematic for use cases that create large numbers of VMs. Such use cases typically don't actually use irqbypass, but eliminating the pointless registration is a future problem to solve as it likely requires new uAPI - Track irqbypass's "token" as "struct eventfd_ctx *" instead of a "void *", to avoid making a simple concept unnecessarily difficult to understand - Decouple device posted IRQs from VFIO device assignment, as binding a VM to a VFIO group is not a requirement for enabling device posted IRQs - Clean up and document/comment the irqfd assignment code - Disallow binding multiple irqfds to an eventfd with a priority waiter, i.e. ensure an eventfd is bound to at most one irqfd through the entire host, and add a selftest to verify eventfd:irqfd bindings are globally unique - Add a tracepoint for KVM_SET_MEMORY_ATTRIBUTES to help debug issues related to private <=> shared memory conversions - Drop guest_memfd's .getattr() implementation as the VFS layer will call generic_fillattr() if inode_operations.getattr is NULL - Fix issues with dirty ring harvesting where KVM doesn't bound the processing of entries in any way, which allows userspace to keep KVM in a tight loop indefinitely - Kill off kvm_arch_{start,end}_assignment() and x86's associated tracking, now that KVM no longer uses assigned_device_count as a heuristic for either irqbypass usage or MDS mitigation Selftests: - Fix a comment typo - Verify KVM is loaded when getting any KVM module param so that attempting to run a selftest without kvm.ko loaded results in a SKIP message about KVM not being loaded/enabled (versus some random parameter not existing) - Skip tests that hit EACCES when attempting to access a file, and print a "Root required?" help message. In most cases, the test just needs to be run with elevated permissions" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (340 commits) Documentation: KVM: Use unordered list for pre-init VGIC registers RISC-V: KVM: Avoid re-acquiring memslot in kvm_riscv_gstage_map() RISC-V: KVM: Use find_vma_intersection() to search for intersecting VMAs RISC-V: perf/kvm: Add reporting of interrupt events RISC-V: KVM: Enable ring-based dirty memory tracking RISC-V: KVM: Fix inclusion of Smnpm in the guest ISA bitmap RISC-V: KVM: Delegate illegal instruction fault to VS mode RISC-V: KVM: Pass VMID as parameter to kvm_riscv_hfence_xyz() APIs RISC-V: KVM: Factor-out g-stage page table management RISC-V: KVM: Add vmid field to struct kvm_riscv_hfence RISC-V: KVM: Introduce struct kvm_gstage_mapping RISC-V: KVM: Factor-out MMU related declarations into separate headers RISC-V: KVM: Use ncsr_xyz() in kvm_riscv_vcpu_trap_redirect() RISC-V: KVM: Implement kvm_arch_flush_remote_tlbs_range() RISC-V: KVM: Don't flush TLB when PTE is unchanged RISC-V: KVM: Replace KVM_REQ_HFENCE_GVMA_VMID_ALL with KVM_REQ_TLB_FLUSH RISC-V: KVM: Rename and move kvm_riscv_local_tlb_sanitize() RISC-V: KVM: Drop the return value of kvm_riscv_vcpu_aia_init() RISC-V: KVM: Check kvm_riscv_vcpu_alloc_vector_context() return value KVM: arm64: selftests: Add FEAT_RAS EL2 registers to get-reg-list ... commit 7d767a9528f6d203bca5e83faf1b8f2f6af3fc07 Merge: 2be6a7503d32eb 114a2de6fa86d9 Author: Linus Torvalds Date: Wed Jul 30 17:03:49 2025 -0700 Merge tag 'for-linus-6.17-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip Pull xen updates from Juergen Gross: - fix for a UAF in the xen gntdev-dmabuf driver - fix in the xen netfront driver avoiding spurious interrupts - fix in the gntdev driver avoiding a large stack allocation - cleanup removing some dead code - build warning fix - cleanup of the sysfs code in the xen-pciback driver * tag 'for-linus-6.17-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip: xen/netfront: Fix TX response spurious interrupts xen/gntdev: remove struct gntdev_copy_batch from stack xen: fix UAF in dmabuf_exp_from_pages() xen: Remove some deadcode (x) xen-pciback: Replace scnprintf() with sysfs_emit_at() xen/xenbus: fix W=1 build warning in xenbus_va_dev_error function commit 2be6a7503d32eb1d60b4c9c15547a10d4ec9a934 Merge: 4ff261e725d737 c2dbaf0af05193 Author: Linus Torvalds Date: Wed Jul 30 16:41:58 2025 -0700 Merge tag 'trace-unused-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracepoint cleanup from Steven Rostedt: "Remove or hide unused tracepoints Tracepoints take up memory (around 5K per tracepoint) even when they are unused. Changes are being made to detect when a tracepoint is defined but unused and a warning is shown at build. But those changes are not yet ready for inclusion. - Fix some of the unused tracepoints that it detected Some tracepoints were removed and others were hidden by config settings to match the config settings of where they are instantiated. Some tracepoints were moved into architecture specific code as only one architecture used them. - Call the ftrace_test_filter tracepoint in an unreachable if statement The ftrace_test_filter tracepoint which is defined when ftrace selftests are configured and is used to test the filter logic, but the tracepoint is not actually called. It is put into an if statement to not have it get compiled out, but also not warn for not being used" * tag 'trace-unused-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: sched: Hide numa events under CONFIG_NUMA_BALANCING powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 tracing: Call trace_ftrace_test_filter() for the event tracing: arm: arm64: Hide trace events ipi_raise, ipi_entry and ipi_exit binder: Remove unused binder lock events PM: tracing: Hide power_domain_target event under ARCH_OMAP2PLUS PM: tracing: Hide device_pm_callback events under PM_SLEEP PM: tracing: Hide psci_domain_idle events under ARM_PSCI_CPUIDLE PM: cpufreq: powernv/tracing: Move powernv_throttle trace event alarmtimer: Hide alarmtimer_suspend event when RTC_CLASS is not configured tracing, AER: Hide PCIe AER event when PCIEAER is not configured commit 5fa62d4ec49a26c5ce747d6b0c205d6b30396bbc Author: Sakari Ailus Date: Fri Jul 4 10:54:17 2025 +0300 i3c: dw: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250704075417.3218742-1-sakari.ailus@linux.intel.com Signed-off-by: Alexandre Belloni commit 0c2ce4fba48c3d3f5a2e7c8d1f9bb176969e5268 Author: Sakari Ailus Date: Fri Jul 4 10:54:16 2025 +0300 i3c: master: svc: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250704075416.3218647-1-sakari.ailus@linux.intel.com Signed-off-by: Alexandre Belloni commit bc4a09d8e79cadccdd505f47b01903a80bc666e7 Author: Stanley Chu Date: Wed Jul 30 08:37:19 2025 +0800 i3c: master: svc: Fix npcm845 FIFO_EMPTY quirk In a private write transfer, the driver pre-fills the FIFO to work around the FIFO_EMPTY quirk. However, if an IBIWON event occurs, the hardware emits a NACK and the driver initiates a retry. During the retry, driver attempts to pre-fill the FIFO again if there is remaining data, but since the FIFO is already full, this leads to data loss. Check available space in FIFO to prevent overflow. Fixes: 4008a74e0f9b ("i3c: master: svc: Fix npcm845 FIFO empty issue") Signed-off-by: Stanley Chu Link: https://lore.kernel.org/r/20250730003719.1825593-1-yschu@nuvoton.com Signed-off-by: Alexandre Belloni commit d028219a9f1485914492bf373406f6a0e665ace2 Author: Wolfram Sang Date: Thu Jul 24 11:41:43 2025 +0200 i3c: master: Add basic driver for the Renesas I3C controller Add a basic driver for the I3C controller found in Renesas RZ/G3S and G3E SoCs. Support I3C pure busses (tested with two targets) and mixed busses (two I3C devices plus various I2C targets). DAA and communication with temperature sensors worked reliably at various speeds. Missing features such as IBI, HotJoin, and target mode will be added incrementally. Signed-off-by: Wolfram Sang Tested-by: Tommaso Merciai Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250724094146.6443-5-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 94e611b5b9ef3a1d9ba77f41343e95155a5091d2 Author: Tommaso Merciai Date: Thu Jul 24 11:41:42 2025 +0200 dt-bindings: i3c: Add Renesas I3C controller Add Renesas I3C controller which is available in R9A08G045 (RZ/G3S) and R9A09G047 (RZ/G3E) SoCs. Signed-off-by: Tommaso Merciai Signed-off-by: Wolfram Sang Reviewed-by: Rob Herring (Arm) Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250724094146.6443-4-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 8acf1f3bae1ea48949458b67d68a72a95c3244a4 Author: Wolfram Sang Date: Thu Jul 24 11:41:41 2025 +0200 i3c: Add more parameters for controllers to the header Add standard timing value definition from specification. Signed-off-by: Wolfram Sang Tested-by: Tommaso Merciai Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250724094146.6443-3-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 9c0609d685b27a0bb392390680207baa820ed118 Author: Wolfram Sang Date: Thu Jul 24 11:41:40 2025 +0200 i3c: Standardize defines for specification parameters Align existing defines to follow the consistent pattern: I3C_BUS___. Prepare the codebase for adding new parameters and help avoid duplication. Signed-off-by: Wolfram Sang Tested-by: Tommaso Merciai Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250724094146.6443-2-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 5523a466e905b6287b94654ddb364536f2f948cf Author: Arnd Bergmann Date: Fri Jul 25 11:06:03 2025 +0200 i3c: fix module_i3c_i2c_driver() with I3C=n When CONFIG_I3C is disabled and the i3c_i2c_driver_register() happens to not be inlined, any driver calling it still references the i3c_driver instance, which then causes a link failure: x86_64-linux-ld: drivers/hwmon/lm75.o: in function `lm75_i3c_reg_read': lm75.c:(.text+0xc61): undefined reference to `i3cdev_to_dev' x86_64-linux-ld: lm75.c:(.text+0xd25): undefined reference to `i3c_device_do_priv_xfers' x86_64-linux-ld: lm75.c:(.text+0xdd8): undefined reference to `i3c_device_do_priv_xfers' This issue was part of the original i3c code, but only now caused problems when i3c support got added to lm75. Change the 'inline' annotations in the header to '__always_inline' to ensure that the dead-code-elimination pass in the compiler can optimize it out as intended. Fixes: 6071d10413ff ("hwmon: (lm75) add I3C support for P3T1755") Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") Signed-off-by: Arnd Bergmann Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Guenter Roeck Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250725090609.2456262-1-arnd@kernel.org Signed-off-by: Alexandre Belloni commit da9b54708ddf0e76974365854cbec7fd9f1d4709 Author: Krzysztof Kozlowski Date: Sun Jul 13 17:24:12 2025 +0200 i3c: master: cdns: Simplify handling clocks in probe() The two clocks, driver is getting, are not being disabled/re-enabled during runtime of the device. Eliminate one variable in state struct, all error paths and a lot of code from probe() and remove() by using devm_clk_get_enabled(). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250713152411.74917-2-krzysztof.kozlowski@linaro.org Signed-off-by: Alexandre Belloni commit 4ff261e725d7376c12e745fdbe8a33cd6dbd5a83 Merge: d50b07d05ca53f 614384533dfe99 Author: Linus Torvalds Date: Wed Jul 30 16:23:12 2025 -0700 Merge tag 'trace-rv-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull runtime verification updates from Steven Rostedt: - Added Linear temporal logic monitors for RT application Real-time applications may have design flaws causing them to have unexpected latency. For example, the applications may raise page faults, or may be blocked trying to take a mutex without priority inheritance. However, while attempting to implement DA monitors for these real-time rules, deterministic automaton is found to be inappropriate as the specification language. The automaton is complicated, hard to understand, and error-prone. For these cases, linear temporal logic is found to be more suitable. The LTL is more concise and intuitive. - Make printk_deferred() public The new monitors needed access to printk_deferred(). Make them visible for the entire kernel. - Add a vpanic() to allow for va_list to be passed to panic. - Add rtapp container monitor. A collection of monitors that check for common problems with real-time applications that cause unexpected latency. - Add page fault tracepoints to risc-v These tracepoints are necessary to for the RV monitor to run on risc-v. - Fix the behaviour of the rv tool with -s and idle tasks. - Allow the rv tool to gracefully terminate with SIGTERM - Adjusts dot2c not to create lines over 100 columns - Properly order nested monitors in the RV Kconfig file - Return the registration error in all DA monitor instead of 0 - Update and add new sched collection monitors Replace tss and sncid monitors with more complete sts: Not only prove that switches occur in scheduling context and scheduling needs interrupt disabled but also that each call to the scheduler disables interrupts to (optionally) switch. New monitor: nrp Preemption requires need resched which is cleared by any switch (includes a non optimal workaround for /nested/ preemptions) New monitor: sssw suspension requires setting the task to sleepable and, after the switch occurs, the task requires a wakeup to come back to runnable New monitor: opid waking and need-resched operations occur with interrupts and preemption disabled or in IRQ without explicitly disabling preemption" * tag 'trace-rv-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (48 commits) rv: Add opid per-cpu monitor rv: Add nrp and sssw per-task monitors rv: Replace tss and sncid monitors with more complete sts sched: Adapt sched tracepoints for RV task model rv: Retry when da monitor detects race conditions rv: Adjust monitor dependencies rv: Use strings in da monitors tracepoints rv: Remove trailing whitespace from tracepoint string rv: Add da_handle_start_run_event_ to per-task monitors rv: Fix wrong type cast in reactors_show() and monitor_reactor_show() rv: Fix wrong type cast in monitors_show() rv: Remove struct rv_monitor::reacting rv: Remove rv_reactor's reference counter rv: Merge struct rv_reactor_def into struct rv_reactor rv: Merge struct rv_monitor_def into struct rv_monitor rv: Remove unused field in struct rv_monitor_def rv: Return init error when registering monitors verification/rvgen: Organise Kconfig entries for nested monitors tools/dot2c: Fix generated files going over 100 column limit tools/rv: Stop gracefully also on SIGTERM ... commit ba12d5f11d52510e804480c14da850f8c3561b69 Author: Bagas Sanjaya Date: Wed Jul 2 11:04:24 2025 +0700 i3c: Fix i3c_device_do_priv_xfers() kernel-doc indentation Sphinx reports indentation warning on i3c_device_do_priv_xfers() return value list: Documentation/driver-api/i3c/device-driver-api:9: ./drivers/i3c/device.c:31: ERROR: Unexpected indentation. [docutils] Format the list as bullet list to fix the warning. Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250702040424.18577-1-bagasdotme@gmail.com Signed-off-by: Alexandre Belloni commit 6e055b1fb2fc72ad937fc75ac109fe904ce56003 Author: Jorge Marques Date: Tue Jun 24 11:06:06 2025 +0200 i3c: master: dw: Use i3c_writel_fifo() and i3c_readl_fifo() Use common inline i3c_writel_fifo()/i3c_readl_fifo() methods to simplify code since the FIFO of controller is a 32bit width. Signed-off-by: Jorge Marques Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250624-i3c-writesl-readsl-v3-3-63ccf0870f01@analog.com Signed-off-by: Alexandre Belloni commit c20d3fa7049144f519b21616e6020e6939822145 Author: Jorge Marques Date: Tue Jun 24 11:06:05 2025 +0200 i3c: master: cdns: Use i3c_writel_fifo() and i3c_readl_fifo() Use common inline i3c_writel_fifo()/i3c_readl_fifo() methods to simplify code since the FIFO of controller is a 32bit width. Signed-off-by: Jorge Marques Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250624-i3c-writesl-readsl-v3-2-63ccf0870f01@analog.com Signed-off-by: Alexandre Belloni commit 733b439375b494e8a6950ab47d18a4b615b73cb3 Author: Jorge Marques Date: Tue Jun 24 11:06:04 2025 +0200 i3c: master: Add inline i3c_readl_fifo() and i3c_writel_fifo() The I3C abstraction expects u8 buffers, but some controllers operate with a 32-bit bus width FIFO and cannot flag valid bytes individually. To avoid reading or writing outside the buffer bounds, use 32-bit accesses where possible and apply memcpy for any remaining bytes Signed-off-by: Jorge Marques Suggested-by: Wolfram Sang Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250624-i3c-writesl-readsl-v3-1-63ccf0870f01@analog.com Signed-off-by: Alexandre Belloni commit d50b07d05ca53fdb6c6d1581b9084c09d4e98f54 Merge: 90a871f74b7002 6443cdf567a900 Author: Linus Torvalds Date: Wed Jul 30 16:16:58 2025 -0700 Merge tag 'trace-ringbuffer-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ring-buffer updates from Steven Rostedt: - Rewind persistent ring buffer on boot When the persistent ring buffer is being used for live kernel tracing and the system crashes, the tool that is reading the trace may not have recorded the data when the system crashed. Although the persistent ring buffer still has that data, when reading it after a reboot, it will start where it left off. That is, what was read will not be accessible. Instead, on reboot, have the persistent ring buffer restart where the data starts and this will allow the tooling to recover what was lost when the crash occurred. - Remove the ring_buffer_read_prepare_sync() logic Reading the trace file required stopping writing to the ring buffer as the trace file is only an iterator and does not consume what it read. It was originally not safe to read the ring buffer in this mode and required disabling writing. The ring_buffer_read_prepare_sync() logic was used to stop each per_cpu ring buffer, call synchronize_rcu() and then start the iterator. This was used instead of calling synchronize_rcu() for each per_cpu buffer. Today, the iterator has been updated where it is safe to read the trace file while writing to the ring buffer is still occurring. There is no more need to do this synchronization and it is causing large delays on machines with many CPUs. Remove this unneeded synchronization. - Make static string array a constant in show_irq_str() Making the string array into a constant has shown to decrease code text/data size. * tag 'trace-ringbuffer-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Make the const read-only 'type' static ring-buffer: Remove ring_buffer_read_prepare_sync() tracing: ring_buffer: Rewind persistent ring buffer on reboot commit 90a871f74b70027779a4f312c0c74b6a89e22412 Merge: 2223228bb1c060 4d6d0a6263babf Author: Linus Torvalds Date: Wed Jul 30 16:04:10 2025 -0700 Merge tag 'ftrace-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ftrace updates from Steven Rostedt: - Keep track of when fgraph_ops are registered or not Keep accounting of when fgraph_ops are registered as if a fgraph_ops is registered twice it can mess up the accounting and it will not work as expected later. Trigger a warning if something registers it twice as to catch bugs before they are found by things just not working as expected. - Make DYNAMIC_FTRACE always enabled for architectures that support it As static ftrace (where all functions are always traced) is very expensive and only exists to help architectures support ftrace, do not make it an option. As soon as an architecture supports DYNAMIC_FTRACE make it use it. This simplifies the code. - Remove redundant config HAVE_FTRACE_MCOUNT_RECORD The CONFIG_HAVE_FTRACE_MCOUNT was added to help simplify the DYNAMIC_FTRACE work, but now every architecture that implements DYNAMIC_FTRACE also has HAVE_FTRACE_MCOUNT set too, making it redundant with the HAVE_DYNAMIC_FTRACE. - Make pid_ptr string size match the comment In print_graph_proc() the pid_ptr string is of size 11, but the comment says /* sign + log10(MAX_INT) + '\0' */ which is actually 12. * tag 'ftrace-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Remove redundant config HAVE_FTRACE_MCOUNT_RECORD ftrace: Make DYNAMIC_FTRACE always enabled for architectures that support it fgraph: Keep track of when fgraph_ops are registered or not fgraph: Make pid_str size match the comment commit 2223228bb1c0608f24cf1d67d1177b0137a2f33b Merge: b7dbc2e813e00d a5e71638ddd7f1 Author: Linus Torvalds Date: Wed Jul 30 15:59:36 2025 -0700 Merge tag 'ktest-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest Pull ktest updates from Steven Rostedt: - Add new -D option that allows to override variables and options For example: ./ktest.pl -DPATCH_START:=HEAD~1 -DOUTPUT_DIR=/work/build/urgent config The above sets the variable "PATCH_START" to HEAD~1 and the OUTPUT_DIR option to "/work/build/urgent". This is useful because currently the only way to make a slight change to a config file is by modifying that config file. For one time changes, this can be annoying. Having a way to do a one time override from the command line simplifies the workflow. Temp variables (PATCH_START) will override every temp variable in the config file, whereas options will act like a normal OVERRIDE option and will only affect the session they define. -DBUILD_OUTPUT=/work/git/linux.git Replaces the default BUILD_OUTPUT option. '-DBUILD_OUTPUT[2]=/work/git/linux.git' Only replaces the BUILD_OUTPUT variable for test #2. - If an option contains itself, just drop it instead of going into an infinite loop and failing to parse (it doesn't crash, it detects the recursion after 100 iterations anyway). Some configs may define a variable with the same name as the option: ADD_CONFIG := $(ADD_CONFIG) But if the option doesn't exist, it the above will fail to parse. In these cases, just ignore evaluating the option inside the definition of another option if it has the same name. - Display the BUILD_DIR and OUTPUT_DIR options at the start of every test It is useful to know which kernel source and what destination a test is using when it starts, in case a mistake is made. This makes it easier to abort the test if the wrong source or destination is being used instead of waiting until the test completes. - Add new PATCHCHECK_SKIP option When testing a series of commits that also includes changes to the Linux tools directory, it is useless to test the changes in tools as they may not affect the kernel itself. Doing tests on the kernel for changes that do not affect the kernel is a waste of time. Add a PATCHCHECK_SKIP that takes a series of shas that will be skipped while doing the individual commit tests. * tag 'ktest-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-ktest: ktest.pl: Add new PATCHCHECK_SKIP option to skip testing individual commits ktest.pl: Always display BUILD_DIR and OUTPUT_DIR at the start of tests ktest.pl: Prevent recursion of default variable options ktest.pl: Have -D option work without a space ktest.pl: Allow command option -D to override temp variables ktest.pl: Add -D option to override options commit 79aef1a3705bbc95b36dad892af1f313490bd65c Author: Bagas Sanjaya Date: Wed Jul 30 08:31:13 2025 +0700 of: Clarify OF device context in of_match_device() comment Open Firmware abbreviation (OF) in of_match_device() comment is written in lowercase instead, which is mistaken for prepositional word "of" ([1], [2], [3], [4]) duplicate. Clarify the context. Link: https://lore.kernel.org/all/CAL_JsqLypcBCOVZ8yYWK0J_xc2Vcr+ANrX_3v4vN55Srp4RknQ@mail.gmail.com/ [1] Link: https://lore.kernel.org/all/20220926185852.GA2581083-robh@kernel.org/ [2] Link: https://lore.kernel.org/all/CAL_JsqL4GvgFYzGUfhW5pvm4wYGrFaj6gHOYZjnOMuk2zCz67w@mail.gmail.com/ [3] Link: https://lore.kernel.org/all/20220627173825.GA2637590-robh@kernel.org/ [4] Signed-off-by: Bagas Sanjaya Reviewed-by: Randy Dunlap Link: https://lore.kernel.org/r/20250730013113.11264-1-bagasdotme@gmail.com Signed-off-by: Rob Herring (Arm) commit b7dbc2e813e00d61e66fc0267599441493774b93 Merge: a03eec74201251 133c302a0c60bc Author: Linus Torvalds Date: Wed Jul 30 15:38:01 2025 -0700 Merge tag 'probes-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes updates from Masami Hiramatsu: "Stack usage reduction for probe events: - Allocate string buffers from the heap for uprobe, eprobe, kprobe, and fprobe events to avoid stack overflow - Allocate traceprobe_parse_context from the heap to prevent potential stack overflow - Fix a typo in the above commit New features for eprobe and tprobe events: - Add support for arrays in eprobes - Support multiple tprobes on the same tracepoint Improve efficiency: - Register fprobe-events only when it is enabled to reduce overhead - Register tracepoints for tprobe events only when enabled to resolve a lock dependency Code Cleanup: - Add kerneldoc for traceprobe_parse_event_name() and __get_insn_slot() - Sort #include alphabetically in the probes code - Remove the unused 'mod' field from the tprobe-event - Clean up the entry-arg storing code in probe-events Selftest update - Enable fprobe events before checking enable_functions in selftests" * tag 'probes-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: trace_fprobe: Fix typo of the semicolon tracing: Have eprobes handle arrays tracing: probes: Add a kerneldoc for traceprobe_parse_event_name() tracing: uprobe-event: Allocate string buffers from heap tracing: eprobe-event: Allocate string buffers from heap tracing: kprobe-event: Allocate string buffers from heap tracing: fprobe-event: Allocate string buffers from heap tracing: probe: Allocate traceprobe_parse_context from heap tracing: probes: Sort #include alphabetically kprobes: Add missing kerneldoc for __get_insn_slot tracing: tprobe-events: Register tracepoint when enable tprobe event selftests: tracing: Enable fprobe events before checking enable_functions tracing: fprobe-events: Register fprobe-events only when it is enabled tracing: tprobe-events: Support multiple tprobes on the same tracepoint tracing: tprobe-events: Remove mod field from tprobe-event tracing: probe-events: Cleanup entry-arg storing code commit a03eec74201251635dede6eb2c3f79c350863d7f Merge: 9bfdba946f30d5 a3e892ab0fc287 Author: Linus Torvalds Date: Wed Jul 30 15:35:57 2025 -0700 Merge tag 'probes-fixes-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes fix from Masami Hiramatsu: - Fix a potential infinite recursion in fprobe by using preempt_*_notrace() * tag 'probes-fixes-v6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: fprobe: Fix infinite recursion using preempt_*_notrace() commit 9bfdba946f30d5cbf2257932a53682c0ad1aeb37 Merge: e8d780dcd957d8 6ed5e20466c79e Author: Linus Torvalds Date: Wed Jul 30 15:05:05 2025 -0700 Merge tag 'bootconfig-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull bootconfig updates from Masami Hiramatsu: - tools/bootconfig: - Fix unaligned access when building footer to avoid SIGBUS - Cleanup bootconfig footer size calculations - test scripts: - Fix to add shebang for a test script - Improve script portability using portable commands - Improve script portability using printf instead of echo - Enclose regex with quotes for syntax highlighter * tag 'bootconfig-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: bootconfig: Fix unaligned access when building footer tools/bootconfig: scripts/ftrace.sh was missing the shebang line, so added it tools/bootconfig: Cleanup bootconfig footer size calculations tools/bootconfig: Replace some echo with printf for more portability tools/bootconfig: Improve portability tools: bootconfig: Regex enclosed with quotes to make syntax highlight proper commit 022245067f07ab913d27054ee9e1fab45256acd5 Author: Jan Polensky Date: Fri Jul 25 19:08:01 2025 +0200 perf test: Ensure lock contention using pipe mode The 'kernel lock contention analysis test' requires reliable triggering of lock contention. On some systems, previous benchmark calls failed to generate sufficient contention due to low system activity or resource limits. This patch adds the -p (pipe) option to all calls of perf bench sched messaging, ensuring consistent lock contention without relying on socket-based communication. Suggested-by: Thomas Richter Signed-off-by: Jan Polensky Link: https://lore.kernel.org/r/20250725170801.3176678-1-japo@linux.ibm.com Signed-off-by: Namhyung Kim commit f62408efc8669b82541295a4611494c8c8c52684 Author: Lukasz Laguna Date: Tue Jul 29 14:34:37 2025 +0200 drm/xe/vf: Disable CSC support on VF CSC is not accessible by VF drivers, so disable its support flag on VF to prevent further initialization attempts. Fixes: e02cea83d32d ("drm/xe/gsc: add Battlemage support") Signed-off-by: Lukasz Laguna Cc: Alexander Usyskin Cc: Michal Wajdeczko Reviewed-by: Michal Wajdeczko Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250729123437.5933-1-lukasz.laguna@intel.com (cherry picked from commit 552dbba1caaf0cb40ce961806d757615e26ec668) Signed-off-by: Rodrigo Vivi commit e8d780dcd957d80725ad5dd00bab53b856429bc0 Merge: 2db4df0c09eeb2 8185696483dcb2 Author: Linus Torvalds Date: Wed Jul 30 11:32:38 2025 -0700 Merge tag 'slab-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab Pull slab updates from Vlastimil Babka: - Convert struct slab to its own flags instead of referencing page flags, which is another preparation step before separating it from struct page completely. Along with that, a bunch of documentation fixes and cleanups (Matthew Wilcox) - Convert large kmalloc to use frozen pages in order to be consistent with non-large kmalloc slabs (Vlastimil Babka) - MAINTAINERS updates (Matthew Wilcox, Lorenzo Stoakes) - Restore NUMA policy support for large kmalloc, broken by mistake in v6.1 (Vlastimil Babka) * tag 'slab-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vbabka/slab: MAINTAINERS: add missing files to slab section slab: Update MAINTAINERS entry memcg_slabinfo: Fix use of PG_slab kfence: Remove mention of PG_slab vmcoreinfo: Remove documentation of PG_slab and PG_hugetlb doc: Add slab internal kernel-doc slub: Fix a documentation build error for krealloc() slab: Add SL_pfmemalloc flag slab: Add SL_partial flag slab: Rename slab->__page_flags to slab->flags doc: Move SLUB documentation to the admin guide mm, slab: use frozen pages for large kmalloc mm, slab: restore NUMA policy support for large kmalloc commit 2db4df0c09eeb209726261f43fc556360b38ec99 Merge: 7dff275c663178 cc1d1365f0f414 Author: Linus Torvalds Date: Wed Jul 30 11:01:41 2025 -0700 Merge tag 'rcu.release.v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux Pull RCU updates from Neeraj Upadhyay: "Expedited grace period updates: - Protect against early RCU exp quiescent state reporting during exp grace period initialization - Remove superfluous barrier in task unblock path - Remove the CPU online quiescent state report optimization, which is error prone for certain scenarios - Add warning for unexpected pending requested expedited quiescent state on dying CPU Core: - Robustify rcu_is_cpu_rrupt_from_idle() by using more accurate indicators of the actual context tracking state of a CPU - Handle ->defer_qs_iw_pending field data race - Enable rcu_normal_wake_from_gp by default on systems with <= 16 CPUs - Fix lockup in rcu_read_unlock() due to recursive irq_exit() calls - Refactor expedited handling condition in rcu_read_unlock_special() - Documentation updates for hotplug and GP init scan ordering, separation of rcu_state and rnp's gp_seq states, quiescent state reporting for offline CPUs torture-scripts: - Cleanup and improve scripts : remove superfluous warnings for disabled tests; better handling of kvm.sh --kconfig arg; suppress some confusing diagnostics; tolerate bad kvm.sh args; add new diagnostic for build output; fail allmodconfig testing on warnings - Include RCU_TORTURE_TEST_CHK_RDR_STATE config for KCSAN kernels - Disable default RCU-tasks and clocksource-wdog testing on arm64 - Add EXPERT Kconfig option for arm64 KCSAN runs - Remove SRCU-lite testing rcutorture: - Start torture writer threads creation after reader threads to handle race in SRCU-P scenario - Add SRCU down_read()/up_read() test - Add diagnostics for delayed SRCU up_read(), unmatched up_read(), print number of up/down readers and the number of such readers which migrated to other CPU - Ignore certain unsupported configurations for trivial RCU test - Fix splats in RT kernels due to inaccurate checks for BH-disabled context - Enable checks and logs to capture intentionally exercised unexpected scenarios (too short readers) for BUSTED test - Remove SRCU-lite testing srcu: - Expedite SRCU-fast grace periods - Remove SRCU-lite implementation - Add guards for SRCU-fast readers rcu nocb: - Dump NOCB group leader state on stall detection - Robustify nocb_cb_kthread pointer accesses - Fix delayed execution of hurry callbacks when LAZY_RCU is enabled refscale: - Fix multiplication overflow in "loops" and "nreaders" calculations" * tag 'rcu.release.v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux: (49 commits) rcu: Document concurrent quiescent state reporting for offline CPUs rcu: Document separation of rcu_state and rnp's gp_seq rcu: Document GP init vs hotplug-scan ordering requirements srcu: Add guards for SRCU-fast readers rcu: Fix delayed execution of hurry callbacks rcu: Refactor expedited handling check in rcu_read_unlock_special() checkpatch: Remove SRCU-lite deprecation srcu: Remove SRCU-lite implementation srcu: Expedite SRCU-fast grace periods rcutorture: Remove support for SRCU-lite rcutorture: Remove SRCU-lite scenarios torture: Remove support for SRCU-lite torture: Make torture.sh --allmodconfig testing fail on warnings torture: Add "ERROR" diagnostic for testing kernel-build output torture: Make torture.sh tolerate runs having bad kvm.sh arguments torture: Add textid.txt file to --do-allmodconfig and --do-rcu-rust runs torture: Extract testid.txt generation to separate script torture: Suppress "find" diagnostics from torture.sh --do-none run torture: Provide EXPERT Kconfig option for arm64 KCSAN torture.sh runs rcu: Fix rcu_read_unlock() deadloop due to IRQ work ... commit 7dff275c663178e9a12a0c0038e4b3be2f3edcba Merge: 53564f400572b1 9872916ad1a1a5 Author: Linus Torvalds Date: Wed Jul 30 11:00:28 2025 -0700 Merge tag 'kcsan-20250728-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux Pull Kernel Concurrency Sanitizer (KCSAN) update from Marco Elver: - A single fix to silence an uninitialized variable warning * tag 'kcsan-20250728-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/melver/linux: kcsan: test: Initialize dummy variable commit 196d9e72c4b0bd68b74a4ec7f52d248f37d0f030 Merge: 6836e1f30fe90e 57d88f02eb4449 Author: Paolo Bonzini Date: Wed Jul 30 13:56:09 2025 -0400 Merge tag 'kvm-s390-next-6.17-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD RCU wakeup fix for KVM s390 guest entry commit 53564f400572b1b8d9ee5bafb9c226eb1d38600a Merge: d9104cec3e8fe4 b9e6e8ae0a5f9e Author: Linus Torvalds Date: Wed Jul 30 10:42:00 2025 -0700 Merge tag 'iommu-updates-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux Pull iommu updates from Will Deacon: "Core: - Remove the 'pgsize_bitmap' member from 'struct iommu_ops' - Convert the x86 drivers over to msi_create_parent_irq_domain() AMD-Vi: - Add support for examining driver/device internals via debugfs - Add support for "HATDis" to disable host translation when it is not supported - Add support for limiting the maximum host translation level based on EFR[HATS] Apple DART: - Don't enable as built-in by default when ARCH_APPLE is selected Arm SMMU: - Devicetree bindings update for the Qualcomm SMMU in the "Milos" SoC - Support for Qualcomm SM6115 MDSS parts - Disable PRR on Qualcomm SM8250 as using these bits causes the hypervisor to explode Intel VT-d: - Reorganize Intel VT-d to be ready for iommupt - Optimize iotlb_sync_map for non-caching/non-RWBF modes - Fix missed PASID in dev TLB invalidation in cache_tag_flush_all() Mediatek: - Fix build warnings when W=1 Samsung Exynos: - Add support for reserved memory regions specified by the bootloader TI OMAP: - Use syscon_regmap_lookup_by_phandle_args() instead of parsing the node manually Misc: - Cleanups and minor fixes across the board" * tag 'iommu-updates-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/iommu/linux: (48 commits) iommu/vt-d: Fix UAF on sva unbind with pending IOPFs iommu/vt-d: Make iotlb_sync_map a static property of dmar_domain dt-bindings: arm-smmu: Remove sdm845-cheza specific entry iommu/amd: Fix geometry.aperture_end for V2 tables iommu/amd: Wrap debugfs ABI testing symbols snippets in literal code blocks iommu/amd: Add documentation for AMD IOMMU debugfs support iommu/amd: Add debugfs support to dump IRT Table iommu/amd: Add debugfs support to dump device table iommu/amd: Add support for device id user input iommu/amd: Add debugfs support to dump IOMMU command buffer iommu/amd: Add debugfs support to dump IOMMU Capability registers iommu/amd: Add debugfs support to dump IOMMU MMIO registers iommu/amd: Refactor AMD IOMMU debugfs initial setup dt-bindings: arm-smmu: document the support on Milos iommu/exynos: add support for reserved regions iommu/arm-smmu: disable PRR on SM8250 iommu/arm-smmu-v3: Revert vmaster in the error path iommu/io-pgtable-arm: Remove unused macro iopte_prot iommu/arm-smmu-qcom: Add SM6115 MDSS compatible iommu/qcom: Fix pgsize_bitmap ... commit 907a99c314a5a695e35acff78ac61f4ec950a6d3 Author: Li Nan Date: Tue Jul 22 11:33:40 2025 +0800 md: rename recovery_cp to resync_offset 'recovery_cp' was used to represent the progress of sync, but its name contains recovery, which can cause confusion. Replaces 'recovery_cp' with 'resync_offset' for clarity. Signed-off-by: Li Nan Link: https://lore.kernel.org/linux-raid/20250722033340.1933388-1-linan666@huaweicloud.com Signed-off-by: Yu Kuai commit 948b1fe12005d39e2b49087b50e5ee55c9a8f76f Author: Heming Zhao Date: Mon Jul 28 12:21:40 2025 +0800 md/md-cluster: handle REMOVE message earlier Commit a1fd37f97808 ("md: Don't wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl") introduced a regression in the md_cluster module. (Failed cases 02r1_Manage_re-add & 02r10_Manage_re-add) Consider a 2-node cluster: - node1 set faulty & remove command on a disk. - node2 must correctly update the array metadata. Before a1fd37f97808, on node1, the delay between msg:METADATA_UPDATED (triggered by faulty) and msg:REMOVE was sufficient for node2 to reload the disk info (written by node1). After a1fd37f97808, node1 no longer waits between faulty and remove, causing it to send msg:REMOVE while node2 is still reloading disk info. This often results in node2 failing to remove the faulty disk. == how to trigger == set up a 2-node cluster (node1 & node2) with disks vdc & vdd. on node1: mdadm -CR /dev/md0 -l1 -b clustered -n2 /dev/vdc /dev/vdd --assume-clean ssh node2-ip mdadm -A /dev/md0 /dev/vdc /dev/vdd mdadm --manage /dev/md0 --fail /dev/vdc --remove /dev/vdc check array status on both nodes with "mdadm -D /dev/md0". node1 output: Number Major Minor RaidDevice State - 0 0 0 removed 1 254 48 1 active sync /dev/vdd node2 output: Number Major Minor RaidDevice State - 0 0 0 removed 1 254 48 1 active sync /dev/vdd 0 254 32 - faulty /dev/vdc Fixes: a1fd37f97808 ("md: Don't wait for MD_RECOVERY_NEEDED for HOT_REMOVE_DISK ioctl") Signed-off-by: Heming Zhao Reviewed-by: Su Yue Link: https://lore.kernel.org/linux-raid/20250728042145.9989-1-heming.zhao@suse.com Signed-off-by: Yu Kuai commit 1df1fc845d221eb646539836dbf509eb96b41afd Author: Yu Kuai Date: Wed Jul 30 15:33:21 2025 +0800 md: fix create on open mddev lifetime regression Commit 9e59d609763f ("md: call del_gendisk in control path") moves setting MD_DELETED from __mddev_put() to do_md_stop(), however, for the case create on open, mddev can be freed without do_md_stop(): 1) open md_probe md_alloc_and_put md_alloc mddev_alloc atomic_set(&mddev->active, 1); mddev->hold_active = UNTIL_IOCTL mddev_put atomic_dec_and_test(&mddev->active) if (mddev->hold_active) -> active is 0, hold_active is set md_open mddev_get atomic_inc(&mddev->active); 2) ioctl that is not STOP_ARRAY, for example, GET_ARRAY_INFO: md_ioctl mddev->hold_active = 0 3) close md_release mddev_put(mddev); atomic_dec_and_lock(&mddev->active, &all_mddevs_lock) __mddev_put -> hold_active is cleared, mddev will be freed queue_work(md_misc_wq, &mddev->del_work) Now that MD_DELETED is not set, before mddev is freed by mddev_delayed_delete(), md_open can still succeed and break mddev lifetime, causing mddev->kobj refcount underflow or mddev uaf problem. Fix this problem by setting MD_DELETED before queuing del_work. Reported-by: syzbot+9921e319bd6168140b40@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0012.GAE@google.com/ Reported-by: syzbot+fa3a12519f0d3fd4ec16@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68894408.a00a0220.26d0e1.0013.GAE@google.com/ Fixes: 9e59d609763f ("md: call del_gendisk in control path") Link: https://lore.kernel.org/linux-raid/20250730073321.2583158-1-yukuai1@huaweicloud.com Signed-off-by: Yu Kuai Reviewed-by: Paul Menzel Reviewed-by: Xiao Ni commit 59edbec7a5c70af6c0058e32eb3750bfb8928d7b Author: Arnaldo Carvalho de Melo Date: Wed Jul 30 10:34:20 2025 -0300 perf python: Stop using deprecated PyUnicode_AsString() As noticed while building for Fedora 43: GEN /tmp/build/perf/python/perf.cpython-314-x86_64-linux-gnu.so /git/perf-6.16.0-rc3/tools/perf/util/python.c: In function ‘get_tracepoint_field’: /git/perf-6.16.0-rc3/tools/perf/util/python.c:340:9: error: ‘_PyUnicode_AsString’ is deprecated [-Werror=deprecated-declarations] 340 | const char *str = _PyUnicode_AsString(PyObject_Str(attr_name)); | ^~~~~ In file included from /usr/include/python3.14/unicodeobject.h:1022, from /usr/include/python3.14/Python.h:89, from /git/perf-6.16.0-rc3/tools/perf/util/python.c:2: /usr/include/python3.14/cpython/unicodeobject.h:648:1: note: declared here 648 | _PyUnicode_AsString(PyObject *unicode) | ^~~~~~~~~~~~~~~~~~~ cc1: all warnings being treated as errors error: command '/usr/bin/gcc' failed with exit code 1 Use PyUnicode_AsUTF8() instead and also check if PyObject_Str() fails before doing so. Signed-off-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/aIofXNK8QLtLIaI3@x1 Signed-off-by: Namhyung Kim commit 078cad8212ce4f4ebbafcc0936475b8215e1ca2a Author: Jaegeuk Kim Date: Mon Jul 28 21:37:26 2025 +0000 f2fs: drop inode from the donation list when the last file is closed Let's drop the inode from the donation list when there is no other open file. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d9104cec3e8fe4b458b74709853231385779001f Merge: 8be4d31cb8aaee cd7c97f4584a93 Author: Linus Torvalds Date: Wed Jul 30 09:58:50 2025 -0700 Merge tag 'bpf-next-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Alexei Starovoitov: - Remove usermode driver (UMD) framework (Thomas Weißschuh) - Introduce Strongly Connected Component (SCC) in the verifier to detect loops and refine register liveness (Eduard Zingerman) - Allow 'void *' cast using bpf_rdonly_cast() and corresponding '__arg_untrusted' for global function parameters (Eduard Zingerman) - Improve precision for BPF_ADD and BPF_SUB operations in the verifier (Harishankar Vishwanathan) - Teach the verifier that constant pointer to a map cannot be NULL (Ihor Solodrai) - Introduce BPF streams for error reporting of various conditions detected by BPF runtime (Kumar Kartikeya Dwivedi) - Teach the verifier to insert runtime speculation barrier (lfence on x86) to mitigate speculative execution instead of rejecting the programs (Luis Gerhorst) - Various improvements for 'veristat' (Mykyta Yatsenko) - For CONFIG_DEBUG_KERNEL config warn on internal verifier errors to improve bug detection by syzbot (Paul Chaignon) - Support BPF private stack on arm64 (Puranjay Mohan) - Introduce bpf_cgroup_read_xattr() kfunc to read xattr of cgroup's node (Song Liu) - Introduce kfuncs for read-only string opreations (Viktor Malik) - Implement show_fdinfo() for bpf_links (Tao Chen) - Reduce verifier's stack consumption (Yonghong Song) - Implement mprog API for cgroup-bpf programs (Yonghong Song) * tag 'bpf-next-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (192 commits) selftests/bpf: Migrate fexit_noreturns case into tracing_failure test suite selftests/bpf: Add selftest for attaching tracing programs to functions in deny list bpf: Add log for attaching tracing programs to functions in deny list bpf: Show precise rejected function when attaching fexit/fmod_ret to __noreturn functions bpf: Fix various typos in verifier.c comments bpf: Add third round of bounds deduction selftests/bpf: Test invariants on JSLT crossing sign selftests/bpf: Test cross-sign 64bits range refinement selftests/bpf: Update reg_bound range refinement logic bpf: Improve bounds when s64 crosses sign boundary bpf: Simplify bounds refinement from s32 selftests/bpf: Enable private stack tests for arm64 bpf, arm64: JIT support for private stack bpf: Move bpf_jit_get_prog_name() to core.c bpf, arm64: Fix fp initialization for exception boundary umd: Remove usermode driver framework bpf/preload: Don't select USERMODE_DRIVER selftests/bpf: Fix test dynptr/test_dynptr_memset_xdp_chunks failure selftests/bpf: Fix test dynptr/test_dynptr_copy_xdp failure selftests/bpf: Increase xdp data size for arm64 64K page size ... commit 3dca3d51b933beb3f35a60472ed2110d1bd7046a Author: Bartosz Golaszewski Date: Wed Jul 30 09:14:43 2025 +0200 ARM: s3c/gpio: complete the conversion to new GPIO value setters Commit fb52f3226cab ("ARM: s3c/gpio: use new line value setter callbacks") correctly changed the assignment of the callback but missed the check one liner higher. Change it now too to using the recommended callback as the legacy one is going away soon. Fixes: fb52f3226cab ("ARM: s3c/gpio: use new line value setter callbacks") Signed-off-by: Bartosz Golaszewski Signed-off-by: Arnd Bergmann commit 0018c39d0a36452de835e71a15565a41319ab8aa Merge: 038d61fd642278 0c927d478486fb Author: Arnd Bergmann Date: Wed Jul 30 18:21:31 2025 +0200 Merge tag 'arm-soc/for-6.16/devicetree-fixes' of https://github.com/Broadcom/stblinux into for-next This pull request contains Device Tree fixes for Broadcom ARM-based SoC platforms, please pull the following: - Florian fixes the bcm7445.dtsi file to conform to the brcm,brcm,brcmstb-memc-ddr.yaml binding after 501be7cecec9 ("dt-bindings: memory-controller: Define fallback compatible") * tag 'arm-soc/for-6.16/devicetree-fixes' of https://github.com/Broadcom/stblinux: ARM: dts: broadcom: Fix bcm7445 memory controller compatible Signed-off-by: Arnd Bergmann commit 8be4d31cb8aaeea27bde4b7ddb26e28a89062ebf Merge: 4b290aae788e06 fa582ca7e187a1 Author: Linus Torvalds Date: Wed Jul 30 08:58:55 2025 -0700 Merge tag 'net-next-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next Pull networking updates from Jakub Kicinski: "Core & protocols: - Wrap datapath globals into net_aligned_data, to avoid false sharing - Preserve MSG_ZEROCOPY in forwarding (e.g. out of a container) - Add SO_INQ and SCM_INQ support to AF_UNIX - Add SIOCINQ support to AF_VSOCK - Add TCP_MAXSEG sockopt to MPTCP - Add IPv6 force_forwarding sysctl to enable forwarding per interface - Make TCP validation of whether packet fully fits in the receive window and the rcv_buf more strict. With increased use of HW aggregation a single "packet" can be multiple 100s of kB - Add MSG_MORE flag to optimize large TCP transmissions via sockmap, improves latency up to 33% for sockmap users - Convert TCP send queue handling from tasklet to BH workque - Improve BPF iteration over TCP sockets to see each socket exactly once - Remove obsolete and unused TCP RFC3517/RFC6675 loss recovery code - Support enabling kernel threads for NAPI processing on per-NAPI instance basis rather than a whole device. Fully stop the kernel NAPI thread when threaded NAPI gets disabled. Previously thread would stick around until ifdown due to tricky synchronization - Allow multicast routing to take effect on locally-generated packets - Add output interface argument for End.X in segment routing - MCTP: add support for gateway routing, improve bind() handling - Don't require rtnl_lock when fetching an IPv6 neighbor over Netlink - Add a new neighbor flag ("extern_valid"), which cedes refresh responsibilities to userspace. This is needed for EVPN multi-homing where a neighbor entry for a multi-homed host needs to be synced across all the VTEPs among which the host is multi-homed - Support NUD_PERMANENT for proxy neighbor entries - Add a new queuing discipline for IETF RFC9332 DualQ Coupled AQM - Add sequence numbers to netconsole messages. Unregister netconsole's console when all net targets are removed. Code refactoring. Add a number of selftests - Align IPSec inbound SA lookup to RFC 4301. Only SPI and protocol should be used for an inbound SA lookup - Support inspecting ref_tracker state via DebugFS - Don't force bonding advertisement frames tx to ~333 ms boundaries. Add broadcast_neighbor option to send ARP/ND on all bonded links - Allow providing upcall pid for the 'execute' command in openvswitch - Remove DCCP support from Netfilter's conntrack - Disallow multiple packet duplications in the queuing layer - Prevent use of deprecated iptables code on PREEMPT_RT Driver API: - Support RSS and hashing configuration over ethtool Netlink - Add dedicated ethtool callbacks for getting and setting hashing fields - Add support for power budget evaluation strategy in PSE / Power-over-Ethernet. Generate Netlink events for overcurrent etc - Support DPLL phase offset monitoring across all device inputs. Support providing clock reference and SYNC over separate DPLL inputs - Support traffic classes in devlink rate API for bandwidth management - Remove rtnl_lock dependency from UDP tunnel port configuration Device drivers: - Add a new Broadcom driver for 800G Ethernet (bnge) - Add a standalone driver for Microchip ZL3073x DPLL - Remove IBM's NETIUCV device driver - Ethernet high-speed NICs: - Broadcom (bnxt): - support zero-copy Tx of DMABUF memory - take page size into account for page pool recycling rings - Intel (100G, ice, idpf): - idpf: XDP and AF_XDP support preparations - idpf: add flow steering - add link_down_events statistic - clean up the TSPLL code - preparations for live VM migration - nVidia/Mellanox: - support zero-copy Rx/Tx interfaces (DMABUF and io_uring) - optimize context memory usage for matchers - expose serial numbers in devlink info - support PCIe congestion metrics - Meta (fbnic): - add 25G, 50G, and 100G link modes to phylink - support dumping FW logs - Marvell/Cavium: - support for CN20K generation of the Octeon chips - Amazon: - add HW clock (without timestamping, just hypervisor time access) - Ethernet virtual: - VirtIO net: - support segmentation of UDP-tunnel-encapsulated packets - Google (gve): - support packet timestamping and clock synchronization - Microsoft vNIC: - add handler for device-originated servicing events - allow dynamic MSI-X vector allocation - support Tx bandwidth clamping - Ethernet NICs consumer, and embedded: - AMD: - amd-xgbe: hardware timestamping and PTP clock support - Broadcom integrated MACs (bcmgenet, bcmasp): - use napi_complete_done() return value to support NAPI polling - add support for re-starting auto-negotiation - Broadcom switches (b53): - support BCM5325 switches - add bcm63xx EPHY power control - Synopsys (stmmac): - lots of code refactoring and cleanups - TI: - icssg-prueth: read firmware-names from device tree - icssg: PRP offload support - Microchip: - lan78xx: convert to PHYLINK for improved PHY and MAC management - ksz: add KSZ8463 switch support - Intel: - support similar queue priority scheme in multi-queue and time-sensitive networking (taprio) - support packet pre-emption in both - RealTek (r8169): - enable EEE at 5Gbps on RTL8126 - Airoha: - add PPPoE offload support - MDIO bus controller for Airoha AN7583 - Ethernet PHYs: - support for the IPQ5018 internal GE PHY - micrel KSZ9477 switch-integrated PHYs: - add MDI/MDI-X control support - add RX error counters - add cable test support - add Signal Quality Indicator (SQI) reporting - dp83tg720: improve reset handling and reduce link recovery time - support bcm54811 (and its MII-Lite interface type) - air_en8811h: support resume/suspend - support PHY counters for QCA807x and QCA808x - support WoL for QCA807x - CAN drivers: - rcar_canfd: support for Transceiver Delay Compensation - kvaser: report FW versions via devlink dev info - WiFi: - extended regulatory info support (6 GHz) - add statistics and beacon monitor for Multi-Link Operation (MLO) - support S1G aggregation, improve S1G support - add Radio Measurement action fields - support per-radio RTS threshold - some work around how FIPS affects wifi, which was wrong (RC4 is used by TKIP, not only WEP) - improvements for unsolicited probe response handling - WiFi drivers: - RealTek (rtw88): - IBSS mode for SDIO devices - RealTek (rtw89): - BT coexistence for MLO/WiFi7 - concurrent station + P2P support - support for USB devices RTL8851BU/RTL8852BU - Intel (iwlwifi): - use embedded PNVM in (to be released) FW images to fix compatibility issues - many cleanups (unused FW APIs, PCIe code, WoWLAN) - some FIPS interoperability - MediaTek (mt76): - firmware recovery improvements - more MLO work - Qualcomm/Atheros (ath12k): - fix scan on multi-radio devices - more EHT/Wi-Fi 7 features - encapsulation/decapsulation offload - Broadcom (brcm80211): - support SDIO 43751 device - Bluetooth: - hci_event: add support for handling LE BIG Sync Lost event - ISO: add socket option to report packet seqnum via CMSG - ISO: support SCM_TIMESTAMPING for ISO TS - Bluetooth drivers: - intel_pcie: support Function Level Reset - nxpuart: add support for 4M baudrate - nxpuart: implement powerup sequence, reset, FW dump, and FW loading" * tag 'net-next-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1742 commits) dpll: zl3073x: Fix build failure selftests: bpf: fix legacy netfilter options ipv6: annotate data-races around rt->fib6_nsiblings ipv6: fix possible infinite loop in fib6_info_uses_dev() ipv6: prevent infinite loop in rt6_nlmsg_size() ipv6: add a retry logic in net6_rt_notify() vrf: Drop existing dst reference in vrf_ip6_input_dst net/sched: taprio: align entry index attr validation with mqprio net: fsl_pq_mdio: use dev_err_probe selftests: rtnetlink.sh: remove esp4_offload after test vsock: remove unnecessary null check in vsock_getname() igb: xsk: solve negative overflow of nb_pkts in zerocopy mode stmmac: xsk: fix negative overflow of budget in zerocopy mode dt-bindings: ieee802154: Convert at86rf230.txt yaml format net: dsa: microchip: Disable PTP function of KSZ8463 net: dsa: microchip: Setup fiber ports for KSZ8463 net: dsa: microchip: Write switch MAC address differently for KSZ8463 net: dsa: microchip: Use different registers for KSZ8463 net: dsa: microchip: Add KSZ8463 switch support to KSZ DSA driver dt-bindings: net: dsa: microchip: Add KSZ8463 switch support ... commit 623526ba8984cafdffa0eba7ee424f2e40c8a219 Author: Steven Rostedt Date: Wed Jul 30 10:07:55 2025 -0400 Documentation: tracing: Add documentation about eprobes Eprobes was added back in 5.15, but was never documented. It became a "secret" interface even though it has been a topic of several presentations. For some reason, when eprobes was added, documenting it never became a priority, until now. Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Namhyung Kim Cc: Jonathan Corbet Link: https://lore.kernel.org/20250730140945.528135548@kernel.org Reviewed-by: Randy Dunlap Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 0dd1274a053f9ede97e3f3269b5012372567e521 Author: Steven Rostedt Date: Wed Jul 30 10:07:54 2025 -0400 tracing: Have eprobes have their own config option Eprobes were added in 5.15 and were selected whenever any of the other probe events were selected. If kprobe events were enabled (which it is by default if kprobes are enabled) it would enable eprobe events as well. The same for uprobes and fprobes. Have eprobes have its own config and it gets enabled by default if tracing is enabled. Link: https://lore.kernel.org/all/20250729102636.b7cce553e7cc263722b12365@kernel.org/ Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Namhyung Kim Cc: Jonathan Corbet Cc: Randy Dunlap Link: https://lore.kernel.org/20250730140945.360286733@kernel.org Suggested-by: Masami Hiramatsu (Google) Acked-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 6f02527729bd31ca4e473bff19fda4ccd5889148 Author: Norman Maurer Date: Mon Jul 28 20:59:53 2025 -1000 io_uring/net: Allow to do vectorized send At the moment you have to use sendmsg for vectorized send. While this works it's suboptimal as it also means you need to allocate a struct msghdr that needs to be kept alive until a submission happens. We can remove this limitation by just allowing to use send directly. Signed-off-by: Norman Maurer Link: https://lore.kernel.org/r/20250729065952.26646-1-norman_maurer@apple.com [axboe: remove -EINVAL return for SENDMSG and SEND_VECTORIZED] [axboe: allow send_zc to set SEND_VECTORIZED too] Signed-off-by: Jens Axboe commit 81231ad173d840693f8d5f34ad9ada75aa8ad79f Author: Takashi Iwai Date: Wed Jul 30 08:46:35 2025 +0200 ALSA: hda/hdmi: Enable drivers as default Like other HD-audio codec drivers, HD-audio HDMI codec driver was split to multiple drivers, and now users are forced to choose the right kconfig items. For smoother upgrade path, keep the previous CONFIG_SND_HDA_CODEC_HDMI as the meuconfig, so that the kconfig can be taken over from the previous config. The all belonging HDMI codec drivers are enabled as default as long as CONFIG_SND_HDA_CODEC_HDMI is set. This is only about the default config, and each driver can be still disabled if user wants to reduce the size, too. The kconfig for the generic HDMI driver is changed to CONFIG_SND_HDA_CODEC_HDMI_GENERIC along with this action. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250730064639.25617-4-tiwai@suse.de commit fc2792a4000e9587080fa7f5b8a868cf393aa62e Author: Takashi Iwai Date: Wed Jul 30 08:46:34 2025 +0200 ALSA: hda/cirrus: Enable drivers as default Like HD-audio Realtek drivers, Cirrus Logic HD-audio codec driver was split to multiple drivers, too, and now users are forced to choose the right kconfig items. For smoother upgrade path, keep the previous CONFIG_SND_HDA_CODEC_CIRRUS as the menuconfig. The new kconfig CONFIG_SND_HDA_CODEC_CS42* are enabled as default, as long as CONFIG_SND_HDA_CODEC_CIRRUS is set, so that the system with Cirrus codec can keep working. This is only about the default config, and each driver can be still disabled if user wants to reduce the size, too. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250730064639.25617-3-tiwai@suse.de commit 1d8dd982c409d89b4ffabdbe10b569b3deb80a64 Author: Takashi Iwai Date: Wed Jul 30 08:46:33 2025 +0200 ALSA: hda/realtek: Enable drivers as default The recent split of Realtek HD-audio driver forced users to choose the right Kconfigs, but most users have no idea which ones to enable. Although the distros tend to enable all of them, individual users may have their own favorites and miss something needed via the version upgrade. For smoother upgrade path from the previous kernel configuration, now we take the following changes: - CONFIG_SND_HDA_CODEC_REALTEK (which is a menuconfig) is changed from bool to tristate again, so that it can take over from the previous config gracefully. - CONFIG_SND_HDA_CODEC_ALC* receive "default y", so that they are enabled as default as long as CONFIG_SND_HDA_CODEC_REALTEK is set. Those can be still disabled if users want to reduce the size, too. At least this allows users to run "make oldconfig" and push RETURN blindly. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250730064639.25617-2-tiwai@suse.de commit 11f74f48c14c1f4fe16541900ea5944c42e30ccf Author: Cezary Rojewski Date: Wed Jul 30 14:49:06 2025 +0200 ASoC: Intel: avs: Fix uninitialized pointer error in probe() If pcim_request_all_regions() fails, error path operates on uninitialized 'bus' pointer. Found out by Coverity static analyzer. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250730124906.351798-1-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 04225d13aef11b2a539014def5e47d8c21fd74a5 Author: Nilay Shroff Date: Wed Jul 30 13:16:09 2025 +0530 block: fix potential deadlock while running nr_hw_queue update Move scheduler tags (sched_tags) allocation and deallocation outside both the ->elevator_lock and ->freeze_lock when updating nr_hw_queues. This change breaks the dependency chain from the percpu allocator lock to the elevator lock, helping to prevent potential deadlocks, as observed in the reported lockdep splat[1]. This commit introduces batch allocation and deallocation helpers for sched_tags, which are now used from within __blk_mq_update_nr_hw_queues routine while iterating through the tagset. With this change, all sched_tags memory management is handled entirely outside the ->elevator_lock and the ->freeze_lock context, thereby eliminating the lock dependency that could otherwise manifest during nr_hw_queues updates. [1] https://lore.kernel.org/all/0659ea8d-a463-47c8-9180-43c719e106eb@linux.ibm.com/ Reported-by: Stefan Haberland Closes: https://lore.kernel.org/all/0659ea8d-a463-47c8-9180-43c719e106eb@linux.ibm.com/ Reviewed-by: Ming Lei Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Nilay Shroff Link: https://lore.kernel.org/r/20250730074614.2537382-4-nilay@linux.ibm.com Signed-off-by: Jens Axboe commit f5a6604f7a4405450e4a1f54e5430f47290c500f Author: Nilay Shroff Date: Wed Jul 30 13:16:08 2025 +0530 block: fix lockdep warning caused by lock dependency in elv_iosched_store Recent lockdep reports [1] have revealed a potential deadlock caused by a lock dependency between the percpu allocator lock and the elevator lock. This issue can be avoided by ensuring that the allocation and release of scheduler tags (sched_tags) are performed outside the elevator lock. Furthermore, the queue does not need to be remain frozen during these operations. To address this, move all sched_tags allocations and deallocations outside of both the ->elevator_lock and the ->freeze_lock. Since the lifetime of the elevator queue and its associated sched_tags is closely tied, the allocated sched_tags are now stored in the elevator queue structure. Then, during the actual elevator switch (which runs under ->freeze_lock and ->elevator_lock), the pre-allocated sched_tags are assigned to the appropriate q->hctx. Once the elevator switch is complete and the locks are released, the old elevator queue and its associated sched_tags are freed. This commit specifically addresses the allocation/deallocation of sched_ tags during elevator switching. Note that sched_tags may also be allocated in other contexts, such as during nr_hw_queues updates. Supporting that use case will require batch allocation/deallocation, which will be handled in a follow-up patch. This restructuring ensures that sched_tags memory management occurs entirely outside of the ->elevator_lock and ->freeze_lock context, eliminating the lock dependency problem seen during scheduler updates. [1] https://lore.kernel.org/all/0659ea8d-a463-47c8-9180-43c719e106eb@linux.ibm.com/ Reported-by: Stefan Haberland Closes: https://lore.kernel.org/all/0659ea8d-a463-47c8-9180-43c719e106eb@linux.ibm.com/ Reviewed-by: Ming Lei Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Nilay Shroff Link: https://lore.kernel.org/r/20250730074614.2537382-3-nilay@linux.ibm.com Signed-off-by: Jens Axboe commit 49811586be373e26a3ab52f54e0dfa663c02fddd Author: Nilay Shroff Date: Wed Jul 30 13:16:07 2025 +0530 block: move elevator queue allocation logic into blk_mq_init_sched In preparation for allocating sched_tags before freezing the request queue and acquiring ->elevator_lock, move the elevator queue allocation logic from the elevator ops ->init_sched callback into blk_mq_init_sched. As elevator_alloc is now only invoked from block layer core, we don't need to export it, so unexport elevator_alloc function. This refactoring provides a centralized location for elevator queue initialization, which makes it easier to store pre-allocated sched_tags in the struct elevator_queue during later changes. Reviewed-by: Ming Lei Reviewed-by: Hannes Reinecke Reviewed-by: Christoph Hellwig Signed-off-by: Nilay Shroff Link: https://lore.kernel.org/r/20250730074614.2537382-2-nilay@linux.ibm.com Signed-off-by: Jens Axboe commit 43584e993293326cfc508e664fe81f56a65f6240 Author: John Johansen Date: Wed Jul 30 03:47:07 2025 -0700 apparmor: fix Regression on linux-next (next-20250721) sk lock initialization was incorrectly removed, from apparmor_file_alloc_security() while testing changes to changes to apparmor_sk_alloc_security() resulting in the following regression. [ 48.056654] INFO: trying to register non-static key. [ 48.057480] The code is fine but needs lockdep annotation, or maybe [ 48.058416] you didn't initialize this object before use? [ 48.059209] turning off the locking correctness validator. [ 48.060040] CPU: 0 UID: 0 PID: 648 Comm: chronyd Not tainted 6.16.0-rc7-test-next-20250721-11410-g1ee809985e11-dirty #577 NONE [ 48.060049] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 48.060055] Call Trace: [ 48.060059] [ 48.060063] dump_stack_lvl (lib/dump_stack.c:122) [ 48.060075] register_lock_class (kernel/locking/lockdep.c:988 kernel/locking/lockdep.c:1302) [ 48.060084] ? path_name (security/apparmor/file.c:159) [ 48.060093] __lock_acquire (kernel/locking/lockdep.c:5116) [ 48.060103] lock_acquire (kernel/locking/lockdep.c:473 (discriminator 4) kernel/locking/lockdep.c:5873 (discriminator 4) kernel/locking/lockdep.c:5828 (discriminator 4)) [ 48.060109] ? update_file_ctx (security/apparmor/file.c:464) [ 48.060115] ? __pfx_profile_path_perm (security/apparmor/file.c:247) [ 48.060121] _raw_spin_lock (include/linux/spinlock_api_smp.h:134 kernel/locking/spinlock.c:154) [ 48.060130] ? update_file_ctx (security/apparmor/file.c:464) [ 48.060134] update_file_ctx (security/apparmor/file.c:464) [ 48.060140] aa_file_perm (security/apparmor/file.c:532 (discriminator 1) security/apparmor/file.c:642 (discriminator 1)) [ 48.060147] ? __pfx_aa_file_perm (security/apparmor/file.c:607) [ 48.060152] ? do_mmap (mm/mmap.c:558) [ 48.060160] ? __pfx_userfaultfd_unmap_complete (fs/userfaultfd.c:841) [ 48.060170] ? __lock_acquire (kernel/locking/lockdep.c:4677 (discriminator 1) kernel/locking/lockdep.c:5194 (discriminator 1)) [ 48.060176] ? common_file_perm (security/apparmor/lsm.c:535 (discriminator 1)) [ 48.060185] security_mmap_file (security/security.c:3012 (discriminator 2)) [ 48.060192] vm_mmap_pgoff (mm/util.c:574 (discriminator 1)) [ 48.060200] ? find_held_lock (kernel/locking/lockdep.c:5353 (discriminator 1)) [ 48.060206] ? __pfx_vm_mmap_pgoff (mm/util.c:568) [ 48.060212] ? lock_release (kernel/locking/lockdep.c:5539 kernel/locking/lockdep.c:5892 kernel/locking/lockdep.c:5878) [ 48.060219] ? __fget_files (arch/x86/include/asm/preempt.h:85 (discriminator 13) include/linux/rcupdate.h:100 (discriminator 13) include/linux/rcupdate.h:873 (discriminator 13) fs/file.c:1072 (discriminator 13)) [ 48.060229] ksys_mmap_pgoff (mm/mmap.c:604) [ 48.060239] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) [ 48.060248] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 48.060254] RIP: 0033:0x7fb6920e30a2 [ 48.060265] Code: 08 00 04 00 00 eb e2 90 41 f7 c1 ff 0f 00 00 75 27 55 89 cd 53 48 89 fb 48 85 ff 74 33 41 89 ea 48 89 df b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 5e 5b 5d c3 0f 1f 00 c7 05 e6 41 01 00 16 00 All code ======== 0: 08 00 or %al,(%rax) 2: 04 00 add $0x0,%al 4: 00 eb add %ch,%bl 6: e2 90 loop 0xffffffffffffff98 8: 41 f7 c1 ff 0f 00 00 test $0xfff,%r9d f: 75 27 jne 0x38 11: 55 push %rbp 12: 89 cd mov %ecx,%ebp 14: 53 push %rbx 15: 48 89 fb mov %rdi,%rbx 18: 48 85 ff test %rdi,%rdi 1b: 74 33 je 0x50 1d: 41 89 ea mov %ebp,%r10d 20: 48 89 df mov %rbx,%rdi 23: b8 09 00 00 00 mov $0x9,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 5e ja 0x90 32: 5b pop %rbx 33: 5d pop %rbp 34: c3 ret 35: 0f 1f 00 nopl (%rax) 38: c7 .byte 0xc7 39: 05 e6 41 01 00 add $0x141e6,%eax 3e: 16 (bad) ... Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 5e ja 0x66 8: 5b pop %rbx 9: 5d pop %rbp a: c3 ret b: 0f 1f 00 nopl (%rax) e: c7 .byte 0xc7 f: 05 e6 41 01 00 add $0x141e6,%eax 14: 16 (bad) ... [ 48.060270] RSP: 002b:00007ffd2c0d3528 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 [ 48.060279] RAX: ffffffffffffffda RBX: 00007fb691fc8000 RCX: 00007fb6920e30a2 [ 48.060283] RDX: 0000000000000005 RSI: 000000000007d000 RDI: 00007fb691fc8000 [ 48.060287] RBP: 0000000000000812 R08: 0000000000000003 R09: 0000000000011000 [ 48.060290] R10: 0000000000000812 R11: 0000000000000206 R12: 00007ffd2c0d3578 [ 48.060293] R13: 00007fb6920b6160 R14: 00007ffd2c0d39f0 R15: 00000fffa581a6a8 Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.") Signed-off-by: John Johansen commit f3c0675bb9e0a3a472dd519ec7ccde23bdcf180b Author: John Johansen Date: Wed Jul 30 03:08:29 2025 -0700 apparmor: fix test error: WARNING in apparmor_unix_stream_connect commit 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.") added the use of security_sk_alloc() which ensures the sk label is initialized. This means that the AA_BUG in apparmor_unix_stream_connect() is no longer correct, because while the sk is still not being initialized by going through post_create, it is now initialize in sk_alloc(). Remove the now invalid check. Reported-by: syzbot+cd38ee04bcb3866b0c6d@syzkaller.appspotmail.com Fixes: 88fec3526e84 ("apparmor: make sure unix socket labeling is correctly updated.") Signed-off-by: John Johansen commit 8936125e232803e64cb29e107326a942981188d6 Author: Jiapeng Chong Date: Fri Jul 25 17:52:52 2025 +0800 apparmor: Remove the unused variable rules Variable rules is not effectively used, so delete it. security/apparmor/lsm.c:182:23: warning: variable ‘rules’ set but not used. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22942 Signed-off-by: Jiapeng Chong Signed-off-by: John Johansen commit 8d452accd1380e1cb0b15a9876bcd19b14c5fabb Author: Shengjiu Wang Date: Wed Jul 30 14:40:54 2025 +0800 ASoC: wm8962: Clear master mode when enter runtime suspend The enabled master mode causes power consumption to increase in idle state. Clear the MSTR bit in runtime supsend and recover it in runtime resume to reduce power. Signed-off-by: Shengjiu Wang Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20250730064054.3006409-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit fb2fae70e7e985c4acb1ad96110d8b98bb64a87c Author: Miquel Raynal Date: Wed Jun 18 14:14:25 2025 +0200 mtd: spinand: winbond: Add comment about the maximum frequency Clarify that Winbond octal capable chips may be clocked at up to 166MHz, which is their absolute maximum. No per-operation maximum value (captured with a "0" in the table) involves that in these cases the maximum frequency of the chip applies, ie. the one commonly described in the DT. Signed-off-by: Miquel Raynal commit 535f30d997baa5e5c6a3a4024d49e1871232c72b Author: Miquel Raynal Date: Wed Jun 18 14:14:24 2025 +0200 mtd: spinand: winbond: Enable high-speed modes on w35n0xjw w35n0xjw chips can run at up to 166MHz in octal mode, but this is only possible after programming various VCR registers. Implement the new ->configure_chip() hook for this purpose. Signed-off-by: Miquel Raynal commit f1a91175faaab02a45d1ceb313a315a5bfeb5416 Author: Miquel Raynal Date: Wed Jun 18 14:14:23 2025 +0200 mtd: spinand: winbond: Enable high-speed modes on w25n0xjw w25n0xjw chips have a high-speed capability hidden in a configuration register. Once enabled, dual/quad SDR reads may be performed at a much higher frequency. Implement the new ->configure_chip() hook for this purpose and configure the SR4 register accordingly. Signed-off-by: Miquel Raynal commit da55809ebb45d1d80b7a388ffef841ed683e1a6f Author: Miquel Raynal Date: Wed Jun 18 14:14:22 2025 +0200 mtd: spinand: Add a ->configure_chip() hook There is already a manufacturer hook, which is manufacturer specific but not chip specific. We no longer have access to the actual NAND identity at this stage so let's add a per-chip configuration hook to align the chip configuration (if any) with the core's setting. Signed-off-by: Miquel Raynal commit d81ad9d78e2cd5bdefd390a83553203668a96092 Author: Miquel Raynal Date: Wed Jun 18 14:14:21 2025 +0200 mtd: spinand: Add a frequency field to all READ_FROM_CACHE variants These macros had initially no frequency field. When I added the "maximum operation frequency" field, I did it initially on very common macros and I decided to add an optional field for that (with VA_ARGS) in order to prevent massively unreadable changes. I then added new variants in the spinand.h header, and requested a frequency field for them by default. Some times later, I also added maximum frequencies to other existing variants, but I did it incorrectly, without noticing I was wrong because the field was optional. This mix is error prone, so let's do what I should have done since the very beginning: add a frequency field to all READ_FROM_CACHE variants. There is no functional change. Signed-off-by: Miquel Raynal commit 5de7ea49653f6b988525b559802da615a61ffbea Author: Miquel Raynal Date: Wed Jun 18 14:14:20 2025 +0200 mtd: spinand: Fix macro alignment No functional change, just a style fix to align with the other macros all around. Signed-off-by: Miquel Raynal commit a11a51896572273d04a9f6011ad22738c52ba554 Author: Miquel Raynal Date: Wed Jun 4 15:52:19 2025 +0200 spi: spi-mem: Take into account the actual maximum frequency In order to pick the best variant, the duration of each typical operation is derived and then compared. These durations are based on the maximum capabilities of the chips, which are commonly the limiting factors. However there are other possible limiting pieces, such as the hardware layout, EMC considerations and in some cases, the SPI controller itself. We need to take this into account to further refine our variant choice, so let's use the actual frequency that will be used for the operation instead of the theoretical maximum. Signed-off-by: Miquel Raynal Reviewed-by: Mark Brown commit 62df72a0ab22b3377aeba3b2159ab35274a4106f Author: Miquel Raynal Date: Wed Jun 18 14:14:18 2025 +0200 spi: spi-mem: Use picoseconds for calculating the op durations spi_mem_calc_op_duration() is deriving the duration of a specific op, by multiplying the number of cycles with the time a cycle will last. This time was measured in nanoseconds, which means at high frequencies the delta between two frequencies might not be properly catch due to roundings. For instance, the Winbond driver has a changing number of dummy cycles depending on the speed, adding +8 dummy cycles when running at 166MHz compared to 162MHz. Both frequencies would lead to using a 6ns delay per cycle for the op duration computation, whereas in practice there is a small difference which actually offsets the number of extra dummy cycles on a normal page read. Augmenting the precision of the calculation by using picoseconds prevents selecting a lower frequency if we can do slightly better with another frequency involving more cycles. As a result, the above situation leads to comparing cycles of 6024 and 6172 picoseconds which leads to picking the most efficient variant. Reviewed-by: Mark Brown Signed-off-by: Miquel Raynal commit f552a7c7e0a14215cb8a6fd89e60fa3932a74786 Author: Balamanikandan Gunasundar Date: Mon Jul 21 16:13:40 2025 +0530 mtd: rawnand: atmel: set pmecc data setup time Setup the pmecc data setup time as 3 clock cycles for 133MHz as recommended by the datasheet. Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Reported-by: Zixun LI Closes: https://lore.kernel.org/all/c015bb20-6a57-4f63-8102-34b3d83e0f5b@microchip.com Suggested-by: Ada Couprie Diaz Signed-off-by: Balamanikandan Gunasundar Signed-off-by: Miquel Raynal commit 091d9e35b85b0f8f7e1c73535299f91364a5c73a Author: Gabor Juhos Date: Tue Jul 8 15:11:00 2025 +0200 mtd: spinand: propagate spinand_wait() errors from spinand_write_page() Since commit 3d1f08b032dc ("mtd: spinand: Use the external ECC engine logic") the spinand_write_page() function ignores the errors returned by spinand_wait(). Change the code to propagate those up to the stack as it was done before the offending change. Cc: stable@vger.kernel.org Fixes: 3d1f08b032dc ("mtd: spinand: Use the external ECC engine logic") Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal commit 6c4dab38431fee3d39a841d66ba6f2890b31b005 Author: Thomas Fourier Date: Mon Jul 7 09:39:37 2025 +0200 mtd: rawnand: fsmc: Add missing check after DMA map The DMA map functions can fail and should be tested for errors. Fixes: 4774fb0a48aa ("mtd: nand/fsmc: Add DMA support") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier Rule: add Link: https://lore.kernel.org/stable/20250702065806.20983-2-fourier.thomas%40gmail.com Signed-off-by: Miquel Raynal commit 3b36f86dc47261828f96f826077131a35dd825fd Author: Thomas Fourier Date: Mon Jul 7 09:15:50 2025 +0200 mtd: rawnand: rockchip: Add missing check after DMA map The DMA map functions can fail and should be tested for errors. Fixes: 058e0e847d54 ("mtd: rawnand: rockchip: NFC driver for RK3308, RK2928 and others") Signed-off-by: Thomas Fourier Signed-off-by: Miquel Raynal commit 125100566b8f830365a85930d85134f7dba3b99b Author: Hector Palacios Date: Fri Jul 4 11:41:09 2025 +0200 mtd: rawnand: hynix: don't try read-retry on SLC NANDs Some SLC NANDs like H27U4G8F2D expose a valid JEDEC ID yet they don't support the read-retry mechanism, and fail. Since SLC NANDs don't require read-retry, continue only if the bits per cell is bigger than 1. Signed-off-by: Hector Palacios Signed-off-by: Miquel Raynal commit e1e6b933c56b1e9fda93caa0b8bae39f3f421e5c Author: Thomas Fourier Date: Wed Jul 2 08:45:11 2025 +0200 mtd: rawnand: atmel: Fix dma_mapping_error() address It seems like what was intended is to test if the dma_map of the previous line failed but the wrong dma address was passed. Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") Signed-off-by: Thomas Fourier Rule: add Link: https://lore.kernel.org/stable/20250702064515.18145-2-fourier.thomas%40gmail.com Signed-off-by: Miquel Raynal commit 23584da2875972782b8a35a9a78c46e5f561ec67 Author: David Regan Date: Wed Jul 2 19:47:05 2025 -0700 mtd: nand: brcmnand: fix mtd corrected bits stat Currently we attempt to get the amount of flipped bits from a hardware location which is reset on every subpage. Instead obtain total flipped bits stat from hardware accumulator. In addition identify the correct maximum subpage corrected bits. Signed-off-by: David Regan Reviewed-by: William Zhang Signed-off-by: Miquel Raynal commit 79e441ee47949376e3bc20f085cf017b70523d0f Author: Thomas Fourier Date: Wed Jul 2 10:01:06 2025 +0200 mtd: rawnand: renesas: Add missing check after DMA map The DMA map functions can fail and should be tested for errors. Fixes: d8701fe890ec ("mtd: rawnand: renesas: Add new NAND controller driver") Cc: stable@vger.kernel.org Signed-off-by: Thomas Fourier Signed-off-by: Miquel Raynal commit fdfb040d0bc5963b7f107cc0711a62cd6ed1682c Author: Teng Wu Date: Mon Jun 30 11:49:31 2025 +0800 mtd: spinand: gigadevice: Add support for GD5F1GM9 chips - GD5F1GM9UExxG (ID:c89101 3.3V) - GD5F1GM9RExxG (ID:c88101 1.8V) Both device feature: - 1Gb density (1024 blocks) - 2048-byte page size with 128-byte OOB - 8-bit ECC requirement per 512 bytes - Quad I/O Read support (opcode EBH) - tPROG ≤ 300us typical page program time Testing environment: - Platform: Raspberry PI-5 (Linux raspberry 6.15.0-rc6-v8) - Operations verified: * Full device read/write/erase cycles on all blocks * Nandspeed: ~ GD5F1GM9UE: 2.75MB/s read, 1.99MB/s write, 41.26MB/s erase ~ GD5F1GM9RE: 1.84MB/s read, 1.45MB/s write, 41.04MS/s erase * Nandbiterrs: Both corredted 8-bit errors per 512 bytes * Stresstest: Both 144k cycles 0 bad block growth Full test log: -U: https://gist.github.com/WT-886/b0f41fb50ddac3adc0020222c1f89b61 -R: https://gist.github.com/WT-886/8784e72f4632d519814928ff49225963 Datasheet: -https://github.com/WT-886/DATASHEET/blob/main/GD5F1GM9-v1.0.pdf Signed-off-by: Teng Wu Signed-off-by: Miquel Raynal commit 258ef75cf2e219350574c8a8d3695451c093ed38 Author: Yuesong Li Date: Wed Jun 18 20:49:47 2025 +0800 mtd: nand: brcmnand: replace manual string choices with standard helpers Use kernel provided standard helper function to replace hard-coded strings Signed-off-by: Yuesong Li Signed-off-by: Miquel Raynal commit 006aa8f57f55dd5bf68c4ada1e0d3f4e59027d71 Author: Shree Ramamoorthy Date: Tue Jul 8 16:04:48 2025 -0500 mfd: dt-bindings: Convert TPS65910 to DT schema Convert the TI TPS65910 documentation to DT schema format. Fix incorrect I2C address in example: should be 0x2d. TPS65910 datasheet: https://www.ti.com/lit/gpn/tps65910 Signed-off-by: Shree Ramamoorthy Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250708210448.56384-1-s-ramamoorthy@ti.com Signed-off-by: Lee Jones commit 73e52f871fc098368c57bfc1756f6281c44e9f55 Author: Charles Keepax Date: Wed Jul 9 14:31:03 2025 +0100 mfd: Minor Cirrus/Maxim Kconfig order fixes Move some Cirrus parts so they are grouped together alphabetically in menuconfig. Also move the Maxim 5970 out of the middle of the Cirrus parts and put it with the other Maxim parts. No functional changes just alphabetising. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20250709133103.3482015-1-ckeepax@opensource.cirrus.com Signed-off-by: Lee Jones commit 8b96324c75d8b09ae8d11ab411adc74528a54bc8 Author: Sakari Ailus Date: Fri Jul 4 10:54:32 2025 +0300 mfd: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20250704075432.3220321-1-sakari.ailus@linux.intel.com Signed-off-by: Lee Jones commit a9dec0963187d05725369156a5e0e14cd3487bfb Author: Edip Hazuri Date: Tue Jul 29 21:18:50 2025 +0300 ALSA: hda/realtek - Fix mute LED for HP Victus 16-d1xxx (MB 8A26) My friend have Victus 16-d1xxx with board ID 8A26, the existing quirk for Victus 16-d1xxx wasn't working because of different board ID Tested on Victus 16-d1015nt Laptop. The LED behaviour works as intended. Cc: Signed-off-by: Edip Hazuri Link: https://patch.msgid.link/20250729181848.24432-4-edip@medip.dev Signed-off-by: Takashi Iwai commit 956048a3cd9d2575032e2c7ca62803677357ae18 Author: Edip Hazuri Date: Tue Jul 29 21:18:48 2025 +0300 ALSA: hda/realtek - Fix mute LED for HP Victus 16-s0xxx The mute led on this laptop is using ALC245 but requires a quirk to work This patch enables the existing quirk for the device. Tested on Victus 16-S0063NT Laptop. The LED behaviour works as intended. Cc: Signed-off-by: Edip Hazuri Link: https://patch.msgid.link/20250729181848.24432-2-edip@medip.dev Signed-off-by: Takashi Iwai commit 4b290aae788e06561754b28c6842e4080957d3f7 Merge: a26321ee4c935a ffc137c5c195a7 Author: Linus Torvalds Date: Tue Jul 29 21:43:08 2025 -0700 Merge tag 'sysctl-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl Pull sysctl updates from Joel Granados: - Move sysctls out of the kern_table array This is the final move of ctl_tables into their respective subsystems. Only 5 (out of the original 50) will remain in kernel/sysctl.c file; these handle either sysctl or common arch variables. By decentralizing sysctl registrations, subsystem maintainers regain control over their sysctl interfaces, improving maintainability and reducing the likelihood of merge conflicts. - docs: Remove false positives from check-sysctl-docs Stopped falsely identifying sysctls as undocumented or unimplemented in the check-sysctl-docs script. This script can now be used to automatically identify if documentation is missing. * tag 'sysctl-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl: (23 commits) docs: Downgrade arm64 & riscv from titles to comment docs: Replace spaces with tabs in check-sysctl-docs docs: Remove colon from ctltable title in vm.rst docs: Add awk section for ucount sysctl entries docs: Use skiplist when checking sysctl admin-guide docs: nixify check-sysctl-docs sysctl: rename kern_table -> sysctl_subsys_table kernel/sys.c: Move overflow{uid,gid} sysctl into kernel/sys.c uevent: mv uevent_helper into kobject_uevent.c sysctl: Removed unused variable sysctl: Nixify sysctl.sh sysctl: Remove superfluous includes from kernel/sysctl.c sysctl: Remove (very) old file changelog sysctl: Move sysctl_panic_on_stackoverflow to kernel/panic.c sysctl: move cad_pid into kernel/pid.c sysctl: Move tainted ctl_table into kernel/panic.c Input: sysrq: mv sysrq into drivers/tty/sysrq.c fork: mv threads-max into kernel/fork.c parisc/power: Move soft-power into power.c mm: move randomize_va_space into memory.c ... commit a26321ee4c935a63c29ed6518f27e38826b36e68 Merge: beb6c8326eb4e7 f627b51aaa041c Author: Linus Torvalds Date: Tue Jul 29 20:49:58 2025 -0700 Merge tag 'hardening-v6.17-rc1-fix1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening fixes from Kees Cook: "Notably, this contains the fix for for the GCC __init mess I created with the kstack_erase annotations. - staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int(). I was asked to carry this fix, so here it is. :) - fortify: Fix incorrect reporting of read buffer size - kstack_erase: Fix missed export of renamed KSTACK_ERASE_CFLAGS - compiler_types: Provide __no_kstack_erase to disable coverage only on Clang" * tag 'hardening-v6.17-rc1-fix1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: compiler_types: Provide __no_kstack_erase to disable coverage only on Clang fortify: Fix incorrect reporting of read buffer size kstack_erase: Fix missed export of renamed KSTACK_ERASE_CFLAGS staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() commit beb6c8326eb4e7006c4aa16b0fee3e303d42e685 Merge: 5f5c9952b33cb4 fc9ed2f6589dc2 Author: Linus Torvalds Date: Tue Jul 29 20:31:45 2025 -0700 Merge tag 'uml-for-linux-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux Pull uml updates from Johannes Berg: "Mostly cleanups, except: - dynamic addition of vfio passthrough devices - implementation of HAVE_SYSCALL_TRACEPOINTS" * tag 'uml-for-linux-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/uml/linux: um: Replace __ASSEMBLY__ with __ASSEMBLER__ in the usermode headers um: Stop tracking stub's PID via userspace_pid[] um: Remove the pid parameter of handle_trap() um: Use err consistently in userspace() um: vfio: Support adding devices via mconsole um: rtc: Avoid shadowing err in uml_rtc_start() um: Avoid redefining ARCH_HAS_CACHE_LINE_SIZE um: Make mm_list and mm_list_lock static um: Make unscheduled_userspace_iterations static um: Re-evaluate thread flags repeatedly um: simplify syscall header files um/ptrace: Implement HAVE_SYSCALL_TRACEPOINTS um/x86: Add system call table to header file um: virt-pci: Switch to msi_create_parent_irq_domain() um: virtio_pcidev: Rename UM_PCI_STAT_WAITING commit 5f5c9952b33cb4e8d25c70ef29f7a45cd26b6a9b Merge: 6fb44438a5e189 da30705c4621fc Author: Linus Torvalds Date: Tue Jul 29 20:28:38 2025 -0700 Merge tag 'powerpc-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux Pull powerpc updates from Madhavan Srinivasan: - CONFIG_HZ changes to move the base_slice from 10ms to 1ms - Patchset to move some of the mutex handling to lock guard - Expose secvars relevant to the key management mode - Misc cleanups and fixes Thanks to Ankit Chauhan, Christophe Leroy, Donet Tom, Gautam Menghani, Haren Myneni, Johan Korsnes, Madadi Vineeth Reddy, Paul Mackerras, Shrikanth Hegde, Srish Srinivasan, Thomas Fourier, Thomas Huth, Thomas Weißschuh, Souradeep, Amit Machhiwal, R Nageswara Sastry, Venkat Rao Bagalkote, Andrew Donnellan, Greg Kroah-Hartman, Mimi Zohar, Mukesh Kumar Chaurasiya, Nayna Jain, Ritesh Harjani (IBM), Sourabh Jain, Srikar Dronamraju, Stefan Berger, Tyrel Datwyler, and Kowshik Jois. * tag 'powerpc-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux: (23 commits) arch/powerpc: Remove .interp section in vmlinux powerpc: Drop GPL boilerplate text with obsolete FSF address powerpc: Don't use %pK through printk arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX misc: ocxl: Replace scnprintf() with sysfs_emit() in sysfs show functions integrity/platform_certs: Allow loading of keys in the static key management mode powerpc/secvar: Expose secvars relevant to the key management mode powerpc/pseries: Correct secvar format representation for static key management (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer powerpc: floppy: Add missing checks after DMA map book3s64/radix : Optimize vmemmap start alignment book3s64/radix : Handle error conditions properly in radix_vmemmap_populate powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add KVM: PPC: Book3S HV: Add H_VIRT mapping for tracing exits powerpc: sysdev: use lock guard for mutex powerpc: powernv: ocxl: use lock guard for mutex powerpc: book3s: vas: use lock guard for mutex powerpc: fadump: use lock guard for mutex powerpc: rtas: use lock guard for mutex powerpc: eeh: use lock guard for mutex ... commit 6fb44438a5e1897a72dd11139274735256be8069 Merge: 3bb38c52719baa 5b1ae9de713358 Author: Linus Torvalds Date: Tue Jul 29 20:21:54 2025 -0700 Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 updates from Catalin Marinas: "A quick summary: perf support for Branch Record Buffer Extensions (BRBE), typical PMU hardware updates, small additions to MTE for store-only tag checking and exposing non-address bits to signal handlers, HAVE_LIVEPATCH enabled on arm64, VMAP_STACK forced on. There is also a TLBI optimisation on hardware that does not require break-before-make when changing the user PTEs between contiguous and non-contiguous. More details: Perf and PMU updates: - Add support for new (v3) Hisilicon SLLC and DDRC PMUs - Add support for Arm-NI PMU integrations that share interrupts between clock domains within a given instance - Allow SPE to be configured with a lower sample period than the minimum recommendation advertised by PMSIDR_EL1.Interval - Add suppport for Arm's "Branch Record Buffer Extension" (BRBE) - Adjust the perf watchdog period according to cpu frequency changes - Minor driver fixes and cleanups Hardware features: - Support for MTE store-only checking (FEAT_MTE_STORE_ONLY) - Support for reporting the non-address bits during a synchronous MTE tag check fault (FEAT_MTE_TAGGED_FAR) - Optimise the TLBI when folding/unfolding contiguous PTEs on hardware with FEAT_BBM (break-before-make) level 2 and no TLB conflict aborts Software features: - Enable HAVE_LIVEPATCH after implementing arch_stack_walk_reliable() and using the text-poke API for late module relocations - Force VMAP_STACK always on and change arm64_efi_rt_init() to use arch_alloc_vmap_stack() in order to avoid KASAN false positives ACPI: - Improve SPCR handling and messaging on systems lacking an SPCR table Debug: - Simplify the debug exception entry path - Drop redundant DBG_MDSCR_* macros Kselftests: - Cleanups and improvements for SME, SVE and FPSIMD tests Miscellaneous: - Optimise loop to reduce redundant operations in contpte_ptep_get() - Remove ISB when resetting POR_EL0 during signal handling - Mark the kernel as tainted on SEA and SError panic - Remove redundant gcs_free() call" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (93 commits) arm64/gcs: task_gcs_el0_enable() should use passed task arm64: Kconfig: Keep selects somewhat alphabetically ordered arm64: signal: Remove ISB when resetting POR_EL0 kselftest/arm64: Handle attempts to disable SM on SME only systems kselftest/arm64: Fix SVE write data generation for SME only systems kselftest/arm64: Test SME on SME only systems in fp-ptrace kselftest/arm64: Test FPSIMD format data writes via NT_ARM_SVE in fp-ptrace kselftest/arm64: Allow sve-ptrace to run on SME only systems arm64/mm: Drop redundant addr increment in set_huge_pte_at() kselftest/arm4: Provide local defines for AT_HWCAP3 arm64: Mark kernel as tainted on SAE and SError panic arm64/gcs: Don't call gcs_free() when releasing task_struct drivers/perf: hisi: Support PMUs with no interrupt drivers/perf: hisi: Relax the event number check of v2 PMUs drivers/perf: hisi: Add support for HiSilicon SLLC v3 PMU driver drivers/perf: hisi: Use ACPI driver_data to retrieve SLLC PMU information drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver drivers/perf: hisi: Simplify the probe process for each DDRC version perf/arm-ni: Support sharing IRQs within an NI instance perf/arm-ni: Consolidate CPU affinity handling ... commit 3bb38c52719baa7f9cdbf200016ed481b4498290 Merge: bc46b7cbc58c4c c8995932db2bad Author: Linus Torvalds Date: Tue Jul 29 20:19:47 2025 -0700 Merge tag 'm68k-for-v6.17-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k Pull m68k updates from Geert Uytterhoeven: - ptdescs conversions - Fix lost column on the graphical debug console - Replace __ASSEMBLY__ with __ASSEMBLER__ in headers - Miscellaneous fixes and improvements - defconfig updates * tag 'm68k-for-v6.17-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: m68k: mac: Improve clocksource driver commentary m68k: defconfig: Update defconfigs for v6.16-rc2 m68k: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers m68k: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers m68k: Enable dead code elimination m68k: Don't unregister boot console needlessly m68k: Remove unused "cursor home" code from debug console m68k: Avoid pointless recursion in debug console rendering m68k: Fix lost column on framebuffer debug console m68k: mm: Convert pointer table macros to use ptdescs m68k: mm: Convert init_pointer_table() to use ptdescs m68k: mm: Convert free_pointer_table() to use ptdescs m68k: mm: Convert get_pointer_table() to use ptdescs commit bc46b7cbc58c4cb562b6a45a1fbc7b8e7b23df58 Merge: 98e8f2c0e0930f 5647f61ad9171e Author: Linus Torvalds Date: Tue Jul 29 20:17:08 2025 -0700 Merge tag 's390-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Alexander Gordeev: - Standardize on the __ASSEMBLER__ macro that is provided by GCC and Clang compilers and replace __ASSEMBLY__ with __ASSEMBLER__ in both uapi and non-uapi headers - Explicitly include in architecture and driver files which contain an EXPORT_SYMBOL() and remove the include from the files which do not contain the EXPORT_SYMBOL() - Use the full title of "z/Architecture Principles of Operation" manual and the name of a section where facility bits are listed - Use -D__DISABLE_EXPORTS for files in arch/s390/boot to avoid unnecessary slowing down of the build and confusing external kABI tools that process symtypes data - Print additional unrecoverable machine check information to make the root cause analysis easier - Move cmpxchg_user_key() handling to uaccess library code, since the generated code is large anyway and there is no benefit if it is inlined - Fix a problem when cmpxchg_user_key() is executing a code with a non-default key: if a system is IPL-ed with "LOAD NORMAL", and the previous system used storage keys where the fetch-protection bit was set for some pages, and the cmpxchg_user_key() is located within such page, a protection exception happens - Either the external call or emergency signal order is used to send an IPI to a remote CPU. Use the external order only, since it is at least as good and sometimes even better, than the emergency signal - In case of an early crash the early program check handler prints more or less random value of the last breaking event address, since it is not initialized properly. Copy the last breaking event address from the lowcore to pt_regs to address this - During STP synchronization check udelay() can not be used, since the first CPU modifies tod_clock_base and get_tod_clock_monotonic() might return a non-monotonic time. Instead, busy-loop on other CPUs, while the the first CPU actually handles the synchronization operation - When debugging the early kernel boot using QEMU with the -S flag and GDB attached, skip the decompressor and start directly in kernel - Rename PAI Crypto event 4210 according to z16 and z17 "z/Architecture Principles of Operation" manual - Remove the in-kernel time steering support in favour of the new s390 PTP driver, which allows the kernel clock steered more precisely - Remove a possible false-positive warning in pte_free_defer(), which could be triggered in a valid case KVM guest process is initializing * tag 's390-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (29 commits) s390/mm: Remove possible false-positive warning in pte_free_defer() s390/stp: Default to enabled s390/stp: Remove leap second support s390/time: Remove in-kernel time steering s390/sclp: Use monotonic clock in sclp_sync_wait() s390/smp: Use monotonic clock in smp_emergency_stop() s390/time: Use monotonic clock in get_cycles() s390/pai_crypto: Rename PAI Crypto event 4210 scripts/gdb/symbols: make lx-symbols skip the s390 decompressor s390/boot: Introduce jump_to_kernel() function s390/stp: Remove udelay from stp_sync_clock() s390/early: Copy last breaking event address to pt_regs s390/smp: Remove conditional emergency signal order code usage s390/uaccess: Merge cmpxchg_user_key() inline assemblies s390/uaccess: Prevent kprobes on cmpxchg_user_key() functions s390/uaccess: Initialize code pages executed with non-default access key s390/skey: Provide infrastructure for executing with non-default access key s390/uaccess: Make cmpxchg_user_key() library code s390/page: Add memory clobber to page_set_storage_key() s390/page: Cleanup page_set_storage_key() inline assemblies ... commit 98e8f2c0e0930feee6a2538450c74d9d7de0a9cc Merge: e12ac84acc722f f12682148262aa Author: Linus Torvalds Date: Tue Jul 29 20:05:06 2025 -0700 Merge tag 'x86-platform-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform updates from Ingo Molnar: "This adds support for the AMD hardware feedback interface (HFI), by Perry Yuan" * tag 'x86-platform-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/itmt: Add debugfs file to show core priorities platform/x86/amd: hfi: Add debugfs support platform/x86/amd: hfi: Set ITMT priority from ranking data cpufreq/amd-pstate: Disable preferred cores on designs with workload classification x86/process: Clear hardware feedback history for AMD processors platform/x86: hfi: Add power management callback platform/x86: hfi: Add online and offline callback support platform/x86: hfi: Init per-cpu scores for each class platform/x86: hfi: Parse CPU core ranking data from shared memory platform/x86: hfi: Introduce AMD Hardware Feedback Interface Driver x86/msr-index: Add AMD workload classification MSRs MAINTAINERS: Add maintainer entry for AMD Hardware Feedback Driver Documentation/x86: Add AMD Hardware Feedback Interface documentation commit e12ac84acc722f06e8b1be66fbb138c5934aaf54 Merge: 0c23929f358c94 9df5e79bf1a30b Author: Linus Torvalds Date: Tue Jul 29 19:55:12 2025 -0700 Merge tag 'x86-kconfig-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 kconfig updates from Ingo Molnar: - Emit standard build success messages in insn_sanity.c and insn_decoder_test.c (Ingo Molnar) - Refresh the x86-[64|32] defconfigs mechanically (Ingo Molnar) * tag 'x86-kconfig-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/tools: insn_sanity.c: Emit standard build success messages x86/tools: insn_decoder_test.c: Emit standard build success messages x86/kconfig/32: Refresh defconfig x86/kconfig/64: Refresh defconfig commit 0c23929f358c949f6254c46883afc2bba415d36e Merge: 4dd39ddeb68fbb 1cec9ac2d071cf Author: Linus Torvalds Date: Tue Jul 29 19:34:17 2025 -0700 Merge tag 'x86-fpu-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 FPU updates from Ingo Molnar: - Most of the changes are related to the implementation of CET supervisor state support for guests, and its preparatory changes (Chao Gao) - Improve/fix the debug output for unexpected FPU exceptions (Dave Hansen) * tag 'x86-fpu-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/fpu: Delay instruction pointer fixup until after warning x86/fpu/xstate: Add CET supervisor xfeature support as a guest-only feature x86/fpu/xstate: Introduce "guest-only" supervisor xfeature set x86/fpu: Remove xfd argument from __fpstate_reset() x86/fpu: Initialize guest fpstate and FPU pseudo container from guest defaults x86/fpu: Initialize guest FPU permissions from guest defaults x86/fpu/xstate: Differentiate default features for host and guest FPUs commit 4dd39ddeb68fbb6d068611f2cc647948dc7dfca0 Merge: 1645f6ab966b82 5bf2f5119b9e95 Author: Linus Torvalds Date: Tue Jul 29 19:22:21 2025 -0700 Merge tag 'x86-cpu-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu update from Ingo Molnar: "Add user-space CPUID faulting support for AMD CPUs" * tag 'x86-cpu-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Add CPUID faulting support commit 1645f6ab966b828bc160c23626d071914debfa79 Merge: 56d5e32929ee8e 7f2b41ac3f29f6 Author: Linus Torvalds Date: Tue Jul 29 19:00:35 2025 -0700 Merge tag 'x86-cleanups-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cleanups from Ingo Molnar: "Miscellaneous x86 cleanups" * tag 'x86-cleanups-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/apic: Move apic_update_irq_cfg() call to apic_update_vector() x86/mm: Remove duplicated __PAGE_KERNEL(_EXEC) definitions commit 56d5e32929ee8e772922242f37cc234c437c89c0 Merge: 72b8944f147e15 61b57d35396a4b Author: Linus Torvalds Date: Tue Jul 29 18:58:22 2025 -0700 Merge tag 'x86-boot-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 boot updates from Ingo Molnar: - Implement support for embedding EFI SBAT data (Secure Boot Advanced Targeting: a secure boot image revocation facility) on x86 (Vitaly Kuznetsov) - Move the efi_enter_virtual_mode() initialization call from the generic init code to x86 init code (Alexander Shishkin) * tag 'x86-boot-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/efi: Implement support for embedding SBAT data for x86 x86/efi: Move runtime service initialization to arch/x86 commit 72b8944f147e151e845d976e7f48beff38967499 Merge: bcb48dd3b34459 ba28549bad8ab2 Author: Linus Torvalds Date: Tue Jul 29 18:11:32 2025 -0700 Merge tag 'locking-core-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull locking updates from Ingo Molnar: "Locking primitives: - Mark devm_mutex_init() as __must_check and fix drivers that didn't check the return code (Thomas Weißschuh) - Reorganize to better expose the internal APIs to local variables (Sebastian Andrzej Siewior) - Remove OWNER_SPINNABLE in rwsem (Jinliang Zheng) - Remove redundant #ifdefs in the mutex code (Ran Xiaokai) Lockdep: - Avoid returning struct in lock_stats() (Arnd Bergmann) - Change `static const` into enum for LOCKF_*_IRQ_* (Arnd Bergmann) - Temporarily use synchronize_rcu_expedited() in lockdep_unregister_key() to speed things up. (Breno Leitao) Rust runtime: - Add #[must_use] to Lock::try_lock() (Jason Devers)" * tag 'locking-core-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: lockdep: Speed up lockdep_unregister_key() with expedited RCU synchronization locking/mutex: Remove redundant #ifdefs locking/lockdep: Change 'static const' variables to enum values locking/lockdep: Avoid struct return in lock_stats() locking/rwsem: Use OWNER_NONSPINNABLE directly instead of OWNER_SPINNABLE rust: sync: Add #[must_use] to Lock::try_lock() locking/mutex: Mark devm_mutex_init() as __must_check leds: lp8860: Check return value of devm_mutex_init() spi: spi-nxp-fspi: Check return value of devm_mutex_init() local_lock: Move this_cpu_ptr() notation from internal to main header commit bcb48dd3b344592cc33732de640b99264c073df1 Merge: bf76f23aa1c178 829f5a6308ce11 Author: Linus Torvalds Date: Tue Jul 29 18:07:19 2025 -0700 Merge tag 'perf-core-2025-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 performance events updates from Ingo Molnar: "Intel uncore driver enhancements (Kan Liang): - Support MSR portal for discovery tables - Support customized MMIO map size - Add Panther Lake support - Add IMC freerunning support for Panther Lake" * tag 'perf-core-2025-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf/x86/intel/uncore: Add iMC freerunning for Panther Lake perf/x86/intel/uncore: Add Panther Lake support perf/x86/intel/uncore: Support customized MMIO map size perf/x86/intel/uncore: Support MSR portal for discovery tables commit bf76f23aa1c178e9115eba17f699fa726aed669b Merge: 14bed9bc81bae6 1b5f1454091e9e Author: Linus Torvalds Date: Tue Jul 29 17:42:52 2025 -0700 Merge tag 'sched-core-2025-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull scheduler updates from Ingo Molnar: "Core scheduler changes: - Better tracking of maximum lag of tasks in presence of different slices duration, for better handling of lag in the fair scheduler (Vincent Guittot) - Clean up and standardize #if/#else/#endif markers throughout the entire scheduler code base (Ingo Molnar) - Make SMP unconditional: build the SMP scheduler's data structures and logic on UP kernel too, even though they are not used, to simplify the scheduler and remove around 200 #ifdef/[#else]/#endif blocks from the scheduler (Ingo Molnar) - Reorganize cgroup bandwidth control interface handling for better interfacing with sched_ext (Tejun Heo) Balancing: - Bump sd->max_newidle_lb_cost when newidle balance fails (Chris Mason) - Remove sched_domain_topology_level::flags to simplify the code (Prateek Nayak) - Simplify and clean up build_sched_topology() (Li Chen) - Optimize build_sched_topology() on large machines (Li Chen) Real-time scheduling: - Add initial version of proxy execution: a mechanism for mutex-owning tasks to inherit the scheduling context of higher priority waiters. Currently limited to a single runqueue and conditional on CONFIG_EXPERT, and other limitations (John Stultz, Peter Zijlstra, Valentin Schneider) - Deadline scheduler (Juri Lelli): - Fix dl_servers initialization order (Juri Lelli) - Fix DL scheduler's root domain reinitialization logic (Juri Lelli) - Fix accounting bugs after global limits change (Juri Lelli) - Fix scalability regression by implementing less agressive dl_server handling (Peter Zijlstra) PSI: - Improve scalability by optimizing psi_group_change() cpu_clock() usage (Peter Zijlstra) Rust changes: - Make Task, CondVar and PollCondVar methods inline to avoid unnecessary function calls (Kunwu Chan, Panagiotis Foliadis) - Add might_sleep() support for Rust code: Rust's "#[track_caller]" mechanism is used so that Rust's might_sleep() doesn't need to be defined as a macro (Fujita Tomonori) - Introduce file_from_location() (Boqun Feng) Debugging & instrumentation: - Make clangd usable with scheduler source code files again (Peter Zijlstra) - tools: Add root_domains_dump.py which dumps root domains info (Juri Lelli) - tools: Add dl_bw_dump.py for printing bandwidth accounting info (Juri Lelli) Misc cleanups & fixes: - Remove play_idle() (Feng Lee) - Fix check_preemption_disabled() (Sebastian Andrzej Siewior) - Do not call __put_task_struct() on RT if pi_blocked_on is set (Luis Claudio R. Goncalves) - Correct the comment in place_entity() (wang wei)" * tag 'sched-core-2025-07-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (84 commits) sched/idle: Remove play_idle() sched: Do not call __put_task_struct() on rt if pi_blocked_on is set sched: Start blocked_on chain processing in find_proxy_task() sched: Fix proxy/current (push,pull)ability sched: Add an initial sketch of the find_proxy_task() function sched: Fix runtime accounting w/ split exec & sched contexts sched: Move update_curr_task logic into update_curr_se locking/mutex: Add p->blocked_on wrappers for correctness checks locking/mutex: Rework task_struct::blocked_on sched: Add CONFIG_SCHED_PROXY_EXEC & boot argument to enable/disable sched/topology: Remove sched_domain_topology_level::flags x86/smpboot: avoid SMT domain attach/destroy if SMT is not enabled x86/smpboot: moves x86_topology to static initialize and truncate x86/smpboot: remove redundant CONFIG_SCHED_SMT smpboot: introduce SDTL_INIT() helper to tidy sched topology setup tools/sched: Add dl_bw_dump.py for printing bandwidth accounting info tools/sched: Add root_domains_dump.py which dumps root domains info sched/deadline: Fix accounting after global limits change sched/deadline: Reset extra_bw to max_bw when clearing root domains sched/deadline: Initialize dl_servers after SMP ... commit f627b51aaa041cba715b59026cf2d9cb1476c7ed Author: Kees Cook Date: Tue Jul 29 16:41:00 2025 -0700 compiler_types: Provide __no_kstack_erase to disable coverage only on Clang In order to support Clang's stack depth tracking (for Linux's kstack_erase feature), the coverage sanitizer needed to be disabled for __init (and __head) section code. Doing this universally (i.e. for GCC too) created a number of unexpected problems, ranging from changes to inlining logic to failures to DCE code on earlier GCC versions. Since this change is only needed for Clang, specialize it so that GCC doesn't see the change as it isn't needed there (the GCC implementation of kstack_erase uses a GCC plugin that removes stack depth tracking instrumentation from __init sections during a late pass in the IR). Successfully build and boot tested with GCC 12 and Clang 22. Fixes: 381a38ea53d2 ("init.h: Disable sanitizer coverage for __init and __head") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507270258.neWuiXLd-lkp@intel.com/ Reported-by: syzbot+5245cb609175fb6e8122@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6888d004.a00a0220.26d0e1.0004.GAE@google.com/ Reviewed-by: Nathan Chancellor Reviewed-by: Marco Elver Link: https://lore.kernel.org/r/20250729234055.it.233-kees@kernel.org Signed-off-by: Kees Cook commit 94fd44648dae2a5b6149a41faa0b07928c3e1963 Author: Kees Cook Date: Tue Jul 29 16:18:25 2025 -0700 fortify: Fix incorrect reporting of read buffer size When FORTIFY_SOURCE reports about a run-time buffer overread, the wrong buffer size was being shown in the error message. (The bounds checking was correct.) Fixes: 3d965b33e40d ("fortify: Improve buffer overflow reporting") Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20250729231817.work.023-kees@kernel.org Signed-off-by: Kees Cook commit 14bed9bc81bae64db98349319f367bfc7dab0afd Merge: 01fce21e1a8904 a7549636f67f97 Author: Linus Torvalds Date: Tue Jul 29 17:18:46 2025 -0700 Merge tag 'x86_sev_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 SEV updates from Borislav Petkov: - Map the SNP calling area pages too so that OVMF EFI fw can issue SVSM calls properly with the goal of implementing EFI variable store in the SVSM - a component which is trusted by the guest, vs in the firmware, which is not - Allow the kernel to handle #VC exceptions from EFI runtime services properly when running as a SNP guest - Rework and cleanup the SNP guest request issue glue code a bit * tag 'x86_sev_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/sev: Let sev_es_efi_map_ghcbs() map the CA pages too x86/sev/vc: Fix EFI runtime instruction emulation x86/sev: Drop unnecessary parameter in snp_issue_guest_request() x86/sev: Document requirement for linear mapping of guest request buffers x86/sev: Allocate request in TSC_INFO_REQ on stack virt: sev-guest: Contain snp_guest_request_ioctl in sev-guest commit fc525d625a22c2179877955ee87e33f532b0674c Author: Kees Cook Date: Tue Jul 29 16:50:48 2025 -0700 kstack_erase: Fix missed export of renamed KSTACK_ERASE_CFLAGS Certain targets disable kstack_erase by filtering out KSTACK_ERASE_CFLAGS rather than adding DISABLE_KSTACK_ERASE. The renaming to kstack_erase missed the CFLAGS export, which broke those build targets (e.g. x86 vdso32). Fixes: 76261fc7d1be ("stackleak: Split KSTACK_ERASE_CFLAGS from GCC_PLUGINS_CFLAGS") Signed-off-by: Kees Cook commit 01fce21e1a890462ba1f37b577fc96c10753c608 Merge: bb78c145f7f08f 9b355cdb63b1e4 Author: Linus Torvalds Date: Tue Jul 29 17:16:26 2025 -0700 Merge tag 'x86_microcode_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 microcode loader update from Borislav Petkov: - Switch the microcode loader from using the fake platform device to the new simple faux bus * tag 'x86_microcode_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/microcode: Move away from using a fake platform device commit bb78c145f7f08fda40bcec397939b01be4366c51 Merge: 04d29e3609b628 4fdc3431e03b9c Author: Linus Torvalds Date: Tue Jul 29 16:55:29 2025 -0700 Merge tag 'x86_core_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 cpu updates from Borislav Petkov: - Add helpers for WB{NO,}INVD with the purpose of using them in KVM and thus diminish the number of invalidations needed. With preceding cleanups, as always * tag 'x86_core_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/lib: Add WBINVD and WBNOINVD helpers to target multiple CPUs x86/lib: Add WBNOINVD helper functions x86/lib: Drop the unused return value from wbinvd_on_all_cpus() drm/gpu: Remove dead checks on wbinvd_on_all_cpus()'s return value commit 04d29e3609b62896b94b60250d475f8f7c15db98 Merge: d7223aed30cd77 a026dc61cffd98 Author: Linus Torvalds Date: Tue Jul 29 16:34:45 2025 -0700 Merge tag 'x86_bugs_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 CPU mitigation updates from Borislav Petkov: - Untangle the Retbleed from the ITS mitigation on Intel. Allow for ITS to enable stuffing independently from Retbleed, do some cleanups to simplify and streamline the code - Simplify SRSO and make mitigation types selection more versatile depending on the Retbleed mitigation selection. Simplify code some - Add the second part of the attack vector controls which provide a lot friendlier user interface to the speculation mitigations than selecting each one by one as it is now. Instead, the selection of whole attack vectors which are relevant to the system in use can be done and protection against only those vectors is enabled, thus giving back some performance to the users * tag 'x86_bugs_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (31 commits) x86/bugs: Print enabled attack vectors x86/bugs: Add attack vector controls for TSA x86/pti: Add attack vector controls for PTI x86/bugs: Add attack vector controls for ITS x86/bugs: Add attack vector controls for SRSO x86/bugs: Add attack vector controls for L1TF x86/bugs: Add attack vector controls for spectre_v2 x86/bugs: Add attack vector controls for BHI x86/bugs: Add attack vector controls for spectre_v2_user x86/bugs: Add attack vector controls for retbleed x86/bugs: Add attack vector controls for spectre_v1 x86/bugs: Add attack vector controls for GDS x86/bugs: Add attack vector controls for SRBDS x86/bugs: Add attack vector controls for RFDS x86/bugs: Add attack vector controls for MMIO x86/bugs: Add attack vector controls for TAA x86/bugs: Add attack vector controls for MDS x86/bugs: Define attack vectors relevant for each bug x86/Kconfig: Add arch attack vector support cpu: Define attack vectors ... commit d7223aed30cd77be31dabd635e709828f3255366 Merge: 909d2bb07dc0e0 35928bc38db69a Author: Linus Torvalds Date: Tue Jul 29 16:30:38 2025 -0700 Merge tag 'edac_updates_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras Pull EDAC updates from Borislav Petkov: - i10nm: - switch to using scnprintf() - Add Granite Rapids-D support - synopsys: Make sure ECC error and counter registers are cleared during init/probing to avoid reporting stale errors - igen6: Add Wildcat Lake SoCs support - Make sure scrub features sysfs attributes are initialized properly - Allocate memory repair sysfs attributes statically to reduce stack usage - Fix DIMM module size computation for DIMMs with total capacity which is a non power-of-two number, in amd64_edac - Do not be too dramatic when reporting disabled memory controllers in igen6_edac - Add support to ie31200_edac for the following SoCs: - Core i5-14[67]00 - Bartless Lake-S SoCs - Raptor Lake-HX * tag 'edac_updates_for_v6.17_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: EDAC/{skx_common,i10nm}: Use scnprintf() for safer buffer handling EDAC/synopsys: Clear the ECC counters on init EDAC/ie31200: Add Intel Raptor Lake-HX SoCs support EDAC/igen6: Add Intel Wildcat Lake SoCs support EDAC/i10nm: Add Intel Granite Rapids-D support EDAC/mem_repair: Reduce stack usage in edac_mem_repair_get_desc() EDAC/igen6: Reduce log level to debug for absent memory controllers EDAC/ie31200: Document which CPUs correspond to each Raptor Lake-S device ID EDAC/ie31200: Enable support for Core i5-14600 and i7-14700 ie31200/EDAC: Add Intel Bartlett Lake-S SoCs support commit 909d2bb07dc0e08ea81841f7c901f0f16f965f0e Merge: 0561bd5692d12d cf4fc66746e344 Author: Linus Torvalds Date: Tue Jul 29 16:14:07 2025 -0700 Merge tag 'stop-machine.2025.07.23a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull stop-machine documentation updates from Paul McKenney: - Improve kernel-doc function-header comments - Document preemption and stop_machine() mutual exclusion (Joel Fernandes) * tag 'stop-machine.2025.07.23a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: smp: Document preemption and stop_machine() mutual exclusion stop_machine: Improve kernel-doc function-header comments commit 0561bd5692d12d0c52e149e5922e32321f25981d Merge: 93942645c44f1e 5c23ce0cb897b4 Author: Linus Torvalds Date: Tue Jul 29 15:56:03 2025 -0700 Merge tag 'ratelimit.2025.07.23a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull ratelimit test updates from Paul McKenney: "Add functional and stress tests: - Add trivial kunit test for ratelimit - Make the ratelimit test more reliable (Petr Mladek) - Add stress test for ratelimit" * tag 'ratelimit.2025.07.23a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: lib: Add stress test for ratelimit lib: Make the ratelimit test more reliable lib: Add trivial kunit test for ratelimit commit 93942645c44f1ed4e834d162ae5ad9fb7ef07213 Merge: b1c21075d30c40 88172700423c27 Author: Linus Torvalds Date: Tue Jul 29 15:54:07 2025 -0700 Merge tag 'lkmm.2025.07.23a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu Pull lkmm documentation update from Paul McKenney: - Add wait_event_cmd() and wait_event_exclusive_cmd() to the list of wait primitives that provide the needed memory barriers (Håkon Bugge) * tag 'lkmm.2025.07.23a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu: docs/memory-barriers.txt: Add wait_event_cmd() and wait_event_exclusive_cmd() commit 85c34532849dae0fdcf880900ac9d7718a73fd1b Author: Kathiravan Thirumoorthy Date: Tue May 13 16:38:33 2025 +0530 i2c: qcom-geni: fix I2C frequency table to achieve accurate bus rates Update the I2C frequency table to match the recommended values specified in the I2C hardware programming guide. In the current IPQ5424 configuration where 32MHz is the source clock, the I2C bus frequencies do not meet expectations—for instance, 363KHz is achieved instead of the expected 400KHz. Fixes: 506bb2ab0075 ("i2c: qcom-geni: Support systems with 32MHz serial engine clock") Signed-off-by: Kathiravan Thirumoorthy Cc: # v6.13+ Reviewed-by: Mukesh Kumar Savaliya Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250513-i2c-bus-freq-v1-1-9a333ad5757f@oss.qualcomm.com commit b1c21075d30c40762750be0cded9822791df422b Merge: 78bb43e51b9482 b9e50363178a40 Author: Linus Torvalds Date: Tue Jul 29 15:32:02 2025 -0700 Merge tag 'nolibc-20250724-for-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc Pull nolibc updates from Thomas Weißschuh: "Highlights: - New supported architectures: SuperH, x32, MIPS n32/n64 - Adopt general kernel architectures names - Integrate the nolibc selftests into the kselftests framework - Various fixes and new syscall wrappers Two non-nolibc changes: - New arm64 selftest which depends on nolibc changes - General tools/ cross-compilation bugfix for s390 clang" * tag 'nolibc-20250724-for-6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/nolibc/linux-nolibc: (30 commits) selftests/nolibc: add x32 test configuration tools/nolibc: define time_t in terms of __kernel_old_time_t selftests/nolibc: show failed run if test process crashes tools/nolibc: drop s390 clang target override tools/build: Fix s390(x) cross-compilation with clang tools/nolibc: avoid false-positive -Wmaybe-uninitialized through waitpid() selftests/nolibc: correctly report errors from printf() and friends selftests/nolibc: create /dev/full when running as PID 1 tools/nolibc: add support for clock_nanosleep() and nanosleep() kselftest/arm64: Add a test for vfork() with GCS selftests/nolibc: Add coverage of vfork() tools/nolibc: Provide vfork() tools/nolibc: Replace ifdef with if defined() in sys.h tools/nolibc: add support for SuperH selftests/nolibc: use file driver for QEMU serial selftests/nolibc: fix EXTRACONFIG variables ordering tools/nolibc: MIPS: add support for N64 and N32 ABIs tools/nolibc: MIPS: drop noreorder option tools/nolibc: MIPS: drop manual stack pointer alignment tools/nolibc: MIPS: drop $gp setup ... commit f632472a2ab42536df720464098e52eb1c6b57ea Author: Nick Chan Date: Tue Jun 10 21:45:20 2025 +0800 dt-bindings: i2c: apple,i2c: Document Apple A7-A11, T2 compatibles The I2C controllers found on Apple A7-A11, T2 SoCs are compatible with the existing driver so add their per-SoC compatibles. Signed-off-by: Nick Chan Reviewed-by: Sven Peter Acked-by: Conor Dooley Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250610-i2c-no-t2-v2-1-a5a71080fba9@gmail.com commit 315b40df66c8f1d7be8056d9d418bb6976747389 Author: Akhil R Date: Thu Jul 10 18:42:06 2025 +0530 i2c: tegra: Remove dma_sync_*() calls Calling dma_sync_*() on a buffer from dma_alloc_coherent() is pointless. The driver should not be doing its own bounce-buffering if the buffer is allocated through dma_alloc_coherent(). Suggested-by: Robin Murphy Signed-off-by: Akhil R Reviewed-by: Thierry Reding Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250710131206.2316-4-akhilrajeev@nvidia.com commit 635bf3c8853359a987c5c909d424df92a0d3016a Author: Akhil R Date: Thu Jul 10 18:42:05 2025 +0530 i2c: tegra: Use internal reset when reset property is not available For controllers that has an internal software reset, make the reset property optional. This provides and option to use I2C in systems that choose to restrict reset control from Linux or not to implement the ACPI _RST method. Internal reset was not required when the reset control was mandatory. But on platforms where the resets are outside the control of Linux, this had to be implemented by just returning success from BPMP or with an empty _RST method in the ACPI table, basically ignoring the reset. While the internal reset is not identical to the hard reset of the controller, this will reset all the internal state of the controller including FIFOs. This may slightly alter the behaviour in systems which were ignoring the reset but it should not cause any functional difference since all the required I2C registers are configured after this reset, just as in boot. Considering that this sequence is hit during the boot or during the I2C recovery path from an error, the internal reset provides a better alternative than just ignoring the reset. Signed-off-by: Akhil R Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250710131206.2316-3-akhilrajeev@nvidia.com commit ffdd20555cc6fcb15e8a57d442c458034d169c7b Author: Clément Le Goffic Date: Fri Jul 4 10:39:16 2025 +0200 i2c: stm32f7: support i2c_*_dma_safe_msg_buf APIs `i2c_*_dma_safe_msg_buf` APIs operate on a `struct i2c_msg`. The get operation make sure the I2C buffer is DMA'able according to its buffer length, or if the memory use is DMA coherent for example and return a valid pointer for safe DMA access to be used. The put operation release the pointer. Prefer using generic API's than relying on private tests. Acked-by: Alain Volmat Signed-off-by: Clément Le Goffic Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250704-i2c-upstream-v4-3-84a095a2c728@foss.st.com commit 3cf186ecc164e19aa47450d412b2aa2f19559f9a Merge: c30cc9ffc1491f 60e61a4a597762 Author: Stephen Boyd Date: Tue Jul 29 15:19:32 2025 -0700 Merge branch 'clk-pm' into clk-next * clk-pm: clk: qcom: Remove redundant pm_runtime_mark_last_busy() calls clk: imx: Remove redundant pm_runtime_mark_last_busy() calls Documentation: PM: *_autosuspend() functions update last busy time PM: runtime: Mark last busy stamp in pm_request_autosuspend() PM: runtime: Mark last busy stamp in pm_runtime_autosuspend() PM: runtime: Mark last busy stamp in pm_runtime_put_sync_autosuspend() PM: runtime: Mark last busy stamp in pm_runtime_put_autosuspend() PM: runtime: Document return values of suspend-related API functions commit c30cc9ffc1491f049f1bffb8bac4ef3f553767d2 Merge: e3abdd1870b7dc a0a6f598e34312 853a7a63f8e955 53afec24ec9dd8 f46c06a302603d be72da73e2e638 Author: Stephen Boyd Date: Tue Jul 29 15:19:17 2025 -0700 Merge branches 'clk-rockchip', 'clk-thead', 'clk-microchip', 'clk-imx' and 'clk-qcom' into clk-next * clk-rockchip: clk: rockchip: rk3568: Add PLL rate for 132MHz * clk-thead: clk: thead: th1520-ap: Describe mux clocks with clk_mux clk: thead: th1520-ap: Correctly refer the parent of osc_12m clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED * clk-microchip: clk: at91: sam9x7: update pll clk ranges * clk-imx: MAINTAINERS: Update i.MX Clock Entry clk: imx95-blk-ctl: Add clock for i.MX94 LVDS/Display CSR clk: imx95-blk-ctl: Rename lvds and displaymix csr blk clk: imx95-blk-ctl: Fix synchronous abort dt-bindings: clock: Add support for i.MX94 LVDS/DISPLAY CSR clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data * clk-qcom: (65 commits) dt-bindings: clock: qcom,sm4450-dispcc: Reference qcom,gcc.yaml dt-bindings: clock: qcom,sm4450-camcc: Reference qcom,gcc.yaml dt-bindings: clock: qcom,mmcc: Reference qcom,gcc.yaml dt-bindings: clock: qcom,sm8150-camcc: Reference qcom,gcc.yaml dt-bindings: clock: qcom: Remove double colon from description clk: qcom: Add Video Clock controller (VIDEOCC) driver for Milos dt-bindings: clock: qcom: document the Milos Video Clock Controller clk: qcom: Add Graphics Clock controller (GPUCC) driver for Milos dt-bindings: clock: qcom: document the Milos GPU Clock Controller clk: qcom: Add Display Clock controller (DISPCC) driver for Milos dt-bindings: clock: qcom: document the Milos Display Clock Controller clk: qcom: Add Camera Clock controller (CAMCC) driver for Milos dt-bindings: clock: qcom: document the Milos Camera Clock Controller clk: qcom: Add Global Clock controller (GCC) driver for Milos dt-bindings: clock: qcom: document the Milos Global Clock Controller clk: qcom: common: Add support to register rcg dfs in qcom_cc_really_probe clk: qcom: gcc-x1e80100: Add missing video resets dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets clk: qcom: videocc-sm8550: Add separate frequency tables for X1E80100 clk: qcom: videocc-sm8550: Allow building without SM8550/SM8560 GCC ... commit e3abdd1870b7dcccf3447a78037217b95929587d Merge: f7887ee4ee2b1f b1712f94f7fcac 2a5cebd0fcaf65 c60b95389d0206 0b4ff5bc7d7555 8e766823592a44 Author: Stephen Boyd Date: Tue Jul 29 15:18:33 2025 -0700 Merge branches 'clk-renesas', 'clk-samsung', 'clk-spacemit', 'clk-allwinner' and 'clk-amlogic' into clk-next * clk-renesas: (42 commits) clk: renesas: r9a08g045: Add MSTOP for coupled clocks as well clk: renesas: r9a09g047: Add clock and reset signals for the GBETH IPs clk: renesas: r9a09g057: Add XSPI clock/reset clk: renesas: r9a09g056: Add XSPI clock/reset clk: renesas: rzv2h: Add fixed-factor module clocks with status reporting clk: renesas: r9a09g057: Add support for xspi mux and divider clk: renesas: r9a09g056: Add support for xspi mux and divider clk: renesas: r9a09g077: Add RIIC module clocks clk: renesas: r9a09g077: Add PLL2 and SDHI clock support clk: renesas: rzv2h: Drop redundant base pointer from pll_clk clk: renesas: r9a09g057: Add entries for the RSPIs dt-bindings: clock: renesas,r9a09g077/87: Add SDHI_CLKHS clock ID dt-bindings: clock: renesas,r9a09g056/57-cpg: Add XSPI core clock clk: renesas: rzv2h: Add missing include file clk: renesas: rzv2h: Use devm_kmemdup_array() clk: renesas: Add CPG/MSSR support to RZ/N2H SoC clk: renesas: r9a09g077: Add PCLKL core clock dt-bindings: clock: renesas,cpg-mssr: Document RZ/N2H support dt-bindings: soc: renesas: Document RZ/N2H (R9A09G087) SoC dt-bindings: clock: renesas,r9a09g077: Add PCLKL core clock ID ... * clk-samsung: clk: samsung: exynosautov920: add block hsi2 clock support dt-bindings: clock: exynosautov920: add hsi2 clock definitions dt-bindings: clock: exynosautov920: sort clock definitions clk: samsung: exynos850: fix a comment clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD * clk-spacemit: clk: spacemit: ccu_pll: fix error return value in recalc_rate callback reset: spacemit: add support for SpacemiT CCU resets clk: spacemit: mark K1 pll1_d8 as critical clk: spacemit: define three reset-only CCUs clk: spacemit: set up reset auxiliary devices soc: spacemit: create a header for clock/reset registers dt-bindings: soc: spacemit: define spacemit,k1-ccu resets * clk-allwinner: clk: sunxi-ng: ccu_nm: convert from round_rate() to determine_rate() clk: sunxi-ng: ccu_nkmp: convert from round_rate() to determine_rate() clk: sunxi-ng: ccu_nk: convert from round_rate() to determine_rate() clk: sunxi-ng: ccu_gate: convert from round_rate() to determine_rate() clk: sunxi-ng: v3s: Assign the de and tcon clocks to the video pll clk: sunxi-ng: v3s: Fix de clock definition clk: sunxi-ng: sun55i-a523-r-ccu: Add missing PPU0 reset dt-bindings: reset: sun55i-a523-r-ccu: Add missing PPU0 reset * clk-amlogic: clk: amlogic: s4: remove unused data clk: amlogic: drop clk_regmap tables clk: amlogic: get regmap with clk_regmap_init clk: amlogic: remove unnecessary headers clk: amlogic: axg-audio: use the auxiliary reset driver commit f7887ee4ee2b1fa2a538db4dbf3cec26538f317a Merge: e04c78d86a9699 17a6d7ceceeaf1 7f5e9ca0a424af f5f792f07bd23f ac32d031f508e4 af9019b5f15002 c3aa8c7278aeff Author: Stephen Boyd Date: Tue Jul 29 15:18:13 2025 -0700 Merge branches 'clk-bindings', 'clk-cleanup', 'clk-pwm', 'clk-hw-device', 'clk-xilinx' and 'clk-adi' into clk-next - Support atomic PWMs in the PWM clk driver - clk_hw_get_dev() and clk_hw_get_of_node() helpers * clk-bindings: (30 commits) dt-bindings: clock: convert lpc1850-cgu.txt to yaml format dt-bindings: clock: Convert qca,ath79-pll to DT schema dt-bindings: clock: Convert nuvoton,npcm750-clk to DT schema dt-bindings: clock: Convert moxa,moxart-clock to DT schema dt-bindings: clock: Convert microchip,pic32mzda-clk to DT schema dt-bindings: clock: Convert maxim,max9485 to DT schema dt-bindings: clock: Convert qcom,krait-cc to DT schema dt-bindings: clock: qcom: Remove double colon from description dt-bindings: clock: convert lpc1850-ccu.txt to yaml format dt-bindings: clock: Convert alphascale,asm9260-clock-controller to DT schema dt-bindings: clock: Convert marvell,armada-370-corediv-clock to DT schema dt-bindings: clock: Convert marvell,armada-3700-periph-clock to DT schema dt-bindings: clock: Convert marvell,mvebu-core-clock to DT schema dt-bindings: clock: Convert marvell,berlin2-clk to DT schema dt-bindings: clock: Convert marvell,dove-divider-clock to DT schema dt-bindings: clock: Convert marvell,armada-3700-tbg-clock to DT schema dt-bindings: clock: Convert marvell-armada-370-gating-clock to DT schema dt-bindings: clock: Convert marvell,armada-xp-cpu-clock to DT schema dt-bindings: clock: Convert TI-NSPIRE clocks to DT schema dt-bindings: clock: Convert lsi,axm5516-clks to DT schema ... * clk-cleanup: (29 commits) clk: clocking-wizard: Fix the round rate handling for versal clk: Fix typos clk: tegra: periph: Make tegra_clk_periph_ops static clk: tegra: periph: Fix error handling and resolve unsigned compare warning clk: imx: scu: convert from round_rate() to determine_rate() clk: imx: pllv4: convert from round_rate() to determine_rate() clk: imx: pllv3: convert from round_rate() to determine_rate() clk: imx: pllv2: convert from round_rate() to determine_rate() clk: imx: pll14xx: convert from round_rate() to determine_rate() clk: imx: pfd: convert from round_rate() to determine_rate() clk: imx: frac-pll: convert from round_rate() to determine_rate() clk: imx: fracn-gppll: convert from round_rate() to determine_rate() clk: imx: fixup-div: convert from round_rate() to determine_rate() clk: imx: cpu: convert from round_rate() to determine_rate() clk: imx: busy: convert from round_rate() to determine_rate() clk: imx: composite-93: remove round_rate() in favor of determine_rate() clk: imx: composite-8m: remove round_rate() in favor of determine_rate() clk: bcm: bcm2835: convert from round_rate() to determine_rate() MAINTAINERS: Include clk.py under COMMON CLK FRAMEWORK entry clk: ti: Simplify ti_find_clock_provider() ... * clk-pwm: clk: pwm: Make use of non-sleeping PWMs clk: pwm: Don't reconfigure running PWM at probe time clk: pwm: Convert to use pwm_apply_might_sleep() clk: pwm: Let .get_duty_cycle() return the real duty cycle * clk-hw-device: clk: tests: add clk_hw_get_dev() and clk_hw_get_of_node() tests clk: tests: Make clk_register_clk_parent_data_device_driver() common clk: add a clk_hw helpers to get the clock device or device_node * clk-xilinx: clk: xilinx: vcu: Update vcu init/reset sequence clk: xilinx: vcu: unregister pll_post only if registered correctly * clk-adi: clk: clk-axi-clkgen: fix coding style issues clk: clk-axi-clkgen move to min/max() clk: clk-axi-clkgen: detect axi_clkgen_limits at runtime include: adi-axi-common: add new helper macros include: linux: move adi-axi-common.h out of fpga clk: clk-axi-clkgen: make sure to include mod_devicetable.h clk: clk-axi-clkgen: fix fpfd_max frequency for zynq commit 78bb43e51b94828b333ab296eabf893d5b439fc2 Merge: a0482e3446cea4 5173ac2dc8c093 Author: Linus Torvalds Date: Tue Jul 29 15:14:29 2025 -0700 Merge tag 'core-entry-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull generic entry code updates from Thomas Gleixner: - Split the code into syscall and exception/interrupt parts to ease the conversion of ARM[64] to the generic entry infrastructure - Extend syscall user dispatching to support a single intercepted range instead of the default single non-intercepted range. That allows monitoring/analysis of a specific executable range, e.g. a library, and also provides flexibility for sandboxing scenarios - Cleanup and extend the user dispatch selftest * tag 'core-entry-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: entry: Split generic entry into generic exception and syscall entry selftests: Add tests for PR_SYS_DISPATCH_INCLUSIVE_ON syscall_user_dispatch: Add PR_SYS_DISPATCH_INCLUSIVE_ON selftests: Fix errno checking in syscall_user_dispatch test commit a0482e3446cea426bf16571e0000423ed5b25af0 Merge: f38b1f243ec3ba 437079605c26dc Author: Linus Torvalds Date: Tue Jul 29 15:12:29 2025 -0700 Merge tag 'timers-vdso-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull VDSO selftest updates from Thomas Gleixner: - Skip the chacha test when the architecture does not provide the random infrastructure in the VDSO - Switch back to a symlink for vdso_standalone_test_x86 to avoid code duplication. - Improve code quality and TAP output compliance * tag 'timers-vdso-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests: vDSO: vdso_standalone_test_x86: Replace source file with symlink selftests: vDSO: vdso_test_getrandom: Always print TAP header selftests: vDSO: vdso_test_correctness: Fix -Wstrict-prototypes selftests: vDSO: Enable -Wall selftests: vDSO: vdso_config: Avoid -Wunused-variables selftests: vDSO: vdso_test_getrandom: Avoid -Wunused selftests: vDSO: vdso_test_getrandom: Drop unused include of linux/compiler.h selftests: vDSO: clock_getres: Drop unused include of err.h selftests: vDSO: chacha: Correctly skip test if necessary commit f38b1f243ec3babea9d8d9c6240249589853aca2 Merge: 02dc9d15d7784a e40892214b454c Author: Linus Torvalds Date: Tue Jul 29 14:39:42 2025 -0700 Merge tag 'locking-futex-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull futex updates from Thomas Gleixner: - Switch the reference counting to a RCU based per-CPU reference to address a performance bottleneck vs the single instance rcuref variant - Make the futex selftest build on 32-bit architectures which only support 64-bit time_t, e.g. RISCV-32 - Cleanups and improvements in selftests and futex bench * tag 'locking-futex-2025-07-29' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: selftests/futex: Fix spelling mistake "Succeffuly" -> "Successfully" selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t perf bench futex: Remove support for IMMUTABLE selftests/futex: Remove support for IMMUTABLE futex: Remove support for IMMUTABLE futex: Make futex_private_hash_get() static futex: Use RCU-based per-CPU reference counting instead of rcuref_t selftests/futex: Adapt the private hash test to RCU related changes commit 7b8346bd9fce6b76a96c6780d2e5bba76687f97f Author: Raghavendra Rao Ananta Date: Tue Jul 29 21:06:44 2025 +0000 KVM: arm64: Don't attempt vLPI mappings when vPE allocation is disabled commit c652887a9288 ("KVM: arm64: vgic-v3: Allow userspace to write GICD_TYPER2.nASSGIcap") makes the allocation of vPEs depend on nASSGIcap for GICv4.1 hosts. While the vGIC v4 initialization and teardown is handled correctly, it erroneously attempts to establish a vLPI mapping to a VM that has no vPEs allocated: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8 Mem abort info: ESR = 0x0000000096000044 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000044, ISS2 = 0x00000000 CM = 0, WnR = 1, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=00000073a453b000 [00000000000000a8] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000044 [#1] SMP pstate: 23400009 (nzCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : its_irq_set_vcpu_affinity+0x58c/0x95c lr : its_irq_set_vcpu_affinity+0x1e0/0x95c sp : ffff8001029bb9e0 pmr_save: 00000060 x29: ffff8001029bba20 x28: ffff0001ca5e28c0 x27: 0000000000000000 x26: 0000000000000000 x25: ffff00019eee9f80 x24: ffff0001992b3f00 x23: ffff8001029bbab8 x22: ffff00001159fb80 x21: 00000000000024a7 x20: 00000000000024a7 x19: ffff00019eee9fb4 x18: 0000000000000494 x17: 000000000000000e x16: 0000000000000494 x15: 0000000000000002 x14: ffff0001a7f34600 x13: ffffccaad1203000 x12: 0000000000000018 x11: ffff000011991000 x10: 0000000000000000 x9 : 00000000000000a2 x8 : 00000000000020a8 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000004 x2 : 0000000000000000 x1 : ffff8001029bbab8 x0 : 00000000000000a8 Call trace: its_irq_set_vcpu_affinity+0x58c/0x95c irq_set_vcpu_affinity+0x74/0xc8 its_map_vlpi+0x4c/0x94 kvm_vgic_v4_set_forwarding+0x134/0x298 kvm_arch_irq_bypass_add_producer+0x28/0x34 irq_bypass_register_producer+0xf8/0x1d8 vfio_msi_set_vector_signal+0x2c8/0x308 vfio_pci_set_msi_trigger+0x198/0x2d4 vfio_pci_set_irqs_ioctl+0xf0/0x104 vfio_pci_core_ioctl+0x6ac/0xc5c vfio_device_fops_unl_ioctl+0x128/0x370 __arm64_sys_ioctl+0x98/0xd0 el0_svc_common+0xd8/0x1d8 do_el0_svc+0x28/0x34 el0_svc+0x40/0xb8 el0t_64_sync_handler+0x70/0xbc el0t_64_sync+0x1a8/0x1ac Code: 321f0129 f940094a 8b080148 d1400900 (39000009) ---[ end trace 0000000000000000 ]--- Fix it by moving the GICv4.1 special-casing to vgic_supports_direct_msis(), returning false if the user explicitly disabled nASSGIcap for the VM. Fixes: c652887a9288 ("KVM: arm64: vgic-v3: Allow userspace to write GICD_TYPER2.nASSGIcap") Suggested-by: Oliver Upton Signed-off-by: Raghavendra Rao Ananta Link: https://lore.kernel.org/r/20250729210644.830364-1-rananta@google.com Signed-off-by: Oliver Upton commit 02dc9d15d7784afb42ffde0ae3d8156dd09c2ff7 Merge: d614399b281abf cd3557a7618bf5 Author: Linus Torvalds Date: Tue Jul 29 14:12:52 2025 -0700 Merge tag 'timers-ptp-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timekeeping and VDSO updates from Thomas Gleixner: - Introduce support for auxiliary timekeepers PTP clocks can be disconnected from the universal CLOCK_TAI reality for various reasons including regularatory requirements for functional safety redundancy. The kernel so far only supports a single notion of time, which means that all clocks are correlated in frequency and only differ by offset to each other. Access to non-correlated PTP clocks has been available so far only through the file descriptor based "POSIX clock IDs", which are subject to locking and have to go all the way out to the hardware. The access is not only horribly slow, as it has to go all the way out to the NIC/PTP hardware, but that also prevents the kernel to read the time of such clocks e.g. from the network stack, where it is required for TSN networking both on the transmit and receive side unless the hardware provides offloading. The auxiliary clocks provide a mechanism to support arbitrary clocks which are not correlated to the system clock. This is not restricted to the PTP use case on purpose as there is no kernel side association of these clocks to a particular PTP device because that's a pure user space configuration decision. Having them independent allows to utilize them for other purposes and also enables them to be tested without hardware dependencies. To avoid pointless overhead these clocks have to be enabled individualy via a new sysfs interface to reduce the overhead to a single compare in the hotpath if they are enabled at the Kconfig level at all. These clocks utilize the existing timekeeping/NTP infrastructures, which has been made possible over the recent releases by incrementaly converting these infrastructures over from a single static instance to a multi-instance pointer based implementation without any performance regression reported. The auxiliary clocks provide the same "emulation" of a "correct" clock as the existing CLOCK_* variants do with an independent instance of data and provide the same steering mechanism through the existing sys_clock_adjtime() interface, which has been confirmed to work by the chronyd(8) maintainer. That allows to provide lockless kernel internal and VDSO support so that applications and kernel internal functionalities can access these clocks without restrictions and at the same performance as the existing system clocks. - Avoid double notifications in the adjtimex() syscall. Not a big issue, but a trivial to avoid latency source. * tag 'timers-ptp-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (39 commits) vdso/gettimeofday: Add support for auxiliary clocks vdso/vsyscall: Update auxiliary clock data in the datapage vdso: Introduce aux_clock_resolution_ns() vdso/gettimeofday: Introduce vdso_get_timestamp() vdso/gettimeofday: Introduce vdso_set_timespec() vdso/gettimeofday: Introduce vdso_clockid_valid() vdso/gettimeofday: Return bool from clock_gettime() helpers vdso/gettimeofday: Return bool from clock_getres() helpers vdso/helpers: Add helpers for seqlocks of single vdso_clock vdso/vsyscall: Split up __arch_update_vsyscall() into __arch_update_vdso_clock() vdso/vsyscall: Introduce a helper to fill clock configurations timekeeping: Remove the temporary CLOCK_AUX workaround timekeeping: Provide ktime_get_clock_ts64() timekeeping: Provide interface to control auxiliary clocks timekeeping: Provide update for auxiliary timekeepers timekeeping: Provide adjtimex() for auxiliary clocks timekeeping: Prepare do_adtimex() for auxiliary clocks timekeeping: Make do_adjtimex() reusable timekeeping: Add auxiliary clock support to __timekeeping_inject_offset() timekeeping: Make timekeeping_inject_offset() reusable ... commit d614399b281abf3980cc9b340a5066e9f4020b5d Merge: 99e731bcb8e6dd bfa788dc2ddaea Author: Linus Torvalds Date: Tue Jul 29 14:08:21 2025 -0700 Merge tag 'timers-core-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer core updates from Thomas Gleixner: - Simplify the logic in the timer migration code - Simplify the clocksource code by utilizing the more modern cpumask+*() interfaces * tag 'timers-core-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: clocksource: Use cpumask_next_wrap() in clocksource_watchdog() clocksource: Use cpumask_any_but() in clocksource_verify_choose_cpus() timers/migration: Clean up the loop in tmigr_quick_check() commit 99e731bcb8e6dd197aa4ab587887a3f670d12b72 Merge: 0b29600a304c0c e78f70bad29c5a Author: Linus Torvalds Date: Tue Jul 29 14:02:53 2025 -0700 Merge tag 'timers-cleanups-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull timer cleanups from Thomas Gleixner: "A treewide cleanup of struct cycle_counter const annotations. The initial idea of making them const was correct as they were seperate instances. When they got embedded into larger data structures, which are even modified by the callback this got moot. The only reason why this went unnoticed is that the required container_of() casts the const attribute forcefully away. Stop pretending that it is const" * tag 'timers-cleanups-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: time/timecounter: Fix the lie that struct cyclecounter is const commit 0b29600a304c0c5da17ce1a7fab7cafb0eaf71f5 Merge: b34111a89f3c78 2aad477b5b734f Author: Linus Torvalds Date: Tue Jul 29 13:26:05 2025 -0700 Merge tag 'irq-drivers-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull interrupt chip driver updates from Thomas Gleixner: - Add support of forced affinity setting to yet offline CPUs for the MIPS-GIC to ensure that the affinity of per CPU interrupts can be set during the early bringup phase of a secondary CPU in the hotplug code before the CPU is set online and interrupts are enabled - Add support for the MIPS (RISC-V !?!?) P8700 SoC in the ACLINT_SSWI interrupt chip - Make the interrupt routing to RISV-V harts specification compliant so it supports arbitrary hart indices - Add a command line parameter and related handling to disable the generic RISCV IMSIC mechanism on platforms which use a trap-emulated IMSIC. Unfortunatly this is required because there is no mechanism available to discover this programatically. - Enable wakeup sources on the Renesas RZV2H driver - Convert interrupt chip drivers, which use a open coded variant of msi_create_parent_irq_domain() to use the new functionality - Convert interrupt chip drivers, which use the old style two level implementation of MSI support over to the MSI parent mechanism to prepare for removing at least one of the three PCI/MSI backend variants. - The usual cleanups and improvements all over the place * tag 'irq-drivers-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (28 commits) irqchip/renesas-irqc: Convert to DEFINE_SIMPLE_DEV_PM_OPS() irqchip/renesas-intc-irqpin: Convert to DEFINE_SIMPLE_DEV_PM_OPS() irqchip/riscv-imsic: Add kernel parameter to disable IPIs irqchip/gic-v3: Fix GICD_CTLR register naming irqchip/ls-scfg-msi: Fix NULL dereference in error handling irqchip/ls-scfg-msi: Switch to use msi_create_parent_irq_domain() irqchip/armada-370-xp: Switch to msi_create_parent_irq_domain() irqchip/alpine-msi: Switch to msi_create_parent_irq_domain() irqchip/alpine-msi: Convert to __free irqchip/alpine-msi: Convert to lock guards irqchip/alpine-msi: Clean up whitespace style irqchip/sg2042-msi: Switch to msi_create_parent_irq_domain() irqchip/loongson-pch-msi.c: Switch to msi_create_parent_irq_domain() irqchip/imx-mu-msi: Convert to msi_create_parent_irq_domain() helper irqchip/riscv-imsic: Convert to msi_create_parent_irq_domain() helper irqchip/bcm2712-mip: Switch to msi_create_parent_irq_domain() irqdomain: Add device pointer to irq_domain_info and msi_domain_info irqchip/renesas-rzv2h: Remove unneeded includes irqchip/renesas-rzv2h: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND irqchip/aslint-sswi: Resolve hart index ... commit b34111a89f3c78baf12546bd4bc77a15dccc19c7 Merge: dba3ec9f2ad085 946a7281982530 Author: Linus Torvalds Date: Tue Jul 29 13:00:20 2025 -0700 Merge tag 'smp-core-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull smp updates from Thomas Gleixner: "A set of updates for SMP function calls: - Improve locality of smp_call_function_any() by utilizing sched_numa_find_nth_cpu() instead of picking a random CPU - Wait for work completion in smp_call_function_many_cond() only when there was actually work enqueued - Simplify functions by unutlizing the appropriate cpumask_*() interfaces - Trivial cleanups" * tag 'smp-core-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: smp: Wait only if work was enqueued smp: Defer check for local execution in smp_call_function_many_cond() smp: Use cpumask_any_but() in smp_call_function_many_cond() smp: Improve locality in smp_call_function_any() smp: Fix typo in comment for raw_smp_processor_id() commit dba3ec9f2ad085f05528ccd36d6835b06b5370cd Merge: 5623870d9b4f1b 8d39d6ec4db5da Author: Linus Torvalds Date: Tue Jul 29 12:55:12 2025 -0700 Merge tag 'irq-core-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull irq updates from Thomas Gleixner: - Prevent a interrupt migration related live lock in handle_edge_irq() If the interrupt affinity is moved to a new target CPU and the interrupt is currently handled on the previous target CPU for edge type interrupts the handler might get stuck on the previous target for a long time, which causes both involved CPUs to waste cycles and eventually run into a soft-lockup situation. Solve this by checking whether the interrupt is redirected to a new target CPU and if the interrupt is handled on that new target CPU, busy wait for completion instead of masking it and sending the pending but which would cause the old CPU to re-run the handler and in the worst case repeating this excercise for a long time. This only works on architectures which use single CPU interrupt targets, but that's so far the only ones where this behaviour has been observed. - Add a kunit test for interrupt disable depth counts The nested interrupt disable depth has been an issue in the past especially vs. free_irq(), interrupt shutdown and CPU hotplug and their interactions. The test exercises the combinations of these scenarios and checks for correctness. * tag 'irq-core-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: genirq: Prevent migration live lock in handle_edge_irq() genirq: Split up irq_pm_check_wakeup() genirq: Move irq_wait_for_poll() to call site genirq: Remove pointless local variable genirq: Add kunit tests for depth counts commit 5623870d9b4f1b9bd4a8b75544f2f9ed2a49afff Merge: 0db240bc077fd1 4a089c0b3f55b4 Author: Linus Torvalds Date: Tue Jul 29 12:52:06 2025 -0700 Merge tag 'irq-msi-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull MSI update from Thomas Gleixner: "A trivial cleanup in the PCI/MSI code to remove a duplicated back and forth conversion" * tag 'irq-msi-2025-07-27' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: PCI/MSI: Remove duplicated to_pci_dev() conversion commit 0db240bc077fd16cc16bcecfd7f4645bc474aa7e Merge: 6f46e6fb4e267a 30fb5e134f0580 Author: Linus Torvalds Date: Tue Jul 29 12:48:53 2025 -0700 Merge tag 'linux_kselftest-next-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: - Fixes: - false failure of subsystem event test - glob filter test to use mutex_unlock() instead of mutex_trylock() - several spelling errors in tests - test_kexec_jump build errors - pidfd test duplicate-symbol warnings for SCHED_ CPP symbols - Add a reliable check for suspend to breakpoints suspend test - Improvements to ipc test * tag 'linux_kselftest-next-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/pidfd: Fix duplicate-symbol warnings for SCHED_ CPP symbols selftests/tracing: Fix false failure of subsystem event test selftests/kexec: fix test_kexec_jump build selftests: breakpoints: use suspend_stats to reliably check suspend success selftests: tracing: Use mutex_unlock for testing glob filter selftests: print installation complete message selftests/ptrace: Fix spelling mistake "multible" -> "multiple" selftests: ipc: Replace fail print statements with ksft_test_result_fail selftests: Add version file to kselftest installation dir selftests/cpu-hotplug: fix typo in hotplaggable_offline_cpus function name commit 6f46e6fb4e267acf8741cb2c29d368b4de7b6c15 Merge: 22c5696e3fe029 34db4fba81916a Author: Linus Torvalds Date: Tue Jul 29 12:43:10 2025 -0700 Merge tag 'linux_kselftest-kunit-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit updates from Shuah Khan: "Correct MODULE_IMPORT_NS() syntax documentation, make kunit_test timeout configurable via a module parameter and a Kconfig option, fix longest symbol length test, add a test for static stub, and adjust kunit_test timeout based on test_{suite,case} speed" * tag 'linux_kselftest-kunit-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit: fix longest symbol length test kunit: Make default kunit_test timeout configurable via both a module parameter and a Kconfig option kunit: Adjust kunit_test timeout based on test_{suite,case} speed kunit: Add test for static stub Documentation: kunit: Correct MODULE_IMPORT_NS() syntax commit 22c5696e3fe029f4fc2decbe7cc6663b5d281223 Merge: 854ff792375300 51a486feac0ca0 Author: Linus Torvalds Date: Tue Jul 29 12:15:39 2025 -0700 Merge tag 'driver-core-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core Pull driver core updates from Danilo Krummrich: "debugfs: - Remove unneeded debugfs_file_{get,put}() instances - Remove last remnants of debugfs_real_fops() - Allow storing non-const void * in struct debugfs_inode_info::aux sysfs: - Switch back to attribute_group::bin_attrs (treewide) - Switch back to bin_attribute::read()/write() (treewide) - Constify internal references to 'struct bin_attribute' Support cache-ids for device-tree systems: - Add arch hook arch_compact_of_hwid() - Use arch_compact_of_hwid() to compact MPIDR values on arm64 Rust: - Device: - Introduce CoreInternal device context (for bus internal methods) - Provide generic drvdata accessors for bus devices - Provide Driver::unbind() callbacks - Use the infrastructure above for auxiliary, PCI and platform - Implement Device::as_bound() - Rename Device::as_ref() to Device::from_raw() (treewide) - Implement fwnode and device property abstractions - Implement example usage in the Rust platform sample driver - Devres: - Remove the inner reference count (Arc) and use pin-init instead - Replace Devres::new_foreign_owned() with devres::register() - Require T to be Send in Devres - Initialize the data kept inside a Devres last - Provide an accessor for the Devres associated Device - Device ID: - Add support for ACPI device IDs and driver match tables - Split up generic device ID infrastructure - Use generic device ID infrastructure in net::phy - DMA: - Implement the dma::Device trait - Add DMA mask accessors to dma::Device - Implement dma::Device for PCI and platform devices - Use DMA masks from the DMA sample module - I/O: - Implement abstraction for resource regions (struct resource) - Implement resource-based ioremap() abstractions - Provide platform device accessors for I/O (remap) requests - Misc: - Support fallible PinInit types in Revocable - Implement Wrapper for Opaque - Merge pin-init blanket dependencies (for Devres) Misc: - Fix OF node leak in auxiliary_device_create() - Use util macros in device property iterators - Improve kobject sample code - Add device_link_test() for testing device link flags - Fix typo in Documentation/ABI/testing/sysfs-kernel-address_bits - Hint to prefer container_of_const() over container_of()" * tag 'driver-core-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (84 commits) rust: io: fix broken intra-doc links to `platform::Device` rust: io: fix broken intra-doc link to missing `flags` module rust: io: mem: enable IoRequest doc-tests rust: platform: add resource accessors rust: io: mem: add a generic iomem abstraction rust: io: add resource abstraction rust: samples: dma: set DMA mask rust: platform: implement the `dma::Device` trait rust: pci: implement the `dma::Device` trait rust: dma: add DMA addressing capabilities rust: dma: implement `dma::Device` trait rust: net::phy Change module_phy_driver macro to use module_device_table macro rust: net::phy represent DeviceId as transparent wrapper over mdio_device_id rust: device_id: split out index support into a separate trait device: rust: rename Device::as_ref() to Device::from_raw() arm64: cacheinfo: Provide helper to compress MPIDR value into u32 cacheinfo: Add arch hook to compress CPU h/w id into 32 bits for cache-id cacheinfo: Set cache 'id' based on DT data container_of: Document container_of() is not to be used in new code driver core: auxiliary bus: fix OF node leak ... commit 6443cdf567a900e03afe1d66fb8bcc7dad0835d0 Author: Colin Ian King Date: Mon Jul 14 17:08:58 2025 +0100 ring-buffer: Make the const read-only 'type' static Don't populate the read-only 'type' on the stack at run time, instead make it static. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250714160858.1234719-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Signed-off-by: Steven Rostedt (Google) commit 854ff7923753009189a9e1f80d23ae9d407c2fb2 Merge: fc8f5028eb0cc5 c3ad4ec3fdaba1 Author: Linus Torvalds Date: Tue Jul 29 12:05:38 2025 -0700 Merge tag 'mmc-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc Pull MMC updates from Ulf Hansson: "MMC core: - Remove redundant pm_runtime_mark_last_busy() calls MMC host: - Convert drivers to use devm_mmc_alloc_host() - Remove redundant pm_runtime_mark_last_busy() calls - renesas_sdhi: - Add support for the RZ/T2H and RZ/N2H variants - Fix incorrect auto retuning for an SDIO card - rtsx_usb_sdmmc: - Add 74 clocks in poweron flow - Re-work the code in sd_set_power_mode() - loongson2: - Add driver for the Loongson-2K SD/SDIO controller - Add support for the Loongson-2K2000 SD/SDIO/eMMC controller - sdhci: - Drop sdhci_free_host()/sdhci_pltfm_free() interface - Remove the sdhci_free_host() and sdhci_pltfm_free() helpers - sdhci-cadence: Add support for the Mobileye EyeQ controller - sdhci-esdhc-imx: - Optimize clock loopback selection - Don't change pinctrl in suspend if wakeup source - sdhci-msm: - Add support for the Milos variant - Add support for the qcs8300 variant - Ensure SD card power isn't ON when card gets removed - sdhci-of-k1: Disable HW busy detection" * tag 'mmc-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc: (102 commits) mmc: loongson2: Unify the function prefixes for loongson2_mmc_pdata mmc: loongson2: Fix error code in loongson2_mmc_resource_request() dt-bindings: mmc: sdhci-msm: document the Milos SDHCI Controller mmc: loongson2: prevent integer overflow in ret variable mmc: Remove redundant pm_runtime_mark_last_busy() calls mmc: sdhci-msm: Ensure SD card power isn't ON when card removed dt-bindings: mmc: Add sdhci compatible for qcs8300 mmc: sdhci-cadence: use of_property_present mmc: loongson2: Add Loongson-2K2000 SD/SDIO/eMMC controller driver dt-bindings: mmc: loongson,ls2k0500-mmc: Add compatible for Loongson-2K2000 mmc: loongson2: Add Loongson-2K SD/SDIO controller driver dt-bindings: mmc: Add Loongson-2K SD/SDIO/eMMC controller binding mmc: Convert ternary operator to str_true_false() helper dt-bindings: mmc: renesas,sdhi: Document RZ/T2H and RZ/N2H support mmc: sdhci-cadence: add Mobileye eyeQ support dt-bindings: mmc: cdns: add Mobileye EyeQ MMC/SDHCI controller mmc: rtsx_usb_sdmmc: Fix clang -Wimplicit-fallthrough in sd_set_power_mode() mmc: cb710-mmc: Convert ternary operator to str_plural() helper mmc: rtsx_usb_sdmmc: Add 74 clocks in poweron flow mmc: rtsx_usb_sdmmc: Re-work the code in sd_set_power_mode() ... commit 5e32d0f15cc5c843a4115c4644d984d42524c794 Author: Steven Rostedt Date: Tue Jul 29 14:23:06 2025 -0400 unwind_user/deferred: Add unwind_user_faultable() Add a new API to retrieve a user space callstack called unwind_user_faultable(). The difference between this user space stack tracer from the current user space stack tracer is that this must be called from faultable context as it may use routines to access user space data that needs to be faulted in. It can be safely called from entering or exiting a system call as the code can still be faulted in there. This code is based on work by Josh Poimboeuf's deferred unwinding code: Link: https://lore.kernel.org/all/6052e8487746603bdb29b65f4033e739092d9925.1737511963.git.jpoimboe@kernel.org/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Josh Poimboeuf Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Thomas Gleixner Cc: Andrii Nakryiko Cc: Indu Bhagat Cc: "Jose E. Marchesi" Cc: Beau Belgrave Cc: Linus Torvalds Cc: Andrew Morton Cc: Jens Axboe Cc: Florian Weimer Cc: Sam James Link: https://lore.kernel.org/20250729182405.147896868@kernel.org Reviewed-by: Jens Remus Signed-off-by: Steven Rostedt (Google) commit 71753c6ed2bf2aee5be26c1bc06a94c9e3713ade Author: Josh Poimboeuf Date: Tue Jul 29 14:23:05 2025 -0400 unwind_user: Add user space unwinding API with frame pointer support Introduce a generic API for unwinding user stacks. In order to expand user space unwinding to be able to handle more complex scenarios, such as deferred unwinding and reading user space information, create a generic interface that all architectures can use that support the various unwinding methods. This is an alternative method for handling user space stack traces from the simple stack_trace_save_user() API. This does not replace that interface, but this interface will be used to expand the functionality of user space stack walking. None of the structures introduced will be exposed to user space tooling. Support for frame pointer unwinding is added. For an architecture to support frame pointer unwinding it needs to enable CONFIG_HAVE_UNWIND_USER_FP and define ARCH_INIT_USER_FP_FRAME. By encoding the frame offsets in struct unwind_user_frame, much of this code can also be reused for future unwinder implementations like sframe. Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Ingo Molnar Cc: Jiri Olsa Cc: Arnaldo Carvalho de Melo Cc: Namhyung Kim Cc: Thomas Gleixner Cc: Andrii Nakryiko Cc: Indu Bhagat Cc: "Jose E. Marchesi" Cc: Beau Belgrave Cc: Linus Torvalds Cc: Andrew Morton Cc: Jens Axboe Cc: Florian Weimer Cc: Sam James Link: https://lore.kernel.org/20250729182404.975790139@kernel.org Reviewed-by: Jens Remus Signed-off-by: Josh Poimboeuf Co-developed-by: Mathieu Desnoyers Link: https://lore.kernel.org/all/20250710164301.3094-2-mathieu.desnoyers@efficios.com/ Signed-off-by: Mathieu Desnoyers Co-developed-by: Steven Rostedt (Google) Signed-off-by: Steven Rostedt (Google) commit fc8f5028eb0cc5aee0501a99f59a04f748fbff1c Merge: 0ae982df67760c 05e35bd07d5678 Author: Linus Torvalds Date: Tue Jul 29 11:42:31 2025 -0700 Merge tag 'pmdomain-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain updates from Ulf Hansson: "pmdomain core: - Leave powered-on genpds on until ->sync_state() or late_initcall_sync - Export a common ->sync_state() helper for genpd providers - Add generic ->sync_state() support - Add a bus/driver for genpd provider-devices - Introduce dev_pm_genpd_is_on() for consumers pmdomain providers: - cpuidle-psci: Drop redundant ->sync_state() support - cpuidle-riscv-sbi: Drop redundant ->sync_state() support - imx: Set ISI panic write for imx8m-blk-ctrl - qcom: Add support for Glymur and Milos RPMh power-domains - qcom: Use of_genpd_sync_state() for power-domains - rockchip: Add support for the RK3528 variant - samsung: Fix splash-screen handover by enforcing a ->sync_state() - sunxi: Add support for Allwinner A523's PCK600 power-controller - tegra: Opt-out from genpd's common ->sync_state() support for pmc - thead: Instantiate a GPU power sequencer via the auxiliary bus - renesas: Move init to postcore_initcalls - xilinx: Move ->sync_state() support to firmware driver - xilinx: Use of_genpd_sync_state() for power-domains pmdomain consumers: - remoteproc: imx_rproc: Fixup the detect/attach procedure for pre-booted cores" * tag 'pmdomain-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: (44 commits) pmdomain: qcom: rpmhpd: Add Glymur RPMh Power Domains dt-bindings: power: rpmpd: Add Glymur power domains remoteproc: imx_rproc: detect and attach to pre-booted remote cores remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU pmdomain: core: introduce dev_pm_genpd_is_on() pmdomain: ti: Select PM_GENERIC_DOMAINS pmdomain: sunxi: sun20i-ppu: change to tristate and enable for ARCH_SUNXI pmdomain: sunxi: add driver for Allwinner A523's PCK-600 power controller pmdomain: sunxi: sun20i-ppu: add A523 support pmdomain: samsung: Fix splash-screen handover by enforcing a sync_state cpuidle: riscv-sbi: Drop redundant sync_state support cpuidle: psci: Drop redundant sync_state support pmdomain: core: Leave powered-on genpds on until sync_state pmdomain: core: Leave powered-on genpds on until late_initcall_sync pmdomain: core: Default to use of_genpd_sync_state() for genpd providers driver core: Add dev_set_drv_sync_state() pmdomain: core: Add common ->sync_state() support for genpd providers driver core: Export get_dev_from_fwnode() firmware: xilinx: Use of_genpd_sync_state() firmware: xilinx: Don't share zynqmp_pm_init_finalize() ... commit 0ae982df67760cd08affa935c0fe86c8a9311797 Merge: 0919a5b3b11c69 1c24e5fc0c7096 Author: Linus Torvalds Date: Tue Jul 29 11:35:24 2025 -0700 Merge tag 'i2c-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux Pull i2c updates from Wolfram Sang: "I2C Core: - prevent double-free of an fwnode if it is a software node - use recent helpers instead of custom ACPI or outdated OF ones - add a more elaborate description of a message flag Cleanups and refactorings: - lpi2c, riic, st, stm32f7: general improvements - riic: support more flexible IRQ configurations - tegra: fix documentation Improvements: - lpi2c: improve register polling and add atomic transfer - imx: use guarded spinlocks New hardware support: - Samsung Exynos 2200 - Renesas RZ/T2H (R9A09G077), RZ/N2H (R9A09G087) DT binding: - rk3x: enable power domains - nxp: support clock property" * tag 'i2c-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: i2c: core: Fix double-free of fwnode in i2c_unregister_device() i2c: lpi2c: implement xfer_atomic callback i2c: lpi2c: use readl_poll_timeout() for register polling dt-bindings: i2c: i2c-rk3x: Allow use of a power-domain dt-bindings: i2c: exynos5: add samsung,exynos2200-hsi2c compatible i2c: lpi2c: convert to use secs_to_jiffies() i2c: st: Use min() to improve code i2c: imx: use guard to take spinlock i2c: stm32f7: Use str_on_off() helper dt-bindings: i2c: nxp,pnx-i2c: allow clocks property i2c: riic: Add support for RZ/T2H SoC i2c: riic: Move generic compatible string to end of array i2c: riic: Pass IRQ desc array as part of OF data dt-bindings: i2c: renesas,riic: Document RZ/T2H and RZ/N2H support dt-bindings: i2c: renesas,riic: Move ref for i2c-controller.yaml to the end i2c: tegra: Add missing kernel-doc for dma_dev member i2c: Clarify behavior of I2C_M_RD flag i2c: mux: pca954x: Use dev_fwnode() i2c: acpi: Replace custom code with device_match_acpi_handle() commit 0919a5b3b11c699d23bc528df5709f2e3213f6a9 Merge: 4c10d2221122a6 8c1f5a11dad0a9 Author: Linus Torvalds Date: Tue Jul 29 11:30:17 2025 -0700 Merge tag 'soc-arm-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull ARM SoC code updates from Arnd Bergmann: "Another small set of code changes for the 32-bit Arm platforms, and a trivial update to the Kconfig entry for the arm64 TI K3 chip. Andrew Davis cleans up the system reset handling, which touches a couple of platforms. The mediatek platform needs some code changes to support multiprocessing in the newly added support for the old mt6572 chip" * tag 'soc-arm-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: ARM: sa110/gpio: convert set_multiple() to returning an integer ARM: rockchip: fix kernel hang during smp initialization ARM: mediatek: add MT6572 smp bring up code ARM: mediatek: add board_dt_compat entry for the MT6572 SoC ARM: tegra: Use I/O memcpy to write to IRAM arm: orion: use string choices helper ARM: Switch to new sys-off handler API arm64: Kconfig.platforms: remove useless select for ARCH_K3 commit 4c10d2221122a62f7c181f0c433bc43bfd6f5d3d Merge: 4df9c0a2465a52 5cfe03e1ca42fa Author: Linus Torvalds Date: Tue Jul 29 11:27:41 2025 -0700 Merge tag 'soc-defconfig-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC defconfig updates from Arnd Bergmann: "As usual, more drivers get enabled in the defconfigs, to support newly added hardware drivers. There is one change for Tegra that modifies the Kconfig file at the same time, and the NXP arm32 defconfigs get a refresh" * tag 'soc-defconfig-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits) arm: multi_v7_defconfig: Enable TPS65219 regulator arm: omap2plus_defconfig: Enable TPS65219 regulator arm64: defconfig: Enable Tegra241 and Tegra264 riscv: defconfig: spacemit: enable sdhci driver for K1 SoC riscv: defconfig: Enable PWM support for SpacemiT K1 SoC riscv: defconfig: Remove CONFIG_SND_SOC_STARFIVE=m arm64: defconfig: Enable Tegra HSP and BPMP ARM: imx_v6_v7_defconfig: select CONFIG_USB_HSIC_USB3503 ARM: imx_v6_v7_defconfig: select CONFIG_INPUT_PWM_BEEPER ARM: imx_v6_v7_defconfig: cleanup with savedefconfig ARM: mxs_defconfig: select new drivers used by imx28-amarula-rmm ARM: mxs_defconfig: Cleanup mxs_defconfig arm64: defconfig: enable further Rockchip platform drivers arm64: defconfig: enable Samsung PMIC over ACPM arm64: defconfig: enable Maxim max77759 driver ARM: configs: sama5_defconfig: Select CONFIG_WILC1000_SDIO ARM: shmobile: defconfig: Refresh for v6.16-rc2 arm64: defconfig: Enable RZ/V2H(P) USB2 PHY controller reset driver arm64: defconfig: add S32G RTC module support arm64: defconfig: Drop unneeded unselectable sound drivers ... commit 4df9c0a2465a523e399e46a8d3b5866c769b381b Merge: 0f46f50845ce75 05a623030b3cc2 Author: Linus Torvalds Date: Tue Jul 29 11:17:24 2025 -0700 Merge tag 'soc-newsoc-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull new SoC support from Arnd Bergmann: "These five newly supported chips come with both devicetree descriptions and the changes to wire them up to the build system for easier bisection. The chips in question are: - Marvell PXA1908 was the first 64-bit mobile phone chip from Marvell in the product line that started with the Digital StrongARM SA1100 based PDAs and continued with the Intel PXA2xx that dominated early smartphones. This one only made it only into a few products before the entire product line was cut in 2015. - The QiLai SoC is made by RISC-V core designer Andes Technologies and is in the 'Voyager' reference board in MicroATX form factor. It uses four in-order AX45MP cores, which is the midrange product from Andes. - CIX P1 is one of the few Arm chips designed for small workstations, and this one uses 12 Cortex-A720/A520 cores, making it also one of the only ARMv9.2 machines that one can but at the moment. - Axiado AX3000 is an embedded chip with relative small Cortex-A53 CPU cores described as a "Trusted Control/Compute Unit" that can be used as a BMC in servers. In addition to the usual I/O, this one comes with 10GBit ethernet and and a 4TOPS NPU. - Sophgo SG2000 is an embedded chip that comes with both RISC-V and Arm cores that can run Linux. This was already supported for RISC-V but now it also works on Arm One more chip, the Black Sesame C1200 did not make it in tirm for the merge window" * tag 'soc-newsoc-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (38 commits) arm64: defconfig: Enable rudimentary Sophgo SG2000 support arm64: Add SOPHGO SOC family Kconfig support arm64: dts: sophgo: Add Duo Module 01 Evaluation Board arm64: dts: sophgo: Add Duo Module 01 arm64: dts: sophgo: Add initial SG2000 SoC device tree MAINTAINERS: Add entry for Axiado arm64: defconfig: enable the Axiado family arm64: dts: axiado: Add initial support for AX3000 SoC and eval board arm64: add Axiado SoC family dt-bindings: i3c: cdns: add Axiado AX3000 I3C controller dt-bindings: serial: cdns: add Axiado AX3000 UART controller dt-bindings: gpio: cdns: add Axiado AX3000 GPIO variant dt-bindings: gpio: cdns: convert to YAML dt-bindings: arm: axiado: add AX3000 EVK compatible strings dt-bindings: vendor-prefixes: Add Axiado Corporation MAINTAINERS: Add CIX SoC maintainer entry arm64: dts: cix: Add sky1 base dts initial support dt-bindings: clock: cix: Add CIX sky1 scmi clock id arm64: defconfig: Enable CIX SoC mailbox: add CIX mailbox driver ... commit 0f46f50845ce75bfaba62df0421084d23bb6a72f Merge: 115e74a29b530d 4507d205f10216 Author: Linus Torvalds Date: Tue Jul 29 11:13:27 2025 -0700 Merge tag 'soc-drivers-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "Changes are all over the place, but very little sticks out as noteworthy. There is a new misc driver for the Raspberry Pi 5's RP1 multifunction I/O chip, along with hooking it up to the pinctrl and clk frameworks. The reset controller and memory subsystems have mainly small updates, but there are two new reset drivers for the K230 and VC1800B SoCs, and new memory driver support for Tegra264. The ARM SMCCC and SCMI firmware drivers gain a few more features that should help them be supported across more environments. Similarly, the SoC specific firmware on Tegra and Qualcomm get minor enhancements and chip support. In the drivers/soc/ directory, the ASPEED LPC snoop driver gets an overhaul for code robustness, the Tegra and Qualcomm and NXP drivers grow to support more chips, while the Hisilicon, Mediatek and Renesas drivers see mostly janitorial fixes" * tag 'soc-drivers-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (100 commits) bus: del unnecessary init var soc: fsl: qe: convert set_multiple() to returning an integer pinctrl: rp1: use new GPIO line value setter callbacks soc: hisilicon: kunpeng_hccs: Fix incorrect log information dt-bindings: soc: qcom: qcom,pmic-glink: document Milos compatible dt-bindings: soc: qcom,aoss-qmp: document the Milos Always-On Subsystem side channel dt-bindings: firmware: qcom,scm: document Milos SCM Firmware Interface soc: qcom: socinfo: Add support to retrieve APPSBL build details soc: qcom: pmic_glink: fix OF node leak soc: qcom: spmi-pmic: add more PMIC SUBTYPE IDs soc: qcom: socinfo: Add PM7550 & PMIV0108 PMICs soc: qcom: socinfo: Add SoC IDs for SM7635 family dt-bindings: arm: qcom,ids: Add SoC IDs for SM7635 family firmware: qcom: scm: request the waitqueue irq *after* initializing SCM firmware: qcom: scm: initialize tzmem before marking SCM as available firmware: qcom: scm: take struct device as argument in SHM bridge enable firmware: qcom: scm: remove unused arguments from SHM bridge routines soc: qcom: rpmh-rsc: Add RSC version 4 support memory: tegra: Add Tegra264 MC and EMC support firmware: tegra: bpmp: Fix build failure for tegra264-only config ... commit 115e74a29b530d121891238e9551c4bcdf7b04b5 Merge: 69f2970aad9375 ac75da105eb38d Author: Linus Torvalds Date: Tue Jul 29 11:04:52 2025 -0700 Merge tag 'soc-dt-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC devicetree updates from Arnd Bergmann: "There are a few new variants of existing chips: - mt6572 is an older mobile phone chip from mediatek that was extremely popular a decade ago but never got upstreamed until now - exynos2200 is a recent high-end mobile phone chip used in a few Samsung phones like the Galaxy S22 - Renesas R-Car V4M-7 (R8A779H2) is an updated version of R-Car V4M (R8A779H0) and used in automotive applications - Tegra264 is a new chip from NVIDIA, but support is fairly minimal for now, and not much information is public about it There are five more chips in a separate branch, as those are new chip families that I merged along with the necessary infrastructure. New board support is not that exciting, with a total of 33 newly added machines here: - Evaluation platforms for the chips above, plus TI am62d2 and Sophgo sg2042 - Six 32-bit industrial boards based on stm32, imx6 and am33 chips, plus eight 64-bit rockchips rk33xx/rk35xx, am62d2, t527, imx8 and imx95 - Two newly added ASPEED BMC based motherboards, and one that got removed - Phones and Tablets based on 32-bit mt6572, tegra30 and 64-bit msm8976 SoCs - Three Laptops based on Mediatek mt8186 and Qualcomm Snapdragon X1 - A set-top box based on Amlogic meson-gxm Updates for existing machines are spread over all the above families. One notable change here is support for the RP1 I/O chip used in Raspberry Pi 5" * tag 'soc-dt-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (606 commits) riscv: dts: sophgo: fix mdio node name for CV180X riscv: dts: sophgo: sophgo-srd3-10: reserve uart0 device riscv: dts: sophgo: add Sophgo SG2042_EVB_V2.0 board device tree riscv: dts: sophgo: add Sophgo SG2042_EVB_V1.X board device tree dt-bindings: riscv: add Sophgo SG2042_EVB_V1.X/V2.0 bindings riscv: dts: sophgo: add ethernet GMAC device for sg2042 riscv: dts: sophgo: Enable ethernet device for Huashan Pi riscv: dts: sophgo: Add mdio multiplexer device for cv18xx riscv: dts: sophgo: Add ethernet device for cv18xx riscv: dts: sophgo: sg2044: add pmu configuration riscv: dts: sophgo: sg2044: add ziccrse extension riscv: dts: sophgo: add zfh for sg2042 riscv: dts: sophgo: add ziccrse for sg2042 riscv: dts: sophgo: Add xtheadvector to the sg2042 devicetree riscv: dts: sophgo: sg2044: add PCIe device support for SG2044 riscv: dts: sophgo: sg2044: add MSI device support for SG2044 riscv: dts: sophgo: add reset configuration for Sophgo CV1800 series SoC riscv: dts: sophgo: add reset generator for Sophgo CV1800 series SoC dt-bindings: soc: sophgo: Move SoCs/boards from riscv into soc, add SG2000 riscv: dts: sophgo: sg2044: Add missing riscv,cbop-block-size property ... commit 69f2970aad93758bea863432e49b564e0ba649ca Merge: 137177af71cf24 0121898ec05fa4 Author: Linus Torvalds Date: Tue Jul 29 10:57:58 2025 -0700 Merge tag 'devicetree-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux Pull devicetree updates from Rob Herring: - Add bindings for arm,armv7m-nvic, fsl,icoll, fsl,imx23-digctl, Xilinx INTC, Analog Devices ADT7411, and a bunch of trivial hwmon devices - Convert fsl,vf610-mscm-ir, fsl,dsu, via,vt8500-timer, nxp,isp1301, Marvell Armada NETA and BM, apm,xgene1-msi, fsl,mpic-msi, himax,hx8357d, and sitronix,st7586 bindings to DT schema format - Fixes for some display bindings - More indentation clean-ups in examples - Add more guidelines and clarifications on writing bindings * tag 'devicetree-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (31 commits) dt-bindings: Correct indentation and style in DTS example dt-bindings: display: mediatek,dp: Allow DisplayPort AUX bus dt-bindings: fsl: convert fsl,vf610-mscm-ir.txt to yaml format dt-bindings: interrupt-controller: Add fsl,icoll.yaml dt-bindings: interrupt-controller: Add missing Xilinx INTC binding dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints dt-bindings: display: imx: convert fsl,dcu.txt to yaml format dt-bindings: timer: via,vt8500-timer: Convert to YAML dt-bindings: net: Convert Marvell Armada NETA and BM to DT schema dt-bindings: trivial-devices: Add undocumented hwmon devices dt-bindings: interrupt-controller: Convert apm,xgene1-msi to DT schema dt-bindings: gpu: mali-bifrost: Add Allwinner A523 compatible docs: dt: writing-schema: Document preferred order of properties docs: dt: writing-bindings: Document discouraged instance IDs docs: dt: writing-bindings: Document compatible and filename naming docs: dt: submitting-patches: Avoid 'YAML' in the subject and add an example MAINTAINERS: adjust file entry in INTEL STRATIX10 FIRMWARE DRIVERS docs: dt: writing-bindings: Consistently use single-whitespace docs: dt: writing-bindings: Express better expectations of "specific" ... commit 137177af71cf24a71a9854a5a5efbad6e0c5c5ac Merge: 4eee1520ea845a 06a9a4408697aa Author: Linus Torvalds Date: Tue Jul 29 10:51:22 2025 -0700 Merge tag 'spdx-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx Pull LICENSES update from Greg KH: "Here are some small changes to the LICENSES files, removing the physical address of the FSF as the old one was incorrect and they finally no longer have that listed in the license files. These updates come directly from the FSF copies of the files, so they mirror what they want the files to look like" * tag 'spdx-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/spdx: LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2 LICENSES: Replace the obsolete address of the FSF in the GFDL-1.1 LICENSES: Replace the obsolete address of the FSF in the LGPL-2.1 LICENSES: Replace the obsolete address of the FSF in the LGPL-2.0 LICENSES: Replace the obsolete address of the FSF in the GPL-2.0 LICENSES: Replace the obsolete address of the FSF in the GPL-1.0 commit 6836e1f30fe90e4c19f6a3749e97ba1e44a840ef Author: Oliver Upton Date: Tue Jul 29 08:22:42 2025 -0700 Documentation: KVM: Use unordered list for pre-init VGIC registers The intent was to create a single column table, however the markup used was actually for a header which led to docs build failures: Sphinx parallel build error: docutils.utils.SystemMessage: Documentation/virt/kvm/devices/arm-vgic-v3.rst:128: (SEVERE/4) Unexpected section title or transition. Fix the issue by converting the attempted table to an unordered list. Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20250729142217.0d4e64cd@canb.auug.org.au/ Signed-off-by: Oliver Upton Message-ID: <20250729152242.3232229-1-oliver.upton@linux.dev> Signed-off-by: Paolo Bonzini commit 4eee1520ea845a6d6d82e85498d9412419560871 Merge: 91e60731dd605c 51d4b0a44c82e5 Author: Linus Torvalds Date: Tue Jul 29 10:17:10 2025 -0700 Merge tag 'usb-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb Pull USB / Thunderbolt updates from Greg KH: "Here is the big set of USB and Thunderbolt driver changes for 6.17-rc1. Lots of little things in here, mostly all small cleanups and updates, no major new features this development cycle. Stuff included in here is: - xhci minor tweaks for error handling - typec minor updates and a driver update - gadget driver api cleanups - unused function removals - unbind memory leak fixes - a few new device ids added - a few new devices supported for some drivers - other minor cleanups and changes All of these have been in linux-next with no reported issues, with the leak fixes being in the shortest amount of time, but they are 'obviously correct' :)" * tag 'usb-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (100 commits) usb: musb: omap2430: clean up probe error handling usb: musb: omap2430: fix device leak at unbind usb: gadget: udc: renesas_usb3: fix device leak at unbind usb: dwc3: meson-g12a: fix device leaks at unbind usb: dwc3: imx8mp: fix device leak at unbind usb: musb: omap2430: enable compile testing usb: gadget: udc: renesas_usb3: drop unused module alias usb: xhci: print xhci->xhc_state when queue_command failed usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() USB: serial: option: add Foxconn T99W709 usb: core: add urb->sgt parameter description thunderbolt: Fix copy+paste error in match_service_id() usb: typec: ucsi: Update power_supply on power role change usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default usb: typec: fusb302: cache PD RX state usb: typec: ucsi: yoga-c630: add DRM dependency usb: gadget : fix use-after-free in composite_dev_cleanup() usb: chipidea: imx: Add a missing blank line usb: gadget: f_uac1: replace scnprintf() with sysfs_emit() usb: usblp: clean up assignment inside if conditions ... commit 03b11982faa0c9d0b47f1940ad953cc3ed9f5b64 Merge: 314b40b3b6189c 36d09b96d3e795 Author: Paolo Bonzini Date: Tue Jul 29 13:12:21 2025 -0400 Merge tag 'loongarch-kvm-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v6.17 1. Simplify some KVM routines. 2. Enhance in-kernel irqchip emulation. 3. Add stat information with kernel irqchip. 4. Add tracepoints for CPUCFG and CSR emulation exits. commit 91e60731dd605c5d6bab8b9ccac886da1780d5ca Merge: 1641684528815b 57b4ca42359c63 Author: Linus Torvalds Date: Tue Jul 29 10:11:01 2025 -0700 Merge tag 'tty-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty Pull tty / serial driver updates from Greg KH: "Here is the big set of TTY and Serial driver updates for 6.17-rc1. Included in here is the following types of changes: - another cleanup round from Jiri for the 8250 serial driver and some other tty drivers, things are slowly getting better with our apis thanks to this work. This touched many tty drivers all over the tree. - qcom_geni_serial driver update for new platforms and devices - 8250 quirk handling fixups - dt serial binding updates for different boards/platforms - other minor cleanups and fixes All of these have been in linux-next with no reported issues" * tag 'tty-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (79 commits) dt-bindings: serial: snps-dw-apb-uart: Allow use of a power-domain serial: 8250: fix panic due to PSLVERR dt-bindings: serial: samsung: add samsung,exynos2200-uart compatible vt: defkeymap: Map keycodes above 127 to K_HOLE vt: keyboard: Don't process Unicode characters in K_OFF mode serial: qcom-geni: Enable Serial on SA8255p Qualcomm platforms serial: qcom-geni: Enable PM runtime for serial driver serial: qcom-geni: move clock-rate logic to separate function serial: qcom-geni: move resource control logic to separate functions serial: qcom-geni: move resource initialization to separate function soc: qcom: geni-se: Enable QUPs on SA8255p Qualcomm platforms dt-bindings: qcom: geni-se: describe SA8255p dt-bindings: serial: describe SA8255p serial: 8250_dw: Fix typo "notifer" dt-bindings: serial: 8250: spacemit: set clocks property as required dt-bindings: serial: renesas: Document RZ/V2N SCIF serial: 8250_ce4100: Fix CONFIG_SERIAL_8250=n build tty: omit need_resched() before cond_resched() serial: 8250_ni: Reorder local variables serial: 8250_ni: Fix build warning ... commit 1641684528815bb7e85737d5d2bceb551c55d5a8 Merge: 0d5ec7919f3747 63533ba19d0f32 Author: Linus Torvalds Date: Tue Jul 29 10:03:10 2025 -0700 Merge tag 'staging-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging Pull staging updates from Greg KH: "Here is the "big" set of staging driver changes for 6.17-rc1. That's in quotes as it really isn't all that big of a set of changes this development cycle at all. Major things that stand out are: - gpib cleanups and tweaks with the majority of the big issues now taken care of. Odds are it will move out of staging/ in the next merge window if all goes well. - more constant cleanups and layer removals from the rtl8723bs driver. It's amazing how many layers deep they really are, all cleanups here are great to see - axis-fifo sysfs api removed and debugfs api added. The sysfs api didn't work at all so obviously no one was using it. Add the same information into debugfs as that's the proper place for it, and make it actually work. - Remaining changes is lots of small checkpatch cleanups, most of which seem to have come from a Debconf session where people were encouraged to submit their first kernel patch, a nice thing to see happen again. All of these have been in linux-next with no reported issues" * tag 'staging-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (71 commits) staging: rtl8723bs: remove redundant semicolon in basic_types.h staging: gpib: Add init response codes for new ni-usb-hs+ staging: rtl8723bs: DoIQK_8723B is empty staging: rtl8723bs: dm_CheckStatistics is empty staging: rtl8723bs: hw_var_port_switch is empty staging: rtl8723bs: _InitOtherVariable is empty staging: rtl8723bs: rtw_get_encrypt_decrypt_from_registrypriv is empty staging: rtl8723bs: rtl8723b_set_FwAoacRsvdPage_cmd is empty staging: rtl8723bs: CheckFwRsvdPageContent is empty staging: rtl8723bs: clean up redundant & parentheses staging: axis-fifo: add debugfs interface for dumping fifo registers staging: axis-fifo: remove sysfs interface staging: nvec: Fix incorrect null termination of battery manufacturer staging: gpib: fix typo staging: sm750fb: fix CamelCase variable naming staging: vme_user: fix spelling errors staging: rtl8723bs: remove unnecessary braces in rtl8723b_cmd staging: rtl8723bs: remove unnecessary commented code staging: rtl8723bs: add missing blank line after declaration staging: rtl8723bs: remove unnecessary comment separator lines ... commit 0d5ec7919f3747193f051036b2301734a4b5e1d6 Merge: 86aa721820952b fa3f79e82dce7b Author: Linus Torvalds Date: Tue Jul 29 09:52:01 2025 -0700 Merge tag 'char-misc-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char / misc / IIO / other driver updates from Greg KH: "Here is the big set of char/misc/iio and other smaller driver subsystems for 6.17-rc1. It's a big set this time around, with the huge majority being in the iio subsystem with new drivers and dts files being added there. Highlights include: - IIO driver updates, additions, and changes making more code const and cleaning up some init logic - bus_type constant conversion changes - misc device test functions added - rust miscdevice minor fixup - unused function removals for some drivers - mei driver updates - mhi driver updates - interconnect driver updates - Android binder updates and test infrastructure added - small cdx driver updates - small comedi fixes - small nvmem driver updates - small pps driver updates - some acrn virt driver fixes for printk messages - other small driver updates All of these have been in linux-next with no reported issues" * tag 'char-misc-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (292 commits) binder: Use seq_buf in binder_alloc kunit tests binder: Add copyright notice to new kunit files misc: ti_fpc202: Switch to of_fwnode_handle() bus: moxtet: Use dev_fwnode() pc104: move PC104 option to drivers/Kconfig drivers: virt: acrn: Don't use %pK through printk comedi: fix race between polling and detaching interconnect: qcom: Add Milos interconnect provider driver dt-bindings: interconnect: document the RPMh Network-On-Chip Interconnect in Qualcomm Milos SoC mei: more prints with client prefix mei: bus: use cldev in prints bus: mhi: host: pci_generic: Add Telit FN990B40 modem support bus: mhi: host: Detect events pointing to unexpected TREs bus: mhi: host: pci_generic: Add Foxconn T99W696 modem bus: mhi: host: Use str_true_false() helper bus: mhi: host: pci_generic: Add support for EM929x and set MRU to 32768 for better performance. bus: mhi: host: Fix endianness of BHI vector table bus: mhi: host: pci_generic: Disable runtime PM for QDU100 bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 dt-bindings: interconnect: qcom,msm8998-bwmon: Allow 'nonposted-mmio' ... commit c2f9de5e2db29158a8caa86a37aa479488e4ba43 Author: Lukas Wunner Date: Sun Jul 13 16:31:04 2025 +0200 PCI: Move is_pciehp check out of pciehp_is_native() pci_bridge_d3_possible() seeks to forbid runtime power management on: * Non Hot-Plug Capable PCIe ports which are nevertheless ACPI slots (recognizable as: bridge->is_hotplug_bridge && !bridge->is_pciehp) * Hot-Plug Capable PCIe ports for which platform firmware has not granted PCIe Native Hot-Plug control to the operating system (recognizable as: bridge->is_pciehp && !pciehp_is_native(bridge)) Somewhat confusingly, the check for is_hotplug_bridge is in pci_bridge_d3_possible(), whereas the one for is_pciehp is in pciehp_is_native(). For clarity, check is_pciehp directly in pci_bridge_d3_possible() (and in the other caller of pciehp_is_native(), hotplug_is_native()). Rephrase the code comment preceding these checks to no longer mention "System Management Mode", which is an x86 term inappropriate in generic PCI code. Likewise no longer mention "Thunderbolt on non-Macs", because there is nothing Thunderbolt-specific about these checks. It used to be the case that non-Macs relied on the platform for Thunderbolt tunnel management and hotplug, but they've since moved to OS-native tunnel management (as Macs always have), hence the code comment is no longer accurate. There is a subsequent check for is_hotplug_bridge further down in pci_bridge_d3_possible(). Change the check to is_pciehp because any ports matching "bridge->is_hotplug_bridge && !bridge->is_pciehp" are already filtered out at the top of the function. Do the same for another check in acpi_pci_bridge_d3(), which is called from pci_bridge_d3_possible() via platform_pci_bridge_d3(). No functional change intended. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/18b2c2110ad0f27a34b189d793310b9c4f2f24a0.1752390102.git.lukas@wunner.de commit c6036c33947d7ff7454b163ac24e565a445f4d46 Author: Lukas Wunner Date: Sun Jul 13 16:31:03 2025 +0200 PCI: pciehp: Use is_pciehp instead of is_hotplug_bridge The PCIe hotplug driver calculates the depth of a nested hotplug port by looking at the is_hotplug_bridge flag. The depth is used as lockdep class to tell hotplug ports apart. The is_hotplug_bridge flag encompasses ACPI slots handled by the ACPI hotplug driver, hence the calculated depth may be too high. Avoid by checking the is_pciehp flag instead. This glitch likely has no user-visible impact: ACPI slots typically only exist at the Root Port level, not in nested hotplug hierarchies. Also, CONFIG_LOCKDEP is usually only used by developers. So this is just for the sake of correctness. Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/59a097376a2bb493da9efd66fb196ae4b66f8a09.1752390102.git.lukas@wunner.de commit 1d60796a62f327cd9e0a6a0865ded7656d2c67f9 Author: Lukas Wunner Date: Sun Jul 13 16:31:02 2025 +0200 PCI/portdrv: Use is_pciehp instead of is_hotplug_bridge The PCIe port driver erroneously creates a subdevice for hotplug on ACPI slots which are handled by the ACPI hotplug driver. Avoid by checking the is_pciehp flag instead of is_hotplug_bridge when deciding whether to create a subdevice. The latter encompasses ACPI slots whereas the former doesn't. The superfluous subdevice has no real negative impact, it occupies memory and interrupt resources but otherwise just sits there waiting for interrupts from the slot that are never signaled. Fixes: f8415222837b ("PCI: Use cached copy of PCI_EXP_SLTCAP_HPC bit") Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org # v4.7+ Link: https://patch.msgid.link/40d5a5fe8d40595d505949c620a067fa110ee85e.1752390102.git.lukas@wunner.de commit 6cff20ce3b92ffbf2fc5eb9e5a030b3672aa414a Author: Lukas Wunner Date: Sun Jul 13 16:31:01 2025 +0200 PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports pci_bridge_d3_possible() is called from both pcie_portdrv_probe() and pcie_portdrv_remove() to determine whether runtime power management shall be enabled (on probe) or disabled (on remove) on a PCIe port. The underlying assumption is that pci_bridge_d3_possible() always returns the same value, else a runtime PM reference imbalance would occur. That assumption is not given if the PCIe port is inaccessible on remove due to hot-unplug: pci_bridge_d3_possible() calls pciehp_is_native(), which accesses Config Space to determine whether the port is Hot-Plug Capable. An inaccessible port returns "all ones", which is converted to "all zeroes" by pcie_capability_read_dword(). Hence the port no longer seems Hot-Plug Capable on remove even though it was on probe. The resulting runtime PM ref imbalance causes warning messages such as: pcieport 0000:02:04.0: Runtime PM usage count underflow! Avoid the Config Space access (and thus the runtime PM ref imbalance) by caching the Hot-Plug Capable bit in struct pci_dev. The struct already contains an "is_hotplug_bridge" flag, which however is not only set on Hot-Plug Capable PCIe ports, but also Conventional PCI Hot-Plug bridges and ACPI slots. The flag identifies bridges which are allocated additional MMIO and bus number resources to allow for hierarchy expansion. The kernel is somewhat sloppily using "is_hotplug_bridge" in a number of places to identify Hot-Plug Capable PCIe ports, even though the flag encompasses other devices. Subsequent commits replace these occurrences with the new flag to clearly delineate Hot-Plug Capable PCIe ports from other kinds of hotplug bridges. Document the existing "is_hotplug_bridge" and the new "is_pciehp" flag and document the (non-obvious) requirement that pci_bridge_d3_possible() always returns the same value across the entire lifetime of a bridge, including its hot-removal. Fixes: 5352a44a561d ("PCI: pciehp: Make pciehp_is_native() stricter") Reported-by: Laurent Bigonville Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220216 Reported-by: Mario Limonciello Closes: https://lore.kernel.org/r/20250609020223.269407-3-superm1@kernel.org/ Link: https://lore.kernel.org/all/20250620025535.3425049-3-superm1@kernel.org/T/#u Signed-off-by: Lukas Wunner Signed-off-by: Bjorn Helgaas Acked-by: Rafael J. Wysocki Cc: stable@vger.kernel.org # v4.18+ Link: https://patch.msgid.link/fe5dcc3b2e62ee1df7905d746bde161eb1b3291c.1752390101.git.lukas@wunner.de commit 1a967e92bf47cf5170336b88d748117c700edc47 Author: Masami Hiramatsu (Google) Date: Tue Jul 29 14:10:35 2025 +0900 tracing: Remove "__attribute__()" from the type field of event format With CONFIG_DEBUG_INFO_BTF=y and PAHOLE_HAS_BTF_TAG=y, `__user` is converted to `__attribute__((btf_type_tag("user")))`. In this case, some syscall events have it for __user data, like below; /sys/kernel/tracing # cat events/syscalls/sys_enter_openat/format name: sys_enter_openat ID: 720 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:int __syscall_nr; offset:8; size:4; signed:1; field:int dfd; offset:16; size:8; signed:0; field:const char __attribute__((btf_type_tag("user"))) * filename; offset:24; size:8; signed:0; field:int flags; offset:32; size:8; signed:0; field:umode_t mode; offset:40; size:8; signed:0; Then the trace event filter fails to set the string acceptable flag (FILTER_PTR_STRING) to the field and rejects setting string filter; # echo 'filename.ustring ~ "*ftracetest-dir.wbx24v*"' \ >> events/syscalls/sys_enter_openat/filter sh: write error: Invalid argument # cat error_log [ 723.743637] event filter parse error: error: Expecting numeric field Command: filename.ustring ~ "*ftracetest-dir.wbx24v*" Since this __attribute__ makes format parsing complicated and not needed, remove the __attribute__(.*) from the type string. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/175376583493.1688759.12333973498014733551.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 314b40b3b6189cc6bffce5d68e3f4c4f6a68dae5 Merge: beafd7ecf2255e 18ec25dd0e9765 Author: Paolo Bonzini Date: Tue Jul 29 12:27:40 2025 -0400 Merge tag 'kvmarm-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 changes for 6.17, round #1 - Host driver for GICv5, the next generation interrupt controller for arm64, including support for interrupt routing, MSIs, interrupt translation and wired interrupts. - Use FEAT_GCIE_LEGACY on GICv5 systems to virtualize GICv3 VMs on GICv5 hardware, leveraging the legacy VGIC interface. - Userspace control of the 'nASSGIcap' GICv3 feature, allowing userspace to disable support for SGIs w/o an active state on hardware that previously advertised it unconditionally. - Map supporting endpoints with cacheable memory attributes on systems with FEAT_S2FWB and DIC where KVM no longer needs to perform cache maintenance on the address range. - Nested support for FEAT_RAS and FEAT_DoubleFault2, allowing the guest hypervisor to inject external aborts into an L2 VM and take traps of masked external aborts to the hypervisor. - Convert more system register sanitization to the config-driven implementation. - Fixes to the visibility of EL2 registers, namely making VGICv3 system registers accessible through the VGIC device instead of the ONE_REG vCPU ioctls. - Various cleanups and minor fixes. commit 65c6f742ab14ab1a2679fba72b82dcc0289d96f1 Author: Laurentiu Mihalcea Date: Mon Jul 28 15:41:44 2025 -0400 pwm: imx-tpm: Reset counter if CMOD is 0 As per the i.MX93 TRM, section 67.3.2.1 "MOD register update", the value of the TPM counter does NOT get updated when writing MOD.MOD unless SC.CMOD != 0. Therefore, with the current code, assuming the following sequence: 1) pwm_disable() 2) pwm_apply_might_sleep() /* period is changed here */ 3) pwm_enable() and assuming only one channel is active, if CNT.COUNT is higher than the MOD.MOD value written during the pwm_apply_might_sleep() call then, when re-enabling the PWM during pwm_enable(), the counter will end up resetting after UINT32_MAX - CNT.COUNT + MOD.MOD cycles instead of MOD.MOD cycles as normally expected. Fix this problem by forcing a reset of the TPM counter before MOD.MOD is written. Fixes: 738a1cfec2ed ("pwm: Add i.MX TPM PWM driver support") Cc: stable@vger.kernel.org Signed-off-by: Laurentiu Mihalcea Link: https://lore.kernel.org/r/20250728194144.22884-1-laurentiumihalcea111@gmail.com Signed-off-by: Uwe Kleine-König commit 5dc50b111b40003ed83f74324e8d4023f01bd93e Author: Baojun Xu Date: Tue Jul 29 22:58:49 2025 +0800 ALSA: hda: Fix the wrong register was used for DVC of TAS2770 The wrong register was used for digital volume control of TAS2770, The definition was changed, and usage was also updated. Fixes: ab29b3460c5c ("ALSA: hda: Add TAS2770 support") Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20250729145849.55057-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit f21d136caf8171f94159d975ea4620c164431bd9 Author: Uwe Kleine-König Date: Mon Jul 28 18:00:18 2025 +0200 pwm: mediatek: Fix duty and period setting The period generated by the hardware is (PWMDWIDTH + 1) << CLKDIV) / freq according to my tests with a signal analyser and also the documentation. The current algorithm doesn't consider the `+ 1` part and so configures slightly too high periods. The same issue exists for the duty cycle setting. So subtract 1 from both the register values for period and duty cycle. If period is 0, bail out, if duty_cycle is 0, just disable the PWM which results in a constant low output. Fixes: caf065f8fd58 ("pwm: Add MediaTek PWM support") Signed-off-by: Uwe Kleine-König Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/6d1fa87a76f8020bfe3171529b8e19baffceab10.1753717973.git.u.kleine-koenig@baylibre.com Cc: stable@vger.kernel.org Signed-off-by: Uwe Kleine-König commit 704d918341c378c5f9505dfdf32d315e256d3846 Author: Uwe Kleine-König Date: Mon Jul 28 18:00:17 2025 +0200 pwm: mediatek: Handle hardware enable and clock enable separately Stop handling the clocks in pwm_mediatek_enable() and pwm_mediatek_disable(). This is a preparing change for the next commit that requires that clocks and the enable bit are handled separately. Also move these two functions a bit further up in the source file to make them usable in pwm_mediatek_config(), which is needed in the next commit, too. Signed-off-by: Uwe Kleine-König Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/55c94fe2917ece152ee1e998f4675642a7716f13.1753717973.git.u.kleine-koenig@baylibre.com Cc: stable@vger.kernel.org Signed-off-by: Uwe Kleine-König commit c8705cefce44fbe85ca3b180dee0e0b5f3d51dc5 Author: Daeho Jeong Date: Mon Jul 28 10:04:30 2025 -0700 f2fs: add gc_boost_gc_greedy sysfs node Add this to control GC algorithm for boost GC. Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1d4c5dbba1a53aeaf2c6cc84e7ba94c436d18852 Author: Daeho Jeong Date: Mon Jul 28 09:45:44 2025 -0700 f2fs: add gc_boost_gc_multiple sysfs node Add a sysfs knob to set a multiplier for the background GC migration window when F2FS Garbage Collection is boosted. Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 926406a85ad895fbe6ee4577cdbc4f55245a0742 Author: Fabrizio Castro Date: Tue Jul 29 15:51:10 2025 +0100 MAINTAINERS: Add entries for the RZ/V2H(P) RSPI Add the MAINTAINERS entries for the Renesas RZ/V2H(P) RSPI driver. Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250729145110.37258-1-fabrizio.castro.jz@renesas.com Signed-off-by: Mark Brown commit 10dfd36f078423c51602a9a21ed85e8e6c947a00 Author: Romain Gantois Date: Tue Jul 29 11:50:57 2025 +0200 regulator: core: correct convergence check in regulator_set_voltage() The logic in regulator_set_voltage() which checks for a non-convergence condition on a stepped regulator is flawed. regulator_set_voltage() checks if the error in target voltage has increased or decreased, and returns -EWOULDBLOCK if the error has not decreased enough. The correct non-convergence condition is: new_delta - delta > -rdev->constraints->max_uV_step or equivalently: delta - new_delta < rdev->constraints->max_uV_step But the currently used condition is: new_delta - delta > rdev->constraints->max_uV_step Which may cause an infinite loop if the voltage error doesn't converge. Fix this by correcting the convergence condition. Suggested-by: Jon Hunter Fixes: d511206dc7443 ("regulator: core: repeat voltage setting request for stepped regulators") Signed-off-by: Romain Gantois Link: https://patch.msgid.link/20250729-b4-regulator-stepping-fix-v1-1-3f7b8c55d7d7@bootlin.com Tested-by: Jon Hunter Reviewed-by: Jon Hunter Signed-off-by: Mark Brown commit 856db37592021e9155384094e331e2d4589f28b1 Author: Zheng Yu Date: Tue Jul 29 01:22:14 2025 +0000 jfs: fix metapage reference count leak in dbAllocCtl In dbAllocCtl(), read_metapage() increases the reference count of the metapage. However, when dp->tree.budmin < 0, the function returns -EIO without calling release_metapage() to decrease the reference count, leading to a memory leak. Add release_metapage(mp) before the error return to properly manage the metapage reference count and prevent the leak. Fixes: a5f5e4698f8abbb25fe4959814093fb5bfa1aa9d ("jfs: fix shift-out-of-bounds in dbSplit") Signed-off-by: Zheng Yu Signed-off-by: Dave Kleikamp commit a5e71638ddd7f1dc0b9f3a5ac8ab8bef48b9f0ee Author: Steven Rostedt Date: Fri Jul 25 11:21:53 2025 -0400 ktest.pl: Add new PATCHCHECK_SKIP option to skip testing individual commits When testing a series of commits that also includes changes to the Linux tools directory, it is useless to test the changes in tools as they may not affect the kernel itself. Doing tests on the kernel for changes that do not affect the kernel is a waste of time. Add a PATCHCHECK_SKIP that takes a series of shas that will be skipped while doing the individual commit tests. For example, the runtime verification may have a series of commits like: $ git log --abbrev-commit --pretty=oneline fac5493251a6~1..HEAD 3d3800b4f7f4 rv: Remove rv_reactor's reference counter 3d3c376118b5 rv: Merge struct rv_reactor_def into struct rv_reactor 24cbfe18d55a rv: Merge struct rv_monitor_def into struct rv_monitor b0c08dd5348d rv: Remove unused field in struct rv_monitor_def 58d5f0d437a8 (debiantesting-x86-64/trace/rv/core) rv: Return init error when registering monitors 560473f2e2d7 verification/rvgen: Organise Kconfig entries for nested monitors 9efcf590827c tools/dot2c: Fix generated files going over 100 column limit 1160ccaf772f tools/rv: Stop gracefully also on SIGTERM f60227f34489 tools/rv: Do not skip idle in trace f3735df6281e verification/rvgen: Do not generate unused variables 6fb37c2a27eb verification/rvgen: Generate each variable definition only once 8cfcf9b0e92f verification/rvgen: Support the 'next' operator fac5493251a6 rv: Allow to configure the number of per-task monitor Where the first commit touches the kernel followed by a series of commits that do not, and ends with commits that do. Instead of having to add multiple patchcheck tests to handle the gaps, just include the commits that should not be tested: $ git log --abbrev-commit --pretty=oneline fac5493251a6~1..HEAD | grep -e verification -e tools/ | cut -d' ' -f1 | while read a ; do echo -n "$a "; done 560473f2e2d7 9efcf590827c 1160ccaf772f f60227f34489 f3735df6281e 6fb37c2a27eb 8cfcf9b0e92f Then set PATCHCHECK_SKIP to that, and those commits will be skipped. PATCHCHECK_SKIP = 560473f2e2d7 9efcf590827c 1160ccaf772f f60227f34489 f3735df6281e 6fb37c2a27eb 8cfcf9b0e92f Cc: John 'Warthog9' Hawley Cc: Dhaval Giani Cc: Greg Kroah-Hartman Link: https://lore.kernel.org/20250725112153.1dd06b84@gandalf.local.home Signed-off-by: Steven Rostedt commit beafd7ecf2255e8b62a42dc04f54843033db3d24 Merge: a10accaef40f19 6f38f8c574642a Author: Paolo Bonzini Date: Mon Jul 28 11:41:06 2025 -0400 Merge tag 'kvm-x86-sev-6.17' of https://github.com/kvm-x86/linux into HEAD KVM SEV cache maintenance changes for 6.17 - Drop a superfluous WBINVD (on all CPUs!) when destroying a VM. - Use WBNOINVD instead of WBINVD when possible, for SEV cache maintenance, e.g. to minimize collateral damage when reclaiming memory from an SEV guest. - When reclaiming memory from an SEV guest, only do cache flushes on CPUs that have ever run a vCPU for the guest, i.e. don't flush the caches for CPUs that can't possibly have cache lines with dirty, encrypted data. commit a10accaef40f1947cf8ad5ec01d306c37aa85897 Merge: 0097f9df996fe9 4fdc3431e03b9c Author: Paolo Bonzini Date: Mon Jul 28 11:41:02 2025 -0400 Merge tag 'x86_core_for_kvm' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into HEAD Immutable branch for KVM tree to put the KVM patches from https://lore.kernel.org/r/20250522233733.3176144-1-seanjc@google.com ontop. Signed-off-by: Borislav Petkov (AMD) commit 0097f9df996fe9c4a66a9f96a492391a8432affd Merge: b4733cd5be1a28 24be2b7956a545 Author: Paolo Bonzini Date: Mon Jul 28 11:37:05 2025 -0400 Merge tag 'kvm-x86-svm-6.17' of https://github.com/kvm-x86/linux into HEAD KVM SVM changes for 6.17 Drop KVM's rejection of SNP's SMT and single-socket policy restrictions, and instead rely on firmware to verify that the policy can actually be supported. Don't bother checking that requested policy(s) can actually be satisfied, as an incompatible policy doesn't put the kernel at risk in any way, and providing guarantees with respect to the physical topology is outside of KVM's purview. commit b4733cd5be1a284cd92840f3126e4165ab34460c Merge: 89400f0687a44f 71443210e26de3 Author: Paolo Bonzini Date: Mon Jul 28 11:32:45 2025 -0400 Merge tag 'kvm-x86-selftests-6.17' of https://github.com/kvm-x86/linux into HEAD KVM selftests changes for 6.17 - Fix a comment typo. - Verify KVM is loaded when getting any KVM module param so that attempting to run a selftest without kvm.ko loaded results in a SKIP message about KVM not being loaded/enabled, versus some random parameter not existing. - SKIP tests that hit EACCES when attempting to access a file, with a "Root required?" help message. In most cases, the test just needs to be run with elevated permissions. commit 89400f0687a44f6fabacd10e9aa5cad0e15803c9 Merge: d7f4aac280ccbc b95a9d313642c9 Author: Paolo Bonzini Date: Mon Jul 28 11:31:33 2025 -0400 Merge tag 'kvm-x86-apic-6.17' of https://github.com/kvm-x86/linux into HEAD KVM local APIC changes for 6.17 Extract many of KVM's helpers for accessing architectural local APIC state to common x86 so that they can be shared by guest-side code for Secure AVIC. commit d7f4aac280ccbc8a9d1a1905da2fae860bdad491 Merge: 1a14928e2e91a0 9c4fe6d1509b38 Author: Paolo Bonzini Date: Mon Jul 28 11:14:40 2025 -0400 Merge tag 'kvm-x86-mmu-6.17' of https://github.com/kvm-x86/linux into HEAD KVM x86 MMU changes for 6.17 - Exempt nested EPT from the the !USER + CR0.WP logic, as EPT doesn't interact with CR0.WP. - Move the TDX hardware setup code to tdx.c to better co-locate TDX code and eliminate a few global symbols. - Dynamically allocation the shadow MMU's hashed page list, and defer allocating the hashed list until it's actually needed (the TDP MMU doesn't use the list). commit 1a14928e2e91a098c6117ba52b06327e3fc5072c Merge: 9de13951d5c3b4 dcbe5a466c123a Author: Paolo Bonzini Date: Mon Jul 28 11:13:57 2025 -0400 Merge tag 'kvm-x86-misc-6.17' of https://github.com/kvm-x86/linux into HEAD KVM x86 misc changes for 6.17 - Prevert the host's DEBUGCTL.FREEZE_IN_SMM (Intel only) when running the guest. Failure to honor FREEZE_IN_SMM can bleed host state into the guest. - Explicitly check vmcs12.GUEST_DEBUGCTL on nested VM-Enter (Intel only) to prevent L1 from running L2 with features that KVM doesn't support, e.g. BTF. - Intercept SPEC_CTRL on AMD if the MSR shouldn't exist according to the vCPU's CPUID model. - Rework the MSR interception code so that the SVM and VMX APIs are more or less identical. - Recalculate all MSR intercepts from the "source" on MSR filter changes, and drop the dedicated "shadow" bitmaps (and their awful "max" size defines). - WARN and reject loading kvm-amd.ko instead of panicking the kernel if the nested SVM MSRPM offsets tracker can't handle an MSR. - Advertise support for LKGS (Load Kernel GS base), a new instruction that's loosely related to FRED, but is supported and enumerated independently. - Fix a user-triggerable WARN that syzkaller found by stuffing INIT_RECEIVED, a.k.a. WFS, and then putting the vCPU into VMX Root Mode (post-VMXON). Use the same approach KVM uses for dealing with "impossible" emulation when running a !URG guest, and simply wait until KVM_RUN to detect that the vCPU has architecturally impossible state. - Add KVM_X86_DISABLE_EXITS_APERFMPERF to allow disabling interception of APERF/MPERF reads, so that a "properly" configured VM can "virtualize" APERF/MPERF (with many caveats). - Reject KVM_SET_TSC_KHZ if vCPUs have been created, as changing the "default" frequency is unsupported for VMs with a "secure" TSC, and there's no known use case for changing the default frequency for other VM types. commit 9de13951d5c3b424a1ad3767e7bc013831e7ad5d Merge: cc5a1021aa50b0 bbc13ae593e0ea Author: Paolo Bonzini Date: Mon Jul 28 11:08:56 2025 -0400 Merge tag 'kvm-x86-no_assignment-6.17' of https://github.com/kvm-x86/linux into HEAD KVM VFIO device assignment cleanups for 6.17 Kill off kvm_arch_{start,end}_assignment() and x86's associated tracking now that KVM no longer uses assigned_device_count as a bad heuristic for "VM has an irqbypass producer" or for "VM has access to host MMIO". commit cc5a1021aa50b0b63d8a71f3ccfc51ed876ee92d Merge: d284562862959a 614fb9d1479b1d Author: Paolo Bonzini Date: Mon Jul 28 11:05:24 2025 -0400 Merge tag 'kvm-x86-dirty_ring-6.17' of https://github.com/kvm-x86/linux into HEAD KVM Dirty Ring changes for 6.17 Fix issues with dirty ring harvesting where KVM doesn't bound the processing of entries in any way, which allows userspace to keep KVM in a tight loop indefinitely. Clean up code and comments along the way. commit d284562862959a7a5057bd0fcb1f0bd41df72332 Merge: f05efcfe07d8af 87d4fbf4a387f2 Author: Paolo Bonzini Date: Mon Jul 28 11:04:54 2025 -0400 Merge tag 'kvm-x86-generic-6.17' of https://github.com/kvm-x86/linux into HEAD KVM generic changes for 6.17 - Add a tracepoint for KVM_SET_MEMORY_ATTRIBUTES to help debug issues related to private <=> shared memory conversions. - Drop guest_memfd's .getattr() implementation as the VFS layer will call generic_fillattr() if inode_operations.getattr is NULL. commit f05efcfe07d8af26703b75cb91c8f58924661275 Merge: f02b1bcc73a176 83ebe715748314 Author: Paolo Bonzini Date: Mon Jul 28 11:04:27 2025 -0400 Merge tag 'kvm-x86-mmio-6.17' of https://github.com/kvm-x86/linux into HEAD KVM MMIO Stale Data mitigation cleanup for 6.17 Rework KVM's mitigation for the MMIO State Data vulnerability to track whether or not a vCPU has access to (host) MMIO based on the MMU that will be used when running in the guest. The current approach doesn't actually detect whether or not a guest has access to MMIO, and is prone to false negatives (and to a lesser extent, false positives), as KVM_DEV_VFIO_FILE_ADD is optional, and obviously only covers VFIO devices. commit f02b1bcc73a17602903480562571069f0dff9f24 Merge: 65164fd0f6b507 81bf24f1ac7702 Author: Paolo Bonzini Date: Mon Jul 28 11:03:04 2025 -0400 Merge tag 'kvm-x86-irqs-6.17' of https://github.com/kvm-x86/linux into HEAD KVM IRQ changes for 6.17 - Rework irqbypass to track/match producers and consumers via an xarray instead of a linked list. Using a linked list leads to O(n^2) insertion times, which is hugely problematic for use cases that create large numbers of VMs. Such use cases typically don't actually use irqbypass, but eliminating the pointless registration is a future problem to solve as it likely requires new uAPI. - Track irqbypass's "token" as "struct eventfd_ctx *" instead of a "void *", to avoid making a simple concept unnecessarily difficult to understand. - Add CONFIG_KVM_IOAPIC for x86 to allow disabling support for I/O APIC, PIC, and PIT emulation at compile time. - Drop x86's irq_comm.c, and move a pile of IRQ related code into irq.c. - Fix a variety of flaws and bugs in the AVIC device posted IRQ code. - Inhibited AVIC if a vCPU's ID is too big (relative to what hardware supports) instead of rejecting vCPU creation. - Extend enable_ipiv module param support to SVM, by simply leaving IsRunning clear in the vCPU's physical ID table entry. - Disable IPI virtualization, via enable_ipiv, if the CPU is affected by erratum #1235, to allow (safely) enabling AVIC on such CPUs. - Dedup x86's device posted IRQ code, as the vast majority of functionality can be shared verbatime between SVM and VMX. - Harden the device posted IRQ code against bugs and runtime errors. - Use vcpu_idx, not vcpu_id, for GA log tag/metadata, to make lookups O(1) instead of O(n). - Generate GA Log interrupts if and only if the target vCPU is blocking, i.e. only if KVM needs a notification in order to wake the vCPU. - Decouple device posted IRQs from VFIO device assignment, as binding a VM to a VFIO group is not a requirement for enabling device posted IRQs. - Clean up and document/comment the irqfd assignment code. - Disallow binding multiple irqfds to an eventfd with a priority waiter, i.e. ensure an eventfd is bound to at most one irqfd through the entire host, and add a selftest to verify eventfd:irqfd bindings are globally unique. commit 65164fd0f6b50781fe27736be54e55535c9ad82d Merge: 038d61fd642278 07a289a031404e Author: Paolo Bonzini Date: Tue Jul 29 08:33:04 2025 -0400 Merge tag 'kvm-riscv-6.17-2' of https://github.com/kvm-riscv/linux into HEAD KVM/riscv changes for 6.17 - Enabled ring-based dirty memory tracking - Improved perf kvm stat to report interrupt events - Delegate illegal instruction trap to VS-mode - MMU related improvements for KVM RISC-V for upcoming nested virtualization commit 5421681bc3ef13476bd9443379cd69381e8760fa Author: Yu Kuai Date: Tue Jul 29 10:32:29 2025 +0800 blk-ioc: don't hold queue_lock for ioc_lookup_icq() Currently issue io can grab queue_lock three times from bfq_bio_merge(), bfq_limit_depth() and bfq_prepare_request(), the queue_lock is not necessary if icq is already created because both queue and ioc can't be freed before io issuing is done, hence remove the unnecessary queue_lock and use rcu to protect radix tree lookup. Noted this is also a prep patch to support request batch dispatching[1]. [1] https://lore.kernel.org/all/20250722072431.610354-1-yukuai1@huaweicloud.com/ Signed-off-by: Yu Kuai Reviewed-by: Damien Le Moal Reviewed-by: Jan Kara Link: https://lore.kernel.org/r/20250729023229.2944898-1-yukuai1@huaweicloud.com Signed-off-by: Jens Axboe commit 1da67b5b1754713b8ea0c3dd847e04790cffd91f Author: John Garry Date: Tue Jul 29 09:14:48 2025 +0000 block: Enforce power-of-2 physical block size The merging/splitting code and other queue limits checking depends on the physical block size being a power-of-2, so enforce it. Reviewed-by: Martin K. Petersen Signed-off-by: John Garry Reviewed-by: Damien Le Moal Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250729091448.1691334-3-john.g.garry@oracle.com [axboe: add missing braces] Signed-off-by: Jens Axboe commit 448dfecc7ff807822ecd47a5c052acedca7d09e8 Author: John Garry Date: Tue Jul 29 09:14:47 2025 +0000 block: avoid possible overflow for chunk_sectors check in blk_stack_limits() In blk_stack_limits(), we check that the t->chunk_sectors value is a multiple of the t->physical_block_size value. However, by finding the chunk_sectors value in bytes, we may overflow the unsigned int which holds chunk_sectors, so change the check to be based on sectors. Reviewed-by: Hannes Reinecke Reviewed-by: Martin K. Petersen Signed-off-by: John Garry Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20250729091448.1691334-2-john.g.garry@oracle.com Signed-off-by: Jens Axboe commit 459779d04ae8dfd4083679a7bf9d72af165d1023 Author: Damien Le Moal Date: Mon Jun 16 15:28:56 2025 +0900 block: Improve read ahead size for rotational devices For a device that does not advertize an optimal I/O size, the function blk_apply_bdi_limits() defaults to an initial setting of the ra_pages field of struct backing_dev_info to VM_READAHEAD_PAGES, that is, 128 KB. This low I/O size value is far from being optimal for hard-disk devices: when reading files from multiple contexts using buffered I/Os, the seek overhead between the small read commands generated to read-ahead multiple files will significantly limit the performance that can be achieved. This fact applies to all ATA devices as ATA does not define an optimal I/O size and the SCSI SAT specification does not define a default value to expose to the host. Modify blk_apply_bdi_limits() to use a device max_sectors limit to calculate the ra_pages field of struct backing_dev_info, when the device is a rotational one (BLK_FEAT_ROTATIONAL feature is set). For a SCSI disk, this defaults to 2560 KB, which significantly improve performance for buffered reads. Using XFS and sequentially reading randomly selected (large) files stored on a SATA HDD, the maximum throughput achieved with 8 readers reading files with 1MB buffered I/Os increases from 122 MB/s to 167 MB/s (+36%). The improvement is even larger when reading files using 128 KB buffered I/Os, with a throughput increasing from 57 MB/s to 165 MB/s (+189%). Signed-off-by: Damien Le Moal Reviewed-by: John Garry Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250616062856.1629897-1-dlemoal@kernel.org Signed-off-by: Jens Axboe commit 5a569ef4d4ab184a481dd8ecb58f464a89b44d2f Author: Jouni Högander Date: Tue Jul 22 15:56:18 2025 +0300 drm/i915/display: Set C10_VDR_CTRL_MSGBUS_ACCESS before phy reg read According to C10 VDR Register programming sequence we need set C10_VDR_CTRL_MSGBUS_ACCESS before accessing PHY internal registers from MsgBus. v2: set C10_VDR_CTRL_MSGBUS_ACCESS once for all owned lanes Bspec: 68962 Fixes: 9dc619680de4 ("drm/i915/display: Add function to configure LFPS sending") Suggested-by: Gustavo Sousa Signed-off-by: Jouni Högander Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250722125618.1842615-5-jouni.hogander@intel.com (cherry picked from commit 8921dce70d46e3156b5a0b21675f5ac90903d81d) Signed-off-by: Tvrtko Ursulin commit 3eb63578d8d9bbaffc204a911cfae6763e895dfe Author: Jouni Högander Date: Tue Jul 22 15:56:17 2025 +0300 drm/i915/display: Ensure phy is accessible on lfps configuration Ensure phy is accessible on lfps configuration by adding intel_cx0_phy_transaction_begin/end around it. Fixes: 9dc619680de4 ("drm/i915/display: Add function to configure LFPS sending") Suggested-by: Gustavo Sousa Signed-off-by: Jouni Högander Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250722125618.1842615-4-jouni.hogander@intel.com (cherry picked from commit cf433f94f188782166598300c4c05274fd13c5a7) Signed-off-by: Tvrtko Ursulin commit c338923c4c8a89bb81f585732b9b49fcf9465cdd Author: Jouni Högander Date: Tue Jul 22 15:56:16 2025 +0300 drm/i915/display: Avoid unnecessarily calling intel_cx0_get_owned_lane_mask Currently we are always calling intel_cx0_get_owned_lane_mask when intel_lnl_mac_transmit_lfps is called. Avoid this in cases where it's not needed. Signed-off-by: Jouni Högander Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250722125618.1842615-3-jouni.hogander@intel.com (cherry picked from commit d487ed7e2b4ab3126239ab93324405eb1e45ccf5) Signed-off-by: Tvrtko Ursulin commit a045246b684badf0545f252651bdc008b2e80835 Author: Jouni Högander Date: Tue Jul 22 15:56:15 2025 +0300 drm/i915/display: Write PHY_CMN1_CONTROL only when using AUXLess ALPM We are seeing "dmesg-warn/abort - *ERROR* PHY * failed after 3 retries" since we started configuring LFPS sending. According to Bspec Configuring LFPS sending is needed only when using AUXLess ALPM. This patch avoids these failures by configuring LFPS sending only when using AUXLess ALPM. Bspec: 68849 Fixes: 9dc619680de4 ("drm/i915/display: Add function to configure LFPS sending") Signed-off-by: Jouni Högander Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250722125618.1842615-2-jouni.hogander@intel.com (cherry picked from commit 8265ce0e0e15ba435eb2af72f2b821e203ebcdb9) Signed-off-by: Tvrtko Ursulin commit a3e892ab0fc287389176eabdcd74234508f6e52d Author: Masami Hiramatsu (Google) Date: Tue Jul 29 08:47:03 2025 +0900 tracing: fprobe: Fix infinite recursion using preempt_*_notrace() Since preempt_count_add/del() are tracable functions, it is not allowed to use preempt_disable/enable() in ftrace handlers. Without this fix, probing on `preempt_count_add%return` will cause an infinite recursion of fprobes. To fix this problem, use preempt_disable/enable_notrace() in fprobe_return(). Link: https://lore.kernel.org/all/175374642359.1471729.1054175011228386560.stgit@mhiramat.tok.corp.google.com/ Fixes: 4346ba160409 ("fprobe: Rewrite fprobe on function-graph tracer") Cc: stable@vger.kernel.org Signed-off-by: Masami Hiramatsu (Google) commit 711fa2667d8b230ff31f1855d0f25e3263268d8a Merge: ba0f4c4c0f9d0f b213eb34f857c4 Author: Dave Airlie Date: Tue Jul 29 16:52:49 2025 +1000 Merge tag 'drm-misc-next-fixes-2025-07-24' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next Two more bridge conversions to devm_drm_bridge_alloc that address a warning now reported by the bridge core code. Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250724-petite-gray-foxhound-b4fbb8@houat commit 86aa721820952b793a12fc6e5a01734186c0c238 Merge: 9669b2499ea377 cc2d5b72b13b3a Author: Linus Torvalds Date: Mon Jul 28 23:26:07 2025 -0700 Merge tag 'chrome-platform-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform updates from Tzung-Bi Shih: "New: - Support ECC in chromeos_pstore - Allow to control power and data role via sysfs in cros_ec_typec Improvements: - Defer probe when the dependencies are not ready in cros_ec_typec - Retry when a sensor is not ready in cros_ec_sensorhub Fixes: - Unregister the blocking notifier as well when unregistering the struct cros_ec_device. Cleanups: - Remove redundant code and leverage more suitable helper macro in chromeos_laptop - Fix typo" * tag 'chrome-platform-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: platform/chrome: Fix typo in CROS_USBPD_NOTIFY help text platform/chrome: cros_ec_typec: Check ec platform device pointer platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() platform/chrome: cros_ec_typec: Add role swap ops platform/chrome: chromeos_laptop: Replace open coded variant of DEFINE_RES_IRQ() platform/chrome: chromeos_laptop: Remove duplicate check platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready platform/chrome: chromeos_pstore: Add ecc_size module parameter platform/chrome: cros_ec_typec: Defer probe on missing EC parent commit 9669b2499ea377764f8320dd562dd6cd4ea80a5d Merge: f38b7512903a50 1798561befd8be Author: Linus Torvalds Date: Mon Jul 28 23:21:28 2025 -0700 Merge tag 'platform-drivers-x86-v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86 Pull x86 platform drivers from Ilpo Järvinen: - alienware: Add more precise labels to fans - amd/hsmp: Improve misleading probe errors (make the legacy driver aware when HSMP is supported through the ACPI driver) - amd/pmc: Add Lenovo Yoga 6 13ALCL6 to pmc quirk list - drm/xe: Correct (D)VSEC information to support PMT crashlog feature - fujitsu: Clamp charge threshold instead of returning an error - ideapad: Expore change types - intel/pmt: - Add PMT Discovery driver - Add API to retrieve telemetry regions by feature - Fix crashlog NULL access - Support Battlemage GPU (BMG) crashlog - intel/vsec: - Add Discovery feature - Add feature dependency support using device links - lenovo: - Move lenovo drivers under drivers/platform/x86/lenovo/ - Add WMI drivers for Lenovo Gaming series - Improve DMI handling - oxpec: - Add support for OneXPlayer X1 Mini Pro (Strix Point variant) - Fix EC registers for G1 AMD - samsung-laptop: Expose change types - wmi: Fix WMI device naming issue (same GUID corner cases) - x86-android-tables: Add ovc-capacity-table to generic battery nodes - Miscellaneous cleanups / refactoring / improvements * tag 'platform-drivers-x86-v6.17-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (63 commits) platform/x86: oxpec: Add support for OneXPlayer X1 Mini Pro (Strix Point) platform/x86: oxpec: Fix turbo register for G1 AMD platform/x86/intel/pmt: support BMG crashlog platform/x86/intel/pmt: use a version struct platform/x86/intel/pmt: refactor base parameter platform/x86/intel/pmt: add register access helpers platform/x86/intel/pmt: decouple sysfs and namespace platform/x86/intel/pmt: correct types platform/x86/intel/pmt: re-order trigger logic platform/x86/intel/pmt: use guard(mutex) platform/x86/intel/pmt: mutex clean up platform/x86/intel/pmt: white space cleanup drm/xe: Correct BMG VSEC header sizing drm/xe: Correct the rev value for the DVSEC entries platform/x86/intel/pmt: fix a crashlog NULL pointer access platform/x86: samsung-laptop: Expose charge_types platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list platform/x86: dell-uart-backlight: Use blacklight power constant platform/x86/intel/pmt: fix build dependency for kunit test platform/x86: lenovo: gamezone needs "other mode" ... commit f38b7512903a50eaeb300e9c8d9448187dd3959c Merge: 0262163136de81 68b9272ca7ac94 Author: Linus Torvalds Date: Mon Jul 28 23:17:46 2025 -0700 Merge tag 'pwm/for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux Pull pwm updates from Uwe Kleine-König: "Apart from the usual mix of new drivers (pwm-argon-fan-hat), adding support for variants to existing drivers, minor improvements to both drivers and docs, device tree documenation updates, the noteworthy changes are: - A hwmon companion driver to pwm-mc33xs2410 living in drivers/hwmon and acked by Guenter Roeck - chardev support for PWM devices. This leverages atomic PWM updates to userspace and at the same time simplifies and accelerates PWM configuration changes" * tag 'pwm/for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux: (35 commits) pwm: raspberrypi-poe: Fix spelling mistake "Firwmware" -> "Firmware" hwmon: add support for MC33XS2410 hardware monitoring pwm: mc33xs2410: add hwmon support pwm: img: Remove redundant pm_runtime_mark_last_busy() calls pwm: Expose PWM_WFHWSIZE in public header dt-bindings: pwm: Convert lpc32xx-pwm.txt to yaml format docs: pwm: Adapt Locking paragraph to reality pwm: twl-led: Drop driver local locking pwm: sun4i: Drop driver local locking pwm: sti: Drop driver local locking pwm: microchip-core: Drop driver local locking pwm: lpc18xx-sct: Drop driver local locking pwm: fsl-ftm: Drop driver local locking pwm: clps711x: Drop driver local locking pwm: atmel: Drop driver local locking pwm: argon-fan-hat: Add Argon40 Fan HAT support dt-bindings: pwm: argon40,fan-hat: Document Argon40 Fan HAT dt-bindings: vendor-prefixes: Document Argon40 pwm: pwm-mediatek: Add support for PWM IP V3.0.2 in MT6991/MT8196 pwm: pwm-mediatek: Pass PWM_CK_26M_SEL from platform data ... commit 0262163136de813894cb172aa8ccf762b92e5fd7 Merge: bf977a9ad33d20 2d442a0c781403 Author: Linus Torvalds Date: Mon Jul 28 23:03:09 2025 -0700 Merge tag 'spi-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi Pull spi updates from Mark Brown: "This release is almost entirely driver work, mostly new drivers with the usual smattering of per driver updates anf fixes, with only trivial changes in the core. Highlights include: - Quite a bit of maintainence work on the STM32 and Qualcomm drivers - Usage of the newly added devm_dma_request_chan() in the ateml driver, pulling in the relevant dmaengine change - Cleanups of our usage of the PM autosuspend functions, this pulls in some PM core changes on a shared tag - Support for ADI sigma-delta triggers, Amlogic SPISG, Mediatek MT6991 and MT8196, Renesas RZ/V2H(P) and SOPHGO SG2042" * tag 'spi-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (62 commits) spi: SPISG: Fix less than zero comparison on a u32 variable spi: intel: Allow writeable MTD partition with module param spi: Add driver for the RZ/V2H(P) RSPI IP spi: dt-bindings: Document the RZ/V2H(P) RSPI MAINTAINERS: Add an entry for Amlogic spi driver spi: Add Amlogic SPISG driver spi: dt-bindings: Add binding document of Amlogic SPISG controller spi: spi-sg2044-nor: Add SPI-NOR controller for SG2042 spi: spi-sg2044-nor: Add configurable chip_info spi: dt-bindings: spi-sg2044-nor: Change SOPHGO SG2042 spi: spi-qpic-snand: simplify bad block marker duplication spi: spidev: Add an entry for the ABB spi sensors dt-bindings: trivial-devices: Document ABB sensors spi: stm32-ospi: Fix NULL vs IS_ERR() bug in stm32_ospi_get_resources() spi: gpio: Use explicit 'unsigned int' for parameter types spi: dt-bindings: spi-mux: Drop "spi-max-frequency" as required spi: st: Switch from CONFIG_PM_SLEEP guards to pm_sleep_ptr() spi: rspi: Convert to DEFINE_SIMPLE_DEV_PM_OPS() spi: sh-msiof: Convert to DEFINE_SIMPLE_DEV_PM_OPS() spi: xilinx: Fix block comment style and minor cleanups ... commit bf977a9ad33d204c8ca646cef83184eb364820ff Merge: 5339a2aefc35c8 0bd042ae771d61 Author: Linus Torvalds Date: Mon Jul 28 22:52:02 2025 -0700 Merge tag 'regulator-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator Pull regulator updates from Mark Brown: "The big change in this release is the addition of Rust bindings from Daniel Almeida, allowing fairly basic consumer use with support for enable and voltage setting operations. This should be good for the vast majority of consumers. Otherwise it's been quite quiet, a few new devices supported, plus some cleanups and fixes. Summary: - Basic Rust bindings - A fix for making large voltage changes on regulators where we limit the size of voltage change we will do in one step, previously we just got as close as we could in one step - Cleanups of our usage of the PM autosuspend functions, this pulls in some PM core changes on a shared tag - Mode setting support for PCA9450 - Support for Mediatek MT6893 and MT8196 DVFSRC, Qualcomm PM7550 and PMR735B, Raspberry Pi displays and TI TPS652G1 The TI driver pulls in the MFD portion of the support for the device and the pinctrl driver which was in the same tag" * tag 'regulator-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (40 commits) regulator: mt6370: Fix spelling mistake in mt6370_regualtor_register regulator: Kconfig: Fix spelling mistake "regualtor" -> "regulator" regulator: core: repeat voltage setting request for stepped regulators regulator: rt6160: Add rt6166 vout min_uV setting for compatible MAINTAINERS: add regulator.rs to the regulator API entry rust: regulator: add a bare minimum regulator abstraction regulator: tps6286x-regulator: Fix a copy & paste error regulator: qcom-rpmh: add support for pm7550 regulators regulator: qcom-rpmh: add support for pmr735b regulators regulator: dt-bindings: qcom,rpmh: Add PMR735B compatible regulator: dt-bindings: qcom,rpmh: Add PM7550 compatible regulator: tps6594-regulator: Add TI TPS652G1 PMIC regulators regulator: tps6594-regulator: refactor variant descriptions regulator: tps6594-regulator: remove hardcoded buck config regulator: tps6594-regulator: remove interrupt_count dt-bindings: mfd: ti,tps6594: Add TI TPS652G1 PMIC pinctrl: pinctrl-tps6594: Add TPS652G1 PMIC pinctrl and GPIO misc: tps6594-pfsm: Add TI TPS652G1 PMIC PFSM mfd: tps6594: Add TI TPS652G1 support regulator: sy8827n: make enable gpio NONEXCLUSIVE ... commit 5339a2aefc35c81526dc9a26419d34e8b041f0e6 Merge: ffec878fa5fba8 ffc72771ff6ec9 Author: Linus Torvalds Date: Mon Jul 28 22:38:15 2025 -0700 Merge tag 'regmap-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap Pull regmap updates from Mark Brown: "A very quiet release for regmap this time, just two cleanup patches and one almost cleanup patch which saves individual MMIO regmaps flagging themselves as having fast I/O" * tag 'regmap-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: regmap: Annotate that MMIO implies fast IO regmap: get rid of redundant debugfs_file_{get,put}() regmap: kunit: Constify regmap_range_cfg array commit ffec878fa5fba8c527cbbb006b0522ae0d6599ce Merge: fcb117e0758d14 07d59dec679542 Author: Linus Torvalds Date: Mon Jul 28 22:34:04 2025 -0700 Merge tag 'pwrseq-updates-for-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull power sequencing updates from Bartosz Golaszewski: "One new driver and a small set of improvements as well as a fix to power sequence unit naming. New driver: - add a power sequencing driver for the T-HEAD TH1520 GPU Power sequencing core improvements: - allow to compile the pwrseq drivers with COMPILE_TEST=y in order to improve the build-test coverage - add named defines for the possible return values of the .match() callback and use it in the existing drivers instead of magic values Fix: - Fix the name of the bluetooth-enable unit for WCN6855" * tag 'pwrseq-updates-for-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: power: sequencing: qcom-wcn: fix bluetooth-wifi copypasta for WCN6855 power: sequencing: thead-gpu: use new defines for match() return values power: sequencing: qcom-wcn: use new defines for match() return values power: sequencing: add defines for return values of the match() callback power: sequencing: extend build coverage with COMPILE_TEST=y power: sequencing: thead-gpu: add missing header power: sequencing: Add T-HEAD TH1520 GPU power sequencer driver commit fcb117e0758d1462128a50c5788555e03b48833b Merge: 177bf8620cf4ed 6b94bf976f9f9e Author: Linus Torvalds Date: Mon Jul 28 21:58:46 2025 -0700 Merge tag 'gpio-updates-for-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "There's one new driver (Apple SMC) and extensions to existing drivers for supporting new HW models. A lot of different impovements across drivers and in core GPIO code. Details on that are in the signed tag as usual. We managed to remove some of the legacy APIs. Arnd Bergmann started to work on making the legacy bits optional so that we may compile them only for older platforms that still really need them. Rob Herring has done a lot of work to convert legacy .txt dt-bindings for GPIO controllers to YAML. There are only a few left now in the GPIO tree. A big part of the commits in this PR concern the conversion of GPIO drivers to using the new line value setter callbacks. This conversion is now complete treewide (unless I've missed something) and once all the changes from different trees land in mainline, I'll send you another PR containing a commit dropping the legacy callbacks from the tree. As the quest to pay back technical dept never really ends, we're starting another set of interface conversions, this time it's about moving fields specific to only a handful of drivers using the gpio-mmio helper out of the core gpio_chip structure that every controller implements and uses. This cycle we introduce a new set of APIs and convert a few drivers under drivers/gpio/, next cycle we'll convert remaining modules treewide (in gpio, pinctrl and mfd trees) and finally remove the old interfaces and move the gpio-mmio fields into their own structure wrapping gpio_chip. One last change I should mention here is the rework of the sysfs interface. In 2016, we introduced the GPIO character device as the preferred alternative to the sysfs class under /sys/class/gpio. While it has seen a wide adoption with the help of its user-space counterpart - libgpiod - there are still users who prefer the simplicity of sysfs. As far as the GPIO subsystem is concerned, the problem is not the existince of the GPIO class as such but rather the fact that it exposes the global GPIO numbers to the user-space, stopping us from ever being able to remove the numberspace from the kernel. To that end, this release we introduced a parallel, limited sysfs interface that doesn't expose these numbers and only implements a subset of features that are relevant to the existing users. This is a result of several discussions over the course of last year and should allow us to remove the legacy part some time in the future. Summary: GPIOLIB core: - introduce a parallel, limited sysfs user ABI that doesn't expose the global GPIO numbers to user-space while maintaining backward compatibility with the end goal of it completely replacing the existing interface, allowing us to remove it - remove the legacy devm_gpio_request() routine which has no more users - start the process of allowing to compile-out the legacy parts of the GPIO core for users who don't need it by introducing a new Kconfig option: GPIOLIB_LEGACY - don't use global GPIO numbers in debugfs output from the core code (drivers still do it, the work is ongoing) - start the process of moving the fields specific to the gpio-mmio helper out of the core struct gpio_chip into their own structure that wraps it: create a new header with modern interfaces and convert several drivers to using it - remove the platform data structure associated with the gpio-mmio helper from the kernel after having converted all remaining users to generic device properties - remove legacy struct gpio definition as it has no more users New drivers: - add the GPIO driver for the Apple System Management Controller Driver improvements: - add support for new models to gpio-adp5585, gpio-tps65219 and gpio-pca953x - extend the interrupt support in gpio-loongson-64bit - allow to mark the simulated GPIO lines as invalid in gpio-sim - convert all remaining GPIO drivers to using the new GPIO value setter callbacks - convert gpio-rcar to using simple device power management ops callbacks - don't check if current direction of a line is output before setting the value in gpio-pisosr and ti-fpc202: the GPIO core already handles that - also drop unneeded GPIO range checks in drivers, the core already makes sure we're within bounds when calling driver callbacks - use dev_fwnode() where applicable across GPIO drivers - set line value in gpio-zynqmp-modepin and gpio-twl6040 when the user wants to change direction of the pin to output even though these drivers don't need to do anything else to actually set the direction, otherwise a call like gpiod_direction_output(d, 1) will not result in the line driver high - remove the reduntant call to pm_runtime_mark_last_busy() from gpio-arizona - use lock guards in gpio-cadence and gpio-mxc - check the return values of regmap functions in gpio-wcd934x and gpio-tps65912 - use better regmap interfaces in gpio-wcove and gpio-pca953x - remove dummy GPIO chip callbacks from several drivers in cases where the GPIO core can already handle their absence - allow building gpio-palmas as a module Fixes: - use correct bit widths (according to the documentation) in gpio-virtio Device-tree bindings: - convert several of the legacy .txt documents for many different devices to YAML, improving automatic validation - create a "trivial" GPIO DT schema that covers a wide range of simple hardware that share a set of basic GPIO properties - document new HW: Apple MAC SMC GPIO block and adp5589 I/O expander - document a new model for pca95xx - add and/or remove properties in YAML documents for gpio-rockchip, fsl,qoriq-gpio, arm,pl061 and gpio-xilinx Misc: - some minor refactoring in several places, adding/removing forward declarations, moving defines to better places, constify the arguments in some functions, remove duplicate includes, etc. - documentation updates" * tag 'gpio-updates-for-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (202 commits) MIPS: alchemy: gpio: use new GPIO line value setter callbacks for the remaining chips gpiolib: enable CONFIG_GPIOLIB_LEGACY even for !GPIOLIB gpio: virtio: Fix config space reading. gpiolib: make legacy interfaces optional dt-bindings: gpio: rockchip: Allow use of a power-domain gpiolib: of: add forward declaration for struct device_node power: reset: macsmc-reboot: Add driver for rebooting via Apple SMC gpio: Add new gpio-macsmc driver for Apple Macs mfd: Add Apple Silicon System Management Controller soc: apple: rtkit: Make shmem_destroy optional dt-bindings: mfd: Add Apple Mac System Management Controller dt-bindings: power: reboot: Add Apple Mac SMC Reboot Controller dt-bindings: gpio: Add Apple Mac SMC GPIO block gpio: cadence: Remove duplicated include in gpio-cadence.c gpio: tps65219: Add support for TI TPS65214 PMIC gpio: tps65219: Update _IDX & _OFFSET macro prefix gpio: sysfs: Fix an end of loop test in gpiod_unexport() dt-bindings: gpio: Convert qca,ar7100-gpio to DT schema dt-bindings: gpio: Convert maxim,max3191x to DT schema dt-bindings: gpio: fsl,qoriq-gpio: Add missing mpc8xxx compatibles ... commit 177bf8620cf4ed290ee170a6c5966adc0924b336 Merge: e30fc090828e57 bca53a176f3d46 Author: Linus Torvalds Date: Mon Jul 28 21:49:49 2025 -0700 Merge tag 'sound-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "This includes lots of file shuffling due to HD-audio code reorganization and many trivial changes, but otherwise there shouldn't be much surprise from the functionality POV. The PR includes the PM changes as prerequisite, too. Some highlights below: Core: - Performance optimizations in PCM core code - Refactoring of ASoC Kconfig menus to be hopefully more consistant and easier to navigate. - Refactoring of ASoC DAPM code, mainly hiding functionality that doesn't need to be exposed to drivers HD-audio reorganization: - All code are moved under sound/hda with a bit more understandable tree structure, as well as file renames - The huge Realtek driver code is split to several parts, a common helper module with driver modules per probe entry - HDMI and Cirrus codec drivers also split ASoC: - Further work on the generic handling for SoundWire SDCA devices - Support for AMD ACP7.2 and SoundWire on ACP 7.1, Fairphone 4 & 5, various Intel systems, Qualcomm QCS8275, Richtek RTQ9124 and TI TAS5753 HD-audio and USB-audio: - TAS2781 driver cleanup and TAS2770 support - EQ enablement in CA0132 driver - USB audio quirk code cleanups Others: - Cleanups of PM autosuspend call patterns with the update from the PM tree - Lots of strcpy() -> strscpy() conversions for fixed size arrays" * tag 'sound-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (385 commits) ALSA: hda: Add TAS2770 support ASoC: qcom: sm8250: Add Fairphone 4 soundcard compatible ASoC: dt-bindings: qcom,sm8250: Add Fairphone 4 sound card ASoC: dt-bindings: qcom,q6afe: Document q6usb subnode ASoC: SDCA: Fix implicit cast from le16 ASoC: SDCA: Shrink detected_mode_handler() stack frame ASoC: SDCA: Check devm_mutex_init() return value ASoC: SDCA: add route by the number of input pins in MU entity ALSA: hda/realtek: Add support for ASUS Commercial laptops using CS35L41 HDA ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for PTL. ASoC: codec: tlv320aic32x4: Fix reset GPIO check ASoC: dt-bindings: qcom,lpass-va-macro: Define clock-names in top-level ASoC: SDCA: Add hw_params() helper function ASoC: SDCA: Add a helper to get the SoundWire port number ASoC: SDCA: Add helper to add DAI constraints ASoC: soc-dai: Add private data to snd_soc_dai ASoC: SDCA: Move SDCA search functions and export ASoC: SDCA: Remove overly chatty input pin list warning ASoC: SDCA: Allow read-only controls to be deferrable ASoC: SDCA: Update memory allocations to zero initialise ... commit e30fc090828e5761defe345b7bfb61bfc46be5bd Merge: 9bbf8e17d85212 1e94cb6c2ae1c2 Author: Linus Torvalds Date: Mon Jul 28 21:02:08 2025 -0700 Merge tag 'thermal-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull thermal control updates from Rafael Wysocki: "These update the thermal control sysfs interface and multiple thermal control drivers: - Convert EAGAIN into ENODATA in temp_show() to prevent user space from polling the sysfs file in vain after a failing O_NONBLOCK read under the assumption that the read would have blocked (Hsin-Te Yuan) - Add Wildcat Lake PCI ID to the int340x Intel processor thermal driver (Srinivas Pandruvada) - Add debugfs interface to override the temperature set by the firmware in the Intel platform temperature control (PTC) interface and add a new sysfs control attribute called thermal_tolerance to it (Srinivas Pandruvada) - Enable the stage 2 shutdown in the qcom-spmi-temp-alarm thermal driver and add support for more SPMI variants to it (Anjelique Melendez) - Constify the thermal_zone_device_ops structure where possible in several assorted thermal drivers (Christophe Jaillet) - Use the dev_fwnode() helper instead of of_fwnode_handle(), as it is more adequate, wherever possible in thermal drivers (Jiri Slaby) - Implement and document One-Time Programmable fuse support in the Rockchip thermal driver in order to increase the precision of the measurements (Nicolas Frattaroli) - Change the way the Mediatek LTVS thermal driver stores the initialization data sequence to support different sequences matching different platforms. Introduce mt7988 support with a new initialization sequence (Mason Chang) - Document the QCom TSens Milos Temperature Sensor DT bindings (Luca Weiss) - Add the fallback compatible string for MT7981 and MT8516 DT bindings (Aleksander Jan Bajkowski) - Add the compatible string for the Tegra210B01 SOC_THERM driver (Aaron Kling)" * tag 'thermal-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (23 commits) dt-bindings: thermal: tegra: Document Tegra210B01 dt-bindings: thermal: mediatek: Add fallback compatible string for MT7981 and MT8516 dt-bindings: thermal: qcom-tsens: document the Milos Temperature Sensor thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const thermal/drivers/rockchip: Support reading trim values from OTP dt-bindings: thermal: rockchip: document otp thermal trim thermal/drivers/rockchip: Support RK3576 SoC in the thermal driver dt-bindings: rockchip-thermal: Add RK3576 compatible thermal/drivers/rockchip: Rename rk_tsadcv3_tshut_mode thermal: Use dev_fwnode() thermal: Constify struct thermal_zone_device_ops thermal/drivers/loongson2: Constify struct thermal_zone_device_ops thermal/drivers/qcom-spmi-temp-alarm: Add support for LITE PMIC peripherals thermal/drivers/qcom-spmi-temp-alarm: Add support for GEN2 rev 2 PMIC peripherals thermal/drivers/qcom-spmi-temp-alarm: Prepare to support additional Temp Alarm subtypes thermal/drivers/qcom-spmi-temp-alarm: Add temp alarm data struct based on HW subtype thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required thermal: sysfs: Return ENODATA instead of EAGAIN for reads ... commit 9bbf8e17d8521211c5c5516ed5ec78d7581aacff Merge: 53edfecef66bfa ea34e67ae7a631 Author: Linus Torvalds Date: Mon Jul 28 20:44:42 2025 -0700 Merge tag 'acpi-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI updates from Rafael Wysocki: "These update APEI (new EINJv2 error injection, assorted fixes), fix the ACPI processor driver, update the legacy ACPI /proc interface (multiple assorted fixes of minor issues) and several assorted ACPI drivers (minor fixes and cleanups): - Printing the address in acpi_ex_trace_point() is either incorrect during early kernel boot or not really useful later when pathnames resolve properly, so stop doing it (Mario Limonciello) - Address several minor issues in the legacy ACPI proc interface (Andy Shevchenko) - Fix acpi_object union initialization in the ACPI processor driver to avoid using memory that contains leftover data (Sebastian Ott) - Make the ACPI processor perflib driver take the initial _PPC limit into account as appropriate (Jiayi Li) - Fix message formatting in the ACPI processor throttling driver and in the ACPI PCI link driver (Colin Ian King) - Clean up general ACPI PM domain handling (Rafael Wysocki) - Fix iomem-related sparse warnings in the APEI EINJ driver (Zaid Alali, Tony Luck) - Add EINJv2 error injection support to the APEI EINJ driver (Zaid Alali) - Fix memory corruption in error_type_set() in the APEI EINJ driver (Dan Carpenter) - Fix less than zero comparison on a size_t variable in the APEI EINJ driver (Colin Ian King) - Fix check and iounmap of an uninitialized pointer in the APEI EINJ driver (Colin Ian King) - Add TAINT_MACHINE_CHECK to the GHES panic path in APEI to improve diagnostics and post-mortem analysis (Breno Leitao) - Update APEI reviewer records and other ACPI-related information in MAINTAINERS as well as the contact information in the ACPI ABI documentation (Rafael Wysocki) - Fix the handling of synchronous uncorrected memory errors in APEI (Shuai Xue) - Remove an AudioDSP-related ID from the ACPI LPSS driver (Andy Shevchenko) - Replace sprintf()/scnprintf() with sysfs_emit() in the ACPI fan driver and update a debug message in fan_get_state_acpi4() (Eslam Khafagy, Abdelrahman Fekry, Sumeet Pawnikar) - Add Intel Wildcat Lake support to the ACPI DPTF driver (Srinivas Pandruvada) - Add more debug information regarding failing firmware updates to the ACPI pfr_update driver (Chen Yu) - Reduce the verbosity of the ACPI PRM (platform runtime mechanism) driver to avoid user confusion (Zhu Qiyu) - Replace sprintf() with sysfs_emit() in the ACPI TAD (time and alarm device) driver (Sukrut Heroorkar) - Enable CONFIG_ACPI_DEBUG by default to make it easier to get ACPI debug messages from OEM platforms (Mario Limonciello) - Fix parent device references in ASL examples in the ACPI documentation and fix spelling and style in the gpio-properties documentation in firmware-guide (Andy Shevchenko) - Fix typos in ACPI documentation and comments (Bjorn Helgaas)" * tag 'acpi-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (39 commits) ACPI: Fix typos ACPI/PCI: Remove space before newline ACPI: processor: throttling: Remove space before newline ACPI: processor: perflib: Fix initial _PPC limit application ACPI/PNP: Use my kernel.org address in MAINTAINERS and ABI docs ACPI: TAD: Replace sprintf() with sysfs_emit() ACPI: APEI: handle synchronous exceptions in task work ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered ACPI: APEI: MAINTAINERS: Update reviewers for APEI Documentation: ACPI: Fix parent device references ACPI: fan: Update debug message in fan_get_state_acpi4() ACPI: PRM: Reduce unnecessary printing to avoid user confusion ACPI: fan: Replace sprintf() with sysfs_emit() ACPI: APEI: EINJ: Fix trigger actions ACPI: processor: fix acpi_object initialization ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path ACPI: LPSS: Remove AudioDSP related ID Documentation: firmware-guide: gpio-properties: Spelling and style fixes ACPI: fan: Replace sprintf()/scnprintf() with sysfs_emit() in show() functions ACPI: PM: Set .detach in acpi_general_pm_domain definition ... commit 53edfecef66bfa65882ae065ed1a52f466c88979 Merge: ae388edd4a8f02 40c28199550d5c Author: Linus Torvalds Date: Mon Jul 28 20:13:36 2025 -0700 Merge tag 'pm-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull power management updates from Rafael Wysocki: "As is tradition, cpufreq is the part with the largest number of updates that include core fixes and cleanups as well as updates of several assorted drivers, but there are also quite a few updates related to system sleep, mostly focused on asynchronous suspend and resume of devices and on making the integration of system suspend and resume with runtime PM easier. Runtime PM is also updated to allow some code duplication in drivers to be eliminated going forward and to work more consistently overall in some cases. Apart from that, there are some driver core updates related to PM domains that should help to address ordering issues with devm_ cleanup routines relying on PM domains, some assorted devfreq updates including core fixes and cleanups, tooling updates, and documentation and MAINTAINERS updates. Specifics: - Fix two initialization ordering issues in the cpufreq core and a governor initialization error path in it, and clean it up (Lifeng Zheng) - Add Granite Rapids support in no-HWP mode to the intel_pstate cpufreq driver (Li RongQing) - Make intel_pstate always use HWP_DESIRED_PERF when operating in the passive mode (Rafael Wysocki) - Allow building the tegra124 cpufreq driver as a module (Aaron Kling) - Do minor cleanups for Rust cpufreq and cpumask APIs and fix MAINTAINERS entry for cpu.rs (Abhinav Ananthu, Ritvik Gupta, Lukas Bulwahn) - Clean up assorted cpufreq drivers (Arnd Bergmann, Dan Carpenter, Krzysztof Kozlowski, Sven Peter, Svyatoslav Ryhel, Lifeng Zheng) - Add the NEED_UPDATE_LIMITS flag to the CPPC cpufreq driver (Prashant Malani) - Fix minimum performance state label error in the amd-pstate driver documentation (Shouye Liu) - Add the CPUFREQ_GOV_STRICT_TARGET flag to the userspace cpufreq governor and explain HW coordination influence on it in the documentation (Shashank Balaji) - Fix opencoded for_each_cpu() in idle_state_valid() in the DT cpuidle driver (Yury Norov) - Remove info about non-existing QoS interfaces from the PM QoS documentation (Ulf Hansson) - Use c_* types via kernel prelude in Rust for OPP (Abhinav Ananthu) - Add HiSilicon uncore frequency scaling driver to devfreq (Jie Zhan) - Allow devfreq drivers to add custom sysfs ABIs (Jie Zhan) - Simplify the sun8i-a33-mbus devfreq driver by using more devm functions (Uwe Kleine-König) - Fix an index typo in trans_stat() in devfreq (Chanwoo Choi) - Check devfreq governor before using governor->name (Lifeng Zheng) - Remove a redundant devfreq_get_freq_range() call from devfreq_add_device() (Lifeng Zheng) - Limit max_freq with scaling_min_freq in devfreq (Lifeng Zheng) - Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng) - Extend the asynchronous suspend and resume of devices to handle suppliers like parents and consumers like children (Rafael Wysocki) - Make pm_runtime_force_resume() work for drivers that set the DPM_FLAG_SMART_SUSPEND flag and allow PCI drivers and drivers that collaborate with the general ACPI PM domain to set it (Rafael Wysocki) - Add kernel parameter to disable asynchronous suspend/resume of devices (Tudor Ambarus) - Drop redundant might_sleep() calls from some functions in the device suspend/resume core code (Zhongqiu Han) - Fix the handling of monitors connected right before waking up the system from sleep (tuhaowen) - Clean up MAINTAINERS entries for suspend and hibernation (Rafael Wysocki) - Fix error code path in the KEXEC_JUMP flow and drop a redundant pm_restore_gfp_mask() call from it (Rafael Wysocki) - Rearrange suspend/resume error handling in the core device suspend and resume code (Rafael Wysocki) - Fix up white space that does not follow coding style in the hibernation core code (Darshan Rathod) - Document return values of suspend-related API functions in the runtime PM framework (Sakari Ailus) - Mark last busy stamp in multiple autosuspend-related functions in the runtime PM framework and update its documentation (Sakari Ailus) - Take active children into account in pm_runtime_get_if_in_use() for consistency (Rafael Wysocki) - Fix NULL pointer dereference in get_pd_power_uw() in the dtpm_cpu power capping driver (Sivan Zohar-Kotzer) - Add support for the Bartlett Lake platform to the Intel RAPL power capping driver (Qiao Wei) - Add PL4 support for Panther Lake to the intel_rapl_msr power capping driver (Zhang Rui) - Update contact information in the PM ABI docs and maintainer information in the power domains DT binding (Rafael Wysocki) - Update PM header inclusions to follow the IWYU (Include What You Use) principle (Andy Shevchenko) - Add flags to specify power on attach/detach for PM domains, make the driver core detach PM domains in device_unbind_cleanup(), and drop the dev_pm_domain_detach() call from the platform bus type (Claudiu Beznea) - Improve Python binding's Makefile for cpupower (John B. Wyatt IV) - Fix printing of CORE, CPU fields in cpupower-monitor (Gautham Shenoy)" * tag 'pm-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (75 commits) cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag PM: docs: Use my kernel.org address in ABI docs and DT bindings PM: hibernate: Fix up white space that does not follow coding style PM: sleep: Rearrange suspend/resume error handling in the core Documentation: amd-pstate:fix minimum performance state label error PM: runtime: Take active children into account in pm_runtime_get_if_in_use() kexec_core: Drop redundant pm_restore_gfp_mask() call kexec_core: Fix error code path in the KEXEC_JUMP flow PM: sleep: Clean up MAINTAINERS entries for suspend and hibernation drivers: cpufreq: add Tegra114 support rust: cpumask: Replace `MaybeUninit` and `mem::zeroed` with `Opaque` APIs cpufreq: Exit governor when failed to start old governor cpufreq: Move the check of cpufreq_driver->get into cpufreq_verify_current_freq() cpufreq: Init policy->rwsem before it may be possibly used cpufreq: Initialize cpufreq-based frequency-invariance later cpufreq: Remove duplicate check in __cpufreq_offline() cpufreq: Contain scaling_cur_freq.attr in cpufreq_attrs cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode PM / devfreq: Add HiSilicon uncore frequency scaling driver ... commit cd7c97f4584a93578f87ea6ff427f74e9a943cdf Merge: 5b4c54ac49af7f 51d3750aba7983 Author: Alexei Starovoitov Date: Mon Jul 28 19:39:30 2025 -0700 Merge branch 'bpf-show-precise-rejected-function-when-attaching-to-__noreturn-and-deny-list-functions' KaFai Wan says: ==================== bpf: Show precise rejected function when attaching to __noreturn and deny list functions Show precise rejected function when attaching fexit/fmod_ret to __noreturn functions. Add log for attaching tracing programs to functions in deny list. Add selftest for attaching tracing programs to functions in deny list. Migrate fexit_noreturns case into tracing_failure test suite. changes: v4: - change tracing_deny case attaching function (Yonghong Song) - add Acked-by: Yafang Shao and Yonghong Song v3: - add tracing_deny case into existing files (Alexei) - migrate fexit_noreturns into tracing_failure - change SOB https://lore.kernel.org/bpf/20250722153434.20571-1-kafai.wan@linux.dev/ v2: - change verifier log message (Alexei) - add missing Suggested-by https://lore.kernel.org/bpf/20250714120408.1627128-1-mannkafai@gmail.com/ v1: https://lore.kernel.org/all/20250710162717.3808020-1-mannkafai@gmail.com/ --- ==================== Link: https://patch.msgid.link/20250724151454.499040-1-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit 51d3750aba798335568970f3157629c6ca5dc91a Author: KaFai Wan Date: Thu Jul 24 23:14:54 2025 +0800 selftests/bpf: Migrate fexit_noreturns case into tracing_failure test suite Delete fexit_noreturns.c files and migrate the cases into tracing_failure.c files. The result: $ tools/testing/selftests/bpf/test_progs -t tracing_failure/fexit_noreturns #467/4 tracing_failure/fexit_noreturns:OK #467 tracing_failure:OK Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: KaFai Wan Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250724151454.499040-5-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit a32f6f17a74d0e897b48bd4c697cc9782a38bf4f Author: KaFai Wan Date: Thu Jul 24 23:14:53 2025 +0800 selftests/bpf: Add selftest for attaching tracing programs to functions in deny list The result: $ tools/testing/selftests/bpf/test_progs -t tracing_failure/tracing_deny #468/3 tracing_failure/tracing_deny:OK #468 tracing_failure:OK Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: KaFai Wan Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250724151454.499040-4-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit 863aab3d4dcdfffa5cf0e0795c526dadca65be7a Author: KaFai Wan Date: Thu Jul 24 23:14:52 2025 +0800 bpf: Add log for attaching tracing programs to functions in deny list Show the rejected function name when attaching tracing programs to functions in deny list. With this change, we know why tracing programs can't attach to functions like __rcu_read_lock() from log. $ ./fentry libbpf: prog '__rcu_read_lock': BPF program load failed: -EINVAL libbpf: prog '__rcu_read_lock': -- BEGIN PROG LOAD LOG -- Attaching tracing programs to function '__rcu_read_lock' is rejected. Suggested-by: Leon Hwang Signed-off-by: KaFai Wan Acked-by: Yafang Shao Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250724151454.499040-3-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit a5a6b29a700fda1dd766cc42dde2cbba9b19f470 Author: KaFai Wan Date: Thu Jul 24 23:14:51 2025 +0800 bpf: Show precise rejected function when attaching fexit/fmod_ret to __noreturn functions With this change, we know the precise rejected function name when attaching fexit/fmod_ret to __noreturn functions from log. $ ./fexit libbpf: prog 'fexit': BPF program load failed: -EINVAL libbpf: prog 'fexit': -- BEGIN PROG LOAD LOG -- Attaching fexit/fmod_ret to __noreturn function 'do_exit' is rejected. Suggested-by: Leon Hwang Signed-off-by: KaFai Wan Acked-by: Yafang Shao Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250724151454.499040-2-kafai.wan@linux.dev Signed-off-by: Alexei Starovoitov commit a2f54ff15c3bdc0132e20aae041607e2320dbd73 Author: Damien Le Moal Date: Mon Jul 28 13:17:00 2025 +0900 scsi: core: sysfs: Correct sysfs attributes access rights The SCSI sysfs attributes "supported_mode" and "active_mode" do not define a store method and thus cannot be modified. Correct the DEVICE_ATTR() call for these two attributes to not include S_IWUSR to allow write access as they are read-only. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20250728041700.76660-1-dlemoal@kernel.org Reviewed-by: John Garry Reviewed-by: Johannes Thumshin Signed-off-by: Martin K. Petersen commit ae388edd4a8f0226f3ef7b102c34f78220756c3d Merge: e833f7dfe3c9a6 6803b6ebb8164c Author: Linus Torvalds Date: Mon Jul 28 19:21:32 2025 -0700 Merge tag 'landlock-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux Pull landlock update from Mickaël Salaün: "Fix test issues, improve build compatibility, and add new tests" * tag 'landlock-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux: landlock: Fix cosmetic change samples/landlock: Fix building on musl libc landlock: Fix warning from KUnit tests selftests/landlock: Add test to check rule tied to covered mount point selftests/landlock: Fix build of audit_test selftests/landlock: Fix readlink check commit b90bb6dbf1d60d70969f8f8f2f30033f49711594 Author: Eric Biggers Date: Tue May 13 22:05:46 2025 -0700 ipe: use SHA-256 library API instead of crypto_shash API audit_policy() does not support any other algorithm, so the crypto_shash abstraction provides no value. Just use the SHA-256 library API instead, which is much simpler and easier to use. Signed-off-by: Eric Biggers Signed-off-by: Fan Wu commit e833f7dfe3c9a6a254c56f2b92a78bab6128622a Merge: dffb641bea1d0c ae1ae11fb277f1 Author: Linus Torvalds Date: Mon Jul 28 18:31:06 2025 -0700 Merge tag 'audit-pr-20250725' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit Pull audit update from Paul Moore: "A single audit patch that restores logging of an audit event in the module load failure case" * tag 'audit-pr-20250725' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit: audit,module: restore audit logging in load failure case commit dffb641bea1d0c5a4017771aafb39513701095be Merge: 30b9dcae9815ae ee79ba39b3d6fd Author: Linus Torvalds Date: Mon Jul 28 18:25:57 2025 -0700 Merge tag 'selinux-pr-20250725' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux Pull selinux updates from Paul Moore: - Introduce the concept of a SELinux "neveraudit" type which prevents all auditing of the given type/domain. Taken by itself, the benefit of marking a SELinux domain with the "neveraudit" tag is likely not very interesting, especially given the significant overlap with the "dontaudit" tag. However, given that the "neveraudit" tag applies to *all* auditing of the tagged domain, we can do some fairly interesting optimizations when a SELinux domain is marked as both "permissive" and "dontaudit" (think of the unconfined_t domain). While this pull request includes optimized inode permission and getattr hooks, these optimizations require SELinux policy changes, therefore the improvements may not be visible on standard downstream Linux distos for a period of time. - Continue the deprecation process of /sys/fs/selinux/user. After removing the associated userspace code in 2020, we marked the /sys/fs/selinux/user interface as deprecated in Linux v6.13 with pr_warn() and the usual documention update. This adds a five second sleep after the pr_warn(), following a previous deprecation process pattern that has worked well for us in the past in helping identify any existing users that we haven't yet reached. - Add a __GFP_NOWARN flag to our initial hash table allocation. Fuzzers such a syzbot often attempt abnormally large SELinux policy loads, which the SELinux code gracefully handles by checking for allocation failures, but not before the allocator emits a warning which causes the automated fuzzing to flag this as an error and report it to the list. While we want to continue to support the work done by the fuzzing teams, we want to focus on proper issues and not an error case that is already handled safely. Add a NOWARN flag to quiet the allocator and prevent syzbot from tripping on this again. - Remove some unnecessary selinuxfs cleanup code, courtesy of Al. - Update the SELinux in-kernel documentation with pointers to additional information. * tag 'selinux-pr-20250725' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux: selinux: don't bother with selinuxfs_info_free() on failures selinux: add __GFP_NOWARN to hashtab_init() allocations selinux: optimize selinux_inode_getattr/permission() based on neveraudit|permissive selinux: introduce neveraudit types documentation: add links to SELinux resources selinux: add a 5 second sleep to /sys/fs/selinux/user commit 30b9dcae9815ae7e752fe3aa00aa283fadf16c6a Merge: 4d40b59d8b0568 5d8b97c9467771 Author: Linus Torvalds Date: Mon Jul 28 18:20:32 2025 -0700 Merge tag 'lsm-pr-20250725' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm Pull lsm updates from Paul Moore: - Add Nicolas Bouchinet and Xiu Jianfeng as Lockdown maintainers The Lockdown LSM has been without a dedicated mantainer since its original acceptance upstream, and it has suffered as a result. Thankfully we have two new volunteers who together I believe have the background and desire to help ensure Lockdown is properly supported. - Remove the unused cap_mmap_file() declaration * tag 'lsm-pr-20250725' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: MAINTAINERS: Add Xiu and myself as Lockdown maintainers security: Remove unused declaration cap_mmap_file() lsm: trivial comment fix commit 4d40b59d8b0568769d10ac9b2a97e0af0a39d371 Merge: 283564a43383d6 7f0c6675b31944 Author: Linus Torvalds Date: Mon Jul 28 18:18:16 2025 -0700 Merge tag 'tpmdd-next-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd Pull tpm updates from Jarkko Sakkinen: "Quite a few commits but nothing really that would be worth of spending too much time for, or would want to emphasize in particular" * tag 'tpmdd-next-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: tpm_crb_ffa: handle tpm busy return code tpm_crb_ffa: Remove memset usage tpm_crb_ffa: Fix typos in function name tpm: Check for completion after timeout tpm: Use of_reserved_mem_region_to_resource() for "memory-region" tpm: Replace scnprintf() with sysfs_emit() and sysfs_emit_at() in sysfs show functions tpm_crb_ffa: Remove unused export tpm: tpm_crb_ffa: try to probe tpm_crb_ffa when it's built-in firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall tpm/tpm_svsm: support TPM_CHIP_FLAG_SYNC tpm/tpm_ftpm_tee: support TPM_CHIP_FLAG_SYNC tpm: support devices with synchronous send() tpm: add bufsiz parameter in the .send callback commit 283564a43383d6f26a55546fe9ae345b5fa95e66 Merge: 4b65b859f55b03 fa65058063cbab Author: Linus Torvalds Date: Mon Jul 28 18:07:38 2025 -0700 Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux Pull fscrypt updates from Eric Biggers: "Simplify how fscrypt uses the crypto API, resulting in some significant performance improvements: - Drop the incomplete and problematic support for asynchronous algorithms. These drivers are bug-prone, and it turns out they are actually much slower than the CPU-based code as well. - Allocate crypto requests on the stack instead of the heap. This improves encryption and decryption performance, especially for filenames. This also eliminates a point of failure during I/O" * tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: ceph: Remove gfp_t argument from ceph_fscrypt_encrypt_*() fscrypt: Remove gfp_t argument from fscrypt_encrypt_block_inplace() fscrypt: Remove gfp_t argument from fscrypt_crypt_data_unit() fscrypt: Switch to sync_skcipher and on-stack requests fscrypt: Drop FORBID_WEAK_KEYS flag for AES-ECB fscrypt: Don't use asynchronous CryptoAPI algorithms fscrypt: Don't use problematic non-inline crypto engines fscrypt: Drop obsolete recommendation to enable optimized SHA-512 fscrypt: Explicitly include commit 4b65b859f55b036649a4525f09fa7c5bbbab384e Merge: f2f573ebd42d65 998646b3c11291 Author: Linus Torvalds Date: Mon Jul 28 18:05:46 2025 -0700 Merge tag 'libcrypto-conversions-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library conversions from Eric Biggers: "Convert fsverity and apparmor to use the SHA-2 library functions instead of crypto_shash. This is simpler and also slightly faster" * tag 'libcrypto-conversions-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: fsverity: Switch from crypto_shash to SHA-2 library fsverity: Explicitly include apparmor: use SHA-256 library API instead of crypto_shash API commit f2f573ebd42d659111bc71279cc16e5e78e56ae7 Merge: 13150742b09e72 8cd876e7833758 Author: Linus Torvalds Date: Mon Jul 28 18:02:58 2025 -0700 Merge tag 'libcrypto-tests-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library test updates from Eric Biggers: "Add KUnit test suites for the Poly1305, SHA-1, SHA-224, SHA-256, SHA-384, and SHA-512 library functions. These are the first KUnit tests for lib/crypto/. So in addition to being useful tests for these specific algorithms, they also establish some conventions for lib/crypto/ testing going forwards. The new tests are fairly comprehensive: more comprehensive than the generic crypto infrastructure's tests. They use a variety of techniques to check for the types of implementation bugs that tend to occur in the real world, rather than just naively checking some test vectors. (Interestingly, poly1305_kunit found a bug in QEMU) The core test logic is shared by all six algorithms, rather than being duplicated for each algorithm. Each algorithm's test suite also optionally includes a benchmark" * tag 'libcrypto-tests-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: tests: Annotate worker to be on stack lib/crypto: tests: Add KUnit tests for SHA-1 and HMAC-SHA1 lib/crypto: tests: Add KUnit tests for Poly1305 lib/crypto: tests: Add KUnit tests for SHA-384 and SHA-512 lib/crypto: tests: Add KUnit tests for SHA-224 and SHA-256 lib/crypto: tests: Add hash-test-template.h and gen-hash-testvecs.py commit 13150742b09e720fdf021de14cd2b98b37415a89 Merge: a578dd095dfe8b debc1e5a431779 Author: Linus Torvalds Date: Mon Jul 28 17:58:52 2025 -0700 Merge tag 'libcrypto-updates-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library updates from Eric Biggers: "This is the main crypto library pull request for 6.17. The main focus this cycle is on reorganizing the SHA-1 and SHA-2 code, providing high-quality library APIs for SHA-1 and SHA-2 including HMAC support, and establishing conventions for lib/crypto/ going forward: - Migrate the SHA-1 and SHA-512 code (and also SHA-384 which shares most of the SHA-512 code) into lib/crypto/. This includes both the generic and architecture-optimized code. Greatly simplify how the architecture-optimized code is integrated. Add an easy-to-use library API for each SHA variant, including HMAC support. Finally, reimplement the crypto_shash support on top of the library API. - Apply the same reorganization to the SHA-256 code (and also SHA-224 which shares most of the SHA-256 code). This is a somewhat smaller change, due to my earlier work on SHA-256. But this brings in all the same additional improvements that I made for SHA-1 and SHA-512. There are also some smaller changes: - Move the architecture-optimized ChaCha, Poly1305, and BLAKE2s code from arch/$(SRCARCH)/lib/crypto/ to lib/crypto/$(SRCARCH)/. For these algorithms it's just a move, not a full reorganization yet. - Fix the MIPS chacha-core.S to build with the clang assembler. - Fix the Poly1305 functions to work in all contexts. - Fix a performance regression in the x86_64 Poly1305 code. - Clean up the x86_64 SHA-NI optimized SHA-1 assembly code. Note that since the new organization of the SHA code is much simpler, the diffstat of this pull request is negative, despite the addition of new fully-documented library APIs for multiple SHA and HMAC-SHA variants. These APIs will allow further simplifications across the kernel as users start using them instead of the old-school crypto API. (I've already written a lot of such conversion patches, removing over 1000 more lines of code. But most of those will target 6.18 or later)" * tag 'libcrypto-updates-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (67 commits) lib/crypto: arm64/sha512-ce: Drop compatibility macros for older binutils lib/crypto: x86/sha1-ni: Convert to use rounds macros lib/crypto: x86/sha1-ni: Minor optimizations and cleanup crypto: sha1 - Remove sha1_base.h lib/crypto: x86/sha1: Migrate optimized code into library lib/crypto: sparc/sha1: Migrate optimized code into library lib/crypto: s390/sha1: Migrate optimized code into library lib/crypto: powerpc/sha1: Migrate optimized code into library lib/crypto: mips/sha1: Migrate optimized code into library lib/crypto: arm64/sha1: Migrate optimized code into library lib/crypto: arm/sha1: Migrate optimized code into library crypto: sha1 - Use same state format as legacy drivers crypto: sha1 - Wrap library and add HMAC support lib/crypto: sha1: Add HMAC support lib/crypto: sha1: Add SHA-1 library functions lib/crypto: sha1: Rename sha1_init() to sha1_init_raw() crypto: x86/sha1 - Rename conflicting symbol lib/crypto: sha2: Add hmac_sha*_init_usingrawkey() lib/crypto: arm/poly1305: Remove unneeded empty weak function lib/crypto: x86/poly1305: Fix performance regression on short messages ... commit 0121898ec05fa4c1f566fc05c7e8b3caf0998f97 Author: Krzysztof Kozlowski Date: Fri Jul 25 12:02:42 2025 +0200 dt-bindings: Correct indentation and style in DTS example DTS example in the bindings should be indented with 2- or 4-spaces and aligned with opening '- |', so correct any differences like 3-spaces or mixtures 2- and 4-spaces in one binding. No functional changes here, but saves some comments during reviews of new patches built on existing code. Acked-by: Ulf Hansson # For MMC Acked-by: Lee Jones Acked-by: Thierry Reding Reviewed-by: Geert Uytterhoeven # renesas Link: https://lore.kernel.org/r/20250107131456.247610-1-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250725100241.120106-2-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit ee4cf798202d285dcbe85e4467a094c44f5ed8e6 Author: Kees Cook Date: Thu Jul 24 01:08:05 2025 -0700 staging: media: atomisp: Fix stack buffer overflow in gmin_get_var_int() When gmin_get_config_var() calls efi.get_variable() and the EFI variable is larger than the expected buffer size, two behaviors combine to create a stack buffer overflow: 1. gmin_get_config_var() does not return the proper error code when efi.get_variable() fails. It returns the stale 'ret' value from earlier operations instead of indicating the EFI failure. 2. When efi.get_variable() returns EFI_BUFFER_TOO_SMALL, it updates *out_len to the required buffer size but writes no data to the output buffer. However, due to bug #1, gmin_get_var_int() believes the call succeeded. The caller gmin_get_var_int() then performs: - Allocates val[CFG_VAR_NAME_MAX + 1] (65 bytes) on stack - Calls gmin_get_config_var(dev, is_gmin, var, val, &len) with len=64 - If EFI variable is >64 bytes, efi.get_variable() sets len=required_size - Due to bug #1, thinks call succeeded with len=required_size - Executes val[len] = 0, writing past end of 65-byte stack buffer This creates a stack buffer overflow when EFI variables are larger than 64 bytes. Since EFI variables can be controlled by firmware or system configuration, this could potentially be exploited for code execution. Fix the bug by returning proper error codes from gmin_get_config_var() based on EFI status instead of stale 'ret' value. The gmin_get_var_int() function is called during device initialization for camera sensor configuration on Intel Bay Trail and Cherry Trail platforms using the atomisp camera stack. Reported-by: zepta Closes: https://lore.kernel.org/all/CAPBS6KoQyM7FMdPwOuXteXsOe44X4H3F8Fw+y_qWq6E+OdmxQA@mail.gmail.com Fixes: 38d4f74bc148 ("media: atomisp_gmin_platform: stop abusing efivar API") Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250724080756.work.741-kees@kernel.org Signed-off-by: Kees Cook commit a578dd095dfe8b56c167201d9aea43e47d27f807 Merge: 8e736a2eeaf261 118da22eb6fbd4 Author: Linus Torvalds Date: Mon Jul 28 17:43:29 2025 -0700 Merge tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull CRC updates from Eric Biggers: - Reorganize the architecture-optimized CRC code It now lives in lib/crc/$(SRCARCH)/ rather than arch/$(SRCARCH)/lib/, and it is no longer artificially split into separate generic and arch modules. This allows better inlining and dead code elimination The generic CRC code is also no longer exported, simplifying the API. (This mirrors the similar changes to SHA-1 and SHA-2 in lib/crypto/, which can be found in the "Crypto library updates" pull request) - Improve crc32c() performance on newer x86_64 CPUs on long messages by enabling the VPCLMULQDQ optimized code - Simplify the crypto_shash wrappers for crc32_le() and crc32c() Register just one shash algorithm for each that uses the (fully optimized) library functions, instead of unnecessarily providing direct access to the generic CRC code - Remove unused and obsolete drivers for hardware CRC engines - Remove CRC-32 combination functions that are no longer used - Add kerneldoc for crc32_le(), crc32_be(), and crc32c() - Convert the crc32() macro to an inline function * tag 'crc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: (26 commits) lib/crc: x86/crc32c: Enable VPCLMULQDQ optimization where beneficial lib/crc: x86: Reorganize crc-pclmul static_call initialization lib/crc: crc64: Add include/linux/crc64.h to kernel-api.rst lib/crc: crc32: Change crc32() from macro to inline function and remove cast nvmem: layouts: Switch from crc32() to crc32_le() lib/crc: crc32: Document crc32_le(), crc32_be(), and crc32c() lib/crc: Explicitly include lib/crc: Remove ARCH_HAS_* kconfig symbols lib/crc: x86: Migrate optimized CRC code into lib/crc/ lib/crc: sparc: Migrate optimized CRC code into lib/crc/ lib/crc: s390: Migrate optimized CRC code into lib/crc/ lib/crc: riscv: Migrate optimized CRC code into lib/crc/ lib/crc: powerpc: Migrate optimized CRC code into lib/crc/ lib/crc: mips: Migrate optimized CRC code into lib/crc/ lib/crc: loongarch: Migrate optimized CRC code into lib/crc/ lib/crc: arm64: Migrate optimized CRC code into lib/crc/ lib/crc: arm: Migrate optimized CRC code into lib/crc/ lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/ lib/crc: Move files into lib/crc/ lib/crc32: Remove unused combination support ... commit 8e736a2eeaf261213b4557778e015699da1e1c8c Merge: d900c4ce638d70 32e42ab9fc88a8 Author: Linus Torvalds Date: Mon Jul 28 17:16:12 2025 -0700 Merge tag 'hardening-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - Introduce and start using TRAILING_OVERLAP() helper for fixing embedded flex array instances (Gustavo A. R. Silva) - mux: Convert mux_control_ops to a flex array member in mux_chip (Thorsten Blum) - string: Group str_has_prefix() and strstarts() (Andy Shevchenko) - Remove KCOV instrumentation from __init and __head (Ritesh Harjani, Kees Cook) - Refactor and rename stackleak feature to support Clang - Add KUnit test for seq_buf API - Fix KUnit fortify test under LTO * tag 'hardening-v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (22 commits) sched/task_stack: Add missing const qualifier to end_of_stack() kstack_erase: Support Clang stack depth tracking kstack_erase: Add -mgeneral-regs-only to silence Clang warnings init.h: Disable sanitizer coverage for __init and __head kstack_erase: Disable kstack_erase for all of arm compressed boot code x86: Handle KCOV __init vs inline mismatches arm64: Handle KCOV __init vs inline mismatches s390: Handle KCOV __init vs inline mismatches arm: Handle KCOV __init vs inline mismatches mips: Handle KCOV __init vs inline mismatch powerpc/mm/book3s64: Move kfence and debug_pagealloc related calls to __init section configs/hardening: Enable CONFIG_INIT_ON_FREE_DEFAULT_ON configs/hardening: Enable CONFIG_KSTACK_ERASE stackleak: Split KSTACK_ERASE_CFLAGS from GCC_PLUGINS_CFLAGS stackleak: Rename stackleak_track_stack to __sanitizer_cov_stack_depth stackleak: Rename STACKLEAK to KSTACK_ERASE seq_buf: Introduce KUnit tests string: Group str_has_prefix() and strstarts() kunit/fortify: Add back "volatile" for sizeof() constants acpi: nfit: intel: avoid multiple -Wflex-array-member-not-at-end warnings ... commit d900c4ce638d707f09c7e5c2afa71e035c0bb33d Merge: ced1b9e0392d98 7f71195c15dcf5 Author: Linus Torvalds Date: Mon Jul 28 17:11:40 2025 -0700 Merge tag 'execve-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull execve updates from Kees Cook: - Introduce regular REGSET note macros arch-wide (Dave Martin) - Remove arbitrary 4K limitation of program header size (Yin Fengwei) - Reorder function qualifiers for copy_clone_args_from_user() (Dishank Jogi) * tag 'execve-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (25 commits) fork: reorder function qualifiers for copy_clone_args_from_user binfmt_elf: remove the 4k limitation of program header size binfmt_elf: Warn on missing or suspicious regset note names xtensa: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names um: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names x86/ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names sparc: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names sh: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names s390/ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names riscv: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names powerpc/ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names parisc: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names openrisc: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names nios2: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names MIPS: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names m68k: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names LoongArch: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names hexagon: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names csky: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names arm64: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names ... commit ced1b9e0392d981a7317c605b402c06650947a34 Merge: e268c230c0e9f0 546527b92d7e72 Author: Linus Torvalds Date: Mon Jul 28 17:08:24 2025 -0700 Merge tag 'ata-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata updates from Damien Le Moal: - Replace the ATA_DFLAG_ZAC device flag with the helper function ata_dev_is_zac() testing directly the device class and device zoned mode (me) - Some small cleanup of ata_scsi_offline_dev() code (me) - Improve the description of the link power management (LPM) policies in Kconfig and in the comments defining these. Together with this, clarify the description of the ahci driver mobile_lpm_policy module parameter (me) - Various code refactoring of libata LPM handling (ata_eh_set_lpm() renaming, introduce ata_dev_config_lpm(), LPM related quirk handling, and LPM related feature advertizing on device scan) (me) - Avoid unnecessary device reset when revalidating after an error when LPM is used (me) - Do not allow setting a port/link LPM policy if LPM is not supported, either because the controller does not support partial, slumber nor devsleep, or when the port is an external port with hotplug capability (me) - Make sure that device initiated power management (DIPM) is not enabled if the host (controller) lacks support for this feature (me) - Improve messages and debug messages related to LPM, in particular, reduce the number of messages signaling the lack of LPM support (me) - Cache in memory a device general purpose log directory to avoid having to access this log for every log page access. The intent here is to reduce the number of read log commands when scanning or revalidating a device (me) - Change ata_dev_cleanup_cdl_resources() to be a static function (me) - Rename and simplify the mode setting functions (me) - Introduce the helper function ata_port_eh_scheduled() to check if EH is pending or running for a port (me) - Improve ata_eh_set_pending() (return bool instead of int) (me) - Use sysfs_emit() instead of scnprintf() for libata-transport attributes (Jonathan) - Use the existing macro definiton of RDC vendor ID instead of hardcoding it in the pata_rdc driver (Andy) - Rework how EH is called for a port to avoid needing to pass along the prereset, softreset, hardreset and postreset operations. The driver API documentation for this is also updated (me) * tag 'ata-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: (28 commits) Documentation: driver-api: Update libata error handler information ata: libata-eh: Simplify reset operation management ata: libata-eh: Remove ata_do_eh() ata: pata_rdc: Use registered definition for the RDC vendor ata: libata-eh: Make ata_eh_followup_srst_needed() return a bool ata: libata-transport: replace scnprintf with sysfs_emit for simple attributes ata: libata-eh: use bool for fastdrain in ata_eh_set_pending() ata: libata: Introduce ata_port_eh_scheduled() ata: libata-core: Rename ata_do_set_mode() ata: libata-eh: Rename and make ata_set_mode() static ata: libata-core: Make ata_dev_cleanup_cdl_resources() static ata: libata-core: Cache the general purpose log directory ata: libata_eh: Add debug messages to ata_eh_link_set_lpm() ata: libata-core: Reduce the number of messages signaling broken LPM ata: ahci: Disallow LPM policy control if not supported ata: ahci: Disallow LPM policy control for external ports ata: ahci: Disable DIPM if host lacks support ata: libata-sata: Disallow changing LPM state if not supported ata: libata-eh: Avoid unnecessary resets when revalidating devices ata: libata-core: Advertize device support for DIPM and HIPM features ... commit e268c230c0e9f00680c929389324cf45acf76599 Merge: 6e11664f148454 6982100bb8297c Author: Linus Torvalds Date: Mon Jul 28 17:06:51 2025 -0700 Merge tag 'zonefs-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs Pull zonefs update from Damien Le Moal: - Use ZONEFS_SUPER_SIZE instead of PAGE_SIZE to read from disk the super block (Johannes). * tag 'zonefs-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dlemoal/zonefs: zonefs: use ZONEFS_SUPER_SIZE instead of PAGE_SIZE commit 6e11664f148454a127dd89e8698c3e3e80e5f62f Merge: c3018a2c6adae9 5989bfe6ac6bf2 Author: Linus Torvalds Date: Mon Jul 28 16:43:54 2025 -0700 Merge tag 'for-6.17/block-20250728' of git://git.kernel.dk/linux Pull block updates from Jens Axboe: - MD pull request via Yu: - call del_gendisk synchronously (Xiao) - cleanup unused variable (John) - cleanup workqueue flags (Ryo) - fix faulty rdev can't be removed during resync (Qixing) - NVMe pull request via Christoph: - try PCIe function level reset on init failure (Keith Busch) - log TLS handshake failures at error level (Maurizio Lombardi) - pci-epf: do not complete commands twice if nvmet_req_init() fails (Rick Wertenbroek) - misc cleanups (Alok Tiwari) - Removal of the pktcdvd driver This has been more than a decade coming at this point, and some recently revealed breakages that had it causing issues even for cases where it isn't required made me re-pull the trigger on this one. It's known broken and nobody has stepped up to maintain the code - Series for ublk supporting batch commands, enabling the use of multishot where appropriate - Speed up ublk exit handling - Fix for the two-stage elevator fixing which could leak data - Convert NVMe to use the new IOVA based API - Increase default max transfer size to something more reasonable - Series fixing write operations on zoned DM devices - Add tracepoints for zoned block device operations - Prep series working towards improving blk-mq queue management in the presence of isolated CPUs - Don't allow updating of the block size of a loop device that is currently under exclusively ownership/open - Set chunk sectors from stacked device stripe size and use it for the atomic write size limit - Switch to folios in bcache read_super() - Fix for CD-ROM MRW exit flush handling - Various tweaks, fixes, and cleanups * tag 'for-6.17/block-20250728' of git://git.kernel.dk/linux: (94 commits) block: restore two stage elevator switch while running nr_hw_queue update cdrom: Call cdrom_mrw_exit from cdrom_release function sunvdc: Balance device refcount in vdc_port_mpgroup_check nvme-pci: try function level reset on init failure dm: split write BIOs on zone boundaries when zone append is not emulated block: use chunk_sectors when evaluating stacked atomic write limits dm-stripe: limit chunk_sectors to the stripe size md/raid10: set chunk_sectors limit md/raid0: set chunk_sectors limit block: sanitize chunk_sectors for atomic write limits ilog2: add max_pow_of_two_factor() nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails nvme-tcp: log TLS handshake failures at error level docs: nvme: fix grammar in nvme-pci-endpoint-target.rst nvme: fix typo in status code constant for self-test in progress nvmet: remove redundant assignment of error code in nvmet_ns_enable() nvme: fix incorrect variable in io cqes error message nvme: fix multiple spelling and grammar issues in host drivers block: fix blk_zone_append_update_request_bio() kernel-doc md/raid10: fix set but not used variable in sync_request_write() ... commit 133c302a0c60bca1f0a2f5f85ef11e7f5e8f1331 Author: Masami Hiramatsu (Google) Date: Mon Jul 28 11:13:12 2025 +0900 tracing: trace_fprobe: Fix typo of the semicolon Fix a typo that uses ',' instead of ';' for line delimiter. Link: https://lore.kernel.org/linux-trace-kernel/175366879192.487099.5714468217360139639.stgit@mhiramat.tok.corp.google.com/ Signed-off-by: Masami Hiramatsu (Google) commit c3018a2c6adae9b32f7b9259f5b38257ba9a758e Merge: e5cf61fa6e2fb9 d9f595b9a65e9c Author: Linus Torvalds Date: Mon Jul 28 16:30:12 2025 -0700 Merge tag 'for-6.17/io_uring-20250728' of git://git.kernel.dk/linux Pull io_uring updates from Jens Axboe: - Optimization to avoid reference counts on non-cloned registered buffers. This is how these buffers were handled prior to having cloning support, and we can still use that approach as long as the buffers haven't been cloned to another ring. - Cleanup and improvement for uring_cmd, where btrfs was the only user of storing allocated data for the lifetime of the uring_cmd. Clean that up so we can get rid of the need to do that. - Avoid unnecessary memory copies in uring_cmd usage. This is particularly important as a lot of uring_cmd usage necessitates the use of 128b SQEs. - A few updates for recv multishot, where it's now possible to add fairness limits for limiting how much is transferred for each retry loop. Additionally, recv multishot now supports an overall cap as well, where once reached the multishot recv will terminate. The latter is useful for buffer management and juggling many recv streams at the same time. - Add support for returning the TX timestamps via a new socket command. This feature can work in either singleshot or multishot mode, where the latter triggers a completion whenever new timestamps are available. This is an alternative to using the existing error queue. - Add support for an io_uring "mock" file, which is the start of being able to do 100% targeted testing in terms of exercising io_uring request handling. The idea is to have a file type that can be anything the tester would like, and behave exactly how you want it to behave in terms of hitting the code paths you want. - Improve zcrx by using sgtables to de-duplicate and improve dma address handling. - Prep work for supporting larger pages for zcrx. - Various little improvements and fixes. * tag 'for-6.17/io_uring-20250728' of git://git.kernel.dk/linux: (42 commits) io_uring/zcrx: fix leaking pages on sg init fail io_uring/zcrx: don't leak pages on account failure io_uring/zcrx: fix null ifq on area destruction io_uring: fix breakage in EXPERT menu io_uring/cmd: remove struct io_uring_cmd_data btrfs/ioctl: store btrfs_uring_encoded_data in io_btrfs_cmd io_uring/cmd: introduce IORING_URING_CMD_REISSUE flag io_uring/zcrx: account area memory io_uring: export io_[un]account_mem io_uring/net: Support multishot receive len cap io_uring: deduplicate wakeup handling io_uring/net: cast min_not_zero() type io_uring/poll: cleanup apoll freeing io_uring/net: allow multishot receive per-invocation cap io_uring/net: move io_sr_msg->retry_flags to io_sr_msg->flags io_uring/net: use passed in 'len' in io_recv_buf_select() io_uring/zcrx: prepare fallback for larger pages io_uring/zcrx: assert area type in io_zcrx_iov_page io_uring/zcrx: allocate sgtable for umem areas io_uring/zcrx: introduce io_populate_area_dma ... commit e5cf61fa6e2fb9ae6339eaa892612488c966baaf Merge: cb6bbff7e6fb26 4f8ff9486fd94b Author: Linus Torvalds Date: Mon Jul 28 16:25:24 2025 -0700 Merge tag 'v6.17-rc-smb3-server-fixes' of git://git.samba.org/ksmbd Pull smb server updates from Steve French: - Fix mtime/ctime reporting issue - Auth fixes, including two session setup race bugs reported by ZDI - Locking improvement in query directory - Fix for potential deadlock in creating hardlinks - Improvements to path name processing * tag 'v6.17-rc-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: fix corrupted mtime and ctime in smb2_open ksmbd: fix Preauh_HashValue race condition ksmbd: check return value of xa_store() in krb5_authenticate ksmbd: fix null pointer dereference error in generate_encryptionkey smb/server: add ksmbd_vfs_kern_path() smb/server: avoid deadlock when linking with ReplaceIfExists smb/server: simplify ksmbd_vfs_kern_path_locked() smb/server: use lookup_one_unlocked() commit cb6bbff7e6fb263dd739514b3f5dfdcd8eaa9836 Merge: c7bfaff47a17ec 736a0516a16268 Author: Linus Torvalds Date: Mon Jul 28 16:17:44 2025 -0700 Merge tag 'hfs-v6.17-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs Pull hfs/hfsplus updates from Viacheslav Dubeyko: "Johannes Thumshirn has made nice cleanup in hfsplus_submit_bio(). Tetsuo Handa has fixed the syzbot reported issue in hfsplus_create_attributes_file() for the case of corruption the Attributes File's metadata. Yangtao Li has fixed the syzbot reported issue by removing the uneccessary WARN_ON() in hfsplus_free_extents(). Other fixes: - restore generic/001 successful execution by erasing deleted b-tree nodes - eliminate slab-out-of-bounds issue in hfs_bnode_read() and hfsplus_bnode_read() by checking correctness of offset and length when accessing b-tree node contents - eliminate slab-out-of-bounds read in hfsplus_uni2asc() if the b-tree node record has corrupted length of a name that could be bigger than HFSPLUS_MAX_STRLEN - eliminate general protection fault in hfs_find_init() for the case of initial b-tree object creation" * tag 'hfs-v6.17-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs: hfs: fix general protection fault in hfs_find_init() hfs: fix slab-out-of-bounds in hfs_bnode_read() hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() hfsplus: don't set REQ_SYNC for hfsplus_submit_bio() hfsplus: remove mutex_lock check in hfsplus_free_extents hfs: make splice write available again hfsplus: make splice write available again hfs: fix not erasing deleted b-tree node issue commit c7bfaff47a17ec01d9d8b648a7266103cb7a305b Merge: 1edaac340f4da8 1a11201668e863 Author: Linus Torvalds Date: Mon Jul 28 16:16:09 2025 -0700 Merge tag 'fs_for_v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull udf and ext2 updates from Jan Kara: "A few udf and ext2 fixes and cleanups" * tag 'fs_for_v6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Verify partition map count udf: stop using write_cache_pages ext2: Handle fiemap on empty files to prevent EINVAL commit 1edaac340f4da813b258a5e3a6c79804612161a4 Author: Klara Modin Date: Fri Jul 25 18:43:34 2025 +0200 block: change blk_get_meta_cap() stub return -ENOIOCTLCMD When introduced in commit 9eb22f7fedfc ("fs: add ioctl to query metadata and protection info capabilities") the stub of blk_get_meta_cap() for !BLK_DEV_INTEGRITY always returns -EOPNOTSUPP. The motivation was that while the command was unsupported in that configuration it was still recognized. A later change instead assumed -ENOIOCTLCMD as is required for unknown ioctl commands per Documentation/driver-api/ioctl.rst. The result being that on !BLK_DEV_INTEGRITY configs, any ioctl which reaches blkdev_common_ioctl() will return -EOPNOTSUPP. Change the stub to return -ENOIOCTLCMD, fixing the issue and better matching with expectations. [ The blkdev_common_ioctl() confusion has been fixed, but -ENOIOCTLCMD is the right thing to return for unrecognized ioctls, so the patch remains the right thing to do. - Linus ] Link: https://lore.kernel.org/lkml/CACzX3AsRd__fXb9=CJPTTJC494SDnYAtYrN2=+bZgMCvM6UQDg@mail.gmail.com Fixes: 42b0ef01e6b5 ("block: fix FS_IOC_GETLBMD_CAP parsing in blkdev_common_ioctl()") Signed-off-by: Klara Modin Reviewed-by: Arnd Bergmann Signed-off-by: Linus Torvalds commit 595d7ebeaf39ee08180e00fdecf3576a2d702e01 Author: Joanne Koong Date: Wed Jul 23 16:08:50 2025 -0700 fuse: remove page alignment check for writeback len Remove incorrect page alignment check for the writeback len arg in fuse_iomap_writeback_range(). len will always be block-aligned as passed in by iomap. On regular fuse filesystems, i_blkbits is set to PAGE_SHIFT so this is not a problem but for fuseblk filesystems, the block size is set to a default of 512 bytes or a block size passed in at mount time. Please note that non-page-aligned lengths are fine for the logic in fuse_iomap_writeback_range(). The check was originally added as a safeguard to detect conspicuously wrong ranges. Signed-off-by: Joanne Koong Fixes: ef7e7cbb323f ("fuse: use iomap for writeback") Reported-by: Linux Kernel Functional Testing Link: https://lore.kernel.org/linux-fsdevel/CA+G9fYs5AdVM-T2Tf3LciNCwLZEHetcnSkHsjZajVwwpM2HmJw@mail.gmail.com/ Reported-by: Sasha Levin Reviewed-by: Darrick J. Wong Signed-off-by: Linus Torvalds commit b5d760d53ac2e36825fbbb8d1f54ad9ce6138f7b Merge: 0965549d6f5f23 d5212d819e0231 Author: Linus Torvalds Date: Mon Jul 28 16:09:03 2025 -0700 Merge tag 'vfs-6.17-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs iomap updates from Christian Brauner: - Refactor the iomap writeback code and split the generic and ioend/bio based writeback code. There are two methods that define the split between the generic writeback code, and the implemementation of it, and all knowledge of ioends and bios now sits below that layer. - Add fuse iomap support for buffered writes and dirty folio writeback. This is needed so that granular uptodate and dirty tracking can be used in fuse when large folios are enabled. This has two big advantages. For writes, instead of the entire folio needing to be read into the page cache, only the relevant portions need to be. For writeback, only the dirty portions need to be written back instead of the entire folio. * tag 'vfs-6.17-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fuse: refactor writeback to use iomap_writepage_ctx inode fuse: hook into iomap for invalidating and checking partial uptodateness fuse: use iomap for folio laundering fuse: use iomap for writeback fuse: use iomap for buffered writes iomap: build the writeback code without CONFIG_BLOCK iomap: add read_folio_range() handler for buffered writes iomap: improve argument passing to iomap_read_folio_sync iomap: replace iomap_folio_ops with iomap_write_ops iomap: export iomap_writeback_folio iomap: move folio_unlock out of iomap_writeback_folio iomap: rename iomap_writepage_map to iomap_writeback_folio iomap: move all ioend handling to ioend.c iomap: add public helpers for uptodate state manipulation iomap: hide ioends from the generic writeback code iomap: refactor the writeback interface iomap: cleanup the pending writeback tracking in iomap_writepage_map_blocks iomap: pass more arguments using the iomap writeback context iomap: header diet commit 0965549d6f5f23e9250cd9c642f4ea5fd682eddb Merge: 57fcb7d930d8f0 d9c37a4904ec21 Author: Linus Torvalds Date: Mon Jul 28 15:50:15 2025 -0700 Merge tag 'vfs-6.17-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull superblock callback update from Christian Brauner: "Currently all filesystems which implement super_operations::shutdown() can not afford losing a device. Thus fs_bdev_mark_dead() will just call the ->shutdown() callback for the involved filesystem. But it will no longer be the case, as multi-device filesystems like btrfs can handle certain device loss without the need to shutdown the whole filesystem. To allow those multi-device filesystems to be integrated to use fs_holder_ops: - Add a new super_operations::remove_bdev() callback - Try ->remove_bdev() callback first inside fs_bdev_mark_dead(). If the callback returned 0, meaning the fs can handling the device loss, then exit without doing anything else. If there is no such callback or the callback returned non-zero value, continue to shutdown the filesystem as usual. This means the new remove_bdev() should only do the check on whether the operation can continue, and if so do the fs specific handlings. The shutdown handling should still be handled by the existing ->shutdown() callback. For all existing filesystems with shutdown callback, there is no change to the code nor behavior. Btrfs is going to implement both the ->remove_bdev() and ->shutdown() callbacks soon" * tag 'vfs-6.17-rc1.super' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: add a new remove_bdev() callback commit 57fcb7d930d8f00f383e995aeebdcd2b416a187a Merge: cec40a7c80e8b0 e85931d1cd6993 Author: Linus Torvalds Date: Mon Jul 28 15:24:14 2025 -0700 Merge tag 'vfs-6.17-rc1.fileattr' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull fileattr updates from Christian Brauner: "This introduces the new file_getattr() and file_setattr() system calls after lengthy discussions. Both system calls serve as successors and extensible companions to the FS_IOC_FSGETXATTR and FS_IOC_FSSETXATTR system calls which have started to show their age in addition to being named in a way that makes it easy to conflate them with extended attribute related operations. These syscalls allow userspace to set filesystem inode attributes on special files. One of the usage examples is the XFS quota projects. XFS has project quotas which could be attached to a directory. All new inodes in these directories inherit project ID set on parent directory. The project is created from userspace by opening and calling FS_IOC_FSSETXATTR on each inode. This is not possible for special files such as FIFO, SOCK, BLK etc. Therefore, some inodes are left with empty project ID. Those inodes then are not shown in the quota accounting but still exist in the directory. This is not critical but in the case when special files are created in the directory with already existing project quota, these new inodes inherit extended attributes. This creates a mix of special files with and without attributes. Moreover, special files with attributes don't have a possibility to become clear or change the attributes. This, in turn, prevents userspace from re-creating quota project on these existing files. In addition, these new system calls allow the implementation of additional attributes that we couldn't or didn't want to fit into the legacy ioctls anymore" * tag 'vfs-6.17-rc1.fileattr' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: fs: tighten a sanity check in file_attr_to_fileattr() tree-wide: s/struct fileattr/struct file_kattr/g fs: introduce file_getattr and file_setattr syscalls fs: prepare for extending file_get/setattr() fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP selinux: implement inode_file_[g|s]etattr hooks lsm: introduce new hooks for setting/getting inode fsxattr fs: split fileattr related helpers into separate file commit cec40a7c80e8b0ef03667708ea2660bc1a99b464 Merge: add07519ea6b6c bc5b0c8febccbe Author: Linus Torvalds Date: Mon Jul 28 15:12:00 2025 -0700 Merge tag 'vfs-6.17-rc1.integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs 'protection info' updates from Christian Brauner: "This adds the new FS_IOC_GETLBMD_CAP ioctl() to query metadata and protection info (PI) capabilities. This ioctl returns information about the files integrity profile. This is useful for userspace applications to understand a files end-to-end data protection support and configure the I/O accordingly. For now this interface is only supported by block devices. However the design and placement of this ioctl in generic FS ioctl space allows us to extend it to work over files as well. This maybe useful when filesystems start supporting PI-aware layouts. A new structure struct logical_block_metadata_cap is introduced, which contains the following fields: - lbmd_flags: bitmask of logical block metadata capability flags - lbmd_interval: the amount of data described by each unit of logical block metadata - lbmd_size: size in bytes of the logical block metadata associated with each interval - lbmd_opaque_size: size in bytes of the opaque block tag associated with each interval - lbmd_opaque_offset: offset in bytes of the opaque block tag within the logical block metadata - lbmd_pi_size: size in bytes of the T10 PI tuple associated with each interval - lbmd_pi_offset: offset in bytes of T10 PI tuple within the logical block metadata - lbmd_pi_guard_tag_type: T10 PI guard tag type - lbmd_pi_app_tag_size: size in bytes of the T10 PI application tag - lbmd_pi_ref_tag_size: size in bytes of the T10 PI reference tag - lbmd_pi_storage_tag_size: size in bytes of the T10 PI storage tag The internal logic to fetch the capability is encapsulated in a helper function blk_get_meta_cap(), which uses the blk_integrity profile associated with the device. The ioctl returns -EOPNOTSUPP, if CONFIG_BLK_DEV_INTEGRITY is not enabled" * tag 'vfs-6.17-rc1.integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: block: fix lbmd_guard_tag_type assignment in FS_IOC_GETLBMD_CAP block: fix FS_IOC_GETLBMD_CAP parsing in blkdev_common_ioctl() fs: add ioctl to query metadata and protection info capabilities nvme: set pi_offset only when checksum type is not BLK_INTEGRITY_CSUM_NONE block: introduce pi_tuple_size field in blk_integrity block: rename tuple_size field in blk_integrity to metadata_size commit add07519ea6b6c2ba2b7842225eb87e0f08f2b0f Merge: 7e7bc8335b1486 3ccc82e31d6a66 Author: Linus Torvalds Date: Mon Jul 28 14:44:43 2025 -0700 Merge tag 'vfs-6.17-rc1.rust' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs rust updates from Christian Brauner: - Allow poll_table pointers to be NULL - Add Rust files to vfs MAINTAINERS entry * tag 'vfs-6.17-rc1.rust' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: vfs: add Rust files to MAINTAINERS poll: rust: allow poll_table ptrs to be null commit 7e7bc8335b1486e5b157e844c248925a763baf16 Merge: 672dcda246071e 70619d40e8307b Author: Linus Torvalds Date: Mon Jul 28 14:42:31 2025 -0700 Merge tag 'vfs-6.17-rc1.bpf' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs bpf updates from Christian Brauner: "These changes allow bpf to read extended attributes from cgroupfs. This is useful in redirecting AF_UNIX socket connections based on cgroup membership of the socket. One use-case is the ability to implement log namespaces in systemd so services and containers are redirected to different journals" * tag 'vfs-6.17-rc1.bpf' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/kernfs: test xattr retrieval selftests/bpf: Add tests for bpf_cgroup_read_xattr bpf: Mark cgroup_subsys_state->cgroup RCU safe bpf: Introduce bpf_cgroup_read_xattr to read xattr of cgroup's node kernfs: remove iattr_mutex commit 672dcda246071e1940eab8bb5a03d04ea026f46e Merge: 7031769e102b76 1f531e35c146cc Author: Linus Torvalds Date: Mon Jul 28 14:10:15 2025 -0700 Merge tag 'vfs-6.17-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull pidfs updates from Christian Brauner: - persistent info Persist exit and coredump information independent of whether anyone currently holds a pidfd for the struct pid. The current scheme allocated pidfs dentries on-demand repeatedly. This scheme is reaching it's limits as it makes it impossible to pin information that needs to be available after the task has exited or coredumped and that should not be lost simply because the pidfd got closed temporarily. The next opener should still see the stashed information. This is also a prerequisite for supporting extended attributes on pidfds to allow attaching meta information to them. If someone opens a pidfd for a struct pid a pidfs dentry is allocated and stashed in pid->stashed. Once the last pidfd for the struct pid is closed the pidfs dentry is released and removed from pid->stashed. So if 10 callers create a pidfs dentry for the same struct pid sequentially, i.e., each closing the pidfd before the other creates a new one then a new pidfs dentry is allocated every time. Because multiple tasks acquiring and releasing a pidfd for the same struct pid can race with each another a task may still find a valid pidfs entry from the previous task in pid->stashed and reuse it. Or it might find a dead dentry in there and fail to reuse it and so stashes a new pidfs dentry. Multiple tasks may race to stash a new pidfs dentry but only one will succeed, the other ones will put their dentry. The current scheme aims to ensure that a pidfs dentry for a struct pid can only be created if the task is still alive or if a pidfs dentry already existed before the task was reaped and so exit information has been was stashed in the pidfs inode. That's great except that it's buggy. If a pidfs dentry is stashed in pid->stashed after pidfs_exit() but before __unhash_process() is called we will return a pidfd for a reaped task without exit information being available. The pidfds_pid_valid() check does not guard against this race as it doens't sync at all with pidfs_exit(). The pid_has_task() check might be successful simply because we're before __unhash_process() but after pidfs_exit(). Introduce a new scheme where the lifetime of information associated with a pidfs entry (coredump and exit information) isn't bound to the lifetime of the pidfs inode but the struct pid itself. The first time a pidfs dentry is allocated for a struct pid a struct pidfs_attr will be allocated which will be used to store exit and coredump information. If all pidfs for the pidfs dentry are closed the dentry and inode can be cleaned up but the struct pidfs_attr will stick until the struct pid itself is freed. This will ensure minimal memory usage while persisting relevant information. The new scheme has various advantages. First, it allows to close the race where we end up handing out a pidfd for a reaped task for which no exit information is available. Second, it minimizes memory usage. Third, it allows to remove complex lifetime tracking via dentries when registering a struct pid with pidfs. There's no need to get or put a reference. Instead, the lifetime of exit and coredump information associated with a struct pid is bound to the lifetime of struct pid itself. - extended attributes Now that we have a way to persist information for pidfs dentries we can start supporting extended attributes on pidfds. This will allow userspace to attach meta information to tasks. One natural extension would be to introduce a custom pidfs.* extended attribute space and allow for the inheritance of extended attributes across fork() and exec(). The first simple scheme will allow privileged userspace to set trusted extended attributes on pidfs inodes. - Allow autonomous pidfs file handles Various filesystems such as pidfs and drm support opening file handles without having to require a file descriptor to identify the filesystem. The filesystem are global single instances and can be trivially identified solely on the information encoded in the file handle. This makes it possible to not have to keep or acquire a sentinal file descriptor just to pass it to open_by_handle_at() to identify the filesystem. That's especially useful when such sentinel file descriptor cannot or should not be acquired. For pidfs this means a file handle can function as full replacement for storing a pid in a file. Instead a file handle can be stored and reopened purely based on the file handle. Such autonomous file handles can be opened with or without specifying a a file descriptor. If no proper file descriptor is used the FD_PIDFS_ROOT sentinel must be passed. This allows us to define further special negative fd sentinels in the future. Userspace can trivially test for support by trying to open the file handle with an invalid file descriptor. - Allow pidfds for reaped tasks with SCM_PIDFD messages This is a logical continuation of the earlier work to create pidfds for reaped tasks through the SO_PEERPIDFD socket option merged in 923ea4d4482b ("Merge patch series "net, pidfs: enable handing out pidfds for reaped sk->sk_peer_pid""). - Two minor fixes: * Fold fs_struct->{lock,seq} into a seqlock * Don't bother with path_{get,put}() in unix_open_file() * tag 'vfs-6.17-rc1.pidfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (37 commits) don't bother with path_get()/path_put() in unix_open_file() fold fs_struct->{lock,seq} into a seqlock selftests: net: extend SCM_PIDFD test to cover stale pidfds af_unix: enable handing out pidfds for reaped tasks in SCM_PIDFD af_unix: stash pidfs dentry when needed af_unix/scm: fix whitespace errors af_unix: introduce and use scm_replace_pid() helper af_unix: introduce unix_skb_to_scm helper af_unix: rework unix_maybe_add_creds() to allow sleep selftests/pidfd: decode pidfd file handles withou having to specify an fd fhandle, pidfs: support open_by_handle_at() purely based on file handle uapi/fcntl: add FD_PIDFS_ROOT uapi/fcntl: add FD_INVALID fcntl/pidfd: redefine PIDFD_SELF_THREAD_GROUP uapi/fcntl: mark range as reserved fhandle: reflow get_path_anchor() pidfs: add pidfs_root_path() helper fhandle: rename to get_path_anchor() fhandle: hoist copy_from_user() above get_path_from_fd() fhandle: raise FILEID_IS_DIR in handle_type ... commit 614384533dfe99293a7ff1bce3d4389adadbb759 Author: Gabriele Monaco Date: Mon Jul 28 15:50:21 2025 +0200 rv: Add opid per-cpu monitor Add a per-cpu monitor as part of the sched model: * opid: operations with preemption and irq disabled Monitor to ensure wakeup and need_resched occur with irq and preemption disabled or in irq handlers. Cc: Jonathan Corbet Cc: Masami Hiramatsu Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250728135022.255578-10-gmonaco@redhat.com Signed-off-by: Gabriele Monaco Acked-by: Nam Cao Tested-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit e8440a88e56bb3aa24c384eec6de8bef1184bed2 Author: Gabriele Monaco Date: Mon Jul 28 15:50:20 2025 +0200 rv: Add nrp and sssw per-task monitors Add 2 per-task monitors as part of the sched model: * nrp: need-resched preempts Monitor to ensure preemption requires need resched. * sssw: set state sleep and wakeup Monitor to ensure sched_set_state to sleepable leads to sleeping and sleeping tasks require wakeup. Cc: Ingo Molnar Cc: Jonathan Corbet Cc: Masami Hiramatsu Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Cc: Peter Zijlstra Link: https://lore.kernel.org/20250728135022.255578-9-gmonaco@redhat.com Signed-off-by: Gabriele Monaco Acked-by: Nam Cao Tested-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit d0096c2f9cfcb4ce385698491604610fcc1a53b3 Author: Gabriele Monaco Date: Mon Jul 28 15:50:19 2025 +0200 rv: Replace tss and sncid monitors with more complete sts The tss monitor currently guarantees task switches can happen only while scheduling, whereas the sncid monitor enforces scheduling occurs with interrupt disabled. Replace the monitors with a more comprehensive specification which implies both but also ensures that: * each scheduler call disable interrupts to switch * each task switch happens with interrupts disabled Cc: Ingo Molnar Cc: Jonathan Corbet Cc: Masami Hiramatsu Cc: Nam Cao Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Cc: Peter Zijlstra Link: https://lore.kernel.org/20250728135022.255578-8-gmonaco@redhat.com Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit adcc3bfa8806761ac21aa271f78454113ec6936e Author: Gabriele Monaco Date: Mon Jul 28 15:50:18 2025 +0200 sched: Adapt sched tracepoints for RV task model Add the following tracepoint: * sched_set_need_resched(tsk, cpu, tif) Called when a task is set the need resched [lazy] flag Remove the unused ip parameter from sched_entry and sched_exit and alter sched_entry to have a value of preempt consistent with the one used in sched_switch. Also adapt all monitors using sched_{entry,exit} to avoid breaking build. These tracepoints are useful to describe the Linux task model and are adapted from the patches by Daniel Bristot de Oliveira (https://bristot.me/linux-task-model/). Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Masami Hiramatsu Cc: Nam Cao Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250728135022.255578-7-gmonaco@redhat.com Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 9d475d80c93735f0f336b34a8e2c22beea6145ab Author: Gabriele Monaco Date: Mon Jul 28 15:50:17 2025 +0200 rv: Retry when da monitor detects race conditions DA monitor can be accessed from multiple cores simultaneously, this is likely, for instance when dealing with per-task monitors reacting on events that do not always occur on the CPU where the task is running. This can cause race conditions where two events change the next state and we see inconsistent values. E.g.: [62] event_srs: 27: sleepable x sched_wakeup -> running (final) [63] event_srs: 27: sleepable x sched_set_state_sleepable -> sleepable [63] error_srs: 27: event sched_switch_suspend not expected in the state running In this case the monitor fails because the event on CPU 62 wins against the one on CPU 63, although the correct state should have been sleepable, since the task get suspended. Detect if the current state was modified by using try_cmpxchg while storing the next value. If it was, try again reading the current state. After a maximum number of failed retries, react by calling a special tracepoint, print on the console and reset the monitor. Remove the functions da_monitor_curr_state() and da_monitor_set_state() as they only hide the underlying implementation in this case. Monitors where this type of condition can occur must be able to account for racing events in any possible order, as we cannot know the winner. Cc: Ingo Molnar Cc: Masami Hiramatsu Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Cc: Peter Zijlstra Link: https://lore.kernel.org/20250728135022.255578-6-gmonaco@redhat.com Signed-off-by: Gabriele Monaco Reviewed-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 79de661707a4a2dc695fd3e00529a14b4f5ec50d Author: Gabriele Monaco Date: Mon Jul 28 15:50:16 2025 +0200 rv: Adjust monitor dependencies RV monitors relying on the preemptirqs tracepoints are set as dependent on PREEMPT_TRACER and IRQSOFF_TRACER. In fact, those configurations do enable the tracepoints but are not the minimal configurations enabling them, which are TRACE_PREEMPT_TOGGLE and TRACE_IRQFLAGS (not selectable manually). Set TRACE_PREEMPT_TOGGLE and TRACE_IRQFLAGS as dependencies for monitors. Cc: Masami Hiramatsu Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250728135022.255578-5-gmonaco@redhat.com Fixes: fbe6c09b7eb4 ("rv: Add scpd, snep and sncid per-cpu monitors") Acked-by: Nam Cao Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 7f904ff6e58d398c4336f3c19c42b338324451f7 Author: Gabriele Monaco Date: Mon Jul 28 15:50:15 2025 +0200 rv: Use strings in da monitors tracepoints Using DA monitors tracepoints with KASAN enabled triggers the following warning: BUG: KASAN: global-out-of-bounds in do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 Read of size 32 at addr ffffffffaada8980 by task ... Call Trace: [...] do_trace_event_raw_event_event_da_monitor+0xd6/0x1a0 ? __pfx_do_trace_event_raw_event_event_da_monitor+0x10/0x10 ? trace_event_sncid+0x83/0x200 trace_event_sncid+0x163/0x200 [...] The buggy address belongs to the variable: automaton_snep+0x4e0/0x5e0 This is caused by the tracepoints reading 32 bytes __array instead of __string from the automata definition. Such strings are literals and reading 32 bytes ends up in out of bound memory accesses (e.g. the next automaton's data in this case). The error is harmless as, while printing the string, we stop at the null terminator, but it should still be fixed. Use the __string facilities while defining the tracepoints to avoid reading out of bound memory. Cc: Masami Hiramatsu Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250728135022.255578-4-gmonaco@redhat.com Fixes: 792575348ff7 ("rv/include: Add deterministic automata monitor definition via C macros") Reviewed-by: Nam Cao Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 7b70ac4cad2b20eaf415276bbaa0d9df9abb428c Author: Gabriele Monaco Date: Mon Jul 28 15:50:14 2025 +0200 rv: Remove trailing whitespace from tracepoint string RV event tracepoints print a line with the format: "event_xyz: S0 x event -> S1 " "event_xyz: S1 x event -> S0 (final)" While printing an event leading to a non-final state, the line has a trailing white space (visible above before the closing "). Adapt the format string not to print the trailing whitespace if we are not printing "(final)". Cc: Masami Hiramatsu Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250728135022.255578-3-gmonaco@redhat.com Reviewed-by: Nam Cao Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 28a78afda6c80dfdcbec51813cb8d2813523ea0c Author: Gabriele Monaco Date: Mon Jul 28 15:50:13 2025 +0200 rv: Add da_handle_start_run_event_ to per-task monitors The RV da_monitor API allows to start monitors in two ways: da_handle_start_event_NAME and da_handle_start_run_event_NAME. The former is used when the event is followed by the initial state of the module, so we ignore the event but we know the monitor is in the initial state and can start monitoring, the latter can be used if the event can only occur in the initial state, so we do handle the event as if the monitor was in the initial state. This latter API is defined for implicit monitors but not per-task ones. Define da_handle_start_run_event_NAME macro also for per-task monitors. Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250728135022.255578-2-gmonaco@redhat.com Reviewed-by: Nam Cao Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 7031769e102b768b3fa0c4c726faf532cb31e973 Merge: 278c7d9b5e0ca7 425c8bb39b032b Author: Linus Torvalds Date: Mon Jul 28 13:43:25 2025 -0700 Merge tag 'vfs-6.17-rc1.mmap_prepare' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull mmap_prepare updates from Christian Brauner: "Last cycle we introduce f_op->mmap_prepare() in c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"). This is preferred to the existing f_op->mmap() hook as it does require a VMA to be established yet, thus allowing the mmap logic to invoke this hook far, far earlier, prior to inserting a VMA into the virtual address space, or performing any other heavy handed operations. This allows for much simpler unwinding on error, and for there to be a single attempt at merging a VMA rather than having to possibly reattempt a merge based on potentially altered VMA state. Far more importantly, it prevents inappropriate manipulation of incompletely initialised VMA state, which is something that has been the cause of bugs and complexity in the past. The intent is to gradually deprecate f_op->mmap, and in that vein this series coverts the majority of file systems to using f_op->mmap_prepare. Prerequisite steps are taken - firstly ensuring all checks for mmap capabilities use the file_has_valid_mmap_hooks() helper rather than directly checking for f_op->mmap (which is now not a valid check) and secondly updating daxdev_mapping_supported() to not require a VMA parameter to allow ext4 and xfs to be converted. Commit bb666b7c2707 ("mm: add mmap_prepare() compatibility layer for nested file systems") handles the nasty edge-case of nested file systems like overlayfs, which introduces a compatibility shim to allow f_op->mmap_prepare() to be invoked from an f_op->mmap() callback. This allows for nested filesystems to continue to function correctly with all file systems regardless of which callback is used. Once we finally convert all file systems, this shim can be removed. As a result, ecryptfs, fuse, and overlayfs remain unaltered so they can nest all other file systems. We additionally do not update resctl - as this requires an update to remap_pfn_range() (or an alternative to it) which we defer to a later series, equally we do not update cramfs which needs a mixed mapping insertion with the same issue, nor do we update procfs, hugetlbfs, syfs or kernfs all of which require VMAs for internal state and hooks. We shall return to all of these later" * tag 'vfs-6.17-rc1.mmap_prepare' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: doc: update porting, vfs documentation to describe mmap_prepare() fs: replace mmap hook with .mmap_prepare for simple mappings fs: convert most other generic_file_*mmap() users to .mmap_prepare() fs: convert simple use of generic_file_*_mmap() to .mmap_prepare() mm/filemap: introduce generic_file_*_mmap_prepare() helpers fs/xfs: transition from deprecated .mmap hook to .mmap_prepare fs/ext4: transition from deprecated .mmap hook to .mmap_prepare fs/dax: make it possible to check dev dax support without a VMA fs: consistently use can_mmap_file() helper mm/nommu: use file_has_valid_mmap_hooks() helper mm: rename call_mmap/mmap_prepare to vfs_mmap/mmap_prepare commit a0b34e4c8663b13e45c78267b4de3004b1a72490 Author: Alex Deucher Date: Fri Jul 18 15:53:54 2025 -0400 drm/amdgpu: update mmhub 4.1.0 client id mappings Update the client id mapping so the correct clients get printed when there is a mmhub page fault. Tested-by: David (Ming Qiang) Wu Reviewed-by: David (Ming Qiang) Wu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 278c7d9b5e0ca73a75e5151c22fb05c91cb4495f Merge: 0c4ec4a339b435 4f984fe7b4d9ae Author: Linus Torvalds Date: Mon Jul 28 13:36:49 2025 -0700 Merge tag 'vfs-6.17-rc1.fallocate' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull fallocate updates from Christian Brauner: "fallocate() currently supports creating preallocated files efficiently. However, on most filesystems fallocate() will preallocate blocks in an unwriten state even if FALLOC_FL_ZERO_RANGE is specified. The extent state must later be converted to a written state when the user writes data into this range, which can trigger numerous metadata changes and journal I/O. This may leads to significant write amplification and performance degradation in synchronous write mode. At the moment, the only method to avoid this is to create an empty file and write zero data into it (for example, using 'dd' with a large block size). However, this method is slow and consumes a considerable amount of disk bandwidth. Now that more and more flash-based storage devices are available it is possible to efficiently write zeros to SSDs using the unmap write zeroes command if the devices do not write physical zeroes to the media. For example, if SCSI SSDs support the UMMAP bit or NVMe SSDs support the DEAC bit[1], the write zeroes command does not write actual data to the device, instead, NVMe converts the zeroed range to a deallocated state, which works fast and consumes almost no disk write bandwidth. This series implements the BLK_FEAT_WRITE_ZEROES_UNMAP feature and BLK_FLAG_WRITE_ZEROES_UNMAP_DISABLED flag for SCSI, NVMe and device-mapper drivers, and add the FALLOC_FL_WRITE_ZEROES and STATX_ATTR_WRITE_ZEROES_UNMAP support for ext4 and raw bdev devices. fallocate() is subsequently extended with the FALLOC_FL_WRITE_ZEROES flag. FALLOC_FL_WRITE_ZEROES zeroes a specified file range in such a way that subsequent writes to that range do not require further changes to the file mapping metadata. This flag is beneficial for subsequent pure overwriting within this range, as it can save on block allocation and, consequently, significant metadata changes" * tag 'vfs-6.17-rc1.fallocate' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: ext4: add FALLOC_FL_WRITE_ZEROES support block: add FALLOC_FL_WRITE_ZEROES support block: factor out common part in blkdev_fallocate() fs: introduce FALLOC_FL_WRITE_ZEROES to fallocate dm: clear unmap write zeroes limits when disabling write zeroes scsi: sd: set max_hw_wzeroes_unmap_sectors if device supports SD_ZERO_*_UNMAP nvmet: set WZDS and DRB if device enables unmap write zeroes operation nvme: set max_hw_wzeroes_unmap_sectors if device supports DEAC bit block: introduce max_{hw|user}_wzeroes_unmap_sectors to queue limits commit 0c4ec4a339b435381bc998f74862bd7a23d33f79 Merge: f70d24c230bcaa d4db71038ff592 Author: Linus Torvalds Date: Mon Jul 28 13:31:32 2025 -0700 Merge tag 'vfs-6.17-rc1.async.dir' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull async directory updates from Christian Brauner: "This contains preparatory changes for the asynchronous directory locking scheme. While the locking scheme is still very much controversial and we're still far away from landing any actual changes in that area the preparatory work that we've been upstreaming for a while now has been very useful. This is another set of minor changes and cleanups" * tag 'vfs-6.17-rc1.async.dir' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: exportfs: use lookup_one_unlocked() coda: use iterate_dir() in coda_readdir() VFS: Minor fixes for porting.rst VFS: merge lookup_one_qstr_excl_raw() back into lookup_one_qstr_excl() commit 2d418e4fd9f1eca7dfce80de86dd702d36a06a25 Author: Ivan Lipski Date: Thu Jul 17 13:58:35 2025 -0400 drm/amd/display: Allow DCN301 to clear update flags [Why & How] Not letting DCN301 to clear after surface/stream update results in artifacts when switching between active overlay planes. The issue is known and has been solved initially. See below: (https://gitlab.freedesktop.org/drm/amd/-/issues/3441) Fixes: f354556e29f4 ("drm/amd/display: limit clear_update_flags t dcn32 and above") Reviewed-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 2b6943df54136f40aff8a6d7ba7c26724d89a0bd Author: Mario Limonciello Date: Thu May 15 15:16:17 2025 -0500 drm/amd/display: Pass up errors for reset GPU that fails to init HW [Why] If a GPU is in reset and the hardware fails to initialize the rest of the resume sequence shouldn't be run. [How] Pass error code up to caller of dm_resume(). Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit b174084b3fe15ad1acc69530e673c1535d2e4f85 Author: Mario Limonciello Date: Tue Jul 15 14:41:46 2025 -0500 drm/amd/display: Only finalize atomic_obj if it was initialized [Why] If amdgpu_dm failed to initalize before amdgpu_dm_initialize_drm_device() completed then freeing atomic_obj will lead to list corruption. [How] Check if atomic_obj state is initialized before trying to free. Reviewed-by: Harry Wentland Signed-off-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit a5ce8695d6d1b40d6960d2d298b579042c158f25 Author: Mario Limonciello Date: Sun Jul 6 08:38:05 2025 -0500 drm/amd/display: Avoid configuring PSR granularity if PSR-SU not supported [Why] If PSR-SU is disabled on the link, then configuring su_y granularity in mod_power_calc_psr_configs() can lead to assertions in psr_su_set_dsc_slice_height(). [How] Check the PSR version in amdgpu_dm_link_setup_psr() to determine whether or not to configure granularity. Reviewed-by: Sun peng (Leo) Li Signed-off-by: Mario Limonciello Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 02f3ec53177243d32ee8b6f8ba99136d7887ee3a Author: Roman Li Date: Mon Jul 14 14:37:33 2025 -0400 drm/amd/display: Disable dsc_power_gate for dcn314 by default [Why] "REG_WAIT timeout 1us * 1000 tries - dcn314_dsc_pg_control line" warnings seen after resuming from s2idle. DCN314 has issues with DSC power gating that cause REG_WAIT timeouts when attempting to power down DSC blocks. [How] Disable dsc_power_gate for dcn314 by default. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Roman Li Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 0395cde08e1f7eee810b5799466e41635a21e599 Author: Frank Min Date: Wed Jun 4 21:39:34 2025 +0800 drm/amdgpu: add kicker fws loading for gfx12/smu14/psp14 1. Add kicker firmwares loading for gfx12/smu14/psp14 2. Register additional MODULE_FIRMWARE entries for kicker fws - gc_12_0_1_rlc_kicker.bin - gc_12_0_1_imu_kicker.bin - psp_14_0_3_sos_kicker.bin - psp_14_0_3_ta_kicker.bin - smu_14_0_3_kicker.bin Signed-off-by: Frank Min Reviewed-by: Gui Chengming Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 8e0d1edb5c16732b695eaf4bd7096b1569817cf0 Author: Yang Wang Date: Thu Jul 24 15:16:18 2025 +0800 drm/amd/amdgpu: fix missing lock for cper.ring->rptr/wptr access Add lock protection for 'ring->wptr'/'ring->rptr' to ensure the correct execution. Fixes: 8652920d2c00 ("drm/amdgpu: add mutex lock for cper ring") Signed-off-by: Yang Wang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit dfe9707c075a365ccd1f82cceabdf6ab55a77b5f Author: Srinivasan Shanmugam Date: Mon Jul 21 18:52:36 2025 +0530 drm/amd/display: Fix misuse of /** to /* in 'dce_i2c_hw.c' Fix the comment style before cntl_stuck_hw_workaround() by replacing '/**' with '/*' since it is not a kdoc comment. Fixes the below with gcc W=1: display/dc/dce/dce_i2c_hw.c:380: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * If we boot without an HDMI display, the I2C engine does not get initialized Fixes: 04d57f4462a6 ("drm/amd/display: Workaround for stuck I2C arbitrage") Cc: Alvin Lee Cc: Dominik Kaszewski Cc: Ivan Lipski Cc: Harry Wentland Cc: Tom Chung Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Signed-off-by: Srinivasan Shanmugam Reviewed-by: Alex Hung Signed-off-by: Alex Deucher commit 9c2883057b3c861879b647f34e8bc448954e8729 Author: Lauri Tirkkonen Date: Mon Jul 21 09:59:40 2025 +0900 drm/amd/display: fix initial backlight brightness calculation DIV_ROUND_CLOSEST(x, 100) returns either 0 or 1 if 0 Cc: stable@vger.kernel.org Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/aH2Q_HJvxKbW74vU@hacktheplanet.fi Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 1f02f2044bda1db1fd995bc35961ab075fa7b5a2 Author: Gang Ba Date: Tue Jul 8 14:36:13 2025 -0400 drm/amdgpu: Avoid extra evict-restore process. If vm belongs to another process, this is fclose after fork, wait may enable signaling KFD eviction fence and cause parent process queue evicted. [677852.634569] amdkfd_fence_enable_signaling+0x56/0x70 [amdgpu] [677852.634814] __dma_fence_enable_signaling+0x3e/0xe0 [677852.634820] dma_fence_wait_timeout+0x3a/0x140 [677852.634825] amddma_resv_wait_timeout+0x7f/0xf0 [amdkcl] [677852.634831] amdgpu_vm_wait_idle+0x2d/0x60 [amdgpu] [677852.635026] amdgpu_flush+0x34/0x50 [amdgpu] [677852.635208] filp_flush+0x38/0x90 [677852.635213] filp_close+0x14/0x30 [677852.635216] do_close_on_exec+0xdd/0x130 [677852.635221] begin_new_exec+0x1da/0x490 [677852.635225] load_elf_binary+0x307/0xea0 [677852.635231] ? srso_alias_return_thunk+0x5/0xfbef5 [677852.635235] ? ima_bprm_check+0xa2/0xd0 [677852.635240] search_binary_handler+0xda/0x260 [677852.635245] exec_binprm+0x58/0x1a0 [677852.635249] bprm_execve.part.0+0x16f/0x210 [677852.635254] bprm_execve+0x45/0x80 [677852.635257] do_execveat_common.isra.0+0x190/0x200 Suggested-by: Christian König Signed-off-by: Gang Ba Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit 284d4dfe850e665f0e7d4dfaf4d3d3da76d11fb0 Author: Alex Deucher Date: Tue Jun 24 11:22:26 2025 -0400 drm/amdgpu: track whether a queue is a kernel queue in amdgpu_mqd_prop Used to to set the MQD appropriately for each queue type. Kernel queues have additional privileges. Acked-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org # 6.16.x commit b4a69f7f29c8a459ad6b4d8a8b72450f1d9fd288 Author: Peter Shkenev Date: Thu Jul 17 23:48:17 2025 +0300 drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities HUBBUB structure is not initialized on DCE hardware, so check if it is NULL to avoid null dereference while accessing amdgpu_dm_capabilities file in debugfs. Signed-off-by: Peter Shkenev Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit c90f2e1172c51fa25492471dc9910e2d7c1444b9 Author: Nathan Chancellor Date: Tue Jul 15 16:50:22 2025 -0700 drm/amdgpu: Initialize data to NULL in imu_v12_0_program_rlc_ram() After a recent change in clang to expose uninitialized warnings from const variables and pointers [1], there is a warning in imu_v12_0_program_rlc_ram() because data is passed uninitialized to program_imu_rlc_ram(): drivers/gpu/drm/amd/amdgpu/imu_v12_0.c:374:30: error: variable 'data' is uninitialized when used here [-Werror,-Wuninitialized] 374 | program_imu_rlc_ram(adev, data, (const u32)size); | ^~~~ As this warning happens early in clang's frontend, it does not realize that due to the assignment of r to -EINVAL, program_imu_rlc_ram() is never actually called, and even if it were, data would not be dereferenced because size is 0. Just initialize data to NULL to silence the warning, as the commit that added program_imu_rlc_ram() mentioned it would eventually be used over the old method, at which point data can be properly initialized and used. Cc: stable@vger.kernel.org Closes: https://github.com/ClangBuiltLinux/linux/issues/2107 Fixes: 56159fffaab5 ("drm/amdgpu: use new method to program rlc ram") Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] Signed-off-by: Nathan Chancellor Signed-off-by: Alex Deucher commit 3556dac8289456bc8b28670546b969f543967856 Author: Dillon Varone Date: Thu Jul 10 20:57:37 2025 -0400 drm/amd/display: Fix divide by zero when calculating min ODM factor [WHY&HOW] If the debug option is set to disable_dsc the max slice width and/or dispclk can be zero. This causes a divide by zero when calculating the min ODM combine factor. Add a check to ensure they are valid first. Reviewed-by: Wenjing Liu Signed-off-by: Dillon Varone Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org commit f70d24c230bcaa1e95f66252133068a98c895200 Merge: 934600daa7bcce 76fdb7eb4e1c91 Author: Linus Torvalds Date: Mon Jul 28 12:50:56 2025 -0700 Merge tag 'vfs-6.17-rc1.nsfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull namespace updates from Christian Brauner: "This contains namespace updates. This time specifically for nsfs: - Userspace heavily relies on the root inode numbers for namespaces to identify the initial namespaces. That's already a hard dependency. So we cannot change that anymore. Move the initial inode numbers to a public header and align the only two namespaces that currently don't do that with all the other namespaces. - The root inode of /proc having a fixed inode number has been part of the core kernel ABI since its inception, and recently some userspace programs (mainly container runtimes) have started to explicitly depend on this behaviour. The main reason this is useful to userspace is that by checking that a suspect /proc handle has fstype PROC_SUPER_MAGIC and is PROCFS_ROOT_INO, they can then use openat2() together with RESOLVE_{NO_{XDEV,MAGICLINK},BENEATH} to ensure that there isn't a bind-mount that replaces some procfs file with a different one. This kind of attack has lead to security issues in container runtimes in the past (such as CVE-2019-19921) and libraries like libpathrs[1] use this feature of procfs to provide safe procfs handling functions" * tag 'vfs-6.17-rc1.nsfs' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: uapi: export PROCFS_ROOT_INO mntns: use stable inode number for initial mount ns netns: use stable inode number for initial mount ns nsfs: move root inode number to uapi commit 934600daa7bcce8ad6d5efe05cce4811c8d2f464 Merge: 117eab5c6e3181 672820a070ea5e Author: Linus Torvalds Date: Mon Jul 28 12:20:06 2025 -0700 Merge tag 'vfs-6.17-rc1.ovl' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull overlayfs updates from Christian Brauner: "This contains overlayfs updates for this cycle. The changes for overlayfs in here are primarily focussed on preparing for some proposed changes to directory locking. Overlayfs currently will sometimes lock a directory on the upper filesystem and do a few different things while holding the lock. This is incompatible with the new potential scheme. This series narrows the region of code protected by the directory lock, taking it multiple times when necessary. This theoretically opens up the possibilty of other changes happening on the upper filesytem between the unlock and the lock. To some extent the patches guard against that by checking the dentries still have the expect parent after retaking the lock. In general, concurrent changes to the upper and lower filesystems aren't supported properly anyway" * tag 'vfs-6.17-rc1.ovl' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (25 commits) ovl: properly print correct variable ovl: rename ovl_cleanup_unlocked() to ovl_cleanup() ovl: change ovl_create_real() to receive dentry parent ovl: narrow locking in ovl_check_rename_whiteout() ovl: narrow locking in ovl_whiteout() ovl: change ovl_cleanup_and_whiteout() to take rename lock as needed ovl: narrow locking on ovl_remove_and_whiteout() ovl: change ovl_workdir_cleanup() to take dir lock as needed. ovl: narrow locking in ovl_workdir_cleanup_recurse() ovl: narrow locking in ovl_indexdir_cleanup() ovl: narrow locking in ovl_workdir_create() ovl: narrow locking in ovl_cleanup_index() ovl: narrow locking in ovl_cleanup_whiteouts() ovl: narrow locking in ovl_rename() ovl: simplify gotos in ovl_rename() ovl: narrow locking in ovl_create_over_whiteout() ovl: narrow locking in ovl_clear_empty() ovl: narrow locking in ovl_create_upper() ovl: narrow the locked region in ovl_copy_up_workdir() ovl: Call ovl_create_temp() without lock held. ... commit 117eab5c6e31815649d952f6da03f67aa247d29b Merge: 7879d7aff0ffd9 5c21c5f22d0701 Author: Linus Torvalds Date: Mon Jul 28 11:50:36 2025 -0700 Merge tag 'vfs-6.17-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull coredump updates from Christian Brauner: "This contains an extension to the coredump socket and a proper rework of the coredump code. - This extends the coredump socket to allow the coredump server to tell the kernel how to process individual coredumps. This allows for fine-grained coredump management. Userspace can decide to just let the kernel write out the coredump, or generate the coredump itself, or just reject it. * COREDUMP_KERNEL The kernel will write the coredump data to the socket. * COREDUMP_USERSPACE The kernel will not write coredump data but will indicate to the parent that a coredump has been generated. This is used when userspace generates its own coredumps. * COREDUMP_REJECT The kernel will skip generating a coredump for this task. * COREDUMP_WAIT The kernel will prevent the task from exiting until the coredump server has shutdown the socket connection. The flexible coredump socket can be enabled by using the "@@" prefix instead of the single "@" prefix for the regular coredump socket: @@/run/systemd/coredump.socket - Cleanup the coredump code properly while we have to touch it anyway. Split out each coredump mode in a separate helper so it's easy to grasp what is going on and make the code easier to follow. The core coredump function should now be very trivial to follow" * tag 'vfs-6.17-rc1.coredump' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (31 commits) cleanup: add a scoped version of CLASS() coredump: add coredump_skip() helper coredump: avoid pointless variable coredump: order auto cleanup variables at the top coredump: add coredump_cleanup() coredump: auto cleanup prepare_creds() cred: add auto cleanup method coredump: directly return coredump: auto cleanup argv coredump: add coredump_write() coredump: use a single helper for the socket coredump: move pipe specific file check into coredump_pipe() coredump: split pipe coredumping into coredump_pipe() coredump: move core_pipe_count to global variable coredump: prepare to simplify exit paths coredump: split file coredumping into coredump_file() coredump: rename do_coredump() to vfs_coredump() selftests/coredump: make sure invalid paths are rejected coredump: validate socket path in coredump_parse() coredump: don't allow ".." in coredump socket path ... commit 7879d7aff0ffd969fcb1a59e3f87ebb353e47b7f Merge: 794cbac9c05315 4e8fc4f7208b03 Author: Linus Torvalds Date: Mon Jul 28 11:22:56 2025 -0700 Merge tag 'vfs-6.17-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull misc VFS updates from Christian Brauner: "This contains the usual selections of misc updates for this cycle. Features: - Add ext4 IOCB_DONTCACHE support This refactors the address_space_operations write_begin() and write_end() callbacks to take const struct kiocb * as their first argument, allowing IOCB flags such as IOCB_DONTCACHE to propagate to the filesystem's buffered I/O path. Ext4 is updated to implement handling of the IOCB_DONTCACHE flag and advertises support via the FOP_DONTCACHE file operation flag. Additionally, the i915 driver's shmem write paths are updated to bypass the legacy write_begin/write_end interface in favor of directly calling write_iter() with a constructed synchronous kiocb. Another i915 change replaces a manual write loop with kernel_write() during GEM shmem object creation. Cleanups: - don't duplicate vfs_open() in kernel_file_open() - proc_fd_getattr(): don't bother with S_ISDIR() check - fs/ecryptfs: replace snprintf with sysfs_emit in show function - vfs: Remove unnecessary list_for_each_entry_safe() from evict_inodes() - filelock: add new locks_wake_up_waiter() helper - fs: Remove three arguments from block_write_end() - VFS: change old_dir and new_dir in struct renamedata to dentrys - netfs: Remove unused declaration netfs_queue_write_request() Fixes: - eventpoll: Fix semi-unbounded recursion - eventpoll: fix sphinx documentation build warning - fs/read_write: Fix spelling typo - fs: annotate data race between poll_schedule_timeout() and pollwake() - fs/pipe: set FMODE_NOWAIT in create_pipe_files() - docs/vfs: update references to i_mutex to i_rwsem - fs/buffer: remove comment about hard sectorsize - fs/buffer: remove the min and max limit checks in __getblk_slow() - fs/libfs: don't assume blocksize <= PAGE_SIZE in generic_check_addressable - fs_context: fix parameter name in infofc() macro - fs: Prevent file descriptor table allocations exceeding INT_MAX" * tag 'vfs-6.17-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (24 commits) netfs: Remove unused declaration netfs_queue_write_request() eventpoll: fix sphinx documentation build warning ext4: support uncached buffered I/O mm/pagemap: add write_begin_get_folio() helper function fs: change write_begin/write_end interface to take struct kiocb * drm/i915: Refactor shmem_pwrite() to use kiocb and write_iter drm/i915: Use kernel_write() in shmem object create eventpoll: Fix semi-unbounded recursion vfs: Remove unnecessary list_for_each_entry_safe() from evict_inodes() fs/libfs: don't assume blocksize <= PAGE_SIZE in generic_check_addressable fs/buffer: remove the min and max limit checks in __getblk_slow() fs: Prevent file descriptor table allocations exceeding INT_MAX fs: Remove three arguments from block_write_end() fs/ecryptfs: replace snprintf with sysfs_emit in show function fs: annotate suspected data race between poll_schedule_timeout() and pollwake() docs/vfs: update references to i_mutex to i_rwsem fs/buffer: remove comment about hard sectorsize fs_context: fix parameter name in infofc() macro VFS: change old_dir and new_dir in struct renamedata to dentrys proc_fd_getattr(): don't bother with S_ISDIR() check ... commit eb3bb145280b6c857a748731a229698e4a7cf37b Author: Muhammad Usama Anjum Date: Sat Jul 26 00:02:54 2025 +0500 ASoC: SOF: amd: acp-loader: Use GFP_KERNEL for DMA allocations in resume context Replace GFP_ATOMIC with GFP_KERNEL for dma_alloc_coherent() calls. This change improves memory allocation reliability during firmware loading, particularly during system resume when memory pressure is high. Because of using GFP_KERNEL, reclaim can happen which can reduce the probability of failure. Fixes memory allocation failures observed during system resume with fragmented memory conditions. snd_sof_amd_vangogh 0000:04:00.5: error: failed to load DSP firmware after resume -12 Fixes: 145d7e5ae8f4e ("ASoC: SOF: amd: add option to use sram for data bin loading") Fixes: 7e51a9e38ab20 ("ASoC: SOF: amd: Add fw loader and renoir dsp ops to load firmware") Cc: stable@vger.kernel.org Signed-off-by: Muhammad Usama Anjum Link: https://patch.msgid.link/20250725190254.1081184-1-usama.anjum@collabora.com Signed-off-by: Mark Brown commit 794cbac9c053155754d04231b9365f91ea4ce7d2 Merge: 953e117bf4aad7 a7cce099450f8f Author: Linus Torvalds Date: Mon Jul 28 10:49:38 2025 -0700 Merge tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull vfs mount updates from Al Viro: - mount hash conflicts rudiments are gone now - we do not allow multiple mounts with the same parent/mountpoint to be hashed at the same time. - 'struct mount' changes: - mnt_umounting is gone - mnt_slave_list/mnt_slave is an hlist now - overmounts are kept track of by explicit pointer in mount - a bunch of flags moved out of mnt_flags to a new field, with only namespace_sem for protection - mnt_expiry is protected by mount_lock now (instead of namespace_sem) - MNT_LOCKED is used only for mounts that need to remain attached to their parents to prevent mountpoint exposure - no more overloading it for absolute roots - all mnt_list uses are transient now - it's used only to represent temporary sets during umount_tree() - mount refcounting change: children no longer pin parents for any mounts, whether they'd passed through umount_tree() or not - 'struct mountpoint' changes: - refcount is no more; what matters is ->m_list emptiness - instead of temporary bumping the refcount, we insert a new object (pinned_mountpoint) into ->m_list - new calling conventions for lock_mount() and friends - do_move_mount()/attach_recursive_mnt() seriously cleaned up - globals in fs/pnode.c are gone - propagate_mnt(), change_mnt_propagation() and propagate_umount() cleaned up (in the last case - pretty much completely rewritten). - freeing of emptied mnt_namespace is done in namespace_unlock(). For one thing, there are subtle ordering requirements there; for another it simplifies cleanups. - assorted cleanups - restore the machinery for long-term mounts from accumulated bitrot. This is going to get a followup come next cycle, when the change of vfs_fs_parse_string() calling conventions goes into -next * tag 'pull-mount' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (48 commits) statmount_mnt_basic(): simplify the logics for group id invent_group_ids(): zero ->mnt_group_id always implies !IS_MNT_SHARED() get rid of CL_SHARE_TO_SLAVE take freeing of emptied mnt_namespace to namespace_unlock() copy_tree(): don't link the mounts via mnt_list change_mnt_propagation(): move ->mnt_master assignment into MS_SLAVE case mnt_slave_list/mnt_slave: turn into hlist_head/hlist_node turn do_make_slave() into transfer_propagation() do_make_slave(): choose new master sanely change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED() change_mnt_propagation() cleanups, step 1 propagate_mnt(): fix comment and convert to kernel-doc, while we are at it propagate_mnt(): get rid of last_dest fs/pnode.c: get rid of globals propagate_one(): fold into the sole caller propagate_one(): separate the "what should be the master for this copy" part propagate_one(): separate the "do we need secondary here?" logics propagate_mnt(): handle all peer groups in the same loop propagate_one(): get rid of dest_master mount: separate the flags accessed only under namespace_sem ... commit 953e117bf4aad7e1d01419d4bcc03ab93420387c Merge: 815d3c16280ce2 ce23f29e7dfb53 Author: Linus Torvalds Date: Mon Jul 28 10:43:46 2025 -0700 Merge tag 'pull-fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull CLASS(fd) update from Al Viro: "A missing bit of commit 66635b077624 ("assorted variants of irqfd setup: convert to CLASS(fd)") from a year ago. mshv_eventfd would've been covered by that, but it had forked slightly before that series and got merged into mainline later" * tag 'pull-fd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: mshv_eventfd: convert to CLASS(fd) commit 815d3c16280ce289c558255acc4296b36383d1a4 Merge: 2d9c1336edc7d8 0d2da2561bdeb4 Author: Linus Torvalds Date: Mon Jul 28 10:35:13 2025 -0700 Merge tag 'pull-ceph-d_name-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull ceph dentry->d_name fixes from Al Viro: "Stuff that had fallen through the cracks back in February; ceph folks tested that pile and said they prefer to have it go through my tree..." * tag 'pull-ceph-d_name-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: ceph: fix a race with rename() in ceph_mdsc_build_path() prep for ceph_encode_encrypted_fname() fixes [ceph] parse_longname(): strrchr() expects NUL-terminated string commit 2d9c1336edc7d8f8e058822e02c0ce4d126a298e Merge: 8297b790c65d17 93c73ab1776fc0 Author: Linus Torvalds Date: Mon Jul 28 10:32:20 2025 -0700 Merge tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull misc VFS updates from Al Viro: "VFS-related cleanups in various places (mostly of the "that really can't happen" or "there's a better way to do it" variety)" * tag 'pull-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: gpib: use file_inode() binder_ioctl_write_read(): simplify control flow a bit secretmem: move setting O_LARGEFILE and bumping users' count to the place where we create the file apparmor: file never has NULL f_path.mnt landlock: opened file never has a negative dentry commit 8297b790c65d17544d8298cb81a46f67348c6267 Merge: ddf52f12ef500d f42b8d78dee771 Author: Linus Torvalds Date: Mon Jul 28 10:07:54 2025 -0700 Merge tag 'pull-securityfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull securityfs updates from Al Viro: "Securityfs cleanups and fixes: - one extra reference is enough to pin a dentry down; no need for two. Switch to regular scheme, similar to shmem, debugfs, etc. This fixes a securityfs_recursive_remove() dentry leak, among other things. - we need to have the filesystem pinned to prevent the contents disappearing; what we do not need is pinning it for each file. Doing that only for files and directories in the root is enough. - the previous two changes allow us to get rid of the racy kludges in efi_secret_unlink(), where we can use simple_unlink() instead of securityfs_remove(). Which does not require unlocking and relocking the parent, with all deadlocks that invites. - Make securityfs_remove() take the entire subtree out, turning securityfs_recursive_remove() into its alias. Makes a lot more sense for callers and fixes a mount leak, while we are at it. - Making securityfs_remove() remove the entire subtree allows for much simpler life in most of the users - efi_secret, ima_fs, evm, ipe, tmp get cleaner. I hadn't touched apparmor use of securityfs, but I suspect that it would be useful there as well" * tag 'pull-securityfs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: tpm: don't bother with removal of files in directory we'll be removing ipe: don't bother with removal of files in directory we'll be removing evm_secfs: clear securityfs interactions ima_fs: get rid of lookup-by-dentry stuff ima_fs: don't bother with removal of files in directory we'll be removing efi_secret: clean securityfs use up make securityfs_remove() remove the entire subtree fix locking in efi_secret_unlink() securityfs: pin filesystem only for objects directly in root securityfs: don't pin dentries twice, once is enough... commit 5b4c54ac49af7f486806d79e3233fc8a9363961c Author: Suchit Karunakaran Date: Sun Jul 27 13:47:54 2025 +0530 bpf: Fix various typos in verifier.c comments This patch fixes several minor typos in comments within the BPF verifier. No changes in functionality. Signed-off-by: Suchit Karunakaran Link: https://lore.kernel.org/r/20250727081754.15986-1-suchitkarunakaran@gmail.com Signed-off-by: Alexei Starovoitov commit a9f8d8adcb0905cff282804a0ef8bdc231da0ad2 Merge: 5345e64760d375 5dbb19b16ac498 Author: Alexei Starovoitov Date: Mon Jul 28 10:02:13 2025 -0700 Merge branch 'bpf-improve-64bits-bounds-refinement' Paul Chaignon says: ==================== bpf: Improve 64bits bounds refinement This patchset improves the 64bits bounds refinement when the s64 ranges crosses the sign boundary. The first patch explains the small addition to __reg64_deduce_bounds. The last one explains why we need a third round of __reg_deduce_bounds. The third patch adds a selftest with a more complete example of the impact on verification. The second and fourth patches update the existing selftests to take the new refinement into account. This patchset should reduce the number of kernel warnings hit by syzkaller due to invariant violations [1]. It was also tested with Agni [2] (and Cilium's CI for good measure). Link: https://syzkaller.appspot.com/bug?extid=c711ce17dd78e5d4fdcf [1] Link: https://github.com/bpfverif/agni [2] Changes in v4: - Fixed outdated test comment, noticed by Eduard. - Rebased. Changes in v3: - Added a 5th patch to call __reg_deduce_bounds a third time in reg_bounds_sync following tests from Eduard. - Fixed broken indentations in the first patch. Changes in v2 (all on Eduard's suggestions): - Added two tests to ensure we cover all cases of u64/s64 overlap. - Improved tests to check deduced ranges with __msg. - Improved code comments. ==================== Link: https://patch.msgid.link/cover.1753695655.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 5dbb19b16ac498b0b7f3a8a85f9d25d6d8af397d Author: Paul Chaignon Date: Mon Jul 28 11:52:00 2025 +0200 bpf: Add third round of bounds deduction Commit d7f008738171 ("bpf: try harder to deduce register bounds from different numeric domains") added a second call to __reg_deduce_bounds in reg_bounds_sync because a single call wasn't enough to converge to a fixed point in terms of register bounds. With patch "bpf: Improve bounds when s64 crosses sign boundary" from this series, Eduard noticed that calling __reg_deduce_bounds twice isn't enough anymore to converge. The first selftest added in "selftests/bpf: Test cross-sign 64bits range refinement" highlights the need for a third call to __reg_deduce_bounds. After instruction 7, reg_bounds_sync performs the following bounds deduction: reg_bounds_sync entry: scalar(smin=-655,smax=0xeffffeee,smin32=-783,smax32=-146) __update_reg_bounds: scalar(smin=-655,smax=0xeffffeee,smin32=-783,smax32=-146) __reg_deduce_bounds: __reg32_deduce_bounds: scalar(smin=-655,smax=0xeffffeee,smin32=-783,smax32=-146,umin32=0xfffffcf1,umax32=0xffffff6e) __reg64_deduce_bounds: scalar(smin=-655,smax=0xeffffeee,smin32=-783,smax32=-146,umin32=0xfffffcf1,umax32=0xffffff6e) __reg_deduce_mixed_bounds: scalar(smin=-655,smax=0xeffffeee,umin=umin32=0xfffffcf1,umax=0xffffffffffffff6e,smin32=-783,smax32=-146,umax32=0xffffff6e) __reg_deduce_bounds: __reg32_deduce_bounds: scalar(smin=-655,smax=0xeffffeee,umin=umin32=0xfffffcf1,umax=0xffffffffffffff6e,smin32=-783,smax32=-146,umax32=0xffffff6e) __reg64_deduce_bounds: scalar(smin=-655,smax=smax32=-146,umin=0xfffffffffffffd71,umax=0xffffffffffffff6e,smin32=-783,umin32=0xfffffcf1,umax32=0xffffff6e) __reg_deduce_mixed_bounds: scalar(smin=-655,smax=smax32=-146,umin=0xfffffffffffffd71,umax=0xffffffffffffff6e,smin32=-783,umin32=0xfffffcf1,umax32=0xffffff6e) __reg_bound_offset: scalar(smin=-655,smax=smax32=-146,umin=0xfffffffffffffd71,umax=0xffffffffffffff6e,smin32=-783,umin32=0xfffffcf1,umax32=0xffffff6e,var_off=(0xfffffffffffffc00; 0x3ff)) __update_reg_bounds: scalar(smin=-655,smax=smax32=-146,umin=0xfffffffffffffd71,umax=0xffffffffffffff6e,smin32=-783,umin32=0xfffffcf1,umax32=0xffffff6e,var_off=(0xfffffffffffffc00; 0x3ff)) In particular, notice how: 1. In the first call to __reg_deduce_bounds, __reg32_deduce_bounds learns new u32 bounds. 2. __reg64_deduce_bounds is unable to improve bounds at this point. 3. __reg_deduce_mixed_bounds derives new u64 bounds from the u32 bounds. 4. In the second call to __reg_deduce_bounds, __reg64_deduce_bounds improves the smax and umin bounds thanks to patch "bpf: Improve bounds when s64 crosses sign boundary" from this series. 5. Subsequent functions are unable to improve the ranges further (only tnums). Yet, a better smin32 bound could be learned from the smin bound. __reg32_deduce_bounds is able to improve smin32 from smin, but for that we need a third call to __reg_deduce_bounds. As discussed in [1], there may be a better way to organize the deduction rules to learn the same information with less calls to the same functions. Such an optimization requires further analysis and is orthogonal to the present patchset. Link: https://lore.kernel.org/bpf/aIKtSK9LjQXB8FLY@mail.gmail.com/ [1] Acked-by: Eduard Zingerman Co-developed-by: Eduard Zingerman Signed-off-by: Eduard Zingerman Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/79619d3b42e5525e0e174ed534b75879a5ba15de.1753695655.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit f96841bbf4a1ee4ed0336ba192a01278fdea6383 Author: Paul Chaignon Date: Mon Jul 28 11:51:45 2025 +0200 selftests/bpf: Test invariants on JSLT crossing sign The improvement of the u64/s64 range refinement fixed the invariant violation that was happening on this test for BPF_JSLT when crossing the sign boundary. After this patch, we have one test remaining with a known invariant violation. It's the same test as fixed here but for 32 bits ranges. Acked-by: Eduard Zingerman Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/ad046fb0016428f1a33c3b81617aabf31b51183f.1753695655.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 26e5e346a52c796190e63af1c2a80a417fda261a Author: Paul Chaignon Date: Mon Jul 28 11:51:30 2025 +0200 selftests/bpf: Test cross-sign 64bits range refinement This patch adds coverage for the new cross-sign 64bits range refinement logic. The three tests cover the cases when the u64 and s64 ranges overlap (1) in the negative portion of s64, (2) in the positive portion of s64, and (3) in both portions. The first test is a simplified version of a BPF program generated by syzkaller that caused an invariant violation [1]. It looks like syzkaller could not extract the reproducer itself (and therefore didn't report it to the mailing list), but I was able to extract it from the console logs of a crash. The principle is similar to the invariant violation described in commit 6279846b9b25 ("bpf: Forget ranges when refining tnum after JSET"): the verifier walks a dead branch, uses the condition to refine ranges, and ends up with inconsistent ranges. In this case, the dead branch is when we fallthrough on both jumps. The new refinement logic improves the bounds such that the second jump is properly detected as always-taken and the verifier doesn't end up walking a dead branch. The second and third tests are inspired by the first, but rely on condition jumps to prepare the bounds instead of ALU instructions. An R10 write is used to trigger a verifier error when the bounds can't be refined. Link: https://syzkaller.appspot.com/bug?extid=c711ce17dd78e5d4fdcf [1] Acked-by: Eduard Zingerman Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/a0e17b00dab8dabcfa6f8384e7e151186efedfdd.1753695655.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit da653de268d32a80e135c9eb960a8147c186f1bc Author: Paul Chaignon Date: Mon Jul 28 11:51:16 2025 +0200 selftests/bpf: Update reg_bound range refinement logic This patch updates the range refinement logic in the reg_bound test to match the new logic from the previous commit. Without this change, tests would fail because we end with more precise ranges than the tests expect. Acked-by: Eduard Zingerman Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/b7f6b1fbe03373cca4e1bb6a113035a6cd2b3ff7.1753695655.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 00bf8d0c6c9be0c481fc45a3f7d87c7f8812f229 Author: Paul Chaignon Date: Mon Jul 28 11:50:53 2025 +0200 bpf: Improve bounds when s64 crosses sign boundary __reg64_deduce_bounds currently improves the s64 range using the u64 range and vice versa, but only if it doesn't cross the sign boundary. This patch improves __reg64_deduce_bounds to cover the case where the s64 range crosses the sign boundary but overlaps with the u64 range on only one end. In that case, we can improve both ranges. Consider the following example, with the s64 range crossing the sign boundary: 0 U64_MAX | [xxxxxxxxxxxxxx u64 range xxxxxxxxxxxxxx] | |----------------------------|----------------------------| |xxxxx s64 range xxxxxxxxx] [xxxxxxx| 0 S64_MAX S64_MIN -1 The u64 range overlaps only with positive portion of the s64 range. We can thus derive the following new s64 and u64 ranges. 0 U64_MAX | [xxxxxx u64 range xxxxx] | |----------------------------|----------------------------| | [xxxxxx s64 range xxxxx] | 0 S64_MAX S64_MIN -1 The same logic can probably apply to the s32/u32 ranges, but this patch doesn't implement that change. In addition to the selftests, the __reg64_deduce_bounds change was also tested with Agni, the formal verification tool for the range analysis [1]. Link: https://github.com/bpfverif/agni [1] Acked-by: Eduard Zingerman Acked-by: Shung-Hsi Yu Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/933bd9ce1f36ded5559f92fdc09e5dbc823fa245.1753695655.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 07a289a031404ec583c01d8e87680d434fc62c1f Author: Quan Zhou Date: Wed Jun 11 17:51:40 2025 +0800 RISC-V: KVM: Avoid re-acquiring memslot in kvm_riscv_gstage_map() The caller has already passed in the memslot, and there are two instances `{kvm_faultin_pfn/mark_page_dirty}` of retrieving the memslot again in `kvm_riscv_gstage_map`, we can replace them with `{__kvm_faultin_pfn/mark_page_dirty_in_slot}`. Signed-off-by: Quan Zhou Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/50989f0a02790f9d7dc804c2ade6387c4e7fbdbc.1749634392.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit fce11b667022766087db8b47deb757fd3c9e8863 Author: Quan Zhou Date: Tue Jun 17 21:04:23 2025 +0800 RISC-V: KVM: Use find_vma_intersection() to search for intersecting VMAs There is already a helper function find_vma_intersection() in KVM for searching intersecting VMAs, use it directly. Signed-off-by: Quan Zhou Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/230d6c8c8b8dd83081fcfd8d83a4d17c8245fa2f.1731552790.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit 3b7270c76622893098532a94e787f8c127d5ed28 Author: Quan Zhou Date: Fri Jun 13 15:53:38 2025 +0800 RISC-V: perf/kvm: Add reporting of interrupt events For `perf kvm stat` on the RISC-V, in order to avoid the occurrence of `UNKNOWN` event names, interrupts should be reported in addition to exceptions. testing without patch: Event name Samples Sample% Time(ns) --------------------------- -------- -------- ------------ STORE_GUEST_PAGE_FAULT 1496461 53.00% 889612544 UNKNOWN 887514 31.00% 272857968 LOAD_GUEST_PAGE_FAULT 305164 10.00% 189186331 VIRTUAL_INST_FAULT 70625 2.00% 134114260 SUPERVISOR_SYSCALL 32014 1.00% 58577110 INST_GUEST_PAGE_FAULT 1 0.00% 2545 testing with patch: Event name Samples Sample% Time(ns) --------------------------- -------- -------- ------------ IRQ_S_TIMER 211271 58.00% 738298680600 EXC_STORE_GUEST_PAGE_FAULT 111279 30.00% 130725914800 EXC_LOAD_GUEST_PAGE_FAULT 22039 6.00% 25441480600 EXC_VIRTUAL_INST_FAULT 8913 2.00% 21015381600 IRQ_VS_EXT 4748 1.00% 10155464300 IRQ_S_EXT 2802 0.00% 13288775800 IRQ_S_SOFT 1998 0.00% 4254129300 Signed-off-by: Quan Zhou Reviewed-by: Andrew Jones Link: https://lore.kernel.org/r/9693132df4d0f857b8be3a75750c36b40213fcc0.1726211632.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit f55ffaf89636877c269ca28399b30d48898c62f3 Author: Quan Zhou Date: Fri Jun 13 19:29:57 2025 +0800 RISC-V: KVM: Enable ring-based dirty memory tracking Enable ring-based dirty memory tracking on riscv: - Enable CONFIG_HAVE_KVM_DIRTY_RING_ACQ_REL as riscv is weakly ordered. - Set KVM_DIRTY_LOG_PAGE_OFFSET for the ring buffer's physical page offset. - Add a check to kvm_vcpu_kvm_riscv_check_vcpu_requests for checking whether the dirty ring is soft full. To handle vCPU requests that cause exits to userspace, modified the `kvm_riscv_check_vcpu_requests` to return a value (currently only returns 0 or 1). Signed-off-by: Quan Zhou Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20e116efb1f7aff211dd8e3cf8990c5521ed5f34.1749810735.git.zhouquan@iscas.ac.cn Signed-off-by: Anup Patel commit 7826c8f37220daabf90c09fcd9a835d6763f1372 Author: Samuel Holland Date: Fri Jan 10 16:46:58 2025 -0800 RISC-V: KVM: Fix inclusion of Smnpm in the guest ISA bitmap The Smnpm extension requires special handling because the guest ISA extension maps to a different extension (Ssnpm) on the host side. commit 1851e7836212 ("RISC-V: KVM: Allow Smnpm and Ssnpm extensions for guests") missed that the vcpu->arch.isa bit is based only on the host extension, so currently both KVM_RISCV_ISA_EXT_{SMNPM,SSNPM} map to vcpu->arch.isa[RISCV_ISA_EXT_SSNPM]. This does not cause any problems for the guest, because both extensions are force-enabled anyway when the host supports Ssnpm, but prevents checking for (guest) Smnpm in the SBI FWFT logic. Redefine kvm_isa_ext_arr to look up the guest extension, since only the guest -> host mapping is unambiguous. Factor out the logic for checking for host support of an extension, so this special case only needs to be handled in one place, and be explicit about which variables hold a host vs a guest ISA extension. Fixes: 1851e7836212 ("RISC-V: KVM: Allow Smnpm and Ssnpm extensions for guests") Signed-off-by: Samuel Holland Reviewed-by: Anup Patel Link: https://lore.kernel.org/r/20250111004702.2813013-2-samuel.holland@sifive.com Signed-off-by: Anup Patel commit 3729fe8cbb4807c6156938bc0eb643d97775a80d Author: Xu Lu Date: Mon Jul 14 17:45:54 2025 +0800 RISC-V: KVM: Delegate illegal instruction fault to VS mode Delegate illegal instruction fault to VS mode by default to avoid such exceptions being trapped to HS and redirected back to VS. The delegation of illegal instruction fault is particularly important to guest applications that use vector instructions frequently. In such cases, an illegal instruction fault will be raised when guest user thread uses vector instruction the first time and then guest kernel will enable user thread to execute following vector instructions. The fw pmu event counter remains undeleted so that guest can still query illegal instruction events via sbi call. Guest will only see zero count on illegal instruction faults and know 'firmware' has delegated it. Reviewed-by: Anup Patel Signed-off-by: Xu Lu Link: https://lore.kernel.org/r/20250714094554.89151-1-luxu.kernel@bytedance.com Signed-off-by: Anup Patel commit 1f6d0eee54f7ed498a5e4ab3e12ea81bdac86b89 Author: Anup Patel Date: Wed Jun 18 17:05:32 2025 +0530 RISC-V: KVM: Pass VMID as parameter to kvm_riscv_hfence_xyz() APIs Currently, all kvm_riscv_hfence_xyz() APIs assume VMID to be the host VMID of the Guest/VM which resticts use of these APIs only for host TLB maintenance. Let's allow passing VMID as a parameter to all kvm_riscv_hfence_xyz() APIs so that they can be re-used for nested virtualization related TLB maintenance. Signed-off-by: Anup Patel Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-13-apatel@ventanamicro.com Signed-off-by: Anup Patel commit dd82e35638d67f4f459eb5324b722295c0ae3da7 Author: Anup Patel Date: Wed Jun 18 17:05:31 2025 +0530 RISC-V: KVM: Factor-out g-stage page table management The upcoming nested virtualization can share g-stage page table management with the current host g-stage implementation hence factor-out g-stage page table management as separate sources and also use "kvm_riscv_mmu_" prefix for host g-stage functions. Signed-off-by: Anup Patel Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-12-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 4c933f3a39ded0df1d727069dbe28bbb460b32ec Author: Anup Patel Date: Wed Jun 18 17:05:30 2025 +0530 RISC-V: KVM: Add vmid field to struct kvm_riscv_hfence Currently, the struct kvm_riscv_hfence does not have vmid field and various hfence processing functions always pick vmid assigned to the guest/VM. This prevents us from doing hfence operation on arbitrary vmid hence add vmid field to struct kvm_riscv_hfence and use it wherever applicable. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-11-apatel@ventanamicro.com Signed-off-by: Anup Patel commit f035b44b518c300d51d36057867d615a30d43cb8 Author: Anup Patel Date: Wed Jun 18 17:05:29 2025 +0530 RISC-V: KVM: Introduce struct kvm_gstage_mapping Introduce struct kvm_gstage_mapping which represents a g-stage mapping at a particular g-stage page table level. Also, update the kvm_riscv_gstage_map() to return the g-stage mapping upon success. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-10-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 4ecbd3eb5b1ba41db8f39d9cd4d20440e88482fa Author: Anup Patel Date: Wed Jun 18 17:05:28 2025 +0530 RISC-V: KVM: Factor-out MMU related declarations into separate headers The MMU, TLB, and VMID management for KVM RISC-V already exists as seprate sources so create separate headers along these lines. This further simplifies asm/kvm_host.h header. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-9-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 77ba6469fe1ed37a1f62bc76fb5a7b159f698aed Author: Anup Patel Date: Wed Jun 18 17:05:27 2025 +0530 RISC-V: KVM: Use ncsr_xyz() in kvm_riscv_vcpu_trap_redirect() The H-extension CSRs accessed by kvm_riscv_vcpu_trap_redirect() will trap when KVM RISC-V is running as Guest/VM hence remove these traps by using ncsr_xyz() instead of csr_xyz(). Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-8-apatel@ventanamicro.com Signed-off-by: Anup Patel commit ca539ba4bc980610b68dba345b18208c0279b2b1 Author: Anup Patel Date: Wed Jun 18 17:05:26 2025 +0530 RISC-V: KVM: Implement kvm_arch_flush_remote_tlbs_range() The kvm_arch_flush_remote_tlbs_range() expected by KVM core can be easily implemented for RISC-V using kvm_riscv_hfence_gvma_vmid_gpa() hence provide it. Also with kvm_arch_flush_remote_tlbs_range() available for RISC-V, the mmu_wp_memory_region() can happily use kvm_flush_remote_tlbs_memslot() instead of kvm_flush_remote_tlbs(). Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-7-apatel@ventanamicro.com Signed-off-by: Anup Patel commit eaa98ba20be088eeb252061f216c299442ba5a69 Author: Anup Patel Date: Wed Jun 18 17:05:25 2025 +0530 RISC-V: KVM: Don't flush TLB when PTE is unchanged The gstage_set_pte() and gstage_op_pte() should flush TLB only when a leaf PTE changes so that unnecessary TLB flushes can be avoided. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-6-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 7584eb611e8ef22aca3b801f7fd8529892b70901 Author: Anup Patel Date: Wed Jun 18 17:05:24 2025 +0530 RISC-V: KVM: Replace KVM_REQ_HFENCE_GVMA_VMID_ALL with KVM_REQ_TLB_FLUSH The KVM_REQ_HFENCE_GVMA_VMID_ALL is same as KVM_REQ_TLB_FLUSH so to avoid confusion let's replace KVM_REQ_HFENCE_GVMA_VMID_ALL with KVM_REQ_TLB_FLUSH. Also, rename kvm_riscv_hfence_gvma_vmid_all_process() to kvm_riscv_tlb_flush_process(). Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-5-apatel@ventanamicro.com Signed-off-by: Anup Patel commit b79bf2025dbc53e0cf834690fc90f11cf801657b Author: Anup Patel Date: Wed Jun 18 17:05:23 2025 +0530 RISC-V: KVM: Rename and move kvm_riscv_local_tlb_sanitize() The kvm_riscv_local_tlb_sanitize() deals with sanitizing current VMID related TLB mappings when a VCPU is moved from one host CPU to another. Let's move kvm_riscv_local_tlb_sanitize() to VMID management sources and rename it to kvm_riscv_gstage_vmid_sanitize(). Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-4-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 7c67de21ee74f007053dfe018afb5c0f5607dd1a Author: Anup Patel Date: Wed Jun 18 17:05:22 2025 +0530 RISC-V: KVM: Drop the return value of kvm_riscv_vcpu_aia_init() The kvm_riscv_vcpu_aia_init() does not return any failure so drop the return value which is always zero. Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-3-apatel@ventanamicro.com Signed-off-by: Anup Patel commit 4a50578a5868f94bb9a8f7bab2ff6ed9122aa1d7 Author: Anup Patel Date: Wed Jun 18 17:05:21 2025 +0530 RISC-V: KVM: Check kvm_riscv_vcpu_alloc_vector_context() return value The kvm_riscv_vcpu_alloc_vector_context() does return an error code upon failure so don't ignore this in kvm_arch_vcpu_create(). Signed-off-by: Anup Patel Reviewed-by: Atish Patra Tested-by: Atish Patra Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/20250618113532.471448-2-apatel@ventanamicro.com Signed-off-by: Anup Patel commit ddf52f12ef500d9f2a5e325e0c86449f594abb25 Merge: 1959e18cc0b842 350db61fbeb940 Author: Linus Torvalds Date: Mon Jul 28 09:56:09 2025 -0700 Merge tag 'pull-rpc_pipefs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull rpc_pipefs updates from Al Viro: "Massage rpc_pipefs to use saner primitives and clean up the APIs provided to the rest of the kernel" * tag 'pull-rpc_pipefs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: rpc_create_client_dir(): return 0 or -E... rpc_create_client_dir(): don't bother with rpc_populate() rpc_new_dir(): the last argument is always NULL rpc_pipe: expand the calls of rpc_mkdir_populate() rpc_gssd_dummy_populate(): don't bother with rpc_populate() rpc_mkpipe_dentry(): switch to simple_start_creating() rpc_pipe: saner primitive for creating regular files rpc_pipe: saner primitive for creating subdirectories rpc_pipe: don't overdo directory locking rpc_mkpipe_dentry(): saner calling conventions rpc_unlink(): saner calling conventions rpc_populate(): lift cleanup into callers rpc_unlink(): use simple_recursive_removal() rpc_{rmdir_,}depopulate(): use simple_recursive_removal() instead rpc_pipe: clean failure exits in fill_super new helper: simple_start_creating() commit 1959e18cc0b842c53836265548e99be8694a11a7 Merge: 11fe69fbd56f63 bad356bb50e641 Author: Linus Torvalds Date: Mon Jul 28 09:43:51 2025 -0700 Merge tag 'pull-simple_recursive_removal' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull simple_recursive_removal() update from Al Viro: "Removing subtrees of kernel filesystems is done in quite a few places; unfortunately, it's easy to get wrong. A number of open-coded attempts are out there, with varying amount of bogosities. simple_recursive_removal() had been introduced for doing that with all precautions needed; it does an equivalent of rm -rf, with sufficient locking, eviction of anything mounted on top of the subtree, etc. This series converts a bunch of open-coded instances to using that" * tag 'pull-simple_recursive_removal' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: functionfs, gadgetfs: use simple_recursive_removal() kill binderfs_remove_file() fuse_ctl: use simple_recursive_removal() pstore: switch to locked_recursive_removal() binfmt_misc: switch to locked_recursive_removal() spufs: switch to locked_recursive_removal() add locked_recursive_removal() better lockdep annotations for simple_recursive_removal() simple_recursive_removal(): saner interaction with fsnotify commit 1005a3ca28e90c7a64fa43023f866b960a60f791 Author: Chao Yu Date: Thu Jul 24 16:01:44 2025 +0800 f2fs: fix to trigger foreground gc during f2fs_map_blocks() in lfs mode w/ "mode=lfs" mount option, generic/299 will cause system panic as below: ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:2835! Call Trace: f2fs_allocate_data_block+0x6f4/0xc50 f2fs_map_blocks+0x970/0x1550 f2fs_iomap_begin+0xb2/0x1e0 iomap_iter+0x1d6/0x430 __iomap_dio_rw+0x208/0x9a0 f2fs_file_write_iter+0x6b3/0xfa0 aio_write+0x15d/0x2e0 io_submit_one+0x55e/0xab0 __x64_sys_io_submit+0xa5/0x230 do_syscall_64+0x84/0x2f0 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0010:new_curseg+0x70f/0x720 The root cause of we run out-of-space is: in f2fs_map_blocks(), f2fs may trigger foreground gc only if it allocates any physical block, it will be a little bit later when there is multiple threads writing data w/ aio/dio/bufio method in parallel, since we always use OPU in lfs mode, so f2fs_map_blocks() does block allocations aggressively. In order to fix this issue, let's give a chance to trigger foreground gc in prior to block allocation in f2fs_map_blocks(). Fixes: 36abef4e796d ("f2fs: introduce mode=lfs mount option") Cc: Daeho Jeong Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e194e140ab7de2ce2782e64b9e086a43ca6ff4f2 Author: Chao Yu Date: Thu Jul 24 16:01:43 2025 +0800 f2fs: fix to calculate dirty data during has_not_enough_free_secs() In lfs mode, dirty data needs OPU, we'd better calculate lower_p and upper_p w/ them during has_not_enough_free_secs(), otherwise we may encounter out-of-space issue due to we missed to reclaim enough free section w/ foreground gc. Fixes: 36abef4e796d ("f2fs: introduce mode=lfs mount option") Cc: Daeho Jeong Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6840faddb65683b4e7bd8196f177b038a1e19faf Author: Chao Yu Date: Thu Jul 24 16:01:42 2025 +0800 f2fs: fix to update upper_p in __get_secs_required() correctly Commit 1acd73edbbfe ("f2fs: fix to account dirty data in __get_secs_required()") missed to calculate upper_p w/ data_secs, fix it. Fixes: 1acd73edbbfe ("f2fs: fix to account dirty data in __get_secs_required()") Cc: Daeho Jeong Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 40aa9e1223fd38e65ac72373e642c7638a3b4752 Author: wangzijie Date: Mon Jul 28 13:02:36 2025 +0800 f2fs: directly add newly allocated pre-dirty nat entry to dirty set list When we need to alloc nat entry and set it dirty, we can directly add it to dirty set list(or initialize its list_head for new_ne) instead of adding it to clean list and make a move. Introduce init_dirty flag to do it. Signed-off-by: wangzijie Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 0349b7f95c806ea30d558c7fec9502f4470fb1b6 Author: wangzijie Date: Mon Jul 28 13:02:35 2025 +0800 f2fs: avoid redundant clean nat entry move in lru list __lookup_nat_cache follows LRU manner to move clean nat entry, when nat entries are going to be dirty, no need to move them to tail of lru list. Introduce a parameter 'for_dirty' to avoid it. Signed-off-by: wangzijie Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 11fe69fbd56f63ad0749303d2e014ef1c17142a6 Merge: 126e5754e942b1 a509e7cf622bc7 Author: Linus Torvalds Date: Mon Jul 28 09:17:57 2025 -0700 Merge tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull dentry d_flags updates from Al Viro: "The current exclusion rules for dentry->d_flags stores are rather unpleasant. The basic rules are simple: - stores to dentry->d_flags are OK under dentry->d_lock - stores to dentry->d_flags are OK in the dentry constructor, before becomes potentially visible to other threads Unfortunately, there's a couple of exceptions to that, and that's where the headache comes from. The main PITA comes from d_set_d_op(); that primitive sets ->d_op of dentry and adjusts the flags that correspond to presence of individual methods. It's very easy to misuse; existing uses _are_ safe, but proof of correctness is brittle. Use in __d_alloc() is safe (we are within a constructor), but we might as well precalculate the initial value of 'd_flags' when we set the default ->d_op for given superblock and set 'd_flags' directly instead of messing with that helper. The reasons why other uses are safe are bloody convoluted; I'm not going to reproduce it here. See [1] for gory details, if you care. The critical part is using d_set_d_op() only just prior to d_splice_alias(), which makes a combination of d_splice_alias() with setting ->d_op, etc a natural replacement primitive. Better yet, if we go that way, it's easy to take setting ->d_op and modifying 'd_flags' under ->d_lock, which eliminates the headache as far as 'd_flags' exclusion rules are concerned. Other exceptions are minor and easy to deal with. What this series does: - d_set_d_op() is no longer available; instead a new primitive (d_splice_alias_ops()) is provided, equivalent to combination of d_set_d_op() and d_splice_alias(). - new field of struct super_block - 's_d_flags'. This sets the default value of 'd_flags' to be used when allocating dentries on this filesystem. - new primitive for setting 's_d_op': set_default_d_op(). This replaces stores to 's_d_op' at mount time. All in-tree filesystems converted; out-of-tree ones will get caught by the compiler ('s_d_op' is renamed, so stores to it will be caught). 's_d_flags' is set by the same primitive to match the 's_d_op'. - a lot of filesystems had sb->s_d_op->d_delete equal to always_delete_dentry; that is equivalent to setting DCACHE_DONTCACHE in 'd_flags', so such filesystems can bloody well set that bit in 's_d_flags' and drop 'd_delete()' from dentry_operations. In quite a few cases that results in empty dentry_operations, which means that we can get rid of those. - kill simple_dentry_operations - not needed anymore - massage d_alloc_parallel() to get rid of the other exception wrt 'd_flags' stores - we can set DCACHE_PAR_LOOKUP as soon as we allocate the new dentry; no need to delay that until we commit to using the sucker. As the result, 'd_flags' stores are all either under ->d_lock or done before the dentry becomes visible in any shared data structures" Link: https://lore.kernel.org/all/20250224010624.GT1977892@ZenIV/ [1] * tag 'pull-dcache' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (21 commits) configfs: use DCACHE_DONTCACHE debugfs: use DCACHE_DONTCACHE efivarfs: use DCACHE_DONTCACHE instead of always_delete_dentry() 9p: don't bother with always_delete_dentry ramfs, hugetlbfs, mqueue: set DCACHE_DONTCACHE kill simple_dentry_operations devpts, sunrpc, hostfs: don't bother with ->d_op shmem: no dentry retention past the refcount reaching zero d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier make d_set_d_op() static simple_lookup(): just set DCACHE_DONTCACHE tracefs: Add d_delete to remove negative dentries set_default_d_op(): calculate the matching value for ->d_flags correct the set of flags forbidden at d_set_d_op() time split d_flags calculation out of d_set_d_op() new helper: set_default_d_op() fuse: no need for special dentry_operations for root dentry switch procfs from d_set_d_op() to d_splice_alias_ops() new helper: d_splice_alias_ops() procfs: kill ->proc_dops ... commit 0d4c4d4ea443babab6ec1a79f481260963fc969a Author: Amir Goldstein Date: Tue Jul 8 16:36:41 2025 +0200 fsnotify: optimize FMODE_NONOTIFY_PERM for the common cases The most unlikely watched permission event is FAN_ACCESS_PERM, because at the time that it was introduced there were no evictable ignore mark, so subscribing to FAN_ACCESS_PERM would have incured a very high overhead. Yet, when we set the fmode to FMODE_NOTIFY_HSM(), we never skip trying to send FAN_ACCESS_PERM, which is almost always a waste of cycles. We got to this logic because of bundling FAN_OPEN*_PERM and FAN_ACCESS_PERM in the same category and because FAN_OPEN_PERM is a commonly used event. By open coding fsnotify_open_perm() in fsnotify_open_perm_and_set_mode(), we no longer need to regard FAN_OPEN*_PERM when calculating fmode. This leaves the case of having pre-content events and not having any other permission event in the object masks a more likely case than the other way around. Rework the fmode macros and code so that their meaning now refers only to hooks on an already open file: - FMODE_NOTIFY_NONE() skip all events - FMODE_NOTIFY_ACCESS_PERM() send all permission events including FAN_ACCESS_PERM - FMODE_NOTIFY_HSM() send pre-content permission events Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara Link: https://patch.msgid.link/20250708143641.418603-3-amir73il@gmail.com commit 08da98e1b2f76cdbacf84b9affaa75960dbce515 Author: Amir Goldstein Date: Tue Jul 8 16:36:40 2025 +0200 fsnotify: merge file_set_fsnotify_mode_from_watchers() with open perm hook Create helper fsnotify_open_perm_and_set_mode() that moves the fsnotify_open_perm() hook into file_set_fsnotify_mode_from_watchers(). This will allow some more optimizations. Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara Link: https://patch.msgid.link/20250708143641.418603-2-amir73il@gmail.com commit 3193e8942fc7f70ba3c872a988a0c15f98818bd2 Author: Brahmajit Das Date: Mon Jun 30 13:02:41 2025 +0200 samples: fix building fs-monitor on musl systems samples/fanotify/fs-monitor.c:22:9: error: unknown type name '__s32' 22 | __s32 error; | ^~~~~ samples/fanotify/fs-monitor.c:23:9: error: unknown type name '__u32' 23 | __u32 error_count; | ^~~~~ samples/fanotify/fs-monitor.c: In function 'handle_notifications': samples/fanotify/fs-monitor.c:98:50: error: 'fsid_t' has no member named 'val'; did you mean '__val'? 98 | fid->fsid.val[0], fid->fsid.val[1]); | ^~~ | __val samples/fanotify/fs-monitor.c:98:68: error: 'fsid_t' has no member named 'val'; did you mean '__val'? 98 | fid->fsid.val[0], fid->fsid.val[1]); | ^~~ | __val This is due to sys/fanotify.h on musl does not include linux/fanotify.h[0] unlike glibc which includes it. This also results in fsid not being of type __kernel_fsid_t, rather the libc's definition of it which does not have val, but instead __val. [0]: https://git.musl-libc.org/cgit/musl/tree/include/sys/fanotify.h Signed-off-by: Brahmajit Das Signed-off-by: Jan Kara Link: https://patch.msgid.link/20250630103011.27484-1-listout@listout.xyz commit 126e5754e942b1a007246561fc61b745747cedcd Merge: ce3f5bb7504ca8 2560014ec150fd Author: Linus Torvalds Date: Mon Jul 28 09:03:37 2025 -0700 Merge tag 'pull-headers_param' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs Pull asm/param cleanup from Al Viro: "This massages asm/param.h to simpler and more uniform shape: - all arch/*/include/uapi/asm/param.h are either generated includes of or a #define or two followed by such include - no arch/*/include/asm/param.h anywhere, generated or not - include resolves to arch/*/include/uapi/asm/param.h of the architecture in question (or that of host in case of uml) - include/asm-generic/param.h pulls uapi/asm-generic/param.h and deals with USER_HZ, CLOCKS_PER_SEC and with HZ redefinition after that" * tag 'pull-headers_param' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: loongarch, um, xtensa: get rid of generated arch/$ARCH/include/asm/param.h alpha: regularize the situation with asm/param.h xtensa: get rid uapi/asm/param.h commit 99765233ab42bf7a4950377ad7894dce8a5c0e60 Author: Benjamin Coddington Date: Wed Jul 9 21:47:43 2025 -0400 NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY If the NFS client is doing writeback from a workqueue context, avoid using __GFP_NORETRY for allocations if the task has set PF_MEMALLOC_NOIO or PF_MEMALLOC_NOFS. The combination of these flags makes memory allocation failures much more likely. We've seen those allocation failures show up when the loopback driver is doing writeback from a workqueue to a file on NFS, where memory allocation failure results in errors or corruption within the loopback device's filesystem. Suggested-by: Trond Myklebust Fixes: 0bae835b63c5 ("NFS: Avoid writeback threads getting stuck in mempool_alloc()") Signed-off-by: Benjamin Coddington Reviewed-by: Laurence Oberman Tested-by: Laurence Oberman Reviewed-by: Jeff Layton Link: https://lore.kernel.org/r/f83ac1155a4bc670f2663959a7a068571e06afd9.1752111622.git.bcodding@redhat.com Signed-off-by: Trond Myklebust commit ce3f5bb7504ca802efa710280a4601a06545bd2e Merge: a90f1b6ad6649d e339967eecf130 Author: Linus Torvalds Date: Mon Jul 28 09:01:09 2025 -0700 Merge tag 'nfsd-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux Pull nfsd updates from Chuck Lever: "NFSD is finally able to offer write delegations to clients that open files with O_WRONLY, thanks to patches from Dai Ngo. We're expecting this to accelerate a few interesting corner cases. The cap on the number of operations per NFSv4 COMPOUND has been lifted. Now, clients that send COMPOUNDs containing dozens of operations (for example, a long stream of LOOKUP operations to walk a pathname in a single round trip) will no longer be rejected. This release re-enables the ability for NFSD to perform NFSv4.2 COPY operations asynchronously. This feature has been disabled to mitigate the risk of denial-of-service when too many such requests arrive. Many thanks to the contributors, reviewers, testers, and bug reporters who participated during the v6.17 development cycle" * tag 'nfsd-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/cel/linux: (32 commits) nfsd: Drop dprintk in blocklayout xdr functions sunrpc: make svc_tcp_sendmsg() take a signed sentp pointer sunrpc: rearrange struct svc_rqst for fewer cachelines sunrpc: return better error in svcauth_gss_accept() on alloc failure sunrpc: reset rq_accept_statp when starting a new RPC sunrpc: remove SVC_SYSERR sunrpc: fix handling of unknown auth status codes NFSD: Simplify struct knfsd_fh NFSD: Access a knfsd_fh's fsid by pointer Revert "NFSD: Force all NFSv4.2 COPY requests to be synchronous" NFSD: Avoid multiple -Wflex-array-member-not-at-end warnings NFSD: Use vfs_iocb_iter_write() NFSD: Use vfs_iocb_iter_read() NFSD: Clean up kdoc for nfsd_open_local_fh() NFSD: Clean up kdoc for nfsd_file_put_local() NFSD: Remove definition for trace_nfsd_ctl_maxconn NFSD: Remove definition for trace_nfsd_file_gc_recent NFSD: Remove definitions for unused trace_nfsd_file_lru trace points NFSD: Remove definition for trace_nfsd_file_unhash_and_queue nfsd: Use correct error code when decoding extents ... commit a90f1b6ad6649d553c9d76f50a42e4ba5783164b Merge: f3f5edc5e41e03 deb016c1669002 Author: Linus Torvalds Date: Mon Jul 28 08:58:58 2025 -0700 Merge tag 'gfs2-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2 Pull gfs2 updates from Andreas Gruenbacher: - Prevent cluster nodes from trying to recover their own filesystems during a withdraw - Add two missing migrate_folio aops and an additional exhash directory consistency check (both triggered by syzbot bug reports) - Sanitize how dlm results are processed and clean up a few quirks in the glock code - Minor stuff: Get rid of the GIF_ALLOC_FAILED flag; use SECTOR_SIZE and SECTOR_SHIFT * tag 'gfs2-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2: gfs2: No more self recovery gfs2: Validate i_depth for exhash directories gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops gfs2: a minor finish_xmote cleanup gfs2: simplify finish_xmote gfs2: sanitize the gdlm_ast -> finish_xmote interface gfs2: Minor do_xmote cancelation fix gfs2: Remove GIF_ALLOC_FAILED flag gfs2: Use SECTOR_SIZE and SECTOR_SHIFT commit f3f5edc5e41e038cf66d124a4cbacf6ff0983513 Merge: 76a9701325d39d ded74fddcaf685 Author: Linus Torvalds Date: Mon Jul 28 08:55:53 2025 -0700 Merge tag 'xfs-merge-6.17' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Carlos Maiolino: "This doesn't contain any new features. It mostly is a collection of clean ups and code refactoring that I preferred to postpone to the merge window. It includes removal of several unused tracepoints, refactoring key comparing routines under the B-Trees management and cleanup of xfs journaling code" * tag 'xfs-merge-6.17' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (44 commits) xfs: don't use a xfs_log_iovec for ri_buf in log recovery xfs: don't use a xfs_log_iovec for attr_item names and values xfs: use better names for size members in xfs_log_vec xfs: cleanup the ordered item logic in xlog_cil_insert_format_items xfs: don't pass the old lv to xfs_cil_prepare_item xfs: remove unused trace event xfs_reflink_cow_enospc xfs: remove unused trace event xfs_discard_rtrelax xfs: remove unused trace event xfs_log_cil_return xfs: remove unused trace event xfs_dqreclaim_dirty fs/xfs: replace strncpy with memtostr_pad() xfs: Remove unused label in xfs_dax_notify_dev_failure xfs: improve the comments in xfs_select_zone_nowait xfs: improve the comments in xfs_max_open_zones xfs: stop passing an inode to the zone space reservation helpers xfs: rename oz_write_pointer to oz_allocated xfs: use a uint32_t to cache i_used_blocks in xfs_init_zone xfs: improve the xg_active_ref check in xfs_group_free xfs: remove the xlog_ticket_t typedef xfs: remove xrep_trans_{alloc,cancel}_hook_dummy xfs: return the allocated transaction from xchk_trans_alloc_empty ... commit 9acb237deff7667b0f6b10fe6b1b70c4429ea049 Author: Olga Kornievskaia Date: Tue Jul 22 16:56:41 2025 -0400 NFSv4.2: another fix for listxattr Currently, when the server supports NFS4.1 security labels then security.selinux label in included twice. Instead, only add it when the server doesn't possess security label support. Fixes: 243fea134633 ("NFSv4.2: fix listxattr to return selinux security label") Signed-off-by: Olga Kornievskaia Link: https://lore.kernel.org/r/20250722205641.79394-1-okorniev@redhat.com Signed-off-by: Trond Myklebust commit 76a9701325d39d8602695b19c49a9d0828c897ca Merge: a11b4fa602ed3b df0ce6cefa453d Author: Linus Torvalds Date: Mon Jul 28 08:49:32 2025 -0700 Merge tag 'erofs-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs Pull erofs updates from Gao Xiang: "We now support metadata compression. It can be useful for embedded use cases or archiving a large number of small files. Additionally, readdir performance has been improved by enabling readahead (note that it was already common practice for ext3/4 non-dx and f2fs directories). We may consider further improvements later to align with ext4's s_inode_readahead_blks behavior for slow devices too. The remaining commits are minor. Summary: - Add support for metadata compression - Enable readahead for directories to improve readdir performance - Minor fixes and cleanups" * tag 'erofs-for-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs: erofs: support to readahead dirent blocks in erofs_readdir() erofs: implement metadata compression erofs: add on-disk definition for metadata compression erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y erofs: remove ENOATTR definition erofs: refine erofs_iomap_begin() erofs: unify meta buffers in z_erofs_fill_inode() erofs: remove need_kmap in erofs_read_metabuf() erofs: do sanity check on m->type in z_erofs_load_compact_lcluster() erofs: get rid of {get,put}_page() for ztailpacking data commit a11b4fa602ed3b744aa075f34bee82c12aa3553a Merge: f92b71ffca8c7e a49f0abd895904 Author: Linus Torvalds Date: Mon Jul 28 08:46:55 2025 -0700 Merge tag 'ntfs3_for_6.17' of https://github.com/Paragon-Software-Group/linux-ntfs3 Pull ntfs3 updates from Konstantin Komarov: "Added: - sanity check for file name - mark live inode as bad and avoid any operations Fixed: - handling of symlinks created in windows - creation of symlinks for relative path Changed: - cancel setting inode as bad after removing name fails - revert 'replace inode_trylock with inode_lock'" * tag 'ntfs3_for_6.17' of https://github.com/Paragon-Software-Group/linux-ntfs3: Revert "fs/ntfs3: Replace inode_trylock with inode_lock" fs/ntfs3: Exclude call make_bad_inode for live nodes. fs/ntfs3: cancle set bad inode after removing name fails fs/ntfs3: Add sanity check for file name fs/ntfs3: correctly create symlink for relative path fs/ntfs3: fix symlinks cannot be handled correctly commit f92b71ffca8c7e45e194aecc85e31bd11582f4d2 Merge: 038d61fd642278 005b0a0c24e162 Author: Linus Torvalds Date: Mon Jul 28 08:42:29 2025 -0700 Merge tag 'for-6.17-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux Pull btrfs updates from David Sterba: "A number of usability and feature updates, scattered performance improvements and fixes. Highlight of the core changes is getting closer to enabling large folios (now behind a config option). User visible changes: - update defrag ioctl, add new flag to request no compression on existing extents - restrict writes to block devices after mount - in experimental config, enable large folios for data, almost complete but not widely tested - add stats tracking duration of critical section in transaction commit to /sys/fs/btrfs/FSID/commit_stats Performance improvements: - caching of lookup results of free space bitmap (20% runtime improvement on an empty file creation benchmark) - accessors to metadata (b-tree items) simplified and optimized, minor improvement in metadata-heavy workloads - readahead on compressed data improves sequential read - the xarray for extent buffers is indexed by denser keys, leading to better packing of the nodes (50-70% reduction of leaf nodes) Notable fixes: - stricter compression mount option parsing - send properly emits fallocate command for file holes when protocol v2 is used - fix overallocation of chunks with mount option 'ssd_spread', due to interaction with size classes not finding the right chunk (workaround: manual reclaim by 'usage' balance filter) - various quota enable/disable races with rescan, more verbose notifications about inconsistent state - populate otime in tree-log during log replay - handle ENOSPC when NOCOW file is used with mmap() Core: - large data folios enabled in experimental config - improved error handling, transaction abort call sites - in zoned mode, allocate reloc block group on mount to make sure there's always one available for zone reclaim under heavy load - rework device opening, they're always open as read-only and delayed until the super block is created, allowing the restricted writes after mount - preparatory work for adding blk_holder_ops, allowing device freeze/thaw in the future Cleanups, refactoring: - type and naming unifications (int/bool, return variables) - rb-tree helper refactoring and simplifications - reorder memory allocations to less critical places - RCU string (used for device name) refactoring and API removal - replace all remaining use of strcpy()" * tag 'for-6.17-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (209 commits) btrfs: send: use fallocate for hole punching with send stream v2 btrfs: unfold transaction aborts when writing dirty block groups btrfs: use saner variable type and name to indicate extrefs at add_inode_ref() btrfs: don't skip remaining extrefs if dir not found during log replay btrfs: don't ignore inode missing when replaying log tree btrfs: enable large data folios for data reloc inode btrfs: output more info when btrfs_subpage_assert() failed btrfs: reloc: unconditionally invalidate the page cache for each cluster btrfs: defrag: add flag to force no-compression btrfs: fix ssd_spread overallocation btrfs: zoned: requeue to unused block group list if zone finish failed btrfs: zoned: do not remove unwritten non-data block group btrfs: remove btrfs_clear_extent_bits() btrfs: use cached state when falling back from NOCoW write to CoW write btrfs: set EXTENT_NORESERVE before range unlock in btrfs_truncate_block() btrfs: don't print relocation messages from auto reclaim btrfs: remove redundant auto reclaim log message btrfs: make btrfs_check_nocow_lock() check more than one extent btrfs: assert we can NOCOW the range in btrfs_truncate_block() btrfs: update function comment for btrfs_check_nocow_lock() ... commit 18ec25dd0e97653cdb576bb1750c31acf2513ea7 Author: Oliver Upton Date: Mon Jul 28 08:26:03 2025 -0700 KVM: arm64: selftests: Add FEAT_RAS EL2 registers to get-reg-list VDISR_EL2 and VSESR_EL2 are now visible to userspace for nested VMs. Add them to get-reg-list. Link: https://lore.kernel.org/r/20250728152603.2823699-1-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 0d46e324c0b6a36af50b08524177e0d598239b5c Merge: a7f49a9bf45012 eed9b14209073c Author: Oliver Upton Date: Mon Jul 28 08:11:34 2025 -0700 Merge branch 'kvm-arm64/vgic-v4-ctl' into kvmarm/next * kvm-arm64/vgic-v4-ctl: : Userspace control of nASSGIcap, courtesy of Raghavendra Rao Ananta : : Allow userspace to decide if support for SGIs without an active state is : advertised to the guest, allowing VMs from GICv3-only hardware to be : migrated to to GICv4.1 capable machines. Documentation: KVM: arm64: Describe VGICv3 registers writable pre-init KVM: arm64: selftests: Add test for nASSGIcap attribute KVM: arm64: vgic-v3: Allow userspace to write GICD_TYPER2.nASSGIcap KVM: arm64: vgic-v3: Allow access to GICD_IIDR prior to initialization KVM: arm64: vgic-v3: Consolidate MAINT_IRQ handling KVM: arm64: Disambiguate support for vSGIs v. vLPIs Signed-off-by: Oliver Upton commit 2c78e74493d33b002312296fbab1d688bfd0f76f Author: Nicolin Chen Date: Thu Jul 24 15:10:02 2025 -0700 iommu/arm-smmu-v3: Replace vsmmu_size/type with get_viommu_size It's more flexible to have a get_viommu_size op. Replace static vsmmu_size and vsmmu_type with that. Link: https://patch.msgid.link/r/20250724221002.1883034-3-nicolinc@nvidia.com Suggested-by: Will Deacon Acked-by: Will Deacon Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 5a1c7590939c3c5678b782d29f0ccfd1323a8d92 Author: Nicolin Chen Date: Thu Jul 24 15:10:01 2025 -0700 iommu/arm-smmu-v3: Do not bother impl_ops if IOMMU_VIOMMU_TYPE_ARM_SMMUV3 When viommu type is IOMMU_VIOMMU_TYPE_ARM_SMMUV3, always return or init the standard struct arm_vsmmu, instead of going through impl_ops that must have its own viommu type than the standard IOMMU_VIOMMU_TYPE_ARM_SMMUV3. Given that arm_vsmmu_init() is called after arm_smmu_get_viommu_size(), any unsupported viommu->type must be a corruption. And it must be a driver bug that its vsmmu_size and vsmmu_init ops aren't paired. Warn these two cases. Link: https://patch.msgid.link/r/20250724221002.1883034-2-nicolinc@nvidia.com Suggested-by: Will Deacon Acked-by: Will Deacon Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit a7f49a9bf45012704c9a5a49abfd16607edd5d97 Merge: d9b9fa2c328385 3435bd79ec1336 Author: Oliver Upton Date: Mon Jul 28 08:06:27 2025 -0700 Merge branch 'kvm-arm64/el2-reg-visibility' into kvmarm/next * kvm-arm64/el2-reg-visibility: : Fixes to EL2 register visibility, courtesy of Marc Zyngier : : - Expose EL2 VGICv3 registers via the VGIC attributes accessor, not the : KVM_{GET,SET}_ONE_REG ioctls : : - Condition visibility of FGT registers on the presence of FEAT_FGT in : the VM KVM: arm64: selftest: vgic-v3: Add basic GICv3 sysreg userspace access test KVM: arm64: Enforce the sorting of the GICv3 system register table KVM: arm64: Clarify the check for reset callback in check_sysreg_table() KVM: arm64: vgic-v3: Fix ordering of ICH_HCR_EL2 KVM: arm64: Document registers exposed via KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS KVM: arm64: selftests: get-reg-list: Add base EL2 registers KVM: arm64: selftests: get-reg-list: Simplify feature dependency KVM: arm64: Advertise FGT2 registers to userspace KVM: arm64: Condition FGT registers on feature availability KVM: arm64: Expose GICv3 EL2 registers via KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS KVM: arm64: Let GICv3 save/restore honor visibility attribute KVM: arm64: Define helper for ICH_VTR_EL2 KVM: arm64: Define constant value for ICC_SRE_EL2 KVM: arm64: Don't advertise ICH_*_EL2 registers through GET_ONE_REG KVM: arm64: Make RVBAR_EL2 accesses UNDEF Signed-off-by: Oliver Upton commit d9b9fa2c3283850d2d051222abdbe77796c91c2e Merge: 0a2c9d808af2cb 3096d238ec490f Author: Oliver Upton Date: Mon Jul 28 08:03:03 2025 -0700 Merge branch 'kvm-arm64/config-masks' into kvmarm/next * kvm-arm64/config-masks: : More config-driven mask computation, courtesy of Marc Zyngier : : Converts more system registers to the config-driven computation of RESx : masks based on the advertised feature set KVM: arm64: Tighten the definition of FEAT_PMUv3p9 KVM: arm64: Convert MDCR_EL2 to config-driven sanitisation KVM: arm64: Convert SCTLR_EL1 to config-driven sanitisation KVM: arm64: Convert TCR2_EL2 to config-driven sanitisation arm64: sysreg: Add THE/ASID2 controls to TCR2_ELx Signed-off-by: Oliver Upton commit 28f09823de9292c6f91171f0627bd0b360b78a75 Author: Paulo Alcantara Date: Sat Jul 26 13:47:51 2025 -0300 smb: client: get rid of kstrdup() when parsing iocharset mount option Steal string reference from @param->string rather than duplicating it. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Signed-off-by: Steve French commit 60c9511253d508bbc9df8d988f38ce2a633ead86 Author: Paulo Alcantara Date: Sat Jul 26 13:45:43 2025 -0300 smb: client: get rid of kstrdup() when parsing domain mount option Steal string reference from @param->string rather than duplicating it. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Signed-off-by: Steve French commit 1b6075ebd34da9c79243416f4c24d418fa490059 Author: Paulo Alcantara Date: Sat Jul 26 13:40:28 2025 -0300 smb: client: get rid of kstrdup() when parsing pass2 mount option Steal string reference from @param->string rather than duplicating it. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Signed-off-by: Steve French commit 524fa5bcc384491140323f12bf12b6e3e0f5b84d Author: Paulo Alcantara Date: Sat Jul 26 13:38:52 2025 -0300 smb: client: get rid of kstrdup() when parsing pass mount option Steal string reference from @param->string rather than duplicating it. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Signed-off-by: Steve French commit e5acab35feffb6f1b7f4ee0d146666a241024804 Author: Paulo Alcantara Date: Sat Jul 26 13:36:51 2025 -0300 smb: client: get rid of kstrdup() when parsing user mount option Steal string reference from @param->string rather than duplicating it. Signed-off-by: Paulo Alcantara (Red Hat) Reviewed-by: David Howells Signed-off-by: Steve French commit 3cfb9c1a7db091f9030826b897d07ddce1591e7f Author: Nam Cao Date: Sun Jul 27 19:31:13 2025 +0200 rv: Fix wrong type cast in reactors_show() and monitor_reactor_show() Argument 'p' of reactors_show() and monitor_reactor_show() is not a pointer to struct rv_reactor, it is actually a pointer to the list_head inside struct rv_reactor. Therefore it's wrong to cast 'p' to struct rv_reactor *. This wrong type cast has been there since the beginning. But it still worked because the list_head was the first field in struct rv_reactor_def. This is no longer true since commit 3d3c376118b5 ("rv: Merge struct rv_reactor_def into struct rv_reactor") moved the list_head, and this wrong type cast became a functional problem. Properly use container_of() instead. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Gabriele Monaco Link: https://lore.kernel.org/b4febbd6844311209e4c8768b65d508b81bd8c9b.1753625621.git.namcao@linutronix.de Fixes: 3d3c376118b5 ("rv: Merge struct rv_reactor_def into struct rv_reactor") Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit e82aea50fe0600da176b2e50a6213f6057b719f9 Author: Nam Cao Date: Sun Jul 27 19:31:12 2025 +0200 rv: Fix wrong type cast in monitors_show() Argument 'p' of monitors_show() is not a pointer to struct rv_monitor, it is actually a pointer to the list_head inside struct rv_monitor. Therefore it is wrong to cast 'p' to struct rv_monitor *. This wrong type cast has been there since the beginning. But it still worked because the list_head was the first field in struct rv_monitor_def. This is no longer true since commit 24cbfe18d55a ("rv: Merge struct rv_monitor_def into struct rv_monitor") moved the list_head, and this wrong type cast became a functional problem. Properly use container_of() instead. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/35e49e97696007919ceacf73796487a2e15a3d02.1753625621.git.namcao@linutronix.de Fixes: 24cbfe18d55a ("rv: Merge struct rv_monitor_def into struct rv_monitor") Signed-off-by: Nam Cao Reviewed-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 942ac8da6388c25fe62b2792c78715e0ea6e649b Author: Michal Wajdeczko Date: Tue Jul 22 16:10:54 2025 +0200 drm/xe/configfs: Fix pci_dev reference leak We are using pci_get_domain_bus_and_slot() function to verify if the given config directory name matches any existing PCI device, but we missed to call matching pci_dev_put() to release reference. While around, also change error code in case of no device match, to make it more specific than generic formatting error. Fixes: 16280ded45fb ("drm/xe: Add configfs to enable survivability mode") Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250722141059.30707-2-michal.wajdeczko@intel.com Signed-off-by: Lucas De Marchi (cherry picked from commit 0bdd05c2a82bbf2419415d012fd4f5faeca7f1af) Signed-off-by: Rodrigo Vivi commit 4846856c3a4afa882b6d1b842ed2fad6f3781f4d Author: Shuicheng Lin Date: Thu Jul 24 19:38:55 2025 +0000 drm/xe/hw_engine_group: Avoid call kfree() for drmm_kzalloc() Memory allocated with drmm_kzalloc() should not be freed using kfree(), as it is managed by the DRM subsystem. The memory will be automatically freed when the associated drm_device is released. These 3 group pointers are allocated using drmm_kzalloc() in hw_engine_group_alloc(), so they don't require manual deallocation. Fixes: 67979060740f ("drm/xe/hw_engine_group: Fix potential leak") Cc: Michal Wajdeczko Cc: Matthew Brost Signed-off-by: Shuicheng Lin Reviewed-by: Matthew Brost Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250724193854.1124510-2-shuicheng.lin@intel.com (cherry picked from commit f98de826b418885a21ece67f0f5b921ae759b7bf) Signed-off-by: Rodrigo Vivi commit a80db1f85774ae571b94077f65c5cd57467641d3 Author: Tomas Glozar Date: Fri Jul 25 15:38:17 2025 +0200 rtla/tests: Test timerlat -P option using actions The -P option is used to set priority of osnoise and timerlat threads. Extend the test for -P with --on-threshold calling a script that looks for running timerlat threads and checks if their priority is set correctly. As --on-threshold is only supported by timerlat at the moment, this is only implemented there so far. Cc: John Kacur Cc: Luis Goncalves Cc: Chang Yin Cc: Costa Shulyupin Link: https://lore.kernel.org/20250725133817.59237-3-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit a2e1407eb8405e59c56b2325d910a73fd917eb3e Author: Michal Wajdeczko Date: Wed Jul 23 19:56:39 2025 +0200 drm/xe/guc: Clear whole g2h_fence during initialization The struct g2h_fence must be explicitly initializated using the g2h_fence_init() function to avoid trash values in its members, but we missed to update this helper function with the new member. To fix that and avoid any future mistakes, memset the whole struct first, then update remaining non-zero members. Fixes: 94de94d24ea8 ("drm/xe/guc: Cancel ongoing H2G requests when stopping CT") Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Cc: Lukasz Laguna Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250723175639.206875-1-michal.wajdeczko@intel.com (cherry picked from commit 159afd92bae8153bdd8d8b34aea0d463fe19c978) Signed-off-by: Rodrigo Vivi commit 892ae5f806af323ceb6073fc550d62c635d7271c Author: Tomas Glozar Date: Fri Jul 25 15:38:16 2025 +0200 rtla/tests: Add grep checks for base test cases Checking for patterns in rtla output with grep was added to test rtla actions. Add grep checks also for base tests where applicable. Also fix trace event histogram trigger check to use the correct syntax for the command-line option so that the test passes with the grep check. Cc: John Kacur Cc: Luis Goncalves Cc: Chang Yin Cc: Costa Shulyupin Link: https://lore.kernel.org/20250725133817.59237-2-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit cccb918e0231fefba059f049acced18760242136 Author: Lukasz Laguna Date: Thu Jul 17 17:54:20 2025 +0200 drm/xe/vf: Don't register I2C devices if VF VF drivers can't access I2C devices, so skip their registration when running as VF. Signed-off-by: Lukasz Laguna Fixes: f0e53aadd702 ("drm/xe: Support for I2C attached MCUs") Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250717155420.25298-1-lukasz.laguna@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit 9a220e065914b67b55d3d0ab91c3e215742fdd73) Signed-off-by: Rodrigo Vivi commit dc94168eaa6f6f2476c4e1a894bd8d031df6226d Author: Zhanjun Dong Date: Mon Jul 21 17:45:20 2025 -0400 drm/xe/uc: Fix missing unwind goto Fix missing unwind goto on error handling. Fixes: b2c4ac219fa4 ("drm/xe/uc: Disable GuC communication on hardware initialization error") Signed-off-by: Zhanjun Dong Reviewed-by: Matthew Brost Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250721214520.954014-1-zhanjun.dong@intel.com (cherry picked from commit 176f44a5ec0b074aaf44852db77d0c183c36696d) Signed-off-by: Rodrigo Vivi commit 2bd986021c297ba675e831c3164bf9bdbbca3bc3 Author: Dan Carpenter Date: Tue Jul 15 17:59:44 2025 -0500 drm/xe: Fix a NULL vs IS_ERR() bug in xe_i2c_register_adapter() The fwnode_create_software_node() function returns error pointers. It never returns NULL. Update the checks to match. Fixes: f0e53aadd702 ("drm/xe: Support for I2C attached MCUs") Signed-off-by: Dan Carpenter Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/65825d00-81ab-4665-af51-4fff6786a250@sabinyo.mountain Signed-off-by: Rodrigo Vivi (cherry picked from commit 2f264d58cc805a3cefc6b98097f90fbc388136ef) Signed-off-by: Rodrigo Vivi commit 6aaceed7fe1a400082ec5990884b11ef7266a605 Author: Ashutosh Dixit Date: Tue Jul 15 11:14:22 2025 -0700 drm/xe/oa: Fix static checker warning about null gt There is a static checker warning that gt returned by xe_device_get_gt can be NULL and that is being dereferenced. Use xe_root_mmio_gt instead, which is equivalent and cannot return a NULL gt 0. Fixes: 10d42ef34bce ("drm/xe/oa: Assign hwe for OAM_SAG") Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250715181422.2807624-1-ashutosh.dixit@intel.com (cherry picked from commit 308dc9b27874d0e8a0258869b9e681b0fdd2e579) Signed-off-by: Rodrigo Vivi commit d9e9aa3e971b37c6d6dfd15ad8dc65537a925725 Author: Raag Jadav Date: Tue Jul 15 03:25:03 2025 +0530 drm/xe: Don't fail probe on unsupported mailbox command If the device is running older pcode firmware, it is possible that newer mailbox commands are not supported by it. The sysfs attributes aren't useful in that case, but we shouldn't fail driver probe because of it. As of now, it is unknown if we can distinguish unsupported commands before attempting them. But until we figure out a way to do that, fix the regressions. v2: Add debug message (Lucas) Fixes: cdc36b66cd41 ("drm/xe: Expose fan control and voltage regulator version") Signed-off-by: Raag Jadav Tested-by: Matthew Brost Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250714215503.2897748-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi (cherry picked from commit ed5461daa150b037e36b8202381da1ef85d6b16b) Signed-off-by: Rodrigo Vivi commit d35cdd6ed55e15f0c3ed60b36fc97beb5571332c Merge: 8a15ca0ca51399 e95122a32e7773 Author: Takashi Iwai Date: Mon Jul 28 14:28:21 2025 +0200 Merge tag 'asoc-v6.17-2' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: More updates for v6.17 A few more updates, mostly fixes and device IDs plus some small enhancements for the FSL xcvr driver. commit 56eb7c13b97c6f9e2fed9e9899b01d1a6a595f28 Author: Andy Shevchenko Date: Thu Jun 26 19:08:12 2025 +0300 mtd: map: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Signed-off-by: Andy Shevchenko Signed-off-by: Miquel Raynal commit 48defdf6b083f74a44e1f742db284960d3444aec Author: Aaron Plattner Date: Mon Jul 21 16:06:39 2025 -0700 watchdog: sbsa: Adjust keepalive timeout to avoid MediaTek WS0 race condition The MediaTek implementation of the sbsa_gwdt watchdog has a race condition where a write to SBSA_GWDT_WRR is ignored if it occurs while the hardware is processing a timeout refresh that asserts WS0. Detect this based on the hardware implementer and adjust wdd->min_hw_heartbeat_ms to avoid the race by forcing the keepalive ping to be one second later. Signed-off-by: Aaron Plattner Acked-by: Timur Tabi Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250721230640.2244915-1-aplattner@nvidia.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8a15ca0ca51399b652b1bbb23b590b220cf03d62 Author: Geoffrey D. Bennett Date: Mon Jul 28 19:00:35 2025 +0930 ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() During communication with Focusrite Scarlett Gen 2/3/4 USB audio interfaces, -EPROTO is sometimes returned from scarlett2_usb_tx(), snd_usb_ctl_msg() which can cause initialisation and control operations to fail intermittently. This patch adds up to 5 retries in scarlett2_usb(), with a delay starting at 5ms and doubling each time. This follows the same approach as the fix for usb_set_interface() in endpoint.c (commit f406005e162b ("ALSA: usb-audio: Add retry on -EPROTO from usb_set_interface()")), which resolved similar -EPROTO issues during device initialisation, and is the same approach as in fcp.c:fcp_usb(). Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface") Closes: https://github.com/geoffreybennett/linux-fcp/issues/41 Cc: stable@vger.kernel.org Signed-off-by: Geoffrey D. Bennett Link: https://patch.msgid.link/aIdDO6ld50WQwNim@m.b4.vu Signed-off-by: Takashi Iwai commit bd7814a4c0fd883894bdf9fe5eda24c9df826e4c Author: Edip Hazuri Date: Fri Jul 25 18:14:37 2025 +0300 ALSA: hda/realtek - Fix mute LED for HP Victus 16-r1xxx The mute led on this laptop is using ALC245 but requires a quirk to work This patch enables the existing quirk for the device. Tested on Victus 16-r1xxx Laptop. The LED behaviour works as intended. Cc: Signed-off-by: Edip Hazuri Link: https://patch.msgid.link/20250725151436.51543-2-edip@medip.dev Signed-off-by: Takashi Iwai commit 1c24e5fc0c7096e00c202a6a3e0c342c1afb47c2 Author: Hans de Goede Date: Sat Jul 19 20:01:04 2025 +0200 i2c: core: Fix double-free of fwnode in i2c_unregister_device() Before commit df6d7277e552 ("i2c: core: Do not dereference fwnode in struct device"), i2c_unregister_device() only called fwnode_handle_put() on of_node-s in the form of calling of_node_put(client->dev.of_node). But after this commit the i2c_client's fwnode now unconditionally gets fwnode_handle_put() on it. When the i2c_client has no primary (ACPI / OF) fwnode but it does have a software fwnode, the software-node will be the primary node and fwnode_handle_put() will put() it. But for the software fwnode device_remove_software_node() will also put() it leading to a double free: [ 82.665598] ------------[ cut here ]------------ [ 82.665609] refcount_t: underflow; use-after-free. [ 82.665808] WARNING: CPU: 3 PID: 1502 at lib/refcount.c:28 refcount_warn_saturate+0xba/0x11 ... [ 82.666830] RIP: 0010:refcount_warn_saturate+0xba/0x110 ... [ 82.666962] [ 82.666971] i2c_unregister_device+0x60/0x90 Fix this by not calling fwnode_handle_put() when the primary fwnode is a software-node. Fixes: df6d7277e552 ("i2c: core: Do not dereference fwnode in struct device") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Wolfram Sang commit f61389a9cd26b424485acade726ccfff96c749de Merge: c3ff7f06c7876b 85b9dd6e90b92f Author: Wolfram Sang Date: Mon Jul 28 10:24:40 2025 +0200 Merge tag 'i2c-host-6.17-pt1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux into i2c/for-mergewindow i2c-host for v6.17, part 1 Cleanups and refactorings: - lpi2c, riic, st, stm32f7: general improvements - riic: support more flexible IRQ configurations - tegra: fix documentation Improvements: - lpi2c: improve register polling and add atomic transfer - imx: use guarded spinlocks New hardware support: - Samsung Exynos 2200 - Renesas RZ/T2H (R9A09G077), RZ/N2H (R9A09G087) DT binding: - rk3x: enable power domains - nxp: support clock property commit 3ebcbf079c26ab6e82faa7f896b66def55547eee Author: Thomas Weißschuh Date: Fri Jul 18 15:18:24 2025 +0200 MIPS: Don't use %pK through printk Restricted pointers ("%pK") are not meant to be used through printk(). It can unintentionally expose security sensitive, raw pointer values. Use regular pointer formatting instead. Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Bogendoerfer commit 748f8b27b0076379f71848259718cf9360e3a0c0 Author: Joshua Kinard Date: Mon Jul 21 12:57:15 2025 -0400 MIPS: Update Joshua Kinard's e-mail address I am switching my address to a personal domain, so some files in the SGI IP30 and IOC3 files need to be updated. I will send updates for the MAINTAINERS file and rtc-ds1685 separately to linux-rtc. Signed-off-by: Joshua Kinard Signed-off-by: Thomas Bogendoerfer commit 707b74c6c2caf89692bcd746f928fdcd564e151b Author: Benoît Monin Date: Tue Jul 22 17:15:20 2025 +0200 MIPS: mobileye: dts: eyeq5,eyeq6h: rename the emmc controller The name should match the pattern defined in the mmc-controller binding. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507220336.JhvVLL7k-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202507220215.wVoUMK5B-lkp@intel.com/ Signed-off-by: Benoît Monin Reviewed-by: Krzysztof Kozlowski Signed-off-by: Thomas Bogendoerfer commit 6b94bf976f9f9e6d4a6bf3218968a506c049702e Author: Bartosz Golaszewski Date: Sun Jul 27 10:24:42 2025 +0200 MIPS: alchemy: gpio: use new GPIO line value setter callbacks for the remaining chips Previous commit missed two other places that need converting, it only came out in tests on autobuilders now. Convert the rest of the driver. Fixes: 68bdc4dc1130 ("MIPS: alchemy: gpio: use new line value setter callbacks") Acked-by: Thomas Bogendoerfer Link: https://lore.kernel.org/r/20250727082442.13182-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 5bf2f5119b9e957f773a22f226974166b58cff32 Merge: 65f55a30176662 038d61fd642278 Author: Ingo Molnar Date: Mon Jul 28 07:12:53 2025 +0200 Merge tag 'v6.16' into x86/cpu, to resolve conflict Resolve overlapping context conflict between this upstream fix: d8010d4ba43e ("x86/bugs: Add a Transient Scheduler Attacks mitigation") And this pending commit in tip:x86/cpu: 65f55a301766 ("x86/CPU/AMD: Add CPUID faulting support") Conflicts: arch/x86/kernel/cpu/amd.c Signed-off-by: Ingo Molnar commit cf2a6de32cabbf84a889e24a9ee7c51dee4a1f70 Author: Puranjay Mohan Date: Thu Jul 17 20:29:17 2025 +0000 powerpc64/bpf: Add jit support for load_acquire and store_release Add JIT support for the load_acquire and store_release instructions. The implementation is similar to the kernel where: load_acquire => plain load -> lwsync store_release => lwsync -> plain store To test the correctness of the implementation, following selftests were run: [fedora@linux-kernel bpf]$ sudo ./test_progs -a \ verifier_load_acquire,verifier_store_release,atomics #11/1 atomics/add:OK #11/2 atomics/sub:OK #11/3 atomics/and:OK #11/4 atomics/or:OK #11/5 atomics/xor:OK #11/6 atomics/cmpxchg:OK #11/7 atomics/xchg:OK #11 atomics:OK #519/1 verifier_load_acquire/load-acquire, 8-bit:OK #519/2 verifier_load_acquire/load-acquire, 8-bit @unpriv:OK #519/3 verifier_load_acquire/load-acquire, 16-bit:OK #519/4 verifier_load_acquire/load-acquire, 16-bit @unpriv:OK #519/5 verifier_load_acquire/load-acquire, 32-bit:OK #519/6 verifier_load_acquire/load-acquire, 32-bit @unpriv:OK #519/7 verifier_load_acquire/load-acquire, 64-bit:OK #519/8 verifier_load_acquire/load-acquire, 64-bit @unpriv:OK #519/9 verifier_load_acquire/load-acquire with uninitialized src_reg:OK #519/10 verifier_load_acquire/load-acquire with uninitialized src_reg @unpriv:OK #519/11 verifier_load_acquire/load-acquire with non-pointer src_reg:OK #519/12 verifier_load_acquire/load-acquire with non-pointer src_reg @unpriv:OK #519/13 verifier_load_acquire/misaligned load-acquire:OK #519/14 verifier_load_acquire/misaligned load-acquire @unpriv:OK #519/15 verifier_load_acquire/load-acquire from ctx pointer:OK #519/16 verifier_load_acquire/load-acquire from ctx pointer @unpriv:OK #519/17 verifier_load_acquire/load-acquire with invalid register R15:OK #519/18 verifier_load_acquire/load-acquire with invalid register R15 @unpriv:OK #519/19 verifier_load_acquire/load-acquire from pkt pointer:OK #519/20 verifier_load_acquire/load-acquire from flow_keys pointer:OK #519/21 verifier_load_acquire/load-acquire from sock pointer:OK #519 verifier_load_acquire:OK #556/1 verifier_store_release/store-release, 8-bit:OK #556/2 verifier_store_release/store-release, 8-bit @unpriv:OK #556/3 verifier_store_release/store-release, 16-bit:OK #556/4 verifier_store_release/store-release, 16-bit @unpriv:OK #556/5 verifier_store_release/store-release, 32-bit:OK #556/6 verifier_store_release/store-release, 32-bit @unpriv:OK #556/7 verifier_store_release/store-release, 64-bit:OK #556/8 verifier_store_release/store-release, 64-bit @unpriv:OK #556/9 verifier_store_release/store-release with uninitialized src_reg:OK #556/10 verifier_store_release/store-release with uninitialized src_reg @unpriv:OK #556/11 verifier_store_release/store-release with uninitialized dst_reg:OK #556/12 verifier_store_release/store-release with uninitialized dst_reg @unpriv:OK #556/13 verifier_store_release/store-release with non-pointer dst_reg:OK #556/14 verifier_store_release/store-release with non-pointer dst_reg @unpriv:OK #556/15 verifier_store_release/misaligned store-release:OK #556/16 verifier_store_release/misaligned store-release @unpriv:OK #556/17 verifier_store_release/store-release to ctx pointer:OK #556/18 verifier_store_release/store-release to ctx pointer @unpriv:OK #556/19 verifier_store_release/store-release, leak pointer to stack:OK #556/20 verifier_store_release/store-release, leak pointer to stack @unpriv:OK #556/21 verifier_store_release/store-release, leak pointer to map:OK #556/22 verifier_store_release/store-release, leak pointer to map @unpriv:OK #556/23 verifier_store_release/store-release with invalid register R15:OK #556/24 verifier_store_release/store-release with invalid register R15 @unpriv:OK #556/25 verifier_store_release/store-release to pkt pointer:OK #556/26 verifier_store_release/store-release to flow_keys pointer:OK #556/27 verifier_store_release/store-release to sock pointer:OK #556 verifier_store_release:OK Summary: 3/55 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Puranjay Mohan Tested-by: Saket Kumar Bhaskar Reviewed-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250717202935.29018-2-puranjay@kernel.org commit 19122a7c28ed119c6ec9adca710acecf633af16a Author: Vishal Parmar Date: Sun Jul 27 16:31:45 2025 +0530 docs: powerpc: add htm.rst to toctree The file Documentation/arch/powerpc/htm.rst is not included in the index.rst toctree. This results in a warning when building the docs: WARNING: document isn't included in any toctree: htm.rst Add it to the index.rst file so that it is properly included in the PowerPC documentation TOC. Signed-off-by: Vishal Parmar Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250727110145.839906-1-vishistriker@gmail.com commit de1fffd88600c5ee1c095c84b86484cd0329a9e8 Author: Krzysztof Kozlowski Date: Thu Jul 24 13:37:36 2025 +0200 dt-bindings: hwmon: Replace bouncing Alexandru Tachici emails Emails to alexandru.tachici@analog.com bounce permanently: Remote Server returned '550 5.1.10 RESOLVER.ADR.RecipientNotFound; Recipient not found by SMTP address lookup' so replace him with Cedric Encarnacion from Analog. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250724113735.59148-2-krzysztof.kozlowski@linaro.org Signed-off-by: Guenter Roeck commit fd470f4ed80ce0807943b8d6802ca41044c73521 Author: Jonas Rebmann Date: Fri Jul 18 16:12:50 2025 +0200 hwmon: (ina238) Add support for INA228 Add support for the Texas Instruments INA228 Ultra-Precise Power/Energy/Charge Monitor. The INA228 is very similar to the INA238 but offers four bits of extra precision in the temperature, voltage and current measurement fields. It also supports energy and charge monitoring, the latter of which is not supported through this patch. While it seems in the datasheet that some constants such as LSB values differ between the 228 and the 238, they differ only for those registers where four bits of precision have been added and they differ by a factor of 16 (VBUS, VSHUNT, DIETEMP, CURRENT). Therefore, the INA238 constants are still applicable with regard to the bit of the same significance. Signed-off-by: Jonas Rebmann Link: https://lore.kernel.org/r/20250718-ina228-v2-3-227feb62f709@pengutronix.de Signed-off-by: Guenter Roeck commit 8aee29f743954d8fc91ecc83fbfd283a0d8f7cfd Author: Jonas Rebmann Date: Fri Jul 18 16:12:49 2025 +0200 dt-bindings: Add INA228 to ina2xx devicetree bindings Add the ina228 to ina2xx bindings. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Jonas Rebmann Link: https://lore.kernel.org/r/20250718-ina228-v2-2-227feb62f709@pengutronix.de Signed-off-by: Guenter Roeck commit cde1cc6b6079fa24c236bff3d58f7f8b4b1fc1bb Author: Jonas Rebmann Date: Fri Jul 18 16:12:48 2025 +0200 hwmon: (ina238) Fix inconsistent whitespace Some purely cosmetic changes in ina238.c: - When aligning definitions, do so consistently with tab stop of 8. - Use spaces instead of tabs around operators. - Align wrapped lines. Signed-off-by: Jonas Rebmann Link: https://lore.kernel.org/r/20250718-ina228-v2-1-227feb62f709@pengutronix.de Signed-off-by: Guenter Roeck commit 309c2b776c8716d4e3b98506bde3ccd131f2fae6 Author: Pali Rohár Date: Thu Dec 26 00:43:22 2024 +0100 cifs: Add support for creating reparse points over SMB1 SMB1 already supports querying reparse points and detecting types of symlink, fifo, socket, block and char. This change implements the missing part - ability to create a new reparse points over SMB1. This includes everything which SMB2+ already supports: - native SMB symlinks and sockets - NFS style of special files (symlinks, fifos, sockets, char/block devs) - WSL style of special files (symlinks, fifos, sockets, char/block devs) Attaching a reparse point to an existing file or directory is done via SMB1 SMB_COM_NT_TRANSACT/NT_TRANSACT_IOCTL/FSCTL_SET_REPARSE_POINT command and implemented in a new cifs_create_reparse_inode() function. This change introduce a new callback ->create_reparse_inode() which creates a new reperse point file or directory and returns inode. For SMB1 it is provided via that new cifs_create_reparse_inode() function. Existing reparse.c code was only slightly updated to call new protocol callback ->create_reparse_inode() instead of hardcoded SMB2+ function. This make the whole reparse.c code to work with every SMB dialect. The original callback ->create_reparse_symlink() is not needed anymore as the implementation of new create_reparse_symlink() function is dialect agnostic too. So the link.c code was updated to call that function directly (and not via callback). Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 75d519b0b52a4ffccfc335be7e5d5eb303d330e6 Author: Pali Rohár Date: Thu Jan 30 22:33:27 2025 +0100 cifs: Do not query WSL EAs for native SMB symlink WSL EAs are not required for native SMB symlinks, so do not query them from server. Signed-off-by: Pali Rohár Signed-off-by: Steve French commit b62a206bfbf3e9c52abc28253bf3baedc8d99880 Author: Pali Rohár Date: Mon Dec 30 20:55:53 2024 +0100 cifs: Optimize CIFSFindFirst() response when not searching When not searching for child entries with msearch wildcard pattern then ask server just for one output entry. There is no need to ask for more entries as we are interested only for one search result, as we are doing query on path. CIFSFindFirst() with msearch=false is called by the cifs_query_path_info() function. Signed-off-by: Pali Rohár Signed-off-by: Steve French commit b460249b9a1dab7a9f58483e5349d045ad6d585c Author: Pali Rohár Date: Mon Dec 30 20:54:11 2024 +0100 cifs: Fix calling CIFSFindFirst() for root path without msearch To query root path (without msearch wildcard) it is needed to send pattern '\' instead of '' (empty string). This allows to use CIFSFindFirst() to query information about root path which is being used in followup changes. This change fixes the stat() syscall called on the root path on the mount. It is because stat() syscall uses the cifs_query_path_info() function and it can fallback to the CIFSFindFirst() usage with msearch=false. Signed-off-by: Pali Rohár Signed-off-by: Steve French commit 33cfdd726381828b9907a61c038a9f48b6690a31 Author: Paulo Alcantara Date: Fri Jul 25 00:04:44 2025 -0300 smb: client: fix session setup against servers that require SPN Some servers might enforce the SPN to be set in the target info blob (AV pairs) when sending NTLMSSP_AUTH message. In Windows Server, this could be enforced with SmbServerNameHardeningLevel set to 2. Fix this by always appending SPN (cifs/) to the existing list of target infos when setting up NTLMv2 response blob. Cc: linux-cifs@vger.kernel.org Cc: David Howells Reported-by: Pierguido Lambri Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit be77ab6b9fbe348daf3c2d3ee40f23ca5110a339 Author: Paulo Alcantara Date: Fri Jul 25 00:04:43 2025 -0300 smb: client: allow parsing zero-length AV pairs Zero-length AV pairs should be considered as valid target infos. Don't skip the next AV pairs that follow them. Cc: linux-cifs@vger.kernel.org Cc: David Howells Fixes: 0e8ae9b953bc ("smb: client: parse av pair type 4 in CHALLENGE_MESSAGE") Signed-off-by: Paulo Alcantara (Red Hat) Signed-off-by: Steve French commit 3edc68de5629efa39911e7c9687b19ad04051cab Author: Shyam Prasad N Date: Thu Jul 24 22:23:53 2025 -0500 cifs: add new field to track the last access time of cfid The handlecache code today tracks the time at which dir lease was acquired and the laundromat thread uses that to check for old entries to cleanup. However, if a directory is actively accessed, it should not be chosen to expire first. This change adds a new last_access_time field to cfid and uses that to decide expiry of the cfid. Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 2aaf1784835f5f3063ae2392689053ebafd27e01 Author: Bharath SM Date: Tue Jul 1 00:19:32 2025 +0530 smb: change return type of cached_dir_lease_break() to bool cached_dir_lease_break() has return type as int but only returning true or false. change return type of this function to bool for clarity. Signed-off-by: Bharath SM Signed-off-by: Steve French commit 9d5eff7821f6d70f7d1b4d8a60680fba4de868a7 Author: Shyam Prasad N Date: Thu Jul 17 17:36:13 2025 +0530 cifs: reset iface weights when we cannot find a candidate We now do a weighted selection of server interfaces when allocating new channels. The weights are decided based on the speed advertised. The fulfilled weight for an interface is a counter that is used to track the interface selection. It should be reset back to zero once all interfaces fulfilling their weight. In cifs_chan_update_iface, this reset logic was missing. As a result when the server interface list changes, the client may not be able to find a new candidate for other channels after all interfaces have been fulfilled. Fixes: a6d8fb54a515 ("cifs: distribute channels across interfaces based on speed") Cc: Signed-off-by: Shyam Prasad N Signed-off-by: Steve French commit 59b33fab4ca4d7dacc03367082777627e05d0323 Author: Wang Zhaolong Date: Thu Jul 17 21:29:26 2025 +0800 smb: client: fix netns refcount leak after net_passive changes After commit 5c70eb5c593d ("net: better track kernel sockets lifetime"), kernel sockets now use net_passive reference counting. However, commit 95d2b9f693ff ("Revert "smb: client: fix TCP timers deadlock after rmmod"") restored the manual socket refcount manipulation without adapting to this new mechanism, causing a memory leak. The issue can be reproduced by[1]: 1. Creating a network namespace 2. Mounting and Unmounting CIFS within the namespace 3. Deleting the namespace Some memory leaks may appear after a period of time following step 3. unreferenced object 0xffff9951419f6b00 (size 256): comm "ip", pid 447, jiffies 4294692389 (age 14.730s) hex dump (first 32 bytes): 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 80 77 c2 44 51 99 ff ff .........w.DQ... backtrace: __kmem_cache_alloc_node+0x30e/0x3d0 __kmalloc+0x52/0x120 net_alloc_generic+0x1d/0x30 copy_net_ns+0x86/0x200 create_new_namespaces+0x117/0x300 unshare_nsproxy_namespaces+0x60/0xa0 ksys_unshare+0x148/0x360 __x64_sys_unshare+0x12/0x20 do_syscall_64+0x59/0x110 entry_SYSCALL_64_after_hwframe+0x78/0xe2 ... unreferenced object 0xffff9951442e7500 (size 32): comm "mount.cifs", pid 475, jiffies 4294693782 (age 13.343s) hex dump (first 32 bytes): 40 c5 38 46 51 99 ff ff 18 01 96 42 51 99 ff ff @.8FQ......BQ... 01 00 00 00 6f 00 c5 07 6f 00 d8 07 00 00 00 00 ....o...o....... backtrace: __kmem_cache_alloc_node+0x30e/0x3d0 kmalloc_trace+0x2a/0x90 ref_tracker_alloc+0x8e/0x1d0 sk_alloc+0x18c/0x1c0 inet_create+0xf1/0x370 __sock_create+0xd7/0x1e0 generic_ip_connect+0x1d4/0x5a0 [cifs] cifs_get_tcp_session+0x5d0/0x8a0 [cifs] cifs_mount_get_session+0x47/0x1b0 [cifs] dfs_mount_share+0xfa/0xa10 [cifs] cifs_mount+0x68/0x2b0 [cifs] cifs_smb3_do_mount+0x10b/0x760 [cifs] smb3_get_tree+0x112/0x2e0 [cifs] vfs_get_tree+0x29/0xf0 path_mount+0x2d4/0xa00 __se_sys_mount+0x165/0x1d0 Root cause: When creating kernel sockets, sk_alloc() calls net_passive_inc() for sockets with sk_net_refcnt=0. The CIFS code manually converts kernel sockets to user sockets by setting sk_net_refcnt=1, but doesn't call the corresponding net_passive_dec(). This creates an imbalance in the net_passive counter, which prevents the network namespace from being destroyed when its last user reference is dropped. As a result, the entire namespace and all its associated resources remain allocated. Timeline of patches leading to this issue: - commit ef7134c7fc48 ("smb: client: Fix use-after-free of network namespace.") in v6.12 fixed the original netns UAF by manually managing socket refcounts - commit e9f2517a3e18 ("smb: client: fix TCP timers deadlock after rmmod") in v6.13 attempted to use kernel sockets but introduced TCP timer issues - commit 5c70eb5c593d ("net: better track kernel sockets lifetime") in v6.14-rc5 introduced the net_passive mechanism with sk_net_refcnt_upgrade() for proper socket conversion - commit 95d2b9f693ff ("Revert "smb: client: fix TCP timers deadlock after rmmod"") in v6.15-rc3 reverted to manual refcount management without adapting to the new net_passive changes Fix this by using sk_net_refcnt_upgrade() which properly handles the net_passive counter when converting kernel sockets to user sockets. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220343 [1] Fixes: 95d2b9f693ff ("Revert "smb: client: fix TCP timers deadlock after rmmod"") Cc: stable@vger.kernel.org Reviewed-by: Kuniyuki Iwashima Reviewed-by: Enzo Matsumiya Signed-off-by: Wang Zhaolong Signed-off-by: Steve French commit 81b96e4aef9592493873507eec52eca68f0721ac Author: Ville Syrjälä Date: Mon Sep 23 23:50:16 2024 +0300 fbcon: Use 'bool' where appopriate Use 'bool' type where it makes more sense than 'int'. v2: Rebase due to corrected 'fbcon_cursor_blink' initial value Acked-by: Helge Deller Signed-off-by: Ville Syrjälä Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 311b07842fb0bb69b5b266b3dfd6037260a3ec2a Author: Ville Syrjälä Date: Mon Sep 23 18:57:48 2024 +0300 fbcon: Introduce get_{fg,bg}_color() Make the code more legible by adding get_{fg,bg}_color() which hide the obscure 'is_fg' parameter of get_color() from the caller. Signed-off-by: Ville Syrjälä Acked-by: Helge Deller Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller commit ffc825a27f5503136196cb38f41641b58bf2df31 Author: Ville Syrjälä Date: Mon Sep 23 18:57:47 2024 +0300 fbcon: fbcon_is_inactive() -> fbcon_is_active() Invert fbcon_is_inactive() into fbcon_is_active(). Much easier on the poor brain when you don't have to do dobule negations all over the place. Signed-off-by: Ville Syrjälä Acked-by: Helge Deller Reviewed-by: Thomas Zimmermann Signed-off-by: Helge Deller commit 91a256467eed9e4449969163e3c93bc4bd990145 Author: Ville Syrjälä Date: Mon Sep 23 23:48:53 2024 +0300 fbcon: fbcon_cursor_noblink -> fbcon_cursor_blink Invert fbcon_cursor_noblink into fbcon_cursor_blink so that: - it matches the sysfs attribute exactly - avoids having to do these NOT operations all over the place - use bool instead of int Signed-off-by: Ville Syrjälä Signed-off-by: Helge Deller commit a2a42f0c96d709d0cf5cc672acb352934ca95326 Author: Daniel Palmer Date: Fri Jul 25 14:30:57 2025 +0900 fbdev: Fix typo in Kconfig text for FB_DEVICE Seems like someone hit 'c' when they meant to hit 'd'. Signed-off-by: Daniel Palmer Signed-off-by: Helge Deller commit da11e6a30e0bb8e911288bdc443b3dc8f6a7cac7 Author: Chenyuan Yang Date: Wed Jul 23 22:25:34 2025 -0500 fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref fb_add_videomode() can fail with -ENOMEM when its internal kmalloc() cannot allocate a struct fb_modelist. If that happens, the modelist stays empty but the driver continues to register. Add a check for its return value to prevent poteintial null-ptr-deref, which is similar to the commit 17186f1f90d3 ("fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var"). Fixes: 1b6c79361ba5 ("video: imxfb: Add DT support") Signed-off-by: Chenyuan Yang Signed-off-by: Helge Deller commit 57ba4d5338a6b455d6b0bb9aa4ce9826897b9007 Author: Darshan R. Date: Mon Jul 21 12:56:47 2025 +0000 fbdev: svgalib: Clean up coding style This patch addresses various coding style issues in `svgalib.c` to improve readability and better align the code with the Linux kernel's formatting standards. The changes primarily consist of: - Adjusting whitespace around operators and after keywords. - Standardizing brace placement for control flow statements. - Removing unnecessary braces on single-statement if/else blocks. - Deleting extraneous blank lines throughout the file. These changes are purely stylistic and introduce no functional modifications. Signed-off-by: Darshan R. Signed-off-by: Helge Deller commit 32dfb6112ea3ca143636832cd34234f2be4830bb Author: Giovanni Di Santi Date: Wed Jul 9 11:53:54 2025 +0200 fbdev: kyro: Use devm_ioremap_wc() for screen mem Replace the manual pci_ioremap_wc() call for mapping screen memory with the device-managed devm_ioremap_wc() variant. This simplifies the driver's resource management by ensuring the memory is automatically unmapped when the driver detaches from the device. Signed-off-by: Giovanni Di Santi Signed-off-by: Helge Deller commit e0bf12a43243e6afc5a03fc55c58ec48aba48088 Author: Giovanni Di Santi Date: Wed Jul 9 11:53:53 2025 +0200 fbdev: kyro: Use devm_ioremap() for mmio registers Replace the manual ioremap() call for the MMIO registers with the device-managed devm_ioremap() variant. This simplifies the driver's resource management by ensuring the memory is automatically unmapped when the driver detaches from the device. Signed-off-by: Giovanni Di Santi Signed-off-by: Helge Deller commit b56f93f568dc0214963d9d9d2fd2c992cf241c76 Author: Giovanni Di Santi Date: Wed Jul 9 11:53:52 2025 +0200 fbdev: kyro: Add missing PCI memory region request The kyro framebuffer driver did not request its PCI memory regions, which could lead to conflicts with other drivers. This change addresses the task "Request memory regions in all fbdev drivers" from the file Documentation/gpu/todo.rst. This is addressed by using the managed device functions pcim_enable_device() and pcim_request_all_regions(). This simplifies the code by making error handling and driver removal cleanup automatic for these resources. Signed-off-by: Giovanni Di Santi Signed-off-by: Helge Deller commit c80de50c192f135a78f6c924818b2f5cd6ca7524 Author: Rob Herring (Arm) Date: Thu Jul 3 13:35:13 2025 -0500 fbdev: simplefb: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. The error handling is a bit different. "memory-region" is optional, so failed lookup is not an error. But then an error in of_address_to_resource() is treated as an error. However, that distinction is not really important. Either the region is available and usable or it is not. So now, it is just of_reserved_mem_region_to_resource() which is checked for an error. Signed-off-by: Rob Herring (Arm) Signed-off-by: Helge Deller commit 523b84dc7ccea9c4d79126d6ed1cf9033cf83b05 Author: Yongzhen Zhang Date: Tue Jul 1 17:07:04 2025 +0800 fbdev: fix potential buffer overflow in do_register_framebuffer() The current implementation may lead to buffer overflow when: 1. Unregistration creates NULL gaps in registered_fb[] 2. All array slots become occupied despite num_registered_fb < FB_MAX 3. The registration loop exceeds array bounds Add boundary check to prevent registered_fb[FB_MAX] access. Signed-off-by: Yongzhen Zhang Signed-off-by: Helge Deller commit ecdd7df997fd992f0ec70b788e3b12258008a2bf Author: Randy Dunlap Date: Sun Jun 15 11:36:51 2025 -0700 fbdev: nvidiafb: add depends on HAS_IOPORT The nvidiafb driver uses inb()/outb() without depending on HAS_IOPORT, which leads to build errors since kernel v6.13-rc1: commit 6f043e757445 ("asm-generic/io.h: Remove I/O port accessors for HAS_IOPORT=n") Add the HAS_IOPORT dependency to prevent the build errors. (Found in ARCH=um allmodconfig builds) drivers/video/fbdev/nvidia/nv_accel.c: In function ‘NVDmaWait’: include/asm-generic/io.h:596:15: error: call to ‘_outb’ declared with attribute error: outb() requires CONFIG_HAS_IOPORT 596 | #define _outb _outb Signed-off-by: Randy Dunlap Cc: Arnd Bergmann Cc: Niklas Schnelle Cc: Antonino Daplas Cc: Helge Deller Cc: linux-fbdev@vger.kernel.org Cc: dri-devel@lists.freedesktop.org Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Helge Deller commit 2662c7a9c3dcc9613a01c07a9118beb906aa455b Author: Johannes Berg Date: Fri Jun 6 11:02:19 2025 +0200 fbdev: nvidiafb: fix build on 32-bit ARCH=um Now that ARCH=um no longer has IO port accesses, this driver can no longer build as-is. Make the IO port calls not just conditional on i386 but also !UML. Reported-by: Arnd Bergmann Signed-off-by: Johannes Berg Signed-off-by: Helge Deller commit 5345e64760d37524d38ddfa7471f42ec64b0f289 Author: Paul Chaignon Date: Thu Jul 24 19:42:52 2025 +0200 bpf: Simplify bounds refinement from s32 During the bounds refinement, we improve the precision of various ranges by looking at other ranges. Among others, we improve the following in this order (other things happen between 1 and 2): 1. Improve u32 from s32 in __reg32_deduce_bounds. 2. Improve s/u64 from u32 in __reg_deduce_mixed_bounds. 3. Improve s/u64 from s32 in __reg_deduce_mixed_bounds. In particular, if the s32 range forms a valid u32 range, we will use it to improve the u32 range in __reg32_deduce_bounds. In __reg_deduce_mixed_bounds, under the same condition, we will use the s32 range to improve the s/u64 ranges. If at (1) we were able to learn from s32 to improve u32, we'll then be able to use that in (2) to improve s/u64. Hence, as (3) happens under the same precondition as (1), it won't improve s/u64 ranges further than (1)+(2) did. Thus, we can get rid of (3). In addition to the extensive suite of selftests for bounds refinement, this patch was also tested with the Agni formal verification tool [1]. Additionally, Eduard mentioned: The argument appears to be as follows: Under precondition `(u32)reg->s32_min <= (u32)reg->s32_max` __reg32_deduce_bounds produces: reg->u32_min = max_t(u32, reg->s32_min, reg->u32_min); reg->u32_max = min_t(u32, reg->s32_max, reg->u32_max); And then first part of __reg_deduce_mixed_bounds assigns: a. reg->umin umax= (reg->umin & ~0xffffffffULL) | max_t(u32, reg->s32_min, reg->u32_min); b. reg->umax umin= (reg->umax & ~0xffffffffULL) | min_t(u32, reg->s32_max, reg->u32_max); And then second part of __reg_deduce_mixed_bounds assigns: c. reg->umin umax= (reg->umin & ~0xffffffffULL) | (u32)reg->s32_min; d. reg->umax umin= (reg->umax & ~0xffffffffULL) | (u32)reg->s32_max; But assignment (c) is a noop because: max_t(u32, reg->s32_min, reg->u32_min) >= (u32)reg->s32_min Hence RHS(a) >= RHS(c) and umin= does nothing. Also assignment (d) is a noop because: min_t(u32, reg->s32_max, reg->u32_max) <= (u32)reg->s32_max Hence RHS(b) <= RHS(d) and umin= does nothing. Plus the same reasoning for the part dealing with reg->s{min,max}_value: e. reg->smin_value smax= (reg->smin_value & ~0xffffffffULL) | max_t(u32, reg->s32_min_value, reg->u32_min_value); f. reg->smax_value smin= (reg->smax_value & ~0xffffffffULL) | min_t(u32, reg->s32_max_value, reg->u32_max_value); vs g. reg->smin_value smax= (reg->smin_value & ~0xffffffffULL) | (u32)reg->s32_min_value; h. reg->smax_value smin= (reg->smax_value & ~0xffffffffULL) | (u32)reg->s32_max_value; RHS(e) >= RHS(g) and RHS(f) <= RHS(h), hence smax=,smin= do nothing. This appears to be correct. Also, Shung-Hsi: Beside going through the reasoning, I also played with CBMC a bit to double check that as far as a single run of __reg_deduce_bounds() is concerned (and that the register state matches certain handwavy expectations), the change indeed still preserve the original behavior. Signed-off-by: Paul Chaignon Signed-off-by: Daniel Borkmann Reviewed-by: Shung-Hsi Yu Acked-by: Eduard Zingerman Link: https://github.com/bpfverif/agni [1] Link: https://lore.kernel.org/bpf/aIJwnFnFyUjNsCNa@mail.gmail.com commit bf24d64268544379d9a9b5b8efc2bb03967703b3 Author: Thorsten Blum Date: Sun Jul 20 20:26:05 2025 +0200 crypto: keembay - Use min() to simplify ocs_create_linked_list_from_sg() Use min() to simplify ocs_create_linked_list_from_sg() and improve its readability. Signed-off-by: Thorsten Blum Signed-off-by: Herbert Xu commit 982fd1a74de63c388c060e4fa6f7fbd088d6d02e Author: Zhiqi Song Date: Fri Jul 18 18:05:01 2025 +0800 crypto: hisilicon/hpre - fix dma unmap sequence Perform DMA unmapping operations before processing data. Otherwise, there may be unsynchronized data accessed by the CPU when the SWIOTLB is enabled. Signed-off-by: Zhiqi Song Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit 301eee1c52d4b8f4d4d995feb932dae742e92bda Author: Giovanni Cabiddu Date: Thu Jul 17 11:05:43 2025 +0100 crypto: qat - make adf_dev_autoreset() static The function adf_dev_autoreset() is only used within adf_aer.c and does not need to be exposed outside the compilation unit. Make it static and remove it from the header adf_common_drv.h. This does not introduce any functional change. Signed-off-by: Giovanni Cabiddu Reviewed-by: Ahsan Atta Signed-off-by: Herbert Xu commit a71475582ada92ba021852bf3c2b40ab3718549b Author: Arnd Bergmann Date: Mon Jul 14 16:59:12 2025 +0200 crypto: ccp - reduce stack usage in ccp_run_aes_gcm_cmd A number of functions in this file have large structures on the stack, ccp_run_aes_gcm_cmd() being the worst, in particular when KASAN is enabled on gcc: drivers/crypto/ccp/ccp-ops.c: In function 'ccp_run_sha_cmd': drivers/crypto/ccp/ccp-ops.c:1833:1: error: the frame size of 1136 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] drivers/crypto/ccp/ccp-ops.c: In function 'ccp_run_aes_gcm_cmd': drivers/crypto/ccp/ccp-ops.c:914:1: error: the frame size of 1632 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] Avoid the issue by using dynamic memory allocation in the worst one of these. Signed-off-by: Arnd Bergmann Acked-by: Tom Lendacky Signed-off-by: Herbert Xu commit 0fab5ee0d477b3bfe0ff72a78d151a49f72558fa Author: Giovanni Cabiddu Date: Mon Jul 14 08:10:30 2025 +0100 crypto: qat - refactor ring-related debug functions Refactor the functions `adf_ring_start()` and `adf_ring_next()` to improve readability. This does not introduce any functional change. Signed-off-by: Giovanni Cabiddu Reviewed-by: Ahsan Atta Signed-off-by: Herbert Xu commit 6908c5f4f066a0412c3d9a6f543a09fa7d87824b Author: Giovanni Cabiddu Date: Mon Jul 14 08:10:29 2025 +0100 crypto: qat - fix seq_file position update in adf_ring_next() The `adf_ring_next()` function in the QAT debug transport interface fails to correctly update the position index when reaching the end of the ring elements. This triggers the following kernel warning when reading ring files, such as /sys/kernel/debug/qat_c6xx_/transport/bank_00/ring_00: [27725.022965] seq_file: buggy .next function adf_ring_next [intel_qat] did not update position index Ensure that the `*pos` index is incremented before returning NULL when after the last element in the ring is found, satisfying the seq_file API requirements and preventing the warning. Fixes: a672a9dc872e ("crypto: qat - Intel(R) QAT transport code") Signed-off-by: Giovanni Cabiddu Reviewed-by: Ahsan Atta Signed-off-by: Herbert Xu commit d41d75fe1b751ee6b347bf1cb1cfe9accc4fcb12 Author: Giovanni Cabiddu Date: Mon Jul 14 08:07:49 2025 +0100 crypto: qat - fix DMA direction for compression on GEN2 devices QAT devices perform an additional integrity check during compression by decompressing the output. Starting from QAT GEN4, this verification is done in-line by the hardware. However, on GEN2 devices, the hardware reads back the compressed output from the destination buffer and performs a decompression operation using it as the source. In the current QAT driver, destination buffers are always marked as write-only. This is incorrect for QAT GEN2 compression, where the buffer is also read during verification. Since commit 6f5dc7658094 ("iommu/vt-d: Restore WO permissions on second-level paging entries"), merged in v6.16-rc1, write-only permissions are strictly enforced, leading to DMAR errors when using QAT GEN2 devices for compression, if VT-d is enabled. Mark the destination buffers as DMA_BIDIRECTIONAL. This ensures compatibility with GEN2 devices, even though it is not required for QAT GEN4 and later. Signed-off-by: Giovanni Cabiddu Fixes: cf5bb835b7c8 ("crypto: qat - fix DMA transfer direction") Reviewed-by: Ahsan Atta Signed-off-by: Herbert Xu commit 1c44b818b81bf6a111a702536a560f5bc830c6d5 Author: Javier Carrasco Date: Wed Oct 16 06:02:43 2024 +0200 Input: st1232 - add touch-overlay handling Use touch-overlay to support overlay objects such as buttons and a resized frame defined in the device tree. A key event will be generated if the coordinates of a touch event are within the area defined by the button properties. Reviewed-by: Jeff LaBundy Signed-off-by: Javier Carrasco Link: https://lore.kernel.org/r/20241016-feature-ts_virtobj_patch-v11-4-b292a1bbb0a1@wolfvision.net Signed-off-by: Dmitry Torokhov commit 88fb51ea6a38189bed42d302183fbbf6bb03accf Author: Javier Carrasco Date: Wed Oct 16 06:02:42 2024 +0200 dt-bindings: input: touchscreen: st1232: add touch-overlay example The touch-overlay feature adds support for segments (touch areas) on the touchscreen surface that represent overlays with clipped touchscreen areas and printed buttons. Add nodes for a clipped touchscreen and overlay buttons to the existing example. Reviewed-by: Rob Herring Signed-off-by: Javier Carrasco Link: https://lore.kernel.org/r/20241016-feature-ts_virtobj_patch-v11-3-b292a1bbb0a1@wolfvision.net Signed-off-by: Dmitry Torokhov commit ea4d331050b4cd43e6a900937db88b01ef75e1f2 Author: Javier Carrasco Date: Wed Oct 16 06:02:41 2024 +0200 Input: touch-overlay - add touchscreen overlay handling Some touch devices provide mechanical overlays with different objects like buttons or clipped touchscreen surfaces. In order to support these objects, add a series of helper functions to the input subsystem to transform them into overlay objects via device tree nodes. These overlay objects consume the raw touch events and report the expected input events depending on the object properties. Note that the current implementation allows for multiple definitions of touchscreen areas (regions that report touch events), but only the first one will be used for the touchscreen device that the consumers typically provide. Should the need for multiple touchscreen areas arise, additional touchscreen devices would be required at the consumer side. There is no limitation in the number of touch areas defined as buttons. Reviewed-by: Jeff LaBundy Signed-off-by: Javier Carrasco Link: https://lore.kernel.org/r/20241016-feature-ts_virtobj_patch-v11-2-b292a1bbb0a1@wolfvision.net Signed-off-by: Dmitry Torokhov commit 19875ccec01653a897a53db91cd4434c52ef5465 Author: Javier Carrasco Date: Wed Oct 16 06:02:40 2024 +0200 dt-bindings: touchscreen: add touch-overlay property The touch-overlay encompasses a number of touch areas that define a clipped touchscreen area and/or buttons with a specific functionality. A clipped touchscreen area avoids getting events from regions that are physically hidden by overlay frames. For touchscreens with printed overlay buttons, sub-nodes with a suitable key code can be defined to report key events instead of the original touch events. Reviewed-by: Jeff LaBundy Reviewed-by: Rob Herring Signed-off-by: Javier Carrasco Link: https://lore.kernel.org/r/20241016-feature-ts_virtobj_patch-v11-1-b292a1bbb0a1@wolfvision.net Signed-off-by: Dmitry Torokhov commit 17eabb792740cea3f24b236e150f9fee8cd344f3 Author: Werner Sembach Date: Tue Jul 22 14:04:35 2025 +0200 Input: atkbd - correctly map F13 - F24 Currently only F23 is correctly mapped for PS/2 keyboards. According to this table: https://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/translate.pdf - F24 and Zenkaku/Hankaku share the same scancode, but since in real world Zenkaku/Hankaku keys seem to just use the tilde scancode, this patch binds the scancode to F24. Note that on userspace side the KEY_ZENKAKUHANKAKU keycode is currently not bound in xkeyboard-config, so it is (mostly*) unused anyway. * Qt on Wayland and therefore KDE on Wayland can see the keypress anyway for some reason and it is actually used in a touchpad toggle shortcut, but this is currently being fixed in both KDE and xkeyboard-config to make this less weird, so it could directly be fixed to correctly handle the F24 keypress instead. - The scancodes for F13-F22 are currently unmapped so there will probably be no harm in mapping them. This would also fix the issue that some of these keys can't be mapped as the target from userspace using the `setkeycodes` command. Reviewed-by: Hans de Goede Signed-off-by: Werner Sembach Link: https://lore.kernel.org/r/20250722120438.28011-1-wse@tuxedocomputers.com Signed-off-by: Dmitry Torokhov commit e7412ba919f625438c570d8b4fbf16c5f31b583d Author: Vicki Pfau Date: Sun Jul 27 01:19:10 2025 -0700 Input: xpad - use new BTN_GRIP* buttons Map paddles to the newly defined BTN_GRIP* buttons. Signed-off-by: Vicki Pfau Link: https://lore.kernel.org/r/20250702040102.125432-3-vi@endrift.com Signed-off-by: Dmitry Torokhov commit 97c01e65ef4c1878532be245b2899fc4363cc453 Author: Vicki Pfau Date: Sun Jul 27 01:15:17 2025 -0700 Input: Add and document BTN_GRIP* Many controllers these days have started including grip buttons. As there has been no particular assigned BTN_* constants for these, they've been haphazardly assigned to BTN_TRIGGER_HAPPY*. Unfortunately, the assignment of these has varied significantly between drivers. Add and document new constants for these grip buttons. Signed-off-by: Vicki Pfau Link: https://lore.kernel.org/r/20250702040102.125432-2-vi@endrift.com Signed-off-by: Dmitry Torokhov commit a43a503df996739ae34f179f6b73b0ae91000c5c Author: Vicki Pfau Date: Sun Jul 27 01:13:42 2025 -0700 Input: xpad - change buttons the D-Pad gets mapped as to BTN_DPAD_* Since dance pads can have both up/down or left/right pressed at the same time, by design, they are not suitable for mapping the buttons to axes. Historically, this driver mapped the D-pad to BTN_TRIGGER_HAPPY1-4 in these cases, and before that as mouse buttons. However, BTN_DPAD_* exists for this and makes far more sense than the arbitrary mapping it was before. Signed-off-by: Vicki Pfau Link: https://lore.kernel.org/r/20250702034740.124817-1-vi@endrift.com Signed-off-by: Dmitry Torokhov commit 3b19c9ed6f01060e9b58963b581ec41b03104c55 Author: Vicki Pfau Date: Sun Jul 27 00:49:54 2025 -0700 Documentation: Fix capitalization of XBox -> Xbox This also improves the phrasing of "an example" listing two examples. Signed-off-by: Vicki Pfau Link: https://lore.kernel.org/r/20250702034500.124741-1-vi@endrift.com Signed-off-by: Dmitry Torokhov commit 4619b6b97553693be7faf21af0533c24240d1d4f Author: André Apitzsch Date: Sun Jul 27 00:32:14 2025 -0700 Input: synaptics-rmi4 - add support for F1A RMI4 F1A implements capacitive keys. Add support for touch keys found in some Synaptics touch controller configurations. Signed-off-by: André Apitzsch Link: https://lore.kernel.org/r/20250707-rmi4_f1a-v1-2-838d83c72e7f@apitzsch.eu Signed-off-by: Dmitry Torokhov commit a86240a37d43fc22b4e4953242fca8d90df2c555 Author: Arnd Bergmann Date: Sat Jul 26 23:10:43 2025 +0200 gpiolib: enable CONFIG_GPIOLIB_LEGACY even for !GPIOLIB A few drivers that use the legacy GPIOLIB interfaces can be enabled even when GPIOLIB is disabled entirely. With my previous patch this now causes build failures like: drivers/nfc/s3fwrn5/uart.c: In function 's3fwrn82_uart_parse_dt': drivers/nfc/s3fwrn5/uart.c:100:14: error: implicit declaration of function 'gpio_is_valid'; did you mean 'uuid_is_valid'? [-Werror=implicit-function-declaration] These did not show up in my randconfig tests because randconfig almost always has GPIOLIB selected by some other driver, and I did most of the testing with follow-up patches that address the failures properly. Move the symbol outside of the 'if CONFIG_GPIOLIB' block for the moment to avoid the build failures. It can be moved back and turned off by default once all the driver specific changes are merged. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507261934.yIHeUuEQ-lkp@intel.com/ Fixes: 678bae2eaa81 ("gpiolib: make legacy interfaces optional") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250726211053.2226857-1-arnd@kernel.org Signed-off-by: Bartosz Golaszewski commit 0da895952607c03cf0518960692cd1b3439c5d25 Author: André Apitzsch Date: Sun Jul 27 00:31:32 2025 -0700 dt-bindings: input: syna,rmi4: Document F1A function In some configurations the touch controller can support touch keys. Document the linux,keycodes property that enables those keys and specifies the keycodes that should be used to report the key events. Signed-off-by: André Apitzsch Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250707-rmi4_f1a-v1-1-838d83c72e7f@apitzsch.eu Signed-off-by: Dmitry Torokhov commit a9c95d17dc13b8a4c5faa02a6b84ba83af058206 Author: Marge Yang Date: Wed Jul 23 09:16:20 2025 -0700 Input: synaptics-rmi4 - add support for Forcepads (F21) Forcepad devices do not have physical buttons underneath the surface and use F21 to report "clicks" based on touch pressure. Signed-off-by: Marge Yang Link: https://lore.kernel.org/r/20250716033648.1785509-1-marge.yang@tw.synaptics.com Signed-off-by: Dmitry Torokhov commit 7f5e9ca0a424af44a708bb4727624d56f83ecffa Author: Shubhrajyoti Datta Date: Wed Jun 25 11:11:14 2025 +0530 clk: clocking-wizard: Fix the round rate handling for versal Fix the `clk_round_rate` implementation for Versal platforms by calling the Versal-specific divider calculation helper. The existing code used the generic divider routine, which results in incorrect round rate. Fixes: 7681f64e6404 ("clk: clocking-wizard: calculate dividers fractional parts") Signed-off-by: Shubhrajyoti Datta Link: https://lore.kernel.org/r/20250625054114.28273-1-shubhrajyoti.datta@amd.com Signed-off-by: Stephen Boyd commit 264200cc3a87d5c53bfa817227624fa2bae6b2c3 Author: Bjorn Helgaas Date: Wed Jul 23 15:38:10 2025 -0500 clk: Fix typos Fix typos, mostly in comments except CLKGATE_SEPERATED_* (definition and uses updated). Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250723203819.2910289-1-helgaas@kernel.org Signed-off-by: Stephen Boyd commit be72da73e2e638f583014316a2195b0c5ff9ff3a Merge: 19272b37aa4f83 45dd59885ca8d2 Author: Stephen Boyd Date: Sat Jul 26 23:23:58 2025 -0700 Merge tag 'qcom-clk-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into clk-qcom Pull Qualcomm clk driver updates from Bjorn Andersson: - Add global, display, gpu, video, camera, tcsr, and rpmh clock controller for the Qualcomm Milos SoC - Add camera, display, GPU, and video clock controllers for Qualcomm QCS615 - Add the video clock controller for Qualcomm SM6350 - Add a camera clock controller driver for Qualcomm SC8180X - Move Qualcomm PLL configuration to really probe across a variety of platforms, in order to handle the clock controllers powered by multiple power domains. - Replace round_rate() with determine_rate() across the Qualcomm clock implementations - Enable GDSC hardware control for video clock controller GDSCs in a few platforms. - Fix GE PHY reset on Qualcomm IPQ5018, broken NSS port6 frequency table on Qualcomm IPQ8074, add missing video resets on Qualcomm X1E80100 and keep the XO clock always on on Qualcomm IPQ5018. * tag 'qcom-clk-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (65 commits) dt-bindings: clock: qcom,sm4450-dispcc: Reference qcom,gcc.yaml dt-bindings: clock: qcom,sm4450-camcc: Reference qcom,gcc.yaml dt-bindings: clock: qcom,mmcc: Reference qcom,gcc.yaml dt-bindings: clock: qcom,sm8150-camcc: Reference qcom,gcc.yaml dt-bindings: clock: qcom: Remove double colon from description clk: qcom: Add Video Clock controller (VIDEOCC) driver for Milos dt-bindings: clock: qcom: document the Milos Video Clock Controller clk: qcom: Add Graphics Clock controller (GPUCC) driver for Milos dt-bindings: clock: qcom: document the Milos GPU Clock Controller clk: qcom: Add Display Clock controller (DISPCC) driver for Milos dt-bindings: clock: qcom: document the Milos Display Clock Controller clk: qcom: Add Camera Clock controller (CAMCC) driver for Milos dt-bindings: clock: qcom: document the Milos Camera Clock Controller clk: qcom: Add Global Clock controller (GCC) driver for Milos dt-bindings: clock: qcom: document the Milos Global Clock Controller clk: qcom: common: Add support to register rcg dfs in qcom_cc_really_probe clk: qcom: gcc-x1e80100: Add missing video resets dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets clk: qcom: videocc-sm8550: Add separate frequency tables for X1E80100 clk: qcom: videocc-sm8550: Allow building without SM8550/SM8560 GCC ... commit b91a9abbf4734d411d304661fbb7e2878281eb51 Author: Ian Rogers Date: Fri Jul 25 11:51:53 2025 -0700 perf list: Skip ABI PMUs when printing pmu values Avoid printing tracepoint, legacy and software events when listing for the pmu option. Add the PMU type to the print_event callbacks to ease detection. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250725185202.68671-8-irogers@google.com Signed-off-by: Namhyung Kim commit 55c09681cc67d175bd62b787c8b6eeafbe1b5851 Author: Ian Rogers Date: Fri Jul 25 11:51:52 2025 -0700 perf list: Remove tracepoint printing code Now that the tp_pmu can iterate and describe events remove the custom tracepoint printing logic, this avoids perf list showing the tracepoint events twice. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250725185202.68671-7-irogers@google.com Signed-off-by: Namhyung Kim commit 45b6e281cb0648acd04f896375de69481d29daa7 Author: Ian Rogers Date: Fri Jul 25 11:51:51 2025 -0700 perf tp_pmu: Add event APIs Add event APIs for the tracepoint PMU allowing things like perf list to function using it. For perf list add the tracepoint format in the long description (shown with -v). $ sudo perf list -v tracepoint List of pre-defined events (to be used in -e or -M): alarmtimer:alarmtimer_cancel [Tracepoint event] [name: alarmtimer_cancel ID: 416 format: field:unsigned short common_type; offset:0; size:2; signed:0; field:unsigned char common_flags; offset:2; size:1; signed:0; field:unsigned char common_preempt_count; offset:3; size:1; signed:0; field:int common_pid; offset:4; size:4; signed:1; field:void * alarm; offset:8; size:8; signed:0; field:unsigned char alarm_type; offset:16; size:1; signed:0; field:s64 expires; offset:24; size:8; signed:1; field:s64 now; offset:32; size:8; signed:1; print fmt: "alarmtimer:%p type:%s expires:%llu now:%llu",REC->alarm,__print_flags((1 << REC->alarm_type)," | ",{ 1 << 0, "REALTIME" },{ 1 << 1,"BOOTTIME" },{ 1 << 3,"REALTIME Freezer" },{ 1 << 4,"BOOTTIME Freezer" }),REC->expires,REC->now . Unit: tracepoint] alarmtimer:alarmtimer_fired [Tracepoint event] [name: alarmtimer_fired ID: 418 ... Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250725185202.68671-6-irogers@google.com Signed-off-by: Namhyung Kim commit d002aab87de84b26c6f0a2b9549a589105d00d35 Author: Ian Rogers Date: Fri Jul 25 11:51:50 2025 -0700 perf tp_pmu: Factor existing tracepoint logic to new file Start the creation of a tracepoint PMU abstraction. Tracepoint events don't follow the regular sysfs perf conventions. Eventually the new PMU abstraction will bridge the gap so tracepoint events look more like regular perf ones. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250725185202.68671-5-irogers@google.com Signed-off-by: Namhyung Kim commit 6e9fa4131abb0129b1153ba6d194bd294b9f9986 Author: Ian Rogers Date: Fri Jul 25 11:51:49 2025 -0700 perf parse-events: Remove non-json software events Remove the hard coded encodings from parse-events. This has the consequence that software events are matched using the sysfs/json priority, will be case insensitive and will be wildcarded across PMUs. As there were software and hardware types in the parsing code, the removal means software vs hardware logic can be removed and hardware assumed. Now the perf json provides detailed descriptions of software events, remove the previous listing support that didn't contain event descriptions. When globbing is required for the "sw" option in perf list, use string PMU globbing as was done previously for the tool PMU. The output of `perf list sw` command changed like this. Before: List of pre-defined events (to be used in -e or -M): alignment-faults [Software event] bpf-output [Software event] cgroup-switches [Software event] context-switches OR cs [Software event] cpu-clock [Software event] cpu-migrations OR migrations [Software event] dummy [Software event] emulation-faults [Software event] major-faults [Software event] minor-faults [Software event] page-faults OR faults [Software event] task-clock [Software event] After: List of pre-defined events (to be used in -e or -M): software: alignment-faults [Number of kernel handled memory alignment faults. Unit: software] bpf-output [An event used by BPF programs to write to the perf ring buffer. Unit: software] cgroup-switches [Number of context switches to a task in a different cgroup. Unit: software] context-switches [Number of context switches [This event is an alias of cs]. Unit: software] cpu-clock [Per-CPU high-resolution timer based event. Unit: software] cpu-migrations [Number of times a process has migrated to a new CPU [This event is an alias of migrations]. Unit: software] cs [Number of context switches [This event is an alias of context-switches]. Unit: software] dummy [A placeholder event that doesn't count anything. Unit: software] ... Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250725185202.68671-4-irogers@google.com Signed-off-by: Namhyung Kim commit 9957d8c801fe0cb905a9443d7a88e6a051f81105 Author: Ian Rogers Date: Fri Jul 25 11:51:48 2025 -0700 perf jevents: Add common software event json Add json for software events so that in perf list the events can have a description. Common json exists for the tool PMU but it has no sysfs equivalent. Modify the map_for_pmu code to return the common map (rather than an architecture specific one) when a PMU with a common name is being looked for, this allows the events to be found. Signed-off-by: Ian Rogers Tested-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250725185202.68671-3-irogers@google.com Signed-off-by: Namhyung Kim commit af470fb532fc803c4c582d15b4bd394682a77a15 Author: Chen Pei Date: Sat Jul 26 19:15:32 2025 +0800 perf tools: Remove libtraceevent in .gitignore The libtraceevent has been removed from the source tree, and .gitignore needs to be updated as well. Fixes: 4171925aa9f3f7bf ("tools lib traceevent: Remove libtraceevent") Signed-off-by: Chen Pei Link: https://lore.kernel.org/r/20250726111532.8031-1-cp0613@linux.alibaba.com Signed-off-by: Namhyung Kim commit d89c58068aa667295fa75d0613c869b612bd6249 Author: Blake Jones Date: Fri Jul 25 17:40:23 2025 -0700 perf test: Fix comment ordering The previous commit that introduced this test overlooked a behavior of "perf test list", causing it to print "SPDX-License-Identifier: GPL-2.0" as a description for that test. This reorders the comments to fix that issue. Fixes: edf2cadf01e8 ("perf test: add test for BPF metadata collection") Signed-off-by: Blake Jones Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250726004023.3466563-1-blakejones@google.com [ update the commit message a little bit ] Signed-off-by: Namhyung Kim commit 95f610e36adc74f3972e31c28567d66777ce37f3 Author: Alexandre Belloni Date: Thu Jul 24 11:04:19 2025 +0200 rtc: pcf85063: scope pcf85063_config structures Fix possible warning: >> drivers/rtc/rtc-pcf85063.c:566:37: warning: unused variable 'config_rv8063' [-Wunused-const-variable] 566 | static const struct pcf85063_config config_rv8063 = { | ^~~~~~~~~~~~~ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507241607.dmz2qrO5-lkp@intel.com/ Link: https://lore.kernel.org/r/20250724090420.917705-1-alexandre.belloni@bootlin.com Signed-off-by: Alexandre Belloni commit af915c3c13b64d196d1c305016092f5da20942c4 Author: Joshua Hahn Date: Fri Jul 25 10:56:15 2025 -0700 MAINTAINERS: add missing headers to mempory policy & migration section These two files currently do not belong to any section. The memory policy & migration section seems to be a good home for them! Link: https://lkml.kernel.org/r/20250725175616.2397031-1-joshua.hahnjy@gmail.com Signed-off-by: Joshua Hahn Acked-by: David Hildenbrand Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Lorenzo Stoakes Cc: Mathew Brost Cc: Rakie Kim Cc: Zi Yan Signed-off-by: Andrew Morton commit 1729003f284d5f8f1bdd0c7e591b94003ebfb1dd Author: Lorenzo Stoakes Date: Thu Jul 24 14:54:21 2025 +0100 MAINTAINERS: add missing file to cgroup section The page_counter files seems most appropriately placed here. Link: https://lkml.kernel.org/r/20250724135421.54510-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Shakeel Butt Cc: Alistair Popple Cc: Christoph Lameter (Ampere) Cc: Dave Chinner Cc: David Hildenbrand Cc: Dennis Zhou Cc: Dev Jain Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport (Microsoft) Cc: Muchun Song Cc: Nico Pache Cc: Oscar Salvador Cc: Pedro Falcato Cc: Qi Zheng Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Vlastimil Babka Cc: Zi Yan Cc: Joshua Hahn Signed-off-by: Andrew Morton commit e23210425c594b0d58c5bae4a955346c2a7b6b1c Author: Lorenzo Stoakes Date: Thu Jul 24 14:33:56 2025 +0100 MAINTAINERS: add MM MISC section, add missing files to MISC and CORE Add a MEMORY MANAGEMENT - MISC section to contain files that are not described by other sections, moving all but the catch-all mm/ and tools/mm/ from MEMORY MANAGEMENT to MEMORY MANAGEMENT - CORE and MEMORY MANAGEMENT - MISC as appropriate. In both sections add remaining missing files. At this point, with the other recent MAINTAINERS changes, this should now mean that every memory management-related file has a section and assigned maintainers/reviewers. Finally, we copy across the maintainers/reviewers from MEMORY MANAGEMENT - CORE to MEMORY MANAGEMENT - MISC, as it seems the two are sufficiently related for this to be sensible. Link: https://lkml.kernel.org/r/20250724133356.49487-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Mike Rapoport (Microsoft) Acked-by: Vlastimil Babka Cc: David Hildenbrand Cc: Liam Howlett Cc: Michal Hocko Cc: Suren Baghdasaryan Cc: Alistair Popple Cc: Christoph Lameter (Ampere) Cc: Dave Chinner Cc: Dennis Zhou Cc: Dev Jain Cc: Jann Horn Cc: Muchun Song Cc: Nico Pache Cc: Oscar Salvador Cc: Pedro Falcato Cc: Qi Zheng Cc: Roman Gushchin Cc: Shakeel Butt Cc: Tejun Heo Cc: Zi Yan Cc: Joshua Hahn Signed-off-by: Andrew Morton commit a5c9fcb18c5a94932a50e2ce1549c8c2396530c4 Author: Lorenzo Stoakes Date: Tue Jul 22 19:18:27 2025 +0100 MAINTAINERS: add missing zsmalloc file The mm/zpdesc.h file is only included by mm/zsmalloc.c so the zsmalloc section seems the most appropriate place for this file. Link: https://lkml.kernel.org/r/20250722181827.156035-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Christoph Lameter (Ampere) Cc: Dave Chinner Cc: David Hildenbrand Cc: Dennis Zhou Cc: Dev Jain Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Nico Pache Cc: Oscar Salvador Cc: Pedro Falcato Cc: Qi Zheng Cc: Roman Gushchin Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Vlastimil Babka Cc: Zi Yan Cc: Shakeel Butt Cc: Joshua Hahn Signed-off-by: Andrew Morton commit 2656a75ca140710b7cc78f3c495dd9660f78a2c3 Author: Lorenzo Stoakes Date: Tue Jul 22 18:41:43 2025 +0100 MAINTAINERS: add missing files to page alloc section There are a couple of mm/-specific header files that were accidentally missed previously, and some page ref debug code also that ought to live here. Link: https://lkml.kernel.org/r/20250722174143.147143-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Zi Yan Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Cc: Alistair Popple Cc: Christoph Lameter (Ampere) Cc: Dave Chinner Cc: Dennis Zhou Cc: Jann Horn Cc: Liam Howlett Cc: Muchun Song Cc: Nico Pache Cc: Oscar Salvador Cc: Qi Zheng Cc: Roman Gushchin Cc: Tejun Heo Cc: Dev Jain Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Shakeel Butt Cc: Joshua Hahn Signed-off-by: Andrew Morton commit c3ef2cc69596f2cfb1546d6428ca906dd2cc13ea Author: Lorenzo Stoakes Date: Tue Jul 22 18:34:36 2025 +0100 MAINTAINERS: add missing shrinker files The mm/list_lru.[ch] files implement a shrinker-specific data structure so seem most suited to the SHRINKER section. Link: https://lkml.kernel.org/r/20250722173436.145526-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Qi Zheng Cc: Dave Chinner Cc: Muchun Song Cc: Roman Gushchin Cc: Alistair Popple Cc: Christoph Lameter (Ampere) Cc: David Hildenbrand Cc: Dennis Zhou Cc: Jann Horn Cc: Liam Howlett Cc: Nico Pache Cc: Oscar Salvador Cc: Tejun Heo Cc: Vlastimil Babka Cc: Zi Yan Cc: Dev Jain Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Shakeel Butt Cc: Joshua Hahn Signed-off-by: Andrew Morton commit 2011011ad6aee2d4366402d91a856a9c9f377252 Author: Lorenzo Stoakes Date: Tue Jul 22 18:22:58 2025 +0100 MAINTAINERS: move memremap.[ch] to hotplug section This seems to be the most appropriate place for these files. Link: https://lkml.kernel.org/r/20250722172258.143488-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Alistair Popple Cc: Oscar Salvador Cc: Christoph Lameter (Ampere) Cc: Dennis Zhou Cc: Tejun Heo Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Cc: Dave Chinner Cc: Muchun Song Cc: Nico Pache Cc: Qi Zheng Cc: Roman Gushchin Cc: Zi Yan Cc: Dev Jain Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Shakeel Butt Cc: Joshua Hahn Signed-off-by: Andrew Morton commit 651ad43d56d1bae6aa37d313339ce756b5303a67 Author: Lorenzo Stoakes Date: Tue Jul 22 18:19:04 2025 +0100 MAINTAINERS: add missing mm_slot.h file THP section This seems to be the most appropriate place for this file. [lorenzo.stoakes@oracle.com: also add mm_slot.h to KSM section] Link: https://lkml.kernel.org/r/685747e2-a8cb-4620-a0c0-5cd9048d69b8@lucifer.local Link: https://lkml.kernel.org/r/20250722171904.142306-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Zi Yan Acked-by: Nico Pache Acked-by: David Hildenbrand Acked-by: Dev Jain Acked-by: Qi Zheng Cc: Alistair Popple Cc: Christoph Lameter (Ampere) Cc: Dave Chinner Cc: Dennis Zhou Cc: Jann Horn Cc: Liam Howlett Cc: Muchun Song Cc: Oscar Salvador Cc: Roman Gushchin Cc: Tejun Heo Cc: Vlastimil Babka Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Shakeel Butt Cc: Joshua Hahn Signed-off-by: Andrew Morton commit 85c16ee6faa1f12289b9b84ab552f55dc4aad89c Author: Lorenzo Stoakes Date: Tue Jul 22 18:15:28 2025 +0100 MAINTAINERS: add missing interval_tree.c to memory mapping section This seems to be the best place for this file. Link: https://lkml.kernel.org/r/20250722171528.141083-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Vlastimil Babka Acked-by: Pedro Falcato Cc: Alistair Popple Cc: Christoph Lameter (Ampere) Cc: Dave Chinner Cc: David Hildenbrand Cc: Dennis Zhou Cc: Jann Horn Cc: Liam Howlett Cc: Muchun Song Cc: Nico Pache Cc: Oscar Salvador Cc: Qi Zheng Cc: Roman Gushchin Cc: Tejun Heo Cc: Zi Yan Cc: Dev Jain Cc: Michal Hocko Cc: Mike Rapoport Cc: Suren Baghdasaryan Cc: Shakeel Butt Cc: Joshua Hahn Signed-off-by: Andrew Morton commit 44d10df2007a3081ae45bbf81a96b077b48db6a2 Author: Lorenzo Stoakes Date: Tue Jul 22 18:10:23 2025 +0100 MAINTAINERS: add missing percpu-internal.h file to per-cpu section This file seems to most appropriately belong to the PER-CPU MEMORY ALLOCATOR section, so place it there. Link: https://lkml.kernel.org/r/20250722171023.139777-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Christoph Lameter (Ampere) Cc: Dave Chinner Cc: David Hildenbrand Cc: Dennis Zhou Cc: Jann Horn Cc: Liam Howlett Cc: Muchun Song Cc: Nico Pache Cc: Oscar Salvador Cc: Qi Zheng Cc: Roman Gushchin Cc: Tejun Heo Cc: Vlastimil Babka Cc: Zi Yan Cc: Dev Jain Cc: Michal Hocko Cc: Mike Rapoport Cc: Pedro Falcato Cc: Suren Baghdasaryan Cc: Shakeel Butt Cc: Joshua Hahn Signed-off-by: Andrew Morton commit 48e6561b667e7f0623da3ca34e2b93b7ae2a5d8d Author: Zi Yan Date: Tue Jul 22 15:46:49 2025 -0400 mm/page_alloc: remove trace_mm_alloc_contig_migrate_range_info() The trace event has not recorded the right data since it was introduced at commit c8b360031218 ("mm: add alloc_contig_migrate_range allocation statistics"). Remove it. Link: https://lkml.kernel.org/r/20250722194649.4135191-1-ziy@nvidia.com Signed-off-by: Zi Yan Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507220742.P3SaKlI6-lkp@intel.com/ Acked-by: David Hildenbrand Acked-by: Vlastimil Babka Cc: Brendan Jackman Cc: David Rientjes Cc: Johannes Weiner Cc: Martin Liu Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Michal Hocko Cc: Richard Chang Cc: Steven Rostedt Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 511914506d194be931de012a5f2ab55841b9b708 Author: Enze Li Date: Fri Jul 18 14:42:17 2025 +0800 selftests/damon: introduce _common.sh to host shared function The current test scripts contain duplicated root permission checks in multiple locations. This patch consolidates these checks into _common.sh to eliminate code redundancy. Link: https://lkml.kernel.org/r/20250718064217.299300-1-lienze@kylinos.cn Signed-off-by: Enze Li Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit da5973a0b8e0370f9e309c60e35a4d4d4dfe32fc Author: SeongJae Park Date: Sun Jul 20 10:16:52 2025 -0700 selftests/damon/sysfs.py: test runtime reduction of DAMON parameters sysfs.py is testing if non-default additional parameters can be committed. Add a test case for further reducing the parameters to the default set. Link: https://lkml.kernel.org/r/20250720171652.92309-23-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 62b7b1ffa2dd242253480ffcd12c96c4b7ef8fb6 Author: SeongJae Park Date: Sun Jul 20 10:16:51 2025 -0700 selftests/damon/sysfs.py: test non-default parameters runtime commit sysfs.py is testing only the default and minimum DAMON parameters. Add another test case for more non-default additional DAMON parameters commitment on runtime. Link: https://lkml.kernel.org/r/20250720171652.92309-22-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 16797a55aab118c5fa9236604aa2142f1121f136 Author: SeongJae Park Date: Sun Jul 20 10:16:50 2025 -0700 selftests/damon/sysfs.py: generalize DAMON context commit assertion DAMON context commitment assertion is hard-coded for a specific test case. Split it out into a general version that can be reused for different test cases. Link: https://lkml.kernel.org/r/20250720171652.92309-21-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit a4027b5f24282b4aab5cee1b63b4267d27b6c686 Author: SeongJae Park Date: Sun Jul 20 10:16:49 2025 -0700 selftests/damon/sysfs.py: generalize monitoring attributes commit assertion DAMON monitoring attributes commitment assertion is hard-coded for a specific test case. Split it out into a general version that can be reused for different test cases. Link: https://lkml.kernel.org/r/20250720171652.92309-20-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 771d7754ab28597c0370a588887f50db229d1c0d Author: SeongJae Park Date: Sun Jul 20 10:16:48 2025 -0700 selftests/damon/sysfs.py: generalize DAMOS schemes commit assertion DAMOS schemes commitment assertion is hard-coded for a specific test case. Split it out into a general version that can be reused for different test cases. Link: https://lkml.kernel.org/r/20250720171652.92309-19-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 53f800581f79555e84aeabff81a90cf954803b83 Author: SeongJae Park Date: Sun Jul 20 10:16:47 2025 -0700 selftests/damon/sysfs.py: test DAMOS filters commitment Current DAMOS scheme commitment assertion is not testing DAMOS filters. Add the test. Link: https://lkml.kernel.org/r/20250720171652.92309-18-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit f22ff7b5a5baf7dc3326948e50781067f9aebb3c Author: SeongJae Park Date: Sun Jul 20 10:16:46 2025 -0700 selftests/damon/sysfs.py: generalize DAMOS scheme commit assertion DAMOS scheme commitment assertion is hard-coded for a specific test case. Split it out into a general version that can be reused for different test cases. Link: https://lkml.kernel.org/r/20250720171652.92309-17-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit bd0487a7745ea84fb0ece7fd796ad51a92a12c70 Author: SeongJae Park Date: Sun Jul 20 10:16:45 2025 -0700 selftests/damon/sysfs.py: test DAMOS destinations commitment Current DAMOS commitment assertion is not testing quota destinations commitment. Add the test. Link: https://lkml.kernel.org/r/20250720171652.92309-16-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 84dc442bd552f3e0b9abc6f1531431beaea68518 Author: SeongJae Park Date: Sun Jul 20 10:16:44 2025 -0700 selftests/damon/sysfs.py: test quota goal commitment Current DAMOS quota commitment assertion is not testing quota goal commitment. Add the test. Link: https://lkml.kernel.org/r/20250720171652.92309-15-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit f797e709f741d5a28e4f3ca2592e5cc1d7e21e3b Author: SeongJae Park Date: Sun Jul 20 10:16:43 2025 -0700 selftests/damon/sysfs.py: generalize DamosQuota commit assertion DamosQuota commitment assertion is hard-coded for a specific test case. Split it out into a general version that can be reused for different test cases. Link: https://lkml.kernel.org/r/20250720171652.92309-14-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit b50c48de6111bc70731ba375e1b45a65e63e287f Author: SeongJae Park Date: Sun Jul 20 10:16:42 2025 -0700 selftests/damon/sysfs.py: generalize DAMOS Watermarks commit assertion DamosWatermarks commitment assertion is hard-coded for a specific test case. Split it out into a general version that can be reused for different test cases. Link: https://lkml.kernel.org/r/20250720171652.92309-13-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit a1d52cd0302d7aefe26edbbccd1d1ae70cca50c9 Author: SeongJae Park Date: Sun Jul 20 10:16:41 2025 -0700 selftests/damon/drgn_dump_damon_status: dump DAMOS filters drgn_dump_damon_status.py is a script for dumping DAMON internal status in json format. It is being used for seeing if DAMON parameters that are set using _damon_sysfs.py are actually passed to DAMON in the kernel space. It is, however, not dumping full DAMON internal status, and it makes increasing test coverage difficult. Add damos filters dumping for more tests. Link: https://lkml.kernel.org/r/20250720171652.92309-12-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit eb413daaf222b1d545f6b46253f0ace97195ccd4 Author: SeongJae Park Date: Sun Jul 20 10:16:40 2025 -0700 selftests/damon/drgn_dump_damon_status: dump ctx->ops.id drgn_dump_damon_status.py is a script for dumping DAMON internal status in json format. It is being used for seeing if DAMON parameters that are set using _damon_sysfs.py are actually passed to DAMON in the kernel space. It is, however, not dumping full DAMON internal status, and it makes increasing test coverage difficult. Add ctx->ops.id dumping for more tests. Link: https://lkml.kernel.org/r/20250720171652.92309-11-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit c1a69589571270f70f1995d88e41b2e262ad05ab Author: SeongJae Park Date: Sun Jul 20 10:16:39 2025 -0700 selftests/damon/drgn_dump_damon_status: dump damos->migrate_dests drgn_dump_damon_status.py is a script for dumping DAMON internal status in json format. It is being used for seeing if DAMON parameters that are set using _damon_sysfs.py are actually passed to DAMON in the kernel space. It is, however, not dumping full DAMON internal status, and it makes increasing test coverage difficult. Add damos->migrate_dests dumping for more tests. Link: https://lkml.kernel.org/r/20250720171652.92309-10-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 80d4e381075f5e454482c76aeaaafbbd76994aeb Author: SeongJae Park Date: Sun Jul 20 10:16:38 2025 -0700 selftests/damon/_damon_sysfs: use 2**32 - 1 as max nr_accesses and age nr_accesses and age are unsigned int. Use the proper max value. Link: https://lkml.kernel.org/r/20250720171652.92309-9-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 86e541f0be477d4656a02c5438c5034eae814c23 Author: SeongJae Park Date: Sun Jul 20 10:16:37 2025 -0700 selftests/damon/_damon_sysfs: support DAMOS target_nid setup _damon_sysfs.py contains code for test-purpose DAMON sysfs interface control. Add support of DAMOS action destination target_nid setup for more tests. Link: https://lkml.kernel.org/r/20250720171652.92309-8-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit fca6ddf44df477d7ecaac4840b15da635798f1eb Author: SeongJae Park Date: Sun Jul 20 10:16:36 2025 -0700 selftests/damon/_damon_sysfs: support DAMOS action dests setup _damon_sysfs.py contains code for test-purpose DAMON sysfs interface control. Add support of DAMOS action destinations setup for more tests. Link: https://lkml.kernel.org/r/20250720171652.92309-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 229b0af6640704bb709fae356108c11d6e63058d Author: SeongJae Park Date: Sun Jul 20 10:16:35 2025 -0700 selftests/damon/_damon_sysfs: support DAMOS quota goal nid setup _damon_sysfs.py contains code for test-purpose DAMON sysfs interface control. Add support of DAMOS quota goal nid setup for more tests. Link: https://lkml.kernel.org/r/20250720171652.92309-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit ff5aae307bfb789c9e9c4564bc19d5393aa2fc43 Author: SeongJae Park Date: Sun Jul 20 10:16:34 2025 -0700 selftests/damon/_damon_sysfs: support DAMOS quota weights setup _damon_sysfs.py contains code for test-purpose DAMON sysfs interface control. Add support of DAMOS quotas prioritization weights setup for more tests. Link: https://lkml.kernel.org/r/20250720171652.92309-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit b436dfaad2ba7bf5061017248ee595f299074610 Author: SeongJae Park Date: Sun Jul 20 10:16:33 2025 -0700 selftests/damon/_damon_sysfs: support monitoring intervals goal setup _damon_sysfs.py contains code for test-purpose DAMON sysfs interface control. Add support of the monitoring intervals auto-tune goal setup for more tests. Link: https://lkml.kernel.org/r/20250720171652.92309-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 9d93c103edf0cdf7f1f251b943799a7fee56a580 Author: SeongJae Park Date: Sun Jul 20 10:16:32 2025 -0700 selftests/damon/_damon_sysfs: support DAMOS filters setup _damon_sysfs.py contains code for test-purpose DAMON sysfs interface control. Add support of DAMOS filters setup for more tests. Link: https://lkml.kernel.org/r/20250720171652.92309-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 6da5e2961f3a1f350ec974b0c56374015b1c8fc1 Author: SeongJae Park Date: Sun Jul 20 10:16:31 2025 -0700 selftests/damon/_damon_sysfs: support DAMOS watermarks setup Patch series "selftests/damon/sysfs.py: test all parameters". sysfs.py tests if DAMON sysfs interface is passing the user-requested parameters to DAMON as expected. But only the default (minimum) parameters are being tested. This is partially because _damon_sysfs.py, which is the library for making the parameter requests, is not supporting the entire parameters. The internal DAMON status dump script (drgn_dump_damon_status.py) is also not dumping entire parameters. Extend the test coverage by updating parameters input and status dumping scripts to support all parameters, and writing additional tests using those. This increased test coverage actually found one real bug (https://lore.kernel.org/20250719181932.72944-1-sj@kernel.org). First seven patches (1-7) extend _damon_sysfs.py for all parameters setup. The eight patch (8) fixes _damon_sysfs.py to use correct max nr_acceses and age values for their type. Following three patches (9-11) extend drgn_dump_damon_status.py to dump full DAMON parameters. Following nine patches (12-20) refactor sysfs.py for general testing code reuse, and extend it for full parameters check. Finally, two patches (21 and 22) add test cases in sysfs.py for full parameters testing. This patch (of 22): _damon_sysfs.py contains code for test-purpose DAMON sysfs interface control. Add support of DAMOS watermarks setup for more tests. Link: https://lkml.kernel.org/r/20250720171652.92309-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250720171652.92309-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit cf20cb9ad1eb3bf59ede1f93a0640f06e6b9d028 Author: SeongJae Park Date: Mon Jul 21 23:03:30 2025 -0700 selftests/damon/sysfs.py: stop DAMON for dumping failures Commit 4ece01897627 ("selftests/damon: add python and drgn-based DAMON sysfs test") in mm-stable tree introduced sysfs.py that runs drgn for dumping DAMON status. When the DAMON status dumping fails for reasons including drgn uninstalled environment, the test fails without stopping DAMON. Following DAMON selftests that assumes DAMON is not running when they executed therefore fail. Catch dumping failures and stop DAMON for that case. Link: https://lkml.kernel.org/r/20250722060330.56068-1-sj@kernel.org Fixes: 4ece01897627 ("selftests/damon: add python and drgn-based DAMON sysfs test") Signed-off-by: SeongJae Park Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202507220707.9c5d6247-lkp@intel.com Cc: Shuah Khan Signed-off-by: Andrew Morton commit 32e42ab9fc88a884435c27527a433f61c4d2b61b Author: Kees Cook Date: Sat Jul 26 00:29:54 2025 -0700 sched/task_stack: Add missing const qualifier to end_of_stack() Add missing const qualifier to the non-CONFIG_THREAD_INFO_IN_TASK version of end_of_stack() to match the CONFIG_THREAD_INFO_IN_TASK version. Fixes a warning with CONFIG_KSTACK_ERASE=y on archs that don't select THREAD_INFO_IN_TASK (such as LoongArch): error: passing 'const struct task_struct *' to parameter of type 'struct task_struct *' discards qualifiers The stackleak_task_low_bound() function correctly uses a const task parameter, but the legacy end_of_stack() prototype didn't like that. Build tested on loongarch (with CONFIG_KSTACK_ERASE=y) and m68k (with CONFIG_DEBUG_STACK_USAGE=y). Fixes: a45728fd4120 ("LoongArch: Enable HAVE_ARCH_STACKLEAK") Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/all/20250726004313.GA3650901@ax162 Cc: Youling Tang Cc: Huacai Chen Tested-by: Nathan Chancellor Signed-off-by: Kees Cook commit a8f0b1f8ef628bd1003eed650862836e97b89fdd Author: Kees Cook Date: Wed Jul 23 22:50:28 2025 -0700 kstack_erase: Support Clang stack depth tracking Wire up CONFIG_KSTACK_ERASE to Clang 21's new stack depth tracking callback[1] option. Link: https://clang.llvm.org/docs/SanitizerCoverage.html#tracing-stack-depth [1] Acked-by: Nicolas Schier Link: https://lore.kernel.org/r/20250724055029.3623499-4-kees@kernel.org Signed-off-by: Kees Cook commit 6676fd3c99b016b9102c584e8b6dfcfad4fa059e Author: Kees Cook Date: Sat Jul 26 02:35:49 2025 -0700 kstack_erase: Add -mgeneral-regs-only to silence Clang warnings Once CONFIG_KSTACK_ERASE is enabled with Clang on i386, the build warns: kernel/kstack_erase.c:168:2: warning: function with attribute 'no_caller_saved_registers' should only call a function with attribute 'no_caller_saved_registers' or be compiled with '-mgeneral-regs-only' [-Wexcessive-regsave] Add -mgeneral-regs-only for the kstack_erase handler, to make Clang feel better (it is effectively a no-op flag for the kernel). No binary changes encountered. Build & boot tested with Clang 21 on x86_64, and i386. Build tested with GCC 14.2.0 on x86_64, i386, arm64, and arm. Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/all/20250726004313.GA3650901@ax162 Tested-by: Nathan Chancellor Signed-off-by: Kees Cook commit 381a38ea53d25ed6f93ba007b021db86c2a36bc6 Author: Kees Cook Date: Wed Jul 23 22:50:27 2025 -0700 init.h: Disable sanitizer coverage for __init and __head While __noinstr already contained __no_sanitize_coverage, it needs to be added to __init and __head section markings to support the Clang implementation of CONFIG_KSTACK_ERASE. This is to make sure the stack depth tracking callback is not executed in unsupported contexts. The other sanitizer coverage options (trace-pc and trace-cmp) aren't needed in __head nor __init either ("We are interested in code coverage as a function of a syscall inputs"[1]), so this is fine to disable for them as well. Link: https://web.git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/kcov.c?h=v6.14#n179 [1] Acked-by: Marco Elver Link: https://lore.kernel.org/r/20250724055029.3623499-3-kees@kernel.org Signed-off-by: Kees Cook commit 431a380f935e2c74cbaeac65367c70fc18903315 Author: Kees Cook Date: Fri Jul 25 23:44:26 2025 -0700 kstack_erase: Disable kstack_erase for all of arm compressed boot code When building with CONFIG_KSTACK_ERASE=y and CONFIG_ARM_ATAG_DTB_COMPAT=y, the compressed boot environment encounters an undefined symbol error: ld.lld: error: undefined symbol: __sanitizer_cov_stack_depth >>> referenced by atags_to_fdt.c:135 This occurs because the compiler instruments the atags_to_fdt() function with sanitizer coverage calls, but the minimal compressed boot environment lacks access to sanitizer runtime support. The compressed boot environment already disables stack protector with -fno-stack-protector. Similarly disable sanitizer coverage by adding $(DISABLE_KSTACK_ERASE) to the general compiler flags (and remove it from the one place it was noticed before), which contains the appropriate flags to prevent sanitizer instrumentation. This follows the same pattern used in other early boot contexts where sanitizer runtime support is unavailable. Reported-by: Linux Kernel Functional Testing Closes: https://lore.kernel.org/all/CA+G9fYtBk8qnpWvoaFwymCx5s5i-5KXtPGpmf=_+UKJddCOnLA@mail.gmail.com Reported-by: Nathan Chancellor Closes: https://lore.kernel.org/all/20250726004313.GA3650901@ax162 Suggested-by: Nathan Chancellor Tested-by: Nathan Chancellor Signed-off-by: Kees Cook commit e9f545d0d336b37ece594a0bfd8d2d13ccbed6ab Author: Puranjay Mohan Date: Thu Jul 24 12:02:55 2025 +0000 selftests/bpf: Enable private stack tests for arm64 As arm64 JIT now supports private stack, make sure all relevant tests run on arm64 architecture. Relevant tests: #415/1 struct_ops_private_stack/private_stack:OK #415/2 struct_ops_private_stack/private_stack_fail:OK #415/3 struct_ops_private_stack/private_stack_recur:OK #415 struct_ops_private_stack:OK #549/1 verifier_private_stack/Private stack, single prog:OK #549/2 verifier_private_stack/Private stack, subtree > MAX_BPF_STACK:OK #549/3 verifier_private_stack/No private stack:OK #549/4 verifier_private_stack/Private stack, callback:OK #549/5 verifier_private_stack/Private stack, exception in mainprog:OK #549/6 verifier_private_stack/Private stack, exception in subprog:OK #549/7 verifier_private_stack/Private stack, async callback, not nested:OK #549/8 verifier_private_stack/Private stack, async callback, potential nesting:OK #549 verifier_private_stack:OK Summary: 2/11 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Puranjay Mohan Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20250724120257.7299-4-puranjay@kernel.org commit 6c17a882d3804dce1c66e1fec25f96d39a184067 Author: Puranjay Mohan Date: Thu Jul 24 12:02:54 2025 +0000 bpf, arm64: JIT support for private stack The private stack is allocated in bpf_int_jit_compile() with 16-byte alignment. It includes additional guard regions to detect stack overflows and underflows at runtime. Memory layout: +------------------------------------------------------+ | | | 16 bytes padding (overflow guard - stack top) | | [ detects writes beyond top of stack ] | BPF FP ->+------------------------------------------------------+ | | | BPF private stack (sized by verifier) | | [ 16-byte aligned ] | | | BPF PRIV SP ->+------------------------------------------------------+ | | | 16 bytes padding (underflow guard - stack bottom) | | [ detects accesses before start of stack ] | | | +------------------------------------------------------+ On detection of an overflow or underflow, the kernel emits messages like: BPF private stack overflow/underflow detected for prog After commit bd737fcb6485 ("bpf, arm64: Get rid of fpb"), Jited BPF programs use the stack in two ways: 1. Via the BPF frame pointer (top of stack), using negative offsets. 2. Via the stack pointer (bottom of stack), using positive offsets in LDR/STR instructions. When a private stack is used, ARM64 callee-saved register x27 replaces the stack pointer. The BPF frame pointer usage remains unchanged; but it now points to the top of the private stack. Relevant tests (Enabled in following patch): #415/1 struct_ops_private_stack/private_stack:OK #415/2 struct_ops_private_stack/private_stack_fail:OK #415/3 struct_ops_private_stack/private_stack_recur:OK #415 struct_ops_private_stack:OK #549/1 verifier_private_stack/Private stack, single prog:OK #549/2 verifier_private_stack/Private stack, subtree > MAX_BPF_STACK:OK #549/3 verifier_private_stack/No private stack:OK #549/4 verifier_private_stack/Private stack, callback:OK #549/5 verifier_private_stack/Private stack, exception in main prog:OK #549/6 verifier_private_stack/Private stack, exception in subprog:OK #549/7 verifier_private_stack/Private stack, async callback, not nested:OK #549/8 verifier_private_stack/Private stack, async callback, potential nesting:OK #549 verifier_private_stack:OK Summary: 2/11 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Puranjay Mohan Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20250724120257.7299-3-puranjay@kernel.org commit 3ba58312e65665e5b9097c7969a51fa49914d85d Author: Puranjay Mohan Date: Thu Jul 24 12:02:53 2025 +0000 bpf: Move bpf_jit_get_prog_name() to core.c bpf_jit_get_prog_name() will be used by all JITs when enabling support for private stack. This function is currently implemented in the x86 JIT. Move the function to core.c so that other JITs can easily use it in their implementation of private stack. Signed-off-by: Puranjay Mohan Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20250724120257.7299-2-puranjay@kernel.org commit b114fcee766d5101eada1aca7bb5fd0a86c89b35 Author: Puranjay Mohan Date: Tue Jul 22 13:34:09 2025 +0000 bpf, arm64: Fix fp initialization for exception boundary In the ARM64 BPF JIT when prog->aux->exception_boundary is set for a BPF program, find_used_callee_regs() is not called because for a program acting as exception boundary, all callee saved registers are saved. find_used_callee_regs() sets `ctx->fp_used = true;` when it sees FP being used in any of the instructions. For programs acting as exception boundary, ctx->fp_used remains false even if frame pointer is used by the program and therefore, FP is not set-up for such programs in the prologue. This can cause the kernel to crash due to a pagefault. Fix it by setting ctx->fp_used = true for exception boundary programs as fp is always saved in such programs. Fixes: 5d4fa9ec5643 ("bpf, arm64: Avoid blindly saving/restoring all callee-saved registers") Signed-off-by: Puranjay Mohan Signed-off-by: Daniel Borkmann Acked-by: Xu Kuohai Link: https://lore.kernel.org/bpf/20250722133410.54161-2-puranjay@kernel.org commit fa582ca7e187a15e772e6a72fe035f649b387a60 Author: Ivan Vecera Date: Sat Jul 26 20:41:45 2025 +0200 dpll: zl3073x: Fix build failure If CONFIG_ZL3073X is enabled but both CONFIG_ZL3073X_I2C and CONFIG_ZL3073X_SPI are disabled, the compilation may fail because CONFIG_REGMAP is not enabled. Fix the issue by selecting CONFIG_REGMAP when CONFIG_ZL3073X is enabled. Fixes: 2df8e64e01c10 ("dpll: Add basic Microchip ZL3073x support") Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250726184145.25769-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 38b74b212a34c37c3157ba6c3af7025fb9447458 Author: Jakub Kicinski Date: Sat Jul 26 08:53:49 2025 -0700 selftests: bpf: fix legacy netfilter options Recent commit to add NETFILTER_XTABLES_LEGACY missed setting a couple of configs to y. They are still enabled but as modules which appears to have upset BPF CI, e.g.: test_bpf_nf_ct:FAIL:iptables-legacy -t raw -A PREROUTING -j CONNMARK --set-mark 42/0 unexpected error: 768 (errno 0) Fixes: 3c3ab65f00eb ("selftests: net: Enable legacy netfilter legacy options.") Link: https://patch.msgid.link/20250726155349.1161845-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b7b3500bd4eef2c3b5124ed195f26eb048407d9b Author: Thomas Weißschuh Date: Mon Jul 21 11:04:42 2025 +0200 umd: Remove usermode driver framework The code is unused since 98e20e5e13d2 ("bpfilter: remove bpfilter"), therefore remove it. Signed-off-by: Thomas Weißschuh Signed-off-by: Daniel Borkmann Reviewed-by: Christoph Hellwig Reviewed-by: Christian Brauner Acked-by: "Eric W. Biederman" Link: https://lore.kernel.org/bpf/20250721-remove-usermode-driver-v1-2-0d0083334382@linutronix.de commit 2b03164eee20eac7ce0fe3aa4fbda7efc1e5427a Author: Thomas Weißschuh Date: Mon Jul 21 11:04:41 2025 +0200 bpf/preload: Don't select USERMODE_DRIVER The usermode driver framework is not used anymore by the BPF preload code. Fixes: cb80ddc67152 ("bpf: Convert bpf_preload.ko to use light skeleton.") Signed-off-by: Thomas Weißschuh Signed-off-by: Daniel Borkmann Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/bpf/20250721-remove-usermode-driver-v1-1-0d0083334382@linutronix.de commit c58c18be8850d58fd61b0480d2355df89ce7ee59 Merge: c471b90bb332da afd8c2c9e2e29c Author: Jakub Kicinski Date: Sat Jul 26 11:44:23 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Merge in late fixes to prepare for the 6.17 net-next PR. Conflicts: net/core/neighbour.c 1bbb76a89948 ("neighbour: Fix null-ptr-deref in neigh_flush_dev().") 13a936bb99fb ("neighbour: Protect tbl->phash_buckets[] with a dedicated mutex.") 03dc03fa0432 ("neighbor: Add NTF_EXT_VALIDATED flag for externally validated entries") Adjacent changes: drivers/net/usb/usbnet.c 0d9cfc9b8cb1 ("net: usbnet: Avoid potential RCU stall on LINK_CHANGE event") 2c04d279e857 ("net: usb: Convert tasklet API to new bottom half workqueue mechanism") net/ipv6/route.c 31d7d67ba127 ("ipv6: annotate data-races around rt->fib6_nsiblings") 1caf27297215 ("ipv6: adopt dst_dev() helper") 3b3ccf9ed05e ("net: Remove unnecessary NULL check for lwtunnel_fill_encap()") Signed-off-by: Jakub Kicinski commit afd8c2c9e2e29c6c7705635bea2960593976dacc Merge: f388f807eca1de 31d7d67ba1274f Author: Jakub Kicinski Date: Sat Jul 26 11:31:03 2025 -0700 Merge branch 'ipv6-f6i-fib6_siblings-and-rt-fib6_nsiblings-fixes' Eric Dumazet says: ==================== ipv6: f6i->fib6_siblings and rt->fib6_nsiblings fixes Series based on an internal syzbot report with a repro. After fixing (in the first patch) the original minor issue, I found that syzbot repro was able to trigger a second more serious bug in rt6_nlmsg_size(). Code review then led to the two final patches. I have not released the syzbot bug, because other issues still need investigations. ==================== Link: https://patch.msgid.link/20250725140725.3626540-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 31d7d67ba1274f42494256d52e86da80ed09f3cb Author: Eric Dumazet Date: Fri Jul 25 14:07:25 2025 +0000 ipv6: annotate data-races around rt->fib6_nsiblings rt->fib6_nsiblings can be read locklessly, add corresponding READ_ONCE() and WRITE_ONCE() annotations. Fixes: 66f5d6ce53e6 ("ipv6: replace rwlock with rcu and spinlock in fib6_table") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250725140725.3626540-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit f8d8ce1b515a0a6af72b30502670a406cfb75073 Author: Eric Dumazet Date: Fri Jul 25 14:07:24 2025 +0000 ipv6: fix possible infinite loop in fib6_info_uses_dev() fib6_info_uses_dev() seems to rely on RCU without an explicit protection. Like the prior fix in rt6_nlmsg_size(), we need to make sure fib6_del_route() or fib6_add_rt2node() have not removed the anchor from the list, or we risk an infinite loop. Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250725140725.3626540-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 54e6fe9dd3b0e7c481c2228782c9494d653546da Author: Eric Dumazet Date: Fri Jul 25 14:07:23 2025 +0000 ipv6: prevent infinite loop in rt6_nlmsg_size() While testing prior patch, I was able to trigger an infinite loop in rt6_nlmsg_size() in the following place: list_for_each_entry_rcu(sibling, &f6i->fib6_siblings, fib6_siblings) { rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len); } This is because fib6_del_route() and fib6_add_rt2node() uses list_del_rcu(), which can confuse rcu readers, because they might no longer see the head of the list. Restart the loop if f6i->fib6_nsiblings is zero. Fixes: d9ccb18f83ea ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn") Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250725140725.3626540-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit ea2f921db7a483a526058c5b5b8162edd88dabe5 Author: Eric Dumazet Date: Fri Jul 25 14:07:22 2025 +0000 ipv6: add a retry logic in net6_rt_notify() inet6_rt_notify() can be called under RCU protection only. This means the route could be changed concurrently and rt6_fill_node() could return -EMSGSIZE. Re-size the skb when this happens and retry, removing one WARN_ON() that syzbot was able to trigger: WARNING: CPU: 3 PID: 6291 at net/ipv6/route.c:6342 inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342 Modules linked in: CPU: 3 UID: 0 PID: 6291 Comm: syz.0.77 Not tainted 6.16.0-rc7-syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:inet6_rt_notify+0x475/0x4b0 net/ipv6/route.c:6342 Code: fc ff ff e8 6d 52 ea f7 e9 47 fc ff ff 48 8b 7c 24 08 4c 89 04 24 e8 5a 52 ea f7 4c 8b 04 24 e9 94 fd ff ff e8 9c fe 84 f7 90 <0f> 0b 90 e9 bd fd ff ff e8 6e 52 ea f7 e9 bb fb ff ff 48 89 df e8 RSP: 0018:ffffc900035cf1d8 EFLAGS: 00010293 RAX: 0000000000000000 RBX: ffffc900035cf540 RCX: ffffffff8a36e790 RDX: ffff88802f7e8000 RSI: ffffffff8a36e9d4 RDI: 0000000000000005 RBP: ffff88803c230f00 R08: 0000000000000005 R09: 00000000ffffffa6 R10: 00000000ffffffa6 R11: 0000000000000001 R12: 00000000ffffffa6 R13: 0000000000000900 R14: ffff888032ea4100 R15: 0000000000000000 FS: 00007fac7b89a6c0(0000) GS:ffff8880d6a20000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fac7b899f98 CR3: 0000000034b3f000 CR4: 0000000000352ef0 Call Trace: ip6_route_mpath_notify+0xde/0x280 net/ipv6/route.c:5356 ip6_route_multipath_add+0x1181/0x1bd0 net/ipv6/route.c:5536 inet6_rtm_newroute+0xe4/0x1a0 net/ipv6/route.c:5647 rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6944 netlink_rcv_skb+0x155/0x420 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x58d/0x850 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2566 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2620 Fixes: 169fd62799e8 ("ipv6: Get rid of RTNL for SIOCADDRT and RTM_NEWROUTE.") Signed-off-by: Eric Dumazet Reported-by: syzbot Link: https://patch.msgid.link/20250725140725.3626540-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit f388f807eca1de9e6e70f9ffb1a573c3811c4215 Author: Stanislav Fomichev Date: Fri Jul 25 09:00:43 2025 -0700 vrf: Drop existing dst reference in vrf_ip6_input_dst Commit ff3fbcdd4724 ("selftests: tc: Add generic erspan_opts matching support for tc-flower") started triggering the following kmemleak warning: unreferenced object 0xffff888015fb0e00 (size 512): comm "softirq", pid 0, jiffies 4294679065 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 40 d2 85 9e ff ff ff ff ........@....... 41 69 59 9d ff ff ff ff 00 00 00 00 00 00 00 00 AiY............. backtrace (crc 30b71e8b): __kmalloc_noprof+0x359/0x460 metadata_dst_alloc+0x28/0x490 erspan_rcv+0x4f1/0x1160 [ip_gre] gre_rcv+0x217/0x240 [ip_gre] gre_rcv+0x1b8/0x400 [gre] ip_protocol_deliver_rcu+0x31d/0x3a0 ip_local_deliver_finish+0x37d/0x620 ip_local_deliver+0x174/0x460 ip_rcv+0x52b/0x6b0 __netif_receive_skb_one_core+0x149/0x1a0 process_backlog+0x3c8/0x1390 __napi_poll.constprop.0+0xa1/0x390 net_rx_action+0x59b/0xe00 handle_softirqs+0x22b/0x630 do_softirq+0xb1/0xf0 __local_bh_enable_ip+0x115/0x150 vrf_ip6_input_dst unconditionally sets skb dst entry, add a call to skb_dst_drop to drop any existing entry. Cc: David Ahern Reviewed-by: Ido Schimmel Fixes: 9ff74384600a ("net: vrf: Handle ipv6 multicast and link-local addresses") Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250725160043.350725-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit c471b90bb332dadd59744fb2c8407d67d815b6e6 Author: Simon Horman Date: Fri Jul 25 10:56:47 2025 +0100 net/sched: taprio: align entry index attr validation with mqprio Both taprio and mqprio have code to validate respective entry index attributes. The validation is indented to ensure that the attribute is present, and that it's value is in range, and that each value is only used once. The purpose of this patch is to align the implementation of taprio with that of mqprio as there seems to be no good reason for them to differ. For one thing, this way, bugs will be present in both or neither. As a follow-up some consideration could be given to a common function used by both sch. No functional change intended. Except of tdc run: the results of the taprio tests # ok 81 ba39 - Add taprio Qdisc to multi-queue device (8 queues) # ok 82 9462 - Add taprio Qdisc with multiple sched-entry # ok 83 8d92 - Add taprio Qdisc with txtime-delay # ok 84 d092 - Delete taprio Qdisc with valid handle # ok 85 8471 - Show taprio class # ok 86 0a85 - Add taprio Qdisc to single-queue device # ok 87 6f62 - Add taprio Qdisc with too short interval # ok 88 831f - Add taprio Qdisc with too short cycle-time # ok 89 3e1e - Add taprio Qdisc with an invalid cycle-time # ok 90 39b4 - Reject grafting taprio as child qdisc of software taprio # ok 91 e8a1 - Reject grafting taprio as child qdisc of offloaded taprio # ok 92 a7bf - Graft cbs as child of software taprio # ok 93 6a83 - Graft cbs as child of offloaded taprio Cc: Vladimir Oltean Cc: Maher Azzouzi Link: https://lore.kernel.org/netdev/20250723125521.GA2459@horms.kernel.org/ Signed-off-by: Simon Horman Reviewed-by: Cong Wang Acked-by: Vinicius Costa Gomes Link: https://patch.msgid.link/20250725-taprio-idx-parse-v1-1-b582fffcde37@kernel.org Signed-off-by: Jakub Kicinski commit 5737383faea3541c92fc08187260b2d3587e5f79 Author: Alexander Stein Date: Fri Jul 25 07:56:13 2025 +0200 net: fsl_pq_mdio: use dev_err_probe Silence deferred probes using dev_err_probe(). This can happen when the ethernet PHY uses an IRQ line attached to a i2c GPIO expander. If the i2c bus is not yet ready, a probe deferral can occur. Signed-off-by: Alexander Stein Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250725055615.259945-1-alexander.stein@ew.tq-group.com Signed-off-by: Jakub Kicinski commit 5b32321fdaf3fd1a92ec726af18765e225b0ee2b Author: Xiumei Mu Date: Fri Jul 25 11:50:28 2025 +0800 selftests: rtnetlink.sh: remove esp4_offload after test The esp4_offload module, loaded during IPsec offload tests, should be reset to its default settings after testing. Otherwise, leaving it enabled could unintentionally affect subsequence test cases by keeping offload active. Without this fix: $ lsmod | grep offload; ./rtnetlink.sh -t kci_test_ipsec_offload ; lsmod | grep offload; PASS: ipsec_offload esp4_offload 12288 0 esp4 32768 1 esp4_offload With this fix: $ lsmod | grep offload; ./rtnetlink.sh -t kci_test_ipsec_offload ; lsmod | grep offload; PASS: ipsec_offload Fixes: 2766a11161cc ("selftests: rtnetlink: add ipsec offload API test") Signed-off-by: Xiumei Mu Reviewed-by: Shannon Nelson Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/6d3a1d777c4de4eb0ca94ced9e77be8d48c5b12f.1753415428.git.xmu@redhat.com Signed-off-by: Jakub Kicinski commit 002f79a5f015350934024ab57285d51cdaf8d92c Author: Wang Liang Date: Fri Jul 25 09:38:08 2025 +0800 vsock: remove unnecessary null check in vsock_getname() The local variable 'vm_addr' is always not NULL, no need to check it. Signed-off-by: Wang Liang Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250725013808.337924-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit e1f4ebd9db7e236eb439f7e243d570cc51797b5e Merge: eccf7a3480a06e 3b7c13dfdcc26a Author: Jakub Kicinski Date: Sat Jul 26 11:23:13 2025 -0700 Merge branch 'xsk-fix-negative-overflow-issues-in-zerocopy-xmit' Jason Xing says: ==================== xsk: fix negative overflow issues in zerocopy xmit Fix two negative overflow issues around {stmmac_xdp|igb}_xmit_zc(). ==================== Link: https://patch.msgid.link/20250723142327.85187-1-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 3b7c13dfdcc26a78756cc17a23cdf4310c5a24a9 Author: Jason Xing Date: Wed Jul 23 22:23:27 2025 +0800 igb: xsk: solve negative overflow of nb_pkts in zerocopy mode There is no break time in the while() loop, so every time at the end of igb_xmit_zc(), negative overflow of nb_pkts will occur, which renders the return value always false. But theoretically, the result should be set after calling xsk_tx_peek_release_desc_batch(). We can take i40e_xmit_zc() as a good example. Returning false means we're not done with transmission and we need one more poll, which is exactly what igb_xmit_zc() always did before this patch. After this patch, the return value depends on the nb_pkts value. Two cases might happen then: 1. if (nb_pkts < budget), it means we process all the possible data, so return true and no more necessary poll will be triggered because of this. 2. if (nb_pkts == budget), it means we might have more data, so return false to let another poll run again. Fixes: f8e284a02afc ("igb: Add AF_XDP zero-copy Tx support") Signed-off-by: Jason Xing Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250723142327.85187-3-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 2764ab51d5f0e8c7d3b7043af426b1883e3bde1d Author: Jason Xing Date: Wed Jul 23 22:23:26 2025 +0800 stmmac: xsk: fix negative overflow of budget in zerocopy mode A negative overflow can happen when the budget number of descs are consumed. as long as the budget is decreased to zero, it will again go into while (budget-- > 0) statement and get decreased by one, so the overflow issue can happen. It will lead to returning true whereas the expected value should be false. In this case where all the budget is used up, it means zc function should return false to let the poll run again because normally we might have more data to process. Without this patch, zc function would return true instead. Fixes: 132c32ee5bc0 ("net: stmmac: Add TX via XDP zero-copy socket") Signed-off-by: Jason Xing Reviewed-by: Aleksandr Loktionov Link: https://patch.msgid.link/20250723142327.85187-2-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit d7e0d327805b6078ca27a6e87041f3e299c2deab Author: Frank Li Date: Thu Jul 24 19:01:24 2025 -0400 dt-bindings: ieee802154: Convert at86rf230.txt yaml format Convert at86rf230.txt yaml format. Additional changes: - Add ref to spi-peripheral-props.yaml. - Add parent spi node in examples. Reviewed-by: Rob Herring (Arm) Signed-off-by: Frank Li Link: https://patch.msgid.link/20250724230129.1480174-1-Frank.Li@nxp.com Signed-off-by: Jakub Kicinski commit 0a2c9d808af2cb8a799eaeb6ef03cf1324c9e1f3 Merge: 1f315e99bdd520 f509de1b0f8959 Author: Oliver Upton Date: Sat Jul 26 08:54:47 2025 -0700 Merge branch 'kvm-arm64/misc' into kvmarm/next * kvm-arm64/misc: : Miscellaneous fixes/cleanups for KVM/arm64 : : - Fixes for computing POE output permissions : : - Return ENXIO for invalid VGIC device attribute : : - String helper conversions arm64: kvm: trace_handle_exit: use string choices helper arm64: kvm: sys_regs: use string choices helper KVM: arm64: Follow specification when implementing WXN KVM: arm64: Remove the wi->{e0,}poe vs wr->{p,u}ov confusion KVM: arm64: vgic-its: Return -ENXIO to invalid KVM_DEV_ARM_VGIC_GRP_CTRL attrs Signed-off-by: Oliver Upton commit 1f315e99bdd52001255cd26d822f23563f2fabb3 Merge: ccd73c57820eba ff2aa6495d4bea Author: Oliver Upton Date: Sat Jul 26 08:50:06 2025 -0700 Merge branch 'kvm-arm64/gcie-legacy' into kvmarm/next * kvm-arm64/gcie-legacy: : Support for GICv3 emulation on GICv5, courtesy of Sascha Bischoff : : FEAT_GCIE_LEGACY adds the necessary hardware for GICv5 systems to : support the legacy GICv3 for VMs, including a backwards-compatible VGIC : implementation that we all know and love. : : As a starting point for GICv5 enablement in KVM, enable + use the : GICv3-compatible feature when running VMs on GICv5 hardware. KVM: arm64: gic-v5: Probe for GICv5 KVM: arm64: gic-v5: Support GICv3 compat arm64/sysreg: Add ICH_VCTLR_EL2 irqchip/gic-v5: Populate struct gic_kvm_info irqchip/gic-v5: Skip deactivate for forwarded PPI interrupts Signed-off-by: Oliver Upton commit ccd73c57820eba4c4768c5c9e59eefe3e20e0870 Merge: 3318e42b81e961 65a5520a275707 Author: Oliver Upton Date: Sat Jul 26 08:49:15 2025 -0700 Merge tag 'irqchip-gic-v5-host' into kvmarm/next GICv5 initial host support Add host kernel support for the new arm64 GICv5 architecture, which is quite a departure from the previous ones. Include support for the full gamut of the architecture (interrupt routing and delivery to CPUs, wired interrupts, MSIs, and interrupt translation). * tag 'irqchip-gic-v5-host': (32 commits) arm64: smp: Fix pNMI setup after GICv5 rework arm64: Kconfig: Enable GICv5 docs: arm64: gic-v5: Document booting requirements for GICv5 irqchip/gic-v5: Add GICv5 IWB support irqchip/gic-v5: Add GICv5 ITS support irqchip/msi-lib: Add IRQ_DOMAIN_FLAG_FWNODE_PARENT handling irqchip/gic-v3: Rename GICv3 ITS MSI parent PCI/MSI: Add pci_msi_map_rid_ctlr_node() helper function of/irq: Add of_msi_xlate() helper function irqchip/gic-v5: Enable GICv5 SMP booting irqchip/gic-v5: Add GICv5 LPI/IPI support irqchip/gic-v5: Add GICv5 IRS/SPI support irqchip/gic-v5: Add GICv5 PPI support arm64: Add support for GICv5 GSB barriers arm64: smp: Support non-SGIs for IPIs arm64: cpucaps: Add GICv5 CPU interface (GCIE) capability arm64: cpucaps: Rename GICv3 CPU interface capability arm64: Disable GICv5 read/write/instruction traps arm64/sysreg: Add ICH_HFGITR_EL2 arm64/sysreg: Add ICH_HFGWTR_EL2 ... Signed-off-by: Oliver Upton commit 3318e42b81e961ab3acbd3e164d31fba4c76764d Merge: c535d132a30f7c d9c5c2320156ba Author: Oliver Upton Date: Sat Jul 26 08:47:22 2025 -0700 Merge branch 'kvm-arm64/doublefault2' into kvmarm/next * kvm-arm64/doublefault2: (33 commits) : NV Support for FEAT_RAS + DoubleFault2 : : Delegate the vSError context to the guest hypervisor when in a nested : state, including registers related to ESR propagation. Additionally, : catch up KVM's external abort infrastructure to the architecture, : implementing the effects of FEAT_DoubleFault2. : : This has some impact on non-nested guests, as SErrors deemed unmasked at : the time they're made pending are now immediately injected with an : emulated exception entry rather than using the VSE bit. KVM: arm64: Make RAS registers UNDEF when RAS isn't advertised KVM: arm64: Filter out HCR_EL2 bits when running in hypervisor context KVM: arm64: Check for SYSREGS_ON_CPU before accessing the CPU state KVM: arm64: Commit exceptions from KVM_SET_VCPU_EVENTS immediately KVM: arm64: selftests: Test ESR propagation for vSError injection KVM: arm64: Populate ESR_ELx.EC for emulated SError injection KVM: arm64: selftests: Catch up set_id_regs with the kernel KVM: arm64: selftests: Add SCTLR2_EL1 to get-reg-list KVM: arm64: selftests: Test SEAs are taken to SError vector when EASE=1 KVM: arm64: selftests: Add basic SError injection test KVM: arm64: Don't retire MMIO instruction w/ pending (emulated) SError KVM: arm64: Advertise support for FEAT_DoubleFault2 KVM: arm64: Advertise support for FEAT_SCTLR2 KVM: arm64: nv: Enable vSErrors when HCRX_EL2.TMEA is set KVM: arm64: nv: Honor SError routing effects of SCTLR2_ELx.NMEA KVM: arm64: nv: Take "masked" aborts to EL2 when HCRX_EL2.TMEA is set KVM: arm64: Route SEAs to the SError vector when EASE is set KVM: arm64: nv: Ensure Address size faults affect correct ESR KVM: arm64: Factor out helper for selecting exception target EL KVM: arm64: Describe SCTLR2_ELx RESx masks ... Signed-off-by: Oliver Upton commit c535d132a30f7c28148efd266a654e68323608df Merge: 86731a2a651e58 f55ce5a6cd3321 Author: Oliver Upton Date: Sat Jul 26 08:47:02 2025 -0700 Merge branch 'kvm-arm64/cacheable-pfnmap' into kvmarm/next * kvm-arm64/cacheable-pfnmap: : Cacheable PFNMAP support at stage-2, courtesy of Ankit Agrawal : : For historical reasons, KVM only allows cacheable mappings at stage-2 : when a kernel alias exists in the direct map for the memory region. On : hardware without FEAT_S2FWB, this is necessary as KVM must do cache : maintenance to keep guest/host accesses coherent. : : This is unnecessarily restrictive on systems with FEAT_S2FWB and : CTR_EL0.DIC, as KVM no longer needs to perform cache maintenance to : maintain correctness. : : Allow cacheable mappings at stage-2 on supporting hardware when the : corresponding VMA has cacheable memory attributes and advertise a : capability to userspace such that a VMM can determine if a stage-2 : mapping can be established (e.g. VFIO device). KVM: arm64: Expose new KVM cap for cacheable PFNMAP KVM: arm64: Allow cacheable stage 2 mapping using VMA flags KVM: arm64: Block cacheable PFNMAP mapping KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable KVM: arm64: Rename the device variable to s2_force_noncacheable Signed-off-by: Oliver Upton commit eed9b14209073c51a0e41365871da05b1ada578f Author: Oliver Upton Date: Wed Jul 23 23:28:05 2025 -0700 Documentation: KVM: arm64: Describe VGICv3 registers writable pre-init KVM allows userspace to control GICD_IIDR.Revision and GICD_TYPER2.nASSGIcap prior to initialization for the sake of provisioning the guest-visible feature set. Document the userspace expectations surrounding accesses to these registers. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250724062805.2658919-7-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 15b5964a411f386d53e41a5595a3dd5e6068a59e Author: Raghavendra Rao Ananta Date: Wed Jul 23 23:28:04 2025 -0700 KVM: arm64: selftests: Add test for nASSGIcap attribute Extend vgic_init to test the nASSGIcap attribute, asserting that it is configurable (within reason) prior to initializing the VGIC. Additionally, check that userspace cannot set the attribute after the VGIC has been initialized. Signed-off-by: Raghavendra Rao Ananta Reviewed-by: Eric Auger Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250724062805.2658919-6-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit c652887a92887b9a2d48ee40f49f8013449b9a50 Author: Raghavendra Rao Ananta Date: Wed Jul 23 23:28:03 2025 -0700 KVM: arm64: vgic-v3: Allow userspace to write GICD_TYPER2.nASSGIcap KVM unconditionally advertises GICD_TYPER2.nASSGIcap (which internally implies vSGIs) on GICv4.1 systems. Allow userspace to change whether a VM supports the feature. Only allow changes prior to VGIC initialization as at that point vPEs need to be allocated for the VM. For convenience, bundle support for vLPIs and vSGIs behind this feature, allowing userspace to control vPE allocation for VMs in environments that may be constrained on vPE IDs. Signed-off-by: Raghavendra Rao Ananta Reviewed-by: Eric Auger Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250724062805.2658919-5-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit f26e6af75782fad6efdc883f33e1c40f1a6d37e7 Author: Oliver Upton Date: Wed Jul 23 23:28:02 2025 -0700 KVM: arm64: vgic-v3: Allow access to GICD_IIDR prior to initialization KVM allows userspace to write GICD_IIDR for backwards-compatibility with older kernels, where new implementation revisions have new features. Unfortunately this is allowed to happen at runtime, and ripping features out from underneath a running guest is a terrible idea. While we can't do anything about the ABI, prepare for more ID-like registers by allowing access to GICD_IIDR prior to VGIC initialization. Hoist initializaiton of the default value to kvm_vgic_create() and discard the incorrect comment that assumed userspace could access the register before initialization (until now). Subsequent changes will allow the VMM to further provision the GIC feature set, e.g. the presence of nASSGIcap. Reviewed-by: Eric Auger Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250724062805.2658919-4-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit ef364c5b43570e31a08b7ad4863ff7a747ad4332 Author: Oliver Upton Date: Wed Jul 23 23:28:01 2025 -0700 KVM: arm64: vgic-v3: Consolidate MAINT_IRQ handling Consolidate the duplicated handling of the VGICv3 maintenance IRQ attribute as a regular GICv3 attribute, as it is neither a register nor a common attribute. As this is now handled separately from the VGIC registers, the locking is relaxed to only acquire the intended config_lock. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250724062805.2658919-3-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 82221a4e66f044a5fe1d0acce10112a821655e8e Author: Oliver Upton Date: Wed Jul 23 23:28:00 2025 -0700 KVM: arm64: Disambiguate support for vSGIs v. vLPIs vgic_supports_direct_msis() is a bit of a misnomer, as it returns true if either vSGIs or vLPIs are supported. Pick it apart into a few predicates and replace some open-coded checks for vSGIs, including an opportunistic fix to always check if the CPUIF is capable of handling vSGIs. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250724062805.2658919-2-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 3435bd79ec13369281f87155b9b612ad0a379795 Author: Marc Zyngier Date: Fri Jul 18 12:11:54 2025 +0100 KVM: arm64: selftest: vgic-v3: Add basic GICv3 sysreg userspace access test We have a lot of more or less useful vgic tests, but none of them tracks the availability of GICv3 system registers, which is a bit annoying. Add one such test, which covers both EL1 and EL2 registers. Signed-off-by: Marc Zyngier Tested-by: Itaru Kitayama Reviewed-by: Sebastian Ott Link: https://lore.kernel.org/r/20250718111154.104029-5-maz@kernel.org Signed-off-by: Oliver Upton commit 8af3e8ab09d0ba9b19fc3ea96ef1fa14660fef21 Author: Marc Zyngier Date: Fri Jul 18 12:11:53 2025 +0100 KVM: arm64: Enforce the sorting of the GICv3 system register table In order to avoid further embarassing bugs, enforce that the GICv3 sysreg table is actually sorted, just like all the other tables. Signed-off-by: Marc Zyngier Reviewed-by: Sebastian Ott Link: https://lore.kernel.org/r/20250718111154.104029-4-maz@kernel.org Signed-off-by: Oliver Upton commit f5e6ebf285e1c84687c33b22fb1c4b992b640832 Author: Marc Zyngier Date: Fri Jul 18 12:11:52 2025 +0100 KVM: arm64: Clarify the check for reset callback in check_sysreg_table() check_sysreg_table() has a wonky 'is_32" parameter, which is really an indication that we should enforce the presence of a reset helper. Clean this up by naming the variable accordingly and inverting the condition. Contrary to popular belief, system instructions don't have a reset value (duh!), and therefore do not need to be checked for reset (they escaped the check through luck...). Signed-off-by: Marc Zyngier Reviewed-by: Sebastian Ott Link: https://lore.kernel.org/r/20250718111154.104029-3-maz@kernel.org Signed-off-by: Oliver Upton commit 0f3046c8f68c00a2e4db31e21a7f14aa20913524 Author: Marc Zyngier Date: Fri Jul 18 12:11:51 2025 +0100 KVM: arm64: vgic-v3: Fix ordering of ICH_HCR_EL2 The sysreg tables are supposed to be sorted so that a binary search can easily find them. However, ICH_HCR_EL2 is obviously at the wrong spot. Move it where it belongs. Fixes: 9fe9663e47e21 ("KVM: arm64: Expose GICv3 EL2 registers via KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS") Signed-off-by: Marc Zyngier Reviewed-by: Sebastian Ott Link: https://lore.kernel.org/r/20250718111154.104029-2-maz@kernel.org Signed-off-by: Oliver Upton commit c32969d0362a790fbc6117e0b6a737a7e510b843 Author: Ben Hutchings Date: Thu Jul 17 16:47:32 2025 +0200 sh: Do not use hyphen in exported variable name arch/sh/Makefile defines and exports ld-bfd to be used by arch/sh/boot/compressed/Makefile and arch/sh/boot/romimage/Makefile. However some shells, including dash, will not pass through environment variables whose name includes a hyphen. Usually GNU make does not use a shell to recurse, but if e.g. $(srctree) contains '~' it will use a shell here. Other instances of this problem were previously fixed by commits 2bfbe7881ee0 "kbuild: Do not use hyphen in exported variable name" and 82977af93a0d "sh: rename suffix-y to suffix_y". Rename the variable to ld_bfd. References: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=sh4&ver=4.13%7Erc5-1%7Eexp1&stamp=1502943967&raw=0 Fixes: 7b022d07a0fd ("sh: Tidy up the ldscript output format specifier.") Signed-off-by: Ben Hutchings Reviewed-by: John Paul Adrian Glaubitz Signed-off-by: John Paul Adrian Glaubitz commit eb549e194bf2d5c86b1b7a71fad54d610dd6c892 Author: Masahiro Yamada Date: Thu Jul 17 08:24:13 2025 +0900 kconfig: gconf: refactor text_insert_help() text_insert_help() and text_insert_msg() share similar code. Refactor text_insert_help() to eliminate the code duplication. Signed-off-by: Masahiro Yamada commit 5ceb15fdc629aa3030e8f8987c561d36678f9559 Author: Masahiro Yamada Date: Thu Jul 17 08:24:12 2025 +0900 kconfig: gconf: remove unneeded variable in text_insert_msg The 'msg' and 'message' refer to the same pointer. Signed-off-by: Masahiro Yamada commit e16f08062f91570aa225bc490e0a92d63ae13769 Author: Masahiro Yamada Date: Thu Jul 17 08:24:11 2025 +0900 kconfig: gconf: use hyphens in signals Using hyphens in signal names is the official convention, even though underscores also work. Signed-off-by: Masahiro Yamada commit 2bc0148f78193865065035fe19095c78c3d8129f Author: Masahiro Yamada Date: Thu Jul 17 08:24:10 2025 +0900 kconfig: gconf: replace GtkImageMenuItem with GtkMenuItem GtkImageMenuItem is deprecated with GTK 3.10. [1] Use GtkMenuItem instead. [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/3.10.0/gtk/deprecated/gtkimagemenuitem.c#L797 Signed-off-by: Masahiro Yamada commit 15a5ae3b0976d1190728044920cf6337a218ae62 Author: Masahiro Yamada Date: Thu Jul 17 08:24:09 2025 +0900 kconfig: gconf: Fix Back button behavior Clicking the Back button may navigate to a non-menu hierarchy level. [Example] menu "menu1" config A bool "A" default y config B bool "B" depends on A default y menu "menu2" depends on B config C bool "C" default y endmenu endmenu After being re-parented by menu_finalize(), the menu tree is structured like follows: menu "menu1" \-- A \-- B \-- menu "menu2" \-- C In Single view, visit "menu2" and click the Back button. It should go up to "menu1" and show A, B and "menu2", but instead goes up to A and show only B and "menu2". This is a bug in on_back_clicked(). Signed-off-by: Masahiro Yamada commit 6d4d44254e43157bb760aa16367a394c2ab299b8 Author: Masahiro Yamada Date: Thu Jul 17 08:24:08 2025 +0900 kconfig: gconf: fix single view to display dependent symbols correctly In the following example, the symbol C was never displayed in Single view. Fix the recursion logic so that all symbols are shown. menu "menu" config A bool "A" config B bool "B" depends on A config C bool "C" depends on B endmenu Signed-off-by: Masahiro Yamada commit ac75da105eb38d7c48ee3421d116282d8c44b690 Merge: 8113e1dfbc4e03 a46b4822bed08d Author: Arnd Bergmann Date: Sat Jul 26 12:01:43 2025 +0200 Merge tag 'sunxi-fixes-for-6.16' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner fixes for 6.16 Only one fix: Correct the name of the A523's EMAC0 to GMAC0, as seen in the SoC's datasheets. The matching DT binding change is in the net tree. Signed-off-by: Arnd Bergmann commit a8f2b96ca9ee87be8091fcc2746b811c173648a0 Author: Timothy Pearson Date: Tue Jul 15 16:39:42 2025 -0500 PCI: pnv_php: Enable third attention indicator state The PCIe specification allows three attention indicator states, on, off, and blink. Enable all three states instead of basic on / off control. This changes the userspace API (writes to the sysfs "attention" file) to match the behavior of pciehp. Here's the comparison of previous and new indicator behavior: Value Previous New Behavior ----- -------- ------------------------ 0 off (reserved, so undefined) 1 on on 2 on blink 3 on off Signed-off-by: Timothy Pearson [bhelgaas: add specifics of behavior change] Signed-off-by: Bjorn Helgaas Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/1210309411.1359866.1752615582001.JavaMail.zimbra@raptorengineeringinc.com commit a2a2a6fc2469524caa713036297c542746d148dc Author: Timothy Pearson Date: Tue Jul 15 16:39:06 2025 -0500 PCI: pnv_php: Fix surprise plug detection and recovery The existing PowerNV hotplug code did not handle surprise plug events correctly, leading to a complete failure of the hotplug system after device removal and a required reboot to detect new devices. This comes down to two issues: 1) When a device is surprise removed, often the bridge upstream port will cause a PE freeze on the PHB. If this freeze is not cleared, the MSI interrupts from the bridge hotplug notification logic will not be received by the kernel, stalling all plug events on all slots associated with the PE. 2) When a device is removed from a slot, regardless of surprise or programmatic removal, the associated PHB/PE ls left frozen. If this freeze is not cleared via a fundamental reset, skiboot is unable to clear the freeze and cannot retrain / rescan the slot. This also requires a reboot to clear the freeze and redetect the device in the slot. Issue the appropriate unfreeze and rescan commands on hotplug events, and don't oops on hotplug if pci_bus_to_OF_node() returns NULL. Signed-off-by: Timothy Pearson [bhelgaas: tidy comments] Signed-off-by: Bjorn Helgaas Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/171044224.1359864.1752615546988.JavaMail.zimbra@raptorengineeringinc.com commit 1010b4c012b0d78dfb9d3132b49aa2ef024a07a7 Author: Timothy Pearson Date: Tue Jul 15 16:38:23 2025 -0500 powerpc/eeh: Make EEH driver device hotplug safe Multiple race conditions existed between the PCIe hotplug driver and the EEH driver, leading to a variety of kernel oopses of the same general nature: A second class of oops is also seen when the underlying bus disappears during device recovery. Refactor the EEH module to be PCI rescan and remove safe. Also clean up a few minor formatting / readability issues. Signed-off-by: Timothy Pearson Signed-off-by: Bjorn Helgaas Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/1334208367.1359861.1752615503144.JavaMail.zimbra@raptorengineeringinc.com commit e82b34eed04b0ddcff4548b62633467235672fd3 Author: Timothy Pearson Date: Tue Jul 15 16:37:34 2025 -0500 powerpc/eeh: Export eeh_unfreeze_pe() The PowerNV hotplug driver needs to be able to clear any frozen PE(s) on the PHB after suprise removal of a downstream device. Export the eeh_unfreeze_pe() symbol to allow implementation of this functionality in the php_nv module. Signed-off-by: Timothy Pearson Signed-off-by: Bjorn Helgaas Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/1778535414.1359858.1752615454618.JavaMail.zimbra@raptorengineeringinc.com commit 80f9fc2362797538ebd4fd70a1dfa838cc2c2cdb Author: Timothy Pearson Date: Tue Jul 15 16:36:55 2025 -0500 PCI: pnv_php: Work around switches with broken presence detection The Microsemi Switchtec PM8533 PFX 48xG3 [11f8:8533] PCIe switch system was observed to incorrectly assert the Presence Detect Set bit in its capabilities when tested on a Raptor Computing Systems Blackbird system, resulting in the hot insert path never attempting a rescan of the bus and any downstream devices not being re-detected. Work around this by additionally checking whether the PCIe data link is active or not when performing presence detection on downstream switches' ports, similar to the pciehp_hpc.c driver. Signed-off-by: Shawn Anastasio Signed-off-by: Timothy Pearson Signed-off-by: Bjorn Helgaas Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/505981576.1359853.1752615415117.JavaMail.zimbra@raptorengineeringinc.com commit 4668619092554e1b95c9a5ac2941ca47ba6d548a Author: Timothy Pearson Date: Tue Jul 15 16:36:07 2025 -0500 PCI: pnv_php: Clean up allocated IRQs on unplug When the root of a nested PCIe bridge configuration is unplugged, the pnv_php driver leaked the allocated IRQ resources for the child bridges' hotplug event notifications, resulting in a panic. Fix this by walking all child buses and deallocating all its IRQ resources before calling pci_hp_remove_devices(). Also modify the lifetime of the workqueue at struct pnv_php_slot::wq so that it is only destroyed in pnv_php_free_slot(), instead of pnv_php_disable_irq(). This is required since pnv_php_disable_irq() will now be called by workers triggered by hot unplug interrupts, so the workqueue needs to stay allocated. The abridged kernel panic that occurs without this patch is as follows: WARNING: CPU: 0 PID: 687 at kernel/irq/msi.c:292 msi_device_data_release+0x6c/0x9c CPU: 0 UID: 0 PID: 687 Comm: bash Not tainted 6.14.0-rc5+ #2 Call Trace: msi_device_data_release+0x34/0x9c (unreliable) release_nodes+0x64/0x13c devres_release_all+0xc0/0x140 device_del+0x2d4/0x46c pci_destroy_dev+0x5c/0x194 pci_hp_remove_devices+0x90/0x128 pci_hp_remove_devices+0x44/0x128 pnv_php_disable_slot+0x54/0xd4 power_write_file+0xf8/0x18c pci_slot_attr_store+0x40/0x5c sysfs_kf_write+0x64/0x78 kernfs_fop_write_iter+0x1b0/0x290 vfs_write+0x3bc/0x50c ksys_write+0x84/0x140 system_call_exception+0x124/0x230 system_call_vectored_common+0x15c/0x2ec Signed-off-by: Shawn Anastasio Signed-off-by: Timothy Pearson [bhelgaas: tidy comments] Signed-off-by: Bjorn Helgaas Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/2013845045.1359852.1752615367790.JavaMail.zimbra@raptorengineeringinc.com commit b9f75396ec107628cc5f52fb6e055c1c9dc68401 Author: Jeremy Linton Date: Mon Jul 14 17:29:23 2025 -0500 scripts: add zboot support to extract-vmlinux Zboot compressed kernel images are used for arm64 kernels on various distros. extract-vmlinux fails with those kernels because the wrapped image is another PE. While this could be a bit confusing, the tools primary purpose of unwrapping and decompressing the contained kernel image makes it the obvious place for this functionality. Add a 'file' check in check_vmlinux() that detects a contained PE image before trying readelf. Recent (FILES_39, Jun/2020) file implementations output something like: "Linux kernel ARM64 boot executable Image, little-endian, 4K pages" Which is also a stronger statement than readelf provides so drop that part of the comment. At the same time this means that kernel images which don't appear to contain a compressed image will be returned rather than reporting an error. Which matches the behavior for existing ELF files. The extracted PE image can then be inspected, or used as would any other kernel PE. Signed-off-by: Jeremy Linton Signed-off-by: Masahiro Yamada commit d8f26717c901b7ec88c3151988fe70ecaed990b8 Author: Giuliano Procida Date: Tue Jul 1 16:19:11 2025 +0100 gendwarfksyms: order -T symtypes output by name When writing symtypes information, we iterate through the entire hash table containing type expansions. The key order varies unpredictably as new entries are added, making it harder to compare symtypes between builds. Resolve this by sorting the type expansions by name before output. Signed-off-by: Giuliano Procida Acked-by: Greg Kroah-Hartman Reviewed-by: Sami Tolvanen Signed-off-by: Masahiro Yamada commit e06aa69de21b6de2ef83f559768a4005114f5661 Author: Giuliano Procida Date: Tue Jul 1 16:19:10 2025 +0100 gendwarfksyms: use preferred form of sizeof for allocation The preferred form is to use the variable being allocated to, rather than explicitly supplying a type name which might become stale. Also do this for memset. Suggested-by: Masahiro Yamada Signed-off-by: Giuliano Procida Reviewed-by: Sami Tolvanen Signed-off-by: Masahiro Yamada commit 87433e3e06a6b6a78a541b6ac39000f41779a882 Author: Masahiro Yamada Date: Mon Jun 30 03:50:35 2025 +0900 kconfig: qconf: confine {begin,end}Group to constructor and destructor Call beginGroup() in the the constructor and endGroup() in the destructor. This looks cleaner. Signed-off-by: Masahiro Yamada commit 721bfe583c52ba1ea74b3736a31a9dcfe6dd6d95 Author: Masahiro Yamada Date: Mon Jun 30 03:48:56 2025 +0900 kconfig: qconf: fix ConfigList::updateListAllforAll() ConfigList::updateListForAll() and ConfigList::updateListAllforAll() are identical. Commit f9b918fae678 ("kconfig: qconf: move ConfigView::updateList(All) to ConfigList class") was a misconversion. Fixes: f9b918fae678 ("kconfig: qconf: move ConfigView::updateList(All) to ConfigList class") Signed-off-by: Masahiro Yamada commit 263e70bc42862af18dce43393ef14277827a0c7f Author: Masahiro Yamada Date: Mon Jun 30 03:48:31 2025 +0900 kconfig: add a function to dump all menu entries in a tree-like format This is useful for debugging purposes. menu_finalize() re-parents menu entries, and this function can be used to dump the final structure of the menu tree. Signed-off-by: Masahiro Yamada commit 65056488e8bfaf6626cd2bba9fa847b264d9fefc Author: Masahiro Yamada Date: Mon Jun 30 03:43:35 2025 +0900 kconfig: gconf: show GTK version in About dialog Likewise xconfig, it is useful to display the GTK version in the About dialog. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit bfa7375c10dfabf6b3289041c12d698861277d90 Author: Masahiro Yamada Date: Mon Jun 30 03:43:34 2025 +0900 kconfig: gconf: replace GtkHPaned and GtkVPaned with GtkPaned GtkHPaned and GtkVPaned are deprecated with GTK 3.2. [1] [2] Use GtkPaned instead. [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/3.2.0/gtk/gtkhpaned.c#L44 [2]: https://gitlab.gnome.org/GNOME/gtk/-/blob/3.2.0/gtk/gtkvpaned.c#L44 Signed-off-by: Masahiro Yamada commit d6f0b652d9b54af5a9cf3e926ecfba81c28e1fc4 Author: Masahiro Yamada Date: Mon Jun 30 03:43:33 2025 +0900 kconfig: gconf: replace GdkColor with GdkRGBA GdkColor is deprecated with GTK 3.14. [1] Use GdkRGBA instead. This fixes warnings such as: scripts/kconfig/gconf.c: In function ‘set_node’: scripts/kconfig/gconf.c:138:9: warning: ‘gdk_color_parse’ is deprecated: Use 'gdk_rgba_parse' instead [-Wdeprecated-declarations] 138 | gdk_color_parse(menu_is_visible(menu) ? "Black" : "DarkGray", &color); | ^~~~~~~~~~~~~~~ [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/3.14.0/gdk/deprecated/gdkcolor.h#L52 Signed-off-by: Masahiro Yamada Tested-by: Randy Dunlap commit df889fdbb8d4243504eba94e1c3a809a4996a219 Author: Masahiro Yamada Date: Mon Jun 30 03:43:32 2025 +0900 kconfig: gconf: replace GtkVbox with GtkBox GtkVBox is deprecated with GTK 3.2. [1] Use GtkBox instead. [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/3.2.0/gtk/gtkvbox.c#L47 Signed-off-by: Masahiro Yamada commit 9755d167bf51fad7091bd990f8d57006d6a60669 Author: Masahiro Yamada Date: Mon Jun 30 03:43:31 2025 +0900 kconfig: gconf: migrate to GTK 3 This commit switches from GTK 2.x to GTK 3, applying the following necessary changes: - Do not include individual headers - GtkObject is gone - Convert Glade to GtkBuilder Link: https://docs.gtk.org/gtk3/migrating-2to3.html Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit e06030c1ae3299f71ae38ccbdd4ae0a2d0aa9189 Author: Masahiro Yamada Date: Mon Jun 30 03:43:30 2025 +0900 kconfig: gconf: rename gconf.glade to gconf.ui The next commit will convert this file to GtkBuilder format. Rename it in advance to reflect the intended format. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit 894ad403439e54d3cdee77a538190dd08ae54789 Author: Masahiro Yamada Date: Mon Jun 30 03:43:29 2025 +0900 kconfig: gconf: rename display_tree_part() This function recreates the tree store to update the menu content. Rename it to recreate_tree() to better reflect its purpose. Signed-off-by: Masahiro Yamada commit 06ba76dc825703fa61cee72c2ae66508ef5f10ec Author: Masahiro Yamada Date: Mon Jun 30 03:43:28 2025 +0900 kconfig: gconf: use configure-event handler to adjust pane separator The size-request event handler is currently used to adjust the position of the horizontal separator in the right pane. However, the size-request signal is not available in GTK 3. Use the configure-event signal instead. Signed-off-by: Masahiro Yamada Tested-by: Randy Dunlap commit 0c82f50a06aa13e6fc29e17081094489d57745fd Author: Masahiro Yamada Date: Mon Jun 30 03:43:27 2025 +0900 kconfig: gconf: fix behavior of a menu under a symbol in split view A menu can be created under a symbol. [Example] menu "outer menu" config A bool "A" menu "inner menu" depends on A config B bool "B" endmenu endmenu After being re-parented by menu_finalize(), the menu tree is structured like follows: menu "outer menu" \-- A \-- menu "inner menu" \-- B In split view, the symbol A is shown in the right pane, so all of its descendants must also be shown there. This has never worked correctly. Signed-off-by: Masahiro Yamada commit 1f937cdf32689279297185be72751ae1c5566baf Author: Randy Dunlap Date: Thu Jun 26 20:06:12 2025 -0700 docs: kconfig: add alldefconfig to the all*configs Add "alldefconfig" to the explanation of the KCONFIG_ALLCONFIG environment variable usage so that all targets that use KCONFIG_ALLCONFIG are listed. Signed-off-by: Randy Dunlap Signed-off-by: Masahiro Yamada commit f468992936894c9ce3b1659cf38c230d33b77a16 Author: Shankari Anand Date: Thu Jun 26 00:36:54 2025 +0530 kconfig: nconf: Ensure null termination where strncpy is used strncpy() does not guarantee null-termination if the source string is longer than the destination buffer. Ensure the buffer is explicitly null-terminated to prevent potential string overflows or undefined behavior. Signed-off-by: Shankari Anand Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap Tested-by: Nicolas Schier Acked-by: Nicolas Schier commit 9ea0691e47b8c43aea42480d1f536f0d3916ecfc Merge: 95993dc3039e29 4a5dcb337395db Author: Martin KaFai Lau Date: Fri Jul 25 18:20:44 2025 -0700 Merge branch 'selftests-bpf-fix-a-few-dynptr-test-failures-with-64k-page-size' Yonghong Song says: ==================== selftests/bpf: Fix a few dynptr test failures with 64K page size There are a few dynptr test failures with arm64 64K page size. They are fixed in this patch set and please see individual patches for details. ==================== Link: https://patch.msgid.link/20250725043425.208128-1-yonghong.song@linux.dev Signed-off-by: Martin KaFai Lau commit 4a5dcb337395db24976090e84f52d48e597697f9 Author: Yonghong Song Date: Thu Jul 24 21:34:40 2025 -0700 selftests/bpf: Fix test dynptr/test_dynptr_memset_xdp_chunks failure For arm64 64K page size, the xdp data size was set to be more than 64K in one of previous patches. This will cause failure for bpf_dynptr_memset(). Since the failure of bpf_dynptr_memset() is expected with 64K page size, return success. Signed-off-by: Yonghong Song Signed-off-by: Martin KaFai Lau Link: https://patch.msgid.link/20250725043440.209266-1-yonghong.song@linux.dev commit 90f791a975af80964b1ae6a370598c5bb8f565a3 Author: Yonghong Song Date: Thu Jul 24 21:34:35 2025 -0700 selftests/bpf: Fix test dynptr/test_dynptr_copy_xdp failure For arm64 64K page size, the bpf_dynptr_copy() in test dynptr/test_dynptr_copy_xdp will succeed, but the test will failure with 4K page size. This patch made a change so the test will fail expectedly for both 4K and 64K page sizes. Signed-off-by: Yonghong Song Signed-off-by: Martin KaFai Lau Acked-by: Mykyta Yatsenko Link: https://patch.msgid.link/20250725043435.208974-1-yonghong.song@linux.dev commit 4c82768e413402c329043ed2a30a36bdfc82127b Author: Yonghong Song Date: Thu Jul 24 21:34:30 2025 -0700 selftests/bpf: Increase xdp data size for arm64 64K page size With arm64 64K page size, the following 4 subtests failed: #97/25 dynptr/test_probe_read_user_dynptr:FAIL #97/26 dynptr/test_probe_read_kernel_dynptr:FAIL #97/27 dynptr/test_probe_read_user_str_dynptr:FAIL #97/28 dynptr/test_probe_read_kernel_str_dynptr:FAIL These failures are due to function bpf_dynptr_check_off_len() in include/linux/bpf.h where there is a test if (len > size || offset > size - len) return -E2BIG; With 64K page size, the 'offset' is greater than 'size - len', which caused the test failure. For 64KB page size, this patch increased the xdp buffer size from 5000 to 90000. The above 4 test failures are fixed as 'size' value is increased. But it introduced two new failures: #97/4 dynptr/test_dynptr_copy_xdp:FAIL #97/12 dynptr/test_dynptr_memset_xdp_chunks:FAIL These two failures will be addressed in subsequent patches. Signed-off-by: Yonghong Song Signed-off-by: Martin KaFai Lau Acked-by: Mykyta Yatsenko Link: https://patch.msgid.link/20250725043430.208469-1-yonghong.song@linux.dev commit e3f96b3556e4856dc4125ce875e87c5b5028b40b Merge: d1f3dbad6f0dba 620e2392db235b Author: Jakub Kicinski Date: Fri Jul 25 17:01:58 2025 -0700 Merge branch 'net-dsa-microchip-add-ksz8463-switch-support' Tristram Ha says: ==================== net: dsa: microchip: Add KSZ8463 switch support This series of patches is to add KSZ8463 switch support to the KSZ DSA driver. ==================== Link: https://patch.msgid.link/20250725001753.6330-1-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit 620e2392db235ba3b9e9619912aadb8cadee15e7 Author: Tristram Ha Date: Thu Jul 24 17:17:53 2025 -0700 net: dsa: microchip: Disable PTP function of KSZ8463 The PTP function of KSZ8463 is on by default. However, its proprietary way of storing timestamp directly in a reserved field inside the PTP message header is not suitable for use with the current Linux PTP stack implementation. It is necessary to disable the PTP function to not interfere the normal operation of the MAC. Note the PTP driver for KSZ switches does not work for KSZ8463 and is not activated for it. Signed-off-by: Tristram Ha Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250725001753.6330-7-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit 006983e59755ea774c52468e9c13d360794be81e Author: Tristram Ha Date: Thu Jul 24 17:17:52 2025 -0700 net: dsa: microchip: Setup fiber ports for KSZ8463 The fiber ports in KSZ8463 cannot be detected internally, so it requires specifying that condition in the device tree. Like the one used in Micrel PHY the port link can only be read and there is no write to the PHY. The driver programs registers to operate fiber ports correctly. Signed-off-by: Tristram Ha Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250725001753.6330-6-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit 5bcdb1373a6c8ffbe2d139a9c7f1fa27d2525b10 Author: Tristram Ha Date: Thu Jul 24 17:17:51 2025 -0700 net: dsa: microchip: Write switch MAC address differently for KSZ8463 KSZ8463 uses 16-bit register definitions so it writes differently for 8-bit switch MAC address. Signed-off-by: Tristram Ha Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250725001753.6330-5-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit 15b8d3e38607efdae25d2845063cf5f6750ef89b Author: Tristram Ha Date: Thu Jul 24 17:17:50 2025 -0700 net: dsa: microchip: Use different registers for KSZ8463 KSZ8463 does not use same set of registers as KSZ8863 so it is necessary to change some registers when using KSZ8463. Signed-off-by: Tristram Ha Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250725001753.6330-4-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit 84c47bfc5b3b40b50b798b6b6c15e8a1442d936d Author: Tristram Ha Date: Thu Jul 24 17:17:49 2025 -0700 net: dsa: microchip: Add KSZ8463 switch support to KSZ DSA driver KSZ8463 switch is a 3-port switch based from KSZ8863. Its major difference from other KSZ SPI switches is its register access is not a simple continual 8-bit transfer with automatic address increase but uses a byte-enable mechanism specifying 8-bit, 16-bit, or 32-bit access. Its registers are also defined in 16-bit format because it shares a design with a MAC controller using 16-bit access. As a result some common register accesses need to be re-arranged. This patch adds the basic structure for using KSZ8463. It cannot use the same regmap table for other KSZ switches as it interprets the 16-bit value as little-endian and its SPI commands are different. KSZ8463 uses a byte-enable mechanism to specify 8-bit, 16-bit, and 32-bit access. The register is first shifted right by 2 then left by 4. Extra 4 bits are added. If the access is 8-bit one of the 4 bits is set. If the access is 16-bit two of the 4 bits are set. If the access is 32-bit all 4 bits are set. The SPI command for read or write is then added. Because of this register transformation separate SPI read and write functions are provided for KSZ8463. KSZ8463's internal PHYs use standard PHY register definitions so there is no need to remap things. However, the hardware has a bug that the high word and low word of the PHY id are swapped. In addition the port registers are arranged differently so KSZ8463 has its own mapping for port registers and PHY registers. Therefore the PORT_CTRL_ADDR macro is replaced with the get_port_addr helper function. Signed-off-by: Tristram Ha Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250725001753.6330-3-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit ba37d556eaf7c6d8dfc0a6c6da680b793276f903 Author: Tristram Ha Date: Thu Jul 24 17:17:48 2025 -0700 dt-bindings: net: dsa: microchip: Add KSZ8463 switch support KSZ8463 switch is a 3-port switch based from KSZ8863. Its register access is significantly different from the other KSZ SPI switches. Signed-off-by: Tristram Ha Acked-by: Krzysztof Kozlowski Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250725001753.6330-2-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit d1f3dbad6f0dbac6266c6b6b450af2aefde8481f Author: Mohsin Bashir Date: Thu Jul 24 16:51:40 2025 -0700 selftests: drv-net: Wait for bkg socat to start Currently, UDP exchange is prone to failure when cmd attempt to send data while socat in bkg is not ready. Since, the behavior is probabilistic, this can result in flakiness for XDP tests. While testing test_xdp_native_tx_mb() on netdevsim, a failure rate of around 1% in 500 500 iterations was observed. Use wait_port_listen() to ensure that the bkg socat is started and ready to receive before cmd start sending. With proposed changes, a re-run of the same test passed 100% of time. Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250724235140.2645885-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 8020ca54a87733c03a14c937fc4f175db2484185 Merge: c6dc26df6b4883 a5e290aab8fc60 Author: Jakub Kicinski Date: Fri Jul 25 16:55:38 2025 -0700 Merge branch 'arm64-dts-socfpga-enable-ethernet-support-for-agilex5' Matthew Gerlach says: ==================== arm64: dts: socfpga: enable ethernet support for Agilex5 This patch set enables ethernet support for the Agilex5 family of SOCFPGAs, and specifically enables gmac2 on the Agilex5 SOCFPGA Premium Development Kit. Patch 1 defines Agilex5 compatibility string in the device tree bindings. Patch 2 add the new compatibility string to dwmac-socfpga.c. ==================== Link: https://patch.msgid.link/20250724154052.205706-1-matthew.gerlach@altera.com Signed-off-by: Jakub Kicinski commit a5e290aab8fc60791486e24bc69f0fce91165a50 Author: Mun Yew Tham Date: Thu Jul 24 08:40:51 2025 -0700 net: stmmac: dwmac-socfpga: Add xgmac support for Agilex5 Add support for Agilex5 compatible value. Signed-off-by: Mun Yew Tham Signed-off-by: Matthew Gerlach Link: https://patch.msgid.link/20250724154052.205706-5-matthew.gerlach@altera.com Signed-off-by: Jakub Kicinski commit 92068a32f978cbeb159d23613c824dc3b077034f Author: Matthew Gerlach Date: Thu Jul 24 08:40:48 2025 -0700 dt-bindings: net: altr,socfpga-stmmac: Add compatible string for Agilex5 Add compatible string for the Altera Agilex5 variant of the Synopsys DWC XGMAC IP version 2.10. Signed-off-by: Matthew Gerlach Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250724154052.205706-2-matthew.gerlach@altera.com Signed-off-by: Jakub Kicinski commit eccf7a3480a06eb698f064af829733bd8d0ec263 Merge: 49db61c27c4bbd 788199b73b6efe Author: Jakub Kicinski Date: Fri Jul 25 16:48:37 2025 -0700 Merge tag 'linux-can-fixes-for-6.16-20250725' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can Marc Kleine-Budde says: ==================== pull-request: can 2025-07-25 The patch is by Stephane Grosjean and adds support the recent firmware of USB CAN FD interfaces to the peak_usb driver. * tag 'linux-can-fixes-for-6.16-20250725' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can: can: peak_usb: fix USB FD devices potential malfunction ==================== Link: https://patch.msgid.link/20250725101619.4095105-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit c6dc26df6b4883de63cb237b4070feba92b01a87 Merge: ecc383e5fe060f 8b4a1a46e84a17 Author: Jakub Kicinski Date: Fri Jul 25 16:37:54 2025 -0700 Merge tag 'nf-next-25-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter/IPVS updates for net-next The following series contains Netfilter/IPVS updates for net-next: 1) Display netns inode in conntrack table full log, from lvxiafei. 2) Autoload nf_log_syslog in case no logging backend is available, from Lance Yang. 3) Three patches to remove unused functions in x_tables, nf_tables and conntrack. From Yue Haibing. 4) Exclude LEGACY TABLES on PREEMPT_RT: Add NETFILTER_XTABLES_LEGACY to exclude xtables legacy infrastructure. 5) Restore selftests by toggling NETFILTER_XTABLES_LEGACY where needed. From Florian Westphal. 6) Use CONFIG_INET_SCTP_DIAG in tools/testing/selftests/net/netfilter/config, from Sebastian Andrzej Siewior. 7) Use timer_delete in comment in IPVS codebase, from WangYuli. 8) Dump flowtable information in nfnetlink_hook, this includes an initial patch to consolidate common code in helper function, from Phil Sutter. 9) Remove unused arguments in nft_pipapo set backend, from Florian Westphal. 10) Return nft_set_ext instead of boolean in set lookup function, from Florian Westphal. 11) Remove indirection in dynamic set infrastructure, also from Florian. 12) Consolidate pipapo_get/lookup, from Florian. 13) Use kvmalloc in nft_pipapop, from Florian Westphal. 14) syzbot reports slab-out-of-bounds in xt_nfacct log message, fix from Florian Westphal. 15) Ignored tainted kernels in selftest nft_interface_stress.sh, from Phil Sutter. 16) Fix IPVS selftest by disabling rp_filter with ipip tunnel device, from Yi Chen. * tag 'nf-next-25-07-25' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: selftests: netfilter: ipvs.sh: Explicity disable rp_filter on interface tunl0 selftests: netfilter: Ignore tainted kernels in interface stress test netfilter: xt_nfacct: don't assume acct name is null-terminated netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps netfilter: nft_set_pipapo: merge pipapo_get/lookup netfilter: nft_set: remove indirection from update API call netfilter: nft_set: remove one argument from lookup and update functions netfilter: nft_set_pipapo: remove unused arguments netfilter: nfnetlink_hook: Dump flowtable info netfilter: nfnetlink: New NFNLA_HOOK_INFO_DESC helper ipvs: Rename del_timer in comment in ip_vs_conn_expire_now() selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG selftests: net: Enable legacy netfilter legacy options. netfilter: Exclude LEGACY TABLES on PREEMPT_RT. netfilter: conntrack: Remove unused net in nf_conntrack_double_lock() netfilter: nf_tables: Remove unused nft_reduce_is_readonly() netfilter: x_tables: Remove unused functions xt_{in|out}name() netfilter: load nf_log_syslog on enabling nf_conntrack_log_invalid netfilter: conntrack: table full detailed log ==================== Link: https://patch.msgid.link/20250725170340.21327-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit ecc383e5fe060f1aaad0e4e4ae36ad1c899e948d Merge: e9e91870ac21ad ecd82dfb4ccdfa Author: Jakub Kicinski Date: Fri Jul 25 16:27:19 2025 -0700 Merge tag 'linux-can-next-for-6.17-20250725' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-07-25 The first patch is by Khaled Elnaggar and converts the janz-ican3 driver's fwinfo_show() to sysfs_emit(). Vincent Mailhol contributes 3 patches that first fix a warning in the ti_hecc driver and then add missing COMPILE_TEST more compile coverage to the ti_hecc and tscan1 driver. Randy Dunlap's patch let's the tscan1 driver depend on PC104. A patch by Luis Felipe Hernandez fixes a kernel-doc error in the ctucanfd driver. Jimmy Assarsson contributes 10 patches for the kvaser_pciefd and 11 for the kvaser_usb driver. Both series simplify the identification of physical the CAN interfaces and add devlink support to get information about the running firmware. * tag 'linux-can-next-for-6.17-20250725' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: (27 commits) Documentation: devlink: add devlink documentation for the kvaser_usb driver can: kvaser_usb: Add devlink port support can: kvaser_usb: Expose device information via devlink info_get() can: kvaser_usb: Add devlink support can: kvaser_usb: Store additional device information can: kvaser_usb: Store the different firmware version components in a struct can: kvaser_usb: Move comment regarding max_tx_urbs can: kvaser_usb: Add intermediate variables can: kvaser_usb: Assign netdev.dev_port based on device channel index can: kvaser_usb: Add support for ethtool set_phys_id() can: kvaser_usb: Add support to control CAN LEDs on device Documentation: devlink: add devlink documentation for the kvaser_pciefd driver can: kvaser_pciefd: Add devlink port support can: kvaser_pciefd: Expose device firmware version via devlink info_get() can: kvaser_pciefd: Add devlink support can: kvaser_pciefd: Split driver into C-file and header-file. can: kvaser_pciefd: Store device channel index can: kvaser_pciefd: Store the different firmware version components in a struct can: kvaser_pciefd: Add intermediate variable for device struct in probe() can: kvaser_pciefd: Add support for ethtool set_phys_id() ... ==================== Link: https://patch.msgid.link/20250725161327.4165174-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit e9e91870ac21ad7941774b62e2b9af2658dc503c Merge: bf3c032bfe1648 026cea3c61c2d4 Author: Jakub Kicinski Date: Fri Jul 25 16:01:18 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== libie: commonize adminq structure Michal Swiatkowski says: It is a prework to allow reusing some specific Intel code (eq. fwlog). Move common *_aq_desc structure to libie header and changing it in ice, ixgbe, i40e and iavf. Only generic adminq commands can be easily moved to common header, as rest is slightly different. Format remains the same. It will be better to correctly move it when it will be needed to commonize other part of the code. Move *_aq_str() to new libie module (libie_adminq) and use it across drivers. The functions are exactly the same in each driver. Some more adminq helpers/functions can be moved to libie_adminq when needed. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: i40e: use libie_aq_str iavf: use libie_aq_str ice: use libie_aq_str libie: add adminq helper for converting err to str iavf: use libie adminq descriptors i40e: use libie adminq descriptors ixgbe: use libie adminq descriptors ice, libie: move generic adminq descriptors to lib ==================== Link: https://patch.msgid.link/20250724182826.3758850-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit bf3c032bfe16489abe38986e2c05fb5f9073319f Author: Fan Yu Date: Thu Jul 24 21:28:37 2025 +0800 net/sched: Add precise drop reason for pfifo_fast queue overflows Currently, packets dropped by pfifo_fast due to queue overflow are marked with a generic SKB_DROP_REASON_QDISC_DROP in __dev_xmit_skb(). This patch adds explicit drop reason SKB_DROP_REASON_QDISC_OVERLIMIT for queue-full cases, providing better distinction from other qdisc drops. Signed-off-by: Fan Yu Reviewed-by: Cong Wang Link: https://patch.msgid.link/20250724212837119BP9HOs0ibXDRWgsXMMir7@zte.com.cn Signed-off-by: Jakub Kicinski commit 736a0516a16268995f4898eded49bfef077af709 Author: Viacheslav Dubeyko Date: Thu Jul 10 14:36:57 2025 -0700 hfs: fix general protection fault in hfs_find_init() The hfs_find_init() method can trigger the crash if tree pointer is NULL: [ 45.746290][ T9787] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000008: 0000 [#1] SMP KAI [ 45.747287][ T9787] KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] [ 45.748716][ T9787] CPU: 2 UID: 0 PID: 9787 Comm: repro Not tainted 6.16.0-rc3 #10 PREEMPT(full) [ 45.750250][ T9787] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 45.751983][ T9787] RIP: 0010:hfs_find_init+0x86/0x230 [ 45.752834][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc [ 45.755574][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202 [ 45.756432][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09 [ 45.757457][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8 [ 45.758282][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000 [ 45.758943][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004 [ 45.759619][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000 [ 45.760293][ T9787] FS: 00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000 [ 45.761050][ T9787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.761606][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0 [ 45.762286][ T9787] Call Trace: [ 45.762570][ T9787] [ 45.762824][ T9787] hfs_ext_read_extent+0x190/0x9d0 [ 45.763269][ T9787] ? submit_bio_noacct_nocheck+0x2dd/0xce0 [ 45.763766][ T9787] ? __pfx_hfs_ext_read_extent+0x10/0x10 [ 45.764250][ T9787] hfs_get_block+0x55f/0x830 [ 45.764646][ T9787] block_read_full_folio+0x36d/0x850 [ 45.765105][ T9787] ? __pfx_hfs_get_block+0x10/0x10 [ 45.765541][ T9787] ? const_folio_flags+0x5b/0x100 [ 45.765972][ T9787] ? __pfx_hfs_read_folio+0x10/0x10 [ 45.766415][ T9787] filemap_read_folio+0xbe/0x290 [ 45.766840][ T9787] ? __pfx_filemap_read_folio+0x10/0x10 [ 45.767325][ T9787] ? __filemap_get_folio+0x32b/0xbf0 [ 45.767780][ T9787] do_read_cache_folio+0x263/0x5c0 [ 45.768223][ T9787] ? __pfx_hfs_read_folio+0x10/0x10 [ 45.768666][ T9787] read_cache_page+0x5b/0x160 [ 45.769070][ T9787] hfs_btree_open+0x491/0x1740 [ 45.769481][ T9787] hfs_mdb_get+0x15e2/0x1fb0 [ 45.769877][ T9787] ? __pfx_hfs_mdb_get+0x10/0x10 [ 45.770316][ T9787] ? find_held_lock+0x2b/0x80 [ 45.770731][ T9787] ? lockdep_init_map_type+0x5c/0x280 [ 45.771200][ T9787] ? lockdep_init_map_type+0x5c/0x280 [ 45.771674][ T9787] hfs_fill_super+0x38e/0x720 [ 45.772092][ T9787] ? __pfx_hfs_fill_super+0x10/0x10 [ 45.772549][ T9787] ? snprintf+0xbe/0x100 [ 45.772931][ T9787] ? __pfx_snprintf+0x10/0x10 [ 45.773350][ T9787] ? do_raw_spin_lock+0x129/0x2b0 [ 45.773796][ T9787] ? find_held_lock+0x2b/0x80 [ 45.774215][ T9787] ? set_blocksize+0x40a/0x510 [ 45.774636][ T9787] ? sb_set_blocksize+0x176/0x1d0 [ 45.775087][ T9787] ? setup_bdev_super+0x369/0x730 [ 45.775533][ T9787] get_tree_bdev_flags+0x384/0x620 [ 45.775985][ T9787] ? __pfx_hfs_fill_super+0x10/0x10 [ 45.776453][ T9787] ? __pfx_get_tree_bdev_flags+0x10/0x10 [ 45.776950][ T9787] ? bpf_lsm_capable+0x9/0x10 [ 45.777365][ T9787] ? security_capable+0x80/0x260 [ 45.777803][ T9787] vfs_get_tree+0x8e/0x340 [ 45.778203][ T9787] path_mount+0x13de/0x2010 [ 45.778604][ T9787] ? kmem_cache_free+0x2b0/0x4c0 [ 45.779052][ T9787] ? __pfx_path_mount+0x10/0x10 [ 45.779480][ T9787] ? getname_flags.part.0+0x1c5/0x550 [ 45.779954][ T9787] ? putname+0x154/0x1a0 [ 45.780335][ T9787] __x64_sys_mount+0x27b/0x300 [ 45.780758][ T9787] ? __pfx___x64_sys_mount+0x10/0x10 [ 45.781232][ T9787] do_syscall_64+0xc9/0x480 [ 45.781631][ T9787] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 45.782149][ T9787] RIP: 0033:0x7ffb7265b6ca [ 45.782539][ T9787] Code: 48 8b 0d c9 17 0d 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 [ 45.784212][ T9787] RSP: 002b:00007ffc0c10cfb8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 [ 45.784935][ T9787] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffb7265b6ca [ 45.785626][ T9787] RDX: 0000200000000240 RSI: 0000200000000280 RDI: 00007ffc0c10d100 [ 45.786316][ T9787] RBP: 00007ffc0c10d190 R08: 00007ffc0c10d000 R09: 0000000000000000 [ 45.787011][ T9787] R10: 0000000000000048 R11: 0000000000000206 R12: 0000560246733250 [ 45.787697][ T9787] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 45.788393][ T9787] [ 45.788665][ T9787] Modules linked in: [ 45.789058][ T9787] ---[ end trace 0000000000000000 ]--- [ 45.789554][ T9787] RIP: 0010:hfs_find_init+0x86/0x230 [ 45.790028][ T9787] Code: c1 ea 03 80 3c 02 00 0f 85 9a 01 00 00 4c 8d 6b 40 48 c7 45 18 00 00 00 00 48 b8 00 00 00 00 00 fc [ 45.792364][ T9787] RSP: 0018:ffffc90015157668 EFLAGS: 00010202 [ 45.793155][ T9787] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff819a4d09 [ 45.794123][ T9787] RDX: 0000000000000008 RSI: ffffffff819acd3a RDI: ffffc900151576e8 [ 45.795105][ T9787] RBP: ffffc900151576d0 R08: 0000000000000005 R09: 0000000000000000 [ 45.796135][ T9787] R10: 0000000080000000 R11: 0000000000000001 R12: 0000000000000004 [ 45.797114][ T9787] R13: 0000000000000040 R14: ffff88802c50814a R15: 0000000000000000 [ 45.798024][ T9787] FS: 00007ffb72734540(0000) GS:ffff8880cec64000(0000) knlGS:0000000000000000 [ 45.799019][ T9787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 45.799822][ T9787] CR2: 00007f9bd8225000 CR3: 000000010979a000 CR4: 00000000000006f0 [ 45.800747][ T9787] Kernel panic - not syncing: Fatal exception The hfs_fill_super() calls hfs_mdb_get() method that tries to construct Extents Tree and Catalog Tree: HFS_SB(sb)->ext_tree = hfs_btree_open(sb, HFS_EXT_CNID, hfs_ext_keycmp); if (!HFS_SB(sb)->ext_tree) { pr_err("unable to open extent tree\n"); goto out; } HFS_SB(sb)->cat_tree = hfs_btree_open(sb, HFS_CAT_CNID, hfs_cat_keycmp); if (!HFS_SB(sb)->cat_tree) { pr_err("unable to open catalog tree\n"); goto out; } However, hfs_btree_open() calls read_mapping_page() that calls hfs_get_block(). And this method calls hfs_ext_read_extent(): static int hfs_ext_read_extent(struct inode *inode, u16 block) { struct hfs_find_data fd; int res; if (block >= HFS_I(inode)->cached_start && block < HFS_I(inode)->cached_start + HFS_I(inode)->cached_blocks) return 0; res = hfs_find_init(HFS_SB(inode->i_sb)->ext_tree, &fd); if (!res) { res = __hfs_ext_cache_extent(&fd, inode, block); hfs_find_exit(&fd); } return res; } The problem here that hfs_find_init() is trying to use HFS_SB(inode->i_sb)->ext_tree that is not initialized yet. It will be initailized when hfs_btree_open() finishes the execution. The patch adds checking of tree pointer in hfs_find_init() and it reworks the logic of hfs_btree_open() by reading the b-tree's header directly from the volume. The read_mapping_page() is exchanged on filemap_grab_folio() that grab the folio from mapping. Then, sb_bread() extracts the b-tree's header content and copy it into the folio. Reported-by: Wenzhi Wang Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/20250710213657.108285-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit a431930c9bac518bf99d6b1da526a7f37ddee8d8 Author: Viacheslav Dubeyko Date: Thu Jul 3 14:49:12 2025 -0700 hfs: fix slab-out-of-bounds in hfs_bnode_read() This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfs_bnode_read(), hfs_bnode_write(), hfs_bnode_clear(), hfs_bnode_copy(), and hfs_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash. Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250703214912.244138-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit c80aa2aaaa5e69d5219c6af8ef7e754114bd08d2 Author: Viacheslav Dubeyko Date: Thu Jul 3 14:48:04 2025 -0700 hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x320 [ 174.883144][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.883595][ T9784] hfsplus_rmdir+0x106/0x1b0 [ 174.884004][ T9784] vfs_rmdir+0x206/0x690 [ 174.884379][ T9784] do_rmdir+0x2b7/0x390 [ 174.884751][ T9784] __x64_sys_rmdir+0xc5/0x110 [ 174.885167][ T9784] do_syscall_64+0xc9/0x480 [ 174.885568][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.886083][ T9784] [ 174.886293][ T9784] The buggy address belongs to the object at ffff88810b5fc600 [ 174.886293][ T9784] which belongs to the cache kmalloc-192 of size 192 [ 174.887507][ T9784] The buggy address is located 40 bytes to the right of [ 174.887507][ T9784] allocated 152-byte region [ffff88810b5fc600, ffff88810b5fc698) [ 174.888766][ T9784] [ 174.888976][ T9784] The buggy address belongs to the physical page: [ 174.889533][ T9784] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10b5fc [ 174.890295][ T9784] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff) [ 174.890927][ T9784] page_type: f5(slab) [ 174.891284][ T9784] raw: 057ff00000000000 ffff88801b4423c0 ffffea000426dc80 dead000000000002 [ 174.892032][ T9784] raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000 [ 174.892774][ T9784] page dumped because: kasan: bad access detected [ 174.893327][ T9784] page_owner tracks the page as allocated [ 174.893825][ T9784] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c00(GFP_NOIO|__GFP_NOWARN|__GFP_NO1 [ 174.895373][ T9784] post_alloc_hook+0x1c0/0x230 [ 174.895801][ T9784] get_page_from_freelist+0xdeb/0x3b30 [ 174.896284][ T9784] __alloc_frozen_pages_noprof+0x25c/0x2460 [ 174.896810][ T9784] alloc_pages_mpol+0x1fb/0x550 [ 174.897242][ T9784] new_slab+0x23b/0x340 [ 174.897614][ T9784] ___slab_alloc+0xd81/0x1960 [ 174.898028][ T9784] __slab_alloc.isra.0+0x56/0xb0 [ 174.898468][ T9784] __kmalloc_noprof+0x2b0/0x550 [ 174.898896][ T9784] usb_alloc_urb+0x73/0xa0 [ 174.899289][ T9784] usb_control_msg+0x1cb/0x4a0 [ 174.899718][ T9784] usb_get_string+0xab/0x1a0 [ 174.900133][ T9784] usb_string_sub+0x107/0x3c0 [ 174.900549][ T9784] usb_string+0x307/0x670 [ 174.900933][ T9784] usb_cache_string+0x80/0x150 [ 174.901355][ T9784] usb_new_device+0x1d0/0x19d0 [ 174.901786][ T9784] register_root_hub+0x299/0x730 [ 174.902231][ T9784] page last free pid 10 tgid 10 stack trace: [ 174.902757][ T9784] __free_frozen_pages+0x80c/0x1250 [ 174.903217][ T9784] vfree.part.0+0x12b/0xab0 [ 174.903645][ T9784] delayed_vfree_work+0x93/0xd0 [ 174.904073][ T9784] process_one_work+0x9b5/0x1b80 [ 174.904519][ T9784] worker_thread+0x630/0xe60 [ 174.904927][ T9784] kthread+0x3a8/0x770 [ 174.905291][ T9784] ret_from_fork+0x517/0x6e0 [ 174.905709][ T9784] ret_from_fork_asm+0x1a/0x30 [ 174.906128][ T9784] [ 174.906338][ T9784] Memory state around the buggy address: [ 174.906828][ T9784] ffff88810b5fc580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 174.907528][ T9784] ffff88810b5fc600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 174.908222][ T9784] >ffff88810b5fc680: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc [ 174.908917][ T9784] ^ [ 174.909481][ T9784] ffff88810b5fc700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 174.910432][ T9784] ffff88810b5fc780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 174.911401][ T9784] ================================================================== The reason of the issue that code doesn't check the correctness of the requested offset and length. As a result, incorrect value of offset or/and length could result in access out of allocated memory. This patch introduces is_bnode_offset_valid() method that checks the requested offset value. Also, it introduces check_and_correct_requested_length() method that checks and correct the requested length (if it is necessary). These methods are used in hfsplus_bnode_read(), hfsplus_bnode_write(), hfsplus_bnode_clear(), hfsplus_bnode_copy(), and hfsplus_bnode_move() with the goal to prevent the access out of allocated memory and triggering the crash. Reported-by: Kun Hu Reported-by: Jiaji Qin Reported-by: Shuoran Bai Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250703214804.244077-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit fad4df29c2d1d5cd634ebc9121b6f5dd8becd44b Merge: 4020b7bafbb720 511d10b4c2f91f Author: Jakub Kicinski Date: Fri Jul 25 15:30:01 2025 -0700 Merge branch 'net-add-sockaddr_inet-unified-address-structure' Kees Cook says: ==================== net: Add sockaddr_inet unified address structure Repeating patch 1, as it has the rationale: There are cases in networking (e.g. wireguard, sctp) where a union is used to provide coverage for either IPv4 or IPv6 network addresses, and they include an embedded "struct sockaddr" as well (for "sa_family" and raw "sa_data" access). The current struct sockaddr contains a flexible array, which means these unions should not be further embedded in other structs because they do not technically have a fixed size (and are generating warnings for the coming -Wflexible-array-not-at-end flag addition). But the future changes to make struct sockaddr a fixed size (i.e. with a 14 byte sa_data member) make the "sa_data" uses with an IPv6 address a potential place for the compiler to get upset about object size mismatches. Therefore, we need a sockaddr that cleanly provides both an sa_family member and an appropriately fixed-sized sa_data member that does not bloat member usage via the potential alternative of sockaddr_storage to cover both IPv4 and IPv6, to avoid unseemly churn in the affected code bases. Introduce sockaddr_inet as a unified structure for holding both IPv4 and IPv6 addresses (i.e. large enough to accommodate sockaddr_in6). The structure is defined in linux/in6.h since its max size is sized based on sockaddr_in6 and provides a more specific alternative to the generic sockaddr_storage for IPv4 with IPv6 address family handling. The "sa_family" member doesn't use the sa_family_t type to avoid needing layer violating header inclusions. Also includes the replacements for wireguard and sctp. ==================== Link: https://patch.msgid.link/20250722171528.work.209-kees@kernel.org Signed-off-by: Jakub Kicinski commit 511d10b4c2f91fb6aa676006b2bdff4df5d6e270 Author: Kees Cook Date: Tue Jul 22 10:18:33 2025 -0700 sctp: Replace sockaddr with sockaddr_inet in sctp_addr union As part of the removal of the variably-sized sockaddr for kernel internals, replace struct sockaddr with sockaddr_inet in the sctp_addr union. No binary changes; the union size remains unchanged due to sockaddr_inet matching the size of sockaddr_in6. Signed-off-by: Kees Cook Link: https://patch.msgid.link/20250722171836.1078436-3-kees@kernel.org Signed-off-by: Jakub Kicinski commit 9203e0a82c0b0c4b12d96d6f6f9ef9afbb6ca9c6 Author: Kees Cook Date: Tue Jul 22 10:18:32 2025 -0700 wireguard: peer: Replace sockaddr with sockaddr_inet As part of the removal of the variably-sized sockaddr for kernel internals, replace struct sockaddr with sockaddr_inet in the endpoint union. No binary changes; the union size remains unchanged due to sockaddr_inet matching the size of sockaddr_in6. Signed-off-by: Kees Cook Link: https://patch.msgid.link/20250722171836.1078436-2-kees@kernel.org Signed-off-by: Jakub Kicinski commit 463deed51796fd0995d08d8b6aa793d7ab5a2059 Author: Kees Cook Date: Tue Jul 22 10:18:31 2025 -0700 ipv6: Add sockaddr_inet unified address structure There are cases in networking (e.g. wireguard, sctp) where a union is used to provide coverage for either IPv4 or IPv6 network addresses, and they include an embedded "struct sockaddr" as well (for "sa_family" and raw "sa_data" access). The current struct sockaddr contains a flexible array, which means these unions should not be further embedded in other structs because they do not technically have a fixed size (and are generating warnings for the coming -Wflexible-array-not-at-end flag addition). But the future changes to make struct sockaddr a fixed size (i.e. with a 14 byte sa_data member) make the "sa_data" uses with an IPv6 address a potential place for the compiler to get upset about object size mismatches. Therefore, we need a sockaddr that cleanly provides both an sa_family member and an appropriately fixed-sized sa_data member that does not bloat member usage via the potential alternative of sockaddr_storage to cover both IPv4 and IPv6, to avoid unseemly churn in the affected code bases. Introduce sockaddr_inet as a unified structure for holding both IPv4 and IPv6 addresses (i.e. large enough to accommodate sockaddr_in6). The structure is defined in linux/in6.h since its max size is sized based on sockaddr_in6 and provides a more specific alternative to the generic sockaddr_storage for IPv4 with IPv6 address family handling. The "sa_family" member doesn't use the sa_family_t type to avoid needing layer violating header inclusions. Signed-off-by: Kees Cook Link: https://patch.msgid.link/20250722171836.1078436-1-kees@kernel.org Signed-off-by: Jakub Kicinski commit 4020b7bafbb720c5ee5317ef395a7547aaddc67b Merge: cf51016ba8c343 5474ca2118191a Author: Jakub Kicinski Date: Fri Jul 25 15:27:56 2025 -0700 Merge branch 'net-mlx5e-misc-changes-2025-07-22' Tariq Toukan says: ==================== net/mlx5e: misc changes 2025-07-22 This series contains misc enhancements to the mlx5e driver. ==================== Link: https://patch.msgid.link/1753194228-333722-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 5474ca2118191abe27ba089737eace66a9b51d8f Author: Feng Liu Date: Tue Jul 22 17:23:48 2025 +0300 net/mlx5e: Expose TIS via devlink tx reporter diagnose Underneath "TIS Config" tag expose TIS diagnostic information. Expose the tisn of each TC under each lag port. $ sudo devlink health diagnose auxiliary/mlx5_core.eth.2/131072 reporter tx ...... TIS Config: lag port: 0 tc: 0 tisn: 0 lag port: 1 tc: 0 tisn: 8 ...... Signed-off-by: Feng Liu Reviewed-by: Aya Levin Signed-off-by: Tariq Toukan Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/1753194228-333722-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 71670f766b8f4c1490e07ad4394e8e27c03b2e91 Author: Alexandre Cassen Date: Tue Jul 22 17:23:47 2025 +0300 net/mlx5e: Support routed networks during IPsec MACs initialization Remote IPsec tunnel endpoint may refer to a network segment that is not directly connected to the host. In such a case, IPsec tunnel endpoints are connected to a router and reachable via a routing path. In IPsec packet offload mode, HW is initialized with the MAC address of both IPsec tunnel endpoints. Extend the current IPsec init MACs procedure to resolve nexthop for routed networks. Direct neighbour lookup and probe is still used for directly connected networks and as a fallback mechanism if fib lookup fails. Signed-off-by: Alexandre Cassen Signed-off-by: Leon Romanovsky Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/1753194228-333722-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 94458781aee6045bd3d0ad4b80b02886b9e2219b Author: Viacheslav Dubeyko Date: Thu Jul 10 16:08:30 2025 -0700 hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.152580][ T9805] [ 667.152798][ T9805] The buggy address belongs to the physical page: [ 667.153373][ T9805] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25928 [ 667.154157][ T9805] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 667.154916][ T9805] anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 667.155631][ T9805] page_type: f5(slab) [ 667.155997][ T9805] raw: 00fff00000000040 ffff88801b442f00 0000000000000000 dead000000000001 [ 667.156770][ T9805] raw: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 667.157536][ T9805] head: 00fff00000000040 ffff88801b442f00 0000000000000000 dead000000000001 [ 667.158317][ T9805] head: 0000000000000000 0000000080080008 00000000f5000000 0000000000000000 [ 667.159088][ T9805] head: 00fff00000000003 ffffea0000964a01 00000000ffffffff 00000000ffffffff [ 667.159865][ T9805] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 667.160643][ T9805] page dumped because: kasan: bad access detected [ 667.161216][ T9805] page_owner tracks the page as allocated [ 667.161732][ T9805] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN9 [ 667.163566][ T9805] post_alloc_hook+0x1c0/0x230 [ 667.164003][ T9805] get_page_from_freelist+0xdeb/0x3b30 [ 667.164503][ T9805] __alloc_frozen_pages_noprof+0x25c/0x2460 [ 667.165040][ T9805] alloc_pages_mpol+0x1fb/0x550 [ 667.165489][ T9805] new_slab+0x23b/0x340 [ 667.165872][ T9805] ___slab_alloc+0xd81/0x1960 [ 667.166313][ T9805] __slab_alloc.isra.0+0x56/0xb0 [ 667.166767][ T9805] __kmalloc_cache_noprof+0x255/0x3e0 [ 667.167255][ T9805] psi_cgroup_alloc+0x52/0x2d0 [ 667.167693][ T9805] cgroup_mkdir+0x694/0x1210 [ 667.168118][ T9805] kernfs_iop_mkdir+0x111/0x190 [ 667.168568][ T9805] vfs_mkdir+0x59b/0x8d0 [ 667.168956][ T9805] do_mkdirat+0x2ed/0x3d0 [ 667.169353][ T9805] __x64_sys_mkdir+0xef/0x140 [ 667.169784][ T9805] do_syscall_64+0xc9/0x480 [ 667.170195][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.170730][ T9805] page last free pid 1257 tgid 1257 stack trace: [ 667.171304][ T9805] __free_frozen_pages+0x80c/0x1250 [ 667.171770][ T9805] vfree.part.0+0x12b/0xab0 [ 667.172182][ T9805] delayed_vfree_work+0x93/0xd0 [ 667.172612][ T9805] process_one_work+0x9b5/0x1b80 [ 667.173067][ T9805] worker_thread+0x630/0xe60 [ 667.173486][ T9805] kthread+0x3a8/0x770 [ 667.173857][ T9805] ret_from_fork+0x517/0x6e0 [ 667.174278][ T9805] ret_from_fork_asm+0x1a/0x30 [ 667.174703][ T9805] [ 667.174917][ T9805] Memory state around the buggy address: [ 667.175411][ T9805] ffff88802592f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 667.176114][ T9805] ffff88802592f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 667.176830][ T9805] >ffff88802592f400: 00 04 fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.177547][ T9805] ^ [ 667.177933][ T9805] ffff88802592f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.178640][ T9805] ffff88802592f500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 667.179350][ T9805] ================================================================== The hfsplus_uni2asc() method operates by struct hfsplus_unistr: struct hfsplus_unistr { __be16 length; hfsplus_unichr unicode[HFSPLUS_MAX_STRLEN]; } __packed; where HFSPLUS_MAX_STRLEN is 255 bytes. The issue happens if length of the structure instance has value bigger than 255 (for example, 65283). In such case, pointer on unicode buffer is going beyond of the allocated memory. The patch fixes the issue by checking the length value of hfsplus_unistr instance and using 255 value in the case if length value is bigger than HFSPLUS_MAX_STRLEN. Potential reason of such situation could be a corruption of Catalog File b-tree's node. Reported-by: Wenzhi Wang Signed-off-by: Liu Shixin Signed-off-by: Viacheslav Dubeyko cc: John Paul Adrian Glaubitz cc: Yangtao Li cc: linux-fsdevel@vger.kernel.org Reviewed-by: Yangtao Li Link: https://lore.kernel.org/r/20250710230830.110500-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit c7c6363ca186747ebc2df10c8a1a51e66e0e32d9 Author: Tetsuo Handa Date: Tue Jul 15 14:17:56 2025 +0900 hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() When the volume header contains erroneous values that do not reflect the actual state of the filesystem, hfsplus_fill_super() assumes that the attributes file is not yet created, which later results in hitting BUG_ON() when hfsplus_create_attributes_file() is called. Replace this BUG_ON() with -EIO error with a message to suggest running fsck tool. Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=1107451c16b9eb9d29e6 Signed-off-by: Tetsuo Handa Reviewed-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/7b587d24-c8a1-4413-9b9a-00a33fbd849f@I-love.SAKURA.ne.jp Signed-off-by: Viacheslav Dubeyko commit 4c6a567cb8e8e0eb7fc559e8cecbae7d83aaafbb Author: Johannes Thumshirn Date: Thu Jul 10 08:35:53 2025 +0200 hfsplus: don't set REQ_SYNC for hfsplus_submit_bio() hfsplus_submit_bio() called by hfsplus_sync_fs() uses bdev_virt_rw() which in turn uses submit_bio_wait() to submit the BIO. But submit_bio_wait() already sets the REQ_SYNC flag on the BIO so there is no need for setting the flag in hfsplus_sync_fs() when calling hfsplus_submit_bio(). Signed-off-by: Johannes Thumshirn Reviewed-by: Yangtao Li Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250710063553.4805-1-johannes.thumshirn@wdc.com Link: https://lore.kernel.org/r/20250710063553.4805-1-johannes.thumshirn@wdc.com Signed-off-by: Viacheslav Dubeyko commit 4507d205f10216d3a6b873f0a2e9c634e23f35ac Merge: edf0a4053aa60c b1136432c97241 Author: Arnd Bergmann Date: Tue Jul 22 22:54:08 2025 +0200 Merge tag 'hisi-drivers-for-6.17' of https://github.com/hisilicon/linux-hisi into soc/drivers HiSilicon driver updates for v6.17 - Print the hardware ID instead of the index in the HCCS driver * tag 'hisi-drivers-for-6.17' of https://github.com/hisilicon/linux-hisi: soc: hisilicon: kunpeng_hccs: Fix incorrect log information Link: https://lore.kernel.org/r/6879FFED.1050002@hisilicon.com Signed-off-by: Arnd Bergmann commit edf0a4053aa60c96010404629c092ebf7968a051 Merge: 5b8141596b06fb 4587d3910f805a Author: Arnd Bergmann Date: Tue Jul 22 22:53:09 2025 +0200 Merge tag 'qcom-drivers-for-6.17-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers More Qualcomm driver updates for v6.17 Fix race condition during SCM driver initialization, in relation to tzmem and waitqueue irq handling, Make the rpmh RSC driver support version 4 of the IP block. Add SM7635 family and related PMICs to the socinfo driver. Also add support for retrieving the bootloader build details. * tag 'qcom-drivers-for-6.17-2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: dt-bindings: soc: qcom: qcom,pmic-glink: document Milos compatible dt-bindings: soc: qcom,aoss-qmp: document the Milos Always-On Subsystem side channel dt-bindings: firmware: qcom,scm: document Milos SCM Firmware Interface soc: qcom: socinfo: Add support to retrieve APPSBL build details soc: qcom: pmic_glink: fix OF node leak soc: qcom: spmi-pmic: add more PMIC SUBTYPE IDs soc: qcom: socinfo: Add PM7550 & PMIV0108 PMICs soc: qcom: socinfo: Add SoC IDs for SM7635 family dt-bindings: arm: qcom,ids: Add SoC IDs for SM7635 family firmware: qcom: scm: request the waitqueue irq *after* initializing SCM firmware: qcom: scm: initialize tzmem before marking SCM as available firmware: qcom: scm: take struct device as argument in SHM bridge enable firmware: qcom: scm: remove unused arguments from SHM bridge routines soc: qcom: rpmh-rsc: Add RSC version 4 support Link: https://lore.kernel.org/r/20250720030743.285440-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit c2dbaf0af05193fa69f267c37d1f825c1c3a59ab Author: Steven Rostedt Date: Thu Jun 12 10:05:52 2025 -0400 tracing: sched: Hide numa events under CONFIG_NUMA_BALANCING The events sched_move_numa, sched_stick_numa and sched_swap_numa are only called when CONFIG_NUMA_BALANCING is configured. As each event can take up to 5K of memory in text and meta data regardless if they are used or not, they should not be defined when unused. Move the #ifdef CONFIG_NUMA_BALANCING to hide these events as well. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Peter Zijlstra Link: https://lore.kernel.org/20250612100552.39672cf9@batman.local.home Reviewed-by: Shrikanth Hegde Signed-off-by: Steven Rostedt (Google) commit 85b9dd6e90b92f5cb7c47991421ceb4925ba2a87 Author: Emanuele Ghidoli Date: Fri Jul 18 15:34:29 2025 +0200 i2c: lpi2c: implement xfer_atomic callback Rework the read and write code paths in the driver to support operation in atomic contexts. To achieve this, the driver must not rely on IRQs or perform any scheduling, e.g., via a sleep or schedule routine. Implement atomic, sleep-free, and IRQ-less operation. This increases complexity but is necessary for atomic I2C transfers required by some hardware configurations, e.g., to trigger reboots on an external PMIC chip. Signed-off-by: Emanuele Ghidoli Signed-off-by: Francesco Dolcini Reviewed-by: Carlos Song Tested-by: Primoz Fiser Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250718133429.67219-3-francesco@dolcini.it commit 8336f9de21f73bf4e7b4c2d641d82cd2f9b53e39 Author: Emanuele Ghidoli Date: Fri Jul 18 15:34:28 2025 +0200 i2c: lpi2c: use readl_poll_timeout() for register polling Replaces polling loops with the readl_poll_timeout() helper macro. Signed-off-by: Emanuele Ghidoli Signed-off-by: Francesco Dolcini Reviewed-by: Carlos Song Tested-by: Primoz Fiser Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250718133429.67219-2-francesco@dolcini.it commit f8fd855d5b2b4eb16ddaa67443f47e7931ba47d5 Author: Jonas Karlman Date: Wed Jul 23 08:56:44 2025 +0000 dt-bindings: i2c: i2c-rk3x: Allow use of a power-domain The I2C controllers in most Rockchip SoCs are part of power domains that are always powered on, i.e. PD_BUS or PD_PMU. These always powered on power domains have typically not been described in the device tree. Because these power domains have been left out of the device tree there has not been any real need to properly describe the I2C controllers power domain. On RK3528 the I2C controllers are spread out among the described PD_RKVENC, PD_VO and PD_VPU power domains. However, one I2C controller belong to an undescribed always powered on power domain. Add support to describe an optional power-domains for the I2C controllers in Rockchip SoCs. Signed-off-by: Jonas Karlman Reviewed-by: Rob Herring (Arm) Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250723085654.2273324-3-jonas@kwiboo.se commit ae5e80ba0a0955649ac1a45af02242a5fd761d6e Author: Ivaylo Ivanov Date: Tue Jul 22 15:14:34 2025 +0300 dt-bindings: i2c: exynos5: add samsung,exynos2200-hsi2c compatible Add samsung,exynos2200-hsi2c compatible, reusing the autov9 support since it's compatible with exynos2200's i2c controllers. Signed-off-by: Ivaylo Ivanov Reviewed-by: Krzysztof Kozlowski Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250722121434.443648-1-ivo.ivanov.ivanov1@gmail.com commit ce556c29b0a2974f344aadf37708956b43c11141 Author: Yuesong Li Date: Fri Jun 13 19:06:38 2025 +0800 i2c: lpi2c: convert to use secs_to_jiffies() Since secs_to_jiffies() has been introduced in commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()"), we can use it to avoid scaling the time to msec. Signed-off-by: Yuesong Li Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250613110649.3283336-1-liyuesong@vivo.com commit a9320f3e96adf0398187816b39cfa867340fc40c Author: Qianfeng Rong Date: Wed Jul 9 12:23:46 2025 +0800 i2c: st: Use min() to improve code Use min() to reduce the code and improve its readability. The type of the max parameter in the st_i2c_rd_fill_tx_fifo() was changed from int to u32, because the max parameter passed in is always greater than 0. Signed-off-by: Qianfeng Rong Reviewed-by: Patrice Chotard Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250709042347.550993-1-rongqianfeng@vivo.com commit cf51016ba8c343329f1495194fd1354d4c6e5cf1 Merge: 33360f2508e07b 5ac00023852d96 Author: Jakub Kicinski Date: Fri Jul 25 14:07:39 2025 -0700 Merge branch 'net-dsa-b53-mmap-add-bcm63xx-ephy-power-control' Kyle Hendry says: ==================== net: dsa: b53: mmap: Add bcm63xx EPHY power control The gpio controller on some bcm63xx SoCs has a register for controlling functionality of the internal fast ethernet phys. These patches allow the b53 driver to enable/disable phy power. The register also contains reset bits which will be set by a reset driver in another patch series: https://lore.kernel.org/all/20250715234605.36216-1-kylehendrydev@gmail.com/ v1: https://lore.kernel.org/20250716002922.230807-1-kylehendrydev@gmail.com ==================== Link: https://patch.msgid.link/20250724035300.20497-1-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit 5ac00023852d960528a0c1d10ae6c17893fc4113 Author: Kyle Hendry Date: Wed Jul 23 20:52:46 2025 -0700 net: dsa: b53: mmap: Implement bcm63xx ephy power control Implement the phy enable/disable calls for b53 mmap, and set the power down registers in the ephy control register appropriately. Signed-off-by: Kyle Hendry Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250724035300.20497-8-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit e8e13073dff7052b144d002bae2cfe9ddfa27e2a Author: Kyle Hendry Date: Wed Jul 23 20:52:45 2025 -0700 net: dsa: b53: mmap: Add register layout for bcm6368 Add ephy register info for bcm6368. Signed-off-by: Kyle Hendry Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250724035300.20497-7-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit c251304ab021ff21c77e83e0babcb9eb76f8787a Author: Kyle Hendry Date: Wed Jul 23 20:52:44 2025 -0700 net: dsa: b53: mmap: Add register layout for bcm6318 Add ephy register info for bcm6318, which also applies to bcm6328 and bcm6362. Signed-off-by: Kyle Hendry Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250724035300.20497-6-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit aed2aaa3c963f8aabbfa061a177022fee826ebfb Author: Kyle Hendry Date: Wed Jul 23 20:52:43 2025 -0700 net: dsa: b53: mmap: Add syscon reference and register layout for bcm63268 On bcm63xx SoCs there are registers that control the PHYs in the GPIO controller. Allow the b53 driver to access them by passing in the syscon through the device tree. Add a structure to describe the ephy control register and add register info for bcm63268. Signed-off-by: Kyle Hendry Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250724035300.20497-5-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit fcf02a462fab52fbfcb24e617dd940745afd0dff Author: Kyle Hendry Date: Wed Jul 23 20:52:42 2025 -0700 net: dsa: b53: Define chip IDs for more bcm63xx SoCs Add defines for bcm6318, bcm6328, bcm6362, bcm6368 chip IDs, update tables and switch init. Signed-off-by: Kyle Hendry Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250724035300.20497-4-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit cce3563875c7903210398644e7eba89d70d022d7 Author: Kyle Hendry Date: Wed Jul 23 20:52:41 2025 -0700 dt-bindings: net: dsa: b53: Document brcm,gpio-ctrl property Add description for bcm63xx gpio-ctrl phandle which allows access to registers that control phy functionality. Signed-off-by: Kyle Hendry Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250724035300.20497-3-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit be7a79145d85af1a9d65a45560b9243b13a67782 Author: Kyle Hendry Date: Wed Jul 23 20:52:40 2025 -0700 net: dsa: b53: Add phy_enable(), phy_disable() methods Add phy enable/disable to b53 ops to be called when enabling/disabling ports. Signed-off-by: Kyle Hendry Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250724035300.20497-2-kylehendrydev@gmail.com Signed-off-by: Jakub Kicinski commit 33360f2508e07b07bb926ea75f11744dcc1cde07 Author: Breno Leitao Date: Wed Jul 23 10:20:29 2025 -0700 netpoll: Remove unused fields from inet_addr union Clean up the inet_addr union by removing unused fields that are redundant with existing members: This simplifies the union structure while maintaining all necessary functionality for both IPv4 and IPv6 address handling. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250723-netconsole_ref-v3-1-8be9b24e4a99@debian.org Signed-off-by: Jakub Kicinski commit 89f686a0fb6e473a876a9a60a13aec67a62b9a7e Author: John David Anglin Date: Fri Jul 25 13:51:32 2025 -0400 parisc: Revise __get_user() to probe user read access Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel executes at privilege level 0, so __get_user() never triggers a read access interruption (code 26). Thus, it is currently possible for user code to access a read protected address via a system call. Fix this by probing read access rights at privilege level 3 (PRIV_USER) and setting __gu_err to -EFAULT (-14) if access isn't allowed. Note the cmpiclr instruction does a 32-bit compare because COND macro doesn't work inside asm. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.12+ commit f6334f4ae9a4e962ba74b026e1d965dfdf8cbef8 Author: John David Anglin Date: Fri Jul 25 12:12:14 2025 -0400 parisc: Revise gateway LWS calls to probe user read access We use load and stbys,e instructions to trigger memory reference interruptions without writing to memory. Because of the way read access support is implemented, read access interruptions are only triggered at privilege levels 2 and 3. The kernel and gateway page execute at privilege level 0, so this code never triggers a read access interruption. Thus, it is currently possible for user code to execute a LWS compare and swap operation at an address that is read protected at privilege level 3 (PRIV_USER). Fix this by probing read access rights at privilege level 3 and branching to lws_fault if access isn't allowed. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.12+ commit 4eab1c27ce1f0e89ab67b01bf1e4e4c75215708a Author: John David Anglin Date: Mon Jul 21 16:18:41 2025 -0400 parisc: Drop WARN_ON_ONCE() from flush_cache_vmap I have observed warning to occassionally trigger. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.12+ commit f92a5e36b0c45cd12ac0d1bc44680c0dfae34543 Author: John David Anglin Date: Mon Jul 21 16:13:13 2025 -0400 parisc: Try to fixup kernel exception in bad_area_nosemaphore path of do_page_fault() Signed-off-by: John David Anglin Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.12+ commit 802e55488bc2cc1ab6423b720255a785ccac42ce Author: John David Anglin Date: Mon Jul 21 16:06:21 2025 -0400 parisc: Define and use set_pte_at() When a PTE is changed, we need to flush the PTE. set_pte_at() was lost in the folio update. PA-RISC version is the same as the generic version. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.12+ commit 52ce9406a9625c4498c4eaa51e7a7ed9dcb9db16 Author: John David Anglin Date: Mon Jul 21 15:56:04 2025 -0400 parisc: Rename pte_needs_flush() to pte_needs_cache_flush() in cache.c The local name used in cache.c conflicts the declaration in include/asm-generic/tlb.h. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.12+ commit 91428ca9320edbab1211851d82429d33b9cd73ef Author: John David Anglin Date: Mon Jul 21 15:39:26 2025 -0400 parisc: Check region is readable by user in raw_copy_from_user() Because of the way the _PAGE_READ is handled in the parisc PTE, an access interruption is not generated when the kernel reads from a region where the _PAGE_READ is zero. The current code was written assuming read access faults would also occur in the kernel. This change adds user access checks to raw_copy_from_user(). The prober_user() define checks whether user code has read access to a virtual address. Note that page faults are not handled in the exception support for the probe instruction. For this reason, we precede the probe by a ldb access check. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.12+ commit cb22f247f371bd206a88cf0e0c05d80b8b62fb26 Author: John David Anglin Date: Mon Jul 21 15:13:42 2025 -0400 parisc: Update comments in make_insert_tlb The following testcase exposed a problem with our read access checks in get_user() and raw_copy_from_user(): #include #include #include #include #include #include #include #include #include int main(int argc, char **argv) { unsigned long page_size = sysconf(_SC_PAGESIZE); char *p = malloc(3 * page_size); char *p_aligned; /* initialize memory region. If not initialized, write syscall below will correctly return EFAULT. */ if (1) memset(p, 'X', 3 * page_size); p_aligned = (char *) ((((uintptr_t) p) + (2*page_size - 1)) & ~(page_size - 1)); /* Drop PROT_READ protection. Kernel and userspace should fault when accessing that memory region */ mprotect(p_aligned, page_size, PROT_NONE); /* the following write() should return EFAULT, since PROT_READ was dropped by previous mprotect() */ int ret = write(2, p_aligned, 1); if (!ret || errno != EFAULT) printf("\n FAILURE: write() did not returned expected EFAULT value\n"); return 0; } Because of the way _PAGE_READ is handled, kernel code never generates a read access fault when it access a page as the kernel privilege level is always less than PL1 in the PTE. This patch reworks the comments in the make_insert_tlb macro to try to make this clearer. Signed-off-by: John David Anglin Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.12+ commit 305ab0a748c52eeaeb01d8cff6408842d19e5cb5 Author: Randy Dunlap Date: Wed Jun 25 00:30:54 2025 -0700 parisc: Makefile: explain that 64BIT requires both 32-bit and 64-bit compilers For building a 64-bit kernel, both 32-bit and 64-bit VDSO binaries are built, so both 32-bit and 64-bit compilers (and tools) should be in the PATH environment variable. Signed-off-by: Randy Dunlap Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: linux-parisc@vger.kernel.org Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.3+ commit 963f1b20a8d2a098954606b9725cd54336a2a86c Author: Randy Dunlap Date: Wed Jun 25 00:39:33 2025 -0700 parisc: Makefile: fix a typo in palo.conf Correct "objree" to "objtree". "objree" is not defined. Fixes: 75dd47472b92 ("kbuild: remove src and obj from the top Makefile") Signed-off-by: Randy Dunlap Cc: Masahiro Yamada Cc: "James E.J. Bottomley" Cc: Helge Deller Cc: linux-parisc@vger.kernel.org Signed-off-by: Helge Deller Cc: stable@vger.kernel.org # v5.3+ commit 70165c78e31d84b4712cc535b1e0fa1674f1dab3 Author: Tomas Glozar Date: Thu Jun 26 14:34:05 2025 +0200 Documentation/rtla: Add actions feature Document both --on-threshold and --on-end, with examples. Cc: John Kacur Cc: Luis Goncalves Cc: Arnaldo Carvalho de Melo Cc: Chang Yin Cc: Costa Shulyupin Cc: Crystal Wood Cc: Gabriele Monaco Link: https://lore.kernel.org/20250626123405.1496931-10-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit 04f837165b9480d6d6d8b00bbc1298762f3f0e4d Author: Tomas Glozar Date: Thu Jun 26 14:34:04 2025 +0200 rtla/tests: Limit duration to maximum of 10s Many of the original rtla tests included durations of 1 minute and 30 seconds. Experience has shown this is unnecessary, since 10 seconds as waiting time for samples to appear. Change duration of all rtla tests to at most 10 seconds. This speeds up testing significantly. Before: $ make check All tests successful. Files=3, Tests=54, 536 wallclock secs ( 0.03 usr 0.00 sys + 20.31 cusr 22.02 csys = 42.36 CPU) Result: PASS After: $ make check ... All tests successful. Files=3, Tests=54, 196 wallclock secs ( 0.03 usr 0.01 sys + 20.28 cusr 20.68 csys = 41.00 CPU) Result: PASS Cc: John Kacur Cc: Luis Goncalves Cc: Arnaldo Carvalho de Melo Cc: Chang Yin Cc: Costa Shulyupin Cc: Crystal Wood Cc: Gabriele Monaco Link: https://lore.kernel.org/20250626123405.1496931-9-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit 4e26f84abfbbfa88a66f8a3b7e5ea9e494d3caf3 Author: Tomas Glozar Date: Thu Jun 26 14:34:03 2025 +0200 rtla/tests: Add tests for actions Add a bunch of tests covering most of both --on-threshold and --on-end. Parts sensitive to implementation of hist/top are tested for both. Cc: John Kacur Cc: Luis Goncalves Cc: Arnaldo Carvalho de Melo Cc: Chang Yin Cc: Costa Shulyupin Cc: Crystal Wood Cc: Gabriele Monaco Link: https://lore.kernel.org/20250626123405.1496931-8-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit 916a9c5b03a7694a7eae5420fbf2fd763395ff14 Author: Tomas Glozar Date: Thu Jun 26 14:34:02 2025 +0200 rtla/tests: Check rtla output with grep Add argument to the check command in the test suite that takes a regular expression that the output of rtla command is checked against. This allows testing for specific information in rtla output in addition to checking the return value. Two minor improvements are included: running rtla with "eval" so that arguments with spaces can be passed to it via shell quotations, and the stdout of pushd and popd is suppressed to clean up the test output. Cc: John Kacur Cc: Luis Goncalves Cc: Arnaldo Carvalho de Melo Cc: Chang Yin Cc: Costa Shulyupin Cc: Crystal Wood Cc: Gabriele Monaco Link: https://lore.kernel.org/20250626123405.1496931-7-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit 3aadb65db5d656b003232e92d9d18de4e5161416 Author: Tomas Glozar Date: Thu Jun 26 14:34:01 2025 +0200 rtla/timerlat: Add action on end feature Implement actions on end next to actions on threshold. A new option, --on-end is added, parallel to --on-threshold. Instead of being executed whenever a latency threshold is reached, it is executed at the end of the measurement. For example: $ rtla timerlat hist -d 5s --on-end trace will save the trace output at the end. All actions supported by --on-threshold are also supported by --on-end, except for continue, which does nothing with --on-end. Cc: John Kacur Cc: Luis Goncalves Cc: Arnaldo Carvalho de Melo Cc: Chang Yin Cc: Costa Shulyupin Cc: Crystal Wood Cc: Gabriele Monaco Link: https://lore.kernel.org/20250626123405.1496931-6-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit 8d933d5c89e80a818019fa5e0c060387bd145216 Author: Tomas Glozar Date: Thu Jun 26 14:34:00 2025 +0200 rtla/timerlat: Add continue action Introduce option to resume tracing after a latency threshold overflow. The option is implemented as an action named "continue". Example: $ rtla timerlat top -q -T 200 -d 1s --on-threshold \ exec,command="echo Threshold" --on-threshold continue Threshold Threshold Threshold Timer Latency ... The feature is supported for both hist and top. After the continue action is executed, processing of the list of actions is stopped and tracing is resumed. Cc: John Kacur Cc: Luis Goncalves Cc: Arnaldo Carvalho de Melo Cc: Chang Yin Cc: Costa Shulyupin Cc: Crystal Wood Cc: Gabriele Monaco Link: https://lore.kernel.org/20250626123405.1496931-5-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit 3b78670e3a932c654dedf88807e70e19719cb0cb Author: Tomas Glozar Date: Thu Jun 26 14:33:59 2025 +0200 rtla/timerlat_bpf: Allow resuming tracing Currently, rtla-timerlat BPF program uses a global variable stored in a .bss section to store whether tracing has been stopped. Move the information to a separate map, so that it is easily writable from userspace, and add a function that clears the value, resuming tracing after it has been stopped. Cc: John Kacur Cc: Luis Goncalves Cc: Arnaldo Carvalho de Melo Cc: Chang Yin Cc: Costa Shulyupin Cc: Crystal Wood Cc: Gabriele Monaco Link: https://lore.kernel.org/20250626123405.1496931-4-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit 6ea082b171e00bb68b749426f03d9d7e833e9f51 Author: Tomas Glozar Date: Thu Jun 26 14:33:58 2025 +0200 rtla/timerlat: Add action on threshold feature Extend the functionality provided by the -t/--trace option, which triggers saving the contents of a tracefs buffer after tracing is stopped, to support implementing arbitrary actions. A new option, --on-threshold, is added, taking an argument that further specifies the action. Actions added in this patch are: - trace[,file=]: Saves tracefs buffer, optionally taking a filename. - signal,num=,pid=: Sends signal to process. "parent" might be specified instead of number to send signal to parent process. - shell,command=: Execute shell command. Multiple actions may be specified and will be executed in order, including multiple actions of the same type. Trace output requested via -t and -a now adds a trace action to the end of the list. If an action fails, the following actions are not executed. For example, this command: $ rtla timerlat -T 20 --on-threshold trace \ --on-threshold shell,command="grep ipi_send timerlat_trace.txt" \ --on-threshold signal,num=2,pid=parent will send signal 2 (SIGINT) to parent process, but only if saved trace contains the text "ipi_send". This way, the feature can be used for flexible reactions on latency spikes, and allows combining rtla with other tooling like perf. Cc: John Kacur Cc: Luis Goncalves Cc: Arnaldo Carvalho de Melo Cc: Chang Yin Cc: Costa Shulyupin Cc: Crystal Wood Cc: Gabriele Monaco Link: https://lore.kernel.org/20250626123405.1496931-3-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit 8b6cbcac76af2e6e8ac0330a4aab342d08ca7a5d Author: Tomas Glozar Date: Thu Jun 26 14:33:57 2025 +0200 rtla/timerlat: Introduce enum timerlat_tracing_mode After the introduction of BPF-based sample collection, rtla-timerlat effectively runs in one of three modes: - Pure BPF mode, with tracefs only being used to set up the timerlat tracer. Sample processing and stop on threshold are handled by BPF. - tracefs mode. BPF is unsupported or kernel is lacking the necessary trace event (osnoise:timerlat_sample). Stop on theshold is handled by timerlat tracer stopping tracing in all instances. - BPF/tracefs mixed mode - BPF is used for sample collection for top or histogram, tracefs is used for trace output and/or auto-analysis. Stop on threshold is handled both through BPF program, which stops sample collection for top/histogram and wakes up rtla, and by timerlat tracer, which stops tracing for trace output/auto-analysis instances. Add enum timerlat_tracing_mode, with three values: - TRACING_MODE_BPF - TRACING_MODE_TRACEFS - TRACING_MODE_MIXED Those represent the modes described above. A field of this type is added to struct timerlat_params, named "mode", replacing the no_bpf variable. params->mode is set in timerlat_{top,hist}_parse_args to TRACING_MODE_BPF or TRACING_MODE_MIXED based on whether trace output and/or auto-analysis is requested. timerlat_{top,hist}_main then checks if BPF is not unavailable or disabled, in that case, it sets params->mode to TRACING_MODE_TRACEFS. A condition is added to timerlat_apply_config that skips setting timerlat tracer thresholds if params->mode is TRACING_MODE_BPF (those are unnecessary, since they only turn off tracing, which is already turned off in that case, since BPF is used to collect samples). Cc: John Kacur Cc: Luis Goncalves Cc: Arnaldo Carvalho de Melo Cc: Chang Yin Cc: Costa Shulyupin Cc: Crystal Wood Cc: Gabriele Monaco Link: https://lore.kernel.org/20250626123405.1496931-2-tglozar@redhat.com Signed-off-by: Tomas Glozar Signed-off-by: Steven Rostedt (Google) commit 49db61c27c4bbd24364086dc0892bd3e14c1502e Author: Florian Larysch Date: Thu Jul 24 00:20:42 2025 +0200 net: phy: micrel: fix KSZ8081/KSZ8091 cable test Commit 21b688dabecb ("net: phy: micrel: Cable Diag feature for lan8814 phy") introduced cable_test support for the LAN8814 that reuses parts of the KSZ886x logic and introduced the cable_diag_reg and pair_mask parameters to account for differences between those chips. However, it did not update the ksz8081_type struct, so those members are now 0, causing no pairs to be tested in ksz886x_cable_test_get_status and ksz886x_cable_test_wait_for_completion to poll the wrong register for the affected PHYs (Basic Control/Reset, which is 0 in normal operation) and exit immediately. Fix this by setting both struct members accordingly. Fixes: 21b688dabecb ("net: phy: micrel: Cable Diag feature for lan8814 phy") Cc: stable@vger.kernel.org Signed-off-by: Florian Larysch Link: https://patch.msgid.link/20250723222250.13960-1-fl@n621.de Signed-off-by: Jakub Kicinski commit 7ef2310b580d617f18ee6e08071294a58eeaca15 Author: AngeloGioacchino Del Regno Date: Thu Jul 24 10:38:38 2025 +0200 dt-bindings: display: mediatek,dp: Allow DisplayPort AUX bus Like others, the MediaTek DisplayPort controller provides an auxiliary bus: import the common dp-aux-bus.yaml in this binding to allow specifying an aux-bus subnode. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250724083914.61351-3-angelogioacchino.delregno@collabora.com Signed-off-by: Rob Herring (Arm) commit 1bbb76a899486827394530916f01214d049931b3 Author: Kuniyuki Iwashima Date: Wed Jul 23 19:53:59 2025 +0000 neighbour: Fix null-ptr-deref in neigh_flush_dev(). kernel test robot reported null-ptr-deref in neigh_flush_dev(). [0] The cited commit introduced per-netdev neighbour list and converted neigh_flush_dev() to use it instead of the global hash table. One thing we missed is that neigh_table_clear() calls neigh_ifdown() with NULL dev. Let's restore the hash table iteration. Note that IPv6 module is no longer unloadable, so neigh_table_clear() is called only when IPv6 fails to initialise, which is unlikely to happen. [0]: IPv6: Attempt to unregister permanent protocol 136 IPv6: Attempt to unregister permanent protocol 17 Oops: general protection fault, probably for non-canonical address 0xdffffc00000001a0: 0000 [#1] SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000d00-0x0000000000000d07] CPU: 1 UID: 0 PID: 1 Comm: systemd Tainted: G T 6.12.0-rc6-01246-gf7f52738637f #1 Tainted: [T]=RANDSTRUCT Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:neigh_flush_dev.llvm.6395807810224103582+0x52/0x570 Code: c1 e8 03 42 8a 04 38 84 c0 0f 85 15 05 00 00 31 c0 41 83 3e 0a 0f 94 c0 48 8d 1c c3 48 81 c3 f8 0c 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 f7 49 93 fe 4c 8b 3b 4d 85 ff 0f RSP: 0000:ffff88810026f408 EFLAGS: 00010206 RAX: 00000000000001a0 RBX: 0000000000000d00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffffc0631640 RBP: ffff88810026f470 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffffffffc0625250 R14: ffffffffc0631640 R15: dffffc0000000000 FS: 00007f575cb83940(0000) GS:ffff8883aee00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f575db40008 CR3: 00000002bf936000 CR4: 00000000000406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __neigh_ifdown.llvm.6395807810224103582+0x44/0x390 neigh_table_clear+0xb1/0x268 ndisc_cleanup+0x21/0x38 [ipv6] init_module+0x2f5/0x468 [ipv6] do_one_initcall+0x1ba/0x628 do_init_module+0x21a/0x530 load_module+0x2550/0x2ea0 __se_sys_finit_module+0x3d2/0x620 __x64_sys_finit_module+0x76/0x88 x64_sys_call+0x7ff/0xde8 do_syscall_64+0xfb/0x1e8 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7f575d6f2719 Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b7 06 0d 00 f7 d8 64 89 01 48 RSP: 002b:00007fff82a2a268 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 0000557827b45310 RCX: 00007f575d6f2719 RDX: 0000000000000000 RSI: 00007f575d584efd RDI: 0000000000000004 RBP: 00007f575d584efd R08: 0000000000000000 R09: 0000557827b47b00 R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000020000 R13: 0000000000000000 R14: 0000557827b470e0 R15: 00007f575dbb4270 Modules linked in: ipv6(+) Fixes: f7f52738637f4 ("neighbour: Create netdev->neighbour association") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202507200931.7a89ecd8-lkp@intel.com Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250723195443.448163-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 165a7f5db919ab68a45ae755cceb751e067273ef Author: Tristram Ha Date: Tue Jul 22 20:04:03 2025 -0700 net: dsa: microchip: Fix wrong rx drop MIB counter for KSZ8863 When KSZ8863 support was first added to KSZ driver the RX drop MIB counter was somehow defined as 0x105. The TX drop MIB counter starts at 0x100 for port 1, 0x101 for port 2, and 0x102 for port 3, so the RX drop MIB counter should start at 0x103 for port 1, 0x104 for port 2, and 0x105 for port 3. There are 5 ports for KSZ8895, so its RX drop MIB counter starts at 0x105. Fixes: 4b20a07e103f ("net: dsa: microchip: ksz8795: add support for ksz88xx chips") Signed-off-by: Tristram Ha Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250723030403.56878-1-Tristram.Ha@microchip.com Signed-off-by: Jakub Kicinski commit f24987ef6959a7efaf79bffd265522c3df18d431 Author: Gabriel Goller Date: Tue Jul 22 10:18:45 2025 +0200 ipv6: add `force_forwarding` sysctl to enable per-interface forwarding It is currently impossible to enable ipv6 forwarding on a per-interface basis like in ipv4. To enable forwarding on an ipv6 interface we need to enable it on all interfaces and disable it on the other interfaces using a netfilter rule. This is especially cumbersome if you have lots of interfaces and only want to enable forwarding on a few. According to the sysctl docs [0] the `net.ipv6.conf.all.forwarding` enables forwarding for all interfaces, while the interface-specific `net.ipv6.conf..forwarding` configures the interface Host/Router configuration. Introduce a new sysctl flag `force_forwarding`, which can be set on every interface. The ip6_forwarding function will then check if the global forwarding flag OR the force_forwarding flag is active and forward the packet. To preserve backwards-compatibility reset the flag (on all interfaces) to 0 if the net.ipv6.conf.all.forwarding flag is set to 0. Add a short selftest that checks if a packet gets forwarded with and without `force_forwarding`. [0]: https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt Acked-by: Nicolas Dichtel Signed-off-by: Gabriel Goller Link: https://patch.msgid.link/20250722081847.132632-1-g.goller@proxmox.com Signed-off-by: Jakub Kicinski commit 1693d187725d75a9b28a5e4531ca8582b4eb0473 Author: Frank Li Date: Thu Jul 24 15:03:41 2025 -0400 dt-bindings: fsl: convert fsl,vf610-mscm-ir.txt to yaml format Convert fsl,vf610-mscm-ir.txt to yaml format. Additional changes: - remove label at example dts. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250724190342.1321632-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit fa8c0b1c7931b76171571a8e25578844caa1c10d Author: Frank Li Date: Thu Jul 24 12:46:23 2025 -0400 dt-bindings: interrupt-controller: Add fsl,icoll.yaml Add fsl,icoll.yaml for i.MX23 and i.MX28. Also add a generic fallback compatible string "fsl,icoll" for legacy devices, which have existed for over 15 years. Reviewed-by: Conor Dooley Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250724164624.1271661-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit 7ce3c2713b45e349468fd5f9166f376ad9a361e3 Author: Michal Simek Date: Thu Jul 24 12:57:57 2025 +0200 dt-bindings: interrupt-controller: Add missing Xilinx INTC binding Add missing description for AMD/Xilinx interrupt controller. The binding is used by Microblaze before dt-binding even existed but never been documented properly. IP acts as primary interrupt controller on Microblaze systems or can be used as secondary interrupt controller on ARM based systems like Zynq, ZynqMP, Versal or Versal Gen 2. Also as secondary interrupt controller on Microblaze-V (Risc-V) systems. Over the years IP exists in multiple variants based on attached bus as OPB, PLB or AXI that's why generic filename is used. Property xlnx,kind-of-intr is in hex because every bit position corresponds to interrupt line. Controller support mixing edge or level interrupts together and this is the property which distinguish them. Signed-off-by: Michal Simek Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/2b9d4a3a693f501d420da88b8418732ba9def877.1753354675.git.michal.simek@amd.com Signed-off-by: Rob Herring (Arm) commit 9312ee76490df61491fee19b5ce71f71b6de908c Author: Simon Horman Date: Thu Jul 24 14:10:54 2025 +0100 octeontx2-af: use unsigned int as iterator for unsigned values The local variable i is used to iterate over unsigned values. The lower bound of the loop is set to 0. While the upper bound is cgx->lmac_count, where they lmac_count is an u8. So the theoretical upper bound is 255. As is, GCC can't see this range of values and warns that a formatted string, which includes the %d representation of i, may overflow the buffer provided. GCC 15.1.0 says: .../cgx.c: In function 'cgx_lmac_init': .../cgx.c:1737:49: warning: '%d' directive writing between 1 and 11 bytes into a region of size between 4 and 6 [-Wformat-overflow=] 1737 | sprintf(lmac->name, "cgx_fwi_%d_%d", cgx->cgx_id, i); | ^~ .../cgx.c:1737:37: note: directive argument in the range [-2147483641, 254] 1737 | sprintf(lmac->name, "cgx_fwi_%d_%d", cgx->cgx_id, i); | ^~~~~~~~~~~~~~~ .../cgx.c:1737:17: note: 'sprintf' output between 12 and 24 bytes into a destination of size 16 1737 | sprintf(lmac->name, "cgx_fwi_%d_%d", cgx->cgx_id, i); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Empirically, changing the type of i from (signed) int to unsigned int addresses this problem. I assume by allowing GCC to see the range of values described above. Also update the format specifiers for the integer values in the string in question from %d to %u. This seems appropriate as they are now both unsigned. No functional change intended. Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250724-octeontx2-af-unsigned-v1-1-c745c106e06f@kernel.org Signed-off-by: Jakub Kicinski commit fada26496ede1d190f2843f4faa2d5f76e645ce6 Merge: 5ec9b15d8dfa49 829fec0244b4ca Author: Jakub Kicinski Date: Fri Jul 25 11:29:07 2025 -0700 Merge branch 'mptcp-track-more-fallback-cases' Matthieu Baerts says: ==================== mptcp: track more fallback cases This series has two patches linked to fallback to TCP: - Patch 1: additional MIB counters for remaining error code paths around fallback - Patch 2: remove dedicated pr_debug() linked to fallback now that everything should be covered by dedicated MIB counters. ==================== Link: https://patch.msgid.link/20250723-net-next-mptcp-track-fallbacks-v1-0-a83cce08f2d5@kernel.org Signed-off-by: Jakub Kicinski commit 829fec0244b4ca593ecfaf914e7245ce5b304ec3 Author: Paolo Abeni Date: Wed Jul 23 16:32:24 2025 +0200 mptcp: remove pr_fallback() We can now track fully the fallback status of a given connection via the relevant mibs, the mentioned helper is redundant. Remove it completely. Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250723-net-next-mptcp-track-fallbacks-v1-2-a83cce08f2d5@kernel.org Signed-off-by: Jakub Kicinski commit c65c2e3bae6912b6baf8ea12eeace220e8e99b47 Author: Paolo Abeni Date: Wed Jul 23 16:32:23 2025 +0200 mptcp: track fallbacks accurately via mibs Add the mibs required to cover the few possible fallback causes still lacking suck info. Move the relevant mib increment into the fallback helper, so that no eventual future fallback operation will miss a paired mib increment. Additionally track failed fallback via its own mib, such mib is incremented only when a fallback mandated by the protocol fails - due to racing subflow creation. While at the above, rename an existing helper to reduce long lines problems all along. Signed-off-by: Paolo Abeni Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250723-net-next-mptcp-track-fallbacks-v1-1-a83cce08f2d5@kernel.org Signed-off-by: Jakub Kicinski commit 5ec9b15d8dfa4992c6f9c26c1f96e69202d8fcb1 Author: Breno Leitao Date: Wed Jul 23 10:35:06 2025 -0700 selftests: net: Skip test if IPv6 is not configured Extend the `check_for_dependencies()` function in `lib_netcons.sh` to check whether IPv6 is enabled by verifying the existence of `/proc/net/if_inet6`. Having IPv6 is a now a dependency of netconsole tests. If the file does not exist, the script will skip the test with an appropriate message suggesting to verify if `CONFIG_IPV6` is enabled. This prevents the test to misbehave if IPv6 is not configured. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250723-netcons_test_ipv6-v1-1-41c9092f93f9@debian.org Signed-off-by: Jakub Kicinski commit a75afcd188e1a7385c71f78d4e5e8d7b6bd9c2e4 Author: Yi Cong Date: Thu Jul 24 09:31:33 2025 +0800 usbnet: Set duplex status to unknown in the absence of MII Currently, USB CDC devices that do not use MDIO to get link status have their duplex mode set to half-duplex by default. However, since the CDC specification does not define a duplex status, this can be misleading. This patch changes the default to DUPLEX_UNKNOWN in the absence of MII, which more accurately reflects the state of the link and avoids implying an incorrect or error state. Link: https://lore.kernel.org/all/20250723152151.70a8034b@kernel.org/ Signed-off-by: Yi Cong Acked-by: Oliver Neukum Link: https://patch.msgid.link/20250724013133.1645142-1-yicongsrfy@163.com Signed-off-by: Jakub Kicinski commit f6c650c8d87e778a36f69acfc591f99b04bfe82b Author: Stanislav Fomichev Date: Wed Jul 23 15:47:15 2025 -0700 selftests: rtnetlink: add macsec and vlan nesting test Add reproducer for [0] with a dummy device. 0: https://lore.kernel.org/netdev/2aff4342b0f5b1539c02ffd8df4c7e58dd9746e7.camel@nvidia.com/ Reviewed-by: Simon Horman Tested-by: Simon Horman Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250723224715.1341121-2-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 0349659fd72f662c054ff20d432559bfaa228ce4 Author: Stanislav Fomichev Date: Wed Jul 23 15:47:14 2025 -0700 macsec: set IFF_UNICAST_FLT priv flag Cosmin reports the following locking issue: # BUG: sleeping function called from invalid context at kernel/locking/mutex.c:275 # dump_stack_lvl+0x4f/0x60 # __might_resched+0xeb/0x140 # mutex_lock+0x1a/0x40 # dev_set_promiscuity+0x26/0x90 # __dev_set_promiscuity+0x85/0x170 # __dev_set_rx_mode+0x69/0xa0 # dev_uc_add+0x6d/0x80 # vlan_dev_open+0x5f/0x120 [8021q] # __dev_open+0x10c/0x2a0 # __dev_change_flags+0x1a4/0x210 # netif_change_flags+0x22/0x60 # do_setlink.isra.0+0xdb0/0x10f0 # rtnl_newlink+0x797/0xb00 # rtnetlink_rcv_msg+0x1cb/0x3f0 # netlink_rcv_skb+0x53/0x100 # netlink_unicast+0x273/0x3b0 # netlink_sendmsg+0x1f2/0x430 Which is similar to recent syzkaller reports in [0] and [1] and triggers because macsec does not advertise IFF_UNICAST_FLT although it has proper ndo_set_rx_mode callback that takes care of pushing uc/mc addresses down to the real device. In general, dev_uc_add call path is problematic for stacking non-IFF_UNICAST_FLT because we might grab netdev instance lock under addr_list_lock spinlock, so this is not a systemic fix. 0: https://lore.kernel.org/netdev/686d55b4.050a0220.1ffab7.0014.GAE@google.com 1: https://lore.kernel.org/netdev/68712acf.a00a0220.26a83e.0051.GAE@google.com/ Reviewed-by: Simon Horman Tested-by: Simon Horman Link: https://lore.kernel.org/netdev/2aff4342b0f5b1539c02ffd8df4c7e58dd9746e7.camel@nvidia.com Fixes: 7e4d784f5810 ("net: hold netdev instance lock during rtnetlink operations") Reported-by: Cosmin Ratiu Tested-by: Cosmin Ratiu Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250723224715.1341121-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 0d9cfc9b8cb17dbc29a98792d36ec39a1cf1395f Author: John Ernberg Date: Wed Jul 23 10:25:35 2025 +0000 net: usbnet: Avoid potential RCU stall on LINK_CHANGE event The Gemalto Cinterion PLS83-W modem (cdc_ether) is emitting confusing link up and down events when the WWAN interface is activated on the modem-side. Interrupt URBs will in consecutive polls grab: * Link Connected * Link Disconnected * Link Connected Where the last Connected is then a stable link state. When the system is under load this may cause the unlink_urbs() work in __handle_link_change() to not complete before the next usbnet_link_change() call turns the carrier on again, allowing rx_submit() to queue new SKBs. In that event the URB queue is filled faster than it can drain, ending up in a RCU stall: rcu: INFO: rcu_sched detected expedited stalls on CPUs/tasks: { 0-.... } 33108 jiffies s: 201 root: 0x1/. rcu: blocking rcu_node structures (internal RCU debug): Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 Call trace: arch_local_irq_enable+0x4/0x8 local_bh_enable+0x18/0x20 __netdev_alloc_skb+0x18c/0x1cc rx_submit+0x68/0x1f8 [usbnet] rx_alloc_submit+0x4c/0x74 [usbnet] usbnet_bh+0x1d8/0x218 [usbnet] usbnet_bh_tasklet+0x10/0x18 [usbnet] tasklet_action_common+0xa8/0x110 tasklet_action+0x2c/0x34 handle_softirqs+0x2cc/0x3a0 __do_softirq+0x10/0x18 ____do_softirq+0xc/0x14 call_on_irq_stack+0x24/0x34 do_softirq_own_stack+0x18/0x20 __irq_exit_rcu+0xa8/0xb8 irq_exit_rcu+0xc/0x30 el1_interrupt+0x34/0x48 el1h_64_irq_handler+0x14/0x1c el1h_64_irq+0x68/0x6c _raw_spin_unlock_irqrestore+0x38/0x48 xhci_urb_dequeue+0x1ac/0x45c [xhci_hcd] unlink1+0xd4/0xdc [usbcore] usb_hcd_unlink_urb+0x70/0xb0 [usbcore] usb_unlink_urb+0x24/0x44 [usbcore] unlink_urbs.constprop.0.isra.0+0x64/0xa8 [usbnet] __handle_link_change+0x34/0x70 [usbnet] usbnet_deferred_kevent+0x1c0/0x320 [usbnet] process_scheduled_works+0x2d0/0x48c worker_thread+0x150/0x1dc kthread+0xd8/0xe8 ret_from_fork+0x10/0x20 Get around the problem by delaying the carrier on to the scheduled work. This needs a new flag to keep track of the necessary action. The carrier ok check cannot be removed as it remains required for the LINK_RESET event flow. Fixes: 4b49f58fff00 ("usbnet: handle link change") Cc: stable@vger.kernel.org Signed-off-by: John Ernberg Link: https://patch.msgid.link/20250723102526.1305339-1-john.ernberg@actia.se Signed-off-by: Jakub Kicinski commit 15dc08fd2cac0210e2488367bc1d529149149f3b Author: Jijie Shao Date: Wed Jul 23 15:48:26 2025 +0800 net: hibmcge: support for statistics of reset failures Add a statistical item to count the number of reset failures. This statistical item can be queried using ethtool -S or reported through diagnose information. Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20250723074826.2756135-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 4fc7885c3a98ec4450103aef874fb1d35920c7af Merge: c8f13134349b43 e80d65561571db Author: Jakub Kicinski Date: Fri Jul 25 11:00:20 2025 -0700 Merge branch 'mlx5e-misc-fixes-2025-07-23' Tariq Toukan says: ==================== mlx5e misc fixes 2025-07-23 This small patchset provides misc bug fixes from the team to the mlx5e driver. ==================== Link: https://patch.msgid.link/1753256672-337784-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit e80d65561571db5024fbdd5ec3f5472cfc485d21 Author: Shahar Shitrit Date: Wed Jul 23 10:44:32 2025 +0300 net/mlx5e: Fix potential deadlock by deferring RX timeout recovery mlx5e_reporter_rx_timeout() is currently invoked synchronously in the driver's open error flow. This causes the thread holding priv->state_lock to attempt acquiring the devlink lock, which can result in a circular dependency with other devlink operations. For example: - Devlink health diagnose flow: - __devlink_nl_pre_doit() acquires the devlink lock. - devlink_nl_health_reporter_diagnose_doit() invokes the driver's diagnose callback. - mlx5e_rx_reporter_diagnose() then attempts to acquire priv->state_lock. - Driver open flow: - mlx5e_open() acquires priv->state_lock. - If an error occurs, devlink_health_reporter may be called, attempting to acquire the devlink lock. To prevent this circular locking scenario, defer the RX timeout recovery by scheduling it via a workqueue. This ensures that the recovery work acquires locks in a consistent order: first the devlink lock, then priv->state_lock. Additionally, make the recovery work acquire the netdev instance lock to safely synchronize with the open/close channel flows, similar to mlx5e_tx_timeout_work. Repeatedly attempt to acquire the netdev instance lock until it is taken or the target RQ is no longer active, as indicated by the MLX5E_STATE_CHANNELS_ACTIVE bit. Fixes: 32c57fb26863 ("net/mlx5e: Report and recover from rx timeout") Signed-off-by: Shahar Shitrit Reviewed-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1753256672-337784-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 6d19c44b5c6dd72f9a357d0399604ec16a77de3c Author: Jianbo Liu Date: Wed Jul 23 10:44:31 2025 +0300 net/mlx5e: Remove skb secpath if xfrm state is not found Hardware returns a unique identifier for a decrypted packet's xfrm state, this state is looked up in an xarray. However, the state might have been freed by the time of this lookup. Currently, if the state is not found, only a counter is incremented. The secpath (sp) extension on the skb is not removed, resulting in sp->len becoming 0. Subsequently, functions like __xfrm_policy_check() attempt to access fields such as xfrm_input_state(skb)->xso.type (which dereferences sp->xvec[sp->len - 1]) without first validating sp->len. This leads to a crash when dereferencing an invalid state pointer. This patch prevents the crash by explicitly removing the secpath extension from the skb if the xfrm state is not found after hardware decryption. This ensures downstream functions do not operate on a zero-length secpath. BUG: unable to handle page fault for address: ffffffff000002c8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 282e067 P4D 282e067 PUD 0 Oops: Oops: 0000 [#1] SMP CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:__xfrm_policy_check+0x61a/0xa30 Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 <0f> b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa RSP: 0018:ffff88885fb04918 EFLAGS: 00010297 RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353 R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8 R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00 FS: 0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? try_to_wake_up+0x108/0x4c0 ? udp4_lib_lookup2+0xbe/0x150 ? udp_lib_lport_inuse+0x100/0x100 ? __udp4_lib_lookup+0x2b0/0x410 __xfrm_policy_check2.constprop.0+0x11e/0x130 udp_queue_rcv_one_skb+0x1d/0x530 udp_unicast_rcv_skb+0x76/0x90 __udp4_lib_rcv+0xa64/0xe90 ip_protocol_deliver_rcu+0x20/0x130 ip_local_deliver_finish+0x75/0xa0 ip_local_deliver+0xc1/0xd0 ? ip_protocol_deliver_rcu+0x130/0x130 ip_sublist_rcv+0x1f9/0x240 ? ip_rcv_finish_core+0x430/0x430 ip_list_rcv+0xfc/0x130 __netif_receive_skb_list_core+0x181/0x1e0 netif_receive_skb_list_internal+0x200/0x360 ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core] gro_receive_skb+0xfd/0x210 mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core] mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core] ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core] mlx5e_napi_poll+0x114/0xab0 [mlx5_core] __napi_poll+0x25/0x170 net_rx_action+0x32d/0x3a0 ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core] ? notifier_call_chain+0x33/0xa0 handle_softirqs+0xda/0x250 irq_exit_rcu+0x6d/0xc0 common_interrupt+0x81/0xa0 Fixes: b2ac7541e377 ("net/mlx5e: IPsec: Add Connect-X IPsec Rx data path offload") Signed-off-by: Jianbo Liu Reviewed-by: Dragos Tatulea Reviewed-by: Yael Chemla Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1753256672-337784-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit fd4b97246a23c1149479b88490946bcfbd28de63 Author: Alexei Lazar Date: Wed Jul 23 10:44:30 2025 +0300 net/mlx5e: Clear Read-Only port buffer size in PBMC before update When updating the PBMC register, we read its current value, modify desired fields, then write it back. The port_buffer_size field within PBMC is Read-Only (RO). If this RO field contains a non-zero value when read, attempting to write it back will cause the entire PBMC register update to fail. This commit ensures port_buffer_size is explicitly cleared to zero after reading the PBMC register but before writing back the modified value. This allows updates to other fields in the PBMC register to succeed. Fixes: 0696d60853d5 ("net/mlx5e: Receive buffer configuration") Signed-off-by: Alexei Lazar Reviewed-by: Yael Chemla Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1753256672-337784-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 2d442a0c781403702de27ccfbc4bb233721585f5 Author: Colin Ian King Date: Fri Jul 25 18:17:01 2025 +0100 spi: SPISG: Fix less than zero comparison on a u32 variable The check for ns < 0 is always false because variable ns is a u32 which is not a signed type. Fix this by making ns a s32 type. Fixes: cef9991e04ae ("spi: Add Amlogic SPISG driver") Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250725171701.839927-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit 6e19839a80b8713b836722ba9d99a3ab12cfb651 Author: Ian Rogers Date: Thu Jul 24 09:33:02 2025 -0700 perf sort: Use perf_env to set arch sort keys and header Previously arch_support_sort_key and arch_perf_header_entry used a weak symbol to compile as appropriate for x86 and powerpc. A limitation to this is that the handling of a data file could vary in cross-platform development. Change to using the perf_env of the current session to determine the architecture kind and set the sort key and header entries as appropriate. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-23-irogers@google.com Signed-off-by: Namhyung Kim commit a563c9f3bb8c23416f3e72edfbc75d1a4937f7e0 Author: Ian Rogers Date: Thu Jul 24 09:33:01 2025 -0700 perf test: Move PERF_SAMPLE_WEIGHT_STRUCT parsing to common test test__x86_sample_parsing is identical to test__sample_parsing except it explicitly tested PERF_SAMPLE_WEIGHT_STRUCT. Now the parsing code is common move the PERF_SAMPLE_WEIGHT_STRUCT to the common sample parsing test and remove the x86 version. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-22-irogers@google.com Signed-off-by: Namhyung Kim commit 8882095b1d4d785524a7a4df8e04e35cfd039142 Author: Ian Rogers Date: Thu Jul 24 09:33:00 2025 -0700 perf sample: Remove arch notion of sample parsing By definition arch sample parsing and synthesis will inhibit certain kinds of cross-platform record then analysis (report, script, etc.). Remove arch_perf_parse_sample_weight and arch_perf_synthesize_sample_weight replacing with a common implementation. Combine perf_sample p_stage_cyc and retire_lat as weight3 to capture the differing uses regardless of compiled for architecture. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-21-irogers@google.com Signed-off-by: Namhyung Kim commit 525a599badeeafba88a4fa0f913e5cf87e2d51ec Author: Ian Rogers Date: Thu Jul 24 09:32:59 2025 -0700 perf env: Remove global perf_env The global perf_env was used for the host, but if a perf_env wasn't easy to come by it was used in a lot of places where potentially recorded and host data could be confused. Remove the global variable as now the majority of accesses retrieve the perf_env for the host from the session. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-20-irogers@google.com Signed-off-by: Namhyung Kim commit 003a86bce0728ad160bcb7c7566a4d40aee3c235 Author: Ian Rogers Date: Thu Jul 24 09:32:58 2025 -0700 perf trace: Avoid global perf_env with evsel__env There is no session in perf trace unless in replay mode, so in host mode no session can be associated with the evlist. If the evsel__env call fails resort to the host_env that's part of the trace. Remove errno_to_name as it becomes a called once 1-line function once the argument is turned into a perf_env, just call perf_env__arch_strerrno directly. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-19-irogers@google.com Signed-off-by: Namhyung Kim commit 69ac7472d28a21057275a396193f1bdcce6ba962 Author: Ian Rogers Date: Thu Jul 24 09:32:57 2025 -0700 perf auxtrace: Pass perf_env from session through to mmap read auxtrace_mmap__read and auxtrace_mmap__read_snapshot end up calling `evsel__env(NULL)` which returns the global perf_env variable for the host. Their only call is in perf record. Rather than use the global variable pass through the perf_env for `perf record`. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-18-irogers@google.com Signed-off-by: Namhyung Kim commit e481066388fe8003916461a54bf0ecffc02505a8 Author: Ian Rogers Date: Thu Jul 24 09:32:56 2025 -0700 perf machine: Explicitly pass in host perf_env When creating a machine for the host explicitly pass in a scoped perf_env. This removes a use of the global perf_env. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-17-irogers@google.com Signed-off-by: Namhyung Kim commit aa91baa09b2a3c38deff05b83410ce86833258d5 Author: Ian Rogers Date: Thu Jul 24 09:32:55 2025 -0700 perf bench synthesize: Avoid use of global perf_env The benchmark doesn't use a data file and so the header perf_env isn't used. Stack allocate a host perf_env for use to avoid the use of the global perf_env. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-16-irogers@google.com Signed-off-by: Namhyung Kim commit aaa23571fe4bb7fb7549ad09dd56de5ca1bd289d Author: Ian Rogers Date: Thu Jul 24 09:32:54 2025 -0700 perf top: Make perf_env locally scoped The use of the global host perf_env variable is potentially inconsistent within the code. Switch perf top to using a locally scoped variable that is generally accessed through the session. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-15-irogers@google.com Signed-off-by: Namhyung Kim commit 740f7ba1e3be5d6f192dafc5efd0bd0a8e8567e2 Author: Ian Rogers Date: Thu Jul 24 09:32:53 2025 -0700 perf session: Add host_env argument to perf_session__new When creating a perf_session the host perf_env may or may not want to be used. For example, `perf top` uses a host perf_env while `perf inject` does not. Add a host_env argument to perf_session__new so that sessions requiring a host perf_env can pass it in. Currently if none is specified the global perf_env variable is used, but this will change in later patches. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-14-irogers@google.com Signed-off-by: Namhyung Kim commit 5a156353e55e994627ac584e90b3b802e51e1ee2 Author: Ian Rogers Date: Thu Jul 24 09:32:52 2025 -0700 perf test: Avoid use perf_env The perf_env global variable holds the host perf_env data but its use is hit and miss. Switch to using local perf_env variables and ensure scoped perf_env__init and perf_env__exit. This loses command line setting of the perf_env, but this doesn't matter for tests. So the perf_env is fully initialized, clear it with memset in perf_env__init. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-13-irogers@google.com Signed-off-by: Namhyung Kim commit b743a1368dea43b4ef6e51c2931eeada07556d87 Author: Ian Rogers Date: Thu Jul 24 09:32:51 2025 -0700 perf header: Clean up use of perf_env Always use the perf_env from the feat_fd's perf_header. Cache the value on entry to a function in `env` and use `env->` consistently in the code. Ensure the header is initialized for use in perf_session__do_write_header. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-12-irogers@google.com Signed-off-by: Namhyung Kim commit 57ddb9cbb54fbf3772063795051b88a1f7258c6c Author: Ian Rogers Date: Thu Jul 24 09:32:50 2025 -0700 perf evlist: Change env variable to session The session holds a perf_env pointer env. In UI code container_of is used to turn the env to a session, but this assumes the session header's env is in use. Rather than a dubious container_of, hold the session in the evlist and derive the env from the session with evsel__env, perf_session__env, etc. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-11-irogers@google.com Signed-off-by: Namhyung Kim commit c3e5b9ec96dee864c2d6b00fbfe52e784f0d7bee Author: Ian Rogers Date: Thu Jul 24 09:32:49 2025 -0700 perf session: Add accessor for session->header.env The perf_env from the header in the session is frequently accessed, add an accessor function rather than access directly. Cache the value to avoid repeated calls. No behavioral change. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-10-irogers@google.com Signed-off-by: Namhyung Kim commit 53b00ff358dc75b12042b2b2aaf1d0e998fd0075 Author: Ian Rogers Date: Thu Jul 24 09:32:48 2025 -0700 perf record: Make --buildid-mmap the default Support for build IDs in mmap2 perf events has been present since Linux v5.12: https://lore.kernel.org/lkml/20210219194619.1780437-1-acme@kernel.org/ Build ID mmap events don't avoid the need to inject build IDs for DSO touched by samples as the build ID cache is populated by perf record. They can avoid some cases of symbol mis-resolution caused by the file system changing from when a sample occurred and when the DSO is sought. Unlike the --buildid-mmap option, this chnage doesn't disable the build ID cache but it does disable the processing of samples looking for DSOs to inject build IDs for. To disable the build ID cache the -B (--no-buildid) option should be used. Making this option the default was raised on the list in: https://lore.kernel.org/linux-perf-users/CAP-5=fXP7jN_QrGUcd55_QH5J-Y-FCaJ6=NaHVtyx0oyNh8_-Q@mail.gmail.com/ Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-9-irogers@google.com Signed-off-by: Namhyung Kim commit 5b11409b924631745eef60a65218ffa496acafd6 Author: Ian Rogers Date: Thu Jul 24 09:32:47 2025 -0700 perf jitdump: Directly mark the jitdump DSO The DSO being generated was being accessed through a thread's maps, this is unnecessary as the dso can just be directly found. This avoids problems with passing a NULL evsel which may be inspected to determine properties of a callchain when using the buildid DSO marking code. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-8-irogers@google.com Signed-off-by: Namhyung Kim commit d9f2ecbc5e47fca7bda7c13cff3b3534b1467b32 Author: Ian Rogers Date: Thu Jul 24 09:32:46 2025 -0700 perf dso: Move build_id to dso_id The dso_id previously contained the major, minor, inode and inode generation information from a mmap2 event - the inode generation would be zero when reading from /proc/pid/maps. The build_id was in the dso. With build ID mmap2 events these fields wouldn't be initialized which would largely mean the special empty case where any dso would match for equality. This isn't desirable as if a dso is replaced we want the comparison to yield a difference. To support detecting the difference between DSOs based on build_id, move the build_id out of the DSO and into the dso_id. The dso_id is also stored in the DSO so nothing is lost. Capture in the dso_id what parts have been initialized and rename dso_id__inject to dso_id__improve_id so that it is clear the dso_id is being improved upon with additional information. With the build_id in the dso_id, use memcmp to compare for equality. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-7-irogers@google.com Signed-off-by: Namhyung Kim commit eee4b66105a6fa3b85fe5260d3791d607570ba95 Author: Ian Rogers Date: Thu Jul 24 09:32:45 2025 -0700 perf build-id: Ensure struct build_id is empty before use If a build ID is read then not all code paths may ensure it is empty before use. Initialize the build_id to be zero-ed unless there is clear initialization such as a call to build_id__init. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-6-irogers@google.com Signed-off-by: Namhyung Kim commit 29be60c93d2d9300571230edaa484930cdbec437 Author: Ian Rogers Date: Thu Jul 24 09:32:44 2025 -0700 perf build-id: Mark DSO in sample callchains Previously only the sample IP's map DSO would be marked hit for the purposes of populating the build ID cache. Walk the call chain to mark all IPs and DSOs. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-5-irogers@google.com Signed-off-by: Namhyung Kim commit fccaaf6fbbc59910edcf276f97a5b2ef5778c55e Author: Ian Rogers Date: Thu Jul 24 09:32:43 2025 -0700 perf build-id: Change sprintf functions to snprintf Pass in a size argument rather than implying all build id strings must be SBUILD_ID_SIZE. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-4-irogers@google.com [ fixed some build errors ] Signed-off-by: Namhyung Kim commit fe09560f82415d6592e74821e031a76eed173a03 Author: Bjorn Helgaas Date: Wed Jul 23 15:15:05 2025 -0500 net: Fix typos Fix typos in comments and error messages. Signed-off-by: Bjorn Helgaas Reviewed-by: David Arinzon Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250723201528.2908218-1-helgaas@kernel.org Signed-off-by: Jakub Kicinski commit f11a5f89910a7ae970fbce4fdc02d86a8ba8570f Author: Alison Schofield Date: Thu Jul 24 15:43:06 2025 -0700 Documentation/ABI/testing/debugfs-cxl: Add 'cxl' to clear_poison path 'cxl' is missing from the path to the clear_poison attribute. Add it. Signed-off-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250724224308.2101255-1-alison.schofield@intel.com Signed-off-by: Dave Jiang commit 8b4a1a46e84a17f5d6fde5c506cc6bb141a24772 Author: Yi Chen Date: Thu Jul 24 16:06:53 2025 +0800 selftests: netfilter: ipvs.sh: Explicity disable rp_filter on interface tunl0 Although setup_ns() set net.ipv4.conf.default.rp_filter=0, loading certain module such as ipip will automatically create a tunl0 interface in all netns including new created ones. In the script, this is before than default.rp_filter=0 applied, as a result tunl0.rp_filter remains set to 1 which causes the test report FAIL when ipip module is preloaded. Before fix: Testing DR mode... Testing NAT mode... Testing Tunnel mode... ipvs.sh: FAIL After fix: Testing DR mode... Testing NAT mode... Testing Tunnel mode... ipvs.sh: PASS Fixes: 7c8b89ec506e ("selftests: netfilter: remove rp_filter configuration") Signed-off-by: Yi Chen Signed-off-by: Pablo Neira Ayuso commit 8d1c91850d064944ab214b2fbfffb7fc08a11d65 Author: Phil Sutter Date: Wed Jul 23 17:17:48 2025 +0200 selftests: netfilter: Ignore tainted kernels in interface stress test Complain about kernel taint value only if it wasn't set at start already. Fixes: 73db1b5dab6f ("selftests: netfilter: Torture nftables netdev hooks") Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit bf58e667af7d96c8eb9411f926a0a0955f41ce21 Author: Florian Westphal Date: Fri Jul 18 13:27:13 2025 +0200 netfilter: xt_nfacct: don't assume acct name is null-terminated BUG: KASAN: slab-out-of-bounds in .. lib/vsprintf.c:721 Read of size 1 at addr ffff88801eac95c8 by task syz-executor183/5851 [..] string+0x231/0x2b0 lib/vsprintf.c:721 vsnprintf+0x739/0xf00 lib/vsprintf.c:2874 [..] nfacct_mt_checkentry+0xd2/0xe0 net/netfilter/xt_nfacct.c:41 xt_check_match+0x3d1/0xab0 net/netfilter/x_tables.c:523 nfnl_acct_find_get() handles non-null input, but the error printk relied on its presence. Reported-by: syzbot+4ff165b9251e4d295690@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=4ff165b9251e4d295690 Tested-by: syzbot+4ff165b9251e4d295690@syzkaller.appspotmail.com Fixes: ceb98d03eac5 ("netfilter: xtables: add nfacct match to support extended accounting") Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 897eefee2eb73ec6c119a0ca357d7b4a3e92c5ef Author: Florian Westphal Date: Wed Jul 9 19:05:16 2025 +0200 netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps The scratchmap size depends on the number of elements in the set. For huge sets, each scratch map can easily require very large allocations, e.g. for 100k entries each scratch map will require close to 64kbyte of memory. Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit d8d871a35ca9ee4881d34995444ed1cb826d01db Author: Florian Westphal Date: Wed Jul 9 19:05:15 2025 +0200 netfilter: nft_set_pipapo: merge pipapo_get/lookup The matching algorithm has implemented thrice: 1. data path lookup, generic version 2. data path lookup, avx2 version 3. control plane lookup Merge 1 and 3 by refactoring pipapo_get as a common helper, then make nft_pipapo_lookup and nft_pipapo_get both call the common helper. Aside from the code savings this has the benefit that we no longer allocate temporary scratch maps for each control plane get and insertion operation. Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 531e61312104d991459af73c838396db26aa3550 Author: Florian Westphal Date: Wed Jul 9 19:05:14 2025 +0200 netfilter: nft_set: remove indirection from update API call This stems from a time when sets and nft_dynset resided in different kernel modules. We can replace this with a direct call. We could even remove both ->update and ->delete, given its only supported by rhashtable, but on the off-chance we'll see runtime add/delete for other types or a new set type keep that as-is for now. Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit 17a20e09f086f2c574ac87f3cf6e14c4377f65f6 Author: Florian Westphal Date: Wed Jul 9 19:05:13 2025 +0200 netfilter: nft_set: remove one argument from lookup and update functions Return the extension pointer instead of passing it as a function argument to be filled in by the callee. As-is, whenever false is returned, the extension pointer is not used. For all set types, when true is returned, the extension pointer was set to the matching element. Only exception: nft_set_bitmap doesn't support extensions. Return a pointer to a static const empty element extension container. return false -> return NULL return true -> return the elements' extension pointer. This saves one function argument. Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit 7792c1e03054440c60d4bce0c06a31c134601997 Author: Florian Westphal Date: Wed Jul 9 19:05:12 2025 +0200 netfilter: nft_set_pipapo: remove unused arguments They are not used anymore, so remove them. Signed-off-by: Florian Westphal Reviewed-by: Stefano Brivio Signed-off-by: Pablo Neira Ayuso commit bc8c43adfdc57c8253884fc1853cb6679cd5953d Author: Phil Sutter Date: Tue Jul 8 15:04:02 2025 +0200 netfilter: nfnetlink_hook: Dump flowtable info Introduce NFNL_HOOK_TYPE_NFT_FLOWTABLE to distinguish flowtable hooks from base chain ones. Nested attributes are shared with the old NFTABLES hook info type since they fit apart from their misleading name. Old nftables in user space will ignore this new hook type and thus continue to print flowtable hooks just like before, e.g.: | family netdev { | hook ingress device test0 { | 0000000000 nf_flow_offload_ip_hook [nf_flow_table] | } | } With this patch in place and support for the new hook info type, output becomes more useful: | family netdev { | hook ingress device test0 { | 0000000000 flowtable ip mytable myft [nf_flow_table] | } | } Suggested-by: Florian Westphal Signed-off-by: Phil Sutter Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit b65504e7cf0a99eb75bbed0d1ef22950c080d84a Author: Phil Sutter Date: Tue Jul 8 15:04:01 2025 +0200 netfilter: nfnetlink: New NFNLA_HOOK_INFO_DESC helper Introduce a helper routine adding the nested attribute for use by a second caller later. Note how this introduces cancelling of 'nest2' for categorical reasons. Since always followed by cancelling of the outer 'nest', it is technically not needed. Signed-off-by: Phil Sutter Reviewed-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit bfabc4f70ee72809f1de662e971ac55648981a31 Author: WangYuli Date: Fri Jul 4 16:35:53 2025 +0800 ipvs: Rename del_timer in comment in ip_vs_conn_expire_now() Commit 8fa7292fee5c ("treewide: Switch/rename to timer_delete[_sync]()") switched del_timer to timer_delete, but did not modify the comment for ip_vs_conn_expire_now(). Now fix it. Signed-off-by: WangYuli Acked-by: Julian Anastasov Signed-off-by: Pablo Neira Ayuso commit ba71a6e58b38aa6f86865d4e18579cb014903692 Author: Sebastian Andrzej Siewior Date: Mon Jun 30 17:44:25 2025 +0200 selftests: netfilter: Enable CONFIG_INET_SCTP_DIAG The config snippet specifies CONFIG_SCTP_DIAG. This was never an option. Replace CONFIG_SCTP_DIAG with the intended CONFIG_INET_SCTP_DIAG. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Pablo Neira Ayuso commit 3c3ab65f00ebf7859d93e29980eb9a9c5bc64642 Author: Florian Westphal Date: Mon Jun 30 17:44:24 2025 +0200 selftests: net: Enable legacy netfilter legacy options. Some specified options rely on NETFILTER_XTABLES_LEGACY to be enabled. IP_NF_TARGET_TTL for instance depends on IP_NF_MANGLE which in turn depends on IP_NF_IPTABLES_LEGACY -> NETFILTER_XTABLES_LEGACY. Enable relevant iptables config options explicitly, this is needed to avoid breakage when symbols related to iptables-legacy will depend on NETFILTER_LEGACY resp. IP_TABLES_LEGACY. This also means that the classic tables (Kernel modules) will not be enabled by default, so enable them too. Signed-off-by: Florian Westphal [bigeasy: Split out the config bits from the main patch] Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Pablo Neira Ayuso commit 9fce66583f06c212e95e4b76dd61d8432ffa56b6 Author: Pablo Neira Ayuso Date: Mon Jun 30 17:44:23 2025 +0200 netfilter: Exclude LEGACY TABLES on PREEMPT_RT. The seqcount xt_recseq is used to synchronize the replacement of xt_table::private in xt_replace_table() against all readers such as ipt_do_table() To ensure that there is only one writer, the writing side disables bottom halves. The sequence counter can be acquired recursively. Only the first invocation modifies the sequence counter (signaling that a writer is in progress) while the following (recursive) writer does not modify the counter. The lack of a proper locking mechanism for the sequence counter can lead to live lock on PREEMPT_RT if the high prior reader preempts the writer. Additionally if the per-CPU lock on PREEMPT_RT is removed from local_bh_disable() then there is no synchronisation for the per-CPU sequence counter. The affected code is "just" the legacy netfilter code which is replaced by "netfilter tables". That code can be disabled without sacrificing functionality because everything is provided by the newer implementation. This will only requires the usage of the "-nft" tools instead of the "-legacy" ones. The long term plan is to remove the legacy code so lets accelerate the progress. Relax dependencies on iptables legacy, replace select with depends on, this should cause no harm to existing kernel configs and users can still toggle IP{6}_NF_IPTABLES_LEGACY in any case. Make EBTABLES_LEGACY, IPTABLES_LEGACY and ARPTABLES depend on NETFILTER_XTABLES_LEGACY. Hide xt_recseq and its users, xt_register_table() and xt_percpu_counter_alloc() behind NETFILTER_XTABLES_LEGACY. Let NETFILTER_XTABLES_LEGACY depend on !PREEMPT_RT. This will break selftest expecing the legacy options enabled and will be addressed in a following patch. Co-developed-by: Florian Westphal Co-developed-by: Sebastian Andrzej Siewior Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Pablo Neira Ayuso commit 29f0f4cefc28611f260fe5c305fcfa0568655135 Author: Yue Haibing Date: Sat Jun 28 18:32:40 2025 +0800 netfilter: conntrack: Remove unused net in nf_conntrack_double_lock() Since commit a3efd81205b1 ("netfilter: conntrack: move generation seqcnt out of netns_ct") this param is unused. Signed-off-by: Yue Haibing Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit bf6788742b8d6c73de441e088a71de7154f0d4aa Author: Yue Haibing Date: Tue Jun 24 09:48:18 2025 +0800 netfilter: nf_tables: Remove unused nft_reduce_is_readonly() Since commit 9e539c5b6d9c ("netfilter: nf_tables: disable expression reduction infra") this is unused. Signed-off-by: Yue Haibing Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso commit 031a712471943ce780a7fc56e35b68cf77243e1e Author: Yue Haibing Date: Tue Jun 24 09:44:32 2025 +0800 netfilter: x_tables: Remove unused functions xt_{in|out}name() Since commit 2173c519d5e9 ("audit: normalize NETFILTER_PKT") these are unused, so can be removed. Signed-off-by: Yue Haibing Signed-off-by: Pablo Neira Ayuso commit e89a68046687fe9913ce3bfad82f7ccbb65687e0 Author: Lance Yang Date: Mon May 26 16:59:02 2025 +0800 netfilter: load nf_log_syslog on enabling nf_conntrack_log_invalid When no logger is registered, nf_conntrack_log_invalid fails to log invalid packets, leaving users unaware of actual invalid traffic. Improve this by loading nf_log_syslog, similar to how 'iptables -I FORWARD 1 -m conntrack --ctstate INVALID -j LOG' triggers it. Suggested-by: Florian Westphal Signed-off-by: Zi Li Signed-off-by: Lance Yang Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit aa5840167780a315f8a050b77f41acb852465e2d Author: lvxiafei Date: Thu May 22 17:19:54 2025 +0800 netfilter: conntrack: table full detailed log Add the netns field in the "nf_conntrack: table full, dropping packet" log to help locate the specific netns when the table is full. Signed-off-by: lvxiafei Signed-off-by: Pablo Neira Ayuso commit ecd82dfb4ccdfab7ecafcdb02b3b388dbaff4396 Merge: 46647a840538b1 6304c4c8476d5a Author: Marc Kleine-Budde Date: Fri Jul 25 18:01:25 2025 +0200 Merge patch series "can: kvaser_usb: Simplify identification of physical CAN interfaces" Jimmy Assarsson says: This patch series simplifies the process of identifying which network interface (can0..canX) corresponds to which physical CAN channel on Kvaser USB based CAN interfaces. Note that this patch series is based on [1] "can: kvaser_pciefd: Simplify identification of physical CAN interfaces" Changes in v3: - Fix GCC compiler array warning (-Warray-bounds) - Fix transient Sparse warning - Add tag Reviewed-by Vincent Mailhol Changes in v2: - New patch with devlink documentation - New patch assigning netdev.dev_port - Formatting and refactoring [1] https://lore.kernel.org/linux-can/20250725123230.8-1-extja@kvaser.com Link: https://patch.msgid.link/20250725123452.41-1-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 6304c4c8476d5a7339ba1839f6cded72208fce57 Author: Jimmy Assarsson Date: Fri Jul 25 14:34:52 2025 +0200 Documentation: devlink: add devlink documentation for the kvaser_usb driver List the version information reported by the kvaser_usb driver through devlink. Suggested-by: Vincent Mailhol Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-12-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit aa6a5c995e162469718de93c7ec0a2d2ac86271d Author: Jimmy Assarsson Date: Fri Jul 25 14:34:51 2025 +0200 can: kvaser_usb: Add devlink port support Register each CAN channel of the device as an devlink physical port. This makes it easier to get device information for a given network interface (i.e. can2). Example output: $ devlink dev usb/1-1.3:1.0 $ devlink port usb/1-1.3:1.0/0: type eth netdev can0 flavour physical port 0 splittable false usb/1-1.3:1.0/1: type eth netdev can1 flavour physical port 1 splittable false $ devlink port show can1 usb/1-1.3:1.0/1: type eth netdev can1 flavour physical port 0 splittable false $ devlink dev info usb/1-1.3:1.0: driver kvaser_usb serial_number 1020 versions: fixed: board.rev 1 board.id 7330130009653 running: fw 3.22.527 $ ethtool -i can1 driver: kvaser_usb version: 6.12.10-arch1-1 firmware-version: 3.22.527 expansion-rom-version: bus-info: 1-1.3:1.0 supports-statistics: no supports-test: no supports-eeprom-access: no supports-register-dump: no supports-priv-flags: no Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-11-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 8720aed90c874b1c21ca776591b3341f226f89dd Author: Jimmy Assarsson Date: Fri Jul 25 14:34:50 2025 +0200 can: kvaser_usb: Expose device information via devlink info_get() Expose device information via devlink info_get(): * Serial number * Firmware version * Hardware revision * EAN (product number) Example output: $ devlink dev usb/1-1.2:1.0 $ devlink dev info usb/1-1.2:1.0: driver kvaser_usb serial_number 1020 versions: fixed: board.rev 1 board.id 7330130009653 running: fw 3.22.527 Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-10-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 9505a83fc4e126303238d069d15731f9d2345c74 Author: Jimmy Assarsson Date: Fri Jul 25 14:34:49 2025 +0200 can: kvaser_usb: Add devlink support Add devlink support at device level. Example output: $ devlink dev usb/1-1.3:1.0 $ devlink dev info usb/1-1.3:1.0: driver kvaser_usb Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-9-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 0020f2ba40994d2ce30a2eaa7dcb950b7e132e11 Author: Jimmy Assarsson Date: Fri Jul 25 14:34:48 2025 +0200 can: kvaser_usb: Store additional device information Store additional device information; EAN (product number), serial_number and hardware revision. Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-8-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 280eba332b3623f7a716de8b244c54c66fbb97f0 Author: Jimmy Assarsson Date: Fri Jul 25 14:34:47 2025 +0200 can: kvaser_usb: Store the different firmware version components in a struct Store firmware version in kvaser_usb_fw_version struct, specifying the different components of the version number. And drop debug prinout of firmware version, since later patches will expose it via the devlink interface. Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-7-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 7506789c5335f21a57d9f7c1b4c5fe97c6688dfe Author: Jimmy Assarsson Date: Fri Jul 25 14:34:46 2025 +0200 can: kvaser_usb: Move comment regarding max_tx_urbs Move comment regarding max_tx_urbs, to where the struct member is declared. Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-6-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 827158a67c86ba26be220710e5f8bcbf709a6103 Author: Jimmy Assarsson Date: Fri Jul 25 14:34:45 2025 +0200 can: kvaser_usb: Add intermediate variables Add intermediate variables, for readability and to simplify future patches. Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-5-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit c151b06a087a61c7a1790b75ee2f1d6edb6a8a45 Author: Jimmy Assarsson Date: Fri Jul 25 14:34:44 2025 +0200 can: kvaser_usb: Assign netdev.dev_port based on device channel index Assign netdev.dev_port based on the device channel index, to indicate the port number of the network device. While this driver already uses netdev.dev_id for that purpose, dev_port is more appropriate. However, retain dev_id to avoid potential regressions. Fixes: 3e66d0138c05 ("can: populate netdev::dev_id for udev discrimination") Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-4-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 3d7a3de9eba406fb01690b27f880d9597301f0d0 Author: Jimmy Assarsson Date: Fri Jul 25 14:34:43 2025 +0200 can: kvaser_usb: Add support for ethtool set_phys_id() Add support for ethtool set_phys_id(), to physically locate devices by flashing a LED on the device. Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-3-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 478248f1bc0c43b9488164fc8cccc54b07c7511f Author: Jimmy Assarsson Date: Fri Jul 25 14:34:42 2025 +0200 can: kvaser_usb: Add support to control CAN LEDs on device Add support to turn on/off CAN LEDs on device. Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123452.41-2-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 46647a840538b1e019873d6097590e5b1b73e7a0 Merge: 2db7a52ca9ed89 fed552478e6fbe Author: Marc Kleine-Budde Date: Fri Jul 25 17:57:41 2025 +0200 Merge patch series "can: kvaser_pciefd: Simplify identification of physical CAN interfaces" Jimmy Assarsson says: This patch series simplifies the process of identifying which network interface (can0..canX) corresponds to which physical CAN channel on Kvaser PCIe based CAN interfaces. Changes in v4: - Fix transient Sparse warning - Add tag Reviewed-by Vincent Mailhol Changes in v3: - Fixed typo; kvaser_pcied -> kvaser_pciefd in documentation patch Changes in v2: - Replace use of netdev.dev_id with netdev.dev_port - Formatting and refactoring - New patch with devlink documentation Link: https://patch.msgid.link/20250725123230.8-1-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit fed552478e6fbefcf0416143ed054bdbfc50fb52 Author: Jimmy Assarsson Date: Fri Jul 25 14:32:30 2025 +0200 Documentation: devlink: add devlink documentation for the kvaser_pciefd driver List the version information reported by the kvaser_pciefd driver through devlink. Suggested-by: Vincent Mailhol Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123230.8-11-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 6271c8b8273009de2b004ace8208972aa6d93069 Author: Jimmy Assarsson Date: Fri Jul 25 14:32:29 2025 +0200 can: kvaser_pciefd: Add devlink port support Register each CAN channel of the device as an devlink physical port. This makes it easier to get device information for a given network interface (i.e. can2). Example output: $ devlink dev pci/0000:07:00.0 pci/0000:08:00.0 pci/0000:09:00.0 $ devlink port pci/0000:07:00.0/0: type eth netdev can0 flavour physical port 0 splittable false pci/0000:07:00.0/1: type eth netdev can1 flavour physical port 1 splittable false pci/0000:07:00.0/2: type eth netdev can2 flavour physical port 2 splittable false pci/0000:07:00.0/3: type eth netdev can3 flavour physical port 3 splittable false pci/0000:08:00.0/0: type eth netdev can4 flavour physical port 0 splittable false pci/0000:08:00.0/1: type eth netdev can5 flavour physical port 1 splittable false pci/0000:09:00.0/0: type eth netdev can6 flavour physical port 0 splittable false pci/0000:09:00.0/1: type eth netdev can7 flavour physical port 1 splittable false pci/0000:09:00.0/2: type eth netdev can8 flavour physical port 2 splittable false pci/0000:09:00.0/3: type eth netdev can9 flavour physical port 3 splittable false $ devlink port show can2 pci/0000:07:00.0/2: type eth netdev can2 flavour physical port 2 splittable false $ devlink dev info pci/0000:07:00.0: driver kvaser_pciefd versions: running: fw 1.3.75 pci/0000:08:00.0: driver kvaser_pciefd versions: running: fw 2.4.29 pci/0000:09:00.0: driver kvaser_pciefd versions: running: fw 1.3.72 $ sudo ethtool -i can2 driver: kvaser_pciefd version: 6.8.0-40-generic firmware-version: 1.3.75 expansion-rom-version: bus-info: 0000:07:00.0 supports-statistics: no supports-test: no supports-eeprom-access: no supports-register-dump: no supports-priv-flags: no Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123230.8-10-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 3d68ecf4173cc42159d32ea0d6d35d4924089003 Author: Jimmy Assarsson Date: Fri Jul 25 14:32:28 2025 +0200 can: kvaser_pciefd: Expose device firmware version via devlink info_get() Expose device firmware version via devlink info_get(). Example output: $ devlink dev pci/0000:07:00.0 pci/0000:08:00.0 pci/0000:09:00.0 $ devlink dev info pci/0000:07:00.0: driver kvaser_pciefd versions: running: fw 1.3.75 pci/0000:08:00.0: driver kvaser_pciefd versions: running: fw 2.4.29 pci/0000:09:00.0: driver kvaser_pciefd versions: running: fw 1.3.72 Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123230.8-9-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 0d1b337b6d6c515555d6abba546e39138f36b111 Author: Jimmy Assarsson Date: Fri Jul 25 14:32:27 2025 +0200 can: kvaser_pciefd: Add devlink support Add devlink support at device level. Example output: $ devlink dev pci/0000:07:00.0 pci/0000:08:00.0 pci/0000:09:00.0 $ devlink dev info pci/0000:07:00.0: driver kvaser_pciefd pci/0000:08:00.0: driver kvaser_pciefd pci/0000:09:00.0: driver kvaser_pciefd Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123230.8-8-extja@kvaser.com [mkl: kvaser_pciefd_remove(): fix use-after-free] Signed-off-by: Marc Kleine-Budde commit 20bc87ae514938ce18619f653ef6b4cefa67880c Author: Jimmy Assarsson Date: Fri Jul 25 14:32:26 2025 +0200 can: kvaser_pciefd: Split driver into C-file and header-file. Split driver into C-file and header-file, to simplify future patches. Move common definitions and declarations to a header file. Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123230.8-7-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit d54b16b40ddadb7d0a77fff48af7b319a0cd6aae Author: Jimmy Assarsson Date: Fri Jul 25 14:32:25 2025 +0200 can: kvaser_pciefd: Store device channel index Store device channel index in netdev.dev_port. Fixes: 26ad340e582d ("can: kvaser_pciefd: Add driver for Kvaser PCIEcan devices") Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123230.8-6-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 5131f18ffa97b50953ab38f464fdaa179e4bcdf7 Author: Jimmy Assarsson Date: Fri Jul 25 14:32:24 2025 +0200 can: kvaser_pciefd: Store the different firmware version components in a struct Store firmware version in kvaser_pciefd_fw_version struct, specifying the different components of the version number. And drop debug prinout of firmware version, since later patches will expose it via the devlink interface. Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123230.8-5-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 69a2cb633c27ae6d6355c7fe658535382221f480 Author: Jimmy Assarsson Date: Fri Jul 25 14:32:23 2025 +0200 can: kvaser_pciefd: Add intermediate variable for device struct in probe() Add intermediate variable, for readability and to simplify future patches. Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123230.8-4-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit e74249a00bf1afa27e3a77dcce770806d2bba7c4 Author: Jimmy Assarsson Date: Fri Jul 25 14:32:22 2025 +0200 can: kvaser_pciefd: Add support for ethtool set_phys_id() Add support for ethtool set_phys_id(), to physically locate devices by flashing a LED on the device. Reviewed-by: Axel Forsman Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123230.8-3-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit 44f0b630f67eceb77b4f037e5db4020cc2795d65 Author: Jimmy Assarsson Date: Fri Jul 25 14:32:21 2025 +0200 can: kvaser_pciefd: Add support to control CAN LEDs on device Add support to turn on/off CAN LEDs on device. Turn off all CAN LEDs in probe, since they are default on after a reset or power on. Reviewed-by: Axel Forsman Reviewed-by: Vincent Mailhol Signed-off-by: Jimmy Assarsson Link: https://patch.msgid.link/20250725123230.8-2-extja@kvaser.com Signed-off-by: Marc Kleine-Budde commit e60737dbfb92fc32511afa68ea70513df7548919 Author: James Clark Date: Mon Jun 30 09:47:17 2025 +0100 ARM: 9449/1: coresight: Finish removal of Coresight support in arch/arm/kernel Commit 184901a06a36 ("ARM: removing support for etb/etm in "arch/arm/kernel/"") removed asm/hardware/coresight.h which is included by this file. Therefore this is dead code so delete it. Acked-by: Suzuki K Poulose Signed-off-by: James Clark Signed-off-by: Russell King (Oracle) commit 099b847ccc6c1ad2f805d13cfbcc83f5b6d4bc42 Author: Theodore Ts'o Date: Thu Jul 17 10:54:34 2025 -0400 ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr A syzbot fuzzed image triggered a BUG_ON in ext4_update_inline_data() when an inode had the INLINE_DATA_FL flag set but was missing the system.data extended attribute. Since this can happen due to a maiciouly fuzzed file system, we shouldn't BUG, but rather, report it as a corrupted file system. Add similar replacements of BUG_ON with EXT4_ERROR_INODE() ii ext4_create_inline_data() and ext4_inline_data_truncate(). Reported-by: syzbot+544248a761451c0df72f@syzkaller.appspotmail.com Signed-off-by: Theodore Ts'o commit a3ce570a5d6a70df616ae9a78635a188e6b5fd2f Author: Baokun Li Date: Mon Jul 14 21:03:27 2025 +0800 ext4: implement linear-like traversal across order xarrays Although we now perform ordered traversal within an xarray, this is currently limited to a single xarray. However, we have multiple such xarrays, which prevents us from guaranteeing a linear-like traversal where all groups on the right are visited before all groups on the left. For example, suppose we have 128 block groups, with a target group of 64, a target length corresponding to an order of 1, and available free groups of 16 (order 1) and group 65 (order 8): For linear traversal, when no suitable free block is found in group 64, it will search in the next block group until group 127, then start searching from 0 up to block group 63. It ensures continuous forward traversal, which is consistent with the unidirectional rotation behavior of HDD platters. Additionally, the block group lock contention during freeing block is unavoidable. The goal increasing from 0 to 64 indicates that previously scanned groups (which had no suitable free space and are likely to free blocks later) and skipped groups (which are currently in use) have newly freed some used blocks. If we allocate blocks in these groups, the probability of competing with other processes increases. For non-linear traversal, we first traverse all groups in order_1. If only group 16 has free space in this list, we first traverse [63, 128), then traverse [0, 64) to find the available group 16, and then allocate blocks in group 16. Therefore, it cannot guarantee continuous traversal in one direction, thus increasing the probability of contention. So refactor ext4_mb_scan_groups_xarray() to ext4_mb_scan_groups_xa_range() to only traverse a fixed range of groups, and move the logic for handling wrap around to the caller. The caller first iterates through all xarrays in the range [start, ngroups) and then through the range [0, start). This approach simulates a linear scan, which reduces contention between freeing blocks and allocating blocks. Assume we have the following groups, where "|" denotes the xarray traversal start position: order_1_groups: AB | CD order_2_groups: EF | GH Traversal order: Before: C > D > A > B > G > H > E > F After: C > D > G > H > A > B > E > F Performance test data follows: |CPU: Kunpeng 920 | P80 | P1 | |Memory: 512GB |------------------------|-------------------------| |960GB SSD (0.5GB/s)| base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 19555 | 20049 (+2.5%) | 315636 | 316724 (-0.3%) | |mb_optimize_scan=1 | 15496 | 19342 (+24.8%) | 323569 | 328324 (+1.4%) | |CPU: AMD 9654 * 2 | P96 | P1 | |Memory: 1536GB |------------------------|-------------------------| |960GB SSD (1GB/s) | base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 53192 | 52125 (-2.0%) | 212678 | 215136 (+1.1%) | |mb_optimize_scan=1 | 37636 | 50331 (+33.7%) | 214189 | 209431 (-2.2%) | Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-18-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 6347558764911f88acac06ab996e162f0c8a212d Author: Baokun Li Date: Mon Jul 14 21:03:26 2025 +0800 ext4: refactor choose group to scan group This commit converts the `choose group` logic to `scan group` using previously prepared helper functions. This allows us to leverage xarrays for ordered non-linear traversal, thereby mitigating the "bouncing" issue inherent in the `choose group` mechanism. This also decouples linear and non-linear traversals, leading to cleaner and more readable code. Key changes: * ext4_mb_choose_next_group() is refactored to ext4_mb_scan_groups(). * Replaced ext4_mb_good_group() with ext4_mb_scan_group() in non-linear traversals, and related functions now return error codes instead of group info. * Added ext4_mb_scan_groups_linear() for performing linear scans starting from a specific group for a set number of times. * Linear scans now execute up to sbi->s_mb_max_linear_groups times, so ac_groups_linear_remaining is removed as it's no longer used. * ac->ac_criteria is now used directly instead of passing cr around. Also, ac->ac_criteria is incremented directly after groups scan fails for the corresponding criteria. * Since we're now directly scanning groups instead of finding a good group then scanning, the following variables and flags are no longer needed, s_bal_cX_groups_considered is sufficient. s_bal_p2_aligned_bad_suggestions s_bal_goal_fast_bad_suggestions s_bal_best_avail_bad_suggestions EXT4_MB_CR_POWER2_ALIGNED_OPTIMIZED EXT4_MB_CR_GOAL_LEN_FAST_OPTIMIZED EXT4_MB_CR_BEST_AVAIL_LEN_OPTIMIZED Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-17-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit f7eaacbb4e54f8a6c6674c16eff54f703ea63d5e Author: Baokun Li Date: Mon Jul 14 21:03:25 2025 +0800 ext4: convert free groups order lists to xarrays While traversing the list, holding a spin_lock prevents load_buddy, making direct use of ext4_try_lock_group impossible. This can lead to a bouncing scenario where spin_is_locked(grp_A) succeeds, but ext4_try_lock_group() fails, forcing the list traversal to repeatedly restart from grp_A. In contrast, linear traversal directly uses ext4_try_lock_group(), avoiding this bouncing. Therefore, we need a lockless, ordered traversal to achieve linear-like efficiency. Therefore, this commit converts both average fragment size lists and largest free order lists into ordered xarrays. In an xarray, the index represents the block group number and the value holds the block group information; a non-empty value indicates the block group's presence. While insertion and deletion complexity remain O(1), lookup complexity changes from O(1) to O(nlogn), which may slightly reduce single-threaded performance. Additionally, xarray insertions might fail, potentially due to memory allocation issues. However, since we have linear traversal as a fallback, this isn't a major problem. Therefore, we've only added a warning message for insertion failures here. A helper function ext4_mb_find_good_group_xarray() is added to find good groups in the specified xarray starting at the specified position start, and when it reaches ngroups-1, it wraps around to 0 and then to start-1. This ensures an ordered traversal within the xarray. Performance test results are as follows: Single-process operations on an empty disk show negligible impact, while multi-process workloads demonstrate a noticeable performance gain. |CPU: Kunpeng 920 | P80 | P1 | |Memory: 512GB |------------------------|-------------------------| |960GB SSD (0.5GB/s)| base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 20097 | 19555 (-2.6%) | 316141 | 315636 (-0.2%) | |mb_optimize_scan=1 | 13318 | 15496 (+16.3%) | 325273 | 323569 (-0.5%) | |CPU: AMD 9654 * 2 | P96 | P1 | |Memory: 1536GB |------------------------|-------------------------| |960GB SSD (1GB/s) | base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 53603 | 53192 (-0.7%) | 214243 | 212678 (-0.7%) | |mb_optimize_scan=1 | 20887 | 37636 (+80.1%) | 213632 | 214189 (+0.2%) | [ Applied spelling fixes per discussion on the ext4-list see thread referened in the Link tag. --tytso] Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-16-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 9c08e42db9056d423dcef5e7998c73182180ff83 Author: Baokun Li Date: Mon Jul 14 21:03:24 2025 +0800 ext4: factor out ext4_mb_scan_group() Extract ext4_mb_scan_group() to make the code clearer and to prepare for the later conversion of 'choose group' to 'scan groups'. No functional changes. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-15-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 5abd85f667a19ef7d880ed00c201fc22de6fa707 Author: Baokun Li Date: Mon Jul 14 21:03:23 2025 +0800 ext4: factor out ext4_mb_might_prefetch() Extract ext4_mb_might_prefetch() to make the code clearer and to prepare for the later conversion of 'choose group' to 'scan groups'. No functional changes. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-14-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 45704f92e55853fe287760e019feb45eeb9c988e Author: Baokun Li Date: Mon Jul 14 21:03:22 2025 +0800 ext4: factor out __ext4_mb_scan_group() Extract __ext4_mb_scan_group() to make the code clearer and to prepare for the later conversion of 'choose group' to 'scan groups'. No functional changes. Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-13-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 7d345aa1fac4c2ec9584fbd6f389f2c2368671d5 Author: Baokun Li Date: Mon Jul 14 21:03:21 2025 +0800 ext4: fix largest free orders lists corruption on mb_optimize_scan switch The grp->bb_largest_free_order is updated regardless of whether mb_optimize_scan is enabled. This can lead to inconsistencies between grp->bb_largest_free_order and the actual s_mb_largest_free_orders list index when mb_optimize_scan is repeatedly enabled and disabled via remount. For example, if mb_optimize_scan is initially enabled, largest free order is 3, and the group is in s_mb_largest_free_orders[3]. Then, mb_optimize_scan is disabled via remount, block allocations occur, updating largest free order to 2. Finally, mb_optimize_scan is re-enabled via remount, more block allocations update largest free order to 1. At this point, the group would be removed from s_mb_largest_free_orders[3] under the protection of s_mb_largest_free_orders_locks[2]. This lock mismatch can lead to list corruption. To fix this, whenever grp->bb_largest_free_order changes, we now always attempt to remove the group from its old order list. However, we only insert the group into the new order list if `mb_optimize_scan` is enabled. This approach helps prevent lock inconsistencies and ensures the data in the order lists remains reliable. Fixes: 196e402adf2e ("ext4: improve cr 0 / cr 1 group scanning") CC: stable@vger.kernel.org Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-12-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 1c320d8e92925bb7615f83a7b6e3f402a5c2ca63 Author: Baokun Li Date: Mon Jul 14 21:03:20 2025 +0800 ext4: fix zombie groups in average fragment size lists Groups with no free blocks shouldn't be in any average fragment size list. However, when all blocks in a group are allocated(i.e., bb_fragments or bb_free is 0), we currently skip updating the average fragment size, which means the group isn't removed from its previous s_mb_avg_fragment_size[old] list. This created "zombie" groups that were always skipped during traversal as they couldn't satisfy any block allocation requests, negatively impacting traversal efficiency. Therefore, when a group becomes completely full, bb_avg_fragment_size_order is now set to -1. If the old order was not -1, a removal operation is performed; if the new order is not -1, an insertion is performed. Fixes: 196e402adf2e ("ext4: improve cr 0 / cr 1 group scanning") CC: stable@vger.kernel.org Signed-off-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-11-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit e7f101a8088770e8f3bb089f13652b9b0fd22b06 Author: Baokun Li Date: Mon Jul 14 21:03:19 2025 +0800 ext4: merge freed extent with existing extents before insertion Attempt to merge ext4_free_data with already inserted free extents prior to adding new ones. This strategy drastically cuts down the number of times locks are held. For example, if prev, new, and next extents are all mergeable, the existing code (before this patch) requires acquiring the s_md_lock three times: prev merge into new and free prev // hold lock next merge into new and free next // hold lock insert new // hold lock After the patch, it only needs to be acquired once: new merge into next and free new // no lock next merge into prev and free next // hold lock Performance test data follows: Test: Running will-it-scale/fallocate2 on CPU-bound containers. Observation: Average fallocate operations per container per second. |CPU: Kunpeng 920 | P80 | P1 | |Memory: 512GB |------------------------|-------------------------| |960GB SSD (0.5GB/s)| base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 20043 | 20097 (+0.2%) | 314331 | 316141 (+0.5%) | |mb_optimize_scan=1 | 7290 | 13318 (+87.4%) | 324226 | 325273 (+0.3%) | |CPU: AMD 9654 * 2 | P96 | P1 | |Memory: 1536GB |------------------------|-------------------------| |960GB SSD (1GB/s) | base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 54999 | 53603 (-2.5%) | 214380 | 214243 (-0.06%)| |mb_optimize_scan=1 | 13497 | 20887 (+54.6%) | 216276 | 213632 (-1.2%) | Signed-off-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-10-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 0a2326f6ae60e99f5e6e9ca900a19b5c14304a51 Author: Baokun Li Date: Mon Jul 14 21:03:18 2025 +0800 ext4: convert sbi->s_mb_free_pending to atomic_t Previously, s_md_lock was used to protect s_mb_free_pending during modifications, while smp_mb() ensured fresh reads, so s_md_lock just guarantees the atomicity of s_mb_free_pending. Thus we optimized it by converting s_mb_free_pending into an atomic variable, thereby eliminating s_md_lock and minimizing lock contention. This also prepares for future lockless merging of free extents. Following this modification, s_md_lock is exclusively responsible for managing insertions and deletions within s_freed_data_list, along with operations involving list_splice. Performance test data follows: Test: Running will-it-scale/fallocate2 on CPU-bound containers. Observation: Average fallocate operations per container per second. |CPU: Kunpeng 920 | P80 | P1 | |Memory: 512GB |------------------------|-------------------------| |960GB SSD (0.5GB/s)| base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 19628 | 20043 (+2.1%) | 320885 | 314331 (-2.0%) | |mb_optimize_scan=1 | 7129 | 7290 (+2.2%) | 321275 | 324226 (+0.9%) | |CPU: AMD 9654 * 2 | P96 | P1 | |Memory: 1536GB |------------------------|-------------------------| |960GB SSD (1GB/s) | base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 53760 | 54999 (+2.3%) | 213145 | 214380 (+0.5%) | |mb_optimize_scan=1 | 12716 | 13497 (+6.1%) | 215262 | 216276 (+0.4%) | Signed-off-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-9-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 9a0ed1698191a143588a9bfb46ed76a4ee094931 Author: Baokun Li Date: Mon Jul 14 21:03:17 2025 +0800 ext4: fix typo in CR_GOAL_LEN_SLOW comment Remove the superfluous "find_". Signed-off-by: Baokun Li Reviewed-by: Ojaswin Mujoo Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-8-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 4d18a0b98259c2fa62f04ce5f94a7ec6e840f220 Author: Baokun Li Date: Mon Jul 14 21:03:16 2025 +0800 ext4: get rid of some obsolete EXT4_MB_HINT flags Since nobody has used these EXT4_MB_HINT flags for ages, let's remove them. Signed-off-by: Baokun Li Reviewed-by: Ojaswin Mujoo Reviewed-by: Jan Kara Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-7-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 8f2c3b74865cac9b3bd87fb15633475b46069ca8 Author: Baokun Li Date: Mon Jul 14 21:03:15 2025 +0800 ext4: utilize multiple global goals to reduce contention When allocating data blocks, if the first try (goal allocation) fails and stream allocation is on, it tries a global goal starting from the last group we used (s_mb_last_group). This helps cluster large files together to reduce free space fragmentation, and the data block contiguity also accelerates write-back to disk. However, when multiple processes allocate blocks, having just one global goal means they all fight over the same group. This drastically lowers the chances of extents merging and leads to much worse file fragmentation. To mitigate this multi-process contention, we now employ multiple global goals, with the number of goals being the minimum between the number of possible CPUs and one-quarter of the filesystem's total block group count. To ensure a consistent goal for each inode, we select the corresponding goal by taking the inode number modulo the total number of goals. Performance test data follows: Test: Running will-it-scale/fallocate2 on CPU-bound containers. Observation: Average fallocate operations per container per second. |CPU: Kunpeng 920 | P80 | P1 | |Memory: 512GB |------------------------|-------------------------| |960GB SSD (0.5GB/s)| base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 9636 | 19628 (+103%) | 337597 | 320885 (-4.9%) | |mb_optimize_scan=1 | 4834 | 7129 (+47.4%) | 341440 | 321275 (-5.9%) | |CPU: AMD 9654 * 2 | P96 | P1 | |Memory: 1536GB |------------------------|-------------------------| |960GB SSD (1GB/s) | base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 22341 | 53760 (+140%) | 219707 | 213145 (-2.9%) | |mb_optimize_scan=1 | 9177 | 12716 (+38.5%) | 215732 | 215262 (+0.2%) | Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-6-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 4b41deb896e3d0417701759194f0765c06258b9c Author: Baokun Li Date: Mon Jul 14 21:03:14 2025 +0800 ext4: remove unnecessary s_md_lock on update s_mb_last_group After we optimized the block group lock, we found another lock contention issue when running will-it-scale/fallocate2 with multiple processes. The fallocate's block allocation and the truncate's block release were fighting over the s_md_lock. The problem is, this lock protects totally different things in those two processes: the list of freed data blocks (s_freed_data_list) when releasing, and where to start looking for new blocks (mb_last_group) when allocating. Now we only need to track s_mb_last_group and no longer need to track s_mb_last_start, so we don't need the s_md_lock lock to ensure that the two are consistent. Since s_mb_last_group is merely a hint and doesn't require strong synchronization, READ_ONCE/WRITE_ONCE is sufficient. Besides, the s_mb_last_group data type only requires ext4_group_t (i.e., unsigned int), rendering unsigned long superfluous. Performance test data follows: Test: Running will-it-scale/fallocate2 on CPU-bound containers. Observation: Average fallocate operations per container per second. |CPU: Kunpeng 920 | P80 | P1 | |Memory: 512GB |------------------------|-------------------------| |960GB SSD (0.5GB/s)| base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 4821 | 9636 (+99.8%) | 314065 | 337597 (+7.4%) | |mb_optimize_scan=1 | 4784 | 4834 (+1.04%) | 316344 | 341440 (+7.9%) | |CPU: AMD 9654 * 2 | P96 | P1 | |Memory: 1536GB |------------------------|-------------------------| |960GB SSD (1GB/s) | base | patched | base | patched | |-------------------|-------|----------------|--------|----------------| |mb_optimize_scan=0 | 15371 | 22341 (+45.3%) | 205851 | 219707 (+6.7%) | |mb_optimize_scan=1 | 6101 | 9177 (+50.4%) | 207373 | 215732 (+4.0%) | Suggested-by: Jan Kara Signed-off-by: Baokun Li Reviewed-by: Ojaswin Mujoo Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-5-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit f0374d80711adf8628bdd442131c045c64a10951 Author: Baokun Li Date: Mon Jul 14 21:03:13 2025 +0800 ext4: remove unnecessary s_mb_last_start Since stream allocation does not use ac->ac_f_ex.fe_start, it is set to -1 by default, so the no longer needed sbi->s_mb_last_start is removed. Signed-off-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-4-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 35bfd4b44ef04a10a091a4037a26296e7cd5273a Author: Baokun Li Date: Mon Jul 14 21:03:12 2025 +0800 ext4: separate stream goal hits from s_bal_goals for better tracking In ext4_mb_regular_allocator(), after the call to ext4_mb_find_by_goal() fails to achieve the inode goal, allocation continues with the stream allocation global goal. Currently, hits for both are combined in sbi->s_bal_goals, hindering accurate optimization. This commit separates global goal hits into sbi->s_bal_stream_goals. Since stream allocation doesn't use ac->ac_g_ex.fe_start, set fe_start to -1. This prevents stream allocations from being counted in s_bal_goals. Also clear EXT4_MB_HINT_TRY_GOAL to avoid calling ext4_mb_find_by_goal again. After adding `stream_goal_hits`, `/proc/fs/ext4/sdx/mb_stats` will show: mballoc: reqs: 840347 success: 750992 groups_scanned: 1230506 cr_p2_aligned_stats: hits: 21531 groups_considered: 411664 extents_scanned: 21531 useless_loops: 0 bad_suggestions: 6 cr_goal_fast_stats: hits: 111222 groups_considered: 1806728 extents_scanned: 467908 useless_loops: 0 bad_suggestions: 13 cr_best_avail_stats: hits: 36267 groups_considered: 1817631 extents_scanned: 156143 useless_loops: 0 bad_suggestions: 204 cr_goal_slow_stats: hits: 106396 groups_considered: 5671710 extents_scanned: 22540056 useless_loops: 123747 cr_any_free_stats: hits: 138071 groups_considered: 724692 extents_scanned: 23615593 useless_loops: 585 extents_scanned: 46804261 goal_hits: 1307 stream_goal_hits: 236317 len_goal_hits: 155549 2^n_hits: 21531 breaks: 225096 lost: 35062 buddies_generated: 40/40 buddies_time_used: 48004 preallocated: 5962467 discarded: 4847560 Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-3-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit e9eec6f33971fbfcdd32fd1c7dd515ff4d2954c0 Author: Baokun Li Date: Mon Jul 14 21:03:11 2025 +0800 ext4: add ext4_try_lock_group() to skip busy groups When ext4 allocates blocks, we used to just go through the block groups one by one to find a good one. But when there are tons of block groups (like hundreds of thousands or even millions) and not many have free space (meaning they're mostly full), it takes a really long time to check them all, and performance gets bad. So, we added the "mb_optimize_scan" mount option (which is on by default now). It keeps track of some group lists, so when we need a free block, we can just grab a likely group from the right list. This saves time and makes block allocation much faster. But when multiple processes or containers are doing similar things, like constantly allocating 8k blocks, they all try to use the same block group in the same list. Even just two processes doing this can cut the IOPS in half. For example, one container might do 300,000 IOPS, but if you run two at the same time, the total is only 150,000. Since we can already look at block groups in a non-linear way, the first and last groups in the same list are basically the same for finding a block right now. Therefore, add an ext4_try_lock_group() helper function to skip the current group when it is locked by another process, thereby avoiding contention with other processes. This helps ext4 make better use of having multiple block groups. Also, to make sure we don't skip all the groups that have free space when allocating blocks, we won't try to skip busy groups anymore when ac_criteria is CR_ANY_FREE. Performance test data follows: Test: Running will-it-scale/fallocate2 on CPU-bound containers. Observation: Average fallocate operations per container per second. |CPU: Kunpeng 920 | P80 | |Memory: 512GB |-------------------------| |960GB SSD (0.5GB/s)| base | patched | |-------------------|-------|-----------------| |mb_optimize_scan=0 | 2667 | 4821 (+80.7%) | |mb_optimize_scan=1 | 2643 | 4784 (+81.0%) | |CPU: AMD 9654 * 2 | P96 | |Memory: 1536GB |-------------------------| |960GB SSD (1GB/s) | base | patched | |-------------------|-------|-----------------| |mb_optimize_scan=0 | 3450 | 15371 (+345%) | |mb_optimize_scan=1 | 3209 | 6101 (+90.0%) | Signed-off-by: Baokun Li Reviewed-by: Jan Kara Reviewed-by: Ojaswin Mujoo Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250714130327.1830534-2-libaokun1@huawei.com Signed-off-by: Theodore Ts'o commit 82e6381e23f1ea7a14f418215068aaa2ca046c84 Author: Zhang Yi Date: Fri Jul 25 10:15:50 2025 +0800 ext4: initialize superblock fields in the kballoc-test.c kunit tests Various changes in the "ext4: better scalability for ext4 block allocation" patch series have resulted in kunit test failures, most notably in the test_new_blocks_simple and the test_mb_mark_used tests. The root cause of these failures is that various in-memory ext4 data structures were not getting initialized, and while previous versions of the functions exercised by the unit tests didn't use these structure members, this was arguably a test bug. Since one of the patches in the block allocation scalability patches is a fix which is has a cc:stable tag, this commit also has a cc:stable tag. CC: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250714130327.1830534-1-libaokun1@huawei.com Link: https://patch.msgid.link/20250725021550.3177573-1-yi.zhang@huaweicloud.com Link: https://patch.msgid.link/20250725021654.3188798-1-yi.zhang@huaweicloud.com Reported-by: Guenter Roeck Closes: https://lore.kernel.org/linux-ext4/b0635ad0-7ebf-4152-a69b-58e7e87d5085@roeck-us.net/ Tested-by: Guenter Roeck Signed-off-by: Zhang Yi Signed-off-by: Theodore Ts'o commit 7038db703317617ef3691fbbb7259d4cdf208cf2 Merge: 8e48727c26c4d8 75fe230b9bed36 Author: Martin K. Petersen Date: Fri Jul 25 09:05:23 2025 -0400 Merge patch series "libsas cleanups" Damien Le Moal says: Martin, John, While debugging an issue with the pm8001 driver, I generated these cleanup patches. No functional changes overall. These patches are against the 6.17/scsi-staging branch of the scsi tree. Link: https://lore.kernel.org/r/20250725015818.171252-1-dlemoal@kernel.org Signed-off-by: Martin K. Petersen commit b8a7fba39cd49eab343bfe561d85bb5dc57541af Author: Nam Cao Date: Thu Jul 24 19:33:30 2025 +0200 rv: Remove struct rv_monitor::reacting The field 'reacting' in struct rv_monitor is set but never used. Delete it. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/a6c16f845d2f1a09c4d0934ab83f3cb14478a71d.1753378331.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 3d3800b4f7f4b1472a0ec2cffd535c05603f8f60 Author: Nam Cao Date: Thu Jul 24 19:33:29 2025 +0200 rv: Remove rv_reactor's reference counter rv_reactor has a reference counter to ensure it is not removed while monitors are still using it. However, this is futile, as __exit functions are not expected to fail and will proceed normally despite rv_unregister_reactor() returning an error. At the moment, reactors do not support being built as modules, therefore they are never removed and the reference counters are not necessary. If we support building RV reactors as modules in the future, kernel module's centralized facilities such as try_module_get(), module_put() or MODULE_SOFTDEP should be used instead of this custom implementation. Remove this reference counter. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/bb946398436a5e17fb0f5b842ef3313c02291852.1753378331.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 3d3c376118b5f7ed7723c2b4fd7a0a1c1893d63e Author: Nam Cao Date: Thu Jul 24 19:33:28 2025 +0200 rv: Merge struct rv_reactor_def into struct rv_reactor Each struct rv_reactor has a unique struct rv_reactor_def associated with it. struct rv_reactor is statically allocated, while struct rv_reactor_def is dynamically allocated. This makes the code more complicated than it should be: - Lookup is required to get the associated rv_reactor_def from rv_reactor - Dynamic memory allocation is required for rv_reactor_def. This is harder to get right compared to static memory. For instance, there is an existing mistake: rv_unregister_reactor() does not free the memory allocated by rv_register_reactor(). This is fortunately not a real memory leak problem as rv_unregister_reactor() is never called. Simplify and merge rv_reactor_def into rv_reactor. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/71cb91c86cd40df5b8c492b788787f2a73c3eaa3.1753378331.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 24cbfe18d55a6866bc2e27fda74306f4a1b5cb01 Author: Nam Cao Date: Thu Jul 24 19:33:27 2025 +0200 rv: Merge struct rv_monitor_def into struct rv_monitor Each struct rv_monitor has a unique struct rv_monitor_def associated with it. struct rv_monitor is statically allocated, while struct rv_monitor_def is dynamically allocated. This makes the code more complicated than it should be: - Lookup is required to get the associated rv_monitor_def from rv_monitor - Dynamic memory allocation is required for rv_monitor_def. This is harder to get right compared to static memory. For instance, there is an existing mistake: rv_unregister_monitor() does not free the memory allocated by rv_register_monitor(). This is fortunately not a real memory leak problem, as rv_unregister_monitor() is never called. Simplify and merge rv_monitor_def into rv_monitor. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/194449c00f87945c207aab4c96920c75796a4f53.1753378331.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit b0c08dd5348dfd8098bdb815bb04e7c59dfaea79 Author: Nam Cao Date: Thu Jul 24 19:33:26 2025 +0200 rv: Remove unused field in struct rv_monitor_def rv_monitor_def::task_monitor is not used. Delete it. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/502d94f2696435690a2b1fdbe80a9e56c96fcabf.1753378331.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 75fe230b9bed364d7ddca482ff29979d873718fa Author: Damien Le Moal Date: Fri Jul 25 10:58:18 2025 +0900 scsi: libsas: Use a bool for sas_deform_port() second argument Change the type of the "gone" argument of sas_deform_port() from int to bool. Simliarly, to be consistent, do the same change to the function sas_unregister_domain_devices(). No functional changes. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20250725015818.171252-6-dlemoal@kernel.org Reviewed-by: Johannes Thumshirn Reviewed-by: John Garry Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen commit 704ed03abf6b1c2752a8b16446a5ebf18694fefe Author: Damien Le Moal Date: Fri Jul 25 10:58:17 2025 +0900 scsi: libsas: Move declarations of internal functions to sas_internal.h Move the declaration of all functions used only within libsas from include/scsi/sas_ata.h to drivers/scsi/libsas/sas_internal.h. No functional changes. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20250725015818.171252-5-dlemoal@kernel.org Reviewed-by: Johannes Thumshirn Reviewed-by: John Garry Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen commit bd31394aabf36ee18781c6371e02d789484ffda3 Author: Damien Le Moal Date: Fri Jul 25 10:58:16 2025 +0900 scsi: libsas: Make sas_get_ata_info() static The function sas_get_ata_info() is used only in drivers/scsi/libsas/sas_ata.c. Remove its definition from include/scsi/sas_ata.h and make this function static. No functional changes. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20250725015818.171252-4-dlemoal@kernel.org Reviewed-by: Johannes Thumshirn Reviewed-by: John Garry Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen commit 0dd03570512a305bc44ac9c8326da95dd8fc3a1d Author: Damien Le Moal Date: Fri Jul 25 10:58:15 2025 +0900 scsi: libsas: Simplify sas_ata_wait_eh() Simplify the code of sas_ata_wait_eh(), removing the local variable ap for the pointer to the device ata_port structure. The test using dev_is_sata() is also removed as all call sites of this function check if the device is a SATA one before calling this function. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20250725015818.171252-3-dlemoal@kernel.org Reviewed-by: John Garry Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen commit 54091eee08acebfb5e971611c3f189e7577a1058 Author: Damien Le Moal Date: Fri Jul 25 10:58:14 2025 +0900 scsi: libsas: Refactor dev_is_sata() Use a switch statement in dev_is_sata() to make the code more readable (and probably slightly better than a series of or conditions). Also have this inline function return a boolean instead of an integer. No functional changes. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20250725015818.171252-2-dlemoal@kernel.org Reviewed-by: John Garry Reviewed-by: Jason Yan Signed-off-by: Martin K. Petersen commit 8e48727c26c4d839ff9b4b73d1cae486bea7fe19 Author: Salomon Dushimirimana Date: Thu Jul 24 21:45:20 2025 +0000 scsi: sd: Make sd shutdown issue START STOP UNIT appropriately Commit aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop") enabled libata EH to manage device power mode trasitions for system suspend/resume and removed the flag from ata_scsi_dev_config. However, since the sd_shutdown() function still relies on the manage_system_start_stop flag, a spin-down command is not issued to the disk with command "echo 1 > /sys/block/sdb/device/delete" sd_shutdown() can be called for both system/runtime start stop operations, so utilize the manage_run_time_start_stop flag set in the ata_scsi_dev_config and issue a spin-down command during disk removal when the system is running. This is in addition to when the system is powering off and manage_shutdown flag is set. The manage_system_start_stop flag will still be used for drivers that still set the flag. Fixes: aa3998dbeb3a ("ata: libata-scsi: Disable scsi device manage_system_start_stop") Signed-off-by: Salomon Dushimirimana Link: https://lore.kernel.org/r/20250724214520.112927-1-salomondush@google.com Tested-by: Damien Le Moal Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit 43cf0e05089afe23dac74fa6e1e109d49f2903c4 Author: Steven Rostedt Date: Thu Jun 12 10:12:59 2025 -0400 powerpc/thp: tracing: Hide hugepage events under CONFIG_PPC_BOOK3S_64 The events hugepage_set_pmd, hugepage_set_pud, hugepage_update_pmd and hugepage_update_pud are only called when CONFIG_PPC_BOOK3S_64 is defined. As each event can take up to 5K regardless if they are used or not, it's best not to define them when they are not used. Add #ifdef around these events when they are not used. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Michael Ellerman Link: https://lore.kernel.org/20250612101259.0ad43e48@batman.local.home Acked-by: David Hildenbrand Acked-by: Madhavan Srinivasan Signed-off-by: Steven Rostedt (Google) commit 87aa3c8d8c4aa2e2567fe04126d14eb9fde815e5 Author: Jakub Czapiga Date: Fri Jul 25 12:25:42 2025 +0000 spi: intel: Allow writeable MTD partition with module param The MTD device is blocked from writing to the SPI-NOR chip if any region of it is write-protected, even if "writeable=1" module parameter is set. Add ability to bypass this behaviour by introducing new module parameter "ignore_protestion_status" which allows to rely on the write protection mechanism of SPI-NOR chip itself, which most modern chips (since the 1990'+) have already implemented. Any erase/write operations performed on the write-protected section will be rejected by the chip. Signed-off-by: Jakub Czapiga Link: https://patch.msgid.link/20250725122542.2633334-1-czapiga@google.com Signed-off-by: Mark Brown commit ffc72771ff6ec9f5b431a86c4b00d8ef0fea958b Author: Wolfram Sang Date: Fri Jul 25 13:03:27 2025 +0200 regmap: Annotate that MMIO implies fast IO Document that using the MMIO helpers will automatically enable the 'fast_io' parameter. This makes the used locking scheme more transparent and avoids superfluous setting of this parameter in drivers. Signed-off-by: Wolfram Sang Link: https://patch.msgid.link/20250725110337.4303-2-wsa+renesas@sang-engineering.com Signed-off-by: Mark Brown commit e95122a32e777309412e30dc638dbc88b9036811 Author: Weidong Wang Date: Fri Jul 25 17:46:02 2025 +0800 ASoC: codecs: Add acpi_match_table for aw88399 driver Add acpi_match_table to the aw88399 driver so that it can be used on more platforms. Signed-off-by: Weidong Wang Link: https://patch.msgid.link/20250725094602.10017-1-wangweidong.a@awinic.com Signed-off-by: Mark Brown commit 5989bfe6ac6bf230c2c84e118c786be0ed4be3f4 Author: Nilay Shroff Date: Thu Jul 24 15:31:51 2025 +0530 block: restore two stage elevator switch while running nr_hw_queue update The kmemleak reports memory leaks related to elevator resources that were originally allocated in the ->init_hctx() method. The following leak traces are observed after running blktests block/040: unreferenced object 0xffff8881b82f7400 (size 512): comm "check", pid 68454, jiffies 4310588881 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 5bac8b34): __kvmalloc_node_noprof+0x55d/0x7a0 sbitmap_init_node+0x15a/0x6a0 kyber_init_hctx+0x316/0xb90 blk_mq_init_sched+0x419/0x580 elevator_switch+0x18b/0x630 elv_update_nr_hw_queues+0x219/0x2c0 __blk_mq_update_nr_hw_queues+0x36a/0x6f0 blk_mq_update_nr_hw_queues+0x3a/0x60 0xffffffffc09ceb80 0xffffffffc09d7e0b configfs_write_iter+0x2b1/0x470 vfs_write+0x527/0xe70 ksys_write+0xff/0x200 do_syscall_64+0x98/0x3c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e unreferenced object 0xffff8881b82f6000 (size 512): comm "check", pid 68454, jiffies 4310588881 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 5bac8b34): __kvmalloc_node_noprof+0x55d/0x7a0 sbitmap_init_node+0x15a/0x6a0 kyber_init_hctx+0x316/0xb90 blk_mq_init_sched+0x419/0x580 elevator_switch+0x18b/0x630 elv_update_nr_hw_queues+0x219/0x2c0 __blk_mq_update_nr_hw_queues+0x36a/0x6f0 blk_mq_update_nr_hw_queues+0x3a/0x60 0xffffffffc09ceb80 0xffffffffc09d7e0b configfs_write_iter+0x2b1/0x470 vfs_write+0x527/0xe70 ksys_write+0xff/0x200 do_syscall_64+0x98/0x3c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e unreferenced object 0xffff8881b82f5800 (size 512): comm "check", pid 68454, jiffies 4310588881 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace (crc 5bac8b34): __kvmalloc_node_noprof+0x55d/0x7a0 sbitmap_init_node+0x15a/0x6a0 kyber_init_hctx+0x316/0xb90 blk_mq_init_sched+0x419/0x580 elevator_switch+0x18b/0x630 elv_update_nr_hw_queues+0x219/0x2c0 __blk_mq_update_nr_hw_queues+0x36a/0x6f0 blk_mq_update_nr_hw_queues+0x3a/0x60 0xffffffffc09ceb80 0xffffffffc09d7e0b configfs_write_iter+0x2b1/0x470 vfs_write+0x527/0xe70 ksys_write+0xff/0x200 do_syscall_64+0x98/0x3c0 entry_SYSCALL_64_after_hwframe+0x76/0x7e The issue arises while we run nr_hw_queue update, Specifically, we first reallocate hardware contexts (hctx) via __blk_mq_realloc_hw_ctxs(), and then later invoke elevator_switch() (assuming q->elevator is not NULL). The elevator switch code would first exit old elevator (elevator_exit) and then switches to the new elevator. The elevator_exit loops through each hctx and invokes the elevator’s per-hctx exit method ->exit_hctx(), which releases resources allocated during ->init_hctx(). This memleak manifests when we reduce the num of h/w queues - for example, when the initial update sets the number of queues to X, and a later update reduces it to Y, where Y < X. In this case, we'd loose the access to old hctxs while we get to elevator exit code because __blk_mq_realloc_hw_ctxs would have already released the old hctxs. As we don't now have any reference left to the old hctxs, we don't have any way to free the scheduler resources (which are allocate in ->init_hctx()) and kmemleak complains about it. This issue was caused due to the commit 596dce110b7d ("block: simplify elevator reattachment for updating nr_hw_queues"). That change unified the two-stage elevator teardown and reattachment into a single call that occurs after __blk_mq_realloc_hw_ctxs() has already freed the hctxs. This patch restores the previous two-stage elevator switch logic during nr_hw_queues updates. First, the elevator is switched to 'none', which ensures all scheduler resources are properly freed. Then, the hardware contexts (hctxs) are reallocated, and the software-to-hardware queue mappings are updated. Finally, the original elevator is reattached. This sequence prevents loss of references to old hctxs and avoids the scheduler resource leaks reported by kmemleak. Reported-by : Yi Zhang Fixes: 596dce110b7d ("block: simplify elevator reattachment for updating nr_hw_queues") Closes: https://lore.kernel.org/all/CAHj4cs8oJFvz=daCvjHM5dYCNQH4UXwSySPPU4v-WHce_kZXZA@mail.gmail.com/ Signed-off-by: Nilay Shroff Reviewed-by: Yu Kuai Link: https://lore.kernel.org/r/20250724102540.1366308-1-nilay@linux.ibm.com Signed-off-by: Jens Axboe commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd Author: Alan Stern Date: Wed Jul 23 10:37:04 2025 -0400 HID: core: Harden s32ton() against conversion to 0 bits Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does. Signed-off-by: Alan Stern Reported-by: syzbot+b63d677d63bcac06cf90@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/68753a08.050a0220.33d347.0008.GAE@google.com/ Tested-by: syzbot+b63d677d63bcac06cf90@syzkaller.appspotmail.com Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/613a66cd-4309-4bce-a4f7-2905f9bce0c9@rowland.harvard.edu Signed-off-by: Benjamin Tissoires commit 2db7a52ca9ed89cd0f762b21f79266f02d613fae Author: Luis Felipe Hernandez Date: Mon Jul 21 23:53:52 2025 -0400 docs: Fix kernel-doc error in CAN driver Fix kernel-doc formatting issue causing unexpected indentation error in ctucanfd driver documentation build. Convert main return values to bullet list format while preserving numbered sub-list in order to correct indentation error and visual structure in rendered html. Signed-off-by: Luis Felipe Hernandez Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Vincent Mailhol Reviewed-by: Pavel Pisa Link: https://patch.msgid.link/20250722035352.21807-1-luis.hernandez093@gmail.com Signed-off-by: Marc Kleine-Budde commit b7d012e59627c1d1bb2ad5d71efc69a070ef767d Author: Randy Dunlap Date: Sun Jul 20 17:28:23 2025 -0700 can: tscan1: CAN_TSCAN1 can depend on PC104 Add a dependency on PC104 to limit (restrict) this driver kconfig prompt to kernel configs that have PC104 set. Add COMPILE_TEST as a possibility for more complete build coverage. I tested this build config on x86_64 5 times without problems. Signed-off-by: Randy Dunlap Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/20250721002823.3548945-1-rdunlap@infradead.org [mkl: fix conflict, remove Fixes: tag] Signed-off-by: Marc Kleine-Budde commit 788199b73b6efe4ee2ade4d7457b50bb45493488 Author: Stephane Grosjean Date: Thu Jul 24 10:13:19 2025 +0200 can: peak_usb: fix USB FD devices potential malfunction The latest firmware versions of USB CAN FD interfaces export the EP numbers to be used to dialog with the device via the "type" field of a response to a vendor request structure, particularly when its value is greater than or equal to 2. Correct the driver's test of this field. Fixes: 4f232482467a ("can: peak_usb: include support for a new MCU") Signed-off-by: Stephane Grosjean Link: https://patch.msgid.link/20250724081550.11694-1-stephane.grosjean@free.fr Reviewed-by: Vincent Mailhol [mkl: rephrase commit message] Signed-off-by: Marc Kleine-Budde commit 51d4b0a44c82e5eff056ef76acd2c3c605a8eb74 Author: Johan Hovold Date: Thu Jul 24 11:19:10 2025 +0200 usb: musb: omap2430: clean up probe error handling Using numbered error labels is discouraged (e.g. as it requires renumbering them when adding a new intermediate error path). Rename the error labels after what they do. While at it, drop the redundant platform allocation failure dev_err() as the error would already have been logged by the allocator. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250724091910.21092-6-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 1473e9e7679bd4f5a62d1abccae894fb86de280f Author: Johan Hovold Date: Thu Jul 24 11:19:09 2025 +0200 usb: musb: omap2430: fix device leak at unbind Make sure to drop the reference to the control device taken by of_find_device_by_node() during probe when the driver is unbound. Fixes: 8934d3e4d0e7 ("usb: musb: omap2430: Don't use omap_get_control_dev()") Cc: stable@vger.kernel.org # 3.13 Cc: Roger Quadros Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250724091910.21092-5-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 868837b0a94c6b1b1fdbc04d3ba218ca83432393 Author: Johan Hovold Date: Thu Jul 24 11:19:08 2025 +0200 usb: gadget: udc: renesas_usb3: fix device leak at unbind Make sure to drop the reference to the companion device taken during probe when the driver is unbound. Fixes: 39facfa01c9f ("usb: gadget: udc: renesas_usb3: Add register of usb role switch") Cc: stable@vger.kernel.org # 4.19 Cc: Yoshihiro Shimoda Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250724091910.21092-4-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 93b400f4951404d040197943a25d6fef9f8ccabb Author: Johan Hovold Date: Thu Jul 24 11:19:07 2025 +0200 usb: dwc3: meson-g12a: fix device leaks at unbind Make sure to drop the references taken to the child devices by of_find_device_by_node() during probe on driver unbind. Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue") Cc: stable@vger.kernel.org # 5.2 Cc: Neil Armstrong Signed-off-by: Johan Hovold Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/r/20250724091910.21092-3-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 086a0e516f7b3844e6328a5c69e2708b66b0ce18 Author: Johan Hovold Date: Thu Jul 24 11:19:06 2025 +0200 usb: dwc3: imx8mp: fix device leak at unbind Make sure to drop the reference to the dwc3 device taken by of_find_device_by_node() on probe errors and on driver unbind. Fixes: 6dd2565989b4 ("usb: dwc3: add imx8mp dwc3 glue layer driver") Cc: stable@vger.kernel.org # 5.12 Cc: Li Jun Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250724091910.21092-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 22fcf88b02e262d3b41215ebc70912b0482aef95 Author: Johan Hovold Date: Thu Jul 24 11:21:04 2025 +0200 usb: musb: omap2430: enable compile testing Nothing seems to prevent the driver from being compile tested on non-OMAP platforms so enable it to provide wider build coverage. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250724092104.21317-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7b4b5591d4551efe16fe4fed00f69db5d4e8a2b4 Author: Johan Hovold Date: Thu Jul 24 11:20:06 2025 +0200 usb: gadget: udc: renesas_usb3: drop unused module alias Since commit f3323cd03e58 ("usb: gadget: udc: renesas_usb3: remove R-Car H3 ES1.* handling") the driver only supports OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250724092006.21216-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7919407eca2ef562fa6c98c41cfdf6f6cdd69d92 Author: Su Hui Date: Fri Jul 25 14:01:18 2025 +0800 usb: xhci: print xhci->xhc_state when queue_command failed When encounters some errors like these: xhci_hcd 0000:4a:00.2: xHCI dying or halted, can't queue_command xhci_hcd 0000:4a:00.2: FIXME: allocate a command ring segment usb usb5-port6: couldn't allocate usb_device It's hard to know whether xhc_state is dying or halted. So it's better to print xhc_state's value which can help locate the resaon of the bug. Signed-off-by: Su Hui Link: https://lore.kernel.org/r/20250725060117.1773770-1-suhui@nfschina.com Signed-off-by: Greg Kroah-Hartman commit 672820a070ea5e6ae114f6109726a4e18313a527 Author: Antonio Quartulli Date: Mon Jul 21 22:38:21 2025 +0200 ovl: properly print correct variable In case of ovl_lookup_temp() failure, we currently print `err` which is actually not initialized at all. Instead, properly print PTR_ERR(whiteout) which is where the actual error really is. Address-Coverity-ID: 1647983 ("Uninitialized variables (UNINIT)") Fixes: 8afa0a7367138 ("ovl: narrow locking in ovl_whiteout()") Signed-off-by: Antonio Quartulli Link: https://lore.kernel.org/20250721203821.7812-1-antonio@mandelbit.com Reviewed-by: NeilBrown Signed-off-by: Christian Brauner commit 4740e1e2f320061c2f0dbadc0dd3dfb58df986d5 Author: Harald Mommer Date: Thu Jul 24 16:36:53 2025 +0200 gpio: virtio: Fix config space reading. Quote from the virtio specification chapter 4.2.2.2: "For the device-specific configuration space, the driver MUST use 8 bit wide accesses for 8 bit wide fields, 16 bit wide and aligned accesses for 16 bit wide fields and 32 bit wide and aligned accesses for 32 and 64 bit wide fields." Signed-off-by: Harald Mommer Cc: stable@vger.kernel.org Fixes: 3a29355a22c0 ("gpio: Add virtio-gpio driver") Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20250724143718.5442-2-harald.mommer@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 4f8ff9486fd94b9d6a4932f2aefb9f2fc3bd0cf6 Author: Namjae Jeon Date: Fri Jul 25 10:33:28 2025 +0900 ksmbd: fix corrupted mtime and ctime in smb2_open If STATX_BASIC_STATS flags are not given as an argument to vfs_getattr, It can not get ctime and mtime in kstat. This causes a problem showing mtime and ctime outdated from cifs.ko. File: /xfstest.test/foo Size: 4096 Blocks: 8 IO Block: 1048576 regular file Device: 0,65 Inode: 2033391 Links: 1 Access: (0755/-rwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root) Context: system_u:object_r:cifs_t:s0 Access: 2025-07-23 22:15:30.136051900 +0100 Modify: 1970-01-01 01:00:00.000000000 +0100 Change: 1970-01-01 01:00:00.000000000 +0100 Birth: 2025-07-23 22:15:30.136051900 +0100 Cc: stable@vger.kernel.org Reported-by: David Howells Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 44a3059c4c8cc635a1fb2afd692d0730ca1ba4b6 Author: Namjae Jeon Date: Fri Jul 25 08:13:31 2025 +0900 ksmbd: fix Preauh_HashValue race condition If client send multiple session setup requests to ksmbd, Preauh_HashValue race condition could happen. There is no need to free sess->Preauh_HashValue at session setup phase. It can be freed together with session at connection termination phase. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-27661 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit ecd9d6bf88ddd64e3dc7beb9a065fd5fa4714f72 Author: Namjae Jeon Date: Mon Jul 21 14:29:43 2025 +0900 ksmbd: check return value of xa_store() in krb5_authenticate xa_store() may fail so check its return value and return error code if error occurred. Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit 9b493ab6f35178afd8d619800df9071992f715de Author: Namjae Jeon Date: Mon Jul 21 14:28:55 2025 +0900 ksmbd: fix null pointer dereference error in generate_encryptionkey If client send two session setups with krb5 authenticate to ksmbd, null pointer dereference error in generate_encryptionkey could happen. sess->Preauth_HashValue is set to NULL if session is valid. So this patch skip generate encryption key if session is valid. Cc: stable@vger.kernel.org Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-27654 Signed-off-by: Namjae Jeon Signed-off-by: Steve French commit a28f98103890403717008a3a016744721f87b03e Author: Rice Lee Date: Tue Jul 22 16:57:20 2025 +0800 scsi: arm64: dts: mediatek: mt8195: Add UFSHCI node Add a UFS host controller interface (UFSHCI) node to mt8195.dtsi. Introduce the 'mediatek,ufs-disable-mcq' property to allow disabling Multiple Circular Queue (MCQ) support. Signed-off-by: Rice Lee Signed-off-by: Eric Lin Signed-off-by: Macpaul Lin Link: https://lore.kernel.org/r/20250722085721.2062657-4-macpaul.lin@mediatek.com Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit d01cfeac89e956b74e17dc9b1c8e10c0d3b4e403 Author: Macpaul Lin Date: Tue Jul 22 16:57:19 2025 +0800 scsi: dt-bindings: mediatek,ufs: add MT8195 compatible and update clock nodes Add MT8195 UFSHCI compatible string. Relax the schema to allow between one to eight clocks/clock-names entries for all MediaTek UFS nodes. Legacy platforms may only need a few clocks, whereas newer devices such as the MT8195 require additional clock-gating domains. For MT8195 specifically, enforce exactly eight clocks and clock-names entries to satisfy its hardware requirements. Signed-off-by: Macpaul Lin Link: https://lore.kernel.org/r/20250722085721.2062657-3-macpaul.lin@mediatek.com Signed-off-by: Martin K. Petersen commit 794ff7a0a6e76af93c5ec09a49b86fe73373ca59 Author: Macpaul Lin Date: Tue Jul 22 16:57:18 2025 +0800 scsi: dt-bindings: mediatek,ufs: Add ufs-disable-mcq flag for UFS host Add the 'mediatek,ufs-disable-mcq' property to the UFS device-tree bindings. This flag corresponds to the UFS_MTK_CAP_DISABLE_MCQ host capability recently introduced in the UFS host driver, allowing it to disable the Multiple Circular Queue (MCQ) feature when present. The binding schema has also been updated to resolve DTBS check errors. Cc: stable@vger.kernel.org Fixes: 46bd3e31d74b ("scsi: ufs: mediatek: Add UFS_MTK_CAP_DISABLE_MCQ") Signed-off-by: Macpaul Lin Link: https://lore.kernel.org/r/20250722085721.2062657-2-macpaul.lin@mediatek.com Reviewed-by: Rob Herring (Arm) Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit 6f1fd3e0279f0b06cd8d53133a25bd83ac0fcb8a Author: Macpaul Lin Date: Tue Jul 22 16:57:17 2025 +0800 scsi: ufs: ufs-mediatek: Add UFS host support for MT8195 SoC Add "mediatek,mt8195-ufshci" to the of_device_id table to enable support for MediaTek MT8195/MT8395 UFS host controller. This matches the device node entry in the MT8195/MT8395 device tree and allows proper driver binding. Signed-off-by: Macpaul Lin Link: https://lore.kernel.org/r/20250722085721.2062657-1-macpaul.lin@mediatek.com Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit aa8c53346e38bc3529f0773ee377efb8ea7b610a Merge: 60feab054bc0b4 22b246e3fc5eb4 Author: Martin K. Petersen Date: Thu Jul 24 22:44:23 2025 -0400 Merge patch series "scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers" Adrian Hunter says: Hi Here is V2 of a couple of fixes for Intel MTL-like UFS host controllers, related to link Hibernation state. Following the fixes are some improvements for the enabling and disabling of UIC Completion interrupts. Link: https://lore.kernel.org/r/20250723165856.145750-1-adrian.hunter@intel.com Conflicts: drivers/ufs/core/ufshcd.c Signed-off-by: Martin K. Petersen commit 22b246e3fc5eb450fffad1eb322e08e3af0e6e3d Author: Adrian Hunter Date: Wed Jul 23 19:58:56 2025 +0300 scsi: ufs: ufs-pci: Remove control of UIC Completion interrupt for Intel MTL Now that UFS core enables the UIC Completion interrupt only when needed, Intel MTL driver no longer needs to control the interrupt itself. So remove the associated code. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20250723165856.145750-9-adrian.hunter@intel.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit d402b20f9c31e477f3cf3512be22c7943dbb0ee4 Author: Adrian Hunter Date: Wed Jul 23 19:58:55 2025 +0300 scsi: ufs: core: Do not write interrupt enable register unnecessarily Write a new value to the interrupt enable register only if it is different from the old value, thereby saving a register write operation. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20250723165856.145750-8-adrian.hunter@intel.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit b4c0cab4eb8d79cf426ac7bca20864881c8b9b8b Author: Adrian Hunter Date: Wed Jul 23 19:58:54 2025 +0300 scsi: ufs: core: Set and clear UIC Completion interrupt as needed Currently the UIC Completion interrupt is left enabled except for when issuing link hibernate commands, in which case the interrupt is disabled and then re-enabled. Instead, set and clear the interrupt enable bit as needed. That is slightly simpler and less error prone, but also avoids side effects of accessing the interrupt enable register after entering link hibernation. Specifically, for some host controllers like Intel MTL, doing so disrupts the link state transition. Note also, the interrupt register is not read back anymore after it is updated. No other code does that, so it is assumed to be no longer necessary if it ever was. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20250723165856.145750-7-adrian.hunter@intel.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit c5977c4c0731b60c8c0b3f7cc4b0082a688a07f8 Author: Adrian Hunter Date: Wed Jul 23 19:58:53 2025 +0300 scsi: ufs: core: Remove duplicated code in ufshcd_send_bsg_uic_cmd() Make ufshcd_send_bsg_uic_cmd() call ufshcd_send_uic_cmd() instead of duplicating its code. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20250723165856.145750-6-adrian.hunter@intel.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 497027eade8c02afdb6c5d21a193ef5cf4a26d0f Author: Adrian Hunter Date: Wed Jul 23 19:58:52 2025 +0300 scsi: ufs: core: Move ufshcd_enable_intr() and ufshcd_disable_intr() Move ufshcd_enable_intr() and ufshcd_disable_intr() so they can be called in subsequent patches without forward declarations. No functional change. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20250723165856.145750-5-adrian.hunter@intel.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 28a60bbbe739c5c895d2d36d23c93045667b4566 Author: Adrian Hunter Date: Wed Jul 23 19:58:51 2025 +0300 scsi: ufs: ufs-pci: Remove UFS PCI driver's ->late_init() call back ->late_init() was introduced to allow the default values for rpm_lvl and spm_lvl to be set. Since commit bb9850704c04 ("scsi: ufs: core: Honor runtime/system PM levels if set by host controller drivers") and commit fe06b7c07f3f ("scsi: ufs: core: Set default runtime/system PM levels before ufshcd_hba_init()"), those default values can be set in the ->init() variant call back. Move the setting of default values for rpm_lvl and spm_lvl to ->init() and remove ->late_init(). Reviewed-by: Bart Van Assche Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20250723165856.145750-4-adrian.hunter@intel.com Signed-off-by: Martin K. Petersen commit 6de7435e6b81fe52c0ab4c7e181f6b5decd18eb1 Author: Adrian Hunter Date: Wed Jul 23 19:58:50 2025 +0300 scsi: ufs: ufs-pci: Fix default runtime and system PM levels Intel MTL-like host controllers support auto-hibernate. Using auto-hibernate with manual (driver initiated) hibernate produces more complex operation. For example, the host controller will have to exit auto-hibernate simply to allow the driver to enter hibernate state manually. That is not recommended. The default rpm_lvl and spm_lvl is 3, which includes manual hibernate. Change the default values to 2, which does not. Note, to be simpler to backport to stable kernels, utilize the UFS PCI driver's ->late_init() call back. Recent commits have made it possible to set up a controller-specific default in the regular ->init() call back, but not all stable kernels have those changes. Fixes: 4049f7acef3e ("scsi: ufs: ufs-pci: Add support for Intel MTL") Cc: stable@vger.kernel.org Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20250723165856.145750-3-adrian.hunter@intel.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 4428ddea832cfdb63e476eb2e5c8feb5d36057fe Author: Archana Patni Date: Wed Jul 23 19:58:49 2025 +0300 scsi: ufs: ufs-pci: Fix hibernate state transition for Intel MTL-like host controllers UFSHCD core disables the UIC completion interrupt when issuing UIC hibernation commands, and re-enables it afterwards if it was enabled to start with, refer ufshcd_uic_pwr_ctrl(). For Intel MTL-like host controllers, accessing the register to re-enable the interrupt disrupts the state transition. Use hibern8_notify variant operation to disable the interrupt during the entire hibernation, thereby preventing the disruption. Fixes: 4049f7acef3e ("scsi: ufs: ufs-pci: Add support for Intel MTL") Cc: stable@vger.kernel.org Signed-off-by: Archana Patni Link: https://lore.kernel.org/r/20250723165856.145750-2-adrian.hunter@intel.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit c60b95389d0206a3a3c087c09113315e7084be3f Author: Akhilesh Patil Date: Wed Jul 23 10:59:56 2025 +0530 clk: spacemit: ccu_pll: fix error return value in recalc_rate callback Return 0 instead of -EINVAL if function ccu_pll_recalc_rate() fails to get correct rate entry. Follow .recalc_rate callback documentation as mentioned in include/linux/clk-provider.h for error return value. Signed-off-by: Akhilesh Patil Fixes: 1b72c59db0add ("clk: spacemit: Add clock support for SpacemiT K1 SoC") Reviewed-by: Haylen Chu Reviewed-by: Alex Elder Link: https://lore.kernel.org/r/aIBzVClNQOBrjIFG@bhairav-test.ee.iitb.ac.in Signed-off-by: Stephen Boyd commit 60feab054bc0b45d40f80d81c2854aa2ef1e920c Merge: 51b6f738ebfafb 5e5976f5242de6 Author: Martin K. Petersen Date: Thu Jul 24 22:25:40 2025 -0400 Merge patch series "ufs: host: mediatek: Provide features and fixes in MediaTek platforms" peter.wang@mediatek.com says: This series fixes some defects and provide features in MediaTek UFS drivers. Link: https://lore.kernel.org/r/20250722030841.1998783-1-peter.wang@mediatek.com Signed-off-by: Martin K. Petersen commit 5e5976f5242de61b9c09c32795b3d7b90364af51 Author: Peter Wang Date: Tue Jul 22 11:07:24 2025 +0800 scsi: ufs: host: mediatek: Support FDE (AES) clock scaling Add support for scaling the FDE (AES) clock to achieve higher performance, particularly for HS-G5: 1. Parse DTS settings for FDE min/max mux. 2. Scale up the FDE clock when required for enhanced performance. These changes ensure that the FDE clock can be dynamically adjusted based on performance needs, leveraging DTS configurations. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250722030841.1998783-10-peter.wang@mediatek.com Reviewed-by: Chun-Hung Wu Signed-off-by: Martin K. Petersen commit 31a20e9f7c766896fbfea45897969bfd1490b466 Author: Peter Wang Date: Tue Jul 22 11:07:23 2025 +0800 scsi: ufs: host: mediatek: Support clock scaling with Vcore binding Add support for clock scaling with Vcore binding: 1. Parse the DTS setting for Vcore voltage. 2. Set the Vcore voltage to the DTS-specified value before scaling up. 3. Reset the Vcore voltage to the default setting after scaling down. These changes ensure that the Vcore voltage is appropriately managed during clock scaling operations to maintain system stability and performance. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250722030841.1998783-9-peter.wang@mediatek.com Reviewed-by: Chun-Hung Wu Signed-off-by: Martin K. Petersen commit ff40f31216fffc1b7f7e5a9e27a317a29a798289 Author: Peter Wang Date: Tue Jul 22 11:07:22 2025 +0800 scsi: ufs: host: mediatek: Add clock scaling query function Introduce a clock scaling readiness query function to streamline the process of checking clock scaling parameters. This function simplifies the code by encapsulating the logic for determining if clock scaling is ready. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250722030841.1998783-8-peter.wang@mediatek.com Reviewed-by: Chun-Hung Wu Signed-off-by: Martin K. Petersen commit 7996746394df569355113ce4643ab892442cfe1d Author: Alice Chao Date: Tue Jul 22 11:07:21 2025 +0800 scsi: ufs: host: mediatek: Add more UFSCHI hardware versions Introduce a function for version control to distinguish between new and old platforms. Update the handling of hardware IP versions, ensuring correct version comparisons by adjusting the version format for specific projects. Signed-off-by: Alice Chao Link: https://lore.kernel.org/r/20250722030841.1998783-7-peter.wang@mediatek.com Reviewed-by: Peter Wang Reviewed-by: Chun-Hung Wu Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit 66e26a4b8a7793137551e77a7e9f6eb1263a49c2 Author: Peter Wang Date: Tue Jul 22 11:07:20 2025 +0800 scsi: ufs: host: mediatek: Set IRQ affinity policy for MCQ mode Set the IRQ affinity for MCQ mode to improve performance. Specifically, it migrates the IRQ from CPU0 to CPU3 to enhance IRQ handling efficiency. Setting IRQ affinity directly from the kernel allows the configuration to take effect earlier, and provides greater security and consistency, especially important for systems with strict performanceor real-time requirements. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250722030841.1998783-6-peter.wang@mediatek.com Reviewed-by: Chun-Hung Wu Signed-off-by: Martin K. Petersen commit a44ff97f895bd8615ebb53e6e199b74152c18bba Author: Peter Wang Date: Tue Jul 22 11:07:19 2025 +0800 scsi: ufs: host: mediatek: Handle broken RTC based on DTS setting Introduce a mechanism to handle broken RTC by checking the DTS setting. The configuration is specifically required for legacy platform. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250722030841.1998783-5-peter.wang@mediatek.com Reviewed-by: Chun-Hung Wu Signed-off-by: Martin K. Petersen commit 16b30c7a4c564e80fefe7e6416320f4f5b776d60 Author: Peter Wang Date: Tue Jul 22 11:07:18 2025 +0800 scsi: ufs: host: mediatek: Change ref-clk timeout policy Update the timeout policy for ref-clk control. - If a clock-on operation times out, it is assumed that the clock is off. The system will notify TFA to perform clock-off settings. - If a clock-off operation times out, it is assumed that the clock will eventually turn off. The 'ref_clk_enabled' flag is set directly. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250722030841.1998783-4-peter.wang@mediatek.com Reviewed-by: Chun-Hung Wu Signed-off-by: Martin K. Petersen commit a84a9ba7888fabc00c9585a0626343dfd5538d59 Author: Naomi Chu Date: Tue Jul 22 11:07:17 2025 +0800 scsi: ufs: host: mediatek: Add DDR_EN setting On MT6989 and later platforms, control of DDR_EN has been switched from SPM to EMI. To prevent abnormal access to DRAM, it is necessary to wait for 'ddren_ack' or assert 'ddren_urgent' after sending 'ddren_req'. Introduce the DDR_EN configuration in the UFS initialization flow, utilizing the assertion of 'ddren_urgent' to maintain performance. Signed-off-by: Naomi Chu Link: https://lore.kernel.org/r/20250722030841.1998783-3-peter.wang@mediatek.com Reviewed-by: Peter Wang Reviewed-by: Chun-Hung Wu Signed-off-by: Peter Wang Signed-off-by: Martin K. Petersen commit 262893939604204d14d7621b6d2658199d1672bb Author: Peter Wang Date: Tue Jul 22 11:07:16 2025 +0800 scsi: ufs: host: mediatek: Simplify boolean conversion Simplify the conversion from unsigned int to boolean by removing explicit conversions and parentheses, relying on implicit conversion instead. This change ensures consistency with other usages in ufs-mediatek.c and streamlines the code. Signed-off-by: Peter Wang Link: https://lore.kernel.org/r/20250722030841.1998783-2-peter.wang@mediatek.com Reviewed-by: Chun-Hung Wu Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 45cd52c44e85453c9147d41b715cd03c53325cf4 Author: Matthew Wilcox (Oracle) Date: Mon Jul 21 21:46:18 2025 +0100 mm: remove grab_cache_page() All callers have been converted to use filemap_grab_folio(). Link: https://lkml.kernel.org/r/20250721204619.163883-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 7e6c3130690a01076efdf45aa02ba5d5c16849a0 Author: SeongJae Park Date: Sun Jul 20 11:58:22 2025 -0700 mm/damon/ops-common: ignore migration request to invalid nodes damon_migrate_pages() tries migration even if the target node is invalid. If users mistakenly make such invalid requests via DAMOS_MIGRATE_{HOT,COLD} action, the below kernel BUG can happen. [ 7831.883495] BUG: unable to handle page fault for address: 0000000000001f48 [ 7831.884160] #PF: supervisor read access in kernel mode [ 7831.884681] #PF: error_code(0x0000) - not-present page [ 7831.885203] PGD 0 P4D 0 [ 7831.885468] Oops: Oops: 0000 [#1] SMP PTI [ 7831.885852] CPU: 31 UID: 0 PID: 94202 Comm: kdamond.0 Not tainted 6.16.0-rc5-mm-new-damon+ #93 PREEMPT(voluntary) [ 7831.886913] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-4.el9 04/01/2014 [ 7831.887777] RIP: 0010:__alloc_frozen_pages_noprof (include/linux/mmzone.h:1724 include/linux/mmzone.h:1750 mm/page_alloc.c:4936 mm/page_alloc.c:5137) [...] [ 7831.895953] Call Trace: [ 7831.896195] [ 7831.896397] __folio_alloc_noprof (mm/page_alloc.c:5183 mm/page_alloc.c:5192) [ 7831.896787] migrate_pages_batch (mm/migrate.c:1189 mm/migrate.c:1851) [ 7831.897228] ? __pfx_alloc_migration_target (mm/migrate.c:2137) [ 7831.897735] migrate_pages (mm/migrate.c:2078) [ 7831.898141] ? __pfx_alloc_migration_target (mm/migrate.c:2137) [ 7831.898664] damon_migrate_folio_list (mm/damon/ops-common.c:321 mm/damon/ops-common.c:354) [ 7831.899140] damon_migrate_pages (mm/damon/ops-common.c:405) [...] Add a target node validity check in damon_migrate_pages(). The validity check is stolen from that of do_pages_move(), which is being used for the move_pages() system call. Link: https://lkml.kernel.org/r/20250720185822.1451-1-sj@kernel.org Fixes: b51820ebea65 ("mm/damon/paddr: introduce DAMOS_MIGRATE_COLD action for demotion") [6.11.x] Signed-off-by: SeongJae Park Reviewed-by: Joshua Hahn Cc: Honggyu Kim Cc: Hyeongtak Ji Cc: Signed-off-by: Andrew Morton commit a27848a03504f140ea14b6b0f711c1a7c722f698 Author: Lorenzo Stoakes Date: Mon Jul 21 16:55:30 2025 +0100 docs: update THP documentation to clarify sysfs "never" setting Rather confusingly, setting all Transparent Huge Page sysfs settings to "never" does not in fact result in THP being globally disabled. Rather, it results in khugepaged being disabled, but one can still obtain THP pages using madvise(..., MADV_COLLAPSE). This is something that has remained poorly documented for some time, and it is likely the received wisdom of most users of THP that never does, in fact, mean never. It is therefore important to highlight, very clearly, that this is not the case. [lorenzo.stoakes@oracle.com: update transhuge page to mention MADV_COLLAPSE] Link: https://lkml.kernel.org/r/d54d1dfb-f06d-4979-983b-73998f05867e@lucifer.local Link: https://lkml.kernel.org/r/20250721155530.75944-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: SeongJae Park Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Reviewed-by: Barry Song Acked-by: David Hildenbrand Cc: Dev Jain Cc: Jonathan Corbet Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 7d6597dfef1183b2c198151c2740c4d9c73d3dfc Author: Lorenzo Stoakes Date: Mon Jul 21 18:33:27 2025 +0100 tools/testing/selftests: explicitly test split multi VMA mremap move Check that moving a range of VMAs where we are offset into the first and last VMAs works correctly. This results in the VMAs being split at these points at which we are offset into VMAs. We explicitly test both the ordinary MREMAP_FIXED multi VMA move case and the MREMAP_DONTUNMAP multi VMA move case. Link: https://lkml.kernel.org/r/b04920bb6c09dc86c207c251eab8ec670fbbcaef.1753119043.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7062387ed690f76fd486963663f2c7c8d5762764 Author: Lorenzo Stoakes Date: Mon Jul 21 18:33:26 2025 +0100 tools/testing/selftests: test MREMAP_DONTUNMAP on multiple VMA move We support MREMAP_MAYMOVE | MREMAP_FIXED | MREMAP_DONTUNMAP for moving multiple VMAs via mremap(), so assert that the tests pass with both MREMAP_DONTUNMAP set and not set. Additionally, add success = false settings when mremap() fails. This is something that cannot realistically happen, so in no way impacted test outcome, but it is incorrect to indicate a test pass when something has failed. Link: https://lkml.kernel.org/r/d7359941981e4e44c774753b3e364d1c54928e6a.1753119043.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 10aed7dac451850a8e18128ee90222ab67d8a7e5 Author: Lorenzo Stoakes Date: Mon Jul 21 18:33:25 2025 +0100 tools/testing/selftests: add mremap() shrink test for multiple VMAs Patch series "tools/testing: expand mremap testing". Expand our mremap() testing to further assert that behaviour is as expected. There is a poorly documented mremap() feature whereby it is possible to mremap() multiple VMAs (even with gaps) when shrinking, as long as the resultant shrunk range spans only a single VMA. So we start by asserting this behaviour functions correctly both with an in-place shrink and a shrink/move. Next, we further test the newly introduced ability to mremap() multiple VMAs when performing a MAP_FIXED move (that is without the size being changed), firstly by asserting that MREMAP_DONTUNMAP has no bearing on this behaviour. Finally, we explicitly test that such moves, when splitting source VMAs, function correctly. This patch (of 3): There is an apparently little-known feature of mremap() whereby, in stark contrast to other modes (other than the recently introduced capacity to move multiple VMAs), the input source range span multiple VMAs with gaps between. This is, when shrinking a VMA, whether moving it or not, and the shrink would reduce the range to a single VMA - this is permitted, as the shrink is actioned by an unmap. This patch adds tests to assert that this behaves as expected. Link: https://lkml.kernel.org/r/cover.1753119043.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/f08122893a26092a2bec6e69443e87f468ffdbed.1753119043.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 6f1cc9fb476941f9cf8ac7ca0d8343b425b1446d Author: wang lian Date: Thu Jul 17 21:18:57 2025 +0800 selftests/mm: guard-regions: Use SKIP() instead of ksft_exit_skip() To ensure only the current test is skipped on permission failure, instead of terminating the entire test binary. Link: https://lkml.kernel.org/r/20250717131857.59909-3-lianux.mm@gmail.com Signed-off-by: wang lian Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Mark Brown Reviewed-by: Zi Yan Reviewed-by: Wei Yang Cc: Christian Brauner Cc: Jann Horn Cc: Kairui Song Cc: Liam Howlett Cc: SeongJae Park Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3f6bfd4789a0f396b8c0dfb8713c1f3eeed3b2d7 Author: wang lian Date: Thu Jul 17 21:18:56 2025 +0800 selftests/mm: reuse FORCE_READ to replace "asm volatile("" : "+r" (XXX));" Patch series "selftests/mm: reuse FORCE_READ to replace "asm volatile("" : "+r" (XXX));" and some cleanup", v2. This series introduces a common FORCE_READ() macro to replace the cryptic asm volatile("" : "+r" (variable)); construct used in several mm selftests. This improves code readability and maintainability by removing duplicated, hard-to-understand code. This patch (of 2): Several mm selftests use the `asm volatile("" : "+r" (variable));` construct to force a read of a variable, preventing the compiler from optimizing away the memory access. This idiom is cryptic and duplicated across multiple test files. Following a suggestion from David[1], this patch refactors this common pattern into a FORCE_READ() macro Link: https://lkml.kernel.org/r/20250717131857.59909-1-lianux.mm@gmail.com Link: https://lkml.kernel.org/r/20250717131857.59909-2-lianux.mm@gmail.com Link: https://lore.kernel.org/lkml/4a3e0759-caa1-4cfa-bc3f-402593f1eee3@redhat.com/ [1] Signed-off-by: wang lian Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Wei Yang Cc: Christian Brauner Cc: Jann Horn Cc: Kairui Song Cc: Liam Howlett Cc: Mark Brown Cc: SeongJae Park Cc: Shuah Khan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7efa1cd5f89b53e15659f84efb2c7a21076df04f Author: Dev Jain Date: Fri Jul 18 14:32:44 2025 +0530 arm64: add batched versions of ptep_modify_prot_start/commit Override the generic definition of modify_prot_start_ptes() to use get_and_clear_full_ptes(). This helper does a TLBI only for the starting and ending contpte block of the range, whereas the current implementation will call ptep_get_and_clear() for every contpte block, thus doing a TLBI on every contpte block. Therefore, we have a performance win. The arm64 definition of pte_accessible() allows us to batch in the errata specific case: #define pte_accessible(mm, pte) \ (mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid(pte)) All ptes are obviously present in the folio batch, and they are also valid. Override the generic definition of modify_prot_commit_ptes() to simply use set_ptes() to map the new ptes into the pagetable. Link: https://lkml.kernel.org/r/20250718090244.21092-8-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Ryan Roberts Cc: Anshuman Khandual Cc: Barry Song Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jann Horn Cc: Joey Gouly Cc: Kevin Brodsky Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Yicong Yang Cc: Zhenhua Huang Cc: Zi Yan Signed-off-by: Andrew Morton commit cac1db8c3aad97d6ffb56ced8868d6cbbbd2bfbe Author: Dev Jain Date: Fri Jul 18 14:32:43 2025 +0530 mm: optimize mprotect() by PTE batching Use folio_pte_batch to batch process a large folio. Note that, PTE batching here will save a few function calls, and this strategy in certain cases (not this one) batches atomic operations in general, so we have a performance win for all arches. This patch paves the way for patch 7 which will help us elide the TLBI per contig block on arm64. The correctness of this patch lies on the correctness of setting the new ptes based upon information only from the first pte of the batch (which may also have accumulated a/d bits via modify_prot_start_ptes()). Observe that the flag combination we pass to mprotect_folio_pte_batch() guarantees that the batch is uniform w.r.t the soft-dirty bit and the writable bit. Therefore, the only bits which may differ are the a/d bits. So we only need to worry about code which is concerned about the a/d bits of the PTEs. Setting extra a/d bits on the new ptes where previously they were not set, is fine - setting access bit when it was not set is not an incorrectness problem but will only possibly delay the reclaim of the page mapped by the pte (which is in fact intended because the kernel just operated on this region via mprotect()!). Setting dirty bit when it was not set is again not an incorrectness problem but will only possibly force an unnecessary writeback. So now we need to reason whether something can go wrong via can_change_pte_writable(). The pte_protnone, pte_needs_soft_dirty_wp, and userfaultfd_pte_wp cases are solved due to uniformity in the corresponding bits guaranteed by the flag combination. The ptes all belong to the same VMA (since callers guarantee that [start, end) will lie within the VMA) therefore the conditional based on the VMA is also safe to batch around. Since the dirty bit on the PTE really is just an indication that the folio got written to - even if the PTE is not actually dirty but one of the PTEs in the batch is, the wp-fault optimization can be made. Therefore, it is safe to batch around pte_dirty() in can_change_shared_pte_writable() (in fact this is better since without batching, it may happen that some ptes aren't changed to writable just because they are not dirty, even though the other ptes mapping the same large folio are dirty). To batch around the PageAnonExclusive case, we must check the corresponding condition for every single page. Therefore, from the large folio batch, we process sub batches of ptes mapping pages with the same PageAnonExclusive condition, and process that sub batch, then determine and process the next sub batch, and so on. Note that this does not cause any extra overhead; if suppose the size of the folio batch is 512, then the sub batch processing in total will take 512 iterations, which is the same as what we would have done before. For pte_needs_flush(): ppc does not care about the a/d bits. For x86, PAGE_SAVED_DIRTY is ignored. We will flush only when a/d bits get cleared; since we can only have extra a/d bits due to batching, we will only have an extra flush, not a case where we elide a flush due to batching when we shouldn't have. Link: https://lkml.kernel.org/r/20250718090244.21092-7-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Cc: Anshuman Khandual Cc: Barry Song Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jann Horn Cc: Joey Gouly Cc: Kevin Brodsky Cc: Lance Yang Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Ryan Roberts Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Yicong Yang Cc: Zhenhua Huang Signed-off-by: Andrew Morton commit 45199f715b7455a2e4054dbc5dab0c3b65e2abc1 Author: Dev Jain Date: Fri Jul 18 14:32:42 2025 +0530 mm: split can_change_pte_writable() into private and shared parts In preparation for patch 6 and modularizing the code in general, split can_change_pte_writable() into private and shared VMA parts. No functional change intended. Link: https://lkml.kernel.org/r/20250718090244.21092-6-dev.jain@arm.com Signed-off-by: Dev Jain Suggested-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Cc: Anshuman Khandual Cc: Barry Song Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jann Horn Cc: Joey Gouly Cc: Kevin Brodsky Cc: Lance Yang Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Ryan Roberts Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Yicong Yang Cc: Zhenhua Huang Signed-off-by: Andrew Morton commit 57fae936b40cba55f36bb8e3296f271696c2bb67 Author: Dev Jain Date: Fri Jul 18 14:32:41 2025 +0530 mm: introduce FPB_RESPECT_WRITE for PTE batching infrastructure Patch 6 ("mm: Optimize mprotect() by PTE batching") optimizes mprotect() by batch clearing the ptes, masking in the new protections, and batch setting the ptes. Suppose that the first pte of the batch is writable - with the current implementation of folio_pte_batch(), it is not guaranteed that the other ptes in the batch are already writable too, so we may incorrectly end up setting the writable bit on all ptes via modify_prot_commit_ptes(). Therefore, introduce FPB_RESPECT_WRITE so that all ptes in the batch are writable or not. Link: https://lkml.kernel.org/r/20250718090244.21092-5-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Lorenzo Stoakes Reviewed-by: Ryan Roberts Reviewed-by: Zi Yan Cc: Anshuman Khandual Cc: Barry Song Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jann Horn Cc: Joey Gouly Cc: Kevin Brodsky Cc: Lance Yang Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Yicong Yang Cc: Zhenhua Huang Signed-off-by: Andrew Morton commit 0aa3657df3ec713fca1f00a57a063b28f2a78147 Author: Dev Jain Date: Fri Jul 18 14:32:40 2025 +0530 mm: add batched versions of ptep_modify_prot_start/commit Batch ptep_modify_prot_start/commit in preparation for optimizing mprotect, implementing them as a simple loop over the corresponding single pte helpers. Architecture may override these helpers. Link: https://lkml.kernel.org/r/20250718090244.21092-4-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Lorenzo Stoakes Reviewed-by: Barry Song Reviewed-by: Ryan Roberts Reviewed-by: Zi Yan Cc: Anshuman Khandual Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jann Horn Cc: Joey Gouly Cc: Kevin Brodsky Cc: Lance Yang Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Yicong Yang Cc: Zhenhua Huang Signed-off-by: Andrew Morton commit 1d40f4e3d9d6a2d6807daa22d40ff27fc0c3d0f5 Author: Dev Jain Date: Fri Jul 18 14:32:39 2025 +0530 mm: optimize mprotect() for MM_CP_PROT_NUMA by batch-skipping PTEs For the MM_CP_PROT_NUMA skipping case, observe that, if we skip an iteration due to the underlying folio satisfying any of the skip conditions, then for all subsequent ptes which map the same folio, the iteration will be skipped for them too. Therefore, we can optimize by using folio_pte_batch() to batch skip the iterations. Use prot_numa_skip() introduced in the previous patch to determine whether we need to skip the iteration. Change its signature to have a double pointer to a folio, which will be used by mprotect_folio_pte_batch() to determine the number of iterations we can safely skip. Link: https://lkml.kernel.org/r/20250718090244.21092-3-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Lorenzo Stoakes Reviewed-by: Ryan Roberts Reviewed-by: Zi Yan Cc: Anshuman Khandual Cc: Barry Song Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jann Horn Cc: Joey Gouly Cc: Kevin Brodsky Cc: Lance Yang Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Yicong Yang Cc: Zhenhua Huang Signed-off-by: Andrew Morton commit b9bf6c2872c530776852b295eb399a23626e9611 Author: Dev Jain Date: Fri Jul 18 14:32:38 2025 +0530 mm: refactor MM_CP_PROT_NUMA skipping case into new function Patch series "Optimize mprotect() for large folios", v5. Use folio_pte_batch() to optimize change_pte_range(). On arm64, if the ptes are painted with the contig bit, then ptep_get() will iterate through all 16 entries to collect a/d bits. Hence this optimization will result in a 16x reduction in the number of ptep_get() calls. Next, ptep_modify_prot_start() will eventually call contpte_try_unfold() on every contig block, thus flushing the TLB for the complete large folio range. Instead, use get_and_clear_full_ptes() so as to elide TLBIs on each contig block, and only do them on the starting and ending contig block. For split folios, there will be no pte batching; the batch size returned by folio_pte_batch() will be 1. For pagetable split folios, the ptes will still point to the same large folio; for arm64, this results in the optimization described above, and for other arches, a minor improvement is expected due to a reduction in the number of function calls. mm-selftests pass on arm64. I have some failing tests on my x86 VM already; no new tests fail as a result of this patchset. We use the following test cases to measure performance, mprotect()'ing the mapped memory to read-only then read-write 40 times: Test case 1: Mapping 1G of memory, touching it to get PMD-THPs, then pte-mapping those THPs Test case 2: Mapping 1G of memory with 64K mTHPs Test case 3: Mapping 1G of memory with 4K pages Average execution time on arm64, Apple M3: Before the patchset: T1: 2.1 seconds T2: 2 seconds T3: 1 second After the patchset: T1: 0.65 seconds T2: 0.7 seconds T3: 1.1 seconds Observing T1/T2 and T3 before the patchset, we also remove the regression introduced by ptep_get() on a contpte block. And, for large folios we get an almost 74% performance improvement, albeit the trade-off being a slight degradation in the small folio case. For x86: Before the patchset: T1: 3.75 seconds T2: 3.7 seconds T3: 3.85 seconds After the patchset: T1: 3.7 seconds T2: 3.7 seconds T3: 3.9 seconds So there is a minor improvement due to reduction in number of function calls, and a slight degradation in the small folio case due to the overhead of vm_normal_folio() + folio_test_large(). Here is the test program: #define _GNU_SOURCE #include #include #include #include #include #define SIZE (1024*1024*1024) unsigned long pmdsize = (1UL << 21); unsigned long pagesize = (1UL << 12); static void pte_map_thps(char *mem, size_t size) { size_t offs; int ret = 0; /* PTE-map each THP by temporarily splitting the VMAs. */ for (offs = 0; offs < size; offs += pmdsize) { ret |= madvise(mem + offs, pagesize, MADV_DONTFORK); ret |= madvise(mem + offs, pagesize, MADV_DOFORK); } if (ret) { fprintf(stderr, "ERROR: mprotect() failed\n"); exit(1); } } int main(int argc, char *argv[]) { char *p; int ret = 0; p = mmap((1UL << 30), SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (p != (1UL << 30)) { perror("mmap"); return 1; } memset(p, 0, SIZE); if (madvise(p, SIZE, MADV_NOHUGEPAGE)) perror("madvise"); explicit_bzero(p, SIZE); pte_map_thps(p, SIZE); for (int loops = 0; loops < 40; loops++) { if (mprotect(p, SIZE, PROT_READ)) perror("mprotect"), exit(1); if (mprotect(p, SIZE, PROT_READ|PROT_WRITE)) perror("mprotect"), exit(1); explicit_bzero(p, SIZE); } } This patch (of 7): Reduce indentation by refactoring the prot_numa case into a new function. No functional change intended. Link: https://lkml.kernel.org/r/20250718090244.21092-1-dev.jain@arm.com Link: https://lkml.kernel.org/r/20250718090244.21092-2-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Lorenzo Stoakes Reviewed-by: Barry Song Reviewed-by: Zi Yan Cc: Anshuman Khandual Cc: Catalin Marinas Cc: Christophe Leroy Cc: David Hildenbrand Cc: Hugh Dickins Cc: Jann Horn Cc: Joey Gouly Cc: Kevin Brodsky Cc: Lance Yang Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Ryan Roberts Cc: Vlastimil Babka Cc: Will Deacon Cc: Yang Shi Cc: Yicong Yang Cc: Zhenhua Huang Signed-off-by: Andrew Morton commit fde47708f9bc7f7babe4f48284f19d92faa06891 Author: Zi Yan Date: Fri Jul 18 14:37:20 2025 -0400 mm/huge_memory: refactor after-split (page) cache code Smatch/coverity checkers report NULL mapping referencing issues[1][2][3] every time the code is modified, because they do not understand that mapping cannot be NULL when a folio is in page cache in the code. Refactor the code to make it explicit. Remove "end = -1" for anonymous folios, since after code refactoring, end is no longer used by anonymous folio handling code. No functional change is intended. Link: https://lkml.kernel.org/r/20250718023000.4044406-7-ziy@nvidia.com Link: https://lore.kernel.org/linux-mm/2afe3d59-aca5-40f7-82a3-a6d976fb0f4f@stanley.mountain/ [1] Link: https://lore.kernel.org/oe-kbuild/64b54034-f311-4e7d-b935-c16775dbb642@suswa.mountain/ [2] Link: https://lore.kernel.org/linux-mm/20250716145804.4836-1-antonio@mandelbit.com/ [3] Link: https://lkml.kernel.org/r/20250718183720.4054515-7-ziy@nvidia.com Signed-off-by: Zi Yan Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Balbir Singh Cc: Baolin Wang Cc: Barry Song Cc: Dan Carpenter Cc: Dev Jain Cc: Hugh Dickins Cc: Kirill A. Shutemov Cc: Liam Howlett Cc: Mariano Pache Cc: Mathew Brost Cc: Ryan Roberts Signed-off-by: Andrew Morton commit a3871560ffc5755e561b75e257d2b15b19395608 Author: Zi Yan Date: Fri Jul 18 14:37:19 2025 -0400 mm/huge_memory: get frozen folio refcount with folio_expected_ref_count() Instead of open coding the refcount calculation, use folio_expected_ref_count() to calculate frozen folio refcount. Because: 1. __folio_split() does not split a folio with PG_private, so no elevated refcount from PG_private; 2. a frozen folio in __folio_split() is fully unmapped, so folio_mapcount() in folio_expected_ref_count() is always 0; 3. (mapping || swap_cache) ? folio_nr_pages(folio) is taken care of by folio_expected_ref_count() too. Link: https://lkml.kernel.org/r/20250718023000.4044406-6-ziy@nvidia.com Link: https://lkml.kernel.org/r/20250718183720.4054515-6-ziy@nvidia.com Signed-off-by: Zi Yan Suggested-by: David Hildenbrand Acked-by: Balbir Singh Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Antonio Quartulli Cc: Baolin Wang Cc: Barry Song Cc: Dan Carpenter Cc: Dev Jain Cc: Hugh Dickins Cc: Kirill A. Shutemov Cc: Liam Howlett Cc: Mariano Pache Cc: Mathew Brost Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 714b056c8321066f5a20d3045a95398092f7c1b9 Author: Zi Yan Date: Thu Jul 17 22:29:58 2025 -0400 mm/huge_memory: convert VM_BUG* to VM_WARN* in __folio_split These VM_BUG* can be handled gracefully without crashing kernel. Link: https://lkml.kernel.org/r/20250718023000.4044406-5-ziy@nvidia.com Link: https://lkml.kernel.org/r/20250718183720.4054515-5-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Cc: Antonio Quartulli Cc: Balbir Singh Cc: Baolin Wang Cc: Barry Song Cc: Dan Carpenter Cc: Dev Jain Cc: Hugh Dickins Cc: Kirill A. Shutemov Cc: Liam Howlett Cc: Mariano Pache Cc: Mathew Brost Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 391dc7f40590d793f0e5214b6e9324b1af8fa40d Author: Zi Yan Date: Fri Jul 18 14:37:17 2025 -0400 mm/huge_memory: deduplicate code in __folio_split() xas unlock, remap_page(), local_irq_enable() are moved out of if branches to deduplicate the code. While at it, add remap_flags to clean up remap_page() call site. nr_dropped is renamed to nr_shmem_dropped, as it becomes a variable at __folio_split() scope. Link: https://lkml.kernel.org/r/20250718183720.4054515-4-ziy@nvidia.com Signed-off-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Antonio Quartulli Cc: Balbir Singh Cc: Baolin Wang Cc: Barry Song Cc: Dan Carpenter Cc: Dev Jain Cc: Hugh Dickins Cc: Kirill A. Shutemov Cc: Liam Howlett Cc: Mariano Pache Cc: Mathew Brost Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 3653fc1bdba1f0fc2f0b4715ad98a3ba62689ab5 Author: Zi Yan Date: Fri Jul 18 14:37:16 2025 -0400 mm/huge_memory: remove after_split label in __split_unmapped_folio() Check stop_split instead to avoid the goto statement. Link: https://lkml.kernel.org/r/20250718183720.4054515-3-ziy@nvidia.com Signed-off-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Antonio Quartulli Cc: Balbir Singh Cc: Baolin Wang Cc: Barry Song Cc: Dan Carpenter Cc: Dev Jain Cc: Hugh Dickins Cc: Kirill A. Shutemov Cc: Liam Howlett Cc: Mariano Pache Cc: Mathew Brost Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 6c7de9c83be68bf40131e75de42aae8868ea43b1 Author: Zi Yan Date: Fri Jul 18 14:37:15 2025 -0400 mm/huge_memory: move unrelated code out of __split_unmapped_folio() Patch series "__folio_split() clean up", v5. This patchset refactors __folio_split() and __split_unmapped_folio() to: 1. make __split_unmapped_folio() reusable for splitting unmapped folios. It avoids the need for a new boolean unmapped parameter to guard mapping-related code when __split_unmapped_folio() is reused to split unmapped folios. 2. improve code readability and prevent smatch/coverity checkers from complaining about NULL mapping referencing. An additional benefit for __split_unmapped_folio() refactoring is that __split_unmapped_folio() could be called on after-split folios by __folio_split(). It can enable new split methods. For example, at deferred split time, unmapped subpages can scatter arbitrarily within a large folio, neither uniform nor non-uniform split can maximize after-split folio orders for mapped subpages. The hope is that by calling __split_unmapped_folio() multiple times, a better split result can be achieved. This patch (of 6): remap(), folio_ref_unfreeze(), lru_add_split_folio() are not relevant to splitting unmapped folio operations. Move them out to __folio_split() so that __split_unmapped_folio() only handles unmapped folio splits. This makes __split_unmapped_folio() reusable. Remove the swapcache folio split check code before __split_unmapped_folio() call, since it is already checked at the beginning of __folio_split() in uniform_split_supported() and non_uniform_split_supported(). Along with the code move, there are some variable renames: 1. release is renamed to new_folio, 2. origin_folio is now folio, since __folio_split() has folio pointing to the original folio already. Link: https://lkml.kernel.org/r/20250718023000.4044406-1-ziy@nvidia.com Link: https://lkml.kernel.org/r/20250718023000.4044406-2-ziy@nvidia.com Link: https://lkml.kernel.org/r/20250718183720.4054515-1-ziy@nvidia.com Link: https://lkml.kernel.org/r/20250718183720.4054515-2-ziy@nvidia.com Signed-off-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Antonio Quartulli Cc: Balbir Singh Cc: Baolin Wang Cc: Barry Song Cc: Dan Carpenter Cc: Dev Jain Cc: Hugh Dickins Cc: Kirill A. Shutemov Cc: Liam Howlett Cc: Mariano Pache Cc: Mathew Brost Cc: Ryan Roberts Cc: Zi Yan Signed-off-by: Andrew Morton commit 6470fb2bb1812cac0a80a290bb193a9d866dd39d Author: Anshuman Khandual Date: Fri Jul 11 15:59:34 2025 +0530 fs/Kconfig: enable HUGETLBFS only if ARCH_SUPPORTS_HUGETLBFS Enable HUGETLBFS only when platform subscrbes via ARCH_SUPPORTS_HUGETLBFS. Hence select ARCH_SUPPORTS_HUGETLBFS on existing x86 and sparc for their continuing HUGETLBFS support. While here also just drop existing 'BROKEN' dependency. Link: https://lkml.kernel.org/r/20250711102934.2399533-1-anshuman.khandual@arm.com Signed-off-by: Anshuman Khandual Cc: "David S. Miller" Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Christian Brauner Signed-off-by: Andrew Morton commit a5867a218d7ca15359e762fa067d867d738689e2 Author: Yadan Fan Date: Sat Jul 19 06:06:51 2025 +0800 mm: mempool: fix wake-up edge case bug for zero-minimum pools The mempool wake-up path has a edge case bug that affects pools created with min_nr=0. When a thread blocks waiting for memory from an empty pool (curr_nr == 0), subsequent mempool_free() calls fail to wake the waiting thread because the condition "curr_nr < min_nr" evaluates to "0 < 0" which is false, this can cause threads to sleep indefinitely according to the code logic. There is at least 2 places where the mempool created with min_nr=0: 1. lib/btree.c:191: mempool_create(0, btree_alloc, btree_free, NULL) 2. drivers/md/dm-verity-fec.c:791: mempool_init_slab_pool(&f->extra_pool, 0, f->cache) Add an explicit check in mempool_free() to handle the min_nr=0 case: when the pool has zero minimum reserves, is currently empty, and has active waiters, allocate the element then wake up the sleeper. Link: https://lkml.kernel.org/r/f28a81ba-615c-481e-86fb-c0bf4115ec89@suse.com Signed-off-by: Yadan Fan Signed-off-by: Andrew Morton commit 5631da56c9a87ea41d69d1bbbc1cee327eb9354b Author: Suren Baghdasaryan Date: Sat Jul 19 11:28:54 2025 -0700 fs/proc/task_mmu: read proc/pid/maps under per-vma lock With maple_tree supporting vma tree traversal under RCU and per-vma locks, /proc/pid/maps can be read while holding individual vma locks instead of locking the entire address space. A completely lockless approach (walking vma tree under RCU) would be quite complex with the main issue being get_vma_name() using callbacks which might not work correctly with a stable vma copy, requiring original (unstable) vma - see special_mapping_name() for example. When per-vma lock acquisition fails, we take the mmap_lock for reading, lock the vma, release the mmap_lock and continue. This fallback to mmap read lock guarantees the reader to make forward progress even during lock contention. This will interfere with the writer but for a very short time while we are acquiring the per-vma lock and only when there was contention on the vma reader is interested in. We shouldn't see a repeated fallback to mmap read locks in practice, as this require a very unlikely series of lock contentions (for instance due to repeated vma split operations). However even if this did somehow happen, we would still progress. One case requiring special handling is when a vma changes between the time it was found and the time it got locked. A problematic case would be if a vma got shrunk so that its vm_start moved higher in the address space and a new vma was installed at the beginning: reader found: |--------VMA A--------| VMA is modified: |-VMA B-|----VMA A----| reader locks modified VMA A reader reports VMA A: | gap |----VMA A----| This would result in reporting a gap in the address space that does not exist. To prevent this we retry the lookup after locking the vma, however we do that only when we identify a gap and detect that the address space was changed after we found the vma. This change is designed to reduce mmap_lock contention and prevent a process reading /proc/pid/maps files (often a low priority task, such as monitoring/data collection services) from blocking address space updates. Note that this change has a userspace visible disadvantage: it allows for sub-page data tearing as opposed to the previous mechanism where data tearing could happen only between pages of generated output data. Since current userspace considers data tearing between pages to be acceptable, we assume is will be able to handle sub-page data tearing as well. Link: https://lkml.kernel.org/r/20250719182854.3166724-7-surenb@google.com Signed-off-by: Suren Baghdasaryan Reviewed-by: Vlastimil Babka Cc: Alexey Dobriyan Cc: Andrii Nakryiko Cc: Christian Brauner Cc: Christophe Leroy Cc: David Hildenbrand Cc: Jann Horn Cc: Jeongjun Park Cc: Johannes Weiner Cc: Josef Bacik Cc: Kalesh Singh Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Oscar Salvador Cc: "Paul E . McKenney" Cc: Peter Xu Cc: Ryan Roberts Cc: Shuah Khan Cc: Thomas Weißschuh Cc: T.J. Mercier Cc: Ye Bin Signed-off-by: Andrew Morton commit 03d98703f7e172778786ebd7c5f2471d0f65d3a6 Author: Suren Baghdasaryan Date: Sat Jul 19 11:28:53 2025 -0700 fs/proc/task_mmu: remove conversion of seq_file position to unsigned Back in 2.6 era, last_addr used to be stored in seq_file->version variable, which was unsigned long. As a result, sentinels to represent gate vma and end of all vmas used unsigned values. In more recent kernels we don't used seq_file->version anymore and therefore conversion from loff_t into unsigned type is not needed. Similarly, sentinel values don't need to be unsigned. Remove type conversion for set_file position and change sentinel values to signed. While at it, change the hardcoded sentinel values with named definitions for better documentation. Link: https://lkml.kernel.org/r/20250719182854.3166724-6-surenb@google.com Signed-off-by: Suren Baghdasaryan Reviewed-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Alexey Dobriyan Cc: Andrii Nakryiko Cc: Christian Brauner Cc: Christophe Leroy Cc: Jann Horn Cc: Jeongjun Park Cc: Johannes Weiner Cc: Josef Bacik Cc: Kalesh Singh Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Oscar Salvador Cc: "Paul E . McKenney" Cc: Peter Xu Cc: Ryan Roberts Cc: Shuah Khan Cc: Thomas Weißschuh Cc: T.J. Mercier Cc: Ye Bin Signed-off-by: Andrew Morton commit aadc099c480f98817849cd44585904402160fe21 Author: Suren Baghdasaryan Date: Sat Jul 19 11:28:52 2025 -0700 selftests/proc: add verbose mode for /proc/pid/maps tearing tests Add verbose mode to the /proc/pid/maps tearing tests to print debugging information. VERBOSE environment variable is used to enable it. Usage example: VERBOSE=1 ./proc-maps-race Link: https://lkml.kernel.org/r/20250719182854.3166724-5-surenb@google.com Signed-off-by: Suren Baghdasaryan Cc: Alexey Dobriyan Cc: Andrii Nakryiko Cc: Christian Brauner Cc: Christophe Leroy Cc: David Hildenbrand Cc: Jann Horn Cc: Jeongjun Park Cc: Johannes Weiner Cc: Josef Bacik Cc: Kalesh Singh Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Oscar Salvador Cc: "Paul E . McKenney" Cc: Peter Xu Cc: Ryan Roberts Cc: Shuah Khan Cc: Thomas Weißschuh Cc: T.J. Mercier Cc: Vlastimil Babka Cc: Ye Bin Signed-off-by: Andrew Morton commit 6a45336b9b6fcc1d9ef3c6fe9a43252f9a20084b Author: Suren Baghdasaryan Date: Sat Jul 19 11:28:51 2025 -0700 selftests/proc: extend /proc/pid/maps tearing test to include vma remapping Test that /proc/pid/maps does not report unexpected holes in the address space when we concurrently remap a part of a vma into the middle of another vma. This remapping results in the destination vma being split into three parts and the part in the middle being patched back from, all done concurrently from under the reader. We should always see either original vma or the split one with no holes. Link: https://lkml.kernel.org/r/20250719182854.3166724-4-surenb@google.com Signed-off-by: Suren Baghdasaryan Cc: Alexey Dobriyan Cc: Andrii Nakryiko Cc: Christian Brauner Cc: Christophe Leroy Cc: David Hildenbrand Cc: Jann Horn Cc: Jeongjun Park Cc: Johannes Weiner Cc: Josef Bacik Cc: Kalesh Singh Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Oscar Salvador Cc: "Paul E . McKenney" Cc: Peter Xu Cc: Ryan Roberts Cc: Shuah Khan Cc: Thomas Weißschuh Cc: T.J. Mercier Cc: Vlastimil Babka Cc: Ye Bin Signed-off-by: Andrew Morton commit b11d9e2d7883031afb570545cb9657a5c457349a Author: Suren Baghdasaryan Date: Sat Jul 19 11:28:50 2025 -0700 selftests/proc: extend /proc/pid/maps tearing test to include vma resizing Test that /proc/pid/maps does not report unexpected holes in the address space when a vma at the edge of the page is being concurrently remapped. This remapping results in the vma shrinking and expanding from under the reader. We should always see either shrunk or expanded (original) version of the vma. Link: https://lkml.kernel.org/r/20250719182854.3166724-3-surenb@google.com Signed-off-by: Suren Baghdasaryan Cc: Alexey Dobriyan Cc: Andrii Nakryiko Cc: Christian Brauner Cc: Christophe Leroy Cc: David Hildenbrand Cc: Jann Horn Cc: Jeongjun Park Cc: Johannes Weiner Cc: Josef Bacik Cc: Kalesh Singh Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Oscar Salvador Cc: "Paul E . McKenney" Cc: Peter Xu Cc: Ryan Roberts Cc: Shuah Khan Cc: Thomas Weißschuh Cc: T.J. Mercier Cc: Vlastimil Babka Cc: Ye Bin Signed-off-by: Andrew Morton commit beb69e81724634063b9dbae4bc79e2e011fdeeb1 Author: Suren Baghdasaryan Date: Sat Jul 19 11:28:49 2025 -0700 selftests/proc: add /proc/pid/maps tearing from vma split test Patch series "use per-vma locks for /proc/pid/maps reads", v8. Reading /proc/pid/maps requires read-locking mmap_lock which prevents any other task from concurrently modifying the address space. This guarantees coherent reporting of virtual address ranges, however it can block important updates from happening. Oftentimes /proc/pid/maps readers are low priority monitoring tasks and them blocking high priority tasks results in priority inversion. Locking the entire address space is required to present fully coherent picture of the address space, however even current implementation does not strictly guarantee that by outputting vmas in page-size chunks and dropping mmap_lock in between each chunk. Address space modifications are possible while mmap_lock is dropped and userspace reading the content is expected to deal with possible concurrent address space modifications. Considering these relaxed rules, holding mmap_lock is not strictly needed as long as we can guarantee that a concurrently modified vma is reported either in its original form or after it was modified. This patchset switches from holding mmap_lock while reading /proc/pid/maps to taking per-vma locks as we walk the vma tree. This reduces the contention with tasks modifying the address space because they would have to contend for the same vma as opposed to the entire address space. Previous version of this patchset [1] tried to perform /proc/pid/maps reading under RCU, however its implementation is quite complex and the results are worse than the new version because it still relied on mmap_lock speculation which retries if any part of the address space gets modified. New implementaion is both simpler and results in less contention. Note that similar approach would not work for /proc/pid/smaps reading as it also walks the page table and that's not RCU-safe. Paul McKenney's designed a test [2] to measure mmap/munmap latencies while concurrently reading /proc/pid/maps. The test has a pair of processes scanning /proc/PID/maps, and another process unmapping and remapping 4K pages from a 128MB range of anonymous memory. At the end of each 10 second run, the latency of each mmap() or munmap() operation is measured, and for each run the maximum and mean latency is printed. The map/unmap process is started first, its PID is passed to the scanners, and then the map/unmap process waits until both scanners are running before starting its timed test. The scanners keep scanning until the specified /proc/PID/maps file disappears. The latest results from Paul: Stock mm-unstable, all of the runs had maximum latencies in excess of 0.5 milliseconds, and with 80% of the runs' latencies exceeding a full millisecond, and ranging up beyond 4 full milliseconds. In contrast, 99% of the runs with this patch series applied had maximum latencies of less than 0.5 milliseconds, with the single outlier at only 0.608 milliseconds. From a median-performance (as opposed to maximum-latency) viewpoint, this patch series also looks good, with stock mm weighing in at 11 microseconds and patch series at 6 microseconds, better than a 2x improvement. Before the change: ./run-proc-vs-map.sh --nsamples 100 --rawdata -- --busyduration 2 0.011 0.008 0.521 0.011 0.008 0.552 0.011 0.008 0.590 0.011 0.008 0.660 ... 0.011 0.015 2.987 0.011 0.015 3.038 0.011 0.016 3.431 0.011 0.016 4.707 After the change: ./run-proc-vs-map.sh --nsamples 100 --rawdata -- --busyduration 2 0.006 0.005 0.026 0.006 0.005 0.029 0.006 0.005 0.034 0.006 0.005 0.035 ... 0.006 0.006 0.421 0.006 0.006 0.423 0.006 0.006 0.439 0.006 0.006 0.608 The patchset also adds a number of tests to check for /proc/pid/maps data coherency. They are designed to detect any unexpected data tearing while performing some common address space modifications (vma split, resize and remap). Even before these changes, reading /proc/pid/maps might have inconsistent data because the file is read page-by-page with mmap_lock being dropped between the pages. An example of user-visible inconsistency can be that the same vma is printed twice: once before it was modified and then after the modifications. For example if vma was extended, it might be found and reported twice. What is not expected is to see a gap where there should have been a vma both before and after modification. This patchset increases the chances of such tearing, therefore it's even more important now to test for unexpected inconsistencies. In [3] Lorenzo identified the following possible vma merging/splitting scenarios: Merges with changes to existing vmas: 1 Merge both - mapping a vma over another one and between two vmas which can be merged after this replacement; 2. Merge left full - mapping a vma at the end of an existing one and completely over its right neighbor; 3. Merge left partial - mapping a vma at the end of an existing one and partially over its right neighbor; 4. Merge right full - mapping a vma before the start of an existing one and completely over its left neighbor; 5. Merge right partial - mapping a vma before the start of an existing one and partially over its left neighbor; Merges without changes to existing vmas: 6. Merge both - mapping a vma into a gap between two vmas which can be merged after the insertion; 7. Merge left - mapping a vma at the end of an existing one; 8. Merge right - mapping a vma before the start end of an existing one; Splits 9. Split with new vma at the lower address; 10. Split with new vma at the higher address; If such merges or splits happen concurrently with the /proc/maps reading we might report a vma twice, once before the modification and once after it is modified: Case 1 might report overwritten and previous vma along with the final merged vma; Case 2 might report previous and the final merged vma; Case 3 might cause us to retry once we detect the temporary gap caused by shrinking of the right neighbor; Case 4 might report overritten and the final merged vma; Case 5 might cause us to retry once we detect the temporary gap caused by shrinking of the left neighbor; Case 6 might report previous vma and the gap along with the final marged vma; Case 7 might report previous and the final merged vma; Case 8 might report the original gap and the final merged vma covering the gap; Case 9 might cause us to retry once we detect the temporary gap caused by shrinking of the original vma at the vma start; Case 10 might cause us to retry once we detect the temporary gap caused by shrinking of the original vma at the vma end; In all these cases the retry mechanism prevents us from reporting possible temporary gaps. [1] https://lore.kernel.org/all/20250418174959.1431962-1-surenb@google.com/ [2] https://github.com/paulmckrcu/proc-mmap_sem-test [3] https://lore.kernel.org/all/e1863f40-39ab-4e5b-984a-c48765ffde1c@lucifer.local/ The /proc/pid/maps file is generated page by page, with the mmap_lock released between pages. This can lead to inconsistent reads if the underlying vmas are concurrently modified. For instance, if a vma split or merge occurs at a page boundary while /proc/pid/maps is being read, the same vma might be seen twice: once before and once after the change. This duplication is considered acceptable for userspace handling. However, observing a "hole" where a vma should be (e.g., due to a vma being replaced and the space temporarily being empty) is unacceptable. Implement a test that: 1. Forks a child process which continuously modifies its address space, specifically targeting a vma at the boundary between two pages. 2. The parent process repeatedly reads the child's /proc/pid/maps. 3. The parent process checks the last vma of the first page and the first vma of the second page for consistency, looking for the effects of vma splits or merges. The test duration is configurable via DURATION environment variable expressed in seconds. The default test duration is 5 seconds. Example Command: DURATION=10 ./proc-maps-race Link: https://lore.kernel.org/all/20250418174959.1431962-1-surenb@google.com/ [1] Link: https://github.com/paulmckrcu/proc-mmap_sem-test [2] Link: https://lore.kernel.org/all/e1863f40-39ab-4e5b-984a-c48765ffde1c@lucifer.local/ [3] Link: https://lkml.kernel.org/r/20250719182854.3166724-1-surenb@google.com Link: https://lkml.kernel.org/r/20250719182854.3166724-2-surenb@google.com Signed-off-by: Suren Baghdasaryan Cc: Alexey Dobriyan Cc: Andrii Nakryiko Cc: Christian Brauner Cc: Christophe Leroy Cc: David Hildenbrand Cc: Jann Horn Cc: Jeongjun Park Cc: Johannes Weiner Cc: Josef Bacik Cc: Kalesh Singh Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Michal Hocko Cc: Oscar Salvador Cc: "Paul E . McKenney" Cc: Peter Xu Cc: Ryan Roberts Cc: Shuah Khan Cc: Thomas Weißschuh Cc: T.J. Mercier Cc: Vlastimil Babka Cc: Ye Bin Signed-off-by: Andrew Morton commit c79147e4b02fa3679aebf34121b12f5097731d8a Author: Yury Norov (NVIDIA) Date: Sat Jul 19 16:54:00 2025 -0400 mm: cma: simplify cma_maxchunk_get() The function opencodes for_each_clear_bitrange(). Fix that and drop most of housekeeping code. Link: https://lkml.kernel.org/r/20250719205401.399475-3-yury.norov@gmail.com Signed-off-by: Yury Norov (NVIDIA) Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit 77c50f9147eabcf726f62c73167bb9d9e8621a43 Author: Yury Norov (NVIDIA) Date: Sat Jul 19 16:53:59 2025 -0400 mm: cma: simplify cma_debug_show_areas() The function opencodes for_each_clear_bitrange(). Fix that and drop most of housekeeping code. Link: https://lkml.kernel.org/r/20250719205401.399475-2-yury.norov@gmail.com Signed-off-by: Yury Norov (NVIDIA) Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit 476d87d6a06146125e8f16edbe845a7bcf6a2e57 Author: Luiz Capitulino Date: Mon Jul 14 09:16:54 2025 -0400 fs: stable_page_flags(): use snapshot_page() A race condition is possible in stable_page_flags() where user-space is reading /proc/kpageflags concurrently to a folio split. This may lead to oopses or BUG_ON()s being triggered. To fix this, this commit uses snapshot_page() in stable_page_flags() so that stable_page_flags() works with a stable page and folio snapshots instead. Note that stable_page_flags() makes use of some functions that require the original page or folio pointer to work properly (eg. is_free_budy_page() and folio_test_idle()). Since those functions can't be used on the page snapshot, we replace their usage with flags that were set by snapshot_page() for this purpose. Link: https://lkml.kernel.org/r/52c16c0f00995a812a55980c2f26848a999a34ab.1752499009.git.luizcap@redhat.com Signed-off-by: Luiz Capitulino Reviewed-by: Shivank Garg Tested-by: Harry Yoo Acked-by: David Hildenbrand Cc: Matthew Wilcox (Oracle) Cc: Oscar Salvador Cc: SeongJae Park Signed-off-by: Andrew Morton commit 71f2a2c4ff62c9bb1daa0e47b588220178a5ad12 Author: Luiz Capitulino Date: Mon Jul 14 09:16:53 2025 -0400 proc: kpagecount: use snapshot_page() Currently, the call to folio_precise_page_mapcount() from kpage_read() can race with a folio split. When the race happens we trigger a VM_BUG_ON_FOLIO() in folio_entire_mapcount() (see splat below). This commit fixes this race by using snapshot_page() so that we retrieve the folio mapcount using a folio snapshot. [ 2356.558576] page: refcount:1 mapcount:1 mapping:0000000000000000 index:0xffff85200 pfn:0x6f7c00 [ 2356.558748] memcg:ffff000651775780 [ 2356.558763] anon flags: 0xafffff60020838(uptodate|dirty|lru|owner_2|swapbacked|node=1|zone=2|lastcpupid=0xfffff) [ 2356.558796] raw: 00afffff60020838 fffffdffdb5d0048 fffffdffdadf7fc8 ffff00064c1629c1 [ 2356.558817] raw: 0000000ffff85200 0000000000000000 0000000100000000 ffff000651775780 [ 2356.558839] page dumped because: VM_BUG_ON_FOLIO(!folio_test_large(folio)) [ 2356.558882] ------------[ cut here ]------------ [ 2356.558897] kernel BUG at ./include/linux/mm.h:1103! [ 2356.558982] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 2356.564729] CPU: 8 UID: 0 PID: 1864 Comm: folio-split-rac Tainted: G S W 6.15.0+ #3 PREEMPT(voluntary) [ 2356.566196] Tainted: [S]=CPU_OUT_OF_SPEC, [W]=WARN [ 2356.566814] Hardware name: Red Hat KVM, BIOS edk2-20241117-3.el9 11/17/2024 [ 2356.567684] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 2356.568563] pc : kpage_read.constprop.0+0x26c/0x290 [ 2356.569605] lr : kpage_read.constprop.0+0x26c/0x290 [ 2356.569992] sp : ffff80008fb739b0 [ 2356.570263] x29: ffff80008fb739b0 x28: ffff00064aa69580 x27: 00000000ff000000 [ 2356.570842] x26: 0000fffffffffff8 x25: ffff00064aa69580 x24: ffff80008fb73ae0 [ 2356.571411] x23: 0000000000000001 x22: 0000ffff86c6e8b8 x21: 0000000000000008 [ 2356.571978] x20: 00000000006f7c00 x19: 0000ffff86c6e8b8 x18: 0000000000000000 [ 2356.572581] x17: 3630303066666666 x16: 0000000000000003 x15: 0000000000001000 [ 2356.573217] x14: 00000000ffffffff x13: 0000000000000004 x12: 00aaaaaa00aaaaaa [ 2356.577674] x11: 0000000000000000 x10: 00aaaaaa00aaaaaa x9 : ffffbf3afca6c300 [ 2356.578332] x8 : 0000000000000002 x7 : 0000000000000001 x6 : 0000000000000001 [ 2356.578984] x5 : ffff000c79812408 x4 : 0000000000000000 x3 : 0000000000000000 [ 2356.579635] x2 : 0000000000000000 x1 : ffff00064aa69580 x0 : 000000000000003e [ 2356.580286] Call trace: [ 2356.580524] kpage_read.constprop.0+0x26c/0x290 (P) [ 2356.580982] kpagecount_read+0x28/0x40 [ 2356.581336] proc_reg_read+0x38/0x100 [ 2356.581681] vfs_read+0xcc/0x320 [ 2356.581992] ksys_read+0x74/0x118 [ 2356.582306] __arm64_sys_read+0x24/0x38 [ 2356.582668] invoke_syscall+0x70/0x100 [ 2356.583022] el0_svc_common.constprop.0+0x48/0xf8 [ 2356.583456] do_el0_svc+0x28/0x40 [ 2356.583930] el0_svc+0x38/0x118 [ 2356.584328] el0t_64_sync_handler+0x144/0x168 [ 2356.584883] el0t_64_sync+0x19c/0x1a0 [ 2356.585350] Code: aa0103e0 9003a541 91082021 97f813fc (d4210000) [ 2356.586130] ---[ end trace 0000000000000000 ]--- [ 2356.587377] note: folio-split-rac[1864] exited with irqs disabled [ 2356.588050] note: folio-split-rac[1864] exited with preempt_count 1 Link: https://lkml.kernel.org/r/1c05cc725b90962d56323ff2e28e9cc3ae397b68.1752499009.git.luizcap@redhat.com Signed-off-by: Luiz Capitulino Reported-by: syzbot+3d7dc5eaba6b932f8535@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67812fbd.050a0220.d0267.0030.GAE@google.com/Reviewed-by: Shivank Garg Tested-by: Harry Yoo Acked-by: David Hildenbrand Cc: Matthew Wilcox (Oracle) Cc: Oscar Salvador Cc: SeongJae Park Signed-off-by: Andrew Morton commit d863a12108f24c5f0b49f99f328e33371bd7c69d Author: Luiz Capitulino Date: Mon Jul 14 09:16:52 2025 -0400 mm/util: introduce snapshot_page() This commit refactors __dump_page() into snapshot_page(). snapshot_page() tries to take a faithful snapshot of a page and its folio representation. The snapshot is returned in the struct page_snapshot parameter along with additional flags that are best retrieved at snapshot creation time to reduce race windows. This function is intended to be used by callers that need a stable representation of a struct page and struct folio so that pointers or page information doesn't change while working on a page. The idea and original implementation of snapshot_page() comes from Matthew Wilcox with suggestions for improvements from David Hildenbrand. All bugs and misconceptions are mine. [luizcap@redhat.com: fix set_ps_flags() commentary] Link: https://lkml.kernel.org/r/d5c75701-b353-4536-a306-187fab0655b3@redhat.com Link: https://lkml.kernel.org/r/637a03a05cb2e3df88f84ff9e9f9642374ef813a.1752499009.git.luizcap@redhat.com Signed-off-by: Luiz Capitulino Reviewed-by: Shivank Garg Tested-by: Harry Yoo Acked-by: David Hildenbrand Cc: Matthew Wilcox (Oracle) Cc: Oscar Salvador Cc: SeongJae Park Signed-off-by: Andrew Morton commit 92c99fc614737eaa99125283c306d2ebb13b101a Author: David Hildenbrand Date: Mon Jul 14 09:16:51 2025 -0400 mm/memory: introduce is_huge_zero_pfn() and use it in vm_normal_page_pmd() Patch series "mm: introduce snapshot_page()", v3. This series introduces snapshot_page(), a helper function that can be used to create a snapshot of a struct page and its associated struct folio. This function is intended to help callers with a consistent view of a a folio while reducing the chance of encountering partially updated or inconsistent state, such as during folio splitting which could lead to crashes and BUG_ON()s being triggered. This patch (of 4): Let's avoid working with the PMD when not required. If vm_normal_page_pmd() would be called on something that is not a present pmd, it would already be a bug (pfn possibly garbage). While at it, let's support passing in any pfn covered by the huge zero folio by masking off PFN bits -- which should be rather cheap. Link: https://lkml.kernel.org/r/cover.1752499009.git.luizcap@redhat.com Link: https://lkml.kernel.org/r/4940826e99f0c709a7cf7beb94f53288320aea5a.1752499009.git.luizcap@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Oscar Salvador Signed-off-by: Luiz Capitulino Reviewed-by: Shivank Garg Tested-by: Harry Yoo Cc: Matthew Wilcox (Oracle) Cc: SeongJae Park Signed-off-by: Andrew Morton commit 8678d1faf1d4c9c6a87237203fc23c9389e8f143 Author: Kemeng Shi Date: Thu May 22 20:25:54 2025 +0800 mm: swap: remove stale comment stale comment in cluster_alloc_swap_entry() As cluster_next_cpu was already dropped, the associated comment is stale now. Link: https://lkml.kernel.org/r/20250522122554.12209-5-shikemeng@huaweicloud.com Signed-off-by: Kemeng Shi Reviewed-by: Kairui Song Reviewed-by: Baoquan He Cc: Johannes Weiner Signed-off-by: Andrew Morton commit 152c1339dc13ad46f1b136e8693de15980750835 Author: Kemeng Shi Date: Thu May 22 20:25:53 2025 +0800 mm: swap: fix potential buffer overflow in setup_clusters() In setup_swap_map(), we only ensure badpages are in range (0, last_page]. As maxpages might be < last_page, setup_clusters() will encounter a buffer overflow when a badpage is >= maxpages. Only call inc_cluster_info_page() for badpage which is < maxpages to fix the issue. Link: https://lkml.kernel.org/r/20250522122554.12209-4-shikemeng@huaweicloud.com Fixes: b843786b0bd0 ("mm: swapfile: fix SSD detection with swapfile on btrfs") Signed-off-by: Kemeng Shi Reviewed-by: Baoquan He Cc: Johannes Weiner Cc: Kairui Song Cc: Signed-off-by: Andrew Morton commit 255116c5b0fa2145ede28c2f7b248df5e73834d1 Author: Kemeng Shi Date: Thu May 22 20:25:52 2025 +0800 mm: swap: correctly use maxpages in swapon syscall to avoid potential deadloop We use maxpages from read_swap_header() to initialize swap_info_struct, however the maxpages might be reduced in setup_swap_extents() and the si->max is assigned with the reduced maxpages from the setup_swap_extents(). Obviously, this could lead to memory waste as we allocated memory based on larger maxpages, besides, this could lead to a potential deadloop as following: 1) When calling setup_clusters() with larger maxpages, unavailable pages within range [si->max, larger maxpages) are not accounted with inc_cluster_info_page(). As a result, these pages are assumed available but can not be allocated. The cluster contains these pages can be moved to frag_clusters list after it's all available pages were allocated. 2) When the cluster mentioned in 1) is the only cluster in frag_clusters list, cluster_alloc_swap_entry() assume order 0 allocation will never failed and will enter a deadloop by keep trying to allocate page from the only cluster in frag_clusters which contains no actually available page. Call setup_swap_extents() to get the final maxpages before swap_info_struct initialization to fix the issue. After this change, span will include badblocks and will become large value which I think is correct value: In summary, there are two kinds of swapfile_activate operations. 1. Filesystem style: Treat all blocks logical continuity and find usable physical extents in logical range. In this way, si->pages will be actual usable physical blocks and span will be "1 + highest_block - lowest_block". 2. Block device style: Treat all blocks physically continue and only one single extent is added. In this way, si->pages will be si->max and span will be "si->pages - 1". Actually, si->pages and si->max is only used in block device style and span value is set with si->pages. As a result, span value in block device style will become a larger value as you mentioned. I think larger value is correct based on: 1. Span value in filesystem style is "1 + highest_block - lowest_block" which is the range cover all possible phisical blocks including the badblocks. 2. For block device style, si->pages is the actual usable block number and is already in pr_info. The original span value before this patch is also refer to usable block number which is redundant in pr_info. [shikemeng@huaweicloud.com: ensure si->pages == si->max - 1 after setup_swap_extents()] Link: https://lkml.kernel.org/r/20250522122554.12209-3-shikemeng@huaweicloud.com Link: https://lkml.kernel.org/r/20250718065139.61989-1-shikemeng@huaweicloud.com Link: https://lkml.kernel.org/r/20250522122554.12209-3-shikemeng@huaweicloud.com Fixes: 661383c6111a ("mm: swap: relaim the cached parts that got scanned") Signed-off-by: Kemeng Shi Reviewed-by: Baoquan He Cc: Johannes Weiner Cc: Kairui Song Cc: Signed-off-by: Andrew Morton commit 4f78252da887ee7e9d1875dd6e07d9baa936c04f Author: Kemeng Shi Date: Thu May 22 20:25:51 2025 +0800 mm: swap: move nr_swap_pages counter decrement from folio_alloc_swap() to swap_range_alloc() Patch series "Some randome fixes and cleanups to swapfile". Patch 0-3 are some random fixes. Patch 4 is a cleanup. More details can be found in respective patches. This patch (of 4): When folio_alloc_swap() encounters a failure in either mem_cgroup_try_charge_swap() or add_to_swap_cache(), nr_swap_pages counter is not decremented for allocated entry. However, the following put_swap_folio() will increase nr_swap_pages counter unpairly and lead to an imbalance. Move nr_swap_pages decrement from folio_alloc_swap() to swap_range_alloc() to pair the nr_swap_pages counting. Link: https://lkml.kernel.org/r/20250522122554.12209-1-shikemeng@huaweicloud.com Link: https://lkml.kernel.org/r/20250522122554.12209-2-shikemeng@huaweicloud.com Fixes: 0ff67f990bd4 ("mm, swap: remove swap slot cache") Signed-off-by: Kemeng Shi Reviewed-by: Kairui Song Reviewed-by: Baoquan He Cc: Johannes Weiner Cc: Signed-off-by: Andrew Morton commit cc1c6724ebeab32e48cc927405c3d436a6eadc65 Author: SeongJae Park Date: Wed Jul 16 22:54:48 2025 -0700 Docs/ABI/damon: update for refresh_ms Document the new DAMON sysfs file, refresh_ms, on the ABI document. Link: https://lkml.kernel.org/r/20250717055448.56976-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit e85e965bdbec7ebee62c9a843d31175e6cf60052 Author: SeongJae Park Date: Wed Jul 16 22:54:47 2025 -0700 Docs/admin-guide/mm/damon/usage: document refresh_ms file Document the new DAMON sysfs file, refresh_ms, on the usage document. Link: https://lkml.kernel.org/r/20250717055448.56976-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit d809a7c64ba8229286b333c0cba03b1cdfb50238 Author: SeongJae Park Date: Wed Jul 16 22:54:46 2025 -0700 mm/damon/sysfs: implement refresh_ms file internal work Only minimum file operations for refresh_ms file is implemented. Further implement its designed behavior, the periodic essential files content update, using repeat mode damon_call(). If non-zero value is written to the file, update DAMON sysfs files for auto-tuned monitoring intervals, DAMOS stats, and auto-tuned DAMOS quota values, which are essential to be monitored in most DAMON use cases. The user-written non-zero value becomes the time delay between the update. If zero is written to the file, the periodic refresh is disabled. Link: https://lkml.kernel.org/r/20250717055448.56976-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit b907494768e5390ee8282dc138d9d6ba9b971af1 Author: SeongJae Park Date: Wed Jul 16 22:54:45 2025 -0700 mm/damon/sysfs: implement refresh_ms file under kdamond directory Patch series "mm/damon/sysfs: support periodic and automated stats update". DAMON sysfs interface provides files for reading DAMON internal status including auto-tuned monitoring intervals, DAMOS stats, DAMOS action applied regions, and auto-tuned DAMOS effective quota. Among those, auto-tuned monitoring intervals, DAMOS stats and auto-tuned DAMOS effective quota are essential for common DAMON/S use cases. The content of the files are not automatically updated, though. Users should manually request updates of the contents by writing a special command to 'state' file of each kdamond directory. This interface is good for minimizing overhead, but causes the below problems. First, the usage is cumbersome. This is arguably not a big problem, since the user-space tool (damo) can do this instead of the user. Second, it can be too slow. The update request is not directly handled by the sysfs interface but kdamond thread. And kdamond threads wake up only once per the sampling interval. Hence if sampling interval is not short, each update request could take too long time. The recommended sampling interval setup is asking DAMON to automatically tune it, within a range between 5 milliseconds and 10 seconds. On production systems it is not very rare to have a few seconds sampling interval as a result of the auto-tuning, so this can disturb observing DAMON internal status. Finally, parallel update requests can conflict with each other. When parallel update requests are received, DAMON sysfs interface simply returns -EBUSY to one of the requests. DAMON user-space tool is hence implementing its own backoff mechanism, but this can make the operation even slower. Introduce a new sysfs file, namely refresh_ms, for asking DAMON sysfs interface to repeat the update of the above mentioned essential contents with a user-specified time delay. If non-zero value is written to the file, DAMON sysfs interface does the updates for essential DAMON internal status including auto-tuned monitoring intervals, DAMOS stats, and auto-tuned DAMOS quotas using the user-written value as the time delay. In other words, it is similar to periodically writing 'update_schemes_stats', 'update_schemes_effective_quotas', and 'update_tuned_intervals' keywords to the 'state' file. If zero is written to the file, the automatic refresh is disabled. This patch (of 4): Implement a new DAMON sysfs file named 'refresh_ms' under each kdamond directory. The file will be used as a control knob of automatic refresh of a few DAMON internal status files. This commit implements only minimum file operations, though. The automatic refresh feature will be implemented by the following commit. Link: https://lkml.kernel.org/r/20250717055448.56976-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250717055448.56976-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 378bdb97405a00bf03d8d993435c83add1688e36 Author: Kuniyuki Iwashima Date: Thu Jul 17 19:46:43 2025 +0000 memcg: convert memcg->socket_pressure to u64 memcg->socket_pressure is initialised with jiffies when the memcg is created. Once vmpressure detects that the cgroup is under memory pressure, the field is updated with jiffies + HZ to signal the fact to the socket layer and suppress memory allocation for one second. Otherwise, the field is not updated. mem_cgroup_under_socket_pressure() uses time_before() to check if jiffies is less than memcg->socket_pressure, and this has a bug on 32-bit kernel. if (time_before(jiffies, memcg->socket_pressure)) return true; As time_before() casts the final result to long, the acceptable delta between two timestamps is 2 ^ (BITS_PER_LONG - 1). On 32-bit kernel with CONFIG_HZ=1000, this is about 24 days. >>> (2 ** 31) / 1000 / 60 / 60 / 24 24.855134814814818 Once 24 days have passed since the last update of socket_pressure, mem_cgroup_under_socket_pressure() starts to lie until the next 24 days pass. We don't need to worry about this on 64-bit machines unless they serve for 300 million years. >>> (2 ** 63) / 1000 / 60 / 60 / 24 / 365 292471208.6775361 Let's convert memcg->socket_pressure to u64. Performance teting: I don't have a real 32-bit machine so this is a result on QEMU, but with/without the u64 jiffie patch, the time spent in mem_cgroup_under_socket_pressure() was 1~5us and I didn't see any measurable delta. no patch applied: iperf3 273 [000] 137.296248: probe:mem_cgroup_under_socket_pressure: (c13660d0) c13660d1 mem_cgroup_under_socket_pressure+0x1 ([kernel.kallsyms]) iperf3 273 [000] 137.296249: probe:mem_cgroup_under_socket_pressure__return: (c13660d0 <- c1d8fd7f) iperf3 273 [000] 137.296251: probe:mem_cgroup_under_socket_pressure: (c13660d0) c13660d1 mem_cgroup_under_socket_pressure+0x1 ([kernel.kallsyms]) iperf3 273 [000] 137.296253: probe:mem_cgroup_under_socket_pressure__return: (c13660d0 <- c1d8fd7f) u64 jiffies patch applied: iperf3 308 [001] 330.669370: probe:mem_cgroup_under_socket_pressure: (c12ddba0) c12ddba1 mem_cgroup_under_socket_pressure+0x1 ([kernel.kallsyms]) iperf3 308 [001] 330.669371: probe:mem_cgroup_under_socket_pressure__return: (c12ddba0 <- c1ce98bf) iperf3 308 [001] 330.669382: probe:mem_cgroup_under_socket_pressure: (c12ddba0) c12ddba1 mem_cgroup_under_socket_pressure+0x1 ([kernel.kallsyms]) iperf3 308 [001] 330.669384: probe:mem_cgroup_under_socket_pressure__return: (c12ddba0 <- c1ce98bf) So the u64 approach is good enough. Link: https://lkml.kernel.org/r/20250717194645.1096500-1-kuniyu@google.com Fixes: 8e8ae645249b ("mm: memcontrol: hook up vmpressure to socket pressure") Signed-off-by: Kuniyuki Iwashima Reported-by: Neal Cardwell Suggested-by: Andrew Morton Acked-by: Shakeel Butt Acked-by: Johannes Weiner Cc: David S. Miller Cc: Eric Dumazet Cc: Johannes Weiner Cc: Vladimir Davydov Signed-off-by: Andrew Morton commit a9e056de661ccab70476c3002be2a6666b40ca4b Author: Ryan Roberts Date: Mon Jun 9 11:31:30 2025 +0100 mm: remove arch_flush_tlb_batched_pending() arch helper Since commit 4b634918384c ("arm64/mm: Close theoretical race where stale TLB entry remains valid"), all arches that use tlbbatch for reclaim (arm64, riscv, x86) implement arch_flush_tlb_batched_pending() with a flush_tlb_mm(). So let's simplify by removing the unnecessary abstraction and doing the flush_tlb_mm() directly in flush_tlb_batched_pending(). This effectively reverts commit db6c1f6f236d ("mm/tlbbatch: introduce arch_flush_tlb_batched_pending()"). Link: https://lkml.kernel.org/r/20250609103132.447370-1-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Suggested-by: Will Deacon Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Anshuman Khandual Acked-by: Will Deacon Cc: Albert Ou Cc: Alexandre Ghiti Cc: Borislav Betkov Cc: Catalin Marinas Cc: "H. Peter Anvin" Cc: Ingo Molnar Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Rik van Riel Cc: Ryan Roberts Cc: Thomas Gleinxer Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 441413d2a99d1d23bea2df2497493024b00ace57 Author: Anthony Yznaga Date: Tue Jul 15 18:26:11 2025 -0700 mm: drop hugetlb_free_pgd_range() There are no longer any callers of hugetlb_free_pgd_range(). Link: https://lkml.kernel.org/r/20250716012611.10369-4-anthony.yznaga@oracle.com Signed-off-by: Anthony Yznaga Acked-by: Mike Rapoport (Microsoft) Acked-by: Oscar Salvador Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anshuman Khandual Cc: Arnd Bergmann Cc: Christophe Leroy Cc: David Hildenbrand Cc: David S. Miller Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Muchun Song Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 1c7bf6c54572f91c92b7adc1e24f492970f7020d Author: Anthony Yznaga Date: Tue Jul 15 18:26:10 2025 -0700 mm: remove call to hugetlb_free_pgd_range() With the removal of the last arch-specific implementation of hugetlb_free_pgd_range(), hugetlb VMAs no longer need special handling when freeing page tables. Link: https://lkml.kernel.org/r/20250716012611.10369-3-anthony.yznaga@oracle.com Signed-off-by: Anthony Yznaga Acked-by: Mike Rapoport (Microsoft) Acked-by: Oscar Salvador Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anshuman Khandual Cc: Arnd Bergmann Cc: Christophe Leroy Cc: David Hildenbrand Cc: David S. Miller Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Muchun Song Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit d0813985a23c222989136d3156c2ccf91fa03e0e Author: Anthony Yznaga Date: Tue Jul 15 18:26:09 2025 -0700 sparc64: remove hugetlb_free_pgd_range() Patch series "drop hugetlb_free_pgd_range()". For all architectures that support hugetlb except for sparc, hugetlb_free_pgd_range() just calls free_pgd_range(). It turns out the sparc implementation is essentially identical to free_pgd_range() and can be removed. Remove it and update free_pgtables() to treat hugetlb VMAs the same as others. This patch (of 3): The sparc implementation of hugetlb_free_pgd_range() is identical to free_pgd_range() with the exception of checking for and skipping possible leaf entries at the PUD and PMD levels. These checks are unnecessary because any huge pages have been freed and their PTEs cleared by the time page tables needed to map them are freed. While some huge page sizes do populate the page table with multiple PTEs, they are correctly cleared by huge_ptep_get_and_clear(). To verify this, libhugetlbfs tests were run for 64K, 8M, and 256M page sizes with an instrumented kernel on a qemu guest modified to support the 256M page size. The same tests were used to verify no regressions after applying this patch and were also run on x86 for both 2M and 1G page sizes. Link: https://lkml.kernel.org/r/20250716012611.10369-1-anthony.yznaga@oracle.com Link: https://lkml.kernel.org/r/20250716012611.10369-2-anthony.yznaga@oracle.com Signed-off-by: Anthony Yznaga Acked-by: Mike Rapoport (Microsoft) Acked-by: Oscar Salvador Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Andreas Larsson Cc: Anshuman Khandual Cc: Arnd Bergmann Cc: Christophe Leroy Cc: David Hildenbrand Cc: David S. Miller Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Muchun Song Cc: Oscar Salvador Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Will Deacon Signed-off-by: Andrew Morton commit 6344a6d9ce13ae29e3ddf280fd8a1109a77b9996 Author: Hugh Dickins Date: Wed Jul 16 01:08:39 2025 -0700 mm/shmem: writeout free swap if swap_writeout() reactivates If swap_writeout() returns AOP_WRITEPAGE_ACTIVATE (for example, because zswap cannot compress and memcg disables writeback), there is no virtue in keeping that folio in swap cache and holding the swap allocation: shmem_writeout() switch it back to shmem page cache before returning. Folio lock is held, and folio->memcg_data remains set throughout, so there is no need to get into any memcg or memsw charge complications: swap_free_nr() and delete_from_swap_cache() do as much as is needed (but beware the race with shmem_free_swap() when inode truncated or evicted). Doing the same for an anonymous folio is harder, since it will usually have been unmapped, with references to the swap left in the page tables. Adding a function to remap the folio would be fun, but not worthwhile unless it has other uses, or an urgent bug with anon is demonstrated. [hughd@google.com: use shmem_recalc_inode() rather than open coding, per Baolin] Link: https://lkml.kernel.org/r/101a7d89-290c-545d-8a6d-b1174ed8b1e5@google.com Link: https://lkml.kernel.org/r/5c911f7a-af7a-5029-1dd4-2e00b66d565c@google.com Signed-off-by: Hugh Dickins Reviewed-by: Baolin Wang Tested-by: David Rientjes Cc: Baoquan He Cc: Barry Song <21cnbao@gmail.com> Cc: Chris Li Cc: Kairui Song Cc: Kemeng Shi Cc: Shakeel Butt Signed-off-by: Andrew Morton commit ea693aaa5ce5ad9fb124788bcb41d4d24a1d7a02 Author: Hugh Dickins Date: Wed Jul 16 01:05:50 2025 -0700 mm/shmem: hold shmem_swaplist spinlock (not mutex) much less A flamegraph (from an MGLRU load) showed shmem_writeout()'s use of the global shmem_swaplist_mutex worryingly hot: improvement is long overdue. 3.1 commit 6922c0c7abd3 ("tmpfs: convert shmem_writepage and enable swap") apologized for extending shmem_swaplist_mutex across add_to_swap_cache(), and hoped to find another way: yes, there may be lots of work to allocate radix tree nodes in there. Then 6.15 commit b487a2da3575 ("mm, swap: simplify folio swap allocation") will have made it worse, by moving shmem_writeout()'s swap allocation under that mutex too (but the worrying flamegraph was observed even before that change). There's a useful comment about pagelock no longer protecting from eviction once moved to swap cache: but it's good till shmem_delete_from_page_cache() replaces page pointer by swap entry, so move the swaplist add between them. We would much prefer to take the global lock once per inode than once per page: given the possible races with shmem_unuse() pruning when !swapped (and other tasks racing to swap other pages out or in), try the swaplist add whenever swapped was incremented from 0 (but inode may already be on the list - only unuse and evict bother to remove it). This technique is more subtle than it looks (we're avoiding the very lock which would make it easy), but works: whereas an unlocked list_empty() check runs a risk of the inode being unqueued and left off the swaplist forever, swapoff only completing when the page is faulted in or removed. The need for a sleepable mutex went away in 5.1 commit b56a2d8af914 ("mm: rid swapoff of quadratic complexity"): a spinlock works better now. This commit is certain to take shmem_swaplist_mutex out of contention, and has been seen to make a practical improvement (but there is likely to have been an underlying issue which made its contention so visible). Link: https://lkml.kernel.org/r/87beaec6-a3b0-ce7a-c892-1e1e5bd57aa3@google.com Signed-off-by: Hugh Dickins Reviewed-by: Baolin Wang Tested-by: Baolin Wang Tested-by: David Rientjes Reviewed-by: Kairui Song Cc: Baoquan He Cc: Barry Song <21cnbao@gmail.com> Cc: Chris Li Cc: Kemeng Shi Cc: Shakeel Butt Signed-off-by: Andrew Morton commit d53f248258e11e145b773a925ad1a8590ce4618e Author: Lorenzo Stoakes Date: Thu Jul 17 17:56:00 2025 +0100 tools/testing/selftests: extend mremap_test to test multi-VMA mremap Now that we have added the ability to move multiple VMAs at once, assert that this functions correctly, both overwriting VMAs and moving backwards and forwards with merge and VMA invalidation. Additionally assert that page tables are correctly propagated by setting random data and reading it back. Link: https://lkml.kernel.org/r/139074a24a011ca4ed52498a7fa2080024b43917.1752770784.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Peter Xu Cc: Rik van Riel Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit d23cb648e3651b47007d4b17376d0af1fa98515e Author: Lorenzo Stoakes Date: Thu Jul 17 17:55:59 2025 +0100 mm/mremap: permit mremap() move of multiple VMAs Historically we've made it a uAPI requirement that mremap() may only operate on a single VMA at a time. For instances where VMAs need to be resized, this makes sense, as it becomes very difficult to determine what a user actually wants should they indicate a desire to expand or shrink the size of multiple VMAs (truncate? Adjust sizes individually? Some other strategy?). However, in instances where a user is moving VMAs, it is restrictive to disallow this. This is especially the case when anonymous mapping remap may or may not be mergeable depending on whether VMAs have or have not been faulted due to anon_vma assignment and folio index alignment with vma->vm_pgoff. Often this can result in surprising impact where a moved region is faulted, then moved back and a user fails to observe a merge from otherwise compatible, adjacent VMAs. This change allows such cases to work without the user having to be cognizant of whether a prior mremap() move or other VMA operations has resulted in VMA fragmentation. We only permit this for mremap() operations that do NOT change the size of the VMA and DO specify MREMAP_MAYMOVE | MREMAP_FIXED. Should no VMA exist in the range, -EFAULT is returned as usual. If a VMA move spans a single VMA - then there is no functional change. Otherwise, we place additional requirements upon VMAs: * They must not have a userfaultfd context associated with them - this requires dropping the lock to notify users, and we want to perform the operation with the mmap write lock held throughout. * If file-backed, they cannot have a custom get_unmapped_area handler - this might result in MREMAP_FIXED not being honoured, which could result in unexpected positioning of VMAs in the moved region. There may be gaps in the range of VMAs that are moved: X Y X Y <---> <-> <---> <-> |-------| |-----| |-----| |-------| |-----| |-----| | A | | B | | C | ---> | A' | | B' | | C' | |-------| |-----| |-----| |-------| |-----| |-----| addr new_addr The move will preserve the gaps between each VMA. Note that any failures encountered will result in a partial move. Since an mremap() can fail at any time, this might result in only some of the VMAs being moved. Note that failures are very rare and typically require an out of a memory condition or a mapping limit condition to be hit, assuming the VMAs being moved are valid. We don't try to assess ahead of time whether VMAs are valid according to the multi VMA rules, as it would be rather unusual for a user to mix uffd-enabled VMAs and/or VMAs which map unusual driver mappings that specify custom get_unmapped_area() handlers in an aggregate operation. So we optimise for the far, far more likely case of the operation being entirely permissible. In the case of the move of a single VMA, the above conditions are permitted. This makes the behaviour identical for a single VMA as before. Link: https://lkml.kernel.org/r/8cab2f2c202c4208bdfdb562635748bea6eb37bf.1752770784.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Peter Xu Cc: Rik van Riel Signed-off-by: Andrew Morton commit 2cf442d74216bbd441c9446edfefb137804e1739 Author: Lorenzo Stoakes Date: Thu Jul 17 17:55:58 2025 +0100 mm/mremap: clean up mlock populate behaviour When an mlock()'d VMA is expanded, we need to populate the expanded region to maintain the contract that all mlock()'d memory is present (albeit - with some period after mmap unlock where the expanded part of the mapping remains unfaulted). The current implementation is very unclear, so make it absolutely explicit under what circumstances we do this. Link: https://lkml.kernel.org/r/2358b0006baa9cab83db4259817794f16fe1992e.1752770784.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Peter Xu Cc: Rik van Riel Signed-off-by: Andrew Morton commit 9b2301bf8d65ede6038353086a24399386e2d815 Author: Lorenzo Stoakes Date: Thu Jul 17 17:55:57 2025 +0100 mm/mremap: move remap_is_valid() into check_prep_vma() Group parameter check logic together, moving check_mremap_params() next to it. This puts all such checks into a single place, and invokes them early so we can simply bail out as soon as we are aware that a condition is not met. No functional change intended. Link: https://lkml.kernel.org/r/4d0669c23531629d8ead42aa701c6237bd6bf012.1752770784.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Peter Xu Cc: Rik van Riel Signed-off-by: Andrew Morton commit a85dc37186a5842580963496e9718f1ec5bcc0e0 Author: Lorenzo Stoakes Date: Thu Jul 17 17:55:56 2025 +0100 mm/mremap: check remap conditions earlier When we expand or move a VMA, this requires a number of additional checks to be performed. Make it really obvious under what circumstances these checks must be performed and aggregate all the checks in one place by invoking this in check_prep_vma(). We have to adjust the checks to account for shrink + move operations by checking new_len <= old_len rather than new_len == old_len. No functional change intended. [lorenzo.stoakes@oracle.com: allow undocumented mremap() shrink behaviour] Link: https://lkml.kernel.org/r/8fc92a38-c636-465e-9a2f-2c6ac9cb49b8@lucifer.local Link: https://lkml.kernel.org/r/8b4161ce074901e00602a446d81f182db92b0430.1752770784.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Peter Xu Cc: Rik van Riel Signed-off-by: Andrew Morton commit f9f11398d4dac3c85507f31192e318b20b19af61 Author: Lorenzo Stoakes Date: Thu Jul 17 17:55:55 2025 +0100 mm/mremap: use an explicit uffd failure path for mremap Right now it appears that the code is relying upon the returned destination address having bits outside PAGE_MASK to indicate whether an error value is specified, and decrementing the increased refcount on the uffd ctx if so. This is not a safe means of determining an error value, so instead, be specific. It makes far more sense to do so in a dedicated error path, so add mremap_userfaultfd_fail() for this purpose and use this when an error arises. A vm_userfaultfd_ctx is not established until we are at the point where mremap_userfaultfd_prep() is invoked in copy_vma_and_data(), so this is a no-op until this happens. That is - uffd remap notification only occurs if the VMA is actually moved - at which point a UFFD_EVENT_REMAP event is raised. No errors can occur after this point currently, though it's certainly not guaranteed this will always remain the case, and we mustn't rely on this. However, the reason for needing to handle this case is that, when an error arises on a VMA move at the point of adjusting page tables, we revert this operation, and propagate the error. At this point, it is not correct to raise a uffd remap event, and we must handle it. This refactoring makes it abundantly clear what we are doing. We assume vrm->new_addr is always valid, which a prior change made the case even for mremap() invocations which don't move the VMA, however given no uffd context would be set up in this case it's immaterial to this change anyway. No functional change intended. Link: https://lkml.kernel.org/r/a70e8a1f7bce9f43d1431065b414e0f212297297.1752770784.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Peter Xu Cc: Rik van Riel Signed-off-by: Andrew Morton commit e49e76c20ba10e04b257f522e5a086db43d8f1c1 Author: Lorenzo Stoakes Date: Thu Jul 17 17:55:54 2025 +0100 mm/mremap: cleanup post-processing stage of mremap Separate out the uffd bits so it clear's what's happening. Don't bother setting vrm->mmap_locked after unlocking, because after this we are done anyway. The only time we drop the mmap lock is on VMA shrink, at which point vrm->new_len will be < vrm->old_len and the operation will not be performed anyway, so move this code out of the if (vrm->mmap_locked) block. All addresses returned by mremap() are page-aligned, so the offset_in_page() check on ret seems only to be incorrectly trying to detect whether an error occurred - explicitly check for this. No functional change intended. Link: https://lkml.kernel.org/r/ebb8f29650b8e343fe98fefc67b3a61a24d1e0f1.1752770784.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Peter Xu Cc: Rik van Riel Signed-off-by: Andrew Morton commit f256a7a4ca1aad688773fec1bd082a200395a234 Author: Lorenzo Stoakes Date: Thu Jul 17 17:55:53 2025 +0100 mm/mremap: put VMA check and prep logic into helper function Rather than lumping everything together in do_mremap(), add a new helper function, check_prep_vma(), to do the work relating to each VMA. This further lays groundwork for subsequent patches which will allow for batched VMA mremap(). Additionally, if we set vrm->new_addr == vrm->addr when prepping the VMA, this avoids us needing to do so in the expand VMA mlocked case. No functional change intended. Link: https://lkml.kernel.org/r/15efa3c57935f7f8894094b94c1803c2f322c511.1752770784.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Peter Xu Cc: Rik van Riel Signed-off-by: Andrew Morton commit 3215eaceca87625ac5ae4cc5dabfe88ba6e9b183 Author: Lorenzo Stoakes Date: Thu Jul 17 17:55:52 2025 +0100 mm/mremap: refactor initial parameter sanity checks We are currently checking some things later, and some things immediately. Aggregate the checks and avoid ones that need not be made. Simplify things by aligning lengths immediately. Defer setting the delta parameter until later, which removes some duplicate code in the hugetlb case. We can safely perform the checks moved from mremap_to() to check_mremap_params() because: * If we set a new address via vrm_set_new_addr(), then this is guaranteed to not overlap nor to position the new VMA past TASK_SIZE, so there's no need to check these later. * We can simply page align lengths immediately. We do not need to check for overlap nor TASK_SIZE sanity after hugetlb alignment as this asserts addresses are huge-aligned, then huge-aligns lengths, rounding down. This means any existing overlap would have already been caught. Moving things around like this lays the groundwork for subsequent changes to permit operations on batches of VMAs. No functional change intended. Link: https://lkml.kernel.org/r/c862d625c98b1abd861c406f2bfad8baf3287f83.1752770784.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Peter Xu Cc: Rik van Riel Signed-off-by: Andrew Morton commit 000c0691ec6a1804244049b7908911aa5d6e866c Author: Lorenzo Stoakes Date: Thu Jul 17 17:55:51 2025 +0100 mm/mremap: perform some simple cleanups Patch series "mm/mremap: permit mremap() move of multiple VMAs", v4. Historically we've made it a uAPI requirement that mremap() may only operate on a single VMA at a time. For instances where VMAs need to be resized, this makes sense, as it becomes very difficult to determine what a user actually wants should they indicate a desire to expand or shrink the size of multiple VMAs (truncate? Adjust sizes individually? Some other strategy?). However, in instances where a user is moving VMAs, it is restrictive to disallow this. This is especially the case when anonymous mapping remap may or may not be mergeable depending on whether VMAs have or have not been faulted due to anon_vma assignment and folio index alignment with vma->vm_pgoff. Often this can result in surprising impact where a moved region is faulted, then moved back and a user fails to observe a merge from otherwise compatible, adjacent VMAs. This change allows such cases to work without the user having to be cognizant of whether a prior mremap() move or other VMA operations has resulted in VMA fragmentation. In order to do this, this series performs a large amount of refactoring, most pertinently - grouping sanity checks together, separately those that check input parameters and those relating to VMAs. we also simplify the post-mmap lock drop processing for uffd and mlock()'d VMAs. With this done, we can then fairly straightforwardly implement this functionality. This works exclusively for mremap() invocations which specify MREMAP_FIXED. It is not compatible with VMAs which use userfaultfd, as the notification of the userland fault handler would require us to drop the mmap lock. It is also not compatible with file-backed mappings with customised get_unmapped_area() handlers as these may not honour MREMAP_FIXED. The input and output addresses ranges must not overlap. We carefully account for moves which would result in VMA iterator invalidation. While there can be gaps between VMAs in the input range, there can be no gap before the first VMA in the range. This patch (of 10): We const-ify the vrm flags parameter to indicate this will never change. We rename resize_is_valid() to remap_is_valid(), as this function does not only apply to cases where we resize, so it's simply confusing to refer to that here. We remove the BUG() from mremap_at(), as we should not BUG() unless we are certain it'll result in system instability. We rename vrm_charge() to vrm_calc_charge() to make it clear this simply calculates the charged number of pages rather than actually adjusting any state. We update the comment for vrm_implies_new_addr() to explain that MREMAP_DONTUNMAP does not require a set address, but will always be moved. Additionally consistently use 'res' rather than 'ret' for result values. No functional change intended. Link: https://lkml.kernel.org/r/cover.1752770784.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/d35ad8ce6b2c33b2f2f4ef7ec415f04a35cba34f.1752770784.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Liam Howlett Cc: Peter Xu Cc: Rik van Riel Signed-off-by: Andrew Morton commit cfea89210a888d3e51607a99ecc69b3f0c958dda Author: Lorenzo Stoakes Date: Mon Jul 14 14:58:39 2025 +0100 mm/vma: refactor vma_modify_flags_name() to vma_modify_name() The single instance in which we use this function doesn't actually need to change VMA flags, so remove this parameter and update the caller accordingly. [lorenzo.stoakes@oracle.com: correct comment] Link: https://lkml.kernel.org/r/77f45b2e-a748-4635-9381-a5051091087f@lucifer.local Link: https://lkml.kernel.org/r/20250714135839.178032-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Reviewed-by: Liam R. Howlett Cc: Jann Horn Signed-off-by: Andrew Morton commit 3865301dc58aec2ab77651bdbf1e55352f50a608 Author: Hugh Dickins Date: Sun Jul 13 12:57:18 2025 -0700 mm: optimize lru_note_cost() by adding lru_note_cost_unlock_irq() Dropping a lock, just to demand it again for an afterthought, cannot be good if contended: convert lru_note_cost() to lru_note_cost_unlock_irq(). [hughd@google.com: delete unneeded comment] Link: https://lkml.kernel.org/r/dbf9352a-1ed9-a021-c0c7-9309ac73e174@google.com Link: https://lkml.kernel.org/r/21100102-51b6-79d5-03db-1bb7f97fa94c@google.com Signed-off-by: Hugh Dickins Acked-by: Johannes Weiner Reviewed-by: Roman Gushchin Tested-by: Roman Gushchin Reviewed-by: Shakeel Butt Cc: David Hildenbrand Cc: Lorenzo Stoakes Cc: Michal Hocko Signed-off-by: Andrew Morton commit 526660b950a425b9d32798703b839e3c08cdf81b Author: Hao Jia Date: Thu Jul 3 10:39:46 2025 +0800 mm/mglru: stop try_to_inc_min_seq() if min_seq[type] has not increased In try_to_inc_min_seq(), if min_seq[type] has not increased. In other words, min_seq[type] == lrugen->min_seq[type]. Then we should return directly to avoid unnecessary overhead later. Corollary: If min_seq[type] of both anonymous and file is not increased, try_to_inc_min_seq() will fail. Proof: It is known that min_seq[type] has not increased, that is, min_seq[type] is equal to lrugen->min_seq[type], then the following: case 1: min_seq[type] has not been reassigned and changed before judgment min_seq[type] <= lrugen->min_seq[type]. Then the subsequent min_seq[type] <= lrugen->min_seq[type] judgment will always be true. case 2: min_seq[type] is reassigned to seq, before judgment min_seq[type] <= lrugen->min_seq[type]. Then at least the condition of min_seq[type] > seq must be met before min_seq[type] will be reassigned to seq. That is to say, before the reassignment, lrugen->min_seq[type] > seq is met, and then min_seq[type] = seq. Then the following min_seq[type](seq) <= lrugen->min_seq[type] judgment is always true. Therefore, in try_to_inc_min_seq(), If min_seq[type] of both anonymous and file is not increased, we can return false directly to avoid unnecessary overhead. Link: https://lkml.kernel.org/r/20250703023946.65315-1-jiahao.kernel@gmail.com Signed-off-by: Hao Jia Suggested-by: Yuanchu Xie Reviewed-by: Axel Rasmussen Cc: David Hildenbrand Cc: Greg Thelen Cc: Johannes Weiner Cc: Kinsey Ho Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Cc: Yu Zhao Signed-off-by: Andrew Morton commit 51b6f738ebfafba4e309e1cde3e8e1745782f128 Author: Liu Song Date: Mon Jul 21 20:01:38 2025 +0800 scsi: ufs: core: Use str_true_false() helper in UFS_FLAG() Remove hard-coded strings by using the str_true_false() helper function. Signed-off-by: Liu Song Link: https://lore.kernel.org/r/20250721200138431dOU9KyajGyGi5339ma26p@zte.com.cn Reviewed-by: Peter Wang Signed-off-by: Martin K. Petersen commit 37c4e72b0651e7697eb338cd1fb09feef472cc1a Author: Ranjan Kumar Date: Tue Jun 24 11:46:49 2025 +0530 scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans sas_user_scan() did not fully process wildcard channel scans (SCAN_WILD_CARD) when a transport-specific user_scan() callback was present. Only channel 0 would be scanned via user_scan(), while the remaining channels were skipped, potentially missing devices. user_scan() invokes updated sas_user_scan() for channel 0, and if successful, iteratively scans remaining channels (1 to shost->max_channel) via scsi_scan_host_selected(). This ensures complete wildcard scanning without affecting transport-specific scanning behavior. Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/r/20250624061649.17990-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 6e0f6aa44b68335df404a2df955055f416b5f2aa Author: Maurizio Lombardi Date: Mon Jul 14 15:37:38 2025 +0200 scsi: target: core: Generate correct identifiers for PR OUT transport IDs Fix target_parse_pr_out_transport_id() to return a string representing the transport ID in a human-readable format (e.g., naa.xxxxxxxx...) for various SCSI protocol types (SAS, FCP, SRP, SBP). Previously, the function returned a pointer to the raw binary buffer, which was incorrectly compared against human-readable strings, causing comparisons to fail. Now, the function writes a properly formatted string into a buffer provided by the caller. The output format depends on the transport protocol: * SAS: 64-bit identifier, "naa." prefix. * FCP: 64-bit identifier, colon separated values. * SBP: 64-bit identifier, no prefix. * SRP: 128-bit identifier, "0x" prefix. * iSCSI: IQN string. Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20250714133738.11054-1-mlombard@redhat.com Reviewed-by: Dmitry Bogdanov Signed-off-by: Martin K. Petersen commit c8f13134349b4385ae739f1efe403d5d3949ef92 Merge: 407c114c983f6e b25b44cd178cc5 Author: Jakub Kicinski Date: Thu Jul 24 18:55:28 2025 -0700 Merge branch 'selftests-drv-net-tso-fix-issues-with-tso-selftest' Daniel Zahka says: ==================== selftests: drv-net: tso: fix issues with tso selftest There are a couple issues with the tso selftest. - Features required for test cases are detected by searching the set of active features at test start, so if a feature is supported by hw, but disabled, the test will report that the feature under test is not available and fail. - The vxlan test cases do not use the correct ip link flags based on the gso feature under test - The non-tunneled tso6 test case is showing up with the wrong name. With all patches applied test output is: # Detected qstat for LSO wire-packets TAP version 13 1..14 ok 1 tso.ipv4 # Testing with mangleid enabled ok 2 tso.vxlan4_ipv4 ok 3 tso.vxlan4_ipv6 # Testing with mangleid enabled ok 4 tso.vxlan_csum4_ipv4 ok 5 tso.vxlan_csum4_ipv6 # Testing with mangleid enabled ok 6 tso.gre4_ipv4 ok 7 tso.gre4_ipv6 ok 8 tso.ipv6 # Testing with mangleid enabled ok 9 tso.vxlan6_ipv4 ok 10 tso.vxlan6_ipv6 # Testing with mangleid enabled ok 11 tso.vxlan_csum6_ipv4 ok 12 tso.vxlan_csum6_ipv6 # Testing with mangleid enabled ok 13 tso.gre6_ipv4 ok 14 tso.gre6_ipv6 # Totals: pass:14 fail:0 xfail:0 xpass:0 skip:0 error:0 ==================== Link: https://patch.msgid.link/20250723184740.4075410-1-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit b25b44cd178cc54277f2dc0ff3b3d5a37ae4b26b Author: Daniel Zahka Date: Wed Jul 23 11:47:38 2025 -0700 selftests: drv-net: tso: fix non-tunneled tso6 test case name The non-tunneled tso6 test case was showing up as: ok 8 tso.ipv4 This is because of the way test_builder() uses the inner_ipver arg in test naming, and how test_info is iterated over in main(). Given that some tunnels not supported yet, e.g. ipip or sit, only support ipv4 or ipv6 as the inner network protocol, I think the best fix here is to call test_builder() in separate branches for tunneled and non-tunneled tests, and to make supported inner l3 types an explicit attribute of tunnel test cases. # Detected qstat for LSO wire-packets TAP version 13 1..14 ok 1 tso.ipv4 # Testing with mangleid enabled ok 2 tso.vxlan4_ipv4 ok 3 tso.vxlan4_ipv6 # Testing with mangleid enabled ok 4 tso.vxlan_csum4_ipv4 ok 5 tso.vxlan_csum4_ipv6 # Testing with mangleid enabled ok 6 tso.gre4_ipv4 ok 7 tso.gre4_ipv6 ok 8 tso.ipv6 # Testing with mangleid enabled ok 9 tso.vxlan6_ipv4 ok 10 tso.vxlan6_ipv6 # Testing with mangleid enabled ok 11 tso.vxlan_csum6_ipv4 ok 12 tso.vxlan_csum6_ipv6 # Testing with mangleid enabled ok 13 tso.gre6_ipv4 ok 14 tso.gre6_ipv6 # Totals: pass:14 fail:0 xfail:0 xpass:0 skip:0 error:0 Fixes: 0d0f4174f6c8 ("selftests: drv-net: add a simple TSO test") Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250723184740.4075410-4-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 2cfbcc5d8af9199823151c21f740e476b223dd2e Author: Daniel Zahka Date: Wed Jul 23 11:47:37 2025 -0700 selftests: drv-net: tso: fix vxlan tunnel flags to get correct gso_type When vxlan is used with ipv6 as the outer network header, the correct ip link parameters for acheiving the SKB_GSO_UDP_TUNNEL gso type is "udp6zerocsumtx udp6zerocsumrx". Otherwise the gso type will be SKB_GSO_UDP_TUNNEL_CSUM. This bug was the reason for the second of the three possible invocations of run_one_stream() invocations, so that can be deleted as well. We only need to test with the feature off and on. Fixes: 0d0f4174f6c8 ("selftests: drv-net: add a simple TSO test") Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250723184740.4075410-3-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 266b835e5e84a0f8fec7fd988ee81925890e8d89 Author: Daniel Zahka Date: Wed Jul 23 11:47:36 2025 -0700 selftests: drv-net: tso: enable test cases based on hw_features tso.py uses the active features at the time of test execution as the set of available gso features to test. This means if a gso feature is supported but toggled off at test start, the test will be skipped with a "Device does not support {feature}" message. Instead, we can enumerate the set of toggleable features by capturing the driver's hw_features bitmap. To avoid configuration side-effects from running the test, we also snapshot the wanted_features flag set before making any feature changes, and then attempt to restore the same set of wanted_features before test exit. Fixes: 0d0f4174f6c8 ("selftests: drv-net: add a simple TSO test") Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20250723184740.4075410-2-daniel.zahka@gmail.com Signed-off-by: Jakub Kicinski commit 220e6083e8bdc11c414c2a44643f739d5c826d7b Author: Yihang Li Date: Wed Jul 2 09:24:23 2025 +0800 scsi: MAINTAINERS: Update hisi_sas entry liyihang9@huawei.com no longer works. So update information for hisi_sas. Signed-off-by: Yihang Li Link: https://lore.kernel.org/r/20250702012423.1947238-1-liyihang9@h-partners.com Acked-by: Wei Xu Signed-off-by: Martin K. Petersen commit faa60990a5414e5a1957adc9434ca0e804ad700b Merge: 4335012705499a d74cd9a02f020a Author: Jakub Kicinski Date: Thu Jul 24 18:52:02 2025 -0700 Merge branch 'selftests-drv-net-fix-and-improve-command-requirement-checking' Gal Pressman says: ==================== selftests: drv-net: Fix and improve command requirement checking This series fixes remote command checking and cleans up command requirement calls across tests. The first patch fixes require_cmd() incorrectly checking commands locally even when remote=True was specified due to a missing host parameter. The second patch makes require_cmd() usage explicit about local/remote requirements, avoiding unnecessary test failures and consolidating duplicate calls. ==================== Link: https://patch.msgid.link/20250723135454.649342-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit d74cd9a02f020a6263b12a4c9e0f846b679a2f13 Author: Gal Pressman Date: Wed Jul 23 16:54:54 2025 +0300 selftests: drv-net: Make command requirements explicit Make require_cmd() calls explicit about whether commands are needed locally, remotely, or both. Since require_cmd() defaults to local=True, tests should explicitly set local=False when commands are only needed remotely. - socat: Set local=False since it's only needed on remote hosts. - iperf3: Use single call with both local=True and remote=True since it's needed on both hosts. This avoids unnecessary test failures when commands are missing locally but available remotely where actually needed, and consolidates a duplicate require_cmd() call into single call that checks both hosts. Fixes: 0d0f4174f6c8 ("selftests: drv-net: add a simple TSO test") Fixes: f1e68a1a4a40 ("selftests: drv-net: add require_XYZ() helpers for validating env") Fixes: c76bab22e920 ("selftests: drv-net: rss_input_xfrm: Check test prerequisites before running") Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20250723135454.649342-3-gal@nvidia.com Signed-off-by: Jakub Kicinski commit b4d52c698210ae1a3ceb487b189701bc70551a48 Author: Gal Pressman Date: Wed Jul 23 16:54:53 2025 +0300 selftests: drv-net: Fix remote command checking in require_cmd() The require_cmd() method was checking for command availability locally even when remote=True was specified, due to a missing host parameter. Fix by passing host=self.remote when checking remote command availability, ensuring commands are verified on the correct host. Fixes: f1e68a1a4a40 ("selftests: drv-net: add require_XYZ() helpers for validating env") Reviewed-by: Nimrod Oren Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20250723135454.649342-2-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 4335012705499aa24cec714ab746c0d3abf97cab Author: Zhu Yanjun Date: Tue Jul 22 14:20:23 2025 -0700 net/mlx5: Fix build -Wframe-larger-than warnings When building, the following warnings will appear. " pci_irq.c: In function ‘mlx5_ctrl_irq_request’: pci_irq.c:494:1: warning: the frame size of 1040 bytes is larger than 1024 bytes [-Wframe-larger-than=] pci_irq.c: In function ‘mlx5_irq_request_vector’: pci_irq.c:561:1: warning: the frame size of 1040 bytes is larger than 1024 bytes [-Wframe-larger-than=] eq.c: In function ‘comp_irq_request_sf’: eq.c:897:1: warning: the frame size of 1080 bytes is larger than 1024 bytes [-Wframe-larger-than=] irq_affinity.c: In function ‘irq_pool_request_irq’: irq_affinity.c:74:1: warning: the frame size of 1048 bytes is larger than 1024 bytes [-Wframe-larger-than=] " These warnings indicate that the stack frame size exceeds 1024 bytes in these functions. To resolve this, instead of allocating large memory buffers on the stack, it is better to use kvzalloc to allocate memory dynamically on the heap. This approach reduces stack usage and eliminates these frame size warnings. Acked-by: Junxian Huang Signed-off-by: Zhu Yanjun Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/20250722212023.244296-1-yanjun.zhu@linux.dev Signed-off-by: Jakub Kicinski commit 7ffbf335e325ed3f36ebcfed8149a8d0d7e20076 Author: Mike Christie Date: Mon Jul 21 13:51:45 2025 -0500 scsi: target: iblock: Allow iblock devices to be shared We might be running a local application that also interacts with the backing device. In this setup we have some clustering type of software that manages the ownwer of it, so we don't want the kernel to restrict us. This patch allows the user to control if the driver gets exclusive access. Signed-off-by: Mike Christie Link: https://lore.kernel.org/r/20250721185145.20913-1-michael.christie@oracle.com Signed-off-by: Martin K. Petersen commit 35dabf4503b94a697bababe94678a8bc989c3223 Author: Seunghui Lee Date: Thu Jul 17 17:12:13 2025 +0900 scsi: ufs: core: Use link recovery when h8 exit fails during runtime resume If the h8 exit fails during runtime resume process, the runtime thread enters runtime suspend immediately and the error handler operates at the same time. It becomes stuck and cannot be recovered through the error handler. To fix this, use link recovery instead of the error handler. Fixes: 4db7a2360597 ("scsi: ufs: Fix concurrency of error handler and other error recovery paths") Signed-off-by: Seunghui Lee Link: https://lore.kernel.org/r/20250717081213.6811-1-sh043.lee@samsung.com Reviewed-by: Bean Huo Acked-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 89628a0ec78718481d75d6a5d49c47862cd28d44 Merge: d2002ccb47dd3b 8e7583a4f65f3d Author: Jakub Kicinski Date: Thu Jul 24 18:34:59 2025 -0700 Merge branch 'use-enum-to-represent-the-napi-threaded-state' Samiullah Khawaja says: ==================== Use enum to represent the NAPI threaded state Instead of using 0/1 to represent the NAPI threaded states use enum (disabled/enabled) to represent the NAPI threaded states. This patch series is a subset of patches from the following patch series: https://lore.kernel.org/20250718232052.1266188-1-skhawaja@google.com The first 3 patches are being sent separately as per the feedback to replace the usage of 0/1 as NAPI threaded states with enum. See: https://lore.kernel.org/20250721164856.1d2208e4@kernel.org ==================== Link: https://patch.msgid.link/20250723013031.2911384-1-skhawaja@google.com Signed-off-by: Jakub Kicinski commit 8e7583a4f65f3dbf3e8deb4e60f3679c276bef62 Author: Samiullah Khawaja Date: Wed Jul 23 01:30:31 2025 +0000 net: define an enum for the napi threaded state Instead of using '0' and '1' for napi threaded state use an enum with 'disabled' and 'enabled' states. Tested: ./tools/testing/selftests/net/nl_netdev.py TAP version 13 1..7 ok 1 nl_netdev.empty_check ok 2 nl_netdev.lo_check ok 3 nl_netdev.page_pool_check ok 4 nl_netdev.napi_list_check ok 5 nl_netdev.dev_set_threaded ok 6 nl_netdev.napi_set_threaded ok 7 nl_netdev.nsim_rxq_reset_down # Totals: pass:7 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Samiullah Khawaja Link: https://patch.msgid.link/20250723013031.2911384-4-skhawaja@google.com Signed-off-by: Jakub Kicinski commit 78afdadafe6fe0c74c08fda156e7be0a0b402b90 Author: Samiullah Khawaja Date: Wed Jul 23 01:30:30 2025 +0000 net: Use netif_threaded_enable instead of netif_set_threaded in drivers Prepare for adding an enum type for NAPI threaded states by adding netif_threaded_enable API. De-export the existing netif_set_threaded API and only use it internally. Update existing drivers to use netif_threaded_enable instead of the de-exported netif_set_threaded. Note that dev_set_threaded used by mt76 debugfs file is unchanged. Signed-off-by: Samiullah Khawaja Link: https://patch.msgid.link/20250723013031.2911384-3-skhawaja@google.com Signed-off-by: Jakub Kicinski commit 71c52411c51bf4f0869c572294ce8123b26528d5 Author: Samiullah Khawaja Date: Wed Jul 23 01:30:29 2025 +0000 net: Create separate gro_flush_normal function Move multiple copies of same code snippet doing `gro_flush` and `gro_normal_list` into separate helper function. Signed-off-by: Samiullah Khawaja Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250723013031.2911384-2-skhawaja@google.com Signed-off-by: Jakub Kicinski commit 8c4e53a1a09374c232fe96232426226b2824f473 Author: Steven Rostedt Date: Wed Jul 23 15:41:45 2025 -0400 tracing: Call trace_ftrace_test_filter() for the event The trace event filter bootup self test tests a bunch of filter logic against the ftrace_test_filter event, but does not actually call the event. Work is being done to cause a warning if an event is defined but not used. To quiet the warning call the trace event under an if statement where it is disabled so it doesn't get optimized out. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Arnd Bergmann Cc: Masahiro Yamada Cc: Nathan Chancellor Cc: Nicolas Schier Cc: Nick Desaulniers Cc: Catalin Marinas Cc: Linus Torvalds Link: https://lore.kernel.org/20250723194212.274458858@kernel.org Signed-off-by: Steven Rostedt (Google) commit 7bdc68921481c19cd8c85ddf805a834211c19e61 Author: Li Lingfeng Date: Tue Jul 15 15:39:26 2025 +0800 scsi: Revert "scsi: iscsi: Fix HW conn removal use after free" This reverts commit c577ab7ba5f3bf9062db8a58b6e89d4fe370447e. The invocation of iscsi_put_conn() in iscsi_iter_destory_conn_fn() is used to free the initial reference counter of iscsi_cls_conn. For non-qla4xxx cases, the ->destroy_conn() callback (e.g., iscsi_conn_teardown) will call iscsi_remove_conn() and iscsi_put_conn() to remove the connection from the children list of session and free the connection at last. However for qla4xxx, it is not the case. The ->destroy_conn() callback of qla4xxx will keep the connection in the session conn_list and doesn't use iscsi_put_conn() to free the initial reference counter. Therefore, it seems necessary to keep the iscsi_put_conn() in the iscsi_iter_destroy_conn_fn(), otherwise, there will be memory leak problem. Link: https://lore.kernel.org/all/88334658-072b-4b90-a949-9c74ef93cfd1@huawei.com/ Fixes: c577ab7ba5f3 ("scsi: iscsi: Fix HW conn removal use after free") Signed-off-by: Li Lingfeng Link: https://lore.kernel.org/r/20250715073926.3529456-1-lilingfeng3@huawei.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen commit dafeaf2c03e71255438ffe5a341d94d180e6c88e Author: John Garry Date: Tue Jul 15 11:15:35 2025 +0000 scsi: aacraid: Stop using PCI_IRQ_AFFINITY When PCI_IRQ_AFFINITY is set for calling pci_alloc_irq_vectors(), it means interrupts are spread around the available CPUs. It also means that the interrupts become managed, which means that an interrupt is shutdown when all the CPUs in the interrupt affinity mask go offline. Using managed interrupts in this way means that we should ensure that completions should not occur on HW queues where the associated interrupt is shutdown. This is typically achieved by ensuring only CPUs which are online can generate IO completion traffic to the HW queue which they are mapped to (so that they can also serve completion interrupts for that HW queue). The problem in the driver is that a CPU can generate completions to a HW queue whose interrupt may be shutdown, as the CPUs in the HW queue interrupt affinity mask may be offline. This can cause IOs to never complete and hang the system. The driver maintains its own CPU <-> HW queue mapping for submissions, see aac_fib_vector_assign(), but this does not reflect the CPU <-> HW queue interrupt affinity mapping. Commit 9dc704dcc09e ("scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity") tried to remedy this issue may mapping CPUs properly to HW queue interrupts. However this was later reverted in commit c5becf57dd56 ("Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity") - it seems that there were other reports of hangs. I guess that this was due to some implementation issue in the original commit or maybe a HW issue. Fix the very original hang by just not using managed interrupts by not setting PCI_IRQ_AFFINITY. In this way, all CPUs will be in each HW queue affinity mask, so should not create completion problems if any CPUs go offline. Signed-off-by: John Garry Link: https://lore.kernel.org/r/20250715111535.499853-1-john.g.garry@oracle.com Closes: https://lore.kernel.org/linux-scsi/20250618192427.3845724-1-jmeneghi@redhat.com/ Reviewed-by: John Meneghini Tested-by: John Meneghini Signed-off-by: Martin K. Petersen commit d2002ccb47dd3bf6102d06c8e5062ccfdd31ce28 Merge: a4f5759b6f0a87 a7bcffc673de21 Author: Jakub Kicinski Date: Thu Jul 24 18:12:54 2025 -0700 Merge tag 'for-net-next-2025-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next Luiz Augusto von Dentz says: ==================== bluetooth-next pull request for net-next: core: - hci_sync: fix double free in 'hci_discovery_filter_clear()' - hci_event: Mask data status from LE ext adv reports - hci_devcd_dump: fix out-of-bounds via dev_coredumpv - ISO: add socket option to report packet seqnum via CMSG - hci_event: Add support for handling LE BIG Sync Lost event - ISO: Support SCM_TIMESTAMPING for ISO TS - hci_core: Add PA_LINK to distinguish BIG sync and PA sync connections - hci_sock: Reset cookie to zero in hci_sock_free_cookie() drivers: - btusb: Add new VID/PID 0489/e14e for MT7925 - btusb: Add a new VID/PID 2c7c/7009 for MT7925 - btusb: Add RTL8852BE device 0x13d3:0x3618 - btusb: Add support for variant of RTL8851BE (USB ID 13d3:3601) - btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano - btusb: QCA: Support downloading custom-made firmwares - btusb: Add one more ID 0x28de:0x1401 for Qualcomm WCN6855 - nxp: add support for supply and reset - btnxpuart: Add support for 4M baudrate - btnxpuart: Correct the Independent Reset handling after FW dump - btnxpuart: Add uevents for FW dump and FW download complete - btintel: Define a macro for Intel Reset vendor command - btintel_pcie: Support Function level reset - btintel_pcie: Add support for device 0x4d76 - btintel_pcie: Make driver wait for alive interrupt - btintel_pcie: Fix Alive Context State Handling - hci_qca: Enable ISO data packet RX * tag 'for-net-next-2025-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next: (42 commits) Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections Bluetooth: hci_event: Mask data status from LE ext adv reports Bluetooth: btintel_pcie: Fix Alive Context State Handling Bluetooth: btintel_pcie: Make driver wait for alive interrupt Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' Bluetooth: btusb: Add one more ID 0x28de:0x1401 for Qualcomm WCN6855 Bluetooth: btusb: Sort WCN6855 device IDs by VID and PID Bluetooth: btusb: QCA: Support downloading custom-made firmwares Bluetooth: btnxpuart: Add uevents for FW dump and FW download complete Bluetooth: btnxpuart: Correct the Independent Reset handling after FW dump Bluetooth: ISO: Support SCM_TIMESTAMPING for ISO TS Bluetooth: ISO: add socket option to report packet seqnum via CMSG Bluetooth: btintel: Define a macro for Intel Reset vendor command Bluetooth: Fix typos in comments Bluetooth: RFCOMM: Fix typos in comments Bluetooth: aosp: Fix typo in comment Bluetooth: hci_bcm4377: Fix typo in comment Bluetooth: btrtl: Fix typo in comment Bluetooth: btmtk: Fix typo in log string ... ==================== Link: https://patch.msgid.link/20250723190233.166823-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski commit 33b3120cb20fde80bf601413b635f957c46ad631 Author: Konrad Dybcio Date: Thu Jul 24 14:23:52 2025 +0200 scsi: ufs: qcom: Drop dead compile guard SCSI_UFSHCD already selects DEVFREQ_GOV_SIMPLE_ONDEMAND, drop the check. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250724-topic-ufs_compile_check-v1-1-5ba9e99dbd52@oss.qualcomm.com Reviewed-by: Dmitry Baryshkov Signed-off-by: Martin K. Petersen commit 3e90b38781e3bdd651edaf789585687611638862 Author: Tomas Henzl Date: Wed Jul 23 17:30:18 2025 +0200 scsi: mpt3sas: Fix a fw_event memory leak In _mpt3sas_fw_work() the fw_event reference is removed, it should also be freed in all cases. Fixes: 4318c7347847 ("scsi: mpt3sas: Handle NVMe PCIe device related events generated from firmware.") Signed-off-by: Tomas Henzl Link: https://lore.kernel.org/r/20250723153018.50518-1-thenzl@redhat.com Acked-by: Sathya Prakash Veerichetty Signed-off-by: Martin K. Petersen commit a4f5759b6f0a875d5b223c99233b2f5db8bec2b9 Merge: 7dba0cc93c5a2c ba578b87fe2bee Author: Jakub Kicinski Date: Thu Jul 24 18:02:23 2025 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Martin KaFai Lau says: ==================== pull-request: bpf-next 2025-07-24 We've added 3 non-merge commits during the last 3 day(s) which contain a total of 4 files changed, 40 insertions(+), 15 deletions(-). The main changes are: 1) Improved verifier error message for incorrect narrower load from pointer field in ctx, from Paul Chaignon. 2) Disabled migration in nf_hook_run_bpf to address a syzbot report, from Kuniyuki Iwashima. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: selftests/bpf: Test invalid narrower ctx load bpf: Reject narrower access to pointer ctx fields bpf: Disable migration in nf_hook_run_bpf(). ==================== Link: https://patch.msgid.link/20250724173306.3578483-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski commit 7dba0cc93c5a2cda7a96667e76ee45c84f952257 Merge: 126d85fb040559 f70d9819c779fd Author: Jakub Kicinski Date: Thu Jul 24 17:28:52 2025 -0700 Merge branch 'tools-ynl-gen-print-setters-for-multi-val-attrs' Jakub Kicinski says: ==================== tools: ynl-gen: print setters for multi-val attrs ncdevmem seems to manually prepare the queue attributes. This is not ideal, YNL should be providing helpers for this. Make YNL output allocation and setter helpers for multi-val attrs. v1: https://lore.kernel.org/20250722161927.3489203-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250723171046.4027470-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f70d9819c779fd9eae04c38b1997b3224a5b0fe7 Author: Jakub Kicinski Date: Wed Jul 23 10:10:46 2025 -0700 selftests: drv-net: devmem: use new mattr ynl helpers Use the just-added YNL helpers instead of manually setting "_present" bits in the queue attrs. Compile tested only. Reviewed-by: Donald Hunter Acked-by: Stanislav Fomichev Acked-by: Mina Almasry Link: https://patch.msgid.link/20250723171046.4027470-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8553fb7c555c15f32ebbc5d032f35589e970e206 Author: Jakub Kicinski Date: Wed Jul 23 10:10:45 2025 -0700 tools: ynl-gen: print setters for multi-val attrs For basic types we "flatten" setters. If a request "a" has a simple nest "b" with value "val" we print helpers like: req_set_a_b(struct a *req, int val) { req->_present.a = 1; req->b._present.val = 1; req->b.val = ... } This is not possible for multi-attr because they have to be allocated dynamically by the user. Print "object level" setters so that user preparing the object doesn't have to futz with the presence bits and other YNL internals. Add the ability to pass in the variable name to generated setters. Using "req" here doesn't feel right, while the attr is part of a request it's not the request itself, so it seems cleaner to call it "obj". Example: static inline void netdev_queue_id_set_id(struct netdev_queue_id *obj, __u32 id) { obj->_present.id = 1; obj->id = id; } Reviewed-by: Donald Hunter Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250723171046.4027470-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2c222dde61c4fcb8693d31acf5ef8e342fda4c26 Author: Jakub Kicinski Date: Wed Jul 23 10:10:44 2025 -0700 tools: ynl-gen: print alloc helper for multi-val attrs In general YNL provides allocation and free helpers for types. For pure nested structs which are used as multi-attr (and therefore have to be allocated dynamically) we already print a free helper as it's needed by free of the containing struct. Add printing of the alloc helper for consistency. The helper takes the number of entries to allocate as an argument, e.g.: static inline struct netdev_queue_id *netdev_queue_id_alloc(unsigned int n) { return calloc(n, sizeof(struct netdev_queue_id)); } Reviewed-by: Donald Hunter Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250723171046.4027470-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit cf5869977702b1d51e3b4d58b6c559a98a366114 Author: Jakub Kicinski Date: Wed Jul 23 10:10:43 2025 -0700 tools: ynl-gen: move free printing to the print_type_full() helper Just to avoid making the main function even more enormous, before adding more things to print move the free printing to a helper which already prints the type. Reviewed-by: Donald Hunter Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250723171046.4027470-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a8a9fd042e0995ed63d33f507c26baf56031e581 Author: Jakub Kicinski Date: Wed Jul 23 10:10:42 2025 -0700 tools: ynl-gen: don't add suffix for pure types Don't add _req to helper names for pure types. We don't currently print those so it makes no difference to existing codegen. Reviewed-by: Donald Hunter Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250723171046.4027470-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 126d85fb040559ba6654f51c0b587d280b041abb Merge: 8b5a19b4ff6a20 55c172c13718b9 Author: Jakub Kicinski Date: Thu Jul 24 17:25:42 2025 -0700 Merge tag 'wireless-next-2025-07-24' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Another wireless update: - rtw89: - STA+P2P concurrency - support for USB devices RTL8851BU/RTL8852BU - ath9k: OF support - ath12k: - more EHT/Wi-Fi 7 features - encapsulation/decapsulation offload - iwlwifi: some FIPS interoperability - brcm80211: support SDIO 43751 device - rt2x00: better DT/OF support - cfg80211/mac80211: - improved S1G support - beacon monitor for MLO * tag 'wireless-next-2025-07-24' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (199 commits) ssb: use new GPIO line value setter callbacks for the second GPIO chip wifi: Fix typos wifi: brcmsmac: Use str_true_false() helper wifi: brcmfmac: fix EXTSAE WPA3 connection failure due to AUTH TX failure wifi: brcm80211: Remove yet more unused functions wifi: brcm80211: Remove more unused functions wifi: brcm80211: Remove unused functions wifi: iwlwifi: Revert "wifi: iwlwifi: remove support of several iwl_ppag_table_cmd versions" wifi: iwlwifi: check validity of the FW API range wifi: iwlwifi: don't export symbols that we shouldn't wifi: iwlwifi: mld: use spec link id and not FW link id wifi: iwlwifi: mld: decode EOF bit for AMPDUs wifi: iwlwifi: Remove support for rx OMI bandwidth reduction wifi: iwlwifi: stop supporting iwl_omi_send_status_notif ver 1 wifi: iwlwifi: remove SC2F firmware support wifi: iwlwifi: mvm: Remove NAN support wifi: iwlwifi: mld: avoid outdated reorder buffer head_sn wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn wifi: iwlwifi: disable certain features for fips_enabled wifi: iwlwifi: mld: support channel survey collection for ACS scans ... ==================== Link: https://patch.msgid.link/20250724100349.21564-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 8245d47cfaba8a38337a447230b4d01f9946f5e1 Author: Kees Cook Date: Wed Jul 23 22:50:26 2025 -0700 x86: Handle KCOV __init vs inline mismatches GCC appears to have kind of fragile inlining heuristics, in the sense that it can change whether or not it inlines something based on optimizations. It looks like the kcov instrumentation being added (or in this case, removed) from a function changes the optimization results, and some functions marked "inline" are _not_ inlined. In that case, we end up with __init code calling a function not marked __init, and we get the build warnings I'm trying to eliminate in the coming patch that adds __no_sanitize_coverage to __init functions: WARNING: modpost: vmlinux: section mismatch in reference: xbc_exit+0x8 (section: .text.unlikely) -> _xbc_exit (section: .init.text) WARNING: modpost: vmlinux: section mismatch in reference: real_mode_size_needed+0x15 (section: .text.unlikely) -> real_mode_blob_end (section: .init.data) WARNING: modpost: vmlinux: section mismatch in reference: __set_percpu_decrypted+0x16 (section: .text.unlikely) -> early_set_memory_decrypted (section: .init.text) WARNING: modpost: vmlinux: section mismatch in reference: memblock_alloc_from+0x26 (section: .text.unlikely) -> memblock_alloc_try_nid (section: .init.text) WARNING: modpost: vmlinux: section mismatch in reference: acpi_arch_set_root_pointer+0xc (section: .text.unlikely) -> x86_init (section: .init.data) WARNING: modpost: vmlinux: section mismatch in reference: acpi_arch_get_root_pointer+0x8 (section: .text.unlikely) -> x86_init (section: .init.data) WARNING: modpost: vmlinux: section mismatch in reference: efi_config_table_is_usable+0x16 (section: .text.unlikely) -> xen_efi_config_table_is_usable (section: .init.text) This problem is somewhat fragile (though using either __always_inline or __init will deterministically solve it), but we've tripped over this before with GCC and the solution has usually been to just use __always_inline and move on. For x86 this means forcing several functions to be inline with __always_inline. Link: https://lore.kernel.org/r/20250724055029.3623499-2-kees@kernel.org Signed-off-by: Kees Cook commit 65c430906efffee9bd7551d474f01a6b1197df90 Author: Kees Cook Date: Wed Jul 23 22:50:25 2025 -0700 arm64: Handle KCOV __init vs inline mismatches GCC appears to have kind of fragile inlining heuristics, in the sense that it can change whether or not it inlines something based on optimizations. It looks like the kcov instrumentation being added (or in this case, removed) from a function changes the optimization results, and some functions marked "inline" are _not_ inlined. In that case, we end up with __init code calling a function not marked __init, and we get the build warnings I'm trying to eliminate in the coming patch that adds __no_sanitize_coverage to __init functions: WARNING: modpost: vmlinux: section mismatch in reference: acpi_get_enable_method+0x1c (section: .text.unlikely) -> acpi_psci_present (section: .init.text) This problem is somewhat fragile (though using either __always_inline or __init will deterministically solve it), but we've tripped over this before with GCC and the solution has usually been to just use __always_inline and move on. For arm64 this requires forcing one ACPI function to be inlined with __always_inline. Link: https://lore.kernel.org/r/20250724055029.3623499-1-kees@kernel.org Signed-off-by: Kees Cook commit 65df390bc2a7351c4bca123c62e853b35a215297 Author: Pei Xiao Date: Wed Jul 9 15:37:14 2025 +0800 clk: tegra: periph: Make tegra_clk_periph_ops static Reduce symbol visibility by converting tegra_clk_periph_ops to static. Removed the extern declaration from clk.h as the symbol is now locally scoped to clk-periph.c. Signed-off-by: Pei Xiao Link: https://lore.kernel.org/r/bda59ad46afae6e7484edf8e2f7bf23ceafe51e9.1752046270.git.xiaopei01@kylinos.cn Acked-by: Thierry Reding Signed-off-by: Stephen Boyd commit 2dc2ca9000eea2eb749f658196204cb84d4306f7 Author: Pei Xiao Date: Wed Jul 9 15:37:13 2025 +0800 clk: tegra: periph: Fix error handling and resolve unsigned compare warning ./drivers/clk/tegra/clk-periph.c:59:5-9: WARNING: Unsigned expression compared with zero: rate < 0 The unsigned long 'rate' variable caused: - Incorrect handling of negative errors - Compile warning: "Unsigned expression compared with zero" Fix by changing to long type and adding req->rate cast. Signed-off-by: Pei Xiao Link: https://lore.kernel.org/r/79c7f01e29876c612e90d6d0157fb1572ca8b3fb.1752046270.git.xiaopei01@kylinos.cn Acked-by: Thierry Reding Signed-off-by: Stephen Boyd commit ba6651a768a1a1e1b3d75413f11e5354da7554c9 Author: Brian Masney Date: Thu Jul 10 17:10:45 2025 -0400 clk: imx: scu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. This driver also implements both the determine_rate() and round_rate() clk ops, and the round_rate() clk ops is deprecated. When both are defined, clk_core_determine_round_nolock() from the clk core will only use the determine_rate() clk ops, so let's remove the round_rate() clk ops since it's unused. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-13-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit 62021be5fcb1bb85d0b35252c18d701ab16aed36 Author: Brian Masney Date: Thu Jul 10 17:10:44 2025 -0400 clk: imx: pllv4: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-12-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit b2826d2252cee45b4ee8c067c91a919bdf553f26 Author: Brian Masney Date: Thu Jul 10 17:10:43 2025 -0400 clk: imx: pllv3: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-11-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit bf7046620975d39ffb084fbad3c0c1f0dec25141 Author: Brian Masney Date: Thu Jul 10 17:10:42 2025 -0400 clk: imx: pllv2: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-10-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit c677a5a0eeb1accb437e26279b288423cda09592 Author: Brian Masney Date: Thu Jul 10 17:10:41 2025 -0400 clk: imx: pll14xx: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-9-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit 341bdb9cf509385a0992363dedcde775e9bc8173 Author: Brian Masney Date: Thu Jul 10 17:10:40 2025 -0400 clk: imx: pfd: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-8-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit 6d50f953f75e76d81253647449570969e37a7bad Author: Brian Masney Date: Thu Jul 10 17:10:39 2025 -0400 clk: imx: frac-pll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-7-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit 6534f1a7c1e5a24c021ad1d3c0f95907105b0ff2 Author: Brian Masney Date: Thu Jul 10 17:10:38 2025 -0400 clk: imx: fracn-gppll: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-6-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit eb7a49208c3d7d1596d4c25072875e144e84a3ef Author: Brian Masney Date: Thu Jul 10 17:10:37 2025 -0400 clk: imx: fixup-div: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to call fixup_div->ops->determine_rate() instead of fixup_div->ops->round_rate() was done by hand. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-5-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit 7379907e241d85803efc1d9eb27c28a6322e274f Merge: 1032fa556c37c5 6776ecc9dd587c Author: Mark Brown Date: Thu Jul 24 23:17:01 2025 +0100 ASoC: fsl_xcvr: get channel status data in two cases Merge series from Shengjiu Wang : There is two different cases for getting channel status data: 1. With PHY exists, there is firmware running on M core, the firmware should fill the channel status to RAM space, driver need to read them from RAM. 2. Without PHY, the channel status need to be obtained from registers. commit 68a33129d7471619adf774be25356015827d173e Author: Brian Masney Date: Thu Jul 10 17:10:36 2025 -0400 clk: imx: cpu: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-4-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit 62a88813c1501fdefd982604ef2f2fcacec09fb7 Author: Brian Masney Date: Thu Jul 10 17:10:35 2025 -0400 clk: imx: busy: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. The change to call busy->div_ops->determine_rate() instead of busy->div_ops->round_rate() was done by hand. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-3-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit 167483da96a489d15a0bf74a04664513342bfc88 Author: Brian Masney Date: Thu Jul 10 17:10:34 2025 -0400 clk: imx: composite-93: remove round_rate() in favor of determine_rate() This driver implements both the determine_rate() and round_rate() clk ops, and the round_rate() clk ops is deprecated. When both are defined, clk_core_determine_round_nolock() from the clk core will only use the determine_rate() clk ops, so let's remove the round_rate() clk ops since it's unused. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-2-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit a16f19d2e81367b8ab497c67d9dc3419e4b59fee Author: Brian Masney Date: Thu Jul 10 17:10:33 2025 -0400 clk: imx: composite-8m: remove round_rate() in favor of determine_rate() This driver implements both the determine_rate() and round_rate() clk ops, and the round_rate() clk ops is deprecated. When both are defined, clk_core_determine_round_nolock() from the clk core will only use the determine_rate() clk ops, so let's remove the round_rate() clk ops since it's unused. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-clk-imx-round-rate-v1-1-5726f98e6d8d@redhat.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit 30fb5e134f05800dc424f8aa1d69841a6bdd9a54 Author: Paul E. McKenney Date: Wed Jul 23 16:13:45 2025 -0700 selftests/pidfd: Fix duplicate-symbol warnings for SCHED_ CPP symbols The pidfd selftests run in userspace and include both userspace and kernel header files. On some distros (for example, CentOS), this results in duplicate-symbol warnings in allmodconfig builds, while on other distros (for example, Ubuntu) it does not. Therefore, use #undef to get rid of the userspace definitions in favor of the kernel definitions. Other ways of handling this include splitting up the selftest code so that the userspace definitions go into one translation unit and the kernel definitions into another (which might or might not be feasible) or to adjust compiler command-line options to suppress the warnings (which might or might not be desirable). [ paulmck: Apply Shuah Khan feedback. ] Link: https://lore.kernel.org/r/cc7e4fe7-299f-4bf3-af46-df6551d61997@paulmck-laptop Signed-off-by: Paul E. McKenney Reviewed-by: Shuah Khan Cc: Christian Brauner Cc: Signed-off-by: Shuah Khan commit f54b69a57a77c301a1013a22257357d9294a1fdc Merge: b71cb3461765bc f6b159431697c9 Author: Mark Brown Date: Thu Jul 24 23:06:15 2025 +0100 spi: sophgo: Add SPI NOR controller for SG2042 Merge series from Zixian Zeng : Add support SPI NOR flash memory controller for SG2042, using upstreamed SG2044 SPI NOR driver. Tested on SG2042 Pioneer Box, read, write operations. Thanks Chen Wang who provided machine and guidance. commit 853a7a63f8e955f7409f76534d6b7e2a1ea9cbde Merge: ab8cfde3404aed 54edba916e2913 Author: Stephen Boyd Date: Thu Jul 24 15:03:54 2025 -0700 Merge tag 'thead-clk-for-v6.17-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into clk-thead Pull one more T-HEAD clk driver update from Drew Fustini: Yao Zi has fixed an issue where the c910 mux clk could end up as an orphan in CCF when the bootloader reparents it to the c910-i0 mux clk. The solution is to refactor the handling of mux clocks by embedding a clk_mux structure directly in ccu_mux. This allows the mux clocks to be registered with devm_clk_hw_register() without allocating any new clk_hw pointer which solves the orphan issue. This change has been tested in linux-next. The LPi4a still boots okay without clk_ignore_unused and peripherals like serial, emmc and ethernet are functional. The file /sys/kernel/debug/clk/c910/clk_possible_parents now correctly outputs: "c910-i0 cpu-pll1" * tag 'thead-clk-for-v6.17-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: clk: thead: th1520-ap: Describe mux clocks with clk_mux commit 213879061a9c60200ba971330dbefec6df3b4a30 Author: Steven Rostedt Date: Mon Jul 21 13:42:12 2025 -0400 selftests/tracing: Fix false failure of subsystem event test The subsystem event test enables all "sched" events and makes sure there's at least 3 different events in the output. It used to cat the entire trace file to | wc -l, but on slow machines, that could last a very long time. To solve that, it was changed to just read the first 100 lines of the trace file. This can cause false failures as some events repeat so often, that the 100 lines that are examined could possibly be of only one event. Instead, create an awk script that looks for 3 different events and will exit out after it finds them. This will find the 3 events the test looks for (eventually if it works), and still exit out after the test is satisfied and not cause slower machines to run forever. Link: https://lore.kernel.org/r/20250721134212.53c3e140@batman.local.home Reported-by: Tengda Wu Closes: https://lore.kernel.org/all/20250710130134.591066-1-wutengda@huaweicloud.com/ Fixes: 1a4ea83a6e67 ("selftests/ftrace: Limit length in subsystem-enable tests") Signed-off-by: Steven Rostedt (Google) Signed-off-by: Shuah Khan commit b351e9c93a4fc0a1b789c0b89eeecb9d5bf564cd Author: Frank Li Date: Thu Jul 10 15:13:54 2025 -0400 selftests: pci_endpoint: Add doorbell test case Add doorbell test case. Signed-off-by: Frank Li [mani: Reworded the testcase description] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Niklas Cassel Link: https://patch.msgid.link/20250710-ep-msi-v21-8-57683fc7fb25@nxp.com commit eefb83790a0dda112d1755e4f5e213738d717e76 Author: Frank Li Date: Thu Jul 10 15:13:53 2025 -0400 misc: pci_endpoint_test: Add doorbell test case Add doorbell support with the help of three new registers: PCIE_ENDPOINT_TEST_DB_BAR, PCIE_ENDPOINT_TEST_DB_ADDR, and PCIE_ENDPOINT_TEST_DB_DATA. The testcase works by triggering the doorbell in Endpoint by writing the value from PCI_ENDPOINT_TEST_DB_DATA register to the address provided by PCI_ENDPOINT_TEST_DB_OFFSET register of the BAR indicated by the PCIE_ENDPOINT_TEST_DB_BAR register and waiting for the completion status from the Endpoint. Signed-off-by: Frank Li [mani: removed one spurious change and reworded the commit message] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Niklas Cassel Link: https://patch.msgid.link/20250710-ep-msi-v21-7-57683fc7fb25@nxp.com commit eff0c286aa916221a69126a43eee7c218d6f4011 Author: Frank Li Date: Thu Jul 10 15:13:52 2025 -0400 PCI: endpoint: pci-epf-test: Add doorbell test support Add doorbell support by allocating a dedicated BAR using the pci_epf_alloc_doorbell() API and mapping the Endpoint MSI controller message data address to it. The data to be written in the message address is stored in the 'pci_epf_test_reg::doorbell_data' register. Finally, the RC can trigger doorbell in the Endpoint by writing the content of 'doorbell_data' register to the offset specified in 'doorbell_offset' of the 'doorbell_bar' BAR. Triggering of the doorbell is detected by pci_epf_test_doorbell_handler(), which is bound to the doorbell IRQ. On successful completion, STATUS_DOORBELL_SUCCESS status is set in the above mentioned handler. To avoid breaking compatibility between host and endpoint, add two new commands: COMMAND_ENABLE_DOORBELL and COMMAND_DISABLE_DOORBELL. The doorbell is allocated when COMMAND_ENABLE_DOORBELL command is called and destroyed when COMMAND_DISABLE_DOORBELL is called. This doorbell feature only works when both RC and EP drivers support it. If one of them doesn't support the feature, the testcase will fail. Signed-off-by: Frank Li [mani: code cleanups and reworded commit message] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Niklas Cassel Link: https://patch.msgid.link/20250710-ep-msi-v21-6-57683fc7fb25@nxp.com commit 4ff4252a2355f585c5cad8dc959ff1097300aa47 Author: Frank Li Date: Thu Jul 10 15:13:51 2025 -0400 PCI: endpoint: Add pci_epf_align_inbound_addr() helper for inbound address alignment Add pci_epf_align_inbound_addr() to align the inbound addresses according to PCI BAR alignment requirements. The aligned base address and offset are returned via 'base' and 'off' parameters. Signed-off-by: Frank Li [mani: reworded kernel-doc and commit message] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Niklas Cassel Link: https://patch.msgid.link/20250710-ep-msi-v21-5-57683fc7fb25@nxp.com commit c822392280aa9bc57ad3b5079020388950cce9c8 Author: Frank Li Date: Thu Jul 10 15:13:50 2025 -0400 PCI: endpoint: pci-ep-msi: Add checks for MSI parent and mutability Some MSI controllers can change address/data pair during the execution of irq_chip::irq_set_affinity() callback. Since the current PCI Endpoint framework cannot support mutable MSI controllers, call irq_domain_is_msi_immutable() API to check if the controller is immutable or not. Also ensure that the MSI domain is a parent MSI domain so that it can allocate address/data pairs. Signed-off-by: Frank Li [mani: reworded error message and commit message] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Niklas Cassel Link: https://patch.msgid.link/20250710-ep-msi-v21-4-57683fc7fb25@nxp.com commit 1c3b002c6bf684b445a7107609979bca5f21bc03 Author: Frank Li Date: Thu Jul 10 15:13:49 2025 -0400 PCI: endpoint: Add RC-to-EP doorbell support using platform MSI controller Implement the doorbell feature by mapping the EP's MSI interrupt controller message address to a dedicated BAR. The EPF driver should pass the actual message data to be written to the message address by the host through implementation-specific logic. Signed-off-by: Frank Li [mani: minor code cleanups and reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: fix kernel-doc] Signed-off-by: Bjorn Helgaas Tested-by: Niklas Cassel Link: https://patch.msgid.link/20250710-ep-msi-v21-3-57683fc7fb25@nxp.com commit 60e61a4a59776229096bd1cb24f3c55e070db819 Author: Sakari Ailus Date: Fri Jul 4 10:54:01 2025 +0300 clk: qcom: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250704075401.3217179-1-sakari.ailus@linux.intel.com Signed-off-by: Stephen Boyd commit 76aa140f38dc2653cde13f1b8286bd3353ef9a4a Author: Sakari Ailus Date: Fri Jul 4 10:54:00 2025 +0300 clk: imx: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250704075400.3217126-1-sakari.ailus@linux.intel.com Reviewed-by: Peng Fan Signed-off-by: Stephen Boyd commit b71cb3461765bcf42f619138f4c90c360369a246 Merge: 317fb4c3871b27 8b61c8919dff08 Author: Mark Brown Date: Thu Jul 24 22:32:27 2025 +0100 Add RSPI support for RZ/V2H Merge series from Fabrizio Castro : This series adds support for the Renesas RZ/V2H RSPI IP. commit 77923f710352f03f9e13c29057fcc80c255180a2 Author: Brian Masney Date: Thu Jul 3 19:22:25 2025 -0400 clk: bcm: bcm2835: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250703-clk-cocci-drop-round-rate-v1-1-3a8da898367e@redhat.com Reviewed-by: Florian Fainelli Signed-off-by: Stephen Boyd commit 467d9c0348d6fd37b3d3a82e46c113ee9228d84b Author: Inochi Amaoto Date: Sun May 4 08:44:19 2025 +0800 PCI: dwc: Add Sophgo SG2044 PCIe controller driver in Root Complex mode Add driver support for DesignWare based PCIe controller in SG2044 SoC. The driver currently supports the Root Complex mode. Signed-off-by: Inochi Amaoto [mani: renamed the driver to 'pcie-sophgo.c' and Kconfig fix] Signed-off-by: Manivannan Sadhasivam [bhelgaas: whitespace] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250504004420.202685-3-inochiama@gmail.com commit 17a6d7ceceeaf1e9696de689fea6d8a13ab68f99 Author: Frank Li Date: Fri Jun 6 12:24:09 2025 -0400 dt-bindings: clock: convert lpc1850-cgu.txt to yaml format Convert lpc1850-cgu.txt to yaml format. Additional changes: - remove extra clock source nodes in example. - remove clock consumer in example. - remove clock-output-names and clock-clock-indices from required list to match existed dts. Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250606162410.1361169-1-Frank.Li@nxp.com Reviewed-by: Rob Herring (Arm) Signed-off-by: Stephen Boyd commit cce39a0d70fc818c3e3ef88f90bcbbc65d2377df Author: Florian Fainelli Date: Wed Jun 25 16:10:38 2025 -0700 MAINTAINERS: Include clk.py under COMMON CLK FRAMEWORK entry Include the GDB scripts file under scripts/gdb/linux/clk.py under the COMMON CLK subsystem since it parses internal data structures that depend upon that subsystem. Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20250625231053.1134589-2-florian.fainelli@broadcom.com Signed-off-by: Stephen Boyd commit d7d8ab87e3e7413e3ed2b6eee51ceaddc7e594f2 Author: Nam Cao Date: Thu Jun 26 16:48:06 2025 +0200 PCI: vmd: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion, wrap long lines, squash fix from https://lore.kernel.org/r/20250716201216.TsY3Kn45@linutronix.de] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/de3f1d737831b251e9cd2cbf9e4c732a5bbba13a.1750858083.git.namcao@linutronix.de commit 63984ea71a6caf9a823e7301ca60942fbc511497 Author: Nam Cao Date: Thu Jun 26 16:48:05 2025 +0200 PCI: vmd: Convert to lock guards Convert lock/unlock pairs to lock guard and tidy up the code. Signed-off-by: Nam Cao Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/836cca37449c70922a2bea1fb13f37940a7a7132.1750858083.git.namcao@linutronix.de commit d7703cf5c40210f54cfd7a642576895e1eb80a15 Author: Nam Cao Date: Thu Jun 26 16:48:03 2025 +0200 PCI: plda: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion, drop fwnode local var] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/1279fe6500a1d8135d8f5feb2f055df008746c88.1750858083.git.namcao@linutronix.de commit f29861aa301c5333ad0a64d41de43e169aa9ac15 Author: Nam Cao Date: Thu Jun 26 16:48:02 2025 +0200 PCI: xilinx: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion, drop fwnode local var] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/b1353c797ce53714c22823de3bd2ae3d09fcd84f.1750858083.git.namcao@linutronix.de commit 710a1494e157f2d59876761f51de0a4a4c75b2af Author: Nam Cao Date: Thu Jun 26 16:48:01 2025 +0200 PCI: xilinx-nwl: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion, drop fwnode local var] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/5ac6e216bf2eaa438c8854baf2ff3e5cf0b2284f.1750858083.git.namcao@linutronix.de commit d08c7e502c9f3212ff5d64903a75e26742b37f2c Author: Nam Cao Date: Thu Jun 26 16:48:00 2025 +0200 PCI: xilinx-xdma: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/b4620dc1808f217a69d0ae50700ffa12ffd657eb.1750858083.git.namcao@linutronix.de commit dd26c1a23fd5a607c50738ea0dcb6cdbb8185cfe Author: Nam Cao Date: Thu Jun 26 16:47:59 2025 +0200 PCI: rcar-host: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion, drop fwnode local var] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/ab4005db0a829549be1f348f6c27be50a2118b5e.1750858083.git.namcao@linutronix.de commit e449cb9afc963cf9cf47139bb873c412605c83e7 Author: Nam Cao Date: Thu Jun 26 16:47:58 2025 +0200 PCI: mediatek: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion, drop fwnode local var] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/76f6e6ce6021607cd0fdfd79fef7d2eb69d9f361.1750858083.git.namcao@linutronix.de commit 9a35a26485b3d8677f8cc44103f554b0ce8d62d0 Author: Nam Cao Date: Thu Jun 26 16:47:57 2025 +0200 PCI: mediatek-gen3: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message & fixed merge conflict] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/bfbd2e375269071b69e1aa85e629ee4b7c99518f.1750858083.git.namcao@linutronix.de commit e275e38a61a10d1a85a6efc12b292daf0dd814e1 Author: Nam Cao Date: Thu Jun 26 16:47:56 2025 +0200 PCI: iproc: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message & squashed the kdoc cleanup patch] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/53946d74caf1fd134a1820eac82c3cf64d48779f.1750858083.git.namcao@linutronix.de commit ebcc2fbd33985b0cb1aa05776ec0313444e96647 Author: Nam Cao Date: Thu Jun 26 16:47:55 2025 +0200 PCI: brcmstb: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion, drop fwnode local var] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/fa72703e06c2ee2c7554082c7152913eb0dd294f.1750858083.git.namcao@linutronix.de commit cf154cccd8c9b9be80e4f9e367975d8f3cf5a497 Author: Nam Cao Date: Thu Jun 26 16:47:54 2025 +0200 PCI: altera-msi: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/0a88da04bb82bd588828a7889e9d58c515ea5dbb.1750858083.git.namcao@linutronix.de commit 750277048afe7ce8ebfc0b120de7dfbc745058a7 Author: Nam Cao Date: Thu Jun 26 16:47:53 2025 +0200 PCI: aardvark: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/68b2f9387bbe4f08bcd428bfab83ad1219fb8d80.1750858083.git.namcao@linutronix.de commit 0cb6d733983cb3be88a7c1e44400fdd231efd053 Author: Nam Cao Date: Thu Jun 26 16:47:52 2025 +0200 PCI: mobiveil: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion, drop fwnode local var] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/af46c15c47a7716f7e0c50d0f7391509c95b49c2.1750858083.git.namcao@linutronix.de commit 3849ceec49dfb8aee24c2c9c96e1bec1138577c1 Author: Rob Herring (Arm) Date: Mon Jun 30 18:26:24 2025 -0500 dt-bindings: clock: Convert qca,ath79-pll to DT schema Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250630232625.3700213-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 71b80a33653debf0374498e6f4141aae43038d0b Author: Rob Herring (Arm) Date: Mon Jun 30 18:26:36 2025 -0500 dt-bindings: clock: Convert nuvoton,npcm750-clk to DT schema Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250630232637.3700584-1-robh@kernel.org Signed-off-by: Stephen Boyd commit f2cb67d73afdf8fd92bec54caf43a246719dd0e6 Author: Rob Herring (Arm) Date: Mon Jun 30 18:26:43 2025 -0500 dt-bindings: clock: Convert moxa,moxart-clock to DT schema Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250630232644.3700781-1-robh@kernel.org Signed-off-by: Stephen Boyd commit ce2930aefb398e004eb733897b4b5302582f6809 Author: Rob Herring (Arm) Date: Mon Jun 30 18:26:51 2025 -0500 dt-bindings: clock: Convert microchip,pic32mzda-clk to DT schema Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250630232652.3701007-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 1a25e13de69dafd4c1d1821df80f89dad036f9bb Author: Rob Herring (Arm) Date: Mon Jun 30 18:26:57 2025 -0500 dt-bindings: clock: Convert maxim,max9485 to DT schema Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250630232658.3701225-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 1032fa556c37c500bf2b93d95fa18e7d1fd1b4de Merge: da98e8b97058c7 50a479527ef01f Author: Mark Brown Date: Thu Jul 24 22:09:30 2025 +0100 More minor SDCA changes Merge series from Charles Keepax : A small chain with some patches that seem to have got lost in the process. One small additional bug fix for the regmap callbacks, and one small feature addition for the control parsing. Charles Keepax (2): ASoC: SDCA: Fix some holes in the regmap readable/writeable helpers ASoC: SDCA: Add support for -cn- value properties include/sound/sdca_function.h | 14 ++--- sound/soc/sdca/sdca_functions.c | 99 +++++++++++++++++++++------------ sound/soc/sdca/sdca_regmap.c | 29 ++++++++-- 3 files changed, 92 insertions(+), 50 deletions(-) -- 2.39.5 commit 68b9272ca7ac948b71aba482ef8244dee8032f46 Author: Colin Ian King Date: Thu Jul 24 11:41:48 2025 +0100 pwm: raspberrypi-poe: Fix spelling mistake "Firwmware" -> "Firmware" There is a spelling mistake in the PWM_RASPBERRYPI_POE Kconfig, fix it. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250724104148.139559-1-colin.i.king@gmail.com Signed-off-by: Uwe Kleine-König commit 8e717112caf35998b198d3762b381de70711bdec Author: Nam Cao Date: Thu Jun 26 16:47:51 2025 +0200 PCI: dwc: Switch to msi_create_parent_irq_domain() Switch to msi_create_parent_irq_domain() from pci_msi_create_irq_domain() which was using legacy MSI domain setup. Signed-off-by: Nam Cao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam [bhelgaas: rebase on dev_fwnode() conversion] Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://patch.msgid.link/04d4a96046490e50139826c16423954e033cdf89.1750858083.git.namcao@linutronix.de commit a103d2dede5683dabbac2c3374bc24b6a9434478 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:44 2025 +0200 PCI: controller: Use dev_fwnode() instead of of_fwnode_handle() All irq_domain functions now accept fwnode instead of of_node. But many PCI controllers still extract dev to of_node and then of_node to fwnode. Instead, clean this up and simply use the dev_fwnode() helper to extract fwnode directly from dev. Internally, it still does dev => of_node => fwnode steps, but it's now hidden from the users. In the case of altera, this also removes an unused 'node' variable that is only used when CONFIG_OF is enabled: drivers/pci/controller/pcie-altera.c: In function 'altera_pcie_init_irq_domain': drivers/pci/controller/pcie-altera.c:855:29: error: unused variable 'node' [-Werror=unused-variable] 855 | struct device_node *node = dev->of_node; Signed-off-by: Jiri Slaby (SUSE) Signed-off-by: Arnd Bergmann # altera [bhelgaas: squash together, rebase to precede msi-parent] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250521163329.2137973-1-arnd@kernel.org Link: https://patch.msgid.link/20250611104348.192092-16-jirislaby@kernel.org Link: https://patch.msgid.link/20250723065907.1841758-1-jirislaby@kernel.org commit 5a2ceebd8175874ae0e91a304ad6600d82806973 Author: Ian Rogers Date: Thu Jul 24 09:32:42 2025 -0700 perf build-id: Truncate to avoid overflowing the build_id data Warning when the build_id data would be overflowed would lead to memory corruption, switch to truncation. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-3-irogers@google.com Signed-off-by: Namhyung Kim commit f3982385bc507991f1ed732c3c7907bff703f4d4 Author: Ian Rogers Date: Thu Jul 24 09:32:41 2025 -0700 perf build-id: Reduce size of "size" variable Later clean up of the dso_id to include a build_id will suffer from alignment and size issues. The size can only hold up to a value of BUILD_ID_SIZE (20) and the mmap2 event uses a byte for the value. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250724163302.596743-2-irogers@google.com Signed-off-by: Namhyung Kim commit fcc7cc31239d0fbf0ebf25e65f7f572caed40206 Author: Ian Rogers Date: Fri Jul 18 20:05:17 2025 -0700 perf metricgroups: Add NO_THRESHOLD_AND_NMI constraint Thresholds can increase the number of counters a metric needs. The NMI watchdog can take away a counter (hopefully the buddy watchdog will become the default and this will no longer be true). Add a new constraint for the case that a metric and its thresholds would fit in counters but only if the NMI watchdog isn't enabled. Either the threshold or the NMI watchdog should be disabled to make the metric fit. Wire this up into the metric__group_events logic. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250719030517.1990983-16-irogers@google.com Signed-off-by: Namhyung Kim commit 8dcd27b1b8661f64e220bc26a499865261d5d0f1 Author: Ian Rogers Date: Fri Jul 18 20:05:16 2025 -0700 perf parse-events: Fix missing slots for Intel topdown metric events Topdown metric events require grouping with a slots event. In perf metrics this is currently achieved by metrics adding an unnecessary "0 * tma_info_thread_slots". New TMA metrics trigger optimizations of the metric expression that removes the event and breaks the metric due to the missing but required event. Add a pass immediately before sorting and fixing parsed events, that insert a slots event if one is missing. Update test expectations to match this. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250719030517.1990983-15-irogers@google.com Signed-off-by: Namhyung Kim commit 5b546de9cc177936a3ed07d7d46ef072db4fdbab Author: Ian Rogers Date: Fri Jul 18 20:05:15 2025 -0700 perf topdown: Use attribute to see an event is a topdown metic or slots The string comparisons were overly broad and could fire for the incorrect PMU and events. Switch to using the config in the attribute then add a perf test to confirm the attribute config values match those of parsed events of that name and don't match others. This exposed matches for slots events that shouldn't have matched as the slots fixed counter event, such as topdown.slots_p. Fixes: fbc798316bef ("perf x86/topdown: Refine helper arch_is_topdown_metrics()") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250719030517.1990983-14-irogers@google.com Signed-off-by: Namhyung Kim commit 811082e4b668db9689f8ce927a106036b4ed4e96 Author: Ian Rogers Date: Fri Jul 18 20:05:14 2025 -0700 perf parse-events: Support user CPUs mixed with threads/processes Counting events system-wide with a specified CPU prior to this change worked: ``` $ perf stat -e 'msr/tsc/,msr/tsc,cpu=cpu_core/,msr/tsc,cpu=cpu_atom/' -a sleep 1 Performance counter stats for 'system wide': 59,393,419,099 msr/tsc/ 33,927,965,927 msr/tsc,cpu=cpu_core/ 25,465,608,044 msr/tsc,cpu=cpu_atom/ ``` However, when counting with process the counts became system wide: ``` $ perf stat -e 'msr/tsc/,msr/tsc,cpu=cpu_core/,msr/tsc,cpu=cpu_atom/' perf test -F 10 10.1: Basic parsing test : Ok 10.2: Parsing without PMU name : Ok 10.3: Parsing with PMU name : Ok Performance counter stats for 'perf test -F 10': 59,233,549 msr/tsc/ 59,227,556 msr/tsc,cpu=cpu_core/ 59,224,053 msr/tsc,cpu=cpu_atom/ ``` Make the handling of CPU maps with event parsing clearer. When an event is parsed creating an evsel the cpus should be either the PMU's cpumask or user specified CPUs. Update perf_evlist__propagate_maps so that it doesn't clobber the user specified CPUs. Try to make the behavior clearer, firstly fix up missing cpumasks. Next, perform sanity checks and adjustments from the global evlist CPU requests and for the PMU including simplifying to the "any CPU"(-1) value. Finally remove the event if the cpumask is empty. So that events are opened with a CPU and a thread change stat's create_perf_stat_counter to give both. With the change things are fixed: ``` $ perf stat --no-scale -e 'msr/tsc/,msr/tsc,cpu=cpu_core/,msr/tsc,cpu=cpu_atom/' perf test -F 10 10.1: Basic parsing test : Ok 10.2: Parsing without PMU name : Ok 10.3: Parsing with PMU name : Ok Performance counter stats for 'perf test -F 10': 63,704,975 msr/tsc/ 47,060,704 msr/tsc,cpu=cpu_core/ (4.62%) 16,640,591 msr/tsc,cpu=cpu_atom/ (2.18%) ``` However, note the "--no-scale" option is used. This is necessary as the running time for the event on the counter isn't the same as the enabled time because the thread doesn't necessarily run on the CPUs specified for the counter. All counter values are scaled with: scaled_value = value * time_enabled / time_running and so without --no-scale the scaled_value becomes very large. This problem already exists on hybrid systems for the same reason. Here are 2 runs of the same code with an instructions event that counts the same on both types of core, there is no real multiplexing happening on the event: ``` $ perf stat -e instructions perf test -F 10 ... Performance counter stats for 'perf test -F 10': 87,896,447 cpu_atom/instructions/ (14.37%) 98,171,964 cpu_core/instructions/ (85.63%) ... $ perf stat --no-scale -e instructions perf test -F 10 ... Performance counter stats for 'perf test -F 10': 13,069,890 cpu_atom/instructions/ (19.32%) 83,460,274 cpu_core/instructions/ (80.68%) ... ``` The scaling has inflated per-PMU instruction counts and the overall count by 2x. To fix this the kernel needs changing when a task+CPU event (or just task event on hybrid) is scheduled out. A fix could be that the state isn't inactive but off for such events, so that time_enabled counts don't accumulate on them. Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250719030517.1990983-13-irogers@google.com Signed-off-by: Namhyung Kim commit e9387ba56918eb3c16aab3e6f0155a7251e339ec Author: Ian Rogers Date: Fri Jul 18 20:05:13 2025 -0700 perf evsel: Add evsel__open_per_cpu_and_thread Add evsel__open_per_cpu_and_thread that combines the operation of evsel__open_per_cpu and evsel__open_per_thread so that an event without the "any" cpumask can be opened with its cpumask and with threads it specifies. Change the implementation of evsel__open_per_cpu and evsel__open_per_thread to use evsel__open_per_cpu_and_thread to make the implementation of those functions clearer. Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Tested-by: James Clark Link: https://lore.kernel.org/r/20250719030517.1990983-12-irogers@google.com Signed-off-by: Namhyung Kim commit cd63c22168257a0b0b59245394915e2488065f7d Author: Ian Rogers Date: Fri Jul 18 20:05:12 2025 -0700 perf parse-events: Minor __add_event refactoring Rename cpu_list to user_cpus. If a PMU isn't given, find it early from the perf_event_attr. Make the pmu_cpus more explicitly a copy from the PMU (except when user_cpus are given). Derive the cpus from pmu_cpus and user_cpus as appropriate. Handle strdup errors on name and metric_id. Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Tested-by: James Clark Link: https://lore.kernel.org/r/20250719030517.1990983-11-irogers@google.com Signed-off-by: Namhyung Kim commit 3cb614a261e43a82acfef437c3242820c1444e2d Author: Ian Rogers Date: Fri Jul 18 20:05:11 2025 -0700 perf pmus: Factor perf_pmus__find_by_attr out of evsel__find_pmu Allow a PMU to be found by a perf_event_attr, useful when creating evsels. Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Tested-by: James Clark Link: https://lore.kernel.org/r/20250719030517.1990983-10-irogers@google.com Signed-off-by: Namhyung Kim commit f958537f185216b2be028ed793508248503bef83 Author: Ian Rogers Date: Fri Jul 18 20:05:10 2025 -0700 perf evsel: Use libperf perf_evsel__exit Avoid the duplicated code and better enable perf_evsel to change. Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Tested-by: James Clark Link: https://lore.kernel.org/r/20250719030517.1990983-9-irogers@google.com Signed-off-by: Namhyung Kim commit 9a711ef3bd57c124cb7255a4bb8a5166c6b0cef0 Author: Ian Rogers Date: Fri Jul 18 20:05:09 2025 -0700 libperf evsel: Factor perf_evsel__exit out of perf_evsel__delete This allows the perf_evsel__exit to be called when the struct perf_evsel is embedded inside another struct, such as struct evsel in perf. Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Tested-by: James Clark Link: https://lore.kernel.org/r/20250719030517.1990983-8-irogers@google.com Signed-off-by: Namhyung Kim commit 6d765f5f7ec669f2a16b44afd23cd877efa640de Author: Ian Rogers Date: Fri Jul 18 20:05:08 2025 -0700 libperf evsel: Rename own_cpus to pmu_cpus own_cpus is generally the cpumask from the PMU. Rename to pmu_cpus to try to make this clearer. Variable rename with no other changes. Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Tested-by: James Clark Link: https://lore.kernel.org/r/20250719030517.1990983-7-irogers@google.com Signed-off-by: Namhyung Kim commit 175c852325a1f566426e2470e5d5d67efc7621dd Author: Ian Rogers Date: Fri Jul 18 20:05:07 2025 -0700 perf tool_pmu: Allow num_cpus(_online) to be specific to a cpumask For hybrid metrics it is useful to know the number of p-core or e-core CPUs. If a cpumask is specified for the num_cpus or num_cpus_online tool events, compute the value relative to the given mask rather than for the full system. ``` $ sudo /tmp/perf/perf stat -e 'tool/num_cpus/,tool/num_cpus,cpu=cpu_core/, tool/num_cpus,cpu=cpu_atom/,tool/num_cpus_online/,tool/num_cpus_online, cpu=cpu_core/,tool/num_cpus_online,cpu=cpu_atom/' true Performance counter stats for 'true': 28 tool/num_cpus/ 16 tool/num_cpus,cpu=cpu_core/ 12 tool/num_cpus,cpu=cpu_atom/ 28 tool/num_cpus_online/ 16 tool/num_cpus_online,cpu=cpu_core/ 12 tool/num_cpus_online,cpu=cpu_atom/ 0.000767205 seconds time elapsed 0.000938000 seconds user 0.000000000 seconds sys ``` Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Tested-by: James Clark Link: https://lore.kernel.org/r/20250719030517.1990983-6-irogers@google.com Signed-off-by: Namhyung Kim commit bd741d80dc65922c7d6e5fd855a934f5d2cf2309 Author: Ian Rogers Date: Fri Jul 18 20:05:06 2025 -0700 perf parse-events: Allow the cpu term to be a PMU or CPU range On hybrid systems, events like msr/tsc/ will aggregate counts across all CPUs. Often metrics only want a value like msr/tsc/ for the cores on which the metric is being computed. Listing each CPU with terms cpu=0,cpu=1.. is laborious and would need to be encoded for all variations of a CPU model. Allow the cpumask from a PMU to be an argument to the cpu term. For example in the following the cpumask of the cstate_pkg PMU selects the CPUs to count msr/tsc/ counter upon: ``` $ cat /sys/bus/event_source/devices/cstate_pkg/cpumask 0 $ perf stat -A -e 'msr/tsc,cpu=cstate_pkg/' -a sleep 0.1 Performance counter stats for 'system wide': CPU0 252,621,253 msr/tsc,cpu=cstate_pkg/ 0.101184092 seconds time elapsed ``` As the cpu term is now also allowed to be a string, allow it to encode a range of CPUs (a list can't be supported as ',' is already a special token). The "event qualifiers" section of the `perf list` man page is updated to detail the additional behavior. The man page formatting is tidied up in this section, as it was incorrectly appearing within the "parameterized events" section. Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250719030517.1990983-5-irogers@google.com Signed-off-by: Namhyung Kim commit ced4c249569ab25c32b0d36e2ebdb19c74394bdf Author: Ian Rogers Date: Fri Jul 18 20:05:05 2025 -0700 perf stat: Don't size aggregation ids from user_requested_cpus As evsels may have additional CPU terms, the user_requested_cpus may not reflect all the CPUs requested. Use evlist->all_cpus to size the array as that reflects all the CPUs potentially needed by the evlist. Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Tested-by: James Clark Link: https://lore.kernel.org/r/20250719030517.1990983-4-irogers@google.com Signed-off-by: Namhyung Kim commit 848e7a06fea9be249c5b788b3f498196925e4d7e Author: Ian Rogers Date: Fri Jul 18 20:05:04 2025 -0700 perf stat: Avoid buffer overflow to the aggregation map CPUs may be created and passed to perf_stat__get_aggr (via config->aggr_get_id), such as in the stat display should_skip_zero_counter. There may be no such aggr_id, for example, if running with a thread. Add a missing bound check and just create IDs for these cases. Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Tested-by: James Clark Link: https://lore.kernel.org/r/20250719030517.1990983-3-irogers@google.com Signed-off-by: Namhyung Kim commit 62f4512238f5541d864a783cbcd8d95d067a17b3 Author: Ian Rogers Date: Fri Jul 18 20:05:03 2025 -0700 perf parse-events: Warn if a cpu term is unsupported by a CPU Factor requested CPU warning out of evlist and into evsel. At the end of adding an event, perform the warning check. To avoid repeatedly testing if the cpu_list is empty, add a local variable. ``` $ perf stat -e cpu_atom/cycles,cpu=1/ -a true WARNING: A requested CPU in '1' is not supported by PMU 'cpu_atom' (CPUs 16-27) for event 'cpu_atom/cycles/' Performance counter stats for 'system wide': cpu_atom/cycles/ 0.000781511 seconds time elapsed ``` Reviewed-by: Thomas Falcon Signed-off-by: Ian Rogers Tested-by: James Clark Link: https://lore.kernel.org/r/20250719030517.1990983-2-irogers@google.com Signed-off-by: Namhyung Kim commit 12d30725bf997ffd5baa849d4b20be86105fc070 Author: Ian Rogers Date: Mon Jul 21 18:34:49 2025 -0700 perf pfm: Don't force loading of all PMUs Force loading all PMUs adds significant cost because DRM and other PMUs are loaded, it should also not be required if the pmus__ functions are used. Tested by run perf test, in particular the pfm related tests. Also `perf list` is identical before and after. Before: $ time ./perf test pfm 54: Test libpfm4 support : 54.1: test of individual --pfm-events : Ok 54.2: test groups of --pfm-events : Ok 103: perf all libpfm4 events test : Ok real 0m8.933s user 0m1.824s sys 0m7.122s After: $ time ./perf test pfm 54: Test libpfm4 support : 54.1: test of individual --pfm-events : Ok 54.2: test groups of --pfm-events : Ok 103: perf all libpfm4 events test : Ok real 0m5.259s user 0m1.793s sys 0m3.570s Signed-off-by: Ian Rogers Tested-by: Namhyung Kim Link: https://lore.kernel.org/r/20250722013449.146233-1-irogers@google.com Signed-off-by: Namhyung Kim commit 317fb4c3871b27454f04d67bfd0f388fcc5783e7 Merge: 1f590fa4b93dd7 0ef2a9779e9dec Author: Mark Brown Date: Thu Jul 24 21:24:17 2025 +0100 support for amlogic the new SPI IP Merge series from Xianwei Zhao : Introduced support for the new SPI IP (SPISG). The SPISG is a communication-oriented SPI controller from Amlogic,supporting three operation modes: PIO, block DMA, and scatter-gather DMA. Add the drivers and device tree bindings corresponding to the SPISG. commit 99dbb2a1bd661418be33b1ff1462c09b7d2221cf Author: Christoph Hellwig Date: Fri Jul 11 10:11:16 2025 +0200 ubifs: stop using write_cache_pages Stop using the obsolete write_cache_pages and use writeback_iter directly. Signed-off-by: Christoph Hellwig Reviewed-by: Zhihao Cheng Signed-off-by: Richard Weinberger commit 3bf1bab503a58ed7dcfcd399c30ad0b976eb2620 Author: yohan.joung Date: Tue Jul 22 15:02:40 2025 +0900 f2fs: zone: wait for inflight dio completion, excluding pinned files read using dio read for the pinfile using Direct I/O do not wait for dio write. Signed-off-by: yohan.joung Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ca7be9c0a148cbfe38df95a0285339c532ca6e17 Author: Dr. David Alan Gilbert Date: Sun Jun 8 17:15:35 2025 +0100 mtd: ubi: Remove unused ubi_flush ubi_flush() was added in 2012 as part of commit 62f384552b67 ("UBI: modify ubi_wl_flush function to clear work queue for a lnum") but has remained unused. (It's friend ubi_wl_flush() is still used) Remove it. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Richard Weinberger commit e6d5e789c3b2df219d6f6a6c7fa0539ce8b563c0 Author: Daeho Jeong Date: Fri Jul 18 15:04:31 2025 -0700 f2fs: ignore valid ratio when free section count is low Otherwise F2FS will not do GC in background in low free section. Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f0a7adfedcc8c7e0b13ffd11dd69bf0ac25b2cd3 Author: Chao Yu Date: Mon Jul 21 10:02:31 2025 +0800 f2fs: don't break allocation when crossing contiguous sections Commit 0638a3197c19 ("f2fs: avoid unused block when dio write in LFS mode") has fixed unused block issue for dio write in lfs mode. However, f2fs_map_blocks() may break and return smaller extent when last allocated block locates in the end of section, even allocator can allocate contiguous blocks across sections. Actually, for the case that allocator returns a block address which is not contiguous w/ current extent, we can record the block address in iomap->private, in the next round, skip reallocating for the last allocated block, then we can fix unused block issue, meanwhile, also, we can allocates contiguous physical blocks as much as possible for dio write in lfs mode. Testcase: - mkfs.f2fs -f /dev/vdb - mount -o mode=lfs /dev/vdb /mnt/f2fs - dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=3; sync; - dd if=/dev/zero of=/mnt/f2fs/dio bs=2M count=1 oflag=direct; - umount /mnt/f2fs Before: f2fs_map_blocks: dev = (253,16), ino = 4, file offset = 0, start blkaddr = 0x0, len = 0x100, flags = 1, seg_type = 8, may_create = 1, multidevice = 0, flag = 5, err = 0 f2fs_map_blocks: dev = (253,16), ino = 4, file offset = 256, start blkaddr = 0x0, len = 0x100, flags = 1, seg_type = 8, may_create = 1, multidevice = 0, flag = 5, err = 0 f2fs_map_blocks: dev = (253,16), ino = 4, file offset = 512, start blkaddr = 0x0, len = 0x100, flags = 1, seg_type = 8, may_create = 1, multidevice = 0, flag = 5, err = 0 f2fs_map_blocks: dev = (253,16), ino = 5, file offset = 0, start blkaddr = 0x4700, len = 0x100, flags = 3, seg_type = 1, may_create = 1, multidevice = 0, flag = 3, err = 0 f2fs_map_blocks: dev = (253,16), ino = 5, file offset = 256, start blkaddr = 0x4800, len = 0x100, flags = 3, seg_type = 1, may_create = 1, multidevice = 0, flag = 3, err = 0 After: f2fs_map_blocks: dev = (253,16), ino = 4, file offset = 0, start blkaddr = 0x0, len = 0x100, flags = 1, seg_type = 8, may_create = 1, multidevice = 0, flag = 5, err = 0 f2fs_map_blocks: dev = (253,16), ino = 4, file offset = 256, start blkaddr = 0x0, len = 0x100, flags = 1, seg_type = 8, may_create = 1, multidevice = 0, flag = 5, err = 0 f2fs_map_blocks: dev = (253,16), ino = 4, file offset = 512, start blkaddr = 0x0, len = 0x100, flags = 1, seg_type = 8, may_create = 1, multidevice = 0, flag = 5, err = 0 f2fs_map_blocks: dev = (253,16), ino = 5, file offset = 0, start blkaddr = 0x4700, len = 0x200, flags = 3, seg_type = 1, may_create = 1, multidevice = 0, flag = 3, err = 0 Cc: Daejun Park Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 95d7c508b21235144f6cef611ec5686bbdeeec25 Author: Sheng Yong Date: Wed Jul 23 22:24:56 2025 +0800 f2fs: remove unnecessary tracepoint enabled check There is no extra work before trace_f2fs_[dataread|datawrite]_end(), so there is no need to check trace__enabled(). Signed-off-by: Sheng Yong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit b93bf64e349b1952170f47a0e68fc52f666b9e25 Author: mason.zhang Date: Wed Jul 23 22:58:37 2025 +0800 f2fs: merge the two conditions to avoid code duplication No functional changes. Signed-off-by: mason.zhang Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 08a7efc5b02a0620ae16aa9584060e980a69cb55 Author: Jan Prusakowski Date: Thu Jul 24 17:31:15 2025 +0200 f2fs: vm_unmap_ram() may be called from an invalid context When testing F2FS with xfstests using UFS backed virtual disks the kernel complains sometimes that f2fs_release_decomp_mem() calls vm_unmap_ram() from an invalid context. Example trace from f2fs/007 test: f2fs/007 5s ... [12:59:38][ 8.902525] run fstests f2fs/007 [ 11.468026] BUG: sleeping function called from invalid context at mm/vmalloc.c:2978 [ 11.471849] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 68, name: irq/22-ufshcd [ 11.475357] preempt_count: 1, expected: 0 [ 11.476970] RCU nest depth: 0, expected: 0 [ 11.478531] CPU: 0 UID: 0 PID: 68 Comm: irq/22-ufshcd Tainted: G W 6.16.0-rc5-xfstests-ufs-g40f92e79b0aa #9 PREEMPT(none) [ 11.478535] Tainted: [W]=WARN [ 11.478536] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 11.478537] Call Trace: [ 11.478543] [ 11.478545] dump_stack_lvl+0x4e/0x70 [ 11.478554] __might_resched.cold+0xaf/0xbe [ 11.478557] vm_unmap_ram+0x21/0xb0 [ 11.478560] f2fs_release_decomp_mem+0x59/0x80 [ 11.478563] f2fs_free_dic+0x18/0x1a0 [ 11.478565] f2fs_finish_read_bio+0xd7/0x290 [ 11.478570] blk_update_request+0xec/0x3b0 [ 11.478574] ? sbitmap_queue_clear+0x3b/0x60 [ 11.478576] scsi_end_request+0x27/0x1a0 [ 11.478582] scsi_io_completion+0x40/0x300 [ 11.478583] ufshcd_mcq_poll_cqe_lock+0xa3/0xe0 [ 11.478588] ufshcd_sl_intr+0x194/0x1f0 [ 11.478592] ufshcd_threaded_intr+0x68/0xb0 [ 11.478594] ? __pfx_irq_thread_fn+0x10/0x10 [ 11.478599] irq_thread_fn+0x20/0x60 [ 11.478602] ? __pfx_irq_thread_fn+0x10/0x10 [ 11.478603] irq_thread+0xb9/0x180 [ 11.478605] ? __pfx_irq_thread_dtor+0x10/0x10 [ 11.478607] ? __pfx_irq_thread+0x10/0x10 [ 11.478609] kthread+0x10a/0x230 [ 11.478614] ? __pfx_kthread+0x10/0x10 [ 11.478615] ret_from_fork+0x7e/0xd0 [ 11.478619] ? __pfx_kthread+0x10/0x10 [ 11.478621] ret_from_fork_asm+0x1a/0x30 [ 11.478623] This patch modifies in_task() check inside f2fs_read_end_io() to also check if interrupts are disabled. This ensures that pages are unmapped asynchronously in an interrupt handler. Fixes: bff139b49d9f ("f2fs: handle decompress only post processing in softirq") Signed-off-by: Jan Prusakowski Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1eef76f463042890fbcb8bac77baa32fa4f31d86 Author: Rob Herring (Arm) Date: Mon Jun 30 18:26:16 2025 -0500 dt-bindings: clock: Convert qcom,krait-cc to DT schema Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250630232617.3699954-1-robh@kernel.org [sboyd@kernel.org: Update to korg] Signed-off-by: Stephen Boyd commit e51c16f9ee90eb08b896bb1b86f117b1e4901ba9 Author: Luca Weiss Date: Thu Jul 17 08:54:44 2025 +0200 dt-bindings: clock: qcom: Remove double colon from description No double colon is necessary in the description. Fix it for all bindings so future bindings won't have the same copy-paste mistake. Reported-by: Rob Herring Closes: https://lore.kernel.org/lkml/20250625150458.GA1182597-robh@kernel.org/ Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250717-bindings-double-colon-v1-1-c04abc180fcd@fairphone.com Reviewed-by: Krzysztof Kozlowski Signed-off-by: Stephen Boyd commit f46c06a302603dcec488a6d07fec92c262edd861 Merge: 19272b37aa4f83 c78865241ecffa Author: Stephen Boyd Date: Thu Jul 24 11:13:15 2025 -0700 Merge tag 'clk-imx-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux into clk-imx Pull i.MX clk driver updates from Abel Vesa: - Document bindings for i.MX94 LVDS/Display CSR - Fix synchronous abort in i.MX95 BLK CTL driver - Rename LVDS and displaymix CSR BLK needed for supporting i.MX943 - Add i.MX94 LVDS/Display CSR clock to the i.MX95 BLK CTL - Update MAINTAINERS entry to include both nxp,imx* and fsl,imx* * tag 'clk-imx-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux: MAINTAINERS: Update i.MX Clock Entry clk: imx95-blk-ctl: Add clock for i.MX94 LVDS/Display CSR clk: imx95-blk-ctl: Rename lvds and displaymix csr blk clk: imx95-blk-ctl: Fix synchronous abort dt-bindings: clock: Add support for i.MX94 LVDS/DISPLAY CSR clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data commit 8b5a19b4ff6a2096225d88cf24cfeef03edc1bed Merge: 94619ea2d933a2 407c114c983f6e Author: Jakub Kicinski Date: Thu Jul 17 10:56:56 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.16-rc8). Conflicts: drivers/net/ethernet/microsoft/mana/gdma_main.c 9669ddda18fb ("net: mana: Fix warnings for missing export.h header inclusion") 755391121038 ("net: mana: Allocate MSI-X vectors dynamically") https://lore.kernel.org/20250711130752.23023d98@canb.auug.org.au Adjacent changes: drivers/net/ethernet/ti/icssg/icssg_prueth.h 6e86fb73de0f ("net: ti: icssg-prueth: Fix buffer allocation for ICSSG") ffe8a4909176 ("net: ti: icssg-prueth: Read firmware-names from device tree") Signed-off-by: Jakub Kicinski commit 2e6ea70690ddd1ffa422423fd0d4523e4dfe4b62 Author: Richard Zhu Date: Wed Jul 9 11:37:22 2025 +0800 PCI: imx6: Delay link start until configfs 'start' written According to Documentation/PCI/endpoint/pci-endpoint-cfs.rst, the Endpoint controller (EPC) should only start the link when userspace writes '1' to the '/sys/kernel/config/pci_ep/controllers//start' attribute, which ultimately results in calling imx_pcie_start_link() via pci_epc_start_store(). To align with the documented behavior, do not start the link automatically when adding the EP controller. Fixes: 75c2f26da03f ("PCI: imx6: Add i.MX PCIe EP mode support") Signed-off-by: Richard Zhu [mani: reworded commit subject and description] Signed-off-by: Manivannan Sadhasivam [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250709033722.2924372-3-hongxing.zhu@nxp.com commit 0bd042ae771d61ef7ccd5882f7aeca59a25f71d9 Author: Colin Ian King Date: Thu Jul 24 12:48:32 2025 +0100 regulator: mt6370: Fix spelling mistake in mt6370_regualtor_register The function name mt6370_regualtor_register contains a spelling mistake, fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250724114832.146718-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit d31eb217425591e100b475fad6360cd3da2073c6 Author: Richard Zhu Date: Wed Jul 9 11:37:21 2025 +0800 PCI: imx6: Remove apps_reset toggling from imx_pcie_{assert/deassert}_core_reset apps_reset corresponds to LTSSM_EN in i.MX7, i.MX8MQ, i.MX8MM and i.MX8MP platforms. Since assertion/de-assertion of apps_reset is done in imx_pcie_ltssm_enable() and imx_pcie_ltssm_disable(), remove it from imx_pcie_assert_core_reset() and imx_pcie_deassert_core_reset(). This also fixes a failure in enumerating the PI7C9X2G608GP (hotplug) chip reliably on i.MX8MM, as reported by Tim. It should be noted that only i.MX7D, i.MX8MQ, i.MX8MM, and i.MX8MP platforms have the apps_reset logic, so this change doesn't have any effect on other platforms. Fixes: ef61c7d8d032 ("PCI: imx6: Deassert apps_reset in imx_pcie_deassert_core_reset()") Reported-by: Tim Harvey Closes: https://lore.kernel.org/all/CAJ+vNU3ohR2YKTwC4xoYrc1z-neDoH2TTZcMHDy+poj9=jSy+w@mail.gmail.com/ Signed-off-by: Richard Zhu [mani: reworded commit subject and description] Signed-off-by: Manivannan Sadhasivam [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Tested-by: Tim Harvey # imx8mp-venice-gw74xx (i.MX8MP + hotplug capable switch) Reviewed-by: Frank Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250709033722.2924372-2-hongxing.zhu@nxp.com commit 026cea3c61c2d42f47665bf8b1e2357f4bfb812d Author: Michal Swiatkowski Date: Fri Apr 25 08:08:09 2025 +0200 i40e: use libie_aq_str There is no need to store the err string in hw->err_str. Simplify it and use common helper. hw->err_str is still used for other purpouse. It should be marked that previously for unknown error the numeric value was passed as a string. Now the "LIBIE_AQ_RC_UNKNOWN" is used for such cases. Add libie_aminq module in i40e Kconfig. Reviewed-by: Przemek Kitszel Reviewed-by: Larysa Zaremba Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 43a11306323402757101a3e97d7a5cc77352505c Author: Michal Swiatkowski Date: Fri Apr 25 08:08:08 2025 +0200 iavf: use libie_aq_str There is no need to store the err string in hw->err_str. Simplify it and use common helper. hw->err_str is still used for other purpouse. It should be marked that previously for unknown error the numeric value was passed as a string. Now the "LIBIE_AQ_RC_UNKNOWN" is used for such cases. Add libie_aminq module in iavf Kconfig. Reviewed-by: Przemek Kitszel Reviewed-by: Larysa Zaremba Signed-off-by: Michal Swiatkowski Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit e99c1618f9dfc0ec87660f8df1dc83693f2724ff Author: Michal Swiatkowski Date: Fri Apr 25 08:08:07 2025 +0200 ice: use libie_aq_str Simple: s/ice_aq_str/libie_aq_str Add libie_aminq module in ice Kconfig. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 5feaa7a07b85ebbef418ba4b80e4e0d23dc379f5 Author: Michal Swiatkowski Date: Fri Apr 25 08:08:06 2025 +0200 libie: add adminq helper for converting err to str Add a new module for common handling of Admin Queue related logic. Start by a helper for error to string conversion. This lives inside libie/, but is a separate module what follows our logic of splitting into topical modules, to avoid pulling in not needed stuff, and have better organization in general. Olek suggested how to better solve the error to string conversion. It will be used in follow-up patches in ice, i40e and iavf. Reviewed-by: Przemek Kitszel Suggested-by: Alexander Lobakin Signed-off-by: Michal Swiatkowski Signed-off-by: Tony Nguyen commit 0eb61b3569229c31b06c58fd3bb58a79721ba91a Author: Michal Swiatkowski Date: Fri Apr 25 08:08:05 2025 +0200 iavf: use libie adminq descriptors Use libie_aq_desc instead of iavf_aq_desc. Do needed changes to allow clean build Use libie_aq_raw() wherever it can be used. Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Signed-off-by: Michal Swiatkowski Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit b46012a20006a689529b6b51e05a8ad5320f7e7c Author: Michal Swiatkowski Date: Fri Apr 25 08:08:04 2025 +0200 i40e: use libie adminq descriptors Use libie_aq_desc instead of i40e_aq_desc. Do needed changes to allow clean build. Get version descriptor is a little less detailed on i40e. To not mess up with shifting or union inside libie desc use get version descriptor from i40e. Move additional caps for i40e to libie. Fix RCT in declaration that is using libie_aq_desc; Use libie_aq_raw() wherever it can be used. The libie aq error is extended, cover it in ice driver just to clean build. In next patches the libie code for that will be used in each of intel driver. Reviewed-by: Przemek Kitszel Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 5b36bef444432b75e7285e33338eb8bad53fe152 Author: Michal Swiatkowski Date: Fri Apr 25 08:08:03 2025 +0200 ixgbe: use libie adminq descriptors Use libie_aq_desc instead of ixgbe_aci_desc. Do needed changes to allow clean build. Move additional caps used in ixgbe to libie. Reviewed-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit fdb7f139864aa332ea8f161beb636dc0599c64f2 Author: Michal Swiatkowski Date: Mon Jun 16 13:29:56 2025 -0700 ice, libie: move generic adminq descriptors to lib The descriptor structure is the same in ice, ixgbe and i40e. Move it to common libie header to use it across different driver. Leave device specific adminq commands in separate folders. This lead to a change that need to be done in filling/getting descriptor: - previous: struct specific_desc *cmd; cmd = &desc.params.specific_desc; - now: struct specific_desc *cmd; cmd = libie_aq_raw(&desc); Do this changes across the driver to allow clean build. The casting only have to be done in case of specific descriptors, for generic one union can still be used. Changes beside code moving: - change ICE_ prefix to LIBIE_ prefix (ice_ and libie_ too) - remove shift variables not otherwise needed (in libie_aq_flags) - fill/get descriptor data based on desc.params.raw whenever the descriptor isn't defined in libie - move defines from the libie_aq_sth structure outside - add libie_aq_raw helper and use it instead of explicit casting Reviewed by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Signed-off-by: Michal Swiatkowski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 4e45cca31d4e70019a5e0fe15208de72f6a55a5e Author: NeilBrown Date: Thu Jul 24 08:23:38 2025 +0900 smb/server: add ksmbd_vfs_kern_path() The function ksmbd_vfs_kern_path_locked() seems to serve two functions and as a result has an odd interface. On success it returns with the parent directory locked and with write access on that filesystem requested, but it may have crossed over a mount point to return the path, which makes the lock and the write access irrelevant. This patches separates the functionality into two functions: - ksmbd_vfs_kern_path() does not lock the parent, does not request write access, but does cross mount points - ksmbd_vfs_kern_path_locked() does not cross mount points but does lock the parent and request write access. The parent_path parameter is no longer needed. For the _locked case the final path is sufficient to drop write access and to unlock the parent (using path->dentry->d_parent which is safe while the lock is held). There were 3 caller of ksmbd_vfs_kern_path_locked(). - smb2_create_link() needs to remove the target if it existed and needs the lock and the write-access, so it continues to use ksmbd_vfs_kern_path_locked(). It would not make sense to cross mount points in this case. - smb2_open() is the only user that needs to cross mount points and it has no need for the lock or write access, so it now uses ksmbd_vfs_kern_path() - smb2_creat() does not need to cross mountpoints as it is accessing a file that it has just created on *this* filesystem. But also it does not need the lock or write access because by the time ksmbd_vfs_kern_path_locked() was called it has already created the file. So it could use either interface. It is simplest to use ksmbd_vfs_kern_path(). ksmbd_vfs_kern_path_unlock() is still needed after ksmbd_vfs_kern_path_locked() but it doesn't require the parent_path any more. After a successful call to ksmbd_vfs_kern_path(), only path_put() is needed to release the path. Signed-off-by: NeilBrown Acked-by: Namjae Jeon Signed-off-by: Steve French commit ded74fddcaf685a9440c5612f7831d0c4c1473ca Author: Christoph Hellwig Date: Tue Jul 15 14:30:10 2025 +0200 xfs: don't use a xfs_log_iovec for ri_buf in log recovery ri_buf just holds a pointer/len pair and is not a log iovec used for writing to the log. Switch to use a kvec instead. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 8bf931f99e84a31974f862e0f981738d048ab67f Author: Christoph Hellwig Date: Tue Jul 15 14:30:09 2025 +0200 xfs: don't use a xfs_log_iovec for attr_item names and values These buffers are not directly logged, just use a kvec and remove the xlog_copy_from_iovec helper only used here. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit e870cbe6fa7cf58ba6ef216ecfd6db1cde33a8f1 Author: Christoph Hellwig Date: Tue Jul 15 14:30:08 2025 +0200 xfs: use better names for size members in xfs_log_vec The lv_size member counts the size of the entire allocation, rename it to lv_alloc_size to make that clear. The lv_buf_len member tracks how much of lv_buf has been used up to format the log item, rename it to lv_buf_used to make that more clear. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 01774798c271de2e03ddaa1ad0f0fc94ee55cd9d Author: Christoph Hellwig Date: Tue Jul 15 14:30:07 2025 +0200 xfs: cleanup the ordered item logic in xlog_cil_insert_format_items Split out handling of ordered items into a single branch in xlog_cil_insert_format_items so that the rest of the code becomes more clear. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 469342210afe516dcb79551a8ac43030efc0c3ac Author: Christoph Hellwig Date: Tue Jul 15 14:30:06 2025 +0200 xfs: don't pass the old lv to xfs_cil_prepare_item By the time xfs_cil_prepare_item is called, the old lv is still pointed to by the log item. Take it from there instead of spreading the old lv logic over xlog_cil_insert_format_items and xfs_cil_prepare_item. Signed-off-by: Christoph Hellwig Reviewed-by: Carlos Maiolino Signed-off-by: Carlos Maiolino commit 75fe259ff7f67d5072f9b5b282be75e159e5e6c7 Author: Steven Rostedt Date: Tue Jul 22 16:19:11 2025 -0400 xfs: remove unused trace event xfs_reflink_cow_enospc The call to the event xfs_reflink_cow_enospc was removed when the COW handling was merged into xfs_file_iomap_begin_delay, but the trace event itself was not. Remove it. Fixes: db46e604adf8 ("xfs: merge COW handling into xfs_file_iomap_begin_delay") Signed-off-by: Steven Rostedt (Google) Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 2b74404188b56332d0c4bdab9a36b86a61b935c6 Author: Steven Rostedt Date: Tue Jul 22 16:19:10 2025 -0400 xfs: remove unused trace event xfs_discard_rtrelax The trace event xfs_discard_rtrelax was added but never used. Remove it. Fixes: a330cae8a7147 ("xfs: Remove header files which are included more than once") Signed-off-by: Steven Rostedt (Google) Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 3c4052cb9f7e606f25737d9ddbe849012cd28c47 Author: Steven Rostedt Date: Tue Jul 22 16:19:09 2025 -0400 xfs: remove unused trace event xfs_log_cil_return The trace event xfs_log_cil_return was added but never used. Remove it. Fixes: c1220522ef405 ("xfs: grant heads track byte counts, not LSNs") Signed-off-by: Steven Rostedt (Google) Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit b9adb86b9045e6e912035e5991d370ac769be0b8 Author: Steven Rostedt Date: Tue Jul 22 16:19:08 2025 -0400 xfs: remove unused trace event xfs_dqreclaim_dirty The tracepoint trace_xfs_dqreclaim_dirty was removed with other code removed from xfs_qm_dquot_isolate() but the defined tracepoint was not. Fixes: d62016b1a2df ("xfs: avoid dquot buffer pin deadlock") Signed-off-by: Steven Rostedt (Google) Reviewed-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit f4a3f01e8e451fb3cb444a95a59964f4bc746902 Author: Pranav Tyagi Date: Fri Jul 4 15:42:50 2025 +0530 fs/xfs: replace strncpy with memtostr_pad() Replace the deprecated strncpy() with memtostr_pad(). This also avoids the need for separate zeroing using memset(). Mark sb_fname buffer with __nonstring as its size is XFSLABEL_MAX and so no terminating NULL for sb_fname. Signed-off-by: Pranav Tyagi Reviewed-by: Carlos Maiolino Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 8c10b04f9fc1760cb79068073686d8866e59d40f Author: Alan Huang Date: Fri Jul 18 11:42:22 2025 +0800 xfs: Remove unused label in xfs_dax_notify_dev_failure Fixes: e967dc40d501 ("xfs: return the allocated transaction from xfs_trans_alloc_empty") Signed-off-by: Alan Huang Reviewed-by: Christoph Hellwig Signed-off-by: Carlos Maiolino commit 60e02f956d77af31b85ed4e73abf85d5f12d0a98 Author: Christoph Hellwig Date: Wed Jul 16 14:54:07 2025 +0200 xfs: improve the comments in xfs_select_zone_nowait The top of the function comment is outdated, and the parts still correct duplicate information in comment inside the function. Remove the top of the function comment and instead improve a comment inside the function. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 7cbbfd27a929398f027f0e8d01c80264f47db4e4 Author: Christoph Hellwig Date: Wed Jul 16 14:54:06 2025 +0200 xfs: improve the comments in xfs_max_open_zones Describe the rationale for the decisions a bit better. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 86e6ddf1d0ba4cad1f3212a2e3059401b5e5b748 Author: Christoph Hellwig Date: Wed Jul 16 14:54:04 2025 +0200 xfs: stop passing an inode to the zone space reservation helpers None of them actually needs the inode, the mount is enough. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 329b996d9210c734b2a93bcb4d69dc49a48881f6 Author: Christoph Hellwig Date: Wed Jul 16 14:54:03 2025 +0200 xfs: rename oz_write_pointer to oz_allocated This member just tracks how much space we handed out for sequential write required zones. Only for conventional space it actually is the pointer where thing are written at, otherwise zone append manages that. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 90b1bda80ece3624eb7962b9c00e6bcb9bbe2193 Author: Christoph Hellwig Date: Wed Jul 16 14:54:02 2025 +0200 xfs: use a uint32_t to cache i_used_blocks in xfs_init_zone i_used_blocks is a uint32_t, so use the same value for the local variable caching it. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 59655147ec34fb72cc090ca4ee688ece05ffac56 Author: Christoph Hellwig Date: Wed Jul 16 15:03:19 2025 +0200 xfs: improve the xg_active_ref check in xfs_group_free Split up the XFS_IS_CORRUPT statement so that it immediately shows if the reference counter overflowed or underflowed. I ran into this quite a bit when developing the zoned allocator, and had to reapply the patch for some work recently. We might as well just apply it upstream given that freeing group is far removed from performance critical code. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit ff67c13dc8f0a718e4097506bb9b8d7cbe8d691a Author: Christoph Hellwig Date: Wed Jul 16 14:43:18 2025 +0200 xfs: remove the xlog_ticket_t typedef Almost no users of the typedef left, kill it and switch the remaining users to use the underlying struct. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit e4a1df35be5d98ffbfb2a919211380167b350c29 Author: Christoph Hellwig Date: Wed Jul 16 14:43:17 2025 +0200 xfs: remove xrep_trans_{alloc,cancel}_hook_dummy XFS stopped using current->journal_info in commit f2e812c1522d ("xfs: don't use current->journal_info"), so there is no point in saving and restoring it. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 92176e32464c97179eadf26fbd1f82d642180e9b Author: Christoph Hellwig Date: Wed Jul 16 14:43:16 2025 +0200 xfs: return the allocated transaction from xchk_trans_alloc_empty xchk_trans_alloc_empty can't return errors, so return the allocated transaction directly instead of an output double pointer argument. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit d8e1ea43e5a314bc01ec059ce93396639dcf9112 Author: Christoph Hellwig Date: Wed Jul 16 14:43:15 2025 +0200 xfs: return the allocated transaction from xfs_trans_alloc_empty xfs_trans_alloc_empty can't return errors, so return the allocated transaction directly instead of an output double pointer argument. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 60538b0b54b38819fa94b2815b5d89863b074526 Author: Christoph Hellwig Date: Wed Jul 16 14:43:14 2025 +0200 xfs: don't use xfs_trans_reserve in xfs_trans_roll xfs_trans_roll uses xfs_trans_reserve to basically just call into xfs_log_regrant while bypassing the reset of xfs_trans_reserve. Open code the call to xfs_log_regrant in xfs_trans_roll and simplify xfs_trans_reserve now that it never regrants and always asks for a log reservation. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 83a80e95e797a2a6d14bf7983e5e6eecf8f5facb Author: Christoph Hellwig Date: Wed Jul 16 14:43:13 2025 +0200 xfs: decouple xfs_trans_alloc_empty from xfs_trans_alloc xfs_trans_alloc_empty only shares the very basic transaction structure allocation and initialization with xfs_trans_alloc. Split out a new __xfs_trans_alloc helper for that and otherwise decouple xfs_trans_alloc_empty from xfs_trans_alloc. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit f1cc16e1547e7be4245755be27bb11027344b4d0 Author: Christoph Hellwig Date: Wed Jul 16 14:43:12 2025 +0200 xfs: don't use xfs_trans_reserve in xfs_trans_reserve_more xfs_trans_reserve_more just tries to allocate additional blocks and/or rtextents and is otherwise unrelated to the transaction reservation logic. Open code the block and rtextent reservation in xfs_trans_reserve_more to prepare for simplifying xfs_trans_reserve. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 736b576d4d9836318ef890093e3b37c35619cfdf Author: Christoph Hellwig Date: Wed Jul 16 14:43:11 2025 +0200 xfs: use xfs_trans_reserve_more in xfs_trans_reserve_more_inode Instead of duplicating the empty transacaction reservation definition. Signed-off-by: Christoph Hellwig Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit ce6cce46aff79423f47680ee65e8f12191a50605 Author: Fedor Pchelkin Date: Wed Jul 2 12:39:33 2025 +0300 xfs: refactor xfs_btree_diff_two_ptrs() to take advantage of cmp_int() Use cmp_int() to yield the result of a three-way-comparison instead of performing subtractions with extra casts. Thus also rename the function to make its name clearer in purpose. Found by Linux Verification Center (linuxtesting.org). Signed-off-by: Fedor Pchelkin Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 2717eb35185581988799bb0d5179409978f36a90 Author: Fedor Pchelkin Date: Wed Jul 2 12:39:32 2025 +0300 xfs: use a proper variable name and type for storing a comparison result Perhaps that's just my silly imagination but 'diff' doesn't look good for the name of a variable to hold a result of a three-way-comparison (-1, 0, 1) which is what ->cmp_key_with_cur() does. It implies to contain an actual difference between the two integer variables but that's not true anymore after recent refactoring. Declaring it as int64_t is also misleading now. Plain integer type is more than enough. Found by Linux Verification Center (linuxtesting.org). Signed-off-by: Fedor Pchelkin Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 734b871d6cf7d4f815bb1eff8c808289079701c2 Author: Fedor Pchelkin Date: Wed Jul 2 12:39:31 2025 +0300 xfs: refactor cmp_key_with_cur routines to take advantage of cmp_int() The net value of these functions is to determine the result of a three-way-comparison between operands of the same type. Simplify the code using cmp_int() to eliminate potential errors with opencoded casts and subtractions. This also means we can change the return value type of cmp_key_with_cur routines from int64_t to int and make the interface a bit clearer. Found by Linux Verification Center (linuxtesting.org). Suggested-by: Darrick J. Wong Signed-off-by: Fedor Pchelkin Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 3b583adf55c649d5ba37bcd1ca87644b0bc10b86 Author: Fedor Pchelkin Date: Wed Jul 2 12:39:30 2025 +0300 xfs: refactor cmp_two_keys routines to take advantage of cmp_int() The net value of these functions is to determine the result of a three-way-comparison between operands of the same type. Simplify the code using cmp_int() to eliminate potential errors with opencoded casts and subtractions. This also means we can change the return value type of cmp_two_keys routines from int64_t to int and make the interface a bit clearer. Found by Linux Verification Center (linuxtesting.org). Suggested-by: Darrick J. Wong Signed-off-by: Fedor Pchelkin Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit 82b63ee160016096436aa026a27c8d85d40f3fb1 Author: Fedor Pchelkin Date: Wed Jul 2 12:39:29 2025 +0300 xfs: rename key_diff routines key_diff routines compare a key value with a cursor value. Make the naming to be a bit more self-descriptive. Found by Linux Verification Center (linuxtesting.org). Signed-off-by: Fedor Pchelkin Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit edce172444b4f489715a3df2e5d50893e74ce3da Author: Fedor Pchelkin Date: Wed Jul 2 12:39:28 2025 +0300 xfs: rename diff_two_keys routines One may think that diff_two_keys routines are used to compute the actual difference between the arguments but they return a result of a three-way-comparison of the passed operands. So it looks more appropriate to denote them as cmp_two_keys. Found by Linux Verification Center (linuxtesting.org). Signed-off-by: Fedor Pchelkin Reviewed-by: Darrick J. Wong Signed-off-by: Carlos Maiolino commit e0a05579b2b61ac2b6db4e3c10796a65fcf2b73a Author: Steven Rostedt Date: Mon Jun 16 13:51:59 2025 -0400 xfs: change xfs_xattr_class from a TRACE_EVENT() to DECLARE_EVENT_CLASS() xfs_xattr_class was accidentally created as a TRACE_EVENT() instead of a class with DECLARE_EVENT_CLASS(). Note, TRACE_EVENT() is just defined as: #define TRACE_EVENT(name, proto, args, tstruct, assign, print) \ DECLARE_EVENT_CLASS(name, \ PARAMS(proto), \ PARAMS(args), \ PARAMS(tstruct), \ PARAMS(assign), \ PARAMS(print)); \ DEFINE_EVENT(name, name, PARAMS(proto), PARAMS(args)); The difference between TRACE_EVENT() and DECLARE_EVENT_CLASS() is that TRACE_EVENT() also creates an event with the class name. Switch xfs_xattr_class over to being a class and not an event as it is not called directly, and that event with the class name takes up unnecessary memory. Fixes: e47dcf113ae3 ("xfs: repair extended attributes") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit 31b98ef2403fc38ba3bbe7663bdd034bfb0456c7 Author: Steven Rostedt Date: Mon Jun 16 13:51:58 2025 -0400 xfs: only create event xfs_file_compat_ioctl when CONFIG_COMPAT is configure The trace event xfs_file_compat_ioctl is only used when CONFIG_COMPAT is configured in the build. As trace events can take up to 5K in memory for text and meta data regardless if they are used, they should not be created when unused. Add #ifdef CONFIG_COMPAT around the event so that it is only created when that is configured. Fixes: cca28fb83d9e6 ("xfs: split xfs_itrace_entry") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit 9a8a536fe5a803d5323cb8d830db5551e78a5a22 Author: Steven Rostedt Date: Mon Jun 16 13:51:57 2025 -0400 xfs: remove usused xfs_end_io_direct events When the use of iomap_dio_rw was added, the calls to the trace events xfs_end_io_direct_unwritten and xfs_end_io_direct_append were removed but those trace events were not. As trace events can take up to 5K in memory for text and meta data regardless if they are used or not, they should not be created when not used. Remove the unused events. Fixes: acdda3aae146 ("xfs: use iomap_dio_rw") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit 88fd451594a6b42f37aa2b3c3647b5d8973e2e5f Author: Steven Rostedt Date: Mon Jun 16 13:51:56 2025 -0400 xfs: remove unused event xfs_pagecache_inval When the function xfs_flushinval_pages() was removed, it removed the only caller to the trace event xfs_pagecache_inval. As trace events can take up to 5K of memory in text and meta data each regardless if they are used or not, they should not be created when unused. Remove the unused event. Fixes: fb59581404ab ("xfs: remove xfs_flushinval_pages") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit f1100605590a13d362efe20f734d882305eb6e64 Author: Steven Rostedt Date: Mon Jun 16 13:51:55 2025 -0400 xfs: remove unused event xfs_alloc_near_nominleft When the function xfs_alloc_space_available() was restructured, it removed the only calls to the trace event xfs_alloc_near_nominleft. As trace events take up to 5K of memory for text and meta data for each event, they should not be created when not used. Remove this unused event. Fixes: 54fee133ad59 ("xfs: adjust allocation length in xfs_alloc_space_available") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit 237f8e885136a073b2a1a70768aa6f538fa634bd Author: Steven Rostedt Date: Mon Jun 16 13:51:54 2025 -0400 xfs: remove unused event xfs_alloc_near_error Trace events take up to 5K of memory in text and meta data regardless if they are used or not. The call to the event xfs_alloc_near_error was removed when the cursor data structure allocation was introduced. Remove it as it is no longer used and is just wasting memory. Fixes: f5e7dbea1e3e ("xfs: introduce allocation cursor data structure") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit ea26bbc7795b6ef49134231bdfc34569ed07f144 Author: Steven Rostedt Date: Mon Jun 16 13:51:53 2025 -0400 xfs: remove unused event xfs_attr_node_removename When xfs_attri_remove_iter() was removed, so was the call to the trace event xfs_attr_node_removename. As trace events can take up to 5K in memory for text and meta data regardless if they are used or not, they should not be created when unused. Remove the unused event. Fixes: 59782a236b622 ("xfs: remove xfs_attri_remove_iter") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit b54480c3b10d4f617e20c51f749015729db74228 Author: Steven Rostedt Date: Mon Jun 16 13:51:52 2025 -0400 xfs: remove unused xfs_attr events Trace events can take up to 5K in memory for text and meta data per event regardless if they are used or not, so they should not be defined when not used. The events xfs_attr_fillstate and xfs_attr_refillstate are only called in code that is #ifdef out and exists only for future reference. Remove these unused events. If the code is needed again, then git history can recover what the events were. Suggested-by: Christoph Hellwig Fixes: 59782a236b622 ("xfs: remove xfs_attri_remove_iter") Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit b3b5015d3454ae347644c99ec94bec7cba664716 Author: Steven Rostedt Date: Mon Jun 16 13:51:51 2025 -0400 xfs: remove unused trace event xfs_attr_rmtval_set When the function xfs_attr_rmtval_set() was removed, the call to the corresponding trace event was also removed but the trace event itself was not. As trace events can take up to 5K of memory in text and meta data regardless if they are used or not they should not be created when not used. Remove the unused trace event. Fixes: 0e6acf29db6f ("xfs: Remove xfs_attr_rmtval_set") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit 8c54845c3a02b40bb76916a94a50267cded68d2b Author: Steven Rostedt Date: Mon Jun 16 13:51:50 2025 -0400 xfs: remove unused xfs_reflink_compare_extents events When the clone/dedupe_file_rang common functions were refactored, it removed the calls to the xfs_reflink_compare_extents and xfs_reflink_compare_extents_error events. As each event can take up to 5K in memory for text and meta data regardless if they are used or not, they should not be created if they are not used. Remove these unused events. Fixes: 876bec6f9bbf ("vfs: refactor clone/dedupe_file_range common functions") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit 6f7080bd932f63d3390cefa8571def5d49b82068 Author: Steven Rostedt Date: Mon Jun 16 13:51:49 2025 -0400 xfs: remove unused event xfs_ioctl_clone The trace event xfs_ioctl_clone was added but never used. As trace events can take up to 5K of memory in text and meta data regardless if they are used or not, remove the unused trace event. Fixes: 53aa1c34f4eb ("xfs: define tracepoints for reflink activities") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit 32177ab8ba5f4002173f4ba2cf595aabf0c6c008 Author: Steven Rostedt Date: Mon Jun 16 13:51:48 2025 -0400 xfs: remove unused event xlog_iclog_want_sync The trace event xlog_iclog_want_sync was added but never used. As trace events can take up around 5K of memory in text and meta data regardless if they are used or not, remove this unused event. Fixes: 956f6daa84bf ("xfs: add iclog state trace events") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit 091e9451d0bdd5d98ad4fcbd55f7c4554bf9e60f Author: Steven Rostedt Date: Mon Jun 16 13:51:47 2025 -0400 xfs: remove unused trace event xfs_attr_remove_iter_return When the function xfs_attri_remove_iter was removed, it did not remove the trace event that it called. As a trace event can take up to 5K of memory for text and meta data regardless of if it is used or not, remove this unused trace event. Fixes: 59782a236b62 ("xfs: remove xfs_attri_remove_iter") Reviewed-by: Christoph Hellwig Signed-off-by: Steven Rostedt (Google) Signed-off-by: Carlos Maiolino commit 5b1ae9de71335865d06ff0e60eadcf368a735edf Merge: 3ae8cef210dd52 1f488fb91378e9 Author: Catalin Marinas Date: Thu Jul 24 16:03:34 2025 +0100 Merge branch 'for-next/feat_mte_store_only' into for-next/core * for-next/feat_mte_store_only: : MTE feature to restrict tag checking to store only operations kselftest/arm64/mte: Add MTE_STORE_ONLY testcases kselftest/arm64/mte: Preparation for mte store only test kselftest/arm64/abi: Add MTE_STORE_ONLY feature hwcap test KVM: arm64: Expose MTE_STORE_ONLY feature to guest arm64/hwcaps: Add MTE_STORE_ONLY hwcaps arm64/kernel: Support store-only mte tag check prctl: Introduce PR_MTE_STORE_ONLY arm64/cpufeature: Add MTE_STORE_ONLY feature commit 3ae8cef210dd52ae95fd5a87f9bea0932bd4e470 Merge: e480898e767c54 8e7a67ca5a8013 83bbd6be7d1712 cbbcfb94c55c02 bad3fa2fb9206f a8b8cce9d96d65 d09674f98cdbf5 4752dcc156f209 30ff3c981e48b3 9d1869f0f537d2 Author: Catalin Marinas Date: Thu Jul 24 16:01:22 2025 +0100 Merge branches 'for-next/livepatch', 'for-next/user-contig-bbml2', 'for-next/misc', 'for-next/acpi', 'for-next/debug-entry', 'for-next/feat_mte_tagged_far', 'for-next/kselftest', 'for-next/mdscr-cleanup' and 'for-next/vmap-stack', remote-tracking branch 'arm64/for-next/perf' into for-next/core * arm64/for-next/perf: (23 commits) drivers/perf: hisi: Support PMUs with no interrupt drivers/perf: hisi: Relax the event number check of v2 PMUs drivers/perf: hisi: Add support for HiSilicon SLLC v3 PMU driver drivers/perf: hisi: Use ACPI driver_data to retrieve SLLC PMU information drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver drivers/perf: hisi: Simplify the probe process for each DDRC version perf/arm-ni: Support sharing IRQs within an NI instance perf/arm-ni: Consolidate CPU affinity handling perf/cxlpmu: Fix typos in cxl_pmu.c comments and documentation perf/cxlpmu: Remove unintended newline from IRQ name format string perf/cxlpmu: Fix devm_kcalloc() argument order in cxl_pmu_probe() perf: arm_spe: Relax period restriction perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE) KVM: arm64: nvhe: Disable branch generation in nVHE guests arm64: Handle BRBE booting requirements arm64/sysreg: Add BRBE registers and fields perf/arm: Add missing .suppress_bind_attrs perf/arm-cmn: Reduce stack usage during discovery perf: imx9_perf: make the read-only array mask static const perf/arm-cmn: Broaden module description for wider interconnect support ... * for-next/livepatch: : Support for HAVE_LIVEPATCH on arm64 arm64: Kconfig: Keep selects somewhat alphabetically ordered arm64: Implement HAVE_LIVEPATCH arm64: stacktrace: Implement arch_stack_walk_reliable() arm64: stacktrace: Check kretprobe_find_ret_addr() return value arm64/module: Use text-poke API for late relocations. * for-next/user-contig-bbml2: : Optimise the TLBI when folding/unfolding contigous PTEs on hardware with BBML2 and no TLB conflict aborts arm64/mm: Elide tlbi in contpte_convert() under BBML2 iommu/arm: Add BBM Level 2 smmu feature arm64: Add BBM Level 2 cpu feature arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type * for-next/misc: : Miscellaneous arm64 patches arm64/gcs: task_gcs_el0_enable() should use passed task arm64: signal: Remove ISB when resetting POR_EL0 arm64/mm: Drop redundant addr increment in set_huge_pte_at() arm64: Mark kernel as tainted on SAE and SError panic arm64/gcs: Don't call gcs_free() when releasing task_struct arm64: fix unnecessary rebuilding when CONFIG_DEBUG_EFI=y arm64/mm: Optimize loop to reduce redundant operations of contpte_ptep_get arm64: pi: use 'targets' instead of extra-y in Makefile * for-next/acpi: : Various ACPI arm64 changes ACPI: Suppress misleading SPCR console message when SPCR table is absent ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled * for-next/debug-entry: : Simplify the debug exception entry path arm64: debug: remove debug exception registration infrastructure arm64: debug: split bkpt32 exception entry arm64: debug: split brk64 exception entry arm64: debug: split hardware watchpoint exception entry arm64: debug: split single stepping exception entry arm64: debug: refactor reinstall_suspended_bps() arm64: debug: split hardware breakpoint exception entry arm64: entry: Add entry and exit functions for debug exceptions arm64: debug: remove break/step handler registration infrastructure arm64: debug: call step handlers statically arm64: debug: call software breakpoint handlers statically arm64: refactor aarch32_break_handler() arm64: debug: clean up single_step_handler logic * for-next/feat_mte_tagged_far: : Support for reporting the non-address bits during a synchronous MTE tag check fault kselftest/arm64/mte: Add mtefar tests on check_mmap_options kselftest/arm64/mte: Refactor check_mmap_option test kselftest/arm64/mte: Add verification for address tag in signal handler kselftest/arm64/mte: Add address tag related macro and function kselftest/arm64/mte: Check MTE_FAR feature is supported kselftest/arm64/mte: Register mte signal handler with SA_EXPOSE_TAGBITS kselftest/arm64: Add MTE_FAR hwcap test KVM: arm64: Expose FEAT_MTE_TAGGED_FAR feature to guest arm64: Report address tag when FEAT_MTE_TAGGED_FAR is supported arm64/cpufeature: Add FEAT_MTE_TAGGED_FAR feature * for-next/kselftest: : Kselftest updates for arm64 kselftest/arm64: Handle attempts to disable SM on SME only systems kselftest/arm64: Fix SVE write data generation for SME only systems kselftest/arm64: Test SME on SME only systems in fp-ptrace kselftest/arm64: Test FPSIMD format data writes via NT_ARM_SVE in fp-ptrace kselftest/arm64: Allow sve-ptrace to run on SME only systems kselftest/arm4: Provide local defines for AT_HWCAP3 kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace kselftest/arm64: Fix test for streaming FPSIMD write in sve-ptrace kselftest/arm64: Fix check for setting new VLs in sve-ptrace kselftest/arm64: Convert tpidr2 test to use kselftest.h * for-next/mdscr-cleanup: : Drop redundant DBG_MDSCR_* macros KVM: selftests: Change MDSCR_EL1 register holding variables as uint64_t arm64/debug: Drop redundant DBG_MDSCR_* macros * for-next/vmap-stack: : Force VMAP_STACK on arm64 arm64: remove CONFIG_VMAP_STACK checks from entry code arm64: remove CONFIG_VMAP_STACK checks from SDEI stack handling arm64: remove CONFIG_VMAP_STACK checks from stacktrace overflow logic arm64: remove CONFIG_VMAP_STACK conditionals from traps overflow stack arm64: remove CONFIG_VMAP_STACK conditionals from irq stack setup arm64: Remove CONFIG_VMAP_STACK conditionals from THREAD_SHIFT and THREAD_ALIGN arm64: efi: Remove CONFIG_VMAP_STACK check arm64: Mandate VMAP_STACK arm64: efi: Fix KASAN false positive for EFI runtime stack arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() arm64/gcs: Don't call gcs_free() during flush_gcs() arm64: Restrict pagetable teardown to avoid false warning docs: arm64: Fix ICC_SRE_EL2 register typo in booting.rst commit 58d5f0d437a8e036a65eeddfb7df2b5d6107f1ef Author: Gabriele Monaco Date: Wed Jul 23 18:12:40 2025 +0200 rv: Return init error when registering monitors Monitors generated with dot2k have their registration function (the one called during monitor initialisation) return always 0, even if the registration failed on RV side. This can hide potential errors. Return the value returned by the RV register function. Cc: Masami Hiramatsu Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250723161240.194860-6-gmonaco@redhat.com Reviewed-by: Nam Cao Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 560473f2e2d77e153cb12ce1ef53c2abb6a5f0ca Author: Gabriele Monaco Date: Wed Jul 23 18:12:39 2025 +0200 verification/rvgen: Organise Kconfig entries for nested monitors The current behaviour of rvgen when running with the -a option is to append the necessary lines at the end of the configuration for Kconfig, Makefile and tracepoints. This is not always the desired behaviour in case of nested monitors: while tracepoints are not affected by nesting and the Makefile's only requirement is that the parent monitor is built before its children, in the Kconfig it is better to have children defined right after their parent, otherwise the result has wrong indentation: [*] foo_parent monitor [*] foo_child1 monitor [*] foo_child2 monitor [*] bar_parent monitor [*] bar_child1 monitor [*] bar_child2 monitor [*] foo_child3 monitor [*] foo_child4 monitor Adapt rvgen to look for a different marker for nested monitors in the Kconfig file and append the line right after the last sibling, instead of the last monitor. Also add the marker when creating a new parent monitor. Cc: Masami Hiramatsu Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250723161240.194860-5-gmonaco@redhat.com Reviewed-by: Nam Cao Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 9efcf590827cd88cbb68b0f93b20c5f5add905f4 Author: Gabriele Monaco Date: Wed Jul 23 18:12:38 2025 +0200 tools/dot2c: Fix generated files going over 100 column limit The dot2c.py script generates all states in a single line. This breaks the 100 column limit when the state machines are non-trivial. Change dot2c.py to generate the states in separate lines in case the generated line is going to be too long. Also adapt existing monitors with line length over the limit. Cc: Masami Hiramatsu Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250723161240.194860-4-gmonaco@redhat.com Suggested-by: Nam Cao Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 1160ccaf772ffd8f9388da26d1832c7da845e7b4 Author: Gabriele Monaco Date: Wed Jul 23 18:12:37 2025 +0200 tools/rv: Stop gracefully also on SIGTERM Currently the userspace RV tool starts a monitor and waits for the user to press Ctrl-C (SIGINT) to terminate and stop the monitor. This doesn't account for a scenario where a user starts RV in background and simply kills it (SIGTERM unless the user specifies differently). E.g.: # rv mon wip & # kill % Would terminate RV without stopping the monitor and next RV executions won't start correctly. Register the signal handler used for SIGINT also to SIGTERM. Cc: Nam Cao Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250723161240.194860-3-gmonaco@redhat.com Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit f60227f3448911b682c45041c3fbd94f6d3b15a2 Author: Gabriele Monaco Date: Wed Jul 23 18:12:36 2025 +0200 tools/rv: Do not skip idle in trace Currently, the userspace RV tool skips trace events triggered by the RV tool itself, this can be changed by passing the parameter -s, which sets the variable config_my_pid to 0 (instead of the tool's PID). This has the side effect of skipping events generated by idle (PID 0). Set config_my_pid to -1 (an invalid pid) to avoid skipping idle. Cc: Nam Cao Cc: Tomas Glozar Cc: Juri Lelli Cc: Clark Williams Cc: John Kacur Link: https://lore.kernel.org/20250723161240.194860-2-gmonaco@redhat.com Fixes: 6d60f89691fc ("tools/rv: Add in-kernel monitor interface") Signed-off-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit f3735df6281e3011f9d650824ef7cd40e5b6f15b Author: Nam Cao Date: Fri Jul 18 16:58:11 2025 +0200 verification/rvgen: Do not generate unused variables ltl2k generates all variable definition in both ltl_start() and ltl_possible_next_states(). However, these two functions may not use all the variables, causing "unused variable" compiler warning. Change the script to only generate used variables. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/636b2b2d99a9bd46a9f77a078d44ebd7ffc7508c.1752850449.git.namcao@linutronix.de Signed-off-by: Nam Cao Reviewed-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit 6fb37c2a27ebdddddcc36dbdfb6b88cc9f932895 Author: Nam Cao Date: Fri Jul 18 16:58:10 2025 +0200 verification/rvgen: Generate each variable definition only once If a variable appears multiple times in the specification, ltl2k generates multiple variable definitions. This fails the build. Make sure each variable is only defined once. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Gabriele Monaco Link: https://lore.kernel.org/107dcf0d0aa8482d5fbe0314c3138f61cd284e91.1752850449.git.namcao@linutronix.de Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 8cfcf9b0e92f917fd3eee19a46924ad3a2f31259 Author: Nam Cao Date: Fri Jul 11 15:17:38 2025 +0200 verification/rvgen: Support the 'next' operator The 'next' operator is a unary operator. It is defined as: "next time, the operand must be true". Support this operator. For RV monitors, "next time" means the next invocation of ltl_validate(). Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/9c32cec04dd18d2e956fddd84b0e0a2503daa75a.1752239482.git.namcao@linutronix.de Signed-off-by: Nam Cao Tested-by: Gabriele Monaco Signed-off-by: Steven Rostedt (Google) commit e93648e86273a5d74b4fb96b645950249668093c Author: Nam Cao Date: Fri Jul 4 15:20:07 2025 +0200 Documentation/rv: Add documentation for linear temporal logic monitors Add documents describing linear temporal logic runtime verification monitors and how to generate them using rvgen. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Gabriele Monaco Link: https://lore.kernel.org/be13719e66fd8da147d7c69d5365aa23c52b743f.1751634289.git.namcao@linutronix.de Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 97ffa4ce6ab329bf601f1362bb2e181636fcc3a0 Author: Nam Cao Date: Fri Jul 4 15:20:06 2025 +0200 verification/rvgen: Add support for linear temporal logic Add support for generating RV monitors from linear temporal logic, similar to the generation of deterministic automaton monitors. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Gabriele Monaco Link: https://lore.kernel.org/f3c63b363ff9c5af3302ba2b5d92a26a98700eaf.1751634289.git.namcao@linutronix.de Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit cce86e03a27fdce11684c85ee33c528124904d8d Author: Nam Cao Date: Fri Jul 4 15:20:04 2025 +0200 verification/rvgen: Restructure the classes to prepare for LTL inclusion Both container generation and DA monitor generation is implemented in the class dot2k. That requires some ugly "if is_container ... else ...". If linear temporal logic support is added at the current state, the "if else" chain is longer and uglier. Furthermore, container generation is irrevelant to .dot files. It is therefore illogical to be implemented in class "dot2k". Clean it up, restructure the dot2k class into the following class hierarchy: (RVGenerator) /\ / \ / \ / \ / \ (Container) (Monitor) /\ / \ / \ / \ (dot2k) [ltl2k] <- intended This allows a simple and clean integration of LTL. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/692137a581ba6bee7a64d37fb7173ae137c47bbd.1751634289.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit ccb21fc879636f9197b29908895174218e11d8ef Author: Nam Cao Date: Fri Jul 4 15:20:03 2025 +0200 verification/rvgen: Restructure the templates files To simply the scripts and to allow easy integration of new monitor types, restructure the template files as followed: 1. Move the template files to be in the same directory as the rvgen package. Furthermore, the installation will now only install the templates to the package directory, not /usr/share/. This simplify templates reading, as the scripts do not need to find the templates at multiple places. 2. Move dot2k_templates/* to: - templates/dot2k/ - templates/container/ This allows sharing templates reading code between DA monitor generation and container generation (and any future generation type). For template files which can be shared between different generation types, support putting them in templates/ This restructure aligns with the recommendation from: https://python-packaging.readthedocs.io/en/latest/non-code-files.html Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/462d90273f96804d3ba850474877d5f727031258.1751634289.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit f40a7c060207090f41998025fcd1cfad06ea2780 Author: Nam Cao Date: Fri Jul 4 15:20:02 2025 +0200 Documentation/rv: Prepare monitor synthesis document for LTL inclusion Monitor synthesis from deterministic automaton and linear temporal logic have a lot in common. Therefore a single document should describe both. Change da_monitor_synthesis.rst to monitor_synthesis.rst. LTL monitor synthesis will be added to this file by a follow-up commit. This makes the diff far easier to read. If renaming and adding LTL info is done in a single commit, git wouldn't recognize it as a rename, but a file removal and a file addition. While at it, correct the old dot2k commands to the new rvgen commands. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/d91c6e4600287f4732d68a014219e576a75ce6dc.1751634289.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit b6c62aa7914b386c4a8983ec3a537399f523cf18 Author: Nam Cao Date: Fri Jul 4 15:20:01 2025 +0200 verification/dot2k: Prepare the frontend for LTL inclusion The dot2k tool has some code that can be reused for linear temporal logic monitor. Prepare its frontend for LTL inclusion: 1. Rename to be generic: rvgen 2. Replace the parameter --dot with 2 parameters: --class: to specific the monitor class, can be 'da' or 'ltl' --spec: the monitor specification file, .dot file for DA, and .ltl file for LTL The old command: python3 dot2/dot2k monitor -d wip.dot -t per_cpu is equivalent to the new commands: python3 rvgen monitor -c da -s wip.dot -t per_cpu Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/dea18f7a44374e4db8df5c7e785604bc3062ffc9.1751634289.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 5270a0e3041cba8aef76aaf62408313b9cd4ad9f Author: Nam Cao Date: Fri Jul 4 15:19:59 2025 +0200 verification/dot2k: Replace is_container() hack with subparsers dot2k is used for both generating deterministic automaton (DA) monitor and generating container monitor. Generating DA monitor and generating container requires different parameters. This is implemented by peeking at sys.argv and check whether "--container" is specified, and use that information to make some parameters optional or required. This works, but is quite hacky and ugly. Replace this hack with Python's built-in subparsers. The old commands: python3 dot2/dot2k -d wip.dot -t per_cpu python3 dot2/dot2k -n sched --container are equivalent to the new commands: python3 dot2/dot2k monitor -d wip.dot -t per_cpu python3 dot2/dot2k container -n sched Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/23c4e3c6e10c39e86d8e6a289208dde407efc4a8.1751634289.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 612934e99b562c959ea5fc4c3adc75248b17b818 Author: Nam Cao Date: Fri Jul 4 15:19:58 2025 +0200 verification/dot2k: Remove __buff_to_string() str.join() can do what __buff_to_string() does. Therefore replace __buff_to_string() to make the scripts more pythonic. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/860d6002659f604c743e0f23d5cf3c99ea6a82d8.1751634289.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 214459699fd202c28b7b9f787e674acbd3af724a Author: Nam Cao Date: Fri Jul 4 15:19:57 2025 +0200 verification/dot2k: Make a separate dot2k_templates/Kconfig_container A generated container's Kconfig has an incorrect line: select DA_MON_EVENTS_IMPLICIT This is due to container generation uses the same template Kconfig file as deterministic automaton monitor. Therefore, make a separate Kconfig template for container which has only the necessaries for container. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/d54fd7ee120785bec5695220e837dbbd6efb30e5.1751634289.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 35293ebbb65e0295d3b9357f786004ae1026d00f Author: Zhiyu Zhang Date: Mon Jul 14 00:34:18 2025 +0800 scripts: add origin commit identification based on specific patterns This patch adds the functionability to smartly identify origin commit of the translation by matching the following patterns in commit log: 1) update to commit HASH 2) Update the translation through commit HASH If no such pattern is found, script will obey the original workflow. Signed-off-by: Zhiyu Zhang Reviewed-by: Dongliang Mu Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250713163418.1459-1-zhiyuzhang999@gmail.com commit 2b16b71a05a7f056221751b906c13f8809656b1f Author: Mauro Carvalho Chehab Date: Thu Jul 17 13:37:19 2025 +0200 sphinx: kernel_abi: fix performance regression with O= The logic there which adds a dependency note to Sphinx cache is not taking into account that the build dir may not be the source dir. This causes a performance regression: $ time make O=/tmp/foo SPHINXDIRS=admin-guide htmldocs [OUTDATED] Added: set() Changed: {'abi-obsolete', 'abi-removed', 'abi-stable-files', 'abi-obsolete-files', 'abi-stable', 'abi', 'abi-removed-files', 'abi-testing-files', 'abi-testing', 'gpio/index', 'gpio/obsolete'} Removed: set() All docs count: 385 Found docs count: 385 real 0m11,324s user 0m15,783s sys 0m1,164s To get the root cause of the problem (ABI files reported as changed), I used this changeset: diff --git a/Documentation/conf.py b/Documentation/conf.py index e8766e689c1b..ab486623bd8b 100644 --- a/Documentation/conf.py +++ b/Documentation/conf.py @@ -571,3 +571,16 @@ def setup(app): """Patterns need to be updated at init time on older Sphinx versions""" app.connect('config-inited', update_patterns) + app.connect('env-get-outdated', on_outdated) + +def on_outdated(app, env, added, changed, removed): + """Track cache outdated due to added/changed/removed files""" + print("\n[OUTDATED]") + print(f"Added: {added}") + print(f"Changed: {changed}") + print(f"Removed: {removed}") + print(f"All docs count: {len(env.all_docs)}") + print(f"Found docs count: {len(env.found_docs)}") + + # Just return what we have + return added | changed | removed Reported-by: Akira Yokosawa Closes: https://lore.kernel.org/linux-doc/c174f7c5-ec21-4eae-b1c3-f643cca90d9d@gmail.com/ Signed-off-by: Mauro Carvalho Chehab Tested-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/e25673d87357457bc54ee863e97ff8f75956580d.1752752211.git.mchehab+huawei@kernel.org commit 3597405effbb17f3dc15b714be04398a91c87a62 Author: Andrew Donnellan Date: Wed Jul 23 17:51:34 2025 +1000 Documentation: core-api: entry: Replace deprecated KVM entry/exit functions The x86-specific functions kvm_guest_{enter,exit}_irqoff() were removed and replaced by the generic guest_state_{enter,exit}_irqoff() in commit ef9989afda73 ("kvm: add guest_state_{enter,exit}_irqoff()") and commit b2d2af7e5df3 ("kvm/x86: rework guest entry logic"). Update the references in the entry/exit handling documentation. Cc: Thomas Gleixner Cc: Nicolas Saenz Julienne Cc: Mark Rutland Signed-off-by: Andrew Donnellan Reviewed-by: Thomas Gleixner Acked-by: Mark Rutland Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250723075134.105132-1-ajd@linux.ibm.com commit fa79e55d467366a2c52c68a261a0d6ea5f8a6534 Author: Vignesh Raman Date: Wed Jul 23 15:58:32 2025 +0530 docs: fault-injection: drop reference to md-faulty Commit 415c7451872b ("md: Remove deprecated CONFIG_MD_FAULTY") removed the md-faulty driver, so drop the outdated reference from the fault-injection documentation. Signed-off-by: Vignesh Raman Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250723102835.232740-1-vignesh.raman@collabora.com commit 678bae2eaa812662929a83b3de399645e9de93ad Author: Arnd Bergmann Date: Tue Jul 22 17:35:43 2025 +0200 gpiolib: make legacy interfaces optional The traditional interfaces are only used on a small number of ancient boards. Make these optional now so they can be disabled by default. Signed-off-by: Arnd Bergmann Reviewed-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250722153634.3683927-1-arnd@kernel.org Signed-off-by: Bartosz Golaszewski commit dabd3e7dcc5881d5d3d6dc60c6f14780fee9a9bd Author: Steven Rostedt Date: Wed Jul 23 12:42:02 2025 -0400 tracing: Have eprobes handle arrays eprobes are dynamic events that can read other events using their fields to create new events. Currently it doesn't work with arrays. When the new event field is attached to the old event field, it looks at the size of the field to determine what type of field the new field should be. For 1 byte fields it's a char, for 2 bytes, it's a short and for 4 bytes it's an integer. For all other sizes it just defaults to "long". This also reads the contents of the field for such cases. For arrays that are bigger than the size of long, return the value of the address of the content itself. This will allow eprobes to read other values in the array of the old event. This is useful when raw_syscalls is enabled but the syscall events are not. The syscall events are created from the raw_syscalls as they have an array of "args" that holds the 6 long words passed to the syscall entry point. To read the value of "filename" from sys_openat, the eprobe could attach to the raw_syscall and read the second value. It can then even be passed to a synthetic event and converted back to another eprobe to get the value of "filename" after it has been read by the kernel during the system call: [ Create an eprobe called "sys" and attach it to sys_enter. Read the id of the system call and the second argument ] # echo 'e:sys raw_syscalls.sys_enter nr=$id:u32 arg2=+8($args):u64' >> /sys/kernel/tracing/dynamic_events [ Create a synthetic event "path" that will hold the address of the sys_openat filename. This is on a 64bit machine, so make it 64 bits ] # echo 's:path u64 file;' >> /sys/kernel/tracing/dynamic_events [ Add a histogram to the eprobe/sys which tiggers if the "nr" field is 257 (sys_openat), and save the filename in the "file" variable. ] # echo 'hist:keys=common_pid:file=arg2 if nr == 257' > /sys/kernel/tracing/events/eprobes/sys/trigger [ Attach a histogram to sys_exit event that triggers the "path" synthetic event and records the "filename" that was passed from the sys eprobe. ] # echo 'hist:keys=common_pid:f=$file:onmatch(eprobes.sys).trace(path,$f)' >> /sys/kernel/tracing/events/raw_syscalls/sys_exit/trigger [ Create another eprobe that dereferences the "file" field as a user space string and displays it. ] # echo 'e:open synthetic.path file=+0($file):ustring' >> /sys/kernel/tracing/dynamic_events # echo 1 > /sys/kernel/tracing/events/eprobes/open/enable # cat trace_pipe cat-1142 [003] ...5. 799.521912: open: (synthetic.path) file="/etc/ld.so.cache" cat-1142 [003] ...5. 799.521934: open: (synthetic.path) file="/etc/ld.so.cache" cat-1142 [003] ...5. 799.522065: open: (synthetic.path) file="/etc/ld.so.cache" cat-1142 [003] ...5. 799.522080: open: (synthetic.path) file="/etc/ld.so.cache" cat-1142 [003] ...5. 799.522296: open: (synthetic.path) file="/lib/x86_64-linux-gnu/libc.so.6" cat-1142 [003] ...5. 799.522319: open: (synthetic.path) file="/lib/x86_64-linux-gnu/libc.so.6" less-1143 [005] ...5. 799.522327: open: (synthetic.path) file="/etc/ld.so.cache" cat-1142 [003] ...5. 799.522333: open: (synthetic.path) file="/lib/x86_64-linux-gnu/libc.so.6" cat-1142 [003] ...5. 799.522348: open: (synthetic.path) file="/lib/x86_64-linux-gnu/libc.so.6" less-1143 [005] ...5. 799.522349: open: (synthetic.path) file="/etc/ld.so.cache" cat-1142 [003] ...5. 799.522363: open: (synthetic.path) file="/lib/x86_64-linux-gnu/libc.so.6" less-1143 [005] ...5. 799.522477: open: (synthetic.path) file="/etc/ld.so.cache" cat-1142 [003] ...5. 799.522489: open: (synthetic.path) file="/lib/x86_64-linux-gnu/libc.so.6" less-1143 [005] ...5. 799.522492: open: (synthetic.path) file="/etc/ld.so.cache" less-1143 [005] ...5. 799.522720: open: (synthetic.path) file="/lib/x86_64-linux-gnu/libtinfo.so.6" less-1143 [005] ...5. 799.522744: open: (synthetic.path) file="/lib/x86_64-linux-gnu/libtinfo.so.6" less-1143 [005] ...5. 799.522759: open: (synthetic.path) file="/lib/x86_64-linux-gnu/libtinfo.so.6" cat-1142 [003] ...5. 799.522850: open: (synthetic.path) file="/lib/x86_64-linux-gnu/libc.so.6" Link: https://lore.kernel.org/all/20250723124202.4f7475be@batman.local.home/ Signed-off-by: Steven Rostedt (Google) Signed-off-by: Masami Hiramatsu (Google) commit 6ed5e20466c79e3b3350bae39f678f73cf564b4e Author: Ben Hutchings Date: Wed Jul 23 12:49:25 2025 +0200 bootconfig: Fix unaligned access when building footer Currently we add padding between the bootconfig text and footer to ensure that the footer is aligned within the initramfs image. However, because only the bootconfig data is held in memory, not the full initramfs image, the footer may not be naturally aligned in memory. This can result in an alignment fault (SIGBUS) when writing the footer on some architectures, such as sparc. Build the footer in a struct on the stack before adding it to the buffer. References: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=sparc64&ver=6.16%7Erc7-1%7Eexp1&stamp=1753209801&raw=0 Link: https://lore.kernel.org/all/aIC-NTw-cdm9ZGFw@decadent.org.uk/ Signed-off-by: Ben Hutchings Signed-off-by: Masami Hiramatsu (Google) commit 94619ea2d933a2efeea5af63ec909bf2f1519a0e Merge: 8aad37d16cffb6 95cfe23285a6de Author: Paolo Abeni Date: Thu Jul 24 15:13:20 2025 +0200 Merge tag 'ipsec-next-2025-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next Steffen Klassert says: ==================== pull request (net-next): ipsec-next 2025-07-23 1) Optimize to hold device only for the asynchronous decryption, where it is really needed. From Jianbo Liu. 2) Align our inbund SA lookup to RFC 4301. Only SPI and protocol should be used for an inbound SA lookup. From Aakash Kumar S. 3) Skip redundant statistics update for xfrm crypto offload. From Jianbo Liu. Please pull or let me know if there are problems. * tag 'ipsec-next-2025-07-23' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next: xfrm: Skip redundant statistics update for crypto offload xfrm: Duplicate SPI Handling xfrm: hold device only for the asynchronous decryption ==================== Link: https://patch.msgid.link/20250723080402.3439619-1-steffen.klassert@secunet.com Signed-off-by: Paolo Abeni commit 8b61c8919dff080d83415523cd68f2fef03ccfc7 Author: Fabrizio Castro Date: Fri Jul 4 17:20:35 2025 +0100 spi: Add driver for the RZ/V2H(P) RSPI IP The Renesas RZ/V2H(P) RSPI IP supports 4-wire and 3-wire serial communications in both host role and target role. It can use a DMA, but the I/O can also be driven by the processor. RX-only, TX-only, and RX-TX operations are available in DMA mode, while in processor I/O mode it only RX-TX operations are supported. Add a driver to support 4-wire serial communications as host role in processor I/O mode. Signed-off-by: Fabrizio Castro Link: https://patch.msgid.link/20250704162036.468765-3-fabrizio.castro.jz@renesas.com Signed-off-by: Mark Brown commit 44b91d61c505863b8ae90b7094aee5ca0dce808f Author: Fabrizio Castro Date: Fri Jul 4 17:20:34 2025 +0100 spi: dt-bindings: Document the RZ/V2H(P) RSPI Add dt-bindings for the RSPI IP found inside the Renesas RZ/V2H(P) SoC. Signed-off-by: Fabrizio Castro Reviewed-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Link: https://patch.msgid.link/20250704162036.468765-2-fabrizio.castro.jz@renesas.com Signed-off-by: Mark Brown commit da98e8b97058c73b5c58e9976af2e7286f1c799b Author: Varshini Rajendran Date: Tue Jun 10 12:20:05 2025 +0530 ASoC: dt-bindings: atmel,at91-ssc: add microchip,sam9x7-ssc Add microchip,sam9x7-ssc to DT bindings documentation. Signed-off-by: Varshini Rajendran Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250610065005.64070-1-varshini.rajendran@microchip.com Signed-off-by: Mark Brown commit 2260bc6ea8bd57aec92cbda770de9cc95232f64d Author: Chancel Liu Date: Wed Jul 23 16:37:25 2025 +0900 ASoC: imx-card: Add WM8524 support WM8524 is a stereo DAC. Add support for this codec in imx-card ASoC machine driver. Signed-off-by: Chancel Liu Link: https://patch.msgid.link/20250723073725.787844-1-chancel.liu@nxp.com Signed-off-by: Mark Brown commit bca53a176f3d46fdab67f9e2fb1a185e0233d98d Merge: 0aa9e51298aedd c58c35ef6ae62e Author: Takashi Iwai Date: Thu Jul 24 14:47:49 2025 +0200 Merge tag 'asoc-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-next ASoC: Updates for v6.17 There's a few new drivers here and quite a lot of cleanup work from Morimoto-san but generally this has been quite a quiet release, resulting in a fairly small diffstat. Highlights include: - Refactoring of the Kconfig menus to be hopefully more consistant and easier to navigate. - Refactoring of the DAPM code, mainly hiding functionality that doesn't need to be exposed to drivers. - Removal of the unused upstream weak paths DAPM functionality. - Further work on the generic handling for SoundWire SDCA devices. - Cleanups of our usage of the PM autosuspend functions, this pulls in some PM core changes on a shared tag. - Support for AMD ACP7.2 and SoundWire on ACP 7.1, Fairphone 4 & 5, various Intel systems, Qualcomm QCS8275, Richtek RTQ9124 and TI TAS5753. commit 0aa9e51298aedd39bc46b0aa61ef2043075cd70a Merge: ab29b3460c5cec 0d57ed922b9a9b Author: Takashi Iwai Date: Thu Jul 24 14:46:21 2025 +0200 Merge branch 'for-linus' into for-next Merge the last-piece from 6.16 devel branch to sync the code base. Signed-off-by: Takashi Iwai commit 6776ecc9dd587c08a6bb334542f9f8821a091013 Author: Shengjiu Wang Date: Thu Jul 10 11:04:05 2025 +0800 ASoC: fsl_xcvr: get channel status data with firmware exists For the XCVR module on i.MX95, even though it only supports SPDIF, the channel status needs to be obtained from RAM space, which is processed by firmware. Firmware is necessary to trigger the FSL_XCVR_IRQ_NEW_CS interrupt. This change also applies for the SPDIF & ARC function on i.MX8MP which has the firmware. Fixes: e6a9750a346b ("ASoC: fsl_xcvr: Add suspend and resume support") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20250710030405.3370671-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit ca592e20659e0304ebd8f4dabb273da4f9385848 Author: Shengjiu Wang Date: Thu Jul 10 11:04:04 2025 +0800 ASoC: fsl_xcvr: get channel status data when PHY is not exists There is no PHY for the XCVR module on i.MX93, the channel status needs to be obtained from FSL_XCVR_RX_CS_DATA_* registers. And channel status acknowledge (CSA) bit should be set once channel status is processed. Fixes: e240b9329a30 ("ASoC: fsl_xcvr: Add support for i.MX93 platform") Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20250710030405.3370671-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 0ef2a9779e9decee52a85bc393309b3e068a74a6 Author: Xianwei Zhao Date: Fri Jul 18 09:52:18 2025 +0800 MAINTAINERS: Add an entry for Amlogic spi driver Add Amlogic spi entry to MAINTAINERS to clarify the maintainers. Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20250718-spisg-v5-3-b8f0f1eb93a2@amlogic.com Signed-off-by: Mark Brown commit cef9991e04aed3305c61c392e880f6e01a0c2ea4 Author: Sunny Luo Date: Fri Jul 18 09:52:17 2025 +0800 spi: Add Amlogic SPISG driver Introduced support for the new SPI IP (SPISG) driver. The SPISG is a communication-oriented SPI controller from Amlogic,supporting three operation modes: PIO, block DMA, and scatter-gather DMA. Due to there is no FIFO, PIO mode can only transfer one word at a time, which is extremely slow. Therefore, this mode was not implemented. Signed-off-by: Sunny Luo Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20250718-spisg-v5-2-b8f0f1eb93a2@amlogic.com Signed-off-by: Mark Brown commit 78d35a20783941c8ba5cf912349728c6e1bee84b Author: Sunny Luo Date: Fri Jul 18 09:52:16 2025 +0800 spi: dt-bindings: Add binding document of Amlogic SPISG controller The SPISG is a new communication oriented SPI controller of Amlogic, which supports PIO, block DMA and scatter-gather DMA three operation modes. Signed-off-by: Sunny Luo Acked-by: Conor Dooley Signed-off-by: Xianwei Zhao Link: https://patch.msgid.link/20250718-spisg-v5-1-b8f0f1eb93a2@amlogic.com Signed-off-by: Mark Brown commit f6b159431697c903da1418e70c825faa0cddbdae Author: Zixian Zeng Date: Sun Jul 20 16:31:45 2025 +0800 spi: spi-sg2044-nor: Add SPI-NOR controller for SG2042 Add support for SOPHGO SG2042 SPI-NOR flash controller. Signed-off-by: Zixian Zeng Reviewed-by: Chen Wang & Tested-by: Chen Wang Link: https://patch.msgid.link/20250720-sfg-spifmc-v4-3-033188ad801e@gmail.com Reviewed-by: Chen Wang & Tested-by: Chen Wang Signed-off-by: Mark Brown commit 5653b4f8840801d9d141ba6a6c10e7cc15040c5b Author: Zixian Zeng Date: Sun Jul 20 16:31:44 2025 +0800 spi: spi-sg2044-nor: Add configurable chip_info SG2044 and SG2042 have similar SPI-NOR flash controller design, but have incompatibility which causes existing driver not working on SG2042: 1. SPI-NOR flash controller on SG2042 have no OPT register. 2. FIFO trigger level on SG2042 should be strictly less than 8. So introduce a new configurable chip_info structure to hold the different configuration. Link: https://github.com/sophgo/sophgo-doc/blob/main/SG2042/TRM/source/SPI-flash.rst Signed-off-by: Zixian Zeng Reviewed-by: Chen Wang & Tested-by: Chen Wang Link: https://patch.msgid.link/20250720-sfg-spifmc-v4-2-033188ad801e@gmail.com Reviewed-by: Chen Wang & Tested-by: Chen Wang Signed-off-by: Mark Brown commit 7438379cfc47046f7507dfdb54906acf56288b9f Author: Zixian Zeng Date: Sun Jul 20 16:31:43 2025 +0800 spi: dt-bindings: spi-sg2044-nor: Change SOPHGO SG2042 With further testing, directly using the spi-sg2044-nor driver on SG2042 does not work. SG2042 is found to lack full compatibility with SG2044. SG2044 has OPT register and it's necessary to write but SG2042 does not. Due to other possible hardware detail differences, it is better to bind SG2042 independently. Fixes: 8450f1e0d3d0 ("spi: dt-bindings: spi-sg2044-nor: Add SOPHGO SG2042") Signed-off-by: Zixian Zeng Acked-by: Rob Herring (Arm) Reviewed-by: Chen Wang & Tested-by: Chen Wang Link: https://patch.msgid.link/20250720-sfg-spifmc-v4-1-033188ad801e@gmail.com Reviewed-by: Chen Wang & Tested-by: Chen Wang Signed-off-by: Mark Brown commit 50a479527ef01f9b36dde1803a7e81741a222509 Author: Charles Keepax Date: Fri Jul 18 14:54:32 2025 +0100 ASoC: SDCA: Add support for -cn- value properties Many of the DisCo properties that specify Control values have an additional variant that specifies a separate value for each Control Number. Add support for these. Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20250718135432.1048566-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 061fade7a67f6cdfe918a675270d84107abbef61 Author: Charles Keepax Date: Fri Jul 18 14:54:31 2025 +0100 ASoC: SDCA: Fix some holes in the regmap readable/writeable helpers The current regmap readable/writeable helper functions always allow the Next flag and allows any Control Number. Mask the Next flag based on SDCA_ACCESS_MODE_DUAL which is the only Mode that supports it. Also check that the Control Number is valid for the given control. Fixes: e3f7caf74b79 ("ASoC: SDCA: Add generic regmap SDCA helpers") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20250718135432.1048566-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit df0ce6cefa453d2236381645e529a27ef2f0a573 Author: Chao Yu Date: Mon Jul 21 10:13:52 2025 +0800 erofs: support to readahead dirent blocks in erofs_readdir() This patch supports to readahead more blocks in erofs_readdir(), it can enhance readdir performance in large direcotry. readdir test in a large directory which contains 12000 sub-files. files_per_second Before: 926385.54 After: 2380435.562 Meanwhile, let's introduces a new sysfs entry to control readahead bytes to provide more flexible policy for readahead of readdir(). - location: /sys/fs/erofs//dir_ra_bytes - default value: 16384 - disable readahead: set the value to 0 Signed-off-by: Chao Yu Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/20250721021352.2495371-1-chao@kernel.org [ Gao Xiang: minor styling adjustment. ] Signed-off-by: Gao Xiang commit 414091322c6363c9283aeb177101e4d7a3819ccd Author: Bo Liu (OpenAnolis) Date: Tue Jul 22 08:32:29 2025 +0800 erofs: implement metadata compression Thanks to the meta buffer infrastructure, metadata-compressed inodes are just read from the metabox inode instead of the blockdevice (or backing file) inode. The same is true for shared extended attributes. When metadata compression is enabled, inode numbers are divided from on-disk NIDs because of non-LTS 32-bit application compatibility. Co-developed-by: Gao Xiang Signed-off-by: Bo Liu (OpenAnolis) Acked-by: Chao Yu Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250722003229.2121752-1-hsiangkao@linux.alibaba.com commit 681acbda3a6d2c687ab01baed22598da389d1f79 Author: Gao Xiang Date: Thu Jul 17 15:08:03 2025 +0800 erofs: add on-disk definition for metadata compression Filesystem metadata has a high degree of redundancy, so it should compress well in the general case. Although metadata compression can increase overall I/O latency, many users care more about minimized image sizes than extreme runtime performance. Let's implement metadata compression in response to user requests [1]. Actually, it's quite simple to implement metadata compression: since EROFS already supports per-inode compression, we can simply treat a special inode (called `the metabox inode`) as a container for compressed inode metadata. Since EROFS supports multiple algorithms, users can even specify LZ4 for metadata and LZMA for data. To better support incremental builds, the MSB of NIDs indicates where the inode metadata is located: if bit 63 is set, the inode itself should be read from `the metabox inode`. Optionally, shared xattrs can also be kept in `the metabox inode` if COMPAT_SHARED_EA_IN_METABOX is set. [1] https://issues.redhat.com/browse/RHEL-75783 Signed-off-by: Gao Xiang Acked-by: Chao Yu Link: https://lore.kernel.org/r/20250717070804.1446345-2-hsiangkao@linux.alibaba.com commit 5e0bf36fd156b8d9b09f8481ee6daa6cdba1b064 Author: Bo Liu (OpenAnolis) Date: Thu Jul 17 23:30:39 2025 -0400 erofs: fix build error with CONFIG_EROFS_FS_ZIP_ACCEL=y fix build err: ld.lld: error: undefined symbol: crypto_req_done referenced by decompressor_crypto.c fs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.a referenced by decompressor_crypto.c fs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.a ld.lld: error: undefined symbol: crypto_acomp_decompress referenced by decompressor_crypto.c fs/erofs/decompressor_crypto.o:(z_erofs_crypto_decompress) in archive vmlinux.a ld.lld: error: undefined symbol: crypto_alloc_acomp referenced by decompressor_crypto.c fs/erofs/decompressor_crypto.o:(z_erofs_crypto_enable_engine) in archive vmlinux.a Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507161032.QholMPtn-lkp@intel.com/ Fixes: b4a29efc5146 ("erofs: support DEFLATE decompression by using Intel QAT") Signed-off-by: Bo Liu (OpenAnolis) Link: https://lore.kernel.org/r/20250718033039.3609-1-liubo03@inspur.com Reviewed-by: Gao Xiang Signed-off-by: Gao Xiang commit 7ca972a2dca29926928baa5a57de00748ce4ca0c Author: Gao Xiang Date: Thu Jul 17 12:23:17 2025 +0800 erofs: remove ENOATTR definition ENOATTR is not defined in Linux; use ENODATA instead. Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250717042317.1218597-1-hsiangkao@linux.alibaba.com commit f768685427c073d46887d78423882e2771276705 Author: Gao Xiang Date: Wed Jul 16 17:22:54 2025 +0800 erofs: refine erofs_iomap_begin() - Avoid calling erofs_map_dev() for unmapped extents; - Assign `iomap->addr` for inline extents too (since they have physical location). Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250716092254.3826715-1-hsiangkao@linux.alibaba.com commit df50848bcd9f17e4e60e6d5823d0e8fe8982bbab Author: Gao Xiang Date: Wed Jul 16 14:41:52 2025 +0800 erofs: unify meta buffers in z_erofs_fill_inode() There is no need to keep additional local metabufs since we already have one in `struct erofs_map_blocks`. This was actually a leftover when applying meta buffers to zmap operations, see commit 09c543798c3c ("erofs: use meta buffers for zmap operations"). Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250716064152.3537457-1-hsiangkao@linux.alibaba.com commit 5e744cb61536bb4e37caca9c5e84feef638782be Author: Gao Xiang Date: Mon Jul 14 17:09:06 2025 +0800 erofs: remove need_kmap in erofs_read_metabuf() - need_kmap is always true except for a ztailpacking case; thus, just open-code that one; - The upcoming metadata compression will add a new boolean, so simplify this first. Signed-off-by: Gao Xiang Reviewed-by: Chao Yu Link: https://lore.kernel.org/r/20250714090907.4095645-1-hsiangkao@linux.alibaba.com commit 1a5223c182fdb3bb3c0ca85cec101c740f685ab6 Author: Chao Yu Date: Tue Jul 8 19:09:28 2025 +0800 erofs: do sanity check on m->type in z_erofs_load_compact_lcluster() All below functions will do sanity check on m->type, let's move sanity check to z_erofs_load_compact_lcluster() for cleanup. - z_erofs_map_blocks_fo - z_erofs_get_extent_compressedlen - z_erofs_get_extent_decompressedlen - z_erofs_extent_lookback Reviewed-by: Hongbo Li Signed-off-by: Chao Yu Reviewed-by: Gao Xiang Link: https://lore.kernel.org/r/20250708110928.3110375-1-chao@kernel.org Signed-off-by: Gao Xiang commit 96debe8c27ee2494bbd78abf3744745a84a745f1 Author: Gao Xiang Date: Thu Jun 26 16:54:59 2025 +0800 erofs: get rid of {get,put}_page() for ztailpacking data The compressed data for the ztailpacking feature is fetched from the metadata inode (e.g., bd_inode), which is folio-based. Therefore, the folio interface should be used instead. Signed-off-by: Gao Xiang Link: https://lore.kernel.org/r/20250626085459.339830-1-hsiangkao@linux.alibaba.com commit 71d141edbfa3e0a213c537e979790835550270d6 Author: Colin Ian King Date: Thu Jul 24 12:31:12 2025 +0100 regulator: Kconfig: Fix spelling mistake "regualtor" -> "regulator" There is a spelling mistake in the REGULATOR_RT4803 config. Fix it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250724113113.143009-1-colin.i.king@gmail.com Signed-off-by: Mark Brown commit 8c7a86088a3eb6f874cc5c46a447787d3a193ff5 Merge: cc2f156a33278d 819687eb28e501 Author: Bartosz Golaszewski Date: Thu Jul 24 13:27:21 2025 +0200 Merge tag 'ib-mfd-gpio-power-soc-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into gpio/for-next Immutable branch between MFD, GPIO, Power and SoC due for the v6.17 merge window commit ea83bf05873fa6301267324803ad592365e6c0cb Merge: acd4692a84246c ad1244e1ce18f8 Author: Greg Kroah-Hartman Date: Thu Jul 24 12:40:02 2025 +0200 Merge tag 'usb-serial-6.17-rc1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB serial device id for 6.17-rc1 Here's a new modem device id. This has been in linux-next with no reported issues. * tag 'usb-serial-6.17-rc1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: option: add Foxconn T99W709 commit acd4692a84246cb37a52051b830fdd2170717a55 Merge: 8d1b02e5d7e3a6 bdf2ab177e2fca Author: Greg Kroah-Hartman Date: Thu Jul 24 12:39:34 2025 +0200 Merge tag 'usb-serial-6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial into usb-next Johan writes: USB serial updates for 6.17-rc1 Here are the USB serial updates for 6.17-rc1, including - switch to new gpiolib interface that can return errors All have been in linux-next with no reported issues. * tag 'usb-serial-6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/johan/usb-serial: USB: serial: cp210x: use new GPIO line value setter callbacks USB: serial: ftdi_sio: use new GPIO line value setter callbacks commit 92ab1e41569416c639643cd75eea2379190a65f2 Author: Dmitry Torokhov Date: Mon Jun 30 16:01:06 2025 -0700 mfd: mt6397: Do not use generic name for keypad sub-devices Do not use "mtk-pmic-keys" when creating sub-device for the keypad to make sure the keypad driver will only bind to the sub-device if it has support for the variant/has matching compatible. Cc: stable@vger.kernel.org Fixes: 6e31bb8d3a63 ("mfd: mt6397: Add initial support for MT6328") Fixes: de58cee8c6b8 ("mfd: mt6397-core: Add MT6357 PMIC support") Fixes: 4a901e305011 ("mfd: mt6397-core: Add resources for PMIC keys for MT6359") Reported-by: Louis-Alexis Eyraud Signed-off-by: Dmitry Torokhov Tested-by: Louis-Alexis Eyraud # on Link: https://lore.kernel.org/r/r4k3pgd3ew3ypne7ernxuzwgniiyvzosbce4cfajbcu7equblt@yato35tjb3lw Signed-off-by: Lee Jones commit 1421c3aff49914d83b83be2f9e17007ba4397dc9 Author: Chen-Yu Tsai Date: Wed Jul 2 00:36:52 2025 +0800 mfd: axp20x: Set explicit ID for regulator cell if no IRQ line is present Originally an explicit ID for the AXP313/AXP323 regulator was set to avoid a conflict with the primary AXP717 PMIC on Allwinner A523 family boards. This didn't entirely work since on some or all of these boards, the interrupt line on this secondary PMIC was left unconnected, and thus the driver would fall back to the generic "no interrupt; only regulators" case, which didn't have the explicit ID set, thus undoing the intended fix. Also set an explicit ID for the regulator cell in the no IRQ generic fall back case. This fixes the conflict for the AXP717 + AXP313/AXP323 case. For the actual single PMIC with no IRQ connected case, the ID does not affect functionality, only the device naming of the regulator cell, and by extension the name and path under sysfs. Fixes: 249abf9b1e25 ("mfd: axp20x: Set explicit ID for AXP313 regulator") Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250701163652.252010-1-wens@kernel.org Signed-off-by: Lee Jones commit 147dea662eaaf2da54bc2ec4d65053325036d734 Author: ChiYuan Huang Date: Wed Jul 9 10:00:48 2025 +0800 mfd: mt6370: Fix the interrupt naming typo Modify the lowercase character to uppercase. Signed-off-by: ChiYuan Huang Link: https://lore.kernel.org/r/a6ab943f4660e39b8112ff58fa97af0507cd89e9.1752026324.git.cy_huang@richtek.com Signed-off-by: Lee Jones commit db8db85cff331eb5a520a18a606692ff85405c3d Author: Quentin Schulz Date: Fri Jun 27 12:53:54 2025 +0200 mfd: rk8xx-core: Allow to customize RK806 reset mode The RK806 PMIC has a bitfield for configuring the restart/reset behavior (which I assume Rockchip calls "function") whenever the PMIC is reset either programmatically (c.f. DEV_RST in the datasheet) or via PWRCTRL or RESETB pins. For RK806, the following values are possible for RST_FUN: 0b00 means "Restart PMU" 0b01 means "Reset all the power off reset registers, forcing the state to switch to ACTIVE mode" 0b10 means "Reset all the power off reset registers, forcing the state to switch to ACTIVE mode, and simultaneously pull down the RESETB PIN for 5mS before releasing" 0b11 means the same as for 0b10 just above. This adds the appropriate logic in the driver to parse the new rockchip,reset-mode DT property to pass this information. It just happens that the values in the binding match the values to write in the bitfield so no mapping is necessary. If it is missing, the register is left untouched and relies either on the silicon default or on whatever was set earlier in the boot stages (e.g. the bootloader). Signed-off-by: Quentin Schulz Link: https://lore.kernel.org/r/20250627-rk8xx-rst-fun-v4-2-ce05d041b45f@cherry.de Signed-off-by: Lee Jones commit 404005d1083997daec7236620b9ba14bccdce449 Author: Quentin Schulz Date: Fri Jun 27 12:53:53 2025 +0200 dt-bindings: mfd: rk806: Allow to customize PMIC reset mode The RK806 PMIC allows to configure its reset/restart behavior whenever the PMIC is reset either programmatically or via some external pins (e.g. PWRCTRL or RESETB). The following modes exist: - 0; restart PMU, - 1; reset all power off reset registers and force state to switch to ACTIVE mode, - 2; same as mode 1 and also pull RESETB pin down for 5ms, For example, some hardware may require a full restart (mode 0) in order to function properly as regulators are shortly interrupted in this mode. This is the case for RK3588 Jaguar and RK3588 Tiger which have a companion microcontroller running on an independent power supply and monitoring the PMIC power rail to know the state of the main system. When it detects a restart, it resets its own IPs exposed to the main system as if to simulate its own reset. Failing to perform this fake reset of the microcontroller may break things (e.g. watchdog not automatically disabled, buzzer still running until manually disabled, leftover configuration from previous main system state, etc...). Some other systems may be depending on the power rails to not be interrupted even for a small amount of time[1]. This allows to specify how the PMIC should perform on the hardware level and may differ between hardware designs, so a DT property seems warranted. I unfortunately do not see how this could be made generic enough to make it a non-vendor property. [1] https://lore.kernel.org/linux-rockchip/2577051.irdbgypaU6@workhorse/ Reviewed-by: Krzysztof Kozlowski Signed-off-by: Quentin Schulz Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250627-rk8xx-rst-fun-v4-1-ce05d041b45f@cherry.de Signed-off-by: Lee Jones commit b9ec71fbd572042770df16c9b65bbf91cbd556cf Author: Andy Shevchenko Date: Fri Jun 27 19:43:58 2025 +0300 mfd: syscon: atmel-smc: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250627164414.1043434-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit dd394515d18aedd379e8dc886cb8286e1714f735 Author: Andy Shevchenko Date: Thu Jun 26 18:45:44 2025 +0300 mfd: madera: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Signed-off-by: Andy Shevchenko Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20250626154544.324724-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit dd1902b6e90508b4243af930db933ea3d26d2981 Author: Andy Shevchenko Date: Thu Jun 26 18:59:51 2025 +0300 mfd: wm8350-core: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Signed-off-by: Andy Shevchenko Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20250626155951.325683-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit 96ecc71fd2fb65edb9048733aecca6b79d76fa14 Author: André Draszik Date: Fri Jun 27 10:15:25 2025 +0100 dt-bindings: mfd: samsung,s2mps11: Add comment about interrupts properties Document why the binding uses oneOf when specifying just one of the interrupt properties is supposed to be enough. dtschema's fixups.py has special treatment of the interrupts and interrupts-extended properties, but that appears to work at the top level only. Elsewhere, an explicit oneOf is required. Signed-off-by: André Draszik Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250627-s2mpg10-binding-comment-v1-1-f37e5187f0fd@linaro.org Signed-off-by: Lee Jones commit c371040f31ab63de992c7d811ffc4c7d450b46a5 Author: Andy Shevchenko Date: Thu Jun 26 18:43:54 2025 +0300 mfd: davinci_voicecodec: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250626154354.324439-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit e403cdf0704b7b1fedaf4ed5f05cc814dffbd6d5 Author: Dr. David Alan Gilbert Date: Tue Jul 1 15:56:25 2025 +0100 mfd: pcf50633: Remove the header file core.h The patches to remove all of the pieces of the pcf50633 have gone in and we're left with the header. Remove it. The pcf50633 was used as part of the OpenMoko devices but the support for its main chip was recently removed in: commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support") See https://lore.kernel.org/all/Z8z236h4B5A6Ki3D@gallifrey/ Signed-off-by: "Dr. David Alan Gilbert" Link: https://lore.kernel.org/r/20250701145625.204048-1-linux@treblig.org Signed-off-by: Lee Jones commit 83f9afe4689d96279d9ade6c1cce36fa86e8ac63 Author: Christophe JAILLET Date: Sat Jun 21 20:30:52 2025 +0200 mfd: tps65219: Remove another unused field from 'struct tps65219' The 'chip_id' field from 'struct tps65219' is unused. Remove it. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/f20443e6e13b0b101648a41010a19ee56589fa0b.1750530460.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit ea39dd2638ff6920c342313db98dbc152e815ecd Author: Christophe JAILLET Date: Sat Jun 21 20:30:51 2025 +0200 mfd: tps65219: Remove an unused field from 'struct tps65219' Since commit 3df4c6367520 ("mfd: tps65219: Add support for soft shutdown via sys-off API"), the 'nb' field from 'struct tps65219' is unused. Remove it. Also remove the now useless #include for the same reason. Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/8a264c3a92b8e62c1dadd374f2685030e042eb08.1750530460.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit 238b671ddd3a91d8c3025201a69c661872e8a7b5 Author: Christophe JAILLET Date: Sat Jun 21 20:28:20 2025 +0200 mfd: tps65219: Constify struct regmap_irq_sub_irq_map and tps65219_chip_data 'struct regmap_irq_sub_irq_map' and 'struct tps65219_chip_data' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 27804 10016 256 38076 94bc drivers/mfd/tps65219.o After: ===== text data bss dec hex filename 27893 9792 256 37941 9435 drivers/mfd/tps65219.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/117946696551de41b706ea9b973a7ccaacea5178.1750530460.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit 86b0fc4b2b45a78cbdc11873bc596d140eff390c Author: Christophe JAILLET Date: Sat Jun 21 12:28:38 2025 +0200 mfd: rohm-bd71828: Constify some structures Several structures are not modified in this driver. Constifying them moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. This is the case for 'gpio_keys_platform_data' and 'mfd_cell'. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 18321 13952 192 32465 7ed1 drivers/mfd/rohm-bd71828.o After: ===== text data bss dec hex filename 22897 9376 192 32465 7ed1 drivers/mfd/rohm-bd71828.o Signed-off-by: Christophe JAILLET Reviewed-by: Matti Vaittinen Link: https://lore.kernel.org/r/037e28e587ae899da9acdb45c606d75ec61f858b.1750501700.git.christophe.jaillet@wanadoo.fr Signed-off-by: Lee Jones commit 6865c645413399eaf54287aa2037974afdea2a47 Author: Liu Ying Date: Fri Jun 20 10:25:37 2025 +0800 dt-bindings: mfd: fsl,imx8qxp-csr: Remove binding documentation commit b0a5cde57cf1 ("dt-bindings: mfd: Explain lack of child dependency in simple-mfd") pointed out that it's a mistake for a child device of a simple MFD device to depend on the simple MFD device's clock resources. fsl,imx8qxp-csr.yaml happens to make that mistake. To fix that, remove fsl,imx8qxp-csr.yaml and use "simple-pm-bus" and "syscon" as the CSR node's compatible strings in the examples of fsl,imx8qxp-pixel-link-msi-bus.yaml to replace the wrong compatible strings which include "simple-mfd" and "fsl,imx8qxp-mipi-lvds-csr". Since fsl,imx8qxp-pixel-link-msi-bus.yaml as the last user of the CSR compatible strings no longer uses them, it's safe to remove the fsl,imx8qxp-csr.yaml binding documentation. Fixes: 9b2c55b5403f ("dt-bindings: mfd: Add i.MX8qm/qxp Control and Status Registers module binding") Fixes: c08645ea215c ("dt-bindings: bus: Add Freescale i.MX8qxp pixel link MSI bus binding") Signed-off-by: Liu Ying Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250620022537.3072877-1-victor.liu@nxp.com Signed-off-by: Lee Jones commit 88828c7e940dd45d139ad4a39d702b23840a37c5 Author: Chen-Yu Tsai Date: Fri Jun 20 01:32:07 2025 +0800 mfd: axp20x: Set explicit ID for AXP313 regulator On newer boards featuring the A523 SoC, the AXP323 (related to the AXP313) is paired with the AXP717 and serves as a secondary PMIC providing additional regulator outputs. However the MFD cells are all registered with PLATFORM_DEVID_NONE, which causes the regulator cells to conflict with each other. Commit e37ec3218870 ("mfd: axp20x: Allow multiple regulators") attempted to fix this by switching to PLATFORM_DEVID_AUTO so that the device names would all be different, however that broke IIO channel mapping, which is also tied to the device names. As a result the change was later reverted. Instead, here we attempt to make sure the AXP313/AXP323 regulator cell does not conflict by explicitly giving it an ID number. This was previously done for the AXP809+AXP806 pair used with the A80 SoC. Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250619173207.3367126-1-wens@kernel.org Signed-off-by: Lee Jones commit ec9cdb91c6ec108d1b0788e80f5e6198296a10a3 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:41 2025 +0200 mfd: Use dev_fwnode() instead of of_fwnode_handle() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20250611104348.192092-13-jirislaby@kernel.org Signed-off-by: Lee Jones commit fc07e412ea38078662723e8e511089d235bdc25d Author: Antonio Borneo Date: Tue Jun 10 14:48:55 2025 +0200 mfd: stm32-timers: Fix build warnings about export.h After commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") and commit 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") we get the build warning with W=1: drivers/mfd/stm32-timers.c: warning: EXPORT_SYMBOL() is used, but #include is missing Fix it. Signed-off-by: Antonio Borneo Acked-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20250610124855.269158-6-antonio.borneo@foss.st.com Signed-off-by: Lee Jones commit fe473fba6435f631a4c7459c02057bf57457e128 Author: Dr. David Alan Gilbert Date: Sat Jun 7 21:22:32 2025 +0100 mfd: twl6030-irq: Remove unused twl6030_mmc_card_detect* twl6030_mmc_card_detect() and twl6030_mmc_card_detect_config() have been unused since 2013's commit b2ff4790612b ("ARM: OMAP2+: Remove legacy omap4_twl6030_hsmmc_init") Remove them. Signed-off-by: "Dr. David Alan Gilbert" Link: https://lore.kernel.org/r/20250607202232.265344-1-linux@treblig.org Signed-off-by: Lee Jones commit 5d005cf799675566d271d90062b70d26e13a59f0 Author: Frank Li Date: Mon Jun 2 10:36:10 2025 -0400 dt-bindings: mfd: Convert lpc1850-creg-clk, pc1850-dmamux and phy-lpc18xx-usb-otg to YAML format Combine the following separate plain text based bindings to YAML: lpc1850-creg-clk.txt pc1850-dmamux.txt phy-lpc18xx-usb-otg.txt Additional changes: - remove label in example. - remove dmamux consumer in example. - remove clock consumer in example. Signed-off-by: Frank Li Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250602143612.943516-1-Frank.Li@nxp.com Signed-off-by: Lee Jones commit 009528b5aa13af4fe36d1ca71e2cef2bc92c6a3e Author: Dario Binacchi Date: Fri May 30 18:07:32 2025 +0200 dt-bindings: mfd: convert mxs-lradc bindings to json-schema Convert the Freescale MXS Low-Resoulution ADC (LRADC) device tree binding documentation to json-schema. The clocks and #io-channel-cells properties have also been added; They are present in the respective SoC DTSI files but were missing from the old mxs-lradc.txt file. Signed-off-by: Dario Binacchi Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250530160748.2476088-2-dario.binacchi@amarulasolutions.com Signed-off-by: Lee Jones commit 2d23e749be527aadb645def0e55df9659d533e0c Author: Krzysztof Kozlowski Date: Wed May 28 21:44:17 2025 +0200 mfd: Constify reg_sequence and regmap_irq Static 'struct reg_sequence' array, 'struct regmap_irq_sub_irq_map' and 'struct regmap_irq_chip ' are not modified so can be changed to const for more safety. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Matti Vaittinen Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20250528194416.567127-2-krzysztof.kozlowski@linaro.org Signed-off-by: Lee Jones commit e40fc1160d491c3bcaf8e940ae0dde0a7c5e8e14 Author: Thomas Weißschuh Date: Wed May 21 16:42:51 2025 +0200 mfd: cros_ec: Separate charge-control probing from USB-PD The charge-control subsystem in the ChromeOS EC is not strictly tied to its USB-PD subsystem. Since commit 7613bc0d116a ("mfd: cros_ec: Don't load charger with UCSI") the presence of EC_FEATURE_UCSI_PPM would inhibit the probing of the charge-control driver. Furthermore recent versions of the EC firmware in Framework laptops hard-disable EC_FEATURE_USB_PD to avoid probing cros-usbpd-charger, which then also breaks cros-charge-control. Instead use the dedicated EC_FEATURE_CHARGER. Cc: stable@vger.kernel.org Link: https://github.com/FrameworkComputer/EmbeddedController/commit/1d7bcf1d50137c8c01969eb65880bc83e424597e Fixes: 555b5fcdb844 ("mfd: cros_ec: Register charge control subdevice") Signed-off-by: Thomas Weißschuh Reviewed-by: Tzung-Bi Shih Tested-by: Tom Vincent Link: https://lore.kernel.org/r/20250521-cros-ec-mfd-chctl-probe-v1-1-6ebfe3a6efa7@weissschuh.net Signed-off-by: Lee Jones commit 6f27d26e363a41fc651be852094823ce47a43243 Author: Shree Ramamoorthy Date: Tue May 27 14:04:54 2025 -0500 mfd: tps65219: Update TPS65214 MFD cell's GPIO compatible string This patch reflects the change made to move TPS65215 from 1 GPO and 1 GPIO to 2 GPOs and 1 GPIO. TPS65215 and TPS65219 both have 2 GPOs and 1 GPIO. TPS65214 has 1 GPO and 1 GPIO. TPS65215 will reuse the TPS65219 GPIO compatible string. TPS65214 TRM: https://www.ti.com/lit/pdf/slvud30 TPS65215 TRM: https://www.ti.com/lit/pdf/slvucw5/ Fixes: 7947219ab1a2 ("mfd: tps65219: Add support for TI TPS65214 PMIC") Signed-off-by: Shree Ramamoorthy Link: https://lore.kernel.org/r/20250527190455.169772-2-s-ramamoorthy@ti.com Signed-off-by: Lee Jones commit f3e332d963ec805975f5e90a89f4c51825ce8b90 Merge: 45ee66c37f9bd8 819687eb28e501 d90171bc2e5f69 Author: Lee Jones Date: Thu Jul 24 11:26:13 2025 +0100 Merge branches 'ib-mfd-gpio-input-pwm-6.17', 'ib-mfd-gpio-power-soc-6.17' and 'ib-mfd-misc-pinctrl-6.17' into ibs-for-mfd-merged commit b9e6e8ae0a5f9edae7cc1b5972a1d3dea9223fe2 Merge: aaac6e2f9b647d b9bb7e814cd0c3 Author: Will Deacon Date: Thu Jul 24 11:18:28 2025 +0100 Merge branch 'arm/smmu/updates' into next * arm/smmu/updates: iommu/arm-smmu: disable PRR on SM8250 iommu/arm-smmu-v3: Revert vmaster in the error path iommu/io-pgtable-arm: Remove unused macro iopte_prot commit aaac6e2f9b647d1edf76e66d808af6c834fae877 Merge: c4e4c1fecc30ca ac1207f516c2ff Author: Will Deacon Date: Thu Jul 24 11:18:23 2025 +0100 Merge branch 'arm/smmu/bindings' into next * arm/smmu/bindings: dt-bindings: arm-smmu: Remove sdm845-cheza specific entry dt-bindings: arm-smmu: document the support on Milos iommu/arm-smmu-qcom: Add SM6115 MDSS compatible commit c4e4c1fecc30cafddc3fc29c4faa2bf869df8a17 Merge: df61544f83cc85 46a7418a3aa62f Author: Will Deacon Date: Thu Jul 24 11:18:16 2025 +0100 Merge branch 'apple/dart' into next * apple/dart: iommu/apple-dart: Drop default ARCH_APPLE in Kconfig commit df61544f83cc8537c33c01b14d1dcdbd692b3897 Merge: 542c6b5e9da2c0 26d1c1f9e3111c Author: Will Deacon Date: Thu Jul 24 11:18:11 2025 +0100 Merge branch 'ti/omap' into next * ti/omap: iommu/omap: Use syscon_regmap_lookup_by_phandle_args iommu/omap: Drop redundant check if ti,syscon-mmuconfig exists commit 542c6b5e9da2c0d3cf1e242951a35e1a0fb98c28 Merge: 6ae1477fd350fa a695cad6954b1f Author: Will Deacon Date: Thu Jul 24 11:18:05 2025 +0100 Merge branch 'mediatek' into next * mediatek: iommu/mediatek-v1: Tidy up probe_finalize commit 6ae1477fd350fae7378c63d0c4dbcf4487df5769 Merge: 9f341a2aeb1f53 8637afa79cfa61 Author: Will Deacon Date: Thu Jul 24 11:17:59 2025 +0100 Merge branch 'amd/amd-vi' into next * amd/amd-vi: iommu/amd: Fix geometry.aperture_end for V2 tables iommu/amd: Wrap debugfs ABI testing symbols snippets in literal code blocks iommu/amd: Add documentation for AMD IOMMU debugfs support iommu/amd: Add debugfs support to dump IRT Table iommu/amd: Add debugfs support to dump device table iommu/amd: Add support for device id user input iommu/amd: Add debugfs support to dump IOMMU command buffer iommu/amd: Add debugfs support to dump IOMMU Capability registers iommu/amd: Add debugfs support to dump IOMMU MMIO registers iommu/amd: Refactor AMD IOMMU debugfs initial setup iommu/amd: Enable PASID and ATS capabilities in the correct order iommu/amd: Add efr[HATS] max v1 page table level iommu/amd: Add HATDis feature support commit 9f341a2aeb1f53297fb1aec74fc069de43be3d00 Merge: ab1de3f9c69d40 f0b9d31c6edd50 Author: Will Deacon Date: Thu Jul 24 11:17:52 2025 +0100 Merge branch 'intel/vt-d' into next * intel/vt-d: iommu/vt-d: Fix UAF on sva unbind with pending IOPFs iommu/vt-d: Make iotlb_sync_map a static property of dmar_domain iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all iommu/vt-d: Split paging_domain_compatible() iommu/vt-d: Split intel_iommu_enforce_cache_coherency() iommu/vt-d: Create unique domain ops for each stage iommu/vt-d: Split intel_iommu_domain_alloc_paging_flags() iommu/vt-d: Do not wipe out the page table NID when devices detach iommu/vt-d: Fold domain_exit() into intel_iommu_domain_free() iommu/vt-d: Lift the __pa to domain_setup_first_level/intel_svm_set_dev_pasid() iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes iommu/vt-d: Remove the CONFIG_X86 wrapping from iommu init hook commit ab1de3f9c69d404dc499349bfc7293d19618eace Merge: 6ed3d08a2220b1 2d70fdd9b5c9a1 Author: Will Deacon Date: Thu Jul 24 11:17:34 2025 +0100 Merge branch 'samsung/exynos' into next * samsung/exynos: iommu/exynos: add support for reserved regions commit 6ed3d08a2220b12a13018ca7ef9e255f264327e8 Merge: 86731a2a651e58 ced24bf4352c22 Author: Will Deacon Date: Thu Jul 24 11:17:02 2025 +0100 Merge branch 'core' into next * core: iommu/qcom: Fix pgsize_bitmap iommu/intel: Convert to msi_create_parent_irq_domain() helper iommu/amd: Convert to msi_create_parent_irq_domain() helper iommu: Remove ops->pgsize_bitmap iommu/msm: Remove ops->pgsize_bitmap iommu/qcom: Remove iommu_ops pgsize_bitmap iommu/mtk: Remove iommu_ops pgsize_bitmap iommu: Remove iommu_ops pgsize_bitmap from simple drivers iommu: Remove ops.pgsize_bitmap from drivers that don't use it iommu/arm-smmu: Remove iommu_ops pgsize_bitmap qiommu/arm-smmu-v3: Remove iommu_ops pgsize_bitmap commit cc2f156a33278d9b23b5cf8f738c55c842d0f225 Author: Jonas Karlman Date: Wed Jul 23 08:56:43 2025 +0000 dt-bindings: gpio: rockchip: Allow use of a power-domain The GPIO controllers in most Rockchip SoCs are part of power domains that are always powered on, i.e. PD_BUS or PD_PMU. These always powered on power domains have typically not been described in the device tree. Because these power domains have been left out of the device tree there has not been any real need to properly describe the GPIO controllers power domain. On RK3528 the GPIO controllers are spread out among the described PD_RKVENC, PD_VO and PD_VPU power domains. However, one GPIO controller belong to an undescribed always powered on power domain. Add support to describe an optional power-domains for the GPIO controllers in Rockchip SoCs. Signed-off-by: Jonas Karlman Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250723085654.2273324-2-jonas@kwiboo.se Signed-off-by: Bartosz Golaszewski commit c32f66d17455970091bd97d7a9cac6f38dfcc423 Author: Andrei Lalaev Date: Mon Jul 21 17:57:37 2025 +0200 gpiolib: of: add forward declaration for struct device_node Commit 08a149c40bdb ("gpiolib: Clean up headers") added a forward declaration for struct device. Later, commit 07445ae1c263 ("gpiolib: of: change of_find_gpio() to accept device node") changed the function signature to accept a struct device_node instead of a struct device. Replace forward declaration of struct device with struct device_node to match the updated function signature. Signed-off-by: Andrei Lalaev Link: https://lore.kernel.org/r/20250721155737.261990-1-andrey.lalaev@gmail.com Signed-off-by: Bartosz Golaszewski commit fa3f79e82dce7b04f7b8cf1791268a775b3d6f9f Author: Tiffany Yang Date: Tue Jul 22 16:45:07 2025 -0700 binder: Use seq_buf in binder_alloc kunit tests Replace instances of snprintf with seq_buf functions, as suggested by Kees [1]. [1] https://lore.kernel.org/all/202507160743.15E8044@keescook/ Fixes: d1934ed9803c ("binder: encapsulate individual alloc test cases") Suggested-by: Kees Cook Cc: Joel Fernandes Signed-off-by: Tiffany Yang Reviewed-by: Kees Cook Link: https://lore.kernel.org/r/20250722234508.232228-2-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman commit 8a8d47e86cf537e6f6deb5c736bbf948a7bbc885 Author: Tiffany Yang Date: Tue Jul 22 16:45:06 2025 -0700 binder: Add copyright notice to new kunit files Clean up for the binder_alloc kunit test series. Add a copyright notice to new files, as suggested by Carlos [1]. [1] https://lore.kernel.org/all/CAFuZdDLD=3CBOLSWw3VxCf7Nkf884SSNmt1wresQgxgBwED=eQ@mail.gmail.com/ Fixes: 5e024582f494 ("binder: Scaffolding for binder_alloc KUnit tests") Suggested-by: Carlos Llamas Cc: Joel Fernandes Signed-off-by: Tiffany Yang Link: https://lore.kernel.org/r/20250722234508.232228-1-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman commit b13b41cc3dc1811189b9cbeb04d11d8bef474679 Author: Jiri Slaby (SUSE) Date: Wed Jul 23 07:35:16 2025 +0200 misc: ti_fpc202: Switch to of_fwnode_handle() of_node_to_fwnode() is an irqdomain's reimplementation of the "officially" defined of_fwnode_handle(). The former is in the process of being removed, so use the latter instead. This is the last in-tree user. Signed-off-by: "Jiri Slaby (SUSE)" Fixes: 1e5c9b1efa1c ("misc: add FPC202 dual port controller driver") Reviewed-by: Romain Gantois Cc: Arnd Bergmann Cc: Greg Kroah-Hartman Cc: Wolfram Sang Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/20250723053516.1796097-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 335fb3d29893a49fc3e68e8dee450314d65a60f6 Author: Jiri Slaby (SUSE) Date: Wed Jul 23 07:53:25 2025 +0200 bus: moxtet: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Marek Behún Link: https://lore.kernel.org/r/20250723055325.1800024-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 61a789ad4326d931488f0b82316bc9ec8034556e Author: Randy Dunlap Date: Tue Jul 22 16:54:31 2025 -0700 pc104: move PC104 option to drivers/Kconfig Put the PC104 kconfig option in drivers/Kconfig along with other buses (AMBA, EISA, PCI, CXL, PCCard, & RapidIO). This localizes PC104 with option bus kconfig options to make it easier to find. Signed-off-by: Randy Dunlap Acked-by: William Breathitt Gray Cc: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250722235431.3671754-1-rdunlap@infradead.org Signed-off-by: Greg Kroah-Hartman commit 93b17c6afa83fda8eea4490aad9a3721eb6627bb Author: Thomas Weißschuh Date: Fri Jul 18 15:43:49 2025 +0200 drivers: virt: acrn: Don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250718-restricted-pointers-virt-v1-1-12913fceaf52@linutronix.de Signed-off-by: Greg Kroah-Hartman commit 57b4ca42359c63ad61548431c184a7d63efbd0b9 Author: Jonas Karlman Date: Wed Jul 23 08:56:46 2025 +0000 dt-bindings: serial: snps-dw-apb-uart: Allow use of a power-domain The UART controllers in most Rockchip SoCs are part of power domains that are always powered on. These always powered on power domains have typically not been described in the device tree. Because these power domains have been left out of the device tree there has not been any real need to properly describe the UART controllers power domain of Rockchip SoCs. On Rockchip RK3528 the UART controllers are spread out among the described PD_RKVENC, PD_VO and PD_VPU power domains. However, one UART controller belong to an undescribed always powered on power domain. Add support to describe an optional power-domains for the UART controllers. Signed-off-by: Jonas Karlman Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250723085654.2273324-5-jonas@kwiboo.se Signed-off-by: Greg Kroah-Hartman commit 7f8fdd4dbffc05982b96caf586f77a014b2a9353 Author: Yunhui Cui Date: Wed Jul 23 10:33:22 2025 +0800 serial: 8250: fix panic due to PSLVERR When the PSLVERR_RESP_EN parameter is set to 1, the device generates an error response if an attempt is made to read an empty RBR (Receive Buffer Register) while the FIFO is enabled. In serial8250_do_startup(), calling serial_port_out(port, UART_LCR, UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter function enables the FIFO via serial_out(p, UART_FCR, p->fcr). Execution proceeds to the serial_port_in(port, UART_RX). This satisfies the PSLVERR trigger condition. When another CPU (e.g., using printk()) is accessing the UART (UART is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) == (lcr & ~UART_LCR_SPAR) in dw8250_check_lcr(), causing it to enter dw8250_force_idle(). Put serial_port_out(port, UART_LCR, UART_LCR_WLEN8) under the port->lock to fix this issue. Panic backtrace: [ 0.442336] Oops - unknown exception [#1] [ 0.442343] epc : dw8250_serial_in32+0x1e/0x4a [ 0.442351] ra : serial8250_do_startup+0x2c8/0x88e ... [ 0.442416] console_on_rootfs+0x26/0x70 Fixes: c49436b657d0 ("serial: 8250_dw: Improve unwritable LCR workaround") Link: https://lore.kernel.org/all/84cydt5peu.fsf@jogness.linutronix.de/T/ Signed-off-by: Yunhui Cui Reviewed-by: John Ogness Cc: stable Link: https://lore.kernel.org/r/20250723023322.464-2-cuiyunhui@bytedance.com Signed-off-by: Greg Kroah-Hartman commit 9e32e4db965fd4e5e95e20b0b02ba03688d7e0de Author: Ivaylo Ivanov Date: Tue Jul 22 15:08:59 2025 +0300 dt-bindings: serial: samsung: add samsung,exynos2200-uart compatible Add dedicated samsung,exynos2200-uart compatible to the dt-schema for representing uart of the exynos2200. Like GS101, it has a required DT property samsung,uart-fifosize and exhibits the 32 bit register access limit, so reuse support for it. Signed-off-by: Ivaylo Ivanov Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250722120859.443283-1-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8d1b02e5d7e3a6d2acffb1f4c094678fda9e3456 Author: Nathan Chancellor Date: Tue Jul 22 12:11:18 2025 -0700 usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() After a recent change in clang to expose uninitialized warnings from const variables [1], there is a warning in cxacru_heavy_init(): drivers/usb/atm/cxacru.c:1104:6: error: variable 'bp' is used uninitialized whenever 'if' condition is false [-Werror,-Wsometimes-uninitialized] 1104 | if (instance->modem_type->boot_rom_patch) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/atm/cxacru.c:1113:39: note: uninitialized use occurs here 1113 | cxacru_upload_firmware(instance, fw, bp); | ^~ drivers/usb/atm/cxacru.c:1104:2: note: remove the 'if' if its condition is always true 1104 | if (instance->modem_type->boot_rom_patch) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/usb/atm/cxacru.c:1095:32: note: initialize the variable 'bp' to silence this warning 1095 | const struct firmware *fw, *bp; | ^ | = NULL While the warning is technically correct that bp is conditionally passed uninitialized to cxacru_upload_firmware(), it is ultimately a false positive warning on the uninitialized use of bp because the same condition that initializes bp, instance->modem_type->boot_rom_patch, is the same one that gates the use of bp within cxacru_upload_firmware(). As this warning occurs in clang's frontend before inlining occurs, it cannot know that these conditions are indentical to avoid the warning. Manually inline cxacru_upload_firmware() into cxacru_heavy_init(), as that is its only callsite, so that clang can see that bp is initialized and used under the same condition, clearing up the warning without any functional changes to the code (LLVM was already doing this inlining later). Cc: stable@vger.kernel.org Fixes: 1b0e61465234 ("[PATCH] USB ATM: driver for the Conexant AccessRunner chipset cxacru") Closes: https://github.com/ClangBuiltLinux/linux/issues/2102 Link: https://github.com/llvm/llvm-project/commit/2464313eef01c5b1edf0eccf57a32cdee01472c7 [1] Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250722-usb-cxacru-fix-clang-21-uninit-warning-v2-1-6708a18decd2@kernel.org Signed-off-by: Greg Kroah-Hartman commit 63533ba19d0f325f8e36cc5aae73281a93758618 Author: Ali Nasrolahi Date: Wed Jul 23 07:49:21 2025 +0330 staging: rtl8723bs: remove redundant semicolon in basic_types.h The macro SET_BITS_TO_LE_2BYTE ends with a semicolon inside its definition, which can lead to an extra semicolon when used, resulting in inconsistent formatting or potential warnings. This patch removes the redundant semicolon to comply with kernel macro style guidelines and improve readability. Detected using checkpatch.pl. Signed-off-by: Ali Nasrolahi Link: https://lore.kernel.org/r/20250723041920.9623-2-A.Nasrolahi01@gmail.com Signed-off-by: Greg Kroah-Hartman commit f50d5e0c1f80d004510bf77cb0e1759103585c00 Author: Dave Penkler Date: Tue Jul 22 18:48:10 2025 +0200 staging: gpib: Add init response codes for new ni-usb-hs+ A new version of a bona fide genuine NI-USB-HS+ adaptor sends new response codes to the initialization sequence. Add the checking for these response codes to suppress console warning messages. Signed-off-by: Dave Penkler Link: https://lore.kernel.org/r/20250722164810.2621-1-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit c5647e0e85c91a7e0532b416e3bf429062d67450 Author: Michael Straube Date: Tue Jul 22 09:41:15 2025 +0200 staging: rtl8723bs: DoIQK_8723B is empty The function DoIQK_8723B is empty, remove the function and code that uses it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250722074115.35044-8-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3a9061c59d781e688723ee84609aa9c79b0f6afb Author: Michael Straube Date: Tue Jul 22 09:41:14 2025 +0200 staging: rtl8723bs: dm_CheckStatistics is empty The function dm_CheckStatistics is empty, remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250722074115.35044-7-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit ea1d8343a622eccfac9dd347da57c2958ea36717 Author: Michael Straube Date: Tue Jul 22 09:41:13 2025 +0200 staging: rtl8723bs: hw_var_port_switch is empty The function hw_var_port_switch is empty, remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250722074115.35044-6-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 2d9e220836ddf0a1911f73d79cc02dad10485c0f Author: Michael Straube Date: Tue Jul 22 09:41:12 2025 +0200 staging: rtl8723bs: _InitOtherVariable is empty The function _InitOtherVariable is empty, remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250722074115.35044-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 907b863508bf89d0538a101d503ee6dee08bbf2b Author: Michael Straube Date: Tue Jul 22 09:41:11 2025 +0200 staging: rtl8723bs: rtw_get_encrypt_decrypt_from_registrypriv is empty The function rtw_get_encrypt_decrypt_from_registrypriv is empty, remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250722074115.35044-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit e6e50a98d8dcbf1eaa6bb4f199879dfe362f9cb0 Author: Michael Straube Date: Tue Jul 22 09:41:10 2025 +0200 staging: rtl8723bs: rtl8723b_set_FwAoacRsvdPage_cmd is empty The function rtl8723b_set_FwAoacRsvdPage_cmd is empty, remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250722074115.35044-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 948483e86a78635f3dd08ff8120882721f24d34c Author: Michael Straube Date: Tue Jul 22 09:41:09 2025 +0200 staging: rtl8723bs: CheckFwRsvdPageContent is empty The function CheckFwRsvdPageContent is empty, remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250722074115.35044-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 400a23b2e0ca9325f7c2c418d804591622cc4f61 Author: Vivek BalachandharTN Date: Sun Jul 20 09:21:25 2025 +0000 staging: rtl8723bs: clean up redundant & parentheses Cleaned up redundant parentheses around the '&' (address-of) operator in various expressions to improve code readability and comply with kernel coding style guidelines. Signed-off-by: Vivek BalachandharTN Link: https://lore.kernel.org/r/20250720092125.246844-1-vivek.balachandhar@gmail.com Signed-off-by: Greg Kroah-Hartman commit fe4e81979aa63364305e6dd1c85ce1e097d3fe02 Author: Ovidiu Panait Date: Sun Jul 20 21:38:33 2025 +0300 staging: axis-fifo: add debugfs interface for dumping fifo registers For debugging purposes, add a simple, read-only debugfs interface to dump the following fifo registers: ISR - Interrupt Status Register IER - Interrupt Enable Register TDFV - Transmit Data FIFO Vacancy RDFO - Receive Data FIFO Occupancy $ cat /sys/kernel/debug/43c00000.axi_fifo_mm_s/regs isr: 0x00000000 ier: 0xfe000000 tdfv: 0x000001fc rdfo: 0x00000000 Signed-off-by: Ovidiu Panait Link: https://lore.kernel.org/r/20250720183833.3570345-2-ovidiu.panait.oss@gmail.com Signed-off-by: Greg Kroah-Hartman commit ff9ec951021c2040db475f3d5cc1ada4259dad33 Author: Ovidiu Panait Date: Sun Jul 20 21:38:32 2025 +0300 staging: axis-fifo: remove sysfs interface Unhandled fault: imprecise external abort (0x1406) at 0xaec8d000 [aec8d000] *pgd=03f74831, *pte=0525c75f, *ppte=0525cc7f Internal error: Oops - BUG: 1406 [#1] SMP ARM Hardware name: Xilinx Zynq Platform PC is at sysfs_read+0xc4/0xd8 LR is at dev_attr_show+0x6c/0xc0 pc : [] lr : [] psr: 60070013 sp : e09abd18 ip : c3193000 fp : c0adaccc r10: 00000000 r9 : c3192000 r8 : 183abab5 r7 : c1d5d5a8 r6 : c2d71440 r5 : 00000024 r4 : c3192000 r3 : e0a60024 r2 : 00000000 r1 : c3192000 r0 : c2d71444 ... Call trace: sysfs_read from dev_attr_show+0x6c/0xc0 dev_attr_show from sysfs_kf_seq_show+0x270/0x360 sysfs_kf_seq_show from seq_read_iter+0x7f4/0x10bc seq_read_iter from vfs_read+0x350/0x3d0 vfs_read from ksys_read+0x104/0x194 ksys_read from ret_fast_syscall+0x0/0x54 The same abort is triggered if a read is attempted on RDFD register when the fifo is empty. Therefore, remove the sysfs interface and only let read()/write() modify the fifo registers. For debugging purposes, a simple read-only debugfs interface is added in the next patch. Fixes: 4a965c5f89de ("staging: add driver for Xilinx AXI-Stream FIFO v4.1 IP core") Signed-off-by: Ovidiu Panait Link: https://lore.kernel.org/r/20250720183833.3570345-1-ovidiu.panait.oss@gmail.com Signed-off-by: Greg Kroah-Hartman commit a8934352ba01081c51d2df428e9d540aae0e88b5 Author: Alok Tiwari Date: Sat Jul 19 01:07:42 2025 -0700 staging: nvec: Fix incorrect null termination of battery manufacturer The battery manufacturer string was incorrectly null terminated using bat_model instead of bat_manu. This could result in an unintended write to the wrong field and potentially incorrect behavior. fixe the issue by correctly null terminating the bat_manu string. Fixes: 32890b983086 ("Staging: initial version of the nvec driver") Signed-off-by: Alok Tiwari Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250719080755.3954373-1-alok.a.tiwari@oracle.com Signed-off-by: Greg Kroah-Hartman commit a713222906e4f77b5fb1b5346d4f5de1adc639b4 Author: Gaston Gonzalez Date: Fri Jul 18 16:40:30 2025 -0300 staging: gpib: fix typo Fix typo in comment: dapter/adapter. Signed-off-by: Gaston Gonzalez Link: https://lore.kernel.org/r/20250718194029.35652-2-gascoar@gmail.com Signed-off-by: Greg Kroah-Hartman commit fdcb641fe9f241dc9e01c05e678d4f2e04791ff2 Author: Ignacio Pena Date: Wed Jul 16 14:17:18 2025 -0400 staging: sm750fb: fix CamelCase variable naming Replace CamelCase variable 'Bpp' with lowercase 'bpp' to fix checkpatch warnings about improper variable naming convention. Signed-off-by: Ignacio Pena Link: https://lore.kernel.org/r/20250716181718.82227-1-ignacio.pena87@gmail.com Signed-off-by: Greg Kroah-Hartman commit 20e81dbd39d86dd0ce36bbdab1764151d5df46ce Author: Akhilesh Patil Date: Fri Jul 18 10:24:14 2025 +0530 staging: vme_user: fix spelling errors Fix spelling errors reported by codespell tool as below. bewteen --> between enty --> entry Copntroller --> Controller Signed-off-by: Akhilesh Patil Link: https://lore.kernel.org/r/aHnTdicud7sW/Zis@bhairav-test.ee.iitb.ac.in Signed-off-by: Greg Kroah-Hartman commit 6643eccdc60cb4c4904dee50d5747f18b5b706f0 Author: Ignacio Pena Date: Wed Jul 16 13:51:12 2025 -0400 staging: rtl8723bs: remove unnecessary braces in rtl8723b_cmd Remove braces that are not necessary for single statement blocks to fix checkpatch warnings. Signed-off-by: Ignacio Pena Link: https://lore.kernel.org/r/20250716175113.81519-1-ignacio.pena87@gmail.com Signed-off-by: Greg Kroah-Hartman commit c6b3b6049bdfa14a70697ee6dce6bdf501653b37 Author: Ignacio Pena Date: Wed Jul 16 13:50:44 2025 -0400 staging: rtl8723bs: remove unnecessary commented code Remove commented out code that serves no purpose, as suggested by Greg KH. Signed-off-by: Ignacio Pena Link: https://lore.kernel.org/r/20250716175044.81439-3-ignacio.pena87@gmail.com Signed-off-by: Greg Kroah-Hartman commit 290bd7277b36b572e3a133fc2bc520ab12b52500 Author: Ignacio Pena Date: Wed Jul 16 13:50:43 2025 -0400 staging: rtl8723bs: add missing blank line after declaration Fix checkpatch warning by adding required blank line after variable declaration in Efuse_CalculateWordCnts function. Signed-off-by: Ignacio Pena Link: https://lore.kernel.org/r/20250716175044.81439-2-ignacio.pena87@gmail.com Signed-off-by: Greg Kroah-Hartman commit 35b79fd9fbdce9b3b314f1a8ff57e2f314f7d8a6 Author: Ignacio Pena Date: Wed Jul 16 13:50:42 2025 -0400 staging: rtl8723bs: remove unnecessary comment separator lines Remove the long dashed separator lines from block comments as they don't follow kernel coding style, as suggested by Greg KH. Signed-off-by: Ignacio Pena Link: https://lore.kernel.org/r/20250716175044.81439-1-ignacio.pena87@gmail.com Signed-off-by: Greg Kroah-Hartman commit 06a9a4408697aaf0b4bd88936a3075a9a0b30124 Author: Thomas Huth Date: Mon Jul 21 12:15:37 2025 +0200 LICENSES: Replace the obsolete address of the FSF in the GFDL-1.2 The FSF does not reside in the Franklin street anymore. Let's update the address with the link to their website, as suggested in the latest revisions of their GFDL-1.2 license: https://www.gnu.org/licenses/old-licenses/fdl-1.2.txt Signed-off-by: Thomas Huth Signed-off-by: Greg Kroah-Hartman commit 57f6815fd065eb9c0e9bba7a01de9793bf806f65 Author: Thomas Huth Date: Mon Jul 21 12:15:36 2025 +0200 LICENSES: Replace the obsolete address of the FSF in the GFDL-1.1 The FSF does not reside in the Franklin street anymore. Let's update the address with the link to their website, as suggested in the latest revisions of their GFDL-1.1 license: https://www.gnu.org/licenses/old-licenses/fdl-1.1.txt Signed-off-by: Thomas Huth Signed-off-by: Greg Kroah-Hartman commit 7aa0a850b823a791c939e4d98e889596d166abe6 Author: Thomas Huth Date: Mon Jul 21 12:15:35 2025 +0200 LICENSES: Replace the obsolete address of the FSF in the LGPL-2.1 The FSF does not reside in the Franklin street anymore. Let's update the address with the link to their website, as suggested in the latest revisions of their LGPL-2.1 license: https://www.gnu.org/licenses/old-licenses/lgpl-2.1.txt Signed-off-by: Thomas Huth Signed-off-by: Greg Kroah-Hartman commit 694c24f81c29d784df143066b9d33758a91827fc Author: Thomas Huth Date: Mon Jul 21 12:15:34 2025 +0200 LICENSES: Replace the obsolete address of the FSF in the LGPL-2.0 The FSF does not reside in the Franklin street anymore. Let's update the address with the link to their website, as suggested in the latest revisions of their LGPL-2.0 license: https://www.gnu.org/licenses/old-licenses/lgpl-2.0.txt Signed-off-by: Thomas Huth Signed-off-by: Greg Kroah-Hartman commit 660470dc58624242e39b7fdc6290c81a4f810b1e Author: Thomas Huth Date: Mon Jul 21 12:15:33 2025 +0200 LICENSES: Replace the obsolete address of the FSF in the GPL-2.0 The FSF does not reside in the Franklin street anymore. Let's update the address with the link to their website, as suggested in the latest revisions of their GPL-2.0 license: https://www.gnu.org/licenses/old-licenses/gpl-2.0.txt Signed-off-by: Thomas Huth Signed-off-by: Greg Kroah-Hartman commit b468f4ea13a8888ce76c5ea34333a0a98ef6db8e Author: Thomas Huth Date: Mon Jul 21 12:15:32 2025 +0200 LICENSES: Replace the obsolete address of the FSF in the GPL-1.0 The FSF does not reside in the Mass Ave anymore. Let's update the address with the link to their website, as suggested in the latest revisions of their GPL-1.0 license: https://www.gnu.org/licenses/old-licenses/gpl-1.0.txt Signed-off-by: Thomas Huth Signed-off-by: Greg Kroah-Hartman commit 819687eb28e501d21dabd6a3f52454638a815071 Author: Hector Martin Date: Tue Jun 10 15:29:48 2025 +0000 power: reset: macsmc-reboot: Add driver for rebooting via Apple SMC This driver implements the reboot/shutdown support exposed by the SMC on Apple Silicon machines, such as Apple M1 Macs. Signed-off-by: Hector Martin Reviewed-by: Alyssa Rosenzweig Reviewed-by: Neal Gompa Reviewed-by: Sebastian Reichel Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250610-smc-6-15-v7-7-556cafd771d3@kernel.org Signed-off-by: Lee Jones commit 9b21051b0885912f5bb2cc9d4f95c6fca697da4d Author: Hector Martin Date: Tue Jun 10 15:29:47 2025 +0000 gpio: Add new gpio-macsmc driver for Apple Macs This driver implements the GPIO service on top of the SMC framework on Apple Mac machines. In particular, these are the GPIOs present in the PMU IC which are used to control power to certain on-board devices. Although the underlying hardware supports various pin config settings (input/output, open drain, etc.), this driver does not implement that functionality and leaves it up to the firmware to configure things properly. We also don't yet support interrupts/events. This is sufficient for device power control, which is the only thing we need to support at this point. More features will be implemented when needed. To our knowledge, only Apple Silicon Macs implement this SMC feature. Signed-off-by: Hector Martin Reviewed-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Reviewed-by: Sven Peter Signed-off-by: "Russell King (Oracle)" Reviewed-by: Alyssa Rosenzweig Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Acked-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250610-smc-6-15-v7-6-556cafd771d3@kernel.org Signed-off-by: Lee Jones commit e038d985c9823a12cd64fa077d0c5aca2c644b67 Author: Sven Peter Date: Tue Jun 10 15:29:46 2025 +0000 mfd: Add Apple Silicon System Management Controller The System Management Controller (SMC) on Apple Silicon machines is a piece of hardware that exposes various functionalities such as temperature sensors, voltage/power meters, shutdown/reboot handling, GPIOs and more. Communication happens via a shared mailbox using the RTKit protocol which is also used for other co-processors. The SMC protocol then allows reading and writing many different keys which implement the various features. The MFD core device handles this protocol and exposes it to the sub-devices. Some of the sub-devices are potentially also useful on pre-M1 Apple machines and support for SMCs on these machines can be added at a later time. Co-developed-by: Hector Martin Signed-off-by: Hector Martin Reviewed-by: Alyssa Rosenzweig Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250610-smc-6-15-v7-5-556cafd771d3@kernel.org Signed-off-by: Lee Jones commit ba9ae011e8373b1ff34aa4175c79288013de7fc8 Author: Sven Peter Date: Tue Jun 10 15:29:45 2025 +0000 soc: apple: rtkit: Make shmem_destroy optional shmem_destroy isn't always required for coprocessor-managed buffers but we still enforce that it exists. Just relax the check. Reviewed-by: Alyssa Rosenzweig Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250610-smc-6-15-v7-4-556cafd771d3@kernel.org Signed-off-by: Lee Jones commit dbad719958e162ac021716c223ba9df9071bca55 Author: Russell King (Oracle) Date: Tue Jun 10 15:29:44 2025 +0000 dt-bindings: mfd: Add Apple Mac System Management Controller Add a DT binding for the Apple Mac System Management Controller. Signed-off-by: "Russell King (Oracle)" Reviewed-by: Linus Walleij Reviewed-by: Krzysztof Kozlowski Reviewed-by: Alyssa Rosenzweig Reviewed-by: Neal Gompa Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250610-smc-6-15-v7-3-556cafd771d3@kernel.org Signed-off-by: Lee Jones commit 51bb1f6d4694cd84491847ea59eb194311b7d7f8 Author: Sven Peter Date: Tue Jun 10 15:29:43 2025 +0000 dt-bindings: power: reboot: Add Apple Mac SMC Reboot Controller On Apple Silicon machines a clean shutdown or reboot requires talking to SMC and writing to NVMEM cells. Add a binding for this MFD sub-device. Reviewed-by: Alyssa Rosenzweig Reviewed-by: Neal Gompa Reviewed-by: "Rob Herring (Arm)" Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250610-smc-6-15-v7-2-556cafd771d3@kernel.org Signed-off-by: Lee Jones commit 0f0a7bd04e7e00cef6da5f4955749d6f1fc27b32 Author: Russell King (Oracle) Date: Tue Jun 10 15:29:42 2025 +0000 dt-bindings: gpio: Add Apple Mac SMC GPIO block Add the DT binding for the Apple Mac System Management Controller GPIOs. Signed-off-by: "Russell King (Oracle)" Reviewed-by: Linus Walleij Reviewed-by: Alyssa Rosenzweig Reviewed-by: Neal Gompa Reviewed-by: "Rob Herring (Arm)" Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250610-smc-6-15-v7-1-556cafd771d3@kernel.org Signed-off-by: Lee Jones commit ee235923d205c6de73bf5035f3cdcaee22f3291c Author: Bernard Metzler Date: Wed Jul 23 15:21:07 2025 +0200 RDMA/siw: Change maintainer email address Change siw maintainer email address since old address will become disfunctional. Also add info to .mailmap Signed-off-by: Bernard Metzler Link: https://patch.msgid.link/20250723132107.2188-1-bernard.metzler@linux.dev Signed-off-by: Leon Romanovsky commit a02b105fe9f2b82cbd13b13a98c2b9ffae4a7c27 Author: Dimitri Fedrau Date: Wed Jul 23 19:34:57 2025 +0200 hwmon: add support for MC33XS2410 hardware monitoring The device is able to monitor temperature, voltage and current of each of the four outputs. Add basic support for monitoring the temperature of the four outputs and the die temperature. Signed-off-by: Dimitri Fedrau Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20250723-mc33xs2410-hwmon-v5-2-f62aab71cd59@liebherr.com Signed-off-by: Uwe Kleine-König commit 28517c8b6275a9cd25a4974d0e4d58eaba465a67 Author: Dimitri Fedrau Date: Wed Jul 23 19:34:56 2025 +0200 pwm: mc33xs2410: add hwmon support Support for hwmon is provided by a separate driver residing in hwmon subsystem which is implemented as auxiliary device. Add handling of this device. Signed-off-by: Dimitri Fedrau Link: https://lore.kernel.org/r/20250723-mc33xs2410-hwmon-v5-1-f62aab71cd59@liebherr.com Signed-off-by: Uwe Kleine-König commit 55c172c13718b93300d3808b65ec326b5287c766 Author: Bartosz Golaszewski Date: Wed Jul 23 16:12:57 2025 +0200 ssb: use new GPIO line value setter callbacks for the second GPIO chip Because the other chip is guarded in an unlikely ifdef, I missed it when converting this driver. Fix it now. Fixes: 757259db79fc ("ssb: use new GPIO line value setter callbacks") Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20250723141257.51412-1-brgl@bgdev.pl Signed-off-by: Johannes Berg commit 41469ff94c052b4900af85f1c62a17aff6236f42 Author: Bjorn Helgaas Date: Wed Jul 23 15:17:17 2025 -0500 wifi: Fix typos Fix typos in comments and error messages. Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250723201741.2908456-1-helgaas@kernel.org Signed-off-by: Johannes Berg commit f509de1b0f8959ae4d90c6eeb13dee145fbb0127 Author: Kuninori Morimoto Date: Fri Jul 18 01:50:38 2025 +0000 arm64: kvm: trace_handle_exit: use string choices helper We can use string choices helper, let's use it. Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87o6ti5ksx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Oliver Upton commit 30a597e19f24dc5264954456fe749e26ac67478a Author: Kuninori Morimoto Date: Fri Jul 18 01:50:24 2025 +0000 arm64: kvm: sys_regs: use string choices helper We can use string choices helper, let's use it. Signed-off-by: Kuninori Morimoto Link: https://lore.kernel.org/r/87pldy5ktb.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Oliver Upton commit 5152977340b6dc54e7c8cc8fe401e89cfa3e6f94 Author: Marc Zyngier Date: Tue Jul 1 16:16:48 2025 +0100 KVM: arm64: Follow specification when implementing WXN The R_QXXPC and R_NPBXC rules have some interesting (and pretty sharp) corners when defining the behaviour of of WXN at S1: - when S1 overlay is enabled, WXN applies to the overlay and will remove W - when S1 overlay is disabled, WXN applies to the base permissions and will remove X. Today, we lumb the two together in a way that doesn't really match the rules, making things awkward to follow what is happening, in particular when overlays are enabled. Split these two rules over two distinct paths, which makes things a lot easier to read and validate against the architecture rules. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250701151648.754785-3-maz@kernel.org Signed-off-by: Oliver Upton commit a508d5afb70894ab50ccc4678f55ff801468182b Author: Marc Zyngier Date: Tue Jul 1 16:16:47 2025 +0100 KVM: arm64: Remove the wi->{e0,}poe vs wr->{p,u}ov confusion Some of the POE computation is a bit confused. Specifically, there is an element of confusion between what wi->{e0,}poe an wr->{p,u}ov actually represent. - wi->{e0,}poe is an *input* to the walk, and indicates whether POE is enabled at EL0 or EL{1,2} - wr->{p,u}ov is a *result* of the walk, and indicates whether overlays are enabled. Crutially, it is possible to have POE enabled, and yet overlays disabled, while the converse isn't true What this all means is that once the base permissions have been established, checking for wi->{e0,}poe makes little sense, because the truth about overlays resides in wr->{p,u}ov. So constructs checking for (wi->poe && wr->pov) only add perplexity. Refactor compute_s1_overlay_permissions() and the way it is called according to the above principles. Take the opportunity to avoid reading registers that are not strictly required. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250701151648.754785-2-maz@kernel.org Signed-off-by: Oliver Upton commit 4530256f3699a053f0b9dc677e231d570bbd0eea Author: David Woodhouse Date: Mon Jun 23 15:22:52 2025 +0200 KVM: arm64: vgic-its: Return -ENXIO to invalid KVM_DEV_ARM_VGIC_GRP_CTRL attrs A preliminary version of a hack to invoke unmap_all_vpes() from an ioctl didn't work very well. We eventually determined this was because we were invoking it on the wrong file descriptor, but not getting an error. Signed-off-by: David Woodhouse Reviewed-by: Eric Auger Link: https://lore.kernel.org/r/bbbddd56135399baf699bc46ffb6e7f08d9f8c9f.camel@infradead.org Signed-off-by: Oliver Upton commit a6d283c526f96595e61a46c7901aecc92645f345 Merge: 35b6fc51c666fc ca652cf0c2612a Author: Greg Kroah-Hartman Date: Thu Jul 24 08:03:36 2025 +0200 Merge tag 'icc-6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 6.17 This pull request contains the interconnect changes for the 6.17-rc1 merge window. It contains only driver changes. Driver changes: - SC8180X and SC8280XP driver fixes - Add new driver for the Qualcomm Milos SoC - Add Support for EPSS L3 hardware in QCS8300 SoC - DT bindings fixes and other cleanups Signed-off-by: Georgi Djakov * tag 'icc-6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/djakov/icc: interconnect: qcom: Add Milos interconnect provider driver dt-bindings: interconnect: document the RPMh Network-On-Chip Interconnect in Qualcomm Milos SoC dt-bindings: interconnect: qcom,msm8998-bwmon: Allow 'nonposted-mmio' dt-bindings: interconnect: Add EPSS L3 compatible for QCS8300 SoC dt-bindings: interconnect: qcom: Remove double colon from description interconnect: qcom: qcs615: Drop IP0 interconnects interconnect: qcom: sc8180x: specify num_nodes interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg commit ba578b87fe2beef95b37264f8a98c0b505b93de9 Author: Paul Chaignon Date: Tue Jul 22 16:33:37 2025 +0200 selftests/bpf: Test invalid narrower ctx load This patch adds selftests to cover invalid narrower loads on the context. These used to cause kernel warnings before the previous patch. To trigger the warning, the load had to be aligned, to read an affected context field (ex., skb->sk), and not starting at the beginning of the field. The nine new cases all fail without the previous patch. Suggested-by: Eduard Zingerman Signed-off-by: Paul Chaignon Signed-off-by: Martin KaFai Lau Acked-by: Eduard Zingerman Link: https://patch.msgid.link/44cd83ea9c6868079943f0a436c6efa850528cc1.1753194596.git.paul.chaignon@gmail.com commit e09299225d5ba3916c91ef70565f7d2187e4cca0 Author: Paul Chaignon Date: Tue Jul 22 16:32:32 2025 +0200 bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk being at offset 168 in __sk_buff. This access is detected as a narrower read in bpf_skb_is_valid_access because it doesn't match offsetof(struct __sk_buff, sk). It is therefore allowed and later proceeds to bpf_convert_ctx_access. Note that for the "is_narrower_load" case in the convert_ctx_accesses(), the insn->off is aligned, so the cnt may not be 0 because it matches the offsetof(struct __sk_buff, sk) in the bpf_convert_ctx_access. However, the target_size stays 0 and the verifier errors with a kernel warning: verifier bug: error during ctx access conversion(1) This patch fixes that to return a proper "invalid bpf_context access off=X size=Y" error on the load instruction. The same issue affects multiple other fields in context structures that allow narrow access. Some other non-affected fields (for sk_msg, sk_lookup, and sockopt) were also changed to use bpf_ctx_range_ptr for consistency. Note this syzkaller crash was reported in the "Closes" link below, which used to be about a different bug, fixed in commit fce7bd8e385a ("bpf/verifier: Handle BPF_LOAD_ACQ instructions in insn_def_regno()"). Because syzbot somehow confused the two bugs, the new crash and repro didn't get reported to the mailing list. Fixes: f96da09473b52 ("bpf: simplify narrower ctx access") Fixes: 0df1a55afa832 ("bpf: Warn on internal verifier errors") Reported-by: syzbot+0ef84a7bdf5301d4cbec@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0ef84a7bdf5301d4cbec Signed-off-by: Paul Chaignon Signed-off-by: Martin KaFai Lau Acked-by: Eduard Zingerman Link: https://patch.msgid.link/3b8dcee67ff4296903351a974ddd9c4dca768b64.1753194596.git.paul.chaignon@gmail.com commit 17ce3e5949bc37557305ad46316f41c7875d6366 Author: Kuniyuki Iwashima Date: Tue Jul 22 22:40:37 2025 +0000 bpf: Disable migration in nf_hook_run_bpf(). syzbot reported that the netfilter bpf prog can be called without migration disabled in xmit path. Then the assertion in __bpf_prog_run() fails, triggering the splat below. [0] Let's use bpf_prog_run_pin_on_cpu() in nf_hook_run_bpf(). [0]: BUG: assuming non migratable context at ./include/linux/filter.h:703 in_atomic(): 0, irqs_disabled(): 0, migration_disabled() 0 pid: 5829, name: sshd-session 3 locks held by sshd-session/5829: #0: ffff88807b4e4218 (sk_lock-AF_INET){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1667 [inline] #0: ffff88807b4e4218 (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendmsg+0x20/0x50 net/ipv4/tcp.c:1395 #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #1: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: __ip_queue_xmit+0x69/0x26c0 net/ipv4/ip_output.c:470 #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:331 [inline] #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:841 [inline] #2: ffffffff8e5c4e00 (rcu_read_lock){....}-{1:3}, at: nf_hook+0xb2/0x680 include/linux/netfilter.h:241 CPU: 0 UID: 0 PID: 5829 Comm: sshd-session Not tainted 6.16.0-rc6-syzkaller-00002-g155a3c003e55 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120 __cant_migrate kernel/sched/core.c:8860 [inline] __cant_migrate+0x1c7/0x250 kernel/sched/core.c:8834 __bpf_prog_run include/linux/filter.h:703 [inline] bpf_prog_run include/linux/filter.h:725 [inline] nf_hook_run_bpf+0x83/0x1e0 net/netfilter/nf_bpf_link.c:20 nf_hook_entry_hookfn include/linux/netfilter.h:157 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:623 nf_hook+0x370/0x680 include/linux/netfilter.h:272 NF_HOOK_COND include/linux/netfilter.h:305 [inline] ip_output+0x1bc/0x2a0 net/ipv4/ip_output.c:433 dst_output include/net/dst.h:459 [inline] ip_local_out net/ipv4/ip_output.c:129 [inline] __ip_queue_xmit+0x1d7d/0x26c0 net/ipv4/ip_output.c:527 __tcp_transmit_skb+0x2686/0x3e90 net/ipv4/tcp_output.c:1479 tcp_transmit_skb net/ipv4/tcp_output.c:1497 [inline] tcp_write_xmit+0x1274/0x84e0 net/ipv4/tcp_output.c:2838 __tcp_push_pending_frames+0xaf/0x390 net/ipv4/tcp_output.c:3021 tcp_push+0x225/0x700 net/ipv4/tcp.c:759 tcp_sendmsg_locked+0x1870/0x42b0 net/ipv4/tcp.c:1359 tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1396 inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg net/socket.c:727 [inline] sock_write_iter+0x4aa/0x5b0 net/socket.c:1131 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x6c7/0x1150 fs/read_write.c:686 ksys_write+0x1f8/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe7d365d407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: Fixes: fd9c663b9ad67 ("bpf: minimal support for programs hooked into netfilter framework") Reported-by: syzbot+40f772d37250b6d10efc@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6879466d.a00a0220.3af5df.0022.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima Signed-off-by: Martin KaFai Lau Tested-by: syzbot+40f772d37250b6d10efc@syzkaller.appspotmail.com Acked-by: Florian Westphal Link: https://patch.msgid.link/20250722224041.112292-1-kuniyu@google.com commit 8aad37d16cffb6c0940d9b213456a2733a786f57 Merge: 1cdf3f2d8f1c5d 68db0ff2f76a68 Author: Jakub Kicinski Date: Wed Jul 23 17:52:10 2025 -0700 Merge branch 'dualpi2-patch' Chia-Yu Chang says: ==================== DUALPI2 patch This patch serise adds DualPI Improved with a Square (DualPI2) with following features: * Supports congestion controls that comply with the Prague requirements in RFC9331 (e.g. TCP-Prague) * Coupled dual-queue that separates the L4S traffic in a low latency queue (L-queue), without harming remaining traffic that is scheduled in classic queue (C-queue) due to congestion-coupling using PI2 as defined in RFC9332 * Configurable overload strategies * Use of sojourn time to reliably estimate queue delay * Supports ECN L4S-identifier (IP.ECN==0b*1) to classify traffic into respective queues For more details of DualPI2, please refer IETF RFC9332 (https://datatracker.ietf.org/doc/html/rfc9332). ==================== Link: https://patch.msgid.link/20250722095915.24485-1-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit 68db0ff2f76a68fe088d478e6267a0bf46c84cf1 Author: Chia-Yu Chang Date: Tue Jul 22 11:59:15 2025 +0200 Documentation: netlink: specs: tc: Add DualPI2 specification Introduce the specification of tc qdisc DualPI2 stats and attributes, which is the reference implementation of IETF RFC9332 DualQ Coupled AQM (https://datatracker.ietf.org/doc/html/rfc9332) providing two different queues: low latency queue (L-queue) and classic queue (C-queue). Signed-off-by: Chia-Yu Chang Link: https://patch.msgid.link/20250722095915.24485-7-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit 032f0e9e15a41899ccd0d8173c07b7c2a7236174 Author: Chia-Yu Chang Date: Tue Jul 22 11:59:14 2025 +0200 selftests/tc-testing: Add selftests for qdisc DualPI2 Update configuration of tc-tests and preload DualPI2 module for self-tests, and add following self-test cases for DualPI2: Test a4c7: Create DualPI2 with default setting Test 1ea4: Create DualPI2 with memlimit Test 2130: Create DualPI2 with typical_rtt and max_rtt Test 90c1: Create DualPI2 with max_rtt Test 7b3c: Create DualPI2 with any_ect option Test 49a3: Create DualPI2 with overflow option Test d0a1: Create DualPI2 with drop_enqueue option Test f051: Create DualPI2 with no_split_gso option Test 456b: Create DualPI2 with packet step_thresh Test 610c: Create DualPI2 with packet min_qlen_step Test b4fa: Create DualPI2 with packet coupling_factor Test 37f1: Create DualPI2 with packet classic_protection Signed-off-by: Chia-Yu Chang Reviewed-by: Victor Nogueira Link: https://patch.msgid.link/20250722095915.24485-6-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit 51217c659e741e7e5452ac550aaf83692d3d14cd Author: Chia-Yu Chang Date: Tue Jul 22 11:59:13 2025 +0200 selftests/tc-testing: Fix warning and style check on tdc.sh Replace exit code check with '! cmd' and add both quote and $(...) around 'nproc' to prevent warning and issue reported by shellcheck. Signed-off-by: Chia-Yu Chang Link: https://patch.msgid.link/20250722095915.24485-5-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit 8f9516daedd67097a0c6e463fcb7a42b5ee9d477 Author: Koen De Schepper Date: Tue Jul 22 11:59:12 2025 +0200 sched: Add enqueue/dequeue of dualpi2 qdisc DualPI2 provides L4S-type low latency & loss to traffic that uses a scalable congestion controller (e.g. TCP-Prague, DCTCP) without degrading the performance of 'classic' traffic (e.g. Reno, Cubic etc.). It is to be the reference implementation of IETF RFC9332 DualQ Coupled AQM (https://datatracker.ietf.org/doc/html/rfc9332). Note that creating two independent queues cannot meet the goal of DualPI2 mentioned in RFC9332: "...to preserve fairness between ECN-capable and non-ECN-capable traffic." Further, it could even lead to starvation of Classic traffic, which is also inconsistent with the requirements in RFC9332: "...although priority MUST be bounded in order not to starve Classic traffic." DualPI2 is designed to maintain approximate per-flow fairness on L-queue and C-queue by forming a single qdisc using the coupling factor and scheduler between two queues. The qdisc provides two queues called low latency and classic. It classifies packets based on the ECN field in the IP headers. By default it directs non-ECN and ECT(0) into the classic queue and ECT(1) and CE into the low latency queue, as per the IETF spec. Each queue runs its own AQM: * The classic AQM is called PI2, which is similar to the PIE AQM but more responsive and simpler. Classic traffic requires a decent target queue (default 15ms for Internet deployment) to fully utilize the link and to avoid high drop rates. * The low latency AQM is, by default, a very shallow ECN marking threshold (1ms) similar to that used for DCTCP. The DualQ isolates the low queuing delay of the Low Latency queue from the larger delay of the 'Classic' queue. However, from a bandwidth perspective, flows in either queue will share out the link capacity as if there was just a single queue. This bandwidth pooling effect is achieved by coupling together the drop and ECN-marking probabilities of the two AQMs. The PI2 AQM has two main parameters in addition to its target delay. The integral gain factor alpha is used to slowly correct any persistent standing queue error from the target delay, while the proportional gain factor beta is used to quickly compensate for queue changes (growth or shrinkage). Either alpha and beta are given as a parameter, or they can be calculated by tc from alternative typical and maximum RTT parameters. Internally, the output of a linear Proportional Integral (PI) controller is used for both queues. This output is squared to calculate the drop or ECN-marking probability of the classic queue. This counterbalances the square-root rate equation of Reno/Cubic, which is the trick that balances flow rates across the queues. For the ECN-marking probability of the low latency queue, the output of the base AQM is multiplied by a coupling factor. This determines the balance between the flow rates in each queue. The default setting makes the flow rates roughly equal, which should be generally applicable. If DUALPI2 AQM has detected overload (due to excessive non-responsive traffic in either queue), it will switch to signaling congestion solely using drop, irrespective of the ECN field. Alternatively, it can be configured to limit the drop probability and let the queue grow and eventually overflow (like tail-drop). GSO splitting in DUALPI2 is configurable from userspace while the default behavior is to split gso. When running DUALPI2 at unshaped 10gigE with 4 download streams test, splitting gso apart results in halving the latency with no loss in throughput: Summary of tcp_4down run 'no_split_gso': avg median # data pts Ping (ms) ICMP : 0.53 0.30 ms 350 TCP download avg : 2326.86 N/A Mbits/s 350 TCP download sum : 9307.42 N/A Mbits/s 350 TCP download::1 : 2672.99 2568.73 Mbits/s 350 TCP download::2 : 2586.96 2570.51 Mbits/s 350 TCP download::3 : 1786.26 1798.82 Mbits/s 350 TCP download::4 : 2261.21 2309.49 Mbits/s 350 Summart of tcp_4down run 'split_gso': avg median # data pts Ping (ms) ICMP   : 0.22 0.23 ms 350 TCP download avg : 2335.02 N/A Mbits/s 350 TCP download sum : 9340.09 N/A Mbits/s 350 TCP download::1 : 2335.30 2334.22 Mbits/s 350 TCP download::2 : 2334.72 2334.20 Mbits/s 350 TCP download::3 : 2335.28 2334.58 Mbits/s 350 TCP download::4 : 2334.79 2334.39 Mbits/s 350 A similar result is observed when running DUALPI2 at unshaped 1gigE with 1 download stream test: Summary of tcp_1down run 'no_split_gso': avg median # data pts Ping (ms) ICMP : 1.13 1.25 ms 350 TCP download : 941.41 941.46 Mbits/s 350 Summart of tcp_1down run 'split_gso': avg median # data pts Ping (ms) ICMP : 0.51 0.55 ms 350 TCP download : 941.41 941.45 Mbits/s 350 Additional details can be found in the draft: https://datatracker.ietf.org/doc/html/rfc9332 Signed-off-by: Koen De Schepper Co-developed-by: Olga Albisser Signed-off-by: Olga Albisser Co-developed-by: Olivier Tilmans Signed-off-by: Olivier Tilmans Co-developed-by: Henrik Steen Signed-off-by: Henrik Steen Co-developed-by: Chia-Yu Chang Signed-off-by: Chia-Yu Chang Signed-off-by: Bob Briscoe Signed-off-by: Ilpo Järvinen Acked-by: Dave Taht Link: https://patch.msgid.link/20250722095915.24485-4-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit d4de8bffbef4a7e4ad14b9fd2ff8e2d0e06b3fa5 Author: Chia-Yu Chang Date: Tue Jul 22 11:59:11 2025 +0200 sched: Dump configuration and statistics of dualpi2 qdisc The configuration and statistics dump of the DualPI2 Qdisc provides information related to both queues, such as packet numbers and queuing delays in the L-queue and C-queue, as well as general information such as probability value, WRR credits, memory usage, packet marking counters, max queue size, etc. The following patch includes enqueue/dequeue for DualPI2. Signed-off-by: Chia-Yu Chang Link: https://patch.msgid.link/20250722095915.24485-3-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit 320d031ad6e4d67e8e1ab08ac71efda02bc85683 Author: Chia-Yu Chang Date: Tue Jul 22 11:59:10 2025 +0200 sched: Struct definition and parsing of dualpi2 qdisc DualPI2 is the reference implementation of IETF RFC9332 DualQ Coupled AQM (https://datatracker.ietf.org/doc/html/rfc9332) providing two queues called low latency (L-queue) and classic (C-queue). By default, it enqueues non-ECN and ECT(0) packets into the C-queue and ECT(1) and CE packets into the low latency queue (L-queue), as per IETF RFC9332 spec. This patch defines the dualpi2 Qdisc structure and parsing, and the following two patches include dumping and enqueue/dequeue for the DualPI2. Signed-off-by: Chia-Yu Chang Link: https://patch.msgid.link/20250722095915.24485-2-chia-yu.chang@nokia-bell-labs.com Signed-off-by: Jakub Kicinski commit 1cdf3f2d8f1c5d709a9a0cae101a4f07c245d2e7 Merge: 918c675b208d16 9dfd871a3e2ed4 Author: Jakub Kicinski Date: Wed Jul 23 17:47:01 2025 -0700 Merge branch 'split-netmem-from-struct-page' Byungchul Park says: ==================== Split netmem from struct page The MM subsystem is trying to reduce struct page to a single pointer. See the following link for your information: https://kernelnewbies.org/MatthewWilcox/Memdescs/Path The first step towards that is splitting struct page by its individual users, as has already been done with folio and slab. This patchset does that for page pool. Matthew Wilcox tried and stopped the same work, you can see in: https://lore.kernel.org/20230111042214.907030-1-willy@infradead.org I focused on removing the page pool members in struct page this time, not moving the allocation code of page pool from net to mm. It can be done later if needed. ==================== Link: https://patch.msgid.link/20250721021835.63939-1-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 9dfd871a3e2ed433d5fee519b90b7e619b972043 Author: Byungchul Park Date: Mon Jul 21 11:18:35 2025 +0900 libeth: xdp: access ->pp through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make xdp access ->pp through netmem_desc instead of page. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-13-byungchul@sk.com Signed-off-by: Jakub Kicinski commit c0bcfabd7752494c6444c131a88a26f7e5ba93e4 Author: Byungchul Park Date: Mon Jul 21 11:18:34 2025 +0900 net: ti: icssg-prueth: access ->pp through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make icssg-prueth access ->pp through netmem_desc instead of page. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-12-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 5445a5f71209418b9c908bb0a41b62038d98b80e Author: Byungchul Park Date: Mon Jul 21 11:18:33 2025 +0900 mlx5: access ->pp through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make mlx5 access ->pp through netmem_desc instead of page. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-11-byungchul@sk.com Signed-off-by: Jakub Kicinski commit fc16f6a5877d07c88f4aac9d4d44a9454663cc7f Author: Byungchul Park Date: Mon Jul 21 11:18:32 2025 +0900 idpf: access ->pp through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make idpf access ->pp through netmem_desc instead of page. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-10-byungchul@sk.com Signed-off-by: Jakub Kicinski commit c8d6830e32eb39dc872e56330e35de7cafe6d67a Author: Byungchul Park Date: Mon Jul 21 11:18:31 2025 +0900 iavf: access ->pp through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make iavf access ->pp through netmem_desc instead of page. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-9-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 58831a1785510312b72c182ae985e902753b6f22 Author: Byungchul Park Date: Mon Jul 21 11:18:30 2025 +0900 octeontx2-pf: access ->pp through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make octeontx2-pf access ->pp through netmem_desc instead of page. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-8-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 65589e860a803695da508e24c0ef2beaaaaa564b Author: Byungchul Park Date: Mon Jul 21 11:18:29 2025 +0900 net: fec: access ->pp through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make fec access ->pp through netmem_desc instead of page. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-7-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 87dda483e63f6286288d75eb3beb58b3db37ee2e Author: Byungchul Park Date: Mon Jul 21 11:18:28 2025 +0900 mt76: access ->pp through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make mt76 access ->pp through netmem_desc instead of page. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-6-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 6fd824342a57164d97717325763daee1ef01cbcd Author: Byungchul Park Date: Mon Jul 21 11:18:27 2025 +0900 netdevsim: access ->pp through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make netdevsim access ->pp through netmem_desc instead of page. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-5-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 89ade7c7306508f46b811cd43960eaed88e0e1dd Author: Byungchul Park Date: Mon Jul 21 11:18:26 2025 +0900 netmem, mlx4: access ->pp_ref_count through netmem_desc instead of page To eliminate the use of struct page in page pool, the page pool users should use netmem descriptor and APIs instead. Make mlx4 access ->pp_ref_count through netmem_desc instead of page. While at it, add a helper, pp_page_to_nmdesc() and __pp_page_to_nmdesc(), that can be used to get netmem_desc from page only if it's a pp page. For now that netmem_desc overlays on page, it can be achieved by just casting, and use macro and _Generic to cover const casting as well. Plus, change page_pool_page_is_pp() to check for 'const struct page *' instead of 'struct page *' since it doesn't modify data and additionally covers const type. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-4-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 38a436d4e26487e16ac6c1de17c030b1bef84d83 Author: Byungchul Park Date: Mon Jul 21 11:18:25 2025 +0900 netmem: use netmem_desc instead of page to access ->pp in __netmem_get_pp() To eliminate the use of the page pool fields in struct page, the page pool code should use netmem descriptor and APIs instead. However, __netmem_get_pp() still accesses ->pp via struct page. So change it to use struct netmem_desc instead, since ->pp no longer will be available in struct page. While at it, add a helper, __netmem_to_nmdesc(), that can be used to unsafely get pointer to netmem_desc backing the netmem_ref, only when the netmem_ref is always backed by system memory. Signed-off-by: Byungchul Park Link: https://patch.msgid.link/20250721021835.63939-3-byungchul@sk.com Signed-off-by: Jakub Kicinski commit f3d85c9ee51036ac7ed129ec16eef5df2192763e Author: Byungchul Park Date: Mon Jul 21 11:18:24 2025 +0900 netmem: introduce struct netmem_desc mirroring struct page To simplify struct page, the page pool members of struct page should be moved to other, allowing these members to be removed from struct page. Introduce a network memory descriptor to store the members, struct netmem_desc, and make it union'ed with the existing fields in struct net_iov, allowing to organize the fields of struct net_iov. Signed-off-by: Byungchul Park Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Pavel Begunkov Reviewed-by: Mina Almasry Reviewed-by: Vlastimil Babka Acked-by: Harry Yoo Link: https://patch.msgid.link/20250721021835.63939-2-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 918c675b208d163d511a10dc745cc795c20db3d0 Author: Wang Liang Date: Tue Jul 22 17:30:49 2025 +0800 vxlan: remove redundant conversion of vni in vxlan_nl2conf The IFLA_VXLAN_ID data has been converted to local variable vni in vxlan_nl2conf(), there is no need to do it again when set conf->vni. Signed-off-by: Wang Liang Acked-by: Nikolay Aleksandrov Reviewed-by: Petr Machata Link: https://patch.msgid.link/20250722093049.1527505-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit 9a5bbab285cd21f56ec759d38d452394b51c5073 Author: Jiri Pirko Date: Tue Jul 22 11:19:45 2025 +0200 netdevsim: add fw_update_flash_chunk_time_ms debugfs knobs Netdevsim emulates firmware update and it takes 5 seconds to complete. For some use cases, this is too long and unnecessary. Allow user to configure the time by exposing debugfs a knob to set chunk time. Signed-off-by: Jiri Pirko Reviewed-by: Jakub Kicinski Link: https://patch.msgid.link/20250722091945.79506-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit 1bbdb81a98363fd5cd0c2ac16ad5346bdf814dff Author: Carolina Jubran Date: Tue Jul 22 12:13:29 2025 +0300 devlink: Fix excessive stack usage in rate TC bandwidth parsing The devlink_nl_rate_tc_bw_parse function uses a large stack array for devlink attributes, which triggers a warning about excessive stack usage: net/devlink/rate.c: In function 'devlink_nl_rate_tc_bw_parse': net/devlink/rate.c:382:1: error: the frame size of 1648 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] Introduce a separate attribute set specifically for rate TC bandwidth parsing that only contains the two attributes actually used: index and bandwidth. This reduces the stack array from DEVLINK_ATTR_MAX entries to just 2 entries, solving the stack usage issue. Update devlink selftest to use the new 'index' and 'bw' attribute names consistent with the YAML spec. Example usage with ynl with the new spec: ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/devlink.yaml \ --do rate-set --json '{ "bus-name": "pci", "dev-name": "0000:08:00.0", "port-index": 1, "rate-tc-bws": [ {"index": 0, "bw": 50}, {"index": 1, "bw": 50}, {"index": 2, "bw": 0}, {"index": 3, "bw": 0}, {"index": 4, "bw": 0}, {"index": 5, "bw": 0}, {"index": 6, "bw": 0}, {"index": 7, "bw": 0} ] }' ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/devlink.yaml \ --do rate-get --json '{ "bus-name": "pci", "dev-name": "0000:08:00.0", "port-index": 1 }' output for rate-get: {'bus-name': 'pci', 'dev-name': '0000:08:00.0', 'port-index': 1, 'rate-tc-bws': [{'bw': 50, 'index': 0}, {'bw': 50, 'index': 1}, {'bw': 0, 'index': 2}, {'bw': 0, 'index': 3}, {'bw': 0, 'index': 4}, {'bw': 0, 'index': 5}, {'bw': 0, 'index': 6}, {'bw': 0, 'index': 7}], 'rate-tx-max': 0, 'rate-tx-priority': 0, 'rate-tx-share': 0, 'rate-tx-weight': 0, 'rate-type': 'leaf'} Fixes: 566e8f108fc7 ("devlink: Extend devlink rate API with traffic classes bandwidth management") Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/netdev/20250708160652.1810573-1-arnd@kernel.org/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507171943.W7DJcs6Y-lkp@intel.com/ Suggested-by: Jakub Kicinski Signed-off-by: Carolina Jubran Tested-by: Carolina Jubran Signed-off-by: Tariq Toukan Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/1753175609-330621-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit cc2d5b72b13b3af2b9b4bed3d5dfd0de14414230 Author: Keenan Salandy Date: Wed Jul 23 10:09:30 2025 -0400 platform/chrome: Fix typo in CROS_USBPD_NOTIFY help text Correct the misspelling "platorms" to "platforms" in the help text for the CROS_USBPD_NOTIFY Kconfig option. Signed-off-by: Keenan Salandy Link: https://lore.kernel.org/r/20250723140930.1443-1-keenansalandy@gmail.com Signed-off-by: Tzung-Bi Shih commit 07e0e8ea6400673fe6eb40d3db2a64f1f2bce4ca Author: Troy Mitchell Date: Sat May 31 14:57:26 2025 +0800 i2c: imx: use guard to take spinlock Use guard to automatically release the lock after going out of scope instead of calling it manually. i2c_imx_slave_handle() can safely be entered with the lock held. Refactored the i2c_imx_isr function so that i2c_imx_master_isr does not participate in the guard scope So Using scoped_guard simplifies the control flow by ensuring consistent and automatic unlock, which improves readability without affecting correctness. Co-developed-by: Yongchao Jia Signed-off-by: Yongchao Jia Signed-off-by: Troy Mitchell Reviewed-by: Frank Li Acked-by: Oleksij Rempel Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250531-i2c-imx-update-v4-1-bfad0c8fd45c@gmail.com commit be3b425bcb65b1f5879752371131e813eaa2d481 Author: Yumeng Fang Date: Mon Jun 23 20:31:44 2025 +0800 i2c: stm32f7: Use str_on_off() helper Remove hard-coded strings by using the str_on_off() helper. Signed-off-by: Yumeng Fang Acked-by: Alain Volmat Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250623203144007kQF7E1Bhy5PJl-Ph3u3Ou@zte.com.cn commit 8428582554c66de11d6f96074be91a53affdb66e Author: Frank Li Date: Tue Jun 24 16:04:43 2025 -0400 dt-bindings: i2c: nxp,pnx-i2c: allow clocks property Allow clocks property to fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/lpc/lpc3250-ea3250.dtb: i2c@300 (nxp,pnx-i2c): Unevaluated properties are not allowed ('clocks' was unexpected) Signed-off-by: Frank Li Reviewed-by: Vladimir Zapolskiy Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250624200444.2514331-1-Frank.Li@nxp.com commit 529a3ff283e7e788dd23d372aaf0820dac5822ae Author: Lad Prabhakar Date: Wed Jun 25 11:45:26 2025 +0100 i2c: riic: Add support for RZ/T2H SoC Add support for the Renesas RZ/T2H (R9A09G077) SoC, which features a different interrupt layout for the RIIC controller. Unlike other SoCs with individual error interrupts, RZ/T2H uses a combined error interrupt (EEI). Introduce a new IRQ descriptor table for RZ/T2H, along with a custom ISR (`riic_eei_isr`) to handle STOP and NACK detection from the shared interrupt. Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang # on RZ/A1 Reviewed-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250625104526.101004-6-prabhakar.mahadev-lad.rj@bp.renesas.com commit 832b2f3e3986c8ea8c24a7823ca5189746644bc4 Author: Lad Prabhakar Date: Wed Jun 25 11:45:25 2025 +0100 i2c: riic: Move generic compatible string to end of array Reorder the entry in `riic_i2c_dt_ids` to place the generic compatible string `renesas,riic-rz` at the end of the array, following the convention used in other Renesas drivers. Also, drop the unnecessary comma after the sentinel entry, as it is not needed. Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang # on RZ/A1 Reviewed-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250625104526.101004-5-prabhakar.mahadev-lad.rj@bp.renesas.com commit 11db6a53b2375b29fe742948d71b9b341f8944db Author: Lad Prabhakar Date: Wed Jun 25 11:45:24 2025 +0100 i2c: riic: Pass IRQ desc array as part of OF data In preparation for adding support for Renesas RZ/T2H and RZ/N2H SoCs, which feature a combined error interrupt instead of individual error interrupts per condition, update the driver to support configurable IRQ layouts via OF data. Introduce a new `irqs` field and `num_irqs` count in `riic_of_data` to allow future SoCs to provide a custom IRQ layout. This patch is a non-functional change for existing SoCs and maintains compatibility with the current `riic_irqs` array. Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang # on RZ/A1 Reviewed-by: Geert Uytterhoeven Tested-by: Geert Uytterhoeven Reviewed-by: Andy Shevchenko Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250625104526.101004-4-prabhakar.mahadev-lad.rj@bp.renesas.com commit 13aa792c10ada4f8870da5ba0fb51e478eb5a45e Author: Lad Prabhakar Date: Wed Jun 25 11:45:23 2025 +0100 dt-bindings: i2c: renesas,riic: Document RZ/T2H and RZ/N2H support Document support for the I2C Bus Interface (RIIC) found on the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs. The RIIC IP on these parts is similar to that on RZ/V2H(P) but supports only four interrupts (including a combined error/event), lacks FM+ mode, and does not require reset. Introduce a new compatible string `renesas,riic-r9a09g077` for RZ/T2H and use it as a fallback for RZ/N2H. Unlike earlier SoCs that use eight distinct interrupts, the RZ/T2H uses only four. Update the binding schema to reflect this interrupt layout and skip the `resets` property check, as it is not required on these SoCs. Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250625104526.101004-3-prabhakar.mahadev-lad.rj@bp.renesas.com commit be221173ee918dff2adaf0e23b03aeea44902d5e Author: Lad Prabhakar Date: Wed Jun 25 11:45:22 2025 +0100 dt-bindings: i2c: renesas,riic: Move ref for i2c-controller.yaml to the end In preparation for adding more validation checks, move the `$ref` for 'i2c-controller.yaml' to the end of the file. Also, relocate the conditional check for 'resets' into the 'allOf' block. Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250625104526.101004-2-prabhakar.mahadev-lad.rj@bp.renesas.com commit da4eb06ea52c25d52a31c2c3b1eaff6a5c7882a4 Author: Hans Zhang <18255117159@163.com> Date: Fri May 23 00:38:14 2025 +0800 i2c: tegra: Add missing kernel-doc for dma_dev member Fix the kernel-doc warning by describing the 'dma_dev' member in the tegra_i2c_dev struct. This resolves the compilation warning: drivers/i2c/busses/i2c-tegra.c:297: warning: Function parameter or struct member 'dma_dev' not described in 'tegra_i2c_dev' Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250522163814.399630-1-18255117159@163.com commit ae48d3542783cdb826774a751084aa1c536029d5 Author: Uwe Kleine-König Date: Fri Jun 13 16:24:05 2025 +0200 rtc: Optimize calculations in rtc_time64_to_tm() Recently (in commit 7df4cfef8b35 ("rtc: Make rtc_time64_to_tm() support dates before 1970")) the function rtc_time64_to_tm() was repaired for times before 1970. This introduced two if blocks. Cassio Neri pointed out that to be not neccessary and suggested an adaption that allows to drop the two branch points again. This is implemented here. Also adapt the reference to the theoretical paper to link to the final published article instead of the preprint on Cassio's request. Suggested-by: Cassio Neri Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250613142405.253420-2-u.kleine-koenig@baylibre.com Signed-off-by: Alexandre Belloni commit db22fd8880a2cb58d8684ba4345b4a8c152b8a4f Author: Xianwei Zhao Date: Thu Jul 17 17:38:37 2025 +0800 dt-bindings: rtc: amlogic,a4-rtc: Add compatible string for C3 Amlogic C3 SoCs uses the same rtc controller as A5 SoCs. There is no need for an extra compatible line in the driver, but add C3 compatible line for documentation. Signed-off-by: Xianwei Zhao Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250717-rtc-c3-node-v1-1-4f9ae059b8e6@amlogic.com Signed-off-by: Alexandre Belloni commit 523923cfd5d622b8f4ba893fdaf29fa6adeb8c3e Author: Meagan Lloyd Date: Wed Jun 11 11:14:16 2025 -0700 rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 In using CONFIG_RTC_HCTOSYS, rtc_hctosys() will sync the RTC time to the kernel time as long as rtc_read_time() succeeds. In some power loss situations, our supercapacitor-backed DS1342 RTC comes up with either an unpredictable future time or the default 01/01/00 from the datasheet. The oscillator stop flag (OSF) is set in these scenarios due to the power loss and can be used to determine the validity of the RTC data. This change expands the oscillator stop flag (OSF) handling that has already been implemented for some chips to the ds1341 chip (DS1341 and DS1342 share a datasheet). This handling manages the validity of the RTC data in .read_time and .set_time based on the OSF. Signed-off-by: Meagan Lloyd Reviewed-by: Tyler Hicks Acked-by: Rodolfo Giometti Link: https://lore.kernel.org/r/1749665656-30108-3-git-send-email-meaganlloyd@linux.microsoft.com Signed-off-by: Alexandre Belloni commit 48458654659c9c2e149c211d86637f1592470da5 Author: Meagan Lloyd Date: Wed Jun 11 11:14:15 2025 -0700 rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe In using CONFIG_RTC_HCTOSYS, rtc_hctosys() will sync the RTC time to the kernel time as long as rtc_read_time() succeeds. In some power loss situations, our supercapacitor-backed DS1342 RTC comes up with either an unpredictable future time or the default 01/01/00 from the datasheet. The oscillator stop flag (OSF) is set in these scenarios due to the power loss and can be used to determine the validity of the RTC data. Some chip types in the ds1307 driver already have OSF handling to determine whether .read_time provides valid RTC data or returns -EINVAL. This change removes the clear of the OSF in .probe as the OSF needs to be preserved to expand the OSF handling to the ds1341 chip type (note that DS1341 and DS1342 share a datasheet). Signed-off-by: Meagan Lloyd Reviewed-by: Tyler Hicks Acked-by: Rodolfo Giometti Link: https://lore.kernel.org/r/1749665656-30108-2-git-send-email-meaganlloyd@linux.microsoft.com Signed-off-by: Alexandre Belloni commit 8113e1dfbc4e03a60a635f91a7fa2a5cc6e57b27 Merge: 4ec93a80d774bf 28fa0dcb571ab8 Author: Arnd Bergmann Date: Wed Jul 23 22:23:26 2025 +0200 Merge tag 'riscv-dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt RISC-V Misc Devicetrees for v6.17 StarFive: Sort properties on the MilkV Mars and add the power status LED to all jh7110 boards. AMD: Add 64-bit Microblaze V cpu compatible. Signed-off-by: Conor Dooley * tag 'riscv-dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: dt-bindings: riscv: cpus: Add AMD MicroBlaze V 64bit compatible riscv: dts: starfive: jh7110-common: add status power led node riscv: dts: starfive: jh7110-milkv-mars sort properties Link: https://lore.kernel.org/r/20250723-postage-skylight-597377b5f8e4@spud Signed-off-by: Arnd Bergmann commit 4ec93a80d774bf6c62c8232d2a497ac761931649 Merge: 0e674132ddfa93 8e5bf103b3ada9 Author: Arnd Bergmann Date: Wed Jul 23 22:21:51 2025 +0200 Merge tag 'samsung-dt64-6.17-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v6.17, part two Tesla FSD and Google GS101 DTS are handled via Samsung SoC tree, so the clean dtbs_check rule applies there as well - mention this in their maintainer entries. Also, include Tesla FSD DTS patterns in Samsung SoC tree to document how the patches actually travel. * tag 'samsung-dt64-6.17-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: samsung: MAINTAINERS: Add Tesla FSD DTS to Exynos entry arm64: tesla/google: MAINTAINERS: Reference "SoC clean" maintainer profile Link: https://lore.kernel.org/r/20250723090455.25295-4-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 0e674132ddfa938cd53ba7c3706f0d83b2a91491 Merge: 11949d263a565d 687d974a218a71 Author: Arnd Bergmann Date: Wed Jul 23 22:20:16 2025 +0200 Merge tag 'samsung-drivers-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung SoC drivers for v6.17 1. Google GS101: Minor improvement PMU binding. 2. ExynosAutov920: Add HSI2 system registers binding. * tag 'samsung-drivers-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: dt-bindings: soc: samsung: exynos-sysreg: add hsi2 for ExynosAutov920 dt-bindings: soc: samsung: exynos-pmu: Constrain google,pmu-intr-gen-syscon Link: https://lore.kernel.org/r/20250723090455.25295-3-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 05a623030b3cc2250755e4d4d6b1440a03aed674 Merge: dceb36675b5375 fe4fd701938197 Author: Arnd Bergmann Date: Wed Jul 23 22:19:14 2025 +0200 Merge tag 'arm-sophgo-dt-for-v6.17' of https://github.com/sophgo/linux into soc/newsoc ARM Devicetrees for v6.17 Sophgo: Add support for Duo Module 01 Evaluation Board. This board uses SG2000(old codename CV181xH), which is dual-arch, RISC-V and ARM64. This patch add the support for ARM64. Signed-off-by: Chen Wang * tag 'arm-sophgo-dt-for-v6.17' of https://github.com/sophgo/linux: arm64: defconfig: Enable rudimentary Sophgo SG2000 support arm64: Add SOPHGO SOC family Kconfig support arm64: dts: sophgo: Add Duo Module 01 Evaluation Board arm64: dts: sophgo: Add Duo Module 01 arm64: dts: sophgo: Add initial SG2000 SoC device tree Link: https://lore.kernel.org/r/MAUPR01MB11072C4B088AAC02268044E95FE5FA@MAUPR01MB11072.INDPRD01.PROD.OUTLOOK.COM Signed-off-by: Arnd Bergmann commit 11949d263a565d7ec277729b5e6c1a4fed51d901 Merge: cd7dace0933a65 7f90573099e8a5 Author: Arnd Bergmann Date: Wed Jul 23 22:10:11 2025 +0200 Merge tag 'riscv-sophgo-dt-for-v6.17' of https://github.com/sophgo/linux into soc/dt RISC-V Devicetrees for v6.17 Sophgo: For CV18xx serials: There are three major changes. The first is to add the RTCSYS MFD node, which provides rich control registers for soc power management and other rich control functions; the second is to add the reset controller node and add related reset properties for other peripherals; the third is to add ethernet controller related nodes to the soc and enable ethernet device control for HuashanPi. For SG2042: There are three major changes. The first is to add ISA extensions such as xtheadvector/ziccrse/zfh for cpu cores; the second is add ethernet controller support; the third is add two new boards EVB_V1 & EVB_V2 which use SG2042 SoC. For SG2044: There are many changes. The first is to add pmu configuration; the second is to add ISA extensions ziccrse and add missing riscv,cbop-block-size property for cpu cores; the third is to add more peripherals nodes for SoC after clock controller is ready, such as MSI/PCIe/pwm/SPI-NOR etc. This PR also add HWMON MCU device for the sophgo-srd3-10 board and reserve uart0 node for sophgo-srd3-10 board because uart0 is already occupied by the firmware. This PR also moves sophgo.yaml from the riscv directory to soc/sophgo for sharing between riscv and arm. CV18xx SoC contains a RISC-V big core and an ARM64 big core. Moving sophgo.yaml to a shared location will help us add support for ARM cores to the CV18xx chip in the future. Signed-off-by: Chen Wang * tag 'riscv-sophgo-dt-for-v6.17' of https://github.com/sophgo/linux: (32 commits) riscv: dts: sophgo: fix mdio node name for CV180X riscv: dts: sophgo: sophgo-srd3-10: reserve uart0 device riscv: dts: sophgo: add Sophgo SG2042_EVB_V2.0 board device tree riscv: dts: sophgo: add Sophgo SG2042_EVB_V1.X board device tree dt-bindings: riscv: add Sophgo SG2042_EVB_V1.X/V2.0 bindings riscv: dts: sophgo: add ethernet GMAC device for sg2042 riscv: dts: sophgo: Enable ethernet device for Huashan Pi riscv: dts: sophgo: Add mdio multiplexer device for cv18xx riscv: dts: sophgo: Add ethernet device for cv18xx riscv: dts: sophgo: sg2044: add pmu configuration riscv: dts: sophgo: sg2044: add ziccrse extension riscv: dts: sophgo: add zfh for sg2042 riscv: dts: sophgo: add ziccrse for sg2042 riscv: dts: sophgo: Add xtheadvector to the sg2042 devicetree riscv: dts: sophgo: sg2044: add PCIe device support for SG2044 riscv: dts: sophgo: sg2044: add MSI device support for SG2044 riscv: dts: sophgo: add reset configuration for Sophgo CV1800 series SoC riscv: dts: sophgo: add reset generator for Sophgo CV1800 series SoC dt-bindings: soc: sophgo: Move SoCs/boards from riscv into soc, add SG2000 riscv: dts: sophgo: sg2044: Add missing riscv,cbop-block-size property ... Link: https://lore.kernel.org/r/MAUPR01MB1107297124C9DA0CD77DA3DC1FE5FA@MAUPR01MB11072.INDPRD01.PROD.OUTLOOK.COM Signed-off-by: Arnd Bergmann commit 9f0cb91767f582df6b17c1e2f22f684c36962295 Author: Steven Rostedt Date: Tue Jul 22 10:37:14 2025 -0400 tracing: arm: arm64: Hide trace events ipi_raise, ipi_entry and ipi_exit The ipi tracepoints are mostly generic, but the tracepoints ipi_raise, ipi_entry and ipi_exit are only used by arm and arm64. This means these trace events are wasting memory in all the other architectures that do not use them. Add CONFIG_HAVE_EXTRA_IPI_TRACEPOINTS and have arm and arm64 select it to enable these trace events. The config makes it easy if other architectures decide to trace these as well. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Will Deacon Cc: Russell King Cc: Mark Rutland Cc: Thomas Gleixner Cc: Valentin Schneider Cc: Nicolas Pitre Cc: Peter Zijlstra Link: https://lore.kernel.org/20250722103714.64eba013@gandalf.local.home Signed-off-by: Steven Rostedt (Google) Acked-by: Catalin Marinas commit a594dec7607744a8f877c8516c73a7728a7b66e3 Author: Steven Rostedt Date: Thu Jun 12 09:34:08 2025 -0400 binder: Remove unused binder lock events Trace events can take up to 5K each when they are defined, regardless if they are used or not. The binder lock events: binder_lock, binder_locked and binder_unlock are no longer used. Remove them. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Greg Kroah-Hartman Cc: "Arve =?utf-8?b?SGrDuG5u?= =?utf-8?b?ZXbDpWc=?= " Cc: Todd Kjos Cc: Martijn Coenen Cc: Joel Fernandes Cc: Christian Brauner Cc: Suren Baghdasaryan Link: https://lore.kernel.org/20250612093408.3b7320fa@batman.local.home Fixes: a60b890f607d ("binder: remove global binder lock") Signed-off-by: Steven Rostedt (Google) Acked-by: Carlos Llamas Reviewed-by: Alice Ryhl commit 50fcd1c14e364a2d65e6049578db320d063e9fa1 Author: Bjorn Helgaas Date: Tue Jul 22 16:37:34 2025 -0500 PCI: Fix typos Fix typos. Signed-off-by: Bjorn Helgaas Acked-by: Thomas Gleixner Link: https://patch.msgid.link/20250722213743.2822761-1-helgaas@kernel.org commit db12d7ec6bdfdac39850198cc97a797b2c4dcda6 Author: Yang Li Date: Wed Jul 23 15:04:18 2025 +0800 perf stat: Remove duplicated include in stat-shadow.c The header files rblist.h is included twice in stat-shadow.c, so one inclusion of each can be removed. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22933 Signed-off-by: Yang Li Link: https://lore.kernel.org/r/20250723070418.2195172-1-yang.lee@linux.alibaba.com Signed-off-by: Namhyung Kim commit a3c7f7e16ea8f1c8a34227c7ea08a7e002c2608b Author: Antoni Pokusinski Date: Sun Apr 13 15:07:55 2025 +0200 rtc: pcf85063: add support for RV8063 Microcrystal RV8063 is a real-time clock with SPI interface. Its functionality is very similar to the RV8263 rtc. Signed-off-by: Antoni Pokusinski Link: https://lore.kernel.org/r/20250413130755.159373-4-apokusinski01@gmail.com Signed-off-by: Alexandre Belloni commit 29ac4cedb00e2df366418f768c70d0e2d60fd007 Author: Antoni Pokusinski Date: Sun Apr 13 15:07:54 2025 +0200 rtc: pcf85063: create pcf85063_i2c_probe Move the i2c-specific code from pcf85063_probe to the newly created function. This is a preparation for introducing the support for RV8063 real-time clock with SPI interface. Signed-off-by: Antoni Pokusinski Link: https://lore.kernel.org/r/20250413130755.159373-3-apokusinski01@gmail.com Signed-off-by: Alexandre Belloni commit b265cb1d68a9ab75cd0048cd604283a152fcf633 Author: Antoni Pokusinski Date: Sun Apr 13 15:07:53 2025 +0200 dt-bindings: rtc: pcf85063: add binding for RV8063 Microcrystal RV8063 is a real-time clock module with SPI interface. Reviewed-by: Rob Herring (Arm) Signed-off-by: Antoni Pokusinski Link: https://lore.kernel.org/r/20250413130755.159373-2-apokusinski01@gmail.com Signed-off-by: Alexandre Belloni commit c79a7ca8fb72a17db03e916438c44d9afc98998f Author: Salah Triki Date: Sat Jul 19 05:34:40 2025 +0100 PCI: mvebu: Use devm_add_action_or_reset() instead of devm_add_action() Replace devm_add_action() with devm_add_action_or_reset() to avoid explicitly dropping the 'port->clk' reference in error path. Signed-off-by: Salah Triki [mani: reworded commit subject and description] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/aHsgYALHfQbrgq0t@pc commit cc1d1365f0f414f6522378867baa997642a7e6b2 Merge: fc39760cd0f432 5d71c2b53f1790 cbd5d35e6ddc47 954c0d74129948 463d46044f0401 005b6187705bc9 Author: Neeraj Upadhyay (AMD) Date: Wed Jul 23 21:42:20 2025 +0530 Merge branches 'rcu-exp.23.07.2025', 'rcu.22.07.2025', 'torture-scripts.16.07.2025', 'srcu.19.07.2025', 'rcu.nocb.18.07.2025' and 'refscale.07.07.2025' into rcu.merge.23.07.2025 commit 5647f61ad9171e8f025558ed6dc5702c56a33ba3 Author: Gerald Schaefer Date: Wed Jul 9 20:34:30 2025 +0200 s390/mm: Remove possible false-positive warning in pte_free_defer() Commit 8211dad627981 ("s390: add pte_free_defer() for pgtables sharing page") added a warning to pte_free_defer(), on our request. It was meant to warn if this would ever be reached for KVM guest mappings, because the page table would be freed w/o a gmap_unlink(). THP mappings are not allowed for KVM guests on s390, so this should never happen. However, it is possible that the warning is triggered in a valid case as false-positive. s390_enable_sie() takes the mmap_lock, marks all VMAs as VM_NOHUGEPAGE and splits possibly existing THP guest mappings. mm->context.has_pgste is set to 1 before that, to prevent races with the mm_has_pgste() check in MADV_HUGEPAGE. khugepaged drops the mmap_lock for file mappings and might run in parallel, before a vma is marked VM_NOHUGEPAGE, but after mm->context.has_pgste was set to 1. If it finds file mappings to collapse, it will eventually call pte_free_defer(). This will trigger the warning, but it is a valid case because gmap is not yet set up, and the THP mappings will be split again. Therefore, remove the warning and the comment. Fixes: 8211dad627981 ("s390: add pte_free_defer() for pgtables sharing page") Cc: # 6.6+ Reviewed-by: Alexander Gordeev Reviewed-by: Claudio Imbrenda Signed-off-by: Gerald Schaefer Signed-off-by: Alexander Gordeev commit 9afa2e0d42187591685caf70cbbd040391b9cbb3 Author: Bhaskar Chowdhury Date: Wed Jul 23 04:23:01 2025 +0530 tools/bootconfig: scripts/ftrace.sh was missing the shebang line, so added it This file was missing the shebang line, so added it. Link: https://lore.kernel.org/all/20250722225351.8811-1-unixbhaskar@gmail.com/ [Masami: changed title. ] Signed-off-by: Bhaskar Chowdhury Signed-off-by: Masami Hiramatsu (Google) commit 558d5f3cd250b5c20386200d573b0518a8f5fe64 Author: Masami Hiramatsu (Google) Date: Wed Jul 23 10:31:45 2025 +0900 tracing: probes: Add a kerneldoc for traceprobe_parse_event_name() Since traceprobe_parse_event_name() is a bit complicated, add a kerneldoc for explaining the behavior. Link: https://lore.kernel.org/all/175323430565.57270.2602609519355112748.stgit@devnote2/ Suggested-by: Steven Rostedt Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit 97e8230f89a3570785a66b1f5eec86a2e4324bf9 Author: Masami Hiramatsu (Google) Date: Wed Jul 23 10:31:36 2025 +0900 tracing: uprobe-event: Allocate string buffers from heap Allocate temporary string buffers for parsing uprobe-events from heap instead of stack. Link: https://lore.kernel.org/all/175323429593.57270.12369235525923902341.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit 4c6edb43ead62776d4ae58cc1a121700b546db0f Author: Masami Hiramatsu (Google) Date: Wed Jul 23 10:31:26 2025 +0900 tracing: eprobe-event: Allocate string buffers from heap Allocate temporary string buffers for parsing eprobe-events from heap instead of stack. Link: https://lore.kernel.org/all/175323428599.57270.988038042425748956.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit 33b4e38baa03b1556bec29dd80e58504fe3de1f2 Author: Masami Hiramatsu (Google) Date: Wed Jul 23 10:31:16 2025 +0900 tracing: kprobe-event: Allocate string buffers from heap Allocate temporary string buffers for parsing kprobe-events from heap instead of stack. Link: https://lore.kernel.org/all/175323427627.57270.5105357260879695051.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit d643eaa7082dc3d2438c9ba3ab856eb1c8ad9ffc Author: Masami Hiramatsu (Google) Date: Wed Jul 23 10:31:06 2025 +0900 tracing: fprobe-event: Allocate string buffers from heap Allocate temporary string buffers for fprobe-event from heap instead of stack. This fixes the stack frame exceed limit error. Link: https://lore.kernel.org/all/175323426643.57270.6657152008331160704.stgit@devnote2/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506240416.nZIhDXoO-lkp@intel.com/ Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit 43beb5e89bc8c0b753553964dd0654e2d1aa23f9 Author: Masami Hiramatsu (Google) Date: Wed Jul 23 10:30:56 2025 +0900 tracing: probe: Allocate traceprobe_parse_context from heap Instead of allocating traceprobe_parse_context on stack, allocate it dynamically from heap (slab). This change is likely intended to prevent potential stack overflow issues, which can be a concern in the kernel environment where stack space is limited. Link: https://lore.kernel.org/all/175323425650.57270.280750740753792504.stgit@devnote2/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506240416.nZIhDXoO-lkp@intel.com/ Signed-off-by: Masami Hiramatsu (Google) Reviewed-by: Steven Rostedt (Google) commit 2f02a61d84c629235b8f9684dd0a67e33a2a3d81 Author: Masami Hiramatsu (Google) Date: Wed Jul 23 10:30:47 2025 +0900 tracing: probes: Sort #include alphabetically Sort the #include directives in trace_probe* files alphabetically for easier maintenance and avoid double includes. This also groups headers as linux-generic, asm-generic, and local headers. Link: https://lore.kernel.org/all/175323424678.57270.11975372127870059007.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) commit 9ba817fb7c6afd3c86a6d4c3b822924b87ef0348 Author: Steven Rostedt Date: Tue Jul 22 17:08:06 2025 -0400 tracing: Deprecate auto-mounting tracefs in debugfs In January 2015, tracefs was created to allow access to the tracing infrastructure without needing to compile in debugfs. When tracefs is configured, the directory /sys/kernel/tracing will exist and tooling is expected to use that path to access the tracing infrastructure. To allow backward compatibility, when debugfs is mounted, it would automount tracefs in its "tracing" directory so that tooling that had hard coded /sys/kernel/debug/tracing would still work. It has been over 10 years since the new interface was introduced, and all tooling should now be using it. Start the process of deprecating the old path so that it doesn't need to be maintained anymore. A new config is added to allow distributions to disable automounting of tracefs on debugfs. If /sys/kernel/debug/tracing is accessed, a pr_warn() will trigger stating: "NOTICE: Automounting of tracing to debugfs is deprecated and will be removed in 2030" Expect to remove this feature in 5 years (2030). Cc: Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Mark Rutland Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Sebastian Andrzej Siewior Cc: Namhyung Kim Cc: Linus Torvalds Cc: Andrew Morton Cc: Greg Kroah-Hartman Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Arnaldo Carvalho de Melo Cc: Frederic Weisbecker Cc: Jiri Olsa Cc: Ian Rogers Link: https://lore.kernel.org/20250722170806.40c068c6@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit ab29b3460c5cec24bde75278d7ffca23cac1b867 Author: Baojun Xu Date: Wed Jul 23 22:24:23 2025 +0800 ALSA: hda: Add TAS2770 support Add TAS2770 support in TI's HDA driver. And add hda_chip_id for more products. Distinguish DSP and non-DSP in firmware loading function. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20250723142423.38768-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit a7bcffc673de219af2698fbb90627016233de67b Author: Yang Li Date: Thu Jul 10 18:52:47 2025 +0800 Bluetooth: Add PA_LINK to distinguish BIG sync and PA sync connections Currently, BIS_LINK is used for both BIG sync and PA sync connections, which makes it impossible to distinguish them when searching for a PA sync connection. Adding PA_LINK will make the distinction clearer and simplify future extensions for PA-related features. Signed-off-by: Yang Li Signed-off-by: Luiz Augusto von Dentz commit 0cadf8534f2a727bc3a01e8c583b085d25963ee0 Author: Chris Down Date: Mon Jul 21 16:30:23 2025 +0100 Bluetooth: hci_event: Mask data status from LE ext adv reports The Event_Type field in an LE Extended Advertising Report uses bits 5 and 6 for data status (e.g. truncation or fragmentation), not the PDU type itself. The ext_evt_type_to_legacy() function fails to mask these status bits before evaluation. This causes valid advertisements with status bits set (e.g. a truncated non-connectable advertisement, which ends up showing as PDU type 0x40) to be misclassified as unknown and subsequently dropped. This is okay for most checks which use bitwise AND on the relevant event type bits, but it doesn't work for non-connectable types, which are checked with '== LE_EXT_ADV_NON_CONN_IND' (that is, zero). In terms of behaviour, first the device sends a truncated report: > HCI Event: LE Meta Event (0x3e) plen 26 LE Extended Advertising Report (0x0d) Entry 0 Event type: 0x0040 Data status: Incomplete, data truncated, no more to come Address type: Random (0x01) Address: 1D:12:46:FA:F8:6E (Non-Resolvable) SID: 0x03 RSSI: -98 dBm (0x9e) Data length: 0x00 Then, a few seconds later, it sends the subsequent complete report: > HCI Event: LE Meta Event (0x3e) plen 122 LE Extended Advertising Report (0x0d) Entry 0 Event type: 0x0000 Data status: Complete Address type: Random (0x01) Address: 1D:12:46:FA:F8:6E (Non-Resolvable) SID: 0x03 RSSI: -97 dBm (0x9f) Data length: 0x60 Service Data: Google (0xfef3) Data[92]: ... These devices often send multiple truncated reports per second. This patch introduces a PDU type mask to ensure only the relevant bits are evaluated, allowing for the correct translation of all valid extended advertising packets. Fixes: b2cc9761f144 ("Bluetooth: Handle extended ADV PDU types") Signed-off-by: Chris Down Signed-off-by: Luiz Augusto von Dentz commit 54713670372e17903bff948f5d0859da02106f09 Author: Kiran K Date: Mon Jul 21 15:14:37 2025 +0530 Bluetooth: btintel_pcie: Fix Alive Context State Handling The firmware raises an alive interrupt upon sending the HCI_RESET or BTINTEL_HCI_OP_RESET command. As part of handling the reset command, firmware initializes the hardware and data path and raises the alive interrupt. Upon receiving the alive interrupt, the driver must enable the data path and grant RX buffers to the firmware before sending any commands. The alive context maintained in the driver must be updated before sending BTINTEL_HCI_OP_RESET or HCI_OP_RESET to prevent a potential race condition where the context is also updated in the threaded IRQ. The issue was observed in a stress reboot usecase (1/25) using "sudo reboot" command where the firmware download was failing as the driver was not granting RX buffer to firmware due to race condition. Bluetooth: hci0: API lock is disabled Bluetooth: hci0: Debug lock is disabled Bluetooth: hci0: Minimum firmware build 1 week 10 2014 Bluetooth: hci0: Bootloader timestamp 2023.43 buildtype 1 build 11631 Bluetooth: hci0: Found device firmware: intel/ibt-00a0-00a1-iml.sfi Bluetooth: hci0: Boot Address: 0xb0301000 Bluetooth: hci0: Firmware Version: 167-12.25 Bluetooth: hci0: Waiting for firmware download to complete Bluetooth: hci0: Firmware loaded in 99902 usecs Bluetooth: hci0: Alive context: fw_dl old_boot_stage: 0xa0db0003 new_boot_stage: 0xa0db0003 Bluetooth: hci0: sent cmd: 0xfc01 alive context changed: fw_dl -> intel_reset1 Bluetooth: hci0: Waiting for device to boot Bluetooth: hci0: Device boot timeout Bluetooth: hci0: Firmware download retry count: 1 Fixes: 05c200c8f029 ("Bluetooth: btintel_pcie: Add handshake between driver and firmware") Signed-off-by: Kiran K Signed-off-by: Sai Teja Aluvala Signed-off-by: Luiz Augusto von Dentz commit 69b3d3acf3dba21e2abad863c80c7114eb110b3d Author: Kiran K Date: Mon Jul 21 15:14:36 2025 +0530 Bluetooth: btintel_pcie: Make driver wait for alive interrupt The firmware raises an alive interrupt upon receiving the HCI_RESET or BTINTEL_HCI_OP_RESET (Intel reset - 0xfc01) command. This change fixes the driver to properly wait for the alive interrupt to avoid driver sending commands to firmware before it is ready to process. For details on the handshake between the driver and firmware, refer to commit 05c200c8f029 ("Bluetooth: btintel_pcie: Add handshake between driver and firmware"). As the driver needs to handle two interrupts for HCI_OP_RESET and BTINTEL_HCI_OP_RESET, the firmware ensures that the TX completion interrupt is always followed by the alive interrupt. Fixes: 05c200c8f029 ("Bluetooth: btintel_pcie: Add handshake between driver and firmware") Signed-off-by: Sai Teja Aluvala Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 7af4d7b53502286c6cf946d397ab183e76d14820 Author: Ivan Pravdin Date: Thu Jul 17 11:10:52 2025 -0400 Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv Currently both dev_coredumpv and skb_put_data in hci_devcd_dump use hdev->dump.head. However, dev_coredumpv can free the buffer. From dev_coredumpm_timeout documentation, which is used by dev_coredumpv: > Creates a new device coredump for the given device. If a previous one hasn't > been read yet, the new coredump is discarded. The data lifetime is determined > by the device coredump framework and when it is no longer needed the @free > function will be called to free the data. If the data has not been read by the userspace yet, dev_coredumpv will discard new buffer, freeing hdev->dump.head. This leads to vmalloc-out-of-bounds error when skb_put_data tries to access hdev->dump.head. A crash report from syzbot illustrates this: ================================================================== BUG: KASAN: vmalloc-out-of-bounds in skb_put_data include/linux/skbuff.h:2752 [inline] BUG: KASAN: vmalloc-out-of-bounds in hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258 Read of size 140 at addr ffffc90004ed5000 by task kworker/u9:2/5844 CPU: 1 UID: 0 PID: 5844 Comm: kworker/u9:2 Not tainted 6.14.0-syzkaller-10892-g4e82c87058f4 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: hci0 hci_devcd_timeout Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105 skb_put_data include/linux/skbuff.h:2752 [inline] hci_devcd_dump+0x142/0x240 net/bluetooth/coredump.c:258 hci_devcd_timeout+0xb5/0x2e0 net/bluetooth/coredump.c:413 process_one_work+0x9cc/0x1b70 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3319 [inline] worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400 kthread+0x3c2/0x780 kernel/kthread.c:464 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:153 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address ffffc90004ed5000 belongs to a vmalloc virtual mapping Memory state around the buggy address: ffffc90004ed4f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90004ed4f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 >ffffc90004ed5000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ^ ffffc90004ed5080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ffffc90004ed5100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 ================================================================== To avoid this issue, reorder dev_coredumpv to be called after skb_put_data that does not free the data. Reported-by: syzbot+ac3c79181f6aecc5120c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ac3c79181f6aecc5120c Fixes: b257e02ecc46 ("HCI: coredump: Log devcd dumps into the monitor") Tested-by: syzbot+ac3c79181f6aecc5120c@syzkaller.appspotmail.com Signed-off-by: Ivan Pravdin Signed-off-by: Luiz Augusto von Dentz commit 2935e556850e9c94d7a00adf14d3cd7fe406ac03 Author: Arseniy Krasnov Date: Wed Jul 16 22:23:58 2025 +0300 Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' Function 'hci_discovery_filter_clear()' frees 'uuids' array and then sets it to NULL. There is a tiny chance of the following race: 'hci_cmd_sync_work()' 'update_passive_scan_sync()' 'hci_update_passive_scan_sync()' 'hci_discovery_filter_clear()' kfree(uuids); <-------------------------preempted--------------------------------> 'start_service_discovery()' 'hci_discovery_filter_clear()' kfree(uuids); // DOUBLE FREE <-------------------------preempted--------------------------------> uuids = NULL; To fix it let's add locking around 'kfree()' call and NULL pointer assignment. Otherwise the following backtrace fires: [ ] ------------[ cut here ]------------ [ ] kernel BUG at mm/slub.c:547! [ ] Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP [ ] CPU: 3 UID: 0 PID: 246 Comm: bluetoothd Tainted: G O 6.12.19-kernel #1 [ ] Tainted: [O]=OOT_MODULE [ ] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ ] pc : __slab_free+0xf8/0x348 [ ] lr : __slab_free+0x48/0x348 ... [ ] Call trace: [ ] __slab_free+0xf8/0x348 [ ] kfree+0x164/0x27c [ ] start_service_discovery+0x1d0/0x2c0 [ ] hci_sock_sendmsg+0x518/0x924 [ ] __sock_sendmsg+0x54/0x60 [ ] sock_write_iter+0x98/0xf8 [ ] do_iter_readv_writev+0xe4/0x1c8 [ ] vfs_writev+0x128/0x2b0 [ ] do_writev+0xfc/0x118 [ ] __arm64_sys_writev+0x20/0x2c [ ] invoke_syscall+0x68/0xf0 [ ] el0_svc_common.constprop.0+0x40/0xe0 [ ] do_el0_svc+0x1c/0x28 [ ] el0_svc+0x30/0xd0 [ ] el0t_64_sync_handler+0x100/0x12c [ ] el0t_64_sync+0x194/0x198 [ ] Code: 8b0002e6 eb17031f 54fffbe1 d503201f (d4210000) [ ] ---[ end trace 0000000000000000 ]--- Fixes: ad383c2c65a5 ("Bluetooth: hci_sync: Enable advertising when LL privacy is enabled") Signed-off-by: Arseniy Krasnov Signed-off-by: Luiz Augusto von Dentz commit c20284f73417581a6097401a4a93843ed670f23b Author: Zijun Hu Date: Tue Jul 15 07:27:08 2025 -0700 Bluetooth: btusb: Add one more ID 0x28de:0x1401 for Qualcomm WCN6855 Add one more part with ID (0x28de, 0x1401) to usb_device_id table for Qualcomm WCN6855, and its device info from /sys/kernel/debug/usb/devices is shown below: T: Bus=03 Lev=01 Prnt=01 Port=09 Cnt=03 Dev#= 4 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=28de ProdID=1401 Rev= 0.01 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I: If#= 1 Alt= 7 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 65 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 65 Ivl=1ms Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz commit 986cb42191b6125dfccbc7ac2ea5ae5f3661eb3b Author: Zijun Hu Date: Tue Jul 15 07:27:07 2025 -0700 Bluetooth: btusb: Sort WCN6855 device IDs by VID and PID Sort WCN6855 device IDs to more easily manage them. Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz commit a3f9f6dd047af711341a2367a8b08a3ade31438d Author: Zijun Hu Date: Tue Jul 15 20:40:14 2025 +0800 Bluetooth: btusb: QCA: Support downloading custom-made firmwares There are custom-made firmwares based on board ID for a given QCA BT chip sometimes, and they are different with existing firmwares and put in a separate subdirectory to avoid conflict, for example: QCA2066, as a variant of WCN6855, has firmwares under 'qca/QCA2066/' of linux-firmware repository. Support downloading custom-made firmwares based on a table newly added. Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz commit 085ee7cf937ce1f524cc6e68e81f109ddb1682c7 Author: Neeraj Sanjay Kale Date: Mon Jul 14 13:00:16 2025 +0530 Bluetooth: btnxpuart: Add uevents for FW dump and FW download complete This adds uevents which will be generated whenever FW dump is triggered, FW dump is complete and FW (re)download is done. This feature is needed for IW612 chipset, which is a tri-radio chipset, where WLAN runs on CPU1 and BT and Zigbee runs on CPU2. Currently, whenever BT FW crashes, and FW dump is in progress, there is no way for 15.4 application to know that CPU2 is in bad state, and when it will be recovered. With the help of these uevents and udev rules, the 15.4 app, or any userspace application can be alerted whenever CPU2 goes in bad state and recoveres after BTNXPUART reloads the firmware. [ 334.255154] Bluetooth: hci0: ==== Start FW dump === [ 334.261003] Bluetooth: hci0: ==== Send uevent: BTNXPUART_DEV=serial0-0:BTNXPUART_STATE=FW_DUMP_ACTIVE === [ 351.486048] Bluetooth: hci0: ==== FW dump complete === [ 351.491356] Bluetooth: hci0: ==== Send uevent: BTNXPUART_DEV=serial0-0:BTNXPUART_STATE=FW_DUMP_DONE === [ 352.028974] Bluetooth: hci0: ChipID: 7601, Version: 0 [ 352.034490] Bluetooth: hci0: Request Firmware: nxp/uartspi_n61x_v1.bin.se [ 353.979977] Bluetooth: hci0: FW Download Complete: 417064 bytes [ 355.197222] Bluetooth: hci0: ==== Send uevent: BTNXPUART_DEV=serial0-0:BTNXPUART_STATE=FW_READY === Tested this change by creating a simple udev rule to store the BTNXPUART_STATE value in a ~//state file, and running 15.4 traffic. The 15.4 packets were sent over SPI only when BTNXPUART_STATE was FW_READY. Signed-off-by: Neeraj Sanjay Kale Tested-by: Jean-Yves Salaün Signed-off-by: Luiz Augusto von Dentz commit 634fd53a63be4798da356dbc7251046b713d992a Author: Neeraj Sanjay Kale Date: Mon Jul 14 13:00:15 2025 +0530 Bluetooth: btnxpuart: Correct the Independent Reset handling after FW dump This adds proper handling for the independent reset command sent by the driver after FW dump is complete. In normal scenario, the independent reset vendor command gives a success response before jumping to bootcode. However, when FW goes in a bad state, and sends out FW dump packets, the independent reset command does not get any response from the controller. [ 159.807732] Bluetooth: hci0: ==== Start FW dump === [ 180.759060] Bluetooth: hci0: ==== FW dump complete === [ 182.779208] Bluetooth: hci0: command 0xfcfc tx timeout [ 183.364974] Bluetooth: hci0: ChipID: 7601, Version: 0 [ 183.368490] Bluetooth: hci0: Request Firmware: nxp/uartspi_n61x_v1.bin.se [ 184.679977] Bluetooth: hci0: FW Download Complete: 417064 bytes [ 187.963102] Bluetooth: hci0: Opcode 0x0c03 failed: -110 As a fix for such scenario, the independent reset vendor command is sent using the __hci_cmd_send() API, which does not expect any response for vendor commands. __hci_cmd_send is non blocking, so before the tx_work is scheduled, it sometimes gets canceled and 3F|FC command is never sent. Adding a small delay after __hci_cmd_send allows the command to be sent to the controller. Signed-off-by: Neeraj Sanjay Kale Tested-by: Jean-Yves Salaün Signed-off-by: Luiz Augusto von Dentz commit ef568ae04ead4d132481550fde36fcdd29a31b3b Author: Yang Li Date: Mon Jul 7 10:38:17 2025 +0800 Bluetooth: ISO: Support SCM_TIMESTAMPING for ISO TS User-space applications (e.g. PipeWire) depend on ISO-formatted timestamps for precise audio sync. The ISO ts is based on the controller’s clock domain, so hardware timestamping (hwtimestamp) must be used. Ref: Documentation/networking/timestamping.rst, section 3.1 Hardware Timestamping. Signed-off-by: Yang Li Signed-off-by: Luiz Augusto von Dentz commit 7565bc56598c3d135318f1bd76a0178dd3ea918f Author: Pauli Virtanen Date: Mon Jul 14 19:40:37 2025 +0300 Bluetooth: ISO: add socket option to report packet seqnum via CMSG User applications need a way to track which ISO interval a given SDU belongs to, to properly detect packet loss. All controllers do not set timestamps, and it's not guaranteed user application receives all packet reports (small socket buffer, or controller doesn't send all reports like Intel AX210 is doing). Add socket option BT_PKT_SEQNUM that enables reporting of received packet ISO sequence number in BT_SCM_PKT_SEQNUM CMSG. Use BT_PKT_SEQNUM == 22 for the socket option, as 21 was used earlier for a removed experimental feature that never got into mainline. Signed-off-by: Pauli Virtanen Signed-off-by: Luiz Augusto von Dentz commit 15843c7fdba65568704245fd3ea2aa3aa2d50825 Author: Kiran K Date: Fri Jul 11 15:37:25 2025 +0530 Bluetooth: btintel: Define a macro for Intel Reset vendor command Use macro for Intel Reset command (0xfc01) instead of hard coded value. Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 0e492dbaccda2807eae56274bc90839f41b332fd Author: Bastien Nocera Date: Thu Jul 3 19:17:01 2025 +0200 Bluetooth: Fix typos in comments Found by codespell. Signed-off-by: Bastien Nocera Signed-off-by: Luiz Augusto von Dentz commit e6555fffd5189be7f1a3d936915660ee63c503da Author: Bastien Nocera Date: Thu Jul 3 19:17:00 2025 +0200 Bluetooth: RFCOMM: Fix typos in comments Found by codespell. Signed-off-by: Bastien Nocera Signed-off-by: Luiz Augusto von Dentz commit 8074811359141e2f67eff9bce41a3e2ecae4ace9 Author: Bastien Nocera Date: Thu Jul 3 19:16:59 2025 +0200 Bluetooth: aosp: Fix typo in comment Found by codespell. Signed-off-by: Bastien Nocera Signed-off-by: Luiz Augusto von Dentz commit 0e77524dbc09e3d9f1cfa7d4a15b988466f89b1f Author: Bastien Nocera Date: Thu Jul 3 19:16:58 2025 +0200 Bluetooth: hci_bcm4377: Fix typo in comment Found by codespell. Signed-off-by: Bastien Nocera Signed-off-by: Luiz Augusto von Dentz commit 887f83d4f2fac7c2029f345eac649aff7679db47 Author: Bastien Nocera Date: Thu Jul 3 19:16:57 2025 +0200 Bluetooth: btrtl: Fix typo in comment Found by codespell. Signed-off-by: Bastien Nocera Signed-off-by: Luiz Augusto von Dentz commit b32cb99d9d846bc7d9bdc6d5964ca8f512528359 Author: Bastien Nocera Date: Thu Jul 3 19:16:56 2025 +0200 Bluetooth: btmtk: Fix typo in log string Found by codespell. Signed-off-by: Bastien Nocera Signed-off-by: Luiz Augusto von Dentz commit 9918b837fac203c7139499ba162d779572b476ab Author: Bastien Nocera Date: Thu Jul 3 19:16:55 2025 +0200 Bluetooth: btintel: Fix typo in comment Found by codespell. Signed-off-by: Bastien Nocera Signed-off-by: Luiz Augusto von Dentz commit 942873c8137fe0015ab37f62f159d88079859c5e Author: En-Wei Wu Date: Wed Jul 9 14:36:06 2025 +0800 Bluetooth: btusb: Add new VID/PID 0489/e14e for MT7925 Add VID 0489 & PID e14e for MediaTek MT7925 USB Bluetooth chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below. T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=03 Dev#= 4 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e14e Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I: If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I:* If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: En-Wei Wu Signed-off-by: Luiz Augusto von Dentz commit 385d358a0e12f50231b1d5eca819c551d4b84d41 Author: Hao Li Date: Thu Jul 10 16:05:48 2025 +0800 Bluetooth: btusb: Add RTL8852BE device 0x13d3:0x3618 The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below: T: Bus=01 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3618 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms Signed-off-by: Hao Li Signed-off-by: WangYuli Signed-off-by: Luiz Augusto von Dentz commit b505902c66a282dcb01bcdc015aa1fdfaaa075db Author: Zhongqiu Han Date: Sat Jul 5 18:52:46 2025 +0800 Bluetooth: btusb: Fix potential NULL dereference on kmalloc failure Avoid potential NULL pointer dereference by checking the return value of kmalloc and handling allocation failure properly. Fixes: 7d70989fcea7 ("Bluetooth: btusb: Add HCI Drv commands for configuring altsetting") Signed-off-by: Zhongqiu Han Signed-off-by: Luiz Augusto von Dentz commit 636c803f926ba0b20ad04be6a98592f4df7a7fd5 Author: Catalin Popescu Date: Wed Jul 2 13:41:05 2025 +0200 Bluetooth: btnxpuart: implement powerup sequence NXP bluetooth chip shares power supply and reset gpio with a WLAN chip. Add support for power supply and reset and enforce powerup sequence: - apply power supply - deassert reset/powerdown Signed-off-by: Catalin Popescu Reviewed-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit 18afbdcd1250cafee0012dc45832d439f96b85e6 Author: Catalin Popescu Date: Wed Jul 2 13:41:04 2025 +0200 dt-bindings: net: bluetooth: nxp: add support for supply and reset Add support for chip power supply and chip reset/powerdown. Signed-off-by: Catalin Popescu Acked-by: Conor Dooley Signed-off-by: Luiz Augusto von Dentz commit be31d11ec9144f7f8f7fcbf84ba6971b664683f3 Author: Yang Li Date: Tue Jul 1 16:47:26 2025 +0800 Bluetooth: Fix spelling mistakes Correct the misspelling of “estabilished” in the code. Signed-off-by: Yang Li Signed-off-by: Luiz Augusto von Dentz commit b2a5f2e1c127cb431df22e114998ff72eb4578c8 Author: Yang Li Date: Tue Jul 1 15:56:22 2025 +0800 Bluetooth: hci_event: Add support for handling LE BIG Sync Lost event When the BIS source stops, the controller sends an LE BIG Sync Lost event (subevent 0x1E). Currently, this event is not handled, causing the BIS stream to remain active in BlueZ and preventing recovery. Signed-off-by: Yang Li Signed-off-by: Luiz Augusto von Dentz commit 45b54f007dc36f14e90a4b8a207964a672d1d151 Author: Neeraj Sanjay Kale Date: Mon Jun 23 14:43:22 2025 +0530 Bluetooth: btnxpuart: Add support for 4M baudrate This adds support for 4000000 as secondary baudrate. This value is selected from device tree property "max-speed" which is then used to download FW chunks, and as operational baudrate after HCI initialization is done. Earlier, the secondary baudrate was fixed to 3000000 in driver, but now with "max-speed" property, this secondary baudrate can be set to 4000000. The secondary baudrate is set by the driver by sending a vendor command (3F 09) to the firmware, with secondary baudrate parameter, in nxp_post_init(). Any other value set for max-speed other than 3000000 or 4000000 will default to 3000000, which is supported by all legacy and new NXP chipsets. This feature is applicable for all new V3 bootloader chips and w8987 V1 bootloader chip. This property does not apply for w8997 compatible device, since it downloads a helper.bin FW file that sets secondary baudrate as 3000000 only. The switch to 4000000 baudrate is validated using a Saleae Logic Analyzer and imx8m-mini with AW693 M.2 module. Signed-off-by: Neeraj Sanjay Kale Signed-off-by: Luiz Augusto von Dentz commit 4112e29a33d98afe107e62d94c884514ffbcb21b Author: Neeraj Sanjay Kale Date: Mon Jun 23 14:43:21 2025 +0530 dt-bindings: net: bluetooth: nxp: Add support for 4M baudrate Add support for 4000000 as secondary baudrate for NXP chipsets supporting max baudrate as 4M, and are close to the host processor on same PCB. This mainly helps with faster FW download. Signed-off-by: Neeraj Sanjay Kale Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luiz Augusto von Dentz commit e44328c99be4fb2f6bcd6da42a9b9fa52c14bb05 Author: Zijun Hu Date: Mon Jun 23 20:31:19 2025 +0800 Bluetooth: hci_event: Correct comment about HCI_EV_EXTENDED_INQUIRY_RESULT HCI_EV_EXTENDED_INQUIRY_RESULT's comment wrongly uses 0x2d as its event code. Use right 0x2f instead. Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz commit 88d6ba89d86404073dc3cb711203c02b0754b166 Author: Zijun Hu Date: Mon Jun 23 20:31:18 2025 +0800 Bluetooth: hci_core: Eliminate an unnecessary goto label in hci_find_irk_by_addr() Eliminate an unnecessary goto label by using break instead of goto to exit the loop in hci_find_irk_by_addr(). Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz commit da0186f19a7433d3d5607b0f61e9a3de17d1f721 Author: Zijun Hu Date: Mon Jun 23 20:31:17 2025 +0800 Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync() Use bt_dev_err() instead of bt_dev_dbg() to log error message in hci_update_event_filter_sync(). Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz commit 4d7936e8a5b1fa803f4a631d2da4a80fa4f0f37f Author: Zijun Hu Date: Mon Jun 23 20:31:16 2025 +0800 Bluetooth: hci_sock: Reset cookie to zero in hci_sock_free_cookie() Reset cookie value to 0 instead of 0xffffffff in hci_sock_free_cookie() since: 0 : means cookie has not been assigned yet 0xffffffff: means cookie assignment failure Also fix generating cookie failure with usage shown below: hci_sock_gen_cookie(sk) // generate cookie hci_sock_free_cookie(sk) // free cookie hci_sock_gen_cookie(sk) // Can't generate cookie any more Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz commit b47c97f2ed9434ccff4efb0b08e3cc0a6c4e08c8 Author: Zijun Hu Date: Mon Jun 23 19:23:48 2025 +0800 Bluetooth: hci_qca: Enable ISO data packet RX Enable ISO data packet RX for LE audio. Signed-off-by: Zijun Hu Signed-off-by: Luiz Augusto von Dentz commit 6053b532d345b551a5d4b87fb721a0bc51393858 Author: Kiran K Date: Sat Jun 21 12:16:31 2025 +0530 Bluetooth: btintel_pcie: Add support for device 0x4d76 lspci -v -k -d 8086:4d76 00:14.7 Bluetooth: Intel Corporation Device 4d76 Subsystem: Intel Corporation Device 0011 Flags: fast devsel, IRQ 255, IOMMU group 12 Memory at 13013328000 (64-bit, non-prefetchable) [disabled] [size=16K] Capabilities: [c8] Power Management version 3 Capabilities: [d0] MSI: Enable- Count=1/1 Maskable- 64bit+ Capabilities: [40] Express Root Complex Integrated Endpoint, MSI 00 Capabilities: [80] MSI-X: Enable- Count=32 Masked- Capabilities: [100] Latency Tolerance Reporting Kernel driver in use: btintel_pcie Kernel modules: btintel_pcie Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 70c672f933337fc1de2df8628567ee0a8146562b Author: Yue Haibing Date: Fri Jun 20 15:03:45 2025 +0800 Bluetooth: Remove hci_conn_hash_lookup_state() Since commit 4aa42119d971 ("Bluetooth: Remove pending ACL connection attempts") this function is unused. Signed-off-by: Yue Haibing Reviewed-by: Simon Horman Signed-off-by: Luiz Augusto von Dentz commit 7ed1d46c6bc2848469f8b0cefc43eef2c5d23536 Author: Haochen Tong Date: Fri Jun 6 23:33:03 2025 +0800 Bluetooth: btusb: Add a new VID/PID 2c7c/7009 for MT7925 Adds a new entry with VID 2c7c and PID 7009 for MediaTek MT7925 Bluetooth chip. The device information from /sys/kernel/debug/usb/devices is provided below. T: Bus=03 Lev=01 Prnt=01 Port=04 Cnt=02 Dev#= 3 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=7009 Rev= 1.00 S: Manufacturer=MediaTek Inc. S: Product=Wireless_Device S: SerialNumber=000000000 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=100mA A: FirstIf#= 0 IfCount= 3 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=125us E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 64 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 64 Ivl=125us I: If#= 2 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=(none) E: Ad=8a(I) Atr=03(Int.) MxPS= 512 Ivl=125us E: Ad=0a(O) Atr=03(Int.) MxPS= 512 Ivl=125us Signed-off-by: Haochen Tong Signed-off-by: Luiz Augusto von Dentz commit 171fccce45e34b1552254c9b38454ec8b46886f1 Author: Luiz Augusto von Dentz Date: Tue Jun 10 15:46:23 2025 -0400 Bluetooth: btintel_pcie: Reword restart to recovery This rewords the term restart with recovery since the intend is for hardware recovery not a regular restart, also remove some debug logs which might just clutter the output informing the recovery counter which isn't really useful for regular users. Signed-off-by: Luiz Augusto von Dentz commit 256ab9520d15c772e39620cc0ef6310091406c67 Author: Chandrashekar Devegowda Date: Tue Jun 10 19:30:38 2025 +0530 Bluetooth: btintel_pcie: Support Function level reset The driver supports Function Level Reset (FLR) to recover the controller upon hardware exceptions or hci command timeouts. FLR is triggered only when no prior reset has occurred within the retry window, with a maximum of one FLR allowed within this window. This patch is tested by, echo 1 > /sys/class/bluetooth/hciX/reset Signed-off-by: Chandrashekar Devegowda Signed-off-by: Kiran K Signed-off-by: Luiz Augusto von Dentz commit 65b0dca6f9f2c912a77a6ad6cf56f60a895a496b Author: Uwe Kleine-König Date: Thu May 29 18:23:32 2025 +0200 Bluetooth: btusb: Add support for variant of RTL8851BE (USB ID 13d3:3601) Teach the btusb driver to recognize another variant of the RTL8851BE bluetooth radio. /sys/kernel/debug/usb/devices reports for that device: T: Bus=03 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=12 MxCh= 0 D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=13d3 ProdID=3601 Rev= 0.00 S: Manufacturer=Realtek S: Product=Bluetooth Radio S: SerialNumber=00e04c000001 C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms Reported-by: shdeb Link: https://bugs.debian.org/1106386 Signed-off-by: Uwe Kleine-König Signed-off-by: Luiz Augusto von Dentz commit d9da920233ec85af8b9c87154f2721a7dc4623f5 Author: Zenm Chen Date: Wed May 21 09:30:20 2025 +0800 Bluetooth: btusb: Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano Add USB ID 3625:010b for TP-LINK Archer TX10UB Nano which is based on a Realtek RTL8851BU chip. The information in /sys/kernel/debug/usb/devices about the Bluetooth device is listed as the below: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 9 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=3625 ProdID=010b Rev= 0.00 S: Manufacturer=Realtek S: Product=802.11ax WLAN Adapter S: SerialNumber=00e04c000001 C:* #Ifs= 3 Cfg#= 1 Atr=e0 MxPwr=500mA A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01 I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms I: If#= 1 Alt= 6 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb E: Ad=03(O) Atr=01(Isoc) MxPS= 63 Ivl=1ms E: Ad=83(I) Atr=01(Isoc) MxPS= 63 Ivl=1ms I:* If#= 2 Alt= 0 #EPs= 8 Cls=ff(vend.) Sub=ff Prot=ff Driver=rtl8851bu E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=07(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=09(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms Cc: stable@vger.kernel.org Signed-off-by: Zenm Chen Signed-off-by: Luiz Augusto von Dentz commit c58c35ef6ae62e36927f506a5afc66610b7261d9 Author: Luca Weiss Date: Wed Jul 23 16:03:40 2025 +0200 ASoC: qcom: sm8250: Add Fairphone 4 soundcard compatible Add a compatible for the SM7225-based Fairphone 4 which can use this machine driver. Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20250723-fp4-usb-audio-offload-v3-3-6be84ed4fc39@fairphone.com Signed-off-by: Mark Brown commit d664e75317e19bb79b6d207f7729e35eca504a6a Author: Luca Weiss Date: Wed Jul 23 16:03:39 2025 +0200 ASoC: dt-bindings: qcom,sm8250: Add Fairphone 4 sound card Document the bindings for the sound card on Fairphone 4 which uses the older non-audioreach audio architecture. Acked-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20250723-fp4-usb-audio-offload-v3-2-6be84ed4fc39@fairphone.com Signed-off-by: Mark Brown commit b102c9d89fecd72be83eaab9b384285e2d0dc940 Author: Luca Weiss Date: Wed Jul 23 16:03:38 2025 +0200 ASoC: dt-bindings: qcom,q6afe: Document q6usb subnode Document the subnode for Q6USB, used for USB audio offloading. Cc: Wesley Cheng Acked-by: Rob Herring (Arm) Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20250723-fp4-usb-audio-offload-v3-1-6be84ed4fc39@fairphone.com Signed-off-by: Mark Brown commit 425c8bb39b032bfb338857476eff5bbee324343e Author: Lorenzo Stoakes Date: Wed Jul 23 13:30:36 2025 +0100 doc: update porting, vfs documentation to describe mmap_prepare() Now that we have established .mmap_prepare() as the preferred means by which filesystems establish state upon memory mapping of a file, update the VFS and porting documentation to reflect this. As part of this change, additionally update the VFS documentation to contain the current state of the file_operations struct. Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/20250723123036.35472-1-lorenzo.stoakes@oracle.com Signed-off-by: Christian Brauner commit 4e8fc4f7208b032674ef8a4977b96484c328515c Author: Yue Haibing Date: Wed Jul 23 20:23:29 2025 +0800 netfs: Remove unused declaration netfs_queue_write_request() Commit c245868524cc ("netfs: Remove the old writeback code") removed the implementation but leave declaration. Signed-off-by: Yue Haibing Link: https://lore.kernel.org/20250723122329.923223-1-yuehaibing@huawei.com Signed-off-by: Christian Brauner commit ecb6cc0fd8cd2d34b983e118aa61dd8c9b052d0d Author: Jann Horn Date: Mon Jul 21 19:09:55 2025 +0200 eventpoll: fix sphinx documentation build warning Sphinx complains that ep_get_upwards_depth_proc() has a kerneldoc-style comment without documenting its parameters. This is an internal function that was not meant to show up in kernel documentation, so fix the warning by changing the comment to a non-kerneldoc one. Fixes: 22bacca48a17 ("epoll: prevent creating circular epoll structures") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/r/20250717173655.10ecdce6@canb.auug.org.au Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507171958.aMcW08Cn-lkp@intel.com/ Signed-off-by: Jann Horn Link: https://lore.kernel.org/20250721-epoll-sphinx-fix-v1-1-b695c92bf009@google.com Tested-by: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Christian Brauner commit bc5b0c8febccbeabfefc9b59083b223ec7c7b53a Author: Anuj Gupta Date: Tue Jul 22 17:37:55 2025 +0530 block: fix lbmd_guard_tag_type assignment in FS_IOC_GETLBMD_CAP The blk_get_meta_cap() implementation directly assigns bi->csum_type to the UAPI field lbmd_guard_tag_type. This is not right as the kernel enum blk_integrity_checksum values are not guaranteed to match the UAPI defined values. Fix this by explicitly mapping internal checksum types to UAPI-defined constants to ensure compatibility and correctness, especially for the devices using CRC64 PI. Fixes: 9eb22f7fedfc ("fs: add ioctl to query metadata and protection info capabilities") Reported-by: Vincent Fu Signed-off-by: Anuj Gupta Link: https://lore.kernel.org/20250722120755.87501-1-anuj20.g@samsung.com Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Reviewed-by: Jens Axboe Signed-off-by: Christian Brauner commit e3a9ccd21897a59d02cf2b7a95297086249306d6 Author: Frank Li Date: Fri May 23 17:32:52 2025 -0400 dt-bindings: dma: fsl-mxs-dma: allow interrupt-names for fsl,imx23-dma-apbx Allow interrupt-names for fsl,imx23-dma-apbx and keep the same restriction for others. Signed-off-by: Frank Li Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250523213252.582366-1-Frank.Li@nxp.com Signed-off-by: Vinod Koul commit e56982021f5303b2523ac247e3c79b063459d012 Author: Robert Marko Date: Wed Jul 2 20:36:06 2025 +0200 dmaengine: xdmac: make it selectable for ARCH_MICROCHIP LAN969x uses the Atmel XDMAC, so make it selectable for ARCH_MICROCHIP to avoid needing to update depends in future if other Microchip SoC-s use it as well. Signed-off-by: Robert Marko Link: https://lore.kernel.org/r/20250702183856.1727275-9-robert.marko@sartura.hr Signed-off-by: Vinod Koul commit 245dd180ac861fea31abe69c722061a3c2c65a66 Author: Rob Herring (Arm) Date: Thu Jul 3 10:59:10 2025 -0500 dt-bindings: dma: Convert marvell,orion-xor to DT schema Convert the Marvell Orion XOR engine binding to schema. The "clocks" property is optional for some platforms (though not distinguished by compatble). The child node names used are 'channel' or 'xor'. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250703155912.1713518-1-robh@kernel.org Signed-off-by: Vinod Koul commit ec896de28c9ad1a4155c518588d9153c454abd39 Author: Rob Herring (Arm) Date: Wed Jul 2 17:26:15 2025 -0500 dt-bindings: dma: Convert brcm,iproc-sba to DT schema Convert the Broadcom SBA RAID engine binding to schema. It is a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250702222616.2760974-1-robh@kernel.org Signed-off-by: Vinod Koul commit c6ee78fc8f3e653bec427cfd06fec7877ee782bd Author: Thomas Fourier Date: Mon Jul 7 09:57:16 2025 +0200 dmaengine: nbpfaxi: Add missing check after DMA map The DMA map functions can fail and should be tested for errors. If the mapping fails, unmap and return an error. Fixes: b45b262cefd5 ("dmaengine: add a driver for AMBA AXI NBPF DMAC IP cores") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250707075752.28674-2-fourier.thomas@gmail.com Signed-off-by: Vinod Koul commit 60095aca6b471b7b7a79c80b7395f7e4e414b479 Author: Thomas Fourier Date: Tue Jul 1 14:37:52 2025 +0200 dmaengine: mv_xor: Fix missing check after DMA map and missing unmap The DMA map functions can fail and should be tested for errors. In case of error, unmap the already mapped regions. Fixes: 22843545b200 ("dma: mv_xor: Add support for DMA_INTERRUPT") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250701123753.46935-2-fourier.thomas@gmail.com Signed-off-by: Vinod Koul commit 3630f043302c065adb3d919992173b7dcb251b7b Merge: 26b1d003c6aac1 da75f183fea01f Author: Johannes Berg Date: Wed Jul 23 14:13:15 2025 +0200 Merge tag 'iwlwifi-next-2025-07-23' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi feature, notably - disable features in fips - remove RX OMI feature code - A few fixes and cleanups ==================== Signed-off-by: Johannes Berg commit 26b1d003c6aac1d6673e735994ee524451d501e4 Author: Liu Song Date: Wed Jul 23 17:30:04 2025 +0800 wifi: brcmsmac: Use str_true_false() helper Remove hard-coded strings by using the str_true_false() helper function. Signed-off-by: Liu Song Acked-by: Arend van Spriel > Link: https://patch.msgid.link/20250723173004776P6QSjcW7NrlpGYLTFM-yP@zte.com.cn Signed-off-by: Johannes Berg commit f2d7c3c380bf0c38c395d50de3a7c1a6275983cb Author: Ting-Ying Li Date: Wed Jul 23 16:29:17 2025 +0530 wifi: brcmfmac: fix EXTSAE WPA3 connection failure due to AUTH TX failure For WPA3-SAE Connection in EXTSAE mode, the userspace daemon is allowed to generate the SAE Auth frames. The driver uses the "mgmt_frame" FW IOVAR to transmit this MGMT frame. Before sending the IOVAR, the Driver is incorrectly treating the channel number read from the FW as a frequency value and again attempts to convert this into a channel number using ieee80211_frequency_to_channel(). This added an invalid channel number as part of the IOVAR request to the FW And some FW which strictly expects a valid channel would return BAD_CHAN error, while failing to transmit the driver requested SAE Auth MGMT frame. Fix this in the CYW vendor specific MGMT TX cfg80211 ops handler, by not treating the channel number read from the FW as frequency value and skip the attempt to convert it again into a channel number. Also fix this in the generic MGMT TX cfg80211 ops handler. Fixes: c2ff8cad6423 ("brcm80211: make mgmt_tx in brcmfmac accept a NULL channel") Fixes: 66f909308a7c ("wifi: brcmfmac: cyw: support external SAE authentication in station mode") Signed-off-by: Ting-Ying Li Signed-off-by: Gokul Sivakumar Acked-by: Arend van Spriel > Link: https://patch.msgid.link/20250723105918.5229-1-gokulkumar.sivakumar@infineon.com Signed-off-by: Johannes Berg commit cb106027444074ed612e45982c32a205697a0381 Author: Dr. David Alan Gilbert Date: Thu Jun 26 15:08:12 2025 +0100 wifi: brcm80211: Remove yet more unused functions This is a subset of unused functions in bcrmsmac phy_cmn.c, They're unused since the original 2010 commit a9533e7ea3c4 ("Staging: Add initial release of brcm80211 - Broadcom 802.11n wireless LAN driver.") Remove them. Signed-off-by: Dr. David Alan Gilbert Acked-by: Arend van Spriel > Link: https://patch.msgid.link/20250626140812.56700-4-linux@treblig.org Signed-off-by: Johannes Berg commit b83c7f49716b2e04ba525b54cb457259bd6b7ece Author: Dr. David Alan Gilbert Date: Thu Jun 26 15:08:11 2025 +0100 wifi: brcm80211: Remove more unused functions This is a subset of unused functions in bcrmsmac phy_cmn.c, They're unused since the original 2010 commit a9533e7ea3c4 ("Staging: Add initial release of brcm80211 - Broadcom 802.11n wireless LAN driver.") Remove them. Signed-off-by: Dr. David Alan Gilbert Acked-by: Arend van Spriel > Link: https://patch.msgid.link/20250626140812.56700-3-linux@treblig.org Signed-off-by: Johannes Berg commit 9edf3f855bca60a3634131e09582ee477199af2a Author: Dr. David Alan Gilbert Date: Thu Jun 26 15:08:10 2025 +0100 wifi: brcm80211: Remove unused functions This is a subset of unused functions in bcrmsmac phy_cmn.c, They're unused since the original 2010 commit a9533e7ea3c4 ("Staging: Add initial release of brcm80211 - Broadcom 802.11n wireless LAN driver.") Remove them. Then remove two more functions in phy_n.c that were only used by the ones just removed. Signed-off-by: Dr. David Alan Gilbert Acked-by: Arend van Spriel > Link: https://patch.msgid.link/20250626140812.56700-2-linux@treblig.org Signed-off-by: Johannes Berg commit 1f590fa4b93dd7c7daaa4e09d8381ac2aab3853c Author: Gabor Juhos Date: Fri Jul 11 18:32:52 2025 +0200 spi: spi-qpic-snand: simplify bad block marker duplication Due to the expectations of the SPINAND code, the driver duplicates the bad block markers during raw OOB reads. It has been implemented by using two if statements, and due to the opposite conditions one of conditional codepaths always runs. Since the effect of both codepaths is the same, remove the if statements and use a single line solution instead. Also add a note about why the duplication is required. No functional changes intended. Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250711-qpic-snand-simplify-bbm-copy-v1-1-dd2608325f72@gmail.com Signed-off-by: Mark Brown commit f0b9d31c6edd50a6207489cd1bd4ddac814b9cd2 Author: Lu Baolu Date: Wed Jul 23 15:20:45 2025 +0800 iommu/vt-d: Fix UAF on sva unbind with pending IOPFs Commit 17fce9d2336d ("iommu/vt-d: Put iopf enablement in domain attach path") disables IOPF on device by removing the device from its IOMMU's IOPF queue when the last IOPF-capable domain is detached from the device. Unfortunately, it did this in a wrong place where there are still pending IOPFs. As a result, a use-after-free error is potentially triggered and eventually a kernel panic with a kernel trace similar to the following: refcount_t: underflow; use-after-free. WARNING: CPU: 3 PID: 313 at lib/refcount.c:28 refcount_warn_saturate+0xd8/0xe0 Workqueue: iopf_queue/dmar0-iopfq iommu_sva_handle_iopf Call Trace: iopf_free_group+0xe/0x20 process_one_work+0x197/0x3d0 worker_thread+0x23a/0x350 ? rescuer_thread+0x4a0/0x4a0 kthread+0xf8/0x230 ? finish_task_switch.isra.0+0x81/0x260 ? kthreads_online_cpu+0x110/0x110 ? kthreads_online_cpu+0x110/0x110 ret_from_fork+0x13b/0x170 ? kthreads_online_cpu+0x110/0x110 ret_from_fork_asm+0x11/0x20 ---[ end trace 0000000000000000 ]--- The intel_pasid_tear_down_entry() function is responsible for blocking hardware from generating new page faults and flushing all in-flight ones. Therefore, moving iopf_for_domain_remove() after this function should resolve this. Fixes: 17fce9d2336d ("iommu/vt-d: Put iopf enablement in domain attach path") Reported-by: Ethan Milon Closes: https://lore.kernel.org/r/e8b37f3e-8539-40d4-8993-43a1f3ffe5aa@eviden.com Suggested-by: Ethan Milon Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250723072045.1853328-1-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit c046de827c85a70548df8b86ce5f18820ebaaca7 Author: Clément Léger Date: Fri May 23 12:19:29 2025 +0200 RISC-V: KVM: add SBI extension reset callback Currently, only the STA extension needed a reset function but that's going to be the case for FWFT as well. Add a reset callback that can be implemented by SBI extensions. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20250523101932.1594077-13-cleger@rivosinc.com Signed-off-by: Anup Patel commit cf648c400fd22c022da0b544ca5fb189c3596641 Author: Clément Léger Date: Fri May 23 12:19:28 2025 +0200 RISC-V: KVM: add SBI extension init()/deinit() functions The FWFT SBI extension will need to dynamically allocate memory and do init time specific initialization. Add an init/deinit callbacks that allows to do so. Signed-off-by: Clément Léger Reviewed-by: Andrew Jones Reviewed-by: Atish Patra Link: https://lore.kernel.org/r/20250523101932.1594077-12-cleger@rivosinc.com Signed-off-by: Anup Patel commit b330d77c5da2cfece98a89cbb51b8ef948691e6f Author: Luca Weiss Date: Sun Jul 13 10:05:31 2025 +0200 dt-bindings: dma: qcom,gpi: document the Milos GPI DMA Engine Document the GPI DMA Engine on the Milos SoC. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250713-sm7635-fp6-initial-v2-9-e8f9a789505b@fairphone.com Signed-off-by: Vinod Koul commit a3fe1324c3c5c292ec79bd756497c1c44ff247d2 Author: Cathy Xu Date: Fri Jul 11 17:44:59 2025 +0800 pinctrl: mediatek: Add pinctrl driver for mt8189 Add pinctrl driver support for MediaTek Soc mt8189. Signed-off-by: Cathy Xu Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/20250711094513.17073-4-ot_cathy.xu@mediatek.com Signed-off-by: Linus Walleij commit b225010185418d22cb508bd36adc607ac2c28968 Author: Cathy Xu Date: Fri Jul 11 17:44:57 2025 +0800 dt-bindings: pinctrl: mediatek: Add support for mt8189 Add the new binding document for pinctrl on MediaTek mt8189. Signed-off-by: Cathy Xu Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/20250711094513.17073-2-ot_cathy.xu@mediatek.com Signed-off-by: Linus Walleij commit b1d4c90bffdeda6c0a304249358608e4ddb80377 Author: Jacky Chou Date: Tue Jul 15 11:43:17 2025 +0800 pinctrl: aspeed-g6: Add PCIe RC PERST pin group The PCIe RC PERST uses SSPRST# as PERST# and enable this pin to output. Signed-off-by: Jacky Chou Acked-by: Linus Walleij Link: https://lore.kernel.org/20250715034320.2553837-8-jacky_chou@aspeedtech.com Signed-off-by: Linus Walleij commit 114a2de6fa86d99ed9546cc9113a3cad58beef79 Author: Anthoine Bourgeois Date: Mon Jul 21 09:34:54 2025 +0000 xen/netfront: Fix TX response spurious interrupts We found at Vates that there are lot of spurious interrupts when benchmarking the xen-net PV driver frontend. This issue appeared with a patch that addresses security issue XSA-391 (b27d47950e48 "xen/netfront: harden netfront against event channel storms"). On an iperf benchmark, spurious interrupts can represent up to 50% of the interrupts. Spurious interrupts are interrupts that are rised for nothing, there is no work to do. This appends because the function that handles the interrupts ("xennet_tx_buf_gc") is also called at the end of the request path to garbage collect the responses received during the transmission load. The request path is doing the work that the interrupt handler should have done otherwise. This is particurary true when there is more than one vcpu and get worse linearly with the number of vcpu/queue. Moreover, this problem is amplifyed by the penalty imposed by a spurious interrupt. When an interrupt is found spurious the interrupt chip will delay the EOI to slowdown the backend. This delay will allow more responses to be handled by the request path and then there will be more chance the next interrupt will not find any work to do, creating a new spurious interrupt. This causes performance issue. The solution here is to remove the calls from the request path and let the interrupt handler do the processing of the responses. This approch removes most of the spurious interrupts (<0.05%) and also has the benefit of freeing up cycles in the request path, allowing it to process more work, which improves performance compared to masking the spurious interrupt one way or another. This optimization changes a part of the code that is present since the net frontend driver was upstreamed. There is no similar pattern in the other xen PV drivers. Since the first commit of xen-netfront is a blob that doesn't explain all the design choices I can only guess why this specific mecanism was here. This could have been introduce to compensate a slow backend at the time (maybe the backend was fixed or optimize later) or a small queue. In 18 years, both frontend and backend gain lot of features and optimizations that could have obsolete the feature of reaping completions from the TX path. Some vif throughput performance figures from a 8 vCPUs, 4GB of RAM HVM guest(s): Without this patch on the : vm -> dom0: 4.5Gb/s vm -> vm: 7.0Gb/s Without XSA-391 patch (revert of b27d47950e48): vm -> dom0: 8.3Gb/s vm -> vm: 8.7Gb/s With XSA-391 and this patch: vm -> dom0: 11.5Gb/s vm -> vm: 12.6Gb/s v2: - add revewed and tested by tags - resend with the maintainers in the recipients list v3: - remove Fixes tag but keep the commit ref in the explanation - add a paragraph on why this code was here Signed-off-by: Anthoine Bourgeois Reviewed-by: Juergen Gross Tested-by: Elliott Mitchell Signed-off-by: Juergen Gross Message-ID: <20250721093316.23560-1-anthoine.bourgeois@vates.tech> commit da75f183fea01f2c9f1382655b366ed017891e4e Author: Miri Korenblit Date: Wed Jul 23 09:45:15 2025 +0300 wifi: iwlwifi: Revert "wifi: iwlwifi: remove support of several iwl_ppag_table_cmd versions" It turns out that version 6 is still needed. This change will be brought back once the FW that supports version 6 will no longer be supported. This reverts commit 24bc49d158c7 ("wifi: iwlwifi: remove support of several iwl_ppag_table_cmd versions") Link: https://patch.msgid.link/20250723064515.2084903-2-miriam.rachel.korenblit@intel.com Signed-off-by: Miri Korenblit commit 343c906522ac93855a76e53b5ad924c2ad55b4b3 Author: Miri Korenblit Date: Wed Jul 23 09:45:14 2025 +0300 wifi: iwlwifi: check validity of the FW API range We assume that iwl_mac_cfg and iwl_rf_cfg instances has either both ucode_api_min and ucode_api_max set, or neither. Validate this assumption with a Kunit test. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.66502f3f4345.I661f347d3bb29994d8b2ec1d3f31f3383422d68a@changeid commit 3a805afaea9a13f9b5a027efaf17b0138f4abb04 Author: Miri Korenblit Date: Wed Jul 23 09:45:13 2025 +0300 wifi: iwlwifi: don't export symbols that we shouldn't Functions that are not called from the opmodes shouldn't be exported. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.97b80d0d00b3.Ib8abe63c9b25ef1e4ae1bc167cb23fe34bb3682a@changeid commit 170db5f873850a04a8eafd3401b2ea36adb20cea Author: Miri Korenblit Date: Wed Jul 23 09:45:12 2025 +0300 wifi: iwlwifi: mld: use spec link id and not FW link id In missed beacon handling, we compare the FW link id to the bss_param_ch_cnt_link_id, which is a spec link id. Fix it. Reviewed-by: Somashekhar Puttagangaiah Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.2104f8cac836.I25ed77c2b87bde82a9153e2aa26e09b8a42f6ee3@changeid commit bc404dfddbf6817cae9b170c34556dc72ea975e5 Author: Benjamin Berg Date: Wed Jul 23 09:45:11 2025 +0300 wifi: iwlwifi: mld: decode EOF bit for AMPDUs Only the EOF bit handling for single frames was ported to the MLD driver. The code to handle AMPDUs correctly was forgotten. Add it back so that the bit is reported in the radiotap headers again. Fixes: d1e879ec600f ("wifi: iwlwifi: add iwlmld sub-driver") Signed-off-by: Benjamin Berg Reviewed-by: Daniel Gabay Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.195be86372d5.I4db4abf348f7b6dfc75f869770dd77655a204bc7@changeid commit 4b0dccdd81509ba57d1929da9e9395a9006fb98d Author: Miri Korenblit Date: Wed Jul 23 09:45:10 2025 +0300 wifi: iwlwifi: Remove support for rx OMI bandwidth reduction This feature turns out to have an issue: it can take up to 8 seconds to detect high throughput scenarios and to leave RX OMI bandwidth reduction. This leads to throughput degradation. Until the issues are fixed, remove the RX OMI implementation. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.a9ccfe210516.Ic87bc7709a6761f593e88f1488a41442c68c1686@changeid commit b089c415e0a9e44f4ecba470e189063c1ed7f4d4 Author: Miri Korenblit Date: Wed Jul 23 09:45:09 2025 +0300 wifi: iwlwifi: stop supporting iwl_omi_send_status_notif ver 1 This version doesn't provide the sta id, so we need to look it up - assuming that no other sta exists, since one of the conditions of entering OMI is not having P2P/TDLS. But when we leave OMI, because of the P2P/TDLS activation, the P2P/TDLS sta can already exist while we receive the notification from the FW. This causes an error log which is incorrect. Since OMI is only supported in SC, which is not shipped yet, no one will use a FW with the old version. Remove support for it. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.b716b9cebaa7.I2a1cc4be441dbbb5566a9a3d2d330d956ff3ed38@changeid commit 5d94c61c9dcffe2ce8da958448ee1c359e3b0b2a Author: Miri Korenblit Date: Wed Jul 23 09:45:08 2025 +0300 wifi: iwlwifi: remove SC2F firmware support The only difference between SC2 and SC2F is that they use a different FSEQ image. The firmware of SC2 implements the logic of selecting the right FSEQ image to load, so there is no need for SC2F firmware image. Stop loading it, and load SC2 image instead. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.bf0ec63e49a9.Iffa0a982f90a179566d85c60ccd3dbfc50e293ef@changeid commit 4459dd6d85b9fbcdbc3803603fba9d78c1cec2c4 Author: Ilan Peer Date: Wed Jul 23 09:45:07 2025 +0300 wifi: iwlwifi: mvm: Remove NAN support NAN is not officially supported on any of the MVM devices so there is no need to maintain it. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.b327adbf35c0.I0357e383ab5df72d8b87e0dee10609a6946865b6@changeid commit 666357bf3e57c6a68be128825775aee14f9a24f7 Author: Avraham Stern Date: Wed Jul 23 09:45:06 2025 +0300 wifi: iwlwifi: mld: avoid outdated reorder buffer head_sn If no frames are received on a queue for a while, the reorder buffer head_sn may be an old one. When the next frame that is received on that queue and buffered is a subframe of an AMSDU but not the last subframe, it will not update the buffer's head_sn. When the frame release notification arrives, it will not release the buffered frame because it will look like the notification's NSSN is lower than the buffer's head_sn (because of a wraparound). Fix it by updating the head_sn when the first frame is buffered. Signed-off-by: Avraham Stern Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.e1f62a9a603c.I7b57a481122074b1f40d39cd31db2e5262668eb2@changeid commit 422850b29e05e67c9145895bfe559940caa0caa8 Author: Avraham Stern Date: Wed Jul 23 09:45:05 2025 +0300 wifi: iwlwifi: mvm: avoid outdated reorder buffer head_sn If no frames are received on a queue for a while, the reorder buffer head_sn may be an old one. When the next frame that is received on that queue and buffered is a subframe of an AMSDU but not the last subframe, it will not update the buffer's head_sn. When the frame release notification arrives, it will not release the buffered frame because it will look like the notification's NSSN is lower than the buffer's head_sn (because of a wraparound). Fix it by updating the head_sn when the first frame is buffered. Signed-off-by: Avraham Stern Reviewed-by: Daniel Gabay Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.795ec0cb8817.I9ec9a3508e7935e8d1833ea3e086066fdefee644@changeid commit 0636800c8ee1daa55c9f0f00e8af869645dab4df Author: Johannes Berg Date: Wed Jul 23 09:45:04 2025 +0300 wifi: iwlwifi: disable certain features for fips_enabled When fips_enabled is set, keys will not be given to the hardware by mac80211 since the hardware isn't certified. In this case, various features cannot work correctly as the firmware needs to handle frames, but it then cannot since no keys are available. Disable features: - WoWLAN since no keys etc. - MFP since some frames need to be handled in firmware - EHT/6GHz since MFP is required Also restrict A-MSDU size since A-MSDUs cannot be split up by hardware and thus need to fit into the RX buffers in one piece. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.329fade58a27.I0be27dd329643cc5fdf79a8c8b8f6d2e6fb5c175@changeid commit 0dd86ab21dbbcef7cd7cb1eb303e1803ed32a5f3 Author: Benjamin Berg Date: Wed Jul 23 09:45:03 2025 +0300 wifi: iwlwifi: mld: support channel survey collection for ACS scans The firmware is able to collect channel statistics when doing passive scans. Enable the flag when doing a passive scan on an AP interface and collect the survey information. Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.a659ef1b1fd8.I24a9a0383327c231f36be170968bc7bac801f9f2@changeid commit fc3475fa461114c148df61a9b0a4d49787eb3cd3 Author: Miri Korenblit Date: Wed Jul 23 09:45:02 2025 +0300 wifi: iwlwifi: mld: disable RX aggregation if requested The user can request to disable RX aggregations via the module parameter enable_11n. Honor this request and reject addba. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250723094230.40746586ade7.Ibf5877df76ea2f1eee614166b3194843fd9898cd@changeid commit cbbcfb94c55c02a8c4ce52b5da0770b5591a314c Author: Jeremy Linton Date: Fri Jul 18 23:37:33 2025 -0500 arm64/gcs: task_gcs_el0_enable() should use passed task Mark Rutland noticed that the task parameter is ignored and 'current' is being used instead. Since this is usually what its passed, it hasn't yet been causing problems but likely will as the code gets more testing. But, once this is fixed, it creates a new bug in copy_thread_gcs() since the gcs_el_mode isn't yet set for the task before its being checked. Move gcs_alloc_thread_stack() after the new task's gcs_el0_mode initialization to avoid this. Fixes: fc84bc5378a8 ("arm64/gcs: Context switch GCS state for EL0") Signed-off-by: Jeremy Linton Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250719043740.4548-2-jeremy.linton@arm.com Signed-off-by: Catalin Marinas commit cac6599b2d68caa6327ee04861572add8fd20004 Author: Rosen Penev Date: Tue Jul 22 14:28:56 2025 -0700 dt-bindings: net: wireless: rt2800: add SOC Wifi Add device-tree bindings for the RT2800 SOC wifi device found in older Ralink/Mediatek devices. Signed-off-by: Rosen Penev Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250722212856.11343-8-rosenp@gmail.com Signed-off-by: Johannes Berg commit fdd544482e405a933aab2537d2db42079d639f82 Author: Rosen Penev Date: Tue Jul 22 14:28:55 2025 -0700 MIPS: dts: ralink: mt7620a: add wifi MT7620A devices all contain a wifi device as part of the SOC. Add it here to get it working. Signed-off-by: Rosen Penev Reviewed-by: Sergio Paracuellos Link: https://patch.msgid.link/20250722212856.11343-7-rosenp@gmail.com Signed-off-by: Johannes Berg commit ddc19499aee1327ad9fa773a3db62f2d67798836 Author: Rosen Penev Date: Tue Jul 22 14:28:54 2025 -0700 wifi: rt2x00: soc: modernize probe Remove a bunch of static memory management functions and simplify with devm. Also move allocation before ieee80211_alloc_hw to get rid of goto statements and clarify the error handling a bit more. Signed-off-by: Rosen Penev Acked-by: Stanislaw Gruszka Reviewed-by: Sergio Paracuellos Link: https://patch.msgid.link/20250722212856.11343-6-rosenp@gmail.com Signed-off-by: Johannes Berg commit 7f6109086c9e7bbc78ff936dac45626870455c76 Author: Rosen Penev Date: Tue Jul 22 14:28:53 2025 -0700 wifi: rt2800: move 2x00soc to 2800soc This driver was written with multiple SOC platforms in mind. However since Ralink was aquired by Mediatek, it only effectively got used by older platforms. As such, we can slim down the driver slightly by moving all of rt2x00soc to rt2800soc in order to benefit from inlining. Signed-off-by: Rosen Penev Acked-by: Stanislaw Gruszka Reviewed-by: Sergio Paracuellos Link: https://patch.msgid.link/20250722212856.11343-5-rosenp@gmail.com Signed-off-by: Johannes Berg commit 708e88b9d47522507e330698cea120e0b73b7de0 Author: Rosen Penev Date: Tue Jul 22 14:28:52 2025 -0700 wifi: rt2800soc: allow loading from OF Add a single binding to help the already present dts files load the driver. More are possible but there doesn't seem to be a significant difference between them to justify this. Use wifi name per dtschema requirements. Added OF dependency to SOC CONFIG as adding of_match_table without OF being present makes no sense. Signed-off-by: Rosen Penev Reviewed-by: Sergio Paracuellos Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/20250722212856.11343-4-rosenp@gmail.com Signed-off-by: Johannes Berg commit f1fd79a6475ff550acaa64cf06308a1f57c6ee8f Author: Rosen Penev Date: Tue Jul 22 14:28:51 2025 -0700 wifi: rt2x00: remove mod_name from platform_driver mod_name is a legacy debugging feature with no real modern use. An analysis of the underlying MIPS setup code reveals it to also be unused. Signed-off-by: Rosen Penev Reviewed-by: Sergio Paracuellos Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/20250722212856.11343-3-rosenp@gmail.com Signed-off-by: Johannes Berg commit 311b05e235cf19283185579803e1be6332ab0d41 Author: Rosen Penev Date: Tue Jul 22 14:28:50 2025 -0700 wifi: rt2x00: add COMPILE_TEST While this driver is for a specific arch, there is nothing preventing it from being compiled on other platforms. Allows the various bots to test compilation and complain if a patch is bad. Signed-off-by: Rosen Penev Acked-by: Stanislaw Gruszka Reviewed-by: Sergio Paracuellos Link: https://patch.msgid.link/20250722212856.11343-2-rosenp@gmail.com Signed-off-by: Johannes Berg commit c57e5b9819dfd16d709bcd6cb633301ed0829a66 Author: Johannes Berg Date: Wed Jul 23 09:14:19 2025 +0200 wifi: mac80211: fix WARN_ON for monitor mode on some devices On devices without WANT_MONITOR_VIF (and probably without channel context support) we get a WARN_ON for changing the per-link setting of a monitor interface. Since we already skip AP_VLAN interfaces and MONITOR with WANT_MONITOR_VIF and/or NO_VIRTUAL_MONITOR should update the settings, catch this in the link change code instead of the warning. Reported-by: Martin Kaistra Link: https://lore.kernel.org/r/a9de62a0-28f1-4981-84df-253489da74ed@linutronix.de/ Fixes: c4382d5ca1af ("wifi: mac80211: update the right link for tx power") Signed-off-by: Johannes Berg commit 204bb852863bf14f343a0801b15bc2173bc318f9 Author: Kees Cook Date: Mon Jul 21 11:18:14 2025 -0700 wifi: brcmfmac: cyw: Fix __counted_by to be LE variant In brcmf_cyw_mgmt_tx() the "len" counter of the struct brcmf_mf_params_le::data flexible array is stored as little-endian via cpu_to_le16() so the __counted_by_le() variant must be used: struct brcmf_mf_params_le *mf_params; ... mf_params_len = offsetof(struct brcmf_mf_params_le, data) + (len - DOT11_MGMT_HDR_LEN); mf_params = kzalloc(mf_params_len, GFP_KERNEL); ... mf_params->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN); Fixes: 66f909308a7c ("wifi: brcmfmac: cyw: support external SAE authentication in station mode") Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Acked-by: Arend van Spriel > Link: https://patch.msgid.link/20250721181810.work.575-kees@kernel.org Signed-off-by: Johannes Berg commit 8185696483dcb29688fc23c45c99d86b73754982 Author: Lorenzo Stoakes Date: Tue Jul 22 18:59:01 2025 +0100 MAINTAINERS: add missing files to slab section The failslab implementation implements fault injection for slab allocations so seems best suited to the slab section. The mempool implementation uses slab in the backend, so that seems best suited here also. Signed-off-by: Lorenzo Stoakes Signed-off-by: Vlastimil Babka commit 05e35bd07d56780f0a5119973995b97a16843579 Author: Kamal Wadhwa Date: Wed Jul 16 20:57:58 2025 +0530 pmdomain: qcom: rpmhpd: Add Glymur RPMh Power Domains Add RPMh Power Domains support for the Glymur platform. Signed-off-by: Kamal Wadhwa Signed-off-by: Pankaj Patil Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250716152758.4079467-3-pankaj.patil@oss.qualcomm.com Signed-off-by: Ulf Hansson commit de674441a2898842fb01e4312757eb3e16e7e68e Merge: a876a3aacc434e 0847a4039120a0 Author: Ulf Hansson Date: Wed Jul 23 12:10:42 2025 +0200 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the DT bindings to be tested together with changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit 0847a4039120a01e1db23c75a96f8cf8ec380fe0 Author: Kamal Wadhwa Date: Wed Jul 16 20:57:57 2025 +0530 dt-bindings: power: rpmpd: Add Glymur power domains Add the compatibles for the rpmpd power domains on glymur boards Signed-off-by: Kamal Wadhwa Signed-off-by: Pankaj Patil Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250716152758.4079467-2-pankaj.patil@oss.qualcomm.com Signed-off-by: Ulf Hansson commit ffc137c5c195a7c2a0f3bdefd9bafa639ba5a430 Author: Joel Granados Date: Tue Jul 1 10:39:27 2025 +0200 docs: Downgrade arm64 & riscv from titles to comment Remove the title string ("====") from under arm64 & riscv and move them to a commment under the perf_user_access sysctl. They are explanations, *not* sysctls themselves This effectively removes these two strings from appearing as not implemented when the check-sysctl-docs script is run Signed-off-by: Joel Granados commit 999aab7f5645f8e5daf1a102a4c4e79275555cf8 Author: Joel Granados Date: Tue Jul 1 10:19:09 2025 +0200 docs: Replace spaces with tabs in check-sysctl-docs Remove the combination of spaces and tabs in favor of just tabs. Signed-off-by: Joel Granados commit 30ec9fde45b553467982382e7cd00bcca94bdba5 Author: Joel Granados Date: Tue Jul 1 10:07:46 2025 +0200 docs: Remove colon from ctltable title in vm.rst Removing them solves an issue where they were incorrectly considered as not implemented by the check-sysctl-docs script Signed-off-by: Joel Granados commit e97a96baa527d8ce51db483d44599dff9ec62af0 Author: Joel Granados Date: Tue Jul 1 10:07:04 2025 +0200 docs: Add awk section for ucount sysctl entries Adjust the sysctl table detection to include the macro pattern used for the ucount ctl_tables. This prevents falsly assigning them as non-documented ctl_tables Signed-off-by: Joel Granados commit be0aef10dca87a644affb087f01728386c19903a Author: Joel Granados Date: Tue Jul 1 09:55:39 2025 +0200 docs: Use skiplist when checking sysctl admin-guide Use a skiplist to "skip" the titles in the guide documentation (Documentation/admin-guide/sysctl/*) that are not sysctls. This will give a more accurate account of what sysctl are miss-documented. Signed-off-by: Joel Granados commit 89b491bcf2d19516dd19b1f7a8872394a58b591b Author: Joel Granados Date: Tue Jul 1 09:51:57 2025 +0200 docs: nixify check-sysctl-docs Use "#!/usr/bin/env -S gawk -f" instead of "#!/bin/gawk". Needed for testing in nix environments as they only provide /usr/bin/env at the standard location. Signed-off-by: Joel Granados commit 73184c8e4ff447b866dac13fc4f1a4079c78a69d Author: Joel Granados Date: Fri Jun 27 10:12:40 2025 +0200 sysctl: rename kern_table -> sysctl_subsys_table Renamed sysctl table from kern_table to sysctl_subsys_table and grouped the two arch specific ctls to the end of the array. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Signed-off-by: Joel Granados commit 25ebbce1f188aa2d3e83fcfcf24da8610362564b Author: Joel Granados Date: Fri Jun 27 10:00:51 2025 +0200 kernel/sys.c: Move overflow{uid,gid} sysctl into kernel/sys.c Moved ctl_tables elements for overflowuid and overflowgid into in kernel/sys.c. Create a register function that keeps them under "kernel" and run it after core with postcore_initcall. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Signed-off-by: Joel Granados commit 88eddb0502d45680efef870ea470a9e8955c5c8b Author: Joel Granados Date: Fri Jun 27 09:29:56 2025 +0200 uevent: mv uevent_helper into kobject_uevent.c Move both uevent_helper table into lib/kobject_uevent.c. Place the registration early in the initcall order with postcore_initcall. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Signed-off-by: Joel Granados commit 39dac316f09ae5a0930878d2cae8aea113648b5a Author: Joel Granados Date: Fri Jun 27 09:00:05 2025 +0200 sysctl: Removed unused variable Remove unaligned_dump_stack from sysctl.h; it is no longer used or defined. Signed-off-by: Joel Granados commit 02b072fd9fe1c5e16b7ae8da2f4ae31c8ef6f6a3 Author: Joel Granados Date: Thu Jun 26 14:48:08 2025 +0200 sysctl: Nixify sysctl.sh Use "#!/usr/bin/env bash" instead of "#!/bin/bash". Needed for testing in nix environments as they only provide /usr/bin/env at the standard location. Signed-off-by: Joel Granados commit 4d693c47a025ee3d3bb1de72c522cf2aa560ce7a Author: Matthew Wilcox (Oracle) Date: Wed Jun 11 16:59:14 2025 +0100 slab: Update MAINTAINERS entry Add the two Documentation files to the maintainers entry. Simplify the match for header files now that there is only slab.h. Move Vlastimil to the top of the list of maintainers since he's the one doing the pull requests. Change David & Christoph's roles to Reviewer. Expand the pattern for files in mm/ so that somebody searching for 'slub' will find it. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Harry Yoo Acked-by: David Rientjes Link: https://patch.msgid.link/20250611155916.2579160-12-willy@infradead.org Signed-off-by: Vlastimil Babka commit 7f770e94d7936e8e35d4b4d5fa4618301b03ea33 Author: Matthew Wilcox (Oracle) Date: Wed Jun 11 16:59:13 2025 +0100 memcg_slabinfo: Fix use of PG_slab Check PGTY_slab instead of PG_slab. Fixes: 4ffca5a96678 (mm: support only one page_type per page) Signed-off-by: Matthew Wilcox (Oracle) Tested-by: Roman Gushchin Reviewed-by: Roman Gushchin Reviewed-by: Harry Yoo Link: https://patch.msgid.link/20250611155916.2579160-11-willy@infradead.org Signed-off-by: Vlastimil Babka commit 97189f84a1b3c80dfbba22521df7098ed51fdb4f Author: Matthew Wilcox (Oracle) Date: Wed Jun 11 16:59:12 2025 +0100 kfence: Remove mention of PG_slab Improve the documentation slightly, assuming I understood it correctly. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Harry Yoo Link: https://patch.msgid.link/20250611155916.2579160-10-willy@infradead.org Signed-off-by: Vlastimil Babka commit 6519dba9af439722b3fd938dec939792cc0ecf8e Author: Joel Granados Date: Mon May 5 10:53:28 2025 +0200 sysctl: Remove superfluous includes from kernel/sysctl.c Remove the following headers from the include list in sysctl.c. * These are removed as the related variables are no longer there. =================== ==================== Include Related Var =================== ==================== linux/kmod.h usermodehelper asm/nmi.h nmi_watchdoc_enabled asm/io.h io_delay_type linux/pid.h pid_max_{,min,max} linux/sched/sysctl.h sysctl_{sched_*,numa_*,timer_*} linux/mount.h sysctl_mount_max linux/reboot.h poweroff_cmd linux/ratelimit.h {,printk_}ratelimit_state linux/printk.h kptr_restrict linux/security.h CONFIG_SECURITY_CAPABILITIES linux/net.h net_table linux/key.h key_sysctls linux/nvs_fs.h acpi_video_flags linux/acpi.h acpi_video_flags linux/fs.h proc_nr_files * These are no longer needed as intermediate includes ============== Include ============== linux/filter.h linux/binfmts.h Reviewed-by: Kees Cook Reviewed-by: Luis Chamberlain Signed-off-by: Joel Granados commit ad0800b1d49ade38bd25409c9d66da0446977c87 Author: Joel Granados Date: Mon May 5 13:42:27 2025 +0200 sysctl: Remove (very) old file changelog These comments are older than 2003 and therefore do not bare any relevance on the current state of the sysctl.c file. Remove them as they confuse more than clarify. Reviewed-by: Luis Chamberlain Reviewed-by: Kees Cook Signed-off-by: Joel Granados commit 5a477e934152d0b32201000444d7a5e8358c9480 Author: Joel Granados Date: Thu May 8 21:35:27 2025 +0200 sysctl: Move sysctl_panic_on_stackoverflow to kernel/panic.c This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Reviewed-by: Kees Cook Signed-off-by: Joel Granados commit e054bcbe7e7af2baad3752f1a4916a7fffc0457e Author: Joel Granados Date: Mon May 5 21:47:47 2025 +0200 sysctl: move cad_pid into kernel/pid.c Move cad_pid as well as supporting function proc_do_cad_pid into kernel/pic.c. Replaced call to __do_proc_dointvec with proc_dointvec inside proc_do_cad_pid which requires the copy of the ctl_table to handle the temp value. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Reviewed-by: Luis Chamberlain Reviewed-by: Kees Cook Signed-off-by: Joel Granados commit 942b296a6c35da6593eeeb126dce71d4e506f314 Author: Joel Granados Date: Mon May 5 21:20:07 2025 +0200 sysctl: Move tainted ctl_table into kernel/panic.c Move the ctl_table with the "tainted" proc_name into kernel/panic.c. With it moves the proc_tainted helper function. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Reviewed-by: Luis Chamberlain Reviewed-by: Kees Cook Signed-off-by: Joel Granados commit 79ac8df97408b97175c01b6bff5ce0a97f35b439 Author: Joel Granados Date: Fri May 2 22:47:06 2025 +0200 Input: sysrq: mv sysrq into drivers/tty/sysrq.c Move both sysrq ctl_table and supported sysrq_sysctl_handler helper function into drivers/tty/sysrq.c. Replaced the __do_proc_dointvec in helper function with do_proc_dointvec_minmax as the former is local to kernel/sysctl.c. Here we use the minmax version of do_proc_dointvec because do_proc_dointvec is static and calling do_proc_dointvec_minmax with a NULL min and max is the same as calling do_proc_dointvec. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Reviewed-by: Kees Cook Acked-by: Greg Kroah-Hartman Signed-off-by: Joel Granados commit 8e5f04b0d58c734c69a0b6e26317561919299638 Author: Joel Granados Date: Fri May 2 22:27:38 2025 +0200 fork: mv threads-max into kernel/fork.c make sysctl_max_threads static as it no longer needs to be exported into sysctl.c. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Reviewed-by: Luis Chamberlain Reviewed-by: Kees Cook Signed-off-by: Joel Granados commit 9e2f403dd8c2b07aff012e72c1fe5455538d72d2 Author: Joel Granados Date: Fri May 2 15:32:17 2025 +0200 parisc/power: Move soft-power into power.c Move the soft-power ctl table into parisc/power.c. As a consequence the pwrsw_enabled var is made static. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Reviewed-by: Luis Chamberlain Reviewed-by: Kees Cook Signed-off-by: Joel Granados commit 851911aa7210ca27f007bd79553172e2e3ba8723 Author: Joel Granados Date: Wed Apr 30 14:42:13 2025 +0200 mm: move randomize_va_space into memory.c Move the randomize_va_space variable together with all its sysctl table elements into memory.c. Register it to the "kernel" directory by adding it to the subsys initialization calls This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Reviewed-by: Luis Chamberlain Reviewed-by: Kees Cook Signed-off-by: Joel Granados commit fff6703fc843569d7a2f78ca08e7a69a9be22b0f Author: Joel Granados Date: Wed Apr 30 14:07:33 2025 +0200 rcu: Move rcu_stall related sysctls into rcu/tree_stall.h Move sysctl_panic_on_rcu_stall and sysctl_max_rcu_stall_to_panic into the kernel/rcu subdirectory. Make these static in tree_stall.h and removed them as extern from panic.h as their scope is now confined into one file. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Reviewed-by: Luis Chamberlain Reviewed-by: Joel Fernandes Reviewed-by: Kees Cook Signed-off-by: Joel Granados commit f1b4f23a52c272f6c1e205e8ec243f563323c5aa Author: Joel Granados Date: Tue Apr 29 15:12:17 2025 +0200 locking/rtmutex: Move max_lock_depth into rtmutex.c Move the max_lock_depth sysctl table element into rtmutex_api.c. Removed the rtmutex.h include from sysctl.c. Chose to move into rtmutex_api.c to avoid multiple registrations every time rtmutex.c is included in other files. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Signed-off-by: Joel Granados commit d0d05f602c1504fb868ed4a560d1465d88a3c5e5 Author: Joel Granados Date: Tue Apr 29 14:30:00 2025 +0200 module: Move modprobe_path and modules_disabled ctl_tables into the module subsys Move module sysctl (modprobe_path and modules_disabled) out of sysctl.c and into the modules subsystem. Make modules_disabled static as it no longer needs to be exported. Remove module.h from the includes in sysctl as it no longer uses any module exported variables. This is part of a greater effort to move ctl tables into their respective subsystems which will reduce the merge conflicts in kernel/sysctl.c. Reviewed-by: Luis Chamberlain Reviewed-by: Petr Pavlu Signed-off-by: Joel Granados commit 4903924ac7ef31fbbe48b3261b1bc86ce6cd7e97 Author: Fabio Estevam Date: Thu Jul 3 11:46:44 2025 -0300 dt-bindings: leds: ncp5623: Add 0x39 as a valid I2C address The NCP5623C variant has the I2C address at 0x39 according its datasheet: https://www.mouser.com/datasheet/2/308/NCP5623C-D-64591.pdf Make 0x39 a valid I2C address in the dt-binding. Signed-off-by: Fabio Estevam Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250703144644.2878253-1-festevam@gmail.com Signed-off-by: Lee Jones commit ff4322b22f35c010643de16c6f13e285bf314d83 Author: Yang Li Date: Wed Jul 23 14:46:08 2025 +0800 gpio: cadence: Remove duplicated include in gpio-cadence.c The header files linux/gpio/driver.h is included twice in gpio-cadence.c, so one inclusion of each can be removed. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=22931 Signed-off-by: Yang Li Link: https://lore.kernel.org/r/20250723064608.2178024-1-yang.lee@linux.alibaba.com Signed-off-by: Bartosz Golaszewski commit 60c9a34df2d83dee2e6ec7e47c2310293c98f7e4 Author: Konstantin Taranov Date: Tue Jul 22 01:55:15 2025 -0700 RDMA/mana_ib: add support of multiple ports If the HW indicates support of multiple ports for rdma, create an IB device with a port per netdev in the ethernet mana driver. CM is only available on port 1, but RC QPs are supported on all ports. Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/1753174515-23634-1-git-send-email-kotaranov@linux.microsoft.com Signed-off-by: Leon Romanovsky commit 1b6ab07c0c800ed32ce417b71b32bb1baa91b493 Author: Shree Ramamoorthy Date: Tue Jul 22 13:16:09 2025 -0500 gpio: tps65219: Add support for TI TPS65214 PMIC Add support for the TI TPS65214 PMIC with the addition of an id_table, separate TPS65214 template_chip, and device-specific _change_direction functions. - Use platform_get_device_id() to assign dev-specific information. - Use different change_direction() functions since TPS65214's GPIO configuration bits are changeable during device operation through bit GPIO_CONFIG in GENERAL_CONFIG register. - Remove MODULE_ALIAS since it is now generated by MODULE_DEVICE_TABLE. Reviewed-by: Jonathan Cormier Tested-by: Jonathan Cormier Signed-off-by: Shree Ramamoorthy Link: https://lore.kernel.org/r/20250722181609.1541739-3-s-ramamoorthy@ti.com Signed-off-by: Bartosz Golaszewski commit 8206650c604687687bed5898b3bdb90e5d361ed4 Author: Shree Ramamoorthy Date: Tue Jul 22 13:16:08 2025 -0500 gpio: tps65219: Update _IDX & _OFFSET macro prefix TPS65215 and TPS65219 are overlapping PMIC devices. While their regulator features differe, the GPIO features are the same. In the TPS65219 MFD driver, the 2 PMICs share the same "tps65219-gpio" compatible string to limit support for TPS65215 in this GPIO driver to comments. The TPS6521X_GPIO0_IDX and TPS6521X_GPIO0_OFFSET macro name prefixes are updated to indicate these macros apply to both PMICs. Reviewed-by: Roger Quadros Acked-by: Linus Walleij Reviewed-by: Jonathan Cormier Signed-off-by: Shree Ramamoorthy Link: https://lore.kernel.org/r/20250722181609.1541739-2-s-ramamoorthy@ti.com Signed-off-by: Bartosz Golaszewski commit 10d4de4189533840f296ce7e48eac05b985d96bc Author: Patrisious Haddad Date: Sun Jul 20 12:37:24 2025 +0300 RDMA/mlx5: Refactor optional counters steering code Currently there isn't a clear layer separation between the counters and the steering code, whereas the steering code is doing redundant access to the counter struct. Separate the fs.c and counters.c, where fs code won't access or be aware of counter structs but only the objects it needs. As a result, move mlx5_rdma_counter struct from the header file to be an internal struct for the counters file only. Signed-off-by: Patrisious Haddad Reviewed-by: Edward Srouji Link: https://patch.msgid.link/9854d1fdb140e4a6552b7a2fd1a028cfe488a935.1753004208.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 9872916ad1a1a5e7d089e05166c85dbd65e5b0e8 Author: Marco Elver Date: Tue Jul 22 20:19:17 2025 +0200 kcsan: test: Initialize dummy variable Newer compiler versions rightfully point out: kernel/kcsan/kcsan_test.c:591:41: error: variable 'dummy' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 591 | KCSAN_EXPECT_READ_BARRIER(atomic_read(&dummy), false); | ^~~~~ 1 error generated. Although this particular test does not care about the value stored in the dummy atomic variable, let's silence the warning. Link: https://lkml.kernel.org/r/CA+G9fYu8JY=k-r0hnBRSkQQrFJ1Bz+ShdXNwC1TNeMt0eXaxeA@mail.gmail.com Fixes: 8bc32b348178 ("kcsan: test: Add test cases for memory barrier instrumentation") Reported-by: Linux Kernel Functional Testing Reviewed-by: Alexander Potapenko Signed-off-by: Marco Elver commit 8c1f5a11dad0a9043c17c4c0240f394e481baca6 Merge: d2755d3cf8578b 7cdb433bb44cdc Author: Arnd Bergmann Date: Wed Jul 23 07:51:03 2025 +0200 Merge tag 'v6.17-rockchip-arm32-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/arm Fix for seldom hangs when bringing up arm32 cpu cores. * tag 'v6.17-rockchip-arm32-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: ARM: rockchip: fix kernel hang during smp initialization Link: https://lore.kernel.org/r/12434765.CDJkKcVGEf@phil Signed-off-by: Arnd Bergmann commit e1bed9a94da86a7c01b985c2e9a030207269cbc7 Author: Yishai Hadas Date: Thu Jul 17 15:17:32 2025 +0300 RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr As part of this enhancement, allow the creation of an MKEY associated with a DMA handle. Additional notes: MKEYs with TPH (i.e. TLP Processing Hints) attributes are currently not UMR-capable unless explicitly enabled by firmware or hardware. Therefore, to maintain such MKEYs in the MR cache, the TPH fields have been added to the rb_key structure, with a dedicated hash bucket. The ability to bypass the kernel verbs flow and create an MKEY with TPH attributes using DEVX has been restricted. TPH must follow the standard InfiniBand flow, where a DMAH is created with the appropriate security checks and management mechanisms in place. DMA handles are currently not supported in conjunction with On-Demand Paging (ODP). Re-registration of memory regions originally created with TPH attributes is currently not supported. Signed-off-by: Yishai Hadas Reviewed-by: Edward Srouji Link: https://patch.msgid.link/1c485651cf8417694ddebb80446c5093d5a791a9.1752752567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit a272019a46c918575f10cc529c893585d46b3b55 Author: Yishai Hadas Date: Thu Jul 17 15:17:31 2025 +0300 IB: Extend UVERBS_METHOD_REG_MR to get DMAH Extend UVERBS_METHOD_REG_MR to get DMAH and pass it to all drivers. It will be used in mlx5 driver as part of the next patch from the series. Signed-off-by: Yishai Hadas Reviewed-by: Edward Srouji Link: https://patch.msgid.link/2ae1e628c0675db81f092cc00d3ad6fbf6139405.1752752567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 3c819070754c3e81ad7be07e77fad83a658022f7 Author: Yishai Hadas Date: Thu Jul 17 15:17:30 2025 +0300 RDMA/mlx5: Add DMAH object support This patch introduces support for allocating and deallocating the DMAH object. Further details: ---------------- The DMAH API is exposed to upper layers only if the underlying device supports TPH. It uses the mlx5_core steering tag (ST) APIs to get a steering tag index based on the provided input. The obtained index is stored in the device-specific mlx5_dmah structure for future use. Upcoming patches in the series will integrate the allocated DMAH into the memory region (MR) registration process. Signed-off-by: Yishai Hadas Reviewed-by: Edward Srouji Link: https://patch.msgid.link/778550776799d82edb4d05da249a1cff00160b50.1752752567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit d83edab562a496a42720902a1d2effccd05c37c5 Author: Yishai Hadas Date: Thu Jul 17 15:17:29 2025 +0300 RDMA/core: Introduce a DMAH object and its alloc/free APIs Introduce a new DMA handle (DMAH) object along with its corresponding allocation and deallocation APIs. This DMAH object encapsulates attributes intended for use in DMA transactions. While its initial purpose is to support TPH functionality, it is designed to be extensible for future features such as DMA PCI multipath, PCI UIO configurations, PCI traffic class selection, and more. Further details: ---------------- We ensure that a caller requesting a DMA handle for a specific CPU ID is permitted to be scheduled on it. This prevent a potential security issue where a non privilege user may trigger DMA operations toward a CPU that it's not allowed to run on. We manage reference counting for the DMAH object and its consumers (e.g., memory regions) as will be detailed in subsequent patches in the series. Signed-off-by: Yishai Hadas Reviewed-by: Edward Srouji Link: https://patch.msgid.link/2cad097e849597e49d6b61e6865dba878257f371.1752752567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 5b2e45049dc06a876bc6b138218ddeb0814502ef Author: Yishai Hadas Date: Thu Jul 17 15:17:28 2025 +0300 IB/core: Add UVERBS_METHOD_REG_MR on the MR object This new method enables us to use a single ioctl from user space which supports the below variants of reg_mr [1]. The method will be extended in the next patches from the series with an extra attribute to let us pass DMA handle to be used as part of the registration. [1] ibv_reg_mr(), ibv_reg_mr_iova(), ibv_reg_mr_iova2(), ibv_reg_dmabuf_mr(). Signed-off-by: Yishai Hadas Reviewed-by: Edward Srouji Link: https://patch.msgid.link/5a3822ceef084efe967c9752e89c58d8250337c7.1752752567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit b272fc897297de2e618883d2cd212cac556a9e53 Merge: b83440736864ad 888a7776f4fb04 Author: Leon Romanovsky Date: Wed Jul 23 01:38:56 2025 -0400 RDMA support for DMA handle From Yishai: This patch series introduces a new DMA Handle (DMAH) object, along with corresponding APIs for its allocation and deallocation. The DMAH object encapsulates attributes relevant for DMA transactions. While initially intended to support TLP Processing Hints (TPH) [1], the design is extensible to accommodate future features such as PCI multipath for DMA, PCI UIO configurations, traffic class selection, and more. Additionally, we introduce a new ioctl method on the MR object: UVERBS_METHOD_REG_MR. This method consolidates multiple reg_mr variants under a single user-space ioctl interface, supporting: ibv_reg_mr(), ibv_reg_mr_iova(), ibv_reg_mr_iova2() and ibv_reg_dmabuf_mr(). It also enables passing a DMA handle as part of the registration process. Throughout the patch series, the following DMAH-related stuff can also be observed in the IB layer: - Association with a CPU ID and its memory type, for use with Steering Tags [2]. - Inclusion of Processing Hints (PH) data for TPH functionality [3]. - Enforces security by ensuring that only tasks allowed to run on a given CPU may request a DMA handle for it. - Reference counting for DMAH life cycle management and safe usage across memory regions. mlx5 driver implementation: -------------------------- The series includes implementation of the above functionality in the mlx5 driver. In mlx5_core: - Enables TPH over PCIe when both firmware and OS support it. - Manages Steering Tags and corresponding indices by writing tag values to the PCI configuration space. - Exposes APIs to upper layers (e.g., mlx5_ib) to enable the PCIe TPH functionality. In mlx5_ib: - Adds full support for DMAH operations. - Utilizes mlx5_core's Steering Tag APIs to derive tag indices from input. - Stores the resulting index in a mlx5_dmah structure for use during MKEY creation with a DMA handle. - Adds support for allowing MKEYs to be created in conjunction with DMA handles. Additional details are provided in the commit messages. [1] Background, from PCIe specification 6.2. TLP Processing Hints (TPH) -------------------------- TLP Processing Hints is an optional feature that provides hints in Request TLP headers to facilitate optimized processing of Requests that target Memory Space. These Processing Hints enable the system hardware (e.g., the Root Complex and/ or Endpoints) to optimize platform resources such as system and memory interconnect on a per TLP basis. Steering Tags are system-specific values used to identify a processing resource that a Requester explicitly targets. System software discovers and identifies TPH capabilities to determine the Steering Tag allocation for each Function that supports TPH [2] Steering Tags Functions that intend to target a TLP towards a specific processing resource such as a host processor or system cache hierarchy require topological information of the target cache (e.g., which host cache). Steering Tags are system-specific values that provide information about the host or cache structure in the system cache hierarchy. These values are used to associate processing elements within the platform with the processing of Requests. [3] Processing Hints The Requester provides hints to the Root Complex or other targets about the intended use of data and data structures by the host and/or device. The hints are provided by the Requester, which has knowledge of upcoming Request patterns, and which the Completer would not be able to deduce autonomously (with good accuracy) Yishai Signed-off-by: Leon Romanovsky * mlx5-next: net/mlx5: Add support for device steering tag net/mlx5: Expose IFC bits for TPH PCI/TPH: Expose pcie_tph_get_st_table_size() net/mlx5: Expose cable_length field in PFCC register net/mlx5: Add IFC bits and enums for buf_ownership net/mlx5: Add IFC bits to support RSS for IPSec offload net/mlx5: IFC updates for disabled host PF net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc commit 888a7776f4fb04c19bec70c737c61c2f383c6b1e Author: Yishai Hadas Date: Thu Jul 17 15:17:27 2025 +0300 net/mlx5: Add support for device steering tag Background, from PCIe specification 6.2. TLP Processing Hints (TPH) -------------------------- TLP Processing Hints is an optional feature that provides hints in Request TLP headers to facilitate optimized processing of Requests that target Memory Space. These Processing Hints enable the system hardware (e.g., the Root Complex and/or Endpoints) to optimize platform resources such as system and memory interconnect on a per TLP basis. Steering Tags are system-specific values used to identify a processing resource that a Requester explicitly targets. System software discovers and identifies TPH capabilities to determine the Steering Tag allocation for each Function that supports TPH. This patch adds steering tag support for mlx5 based NICs by: - Enabling the TPH functionality over PCI if both FW and OS support it. - Managing steering tags and their matching steering indexes by writing a ST to an ST index over the PCI configuration space. - Exposing APIs to upper layers (e.g.,mlx5_ib) to allow usage of the PCI TPH infrastructure. Further details: - Upon probing of a device, the feature will be enabled based on both capability detection and OS support. - It will retrieve the appropriate ST for a given CPU ID and memory type using the pcie_tph_get_cpu_st() API. - It will track available ST indices according to the configuration space table size (expected to be 63 entries), reserving index 0 to indicate non-TPH use. - It will assign a free ST index with a ST using the pcie_tph_set_st_entry() API. - It will reuse the same index for identical (CPU ID + memory type) combinations by maintaining a reference count per entry. - It will expose APIs to upper layers (e.g., mlx5_ib) to allow usage of the PCI TPH infrastructure. - SF will use its parent PF stuff. Signed-off-by: Yishai Hadas Link: https://patch.msgid.link/de1ae7398e9e34eacd8c10845683df44fc9e32f8.1752752567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 5f9ec7880e6b3c4d0cf242fe28506d0b084328b1 Author: Yishai Hadas Date: Thu Jul 17 15:17:26 2025 +0300 net/mlx5: Expose IFC bits for TPH Expose IFC bits for the TPH functionality. Signed-off-by: Yishai Hadas Reviewed-by: Edward Srouji Reviewed-by: Moshe Shemesh Link: https://patch.msgid.link/38ea3a0d56551364214e8edf359c9c77c9a3b71b.1752752567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 0a61ec9cc51b0e43981222005444508437e95b33 Author: Yishai Hadas Date: Thu Jul 17 15:17:25 2025 +0300 PCI/TPH: Expose pcie_tph_get_st_table_size() Expose pcie_tph_get_st_table_size() to be used by drivers as will be done in the next patch from the series. Signed-off-by: Yishai Hadas Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/9ae851e0ee42cc56d2a30276e116b65091030ceb.1752752567.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 2558df8c13ae3bd6c303b28f240ceb0189519c91 Author: Krzysztof Kozlowski Date: Sun Jul 20 14:30:05 2025 +0200 dt-bindings: display: sprd,sharkl3-dsi-host: Fix missing clocks constraints 'minItems' alone does not impose upper bound, unlike 'maxItems' which implies lower bound. Add missing clock constraint so the list will have exact number of items (clocks). Fixes: 2295bbd35edb ("dt-bindings: display: add Unisoc's mipi dsi controller bindings") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250720123003.37662-4-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit 934da599e694d476f493d3927a30414e98a81561 Author: Krzysztof Kozlowski Date: Sun Jul 20 14:30:04 2025 +0200 dt-bindings: display: sprd,sharkl3-dpu: Fix missing clocks constraints 'minItems' alone does not impose upper bound, unlike 'maxItems' which implies lower bound. Add missing clock constraint so the list will have exact number of items (clocks). Fixes: 8cae15c60cf0 ("dt-bindings: display: add Unisoc's dpu bindings") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250720123003.37662-3-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit 83e6769f80a1b8e1a97f8d1cecd8631b976fc009 Author: Frank Li Date: Mon Jun 16 14:24:38 2025 -0400 dt-bindings: display: imx: convert fsl,dcu.txt to yaml format Convert fsl,dcu.txt to yaml format. Additional changes: - remove label in example. - change node to display-controller in example. - use 32bit address in example. - add interrupts property. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Frank Li Reviewed-by: Stefan Agner Link: https://lore.kernel.org/r/20250616182439.1989840-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit b06d6a1d0cc6d0d44a8175108356016057718081 Author: Alexey Charkov Date: Wed May 21 17:00:09 2025 +0400 dt-bindings: timer: via,vt8500-timer: Convert to YAML Rewrite the textual description for the VIA/WonderMedia timer as YAML schema. The IP can generate up to four interrupts from four respective match registers, so reflect that in the schema. Reviewed-by: Rob Herring (Arm) Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250521-vt8500-timer-updates-v5-1-7e4bd11df72e@gmail.com Signed-off-by: Rob Herring (Arm) commit 2382aedd17d7bd8f4cbf0c50f9298851c00ebf86 Author: Rob Herring (Arm) Date: Wed Jul 2 17:26:24 2025 -0500 dt-bindings: net: Convert Marvell Armada NETA and BM to DT schema Convert Marvell Armada NETA Ethernet Controller and Buffer Manager bindings to schema. It is a straight forward conversion. Link: https://lore.kernel.org/r/20250702222626.2761199-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit 731a4702b668ef28730e7d2414672b7085e757d6 Author: Tomasz Michalec Date: Tue Jul 22 15:28:26 2025 +0200 platform/chrome: cros_ec_typec: Check ec platform device pointer It is possible that parent device for cros_ec_typec device is already available, but ec pointer in parent driver data isn't populated yet. It may happen when cros_typec_probe is running in parallel with cros_ec_register. This leads to NULL pointer dereference when cros_typec_probe tries to get driver data from typec->ec->ec->dev. Check if typec->ec->ec is set before using it in cros_typec_probe. Signed-off-by: Tomasz Michalec Link: https://lore.kernel.org/r/20250722132826.707087-1-tmichalec@google.com Signed-off-by: Tzung-Bi Shih commit e2374953461947eee49f69b3e3204ff080ef31b1 Author: Tzung-Bi Shih Date: Tue Jul 22 12:05:13 2025 +0000 platform/chrome: cros_ec: Unregister notifier in cros_ec_unregister() The blocking notifier is registered in cros_ec_register(); however, it isn't unregistered in cros_ec_unregister(). Fix it. Fixes: 42cd0ab476e2 ("platform/chrome: cros_ec: Query EC protocol version if EC transitions between RO/RW") Cc: stable@vger.kernel.org Reviewed-by: Benson Leung Link: https://lore.kernel.org/r/20250722120513.234031-1-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih commit fe4fd701938197c2bceeeff670da3ace9b488d09 Author: Alexander Sverdlin Date: Thu Jun 12 15:28:14 2025 +0200 arm64: defconfig: Enable rudimentary Sophgo SG2000 support Enable ARCH_SOPHGO, pinctrl (built-in, required to boot), ADC as module. This defconfig is able to boot from SD card on Milk-V Duo Module 01 evalboard. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Inochi Amaoto Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250612132844.767216-7-alexander.sverdlin@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit c6e9e3aaef76294f2dde4fcb4450bad746671c4b Author: Alexander Sverdlin Date: Thu Jun 12 15:28:13 2025 +0200 arm64: Add SOPHGO SOC family Kconfig support First user will be Aarch64 core within SG2000 SoC. Reviewed-by: Chen Wang Reviewed-by: Inochi Amaoto Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250612132844.767216-6-alexander.sverdlin@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit aa3f38f5dc4cc463e620833b71362a805ac169ea Author: Alexander Sverdlin Date: Thu Jun 12 15:28:12 2025 +0200 arm64: dts: sophgo: Add Duo Module 01 Evaluation Board Duo Module 01 Evaluation Board contains Sophgo Duo Module 01 SMD SoM, Ethernet+USB switch, microSD slot, etc... Add only support for UART0 (console) and microSD slot. Signed-off-by: Alexander Sverdlin Reviewed-by: Inochi Amaoto Link: https://lore.kernel.org/r/20250612132844.767216-5-alexander.sverdlin@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit cccac5279a6c06620e59e366563d443cd7201261 Author: Alexander Sverdlin Date: Thu Jun 12 15:28:11 2025 +0200 arm64: dts: sophgo: Add Duo Module 01 The Duo Module 01 is a compact module with integrated SG2000, WI-FI6/BTDM5.4, and eMMC. Add only support for UART and SDHCI. Signed-off-by: Alexander Sverdlin Reviewed-by: Inochi Amaoto Link: https://lore.kernel.org/r/20250612132844.767216-4-alexander.sverdlin@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit dabb6ec640a3512bd105055d5573a2cfa403bdea Author: Alexander Sverdlin Date: Thu Jun 12 15:28:10 2025 +0200 arm64: dts: sophgo: Add initial SG2000 SoC device tree Add initial device tree for the SG2000 SoC by SOPHGO (from ARM64 PoV). Reviewed-by: Inochi Amaoto Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250612132844.767216-3-alexander.sverdlin@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 7f90573099e8a506a6874d691d884d7f5b77ec74 Author: Inochi Amaoto Date: Wed Jul 16 06:13:48 2025 +0800 riscv: dts: sophgo: fix mdio node name for CV180X As the mdio multipledxer is marked as mdio device, the check complains the mdio bus number exceed the maximum. Change the node name to mdio-mux to remove the following warnings: mdio@3009800 (mdio-mux-mmioreg): mdio@80:reg:0:0: 128 is greater than the maximum of 31 Fixes: b7945143bc33 ("riscv: dts: sophgo: Add mdio multiplexer device for cv18xx") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507140738.XRjv3G8i-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202507121830.POx2KDVi-lkp@intel.com/ Reviewed-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250715221349.11034-1-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 46683af1fb70d891d89cb9221b25b92f6b1d5193 Author: Inochi Amaoto Date: Thu Jul 3 08:40:23 2025 +0800 riscv: dts: sophgo: sophgo-srd3-10: reserve uart0 device As the uart0 is already occupied by the firmware, reserve it to avoid this port is used by mistake. Tested-by: Han Gao Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/20250703004024.85221-1-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 6ea2a06165e7c613e2efb9927c3537f76ccdfc1a Author: Han Gao Date: Sat Jul 5 15:39:56 2025 +0800 riscv: dts: sophgo: add Sophgo SG2042_EVB_V2.0 board device tree Sophgo SG2042_EVB_V2.0 [1] is a prototype development board based on SG2042 Currently supports serial port, sdcard/emmc, pwm, fan speed control. Link: https://github.com/sophgo/sophgo-hardware/tree/master/SG2042/SG2042-x4-EVB [1] Signed-off-by: Han Gao Reviewed-by: Nutty Liu Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/c1b6ccdc69af0c1457fc1486a6bc8a1e83671537.1751700954.git.rabenda.cn@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 100513b2e54ab9f889c64e5bf13fca566a8e70ba Author: Han Gao Date: Sat Jul 5 15:39:55 2025 +0800 riscv: dts: sophgo: add Sophgo SG2042_EVB_V1.X board device tree Sophgo SG2042_EVB_V1.X [1] is a prototype development board based on SG2042 Currently supports serial port, sdcard/emmc, pwm, fan speed control. Link: https://github.com/sophgo/sophgo-hardware/tree/master/SG2042/SG2042-x8-EVB [1] Signed-off-by: Han Gao Reviewed-by: Nutty Liu Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/27091134ce1f8a6541a349afc324d6f7402ea606.1751700954.git.rabenda.cn@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit e8dd24de123472595c9b5fe6258599d8290d75ce Author: Han Gao Date: Sat Jul 5 15:39:54 2025 +0800 dt-bindings: riscv: add Sophgo SG2042_EVB_V1.X/V2.0 bindings Add DT binding documentation for the Sophgo SG2042_EVB_V1.X/V2.0 board [1]. Link: https://github.com/sophgo/sophgo-hardware/tree/master/SG2042/SG2042-x8-EVB [1] Acked-by: Conor Dooley Signed-off-by: Han Gao Reviewed-by: Nutty Liu Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/204c8214aa084d592e8dc45d6c5ca23381937b54.1751700954.git.rabenda.cn@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 39539df543650dbaa570646e90f526fb55f79699 Author: Inochi Amaoto Date: Tue Jul 8 14:46:25 2025 +0800 riscv: dts: sophgo: add ethernet GMAC device for sg2042 Add ethernet GMAC device node for the sg2042. Tested-by: Han Gao Link: https://lore.kernel.org/r/20250708064627.509363-1-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit a9b547cefb0f4d8730cd66d92ba76dae723fae51 Author: Inochi Amaoto Date: Thu Jul 3 10:15:58 2025 +0800 riscv: dts: sophgo: Enable ethernet device for Huashan Pi Enable ethernet controller and mdio multiplexer device on Huashan Pi. Link: https://lore.kernel.org/r/20250703021600.125550-4-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit ba1abacc57cb7c1bdc249d3d61ec75fbe3e598f2 Author: Inochi Amaoto Date: Thu Jul 3 10:15:57 2025 +0800 riscv: dts: sophgo: Add mdio multiplexer device for cv18xx Add DT device node of mdio multiplexer device for cv18xx SoC. Link: https://lore.kernel.org/r/20250703021600.125550-3-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 109b3d7b888cf3685b06c19fa7241fb2da280db8 Author: Inochi Amaoto Date: Thu Jul 3 10:15:56 2025 +0800 riscv: dts: sophgo: Add ethernet device for cv18xx Add ethernet controller device node for cv18xx SoC. Link: https://lore.kernel.org/r/20250703021600.125550-2-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 3f859e838285f8b6c90239e5d5c19fa7ad4de8af Author: Inochi Amaoto Date: Thu Jul 3 08:38:43 2025 +0800 riscv: dts: sophgo: sg2044: add pmu configuration Add PMU configuration for the cpu of sg2044, which is the V2 version of C920. Reviewed-by: Chen Wang Tested-by: Han Gao Link: https://lore.kernel.org/r/20250703003844.84617-1-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit a1de92f0cd4118652ec94a6c3be62d7571029a9b Author: Han Gao Date: Mon Jul 7 11:15:18 2025 +0800 riscv: dts: sophgo: sg2044: add ziccrse extension sg2044 support ziccrse extension. Signed-off-by: Han Gao Reviewed-by: Chen Wang Reviewed-by: Nutty Liu Link: https://lore.kernel.org/r/0889174f2e013e095b94940614f4a0a6e614b09c.1751858054.git.rabenda.cn@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit cb074bed1186984f128e3719ee54ca529aba1b56 Author: Han Gao Date: Sat Jul 5 15:00:14 2025 +0800 riscv: dts: sophgo: add zfh for sg2042 sg2042 support Zfh ISA extension [1]. Link: https://occ-oss-prod.oss-cn-hangzhou.aliyuncs.com/resource//1737721869472/%E7%8E%84%E9%93%81C910%E4%B8%8EC920R1S6%E7%94%A8%E6%88%B7%E6%89%8B%E5%86%8C%28xrvm%29_20250124.pdf [1] Signed-off-by: Han Gao Reviewed-by: Inochi Amaoto Reviewed-by: Nutty Liu Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/bcaf5684c614959f49a9770bf3cd41096cee5fe6.1751698574.git.rabenda.cn@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 6ebff712f4b4be64a80b405fd263c11f522069ab Author: Han Gao Date: Sat Jul 5 15:00:13 2025 +0800 riscv: dts: sophgo: add ziccrse for sg2042 sg2042 support Ziccrse ISA extension [1]. Link: https://lore.kernel.org/all/20241103145153.105097-12-alexghiti@rivosinc.com/ [1] Signed-off-by: Han Gao Reviewed-by: Inochi Amaoto Reviewed-by: Nutty Liu Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/859df9a05e1693fec9bd2c7dcf14415bb15230bd.1751698574.git.rabenda.cn@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit a5fb9056f26011f24525f0083b9c1ad300413269 Author: Han Gao Date: Sat Jul 5 15:00:12 2025 +0800 riscv: dts: sophgo: Add xtheadvector to the sg2042 devicetree The sg2042 SoCs support xtheadvector [1] so it can be included in the devicetree. Also include vlenb for the cpu. And set vlenb=16 [2]. This can be tested by passing the "mitigations=off" kernel parameter. Link: https://lore.kernel.org/linux-riscv/20241113-xtheadvector-v11-4-236c22791ef9@rivosinc.com/ [1] Link: https://lore.kernel.org/linux-riscv/aCO44SAoS2kIP61r@ghost/ [2] Signed-off-by: Han Gao Reviewed-by: Inochi Amaoto Reviewed-by: Nutty Liu Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/915bef0530dee6c8bc0ae473837a4bd6786fa4fb.1751698574.git.rabenda.cn@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 3309df45e6b5f1c1a9e91019054b7662d56ef31a Author: Inochi Amaoto Date: Wed Jun 18 09:58:49 2025 +0800 riscv: dts: sophgo: sg2044: add PCIe device support for SG2044 Add PCIe device node for SG2044 and configuration for Sophgo SRD3-10. Link: https://lore.kernel.org/r/20250618015851.272188-3-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 7cc925594c10e18a6d99688aa008a8bc8b1e25d7 Author: Inochi Amaoto Date: Wed Jun 18 09:58:48 2025 +0800 riscv: dts: sophgo: sg2044: add MSI device support for SG2044 Add MSI device tree node for SG2044. Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/20250618015851.272188-2-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 817c89a6b5c0df6e018857e1e540d86d38779d24 Author: Inochi Amaoto Date: Tue Jun 17 15:01:42 2025 +0800 riscv: dts: sophgo: add reset configuration for Sophgo CV1800 series SoC Add known reset configuration for existed device. Reviewed-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250617070144.1149926-5-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit f5742f67a47cc1bd44368706d41bb2657f8e487d Author: Inochi Amaoto Date: Tue Jun 17 15:01:41 2025 +0800 riscv: dts: sophgo: add reset generator for Sophgo CV1800 series SoC Add reset generator node for all CV18XX series SoC. Reviewed-by: Alexander Sverdlin Tested-by: Junhui Liu Tested-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250617070144.1149926-4-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 610f943a66bee95101f329d8a8e9a4a82123a66c Author: Alexander Sverdlin Date: Thu Jun 12 15:28:09 2025 +0200 dt-bindings: soc: sophgo: Move SoCs/boards from riscv into soc, add SG2000 Move sophgo.yaml from riscv into soc/sophgo so that it can be shared for all SoCs containing ARM cores as well. This already applies to SG2002. Add SG2000 SoC, Milk-V Duo Module 01 and Milk-V Module 01 EVB. Reviewed-by: Chen Wang Reviewed-by: Inochi Amaoto Acked-by: Conor Dooley Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250612132844.767216-2-alexander.sverdlin@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 02d548e553d161813b7d3702a311b9067806057d Author: Inochi Amaoto Date: Fri Jun 13 15:45:12 2025 +0800 riscv: dts: sophgo: sg2044: Add missing riscv,cbop-block-size property The kernel complains no "riscv,cbop-block-size" and disables the Zicbop extension. Add the missing property to keep it functional. Fixes: ae5bac370ed4 ("riscv: dts: sophgo: Add initial device tree of Sophgo SRD3-10") Link: https://lore.kernel.org/r/20250613074513.1683624-1-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit ff9089739784a9766487672b98c8c2caa9aa659b Author: Longbin Li Date: Mon Jun 9 07:28:35 2025 +0800 riscv: dts: sophgo: add pwm controller for SG2044 Add pwm device node for SG2044. Signed-off-by: Longbin Li Reviewed-by: Chen Wang Link: https://lore.kernel.org/r/20250608232836.784737-12-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 162b265ce05ec02e0909ef5e1de6483f1e1c78f4 Author: Longbin Li Date: Mon Jun 9 07:28:34 2025 +0800 riscv: dts: sophgo: add SG2044 SPI NOR controller driver Add SPI NOR device node for SG2044. Signed-off-by: Longbin Li Link: https://lore.kernel.org/r/20250608232836.784737-11-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit c20e152a08681e6bb5dfefed9acc768ecc859c41 Author: Inochi Amaoto Date: Mon Jun 9 07:28:33 2025 +0800 riscv: dts: sophgo: sg2044: Add pinctrl device Add pinctrl DT node and configuration for SG2044. Link: https://lore.kernel.org/r/20250608232836.784737-10-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 2c7ef3dc129f5c6697101cfe75cdcdc3afb4d672 Author: Inochi Amaoto Date: Mon Jun 9 07:28:32 2025 +0800 riscv: dts: sophgo: sg2044: Add ethernet control device Add ethernet control node for sg2044. Link: https://lore.kernel.org/r/20250608232836.784737-9-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 2b09dad74e5ab2e20772a9a7293c40ea64bcd936 Author: Inochi Amaoto Date: Mon Jun 9 07:28:31 2025 +0800 riscv: dts: sophgo: sophgo-srd3-10: add HWMON MCU device Add MCU devicetree node for Sophgo SRD3-10 board. This is used to provide SUSP function for the board. Link: https://lore.kernel.org/r/20250608232836.784737-8-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit ddaa0b550022fd56167a592e23b9aa0b737753f5 Author: Inochi Amaoto Date: Mon Jun 9 07:28:30 2025 +0800 riscv: dts: sophgo: sg2044: Add MMC controller device Add emmc controller and sd controller DT node for SG2044. Link: https://lore.kernel.org/r/20250608232836.784737-7-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit f88aa1f14c6bccd9a498f842ed16155fe3279b23 Author: Inochi Amaoto Date: Mon Jun 9 07:28:29 2025 +0800 riscv: dts: sophgo: sg2044: add DMA controller device The DMA controller of SG2044 is a standard Synopsys IP, which is already supported by the kernel. Add DMA controller DT node for SG2044. Link: https://lore.kernel.org/r/20250608232836.784737-6-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 11350d2f88641c9108b82f64a4d57556a0429b67 Author: Inochi Amaoto Date: Mon Jun 9 07:28:28 2025 +0800 riscv: dts: sophgo: sg2044: Add I2C device The I2C controller of SG2044 is a standard Synopsys IP, with one the ref clock is need. Add I2C DT node for SG2044 SoC. Link: https://lore.kernel.org/r/20250608232836.784737-5-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit cfb8869685caf80b16c2ec77a85f9093dddc9ac6 Author: Inochi Amaoto Date: Mon Jun 9 07:28:27 2025 +0800 riscv: dts: sophgo: sg2044: Add GPIO device The GPIO controller is a standard Synopsys IP, which is already supported by the kernel. Add GPIO DT node for SG2044 SoC. Link: https://lore.kernel.org/r/20250608232836.784737-4-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 1995b2644fd9534058c4e4d3e7e44588ca663daf Author: Inochi Amaoto Date: Mon Jun 9 07:28:26 2025 +0800 riscv: dts: sophgo: sg2044: Add clock controller device Add clock controller and pll clock node for sg2044. Link: https://lore.kernel.org/r/20250608232836.784737-3-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 95f119e36443b0028d78986f01f382024c811ddb Author: Inochi Amaoto Date: Mon Jun 9 07:28:25 2025 +0800 riscv: dts: sophgo: sg2044: Add system controller device The TOP system controller device is necessary for the SG2044 clock controller. Add it to the SoC device tree. Link: https://lore.kernel.org/r/20250608232836.784737-2-inochiama@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 616c84f0473b1292a232b979c5a441de3039bb88 Author: Alexander Sverdlin Date: Tue May 13 22:31:25 2025 +0200 riscv: dts: sophgo: cv18xx: Add RTCSYS device node Add the RTCSYS MFD node: in Cvitek CV18xx and its successors RTC Subsystem is quite advanced and provides SoC power management functions as well. The SoC family also contains DW8051 block (Intel 8051 compatible CPU core) and an associated SRAM. The corresponding control registers are mapped into RTCSYS address space as well. Link: https://github.com/sophgo/sophgo-doc/tree/main/SG200X/TRM Signed-off-by: Alexander Sverdlin Reviewed-by: Inochi Amaoto Link: https://lore.kernel.org/r/20250513203128.620731-1-alexander.sverdlin@gmail.com Signed-off-by: Inochi Amaoto Signed-off-by: Chen Wang Signed-off-by: Chen Wang commit 56613001dfc9b2e35e2d6ba857cbc2eb0bac4272 Merge: 9f9a14a88c62a0 9a0048e0ae14cb Author: Jakub Kicinski Date: Tue Jul 22 18:37:23 2025 -0700 Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2025-07-22 The following pull-request contains common mlx5 updates * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Expose cable_length field in PFCC register net/mlx5: Add IFC bits and enums for buf_ownership net/mlx5: Add IFC bits to support RSS for IPSec offload ==================== Link: https://patch.msgid.link/1753175048-330044-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 9f9a14a88c62a02439893197b96553d629cc1ce8 Merge: 8839d1cc6ce0d3 b115c7758802f8 Author: Jakub Kicinski Date: Tue Jul 22 18:21:17 2025 -0700 Merge branch 'tcp-a-couple-of-fixes' Paolo Abeni says: ==================== tcp: a couple of fixes This series includes a couple of follow-up for the recent tcp receiver changes, addressing issues outlined by the nipa CI and the mptcp self-tests. Note that despite the affected self-tests where MPTCP ones, the issues are really in the TCP code, see patch 1 for the details. v1: https://lore.kernel.org/cover.1752859383.git.pabeni@redhat.com ==================== Link: https://patch.msgid.link/cover.1753118029.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit b115c7758802f8d14ba8797e0ba979c47d78f310 Author: Paolo Abeni Date: Mon Jul 21 19:20:22 2025 +0200 tcp: do not increment BeyondWindow MIB for old seq The mentioned MIB is currently incremented even when a packet with an old sequence number (i.e. a zero window probe) is received, which is IMHO misleading. Explicitly restrict such MIB increment at the relevant events. Fixes: 6c758062c64d ("tcp: add LINUX_MIB_BEYOND_WINDOW") Acked-by: Eric Dumazet Signed-off-by: Paolo Abeni Link: https://patch.msgid.link/20d147292eb4b13b6535e0ad6f56be64d9c330d3.1753118029.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 972ca7a3bc9a136b15ba698713b056a4900e2634 Author: Paolo Abeni Date: Mon Jul 21 19:20:21 2025 +0200 tcp: do not set a zero size receive buffer The nipa CI is reporting frequent failures in the mptcp_connect self-tests. In the failing scenarios (TCP -> MPTCP) the involved sockets are actually plain TCP ones, as fallback for passive socket at 2whs time cause the MPTCP listener to actually create a TCP socket. The transfer is stuck due to the receiver buffer being zero. With the stronger check in place, tcp_clamp_window() can be invoked while the TCP socket has sk_rmem_alloc == 0, and the receive buffer will be zeroed, too. Check for the critical condition in tcp_prune_queue() and just drop the packet without shrinking the receiver buffer. Fixes: 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks") Suggested-by: Eric Dumazet Signed-off-by: Paolo Abeni Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20c18165d3f848e1c5c1b782d88c1a5ab38b3f70.1753118029.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 8839d1cc6ce0d38b4799380eae0c31bb0f07928b Merge: ad892e912b84b7 eeaf11464f38db Author: Jakub Kicinski Date: Tue Jul 22 18:20:15 2025 -0700 Merge branch 'net-mlx5-misc-changes-2025-07-21' Tariq Toukan says: ==================== net/mlx5: misc changes 2025-07-21 This series by Lama contains misc enhancements to the SHAMPO parameters. ==================== Link: https://patch.msgid.link/1753081999-326247-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit eeaf11464f38db9307b7d9ed6c7750b83c344ff8 Author: Lama Kayal Date: Mon Jul 21 10:13:19 2025 +0300 net/mlx5e: Remove duplicate mkey from SHAMPO header SHAMPO structure holds two variations of the mkey, which is unnecessary, a duplication that's repeated per rq. Remove duplicate mkey information and keep only one version, the one used in the fast path, rename field to reflect field type clearly. Signed-off-by: Lama Kayal Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Michal Swiatkowski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/1753081999-326247-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit eee529c0044e06959a40c6dba6d85df493f54fc3 Author: Lama Kayal Date: Mon Jul 21 10:13:18 2025 +0300 net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() Refactor mlx5e_shampo_get_log_hd_entry_size() as macro, for more simplicity. Signed-off-by: Lama Kayal Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Michal Swiatkowski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/1753081999-326247-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit bc2d44b83f2b333719560740068663a2b405deaf Author: Lama Kayal Date: Mon Jul 21 10:13:17 2025 +0300 net/mlx5e: SHAMPO, Cleanup reservation size formula The reservation size formula can be reduced to a simple evaluation of MLX5E_SHAMPO_WQ_RESRV_SIZE. This leaves mlx5e_shampo_get_log_rsrv_size() with one single use, which can be replaced with a macro for simplicity. Also, function mlx5e_shampo_get_log_rsrv_size() is used only throughout params.c, make it static. Signed-off-by: Lama Kayal Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Michal Swiatkowski Reviewed-by: Jacob Keller Link: https://patch.msgid.link/1753081999-326247-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ad892e912b84b706ed399a212174978ddd1ac1f9 Author: Fan Yu Date: Mon Jul 21 11:16:07 2025 +0800 tcp: trace retransmit failures in tcp_retransmit_skb Background ========== When TCP retransmits a packet due to missing ACKs, the retransmission may fail for various reasons (e.g., packets stuck in driver queues, receiver zero windows, or routing issues). The original tcp_retransmit_skb tracepoint: 'commit e086101b150a ("tcp: add a tracepoint for tcp retransmission")' lacks visibility into these failure causes, making production diagnostics difficult. Solution ======== Adds the retval("err") to the tcp_retransmit_skb tracepoint. Enables users to know why some tcp retransmission failed and users can filter retransmission failures by retval. Compatibility description ========================= This patch extends the tcp_retransmit_skb tracepoint by adding a new "err" field at the end of its existing structure (within TP_STRUCT__entry). The compatibility implications are detailed as follows: 1) Structural compatibility for legacy user-space tools Legacy tools/BPF programs accessing existing fields (by offset or name) can still work without modification or recompilation.The new field is appended to the end, preserving original memory layout. 2) Note: semantic changes The original tracepoint primarily only focused on successfully retransmitted packets. With this patch, the tracepoint now can figure out packets that may terminate early due to specific reasons. For accurate statistics, users should filter using "err" to distinguish outcomes. Before patched: field:const void * skbaddr; offset:8; size:8; signed:0; field:const void * skaddr; offset:16; size:8; signed:0; field:int state; offset:24; size:4; signed:1; field:__u16 sport; offset:28; size:2; signed:0; field:__u16 dport; offset:30; size:2; signed:0; field:__u16 family; offset:32; size:2; signed:0; field:__u8 saddr[4]; offset:34; size:4; signed:0; field:__u8 daddr[4]; offset:38; size:4; signed:0; field:__u8 saddr_v6[16]; offset:42; size:16; signed:0; field:__u8 daddr_v6[16]; offset:58; size:16; signed:0; print fmt: "skbaddr=%p skaddr=%p family=%s sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c state=%s" After patched: field:const void * skbaddr; offset:8; size:8; signed:0; field:const void * skaddr; offset:16; size:8; signed:0; field:int state; offset:24; size:4; signed:1; field:__u16 sport; offset:28; size:2; signed:0; field:__u16 dport; offset:30; size:2; signed:0; field:__u16 family; offset:32; size:2; signed:0; field:__u8 saddr[4]; offset:34; size:4; signed:0; field:__u8 daddr[4]; offset:38; size:4; signed:0; field:__u8 saddr_v6[16]; offset:42; size:16; signed:0; field:__u8 daddr_v6[16]; offset:58; size:16; signed:0; field:int err; offset:76; size:4; signed:1; print fmt: "skbaddr=%p skaddr=%p family=%s sport=%hu dport=%hu saddr=%pI4 daddr=%pI4 saddrv6=%pI6c daddrv6=%pI6c state=%s err=%d" Co-developed-by: xu xin Signed-off-by: xu xin Signed-off-by: Fan Yu Reviewed-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250721111607626_BDnIJB0ywk6FghN63bor@zte.com.cn Signed-off-by: Jakub Kicinski commit 008b75759eb98fa6ee83eae8e9e19722121de633 Author: Ian Rogers Date: Thu Jul 17 08:08:55 2025 -0700 perf ui scripts: Switch FILENAME_MAX to NAME_MAX FILENAME_MAX is the same as PATH_MAX (4kb) in glibc rather than NAME_MAX's 255. Switch to using NAME_MAX and ensure the '\0' is accounted for in the path's buffer size. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250717150855.1032526-3-irogers@google.com Signed-off-by: Namhyung Kim commit 82aac553372cd201b91a8b064be0cd5a501932b2 Author: Ian Rogers Date: Thu Jul 17 08:08:54 2025 -0700 perf pmu: Switch FILENAME_MAX to NAME_MAX FILENAME_MAX is the same as PATH_MAX (4kb) in glibc rather than NAME_MAX's 255. Switch to using NAME_MAX and ensure the '\0' is accounted for in the path's buffer size. Fixes: 754baf426e09 ("perf pmu: Change aliases from list to hashmap") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250717150855.1032526-2-irogers@google.com Signed-off-by: Namhyung Kim commit 478272d1cdd9959a6d638e9d81f70642f04290c9 Author: Ian Rogers Date: Thu Jul 17 08:08:53 2025 -0700 tools subcmd: Tighten the filename size in check_if_command_finished FILENAME_MAX is often PATH_MAX (4kb), far more than needed for the /proc path. Make the buffer size sufficient for the maximum integer plus "/proc/" and "/status" with a '\0' terminator. Fixes: 5ce42b5de461 ("tools subcmd: Add non-waitpid check_if_command_finished()") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250717150855.1032526-1-irogers@google.com Signed-off-by: Namhyung Kim commit b2dd6eb0acd756a48a5351c56a675e2e7ff45e70 Author: Randy Dunlap Date: Sun Jul 20 19:04:20 2025 -0700 net: Kconfig: add endif/endmenu comments Add comments on endif & endmenu blocks. This can save time when searching & trying to understand kconfig menu dependencies. The other endif & endmenu statements are already commented like this. This makes it similar to drivers/net/Kconfig, which is already commented like this. Signed-off-by: Randy Dunlap Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250721020420.3555128-1-rdunlap@infradead.org Signed-off-by: Jakub Kicinski commit b2c688337fda9ddf655899909adf6b0b69a5e1b0 Merge: 391daec35b937a d6444ebc97dcbb Author: Jakub Kicinski Date: Tue Jul 22 18:15:55 2025 -0700 Merge branch 'selftests-drv-net-test-xdp-native-support' Mohsin Bashir says: ==================== selftests: drv-net: Test XDP native support This patch series add tests to validate XDP native support for PASS, DROP, ABORT, and TX actions, as well as headroom and tailroom adjustment. For adjustment tests, validate support for both the extension and shrinking cases across various packet sizes and offset values. The pass criteria for head/tail adjustment tests require that at-least one adjustment value works for at-least one packet size. This ensure that the variability in maximum supported head/tail adjustment offset across different drivers is being incorporated. The results reported in this series are based on netdevsim. However, the series is tested against multiple other drivers including fbnic. Note: The XDP support for fbnic will be added later. ==================== Link: https://patch.msgid.link/20250719083059.3209169-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit d6444ebc97dcbbc1e378bedb037380305294e77d Author: Mohsin Bashir Date: Sat Jul 19 01:30:59 2025 -0700 selftests: drv-net: Test head-adjustment support Add test to validate the headroom adjustment support for both extension and the shrinking cases. For the extension part, eat up space from the start of payload data whereas, for the shrinking part, populate the newly available space with a tag. In the user-space, validate that a test string is manipulated accordingly. The negative and positive offset values result in shrinking and growing of headroom (growing and shrinking of payload) respectively. TAP version 13 1..9 ok 1 xdp.test_xdp_native_pass_sb ok 2 xdp.test_xdp_native_pass_mb ok 3 xdp.test_xdp_native_drop_sb ok 4 xdp.test_xdp_native_drop_mb ok 5 xdp.test_xdp_native_tx_mb \# Failed run: pkt_sz 512, ... offset 1. Reason: Adjustment failed ok 6 xdp.test_xdp_native_adjst_tail_grow_data ok 7 xdp.test_xdp_native_adjst_tail_shrnk_data \# Failed run: pkt_sz 512, ... offset -128. Reason: Adjustment failed ok 8 xdp.test_xdp_native_adjst_head_grow_data \# Failed run: pkt_sz (512) > HDS threshold (0) and offset 64 > 48 ok 9 xdp.test_xdp_native_adjst_head_shrnk_data \# Totals: pass:9 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250719083059.3209169-6-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 0b65cfcef9c5737eb2700aba20a93b8593f94c04 Author: Mohsin Bashir Date: Sat Jul 19 01:30:58 2025 -0700 selftests: drv-net: Test tail-adjustment support Add test to validate support for the two cases of tail adjustment: 1) tail extension, and 2) tail shrinking across different frame sizes and offset values. For each of the two cases, test both the single and multi-buffer cases by choosing appropriate packet size. The negative offset value result in growing of tailroom (shrinking of payload) while the positive offset result in shrinking of tailroom (growing of payload). Since the support for tail adjustment varies across drivers, classify the test as pass if at least one combination of packet size and offset from a pre-selected list results in a successful run. In case of an unsuccessful run, report the failure and highlight the packet size and offset values that caused the test to fail, as well as the values that resulted in the last successful run. Note: The growing part of this test for netdevsim may appear flaky when the offset value is larger than 1. This behavior occurs because tailroom is not explicitly reserved for netdevsim, with 1 being the typical tailroom value. However, in certain cases, such as payload being the last in the page with additional available space, the truesize is expanded. This also result increases the tailroom causing the test to pass intermittently. In contrast, when tailrrom is explicitly reserved, such as in the of fbnic, the test results are deterministic. ./drivers/net/xdp.py TAP version 13 1..7 ok 1 xdp.test_xdp_native_pass_sb ok 2 xdp.test_xdp_native_pass_mb ok 3 xdp.test_xdp_native_drop_sb ok 4 xdp.test_xdp_native_drop_mb ok 5 xdp.test_xdp_native_tx_mb \# Failed run: ... successful run: ... offset 1. Reason: Adjustment failed ok 6 xdp.test_xdp_native_adjst_tail_grow_data ok 7 xdp.test_xdp_native_adjst_tail_shrnk_data \# Totals: pass:7 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250719083059.3209169-5-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 6713945726ce6859aac9cfe0f37ba641471f9235 Author: Mohsin Bashir Date: Sat Jul 19 01:30:57 2025 -0700 selftests: drv-net: Test XDP_TX support Add test to verify the XDP_TX functionality by generating traffic from a remote node on a specific UDP port and redirecting it back to the sender. ./drivers/net/xdp.py TAP version 13 1..5 ok 1 xdp.test_xdp_native_pass_sb ok 2 xdp.test_xdp_native_pass_mb ok 3 xdp.test_xdp_native_drop_sb ok 4 xdp.test_xdp_native_drop_mb ok 5 xdp.test_xdp_native_tx_mb \# Totals: pass:5 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250719083059.3209169-4-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 1cbcb1b28b26a528b1c1cf1eefb5d5c5659967dd Author: Mohsin Bashir Date: Sat Jul 19 01:30:56 2025 -0700 selftests: drv-net: Test XDP_PASS/DROP support Test XDP_PASS/DROP in single buffer and multi buffer mode when XDP native support is available. ./drivers/net/xdp.py TAP version 13 1..4 ok 1 xdp.test_xdp_native_pass_sb ok 2 xdp.test_xdp_native_pass_mb ok 3 xdp.test_xdp_native_drop_sb ok 4 xdp.test_xdp_native_drop_mb \# Totals: pass:4 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250719083059.3209169-3-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit be09f0d1acce9ed8d730ae33969da201948608cd Author: Jakub Kicinski Date: Sat Jul 19 01:30:55 2025 -0700 net: netdevsim: hook in XDP handling Add basic XDP support by hooking in do_xdp_generic(). This should be enough to validate most basic XDP tests. Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250719083059.3209169-2-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 5ec9d26b78c4eb7c2fab54dcec6c0eb845302a98 Author: Phillip Potter Date: Wed Jul 23 00:19:00 2025 +0100 cdrom: Call cdrom_mrw_exit from cdrom_release function Remove the cdrom_mrw_exit call from unregister_cdrom, as it invokes block commands that can fail due to a NULL pointer dereference from the call happening too late, during the unloading of the driver (e.g. unplugging of USB optical drives). Instead perform the call inside cdrom_release, thus also removing the need for the exit function pointer inside the cdrom_device_info struct. Reported-by: Sergey Senozhatsky Closes: https://lore.kernel.org/linux-block/uxgzea5ibqxygv3x7i4ojbpvcpv2wziorvb3ns5cdtyvobyn7h@y4g4l5ezv2ec Suggested-by: Jens Axboe Link: https://lore.kernel.org/linux-block/6686fe78-a050-4a1d-aa27-b7bf7ca6e912@kernel.dk Tested-by: Phillip Potter Signed-off-by: Phillip Potter Link: https://lore.kernel.org/r/20250722231900.1164-2-phil@philpotter.co.uk Signed-off-by: Jens Axboe commit 129f70bd6063d701c3ecb63ecdd4b5ee520cfd45 Author: Changbin Du Date: Fri Jun 13 19:40:47 2025 +0800 perf: ftrace: add graph tracer options args/retval/retval-hex/retaddr This change adds support for new funcgraph tracer options funcgraph-args, funcgraph-retval, funcgraph-retval-hex and funcgraph-retaddr. The new added options are: - args : Show function arguments. - retval : Show function return value. - retval-hex : Show function return value in hexadecimal format. - retaddr : Show function return address. # ./perf ftrace -G vfs_write --graph-opts retval,retaddr # tracer: function_graph # # CPU DURATION FUNCTION CALLS # | | | | | | | 5) | mutex_unlock() { /* <-rb_simple_write+0xda/0x150 */ 5) 0.188 us | local_clock(); /* <-lock_release+0x2ad/0x440 ret=0x3bf2a3cf90e */ 5) | rt_mutex_slowunlock() { /* <-rb_simple_write+0xda/0x150 */ 5) | _raw_spin_lock_irqsave() { /* <-rt_mutex_slowunlock+0x4f/0x200 */ 5) 0.123 us | preempt_count_add(); /* <-_raw_spin_lock_irqsave+0x23/0x90 ret=0x0 */ 5) 0.128 us | local_clock(); /* <-__lock_acquire.isra.0+0x17a/0x740 ret=0x3bf2a3cfc8b */ 5) 0.086 us | do_raw_spin_trylock(); /* <-_raw_spin_lock_irqsave+0x4a/0x90 ret=0x1 */ 5) 0.845 us | } /* _raw_spin_lock_irqsave ret=0x292 */ 5) | _raw_spin_unlock_irqrestore() { /* <-rt_mutex_slowunlock+0x191/0x200 */ 5) 0.097 us | local_clock(); /* <-lock_release+0x2ad/0x440 ret=0x3bf2a3cff1f */ 5) 0.086 us | do_raw_spin_unlock(); /* <-_raw_spin_unlock_irqrestore+0x23/0x60 ret=0x1 */ 5) 0.104 us | preempt_count_sub(); /* <-_raw_spin_unlock_irqrestore+0x35/0x60 ret=0x0 */ 5) 0.726 us | } /* _raw_spin_unlock_irqrestore ret=0x80000000 */ 5) 1.881 us | } /* rt_mutex_slowunlock ret=0x0 */ 5) 2.931 us | } /* mutex_unlock ret=0x0 */ Signed-off-by: Changbin Du Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250613114048.132336-1-changbin.du@huawei.com Signed-off-by: Namhyung Kim commit 0a949252556809ce922e0289c148883e838cb9bb Author: Nam Cao Date: Fri Jul 11 15:17:37 2025 +0200 rv/ltl: Do not execute the Buchi automaton twice on start condition On start condition of a Buchi automaton, the automaton is executed twice. This is fine for now, as all the current LTL operators do not care about this. But it would break the 'next' operator, which will be introduced in a follow-up patch. Prepare for the introduction of the 'next' operator, only execute the automaton once on start condition. Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Gabriele Monaco Link: https://lore.kernel.org/9379f4e7b9c1c69a6dca3e20a22936c850a25ca7.1752239482.git.namcao@linutronix.de Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 502ffa43994de8f038101e0920e8e87d9756c4d8 Author: Steven Rostedt Date: Thu Jul 10 09:56:28 2025 -0400 tracing: Fix comment in trace_module_remove_events() Fix typo "allocade" -> "allocated". Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250710095628.42ed6b06@batman.local.home Signed-off-by: Steven Rostedt (Google) commit 4d6d0a6263babf7c43faa55de4fa3c6637dec624 Author: Steven Rostedt Date: Fri Jul 4 10:48:38 2025 -0400 tracing: Remove redundant config HAVE_FTRACE_MCOUNT_RECORD Ftrace is tightly coupled with architecture specific code because it requires the use of trampolines written in assembly. This means that when a new feature or optimization is made, it must be done for all architectures. To simplify the approach, CONFIG_HAVE_FTRACE_* configs are added to denote which architecture has the new enhancement so that other architectures can still function until they too have been updated. The CONFIG_HAVE_FTRACE_MCOUNT was added to help simplify the DYNAMIC_FTRACE work, but now every architecture that implements DYNAMIC_FTRACE also has HAVE_FTRACE_MCOUNT set too, making it redundant with the HAVE_DYNAMIC_FTRACE. Remove the HAVE_FTRACE_MCOUNT config and use DYNAMIC_FTRACE directly where applicable. Link: https://lore.kernel.org/all/20250703154916.48e3ada7@gandalf.local.home/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Mark Rutland Cc: Linus Torvalds Link: https://lore.kernel.org/20250704104838.27a18690@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit 07c3f391bcb217b6949b49785ccb5fee02be21fe Author: Steven Rostedt Date: Wed Jul 2 14:36:57 2025 -0400 tracing: Remove EVENT_FILE_FL_SOFT_MODE flag When soft disabling of trace events was first created, it needed to have a way to know if a file had a user that was using it with soft disabled (for triggers that need to enable or disable events from a context that can not really enable or disable the event, it would set SOFT_DISABLED to state it is disabled). The flag SOFT_MODE was used to denote that an event had a user that would enable or disable it via the SOFT_DISABLED flag. Commit 1cf4c0732db3c ("tracing: Modify soft-mode only if there's no other referrer") fixed a bug where if two users were using the SOFT_DISABLED flag the accounting would get messed up as the SOFT_MODE flag could only handle one user. That commit added the sm_ref counter which kept track of how many users were using the event in "soft mode". This made the SOFT_MODE flag redundant as it should only be set if the sm_ref counter is non zero. Remove the SOFT_MODE flag and just use the sm_ref counter to know the event is in soft mode or not. This makes the code a bit simpler. Link: https://lore.kernel.org/all/20250702111908.03759998@batman.local.home/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Gabriele Paoloni Link: https://lore.kernel.org/20250702143657.18dd1882@batman.local.home Signed-off-by: Steven Rostedt (Google) commit c897c1e5b19dd4fc32e84fa1ab2065c2507be3a7 Author: Nam Cao Date: Thu Jun 26 17:19:40 2025 +0200 tracing: Remove pointless memory barriers Memory barriers are useful to ensure memory accesses from one CPU appear in the original order as seen by other CPUs. Some smp_rmb() and smp_wmb() are used, but they are not ordering multiple memory accesses. Remove them. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Gabriele Monaco Link: https://lore.kernel.org/20250626151940.1756398-1-namcao@linutronix.de Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 9b4d5d330fcd40bbc38a1e6ed3d617e674d651fa Author: Steven Rostedt Date: Thu Jul 3 11:52:22 2025 -0400 ftrace: Make DYNAMIC_FTRACE always enabled for architectures that support it ftrace has two flavors: 1) static: Where every function always calls the ftrace trampoline 2) dynamic: Where each function has nops that can be changed on demand to jump to the ftrace trampoline when needed. The static flavor has very high performance overhead and was only created to make it easier for architectures to implement the dynamic flavor. An architecture developer can first implement the static ftrace to make sure the trampolines work before working on the more complicated dynamic aspect of ftrace. Once the architecture can support dynamic ftrace, there's no reason to continue to support the static flavor. In fact, the static flavor tends to bitrot and bugs start to appear in them. Remove the prompt to pick DYNAMIC_FTRACE and simply enable it if the architecture supports it. Link: https://lore.kernel.org/all/f7e12c6d-892e-4ca3-9ef0-fbb524d04a48@ghiti.fr/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Mark Rutland Cc: Linus Torvalds Cc: Alexandre Ghiti Cc: ChenMiao Link: https://lore.kernel.org/20250703115222.2d7c8cd5@batman.local.home Signed-off-by: Steven Rostedt (Google) commit 218d372ce8d56c08f08d028e4c7845bc121e719f Author: Steven Rostedt Date: Tue Jul 1 19:44:51 2025 -0400 fgraph: Keep track of when fgraph_ops are registered or not Add a warning if unregister_ftrace_graph() is called without ever registering it, or if register_ftrace_graph() is called twice. This can detect errors when they happen and not later when there's a side effect: Link: https://lore.kernel.org/all/20250617120830.24fbdd62@gandalf.local.home/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Mark Rutland Link: https://lore.kernel.org/20250701194451.22e34724@gandalf.local.home Signed-off-by: Steven Rostedt (Google) commit dff64b072708ffef23c117fa1ee1ea59eb417807 Author: FUJITA Tomonori Date: Fri May 2 18:45:36 2025 +0900 rust: Add warn_on macro Add warn_on macro, uses the BUG/WARN feature (lib/bug.c) via assembly for x86_64/arm64/riscv. The current Rust code simply wraps BUG() macro but doesn't provide the proper debug information. The BUG/WARN feature can only be used from assembly. This uses the assembly code exported by the C side via ARCH_WARN_ASM macro. To avoid duplicating the assembly code, this approach follows the same strategy as the static branch code: it generates the assembly code for Rust using the C preprocessor at compile time. Similarly, ARCH_WARN_REACHABLE is also used at compile time to generate the assembly code; objtool's reachable annotation code. It's used for only architectures that use objtool. For now, Loongarch and arm just use a wrapper for WARN macro. UML doesn't use the assembly BUG/WARN feature; just wrapping generic BUG/WARN functions implemented in C works. Signed-off-by: FUJITA Tomonori Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250502094537.231725-5-fujita.tomonori@gmail.com [ Avoid evaluating the condition twice (a good idea in general, but it also matches the C side). Simplify with `as_char_ptr()` to avoid a cast. Cast to `ffi` integer types for `warn_slowpath_fmt`. Avoid cast for `null()`. - Miguel ] Signed-off-by: Miguel Ojeda commit 119a5d573622ae90ba730d18acfae9bb75d77b9a Author: Steven Rostedt Date: Mon Jun 30 18:04:40 2025 -0400 ring-buffer: Remove ring_buffer_read_prepare_sync() When the ring buffer was first introduced, reading the non-consuming "trace" file required disabling the writing of the ring buffer. To make sure the writing was fully disabled before iterating the buffer with a non-consuming read, it would set the disable flag of the buffer and then call an RCU synchronization to make sure all the buffers were synchronized. The function ring_buffer_read_start() originally would initialize the iterator and call an RCU synchronization, but this was for each individual per CPU buffer where this would get called many times on a machine with many CPUs before the trace file could be read. The commit 72c9ddfd4c5bf ("ring-buffer: Make non-consuming read less expensive with lots of cpus.") separated ring_buffer_read_start into ring_buffer_read_prepare(), ring_buffer_read_sync() and then ring_buffer_read_start() to allow each of the per CPU buffers to be prepared, call the read_buffer_read_sync() once, and then the ring_buffer_read_start() for each of the CPUs which made things much faster. The commit 1039221cc278 ("ring-buffer: Do not disable recording when there is an iterator") removed the requirement of disabling the recording of the ring buffer in order to iterate it, but it did not remove the synchronization that was happening that was required to wait for all the buffers to have no more writers. It's now OK for the buffers to have writers and no synchronization is needed. Remove the synchronization and put back the interface for the ring buffer iterator back before commit 72c9ddfd4c5bf was applied. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250630180440.3eabb514@batman.local.home Reported-by: David Howells Fixes: 1039221cc278 ("ring-buffer: Do not disable recording when there is an iterator") Tested-by: David Howells Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 7f0c6675b3194461ad7bb8db1d822445121fb029 Author: Prachotan Bathi Date: Tue Jul 8 17:51:51 2025 -0500 tpm_crb_ffa: handle tpm busy return code Platforms supporting direct message request v2 [1] can support secure partitions that support multiple services. For CRB over FF-A interface, if the firmware TPM or TPM service [1] shares its Secure Partition (SP) with another service, message requests may fail with a -EBUSY error. To handle this, replace the single check and call with a retry loop that attempts the TPM message send operation until it succeeds or a configurable timeout is reached. Implement a _try_send_receive function to do a single send/receive and modify the existing send_receive to add this retry loop. The retry mechanism introduces a module parameter (`busy_timeout_ms`, default: 2000ms) to control how long to keep retrying on -EBUSY responses. Between retries, the code waits briefly (50-100 microseconds) to avoid busy-waiting and handling TPM BUSY conditions more gracefully. The parameter can be modified at run-time as such: echo 3000 | tee /sys/module/tpm_crb_ffa/parameters/busy_timeout_ms This changes the timeout from the default 2000ms to 3000ms. [1] TPM Service Command Response Buffer Interface Over FF-A https://developer.arm.com/documentation/den0138/latest/ Signed-off-by: Prachotan Bathi Signed-off-by: Jarkko Sakkinen commit 586dafcdbc5004266a74bc280281e4ee92488633 Author: Prachotan Bathi Date: Tue Jul 8 17:51:50 2025 -0500 tpm_crb_ffa: Remove memset usage Simplify initialization of `ffa_send_direct_data2` and `ffa_send_direct_data` structures by using designated initializers instead of `memset()` followed by field assignments, reducing code size and improving readability. Signed-off-by: Prachotan Bathi Suggested-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 8b325091b76f7a4213d2d6b5c7717d87c2c36e62 Author: Prachotan Bathi Date: Tue Jul 8 17:51:49 2025 -0500 tpm_crb_ffa: Fix typos in function name Rename *recieve as __tpm_crb_ffa_send_receive [jarkko: polished commit message] Signed-off-by: Prachotan Bathi Signed-off-by: Jarkko Sakkinen commit d4640c394f23b202a89512346cf28f6622a49031 Author: Jarkko Sakkinen Date: Wed Jul 23 02:21:24 2025 +0300 tpm: Check for completion after timeout The current implementation of timeout detection works in the following way: 1. Read completion status. If completed, return the data 2. Sleep for some time (usleep_range) 3. Check for timeout using current jiffies value. Return an error if timed out 4. Goto 1 usleep_range doesn't guarantee it's always going to wake up strictly in (min, max) range, so such a situation is possible: 1. Driver reads completion status. No completion yet 2. Process sleeps indefinitely. In the meantime, TPM responds 3. We check for timeout without checking for the completion again. Result is lost. Such a situation also happens for the guest VMs: if vCPU goes to sleep and doesn't get scheduled for some time, the guest TPM driver will timeout instantly after waking up without checking for the completion (which may already be in place). Perform the completion check once again after exiting the busy loop in order to give the device the last chance to send us some data. Since now we check for completion in two places, extract this check into a separate function. Signed-off-by: Ivan Orlov Reviewed-by: Jonathan McDowell Signed-off-by: Jarkko Sakkinen commit 63d1dbfef6ac5ae92c672a633e4b38998dfa03b2 Author: Rob Herring Date: Sat Jul 19 13:29:11 2025 +0300 tpm: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Signed-off-by: Rob Herring Signed-off-by: Jarkko Sakkinen commit 9eed6373420ee74ccb2683cba36ad476ed70592d Author: Chelsy Ratnawat Date: Thu Jun 26 05:51:30 2025 -0700 tpm: Replace scnprintf() with sysfs_emit() and sysfs_emit_at() in sysfs show functions Documentation/filesystems/sysfs.rst mentions that show() should only use sysfs_emit() or sysfs_emit_at() when formating the value to be returned to user space. So replace scnprintf() with sysfs_emit(). Signed-off-by: Chelsy Ratnawat Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 89dd3695de4b8b17f0cded7c4b695b775b4d1d29 Author: Jarkko Sakkinen Date: Tue Jul 1 03:37:36 2025 +0300 tpm_crb_ffa: Remove unused export Remove the export of tpm_crb_ffa_get_interface_version() as it has no callers outside tpm_crb_ffa. Fixes: eb93f0734ef1 ("tpm_crb: ffa_tpm: Implement driver compliant to CRB over FF-A") Signed-off-by: Jarkko Sakkinen Reviewed-by: Yeoreum Yun Signed-off-by: Jarkko Sakkinen commit 746d9e9f62a6e8ba0eba2b83fc61cfe7fa8797ce Author: Yeoreum Yun Date: Sat Jul 19 13:27:46 2025 +0300 tpm: tpm_crb_ffa: try to probe tpm_crb_ffa when it's built-in To generate the boot_aggregate log in the IMA subsystem using TPM PCR values, the TPM driver must be built as built-in and must be probed before the IMA subsystem is initialized. However, when the TPM device operates over the FF-A protocol using the CRB interface, probing fails and returns -EPROBE_DEFER if the tpm_crb_ffa device — an FF-A device that provides the communication interface to the tpm_crb driver — has not yet been probed. This issue occurs because both crb_acpi_driver_init() and tpm_crb_ffa_driver_init() are registered with device_initcall. As a result, crb_acpi_driver_init() may be invoked before tpm_crb_ffa_driver_init(), which is responsible for probing the tpm_crb_ffa device. When this happens, IMA fails to detect the TPM device and logs the following message: | ima: No TPM chip found, activating TPM-bypass! Consequently, it cannot generate the boot_aggregate log with the PCR values provided by the TPM. To resolve this issue, the tpm_crb_ffa_init() function explicitly attempts to probe the tpm_crb_ffa by register tpm_crb_ffa driver so that when tpm_crb_ffa device is created before tpm_crb_ffa_init(), probe the tpm_crb_ffa device in tpm_crb_ffa_init() to finish probe the TPM device completely. This ensures that the TPM device using CRB over FF-A can be successfully probed, even if crb_acpi_driver_init() is called first. [ jarkko: reformatted some of the paragraphs because they were going past the 75 character boundary. ] Signed-off-by: Yeoreum Yun Reviewed-by: Mimi Zohar Reviewed-by: Sudeep Holla Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 0e0546eabcd6c19765a8dbf5b5db3723e7b0ea75 Author: Yeoreum Yun Date: Sat Jul 19 13:27:02 2025 +0300 firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall The Linux IMA (Integrity Measurement Architecture) subsystem used for secure boot, file integrity, or remote attestation cannot be a loadable module for few reasons listed below: o Boot-Time Integrity: IMA’s main role is to measure and appraise files before they are used. This includes measuring critical system files during early boot (e.g., init, init scripts, login binaries). If IMA were a module, it would be loaded too late to cover those. o TPM Dependency: IMA integrates tightly with the TPM to record measurements into PCRs. The TPM must be initialized early (ideally before init_ima()), which aligns with IMA being built-in. o Security Model: IMA is part of a Trusted Computing Base (TCB). Making it a module would weaken the security model, as a potentially compromised system could delay or tamper with its initialization. IMA must be built-in to ensure it starts measuring from the earliest possible point in boot which inturn implies TPM must be initialised and ready to use before IMA. To enable integration of tpm_event_log with the IMA subsystem, the TPM drivers (tpm_crb and tpm_crb_ffa) also needs to be built-in. However with FF-A driver also being initialised at device initcall level, it can lead to an initialization order issue where: - crb_acpi_driver_init() may run before tpm_crb_ffa_driver()_init and ffa_init() - As a result, probing the TPM device via CRB over FFA is deferred - ima_init() (called as a late initcall) runs before deferred probe completes, IMA fails to find the TPM and logs the below error: | ima: No TPM chip found, activating TPM-bypass! Eventually it fails to generate boot_aggregate with PCR values. Because of the above stated dependency, the ffa driver needs to initialised before tpm_crb_ffa module to ensure IMA finds the TPM successfully when present. [ jarkko: reformatted some of the paragraphs because they were going past the 75 character boundary. ] Signed-off-by: Yeoreum Yun Reviewed-by: Mimi Zohar Reviewed-by: Sudeep Holla Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit faddec84aa8a600f5f6857cdd9b9ea29f7cf60fb Author: Stefano Garzarella Date: Fri Jun 20 15:08:10 2025 +0200 tpm/tpm_svsm: support TPM_CHIP_FLAG_SYNC This driver does not support interrupts, and receiving the response is synchronous with sending the command. Enable synchronous send() with TPM_CHIP_FLAG_SYNC, which implies that ->send() already fills the provided buffer with a response, and ->recv() is not implemented. Keep using the same pre-allocated buffer to avoid having to allocate it for each command. We need the buffer to have the header required by the SVSM protocol and the command contiguous in memory. Signed-off-by: Stefano Garzarella Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 0637c10e72ef4b0645cb45873d21fd5f711ba041 Author: Stefano Garzarella Date: Fri Jun 20 15:08:09 2025 +0200 tpm/tpm_ftpm_tee: support TPM_CHIP_FLAG_SYNC This driver does not support interrupts, and receiving the response is synchronous with sending the command. Enable synchronous send() with TPM_CHIP_FLAG_SYNC, which implies that ->send() already fills the provided buffer with a response, and ->recv() is not implemented. Signed-off-by: Stefano Garzarella Reviewed-by: Sumit Garg Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 04fe47015d7726b42c34615c124697c7a3537bf0 Author: Stefano Garzarella Date: Fri Jun 20 15:08:08 2025 +0200 tpm: support devices with synchronous send() Some devices do not support interrupts and provide a single synchronous operation to send the command and receive the response on the same buffer. Currently, these types of drivers must use an internal buffer where they temporarily store the response between .send() and .recv() calls. Introduce a new flag (TPM_CHIP_FLAG_SYNC) to support synchronous send(). If that flag is set by the driver, tpm_try_transmit() will use the send() callback to send the command and receive the response on the same buffer synchronously. In that case send() return the number of bytes of the response on success, or -errno on failure. Signed-off-by: Stefano Garzarella Suggested-by: Jason Gunthorpe Suggested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 07d8004d6fb95cbe48918e56012f16454cfdfe89 Author: Stefano Garzarella Date: Fri Jun 20 15:08:07 2025 +0200 tpm: add bufsiz parameter in the .send callback Add a new `bufsiz` parameter to the `.send` callback in `tpm_class_ops`. This parameter will allow drivers to differentiate between the actual command length to send and the total buffer size. Currently `bufsiz` is not used, but it will be used to implement devices with synchronous send() to send the command and receive the response on the same buffer. Also rename the previous parameter `len` to `cmd_len` in the declaration to make it clear that it contains the length in bytes of the command stored in the buffer. The semantics don't change and it can be used as before by drivers. This is an optimization since the drivers could get it from the header, but let's avoid duplicating code. While we are here, resolve a checkpatch warning: WARNING: Unnecessary space before function pointer arguments #66: FILE: include/linux/tpm.h:90: + int (*send) (struct tpm_chip *chip, u8 *buf, size_t bufsiz, Signed-off-by: Stefano Garzarella Suggested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen commit 5c0d0ee36f168f6962a710205436533be31c9a42 Author: Sean Christopherson Date: Tue Jul 22 08:59:26 2025 -0700 PCI: Support Immediate Readiness on devices without PM capabilities Query support for Immediate Readiness irrespective of whether or not the device supports PM capabilities, as nothing in the PCIe spec suggests that Immediate Readiness is in any way dependent on PM functionality. Fixes: d6112f8def51 ("PCI: Add support for Immediate Readiness") Signed-off-by: Sean Christopherson Signed-off-by: Bjorn Helgaas Cc: David Matlack Cc: Vipin Sharma Cc: Aaron Lewis Link: https://patch.msgid.link/20250722155926.352248-1-seanjc@google.com commit 8b52144f0e08e7640bdbaf7b6a2527b3e100a769 Author: Krzysztof Kozlowski Date: Mon Jul 7 11:22:01 2025 +0200 rtc: s3c: Put 'const' just after 'static' keyword for data Convention is to define static data as 'static const ...', not 'static ... const' because of readability, even if the code is functionally equal. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250707092200.48862-2-krzysztof.kozlowski@linaro.org Signed-off-by: Alexandre Belloni commit 289642767c2e12df58213f7b34f78d19466d9c28 Author: Alexander Shiyan Date: Fri Jul 4 12:11:44 2025 +0300 rtc: m41t80: remove HT feature for m41t65 The M41T65 device does not support the "Halt Update Bit" (HT) feature as per its datasheet. This aligns the driver with the actual hardware capabilities. Signed-off-by: Alexander Shiyan Link: https://lore.kernel.org/r/20250704091144.45389-1-eagle.alexander923@gmail.com Signed-off-by: Alexandre Belloni commit 54edba916e2913b0893b0f6404b73155d48374ea Author: Yao Zi Date: Tue Jul 22 08:05:36 2025 +0000 clk: thead: th1520-ap: Describe mux clocks with clk_mux Mux clocks are now described with a customized ccu_mux structure consisting of ccu_internal and ccu_common substructures, and registered later with devm_clk_hw_register_mux_parent_data_table(). As this helper always allocates a new clk_hw structure, it's extremely hard to use mux clocks as parents statically by clk_hw pointers, since CCF has no knowledge about the clk_hw structure embedded in ccu_mux. This scheme already causes issues for clock c910, which takes a mux clock, c910-i0, as a possible parent. With mainline U-Boot that reparents c910 to c910-i0 at boottime, c910 is considered as an orphan by CCF. This patch refactors handling of mux clocks, embeds a clk_mux structure in ccu_mux directly. Instead of calling devm_clk_hw_register_mux_*(), we could register mux clocks on our own without allocating any new clk_hw pointer, fixing c910 clock's issue. Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks") Signed-off-by: Yao Zi Signed-off-by: Drew Fustini commit 826230970a44a50227d4884835ea8a0f8825fe03 Author: FUJITA Tomonori Date: Fri May 2 18:45:35 2025 +0900 arm64/bug: Add ARCH_WARN_ASM macro for BUG/WARN asm code sharing with Rust Add new ARCH_WARN_ASM macro for BUG/WARN assembly code sharing with Rust to avoid the duplication. No functional changes. Acked-by: Catalin Marinas Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250502094537.231725-4-fujita.tomonori@gmail.com Signed-off-by: Miguel Ojeda commit 8ad470d4e3dcd3db95d8bda6d35909a2ce897ca7 Author: FUJITA Tomonori Date: Fri May 2 18:45:34 2025 +0900 riscv/bug: Add ARCH_WARN_ASM macro for BUG/WARN asm code sharing with Rust Add new ARCH_WARN_ASM macro for BUG/WARN assembly code sharing with Rust to avoid the duplication. No functional changes. Acked-by: Alexandre Ghiti Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250502094537.231725-3-fujita.tomonori@gmail.com [ Remove ending newline in `ARCH_WARN_ASM` content to be closer to the original. - Miguel ] Signed-off-by: Miguel Ojeda commit 8c8efa93db68bb9fbdb46b93d5b66ff18bdf3d18 Author: FUJITA Tomonori Date: Fri May 2 18:45:33 2025 +0900 x86/bug: Add ARCH_WARN_ASM macro for BUG/WARN asm code sharing with Rust Add new ARCH_WARN_ASM macro for BUG/WARN assembly code sharing with Rust to avoid the duplication. No functional changes. Acked-by: Peter Zijlstra (Intel) Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250502094537.231725-2-fujita.tomonori@gmail.com [ Fixed typo in macro parameter name. - Miguel ] Signed-off-by: Miguel Ojeda commit 661e9cd196598c7d2502260ebbe60970546cca35 Author: Moon Hee Lee Date: Wed Jul 2 10:17:05 2025 -0700 selftests/kexec: fix test_kexec_jump build The test_kexec_jump program builds correctly when invoked from the top-level selftests/Makefile, which explicitly sets the OUTPUT variable. However, building directly in tools/testing/selftests/kexec fails with: make: *** No rule to make target '/test_kexec_jump', needed by 'test_kexec_jump.sh'. Stop. This failure occurs because the Makefile rule relies on $(OUTPUT), which is undefined in direct builds. Fix this by listing test_kexec_jump in TEST_GEN_PROGS, the standard way to declare generated test binaries in the kselftest framework. This ensures the binary is built regardless of invocation context and properly removed by make clean. Link: https://lore.kernel.org/r/20250702171704.22559-2-moonhee.lee.ca@gmail.com Acked-by: Shuah Khan Signed-off-by: Moon Hee Lee Acked-by: Baoquan He Acked-by: David Woodhouse Signed-off-by: Shuah Khan commit cd7dace0933a656dce783272e3c61dc904bcbd06 Merge: dc56e105c5402a 76f3ffeb41d870 Author: Arnd Bergmann Date: Tue Jul 22 23:03:11 2025 +0200 Merge tag 'apple-soc-dt-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/dt Apple SoC device tree changes for v6.17 - Added the bindings and nodes for Apple SoC GPU. The driver itself isn't ready for upstreaming yet due to rust dependencies but we're confident that the bindings are stable at this point. - Added a missing node for the touchbar framebuffer to Apple T2 device trees, which is the BMC for some x86 Macs - Fixed a W=1 warning by adding bit offsets to NVMEM node names. This required a change to the generic NVMEM cell binding which will be part of 6.17 through the NVMEM tree. Signed-off-by: Sven Peter * tag 'apple-soc-dt-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux: arm64: dts: apple: Add Apple SoC GPU dt-bindings: gpu: Add Apple SoC GPU arm64: dts: apple: t8012-j132: Include touchbar framebuffer node arm64: dts: apple: Add bit offset to PMIC NVMEM node names Link: https://lore.kernel.org/r/20250722163258.62424-2-sven@kernel.org Signed-off-by: Arnd Bergmann commit dc56e105c5402afa409b1f9b18b1284f4e01971f Merge: 95e4ade2b7ef63 314862edb13d52 Author: Arnd Bergmann Date: Tue Jul 22 23:02:23 2025 +0200 Merge tag 'at91-dt-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt Microchip AT91 device tree updates for v6.17 This update includes: - controllers enabled for SAMA7D65 SoC (crypto controllers, PWM, CAN) - controllers enabled for SAM9X7 SoC (LCD, LVDS) - cache configuration updates for SAMA5D2, SAMA5D3, SAMA5D4, SAMA7G5, SAMA7D65 - cleanups * tag 'at91-dt-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: (22 commits) ARM: dts: microchip: sama7g5: Add cache configuration for cpu node ARM: dts: microchip: sama7d65: Add cache configuration for cpu node ARM: dts: microchip: sama5d4: Update the cache configuration for CPU ARM: dts: microchip: sama5d3: Update the cache configuration for CPU ARM: dts: microchip: sama5d2: Update the cache configuration for CPU ARM: dts: microchip: sam9x7: Add LVDS controller ARM: dts: microchip: sama5d2_icp: rename spi-cs-setup-ns property to spi-cs-setup-delay-ns ARM: dts: microchip: sama5d27_wlsom1: rename spi-cs-setup-ns property to spi-cs-setup-delay-ns ARM: dts: microchip: sama5d27_som1: rename spi-cs-setup-ns property to spi-cs-setup-delay-ns ARM: dts: microchip: sam9x60ek: rename spi-cs-setup-ns property to spi-cs-setup-delay-ns ARM: dts: at91-sama5d27_wlsom1: Improve the Wifi compatible ARM: dts: microchip: gardena-smart-gateway: Fix power LED ARM: dts: microchip: sam9x7: Add clock name property ARM: dts: microchip: sama7d65: Add clock name property ARM: dts: microchip: sama7g5: Adjust clock xtal phandle ARM: dts: microchip: sam9x7: Add HLCD controller ARM: dts: microchip: sama7d65: Enable CAN bus ARM: dts: microchip: sama7d65: Clean up extra space ARM: dts: microchip: sama7d65: Add CAN bus support ARM: dts: microchip: sama7d65: Add PWM support ... Link: https://lore.kernel.org/r/20250721100904.568575-2-claudiu.beznea@tuxon.dev Signed-off-by: Arnd Bergmann commit 95e4ade2b7ef635bb5581ae38f1c8aeea1b01b20 Merge: dd9f8213694302 c31f2899eab084 Author: Arnd Bergmann Date: Tue Jul 22 23:01:35 2025 +0200 Merge tag 'thead-dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt T-HEAD Devicetrees for v6.17 There are several additions for the T-Head TH1520 SoC: - Add PVT node for thermal sensor which works with the existing Moortec MR75203 driver. - Add "gpu-clkgen" reset property to the AON node which allows the power domain driver to detect the capability to power sequence the GPU. All of these patches have been tested in linux-next. Signed-off-by: Drew Fustini * tag 'thead-dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: riscv: dts: thead: Add PVT node riscv: dts: thead: th1520: Add GPU clkgen reset to AON node Link: https://lore.kernel.org/r/aHtnwthmTpfkIBMr@x1 Signed-off-by: Arnd Bergmann commit dd9f82136943026ef7616e6c002c42d1e55a28dd Merge: dda1d84a0c74ab 07e04c071a35ab Author: Arnd Bergmann Date: Tue Jul 22 23:00:24 2025 +0200 Merge tag 'v6.17-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New board: FriendlyElec NanoPi M5 Camera support for the PinePhone Pro. A bunch of cleanups to make DTC happier, fix ordering of DMA uart channels on rk3528 and some video output enablement as well as some button definitions. An interesting tidbit is the reset behaviour addition in that some boards have specific requirements as to how the PMIC needs to do the restart. DT-maintainers did not consider the header with helper-constants as part of the binding, so that header ended up in the Rockchip directory * tag 'v6.17-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (29 commits) arm64: dts: rockchip: Add maskrom button to NanoPi R5S + R5C arm64: dts: rockchip: Drop regulator-compatible property on rk3399 arm64: dts: rockchip: Drop unneeded address+size-cells on px30 arm64: dts: rockchip: Fix LCD panel port on rk3566-pinetab2 arm64: dts: rockchip: Move mipi_out node on rk3399 haikou demo dtso arm64: dts: rockchip: Simplify mipi_out endpoint on rk3399 RP64 dtso arm64: dts: rockchip: Simplify edp endpoints on several rk3399 boards arm64: dts: rockchip: Simplify VOP port definition on rk3328 arm64: dts: rockchip: Move dsi address+size-cells from SoC to rk3399 boards arm64: dts: rockchip: Move dsi address+size-cells from SoC to px30 boards arm64: dts: rockchip: Fix UART DMA support for RK3528 arm64: dts: rockchip: Add reset button to NanoPi R5S arm64: dts: rockchip: Add rtc0 alias for NanoPi R5S + R5C arm64: dts: rockchip: describe the OV8858 user camera on PinePhone Pro arm64: dts: rockchip: describe I2c Bus 1 and IMX258 world camera on PinePhone Pro arm64: dts: rockchip: Fix pinctrl node names for RK3528 arm64: dts: rockchip: Add FriendlyElec NanoPi M5 support dt-bindings: arm: rockchip: add FriendlyElec NanoPi M5 board arm64: dts: rockchip: force PMIC reset behavior to restart PMU on RK3588 Tiger arm64: dts: rockchip: force PMIC reset behavior to restart PMU on RK3588 Jaguar ... Link: https://lore.kernel.org/r/11552292.NyiUUSuA9g@phil Signed-off-by: Arnd Bergmann commit dda1d84a0c74ab721ffc8917e2579a157cda76d5 Author: Krzysztof Kozlowski Date: Thu Jul 17 16:22:46 2025 +0200 ARM: dts: st: spear: Use generic "ethernet" as node name Common name for Ethernet controllers is "ethernet", not "eth", also recommended by Devicetree specification in "Generic Names Recommendation". Verified lack of impact using dtx_diff. Signed-off-by: Krzysztof Kozlowski Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20250717142245.92492-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 5cfe03e1ca42fa97341fde7a8ad53be86a51d789 Merge: 4252ec9ff812be edc4a9d1dc1669 Author: Arnd Bergmann Date: Tue Jul 22 22:58:01 2025 +0200 Merge tag 'v6.17-rockchip-defconfig64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/defconfig Enable Rockchip DFI + PM_DEVFREQ_EVENT and RGA modules. * tag 'v6.17-rockchip-defconfig64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: arm64: defconfig: enable further Rockchip platform drivers Link: https://lore.kernel.org/r/9025082.MhkbZ0Pkbq@phil Signed-off-by: Arnd Bergmann commit 4252ec9ff812be6d6653724664fb35369869eaae Merge: 0d0807814b162e c5d02bbaa217b2 Author: Arnd Bergmann Date: Tue Jul 22 22:56:46 2025 +0200 Merge tag 'qcom-arm64-defconfig-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/defconfig Qualcomm Arm64 defconfig updates for v6.17 Enable camera and video clock controllers for SM8450, SM8550, and SM8650 platforms. * tag 'qcom-arm64-defconfig-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: defconfig: Enable camcc and videocc on Qualcomm SM8450+ Link: https://lore.kernel.org/r/20250720031134.286063-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 0d0807814b162e5292bdebb93d2ee8fbbf969ccc Merge: 8c25d964e83777 fac62e76b87029 Author: Arnd Bergmann Date: Tue Jul 22 22:56:16 2025 +0200 Merge tag 'at91-defconfig-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/defconfig Microchip AT91 defconfig updates for v6.17 This update includes: - the WILC1000 SDIO module * tag 'at91-defconfig-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: configs: sama5_defconfig: Select CONFIG_WILC1000_SDIO Link: https://lore.kernel.org/r/20250721100904.568575-1-claudiu.beznea@tuxon.dev Signed-off-by: Arnd Bergmann commit 5b8141596b06fba7313cdfbd5f589649d7fde662 Merge: 9841d92754d0f3 9f35ab0e53ccbe Author: Arnd Bergmann Date: Tue Jul 22 22:47:47 2025 +0200 Merge tag 'qcom-drivers-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers Qualcomm driver updates for v6.17 Perform input validation in the MDT loader, as this was not properly done in the non-remoteproc cases. Fix endian issues in the QMI encoder/decoder. Support reading DDR statistic using the Qualcomm stats driver. Add support for reading TME firmware details to the socinfo driver. Document the Kryo 470 CPU, and add SM7150 to the DCC to DeviceTree bindings. * tag 'qcom-drivers-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() dt-bindings: sram: qcom,imem: Add a number of missing compatibles dt-bindings: arm: cpus: Add Kryo 470 CPUs dt-bindings: sram: qcom,imem: Add the SM7150 compatible dt-bindings: soc: qcom: aoss-qmp: Add the SM7150 compatible dt-bindings: soc: qcom,dcc: Add the SM7150 compatible soc: qcom: socinfo: Add support to retrieve TME build details soc: qcom: fix endianness for QMI header soc: qcom: QMI encoding/decoding for big endian dt-bindings: soc: qcom: add qcom,qcs615-imem compatible soc: qcom: qcom_stats: Add QMP support for syncing ddr stats soc: qcom: qcom_stats: Add support to read DDR statistic soc: qcom: mdt_loader: Actually use the e_phoff soc: qcom: mdt_loader: Rename mdt_phdr_valid() soc: qcom: mdt_loader: Ensure we don't read past the ELF header Link: https://lore.kernel.org/r/20250715021454.14516-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 9841d92754d0f3846977a39844c3395ee2463381 Merge: 1c37b63aab4753 93a7aedc4cc447 Author: Arnd Bergmann Date: Tue Jul 22 22:46:59 2025 +0200 Merge tag 'memory-controller-drv-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers Memory controller drivers for v6.17 1. Several cleanups: Use dev_fwnode() in OMAP GPMX, convert arm,pl172.txt DT bindings to DT schema, use syscon_regmap_lookup_by_phandle_args() wrapper, correct kerneldoc. 2. Mediatek MT8186 SMI: Extend hardware bandwidth limits to fix VENC hardware during stress testing. 3. Broadcom brcmstb_memc: Add additional fallback compatible and simplify device driver matching. The change comes from Broadcom SoC maintainer (Florian Fainelli), thus its ABI impact is acknowledged. * tag 'memory-controller-drv-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl: dt-bindings: memory: renesas,rzg3e-xspi: Document RZ/V2H(P) and RZ/V2N support memory: brcmstb_memc: Simplify compatible matching dt-bindings: memory-controller: Define fallback compatible memory: omap-gpmx: Use dev_fwnode() memory: mtk-smi: Add ostd setting for mt8186 dt-bindings: memory-controllers: convert arm,pl172.txt to yaml format memory: stm32_omm: Use syscon_regmap_lookup_by_phandle_args memory: emif: Add missing kerneldoc for lpmode Link: https://lore.kernel.org/r/20250715095315.59299-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 28fa0dcb571ab8f3be4d919f0e20e01d4e44bcb1 Author: Michal Simek Date: Tue Jul 22 09:25:40 2025 +0200 dt-bindings: riscv: cpus: Add AMD MicroBlaze V 64bit compatible 32bit version has been added by commit 4a6b93f56296 ("dt-bindings: riscv: cpus: Add AMD MicroBlaze V compatible") but 64bit version also exists and should be covered by binding too. Signed-off-by: Michal Simek Acked-by: Conor Dooley Signed-off-by: Conor Dooley commit 1c37b63aab475349b00bee19e166fea0a851070e Merge: 62bd59ca1c191f 5080cf6339d387 Author: Arnd Bergmann Date: Tue Jul 22 22:45:32 2025 +0200 Merge tag 'imx-drivers-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/drivers i.MX drivers changes for 6.17: - A couple of MAINTAINERS updates - A new bus driver for i.MX AIPSTZ bridge and a follow-up fix from Laurentiu Mihalcea * tag 'imx-drivers-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: bus: imx-aipstz: allow creating pdevs for child buses MAINTAINERS: Update i.MX entry bus: add driver for IMX AIPSTZ bridge MAINTAINERS: add NXP S32G RTC driver Link: https://lore.kernel.org/r/20250713055441.221235-1-shawnguo2@yeah.net Signed-off-by: Arnd Bergmann commit 62bd59ca1c191f68c51932a62dd9f3b1f5b6caec Merge: 27d0ff5a60d666 2401dc4dcdd029 Author: Arnd Bergmann Date: Tue Jul 22 22:44:35 2025 +0200 Merge tag 'tegra-for-6.17-memory' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers memory: tegra: Updates for v6.17-rc1 Enable support for the memory and external memory controllers found on Tegra264. * tag 'tegra-for-6.17-memory' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: memory: tegra: Add Tegra264 MC and EMC support dt-bindings: memory: tegra: Add Tegra264 support Link: https://lore.kernel.org/r/20250711220943.2389322-4-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 27d0ff5a60d666f2ed720405e81d8048898e75fe Merge: 8adc8e1657e198 83f96a7eaaf0e3 Author: Arnd Bergmann Date: Tue Jul 22 22:43:50 2025 +0200 Merge tag 'tegra-for-6.17-firmware' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers firmware: tegra: Updates for v6.17-rc1 Add Tegra264 support for the BPMP, fix some dependency issues and clean up some code using new OF helpers. * tag 'tegra-for-6.17-firmware' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: firmware: tegra: bpmp: Fix build failure for tegra264-only config firmware: tegra: bpmp: Use of_reserved_mem_region_to_resource() for "memory-region" firmware: tegra: bpmp: Add support on Tegra264 firmware: tegra: Fix IVC dependency problems Link: https://lore.kernel.org/r/20250711220943.2389322-2-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit e612423be33465d2b9822bf09e03d4e6c165e384 Author: Marc Zyngier Date: Tue Jul 8 18:34:04 2025 +0100 cpu/hotplug: Remove unused cpuhp_state CPUHP_PCI_XGENE_DEAD Now that the XGene MSI driver has been mostly rewritten and doesn't use the CPU hotplug infrastructure, CPUHP_PCI_XGENE_DEAD is unused. Remove it to reduce the size of cpuhp_hp_states[]. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-14-maz@kernel.org commit 6aceb36f17abf801000835763df7c64a4f11f46d Author: Marc Zyngier Date: Tue Jul 8 18:34:03 2025 +0100 PCI: xgene-msi: Restructure handler setup/teardown Another utterly pointless aspect of the xgene-msi driver is that it is built around CPU hotplug. Which is quite amusing since this is one of the few arm64 platforms that, by construction, cannot do CPU hotplug in a supported way (no EL3, no PSCI, no luck). Drop the CPU hotplug nonsense and just setup the IRQs and handlers in a less overdesigned way, grouping things more logically in the process. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-13-maz@kernel.org commit cd5ffaf2b1a85f507e668b773575baf77aa6a6d3 Author: Marc Zyngier Date: Tue Jul 8 18:34:02 2025 +0100 PCI: xgene-msi: Probe as a standard platform driver Now that we have made the dependency between the PCI driver and the MSI driver explicit, there is no need to use subsys_initcall() as a probing hook, and we can rely on builtin_platform_driver() instead. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-12-maz@kernel.org commit 3cc8f625e4c6a0e9f936da6b94166e62e387fe1d Author: Marc Zyngier Date: Tue Jul 8 18:34:01 2025 +0100 PCI: xgene-msi: Resend an MSI racing with itself on a different CPU Since changing the affinity of an MSI really is about changing the target address and that it isn't possible to mask an individual MSI, it is completely possible for an interrupt to race with itself, usually resulting in a lost interrupt. Paper over the design blunder by informing the core code of this sad state of affairs. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-11-maz@kernel.org commit 17c1f960cbf0b93ba22e2d619718343fbdf819ab Author: Marc Zyngier Date: Tue Jul 8 18:34:00 2025 +0100 PCI: xgene-msi: Sanitise MSI allocation and affinity setting Plugging a device that doesn't use managed affinity on an XGene-1 machine results in messages such as: genirq: irq_chip PCI-MSIX-0000:01:00.0 did not update eff. affinity mask of irq 39 As it turns out, the driver was never updated to populate the effective affinity on irq_set_affinity() call, and the core code is prickly about that. But upon further investigation, it appears that the driver keeps repainting the hwirq field of the irq_data structure as a way to track the affinity of the MSI, something that is very much frowned upon as it breaks the fundamentals of an IRQ domain (an array indexed by hwirq). Fixing this results more or less in a rewrite of the driver: - Define how a hwirq and a CPU affinity map onto the MSI termination registers - Allocate a single entry in the bitmap per MSI instead of *8* - Correctly track CPU affinity - Fix the documentation so that it actually means something (to me) - Use standard bitmap iterators - and plenty of other cleanups With this, the driver behaves correctly on my vintage Mustang board. Signed-off-by: Marc Zyngier [lpieralisi: replaced open coded GENMASK(6, 4) with MSInRx_HWIRQ_MASK] Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-10-maz@kernel.org commit 011f4fc1e8debaf9e749c20bfabc08a180870722 Author: Marc Zyngier Date: Tue Jul 8 18:33:59 2025 +0100 PCI: xgene-msi: Get rid of intermediate tracking structure The xgene-msi driver uses an odd construct in the form of an intermediate tracking structure, evidently designed to deal with multiple instances of the MSI widget. However, the existing HW only has one set, and it is obvious that there won't be new HW coming down that particular line. Simplify the driver by using a bit of pointer arithmetic instead, directly tracking the interrupt and avoiding extra memory allocation. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-9-maz@kernel.org commit c9c1578f11af7ebfb62ff683be638ba6f7a9cb44 Author: Marc Zyngier Date: Tue Jul 8 18:33:58 2025 +0100 PCI: xgene-msi: Use device-managed memory allocations Since the MSI driver is probed as a platform device, there is no reason to not use device-managed allocations. That's including the top-level bookkeeping structure, which is better dynamically allocated than being static. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-8-maz@kernel.org commit 0756244d4cbcd9b1403a39e1e719b9b9bcae3aff Author: Marc Zyngier Date: Tue Jul 8 18:33:57 2025 +0100 PCI: xgene-msi: Drop superfluous fields from xgene_msi structure The xgene_msi structure remembers both the of_node of the device and the number of CPUs. All of which are perfectly useless. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-7-maz@kernel.org commit d17e3f8a933f1e467e2cfbe144ebefc2943a019f Author: Marc Zyngier Date: Tue Jul 8 18:33:56 2025 +0100 PCI: xgene-msi: Make per-CPU interrupt setup robust The way the per-CPU interrupts are dealt with in the XGene MSI driver isn't great: - the affinity is set after the interrupt is enabled - nothing prevents userspace from moving the interrupt around - the affinity setting code pointlessly allocates memory - the driver checks for conditions that cannot possibly happen Address all of this in one go, resulting in slightly simpler setup code. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-6-maz@kernel.org commit fddf72ed7b52c91da37fe5f1d4faed11251b714f Author: Marc Zyngier Date: Tue Jul 8 18:33:55 2025 +0100 PCI: xgene: Drop XGENE_PCIE_IP_VER_UNKN XGENE_PCIE_IP_VER_UNKN is only refered to when probing for the original XGene PCIe implementation, and get immediately overridden if the device has the "apm,xgene-pcie" compatible string. Given that the only way to get there is by finding this very string in the DT, it is obvious that we will always overwrite the version with XGENE_PCIE_IP_VER_1. Drop the whole thing. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-5-maz@kernel.org commit e3ac25cc95b814723678c3611591f2b85c731c27 Author: Marc Zyngier Date: Tue Jul 8 18:33:54 2025 +0100 PCI: xgene: Drop useless conditional compilation pci-xgene.c only gets compiled if CONFIG_PCI_XGENE is selected. It is therefore pointless to check for CONFIG_PCI_XGENE inside the driver. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-4-maz@kernel.org commit 0d402bd41a075178a9a30d5716abbfda3f123240 Author: Marc Zyngier Date: Tue Jul 8 18:33:53 2025 +0100 PCI: xgene: Defer probing if the MSI widget driver hasn't probed yet As a preparatory work to make the XGene MSI driver probe less of a sorry hack, make the PCI driver check for the availability of the MSI parent domain, and defer the probing otherwise. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Link: https://lore.kernel.org/r/20250708173404.1278635-3-maz@kernel.org commit 2c9e7f857400ffecf16c49bc6d98ac43d4129fef Author: Marc Zyngier Date: Tue Jul 8 18:33:52 2025 +0100 genirq: Teach handle_simple_irq() to resend an in-progress interrupt It appears that the defect outlined in 9c15eeb5362c4 ("genirq: Allow fasteoi handler to resend interrupts on concurrent handling") also affects some other less stellar MSI controllers, this time using the handle_simple_irq() flow. Teach this flow about irqd_needs_resend_when_in_progress(). Given the invasive nature of this workaround, only this flow is updated. Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Signed-off-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Link: https://lore.kernel.org/r/20250708173404.1278635-2-maz@kernel.org commit dceb36675b5375955cdbd44ad693c080359fecb8 Merge: c5b9bff35a9823 a6beb2bdb0db05 Author: Arnd Bergmann Date: Tue Jul 22 22:30:38 2025 +0200 Merge branch 'newsoc/axiado' into soc/newsoc Support for the AX3000 SoC, from Harshit Shah : The AX3000 is a multi-core system-on-chip featuring four ARM Cortex-A53 cores, secure vault, hardware firewall, and AI acceleration engines. This initial support enables basic bring-up of the SoC and evaluation platform with CPU, timer, UART, and I3C functionality. The series begins by adding the "axiado" vendor prefix and compatible strings for the SoC and board. It then introduces the device tree files and minimal ARCH_AXIADO platform support in arm64. * newsoc/axiado: MAINTAINERS: Add entry for Axiado arm64: defconfig: enable the Axiado family arm64: dts: axiado: Add initial support for AX3000 SoC and eval board arm64: add Axiado SoC family dt-bindings: i3c: cdns: add Axiado AX3000 I3C controller dt-bindings: serial: cdns: add Axiado AX3000 UART controller dt-bindings: gpio: cdns: add Axiado AX3000 GPIO variant dt-bindings: gpio: cdns: convert to YAML dt-bindings: arm: axiado: add AX3000 EVK compatible strings dt-bindings: vendor-prefixes: Add Axiado Corporation commit a6beb2bdb0db055f7402ed90e37fae99d68ff92c Author: Harshit Shah Date: Tue Jul 22 13:15:38 2025 -0700 MAINTAINERS: Add entry for Axiado Add entry for Axiado maintainer and related files Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit 525f46c7e3b7eba341b3cbd324266cd8032a0c87 Author: Harshit Shah Date: Tue Jul 22 13:15:37 2025 -0700 arm64: defconfig: enable the Axiado family Enable the Axiado SoC family in the arm64 defconfig. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit 1f70557790011fbf6f6ba4dd85910e427e12d2f8 Author: Harshit Shah Date: Tue Jul 22 13:15:36 2025 -0700 arm64: dts: axiado: Add initial support for AX3000 SoC and eval board Add initial device tree support for the AX3000 SoC and its evaluation platform. The AX3000 is a multi-core SoC featuring 4 Cortex-A53 cores, Secure Vault, AI Engine and Firewall. It adds support for Cortex-A53 CPUs, timer, UARTs, and I3C controllers on the AX3000 evaluation board. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit 729b770bb454b1adf59fdada6c901cd61c413ce6 Author: Harshit Shah Date: Tue Jul 22 13:15:35 2025 -0700 arm64: add Axiado SoC family Add ARCH_AXIADO for the support of the Axiado SoC for arm64 architecture. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit 678fefdfe9de73e8043b971a217436f82d93f6e8 Author: Harshit Shah Date: Tue Jul 22 13:15:34 2025 -0700 dt-bindings: i3c: cdns: add Axiado AX3000 I3C controller Add binding for AX3000 I3C controller. So far, no changes known, so it can fallback to default compatible. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit 7346be495b9ad23077d8fbfd953f341c92027067 Author: Harshit Shah Date: Tue Jul 22 13:15:33 2025 -0700 dt-bindings: serial: cdns: add Axiado AX3000 UART controller Add binding for AX3000 UART controller. So far, no changes known, so it can fallback to default compatible. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit 4c5250ebc3e4ae49934069968beffbfaa83fb734 Author: Harshit Shah Date: Tue Jul 22 13:15:32 2025 -0700 dt-bindings: gpio: cdns: add Axiado AX3000 GPIO variant Add binding for Axiado AX3000 GPIO controller. So far, no changes are known, so it can fallback to default compatible. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit 36f42234497845bfa45ca13e8a683dbffaa09a83 Author: Harshit Shah Date: Tue Jul 22 13:15:31 2025 -0700 dt-bindings: gpio: cdns: convert to YAML Convert Cadence family GPIO controller bindings to DT schema. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit c1fbbb76ecc9bea01962876c60a5e1c55d82714e Author: Harshit Shah Date: Tue Jul 22 13:15:30 2025 -0700 dt-bindings: arm: axiado: add AX3000 EVK compatible strings Add device tree binding schema for Axiado platforms, specifically the AX3000 SoC and its associated evaluation board. This binding will be used for the board-level DTS files that support the AX3000 platforms. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit ffab86698c260414bc4218e7c89dc0531d5dd159 Author: Harshit Shah Date: Tue Jul 22 13:15:29 2025 -0700 dt-bindings: vendor-prefixes: Add Axiado Corporation Link: https://axiado.com Acked-by: Rob Herring (Arm) Signed-off-by: Harshit Shah Signed-off-by: Arnd Bergmann commit 8c25d964e8377768e6d9edfc132d045ca34f9f82 Merge: c18b21c5d5a3d9 bd4d5d3faadcdf Author: Arnd Bergmann Date: Tue Jul 22 22:27:44 2025 +0200 Merge tag 'riscv-config-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/defconfig RISC-V soc defconfig for v6.17 spacemit: Enable sdhci and pwm drivers for the k1 soc in defconfig, the former as a builtin and the latter a module. starfive: Remove a no-longer required config for the starfive sound driver. Signed-off-by: Conor Dooley * tag 'riscv-config-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: defconfig: spacemit: enable sdhci driver for K1 SoC riscv: defconfig: Enable PWM support for SpacemiT K1 SoC riscv: defconfig: Remove CONFIG_SND_SOC_STARFIVE=m Link: https://lore.kernel.org/r/20250716-defrost-regime-20a55ed925ad@spud Signed-off-by: Arnd Bergmann commit c18b21c5d5a3d993f47e7d7b3cfe413235364287 Merge: 0570e9064c5360 0c712465867788 Author: Arnd Bergmann Date: Tue Jul 22 22:26:11 2025 +0200 Merge tag 'imx-defconfig-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/defconfig i.MX defconfig changes for 6.17: - Enable S32G RTC driver as module in arm64 defconfig - Enable drivers used by imx28-amarula-rmm board in mxs_defconfig - Enable INPUT_PWM_BEEPER, USB_HSIC_USB3503 and BT_HCIUART_BCM in imx_v6_v7_defconfig * tag 'imx-defconfig-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: ARM: imx_v6_v7_defconfig: select CONFIG_USB_HSIC_USB3503 ARM: imx_v6_v7_defconfig: select CONFIG_INPUT_PWM_BEEPER ARM: imx_v6_v7_defconfig: cleanup with savedefconfig ARM: mxs_defconfig: select new drivers used by imx28-amarula-rmm ARM: mxs_defconfig: Cleanup mxs_defconfig arm64: defconfig: add S32G RTC module support ARM: imx_v6_v7_defconfig: Select BT_HCIUART_BCM Link: https://lore.kernel.org/r/20250713055441.221235-5-shawnguo2@yeah.net Signed-off-by: Arnd Bergmann commit 0570e9064c5360f75b2c12f5b58de839c63deb0c Merge: acbf491e07add6 bd3b8e53e244fe Author: Arnd Bergmann Date: Tue Jul 22 22:23:35 2025 +0200 Merge tag 'tegra-for-6.17-arm64-defconfig' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/defconfig arm64: tegra: Default configuration updates for v6.17-rc1 Enable the HSP and BPMP via the configuration instead of selecting them, which can lead to problems. Also enable support for Tegra241, which was never done after support for it was added, and Tegra264. * tag 'tegra-for-6.17-arm64-defconfig' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: defconfig: Enable Tegra241 and Tegra264 arm64: defconfig: Enable Tegra HSP and BPMP Link: https://lore.kernel.org/r/20250711220943.2389322-8-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 8adc8e1657e19849c02c764e371478a05ca83c57 Author: Li Jun Date: Wed Jun 4 16:17:12 2025 +0800 bus: del unnecessary init var The compiler generates initialization instructions, which consume additional CPU cycles. the sysc_clockdomain_init should assign a value to 'error' before it is read.so the var don't need init to 0. Signed-off-by: Li Jun Link: https://lore.kernel.org/r/20250604081712.119523-1-lijun01@kylinos.cn Signed-off-by: Kevin Hilman Signed-off-by: Arnd Bergmann commit acbf491e07add62ce7e820552432a14d9a53ab67 Author: Kory Maincent Date: Fri Jun 20 10:15:56 2025 +0200 arm: multi_v7_defconfig: Enable TPS65219 regulator Enable the TPS65219 regulator in the defconfig, as the TPS65214 variant is used by the newly introduced BeagleBoard Green Eco board. Signed-off-by: Kory Maincent Reviewed-by: Andreas Kemnade Tested-by: Judith Mendez Link: https://lore.kernel.org/r/20250620-bbg-v5-5-84f9b9a2e3a8@bootlin.com Signed-off-by: Kevin Hilman Signed-off-by: Arnd Bergmann commit d50faff722189fa8964871347d55bca53548b659 Author: Kory Maincent Date: Fri Jun 20 10:15:55 2025 +0200 arm: omap2plus_defconfig: Enable TPS65219 regulator Enable the TPS65219 regulator in the defconfig, as the TPS65214 variant is used by the newly introduced BeagleBoard Green Eco board. Reviewed-by: Andreas Kemnade Signed-off-by: Kory Maincent Tested-by: Judith Mendez Link: https://lore.kernel.org/r/20250620-bbg-v5-4-84f9b9a2e3a8@bootlin.com Signed-off-by: Kevin Hilman Signed-off-by: Arnd Bergmann commit a4bb91d128929595160faf86f0add660aeb07c36 Merge: 7097d52d558426 28254bcf96bf93 Author: Arnd Bergmann Date: Tue Jul 22 22:20:16 2025 +0200 Merge tag 'mvebu-dt-6.17-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/dt mvebu dt for 6.17 (part 1) Use recent scl/sda gpio bindings on kirkwood boards (Keymile ones) * tag 'mvebu-dt-6.17-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: ARM: dts: marvell: kirkwood: use recent scl/sda gpio bindings Link: https://lore.kernel.org/r/87ms94xzr8.fsf@BLaptop.bootlin.com Signed-off-by: Arnd Bergmann commit 7097d52d558426d25a7bd1965e19ae8bdd5a58a8 Merge: 7723866e8b0af1 587c1c00f75565 Author: Arnd Bergmann Date: Tue Jul 22 22:19:54 2025 +0200 Merge tag 'amlogic-arm64-dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt Amlogic ARM64 DT for v6.17: - Align wifi node name with bindings - Add pinctrl nodes for Amlogic S7/S7D/S6 nodes - Enable the NPU nodes on Alta & VIM3 - New boards: - Ugoos AM3 * tag 'amlogic-arm64-dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/amlogic/linux: arm64: dts: amlogic: Enable the npu node for Alta and VIM3 dts: arm64: amlogic: add S6 pinctrl node dts: arm64: amlogic: add S7D pinctrl node dts: arm64: amlogic: add S7 pinctrl node arm64: dts: amlogic: Add Ugoos AM3 dt-bindings: arm: amlogic: Add Ugoos AM3 arm64: dts: amlogic: Align wifi node name with bindings Link: https://lore.kernel.org/r/3d93b621-9544-4a68-85db-6f87a9e8fa5c@linaro.org Signed-off-by: Arnd Bergmann commit 7723866e8b0af134a6a69759707f378754908597 Merge: 1037b300df2a5a 7de0d60f6345e7 Author: Arnd Bergmann Date: Tue Jul 22 22:19:30 2025 +0200 Merge tag 'qcom-arm64-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm64 DeviceTree updates for v6.17 79b896e7da7e arm64: dts: qcom: msm8976-longcheer-l9360: Add initial device tree 6516961352a1 arm64: dts: qcom: Add support for X1-based Asus Zenbook A14 The DB410c D3 camera mezzanine is converted to an overlay. On MSM8976 SDC2 pinctrl definitions are introduced and BLSP DMA controller is marked to be managed by another entity. Add camera subsystem on the QCM2290 platform. Add and enable remoteproc and related devices on QCS615. Add and enable Video encoder/decoder on QCS8300 and SA8775P. Also on SA8775P add CPU OPP tables for scaling DDR/L3 bandwidth based on CPU frequency, add L3 interconnect definitions, DSI and video encoder/decoder support. Enable the SLPI remoteproc on SDM850-based Lenovo Yoga C630. On SM6350, add the video clock controller, APR and some audio related services. Describe the camera subsystem on SM8550 and add Iris video encoder/decoder node for SM8650. On SM8750 introduce UFS and Soundwire support, enable these and describe the sound hardware on MTP and QRD. Add camera clock controller on SC8180X. On X Elite, for the Dell XPS13, add WiFi and Bluetooth pwrseq and enable the fingerprint sensor. For HP Omnibook X14 USB1 SS1 SBU mux and do some misc cleanup. Replace the thermal zones inherited from X Elite with X Plus-specific ones. Add missing interrupts and clean up unrelated clocks for PCIe controllers across a variety of platforms. * tag 'qcom-arm64-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (67 commits) arm64: dts: qcom: sm8150: Drop unrelated clocks from PCIe hosts arm64: dts: qcom: sc8180x: Drop unrelated clocks from PCIe hosts arm64: dts: qcom: x1-asus-zenbook: support sound arm64: dts: qcom: x1-asus-zenbook: fixup GPU nodes arm64: dts: qcom: sm6115: add debug UART pins arm64: dts: qcom: sm8650: add iris DT node arm64: dts: qcom: msm8976-longcheer-l9360: Add initial device tree arm64: dts: qcom: msm8976: Add sdc2 GPIOs dt-bindings: arm: qcom: Add MSM8976 BQ Aquaris X5 Plus arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc arm64: dts: qcom: sm8550: Add support for camss arm64: dts: qcom: qcs615: disable the CTI device of the camera block arm64: dts: qcom: qcs615-ride: enable remoteprocs arm64: dts: qcom: qcs615: add ADSP and CDSP nodes arm64: dts: qcom: qcs615: Add IMEM and PIL info region arm64: dts: qcom: qcs615: Add mproc node for SEMP2P arm64: dts: qcom: Add support for X1-based Asus Zenbook A14 arm64: dts: qcom: sc7180: Expand IMEM region arm64: dts: qcom: sdm845: Expand IMEM region ... Link: https://lore.kernel.org/r/20250716031059.76348-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 1037b300df2a5a6ef72df3f7610ed243aac50bf6 Merge: c522d00e1b4b00 d96d9ac8d2f197 Author: Arnd Bergmann Date: Tue Jul 22 21:54:29 2025 +0200 Merge tag 'sunxi-dt-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner device tree changes for 6.17 This branch includes a change shared with the clk tree for adding the missing PPU0 reset on the A523. The PM domain DT binding immutable branch is also included, which brings in v6.16-rc2, as well as PM domain bindings for other platforms. Other changes include: - RGB666 LCD pin definitions for the V3s PE pins and V3 PD pins - node order fixes for the A523 dtsi - UART1 pin definitions for A523 - Allwinner board DT binding cleanup - EMAC support on A100/A133 - Enabled on the Liontron H-A133L board - SID efuse, power controllers and GPU added for A523 - A523 GPU enabled on all existing boards New boards: - Xunlong OrangePi 4A with the Allwinner T527 SoC. * tag 'sunxi-dt-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: (21 commits) arm64: dts: allwinner: a523: enable Mali GPU for all boards arm64: dts: allwinner: a523: add Mali GPU node arm64: dts: allwinner: a523: Add power controller device nodes dt-bindings: power: Add A523 PPU and PCK600 power controllers arm64: dts: allwinner: A523: Add SID controller node arm64: dts: allwinner: a133-liontron-h-a133l: Add Ethernet support arm64: dts: allwinner: a100: Add EMAC support arm64: dts: allwinner: a100: Add pin definitions for RGMII/RMII dt-bindings: arm: sunxi: Combine board variants into enums dt-bindings: power: qcom,rpmpd: document the Milos RPMh Power Domains arm64: dts: allwinner: t527: Add OrangePi 4A board arm64: dts: allwinner: a523: Add UART1 pins arm64: dts: allwinner: a523: Move rgmii0 pins to correct location arm64: dts: allwinner: a523: Move mmc nodes to correct position dt-bindings: arm: sunxi: Add Xunlong OrangePi 4A board ARM: dts: sun8i: v3: Add RGB666 LCD PD pins definition ARM: dts: sun8i: v3s: Add RGB666 LCD PE pins definition dt-bindings: reset: sun55i-a523-r-ccu: Add missing PPU0 reset dt-bindings: firmware: thead,th1520: Add resets for GPU clkgen dt-bindings: rockchip: pmu: Add compatible for RK3528 ... Link: https://lore.kernel.org/r/aHaQFe3Lr8Qzyb1M@wens.tw Signed-off-by: Arnd Bergmann commit c522d00e1b4b00c5224c2acb9c2738bcc9c04ff5 Merge: 7824d9e7f9bccc 974e6cfd8d7b61 Author: Arnd Bergmann Date: Tue Jul 22 21:52:46 2025 +0200 Merge tag 'ti-k3-dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt TI K3 device tree updates for v6.17 Generic fixes and cleanups: * Enable overlays for all DTB files * Enable Schmitt Trigger by default in K3 pinctrl SoC specific changes: AM62D * Add new SoC support and pinctrl entries AM62 * Remove eMMC High Speed DDR support * Move eMMC pinmux to top level board file J784S4/J742S2 * Add Power on BIST (PBSIT) nodes * Add ACSPCIE1 node J721S2 * Add McASP support J722S * Add alernate audio-refclk0 node Board changes: Multiple boards * Bootphase tags for Ethernet boot support AM62D2-EVM * Add new board support AM62A7-SK * Fix pinmux for main_uart1 * Add SPI NAND support AM62P * Fix PWM_3_DSI GPIO direction, SD pull up, I2C ups on AM62P-Verdin * Add bootph-all property for Ethernet boot AM62-Verdin * Enable pull-ups on I2C buses AM654-base-board * Add boot phase tags for various bootmodes AM64 * Add boot phase tag PCIe EP boot * Fix PRU-ICSSG Ethernet ports on AM642-PhyBoard-Electra AM69-SK * Add idle-states for remaining SERDES instances J722S-EVM * Fix USB gpio-hog level for Type-C * tag 'ti-k3-dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: (33 commits) arm64: dts: ti: k3-am69-sk: Add idle-states for remaining SERDES instances arm64: dts: ti: k3-am62a7-sk: add boot phase tags arm64: dts: ti: k3-am654-base-board: add boot phase tags arm64: dts: ti: k3-am65: add boot phase tags arm64: dts: ti: k3-am69-sk: Add bootph-all property to enable Ethernet boot arm64: dts: ti: k3-j722s-evm: Add bootph-all property to enable Ethernet boot arm64: dts: ti: k3-am62p5-sk: Add bootph-all property to enable Ethernet boot arm64: dts: ti: k3-am68-sk-base-board: Add bootph-all property to enable Ethernet boot arm64: dts: ti: Add support for AM62D2-EVM arm64: dts: ti: Add pinctrl entries for AM62D2 family of SoCs dt-bindings: arm: ti: Add AM62D2 SoC and Boards arm64: dts: ti: Add bootph property to nodes at source for am62a arm64: dts: ti: k3-am62p-verdin: Adjust temperature trip points arm64: dts: ti: k3-am62p-j722s: Enable freq throttling on thermal alert arm64: dts: ti: k3-j784s4-j742s2-main-common: Add PBIST_14 node dt-bindings: soc: ti: bist: Add BIST for K3 devices arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 arm64: dts: ti: Enable overlays for all DTB files ... Link: https://lore.kernel.org/r/a0401460-8c67-4c29-a6cf-fa4bdf33bc7d@ti.com Signed-off-by: Arnd Bergmann commit 7824d9e7f9bcccf3eec46f314e990f0265adc533 Merge: 4ec8959278a707 fb84f0ec527c50 Author: Arnd Bergmann Date: Tue Jul 22 21:46:27 2025 +0200 Merge tag 'qcom-arm32-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt Qualcomm Arm32 DeviceTree updates for v6.17 Add aliases for MMC controllers on MSM8974, enable USB charging on the Sony Xperia Rhine platform and add new DeviceTree for the Sony Xperia Z Ultra device. Tidy up interrupts specifiers on MSM8960, by using macro constants. * tag 'qcom-arm32-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: ARM: dts: qcom: msm8974-sony-xperia-rhine: Add alias for mmc0 & mmc1 ARM: dts: qcom: msm8974-hammerhead: Add alias for mmc0 ARM: dts: qcom: msm8974-oneplus-bacon: Add alias for mmc0 ARM: dts: qcom: Add initial support for Sony Xperia Z Ultra (togari) dt-bindings: arm: qcom: Add Sony Xperia Z Ultra (togari) ARM: dts: qcom: msm8974-sony-xperia-rhine: Move camera buttons to amami & honami ARM: dts: qcom: msm8974-sony-xperia-rhine: Enable USB charging ARM: dts: qcom: msm8960: use macros for interrupts ARM: dts: qcom: Align wifi node name with bindings Link: https://lore.kernel.org/r/20250715021838.14751-1-andersson@kernel.org Signed-off-by: Arnd Bergmann commit 4ec8959278a707c5f26c29c218a4578308572656 Merge: 99cb440b6e8e85 57fa4ba6d0a466 Author: Arnd Bergmann Date: Tue Jul 22 21:45:11 2025 +0200 Merge tag 'spacemit-dt-for-6.17-1' of https://github.com/spacemit-com/linux into soc/dt RISC-V SpacemiT DT changes for 6.17 - Add DMA translation buses - Add PWM support - Add Reset support - Add eMMC node * tag 'spacemit-dt-for-6.17-1' of https://github.com/spacemit-com/linux: riscv: dts: spacemit: Move eMMC under storage-bus for K1 riscv: dts: spacemit: Move UARTs under dma-bus for K1 riscv: dts: spacemit: Add DMA translation buses for K1 riscv: dts: spacemit: add pwm14_1 pinctrl setting riscv: dts: spacemit: add PWM support for K1 SoC riscv: dts: spacemit: add reset support for the K1 SoC dt-bindings: soc: spacemit: define spacemit,k1-ccu resets riscv: dts: spacemit: enable eMMC for K1 SoC Link: https://lore.kernel.org/r/20250715014214-GYA540030@gentoo Signed-off-by: Arnd Bergmann commit 99cb440b6e8e85e76c429d62bc35c0dc0ed19961 Merge: 1d9026c38e84df f794181b723141 Author: Arnd Bergmann Date: Tue Jul 22 21:43:39 2025 +0200 Merge tag 'imx-bindings-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX dt-bindings changes for 6.17: - New board compatibles for i.MX28 Amarula, Engicam MicroGEA, GOcontroll and phyCORE-i.MX 95 Plus FPSC SoM - A couple of i.MX AIPSTZ bridge related bindings updates from Laurentiu Mihalcea * tag 'imx-bindings-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: dt-bindings: add imx95-libra-rdk-fpsc dt-bindings: arm: fsl: support Engicam MicroGEA GTW board dt-bindings: arm: fsl: support Engicam MicroGEA RMM board dt-bindings: arm: fsl: support Engicam MicroGEA BMM board dt-bindings: dsp: fsl,dsp: document 'access-controllers' property dt-bindings: bus: document the IMX AIPSTZ bridge dt-bindings: arm: fsl: add i.MX28 Amarula rmm board dt-bindings: arm: fsl: Add GOcontroll Moduline Display Link: https://lore.kernel.org/r/20250713055441.221235-2-shawnguo2@yeah.net Signed-off-by: Arnd Bergmann commit 1d9026c38e84df9087a091492c174c9c0b6c8ffd Merge: ced92af976f037 b23de67d4b6996 Author: Arnd Bergmann Date: Tue Jul 22 21:42:23 2025 +0200 Merge tag 'imx-dt-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX ARM device tree changes for 6.17: - New device trees for Engicam MicroGEA-MX6UL and i.MX28 Amarula board - A couple of changes from Bence Csókás to replace license text comment with SPDX identifier for Karo and Gateworks boards - A couple of imx7s-warp updates from Fabio Estevam to improve Bluetooth and Wifi description - A set of dt-schema fixes for VF610 based boards from Frank Li - A couple of imx6ul-kontron-sl-common changes to add SPI NOR partitions and correct QSPI NAND node name - A few other random improvements * tag 'imx-dt-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (21 commits) ARM: dts: imx6-gw: Replace license text comment with SPDX identifier ARM: dts: imx6ul-kontron-sl-common: Fix QSPI NAND node name ARM: dts: imx6ul-kontron-sl-common: Add SPI NOR partitions ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface ARM: dts: imx6-karo: Replace license text comment with SPDX identifier ARM: dts: imx6ul: support Engicam MicroGEA GTW board ARM: dts: imx6ul: support Engicam MicroGEA RMM board ARM: dts: imx6ul: support Engicam MicroGEA BMM board ARM: dts: imx6ul: support Engicam MicroGEA-MX6UL SoM ARM: dts: mxs: support i.MX28 Amarula rmm board ARM: dts: imx28: add pwm7 muxing options ARM: dts: vf: vf610-zii-cfu1: rename node name *-gpio to *-gpios ARM: dts: vf: vf-colibri-eval-v3: add power-supply for edt,et057090dhu ARM: dts: vf: rename io-expander@20 to pinctrl@20 ARM: dts: vf: remove redundant layer under iomux ARM: dts: vf: remove redundant pinctrl-names ARM: dts: vf: remove reg property for arm pmu ARM: dts: vfxxx: Correctly use two tuples for timer address ARM: dts: add ngpios for vf610 compatible gpio controllers ARM: dts: imx7s-warp: Improve the Wifi description ... Link: https://lore.kernel.org/r/20250713055441.221235-3-shawnguo2@yeah.net Signed-off-by: Arnd Bergmann commit ced92af976f037443e8649c5b0617542b04d7914 Merge: 0acf88fe853a00 4f25d7f1439f12 Author: Arnd Bergmann Date: Tue Jul 22 21:40:16 2025 +0200 Merge tag 'imx-dt64-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into soc/dt i.MX arm64 device tree changes for 6.17: - New board support: GOcontroll Moduline based devices, phyCORE-i.MX 95 Plus FPSC SoM and base boards, i.MX93 phycore overlays - A few i.MX8M changes from Adam Ford to add DMA configuration for UART2, set up VPU clocks for nominal and overdrive mode, improve HS400 USDHC clock speed - Several sets of changes from Alexander Stein to add EASRC support for tqma8mnql and tqma8mpql board, add missing DMA entries for I2C & LPUART on ls1043a and ls1046a, enable SFP interface for tqmls1043a and tqmls1046a, etc. - A series from Clark Wang to improve Ethernet support for i.MX93, removing eee-broken-1000t for eqos node, reducing the driving strength of net RXC/TXC, etc. - A few i.MX95 and i.MX8Q changes from Frank Li to add missing devices for EVK board and enable camera support - A couple of changes from Laurentiu Mihalcea to support WM8962 audio codec for imx8qxp-mek and imx8qm-mek board - A number of changes from Shengjiu Wang to improve various audio support for imx943-evk and imx8mp-evk - A series from Tim Harvey to increase HS400 USDHC clock speed for Gateworks i.MX8M Venice devices - Many other random improvements and cleanups on various boards * tag 'imx-dt64-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux: (85 commits) arm64: dts: imx8q: add camera ov5640 support for imx8qm-mek and imx8qxp-mek arm64: dts: freescale: imx8mp-toradex-smarc: remove gpio hog arm64: dts: freescale: imx8mp-toradex-smarc: fix lvds dsi mux gpio arm64: dts: imx8mm-venice-gw7904: Increase HS400 USDHC clock speed arm64: dts: imx8mm-venice-gw7903: Increase HS400 USDHC clock speed arm64: dts: imx8mn-venice-gw7902: Increase HS400 USDHC clock speed arm64: dts: imx8mm-venice-gw7902: Increase HS400 USDHC clock speed arm64: dts: imx8mm-venice-gw7901: Increase HS400 USDHC clock speed arm64: dts: imx8mp-venice-gw702x: Increase HS400 USDHC clock speed arm64: dts: imx8mm-venice-gw700x: Increase HS400 USDHC clock speed arm64: dts: lx2160a-qds: add the two on-board RGMII PHYs arm64: dts: add imx95-libra-rdk-fpsc board arm64: dts: imx8q: add linux,cma node for imx8qm-mek and imx8qxp-mek arm64: dts: imx8: add capture controller for i.MX8's img subsystem arm64: dts: imx95: add jpeg encode and decode nodes arm64: dts: imx93-phyboard-nash: Add PEB-WLBT-07 overlay arm64: dts: imx93-phyboard-segin: Add PEB-WLBT-05 overlay arm64: dts: imx93-phyboard-segin: Add PEB-EVAL-01 overlay arm64: dts: imx93-phycore-som: Add RPMsg overlay arm64: dts: freescale: tqmls10xx: Add vdd-supply for spi-nor flash ... Link: https://lore.kernel.org/r/20250713055441.221235-4-shawnguo2@yeah.net Signed-off-by: Arnd Bergmann commit 0acf88fe853a00d465bc7509f1acfeb346e41761 Merge: 3116e1d5c145fa 203b862057d08f Author: Arnd Bergmann Date: Tue Jul 22 21:39:34 2025 +0200 Merge tag 'socfpga_dts_updates_for_v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt SoCFPGA DTS updates for v6.17 - Fix dt_binding_check warnings - agilex - f2s-free-clk - stratix10 - rstmgr - swvp - remove phy-addr, cpu1-start-addr and altr,modrst-offset * tag 'socfpga_dts_updates_for_v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: arm64: dts: altera: socfpga_stratix10: update internal oscillators arm64: dts: socfpga: swvp: remove phy-addr in the GMAC node arm64: dts: socfpga: swvp: remove cpu1-start-addr arm64: dts: socfpga: swvp: remove altr,modrst-offset arm64: dts: socfpga: stratix10: fix dtbs_check for rstmgr arm64: dts: socfpga: agilex: fix dtbs_check warning for f2s-free-clk Link: https://lore.kernel.org/r/20250712123248.16981-1-dinguyen@kernel.org Signed-off-by: Arnd Bergmann commit 3116e1d5c145faf7d39bfba0afd1d22e9546e470 Merge: d8ce23423bb94f d01e4f1e7aa883 Author: Arnd Bergmann Date: Tue Jul 22 21:38:44 2025 +0200 Merge tag 'tegra-for-6.17-arm64-dt' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt arm64: tegra: Changes for v6.17-rc1 Add support for the Tegra264 SoC and the corresponding engineering reference hardware (P3971-0089+P3834-0008). * tag 'tegra-for-6.17-arm64-dt' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Add p3971-0089+p3834-0008 support arm64: tegra: Add memory controller on Tegra264 arm64: tegra: Add Tegra264 support Link: https://lore.kernel.org/r/20250711220943.2389322-7-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit d8ce23423bb94f515264dc583c8930b669595f19 Merge: 8fa90d098aac13 3c2c00572fc3e0 Author: Arnd Bergmann Date: Tue Jul 22 21:37:39 2025 +0200 Merge tag 'tegra-for-6.17-arm-dt' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt ARM: tegra: Device tree changes for v6.17-rc1 Add support for two Tegra30 ASUS devices and enable the embedded controller on Pegatron Chagall. * tag 'tegra-for-6.17-arm-dt' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: chagall: Add embedded controller node ARM: tegra: Add device-tree for Asus Portable AiO P1801-T ARM: tegra: Add device-tree for ASUS VivoTab RT TF600T Link: https://lore.kernel.org/r/20250711220943.2389322-6-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 8fa90d098aac132d91f6a8499827532ca57f3928 Merge: d436d1d5edb306 ad8247beb4c45a Author: Arnd Bergmann Date: Tue Jul 22 21:36:28 2025 +0200 Merge tag 'tegra-for-6.17-dt-bindings' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt dt-bindings: Updates for v6.17-rc1 Add Tegra264 compatible strings for some core components and extend bindings where necessary to accomodate the new hardware generation. Also document some new platforms, for both old and new chips. * tag 'tegra-for-6.17-dt-bindings' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: dt-bindings: arm: tegra: Add Asus Portable AiO P1801-T dt-bindings: arm: tegra: Add Asus VivoTab RT TF600T dt-bindings: Add Tegra264 clock and reset definitions dt-bindings: tegra: Document P3971-0089+P3834-0008 Platform dt-bindings: rtc: tegra: Document Tegra264 RTC dt-bindings: dma: Add Tegra264 compatible string dt-bindings: misc: Document Tegra264 APBMISC compatible dt-bindings: firmware: Document Tegra264 BPMP dt-bindings: mailbox: tegra-hsp: Properly sort compatible string list dt-bindings: mailbox: tegra-hsp: Bump number of shared interrupts dt-bindings: tegra: pmc: Add Tegra264 compatible dt-bindings: memory: tegra: Add Tegra264 support Link: https://lore.kernel.org/r/20250711220943.2389322-3-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit d2755d3cf8578bc8522cfdc2eac05cae73428904 Merge: b586f289109699 90ec89d68ffaf3 Author: Arnd Bergmann Date: Tue Jul 22 21:35:08 2025 +0200 Merge tag 'mvebu-arm-6.17-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/arm mvebu arm for 6.17 (part 1) Use string choices helper in GPIO support code for legacy Orion based platforms. * tag 'mvebu-arm-6.17-1' of https://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu: arm: orion: use string choices helper Link: https://lore.kernel.org/r/87jz48xzpz.fsf@BLaptop.bootlin.com Signed-off-by: Arnd Bergmann commit b586f2891096999b4a1d79efde171db0308fd25a Merge: 686f71a53b4cd3 631ce8f743a5c8 Author: Arnd Bergmann Date: Tue Jul 22 21:34:06 2025 +0200 Merge tag 'ti-k3-config-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/arm TI K3 defconfig updates for v6.17 Cleanup select clauses for ARCH_K3 allow more modular builds * tag 'ti-k3-config-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux: arm64: Kconfig.platforms: remove useless select for ARCH_K3 Link: https://lore.kernel.org/r/5488ccd5-c999-4b72-bfc0-ba94bb9a360d@ti.com Signed-off-by: Arnd Bergmann commit 686f71a53b4cd301299f3cfe28420867fce692a8 Merge: 73bcce043f3ca4 398e67e0f5ae04 Author: Arnd Bergmann Date: Tue Jul 22 21:33:23 2025 +0200 Merge tag 'tegra-for-6.17-arm-core' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/arm ARM: tegra: Core changes for v6.17-rc1 Fixes an issue when copying data to IRAM using memcpy() and use the memcpy_toio() function instead. * tag 'tegra-for-6.17-arm-core' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: Use I/O memcpy to write to IRAM Link: https://lore.kernel.org/r/20250711220943.2389322-5-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 089a60acbd1bf77d01ec086d026a1e124dc003e8 Merge: 0156c22fb0ca86 931837cd924048 Author: Takashi Iwai Date: Tue Jul 22 20:02:13 2025 +0200 Merge branch 'for-linus' into for-next Signed-off-by: Takashi Iwai commit b43cb4ff85da5cf29c4cd351ef1d7dd8210780f7 Author: Myrrh Periwinkle Date: Wed Jul 2 21:17:58 2025 +0700 vt: defkeymap: Map keycodes above 127 to K_HOLE The maximum number of keycodes got bumped to 256 a very long time ago, but the default keymaps were never adjusted to match. This is causing the kernel to interpret keycodes above 127 as U+0000 if the shipped generated keymap is used. Fix this by mapping all keycodes above 127 to K_HOLE so the kernel ignores them. The contents of this patche were generated by rerunning `loadkeys --mktable --unicode` and only including the changes to map keycodes above 127 to K_HOLE. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Myrrh Periwinkle Cc: stable Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-2-c27e143cc2eb@qtmlabs.xyz Signed-off-by: Greg Kroah-Hartman commit b1cc2092ea7a52e2c435aee6d2b1bcb773202663 Author: Myrrh Periwinkle Date: Wed Jul 2 21:17:57 2025 +0700 vt: keyboard: Don't process Unicode characters in K_OFF mode We don't process Unicode characters if the virtual terminal is in raw mode, so there's no reason why we shouldn't do the same for K_OFF (especially since people would expect K_OFF to actually turn off all VT key processing). Fixes: 9fc3de9c8356 ("vt: Add virtual console keyboard mode OFF") Signed-off-by: Myrrh Periwinkle Cc: stable Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20250702-vt-misc-unicode-fixes-v1-1-c27e143cc2eb@qtmlabs.xyz Signed-off-by: Greg Kroah-Hartman commit 86fa39dd6fb700c97606695b6ca40ff48ee323e9 Author: Praveen Talari Date: Mon Jul 21 23:15:32 2025 +0530 serial: qcom-geni: Enable Serial on SA8255p Qualcomm platforms The Qualcomm automotive SA8255p SoC relies on firmware to configure platform resources, including clocks, interconnects and TLMM. The driver requests resources operations over SCMI using power and performance protocols. The SCMI power protocol enables or disables resources like clocks, interconnect paths, and TLMM (GPIOs) using runtime PM framework APIs, such as resume/suspend, to control power states(on/off). The SCMI performance protocol manages UART baud rates, with each baud rate represented by a performance level. The driver uses the dev_pm_opp_set_level() API to request the desired baud rate by specifying the performance level. Reviewed-by: Bryan O'Donoghue Signed-off-by: Praveen Talari Link: https://lore.kernel.org/r/20250721174532.14022-9-quic_ptalari@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 1afa70632c390488308d8e94e037df6895a3e1ac Author: Praveen Talari Date: Mon Jul 21 23:15:31 2025 +0530 serial: qcom-geni: Enable PM runtime for serial driver The GENI serial driver currently handles power resource management through calls to the statically defined geni_serial_resources_on() and geni_serial_resources_off() functions. This approach reduces modularity and limits support for platforms with diverse power management mechanisms, including resource managed by firmware. Improve modularity and enable better integration with platform-specific power management, introduce support for runtime PM. Use pm_runtime_resume_and_get() and pm_runtime_put_sync() within the qcom_geni_serial_pm() callback to control resource power state transitions based on UART power state changes. Reviewed-by: Bryan O'Donoghue Signed-off-by: Praveen Talari Link: https://lore.kernel.org/r/20250721174532.14022-8-quic_ptalari@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 5893e62d46bce4ff2e0bc422c0957539d36e0f06 Author: Praveen Talari Date: Mon Jul 21 23:15:30 2025 +0530 serial: qcom-geni: move clock-rate logic to separate function Facilitates future modifications within the new function, leading to better readability and maintainability of the code. Move the code that handles the actual logic of clock-rate calculations to a separate function geni_serial_set_rate() which enhances code readability. Signed-off-by: Praveen Talari Link: https://lore.kernel.org/r/20250721174532.14022-7-quic_ptalari@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 94d691417e6f1fe5ba28c092fe95de3dc66d5e3c Author: Praveen Talari Date: Mon Jul 21 23:15:29 2025 +0530 serial: qcom-geni: move resource control logic to separate functions Supports use in PM system/runtime frameworks, helping to distinguish new resource control mechanisms and facilitate future modifications within the new API. The code that handles the actual enable or disable of resources like clock and ICC paths to a separate function (geni_serial_resources_on() and geni_serial_resources_off()) which enhances code readability. Introduced minor return checks in newly added function APIs to enhance error detection and prevent silent failures. Signed-off-by: Praveen Talari Link: https://lore.kernel.org/r/20250721174532.14022-6-quic_ptalari@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 4b2601ae3066daba5674049e83376317f66d45e8 Author: Praveen Talari Date: Mon Jul 21 23:15:28 2025 +0530 serial: qcom-geni: move resource initialization to separate function Enhances code readability and future modifications within the new API. Move the code that handles the actual initialization of resources like clock and ICC paths to a separate function, making the probe function cleaner. Reviewed-by: Bryan O'Donoghue Signed-off-by: Praveen Talari Link: https://lore.kernel.org/r/20250721174532.14022-5-quic_ptalari@quicinc.com Signed-off-by: Greg Kroah-Hartman commit f5b16f28fa8b8f7aa3e66d21b486aee2ffd68608 Author: Praveen Talari Date: Mon Jul 21 23:15:27 2025 +0530 soc: qcom: geni-se: Enable QUPs on SA8255p Qualcomm platforms On the sa8255p platform, resources such as clocks,interconnects and TLMM (GPIO) configurations are managed by firmware. Use the `num_clks` field in platform data to distinguish whether resource control is performed by firmware or directly by the driver in linux. Signed-off-by: Praveen Talari Link: https://lore.kernel.org/r/20250721174532.14022-4-quic_ptalari@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 3a0fdc6d934ded4756ae027d4272aeccb34de08a Author: Nikunj Kela Date: Mon Jul 21 23:15:26 2025 +0530 dt-bindings: qcom: geni-se: describe SA8255p SA8255p platform abstracts resources such as clocks, interconnect configuration in Firmware. Add DT bindings for the QUP Wrapper on sa8255p platform. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Nikunj Kela Co-developed-by: Praveen Talari Signed-off-by: Praveen Talari Link: https://lore.kernel.org/r/20250721174532.14022-3-quic_ptalari@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 4c83146cfb466ef24fcb9cf110f3b8821d1d2d85 Author: Nikunj Kela Date: Mon Jul 21 23:15:25 2025 +0530 dt-bindings: serial: describe SA8255p SA8255p platform abstracts resources such as clocks, interconnect and GPIO pins configuration in Firmware. SCMI power and perf protocols are used to send request for resource configurations. Add DT bindings for the QUP GENI UART controller on sa8255p platform. The wakeup interrupt (IRQ) is treated as optional, as not all UART instances have a wakeup-capable interrupt routed via the PDC. Signed-off-by: Nikunj Kela Co-developed-by: Praveen Talari Signed-off-by: Praveen Talari Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250721174532.14022-2-quic_ptalari@quicinc.com Signed-off-by: Greg Kroah-Hartman commit a8d455db2621ff5223416ead264f346d8164c92f Author: WangYuli Date: Tue Jul 22 15:34:29 2025 +0800 serial: 8250_dw: Fix typo "notifer" There is a spelling mistake of 'notifer' in the comment which should be 'notifier'. Reviewed-by: Andy Shevchenko Signed-off-by: WangYuli Link: https://lore.kernel.org/r/BD4804BF4FBA1648+20250722073431.21983-6-wangyuli@uniontech.com Signed-off-by: Greg Kroah-Hartman commit 35b6fc51c666fc96355be5cd633ed0fe4ccf68b2 Author: Ian Abbott Date: Tue Jul 22 16:53:16 2025 +0100 comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the `COMEDI_DEVCONFIG` ioctl. Tasks will read-lock `dev->attach_lock` before adding themselves to the subdevice wait queue, so fix the problem in the `COMEDI_DEVCONFIG` ioctl handler by write-locking `dev->attach_lock` before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the `comedi_device_detach()` function to be refactored slightly, moving the bulk of it into new function `comedi_device_detach_locked()`. Note that the refactor of `comedi_device_detach()` results in `comedi_device_cancel_all()` now being called while `dev->attach_lock` is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch. Cc: stable Fixes: 2f3fdcd7ce93 ("staging: comedi: add rw_semaphore to protect against device detachment") Link: https://lore.kernel.org/all/687bd5fe.a70a0220.693ce.0091.GAE@google.com/ Reported-by: syzbot+01523a0ae5600aef5895@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=01523a0ae5600aef5895 Co-developed-by: Jens Axboe Signed-off-by: Jens Axboe Signed-off-by: Ian Abbott Tested-by: Jens Axboe Link: https://lore.kernel.org/r/20250722155316.27432-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman commit 2138e89cb066b40386b1d9ddd61253347d356474 Author: Dan Carpenter Date: Sat Jul 19 09:19:10 2025 -0500 fs/orangefs: Allow 2 more characters in do_c_string() The do_k_string() and do_c_string() functions do essentially the same thing which is they add a string and a comma onto the end of an existing string. At the end, the caller will overwrite the last comma with a newline. Later, in orangefs_kernel_debug_init(), we add a newline to the string. The change to do_k_string() is just cosmetic. I moved the "- 1" to the other side of the comparison and made it "+ 1". This has no effect on runtime, I just wanted the functions to match each other and the rest of the file. However in do_c_string(), I removed the "- 2" which allows us to print two extra characters. I noticed this issue while reviewing the code and I doubt affects anything in real life. My guess is that this was double counting the comma and the newline. The "+ 1" accounts for the newline, and the caller will delete the final comma which ensures there is enough space for the newline. Removing the "- 2" lets us print 2 more characters, but mainly it makes the code more consistent and understandable for reviewers. Fixes: 44f4641073f1 ("orangefs: clean up debugfs globals") Signed-off-by: Dan Carpenter Signed-off-by: Mike Marshall commit 40c28199550d5cdace4583bfe723a7636b170a90 Merge: 3b4d4c98e5bb74 ebf266d0709b9b b1092465e24bd9 Author: Rafael J. Wysocki Date: Tue Jul 22 18:07:11 2025 +0200 Merge branches 'pm-misc' and 'pm-tools' Merge miscellaneous power management updates and cpupower utility updates for 6.17-rc1: - Update contact information in the PM ABI docs and maintainer information in the power domains DT binding (Rafael Wysocki) - Update PM header inclusions to follow the IWYU (Include What You Use) principle (Andy Shevchenko) - Add flags to specify power on attach/detach for PM domains, make the driver core detach PM domains in device_unbind_cleanup(), and drop the dev_pm_domain_detach() call from the platform bus type (Claudiu Beznea) - Improve Python binding's Makefile for cpupower (John B. Wyatt IV) - Fix printing of CORE, CPU fields in cpupower-monitor (Gautham Shenoy) * pm-misc: PM: docs: Use my kernel.org address in ABI docs and DT bindings driver core: platform: Drop dev_pm_domain_detach() call PM: domains: Detach on device_unbind_cleanup() PM: domains: Add flags to specify power on attach/detach PM: Don't use "proxy" headers * pm-tools: cpupower: Improve Python binding's Makefile pm: cpupower: Fix printing of CORE, CPU fields in cpupower-monitor pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() commit 63ce53724637e2e7ba51fe3a4f78351715049905 Author: Ma Ke Date: Sat Jul 19 15:58:56 2025 +0800 sunvdc: Balance device refcount in vdc_port_mpgroup_check Using device_find_child() to locate a probed virtual-device-port node causes a device refcount imbalance, as device_find_child() internally calls get_device() to increment the device’s reference count before returning its pointer. vdc_port_mpgroup_check() directly returns true upon finding a matching device without releasing the reference via put_device(). We should call put_device() to decrement refcount. As comment of device_find_child() says, 'NOTE: you will need to drop the reference with put_device() after use'. Found by code review. Cc: stable@vger.kernel.org Fixes: 3ee70591d6c4 ("sunvdc: prevent sunvdc panic when mpgroup disk added to guest domain") Signed-off-by: Ma Ke Link: https://lore.kernel.org/r/20250719075856.3447953-1-make24@iscas.ac.cn Signed-off-by: Jens Axboe commit 3b4d4c98e5bb74ba193179ac36af780b28e47d29 Merge: c4930d6dba025a 51888393cc64dd 46dc57406887dd Author: Rafael J. Wysocki Date: Tue Jul 22 18:01:15 2025 +0200 Merge branches 'pm-runtime' and 'pm-powercap' Merge runtime PM updates and power capping updates for 6.17-rc1: - Document return values of suspend-related API functions in the runtime PM framework (Sakari Ailus) - Mark last busy stamp in multiple autosuspend-related functions in the runtime PM framework and update its documentation (Sakari Ailus) - Take active children into account in pm_runtime_get_if_in_use() for consistency (Rafael Wysocki) - Fix NULL pointer dereference in get_pd_power_uw() in the dtpm_cpu power capping driver (Sivan Zohar-Kotzer) - Add support for the Bartlett Lake platform to the Intel RAPL power capping driver (Qiao Wei) - Add PL4 support for Panther Lake to the intel_rapl_msr power capping driver (Zhang Rui) * pm-runtime: PM: runtime: Take active children into account in pm_runtime_get_if_in_use() Documentation: PM: *_autosuspend() functions update last busy time PM: runtime: Mark last busy stamp in pm_request_autosuspend() PM: runtime: Mark last busy stamp in pm_runtime_autosuspend() PM: runtime: Mark last busy stamp in pm_runtime_put_sync_autosuspend() PM: runtime: Mark last busy stamp in pm_runtime_put_autosuspend() PM: runtime: Document return values of suspend-related API functions * pm-powercap: powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() powercap: intel_rapl: Add support for Bartlett Lake platform powercap: intel_rapl_msr: Add PL4 support for Panther Lake commit 77de19b6867f2740cdcb6c9c7e50d522b47847a4 Author: Chao Yu Date: Thu Jul 17 21:26:33 2025 +0800 f2fs: fix to avoid out-of-boundary access in dnode page As Jiaming Zhang reported: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x1c1/0x2a0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x17e/0x800 mm/kasan/report.c:480 kasan_report+0x147/0x180 mm/kasan/report.c:593 data_blkaddr fs/f2fs/f2fs.h:3053 [inline] f2fs_data_blkaddr fs/f2fs/f2fs.h:3058 [inline] f2fs_get_dnode_of_data+0x1a09/0x1c40 fs/f2fs/node.c:855 f2fs_reserve_block+0x53/0x310 fs/f2fs/data.c:1195 prepare_write_begin fs/f2fs/data.c:3395 [inline] f2fs_write_begin+0xf39/0x2190 fs/f2fs/data.c:3594 generic_perform_write+0x2c7/0x910 mm/filemap.c:4112 f2fs_buffered_write_iter fs/f2fs/file.c:4988 [inline] f2fs_file_write_iter+0x1ec8/0x2410 fs/f2fs/file.c:5216 new_sync_write fs/read_write.c:593 [inline] vfs_write+0x546/0xa90 fs/read_write.c:686 ksys_write+0x149/0x250 fs/read_write.c:738 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xf3/0x3d0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in the corrupted image, there is a dnode has the same node id w/ its inode, so during f2fs_get_dnode_of_data(), it tries to access block address in dnode at offset 934, however it parses the dnode as inode node, so that get_dnode_addr() returns 360, then it tries to access page address from 360 + 934 * 4 = 4096 w/ 4 bytes. To fix this issue, let's add sanity check for node id of all direct nodes during f2fs_get_dnode_of_data(). Cc: stable@kernel.org Reported-by: Jiaming Zhang Closes: https://groups.google.com/g/syzkaller/c/-ZnaaOOfO3M Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 94b3ce7f1509d91fbe3f84f367b622cbb2c1af7e Author: Hongbo Li Date: Thu Jul 10 12:14:15 2025 +0000 f2fs: switch to the new mount api The new mount api will execute .parse_param, .init_fs_context, .get_tree and will call .remount if remount happened. So we add the necessary functions for the fs_context_operations. If .init_fs_context is added, the old .mount should remove. See Documentation/filesystems/mount_api.rst for more information. Signed-off-by: Hongbo Li [sandeen: forward port] Signed-off-by: Eric Sandeen [hongbo: context modified] Signed-off-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit bb463a75ab2fc5b7322d342808d1dacf34abe79e Author: Hongbo Li Date: Thu Jul 10 12:14:14 2025 +0000 f2fs: introduce fs_context_operation structure The handle_mount_opt() helper is used to parse mount parameters, and so we can rename this function to f2fs_parse_param() and set it as .param_param in fs_context_operations. Signed-off-by: Hongbo Li [sandeen: forward port] Signed-off-by: Eric Sandeen Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d185351325237da688de006a2c579e82ea97bdfe Author: Hongbo Li Date: Thu Jul 10 12:14:13 2025 +0000 f2fs: separate the options parsing and options checking The new mount api separates option parsing and super block setup into two distinct steps and so we need to separate the options parsing out of the parse_options(). In order to achieve this, here we handle the mount options with three steps: - Firstly, we move sb/sbi out of handle_mount_opt. As the former patch introduced f2fs_fs_context, so we record the changed mount options in this context. In handle_mount_opt, sb/sbi is null, so we should move all relative code out of handle_mount_opt (thus, some check case which use sb/sbi should move out). - Secondly, we introduce the some check helpers to keep the option consistent. During filling superblock period, sb/sbi are ready. So we check the f2fs_fs_context which holds the mount options base on sb/sbi. - Thirdly, we apply the new mount options to sb/sbi. After checking the f2fs_fs_context, all changed on mount options are valid. So we can apply them to sb/sbi directly. After do these, option parsing and super block setting have been decoupled. Also it should have retained the original execution flow. Signed-off-by: Hongbo Li [sandeen: forward port, minor fixes and updates] Signed-off-by: Eric Sandeen [hongbo: minor fixes] Signed-off-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1a9094b10cf7339e4aa8d8c004534200968b558c Author: Hongbo Li Date: Thu Jul 10 12:14:12 2025 +0000 f2fs: Add f2fs_fs_context to record the mount options At the parsing phase of mouont in the new mount api, options value will be recorded with the context, and then it will be used in fill_super and other helpers. Note that, this is a temporary status, we want remove the sb and sbi usages in handle_mount_opt. So here the f2fs_fs_context only records the mount options, it will be copied in sb/sbi in later process. (At this point in the series, mount options are temporarily not set during mount.) Signed-off-by: Hongbo Li [sandeen: forward port, minor fixes and updates] Signed-off-by: Eric Sandeen [hongbo: minor cleanup] Signed-off-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 19c4b380f23e5a445cfc9e922c996784990d218c Author: Hongbo Li Date: Thu Jul 10 12:14:11 2025 +0000 f2fs: Allow sbi to be NULL in f2fs_printk At the parsing phase of the new mount api, sbi will not be available. So here allows sbi to be NULL in f2fs log helpers and use that in handle_mount_opt(). Signed-off-by: Hongbo Li [sandeen: forward port] Signed-off-by: Eric Sandeen Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 02eb5fe42a8c6cfcf063126df7e41ec2036b083c Author: Hongbo Li Date: Thu Jul 10 12:14:10 2025 +0000 f2fs: move the option parser into handle_mount_opt In handle_mount_opt, we use fs_parameter to parse each option. However we're still using the old API to get the options string. Using fsparams parse_options allows us to remove many of the Opt_ enums, so remove them. The checkpoint disable cap (or percent) involves rather complex parsing; we retain the old match_table mechanism for this, which handles it well. There are some changes about parsing options: 1. For `active_logs`, `inline_xattr_size` and `fault_injection`, we use s32 type according the internal structure to record the option's value. Signed-off-by: Hongbo Li [sandeen: forward port, minor fixes and updates] Signed-off-by: Eric Sandeen [hongbo: minor cleanup] Signed-off-by: Hongbo Li Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit f2091cc188c60d6f9436b4da5bd75cda46665315 Author: Hongbo Li Date: Thu Jul 10 12:14:09 2025 +0000 f2fs: Add fs parameter specifications for mount options Use an array of `fs_parameter_spec` called f2fs_param_specs to hold the mount option specifications for the new mount api. Add constant_table structures for several options to facilitate parsing. Signed-off-by: Hongbo Li [sandeen: forward port, minor fixes and updates, more fsparam_enum] Signed-off-by: Eric Sandeen Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5661998536af52848cc4d52a377e90368196edea Author: Chao Yu Date: Fri Jul 11 15:14:50 2025 +0800 f2fs: fix to avoid out-of-boundary access in devs.path - touch /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - truncate -s $((1024*1024*1024)) \ /mnt/f2fs/012345678901234567890123456789012345678901234567890123 - touch /mnt/f2fs/file - truncate -s $((1024*1024*1024)) /mnt/f2fs/file - mkfs.f2fs /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ -c /mnt/f2fs/file - mount /mnt/f2fs/012345678901234567890123456789012345678901234567890123 \ /mnt/f2fs/loop [16937.192225] F2FS-fs (loop0): Mount Device [ 0]: /mnt/f2fs/012345678901234567890123456789012345678901234567890123\xff\x01, 511, 0 - 3ffff [16937.192268] F2FS-fs (loop0): Failed to find devices If device path length equals to MAX_PATH_LEN, sbi->devs.path[] may not end up w/ null character due to path array is fully filled, So accidently, fields locate after path[] may be treated as part of device path, result in parsing wrong device path. struct f2fs_dev_info { ... char path[MAX_PATH_LEN]; ... }; Let's add one byte space for sbi->devs.path[] to store null character of device path string. Fixes: 3c62be17d4f5 ("f2fs: support multiple devices") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 816aa305cd499c5fd53a1960b6fa3e80b909d922 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:57 2025 +0100 f2fs: Remove F2FS_P_SB() All callers have been converted to F2FS_F_SB() so delete this wrapper. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5fb60c0365c4dad347e4958f78976cb733d903f2 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:56 2025 +0100 f2fs: Pass a folio to __has_merged_page() All three callers have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 06e42bf4327a410c72b7e689190f4c6b769e1e02 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:55 2025 +0100 f2fs: Pass a folio to f2fs_submit_merged_write_cond() Most callers pass NULL, and the one that passes a page already has a folio. Also convert __submit_merged_write_cond() to take a folio. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7695f8ccf61451305d08051cd1a1d8388f65fd54 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:54 2025 +0100 f2fs: Remove use of page from f2fs_write_single_data_page() Both remaining uses of page now have a folio equivalent. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6974b21f7013fe08008f2fea5d61b96c5a4858dd Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:53 2025 +0100 f2fs: Remove clear_page_private_all() All callers can simply call folio_detach_private(). This was the only way that clear_page_private_data() could be called, so remove that too. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 0f54eec0cb89887e3ed8ed430f5b9cd513038ca4 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:52 2025 +0100 f2fs: Use F2FS_F_SB() in f2fs_read_end_io() Get the folio from the bio instead of the page. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 015622b8c7ed781329284802a690f1517d3599e6 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:51 2025 +0100 f2fs: Use a folio in f2fs_encrypted_get_link() Use a folio instead of a page when dealing with the page cache. Removes a hidden call to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 49bb2b894e87bd9542ee6c5d67aeb7e3fcaee6e4 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:50 2025 +0100 f2fs: Pass a folio to f2fs_cache_compressed_page() The only caller already has a folio so pass it in. f2fs_cache_compressed_page() is not used outside compress.c so make it static. This requires a forward declaration (or would require rearranging this file, but I've chosen not to do that for readability of the diff). Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8591db2a6571e2074f0cab835f8ac2cff516529e Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:49 2025 +0100 f2fs: Pass a folio to F2FS_NODE() All callers now have a folio so pass it in Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c07de7557a5647e289287d6cf5063ebfa42afd68 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:48 2025 +0100 f2fs: Pass the nat_blk to __update_nat_bits() The page argument is only used to look up the address of the nat_blk. Since the caller already has it, pass it in instead. Also mark it const as the nat_blk isn't modified by this function. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 3a19caf12f03a3d731dfae79384a5fe998bc28ca Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:47 2025 +0100 f2fs: Convert get_next_nat_page() to get_next_nat_folio() Return a folio from this function and convert its one caller. Removes a call to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 9e3d138737f8b7a26d078dc088ed33da87884723 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:46 2025 +0100 f2fs: Pass a folio to f2fs_is_compressed_page() All callers now have a folio so pass it in. Also remove the test for the private flag; it is redundant with checking folio->private for being NULL. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit cabda16223ed7ac41af27e491a7385e5c5a0c5cd Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:45 2025 +0100 f2fs: Use a folio iterator in f2fs_verify_bio() Change from bio_for_each_segment_all() to bio_for_each_folio_all() to iterate over each folio instead of each page. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 587b2df524f9cd3f799d7196315453b5f2b01813 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:44 2025 +0100 f2fs: Pass a folio to f2fs_end_read_compressed_page() Both callers now have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit a9249a2671bca27860b152fc5db32d448f359af3 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:43 2025 +0100 f2fs: Use a folio iterator in f2fs_handle_step_decompress() Change from bio_for_each_segment_all() to bio_for_each_folio_all() to iterate over each folio instead of each page. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d6966e7ed280caf1f4397c4a0cad14618e5ff5f7 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:42 2025 +0100 f2fs: Pass a folio to WB_DATA_TYPE() and f2fs_is_cp_guaranteed() All callers now have a folio so pass it in. Removes a call to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit fec903541713bcb606f7f93cfdad99d2083cfda7 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:41 2025 +0100 f2fs: Use a bio in f2fs_submit_page_write() Convert bio_page to bio_folio and use it throughout. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5e2a00e6e0099fa7f22be90ee87c5019b2e02223 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:40 2025 +0100 f2fs: Use a folio in f2fs_merge_page_bio() We have two folios to deal with here; one carries the metadata and the other points to the data. They may be the same, but if it's compressed, the data_folio will differ from the metadata folio. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ca8049c99f3d297665b8e5c5c3bec08573386691 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:39 2025 +0100 f2fs: Pass a folio to f2fs_compress_write_end_io() The only caller has a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 3659196c872349b8c4a4f1ef389780b2ab8f0093 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:38 2025 +0100 f2fs: Convert get_page_private_data() to folio_get_f2fs_data() The only caller already has a folio so convert this function to be folio based. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 161922410d6ec7231740c28557d387dbd79fe132 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:37 2025 +0100 f2fs: Convert set_page_private_data() to folio_set_f2fs_data() The only caller has a folio, so pass it in and operate on it. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit a824388d911927b2a82bf7dcfd7cef6ee45c8b43 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:36 2025 +0100 f2fs: Use a folio in f2fs_is_cp_guaranteed() Convert the passed page to a folio and use it throughout. Removes a use of fscrypt_is_bounce_page(), which we're trying to remove. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4ecaf580ee3520265350d0433755dc080f118afa Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:35 2025 +0100 f2fs: Add folio counterparts to page_private_flags functions Name these new functions folio_test_f2fs_*(), folio_set_f2fs_*() and folio_clear_f2fs_*(). Convert all callers which currently have a folio and cast back to a page. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit a5f3be6e652a7beaaf6c482bc013b64129a5d239 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:34 2025 +0100 f2fs: Pass a folio to IS_INODE() All callers now have a folio so pass it in. Also make it const to help the compiler. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ad38574a8e8223361e265973fbd87013ea058c5d Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:33 2025 +0100 f2fs: Pass a folio to ADDRS_PER_PAGE() All callers now have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e8f46b2c3aef32a4efdf5459b26c1f7d96d81826 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:32 2025 +0100 f2fs: Pass a folio to get_dnode_base() The only caller already has a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6d3a7f6589fec21addb4bdff6289283dfdf55af9 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:31 2025 +0100 f2fs: Pass a folio to ofs_of_node() All callers now have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit fb92a5c9f89a4e5337768c7d2f374669e0ab454b Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:30 2025 +0100 f2fs: Pass a folio to IS_DNODE() All callers now have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5bba2a22494cf47a1e0021457ca2d9a6722d90fe Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:29 2025 +0100 f2fs: Pass a folio to is_node() All three callers now have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1fd0dffdb446c780a555d9b792408560a5c693d6 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:28 2025 +0100 f2fs: Pass a folio to is_cold_node() All callers now have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 79d976a2e73b103762942fcf46a9bbe3ecc9d699 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:27 2025 +0100 f2fs: Use folio_unlock() in f2fs_write_compressed_pages() Remove a call to compound_head() by replacing a call to unlock_page() with a call to folio_unlock(). Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit d342b7adad71e5a4a609fedd673e964cfad91822 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:26 2025 +0100 f2fs: Add fio->folio Put fio->page insto a union with fio->folio. This lets us remove a lot of folio->page and page->folio conversions. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4aecdc80b3a6207a9e477857bf9a0f2095addc09 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:25 2025 +0100 f2fs: Pass a folio to is_dent_dnode() Both callers have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ac576da7c950984c7bbb71c1b557187c58758d16 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:24 2025 +0100 f2fs: Pass a folio to is_fsync_dnode() Both callers have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 447e4fb5e8800648c6c7b8edaa90ad3f8919ce0b Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:23 2025 +0100 f2fs: Pass a folio to f2fs_recover_xattr_data() One caller passes NULL and the other caller already has a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit eca35d6d5a0245ffeb0e80a7d07aab8801b6572a Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:22 2025 +0100 f2fs: Pass a folio to cpver_of_node() All callers have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 06bf11829b495211c3c654332fcd126e1cc59227 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:21 2025 +0100 f2fs: Pass a folio to fill_node_footer() All callers have a folio so pass it in. Also mark it as const to help the compiler. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 171a3aebbd48dd1d43cbf3fc8b1be3b6ab7d5836 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:20 2025 +0100 f2fs: Pass folios to copy_node_footer() The only caller has folios so pass them in. Also mark them as const to help the compiler. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 53987453349bdd64f4897a83a5e7ee89aa9b907b Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:19 2025 +0100 f2fs: Pass a folio to set_cold_node() All callers have a folio so pass it in. Also mark it as const to help the compiler. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit fddd722e73afadff41f570affea351b970ea23e4 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:18 2025 +0100 f2fs: Pass a folio to get_nid() All callers have a folio so pass it in. Also mark it as const to help the compiler. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 889293ea1148857fcf3879073d223dd7c47a61fd Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:17 2025 +0100 f2fs: Pass a folio to fill_node_footer_blkaddr() The only caller has a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 5ea99b6d70b3c9b6b8ae7807827a92beee3f8903 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:16 2025 +0100 f2fs: Pass a folio to f2fs_inode_chksum() Both callers have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 6ebd7ba499c5c5141ff082dc772ca04ef581490c Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:15 2025 +0100 f2fs: Pass a folio to f2fs_enable_inode_chksum() All callers have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e3f1b76d877c14897b4776fc5dd08af3c7751976 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:14 2025 +0100 f2fs: Pass a folio to f2fs_inode_chksum_set() All callers have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c3c06275e4e2131111d4d6b2ead0221e67bf70b8 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:13 2025 +0100 f2fs: Pass a folio to f2fs_allocate_data_block() Most callers pass NULL, and the one which passes a page already has a folio, so we can pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 61fcaf3eb88d389cd0792983cdd0da9e5cad0901 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:12 2025 +0100 f2fs: Pass a folio to set_mark() All callers have a folio so pass it in. Removes a call to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit b07bfa70e4b11078b48e0cec3c2c2dd36c34e534 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:11 2025 +0100 f2fs: Pass a folio to set_fsync_mark() All callers have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4f3466d79b2bfe92879968595dd74efbfa224058 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:10 2025 +0100 f2fs: Pass a folio to set_dentry_mark() All callers have a folio so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit bead9a6f1b8d22a2e8185a380a4738cb737d0d70 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:09 2025 +0100 f2fs: Pass a folio to is_recoverable_dnode() All callers have a folio so pass it in. Also make the argument const as the function does not modify it. Removes a call to compound_head(). Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit a63f2de2dd950aaa7c6008e90f30c43b34f643f5 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:08 2025 +0100 f2fs: Pass a folio to nid_of_node() All callers have a folio so pass it in. Also make the argument const as the function does not modify it. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 28fde0d7ff293e07f03d8fb9bfa61ede3144b552 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:07 2025 +0100 f2fs: Pass a folio to ino_of_node() All callers have a folio so pass it in. Also make the argument const as the function does not modify it. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 9d717807167f82687592742002bd5fbaeb69380a Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:06 2025 +0100 f2fs: Pass a folio to F2FS_INODE() All callers now have a folio, so pass it in. Also make it const as F2FS_INODE() does not modify the struct folio passed in (the data it describes is mutable, but it does not change the contents of the struct). This may improve code generation. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 4a09966a2066cc50f8dfa55e11986e2b5ffeecc0 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:05 2025 +0100 f2fs: Pass a folio to inode_has_blocks() The only caller has a folio, so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1f6425e33da270f0ebb8b43f686ba5d1d40cbe2f Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:04 2025 +0100 f2fs: Pass a folio to f2fs_sanity_check_inline_data() The only caller has a folio, so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit ea3f2069ea162a2d85cf5a020c6b0324533b871a Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:03 2025 +0100 f2fs: Pass a folio to sanity_check_inode() The only caller has a folio, so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit afd42fa98b9c01596daf0f1e41a6ffd0f7179144 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:02 2025 +0100 f2fs: Pass a folio to sanity_check_extent_cache() The only caller has a folio, so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit b77dc031a7848066555e7c6da2a2c091b4572e8e Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:01 2025 +0100 f2fs: Pass a folio to f2fs_recover_inode_page() The only caller has a folio, so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 71e5066738e91890ec2dd98b7148c61c417013ee Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:03:00 2025 +0100 f2fs: Pass a folio to recover_quota_data() The only caller has a folio, so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7872c71e646b9682ce22be8f3616b5a3f5a5df62 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:02:59 2025 +0100 f2fs: Pass a folio to recover_inode() The only caller has a folio, so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 9050cabbe1addc5bd2d080b04d51e1f05802a7c4 Author: Matthew Wilcox (Oracle) Date: Tue Jul 8 18:02:58 2025 +0100 f2fs: Pass a folio to recover_dentry() The only caller has a folio, so pass it in. Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c4930d6dba025a5d6035b18350120a540c68dc25 Merge: 987c420c2e760a f633c1a236df95 Author: Rafael J. Wysocki Date: Tue Jul 22 17:49:34 2025 +0200 Merge branch 'pm-sleep' Merge updates related to system sleep for 6.17-rc1: - Extend the asynchronous suspend and resume of devices to handle suppliers like parents and consumers like children (Rafael Wysocki) - Make pm_runtime_force_resume() work for drivers that set the DPM_FLAG_SMART_SUSPEND flag and allow PCI drivers and drivers that collaborate with the general ACPI PM domain to set it (Rafael Wysocki) - Add kernel parameter to disable asynchronous suspend/resume of devices (Tudor Ambarus) - Drop redundant might_sleep() calls from some functions in the device suspend/resume core code (Zhongqiu Han) - Fix the handling of monitors connected right before waking up the system from sleep (tuhaowen) - Clean up MAINTAINERS entries for suspend and hibernation (Rafael Wysocki) - Fix error code path in the KEXEC_JUMP flow and drop a redundant pm_restore_gfp_mask() call from it (Rafael Wysocki) - Rearrange suspend/resume error handling in the core device suspend and resume code (Rafael Wysocki) - Fix up white space that does not follow coding style in the hibernation core code (Darshan Rathod) * pm-sleep: PM: hibernate: Fix up white space that does not follow coding style PM: sleep: Rearrange suspend/resume error handling in the core kexec_core: Drop redundant pm_restore_gfp_mask() call kexec_core: Fix error code path in the KEXEC_JUMP flow PM: sleep: Clean up MAINTAINERS entries for suspend and hibernation PM: sleep: add kernel parameter to disable asynchronous suspend/resume PCI/PM: Set power.strict_midlayer in pci_pm_init() ACPI: PM: Set/clear power.strict_midlayer in prepare/complete PM: sleep: Add strict_midlayer flag to struct dev_pm_info PM: runtime: Introduce __rpm_get_driver_callback() PM: Check power.needs_force_resume in pm_runtime_force_suspend() PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() PM: Make pm_runtime_force_resume() work with DPM_FLAG_SMART_SUSPEND PM: Move two sleep-related functions under CONFIG_PM_SLEEP PM: Use true/false as power.needs_force_resume values PM: sleep: Make async suspend handle suppliers like parents PM: sleep: Make async resume handle consumers like children PM: sleep: Drop superfluous might_sleep() calls PM: sleep: console: Fix the black screen issue commit 987c420c2e760aeb227811a1d3827e26a47da81e Merge: caf4427d8a397c ee2736848f1c9b 01d40d3c146449 c22458458c2e3f 1c61cf974917bc Author: Rafael J. Wysocki Date: Tue Jul 22 17:40:32 2025 +0200 Merge branches 'pm-cpuidle', 'pm-qos', 'pm-devfreq' and 'pm-opp' Merge a cpuidle update, a PM QoS update, devfreq updates, and an OPP (operating performance points) update for 6.17-rc1: - Fix opencoded for_each_cpu() in idle_state_valid() in the DT cpuidle driver (Yury Norov) - Remove info about non-existing QoS interfaces from the PM QoS documentation (Ulf Hansson) - Use c_* types via kernel prelude in Rust for OPP (Abhinav Ananthu) - Add HiSilicon uncore frequency scaling driver to devfreq (Jie Zhan) - Allow devfreq drivers to add custom sysfs ABIs (Jie Zhan) - Simplify the sun8i-a33-mbus devfreq driver by using more devm functions (Uwe Kleine-König) - Fix an index typo in trans_stat() in devfreq (Chanwoo Choi) - Check devfreq governor before using governor->name (Lifeng Zheng) - Remove a redundant devfreq_get_freq_range() call from devfreq_add_device() (Lifeng Zheng) - Limit max_freq with scaling_min_freq in devfreq (Lifeng Zheng) - Replace sscanf() with kstrtoul() in set_freq_store() (Lifeng Zheng) * pm-cpuidle: cpuidle: dt: fix opencoded for_each_cpu() in idle_state_valid() * pm-qos: Documentation: power: Remove info about non-existing QoS interfaces * pm-devfreq: PM / devfreq: Add HiSilicon uncore frequency scaling driver PM / devfreq: Allow devfreq driver to add custom sysfs ABIs PM / devfreq: sun8i-a33-mbus: Simplify by using more devm functions PM / devfreq: Fix a index typo in trans_stat PM / devfreq: Check governor before using governor->name PM / devfreq: Remove redundant devfreq_get_freq_range() calling in devfreq_add_device() PM / devfreq: Limit max_freq with scaling_min_freq PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() * pm-opp: rust: opp: use c_* types via kernel prelude commit caf4427d8a397cd7e045aafd27d3f6fa51c531e5 Merge: ebd6884167eac9 0a1416a49e63c3 Author: Rafael J. Wysocki Date: Tue Jul 22 17:24:59 2025 +0200 Merge branch 'pm-cpufreq' Merge cpufreq updates for 6.17-rc1: - Fix two initialization ordering issues in the cpufreq core and a governor initialization error path in it, and clean it up (Lifeng Zheng) - Add Granite Rapids support in no-HWP mode to the intel_pstate cpufreq driver (Li RongQing) - Make intel_pstate always use HWP_DESIRED_PERF in passive mode (Rafael Wysocki) - Allow building the tegra124 cpufreq driver as a module (Aaron Kling) - Do minor cleanups for Rust cpufreq and cpumask APIs and fix MAINTAINERS entry for cpu.rs (Abhinav Ananthu, Ritvik Gupta, Lukas Bulwahn) - Clean up assorted cpufreq drivers (Arnd Bergmann, Dan Carpenter, Krzysztof Kozlowski, Sven Peter, Svyatoslav Ryhel, Lifeng Zheng) - Add the NEED_UPDATE_LIMITS flag to the CPPC cpufreq driver (Prashant Malani) - Fix minimum performance state label error in the amd-pstate driver documentation (Shouye Liu) - Add the CPUFREQ_GOV_STRICT_TARGET flag to the userspace cpufreq governor and explain HW coordination influence on it in the documentation (Shashank Balaji) * pm-cpufreq: (27 commits) cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag Documentation: amd-pstate:fix minimum performance state label error drivers: cpufreq: add Tegra114 support rust: cpumask: Replace `MaybeUninit` and `mem::zeroed` with `Opaque` APIs cpufreq: Exit governor when failed to start old governor cpufreq: Move the check of cpufreq_driver->get into cpufreq_verify_current_freq() cpufreq: Init policy->rwsem before it may be possibly used cpufreq: Initialize cpufreq-based frequency-invariance later cpufreq: Remove duplicate check in __cpufreq_offline() cpufreq: Contain scaling_cur_freq.attr in cpufreq_attrs cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode cpufreq: tegra124: Allow building as a module cpufreq: dt: Add register helper cpufreq: Export disable_cpufreq() cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() cpufreq: armada-8k: make both cpu masks static rust: cpufreq: use c_ types from kernel prelude rust: cpufreq: Ensure C ABI compatibility in all unsafe cpufreq: brcmstb-avs: Fully open-code compatible for grepping ... commit 1c20224123f41e4f7da44ae020832bdac3f30ec1 Author: Tanmay Shah Date: Wed Jul 16 14:30:48 2025 -0700 remoteproc: xlnx: Fix kernel-doc warnings Fix kernel-doc warnings generated by following command: `scripts/kernel-doc -Werror -Wshort-desc -Wall \ drivers/remoteproc/xlnx_r5_remoteproc.c > /dev/null` warning: missing initial short description on line: * struct mbox_info ... Total 8 warnings fixed Signed-off-by: Tanmay Shah Link: https://lore.kernel.org/r/20250716213048.2316424-3-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier commit ea34e67ae7a6318dc775a8d98cf00c3e45bfb7d2 Merge: a78dfdb6e81efb f9db1fc56281b9 Author: Rafael J. Wysocki Date: Tue Jul 22 17:12:57 2025 +0200 Merge branch 'acpi-misc' Merge an update fixing typos in ACPI documentation and comments for 6.17-rc1 (Bjorn Helgaas). * acpi-misc: ACPI: Fix typos commit fc9ed2f6589dc2c11f05883e5c323be5f39fd241 Author: Thomas Huth Date: Fri Mar 14 08:10:06 2025 +0100 um: Replace __ASSEMBLY__ with __ASSEMBLER__ in the usermode headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, so let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Richard Weinberger Cc: Anton Ivanov Cc: Johannes Berg Cc: linux-um@lists.infradead.org Signed-off-by: Thomas Huth Link: https://patch.msgid.link/20250314071013.1575167-36-thuth@redhat.com Signed-off-by: Johannes Berg commit f9db1fc56281b96fe8748632b3894de970a8a850 Author: Bjorn Helgaas Date: Mon Jul 21 16:37:14 2025 -0500 ACPI: Fix typos Fix typos in documentation and comments. Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250722132653.GA2781885@bhelgaas Signed-off-by: Rafael J. Wysocki commit 73bcce043f3ca4869dcdf4087a043dce30145939 Merge: 5d3aeecc26bbc1 20e672e6584446 Author: Arnd Bergmann Date: Tue Jul 22 16:47:52 2025 +0200 Merge tag 'mtk-arm32-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/arm MediaTek mach ARM32 updates This adds support for the MediaTek MT6572 SoC, found in various old smartphones and tablets from various manufacturers. In particular, this adds a board_dt_compat entry for this SoC and its SMP bring up sequence to enable secondary cores. * tag 'mtk-arm32-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: ARM: mediatek: add MT6572 smp bring up code ARM: mediatek: add board_dt_compat entry for the MT6572 SoC Link: https://lore.kernel.org/r/20250711083656.33538-1-angelogioacchino.delregno@collabora.com Signed-off-by: Arnd Bergmann commit 5d3aeecc26bbc1321d4a1954093d6df396f80295 Author: Bartosz Golaszewski Date: Tue Jul 22 09:15:42 2025 +0200 ARM: sa110/gpio: convert set_multiple() to returning an integer The conversion to using the new GPIO line setter callbacks missed the set_multiple() in this file. Convert it to using the new callback. Fixes: 9c3782118a57 ("ARM: sa1100/gpio: use new line value setter callbacks") Signed-off-by: Bartosz Golaszewski Signed-off-by: Arnd Bergmann commit 1798561befd8be1e52feb54f850efcab5a595f43 Author: Antheas Kapenekakis Date: Fri Jul 18 18:33:05 2025 +0200 platform/x86: oxpec: Add support for OneXPlayer X1 Mini Pro (Strix Point) The OneXPlayer X1 Mini Pro (which is the Strix Point variant of the Mini) uses the same registers as the X1 Mini, so re-use the quirk. Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250718163305.159232-2-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 232b41d3c2ce8cf4641a174416676458bf0de5b2 Author: Antheas Kapenekakis Date: Fri Jul 18 18:33:04 2025 +0200 platform/x86: oxpec: Fix turbo register for G1 AMD Turns out that the AMD variant of the G1 uses different EC registers than the Intel variant. Differentiate them and apply the correct ones to the AMD variant. Fixes: b369395c895b ("platform/x86: oxpec: Add support for the OneXPlayer G1") Signed-off-by: Antheas Kapenekakis Link: https://lore.kernel.org/r/20250718163305.159232-1-lkml@antheas.dev Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit ad1244e1ce18f8c1a5ebad8074bfcf10eacb0311 Author: Slark Xiao Date: Mon Jul 21 19:39:19 2025 +0800 USB: serial: option: add Foxconn T99W709 T99W709 is designed based on MTK T300(5G redcap) chip. There are 7 serial ports to be enumerated: AP_LOG, GNSS, AP_META, AT, MD_META, NPT, DBG. RSVD(5) for ADB port. test evidence as below: T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=0489 ProdID=e15f Rev=00.01 S: Manufacturer=MediaTek Inc. S: Product=USB DATA CARD S: SerialNumber=355511220000399 C: #Ifs=10 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x3 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=usbfs I: If#=0x6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x7 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x8 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x9 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option Signed-off-by: Slark Xiao Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold commit 2c402a801c19568de97b86a77b25d13448dc080a Author: Michael J. Ruhl Date: Sun Jul 13 13:29:43 2025 -0400 platform/x86/intel/pmt: support BMG crashlog The Battlemage GPU has the type 1 version 2 crashlog feature. Update the crashlog driver to support this crashlog version. Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-14-michael.j.ruhl@intel.com [ij: make crashlog_type1_ver2 static] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5623fa6859a6cd49366421317e3c5ab183583624 Author: Michael J. Ruhl Date: Sun Jul 13 13:29:42 2025 -0400 platform/x86/intel/pmt: use a version struct In preparation for supporting multiple crashlog versions, use a struct to keep bit offset info for the status and control bits. Reviewed-by: Ilpo Järvinen Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-13-michael.j.ruhl@intel.com [ij: move crashlog_type1_ver0 to its final place & add consts to crashlog_info] Signed-off-by: Ilpo Järvinen commit 66df9fa783aadc2a5ae8ca11ead0b13032d24e7e Author: Michael J. Ruhl Date: Sun Jul 13 13:29:41 2025 -0400 platform/x86/intel/pmt: refactor base parameter To support an upcoming crashlog change, use the parent of struct intel_pmt_entry, struct crashlog_entry, as a main parameter. Using struct crashlog_entry will allow for a more flexible interface to control the crashlog feature. - Refactor to use struct crashlog_entry in place of struct intel_pmt_entry - Rename variables from "entry" to "crashlog" Reviewed-by: Ilpo Järvinen Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-12-michael.j.ruhl@intel.com Signed-off-by: Ilpo Järvinen commit f57b32cb4adb28b62f61c4729f7b85f55518cb2b Author: Michael J. Ruhl Date: Sun Jul 13 13:29:40 2025 -0400 platform/x86/intel/pmt: add register access helpers The control register is used in a read/modify/write pattern. The status register is used in a read/check bit pattern. Add helpers to eliminate common code. Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-11-michael.j.ruhl@intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8ab4f88d46c70bade0633b56a0f03e20102bf10c Author: Michael J. Ruhl Date: Sun Jul 13 13:29:39 2025 -0400 platform/x86/intel/pmt: decouple sysfs and namespace The PMT namespace includes the crashlog sysfs attribute information. Other crashlog version/types may need different sysfs attributes. Coupling the attributes with the namespace blocks this usage. Decouple sysfs attributes from the name space and add them to the specific entry. Reviewed-by: Ilpo Järvinen Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-10-michael.j.ruhl@intel.com Signed-off-by: Ilpo Järvinen commit 5c7bfa1088274bc3820eb2083f8091ff8ad397ec Author: Michael J. Ruhl Date: Sun Jul 13 13:29:38 2025 -0400 platform/x86/intel/pmt: correct types A couple of local variables do not match the return types of some of the functions. Update the mismatched types to match. Reviewed-by: Ilpo Järvinen Reviewed-by: David E. Box Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-9-michael.j.ruhl@intel.com Signed-off-by: Ilpo Järvinen commit 147c18d8efaa1fa006fdd0b901d51092dc3b2189 Author: Michael J. Ruhl Date: Sun Jul 13 13:29:37 2025 -0400 platform/x86/intel/pmt: re-order trigger logic Setting the clear bit or checking the complete bit before checking to see if crashlog is disabled seems incorrect. Check disable before accessing any other bits. Reviewed-by: Ilpo Järvinen Reviewed-by: David E. Box Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-8-michael.j.ruhl@intel.com Signed-off-by: Ilpo Järvinen commit 4f8fa22d108006b8ec0b94bb67a1bd537a2bf141 Author: Michael J. Ruhl Date: Sun Jul 13 13:29:36 2025 -0400 platform/x86/intel/pmt: use guard(mutex) Update the mutex paths to use the new guard() mechanism. With the removal of goto, do some minor cleanup of the current logic path. Reviewed-by: David E. Box Reviewed-by: Ilpo Järvinen Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-7-michael.j.ruhl@intel.com Signed-off-by: Ilpo Järvinen commit 75a496aa054326d9ebf27b39e1af8b5b770311ba Author: Michael J. Ruhl Date: Sun Jul 13 13:29:35 2025 -0400 platform/x86/intel/pmt: mutex clean up The header file for mutex usage and mutex_destroy() cleanup code is absent from the crashlog.c module. Add the header file and mutex_destroy(). Reviewed-by: Ilpo Järvinen Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-6-michael.j.ruhl@intel.com Signed-off-by: Ilpo Järvinen commit ba22fe0cffedf5156731fbac729a638f18d17e6b Author: Michael J. Ruhl Date: Sun Jul 13 13:29:34 2025 -0400 platform/x86/intel/pmt: white space cleanup Noticed two white space issues; cleaned them. Reviewed-by: David E. Box Reviewed-by: Ilpo Järvinen Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-5-michael.j.ruhl@intel.com Signed-off-by: Ilpo Järvinen commit 5b27388171a18cf6842c700520086ec50194e858 Author: Michael J. Ruhl Date: Sun Jul 13 13:29:33 2025 -0400 drm/xe: Correct BMG VSEC header sizing The intel_vsec_header information for the crashlog feature is incorrect. Update the VSEC header with correct sizing and count. Since the crashlog entries are "merged" (num_entries = 2), the separate capabilities entries must be merged as well. Fixes: 0c45e76fcc62 ("drm/xe/vsec: Support BMG devices") Acked-by: Rodrigo Vivi Signed-off-by: Michael J. Ruhl Reviewed-by: David E. Box Link: https://lore.kernel.org/r/20250713172943.7335-4-michael.j.ruhl@intel.com Signed-off-by: Ilpo Järvinen commit 0ba9e9cf76f2487654bc9bca38218780fa53030e Author: Michael J. Ruhl Date: Sun Jul 13 13:29:32 2025 -0400 drm/xe: Correct the rev value for the DVSEC entries By definition, the Designated Vendor Specific Extended Capability (DVSEC) revision should be 1. Add the rev value to be correct. Fixes: 0c45e76fcc62 ("drm/xe/vsec: Support BMG devices") Signed-off-by: Michael J. Ruhl Reviewed-by: David E. Box Link: https://lore.kernel.org/r/20250713172943.7335-3-michael.j.ruhl@intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 54d5cd4719c5e87f33d271c9ac2e393147d934f8 Author: Michael J. Ruhl Date: Sun Jul 13 13:29:31 2025 -0400 platform/x86/intel/pmt: fix a crashlog NULL pointer access Usage of the intel_pmt_read() for binary sysfs, requires a pcidev. The current use of the endpoint value is only valid for telemetry endpoint usage. Without the ep, the crashlog usage causes the following NULL pointer exception: BUG: kernel NULL pointer dereference, address: 0000000000000000 Oops: Oops: 0000 [#1] SMP NOPTI RIP: 0010:intel_pmt_read+0x3b/0x70 [pmt_class] Code: Call Trace: ? sysfs_kf_bin_read+0xc0/0xe0 kernfs_fop_read_iter+0xac/0x1a0 vfs_read+0x26d/0x350 ksys_read+0x6b/0xe0 __x64_sys_read+0x1d/0x30 x64_sys_call+0x1bc8/0x1d70 do_syscall_64+0x6d/0x110 Augment struct intel_pmt_entry with a pointer to the pcidev to avoid the NULL pointer exception. Fixes: 045a513040cc ("platform/x86/intel/pmt: Use PMT callbacks") Cc: stable@vger.kernel.org Reviewed-by: David E. Box Reviewed-by: Tejas Upadhyay Signed-off-by: Michael J. Ruhl Link: https://lore.kernel.org/r/20250713172943.7335-2-michael.j.ruhl@intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit de2884c6cdd3d133704ce37393590dd1c761500c Author: Jelle van der Waa Date: Wed Jul 2 20:28:43 2025 +0200 platform/x86: samsung-laptop: Expose charge_types Support the newly introduced charge_types sysfs attribute as a replacement for the custom `battery_life_extender` attribute. Setting charge_types to `Long Life` enables battery life extending mode. This change is similar to the recent Ideapad patch adding support for charge_types. Signed-off-by: Jelle van der Waa Link: https://lore.kernel.org/r/20250702182844.107706-1-jvanderwaa@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 246570cd351299959822ac21e75e2975f80ce4b7 Author: Charles Keepax Date: Tue Jul 22 12:47:05 2025 +0100 ASoC: SDCA: Fix implicit cast from le16 As the HID wDescriptorLength is explicitly marked as little endian it should be converted to host endian before being used. Fixes: ac558015dfd8 ("ASoC: SDCA: add a HID device for HIDE entity") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507221024.M18hWD6q-lkp@intel.com/ Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20250722114705.2816910-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 699cdd706290208d47bd858a188b030df2e90357 Author: Tanmay Shah Date: Wed Jul 16 14:30:47 2025 -0700 remoteproc: xlnx: Disable unsupported features AMD-Xilinx platform driver does not support iommu or recovery mechanism yet. Disable both features in platform driver. Signed-off-by: Tanmay Shah Link: https://lore.kernel.org/r/20250716213048.2316424-2-tanmay.shah@amd.com Fixes: 6b291e8020a8 ("drivers: remoteproc: Add Xilinx r5 remoteproc driver") Signed-off-by: Mathieu Poirier commit a78dfdb6e81efbe3ff92016f165abe7d5aa8d58f Merge: c58364ac072585 814eca1085ef26 e65cb011349e65 Author: Rafael J. Wysocki Date: Tue Jul 22 16:02:02 2025 +0200 Merge branches 'acpi-debug' and 'acpi-docs' Merge an update related to ACPI debugging and ACPI documentation updates for 6.17-rc1: - Enable CONFIG_ACPI_DEBUG by default to make it easier to get ACPI debug messages from OEM platforms (Mario Limonciello) - Fix parent device references in ASL examples in the ACPI documentation and fix spelling and style in the gpio-properties documentation in firmware-guide (Andy Shevchenko) * acpi-debug: ACPI: Enable CONFIG_ACPI_DEBUG by default * acpi-docs: Documentation: ACPI: Fix parent device references Documentation: firmware-guide: gpio-properties: Spelling and style fixes commit c58364ac072585abfa2a42d71bd00dd5eda1e01d Merge: 6984f941f49b7d 151c1f989bcbe5 c9d52116c5d4ce 9cf45756a4b9a7 1caf3f78c02262 3db5648c4d608b cf115ebad30f08 Author: Rafael J. Wysocki Date: Tue Jul 22 15:59:47 2025 +0200 Merge branches 'acpi-soc', 'acpi-fan', 'acpi-dptf', 'acpi-pfrut', 'acpi-prm' and 'acpi-tad' Merge updates of assorted ACPI drivers for 6.17-rc1: - Remove an AudioDSP-related ID from the ACPI LPSS driver (Andy Shevchenko) - Replace sprintf()/scnprintf() with sysfs_emit() in the ACPI fan driver and update a debug message in fan_get_state_acpi4() (Eslam Khafagy, Abdelrahman Fekry, Sumeet Pawnikar) - Add Intel Wildcat Lake support to the ACPI DPTF driver (Srinivas Pandruvada) - Add more debug information regarding failing firmware updates to the ACPI pfr_update driver (Chen Yu) - Reduce the verbosity of the ACPI PRM (platform runtime mechanism) driver to avoid user confusion (Zhu Qiyu) - Replace sprintf() with sysfs_emit() in the ACPI TAD (time and alarm device) driver (Sukrut Heroorkar) * acpi-soc: ACPI: LPSS: Remove AudioDSP related ID * acpi-fan: ACPI: fan: Update debug message in fan_get_state_acpi4() ACPI: fan: Replace sprintf() with sysfs_emit() ACPI: fan: Replace sprintf()/scnprintf() with sysfs_emit() in show() functions * acpi-dptf: ACPI: DPTF: Support for Wildcat Lake * acpi-pfrut: ACPI: pfr_update: Add more debug information when firmware update failed * acpi-prm: ACPI: PRM: Reduce unnecessary printing to avoid user confusion * acpi-tad: ACPI: TAD: Replace sprintf() with sysfs_emit() commit ef93a685e01a281b5e2a25ce4e3428cf9371a205 Author: Trond Myklebust Date: Tue Jul 22 09:24:58 2025 -0400 NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() The function needs to check the minimal filehandle length before it can access the embedded filehandle. Reported-by: zhangjian Fixes: 20fa19027286 ("nfs: add export operations") Signed-off-by: Trond Myklebust commit 6984f941f49b7de132004a88a21b2f629f0a7516 Merge: 114048179f24fd c1f1fda141373d Author: Rafael J. Wysocki Date: Tue Jul 22 15:50:20 2025 +0200 Merge branch 'acpi-apei' Merge ACPI APEI updates for 6.17-rc1: - Fix iomem-related sparse warnings in the APEI EINJ driver (Zaid Alali, Tony Luck) - Add EINJv2 error injection support to the APEI EINJ driver (Zaid Alali) - Fix memory corruption in error_type_set() in the APEI EINJ driver (Dan Carpenter) - Fix less than zero comparison on a size_t variable in the APEI EINJ driver (Colin Ian King) - Fix check and iounmap of an uninitialized pointer in the APEI EINJ driver (Colin Ian King) - Add TAINT_MACHINE_CHECK to the GHES panic path in APEI to improve diagnostics and post-mortem analysis (Breno Leitao) - Update APEI reviewer records in MAINTAINERS (Rafael Wysocki) - Fix the handling of synchronous uncorrected memory errors in APEI (Shuai Xue) * acpi-apei: ACPI: APEI: handle synchronous exceptions in task work ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered ACPI: APEI: MAINTAINERS: Update reviewers for APEI ACPI: APEI: EINJ: Fix trigger actions ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable ACPI: APEI: EINJ: prevent memory corruption in error_type_set() ACPI: APEI: EINJ: Update the documentation for EINJv2 support ACPI: APEI: EINJ: Enable EINJv2 error injections ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome ACPI: APEI: EINJ: Discover EINJv2 parameters ACPI: APEI: EINJ: Add einjv2 extension struct ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities ACPI: APEI: EINJ: Fix kernel test sparse warnings commit 114048179f24fd4eccd23d187eb6ae4b1732787b Merge: 492086faa559e5 ef4af870be41a2 acec3f6aa4f2bd 94fd4423036fc3 4a89166ee0750b Author: Rafael J. Wysocki Date: Tue Jul 22 15:48:55 2025 +0200 Merge branches 'acpica', 'acpi-proc', 'acpi-processor' and 'acpi-pm' Merge an ACPICA update, ACPI proc interface updates, ACPI processor driver updates, and ACPI power management updates for 6.17-rc1: - Printing the address in acpi_ex_trace_point() is either incorrect during early kernel boot or not really useful later when pathnames resolve properly, so stop doing it (Mario Limonciello) - Address several minor issues in the legacy ACPI proc interface (Andy Shevchenko) - Fix acpi_object union initialization in the ACPI processor driver to avoid using memory that contains leftover data (Sebastian Ott). - Make the ACPI processor perflib driver take the initial _PPC limit into account as appropriate (Jiayi Li). - Fix message formatting in the ACPI processor throttling driver (Colin Ian King). - Clean up general ACPI PM domain handling (Rafael Wysocki) * acpica: ACPICA: Decrease `AcpiExTracePoint` verbosity * acpi-proc: ACPI: proc: Prefer to use octal permission ACPI: proc: Use str_enabled_disabled() helper ACPI: proc: Remove unused header ACPI: proc: Use correct format specifier and drop casting ACPI: wakeup: Drop unneeded casting for sleep_state * acpi-processor: ACPI: processor: throttling: Remove space before newline ACPI: processor: perflib: Fix initial _PPC limit application ACPI: processor: fix acpi_object initialization * acpi-pm: ACPI: PM: Set .detach in acpi_general_pm_domain definition commit 391daec35b937a78c2628d08ddb0b7fb7419e950 Merge: 2094200b5f77e6 49f02e6877d1be Author: Paolo Abeni Date: Tue Jul 22 15:36:40 2025 +0200 Merge branch 'octeontx2-af-rpm-misc-feaures' Hariprasad Kelam says: ==================== Octeontx2-af: RPM: misc feaures This series patches adds different features like debugfs support for shared firmware structure and DMAC filter related enhancements. Patch1: Saves interface MAC address configured from DMAC filters. Patch2: Disables the stale DMAC filters in driver initialization Patch3: Configure dma mask for CGX/RPM drivers Patch4: Debugfs support for shared firmware data. ==================== Link: https://patch.msgid.link/20250720163638.1560323-1-hkelam@marvell.com Signed-off-by: Paolo Abeni commit 49f02e6877d1bec848048dc6366859c30bbc0a04 Author: Hariprasad Kelam Date: Sun Jul 20 22:06:38 2025 +0530 Octeontx2-af: Debugfs support for firmware data MAC address, Link modes (supported and advertised) and eeprom data for the Netdev interface are read from the shared firmware data. This patch adds debugfs support for the same. Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20250720163638.1560323-5-hkelam@marvell.com Signed-off-by: Paolo Abeni commit f5295b5a58492f94833bc0ed0a157c32ec973c8c Author: Hariprasad Kelam Date: Sun Jul 20 22:06:37 2025 +0530 Octeontx2-af: RPM: Update DMA mask CGX/RPM driver supports 48 bits of DMA addressing. Update the DMA mask accordingly. Signed-off-by: Hariprasad Kelam Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250720163638.1560323-4-hkelam@marvell.com Signed-off-by: Paolo Abeni commit 83d17aba92ca11bfb745e4f068debc955d02d229 Author: Subbaraya Sundeep Date: Sun Jul 20 22:06:36 2025 +0530 Octeontx2-af: Disable stale DMAC filters During driver initialization disable stale DMAC filters in CGX/RPM set by firmware. Signed-off-by: Subbaraya Sundeep Signed-off-by: Hariprasad Kelam Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250720163638.1560323-3-hkelam@marvell.com Signed-off-by: Paolo Abeni commit dd47fc6769340536d0d451bfe0793440f630a73f Author: Hariprasad Kelam Date: Sun Jul 20 22:06:35 2025 +0530 Octeontx2-af: Add programmed macaddr to RVU pfvf Octeontx2/CN10k MAC block supports DMAC filters. DMAC filters can be installed on the interface through ethtool. When a user installs a DMAC filter, the interface's MAC address is implicitly added to the filter list. To ensure consistency, this MAC address must be kept in sync with the pfvf->mac_addr field, which is used to install MAC-based NPC rules. This patch updates the pfvf->mac_addr field with the programmed MAC address and also enables VF interfaces to install DMAC filters. Signed-off-by: Hariprasad Kelam Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250720163638.1560323-2-hkelam@marvell.com Signed-off-by: Paolo Abeni commit 4a3556b81b99f0c8c0358f7cc6801a62b4538fe2 Author: Kathiravan Thirumoorthy Date: Mon Jun 30 13:48:13 2025 +0530 phy: qcom: phy-qcom-m31: Update IPQ5332 M31 USB phy initialization sequence The current configuration used for the IPQ5332 M31 USB PHY fails the Near End High Speed Signal Quality compliance test. To resolve this, update the initialization sequence as specified in the Hardware Design Document. Fixes: 08e49af50701 ("phy: qcom: Introduce M31 USB PHY driver") Cc: stable@kernel.org Signed-off-by: Kathiravan Thirumoorthy Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250630-ipq5332_hsphy_complaince-v2-1-63621439ebdb@oss.qualcomm.com Signed-off-by: Vinod Koul commit 4c3d05da59eb75bdb7869f8668778dae87229168 Author: Rob Herring (Arm) Date: Fri Jun 27 17:01:25 2025 -0500 dt-bindings: phy: Convert brcm,sr-usb-combo-phy to DT schema Convert the Broadcom Stingray USB PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250627220126.214577-1-robh@kernel.org Signed-off-by: Vinod Koul commit 99dd7faeb7a4d973f049e1bad234888777e03646 Author: Rob Herring (Arm) Date: Fri Jun 27 17:01:06 2025 -0500 dt-bindings: phy: Convert ti,da830-usb-phy to DT schema Convert the TI DA830 USB PHY binding to DT schema format. Add "clocks" and "clock-names" which are already in use. As they are always present, make them required as well. Signed-off-by: Rob Herring (Arm) Reviewed-by: David Lechner Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250627220107.214162-1-robh@kernel.org Signed-off-by: Vinod Koul commit a91ec5efde530747c23f3182cc5b53ba99b57051 Author: Krzysztof Kozlowski Date: Tue Jul 1 08:36:37 2025 +0200 dt-bindings: phy: marvell,mmp2-usb-phy: Drop status from the example Examples should not have the 'status' property and 'okay' is anyway by default. Signed-off-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250701063636.23872-2-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit 429efeb1900d4a3164e1233b392ee5f489b6c3f8 Author: Liu Ying Date: Mon Jul 7 10:47:00 2025 +0800 dt-bindings: phy: mixel, mipi-dsi-phy: Allow assigned-clock* properties assigned-clock* properties can be used by default now, so allow them. Signed-off-by: Liu Ying Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250707-dt-bindings-phy-mixel-mipi-dsi-phy-allow-assign-clock-properties-v1-1-5e34b257e1ef@nxp.com Signed-off-by: Vinod Koul commit f31ac39c037a77a87e210b0f6d86fdefe8fc7258 Author: Kaustabh Chakraborty Date: Thu Jul 10 16:42:48 2025 +0530 phy: exynos-mipi-video: correct cam0 sysreg property name for exynos7870 Fix the cam0 sysreg property name (samsung,cam0-sysreg), which has been erroneously declared as samsung,cam-sysreg. This follows the same name used in Exynos5433 PHY. Fixes: 543f5e314282 ("phy: exynos-mipi-video: introduce support for exynos7870") Reviewed-by: Krzysztof Kozlowski Signed-off-by: Kaustabh Chakraborty Link: https://lore.kernel.org/r/20250710-exynos7870-mipi-phy-fix-v2-1-5cf50d69c9d7@disroot.org Signed-off-by: Vinod Koul commit 2094200b5f77e6710f9594571889f64f31966de1 Author: Mingming Cao Date: Sat Jul 19 05:13:56 2025 -0400 ibmveth: Add multi buffers rx replenishment hcall support This patch enables batched RX buffer replenishment in ibmveth by using the new firmware-supported h_add_logical_lan_buffers() hcall to submit up to 8 RX buffers in a single call, instead of repeatedly calling the single-buffer h_add_logical_lan_buffer() hcall. During the probe, with the patch, the driver queries ILLAN attributes to detect IBMVETH_ILLAN_RX_MULTI_BUFF_SUPPORT bit. If the attribute is present, rx_buffers_per_hcall is set to 8, enabling batched replenishment. Otherwise, it defaults to 1, preserving the original upstream behavior with no change in code flow for unsupported systems. The core rx replenish logic remains the same. But when batching is enabled, the driver aggregates up to 8 fully prepared descriptors into a single h_add_logical_lan_buffers() hypercall. If any allocation or DMA mapping fails while preparing a batch, only the successfully prepared buffers are submitted, and the remaining are deferred for the next replenish cycle. If at runtime the firmware stops accepting the batched hcall—e,g, after a Live Partition Migration (LPM) to a host that does not support h_add_logical_lan_buffers(), the hypercall returns H_FUNCTION. In that case, the driver transparently disables batching, resets rx_buffers_per_hcall to 1, and falls back to the single-buffer hcall in next future replenishments to take care of these and future buffers. Test were done on systems with firmware that both supports and does not support the new h_add_logical_lan_buffers hcall. On supported firmware, this reduces hypercall overhead significantly over multiple buffers. SAR measurements showed about a 15% improvement in packet processing rate under moderate RX load, with heavier traffic seeing gains more than 30% Signed-off-by: Mingming Cao Reviewed-by: Brian King Reviewed-by: Haren Myneni Reviewed-by: Dave Marquardt Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250719091356.57252-1-mmc@linux.ibm.com Signed-off-by: Paolo Abeni commit 4ff3aeb664f7dfe824ba91ffb0b203397a8d431e Author: Mario Limonciello Date: Fri Jul 18 12:23:05 2025 -0500 platform/x86/amd: pmc: Add Lenovo Yoga 6 13ALC6 to pmc quirk list The Lenovo Yoga 6 13ACL6 82ND has a similar BIOS problem as other Lenovo laptops from that vintage that causes a rather long resume from suspend. Add it to the quirk list that manipulates the scratch register to avoid the issue. Reported-by: Adam Berglund Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4434 Tested-by: Adam Berglund Signed-off-by: Mario Limonciello Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250718172307.1928744-1-superm1@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit cf685b3826e62a5e8bdc61135c0a60d128673e1b Author: Thomas Zimmermann Date: Tue Jul 15 14:24:38 2025 +0200 platform/x86: dell-uart-backlight: Use blacklight power constant The backlight subsystem has gotten its own power constants. Replace FB_BLANK_UNBLANK with BACKLIGHT_POWER_ON. Signed-off-by: Thomas Zimmermann Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250715122643.137027-2-tzimmermann@suse.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1e94cb6c2ae1c2660ed406669f12b90c7052d2b9 Merge: 9bf3eb1a9eb56f 866032d5625a76 Author: Rafael J. Wysocki Date: Tue Jul 22 14:47:07 2025 +0200 Merge back earlier thermal control updates for 6.17 commit 9bf3eb1a9eb56fc3466d3a442aed365e88e1dd21 Merge: d7b8f8e20813f0 1d264d3a198839 Author: Rafael J. Wysocki Date: Tue Jul 22 14:45:51 2025 +0200 Merge tag 'thermal-v6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux Merge thermal driver updates for 6.17-rc1 from Daniel Lezcano: "- Enable the stage 2 shutdown and support to more SPMI variants (Anjelique Melendez) - Constify thermal_zone_device_ops structure when possible in the different thermal drivers (Christophe Jaillet) - Use the dev_fwnode() helper instead of of_fwnode_handle() which is more adequate wherever is possible in the thermal drivers (Jiri Slaby) - Implement and document One-Time Programmable fuse support for the Rockchip driver in order to increase the precision of the measurements (Nicolas Frattaroli) - Change the way the Mediatek LTVS driver stores the initialization data sequence to support different sequences regarding the current platform. Introduce the mt7988 support with a new initialization sequence (Mason Chang) - Document the QCom TSens Milos Temperature Sensor DT bindings (Luca Weiss) - Add the fallback compatible string for MT7981 and MT8516 DT bindings (Aleksander Jan Bajkowski) - Add the compatible string for Tegra210B01 SOC_THERM driver (Aaron Kling)" * tag 'thermal-v6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/thermal/linux: dt-bindings: thermal: tegra: Document Tegra210B01 dt-bindings: thermal: mediatek: Add fallback compatible string for MT7981 and MT8516 dt-bindings: thermal: qcom-tsens: document the Milos Temperature Sensor thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const thermal/drivers/rockchip: Support reading trim values from OTP dt-bindings: thermal: rockchip: document otp thermal trim thermal/drivers/rockchip: Support RK3576 SoC in the thermal driver dt-bindings: rockchip-thermal: Add RK3576 compatible thermal/drivers/rockchip: Rename rk_tsadcv3_tshut_mode thermal: Use dev_fwnode() thermal: Constify struct thermal_zone_device_ops thermal/drivers/loongson2: Constify struct thermal_zone_device_ops thermal/drivers/qcom-spmi-temp-alarm: Add support for LITE PMIC peripherals thermal/drivers/qcom-spmi-temp-alarm: Add support for GEN2 rev 2 PMIC peripherals thermal/drivers/qcom-spmi-temp-alarm: Prepare to support additional Temp Alarm subtypes thermal/drivers/qcom-spmi-temp-alarm: Add temp alarm data struct based on HW subtype thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required commit 828c3e9dce25a9551e52fd076136f4d9936c0498 Author: Luca Weiss Date: Tue Jul 15 09:29:37 2025 +0200 phy: qcom: phy-qcom-snps-eusb2: Update init sequence per HPG 1.0.2 The eUSB2 HPG version 1.0.2 asks to clear bits [7:1] on all targets. Implement that change in the driver to follow. See also https://lore.kernel.org/linux-arm-msm/7d073433-f254-4d75-a68b-d184f900294a@oss.qualcomm.com/ Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250715-sm7635-eusb-phy-v3-4-6c3224085eb6@fairphone.com Signed-off-by: Vinod Koul commit 7f5f703210109366c1e1b685086c9b0a4897ea54 Author: Luca Weiss Date: Tue Jul 15 09:29:36 2025 +0200 phy: qcom: phy-qcom-snps-eusb2: Add missing write from init sequence As per a commit from Qualcomm's downstream 6.1 kernel[0], the init sequence is missing setting the CMN_CTRL_OVERRIDE_EN bit back to 0 at the end, as per the 'latest' HPG revision (as of November 2023). [0] https://git.codelinaro.org/clo/la/kernel/qcom/-/commit/b77774a89e3fda3246e09dd39e16e2ab43cd1329 Fixes: 80090810f5d3 ("phy: qcom: Add QCOM SNPS eUSB2 driver") Reviewed-by: Konrad Dybcio Reviewed-by: Neil Armstrong Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-eusb-phy-v3-3-6c3224085eb6@fairphone.com Signed-off-by: Vinod Koul commit bb39f49a433312ba7558b7cc44cfd9131b46bce1 Author: Luca Weiss Date: Tue Jul 15 09:29:35 2025 +0200 dt-bindings: phy: qcom,snps-eusb2: document the Milos Synopsys eUSB2 PHY Document the Synopsys eUSB2 PHY on the Milos SoC by using the SM8550 as fallback. Acked-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-eusb-phy-v3-2-6c3224085eb6@fairphone.com Signed-off-by: Vinod Koul commit 9e891b0d21bc889898e726783f20bd81f5fd4056 Author: Luca Weiss Date: Tue Jul 15 09:29:34 2025 +0200 dt-bindings: usb: qcom,snps-dwc3: Add Milos compatible Document the Milos dwc3 compatible. Acked-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-eusb-phy-v3-1-6c3224085eb6@fairphone.com Signed-off-by: Vinod Koul commit 8d39d6ec4db5da9899993092227584a97c203fd3 Author: Thomas Gleixner Date: Fri Jul 18 20:54:12 2025 +0200 genirq: Prevent migration live lock in handle_edge_irq() Yicon reported and Liangyan debugged a live lock in handle_edge_irq() related to interrupt migration. If the interrupt affinity is moved to a new target CPU and the interrupt is currently handled on the previous target CPU for edge type interrupts the handler might get stuck on the previous target: CPU 0 (previous target) CPU 1 (new target) handle_edge_irq() repeat: handle_event() handle_edge_irq() if (INPROGESS) { set(PENDING); mask(); return; } if (PENDING) { clear(PENDING); unmask(); goto repeat; } The migration in software never completes and CPU0 continues to handle the pending events forever. This happens when the device raises interrupts with a high rate and always before handle_event() completes and before the CPU0 handler can clear INPROGRESS so that CPU1 sets the PENDING flag over and over. This has been observed in virtual machines. Prevent this by checking whether the CPU which observes the INPROGRESS flag is the new affinity target. If that's the case, do not set the PENDING flag and wait for the INPROGRESS flag to be cleared instead, so that the new interrupt is handled on the new target CPU and the previous CPU is released from the action. This is restricted to the edge type handler and only utilized on systems, which use single CPU targets for interrupt affinity. Reported-by: Yicong Shen Reported-by: Liangyan Signed-off-by: Thomas Gleixner Tested-by: Liangyan Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/all/20250701163558.2588435-1-liangyan.peng@bytedance.com Link: https://lore.kernel.org/all/20250718185312.076515034@linutronix.de commit c609045abc778689ce42e8f5827a84179ace52c5 Author: Thomas Gleixner Date: Fri Jul 18 20:54:10 2025 +0200 genirq: Split up irq_pm_check_wakeup() Let the calling code check for the IRQD_WAKEUP_ARMED flag to prepare for a live lock mitigation in the edge type handler. No functional change. Signed-off-by: Thomas Gleixner Tested-by: Liangyan Link: https://lore.kernel.org/all/20250718185312.012392426@linutronix.de commit 4e879dedd571128ed5aa4d5989ec0a1938804d20 Author: Thomas Gleixner Date: Fri Jul 18 20:54:08 2025 +0200 genirq: Move irq_wait_for_poll() to call site Move it to the call site so that the waiting for the INPROGRESS flag can be reused by an upcoming mitigation for a potential live lock in the edge type handler. No functional change. Signed-off-by: Thomas Gleixner Tested-by: Liangyan Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/all/20250718185311.948555026@linutronix.de commit 46958a7bac2d32fda43fd7cd1858aa414640fbd1 Author: Thomas Gleixner Date: Fri Jul 18 20:54:06 2025 +0200 genirq: Remove pointless local variable The variable is only used at one place, which can simply take the constant as function argument. Signed-off-by: Thomas Gleixner Tested-by: Liangyan Link: https://lore.kernel.org/all/20250718185311.884314473@linutronix.de commit 25facbabc3fc33c794ad09d73f73268c0f8cbc7d Author: Geraldo Nascimento Date: Mon Jun 30 19:25:28 2025 -0300 phy: rockchip-pcie: Properly disable TEST_WRITE strobe signal pcie_conf is used to touch TEST_WRITE strobe signal. This signal should be enabled, a little time waited, and then disabled. Current code clearly was copy-pasted and never disables the strobe signal. Adjust the define. While at it, remove PHY_CFG_RD_MASK which has been unused since 64cdc0360811 ("phy: rockchip-pcie: remove unused phy_rd_cfg function"). Reviewed-by: Neil Armstrong Signed-off-by: Geraldo Nascimento Link: https://lore.kernel.org/r/d514d5d5627680caafa8b7548cbdfee4307f5440.1751322015.git.geraldogabriel@gmail.com Signed-off-by: Vinod Koul commit c3fe7071e196e25789ecf90dbc9e8491a98884d7 Author: Valmantas Paliksa Date: Mon Jun 30 19:25:14 2025 -0300 phy: rockchip-pcie: Enable all four lanes if required Current code enables only Lane 0 because pwr_cnt will be incremented on first call to the function. Let's reorder the enablement code to enable all 4 lanes through GRF. Reviewed-by: Neil Armstrong Reviewed-by: Robin Murphy Signed-off-by: Valmantas Paliksa Signed-off-by: Geraldo Nascimento Reviewed-by: Robin Murphy Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/16b610aab34e069fd31d9f57260c10df2a968f80.1751322015.git.geraldogabriel@gmail.com Signed-off-by: Vinod Koul commit dfef90f29811b5b8bc6353e259cac6134a88671f Author: Ziyue Zhang Date: Thu Jul 3 02:56:28 2025 -0700 dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Update pcie phy bindings for QCS615 QCS615 pcie phy only use 5 clocks, which are aux, cfg_ahb, ref, ref_gen, pipe. So move "qcom,qcs615-qmp-gen3x1-pcie-phy" compatible from 6 clocks' list to 5 clocks' list. Fixes: 1e889f2bd837 ("dt-bindings: phy: qcom,sc8280xp-qmp-pcie-phy: Document the QCS615 QMP PCIe PHY Gen3 x1") Signed-off-by: Ziyue Zhang Acked-by: Krzysztof Kozlowski Reviewed-by: Johan Hovold Link: https://lore.kernel.org/r/20250703095630.669044-2-ziyue.zhang@oss.qualcomm.com Signed-off-by: Vinod Koul commit 708243c62efde8241e2c66e9c3f377658855149d Author: Antonio Quartulli Date: Tue Jul 22 14:06:34 2025 +0200 wifi: mac80211: fix unassigned variable access In ieee80211_latest_active_link_conn_timeout() we loop over all sta->links in order to compute the timeout expiring last across all links. Such timeout is stored in `latest_timeout` which is used in the time_after() comparison before having been initialized. Fix this behaviour by initializing the variable to `jiffies` and adapt surrouding conditions accordingly. Note that the caller assumed latest_timeout to be 0 if no active link was found. This is not appropriate because jiffies=0 is a valid (and recurrent, although not often) point in time. By using `jiffies` as default value for latest_timeout, we can fix the caller as well. Address-Coverity-ID: 1647986 ("Uninitialized variables (UNINIT)") Fixes: 1bc892d76a6f ("wifi: mac80211: extend connection monitoring for MLO") Signed-off-by: Antonio Quartulli Link: https://patch.msgid.link/20250722120634.3501-1-antonio@mandelbit.com Signed-off-by: Johannes Berg commit f66e6bffc531bafaeb067e6f6af56f52d5cd4ac2 Author: Trond Myklebust Date: Fri Jul 18 19:13:55 2025 -0700 SUNRPC: Silence warnings about parameters not being described Warning: net/sunrpc/auth_gss/gss_krb5_crypto.c:902 function parameter 'len' not described in 'krb5_etm_decrypt' Warning: net/sunrpc/auth_gss/gss_krb5_crypto.c:902 function parameter 'buf' not described in 'krb5_etm_decrypt' Signed-off-by: Trond Myklebust commit ec0abdda891f082dcb95bfbe7fcc82b12342e506 Author: Trond Myklebust Date: Fri Jul 18 16:44:03 2025 -0700 NFS: Clean up pnfs_put_layout_hdr()/pnfs_destroy_layout_final() Use the wake_up_var_locked() and wait_var_event_spinlock() helpers. Signed-off-by: Trond Myklebust commit 1db3a48e83bb64a70bf27263b7002585574a9c2d Author: Trond Myklebust Date: Fri Jul 18 16:15:27 2025 -0700 NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() Use store_release_wake_up() to add the appropriate memory barrier before calling wake_up_var(&dentry->d_fsdata). Reported-by: Lukáš Hejtmánek Suggested-by: Santosh Pradhan Link: https://lore.kernel.org/all/18945D18-3EDB-4771-B019-0335CE671077@ics.muni.cz/ Fixes: 99bc9f2eb3f7 ("NFS: add barriers when testing for NFS_FSDATA_BLOCKED") Signed-off-by: Trond Myklebust commit f5b3108e6a14418b120a3c38ca589b8d6cf87627 Author: Christoph Hellwig Date: Fri Jul 18 10:14:50 2025 +0200 NFS: use a hash table for delegation lookup nfs_delegation_find_inode currently has to walk the entire list of delegations per inode, which can become pretty large, and can become even larger when increasing the delegation watermark. Add a hash table to speed up the delegation lookup, sized as a fraction of the delegation watermark. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250718081509.2607553-6-hch@lst.de Signed-off-by: Trond Myklebust commit 2fb4af5ea3c735a205d97de10f044f809b20af51 Author: Christoph Hellwig Date: Fri Jul 18 10:14:49 2025 +0200 NFS: track active delegations per-server The active delegation watermark was added to avoid overloading servers. Track the active delegation per-server instead of globally so that clients talking to multiple servers aren't limited by the global limit. Signed-off-by: Christoph Hellwig Reviewed-by: Jeff Layton Link: https://lore.kernel.org/r/20250718081509.2607553-5-hch@lst.de Signed-off-by: Trond Myklebust commit aee077d8edc8b9772b205f4104686d676171e61f Author: Christoph Hellwig Date: Fri Jul 18 10:14:48 2025 +0200 NFS: move the delegation_watermark module parameter Keep the module_param_named next to the variable declaration instead of somewhere unrelated, following the best practice in the rest of the kernel. Signed-off-by: Christoph Hellwig Reviewed-by: Jeff Layton Link: https://lore.kernel.org/r/20250718081509.2607553-4-hch@lst.de Signed-off-by: Trond Myklebust commit 7375bbad467e9b1b101d591a458b49a0f3896641 Author: Christoph Hellwig Date: Fri Jul 18 10:14:47 2025 +0200 NFS: cleanup nfs_inode_reclaim_delegation Reduce a level of indentation for most of the code in this function. Signed-off-by: Christoph Hellwig Reviewed-by: Jeff Layton Link: https://lore.kernel.org/r/20250718081509.2607553-3-hch@lst.de Signed-off-by: Trond Myklebust commit 67173860a763b99317184bfaa821abd3578a4ce3 Author: Christoph Hellwig Date: Fri Jul 18 10:14:46 2025 +0200 NFS: cleanup error handling in nfs4_server_common_setup Return error directly instead of using a goto label for it. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250718081509.2607553-2-hch@lst.de Signed-off-by: Trond Myklebust commit f06bedfa62d57f7b67d44aacd6badad2e13a803f Author: Tigran Mkrtchyan Date: Fri Jun 27 09:17:51 2025 +0200 pNFS/flexfiles: don't attempt pnfs on fatal DS errors When an applications get killed (SIGTERM/SIGINT) while pNFS client performs a connection to DS, client ends in an infinite loop of connect-disconnect. This source of the issue, it that flexfilelayoutdev#nfs4_ff_layout_prepare_ds gets an error on nfs4_pnfs_ds_connect with status ERESTARTSYS, which is set by rpc_signal_task, but the error is treated as transient, thus retried. The issue is reproducible with Ctrl+C the following script(there should be ~1000 files in a directory, client should must not have any connections to DSes): ``` echo 3 > /proc/sys/vm/drop_caches for i in * do head -1 $i done ``` The change aims to propagate the nfs4_ff_layout_prepare_ds error state to the caller that can decide whatever this is a retryable error or not. Signed-off-by: Tigran Mkrtchyan Link: https://lore.kernel.org/r/20250627071751.189663-1-tigran.mkrtchyan@desy.de Fixes: 260f32adb88d ("pNFS/flexfiles: Check the result of nfs4_pnfs_ds_connect") Signed-off-by: Trond Myklebust commit c262b444bd0d6bfbcda65130e6137952bef422f6 Author: Christoph Hellwig Date: Mon Jul 14 08:24:50 2025 +0200 NFS: drop __exit from nfs_exit_keyring Otherwise built-in NFS can lead to sectіon mismatches. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250714062450.1468117-1-hch@lst.de Fixes: 87268f7a4f1f ("nfs: create a kernel keyring") Signed-off-by: Trond Myklebust commit f3fc8f06492693d4fcb32c9821fb465d4c7f5a97 Author: Christoph Hellwig Date: Mon Jul 14 08:30:45 2025 +0200 NFS: pass struct nfs_client_initdata to nfs4_set_client Passed the partially filled out structure to nfs4_set_client instead of 11 arguments that then get stashed into the structure. Signed-off-by: Christoph Hellwig Signed-off-by: Trond Myklebust commit 07dad44aa9a93b16af19e8609a10b241c352b440 Author: Shankari Anand Date: Tue Jul 15 16:34:23 2025 +0530 rust: kernel: move ARef and AlwaysRefCounted to sync::aref Move the definitions of `ARef` and `AlwaysRefCounted` from `types.rs` to a new file `sync/aref.rs`. Define the corresponding `aref` module under `rust/kernel/sync.rs`. These types are better grouped in `sync`. To avoid breaking existing imports, they are re-exported from `types.rs`. Drop unused imports `mem::ManuallyDrop`, `ptr::NonNull` from `types.rs`, they are now only used in `sync/aref.rs`, where they are already imported. Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1173 Signed-off-by: Shankari Anand Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250715110423.334744-1-shankari.ak0208@gmail.com [ Added missing `///`. Changed module title. Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 4e6b5b8ab3e28148d04a63defadc29cfc771b102 Author: Benno Lossin Date: Wed May 21 01:17:13 2025 +0200 rust: sync: fix safety comment for `static_lock_class` The safety comment mentions lockdep -- which from a Rust perspective isn't important -- and doesn't mention the real reason for why it's sound to create `LockClassKey` as uninitialized memory. Signed-off-by: Benno Lossin Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250520231714.323931-1-lossin@kernel.org Signed-off-by: Miguel Ojeda commit ca652cf0c2612add5d3c9283bbc742dabc704a77 Merge: a234cffd04bc06 4781dbbfa5fee0 Author: Georgi Djakov Date: Tue Jul 22 18:18:41 2025 +0300 Merge branch 'icc-milos' into icc-next Add documentation and driver for the interconnect on the Milos SoC. * icc-milos dt-bindings: interconnect: document the RPMh Network-On-Chip Interconnect in Qualcomm Milos SoC interconnect: qcom: Add Milos interconnect provider driver Link: https://lore.kernel.org/r/20250709-sm7635-icc-v3-0-c446203c3b3a@fairphone.com Signed-off-by: Georgi Djakov commit 5d71c2b53f1790c2ca09d03848839c610653d278 Author: Joel Fernandes Date: Tue Jul 15 16:01:55 2025 -0400 rcu: Document concurrent quiescent state reporting for offline CPUs The synchronization of CPU offlining with GP initialization is confusing to put it mildly (rightfully so as the issue it deals with is complex). Recent discussions brought up a question -- what prevents the rcu_implicit_dyntick_qs() from warning about QS reports for offline CPUs (missing QS reports for offline CPUs causing indefinite hangs). QS reporting for now-offline CPUs should only happen from: - gp_init() - rcutree_cpu_report_dead() Add some documentation on this and refer to it from comments in the code explaining how QS reporting is not missed when these functions are concurrently running. I referred heavily to this post [1] about the need for the ofl_lock. [1] https://lore.kernel.org/all/20180924164443.GF4222@linux.ibm.com/ [ Applied paulmck feedback on moving documentation to Requirements.rst ] Link: https://lore.kernel.org/all/01b4d228-9416-43f8-a62e-124b92e8741a@paulmck-laptop/ Co-developed-by: "Paul E. McKenney" Signed-off-by: "Paul E. McKenney" Reviewed-by: Frederic Weisbecker Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 186779c036468038b0d077ec5333a51512f867e5 Author: Joel Fernandes Date: Tue Jul 15 16:01:54 2025 -0400 rcu: Document separation of rcu_state and rnp's gp_seq The details of this are subtle and was discussed recently. Add a quick-quiz about this and refer to it from the code, for more clarity. Reviewed-by: "Paul E. McKenney" Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 30a7806adab5f6b971cf07439ed6a3fac3fd80cf Author: Joel Fernandes Date: Tue Jul 15 16:01:53 2025 -0400 rcu: Document GP init vs hotplug-scan ordering requirements Add detailed comments explaining the critical ordering constraints during RCU grace period initialization, based on discussions with Frederic. Reviewed-by: "Paul E. McKenney" Co-developed-by: Frederic Weisbecker Signed-off-by: Frederic Weisbecker Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 4781dbbfa5fee0e24856ee1f35275f64c5619fd7 Author: Luca Weiss Date: Wed Jul 9 15:14:50 2025 +0200 interconnect: qcom: Add Milos interconnect provider driver Add driver for the Qualcomm interconnect buses found in Milos based platforms. The topology consists of several NoCs that are controlled by a remote processor that collects the aggregated bandwidth for each master-slave pairs. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250709-sm7635-icc-v3-2-c446203c3b3a@fairphone.com [georgi: remove null termination of nodes and links] Signed-off-by: Georgi Djakov commit 59c5dbd585a0bee70e51fcdf36185f7602b9c285 Author: Charles Keepax Date: Tue Jul 22 11:23:05 2025 +0100 ASoC: SDCA: Shrink detected_mode_handler() stack frame The stack frame for detected_mode_handler() is a bit large. Dynamically allocate the control value struct, which is most of the size, to avoid this. Fixes: b9ab3b618241 ("ASoC: SDCA: Add some initial IRQ handlers") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507182222.OLgOy9fX-lkp@intel.com/ Signed-off-by: Charles Keepax Reviewed-by: Arnd Bergmann Link: https://patch.msgid.link/20250722102305.2513755-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 5b838a24e9942d8b8da208f924701d0f989778cf Author: Stephen Rothwell Date: Tue Jul 22 11:27:54 2025 +0100 ASoC: SDCA: Check devm_mutex_init() return value Fix interaction with commit daec29dcc873 ("locking/mutex: Mark devm_mutex_init() as __must_check"), add return value check. There is no need for additional complex error handling here, failure to init the mutex means the code can't progress, so the failure just needs to be passed up to the caller. Fixes: b126394d9ec6 ("ASoC: SDCA: Generic interrupt support") Signed-off-by: Stephen Rothwell Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20250722102754.2514351-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit fed5aaeb4e94e0f071bf467f2bafd5ea6f093722 Author: Andy Shevchenko Date: Wed Jul 2 11:01:08 2025 +0300 rtc: sysfs: use __ATTRIBUTE_GROUPS() Embrace __ATTRIBUTE_GROUPS() to avoid boiler plate code. This should not introduce any functional changes. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250702080108.2722905-1-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit bbe8d4fef308cddd11b2e766c8710d318334b88b Author: Andy Shevchenko Date: Wed Jul 2 10:32:24 2025 +0300 rtc: sysfs: Bail out earlier if no new groups provided When there is no new groups provided, no need to reallocate memory, copy the old ones and free them in order to do nothing. Do nothing instead. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250702073224.2684097-1-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit 4dda8df717b7e5ad89de79844e5491aaf78b44da Author: Andy Shevchenko Date: Wed Jul 2 09:15:34 2025 +0300 rtc: sysfs: Use sysfs_emit() to instead of s*printf() Follow the advice of the Documentation/filesystems/sysfs.rst that show() should only use sysfs_emit() or sysfs_emit_at() when formatting the value to be returned to user space. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250702061534.2670729-1-andriy.shevchenko@linux.intel.com Signed-off-by: Alexandre Belloni commit e92eda97f8c534be63ab0ef322ad2fdfeb759e16 Author: Geert Uytterhoeven Date: Wed Jul 9 20:47:52 2025 +0200 rtc: sh: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas SuperH On-Chip RTC driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/396d4a769b8d3c6fec43c65022cdfd8a6854524a.1752086758.git.geert+renesas@glider.be Signed-off-by: Alexandre Belloni commit 0c6f0d77ab62ff557fd0cace8284bc67ef7ab79c Author: Geert Uytterhoeven Date: Tue Jul 1 09:44:39 2025 +0200 rtc: Rename lib_test to test_rtc_lib When compiling the RTC library functions test as a module, the module has the non-descriptive name "lib_test.ko". Fix this by renaming it to "test_rtc_lib.ko". Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/47019d7f8ced12107b54a372fdf34b1b8f7b6183.1751355848.git.geert@linux-m68k.org Signed-off-by: Alexandre Belloni commit c20413b799255a53e300f052b6b6c54d8fa58a7a Merge: b8da74000db397 bc1c2f0ae355f7 Author: Jens Axboe Date: Tue Jul 22 04:48:52 2025 -0600 Merge tag 'md-6.17-20250722' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into for-6.17/block Pull MD updates from Yu: "- call del_gendisk synchronously, from Xiao - cleanup unused variable, from John - cleanup workqueue flags, from Ryo - fix faulty rdev can't be removed during resync, from Qixing" * tag 'md-6.17-20250722' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: md/raid10: fix set but not used variable in sync_request_write() md: allow removing faulty rdev during resync md/raid5: unset WQ_CPU_INTENSIVE for raid5 unbound workqueue md: remove/add redundancy group only in level change md: Don't clear MD_CLOSING until mddev is freed md: call del_gendisk in control path commit b8da74000db3979a7ea1138125ba4b4cf105b608 Merge: 675f940576351b 5b2c214a95942f Author: Jens Axboe Date: Tue Jul 22 04:48:10 2025 -0600 Merge tag 'nvme-6.17-2025-07-22' of git://git.infradead.org/nvme into for-6.17/block Pull NVMe updates from Christoph: "- try PCIe function level reset on init failure (Keith Busch) - log TLS handshake failures at error level (Maurizio Lombardi) - pci-epf: do not complete commands twice if nvmet_req_init() fails (Rick Wertenbroek) - misc cleanups (Alok Tiwari)" * tag 'nvme-6.17-2025-07-22' of git://git.infradead.org/nvme: nvme-pci: try function level reset on init failure nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails nvme-tcp: log TLS handshake failures at error level docs: nvme: fix grammar in nvme-pci-endpoint-target.rst nvme: fix typo in status code constant for self-test in progress nvmet: remove redundant assignment of error code in nvmet_ns_enable() nvme: fix incorrect variable in io cqes error message nvme: fix multiple spelling and grammar issues in host drivers commit db8a5149fa360da9ba899484bbafd976ac885e5d Author: Yue Haibing Date: Sat Jul 19 16:15:51 2025 +0800 ip6_gre: Factor out common ip6gre tunnel match into helper Extract common ip6gre tunnel match from ip6gre_tunnel_lookup() into new helper function ip6gre_tunnel_match() to reduce code duplication. No functional change intended. Signed-off-by: Yue Haibing Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250719081551.963670-1-yuehaibing@huawei.com Signed-off-by: Paolo Abeni commit 0a1416a49e63c320f6e6c1c8d07e1b58c0d4a3f3 Author: Prashant Malani Date: Tue Jul 22 05:55:40 2025 +0000 cpufreq: CPPC: Mark driver with NEED_UPDATE_LIMITS flag AMU counters on certain CPPC-based platforms tend to yield inaccurate delivered performance measurements on systems that are idle/mostly idle. This results in an inaccurate frequency being stored by cpufreq in its policy structure when the CPU is brought online. [1] Consequently, if the userspace governor tries to set the frequency to a new value, there is a possibility that it would be the erroneous value stored earlier. In such a scenario, cpufreq would assume that the requested frequency has already been set and return early, resulting in the correct/new frequency request never making it to the hardware. Since the operating frequency is liable to this sort of inconsistency, mark the CPPC driver with CPUFREQ_NEED_UPDATE_LIMITS so that it is always invoked when a target frequency update is requested. Link: https://lore.kernel.org/linux-pm/20250619000925.415528-3-pmalani@google.com/ [1] Suggested-by: Rafael J. Wysocki Signed-off-by: Prashant Malani Acked-by: Viresh Kumar Link: https://patch.msgid.link/20250722055611.130574-2-pmalani@google.com Signed-off-by: Rafael J. Wysocki commit 8e7a67ca5a8013ac6055c776d7d1ef4c4047ee48 Author: Catalin Marinas Date: Tue Jul 22 10:55:48 2025 +0100 arm64: Kconfig: Keep selects somewhat alphabetically ordered Recent patches selecting HAVE_RELIABLE_STACKTRACE and HAVE_LIVEPATCH added them to the end of the ARM64 Kconfig select list. Move them around to keep this list nearly alphabetically ordered. Signed-off-by: Catalin Marinas commit 492086faa559e5b0bf776d2ade2497394d1ce151 Author: Colin Ian King Date: Mon Jul 21 15:59:52 2025 +0100 ACPI/PCI: Remove space before newline There is an extraneous space before a newline in an acpi_handle_debug() message. Remove it. Signed-off-by: Colin Ian King Acked-by: Bjorn Helgaas Link: https://patch.msgid.link/20250721145952.2601422-1-colin.i.king@gmail.com Signed-off-by: Rafael J. Wysocki commit 1a665a71ef0fb043c6cfafbf6a6cc9cdc2357505 Author: Kevin Brodsky Date: Thu Jun 19 17:00:42 2025 +0100 arm64: signal: Remove ISB when resetting POR_EL0 POR_EL0 is set to its most permissive value before setting up the signal frame, to ensure that uaccess succeeds regardless of the signal stack's pkey. We are now tolerant to spurious POE faults. This means that we do not strictly need to issue an ISB after updating POR_EL0, even when followed by uaccess. The question is whether a fault is likely to happen or not if the ISB is omitted; in this case the answer seems to be no. If the regular stack is used, then it should already be accessible. If the alternate signal stack is used, then a special (inaccessible) pkey may be used - the assumption is that this situation is very uncommon. Remove the ISB to speed up the regular path - this should not have any functional impact regardless of the scenario. Signed-off-by: Kevin Brodsky Link: https://lore.kernel.org/r/20250619160042.2499290-3-kevin.brodsky@arm.com Signed-off-by: Catalin Marinas commit cdb794002d9059bf82acba6b68a7324db4451494 Merge: 3fc894728fb3a0 c1fffc5d66a714 Author: Paolo Abeni Date: Tue Jul 22 11:35:51 2025 +0200 Merge branch 'gve-af_xdp-zero-copy-for-dqo-rda' Joshua Washington says: ==================== gve: AF_XDP zero-copy for DQO RDA This patch series adds support for AF_XDP zero-copy in the DQO RDA queue format. XSK infrastructure is updated to re-post buffers when adding XSK pools because XSK umem will be posted directly to the NIC, a departure from the bounce buffer model used in GQI QPL. A registry of XSK pools is introduced to prevent the usage of XSK pools when in copy mode. v1: https://lore.kernel.org/netdev/20250714160451.124671-1-jeroendb@google.com/ ==================== Link: https://patch.msgid.link/20250717152839.973004-1-jeroendb@google.com Signed-off-by: Paolo Abeni commit c1fffc5d66a7147d557736c2341a511e0896d9ff Author: Joshua Washington Date: Thu Jul 17 08:28:39 2025 -0700 gve: implement DQO RX datapath and control path for AF_XDP zero-copy Add the RX datapath for AF_XDP zero-copy for DQ RDA. The RX path is quite similar to that of the normal XDP case. Parallel methods are introduced to properly handle XSKs instead of normal driver buffers. To properly support posting from XSKs, queues are destroyed and recreated, as the driver was initially making use of page pool buffers instead of the XSK pool memory. Expose support for AF_XDP zero-copy, as the TX and RX datapaths both exist. Reviewed-by: Willem de Bruijn Signed-off-by: Praveen Kaligineedi Signed-off-by: Joshua Washington Signed-off-by: Jeroen de Borst Link: https://patch.msgid.link/20250717152839.973004-6-jeroendb@google.com Signed-off-by: Paolo Abeni commit 2236836eab2629978e9777dbde83161f9c7b450b Author: Joshua Washington Date: Thu Jul 17 08:28:38 2025 -0700 gve: implement DQO TX datapath for AF_XDP zero-copy In the descriptor clean path, a number of changes need to be made to accommodate out of order completions and double completions. The XSK stack can only handle completions being processed in order, as a single counter is incremented in xsk_tx_completed to sigify how many XSK descriptors have been completed. Because completions can come back out of order in DQ, a separate queue of XSK descriptors must be maintained. This queue keeps the pending packets in the order that they were written so that the descriptors can be counted in xsk_tx_completed in the same order. For double completions, a new pending packet state and type are introduced. The new type, GVE_TX_PENDING_PACKET_DQO_XSK, plays an anlogous role to pre-existing _SKB and _XDP_FRAME pending packet types for XSK descriptors. The new state, GVE_PACKET_STATE_XSK_COMPLETE, represents packets for which no more completions are expected. This includes packets which have received a packet completion or reinjection completion, as well as packets whose reinjection completion timer have timed out. At this point, such packets can be counted as part of xsk_tx_completed() and freed. Reviewed-by: Willem de Bruijn Signed-off-by: Praveen Kaligineedi Signed-off-by: Joshua Washington Signed-off-by: Jeroen de Borst Link: https://patch.msgid.link/20250717152839.973004-5-jeroendb@google.com Signed-off-by: Paolo Abeni commit 652fe13b1fd841528442c22170a3c9030c17822d Author: Joshua Washington Date: Thu Jul 17 08:28:37 2025 -0700 gve: keep registry of zc xsk pools in netdev_priv Relying on xsk_get_pool_from_qid for getting whether zero copy is enabled on a queue is erroneous, as an XSK pool is registered in xp_assign_dev whether AF_XDP zero-copy is enabled or not. This becomes problematic when queues are restarted in copy mode, as all RX queues with XSKs will register a pool, causing the driver to exercise the zero-copy codepath. This patch adds a bitmap to keep track of which queues have zero-copy enabled. Reviewed-by: Willem de Bruijn Signed-off-by: Joshua Washington Signed-off-by: Jeroen de Borst Link: https://patch.msgid.link/20250717152839.973004-4-jeroendb@google.com Signed-off-by: Paolo Abeni commit 077f7153fd2582874b0dec8c8fcd687677d0f4cc Author: Joshua Washington Date: Thu Jul 17 08:28:36 2025 -0700 gve: merge xdp and xsk registration The existence of both of these xdp_rxq and xsk_rxq is redundant. xdp_rxq can be used in both the zero-copy mode and the copy mode case. XSK pool memory model registration is prioritized over normal memory model registration to ensure that memory model registration happens only once per queue. Reviewed-by: Willem de Bruijn Signed-off-by: Joshua Washington Signed-off-by: Jeroen de Borst Link: https://patch.msgid.link/20250717152839.973004-3-jeroendb@google.com Signed-off-by: Paolo Abeni commit d57ae093c887180b72c575724c1779f5ca0f5b5b Author: Joshua Washington Date: Thu Jul 17 08:28:35 2025 -0700 gve: deduplicate xdp info and xsk pool registration logic The XDP registration path currently has a lot of reused logic, leading changes to the codepaths to be unnecessarily complex. gve_reg_xsk_pool extracts the logic of registering an XSK pool with a queue into a method that can be used by both XDP_SETUP_XSK_POOL and gve_reg_xdp_info. gve_unreg_xdp_info is used to undo XDP info registration in the error path instead of explicitly unregistering the XDP info, as it is more complete and idempotent. This patch will be followed by other changes to the XDP registration logic, and will simplify those changes due to the use of common methods. Reviewed-by: Willem de Bruijn Signed-off-by: Joshua Washington Signed-off-by: Jeroen de Borst Link: https://patch.msgid.link/20250717152839.973004-2-jeroendb@google.com Signed-off-by: Paolo Abeni commit e40892214b454c8734350d82374f46c2e495a4d2 Author: Colin Ian King Date: Tue Jul 15 14:06:26 2025 +0100 selftests/futex: Fix spelling mistake "Succeffuly" -> "Successfully" There is a spelling mistake in a ksft_exit_fail_msg() message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250715130627.1907017-1-colin.i.king@gmail.com commit 04850819c65c8242072818655d4341e70ae998b5 Author: Cynthia Huang Date: Thu Jul 10 18:36:30 2025 +0800 selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t The kernel does not provide sys_futex() on 32-bit architectures that do not support 32-bit time representations, such as riscv32. As a result, glibc cannot define SYS_futex, causing compilation failures in tests that rely on this syscall. Define SYS_futex as SYS_futex_time64 in such cases to ensure successful compilation and compatibility. Signed-off-by: Cynthia Huang Signed-off-by: Ben Zong-You Xie Signed-off-by: Thomas Gleixner Reviewed-by: Muhammad Usama Anjum Link: https://lore.kernel.org/all/20250710103630.3156130-1-ben717@andestech.com commit 1b5f1454091e9e9fb5c944b3161acf4ec0894d0d Author: Feng Lee <379943137@qq.com> Date: Mon Jul 21 16:04:35 2025 +0800 sched/idle: Remove play_idle() play_idle() is no longer in use, so delete it. Signed-off-by: Feng Lee <379943137@qq.com> Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/tencent_C3E0BD9B812C27A30FC49F1EA6A4B1352707@qq.com commit 51a486feac0ca002bee6429f03da0a6c206d0dc5 Author: Miguel Ojeda Date: Tue Jul 22 10:55:00 2025 +0200 rust: io: fix broken intra-doc links to `platform::Device` `platform` is not accessible from here. Thus fix the intra-doc links by qualifying the paths a bit more. Fixes: 1d0d4b28513b ("rust: io: mem: add a generic iomem abstraction") Signed-off-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250722085500.1360401-2-ojeda@kernel.org Signed-off-by: Danilo Krummrich commit 83fb6160727874a588d70b727bc34f367362e6ed Author: Miguel Ojeda Date: Tue Jul 22 10:54:59 2025 +0200 rust: io: fix broken intra-doc link to missing `flags` module There is no `mod flags` in this case, unlike others. Instead, they are associated constants for the `Flags` type. Thus reword the sentence to fix the broken intra-doc link, providing an example of constant and linking to it to clarify which ones we are referring to. Fixes: 493fc33ec252 ("rust: io: add resource abstraction") Signed-off-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250722085500.1360401-1-ojeda@kernel.org Signed-off-by: Danilo Krummrich commit da30705c4621fc82d68483f114f5a395a5f472d2 Author: Christophe Leroy Date: Tue Jul 1 12:49:29 2025 +0200 arch/powerpc: Remove .interp section in vmlinux When building with CONFIG_RELOCATABLE, there is a .interp section which contains the name of the expected ELF interpreter: Contents of section .interp: c0000000021c1bac 2f757372 2f6c6962 2f6c642e 736f2e31 /usr/lib/ld.so.1 c0000000021c1bbc 00 . That information is useless and even likely wrong. Remove it. Link: https://github.com/linuxppc/issues/issues/434 Signed-off-by: Christophe Leroy Acked-by: Segher Boessenkool Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/eeaf8fd6628a75d19872ab31cf7e7179e2baef5e.1751366959.git.christophe.leroy@csgroup.eu commit 69bf2053608423cbe348f4c5d4f8d737e607d1ad Author: Thomas Huth Date: Fri Jul 11 09:25:53 2025 +0200 powerpc: Drop GPL boilerplate text with obsolete FSF address The FSF does not reside in the Franklin street anymore, so we should not request the people to write to this address. Fortunately, these header files already contain a proper SPDX license identifier, so it should be fine to simply drop all of this license boilerplate code here. Suggested-by: Greg Kroah-Hartman Signed-off-by: Thomas Huth Reviewed-by: Greg Kroah-Hartman Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250711072553.198777-1-thuth@redhat.com commit 4bb69d5270df0f78874c93efade580d9550b34a9 Author: Thomas Weißschuh Date: Fri Jul 18 15:20:25 2025 +0200 powerpc: Don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Link: https://lore.kernel.org/lkml/20250113171731-dc10e3c1-da64-4af0-b767-7c7070468023@linutronix.de/ Signed-off-by: Thomas Weißschuh Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250718-restricted-pointers-powerpc-v2-1-fd7bddd809f3@linutronix.de commit 69fdb084355d6c0b353536024cc51aa5f7ffb62c Author: Miri Korenblit Date: Mon Jul 21 21:50:49 2025 +0300 wifi: mac80211: don't require cipher and keylen in gtk rekey ieee80211_add_gtk_rekey receives a keyconf as an argument, and the cipher and keylen are taken from there to the new allocated key. But in rekey, both the cipher and the keylen should be the same as of the old key, so let ieee80211_add_gtk_rekey find those, so drivers won't have to fill it in. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250721214922.3c5c023bfae9.Ie6594ae2b4b6d5b3d536e642b349046ebfce7a5d@changeid Signed-off-by: Johannes Berg commit 2ed9a9fc9976262109d04f1a3c75c46de8ce4f22 Author: Kees Cook Date: Mon Jul 21 11:31:29 2025 -0700 wifi: nl80211: Set num_sub_specs before looping through sub_specs The processing of the struct cfg80211_sar_specs::sub_specs flexible array requires its counter, num_sub_specs, to be assigned before the loop in nl80211_set_sar_specs(). Leave the final assignment after the loop in place in case fewer ended up in the array. Fixes: aa4ec06c455d ("wifi: cfg80211: use __counted_by where appropriate") Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://patch.msgid.link/20250721183125.work.183-kees@kernel.org Signed-off-by: Johannes Berg commit a37192c432adaec9e8ef29e4ddb319ea2f443aa6 Author: Kees Cook Date: Mon Jul 21 11:25:22 2025 -0700 wifi: mac80211: Write cnt before copying in ieee80211_copy_rnr_beacon() While I caught the need for setting cnt early in nl80211_parse_rnr_elems() in the original annotation of struct cfg80211_rnr_elems with __counted_by, I missed a similar pattern in ieee80211_copy_rnr_beacon(). Fix this by moving the cnt assignment to before the loop. Fixes: 7b6d7087031b ("wifi: cfg80211: Annotate struct cfg80211_rnr_elems with __counted_by") Signed-off-by: Kees Cook Reviewed-by: Gustavo A. R. Silva Link: https://patch.msgid.link/20250721182521.work.540-kees@kernel.org Signed-off-by: Johannes Berg commit 4752dcc156f2090143296ff45f8e35c8ec3e1730 Author: Mark Brown Date: Fri Jul 18 23:14:52 2025 +0100 kselftest/arm64: Handle attempts to disable SM on SME only systems The ABI for disabling streaming mode via ptrace is to do a write via the SVE register set. Following the recent round of fixes to the ptrace code we don't support this operation on systems without SVE, which is detected as failures by fp-ptrace. Update the program so that it knows that this operation is not currently supported. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250718-arm64-fp-ptrace-sme-only-v1-3-3b96dd19a503@kernel.org Signed-off-by: Catalin Marinas commit aa7d3c8bc27d32dec940c924d6d270fa312e731f Author: Mark Brown Date: Fri Jul 18 23:14:51 2025 +0100 kselftest/arm64: Fix SVE write data generation for SME only systems fp-ptrace does not handle SME only systems correctly when generating data, on SME only systems scenarios where we are not in streaming mode will not have an expected vector length. This leads to attempts to do memcpy()s of zero byte arrays which can crash, fix this by skipping generation of SVE data for cases where we do not expect to have an active vector length. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250718-arm64-fp-ptrace-sme-only-v1-2-3b96dd19a503@kernel.org Signed-off-by: Catalin Marinas commit b021f45d39f37f67005948a96abea84736890463 Author: Mark Brown Date: Fri Jul 18 23:14:50 2025 +0100 kselftest/arm64: Test SME on SME only systems in fp-ptrace When checking that the vector extensions are supported fp-ptrace currently only checks for SVE being supported which means that we get into a confused half configured state for SME only systems. Check for SME as well. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250718-arm64-fp-ptrace-sme-only-v1-1-3b96dd19a503@kernel.org Signed-off-by: Catalin Marinas commit b84d2b27954f83c95c4b984d4f85574e8f51caa5 Author: Mark Brown Date: Fri Jul 18 23:03:26 2025 +0100 kselftest/arm64: Test FPSIMD format data writes via NT_ARM_SVE in fp-ptrace The NT_ARM_SVE register set supports two data formats, the native SVE one and an alternative format where we embed a copy of user_fpsimd_data as used for NT_PRFPREG in the SVE register set. The register data is set as for a write to NT_PRFPREG and changes in vector length and streaming mode are handled as for any NT_ARM_SVE write. This has not previously been tested by fp-ptrace, add coverage of it. We do not support writes in FPSIMD format for NT_ARM_SSVE so we skip the test for anything that would leave us in streaming mode. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250718-arm64-fp-ptrace-sve-fpsimd-v1-1-7ecda32aa297@kernel.org Signed-off-by: Catalin Marinas commit b5cebb5de9a8fce3f6e6451f6db8e5608c7f2261 Author: Mark Brown Date: Fri Jul 18 19:33:16 2025 +0100 kselftest/arm64: Allow sve-ptrace to run on SME only systems Currently the sve-ptrace test program only runs if the system supports SVE but since SME includes streaming SVE the tests it offers are valid even on a system that only supports SME. Since the tests already have individual hwcap checks just remove the top level test and rely on those. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250718-arm64-sve-ptrace-sme-only-v1-1-2a1121e51b1d@kernel.org Signed-off-by: Catalin Marinas commit ee0e5ce2790c5be14ea3d422cac323e059a43792 Merge: 84b62b72b4c759 4a2bf707270f89 Author: Johannes Berg Date: Tue Jul 22 10:24:52 2025 +0200 Merge tag 'ath-next-20250721' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath into wireless-next Jeff Johnson says: ================== ath.git patches for v6.17 Highlights for some specific drivers include: ath9k: Add AHB "of" support ath11k: Support device-specific firmware override Fix potentially reordered access to device memory ath12k: Add more Wi-Fi 7 functionality Add more statistics to DebugFS Support different memory profiles Support 802.11 encap/decap offload to firmware Fix potentially reordered access to device memory And of course there is the usual set of cleanups and bug fixes across the entire family of "ath" drivers. ================== Signed-off-by: Johannes Berg commit c64d6be1a6f8c93274bb861ec75c59453508093a Author: Kees Cook Date: Thu Jul 17 16:25:12 2025 -0700 s390: Handle KCOV __init vs inline mismatches When KCOV is enabled all functions get instrumented, unless the __no_sanitize_coverage attribute is used. To prepare for __no_sanitize_coverage being applied to __init functions, we have to handle differences in how GCC's inline optimizations get resolved. For s390 this exposed a place where the __init annotation was missing but ended up being "accidentally correct". Fix this cases and force a couple functions to be inline with __always_inline. Acked-by: Heiko Carstens Link: https://lore.kernel.org/r/20250717232519.2984886-7-kees@kernel.org Signed-off-by: Kees Cook commit 2424fe1cac4fc8ea0520ba22ede7544c3ddc8dd1 Author: Kees Cook Date: Thu Jul 17 16:25:10 2025 -0700 arm: Handle KCOV __init vs inline mismatches When KCOV is enabled all functions get instrumented, unless the __no_sanitize_coverage attribute is used. To prepare for __no_sanitize_coverage being applied to __init functions, we have to handle differences in how GCC's inline optimizations get resolved. For arm this exposed several places where __init annotations were missing but ended up being "accidentally correct". Fix these cases and force several functions to be inline with __always_inline. Acked-by: Nishanth Menon Acked-by: Lee Jones Reviewed-by: Nishanth Menon Link: https://lore.kernel.org/r/20250717232519.2984886-5-kees@kernel.org Signed-off-by: Kees Cook commit d01daf9d95c9918bd11f990e807517f214a83ea2 Author: Kees Cook Date: Thu Jul 17 16:25:14 2025 -0700 mips: Handle KCOV __init vs inline mismatch When KCOV is enabled all functions get instrumented, unless the __no_sanitize_coverage attribute is used. To prepare for __no_sanitize_coverage being applied to __init functions, we have to handle differences in how GCC's inline optimizations get resolved. For mips this requires adding the __init annotation on init_mips_clocksource(). Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/20250717232519.2984886-9-kees@kernel.org Signed-off-by: Kees Cook commit 645d1b666498ef0d2c44c434a609b5560e9dc401 Author: Ritesh Harjani (IBM) Date: Thu Jul 17 16:25:13 2025 -0700 powerpc/mm/book3s64: Move kfence and debug_pagealloc related calls to __init section Move a few kfence and debug_pagealloc related functions in hash_utils.c and radix_pgtable.c to __init sections since these are only invoked once by an __init function during system initialization. i.e. - hash_debug_pagealloc_alloc_slots() - hash_kfence_alloc_pool() - hash_kfence_map_pool() The above 3 functions only gets called by __init htab_initialize(). - alloc_kfence_pool() - map_kfence_pool() The above 2 functions only gets called by __init radix_init_pgtable() This should also help fix warning msgs like: >> WARNING: modpost: vmlinux: section mismatch in reference: hash_debug_pagealloc_alloc_slots+0xb0 (section: .text) -> memblock_alloc_try_nid (section: .init.text) Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202504190552.mnFGs5sj-lkp@intel.com/ Signed-off-by: Ritesh Harjani (IBM) Link: https://lore.kernel.org/r/20250717232519.2984886-8-kees@kernel.org Signed-off-by: Kees Cook commit 437641a72d0a675242ae3e649a30b4c51b3ad450 Author: Kees Cook Date: Thu Jul 17 16:25:18 2025 -0700 configs/hardening: Enable CONFIG_INIT_ON_FREE_DEFAULT_ON To reduce stale data lifetimes, enable CONFIG_INIT_ON_FREE_DEFAULT_ON as well. This matches the addition of CONFIG_STACKLEAK=y, which is doing similar for stack memory. Link: https://lore.kernel.org/r/20250717232519.2984886-13-kees@kernel.org Signed-off-by: Kees Cook commit 4c56d9f7e75eb2a137584f708fa262d7e8c8a2d8 Author: Kees Cook Date: Thu Jul 17 16:25:17 2025 -0700 configs/hardening: Enable CONFIG_KSTACK_ERASE Since we can wipe the stack with both Clang and GCC plugins, enable this for the "hardening.config" for wider testing. Link: https://lore.kernel.org/r/20250717232519.2984886-12-kees@kernel.org Signed-off-by: Kees Cook commit 76261fc7d1be3fde06efed859cb10c95b1204055 Author: Kees Cook Date: Thu Jul 17 16:25:08 2025 -0700 stackleak: Split KSTACK_ERASE_CFLAGS from GCC_PLUGINS_CFLAGS In preparation for Clang stack depth tracking for KSTACK_ERASE, split the stackleak-specific cflags out of GCC_PLUGINS_CFLAGS into KSTACK_ERASE_CFLAGS. Link: https://lore.kernel.org/r/20250717232519.2984886-3-kees@kernel.org Signed-off-by: Kees Cook commit 9ea1e8d28add49ab3c1ecfa43f08d92ee23f3e33 Author: Kees Cook Date: Thu Jul 17 16:25:07 2025 -0700 stackleak: Rename stackleak_track_stack to __sanitizer_cov_stack_depth The Clang stack depth tracking implementation has a fixed name for the stack depth tracking callback, "__sanitizer_cov_stack_depth", so rename the GCC plugin function to match since the plugin has no external dependencies on naming. Link: https://lore.kernel.org/r/20250717232519.2984886-2-kees@kernel.org Signed-off-by: Kees Cook commit 57fbad15c2eee77276a541c616589b32976d2b8e Author: Kees Cook Date: Thu Jul 17 16:25:06 2025 -0700 stackleak: Rename STACKLEAK to KSTACK_ERASE In preparation for adding Clang sanitizer coverage stack depth tracking that can support stack depth callbacks: - Add the new top-level CONFIG_KSTACK_ERASE option which will be implemented either with the stackleak GCC plugin, or with the Clang stack depth callback support. - Rename CONFIG_GCC_PLUGIN_STACKLEAK as needed to CONFIG_KSTACK_ERASE, but keep it for anything specific to the GCC plugin itself. - Rename all exposed "STACKLEAK" names and files to "KSTACK_ERASE" (named for what it does rather than what it protects against), but leave as many of the internals alone as possible to avoid even more churn. While here, also split "prev_lowest_stack" into CONFIG_KSTACK_ERASE_METRICS, since that's the only place it is referenced from. Suggested-by: Ingo Molnar Link: https://lore.kernel.org/r/20250717232519.2984886-1-kees@kernel.org Signed-off-by: Kees Cook commit 3ea3a256ed81f95ab0f3281a0e234b01a9cae605 Author: Showrya M N Date: Fri Jun 27 16:53:29 2025 +0530 scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated In case of an ib_fast_reg_mr allocation failure during iSER setup, the machine hits a panic because iscsi_conn->dd_data is initialized unconditionally, even when no memory is allocated (dd_size == 0). This leads invalid pointer dereference during connection teardown. Fix by setting iscsi_conn->dd_data only if memory is actually allocated. Panic trace: ------------ iser: iser_create_fastreg_desc: Failed to allocate ib_fast_reg_mr err=-12 iser: iser_alloc_rx_descriptors: failed allocating rx descriptors / data buffers BUG: unable to handle page fault for address: fffffffffffffff8 RIP: 0010:swake_up_locked.part.5+0xa/0x40 Call Trace: complete+0x31/0x40 iscsi_iser_conn_stop+0x88/0xb0 [ib_iser] iscsi_stop_conn+0x66/0xc0 [scsi_transport_iscsi] iscsi_if_stop_conn+0x14a/0x150 [scsi_transport_iscsi] iscsi_if_rx+0x1135/0x1834 [scsi_transport_iscsi] ? netlink_lookup+0x12f/0x1b0 ? netlink_deliver_tap+0x2c/0x200 netlink_unicast+0x1ab/0x280 netlink_sendmsg+0x257/0x4f0 ? _copy_from_user+0x29/0x60 sock_sendmsg+0x5f/0x70 Signed-off-by: Showrya M N Signed-off-by: Potnuri Bharat Teja Link: https://lore.kernel.org/r/20250627112329.19763-1-showrya@chelsio.com Reviewed-by: Chris Leech Signed-off-by: Martin K. Petersen commit d2af710d6d50b3a3e691c4e2b262ed9de3038e96 Author: Gustavo A. R. Silva Date: Wed Jul 9 22:47:13 2025 +0300 wifi: iwlwifi: mvm/fw: Avoid -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. We have a flexible struct iwl_tx_cmd_v6 in the middle of a few structs, but those don't even need the flexible part. So, we add iwl_tx_cmd_v6_params, that will contain everything except the flexible array and use this one for the containing structs. Also, as part of the refactoring remove unused flex array `payload`. So, with these changes, fix the following warnings: drivers/net/wireless/intel/iwlwifi/mld/../fw/api/tdls.h:134:27: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlwifi/mld/../fw/api/tdls.h:53:27: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlwifi/mld/../fw/api/tx.h:745:27: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlwifi/mld/../fw/api/tx.h:764:27: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlwifi/mvm/../fw/api/tdls.h:134:27: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlwifi/mvm/../fw/api/tdls.h:53:27: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlwifi/mvm/../fw/api/tx.h:745:27: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlwifi/mvm/../fw/api/tx.h:764:27: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Link: https://msgid.link/aCUOQ6wdD1jQjO36@kspp [use iwl_tx_cmd_v6_params as described in the changed commit message] Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709224608.0785a61b0826.I6da02c2a12a5ed1e6d317045a6995d132850a455@changeid Signed-off-by: Miri Korenblit commit 9296cc59b2278a30a44504fd588b119aff7896ae Author: WangYuli Date: Tue Jul 15 13:58:27 2025 +0800 wifi: iwlwifi: Fix typo "ransport" There is a spelling mistake of 'ransport' in comments which should be 'transport'. Link: https://lore.kernel.org/all/03DFEDFFB5729C96+20250714104736.559226-1-wangyuli@uniontech.com/ Signed-off-by: WangYuli Link: https://patch.msgid.link/8F065DF7EF7EEB89+20250715055828.932160-1-wangyuli@uniontech.com Signed-off-by: Miri Korenblit commit 7b87c542c0115726f67461a6360d2cece1d11896 Author: Antonio Quartulli Date: Wed Jul 16 22:19:11 2025 +0200 wifi: iwlwifi: fix cmd length when sending WOWLAN_TSC_RSC_PARAM In iwl_mvm_wowlan_config_rsc_tsc() when calling iwl_mvm_send_cmd_pdu() we are accidentally passing the size of a pointer rather than the size of the object pointed by it. Fix the expression in order to pass the approriate object length. Fixes: 493681d9f95b ("wifi: iwlwifi: remove support of version 4 of iwl_wowlan_rsc_tsc_params_cmd") Address-Coverity-ID: 1647627 ("Incorrect expression (SIZEOF_MISMATCH)") Signed-off-by: Antonio Quartulli Link: https://patch.msgid.link/20250716201911.700-1-antonio@mandelbit.com Signed-off-by: Miri Korenblit commit 603e4dbe9146ad76c6d65a25947ca8bba05f1a67 Author: Ewan D. Milne Date: Mon Jul 21 12:46:52 2025 -0400 scsi: scsi_transport_fc: Add comments to describe added 'rport' parameter Note that there is no executable code altered by this patch. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507181446.aAoFiDm5-lkp@intel.com/ Signed-off-by: Ewan D. Milne Link: https://lore.kernel.org/r/20250721164652.335716-1-emilne@redhat.com Signed-off-by: Martin K. Petersen commit 8cd876e7833758f8a924db2e39530d2a9afd2703 Author: Guenter Roeck Date: Mon Jul 21 16:19:17 2025 -0700 lib/crypto: tests: Annotate worker to be on stack The following warning traceback is seen if object debugging is enabled with the new crypto test code. ODEBUG: object 9000000106237c50 is on stack 9000000106234000, but NOT annotated. ------------[ cut here ]------------ WARNING: lib/debugobjects.c:655 at lookup_object_or_alloc.part.0+0x19c/0x1f4, CPU#0: kunit_try_catch/468 ... This also results in a boot stall when running the code in qemu:loongarch. Initializing the worker with INIT_WORK_ONSTACK() fixes the problem. Fixes: 950a81224e8b ("lib/crypto: tests: Add hash-test-template.h and gen-hash-testvecs.py") Signed-off-by: Guenter Roeck Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250721231917.3182029-1-linux@roeck-us.net Signed-off-by: Eric Biggers commit 3fc894728fb3a0d9282e81247b68c07468fe2985 Merge: e8c24e23c4c9f5 4c86c9fdf6a513 Author: Jakub Kicinski Date: Mon Jul 21 18:20:21 2025 -0700 Merge branch 'ethtool-rss-support-creating-and-removing-contexts-via-netlink' Jakub Kicinski says: ==================== ethtool: rss: support creating and removing contexts via Netlink This series completes support of RSS configuration via Netlink. All functionality supported by the IOCTL is now supported by Netlink. Future series (time allowing) will add: - hashing on the flow label, which started this whole thing; - pinning the RSS context to a Netlink socket for auto-cleanup. The first patch is a leftover held back from previous series to avoid conflicting with Gal's fix. Next 4 patches refactor existing code to make reusing it for context creation possible. 2 patches after that add create and delete commands. Last but not least the test is extended. ==================== Link: https://patch.msgid.link/20250717234343.2328602-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4c86c9fdf6a51394434811add48c7d5fe7da47ef Author: Jakub Kicinski Date: Thu Jul 17 16:43:43 2025 -0700 selftests: drv-net: rss_api: context create and delete tests Add test cases for creating and deleting contexts. TAP version 13 1..12 ok 1 rss_api.test_rxfh_nl_set_fail ok 2 rss_api.test_rxfh_nl_set_indir ok 3 rss_api.test_rxfh_nl_set_indir_ctx ok 4 rss_api.test_rxfh_indir_ntf ok 5 rss_api.test_rxfh_indir_ctx_ntf ok 6 rss_api.test_rxfh_nl_set_key ok 7 rss_api.test_rxfh_fields ok 8 rss_api.test_rxfh_fields_set ok 9 rss_api.test_rxfh_fields_set_xfrm # SKIP no input-xfrm supported ok 10 rss_api.test_rxfh_fields_ntf ok 11 rss_api.test_rss_ctx_add ok 12 rss_api.test_rss_ctx_ntf # Totals: pass:11 fail:0 xfail:0 xpass:0 skip:1 error:0 Link: https://patch.msgid.link/20250717234343.2328602-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit fbe09277fa6324b50cc4eedb4d99498cf7dad897 Author: Jakub Kicinski Date: Thu Jul 17 16:43:42 2025 -0700 ethtool: rss: support removing contexts via Netlink Implement removing additional RSS contexts via Netlink. Technically it'd be possible to shoehorn the delete operation into ethnl_request_ops-compatible handler. The code ends up longer than open coded version, and I think we'll need a custom way of sending notifications at some stage (if we allow tying the context lifetime to the netlink socket, in the future). Link: https://patch.msgid.link/20250717234343.2328602-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a166ab7816c534973745b0fe7bce3c8cefc5426f Author: Jakub Kicinski Date: Thu Jul 17 16:43:41 2025 -0700 ethtool: rss: support creating contexts via Netlink Support creating contexts via Netlink. Setting flow hashing fields on the new context is not supported at this stage, it can be added later. An empty indirection table is not supported. This is a carry over from the IOCTL interface where empty indirection table meant delete. We can repurpose empty indirection table in Netlink but for now to avoid confusion reject it using the policy. Support letting user choose the ID for the new context. This was not possible in IOCTL since the context ID field for the create action had to be set to the ETH_RXFH_CONTEXT_ALLOC magic value. Link: https://patch.msgid.link/20250717234343.2328602-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 55ef461ce18fbe678f0b4834fc1eaa38c24f83fe Author: Jakub Kicinski Date: Thu Jul 17 16:43:40 2025 -0700 ethtool: move ethtool_rxfh_ctx_alloc() to common code Move ethtool_rxfh_ctx_alloc() to common code, Netlink will need it. Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250717234343.2328602-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5c090d9eae8807420bcb01a6280b02774e5320c6 Author: Jakub Kicinski Date: Thu Jul 17 16:43:39 2025 -0700 ethtool: rss: factor out populating response from context Similarly to previous change, factor out populating the response. We will use this after the context was allocated to send a notification so this time factor out from the additional context handling, rather than context 0 handling (for request context didn't exist, for response it does). Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250717234343.2328602-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a45f98efa483b7f40a97546b11a8020564a268ce Author: Jakub Kicinski Date: Thu Jul 17 16:43:38 2025 -0700 ethtool: rss: factor out allocating memory for response To ease the code reuse for RSS_CREATE we'll want to prepare struct rss_reply_data for the new context. Unfortunately we can't depend on the exiting scaffolding because the context doesn't exist (ctx=NULL) when we start preparing. Factor out the portion of the context 0 handling responsible for allocation of request memory, so that we can call it directly. Link: https://patch.msgid.link/20250717234343.2328602-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5f5c59b78e5a9389da07c1913dbe5ffd6d2759ee Author: Jakub Kicinski Date: Thu Jul 17 16:43:37 2025 -0700 ethtool: rejig the RSS notification machinery for more types In anticipation for CREATE and DELETE notifications - explicitly pass the notification type to ethtool_rss_notify(), when calling from the IOCTL code. Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250717234343.2328602-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 80e55735d5a5a1f765e807d4c38027039f48302f Author: Jakub Kicinski Date: Thu Jul 17 16:43:36 2025 -0700 ethtool: assert that drivers with sym hash are consistent for RSS contexts Supporting per-RSS context configuration of hashing fields but not the hashing algorithm would complicate the code a lot. We'd need to cross check the config against all RSS contexts. None of the drivers need this today, so explicitly prevent new drivers with such skewed capabilities from registering. If such driver appears it will need to first adjust the checks in the core. Link: https://patch.msgid.link/20250717234343.2328602-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e8c24e23c4c9f515b02dde01de9ec2c945b2fddc Merge: 1b02c861714bf2 154e56a77d81ad Author: Jakub Kicinski Date: Mon Jul 21 17:48:36 2025 -0700 Merge branch 'mptcp-add-tcp_maxseg-sockopt-support' Matthieu Baerts says: ==================== mptcp: add TCP_MAXSEG sockopt support The TCP_MAXSEG socket option was not supported by MPTCP, mainly because it has never been requested before. But there are still valid use-cases, e.g. with HAProxy. - Patch 1 is a small cleanup patch in the MPTCP sockopt file. - Patch 2 expose some code from TCP, to avoid duplicating it in MPTCP. - Patch 3 adds TCP_MAXSEG sockopt support in MPTCP. - Patch 4 is not related to the others, it fixes a typo in a comment. Note that the new TCP_MAXSEG sockopt support has been validated by a new packetdrill script on the MPTCP CI: https://github.com/multipath-tcp/packetdrill/pull/161 v1: https://lore.kernel.org/20250716-net-next-mptcp-tcp_maxseg-v1-0-548d3a5666f6@kernel.org ==================== Link: https://patch.msgid.link/20250719-net-next-mptcp-tcp_maxseg-v2-0-8c910fbc5307@kernel.org Signed-off-by: Jakub Kicinski commit 154e56a77d81ad49eb979aa64463d5fcfad51136 Author: moyuanhao Date: Sat Jul 19 00:06:59 2025 +0200 mptcp: fix typo in a comment This patch fixes the follow spelling mistake in a comment: greter -> greater Signed-off-by: moyuanhao Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250719-net-next-mptcp-tcp_maxseg-v2-4-8c910fbc5307@kernel.org Signed-off-by: Jakub Kicinski commit 51c5fd09e1b457eed103a22893603fb83a818162 Author: Geliang Tang Date: Sat Jul 19 00:06:58 2025 +0200 mptcp: add TCP_MAXSEG sockopt support The TCP_MAXSEG socket option is currently not supported by MPTCP, mainly because it has never been requested before. But there are still valid use-cases, e.g. with HAProxy. This patch adds its support in MPTCP by propagating the value to all subflows. The get part looks at the value on the first subflow, to be as closed as possible to TCP. Only one value can be returned for the cached MSS, so this can come only from one subflow. Similar to mptcp_setsockopt_first_sf_only(), a generic helper mptcp_setsockopt_all_subflows() is added to set sockopt for each subflows of the mptcp socket. Add a new member for struct mptcp_sock to store the TCP_MAXSEG value, and return this value in getsockopt. Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/515 Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250719-net-next-mptcp-tcp_maxseg-v2-3-8c910fbc5307@kernel.org Signed-off-by: Jakub Kicinski commit 51a62199a8aaac0d1645b1dd8e670a6f35aead81 Author: Geliang Tang Date: Sat Jul 19 00:06:57 2025 +0200 tcp: add tcp_sock_set_maxseg Add a helper tcp_sock_set_maxseg() to directly set the TCP_MAXSEG sockopt from kernel space. This new helper will be used in the following patch from MPTCP. Signed-off-by: Geliang Tang Acked-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250719-net-next-mptcp-tcp_maxseg-v2-2-8c910fbc5307@kernel.org Signed-off-by: Jakub Kicinski commit edd669057c56966b598a464d6e8c9fc0122a1b1c Author: Geliang Tang Date: Sat Jul 19 00:06:56 2025 +0200 mptcp: sockopt: drop redundant tcp_getsockopt tcp_getsockopt() is called twice in mptcp_getsockopt_first_sf_only() in different conditions, which makes the code a bit redundant. The first call to tcp_getsockopt() when the first subflow exists can be replaced by going to a new label "get" before the second call. Signed-off-by: Geliang Tang Reviewed-by: Matthieu Baerts (NGI0) Signed-off-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20250719-net-next-mptcp-tcp_maxseg-v2-1-8c910fbc5307@kernel.org Signed-off-by: Jakub Kicinski commit 1b02c861714bf28814926d1fcb3c5594de960757 Author: Aswin Karuvally Date: Fri Jul 18 16:17:11 2025 +0200 s390/qeth: Make hw_trap sysfs attribute idempotent Update qeth driver to allow writing an existing value to the "hw_trap" sysfs attribute. Attempting such a write earlier resulted in -EINVAL. In other words, make the sysfs attribute idempotent. After: $ cat hw_trap disarm $ echo disarm > hw_trap $ Suggested-by: Alexandra Winter Signed-off-by: Aswin Karuvally Reviewed-by: Alexandra Winter Signed-off-by: Alexandra Winter Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250718141711.1141049-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski commit 14e710d7080f7b5bf230c4ee1b417df8dc0c5ac6 Author: Luo Jie Date: Fri Jul 18 21:57:48 2025 +0800 net: phy: qcom: qca807x: Enable WoL support using shared library The Wake-on-LAN (WoL) functionality for the QCA807x series is identical to that of the AT8031. WoL support for QCA807x is enabled by utilizing the at8031_set_wol() function provided in the shared library. Reviewed-by: Maxime Chevallier Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250718-qca807x_wol_support-v1-1-cfe323cbb4e8@quicinc.com Signed-off-by: Jakub Kicinski commit c521b8c9f212f8304e9d5f92828ac662c621f32c Author: Oleksij Rempel Date: Fri Jul 18 09:51:56 2025 +0200 net: usb: smsc95xx: add support for ethtool pause parameters Implement ethtool .get_pauseparam and .set_pauseparam handlers for configuring flow control on smsc95xx. The driver now supports enabling or disabling transmit and receive pause frames, with or without autonegotiation. Pause settings are applied during link-up based on current PHY state and user configuration. Previously, the driver used phy_get_pause() during link-up handling, but lacked initialization and an ethtool interface to configure pause modes. As a result, flow control support was effectively non-functional. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250718075157.297923-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 53afec24ec9dd8e8459ca1634fef2f8c958fbc65 Merge: 19272b37aa4f83 c7f7ddbd27d55f Author: Stephen Boyd Date: Mon Jul 21 17:34:01 2025 -0700 Merge tag 'clk-microchip-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into clk-microchip Microchip clock updates for v6.17 - Fix the PLL output ranges for Microchip SAM9X7, based on the latest hardware documentation updates * tag 'clk-microchip-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: clk: at91: sam9x7: update pll clk ranges commit ab8cfde3404aed643caee6b9d2af8f83f3109069 Merge: 19272b37aa4f83 d274c77ffa202b Author: Stephen Boyd Date: Mon Jul 21 17:27:42 2025 -0700 Merge tag 'thead-clk-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into clk-thead Pull T-HEAD TH1520 clk driver updates from Drew Fustini: - Fix the parent data for osc_12m by referencing osc_24m by index. - Mark essential bus clocks as CLK_IGNORE_UNUSED to fix boot hang associated with the PVT sensor. * tag 'thead-clk-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux: clk: thead: th1520-ap: Correctly refer the parent of osc_12m clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED commit 95993dc3039e29dabb9a50d074145d4cb757b08b Author: Yonghong Song Date: Sun Jul 20 09:47:54 2025 -0700 bpf: Use ERR_CAST instead of ERR_PTR(PTR_ERR(...)) Intel linux test robot reported a warning that ERR_CAST can be used for error pointer casting instead of more-complicated/rarely-used ERR_PTR(PTR_ERR(...)) style. There is no functionality change, but still let us replace two such instances as it improves consistency and readability. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507201048.bceHy8zX-lkp@intel.com/ Signed-off-by: Yonghong Song Signed-off-by: Martin KaFai Lau Acked-by: Eduard Zingerman Link: https://patch.msgid.link/20250720164754.3999140-1-yonghong.song@linux.dev commit a0a6f598e34312793c75bf1a63eeb9c4bd572427 Merge: 19272b37aa4f83 132b62280a9dbe Author: Stephen Boyd Date: Mon Jul 21 17:20:15 2025 -0700 Merge tag 'v6.17-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into clk-rockchip Pull a Rockchip clk driver update from Heiko Stuebner: - 132MHz PLL rate for Rockchip rk3588 * tag 'v6.17-rockchip-clk1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: clk: rockchip: rk3568: Add PLL rate for 132MHz commit 0b3b3ba113f061c406fdfbb7dd634db2c41ff149 Merge: 61c3e8940f2d8b 0d1c95e42b77cb Author: Jakub Kicinski Date: Mon Jul 21 17:18:33 2025 -0700 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-07-18 (idpf, ice, igc, igbvf, ixgbevf) For idpf: Ahmed and Sudheer add support for flow steering via ntuple filters. Current support is for IPv4 and TCP/UDP only. Milena adds support for cross timestamping. Ahmed preserves coalesce settings across resets. For ice: Alex adds reporting of 40GbE speed in devlink port split. Dawid adds support for E835 devices. Jesse refactors profile ptype processing for cleaner, more readable, code. Dave adds a couple of helper functions for LAG to reduce code duplication. For igc: Siang adds support to configure "Default Queue" during runtime using ethtool's Network Flow Classification (NFC) wildcard rule approach. For igbvf: Yuto Ohnuki removes unused fields from igbvf_adapter. For ixgbevf: Yuto Ohnuki removes unused fields from ixgbevf_adapter. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixgbevf: remove unused fields from struct ixgbevf_adapter igbvf: remove unused fields from struct igbvf_adapter igc: Add wildcard rule support to ethtool NFC using Default Queue igc: Relocate RSS field definitions to igc_defines.h ice: breakout common LAG code into helpers ice: convert ice_add_prof() to bitmap ice: add E835 device IDs ice: add 40G speed to Admin Command GET PORT OPTION idpf: preserve coalescing settings across resets idpf: add cross timestamping idpf: add flow steering support virtchnl2: add flow steering support virtchnl2: rename enum virtchnl2_cap_rss ==================== Link: https://patch.msgid.link/20250718185118.2042772-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 61c3e8940f2d8b5bfeaeec4bedc2f3e7d873abb3 Author: Oliver Neukum Date: Thu Jul 17 14:06:17 2025 +0200 net: usb: cdc-ncm: check for filtering capability If the decice does not support filtering, filtering must not be used and all packets delivered for the upper layers to sort. Signed-off-by: Oliver Neukum Link: https://patch.msgid.link/20250717120649.2090929-1-oneukum@suse.com Signed-off-by: Jakub Kicinski commit 72b4612af36fec844857415f14fd07126dc4499a Author: Biju Das Date: Thu Jul 17 08:11:06 2025 +0100 net: stmmac: dwmac-renesas-gbeth: Add PM suspend/resume callbacks Add PM suspend/resume callbacks for RZ/G3E SMARC EVK. The PM deep entry is executed by pressing the SLEEP button and exit from entry is by pressing the power button. Logs: root@smarc-rzg3e:~# PM: suspend entry (deep) Filesystems sync: 0.115 seconds Freezing user space processes Freezing user space processes completed (elapsed 0.002 seconds) OOM killer disabled. Freezing remaining freezable tasks Freezing remaining freezable tasks completed (elapsed 0.001 seconds) printk: Suspending console(s) (use no_console_suspend to debug) NOTICE: BL2: v2.10.5(release):2.10.5/rz_soc_dev-162-g7148ba838 NOTICE: BL2: Built : 14:23:58, Jul 5 2025 NOTICE: BL2: SYS_LSI_MODE: 0x13e06 NOTICE: BL2: SYS_LSI_DEVID: 0x8679447 NOTICE: BL2: SYS_LSI_PRR: 0x0 NOTICE: BL2: Booting BL31 renesas-gbeth 15c30000.ethernet end0: Link is Down Disabling non-boot CPUs ... psci: CPU3 killed (polled 0 ms) psci: CPU2 killed (polled 0 ms) psci: CPU1 killed (polled 0 ms) Enabling non-boot CPUs ... Detected VIPT I-cache on CPU1 GICv3: CPU1: found redistributor 100 region 0:0x0000000014960000 CPU1: Booted secondary processor 0x0000000100 [0x412fd050] CPU1 is up Detected VIPT I-cache on CPU2 GICv3: CPU2: found redistributor 200 region 0:0x0000000014980000 CPU2: Booted secondary processor 0x0000000200 [0x412fd050] CPU2 is up Detected VIPT I-cache on CPU3 GICv3: CPU3: found redistributor 300 region 0:0x00000000149a0000 CPU3: Booted secondary processor 0x0000000300 [0x412fd050] CPU3 is up dwmac4: Master AXI performs fixed burst length 15c30000.ethernet end0: No Safety Features support found 15c30000.ethernet end0: IEEE 1588-2008 Advanced Timestamp supported 15c30000.ethernet end0: configuring for phy/rgmii-id link mode dwmac4: Master AXI performs fixed burst length 15c40000.ethernet end1: No Safety Features support found 15c40000.ethernet end1: IEEE 1588-2008 Advanced Timestamp supported 15c40000.ethernet end1: configuring for phy/rgmii-id link mode OOM killer enabled. Restarting tasks: Starting Restarting tasks: Done random: crng reseeded on system resumption PM: suspend exit 15c30000.ethernet end0: Link is Up - 1Gbps/Full - flow control rx/tx root@smarc-rzg3e:~# ifconfig end0 192.168.10.7 up root@smarc-rzg3e:~# ping 192.168.10.1 PING 192.168.10.1 (192.168.10.1) 56(84) bytes of data. 64 bytes from 192.168.10.1: icmp_seq=1 ttl=64 time=2.05 ms 64 bytes from 192.168.10.1: icmp_seq=2 ttl=64 time=0.928 ms Reviewed-by: Lad Prabhakar Reviewed-by: Russell King (Oracle) Signed-off-by: Biju Das Link: https://patch.msgid.link/20250717071109.8213-1-biju.das.jz@bp.renesas.com Signed-off-by: Jakub Kicinski commit 323ab10ad35c3ccbcc1ae546e264c241e33fc534 Merge: ff3fbcdd472453 fbd47be098b542 Author: Jakub Kicinski Date: Mon Jul 21 16:40:23 2025 -0700 Merge branch 'amd-xgbe-add-hardware-ptp-timestamping' Raju Rangoju says: ==================== amd-xgbe: add hardware PTP timestamping Remove the hwptp abstraction and associated callbacks from the struct xgbe_hw_if {} and move them to separate file after cleanup. Adds complete support for hardware-based PTP (IEEE 1588) timestamping to the AMD XGBE driver. ==================== Link: https://patch.msgid.link/20250718185628.4038779-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit fbd47be098b542dd8ad7beb42c88e7726d14cfb6 Author: Raju Rangoju Date: Sat Jul 19 00:26:28 2025 +0530 amd-xgbe: add hardware PTP timestamping support Adds complete support for hardware-based PTP (IEEE 1588) timestamping to the AMD XGBE driver. - Initialize and configure the MAC PTP registers based on link speed and reference clock. - Support both 50MHz and 125MHz PTP reference clocks. - Update the driver interface and version data to support PTP clock frequency selection. Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20250718185628.4038779-3-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 7564d3247aec784941da8cd89fbd1334069430c1 Author: Raju Rangoju Date: Sat Jul 19 00:26:27 2025 +0530 and-xgbe: remove the abstraction for hwptp Remove the hwptp abstraction and associated callbacks from the struct xgbe_hw_if {}. The callback structure was only ever assigned a single function, without null checks. This cleanup inlines the logic and moves all the hwtstamp realted code a separate file, improving readability and maintainance. Signed-off-by: Raju Rangoju Link: https://patch.msgid.link/20250718185628.4038779-2-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 005b0a0c24e1628313e951516b675109a92cacfe Author: Filipe Manana Date: Fri Jul 18 13:07:29 2025 +0100 btrfs: send: use fallocate for hole punching with send stream v2 Currently holes are sent as writes full of zeroes, which results in unnecessarily using disk space at the receiving end and increasing the stream size. In some cases we avoid sending writes of zeroes, like during a full send operation where we just skip writes for holes. But for some cases we fill previous holes with writes of zeroes too, like in this scenario: 1) We have a file with a hole in the range [2M, 3M), we snapshot the subvolume and do a full send. The range [2M, 3M) stays as a hole at the receiver since we skip sending write commands full of zeroes; 2) We punch a hole for the range [3M, 4M) in our file, so that now it has a 2M hole in the range [2M, 4M), and snapshot the subvolume. Now if we do an incremental send, we will send write commands full of zeroes for the range [2M, 4M), removing the hole for [2M, 3M) at the receiver. We could improve cases such as this last one by doing additional comparisons of file extent items (or their absence) between the parent and send snapshots, but that's a lot of code to add plus additional CPU and IO costs. Since the send stream v2 already has a fallocate command and btrfs-progs implements a callback to execute fallocate since the send stream v2 support was added to it, update the kernel to use fallocate for punching holes for V2+ streams. Test coverage is provided by btrfs/284 which is a version of btrfs/007 that exercises send stream v2 instead of v1, using fsstress with random operations and fssum to verify file contents. Link: https://github.com/kdave/btrfs-progs/issues/1001 CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 55fae08a0638ac2cb362d5739f5b5eb34c758da8 Author: Filipe Manana Date: Fri Jul 18 18:14:40 2025 +0100 btrfs: unfold transaction aborts when writing dirty block groups We have a single transaction abort call that can be due to an error from one of two calls to update_block_group_item(). Unfold the transaction abort calls so that if they happen we know which update_block_group_item() call failed. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3a074cc659ef857d727d879d86cd96e934a6f6df Author: Filipe Manana Date: Fri Jul 11 20:59:36 2025 +0100 btrfs: use saner variable type and name to indicate extrefs at add_inode_ref() We are using a variable named 'log_ref_ver' of type int to indicate if we are processing an extref item or not, using a value of 1 if so, otherwise 0. This is an odd name and type, so rename it to 'is_extref_item' and change its type to bool. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 24e066ded45b8147b79c7455ac43a5bff7b5f378 Author: Filipe Manana Date: Fri Jul 11 20:48:23 2025 +0100 btrfs: don't skip remaining extrefs if dir not found during log replay During log replay, at add_inode_ref(), if we have an extref item that contains multiple extrefs and one of them points to a directory that does not exist in the subvolume tree, we are supposed to ignore it and process the remaining extrefs encoded in the extref item, since each extref can point to a different parent inode. However when that happens we just return from the function and ignore the remaining extrefs. The problem has been around since extrefs were introduced, in commit f186373fef00 ("btrfs: extended inode refs"), but it's hard to hit in practice because getting extref items encoding multiple extref requires getting a hash collision when computing the offset of the extref's key. The offset if computed like this: key.offset = btrfs_extref_hash(dir_ino, name->name, name->len); and btrfs_extref_hash() is just a wrapper around crc32c(). Fix this by moving to next iteration of the loop when we don't find the parent directory that an extref points to. Fixes: f186373fef00 ("btrfs: extended inode refs") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 7ebf381a69421a88265d3c49cd0f007ba7336c9d Author: Filipe Manana Date: Fri Jul 11 20:21:28 2025 +0100 btrfs: don't ignore inode missing when replaying log tree During log replay, at add_inode_ref(), we return -ENOENT if our current inode isn't found on the subvolume tree or if a parent directory isn't found. The error comes from btrfs_iget_logging() <- btrfs_iget() <- btrfs_read_locked_inode(). The single caller of add_inode_ref(), replay_one_buffer(), ignores an -ENOENT error because it expects that error to mean only that a parent directory wasn't found and that is ok. Before commit 5f61b961599a ("btrfs: fix inode lookup error handling during log replay") we were converting any error when getting a parent directory to -ENOENT and any error when getting the current inode to -EIO, so our caller would fail log replay in case we can't find the current inode. After that commit however in case the current inode is not found we return -ENOENT to the caller and therefore it ignores the critical fact that the current inode was not found in the subvolume tree. Fix this by converting -ENOENT to 0 when we don't find a parent directory, returning -ENOENT when we don't find the current inode and making the caller, replay_one_buffer(), not ignore -ENOENT anymore. Fixes: 5f61b961599a ("btrfs: fix inode lookup error handling during log replay") CC: stable@vger.kernel.org # 6.16 Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 041c39da53c25f94a4705466b7f980c979215767 Author: Qu Wenruo Date: Wed Jul 16 16:55:39 2025 +0930 btrfs: enable large data folios for data reloc inode For data reloc inodes, they are a special type of inodes that are not exposed to user space, and are only utilized during data block groups relocation. They do not go under regular read-write operations, but have their file extents manually created to have the same layout of a block group, then its content is read from the original block group, and written back to the new location which is in a new block group. Previously all the handling was done in page units, and commit c2832898126f ("btrfs: make relocate_one_page() handle subpage case") changed the handling to subpage blocks. On the other hand, data reloc inodes are a perfect match for large data folios, as each relocation cluster represents one or more data extents that are contiguous in their logical addresses. This patch enables large folios for data reloc inodes by: - Remove the special handling of data reloc inodes when setting folio order - Change relocate_one_folio() to return the file offset of the next folio Originally it's designed to handle fixed page sized blocks, but with large folios, we can handle a large folio, thus we have to return the end of the current folio. - Remove the warning on folio_order() - Use folio_size() to replace fixed PAGE_SIZE usage - Use file_offset as iterator inside relocate_file_extent_cluster Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit cec780a139f3d361973d798e918576b707fd5a3c Author: Qu Wenruo Date: Wed Jul 16 17:43:06 2025 +0930 btrfs: output more info when btrfs_subpage_assert() failed The function btrfs_subpage_assert() is a very commonly utilized assert to make sure the range passed in is correct inside the folio. And when some code is not properly subpage/large folio compatible btrfs_subpage_assert() will be the first to be triggered. E.g. when I incorrectly enabled large folios for data reloc inodes, it immediately triggered btrfs_subpage_assert(). In that case, outputting all the involved members will be very helpful, this includes: - start - len - folio position inside the mapping - folio size Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4e346baee95f4688b36c9bd95664774c3d105c3d Author: Qu Wenruo Date: Tue Jul 15 13:18:39 2025 +0930 btrfs: reloc: unconditionally invalidate the page cache for each cluster Commit 9d9ea1e68a05 ("btrfs: subpage: fix relocation potentially overwriting last page data") fixed a bug when relocating data block groups for subpage cases. However for the incoming large folios for data reloc inode, we can hit the same situation where block size is the same as page size, but the folio we got is still larger than a block. In that case, the old subpage specific check is no longer reliable. Here we have to enhance the handling by: - Unconditionally invalidate the page cache for the current cluster We set the @flush to true so that any dirty folios are properly written back first. And this time instead of dropping the whole page cache, just drop the range covered by the current cluster. This will bring some minor performance drop, as for a large folio, the heading half will be read twice (read by previous cluster, then invalidated, then read again by the current cluster). However that is required to support large folios, and this gets rid of the kinda tricky manual uptodate flag clearing for each block. - Remove the special handling of writing back the whole page cache filemap_invalidate_inode() handles the write back already, and since we're invalidating all pages in the range, we no longer need to manually clear the uptodate flags for involved blocks. Thus there is no need to manually write back the whole page cache. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 009b2056cb259c90426b3c57e5b145d1cd9fa9e2 Author: David Sterba Date: Wed Jul 9 16:29:17 2025 +0200 btrfs: defrag: add flag to force no-compression Currently the defrag ioctl cannot rewrite the extents without compression. Add a new flag for that, as setting compression to 0 (or "no compression") means to do no changes to compression so take what is the current default, like mount options or properties. The defrag setting overrides mount or properties. The compression BTRFS_DEFRAG_DONT_COMPRESS is only used for in-memory operations and does not need to have a fixed value. Mount with zstd:9, copy test file from /usr/bin/ (about 260KB): $ mount -o compress=zstd:9 /dev/vda /mnt $ filefrag -vsb testfile filefrag: -b needs a blocksize option, assuming 1024-byte blocks. Filesystem type is: 9123683e File size of testfile is 297704 (292 blocks of 1024 bytes) ext: logical_offset: physical_offset: length: expected: flags: 0: 0.. 127: 13312.. 13439: 128: encoded 1: 128.. 255: 13364.. 13491: 128: 13440: encoded 2: 256.. 291: 13424.. 13459: 36: 13492: last,encoded,eof testfile: 3 extents found $ compsize testfile Processed 1 file, 3 regular extents (3 refs), 0 inline, 1 fragments. Type Perc Disk Usage Uncompressed Referenced TOTAL 42% 124K 292K 292K zstd 42% 124K 292K 292K Defrag to uncompressed: $ btrfs fi defrag --nocomp testfile $ filefrag -vsb testfile filefrag: -b needs a blocksize option, assuming 1024-byte blocks. Filesystem type is: 9123683e File size of testfile is 297704 (292 blocks of 1024 bytes) ext: logical_offset: physical_offset: length: expected: flags: 0: 0.. 291: 291840.. 292131: 292: last,eof testfile: 1 extent found $ compsize testfile Processed 1 file, 1 regular extents (1 refs), 0 inline, 1 fragments. Type Perc Disk Usage Uncompressed Referenced TOTAL 100% 292K 292K 292K none 100% 292K 292K 292K Compress again with LZO: $ btrfs fi defrag -clzo testfile $ filefrag -vsb testfile filefrag: -b needs a blocksize option, assuming 1024-byte blocks. Filesystem type is: 9123683e File size of testfile is 297704 (292 blocks of 1024 bytes) ext: logical_offset: physical_offset: length: expected: flags: 0: 0.. 127: 13312.. 13439: 128: encoded 1: 128.. 255: 13392.. 13519: 128: 13440: encoded 2: 256.. 291: 13480.. 13515: 36: 13520: last,encoded,eof testfile: 3 extents found $ compsize testfile Processed 1 file, 3 regular extents (3 refs), 0 inline, 1 fragments. Type Perc Disk Usage Uncompressed Referenced TOTAL 64% 188K 292K 292K lzo 64% 188K 292K 292K Signed-off-by: David Sterba commit 807d9023e75fc20bfd6dd2ac0408ce4af53f1648 Author: Boris Burkov Date: Mon Jul 14 16:44:28 2025 -0700 btrfs: fix ssd_spread overallocation If the ssd_spread mount option is enabled, then we run the so called clustered allocator for data block groups. In practice, this results in creating a btrfs_free_cluster which caches a block_group and borrows its free extents for allocation. Since the introduction of allocation size classes in 6.1, there has been a bug in the interaction between that feature and ssd_spread. find_free_extent() has a number of nested loops. The loop going over the allocation stages, stored in ffe_ctl->loop and managed by find_free_extent_update_loop(), the loop over the raid levels, and the loop over all the block_groups in a space_info. The size class feature relies on the block_group loop to ensure it gets a chance to see a block_group of a given size class. However, the clustered allocator uses the cached cluster block_group and breaks that loop. Each call to do_allocation() will really just go back to the same cached block_group. Normally, this is OK, as the allocation either succeeds and we don't want to loop any more or it fails, and we clear the cluster and return its space to the block_group. But with size classes, the allocation can succeed, then later fail, outside of do_allocation() due to size class mismatch. That latter failure is not properly handled due to the highly complex multi loop logic. The result is a painful loop where we continue to allocate the same num_bytes from the cluster in a tight loop until it fails and releases the cluster and lets us try a new block_group. But by then, we have skipped great swaths of the available block_groups and are likely to fail to allocate, looping the outer loop. In pathological cases like the reproducer below, the cached block_group is often the very last one, in which case we don't perform this tight bg loop but instead rip through the ffe stages to LOOP_CHUNK_ALLOC and allocate a chunk, which is now the last one, and we enter the tight inner loop until an allocation failure. Then allocation succeeds on the final block_group and if the next allocation is a size mismatch, the exact same thing happens again. Triggering this is as easy as mounting with -o ssd_spread and then running: mount -o ssd_spread $dev $mnt dd if=/dev/zero of=$mnt/big bs=16M count=1 &>/dev/null dd if=/dev/zero of=$mnt/med bs=4M count=1 &>/dev/null sync if you do the two writes + sync in a loop, you can force btrfs to spin an excessive amount on semi-successful clustered allocations, before ultimately failing and advancing to the stage where we force a chunk allocation. This results in 2G of data allocated per iteration, despite only using ~20M of data. By using a small size classed extent, the inner loop takes longer and we can spin for longer. The simplest, shortest term fix to unbreak this is to make the clustered allocator size_class aware in the dumbest way, where it fails on size class mismatch. This may hinder the operation of the clustered allocator, but better hindered than completely broken and terribly overallocating. Further re-design improvements are also in the works. Fixes: 52bb7a2166af ("btrfs: introduce size class to block group allocator") CC: stable@vger.kernel.org # 6.1+ Reported-by: David Sterba Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit ff3fbcdd472453190d4f37fe1d1e69e50cce7612 Author: Li Shuang Date: Fri Jul 18 22:16:12 2025 +0800 selftests: tc: Add generic erspan_opts matching support for tc-flower Add test cases to tc_flower.sh to validate generic matching on ERSPAN options. Both ERSPAN Type II and Type III are covered. Also add check_tc_erspan_support() to verify whether tc supports erspan_opts. Signed-off-by: Li Shuang Reviewed-by: Xin Long Link: https://patch.msgid.link/1f354a1afd60f29bbbf02bd60cb52ecfc0b6bd17.1752848172.git.shuali@redhat.com Signed-off-by: Jakub Kicinski commit 62be7afcc13b2727bdc6a4c91aefed6b452e6ecc Author: Naohiro Aota Date: Sun Jun 29 23:18:29 2025 +0900 btrfs: zoned: requeue to unused block group list if zone finish failed btrfs_zone_finish() can fail for several reason. If it is -EAGAIN, we need to try it again later. So, put the block group to the retry list properly. Failing to do so will keep the removable block group intact until remount and can causes unnecessary ENOSPC. Fixes: 74e91b12b115 ("btrfs: zoned: zone finish unused block group") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit 3061801420469610c8fa6080a950e56770773ef1 Author: Naohiro Aota Date: Sun Jun 29 23:07:42 2025 +0900 btrfs: zoned: do not remove unwritten non-data block group There are some reports of "unable to find chunk map for logical 2147483648 length 16384" error message appears in dmesg. This means some IOs are occurring after a block group is removed. When a metadata tree node is cleaned on a zoned setup, we keep that node still dirty and write it out not to create a write hole. However, this can make a block group's used bytes == 0 while there is a dirty region left. Such an unused block group is moved into the unused_bg list and processed for removal. When the removal succeeds, the block group is removed from the transaction->dirty_bgs list, so the unused dirty nodes in the block group are not sent at the transaction commit time. It will be written at some later time e.g, sync or umount, and causes "unable to find chunk map" errors. This can happen relatively easy on SMR whose zone size is 256MB. However, calling do_zone_finish() on such block group returns -EAGAIN and keep that block group intact, which is why the issue is hidden until now. Fixes: afba2bc036b0 ("btrfs: zoned: implement active zone tracking") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Johannes Thumshirn Signed-off-by: Naohiro Aota Signed-off-by: David Sterba commit d6be378de06c8ae72c46d528f69cc53fa382b01c Author: Filipe Manana Date: Fri Jul 11 09:46:16 2025 +0100 btrfs: remove btrfs_clear_extent_bits() It's just a simple wrapper around btrfs_clear_extent_bit() that passes a NULL for its last argument (a cached extent state record), plus there is not counter part - we have a btrfs_set_extent_bit() but we do not have a btrfs_set_extent_bits() (plural version). So just remove it and make all callers use btrfs_clear_extent_bit() directly. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 279b4db10e46a31c7cd8161c1a5d7dc4c423b028 Author: Filipe Manana Date: Fri Jul 11 09:23:09 2025 +0100 btrfs: use cached state when falling back from NOCoW write to CoW write We have a cached extent state record from the previous extent locking so we can use when setting the EXTENT_NORESERVE in the range, allowing the operation to be faster if the extent io tree is relatively large. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit bfc9d71aa41d6cfc32b60318222b3e65352b0776 Author: Filipe Manana Date: Tue Jul 8 16:32:33 2025 +0100 btrfs: set EXTENT_NORESERVE before range unlock in btrfs_truncate_block() Set the EXTENT_NORESERVE bit in the io tree before unlocking the range so that we can use the cached state and speedup the operation, since the unlock operation releases the cached state. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 5ae011bcbb5ac088e5fa41fcaf3896fc866c0b9a Author: Johannes Thumshirn Date: Tue Jul 8 08:55:03 2025 +0200 btrfs: don't print relocation messages from auto reclaim When BTRFS is doing automatic block-group reclaim, it is spamming the kernel log messages a lot. Add a 'verbose' parameter to btrfs_relocate_chunk() and btrfs_relocate_block_group() to control the verbosity of these log message. This way the old behaviour of printing log messages on a user-space initiated balance operation can be kept while excessive log spamming due to auto reclaim is mitigated. Reviewed-by: Boris Burkov Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit a507904090d05904dda4fbcd3413e63c29d24057 Author: Johannes Thumshirn Date: Tue Jul 8 08:55:02 2025 +0200 btrfs: remove redundant auto reclaim log message Remove the log message before reclaiming a chunk in btrfs_reclaim_bgs_work(). Especially with automatic block-group reclaiming these messages spam the kernel log. Note there is also a tracepoint for the same condition to ease debugging. Reviewed-by: Boris Burkov Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 240fafaa4400f7c577a5e8e40c496663da0e0798 Author: Filipe Manana Date: Wed Jul 9 16:34:20 2025 +0100 btrfs: make btrfs_check_nocow_lock() check more than one extent Currently btrfs_check_nocow_lock() stops at the first extent it finds and that extent may be smaller than the target range we want to NOCOW into. But we can have multiple consecutive extents which we can NOCOW into, so by stopping at the first one we find we just make the caller do more work by splitting the write into multiple ones, or in the case of mmap writes with large folios we fail with -ENOSPC in case the folio's range is covered by more than one extent (the fallback to NOCOW for mmap writes in case there's no available data space to reserve/allocate was recently added by the patch "btrfs: fix -ENOSPC mmap write failure on NOCOW files/extents"). Improve on this by checking for multiple consecutive extents. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 68e0fcc3617b7a61ab93eeb6d8b935046d152685 Author: Filipe Manana Date: Wed Jul 9 16:26:13 2025 +0100 btrfs: assert we can NOCOW the range in btrfs_truncate_block() We call btrfs_check_nocow_lock() to see if we can NOCOW a block sized range but we don't check later if we can NOCOW the whole range. It's unexpected to be able to NOCOW a range smaller than blocksize, so add an assertion to check the NOCOW range matches the blocksize. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit c6482cff95c77a3c1fc0120c6e8ef7b15f85439b Author: Filipe Manana Date: Wed Jul 9 15:03:54 2025 +0100 btrfs: update function comment for btrfs_check_nocow_lock() The documentation for the @nowait parameter is missing, so add it. The @nowait parameter was added in commit 80f9d24130e4 ("btrfs: make btrfs_check_nocow_lock nowait compatible"), which forgot to update the function comment. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 601ea9c42a58a46e1ec5d8ef1ab9fee5aef34b6d Author: Filipe Manana Date: Tue Jul 8 16:28:44 2025 +0100 btrfs: use btrfs_inode local variable at btrfs_page_mkwrite() Most of the time we want to use the btrfs_inode, so change the local inode variable to be a btrfs_inode instead of a VFS inode, reducing verbosity by eliminating a lot of BTRFS_I() calls. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 11ad7983c2eeb71a0b25b5f7aca9831fbed9ea57 Author: Filipe Manana Date: Tue Jul 8 16:23:02 2025 +0100 btrfs: use variable for io_tree when clearing range in btrfs_page_mkwrite() We have the inode's io_tree already stored in a local variable, so use it instead of grabbing it again in the call to btrfs_clear_extent_bit(). Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6599716de2d68ab7b3c0429221deca306dbda878 Author: Filipe Manana Date: Tue Jul 8 16:01:19 2025 +0100 btrfs: fix -ENOSPC mmap write failure on NOCOW files/extents If we attempt a mmap write into a NOCOW file or a prealloc extent when there is no more available data space (or unallocated space to allocate a new data block group) and we can do a NOCOW write (there are no reflinks for the target extent or snapshots), we always fail due to -ENOSPC, unlike for the regular buffered write and direct IO paths where we check that we can do a NOCOW write in case we can't reserve data space. Simple reproducer: $ cat test.sh #!/bin/bash DEV=/dev/sdi MNT=/mnt/sdi umount $DEV &> /dev/null mkfs.btrfs -f -b $((512 * 1024 * 1024)) $DEV mount $DEV $MNT touch $MNT/foobar # Make it a NOCOW file. chattr +C $MNT/foobar # Add initial data to file. xfs_io -c "pwrite -S 0xab 0 1M" $MNT/foobar # Fill all the remaining data space and unallocated space with data. dd if=/dev/zero of=$MNT/filler bs=4K &> /dev/null # Overwrite the file with a mmap write. Should succeed. xfs_io -c "mmap -w 0 1M" \ -c "mwrite -S 0xcd 0 1M" \ -c "munmap" \ $MNT/foobar # Unmount, mount again and verify the new data was persisted. umount $MNT mount $DEV $MNT od -A d -t x1 $MNT/foobar umount $MNT Running this: $ ./test.sh (...) wrote 1048576/1048576 bytes at offset 0 1 MiB, 256 ops; 0.0008 sec (1.188 GiB/sec and 311435.5231 ops/sec) ./test.sh: line 24: 234865 Bus error xfs_io -c "mmap -w 0 1M" -c "mwrite -S 0xcd 0 1M" -c "munmap" $MNT/foobar 0000000 ab ab ab ab ab ab ab ab ab ab ab ab ab ab ab ab * 1048576 Fix this by not failing in case we can't allocate data space and we can NOCOW into the target extent - reserving only metadata space in this case. After this change the test passes: $ ./test.sh (...) wrote 1048576/1048576 bytes at offset 0 1 MiB, 256 ops; 0.0007 sec (1.262 GiB/sec and 330749.3540 ops/sec) 0000000 cd cd cd cd cd cd cd cd cd cd cd cd cd cd cd cd * 1048576 A test case for fstests will be added soon. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit e8d2e254dc073f9a1ea2c00b53ba44f329828701 Author: David Sterba Date: Tue Jul 8 16:49:52 2025 +0200 btrfs: use clear_and_wake_up_bit() where open coded There are two cases open coding the clear and wake up pattern, we can use the helper. Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit 72b2b199d5ee659ceb439192db4618f47c61eeef Author: David Sterba Date: Sun Jul 6 20:23:58 2025 +0200 btrfs: accessors: rename variable for folio offset There used to be 'oip' short for offset in page, which got changed during conversion to folios, the name is a bit confusing so rename it. Signed-off-by: David Sterba commit ae807482255bdc84a591b566b7a84fc9f2c1d572 Author: David Sterba Date: Tue Jul 1 19:23:54 2025 +0200 btrfs: accessors: factor out split memcpy with two sources The case of a reading the bytes from 2 folios needs two memcpy()s, the compiler does not emit calls but two inline loops. Factoring out the code makes some improvement (stack, code) and in the future will provide an optimized implementation as well. (The analogical version with two destinations is not done as it increases stack usage but can be done if needed.) The address of the second folio is reordered before the first memcpy, which leads to an optimization reusing the vmemmap_base and page_offset_base (implementing folio_address()). Stack usage reduction: btrfs_get_32 -8 (32 -> 24) btrfs_get_64 -8 (32 -> 24) Code size reduction: text data bss dec hex filename 1454279 115665 16088 1586032 183370 pre/btrfs.ko 1454229 115665 16088 1585982 18333e post/btrfs.ko DELTA: -50 As this is the last patch in this series, here's the overall diff starting and including commit "btrfs: accessors: simplify folio bounds checks": Stack: btrfs_set_16 -72 (88 -> 16) btrfs_get_32 -56 (80 -> 24) btrfs_set_8 -72 (88 -> 16) btrfs_set_64 -64 (88 -> 24) btrfs_get_8 -72 (80 -> 8) btrfs_get_16 -64 (80 -> 16) btrfs_set_32 -64 (88 -> 24) btrfs_get_64 -56 (80 -> 24) NEW (48): report_setget_bounds 48 LOST/NEW DELTA: +48 PRE/POST DELTA: -472 Code: text data bss dec hex filename 1456601 115665 16088 1588354 183c82 pre/btrfs.ko 1454229 115665 16088 1585982 18333e post/btrfs.ko DELTA: -2372 Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit c8b33a57fba29733518d469be062ca6fea03203d Author: David Sterba Date: Tue Jul 1 19:23:53 2025 +0200 btrfs: accessors: set target address at initialization The target address for the read/write can be simplified as it's the same expression for the first folio. This improves the generated code as the folio address does not have to be cached on stack. Stack usage reduction: btrfs_set_32 -8 (32 -> 24) btrfs_set_64 -8 (32 -> 24) btrfs_get_16 -8 (24 -> 16) Code size reduction: text data bss dec hex filename 1454459 115665 16088 1586212 183424 pre/btrfs.ko 1454279 115665 16088 1586032 183370 post/btrfs.ko DELTA: -180 Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit 1ed0f75d57aef3c447fbc78885c90421e40c1755 Author: David Sterba Date: Tue Jul 1 19:23:52 2025 +0200 btrfs: accessors: compile-time fast path for u16 Reading/writing 2 bytes (u16) may need 2 folios to be written to, each time it's just one byte so using memcpy for that is an overkill. Add a branch for the split case so that memcpy is now used for u32 and u64. Another side effect is that the u16 types now don't need additional stack space, everything fits to registers. Stack usage is reduced: btrfs_get_16 -8 (32 -> 24) btrfs_set_16 -16 (32 -> 16) Code size reduction: text data bss dec hex filename 1454691 115665 16088 1586444 18350c pre/btrfs.ko 1454459 115665 16088 1586212 183424 post/btrfs.ko DELTA: -232 Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit 58383c6866a76acb719b1f22caaba64fa4dd3f6e Author: David Sterba Date: Tue Jul 1 19:23:51 2025 +0200 btrfs: accessors: compile-time fast path for u8 Reading/writing 1 byte (u8) is a special case compared to the others as it's always contained in the folio we find, so the split memcpy will never be needed. Turn it to a compile-time check that the memcpy part can be optimized out. The stack usage is reduced: btrfs_set_8 -16 (32 -> 16) btrfs_get_8 -16 (24 -> 8) Code size reduction: text data bss dec hex filename 1454951 115665 16088 1586704 183610 pre/btrfs.ko 1454691 115665 16088 1586444 18350c post/btrfs.ko DELTA: -260 Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit d5a87dbd958398c1926dd35a328ccf89a410cbd2 Author: David Sterba Date: Tue Jul 1 19:23:50 2025 +0200 btrfs: accessors: inline eb bounds check and factor out the error report There's a check in each set/get helper if the requested range is within extent buffer bounds, and if it's not then report it. This was in an ASSERT statement so with CONFIG_BTRFS_ASSERT this crashes right away, on other configs this is only reported but reading out of the bounds is done anyway. There are currently no known reports of this particular condition failing. There are some drawbacks though. The behaviour dependence on the assertions being compiled in or not and a less visible effect of inlining report_setget_bounds() into each helper. As the bounds check is expected to succeed almost always it's ok to inline it but make the report a function and move it out of the helper completely (__cold puts it to a different section). This also skips reading/writing the requested range in case it fails. This improves stack usage significantly: btrfs_get_16 -48 (80 -> 32) btrfs_get_32 -48 (80 -> 32) btrfs_get_64 -48 (80 -> 32) btrfs_get_8 -48 (72 -> 24) btrfs_set_16 -56 (88 -> 32) btrfs_set_32 -56 (88 -> 32) btrfs_set_64 -56 (88 -> 32) btrfs_set_8 -48 (80 -> 32) NEW (48): report_setget_bounds 48 LOST/NEW DELTA: +48 PRE/POST DELTA: -360 Same as .ko size: text data bss dec hex filename 1456079 115665 16088 1587832 183a78 pre/btrfs.ko 1454951 115665 16088 1586704 183610 post/btrfs.ko DELTA: -1128 Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit 378c95c477b4bdc3a8283ebdf3754e308bf65891 Author: David Sterba Date: Tue Jul 1 19:23:49 2025 +0200 btrfs: accessors: use type sizeof constants directly Now unit_size is used only once, so use it directly in 'part' calculation. Don't cache sizeof(type) in a variable. While this is a compile-time constant, forcing the type 'int' generates worse code as it leads to additional conversion from 32 to 64 bit type on x86_64. The sizeof() is used only a few times and it does not make the code that harder to read, so use it directly and let the compiler utilize the immediate constants in the context it needs. The .ko code size slightly increases (+50) but further patches will reduce that again. Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit 00c0cf844465139ee6d9b271549295da3c7822ca Author: David Sterba Date: Tue Jul 1 19:23:48 2025 +0200 btrfs: accessors: simplify folio bounds checks As we can a have non-contiguous range in the eb->folios, any item can be straddling two folios and we need to check if it can be read in one go or in two parts. For that there's a check which is not implemented in the simplest way: offset in folio + size <= folio size With a simple expression transformation: oil + size <= unit_size size <= unit_size - oil sizeof() <= part this can be simplified and reusing existing run-time or compile-time constants. Add likely() annotation for this expression as this is the fast path and compiler sometimes reorders that after the followup block with the memcpy (observed in practice with other simplifications). Overall effect on stack consumption: btrfs_get_8 -8 (80 -> 72) btrfs_set_8 -8 (88 -> 80) And .ko size (due to optimizations making use of the direct constants): text data bss dec hex filename 1456601 115665 16088 1588354 183c82 pre/btrfs.ko 1456093 115665 16088 1587846 183a86 post/btrfs.ko DELTA: -508 Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit c76841362f66915a878c3a13ed74675e0e4af43e Author: David Sterba Date: Wed Jun 25 15:37:26 2025 +0200 btrfs: remove struct rcu_string The only use for device name has been removed so we can kill the RCU string API. Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit e8d58aef119aeb8f45898adbf6ce0385b8a056c2 Author: David Sterba Date: Wed Jun 25 15:37:19 2025 +0200 btrfs: open code RCU for device name The RCU protected string is only used for a device name, and RCU is used so we can print the name and eventually synchronize against the rare device rename in device_list_add(). We don't need the whole API just for that. Open code all the helpers and access to the string itself. Notable change is in device_list_add() when the device name is changed, which is the only place that can actually happen at the same time as message prints using the device name under RCU read lock. Previously there was kfree_rcu() which used the embedded rcu_head to delay freeing the object depending on the RCU mechanism. Now there's kfree_rcu_mightsleep() which does not need the rcu_head and waits for the grace period. Sleeping is safe in this context and as this is a rare event it won't interfere with the rest as it's holding the device_list_mutex. Straightforward changes: - rcu_string_strdup -> kstrdup - rcu_str_deref -> rcu_dereference - drop ->str from safe contexts and use rcu_dereference_raw() so it does not trigger RCU validators Historical notes: Introduced in 606686eeac45 ("Btrfs: use rcu to protect device->name") with a vague reference of the potential problem described in https://lore.kernel.org/all/20120531155304.GF11775@ZenIV.linux.org.uk/ . The RCU protection looks like the easiest and most lightweight way of protecting the rare event of device rename racing device_list_add() with a random printk() that uses the device name. Alternatives: a spin lock would require to protect the printk anyway, a fixed buffer for the name would be eventually wrong in case the new name is overwritten when being printed, an array switching pointers and cleaning them up eventually resembles RCU too much. The cleanups up to this patch should hide special case of RCU to the minimum that only the name needs rcu_dereference(), which can be further cleaned up to use btrfs_dev_name(). Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit f2cb97ee964a0af0e4644b1dd7556ed4b14bee06 Author: Daniel Vacek Date: Fri Jul 4 18:07:02 2025 +0200 btrfs: index buffer_tree using node size So far we've been deriving the buffer tree index using the sector size. But each extent buffer covers multiple sectors. This makes the buffer tree rather sparse. For example the typical and quite common configuration uses sector size of 4KiB and node size of 16KiB. In this case it means the buffer tree is using up to the maximum of 25% of it's slots. Or in other words at least 75% of the tree slots are wasted as never used. We can score significant memory savings on the required tree nodes by indexing the tree using the node size instead. As a result far less slots are wasted and the tree can now use up to all 100% of it's slots this way. Note: This works even with unaligned tree blocks as we can still get unique index by doing eb->start >> nodesize_shift. Getting some stats from running fio write test, there is a bit of variance. The values presented in the table below are medians from 5 test runs. The numbers are: - # of allocated ebs in the tree - # of leaf tree nodes - highest index in the tree (radix tree width)): ebs / leaves / Index | bare for-next | with fix ---------------------+--------------------+------------------- post mount | 16 / 11 / 10e5c | 16 / 10 / 4240 post test | 5810 / 891 / 11cfc | 4420 / 252 / 473a post rm | 574 / 300 / 10ef0 | 540 / 163 / 46e9 In this case (10GiB filesystem) the height of the tree is still 3 levels but the 4x width reduction is clearly visible as expected. But since the tree is more dense we can see the 54-72% reduction of leaf nodes. That's very close to ideal with this test. It means the tree is getting really dense with this kind of workload. Also, the fio results show no performance change. Reviewed-by: Qu Wenruo Signed-off-by: Daniel Vacek Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2b759eea989f24c2b2601b16c4a238fc5cd9b806 Author: Filipe Manana Date: Wed Feb 26 16:18:25 2025 +0000 btrfs: send: directly return strcmp() result when comparing recorded refs There's no point in converting the return values from strcmp() as all we need is that it returns a negative value if the first argument is less than the second, a positive value if it's greater and 0 if equal. We do not have a need for -1 instead of any other negative value and no need for 1 instead of any other positive value - that's all that rb_find() needs and no where else we need specific negative and positive values. So remove the intermediate local variable and checks and return directly the result from strcmp(). This also reduces the module's text size. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1888116 161347 16136 2065599 1f84bf fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1888052 161347 16136 2065535 1f847f fs/btrfs/btrfs.ko Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e560afc1a83ddcbb8b49cce544c10572458bf2e4 Author: Filipe Manana Date: Tue Jul 1 22:45:47 2025 +0100 btrfs: set search_commit_root to false in iterate_inodes_from_logical() There's no point in checking at iterate_inodes_from_logical() if the path has search_commit_root set, the only caller never sets search_commit_root to true and it doesn't make sense for it ever to be true for the current use case (logical_to_ino ioctl). So stop checking for that and since the only caller allocates the path just for it to be used by iterate_inodes_from_logical(), move the path allocation into that function. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit aee10fe4e4f6d9e3444b4309ae2187ce4e9fb00f Author: Filipe Manana Date: Tue Jul 1 23:01:56 2025 +0100 btrfs: reduce size of struct tree_mod_elem Several members are used for specific types of tree mod log operations so they can be placed in a union in order to reduce the structure's size. This reduces the structure size from 112 bytes to 88 bytes on x86_64, so we can now use the kmalloc-96 slab instead of the kmalloc-128 slab. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d30b236a3e706b1225accaff686d56d3bd4e8007 Author: Filipe Manana Date: Tue Jul 1 22:20:19 2025 +0100 btrfs: avoid logging tree mod log elements for irrelevant extent buffers We are logging tree mod log operations for extent buffers from any tree but we only need to log for the extent tree and subvolume tree, since the tree mod log is used to get a consistent view, within a transaction, of extents and their backrefs. So it's pointless to log operations for trees such as the csum tree, free space tree, root tree, chunk tree, log trees, data relocation tree, etc, as these trees are not used for backref walking and all tree mod log users are about backref walking. So skip extent buffers that don't belong neither to the extent nor to subvolume trees. This avoids unnecessary memory allocations and having a larger tree mod log rbtree with nodes that are never needed. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 9e9ff875e4174be939371667d2cc81244e31232f Author: Boris Burkov Date: Wed Jun 4 17:46:58 2025 -0700 btrfs: use readahead_expand() on compressed extents We recently received a report of poor performance doing sequential buffered reads of a file with compressed extents. With bs=128k, a naive sequential dd ran as fast on a compressed file as on an uncompressed (1.2GB/s on my reproducing system) while with bs<32k, this performance tanked down to ~300MB/s. i.e., slow: dd if=some-compressed-file of=/dev/null bs=4k count=X vs fast: dd if=some-compressed-file of=/dev/null bs=128k count=Y The cause of this slowness is overhead to do with looking up extent_maps to enable readahead pre-caching on compressed extents (add_ra_bio_pages()), as well as some overhead in the generic VFS readahead code we hit more in the slow case. Notably, the main difference between the two read sizes is that in the large sized request case, we call btrfs_readahead() relatively rarely while in the smaller request we call it for every compressed extent. So the fast case stays in the btrfs readahead loop: while ((folio = readahead_folio(rac)) != NULL) btrfs_do_readpage(folio, &em_cached, &bio_ctrl, &prev_em_start); where the slower one breaks out of that loop every time. This results in calling add_ra_bio_pages a lot, doing lots of extent_map lookups, extent_map locking, etc. This happens because although add_ra_bio_pages() does add the appropriate un-compressed file pages to the cache, it does not communicate back to the ractl in any way. To solve this, we should be using readahead_expand() to signal to readahead to expand the readahead window. This change passes the readahead_control into the btrfs_bio_ctrl and in the case of compressed reads sets the expansion to the size of the extent_map we already looked up anyway. It skips the subpage case as that one already doesn't do add_ra_bio_pages(). With this change, whether we use bs=4k or bs=128k, btrfs expands the readahead window up to the largest compressed extent we have seen so far (in the trivial example: 128k) and the call stacks of the two modes look identical. Notably, we barely call add_ra_bio_pages at all. And the performance becomes identical as well. So this change certainly "fixes" this performance problem. Of course, it does seem to beg a few questions: 1. Will this waste too much page cache with a too large ra window? 2. Will this somehow cause bugs prevented by the more thoughtful checking in add_ra_bio_pages? 3. Should we delete add_ra_bio_pages? My stabs at some answers: 1. Hard to say. See attempts at generic performance testing below. Is there a "readahead_shrink" we should be using? Should we expand more slowly, by half the remaining em size each time? 2. I don't think so. Since the new behavior is indistinguishable from reading the file with a larger read size passed in, I don't see why one would be safe but not the other. 3. Probably! I tested that and it was fine in fstests, and it seems like the pages would get re-used just as well in the readahead case. However, it is possible some reads that use page cache but not btrfs_readahead() could suffer. I will investigate this further as a follow up. I tested the performance implications of this change in 3 ways (using compress-force=zstd:3 for compression): Directly test the affected workload of small sequential reads on a compressed file (improved from ~250MB/s to ~1.2GB/s) ==========for-next========== dd /mnt/lol/non-cmpr 4k 1048576+0 records in 1048576+0 records out 4294967296 bytes (4.3 GB, 4.0 GiB) copied, 6.02983 s, 712 MB/s dd /mnt/lol/non-cmpr 128k 32768+0 records in 32768+0 records out 4294967296 bytes (4.3 GB, 4.0 GiB) copied, 5.92403 s, 725 MB/s dd /mnt/lol/cmpr 4k 1048576+0 records in 1048576+0 records out 4294967296 bytes (4.3 GB, 4.0 GiB) copied, 17.8832 s, 240 MB/s dd /mnt/lol/cmpr 128k 32768+0 records in 32768+0 records out 4294967296 bytes (4.3 GB, 4.0 GiB) copied, 3.71001 s, 1.2 GB/s ==========ra-expand========== dd /mnt/lol/non-cmpr 4k 1048576+0 records in 1048576+0 records out 4294967296 bytes (4.3 GB, 4.0 GiB) copied, 6.09001 s, 705 MB/s dd /mnt/lol/non-cmpr 128k 32768+0 records in 32768+0 records out 4294967296 bytes (4.3 GB, 4.0 GiB) copied, 6.07664 s, 707 MB/s dd /mnt/lol/cmpr 4k 1048576+0 records in 1048576+0 records out 4294967296 bytes (4.3 GB, 4.0 GiB) copied, 3.79531 s, 1.1 GB/s dd /mnt/lol/cmpr 128k 32768+0 records in 32768+0 records out 4294967296 bytes (4.3 GB, 4.0 GiB) copied, 3.69533 s, 1.2 GB/s Built the linux kernel from clean (no change) Ran fsperf. Mostly neutral results with some improvements and regressions here and there. Reported-by: Dimitrios Apostolou Link: https://lore.kernel.org/linux-btrfs/34601559-6c16-6ccc-1793-20a97ca0dbba@gmx.net/ Reviewed-by: Filipe Manana Signed-off-by: Boris Burkov Signed-off-by: David Sterba commit 1ef94169db0958d6de39f9ea6e063ce887342e2d Author: Qu Wenruo Date: Wed Jul 2 15:08:13 2025 +0930 btrfs: populate otime when logging an inode item [TEST FAILURE WITH EXPERIMENTAL FEATURES] When running test case generic/508, the test case will fail with the new btrfs shutdown support: generic/508 - output mismatch (see /home/adam/xfstests/results//generic/508.out.bad) --- tests/generic/508.out 2022-05-11 11:25:30.806666664 +0930 +++ /home/adam/xfstests/results//generic/508.out.bad 2025-07-02 14:53:22.401824212 +0930 @@ -1,2 +1,6 @@ QA output created by 508 Silence is golden +Before: +After : stat.btime = Thu Jan 1 09:30:00 1970 +Before: +After : stat.btime = Wed Jul 2 14:53:22 2025 ... (Run 'diff -u /home/adam/xfstests/tests/generic/508.out /home/adam/xfstests/results//generic/508.out.bad' to see the entire diff) Ran: generic/508 Failures: generic/508 Failed 1 of 1 tests Please note that the test case requires shutdown support, thus the test case will be skipped using the current upstream kernel, as it doesn't have shutdown ioctl support. [CAUSE] The direct cause the 0 time stamp in the log tree: leaf 30507008 items 2 free space 16057 generation 9 owner TREE_LOG leaf 30507008 flags 0x1(WRITTEN) backref revision 1 checksum stored e522548d checksum calced e522548d fs uuid 57d45451-481e-43e4-aa93-289ad707a3a0 chunk uuid d52bd3fd-5163-4337-98a7-7986993ad398 item 0 key (257 INODE_ITEM 0) itemoff 16123 itemsize 160 generation 9 transid 9 size 0 nbytes 0 block group 0 mode 100644 links 1 uid 0 gid 0 rdev 0 sequence 1 flags 0x0(none) atime 1751432947.492000000 (2025-07-02 14:39:07) ctime 1751432947.492000000 (2025-07-02 14:39:07) mtime 1751432947.492000000 (2025-07-02 14:39:07) otime 0.0 (1970-01-01 09:30:00) <<< But the old fs tree has all the correct time stamp: btrfs-progs v6.12 fs tree key (FS_TREE ROOT_ITEM 0) leaf 30425088 items 2 free space 16061 generation 5 owner FS_TREE leaf 30425088 flags 0x1(WRITTEN) backref revision 1 checksum stored 48f6c57e checksum calced 48f6c57e fs uuid 57d45451-481e-43e4-aa93-289ad707a3a0 chunk uuid d52bd3fd-5163-4337-98a7-7986993ad398 item 0 key (256 INODE_ITEM 0) itemoff 16123 itemsize 160 generation 3 transid 0 size 0 nbytes 16384 block group 0 mode 40755 links 1 uid 0 gid 0 rdev 0 sequence 0 flags 0x0(none) atime 1751432947.0 (2025-07-02 14:39:07) ctime 1751432947.0 (2025-07-02 14:39:07) mtime 1751432947.0 (2025-07-02 14:39:07) otime 1751432947.0 (2025-07-02 14:39:07) <<< The root cause is that fill_inode_item() in tree-log.c is only populating a/c/m time, not the otime (or btime in statx output). Part of the reason is that, the vfs inode only has a/c/m time, no native btime support yet. [FIX] Thankfully btrfs has its otime stored in btrfs_inode::i_otime_sec and btrfs_inode::i_otime_nsec. So what we really need is just fill the otime time stamp in fill_inode_item() of tree-log.c There is another fill_inode_item() in inode.c, which is doing the proper otime population. Fixes: 94edf4ae43a5 ("Btrfs: don't bother committing delayed inode updates when fsyncing") CC: stable@vger.kernel.org Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit a943812bfffb38e6b416ee359d3db1f6974c5dfe Author: Filipe Manana Date: Tue Jul 1 15:25:14 2025 +0100 btrfs: qgroup: use btrfs_qgroup_enabled() in ioctls We have a publicly exported btrfs_qgroup_enabled() and an ioctl.c private qgroup_enabled() helper. Both of these test if qgroups are enabled, the first check if the flag BTRFS_FS_QUOTA_ENABLED is set in fs_info->flags while the second checks if fs_info->quota_root is not NULL while holding the mutex fs_info->qgroup_ioctl_lock. We can get away with the private ioctl.c:qgroup_enabled(), as all entry points into the qgroup code check if fs_info->quota_root is NULL or not while holding the mutex fs_info->qgroup_ioctl_lock, and returning the error -ENOTCONN in case it's NULL. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 08530d6e638427e7e1344bd67bacc03882ba95b9 Author: Filipe Manana Date: Tue Jul 1 15:44:16 2025 +0100 btrfs: qgroup: fix qgroup create ioctl returning success after quotas disabled When quotas are disabled qgroup ioctls are supposed to return -ENOTCONN, but the qgroup create ioctl stopped doing that when it races with a quota disable operation, returning 0 instead. This change of behaviour happened in commit 6ed05643ddb1 ("btrfs: create qgroup earlier in snapshot creation"). The issue happens as follows: 1) Task A enters btrfs_ioctl_qgroup_create(), qgroups are enabled and so qgroup_enabled() returns true since fs_info->quota_root is not NULL; 2) Task B enters btrfs_ioctl_quota_ctl() -> btrfs_quota_disable() and disables qgroups, so now fs_info->quota_root is NULL; 3) Task A enters btrfs_create_qgroup() and calls btrfs_qgroup_mode(), which returns BTRFS_QGROUP_MODE_DISABLED since quotas are disabled, and then btrfs_create_qgroup() returns 0 to the caller, which makes the ioctl return 0 instead of -ENOTCONN. The check for fs_info->quota_root and returning -ENOTCONN if it's NULL is made only after the call btrfs_qgroup_mode(). Fix this by moving the check for disabled quotas with btrfs_qgroup_mode() into transaction.c:create_pending_snapshot(), so that we don't abort the transaction if btrfs_create_qgroup() returns -ENOTCONN and quotas are disabled. Fixes: 6ed05643ddb1 ("btrfs: create qgroup earlier in snapshot creation") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e41c75ca3189341e76e6af64b857c05b68a1d7db Author: Filipe Manana Date: Tue Jul 1 11:39:44 2025 +0100 btrfs: qgroup: set quota enabled bit if quota disable fails flushing reservations Before waiting for the rescan worker to finish and flushing reservations, we clear the BTRFS_FS_QUOTA_ENABLED flag from fs_info. If we fail flushing reservations we leave with the flag not set which is not correct since quotas are still enabled - we must set back the flag on error paths, such as when we fail to start a transaction, except for error paths that abort a transaction. The reservation flushing happens very early before we do any operation that actually disables quotas and before we start a transaction, so set back BTRFS_FS_QUOTA_ENABLED if it fails. Fixes: af0e2aab3b70 ("btrfs: qgroup: flush reservations during quota disable") CC: stable@vger.kernel.org # 6.12+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 736bd9d2e35866a07f32d9884019e0431b0b50d8 Author: Qu Wenruo Date: Fri Jul 4 19:08:03 2025 +0930 btrfs: restrict writes to opened btrfs devices [FLAG EXCLUSION] Commit ead622674df5 ("btrfs: Do not restrict writes to btrfs devices") removes the BLK_OPEN_RESTRICT_WRITES flag when opening the devices during mount. This was an exception at the time as it depended on other patches. [REASON TO EXCLUDE THAT FLAG] Btrfs needs to call btrfs_scan_one_device() to determine the fsid, no matter if we're mounting a new fs or an existing one. But if a fs is already mounted and the BLK_OPEN_RESTRICT_WRITES is honored, meaning no other write open is allowed for the block device. Then we want to mount a subvolume of the mounted fs to another mount point, we will call btrfs_scan_one_device() again, but it will fail due to the BLK_OPEN_RESTRICT_WRITES flag (no more write open allowed), causing only one mount point for the fs. Thus at that time, we had to exclude the BLK_OPEN_RESTRICT_WRITES to allow multiple mount points for one fs. [WHY IT'S SAFE NOW] The root problem is, we do not need to nor should use BLK_OPEN_WRITE for btrfs_scan_one_device(). That function is only to read out the super block, no write at all, and BLK_OPEN_WRITE is only going to cause problems for such usage. The root problem has been fixed by patch "btrfs: always open the device read-only in btrfs_scan_one_device", so btrfs_scan_one_device() will always work no matter if the device is opened with BLK_OPEN_RESTRICT_WRITES. [ENHANCEMENT] Just remove the btrfs_open_mode(), as the only call site can be replaced with regular sb_open_mode(). Reviewed-by: Christian Brauner Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 08fa138864d54a2a93ad6fb1b681e7723ba26c9d Author: Qu Wenruo Date: Thu Jun 19 16:48:44 2025 +0930 btrfs: use fs_holder_ops for all opened devices Since we have btrfs_fs_info::sb (struct super_block) as our block device holder, we can safely use fs_holder_ops for all of our block devices. This enables freezing/thawing the filesystem from the underlying block devices. This may enhance hibernation/suspend support since previously freezing/thawing a block device managed by btrfs won't do anything btrfs specific, but only syncing the block device. Thus before this change, freezing the underlying block devices won't prevent future writes into the filesystem, thus may cause problems for hibernation/suspend when btrfs is involved. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 40426dd147ffde7087dc29c263b87e1a2a36ca38 Author: Christoph Hellwig Date: Wed Jun 11 12:03:03 2025 +0200 btrfs: use the super_block as holder when mounting file systems The file system type is not a very useful holder as it doesn't allow us to go back to the actual file system instance. Pass the super_block instead which is useful when passed back to the file system driver. This matches what is done for all other block device based file systems, and allows us to remove btrfs_fs_info::bdev_holder completely. Signed-off-by: Christoph Hellwig Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit bddf57a70781ef8821d415200bdbcb71f443993a Author: Qu Wenruo Date: Tue Jun 17 07:41:14 2025 +0930 btrfs: delay btrfs_open_devices() until super block is created Currently we always call btrfs_open_devices() before creating the super block. It's fine for now because: - No blk_holder_ops is provided - btrfs_fs_type is used as a holder This means no matter who wins the device opening race, the holder will be the same thus not affecting the later sget_fc() race. And since no blk_holder_ops is provided, no bdev operation is depending on the holder. But this will no longer be true if we want to implement a proper blk_holder_ops using fs_holder_ops. This means we will need a proper super block as the bdev holder. To prepare for such change: - Add btrfs_fs_devices::holding member This will prevent btrfs_free_stale_devices() and btrfs_close_device() from deleting the fs_devices when there is another process trying to mount the fs. Along with the new member, here come the two helpers, btrfs_fs_devices_inc_holding() and btrfs_fs_devices_dec_holding(). This will allow us to hold fs_devices without opening it. This is needed because we cannot hold uuid_mutex while calling sget_fc(), this will reverse the lock sequence with s_umount, causing a lockdep warning. - Delay btrfs_open_devices() until a super block is returned This means we have to hold the initial fs_devices first, then unlock uuid_mutex, call sget_fc(), then re-lock uuid_mutex, and decrease the holding number. For new super block case, we continue to btrfs_open_devices() with uuid_mutex hold. For existing super block case, we can unlock uuid_mutex and continue. Although this means a more complex error handling path, as if we didn't call btrfs_open_devices() (either got an existing sb, or sget_fc() failed), we cannot let btrfs_put_fs_info() cleanup the fs_devices, as it can be freed at any time after we decrease the hold on fs_devices and unlock uuid_mutex. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit de339cbfb4027957304174321945d30a3f54e6f5 Author: Qu Wenruo Date: Mon Jun 16 09:42:20 2025 +0930 btrfs: call bdev_fput() to reclaim the blk_holder immediately As part of the preparation for btrfs blk_holder_ops, we want to ensure the holder of a block device has a proper lifespan. However btrfs is always using fput() to close a block device, which has one problem: - fput() is deferred Meaning we can have a block device with invalid (aka, freed) holder. To avoid the problem and align the behavior to other code, just call bdev_fput() instead. There is some extra requirement on the locking, but that's all resolved by previous patches and we should be safe to call bdev_fput(). Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 9f43d0ff55e306aed9fa95c79ed372d530471382 Author: Christoph Hellwig Date: Wed Jun 11 12:03:00 2025 +0200 btrfs: call btrfs_close_devices() from ->kill_sb Although btrfs is not yet implementing blk_holder_ops, there is a requirement for proper blk_holder_ops: - blkdev_put() must not be called under sb->s_umount The blkdev_put()/bdev_fput() must not be called under sb->s_umount to avoid lock order reversal with disk->open_mutex. This is for the proper blk_holder_ops callbacks. Currently we're fine because we call regular fput() which defers the blk holder reclaiming. To prepare for the future of blk_holder_ops, move the btrfs_close_devices() calls into btrfs_free_fs_info(). That will be called from kill_sb() callbacks, which is also called for error handing during mount failures, or there is already an existing super block. Signed-off-by: Christoph Hellwig Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit 2936a6ac8d976f3c4de6fb5fbc00c5905c0cfec7 Author: Qu Wenruo Date: Mon Jun 16 08:14:25 2025 +0930 btrfs: add assertions to make super block creation more clear When calling sget_fc(), there are 3 different situations: a) Critical error No super block created. b) A new super block is created The fc->s_fs_info is transferred to the super block, and fc->s_fs_info is reset to NULL. In this case sb->s_root should still be NULL, and needs to be properly initialized later by btrfs_fill_super(). c) An existing super block is returned The fc->s_fs_info is untouched, and anything related to that fs_info should be properly cleaned up. This is not obvious even with the extra comments at sget_fc(). Enhance the situation by: - Add comments for case b) and c) Especially for case c), the fs_info and fs_devices cleanup happens at different timing, thus needs extra explanation. - Move the comments closer to case b) and case c) Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 35ea448b75f3bdb825e6a19fd8db2a147bee0ab7 Author: Qu Wenruo Date: Thu Jun 12 15:14:35 2025 +0930 btrfs: get rid of re-entering of btrfs_get_tree() [EXISTING PROBLEM] Currently btrfs mount is split into two parts: - btrfs_get_tree_subvol() Which sets up the very basic fs_info, and eventually calls mount_subvol() to mount the target subvolume. - btrfs_get_tree_super() This is the part doing super block allocation and if there is no existing super block, do the real open_ctree() to open the fs. However currently we're doing this in a complex re-entering way: vfs_get_tree() |- btrfs_get_tree() |- btrfs_get_tree_subvol() |- vfs_get_tree() | |- btrfs_get_tree() | |- btrfs_get_tree_super() |- mount_subvol() This is definitely not that easy to grasp. [ENHANCEMENT] The function vfs_get_tree() is only doing the following work: - Call get_tree() call back - Call super_wake() - Call security_sb_set_mnt_opts() In our case, super_wake() can be skipped, as after btrfs_get_tree_subvol() finishes, vfs_get_tree() will call super_wake() on the super block we got anyway. The same applies to security_sb_set_mnt_opts(), as long as we do not free the security from our original fc in btrfs_get_tree_subvol(), the first vfs_get_tree() call will handle the security correctly. So here we only need to: - Replace vfs_get_tree() call with btrfs_get_tree_super() - Keep the existing fc->security for vfs_get_tree() to handle the security This will remove the re-entering behavior and make thing much easier to follow. Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit ae818824a203958b326fd0a29e57aaeb166f1fbe Author: Christoph Hellwig Date: Wed Jun 11 12:02:59 2025 +0200 btrfs: always open the device read-only in btrfs_scan_one_device() btrfs_scan_one_device() opens the block device only to read the super block. Instead of passing a blk_mode_t argument to sometimes open it for writing, just hard code BLK_OPEN_READ as it will never write to the device or hand the block_device out to someone else. Signed-off-by: Christoph Hellwig Signed-off-by: Qu Wenruo Signed-off-by: David Sterba commit ea124ec327086325fc096abf42837dac471ac7ae Author: Caleb Sander Mateos Date: Thu Jun 19 13:27:45 2025 -0600 btrfs: don't skip accounting in early ENOTTY return in btrfs_uring_encoded_read() btrfs_uring_encoded_read() returns early with -ENOTTY if the uring_cmd is issued with IO_URING_F_COMPAT but the kernel doesn't support compat syscalls. However, this early return bypasses the syscall accounting. Go to out_acct instead to ensure the syscall is counted. Fixes: 34310c442e17 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)") CC: stable@vger.kernel.org # 6.15+ Signed-off-by: Caleb Sander Mateos Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9950c31ad9047cfa2599f8c02a9bd74c711a5a9f Author: David Sterba Date: Thu Jun 26 16:30:12 2025 +0200 btrfs: rename inode number parameter passed to btrfs_check_dir_item_collision() The name 'dir' is misleading as it's the inode number of the directory, so rename it accordingly. Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit 8320febc6449f5bade61c8163fd472071e3752da Author: David Sterba Date: Thu Jun 26 16:30:11 2025 +0200 btrfs: pass bool to indicate subvolume/snapshot creation type Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit a5f0e0a4df6c37ab1d21035b05976ab1eeb8dc95 Author: David Sterba Date: Thu Jun 26 16:30:10 2025 +0200 btrfs: pass dentry to btrfs_mksubvol() and btrfs_mksnapshot() There's no reason to pass 'struct path' to btrfs_mksubvol(), though it's been like the since the first commit 76dda93c6ae2c1 ("Btrfs: add snapshot/subvolume destroy ioctl"). We only use the dentry so we should pass it directly. Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit 34f6cc5b187f41e0268ebec363bcf5f98c0defcf Author: David Sterba Date: Thu Jun 26 16:30:09 2025 +0200 btrfs: use struct qstr for subvolume ioctl helpers We pass name and length of subvolumes separately to the related functions, while this can be a struct qstr which is otherwise used for dentry interfaces. Reviewed-by: Boris Burkov Signed-off-by: David Sterba commit 164299ba117619643f6f042d487153d45a142999 Author: Brahmajit Das Date: Fri Jun 20 22:19:57 2025 +0530 btrfs: replace strcpy() with strscpy() strcpy() is discouraged from use due to lack of bounds checking. Replaces it with strscpy(), the recommended alternative for null terminated strings, to follow best practices. There are instances where strscpy() cannot be used such as where both the source and destination are character pointers. In that instance we can use sysfs_emit(). Link: https://github.com/KSPP/linux/issues/88 Suggested-by: Anthony Iliopoulos Signed-off-by: Brahmajit Das Reviewed-by: David Sterba Signed-off-by: David Sterba commit b37eb352c4c6ecd8e6aa62d08dbf3f5d3ce8afd7 Author: David Sterba Date: Fri Jun 27 16:03:53 2025 +0200 btrfs: accessors: delete token versions of set/get helpers Once upon a time there was a need to cache address of extent buffer pages, as it was a costly operation (map_private_extent_buffer(), cfed81a04eb555 ("Btrfs: add the ability to cache a pointer into the eb")). This was not even due to use of HIGHMEM, this had been removed before that due to possible locking issues (a65917156e3459 ("Btrfs: stop using highmem for extent_buffers")). Over time the amount of work in the set/get helpers got reduced and became quite straightforward bounds checking with an unaligned read/write, commit db3756c879773c ("btrfs: remove unused map_private_extent_buffer"). The actual caching of the page_address()/folio_address() in the token was more work for very little gain. This depended on subsequent access into the same page/folio, otherwise the cached pointer had to be updated. For metadata-heavy operations this showed up in the 'perf top' profile where the btrfs_get_token_32() calls were at the top, on my testing machine consuming about 2-3%. The other generic 32/64 bit helpers also appeared in the profile with similar fraction. After removing use of the token helpers we can remove them completely, this leads to reduction of btrfs.ko by 6.7KiB on release config. text data bss dec hex filename 1463289 115665 16088 1595042 1856a2 pre/btrfs.ko 1456601 115665 16088 1588354 183c82 post/btrfs.ko DELTA: -6688 Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit c418a1504540c6678279b965ea73fe61621faa65 Author: David Sterba Date: Fri Jun 27 16:03:52 2025 +0200 btrfs: tree-log: don't use token set/get accessors in fill_inode_item() The token versions of set/get accessors will be removed, use the normal helpers. There's additional overhead of the token helpers that update the cached address in case it moves to another page/folio. The normal versions don't need to do that. Note this is similar to fill_inode_item() in inode.c but with slight differences. The two functions could be deduplicated eventually. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit e3df5141a4c1b85e1f6dc117f48fb634eb275f6c Author: David Sterba Date: Fri Jun 27 16:03:51 2025 +0200 btrfs: don't use token set/get accessors in inode.c:fill_inode_item() The token versions of set/get accessors will be removed, use the normal helpers. There's additional overhead of the token helpers that update the cached address in case it moves to another page/folio. The normal versions don't need to do that. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit 114b806a733ffbd3906fca3493d47529dbc8210b Author: David Sterba Date: Fri Jun 27 16:03:50 2025 +0200 btrfs: don't use token set/get accessors for btrfs_item members The token versions of set/get accessors will be removed, use the normal helpers. The btrfs_item members use that interface the most but there are no real benefits anymore. This reduces stack consumption on x86_64 release config: setup_items_for_insert -32 (144 -> 112) __push_leaf_left -32 (176 -> 144) btrfs_extend_item -16 (104 -> 88) copy_for_split -32 (144 -> 112) btrfs_del_items -16 (144 -> 128) btrfs_truncate_item -24 (152 -> 128) __push_leaf_right -24 (168 -> 144) and module size: text data bss dec hex filename 1463615 115665 16088 1595368 1857e8 pre/btrfs.ko 1463413 115665 16088 1595166 18571e post/btrfs.ko DELTA: -202 Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit 60127c29f1602c47bed4f5b8c62b5859159113e6 Author: Filipe Manana Date: Mon Jun 30 13:30:44 2025 +0100 btrfs: qgroup: remove no longer used fs_info->qgroup_ulist It's not used anymore after commit 091344508249 ("btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta()"), so remove it. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e1249667750399a48cafcf5945761d39fa584edf Author: Filipe Manana Date: Mon Jun 30 13:19:20 2025 +0100 btrfs: qgroup: fix race between quota disable and quota rescan ioctl There's a race between a task disabling quotas and another running the rescan ioctl that can result in a use-after-free of qgroup records from the fs_info->qgroup_tree rbtree. This happens as follows: 1) Task A enters btrfs_ioctl_quota_rescan() -> btrfs_qgroup_rescan(); 2) Task B enters btrfs_quota_disable() and calls btrfs_qgroup_wait_for_completion(), which does nothing because at that point fs_info->qgroup_rescan_running is false (it wasn't set yet by task A); 3) Task B calls btrfs_free_qgroup_config() which starts freeing qgroups from fs_info->qgroup_tree without taking the lock fs_info->qgroup_lock; 4) Task A enters qgroup_rescan_zero_tracking() which starts iterating the fs_info->qgroup_tree tree while holding fs_info->qgroup_lock, but task B is freeing qgroup records from that tree without holding the lock, resulting in a use-after-free. Fix this by taking fs_info->qgroup_lock at btrfs_free_qgroup_config(). Also at btrfs_qgroup_rescan() don't start the rescan worker if quotas were already disabled. Reported-by: cen zhang Link: https://lore.kernel.org/linux-btrfs/CAFRLqsV+cMDETFuzqdKSHk_FDm6tneea45krsHqPD6B3FetLpQ@mail.gmail.com/ CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit c0d013495a80cbb53e2288af7ae0ec4170aafd7c Author: Filipe Manana Date: Mon Jun 30 10:50:46 2025 +0100 btrfs: clear dirty status from extent buffer on error at insert_new_root() If we failed to insert the tree mod log operation, we are not removing the dirty status from the allocated and dirtied extent buffer before we free it. Removing the dirty status is needed for several reasons such as to adjust the fs_info->dirty_metadata_bytes counter and remove the dirty status from the respective folios. So add the missing call to btrfs_clear_buffer_dirty(). Fixes: f61aa7ba08ab ("btrfs: do not BUG_ON() on tree mod log failure at insert_new_root()") CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 9669fcb77eae2c03a030d99b0cc22b1d25a30f7c Author: Johannes Thumshirn Date: Mon Jun 30 16:47:35 2025 +0200 btrfs: change dump_block_groups() in btrfs_dump_space_info() from int to bool btrfs_dump_space_info()'s parameter dump_block_groups is used as a boolean although it is defined as an integer. Change it from int to bool. Reviewed-by: Qu Wenruo Reviewed-by: Daniel Vacek Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit ab5fcbb1adc8e44ed027b0a73f484fbc8d528b94 Author: David Sterba Date: Fri Jun 27 13:01:17 2025 +0200 btrfs: use pgoff_t for page index variables Any conversion of offsets in the logical or the physical mapping space of the pages is done by a shift and the target type should be pgoff_t (type of struct page::index). Fix the locations where it's still unsigned long. Signed-off-by: David Sterba commit afd1dacbd0964c7d36a9057c39c168fe7fbb5196 Author: George Hu Date: Sat Jun 28 13:21:30 2025 +0800 btrfs: replace nested usage of min & max with clamp in btrfs_compress_set_level() Refactor the btrfs_compress_set_level() function by replacing the nested usage of min() and max() macro with clamp() to simplify the code and improve readability. Reviewed-by: Qu Wenruo Signed-off-by: George Hu Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2fb5e56f524f7c0ca3ebda0069f8dd83b90876e5 Author: Dmitry Antipov Date: Fri Jun 27 11:51:17 2025 +0300 btrfs: send: avoid extra calls to strlen() in gen_unique_name() Since 'snprintf()' returns the number of characters which would be emitted and output truncation is handled by 'ASSERT()', it should be safe to use that return value instead of the subsequent calls to 'strlen()' in 'gen_unique_name()'. This also reduces the module's text size. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1897006 161571 16136 2074713 1fa859 fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1896848 161571 16136 2074555 1fa7bb fs/btrfs/btrfs.ko Reviewed-by: Johannes Thumshirn Signed-off-by: Dmitry Antipov Reviewed-by: Filipe Manana Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6633a416ed64aeb5c0a971d091d598b144739886 Author: Filipe Manana Date: Thu Jun 26 16:57:02 2025 +0100 btrfs: qgroup: avoid memory allocation if qgroups are not enabled At btrfs_qgroup_inherit() we allocate a qgroup record even if qgroups are not enabled, which is unnecessary overhead and can result in subvolume creation to fail with -ENOMEM, as create_subvol() calls this function. Improve on this by making btrfs_qgroup_inherit() check if qgroups are enabled earlier and return if they are not, avoiding the unnecessary memory allocation and taking some locks. Reviewed-by: Qu Wenruo Reviewed-by: Johannes Thumshirn Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2fda07effb6f1069b59e93b71c820a6794a703a2 Author: Filipe Manana Date: Wed Jun 25 16:16:05 2025 +0100 btrfs: qgroup: remove pointless error check for add_qgroup_rb() call The add_qgroup_rb() function never returns an error pointer anymore since commit 8d54518b5e52 ("btrfs: qgroup: pre-allocate btrfs_qgroup to reduce GFP_ATOMIC usage"), so checking for an error pointer result at btrfs_quota_enable() is pointless. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit da7f00523925ed0c737aa00dd849c9e4d275f816 Author: Filipe Manana Date: Mon Jun 23 13:15:58 2025 +0100 btrfs: split btrfs_is_fstree() into multiple if statements for readability Instead of a single if statement with multiple conditions, split it into several if statements testing only one condition at a time and return true or false immediately after. This makes it more immediate to reason. The module's text size also slightly decreases, at least with gcc 14.2.0 on x86_64. Before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1897138 161583 16136 2074857 1fa8e9 fs/btrfs/btrfs.ko After: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1896976 161583 16136 2074695 1fa847 fs/btrfs/btrfs.ko Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit fd00922abc07d01bb4c5b71a6622fe0030855f22 Author: Filipe Manana Date: Mon Jun 23 13:13:23 2025 +0100 btrfs: add btrfs prefix to is_fstree() and make it return bool This is an exported function and therefore it should have a 'btrfs_' prefix, to make it clear it's btrfs specific, avoid future name collisions with code outside btrfs, and make its naming consistent with most other btrfs exported functions. So add a 'btrfs_' prefix to it and make it return bool instead of int, since all we need is to return true or false. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0c6f37eaa5454236b8343ca48cd7a77ebad662e3 Author: Filipe Manana Date: Mon Jun 23 12:54:40 2025 +0100 btrfs: split inode extref processing from __add_inode_ref() into a helper The __add_inode_ref() function is quite big and with too much nesting, so move the code that processes inode extrefs into a helper function, to make the function easier to read and reduce the level of indentation too. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 06f77c659e6a231a4d4262bdd6a1c7dc3cb4c44e Author: Filipe Manana Date: Mon Jun 23 11:22:48 2025 +0100 btrfs: split inode ref processing from __add_inode_ref() into a helper The __add_inode_ref() function is quite big and with too much nesting, so move the code that processes inode refs into a helper function, to make the function easier to read and reduce the level of indentation too. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 98060e1611177ddc842601a58258876ab435fdbf Author: Filipe Manana Date: Fri Jun 20 16:58:48 2025 +0100 btrfs: use btrfs inodes in btrfs_rmdir() to avoid so much usage of BTRFS_I() Almost everywhere we want to use a btrfs inode and therefore we have a lot of calls to BTRFS_I(), making the code more verbose. Instead use btrfs inode local variables to avoid so much use of BTRFS_I(). Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 9f82a4ed34d870b5719f9b95f7da4f74d3325a6f Author: Filipe Manana Date: Fri Jun 20 16:50:31 2025 +0100 btrfs: use inode already stored in local variable at btrfs_rmdir() There's no need to call d_inode(dentry) when calling btrfs_unlink_inode() since we have already stored that in a local inode variable. So just use the local variable to make the code less verbose. Reviewed-by: Johannes Thumshirn Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 44cac5234104bb25e57dc75b8d5e6c5c26c384fb Author: David Sterba Date: Fri Jun 20 18:06:45 2025 +0200 btrfs: use our message helpers instead of pr_err/pr_warn/pr_info Our message helpers accept NULL for the fs_info in the context that does not provide and print the common header of the message. The use of pr_* helpers is only for special reasons, like module loading, device scanning or multi-line output (print-tree). Reviewed-by: Qu Wenruo Signed-off-by: David Sterba commit 27260dd1904bb409cf84709928ba9bc5506fbe8e Author: Sun YangKai Date: Thu Jun 12 16:32:23 2025 +0800 btrfs: remove partial support for lowest level from btrfs_search_forward() Commit 323ac95bce44 ("Btrfs: don't read leaf blocks containing only checksums during truncate") changed the condition from `level == 0` to `level == path->lowest_level`, while its original purpose was just to do some leaf node handling (calling btrfs_item_key_to_cpu()) and skip some code that doesn't fit leaf nodes. After changing the condition, the code path: 1. Also handles the non-leaf nodes when path->lowest_level is nonzero, which is wrong. However btrfs_search_forward() is never called with a nonzero path->lowest_level, which makes this bug not found before. 2. Makes the later if block with the same condition, which was originally used to handle non-leaf node (calling btrfs_node_key_to_cpu()) when lowest_level is not zero, dead code. Since btrfs_search_forward() is never called for a path with a lowest_level different from zero, just completely remove the partial support for a non-zero lowest_level, simplifying a bit the code, and assert that lowest_level is zero at the start of the function. Suggested-by: Qu Wenruo Fixes: 323ac95bce44 ("Btrfs: don't read leaf blocks containing only checksums during truncate") Reviewed-by: Filipe Manana Signed-off-by: Sun YangKai Signed-off-by: David Sterba commit c9da22428e09de83b1c301339a97cc14caf93b7a Author: Qianfeng Rong Date: Thu Jun 19 18:15:01 2025 +0800 btrfs: use folio_next_index() helper in check_range_has_page() Simplify code pattern of 'folio->index + folio_nr_pages(folio)' by using the existing helper folio_next_index(). Signed-off-by: Qianfeng Rong Reviewed-by: David Sterba Signed-off-by: David Sterba commit 23a6abdadaa3114e74d2c0350ad7f2b50da7c841 Author: Sun YangKai Date: Sat Jun 14 11:39:06 2025 +0800 btrfs: remove unused parameters from btrfs_lookup_inode_extref() The function btrfs_lookup_inode_extref(` no longer requires transaction handle, insert length, or COW flag, as the only caller now performs a read-only lookup using trans == NULL, ins_len == 0 and cow == 0. This function was introduced in the early days where extref feature was introduced by commit f186373fef00 ("btrfs: extended inode refs"). Then some cleanup was done in commit 33b98f227111 ("btrfs: cleanup: removed unused 'btrfs_get_inode_ref_index'"), which removed the only caller passing trans and other COW specific options. Reviewed-by: Qu Wenruo Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6be75e891c611f5dd460a485b35cd0932b41f763 Author: David Sterba Date: Wed Jun 18 13:29:31 2025 +0200 btrfs: rename error to ret in device_list_add() Unify naming of return value to the preferred way. Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 6631c67ca128d89a2d39865a31ef386b747ef621 Author: David Sterba Date: Wed Jun 18 13:29:30 2025 +0200 btrfs: rename error to ret in btrfs_sysfs_add_mounted() Unify naming of return value to the preferred way. Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 6dfe71e6abc13a43ea057c02d3cb97b9a83973bf Author: David Sterba Date: Wed Jun 18 13:29:29 2025 +0200 btrfs: rename error to ret in btrfs_sysfs_add_fsid() Unify naming of return value to the preferred way. Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 64b8c3851fee19265762cbaff3be597f1832965a Author: David Sterba Date: Wed Jun 18 13:29:28 2025 +0200 btrfs: rename error to ret in btrfs_mksubvol() Unify naming of return value to the preferred way. Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit bfa13b82cc820440435dc68cba7ab9a37550567c Author: David Sterba Date: Wed Jun 18 13:29:27 2025 +0200 btrfs: rename error to ret in btrfs_may_delete() Unify naming of return value to the preferred way. Reviewed-by: Daniel Vacek yy Signed-off-by: David Sterba commit 2abd9e1c58d46e4d5b528a83f75c392ca5700b92 Author: Filipe Manana Date: Thu Jun 12 17:19:05 2025 +0100 btrfs: cache if we are using free space bitmaps for a block group Every time we add free space to the free space tree or we remove free space from the free space tree, we do a lookup for the block group's free space info item in the free space tree. This takes time, navigating the btree and we may block either on IO when reading extent buffers from disk or on extent buffer lock contention due to concurrency. Instead of doing this lookup every time, cache the result in the block structure and use it after the first lookup. This adds two boolean members to the block group structure but doesn't increase the structure's size. The following script that runs fs_mark was used to measure the time spent on run_delayed_tree_ref(), since down that call chain we have calls to add and remove free space to/from the free space tree (calls to btrfs_add_to_free_space_tree() and btrfs_remove_from_free_space_tree()): $ cat test.sh #!/bin/bash DEV=/dev/nullb0 MNT=/mnt FILES=100000 THREADS=$(nproc --all) echo "performance" | \ tee /sys/devices/system/cpu/cpu*/cpufreq/scaling_governor umount $DEV &> /dev/null mkfs.btrfs -f $DEV mount -o ssd $DEV $MNT OPTS="-S 0 -L 5 -n $FILES -s 0 -t $THREADS -k" for ((i = 1; i <= $THREADS; i++)); do OPTS="$OPTS -d $MNT/d$i" done fs_mark $OPTS umount $MNT This is a heavy metadata test as it's exercising only file creation, so a lot of allocations of metadata extents, creating delayed refs for adding new metadata extents and dropping existing ones due to COW. The results of the times it took to execute run_delayed_tree_ref(), in nanoseconds, are the following. Before this change: Range: 1868.000 - 6482857.000; Mean: 10231.430; Median: 7005.000; Stddev: 27993.173 Percentiles: 90th: 13342.000; 95th: 23279.000; 99th: 82448.000 1868.000 - 4222.038: 270696 ############ 4222.038 - 9541.029: 1201327 ##################################################### 9541.029 - 21559.383: 385436 ################# 21559.383 - 48715.063: 64942 ### 48715.063 - 110073.800: 31454 # 110073.800 - 248714.944: 8218 | 248714.944 - 561977.042: 1030 | 561977.042 - 1269798.254: 295 | 1269798.254 - 2869132.711: 116 | 2869132.711 - 6482857.000: 28 | After this change: Range: 1554.000 - 4557014.000; Mean: 9168.164; Median: 6391.000; Stddev: 21467.060 Percentiles: 90th: 12478.000; 95th: 20964.000; 99th: 72234.000 1554.000 - 3453.820: 219004 ############ 3453.820 - 7674.743: 980645 ##################################################### 7674.743 - 17052.574: 552486 ############################## 17052.574 - 37887.762: 68558 #### 37887.762 - 84178.322: 31557 ## 84178.322 - 187024.331: 12102 # 187024.331 - 415522.355: 1364 | 415522.355 - 923187.626: 256 | 923187.626 - 2051092.468: 125 | 2051092.468 - 4557014.000: 21 | Approximate improvement in the first four buckets is about 20%. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit fdeffeb4f58797eb2ca3194a16eb1b49637ac0d4 Author: Filipe Manana Date: Wed Jun 11 18:10:24 2025 +0100 btrfs: add and use helper to determine if using bitmaps in free space tree When adding and removing free space to the free space tree, we need to lookup the respective block group's free info item in the free space tree, check its flags for the BTRFS_FREE_SPACE_USING_BITMAPS bit and then release the path. Move these steps into a helper function and use it in both sites. This will also help avoiding duplicate code in a subsequent change. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d1ac35ae2a51e8f06360aa535b8d0f13800a0861 Author: Filipe Manana Date: Wed Jun 11 23:11:14 2025 +0100 btrfs: use fs_info from local variable in btrfs_convert_free_space_to_extents() There's no need to dereference the block group to extract fs_info as we have already stored fs_info in a local variable. So use the local variable instead. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 497c726ff824c9339e4dbd174f702b2dafb70aeb Author: Filipe Manana Date: Wed Jun 11 23:04:45 2025 +0100 btrfs: avoid double slot decrement at btrfs_convert_free_space_to_extents() There's no need to subtract 1 from path->slots[0] and then decrement the slot, we can reduce the generated assembly code by decrementing the slot and then use it. Module size before: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1846220 162998 16136 2025354 1ee78a fs/btrfs/btrfs.ko Module size after: $ size fs/btrfs/btrfs.ko text data bss dec hex filename 1846204 162998 16136 2025338 1ee77a fs/btrfs/btrfs.ko Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit a8da443c9b67c039fcf40cc5ea34f00a88291174 Author: Filipe Manana Date: Wed Jun 11 17:58:04 2025 +0100 btrfs: turn remove argument of modify_free_space_bitmap() to boolean The argument is used as a boolean, so switch its type from int to bool. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3887067f55a4ac6f9b2c938efa51f2d582b3925b Author: Filipe Manana Date: Wed Jun 11 17:48:28 2025 +0100 btrfs: rename free_space_set_bits() and make it less confusing The free_space_set_bits() is used both to set a range of bits or to clear range of bits, depending on the 'bit' argument value. So the name is very misleading since it's not used only to set bits. Furthermore the 'bit' argument is an integer when a boolean is all that is needed plus its name is singular, which gives the idea the function operates on a single bit and not on a range of bits. So rename the function to free_space_modify_bits(), rename the 'bit' argument to 'set_bits' and turn the argument to bool instead of int. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 6fc5ef7829887c5a07c733013c6158ec47aa24f9 Author: Filipe Manana Date: Wed Jun 11 17:05:12 2025 +0100 btrfs: add btrfs prefix to free space tree exported functions A few of the free space tree exported functions have a 'btrfs_' prefix in their name, but most don't. Not only is this inconsistent, the preferred style is to have such a prefix, to avoid potential collisions in the future with other kernel code and offer a somewhat better readibility by making it obvious in calls sites that we are calling btrfs specific code. So add the 'btrfs_' prefix to all free space tree functions that are missing it. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8bfa3727ea6b852d6e23273cdc8f05f578bc119e Author: Filipe Manana Date: Wed Jun 11 13:06:39 2025 +0100 btrfs: remove pointless out label from load_free_space_extents() All we do under the label is to return, so there's no point in having it, just return directly whenever we get an error. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b7db594bc2b7e0518fae6b1b4eff45bafd9da2c0 Author: Filipe Manana Date: Wed Jun 11 13:04:59 2025 +0100 btrfs: remove pointless out label from load_free_space_bitmaps() All we do under the label is to return, so there's no point in having it, just return directly whenever we get an error. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5801a749a9f4bee4a1ab709ce9549f2aef49afcb Author: Filipe Manana Date: Wed Jun 11 13:00:44 2025 +0100 btrfs: remove pointless out label from add_free_space_extent() All we do under the label is to return, so there's no point in having it, just return directly whenever we get an error. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e3ecf6f16411e12f35fb5c49b7138f7d1eb4cc68 Author: Filipe Manana Date: Wed Jun 11 12:56:47 2025 +0100 btrfs: remove pointless out label from remove_free_space_extent() All we do under the label is to return, so there's no point in having it, just return directly whenever we get an error. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit ffb7068f16ff1d043b446bcd7b76ef19a60d55b9 Author: Filipe Manana Date: Wed Jun 11 12:54:53 2025 +0100 btrfs: remove pointless out label from modify_free_space_bitmap() All we do under the label is to return, so there's no point in having it, just return directly whenever we get an error. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 22b609768cfb639095af4bfc0d8ea10aa3b3eda1 Author: Filipe Manana Date: Wed Jun 11 12:44:11 2025 +0100 btrfs: make free_space_test_bit() return a boolean instead The function returns the result of another function that returns a boolean (extent_buffer_test_bit()), and all the callers need is a boolean an not an integer. So change its return type from int to bool, and modify the callers to store results in booleans instead of integers, which also makes them simpler. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 790b88c4dd3b5cf28a52280c1c5d10865266f0a5 Author: Filipe Manana Date: Wed Jun 11 12:25:48 2025 +0100 btrfs: make extent_buffer_test_bit() return a boolean instead All the callers want is to determine if a bit is set and all of them call the function and do a double negation (!!) on its result to get a boolean. So change it to return a boolean and simplify callers. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit e4e5fcbc62d0105e26b06375b62cf1a2cb54d7b6 Author: Filipe Manana Date: Wed Jun 11 12:18:26 2025 +0100 btrfs: remove pointless out label from update_free_space_extent_count() Just return directly, we don't need the label since all we do under it is to return. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 61b43a937418cd769818159d8cc007eb888ea195 Author: Filipe Manana Date: Wed Jun 11 12:06:57 2025 +0100 btrfs: remove pointless out label from add_new_free_space_info() We can just return directly if btrfs_insert_empty_item() fails, there is no need to release the path before returning, as all callers (or upper in the call chain) will free the path if they get an error from the call to add_new_free_space_info(), which is also a common pattern everywhere in btrfs. Finally there's no need to set 'ret' to 0 if the call to btrfs_insert_empty_item() didn't fail, since 'ret' is already 0. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 44892c5a3e2d779fb056cbb69954d80e718edce1 Author: David Sterba Date: Tue Jun 10 18:30:09 2025 +0200 btrfs: tree-log: add and rename extent bits for dirty_log_pages tree The dirty_log_pages tree is used for tree logging and marks extents based on log_transid. The bits could be renamed to resemble the LOG1/LOG2 naming used for the BTRFS_FS_LOG1_ERR bits. The DIRTY bit is renamed to LOG1 and NEW to LOG2. Signed-off-by: David Sterba commit 55cd57faa5034674200aac4a91387c06c3f1170c Author: David Sterba Date: Tue Jun 10 14:17:55 2025 +0200 btrfs: use folio_end() where appropriate Simplify folio_pos() + folio_size() and use the new helper. Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit 89a3cc19e4e4158b3ffd746918227bc409f91e12 Author: David Sterba Date: Tue Jun 10 14:17:53 2025 +0200 btrfs: add helper folio_end() There are several cases of folio_pos + folio_size, add a convenience helper for that. This is a local helper and not proposed as folio API because it does not seem to be heavily used elsewhere: A quick grep (folio_size + folio_end) in fs/ shows 24 btrfs 4 iomap 4 ext4 2 xfs 2 netfs 1 gfs2 1 f2fs 1 bcachefs 1 buffer.c Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit d549391fc6845b701cffe870ee60916bf8b13094 Author: David Sterba Date: Tue Jun 10 14:17:51 2025 +0200 btrfs: rename variables for locked range in defrag_prepare_one_folio() In preparation to use a helper for folio_pos + folio_size, rename the variables for the locked range so they don't use the 'folio_' prefix. As the locking ranges take inclusive end of the range (hence the "-1") this would be confusing as the folio helpers typically use exclusive end of the range. Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit e47c8a47670dbb71bbeeb6cd91f6697106acd742 Author: David Sterba Date: Tue Jun 10 14:17:48 2025 +0200 btrfs: simplify range end calculations in truncate_block_zero_beyond_eof() The way zero_end is calculated and used does a -1 and +1 that effectively cancel out, so this can be simplified. This is also preparatory patch for using a helper for folio_pos + folio_size with the semantics of exclusive end of the range. Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit bdd01fb0364725081d6e938b8b3e647ee48e97eb Author: Filipe Manana Date: Sat Jun 7 19:55:41 2025 +0100 btrfs: check BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE at __add_block_group_free_space() Every caller of __add_block_group_free_space() is checking if the flag BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE is set before calling it. This is duplicate code and it's prone to some mistake in case we add more callers in the future. So move the check for that flag into the start of __add_block_group_free_space(), and, as a consequence, the path allocation from add_block_group_free_space() is moved into __add_block_group_free_space(), to preserve the behaviour of allocating a path only if the flag BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE is set. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1f06c942aa709d397cf6bed577a0d10a61509667 Author: Filipe Manana Date: Sat Jun 7 19:44:03 2025 +0100 btrfs: always abort transaction on failure to add block group to free space tree Only one of the callers of __add_block_group_free_space() aborts the transaction if the call fails, while the others don't do it and it's either never done up the call chain or much higher in the call chain. So make sure we abort the transaction at __add_block_group_free_space() if it fails, which brings a couple benefits: 1) If some call chain never aborts the transaction, we avoid having some metadata inconsistency because BLOCK_GROUP_FLAG_NEEDS_FREE_SPACE is cleared when we enter __add_block_group_free_space() and therefore __add_block_group_free_space() is never called again to add the block group items to the free space tree, since the function is only called when that flag is set in a block group; 2) If the call chain already aborts the transaction, then we get a better trace that points to the exact step from __add_block_group_free_space() which failed, which is better for analysis. So abort the transaction at __add_block_group_free_space() if any of its steps fails. CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 936f0b49dc4ac29a34a1501342a489d4fe366b9b Author: Qu Wenruo Date: Wed Jun 11 10:52:03 2025 +0930 btrfs: add extra warning when qgroup is marked inconsistent Unlike qgroup rescan, which always shows whether it cleared the inconsistent flag, we do not have a proper way to show if qgroup is marked inconsistent. This was not a big deal before as there aren't that many locations that can mark qgroup inconsistent. But with the introduction of drop_subtree_threshold, qgroup can be marked inconsistent very frequently, especially when dropping subvolumes. Although most user space tools relying on qgroup should do their own checks and queue a rescan if needed, we have no idea when qgroup is marked inconsistent, and this would be much harder to debug. So this patch will add an extra warning (btrfs_warn_rl()) when the qgroup flag is flipped into inconsistent for the first time. And add extra reason why qgroup flips inconsistent. This means we can move the error message immediately before qgroup_inconsistent_warning() into that function. For call sites without an obvious reason, or is a shared error handling, output the function that failed and the error code instead. Reviewed-by: Filipe Manana Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit b37532bffd35374b7816ef0629e8a1bbf12dc30b Author: David Sterba Date: Mon Jun 9 19:09:31 2025 +0200 btrfs: merge btrfs_printk_ratelimited() and its only caller There's only one caller of btrfs_printk_ratelimited(), merge it there. Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 2f3f1ad7f1792d0a6535a2da39d114a12902588d Author: David Sterba Date: Mon Jun 9 19:09:30 2025 +0200 btrfs: simplify debug print helpers without enabled printk The btrfs_debug() helpers depend on various config options. In case of "no_printk" we don't need to define a special helper that in the end does nothing but validates the parameters. As the default build config is to validate the parameters we can simplify it to let the debug helpers expand to nothing and remove btrfs_no_printk_in_rcu(). To avoid warnings use fs_info and inline one variable in extent_from_logical(). Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit f9095103f2db15d791706191819d42224610d542 Author: David Sterba Date: Mon Jun 9 19:09:29 2025 +0200 btrfs: remove remaining unused message helpers Remove the critical level message helpers as they're not used, the RCU protection is provided by the plain helpers. Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 80f4fab544349a90b47a69443973d8f3f3be9334 Author: David Sterba Date: Mon Jun 9 19:09:28 2025 +0200 btrfs: switch RCU helper versions to btrfs_debug() The RCU protection is now done in the plain helpers, we can remove the "_in_rcu" and "_rl_in_rcu". Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 2eac2ae8b214ab39a5f7ff62380f1258711e1d77 Author: David Sterba Date: Mon Jun 9 19:09:27 2025 +0200 btrfs: switch RCU helper versions to btrfs_info() The RCU protection is now done in the plain helpers, we can remove the "_in_rcu" and "_rl_in_rcu". Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 0fe04bf13279099f923a550f4092d952139823a8 Author: David Sterba Date: Mon Jun 9 19:09:26 2025 +0200 btrfs: switch RCU helper versions to btrfs_warn() The RCU protection is now done in the plain helpers, we can remove the "_in_rcu" and "_rl_in_rcu". Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 9db18fe3aca3835756946365dcc33c2dea57a27f Author: David Sterba Date: Mon Jun 9 19:09:25 2025 +0200 btrfs: switch RCU helper versions to btrfs_err() The RCU protection is now done in the plain helpers, we can remove the "_in_rcu" and "_rl_in_rcu". Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 0e26727a731adf0a67a5eff1ed74f74c420e7080 Author: David Sterba Date: Mon Jun 9 19:09:24 2025 +0200 btrfs: switch all message helpers to be RCU safe We have two versions of message helpers, one that provides RCU protection around the call in case we need to dereference device name. As messages are not performance critical we can set up the RCU protection for all of them and drop the distinction for those where device name is needed. This will lead to further simplifications. Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 4d4b489ef1d7913cddb26e49e26628fbfd5eeaf4 Author: David Sterba Date: Mon Jun 9 19:09:23 2025 +0200 btrfs: remove unused levels of message helpers We're using the following levels: crit, err, warn, info, debug. This covers our needs and further specializations is not needed, so let's remove emerg, alert and notice. Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit ee3af49a0519454d7130bcd3882055bc0155bfaa Author: David Sterba Date: Mon Jun 9 19:09:22 2025 +0200 btrfs: remove unused rcu-string printk helpers The RCU-string API has never taken off and we don't use the printk helpers provided as we do the protection in our helpers. Remove the "in RCU" wrappers. Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit d1d1c854270ae21c2c770ac42591558b6511578e Author: David Sterba Date: Mon Jun 9 19:09:21 2025 +0200 btrfs: open code rcu_string_free() and remove it The helper is trivial and we can simply use kfree_rcu() if needed. In our case it's just one place where we rename a device in device_list_add() and the old name can still be used until the end of the RCU grace period. The other case is freeing a device and there nothing should reach the device, so we can use plain kfree(). Reviewed-by: Daniel Vacek Signed-off-by: David Sterba commit 694ce5e143d67267ad26b04463e790a597500b00 Author: Johannes Thumshirn Date: Tue Jun 3 08:14:01 2025 +0200 btrfs: zoned: reserve data_reloc block group on mount Create a block group dedicated for data relocation on mount of a zoned filesystem. If there is already more than one empty DATA block group on mount, this one is picked for the data relocation block group, instead of a newly created one. This is done to ensure, there is always space for performing garbage collection and the filesystem is not hitting ENOSPC under heavy overwrite workloads. CC: stable@vger.kernel.org # 6.6+ Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 28753212e0f9c61afd859acf1d678f5de7faa4b8 Author: Benno Lossin Date: Mon May 19 14:43:02 2025 +0200 rust: types: remove `Either` This enum is not used. Additionally, using it would result in poor ergonomics, because in order to do any operation on a value it has to be matched first. Our version of `Either` also doesn't provide any helper methods making it even more difficult to use. The alternative of creating a custom enum for the concrete use-case also is much better for ergonomics. As one can provide functions on the type directly and users don't need to match the value manually. Signed-off-by: Benno Lossin Reviewed-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250519124304.79237-1-lossin@kernel.org Signed-off-by: Miguel Ojeda commit f1f22dfbea2e834aa81eb8511e2f96583390ef82 Author: David Sterba Date: Fri Jun 6 19:50:14 2025 +0200 btrfs: use btrfs_root_id() where not done yet A few more remaining cases where we can use the helper. Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit 918fb770736a61cd3e855c1471a46409b0a35ea3 Author: David Sterba Date: Fri Jun 6 19:50:01 2025 +0200 btrfs: use btrfs_is_data_reloc_root() where not done yet Two remaining cases where we can use the helper. Reviewed-by: Johannes Thumshirn Signed-off-by: David Sterba commit c6aeae86b9af577ae84b97e6affcb228f5b9481a Author: David Sterba Date: Wed Jun 4 11:29:27 2025 +0200 btrfs: use on-stack variable for block reserve in btrfs_replace_file_extents() We can avoid potential memory allocation failure in btrfs_replace_file_extents() as the block reserve lifetime is limited to the scope of the function. This requires +48 bytes on stack. Signed-off-by: David Sterba commit 7ce22f62b2c5b022841ef51b7f8636484dc713a6 Author: David Sterba Date: Wed Jun 4 11:29:25 2025 +0200 btrfs: use on-stack variable for block reserve in btrfs_truncate() We can avoid potential memory allocation failure in btrfs_truncate() as the block reserve lifetime is limited to the scope of the function. This requires +48 bytes on stack. Signed-off-by: David Sterba commit ec41c345477fe81a17f0c0a95957ce5bc9bd07b8 Author: David Sterba Date: Wed Jun 4 11:29:23 2025 +0200 btrfs: use on-stack variable for block reserve in btrfs_evict_inode() We can avoid potential memory allocation failure in btrfs_evict_inode() as the block reserve lifetime is limited to the scope of the function. This requires +48 bytes on stack. Signed-off-by: David Sterba commit 8811ace43947768d7d05a29b8ac055c70bb1a084 Author: Sun YangKai Date: Wed Jun 4 21:46:39 2025 +0800 btrfs: update comment for xarray fields in struct btrfs_root The inode_lock field of struct btrfs_root was removed in commit e2844cce75c9e61("btrfs: remove inode_lock from struct btrfs_root and use xarray locks") but the related comment haven't been updated. Reviewed-by: Filipe Manana Signed-off-by: Sun YangKai Reviewed-by: David Sterba Signed-off-by: David Sterba commit cc38d178ff33543cdb0bd58cfbb9a7c41372ff75 Author: Qu Wenruo Date: Wed Apr 23 18:28:02 2025 +0930 btrfs: enable large data folio support under CONFIG_BTRFS_EXPERIMENTAL With all the preparation patches already merged, it's pretty easy to enable large data folios: - Remove the ASSERT() on folio size in btrfs_end_repair_bio() - Add a helper to properly set the max folio order Currently due to several call sites that are fetching the bitmap content directly into an unsigned long, we can only support BITS_PER_LONG blocks for each bitmap. - Call the helper when reading/creating an inode The support has the following limitations: - No large folios for data reloc inode The relocation code still requires page sized folio. But it's not that hot nor common compared to regular buffered ios. Will be improved in the future. - Requires CONFIG_BTRFS_EXPERIMENTAL - Will require all folio related operations to check if it needs the extra btrfs_subpage structure Now any folio larger than block size will need btrfs_subpage structure handling. Unfortunately I do not have a physical machine for performance test, but if everything goes like XFS/EXT4, it should mostly bring single digits percentage performance improvement in the real world. Although I believe there are still quite some optimizations to be done, let's focus on testing the current large data folio support first. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit b769777d927af168b1389388392bfd7dc4e38399 Author: Filipe Manana Date: Mon Jun 2 13:56:48 2025 +0100 btrfs: use refcount_t type for the extent buffer reference counter Instead of using a bare atomic, use the refcount_t type, which despite being a structure that contains only an atomic, has an API that checks for underflows and other hazards. This doesn't change the size of the extent_buffer structure. This removes the need to do things like this: WARN_ON(atomic_read(&eb->refs) == 0); if (atomic_dec_and_test(&eb->refs)) { (...) } And do just: if (refcount_dec_and_test(&eb->refs)) { (...) } Since refcount_dec_and_test() already triggers a warning when we decrement a ref count that has a value of 0 (or below zero). Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2697b6159744e5afae0f7715da9f830ba6f9e45a Author: Filipe Manana Date: Mon Jun 2 13:46:23 2025 +0100 btrfs: add comment for optimization in free_extent_buffer() There's this special atomic compare and exchange logic which serves to avoid locking the extent buffers refs_lock spinlock and therefore reduce lock contention, so add a comment to make it more obvious. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 71c086b30d4373a01bd5627f54516a72891a026a Author: Filipe Manana Date: Mon Jun 2 13:27:49 2025 +0100 btrfs: reorganize logic at free_extent_buffer() for better readability It's hard to read the logic to break out of the while loop since it's a very long expression consisting of a logical or of two composite expressions, each one composed by a logical and. Further each one is also testing for the EXTENT_BUFFER_UNMAPPED bit, making it more verbose than necessary. So change from this: if ((!test_bit(EXTENT_BUFFER_UNMAPPED, &eb->bflags) && refs <= 3) || (test_bit(EXTENT_BUFFER_UNMAPPED, &eb->bflags) && refs == 1)) break; To this: if (test_bit(EXTENT_BUFFER_UNMAPPED, &eb->bflags)) { if (refs == 1) break; } else if (refs <= 3) { break; } At least on x86_64 using gcc 9.3.0, this doesn't change the object size. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 41e4ea0bf5558c03c8e7e3fc45ddf61da00e7c80 Author: Filipe Manana Date: Sat May 31 15:56:46 2025 +0100 btrfs: make btrfs_readdir_delayed_dir_index() return a bool instead There's no need to return errors, all we do is return 1 or 0 depending on whether we should or should not stop iterating over delayed dir indexes. So change the function to return bool instead of an int. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4106eb9bdae662e6ba14f1b55a33c8a2489ff86b Author: Filipe Manana Date: Sat May 31 15:41:41 2025 +0100 btrfs: make btrfs_should_delete_dir_index() return a bool instead There's no need to return errors and we currently return 1 in case the index should be deleted and 0 otherwise, so change the return type from int to bool as this is a boolean function and it's more clear this way. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit adc1ef55dc04a57cfafdc1f7477a7c98969e7600 Author: Filipe Manana Date: Fri May 30 18:41:18 2025 +0100 btrfs: add details to error messages at btrfs_delete_delayed_dir_index() Update the error messages with: 1) Fix typo in the first one, deltiona -> deletion; 2) Remove redundant part of the first message, the part following the comma, and including all the useful information: root, inode, index and error value; 3) Update the second message to use more formal language (example 'error' instead of 'err'), , remove redundant part about "deletion tree of delayed node..." and print the relevant information in the same format and order as the first message, without the ugly opening parenthesis without a space separating from the previous word. This also makes the message similar in format to the one we have at btrfs_insert_delayed_dir_index(). Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0187acef3558cd5bb6c0fa6c29a362a015a69d72 Author: Filipe Manana Date: Fri May 30 18:27:07 2025 +0100 btrfs: make btrfs_delete_delayed_insertion_item() return a boolean There's no need to return an integer as all we need to do is return true or false to tell whether we deleted a delayed item or not. Also the logic is inverted since we return 1 (true) if we didn't delete and 0 (false) if we did, which is somewhat counter intuitive. Change the return type to a boolean and make it return true if we deleted and false otherwise. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7077d7b87288ca3a01aff84f0703927a3787dbae Author: Filipe Manana Date: Thu May 29 17:41:46 2025 +0100 btrfs: switch del_all argument of replay_dir_deletes() from int to bool The argument has boolean semantics, so change its type from int to bool, making it more clear. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5f8882c8540efc501e2836afbc0eb06a84bf2ff2 Author: Filipe Manana Date: Thu May 29 16:59:07 2025 +0100 btrfs: pass NULL index to btrfs_del_inode_ref() where not needed There are two callers of btrfs_del_inode_ref() that declare a local index variable and then pass a pointer for it to btrfs_del_inode_ref(), but then don't use that index at all. Since btrfs_del_inode_ref() accepts a NULL index pointer, pass NULL instead and stop declaring those useless index variables. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 93612a92bade22c813599388baca1896a0bbc802 Author: Filipe Manana Date: Sun Jun 1 15:39:16 2025 +0100 btrfs: allocate scratch eb earlier at btrfs_log_new_name() Instead of allocating the scratch eb after joining the log transaction, allocate it before so that we're not delaying log commits for longer than necessary, as allocating the scratch eb means allocating an extent_buffer structure, which comes from a dedicated kmem_cache, plus pages/folios to attach to the eb. Both of these allocations may take time when we're under memory pressure. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 841324a8e60b25b2fa56f93ccc1ef36887593b5a Author: Filipe Manana Date: Sat May 31 16:33:14 2025 +0100 btrfs: allocate path earlier at btrfs_log_new_name() Instead of allocating the path after joining the log transaction, allocate it before so that we're not delaying log commits for the rare cases where the allocation takes a significant time (under memory pressure and all slabs are full, there's the need to allocate a new page, etc). Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b32efae7b853585b1453f169fa5a14565b652326 Author: Filipe Manana Date: Thu May 29 16:32:37 2025 +0100 btrfs: allocate path earlier at btrfs_del_dir_entries_in_log() Instead of allocating the path after joining the log transaction, allocate it before so that we're not delaying log commits for the rare cases where the allocation takes a significant time (under memory pressure and all slabs are full, there's the need to allocate a new page, etc). Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 181436a85b16f9fa860d407ed37c726149fc3301 Author: Filipe Manana Date: Thu May 29 16:25:29 2025 +0100 btrfs: assert we join log transaction at btrfs_del_dir_entries_in_log() We are supposed to be able to join a log transaction at that point, since we have determined that the inode was logged in the current transaction with the call to inode_logged(). So ASSERT() we joined a log transaction and also warn if we didn't in case assertions are disabled (the kernel config doesn't have CONFIG_BTRFS_ASSERT=y), so that the issue gets noticed and reported if it ever happens. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1ed0cfc89e992112b5e5f5677c17081e0eee688d Author: Filipe Manana Date: Thu May 29 16:12:45 2025 +0100 btrfs: use btrfs_del_item() at del_logged_dentry() There's no need to use btrfs_delete_one_dir_name() at del_logged_dentry() because we are processing a dir index key which can contain only a single name, unlike dir item keys which can encode multiple names in case of name hash collisions. We have explicitly looked up for a dir index key by calling btrfs_lookup_dir_index_item() and we don't log dir item keys anymore (since commit 339d03542484 ("btrfs: only copy dir index keys when logging a directory")). So simplify and use btrfs_del_item() directly instead of btrfs_delete_one_dir_name(). Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 0ef4c6120e253f3c7ea2308527a94bc3312f8fa9 Author: Filipe Manana Date: Thu May 29 15:47:24 2025 +0100 btrfs: free path sooner at __btrfs_unlink_inode() After calling btrfs_delete_one_dir_name() there's no need for the path anymore so we can free it immediately after. After that point we do some btree operations that take time and in those call chains we end up allocating paths for these operations, so we're unnecessarily holding on to the path we allocated early at __btrfs_unlink_inode(). So free the path as soon as we don't need it and add a comment. This also allows to simplify the error path, removing two exit labels and returning directly when an error happens. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit d94edb0d7e38e520174c0846afa5337319c1ac5f Author: Filipe Manana Date: Wed May 28 15:28:26 2025 +0100 btrfs: assert we join log transaction at btrfs_del_inode_ref_in_log() We are supposed to be able to join a log transaction at that point, since we have determined that the inode was logged in the current transaction with the call to inode_logged(). So ASSERT() we joined a log transaction and also warn if we didn't in case assertions are disabled (the kernel config doesn't have CONFIG_BTRFS_ASSERT=y), so that the issue gets noticed and reported if it ever happens. Reviewed-by: Boris Burkov Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 75764b41bfc3a463b8a5f240e93f6342510dc944 Author: Al Viro Date: Tue May 6 20:58:26 2025 +0100 btrfs: open code fc_mount() to avoid releasing s_umount rw_sempahore [CURRENT BEHAVIOR] Currently inside btrfs_get_tree_subvol(), we call fc_mount() to grab a tree, then re-lock s_umount inside btrfs_reconfigure_for_mount() to avoid race with remount. However fc_mount() itself is just doing two things: 1. Call vfs_get_tree() 2. Release s_umount then call vfs_create_mount() [ENHANCEMENT] Instead of calling fc_mount(), we can open-code it with vfs_get_tree() first. This provides a benefit that, since we have the full control of s_umount, we do not need to re-lock that rw_sempahore when calling btrfs_reconfigure_for_mount(), meaning less race between RO/RW remount. Signed-off-by: Al Viro Reviewed-by: Qu Wenruo [ Rework the subject and commit message, refactor the error handling ] Signed-off-by: Qu Wenruo Tested-by: Qu Wenruo Signed-off-by: David Sterba commit 4013cde56e170bc71e2d242c1933f4b7c1e4486a Author: David Sterba Date: Fri May 30 18:19:06 2025 +0200 btrfs: rename err to ret in scrub_submit_extent_sector_read() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 56ccdd9af29f302968741cc69ffc59b5fe9fb610 Author: David Sterba Date: Fri May 30 18:19:03 2025 +0200 btrfs: rename err to ret in btrfs_create_common() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 7d13ea864ee50b6d8ef0e7ac6eb5cd99f06b1e2b Author: David Sterba Date: Fri May 30 18:18:57 2025 +0200 btrfs: rename err to ret in btrfs_wait_tree_log_extents() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 0b2cd9e2c7ec8158ba539a0b1c41870982044ba4 Author: David Sterba Date: Fri May 30 18:18:55 2025 +0200 btrfs: rename err to ret in btrfs_wait_extents() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 69c5c6130d090af97b8a602489763b898813c7dc Author: David Sterba Date: Fri May 30 18:18:48 2025 +0200 btrfs: rename err to ret in quota_override_store() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 148961dac302c3051aeb5b918c661d7924e6b6bd Author: David Sterba Date: Fri May 30 18:18:46 2025 +0200 btrfs: rename err to ret in btrfs_fill_super() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 60a8bab08c5883772a30851468487d04d7e621a6 Author: David Sterba Date: Fri May 30 18:18:40 2025 +0200 btrfs: rename err to ret in calc_pct_ratio() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 3b5742f379725f3427000ea3306c3c2b11cd659a Author: David Sterba Date: Fri May 30 18:18:33 2025 +0200 btrfs: rename err to ret in btrfs_symlink() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit af6f6c3af720935c7895455237e5e0df1a41c9fa Author: David Sterba Date: Fri May 30 18:18:31 2025 +0200 btrfs: rename err to ret in btrfs_link() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 9cf280e2bdcd450d35634c4c8938abb72a65465a Author: David Sterba Date: Fri May 30 18:18:29 2025 +0200 btrfs: rename err to ret in btrfs_setattr() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit b71a348513e62f17f0ba56ac406a366277f03ba7 Author: David Sterba Date: Fri May 30 18:18:18 2025 +0200 btrfs: rename err to ret in btrfs_init_inode_security() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit d64ef1d23f1f46b88abf997159c75a06be0a1518 Author: David Sterba Date: Fri May 30 18:18:01 2025 +0200 btrfs: rename err to ret in btrfs_alloc_from_bitmap() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 8d9e877919df9a3a62ebebac362c202f8f0fb803 Author: David Sterba Date: Fri May 30 18:17:58 2025 +0200 btrfs: rename err to ret in btrfs_lock_extent_bits() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 886240cbcd452af1321c9d2cf8e63113ca5875e1 Author: David Sterba Date: Fri May 30 18:17:48 2025 +0200 btrfs: rename err to ret in btrfs_try_lock_extent_bits() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 986b6aa1859205aff6dfe751a59139e0598ad2a5 Author: David Sterba Date: Fri May 30 18:17:46 2025 +0200 btrfs: rename err to ret2 in btrfs_truncate_inode_items() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit a579ddca4392641ffd516714199b58a2d9990ff8 Author: David Sterba Date: Fri May 30 18:17:39 2025 +0200 btrfs: rename err to ret2 in btrfs_add_link() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 8f3850706844f12f3070d3c20d99f13a18d98aa3 Author: David Sterba Date: Fri May 30 18:17:37 2025 +0200 btrfs: rename err to ret2 in btrfs_setsize() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit df20be9f02f0a60817531c660bcde7c7bc0883e9 Author: David Sterba Date: Fri May 30 18:17:26 2025 +0200 btrfs: rename err to ret2 in btrfs_search_old_slot() Unify naming of return value to the preferred way, move the variable to the closest scope. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 644dcb4316c0dc0031186df68aa9be60e8dad7f8 Author: David Sterba Date: Fri May 30 18:17:24 2025 +0200 btrfs: rename err to ret2 in btrfs_search_slot() Unify naming of return value to the preferred way, move the variable to the closest scope. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 56fc5b18c97392158547d95ebddaec9dc4d5178e Author: David Sterba Date: Fri May 30 18:17:14 2025 +0200 btrfs: rename err to ret2 in search_leaf() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 58019c1dd4f82d75e04f0c352c4608657c903b77 Author: David Sterba Date: Fri May 30 18:17:11 2025 +0200 btrfs: rename err to ret2 in read_block_for_search() Unify naming of return value to the preferred way. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 66ca7ea65013dd2b561e6c54749a723fa503595c Author: David Sterba Date: Fri May 30 18:17:05 2025 +0200 btrfs: rename err to ret2 in resolve_indirect_refs() Unify naming of return value to the preferred way, move the variable to the closest scope. Reviewed-by: Anand Jain Signed-off-by: David Sterba commit 582cd4bad4332cca95c578e99442eb148366eb82 Author: Qu Wenruo Date: Mon Jun 2 10:08:53 2025 +0930 btrfs: rename btrfs_subpage structure With the incoming large data folios support, the structure name btrfs_subpage is no longer correct, as for we can have multiple blocks inside a large folio, and the block size is still page size. So to follow the schema of iomap, rename btrfs_subpage to btrfs_folio_state, along with involved enums. There are still exported functions with "btrfs_subpage_" prefix, and I believe for metadata the name "subpage" will stay forever as we will never allocate a folio larger than nodesize anyway. The full cleanup of the word "subpage" will happen in much smaller steps in the future. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1e17738d6b76cdc76d240d64de87fa66ba2365f7 Author: Qu Wenruo Date: Mon Jun 2 10:08:52 2025 +0930 btrfs: add comments on the extra btrfs specific subpage bitmaps Unlike the iomap_folio_state structure, the btrfs_subpage structure has a lot of extra sub-bitmaps, namely: - writeback sub-bitmap - locked sub-bitmap iomap_folio_state uses an atomic for writeback tracking, while it has no per-block locked tracking. This is because iomap always locks a single folio, and submits dirty blocks with that folio locked. But btrfs has async delalloc ranges (for compression), which are queued with their range locked, until the compression is done, then marks the involved range writeback and unlocked. This means a range can be unlocked and marked writeback at seemingly random timing, thus it needs the extra tracking. This needs a huge rework on the lifespan of async delalloc range before we can remove/simplify these two sub-bitmaps. - ordered sub-bitmap - checked sub-bitmap These are for COW-fixup, but as I mentioned in the past, the COW-fixup is not really needed anymore and these two flags are already marked deprecated, and will be removed in the near future after comprehensive tests. Add related comments to indicate we're actively trying to align the sub-bitmaps to the iomap ones. Signed-off-by: Qu Wenruo Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3f093ccb95f30f95b7c6014d1f0b6847299190c2 Author: Daniel Vacek Date: Mon Jun 2 17:53:19 2025 +0200 btrfs: harden parsing of compression mount options Btrfs happily but incorrectly accepts the `-o compress=zlib+foo` and similar options with any random suffix. Fix that by explicitly checking the end of the strings. Signed-off-by: Daniel Vacek Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3f0e865ae61ed8c023b72b1ae6c186024b0aec1f Author: Daniel Vacek Date: Mon Jun 2 17:53:18 2025 +0200 btrfs: factor out compression mount options parsing There are many options making the parsing a bit lengthy. Factor the compress options out into a helper function. The next patch is going to harden this function. Signed-off-by: Daniel Vacek Reviewed-by: David Sterba Signed-off-by: David Sterba commit ccb42a6eed8bf26b7a62e87334ad9c1a4d017398 Author: David Sterba Date: Thu May 15 17:03:24 2025 +0200 btrfs: constify more pointer parameters Another batch of pointer parameter constifications. This is for clarity and minor addition to type safety. There are no observable effects in the assembly code and .ko measured on release config. Signed-off-by: David Sterba commit c7f04fbc98dcf81723bb2fdc65d905a38fc38f3c Author: Boris Burkov Date: Thu May 8 17:54:41 2025 -0700 btrfs: sysfs: track current commit duration in commit_stats When debugging/detecting outlier commit stalls, having an indicator that we are currently in a long commit critical section can be very useful. Extend the commit_stats sysfs file to also include the current commit critical section duration. Since this requires storing the last commit start time, use that rather than a separate stack variable for storing the finished commit durations as well. This also requires slightly moving up the timing of the stats updating to *inside* the critical section to avoid the transaction T+1 setting the critical_section_start_time to 0 before transaction T can update its stats, which would trigger the new ASSERT. This is an improvement in and of itself, as it makes the stats more accurately represent the true critical section time. It may be yet better to pull the stats up to where start_transaction gets unblocked, rather than the next commit, but this seems like a good enough place as well. Signed-off-by: Boris Burkov Reviewed-by: David Sterba Signed-off-by: David Sterba commit 46d549928cc93f9b08fd66d0ff7778e800bb17f3 Author: Pan Chuang Date: Fri May 16 11:03:33 2025 +0800 btrfs: use rb_find_add() in rb_simple_insert() Use the rb-tree helper so we don't open code the search and insert code. Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit c52ea14d0544cfcd3c76ac9e3ce8ca16832cc033 Author: Pan Chuang Date: Fri May 16 11:03:32 2025 +0800 btrfs: pass struct rb_simple_node pointer directly in rb_simple_insert() Replace struct embedding with union to enable safe type conversion in btrfs_backref_node, tree_block and mapping_node. Adjust function calls to use the new unified API, eliminating redundant parameters. Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit fbec9a5d3e98513ce796194fe8604cade1aa3188 Author: Yangtao Li Date: Fri May 16 11:03:31 2025 +0800 btrfs: use rb_find_add() in btrfs_qgroup_add_swapped_blocks() Use the rb-tree helper so we don't open code the search and insert code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 844e5f902ddd07abc0ff67909d4304b39cb1db9b Author: Yangtao Li Date: Fri May 16 11:03:30 2025 +0800 btrfs: use rb_find() in btrfs_qgroup_trace_subtree_after_cow() Use the rb-tree helper so we don't open code the search code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit e3def6ce67642b442c01864edb1f2ca94307d1da Author: Yangtao Li Date: Fri May 16 11:03:29 2025 +0800 btrfs: use rb_find_add() in add_qgroup_rb() Use the rb-tree helper so we don't open code the search and insert code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 1e0f0239a310f035b6afb9cd65c517b23e841ba8 Author: Yangtao Li Date: Fri May 16 11:03:28 2025 +0800 btrfs: use rb_find() in find_qgroup_rb() Use the rb-tree helper so we don't open code the search code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 287480e2691a62ed69daf9764ac6fd34f5fa85f2 Author: Yangtao Li Date: Fri May 16 11:03:27 2025 +0800 btrfs: use rb_find_add() in insert_ref_entry() Use the rb-tree helper so we don't open code the search and insert code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit c6e3ae8ac32254550b04abfe8ff2cb03d84f2165 Author: Yangtao Li Date: Fri May 16 11:03:26 2025 +0800 btrfs: use rb_find_add() in insert_root_entry() Use the rb-tree helper so we don't open code the search and insert code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit afaa9f8235b9bf4cf934e21359158d7b0a2bb8d7 Author: Yangtao Li Date: Fri May 16 11:03:25 2025 +0800 btrfs: use rb_find() in lookup_root_entry() Use the rb-tree helper so we don't open code the search code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3f60f4374ab4cae0595301748e6e6a4a43afa881 Author: Yangtao Li Date: Fri May 16 11:03:24 2025 +0800 btrfs: use rb_find_add() in insert_block_entry() Use the rb-tree helper so we don't open code the search and insert code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 4044a7ed3b1e8a786e6d47ebf756ab25160bd98f Author: Yangtao Li Date: Fri May 16 11:03:23 2025 +0800 btrfs: use rb_find() in lookup_block_entry() Use the rb-tree helper so we don't open code the search code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit b017a92bd9a8ec89cf77496db3d347d244fbb7cf Author: Yangtao Li Date: Fri May 16 11:03:22 2025 +0800 btrfs: use rb_find_add() in ulist_rbtree_insert() Use the rb-tree helper so we don't open code the search and insert code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit c4f38e7ca54e88d34d1cccf88640abc5adb84d73 Author: Yangtao Li Date: Fri May 16 11:03:21 2025 +0800 btrfs: use rb_find() in ulist_rbtree_search() Use the rb-tree helper so we don't open code the search code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 973468585461f40b0f8a57ebdac4e498d041f5a0 Author: Yangtao Li Date: Fri May 16 11:03:20 2025 +0800 btrfs: use rb_find() in __btrfs_lookup_delayed_item() Use the rb-tree helper so we don't open code the search code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 7a91e0187570a699d3476a7476e9f945232ced29 Author: Yangtao Li Date: Fri May 16 11:03:19 2025 +0800 btrfs: use rb_find_add() in btrfs_insert_inode_defrag() Use the rb-tree helper so we don't open code the search and insert code. Signed-off-by: Yangtao Li Signed-off-by: Pan Chuang Reviewed-by: David Sterba Signed-off-by: David Sterba commit 06c3437f744973ade1f2391ef1c12ec37db96504 Author: Dan Johnson Date: Mon Apr 14 17:25:52 2025 -0700 btrfs: fix comment in reserved space warning mkfs.btrfs up to v4.14 actually can leave a chunk inside the reserved space when invoked with `-m single`, fixed by 997f9977c24397eb6980bb9 ("mkfs: Prevent temporary system chunk to use space in reserved 1M range") released with v4.15. Signed-off-by: Dan Johnson Reviewed-by: David Sterba Signed-off-by: David Sterba commit d8f6cb2b28627fefa72e2ce1508db5781868a692 Author: Daniel Vacek Date: Wed May 14 15:12:39 2025 +0200 btrfs: relocation: simplify unused logic related to LINK_LOWER btrfs_backref_link_edge() is always called with the LINK_LOWER argument. We can simplify it and remove the LINK_LOWER and LINK_UPPER macros completely. The last call with LINK_UPPER was removed with commit 0097422c0dfe0a ("btrfs: remove clone_backref_node() from relocation"). Reviewed-by: Johannes Thumshirn Signed-off-by: Daniel Vacek Reviewed-by: David Sterba Signed-off-by: David Sterba commit 593062f67b828ecbd74bcf41e8be44ccf7d72374 Author: Filipe Manana Date: Mon May 19 12:16:10 2025 +0100 btrfs: unfold transaction abort at btrfs_insert_one_raid_extent() We have a common error path where we abort the transaction, but like this in case we get a transaction abort stack trace we don't know exactly which previous function call failed. Instead abort the transaction after any function call that returns an error, so that we can easily identify which function failed. Reviewed-by: Daniel Vacek Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 35bb03e57aa7d1ed8203b802d306089d64664d52 Author: Filipe Manana Date: Mon May 19 11:57:13 2025 +0100 btrfs: unfold transaction abort at __btrfs_update_delayed_inode() We have a common error path where we abort the transaction, but like this in case we get a transaction abort stack trace we don't know exactly which previous function call failed. Instead abort the transaction after any function call that returns an error, so that we can easily identify which function failed. Reviewed-by: Daniel Vacek Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 33e8f24b52d2796b8cfb28c19a1a7dd6476323a8 Author: Filipe Manana Date: Mon May 19 11:07:29 2025 +0100 btrfs: abort transaction on unexpected eb generation at btrfs_copy_root() If we find an unexpected generation for the extent buffer we are cloning at btrfs_copy_root(), we just WARN_ON() and don't error out and abort the transaction, meaning we allow to persist metadata with an unexpected generation. Instead of warning only, abort the transaction and return -EUCLEAN. CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Daniel Vacek Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 273bbb5b487f0c562e1f7373601568933dc25fea Author: Filipe Manana Date: Mon May 19 10:59:18 2025 +0100 btrfs: unfold transaction abort at btrfs_copy_root() Instead of having a common btrfs_abort_transaction() call for when any of the two btrfs_inc_ref() calls fail, move the btrfs_abort_transaction() to happen immediately after each one of the calls, so that when analyzing a stack trace with a transaction abort we know which call failed. Reviewed-by: Daniel Vacek Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit b63c8c1ede4407835cb8c8bed2014d96619389f3 Author: David Sterba Date: Sat May 17 21:03:57 2025 +0200 btrfs: move transaction aborts to the error site in add_block_group_free_space() Transaction aborts should be done next to the place the error happens, which was not done in add_block_group_free_space(). Reviewed-by: Filipe Manana Signed-off-by: David Sterba commit 0b10f3dd13cbbff4965732af86e86a0eb1082dd8 Author: David Sterba Date: Sat May 17 21:04:10 2025 +0200 btrfs: move transaction aborts to the error site in remove_block_group_free_space() Transaction aborts should be done next to the place the error happens, which was not done in remove_block_group_free_space(). Reviewed-by: Filipe Manana Signed-off-by: David Sterba commit 81bfd9d54767d0ec85853102b9a1a02123458314 Author: Filipe Manana Date: Wed May 21 18:18:09 2025 +0100 btrfs: simplify error detection flow during log replay We have this fuzzy logic at btrfs_recover_log_trees() where we don't abort the transaction and exit immediately after each function call that returned an error, and instead have if-then-else logic or check if the previous function call returned success before calling the next function. Make the flow more straightforward by immediately aborting the transaction and exiting after each function call failure. This also allows to avoid two consecutive if statements that test the same conditions: if (!ret && wc.stage == LOG_WALK_REPLAY_ALL) { (...) } Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Signed-off-by: David Sterba commit 6466084df6b083b6f0778aa9adcb83cb8880597e Author: Filipe Manana Date: Wed May 21 17:56:25 2025 +0100 btrfs: remove redundant path release when replaying a log tree There's no need to call btrfs_release_path() before calling btrfs_init_root_free_objectid() as we have released the path already at the top of the loop and the previous call to fixup_inode_link_counts() also releases the path. So remove it to simplify the code. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2a5898c4aac67494c2f0f7fe38373c95c371c930 Author: Filipe Manana Date: Wed May 21 17:41:18 2025 +0100 btrfs: abort transaction during log replay if walk_log_tree() failed If we failed walking a log tree during replay, we have a missing transaction abort to prevent committing a transaction where we didn't fully replay all the changes from a log tree and therefore can leave the respective subvolume tree in some inconsistent state. So add the missing transaction abort. CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 8f1e1b263dbcd0f250116b9453001eb48fc31c74 Author: Filipe Manana Date: Wed May 21 17:30:56 2025 +0100 btrfs: unfold transaction aborts when replaying log trees We have a single line doing a transaction abort in case either we got an error from btrfs_get_fs_root() different from -ENOENT or we got an error from btrfs_pin_extent_for_log_replay(), making it hard to figure out which function call failed when looking at a transaction abort massages and stack trace in dmesg. Change this to have an explicit transaction abort for each one of the two cases. Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 2a946bf6d675178934100582317d58ce74f9e5af Author: Johannes Thumshirn Date: Wed May 21 12:14:05 2025 +0200 btrfs: make btrfs_should_periodic_reclaim() static btrfs_should_periodic_reclaim() is not used outside of space-info.c so make it static and remove the prototype from space-info.h. Reviewed-by: Filipe Manana Signed-off-by: Johannes Thumshirn Reviewed-by: David Sterba Signed-off-by: David Sterba commit 55f7c65b2f69c7e4cb7aa7c1654a228ccf734fd8 Author: Johannes Thumshirn Date: Tue May 20 09:20:47 2025 +0200 btrfs: zoned: use filesystem size not disk size for reclaim decision When deciding if a zoned filesystem is reaching the threshold to reclaim data block groups, look at the size of the filesystem not to potentially total available size of all drives in the filesystem. Especially if a filesystem was created with mkfs' -b option, constraining it to only a portion of the block device, the numbers won't match and potentially garbage collection is kicking in too late. Fixes: 3687fcb0752a ("btrfs: zoned: make auto-reclaim less aggressive") CC: stable@vger.kernel.org # 6.1+ Reviewed-by: Damien Le Moal Tested-by: Damien Le Moal Signed-off-by: Johannes Thumshirn Signed-off-by: David Sterba commit 4a2bf707270f897ab8077baee8ed5842a5321686 Author: Sarika Sharma Date: Mon Jul 21 11:47:49 2025 +0530 wifi: ath12k: Correct tid cleanup when tid setup fails Currently, if any error occurs during ath12k_dp_rx_peer_tid_setup(), the tid value is already incremented, even though the corresponding TID is not actually allocated. Proceed to ath12k_dp_rx_peer_tid_delete() starting from unallocated tid, which might leads to freeing unallocated TID and cause potential crash or out-of-bounds access. Hence, fix by correctly decrementing tid before cleanup to match only the successfully allocated TIDs. Also, remove tid-- from failure case of ath12k_dp_rx_peer_frag_setup(), as decrementing the tid before cleanup in loop will take care of this. Compile tested only. Signed-off-by: Sarika Sharma Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250721061749.886732-1-quic_sarishar@quicinc.com Signed-off-by: Jeff Johnson commit c4825d540f4beb179d552f3aa1f44f8db5095fb6 Author: Baochen Qiang Date: Mon Jul 21 10:27:26 2025 +0800 wifi: ath12k: bring DFS support back for WCN7850 Due to the restrict in MAC80211 that DFS (Dynamic Frequency Selection) can't be enabled on multiple channels, commit 176f3009ae59 ("wifi: ath12k: support 2 channels for single pdev device") removes DFS support in order to support 2 channels concurrently, making AP mode not working on DFS channels [1]. Revert portions of that commit to bring DFS back, and add a new combination to support 2-channels concurrency. This is valid because the MAC80211 restrict works on each individual combination, but does not care about them as a whole, as far as DFS is concerned. This change applies to WCN7850 only, other chips are not affected. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: 176f3009ae59 ("wifi: ath12k: support 2 channels for single pdev device") Reported-by: Mihai Moldovan Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220346 # 1 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Tested-by: Mihai Moldovan Link: https://patch.msgid.link/20250721-ath12k-dfs-v1-1-065c31454f91@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 306facc029ba8d217ef5a46e8cf4bd50c70603d0 Author: Jeff Johnson Date: Sun Jul 20 08:24:14 2025 -0700 wifi: ath12k: Prefer {} to {0} in initializers Prefer {} to {0} in initializers since {} works even when the first member is not a scalar. Generated using: sed -i 's/{[[:space:]]*0[[:space:]]*}/{}/g' drivers/net/wireless/ath/ath12k/* Compile tested only. Link: https://patch.msgid.link/20250720-ath12k-zero-brace-v1-1-d8c8ca9d40a8@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 1228d99fac4c103a1ca6af82ddd27ba2c445d0ca Author: Jeff Johnson Date: Sun Jul 20 08:13:38 2025 -0700 wifi: ath11k: Prefer {} to {0} in initializers Prefer {} to {0} in initializers since {} works even when the first member is not a scalar. Generated using: sed -i 's/{[[:space:]]*0[[:space:]]*}/{}/g' drivers/net/wireless/ath/ath11k/* Compile tested only. Link: https://patch.msgid.link/20250720-ath11k-zero-brace-v1-1-6132e2ef1748@oss.qualcomm.com Signed-off-by: Jeff Johnson commit f0b72d15265e877a02427e0062a72ade70ee6f86 Author: Jeff Johnson Date: Sun Jul 20 07:46:15 2025 -0700 wifi: ath10k: Prefer {} to {0} in initializers Prefer {} to {0} in initializers since {} works even when the first member is not a scalar. Generated using: sed -i 's/{[[:space:]]*0[[:space:]]*}/{}/g' drivers/net/wireless/ath/ath10k/* Compile tested only. Link: https://patch.msgid.link/20250720-ath10k-zero-brace-v1-1-c1ee818d6238@oss.qualcomm.com Signed-off-by: Jeff Johnson commit dd4186c2f2733389749182775498b03528622d70 Author: Steven Rostedt Date: Thu Jun 12 10:53:14 2025 -0400 PM: tracing: Hide power_domain_target event under ARCH_OMAP2PLUS The power_domain_target event event is only called when CONFIG_OMAP2PLUS is defined. As each event can take up to 5K regardless if they are used or not, it's best not to define them when they are not used. Add #ifdef around these events when they are not used. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Viresh Kumar Cc: Madhavan Srinivasan Cc: Michael Ellerman Link: https://lore.kernel.org/20250612145408.415483176@goodmis.org Acked-by: Rafael J. Wysocki Signed-off-by: Steven Rostedt (Google) commit e68849097e82f7e42f3212cefbdcb7d1428e6ffd Author: Steven Rostedt Date: Thu Jun 12 10:53:13 2025 -0400 PM: tracing: Hide device_pm_callback events under PM_SLEEP The events device_pm_callback_start and device_pm_callback_end events are only called when CONFIG_PM_SLEEP is defined. As each event can take up to 5K regardless if they are used or not, it's best not to define them when they are not used. Add #ifdef around these events when they are not used. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Viresh Kumar Cc: Madhavan Srinivasan Cc: Michael Ellerman Link: https://lore.kernel.org/20250612145408.246703478@goodmis.org Acked-by: Rafael J. Wysocki Signed-off-by: Steven Rostedt (Google) commit e64397f81c5422d5323f5f9a0fd2438e4c403015 Author: Steven Rostedt Date: Thu Jun 12 10:53:12 2025 -0400 PM: tracing: Hide psci_domain_idle events under ARM_PSCI_CPUIDLE The events psci_domain_idle_enter and psci_domain_idle_exit events are only called when CONFIG_ARM_PSCI_CPUIDLE is defined. As each event can take up to 5K (less for DEFINE_EVENT()) regardless if they are used or not, it's best not to define them when they are not used. Add #ifdef around these events when they are not used. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Viresh Kumar Cc: Madhavan Srinivasan Cc: Michael Ellerman Link: https://lore.kernel.org/20250612145408.074769245@goodmis.org Acked-by: Rafael J. Wysocki Signed-off-by: Steven Rostedt (Google) commit 647fe16b46999258ce1aec41f4bdeabb4f0cc8e7 Author: Steven Rostedt Date: Thu Jun 12 10:53:11 2025 -0400 PM: cpufreq: powernv/tracing: Move powernv_throttle trace event As the trace event powernv_throttle is only used by the powernv code, move it to a separate include file and have that code directly enable it. Trace events can take up around 5K of memory when they are defined regardless if they are used or not. It wastes memory to have them defined in configurations where the tracepoint is not used. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Cc: Madhavan Srinivasan Cc: Michael Ellerman Link: https://lore.kernel.org/20250612145407.906308844@goodmis.org Fixes: 0306e481d479a ("cpufreq: powernv/tracing: Add powernv_throttle tracepoint") Acked-by: Viresh Kumar Acked-by: Rafael J. Wysocki Signed-off-by: Steven Rostedt (Google) commit 06cc77a63f1b10e8f05e7223753883e14c35b512 Author: Steven Rostedt Date: Thu Jun 12 09:58:28 2025 -0400 alarmtimer: Hide alarmtimer_suspend event when RTC_CLASS is not configured The trace event alarmtimer_suspend is only called when RTC_CLASS is defined. As every event created can create up to 5K of text and meta data regardless if it is called or not it should not be created and waste memory. Hide the event when CONFIG_RTC_CLASS is not defined. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Peter Zijlstra Link: https://lore.kernel.org/20250612095828.6d75dfa3@batman.local.home Acked-by: Thomas Gleixner Signed-off-by: Steven Rostedt (Google) commit a3b366dbf468788baa2e0ccdccd8482ac277e47b Author: Steven Rostedt Date: Thu Jun 12 09:49:32 2025 -0400 tracing, AER: Hide PCIe AER event when PCIEAER is not configured The event aer_event is only used when CONFIG_PCIEAER is configured. It should not be created when it is not. When an event is created it creates around 5K of text and meta data regardless if the tracepoint is used or not. Instead of wasting this memory, put #ifdef around the event to not create it when it is not used. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Tony Luck Link: https://lore.kernel.org/20250612094932.4a08abd6@batman.local.home Acked-by: Borislav Petkov (AMD) Signed-off-by: Steven Rostedt (Google) commit 23a2d4c64e713b5645e3af8fc9da0931600ba85c Author: Steven Rostedt Date: Fri Jul 18 16:18:45 2025 -0400 ktest.pl: Always display BUILD_DIR and OUTPUT_DIR at the start of tests As ktest.pl can run in various different directories, to make sure the test is running in the proper directory with the proper source and proper destination directory, display the content of BUILD_DIR and OUTPUT_DIR at the start of every test. This can be helpful for the test runner to stop the test if a test is running in the wrong location instead of finding out after the test has completed. Cc: "John Warthog9 Hawley" Cc: Dhaval Giani Cc: Greg KH Link: https://lore.kernel.org/20250718202053.898022631@kernel.org Signed-off-by: Steven Rostedt commit 61f7e318e99d3b398670518dd3f4f8510d1800fc Author: Steven Rostedt Date: Fri Jul 18 16:18:44 2025 -0400 ktest.pl: Prevent recursion of default variable options If a default variable contains itself, do not recurse on it. For example: ADD_CONFIG := ${CONFIG_DIR}/temp_config DEFAULTS ADD_CONFIG = ${CONFIG_DIR}/default_config ${ADD_CONFIG} The above works because the temp variable ADD_CONFIG (is a temp because it is created with ":=") is already defined, it will be substituted in the variable option. But if it gets commented out: # ADD_CONFIG := ${CONFIG_DIR}/temp_config DEFAULTS ADD_CONFIG = ${CONFIG_DIR}/default_config ${ADD_CONFIG} Then the above will go into a recursive loop where ${ADD_CONFIG} will get replaced with the current definition of ADD_CONFIG which contains the ${ADD_CONFIG} and that will also try to get converted. ktest.pl will error after 100 attempts of recursion and fail. When replacing a variable with the default variable, if the default variable contains itself, do not replace it. Cc: "John Warthog9 Hawley" Cc: Dhaval Giani Cc: Greg KH Link: https://lore.kernel.org/20250718202053.732189428@kernel.org Signed-off-by: Steven Rostedt commit acd98e230ee86a9812c56a081929248cdbe412fa Author: Steven Rostedt Date: Fri Jul 18 16:18:43 2025 -0400 ktest.pl: Have -D option work without a space Allow -DBUILD_TYPE=boot work the same as -D BUILD_TYPE=boot just like normal single character option does in most applications. Cc: "John Warthog9 Hawley" Cc: Dhaval Giani Cc: Greg KH Link: https://lore.kernel.org/20250718202053.567246162@kernel.org Signed-off-by: Steven Rostedt commit 3bcdb6e90c9f5403e764dc9cdbe7907026de59a0 Author: Steven Rostedt Date: Fri Jul 18 16:18:42 2025 -0400 ktest.pl: Allow command option -D to override temp variables Currently -D only updates the persistent options that are defined with "=". Allow it to also override all temp variables that are defined with ":=". ktest.pl -D 'USE_TEMP_DIR:=1' -D 'TEST_TYPE[2]=build' config Cc: "John Warthog9 Hawley" Cc: Dhaval Giani Cc: Greg KH Link: https://lore.kernel.org/20250718202053.399653933@kernel.org Signed-off-by: Steven Rostedt commit 23b772c15f5b39fb2c27b386946232769e4dcc32 Author: Steven Rostedt Date: Fri Jul 18 16:18:41 2025 -0400 ktest.pl: Add -D option to override options Add -D option that lets the user override options in the config. For instance, if the config has: BUILD_NOCLEAN=1 which prevents mrproper from being called before builds, and the user wants to call it once. The user can run: ktest -D BUILD_NOCLEAN=0 config And the default "BUILD_NOCLEAN" options will be disabled. If the user wants to change the second test to do a build and not boot, the user can run: ktest -D 'TEST_TYPE[2]=build' config Where the '[#]' is for the test to assign the variable for. In the above example, it will happen on test 2. Cc: "John Warthog9 Hawley" Cc: Dhaval Giani Cc: Greg KH Link: https://lore.kernel.org/20250718202053.231478909@kernel.org Signed-off-by: Steven Rostedt commit 1d264d3a198839c7483580acdce17e1015d0ef91 Author: Aaron Kling Date: Sun Jul 20 21:14:59 2025 -0500 dt-bindings: thermal: tegra: Document Tegra210B01 Add the compatible string for Tegra210B01 SOC_THERM Acked-by: Rob Herring (Arm) Signed-off-by: Aaron Kling Link: https://lore.kernel.org/r/20250720-t210b01-v2-5-9cb209f1edfc@gmail.com Signed-off-by: Daniel Lezcano commit a9302f8fbe8c0fd7d92e6e003ba62086b2ee1162 Author: Aleksander Jan Bajkowski Date: Sat Jul 12 21:59:03 2025 +0200 dt-bindings: thermal: mediatek: Add fallback compatible string for MT7981 and MT8516 The ‘mediatek,mt7981-thermal’ and ‘mediatek,mt8516-thermal’ strings aren't definied in the driver. Both should have fallback compatible strings. This commit fixes this issue. Fixes: 788494ba0999 ("dt-bindings: thermal: convert Mediatek Thermal to the json-schema") Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Krzysztof Kozlowski Acked-by: Rafał Miłecki Link: https://lore.kernel.org/r/20250712195904.6988-2-olek2@wp.pl Signed-off-by: Daniel Lezcano commit 84b62b72b4c759b51568e44b0e8dc80f4cb8a2b9 Author: Michael-CY Lee Date: Mon Jul 21 14:51:59 2025 +0800 wifi: cfg80211/mac80211: report link ID for unexpected frames The upper layer may require the link ID to properly handle unexpected frames. For instance, if hostapd, operating as an AP MLD, receives a data frame from a non-associated STA, it must send deauthentication to the link on which the STA is operating. Signed-off-by: Michael-CY Lee Reviewed-by: Money Wang Link: https://patch.msgid.link/20250721065159.1740992-1-michael-cy.lee@mediatek.com [edit commit message] Signed-off-by: Johannes Berg commit 4970e393eb5d1aed10119532abe36e07f27eec7f Author: Michael-CY Lee Date: Mon Jul 21 14:29:29 2025 +0800 wifi: mac80211: determine missing link_id in ieee80211_rx_for_interface() based on frequency For broadcast frames, every interface might have to process it and therefore the link_id cannot be determined in the driver. In mac80211, when the frame is about to be forwarded to each interface, we can use the member "freq" in struct ieee80211_rx_status to determine the "link_id" for each interface. Signed-off-by: Michael-CY Lee Reviewed-by: Money Wang Link: https://patch.msgid.link/20250721062929.1662700-1-michael-cy.lee@mediatek.com [simplify, remove unnecessary link->conf check] Signed-off-by: Johannes Berg commit c639a44ac6c2624f983bbe36483166a4b3afb371 Author: Double Lo Date: Tue Jun 24 04:34:53 2025 -0500 wifi: brcmfmac: support CYW54591 PCIE device CYW54591 is a variant of BCM4355 silicon with the same chipid. In the chipid-fwname mapping table, apply chiprev 13 to identify CYW54591. Skip reading OTP process for CYW chip since it contains vendor specific information which is not common for cypress. Signed-off-by: Double Lo Signed-off-by: Chi-hsien Lin Signed-off-by: Ian Lin Acked-by: Arend van Spriel Link: https://patch.msgid.link/20250624093453.7264-1-ian.lin@infineon.com Signed-off-by: Johannes Berg commit 579bf8037b70b644a674c126a32bbb2212cf5c21 Author: Gokul Sivakumar Date: Thu Jun 26 10:37:02 2025 +0530 wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE After commit bd99a3013bdc ("brcmfmac: move configuration of probe request IEs"), the probe request MGMT IE addition operation brcmf_vif_set_mgmt_ie() got moved from the brcmf_p2p_scan_prep() to the brcmf_cfg80211_scan(). Because of this, as part of the scan request handler for the P2P Discovery, vif struct used for adding the Probe Request P2P IE in firmware got changed from the P2PAPI_BSSCFG_DEVICE vif to P2PAPI_BSSCFG_PRIMARY vif incorrectly. So the firmware stopped adding P2P IE to the outgoing P2P Discovery probe requests frames and the other P2P peers were unable to discover this device causing a regression on the P2P feature. To fix this, while setting the P2P IE in firmware, properly use the vif of the P2P discovery wdev on which the driver received the P2P scan request. This is done by not changing the vif pointer, until brcmf_vif_set_mgmt_ie() is completed. Fixes: bd99a3013bdc ("brcmfmac: move configuration of probe request IEs") Signed-off-by: Gokul Sivakumar Acked-by: Arend van Spriel Link: https://patch.msgid.link/20250626050706.7271-1-gokulkumar.sivakumar@infineon.com Signed-off-by: Johannes Berg commit be06a8c7313943109fa870715356503c4c709cbc Author: Johannes Berg Date: Fri Jul 18 20:23:06 2025 +0200 wifi: cfg80211: reject HTC bit for management frames Management frames sent by userspace should never have the order/HTC bit set, reject that. It could also cause some confusion with the length of the buffer and the header so the validation might end up wrong. Link: https://patch.msgid.link/20250718202307.97a0455f0f35.I1805355c7e331352df16611839bc8198c855a33f@changeid Signed-off-by: Johannes Berg commit 460114eae8284155b51f6e72ed26f627ee338a30 Author: Miri Korenblit Date: Mon Jul 21 09:20:03 2025 +0300 wifi: mac80211: remove ieee80211_remove_key It is no longer used, remove it. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250721091956.e964ceacd85c.Idecab8ef161fa58e000b3969bc936399284b79f0@changeid Signed-off-by: Johannes Berg commit 8e766823592a4450f0405a96003642bde56bbb01 Merge: 19272b37aa4f83 8a65268500b00e Author: Stephen Boyd Date: Mon Jul 21 10:32:46 2025 -0700 Merge tag 'clk-meson-v6.17-1' of https://github.com/BayLibre/clk-meson into clk-amlogic Pull Amlogic clk driver updates from Jerome Brunet: - Use the auxiliary reset controller implementation in the Amlogic axg-audio, instead of implementing the reset controller in drivers/clk - Drop unnecessary clock controller headers for Amlogic drivers - Drop clock controller big regmap tables in the Amlogic drivers * tag 'clk-meson-v6.17-1' of https://github.com/BayLibre/clk-meson: clk: amlogic: s4: remove unused data clk: amlogic: drop clk_regmap tables clk: amlogic: get regmap with clk_regmap_init clk: amlogic: remove unnecessary headers clk: amlogic: axg-audio: use the auxiliary reset driver clk: tests: add clk_hw_get_dev() and clk_hw_get_of_node() tests clk: tests: Make clk_register_clk_parent_data_device_driver() common clk: add a clk_hw helpers to get the clock device or device_node commit 0b4ff5bc7d75553e243de5e2baf867c9beb63bef Merge: 19272b37aa4f83 80395c3b47577c Author: Stephen Boyd Date: Mon Jul 21 10:26:31 2025 -0700 Merge tag 'sunxi-clk-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into clk-allwinner Pull Allwinner clk driver updates from Chen-Yu Tsai: - Add Allwinner A523's missing PPU0 reset (both DT binding and driver) The binding change is shared with the soc tree. - Fix Allwinner V3s DE clock mux field width - Stop passing rate change requests to parent for Allwinner V3s DE clock - Force and lock Allwinner V3s DE and TCON clocks to the same parent, the video PLL * tag 'sunxi-clk-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: clk: sunxi-ng: ccu_nm: convert from round_rate() to determine_rate() clk: sunxi-ng: ccu_nkmp: convert from round_rate() to determine_rate() clk: sunxi-ng: ccu_nk: convert from round_rate() to determine_rate() clk: sunxi-ng: ccu_gate: convert from round_rate() to determine_rate() clk: sunxi-ng: v3s: Assign the de and tcon clocks to the video pll clk: sunxi-ng: v3s: Fix de clock definition clk: sunxi-ng: sun55i-a523-r-ccu: Add missing PPU0 reset dt-bindings: reset: sun55i-a523-r-ccu: Add missing PPU0 reset commit 0f29e33fbadd7517b96f3f3e86220215d99875cb Author: Luca Weiss Date: Wed Jul 9 15:14:49 2025 +0200 dt-bindings: interconnect: document the RPMh Network-On-Chip Interconnect in Qualcomm Milos SoC Document the RPMh Network-On-Chip Interconnect of the Milos (e.g. SM7635) SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250709-sm7635-icc-v3-1-c446203c3b3a@fairphone.com Signed-off-by: Georgi Djakov commit d9c5c2320156ba4c7ac79db2ea98f4445a18c2e7 Author: Marc Zyngier Date: Mon Jul 21 11:19:51 2025 +0100 KVM: arm64: Make RAS registers UNDEF when RAS isn't advertised We currently always expose FEAT_RAS when available on the host. As we are about to make this feature selectable from userspace, check for it being present before emulating register accesses as RAZ/WI, and inject an UNDEF otherwise. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250721101955.535159-4-maz@kernel.org Signed-off-by: Oliver Upton commit 303084ad12767db64c84ba8fcd0450aec38c8534 Author: Marc Zyngier Date: Mon Jul 21 11:19:50 2025 +0100 KVM: arm64: Filter out HCR_EL2 bits when running in hypervisor context Most HCR_EL2 bits are not supposed to affect EL2 at all, but only the guest. However, we gladly merge these bits with the host's HCR_EL2 configuration, irrespective of entering L1 or L2. This leads to some funky behaviour, such as L1 trying to inject a virtual SError for L2, and getting a taste of its own medecine. Not quite what the architecture anticipated. In the end, the only bits that matter are those we have defined as invariants, either because we've made them RESx (E2H, HCD...), or that we actively refuse to merge because the mess with KVM's own logic. Use the sanitisation infrastructure to get the RES1 bits, and let things rip in a safer way. Fixes: 04ab519bb86df ("KVM: arm64: nv: Configure HCR_EL2 for FEAT_NV2") Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250721101955.535159-3-maz@kernel.org Signed-off-by: Oliver Upton commit c6e35dff58d348c1a9489e9b3b62b3721e62631d Author: Marc Zyngier Date: Sun Jul 20 11:22:29 2025 +0100 KVM: arm64: Check for SYSREGS_ON_CPU before accessing the CPU state Mark Brown reports that since we commit to making exceptions visible without the vcpu being loaded, the external abort selftest fails. Upon investigation, it turns out that the code that makes registers affected by an exception visible to the guest is completely broken on VHE, as we don't check whether the system registers are loaded on the CPU at this point. We managed to get away with this so far, but that's obviously as bad as it gets, Add the required checksm and document the absolute need to check for the SYSREGS_ON_CPU flag before calling into any of the __vcpu_write_sys_reg_to_cpu()__vcpu_read_sys_reg_from_cpu() helpers. Reported-by: Mark Brown Signed-off-by: Marc Zyngier Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/18535df8-e647-4643-af9a-bb780af03a70@sirena.org.uk Link: https://lore.kernel.org/r/20250720102229.179114-1-maz@kernel.org Signed-off-by: Oliver Upton commit 985da98f294ae7bd83b58ca50374a07972d594bf Merge: 12702f0c38347f 84daa158bb5e72 Author: Arnd Bergmann Date: Mon Jul 21 18:18:07 2025 +0200 Merge tag 'tegra-for-6.17-soc' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers soc/tegra: Updates for v6.17-rc1 The bulk of this is the addition of Tegra264 support for various low- level components. This also adds fabric descriptors for the new Tegra254 and Tegra264 chips. * tag 'tegra-for-6.17-soc' of https://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: soc/tegra: cbb: Add support for CBB fabrics in Tegra254 soc/tegra: cbb: Add support for CBB fabrics in Tegra264 soc/tegra: cbb: Support HW lookup to get timed out target address soc/tegra: cbb: Improve handling for per SoC fabric data soc/tegra: cbb: Make error interrupt enable and status per SoC soc/tegra: cbb: Change master/slave to initiator/target soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS soc/tegra: Add Tegra264 APBMISC compatible string soc/tegra: pmc: Add Tegra264 support soc/tegra: Enable support for Tegra264 Link: https://lore.kernel.org/r/20250711220943.2389322-1-thierry.reding@gmail.com Signed-off-by: Arnd Bergmann commit 12702f0c38347f3825a61b7c84d1b1d7eb84dd74 Author: Bartosz Golaszewski Date: Mon Jul 21 15:15:11 2025 +0200 soc: fsl: qe: convert set_multiple() to returning an integer The conversion to using the new GPIO line setter callbacks missed the set_multiple() in this file. Convert it to using the new callback. Fixes: 52ccf19527fd ("soc: fsl: qe: use new GPIO line value setter callbacks") Signed-off-by: Bartosz Golaszewski commit 83d92eae8d44e320a414b76fcba8186fa739f3e8 Author: Bartosz Golaszewski Date: Sat Jul 19 17:58:25 2025 +0200 pinctrl: rp1: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Linus Walleij Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrea della Porta Signed-off-by: Arnd Bergmann commit fcb476990beb55c958db0b5aa2e9ca772d0fc982 Author: Xu Yang Date: Mon Jul 21 18:44:17 2025 +0800 usb: core: add urb->sgt parameter description The parameter description of urb->sgt is lost, this will add it for completeness. Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20250711182803.1d548467@canb.auug.org.au/ Signed-off-by: Xu Yang Fixes: 488e6eaab88c ("usb: core: add dma-noncoherent buffer alloc and free API") Link: https://lore.kernel.org/r/20250721104417.3442530-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 48f9034e024a4c6e279b0d040e1f5589bb544806 Author: Yixun Lan Date: Fri Jul 18 23:04:37 2025 +0800 dt-bindings: serial: 8250: spacemit: set clocks property as required In SpacemiT's K1 SoC, the clocks for UART are mandatory needed, so for DT, both clocks and clock-names property should be set as required. Fixes: 2c0594f9f062 ("dt-bindings: serial: 8250: support an optional second clock") Signed-off-by: Yixun Lan Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250718-01-k1-uart-binding-v1-1-a92e1e14c836@gentoo.org Signed-off-by: Greg Kroah-Hartman commit 5eb2d4b3e9a19f08e0ccbb81e0fbfa61de229345 Author: Lad Prabhakar Date: Wed Jul 16 21:29:23 2025 +0100 dt-bindings: serial: renesas: Document RZ/V2N SCIF Document SCIF bindings for the Renesas RZ/V2N (a.k.a R9A09G056) SoC. The SCIF interface in Renesas RZ/V2N is identical to the one available in RZ/V2H(P), so `renesas,scif-r9a09g057` will be used as a fallback, allowing reuse of the existing driver without modifications. Signed-off-by: Lad Prabhakar Acked-by: "Rob Herring (Arm)" Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250716202923.163950-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 69c94feda519cb7615794123eac8981d7ac9f688 Author: Andy Shevchenko Date: Wed Jul 16 17:23:29 2025 +0300 serial: 8250_ce4100: Fix CONFIG_SERIAL_8250=n build On i386, when CONFIG_X86_INTEL_CE=y # CONFIG_SERIAL_8250 is not set it will try to compile the driver and use the stub simultaneously. This breaks the build. Fix it by making sure that the driver compiles only when CONFIG_SERIAL_8250 is also enabled. On top of that ensure that CONFIG_SERIAL_8250 is actually set to 'y' and not 'm' as the later makes no sense for this platform. The hook may only be applied during early boot. Fixes: acc902de05b2 ("serial: 8250: Move CE4100 quirks to a module under 8250 driver") Fixes: 5ec6960f6f0c ("ce4100: Add errata fixes for UART on CE4100") Reported-by: Randy Dunlap Closes: https://lore.kernel.org/r/cdf4ee46-7bf8-4379-9245-fed9db72e7e8@infradead.org Signed-off-by: Andy Shevchenko Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20250716142412.1667927-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 1e1bf8bf4e2043dfcb5b73afd4f6c21dd3db73e2 Merge: 241a3be4775651 a7d7aebed4005b Author: Arnd Bergmann Date: Mon Jul 21 17:36:27 2025 +0200 Merge tag 'samsung-defconfig-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/defconfig Samsung SoC defconfig changes for v6.17 1. Multiple SoCs (including Samsung, Apple): switch sound to module from a built-in, because it is not necessary for booting. Also drop redundant sound codec options. 2. Enable PMIC drivers for Google GS101 Pixel 6 phones: MAX77759 and Samsung PMIC over ACPM protocol. * tag 'samsung-defconfig-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: defconfig: enable Samsung PMIC over ACPM arm64: defconfig: enable Maxim max77759 driver arm64: defconfig: Drop unneeded unselectable sound drivers arm64: defconfig: Switch SOUND to module Link: https://lore.kernel.org/r/20250709191523.171359-4-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 76f3ffeb41d8700c22005211521bf692f2551668 Author: Sasha Finkelstein Date: Thu Jul 10 00:21:45 2025 +0200 arm64: dts: apple: Add Apple SoC GPU Add device tree entries for GPUs in M-series SoCs Reviewed-by: Alyssa Rosenzweig Reviewed-by: Sven Peter Signed-off-by: Sasha Finkelstein Link: https://lore.kernel.org/r/20250710-sgx-dt-v3-2-299bb3a65109@gmail.com Signed-off-by: Sven Peter commit f8c667edaf80a9ed91e730b9f106923119904c87 Author: Sasha Finkelstein Date: Thu Jul 10 00:21:44 2025 +0200 dt-bindings: gpu: Add Apple SoC GPU Add bindings for the GPU present in Apple SoCs Reviewed-by: Rob Herring (Arm) Reviewed-by: Sven Peter Signed-off-by: Sasha Finkelstein Link: https://lore.kernel.org/r/20250710-sgx-dt-v3-1-299bb3a65109@gmail.com Signed-off-by: Sven Peter commit ef68a0e1087882850628000f28078e1c4df917ee Author: Nick Chan Date: Fri Jun 20 18:35:36 2025 +0800 arm64: dts: apple: t8012-j132: Include touchbar framebuffer node Apple T2 MacBookPro15,2 (j132) has a touchbar so include the framebuffer node. Cc: stable@vger.kernel.org Fixes: 4efbcb623e9bc ("arm64: dts: apple: Add T2 devices") Signed-off-by: Nick Chan Link: https://lore.kernel.org/stable/20250620-j132-fb-v1-1-bc6937baf0b9%40gmail.com Link: https://lore.kernel.org/r/20250620-j132-fb-v2-1-65f100182085@gmail.com Signed-off-by: Sven Peter commit 6aaf36bb07057e7c97df7e64ed2cfe4bd56f3e6a Author: Sven Peter Date: Tue Jun 10 17:17:35 2025 +0000 arm64: dts: apple: Add bit offset to PMIC NVMEM node names Now that the dt-binding has been extended to allow indicating the bit position the following warning about a duplicate unit address with W=1 can be fixed: arch/arm64/boot/dts/apple/t8103.dtsi:764.46-767.8: Warning (unique_unit_address_if_enabled): /soc/spmi@23d0d9300/pmic@f/nvmem-layout/boot-error-count@9f02: duplicate unit-address (also used in node /soc/spmi@23d0d9300/pmic@f/nvmem-layout/panic-count@9f02) Fixes: d8bf82081c9e ("arm64: dts: apple: Add PMIC NVMEM") Link: https://lore.kernel.org/r/20250610-nvmem-bit-pattern-v1-2-55ed5c1b369c@kernel.org Signed-off-by: Sven Peter commit c5b9bff35a9823c4dd803f0eda3b34be88bbcded Merge: 63e9bb0d6e03f5 46f89a0d154312 Author: Arnd Bergmann Date: Mon Jul 21 17:15:45 2025 +0200 Merge branch 'newsoc/cix-p1' into soc/newsoc Patches from Peter Chen : Cixtech P1 (internal name sky1) is high performance generic Armv9 SoC. Orion O6 is the Arm V9 Motherboard built by Radxa. You could find brief introduction for SoC and related boards at: https://radxa.com/products/orion/o6#overview Currently, to run upstream kernel at Orion O6 board, you need to use BIOS released by Radxa, and add "clk_ignore_unused=1" at bootargs. https://docs.radxa.com/en/orion/o6/bios/install-bios In this series, we add initial SoC and board support for Kernel building. Since mailbox is used for SCMI clock communication, mailbox driver is added in this series for the minimum SoC support. Patch 1-2: add dt-binding doc for CIX and its sky1 SoC Patch 3: add Arm64 build support Patch 4-5: add CIX mailbox driver which needs to support SCMI clock protocol. Patch 6: add Arm64 defconfig support Patch 7-8: add initial dts support for SoC and Orion O6 board Patch 9: add MAINTAINERS entry * newsoc/cix-p1: MAINTAINERS: Add CIX SoC maintainer entry arm64: dts: cix: Add sky1 base dts initial support dt-bindings: clock: cix: Add CIX sky1 scmi clock id arm64: defconfig: Enable CIX SoC mailbox: add CIX mailbox driver dt-bindings: mailbox: add cix,sky1-mbox arm64: Kconfig: add ARCH_CIX for cix silicons dt-bindings: arm: add CIX P1 (SKY1) SoC dt-bindings: vendor-prefixes: Add CIX Technology Group Co., Ltd. Signed-off-by: Arnd Bergmann commit 46f89a0d154312673d5d6045282eb1a7015b1037 Author: Peter Chen Date: Mon Jul 21 22:45:00 2025 +0800 MAINTAINERS: Add CIX SoC maintainer entry Using this entry as the maintainers information for CIX SoCs. Reviewed-by: Krzysztof Kozlowski Acked-by: Fugang Duan Signed-off-by: Peter Chen Signed-off-by: Arnd Bergmann commit 80be23bb20eab1a89cf585b3bdee0e257d23f5e0 Author: Peter Chen Date: Mon Jul 21 22:44:59 2025 +0800 arm64: dts: cix: Add sky1 base dts initial support CIX SKY1 SoC is high performance Armv9 SoC designed by Cixtech, and Orion O6 is the motherboard launched by Radxa. See below for detail: https://docs.radxa.com/en/orion/o6/getting-started/introduction In this commit, it only adds limited components for running initramfs at Orion O6. Reviewed-by: Krzysztof Kozlowski Tested-by: Enric Balletbo i Serra Tested-by: Kajetan Puchalski Signed-off-by: Peter Chen Signed-off-by: Guomin Chen Signed-off-by: Gary Yang Signed-off-by: Arnd Bergmann commit 2b752ae0231f7b20cd2b8cad0b4ab36b16d4be88 Author: Gary Yang Date: Mon Jul 21 22:44:58 2025 +0800 dt-bindings: clock: cix: Add CIX sky1 scmi clock id Add device tree bindings for the scmi clock id on Cix sky1 platform. Acked-by: Krzysztof Kozlowski Reviewed-by: Peter Chen Signed-off-by: Gary Yang Signed-off-by: Peter Chen Signed-off-by: Arnd Bergmann commit 4cd122a4f642ab624257c2f92a6eddc4306213b4 Author: Peter Chen Date: Mon Jul 21 22:44:57 2025 +0800 arm64: defconfig: Enable CIX SoC - Enable CIX SoC support at ARM64 defconfig - Enable CIX mailbox At CIX SoC platforms, the clock handling uses Arm SCMI protocol, the physical clock access is at sub processor, so it needs to enable mailbox by default. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Peter Chen Signed-off-by: Arnd Bergmann commit fe2aa2361ddba8f4ccf05123e0e14e9fb70ea701 Author: Guomin Chen Date: Mon Jul 21 22:44:56 2025 +0800 mailbox: add CIX mailbox driver The CIX mailbox controller, used in the Cix SoCs, like sky1. facilitates message transmission between multiple processors within the SoC, such as the AP, PM, audio DSP, SensorHub MCU, and others. Acked-by: Jassi Brar Reviewed-by: Peter Chen Signed-off-by: Guomin Chen Signed-off-by: Gary Yang Signed-off-by: Lihua Liu Signed-off-by: Peter Chen Signed-off-by: Arnd Bergmann commit 621d7d081d18fce44ee431df1d054c8865b96ed8 Author: Guomin Chen Date: Mon Jul 21 22:44:55 2025 +0800 dt-bindings: mailbox: add cix,sky1-mbox Add a dt-binding for the Cixtech Mailbox Controller. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Peter Chen Signed-off-by: Guomin Chen Signed-off-by: Lihua Liu Signed-off-by: Peter Chen Signed-off-by: Arnd Bergmann commit aa4bc2850e671cc71081f637dd6db1faca8adac7 Author: Fugang Duan Date: Mon Jul 21 22:44:54 2025 +0800 arm64: Kconfig: add ARCH_CIX for cix silicons Add ARCH_CIX for CIX SoC series support. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Fugang Duan Signed-off-by: Peter Chen Signed-off-by: Arnd Bergmann commit 69563d502c5a2167bffebb52aba159ab57b76d3d Author: Peter Chen Date: Mon Jul 21 22:44:53 2025 +0800 dt-bindings: arm: add CIX P1 (SKY1) SoC Add device tree bindings for CIX P1 (Internal name sky1) Arm SoC, it consists several SoC models like CP8180, CD8180, etc. Reviewed-by: Krzysztof Kozlowski Acked-by: Fugang Duan Signed-off-by: Peter Chen Signed-off-by: Arnd Bergmann commit 960dda6eca2b771d1b243c13ab81bd42649b9ac4 Author: Peter Chen Date: Mon Jul 21 22:44:52 2025 +0800 dt-bindings: vendor-prefixes: Add CIX Technology Group Co., Ltd. CIX Technology Group Co., Ltd. is a high performance Arm SoC design company. Link: https://www.cixtech.com/. Acked-by: Krzysztof Kozlowski Acked-by: Fugang Duan Signed-off-by: Peter Chen Signed-off-by: Arnd Bergmann commit 313bf5b79ed1e218b8b793bb297e5d24bdeed0cc Author: Shankari Anand Date: Tue Jun 24 20:55:45 2025 +0530 fs: orangefs: replace scnprintf() with sysfs_emit() Documentation/filesystems/sysfs.rst mentions that show() should only use sysfs_emit() or sysfs_emit_at() when formating the value to be returned to user space. So replace scnprintf() with sysfs_emit(). Signed-off-by: Shankari Anand Signed-off-by: Mike Marshall commit 63e9bb0d6e03f59ff89d71f890a580c27b873ad2 Merge: 9cf8d2b8a0764a bf40c1a5b9561b Author: Arnd Bergmann Date: Mon Jul 21 17:12:44 2025 +0200 Merge branch 'newsoc/andes' into soc/newsoc Patches from Ben Zong-You Xie : The Voyager is a 9.6” x 9.6” Micro ATX form factor development board including Andes QiLai SoC. This patch series adds minimal device tree files for the QiLai SoC and the Voyager board [1]. Now only support basic uart drivers to boot up into a basic console. Other features will be added later. [1] https://www.andestech.com/en/products-solutions/andeshape-platforms/qilai-chip/ [2] https://lore.kernel.org/all/20250602060747.689824-1-ben717@andestech.com/ * newsoc/andes: MAINTAINERS: Add entry for Andes SoC riscv: defconfig: enable Andes SoC riscv: dts: andes: add Voyager board device tree riscv: dts: andes: add QiLai SoC device tree dt-bindings: timer: add Andes machine timer dt-bindings: interrupt-controller: add Andes machine-level software interrupt controller dt-bindings: interrupt-controller: add Andes QiLai PLIC dt-bindings: riscv: add Andes QiLai SoC and the Voyager board bindings riscv: add Andes SoC family Kconfig support commit cdfa1304657d6f23be8fd2bb0516380a3c89034e Author: Amir Mohammad Jahangirzad Date: Sun Jun 8 20:05:59 2025 +0330 fs/orangefs: use snprintf() instead of sprintf() sprintf() is discouraged for use with bounded destination buffers as it does not prevent buffer overflows when the formatted output exceeds the destination buffer size. snprintf() is a safer alternative as it limits the number of bytes written and ensures NUL-termination. Replace sprintf() with snprintf() for copying the debug string into a temporary buffer, using ORANGEFS_MAX_DEBUG_STRING_LEN as the maximum size to ensure safe formatting and prevent memory corruption in edge cases. EDIT: After this patch sat on linux-next for a few days, Dan Carpenter saw it and suggested that I use scnprintf instead of snprintf. I made the change and retested. Signed-off-by: Amir Mohammad Jahangirzad Signed-off-by: Mike Marshall commit d436d1d5edb3068cb8c9023e129008a5dc50e7a0 Merge: a6942926a3fabd a9b906f15995e1 Author: Arnd Bergmann Date: Mon Jul 21 17:07:30 2025 +0200 Merge tag 'mtk-dts64-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt MediaTek ARM64 DeviceTree updates for v6.17 This adds new machines and improves support for already supported MediaTek SoCs. In particular: - New machine: MT8186 Steelix Squirtle Chromebook - Steelix-Voltorb's two dts are merged in one ...and improvements for already supported SoCs and machines: - Added reserved memory for AFE DMA for MT8173/83/86/92, aligning audio related memory allocation between all of the Chromebook SoCs - Added second source components for Steelix, and marked the multiple trackpads for Asurada as such - MediaTek Genio 1200: Enabled support for the Audio DSP and sound - MediaTek Genio 510/700/1200: Added support for the PMIC Keys - MediaTek MT7988: Added Cache Coherent Interconnect for CPU DVFS - MT7988A-BananaPi-R4: Enabled CCI, added GPIO LEDs - Airoha EN7581: Added ethernet nodes to Evaluation Board * tag 'mtk-dts64-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: arm64: dts: mediatek: mt8395-genio-1200-evk: Add MT6359 PMIC key support arm64: dts: mediatek: mt8390-genio-common: Add Home MT6359 PMIC key support arm64: dts: mediatek: mt7988a-bpi-r4: add gpio leds arm64: dts: mediatek: mt7988a-bpi-r4: drop unused pins arm64: dts: mediatek: mt7988a-bpi-r4: add proc-supply for cci arm64: dts: mediatek: mt7988: add cci node dt-bindings: interconnect: add mt7988-cci compatible arm64: dts: airoha: en7581: Add ethernet nodes to EN7581 SoC evaluation board arm64: dts: mediatek: mt8192-asurada-spherion: Mark trackpads as fail-needs-probe arm64: dts: mediatek: mt8186: Add Squirtle Chromebooks arm64: dts: mediatek: mt8186: Merge Voltorb device trees arm64: dts: mediatek: mt8186-steelix: Mark second source components for probing dt-bindings: arm: mediatek: Add MT8186 Squirtle Chromebooks dt-bindings: arm: mediatek: Merge MT8186 Voltorb entries arm64: dts: mediatek: mt8395-genio-1200-evk: Enable Audio DSP and sound card arm64: dts: mediatek: mt8192-asurada: Reserve memory for audio frontend arm64: dts: mediatek: mt8186-corsola: Reserve memory for audio frontend arm64: dts: mediatek: mt8183-kukui: Reserve memory for audio frontend arm64: dts: mediatek: mt8173: Reserve memory for audio frontend Link: https://lore.kernel.org/r/20250711083656.33538-3-angelogioacchino.delregno@collabora.com Signed-off-by: Arnd Bergmann commit a6942926a3fabd964a22a9d9e401788f5f4c27b7 Merge: 5a793f891afa0e 5a8e7b4eaaa232 Author: Arnd Bergmann Date: Mon Jul 21 17:06:24 2025 +0200 Merge tag 'mtk-dts32-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt MediaTek mach ARM32 updates This adds support for the MediaTek MT6572 SoC, found in various old smartphones and tablets from various manufacturers. In particular, this adds a board_dt_compat entry for this SoC and its SMP bring up sequence to enable secondary cores. * tag 'mtk-dts32-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: ARM: dts: mediatek: add basic support for Lenovo A369i board ARM: dts: mediatek: add basic support for JTY D101 board ARM: dts: mediatek: add basic support for MT6572 SoC dt-bindings: arm: mediatek: add boards based on the MT6572 SoC dt-bindings: vendor-prefixes: add JTY dt-bindings: watchdog: mediatek,mtk-wdt: add MT6572 dt-bindings: interrupt-controller: mediatek,mt6577-sysirq: add MT6572 Link: https://lore.kernel.org/r/20250711083656.33538-2-angelogioacchino.delregno@collabora.com Signed-off-by: Arnd Bergmann commit 5a793f891afa0eb5b8fe9fa1cb695de4ae138cae Merge: 96a96de2cc79b9 a3a4be32b69c99 Author: Arnd Bergmann Date: Mon Jul 21 17:05:46 2025 +0200 Merge tag 'omap-for-v6.17/dt-signed' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/dt arm: dts: OMAP updates for v6.17 - new board support: Seeed BeagleBone Green Eco - misc. fixups / cleanups * tag 'omap-for-v6.17/dt-signed' of https://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: arm: dts: ti: omap: Fixup pinheader typo ARM: dts: am335x-pdu001: Fix RS-485 transceiver switching arm: dts: omap: Add support for BeagleBone Green Eco board dt-bindings: omap: Add Seeed BeagleBone Green Eco arm: dts: omap: am335x-bone-common: Rename tps to generic pmic node Revert "ARM: dts: Update pcie ranges for dra7" ARM: dts: omap: am335x: Use non-deprecated rts-gpios Link: https://lore.kernel.org/r/7h7c0gxczy.fsf@baylibre.com Signed-off-by: Arnd Bergmann commit 17882721dcb49323eaa9728d7eaa2ae826c876f7 Author: Shuming Fan Date: Mon Jul 21 19:23:46 2025 +0800 ASoC: SDCA: add route by the number of input pins in MU entity This patch removed the code where num_sources should be the same as cn_list. For better resilience, it would be preferable to explicitly add the route mapping the input pins to this MU entity. Signed-off-by: Shuming Fan Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20250721112346.388542-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 96a96de2cc79b97b277ede44d0ac4258ad84ff65 Merge: 4340c8d32af215 1a32f7427eb3d1 Author: Arnd Bergmann Date: Mon Jul 21 17:04:38 2025 +0200 Merge tag 'stm32-dt-for-v6.17-1' of https://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt STM32 DT for v6.17, round 1 Highlights: ---------- - MPU: - STM32MP13: -Add Ethernet MAC adress efuse support. - STMP32MP15: - Add stm32mp157f-DK2 board support. This board embedds the same conectivity devices, DDR ... than stm32mp157c-dk2. However there are two differences: STM32MP157F SoC which allows overdrive OPP and the SCMI support for system features like clocks and regulators. - STM32MP25: - Fix tick timer for low power use cases. - Add timer support. * tag 'stm32-dt-for-v6.17-1' of https://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: arm64: dts: st: remove empty line in stm32mp251.dtsi arm64: dts: st: fix timer used for ticks arm64: defconfig: Enable STM32 Octo Memory Manager and OcstoSPI driver ARM: dts: stm32: add stm32mp157f-dk2 board support dt-bindings: arm: stm32: add STM32MP157F-DK2 board compatible ARM: dts: stm32: optee async notif interrupt for MP15 scmi variants ARM: dts: stm32: use internal regulators bindings for MP15 scmi variants dt-bindings: regulator: Add STM32MP15 SCMI regulator identifiers ARM: dts: stm32: use 'typec' generic name for stusb1600 on stm32mp15xx-dkx ARM: dts: stm32: fullfill diversity with OPP for STM32M15xF SOCs ARM: dts: stm32: add system-clock-direction-out on stm32mp15xx-dkx arm64: defconfig: enable STM32 timers drivers arm64: dts: st: add timer nodes on stm32mp257f-ev1 arm64: dts: st: add timer pins for stm32mp257f-ev1 arm64: dts: st: add timer nodes on stm32mp251 ARM: dts: stm32: Add nvmem-cells to ethernet nodes for constant mac-addresses Link: https://lore.kernel.org/r/b3e3363b-1ea5-457c-b244-2cbe26f7d6e4@foss.st.com Signed-off-by: Arnd Bergmann commit 4340c8d32af2158279f4e033466f470d6c01362c Merge: 8e7e63fc479af4 6e3071f4e03997 Author: Arnd Bergmann Date: Mon Jul 21 17:03:14 2025 +0200 Merge tag 'v6.17-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt New boards: ROC-RK3588S-PC, Luckfox Omni3576, Radxa Rock 5T, Sakura Pi RK3308B - all of them have the used soc in their name. New overlays: RockPro64 screen, optional Sige5 Wifi/BT module, ethernet-switch addon for Jaguar. Added peripherals on rk3528 (spi, power-domain controller, gpu) and sdio controller on rk3576. DSI display support for the Gameforce-ACE handheld, a fix for the cover-detection (closed/open) on the PineNote, camera support for the Haikou Video Demo overlay on PX30 Ringneck as well as a number of other newly enabled peripherals on a number of boards. * tag 'v6.17-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip: (40 commits) arm64: dts: rockchip: Enable eMMC HS200 mode on Radxa E20C arm64: dts: rockchip: Add bluetooth support to ArmSoM Sige7 arm64: dts: rockchip: enable PCIe on ROCK 4D arm64: dts: rockchip: Enable HDMI receiver on CM3588 arm64: dts: rockchip: Add HDMI PHY PLL clock source to VOP2 on rk3576 arm64: dts: rockchip: Enable HDMI PHY clk provider on rk3576 arm64: dts: rockchip: add DTs for Firefly ROC-RK3588S-PC dt-bindings: arm: rockchip: Add Firefly ROC-RK3588S-PC arm64: dts: rockchip: Enable GPU on Radxa E20C arm64: dts: rockchip: Add GPU node for RK3528 arm64: dts: rockchip: support camera module on Haikou Video Demo on PX30 Ringneck arm64: dts: rockchip: add label to first port of ISP on px30 arm64: dts: rockchip: fix endpoint dtc warning for PX30 ISP arm64: dts: rockchip: Add power controller for RK3528 arm64: dts: rockchip: enable USB on Sige5 arm64: dts: rockchip: add overlay for the WiFi/BT module on Sige5 v1.2 arm64: dts: rockchip: add version-independent WiFi/BT nodes on Sige5 arm64: dts: rockchip: add SDIO controller on RK3576 arm64: dts: rockchip: Enable gpu on rk3576-evb1-v10 arm64: dts: rockchip: Update the PinePhone Pro panel description ... Link: https://lore.kernel.org/r/15465458.uLZWGnKmhe@phil Signed-off-by: Arnd Bergmann commit 8e7e63fc479af47449ef69d81f4dc4f3875b8e21 Author: Rob Herring (Arm) Date: Thu Jul 10 12:39:38 2025 +0930 arm64: dts: nuvoton: npcm8xx: Drop the GIC "ppi-partitions" node The Arm GIC "ppi-partitions" node is only relevant to GICv3 and makes no sense for GICv2 implementations which the GIC-400 is. PPIs in GICv2 have no CPU affinity. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250609203721.2852879-1-robh@kernel.org Signed-off-by: Andrew Jeffery Link: https://lore.kernel.org/r/20250710-nuvoton-arm64-dt-v1-1-ec7db96ea507@codeconstruct.com.au Signed-off-by: Arnd Bergmann commit 9a5a531d1cb8796243fbbaf35cff1d2ea8d72c3a Merge: 31e91dfc7fba0b 1c15e359ba53b2 Author: Arnd Bergmann Date: Mon Jul 21 17:01:43 2025 +0200 Merge tag 'aspeed-6.17-devicetree-1' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt ASPEED devicetree updates for 6.17 Removed platforms: - IBM's Swift BMC New platforms: - Meta's Santabarbara Santabarbara is a compute node with an accelerator module - NVIDIA's GB200NVL BMC NVIDIA GB200 NVL72 connects 36 Grace CPUs and 72 Blackwell GPUs in an NVIDIA NVLink-connected, liquid-cooled, rack-scale design. Updated BMC platforms: - Bletchley (Meta): GPIO hog names, remove ethernet-phy node, USB PD negotiation - Catalina (Meta): Various sensors added, MCTP support for NIC management - Harma (Meta): Various sensors added - System1 (IBM): IPMB and various GPIO-related updates - Yosemite4 (Meta): GPIO names for UART mux select lines The System1 series includes a devicetree binding patch for IPMI IPMB devices. * tag 'aspeed-6.17-devicetree-1' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: (34 commits) ARM: dts: aspeed: yosemite4: add gpio name for uart mux sel ARM: dts: aspeed: santabarbara: Add Meta Santabarbara BMC dt-bindings: arm: aspeed: add Meta Santabarbara board ARM: dts: aspeed: bletchley: enable USB PD negotiation ARM: dts: aspeed: lanyang: Fix 'lable' typo in LED nodes ARM: dts: aspeed: harma: add mmc health ARM: dts: aspeed: Harma: revise gpio bride pin for battery ARM: dts: aspeed: harma: add ADC128D818 for voltage monitoring ARM: dts: aspeed: harma: add fan board I/O expander ARM: dts: aspeed: harma: add E1.S power monitor ARM: dts: aspeed: catalina: Enable MCTP for frontend NIC management ARM: dts: aspeed: Add device tree for Nvidia's GB200NVL BMC dt-bindings: arm: aspeed: add Nvidia's GB200NVL BMC ARM: dts: aspeed: catalina: Enable MCTP support for NIC management ARM: dts: aspeed: catalina: Update CBC FRU EEPROM I2C bus and address ARM: dts: aspeed: catalina: Enable multi-master on additional I2C buses ARM: dts: aspeed: catalina: Remove INA238 and INA230 nodes ARM: dts: aspeed: catalina: Add second source HSC node support ARM: dts: aspeed: catalina: Add second source fan controller support ARM: dts: aspeed: catalina: Add fan controller support ... Link: https://lore.kernel.org/r/36d50489cac1fbae01ec699b742f6c6c459a01cb.camel@codeconstruct.com.au Signed-off-by: Arnd Bergmann commit 31e91dfc7fba0bd6d27358865a05a878145469d7 Merge: c9d40ba73727b1 145a2a9e275629 Author: Arnd Bergmann Date: Mon Jul 21 17:00:32 2025 +0200 Merge tag 'renesas-dts-for-v6.17-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.17 (take two) - Add support for the Renesas Gray Hawk Single board with R-Car V4M-7 (R8A779H2), - Add eMMC and microSD expansion board support for the RZ/V2H and RZ/V2N EVK development boards, - Add GPIO keys and Ethernet support for the RZ/G3E SoM and SMARC Carrier-II EVK development board, - Add QSPI FLASH support for the RZ/V2H and RZ/V2N SoCs and their EVK development boards, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v6.17-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable serial NOR FLASH arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable serial NOR FLASH arm64: dts: renesas: r9a09g057: Add XSPI node arm64: dts: renesas: r9a09g056: Add XSPI node arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Fix pinctrl node name for GBETH1 arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Fix pinctrl node name for GBETH1 arm64: dts: renesas: r8a779g3-sparrow-hawk-fan-pwm: Add missing install target arm64: dts: renesas: rzg3e-smarc-som: Enable eth{0-1} (GBETH) interfaces arm64: dts: renesas: r9a09g047e57-smarc: Add gpio keys arm64: dts: renesas: Add CN15 eMMC and SD overlays for RZ/V2H and RZ/V2N EVKs arm64: dts: renesas: r8a779h2: Add Gray Hawk Single support arm64: dts: renesas: Add Renesas R8A779H2 SoC support arm64: dts: renesas: Factor out Gray Hawk Single board support dt-bindings: clock: renesas,r9a09g056/57-cpg: Add XSPI core clock Link: https://lore.kernel.org/r/cover.1752090401.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit c9d40ba73727b10fa88452ed3472b5751a95bd0b Merge: e65761ff6b7937 f2ce1fd2d991c5 Author: Arnd Bergmann Date: Mon Jul 21 17:00:03 2025 +0200 Merge tag 'renesas-dt-bindings-for-v6.17-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DT binding updates for v6.17 (take two) - Document support for the Renesas Gray Hawk Single board with R-Car V4M-7 (R8A779H2). * tag 'renesas-dt-bindings-for-v6.17-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: dt-bindings: soc: renesas: Document R-Car V4M-7 Gray Hawk Single Link: https://lore.kernel.org/r/cover.1752090400.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit e65761ff6b7937b9d5e0677fea937fac36dcdeee Merge: ad6d5af8bb0195 49a27c6c392dec Author: Arnd Bergmann Date: Mon Jul 21 16:59:37 2025 +0200 Merge tag 'samsung-dt64-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v6.17 1. New SoC - Exynos2200 SoC - with basic nodes, pin controllers, clock controllers and initial USB support. Add board using it: Samsung Galaxy S22+ (SM-S906B), called G0S. 2. ExynosAutov920: Add CMU_HSI2 clock controller, remaining SPI nodes 3. Google GS101: - Prepare to switching to architected timer, instead of Exynos MCT as the primary one. - Add secondary Maxim MAX77759 PMIC to Pixel boards, managing USB Type-C and charger. - Add incomplete description of the primary Samsung S2MPG10 PMIC. Several bits, like regulators, are still missing, though. - Add also secondary reboot-mode, via MAX77759 NVMEM. - Switch the primary (SoC) reboot handler to Google specific google,gs101-reboot which gives additional GS101 features (cold and warm reboots). This change will affect other users of this DTS, but to our knowledge there is only Android, from which this change originates. 4. Exynos7870: - Fix speed problems in USB gadget mode. - Correct memory map to avoid crashes due to secure world. * tag 'samsung-dt64-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: arm64: dts: exynos7870-j6lte: reduce memory ranges to base amount arm64: dts: exynos7870-on7xelte: reduce memory ranges to base amount arm64: dts: exynos7870: add quirk to disable USB2 LPM in gadget mode arm64: dts: exynos: gs101: switch to gs101 specific reboot arm64: dts: exynos: gs101-pixel-common: add main PMIC node arm64: dts: exynos: gs101: ufs: add dma-coherent property arm64: dts: exynos: gs101: add dm-verity-device-corrupted syscon-reboot-mode arm64: dts: exynos: gs101-pixel-common: add nvmem-reboot-mode arm64: dts: exynos: gs101-pixel-common: add Maxim MAX77759 PMIC arm64: dts: exynos5433: Align i2c-gpio node names with dtschema arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes arm64: dts: exynosautov920: Add DT node for all SPI ports arm64: dts: exynosautov920: add CMU_HSI2 clock DT nodes MAINTAINERS: add entry for Samsung Exynos2200 SoC arm64: dts: exynos: add initial support for Samsung Galaxy S22+ arm64: dts: exynos: add initial support for exynos2200 SoC dt-bindings: arm: samsung: document g0s board binding Link: https://lore.kernel.org/r/20250709191523.171359-6-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit ad6d5af8bb0195e18895f4fd2c6cb82437065f9d Merge: 43af11e1923e3c a24cd2f207efa7 Author: Arnd Bergmann Date: Mon Jul 21 16:59:03 2025 +0200 Merge tag 'samsung-dt-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM changes for v6.17 Just few cleanups based on dtbs_check. * tag 'samsung-dt-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: ARM: dts: s5pv210: Align i2c-gpio node names with dtschema ARM: dts: exynos: Align i2c-gpio node names with dtschema Link: https://lore.kernel.org/r/20250709191523.171359-5-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit 43af11e1923e3c37ef6a4cbeb4018e81ecc20aa2 Merge: 2ee49a6143b631 6cd594ed969d5c Author: Arnd Bergmann Date: Mon Jul 21 16:58:30 2025 +0200 Merge tag 'dt-vt8500-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt into soc/dt VT8500 DTS ARM changes for v6.17 1. Several dtbs_check cleanups. 2. Add missing cache topology - L2 cache controller on WM8850/WM895. * tag 'dt-vt8500-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-dt: ARM: dts: vt8500: Add L2 cache controller on WM8850/WM8950 ARM: dts: vt8500: Fix the unit address of the VT8500 LCD controller ARM: dts: vt8500: Use generic node name for the SD/MMC controller ARM: dts: vt8500: Move memory nodes to board dts and fix addr/size ARM: dts: vt8500: Add node address and reg in CPU nodes Link: https://lore.kernel.org/r/20250709184800.168462-2-krzysztof.kozlowski@linaro.org Signed-off-by: Arnd Bergmann commit aee4eeec7e5e598f0b7da65405d43f9941f965a5 Merge: 2b12a400dd94e1 e3ce7b89738833 Author: Arnd Bergmann Date: Mon Jul 21 16:56:47 2025 +0200 Merge tag 'arm-soc/for-6.17/drivers' of https://github.com/Broadcom/stblinux into soc/drivers This pull request contains Broadcom SoCs drivers updates for 6.17, please pull the following: - Andrea adds the RP1 clock, pinctrl/pinconf/gpio and misc driver to bind them all * tag 'arm-soc/for-6.17/drivers' of https://github.com/Broadcom/stblinux: pinctrl: rp1: Implement RaspberryPi RP1 pinmux/pinconf support misc: rp1: RaspberryPi RP1 misc driver pinctrl: rp1: Implement RaspberryPi RP1 gpio support clk: rp1: Add support for clocks provided by RP1 dt-bindings: clock: Add RaspberryPi RP1 clock bindings Link: https://lore.kernel.org/r/20250630190216.1518354-4-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit 2b12a400dd94e1f73097d60e043b4e90b64ec9e1 Merge: 983f3a8831add1 4a525d5d3150a3 Author: Arnd Bergmann Date: Mon Jul 21 16:56:11 2025 +0200 Merge tag 'arm-soc/for-6.17/maintainers' of https://github.com/Broadcom/stblinux into soc/drivers This pull request contains MAINTAINERS file updates for 6.17, please pull the following: - Andrea adds the RP1 entry for all of the drivers pertaining to that chip * tag 'arm-soc/for-6.17/maintainers' of https://github.com/Broadcom/stblinux: MAINTAINERS: add Raspberry Pi RP1 section Link: https://lore.kernel.org/r/20250630190216.1518354-5-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit bcbef1e4a626e093d4ead56593fb169eed5033c7 Merge: 103f5d8c35b3d2 89be9a83ccf1f8 Author: Greg Kroah-Hartman Date: Mon Jul 21 16:53:33 2025 +0200 Merge tag 'v6.16-rc7' into tty-next We need the tty/serial fixes in here as well. Signed-off-by: Greg Kroah-Hartman commit bf40c1a5b9561bef0c0d1df47bcfc0ceb26a6c8a Author: Ben Zong-You Xie Date: Fri Jul 11 21:30:25 2025 +0800 MAINTAINERS: Add entry for Andes SoC Add entry for Andes SoC maintainer and related files Signed-off-by: Ben Zong-You Xie Link: https://lore.kernel.org/r/20250711133025.2192404-10-ben717@andestech.com Signed-off-by: Arnd Bergmann commit ad087c91eb87bebd79f05a4c9b5cfbe72d6186fa Author: Ben Zong-You Xie Date: Fri Jul 11 21:30:24 2025 +0800 riscv: defconfig: enable Andes SoC Enable Andes SoC config in defconfig to allow the default upstream kernel to boot on Voyager board. Acked-by: Conor Dooley Signed-off-by: Ben Zong-You Xie Link: https://lore.kernel.org/r/20250711133025.2192404-9-ben717@andestech.com Signed-off-by: Arnd Bergmann commit 9d462f56db7a0fdb0c814b34a6f9bdd01ebc23f5 Author: Ben Zong-You Xie Date: Fri Jul 11 21:30:23 2025 +0800 riscv: dts: andes: add Voyager board device tree Introduce the device tree support for Voyager development board. Currently only support booting into console with only uart, other features will be added later. Signed-off-by: Ben Zong-You Xie Link: https://lore.kernel.org/r/20250711133025.2192404-8-ben717@andestech.com Signed-off-by: Arnd Bergmann commit 609496af55caff0e358bac901936b65b98900f92 Author: Ben Zong-You Xie Date: Fri Jul 11 21:30:22 2025 +0800 riscv: dts: andes: add QiLai SoC device tree Introduce the initial device tree support for the Andes QiLai SoC. For further information, you can refer to [1]. [1] https://www.andestech.com/en/products-solutions/andeshape-platforms/qilai-chip/ Signed-off-by: Ben Zong-You Xie Link: https://lore.kernel.org/r/20250711133025.2192404-7-ben717@andestech.com Signed-off-by: Arnd Bergmann commit 65bbf10b934ae17e1ce7a673355723eb806668ac Author: Ben Zong-You Xie Date: Fri Jul 11 21:30:21 2025 +0800 dt-bindings: timer: add Andes machine timer Add the DT binding documentation for Andes machine timer. The RISC-V architecture defines a machine timer that provides a real-time counter and generates timer interrupts. Andes machiner timer (PLMT0) is the implementation of the machine timer, and it contains memory-mapped registers (mtime and mtimecmp). This device supports up to 32 cores. Acked-by: Conor Dooley Signed-off-by: Ben Zong-You Xie Link: https://lore.kernel.org/r/20250711133025.2192404-6-ben717@andestech.com Signed-off-by: Arnd Bergmann commit 1f5ff8c363cf81e1b268108d1ed93b59b6a504f8 Author: Ben Zong-You Xie Date: Fri Jul 11 21:30:20 2025 +0800 dt-bindings: interrupt-controller: add Andes machine-level software interrupt controller Add the DT binding documentation for Andes machine-level software interrupt controller. In the Andes platform such as QiLai SoC, the PLIC module is instantiated a second time with all interrupt sources tied to zero as the software interrupt controller (PLICSW). PLICSW can generate machine-level software interrupts through programming its registers. Acked-by: Conor Dooley Signed-off-by: Ben Zong-You Xie Link: https://lore.kernel.org/r/20250711133025.2192404-5-ben717@andestech.com Signed-off-by: Arnd Bergmann commit 6eeee4fb1930a3863911cf3b620ec340c9227952 Author: Ben Zong-You Xie Date: Fri Jul 11 21:30:19 2025 +0800 dt-bindings: interrupt-controller: add Andes QiLai PLIC Add a new compatible string for Andes QiLai PLIC. Acked-by: Rob Herring (Arm) Reviewed-by: Lad Prabhakar Signed-off-by: Ben Zong-You Xie Link: https://lore.kernel.org/r/20250711133025.2192404-4-ben717@andestech.com Signed-off-by: Arnd Bergmann commit 12d8c15992c4396eeb4df53170cae41c9a1a441a Author: Ben Zong-You Xie Date: Fri Jul 11 21:30:18 2025 +0800 dt-bindings: riscv: add Andes QiLai SoC and the Voyager board bindings Add DT binding documentation for the Andes QiLai SoC and the Voyager development board. Reviewed-by: Rob Herring (Arm) Signed-off-by: Ben Zong-You Xie Link: https://lore.kernel.org/r/20250711133025.2192404-3-ben717@andestech.com Signed-off-by: Arnd Bergmann commit 00dba19aa005c8cff5694adeea996b0ce85808cf Author: Ben Zong-You Xie Date: Fri Jul 11 21:30:17 2025 +0800 riscv: add Andes SoC family Kconfig support The first SoC in the Andes series is QiLai. It includes a high-performance quad-core RISC-V AX45MP cluster and one NX27V vector processor. For further information, refer to [1]. [1] https://www.andestech.com/en/products-solutions/andeshape-platforms/qilai-chip/ Signed-off-by: Ben Zong-You Xie Link: https://lore.kernel.org/r/20250711133025.2192404-2-ben717@andestech.com Signed-off-by: Arnd Bergmann commit 983f3a8831add1d4a9445f247412c4fcee94afd0 Merge: ed82b8d6574fcd 331db44e70dacf Author: Arnd Bergmann Date: Mon Jul 21 16:49:43 2025 +0200 Merge tag 'mtk-soc-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers MediaTek soc driver updates for v6.17 This adds a single cleanup commit for the mtk-mutex driver, clarifying the usage of the MUTEX_MOD1, MUTEX_MOD2 registers for applying display controller sub-component mute settings on all MediaTek SoCs. * tag 'mtk-soc-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux: soc: mediatek: mtk-mutex: Fix confusing usage of MUTEX_MOD2 Link: https://lore.kernel.org/r/20250711083656.33538-4-angelogioacchino.delregno@collabora.com Signed-off-by: Arnd Bergmann commit ed82b8d6574fcde9d88059b3be84f27a1865c7ea Merge: d60b1224b90519 196dbace08243b Author: Arnd Bergmann Date: Mon Jul 21 16:48:32 2025 +0200 Merge tag 'reset-for-v6.17' of https://git.pengutronix.de/git/pza/linux into soc/drivers Reset controller updates for v6.17 * Support reset controllers on Kendryte K230 and SOPHGO CV1800B. * Add RZ/V2N USB2PHY reset controller bindings * Use auxiliary device creation helpers in reset-mpfs. * Convert nxp,lcp1850-rgu and snps,dw-reset binding docs to DT schema. * Enable reset-brcmstb(-rescal) on BCM2712. * Fix a typo in the T-HEAD TH1520 Kconfig option * tag 'reset-for-v6.17' of https://git.pengutronix.de/git/pza/linux: dt-bindings: reset: Convert snps,dw-reset to DT schema reset: brcmstb: Enable reset drivers for ARCH_BCM2835 reset: simple: add support for Sophgo CV1800B dt-bindings: reset: sophgo: Add CV1800B support reset: mpfs: use the auxiliary device creation dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/V2N SoC support dt-bindings: reset: convert nxp,lpc1850-rgu.txt to yaml format reset: thead: Fix TH1520 typo reset: canaan: add reset driver for Kendryte K230 dt-bindings: reset: add support for canaan,k230-rst Link: https://lore.kernel.org/r/20250710152513.1346298-1-p.zabel@pengutronix.de Signed-off-by: Arnd Bergmann commit 94fd4423036fc336d5211f112dc62a03b28ebba0 Author: Colin Ian King Date: Mon Jul 21 14:50:16 2025 +0100 ACPI: processor: throttling: Remove space before newline There is a extraneous space before a newline in a pr_warn message. Remove it. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250721135016.2500117-1-colin.i.king@gmail.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit d60b1224b905194466955080385ad3d8e707cfc5 Merge: 708109c46f475e 76760b9dbbf808 Author: Arnd Bergmann Date: Mon Jul 21 16:45:32 2025 +0200 Merge tag 'soc_fsl-6.17-1' of https://github.com/chleroy/linux into soc/drivers FSL SOC Changes for 6.17: - Use dev_fwnode() instead of of_fwnode_handle() - Use new GPIO line value setter callbacks * tag 'soc_fsl-6.17-1' of https://github.com/chleroy/linux: soc: Use dev_fwnode() soc: fsl: qe: use new GPIO line value setter callbacks Link: https://lore.kernel.org/r/c947d537-cae5-44f0-abd8-0c558bac46d2@csgroup.eu Signed-off-by: Arnd Bergmann commit 708109c46f475eca59e70d1293af8d3763ba9ce3 Merge: 404dcaa62651ca fdf003f30b99e2 Author: Arnd Bergmann Date: Mon Jul 21 16:44:48 2025 +0200 Merge tag 'aspeed-6.17-drivers-1' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/drivers ASPEED SoC driver updates for 6.17 The ASPEED LPC snoop driver was recently the cause of some concern. In addition to the initial fixes, the channel configuration paths are refactored to improve robustness against errors. * tag 'aspeed-6.17-drivers-1' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux: soc: aspeed: lpc-snoop: Lift channel config to const structs soc: aspeed: lpc-snoop: Consolidate channel initialisation soc: aspeed: lpc-snoop: Use dev_err_probe() where possible soc: aspeed: lpc-snoop: Switch to devm_clk_get_enabled() soc: aspeed: lpc-snoop: Rearrange channel paths soc: aspeed: lpc-snoop: Rename 'channel' to 'index' in channel paths soc: aspeed: lpc-snoop: Constrain parameters in channel paths soc: aspeed: lpc-snoop: Ensure model_data is valid soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled soc: aspeed: lpc-snoop: Cleanup resources in stack-order Link: https://lore.kernel.org/r/9123f151280e52c63dcb645cb07d4eee3462c067.camel@codeconstruct.com.au Signed-off-by: Arnd Bergmann commit 404dcaa62651caa0a3dc49fe70a73c27a734c5fc Merge: 753355d6200753 2d9f884ceae80a Author: Arnd Bergmann Date: Mon Jul 21 16:44:01 2025 +0200 Merge tag 'renesas-drivers-for-v6.17-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v6.17 (take two) - Sort Renesas Kconfig symbols. * tag 'renesas-drivers-for-v6.17-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: Sort Renesas Kconfig configs Link: https://lore.kernel.org/r/cover.1752090398.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 753355d6200753f4d8cb8db794339ad46d471d7d Merge: 7edf259b112708 62d6b81e8bd207 Author: Arnd Bergmann Date: Mon Jul 21 16:41:37 2025 +0200 Merge tag 'scmi-updates-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers Arm SCMI updates for v6.17 1. A fix is introduced to correct turbo frequency marking for 64-bit devices with sustained frequencies over 4GHz, ensuring accurate turbo frequency identification. 2. Debug capabilities are being improved by introducing in-flight transfer tracking using debug counters, which help diagnose transfer congestion and behavior. Additional tracepoints are added to log in-flight counts at transfer begin and end, offering better runtime insight. The debug counters now support decrement operations using a newly added scmi_dec_count helper, making counter tracking symmetric and more robust. 3. A race condition in suspend-resume logic is being resolved by ensuring SCMI_SYSPOWER_IDLE state is set early during resume, improving suspend reliability under certain conditions. New suspend and resume operations are added to the scmi_bus_type to enable finer power management control for SCMI-based devices. 4. Finally enhancements are also made to avoid registering notifiers for events that a platform does not support, reducing unnecessary overhead by checking for unsupported event types during protocolinitialization. * tag 'scmi-updates-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS firmware: arm_scmi: Avoid notifier registration for unsupported events firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume firmware: arm_scmi: Add power management operations to SCMI bus include: trace: Add tracepoint support for inflight xfer count firmware: arm_scmi: Track number of inflight SCMI transfers firmware: arm_scmi: Add support for debug counter decrement firmware: arm_scmi: Fix up turbo frequencies selection Link: https://lore.kernel.org/r/20250709122907.1171913-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 7edf259b11270846c201cfd6ebe12e2418dca9f0 Merge: 5f931b56848017 1733432638f323 Author: Arnd Bergmann Date: Mon Jul 21 16:40:13 2025 +0200 Merge tag 'smccc-updates-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers firmware: smccc: Update for v6.17 Just a single update extending arm_smccc_hypervisor_has_uuid() to support both SMC and HVC conduits, enabling UUID retrieval when Linux runs as the root partition under Microsoft Hypervisor (MSHV), where SMC is used. It leverages arm_smccc_1_1_invoke() to dynamically select the appropriate conduit, enhancing compatibility beyond just HVC. * tag 'smccc-updates-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: smccc: Support both smc and hvc conduits for getting hyp UUID Link: https://lore.kernel.org/r/20250709122615.1171419-1-sudeep.holla@arm.com Signed-off-by: Arnd Bergmann commit 69e536c93242425fc65580b02d3f781a96403660 Merge: 951a6d8d41289b d60f7cab7c0494 Author: Mark Brown Date: Mon Jul 21 15:39:07 2025 +0100 spidev: introduce trivial abb sensor device Merge series from Heiko Schocher : This series introduces the changes needed for trivial spi based sensors from ABB, currently operated from userspace. commit 5cc1f66cb23cccc704e3def27ad31ed479e934a5 Author: Eric Biggers Date: Sun Jul 20 22:01:36 2025 -0700 thunderbolt: Fix copy+paste error in match_service_id() The second instance of TBSVC_MATCH_PROTOCOL_VERSION seems to have been intended to be TBSVC_MATCH_PROTOCOL_REVISION. Fixes: d1ff70241a27 ("thunderbolt: Add support for XDomain discovery protocol") Cc: stable Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20250721050136.30004-1-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7616f006db07017ef5d4ae410fca99279aaca7aa Author: Myrrh Periwinkle Date: Mon Jul 21 13:32:51 2025 +0700 usb: typec: ucsi: Update power_supply on power role change The current power direction of an USB-C port also influences the power_supply's online status, so a power role change should also update the power_supply. Fixes an issue on some systems where plugging in a normal USB device in for the first time after a reboot will cause upower to erroneously consider the system to be connected to AC power. Cc: stable Fixes: 0e6371fbfba3 ("usb: typec: ucsi: Report power supply changes") Signed-off-by: Myrrh Periwinkle Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250721-fix-ucsi-pwr-dir-notify-v1-1-e53d5340cb38@qtmlabs.xyz Signed-off-by: Greg Kroah-Hartman commit af833e7f7db3cf4c82f063668e1b52297a30ec18 Author: Benson Leung Date: Thu Jul 17 20:08:05 2025 +0000 usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default ucsi_psy_get_current_max would return 0mA as the maximum current if UCSI detected a BC or a Default USB Power sporce. The comment in this function is true that we can't tell the difference between DCP/CDP or SDP chargers, but we can guarantee that at least 1-unit of USB 1.1/2.0 power is available, which is 100mA, which is a better fallback value than 0, which causes some userspaces, including the ChromeOS power manager, to regard this as a power source that is not providing any power. In reality, 100mA is guaranteed from all sources in these classes. Signed-off-by: Benson Leung Reviewed-by: Jameson Thies Reviewed-by: Heikki Krogerus Reviewed-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250717200805.3710473-1-bleung@chromium.org Signed-off-by: Greg Kroah-Hartman commit 1e61f6ab08786d66a11cfc51e13d6f08a6b06c56 Author: Sebastian Reichel Date: Fri Jul 4 19:55:06 2025 +0200 usb: typec: fusb302: cache PD RX state This patch fixes a race condition communication error, which ends up in PD hard resets when losing the race. Some systems, like the Radxa ROCK 5B are powered through USB-C without any backup power source and use a FUSB302 chip to do the PD negotiation. This means it is quite important to avoid hard resets, since that effectively kills the system's power-supply. I've found the following race condition while debugging unplanned power loss during booting the board every now and then: 1. lots of TCPM/FUSB302/PD initialization stuff 2. TCPM ends up in SNK_WAIT_CAPABILITIES (tcpm_set_pd_rx is enabled here) 3. the remote PD source does not send anything, so TCPM does a SOFT RESET 4. TCPM ends up in SNK_WAIT_CAPABILITIES for the second time (tcpm_set_pd_rx is enabled again, even though it is still on) At this point I've seen broken CRC good messages being send by the FUSB302 with a logic analyzer sniffing the CC lines. Also it looks like messages are being lost and things generally going haywire with one of the two sides doing a hard reset once a broken CRC good message was send to the bus. I think the system is running into a race condition, that the FIFOs are being cleared and/or the automatic good CRC message generation flag is being updated while a message is already arriving. Let's avoid this by caching the PD RX enabled state, as we have already processed anything in the FIFOs and are in a good state. As a side effect that this also optimizes I2C bus usage :) As far as I can tell the problem theoretically also exists when TCPM enters SNK_WAIT_CAPABILITIES the first time, but I believe this is less critical for the following reason: On devices like the ROCK 5B, which are powered through a TCPM backed USB-C port, the bootloader must have done some prior PD communication (initial communication must happen within 5 seconds after plugging the USB-C plug). This means the first time the kernel TCPM state machine reaches SNK_WAIT_CAPABILITIES, the remote side is not sending messages actively. On other devices a hard reset simply adds some extra delay and things should be good afterwards. Fixes: c034a43e72dda ("staging: typec: Fairchild FUSB302 Type-c chip driver") Cc: stable Signed-off-by: Sebastian Reichel Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250704-fusb302-race-condition-fix-v1-1-239012c0e27a@kernel.org Signed-off-by: Greg Kroah-Hartman commit a33665facf792de619e451bdbf66e86b9c6763bc Author: Arnd Bergmann Date: Thu Jul 17 15:30:41 2025 +0200 usb: typec: ucsi: yoga-c630: add DRM dependency Selecting DRM_AUX_HPD_BRIDGE is not possible from a built-in driver when CONFIG_DRM=m: WARNING: unmet direct dependencies detected for DRM_AUX_HPD_BRIDGE Depends on [m]: HAS_IOMEM [=y] && DRM [=m] && DRM_BRIDGE [=y] && OF [=y] Selected by [y]: - UCSI_LENOVO_YOGA_C630 [=y] && USB_SUPPORT [=y] && TYPEC [=y] && TYPEC_UCSI [=y] && EC_LENOVO_YOGA_C630 [=y] && DRM_BRIDGE [=y] && OF [=y] arm-linux-gnueabi-ld: drivers/gpu/drm/bridge/aux-hpd-bridge.o: in function `drm_aux_hpd_bridge_notify': aux-hpd-bridge.c:(.text.drm_aux_hpd_bridge_notify+0x28): undefined reference to `drm_bridge_hpd_notify' arm-linux-gnueabi-ld: drivers/gpu/drm/bridge/aux-hpd-bridge.o: in function `drm_aux_hpd_bridge_probe': aux-hpd-bridge.c:(.text.drm_aux_hpd_bridge_probe+0x20): undefined reference to `__devm_drm_bridge_alloc' Add a dependency to force UCSI_LENOVO_YOGA_C630 to be a loadable module as well in this configuration. Fixes: eb90d36bfa06 ("usb: typec: ucsi: yoga-c630: register DRM HPD bridge") Signed-off-by: Arnd Bergmann Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250717133045.991254-1-arnd@kernel.org Signed-off-by: Greg Kroah-Hartman commit 151c0aa896c47a4459e07fee7d4843f44c1bb18e Author: Tao Xue Date: Mon Jul 21 17:39:08 2025 +0800 usb: gadget : fix use-after-free in composite_dev_cleanup() 1. In func configfs_composite_bind() -> composite_os_desc_req_prepare(): if kmalloc fails, the pointer cdev->os_desc_req will be freed but not set to NULL. Then it will return a failure to the upper-level function. 2. in func configfs_composite_bind() -> composite_dev_cleanup(): it will checks whether cdev->os_desc_req is NULL. If it is not NULL, it will attempt to use it.This will lead to a use-after-free issue. BUG: KASAN: use-after-free in composite_dev_cleanup+0xf4/0x2c0 Read of size 8 at addr 0000004827837a00 by task init/1 CPU: 10 PID: 1 Comm: init Tainted: G O 5.10.97-oh #1 kasan_report+0x188/0x1cc __asan_load8+0xb4/0xbc composite_dev_cleanup+0xf4/0x2c0 configfs_composite_bind+0x210/0x7ac udc_bind_to_driver+0xb4/0x1ec usb_gadget_probe_driver+0xec/0x21c gadget_dev_desc_UDC_store+0x264/0x27c Fixes: 37a3a533429e ("usb: gadget: OS Feature Descriptors support") Cc: stable Signed-off-by: Tao Xue Link: https://lore.kernel.org/r/20250721093908.14967-1-xuetao09@huawei.com Signed-off-by: Greg Kroah-Hartman commit 82d8cc9542b8b6588a3c7c7e3db8936243163408 Author: Dan Carpenter Date: Wed Jul 16 17:46:26 2025 -0500 usb: chipidea: imx: Add a missing blank line Fix a checkpatch warning: CHECK: Please use a blank line after function/struct/union/enum declarations Reported-by: Xu Yang Acked-by: Peter Chen Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/36d1c961-319e-4457-bdc1-69f8b6bed33e@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman commit bb76f0d843a26d11bed5df2793b492ca414de0a4 Author: Sumanth Gavini Date: Fri Jul 18 12:50:35 2025 -0500 usb: gadget: f_uac1: replace scnprintf() with sysfs_emit() Documentation/filesystems/sysfs.rst mentions that show() should only use sysfs_emit() or sysfs_emit_at() when formating the value to be returned to user space. So replace scnprintf() with sysfs_emit(). Signed-off-by: Sumanth Gavini Link: https://lore.kernel.org/r/20250718175037.299710-1-sumanth.gavini@yahoo.com Signed-off-by: Greg Kroah-Hartman commit d8e1ecffb4a282791be1b3d81a05541749b0db64 Author: Darshan Rathod Date: Fri Jul 18 14:40:45 2025 +0530 usb: usblp: clean up assignment inside if conditions This patch cleans up a few cases where assignments were made inside of if conditions, like if ((rv = func()) < 0) into two lines, to improve readability and be more in-line with Linux kernel coding style. It also cleans up checkpatch warnings like: ERROR: do not use assignment in if condition No functional change, just a style and maintainability fix. Signed-off-by: Darshan Rathod Link: https://lore.kernel.org/r/20250718091045.264129-1-darshan.rathod@siqol.com Signed-off-by: Greg Kroah-Hartman commit 323a80a1a5ace319a722909c006d5bdb2a35d273 Author: Akash Kumar Date: Fri Jul 18 14:21:38 2025 +0530 usb: gadget: uvc: Initialize frame-based format color matching descriptor Fix NULL pointer crash in uvcg_framebased_make due to uninitialized color matching descriptor for frame-based format which was added in commit f5e7bdd34aca ("usb: gadget: uvc: Allow creating new color matching descriptors") that added handling for uncompressed and mjpeg format. Crash is seen when userspace configuration (via configfs) does not explicitly define the color matching descriptor. If color_matching is not found, config_group_find_item() returns NULL. The code then jumps to out_put_cm, where it calls config_item_put(color_matching);. If color_matching is NULL, this will dereference a null pointer, leading to a crash. [ 2.746440] Unable to handle kernel NULL pointer dereference at virtual address 000000000000008c [ 2.756273] Mem abort info: [ 2.760080] ESR = 0x0000000096000005 [ 2.764872] EC = 0x25: DABT (current EL), IL = 32 bits [ 2.771068] SET = 0, FnV = 0 [ 2.771069] EA = 0, S1PTW = 0 [ 2.771070] FSC = 0x05: level 1 translation fault [ 2.771071] Data abort info: [ 2.771072] ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000 [ 2.771073] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 2.771074] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 2.771075] user pgtable: 4k pages, 39-bit VAs, pgdp=00000000a3e59000 [ 2.771077] [000000000000008c] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 2.771081] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP [ 2.771084] Dumping ftrace buffer: [ 2.771085] (ftrace buffer empty) [ 2.771138] CPU: 7 PID: 486 Comm: ln Tainted: G W E 6.6.58-android15 [ 2.771139] Hardware name: Qualcomm Technologies, Inc. SunP QRD HDK (DT) [ 2.771140] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--) [ 2.771141] pc : __uvcg_fill_strm+0x198/0x2cc [ 2.771145] lr : __uvcg_iter_strm_cls+0xc8/0x17c [ 2.771146] sp : ffffffc08140bbb0 [ 2.771146] x29: ffffffc08140bbb0 x28: ffffff803bc81380 x27: ffffff8023bbd250 [ 2.771147] x26: ffffff8023bbd250 x25: ffffff803c361348 x24: ffffff803d8e6768 [ 2.771148] x23: 0000000000000004 x22: 0000000000000003 x21: ffffffc08140bc48 [ 2.771149] x20: 0000000000000000 x19: ffffffc08140bc48 x18: ffffffe9f8cf4a00 [ 2.771150] x17: 000000001bf64ec3 x16: 000000001bf64ec3 x15: ffffff8023bbd250 [ 2.771151] x14: 000000000000000f x13: 004c4b40000f4240 x12: 000a2c2a00051615 [ 2.771152] x11: 000000000000004f x10: ffffffe9f76b40ec x9 : ffffffe9f7e389d0 [ 2.771153] x8 : ffffff803d0d31ce x7 : 000f4240000a2c2a x6 : 0005161500028b0a [ 2.771154] x5 : ffffff803d0d31ce x4 : 0000000000000003 x3 : 0000000000000000 [ 2.771155] x2 : ffffffc08140bc50 x1 : ffffffc08140bc48 x0 : 0000000000000000 [ 2.771156] Call trace: [ 2.771157] __uvcg_fill_strm+0x198/0x2cc [ 2.771157] __uvcg_iter_strm_cls+0xc8/0x17c [ 2.771158] uvcg_streaming_class_allow_link+0x240/0x290 [ 2.771159] configfs_symlink+0x1f8/0x630 [ 2.771161] vfs_symlink+0x114/0x1a0 [ 2.771163] do_symlinkat+0x94/0x28c [ 2.771164] __arm64_sys_symlinkat+0x54/0x70 [ 2.771164] invoke_syscall+0x58/0x114 [ 2.771166] el0_svc_common+0x80/0xe0 [ 2.771168] do_el0_svc+0x1c/0x28 [ 2.771169] el0_svc+0x3c/0x70 [ 2.771172] el0t_64_sync_handler+0x68/0xbc [ 2.771173] el0t_64_sync+0x1a8/0x1ac Initialize color matching descriptor for frame-based format to prevent NULL pointer crash by mirroring the handling done for uncompressed and mjpeg formats. Fixes: 7b5a58952fc3 ("usb: gadget: uvc: configfs: Add frame-based frame format support") Cc: stable Signed-off-by: Akash Kumar Link: https://lore.kernel.org/r/20250718085138.1118788-1-quic_akakum@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 64690a90cd7c6db16d3af8616be1f4bf8d492850 Author: Oliver Neukum Date: Thu Jul 17 16:12:50 2025 +0200 cdc-acm: fix race between initial clearing halt and open On the devices that need their endpoints to get an initial clear_halt, this needs to be done before the devices can be opened. That means it needs to be before the devices are registered. Fixes: 15bf722e6f6c0 ("cdc-acm: Add support of ATOL FPrint fiscal printers") Cc: stable Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20250717141259.2345605-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 0156c22fb0ca869381fe0520731da79f70389652 Author: Stefan Binding Date: Mon Jul 21 14:54:05 2025 +0100 ALSA: hda/realtek: Add support for ASUS Commercial laptops using CS35L41 HDA Add support for ASUS PM3406CKA and PM3606CKA. Laptops use 2 CS35L41 Amps with HDA, using Internal boost, with I2C Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20250721135406.366912-1-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 5a9fffd8a533bfb2688ec69dd6d1b6e53ef1177a Author: Arnd Bergmann Date: Mon Jul 14 10:15:43 2025 +0200 platform/x86/intel/pmt: fix build dependency for kunit test When INTEL_PMT_TELEMETRY is in a loadable module, the discovery test cannot be built-in: x86_64-linux-ld: drivers/platform/x86/intel/pmt/discovery-kunit.o: in function `test_intel_pmt_get_regions_by_feature': discovery-kunit.c:(.text+0x29d): undefined reference to `intel_pmt_get_regions_by_feature' x86_64-linux-ld: discovery-kunit.c:(.text+0x2c3): undefined reference to `intel_pmt_put_feature_group' Add a Kconfig dependency to prevent this. Fixes: b9707d46a959 ("platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250714081559.4056777-1-arnd@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b5f20799f164053a0fbf7c61b3c99f8cf9cf0656 Merge: 6e38b9fcbfa305 e2967b50b70997 Author: Ilpo Järvinen Date: Mon Jul 21 16:37:27 2025 +0300 Merge branch 'fixes' into 'for-next' Merge the fixes branch into the for-next branch to resolve Makefile conflict and include the power supply accessor work that is required by the upcoming Uniwill driver. commit f2de2b9ffdc81a4d2713f8785332ae356d510d07 Author: Filipe Manana Date: Fri May 16 19:37:44 2025 +0100 btrfs: unfold transaction abort at clone_copy_inline_extent() We have a common error path where we abort the transaction, but like this in case we get a transaction abort stack trace we don't know exactly which previous function call failed. Instead abort the transaction after any function call that returns an error, so that we can easily identify which function failed. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5ff6050fcd3c5b8ca16beb058af81186ac6f67fb Author: Filipe Manana Date: Fri May 16 19:13:53 2025 +0100 btrfs: remove pointless 'out' label from clone_finish_inode_update() The label is only used once and we can instead return directly where it's used, besides the fact that all we do under the label is to return the value of 'ret'. So get rid of the label and return directly. Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 5cf0e668ea8a64b45918aee38f5602b9dbbc3e7e Author: Filipe Manana Date: Fri May 16 17:32:14 2025 +0100 btrfs: unfold transaction abort at walk_up_proc() Instead of having a common btrfs_abort_transaction() call for when any of the two btrfs_dec_ref() calls fail, move the btrfs_abort_transaction() to happen immediately after each one of the calls, so that when analysing a stack trace with a transaction abort we know which call failed. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 227aa55fa2bf4bb81f654c62cbcc6569854c1730 Author: Filipe Manana Date: Fri May 16 17:26:03 2025 +0100 btrfs: unfold transaction abort at __btrfs_inc_extent_ref() Instead of having a common btrfs_abort_transaction() call for when either insert_tree_block_ref() failed or when insert_extent_data_ref() failed, move the btrfs_abort_transaction() to happen immediately after each one of those calls, so that when analysing a stack trace with a transaction abort we know which call failed. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit 3f757b56f1c4579fe32b810bce1d39f202964412 Author: Filipe Manana Date: Fri May 16 17:07:40 2025 +0100 btrfs: unfold transaction aborts at btrfs_create_new_inode() Instead of having a common btrfs_abort_transaction() call for when either btrfs_orphan_add() failed or when btrfs_add_link() failed, move the btrfs_abort_transaction() to happen immediately after each one of those calls, so that when analysing a stack trace with a transaction abort we know which call failed. Reviewed-by: Boris Burkov Reviewed-by: Qu Wenruo Signed-off-by: Filipe Manana Reviewed-by: David Sterba Signed-off-by: David Sterba commit cee686775f9cd4eae31f3c1f7ec24b2048082667 Author: Lu Baolu Date: Mon Jul 21 13:16:57 2025 +0800 iommu/vt-d: Make iotlb_sync_map a static property of dmar_domain Commit 12724ce3fe1a ("iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes") dynamically set iotlb_sync_map. This causes synchronization issues due to lack of locking on map and attach paths, racing iommufd userspace operations. Invalidation changes must precede device attachment to ensure all flushes complete before hardware walks page tables, preventing coherence issues. Make domain->iotlb_sync_map static, set once during domain allocation. If an IOMMU requires iotlb_sync_map but the domain lacks it, attach is rejected. This won't reduce domain sharing: RWBF and shadowing page table caching are legacy uses with legacy hardware. Mixed configs (some IOMMUs in caching mode, others not) are unlikely in real-world scenarios. Fixes: 12724ce3fe1a ("iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes") Suggested-by: Jason Gunthorpe Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250721051657.1695788-1-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit d33bd88ac0ebb49e7f7c8f29a8c7ee9eae85d765 Author: Jiayi Li Date: Mon Jul 21 11:26:06 2025 +0800 ACPI: processor: perflib: Fix initial _PPC limit application If the BIOS sets a _PPC frequency limit upfront, it will fail to take effect due to a call ordering issue. Namely, freq_qos_update_request() is called before freq_qos_add_request() for the given request causing the constraint update to be ignored. The call sequence in question is as follows: cpufreq_policy_online() acpi_cpufreq_cpu_init() acpi_processor_register_performance() acpi_processor_get_performance_info() acpi_processor_get_platform_limit() freq_qos_update_request(&perflib_req) <- inactive QoS request blocking_notifier_call_chain(&cpufreq_policy_notifier_list, CPUFREQ_CREATE_POLICY) acpi_processor_notifier() acpi_processor_ppc_init() freq_qos_add_request(&perflib_req) <- QoS request activation Address this by adding an acpi_processor_get_platform_limit() call to acpi_processor_ppc_init(), after the perflib_req activation via freq_qos_add_request(), which causes the initial _PPC limit to be picked up as appropriate. However, also ensure that the _PPC limit will not be picked up in the cases when the cpufreq driver does not call acpi_processor_register_performance() by adding a pr->performance check to the related_cpus loop in acpi_processor_ppc_init(). Fixes: d15ce412737a ("ACPI: cpufreq: Switch to QoS requests instead of cpufreq notifier") Signed-off-by: Jiayi Li Link: https://patch.msgid.link/20250721032606.3459369-1-lijiayi@kylinos.cn [ rjw: Consolidate pr-related checks in acpi_processor_ppc_init() ] [ rjw: Subject and changelog adjustments ] Cc: 5.4+ # 5.4+: 2d8b39a62a5d ACPI: processor: Avoid NULL pointer dereferences at init time Cc: 5.4+ # 5.4+: 3000ce3c52f8 cpufreq: Use per-policy frequency QoS Cc: 5.4+ # 5.4+: a1bb46c36ce3 ACPI: processor: Add QoS requests for all CPUs Cc: 5.4+ # 5.4+ Signed-off-by: Rafael J. Wysocki commit 234b9258c6907cabbb2594ee366286d35ff056f3 Author: Frank Li Date: Thu Jul 10 15:13:48 2025 -0400 PCI: imx6: Add LUT configuration for MSI/IOMMU in Endpoint mode Add LUT entry for MSI/IOMMU in Endpoint mode by calling imx_pcie_add_lut_by_rid() helper function. Since only one physical function is supported in the Endpoint mode for now, '0' is passed as the Device ID. This sets up a single LUT entry required for MSI/IOMMU. The Endpoint function can operate without LUT configuration if neither IOMMU nor MSI is used by the platform. This LUT configuration is used for the EP doorbell feature by allowing the Root Complex to trigger the doorbell on the Endpoint with the help of the Endpoint MSI controller. Signed-off-by: Frank Li [mani: reworded the comments & commit message and dropped tested-by tag] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250710-ep-msi-v21-2-57683fc7fb25@nxp.com commit 9d0ca8df2451eb66a0c13a9932f348d417d9603b Author: Frank Li Date: Thu Jul 10 15:13:47 2025 -0400 PCI: imx6: Add helper function imx_pcie_add_lut_by_rid() Add helper function imx_pcie_add_lut_by_rid(), which will be used by the upcoming LUT configuration for MSI/IOMMU in the Endpoint mode. No functional change. Signed-off-by: Frank Li [mani: reworded commit message and dropped tested-by tag] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250710-ep-msi-v21-1-57683fc7fb25@nxp.com commit 57d88f02eb4449d96dfee3af4b7cd4287998bdbd Author: Mark Rutland Date: Tue Jul 8 19:27:42 2025 +1000 KVM: s390: Rework guest entry logic In __vcpu_run() and do_vsie_run(), we enter an RCU extended quiescent state (EQS) by calling guest_enter_irqoff(), which lasts until __vcpu_run() calls guest_exit_irqoff(). However, between the two we enable interrupts and may handle interrupts during the EQS. As the IRQ entry code will not wake RCU in this case, we may run the core IRQ code and IRQ handler without RCU watching, leading to various potential problems. It is necessary to unmask (host) interrupts around entering the guest, as entering the guest via SIE will not automatically unmask these. When a host interrupt is taken from a guest, it is taken via its regular host IRQ handler rather than being treated as a direct exit from SIE. Due to this, we cannot simply mask interrupts around guest entry, and must handle interrupts during this window, waking RCU as required. Additionally, between guest_enter_irqoff() and guest_exit_irqoff(), we use local_irq_enable() and local_irq_disable() to unmask interrupts, violating the ordering requirements for RCU/lockdep/tracing around entry/exit sequences. Further, since this occurs in an instrumentable function, it's possible that instrumented code runs during this window, with potential usage of RCU, etc. To fix the RCU wakeup problem, an s390 implementation of arch_in_rcu_eqs() is added which checks for PF_VCPU in current->flags. PF_VCPU is set/cleared by guest_timing_{enter,exit}_irqoff(), which surround the actual guest entry. To fix the remaining issues, the lower-level guest entry logic is moved into a shared noinstr helper function using the guest_state_{enter,exit}_irqoff() helpers. These perform all the lockdep/RCU/tracing manipulation necessary, but as sie64a() does not enable/disable interrupts, we must do this explicitly with the non-instrumented arch_local_irq_{enable,disable}() helpers: guest_state_enter_irqoff() arch_local_irq_enable(); sie64a(...); arch_local_irq_disable(); guest_state_exit_irqoff(); [ajd@linux.ibm.com: rebase, fix commit message] Signed-off-by: Mark Rutland Cc: Christian Borntraeger Cc: Frederic Weisbecker Cc: Heiko Carstens Cc: Janosch Frank Cc: Paolo Bonzini Cc: Paul E. McKenney Cc: Sven Schnelle Cc: Vasily Gorbik Cc: Claudio Imbrenda Cc: Alexander Gordeev Signed-off-by: Andrew Donnellan Reviewed-by: Janosch Frank Link: https://lore.kernel.org/r/20250708092742.104309-3-ajd@linux.ibm.com Signed-off-by: Janosch Frank Message-ID: <20250708092742.104309-3-ajd@linux.ibm.com> commit ee4a2e08c10188f02fe3fb36b6beddc3c2fdb287 Author: Mark Rutland Date: Tue Jul 8 19:27:41 2025 +1000 entry: Add arch_in_rcu_eqs() All architectures have an interruptible RCU extended quiescent state (EQS) as part of their idle sequences, where interrupts can occur without RCU watching. Entry code must account for this and wake RCU as necessary; the common entry code deals with this in irqentry_enter() by treating any interrupt from an idle thread as potentially having occurred within an EQS and waking RCU for the duration of the interrupt via rcu_irq_enter() .. rcu_irq_exit(). Some architectures may have other interruptible EQSs which require similar treatment. For example, on s390 it is necessary to enable interrupts around guest entry in the middle of a period where core KVM code has entered an EQS. So that architectures can wake RCU in these cases, this patch adds a new arch_in_rcu_eqs() hook to the common entry code which is checked in addition to the existing is_idle_thread() check, with RCU woken if either returns true. A default implementation is provided which always returns false, which suffices for most architectures. As no architectures currently implement arch_in_rcu_eqs(), there should be no functional change as a result of this patch alone. A subsequent patch will add an s390 implementation to fix a latent bug with missing RCU wakeups. [ajd@linux.ibm.com: rebase, fix commit message] Signed-off-by: Mark Rutland Cc: Andy Lutomirski Cc: Christian Borntraeger Cc: Heiko Carstens Cc: Paolo Bonzini Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Sven Schnelle Cc: Thomas Gleixner Cc: Claudio Imbrenda Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Janosch Frank Reviewed-by: Christian Borntraeger Signed-off-by: Andrew Donnellan Acked-by: Peter Zijlstra (Intel) Reviewed-by: Janosch Frank Link: https://lore.kernel.org/r/20250708092742.104309-2-ajd@linux.ibm.com Signed-off-by: Janosch Frank Message-ID: <20250708092742.104309-2-ajd@linux.ibm.com> commit d9f595b9a65e9c9eb03e21f3db98fde158d128db Author: Pavel Begunkov Date: Mon Jul 21 10:56:22 2025 +0100 io_uring/zcrx: fix leaking pages on sg init fail If sg_alloc_table_from_pages() fails, io_import_umem() returns without cleaning up pinned pages first. Fix it. Fixes: b84621d96ee02 ("io_uring/zcrx: allocate sgtable for umem areas") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/9fd94d1bc8c316611eccfec7579799182ff3fb0a.1753091564.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 6bbd3411ff87df1ca38ff32d36eb5dc673ca8021 Author: Pavel Begunkov Date: Mon Jul 21 10:56:21 2025 +0100 io_uring/zcrx: don't leak pages on account failure Someone needs to release pinned pages in io_import_umem() if accounting fails. Assign them to the area but return an error, the following io_zcrx_free_area() will clean them up. Fixes: 262ab205180d2 ("io_uring/zcrx: account area memory") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/e19f283a912f200c0d427e376cb789fc3f3d69bc.1753091564.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 720df2310b89cf76c1dc1a05902536282506f8bf Author: Pavel Begunkov Date: Mon Jul 21 10:56:20 2025 +0100 io_uring/zcrx: fix null ifq on area destruction Dan reports that ifq can be null when infering arguments for io_unaccount_mem() from io_zcrx_free_area(). Fix it by always setting a correct ifq. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202507180628.gBxrOgqr-lkp@intel.com/ Fixes: 262ab205180d2 ("io_uring/zcrx: account area memory") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/20670d163bb90dba2a81a4150f1125603cefb101.1753091564.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit d60f7cab7c04944a79af16caa43c141e780a59c6 Author: Heiko Schocher Date: Sat Jul 19 08:33:53 2025 +0200 spi: spidev: Add an entry for the ABB spi sensors This sensors are currently controlled from userspace, ideally we will add full drivers in the future. Signed-off-by: Heiko Schocher Link: https://patch.msgid.link/20250719063355.73111-3-hs@denx.de Signed-off-by: Mark Brown commit aad2f87cbcab56b322109d26d7b11842a09df91f Author: Heiko Schocher Date: Sat Jul 19 08:33:52 2025 +0200 dt-bindings: trivial-devices: Document ABB sensors Add documentation for spi based ABB sensors, which are currently operated from userspace. Signed-off-by: Heiko Schocher Link: https://patch.msgid.link/20250719063355.73111-2-hs@denx.de Signed-off-by: Mark Brown commit 62b2e01966dd7e8fd588d09e9e2fb99b7588d97a Author: Rafael J. Wysocki Date: Sat Jul 19 14:38:41 2025 +0200 ACPI/PNP: Use my kernel.org address in MAINTAINERS and ABI docs For the sake of consistency, use my kernel.org address in all Contact records in sysfs-bus-acpi and in the MAINTAINERS records related to ACPI and PNP. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2796086.mvXUDI8C0e@rjwysocki.net commit ebf266d0709b9b8eb3df1fde4152cdd329726598 Author: Rafael J. Wysocki Date: Sat Jul 19 14:40:31 2025 +0200 PM: docs: Use my kernel.org address in ABI docs and DT bindings For the sake of consistency, use my kernel.org address in all Contact records in sysfs-devices-power and sysfs-power, and in the power-domain DT binding. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/5911353.DvuYhMxLoT@rjwysocki.net commit c22458458c2e3fae5baa61313ee8bbb64c8150dc Merge: 347e9f5043c896 7da2fdaaa1e606 Author: Rafael J. Wysocki Date: Mon Jul 21 12:45:08 2025 +0200 Merge tag 'devfreq-next-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux Merge devfreq updates for v6.17 from Chanwoo Choi: "- Clean devfreq core and fix bugs : Replace sscanf with kstrtoul : Remove redundant devfreq_get_freq_range() on adding devfreq driver : Check missing NULL pointer check on removing devfreq driver : Limit max_freq and min_freq to avoid unreachable value : Fix wrong index on trans_stat sysfs node - Use devm_* managed function for clock control on sun81-a33-mbus driver - Add HiSilicon uncore frequencye scaling driver for for HiSilicon Kunpeng SoCs : The uncore domain includes shared system resources such as interconnects and L3 cache, and its frequency has a significant impact on system performance and power consumption. The driver provides the following functions: - Support to scale frequency scaling with governor and user setting - Support to query CPUs whose performance is closely related to the uncore domain - Communication with the platform controller via an ACPI PCC mailbox to perform actual frequency changes" * tag 'devfreq-next-for-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/linux: PM / devfreq: Add HiSilicon uncore frequency scaling driver PM / devfreq: Allow devfreq driver to add custom sysfs ABIs PM / devfreq: sun8i-a33-mbus: Simplify by using more devm functions PM / devfreq: Fix a index typo in trans_stat PM / devfreq: Check governor before using governor->name PM / devfreq: Remove redundant devfreq_get_freq_range() calling in devfreq_add_device() PM / devfreq: Limit max_freq with scaling_min_freq PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() commit b1052a917362d0776d272e6446ce2dc78b75342d Author: Sven Schnelle Date: Thu Feb 29 08:34:43 2024 +0100 s390/stp: Default to enabled With time steering moved to userspace, stp can be enabled by default. Signed-off-by: Sven Schnelle Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 64764cf6d0cc9ccf900d305e7ad03a28e3e1cb87 Author: Sven Schnelle Date: Fri Apr 25 10:39:44 2025 +0200 s390/stp: Remove leap second support With moving time steering to userspace, there's no need to handle leap seconds inside the kernel. Remove it. Signed-off-by: Sven Schnelle Acked-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 94ecbf1e71d463080c36a6e494e067e5a30ad0f0 Author: Sven Schnelle Date: Fri Apr 25 10:19:28 2025 +0200 s390/time: Remove in-kernel time steering Remove the in-kernel time steering in favour of the new ptp s390 driver, which allows the kernel clock to be steered more precise. Signed-off-by: Sven Schnelle Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 925f0707a67cae0a974c4bd5b718f0263dc56824 Author: Sven Schnelle Date: Thu Jul 10 09:43:40 2025 +0200 s390/sclp: Use monotonic clock in sclp_sync_wait() sclp_sync_wait() should use the monotonic clock for the delay loop. Otherwise the code won't work correctly when the clock is changed. Signed-off-by: Sven Schnelle Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit e12570c9855555d2acd3360c57abc591a8ec570d Author: Sven Schnelle Date: Thu Jul 10 09:43:11 2025 +0200 s390/smp: Use monotonic clock in smp_emergency_stop() This is a cosmetic change because when in smp_emergency_stop() the system is going to die anyway. But still change the code to use get_tod_clock_monotonic() to prevent people from copying broken code. Signed-off-by: Sven Schnelle Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 09e7e29d2b49ba84bcefb3dc1657726d2de5bb24 Author: Sven Schnelle Date: Thu Jul 10 09:42:29 2025 +0200 s390/time: Use monotonic clock in get_cycles() Otherwise the code might not work correctly when the clock is changed. Signed-off-by: Sven Schnelle Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 1c61cf974917bc47930bdab4ec9a18ec8fe7ac77 Merge: e04c78d86a9699 22679d807dea5c Author: Rafael J. Wysocki Date: Mon Jul 21 12:40:56 2025 +0200 Merge tag 'opp-updates-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge an operating performance points (OPP) update for 6.17 from Viresh Kumar: "- Minor cleanup in Rust bindings (Abhinav Ananthu)." * tag 'opp-updates-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: rust: opp: use c_* types via kernel prelude commit ba0205042944b38a8b8ad462128072424b71c690 Merge: 4f95b5bad62c95 a7ce9ca1aaf93d Author: Rafael J. Wysocki Date: Mon Jul 21 12:34:28 2025 +0200 Merge tag 'cpufreq-arm-updates-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm Merge CPUFreq updates for 6.17 from Viresh Kumar: "- tegra124: Allow building as a module (Aaron Kling). - Minor cleanups for Rust cpufreq and cpumask APIs and fix MAINTAINERS entry for cpu.rs (Abhinav Ananthu, Ritvik Gupta, and Lukas Bulwahn). - Minor cleanups for miscellaneous cpufreq drivers (Arnd Bergmann, Dan Carpenter, Krzysztof Kozlowski, Sven Peter, and Svyatoslav Ryhel)." * tag 'cpufreq-arm-updates-6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/vireshk/pm: drivers: cpufreq: add Tegra114 support rust: cpumask: Replace `MaybeUninit` and `mem::zeroed` with `Opaque` APIs cpufreq: tegra124: Allow building as a module cpufreq: dt: Add register helper cpufreq: Export disable_cpufreq() cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() cpufreq: armada-8k: make both cpu masks static rust: cpufreq: use c_ types from kernel prelude rust: cpufreq: Ensure C ABI compatibility in all unsafe cpufreq: brcmstb-avs: Fully open-code compatible for grepping cpufreq: apple: drop default ARCH_APPLE in Kconfig MAINTAINERS: adjust file entry in CPU HOTPLUG commit dd500e4aecf25e48e874ca7628697969df679493 Author: Zqiang Date: Wed Jul 16 08:15:24 2025 +0800 net: usb: Remove duplicate assignments for net->pcpu_stat_type This commit remove duplicate assignments for net->pcpu_stat_type in usbnet_probe(). Signed-off-by: Zqiang Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit ac3dbb91e0167d017f44701dd51c1efe30d0c256 Author: Sebastian Reichel Date: Thu Jul 17 18:55:02 2025 +0200 watchdog: dw_wdt: Fix default timeout The Synopsys Watchdog driver sets the default timeout to 30 seconds, but on some devices this is not a valid timeout. E.g. on RK3588 the actual timeout being used is 44 seconds instead. Once the watchdog is started the value is updated accordingly, but it would be better to expose a sensible timeout to userspace without the need to first start the watchdog. Signed-off-by: Sebastian Reichel Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250717-dw-wdt-fix-initial-timeout-v1-1-86dc864d48dd@kernel.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit a83c371c4b6c9e5cc11391ee6e56543a0fef59b9 Merge: f72b9aa821a2bf 89be9a83ccf1f8 Author: Greg Kroah-Hartman Date: Mon Jul 21 10:55:57 2025 +0200 Merge tag 'v6.16-rc7' into usb-next We need the USB/Thunderbolt fixes in here for other patches to be on top of. Signed-off-by: Greg Kroah-Hartman commit c78865241ecffaff7ce5db00ed5b71c1a70c0ff1 Author: Peng Fan Date: Mon Jul 7 10:24:41 2025 +0800 MAINTAINERS: Update i.MX Clock Entry Update file match pattern to include nxp,imx* and fsl,imx*. Signed-off-by: Peng Fan Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250707-imx95-blk-ctl-7-1-v3-5-c1b676ec13be@nxp.com Signed-off-by: Abel Vesa commit 9678bc7661cb34bec4be92685039eec68ca67dad Author: Peng Fan Date: Mon Jul 7 10:24:40 2025 +0800 clk: imx95-blk-ctl: Add clock for i.MX94 LVDS/Display CSR i.MX94 BLK CTL LVDS CSR's LVDS_PHY_CLOCK_CONTRL register controls the clock gating logic of LVDS units. Display CSR's DISPLAY_ENGINES_CLOCK_CONTROL register controls the selection of the clock feeding the display engine. Add clock gate support for the two CSRs. Reviewed-by: Abel Vesa Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250707-imx95-blk-ctl-7-1-v3-4-c1b676ec13be@nxp.com Signed-off-by: Abel Vesa commit 88768d6f8c13ede81b248177fed3ac285499f77c Author: Sandor Yu Date: Mon Jul 7 10:24:39 2025 +0800 clk: imx95-blk-ctl: Rename lvds and displaymix csr blk Rename i.MX95 lvds and displaymix csr blk drvdata in order to add support for i.MX943. Signed-off-by: Sandor Yu Signed-off-by: Laurentiu Palcu Reviewed-by: Abel Vesa Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250707-imx95-blk-ctl-7-1-v3-3-c1b676ec13be@nxp.com Signed-off-by: Abel Vesa commit b08217a257215ed9130fce93d35feba66b49bf0a Author: Laurentiu Palcu Date: Mon Jul 7 10:24:38 2025 +0800 clk: imx95-blk-ctl: Fix synchronous abort When enabling runtime PM for clock suppliers that also belong to a power domain, the following crash is thrown: error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP Workqueue: events_unbound deferred_probe_work_func pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : clk_mux_get_parent+0x60/0x90 lr : clk_core_reparent_orphans_nolock+0x58/0xd8 Call trace: clk_mux_get_parent+0x60/0x90 clk_core_reparent_orphans_nolock+0x58/0xd8 of_clk_add_hw_provider.part.0+0x90/0x100 of_clk_add_hw_provider+0x1c/0x38 imx95_bc_probe+0x2e0/0x3f0 platform_probe+0x70/0xd8 Enabling runtime PM without explicitly resuming the device caused the power domain cut off after clk_register() is called. As a result, a crash happens when the clock hardware provider is added and attempts to access the BLK_CTL register. Fix this by using devm_pm_runtime_enable() instead of pm_runtime_enable() and getting rid of the pm_runtime_disable() in the cleanup path. Fixes: 5224b189462f ("clk: imx: add i.MX95 BLK CTL clk driver") Reviewed-by: Frank Li Reviewed-by: Abel Vesa Signed-off-by: Laurentiu Palcu Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250707-imx95-blk-ctl-7-1-v3-2-c1b676ec13be@nxp.com Signed-off-by: Abel Vesa commit 0b0cd1857b783711b4bdfb8eb513c263b8a84f6d Author: Peng Fan Date: Mon Jul 7 10:24:37 2025 +0800 dt-bindings: clock: Add support for i.MX94 LVDS/DISPLAY CSR Add i.MX94 LVDS/DISPLAY CSR compatible string. Add clock index for the two CSRs. Reviewed-by: Abel Vesa Signed-off-by: Peng Fan Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250707-imx95-blk-ctl-7-1-v3-1-c1b676ec13be@nxp.com Signed-off-by: Abel Vesa commit b2be1327a6ed74fbf7e1ac0bc6ca57750f7ebe07 Author: Xiaolei Wang Date: Thu Jun 19 14:21:08 2025 +0800 clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data When num_parents is 4, __clk_register() occurs an out-of-bounds when accessing parent_names member. Use ARRAY_SIZE() instead of hardcode number here. BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8 Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59 Hardware name: NXP i.MX95 19X19 board (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x8c/0xcc print_report+0x398/0x5fc kasan_report+0xd4/0x114 __asan_report_load8_noabort+0x20/0x2c __clk_register+0x1844/0x20d8 clk_hw_register+0x44/0x110 __clk_hw_register_mux+0x284/0x3a8 imx95_bc_probe+0x4f4/0xa70 Fixes: 5224b189462f ("clk: imx: add i.MX95 BLK CTL clk driver") Cc: stable@vger.kernel.org Reviewed-by: Frank Li Signed-off-by: Xiaolei Wang Link: https://lore.kernel.org/r/20250619062108.2016511-1-xiaolei.wang@windriver.com Signed-off-by: Stephen Boyd commit 7cd3c8cafbc050eeeeae89b9d6bd7dc4cb95ab8a Merge: f261196d4bf1d4 9744ede7099e8a Author: Takashi Iwai Date: Mon Jul 21 09:23:34 2025 +0200 Merge branch 'for-linus' into for-next Synch HD-audio changes landed in 6.16-rc7. Mostly for file rename tracking. Signed-off-by: Takashi Iwai commit b83440736864ad96f863666fea49bd14ab17547d Author: Leon Romanovsky Date: Sun Jul 20 12:25:35 2025 +0300 RDMA/mlx5: Fix incorrect MKEY masking mkey_mask is __be64 type, while MLX5_MKEY_MASK_PAGE_SIZE is declared as unsigned long long. This causes to the static checkers errors: drivers/infiniband/hw/mlx5/umr.c:663:49: warning: invalid assignment: &= drivers/infiniband/hw/mlx5/umr.c:663:49: left side has type restricted __be64 drivers/infiniband/hw/mlx5/umr.c:663:49: right side has type int Fixes: e73242aa14d2 ("RDMA/mlx5: Optimize DMABUF mkey page size") Link: https://patch.msgid.link/e354d70b98dfa5ecf4c236a36cd36b64add9d9de.1753003467.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit d59ebb4549ff9bdba7abf6a5246a749e7f4a36ed Author: Leon Romanovsky Date: Sun Jul 20 12:25:34 2025 +0300 RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() As Colin reported: "The variable zapped_blocks is a size_t type and is being assigned a int return value from the call to _mlx5r_umr_zap_mkey. Since zapped_blocks is an unsigned type, the error check for zapped_blocks < 0 will never be true." So separate return error and nblocks assignment. Fixes: e73242aa14d2 ("RDMA/mlx5: Optimize DMABUF mkey page size") Reported-by: Colin King (gmail) Closes: https://lore.kernel.org/all/79166fb1-3b73-4d37-af02-a17b22eb8e64@gmail.com Link: https://patch.msgid.link/71d8ea208ac7eaa4438af683b9afaed78625e419.1753003467.git.leon@kernel.org Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 61ae7f8694fb4b57a8c02a1a8d2b601806afc999 Author: Manivannan Sadhasivam Date: Wed Jul 9 18:20:22 2025 +0530 PCI: endpoint: pci-epf-vntb: Fix the incorrect usage of __iomem attribute __iomem attribute is supposed to be used only with variables holding the MMIO pointer. But here, 'mw_addr' variable is just holding a 'void *' returned by pci_epf_alloc_space(). So annotating it with __iomem is clearly wrong. Hence, drop the attribute. This also fixes the below sparse warning: drivers/pci/endpoint/functions/pci-epf-vntb.c:524:17: warning: incorrect type in assignment (different address spaces) drivers/pci/endpoint/functions/pci-epf-vntb.c:524:17: expected void [noderef] __iomem *mw_addr drivers/pci/endpoint/functions/pci-epf-vntb.c:524:17: got void * drivers/pci/endpoint/functions/pci-epf-vntb.c:530:21: warning: incorrect type in assignment (different address spaces) drivers/pci/endpoint/functions/pci-epf-vntb.c:530:21: expected unsigned int [usertype] *epf_db drivers/pci/endpoint/functions/pci-epf-vntb.c:530:21: got void [noderef] __iomem *mw_addr drivers/pci/endpoint/functions/pci-epf-vntb.c:542:38: warning: incorrect type in argument 2 (different address spaces) drivers/pci/endpoint/functions/pci-epf-vntb.c:542:38: expected void *addr drivers/pci/endpoint/functions/pci-epf-vntb.c:542:38: got void [noderef] __iomem *mw_addr Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Link: https://patch.msgid.link/20250709125022.22524-1-mani@kernel.org commit 34b1cb4ec286603127aa8c4191ea527eb8dd3567 Author: Venkata Prasad Potturu Date: Tue Jul 15 17:40:41 2025 +0530 soundwire: amd: Add support for acp7.2 platform Add soundwire support for acp7.2 platform. Signed-off-by: Venkata Prasad Potturu Link: https://lore.kernel.org/r/20250715121048.1795607-1-venkataprasad.potturu@amd.com Signed-off-by: Vinod Koul commit dba7d9dbfdc4389361ff3a910e767d3cfca22587 Author: Bard Liao Date: Thu Jun 26 14:09:52 2025 +0800 soundwire: stream: restore params when prepare ports fail The bus->params should be restored if the stream is failed to prepare. The issue exists since beginning. The Fixes tag just indicates the first commit that the commit can be applied to. Fixes: 17ed5bef49f4 ("soundwire: add missing newlines in dynamic debug logs") Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Link: https://lore.kernel.org/r/20250626060952.405996-1-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit debc1e5a431779c027a5752f247a4de2e4f702b2 Author: Eric Biggers Date: Fri Jul 18 15:07:06 2025 -0700 lib/crypto: arm64/sha512-ce: Drop compatibility macros for older binutils Now that the oldest supported binutils version is 2.30, the macros that emit the SHA-512 instructions as '.inst' words are no longer needed. So drop them. No change in the generated machine code. Changed from the original patch by Ard Biesheuvel: (https://lore.kernel.org/r/20250515142702.2592942-2-ardb+git@google.com): - Reduced scope to just SHA-512 - Added comment that explains why "sha3" is used instead of "sha2" Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250718220706.475240-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 42e3376e0954d7e589e5a53d6149835cad64e8e6 Author: Eric Biggers Date: Fri Jul 18 12:19:00 2025 -0700 lib/crypto: x86/sha1-ni: Convert to use rounds macros The assembly code that does all 80 rounds of SHA-1 is highly repetitive. Replace it with 20 expansions of a macro that does 4 rounds, using the macro arguments and .if directives to handle the slight variations between rounds. This reduces the length of sha1-ni-asm.S by 129 lines while still producing the exact same object file. This mirrors sha256-ni-asm.S which uses this same strategy. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250718191900.42877-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit f88ed14aa0ef64ff5633605114efe313a0bed84b Author: Eric Biggers Date: Fri Jul 18 12:18:59 2025 -0700 lib/crypto: x86/sha1-ni: Minor optimizations and cleanup - Store the previous state in %xmm8-%xmm9 instead of spilling it to the stack. There are plenty of unused XMM registers here, so there is no reason to spill to the stack. (While 32-bit code is limited to %xmm0-%xmm7, this is 64-bit code, so it's free to use %xmm8-%xmm15.) - Remove the unnecessary check for nblocks == 0. sha1_ni_transform() is always passed a positive nblocks. - To get an XMM register with 'e' in the high dword and the rest zeroes, just zeroize the register using pxor, then load 'e'. Previously the code loaded 'e', then zeroized the lower dwords by AND-ing with a constant, which was slightly less efficient. - Instead of computing &DATA_PTR[NBLOCKS << 6] and stopping when DATA_PTR reaches that value, instead just decrement NBLOCKS on each iteration and stop when it reaches 0. This is fewer instructions. - Rename DIGEST_PTR to STATE_PTR. It points to the SHA-1 internal state, not a SHA-1 digest value. This commit shrinks the code size of sha1_ni_transform() from 624 bytes to 589 bytes and also shrinks rodata by 16 bytes. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250718191900.42877-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 118da22eb6fbd48f896d17411f942399283d600c Author: Eric Biggers Date: Sat Jul 19 15:49:38 2025 -0700 lib/crc: x86/crc32c: Enable VPCLMULQDQ optimization where beneficial Improve crc32c() performance on lengths >= 512 bytes by using crc32_lsb_vpclmul_avx512() instead of crc32c_x86_3way(), when the CPU supports VPCLMULQDQ and has a "good" implementation of AVX-512. For now that means AMD Zen 4 and later, and Intel Sapphire Rapids and later. Pass crc32_lsb_vpclmul_avx512() the table of constants needed to make it use the CRC-32C polynomial. Rationale: VPCLMULQDQ performance has improved on newer CPUs, making crc32_lsb_vpclmul_avx512() faster than crc32c_x86_3way(), even though crc32_lsb_vpclmul_avx512() is designed for generic 32-bit CRCs and does not utilize x86_64's dedicated CRC-32C instructions. Performance results for len=4096 using crc_kunit: CPU Before (MB/s) After (MB/s) ====================== ============= ============ AMD Zen 4 (Genoa) 19868 28618 AMD Zen 5 (Ryzen AI 9 365) 24080 46940 AMD Zen 5 (Turin) 29566 58468 Intel Sapphire Rapids 22340 73794 Intel Emerald Rapids 24696 78666 Performance results for len=512 using crc_kunit: CPU Before (MB/s) After (MB/s) ====================== ============= ============ AMD Zen 4 (Genoa) 7251 7758 AMD Zen 5 (Ryzen AI 9 365) 17481 19135 AMD Zen 5 (Turin) 21332 25424 Intel Sapphire Rapids 18886 29312 Intel Emerald Rapids 19675 29045 That being said, in the above benchmarks the ZMM registers are "warm", so they don't quite tell the whole story. While significantly improved from older Intel CPUs, Intel still has ~2000 ns of ZMM warm-up time where 512-bit instructions execute 4 times more slowly than they normally do. In contrast, AMD does better and has virtually zero ZMM warm-up time (at most ~60 ns). Thus, while this change is always beneficial on AMD, strictly speaking there are cases in which it is not beneficial on Intel, e.g. a small number of 512-byte messages with "cold" ZMM registers. But typically, it is beneficial even on Intel. Note that on AMD Zen 3--5, crc32c() performance could be further improved with implementations that interleave crc32q and VPCLMULQDQ instructions. Unfortunately, it appears that a different such implementation would be optimal on *each* of these microarchitectures. Such improvements are left for future work. This commit just improves the way that we choose the implementations we already have. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250719224938.126512-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 110628e55a577468ef21f01e042e87c4257b2fd5 Author: Eric Biggers Date: Sat Jul 19 15:49:37 2025 -0700 lib/crc: x86: Reorganize crc-pclmul static_call initialization Reorganize the crc-pclmul static_call initialization to place more of the logic in the *_mod_init_arch() functions instead of in the INIT_CRC_PCLMUL macro. This provides the flexibility to do more than a single static_call update for each CPU feature check. Right away, optimize crc64_mod_init_arch() to check the CPU features just once instead of twice, doing both the crc64_msb and crc64_lsb static_call updates together. A later commit will also use this to initialize an additional static_key when crc32_lsb_vpclmul_avx512() is enabled. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250719224938.126512-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e9fdf0d2ecc095ce9f078588c7ce06967e0138b2 Author: Federico Pellegrin Date: Fri Jul 18 06:12:24 2025 +0200 perf build: Always disable stack protection for BPF skeleton objects When the clang toolchain has stack protection enabled, the bpf skeletons build fails with: error: A call to built-in function '__stack_chk_fail' is not supported. Since stack-protector makes no sense for the BPF bits, just unconditionally disable it. See also similar case at 878625e1c7a10dfbb1fdaaaae2c4d2a58fbce627 Signed-off-by: Federico Pellegrin Link: https://lore.kernel.org/r/20250718041224.12389-1-fede@evolware.org [ rearrange long lines ] Signed-off-by: Namhyung Kim commit ba0f4c4c0f9d0f90300578fc8d081f43be281a71 Merge: acab5fbd77a55d 14ae91a81ec8fa Author: Dave Airlie Date: Mon Jul 21 12:56:15 2025 +1000 Merge tag 'nova-next-v6.17-2025-07-18' of https://gitlab.freedesktop.org/drm/nova into drm-next Nova changes for v6.17 DMA: - Merge topic/dma-features-2025-06-23 from alloc tree. - Clarify wording and be consistent in 'coherent' nomenclature. - Convert the read!() / write!() macros to return a Result. - Add as_slice() / write() methods in CoherentAllocation. - Fix doc-comment of dma_handle(). - Expose count() and size() in CoherentAllocation and add the corresponding type invariants. - Implement CoherentAllocation::dma_handle_with_offset(). nova-core: - Various register!() macro improvements. - Custom Sleep / Delay helpers (until the actual abstractions land). - Add DMA object abstraction. - VBIOS - Image parser / iterator. - PMU table look up in FWSEC. - FWSEC ucode extraction. - Register sysmem flush page. - Falcon - Generic falcon boot code and HAL (Ampere). - GSP / SEC2 specific code. - FWSEC-FRTS - Compute layout of FRTS region (FbLayout and HAL). - Load into GSP falcon and execute. - Add Documentation for VBIOS layout, Devinit process, Fwsec operation and layout, Falcon basics. - Update and annotate TODO list. - Add Alexandre Courbot as co-maintainer. Rust: - Make ETIMEDOUT error available. - Add size constants up to SZ_2G. Signed-off-by: Dave Airlie From: "Danilo Krummrich" Link: https://lore.kernel.org/r/DBFKLDMUGZD9.Z93GN2N5B0FI@kernel.org commit acab5fbd77a55dc7913632a354b969ae9090e78c Merge: be3cd668fffe2a 6ac55eab4fc41e Author: Dave Airlie Date: Mon Jul 21 11:57:43 2025 +1000 Merge tag 'amd-drm-next-6.17-2025-07-17' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.17-2025-07-17: amdgpu: - Partition fixes - Reset fixes - RAS fixes - i2c fix - MPC updates - DSC cleanup - EDID fixes - Display idle D3 update - IPS updates - DMUB updates - Retimer fix - Replay fixes - Fix DC memory leak - Initial support for smartmux - DCN 4.0.1 degamma LUT fix - Per queue reset cleanups - Track ring state associated with a fence - SR-IOV fixes - SMU fixes - Per queue reset improvements for GC 9+ compute - Per queue reset improvements for GC 10+ gfx - Per queue reset improvements for SDMA 5+ - Per queue reset improvements for JPEG 2+ - Per queue reset improvements for VCN 2+ - GC 8 fix - ISP updates amdkfd: - Enable KFD on LoongArch radeon: - Drop console lock during suspend/resume UAPI: - Add userq slot info to INFO IOCTL Used for IGT userq validation tests (https://lists.freedesktop.org/archives/igt-dev/2025-July/093228.html) From: Alex Deucher Link: https://lore.kernel.org/r/20250717213827.2061581-1-alexander.deucher@amd.com Signed-off-by: Dave Airlie commit 36d09b96d3e79518e2be31fc7960cc694702afb8 Author: Yulong Han Date: Mon Jul 21 09:26:35 2025 +0800 LoongArch: KVM: Add tracepoints for CPUCFG and CSR emulation exits This patch adds tracepoints to track KVM exits caused by CPUCFG and CSR emulation. Note that IOCSR emulation tracing is already covered by the generic trace_kvm_iocsr(). Reviewed-by: Bibo Mao Signed-off-by: Yulong Han Signed-off-by: Huacai Chen commit 46ecfb68ddd88118dcf623f21785d78f69337631 Author: Bibo Mao Date: Mon Jul 21 09:26:32 2025 +0800 LoongArch: KVM: Add stat information with kernel irqchip Move stat information about kernel irqchip from VM to vCPU, since all vm exiting events should be vCPU relative. And also add entry with structure kvm_vcpu_stats_desc[], so that it can display with directory /sys/kernel/debug/kvm. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 9c79c951a388c0c1935b3c8f5f83a89e21cc3381 Author: Bibo Mao Date: Mon Jul 21 09:26:32 2025 +0800 LoongArch: KVM: Replace eiointc_enable_irq() with eiointc_update_irq() Function eiointc_enable_irq() checks mask value with char type, and call eiointc_update_irq() eventually. Function eiointc_update_irq() will update one single irq status directly. Here it can check mask value with unsigned long type and call function eiointc_update_irq(), that is simple and direct. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit b0096e1e5783c7a3cc75eb70a4207f1657ac689b Author: Bibo Mao Date: Mon Jul 21 09:26:32 2025 +0800 LoongArch: KVM: Use generic function loongarch_eiointc_write() With all eiointc iocsr register write operation with 1/2/4/8 bytes size, generic function loongarch_eiointc_write() is used here. And function loongarch_eiointc_writeb(), loongarch_eiointc_writew(), loongarch_eiointc_writel() are removed. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 3e394eac6a61c846bf8c962b3e7b35ec8e025920 Author: Bibo Mao Date: Mon Jul 21 09:26:32 2025 +0800 LoongArch: KVM: Use generic function loongarch_eiointc_read() Generic read function loongarch_eiointc_read() is used for 1/2/4/8 bytes read access. It reads 8 bytes from emulated software state and shift right from address offset. Also the similar with kvm_complete_iocsr_read(), destination register of IOCSRRD.{B/H/W} is sign extension from byte/half word/word. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit d23bd878f6ea9cff93104159356e012a8b2bbfaf Author: Bibo Mao Date: Mon Jul 21 09:26:32 2025 +0800 LoongArch: KVM: Use standard bitops API with eiointc Standard bitops APIs such test_bit() is used here, rather than manually calculating the offset and mask. Also use non-atomic API __set_bit() and __clear_bit() rather than set_bit() and clear_bit(), since the global spinlock is held already. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit 9afce1f1ee1f687b5ba16de87224ddcfadca3e93 Author: Bibo Mao Date: Mon Jul 21 09:26:32 2025 +0800 LoongArch: KVM: Remove never called default case statement IOCSR instruction supports 1/2/4/8 bytes access, len must be 1/2/4/8 bytes from iocsr exit emulation function kvm_emu_iocsr(), remove the default case in switch case statements. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit a0630332fd5068bbdf60aa4479a292fdd0ae2e72 Author: Bibo Mao Date: Mon Jul 21 09:26:32 2025 +0800 LoongArch: KVM: Remove unused parameter len Parameter len is unused in some functions with eiointc emulation driver, remove it here. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit d42fd71333fc0cbe9f631c3dee2c37ebf4285bff Author: Bibo Mao Date: Mon Jul 21 09:26:32 2025 +0800 LoongArch: KVM: Remove unnecessary local variable Local variable device1 can be replaced with existing variable device, it makes code concise. Signed-off-by: Bibo Mao Signed-off-by: Huacai Chen commit ca2e92dc459d3c536250447dc0716835390e8ee9 Author: Yury Norov (NVIDIA) Date: Mon Jul 21 09:26:32 2025 +0800 LoongArch: KVM: Simplify kvm_deliver_intr() The function opencodes for_each_set_bit() macro, which makes it bulky. Using the proper API makes all the housekeeping code going away. Reviewed-by: Bibo Mao Signed-off-by: Yury Norov (NVIDIA) Signed-off-by: Huacai Chen commit 640f8424caad0ba69d89556a5d7d3be29c0e55d4 Author: Yury Norov (NVIDIA) Date: Mon Jul 21 09:26:32 2025 +0800 LoongArch: KVM: Rework kvm_send_pv_ipi() The function in fact traverses a "bitmap" stored in GPR regs A1 and A2, but does it in a non-obvious way by creating a single-word bitmap twice. This patch switches the function to create a single 2-word bitmap, and also employs for_each_set_bit() macro, as it helps to drop most of the housekeeping code. While there, convert the function to return void to not confuse readers with unchecked result. Reviewed-by: Bibo Mao Signed-off-by: Yury Norov (NVIDIA) Signed-off-by: Huacai Chen commit d5fc1400a34b4ea5e8f2ce296ea12bf8c8421694 Author: NeilBrown Date: Mon Jun 9 09:35:09 2025 +1000 smb/server: avoid deadlock when linking with ReplaceIfExists If smb2_create_link() is called with ReplaceIfExists set and the name does exist then a deadlock will happen. ksmbd_vfs_kern_path_locked() will return with success and the parent directory will be locked. ksmbd_vfs_remove_file() will then remove the file. ksmbd_vfs_link() will then be called while the parent is still locked. It will try to lock the same parent and will deadlock. This patch moves the ksmbd_vfs_kern_path_unlock() call to *before* ksmbd_vfs_link() and then simplifies the code, removing the file_present flag variable. Signed-off-by: NeilBrown Acked-by: Namjae Jeon Signed-off-by: Steve French commit a5dc90a9c355a30300ea4b4b25f0732270568d83 Author: NeilBrown Date: Sat Jul 19 18:46:42 2025 +0900 smb/server: simplify ksmbd_vfs_kern_path_locked() ksmbd_vfs_kern_path_locked() first tries to look up the path with the given case. When this fails, if caseless is set, it loops over the components in the path, opening the relevant directory and searching for a name which matches. This name is copied over the original and the the process repeats. Each time a lookup with the newly updated path is repeated from the top (vfs_path_lookup()). When the last component has been case-corrected the simplest next step is to repeat the original lookup with ksmbd_vfs_path_lookup_locked(). If this works it gives exactly what we want, if it fails it gives the correct failure. This observation allows the code to be simplified, in particular removing the ksmbd_vfs_lock_parent() call. This patch also removes the duplication of name and filepath (two names for the one thing) and calls path_put(parent_path) sooner so parent_path can be passed directly to vfs_path_lookup avoiding the need to store it temporarily in path and then copying into parent_path. This patch removes one user of ksmbd_vfs_lock_parent() which will simplify a future patch. Signed-off-by: NeilBrown Acked-by: Namjae Jeon Signed-off-by: Steve French commit 09f124b2871b3cf1e04fcdd3aff7932ecc8c125c Author: NeilBrown Date: Mon Jun 9 09:35:07 2025 +1000 smb/server: use lookup_one_unlocked() In process_query_dir_entries(), instead of locking the directory, performing a lookup, then unlocking, we can simply call lookup_one_unlocked(). That takes locks the directory only when needed. This removes the only users of lock_dir() and unlock_dir() so they can be removed. Signed-off-by: NeilBrown Acked-by: Namjae Jeon Signed-off-by: Steve French commit 05a0ffe37c44f4dea0433a8c753fc0259650cb3d Author: Uwe Kleine-König Date: Thu Jun 19 21:37:46 2025 +0200 dt-bindings: hwmon: adt7475: Allow and recommend #pwm-cells = <3> To make this binding match what is usally used for PWMs, deprecate 4 cells and allow 3 instead. Signed-off-by: Uwe Kleine-König Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/77895aec937b6217f513d3b12e7945f1707fd906.1750361514.git.u.kleine-koenig@baylibre.com Signed-off-by: Guenter Roeck commit 50f16073d175670f41f3f64ae64ab66a745fd58b Author: Uwe Kleine-König Date: Thu Jun 19 21:37:45 2025 +0200 hwmon: (adt7475) Implement support for #pwm-cells = <3> The adt7475 driver and binding are outliers requiring 4 pwm-cells. The typical value is 3, there are a few devices that use a lesser value for historical reasons, no other uses a value bigger than 3. Implement support for 3 cells to make the adt7475 binding match the usual PWM binding. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/b5cc994cbe74095e39468fd694c721d7c879db78.1750361514.git.u.kleine-koenig@baylibre.com Signed-off-by: Guenter Roeck commit 75ca1e5875fe3f0b9d0e8615c69f49bc2c7fb65d Author: Chiang Brian Date: Thu Jun 19 14:42:23 2025 +0800 hwmon: (pmbus/tps53679) Add support for TPS53685 The TPS53685 is a fully AMD SVI3 compliant step down controller with trans-inductor voltage regulator(TLVR) topology support, dual channels, built-in non-volatile memory (NVM), PMBus interface, and full compatible with TI NexFET smart power stages. Add support for it to the tps53679 driver. Signed-off-by: Chiang Brian Link: https://lore.kernel.org/r/20250619064223.3165523-3-chiang.brian@inventec.com Signed-off-by: Guenter Roeck commit a6945f39d9fe6ed301bd037de8eb1b0d6fb18aeb Author: Chiang Brian Date: Thu Jun 19 14:42:22 2025 +0800 dt-bindings: trivial: Add tps53685 support Add device type support for tps53685 Acked-by: Krzysztof Kozlowski Signed-off-by: Chiang Brian Link: https://lore.kernel.org/r/20250619064223.3165523-2-chiang.brian@inventec.com Signed-off-by: Guenter Roeck commit e09ef2fe4ae61e35037d290696fec8236c5ae9ad Author: Cedric Encarnacion Date: Wed Jul 9 13:43:27 2025 +0800 hwmon: (pmbus/adp1050) Add regulator support for ltp8800 Add regulator support for the single-channel LTP8800-1A/-2/-4A 150A/135A/200A DC/DC µModule Regulator. Reviewed-by: Andy Shevchenko Signed-off-by: Cedric Encarnacion Link: https://lore.kernel.org/r/20250709-adp1051-v5-3-539254692252@analog.com Signed-off-by: Guenter Roeck commit 3e5f73a0620dff64a22aae1cd62334a6706dc307 Author: Cedric Encarnacion Date: Wed Jul 9 13:43:26 2025 +0800 hwmon: (pmbus/adp1050) Add support for adp1051, adp1055 and ltp8800 Introduce hardware monitoring support for the following devices: ADP1051: 6 PWM for I/O Voltage, I/O Current, Temperature ADP1055: 6 PWM for I/O Voltage, I/O Current, Power, Temperature LTP8800-1A/-2/-4A: 150A/135A/200A DC/DC µModule Regulator The ADP1051 and ADP1055 are similar digital controllers for high efficiency DC-DC power conversion while the LTP8800 is a family of step-down μModule regulators that provides microprocessor core voltage from 54V power distribution architecture. All of the above components features telemetry monitoring of input/output voltage, input current, output power, and temperature over PMBus. Reviewed-by: Andy Shevchenko Co-developed-by: Alexis Czezar Torreno Signed-off-by: Alexis Czezar Torreno Signed-off-by: Cedric Encarnacion Link: https://lore.kernel.org/r/20250709-adp1051-v5-2-539254692252@analog.com [groeck: Dropped unnecessaary spaces after type casts] Signed-off-by: Guenter Roeck commit 409d2add31070fb79184acfb73b132b2a7146668 Author: Cedric Encarnacion Date: Wed Jul 9 13:43:25 2025 +0800 dt-bindings: hwmon: pmbus/adp1050: Add adp1051, adp1055 and ltp8800 Add support for adp1051, adp1055, and ltp8800. ADP1051: 6 PWM for I/O Voltage, I/O Current, Temperature ADP1055: 6 PWM for I/O Voltage, I/O Current, Power, Temperature LTP8800-1A/-2/-4A: 150A/135A/200A DC/DC µModule Regulator Co-developed-by: Alexis Czezar Torreno Signed-off-by: Alexis Czezar Torreno Signed-off-by: Cedric Encarnacion Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250709-adp1051-v5-1-539254692252@analog.com Signed-off-by: Guenter Roeck commit d1eb9fe14e73dc2ca47fd3c2f9f3c8753e33b774 Author: Khaled Elnaggar Date: Sat Jul 12 16:14:46 2025 +0300 hwmon: (max31827) use sysfs_emit() in temp1_resolution_show() Replace scnprintf() with sysfs_emit() in temp1_resolution_show(), as recommended in Documentation/filesystems/sysfs.rst: show() callbacks should use sysfs_emit() or sysfs_emit_at() to format values returned to userspace. Signed-off-by: Khaled Elnaggar Link: https://lore.kernel.org/r/20250712131447.326995-1-khaledelnaggarlinux@gmail.com Signed-off-by: Guenter Roeck commit 9f4401ad3740ecc7ea46ff8406b35cd29ddadd9b Author: Brian Masney Date: Thu Jul 10 14:10:41 2025 -0400 hwmon: (ltc4282) convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch appended to the "under-the-cut" portion of the patch. Signed-off-by: Brian Masney Link: https://lore.kernel.org/r/20250710-hwmon-round-rate-v1-1-64fbe4bf3d05@redhat.com Signed-off-by: Guenter Roeck commit 6082bfe47795c9ffc250df245d94e7057489466f Author: Shantanu Tushar Date: Mon Jun 30 22:14:44 2025 +0200 hwmon: (corsair-psu) add support for HX1200i Series 2025 Add the USB ID of the Corsair HXi Series 2025 HX1200i PSU (CP-9020307). Update the documentation to mention this. Signed-off-by: Shantanu Tushar Reviewed-by: Wilken Gottwalt Link: https://lore.kernel.org/r/20250630201444.210420-1-shantanu@kde.org Signed-off-by: Guenter Roeck commit 535ac9ae4138e632f56621d0d70b34c54f01aced Author: Rob Herring (Arm) Date: Tue Jul 1 16:00:44 2025 -0500 dt-bindings: hwmon: pmbus: ti,ucd90320: Add missing compatibles Add several compatibles already in use to the ti,ucd90320 binding. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250701-dt-hwmon-compatibles-v1-5-ad99e65cf11b@kernel.org Signed-off-by: Guenter Roeck commit 887088fabb4de70838910907f7270183d509148f Author: Rob Herring (Arm) Date: Tue Jul 1 16:00:43 2025 -0500 dt-bindings: hwmon: maxim,max20730: Add maxim,max20710 compatible The maxim,max20710 compatible is already in use. Add it to the maxim,max20730 binding as the device appears to be similar. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250701-dt-hwmon-compatibles-v1-4-ad99e65cf11b@kernel.org Signed-off-by: Guenter Roeck commit ed3f35ca5f8385a3441b7c9a44b3c3df6cb90090 Author: Rob Herring (Arm) Date: Tue Jul 1 16:00:42 2025 -0500 dt-bindings: hwmon: lltc,ltc2978: Add lltc,ltc713 compatible The lltc,ltc713 compatible is already in use. Add it to the lltc,ltc2978 binding as the device appears to be similar. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250701-dt-hwmon-compatibles-v1-3-ad99e65cf11b@kernel.org Signed-off-by: Guenter Roeck commit a735074da1859cd7cc1486587f7713e33df68bc5 Author: Rob Herring (Arm) Date: Tue Jul 1 16:00:41 2025 -0500 dt-bindings: hwmon: ti,lm87: Add adi,adm1024 compatible The adi,adm1024 compatible is already in use. Add it to the lm87 binding as the device appears to be compatible. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250701-dt-hwmon-compatibles-v1-2-ad99e65cf11b@kernel.org Signed-off-by: Guenter Roeck commit 3e72912e6a8a6a2edfa3c6fd03ab6998c3086e9b Author: Rob Herring (Arm) Date: Tue Jul 1 16:00:40 2025 -0500 dt-bindings: hwmon: national,lm90: Add missing Dallas max6654 and onsemi nct72, nct214, and nct218 The onsemi nct72, nct214, and nct218 and Dallas/Analog max6654 temperature sensors are already supported, but not documented. Add them to the LM90 binding. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250701-dt-hwmon-compatibles-v1-1-ad99e65cf11b@kernel.org Signed-off-by: Guenter Roeck commit bb4eb5739deda3c84801397f5fa9b067a9fc4746 Author: Colin Ian King Date: Mon Jul 14 16:55:05 2025 +0100 hwmon: (w83627ehf) make the read-only arrays 'bit' static const Don't populate the read-only arrays 'bit' on the stack at run time, instead make them static const. Signed-off-by: Colin Ian King Link: https://lore.kernel.org/r/20250714155505.1234012-1-colin.i.king@gmail.com Signed-off-by: Guenter Roeck commit 0429415a084a15466e87d504e8c2a502488184a5 Author: Florin Leotescu Date: Tue Jun 3 14:31:25 2025 +0300 hwmon: (emc2305) Set initial PWM minimum value during probe based on thermal state Prevent the PWM value from being set to minimum when thermal zone temperature exceeds any trip point during driver probe. Otherwise, the PWM fan speed will remains at minimum speed and not respond to temperature changes. Signed-off-by: Florin Leotescu Link: https://lore.kernel.org/r/20250603113125.3175103-5-florin.leotescu@oss.nxp.com Signed-off-by: Guenter Roeck commit ef8b1b4eb702cdd56807c0430b511f94b2af8e66 Author: Florin Leotescu Date: Tue Jun 3 14:31:24 2025 +0300 hwmon: (emc2305) Enable PWM polarity and output configuration Enable configuration of PWM polarity and PWM output config based Device Tree properties. Signed-off-by: Florin Leotescu Link: https://lore.kernel.org/r/20250603113125.3175103-4-florin.leotescu@oss.nxp.com Signed-off-by: Guenter Roeck commit 2ed4db7a1d07b349b50e890dee3d0f245230d254 Author: Florin Leotescu Date: Tue Jun 3 14:31:23 2025 +0300 hwmon: (emc2305) Configure PWM channels based on DT properties Add support for configuring each PWM channel using Device Tree (DT) properties by parsing the 'pwms' phandle arguments. Signed-off-by: Florin Leotescu Link: https://lore.kernel.org/r/20250603113125.3175103-3-florin.leotescu@oss.nxp.com Signed-off-by: Guenter Roeck commit 7114b74d99a3cd588da4ecb6011858c06f8408a1 Author: Florin Leotescu Date: Tue Jun 3 14:31:22 2025 +0300 hwmon: (emc2305) Add support for PWM frequency, polarity and output Add three new attributes to the driver data structures to support configuration of PWM frequency, PWM polarity and PWM output config. Signed-off-by: Florin Leotescu Link: https://lore.kernel.org/r/20250603113125.3175103-2-florin.leotescu@oss.nxp.com Signed-off-by: Guenter Roeck commit 90cf254f88d1d5a5219c8ee122ce677a3dc2f734 Author: João Paulo Gonçalves Date: Fri Jun 13 10:42:40 2025 -0300 hwmon: (amc6821) Add cooling device support Add support for using the AMC6821 as a cooling device. The AMC6821 registers with the thermal framework only if the `cooling-levels` property is present in the fan device tree child node. If this property is present, the driver assumes the fan will operate in open-loop, and the kernel will control it directly. In this case, the driver will change the AMC6821 mode to manual (software DCY) and set the initial PWM duty cycle to the maximum fan cooling state level as defined in the DT. It is worth mentioning that the cooling device is registered on the child fan node, not on the fan controller node. Existing behavior is unchanged, so the AMC6821 can still be used without the thermal framework (hwmon only). Signed-off-by: João Paulo Gonçalves Link: https://lore.kernel.org/r/20250613-b4-amc6821-cooling-device-support-v4-3-a8fc063c55de@toradex.com [groeck: Reduced line length when registering thermal device] Signed-off-by: Guenter Roeck commit b0078b2c9f54eac77e2562d83e70ace41f8397cc Author: João Paulo Gonçalves Date: Fri Jun 13 10:42:39 2025 -0300 hwmon: (amc6821) Move reading fan data from OF to a function Move fan property reading from OF to a separate function. This keeps OF data handling separate from the code logic and makes it easier to add features like cooling device support that use the same fan node. Signed-off-by: João Paulo Gonçalves Link: https://lore.kernel.org/r/20250613-b4-amc6821-cooling-device-support-v4-2-a8fc063c55de@toradex.com Signed-off-by: Guenter Roeck commit f2a32ed8691185206e080a603486730d65ffecb7 Author: João Paulo Gonçalves Date: Fri Jun 13 10:42:38 2025 -0300 dt-bindings: hwmon: amc6821: Add cooling levels The fan can be used as a cooling device, add a description of the `cooling-levels` property and restrict the maximum value to 255, which is the highest PWM duty cycle supported by the AMC6821 fan controller. Signed-off-by: João Paulo Gonçalves Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250613-b4-amc6821-cooling-device-support-v4-1-a8fc063c55de@toradex.com Signed-off-by: Guenter Roeck commit 36b0fef0b5437413ff3bfeba19e610d2c4fb0e5f Author: Qiushi Wu Date: Fri Jun 13 14:24:13 2025 -0400 hwmon: (ibmaem) match return type of wait_for_completion_timeout Return type of wait_for_completion_timeout is unsigned long not int. Check its return value inline instead of introducing a throw-away variable. Reviewed-by: Mimi Zohar Signed-off-by: Qiushi Wu Link: https://lore.kernel.org/r/20250613182413.1426367-1-qiushi@linux.ibm.com Signed-off-by: Guenter Roeck commit 6e253295e9c4c1dc1cf4a5eb4c0a0d9ebb68ce4b Author: Nuno Sá Date: Wed Jun 11 17:26:13 2025 +0100 hwmon: (ltc4282) fix copy paste on variable name The struct hwmon_chip_info was named ltc2947_chip_info which is obviously a copy paste leftover. Name it accordingly. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250611-fix-ltc4282-repetead-write-v1-2-fe46edd08cf1@analog.com Signed-off-by: Guenter Roeck commit 947809f9ee86539f40bb2802c39133b918503162 Author: Chiang Brian Date: Thu Jun 5 12:01:34 2025 +0800 hwmon: (pmbus/isl68137) Add support for RAA229621 The RAA229621 is a digital dual output multiphase (X+Y <= 8) PWM controller designed to be compliant with AMD SVI3 specifications, targeting VDDCR_CPU and VDDCR_SOC rails. Add support for it to the isl68137 driver. Signed-off-by: Chiang Brian Link: https://lore.kernel.org/r/20250605040134.4012199-3-chiang.brian@inventec.com Signed-off-by: Guenter Roeck commit 588f084a00b81ed2cea2d003fc66983a66a5ea4d Author: Chiang Brian Date: Thu Jun 5 12:01:33 2025 +0800 dt-bindings: hwmon: (pmbus/isl68137) Add RAA229621 support Add device type support for raa229621 Acked-by: Krzysztof Kozlowski Signed-off-by: Chiang Brian Link: https://lore.kernel.org/r/20250605040134.4012199-2-chiang.brian@inventec.com Signed-off-by: Guenter Roeck commit 3e538b52157b4a28b9a596210212571074d469ee Author: Eugene Shalygin Date: Sat Jun 7 12:26:14 2025 +0200 hwmon: (asus-ec-sensors) add ProArt X870E-CREATOR WIFI Adds support for the ProArt X870E-CREATOR WIFI board. Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250607102626.9051-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit e923acf15ae48a7f0a35922120fec07795123c5a Author: Roy Seitz Date: Thu May 29 11:01:41 2025 +0200 hwmon: (asus-ec-sensors) add support for ROG STRIX Z490-F GAMING This adds support for the ROG STRIX Z490-F GAMING board. Signed-off-by: Roy Seitz Signed-off-by: Eugene Shalygin Link: https://lore.kernel.org/r/20250529090222.154696-1-eugene.shalygin@gmail.com Signed-off-by: Guenter Roeck commit 9c62e2282900332c8b711d9f9e37af369a8ef71b Author: Tim Harvey Date: Fri Jul 18 13:02:59 2025 -0700 hwmon: (gsc-hwmon) fix fan pwm setpoint show functions The Linux hwmon sysfs API values for pwmX_auto_pointY_pwm represent an integer value between 0 (0%) to 255 (100%) and the pwmX_auto_pointY_temp represent millidegrees Celcius. Commit a6d80df47ee2 ("hwmon: (gsc-hwmon) fix fan pwm temperature scaling") properly addressed the incorrect scaling in the pwm_auto_point_temp_store implementation but erroneously scaled the pwm_auto_point_pwm_show (pwm value) instead of the pwm_auto_point_temp_show (temp value) resulting in: # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_pwm 25500 # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_temp 4500 Fix the scaling of these attributes: # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_pwm 255 # cat /sys/class/hwmon/hwmon0/pwm1_auto_point6_temp 45000 Fixes: a6d80df47ee2 ("hwmon: (gsc-hwmon) fix fan pwm temperature scaling") Cc: stable@vger.kernel.org Signed-off-by: Tim Harvey Link: https://lore.kernel.org/r/20250718200259.1840792-1-tharvey@gateworks.com Signed-off-by: Guenter Roeck commit be3cd668fffe2a1dc8a9c617b44c5f46fa2e4b96 Merge: af42cf30ea5dfc 28c5c486380cc2 Author: Dave Airlie Date: Mon Jul 21 09:13:15 2025 +1000 Merge tag 'drm-misc-next-2025-07-17' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 6.17: UAPI Changes: Cross-subsystem Changes: Core Changes: - mode_config: Change fb_create prototype to pass the drm_format_info and avoid redundant lookups in drivers - sched: kunit improvements, memory leak fixes, reset handling improvements - tests: kunit EDID update Driver Changes: - amdgpu: Hibernation fixes, structure lifetime fixes - nouveau: sched improvements - sitronix: Add Sitronix ST7567 Support - bridge: - Make connector available to bridge detect hook - panel: - More refcounting changes - New panels: BOE NE14QDM Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250717-efficient-kudu-of-fantasy-ff95e0@houat commit 1523590203786bf4e1d29b7d08a7100c783f20ba Author: Tamir Duberstein Date: Fri Jul 4 16:14:57 2025 -0400 rust: kernel: use `core::ffi::CStr` method names Prepare for `core::ffi::CStr` taking the place of `kernel::str::CStr` by avoiding methods that only exist on the latter. Also avoid `Deref for CStr` as that impl doesn't exist on `core::ffi::CStr`. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Signed-off-by: Tamir Duberstein Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250704-core-cstr-prepare-v1-6-a91524037783@gmail.com [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit 10a7108d4bd411166a7b4484bda8894dc3f0f04b Author: Tamir Duberstein Date: Fri Jul 4 16:14:56 2025 -0400 rust: str: add `CStr` methods matching `core::ffi::CStr` Prepare for replacing `CStr` with `core::ffi::CStr` by soft-deprecating methods which don't exist on `core::ffi::CStr`. We could keep `as_bytes{,_with_nul}` through an extension trait but seeing as we have to introduce `as_char_ptr_in_const_context` as a free function, we may as well introduce `to_bytes{,_with_nul}` here to allow downstream code to migrate in one cycle rather than two. Link: https://github.com/Rust-for-Linux/linux/issues/1075 Signed-off-by: Tamir Duberstein Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250704-core-cstr-prepare-v1-5-a91524037783@gmail.com [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit 0f6d225671e05bd84b426823152b77a8db580f92 Author: Tamir Duberstein Date: Fri Jul 4 16:14:55 2025 -0400 rust: str: remove unnecessary qualification `core::ffi::*` is in the prelude, which is imported here. Signed-off-by: Tamir Duberstein Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250704-core-cstr-prepare-v1-4-a91524037783@gmail.com Signed-off-by: Miguel Ojeda commit 386f285d885ae40b64ccf8328d59694055af3187 Author: Tamir Duberstein Date: Fri Jul 4 16:14:54 2025 -0400 rust: use `kernel::{fmt,prelude::fmt!}` Reduce coupling to implementation details of the formatting machinery by avoiding direct use for `core`'s formatting traits and macros. Signed-off-by: Tamir Duberstein Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250704-core-cstr-prepare-v1-3-a91524037783@gmail.com Signed-off-by: Miguel Ojeda commit bda947d613f1882c73ebb3ddda388459bab5902c Author: Tamir Duberstein Date: Fri Jul 4 16:14:53 2025 -0400 rust: kernel: add `fmt` module `kernel::fmt` is a facade over `core::fmt` that can be used downstream, allowing future changes to the formatting machinery to be contained within the kernel crate without downstream code needing to be modified. Signed-off-by: Tamir Duberstein Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250704-core-cstr-prepare-v1-2-a91524037783@gmail.com Signed-off-by: Miguel Ojeda commit f411b7eddde8b780a61dadea0916480f5c9edf5a Author: Tamir Duberstein Date: Fri Jul 4 16:14:52 2025 -0400 rust: kernel: remove `fmt!`, fix clippy::uninlined-format-args Rather than export a macro that delegates to `core::format_args`, simply re-export `core::format_args` as `fmt` from the prelude. This exposes clippy warnings which were previously obscured by this macro, such as: warning: variables can be used directly in the `format!` string --> ../drivers/cpufreq/rcpufreq_dt.rs:21:43 | 21 | let prop_name = CString::try_from_fmt(fmt!("{}-supply", name)).ok()?; | ^^^^^^^^^^^^^^^^^^^^^^^ | = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#uninlined_format_args = note: `-W clippy::uninlined-format-args` implied by `-W clippy::all` = help: to override `-W clippy::all` add `#[allow(clippy::uninlined_format_args)]` help: change this to | 21 - let prop_name = CString::try_from_fmt(fmt!("{}-supply", name)).ok()?; 21 + let prop_name = CString::try_from_fmt(fmt!("{name}-supply")).ok()?; | Thus fix them in the same commit. This could possibly be fixed in two stages, but the diff is small enough (outside of kernel/str.rs) that I hope it can be taken in a single commit. Signed-off-by: Tamir Duberstein Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250704-core-cstr-prepare-v1-1-a91524037783@gmail.com Signed-off-by: Miguel Ojeda commit 2254991d5b573662f841998c1d263118a15f067a Author: Tamir Duberstein Date: Thu May 29 09:14:59 2025 -0400 scripts: rust: emit path candidates in panic message Include all information in the panic message rather than emit fragments to stderr to avoid possible interleaving with other output. Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250529-idiomatic-match-slice-v2-2-4925ca2f1550@gmail.com [ Kept newlines using `writeln!`. Used new message from Tamir. Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit 8b097b5ac68b0fd2a7a251e101a84175b2ed585d Author: Tamir Duberstein Date: Thu May 29 09:14:58 2025 -0400 scripts: rust: replace length checks with match Use a match expression with slice patterns instead of length checks and indexing. The result is more idiomatic, which is a better example for future Rust code authors. Reviewed-by: Alice Ryhl Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250529-idiomatic-match-slice-v2-1-4925ca2f1550@gmail.com [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit d1fbe1ebf4a12cabd7945335d5e47718cb2bef99 Author: Randy Dunlap Date: Sat Jul 19 18:04:56 2025 -0700 io_uring: fix breakage in EXPERT menu Add a dependency for IO_URING for the GCOV_PROFILE_URING symbol. Without this patch the EXPERT config menu ends with "Enable IO uring support" and the menu prompts for GCOV_PROFILE_URING and IO_URING_MOCK_FILE are not subordinate to it. This causes all of the EXPERT Kconfig options that follow GCOV_PROFILE_URING to be display in the "upper" menu (General setup), just following the EXPERT menu. Fixes: 1802656ef890 ("io_uring: add GCOV_PROFILE_URING Kconfig option") Signed-off-by: Randy Dunlap Cc: Jens Axboe Cc: Andrew Morton Cc: Masahiro Yamada Cc: io-uring@vger.kernel.org Link: https://lore.kernel.org/r/20250720010456.2945344-1-rdunlap@infradead.org Signed-off-by: Jens Axboe commit 696b2a6ce9487ae278fd239658ca2714cd211e8e Author: Danilo Krummrich Date: Sat Jul 19 16:08:16 2025 +0200 rust: io: mem: enable IoRequest doc-tests When introduced, the IoRequest doc-tests did depend on infrastructure added in subsequent patches, hence they temporarily had to be disabled. Now that we have the corresponding platform device infrastructure, enable them. Link: https://lore.kernel.org/r/DBG39YMN2TX6.1VR4PEQSI8PSG@kernel.org Signed-off-by: Danilo Krummrich commit bc4f9045a59963abb142f6a648195ccd73ec39dd Author: Daniel Almeida Date: Thu Jul 17 12:55:24 2025 -0300 rust: platform: add resource accessors The previous patches have added the abstractions for Resources and the ability to map them and therefore read and write the underlying memory . The only thing missing to make this accessible for platform devices is to provide accessors that return instances of IoRequest<'a>. These ensure that the resource are valid only for the lifetime of the platform device, and that the platform device is in the Bound state. Therefore, add these accessors. Also make it possible to retrieve resources from platform devices in Rust using either a name or an index. Acked-by: Miguel Ojeda Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250717-topics-tyr-platform_iomem-v15-3-beca780b77e3@collabora.com [ Remove #[expect(dead_code)] from IoRequest::new() and move SAFETY comments right on top of unsafe blocks to avoid clippy warnings for some (older) clippy versions. - Danilo ] Signed-off-by: Danilo Krummrich commit 1d0d4b28513b5e0e9e87e09c8da289e1b8d88f84 Author: Daniel Almeida Date: Thu Jul 17 12:55:23 2025 -0300 rust: io: mem: add a generic iomem abstraction Add a generic iomem abstraction to safely read and write ioremapped regions. This abstraction requires a previously acquired IoRequest instance. This makes it so that both the resource and the device match, or, in other words, that the resource is indeed a valid resource for a given bound device. A subsequent patch will add the ability to retrieve IoRequest instances from platform devices. The reads and writes are done through IoRaw, and are thus checked either at compile-time, if the size of the region is known at that point, or at runtime otherwise. Non-exclusive access to the underlying memory region is made possible to cater to cases where overlapped regions are unavoidable. Acked-by: Miguel Ojeda Reviewed-by: Alice Ryhl Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250717-topics-tyr-platform_iomem-v15-2-beca780b77e3@collabora.com [ Add #[expect(dead_code)] to avoid a temporary warning, remove unnecessary OF_ID_TABLE constants in doc-tests and ignore doc-tests for now to avoid a temporary build failure. - Danilo ] Signed-off-by: Danilo Krummrich commit 493fc33ec25294cb2e444dfa77c105aa774c83f2 Author: Daniel Almeida Date: Thu Jul 17 12:55:22 2025 -0300 rust: io: add resource abstraction In preparation for ioremap support, add a Rust abstraction for struct resource. A future commit will introduce the Rust API to ioremap a resource from a platform device. The current abstraction, therefore, adds only the minimum API needed to get that done. Acked-by: Miguel Ojeda Reviewed-by: Alice Ryhl Co-developed-by: Fiona Behrens Signed-off-by: Fiona Behrens Signed-off-by: Daniel Almeida Link: https://lore.kernel.org/r/20250717-topics-tyr-platform_iomem-v15-1-beca780b77e3@collabora.com [ Capitalize safety comments and end it with a period. - Danilo ] Signed-off-by: Danilo Krummrich commit 275ad5e7931160aca2ea7657f7be7ef3493dea79 Author: Miguel Ojeda Date: Sun Jul 20 01:25:00 2025 +0200 rust: list: remove nonexistent generic parameter in link `ListLinks` does not take a `T` generic parameter, unlike `ListLinksSelfPtr`. Thus fix it, which makes it also consistent with the rest of the links in the file. Fixes: 40c53294596b ("rust: list: add macro for implementing ListItem") Reviewed-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250719232500.822313-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 4d9d1a08b796efd54f1e29b42bd95879109fe448 Author: John Johansen Date: Thu May 22 13:54:05 2025 -0700 apparmor: fix: accept2 being specifie even when permission table is presnt The transition to the perms32 permission table dropped the need for the accept2 table as permissions. However accept2 can be used for flags and may be present even when the perms32 table is present. So instead of checking on version, check whether the table is present. Fixes: 2e12c5f06017 ("apparmor: add additional flags to extended permission.") Signed-off-by: John Johansen commit 9afdc6abb007d5a86f54e9f10870ac1468155ca5 Author: John Johansen Date: Mon Feb 17 01:46:37 2025 -0800 apparmor: transition from a list of rules to a vector of rules The set of rules on a profile is not dynamically extended, instead if a new ruleset is needed a new version of the profile is created. This allows us to use a vector of rules instead of a list, slightly reducing memory usage and simplifying the code. Signed-off-by: John Johansen commit f9c9dce01e9640d94a37304bddc97b738ee4ac35 Author: Peng Jiang Date: Mon Jun 23 14:41:11 2025 +0800 apparmor: fix documentation mismatches in val_mask_to_str and socket functions This patch fixes kernel-doc warnings: 1. val_mask_to_str: - Added missing descriptions for `size` and `table` parameters. - Removed outdated str_size and chrs references. 2. Socket Functions: - Makes non-null requirements clear for socket/address args. - Standardizes return values per kernel conventions. - Adds Unix domain socket protocol details. These changes silence doc validation warnings and improve accuracy for AppArmor LSM docs. Signed-off-by: Peng Jiang Signed-off-by: John Johansen commit 4ce7d3cf5ad846a8843f8afc78de2a8309f74f12 Author: Ryan Lee Date: Mon Jun 23 14:58:00 2025 -0700 apparmor: remove redundant perms.allow MAY_EXEC bitflag set This section of profile_transition that occurs after x_to_label only happens if perms.allow already has the MAY_EXEC bit set, so we don't need to set it again. Fixes: 16916b17b4f8 ("apparmor: force auditing of conflicting attachment execs from confined") Signed-off-by: Ryan Lee Signed-off-by: John Johansen commit da0edababafa444e638a0be6dd2feef0a9e529e2 Author: John Johansen Date: Fri Jun 20 15:05:01 2025 -0700 apparmor: fix kernel doc warnings for kernel test robot Fix kernel doc warnings for the functions - apparmor_socket_bind - apparmor_unix_may_send - apparmor_unix_stream_connect - val_mask_to_str Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506070127.B1bc3da4-lkp@intel.com/ Signed-off-by: John Johansen commit c68804199dd9d63868497a27b5da3c3cd15356db Author: Helge Deller Date: Sat May 31 17:08:22 2025 +0200 apparmor: Fix unaligned memory accesses in KUnit test The testcase triggers some unnecessary unaligned memory accesses on the parisc architecture: Kernel: unaligned access to 0x12f28e27 in policy_unpack_test_init+0x180/0x374 (iir 0x0cdc1280) Kernel: unaligned access to 0x12f28e67 in policy_unpack_test_init+0x270/0x374 (iir 0x64dc00ce) Use the existing helper functions put_unaligned_le32() and put_unaligned_le16() to avoid such warnings on architectures which prefer aligned memory accesses. Signed-off-by: Helge Deller Fixes: 98c0cc48e27e ("apparmor: fix policy_unpack_test on big endian systems") Signed-off-by: John Johansen commit c567de2c4f5fe6e079672e074e1bc6122bf7e444 Author: Helge Deller Date: Sat May 31 17:08:21 2025 +0200 apparmor: Fix 8-byte alignment for initial dfa blob streams The dfa blob stream for the aa_dfa_unpack() function is expected to be aligned on a 8 byte boundary. The static nulldfa_src[] and stacksplitdfa_src[] arrays store the initial apparmor dfa blob streams, but since they are declared as an array-of-chars the compiler and linker will only ensure a "char" (1-byte) alignment. Add an __aligned(8) annotation to the arrays to tell the linker to always align them on a 8-byte boundary. This avoids runtime warnings at startup on alignment-sensitive platforms like parisc such as: Kernel: unaligned access to 0x7f2a584a in aa_dfa_unpack+0x124/0x788 (iir 0xca0109f) Kernel: unaligned access to 0x7f2a584e in aa_dfa_unpack+0x210/0x788 (iir 0xca8109c) Kernel: unaligned access to 0x7f2a586a in aa_dfa_unpack+0x278/0x788 (iir 0xcb01090) Signed-off-by: Helge Deller Cc: stable@vger.kernel.org Fixes: 98b824ff8984 ("apparmor: refcount the pdb") Signed-off-by: John Johansen commit 3fa0af4cc8a31d4139ee85a7b0e3d9b4f37b3093 Author: Gabriel Totev Date: Wed Apr 16 18:42:09 2025 -0400 apparmor: shift uid when mediating af_unix in userns Avoid unshifted ouids for socket file operations as observed when using AppArmor profiles in unprivileged containers with LXD or Incus. For example, root inside container and uid 1000000 outside, with `owner /root/sock rw,` profile entry for nc: /root$ nc -lkU sock & nc -U sock ==> dmesg apparmor="DENIED" operation="connect" class="file" namespace="root//lxd-podia_" profile="sockit" name="/root/sock" pid=3924 comm="nc" requested_mask="wr" denied_mask="wr" fsuid=1000000 ouid=0 [<== should be 1000000] Fix by performing uid mapping as per common_perm_cond() in lsm.c Signed-off-by: Gabriel Totev Fixes: c05e705812d1 ("apparmor: add fine grained af_unix mediation") Signed-off-by: John Johansen commit c5bf96d20fd787e4909b755de4705d52f3458836 Author: Gabriel Totev Date: Wed Apr 16 18:42:08 2025 -0400 apparmor: shift ouid when mediating hard links in userns When using AppArmor profiles inside an unprivileged container, the link operation observes an unshifted ouid. (tested with LXD and Incus) For example, root inside container and uid 1000000 outside, with `owner /root/link l,` profile entry for ln: /root$ touch chain && ln chain link ==> dmesg apparmor="DENIED" operation="link" class="file" namespace="root//lxd-feet_" profile="linkit" name="/root/link" pid=1655 comm="ln" requested_mask="l" denied_mask="l" fsuid=1000000 ouid=0 [<== should be 1000000] target="/root/chain" Fix by mapping inode uid of old_dentry in aa_path_link() rather than using it directly, similarly to how it's mapped in __file_path_perm() later in the file. Signed-off-by: Gabriel Totev Signed-off-by: John Johansen commit 88fec3526e84123997ecebd6bb6778eb4ce779b7 Author: John Johansen Date: Thu Jun 19 22:11:52 2025 -0700 apparmor: make sure unix socket labeling is correctly updated. When a unix socket is passed into a different confinement domain make sure its cached mediation labeling is updated to correctly reflect which domains are using the socket. Fixes: c05e705812d1 ("apparmor: add fine grained af_unix mediation") Signed-off-by: John Johansen commit 9a0048e0ae14cb7babfd459ec920234e8a2ab86e Author: Oren Sidi Date: Thu Jul 17 09:48:15 2025 +0300 net/mlx5: Expose cable_length field in PFCC register Introduce new "cable_length" field in PFCC register and related fields to enhance rx buffer configuration management: 1. cable_length: Shifts cable length handling to fw by storing a manually entered length from user in PFCC.cable_length 2. lane_rate_oper: In a case where PFCC.cable_length is not supported, helps compute a default cable length Signed-off-by: Oren Sidi Reviewed-by: Alex Lazar Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1752734895-257735-4-git-send-email-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 6f09ee0b583cad4f2b6a82842c26235bee3d5c2e Author: Oren Sidi Date: Thu Jul 17 09:48:14 2025 +0300 net/mlx5: Add IFC bits and enums for buf_ownership Extend structure layouts and defines buf_ownership. buf_ownership indicates whether the buffer is managed by SW or FW. Signed-off-by: Oren Sidi Reviewed-by: Alex Lazar Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1752734895-257735-3-git-send-email-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit 438794e93f6271af93f0d16a1851725115b5fd51 Author: Jianbo Liu Date: Thu Jul 17 09:48:13 2025 +0300 net/mlx5: Add IFC bits to support RSS for IPSec offload This adds the capabilities, ipsec_next_header and inner/outer l4_type_ext fields to support RSS for the decrypted packets. These fields are specifically for firmware steering. HWS validation logic is updated to correctly handle the changes, ensuring the unsupported fields are not set. Besides, reserved_at_c4 is fixed to reserved_at_d4 to reflect the accurate offset within the structure. Signed-off-by: Jianbo Liu Reviewed-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1752734895-257735-2-git-send-email-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit fc07839203f3b98fa9afac370aaba283afc10433 Author: Kees Cook Date: Thu Jul 17 01:52:12 2025 -0700 seq_buf: Introduce KUnit tests Add KUnit tests for the seq_buf API to ensure its correctness and prevent future regressions, covering the following functions: - seq_buf_init() - DECLARE_SEQ_BUF() - seq_buf_clear() - seq_buf_puts() - seq_buf_putc() - seq_buf_printf() - seq_buf_get_buf() - seq_buf_commit() $ tools/testing/kunit/kunit.py run seq_buf =================== seq_buf (9 subtests) =================== [PASSED] seq_buf_init_test [PASSED] seq_buf_declare_test [PASSED] seq_buf_clear_test [PASSED] seq_buf_puts_test [PASSED] seq_buf_puts_overflow_test [PASSED] seq_buf_putc_test [PASSED] seq_buf_printf_test [PASSED] seq_buf_printf_overflow_test [PASSED] seq_buf_get_buf_commit_test ===================== [PASSED] seq_buf ===================== Link: https://lore.kernel.org/r/20250717085156.work.363-kees@kernel.org Reviewed-by: David Gow Signed-off-by: Kees Cook commit 45dd59885ca8d283f365774a82b9b785b65c8d37 Author: Satya Priya Kakitapalli Date: Thu Jul 17 12:08:36 2025 +0530 dt-bindings: clock: qcom,sm4450-dispcc: Reference qcom,gcc.yaml Reference the common qcom,gcc.yaml schema to unify the common parts of the binding. Suggested-by: Krzysztof Kozlowski Signed-off-by: Satya Priya Kakitapalli Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717-gcc-ref-fixes-v2-4-a2a571d2be28@quicinc.com Signed-off-by: Bjorn Andersson commit 9df98d4b50bec90b9d7069691dce88d50595a872 Author: Satya Priya Kakitapalli Date: Thu Jul 17 12:08:35 2025 +0530 dt-bindings: clock: qcom,sm4450-camcc: Reference qcom,gcc.yaml Reference the common qcom,gcc.yaml schema to unify the common parts of the binding. Suggested-by: Krzysztof Kozlowski Signed-off-by: Satya Priya Kakitapalli Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717-gcc-ref-fixes-v2-3-a2a571d2be28@quicinc.com Signed-off-by: Bjorn Andersson commit 56245968a7b71fe71b610a9431605034b10922c9 Author: Satya Priya Kakitapalli Date: Thu Jul 17 12:08:34 2025 +0530 dt-bindings: clock: qcom,mmcc: Reference qcom,gcc.yaml Reference the common qcom,gcc.yaml schema to unify the common parts of the binding. Suggested-by: Krzysztof Kozlowski Signed-off-by: Satya Priya Kakitapalli Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717-gcc-ref-fixes-v2-2-a2a571d2be28@quicinc.com Signed-off-by: Bjorn Andersson commit 92b7d67614a68b03daf126d252c1cea935e9d5e5 Author: Satya Priya Kakitapalli Date: Thu Jul 17 12:08:33 2025 +0530 dt-bindings: clock: qcom,sm8150-camcc: Reference qcom,gcc.yaml Reference the common qcom,gcc.yaml schema to unify the common parts of the binding. Suggested-by: Krzysztof Kozlowski Signed-off-by: Satya Priya Kakitapalli Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717-gcc-ref-fixes-v2-1-a2a571d2be28@quicinc.com Signed-off-by: Bjorn Andersson commit 40f7d6d1764c2f66a15e7f4f4166499206f0aec3 Author: Luca Weiss Date: Thu Jul 17 08:54:44 2025 +0200 dt-bindings: clock: qcom: Remove double colon from description No double colon is necessary in the description. Fix it for all bindings so future bindings won't have the same copy-paste mistake. Reported-by: Rob Herring Closes: https://lore.kernel.org/lkml/20250625150458.GA1182597-robh@kernel.org/ Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717-bindings-double-colon-v1-1-c04abc180fcd@fairphone.com Signed-off-by: Bjorn Andersson commit a9ed4422adacce848fd368c3a7076368ead7fc18 Author: Herbert Xu Date: Mon Jun 23 16:47:25 2025 +0800 lib/raid6: update recov_rvv.c zero page usage Update lib/raid6/recov_rvv.c, for 1857fcc84744 ("lib/raid6: replace custom zero page with ZERO_PAGE"), per Klara. Link: https://lkml.kernel.org/r/aFkUnXWtxcgOTVkw@gondor.apana.org.au Fixes: 1857fcc84744 ("lib/raid6: replace custom zero page with ZERO_PAGE") Signed-off-by: Herbert Xu Cc: Song Liu Cc: Yu Kuai Cc: Klara Modin Signed-off-by: Andrew Morton commit 320bf1709a473403840eba60c432a9f9b7d824d5 Author: Wang Yaxin Date: Thu Jul 10 13:51:41 2025 +0800 docs: update docs after introducing delaytop The "getdelays" can only display the latency of a single task by specifying a PID, we introduce the "delaytop" with the following capabilities: 1. system view: monitors latency metrics (CPU, I/O, memory, IRQ, etc.) for all system processes 2. supports field-based sorting (e.g., default sort by CPU latency in descending order) 3. dynamic interactive interface: focus on specific processes with --pid; limit displayed entries with --processes 20; control monitoring duration with --iterations; Link: https://lkml.kernel.org/r/2025071013514177028RdjISjqeIOnTCRvGAwy@zte.com.cn Signed-off-by: Fan Yu Signed-off-by: Wang Yaxin Signed-off-by: Jiang Kun Cc: Balbir Singh Cc: David Hildenbrand Cc: Peilin He Cc: Qiang Tu Cc: wangyong Cc: xu xin Cc: Yang Yang Cc: Yunkai Zhang Signed-off-by: Andrew Morton commit 6b47c9f8ee3960d4b46bda4de63429fdfe468989 Author: Wang Yaxin Date: Thu Jul 10 13:54:51 2025 +0800 delaytop: add psi info to show system delay Support showing whole delay of system by reading PSI, just like the first few lines of information output by the top command. the output of delaytop includes both system-wide delay and delay of individual tasks, providing a more comprehensive reflection of system latency status. Use case ======== bash# ./delaytop System Pressure Information: (avg10/avg60/avg300/total) CPU: full: 0.0%/ 0.0%/ 0.0%/0 some: 0.1%/ 0.0%/ 0.0%/14216596 Memory: full: 0.0%/ 0.0%/ 0.0%/34010659 some: 0.0%/ 0.0%/ 0.0%/35406492 IO: full: 0.1%/ 0.0%/ 0.0%/51029453 some: 0.1%/ 0.0%/ 0.0%/55330465 IRQ: full: 0.0%/ 0.0%/ 0.0%/0 Top 20 processes (sorted by CPU delay): PID TGID COMMAND CPU(ms) IO(ms) SWAP(ms) RCL(ms) THR(ms) CMP(ms) WP(ms) IRQ(ms) --------------------------------------------------------------------------------------------- 32 32 kworker/2:0H-sy 23.65 0.00 0.00 0.00 0.00 0.00 0.00 0.00 497 497 kworker/R-scsi_ 1.20 0.00 0.00 0.00 0.00 0.00 0.00 0.00 495 495 kworker/R-scsi_ 1.13 0.00 0.00 0.00 0.00 0.00 0.00 0.00 494 494 scsi_eh_0 1.12 0.00 0.00 0.00 0.00 0.00 0.00 0.00 485 485 kworker/R-ata_s 0.90 0.00 0.00 0.00 0.00 0.00 0.00 0.00 574 574 kworker/R-kdmfl 0.36 0.00 0.00 0.00 0.00 0.00 0.00 0.00 34 34 idle_inject/3 0.33 0.00 0.00 0.00 0.00 0.00 0.00 0.00 1123 1123 nde-netfilter 0.28 0.00 0.00 0.00 0.00 0.00 0.00 0.00 60 60 ksoftirqd/7 0.25 0.00 0.00 0.00 0.00 0.00 0.00 0.00 114 114 kworker/0:2-cgr 0.25 0.00 0.00 0.00 0.00 0.00 0.00 0.00 496 496 scsi_eh_1 0.24 0.00 0.00 0.00 0.00 0.00 0.00 0.00 51 51 cpuhp/6 0.24 0.00 0.00 0.00 0.00 0.00 0.00 0.00 1667 1667 atd 0.24 0.00 0.00 0.00 0.00 0.00 0.00 0.00 45 45 cpuhp/5 0.23 0.00 0.00 0.00 0.00 0.00 0.00 0.00 1102 1102 nde-backupservi 0.22 0.00 0.00 0.00 0.00 0.00 0.00 0.00 1098 1098 systemsettings 0.21 0.00 0.00 0.00 0.00 0.00 0.00 0.00 1100 1100 audit-monitor 0.20 0.00 0.00 0.00 0.00 0.00 0.00 0.00 53 53 migration/6 0.20 0.00 0.00 0.00 0.00 0.00 0.00 0.00 1482 1482 sshd 0.19 0.00 0.00 0.00 0.00 0.00 0.00 0.00 39 39 cpuhp/4 0.19 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Link: https://lkml.kernel.org/r/20250710135451340_5pOgpIFi0M5AE7H44W1D@zte.com.cn Co-developed-by: Fan Yu Signed-off-by: Fan Yu Signed-off-by: Wang Yaxin Signed-off-by: Jiang Kun Cc: Balbir Singh Cc: David Hildenbrand Cc: Peilin He Cc: Qiang Tu Cc: wangyong Cc: xu xin Cc: Yang Yang Cc: Yunkai Zhang Signed-off-by: Andrew Morton commit 599579e857ab8d8f97409f631090e08018f8343b Author: WangYuli Date: Thu Jul 10 21:47:51 2025 +0800 selftests/thermal: remove duplicate newlines in perror calls perror() automatically appends a newline character, so the explicit '\n' in the format strings is redundant and results in duplicate newlines in the output. Remove the redundant '\n' characters from perror() calls in workload_hint_test.c to fix the formatting. Link: https://lkml.kernel.org/r/F482FB1EC020000C+20250710134751.306096-1-wangyuli@uniontech.com Signed-off-by: WangYuli Cc: Guan Wentao Cc: Shuah Khan Signed-off-by: Andrew Morton commit 813b46808822db6838c43e92ba21ce013d23fcdc Author: WangYuli Date: Thu Jul 10 21:04:12 2025 +0800 selftests/thermal: remove duplicate sprintf() call in workload_hint_test Remove redundant sprintf() call that was duplicating the same operation of formatting delay_str with argv[1]. Link: https://lkml.kernel.org/r/6338CD0E839B770B+20250710130412.284531-1-wangyuli@uniontech.com Signed-off-by: WangYuli Cc: Guan Wentao Cc: Shuah Khan Signed-off-by: Andrew Morton commit 36e22416872114cae812cdcdd84a5b99ef30b3de Author: Kuan-Wei Chiu Date: Fri Jun 6 21:47:58 2025 +0800 riscv: optimize gcd() performance on RISC-V without Zbb extension The binary GCD implementation uses FFS (find first set), which benefits from hardware support for the ctz instruction, provided by the Zbb extension on RISC-V. Without Zbb, this results in slower software-emulated behavior. Previously, RISC-V always used the binary GCD, regardless of actual hardware support. This patch improves runtime efficiency by disabling the efficient_ffs_key static branch when Zbb is either not enabled in the kernel (config) or not supported on the executing CPU. This selects the odd-even GCD implementation, which is faster in the absence of efficient FFS. This change ensures the most suitable GCD algorithm is chosen dynamically based on actual hardware capabilities. Link: https://lkml.kernel.org/r/20250606134758.1308400-4-visitorckw@gmail.com Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Signed-off-by: Kuan-Wei Chiu Acked-by: Alexandre Ghiti Cc: Albert Ou Cc: Ching-Chun (Jim) Huang Cc: Palmer Dabbelt Cc: Paul Walmsley Signed-off-by: Andrew Morton commit 26b537edc533058c48f6351569d676703d7d1af3 Author: Kuan-Wei Chiu Date: Fri Jun 6 21:47:57 2025 +0800 riscv: optimize gcd() code size when CONFIG_RISCV_ISA_ZBB is disabled The binary GCD implementation depends on efficient ffs(), which on RISC-V requires hardware support for the Zbb extension. When CONFIG_RISCV_ISA_ZBB is not enabled, the kernel will never use binary GCD, as runtime logic will always fall back to the odd-even implementation. To avoid compiling unused code and reduce code size, select CONFIG_CPU_NO_EFFICIENT_FFS when CONFIG_RISCV_ISA_ZBB is not set. $ ./scripts/bloat-o-meter ./lib/math/gcd.o.old ./lib/math/gcd.o.new add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-274 (-274) Function old new delta gcd 360 86 -274 Total: Before=384, After=110, chg -71.35% Link: https://lkml.kernel.org/r/20250606134758.1308400-3-visitorckw@gmail.com Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Signed-off-by: Kuan-Wei Chiu Acked-by: Alexandre Ghiti Cc: Albert Ou Cc: Ching-Chun (Jim) Huang Cc: Palmer Dabbelt Cc: Paul Walmsley Signed-off-by: Andrew Morton commit b3d5fd6f82dde8c906dc2a587003a44252ae5eae Author: Kuan-Wei Chiu Date: Fri Jun 6 21:47:56 2025 +0800 lib/math/gcd: use static key to select implementation at runtime Patch series "Optimize GCD performance on RISC-V by selecting implementation at runtime", v3. The current implementation of gcd() selects between the binary GCD and the odd-even GCD algorithm at compile time, depending on whether CONFIG_CPU_NO_EFFICIENT_FFS is set. On platforms like RISC-V, however, this compile-time decision can be misleading: even when the compiler emits ctz instructions based on the assumption that they are efficient (as is the case when CONFIG_RISCV_ISA_ZBB is enabled), the actual hardware may lack support for the Zbb extension. In such cases, ffs() falls back to a software implementation at runtime, making the binary GCD algorithm significantly slower than the odd-even variant. To address this, we introduce a static key to allow runtime selection between the binary and odd-even GCD implementations. On RISC-V, the kernel now checks for Zbb support during boot. If Zbb is unavailable, the static key is disabled so that gcd() consistently uses the more efficient odd-even algorithm in that scenario. Additionally, to further reduce code size, we select CONFIG_CPU_NO_EFFICIENT_FFS automatically when CONFIG_RISCV_ISA_ZBB is not enabled, avoiding compilation of the unused binary GCD implementation entirely on systems where it would never be executed. This series ensures that the most efficient GCD algorithm is used in practice and avoids compiling unnecessary code based on hardware capabilities and kernel configuration. This patch (of 3): On platforms like RISC-V, the compiler may generate hardware FFS instructions even if the underlying CPU does not actually support them. Currently, the GCD implementation is chosen at compile time based on CONFIG_CPU_NO_EFFICIENT_FFS, which can result in suboptimal behavior on such systems. Introduce a static key, efficient_ffs_key, to enable runtime selection between the binary GCD (using ffs) and the odd-even GCD implementation. This allows the kernel to default to the faster binary GCD when FFS is efficient, while retaining the ability to fall back when needed. Link: https://lkml.kernel.org/r/20250606134758.1308400-1-visitorckw@gmail.com Link: https://lkml.kernel.org/r/20250606134758.1308400-2-visitorckw@gmail.com Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Signed-off-by: Kuan-Wei Chiu Cc: Albert Ou Cc: Ching-Chun (Jim) Huang Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Alexandre Ghiti Signed-off-by: Andrew Morton commit 08eabe4b9e98d940d2dd6cdb70c7a9187ca54aca Author: Ivan Pravdin Date: Mon Jul 7 22:06:40 2025 -0400 ocfs2: avoid potential ABBA deadlock by reordering tl_inode lock In ocfs2_move_extent(), tl_inode is currently locked after the global bitmap inode. However, in ocfs2_flush_truncate_log(), the lock order is reversed: tl_inode is locked first, followed by the global bitmap inode. This creates a classic ABBA deadlock scenario if two threads attempt these operations concurrently and acquire the locks in different orders. To prevent this, move the tl_inode locking earlier in ocfs2_move_extent(), so that it always precedes the global bitmap inode lock. No functional changes beyond lock ordering. Link: https://lkml.kernel.org/r/20250708020640.387741-1-ipravdin.official@gmail.com Reported-by: syzbot+6bf948e47f9bac7aacfa@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67d5645c.050a0220.1dc86f.0004.GAE@google.com/ Signed-off-by: Ivan Pravdin Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 97103dcec292b8688de142f7a48bd0d46038d3f6 Author: Colin Ian King Date: Tue Jul 8 15:26:04 2025 +0100 squashfs: fix incorrect argument to sizeof in kmalloc_array call The sizeof(void *) is the incorrect argument in the kmalloc_array call, it best to fix this by using sizeof(*cache_folios) instead. Fortunately the sizes of void* and folio* happen to be the same, so this has not shown up as a run time issue. [akpm@linux-foundation.org: fix build] Link: https://lkml.kernel.org/r/20250708142604.1891156-1-colin.i.king@gmail.com Fixes: 2e227ff5e272 ("squashfs: add optional full compressed block caching") Signed-off-by: Colin Ian King Cc: Phillip Lougher Cc: Chanho Min Signed-off-by: Andrew Morton commit c0f98be69f4b550b19f9517157a30f33877bb14d Author: Colin Ian King Date: Tue Jul 8 12:49:00 2025 +0100 squashfs: replace ;; with ; and end of fi declaration There is an extraneous ; after a declaration, remove it. Link: https://lkml.kernel.org/r/20250708114900.1883130-1-colin.i.king@gmail.com Signed-off-by: Colin Ian King Reviewed-by: Phillip Lougher Signed-off-by: Andrew Morton commit 44acc46d182ff36d40cea69db3875440fab72ba5 Author: Ivan Pravdin Date: Mon Jul 7 20:10:09 2025 -0400 ocfs2: avoid NULL pointer dereference in dx_dir_lookup_rec() When a directory entry is not found, ocfs2_dx_dir_lookup_rec() prints an error message that unconditionally dereferences the 'rec' pointer. However, if 'rec' is NULL, this leads to a NULL pointer dereference and a kernel panic. Add an explicit check empty extent list to avoid dereferencing NULL 'rec' pointer. Link: https://lkml.kernel.org/r/20250708001009.372263-1-ipravdin.official@gmail.com Reported-by: syzbot+20282c1b2184a857ac4c@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/67cd7e29.050a0220.e1a89.0007.GAE@google.com/ Signed-off-by: Ivan Pravdin Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 988f451ecb17c359cb34e360fce82039942de7bb Author: Ahelenia Ziemiańska Date: Thu Jul 3 20:21:27 2025 +0200 ocfs2/dlm: fix "take a while" typo Signed-off-by: Ahelenia Ziemiańska Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Joseph Qi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 98aa4d5d242d3a73388271e00e11ce91d8c3c3e1 Author: Lillian Berry Date: Mon Jul 7 09:14:11 2025 +0000 init/main.c: add warning when file specified in rdinit is inaccessible Avoid silently ignoring the initramfs when the file specified in rdinit is not usable. This prints an error that clearly explains the issue (file was not found, vs initramfs was not found). Link: https://lkml.kernel.org/r/20250707091411.1412681-1-lillian@star-ark.net Signed-off-by: Lillian Berry Cc: Al Viro Signed-off-by: Andrew Morton commit 4efec6c0919d9081a52be50d5b5bfa32bf489c75 Author: Zi Li Date: Fri Jun 27 15:29:24 2025 +0800 samples: enhance hung_task detector test with read-write semaphore support Extend the hung_task detector test module to include read-write semaphore support alongside existing mutex and semaphore tests. This module now creates additional debugfs files under /hung_task, namely 'rw_semaphore_read' and 'rw_semaphore_write', in addition to 'mutex' and 'semaphore'. Reading these files with multiple processes triggers a prolonged sleep (256 seconds) while holding the respective lock, enabling hung_task detector testing for various locking mechanisms. This change builds on the extensible hung_task_tests module, adding read-write semaphore functionality to improve test coverage for kernel locking primitives. The implementation ensures proper lock handling and includes checks to prevent redundant data reads. Usage is: > cd /sys/kernel/debug/hung_task > cat mutex & cat mutex # Test mutex blocking > cat semaphore & cat semaphore # Test semaphore blocking > cat rw_semaphore_write \ & cat rw_semaphore_read # Test rwsem blocking > cat rw_semaphore_write \ & cat rw_semaphore_write # Test rwsem blocking Update the Kconfig description to reflect the addition of read-write semaphore debugfs files. Link: https://lkml.kernel.org/r/20250627072924.36567-4-lance.yang@linux.dev Signed-off-by: Zi Li Suggested-by: Masami Hiramatsu (Google) Cc: Anna Schumaker Cc: Boqun Feng Cc: Ingo Molnar Cc: Joel Granados Cc: John Stultz Cc: Kent Overstreet Cc: Mingzhe Yang Cc: Peter Zijlstra Cc: Sergey Senozhatsky Cc: Steven Rostedt Cc: Tomasz Figa Cc: Waiman Long Cc: Will Deacon Cc: Yongliang Gao Signed-off-by: Andrew Morton commit 77da18de55ac6417e48905bec8b3c66f023b15a9 Author: Lance Yang Date: Fri Jun 27 15:29:23 2025 +0800 hung_task: extend hung task blocker tracking to rwsems Inspired by mutex blocker tracking[1], and having already extended it to semaphores, let's now add support for reader-writer semaphores (rwsems). The approach is simple: when a task enters TASK_UNINTERRUPTIBLE while waiting for an rwsem, we just call hung_task_set_blocker(). The hung task detector can then query the rwsem's owner to identify the lock holder. Tracking works reliably for writers, as there can only be a single writer holding the lock, and its task struct is stored in the owner field. The main challenge lies with readers. The owner field points to only one of many concurrent readers, so we might lose track of the blocker if that specific reader unlocks, even while others remain. This is not a significant issue, however. In practice, long-lasting lock contention is almost always caused by a writer. Therefore, reliably tracking the writer is the primary goal of this patch series ;) With this change, the hung task detector can now show blocker task's info like below: [Fri Jun 27 15:21:34 2025] INFO: task cat:28631 blocked for more than 122 seconds. [Fri Jun 27 15:21:34 2025] Tainted: G S 6.16.0-rc3 #8 [Fri Jun 27 15:21:34 2025] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [Fri Jun 27 15:21:34 2025] task:cat state:D stack:0 pid:28631 tgid:28631 ppid:28501 task_flags:0x400000 flags:0x00004000 [Fri Jun 27 15:21:34 2025] Call Trace: [Fri Jun 27 15:21:34 2025] [Fri Jun 27 15:21:34 2025] __schedule+0x7c7/0x1930 [Fri Jun 27 15:21:34 2025] ? __pfx___schedule+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? policy_nodemask+0x215/0x340 [Fri Jun 27 15:21:34 2025] ? _raw_spin_lock_irq+0x8a/0xe0 [Fri Jun 27 15:21:34 2025] ? __pfx__raw_spin_lock_irq+0x10/0x10 [Fri Jun 27 15:21:34 2025] schedule+0x6a/0x180 [Fri Jun 27 15:21:34 2025] schedule_preempt_disabled+0x15/0x30 [Fri Jun 27 15:21:34 2025] rwsem_down_read_slowpath+0x55e/0xe10 [Fri Jun 27 15:21:34 2025] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? __pfx___might_resched+0x10/0x10 [Fri Jun 27 15:21:34 2025] down_read+0xc9/0x230 [Fri Jun 27 15:21:34 2025] ? __pfx_down_read+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? __debugfs_file_get+0x14d/0x700 [Fri Jun 27 15:21:34 2025] ? __pfx___debugfs_file_get+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? handle_pte_fault+0x52a/0x710 [Fri Jun 27 15:21:34 2025] ? selinux_file_permission+0x3a9/0x590 [Fri Jun 27 15:21:34 2025] read_dummy_rwsem_read+0x4a/0x90 [Fri Jun 27 15:21:34 2025] full_proxy_read+0xff/0x1c0 [Fri Jun 27 15:21:34 2025] ? rw_verify_area+0x6d/0x410 [Fri Jun 27 15:21:34 2025] vfs_read+0x177/0xa50 [Fri Jun 27 15:21:34 2025] ? __pfx_vfs_read+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? fdget_pos+0x1cf/0x4c0 [Fri Jun 27 15:21:34 2025] ksys_read+0xfc/0x1d0 [Fri Jun 27 15:21:34 2025] ? __pfx_ksys_read+0x10/0x10 [Fri Jun 27 15:21:34 2025] do_syscall_64+0x66/0x2d0 [Fri Jun 27 15:21:34 2025] entry_SYSCALL_64_after_hwframe+0x76/0x7e [Fri Jun 27 15:21:34 2025] RIP: 0033:0x7f3f8faefb40 [Fri Jun 27 15:21:34 2025] RSP: 002b:00007ffdeda5ab98 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [Fri Jun 27 15:21:34 2025] RAX: ffffffffffffffda RBX: 0000000000010000 RCX: 00007f3f8faefb40 [Fri Jun 27 15:21:34 2025] RDX: 0000000000010000 RSI: 00000000010fa000 RDI: 0000000000000003 [Fri Jun 27 15:21:34 2025] RBP: 00000000010fa000 R08: 0000000000000000 R09: 0000000000010fff [Fri Jun 27 15:21:34 2025] R10: 00007ffdeda59fe0 R11: 0000000000000246 R12: 00000000010fa000 [Fri Jun 27 15:21:34 2025] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000fff [Fri Jun 27 15:21:34 2025] [Fri Jun 27 15:21:34 2025] INFO: task cat:28631 blocked on an rw-semaphore likely owned by task cat:28630 [Fri Jun 27 15:21:34 2025] task:cat state:S stack:0 pid:28630 tgid:28630 ppid:28501 task_flags:0x400000 flags:0x00004000 [Fri Jun 27 15:21:34 2025] Call Trace: [Fri Jun 27 15:21:34 2025] [Fri Jun 27 15:21:34 2025] __schedule+0x7c7/0x1930 [Fri Jun 27 15:21:34 2025] ? __pfx___schedule+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? __mod_timer+0x304/0xa80 [Fri Jun 27 15:21:34 2025] schedule+0x6a/0x180 [Fri Jun 27 15:21:34 2025] schedule_timeout+0xfb/0x230 [Fri Jun 27 15:21:34 2025] ? __pfx_schedule_timeout+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? __pfx_process_timeout+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? down_write+0xc4/0x140 [Fri Jun 27 15:21:34 2025] msleep_interruptible+0xbe/0x150 [Fri Jun 27 15:21:34 2025] read_dummy_rwsem_write+0x54/0x90 [Fri Jun 27 15:21:34 2025] full_proxy_read+0xff/0x1c0 [Fri Jun 27 15:21:34 2025] ? rw_verify_area+0x6d/0x410 [Fri Jun 27 15:21:34 2025] vfs_read+0x177/0xa50 [Fri Jun 27 15:21:34 2025] ? __pfx_vfs_read+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? fdget_pos+0x1cf/0x4c0 [Fri Jun 27 15:21:34 2025] ksys_read+0xfc/0x1d0 [Fri Jun 27 15:21:34 2025] ? __pfx_ksys_read+0x10/0x10 [Fri Jun 27 15:21:34 2025] do_syscall_64+0x66/0x2d0 [Fri Jun 27 15:21:34 2025] entry_SYSCALL_64_after_hwframe+0x76/0x7e [Fri Jun 27 15:21:34 2025] RIP: 0033:0x7f8f288efb40 [Fri Jun 27 15:21:34 2025] RSP: 002b:00007ffffb631038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [Fri Jun 27 15:21:34 2025] RAX: ffffffffffffffda RBX: 0000000000010000 RCX: 00007f8f288efb40 [Fri Jun 27 15:21:34 2025] RDX: 0000000000010000 RSI: 000000002a4b5000 RDI: 0000000000000003 [Fri Jun 27 15:21:34 2025] RBP: 000000002a4b5000 R08: 0000000000000000 R09: 0000000000010fff [Fri Jun 27 15:21:34 2025] R10: 00007ffffb630460 R11: 0000000000000246 R12: 000000002a4b5000 [Fri Jun 27 15:21:34 2025] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000fff [Fri Jun 27 15:21:34 2025] [1] https://lore.kernel.org/all/174046694331.2194069.15472952050240807469.stgit@mhiramat.tok.corp.google.com/ Link: https://lkml.kernel.org/r/20250627072924.36567-3-lance.yang@linux.dev Signed-off-by: Lance Yang Suggested-by: Masami Hiramatsu (Google) Reviewed-by: Masami Hiramatsu (Google) Cc: Anna Schumaker Cc: Boqun Feng Cc: Ingo Molnar Cc: Joel Granados Cc: John Stultz Cc: Kent Overstreet Cc: Mingzhe Yang Cc: Peter Zijlstra Cc: Sergey Senozhatsky Cc: Steven Rostedt Cc: Tomasz Figa Cc: Waiman Long Cc: Will Deacon Cc: Yongliang Gao Cc: Zi Li Signed-off-by: Andrew Morton commit ae2da51def76020fa16f53cd3446c00cafe41008 Author: Lance Yang Date: Fri Jun 27 15:29:22 2025 +0800 locking/rwsem: make owner helpers globally available Patch series "extend hung task blocker tracking to rwsems". Inspired by mutex blocker tracking[1], and having already extended it to semaphores, let's now add support for reader-writer semaphores (rwsems). The approach is simple: when a task enters TASK_UNINTERRUPTIBLE while waiting for an rwsem, we just call hung_task_set_blocker(). The hung task detector can then query the rwsem's owner to identify the lock holder. Tracking works reliably for writers, as there can only be a single writer holding the lock, and its task struct is stored in the owner field. The main challenge lies with readers. The owner field points to only one of many concurrent readers, so we might lose track of the blocker if that specific reader unlocks, even while others remain. This is not a significant issue, however. In practice, long-lasting lock contention is almost always caused by a writer. Therefore, reliably tracking the writer is the primary goal of this patch series ;) With this change, the hung task detector can now show blocker task's info like below: [Fri Jun 27 15:21:34 2025] INFO: task cat:28631 blocked for more than 122 seconds. [Fri Jun 27 15:21:34 2025] Tainted: G S 6.16.0-rc3 #8 [Fri Jun 27 15:21:34 2025] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [Fri Jun 27 15:21:34 2025] task:cat state:D stack:0 pid:28631 tgid:28631 ppid:28501 task_flags:0x400000 flags:0x00004000 [Fri Jun 27 15:21:34 2025] Call Trace: [Fri Jun 27 15:21:34 2025] [Fri Jun 27 15:21:34 2025] __schedule+0x7c7/0x1930 [Fri Jun 27 15:21:34 2025] ? __pfx___schedule+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? policy_nodemask+0x215/0x340 [Fri Jun 27 15:21:34 2025] ? _raw_spin_lock_irq+0x8a/0xe0 [Fri Jun 27 15:21:34 2025] ? __pfx__raw_spin_lock_irq+0x10/0x10 [Fri Jun 27 15:21:34 2025] schedule+0x6a/0x180 [Fri Jun 27 15:21:34 2025] schedule_preempt_disabled+0x15/0x30 [Fri Jun 27 15:21:34 2025] rwsem_down_read_slowpath+0x55e/0xe10 [Fri Jun 27 15:21:34 2025] ? __pfx_rwsem_down_read_slowpath+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? __pfx___might_resched+0x10/0x10 [Fri Jun 27 15:21:34 2025] down_read+0xc9/0x230 [Fri Jun 27 15:21:34 2025] ? __pfx_down_read+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? __debugfs_file_get+0x14d/0x700 [Fri Jun 27 15:21:34 2025] ? __pfx___debugfs_file_get+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? handle_pte_fault+0x52a/0x710 [Fri Jun 27 15:21:34 2025] ? selinux_file_permission+0x3a9/0x590 [Fri Jun 27 15:21:34 2025] read_dummy_rwsem_read+0x4a/0x90 [Fri Jun 27 15:21:34 2025] full_proxy_read+0xff/0x1c0 [Fri Jun 27 15:21:34 2025] ? rw_verify_area+0x6d/0x410 [Fri Jun 27 15:21:34 2025] vfs_read+0x177/0xa50 [Fri Jun 27 15:21:34 2025] ? __pfx_vfs_read+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? fdget_pos+0x1cf/0x4c0 [Fri Jun 27 15:21:34 2025] ksys_read+0xfc/0x1d0 [Fri Jun 27 15:21:34 2025] ? __pfx_ksys_read+0x10/0x10 [Fri Jun 27 15:21:34 2025] do_syscall_64+0x66/0x2d0 [Fri Jun 27 15:21:34 2025] entry_SYSCALL_64_after_hwframe+0x76/0x7e [Fri Jun 27 15:21:34 2025] RIP: 0033:0x7f3f8faefb40 [Fri Jun 27 15:21:34 2025] RSP: 002b:00007ffdeda5ab98 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [Fri Jun 27 15:21:34 2025] RAX: ffffffffffffffda RBX: 0000000000010000 RCX: 00007f3f8faefb40 [Fri Jun 27 15:21:34 2025] RDX: 0000000000010000 RSI: 00000000010fa000 RDI: 0000000000000003 [Fri Jun 27 15:21:34 2025] RBP: 00000000010fa000 R08: 0000000000000000 R09: 0000000000010fff [Fri Jun 27 15:21:34 2025] R10: 00007ffdeda59fe0 R11: 0000000000000246 R12: 00000000010fa000 [Fri Jun 27 15:21:34 2025] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000fff [Fri Jun 27 15:21:34 2025] [Fri Jun 27 15:21:34 2025] INFO: task cat:28631 blocked on an rw-semaphore likely owned by task cat:28630 [Fri Jun 27 15:21:34 2025] task:cat state:S stack:0 pid:28630 tgid:28630 ppid:28501 task_flags:0x400000 flags:0x00004000 [Fri Jun 27 15:21:34 2025] Call Trace: [Fri Jun 27 15:21:34 2025] [Fri Jun 27 15:21:34 2025] __schedule+0x7c7/0x1930 [Fri Jun 27 15:21:34 2025] ? __pfx___schedule+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? __mod_timer+0x304/0xa80 [Fri Jun 27 15:21:34 2025] schedule+0x6a/0x180 [Fri Jun 27 15:21:34 2025] schedule_timeout+0xfb/0x230 [Fri Jun 27 15:21:34 2025] ? __pfx_schedule_timeout+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? __pfx_process_timeout+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? down_write+0xc4/0x140 [Fri Jun 27 15:21:34 2025] msleep_interruptible+0xbe/0x150 [Fri Jun 27 15:21:34 2025] read_dummy_rwsem_write+0x54/0x90 [Fri Jun 27 15:21:34 2025] full_proxy_read+0xff/0x1c0 [Fri Jun 27 15:21:34 2025] ? rw_verify_area+0x6d/0x410 [Fri Jun 27 15:21:34 2025] vfs_read+0x177/0xa50 [Fri Jun 27 15:21:34 2025] ? __pfx_vfs_read+0x10/0x10 [Fri Jun 27 15:21:34 2025] ? fdget_pos+0x1cf/0x4c0 [Fri Jun 27 15:21:34 2025] ksys_read+0xfc/0x1d0 [Fri Jun 27 15:21:34 2025] ? __pfx_ksys_read+0x10/0x10 [Fri Jun 27 15:21:34 2025] do_syscall_64+0x66/0x2d0 [Fri Jun 27 15:21:34 2025] entry_SYSCALL_64_after_hwframe+0x76/0x7e [Fri Jun 27 15:21:34 2025] RIP: 0033:0x7f8f288efb40 [Fri Jun 27 15:21:34 2025] RSP: 002b:00007ffffb631038 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [Fri Jun 27 15:21:34 2025] RAX: ffffffffffffffda RBX: 0000000000010000 RCX: 00007f8f288efb40 [Fri Jun 27 15:21:34 2025] RDX: 0000000000010000 RSI: 000000002a4b5000 RDI: 0000000000000003 [Fri Jun 27 15:21:34 2025] RBP: 000000002a4b5000 R08: 0000000000000000 R09: 0000000000010fff [Fri Jun 27 15:21:34 2025] R10: 00007ffffb630460 R11: 0000000000000246 R12: 000000002a4b5000 [Fri Jun 27 15:21:34 2025] R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000fff [Fri Jun 27 15:21:34 2025] This patch (of 3): In preparation for extending blocker tracking to support rwsems, make the rwsem_owner() and is_rwsem_reader_owned() helpers globally available for determining if the blocker is a writer or one of the readers. Additionally, a stale owner pointer in a reader-owned rwsem can lead to false positives in blocker tracking when CONFIG_DETECT_HUNG_TASK_BLOCKER is enabled. To mitigate this, clear the owner field on the reader unlock path, similar to what CONFIG_DEBUG_RWSEMS does. A NULL owner is better than a stale one for diagnostics. Link: https://lkml.kernel.org/r/20250627072924.36567-1-lance.yang@linux.dev Link: https://lkml.kernel.org/r/20250627072924.36567-2-lance.yang@linux.dev Link: https://lore.kernel.org/all/174046694331.2194069.15472952050240807469.stgit@mhiramat.tok.corp.google.com/ [1] Signed-off-by: Lance Yang Reviewed-by: Masami Hiramatsu (Google) Cc: Anna Schumaker Cc: Boqun Feng Cc: Ingo Molnar Cc: Joel Granados Cc: John Stultz Cc: Kent Overstreet Cc: Mingzhe Yang Cc: Peter Zijlstra Cc: Sergey Senozhatsky Cc: Steven Rostedt Cc: Tomasz Figa Cc: Waiman Long Cc: Will Deacon Cc: Yongliang Gao Cc: Zi Li Signed-off-by: Andrew Morton commit 249e7ced7271d8a7e733b1fe7ea7a221eb46698f Author: Easwar Hariharan Date: Thu Jul 3 15:51:32 2025 -0700 coccinelle: misc: secs_to_jiffies: implement context and report modes As requested by Ricardo and Jakub, implement report and context modes for the secs_to_jiffies Coccinelle script. While here, add the option to look for opportunities to use secs_to_jiffies() in headers. Link: https://lkml.kernel.org/r/20250703225145.152288-1-eahariha@linux.microsoft.com Signed-off-by: Easwar Hariharan Closes: https://lore.kernel.org/all/20250129-secs_to_jiffles-v1-1-35a5e16b9f03@chromium.org/ Closes: https://lore.kernel.org/all/20250221162107.409ae333@kernel.org/ Tested-by: Ricardo Ribalda Cc: Julia Lawall Cc: Nicolas Palix Cc: Jakub Kicinski Cc: Ricardo Ribalda Signed-off-by: Andrew Morton commit ee13240cd78b68430eb50af4721b3f18dd08af29 Author: Feng Tang Date: Thu Jul 3 10:10:04 2025 +0800 panic: add note that panic_print sysctl interface is deprecated Add a dedicated core parameter 'panic_console_replay' for controlling console replay, and add note that 'panic_print' sysctl interface will be obsoleted by 'panic_sys_info' and 'panic_console_replay'. When it happens, the SYS_INFO_PANIC_CONSOLE_REPLAY can be removed as well. Link: https://lkml.kernel.org/r/20250703021004.42328-6-feng.tang@linux.alibaba.com Signed-off-by: Feng Tang Suggested-by: Petr Mladek Cc: John Ogness Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Steven Rostedt Cc: Nathan Chancellor Signed-off-by: Andrew Morton commit 9743d12d0c63968320ece31e2e48723f3235be6d Author: Feng Tang Date: Thu Jul 3 10:10:03 2025 +0800 panic: add 'panic_sys_info=' setup option for kernel cmdline 'panic_sys_info=' sysctl interface is already added for runtime setting. Add counterpart kernel cmdline option for boottime setting. Link: https://lkml.kernel.org/r/20250703021004.42328-5-feng.tang@linux.alibaba.com Signed-off-by: Feng Tang Suggested-by: Petr Mladek Cc: John Ogness Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Steven Rostedt Cc: Nathan Chancellor Signed-off-by: Andrew Morton commit d747755917bf8ae08f490c3fe7d8e321afab8127 Author: Feng Tang Date: Thu Jul 3 10:10:02 2025 +0800 panic: add 'panic_sys_info' sysctl to take human readable string parameter Bitmap definition for 'panic_print' is hard to remember and decode. Add 'panic_sys_info='sysctl to take human readable string like "tasks,mem,timers,locks,ftrace,..." and translate it into bitmap. The detailed mapping is: SYS_INFO_TASKS "tasks" SYS_INFO_MEM "mem" SYS_INFO_TIMERS "timers" SYS_INFO_LOCKS "locks" SYS_INFO_FTRACE "ftrace" SYS_INFO_ALL_CPU_BT "all_bt" SYS_INFO_BLOCKED_TASKS "blocked_tasks" [nathan@kernel.org: add __maybe_unused to sys_info_avail] Link: https://lkml.kernel.org/r/20250708-fix-clang-sys_info_avail-warning-v1-1-60d239eacd64@kernel.org Link: https://lkml.kernel.org/r/20250703021004.42328-4-feng.tang@linux.alibaba.com Signed-off-by: Feng Tang Suggested-by: Petr Mladek Cc: John Ogness Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Steven Rostedt Cc: Nathan Chancellor Cc: Andy Shevchenko Signed-off-by: Andrew Morton commit b76e89e50fc3693b7b8a443ed906320d8ccb93fd Author: Feng Tang Date: Thu Jul 3 10:10:01 2025 +0800 panic: generalize panic_print's function to show sys info 'panic_print' was introduced to help debugging kernel panic by dumping different kinds of system information like tasks' call stack, memory, ftrace buffer, etc. Actually this function could also be used to help debugging other cases like task-hung, soft/hard lockup, etc. where user may need the snapshot of system info at that time. Extract system info dump function related code from panic.c to separate file sys_info.[ch], for wider usage by other kernel parts for debugging. Also modify the macro names about singulars/plurals. Link: https://lkml.kernel.org/r/20250703021004.42328-3-feng.tang@linux.alibaba.com Signed-off-by: Feng Tang Suggested-by: Petr Mladek Cc: John Ogness Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Steven Rostedt Cc: Nathan Chancellor Signed-off-by: Andrew Morton commit 261743b0135d1d578cab407ba0cf226df30b43d8 Author: Feng Tang Date: Thu Jul 3 10:10:00 2025 +0800 panic: clean up code for console replay Patch series "generalize panic_print's dump function to be used by other kernel parts", v3. When working on kernel stability issues, panic, task-hung and software/hardware lockup are frequently met. And to debug them, user may need lots of system information at that time, like task call stacks, lock info, memory info etc. panic case already has panic_print_sys_info() for this purpose, and has a 'panic_print' bitmask to control what kinds of information is needed, which is also helpful to debug other task-hung and lockup cases. So this patchset extracts the function out to a new file 'lib/sys_info.c', and makes it available for other cases which also need to dump system info for debugging. Also as suggested by Petr Mladek, add 'panic_sys_info=' interface to take human readable string like "tasks,mem,locks,timers,ftrace,....", and eventually obsolete the current 'panic_print' bitmap interface. In RFC and V1 version, hung_task and SW/HW watchdog modules are enabled with the new sys_info dump interface. In v2, they are kept out for better review of current change, and will be posted later. Locally these have been used in our bug chasing for stability issues and was proven helpful. Many thanks to Petr Mladek for great suggestions on both the code and architectures! This patch (of 5): Currently the panic_print_sys_info() was called twice with different parameters to handle console replay case, which is kind of confusing. Add panic_console_replay() explicitly and rename 'PANIC_PRINT_ALL_PRINTK_MSG' to 'PANIC_CONSOLE_REPLAY', to make the code straightforward. The related kernel document is also updated. Link: https://lkml.kernel.org/r/20250703021004.42328-1-feng.tang@linux.alibaba.com Link: https://lkml.kernel.org/r/20250703021004.42328-2-feng.tang@linux.alibaba.com Signed-off-by: Feng Tang Suggested-by: Petr Mladek Reviewed-by: Petr Mladek Cc: John Ogness Cc: Jonathan Corbet Cc: Lance Yang Cc: "Paul E . McKenney" Cc: Steven Rostedt Cc: Nathan Chancellor Signed-off-by: Andrew Morton commit bf8be1c3610829056e5445282ca92ca7b7a4ba7b Author: Jiri Bohac Date: Thu Jun 12 12:20:04 2025 +0200 x86: implement crashkernel cma reservation Implement the crashkernel CMA reservation for x86: - enable parsing of the cma suffix by parse_crashkernel() - reserve memory with reserve_crashkernel_cma() - add the CMA-reserved ranges to the e820 map for the crash kernel - exclude the CMA-reserved ranges from vmcore Link: https://lkml.kernel.org/r/aEqp1LD2og4QeBw9@dwarf.suse.cz Signed-off-by: Jiri Bohac Cc: Baoquan He Cc: Dave Young Cc: David Hildenbrand Cc: Donald Dutile Cc: Michal Hocko Cc: Philipp Rudo Cc: Pingfan Liu Cc: Tao Liu Cc: Vivek Goyal Signed-off-by: Andrew Morton commit e1280f3071f11abc1bacd84937ecf077dce449f3 Author: Jiri Bohac Date: Thu Jun 12 12:18:40 2025 +0200 kdump: wait for DMA to finish when using CMA When re-using the CMA area for kdump there is a risk of pending DMA into pinned user pages in the CMA area. Pages residing in CMA areas can usually not get long-term pinned and are instead migrated away from the CMA area, so long-term pinning is typically not a concern. (BUGs in the kernel might still lead to long-term pinning of such pages if everything goes wrong.) Pages pinned without FOLL_LONGTERM remain in the CMA and may possibly be the source or destination of a pending DMA transfer. Although there is no clear specification how long a page may be pinned without FOLL_LONGTERM, pinning without the flag shows an intent of the caller to only use the memory for short-lived DMA transfers, not a transfer initiated by a device asynchronously at a random time in the future. Add a delay of CMA_DMA_TIMEOUT_SEC seconds before starting the kdump kernel, giving such short-lived DMA transfers time to finish before the CMA memory is re-used by the kdump kernel. Set CMA_DMA_TIMEOUT_SEC to 10 seconds - chosen arbitrarily as both a huge margin for a DMA transfer, yet not increasing the kdump time too significantly. Link: https://lkml.kernel.org/r/aEqpgDIBndZ5LXSo@dwarf.suse.cz Signed-off-by: Jiri Bohac Acked-by: David Hildenbrand Cc: Baoquan He Cc: Dave Young Cc: Donald Dutile Cc: Michal Hocko Cc: Philipp Rudo Cc: Pingfan Liu Cc: Tao Liu Cc: Vivek Goyal Signed-off-by: Andrew Morton commit ce1bf19a34dfa1f418037cebe11f5d2c7adf9d1e Author: Jiri Bohac Date: Thu Jun 12 12:17:39 2025 +0200 kdump, documentation: describe craskernel CMA reservation Describe the new crashkernel ",cma" suffix in Documentation/ Link: https://lkml.kernel.org/r/aEqpQwUy6gqSiUkV@dwarf.suse.cz Signed-off-by: Jiri Bohac Cc: Baoquan He Cc: Dave Young Cc: David Hildenbrand Cc: Donald Dutile Cc: Michal Hocko Cc: Philipp Rudo Cc: Pingfan Liu Cc: Tao Liu Cc: Vivek Goyal Signed-off-by: Andrew Morton commit ab475510e0422bb5672d465f9d0f523d72fdb7f1 Author: Jiri Bohac Date: Thu Jun 12 12:16:39 2025 +0200 kdump: implement reserve_crashkernel_cma reserve_crashkernel_cma() reserves CMA ranges for the crash kernel. If allocating the requested size fails, try to reserve in smaller blocks. Store the reserved ranges in the crashk_cma_ranges array and the number of ranges in crashk_cma_cnt. Link: https://lkml.kernel.org/r/aEqpBwOy_ekm0gw9@dwarf.suse.cz Signed-off-by: Jiri Bohac Cc: Baoquan He Cc: Dave Young Cc: David Hildenbrand Cc: Donald Dutile Cc: Michal Hocko Cc: Philipp Rudo Cc: Pingfan Liu Cc: Tao Liu Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 35c18f2933c596b4fd6a98baee36f3137d133a5f Author: Jiri Bohac Date: Thu Jun 12 12:13:21 2025 +0200 Add a new optional ",cma" suffix to the crashkernel= command line option Patch series "kdump: crashkernel reservation from CMA", v5. This series implements a way to reserve additional crash kernel memory using CMA. Currently, all the memory for the crash kernel is not usable by the 1st (production) kernel. It is also unmapped so that it can't be corrupted by the fault that will eventually trigger the crash. This makes sense for the memory actually used by the kexec-loaded crash kernel image and initrd and the data prepared during the load (vmcoreinfo, ...). However, the reserved space needs to be much larger than that to provide enough run-time memory for the crash kernel and the kdump userspace. Estimating the amount of memory to reserve is difficult. Being too careful makes kdump likely to end in OOM, being too generous takes even more memory from the production system. Also, the reservation only allows reserving a single contiguous block (or two with the "low" suffix). I've seen systems where this fails because the physical memory is fragmented. By reserving additional crashkernel memory from CMA, the main crashkernel reservation can be just large enough to fit the kernel and initrd image, minimizing the memory taken away from the production system. Most of the run-time memory for the crash kernel will be memory previously available to userspace in the production system. As this memory is no longer wasted, the reservation can be done with a generous margin, making kdump more reliable. Kernel memory that we need to preserve for dumping is normally not allocated from CMA, unless it is explicitly allocated as movable. Currently this is only the case for memory ballooning and zswap. Such movable memory will be missing from the vmcore. User data is typically not dumped by makedumpfile. When dumping of user data is intended this new CMA reservation cannot be used. There are five patches in this series: The first adds a new ",cma" suffix to the recenly introduced generic crashkernel parsing code. parse_crashkernel() takes one more argument to store the cma reservation size. The second patch implements reserve_crashkernel_cma() which performs the reservation. If the requested size is not available in a single range, multiple smaller ranges will be reserved. The third patch updates Documentation/, explicitly mentioning the potential DMA corruption of the CMA-reserved memory. The fourth patch adds a short delay before booting the kdump kernel, allowing pending DMA transfers to finish. The fifth patch enables the functionality for x86 as a proof of concept. There are just three things every arch needs to do: - call reserve_crashkernel_cma() - include the CMA-reserved ranges in the physical memory map - exclude the CMA-reserved ranges from the memory available through /proc/vmcore by excluding them from the vmcoreinfo PT_LOAD ranges. Adding other architectures is easy and I can do that as soon as this series is merged. With this series applied, specifying crashkernel=100M craskhernel=1G,cma on the command line will make a standard crashkernel reservation of 100M, where kexec will load the kernel and initrd. An additional 1G will be reserved from CMA, still usable by the production system. The crash kernel will have 1.1G memory available. The 100M can be reliably predicted based on the size of the kernel and initrd. The new cma suffix is completely optional. When no crashkernel=size,cma is specified, everything works as before. This patch (of 5): Add a new cma_size parameter to parse_crashkernel(). When not NULL, call __parse_crashkernel to parse the CMA reservation size from "crashkernel=size,cma" and store it in cma_size. Set cma_size to NULL in all calls to parse_crashkernel(). Link: https://lkml.kernel.org/r/aEqnxxfLZMllMC8I@dwarf.suse.cz Link: https://lkml.kernel.org/r/aEqoQckgoTQNULnh@dwarf.suse.cz Signed-off-by: Jiri Bohac Cc: Baoquan He Cc: Dave Young Cc: Donald Dutile Cc: Michal Hocko Cc: Philipp Rudo Cc: Pingfan Liu Cc: Tao Liu Cc: Vivek Goyal Cc: David Hildenbrand Signed-off-by: Andrew Morton commit 9989db9f230542cfc097be3291b9457173371eb1 Author: Sidhartha Kumar Date: Fri Jul 11 10:59:10 2025 -0400 mm/page_owner: convert set_page_owner_migrate_reason() to folios Both callers of set_page_owner_migrate_reason() use folios. Convert the function to take a folio directly and move the &folio->page conversion inside __set_page_owner_migrate_reason(). Link: https://lkml.kernel.org/r/20250711145910.90135-1-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Matthew Wilcox (Oracle) Acked-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Oscar Salvador Cc: Muchun Song Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 5bd88fef6a0858bc80723de2e63168965054705d Author: Thorsten Blum Date: Sat Jul 12 19:45:17 2025 +0200 mm/memfd: replace deprecated strcpy() with memcpy() in alloc_name() strcpy() is deprecated; use memcpy() instead. Not copying the NUL terminator is safe because strncpy_from_user() would overwrite it anyway by appending uname to the destination buffer at index MFD_NAME_PREFIX_LEN. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Link: https://lkml.kernel.org/r/20250712174516.64243-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Cc: Baolin Wang Cc: Hugh Dickins Signed-off-by: Andrew Morton commit 5add26c0a18636e8e9fe409d4591c8a36e1bf695 Author: SeongJae Park Date: Sat Jul 12 12:50:16 2025 -0700 mm/damon/core: remove damon_callback All damon_callback usages are replicated by damon_call() and damos_walk(). Time to say goodbye. Remove damon_callback. Link: https://lkml.kernel.org/r/20250712195016.151108-15-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 0c96decca508f681209d18163f06809331746280 Author: SeongJae Park Date: Sat Jul 12 12:50:15 2025 -0700 mm/damon/sysfs: remove damon_sysfs_before_terminate() DAMON core layer does target cleanup on its own. Remove duplicated and unnecessarily selective cleanup attempts in DAMON sysfs interface. Link: https://lkml.kernel.org/r/20250712195016.151108-14-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 3a69f1635769e976151625798cc6597301150296 Author: SeongJae Park Date: Sat Jul 12 12:50:14 2025 -0700 mm/damon/core: destroy targets when kdamond_fn() finish When kdamond_fn() completes, the targets are kept. Those are kept to let callers do additional cleanups if they need. There are no such additional cleanups though. DAMON sysfs interface deallocates those in before_terminate() callback, to reduce unnecessary memory usage, for [f]vaddr use case. Just destroy the targets for every case in the core layer. This saves more memory and simplifies the logic. Link: https://lkml.kernel.org/r/20250712195016.151108-13-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit f59ae147abb7905cc4656cee5c4c6ae7b53db75a Author: SeongJae Park Date: Sat Jul 12 12:50:13 2025 -0700 mm/damon/sysfs: remove damon_sysfs_destroy_targets() The function was introduced for putting pids and deallocating unnecessary targets. Hence it is called before damon_destroy_ctx(). Now vaddr puts pid for each target destruction (cleanup_target()). damon_destroy_ctx() deallocates the targets anyway. So damon_sysfs_destroy_targets() has no reason to exist. Remove it. Link: https://lkml.kernel.org/r/20250712195016.151108-12-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit ff01aba6e45833395a3739fa7e8bd42251be0254 Author: SeongJae Park Date: Sat Jul 12 12:50:12 2025 -0700 mm/damon/vaddr: put pid in cleanup_target() Implement cleanup_target() callback for [f]vaddr, which calls put_pid() for each target that will be destroyed. Also remove redundant put_pid() calls in core, sysfs and sample modules, which were required to be done redundantly due to the lack of such self cleanup in vaddr. Link: https://lkml.kernel.org/r/20250712195016.151108-11-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 7114bc5e01cf393e1fdc97e10399eb9451b6af45 Author: SeongJae Park Date: Sat Jul 12 12:50:11 2025 -0700 mm/damon/core: add cleanup_target() ops callback Some DAMON operation sets may need additional cleanup per target. For example, [f]vaddr need to put pids of each target. Each user and core logic is doing that redundantly. Add another DAMON ops callback that will be used for doing such cleanups in operations set layer. [sj@kernel.org: add kernel-doc comment for damon_operations->cleanup_target] Link: https://lkml.kernel.org/r/20250715185239.89152-2-sj@kernel.org [sj@kernel.org: remove damon_ctx->callback kernel-doc comment] Link: https://lkml.kernel.org/r/20250715185239.89152-3-sj@kernel.org Link: https://lkml.kernel.org/r/20250712195016.151108-10-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit d4614161fb6d4a56ead3e8e3e9cafa83a54747e4 Author: SeongJae Park Date: Sat Jul 12 12:50:10 2025 -0700 mm/damon/core: do not call ops.cleanup() when destroying targets damon_operations.cleanup() is documented to be called for kdamond termination, but also being called for targets destruction, which is done for any damon_ctx destruction. Nobody is using the callback for now, though. Remove the cleanup() call under the destruction. Link: https://lkml.kernel.org/r/20250712195016.151108-9-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit cc9c1b8c205beda5915ce935463f15cc05ff9f49 Author: SeongJae Park Date: Sat Jul 12 12:50:09 2025 -0700 samples/damon/wsse: use damon_call() repeat mode instead of damon_callback wsse uses damon_callback for periodically reading DAMON internal data. Use its alternative, damon_call() repeat mode. Link: https://lkml.kernel.org/r/20250712195016.151108-8-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit a6c33f1054e3c717ef001d292b6f0350c6388308 Author: SeongJae Park Date: Sat Jul 12 12:50:08 2025 -0700 samples/damon/prcl: use damon_call() repeat mode instead of damon_callback prcl uses damon_callback for periodically reading DAMON internal data. Use its alternative, damon_call() repeat mode. Link: https://lkml.kernel.org/r/20250712195016.151108-7-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 9cc8f00e527b37f001e6003ce26108fe111ec418 Author: SeongJae Park Date: Sat Jul 12 12:50:07 2025 -0700 mm/damon/lru_sort: use damon_call() repeat mode instead of damon_callback DAMON_LRU_SORT uses damon_callback for periodically reading and writing DAMON internal data and parameters. Use its alternative, damon_call() repeat mode. Link: https://lkml.kernel.org/r/20250712195016.151108-6-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 5da7c7031853373f4f3208a1102bd8b27b44f8b7 Author: SeongJae Park Date: Sat Jul 12 12:50:06 2025 -0700 mm/damon/reclaim: use damon_call() repeat mode instead of damon_callback DAMON_RECLAIM uses damon_callback for periodically reading and writing DAMON internal data and parameters. Use its alternative, damon_call() repeat mode. Link: https://lkml.kernel.org/r/20250712195016.151108-5-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 405f61996d9d2e9d497cd9f6b66f41dc28d3d1d8 Author: SeongJae Park Date: Sat Jul 12 12:50:05 2025 -0700 mm/damon/stat: use damon_call() repeat mode instead of damon_callback DAMON_STAT uses damon_callback for periodically reading DAMON internal data. Use its alternative, damon_call() repeat mode. Link: https://lkml.kernel.org/r/20250712195016.151108-4-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 43df7676e5508895c33b846d37cff9cf3b52674c Author: SeongJae Park Date: Sat Jul 12 12:50:04 2025 -0700 mm/damon/core: introduce repeat mode damon_call() damon_call() can be useful for reading or writing DAMON internal data for one time. A common pattern of DAMON core usage from DAMON modules is doing such reads and writes repeatedly, for example, to periodically update the DAMOS stats. To do that with damon_call(), callers should call damon_call() repeatedly, with their own delay loop. Each caller doing that is repetitive. Introduce a repeat mode damon_call(). Callers can use the mode by setting a new field in damon_call_control. If the mode is turned on, damon_call() returns success immediately, and DAMON repeats invoking the callback function inside the kdamond main loop. Link: https://lkml.kernel.org/r/20250712195016.151108-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 004ded6bee11b8ed463cdc54b89a4390f4b64f6d Author: SeongJae Park Date: Sat Jul 12 12:50:03 2025 -0700 mm/damon: accept parallel damon_call() requests Patch series "mm/damon: remove damon_callback". damon_callback was the only way for communicating with DAMON for contexts running on its worker thread. The interface is flexible and simple. But as DAMON evolves with more features, damon_callback has become somewhat too old. With runtime parameters update, for example, its lack of synchronization support was found to be inconvenient. Arguably it is also not easy to use correctly since the callers should understand when each callback is called, and implication of the return values from the callbacks. To replace it, damon_call() and damos_walk() are introduced. And those replaced a few damon_callback use cases. Some use cases of damon_callback such as parallel or repetitive DAMON internal data reading and additional cleanups cannot simply be replaced by damon_call() and damos_walk(), though. To allow those replaceable, extend damon_call() for parallel and/or repeated callbacks and modify the core/ops layers for additional resources cleanup. With the updates, replace the remaining damon_callback usages and finally say goodbye to damon_callback. This patch (of 14): Calling damon_call() while it is serving for another parallel thread immediately fails with -EBUSY. The caller should call it again, later. Each caller implementing such retry logic would be redundant. Accept parallel damon_call() requests and do the wait instead of the caller. Link: https://lkml.kernel.org/r/20250712195016.151108-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250712195016.151108-2-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit e001ef9652c2d931a1126c9d173ec5ea95e9847a Author: Xuanye Liu Date: Thu Jul 10 10:58:58 2025 +0800 mm: simplify min_brk handling in brk() Set min_brk to mm->start_brk by default, and override it with mm->end_data only when CONFIG_COMPAT_BRK is enabled and brk_randomized is false. This makes the logic clearer with no functional change. Link: https://lkml.kernel.org/r/20250710025859.926355-1-liuqiye2025@163.com Signed-off-by: Xuanye Liu Reviewed-by: Pedro Falcato Reviewed-by: Lorenzo Stoakes Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit c809579374f47c8273eaf22a40674ae547f39254 Author: Chi Zhiling Date: Thu Jul 10 14:04:51 2025 +0800 readahead: use folio_nr_pages() instead of shift operation folio_nr_pages() is faster helper function to get the number of pages when NR_PAGES_IN_LARGE_FOLIO is enabled. Link: https://lkml.kernel.org/r/20250710060451.3535957-1-chizhiling@163.com Signed-off-by: Chi Zhiling Acked-by: David Hildenbrand Reviewed-by: Ryan Roberts Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 188cb385bbf04d486df3e52f28c47b3961f5f0c0 Author: Andy Shevchenko Date: Thu Jul 10 11:23:53 2025 +0300 mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery When pmd_to_hmm_pfn_flags() is unused, it prevents kernel builds with clang, `make W=1` and CONFIG_TRANSPARENT_HUGEPAGE=n: mm/hmm.c:186:29: warning: unused function 'pmd_to_hmm_pfn_flags' [-Wunused-function] Fix this by moving the function to the respective existing ifdeffery for its the only user. See also: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build") Link: https://lkml.kernel.org/r/20250710082403.664093-1-andriy.shevchenko@linux.intel.com Fixes: 992de9a8b751 ("mm/hmm: allow to mirror vma of a file on a DAX backed filesystem") Signed-off-by: Andy Shevchenko Reviewed-by: Leon Romanovsky Reviewed-by: Alistair Popple Cc: Andriy Shevchenko Cc: Bill Wendling Cc: Jerome Glisse Cc: Justin Stitt Cc: Nathan Chancellor Cc: Signed-off-by: Andrew Morton commit b980077899ea49cc747afe003e01ca303b00d463 Author: Davidlohr Bueso Date: Mon Jun 23 11:58:51 2025 -0700 mm: introduce per-node proactive reclaim interface This adds support for allowing proactive reclaim in general on a NUMA system. A per-node interface extends support for beyond a memcg-specific interface, respecting the current semantics of memory.reclaim: respecting aging LRU and not supporting artificially triggering eviction on nodes belonging to non-bottom tiers. This patch allows userspace to do: echo "512M swappiness=10" > /sys/devices/system/node/nodeX/reclaim One of the premises for this is to semantically align as best as possible with memory.reclaim. During a brief time memcg did support nodemask until 55ab834a86a9 (Revert "mm: add nodes= arg to memory.reclaim"), for which semantics around reclaim (eviction) vs demotion were not clear, rendering charging expectations to be broken. With this approach: 1. Users who do not use memcg can benefit from proactive reclaim. The memcg interface is not NUMA aware and there are usecases that are focusing on NUMA balancing rather than workload memory footprint. 2. Proactive reclaim on top tiers will trigger demotion, for which memory is still byte-addressable. Reclaiming on the bottom nodes will trigger evicting to swap (the traditional sense of reclaim). This follows the semantics of what is today part of the aging process on tiered memory, mirroring what every other form of reclaim does (reactive and memcg proactive reclaim). Furthermore per-node proactive reclaim is not as susceptible to the memcg charging problem mentioned above. 3. Unlike the nodes= arg, this interface avoids confusing semantics, such as what exactly the user wants when mixing top-tier and low-tier nodes in the nodemask. Further per-node interface is less exposed to "free up memory in my container" usecases, where eviction is intended. 4. Users that *really* want to free up memory can use proactive reclaim on nodes knowingly to be on the bottom tiers to force eviction in a natural way - higher access latencies are still better than swap. If compelled, while no guarantees and perhaps not worth the effort, users could also also potentially follow a ladder-like approach to eventually free up the memory. Alternatively, perhaps an 'evict' option could be added to the parameters for both memory.reclaim and per-node interfaces to force this action unconditionally. [akpm@linux-foundation.org: user_proactive_reclaim(): return -EBUSY on PGDAT_RECLAIM_LOCKED contention, per Roman] [dave@stgolabs.net: memcg && node is also a bogus case, per Shakeel] Link: https://lkml.kernel.org/r/20250717235604.2atyx2aobwowpge3@offworld Link: https://lkml.kernel.org/r/20250623185851.830632-5-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Acked-by: Shakeel Butt Acked-by: Roman Gushchin Cc: Johannes Weiner Cc: Michal Hocko Cc: Yosry Ahmed Signed-off-by: Andrew Morton commit 57972c78e6780564710e20f0b2fad45114c93461 Author: Davidlohr Bueso Date: Mon Jun 23 11:58:50 2025 -0700 mm/vmscan: make __node_reclaim() more generic As this will be called from non page allocator paths for proactive reclaim, allow users to pass the sc and nr of pages, and adjust the return value as well. No change in semantics. Link: https://lkml.kernel.org/r/20250623185851.830632-4-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Reviewed-by: Roman Gushchin Acked-by: Shakeel Butt Cc: Johannes Weiner Cc: Michal Hocko Cc: Yosry Ahmed Signed-off-by: Andrew Morton commit 2b7226af730cc9a8818ff3b39aabcd76861913dd Author: Davidlohr Bueso Date: Mon Jun 23 11:58:49 2025 -0700 mm/memcg: make memory.reclaim interface generic This adds a general call for both parsing as well as the common reclaim semantics. memcg is still the only user and no change in semantics. [akpm@linux-foundation.org: fix CONFIG_NUMA=n build] Link: https://lkml.kernel.org/r/20250623185851.830632-3-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Acked-by: Shakeel Butt Cc: Johannes Weiner Cc: Michal Hocko Cc: Roman Gushchin Cc: Yosry Ahmed Signed-off-by: Andrew Morton commit 7a92f4f591770cf77de2e6550f4a68957483b739 Author: Davidlohr Bueso Date: Mon Jun 23 11:58:48 2025 -0700 mm/vmscan: respect psi_memstall region in node reclaim Patch series "mm: per-node proactive reclaim", v2. This adds support for allowing proactive reclaim in general on a NUMA system. A per-node interface extends support for beyond a memcg-specific interface, respecting the current semantics of memory.reclaim: respecting aging LRU and not supporting artificially triggering eviction on nodes belonging to non-bottom tiers. This patch allows userspace to do: echo 512M swappiness=10 > /sys/devices/system/node/nodeX/reclaim One of the premises for this is to semantically align as best as possible with memory.reclaim. During a brief time memcg did support nodemask until 55ab834a86a9 (Revert "mm: add nodes= arg to memory.reclaim"), for which semantics around reclaim (eviction) vs demotion were not clear, rendering charging expectations to be broken. With this approach: 1. Users who do not use memcg can benefit from proactive reclaim. 2. Proactive reclaim on top tiers will trigger demotion, for which memory is still byte-addressable. Reclaiming on the bottom nodes will trigger evicting to swap (the traditional sense of reclaim). This follows the semantics of what is today part of the aging process on tiered memory, mirroring what every other form of reclaim does (reactive and memcg proactive reclaim). Furthermore per-node proactive reclaim is not as susceptible to the memcg charging problem mentioned above. 3. Unlike memcg, there should be no surprises of callers expecting reclaim but instead got a demotion. Essentially relying on behavior of shrink_folio_list() after 6b426d071419 ("mm: disable top-tier fallback to reclaim on proactive reclaim"), without the expectations of try_to_free_mem_cgroup_pages(). 4. Unlike the nodes= arg, this interface avoids confusing semantics, such as what exactly the user wants when mixing top-tier and low-tier nodes in the nodemask. Further per-node interface is less exposed to "free up memory in my container" usecases, where eviction is intended. 5. Users that *really* want to free up memory can use proactive reclaim on nodes knowingly to be on the bottom tiers to force eviction in a natural way - higher access latencies are still better than swap. If compelled, while no guarantees and perhaps not worth the effort, users could also also potentially follow a ladder-like approach to eventually free up the memory. Alternatively, perhaps an 'evict' option could be added to the parameters for both memory.reclaim and per-node interfaces to force this action unconditionally. This patch (of 4): ... rather benign but keep proper ending order. Link: https://lkml.kernel.org/r/20250623185851.830632-1-dave@stgolabs.net Link: https://lkml.kernel.org/r/20250623185851.830632-2-dave@stgolabs.net Signed-off-by: Davidlohr Bueso Acked-by: Shakeel Butt Reviewed-by: Roman Gushchin Cc: Johannes Weiner Cc: Michal Hocko Cc: Roman Gushchin Cc: Yosry Ahmed Signed-off-by: Andrew Morton commit e05d3a6014fd4ae224b44b89fbeacfaa4ace0a8e Author: Vishal Moola (Oracle) Date: Wed Jul 9 12:40:18 2025 -0700 mm: remove unmap_and_put_page() There are no callers of unmap_and_put_page() left. Remove it. Link: https://lkml.kernel.org/r/20250709194017.927978-6-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Acked-by: David Hildenbrand Cc: Jordan Rome Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 0c092fef53f08f1e461b180c61dddc30491ec855 Author: Vishal Moola (Oracle) Date: Wed Jul 9 12:40:17 2025 -0700 mm/memory.c: use folios in __access_remote_vm() Use kmap_local_folio() instead of kmap_local_page(). Replaces 2 calls to compound_head() with one. This prepares us for the removal of unmap_and_put_page(). Link: https://lkml.kernel.org/r/20250709194017.927978-5-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Acked-by: David Hildenbrand Cc: Jordan Rome Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 0ec5eea20821287d9d9d4ec477f7cd0e15315518 Author: Vishal Moola (Oracle) Date: Wed Jul 9 12:40:16 2025 -0700 mm/memory.c: use folios in __copy_remote_vm_str() Patch series "Remove unmap_and_put_page()". This patchset uses folios in both the callers of unmap_and_put_page(), saving a couple calls to compound_head() wrappers. This patch (of 3): Use kmap_local_folio() instead of kmap_local_page(). Replaces 2 calls to compound_head() from unmap_and_put_page() with one. This prepares us for the removal of unmap_and_put_page(). Link: https://lkml.kernel.org/r/20250709194017.927978-3-vishal.moola@gmail.com Link: https://lkml.kernel.org/r/20250709194017.927978-4-vishal.moola@gmail.com Signed-off-by: Vishal Moola (Oracle) Acked-by: David Hildenbrand Cc: Jordan Rome Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit db87a4e236424249c7def768ba50b88699af2c0d Author: Bijan Tabatabai Date: Tue Jul 8 19:59:43 2025 -0500 mm/damon/vaddr: apply filters in migrate_{hot/cold} The paddr versions of migrate_{hot/cold} filter out folios from migration based on the scheme's filters. This patch does the same for the vaddr versions of those schemes. The filtering code is mostly the same for the paddr and vaddr versions. The exception is the young filter. paddr determines if a page is young by doing a folio rmap walk to find the page table entries corresponding to the folio. However, vaddr schemes have easier access to the page tables, so we add some logic to avoid the extra work. Link: https://lkml.kernel.org/r/20250709005952.17776-14-bijan311@gmail.com Co-developed-by: Ravi Shankar Jonnalagadda Signed-off-by: Ravi Shankar Jonnalagadda Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 0a707d6b04e01490f6c246fa4b6e643cc33b40a1 Author: Bijan Tabatabai Date: Tue Jul 8 19:59:42 2025 -0500 mm/damon: move folio filtering from paddr to ops-common This patch moves damos_pa_filter_match and the functions it calls to ops-common, renaming it to damos_folio_filter_match. Doing so allows us to share the filtering logic for the vaddr version of the migrate_{hot,cold} schemes. Link: https://lkml.kernel.org/r/20250709005952.17776-13-bijan311@gmail.com Co-developed-by: Ravi Shankar Jonnalagadda Signed-off-by: Ravi Shankar Jonnalagadda Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 19c1dc15c859929f8f084d0bfa2fafd1ee876cdd Author: Bijan Tabatabai Date: Tue Jul 8 19:59:41 2025 -0500 mm/damon/vaddr: use damos->migrate_dests in migrate_{hot,cold} damos->migrate_dests provides a list of nodes the migrate_{hot,cold} actions should migrate to, as well as the weights which specify the ratio pages should be migrated to each destination node. This patch interleaves pages in the migrate_{hot,cold} actions according to the information provided in damos->migrate_dests if it is used. The interleaving algorithm used is similar to the one used in weighted_interleave_nid(). If damos->migration_dests is not provided, the actions migrate pages to the node specified in damos->target_nid as before. Link: https://lkml.kernel.org/r/20250709005952.17776-12-bijan311@gmail.com Co-developed-by: Ravi Shankar Jonnalagadda Signed-off-by: Ravi Shankar Jonnalagadda Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 0af934b1312cc03bb977e8f345c694f3bef9529e Author: Bijan Tabatabai Date: Tue Jul 8 19:59:40 2025 -0500 Docs/mm/damon/design: document vaddr support for migrate_{hot,cold} Document that the migrate_{hot,cold} schemes can be used by the vaddr operations set. Link: https://lkml.kernel.org/r/20250709005952.17776-11-bijan311@gmail.com Co-developed-by: Ravi Shankar Jonnalagadda Signed-off-by: Ravi Shankar Jonnalagadda Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 256b0c7faa84e042ceb809cf57f6593c25bd9c58 Author: Bijan Tabatabai Date: Tue Jul 8 19:59:39 2025 -0500 mm/damon/vaddr: add vaddr versions of migrate_{hot,cold} migrate_{hot,cold} are paddr schemes that are used to migrate hot/cold data to a specified node. However, these schemes are only available when doing physical address monitoring. This patch adds an implementation for them virtual address monitoring as well. Link: https://lkml.kernel.org/r/20250709005952.17776-10-bijan311@gmail.com Co-developed-by: Ravi Shankar Jonnalagadda Signed-off-by: Ravi Shankar Jonnalagadda Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 13dde31db71f013257e2f9363edb76f683ea5728 Author: Bijan Tabatabai Date: Tue Jul 8 19:59:38 2025 -0500 mm/damon: move migration helpers from paddr to ops-common This patch moves the damon_pa_migrate_pages function along with its corresponding helper functions from paddr to ops-common. The function prefix of "damon_pa_" was also changed to just "damon_" accordingly. This patch will allow page migration to be available to vaddr schemes as well as paddr schemes. Link: https://lkml.kernel.org/r/20250709005952.17776-9-bijan311@gmail.com Co-developed-by: Ravi Shankar Jonnalagadda Signed-off-by: Ravi Shankar Jonnalagadda Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit cbc4eea4ffb5c9858b8f4dc7cae5897b01102a3f Author: Bijan Tabatabai Date: Tue Jul 8 19:59:37 2025 -0500 mm/damon/core: commit damos->migrate_dests When committing new scheme parameters from the sysfs, copy the migrate_dests struct of the source schemes into the destination schemes. Link: https://lkml.kernel.org/r/20250709005952.17776-8-bijan311@gmail.com Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Cc: Ravi Shankar Jonnalagadda Signed-off-by: Andrew Morton commit 3a4785c2d3bee59a0e39ad94b672f6e1a1180981 Author: SeongJae Park Date: Tue Jul 8 19:59:36 2025 -0500 Docs/admin-guide/mm/damon/usage: document dests directory Document the newly added DAMOS action destination directory of the DAMON sysfs interface on the usage document. Link: https://lkml.kernel.org/r/20250709005952.17776-7-bijan311@gmail.com Signed-off-by: SeongJae Park Cc: Bijan Tabatabai Cc: Jonathan Corbet Cc: Ravi Shankar Jonnalagadda Signed-off-by: Andrew Morton commit b9dfe8af511d901d6e6cac2ca999e390d7bf2a41 Author: SeongJae Park Date: Tue Jul 8 19:59:35 2025 -0500 Docs/ABI/damon: document schemes dests directory Document the new DAMOS action destinations sysfs directories on ABI doc. Link: https://lkml.kernel.org/r/20250709005952.17776-6-bijan311@gmail.com Signed-off-by: SeongJae Park Cc: Bijan Tabatabai Cc: Jonathan Corbet Cc: Ravi Shankar Jonnalagadda Signed-off-by: Andrew Morton commit 9106d467533db0f042f2ddbf304620fa3fd54b1d Author: SeongJae Park Date: Tue Jul 8 19:59:34 2025 -0500 mm/damon/sysfs-schemes: set damos->migrate_dests Pass user-specified multiple DAMOS action destinations and their weights to DAMON core API, so that user requests can really work. Link: https://lkml.kernel.org/r/20250709005952.17776-5-bijan311@gmail.com Signed-off-by: SeongJae Park Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Cc: Ravi Shankar Jonnalagadda Signed-off-by: Andrew Morton commit 2cd0bf85a203e21f7bc93628441f136fc2d0a2b8 Author: SeongJae Park Date: Tue Jul 8 19:59:33 2025 -0500 mm/damon/sysfs-schemes: implement DAMOS action destinations directory DAMOS_MIGRATE_{HOT,COLD} can have multiple action destinations and their weights. Implement sysfs directory named 'dests' under each scheme directory to let DAMON sysfs ABI users utilize the feature. The interface is similar to other multiple parameters directory like kdamonds or filters. The directory contains only nr_dests file initially. Writing a number of desired destinations to nr_dests creates directories of the number. Each of the created directories has two files named id and weight. Users can then write the destination's identifier (node id in case of DAMOS_MIGRATE_*) and weight to the files. Link: https://lkml.kernel.org/r/20250709005952.17776-4-bijan311@gmail.com Signed-off-by: SeongJae Park Cc: Bijan Tabatabai Cc: Jonathan Corbet Cc: Ravi Shankar Jonnalagadda Signed-off-by: Andrew Morton commit aabc85ee33c883243f2c506a5d88963f2456faa6 Author: SeongJae Park Date: Tue Jul 8 19:59:32 2025 -0500 mm/damon/core: add damos->migrate_dests field Add a new field to 'struct damos', namely migrate_dests, to allow DAMON API callers specify multiple migration destination nodes and their weights. Also update 'struct damos' creation and destruction functions accordingly to initialize the new field and free up the API caller-allocated buffers on those, respectively. Link: https://lkml.kernel.org/r/20250709005952.17776-3-bijan311@gmail.com Signed-off-by: SeongJae Park Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Cc: Ravi Shankar Jonnalagadda Signed-off-by: Andrew Morton commit a2c24eae5a15f79673eba2913d87d658a04830cf Author: SeongJae Park Date: Tue Jul 8 19:59:31 2025 -0500 mm/damon: add struct damos_migrate_dests Patch series "mm/damon/vaddr: Allow interleaving in migrate_{hot,cold} actions", v4. A recent patchset automatically sets the interleave weight for each node according to the node's maximum bandwidth [1]. In another thread, the patch set's author, Joshua Hahn, wondered if/how thes weights should be changed if the bandwidth utilization of the system changes [2]. This patch set adds the mechanism for dynamically changing how application data is interleaved across nodes while leaving the policy of what the interleave weights should be to userspace. It does this by having the migrate_{hot,cold} operating schemes interleave application data according to the list of migration nodes and weights passed in via the DAMON sysfs interface. This functionality can be used to dynamically adjust how folios are interleaved by having a userspace process adjust those weights. If no specific destination nodes or weights are provided, the migrate_{hot,cold} actions will only migrate folios to damos->target_nid as before. The algorithm used to interleave the folios is similar to the one used for the weighted interleave mempolicy [3]. It uses the offset from which a folio is mapped into a VMA to determine the node the folio should be placed in. This method is convenient because for a given set of interleave weights, a folio has only one valid node it can be placed in, limitng the amount of unnecessary data movement. However, finding out how a folio is mapped inside of a VMA requires a costly rmap walk when using a paddr scheme. As such, we have decided that this functionality makes more sense as a vaddr scheme [4]. To this end, this patch set also adds vaddr versions of the migrate_{hot,cold}. Motivation ========== There have been prior discussions about how changing the interleave weights in response to the system's bandwidth utilization can be beneficial [2]. However, currently the interleave weights only are applied when data is allocated. Migrating already allocated pages according to the dynamically changing weights will better help balance the bandwidth utilization across nodes. As a toy example, imagine some application that uses 75% of the local bandwidth. Assuming sufficient capacity, when running alone, we want to keep that application's data in local memory. However, if a second instance of that application begins, using the same amount of bandwidth, it would be best to interleave the data of both processes to alleviate the bandwidth pressure from the local node. Likewise, when one of the processes ends, the data should be moves back to local memory. We imagine there would be a userspace application that would monitor system performance characteristics, such as bandwidth utilization or memory access latency, and uses that information to tune the interleave weights. Others seem to have come to a similar conclusion in previous discussions [5]. We are currently working on a userspace program that does this, but it is not quite ready to be published yet. After the userspace application tunes the interleave weights, there must be some mechanism that actually migrates pages to be consistent with those weights. This patchset is what provides this mechanism. We believe DAMON is the correct venue for the interleaving mechanism for a few reasons. First, we noticed that we don't have to migrate all of the application's pages to improve performance. we just need to migrate the frequently accessed pages. DAMON's existing hotness traching is very useful for this. Second, DAMON's quota system can be used to ensure we are not using too much bandwidth for migrations. Finally, as Ying pointed out [6], a complete solution must also handle when a memory node is at capacity. The existing migrate_cold action can be used in conjunction with the functionality added in this patch set to provide that complete solution. Functionality Test ================== Below is an example of this new functionality in use to confirm that these patches behave as intended. In this example, the user starts an application, alloc_data, which allocates 1GB using the default memory policy (i.e. allocate to local memory) then sleeps. Afterwards, we start DAMON to interleave the data at a 1:1 ratio. Using numastat, we show that DAMON has migrated the application's data to match the new interleave ratio. For this example, I modified the userspace damo tool [8] to write to the migration_dest sysfs files. I plan to upstream these changes when these patches are merged. $ # Allocate the data initially $ ./alloc_data 1G & [1] 6587 $ numastat -c -p alloc_data Per-node process memory usage (in MBs) for PID 6587 (alloc_data) Node 0 Node 1 Total ------ ------ ----- Huge 0 0 0 Heap 0 0 0 Stack 0 0 0 Private 1027 0 1027 ------- ------ ------ ----- Total 1027 0 1027 $ # Start DAMON to interleave data at a 1:1 ratio $ cat ./interleave_vaddr.yaml kdamonds: - contexts: - ops: vaddr addr_unit: null targets: - pid: 6587 regions: [] intervals: sample_us: 500 ms aggr_us: 5 s ops_update_us: 20 s intervals_goal: access_bp: 0 % aggrs: '0' min_sample_us: 0 ns max_sample_us: 0 ns nr_regions: min: '20' max: '50' schemes: - action: migrate_hot dests: - nid: 0 weight: 1 - nid: 1 weight: 1 access_pattern: sz_bytes: min: 0 B max: max nr_accesses: min: 0 % max: 100 % age: min: 0 ns max: max $ sudo ./damo/damo interleave_vaddr.yaml $ # Verify that DAMON has migrated data to match the 1:1 ratio $ numastat -c -p alloc_data Per-node process memory usage (in MBs) for PID 6587 (alloc_data) Node 0 Node 1 Total ------ ------ ----- Huge 0 0 0 Heap 0 0 0 Stack 0 0 0 Private 514 514 1027 ------- ------ ------ ----- Total 514 514 1027 Performance Test ================ Below is a simple example showing that interleaving application data using these patches can improve application performance. To do this, we run a bandwidth intensive embedding reduction application [7]. This workload is useful for this test because it reports the time it takes each iteration to run and each iteration reuses the same allocation, allowing us to see the benefits of the migration. We evaluate this on a 128 core/256 thread AMD CPU with 72GB/s of local DDR bandwidth and 26 GB/s of CXL bandwidth. Before we start the workload, the system bandwidth utilization is low, so we start with the interleave weights of 1:0, i.e. allocating all data to local memory. When the workload beings, it saturates the local bandwidth, making the page placement suboptimal. To alleviate this, we modify the interleave weights, triggering DAMON to migrate the workload's data. We use the same interleave_vaddr.yaml file to setup DAMON, except we configure it to begin with a 1:0 interleave ratio, and attach it to the shell and its children processes. $ sudo ./damo/damo start interleave_vaddr.yaml --include_child_tasks & $ /eval_baseline -d amazon_All -c 255 -r 100 Eval Phase 3: Running Baseline... REPEAT # 0 Baseline Total time : 7323.54 ms REPEAT # 1 Baseline Total time : 7624.56 ms REPEAT # 2 Baseline Total time : 7619.61 ms REPEAT # 3 Baseline Total time : 7617.12 ms REPEAT # 4 Baseline Total time : 7638.64 ms REPEAT # 5 Baseline Total time : 7611.27 ms REPEAT # 6 Baseline Total time : 7629.32 ms REPEAT # 7 Baseline Total time : 7695.63 ms # Interleave weights set to 3:1 REPEAT # 8 Baseline Total time : 7077.5 ms REPEAT # 9 Baseline Total time : 5633.23 ms REPEAT # 10 Baseline Total time : 5644.6 ms REPEAT # 11 Baseline Total time : 5627.66 ms REPEAT # 12 Baseline Total time : 5629.76 ms REPEAT # 13 Baseline Total time : 5633.05 ms REPEAT # 14 Baseline Total time : 5641.24 ms REPEAT # 15 Baseline Total time : 5631.18 ms REPEAT # 16 Baseline Total time : 5631.33 ms Updating the interleave weights and having DAMON migrate the workload data according to the weights resulted in an approximarely 25% speedup. Patches Sequence ================ Patches 1-7 extend the DAMON API to specify multiple destination nodes and weights for the migrate_{hot,cold} actions. These patches are from SJ'S RFC [8]. Patches 8-10 add a vaddr implementation of the migrate_{hot,cold} schemes. Patch 11 modifies the vaddr migrate_{hot,cold} schemes to interleave data according to the weights provided by damos->migrate_dest. Patches 12-13 allow the vaddr migrate_{hot,cold} implementation to filter out folios like the paddr version. This patch (of 13): Introduce a new struct, namely damos_migrate_dests, for specifying multiple DAMOS' migration destination nodes and their weights. Link: https://lkml.kernel.org/r/20250709005952.17776-1-bijan311@gmail.com Link: https://lkml.kernel.org/r/20250709005952.17776-2-bijan311@gmail.com Link: https://lore.kernel.org/linux-mm/20250520141236.2987309-1-joshua.hahnjy@gmail.com/ [1] Link: https://lore.kernel.org/linux-mm/20250313155705.1943522-1-joshua.hahnjy@gmail.com/ [2] Link: https://elixir.bootlin.com/linux/v6.15.4/source/mm/mempolicy.c#L2015 [3] Link: https://lore.kernel.org/damon/20250624223310.55786-1-sj@kernel.org/ [4] Link: https://lore.kernel.org/linux-mm/20250314151137.892379-1-joshua.hahnjy@gmail.com/ [5] Link: https://lore.kernel.org/linux-mm/87frjfx6u4.fsf@DESKTOP-5N7EMDA/ [6] Link: https://github.com/SNU-ARC/MERCI [7] Link: https://lore.kernel.org/damon/20250702051558.54138-1-sj@kernel.org/ [8] Signed-off-by: SeongJae Park Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Cc: Ravi Shankar Jonnalagadda Signed-off-by: Andrew Morton commit 579bd5006fe7f4a7abb32da0160d376476cab67d Author: Bijan Tabatabai Date: Tue Jul 8 19:47:29 2025 -0500 mm/damon/core: commit damos->target_nid When committing new scheme parameters from the sysfs, the target_nid field of the damos struct would not be copied. This would result in the target_nid field to retain its original value, despite being updated in the sysfs interface. This patch fixes this issue by copying target_nid in damos_commit(). Link: https://lkml.kernel.org/r/20250709004729.17252-1-bijan311@gmail.com Fixes: 83dc7bbaecae ("mm/damon/sysfs: use damon_commit_ctx()") Signed-off-by: Bijan Tabatabai Reviewed-by: SeongJae Park Cc: Jonathan Corbet Cc: Ravi Shankar Jonnalagadda Cc: Signed-off-by: Andrew Morton commit 749cc6533b662166fb387486e408e581a87b2a34 Author: Yunjeong Mun Date: Tue Jul 8 08:59:18 2025 +0900 samples/damon: support automatic node address detection This patch adds a new knob `detect_node_addresses`, which determines whether the physical address range is set manually using the existing knobs or automatically by the mtier module. When `detect_node_addresses` set to 'Y', mtier automatically converts node0 and node1 to their physical addresses. If set to 'N', it uses the existing 'node#_start_addr' and 'node#_end_addr' to define regions as before. Link: https://lkml.kernel.org/r/20250707235919.513-1-yunjeong.mun@sk.com Signed-off-by: Yunjeong Mun Suggested-by: Honggyu Kim Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 793020545cea0c9e2a79de6ad5c9746ec4f5bd7e Author: Honggyu Kim Date: Mon Jul 7 11:45:47 2025 +0900 samples/damon: change enable parameters to enabled The damon_{lru_sort,reclaim,stat} kernel modules use "enabled" parameter knobs as follows. /sys/module/damon_lru_sort/parameters/enabled /sys/module/damon_reclaim/parameters/enabled /sys/module/damon_stat/parameters/enabled However, other sample modules of damon use "enable" parameter knobs so it'd be better to rename them from "enable" to "enabled" to keep the consistency with other damon modules. Before: /sys/module/damon_sample_wsse/parameters/enable /sys/module/damon_sample_prcl/parameters/enable /sys/module/damon_sample_mtier/parameters/enable After: /sys/module/damon_sample_wsse/parameters/enabled /sys/module/damon_sample_prcl/parameters/enabled /sys/module/damon_sample_mtier/parameters/enabled There is no functional changes in this patch. Link: https://lkml.kernel.org/r/20250707024548.1964-1-honggyu.kim@sk.com Signed-off-by: Honggyu Kim Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit 8356a5a3b078ca89c526dd6d71e9a76fec571c37 Author: Vlastimil Babka Date: Wed Jun 25 17:51:52 2025 +0200 mm, vmstat: remove the NR_WRITEBACK_TEMP node_stat_item counter The only user of the counter (FUSE) was removed in commit 0c58a97f919c ("fuse: remove tmp folio for writebacks and internal rb tree") so follow the established pattern of removing the counter and hardcoding 0 in meminfo output, as done recently with NR_BOUNCE. Update documentation for procfs, including for the value for Bounce that was missed when removing its counter. Also remove the mention of NR_WRITEBACK_TEMP implications from a comment in wb_position_ratio(). The rest of the comment there about fuse setting bdi->max_ratio to 1% is still correct. [vbabka@suse.cz: v2] Link: https://lkml.kernel.org/r/5a848e15-6a57-4ecb-a015-d4f358b8a5d3@suse.cz Link: https://lkml.kernel.org/r/20250625-nr_writeback_removal-v1-1-7f2a0df70faa@suse.cz Signed-off-by: Vlastimil Babka Cc: Brendan Jackman Cc: Danilo Krummrich Cc: Greg Kroah-Hartman Cc: Jan Kara Cc: Jeff Layton Cc: Jeffle Xu Cc: Jens Axboe Cc: Joanne Koong Cc: Johannes Weiner Cc: Jonathan Corbet Cc: Kirill A. Shuemov Cc: Matthew Wilcox (Oracle) Cc: Maxim Patlasov Cc: Michal Hocko Cc: Miklos Szeredi Cc: Suren Baghdasaryan Cc: Tejun Heo Cc: Zach O'Keefe Cc: Zi Yan Signed-off-by: Andrew Morton commit ed6a9068a0fc01c27f49f97a84b3b80b0fda2787 Author: Kirill A. Shutemov Date: Tue Jun 3 11:45:56 2025 +0300 mm/vmstat: utilize designated initializers for the vmstat_text array The vmstat_text array defines labels for counters displayed in /proc/vmstat. The current definition of the array implies a specific order of the counters in their enums, making it fragile. To make it clear which counter the label is for, use designated initializers. Link: https://lkml.kernel.org/r/20250603084556.113975-1-kirill.shutemov@linux.intel.com Signed-off-by: Kirill A. Shutemov Reviewed-by: Christoph Hellwig Acked-by: Vlastimil Babka Acked-by: Michal Hocko Cc: David Hildenbrand Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 8a63ff68e5ead16ab384dcbed6103f9ad371e246 Author: Kirill A. Shutemov Date: Thu May 29 14:05:41 2025 +0300 mm: strictly check vmstat_text array size /proc/vmstat displays counters from various sources. It is easy to forget to add or remove a label when a new counter is added or removed. There is a BUILD_BUG_ON() function that catches missing labels. However, for some reason, it ignores extra labels. Let's make the check strict. This would help to catch issues when a counter is removed. Link: https://lkml.kernel.org/r/20250529110541.2960330-1-kirill.shutemov@linux.intel.com Signed-off-by: Kirill A. Shutemov Reviewed-by: Vlastimil Babka Acked-by: Michal Hocko Reviewed-by: David Hildenbrand Cc: Konstantin Khlebnikov Cc: Kirill A. Shuemov Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mike Rapoport Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit fdc5001b002eaca9989b5f3563245662fd1e4d40 Author: Kirill A. Shutemov Date: Wed Jun 4 12:51:11 2025 +0300 mm/vmstat: make MEMCG select VM_EVENT_COUNTERS The vmstat_text array contains labels for counters displayed in /proc/vmstat. It is important to keep the labels in sync with the counters. There is a BUILD_BUG_ON() check in vmstat_start() that ensures the size of the vmstat_text is not smaller than VM_EVENT_COUNTERS. This helps to catch cases where a new counter is added but the label is not. However, it does not help if a counter is removed but the label remains. It would be nice to make the BUILD_BUG_ON() check more strict to catch such cases. However, when compiling with MEMCG enabled but VM_EVENT_COUNTERS disabled, the vmstat_text array is larger than NR_VMSTAT_ITEMS. This issue arises because some elements of the vmstat_text array are present when either MEMCG or VM_EVENT_COUNTERS is enabled, but NR_VMSTAT_ITEMS only accounts for these elements if VM_EVENT_COUNTERS is enabled. Instead of adjusting the NR_VMSTAT_ITEMS definition to account for MEMCG, make MEMCG select VM_EVENT_COUNTERS. VM_EVENT_COUNTERS is enabled in most configurations anyway. Link: https://lkml.kernel.org/r/20250604095111.533783-1-kirill.shutemov@linux.intel.com Fixes: ebc5d83d0443 ("mm/memcontrol: use vmstat names for printing statistics") Signed-off-by: Kirill A. Shutemov Reported-by: Randy Dunlap Acked-by: Vlastimil Babka Tested-by: Randy Dunlap Acked-by: Randy Dunlap Acked-by: Shakeel Butt Cc: Konstantin Khlebnikov Cc: David Hildenbrand Cc: Johannes Weiner Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Mike Rapoport Cc: Muchun Song Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 7ae7e811f0a6817b6deeb4f68eb44be0ec3b8e07 Author: David Hildenbrand Date: Wed Jul 2 12:49:26 2025 +0200 mm: remove boolean output parameters from folio_pte_batch_ext() Instead, let's just allow for specifying through flags whether we want to have bits merged into the original PTE. For the madvise() case, simplify by having only a single parameter for merging young+dirty. For madvise_cold_or_pageout_pte_range() merging the dirty bit is not required, but also not harmful. This code is not that performance critical after all to really force all micro-optimizations. As we now have two pte_t * parameters, use PageTable() to make sure we are actually given a pointer at a copy of the PTE, not a pointer into an actual page table. Link: https://lkml.kernel.org/r/20250702104926.212243-5-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Dev Jain Reviewed-by: Oscar Salvador Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Jann Horn Cc: Joshua Hahn Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mathew Brost Cc: Michal Hocko Cc: Mike Rapoport Cc: Rakie Kim Cc: Rik van Riel Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit dd80cfd4878bafc74f2a386c51b5398a12ffeb8c Author: David Hildenbrand Date: Wed Jul 2 12:49:25 2025 +0200 mm: split folio_pte_batch() into folio_pte_batch() and folio_pte_batch_flags() Many users (including upcoming ones) don't really need the flags etc, and can live with the possible overhead of a function call. So let's provide a basic, non-inlined folio_pte_batch(), to avoid code bloat while still providing a variant that optimizes out all flag checks at runtime. folio_pte_batch_flags() will get inlined into folio_pte_batch(), optimizing out any conditionals that depend on input flags. folio_pte_batch() will behave like folio_pte_batch_flags() when no flags are specified. It's okay to add new users of folio_pte_batch_flags(), but using folio_pte_batch() if applicable is preferred. So, before this change, folio_pte_batch() was inlined into the C file optimized by propagating constants within the resulting object file. With this change, we now also have a folio_pte_batch() that is optimized by propagating all constants. But instead of having one instance per object file, we have a single shared one. In zap_present_ptes(), where we care about performance, the compiler already seem to generate a call to a common inlined folio_pte_batch() variant, shared with fork() code. So calling the new non-inlined variant should not make a difference. While at it, drop the "addr" parameter that is unused. Link: https://lkml.kernel.org/r/20250702104926.212243-4-david@redhat.com Signed-off-by: David Hildenbrand Suggested-by: Andrew Morton Link: https://lore.kernel.org/linux-mm/20250503182858.5a02729fcffd6d4723afcfc2@linux-foundation.org/ Reviewed-by: Oscar Salvador Reviewed-by: Zi Yan Reviewed-by: Dev Jain Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Jann Horn Cc: Joshua Hahn Cc: Lance Yang Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mathew Brost Cc: Michal Hocko Cc: Mike Rapoport Cc: Rakie Kim Cc: Rik van Riel Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 233e28e2a76e6ffcbe33ee7813f98536fe0690b5 Author: David Hildenbrand Date: Wed Jul 2 12:49:24 2025 +0200 mm: smaller folio_pte_batch() improvements Let's clean up a bit: (1) No need for start_ptep vs. ptep anymore, we can simply use ptep. (2) Let's switch to "unsigned int" for everything. Negative values do not make sense. (3) We can simplify the code by leaving the pte unchanged after the pte_same() check. (4) Clarify that we should never exceed a single VMA; it indicates a problem in the caller. No functional change intended. Link: https://lkml.kernel.org/r/20250702104926.212243-3-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lance Yang Reviewed-by: Lorenzo Stoakes Reviewed-by: Oscar Salvador Reviewed-by: Dev Jain Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Jann Horn Cc: Joshua Hahn Cc: Liam Howlett Cc: Mathew Brost Cc: Michal Hocko Cc: Mike Rapoport Cc: Rakie Kim Cc: Rik van Riel Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit e66d7a4f55f44aca39cc74e8c7b4602faf26b4f7 Author: David Hildenbrand Date: Wed Jul 2 12:49:23 2025 +0200 mm: convert FPB_IGNORE_* into FPB_RESPECT_* Patch series "mm: folio_pte_batch() improvements", v2. Ever since we added folio_pte_batch() for fork() + munmap() purposes, a lot more users appeared (and more are being proposed), and more functionality was added. Most of the users only need basic functionality, and could benefit from a non-inlined version. So let's clean up folio_pte_batch() and split it into a basic folio_pte_batch() (no flags) and a more advanced folio_pte_batch_ext(). Using either variant will now look much cleaner. This series will likely conflict with some changes in some (old+new) folio_pte_batch() users, but conflicts should be trivial to resolve. This patch (of 4): Respecting these PTE bits is the exception, so let's invert the meaning. With this change, most callers don't have to pass any flags. This is a preparation for splitting folio_pte_batch() into a non-inlined variant that doesn't consume any flags. Long-term, we want folio_pte_batch() to probably ignore most common PTE bits (e.g., write/dirty/young/soft-dirty) that are not relevant for most page table walkers: uffd-wp and protnone might be bits to consider in the future. Only walkers that care about them can opt-in to respect them. No functional change intended. Link: https://lkml.kernel.org/r/20250702104926.212243-2-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lance Yang Reviewed-by: Zi Yan Reviewed-by: Oscar Salvador Reviewed-by: Dev Jain Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: Jann Horn Cc: Joshua Hahn Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mathew Brost Cc: Michal Hocko Cc: Mike Rapoport Cc: Rakie Kim Cc: Rik van Riel Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 7765794810c2ff6eafbbde30f343f53bbc0f979a Author: Wei Yang Date: Mon Jul 7 06:57:11 2025 +0000 mm/migrate: remove the -EEXIST conversion for move_pages() The -EEXIST conversion is introduced in commit 65462462ffb2 ("mm/gup: follow_pfn_pte(): -EEXIST cleanup"), since follow_page() may call follow_pfn_pte() which may return -EEXIST. But after commit 7dff875c9436 ("mm/migrate: convert add_page_for_migration() from follow_page() to folio_walk"), it use folio_walk instead. This limit the error code and won't return -EEXIST. Remove the error code conversion here. Link: https://lkml.kernel.org/r/20250707065711.18056-1-richard.weiyang@gmail.com Signed-off-by: Wei Yang Acked-by: David Hildenbrand Reviewed-by: Joshua Hahn Reviewed-by: Zi Yan Cc: John Hubbard Cc: Matthew Brost Cc: Rakie Kim Cc: Byungchul Park Cc: Gregory Price Cc: Ying Huang Cc: Alistair Popple Signed-off-by: Andrew Morton commit f73858d5ef93cb880aca64d826b4e3ca8b55365a Author: Muhammad Usama Anjum Date: Mon Jul 7 12:33:20 2025 +0500 selftests/mm: pagemap_scan ioctl: add PFN ZERO test cases Add test cases to test the correctness of PFN ZERO flag of pagemap_scan ioctl. Test with normal pages backed memory and huge pages backed memory. Link: https://lkml.kernel.org/r/20250707073321.106431-1-usama.anjum@collabora.com Signed-off-by: Muhammad Usama Anjum Cc: David Hildenbrand Cc: Muhammad Usama Anjum Cc: Shuah Khan Signed-off-by: Andrew Morton commit 0b473f9e6eace01bf5d450fd696119e827c5fa5d Author: SeongJae Park Date: Sat Jul 5 10:50:00 2025 -0700 Docs/mm/damon/maintainer-profile: update for mm-new tree Recently a new mm tree for new patches, namely mm-new, has been added. Update DAMON maintainer's profile doc for DAMON patches life cycle, which depend on those of mm trees. Link: https://lkml.kernel.org/r/20250705175000.56259-7-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit e000df9ff183e7adc938db8a739690de112dd961 Author: SeongJae Park Date: Sat Jul 5 10:49:59 2025 -0700 mm/damon/sysfs: don't hold kdamond_lock in before_terminate() damon_sysfs_before_terminate() is a DAMON callback that is executed from the kdamond's context. Hence it is safe to access DAMON context internal data. But the function is unnecessarily holding kdamond_lock of the context. It is just unnecessary. Remove the locking code. Link: https://lkml.kernel.org/r/20250705175000.56259-6-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit d2b5be741a5045272b9d711908eab017632ac022 Author: SeongJae Park Date: Sat Jul 5 10:49:58 2025 -0700 mm/damon/sysfs: use DAMON core API damon_is_running() DAMON core implements a static function to see if a given DAMON context is running. DAMON sysfs interface is implementing the same one on its own. Make the core function non-static and reuse it from the DAMON sysfs interface. Link: https://lkml.kernel.org/r/20250705175000.56259-5-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 775c96714dca287f1130a7028890254d426a2b5d Author: SeongJae Park Date: Sat Jul 5 10:49:57 2025 -0700 samples/damon/mtier: rename to have damon_sample_ prefix DAMON sample module, mtier has its name 'mtier'. It could conflict with future modules, and not very easy to identify it by name. Use a prefix, "damon_sample_" for the name. Note that this could break users if they depend on the old name. But it is just a sample, so no such usage is expected, or known. Even if such usage exists, updating it for the new name should be straightforward. Link: https://lkml.kernel.org/r/20250705175000.56259-4-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 6a52ac0b60317337d57c57c45e6abd4936c386c3 Author: SeongJae Park Date: Sat Jul 5 10:49:56 2025 -0700 samples/damon/prcl: rename to have damon_sample_ prefix DAMON sample module, prcl has its name 'prcl'. It could conflict with future modules, and not very easy to identify it by name. Use a prefix, "damon_sample_" for the name. Note that this could break users if they depend on the old name. But it is just a sample, so no such usage is expected, or known. Even if such usage exists, updating it for the new name should be straightforward. Link: https://lkml.kernel.org/r/20250705175000.56259-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit c1db0cb157c6ddd6e24eb62673022b665ca688b9 Author: SeongJae Park Date: Sat Jul 5 10:49:55 2025 -0700 samples/damon/wsse: rename to have damon_sample_ prefix Patch series "mm/damon: misc cleanups". Yet another round of miscellaneous DAMON cleanups. This patch (of 6): DAMON sample module, wsse has its name 'wsse'. It could conflict with future modules, and not very easy to identify it by name. Use a prefix, "damon_sample_" for the name. Note that this could break users if they depend on the old name. But it is just a sample, so no such usage is expected, or known. Even if such usage exists, updating it for the new name should be straightforward. Link: https://lkml.kernel.org/r/20250705175000.56259-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250705175000.56259-2-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit e89d5bf3a4f92f038817d77339a9c04904da8ad9 Author: Baolin Wang Date: Fri Jul 4 11:19:26 2025 +0800 mm: fault in complete folios instead of individual pages for tmpfs After commit acd7ccb284b8 ("mm: shmem: add large folio support for tmpfs"), tmpfs can also support large folio allocation (not just PMD-sized large folios). However, when accessing tmpfs via mmap(), although tmpfs supports large folios, we still establish mappings at the base page granularity, which is unreasonable. We can map multiple consecutive pages of tmpfs folios at once according to the size of the large folio. On one hand, this can reduce the overhead of page faults; on the other hand, it can leverage hardware architecture optimizations to reduce TLB misses, such as contiguous PTEs on the ARM architecture. Moreover, tmpfs mount will use the 'huge=' option to control large folio allocation explicitly. So it can be understood that the process's RSS statistics might increase, and I think this will not cause any obvious effects for users. Performance test: I created a 1G tmpfs file, populated with 64K large folios, and write-accessed it sequentially via mmap(). I observed a significant performance improvement: Before the patch: real 0m0.158s user 0m0.008s sys 0m0.150s After the patch: real 0m0.021s user 0m0.004s sys 0m0.017s Link: https://lkml.kernel.org/r/440940e78aeb7430c5cc8b6d2088ae98265b9809.1751599072.git.baolin.wang@linux.alibaba.com Fixes: acd7ccb284b8 ("mm: shmem: add large folio support for tmpfs") Signed-off-by: Baolin Wang Acked-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Vishal Moola (Oracle) Reviewed-by: Barry Song Reviewed-by: Lorenzo Stoakes Cc: Baolin Wang Cc: Dev Jain Cc: Hugh Dickins Cc: Liam Howlett Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit cc84ef3b88f407e8bd5a5f7b6906d1e69851c856 Author: Daniel Almeida Date: Mon Jul 14 20:29:58 2025 -0300 rust: bits: add support for bits/genmask macros In light of bindgen being unable to generate bindings for macros, and owing to the widespread use of these macros in drivers, manually define the bit and genmask C macros in Rust. The *_checked version of the functions provide runtime checking while the const version performs compile-time assertions on the arguments via the build_assert!() macro. Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Signed-off-by: Daniel Almeida Reviewed-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250714-topics-tyr-genmask2-v9-1-9e6422cbadb6@collabora.com [ `expect`ed Clippy warning in doctests, hid single `use`, grouped examples. Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit c77f85b347dd506ab6ef047031e75c2d03101187 Author: Tamir Duberstein Date: Wed Jul 9 15:31:16 2025 -0400 rust: list: remove OFFSET constants Replace `ListLinksSelfPtr::LIST_LINKS_SELF_PTR_OFFSET` with `unsafe fn raw_get_self_ptr` which returns a pointer to the field rather than requiring the caller to do pointer arithmetic. Implement `HasListLinks::raw_get_list_links` in `impl_has_list_links!`, narrowing the interface of `HasListLinks` and replacing pointer arithmetic with `container_of!`. Modify `impl_list_item` to also invoke `impl_has_list_links!` or `impl_has_list_links_self_ptr!`. This is necessary to allow `impl_list_item` to see more of the tokens used by `impl_has_list_links{,_self_ptr}!`. A similar API change was discussed on the hrtimer series[1]. Link: https://lore.kernel.org/all/20250224-hrtimer-v3-v6-12-rc2-v9-1-5bd3bf0ce6cc@kernel.org/ [1] Tested-by: Alice Ryhl Reviewed-by: Alice Ryhl Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250709-list-no-offset-v4-6-a429e75840a9@gmail.com [ Fixed broken intra-doc links. Used the renamed `Opaque::cast_into`. - Miguel ] Signed-off-by: Miguel Ojeda commit 5d840b4c4935cd5100be97b6df565b4b159970a5 Author: Tamir Duberstein Date: Wed Jul 9 15:31:15 2025 -0400 rust: list: add `impl_list_item!` examples There's a comprehensive example in `rust/kernel/list.rs` but it doesn't exercise the `using ListLinksSelfPtr` variant nor the generic cases. Add that here. Generalize `impl_has_list_links_self_ptr` to handle nested fields in the same manner as `impl_has_list_links`. Tested-by: Alice Ryhl Reviewed-by: Alice Ryhl Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250709-list-no-offset-v4-5-a429e75840a9@gmail.com [ Fixed Rust < 1.82 build by enabling the `offset_of_nested` feature. - Miguel ] Signed-off-by: Miguel Ojeda commit 6a13057d500d48b1786344f4f93b0253adfc4e76 Author: Tamir Duberstein Date: Wed Jul 9 15:31:14 2025 -0400 rust: list: use fully qualified path Use a fully qualified path rooted at `$crate` rather than relying on imports in the invoking scope. Tested-by: Alice Ryhl Reviewed-by: Alice Ryhl Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250709-list-no-offset-v4-4-a429e75840a9@gmail.com Signed-off-by: Miguel Ojeda commit 9e626edd7b1469005625e7c5e7f2aea50d2b6646 Author: Tamir Duberstein Date: Wed Jul 9 15:31:13 2025 -0400 rust: list: use consistent self parameter name Refer to the self parameter of `impl_list_item!` by the same name used in `impl_has_list_links{,_self_ptr}!`. Reviewed-by: Christian Schrefl Tested-by: Alice Ryhl Reviewed-by: Alice Ryhl Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250709-list-no-offset-v4-3-a429e75840a9@gmail.com Signed-off-by: Miguel Ojeda commit 9cec86e4ae000947b268913ca0ef6ba519b6719a Author: Tamir Duberstein Date: Wed Jul 9 15:31:12 2025 -0400 rust: list: use consistent type parameter style Refer to the type parameters of `impl_has_list_links{,_self_ptr}!` by the same name used in `impl_list_item!`. Capture type parameters of `impl_list_item!` as `tt` using `{}` to match the style of all other macros that work with generics. Reviewed-by: Christian Schrefl Tested-by: Alice Ryhl Reviewed-by: Alice Ryhl Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250709-list-no-offset-v4-2-a429e75840a9@gmail.com Signed-off-by: Miguel Ojeda commit e71d7e39be6e2aa3fbba34cad12aa72ab853cfb5 Author: Tamir Duberstein Date: Wed Jul 9 15:31:11 2025 -0400 rust: list: simplify macro capture Avoid manually capturing generics; use `ty` to capture the whole type instead. Reviewed-by: Christian Schrefl Tested-by: Alice Ryhl Reviewed-by: Alice Ryhl Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250709-list-no-offset-v4-1-a429e75840a9@gmail.com Signed-off-by: Miguel Ojeda commit b0c7d8c9e8c671aaee6d14abd834f7d0d63e3c19 Author: Miguel Ojeda Date: Sat Jul 19 20:36:49 2025 +0200 rust: list: undo unintended replacement of method name When we renamed `Opaque::raw_get` to `cast_into`, there was one replacement that was not supposed to be there. It does not cause an issue so far because it is inside a macro rule (the `ListLinksSelfPtr` one) that is unused so far. However, it will start to be used soon. Thus fix it now. Fixes: 64fb810bce03 ("rust: types: rename Opaque::raw_get to cast_into") Reviewed-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250719183649.596051-1-ojeda@kernel.org Signed-off-by: Miguel Ojeda commit 931d9251e4855f79394357eb0071b5c4a189a8bd Author: Danilo Krummrich Date: Wed Jul 16 17:02:50 2025 +0200 rust: samples: dma: set DMA mask Set a DMA mask for the `pci::Device` in the Rust DMA sample driver. Reviewed-by: Abdiel Janulgue Reviewed-by: Daniel Almeida Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250716150354.51081-6-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 256de48f2cad85153b271b66320a9355773db64e Author: Danilo Krummrich Date: Wed Jul 16 17:02:49 2025 +0200 rust: platform: implement the `dma::Device` trait The platform bus is potentially capable of performing DMA, hence implement the `dma:Device` trait for `platform::Device`. Reviewed-by: Daniel Almeida Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250716150354.51081-5-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 8eb698f54736b44a398ca883d0a33f661c12da9d Author: Danilo Krummrich Date: Wed Jul 16 17:02:48 2025 +0200 rust: pci: implement the `dma::Device` trait The PCI bus is potentially capable of performing DMA, hence implement the `dma:Device` trait for `pci::Device`. Reviewed-by: Daniel Almeida Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250716150354.51081-4-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 101d66828a4eefb89b72256155feb6ec9abc144a Author: Danilo Krummrich Date: Wed Jul 16 17:02:47 2025 +0200 rust: dma: add DMA addressing capabilities Implement `dma_set_mask()`, `dma_set_coherent_mask()` and `dma_set_mask_and_coherent()` in the `dma::Device` trait. Those methods are used to set up the device's DMA addressing capabilities. Reviewed-by: Abdiel Janulgue Reviewed-by: Daniel Almeida Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250716150354.51081-3-dakr@kernel.org [ Add DmaMask::try_new(). - Danilo ] Signed-off-by: Danilo Krummrich commit ba28549bad8ab2b09264ebc8c2ca24af3537ee52 Merge: 7ff495e26a39f3 7a3cedafccf8e7 Author: Peter Zijlstra Date: Sat Jul 19 19:25:53 2025 +0200 Merge tag 'lockdep-for-tip.2025.07.16' of git://git.kernel.org/pub/scm/linux/kernel/git/boqun/linux into locking/core Locking changes for v6.17: - General - Mark devm_mutex_init() as __must_check - Add #[must_use] to Lock::try_lock() - Remove OWNER_SPINNABLE in rwsem - Remove redundant #ifdefs in mutex - Lockdep - Avoid returning struct in lock_stats() - Change `static const` into enum for LOCKF_*_IRQ_* - Temporarily use synchronize_rcu_expedited() in lockdep_unregister_key() to speed things up. Signed-off-by: Peter Zijlstra commit d06d5f66f5494e29c1520583eac8382f0ab5f8a7 Author: Danilo Krummrich Date: Wed Jul 16 17:02:46 2025 +0200 rust: dma: implement `dma::Device` trait Add a trait that defines the DMA specific methods of devices. The `dma::Device` trait is to be implemented by bus device representations, where the underlying bus is capable of DMA, such as `pci::Device` or `platform::Device`. Reviewed-by: Abdiel Janulgue Reviewed-by: Daniel Almeida Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250716150354.51081-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit d29591d5b52eaa62bc8c07ec83fe63018b5546ea Author: Nithyanantham Paramasivam Date: Fri Jul 18 08:25:13 2025 +0530 wifi: ath12k: Advertise encapsulation/decapsulation offload support to mac80211 Currently, the mac80211 layer handles construction and parsing of 802.11 headers during packet transmission and reception. Offloading encapsulation and decapsulation to hardware can significantly enhance performance. Check the service bit to determine if the firmware supports Ethernet offload. If supported, advertise the capability to mac80211 to bypass software-based 802.11 header processing. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00217-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250718025513.32982-4-nithyanantham.paramasivam@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 981050b918fc4c36e0ef3bd7392b39d7304ef09b Author: Nithyanantham Paramasivam Date: Fri Jul 18 08:25:12 2025 +0530 wifi: ath12k: Fix TX status reporting to mac80211 when offload is enabled Currently, the ath12k driver supports only the native Wi-Fi frame format. In this mode, the ieee80211_tx_status() function works correctly to report transmission status to mac80211, as it retrieves station information using sta_info_get_by_addrs(). However, this method is not applicable for Ethernet-converted packets, since sta_info_get_by_addrs() cannot extract station information from such formats. Retrieve station information using ath12k_peer_find_by_id() to support all frame formats, including native Wi-Fi, raw, and Ethernet. Report transmission status using ieee80211_tx_status_ext(), and include rate information as part of the datapath TX status report. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00217-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250718025513.32982-3-nithyanantham.paramasivam@oss.qualcomm.com [changed instances of { 0 } to {}] Signed-off-by: Jeff Johnson commit 646faf36d7271c597497ca547a59912fcab49be9 Author: Michal Koutný Date: Fri Jul 18 11:18:54 2025 +0200 cgroup: Add compatibility option for content of /proc/cgroups /proc/cgroups lists only v1 controllers by default, however, this is only enforced since the commit af000ce85293b ("cgroup: Do not report unavailable v1 controllers in /proc/cgroups") and there is software in the wild that uses content of /proc/cgroups to decide on availability of v2 (sic) controllers. Add a boottime param that can bring back the previous behavior for setups where the check in the software cannot be changed and it causes e.g. unintended OOMs. Also, this patch takes out cgrp_v1_visible from cgroup1_subsys_absent() guard since it's only important to check which hierarchy (v1 vs v2) the subsys is attached to. This has no effect on the printed message but the code is cleaner since cgrp_v1_visible is really about mounted hierarchies, not the content of /proc/cgroups. Link: https://lore.kernel.org/r/b26b60b7d0d2a5ecfd2f3c45f95f32922ed24686.camel@decadent.org.uk Fixes: af000ce85293b ("cgroup: Do not report unavailable v1 controllers in /proc/cgroups") Fixes: a0ab1453226d8 ("cgroup: Print message when /proc/cgroups is read on v2-only system") Signed-off-by: Michal Koutný Signed-off-by: Tejun Heo commit 192c8e9a131f1772a635c3c5df4cb592bd7b3e8b Author: Nithyanantham Paramasivam Date: Fri Jul 18 08:25:11 2025 +0530 wifi: ath12k: Fix the handling of TX packets in Ethernet mode Currently, in the transmit (TX) direction, EAPOL, QoS NULL, and multicast frames are sent in native Wi-Fi (802.11) format. However, when the virtual interface is configured in Ethernet mode, transmission fails for packets enqueued in native Wi-fi format. To address this issue, the firmware should be instructed to treat these packets as RAW type packets, ensuring proper handling even when the interface operates in Ethernet mode. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00217-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Nithyanantham Paramasivam Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250718025513.32982-2-nithyanantham.paramasivam@oss.qualcomm.com [fix indentation] Signed-off-by: Jeff Johnson commit 5607f5ed3c5f30f41e72ce09c8e616af0fc0d474 Author: Dan Carpenter Date: Fri Jul 18 16:22:15 2025 -0500 gpio: sysfs: Fix an end of loop test in gpiod_unexport() The test for "if (!desc_data)" does not work correctly because the list iterator in a list_for_each_entry() loop is always non-NULL. If we don't exit via a break, then it points to invalid memory. Instead, use a tmp variable for the list iterator and only set the "desc_data" when we have found a match. Fixes: 1cd53df733c2 ("gpio: sysfs: don't look up exported lines as class devices") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/747545bf-05f0-4f89-ba77-cb96bf9041f1@sabinyo.mountain Signed-off-by: Bartosz Golaszewski commit 0bbd90c2c6b2dc5b1211cc461a144c6c8808605d Author: Bartosz Golaszewski Date: Wed Jul 9 16:39:03 2025 +0200 pinctrl: ingenic: use pinmux_generic_add_pinfunction() Instead of passing individual fields of struct pinfunction to pinmux_generic_add_function(), use pinmux_generic_add_pinfunction() and pass the entire structure directly. Signed-off-by: Bartosz Golaszewski Reviewed-by: Paul Cercueil Link: https://lore.kernel.org/20250709-pinctrl-gpio-pinfuncs-v2-7-b6135149c0d9@linaro.org Signed-off-by: Linus Walleij commit adb9e21052c76ef8769b8f6c4c3c26a919bafc5e Author: Bartosz Golaszewski Date: Wed Jul 9 16:39:02 2025 +0200 pinctrl: keembay: use pinmux_generic_add_pinfunction() Instead of passing individual fields of struct pinfunction to pinmux_generic_add_function(), use pinmux_generic_add_pinfunction() and pass the entire structure directly. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250709-pinctrl-gpio-pinfuncs-v2-6-b6135149c0d9@linaro.org Signed-off-by: Linus Walleij commit 8f8fe52c5a072c1d1e2a8f91f9de95739bd80d52 Author: Bartosz Golaszewski Date: Wed Jul 9 16:39:01 2025 +0200 pinctrl: mediatek: moore: use pinmux_generic_add_pinfunction() Instead of passing individual fields of struct pinfunction to pinmux_generic_add_function(), use pinmux_generic_add_pinfunction() and pass the entire structure directly. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250709-pinctrl-gpio-pinfuncs-v2-5-b6135149c0d9@linaro.org Signed-off-by: Linus Walleij commit 7d7883db6efb7c48c8e9f94ed59c910f14256771 Author: Bartosz Golaszewski Date: Wed Jul 9 16:39:00 2025 +0200 pinctrl: airoha: use pinmux_generic_add_pinfunction() Instead of passing individual fields of struct pinfunction to pinmux_generic_add_function(), use pinmux_generic_add_pinfunction() and pass the entire structure directly. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250709-pinctrl-gpio-pinfuncs-v2-4-b6135149c0d9@linaro.org Signed-off-by: Linus Walleij commit cc154c00a61cdddafa8f6053afa09fcc519ddf25 Author: Bartosz Golaszewski Date: Wed Jul 9 16:38:59 2025 +0200 pinctrl: equilibrium: use pinmux_generic_add_pinfunction() Instead of passing individual fields of struct pinfunction to pinmux_generic_add_function(), use pinmux_generic_add_pinfunction() and pass the entire structure directly. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250709-pinctrl-gpio-pinfuncs-v2-3-b6135149c0d9@linaro.org Signed-off-by: Linus Walleij commit 431b68ae73566125e498a6b95b44afc3325c2f18 Author: Bartosz Golaszewski Date: Wed Jul 9 16:38:58 2025 +0200 pinctrl: provide pinmux_generic_add_pinfunction() Several drivers call pinmux_generic_add_function() passing it the contents of struct pinfunction as first three arguments. We can make this shorter by simply providing an interface allowing to pass the address of struct pinfunction directly when adding a new function. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250709-pinctrl-gpio-pinfuncs-v2-2-b6135149c0d9@linaro.org Signed-off-by: Linus Walleij commit dd47155a0e6f4ad1fe9ae0a00282f324153bb3a8 Author: Bartosz Golaszewski Date: Wed Jul 9 16:38:57 2025 +0200 pinctrl: pinmux: open-code PINCTRL_FUNCTION_DESC() This macro is only used in one place and pin function descriptors should only be created by pinmux core so there's no point in exposing it to other pinctrl users. Remove the macro and hand-code its functionality. Signed-off-by: Bartosz Golaszewski Reviewed-by: Bjorn Andersson Link: https://lore.kernel.org/20250709-pinctrl-gpio-pinfuncs-v2-1-b6135149c0d9@linaro.org Signed-off-by: Linus Walleij commit 63149542dcf4468ed15469035740a937cf9ff88a Author: Bartosz Golaszewski Date: Thu Jul 17 14:57:58 2025 +0200 pinctrl: ma35: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250717125758.53141-1-brgl@bgdev.pl Signed-off-by: Linus Walleij commit 6803b6ebb8164c1d306600f8836a39b6fceffeec Author: Mickaël Salaün Date: Sat Jul 19 12:42:00 2025 +0200 landlock: Fix cosmetic change This line removal should not be there and it makes it more difficult to backport the following patch. Cc: Günther Noack Cc: Konstantin Meskhidze Fixes: 7a11275c3787 ("landlock: Refactor layer helpers") Link: https://lore.kernel.org/r/20250719104204.545188-2-mic@digikod.net Signed-off-by: Mickaël Salaün commit 631ae0c01010ba20a42889fb8b6d902fa02d76c1 Author: Alexander Usyskin Date: Thu Jul 17 17:11:11 2025 +0300 mei: more prints with client prefix Use client-aware print macro instead of usual device print in more places to expand debug-ability. The client-aware print macro prefixes the usual device print with current connection endpoints. Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250717141112.1696482-3-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 3fd97f2292c7e3a0374337e2cdb25b0bf4f797e0 Author: Alexander Usyskin Date: Thu Jul 17 17:11:10 2025 +0300 mei: bus: use cldev in prints For unifomity, print using client device on bus where possible. Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250717141112.1696482-2-alexander.usyskin@intel.com Signed-off-by: Greg Kroah-Hartman commit 34120f7fa5d22aa836b0ff74bcb4dc171be71bb9 Merge: c7f37f8f3b89c5 0a686b9c4f847d Author: Greg Kroah-Hartman Date: Sat Jul 19 09:42:35 2025 +0200 Merge tag 'iio-for-6.17a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio into char-misc-next Jonathan writes: IIO: New device support, features, late breaking fixes and cleanup for 6.17 The normal mixed bag. A few more fixes than usual as I failed to send them out earlier. New device support ================== adi,ad4080 - New driver for this high speed ADC. Includes extensions to iio-backends necessary to support filter config, variable data lands and data alignment control. adi,ad4170-4 - New driver for this 24-bit very feature rich ADC suited for weigh scale and thermocouple applications. adi,ad7405 - New driver for this single channel isolated ADC with backend support (adi-axi-adc) google,cros_ec_activity - Add activity detection to the existing set of cros_ec drivers covering both human body and significant motion detection. mediatek,mt6359 - Add support for MT6363 and MT6373 PMIC Auxiliary ADCs. nicera,d3-323-aa - New driver for this configurable Passive InfraRed sensor. Device ID only ============== mediatek,mt7981-auxadc - Add ID to mt2701 driver as fully compatible with mt7986-auxadc. rohm,bu79100g - Add ID to ad7476 driver as fully compatible with TI ADS7866. Features ======== Core - New in_voltageY_convdelay to allow for devices to control timing offsets between sampling different channels. adi,ad-sigma-delta-library - Support SPI offload (later fix for missing Kconfig dependency) adi,ad4851 - SPI 3-wire support. adi,ad7606 - Power supply control. - convdelay and calibbias support for calibration purposes. - gain calibration support based on external filter resistance provided from device tree. adi,ad7768-1 - Add output regulator for VCM output, typically used for preconditioning circuits. - Add gpio controller for the 4 GPIOs. - Multiple scan type support to enable 16-bit modes. - Support synchronization over SPI. - Filter type and oversampling ratio control. - Low pass filter cut off read only attribute. adi,adxl313 - FIFO support - DC activity, inactivity detection with power-save on inactivity - AC coupled activity detection - Documentation for this complex driver. - debugfs register access. adi,adxl345 - Sampling frequency and sensor range controls. bosch,bmi270 - Add step counter support. invensense,icm42600 - Wake on motion support. Cleanup and fixes ================= backend - Drop unused parameter from iio_backend_ovesampling_ratio_set() docs - Fix ABI docs around I and Q modifiers. treewide - Switch remaining drives to use maple tree regcache. - Drop use of DRIVER_NAME style definitions when only used in one place. - Drop unused export.h includes. - Use = { } in place of memset in various drivers. - Constify various info structures and related. - Switch some drivers from array of chip_info structures to individual named structures. adi,ad-sigma_delta library - Fix over allocation of scan buffer. (bits/bytes confusion) - Sort includes and apply iwyu principles to ensure sensible set. - Use u8 instead of uint8_t - Replace hard coded type sizes with sizeof() and BITS_TO_BYTES() as appropriate. - Factor out setting of read address to reduce duplication. - Switch to buffer predisable so error handling on buffer enable functions correctly (balanced against postenable). adi,ad4000 - Don't use sift_right() on an unsigned value. adi,ad7173 - Add missing check on spi_setup() succeeding. - Simplify clock enable disable code using devm_clk_get_enabled() - Fix channel index for syscalib_mode - Fix number of configuration slots for some devics. - Fix the channel used for calibration. - Fix setting ODR up in probe. adi,ad7380 - Drop unused oversampling_ratio getter function call as value never used. adi,ad7606 - Exit if invalid dt_schema encountered rather than carrying on with unknown config. adi,ad7768-1 - Ensure SYNC_IN pulse is long enough. - Switch sampling_frequency_available to read_avail() callback. adi,ada4250 - Ensuring a dma-safe buffer for regmap_bulk_read() - Use a local dev variable to simplify code - Relax chip ID matching to allow for fallback dt compatibles. - Make use of devm_regulator_get_enabled_read_voltage() to replace equivalent code. - Shuffle elements around in struct to improve logical groupings and reduce holes. - Use dev_err_probe() adi,adxl313 - Use regcache to reduce traffic. - Factor out enabling of measurement. adi,adxl345 - Drop irq from struct as only used locally in code - Simplify measure enable function using regmap_update_bits() - Replace some magic numbers by units.h defines - Simplify interrupt mapping code - Simplify FIFO read out. adi,axi-dac - Factor out code to check for bus free to reduce duplication. avago,apds9306 - Use a helper to get register address in both get and set functions. bosch,bmi160+bmi270 - Ensure triggers suspended and resumed correctly. bosch,bmo055 - Fix theoretical OOB acces to hw_xlate array. freescale,vf610 - Drop -ENOMEM error message as plenty of existing prints if memory allocation fails. - Use dev_err_probe() and devm_clk_geT_enabled() to simplify probe(). kionix,kx022a - Apply include what you use principles to includes. invensense,itg3200 - Add missing dt-binding for this gyroscope. invensense,icm42600 - Switch from int64_t and similar to s64 and other kernel types. - Simplify arrangement of DMA safe buffers and potentially reduce structure size a little. invensense,mpu6050 - Reduce duplication in aux read/write code. - Use sysfs_emit() to replace scnprintf() murata,irsd200 - Drop duplicate printing of ret in dev_err_probe() nxp,lpc3220-adc - Add missing clocks property to dt-binding. st,spear600 - Convert dt-binding that got left behind in staging to yaml in the main tree. st,stm32-adc - Use dev_fwnode() rather than directly accessing the of_node. vti,sca3000 - Use direct returns instead of gotos where simple. Various other minor typo and white space fixes. * tag 'iio-for-6.17a' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/jic23/iio: (201 commits) iio: adc: ad_sigma_delta: Select IIO_BUFFER_DMAENGINE and SPI_OFFLOAD iio: adc: ad7173: fix setting ODR in probe iio: adc: ad7173: fix calibration channel iio: adc: ad7173: fix num_slots iio: adc: ad7173: fix channels index for syscalib_mode iio: adc: ad_sigma_delta: change to buffer predisable iio: ABI: fix correctness of I and Q modifiers iio: Add driver for Nicera D3-323-AA PIR sensor dt-bindings: iio: proximity: Add Nicera D3-323-AA PIR sensor dt-bindings: vendor-prefixes: Add Nicera iio: dac: vf610: Simplify with devm_clk_get_enabled() iio: adc: vf610: Simplify with dev_err_probe iio: adc: vf610: Drop -ENOMEM error message iio: imu: bno055: make bno055_sysfs_attr const iio: imu: bno055: fix OOB access of hw_xlate array dt-bindings: iio: adc: Add support for MT7981 iio: accel: kionix-kx022a: Apply approximate iwyu principles to includes iio: adc: ad4170-4: Add support for weigh scale, thermocouple, and RTD sens iio: adc: ad4170-4: Add support for internal temperature sensor iio: adc: ad4170-4: Add GPIO controller support ... commit c7f37f8f3b89c5d12256ae0381f972ad2af9ee96 Merge: 60c46a0bd34b25 37e00703228ab4 Author: Greg Kroah-Hartman Date: Sat Jul 19 09:41:06 2025 +0200 Merge tag 'fpga-for-6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next Xu writes: FPGA Manager changes for 6.17-rc1 - Marek's change fixes the incorrect use of sgtable calls. All patches have been reviewed on the mailing list, and have been in the last linux-next releases (as part of our for-next branch). Signed-off-by: Xu Yilun * tag 'fpga-for-6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga: zynq_fpga: use sgtable-based scatterlist wrappers commit 60c46a0bd34b253dec01c6339d9d6bd25486d72e Merge: 45e06a9d7496c7 00559ba3ae740e Author: Greg Kroah-Hartman Date: Sat Jul 19 09:37:37 2025 +0200 Merge tag 'mhi-for-v6.17' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi into char-misc-next Manivannan writes: MHI Host ======== - Make local functions static (as they should be). - Fix the modem name for Foxconn T99W640 modem. - Disable runtime PM for Qcom QDU100 modem as it doesn't support M3 state. - Fix endianness of BHI vector table to allow MHI to work correctly on big endian platforms like PowerPC. - Add modem support for Semtech EM929x, Foxconn T99W696 and Telit FN990B40 modems. - Fix the OOB access to Transfer Ring Element (TRE) by hardening the checks in parse_xfer_event(). * tag 'mhi-for-v6.17' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi: bus: mhi: host: pci_generic: Add Telit FN990B40 modem support bus: mhi: host: Detect events pointing to unexpected TREs bus: mhi: host: pci_generic: Add Foxconn T99W696 modem bus: mhi: host: Use str_true_false() helper bus: mhi: host: pci_generic: Add support for EM929x and set MRU to 32768 for better performance. bus: mhi: host: Fix endianness of BHI vector table bus: mhi: host: pci_generic: Disable runtime PM for QDU100 bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 bus: mhi: host: Make local functions static commit 954c0d74129948eed5c8f4a6898d3d5b344c8b18 Author: Paul E. McKenney Date: Thu Jul 17 11:55:41 2025 -0700 srcu: Add guards for SRCU-fast readers This adds the usual scoped_guard(srcu_fast, &my_srcu) and guard(srcu_fast)(&my_srcu). Suggested-by: Steven Rostedt Signed-off-by: Paul E. McKenney Cc: Mathieu Desnoyers Cc: Sebastian Andrzej Siewior Reviewed-by: Steven Rostedt (Google) Signed-off-by: Neeraj Upadhyay (AMD) commit 00559ba3ae740e7544b48fb509b2b97f56615892 Author: Daniele Palmas Date: Wed Jul 16 11:18:36 2025 +0200 bus: mhi: host: pci_generic: Add Telit FN990B40 modem support Add SDX72 based modem Telit FN990B40, reusing FN920C04 configuration. 01:00.0 Unassigned class [ff00]: Qualcomm Device 0309 Subsystem: Device 1c5d:201a Signed-off-by: Daniele Palmas [mani: added sdx72 in the comment to identify the chipset] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250716091836.999364-1-dnlplm@gmail.com commit 5bd398e20f0833ae8a1267d4f343591a2dd20185 Author: Youssef Samir Date: Mon Jul 14 18:30:39 2025 +0200 bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer is written")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. Fixes: 1d3173a3bae7 ("bus: mhi: core: Add support for processing events from client device") Signed-off-by: Youssef Samir [mani: added stable tag and reworded commit message] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Jeff Hugo Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250714163039.3438985-1-quic_yabdulra@quicinc.com commit 0d63055e1406c545f03857db02db7e657c635ebf Author: Slark Xiao Date: Wed May 28 17:22:32 2025 +0800 bus: mhi: host: pci_generic: Add Foxconn T99W696 modem T99W696 modem is based on Qualcomm SDX61 chipset, which is an economic version compared to the baseline SDX62/SDX65 chipsets. Add support for it by introducing a new 'mhi_channel_config'. Since this modem supports the NMEA channel, a new config is needed. Signed-off-by: Slark Xiao [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250528092232.16111-1-slark_xiao@163.com commit e99f55e438d187bf60cbff5493818e7130687fc7 Author: Yumeng Fang Date: Mon Jun 23 20:28:14 2025 +0800 bus: mhi: host: Use str_true_false() helper Remove hard-coded strings by using the str_true_false() helper. Signed-off-by: Yumeng Fang Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250623202814633ukJqUDLU7BRlLLhvWkbD7@zte.com.cn commit b484fa61acea341c3c0be7ae7414071bc22a19d3 Author: Adam Xue Date: Wed May 28 10:59:43 2025 -0700 bus: mhi: host: pci_generic: Add support for EM929x and set MRU to 32768 for better performance. Add MHI controller config for EM929x. It uses the same configuration as EM919x. Also set the MRU to 32768 to improve downlink throughput. 02:00.0 Unassigned class [ff00]: Qualcomm Technologies, Inc Device 0308 Subsystem: Device 18d7:0301 Signed-off-by: Adam Xue Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250528175943.12739-1-zxue@semtech.com commit f471578e8b1a90623674433a01a8845110bc76ce Author: Alexander Wilhelm Date: Mon May 19 16:58:37 2025 +0200 bus: mhi: host: Fix endianness of BHI vector table On big endian platform like PowerPC, the MHI bus (which is little endian) does not start properly. The following example shows the error messages by using QCN9274 WLAN device with ath12k driver: ath12k_pci 0001:01:00.0: BAR 0: assigned [mem 0xc00000000-0xc001fffff 64bit] ath12k_pci 0001:01:00.0: MSI vectors: 1 ath12k_pci 0001:01:00.0: Hardware name: qcn9274 hw2.0 ath12k_pci 0001:01:00.0: failed to set mhi state: POWER_ON(2) ath12k_pci 0001:01:00.0: failed to start mhi: -110 ath12k_pci 0001:01:00.0: failed to power up :-110 ath12k_pci 0001:01:00.0: failed to create soc core: -110 ath12k_pci 0001:01:00.0: failed to init core: -110 ath12k_pci: probe of 0001:01:00.0 failed with error -110 The issue seems to be with the incorrect DMA address/size used for transferring the firmware image over BHI. So fix it by converting the DMA address and size of the BHI vector table to little endian format before sending them to the device. Fixes: 6cd330ae76ff ("bus: mhi: core: Add support for ringing channel/event ring doorbells") Signed-off-by: Alexander Wilhelm [mani: added stable tag and reworded commit message] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Jeff Hugo Reviewed-by: Krishna Chaitanya Chundru Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250519145837.958153-1-alexander.wilhelm@westermo.com commit 0494cf9793b7c250f63fdb2cb6b648473e9d4ae6 Author: Vivek Pernamitta Date: Fri Apr 25 12:49:31 2025 +0530 bus: mhi: host: pci_generic: Disable runtime PM for QDU100 The QDU100 device does not support the MHI M3 state, necessitating the disabling of runtime PM for this device. It is essential to disable runtime PM if the device does not support M3 state. Signed-off-by: Vivek Pernamitta [mani: Fixed the kdoc comment for no_m3] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Krishna Chaitanya Chundru Link: https://patch.msgid.link/20250425-vdev_next-20250411_pm_disable-v4-1-d4870a73ebf9@quicinc.com commit ae5a34264354087aef38cdd07961827482a51c5a Author: Slark Xiao Date: Fri Jun 6 17:50:19 2025 +0800 bus: mhi: host: pci_generic: Fix the modem name of Foxconn T99W640 T99W640 was mistakenly mentioned as T99W515. T99W515 is a LGA device, not a M.2 modem device. So correct it's name to avoid name mismatch issue. Fixes: bf30a75e6e00 ("bus: mhi: host: Add support for Foxconn SDX72 modems") Signed-off-by: Slark Xiao [mani: commit message fixup] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250606095019.383992-1-slark_xiao@163.com commit 4701ee5044fb3992f1c910630a9673c2dc600ce5 Author: Alok Tiwari Date: Thu Jul 17 12:35:47 2025 -0700 be2net: Use correct byte order and format string for TCP seq and ack_seq The TCP header fields seq and ack_seq are 32-bit values in network byte order as (__be32). these fields were earlier printed using ntohs(), which converts only 16-bit values and produces incorrect results for 32-bit fields. This patch is changeing the conversion to ntohl(), ensuring correct interpretation of these sequence numbers. Notably, the format specifier is updated from %d to %u to reflect the unsigned nature of these fields. improves the accuracy of debug log messages for TCP sequence and acknowledgment numbers during TX timeouts. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250717193552.3648791-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 190ccb817637887d52bd789c9f17403d60227ae1 Author: Florian Fainelli Date: Thu Jul 17 11:09:15 2025 -0700 net: bcmasp: Add support for re-starting auto-negotiation Wire-up ethtool_ops::nway_reset to phy_ethtool_nway_reset in order to support re-starting auto-negotiation. Signed-off-by: Florian Fainelli Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250717180915.2611890-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit e07ba344a46500ec7c11e4b7e3e47b03b09ef58d Merge: 25250f40e2a9ca 88d3cec28274f9 Author: Jakub Kicinski Date: Fri Jul 18 17:27:51 2025 -0700 Merge branch 'net-maintain-netif-vs-dev-prefix-semantics' Stanislav Fomichev says: ==================== net: maintain netif vs dev prefix semantics Commit cc34acd577f1 ("docs: net: document new locking reality") introduced netif_ vs dev_ function semantics: the former expects locked netdev, the latter takes care of the locking. We don't strictly follow this semantics on either side, but there are more dev_xxx handlers now that don't fit. Rename them to netif_xxx where appropriate. We care only about driver-visible APIs, don't touch stack-internal routines. The rest seem to be ok: * dev_xdp_prog_count - mostly called by sw drivers (bonding), should not matter * dev_get_by_xxx - too many to reasonably cleanup, already have different flavors * dev_fetch_sw_netstats - don't need instance lock * dev_get_tstats64 - never called directly, only as an ndo callback * dev_pick_tx_zero - never called directly, only as an ndo callback * dev_add_pack / dev_remove_pack - called early enough (in module init) to not matter * dev_get_iflink - mostly called by sw drivers, should not matter * dev_fill_forward_path - ditto * dev_getbyhwaddr_rcu - ditto * dev_getbyhwaddr - ditto * dev_getfirstbyhwtype - ditto * dev_valid_name - ditto * __dev_forward_skb dev_forward_skb dev_queue_xmit_nit - established helpers, no netif vs dev distinction ==================== Link: https://patch.msgid.link/20250717172333.1288349-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 88d3cec28274f9c15355835466c0c694e313680e Author: Stanislav Fomichev Date: Thu Jul 17 10:23:33 2025 -0700 net: s/dev_close_many/netif_close_many/ Commit cc34acd577f1 ("docs: net: document new locking reality") introduced netif_ vs dev_ function semantics: the former expects locked netdev, the latter takes care of the locking. We don't strictly follow this semantics on either side, but there are more dev_xxx handlers now that don't fit. Rename them to netif_xxx where appropriate. netif_close_many is used only by vlan/dsa and one mtk driver, so move it into NETDEV_INTERNAL namespace. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250717172333.1288349-8-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 5d4d84618e1aa2c9531afa3a6323f56e1db4dcf7 Author: Stanislav Fomichev Date: Thu Jul 17 10:23:32 2025 -0700 net: s/dev_set_threaded/netif_set_threaded/ Commit cc34acd577f1 ("docs: net: document new locking reality") introduced netif_ vs dev_ function semantics: the former expects locked netdev, the latter takes care of the locking. We don't strictly follow this semantics on either side, but there are more dev_xxx handlers now that don't fit. Rename them to netif_xxx where appropriate. Note that one dev_set_threaded call still remains in mt76 for debugfs file. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250717172333.1288349-7-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 93893a57efd431b9b4e72359bc8a8428681ca688 Author: Stanislav Fomichev Date: Thu Jul 17 10:23:31 2025 -0700 net: s/dev_get_flags/netif_get_flags/ Commit cc34acd577f1 ("docs: net: document new locking reality") introduced netif_ vs dev_ function semantics: the former expects locked netdev, the latter takes care of the locking. We don't strictly follow this semantics on either side, but there are more dev_xxx handlers now that don't fit. Rename them to netif_xxx where appropriate. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250717172333.1288349-6-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 303a8487a657c357ca6abc06a4045f72cdae90d5 Author: Stanislav Fomichev Date: Thu Jul 17 10:23:30 2025 -0700 net: s/__dev_set_mtu/__netif_set_mtu/ Commit cc34acd577f1 ("docs: net: document new locking reality") introduced netif_ vs dev_ function semantics: the former expects locked netdev, the latter takes care of the locking. We don't strictly follow this semantics on either side, but there are more dev_xxx handlers now that don't fit. Rename them to netif_xxx where appropriate. __netif_set_mtu is used only by bond, so move it into NETDEV_INTERNAL namespace. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250717172333.1288349-5-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 0413a34ef678c3e2f0fafb4e113e810a05197030 Author: Stanislav Fomichev Date: Thu Jul 17 10:23:29 2025 -0700 net: s/dev_pre_changeaddr_notify/netif_pre_changeaddr_notify/ Commit cc34acd577f1 ("docs: net: document new locking reality") introduced netif_ vs dev_ function semantics: the former expects locked netdev, the latter takes care of the locking. We don't strictly follow this semantics on either side, but there are more dev_xxx handlers now that don't fit. Rename them to netif_xxx where appropriate. netif_pre_changeaddr_notify is used only by ipvlan/bond, so move it into NETDEV_INTERNAL namespace. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250717172333.1288349-4-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit af1d017377c1c1931bfb898e719ab712cf79f944 Author: Stanislav Fomichev Date: Thu Jul 17 10:23:28 2025 -0700 net: s/dev_get_mac_address/netif_get_mac_address/ Commit cc34acd577f1 ("docs: net: document new locking reality") introduced netif_ vs dev_ function semantics: the former expects locked netdev, the latter takes care of the locking. We don't strictly follow this semantics on either side, but there are more dev_xxx handlers now that don't fit. Rename them to netif_xxx where appropriate. netif_get_mac_address is used only by tun/tap, so move it into NETDEV_INTERNAL namespace. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250717172333.1288349-3-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit ffea1168346120df9417fcafd8f3a1c93033ae34 Author: Stanislav Fomichev Date: Thu Jul 17 10:23:27 2025 -0700 net: s/dev_get_port_parent_id/netif_get_port_parent_id/ Commit cc34acd577f1 ("docs: net: document new locking reality") introduced netif_ vs dev_ function semantics: the former expects locked netdev, the latter takes care of the locking. We don't strictly follow this semantics on either side, but there are more dev_xxx handlers now that don't fit. Rename them to netif_xxx where appropriate. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250717172333.1288349-2-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit 25250f40e2a9cade7ef294af8bee0b2bd0afca2d Author: Ido Schimmel Date: Thu Jul 17 15:51:51 2025 +0300 selftests: rtnetlink: Add operational state test Virtual devices (e.g., VXLAN) that do not have a notion of a carrier are created with an "UNKNOWN" operational state which some users find confusing [1]. It is possible to set the operational state from user space either during device creation or afterwards and some applications will start doing that in order to avoid the above problem. Add a test for this functionality to ensure it does not regress. [1] https://lore.kernel.org/netdev/20241119153703.71f97b76@hermes.local/ Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250717125151.466882-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit e7ce59d9205e3842d0931632372aaf9fb4d901cf Author: Oleksij Rempel Date: Thu Jul 17 10:35:24 2025 +0200 net: selftests: add PHY-loopback test for bad TCP checksums Detect NICs and drivers that either drop frames with a corrupted TCP checksum or, worse, pass them up as valid. The test flips one bit in the checksum, transmits the packet in internal loopback, and fails when the driver reports CHECKSUM_UNNECESSARY. Discussed at: https://lore.kernel.org/all/20250625132117.1b3264e8@kernel.org/ Signed-off-by: Oleksij Rempel Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250717083524.1645069-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 42be23e8f2dcb100cb9944b2b54b6bf41aff943d Author: Eduard Zingerman Date: Fri Jul 18 15:20:59 2025 -0700 libbpf: Verify that arena map exists when adding arena relocations Fuzzer reported a memory access error in bpf_program__record_reloc() that happens when: - ".addr_space.1" section exists - there is a relocation referencing this section - there are no arena maps defined in BTF. Sanity checks for maps existence are already present in bpf_program__record_reloc(), hence this commit adds another one. [1] https://github.com/libbpf/libbpf/actions/runs/16375110681/job/46272998064 Signed-off-by: Eduard Zingerman Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250718222059.281526-1-eddyz87@gmail.com commit a6f190630d070173897a7e98a30188b7638ba0a1 Author: Jesper Dangaard Brouer Date: Wed Jul 16 18:26:53 2025 +0200 net: track pfmemalloc drops via SKB_DROP_REASON_PFMEMALLOC Add a new SKB drop reason (SKB_DROP_REASON_PFMEMALLOC) to track packets dropped due to memory pressure. In production environments, we've observed memory exhaustion reported by memory layer stack traces, but these drops were not properly tracked in the SKB drop reason infrastructure. While most network code paths now properly report pfmemalloc drops, some protocol-specific socket implementations still use sk_filter() without drop reason tracking: - Bluetooth L2CAP sockets - CAIF sockets - IUCV sockets - Netlink sockets - SCTP sockets - Unix domain sockets These remaining cases represent less common paths and could be converted in a follow-up patch if needed. The current implementation provides significantly improved observability into memory pressure events in the network stack, especially for key protocols like TCP and UDP, helping to diagnose problems in production environments. Reported-by: Matt Fleming Signed-off-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/175268316579.2407873.11634752355644843509.stgit@firesoul Signed-off-by: Jakub Kicinski commit 8b7ab8eb52b51a7058edf0035e47b281f9fc9a19 Author: Suchit Karunakaran Date: Wed Jul 16 21:04:04 2025 +0530 net: stream: add description for sk_stream_write_space() Add a proper description for the sk_stream_write_space() function as previously marked by a FIXME comment. No functional changes. Signed-off-by: Suchit Karunakaran Link: https://patch.msgid.link/20250716153404.7385-1-suchitkarunakaran@gmail.com Signed-off-by: Jakub Kicinski commit 3a32c5b3bb7d2dfad5fab94817f59e8963e2b1a6 Merge: 49d6e658e758e4 f10f46a0ee5342 Author: Dave Jiang Date: Fri Jul 18 16:15:44 2025 -0700 Merge branch 'for-6.17/cxl-events-updates' into cxl-for-next Update Common Event Record to CXL r3.2 definition. Add additional validity check for event records. Add memory sparing event record tracing. commit 49d6e658e758e42aaff8ae5ecdd2d06b29abf53e Author: Dan Carpenter Date: Fri Jul 18 16:22:40 2025 -0500 cxl/region: Fix an ERR_PTR() vs NULL bug The __cxl_decoder_detach() function is expected to return NULL on error but this error path accidentally returns an error pointer. It could potentially lead to an error pointer dereference in the caller. Change it to return NULL. Fixes: b3a88225519c ("cxl/region: Consolidate cxl_decoder_kill_region() and cxl_region_detach()") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/7def7da0-326a-410d-8c92-718c8963c0a2@sabinyo.mountain Signed-off-by: Dave Jiang commit ab6bc44159d8f0c4ee757e0ce041fa9033e0ead8 Author: Xu Yilun Date: Wed Jul 16 15:03:49 2025 +0800 iommufd: Rename some shortterm-related identifiers Rename the shortterm-related identifiers to wait-related. The usage of shortterm_users refcount is now beyond its name. It is also used for references which live longer than an ioctl execution. E.g. vdev holds idev's shortterm_users refcount on vdev allocation, releases it during idev's pre_destroy(). Rename the refcount as wait_cnt, since it is always used to sync the referencing & the destruction of the object by waiting for it to go to zero. List all changed identifiers: iommufd_object::shortterm_users -> iommufd_object::wait_cnt REMOVE_WAIT_SHORTTERM -> REMOVE_WAIT iommufd_object_dec_wait_shortterm() -> iommufd_object_dec_wait() zerod_shortterm -> zerod_wait_cnt No functional change intended. Link: https://patch.msgid.link/r/20250716070349.1807226-9-yilun.xu@linux.intel.com Suggested-by: Kevin Tian Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Reviewed-by: Nicolin Chen Tested-by: Nicolin Chen Signed-off-by: Xu Yilun Signed-off-by: Jason Gunthorpe commit 39a369c34152e1b76895fda37aa586dfb9b2cf38 Author: Xu Yilun Date: Wed Jul 16 15:03:48 2025 +0800 iommufd/selftest: Add coverage for vdevice tombstone This tests the flow to tombstone vdevice when idevice is to be unbound before vdevice destruction. The expected results of the tombstone are: - The vdevice ID can't be reused anymore (not tested in this patch). - Even ioctl(IOMMU_DESTROY) can't free the vdevice ID. - iommufd_fops_release() can still free everything. Link: https://patch.msgid.link/r/20250716070349.1807226-8-yilun.xu@linux.intel.com Reviewed-by: Nicolin Chen Tested-by: Nicolin Chen Signed-off-by: Xu Yilun Signed-off-by: Jason Gunthorpe commit c4e496d413686cbd717139cfd8c58f467eff9e08 Author: Xu Yilun Date: Wed Jul 16 15:03:47 2025 +0800 iommufd/selftest: Explicitly skip tests for inapplicable variant no_viommu is not applicable for some viommu/vdevice tests. Explicitly report the skipping, don't do it silently. Opportunistically adjust the line wrappings after the indentation changes using git clang-format. Only add the prints. No functional change intended. Link: https://patch.msgid.link/r/20250716070349.1807226-7-yilun.xu@linux.intel.com Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Tested-by: Nicolin Chen Signed-off-by: Xu Yilun Signed-off-by: Jason Gunthorpe commit 651f733675c4a26e59dd34522917eace20c557c0 Author: Xu Yilun Date: Wed Jul 16 15:03:46 2025 +0800 iommufd/vdevice: Remove struct device reference from struct vdevice Remove struct device *dev from struct vdevice. The dev pointer is the Plan B for vdevice to reference the physical device. As now vdev->idev is added without refcounting concern, just use vdev->idev->dev when needed. To avoid exposing struct iommufd_device in the public header, export a iommufd_vdevice_to_device() helper. Link: https://patch.msgid.link/r/20250716070349.1807226-6-yilun.xu@linux.intel.com Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Co-developed-by: Nicolin Chen Signed-off-by: Nicolin Chen Tested-by: Nicolin Chen Signed-off-by: Xu Yilun Signed-off-by: Jason Gunthorpe commit 850f14f5b91986e586b66565c9c75bdd4c834571 Author: Xu Yilun Date: Wed Jul 16 15:03:45 2025 +0800 iommufd: Destroy vdevice on idevice destroy Destroy iommufd_vdevice (vdev) on iommufd_idevice (idev) destruction so that vdev can't outlive idev. idev represents the physical device bound to iommufd, while the vdev represents the virtual instance of the physical device in the VM. The lifecycle of the vdev should not be longer than idev. This doesn't cause real problem on existing use cases cause vdev doesn't impact the physical device, only provides virtualization information. But to extend vdev for Confidential Computing (CC), there are needs to do secure configuration for the vdev, e.g. TSM Bind/Unbind. These configurations should be rolled back on idev destroy, or the external driver (VFIO) functionality may be impact. The idev is created by external driver so its destruction can't fail. The idev implements pre_destroy() op to actively remove its associated vdev before destroying itself. There are 3 cases on idev pre_destroy(): 1. vdev is already destroyed by userspace. No extra handling needed. 2. vdev is still alive. Use iommufd_object_tombstone_user() to destroy vdev and tombstone the vdev ID. 3. vdev is being destroyed by userspace. The vdev ID is already freed, but vdev destroy handler is not completed. This requires multi-threads syncing - vdev holds idev's short term users reference until vdev destruction completes, idev leverages existing wait_shortterm mechanism for syncing. idev should also block any new reference to it after pre_destroy(), or the following wait shortterm would timeout. Introduce a 'destroying' flag, set it to true on idev pre_destroy(). Any attempt to reference idev should honor this flag under the protection of idev->igroup->lock. Link: https://patch.msgid.link/r/20250716070349.1807226-5-yilun.xu@linux.intel.com Originally-by: Nicolin Chen Suggested-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Co-developed-by: "Aneesh Kumar K.V (Arm)" Signed-off-by: "Aneesh Kumar K.V (Arm)" Tested-by: Nicolin Chen Signed-off-by: Xu Yilun Signed-off-by: Jason Gunthorpe commit 7dc0e1090ba80bcf1bbb69b334ccb3c47631a9c5 Author: Xu Yilun Date: Wed Jul 16 15:03:44 2025 +0800 iommufd: Add a pre_destroy() op for objects Add a pre_destroy() op which gives objects a chance to clear their short term users references before destruction. This op is intended for external driver created objects (e.g. idev) which does deterministic destruction. In order to manage the lifecycle of interrelated objects as well as the deterministic destruction (e.g. vdev can't outlive idev, and idev destruction can't fail), short term users references are allowed to live out of an ioctl execution. An immediate use case is, vdev holds idev's short term user reference until vdev destruction completes, idev leverages existing wait_shortterm mechanism to ensure it is destroyed after vdev. This extended usage makes the referenced object unable to just wait for its reference gone. It needs to actively trigger the reference removal, as well as prevent new references before wait. Should implement these work in pre_destroy(). Link: https://patch.msgid.link/r/20250716070349.1807226-4-yilun.xu@linux.intel.com Suggested-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Tested-by: Nicolin Chen Signed-off-by: Xu Yilun Signed-off-by: Jason Gunthorpe commit e6d41ee31219b4d605c2a26bdca0984108e6e01a Author: Xu Yilun Date: Wed Jul 16 15:03:43 2025 +0800 iommufd: Add iommufd_object_tombstone_user() helper Add the iommufd_object_tombstone_user() helper, which allows the caller to destroy an iommufd object created by userspace. This is useful on some destroy paths when the kernel caller finds the object should have been removed by userspace but is still alive. With this helper, the caller destroys the object but leave the object ID reserved (so called tombstone). The tombstone prevents repurposing the object ID without awareness of the original user. Since this happens for abnormal userspace behavior, for simplicity, the tombstoned object ID would be permanently leaked until iommufd_fops_release(). I.e. the original user gets an error when calling ioctl(IOMMU_DESTROY) on that ID. The first use case would be to ensure the iommufd_vdevice can't outlive the associated iommufd_device. Link: https://patch.msgid.link/r/20250716070349.1807226-3-yilun.xu@linux.intel.com Suggested-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Co-developed-by: "Aneesh Kumar K.V (Arm)" Signed-off-by: "Aneesh Kumar K.V (Arm)" Tested-by: Nicolin Chen Signed-off-by: Xu Yilun Signed-off-by: Jason Gunthorpe commit a64bae68adf1f817696752abee8d086e0d9f7941 Author: Xu Yilun Date: Wed Jul 16 15:03:42 2025 +0800 iommufd/viommu: Roll back to use iommufd_object_alloc() for vdevice To solve the vdevice lifecycle issue, future patches make the vdevice allocation protected by lock. That will make _iommufd_object_alloc_ucmd() not applicable for vdevice. Roll back to use _iommufd_object_alloc() for preparation. Link: https://patch.msgid.link/r/20250716070349.1807226-2-yilun.xu@linux.intel.com Reviewed-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Tested-by: Nicolin Chen Signed-off-by: Xu Yilun Signed-off-by: Jason Gunthorpe commit 5d8b1d957def5358113aa39b299c084836893b73 Author: Jason Gunthorpe Date: Thu Jul 17 14:59:02 2025 -0300 iommufd/selftest: Test reserved regions near ULONG_MAX This has triggered an overflow inside the ioas iova auto allocation logic, test it directly. Use the same stimulus syzkaller found. Link: https://patch.msgid.link/all/2-v1-7b4a16fc390b+10f4-iommufd_alloc_overflow_jgg@nvidia.com/ Tested-by: Yi Liu Tested-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit beb1097ec8bdf15e2fed3301920a719e0dd2250a Merge: 0ee30d937c147f 7abc678e308467 Author: Alexei Starovoitov Date: Fri Jul 18 12:14:51 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after rc6 Cross-merge BPF and other fixes after downstream PR. No conflicts. Signed-off-by: Alexei Starovoitov commit 2e6dbb25ea15844c8b617260d635731c37c85ac9 Author: Caleb Sander Mateos Date: Tue Jul 8 14:22:12 2025 -0600 io_uring/cmd: remove struct io_uring_cmd_data There are no more users of struct io_uring_cmd_data and its op_data field. Remove it to shave 8 bytes from struct io_async_cmd and eliminate a store and load for every uring_cmd. Signed-off-by: Caleb Sander Mateos Acked-by: David Sterba Link: https://lore.kernel.org/r/20250708202212.2851548-5-csander@purestorage.com Signed-off-by: Jens Axboe commit 9aad72b4e3f0233e747bb6b1ec05ea71365f4246 Author: Caleb Sander Mateos Date: Tue Jul 8 14:22:11 2025 -0600 btrfs/ioctl: store btrfs_uring_encoded_data in io_btrfs_cmd btrfs is the only user of struct io_uring_cmd_data and its op_data field. Switch its ->uring_cmd() implementations to store the struct btrfs_uring_encoded_data * in the struct io_btrfs_cmd, overlayed with io_uring_cmd's pdu field. This avoids having to touch another cache line to access the struct btrfs_uring_encoded_data *, and allows op_data and struct io_uring_cmd_data to be removed. Signed-off-by: Caleb Sander Mateos Acked-by: David Sterba Link: https://lore.kernel.org/r/20250708202212.2851548-4-csander@purestorage.com Signed-off-by: Jens Axboe commit 733c43f1df34f9185b945e6f12ac00c8556c6dfe Author: Caleb Sander Mateos Date: Tue Jul 8 14:22:10 2025 -0600 io_uring/cmd: introduce IORING_URING_CMD_REISSUE flag Add a flag IORING_URING_CMD_REISSUE that ->uring_cmd() implementations can use to tell whether this is the first or subsequent issue of the uring_cmd. This will allow ->uring_cmd() implementations to store information in the io_uring_cmd's pdu across issues. Signed-off-by: Caleb Sander Mateos Acked-by: David Sterba Link: https://lore.kernel.org/r/20250708202212.2851548-3-csander@purestorage.com Signed-off-by: Jens Axboe commit 1bb3363da862e0464ec050eea2fb5472a36ad86b Author: Qasim Ijaz Date: Mon Jul 14 00:30:08 2025 +0100 HID: apple: validate feature-report field count to prevent NULL pointer dereference A malicious HID device with quirk APPLE_MAGIC_BACKLIGHT can trigger a NULL pointer dereference whilst the power feature-report is toggled and sent to the device in apple_magic_backlight_report_set(). The power feature-report is expected to have two data fields, but if the descriptor declares one field then accessing field[1] and dereferencing it in apple_magic_backlight_report_set() becomes invalid since field[1] will be NULL. An example of a minimal descriptor which can cause the crash is something like the following where the report with ID 3 (power report) only references a single 1-byte field. When hid core parses the descriptor it will encounter the final feature tag, allocate a hid_report (all members of field[] will be zeroed out), create field structure and populate it, increasing the maxfield to 1. The subsequent field[1] access and dereference causes the crash. Usage Page (Vendor Defined 0xFF00) Usage (0x0F) Collection (Application) Report ID (1) Usage (0x01) Logical Minimum (0) Logical Maximum (255) Report Size (8) Report Count (1) Feature (Data,Var,Abs) Usage (0x02) Logical Maximum (32767) Report Size (16) Report Count (1) Feature (Data,Var,Abs) Report ID (3) Usage (0x03) Logical Minimum (0) Logical Maximum (1) Report Size (8) Report Count (1) Feature (Data,Var,Abs) End Collection Here we see the KASAN splat when the kernel dereferences the NULL pointer and crashes: [ 15.164723] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] SMP KASAN NOPTI [ 15.165691] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 15.165691] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0 #31 PREEMPT(voluntary) [ 15.165691] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 15.165691] RIP: 0010:apple_magic_backlight_report_set+0xbf/0x210 [ 15.165691] Call Trace: [ 15.165691] [ 15.165691] apple_probe+0x571/0xa20 [ 15.165691] hid_device_probe+0x2e2/0x6f0 [ 15.165691] really_probe+0x1ca/0x5c0 [ 15.165691] __driver_probe_device+0x24f/0x310 [ 15.165691] driver_probe_device+0x4a/0xd0 [ 15.165691] __device_attach_driver+0x169/0x220 [ 15.165691] bus_for_each_drv+0x118/0x1b0 [ 15.165691] __device_attach+0x1d5/0x380 [ 15.165691] device_initial_probe+0x12/0x20 [ 15.165691] bus_probe_device+0x13d/0x180 [ 15.165691] device_add+0xd87/0x1510 [...] To fix this issue we should validate the number of fields that the backlight and power reports have and if they do not have the required number of fields then bail. Fixes: 394ba612f941 ("HID: apple: Add support for magic keyboard backlight on T2 Macs") Cc: stable@vger.kernel.org Signed-off-by: Qasim Ijaz Reviewed-by: Orlando Chamberlain Tested-by: Aditya Garg Link: https://patch.msgid.link/20250713233008.15131-1-qasdev00@gmail.com Signed-off-by: Benjamin Tissoires commit 0d1c95e42b77cb79461bf7edff24c63d0b2d46fe Author: Yuto Ohnuki Date: Thu Jul 17 09:46:09 2025 +0100 ixgbevf: remove unused fields from struct ixgbevf_adapter Remove hw_rx_no_dma_resources and eitr_param fields from struct ixgbevf_adapter since these fields are never referenced in the driver. Note that the interrupt throttle rate is controlled by the rx_itr_setting and tx_itr_setting variables. This change simplifies the ixgbevf driver by removing unused fields, which improves maintainability. Signed-off-by: Yuto Ohnuki Reviewed-by: Dawid Osuchowski Signed-off-by: Tony Nguyen commit dfe80201e1b04f683698a065f059b66102b12e89 Author: Yuto Ohnuki Date: Mon Jul 7 19:01:17 2025 +0100 igbvf: remove unused fields from struct igbvf_adapter Remove following unused fields from struct igbvf_adapter that are never referenced in the driver. - blink_timer - eeprom_wol - fc_autoneg - int_mode - led_status - mng_vlan_id - polling_interval - rx_dma_failed - test_icr - test_rx_ring - test_tx_ring - tx_dma_failed - tx_fifo_head - tx_fifo_size - tx_head_addr Also removed the following fields from struct igbvf_adapter since they are never read or used after initialization by igbvf_probe() and igbvf_sw_init(). - bd_number - rx_abs_int_delay - tx_abs_int_delay - rx_int_delay - tx_int_delay This changes simplify the igbvf driver by removing unused fields, which improves maintenability. Tested-by: Kohei Enju Signed-off-by: Yuto Ohnuki Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit d5b97c01ce28245144abeb74afe0bd34f8ba91cb Author: Song Yoong Siang Date: Fri Jun 20 18:02:51 2025 +0800 igc: Add wildcard rule support to ethtool NFC using Default Queue Introduce support for a lowest priority wildcard (catch-all) rule in ethtool's Network Flow Classification (NFC) for the igc driver. The wildcard rule directs all unmatched network traffic, including traffic not captured by Receive Side Scaling (RSS), to a specified queue. This functionality utilizes the Default Queue feature available in I225/I226 hardware. The implementation has been validated on Intel ADL-S systems with two back-to-back connected I226 network interfaces. Testing Procedure: 1. On the Device Under Test (DUT), verify the initial statistic: $ ethtool -S enp1s0 | grep rx_q.*packets rx_queue_0_packets: 0 rx_queue_1_packets: 0 rx_queue_2_packets: 0 rx_queue_3_packets: 0 2. From the Link Partner, send 10 ARP packets: $ arping -c 10 -I enp170s0 169.254.1.2 3. On the DUT, verify the packet reception on Queue 0: $ ethtool -S enp1s0 | grep rx_q.*packets rx_queue_0_packets: 10 rx_queue_1_packets: 0 rx_queue_2_packets: 0 rx_queue_3_packets: 0 4. On the DUT, add a wildcard rule to route all packets to Queue 3: $ sudo ethtool -N enp1s0 flow-type ether queue 3 5. From the Link Partner, send another 10 ARP packets: $ arping -c 10 -I enp170s0 169.254.1.2 6. Now, packets are routed to Queue 3 by the wildcard (Default Queue) rule: $ ethtool -S enp1s0 | grep rx_q.*packets rx_queue_0_packets: 10 rx_queue_1_packets: 0 rx_queue_2_packets: 0 rx_queue_3_packets: 10 7. On the DUT, add a EtherType rule to route ARP packet to Queue 1: $ sudo ethtool -N enp1s0 flow-type ether proto 0x0806 queue 1 8. From the Link Partner, send another 10 ARP packets: $ arping -c 10 -I enp170s0 169.254.1.2 9. Now, packets are routed to Queue 1 by the EtherType rule because it is higher priority than the wildcard (Default Queue) rule: $ ethtool -S enp1s0 | grep rx_q.*packets rx_queue_0_packets: 10 rx_queue_1_packets: 10 rx_queue_2_packets: 0 rx_queue_3_packets: 10 10. On the DUT, delete all the NFC rules: $ sudo ethtool -N enp1s0 delete 63 $ sudo ethtool -N enp1s0 delete 64 11. From the Link Partner, send another 10 ARP packets: $ arping -c 10 -I enp170s0 169.254.1.2 12. Now, packets are routed to Queue 0 because the value of Default Queue is reset back to 0: $ ethtool -S enp1s0 | grep rx_q.*packets rx_queue_0_packets: 20 rx_queue_1_packets: 10 rx_queue_2_packets: 0 rx_queue_3_packets: 10 Reviewed-by: Kurt Kanzenbach Co-developed-by: Blanco Alcaine Hector Signed-off-by: Blanco Alcaine Hector Signed-off-by: Song Yoong Siang Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit bdfaa8d70da26edb8779d2f7035f186490b2d586 Author: Song Yoong Siang Date: Fri Jun 20 18:02:50 2025 +0800 igc: Relocate RSS field definitions to igc_defines.h Move the RSS field definitions related to IPv4 and IPv6 UDP from igc.h to igc_defines.h to consolidate the RSS field definitions in a single header file, improving code organization and maintainability. This refactoring does not alter the functionality of the driver but enhances the logical grouping of related constants Reviewed-by: Kurt Kanzenbach Signed-off-by: Song Yoong Siang Reviewed-by: Aleksandr Loktionov Reviewed-by: Brett Creeley Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit 351d8d8ab6af71193033a2786a99ea56e1af8526 Author: Dave Ertman Date: Mon Jun 16 13:03:22 2025 +0200 ice: breakout common LAG code into helpers In the VF handling code, parts of the code for lag can be broken out into helper functions to reduce code duplication. Break this code out into helper functions Reviewed-by: Marcin Szycik Signed-off-by: Dave Ertman Signed-off-by: Tony Nguyen commit 850a9a32ab6d8bdd2caf667e184e802aaa2b022d Author: Jesse Brandeburg Date: Wed Jun 18 13:28:53 2025 +0200 ice: convert ice_add_prof() to bitmap Previously the ice_add_prof() took an array of u8 and looped over it with for_each_set_bit(), examining each 8 bit value as a bitmap. This was just hard to understand and unnecessary, and was triggering undefined behavior sanitizers with unaligned accesses within bitmap fields (on our internal tools/builds). Since the @ptype being passed in was already declared as a bitmap, refactor this to use native types with the advantage of simplifying the code to use a single loop. Co-developed-by: Jacob Keller Signed-off-by: Jacob Keller Signed-off-by: Jesse Brandeburg Signed-off-by: Aleksandr Loktionov CC: Jesse Brandeburg Signed-off-by: Przemek Kitszel Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 0146da53670158c2c83d5be1e885904b596bc919 Author: Dawid Osuchowski Date: Tue May 20 11:30:59 2025 +0200 ice: add E835 device IDs E835 is an enhanced version of the E830. It continues to use the same set of commands, registers and interfaces as other devices in the 800 Series. Following device IDs are added: - 0x1248: Intel(R) Ethernet Controller E835-CC for backplane - 0x1249: Intel(R) Ethernet Controller E835-CC for QSFP - 0x124A: Intel(R) Ethernet Controller E835-CC for SFP - 0x1261: Intel(R) Ethernet Controller E835-C for backplane - 0x1262: Intel(R) Ethernet Controller E835-C for QSFP - 0x1263: Intel(R) Ethernet Controller E835-C for SFP - 0x1265: Intel(R) Ethernet Controller E835-L for backplane - 0x1266: Intel(R) Ethernet Controller E835-L for QSFP - 0x1267: Intel(R) Ethernet Controller E835-L for SFP Reviewed-by: Konrad Knitter Reviewed-by: Simon Horman Signed-off-by: Dawid Osuchowski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 9419c43859e1d4f64620ec631fd5ac85733254d5 Author: Aleksandr Loktionov Date: Fri May 16 14:42:14 2025 +0000 ice: add 40G speed to Admin Command GET PORT OPTION Introduce the ICE_AQC_PORT_OPT_MAX_LANE_40G constant and update the code to process this new option in both the devlink and the Admin Queue Command GET PORT OPTION (opcode 0x06EA) message, similar to existing constants like ICE_AQC_PORT_OPT_MAX_LANE_50G, ICE_AQC_PORT_OPT_MAX_LANE_100G, and so on. This feature allows the driver to correctly report configuration options for 2x40G on E823 and other cards in the future via devlink. Example command: devlink port split pci/0000:01:00.0/0 count 2 Example dmesg: ice 0000:01:00.0: Available port split options and max port speeds (Gbps): ice 0000:01:00.0: Status Split Quad 0 Quad 1 ice 0000:01:00.0: count L0 L1 L2 L3 L4 L5 L6 L7 ice 0000:01:00.0: 2 40 - - - 40 - - - ice 0000:01:00.0: 2 50 - 50 - - - - - ice 0000:01:00.0: 4 25 25 25 25 - - - - ice 0000:01:00.0: 4 25 25 - - 25 25 - - ice 0000:01:00.0: Active 8 10 10 10 10 10 10 10 10 ice 0000:01:00.0: 1 100 - - - - - - - Signed-off-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Reviewed-by: Paul Menzel Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit e1e3fec3e34b4934a9d2c98e4ee00a4d87b19179 Author: Ahmed Zaki Date: Fri Jun 20 11:15:48 2025 -0600 idpf: preserve coalescing settings across resets The IRQ coalescing config currently reside only inside struct idpf_q_vector. However, all idpf_q_vector structs are de-allocated and re-allocated during resets. This leads to user-set coalesce configuration to be lost. Add new fields to struct idpf_vport_user_config_data to save the user settings and re-apply them after reset. Reviewed-by: Madhu Chittim Signed-off-by: Ahmed Zaki Reviewed-by: Simon Horman Reviewed-by: Willem de Bruijn Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit e831f9e276c51ab18e52fa007f2435b61c616274 Author: Milena Olech Date: Wed Jun 18 16:42:36 2025 +0200 idpf: add cross timestamping Add cross timestamp support through virtchnl mailbox messages and directly, through PCIe BAR registers. Cross timestamping assumes that both system time and device clock time values are cached simultaneously, what is triggered by HW. Feature is enabled for both ARM and x86 archs. Signed-off-by: Milena Olech Reviewed-by: Karol Kolacinski Reviewed-by: Willem de Bruijn Tested-by: Samuel Salin Signed-off-by: Tony Nguyen commit ada3e24b84a097b27a823f1ad98e5b2e8c979689 Author: Ahmed Zaki Date: Wed Apr 23 13:27:05 2025 -0600 idpf: add flow steering support Use the new virtchnl2 OP codes to communicate with the Control Plane to add flow steering filters. We add the basic functionality for add/delete with TCP/UDP IPv4 only. Support for other OP codes and protocols will be added later. Standard 'ethtool -N|--config-ntuple' should be used, for example: # ethtool -N ens801f0d1 flow-type tcp4 src-ip 10.0.0.1 action 6 to route all IPv4/TCP traffic from IP 10.0.0.1 to queue 6. Reviewed-by: Sridhar Samudrala Signed-off-by: Ahmed Zaki Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit bff423578d4fc2ca22f4224fc53f6c743c0e200a Author: Sudheer Mogilappagari Date: Wed Apr 23 13:27:04 2025 -0600 virtchnl2: add flow steering support Add opcodes and corresponding message structure to add and delete flow steering rules. Flow steering enables configuration of rules to take an action or subset of actions based on a match criteria. Actions could be redirect to queue, redirect to queue group, drop packet or mark. Reviewed-by: Aleksandr Loktionov Reviewed-by: Sridhar Samudrala Co-developed-by: Dinesh Kumar Signed-off-by: Dinesh Kumar Signed-off-by: Sudheer Mogilappagari Signed-off-by: Ahmed Zaki Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 7cc6d633c08db169280a550db92ef9e078e7f098 Author: Ahmed Zaki Date: Wed Apr 23 13:27:03 2025 -0600 virtchnl2: rename enum virtchnl2_cap_rss The "enum virtchnl2_cap_rss" will be used for negotiating flow steering capabilities. Instead of adding a new enum, rename virtchnl2_cap_rss to virtchnl2_flow_types. Also rename the enum's constants. Flow steering will use this enum in the next patches. Reviewed-by: Sridhar Samudrala Signed-off-by: Ahmed Zaki Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 0ee30d937c147fc14c4b49535181d437cd2fde7a Author: Matteo Croce Date: Thu Jul 17 22:03:37 2025 +0200 libbpf: Fix warning in calloc() usage When compiling libbpf with some compilers, this warning is triggered: libbpf.c: In function ‘bpf_object__gen_loader’: libbpf.c:9209:28: error: ‘calloc’ sizes specified with ‘sizeof’ in the earlier argument and not in the later argument [-Werror=calloc-transposed-args] 9209 | gen = calloc(sizeof(*gen), 1); | ^ libbpf.c:9209:28: note: earlier argument should specify number of elements, later size of each element Fix this by inverting the calloc() arguments. Signed-off-by: Matteo Croce Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20250717200337.49168-1-technoboy85@gmail.com commit f10f46a0ee53420f707195fe33b7c235a1c0e48a Author: Shiju Jose Date: Thu Jul 17 11:18:17 2025 +0100 cxl/events: Trace Memory Sparing Event Record CXL rev 3.2 section 8.2.10.2.1.4 Table 8-60 defines the Memory Sparing Event Record. Determine if the event read is memory sparing record and if so trace the record. Memory device shall produce a memory sparing event record 1. After completion of a PPR maintenance operation if the memory sparing event record enable bit is set (Field: sPPR/hPPR Operation Mode in Table 8-128/Table 8-131). 2. In response to a query request by the host (see section 8.2.10.7.1.4) to determine the availability of sparing resources. The device shall report the resource availability by producing the Memory Sparing Event Record (see Table 8-60) in which the channel, rank, nibble mask, bank group, bank, row, column, sub-channel fields are a copy of the values specified in the request. If the controller does not support reporting whether a resource is available, and a perform maintenance operation for memory sparing is issued with query resources set to 1, the controller shall return invalid input. Example trace log for produce memory sparing event record on completion of a soft PPR operation, cxl_memory_sparing: memdev=mem1 host=0000:0f:00.0 serial=3 log=Informational : time=55045163029 uuid=e71f3a40-2d29-4092-8a39-4d1c966c7c65 len=128 flags='0x1' handle=1 related_handle=0 maint_op_class=2 maint_op_sub_class=1 ld_id=0 head_id=0 : flags='' result=0 validity_flags='CHANNEL|RANK|NIBBLE|BANK GROUP|BANK|ROW|COLUMN' spare resource avail=1 channel=2 rank=5 nibble_mask=a59c bank_group=2 bank=4 row=13 column=23 sub_channel=0 comp_id=00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 comp_id_pldm_valid_flags='' pldm_entity_id=0x00 pldm_resource_id=0x00 Note: For memory sparing event record, fields 'maintenance operation class' and 'maintenance operation subclass' are defined twice, first in the common event record (Table 8-55) and second in the memory sparing event record (Table 8-60). Thus those in the sparing event record coded as reserved, to be removed when the spec is updated. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Shiju Jose Link: https://patch.msgid.link/20250717101817.2104-5-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit d8145bb8af5c09d27c4dde4f4030d589771594d1 Author: Shiju Jose Date: Thu Jul 17 11:18:16 2025 +0100 cxl/events: Add extra validity checks for CVME count in DRAM Event Record According to the CXL Specification Revision 3.2, Section 8.2.10.2.1.2, Table 8-58 (DRAM Event Record), the CVME (Corrected Volatile Memory Error) Count field is valid under the following conditions: 1. The Threshold Event bit is set in the Memory Event Descriptor field, and 2. The CVME Count must be greater than 0 for events where the Advanced Programmable Threshold Counter has expired. Additionally, if the Advanced Programmable Corrected Memory Error Counter Expire bit in the Memory Event Type field is set, then the Threshold Event bit in the Memory Event Descriptor field shall also be set. Add validity checks for the above conditions while reporting the event to the userspace. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Shiju Jose Link: https://patch.msgid.link/20250717101817.2104-4-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit cd3b36cfc659306456d3cf3714c8856307693c01 Author: Shiju Jose Date: Thu Jul 17 11:18:15 2025 +0100 cxl/events: Add extra validity checks for corrected memory error count in General Media Event Record According to the CXL Specification Revision 3.2, Section 8.2.10.2.1.1, Table 8-57 (General Media Event Record), the Corrected Memory Error Count field is valid under the following conditions: 1. The Threshold Event bit is set in the Memory Event Descriptor field, and 2. The Corrected Memory Error Count must be greater than 0 for events where the Advanced Programmable Threshold Counter has expired. Additionally, if the Advanced Programmable Corrected Memory Error Counter Expire bit in the Memory Event Type field is set, then the Threshold Event bit in the Memory Event Descriptor field shall also be set. Add validity checks for the above conditions while reporting the event to the userspace. Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Signed-off-by: Shiju Jose Link: https://patch.msgid.link/20250717101817.2104-3-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit 1f4f8166110f037f15a89c2203ff887b98a8393a Author: Shiju Jose Date: Thu Jul 17 11:18:14 2025 +0100 cxl/events: Update Common Event Record to CXL spec rev 3.2 CXL spec 3.2 section 8.2.10.2.1 Table 8-55, Common Event Record format defined new fields LD-ID and Head ID. LD-ID: ID of logical device from where the event originated, which is valid only if LD-ID valid flag is set to 1. CXL spec 3.2 Section 2.4 describes, a Type 3 Multi-Logical Device (MLD) can partition its resources into up to 16 isolated Logical Devices. Each Logical Device is identified by a Logical Device Identifier (LD-ID) in CXL.mem and CXL.io protocols. LD-ID is a 16-bit Logical Device identifier applicable for CXL.io and CXL.mem requests and responses. CXL.mem supports only the lower 4 bits of LD-ID and therefore can support up to 16 unique LD-ID values over the link. Requests and responses forwarded over an MLD Port are tagged with LD-ID. Head ID: ID of the device head, from where the event originated, which is valid only if head valid flag is set to 1. Add updates for the above spec changes in the CXL events record and CXL common trace event implementation. Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Shiju Jose Link: https://patch.msgid.link/20250717101817.2104-2-shiju.jose@huawei.com Signed-off-by: Dave Jiang commit d511206dc7443120637efd9cfa3ab06a26da33dd Author: Romain Gantois Date: Fri Jul 18 16:11:36 2025 +0200 regulator: core: repeat voltage setting request for stepped regulators The regulator_set_voltage() function may exhibit unexpected behavior if the target regulator has a maximum voltage step constraint. With such a constraint, the regulator core may clamp the requested voltage to a lesser value, to ensure that the voltage delta stays under the specified limit. This means that the resulting regulator voltage depends on the current voltage, as well as the requested range, which invalidates the assumption that a repeated request for a specific voltage range will amount to a noop. Considering the case of a regulator with a maximum voltage step constraint of 1V: initial voltage: 2.5V consumer requests 4V expected result: 3.5V resulting voltage: 3.5V consumer requests 4V again expected result: 4V actual result: 3.5V Correct this by repeating attempts to balance the regulator voltage until the result converges. Signed-off-by: Romain Gantois Link: https://patch.msgid.link/20250718-regulator-stepping-v2-1-e28c9ac5d54a@bootlin.com Signed-off-by: Mark Brown commit a234cffd04bc06386b18976de5b691b23bcf68a4 Author: Konrad Dybcio Date: Wed Jul 16 14:25:46 2025 +0200 dt-bindings: interconnect: qcom,msm8998-bwmon: Allow 'nonposted-mmio' One of the BWMON instances on SM8750 requires that its MMIO space is mapped specifically with the nE memory attribute. Allow the nonposted-mmio property which instructs the OS to do so. Signed-off-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250716-8750_cpubwmon-v4-1-12212098e90f@oss.qualcomm.com Signed-off-by: Georgi Djakov commit a95571d8ffe2fa92bcc2af22a853170340ae1e9c Author: Raviteja Laggyshetty Date: Fri Jul 11 10:25:38 2025 +0000 dt-bindings: interconnect: Add EPSS L3 compatible for QCS8300 SoC Add Epoch Subsystem (EPSS) L3 interconnect provider binding for QCS8300 SoC. As the EPSS hardware in QCS8300 and SA8775P are same, added a family-level compatible for SA877P SoC. This shared fallback compatible allows grouping of SoCs with similar hardware, reducing the need to explicitly list each variant in the driver match table. Signed-off-by: Raviteja Laggyshetty Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250711102540.143-2-raviteja.laggyshetty@oss.qualcomm.com Signed-off-by: Georgi Djakov commit a8d7161d1dba668d814e66b28aef235341d7b1ed Author: Luca Weiss Date: Thu Jul 17 08:54:45 2025 +0200 dt-bindings: interconnect: qcom: Remove double colon from description No double colon is necessary in the description. Fix it for all bindings so future bindings won't have the same copy-paste mistake. Reported-by: Rob Herring Closes: https://lore.kernel.org/lkml/20250625150458.GA1182597-robh@kernel.org/ Signed-off-by: Luca Weiss Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250717-bindings-double-colon-v1-2-c04abc180fcd@fairphone.com Signed-off-by: Georgi Djakov commit cbabc73e85be9e706a5051c9416de4a8d391cf57 Author: Konrad Dybcio Date: Fri Jun 27 21:37:56 2025 +0200 interconnect: qcom: qcs615: Drop IP0 interconnects In the same spirit as e.g. Commit b136d257ee0b ("interconnect: qcom: sc8280xp: Drop IP0 interconnects"), drop the resources that should be taken care of through the clk-rpmh driver. Fixes: 77d79677b04b ("interconnect: qcom: add QCS615 interconnect provider driver") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250627-topic-qcs615_icc_ipa-v1-2-dc47596cde69@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 7e0b59496a02d25828612721e846ea4b717a97b9 Author: Dmitry Baryshkov Date: Fri Jul 4 19:35:14 2025 +0300 interconnect: qcom: sc8180x: specify num_nodes Specify .num_nodes for several BCMs which missed this declaration. Fixes: 04548d4e2798 ("interconnect: qcom: sc8180x: Reformat node and bcm definitions") Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250704-rework-icc-v2-2-875fac996ef5@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 02ee375506dceb7d32007821a2bff31504d64b99 Author: Dmitry Baryshkov Date: Fri Jul 4 19:35:13 2025 +0300 interconnect: qcom: sc8280xp: specify num_links for qnm_a1noc_cfg The qnm_a1noc_cfg declaration didn't include .num_links definition, fix it. Fixes: f29dabda7917 ("interconnect: qcom: Add SC8280XP interconnect provider") Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250704-rework-icc-v2-1-875fac996ef5@oss.qualcomm.com Signed-off-by: Georgi Djakov commit 2aad477b5b734f52825f7c31780222a5a17c06d3 Author: Geert Uytterhoeven Date: Wed Jul 9 20:45:42 2025 +0200 irqchip/renesas-irqc: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas IRQC driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This allows to drop the __maybe_unused annotations from its suspend callback, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/5a14f9932da20ec46cde27f314414474072755ed.1752086718.git.geert+renesas@glider.be commit bc398dc4f3677ca381d5b64f8e55005131e68650 Author: Geert Uytterhoeven Date: Wed Jul 9 20:45:01 2025 +0200 irqchip/renesas-intc-irqpin: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas INTC External IRQ Pin driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This allows to drop the __maybe_unused annotations from its suspend callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/865e5274cc516d8c345048330a46e753e2bda677.1752086656.git.geert+renesas@glider.be commit ea92b6046d352740c15f35e703c1b13a47dd99b0 Author: Anup Patel Date: Wed Jul 16 18:07:45 2025 +0530 irqchip/riscv-imsic: Add kernel parameter to disable IPIs When injecting IPIs to a set of harts, the IMSIC IPI support will do a separate MMIO write to the SETIPNUM_LE register of each target hart. This means on a platform where IMSIC is trap-n-emulated, there will be N MMIO traps when injecting IPI to N target harts hence IMSIC IPIs will be slow on such platforms compared to the SBI IPI extension. Unfortunately, there is no DT, ACPI, or any other way of discovering whether the underlying IMSIC is trap-n-emulated. Using MMIO write to the SETIPNUM_LE register for injecting IPI is purely a software choice in the IMSIC driver hence add a kernel parameter to allow users to disable IMSIC IPIs on platforms with trap-n-emulated IMSIC. Signed-off-by: Anup Patel Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250716123745.557585-1-apatel@ventanamicro.com commit 1a50c5ca394ab1b3a30094eda2354bcfc00f9909 Author: Tamizh Chelvam Raja Date: Thu Jul 17 23:05:39 2025 +0530 wifi: ath12k: Add support to parse max ext2 wmi service bit Update the host logic to dynamically parse WMI extended service bits beyond the current fixed size of 4 * 32 (i.e., 384 bits) after WMI_MAX_EXT_SERVICE (256). The current implementation misses service bits advertised beyond this range, leading to not enabling some of the features supported by firmware. Implement dynamic length parsing to iterate up to the maximum service bit index advertised by the firmware. This ensures all supported features are correctly recognized and enabled. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00217-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Tamizh Chelvam Raja Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250717173539.2523396-3-tamizh.raja@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 8f1a078842d4af4877fb686f3907788024d0d1b7 Author: Tamizh Chelvam Raja Date: Thu Jul 17 23:05:38 2025 +0530 wifi: ath12k: fix endianness handling while accessing wmi service bit Currently there is no endian conversion in ath12k_wmi_tlv_services_parser() so the service bit parsing will be incorrect on a big endian platform and to fix this by using appropriate endian conversion. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00217-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: 342527f35338 ("wifi: ath12k: Add support to parse new WMI event for 6 GHz regulatory") Signed-off-by: Tamizh Chelvam Raja Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250717173539.2523396-2-tamizh.raja@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 26f732791f2bcab18f59c61915bbe35225f30136 Author: Daniel Golle Date: Sat Jul 12 16:39:21 2025 +0100 Revert "leds: trigger: netdev: Configure LED blink interval for HW offload" This reverts commit c629c972b310af41e9e072febb6dae9a299edde6. While .led_blink_set() would previously put an LED into an unconditional permanently blinking state, the offending commit now uses same operation to (also?) set the blink timing of the netdev trigger when offloading. This breaks many if not all of the existing PHY drivers which offer offloading LED operations, as those drivers would just put the LED into blinking state after .led_blink_set() has been called. Unfortunately the change even made it into stable kernels for unknown reasons, so it should be reverted there as well. Fixes: c629c972b310a ("leds: trigger: netdev: Configure LED blink interval for HW offload") Link: https://lore.kernel.org/linux-leds/c6134e26-2e45-4121-aa15-58aaef327201@lunn.ch/T/#m9d6fe81bbcb273e59f12bbedbd633edd32118387 Suggested-by: Andrew Lunn Cc: stable@vger.kernel.org Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/6dcc77ee1c9676891d6250d8994850f521426a0f.1752334655.git.daniel@makrotopia.org Signed-off-by: Lee Jones commit 97c03ec2c0e0621bbd7a56f5be19bd2de552e6f4 Author: Zenghui Yu Date: Wed Jul 9 21:00:46 2025 +0800 irqchip/gic-v3: Fix GICD_CTLR register naming It was incorrectly named as GICD_CTRL in a pr_info() and comments. Fix them. Signed-off-by: Zenghui Yu Signed-off-by: Thomas Gleixner Acked-by: Marc Zyngier Link: https://lore.kernel.org/all/20250709130046.1354-1-yuzenghui@huawei.com commit aabf4ff06b9789f3cd167bf9e2eb25f1fdb5541a Author: Dan Carpenter Date: Wed Jul 16 14:43:45 2025 -0500 irqchip/ls-scfg-msi: Fix NULL dereference in error handling The call to irq_domain_remove(msi_data->parent); was accidentally left behind during a code refactor. It's not necessary to free "msi_data->parent" because it is NULL and, in fact, trying to free it will lead to a NULL pointer dereference. Delete the unnecessary code. Fixes: 94b59d5f567a ("irqchip/ls-scfg-msi: Switch to use msi_create_parent_irq_domain()") Signed-off-by: Dan Carpenter Signed-off-by: Thomas Gleixner Reviewed-by: Nam Cao Link: https://lore.kernel.org/all/15059507-6422-4333-94ca-e8e8840bd289@sabinyo.mountain commit 754fe848b3b297fc85ec24cd959bad22b6df8cb8 Author: Remi Pommarel Date: Thu Jul 17 17:45:29 2025 +0200 Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" This reverts commit 0937cb5f345c ("Revert "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()""). This commit broke TX with 802.11 encapsulation HW offloading, now that this is fixed, reapply it. Fixes: bb42f2d13ffc ("mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue") Signed-off-by: Remi Pommarel Link: https://patch.msgid.link/66b8fc39fb0194fa06c9ca7eeb6ffe0118dcb3ec.1752765971.git.repk@triplefau.lt Signed-off-by: Johannes Berg commit 4037c468d1b3c508d69e6df0ef47fdee3d440e39 Author: Remi Pommarel Date: Thu Jul 17 17:45:28 2025 +0200 wifi: mac80211: Check 802.11 encaps offloading in ieee80211_tx_h_select_key() With 802.11 encapsulation offloading, ieee80211_tx_h_select_key() is called on 802.3 frames. In that case do not try to use skb data as valid 802.11 headers. Reported-by: Bert Karwatzki Closes: https://lore.kernel.org/linux-wireless/20250410215527.3001-1-spasswolf@web.de Fixes: bb42f2d13ffc ("mac80211: Move reorder-sensitive TX handlers to after TXQ dequeue") Signed-off-by: Remi Pommarel Link: https://patch.msgid.link/1af4b5b903a5fca5ebe67333d5854f93b2be5abe.1752765971.git.repk@triplefau.lt Signed-off-by: Johannes Berg commit cb3bb3d88dfcd177a1050c0a009a3ee147b2e5b9 Author: Alexander Wetzel Date: Thu Jul 17 18:25:47 2025 +0200 wifi: mac80211: Don't call fq_flow_idx() for management frames skb_get_hash() can only be used when the skb is linked to a netdev device. Signed-off-by: Alexander Wetzel Fixes: 73bc9e0af594 ("mac80211: don't apply flow control on management frames") Link: https://patch.msgid.link/20250717162547.94582-3-Alexander@wetzel-home.de Signed-off-by: Johannes Berg commit 11e3e22fa533f5d7cf04e32343b05a27eda3c7a5 Author: Alexander Wetzel Date: Thu Jul 17 18:25:46 2025 +0200 wifi: mac80211: Do not schedule stopped TXQs Ignore TXQs with the flag IEEE80211_TXQ_STOP when scheduling a queue. The flag is only set after all fragments have been dequeued and won't allow dequeueing other frames as long as the flag is set. For drivers using ieee80211_txq_schedule_start() this prevents an loop trying to push the queued frames while IEEE80211_TXQ_STOP is set: After setting IEEE80211_TXQ_STOP the driver will call ieee80211_return_txq(). Which calls __ieee80211_schedule_txq(), detects that there sill are frames in the queue and immediately restarts the stopped TXQ. Which can't dequeue any frame and thus starts over the loop. Signed-off-by: Alexander Wetzel Fixes: ba8c3d6f16a1 ("mac80211: add an intermediate software queue implementation") Link: https://patch.msgid.link/20250717162547.94582-2-Alexander@wetzel-home.de Signed-off-by: Johannes Berg commit 2c5dee15239f3f3e31aa5c8808f18996c039e2c1 Author: Alexander Wetzel Date: Thu Jul 17 18:25:45 2025 +0200 wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() Callers of wdev_chandef() must hold the wiphy mutex. But the worker cfg80211_propagate_cac_done_wk() never takes the lock. Which triggers the warning below with the mesh_peer_connected_dfs test from hostapd and not (yet) released mac80211 code changes: WARNING: CPU: 0 PID: 495 at net/wireless/chan.c:1552 wdev_chandef+0x60/0x165 Modules linked in: CPU: 0 UID: 0 PID: 495 Comm: kworker/u4:2 Not tainted 6.14.0-rc5-wt-g03960e6f9d47 #33 13c287eeabfe1efea01c0bcc863723ab082e17cf Workqueue: cfg80211 cfg80211_propagate_cac_done_wk Stack: 00000000 00000001 ffffff00 6093267c 00000000 6002ec30 6d577c50 60037608 00000000 67e8d108 6063717b 00000000 Call Trace: [<6002ec30>] ? _printk+0x0/0x98 [<6003c2b3>] show_stack+0x10e/0x11a [<6002ec30>] ? _printk+0x0/0x98 [<60037608>] dump_stack_lvl+0x71/0xb8 [<6063717b>] ? wdev_chandef+0x60/0x165 [<6003766d>] dump_stack+0x1e/0x20 [<6005d1b7>] __warn+0x101/0x20f [<6005d3a8>] warn_slowpath_fmt+0xe3/0x15d [<600b0c5c>] ? mark_lock.part.0+0x0/0x4ec [<60751191>] ? __this_cpu_preempt_check+0x0/0x16 [<600b11a2>] ? mark_held_locks+0x5a/0x6e [<6005d2c5>] ? warn_slowpath_fmt+0x0/0x15d [<60052e53>] ? unblock_signals+0x3a/0xe7 [<60052f2d>] ? um_set_signals+0x2d/0x43 [<60751191>] ? __this_cpu_preempt_check+0x0/0x16 [<607508b2>] ? lock_is_held_type+0x207/0x21f [<6063717b>] wdev_chandef+0x60/0x165 [<605f89b4>] regulatory_propagate_dfs_state+0x247/0x43f [<60052f00>] ? um_set_signals+0x0/0x43 [<605e6bfd>] cfg80211_propagate_cac_done_wk+0x3a/0x4a [<6007e460>] process_scheduled_works+0x3bc/0x60e [<6007d0ec>] ? move_linked_works+0x4d/0x81 [<6007d120>] ? assign_work+0x0/0xaa [<6007f81f>] worker_thread+0x220/0x2dc [<600786ef>] ? set_pf_worker+0x0/0x57 [<60087c96>] ? to_kthread+0x0/0x43 [<6008ab3c>] kthread+0x2d3/0x2e2 [<6007f5ff>] ? worker_thread+0x0/0x2dc [<6006c05b>] ? calculate_sigpending+0x0/0x56 [<6003b37d>] new_thread_handler+0x4a/0x64 irq event stamp: 614611 hardirqs last enabled at (614621): [<00000000600bc96b>] __up_console_sem+0x82/0xaf hardirqs last disabled at (614630): [<00000000600bc92c>] __up_console_sem+0x43/0xaf softirqs last enabled at (614268): [<00000000606c55c6>] __ieee80211_wake_queue+0x933/0x985 softirqs last disabled at (614266): [<00000000606c52d6>] __ieee80211_wake_queue+0x643/0x985 Fixes: 26ec17a1dc5e ("cfg80211: Fix radar event during another phy CAC") Signed-off-by: Alexander Wetzel Link: https://patch.msgid.link/20250717162547.94582-1-Alexander@wetzel-home.de Signed-off-by: Johannes Berg commit 3fe79a25c3cd54d25d30bc235c0c57f8a123d9d5 Author: Murad Masimov Date: Fri Mar 21 21:52:26 2025 +0300 wifi: plfxlc: Fix error handling in usb driver probe If probe fails before ieee80211_register_hw() is successfully done, ieee80211_unregister_hw() will be called anyway. This may lead to various bugs as the implementation of ieee80211_unregister_hw() assumes that ieee80211_register_hw() has been called. Divide error handling section into relevant subsections, so that ieee80211_unregister_hw() is called only when it is appropriate. Correct the order of the calls: ieee80211_unregister_hw() should go before plfxlc_mac_release(). Also move ieee80211_free_hw() to plfxlc_mac_release() as it supposed to be the opposite to plfxlc_mac_alloc_hw() that calls ieee80211_alloc_hw(). Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 68d57a07bfe5 ("wireless: add plfxlc driver for pureLiFi X, XL, XC devices") Signed-off-by: Murad Masimov Link: https://patch.msgid.link/20250321185226.71-3-m.masimov@mt-integration.ru Signed-off-by: Johannes Berg commit f8bf97ad19c48f5e66cf99bd390356ffa1189d62 Author: Lachlan Hodges Date: Thu Jul 17 17:42:05 2025 +1000 wifi: mac80211: support returning the S1G short beacon skb When short beaconing is enabled, check the value of the sb_count to determine whether we are to send a long beacon or short beacon. sb_count represents the number of short beacons until the next long beacon, where if its value is 0 we are to send a long beacon. The value is then reset to the long beacon period, which represents the number of beacon intervals between each long beacon. The decrement process follows the same cadence as the decrement of the DTIM count value. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250717074205.312577-5-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 2758b703a9b389158964b3ae6ca171b66bfc883c Author: Lachlan Hodges Date: Thu Jul 17 17:42:04 2025 +1000 wifi: mac80211: support initialising current S1G short beacon index Introduce the sb_count variable which tracks the number of beacon intervals until the next long beacon. To initialise this value, we find the current short beacon index into this period which represents the number of short beacons left to send before the next long beacon. We use the same TSF value used to initialise the DTIM count to ensure the short beacon count and DTIM count are in sync as its common for the long beacon period and DTIM period to be equivalent. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250717074205.312577-4-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit bbf93a06d73505591db3a93797f44b9c44555d9b Author: Lachlan Hodges Date: Thu Jul 17 17:42:03 2025 +1000 wifi: mac80211: support initialising an S1G short beaconing BSS Introduce the ability to parse the short beacon data and long beacon period. The long beacon period represents the number of beacon intervals between each long beacon transmission. Additionally, as a BSS cannot change its configuration such that short beaconing is dynamically disabled/enabled without tearing down the interface - we ensure we have an existing short beacon before performing the update. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250717074205.312577-3-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 6624a0af82a6e3a4d3609264ef591a8fa3467139 Author: Lachlan Hodges Date: Thu Jul 17 17:42:02 2025 +1000 wifi: cfg80211: support configuring an S1G short beaconing BSS S1G short beacons are an optional frame type used in an S1G BSS that contain a limited set of elements. While they are optional, they are a fundamental part of S1G that enables significant power saving. Expose 2 additional netlink attributes, NL80211_ATTR_S1G_LONG_BEACON_PERIOD which denotes the number of beacon intervals between each long beacon and NL80211_ATTR_S1G_SHORT_BEACON which is a nested attribute containing the short beacon tail and head. We split them as the long beacon period cannot be updated, and is only used when initialisng the interface, whereas the short beacon data can be used to both initialise and update the templates. This follows how things such as the beacon interval and DTIM period currently operate. During the initialisation path, we ensure we have the long beacon period if the short beacon data is being passed down, whereas the update path will simply update the template if its sent down. The short beacon data is validated using the same routines for regular beacons as they support correctly parsing the short beacon format while ensuring the frame is well-formed. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250717074205.312577-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 78e50d88998a4a634eeda3e0d136cb8b9c9bc9d8 Author: Fabio Estevam Date: Sat Jul 12 18:53:07 2025 -0300 wifi: brcmfmac: Add support for the SDIO 43751 device Add the SDIO ID and firmware matching for the 43751 device. Based on the previous work from Marc Gonzalez . Tested on an i.MX6DL board connected to an AP6398SV chip with the brcmfmac43752-sdio.bin firmware taken from: https://source.puri.sm/Librem5/firmware-brcm43752-nonfree Signed-off-by: Fabio Estevam Acked-by: Arend van Spriel > Link: https://patch.msgid.link/20250712215307.1310802-1-festevam@gmail.com Signed-off-by: Johannes Berg commit 219cbc4d713e26792e93dda596f6e972583aa173 Author: Qianfeng Rong Date: Tue Jul 15 20:16:52 2025 +0800 wifi: wilc1000: Use min() to improve code Use min() to reduce the code and improve its readability. Reviewed-by: Alexis Lothoré Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250715121721.266713-7-rongqianfeng@vivo.com Signed-off-by: Johannes Berg commit 37fa920819363254d0701c6f3693a81538f99b2e Author: Qianfeng Rong Date: Tue Jul 15 20:16:51 2025 +0800 wifi: mwifiex: Use max_t() to improve code Use max_t() to reduce the code and improve its readability. Signed-off-by: Qianfeng Rong Reviewed-by: Jeff Chen Link: https://patch.msgid.link/20250715121721.266713-6-rongqianfeng@vivo.com Signed-off-by: Johannes Berg commit b60c49590a1e268305d1da4f8593d2b54468b6c4 Author: Qianfeng Rong Date: Tue Jul 15 20:16:50 2025 +0800 wifi: brcm80211: Use min() to improve code Use min() to reduce the code and improve its readability. Signed-off-by: Qianfeng Rong Acked-by: Arend van Spriel > Link: https://patch.msgid.link/20250715121721.266713-5-rongqianfeng@vivo.com Signed-off-by: Johannes Berg commit 6d0a67c600a61c42308e8b78864492752c4f69a2 Author: WangYuli Date: Tue Jul 15 21:44:04 2025 +0800 wifi: brcmfmac: Fix typo "notifer" There is a spelling mistake of 'notifer' in the comment which should be 'notifier'. Signed-off-by: WangYuli Acked-by: Arend van Spriel > Link: https://patch.msgid.link/F92035B0A9123150+20250715134407.540483-5-wangyuli@uniontech.com [remove prior link] Signed-off-by: Johannes Berg commit 16ecdab5446f15a61ec88eb0d23d25d009821db0 Author: Moon Hee Lee Date: Tue Jul 15 16:09:05 2025 -0700 wifi: mac80211: reject TDLS operations when station is not associated syzbot triggered a WARN in ieee80211_tdls_oper() by sending NL80211_TDLS_ENABLE_LINK immediately after NL80211_CMD_CONNECT, before association completed and without prior TDLS setup. This left internal state like sdata->u.mgd.tdls_peer uninitialized, leading to a WARN_ON() in code paths that assumed it was valid. Reject the operation early if not in station mode or not associated. Reported-by: syzbot+f73f203f8c9b19037380@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f73f203f8c9b19037380 Fixes: 81dd2b882241 ("mac80211: move TDLS data to mgd private part") Tested-by: syzbot+f73f203f8c9b19037380@syzkaller.appspotmail.com Signed-off-by: Moon Hee Lee Link: https://patch.msgid.link/20250715230904.661092-2-moonhee.lee.ca@gmail.com Signed-off-by: Johannes Berg commit 81284e86bf8849f8e98e8ead3ff5811926b2107f Author: Nathan Chancellor Date: Tue Jul 15 19:45:23 2025 -0700 wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() A new warning in clang [1] complains that diq_start in wlc_lcnphy_tx_iqlo_cal() is passed uninitialized as a const pointer to wlc_lcnphy_common_read_table(): drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c:2728:13: error: variable 'diq_start' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 2728 | &diq_start, 1, 16, 69); | ^~~~~~~~~ The table pointer passed to wlc_lcnphy_common_read_table() should not be considered constant, as wlc_phy_read_table() is ultimately going to update it. Remove the const qualifier from the tbl_ptr to clear up the warning. Cc: stable@vger.kernel.org Closes: https://github.com/ClangBuiltLinux/linux/issues/2108 Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers") Link: https://github.com/llvm/llvm-project/commit/00dacf8c22f065cb52efb14cd091d441f19b319e [1] Signed-off-by: Nathan Chancellor Acked-by: Arend van Spriel > Link: https://patch.msgid.link/20250715-brcmsmac-fix-uninit-const-pointer-v1-1-16e6a51a8ef4@kernel.org Signed-off-by: Johannes Berg commit cd3557a7618bf5c1935e9f66b58a329f1f1f4b27 Author: Thomas Weißschuh Date: Tue Jul 1 10:58:06 2025 +0200 vdso/gettimeofday: Add support for auxiliary clocks Expose the auxiliary clocks through the vDSO. Architectures not using the generic vDSO time framework, namely SPARC64, are not supported. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-12-df7d9f87b9b8@linutronix.de commit 1bc892d76a6f8778945eaa44af4e7f95faf5fbd4 Author: Maharaja Kennadyrajan Date: Fri Jul 18 11:38:37 2025 +0530 wifi: mac80211: extend connection monitoring for MLO Currently, reset connection monitor (ieee80211_sta_reset_conn_monitor()) timer is handled only for non-AP non-MLD STA and do not support non-AP MLD STA. The current implementation checks for the CSA active and update the monitor timer with the timeout value of deflink and reset the timer based on the deflink's timeout value else schedule the connection loss work when the deflink is timed out and it won't work for the non-AP MLD STA. Handle the reset connection monitor timer for non-AP MLD STA by updating the monitor timer with the timeout value which is determined based on the link that will expire last among all the links in MLO. If at least one link has not timed out, the timer is updated accordingly with the latest timeout value else schedule the connection loss work when all links have timed out. Remove the MLO-related WARN_ON() checks in the beacon and connection monitoring logic code paths as they support MLO now. Signed-off-by: Maharaja Kennadyrajan Link: https://patch.msgid.link/20250718060837.59371-5-maharaja.kennadyrajan@oss.qualcomm.com Signed-off-by: Johannes Berg commit 66e53e117f41df05d3fd4f8c65810e148fc23669 Author: Maharaja Kennadyrajan Date: Fri Jul 18 11:38:36 2025 +0530 wifi: mac80211: extend beacon monitoring for MLO Currently, reset beacon monitor (ieee80211_sta_reset_beacon_monitor()) timer is handled only for non-AP non-MLD STA and do not support non-AP MLD STA. When the beacon loss occurs in non-AP MLD STA with the current implementation, it is treated as a single link and the timer will reset based on the timeout of the deflink, without checking all the links. Check the CSA flags for all the links in the MLO and decide whether to schedule the work queue for beacon loss. If any of the links has CSA active, then beacon loss work is not scheduled. Also, call the functions ieee80211_sta_reset_beacon_monitor() and ieee80211_sta_reset_conn_monitor() from ieee80211_csa_switch_work() only when all the links are CSA active. Signed-off-by: Maharaja Kennadyrajan Link: https://patch.msgid.link/20250718060837.59371-4-maharaja.kennadyrajan@oss.qualcomm.com Signed-off-by: Johannes Berg commit 4e1916dec9850cd49dd5792200ab649061cbedc1 Author: Maharaja Kennadyrajan Date: Fri Jul 18 11:38:35 2025 +0530 wifi: mac80211: Add link iteration macro for link data with rcu_dereference Currently, the existing macro for_each_link_data() uses sdata_dereference() which requires the wiphy lock. This lock cannot be used in atomic or RCU read-side contexts, such as in the RX path. Introduce a new macro, for_each_link_data_rcu(), that iterates over link of sdata using rcu_dereference(), making it safe to use in RCU contexts. This allows callers to access link data without requiring the wiphy lock. The macro takes into account the vif.valid_links bitmap and ensures only valid links are accessed safely. Callers are responsible for ensuring that rcu_read_lock() is held when using this macro. Signed-off-by: Maharaja Kennadyrajan Link: https://patch.msgid.link/20250718060837.59371-3-maharaja.kennadyrajan@oss.qualcomm.com Signed-off-by: Johannes Berg commit f562f6a5899d91940fd5ef78e3f6042f56abe3e2 Author: Aditya Kumar Singh Date: Fri Jul 18 11:38:34 2025 +0530 wifi: mac80211: fix macro scoping in for_each_link_data The for_each_link_data() macro currently declares a local variable __sdata directly, which could lead to compiler warnings or errors when reused in the same function or within switch-case blocks due to variable redefinition or invalid scoping. To address this, restructure the macro to use an outer for-loop that runs only once, allowing safe declaration of __sdata without polluting the outer scope. This ensures compatibility with static analyzers. No functional changes; this is purely a cleanup to improve macro hygiene. Signed-off-by: Aditya Kumar Singh Signed-off-by: Maharaja Kennadyrajan Link: https://patch.msgid.link/20250718060837.59371-2-maharaja.kennadyrajan@oss.qualcomm.com Signed-off-by: Johannes Berg commit 765e98e918ebe0685abbd47994ecc9354163ba24 Author: Johannes Berg Date: Fri Jul 18 10:32:36 2025 +0200 wifi: cfg80211/mac80211: remove wrong scan request n_channels This (partially) reverts commits - 838c7b8f1f27 ("wifi: nl80211: Avoid address calculations via out of bounds array indexing") - f1d3334d604c ("wifi: cfg80211: sme: init n_channels before channels[] access") - 82bbe02b2500 ("wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request") These commits all set the structure to be in an inconsistent state, setting n_channels to some value before them actually being filled in. That's fine for what the code does now, but with the removal of __counted_by() in 444020f4bf06 ("wifi: cfg80211: remove scan request n_channels counted_by") it's no longer needed and it does leave a bit of a landmine there since breaking out of some code to send the scan or something would leave it wrong. Remove the now superfluous n_channels settings. Link: https://patch.msgid.link/20250718103237.59510b2384c5.Ied5ba9c5c49efc008f4491c8ca7a45858a83f064@changeid Signed-off-by: Johannes Berg commit 18b3246dbf63a15a5c75a0ed82af03e28918980a Merge: af2d6148d2a159 94cd0ba1842ece Author: Johannes Berg Date: Fri Jul 18 13:57:33 2025 +0200 Merge tag 'rtw-next-2025-07-18' of https://github.com/pkshih/rtw Ping-Ke Shih says: ================== rtw-next patches for v6.17 Some minor fixes and refinements. Major changes are listed: rtw89: - STA+P2P concurrency feature gets implemented. - add USB architecture and support RTL8851BU and RTL8852BU. ================== Signed-off-by: Johannes Berg commit b213eb34f857c45bdd769c9e9191a386accc9e8f Author: Jayesh Choudhary Date: Mon Jul 14 16:15:54 2025 +0530 drm/tidss: oldi: convert to devm_drm_bridge_alloc() API DRM bridges now use "devm_drm_bridge_alloc()" for allocation and initialization. "devm_kzalloc()" is not allowed anymore and it results in WARNING. So convert it. Fixes: 7246e0929945 ("drm/tidss: Add OLDI bridge support") Reviewed-by: Devarsh Thakkar Reviewed-by: Aradhya Bhatia Signed-off-by: Jayesh Choudhary Link: https://lore.kernel.org/r/20250714104554.13441-1-j-choudhary@ti.com Signed-off-by: Tomi Valkeinen commit 66cdf05f8548e27a5ad274f0b25db284871eb75e Author: Michael Walle Date: Wed Jul 16 15:41:07 2025 +0200 drm/tidss: encoder: convert to devm_drm_bridge_alloc() Convert the tidss encoder to use devm_drm_bridge_alloc(). Instead of allocating the memory by drmm_simple_encoder_alloc() use devm_drm_bridge_alloc() and initialize the encoder afterwards. Fixes: a7748dd127ea ("drm/bridge: get/put the bridge reference in drm_bridge_add/remove()") Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20250716134107.4084945-1-mwalle@kernel.org Signed-off-by: Tomi Valkeinen commit 380b84e168e57c54d0a9e053a5558fddc43f0c1a Author: Thomas Weißschuh Date: Tue Jul 1 10:58:05 2025 +0200 vdso/vsyscall: Update auxiliary clock data in the datapage Expose the auxiliary clock data so it can be read from the vDSO. Architectures not using the generic vDSO time framework, namely SPARC64, are not supported. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-11-df7d9f87b9b8@linutronix.de commit 9b7fc3f14576c268f62fe0b882fac5e61239b659 Author: Thomas Weißschuh Date: Tue Jul 1 10:58:04 2025 +0200 vdso: Introduce aux_clock_resolution_ns() Move the constant resolution to a shared header, so the vDSO can use it and return it without going through a syscall. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-10-df7d9f87b9b8@linutronix.de commit 562f03ed967dc65e513a3e2e9821f656d5333b8e Author: Thomas Weißschuh Date: Tue Jul 1 10:58:03 2025 +0200 vdso/gettimeofday: Introduce vdso_get_timestamp() This code is duplicated and with the introduction of auxiliary clocks will be duplicated even more. Introduce a helper. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-9-df7d9f87b9b8@linutronix.de commit 381d96ccc1a52237e03ac97b4d2945997c9356e6 Author: Thomas Weißschuh Date: Tue Jul 1 10:58:02 2025 +0200 vdso/gettimeofday: Introduce vdso_set_timespec() This code is duplicated and with the introduction of auxiliary clocks will be duplicated even more. Introduce a helper. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-8-df7d9f87b9b8@linutronix.de commit 1a1cd5fe881fdf7b0391e5426f6bfcb663c90dde Author: Thomas Weißschuh Date: Tue Jul 1 10:58:01 2025 +0200 vdso/gettimeofday: Introduce vdso_clockid_valid() Move the clock ID validation check into a common helper. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-7-df7d9f87b9b8@linutronix.de commit fb61bdb27fd730c393a8bddbda2401c37a919667 Author: Thomas Weißschuh Date: Tue Jul 1 10:58:00 2025 +0200 vdso/gettimeofday: Return bool from clock_gettime() helpers The internal helpers are effectively using boolean results, while pretending to use error numbers. Switch the return type to bool for more clarity. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-6-df7d9f87b9b8@linutronix.de commit 4fec76bcc5357fb10f2f69c1bf1e163db93616f1 Author: Ruben Wauters Date: Sun Jul 13 14:13:50 2025 +0100 crypto: jitter - replace ARRAY_SIZE definition with header include The ARRAY_SIZE macro is already defined in linux/array_size.h This patch replaces the ARRAY_SIZE definition in jitterentropy.c with an include, to make the code cleaner, and help reduce the number of duplicate ARRAY_SIZE definitions in the codebase. Signed-off-by: Ruben Wauters Signed-off-by: Herbert Xu commit 5eb32430df783e212ffed8d35cc494a8941cda0a Author: Ovidiu Panait Date: Fri Jul 11 21:29:32 2025 +0300 crypto: engine - remove {prepare,unprepare}_crypt_hardware callbacks The {prepare,unprepare}_crypt_hardware callbacks were added back in 2016 by commit 735d37b5424b ("crypto: engine - Introduce the block request crypto engine framework"), but they were never implemented by any driver. Remove them as they are unused. Since the 'engine->idling' and 'was_busy' flags are no longer needed, remove them as well. Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit c470ffa6f48619e8ea2442206b31b7965f8826a5 Author: Ovidiu Panait Date: Fri Jul 11 21:29:31 2025 +0300 crypto: engine - remove request batching support Remove request batching support from crypto_engine, as there are no drivers using this feature and it doesn't really work that well. Instead of doing batching based on backlog, a more optimal approach would be for the user to handle the batching (similar to how IPsec can hook into GSO to get 64K of data each time or how block encryption can use unit sizes much greater than 4K). Suggested-by: Herbert Xu Signed-off-by: Ovidiu Panait Reviewed-by: Horia Geantă Signed-off-by: Herbert Xu commit 3d4df408ba9bad2b205c7fb8afc1836a6a4ca88a Author: Giovanni Cabiddu Date: Fri Jul 11 13:27:43 2025 +0100 crypto: qat - flush misc workqueue during device shutdown Repeated loading and unloading of a device specific QAT driver, for example qat_4xxx, in a tight loop can lead to a crash due to a use-after-free scenario. This occurs when a power management (PM) interrupt triggers just before the device-specific driver (e.g., qat_4xxx.ko) is unloaded, while the core driver (intel_qat.ko) remains loaded. Since the driver uses a shared workqueue (`qat_misc_wq`) across all devices and owned by intel_qat.ko, a deferred routine from the device-specific driver may still be pending in the queue. If this routine executes after the driver is unloaded, it can dereference freed memory, resulting in a page fault and kernel crash like the following: BUG: unable to handle page fault for address: ffa000002e50a01c #PF: supervisor read access in kernel mode RIP: 0010:pm_bh_handler+0x1d2/0x250 [intel_qat] Call Trace: pm_bh_handler+0x1d2/0x250 [intel_qat] process_one_work+0x171/0x340 worker_thread+0x277/0x3a0 kthread+0xf0/0x120 ret_from_fork+0x2d/0x50 To prevent this, flush the misc workqueue during device shutdown to ensure that all pending work items are completed before the driver is unloaded. Note: This approach may slightly increase shutdown latency if the workqueue contains jobs from other devices, but it ensures correctness and stability. Fixes: e5745f34113b ("crypto: qat - enable power management for QAT GEN4") Signed-off-by: Giovanni Cabiddu Cc: stable@vger.kernel.org Reviewed-by: Ahsan Atta Signed-off-by: Herbert Xu commit 3471c899fd6be69383aa2b52c411a67c6200a762 Author: Suman Kumar Chakraborty Date: Thu Jul 10 14:33:47 2025 +0100 crypto: qat - enable rate limiting feature for GEN6 devices Add support for enabling rate limiting(RL) feature for QAT GEN6 by initializing the rl_data member in adf_hw_device_data structure. Implement init_num_svc_aes() for GEN6 which will populate the number of AEs associated with the RL service type. Implement adf_gen6_get_svc_slice_cnt() for GEN6 which will return the slice count that can support the RL service type. Co-developed-by: George Abraham P Signed-off-by: George Abraham P Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 45515eec6662dee31a66bd06110ca0b8ded38574 Author: Suman Kumar Chakraborty Date: Thu Jul 10 14:33:46 2025 +0100 crypto: qat - add compression slice count for rate limiting In QAT GEN4 devices, the compression slice count was tracked using the dcpr_cnt field. Introduce a new cpr_cnt field in the rate limiting (RL) infrastructure to track the compression (CPR) slice count independently. The cpr_cnt value is populated via the RL_INIT admin message. The existing dcpr_cnt field will now be used exclusively to cache the decompression slice count, ensuring a clear separation between compression and decompression tracking. Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit e983946de17281d473a4873f52806f0183bb5ab1 Author: Suman Kumar Chakraborty Date: Thu Jul 10 14:33:45 2025 +0100 crypto: qat - add get_svc_slice_cnt() in device data structure Enhance the adf_hw_device_data structure by introducing a new callback function get_svc_slice_cnt(), which provides a mechanism to query the total number of accelerator available on the device for a specific service. Implement adf_gen4_get_svc_slice_cnt() for QAT GEN4 devices to support this new interface. This function returns the total accelerator count for a specific service. Co-developed-by: George Abraham P Signed-off-by: George Abraham P Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit a95521531619945cba526da0a8241e43a18bade3 Author: Suman Kumar Chakraborty Date: Thu Jul 10 14:33:44 2025 +0100 crypto: qat - add adf_rl_get_num_svc_aes() in rate limiting Enhance the rate limiting (RL) infrastructure by adding adf_rl_get_num_svc_aes() which can be used to fetch the number of engines associated with the service type. Expand the structure adf_rl_hw_data with an array that contains the number of AEs per service. Implement adf_gen4_init_num_svc_aes() for QAT GEN4 devices to calculate the total number of acceleration engines dedicated to a specific service. Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit fdf31c75096051cee191ce1baf3f4c41b860e1c6 Author: Suman Kumar Chakraborty Date: Thu Jul 10 14:33:43 2025 +0100 crypto: qat - relocate service related functions Rename (1) is_service_enabled() to adf_is_service_enabled(), and (2) srv_to_cfg_svc_type() to adf_srv_to_cfg_svc_type(), and move them to adf_cfg_services.c which is the appropriate place for configuration-related service logic. This improves code organization and modularity by grouping related service configuration logic in a single location. Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit d8d7e283e0d98d7a57346cc65feab59bf9638de9 Author: Suman Kumar Chakraborty Date: Thu Jul 10 14:33:42 2025 +0100 crypto: qat - consolidate service enums The enums `adf_base_services` (used in rate limiting) and `adf_services` define the same values, resulting in code duplication. To improve consistency across the QAT driver: (1) rename `adf_services` to `adf_base_services` in adf_cfg_services.c to better reflect its role in defining core services (those with dedicated accelerators), (2) introduce a new `adf_extended_services` enum starting from `SVC_BASE_COUNT`, and move `SVC_DCC` into it, as it represents an extended service (DC with chaining), and (3) remove the redundant `adf_base_services` enum from the rate limiting implementation. This does not introduce any functional change. Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit fa37d386c956a4f0112f3ade20b1d6948b6b5238 Author: Suman Kumar Chakraborty Date: Thu Jul 10 14:33:41 2025 +0100 crypto: qat - add decompression service for rate limiting Add a new base service type ADF_SVC_DECOMP to the QAT rate limiting (RL) infrastructure. This enables RL support for the decompression (DECOMP) service type, allowing service-level agreements (SLAs) to be enforced when decompression is configured. The new service is exposed in the sysfs RL service list for visibility. Note that this support is applicable only to devices that provide the decompression service, such as QAT GEN6 devices. Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 63fa7c4dc0ea965d0a17fdbf51e5b421f61000fe Author: Suman Kumar Chakraborty Date: Thu Jul 10 14:33:40 2025 +0100 crypto: qat - validate service in rate limiting sysfs api The sysfs interface 'qat_rl/srv' currently allows all valid services, even if a service is not configured for the device. This leads to a failure when attempting to add the SLA using 'qat_rl/sla_op'. Add a check using is_service_enabled() to ensure the requested service is enabled. If not, return -EINVAL to prevent invalid configurations. Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit f0ae287c50455f7be0d8dd45a803d403c7aa4d2e Author: Wenkai Lin Date: Thu Jul 10 20:24:57 2025 +0800 crypto: hisilicon/sec2 - implement full backlog mode for sec This patch introduces a hierarchical backlog mechanism to cache user data in high-throughput encryption/decryption scenarios, the implementation addresses packet loss issues when hardware queues overflow during peak loads. First, we use sec_alloc_req_id to obtain an exclusive resource from the pre-allocated resource pool of each queue, if no resource is allocated, perform the DMA map operation on the request memory. When the task is ready, we will attempt to send it to the hardware, if the hardware queue is already full, we cache the request into the backlog list, then return an EBUSY status to the upper layer and instruct the packet-sending thread to pause transmission. Simultaneously, when the hardware completes a task, it triggers the sec callback function, within this function, reattempt to send the requests from the backlog list and wake up the sending thread until the hardware queue becomes fully occupied again. In addition, it handles such exceptions like the hardware is reset when packets are sent, it will switch to the software computing and release occupied resources. Signed-off-by: Wenkai Lin Signed-off-by: Chenghai Huang Signed-off-by: Herbert Xu commit f9c4923ca891c83ffad5f9a9fce666a5fa24a7f4 Author: Vijay Sundar Selvamani Date: Thu Jul 10 07:39:45 2025 +0100 Documentation: qat: update debugfs-driver-qat_telemetry for GEN6 devices Expands telemetry documentation for supporting QAT GEN6 device. Introduces new parameters to capture compression, decompression slice utilization and execution count. Co-developed-by: George Abraham P Signed-off-by: George Abraham P Signed-off-by: Vijay Sundar Selvamani Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit c6b012a26cf9aab56bef8e09f02818c3b79cfd95 Author: Vijay Sundar Selvamani Date: Thu Jul 10 07:39:44 2025 +0100 crypto: qat - enable telemetry for GEN6 devices Enable telemetry for QAT GEN6 devices by defining the firmware data structures layouts, implementing the counters parsing logic and setting the required properties on the adf_tl_hw_data data structure. As for QAT GEN4, telemetry counters are exposed via debugfs using the interface described in Documentation/ABI/testing/debugfs-driver-qat_telemetry. Co-developed-by: George Abraham P Signed-off-by: George Abraham P Signed-off-by: Vijay Sundar Selvamani Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit e85334656836c161ee9d87b52ea09776828e7bcd Author: Vijay Sundar Selvamani Date: Thu Jul 10 07:39:43 2025 +0100 crypto: qat - add decompression service to telemetry QAT GEN6 devices offer decompression as an additional service. Update the telemetry ring pair service interface to support monitoring decompression operations. Co-developed-by: George Abraham P Signed-off-by: George Abraham P Signed-off-by: Vijay Sundar Selvamani Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit b19f1ab8d5bf417e00d5855c62e061fb449b13c5 Author: Eric Biggers Date: Wed Jul 9 00:11:40 2025 -0700 crypto: krb5 - Fix memory leak in krb5_test_one_prf() Fix a leak reported by kmemleak: unreferenced object 0xffff8880093bf7a0 (size 32): comm "swapper/0", pid 1, jiffies 4294877529 hex dump (first 32 bytes): 9d 18 86 16 f6 38 52 fe 86 91 5b b8 40 b4 a8 86 .....8R...[.@... ff 3e 6b b0 f8 19 b4 9b 89 33 93 d3 93 85 42 95 .>k......3....B. backtrace (crc 8ba12f3b): kmemleak_alloc+0x8d/0xa0 __kmalloc_noprof+0x3cd/0x4d0 prep_buf+0x36/0x70 load_buf+0x10d/0x1c0 krb5_test_one_prf+0x1e1/0x3c0 krb5_selftest.cold+0x7c/0x54c crypto_krb5_init+0xd/0x20 do_one_initcall+0xa5/0x230 do_initcalls+0x213/0x250 kernel_init_freeable+0x220/0x260 kernel_init+0x1d/0x170 ret_from_fork+0x301/0x410 ret_from_fork_asm+0x1a/0x30 Fixes: fc0cf10c04f4 ("crypto/krb5: Implement crypto self-testing") Signed-off-by: Eric Biggers Acked-by: David Howells Signed-off-by: Herbert Xu commit 962ddc5a7a4b04c007bba0f3e7298cda13c62efd Author: Eric Biggers Date: Tue Jul 8 17:59:54 2025 -0700 crypto: acomp - Fix CFI failure due to type punning To avoid a crash when control flow integrity is enabled, make the workspace ("stream") free function use a consistent type, and call it through a function pointer that has that same type. Fixes: 42d9f6c77479 ("crypto: acomp - Move scomp stream allocation code into acomp") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 3d9eb180fbe8828cce43bce4c370124685b205c3 Author: Eric Biggers Date: Tue Jul 8 12:38:29 2025 -0700 crypto: x86/aegis - Add missing error checks The skcipher_walk functions can allocate memory and can fail, so checking for errors is necessary. Fixes: 1d373d4e8e15 ("crypto: x86 - Add optimized AEGIS implementations") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit c7f49dadfcdf27e1f747442e874e9baa52ab7674 Author: Eric Biggers Date: Tue Jul 8 12:38:28 2025 -0700 crypto: x86/aegis - Fix sleeping when disallowed on PREEMPT_RT skcipher_walk_done() can call kfree(), which takes a spinlock, which makes it incorrect to call while preemption is disabled on PREEMPT_RT. Therefore, end the kernel-mode FPU section before calling skcipher_walk_done(), and restart it afterwards. Moreover, pass atomic=false to skcipher_walk_aead_encrypt() instead of atomic=true. The point of atomic=true was to make skcipher_walk_done() safe to call while in a kernel-mode FPU section, but that does not actually work. So just use the usual atomic=false. Fixes: 1d373d4e8e15 ("crypto: x86 - Add optimized AEGIS implementations") Cc: stable@vger.kernel.org Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu commit c963ff0ec45a4eef7fad8a741848af9a888a0863 Author: George Abraham P Date: Mon Jul 7 13:28:46 2025 +0100 crypto: qat - enable power management debugfs for GEN6 devices The QAT driver includes infrastructure to report power management (PM) information via debugfs. Extend this support to QAT GEN6 devices by exposing PM debug data through the `pm_status` file. This implementation reports the current PM state, power management hardware control and status registers (CSR), and per-domain power status specific to the QAT GEN6 architecture. The debug functionality is implemented in adf_gen6_pm_dbgfs.c and initialized as part of the enable_pm() function. Co-developed-by: Vijay Sundar Selvamani Signed-off-by: Vijay Sundar Selvamani Signed-off-by: George Abraham P Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 7c68005a46108ffaa598e91f1571e5f7f9acb6dc Author: George Abraham P Date: Mon Jul 7 13:28:45 2025 +0100 crypto: qat - relocate power management debugfs helper APIs Relocate the power management debugfs helper APIs in a common file adf_pm_dbgfs_utils.h and adf_pm_dbgfs_utils.c so that it can be shared between device generations. When moving logic from adf_gen4_pm_debugfs.c to adf_pm_dbgfs_utils.c, the include kernel.h has been replaced with the required include. This does not introduce any functional change. Signed-off-by: George Abraham P Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit e83cfb8ff1433cc832d31b8cac967a1eb79d5b44 Author: Suman Kumar Chakraborty Date: Mon Jul 7 09:54:17 2025 +0100 crypto: qat - fix virtual channel configuration for GEN6 devices The TCVCMAP (Traffic Class to Virtual Channel Mapping) field in the PVC0CTL and PVC1CTL register controls how traffic classes are mapped to virtual channels in QAT GEN6 hardware. The driver previously wrote a default TCVCMAP value to this register, but this configuration was incorrect. Modify the TCVCMAP configuration to explicitly enable both VC0 and VC1, and map Traffic Classes 0 to 7 → VC0 and Traffic Class 8 → VC1. Replace FIELD_PREP() with FIELD_MODIFY() to ensure that only the intended TCVCMAP field is updated, preserving other bits in the register. This prevents unintended overwrites of unrelated configuration fields when modifying TC to VC mappings. Fixes: 17fd7514ae68 ("crypto: qat - add qat_6xxx driver") Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 62842d290ee71feb89b2ed4fe810c55f06031ae4 Author: Sakari Ailus Date: Fri Jul 4 10:54:02 2025 +0300 crypto: drivers - Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Signed-off-by: Herbert Xu commit 99d9edf6380be9912bcee53e5262704ebdb96869 Author: Sakari Ailus Date: Fri Jul 4 10:53:59 2025 +0300 hwrng: drivers - Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Herbert Xu commit 75e2d4b1eddcfafd3b3961490f7da0bae4ecb451 Author: Lukas Bulwahn Date: Tue Jul 1 13:20:45 2025 +0200 crypto: caam - avoid option aliasing with the CONFIG_CAAM_QI build option In the Makefile, the new build option CONFIG_CAAM_QI is defined conditioned on the existence of the CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_QI, which is properly defined in the Kconfig file. So, CONFIG_CAAM_QI is just a local alias for CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_QI. There is little benefit in the source code of having this slightly shorter alias for this configuration, but it complicates further maintenance, as searching for the impact of CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_QI requires to grep once, and then identify the option introduced and continue searching for that. Further, tools, such as cross referencers, and scripts to check Kconfig definitions and their use simply do not handle this situation. Given that this is the only incidence of such a config alias in the whole kernel tree, just prefer to avoid this pattern of aliasing here. Use CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_QI throughout the Freescale CAAM-Multicore platform driver backend source code. No functional change. Signed-off-by: Lukas Bulwahn Reviewed-by: Horia Geantă Signed-off-by: Herbert Xu commit 26abce2510980f8c4693a6a35753a94f0efd47ab Author: Małgorzata Mielnik Date: Tue Jul 1 10:47:30 2025 +0100 crypto: qat - add live migration enablers for GEN6 devices The current implementation of the QAT live migration enablers is exclusive to QAT GEN4 devices and resides within QAT GEN4 specific files. However, the underlying mechanisms, such as the relevant CSRs and offsets, can be shared between QAT GEN4 and QAT GEN6 devices. Add the necessary enablers required to implement live migration for QAT GEN6 devices to the abstraction layer to allow leveraging the existing QAT GEN4 implementation. Signed-off-by: Małgorzata Mielnik Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit a47dc5d1a6e2342e7725c6c592800d49b7276b7a Author: Suman Kumar Chakraborty Date: Tue Jul 1 10:47:29 2025 +0100 crypto: qat - relocate and rename bank state structure definition The `bank_state` structure represents the state of a bank of rings. As part of recent refactoring, the functions that interact with this structure have been moved to a new unit, adf_bank_state.c. To align with this reorganization, rename `struct bank_state` to `struct adf_bank_state` and move its definition to adf_bank_state.h. Also relocate the associated `struct ring_config` to the same header to consolidate related definitions. Update all references to use the new structure name. This does not introduce any functional change. Signed-off-by: Suman Kumar Chakraborty Signed-off-by: Herbert Xu commit e9eec2916c167c7867148254a8f945401a5f6a38 Author: Małgorzata Mielnik Date: Tue Jul 1 10:47:28 2025 +0100 crypto: qat - relocate bank state helper functions The existing implementation of bank state management functions, including saving and restoring state, is located within 4xxx device files. However, these functions do not contain GEN4-specific code and are applicable to other QAT generations. Relocate the bank state management functions to a new file, adf_bank_state.c, and rename them removing the `gen4` prefix. This change enables the reuse of such functions across different QAT generations. Add documentation to bank state related functions that were moved from QAT 4xxx specific files to common files. This does not introduce any functional change. Signed-off-by: Małgorzata Mielnik Signed-off-by: Herbert Xu commit 18126fdff42f6854123b3ddaf3b469a0cee80adb Author: Suman Kumar Chakraborty Date: Tue Jul 1 10:47:27 2025 +0100 crypto: qat - replace CHECK_STAT macro with static inline function The macro CHECK_STAT is used to check that all ring statuses match the saved state during restoring the state of bank. Replace the CHECK_STAT macro with the static inline function `check_stat()` to improve type safety, readability, and debuggability. This does not introduce any functional change. Signed-off-by: Suman Kumar Chakraborty Signed-off-by: Herbert Xu commit 7ea5ea3e58b037e0751c6406cea1e048892be4de Author: Suman Kumar Chakraborty Date: Tue Jul 1 10:47:26 2025 +0100 crypto: qat - use pr_fmt() in adf_gen4_hw_data.c Add pr_fmt() to adf_gen4_hw_data.c logging and update the debug and error messages to utilize it accordingly. This does not introduce any functional changes. Signed-off-by: Suman Kumar Chakraborty Signed-off-by: Herbert Xu commit 590f8a67ba3cafba48e62d20ee03ab7d9a2c51f9 Author: Sebastian Andrzej Siewior Date: Tue Jul 1 08:09:36 2025 +0200 crypto: cryptd - Use nested-BH locking for cryptd_cpu_queue cryptd_queue::cryptd_cpu_queue is a per-CPU variable and relies on disabled BH for its locking. Without per-CPU locking in local_bh_disable() on PREEMPT_RT this data structure requires explicit locking. Add a local_lock_t to the struct cryptd_cpu_queue and use local_lock_nested_bh() for locking. This change adds only lockdep coverage and does not alter the functional behaviour for !PREEMPT_RT. Cc: "David S. Miller" Cc: Herbert Xu Cc: linux-crypto@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Herbert Xu commit d956692c7dd523b331d4556ee03def8dd02609dc Author: Bairavi Alagappan Date: Mon Jun 30 10:20:49 2025 +0100 crypto: qat - disable ZUC-256 capability for QAT GEN5 The ZUC-256 EEA (encryption) and EIA (integrity) algorithms are not supported on QAT GEN5 devices, as their current implementation does not align with the NIST specification. Earlier versions of the ZUC-256 specification used a different initialization scheme, which has since been revised to comply with the 5G specification. Due to this misalignment with the updated specification, remove support for ZUC-256 EEA and EIA for QAT GEN5 by masking out the ZUC-256 capability. Fixes: fcf60f4bcf549 ("crypto: qat - add support for 420xx devices") Signed-off-by: Bairavi Alagappan Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 34b283636181ce02c52633551f594fec9876bec7 Author: Thomas Fourier Date: Mon Jun 30 11:16:22 2025 +0200 crypto: img-hash - Fix dma_unmap_sg() nents value The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: d358f1abbf71 ("crypto: img-hash - Add Imagination Technologies hw hash accelerator") Signed-off-by: Thomas Fourier Signed-off-by: Herbert Xu commit 01951a7dc5ac1a37e5fb7d86ea7eb2dfbf96e8b6 Author: Thomas Fourier Date: Mon Jun 30 10:57:06 2025 +0200 crypto: keembay - Fix dma_unmap_sg() nents value The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: 472b04444cd3 ("crypto: keembay - Add Keem Bay OCS HCU driver") Signed-off-by: Thomas Fourier Signed-off-by: Herbert Xu commit 522a242a18adc5c63a24836715dbeec4dc3faee1 Author: Ovidiu Panait Date: Sun Jun 29 20:31:41 2025 +0300 hwrng: mtk - handle devm_pm_runtime_enable errors Although unlikely, devm_pm_runtime_enable() call might fail, so handle the return value. Fixes: 78cb66caa6ab ("hwrng: mtk - Use devm_pm_runtime_enable") Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit 648272e94e73a2d77a9664f3a5e6cfbd65f2d927 Merge: 25f4e1d7193d14 7ff495e26a39f3 Author: Herbert Xu Date: Fri Jul 18 20:51:19 2025 +1000 Merge tag 'local-lock-for-net' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into head Local lock changes required by net/crypto commit a876a3aacc434e93154540c7ffafa66da9d5af34 Author: Hiago De Franco Date: Wed Jul 16 16:46:38 2025 -0300 remoteproc: imx_rproc: detect and attach to pre-booted remote cores When the Cortex-M remote core is started and already running before Linux boots (typically by the Cortex-A bootloader using a command like bootaux), the current driver is unable to attach to it. This is because the driver only checks for remote cores running in different SCU partitions. However in this case, the M-core is in the same partition as Linux and is already powered up and running by the bootloader. This patch adds a check using dev_pm_genpd_is_on() to verify whether the M-core's power domains are already on. If all power domain devices are on, the driver assumes the M-core is running and proceed to attach to it. To accomplish this, we need to avoid passing any attach_data or flags to dev_pm_domain_attach_list(), allowing the platform device become a consumer of the power domain provider without changing its current state. During probe, also enable and sync the device runtime PM to make sure the power domains are correctly managed when the core is controlled by the kernel. Suggested-by: Ulf Hansson Reviewed-by: Ulf Hansson Reviewed-by: Peng Fan Signed-off-by: Hiago De Franco Reviewed-by: Mathieu Poirier Link: https://lore.kernel.org/r/20250716194638.113115-1-hiagofranco@gmail.com Signed-off-by: Ulf Hansson commit af42cf30ea5dfc946dca11ec2bca0e2d4bbb6f9e Merge: 7e11e01d1f1d00 a81648768178f6 Author: Dave Airlie Date: Fri Jul 18 19:48:13 2025 +1000 Merge tag 'drm-xe-next-2025-07-15' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next Driver Changes: - Create and use XE_DEVICE_WA infrastructure (Atwood) - SRIOV: Mark BMG as SR-IOV capable (Michal) - Dont skip TLB invalidations on VF (Tejas) - Fix migration copy direction in access_memory (Auld) - General code clean-up (Lucas, Brost, Dr. David, Xin) - More missing XeLP workarounds (Tvrtko) - SRIOV: Relax VF/PF version negotiation (Michal) - SRIOV: LMTT invalidation (Michal) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aHacDvF9IaVHI61C@intel.com commit dc3977856443e336ed2ba82a2e2e5514244c82e7 Merge: 083957f9614a8b fe4d3360f9cbb5 Author: Christian Brauner Date: Fri Jul 18 11:10:48 2025 +0200 Merge patch series "ovl: narrow regions protected by i_rw_sem" NeilBrown says: This series of patches for overlayfs is primarily focussed on preparing for some proposed changes to directory locking. In the new scheme we will lock individual dentries in a directory rather than the whole directory. ovl currently will sometimes lock a directory on the upper filesystem and do a few different things while holding the lock. This is incompatible with the new scheme. This series narrows the region of code protected by the directory lock, taking it multiple times when necessary. This theoretically open up the possibilty of other changes happening on the upper filesytem between the unlock and the lock. To some extent the patches guard against that by checking the dentries still have the expect parent after retaking the lock. In general, I think ovl would have trouble if upperfs were being changed independantly, and I don't think the changes here increase the problem in any important way. After this series (with any needed changes) lands I will resubmit my change to vfs_rmdir() behaviour to have it drop the lock on error. ovl will be much better positioned to handle that change. It will come with the new "lookup_and_lock" API that I am proposing. * patches from https://lore.kernel.org/20250716004725.1206467-1-neil@brown.name: (21 commits) ovl: rename ovl_cleanup_unlocked() to ovl_cleanup() ovl: change ovl_create_real() to receive dentry parent ovl: narrow locking in ovl_check_rename_whiteout() ovl: narrow locking in ovl_whiteout() ovl: change ovl_cleanup_and_whiteout() to take rename lock as needed ovl: narrow locking on ovl_remove_and_whiteout() ovl: change ovl_workdir_cleanup() to take dir lock as needed. ovl: narrow locking in ovl_workdir_cleanup_recurse() ovl: narrow locking in ovl_indexdir_cleanup() ovl: narrow locking in ovl_workdir_create() ovl: narrow locking in ovl_cleanup_index() ovl: narrow locking in ovl_cleanup_whiteouts() ovl: narrow locking in ovl_rename() ovl: simplify gotos in ovl_rename() ovl: narrow locking in ovl_create_over_whiteout() ovl: narrow locking in ovl_clear_empty() ovl: narrow locking in ovl_create_upper() ovl: narrow the locked region in ovl_copy_up_workdir() ovl: Call ovl_create_temp() without lock held. ovl: change ovl_create_index() to take dir locks ... Link: https://lore.kernel.org/20250716004725.1206467-1-neil@brown.name Signed-off-by: Christian Brauner commit fe4d3360f9cbb513be6d74bdeb154728cad5c437 Author: NeilBrown Date: Wed Jul 16 10:44:32 2025 +1000 ovl: rename ovl_cleanup_unlocked() to ovl_cleanup() The only remaining user of ovl_cleanup() is ovl_cleanup_locked(), so we no longer need both. This patch renames ovl_cleanup() to ovl_cleanup_locked() and makes it static. ovl_cleanup_unlocked() is renamed to ovl_cleanup(). Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-22-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit ee37c3cfc5df9013dadf42919ca65510abc15632 Author: NeilBrown Date: Wed Jul 16 10:44:31 2025 +1000 ovl: change ovl_create_real() to receive dentry parent Instead of passing an inode *dir, pass a dentry *parent. This makes the calling slightly cleaner. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-21-neil@brown.name Signed-off-by: Christian Brauner commit 09d56cc88c247036da5756fd552f2cb2af8d8c5e Author: NeilBrown Date: Wed Jul 16 10:44:30 2025 +1000 ovl: narrow locking in ovl_check_rename_whiteout() ovl_check_rename_whiteout() now only holds the directory lock when needed, and takes it again if necessary. This makes way for future changes where locks are taken on individual dentries rather than the whole directory. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-20-neil@brown.name Signed-off-by: Christian Brauner commit 8afa0a736713898f04d52abad69c07caa2c2f227 Author: NeilBrown Date: Wed Jul 16 10:44:29 2025 +1000 ovl: narrow locking in ovl_whiteout() ovl_whiteout() relies on the workdir i_rwsem to provide exclusive access to ofs->whiteout which it manipulates. Rather than depending on this, add a new mutex, "whiteout_lock" to explicitly provide the required locking. Use guard(mutex) for this so that we can return without needing to explicitly unlock. Then take the lock on workdir only when needed - to lookup the temp name and to do the whiteout or link. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-19-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 2fa14cf2dca1913054e0225377d0a9999483d34d Author: NeilBrown Date: Wed Jul 16 10:44:28 2025 +1000 ovl: change ovl_cleanup_and_whiteout() to take rename lock as needed Rather than locking the directory(s) before calling ovl_cleanup_and_whiteout(), change it (and ovl_whiteout()) to do the locking, so the locking can be fine grained as will be needed for proposed locking changes. Sometimes this is called to whiteout something in the index dir, in which case only that dir must be locked. In one case it is called on something in an upperdir, so two directories must be locked. We use ovl_lock_rename_workdir() for this and remove the restriction that upperdir cannot be indexdir - because now sometimes it is. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-18-neil@brown.name Signed-off-by: Christian Brauner commit c69566b1d11d781d6b586113126ce1a803bbf8fc Author: NeilBrown Date: Wed Jul 16 10:44:27 2025 +1000 ovl: narrow locking on ovl_remove_and_whiteout() This code: performs a lookup_upper creates a whiteout object renames the whiteout over the result of the lookup The create and the rename must be locked separately for proposed directory locking changes. This patch takes a first step of moving the lookup out of the locked region. A subsequent patch will separate the create from the rename. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-17-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 241062ae5d8784158d0af5d7b9212c3b53d91ca5 Author: NeilBrown Date: Wed Jul 16 10:44:26 2025 +1000 ovl: change ovl_workdir_cleanup() to take dir lock as needed. Rather than calling ovl_workdir_cleanup() with the dir already locked, change it to take the dir lock only when needed. Also change ovl_workdir_cleanup() to take a dentry for the parent rather than an inode. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-16-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit a45ee87ded78876f8106a255f726b89aa69cd7a4 Author: NeilBrown Date: Wed Jul 16 10:44:25 2025 +1000 ovl: narrow locking in ovl_workdir_cleanup_recurse() Only take the dir lock when needed, rather than for the whole loop. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-15-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit d56c6feb69cb8f036855b4d12c84b46b10421278 Author: NeilBrown Date: Wed Jul 16 10:44:24 2025 +1000 ovl: narrow locking in ovl_indexdir_cleanup() Instead of taking the directory lock for the whole cleanup, only take it when needed. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-14-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 61eb7fec9e79d429939fab16a4558caf7fa83160 Author: NeilBrown Date: Wed Jul 16 10:44:23 2025 +1000 ovl: narrow locking in ovl_workdir_create() In ovl_workdir_create() don't hold the dir lock for the whole time, but only take it when needed. It now gets taken separately for ovl_workdir_cleanup(). A subsequent patch will move the locking into that function. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-13-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 8290fb412d2f3dced1b744330d22f2d639ccdf36 Author: NeilBrown Date: Wed Jul 16 10:44:22 2025 +1000 ovl: narrow locking in ovl_cleanup_index() ovl_cleanup_index() takes a lock on the directory and then does a lookup and possibly one of two different cleanups. This patch narrows the locking to use the _unlocked() versions of the lookup and one cleanup, and just takes the lock for the other cleanup. A subsequent patch will take the lock into the cleanup. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-12-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 7dfb0722ad0740f6fbf9bd184e3ae4ba4bc19f31 Author: NeilBrown Date: Wed Jul 16 10:44:21 2025 +1000 ovl: narrow locking in ovl_cleanup_whiteouts() Rather than lock the directory for the whole operation, use ovl_lookup_upper_unlocked() and ovl_cleanup_unlocked() to take the lock only when needed. This makes way for future changes where locks are taken on individual dentries rather than the whole directory. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-11-neil@brown.name Signed-off-by: Christian Brauner commit 05468498cd2fc5b65e18eb80cdce8ae6ee6c9a77 Author: NeilBrown Date: Wed Jul 16 10:44:20 2025 +1000 ovl: narrow locking in ovl_rename() Drop the rename lock immediately after the rename, and use ovl_cleanup_unlocked() for cleanup. This makes way for future changes where locks are taken on individual dentries rather than the whole directory. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-10-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 76342c9eb8e28f2e421ec7fb72bb2b9aa4d7dd77 Author: NeilBrown Date: Wed Jul 16 10:44:19 2025 +1000 ovl: simplify gotos in ovl_rename() Rather than having three separate goto label: out_unlock, out_dput_old, and out_dput, make use of that fact that dput() happily accepts a NULL pointer to reduce this to just one goto label: out_unlock. olddentry and newdentry are initialised to NULL and only set once a value dentry is found. They are then dput() late in the function. Suggested-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-9-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit e460bc4d012ce144376264609309b14b84b693ff Author: NeilBrown Date: Wed Jul 16 10:44:18 2025 +1000 ovl: narrow locking in ovl_create_over_whiteout() Unlock the parents immediately after the rename, and use ovl_cleanup_unlocked() for cleanup, which takes a separate lock. This makes way for future changes where locks are taken on individual dentries rather than the whole directory. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-8-neil@brown.name Signed-off-by: Christian Brauner commit 4f622bd9f3e5dd1e882ee8f4194ea1d95dcf752f Author: NeilBrown Date: Wed Jul 16 10:44:17 2025 +1000 ovl: narrow locking in ovl_clear_empty() Drop the locks immediately after rename, and use a separate lock for cleanup. This makes way for future changes where locks are taken on individual dentries rather than the whole directory. Note that ovl_cleanup_whiteouts() operates on "upper", a child of "upperdir" and does not require upperdir or workdir to be locked. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-7-neil@brown.name Signed-off-by: Christian Brauner commit a07052e07b67add56328b547ce4459878618334d Author: NeilBrown Date: Wed Jul 16 10:44:16 2025 +1000 ovl: narrow locking in ovl_create_upper() Drop the directory lock immediately after the ovl_create_real() call and take a separate lock later for cleanup in ovl_cleanup_unlocked() - if needed. This makes way for future changes where locks are taken on individual dentries rather than the whole directory. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-6-neil@brown.name Signed-off-by: Christian Brauner commit a735bdf0b78528970f169870ced234dd3a33ea7b Author: NeilBrown Date: Wed Jul 16 10:44:15 2025 +1000 ovl: narrow the locked region in ovl_copy_up_workdir() In ovl_copy_up_workdir() unlock immediately after the rename. There is nothing else in the function that needs the lock. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-5-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit d2c995581c7c5d0ff623b2700e76bf22499c66df Author: NeilBrown Date: Wed Jul 16 10:44:14 2025 +1000 ovl: Call ovl_create_temp() without lock held. ovl currently locks a directory or two and then performs multiple actions in one or both directories. This is incompatible with proposed changes which will lock just the dentry of objects being acted on. This patch moves calls to ovl_create_temp() out of the locked regions and has it take and release the relevant lock itself. The lock that was taken before this function was called is now taken after. This means that any code between where the lock was taken and ovl_create_temp() is now unlocked. This necessitates the use of ovl_cleanup_unlocked() and the creation of ovl_lookup_upper_unlocked(). These will be used more widely in future patches. Now that the file is created before the lock is taken for rename, we need to ensure the parent wasn't changed before the lock was gained. ovl_lock_rename_workdir() is changed to optionally receive the dentries that will be involved in the rename. If either is present but has the wrong parent, an error is returned. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-4-neil@brown.name Signed-off-by: Christian Brauner commit c4f8f862b31ccd3d633475fe3982490c744b6565 Author: NeilBrown Date: Wed Jul 16 10:44:13 2025 +1000 ovl: change ovl_create_index() to take dir locks ovl_copy_up_workdir() currently take a rename lock on two directories, then use the lock to both create a file in one directory, perform a rename, and possibly unlink the file for cleanup. This is incompatible with proposed changes which will lock just the dentry of objects being acted on. This patch moves the call to ovl_create_index() earlier in ovl_copy_up_workdir() to before the lock is taken. ovl_create_index() then takes the required lock only when needed. Reviewed-by: Amir Goldstein Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-3-neil@brown.name Signed-off-by: Christian Brauner commit 9d23967b18c64b058cc0a03a8932413bcb37ebb9 Author: NeilBrown Date: Wed Jul 16 10:44:12 2025 +1000 ovl: simplify an error path in ovl_copy_up_workdir() If ovl_copy_up_data() fails the error is not immediately handled but the code continues on to call ovl_start_write() and lock_rename(), presumably because both of these locks are needed for the cleanup. Only then (if the lock was successful) is the error checked. This makes the code a little hard to follow and could be fragile. This patch changes to handle the error after the ovl_start_write() (which cannot fail, so there aren't multiple errors to deail with). A new ovl_cleanup_unlocked() is created which takes the required directory lock. This will be used extensively in later patches. In general we need to check the parent is still correct after taking the lock (as ovl_copy_up_workdir() does after a successful lock_rename()) so that is included in ovl_cleanup_unlocked() using new ovl_parent_lock() and ovl_parent_unlock() calls (it is planned to move this API into VFS code eventually, though in a slightly different form). Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250716004725.1206467-2-neil@brown.name Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 083957f9614a8b2e284dbb3a85c5fec8e2fb26b8 Author: Amir Goldstein Date: Mon Jun 2 19:17:02 2025 +0200 ovl: support layers on case-folding capable filesystems Case folding is often applied to subtrees and not on an entire filesystem. Disallowing layers from filesystems that support case folding is over limiting. Replace the rule that case-folding capable are not allowed as layers with a rule that case folded directories are not allowed in a merged directory stack. Should case folding be enabled on an underlying directory while overlayfs is mounted the outcome is generally undefined. Specifically in ovl_lookup(), we check the base underlying directory and fail with -ESTALE and write a warning to kmsg if an underlying directory case folding is enabled. Suggested-by: Kent Overstreet Link: https://lore.kernel.org/linux-fsdevel/20250520051600.1903319-1-kent.overstreet@linux.dev/ Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/20250602171702.1941891-1-amir73il@gmail.com Reviewed-by: Kent Overstreet Signed-off-by: Christian Brauner commit 04060e7860cb2dad21898248f7e7f7575ce44a14 Merge: bc9241367aac08 3ec2529eca6f17 Author: Christian Brauner Date: Wed Jun 11 11:13:10 2025 +0200 Merge patch series "backing_file accessors cleanup" Amir Goldstein says: As promissed, here is the backing_file accessors cleanup that was dicussed on the overlayfs pr [1]. I have kept the ovl patch separate from the vfs patch, so that the vfs patch could be backported to stable kernels, because the ovl patch depends on master of today. * patches from https://lore.kernel.org/20250607115304.2521155-1-amir73il@gmail.com: ovl: remove unneeded non-const conversion fs: constify file ptr in backing_file accessor helpers Link: https://lore.kernel.org/linux-fsdevel/CAOQ4uxgFJCikAi4o4e9vzXTH=cUQGyvoo+cpdtfmBwJzutSCzw@mail.gmail.com/ [1] Link: https://lore.kernel.org/20250607115304.2521155-1-amir73il@gmail.com Signed-off-by: Christian Brauner commit 3ec2529eca6f175f4e3e87c4534010e044839b38 Author: Amir Goldstein Date: Sat Jun 7 13:53:04 2025 +0200 ovl: remove unneeded non-const conversion file_user_path() now takes a const file ptr. Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/20250607115304.2521155-3-amir73il@gmail.com Signed-off-by: Christian Brauner commit 4e301d858af17ae2ce56886296e5458c5a08219a Author: Amir Goldstein Date: Sat Jun 7 13:53:03 2025 +0200 fs: constify file ptr in backing_file accessor helpers Add internal helper backing_file_set_user_path() for the only two cases that need to modify backing_file fields. Signed-off-by: Amir Goldstein Link: https://lore.kernel.org/20250607115304.2521155-2-amir73il@gmail.com Signed-off-by: Christian Brauner commit ae455b249449ad6306500324aa76f03b46295599 Author: Rob Herring (Arm) Date: Mon Jul 14 15:28:58 2025 -0500 dt-bindings: gpio: Convert qca,ar7100-gpio to DT schema Convert the Qualcomm Atheros AR7xxx/AR9xxx GPIO binding to DT schema format. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202859.3012173-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 07e858e7e1932c97509a874cf753b09ce3f167ca Author: Rob Herring (Arm) Date: Mon Jul 14 15:28:41 2025 -0500 dt-bindings: gpio: Convert maxim,max3191x to DT schema Convert the Maxim MAX3191x and similar GPIO binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Reviewed-by: Lukas Wunner Link: https://lore.kernel.org/r/20250714202843.3011698-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit e2337e64fce36a8ed6cb44771482e9dabb24eea9 Author: Rob Herring (Arm) Date: Mon Jul 14 15:29:40 2025 -0500 dt-bindings: gpio: fsl,qoriq-gpio: Add missing mpc8xxx compatibles The fsl,mpc8349-gpio, fsl,mpc8572-gpio, and fsl,mpc8610-gpio compatibles are already documented in fsl,qoriq-gpio.yaml. Add the additional compatibles that use fsl,mpc8349-gpio as a fallback. With that, the 8xxx_gpio.txt binding document is redundant and can be removed. Signed-off-by: Rob Herring (Arm) Acked-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250714202941.3013390-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit f03a7f20b23c1abb1066f791806bbca406362324 Author: Rob Herring (Arm) Date: Mon Jul 14 15:19:51 2025 -0500 dt-bindings: gpio: Create a trivial GPIO schema Many simple GPIO controllers without interrupt capability have the same schema other than their compatible value. Combine all these bindings into a single schema. The criteria to be included here is must use 2 cells, have no interrupt capability, have 0 or 1 "reg" entries, and have no other resources (like clocks). Note that "ngpios" is now allowed in some cases it wasn't before and constraints on it have been dropped. Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250714201959.2983482-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit aa66eb1202d65923e101c7b50d757ddf0422eb27 Author: Rob Herring (Arm) Date: Mon Jul 14 15:27:52 2025 -0500 dt-bindings: gpio: Convert st,spear-spics-gpio to DT schema Convert the ST SPEAr SPI CS GPIO binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20250714202753.3010240-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 48a9cf93ba3a11dab608a0ea11341ccda0494e3d Author: Rob Herring (Arm) Date: Mon Jul 14 15:29:32 2025 -0500 dt-bindings: gpio: Convert abilis,tb10x-gpio to DT schema Convert the Abilis TB10x GPIO binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202934.3013189-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 672d644a7da94ee906950953188c6da26ae99594 Author: Rob Herring (Arm) Date: Mon Jul 14 15:28:20 2025 -0500 dt-bindings: gpio: Convert apm,xgene-gpio-sb to DT schema Convert APM X-Gene Standby GPIO binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202821.3011099-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 842dcff8e2d6fb33f7e9d59332a713b867a8f187 Author: Rob Herring (Arm) Date: Mon Jul 14 15:28:28 2025 -0500 dt-bindings: gpio: Convert ti,twl4030-gpio to DT schema Convert the TI TWL4030 PMIC GPIO binding to DT schema format. The number of #interrupt-cells was wrong compared to what is in use. Correct it to be 1. Reviewed-by: Andreas Kemnade Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202829.3011298-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 71b660010bde67a0e0ffdee67d30e62672e6d393 Author: Rob Herring (Arm) Date: Mon Jul 14 15:28:35 2025 -0500 dt-bindings: gpio: Convert lantiq,gpio-mm-lantiq to DT schema Convert the Lantiq SoC External Bus memory mapped GPIO binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202837.3011521-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit aff0a1701b020c8e6b172f28828fd4f3e6eed41a Author: Rob Herring (Arm) Date: Mon Jul 14 15:28:49 2025 -0500 dt-bindings: gpio: Convert ti,keystone-dsp-gpio to DT schema Convert the TI Keystone DSP GPIO binding to DT schema format. The "ti,syscon-dev" property was wrong and should be "gpio,syscon-dev" instead. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202850.3011952-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 695f375b2a881544d112edbb60a35a884c7604ae Author: Rob Herring (Arm) Date: Mon Jul 14 15:29:04 2025 -0500 dt-bindings: gpio: Convert altr,pio-1.0 to DT schema Convert the altr,pio-1.0 binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202905.3012386-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 7aee14a170a07bf6481f65e6a36a835e6414917e Author: Rob Herring (Arm) Date: Mon Jul 14 15:29:17 2025 -0500 dt-bindings: gpio: Convert cirrus,clps711x-mctrl-gpio to DT schema Convert the cirrus,clps711x-mctrl-gpio binding to DT schema format. Add the missing "gpio,syscon-dev" phandle property. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202919.3012764-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 5c163c9759605148d0c66acd8d795133c4b48ebb Author: Rob Herring (Arm) Date: Mon Jul 14 15:29:25 2025 -0500 dt-bindings: gpio: Convert cavium,octeon-3860-gpio to DT schema Convert the Cavium Octeon 3860 GPIO binding to DT schema format. It's a straight forward conversion. Looks like Octeon has no maintainers, so Bartosz is listed. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202927.3012974-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 98ce0e1c4a46049faf63bc02e1916bd219465974 Author: Rob Herring (Arm) Date: Mon Jul 14 15:28:12 2025 -0500 dt-bindings: gpio: Convert exar,xra1403 to DT schema Convert XRA1403 16-bit GPIO Expander binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202813.3010879-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 82388cb24a2c057316801dc390321cfe2bc0f3e2 Author: Rob Herring (Arm) Date: Mon Jul 14 15:28:06 2025 -0500 dt-bindings: gpio: Convert microchip,pic32mzda-gpio to DT schema Convert the Microchip PIC32 GPIO binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202807.3010652-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 2ae9b28947d486b7980b990cba205b1862b6d7a8 Author: Rob Herring (Arm) Date: Mon Jul 14 15:28:00 2025 -0500 dt-bindings: gpio: Convert lacie,netxbig-gpio-ext to DT schema Convert the Lacie NetxBig GPIO binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250714202801.3010442-1-robh@kernel.org Signed-off-by: Bartosz Golaszewski commit 906b955c60770bfdfae141aa993ae5fdb3eab193 Author: Bartosz Golaszewski Date: Thu Jul 17 15:11:15 2025 +0200 gpio: xilinx: convert set_multiple() to the new API as well The patch converting the driver to using new GPIO line value setters only converted the set() callback and missed set_multiple(). Fix it now. Fixes: 1919ea19a4ff ("gpio: xilinx: use new GPIO line value setter callbacks") Acked-by: Michal Simek Link: https://lore.kernel.org/r/20250717131116.53878-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 74896eae7e040e1b2a381efc8df0c839023dbf16 Author: Bartosz Golaszewski Date: Thu Jul 17 15:03:56 2025 +0200 misc: ti-fpc202: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Romain Gantois Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250717130357.53491-2-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit db7897ad60fd7d7bf471bc1c49e3d01fefadade3 Author: Bartosz Golaszewski Date: Thu Jul 17 15:03:55 2025 +0200 misc: ti-fpc202: remove unneeded direction check As of commit 92ac7de3175e3 ("gpiolib: don't allow setting values on input lines"), the GPIO core makes sure values cannot be set on input lines. Remove the unnecessary check. Reviewed-by: Romain Gantois Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250717130357.53491-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit b1136432c97241f0e5c40d58597da00d49cd9917 Author: Huisong Li Date: Fri Jul 11 14:37:06 2025 +0800 soc: hisilicon: kunpeng_hccs: Fix incorrect log information The hccs_get_all_spec_port_idle_sta() will tell user which port is busy when firmware doesn't allow to decrease HCCS lane number. However, the current log prints the index of die and port instead of the hardware ID user perceived. Signed-off-by: Huisong Li Reviewed-by: Jonathan Cameron Signed-off-by: Wei Xu commit 94cd0ba1842ece06acc15bba5f2bff6b6043eb1d Author: Qianfeng Rong Date: Tue Jul 15 20:16:53 2025 +0800 wifi: rtlwifi: Use min()/max() to improve code Use min()/max() to reduce the code and improve its readability. Acked-by: Ping-Ke Shih Signed-off-by: Qianfeng Rong Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250715121721.266713-8-rongqianfeng@vivo.com commit 37c23874d13eb369d8b384a1ce5992ff6c23d56f Author: Chin-Yen Lee Date: Wed Jul 16 20:29:26 2025 +0800 wifi: rtw89: wow: Add Basic Rate IE to probe request in scheduled scan mode In scheduled scan mode, the current probe request only includes the SSID IE, but omits the Basic Rate IE. Some APs do not respond to such incomplete probe requests, causing net-detect failures. To improve interoperability and ensure APs respond correctly, add the Basic Rate IE to the probe request in driver. Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250716122926.6709-1-pkshih@realtek.com commit c7f7ddbd27d55fa552a7269b7bae539adc2a3d46 Author: Varshini Rajendran Date: Mon Jul 14 15:05:12 2025 +0530 clk: at91: sam9x7: update pll clk ranges Update the min, max ranges of the PLL clocks according to the latest datasheet to be coherent in the driver. This patch solves the issues in configuring the clocks related to peripherals with the desired frequency within the range. Fixes: 33013b43e271 ("clk: at91: sam9x7: add sam9x7 pmc driver") Suggested-by: Patrice Vilchez Signed-off-by: Varshini Rajendran Link: https://lore.kernel.org/r/20250714093512.29944-1-varshini.rajendran@microchip.com Signed-off-by: Claudiu Beznea commit 12322a02603071d09df652bbc11864e23de0b83e Author: Bitterblue Smith Date: Tue Jul 15 22:46:20 2025 +0300 wifi: rtw89: Lower the timeout in rtw89_fwdl_check_path_ready_ax() for USB When the chip is not powered on correctly (like during driver development) rtw89_fwdl_check_path_ready_ax() can fail. read_poll_timeout_atomic() with a delay of 1 µs and a timeout of 400000 µs can take 50 seconds with USB because of the time it takes to send a USB control message. The firmware upload is tried 5 times, so in total it takes 250 seconds. Lower the timeout to 3200 for USB in order to reduce the time rtw89_fwdl_check_path_ready_ax() takes from 50 seconds to less than 1 second. Signed-off-by: Bitterblue Smith Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/af0b25d0-ea67-455e-91f2-8e4c18ae4328@gmail.com commit 671be46afd1f03de9dc6e4679c88e1a7a81cdff6 Author: Bitterblue Smith Date: Tue Jul 15 22:44:47 2025 +0300 wifi: rtw89: Lower the timeout in rtw89_fw_read_c2h_reg() for USB This read_poll_timeout_atomic() with a delay of 1 µs and a timeout of 1000000 µs can take ~250 seconds in the worst case because sending a USB control message takes ~250 µs. Lower the timeout to 4000 for USB in order to reduce the maximum polling time to ~1 second. This problem was observed with RTL8851BU while suspending to RAM with WOWLAN enabled. The computer sat for 4 minutes with a black screen before suspending. Signed-off-by: Bitterblue Smith Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/09313da6-c865-4e91-b758-4cb38a878796@gmail.com commit 8b4a0277388137ac31728ee69d9e388a0fa52287 Author: Ping-Ke Shih Date: Tue Jul 15 11:52:59 2025 +0800 wifi: rtw89: check path range before using in rtw89_fw_h2c_rf_ps_info() The variable 'path' from rtw89_phy_get_syn_sel() as index of array could be 3, but array size is 2. Fortunately, current chip->rf_path_num is smaller or equal to 2, so it is safe. To prevent mistakes in the future, add a checking and avoid Coverity warnings. Addresses-Coverity-ID: linux-next: 1644716 ("Out-of-bounds write") Addresses-Coverity-ID: linux-next: 1644717 ("Out-of-bounds write") Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250715035259.45061-6-pkshih@realtek.com commit f1000385d47be9e0a1d1d622a2e2e28ffd0fe384 Author: Ping-Ke Shih Date: Tue Jul 15 11:52:58 2025 +0800 wifi: rtw89: purge obsoleted scan events with software sequence number The queued and obsoleted scan events can be wrongly treated as events of new scan request, causing unexpected scan result. Attach a software sequence number to scan request and its corresponding events. When a new scan request is acknowledged by firmware, purge the scan events if its sequence number is not belong to current request. Normal case: mac80211 event work event BH ------------- ---------- -------- scan req #1 ---->o | <----o <...........................o o | <--------------------------+ ieee80211_scan_completed() Abnormal case (late event work): mac80211 event work event BH ------------- ---------- -------- scan req #1 ---->o | <----o <...........................o o #1 scan cancel #2 ->o | <----o <...........................o o #2 | (patch to avoid this) scan req #3 ---->o | | | <----o <..........|................o | o #3 <--------------------------+ ieee80211_scan_completed() Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250715035259.45061-5-pkshih@realtek.com commit b552a3ef8a3d722470593349333c9b19bfe40767 Author: Kuan-Chung Chen Date: Tue Jul 15 11:52:57 2025 +0800 wifi: rtw89: dynamically update EHT preamble puncturing When the 'Disabled Subchannel Bitmap' within the EHT Operation element is changed, mac80211 parse and pass it to the driver. The driver is then updated with this puncturing bitmap to optimize bandwidth usage and prevent interference from degrading performance across the entire channel. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250715035259.45061-4-pkshih@realtek.com commit 8552f2b3153eb8d49450f1661adf62457c410660 Author: Chia-Yuan Li Date: Tue Jul 15 11:52:56 2025 +0800 wifi: rtw89: mac: reduce PPDU status length for WiFi 6 chips Since the RX counter in the PPDU status is not used, it is disabled to reduce the waste of DLE quota. Signed-off-by: Chia-Yuan Li Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250715035259.45061-3-pkshih@realtek.com commit cbf510e21e0ce3d75b099528859526cc24ebf628 Author: Chia-Yuan Li Date: Tue Jul 15 11:52:55 2025 +0800 wifi: rtw89: trigger TX stuck if FIFO full In order for the situation where the dispatcher blocking causes HAXIDMA to be unable to TX to be reported as a TX stuck, so that subsequent recovery can be handled. Signed-off-by: Chia-Yuan Li Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250715035259.45061-2-pkshih@realtek.com commit 463d46044f04013306a4893242f65788b8a16b2e Author: Tze-nan Wu Date: Thu Jul 17 13:53:38 2025 +0800 rcu: Fix delayed execution of hurry callbacks We observed a regression in our customer’s environment after enabling CONFIG_LAZY_RCU. In the Android Update Engine scenario, where ioctl() is used heavily, we found that callbacks queued via call_rcu_hurry (such as percpu_ref_switch_to_atomic_rcu) can sometimes be delayed by up to 5 seconds before execution. This occurs because the new grace period does not start immediately after the previous one completes. The root cause is that the wake_nocb_gp_defer() function now checks "rdp->nocb_defer_wakeup" instead of "rdp_gp->nocb_defer_wakeup". On CPUs that are not rcuog, "rdp->nocb_defer_wakeup" may always be RCU_NOCB_WAKE_NOT. This can cause "rdp_gp->nocb_defer_wakeup" to be downgraded and the "rdp_gp->nocb_timer" to be postponed by up to 10 seconds, delaying the execution of hurry RCU callbacks. The trace log of one scenario we encountered is as follow: // previous GP ends at this point rcu_preempt [000] d..1. 137.240210: rcu_grace_period: rcu_preempt 8369 end rcu_preempt [000] ..... 137.240212: rcu_grace_period: rcu_preempt 8372 reqwait // call_rcu_hurry enqueues "percpu_ref_switch_to_atomic_rcu", the callback waited on by UpdateEngine update_engine [002] d..1. 137.301593: __call_rcu_common: wyy: unlikely p_ref = 00000000********. lazy = 0 // FirstQ on cpu 2 rdp_gp->nocb_timer is set to fire after 1 jiffy (4ms) // and the rdp_gp->nocb_defer_wakeup is set to RCU_NOCB_WAKE update_engine [002] d..2. 137.301595: rcu_nocb_wake: rcu_preempt 2 FirstQ on cpu2 with rdp_gp (cpu0). // FirstBQ event on cpu2 during the 1 jiffy, make the timer postpond 10 seconds later. // also, the rdp_gp->nocb_defer_wakeup is overwrite to RCU_NOCB_WAKE_LAZY update_engine [002] d..1. 137.301601: rcu_nocb_wake: rcu_preempt 2 WakeEmptyIsDeferred ... ... ... // before the 10 seconds timeout, cpu0 received another call_rcu_hurry // reset the timer to jiffies+1 and set the waketype = RCU_NOCB_WAKE. kworker/u32:0 [000] d..2. 142.557564: rcu_nocb_wake: rcu_preempt 0 FirstQ kworker/u32:0 [000] d..1. 142.557576: rcu_nocb_wake: rcu_preempt 0 WakeEmptyIsDeferred kworker/u32:0 [000] d..1. 142.558296: rcu_nocb_wake: rcu_preempt 0 WakeNot kworker/u32:0 [000] d..1. 142.558562: rcu_nocb_wake: rcu_preempt 0 WakeNot // idle(do_nocb_deferred_wakeup) wake rcuog due to waketype == RCU_NOCB_WAKE [000] d..1. 142.558786: rcu_nocb_wake: rcu_preempt 0 DoWake [000] dN.1. 142.558839: rcu_nocb_wake: rcu_preempt 0 DeferredWake rcuog/0 [000] ..... 142.558871: rcu_nocb_wake: rcu_preempt 0 EndSleep rcuog/0 [000] ..... 142.558877: rcu_nocb_wake: rcu_preempt 0 Check // finally rcuog request a new GP at this point (5 seconds after the FirstQ event) rcuog/0 [000] d..2. 142.558886: rcu_grace_period: rcu_preempt 8372 newreq rcu_preempt [001] d..1. 142.559458: rcu_grace_period: rcu_preempt 8373 start ... rcu_preempt [000] d..1. 142.564258: rcu_grace_period: rcu_preempt 8373 end rcuop/2 [000] D..1. 142.566337: rcu_batch_start: rcu_preempt CBs=219 bl=10 // the hurry CB is invoked at this point rcuop/2 [000] b.... 142.566352: blk_queue_usage_counter_release: wyy: wakeup. p_ref = 00000000********. This patch changes the condition to check "rdp_gp->nocb_defer_wakeup" in the lazy path. This prevents an already scheduled "rdp_gp->nocb_timer" from being postponed and avoids overwriting "rdp_gp->nocb_defer_wakeup" when it is not RCU_NOCB_WAKE_NOT. Fixes: 3cb278e73be5 ("rcu: Make call_rcu() lazy to save power") Co-developed-by: Cheng-jui Wang Signed-off-by: Cheng-jui Wang Co-developed-by: Lorry.Luo@mediatek.com Signed-off-by: Lorry.Luo@mediatek.com Tested-by: weiyangyang@vivo.com Signed-off-by: weiyangyang@vivo.com Signed-off-by: Tze-nan Wu Reviewed-by: Frederic Weisbecker Signed-off-by: Neeraj Upadhyay (AMD) commit 90f097b1403f232a202c501bfd49b1b196e840ea Author: Theodore Ts'o Date: Sat Jul 12 14:12:49 2025 -0400 ext4: refactor the inline directory conversion and new directory codepaths There was a lot of common code in the codepaths used to convert an inline directory and to creaet a new directory. To address this, rename ext4_init_dot_dotdot() to ext4_init_dirblock() and then move common code into that function. This reduces the lines of code count in fs/ext4/inline.c and fs/ext4/namei.c, as well as reducing the size of their object files. Signed-off-by: Theodore Ts'o Link: https://patch.msgid.link/20250712181249.434530-3-tytso@mit.edu Signed-off-by: Theodore Ts'o commit a35454ecf8a320c49954fdcdae0e8d3323067632 Author: Theodore Ts'o Date: Sat Jul 12 14:12:48 2025 -0400 ext4: use memcpy() instead of strcpy() The strcpy() function is considered dangerous and eeeevil by people who are using sophisticated code analysis tools such as "grep". This is true even when a quick inspection would show that the source is a constant string ("." or "..") and the destination is a fixed array which is guaranteed to have enough space. Make the "grep" code analysis tool happy by using memcpy() isstead of strcpy(). :-) Signed-off-by: Theodore Ts'o Link: https://patch.msgid.link/20250712181249.434530-2-tytso@mit.edu Signed-off-by: Theodore Ts'o commit 3658b8b3398eb2a49ee8d1ac88e5cdc41764f1c9 Author: Theodore Ts'o Date: Sat Jul 12 14:12:47 2025 -0400 ext4: replace strcmp with direct comparison for '.' and '..' In a discussion over a proposed patch, "ext4: replace strcpy() with '.' assignment"[1], I had asserted that directory entries in ext4 were not NUL terminated, and hence it was safe to replace strcpy() with a direct assignment. As it turns out, this was incorrect. It's true for all all directory entries *except* for '.' and '..' where the kernel was using strcmp() and where e2fsck actually checks and offers to fix things if '.' and '..' are not NUL terminated. [1] https://lore.kernel.org/r/202505191316.JJMnPobO-lkp@intel.com We can't change this without breaking old kernel versions, but in the spirit of "be liberal in what you receive", use direct comparison of de->name_len and de->name[0,1] instead of strcmp(). This has the side benefit of reducing the compiled text size by 96 bytes on x86_64. Signed-off-by: Theodore Ts'o Link: https://patch.msgid.link/20250712181249.434530-1-tytso@mit.edu Signed-off-by: Theodore Ts'o commit 91b8ca8b26729b729dda8a4eddb9aceaea706f37 Author: Jan Kara Date: Wed Jul 9 10:48:32 2025 +0200 ext4: Make sure BH_New bit is cleared in ->write_end handler Currently we clear BH_New bit in case of error and also in the standard ext4_write_end() handler (in block_commit_write()). However ext4_journalled_write_end() misses this clearing and thus we are leaving stale BH_New bits behind. Generally ext4_block_write_begin() clears these bits before any harm can be done but in case blocksize < pagesize and we hit some error when processing a page with these stale bits, we'll try to zero buffers with these stale BH_New bits and jbd2 will complain (as buffers were not prepared for writing in this transaction). Fix the problem by clearing BH_New bits in ext4_journalled_write_end() and WARN if ext4_block_write_begin() sees stale BH_New bits. Reported-by: Baolin Liu Reported-by: Zhi Long Fixes: 3910b513fcdf ("ext4: persist the new uptodate buffers in ext4_journalled_zero_new_buffers") Signed-off-by: Jan Kara Link: https://patch.msgid.link/20250709084831.23876-2-jack@suse.cz Signed-off-by: Theodore Ts'o commit c678bdc998754589cea2e6afab9401d7d8312ac4 Author: Baokun Li Date: Tue Jul 8 19:15:04 2025 +0800 ext4: fix inode use after free in ext4_end_io_rsv_work() In ext4_io_end_defer_completion(), check if io_end->list_vec is empty to avoid adding an io_end that requires no conversion to the i_rsv_conversion_list, which in turn prevents starting an unnecessary worker. An ext4_emergency_state() check is also added to avoid attempting to abort the journal in an emergency state. Additionally, ext4_put_io_end_defer() is refactored to call ext4_io_end_defer_completion() directly instead of being open-coded. This also prevents starting an unnecessary worker when EXT4_IO_END_FAILED is set but data_err=abort is not enabled. This ensures that the check in ext4_put_io_end_defer() is consistent with the check in ext4_end_bio(). Otherwise, we might add an io_end to the i_rsv_conversion_list and then call ext4_finish_bio(), after which the inode could be freed before ext4_end_io_rsv_work() is called, triggering a use-after-free issue. Fixes: ce51afb8cc5e ("ext4: abort journal on data writeback failure if in data_err=abort mode") Signed-off-by: Baokun Li Reviewed-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250708111504.3208660-1-libaokun@huaweicloud.com Signed-off-by: Theodore Ts'o commit 3796f2985c267b90052613cf0b379e51c61e9367 Author: Li Zhijian Date: Thu Jul 17 11:12:51 2025 +0800 cxl: Fix -Werror=return-type in cxl_decoder_detach() Fix following compiling errors: In file included from ../drivers/cxl/core/pmu.c:10: ../drivers/cxl/core/core.h: In function ‘cxl_decoder_detach’: ../drivers/cxl/core/core.h:65:1: error: no return statement in function returning non-void [-Werror=return-type] } ^ cc1: some warnings being treated as errors CC [M] drivers/nvdimm/claim.o make[6]: *** [../scripts/Makefile.build:287: drivers/cxl/core/pmu.o] Error 1 make[6]: *** Waiting for unfinished jobs.... CC [M] drivers/infiniband/core/verbs.o Fixes: b3a88225519c ("cxl/region: Consolidate cxl_decoder_kill_region() and cxl_region_detach()") Signed-off-by: Li Zhijian Link: https://patch.msgid.link/20250717031251.1043825-1-lizhijian@fujitsu.com Signed-off-by: Dave Jiang commit b2df55a98672f4be076ff69d0f0d0b1fc81f2044 Author: Dan Williams Date: Thu Jul 17 09:30:36 2025 -0700 cleanup: Fix documentation build error for ACQUIRE updates Stephen reports: Documentation/core-api/cleanup:7: include/linux/cleanup.h:73: ERROR: Unexpected indentation. [docutils] Documentation/core-api/cleanup:7: include/linux/cleanup.h:74: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils] Which points out that the ACQUIRE() example in cleanup.h missed the "::" suffix to mark the following text as a code-block. Fixes: 857d18f23ab1 ("cleanup: Introduce ACQUIRE() and ACQUIRE_ERR() for conditional locks") Reported-by: Stephen Rothwell Closes: http://lore.kernel.org/20250717173354.34375751@canb.auug.org.au Signed-off-by: Dan Williams Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://patch.msgid.link/20250717163036.1275791-1-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit d61f6cb6f6ef3c70d2ccc0d9c85c508cb8017da9 Author: Thomas Fourier Date: Wed Jul 16 11:47:30 2025 +0200 et131x: Add missing check after DMA map The DMA map functions can fail and should be tested for errors. If the mapping fails, unmap and return an error. Signed-off-by: Thomas Fourier Acked-by: Mark Einon Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250716094733.28734-2-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski commit 96a1e15e60216b52da0e6da5336b6d7f5b0188b0 Author: Thomas Fourier Date: Wed Jul 16 11:57:25 2025 +0200 net: ag71xx: Add missing check after DMA map The DMA map functions can fail and should be tested for errors. Signed-off-by: Thomas Fourier Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250716095733.37452-3-fourier.thomas@gmail.com Signed-off-by: Jakub Kicinski commit b6645645d0d0b6c5cb33cf58c9de5e74b6701326 Author: Tianyi Cui <1997cui@gmail.com> Date: Wed Jul 16 18:19:13 2025 -0700 selftests/drivers/net: Support ipv6 for napi_id test Add support for IPv6 environment for napi_id test. Test Plan: ./run_kselftest.sh -t drivers/net:napi_id.py TAP version 13 1..1 # timeout set to 45 # selftests: drivers/net: napi_id.py # TAP version 13 # 1..1 # ok 1 napi_id.test_napi_id # # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 ok 1 selftests: drivers/net: napi_id.py Signed-off-by: Tianyi Cui <1997cui@gmail.com> Link: https://patch.msgid.link/20250717011913.1248816-1-1997cui@gmail.com Signed-off-by: Jakub Kicinski commit efe28034ea27cd621e42c9be9a5af2c5ad0e2198 Author: Mingming Cao Date: Wed Jul 16 11:21:15 2025 -0400 ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting VNIC testing on multi-core Power systems showed SAR stats drift and packet rate inconsistencies under load. Implements ndo_get_stats64 to provide safe aggregation of queue-level atomic64 counters into rtnl_link_stats64 for use by tools like 'ip -s', 'ifconfig', and 'sar'. Switch to ndo_get_stats64 to align SAR reporting with the standard kernel interface for retrieving netdev stats. This removes redundant per-adapter stat updates, reduces overhead, eliminates cacheline bouncing from hot path updates, and improves the accuracy of reported packet rates. Signed-off-by: Mingming Cao Reviewed-by: Brian King Reviewed-by: Dave Marquardt Reviewed-by: Simon Horman ---- Changes since v3: link to v3: https://www.spinics.net/lists/netdev/msg1107999.html -- keep per queue counters as u64 (this patch) and drop off patch 1 in v3 Link: https://patch.msgid.link/20250716152115.61143-1-mmc@linux.ibm.com Signed-off-by: Jakub Kicinski commit 0dce68479305e0307c8b2766ee1271ea7c9aaca8 Merge: 2b0ba7b5b01045 2a601b2d356230 Author: Jakub Kicinski Date: Thu Jul 17 18:53:11 2025 -0700 Merge branch 'net-mlx5-misc-changes-2025-07-16' Tariq Toukan says: ==================== net/mlx5: misc changes 2025-07-16 This series contains misc enhancements to the mlx5 driver. v1: https://lore.kernel.org/1752471585-18053-1-git-send-email-tariqt@nvidia.com ==================== Link: https://patch.msgid.link/1752675472-201445-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 2a601b2d35623065d31ebaf697b07502d54878c9 Author: Leon Romanovsky Date: Wed Jul 16 17:17:49 2025 +0300 net/mlx5e: Properly access RCU protected qdisc_sleeping variable qdisc_sleeping variable is declared as "struct Qdisc __rcu" and as such needs proper annotation while accessing it. Without rtnl_dereference(), the following error is generated by sparse: drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: warning: incorrect type in initializer (different address spaces) drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: expected struct Qdisc *qdisc drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: got struct Qdisc [noderef] __rcu *qdisc_sleeping Signed-off-by: Leon Romanovsky Signed-off-by: Tariq Toukan Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/1752675472-201445-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 394d31d52fb64f622f51a461a4d7fc0c683a980f Author: Moshe Shemesh Date: Wed Jul 16 17:17:48 2025 +0300 net/mlx5e: fix kdoc warning on eswitch.h Fix the following kdoc warning: git ls-files *.[ch] | egrep drivers/net/ethernet/mellanox/mlx5/core/ |\ xargs scripts/kernel-doc --none drivers/net/ethernet/mellanox/mlx5/core/eswitch.h:824: warning: cannot understand function prototype: 'struct mlx5_esw_event_info ' Signed-off-by: Moshe Shemesh Signed-off-by: Tariq Toukan Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/1752675472-201445-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 159846ffbaf5e723b4eafdf6f951028cfda61601 Author: Lama Kayal Date: Wed Jul 16 17:17:47 2025 +0300 net/mlx5: HWS, Enable IPSec hardware offload in legacy mode IPSec hardware offload in legacy mode should not be affected by the steering mode, hence it should also work properly with hmfs mode. Remove steering mode validation when calculating the cap for packet offload, this will also enable the missing cap MLX5_IPSEC_CAP_PRIO needed for crypto offload. Signed-off-by: Lama Kayal Reviewed-by: Jianbo Liu Signed-off-by: Tariq Toukan Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/1752675472-201445-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 2b0ba7b5b010455c4e43ab557860f8b1089e7424 Author: Jack Ping CHNG Date: Wed Jul 16 11:03:49 2025 +0800 net: pcs: xpcs: mask readl() return value to 16 bits readl() returns 32-bit value but Clause 22/45 registers are 16-bit wide. Masking with 0xFFFF avoids using garbage upper bits. Signed-off-by: Jack Ping CHNG Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20250716030349.3796806-1-jchng@maxlinear.com Signed-off-by: Jakub Kicinski commit 49be1e245ea3e3515c5989ce1af215d8500dec85 Author: Dan Carpenter Date: Tue Jul 15 18:01:30 2025 -0500 net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() The __esw_qos_alloc_node() function returns NULL on error. It doesn't return error pointers. Update the error checking to match. Fixes: 96619c485fa6 ("net/mlx5: Add support for setting tc-bw on nodes") Signed-off-by: Dan Carpenter Reviewed-by: Tariq Toukan Link: https://patch.msgid.link/0ce4ec2a-2b5d-4652-9638-e715a99902a7@sabinyo.mountain Signed-off-by: Jakub Kicinski commit c2fe3b2a7c71adccff9d7f651004405fa413bf17 Author: Dan Carpenter Date: Tue Jul 15 18:01:19 2025 -0500 net: ethernet: mtk_wed: Fix NULL vs IS_ERR() bug in mtk_wed_get_memory_region() We recently changed this from using devm_ioremap() to using devm_ioremap_resource() and unfortunately the former returns NULL while the latter returns error pointers. The check for errors needs to be updated as well. Fixes: e27dba1951ce ("net: Use of_reserved_mem_region_to_resource{_byname}() for "memory-region"") Signed-off-by: Dan Carpenter Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/87c10dbd-df86-4971-b4f5-40ba02c076fb@sabinyo.mountain Signed-off-by: Jakub Kicinski commit 1e5e40f2558c07f6bc60a8983000309cc0a9d600 Author: Dan Carpenter Date: Tue Jul 15 18:01:10 2025 -0500 net: airoha: Fix a NULL vs IS_ERR() bug in airoha_npu_run_firmware() The devm_ioremap_resource() function returns error pointers. It never returns NULL. Update the check to match. Fixes: e27dba1951ce ("net: Use of_reserved_mem_region_to_resource{_byname}() for "memory-region"") Signed-off-by: Dan Carpenter Acked-by: Lorenzo Bianconi Link: https://patch.msgid.link/fc6d194e-6bf5-49ca-bc77-3fdfda62c434@sabinyo.mountain Signed-off-by: Jakub Kicinski commit 687678f1565fff2cb129d74f107dbacc0b0d39f9 Merge: a93f38ebff577a d98f43b84a1e0b Author: Jakub Kicinski Date: Thu Jul 17 18:35:52 2025 -0700 Merge branch 'add-shared-phy-counter-support-for-qca807x-and-qca808x' Luo Jie says: ==================== Add shared PHY counter support for QCA807x and QCA808x The implementation of the PHY counter is identical for both QCA808x and QCA807x series devices. This includes counters for both good and bad CRC frames in the RX and TX directions, which are active when CRC checking is enabled. This patch series introduces PHY counter functions into a shared library, enabling counter support for the QCA808x and QCA807x families through this common infrastructure. Additionally, enable CRC checking and configure automatic clearing of counters after reading within config_init() to ensure accurate counter recording. v2: https://lore.kernel.org/20250714-qcom_phy_counter-v2-0-94dde9d9769f@quicinc.com v1: https://lore.kernel.org/20250709-qcom_phy_counter-v1-0-93a54a029c46@quicinc.com ==================== Link: https://patch.msgid.link/20250715-qcom_phy_counter-v3-0-8b0e460a527b@quicinc.com Signed-off-by: Jakub Kicinski commit d98f43b84a1e0bedbe32bb0c758c1abd62579fbb Author: Luo Jie Date: Tue Jul 15 19:02:28 2025 +0800 net: phy: qcom: qca807x: Support PHY counter Within the QCA807X PHY operation's config_init() function, enable CRC checking for received and transmitted frames and configure counter to clear after being read to support counter recording. Additionally, add support for PHY counter operations. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250715-qcom_phy_counter-v3-3-8b0e460a527b@quicinc.com Signed-off-by: Jakub Kicinski commit 3370e33a1c23282ec399bda282347b115f35b8cb Author: Luo Jie Date: Tue Jul 15 19:02:27 2025 +0800 net: phy: qcom: qca808x: Support PHY counter Enable CRC checking for received and transmitted frames, and configure counters to clear after being read within config_init() for accurate counter recording. Additionally, add PHY counter operations and integrate shared functions. Signed-off-by: Luo Jie Link: https://patch.msgid.link/20250715-qcom_phy_counter-v3-2-8b0e460a527b@quicinc.com Signed-off-by: Jakub Kicinski commit 22bf4bd8ec4fc427cbd07af223a509b80913923a Author: Luo Jie Date: Tue Jul 15 19:02:26 2025 +0800 net: phy: qcom: Add PHY counter support Add PHY counter functionality to the shared library. The implementation is identical for the current QCA807X and QCA808X PHYs. The PHY counter can be configured to perform CRC checking for both received and transmitted packets. Additionally, the packet counter can be set to automatically clear after it is read. The PHY counter includes 32-bit packet counters for both RX (received) and TX (transmitted) packets, as well as 16-bit counters for recording CRC error packets for both RX and TX. Signed-off-by: Luo Jie Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250715-qcom_phy_counter-v3-1-8b0e460a527b@quicinc.com Signed-off-by: Jakub Kicinski commit a93f38ebff577a8f131c565ac0fa3d281084df3e Author: Dennis Chen Date: Wed Jul 16 12:57:50 2025 -0400 netdevsim: remove redundant branch bool notify is referenced nowhere else in the function except to check whether or not to call rtnl_offload_xstats_notify(). Remove it and move the call to the previous branch. Signed-off-by: Dennis Chen Reviewed-by: Simon Horman Reviewed-by: Petr Machata Link: https://patch.msgid.link/20250716165750.561175-1-dechen@redhat.com Signed-off-by: Jakub Kicinski commit ffe5aedc439cd59c0fb267c845a733fbb41532de Merge: 797f080c463d98 ef57dc6f52e494 Author: Jakub Kicinski Date: Thu Jul 17 18:07:37 2025 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Martin KaFai Lau says: ==================== pull-request: bpf-next 2025-07-17 We've added 13 non-merge commits during the last 20 day(s) which contain a total of 4 files changed, 712 insertions(+), 84 deletions(-). The main changes are: 1) Avoid skipping or repeating a sk when using a TCP bpf_iter, from Jordan Rife. 2) Clarify the driver requirement on using the XDP metadata, from Song Yoong Siang * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: doc: xdp: Clarify driver implementation for XDP Rx metadata selftests/bpf: Add tests for bucket resume logic in established sockets selftests/bpf: Create iter_tcp_destroy test program selftests/bpf: Create established sockets in socket iterator tests selftests/bpf: Make ehash buckets configurable in socket iterator tests selftests/bpf: Allow for iteration over multiple states selftests/bpf: Allow for iteration over multiple ports selftests/bpf: Add tests for bucket resume logic in listening sockets bpf: tcp: Avoid socket skips and repeats during iteration bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items bpf: tcp: Get rid of st_bucket_done bpf: tcp: Make sure iter->batch always contains a full bucket snapshot bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch ==================== Link: https://patch.msgid.link/20250717191731.4142326-1-martin.lau@linux.dev Signed-off-by: Jakub Kicinski commit 39f473f6d0b24cf375893f2110b1cc9d8a079a42 Author: Anubhav Shelat Date: Wed Jul 16 16:39:15 2025 -0400 perf sched timehist: decode process names of processes in zombie state Previously when running perf trace timehist --state, when recording processes in the zombie state the process name would not be decoded properly and appears with just the PID: 1140057.412177 [0006] Mutter Input Th[3139/3104] 0.956 0.019 0.041 S 1140057.412222 [0012] :1248612[1248612] 0.000 0.000 0.332 Z 1140057.412275 [0004] 0.052 0.052 0.953 I 1140057.412284 [0008] 0.070 0.070 0.932 I 1140057.412333 [0004] KMS thread[3126/3104] 0.953 0.112 0.058 S Now some extra processing has been added to decode the process name: 1140057.412177 [0006] Mutter Input Th[3139/3104] 0.956 0.019 0.041 S 1140057.412222 [0012] sleep[1248612] 0.000 0.000 0.332 Z 1140057.412275 [0004] 0.052 0.052 0.953 I 1140057.412284 [0008] 0.070 0.070 0.932 I 1140057.412333 [0004] KMS thread[3126/3104] 0.953 0.112 0.058 S Signed-off-by: Anubhav Shelat Link: https://lore.kernel.org/r/20250716203914.45772-2-ashelat@redhat.com Signed-off-by: Namhyung Kim commit 2d8ae9a4f1bc04a118e3d438ac50dd49281b34fd Author: Andy Shevchenko Date: Fri Jul 11 11:55:14 2025 +0300 string: Group str_has_prefix() and strstarts() The two str_has_prefix() and strstarts() are about the same with a slight difference on what they return. Group them in the header. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250711085514.1294428-1-andriy.shevchenko@linux.intel.com Signed-off-by: Kees Cook commit 7f71195c15dcf5f34c4c7f056603659374e3a525 Author: Dishank Jogi Date: Wed Jul 16 15:05:25 2025 +0530 fork: reorder function qualifiers for copy_clone_args_from_user Change the order of function qualifiers from 'noinline static' to 'static noinline' in copy_clone_args_from_user for consistency with kernel coding style. No functional change intended. The goal is to improve readability and maintain consistent ordering of qualifiers across the codebase. Signed-off-by: Dishank Jogi Reviewed-by: Liam R. Howlett Reviewed-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Link: https://lore.kernel.org/r/20250716093525.449994-1-dishank.jogi@siqol.com Signed-off-by: Kees Cook commit 8030790477e839b94a10032c490132e47926cb02 Author: Yin Fengwei Date: Thu Jul 17 19:01:08 2025 +0800 binfmt_elf: remove the 4k limitation of program header size We have assembly code generated by a script. GCC successfully compiles it. However, the kernel cannot load it on an ARM64 platform with a 4K page size. In contrast, the same ELF file loads correctly on the same platform with a 64K page size. The root cause is the Linux kernel's ELF_MIN_ALIGN limitation on the program headers of ELF files. The ELF file contains 78 program headers (the script inserts many holes when generating the assembly code). On ARM64 with a 4K page size, the ELF_MIN_ALLIGN enforces a maximum of 74 program headers, causing the ELF file to fail. However, with a 64K page size, the ELF_MIN_ALIGN is relaxed to over 1,184 program headers, allowing the file to run correctly. Cook kindly identified[1] that this limitation was introduced in Linux-0.99.15f without an explanation for its purpose. The ELF specification does not impose such a restriction on program headers. Removing the ELF_MIN_ALIGN limitation on program headers to align with the ELF spec. After removing ELF_MIN_ALIGN limitation, 64K size limitation still exist which should be sufficient. Suggested-by: Kees Cook Link: https://lore.kernel.org/linux-mm/202506270854.A729825@keescook/ [1] Signed-off-by: Yin Fengwei Link: https://lore.kernel.org/r/20250717110108.55586-1-fengwei_yin@linux.alibaba.com Signed-off-by: Kees Cook commit 797f080c463d9866ca8a4bcc8cf0f512dec634e6 Author: Jakub Kicinski Date: Wed Jul 16 13:57:12 2025 -0700 selftests: net: prevent Python from buffering the output Make sure Python doesn't buffer the output, otherwise for some tests we may see false positive timeouts in NIPA. NIPA thinks that a machine has hung if the test doesn't print anything for 3min. This is also nice to heave for running the tests manually, especially in vng. Reviewed-by: Petr Machata Link: https://patch.msgid.link/20250716205712.1787325-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 25bf7d7f458c0c685b2be62a5b16534b9d6bf806 Merge: 7f7f3e1bedf70b dc2a27e524ac13 Author: Jakub Kicinski Date: Thu Jul 17 16:25:23 2025 -0700 Merge branch 'neighbour-convert-rtm_getneigh-to-rcu-and-make-pneigh-rtnl-free' Kuniyuki Iwashima says: ==================== neighbour: Convert RTM_GETNEIGH to RCU and make pneigh RTNL-free. This is kind of v3 of the series below [0] but without NEIGHTBL patches. Patch 1 ~ 4 and 9 come from the series to convert RTM_GETNEIGH to RCU. Other patches clean up pneigh_lookup() and convert the pneigh code to RCU + private mutex so that we can easily remove RTNL from RTM_NEWNEIGH in the later series. [0]: https://lore.kernel.org/netdev/20250418012727.57033-1-kuniyu@amazon.com/ v2: https://lore.kernel.org/20250712203515.4099110-1-kuniyu@google.com v1: https://lore.kernel.org/20250711191007.3591938-1-kuniyu@google.com ==================== Link: https://patch.msgid.link/20250716221221.442239-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit dc2a27e524ac13e7a599bc693934ed81f868dc2d Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:20 2025 +0000 neighbour: Update pneigh_entry in pneigh_create(). neigh_add() updates pneigh_entry() found or created by pneigh_create(). This update is serialised by RTNL, but we will remove it. Let's move the update part to pneigh_create() and make it return errno instead of a pointer of pneigh_entry. Now, the pneigh code is RTNL free. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-16-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 13a936bb99fb6385dc8620d24d7111e514448371 Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:19 2025 +0000 neighbour: Protect tbl->phash_buckets[] with a dedicated mutex. tbl->phash_buckets[] is only modified in the slow path by pneigh_create() and pneigh_delete() under the table lock. Both of them are called under RTNL, so no extra lock is needed, but we will remove RTNL from the paths. pneigh_create() looks up a pneigh_entry, and this part can be lockless, but it would complicate the logic like 1. lookup 2. allocate pengih_entry for GFP_KERNEL 3. lookup again but under lock 4. if found, return it after freeing the allocated memory 5. else, return the new one Instead, let's add a per-table mutex and run lookup and allocation under it. Note that updating pneigh_entry part in neigh_add() is still protected by RTNL and will be moved to pneigh_create() in the next patch. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-15-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b8b7ed1ea83a9b2b6e697c10c4b24b9ea0003e19 Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:18 2025 +0000 neighbour: Drop read_lock_bh(&tbl->lock) in pneigh_lookup(). Now, all callers of pneigh_lookup() are under RCU, and the read lock there is no longer needed. Let's drop the lock, inline __pneigh_lookup_1() to pneigh_lookup(), and call it from pneigh_create(). The next patch will remove tbl->lock from pneigh_create(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-14-kuniyu@google.com Signed-off-by: Jakub Kicinski commit dd103c9a53752d3754a3182ec8dd97885680cfe2 Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:17 2025 +0000 neighbour: Remove __pneigh_lookup(). __pneigh_lookup() is the lockless version of pneigh_lookup(), but its only caller pndisc_is_router() holds the table lock and reads pneigh_netry.flags. This is because accessing pneigh_entry after pneigh_lookup() was illegal unless the caller holds RTNL or the table lock. Now, pneigh_entry is guaranteed to be alive during the RCU critical section. Let's call pneigh_lookup() and use READ_ONCE() for n->flags in pndisc_is_router() and remove __pneigh_lookup(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-13-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b9c89fa128fa41e56300434dfca1138459b29384 Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:16 2025 +0000 neighbour: Use rcu_dereference() in pneigh_get_{first,next}(). Now pneigh_entry is guaranteed to be alive during the RCU critical section even without holding tbl->lock. Let's use rcu_dereference() in pneigh_get_{first,next}(). Note that neigh_seq_start() still holds tbl->lock for the normal neighbour entry. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-12-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 32d5eaabf186112eb2023aacb860c47ff7e7fdbf Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:15 2025 +0000 neighbour: Drop read_lock_bh(&tbl->lock) in pneigh_dump_table(). Now pneigh_entry is guaranteed to be alive during the RCU critical section even without holding tbl->lock. Let's drop read_lock_bh(&tbl->lock) and use rcu_dereference() to iterate tbl->phash_buckets[] in pneigh_dump_table() Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-11-kuniyu@google.com Signed-off-by: Jakub Kicinski commit ed6e380d2d419a3e8ca73de7b4c7ccb522835f1e Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:14 2025 +0000 neighbour: Convert RTM_GETNEIGH to RCU. Only __dev_get_by_index() is the RTNL dependant in neigh_get(). Let's replace it with dev_get_by_index_rcu() and convert RTM_GETNEIGH to RCU. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-10-kuniyu@google.com Signed-off-by: Jakub Kicinski commit cc03492c7b92cb4414bd72a88f4d88ceb78362f9 Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:13 2025 +0000 neighbour: Annotate access to struct pneigh_entry.{flags,protocol}. We will convert pneigh readers to RCU, and its flags and protocol will be read locklessly. Let's annotate the access to the two fields. Note that all access to pn->permanent is under RTNL (neigh_add() and pneigh_ifdown_and_unlock()), so WRITE_ONCE() and READ_ONCE() are not needed. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-9-kuniyu@google.com Signed-off-by: Jakub Kicinski commit d539d8fbd8fcf64a1492c51f5ee99aaa8a8dc9ab Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:12 2025 +0000 neighbour: Free pneigh_entry after RCU grace period. We will convert RTM_GETNEIGH to RCU. neigh_get() looks up pneigh_entry by pneigh_lookup() and passes it to pneigh_fill_info(). Then, we must ensure that the entry is alive till pneigh_fill_info() completes, but read_lock_bh(&tbl->lock) in pneigh_lookup() does not guarantee that. Also, we will convert all readers of tbl->phash_buckets[] to RCU. Let's use call_rcu() to free pneigh_entry and update phash_buckets[] and ->next by rcu_assign_pointer(). pneigh_ifdown_and_unlock() uses list_head to avoid overwriting ->next and moving RCU iterators to another list. pndisc_destructor() (only IPv6 ndisc uses this) uses a mutex, so it is not delayed to call_rcu(), where we cannot sleep. This is fine because the mcast code works with RCU and ipv6_dev_mc_dec() frees mcast objects after RCU grace period. While at it, we change the return type of pneigh_ifdown_and_unlock() to void. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-8-kuniyu@google.com Signed-off-by: Jakub Kicinski commit d63382aea70aa4ecb516126e00930bc8ab5e55ef Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:11 2025 +0000 neighbour: Annotate neigh_table.phash_buckets and pneigh_entry.next with __rcu. The next patch will free pneigh_entry with call_rcu(). Then, we need to annotate neigh_table.phash_buckets[] and pneigh_entry.next with __rcu. To make the next patch cleaner, let's annotate the fields in advance. Currently, all accesses to the fields are under the neigh table lock, so rcu_dereference_protected() is used with 1 for now, but most of them (except in pneigh_delete() and pneigh_ifdown_and_unlock()) will be replaced with rcu_dereference() and rcu_dereference_check(). Note that pneigh_ifdown_and_unlock() changes pneigh_entry.next to a local list, which is illegal because the RCU iterator could be moved to another list. This part will be fixed in the next patch. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit e804bd83c1fd7e1f03899c948812ebc207ac5a7e Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:10 2025 +0000 neighbour: Split pneigh_lookup(). pneigh_lookup() has ASSERT_RTNL() in the middle of the function, which is confusing. When called with the last argument, creat, 0, pneigh_lookup() literally looks up a proxy neighbour entry. This is the case of the reader path as the fast path and RTM_GETNEIGH. pneigh_lookup(), however, creates a pneigh_entry when called with creat 1 from RTM_NEWNEIGH and SIOCSARP, which require RTNL. Let's split pneigh_lookup() into two functions. We will convert all the reader paths to RCU, and read_lock_bh(&tbl->lock) in the new pneigh_lookup() will be dropped. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 0e5ac19c78654abbf43dc4ffdae290c8cb81c59c Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:09 2025 +0000 neighbour: Move neigh_find_table() to neigh_get(). neigh_valid_get_req() calls neigh_find_table() to fetch neigh_tables[]. neigh_find_table() uses rcu_dereference_rtnl(), but RTNL actually does not protect it at all; neigh_table_clear() can be called without RTNL and only waits for RCU readers by synchronize_rcu(). Fortunately, there is no bug because IPv4 is built-in, IPv6 cannot be unloaded, and DECNET was removed. To fetch neigh_tables[] by rcu_dereference() later, let's move neigh_find_table() from neigh_valid_get_req() to neigh_get(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 3dfe0b57dcda070d9f1ed2bfb3a9bf0ec8632e08 Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:08 2025 +0000 neighbour: Allocate skb in neigh_get(). We will remove RTNL for neigh_get() and run it under RCU instead. neigh_get_reply() and pneigh_get_reply() allocate skb with GFP_KERNEL. Let's move the allocation before __dev_get_by_index() in neigh_get(). Now, neigh_get_reply() and pneigh_get_reply() are inlined and rtnl_unicast() is factorised. We will convert pneigh_lookup() to __pneigh_lookup() later. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit f5046fbc1b6d8c5168d47a617f368f9d4a025e34 Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:07 2025 +0000 neighbour: Move two validations from neigh_get() to neigh_valid_get_req(). We will remove RTNL for neigh_get() and run it under RCU instead. neigh_get() returns -EINVAL in the following cases: * NDA_DST is not specified * Both ndm->ndm_ifindex and NTF_PROXY are not specified These validations do not require RCU. Let's move them to neigh_valid_get_req(). While at it, the extack string for the first case is replaced with NL_SET_ERR_ATTR_MISS(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit caf0a753a8eb7ca2b035e199b71a3dabb853a18a Author: Kuniyuki Iwashima Date: Wed Jul 16 22:08:06 2025 +0000 neighbour: Make neigh_valid_get_req() return ndmsg. neigh_get() passes 4 local variable pointers to neigh_valid_get_req(). If it returns a pointer of struct ndmsg, we do not need to pass two of them. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250716221221.442239-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 7f7f3e1bedf70bfe611b72bf38ff037566ce560d Merge: 870bc1aaa0f95e 00e6c61c5a0a82 Author: Jakub Kicinski Date: Thu Jul 17 16:14:01 2025 -0700 Merge branch 'ethtool-rss-support-rss_set-via-netlink' Jakub Kicinski says: ==================== ethtool: rss: support RSS_SET via Netlink Support configuring RSS settings via Netlink. Creating and removing contexts remains for the following series. v2: https://lore.kernel.org/20250714222729.743282-1-kuba@kernel.org v1: https://lore.kernel.org/20250711015303.3688717-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250716000331.1378807-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 00e6c61c5a0a8277e0cb3e1ec9fdaf79a5928819 Author: Jakub Kicinski Date: Tue Jul 15 17:03:31 2025 -0700 selftests: drv-net: rss_api: test input-xfrm and hash fields Test configuring input-xfrm and hash fields with all the limitations. Tested on mlx5 (CX6): # ./ksft-net-drv/drivers/net/hw/rss_api.py TAP version 13 1..10 ok 1 rss_api.test_rxfh_nl_set_fail ok 2 rss_api.test_rxfh_nl_set_indir ok 3 rss_api.test_rxfh_nl_set_indir_ctx ok 4 rss_api.test_rxfh_indir_ntf ok 5 rss_api.test_rxfh_indir_ctx_ntf ok 6 rss_api.test_rxfh_nl_set_key ok 7 rss_api.test_rxfh_fields ok 8 rss_api.test_rxfh_fields_set ok 9 rss_api.test_rxfh_fields_set_xfrm ok 10 rss_api.test_rxfh_fields_ntf # Totals: pass:10 fail:0 xfail:0 xpass:0 skip:0 error:0 Link: https://patch.msgid.link/20250716000331.1378807-12-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2f70251112ec412b6edf9769b2f9dd572145f38b Author: Jakub Kicinski Date: Tue Jul 15 17:03:30 2025 -0700 ethtool: rss: support setting flow hashing fields Add support for ETHTOOL_SRXFH (setting hashing fields) in RSS_SET. The tricky part is dealing with symmetric hashing. In netlink user can change the hashing fields and symmetric hash in one request, in IOCTL the two used to be set via different uAPI requests. Since fields and hash function config are still separate driver callbacks - changes to the two are not atomic. Keep things simple and validate the settings against both pre- and post- change ones. Meaning that we will reject the config request if user tries to correct the flow fields and set input_xfrm in one request, or disables input_xfrm and makes flow fields non-symmetric. We can adjust it later if there's a real need. Starting simple feels right, and potentially partially applying the settings isn't nice, either. Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250716000331.1378807-11-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d3e2c7bab12409e87bd6b20505c19f5532a727db Author: Jakub Kicinski Date: Tue Jul 15 17:03:29 2025 -0700 ethtool: rss: support setting input-xfrm via Netlink Support configuring symmetric hashing via Netlink. We have the flow field config prepared as part of SET handling, so scan it for conflicts instead of querying the driver again. Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250716000331.1378807-10-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c1b27f0695d65e91878d6ae917c285d3163297e4 Author: Jakub Kicinski Date: Tue Jul 15 17:03:28 2025 -0700 netlink: specs: define input-xfrm enum in the spec Help YNL decode the values for input-xfrm by defining the possible values in the spec. Don't define "no change" as it's an IOCTL artifact with no use in Netlink. With this change on mlx5 input-xfrm gets decoded: # ynl --family ethtool --dump rss-get [{'header': {'dev-index': 2, 'dev-name': 'eth0'}, 'hfunc': 1, 'hkey': b'V\xa8\xf9\x9 ...', 'indir': [0, 1, ... ], 'input-xfrm': {'sym-or-xor'}, <<< 'flow-hash': {'ah4': {'ip-dst', 'ip-src'}, 'ah6': {'ip-dst', 'ip-src'}, 'esp4': {'ip-dst', 'ip-src'}, 'esp6': {'ip-dst', 'ip-src'}, 'ip4': {'ip-dst', 'ip-src'}, 'ip6': {'ip-dst', 'ip-src'}, 'tcp4': {'l4-b-0-1', 'ip-dst', 'l4-b-2-3', 'ip-src'}, 'tcp6': {'l4-b-0-1', 'ip-dst', 'l4-b-2-3', 'ip-src'}, 'udp4': {'l4-b-0-1', 'ip-dst', 'l4-b-2-3', 'ip-src'}, 'udp6': {'l4-b-0-1', 'ip-dst', 'l4-b-2-3', 'ip-src'}} }] Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250716000331.1378807-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 169b26207a46a558588c9558da7b375dfcd61513 Author: Jakub Kicinski Date: Tue Jul 15 17:03:27 2025 -0700 selftests: drv-net: rss_api: test setting hashing key via Netlink Test setting hashing key via Netlink. # ./tools/testing/selftests/drivers/net/hw/rss_api.py TAP version 13 1..7 ok 1 rss_api.test_rxfh_nl_set_fail ok 2 rss_api.test_rxfh_nl_set_indir ok 3 rss_api.test_rxfh_nl_set_indir_ctx ok 4 rss_api.test_rxfh_indir_ntf ok 5 rss_api.test_rxfh_indir_ctx_ntf ok 6 rss_api.test_rxfh_nl_set_key ok 7 rss_api.test_rxfh_fields # Totals: pass:7 fail:0 xfail:0 xpass:0 skip:0 error:0 Link: https://patch.msgid.link/20250716000331.1378807-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 51798c519a9178d179913ac1417ea3e1d27f5fce Author: Jakub Kicinski Date: Tue Jul 15 17:03:26 2025 -0700 ethtool: rss: support setting hkey via Netlink Support setting RSS hashing key via ethtool Netlink. Use the Netlink policy to make sure user doesn't pass an empty key, "resetting" the key is not a thing. Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250716000331.1378807-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 82ae67cbc423425ecc5836daa520442d4c8bdb33 Author: Jakub Kicinski Date: Tue Jul 15 17:03:25 2025 -0700 ethtool: rss: support setting hfunc via Netlink Support setting RSS hash function / algo via ethtool Netlink. Like IOCTL we don't validate that the function is within the range known to the kernel. The drivers do a pretty good job validating the inputs, and the IDs are technically "dynamically queried" rather than part of uAPI. Only change should be that in Netlink we don't support user explicitly passing ETH_RSS_HASH_NO_CHANGE (0), if no change is requested the attribute should be absent. The ETH_RSS_HASH_NO_CHANGE is retained in driver-facing API for consistency (not that I see a strong reason for it). Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250716000331.1378807-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6e7eb93a692c21d8d1496e31df8b0d5f77d98ea2 Author: Jakub Kicinski Date: Tue Jul 15 17:03:24 2025 -0700 selftests: drv-net: rss_api: test setting indirection table via Netlink Test setting indirection table via Netlink. # ./tools/testing/selftests/drivers/net/hw/rss_api.py TAP version 13 1..6 ok 1 rss_api.test_rxfh_nl_set_fail ok 2 rss_api.test_rxfh_nl_set_indir ok 3 rss_api.test_rxfh_nl_set_indir_ctx ok 4 rss_api.test_rxfh_indir_ntf ok 5 rss_api.test_rxfh_indir_ctx_ntf ok 6 rss_api.test_rxfh_fields # Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0 Reviewed-by: Edward Cree Link: https://patch.msgid.link/20250716000331.1378807-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c3e91403103974e8f40dc170f384c0b707fe93e4 Author: Jakub Kicinski Date: Tue Jul 15 17:03:23 2025 -0700 tools: ynl: support packing binary arrays of scalars We support decoding a binary type with a scalar subtype already, add support for sending such arrays to the kernel. While at it also support using "None" to indicate that the binary attribute should be empty. I couldn't decide whether empty binary should be [] or None, but there should be no harm in supporting both. Link: https://patch.msgid.link/20250716000331.1378807-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1560af51e1ea32f87b7be2c28bb623308b37acf3 Author: Jakub Kicinski Date: Tue Jul 15 17:03:22 2025 -0700 selftests: drv-net: rss_api: factor out checking min queue count Multiple tests check min queue count, create a helper. Link: https://patch.msgid.link/20250716000331.1378807-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c0ae03588bbb95378758fe80e7436a9b4cfc71f6 Author: Jakub Kicinski Date: Tue Jul 15 17:03:21 2025 -0700 ethtool: rss: initial RSS_SET (indirection table handling) Add initial support for RSS_SET, for now only operations on the indirection table are supported. Unlike the ioctl don't check if at least one parameter is being changed. This is how other ethtool-nl ops behave, so pick the ethtool-nl consistency vs copying ioctl behavior. There are two special cases here: 1) resetting the table to defaults; 2) support for tables of different size. For (1) I use an empty Netlink attribute (array of size 0). (2) may require some background. AFAICT a lot of modern devices allow allocating RSS tables of different sizes. mlx5 can upsize its tables, bnxt has some "table size calculation", and Intel folks asked about RSS table sizing in context of resource allocation in the past. The ethtool IOCTL API has a concept of table size, but right now the user is expected to provide a table exactly the size the device requests. Some drivers may change the table size at runtime (in response to queue count changes) but the user is not in control of this. What's not great is that all RSS contexts share the same table size. For example a device with 128 queues enabled, 16 RSS contexts 8 queues in each will likely have 256 entry tables for each of the 16 contexts, while 32 would be more than enough given each context only has 8 queues. To address this the Netlink API should avoid enforcing table size at the uAPI level, and should allow the user to express the min table size they expect. To fully solve (2) we will need more driver plumbing but at the uAPI level this patch allows the user to specify a table size smaller than what the device advertises. The device table size must be a multiple of the user requested table size. We then replicate the user-provided table to fill the full device size table. This addresses the "allow the user to express the min table size" objective, while not enforcing any fixed size. From Netlink perspective .get_rxfh_indir_size() is now de facto the "max" table size supported by the device. We may choose to support table replication in ethtool, too, when we actually plumb this thru the device APIs. Initially I was considering moving full pattern generation to the kernel (which queues to use, at which frequency and what min sequence length). I don't think this complexity would buy us much and most if not all devices have pow-2 table sizes, which simplifies the replication a lot. Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250716000331.1378807-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit dcaf9d315cb787204ff88ffae4534e5ecb49b0ec Author: Nicolas Frattaroli Date: Mon Jul 14 10:14:47 2025 +0200 docs: document linked lists Add example-driven documentation for the kernel's generic linked list data structure. This includes discussion of situations where linked lists are likely inappropriate, and references to further reading. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250714-linked-list-docs-v3-1-56c461580866@collabora.com Signed-off-by: Jonathan Corbet commit 39e39af70d066029c788800ee07e0491e07eb081 Author: Mauro Carvalho Chehab Date: Fri Jul 11 09:27:09 2025 +0200 scripts: kdoc: make it backward-compatible with Python 3.7 There was a change at kdoc that ended breaking compatibility with Python 3.7: str.removesuffix() was introduced on version 3.9. Restore backward compatibility. Reported-by: Akira Yokosawa Closes: https://lore.kernel.org/linux-doc/57be9f77-9a94-4cde-aacb-184cae111506@gmail.com/ Fixes: 27ad33b6b349 ("kernel-doc: Fix symbol matching for dropped suffixes") Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/d13058d285838ac2bc04c492e60531c013a8a919.1752218291.git.mchehab+huawei@kernel.org commit 7740f9dbe2a96f6e7eb138dbdcb414aa78e83c10 Author: Mauro Carvalho Chehab Date: Fri Jul 11 09:27:08 2025 +0200 docs: kernel-doc: emit warnings for ancient versions of Python Kernel-doc requires at least version 3.6 to run, as it uses f-string. Yet, Kernel build currently calls kernel-doc with -none on some places. Better not to bail out when older versions are found. Versions of Python prior to 3.7 do not guarantee to remember the insertion order of dicts; since kernel-doc depends on that guarantee, running with such older versions could result in output with reordered sections. Check Python version when called via command line. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/7d7fa3a3aa1fafa0cc9ea29c889de4c7d377dca6.1752218291.git.mchehab+huawei@kernel.org commit 2d48d3e483f5d71a9579b0f0468d27e34e1f2a4d Author: Costa Shulyupin Date: Sun Jun 8 13:55:30 2025 +0300 Documentation/rtla: Describe exit status Commit 18682166f61494072d58 ("rtla: Set distinctive exit value for failed tests") expands exit status making it useful. Add section 'EXIT STATUS' and required SPDX-License-Identifier to the documentation. Signed-off-by: Costa Shulyupin Acked-by: Steven Rostedt (Google) [jc: fixed sphinx error caused by missing blank line] Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250608105531.758809-2-costa.shul@redhat.com commit f44f9445eb2cb4240a931aba393420e367f1401e Author: Costa Shulyupin Date: Sun Jun 8 13:44:36 2025 +0300 Documentation/rtla: Add include common_appendix.rst Add include common_appendix.rst into Documentation/tools/rtla/rtla-timerlat-hist.rst - the only file of rtla-*.rst still without common_appendix.rst. Signed-off-by: Costa Shulyupin Acked-by: Steven Rostedt (Google) Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250608104437.753708-2-costa.shul@redhat.com commit 6642adf0c1fbe2977597ab277dfd507053a874ac Author: Mario Limonciello Date: Thu Jul 17 12:38:08 2025 -0500 ALSA: hda: Use pci_is_display() The inline pci_is_display() helper does the same thing. Use it. Suggested-by: Bjorn Helgaas Signed-off-by: Mario Limonciello Signed-off-by: Bjorn Helgaas Reviewed-by: Takashi Iwai Reviewed-by: Daniel Dadap Reviewed-by: Simona Vetter Link: https://patch.msgid.link/20250717173812.3633478-6-superm1@kernel.org commit 75952c497550fd34d60b4e45aee15249d91263fa Author: Mario Limonciello Date: Thu Jul 17 12:38:07 2025 -0500 iommu/vt-d: Use pci_is_display() The inline pci_is_display() helper does the same thing. Use it. Suggested-by: Bjorn Helgaas Signed-off-by: Mario Limonciello Signed-off-by: Bjorn Helgaas Reviewed-by: Lu Baolu Reviewed-by: Daniel Dadap Reviewed-by: Simona Vetter Link: https://patch.msgid.link/20250717173812.3633478-5-superm1@kernel.org commit b1060ea44a1f846203ca3ef90389cd0e4f46bc8b Author: Mario Limonciello Date: Thu Jul 17 12:38:06 2025 -0500 vga_switcheroo: Use pci_is_display() The inline pci_is_display() helper does the same thing. Use it. Suggested-by: Bjorn Helgaas Signed-off-by: Mario Limonciello Signed-off-by: Bjorn Helgaas Reviewed-by: Daniel Dadap Reviewed-by: Simona Vetter Link: https://patch.msgid.link/20250717173812.3633478-4-superm1@kernel.org commit a7feca7c88187b83f95dc18ad788015f1bff8939 Author: Mario Limonciello Date: Thu Jul 17 12:38:05 2025 -0500 vfio/pci: Use pci_is_display() The inline pci_is_display() helper does the same thing. Use it. Suggested-by: Bjorn Helgaas Signed-off-by: Mario Limonciello Signed-off-by: Bjorn Helgaas Reviewed-by: Daniel Dadap Reviewed-by: Simona Vetter Acked-by: Alex Williamson Link: https://patch.msgid.link/20250717173812.3633478-3-superm1@kernel.org commit 76720eed7d18baf51c0f31fe8a3784702f50e3fc Author: Mario Limonciello Date: Thu Jul 17 12:38:04 2025 -0500 PCI: Add pci_is_display() to check if device is a display controller Several places in the kernel do class shifting to match whether a PCI device is display class. Add pci_is_display() for those places to use. Signed-off-by: Mario Limonciello Signed-off-by: Bjorn Helgaas Reviewed-by: Daniel Dadap Reviewed-by: Simona Vetter Link: https://patch.msgid.link/20250717173812.3633478-2-superm1@kernel.org commit 2a1390c81305ba9d5311fe82adccd3a34603065a Author: Breno Leitao Date: Mon Jul 14 05:06:27 2025 -0700 docs: kernel: Clarify printk_ratelimit_burst reset behavior Add clarification that the printk_ratelimit_burst window resets after printk_ratelimit seconds have elapsed, allowing another burst of messages to be sent. This helps users understand that the rate limiting is not permanent but operates in periodic windows. Signed-off-by: Breno Leitao Reviewed-by: Paul E. McKenney Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250714-docs_ratelimit-v1-1-51a6d9071f1a@debian.org commit cf4fc66746e344181f41604066659073dbb8aaf0 Author: Joel Fernandes Date: Tue Jul 15 16:01:51 2025 -0400 smp: Document preemption and stop_machine() mutual exclusion Recently while revising RCU's cpu online checks, there was some discussion around how IPIs synchronize with hotplug. Add comments explaining how preemption disable creates mutual exclusion with CPU hotplug's stop_machine mechanism. The key insight is that stop_machine() atomically updates CPU masks and flushes IPIs with interrupts disabled, and cannot proceed while any CPU (including the IPI sender) has preemption disabled. [ Apply peterz feedback. ] Cc: Andrea Righi Cc: Paul E. McKenney Cc: Frederic Weisbecker Cc: Peter Zijlstra (Intel) Cc: rcu@vger.kernel.org Acked-by: Paul E. McKenney Co-developed-by: Frederic Weisbecker Signed-off-by: Joel Fernandes Signed-off-by: Paul E. McKenney commit fc6f89dc707838564abbb8e22dad8e4d75c7fa26 Author: Paul E. McKenney Date: Tue Jul 8 15:47:29 2025 -0700 stop_machine: Improve kernel-doc function-header comments Add more detail to the kernel-doc function-header comments for stop_machine(), stop_machine_cpuslocked(), and stop_core_cpuslocked(). Signed-off-by: Paul E. McKenney commit 870bc1aaa0f95e1827c1cc089e183e8749dca6da Author: Dragos Tatulea Date: Wed Jul 16 10:00:42 2025 +0300 net/mlx5e: TX, Fix dma unmapping for devmem tx net_iovs should have the dma address set to 0 so that netmem_dma_unmap_page_attrs() correctly skips the unmap. This was not done in mlx5 when support for devmem tx was added and resulted in the splat below when the platform iommu was enabled. This patch addresses the issue by using netmem_dma_unmap_addr_set() which handles the net_iov case when setting the dma address. A small refactoring of mlx5e_dma_push() was required to be able to use this API. The function was split in two versions and each version called accordingly. Note that netmem_dma_unmap_addr_set() introduces an additional if case. Splat: WARNING: CPU: 14 PID: 2587 at drivers/iommu/dma-iommu.c:1228 iommu_dma_unmap_page+0x7d/0x90 Modules linked in: [...] Unloaded tainted modules: i10nm_edac(E):1 fjes(E):1 CPU: 14 UID: 0 PID: 2587 Comm: ncdevmem Tainted: G S E 6.15.0+ #3 PREEMPT(voluntary) Tainted: [S]=CPU_OUT_OF_SPEC, [E]=UNSIGNED_MODULE Hardware name: HPE ProLiant DL380 Gen10 Plus/ProLiant DL380 Gen10 Plus, BIOS U46 06/01/2022 RIP: 0010:iommu_dma_unmap_page+0x7d/0x90 Code: [...] RSP: 0000:ff6b1e3ea0b2fc58 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ff46ef2d0a2340c8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffff8827a120 R10: 0000000000000000 R11: 0000000000000000 R12: 00000000d8000000 R13: 0000000000000008 R14: 0000000000000001 R15: 0000000000000000 FS: 00007feb69adf740(0000) GS:ff46ef2c779f1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007feb69cca000 CR3: 0000000154b97006 CR4: 0000000000773ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: dma_unmap_page_attrs+0x227/0x250 mlx5e_poll_tx_cq+0x163/0x510 [mlx5_core] mlx5e_napi_poll+0x94/0x720 [mlx5_core] __napi_poll+0x28/0x1f0 net_rx_action+0x33a/0x420 ? mlx5e_completion_event+0x3d/0x40 [mlx5_core] handle_softirqs+0xe8/0x2f0 __irq_exit_rcu+0xcd/0xf0 common_interrupt+0x47/0xa0 asm_common_interrupt+0x26/0x40 RIP: 0033:0x7feb69cd08ec Code: [...] RSP: 002b:00007ffc01b8c880 EFLAGS: 00000246 RAX: 00000000c3a60cf7 RBX: 0000000000045e12 RCX: 000000000000000e RDX: 00000000000035b4 RSI: 0000000000000000 RDI: 00007ffc01b8c8c0 RBP: 00007ffc01b8c8b0 R08: 0000000000000000 R09: 0000000000000064 R10: 00007ffc01b8c8c0 R11: 0000000000000000 R12: 00007feb69cca000 R13: 00007ffc01b90e48 R14: 0000000000427e18 R15: 00007feb69d07000 Cc: Mina Almasry Reported-by: Stanislav Fomichev Closes: https://lore.kernel.org/all/aFM6r9kFHeTdj-25@mini-arch/ Fixes: 5a842c288cfa ("net/mlx5e: Add TX support for netmems") Signed-off-by: Dragos Tatulea Reviewed-by: Carolina Jubran Signed-off-by: Tariq Toukan Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/1752649242-147678-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit f633c1a236df95ab927f1919b3be2619c8cc6733 Author: Darshan Rathod Date: Wed Jul 16 12:42:16 2025 +0000 PM: hibernate: Fix up white space that does not follow coding style Fix up white space usage that does not follow the kernel coding style rules in several places in snapshot.c. Signed-off-by: Darshan Rathod Link: https://patch.msgid.link/20250716124216.64329-1-darshanrathod475@gmail.com [ rjw: New subject and changelog ] Signed-off-by: Rafael J. Wysocki commit ae96bba1ca0000ebb3f3ced64c9367e2a223d69e Author: Christian Loehle Date: Tue Jul 8 17:12:51 2025 +0100 sched_ext: Fix scx_bpf_reenqueue_local() reference The comment mentions bpf_scx_reenqueue_local(), but the function is provided for the BPF program implementing scx, as such the naming convention is scx_bpf_reenqueue_local(), fix the comment. Signed-off-by: Christian Loehle Signed-off-by: Tejun Heo commit df316ab3d4440177e322a2847969d356c29b0eef Author: Uros Bizjak Date: Wed Jul 9 15:19:03 2025 +0200 workqueue: Use atomic_try_cmpxchg_relaxed() in tryinc_node_nr_active() Use try_cmpxchg() family of locking primitives instead of cmpxchg(*ptr, old, new) == old. The x86 CMPXCHG instruction returns success in the ZF flag, so this change saves a compare after CMPXCHG (and related move instruction in front of CMPXCHG). Also, try_cmpxchg() implicitly assigns old *ptr value to "old" when CMPXCHG fails. There is no need to re-read the value in the loop. The generated assembly improves from: 3f7: 44 8b 0a mov (%rdx),%r9d 3fa: eb 12 jmp 40e <...> 3fc: 8d 79 01 lea 0x1(%rcx),%edi 3ff: 89 c8 mov %ecx,%eax 401: f0 0f b1 7a 04 lock cmpxchg %edi,0x4(%rdx) 406: 39 c1 cmp %eax,%ecx 408: 0f 84 83 00 00 00 je 491 <...> 40e: 8b 4a 04 mov 0x4(%rdx),%ecx 411: 41 39 c9 cmp %ecx,%r9d 414: 7f e6 jg 3fc <...> to: 256b: 45 8b 08 mov (%r8),%r9d 256e: 41 8b 40 04 mov 0x4(%r8),%eax 2572: 41 39 c1 cmp %eax,%r9d 2575: 7e 10 jle 2587 <...> 2577: 8d 78 01 lea 0x1(%rax),%edi 257a: f0 41 0f b1 78 04 lock cmpxchg %edi,0x4(%r8) 2580: 75 f0 jne 2572 <...> No functional change intended. Signed-off-by: Uros Bizjak Cc: Tejun Heo Cc: Lai Jiangshan Signed-off-by: Tejun Heo commit 954bacce36d976fe472090b55987df66da00c49b Author: Shashank Balaji Date: Fri Jul 4 20:08:41 2025 +0900 selftests/cgroup: fix cpu.max tests Current cpu.max tests (both the normal one and the nested one) are broken. They setup cpu.max with 1000 us quota and the default period (100,000 us). A cpu hog is run for a duration of 1s as per wall clock time. This corresponds to 10 periods, hence an expected usage of 10,000 us. We want the measured usage (as per cpu.stat) to be close to 10,000 us. Previously, this approximate equality test was done by `!values_close(usage_usec, expected_usage_usec, 95)`: if the absolute difference between usage_usec and expected_usage_usec is greater than 95% of their sum, then we pass. And expected_usage_usec was set to 1,000,000 us. Mathematically, this translates to the following being true for pass: |usage - expected_usage| > (usage + expected_usage)*0.95 If usage > expected_usage: usage - expected_usage > (usage + expected_usage)*0.95 0.05*usage > 1.95*expected_usage usage > 39*expected_usage = 39s If usage < expected_usage: expected_usage - usage > (usage + expected_usage)*0.95 0.05*expected_usage > 1.95*usage usage < 0.0256*expected_usage = 25,600 us Combined, Pass if usage < 25,600 us or > 39 s, which makes no sense given that all we need is for usage_usec to be close to 10,000 us. Fix this by explicitly calcuating the expected usage duration based on the configured quota, default period, and the duration, and compare usage_usec and expected_usage_usec using values_close() with a 10% error margin. Also, use snprintf to get the quota string to write to cpu.max instead of hardcoding the quota, ensuring a single source of truth. Remove the check comparing user_usec and expected_usage_usec, since on running this test modified with printfs, it's seen that user_usec and usage_usec can regularly exceed the theoretical expected_usage_usec: $ sudo ./test_cpu user: 10485, usage: 10485, expected: 10000 ok 1 test_cpucg_max user: 11127, usage: 11127, expected: 10000 ok 2 test_cpucg_max_nested $ sudo ./test_cpu user: 10286, usage: 10286, expected: 10000 ok 1 test_cpucg_max user: 10404, usage: 11271, expected: 10000 ok 2 test_cpucg_max_nested Hence, a values_close() check of usage_usec and expected_usage_usec is sufficient. Fixes: a79906570f9646ae17 ("cgroup: Add test_cpucg_max_nested() testcase") Fixes: 889ab8113ef1386c57 ("cgroup: Add test_cpucg_max() testcase") Acked-by: Michal Koutný Signed-off-by: Shashank Balaji Signed-off-by: Tejun Heo commit 4f95b5bad62c95e840b41ba78ec1f382f2f8c381 Merge: 84bb8c1897ad65 0ae204405095ab Author: Rafael J. Wysocki Date: Thu Jul 17 20:02:51 2025 +0200 Merge back earlier cpufreq material for 6.17-rc1 commit 84bb8c1897ad6592b4c5f6f29c02d50c127c0114 Merge: 347e9f5043c896 efbc5b4ac98e18 Author: Rafael J. Wysocki Date: Thu Jul 17 20:02:14 2025 +0200 Merge tag 'amd-pstate-v6.17-2025-07-16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux Merge amd-pstate 6.17 content from Mario Limonciello: "Documentation update" * tag 'amd-pstate-v6.17-2025-07-16' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/superm1/linux: Documentation: amd-pstate:fix minimum performance state label error commit af2d6148d2a159e1a0862bce5a2c88c1618a2b27 Merge: a96cee9b369ee4 6832a9317eee28 Author: Jakub Kicinski Date: Thu Jul 17 10:56:56 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.16-rc7). Conflicts: Documentation/netlink/specs/ovpn.yaml 880d43ca9aa4 ("netlink: specs: clean up spaces in brackets") af52020fc599 ("ovpn: reject unexpected netlink attributes") drivers/net/phy/phy_device.c a44312d58e78 ("net: phy: Don't register LEDs for genphy") f0f2b992d818 ("net: phy: Don't register LEDs for genphy") https://lore.kernel.org/20250710114926.7ec3a64f@kernel.org drivers/net/wireless/intel/iwlwifi/fw/regulatory.c drivers/net/wireless/intel/iwlwifi/mld/regulatory.c 5fde0fcbd760 ("wifi: iwlwifi: mask reserved bits in chan_state_active_bitmap") ea045a0de3b9 ("wifi: iwlwifi: add support for accepting raw DSM tables by firmware") net/ipv6/mcast.c ae3264a25a46 ("ipv6: mcast: Delay put pmc->idev in mld_del_delrec()") a8594c956cc9 ("ipv6: mcast: Avoid a duplicate pointer check in mld_del_delrec()") https://lore.kernel.org/8cc52891-3653-4b03-a45e-05464fe495cf@kernel.org No adjacent changes. Signed-off-by: Jakub Kicinski commit dbd4bccd96626563d1d811bc121484cd45f964a1 Author: Rafael J. Wysocki Date: Wed Jul 16 21:31:23 2025 +0200 PM: sleep: Rearrange suspend/resume error handling in the core Notice that device_suspend_noirq(), device_suspend_late() and device_suspend() all set async_error on errors, so they don't really need to return a value. Accordingly, make them all void and use async_error in their callers instead of their return values. Moreover, since async_error is updated concurrently without locking during asynchronous suspend and resume processing, use READ_ONCE() and WRITE_ONCE() for accessing it in those places to ensure that all of the accesses will be carried out as expected. Signed-off-by: Rafael J. Wysocki Reviewed-by: Saravana Kannan Link: https://patch.msgid.link/6198088.lOV4Wx5bFT@rjwysocki.net commit 7c1f7c22e69fae209eaad58de2627b8b5acb3cb3 Merge: ebd6884167eac9 2096d42d82dc98 Author: Rafael J. Wysocki Date: Thu Jul 17 19:55:25 2025 +0200 Merge back earlier material related to system sleep commit dfe25fbaedfc2a07281ed5ff0442270217d25b31 Author: Shakeel Butt Date: Fri Jul 4 11:08:04 2025 -0700 cgroup: llist: avoid memory tears for llist_node Before the commit 36df6e3dbd7e ("cgroup: make css_rstat_updated nmi safe"), the struct llist_node is expected to be private to the one inserting the node to the lockless list or the one removing the node from the lockless list. After the mentioned commit, the llist_node in the rstat code is per-cpu shared between the stacked contexts i.e. process, softirq, hardirq & nmi. It is possible the compiler may tear the loads or stores of llist_node. Let's avoid that. KCSAN reported the following race: Reported by Kernel Concurrency Sanitizer on: CPU: 60 UID: 0 PID: 5425 ... 6.16.0-rc3-next-20250626 #1 NONE Tainted: [E]=UNSIGNED_MODULE Hardware name: ... ================================================================== ================================================================== BUG: KCSAN: data-race in css_rstat_flush / css_rstat_updated write to 0xffffe8fffe1c85f0 of 8 bytes by task 1061 on cpu 1: css_rstat_flush+0x1b8/0xeb0 __mem_cgroup_flush_stats+0x184/0x190 flush_memcg_stats_dwork+0x22/0x50 process_one_work+0x335/0x630 worker_thread+0x5f1/0x8a0 kthread+0x197/0x340 ret_from_fork+0xd3/0x110 ret_from_fork_asm+0x11/0x20 read to 0xffffe8fffe1c85f0 of 8 bytes by task 3551 on cpu 15: css_rstat_updated+0x81/0x180 mod_memcg_lruvec_state+0x113/0x2d0 __mod_lruvec_state+0x3d/0x50 lru_add+0x21e/0x3f0 folio_batch_move_lru+0x80/0x1b0 __folio_batch_add_and_move+0xd7/0x160 folio_add_lru_vma+0x42/0x50 do_anonymous_page+0x892/0xe90 __handle_mm_fault+0xfaa/0x1520 handle_mm_fault+0xdc/0x350 do_user_addr_fault+0x1dc/0x650 exc_page_fault+0x5c/0x110 asm_exc_page_fault+0x22/0x30 value changed: 0xffffe8fffe18e0d0 -> 0xffffe8fffe1c85f0 $ ./scripts/faddr2line vmlinux css_rstat_flush+0x1b8/0xeb0 css_rstat_flush+0x1b8/0xeb0: init_llist_node at include/linux/llist.h:86 (inlined by) llist_del_first_init at include/linux/llist.h:308 (inlined by) css_process_update_tree at kernel/cgroup/rstat.c:148 (inlined by) css_rstat_updated_list at kernel/cgroup/rstat.c:258 (inlined by) css_rstat_flush at kernel/cgroup/rstat.c:389 $ ./scripts/faddr2line vmlinux css_rstat_updated+0x81/0x180 css_rstat_updated+0x81/0x180: css_rstat_updated at kernel/cgroup/rstat.c:90 (discriminator 1) These are expected race and a simple READ_ONCE/WRITE_ONCE resolves these reports. However let's add comments to explain the race and the need for memory barriers if stronger guarantees are needed. More specifically the rstat updater and the flusher can race and cause a scenario where the stats updater skips adding the css to the lockless list but the flusher might not see those updates done by the skipped updater. This is benign race and the subsequent flusher will flush those stats and at the moment there aren't any rstat users which are not fine with this kind of race. However some future user might want more stricter guarantee, so let's add appropriate comments to ease the job of future users. Signed-off-by: Shakeel Butt Reviewed-by: Paul E. McKenney Fixes: 36df6e3dbd7e ("cgroup: make css_rstat_updated nmi safe") Signed-off-by: Tejun Heo commit 6ac55eab4fc41e0ea80f9064945e4340f13d8b5c Author: Alex Deucher Date: Tue Jul 15 11:55:05 2025 -0400 drm/amdgpu: move reset support type checks into the caller Rather than checking in the callbacks, check if the reset type is supported in the caller. Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit ea2791d05a2e8bd483df48f548e0293edc3bcc0f Author: Alex Deucher Date: Thu May 29 13:12:35 2025 -0400 drm/amdgpu/sdma7: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 9753078f5492a4d3667f4832f105f65ae8a633cc Author: Alex Deucher Date: Thu May 29 13:11:54 2025 -0400 drm/amdgpu/sdma6: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1b49bddc5881f2dbf0ed8c53416620d60b59e8f3 Author: Alex Deucher Date: Thu Jun 26 09:53:18 2025 -0400 drm/amdgpu/sdma5.2: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 4b1df3bad2e283dc299ac38fb94c379b35173a86 Author: Alex Deucher Date: Thu Jun 26 09:52:55 2025 -0400 drm/amdgpu/sdma5: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 4da11b92d7ed4ce3be5d92feface8f3c2d5424bd Author: Alex Deucher Date: Tue May 27 22:29:31 2025 -0400 drm/amdgpu/gfx12: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Drop the soft_recovery callbacks as the queue reset replaces it. Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit fa3385ac15fe5350867ad3c59a1ad0fb5f8e8fc1 Author: Alex Deucher Date: Tue May 27 22:05:13 2025 -0400 drm/amdgpu/gfx11: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Drop the soft_recovery callbacks as the queue reset replaces it. Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit f410731d5cdd14efdfa055bf12d50b8367915b0f Author: Alex Deucher Date: Fri May 23 00:33:04 2025 -0400 drm/amdgpu/gfx10: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Drop the soft_recovery callbacks as the queue reset replaces it. Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit e22631b53aec436199e666967952d49dc3e82c55 Author: Alex Deucher Date: Tue May 27 23:23:53 2025 -0400 drm/amdgpu/gfx9.4.3: re-emit unprocessed state on kcq reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit ee60209b6ff62fcde05856d771544f14fcf1ec50 Author: Alex Deucher Date: Tue May 27 23:19:29 2025 -0400 drm/amdgpu/gfx9: re-emit unprocessed state on kcq reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 81df6bfad6a479530cef4b8ecbf848132d0fc0ab Author: Arunpravin Paneer Selvam Date: Wed Jul 16 13:21:23 2025 +0530 drm/amdgpu: Add WARN_ON to the resource clear function Set the dirty bit when the memory resource is not cleared during BO release. v2(Christian): - Drop the cleared flag set to false. - Improve the amdgpu_vram_mgr_set_clear_state() function. v3: - Add back the resource clear flag set function call after being cleared during eviction (Christian). - Modified the patch subject name. Signed-off-by: Arunpravin Paneer Selvam Suggested-by: Christian König Reviewed-by: Christian König Signed-off-by: Alex Deucher commit e678e75d68ca28fbc03d22f078e641f123698779 Author: Lijo Lazar Date: Fri Jul 11 12:09:06 2025 +0530 drm/amd/pm: Use cached metrics data on SMUv13.0.6 Cached metrics data validity is 1ms on SMUv13.0.6 SOCs. It's not reasonable for any client to query gpu_metrics at a faster rate and constantly interrupt PMFW. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 8825dabaf67bb1517d939f28b6ba6fcf86d7f259 Author: Lijo Lazar Date: Fri Jul 11 21:48:33 2025 +0530 drm/amd/pm: Use cached data for min/max clocks If dpm tables are already populated on SMU v13.0.6 SOCs, use the cached data. Otherwise, fetch values from firmware. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 5b2c214a95942f7997d1916a4c44017becbc3cac Author: Keith Busch Date: Tue Jul 15 12:16:27 2025 -0700 nvme-pci: try function level reset on init failure NVMe devices from multiple vendors appear to get stuck in a reset state that we can't get out of with an NVMe level Controller Reset. The kernel would report these with messages that look like: Device not ready; aborting reset, CSTS=0x1 These have historically required a power cycle to make them usable again, but in many cases, a PCIe FLR is sufficient to restart operation without a power cycle. Try it if the initial controller reset fails during any nvme reset attempt. Signed-off-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Reviewed-by: Nitesh Shetty Signed-off-by: Christoph Hellwig commit b42497e3c0e74db061eafad41c0cd7243c46436b Author: Jason Gunthorpe Date: Thu Jul 17 11:46:55 2025 -0300 iommufd: Prevent ALIGN() overflow When allocating IOVA the candidate range gets aligned to the target alignment. If the range is close to ULONG_MAX then the ALIGN() can wrap resulting in a corrupted iova. Open code the ALIGN() using get_add_overflow() to prevent this. This simplifies the checks as we don't need to check for length earlier either. Consolidate the two copies of this code under a single helper. This bug would allow userspace to create a mapping that overlaps with some other mapping or a reserved range. Cc: stable@vger.kernel.org Fixes: 51fe6141f0f6 ("iommufd: Data structure to provide IOVA to PFN mapping") Reported-by: syzbot+c2f65e2801743ca64e08@syzkaller.appspotmail.com Closes: https://lore.kernel.org/r/685af644.a00a0220.2e5631.0094.GAE@google.com Reviewed-by: Yi Liu Reviewed-by: Nicolin Chen Link: https://patch.msgid.link/all/1-v1-7b4a16fc390b+10f4-iommufd_alloc_overflow_jgg@nvidia.com/ Signed-off-by: Jason Gunthorpe commit 9d9076238fe9fe45257f298bf51b35aa796cf0f1 Author: I Hsin Cheng Date: Tue Jul 8 10:00:13 2025 +0800 ext4: Refactor breaking condition for xattr_find_entry() Refactor the condition for breaking the loop within xattr_find_entry(). Elimate the usage of "<=" and take condition shortcut when "!cmp" is true. Originally, the condition was "(cmp <= 0 && (sorted || cmp == 0))", which means after it knows "cmp <= 0" is true, it has to check the value of "sorted" and "cmp". The checking of "cmp" here would be redundant since it has already checked it. Observing from the logic, when "cmp == 0" the branch is going to be true, no need to check "cmp == 0" again, so we only need to take shortcut when "cmp == 0", on the other hand, we'll check "sorted" when "cmp < 0". The refactor can shrink the generated code size by 44 bytes. Numerous instructions can be saved thus should also benefit execution efficiency as well. $ ./scripts/bloat-o-meter vmlinux_old vmlinux_new add/remove: 0/0 grow/shrink: 0/1 up/down: 0/-44 (-44) Function old new delta xattr_find_entry 300 256 -44 Total: Before=22989434, After=22989390, chg -0.00% The test is done on kernel version 6.16 with x86_64 defconfig and gcc 13.3.0. Signed-off-by: I Hsin Cheng Link: https://patch.msgid.link/20250708020013.175728-1-richard120310@gmail.com Signed-off-by: Theodore Ts'o commit 828e50188de5fe898293dfb6e151f88b3d942407 Author: Rob Herring (Arm) Date: Tue Jul 1 16:00:45 2025 -0500 dt-bindings: trivial-devices: Add undocumented hwmon devices There's a bunch of undocumented, but already in use trivial hwmon devices. Most are just variants of existing trivial devices. Acked-by: Guenter Roeck Link: https://lore.kernel.org/r/20250701-dt-hwmon-compatibles-v1-6-ad99e65cf11b@kernel.org Signed-off-by: Rob Herring (Arm) commit a96cee9b369ee47b5309311d0d71cb6663b123fc Merge: e0c7e3154e042e d4f6460a4bc5fa Author: Paolo Abeni Date: Thu Jul 17 15:36:23 2025 +0200 Merge branch 'ppp-replace-per-cpu-recursion-counter-with-lock-owner-field' Sebastian Andrzej Siewior says: ==================== ppp: Replace per-CPU recursion counter with lock-owner field This is another approach to avoid relying on local_bh_disable() for locking of per-CPU in ppp. I redid it with the per-CPU lock and local_lock_nested_bh() as discussed in v1. The xmit_recursion counter has been removed since it served the same purpose as the owner field. Both were updated and checked. The xmit_recursion looks like a counter in ppp_channel_push() but at this point, the counter should always be 0 so it always serves as a boolean. Therefore I removed it. I do admit that this looks easier to review. v2 https://lore.kernel.org/all/20250710162403.402739-1-bigeasy@linutronix.de/ v1 https://lore.kernel.org/all/20250627105013.Qtv54bEk@linutronix.de/ ==================== Link: https://patch.msgid.link/20250715150806.700536-1-bigeasy@linutronix.de Signed-off-by: Paolo Abeni commit d4f6460a4bc5fa52c04a985b222a719a42c78be6 Author: Sebastian Andrzej Siewior Date: Tue Jul 15 17:08:06 2025 +0200 ppp: Replace per-CPU recursion counter with lock-owner field The per-CPU variable ppp::xmit_recursion is protecting against recursion due to wrong configuration of the ppp unit. The per-CPU variable relies on disabled BH for its locking. Without per-CPU locking in local_bh_disable() on PREEMPT_RT this data structure requires explicit locking. The ppp::xmit_recursion is used as a per-CPU boolean. The counter is checked early in the send routing and the transmit path is only entered if the counter is zero. Then the counter is incremented to avoid recursion. It used to detect recursion on channel::downl and ppp::wlock. Create a struct ppp_xmit_recursion and move the counter into it. Add local_lock_t to the struct and use local_lock_nested_bh() for locking. Due to possible nesting, the lock cannot be acquired unconditionally but it requires an owner field to identify recursion before attempting to acquire the lock. The counter is incremented and checked only after the lock is acquired. Since it functions as a boolean rather than a count, and its role is now superseded by the owner field, it can be safely removed. Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20250715150806.700536-2-bigeasy@linutronix.de Reviewed-by: Guillaume Nault Signed-off-by: Paolo Abeni commit e0c7e3154e042e2210b3a0b37e9129b52f3ae91c Merge: 44eb62e1ea19d6 904c99ea36bb7d Author: Paolo Abeni Date: Thu Jul 17 15:31:56 2025 +0200 Merge branch 'dpll-zl3073x-add-misc-features' Ivan Vecera says: ==================== dpll: zl3073x: Add misc features Add several new features missing in initial submission: * Embedded sync for both pin types * Phase offset reporting for connected input pin * Selectable phase offset monitoring (aka all inputs phase monitor) * Phase adjustments for both pin types * Fractional frequency offset reporting for input pins Everything was tested on Microchip EVB-LAN9668 EDS2 development board. ==================== Link: https://patch.msgid.link/20250715144633.149156-1-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 904c99ea36bb7d0333b4e0cc5e9e835c51e99316 Author: Ivan Vecera Date: Tue Jul 15 16:46:33 2025 +0200 dpll: zl3073x: Add support to get fractional frequency offset Adds support to get fractional frequency offset for input pins. Implement the appropriate callback and function that periodicaly performs reference frequency measurement and notifies DPLL core about changes. Reviewed-by: Jiri Pirko Tested-by: Prathosh Satish Co-developed-by: Prathosh Satish Signed-off-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250715144633.149156-6-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 6287262f761e5a75c6316a7fd101abafd7a1d033 Author: Ivan Vecera Date: Tue Jul 15 16:46:32 2025 +0200 dpll: zl3073x: Add support to adjust phase Add support to get/set phase adjustment for both input and output pins. The phase adjustment is implemented using reference and output phase offset compensation registers. For input pins the adjustment value can be arbitrary number but for outputs the value has to be a multiple of half synthesizer clock cycles. Reviewed-by: Jiri Pirko Tested-by: Prathosh Satish Co-developed-by: Prathosh Satish Signed-off-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250715144633.149156-5-ivecera@redhat.com Signed-off-by: Paolo Abeni commit b7dbde2b82cc9523227c4f8ae5aa79b70ba36e22 Author: Ivan Vecera Date: Tue Jul 15 16:46:31 2025 +0200 dpll: zl3073x: Implement phase offset monitor feature Implement phase offset monitor feature to allow a user to monitor phase offsets across all available inputs. The device firmware periodically performs phase offsets measurements for all available DPLL channels and input references. The driver can ask the firmware to fill appropriate latch registers with measured values. There are 2 sets of latch registers for phase offsets reporting: 1) DPLL-to-connected-ref: up to 5 registers that contain values for phase offset between particular DPLL channel and its connected input reference. 2) selected-DPLL-to-ref: 10 registers that contain values for phase offsets between selected DPLL channel and all available input references. Both are filled with single read request so the driver can read DPLL-to-connected-ref phase offset for all DPLL channels at once. This was implemented in the previous patch. To read selected-DPLL-to-ref registers for all DPLLs a separate read request has to be sent to device firmware for each DPLL channel. To implement phase offset monitor feature: * Extend zl3073x_ref_phase_offsets_update() to select given DPLL channel in phase offset read request. The caller can set channel==-1 if it will not read Type2 registers. * Use this extended function to update phase offset latch registers during zl3073x_dpll_changes_check() call if phase monitor is enabled * Extend zl3073x_dpll_pin_phase_offset_check() to check phase offset changes for all available input references * Extend zl3073x_dpll_input_pin_phase_offset_get() to report phase offset values for all available input references * Implement phase offset monitor callbacks to enable/disable this feature Reviewed-by: Jiri Pirko Tested-by: Prathosh Satish Co-developed-by: Prathosh Satish Signed-off-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250715144633.149156-4-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 86ed4cd5fc0d4388cc083bee7ded8d9894a56b69 Author: Ivan Vecera Date: Tue Jul 15 16:46:30 2025 +0200 dpll: zl3073x: Add support to get phase offset on connected input pin Add support to get phase offset for the connected input pin. Implement the appropriate callback and function that performs DPLL to connected reference phase error measurement and notifies DPLL core about changes. The measurement is performed internally by device on background 40 times per second but the measured value is read each second and compared with previous value. Reviewed-by: Jiri Pirko Tested-by: Prathosh Satish Co-developed-by: Prathosh Satish Signed-off-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250715144633.149156-3-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 634ca2cb06d2117020908cdf7ca8556a92801fee Author: Ivan Vecera Date: Tue Jul 15 16:46:29 2025 +0200 dpll: zl3073x: Add support to get/set esync on pins Add support to get/set embedded sync for both input and output pins. The DPLL is able to lock on input reference when the embedded sync frequency is 1 PPS and pulse width 25%. The esync on outputs are more versatille and theoretically supports any esync frequency that divides current output frequency but for now support the same that supported on input pins (1 PPS & 25% pulse). Note that for the output pins the esync divisor shares the same register used for N-divided signal formats. Due to this the esync cannot be enabled on outputs configured with one of the N-divided signal formats. Reviewed-by: Jiri Pirko Tested-by: Prathosh Satish Co-developed-by: Prathosh Satish Signed-off-by: Prathosh Satish Signed-off-by: Ivan Vecera Link: https://patch.msgid.link/20250715144633.149156-2-ivecera@redhat.com Signed-off-by: Paolo Abeni commit 44eb62e1ea19d640e6c7a4da36059a6b67948881 Merge: 8a2a6bb01664c3 003322be55c650 Author: Paolo Abeni Date: Thu Jul 17 15:00:40 2025 +0200 Merge tag 'wireless-next-2025-07-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Another set of changes, notably: - cfg80211: fix double-free introduced earlier - mac80211: fix RCU iteration in CSA - iwlwifi: many cleanups (unused FW APIs, PCIe code, WoWLAN) - mac80211: some work around how FIPS affects wifi, which was wrong (RC4 is used by TKIP, not only WEP) - cfg/mac80211: improvements for unsolicated probe response handling * tag 'wireless-next-2025-07-17' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (64 commits) wifi: cfg80211: fix double free for link_sinfo in nl80211_station_dump() wifi: cfg80211: fix off channel operation allowed check for MLO wifi: mac80211: use RCU-safe iteration in ieee80211_csa_finish wifi: mac80211_hwsim: Update comments in header wifi: mac80211: parse unsolicited broadcast probe response data wifi: cfg80211: parse attribute to update unsolicited probe response template wifi: mac80211: don't use TPE data from assoc response wifi: mac80211: handle WLAN_HT_ACTION_NOTIFY_CHANWIDTH async wifi: mac80211: simplify __ieee80211_rx_h_amsdu() loop wifi: mac80211: don't mark keys for inactive links as uploaded wifi: mac80211: only assign chanctx in reconfig wifi: mac80211_hwsim: Declare support for AP scanning wifi: mac80211: clean up cipher suite handling wifi: mac80211: don't send keys to driver when fips_enabled wifi: cfg80211: Fix interface type validation wifi: mac80211: remove ieee80211_link_unreserve_chanctx() return value wifi: mac80211: don't unreserve never reserved chanctx mwl8k: Add missing check after DMA map wifi: mac80211: make VHT opmode NSS ignore a debug message wifi: iwlwifi: remove support of several iwl_ppag_table_cmd versions ... ==================== Link: https://patch.msgid.link/20250717094610.20106-47-johannes@sipsolutions.net Signed-off-by: Paolo Abeni commit e8e7c1e95d6d4ccdc53654a5966d2183532ab115 Author: Florian Fainelli Date: Tue Jun 24 16:19:23 2025 -0700 PCI: brcmstb: Replace open coded value with PCIE_T_RRS_READY_MS The delay that we are waiting on in brcm_pcie_start_link() is PCIE_T_RRS_READY_MS, use it. Signed-off-by: Florian Fainelli [mani: Removed the redundant comment] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250624231923.990361-3-florian.fainelli@broadcom.com commit fde41f282590b46e96864ae88da2e2c20a967b3a Author: Florian Fainelli Date: Tue Jun 24 16:19:22 2025 -0700 MAINTAINERS: Drop Nicolas from maintaining pcie-brcmstb Nicolas indicated a long time back that he would not have the bandwidth and indeed, has not provided any review or feedback since. Signed-off-by: Florian Fainelli Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250624231923.990361-2-florian.fainelli@broadcom.com commit aee80e6ffc5878a90ca5c16760b2c4f3f3d7343f Author: Colin Ian King Date: Thu Jul 17 12:21:08 2025 +0100 RDMA/mlx5: remove redundant check on err on return expression Currently all paths that set err and then check it for an error perform immediate returns, hence err always zero at the end of the function _mlx5r_umr_zap_mkey. The return expression err ? err : nblocks has a redundant check on the err since err is always zero, so just return nblocks instead. Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250717112108.4036171-1-colin.i.king@gmail.com Signed-off-by: Leon Romanovsky commit 675f940576351bb049f5677615140b9d0a7712d0 Author: Shin'ichiro Kawasaki Date: Thu Jul 17 19:35:39 2025 +0900 dm: split write BIOs on zone boundaries when zone append is not emulated Commit 2df7168717b7 ("dm: Always split write BIOs to zoned device limits") updates the device-mapper driver to perform splits for the write BIOs. However, it did not address the cases where DM targets do not emulate zone append, such as in the cases of dm-linear or dm-flakey. For these targets, when the write BIOs span across zone boundaries, they trigger WARN_ON_ONCE(bio_straddles_zones(bio)) in blk_zone_wplug_handle_write(). This results in I/O errors. The errors are reproduced by running blktests test case zbd/004 using zoned dm-linear or dm-flakey devices. To avoid the I/O errors, handle the write BIOs regardless whether DM targets emulate zone append or not, so that all write BIOs are split at zone boundaries. For that purpose, drop the check for zone append emulation in dm_zone_bio_needs_split(). Its argument 'md' is no longer used then drop it also. Fixes: 2df7168717b7 ("dm: Always split write BIOs to zoned device limits") Signed-off-by: Shin'ichiro Kawasaki Reviewed-by: Damien Le Moal Reviewed-by: Mikulas Patocka Link: https://lore.kernel.org/r/20250717103539.37279-1-shinichiro.kawasaki@wdc.com Signed-off-by: Jens Axboe commit 63d092d1c1b1f773232c67c87debe557aab5aca0 Author: John Garry Date: Fri Jul 11 10:52:58 2025 +0000 block: use chunk_sectors when evaluating stacked atomic write limits The atomic write unit max value is limited by any stacked device stripe size. It is required that the atomic write unit is a power-of-2 factor of the stripe size. Currently we use io_min limit to hold the stripe size, and check for a io_min <= SECTOR_SIZE when deciding if we have a striped stacked device. Nilay reports that this causes a problem when the physical block size is greater than SECTOR_SIZE [0]. Furthermore, io_min may be mutated when stacking devices, and this makes it a poor candidate to hold the stripe size. Such an example (of when io_min may change) would be when the io_min is less than the physical block size. Use chunk_sectors to hold the stripe size, which is more appropriate. [0] https://lore.kernel.org/linux-block/888f3b1d-7817-4007-b3b3-1a2ea04df771@linux.ibm.com/T/#mecca17129f72811137d3c2f1e477634e77f06781 Reviewed-by: Nilay Shroff Tested-by: Nilay Shroff Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250711105258.3135198-7-john.g.garry@oracle.com Signed-off-by: Jens Axboe commit 5fb9d4341b782a80eefa0dc1664d131ac3c8885d Author: John Garry Date: Fri Jul 11 10:52:57 2025 +0000 dm-stripe: limit chunk_sectors to the stripe size Same as done for raid0, set chunk_sectors limit to appropriately set the atomic write size limit. Setting chunk_sectors limit in this way overrides the stacked limit already calculated based on the bottom device limits. This is ok, as when any bios are sent to the bottom devices, the block layer will still respect the bottom device chunk_sectors. Reviewed-by: Nilay Shroff Reviewed-by: Mikulas Patocka Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250711105258.3135198-6-john.g.garry@oracle.com Signed-off-by: Jens Axboe commit 7ef50c4c6a9c36fa3ea6f1681a80c0bf9a797345 Author: John Garry Date: Fri Jul 11 10:52:56 2025 +0000 md/raid10: set chunk_sectors limit Same as done for raid0, set chunk_sectors limit to appropriately set the atomic write size limit. Reviewed-by: Nilay Shroff Reviewed-by: Yu Kuai Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250711105258.3135198-5-john.g.garry@oracle.com Signed-off-by: Jens Axboe commit 4b8beba60d324d259f5a1d1923aea2c205d17ebc Author: John Garry Date: Fri Jul 11 10:52:55 2025 +0000 md/raid0: set chunk_sectors limit Currently we use min io size as the chunk size when deciding on the atomic write size limits - see blk_stack_atomic_writes_head(). The limit min_io size is not a reliable value to store the chunk size, as this may be mutated by the block stacking code. Such an example would be for the min io size less than the physical block size, and the min io size is raised to the physical block size - see blk_stack_limits(). The block stacking limits will rely on chunk_sectors in future, so set this value (to the chunk size). Reviewed-by: Nilay Shroff Reviewed-by: Yu Kuai Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250711105258.3135198-4-john.g.garry@oracle.com Signed-off-by: Jens Axboe commit 1de67e8e28fc47d71ee06ffa0185da549b378ffb Author: John Garry Date: Fri Jul 11 10:52:54 2025 +0000 block: sanitize chunk_sectors for atomic write limits Currently we just ensure that a non-zero value in chunk_sectors aligns with any atomic write boundary, as the blk boundary functionality uses both these values. However it is also improper to have atomic write unit max > chunk_sectors (for non-zero chunk_sectors), as this would lead to splitting of atomic write bios (which is disallowed). Sanitize atomic write unit max against chunk_sectors to avoid any potential problems. Fixes: d00eea91deaf3 ("block: Add extra checks in blk_validate_atomic_write_limits()") Reviewed-by: Nilay Shroff Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250711105258.3135198-3-john.g.garry@oracle.com Signed-off-by: Jens Axboe commit 6381061d82141909c382811978ccdd7566698bca Author: John Garry Date: Fri Jul 11 10:52:53 2025 +0000 ilog2: add max_pow_of_two_factor() Relocate the function max_pow_of_two_factor() to common ilog2.h from the xfs code, as it will be used elsewhere. Also simplify the function, as advised by Mikulas Patocka. Signed-off-by: John Garry Reviewed-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250711105258.3135198-2-john.g.garry@oracle.com Signed-off-by: Jens Axboe commit 746d0ac5a07d5da952ef258dd4d75f0b26c96476 Author: Rick Wertenbroek Date: Wed Jul 16 13:15:03 2025 +0200 nvmet: pci-epf: Do not complete commands twice if nvmet_req_init() fails Have nvmet_req_init() and req->execute() complete failed commands. Description of the problem: nvmet_req_init() calls __nvmet_req_complete() internally upon failure, e.g., unsupported opcode, which calls the "queue_response" callback, this results in nvmet_pci_epf_queue_response() being called, which will call nvmet_pci_epf_complete_iod() if data_len is 0 or if dma_dir is different from DMA_TO_DEVICE. This results in a double completion as nvmet_pci_epf_exec_iod_work() also calls nvmet_pci_epf_complete_iod() when nvmet_req_init() fails. Steps to reproduce: On the host send a command with an unsupported opcode with nvme-cli, For example the admin command "security receive" $ sudo nvme security-recv /dev/nvme0n1 -n1 -x4096 This triggers a double completion as nvmet_req_init() fails and nvmet_pci_epf_queue_response() is called, here iod->dma_dir is still in the default state of "DMA_NONE" as set by default in nvmet_pci_epf_alloc_iod(), so nvmet_pci_epf_complete_iod() is called. Because nvmet_req_init() failed nvmet_pci_epf_complete_iod() is also called in nvmet_pci_epf_exec_iod_work() leading to a double completion. This not only sends two completions to the host but also corrupts the state of the PCI NVMe target leading to kernel oops. This patch lets nvmet_req_init() and req->execute() complete all failed commands, and removes the double completion case in nvmet_pci_epf_exec_iod_work() therefore fixing the edge cases where double completions occurred. Fixes: 0faa0fe6f90e ("nvmet: New NVMe PCI endpoint function target driver") Signed-off-by: Rick Wertenbroek Reviewed-by: Damien Le Moal Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 5a58ac9bfc412a58c3cf26c6a7e54d4308e9d109 Author: Maurizio Lombardi Date: Wed Jul 2 16:06:29 2025 +0200 nvme-tcp: log TLS handshake failures at error level Update the nvme_tcp_start_tls() function to use dev_err() instead of dev_dbg() when a TLS error is detected. This ensures that handshake failures are visible by default, aiding in debugging. Signed-off-by: Maurizio Lombardi Reviewed-by: Laurence Oberman Reviewed-by: Hannes Reinecke Signed-off-by: Christoph Hellwig commit 3be8ad8caa9bf87fe887174df15be9ab08f69676 Author: Alok Tiwari Date: Tue Jun 24 21:16:34 2025 -0700 docs: nvme: fix grammar in nvme-pci-endpoint-target.rst Notable changes: - Use "an NVMe" instead of "a NVMe" throughout the document - Fix incorrect phrasing such as "will is discoverable" -> "is discoverable" - Ensure consistent and proper article usage for clarity. Signed-off-by: Alok Tiwari Reviewed-by: Randy Dunlap Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit b5cd5f1e50205831cb078f5c52359004eb1cbe74 Author: Alok Tiwari Date: Tue Jun 24 21:16:33 2025 -0700 nvme: fix typo in status code constant for self-test in progress Correct a typo error in the NVMe status code constant from NVME_SC_SELT_TEST_IN_PROGRESS to NVME_SC_SELF_TEST_IN_PROGRESS to accurately reflect its meaning. Signed-off-by: Alok Tiwari Reviewed-by: Randy Dunlap Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 2e7dd5c1a8ae9532530474e13dec3371b3db4ee0 Author: Alok Tiwari Date: Tue Jun 24 21:16:32 2025 -0700 nvmet: remove redundant assignment of error code in nvmet_ns_enable() Remove the unnecessary ret = -EMFILE; assignment since it is immediately overwritten by the result of nvmet_bdev_ns_enable() The initial value (-EMFILE) is redundant because it has no effect on the code logic or outcome. Signed-off-by: Alok Tiwari Reviewed-by: Randy Dunlap Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 3b1eabed272e99bf0291260ed0947ed29e017193 Author: Alok Tiwari Date: Tue Jun 24 21:16:31 2025 -0700 nvme: fix incorrect variable in io cqes error message Correct the error log to print ctrl->io_cqes instead of incorrectly using ctrl->io_sqes for the io cqes size check. Signed-off-by: Alok Tiwari Reviewed-by: Randy Dunlap Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 164c187d25b60699bd87e7f78868d26cfc70035e Author: Alok Tiwari Date: Tue Jun 24 21:16:30 2025 -0700 nvme: fix multiple spelling and grammar issues in host drivers This commit fixes several typos and grammatical issues across various nvme host driver files: - correct "glace" to "glance" in a comment in apple.c - fix "Idependent" to "Independent" in core.c - change "unsucceesful" to "unsuccessful", "they blk-mq" to "the blk-mq", - fix "terminaed" to "terminated" and other grammar in fc.c - update "O's" to "0's" to clarify meaning in nvme.h - fix a function name reference in a comment in zns.c: *_transter_len() -> *_transfer_len(). - fix sysfs_emit() output format in pci.c (replace x%08x with 0x%08x) These changes improve the code readability and documentation consistency across the NVMe driver. Signed-off-by: Alok Tiwari Reviewed-by: Randy Dunlap Reviewed-by: Chaitanya Kulkarni Signed-off-by: Christoph Hellwig commit 8a2a6bb01664c34464153b6ace79a6da34e63eaa Author: Jack Ping CHNG Date: Tue Jul 15 10:19:56 2025 +0800 net: pcs: xpcs: Use devm_clk_get_optional Synopsys DesignWare XPCS CSR clock is optional, so it is better to use devm_clk_get_optional instead of devm_clk_get. Signed-off-by: Jack Ping CHNG Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250715021956.3335631-1-jchng@maxlinear.com Signed-off-by: Paolo Abeni commit 2dec50d4d375bdaa11a1620de4cfe00d10d9908f Merge: cd031354087d8a 6aa53e861c1a0c Author: Paolo Abeni Date: Thu Jul 17 11:49:29 2025 +0200 Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/linux Tony Nguyen says: ==================== Add RDMA support for Intel IPU E2000 in idpf Tatyana Nikolova says: This idpf patch series is the second part of the staged submission for introducing RDMA RoCEv2 support for the IPU E2000 line of products, referred to as GEN3. To support RDMA GEN3 devices, the idpf driver uses common definitions of the IIDC interface and implements specific device functionality in iidc_rdma_idpf.h. The IPU model can host one or more logical network endpoints called vPorts per PCI function that are flexibly associated with a physical port or an internal communication port. Other features as it pertains to GEN3 devices include: * MMIO learning * RDMA capability negotiation * RDMA vectors discovery between idpf and control plane These patches are split from the submission "Add RDMA support for Intel IPU E2000 (GEN3)" [1]. The patches have been tested on a range of hosts and platforms with a variety of general RDMA applications which include standalone verbs (rping, perftest, etc.), storage and HPC applications. Signed-off-by: Tony Nguyen [1] https://lore.kernel.org/all/20240724233917.704-1-tatyana.e.nikolova@intel.com/ This idpf patch series is the second part of the staged submission for introducing RDMA RoCEv2 support for the IPU E2000 line of products, referred to as GEN3. To support RDMA GEN3 devices, the idpf driver uses common definitions of the IIDC interface and implements specific device functionality in iidc_rdma_idpf.h. The IPU model can host one or more logical network endpoints called vPorts per PCI function that are flexibly associated with a physical port or an internal communication port. Other features as it pertains to GEN3 devices include: * MMIO learning * RDMA capability negotiation * RDMA vectors discovery between idpf and control plane These patches are split from the submission "Add RDMA support for Intel IPU E2000 (GEN3)" [1]. The patches have been tested on a range of hosts and platforms with a variety of general RDMA applications which include standalone verbs (rping, perftest, etc.), storage and HPC applications. Signed-off-by: Tony Nguyen [1] https://lore.kernel.org/all/20240724233917.704-1-tatyana.e.nikolova@intel.com/ IWL reviews: v3: https://lore.kernel.org/all/20250708210554.1662-1-tatyana.e.nikolova@intel.com/ v2: https://lore.kernel.org/all/20250612220002.1120-1-tatyana.e.nikolova@intel.com/ v1 (split from previous series): https://lore.kernel.org/all/20250523170435.668-1-tatyana.e.nikolova@intel.com/ v3: https://lore.kernel.org/all/20250207194931.1569-1-tatyana.e.nikolova@intel.com/ RFC v2: https://lore.kernel.org/all/20240824031924.421-1-tatyana.e.nikolova@intel.com/ RFC: https://lore.kernel.org/all/20240724233917.704-1-tatyana.e.nikolova@intel.com/ * 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/linux: idpf: implement get LAN MMIO memory regions idpf: implement IDC vport aux driver MTU change handler idpf: implement remaining IDC RDMA core callbacks and handlers idpf: implement RDMA vport auxiliary dev create, init, and destroy idpf: implement core RDMA auxiliary dev create, init, and destroy idpf: use reserved RDMA vectors from control plane ==================== Link: https://patch.msgid.link/20250714181002.2865694-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit aa46e18836c07e4d81491d47f8deeba840e780f0 Author: Anshuman Khandual Date: Wed Jul 16 04:54:32 2025 +0100 arm64/mm: Drop redundant addr increment in set_huge_pte_at() The 'addr' need not be incremented in the loop because that is not going to be used subsequently. Cc: Catalin Marinas Cc: Will Deacon Cc: Ryan Roberts Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Dev Jain Signed-off-by: Anshuman Khandual Link: https://lore.kernel.org/r/20250716035432.293682-1-anshuman.khandual@arm.com Signed-off-by: Will Deacon commit 54c605124da6fad3d6033ca822c551ce33982084 Author: Mark Brown Date: Tue Jul 15 22:11:41 2025 +0100 kselftest/arm4: Provide local defines for AT_HWCAP3 Some build environments for the selftests are not picking up the newly added AT_HWCAP3 when using the libc headers, even with headers_install (which we require already for the arm64 selftests). As a quick fix add local definitions of the constant to tools use it, while auxvec.h is installed with some toolchains it needs some persuasion to get picked up. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250715-arm64-selftest-bodge-hwcap3-v1-1-541b54bc43bb@kernel.org Signed-off-by: Will Deacon commit d7ce7e3a84642aadf7c4787f7ec4f58eb163d129 Author: Breno Leitao Date: Wed Jul 16 02:42:01 2025 -0700 arm64: Mark kernel as tainted on SAE and SError panic Set TAINT_MACHINE_CHECK when SError or Synchronous External Abort (SEA) interrupts trigger a panic to flag potential hardware faults. This tainting mechanism aids in debugging and enables correlation of hardware-related crashes in large-scale deployments. This change aligns with similar patches[1] that mark machine check events when the system crashes due to hardware errors. Link: https://lore.kernel.org/all/20250702-add_tain-v1-1-9187b10914b9@debian.org/ [1] Signed-off-by: Breno Leitao Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250716-vmcore_hw_error-v2-1-f187f7d62aba@debian.org Signed-off-by: Will Deacon commit ac1207f516c2ffe082a5d8aad35ac839d6c60747 Author: Konrad Dybcio Date: Wed Jul 16 12:16:09 2025 +0200 dt-bindings: arm-smmu: Remove sdm845-cheza specific entry The firmware on SDM845-based Cheza boards did not provide the same level of feature support for SMMUs (particularly around the Adreno GPU integration). Now that Cheza is being removed from the kernel (almost none exist at this point in time), retire the entry as well. Most notably, it's not being marked as deprecated instead, as there is no indication that any more of those ~7 year old devboards will be built. Signed-off-by: Konrad Dybcio Reviewed-by: Douglas Anderson Reviewed-by: Krzysztof Kozlowski Acked-by: Robin Murphy Link: https://lore.kernel.org/r/20250716-topic-goodnight_cheza-v2-3-6fa8d3261813@oss.qualcomm.com Signed-off-by: Will Deacon commit ddb8172cdf8854a215ce23ad0f20b2578fa512db Author: Andy Shevchenko Date: Tue Jul 8 16:33:44 2025 +0300 watchdog: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Signed-off-by: Andy Shevchenko Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250708133646.70384-3-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 6a4a2d5cba74e1cd31dabea29be7a79e2a409f3d Author: Andy Shevchenko Date: Tue Jul 8 16:33:43 2025 +0300 watchdog: it87_wdt: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Signed-off-by: Andy Shevchenko Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250708133646.70384-2-andriy.shevchenko@linux.intel.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 8637afa79cfa6123f602408cfafe8c9a73620ff1 Author: Jason Gunthorpe Date: Mon Jun 9 20:58:05 2025 -0300 iommu/amd: Fix geometry.aperture_end for V2 tables The AMD IOMMU documentation seems pretty clear that the V2 table follows the normal CPU expectation of sign extension. This is shown in Figure 25: AMD64 Long Mode 4-Kbyte Page Address Translation Where bits Sign-Extend [63:57] == [56]. This is typical for x86 which would have three regions in the page table: lower, non-canonical, upper. The manual describes that the V1 table does not sign extend in section 2.2.4 Sharing AMD64 Processor and IOMMU Page Tables GPA-to-SPA Further, Vasant has checked this and indicates the HW has an addtional behavior that the manual does not yet describe. The AMDv2 table does not have the sign extended behavior when attached to PASID 0, which may explain why this has gone unnoticed. The iommu domain geometry does not directly support sign extended page tables. The driver should report only one of the lower/upper spaces. Solve this by removing the top VA bit from the geometry to use only the lower space. This will also make the iommu_domain work consistently on all PASID 0 and PASID != 1. Adjust dma_max_address() to remove the top VA bit. It now returns: 5 Level: Before 0x1ffffffffffffff After 0x0ffffffffffffff 4 Level: Before 0xffffffffffff After 0x7fffffffffff Fixes: 11c439a19466 ("iommu/amd/pgtbl_v2: Fix domain max address") Link: https://lore.kernel.org/all/8858d4d6-d360-4ef0-935c-bfd13ea54f42@amd.com/ Signed-off-by: Jason Gunthorpe Reviewed-by: Vasant Hegde Reviewed-by: Lu Baolu Link: https://lore.kernel.org/r/0-v2-0615cc99b88a+1ce-amdv2_geo_jgg@nvidia.com Signed-off-by: Will Deacon commit f72b9aa821a2bfe4b6dfec4be19f264d0673b008 Author: Jay Chen Date: Thu Jul 17 10:31:07 2025 +0300 usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command There is a subtle contradiction between sections of the xHCI 1.2 spec regarding the initialization of Input Endpoint Context fields. Section 4.8.2 ("Endpoint Context Initialization") states that all fields should be initialized to 0. However, Section 6.2.3 ("Endpoint Context", p.453) specifies that the Average TRB Length (avg_trb_len) field shall be greater than 0, and explicitly notes (p.454): "Software shall set Average TRB Length to '8' for control endpoints." Strictly setting all fields to 0 during initialization conflicts with the specific recommendation for control endpoints. In practice, setting avg_trb_len = 0 is not meaningful for the hardware/firmware, as the value is used for bandwidth calculation. Motivation: Our company is developing a custom Virtual xHC hardware platform that strictly follows the xHCI spec and its recommendations. During validation, we observed that enumeration fails and a parameter error (TRB Completion Code = 5) is reported if avg_trb_len for EP0 is not set to 8 as recommended by Section 6.2.3. This demonstrates the importance of assigning a meaningful, non-zero value to avg_trb_len, even in virtualized or emulated environments. This patch explicitly sets avg_trb_len to 8 for EP0 in xhci_setup_addressable_virt_dev(), as recommended in Section 6.2.3, to prevent potential issues with xHCI host controllers that enforce the spec strictly. Link: https://bugzilla.kernel.org/show_bug.cgi?id=220033 Signed-off-by: Jay Chen Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20250717073107.488599-4-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 65fc0fc137b5da3ee1f4ca4f61050fcb203d7582 Author: Mario Limonciello Date: Thu Jul 17 10:31:06 2025 +0300 usb: xhci: Avoid showing warnings for dying controller When a USB4 dock is unplugged from a system it won't respond to ring events. The PCI core handles the surprise removal event and notifies all PCI drivers. The XHCI PCI driver sets a flag that the device is being removed, and when the device stops responding a flag is also added to indicate it's dying. When that flag is set don't bother to show warnings about a missing controller. Signed-off-by: Mario Limonciello Signed-off-by: Mathias Nyman Acked-by: Mathias Nyman Link: https://lore.kernel.org/r/20250717073107.488599-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 4b9c60e440525b729ac5f071e00bcee12e0a7e84 Author: Mario Limonciello Date: Thu Jul 17 10:31:05 2025 +0300 usb: xhci: Avoid showing errors during surprise removal When a USB4 dock is unplugged from a system it won't respond to ring events. The PCI core handles the surprise removal event and notifies all PCI drivers. The XHCI PCI driver sets a flag that the device is being removed as well. When that flag is set don't show messages in the cleanup path for marking the controller dead. Signed-off-by: Mario Limonciello Signed-off-by: Mathias Nyman Acked-by: Mathias Nyman Link: https://lore.kernel.org/r/20250717073107.488599-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 9628e5c85b1e0fd1e30d8f797ba1289de2708d3a Author: Bagas Sanjaya Date: Thu Jul 17 08:03:31 2025 +0700 iommu/amd: Wrap debugfs ABI testing symbols snippets in literal code blocks Commit 39215bb3b0d929 ("iommu/amd: Add documentation for AMD IOMMU debugfs support") documents debugfs ABI symbols for AMD IOMMU, but forgets to wrap examples snippets and their output in literal code blocks, hence Sphinx reports indentation warnings: Documentation/ABI/testing/debugfs-amd-iommu:31: ERROR: Unexpected indentation. [docutils] Documentation/ABI/testing/debugfs-amd-iommu:31: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils] Documentation/ABI/testing/debugfs-amd-iommu:31: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils] Wrap them to fix the warnings. Fixes: 39215bb3b0d9 ("iommu/amd: Add documentation for AMD IOMMU debugfs support") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20250716204207.73869849@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20250717010331.8941-1-bagasdotme@gmail.com Signed-off-by: Will Deacon commit 07e04c071a35abe12957b575cd1453ccafc02eb6 Author: Diederik de Haas Date: Wed Jul 16 10:33:35 2025 +0200 arm64: dts: rockchip: Add maskrom button to NanoPi R5S + R5C Both the R5S and R5C have a MASKROM button connected via saradc. For both the R5S as the R5C it's described on page 9 of their respective schematic, identified as 'Recovery'. Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250716083355.327451-1-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit 47f4bef6e71914fd0bab11ae0e3658802118f3d9 Author: Luca Weiss Date: Sun Jul 13 10:05:30 2025 +0200 dt-bindings: thermal: qcom-tsens: document the Milos Temperature Sensor Document the Temperature Sensor (TSENS) on the Milos SoC. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250713-sm7635-fp6-initial-v2-8-e8f9a789505b@fairphone.com Signed-off-by: Daniel Lezcano commit d5212d819e02313f27c867e6d365e71f1fdaaca4 Merge: 2f368b5f93430e 6e2f4d8a611831 Author: Christian Brauner Date: Thu Jul 17 09:55:23 2025 +0200 Merge patch series "fuse: use iomap for buffered writes + writeback" Joanne Koong says: This series adds fuse iomap support for buffered writes and dirty folio writeback. This is needed so that granular uptodate and dirty tracking can be used in fuse when large folios are enabled. This has two big advantages. For writes, instead of the entire folio needing to be read into the page cache, only the relevant portions need to be. For writeback, only the dirty portions need to be written back instead of the entire folio. Please note that this patchset does not enable large folios yet. That will be sent out in a separate future patchset. * patches from https://lore.kernel.org/20250715202122.2282532-1-joannelkoong@gmail.com: fuse: refactor writeback to use iomap_writepage_ctx inode fuse: hook into iomap for invalidating and checking partial uptodateness fuse: use iomap for folio laundering fuse: use iomap for writeback fuse: use iomap for buffered writes Link: https://lore.kernel.org/20250715202122.2282532-1-joannelkoong@gmail.com Signed-off-by: Christian Brauner commit 6e2f4d8a6118318ccbc0c460e4b959d552e6483a Author: Joanne Koong Date: Tue Jul 15 13:21:22 2025 -0700 fuse: refactor writeback to use iomap_writepage_ctx inode struct iomap_writepage_ctx includes a pointer to the file inode. In writeback, use that instead of also passing the inode into fuse_fill_wb_data. No functional changes. Signed-off-by: Joanne Koong Link: https://lore.kernel.org/20250715202122.2282532-6-joannelkoong@gmail.com Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 707c5d3471e32ecfdcfa5ebe4e8023f886d4b1fd Author: Joanne Koong Date: Tue Jul 15 13:21:21 2025 -0700 fuse: hook into iomap for invalidating and checking partial uptodateness Hook into iomap_invalidate_folio() so that if the entire folio is being invalidated during truncation, the dirty state is cleared and the folio doesn't get written back. As well the folio's corresponding ifs struct will get freed. Hook into iomap_is_partially_uptodate() since iomap tracks uptodateness granularly when it does buffered writes. Signed-off-by: Joanne Koong Link: https://lore.kernel.org/20250715202122.2282532-5-joannelkoong@gmail.com Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 1097a87dcb7447e319f143c3cb1518a177e6896f Author: Joanne Koong Date: Tue Jul 15 13:21:20 2025 -0700 fuse: use iomap for folio laundering Use iomap for folio laundering, which will do granular dirty writeback when laundering a large folio. Signed-off-by: Joanne Koong Link: https://lore.kernel.org/20250715202122.2282532-4-joannelkoong@gmail.com Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit ef7e7cbb323f8a39381a2d4bb8392712bf3cf7ae Author: Joanne Koong Date: Tue Jul 15 13:21:19 2025 -0700 fuse: use iomap for writeback Use iomap for dirty folio writeback in ->writepages(). This allows for granular dirty writeback of large folios. Only the dirty portions of the large folio will be written instead of having to write out the entire folio. For example if there is a 1 MB large folio and only 2 bytes in it are dirty, only the page for those dirty bytes will be written out. .dirty_folio needs to be set to iomap_dirty_folio so that the bitmap iomap uses for dirty tracking correctly reflects dirty regions that need to be written back. Signed-off-by: Joanne Koong Link: https://lore.kernel.org/20250715202122.2282532-3-joannelkoong@gmail.com Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit a4c9ab1d4975746c14b34c7bb908869245a9dd4f Author: Joanne Koong Date: Tue Jul 15 13:21:18 2025 -0700 fuse: use iomap for buffered writes Have buffered writes go through iomap. This has two advantages: * granular large folio synchronous reads * granular large folio dirty tracking If for example there is a 1 MB large folio and a write issued at pos 1 to pos 1 MB - 2, only the head and tail pages will need to be read in and marked uptodate instead of the entire folio needing to be read in. Non-relevant trailing pages are also skipped (eg if for a 1 MB large folio a write is issued at pos 1 to 4099, only the first two pages are read in and the ones after that are skipped). iomap also has granular dirty tracking. This is useful in that when it comes to writeback time, only the dirty portions of the large folio will be written instead of having to write out the entire folio. For example if there is a 1 MB large folio and only 2 bytes in it are dirty, only the page for those dirty bytes get written out. Please note that granular writeback is only done once fuse also uses iomap in writeback (separate commit). .release_folio needs to be set to iomap_release_folio so that any allocated iomap ifs structs get freed. Signed-off-by: Joanne Koong Link: https://lore.kernel.org/20250715202122.2282532-2-joannelkoong@gmail.com Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 14ae91a81ec8fa0bc23170d4aa16dd2a20d54105 Author: Rhys Lloyd Date: Sat Jul 12 19:51:08 2025 -0700 gpu: nova-core: fix bounds check in PmuLookupTableEntry::new data is sliced from 2..6, but the bounds check data.len() < 5 does not satisfy those bounds. Fixes: 47c4846e4319 ("gpu: nova-core: vbios: Add support for FWSEC ucode extraction") Reviewed-by: Alexandre Courbot Reviewed-by: Joel Fernandes Signed-off-by: Rhys Lloyd Link: https://lore.kernel.org/r/20250713025108.9364-2-krakow20@gmail.com Signed-off-by: Alexandre Courbot commit 633a81bead863881373cf3399e26d9d10d31315e Author: Luca Weiss Date: Tue Jul 15 09:19:11 2025 +0200 clk: qcom: Add Video Clock controller (VIDEOCC) driver for Milos Add support for the video clock controller found on Milos (e.g. SM7635) based devices. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-11-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit a4937e9741867865bb307ae9dde6ef393b68540b Author: Luca Weiss Date: Tue Jul 15 09:19:10 2025 +0200 dt-bindings: clock: qcom: document the Milos Video Clock Controller Add bindings documentation for the Milos (e.g. SM7635) Video Clock Controller. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-10-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit 980d7c84461a0ae88ec915735553067c7743ba4c Author: Luca Weiss Date: Tue Jul 15 09:19:09 2025 +0200 clk: qcom: Add Graphics Clock controller (GPUCC) driver for Milos Add support for the graphics clock controller found on Milos (e.g. SM7635) based devices. Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-9-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit 7e5368a14b8c295470ab07d2a9ad8ee9bf7187ee Author: Luca Weiss Date: Tue Jul 15 09:19:08 2025 +0200 dt-bindings: clock: qcom: document the Milos GPU Clock Controller Add bindings documentation for the Milos (e.g. SM7635) Graphics Clock Controller. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-8-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit f40b5217dce1832e5a270ee10f03d3d23233d720 Author: Luca Weiss Date: Tue Jul 15 09:19:07 2025 +0200 clk: qcom: Add Display Clock controller (DISPCC) driver for Milos Add support for the display clock controller found on Milos (e.g. SM7635) based devices. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-7-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit 63edb206a3a93f523579df7f49f2989aae4e8450 Author: Luca Weiss Date: Tue Jul 15 09:19:06 2025 +0200 dt-bindings: clock: qcom: document the Milos Display Clock Controller Add bindings documentation for the Milos (e.g. SM7635) Display Clock Controller. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-6-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit f003800e2d3596770fc42bfff7de9528923dafe2 Author: Luca Weiss Date: Tue Jul 15 09:19:05 2025 +0200 clk: qcom: Add Camera Clock controller (CAMCC) driver for Milos Add support for the camera clock controller found on Milos (e.g. SM7635) based devices. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-5-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit dbb9d53b7197b6b13d0137c0ea45902ef26e2bb4 Author: Luca Weiss Date: Tue Jul 15 09:19:04 2025 +0200 dt-bindings: clock: qcom: document the Milos Camera Clock Controller Add bindings documentation for the Milos (e.g. SM7635) Camera Clock Controller. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-4-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit 88174d5d94226b0f0931f4ae97913e498f76d2a2 Author: Luca Weiss Date: Tue Jul 15 09:19:03 2025 +0200 clk: qcom: Add Global Clock controller (GCC) driver for Milos Add support for the global clock controller found on Milos (e.g. SM7635) based devices. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-3-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit 95ba6820a665c25f372a3cdc9c469bb0a86bf174 Author: Luca Weiss Date: Tue Jul 15 09:19:02 2025 +0200 dt-bindings: clock: qcom: document the Milos Global Clock Controller Add bindings documentation for the Milos (e.g. SM7635) Global Clock Controller. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-2-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit b21b5b3ae0fce4db3eab052d3e3cc17890e78523 Author: Luca Weiss Date: Tue Jul 15 09:19:01 2025 +0200 clk: qcom: common: Add support to register rcg dfs in qcom_cc_really_probe Add support to register the rcg dfs in qcom_cc_really_probe(). This allows users to move the call from the probe function to static properties. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250715-sm7635-clocks-v3-1-18f9faac4984@fairphone.com Signed-off-by: Bjorn Andersson commit eb1af6ee4874dd15e52f38216dfd6a2b12d595da Author: Stephan Gerhold Date: Wed Jul 9 12:08:57 2025 +0200 clk: qcom: gcc-x1e80100: Add missing video resets Add the missing video resets that are needed for the iris video codec. Copied from gcc-sm8550.c. Reviewed-by: Konrad Dybcio Reviewed-by: Bryan O'Donoghue Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250709-x1e-videocc-v2-5-ad1acf5674b4@linaro.org Signed-off-by: Bjorn Andersson commit d0b706509fb04449add5446e51a494bfeadcac10 Author: Stephan Gerhold Date: Wed Jul 9 12:08:56 2025 +0200 dt-bindings: clock: qcom,x1e80100-gcc: Add missing video resets Add the missing video resets that are needed for the iris video codec. Acked-by: Rob Herring (Arm) Reviewed-by: Bryan O'Donoghue Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250709-x1e-videocc-v2-4-ad1acf5674b4@linaro.org Signed-off-by: Bjorn Andersson commit 92640a6d4a4f59137867b7025d54cbbf7f23f89e Author: Stephan Gerhold Date: Wed Jul 9 12:08:55 2025 +0200 clk: qcom: videocc-sm8550: Add separate frequency tables for X1E80100 X1E80100 videocc is identical to the one in SM8550, aside from slightly different recommended PLL frequencies. Add the separate frequency tables for that and apply them if the qcom,x1e80100-videocc compatible is used. Reviewed-by: Bryan O'Donoghue Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250709-x1e-videocc-v2-3-ad1acf5674b4@linaro.org Signed-off-by: Bjorn Andersson commit b7b0799f0d9f4c6f5ca8b1ee63bc9e961a326f9c Author: Stephan Gerhold Date: Wed Jul 9 12:08:54 2025 +0200 clk: qcom: videocc-sm8550: Allow building without SM8550/SM8560 GCC >From the build perspective, the videocc-sm8550 driver doesn't depend on having one of the GCC drivers enabled. It builds just fine without the GCC driver. In practice, it doesn't make much sense to have it enabled without the GCC driver, but currently this extra dependency is inconsistent with most of the other VIDEOCC entries in Kconfig. This can easily cause confusion when you see the VIDEOCC options for some of the SoCs but not for all of them. Let's just drop the depends line to allow building the videocc driver independent of the GCC selection. Compile testing with randconfig will also benefit from keeping the dependencies minimal. Reviewed-by: Bryan O'Donoghue Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250709-x1e-videocc-v2-2-ad1acf5674b4@linaro.org Signed-off-by: Bjorn Andersson commit 3b4e2820e1a5889c3eff274780137c61cecdab2b Author: Stephan Gerhold Date: Wed Jul 9 12:08:53 2025 +0200 dt-bindings: clock: qcom,sm8450-videocc: Document X1E80100 compatible X1E80100 videocc is largely identical to SM8550, but needs slightly different PLL frequencies. Add a separate qcom,x1e80100-videocc compatible to the existing schema used for SM8550. Acked-by: Rob Herring (Arm) Reviewed-by: Bryan O'Donoghue Signed-off-by: Stephan Gerhold Link: https://lore.kernel.org/r/20250709-x1e-videocc-v2-1-ad1acf5674b4@linaro.org Signed-off-by: Bjorn Andersson commit 7181c64fdd3e10e731568b2f44c3805173bd7b9c Author: Luca Weiss Date: Mon Jul 7 11:56:40 2025 +0200 clk: qcom: tcsrcc-sm8650: Add support for Milos SoC The Milos SoC has a very similar tcsrcc block, only TCSR_UFS_CLKREF_EN uses different regs, and both TCSR_USB2_CLKREF_EN and TCSR_USB3_CLKREF_EN are not present. Modify these resources at probe if we're probing for Milos. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250707-sm7635-clocks-misc-v2-4-b49f19055768@fairphone.com Signed-off-by: Bjorn Andersson commit 5009024ad7c670066204c3153b177de20ea9d93b Author: Luca Weiss Date: Mon Jul 7 11:56:39 2025 +0200 dt-bindings: clock: qcom: document the Milos TCSR Clock Controller Add bindings documentation for the Milos (e.g. SM7635) TCSR Clock Controller. Signed-off-by: Luca Weiss Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250707-sm7635-clocks-misc-v2-3-b49f19055768@fairphone.com Signed-off-by: Bjorn Andersson commit 4901838d2be20e00711f3b2b612acd1c7c754a88 Author: Luca Weiss Date: Mon Jul 7 11:56:38 2025 +0200 clk: qcom: rpmh: Add support for RPMH clocks on Milos Add support for RPMH clocks on Milos SoCs. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250707-sm7635-clocks-misc-v2-2-b49f19055768@fairphone.com Signed-off-by: Bjorn Andersson commit 136e6393a5462502dc78c661fcf09f360c6f5d6b Author: Luca Weiss Date: Mon Jul 7 11:56:37 2025 +0200 dt-bindings: clock: qcom: Document the Milos RPMH Clock Controller Add bindings documentation for the Milos (e.g. SM7635) RPMH Clock Controller. Signed-off-by: Luca Weiss Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250707-sm7635-clocks-misc-v2-1-b49f19055768@fairphone.com Signed-off-by: Bjorn Andersson commit ebec04773bf313280fe1cd9c0877c73660e69a10 Author: Brian Masney Date: Thu Jul 3 19:22:30 2025 -0400 clk: qcom: spmi-pmic-div: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250703-clk-cocci-drop-round-rate-v1-6-3a8da898367e@redhat.com Signed-off-by: Bjorn Andersson commit 11add2107c04bdcfb499cdb96ab156a4646ec9e1 Author: Brian Masney Date: Thu Jul 3 19:22:29 2025 -0400 clk: qcom: smd-rpm: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250703-clk-cocci-drop-round-rate-v1-5-3a8da898367e@redhat.com Signed-off-by: Bjorn Andersson commit 2c0dce7392fdc0fcca1f133114c7c4295ac69233 Author: Brian Masney Date: Thu Jul 3 19:22:28 2025 -0400 clk: qcom: rpmh: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250703-clk-cocci-drop-round-rate-v1-4-3a8da898367e@redhat.com Signed-off-by: Bjorn Andersson commit 120c4b7a35a2e2414fc3e35b34526b60ac54515d Author: Brian Masney Date: Thu Jul 3 19:22:27 2025 -0400 clk: qcom: rpm: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250703-clk-cocci-drop-round-rate-v1-3-3a8da898367e@redhat.com Signed-off-by: Bjorn Andersson commit 3ebefed3d3afbda632b5647a06598e1bad1baeb6 Author: Brian Masney Date: Thu Jul 3 19:22:26 2025 -0400 clk: qcom: gcc-ipq4019: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250703-clk-cocci-drop-round-rate-v1-2-3a8da898367e@redhat.com Signed-off-by: Bjorn Andersson commit f6a8abe0cc16c44eda30712a8922261363d6d3ac Author: Taniya Das Date: Wed Jul 2 14:34:29 2025 +0530 clk: qcom: videocc-qcs615: Add QCS615 video clock controller driver Add support for the video clock controller for video clients to be able to request for the clocks on QCS615 platform. Reviewed-by: Bryan O'Donoghue Reviewed-by: Dmitry Baryshkov Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250702-qcs615-mm-v10-clock-controllers-v11-9-9c216e1615ab@quicinc.com Signed-off-by: Bjorn Andersson commit 9c51c66c997cae09c12ec250a9f538c0c23d8930 Author: Taniya Das Date: Wed Jul 2 14:34:28 2025 +0530 dt-bindings: clock: Add Qualcomm QCS615 Video clock controller Add DT bindings for the Video clock on QCS615 platforms. Add the relevant DT include definitions as well. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250702-qcs615-mm-v10-clock-controllers-v11-8-9c216e1615ab@quicinc.com Signed-off-by: Bjorn Andersson commit f4b5b40805ab116aad57ee7042359f97d065bd70 Author: Taniya Das Date: Wed Jul 2 14:34:27 2025 +0530 clk: qcom: gpucc-qcs615: Add QCS615 graphics clock controller driver Add support for the graphics clock controller for graphics clients to be able to request for the clocks on QCS615 platform. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250702-qcs615-mm-v10-clock-controllers-v11-7-9c216e1615ab@quicinc.com Signed-off-by: Bjorn Andersson commit 3590dfbdd1b3e4ceba0b7daed2a396f644c277c4 Author: Taniya Das Date: Wed Jul 2 14:34:26 2025 +0530 dt-bindings: clock: Add Qualcomm QCS615 Graphics clock controller Add DT bindings for the Graphics clock on QCS615 platforms. Add the relevant DT include definitions as well. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250702-qcs615-mm-v10-clock-controllers-v11-6-9c216e1615ab@quicinc.com Signed-off-by: Bjorn Andersson commit 9b47105f5434707eab065f65e7d35c62a51179f8 Author: Taniya Das Date: Wed Jul 2 14:34:25 2025 +0530 clk: qcom: dispcc-qcs615: Add QCS615 display clock controller driver Add support for the display clock controller for display clients to be able to request for the clocks on QCS615 platform. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250702-qcs615-mm-v10-clock-controllers-v11-5-9c216e1615ab@quicinc.com Signed-off-by: Bjorn Andersson commit 8b1750ea009f2774a3acd6c7bc9e61b5157101d1 Author: Taniya Das Date: Wed Jul 2 14:34:24 2025 +0530 dt-bindings: clock: Add Qualcomm QCS615 Display clock controller Add DT bindings for the Display clock on QCS615 platforms. Add the relevant DT include definitions as well. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250702-qcs615-mm-v10-clock-controllers-v11-4-9c216e1615ab@quicinc.com Signed-off-by: Bjorn Andersson commit 28bc422939540b37eeaa11dd9c0fb412caaaca27 Author: Taniya Das Date: Wed Jul 2 14:34:23 2025 +0530 clk: qcom: camcc-qcs615: Add QCS615 camera clock controller driver Add support for the camera clock controller for camera clients to be able to request for camcc clocks on QCS615 platform. Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250702-qcs615-mm-v10-clock-controllers-v11-3-9c216e1615ab@quicinc.com Signed-off-by: Bjorn Andersson commit 8df29649903c067138180ef89f315b6f166b8732 Author: Taniya Das Date: Wed Jul 2 14:34:22 2025 +0530 dt-bindings: clock: Add Qualcomm QCS615 Camera clock controller Add DT bindings for the Camera clock on QCS615 platforms. Add the relevant DT include definitions as well. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Taniya Das Link: https://lore.kernel.org/r/20250702-qcs615-mm-v10-clock-controllers-v11-2-9c216e1615ab@quicinc.com Signed-off-by: Bjorn Andersson commit 48d2c6dec1c46460ee7028915595d49a644e8a77 Author: Taniya Das Date: Wed Jul 2 14:34:21 2025 +0530 clk: qcom: clk-alpha-pll: Add support for dynamic update for slewing PLLs The alpha PLLs which slew to a new frequency at runtime would require the PLL to calibrate at the mid point of the VCO. Add the new PLL ops which can support the slewing of the PLL to a new frequency. Reviewed-by: Imran Shaik Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250702-qcs615-mm-v10-clock-controllers-v11-1-9c216e1615ab@quicinc.com Signed-off-by: Bjorn Andersson commit f6a4a55ae5d99f865e106916a9295548e381de47 Author: George Moussalem Date: Mon Jun 30 16:35:00 2025 +0400 clk: qcom: gcc-ipq5018: fix GE PHY reset The MISC reset is supposed to trigger a resets across the MDC, DSP, and RX & TX clocks of the IPQ5018 internal GE PHY. So let's set the bitmask of the reset definition accordingly in the GCC as per the downstream driver. Link: https://git.codelinaro.org/clo/qsdk/oss/kernel/linux-ipq-5.4/-/commit/00743c3e82fa87cba4460e7a2ba32f473a9ce932 Reviewed-by: Konrad Dybcio Signed-off-by: George Moussalem Link: https://lore.kernel.org/r/20250630-ipq5018-ge-phy-v6-1-01be06378c15@outlook.com Signed-off-by: Bjorn Andersson commit 9723807046601f6596fa71515a3bc81f202cde5c Author: Loic Poulain Date: Fri Jun 13 12:22:45 2025 +0200 clk: qcom: gcc-qcm2290: Set HW_CTRL_TRIGGER for video GDSC The venus video driver will uses dev_pm_genpd_set_hwmode() API to switch the video GDSC to HW and SW control modes at runtime. This requires domain to have the HW_CTRL_TRIGGER flag. Signed-off-by: Loic Poulain Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250613102245.782511-1-loic.poulain@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 25d12630561d8d0906f1f5eceb055da3af67c8c9 Author: George Moussalem Date: Fri May 16 16:36:10 2025 +0400 clk: qcom: ipq-cmn-pll: Add IPQ5018 SoC support The CMN PLL in IPQ5018 SoC supplies fixed clocks to XO, sleep, and the ethernet block. Signed-off-by: George Moussalem Link: https://lore.kernel.org/r/20250516-ipq5018-cmn-pll-v4-3-389a6b30e504@outlook.com Signed-off-by: Bjorn Andersson commit 693a723291d0634eaea24cff2f9d807f3223f204 Author: George Moussalem Date: Fri May 16 16:36:08 2025 +0400 clk: qcom: ipq5018: keep XO clock always on The XO clock must not be disabled to avoid the kernel trying to disable the it. As such, keep the XO clock always on by flagging it as critical. Signed-off-by: George Moussalem Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250516-ipq5018-cmn-pll-v4-1-389a6b30e504@outlook.com Signed-off-by: Bjorn Andersson commit 3c4ee2cc7f56f7097e045c7c0116071a530686a7 Merge: a2afa4c33f0a7f 314b903c300406 Author: Bjorn Andersson Date: Wed Jul 16 23:04:22 2025 -0500 Merge branch '20250516-ipq5018-cmn-pll-v4-2-389a6b30e504@outlook.com' into clk-for-6.17 Merge the IPQ5018 CMN PLL binding through a topic branch, to allow merging the clock defines into DeviceTree branch as well. commit 314b903c30040632db7edd187cd33003b2aee512 Author: George Moussalem Date: Fri May 16 16:36:09 2025 +0400 dt-bindings: clock: qcom: Add CMN PLL support for IPQ5018 SoC The CMN PLL block in the IPQ5018 SoC takes 96 MHZ as the reference input clock. Its output clocks are the XO (24Mhz), sleep (32Khz), and ethernet (50Mhz) clocks. Reviewed-by: Rob Herring (Arm) Signed-off-by: George Moussalem Link: https://lore.kernel.org/r/20250516-ipq5018-cmn-pll-v4-2-389a6b30e504@outlook.com Signed-off-by: Bjorn Andersson commit 4587d3910f805ac74348e6c320071a9b65be035e Author: Luca Weiss Date: Sun Jul 13 10:05:33 2025 +0200 dt-bindings: soc: qcom: qcom,pmic-glink: document Milos compatible Document the Milos compatible used to describe the pmic glink on this SoC. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250713-sm7635-fp6-initial-v2-11-e8f9a789505b@fairphone.com Signed-off-by: Bjorn Andersson commit 6cd06adc39ac92ebca04d5c0df5acb7f0ec5ff2d Author: Luca Weiss Date: Sun Jul 13 10:05:29 2025 +0200 dt-bindings: soc: qcom,aoss-qmp: document the Milos Always-On Subsystem side channel Document the Always-On Subsystem side channel on the Milos SoC. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250713-sm7635-fp6-initial-v2-7-e8f9a789505b@fairphone.com Signed-off-by: Bjorn Andersson commit 4405f3f7b44767c037270d8c40fe2fb3dc3454d0 Author: Luca Weiss Date: Sun Jul 13 10:05:26 2025 +0200 dt-bindings: firmware: qcom,scm: document Milos SCM Firmware Interface Document the SCM Firmware Interface on the Milos SoC. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250713-sm7635-fp6-initial-v2-4-e8f9a789505b@fairphone.com Signed-off-by: Bjorn Andersson commit 955a41218d2bd2ffadd0406b14a4b4efb67b056c Author: Kathiravan Thirumoorthy Date: Fri Jul 11 16:33:06 2025 +0530 soc: qcom: socinfo: Add support to retrieve APPSBL build details Add support to retrieve APPS (Application Processor Subsystem) Bootloader image details from SMEM. Signed-off-by: Kathiravan Thirumoorthy Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250711-appsbl_crm_version-v1-1-48b49b1dfdcf@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 65702c3d293e45d3cac5e4e175296a9c90404326 Author: Johan Hovold Date: Tue Jul 8 10:57:17 2025 +0200 soc: qcom: pmic_glink: fix OF node leak Make sure to drop the OF node reference taken when registering the auxiliary devices when the devices are later released. Fixes: 58ef4ece1e41 ("soc: qcom: pmic_glink: Introduce base PMIC GLINK driver") Cc: Bjorn Andersson Signed-off-by: Johan Hovold Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250708085717.15922-1-johan@kernel.org Signed-off-by: Bjorn Andersson commit 50b749fab108c2354bb6368d95aaec82e3c99912 Author: Rakesh Kota Date: Fri Jul 4 17:00:36 2025 +0530 soc: qcom: spmi-pmic: add more PMIC SUBTYPE IDs Add the PMM8650AU and PMM8650AU_PSAIL PMIC SUBTYPE IDs and These PMICs are used by the qcs8300 and qcs9100 platforms. Signed-off-by: Rakesh Kota Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250704113036.1627695-1-rakesh.kota@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9c4299b2361892a2eb8ab4ac63d07b97acd8a1ab Author: Luca Weiss Date: Wed Jun 25 11:11:46 2025 +0200 soc: qcom: socinfo: Add PM7550 & PMIV0108 PMICs Add the PM7550 and PMIV0108 to the pmic_models array. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250625-sm7635-socinfo-v1-3-be09d5c697b8@fairphone.com Signed-off-by: Bjorn Andersson commit 95f3b09e7e8c963c3206ce5450a88747c4653343 Author: Luca Weiss Date: Wed Jun 25 11:11:45 2025 +0200 soc: qcom: socinfo: Add SoC IDs for SM7635 family Add the entries for the 'volcano' family, namely SM7635, SM6650, SM6650P, QCM6690 and QCS6690. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250625-sm7635-socinfo-v1-2-be09d5c697b8@fairphone.com Signed-off-by: Bjorn Andersson commit e53ff5b79fbac35d1fbf2b8c28a5a5dcf125567e Author: Luca Weiss Date: Wed Jun 25 11:11:44 2025 +0200 dt-bindings: arm: qcom,ids: Add SoC IDs for SM7635 family Add the SoC IDs of the 'volcano' family, namely SM7635, SM6650, SM6650P, QCM6690 and QCS6690. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250625-sm7635-socinfo-v1-1-be09d5c697b8@fairphone.com Signed-off-by: Bjorn Andersson commit 7ab36b51c6bee56e1a1939063dd10d602fe49d13 Author: Bartosz Golaszewski Date: Mon Jun 30 14:12:05 2025 +0200 firmware: qcom: scm: request the waitqueue irq *after* initializing SCM There's a subtle race in the SCM driver: we assign the __scm pointer before requesting the waitqueue interrupt. Assigning __scm marks the SCM API as ready to accept calls. It's possible that a user makes a call right after we set __scm and the firmware raises an interrupt before the driver's ready to service it. Move the __scm assignment after we request the interrupt. This has the added benefit of allowing us to drop the goto label. Reviewed-by: Konrad Dybcio Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-4-fa3851c98611@linaro.org Signed-off-by: Bjorn Andersson commit 87be3e7a2d0030cda6314d2ec96b37991f636ccd Author: Bartosz Golaszewski Date: Mon Jun 30 14:12:04 2025 +0200 firmware: qcom: scm: initialize tzmem before marking SCM as available Now that qcom_scm_shm_bridge_enable() uses the struct device passed to it as argument to make the QCOM_SCM_MP_SHM_BRIDGE_ENABLE SCM call, we can move the TZMem initialization before the assignment of the __scm pointer in the SCM driver (which marks SCM as ready to users) thus fixing the potential race between consumer calls and the memory pool initialization. Reported-by: Johan Hovold Closes: https://lore.kernel.org/all/20250120151000.13870-1-johan+linaro@kernel.org/ Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-3-fa3851c98611@linaro.org Signed-off-by: Bjorn Andersson commit dc3f4e75c54c19bad9a70419afae00ce6baf3ebf Author: Bartosz Golaszewski Date: Mon Jun 30 14:12:03 2025 +0200 firmware: qcom: scm: take struct device as argument in SHM bridge enable qcom_scm_shm_bridge_enable() is used early in the SCM initialization routine. It makes an SCM call and so expects the internal __scm pointer in the SCM driver to be assigned. For this reason the tzmem memory pool is allocated *after* this pointer is assigned. However, this can lead to a crash if another consumer of the SCM API makes a call using the memory pool between the assignment of the __scm pointer and the initialization of the tzmem memory pool. As qcom_scm_shm_bridge_enable() is a special case, not meant to be called by ordinary users, pull it into the local SCM header. Make it take struct device as argument. This is the device that will be used to make the SCM call as opposed to the global __scm pointer. This will allow us to move the tzmem initialization *before* the __scm assignment in the core SCM driver. Signed-off-by: Bartosz Golaszewski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-2-fa3851c98611@linaro.org Signed-off-by: Bjorn Andersson commit 23972da96e1eee7f10c8ef641d56202ab9af8ba7 Author: Bartosz Golaszewski Date: Mon Jun 30 14:12:02 2025 +0200 firmware: qcom: scm: remove unused arguments from SHM bridge routines qcom_scm_shm_bridge_create() and qcom_scm_shm_bridge_delete() take struct device as argument but don't use it. Remove it from these functions' prototypes. Reviewed-by: Konrad Dybcio Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250630-qcom-scm-race-v2-1-fa3851c98611@linaro.org Signed-off-by: Bjorn Andersson commit 0768e980feb5cffe63920d375bebef3bb4654961 Merge: fd60aa0a45c150 0769857a07b445 Author: Alexei Starovoitov Date: Wed Jul 16 18:38:53 2025 -0700 Merge branch 'a-tool-to-verify-the-bpf-memory-model' Puranjay Mohan says: ==================== A tool to verify the BPF memory model I am building a tool called blitmus[1] that converts memory model litmus tests written in C into BPF programs that run in parallel to verify that the JITs are enforcing the memory model correctly. With this tool I was able to find a bug in the implementation of the smp_mb() in the selftests. Using the following litmus test: C SB+fencembonceonces (* * Result: Never * * This litmus test demonstrates that full memory barriers suffice to * order the store-buffering pattern, where each process writes to the * variable that the preceding process reads. (Locking and RCU can also * suffice, but not much else.) *) {} P0(int *x, int *y) { int r0; WRITE_ONCE(*x, 1); smp_mb(); r0 = READ_ONCE(*y); } P1(int *x, int *y) { int r0; WRITE_ONCE(*y, 1); smp_mb(); r0 = READ_ONCE(*x); } exists (0:r0=0 /\ 1:r0=0) Running the generated program on an ARMv8 machine: With the current implementation of smp_mb(): [root@fedora blitmus]# ./sb_fencembonceonces Starting litmus test with configuration: Test: SB+fencembonceonces Iterations: 4100 Test SB+fencembonceonces Allowed Histogram (4 states) 4545 *>0:r0=0; 1:r0=0; 20403742 :>0:r0=0; 1:r0=1; 20591700 :>0:r0=1; 1:r0=0; 13 :>0:r0=1; 1:r0=1; Ok Witnesses Positive: 4545, Negative: 40995455 Condition exists (0:r0=0 /\ 1:r0=0) is validated Observation SB+fencembonceonces Sometimes 4545 40995455 Time SB+fencembonceonces 8.33 Thu Jul 10 16:56:41 UTC Positive witnesses mean that smp_mb() is not working as expected and not providing any ordering. After applying the patch to fix smp_mb(): [root@fedora blitmus]# ./sb_fencembonceonces Starting litmus test with configuration: Test: SB+fencembonceonces Iterations: 4100 Test SB+fencembonceonces Allowed Histogram (3 states) 19657569 :>0:r0=0; 1:r0=1; 20227574 :>0:r0=1; 1:r0=0; 1114857 :>0:r0=1; 1:r0=1; No Witnesses Positive: 0, Negative: 41000000 Condition exists (0:r0=0 /\ 1:r0=0) is NOT validated Observation SB+fencembonceonces Never 0 41000000 Time SB+fencembonceonces 9.58 Thu Jul 10 16:56:10 UTC 0 positive witnesses mean that invalid behaviour is not seen and smp_mb() is ordering the operations properly. I hope to improve this tool more and use it to fuzz the JITs of ARMv8, RISC-V, and Power and see what other bugs can be exposed. [1] https://github.com/puranjaymohan/blitmus ==================== Link: https://patch.msgid.link/20250710175434.18829-1-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit 0769857a07b4451a1dc1c3ad1f1c86a6f4ce136a Author: Puranjay Mohan Date: Thu Jul 10 17:54:33 2025 +0000 selftests/bpf: fix implementation of smp_mb() As BPF doesn't include any barrier instructions, smp_mb() is implemented by doing a dummy value returning atomic operation. Such an operation acts a full barrier as enforced by LKMM and also by the work in progress BPF memory model. If the returned value is not used, clang[1] can optimize the value returning atomic instruction in to a normal atomic instruction which provides no ordering guarantees. Mark the variable as volatile so the above optimization is never performed and smp_mb() works as expected. [1] https://godbolt.org/z/qzze7bG6z Fixes: 88d706ba7cc5 ("selftests/bpf: Introduce arena spin lock") Signed-off-by: Puranjay Mohan Link: https://lore.kernel.org/r/20250710175434.18829-2-puranjay@kernel.org Signed-off-by: Alexei Starovoitov commit fd60aa0a45c1508cdcb982dbf25fd003a6b34e92 Author: Tao Chen Date: Wed Jul 16 21:46:54 2025 +0800 bpf/selftests: Add selftests for token info A previous change added bpf_token_info to get token info with bpf_get_obj_info_by_fd, this patch adds a new test for token info. #461/12 token/bpf_token_info:OK Acked-by: Andrii Nakryiko Signed-off-by: Tao Chen Link: https://lore.kernel.org/r/20250716134654.1162635-2-chen.dylane@linux.dev Signed-off-by: Alexei Starovoitov commit 19d18fdfc79217c86802271c9ce5b4ed174628cc Author: Tao Chen Date: Wed Jul 16 21:46:53 2025 +0800 bpf: Add struct bpf_token_info The 'commit 35f96de04127 ("bpf: Introduce BPF token object")' added BPF token as a new kind of BPF kernel object. And BPF_OBJ_GET_INFO_BY_FD already used to get BPF object info, so we can also get token info with this cmd. One usage scenario, when program runs failed with token, because of the permission failure, we can report what BPF token is allowing with this API for debugging. Acked-by: Andrii Nakryiko Signed-off-by: Tao Chen Link: https://lore.kernel.org/r/20250716134654.1162635-1-chen.dylane@linux.dev Signed-off-by: Alexei Starovoitov commit 8080500cba05d057dc6cfe4b6afbaf026eb2dd06 Author: Andrii Nakryiko Date: Wed Jul 16 10:59:36 2025 -0700 libbpf: start v1.7 dev cycle With libbpf 1.6.0 released, adjust libbpf.map and libbpf_version.h to start v1.7 development cycles. Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250716175936.2343013-1-andrii@kernel.org Signed-off-by: Alexei Starovoitov commit 62ef449b8d8e312ee06279da797702cdb19a9920 Author: Feng Yang Date: Thu Jul 10 13:54:19 2025 +0800 bpf: Clean up individual BTF_ID code Use BTF_ID_LIST_SINGLE(a, b, c) instead of BTF_ID_LIST(a) BTF_ID(b, c) Signed-off-by: Feng Yang Link: https://lore.kernel.org/r/20250710055419.70544-1-yangfeng59949@163.com Signed-off-by: Alexei Starovoitov commit 1f489662fba823c5063f99cd875516829be0c276 Author: Ilya Leoshkevich Date: Thu Jul 10 12:08:50 2025 +0200 bpf: Update iterators.lskel-big-endian.h The last iterators update (commit 515ee52b2224 ("bpf: make preloaded map iterators to display map elements count")) missed the big-endian skeleton. Update it by running "make big" with Debian clang version 21.0.0 (++20250706105601+01c97b4953e8-1~exp1~20250706225612.1558). Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250710100907.45880-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 13630f90426fe39b0d506c9d47142c63b61bb9c6 Merge: e860a98c8aebd8 4a760d2d7aa635 Author: Alexei Starovoitov Date: Wed Jul 16 18:28:30 2025 -0700 Merge branch 'bpf-arm64-relax-constraint-in-bpf-jit-compiler' Alexis Lothoré (eBPF Foundation) says: ==================== this series follows up on the one introducing 9+ args for tracing programs [1]. It has been observed with this series that there are cases for which we can not identify accurately the location of the target function arguments to prepare correctly the corresponding BPF trampoline. This is the case for example if: - the function consumes a struct variable _by value_ - it is passed on the stack (no more register available for it) - it has some __packed__ or __aligned(X)__ attribute As a consequence, a small restrictive check has been added to the ARM64 side, highlighting that other arch supporting 9+ args in BPF trampolines are already suffering from the same issue. After a bit of discussions and attempts, the chosen solution is, rather than applying the same constraint to all JIT compilers, to prevent such function from being encoded at all in BTF info([2]). As the pahole side is closed to be integrated, we can now remove the restrictive check from kernel side. [1] https://lore.kernel.org/bpf/20250527-many_args_arm64-v3-0-3faf7bb8e4a2@bootlin.com/ [2] https://lore.kernel.org/bpf/20250707-btf_skip_structs_on_stack-v3-0-29569e086c12@bootlin.com/ Signed-off-by: Alexis Lothoré (eBPF Foundation) --- Alexis Lothoré (eBPF Foundation) (2): bpf, arm64: remove structs on stack constraint selftests/bpf: enable tracing_struct tests for arm64 arch/arm64/net/bpf_jit_comp.c | 5 ----- tools/testing/selftests/bpf/DENYLIST.aarch64 | 1 - 2 files changed, 6 deletions(-) --- base-commit: 8da1e37fc84868b50ba6a7cdf082aa3b0d11e006 change-id: 20250708-arm64_relax_jit_comp-e8889647d8d2 Best regards, ==================== Link: https://patch.msgid.link/20250709-arm64_relax_jit_comp-v1-0-3850fe189092@bootlin.com Signed-off-by: Alexei Starovoitov commit 4a760d2d7aa6357428eadb6c3714f21a8b85cf6b Author: Alexis Lothoré (eBPF Foundation) Date: Wed Jul 9 10:36:56 2025 +0200 selftests/bpf: enable tracing_struct tests for arm64 Now that the constraint preventing attachment to functions consuming struct on stack has been removed from the kernel (and moved to pahole, with a slightly smarter detection, to prevent only those that are packed), re-enable the tracing_struct tests for arm64. Signed-off-by: Alexis Lothoré (eBPF Foundation) Link: https://lore.kernel.org/r/20250709-arm64_relax_jit_comp-v1-2-3850fe189092@bootlin.com Signed-off-by: Alexei Starovoitov commit dc704d0cfa431b5fbaa546941b3b82b4f318cb5f Author: Alexis Lothoré (eBPF Foundation) Date: Wed Jul 9 10:36:55 2025 +0200 bpf, arm64: remove structs on stack constraint While introducing support for 9+ arguments for tracing programs on ARM64, commit 9014cf56f13d ("bpf, arm64: Support up to 12 function arguments") has also introduced a constraint preventing BPF trampolines from being generated if the target function consumes a struct argument passed on stack, because of uncertainties around the exact struct location: if the struct has been marked as packed or with a custom alignment, this info is not reflected in BTF data, and so generated tracing trampolines could read the target function arguments at wrong offsets. This issue is not specific to ARM64: there has been an attempt (see [1]) to bring the same constraint to other architectures JIT compilers. But discussions following this attempt led to the move of this constraint out of the kernel (see [2]): instead of preventing the kernel from generating trampolines for those functions consuming structs on stack, it is simpler to just make sure that those functions with uncertain struct arguments location are not encoded in BTF information, and so that one can not even attempt to attach a tracing program to such function. The task is then deferred to pahole (see [3]). Now that the constraint is handled by pahole, remove it from the arm64 JIT compiler to keep it simple. [1] https://lore.kernel.org/bpf/20250613-deny_trampoline_structs_on_stack-v1-0-5be9211768c3@bootlin.com/ [2] https://lore.kernel.org/bpf/CAADnVQ+sj9XhscN9PdmTzjVa7Eif21noAUH3y1K6x5bWcL-5pg@mail.gmail.com/ [3] https://lore.kernel.org/bpf/20250707-btf_skip_structs_on_stack-v3-0-29569e086c12@bootlin.com/ Signed-off-by: Alexis Lothoré (eBPF Foundation) Link: https://lore.kernel.org/r/20250709-arm64_relax_jit_comp-v1-1-3850fe189092@bootlin.com Signed-off-by: Alexei Starovoitov commit cd031354087d8ae005404f0c552730f0bd33ac33 Merge: 727258025b933c 8890ee6dcf6e3d Author: Jakub Kicinski Date: Wed Jul 16 17:56:35 2025 -0700 Merge branch 'net-mlx5e-add-support-for-pcie-congestion-events' Tariq Toukan says: ==================== net/mlx5e: Add support for PCIe congestion events Dragos says: PCIe congestion events are events generated by the firmware when the device side has sustained PCIe inbound or outbound traffic above certain thresholds. The high and low threshold are hysteresis thresholds to prevent flapping: once the high threshold has been reached, a low threshold event will be triggered only after the bandwidth usage went below the low threshold. This series adds support for receiving and exposing such events as ethtool counters. 2 new pairs of counters are exposed: pci_bw_in/outbound_high/low. These should help the user understand if the device PCI is under pressure. Planned followup patches: - Allow configuration of thresholds through devlink. - Add ethtool counter for wakeups which did not result in any state change. ==================== Link: https://patch.msgid.link/1752589821-145787-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 8890ee6dcf6e3d396677308553a8a57f29c7109e Author: Dragos Tatulea Date: Tue Jul 15 17:30:21 2025 +0300 net/mlx5e: Add device PCIe congestion ethtool stats Implement the PCIe Congestion Event notifier which triggers a work item to query the PCIe Congestion Event object. The result of the congestion state is reflected in the new ethtool stats: * pci_bw_inbound_high: the device has crossed the high threshold for inbound PCIe traffic. * pci_bw_inbound_low: the device has crossed the low threshold for inbound PCIe traffic * pci_bw_outbound_high: the device has crossed the high threshold for outbound PCIe traffic. * pci_bw_outbound_low: the device has crossed the low threshold for outbound PCIe traffic The high and low thresholds are currently configured at 90% and 75%. These are hysteresis thresholds which help to check if the PCI bus on the device side is in a congested state. If low + 1 = high then the device is in a congested state. If low == high then the device is not in a congested state. The counters are also documented. A follow-up patch will make the thresholds configurable. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1752589821-145787-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ab2b0d4d639435f382583b107997a4ce805a665b Author: Dragos Tatulea Date: Tue Jul 15 17:30:20 2025 +0300 net/mlx5e: Create/destroy PCIe Congestion Event object Add initial infrastructure to create and destroy the PCIe Congestion Event object if the object is supported. The verb for the object creation function is "set" instead of "create" because the function will accommodate the modify operation as well in a subsequent patch. The next patches will hook it up to the event handler and will add actual functionality. Signed-off-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1752589821-145787-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 727258025b933c61e103318ec42e765a53d9b18d Author: Nagamani PV Date: Tue Jul 15 09:42:10 2025 +0200 s390/net: Remove NETIUCV device driver The netiucv driver creates TCP/IP interfaces over IUCV between Linux guests on z/VM and other z/VM entities. Rationale for removal: - NETIUCV connections are only supported for compatibility with earlier versions and not to be used for new network setups, since at least Linux kernel 4.0. - No known active users, use cases, or product dependencies - The driver is no longer relevant for z/VM networking; preferred methods include: * Device pass-through (e.g., OSA, RoCE) * z/VM Virtual Switch (VSWITCH) The IUCV mechanism itself remains supported and is actively used via AF_IUCV, hvc_iucv, and smsg_iucv. Signed-off-by: Nagamani PV Reviewed-by: Alexandra Winter Signed-off-by: Alexandra Winter Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250715074210.3999296-1-wintera@linux.ibm.com Signed-off-by: Jakub Kicinski commit 071a2ef56857918021159a1c4e10eadf74bfe5b4 Merge: 27b0286d00394c db400061b5e7cc Author: Jakub Kicinski Date: Wed Jul 16 17:28:40 2025 -0700 Merge branch 'expose-refclk-for-rmii-and-enable-rmii' Ryan Wanner says: ==================== Expose REFCLK for RMII and enable RMII This set allows the REFCLK property to be exposed as a dt-property to properly reflect the correct RMII layout. RMII can take an external or internal provided REFCLK, since this is not SoC dependent but board dependent this must be exposed as a DT property for the macb driver. This set also enables RMII mode for the SAMA7 SoCs gigabit mac. v1: https://lore.kernel.org/cover.1750346271.git.Ryan.Wanner@microchip.com ==================== Link: https://patch.msgid.link/cover.1752510727.git.Ryan.Wanner@microchip.com Signed-off-by: Jakub Kicinski commit db400061b5e7cc55f9b4dd15443e9838964119ea Author: Ryan Wanner Date: Mon Jul 14 09:37:02 2025 -0700 net: cadence: macb: sama7g5_emac: Remove USARIO CLKEN flag Remove USARIO_CLKEN flag since this is now a device tree argument and not fixed to the SoC. This will instead be selected by the "cdns,refclk-ext" device tree property. Signed-off-by: Ryan Wanner Link: https://patch.msgid.link/1e7a8c324526f631f279925aa8a6aa937d55c796.1752510727.git.Ryan.Wanner@microchip.com Signed-off-by: Jakub Kicinski commit eb4f50ddfdd3107f8d59edd5af0491620cca036c Author: Ryan Wanner Date: Mon Jul 14 09:37:01 2025 -0700 net: cadence: macb: Enable RMII for SAMA7 gem This macro enables the RMII mode bit in the USRIO register when RMII mode is requested. Signed-off-by: Ryan Wanner Link: https://patch.msgid.link/6698836e4ee7df5f6bee181f0d2e38d4b8e4cec2.1752510727.git.Ryan.Wanner@microchip.com Signed-off-by: Jakub Kicinski commit dce32ece3bb8f3768d04d01cbe146b7ac5ccdbde Author: Ryan Wanner Date: Mon Jul 14 09:37:00 2025 -0700 net: cadence: macb: Expose REFCLK as a device tree property The RMII and RGMII can both support internal or external provided REFCLKs 50MHz and 125MHz respectively. Since this is dependent on the board that the SoC is on this needs to be set via the device tree. This property flag is checked in the MACB DT node so the REFCLK cap is configured the correct way for the RMII or RGMII is configured on the board. Signed-off-by: Ryan Wanner Link: https://patch.msgid.link/7f9b65896d6b7b48275bc527b72a16347f8ce10a.1752510727.git.Ryan.Wanner@microchip.com Signed-off-by: Jakub Kicinski commit 1b7531c094c880f4e5a5ad8e3c7757c2c2f90a3f Author: Ryan Wanner Date: Mon Jul 14 09:36:59 2025 -0700 dt-bindings: net: cdns,macb: Add external REFCLK property REFCLK can be provided by an external source so this should be exposed by a DT property. The REFCLK is used for RMII and in some SoCs that use this driver the RGMII 125MHz clk can also be provided by an external source. Signed-off-by: Ryan Wanner Acked-by: Conor Dooley Link: https://patch.msgid.link/d558467c4d5b27fb3135ffdead800b14cd9c6c0a.1752510727.git.Ryan.Wanner@microchip.com Signed-off-by: Jakub Kicinski commit 27b0286d00394c178d0cde0388054c27ae4ae8f4 Merge: 6c628ed95e1b41 b3019343e4bde3 Author: Jakub Kicinski Date: Wed Jul 16 17:25:50 2025 -0700 Merge branch 'selftest-net-add-selftest-for-netpoll' Breno Leitao says: ==================== selftest: net: Add selftest for netpoll I am submitting a new selftest for the netpoll subsystem specifically targeting the case where the RX is polling in the TX path, which is a case that we don't have any test in the tree today. This is done when netpoll_poll_dev() called, and this test creates a scenario when that is probably. The test does the following: 1) Configuring a single RX/TX queue to increase contention on the interface. 2) Generating background traffic to saturate the network, mimicking real-world congestion. 3) Sending netconsole messages to trigger netpoll polling and monitor its behavior. 4) Using dynamic netconsole targets via configfs, with the ability to delete and recreate targets during the test. 5) Running bpftrace in parallel to verify that netpoll_poll_dev() is called when expected. If it is called, then the test passes, otherwise the test is marked as skipped. In order to achieve it, I stole Jakub's bpftrace helper from [1], and did some small changes that I found useful to use the helper. So, this patchset basically contains: 1) The code stolen from Jakub 2) Improvements on bpftrace() helper 3) The selftest itself Link: https://lore.kernel.org/all/20250421222827.283737-22-kuba@kernel.org/ [1] ==================== Link: https://patch.msgid.link/20250714-netpoll_test-v7-0-c0220cfaa63e@debian.org Signed-off-by: Jakub Kicinski commit b3019343e4bde385d1d59918b2e3ffa4eb340739 Author: Breno Leitao Date: Mon Jul 14 02:56:50 2025 -0700 selftests: net: add netpoll basic functionality test Add a basic selftest for the netpoll polling mechanism, specifically targeting the netpoll poll() side. The test creates a scenario where network transmission is running at maximum speed, and netpoll needs to poll the NIC. This is achieved by: 1. Configuring a single RX/TX queue to create contention 2. Generating background traffic to saturate the interface 3. Sending netconsole messages to trigger netpoll polling 4. Using dynamic netconsole targets via configfs 5. Delete and create new netconsole targets after some messages 6. Start a bpftrace in parallel to make sure netpoll_poll_dev() is called 7. If bpftrace exists and netpoll_poll_dev() was called, stop. The test validates a critical netpoll code path by monitoring traffic flow and ensuring netpoll_poll_dev() is called when the normal TX path is blocked. This addresses a gap in netpoll test coverage for a path that is tricky for the network stack. Signed-off-by: Breno Leitao Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250714-netpoll_test-v7-3-c0220cfaa63e@debian.org Signed-off-by: Jakub Kicinski commit fd2aadcefbacb4425f54c252ec9cfb8218548eb9 Author: Breno Leitao Date: Mon Jul 14 02:56:49 2025 -0700 selftests: drv-net: Strip '@' prefix from bpftrace map keys The '@' prefix in bpftrace map keys is specific to bpftrace and can be safely removed when processing results. This patch modifies the bpftrace utility to strip the '@' from map keys before storing them in the result dictionary, making the keys more consistent with Python conventions. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250714-netpoll_test-v7-2-c0220cfaa63e@debian.org Signed-off-by: Jakub Kicinski commit 3c561c547c396038c7690645cff4f98181c62d49 Author: Jakub Kicinski Date: Mon Jul 14 02:56:48 2025 -0700 selftests: drv-net: add helper/wrapper for bpftrace bpftrace is very useful for low level driver testing. perf or trace-cmd would also do for collecting data from tracepoints, but they require much more post-processing. Add a wrapper for running bpftrace and sanitizing its output. bpftrace has JSON output, which is great, but it prints loose objects and in a slightly inconvenient format. We have to read the objects line by line, and while at it return them indexed by the map name. Reviewed-by: Breno Leitao Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250714-netpoll_test-v7-1-c0220cfaa63e@debian.org Signed-off-by: Jakub Kicinski commit ef57dc6f52e4949527f82a456cb9a637a55209ea Author: Song Yoong Siang Date: Wed Jul 16 23:48:46 2025 +0800 doc: xdp: Clarify driver implementation for XDP Rx metadata Clarify that drivers must remove device-reserved metadata from the data_meta area before passing frames to XDP programs. Additionally, expand the explanation of how userspace and BPF programs should coordinate the use of METADATA_SIZE, and add a detailed diagram to illustrate pointer adjustments and metadata layout. Also describe the requirements and constraints enforced by bpf_xdp_adjust_meta(). Signed-off-by: Song Yoong Siang Signed-off-by: Martin KaFai Lau Acked-by: Stanislav Fomichev Link: https://lore.kernel.org/r/20250716154846.3513575-1-yoong.siang.song@intel.com commit 6c628ed95e1b41f98766268593196adb7a0cb9a7 Author: Yue Haibing Date: Tue Jul 15 20:07:09 2025 +0800 ipv6: mcast: Simplify mld_clear_{report|query}() Use __skb_queue_purge() instead of re-implementing it. Note that it uses kfree_skb_reason() instead of kfree_skb() internally, and pass SKB_DROP_REASON_QUEUE_PURGE drop reason to the kfree_skb tracepoint. Signed-off-by: Yue Haibing Reviewed-by: Hangbin Liu Link: https://patch.msgid.link/20250715120709.3941510-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 47ee43e4bf50be16a142df1bf51e04b4bc5a6cdc Author: Stefano Garzarella Date: Tue Jul 15 11:32:33 2025 +0200 vsock/test: fix vsock_ioctl_int() check for unsupported ioctl `vsock_do_ioctl` returns -ENOIOCTLCMD if an ioctl support is not implemented, like for SIOCINQ before commit f7c722659275 ("vsock: Add support for SIOCINQ ioctl"). In net/socket.c, -ENOIOCTLCMD is re-mapped to -ENOTTY for the user space. So, our test suite, without that commit applied, is failing in this way: 34 - SOCK_STREAM ioctl(SIOCINQ) functionality...ioctl(21531): Inappropriate ioctl for device Return false in vsock_ioctl_int() to skip the test in this case as well, instead of failing. Fixes: 53548d6bffac ("test/vsock: Add retry mechanism to ioctl wrapper") Cc: niuxuewei.nxw@antgroup.com Signed-off-by: Stefano Garzarella Reviewed-by: Xuewei Niu Link: https://patch.msgid.link/20250715093233.94108-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit 7eeabfb23738eaa01d94342550e30d9f8502b8df Author: Paolo Abeni Date: Tue Jul 15 10:13:58 2025 +0200 tcp: fix UaF in tcp_prune_ofo_queue() The CI reported a UaF in tcp_prune_ofo_queue(): BUG: KASAN: slab-use-after-free in tcp_prune_ofo_queue+0x55d/0x660 Read of size 4 at addr ffff8880134729d8 by task socat/20348 CPU: 0 UID: 0 PID: 20348 Comm: socat Not tainted 6.16.0-rc5-virtme #1 PREEMPT(full) Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 Call Trace: dump_stack_lvl+0x82/0xd0 print_address_description.constprop.0+0x2c/0x400 print_report+0xb4/0x270 kasan_report+0xca/0x100 tcp_prune_ofo_queue+0x55d/0x660 tcp_try_rmem_schedule+0x855/0x12e0 tcp_data_queue+0x4dd/0x2260 tcp_rcv_established+0x5e8/0x2370 tcp_v4_do_rcv+0x4ba/0x8c0 __release_sock+0x27a/0x390 release_sock+0x53/0x1d0 tcp_sendmsg+0x37/0x50 sock_write_iter+0x3c1/0x520 vfs_write+0xc09/0x1210 ksys_write+0x183/0x1d0 do_syscall_64+0xc1/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcf73ef2337 Code: 0f 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 RSP: 002b:00007ffd4f924708 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcf73ef2337 RDX: 0000000000002000 RSI: 0000555f11d1a000 RDI: 0000000000000008 RBP: 0000555f11d1a000 R08: 0000000000002000 R09: 0000000000000000 R10: 0000000000000040 R11: 0000000000000246 R12: 0000000000000008 R13: 0000000000002000 R14: 0000555ee1a44570 R15: 0000000000002000 Allocated by task 20348: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 __kasan_slab_alloc+0x59/0x70 kmem_cache_alloc_node_noprof+0x110/0x340 __alloc_skb+0x213/0x2e0 tcp_collapse+0x43f/0xff0 tcp_try_rmem_schedule+0x6b9/0x12e0 tcp_data_queue+0x4dd/0x2260 tcp_rcv_established+0x5e8/0x2370 tcp_v4_do_rcv+0x4ba/0x8c0 __release_sock+0x27a/0x390 release_sock+0x53/0x1d0 tcp_sendmsg+0x37/0x50 sock_write_iter+0x3c1/0x520 vfs_write+0xc09/0x1210 ksys_write+0x183/0x1d0 do_syscall_64+0xc1/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 20348: kasan_save_stack+0x24/0x50 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x38/0x50 kmem_cache_free+0x149/0x330 tcp_prune_ofo_queue+0x211/0x660 tcp_try_rmem_schedule+0x855/0x12e0 tcp_data_queue+0x4dd/0x2260 tcp_rcv_established+0x5e8/0x2370 tcp_v4_do_rcv+0x4ba/0x8c0 __release_sock+0x27a/0x390 release_sock+0x53/0x1d0 tcp_sendmsg+0x37/0x50 sock_write_iter+0x3c1/0x520 vfs_write+0xc09/0x1210 ksys_write+0x183/0x1d0 do_syscall_64+0xc1/0x380 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888013472900 which belongs to the cache skbuff_head_cache of size 232 The buggy address is located 216 bytes inside of freed 232-byte region [ffff888013472900, ffff8880134729e8) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13472 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff88800198fb40 ffffea0000347b10 ffffea00004f5290 raw: 0000000000000000 0000000000120012 00000000f5000000 0000000000000000 head: 0080000000000040 ffff88800198fb40 ffffea0000347b10 ffffea00004f5290 head: 0000000000000000 0000000000120012 00000000f5000000 0000000000000000 head: 0080000000000001 ffffea00004d1c81 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888013472880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888013472900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888013472980: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ^ ffff888013472a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888013472a80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb Indeed tcp_prune_ofo_queue() is reusing the skb dropped a few lines above. The caller wants to enqueue 'in_skb', lets check space vs the latter. Fixes: 1d2fbaad7cd8 ("tcp: stronger sk_rcvbuf checks") Signed-off-by: Paolo Abeni Tested-by: syzbot+865aca08c0533171bf6a@syzkaller.appspotmail.com Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/b78d2d9bdccca29021eed9a0e7097dd8dc00f485.1752567053.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 23b128bba76776541dc09efaf3acf6242917e1f0 Author: Lyude Paul Date: Thu Jul 10 18:51:13 2025 -0400 rust: time: Pass correct timer mode ID to hrtimer_start_range_ns While rebasing rvkms I noticed that timers I was setting seemed to have pretty random timer values that amounted slightly over 2x the time value I set each time. After a lot of debugging, I finally managed to figure out why: it seems that since we moved to Instant and Delta, we mistakenly began passing the clocksource ID to hrtimer_start_range_ns, when we should be passing the timer mode instead. Presumably, this works fine for simple relative timers - but immediately breaks on other types of timers. So, fix this by passing the ID for the timer mode instead. Signed-off-by: Lyude Paul Acked-by: Andreas Hindborg Reviewed-by: FUJITA Tomonori Fixes: e0c0ab04f678 ("rust: time: Make HasHrTimer generic over HrTimerMode") Link: https://lore.kernel.org/r/20250710225129.670051-1-lyude@redhat.com [ Removed cast, applied `rustfmt`, fixed `Fixes:` tag. - Miguel ] Signed-off-by: Miguel Ojeda commit 262ab205180d2ba3ab6110899a4dbe439c51dfaa Author: Pavel Begunkov Date: Wed Jul 16 22:04:09 2025 +0100 io_uring/zcrx: account area memory zcrx areas can be quite large and need to be accounted and checked against RLIMIT_MEMLOCK. In practise it shouldn't be a big issue as the inteface already requires cap_net_admin. Cc: stable@vger.kernel.org Fixes: cf96310c5f9a0 ("io_uring/zcrx: add io_zcrx_area") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/4b53f0c575bd062f63d12bec6cac98037fc66aeb.1752699568.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 11fbada7184f9e19bcdfa2f6b15828a78b8897a6 Author: Pavel Begunkov Date: Wed Jul 16 22:04:08 2025 +0100 io_uring: export io_[un]account_mem Export pinned memory accounting helpers, they'll be used by zcrx shortly. Cc: stable@vger.kernel.org Fixes: cf96310c5f9a0 ("io_uring/zcrx: add io_zcrx_area") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/9a61e54bd89289b39570ae02fe620e12487439e4.1752699568.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 511ad4c26446e5254b94352f55067c501d319462 Author: Jakub Kicinski Date: Tue Jul 15 07:28:49 2025 -0700 selftests: packetdrill: correct the expected timing in tcp_rcv_big_endseq Commit f5fda1a86884 ("selftests/net: packetdrill: add tcp_rcv_big_endseq.pkt") added this test recently, but it's failing with: # tcp_rcv_big_endseq.pkt:41: error handling packet: timing error: expected outbound packet at 1.230105 sec but happened at 1.190101 sec; tolerance 0.005046 sec # script packet: 1.230105 . 1:1(0) ack 54001 win 0 # actual packet: 1.190101 . 1:1(0) ack 54001 win 0 It's unclear why the test expects the ack to be delayed. Correct it. Link: https://patch.msgid.link/20250715142849.959444-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 410b0ace8891a324d31efdc445b07b0e3054a68c Author: Gal Pressman Date: Tue Jul 15 17:07:54 2025 +0300 ethtool: Don't check for RXFH fields conflict when no input_xfrm is requested The requirement of ->get_rxfh_fields() in ethtool_set_rxfh() is there to verify that we have no conflict of input_xfrm with the RSS fields options, there is no point in doing it if input_xfrm is not supported/requested. This is under the assumption that a driver that supports input_xfrm will also support ->get_rxfh_fields(), so add a WARN_ON() to ethtool_check_ops() to verify it, and remove the op NULL check. This fixes the following error in mlx4_en, which doesn't support getting/setting RXFH fields. $ ethtool --set-rxfh-indir eth2 hfunc xor Cannot set RX flow hash configuration: Operation not supported Fixes: 72792461c8e8 ("net: ethtool: don't mux RXFH via rxnfc callbacks") Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20250715140754.489677-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 3047957cc7c19433dc8b88a7fec471efa13ba034 Author: Hangbin Liu Date: Tue Jul 15 04:34:59 2025 +0000 selftests: rtnetlink: fix addrlft test flakiness on power-saving systems Jakub reported that the rtnetlink test for the preferred lifetime of an address has become quite flaky. The issue started appearing around the 6.16 merge window in May, and the test fails with: FAIL: preferred_lft addresses remaining The flakiness might be related to power-saving behavior, as address expiration is handled by a "power-efficient" workqueue. To address this, use slowwait to check more frequently whether the address still exists. This reduces the likelihood of the system entering a low-power state during the test, improving reliability. Reported-by: Jakub Kicinski Signed-off-by: Hangbin Liu Link: https://patch.msgid.link/20250715043459.110523-1-liuhangbin@gmail.com Signed-off-by: Jakub Kicinski commit 77580e801a981f0c24c886460840d1ed70c794ae Merge: 8ecb65b7b68ea4 d4b29ddf82a458 Author: Miguel Ojeda Date: Wed Jul 16 23:45:08 2025 +0200 Merge tag 'rust-timekeeping-for-v6.17' of https://github.com/Rust-for-Linux/linux into rust-next Pull timekeeping updates from Andreas Hindborg: - Make 'Instant' generic over clock source. This allows the compiler to assert that arithmetic expressions involving the 'Instant' use 'Instants' based on the same clock source. - Make 'HrTimer' generic over the timer mode. 'HrTimer' timers take a 'Duration' or an 'Instant' when setting the expiry time, depending on the timer mode. With this change, the compiler can check the type matches the timer mode. - Add an abstraction for 'fsleep'. 'fsleep' is a flexible sleep function that will select an appropriate sleep method depending on the requested sleep time. - Avoid 64-bit divisions on 32-bit hardware when calculating timestamps. - Seal the 'HrTimerMode' trait. This prevents users of the 'HrTimerMode' from implementing the trait on their own types. * tag 'rust-timekeeping-for-v6.17' of https://github.com/Rust-for-Linux/linux: rust: time: Add wrapper for fsleep() function rust: time: Seal the HrTimerMode trait rust: time: Remove Ktime in hrtimer rust: time: Make HasHrTimer generic over HrTimerMode rust: time: Add HrTimerExpires trait rust: time: Replace HrTimerMode enum with trait-based mode types rust: time: Add ktime_get() to ClockSource trait rust: time: Make Instant generic over ClockSource rust: time: Replace ClockId enum with ClockSource trait rust: time: Avoid 64-bit integer division on 32-bit architectures commit 9a8682f0875b8cedad42bdfe601e6ab204fad06d Author: FUJITA Tomonori Date: Fri Jul 11 13:09:47 2025 +0900 rust: net::phy Change module_phy_driver macro to use module_device_table macro Change module_phy_driver macro to build device tables which are exported to userspace by using module_device_table macro. Acked-by: Jakub Kicinski Reviewed-by: Trevor Gross Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250711040947.1252162-4-fujita.tomonori@gmail.com Signed-off-by: Danilo Krummrich commit f65a3218fd92cbe3e00f25427e1c9255b8973b31 Author: FUJITA Tomonori Date: Fri Jul 11 13:09:46 2025 +0900 rust: net::phy represent DeviceId as transparent wrapper over mdio_device_id Refactor the DeviceId struct to be a #[repr(transparent)] wrapper around the C struct bindings::mdio_device_id. This refactoring is a preparation for enabling the PHY abstractions to use the RawDeviceId trait. Acked-by: Jakub Kicinski Reviewed-by: Trevor Gross Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250711040947.1252162-3-fujita.tomonori@gmail.com Signed-off-by: Danilo Krummrich commit 8d84b32075fb2d9bd95c7e47b165942411d74bba Author: FUJITA Tomonori Date: Fri Jul 11 13:09:45 2025 +0900 rust: device_id: split out index support into a separate trait Introduce a new trait `RawDeviceIdIndex`, which extends `RawDeviceId` to provide support for device ID types that include an index or context field (e.g., `driver_data`). This separates the concerns of layout compatibility and index-based data embedding, and allows `RawDeviceId` to be implemented for types that do not contain a `driver_data` field. Several such structures are defined in include/linux/mod_devicetable.h. Refactor `IdArray::new()` into a generic `build()` function, which takes an optional offset. Based on the presence of `RawDeviceIdIndex`, index writing is conditionally enabled. A new `new_without_index()` constructor is also provided for use cases where no index should be written. This refactoring is a preparation for enabling the PHY abstractions to use the RawDeviceId trait. The changes to acpi.rs and driver.rs were made by Danilo. Reviewed-by: Trevor Gross Signed-off-by: FUJITA Tomonori Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250711040947.1252162-2-fujita.tomonori@gmail.com Signed-off-by: Danilo Krummrich commit 2f5606afa4c2bcabd45cb34c92faf93ca5ffe75e Author: Alice Ryhl Date: Fri Jul 11 08:04:37 2025 +0000 device: rust: rename Device::as_ref() to Device::from_raw() The prefix as_* should not be used for a constructor. Constructors usually use the prefix from_* instead. Some prior art in the stdlib: Box::from_raw, CString::from_raw, Rc::from_raw, Arc::from_raw, Waker::from_raw, File::from_raw_fd. There is also prior art in the kernel crate: cpufreq::Policy::from_raw, fs::File::from_raw_file, Kuid::from_raw, ARef::from_raw, SeqFile::from_raw, VmaNew::from_raw, Io::from_raw. Link: https://lore.kernel.org/r/aCd8D5IA0RXZvtcv@pollux Signed-off-by: Alice Ryhl Reviewed-by: Benno Lossin Reviewed-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250711-device-as-ref-v2-1-1b16ab6402d7@google.com Signed-off-by: Danilo Krummrich commit deb016c1669002e48c431d6fd32ea1c20ef41756 Author: Andreas Gruenbacher Date: Wed Jul 16 23:30:32 2025 +0200 gfs2: No more self recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. Not only is that a very bad idea, it has also never worked because gfs2_recover_func() will refuse to do anything during a withdraw. However, before even getting to this point, gfs2_recover_func() dereferences sdp->sd_jdesc->jd_inode. This was a use-after-free before commit 04133b607a78 ("gfs2: Prevent double iput for journal on error") and is a NULL pointer dereference since then. Simply get rid of self recovery to fix that. Fixes: 601ef0d52e96 ("gfs2: Force withdraw to replay journals and wait for it to finish") Reported-by: Chunjie Zhu Signed-off-by: Andreas Gruenbacher commit 685a755089f95b7e205c0202567d9a647f9de096 Author: Mason Chang Date: Mon May 26 18:26:59 2025 +0800 thermal/drivers/mediatek/lvts_thermal: Add mt7988 lvts commands These commands are necessary to avoid severely abnormal and inaccurate temperature readings that are caused by using the default commands. Signed-off-by: Mason Chang Link: https://lore.kernel.org/r/20250526102659.30225-4-mason-cw.chang@mediatek.com Signed-off-by: Daniel Lezcano commit 6203a5e6fd090ed05f6d9b92e33bc7e7679a3dd6 Author: Mason Chang Date: Mon May 26 18:26:58 2025 +0800 thermal/drivers/mediatek/lvts_thermal: Add lvts commands and their sizes to driver data Add LVTS commands and their sizes to driver data in preparation for adding different commands. Signed-off-by: Mason Chang Link: https://lore.kernel.org/r/20250526102659.30225-3-mason-cw.chang@mediatek.com Signed-off-by: Daniel Lezcano commit c5d5a72c01f7faabe7cc0fd63942c18372101daf Author: Mason Chang Date: Mon May 26 18:26:57 2025 +0800 thermal/drivers/mediatek/lvts_thermal: Change lvts commands array to static const Change the LVTS commands array to static const in preparation for adding different commands. Signed-off-by: Mason Chang Link: https://lore.kernel.org/r/20250526102659.30225-2-mason-cw.chang@mediatek.com Signed-off-by: Daniel Lezcano commit 84684c57c9cd47b86c883a7170dd68222d97ef13 Author: Maulik Shah Date: Mon Jun 23 11:19:43 2025 +0530 soc: qcom: rpmh-rsc: Add RSC version 4 support Register offsets for v3 and v4 versions are backward compatible. Assign v3 offsets for v4 and all higher versions to avoid end up using v2 offsets. Signed-off-by: Maulik Shah Reviewed-by: Konrad Dybcio Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250623-rsc_v4-v1-1-275b27bc5e3c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b873adfddeeb337fa8e9f381fd35eb94f7887f2f Merge: 12b3d697c812aa d03fcf50ba56f4 Author: Dave Jiang Date: Wed Jul 16 13:30:17 2025 -0700 Merge branch 'for-6.17/cxl-acquire' into cxl-for-next Introduce ACQUIRE() and ACQUIRE_ERR() for conditional locks. Convert CXL subsystem to use the new macros. commit 9ffab039bcb0bbfade0e659552d2fb912347a871 Author: Jesse Zhang Date: Fri Jul 4 15:17:43 2025 +0800 drm/amdgpu: Replace HQD terminology with slots naming The term "HQD" is CP-specific and doesn't accurately describe the queue resources for other IP blocks like SDMA, VCN, or VPE. This change: 1. Renames `num_hqds` to `num_slots` in amdgpu_kms.c to better reflect the generic nature of the resource counting 2. Updates the UAPI struct member from `userq_num_hqds` to `userq_num_slots` 3. Maintains the same functionality while using more appropriate terminology Signed-off-by: Jesse Zhang Reviewed-by: Marek Olšák Signed-off-by: Alex Deucher commit 78d0a27ae0e2e70b22895f4b388cc0ab88e3c6ca Author: Jesse Zhang Date: Wed Jun 25 15:29:45 2025 +0800 drm/amdgpu: Add user queue instance count in HW IP info This change exposes the number of available user queue instances for each hardware IP type (GFX, COMPUTE, SDMA) through the drm_amdgpu_info_hw_ip interface. Key changes: 1. Added userq_num_instance field to drm_amdgpu_info_hw_ip structure 2. Implemented counting of available HQD slots using: - mes.gfx_hqd_mask for GFX queues - mes.compute_hqd_mask for COMPUTE queues - mes.sdma_hqd_mask for SDMA queues 3. Only counts available instances when user queues are enabled (!disable_uq) v2: using the adev->mes.gfx_hqd_mask[]/compute_hqd_mask[]/sdma_hqd_mask[] masks to determine the number of queue slots available for each engine type (Alex) v3: rename userq_num_instance to userq_num_hqds (Alex) Suggested-by: Alex Deucher Reviewed-by: Alex Deucher Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 55d42f6169760d052330f3c949c02e37867b87d8 Author: Pratap Nirujogi Date: Mon Jun 23 18:44:50 2025 -0400 drm/amd/amdgpu: Add helper functions for isp buffers Accessing amdgpu internal data structures "struct amdgpu_device" and "struct amdgpu_bo" in ISP V4L2 driver to alloc/free GART buffers is not recommended. Add new amdgpu_isp helper functions that takes opaque params from ISP V4L2 driver and calls the amdgpu internal functions amdgpu_bo_create_isp_user() and amdgpu_bo_create_kernel() to alloc/free GART buffers. Reviewed-by: Mario Limonciello Signed-off-by: Pratap Nirujogi Signed-off-by: Alex Deucher commit e36519f5c8035f1685b39690ed330ac3b2c978a2 Author: Pratap Nirujogi Date: Tue Jun 24 19:15:00 2025 -0400 drm/amd/amdgpu: Initialize swnode for ISP MFD device Create amd_isp_capture MFD device with swnode initialized to isp specific software_node part of fwnode graph in amd_isp4 x86/platform driver. The isp driver use this swnode handle to retrieve the critical properties (data-lanes, mipi phyid, link-frequencies etc.) required for camera to work on AMD ISP4 based targets. Reviewed-by: Mario Limonciello Signed-off-by: Pratap Nirujogi Signed-off-by: Alex Deucher commit 2becafc319db3d96205320f31cc0de4ee5a93747 Author: Eeli Haapalainen Date: Mon Jul 14 08:13:09 2025 +0300 drm/amdgpu/gfx8: reset compute ring wptr on the GPU on resume Commit 42cdf6f687da ("drm/amdgpu/gfx8: always restore kcq MQDs") made the ring pointer always to be reset on resume from suspend. This caused compute rings to fail since the reset was done without also resetting it for the firmware. Reset wptr on the GPU to avoid a disconnect between the driver and firmware wptr. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3911 Fixes: 42cdf6f687da ("drm/amdgpu/gfx8: always restore kcq MQDs") Signed-off-by: Eeli Haapalainen Signed-off-by: Alex Deucher commit d524d40e3a6152a3ea1125af729f8cd8ca65efde Author: Umio Yasuno Date: Tue Jul 15 14:44:35 2025 +0000 drm/amd/pm: fix null pointer access Writing a string without delimiters (' ', '\n', '\0') to the under gpu_od/fan_ctrl sysfs or pp_power_profile_mode for the CUSTOM profile will result in a null pointer dereference. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4401 Signed-off-by: Umio Yasuno Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 82a7c94fcecd104fa70766caaf6423e84bf588cb Author: Alex Deucher Date: Tue Jul 15 11:37:56 2025 -0400 drm/amdgpu/jpeg: clean up reset type handling Make the handling consistent with other IPs and across JPEG versions. Reviewed-by: Sathishkumar S Signed-off-by: Alex Deucher commit 084300fef58049eee71091f04e992959ac850d3c Author: Christian König Date: Thu Jun 5 14:17:09 2025 +0200 drm/amdgpu: rework gmc_v9_0_get_coherence_flags v2 Avoid using the mapping here. v2: use amdgpu_xgmi_same_hive() as suggested by Felix Signed-off-by: Christian König Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit d7767a1fd46b386ce930e734a5f6de7a02aede11 Author: Alex Deucher Date: Mon Jun 16 17:15:27 2025 -0400 drm/amdgpu/vcn3: implement ring reset Use the new helpers to handle engine resets for VCN. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit 63b8c9fdfb7f822d13f1591b71a739a40513c0bf Author: Alex Deucher Date: Mon Jun 16 17:07:22 2025 -0400 drm/amdgpu/vcn2.5: implement ring reset Use the new helpers to handle engine resets for VCN. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit 64ac00974754fd340452970ab019a8666ee8fa2c Author: Alex Deucher Date: Mon Jun 16 16:37:34 2025 -0400 drm/amdgpu/vcn2: implement ring reset Use the new helpers to handle engine resets for VCN. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit 7b6cde7f4e85d29f39779ff9cb7ed0203ad7e153 Author: Alex Deucher Date: Mon Jun 16 16:01:25 2025 -0400 drm/amdgpu/vcn: add a helper framework for engine resets With engine resets we reset all queues on the engine rather than just a single queue. Add a framework to handle this similar to SDMA. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit 3871149081b0d800d336791b208f541bdb8b457c Author: Alex Deucher Date: Thu May 29 15:26:37 2025 -0400 drm/amdgpu/vcn5: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit 6166e37afd1723866e1e45c13338107b4fc868fa Author: Alex Deucher Date: Thu May 29 15:26:08 2025 -0400 drm/amdgpu/vcn4.0.5: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit 64c54f0aa207580f55adabf18afc44a97fd4c91e Author: Alex Deucher Date: Thu May 29 15:25:52 2025 -0400 drm/amdgpu/vcn4.0.3: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Signed-off-by: Alex Deucher commit d156ba39704ed610f47dea901dca281900e33c6f Author: Alex Deucher Date: Thu May 29 15:25:05 2025 -0400 drm/amdgpu/vcn4: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit 8bea669e67aab1147d674d989202956b7e79ec36 Author: Alex Deucher Date: Thu May 29 15:24:11 2025 -0400 drm/amdgpu/jpeg5.0.1: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Signed-off-by: Alex Deucher commit e708f2cb56c08b8dd535202e7bf007fc1a2aeb64 Author: Alex Deucher Date: Thu May 29 13:05:35 2025 -0400 drm/amdgpu/jpeg5: add queue reset Add queue reset support for jpeg 5.0.0. Use the new helpers to re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit cf07ece3a81f9696548b785dc481f18b4ea59dd4 Author: Alex Deucher Date: Thu Jun 5 18:11:11 2025 -0400 drm/amdgpu/jpeg4.0.5: add queue reset Add queue reset support for jpeg 4.0.5. Use the new helpers to re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit 98f16636a2fcebff67d6c488ed393287d3321c07 Author: Alex Deucher Date: Thu May 29 15:22:52 2025 -0400 drm/amdgpu/jpeg4.0.3: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Signed-off-by: Alex Deucher commit 429ccbf6f4418e0e823d3470591fb4a99aadb09e Author: Alex Deucher Date: Thu May 29 15:22:36 2025 -0400 drm/amdgpu/jpeg4: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit b81891589be1fb6c963d3b6752a50d56fef6a030 Author: Alex Deucher Date: Thu May 29 15:22:20 2025 -0400 drm/amdgpu/jpeg3: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit bb7928f9fc697294a0026b1a2e28386aa762d001 Author: Alex Deucher Date: Thu May 29 15:22:01 2025 -0400 drm/amdgpu/jpeg2.5: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit 3c9e205f325ab2eba11c1ce5e6fb63fa9613f60f Author: Alex Deucher Date: Thu May 29 15:21:46 2025 -0400 drm/amdgpu/jpeg2: re-emit unprocessed state on ring reset Re-emit the unprocessed state after resetting the queue. Reviewed-by: Sathishkumar S Tested-by: Sathishkumar S Signed-off-by: Alex Deucher commit 461f43b9b65ed10d9bdebcca87312713f4adcbfd Author: Asad Kamal Date: Tue Jul 15 13:40:43 2025 +0800 drm/amd/pm: Remove unnecessary variable Remove unnecessary variable ret from smu_v13_0_12_get_smu_metrics_data Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507150618.WOfvWsQF-lkp@intel.com Signed-off-by: Asad Kamal Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 25c314aa3ec3d30e4ee282540e2096b5c66a2437 Author: Lijo Lazar Date: Mon Jul 14 10:37:00 2025 +0530 drm/amdgpu: Increase reset counter only on success Increment the reset counter only if soft recovery succeeded. This is consistent with a ring hard reset behaviour where counter gets incremented only if hard reset succeeded. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 9ad73536f8758e53e266c81f6f0fcbb90b349b6b Author: Lijo Lazar Date: Sat Jul 12 12:10:48 2025 +0530 drm/amd/pm: Get max/min frequency on aldebaran VF PMFW interface to get max/min frequencies is not available on aldebaran VFs. Use data, if available, in DPM tables to get the max/min frequencies. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit ec8fbb44b51ef5cf82ef09043387879276e9ba6b Author: Alex Deucher Date: Wed Jun 18 09:49:05 2025 -0400 drm/amdgpu: make compute timeouts consistent For kernel compute queues, align the timeout with other kernel queues (10 sec). This had previously been set higher for OpenCL when it used kernel queues, but now OpenCL uses KFD user queues which don't have a timeout limitation. This also aligns with SR-IOV which already used a shorter timeout. Additionally the longer timeout negatively impacts the user experience with kernel queues for interactive applications. Reviewed-by: Kent Russell Signed-off-by: Alex Deucher commit 991f2e0c63a7513202faab90a470ebb46e227541 Author: Tony Yi Date: Mon Jun 9 14:09:28 2025 -0500 drm/amdgpu: Check SQ_CONFIG register support on SRIOV On SRIOV environments, check if RLCG supports SQ_CONFIG register programming. Signed-off-by: Tony Yi Reviewed-by: Zhigang Luo Signed-off-by: Alex Deucher commit 77cc0da39c7ce203cd3ce6bc5696421947a979d7 Author: Alex Deucher Date: Tue May 27 21:35:00 2025 -0400 drm/amdgpu: track ring state associated with a fence We need to know the wptr and sequence number associated with a fence so that we can re-emit the unprocessed state after a ring reset. Pre-allocate storage space for the ring buffer contents and add helpers to save off and re-emit the unprocessed state so that it can be re-emitted after the queue is reset. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit ae332ec0009d762982540635411caefeafa92a5b Author: Nicolas Frattaroli Date: Tue Jun 10 14:32:41 2025 +0200 thermal/drivers/rockchip: Support reading trim values from OTP Many of the Rockchip SoCs support storing trim values for the sensors in factory programmable memory. These values specify a fixed offset from the sensor's returned temperature to get a more accurate picture of what temperature the silicon is actually at. The way this is implemented is with various OTP cells, which may be absent. There may both be whole-TSADC trim values, as well as per-sensor trim values. In the downstream driver, whole-chip trim values override the per-sensor trim values. This rewrite of the functionality changes the semantics to something I see as slightly more useful: allow the whole-chip trim values to serve as a fallback for lacking per-sensor trim values, instead of overriding already present sensor trim values. Additionally, the chip may specify an offset (trim_base, trim_base_frac) in degrees celsius and degrees decicelsius respectively which defines what the basis is from which the trim, if any, should be calculated from. By default, this is 30 degrees Celsius, but the chip can once again specify a different value through OTP cells. The implementation of these trim calculations have been tested extensively on an RK3576, where it was confirmed to get rid of pesky 1.8 degree Celsius offsets between certain sensors. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250610-rk3576-tsadc-upstream-v6-5-b6e9efbf1015@collabora.com Signed-off-by: Daniel Lezcano commit 75b98a2c35319d0e8827576030e110a9c046460f Author: Nicolas Frattaroli Date: Tue Jun 10 14:32:40 2025 +0200 dt-bindings: thermal: rockchip: document otp thermal trim Several Rockchip SoCs, such as the RK3576, can store calibration trim data for thermal sensors in OTP cells. This capability should be documented. Such a rockchip thermal sensor may reference cell handles that store both a chip-wide trim for all the sensors, as well as cell handles for each individual sensor channel pointing to that specific sensor's trim value. Additionally, the thermal sensor may optionally reference cells which store the base in terms of degrees celsius and decicelsius that the trim is relative to. Each SoC that implements this appears to have a slightly different combination of chip-wide trim, base, base fractional part and per-channel trim, so which ones do which is documented in the bindings. Reviewed-by: Rob Herring (Arm) Signed-off-by: Nicolas Frattaroli Acked-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250610-rk3576-tsadc-upstream-v6-4-b6e9efbf1015@collabora.com Signed-off-by: Daniel Lezcano commit feb69bccf5d3eb31918df86638abc82594390ba5 Author: Ye Zhang Date: Tue Jun 10 14:32:39 2025 +0200 thermal/drivers/rockchip: Support RK3576 SoC in the thermal driver The RK3576 SoC has six TS-ADC channels: TOP, BIG_CORE, LITTLE_CORE, DDR, NPU and GPU. Signed-off-by: Ye Zhang [ported to mainline, reworded commit message] Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250610-rk3576-tsadc-upstream-v6-3-b6e9efbf1015@collabora.com Signed-off-by: Daniel Lezcano commit 83f2ef0f1b57445ddf38e18d2c8ffd7f270d56bd Author: Nicolas Frattaroli Date: Tue Jun 10 14:32:38 2025 +0200 dt-bindings: rockchip-thermal: Add RK3576 compatible Add a new compatible for the thermal sensor device on the RK3576 SoC. Acked-by: Rob Herring (Arm) Signed-off-by: Nicolas Frattaroli Acked-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250610-rk3576-tsadc-upstream-v6-2-b6e9efbf1015@collabora.com Signed-off-by: Daniel Lezcano commit 9a9f71b2a3a7491c10ceea699e1999298db5c596 Author: Nicolas Frattaroli Date: Tue Jun 10 14:32:37 2025 +0200 thermal/drivers/rockchip: Rename rk_tsadcv3_tshut_mode The "v" version specifier here refers to the hardware IP revision. Mainline deviated from downstream here by calling the v4 revision v3 as it didn't support the v3 hardware revision at all. This creates needless confusion, so rename it to rk_tsadcv4_tshut_mode to be consistent with what the hardware wants to be called. Signed-off-by: Nicolas Frattaroli Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250610-rk3576-tsadc-upstream-v6-1-b6e9efbf1015@collabora.com Signed-off-by: Daniel Lezcano commit bc29c03b28159bac846ea61033dad09e33f4a338 Author: Alex Deucher Date: Fri Jul 11 14:01:42 2025 -0400 drm/amdgpu: clean up GC reset functions Make them consistent and use the reset flags. Acked-by: Christian König Signed-off-by: Alex Deucher commit e3f15cfd8b5dce72d3517c85b7eb6f6633905f6e Author: Alex Deucher Date: Fri Jul 11 13:31:14 2025 -0400 drm/amdgpu: clean up jpeg reset functions Make them consistent and use the reset flags. Reviewed-by: Sathishkumar S Acked-by: Christian König Signed-off-by: Alex Deucher commit 290ccae52dcff890c2b9fd9a9862c08598f5ed8f Author: Alex Deucher Date: Fri Jul 11 13:21:46 2025 -0400 drm/amdgpu/vcn: don't enable per queue resets on SR-IOV Power control is only available in bare metal. SR-IOV will need a different method. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 94ee19ea149f3d9ffc4baa8a7977c1aa8b878f8e Author: Alex Deucher Date: Mon Jul 7 11:00:24 2025 -0400 drm/amdgpu/jpeg4: add additional ring reset error checking Start and stop can fail, so add checks. Fixes: 74894ffc7d0c ("drm/amdgpu: Add ring reset callback for JPEG4_0_0") Reviewed-by: Sathishkumar S Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: Sathishkumar S commit 29184874556adff0399580280a077f3a2833396e Author: Alex Deucher Date: Mon Jul 7 10:56:07 2025 -0400 drm/amdgpu/jpeg3: add additional ring reset error checking Start and stop can fail, so add checks. Fixes: 03399d0bff25 ("drm/amdgpu: Add ring reset callback for JPEG3_0_0") Reviewed-by: Sathishkumar S Signed-off-by: Alex Deucher Cc: Sathishkumar S commit c9bfafc1a672978b7608fcfb5f498ea1acf4dd24 Author: Alex Deucher Date: Mon Jul 7 10:52:49 2025 -0400 drm/amdgpu/jpeg2: add additional ring reset error checking Start and stop can fail, so add checks. Fixes: 500c04d2a708 ("drm/amdgpu: Add ring reset callback for JPEG2_0_0") Reviewed-by: Sathishkumar S Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: Sathishkumar S commit d18e1faef6baab417cff8f6704c6279ba8f4922f Author: Alex Deucher Date: Mon Jul 7 10:22:59 2025 -0400 drm/amdgpu: clean up sdma reset functions Make them consistent and drop unneeded extra variables. Acked-by: Christian König Signed-off-by: Alex Deucher commit efbc5b4ac98e187375bf14c18ecc76988d3bab3c Author: shouyeliu Date: Thu May 22 15:01:41 2025 +0800 Documentation: amd-pstate:fix minimum performance state label error In the AMD P-States Performance Scale diagram, the labels for "Max Perf" and "Lowest Perf" were incorrectly used to define the range for "Desired Perf".The "Desired performance target" should be bounded by the "Maximum requested performance" and the "Minimum requested performance", which corresponds to "Max Perf" and "Min Perf", respectively. Signed-off-by: Shouye Liu Reviewed-by: Mario Limonciello Link: https://lore.kernel.org/r/20250522070140.17557-1-shouyeliu@gmail.com Signed-off-by: Mario Limonciello commit 28c5c486380cc29e82b7747e999b3238f2887539 Author: Christophe JAILLET Date: Wed Jul 9 21:02:51 2025 +0200 drm/amdgpu: Fix missing unlocking in an error path in amdgpu_userq_create() If kasprintf() fails, some mutex still need to be released to avoid locking issue, as already done in all other error handling path. Fixes: c03ea34cbf88 ("drm/amdgpu: add support of debugfs for mqd information") Reviewed-by: Alex Deucher Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/all/366557fa7ca8173fd78c58336986ca56953369b9.1752087753.git.christophe.jaillet@wanadoo.fr/ Signed-off-by: Alex Deucher commit cf115ebad30f08c96f59a39e6a96ef26a146d900 Author: Sukrut Heroorkar Date: Wed Jul 16 14:35:43 2025 +0200 ACPI: TAD: Replace sprintf() with sysfs_emit() Replace sprintf() in *_show() callbacks of sysfs attributes with sysfs_emit(). While the current implementation works, sysfs_emit() helps to prevent potential buffer overflows and aligns with kernel documentation Documentation/filesystems/sysfs.rst. Tested on an x86_64 system with acpi_tad built as a module: - Inserted patched acpi_tad.ko successfully - Verified /sys/devices/platform/ACPI000E:00/time and /caps are accessible - Confirmed correct output from 'cat' with no dmesg errors Signed-off-by: Sukrut Heroorkar Link: https://patch.msgid.link/20250716123543.495628-1-hsukrut3@gmail.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit c1f1fda141373d7253b4c1497043b0ef85f534ce Author: Shuai Xue Date: Mon Jul 14 19:42:12 2025 +0800 ACPI: APEI: handle synchronous exceptions in task work The memory uncorrected error could be signaled by asynchronous interrupt (specifically, SPI in arm64 platform), e.g. when an error is detected by a background scrubber, or signaled by synchronous exception (specifically, data abort exception in arm64 platform), e.g. when a CPU tries to access a poisoned cache line. Currently, both synchronous and asynchronous errors use memory_failure_queue() to schedule memory_failure() to exectute in a kworker context. As a result, when a user-space process is accessing a poisoned data, a data abort is taken and the memory_failure() is executed in the kworker context, which: - will send wrong si_code by SIGBUS signal in early_kill mode, and - can not kill the user-space in some cases resulting a synchronous error infinite loop Issue 1: send wrong si_code in early_kill mode Since commit a70297d22132 ("ACPI: APEI: set memory failure flags as MF_ACTION_REQUIRED on synchronous events")', the flag MF_ACTION_REQUIRED could be used to determine whether a synchronous exception occurs on ARM64 platform. When a synchronous exception is detected, the kernel is expected to terminate the current process which has accessed a poisoned page. This is done by sending a SIGBUS signal with error code BUS_MCEERR_AR, indicating an action-required machine check error on read. However, when kill_proc() is called to terminate the processes who has the poisoned page mapped, it sends the incorrect SIGBUS error code BUS_MCEERR_AO because the context in which it operates is not the one where the error was triggered. To reproduce this problem: #sysctl -w vm.memory_failure_early_kill=1 vm.memory_failure_early_kill = 1 # STEP2: inject an UCE error and consume it to trigger a synchronous error #einj_mem_uc single 0: single vaddr = 0xffffb0d75400 paddr = 4092d55b400 injecting ... triggering ... signal 7 code 5 addr 0xffffb0d75000 page not present Test passed The si_code (code 5) from einj_mem_uc indicates that it is BUS_MCEERR_AO error and it is not factually correct. After this change: # STEP1: enable early kill mode #sysctl -w vm.memory_failure_early_kill=1 vm.memory_failure_early_kill = 1 # STEP2: inject an UCE error and consume it to trigger a synchronous error #einj_mem_uc single 0: single vaddr = 0xffffb0d75400 paddr = 4092d55b400 injecting ... triggering ... signal 7 code 4 addr 0xffffb0d75000 page not present Test passed The si_code (code 4) from einj_mem_uc indicates that it is a BUS_MCEERR_AR error as expected. Issue 2: a synchronous error infinite loop If a user-space process, e.g. devmem, accesses a poisoned page for which the HWPoison flag is set, kill_accessing_process() is called to send SIGBUS to current processs with error info. Since the memory_failure() is executed in the kworker context, it will just do nothing but return EFAULT. So, devmem will access the posioned page and trigger an exception again, resulting in a synchronous error infinite loop. Such exception loop may cause platform firmware to exceed some threshold and reboot when Linux could have recovered from this error. To reproduce this problem: # STEP 1: inject an UCE error, and kernel will set HWPosion flag for related page #einj_mem_uc single 0: single vaddr = 0xffffb0d75400 paddr = 4092d55b400 injecting ... triggering ... signal 7 code 4 addr 0xffffb0d75000 page not present Test passed # STEP 2: access the same page and it will trigger a synchronous error infinite loop devmem 0x4092d55b400 To fix above two issues, queue memory_failure() as a task_work so that it runs in the context of the process that is actually consuming the poisoned data. Signed-off-by: Shuai Xue Tested-by: Ma Wupeng Reviewed-by: Kefeng Wang Reviewed-by: Xiaofei Tan Reviewed-by: Baolin Wang Reviewed-by: Jarkko Sakkinen Reviewed-by: Jonathan Cameron Reviewed-by: Jane Chu Reviewed-by: Yazen Ghannam Reviewed-by: Hanjun Guo Link: https://patch.msgid.link/20250714114212.31660-3-xueshuai@linux.alibaba.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 79a5ae3c4c5eb7e38e0ebe4d6bf602d296080060 Author: Shuai Xue Date: Mon Jul 14 19:42:11 2025 +0800 ACPI: APEI: send SIGBUS to current task if synchronous memory error not recovered If a synchronous error is detected as a result of user-space process triggering a 2-bit uncorrected error, the CPU will take a synchronous error exception such as Synchronous External Abort (SEA) on Arm64. The kernel will queue a memory_failure() work which poisons the related page, unmaps the page, and then sends a SIGBUS to the process, so that a system wide panic can be avoided. However, no memory_failure() work will be queued when abnormal synchronous errors occur. These errors can include situations like invalid PA, unexpected severity, no memory failure config support, invalid GUID section, etc. In such a case, the user-space process will trigger SEA again. This loop can potentially exceed the platform firmware threshold or even trigger a kernel hard lockup, leading to a system reboot. Fix it by performing a force kill if no memory_failure() work is queued for synchronous errors. Signed-off-by: Shuai Xue Reviewed-by: Jarkko Sakkinen Reviewed-by: Jonathan Cameron Reviewed-by: Yazen Ghannam Reviewed-by: Jane Chu Reviewed-by: Hanjun Guo Link: https://patch.msgid.link/20250714114212.31660-2-xueshuai@linux.alibaba.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 3ee9f060826e8262b2c40fec5944994562d4aa10 Author: Rafael J. Wysocki Date: Tue Jul 15 15:20:21 2025 +0200 ACPI: APEI: MAINTAINERS: Update reviewers for APEI Update the ACPI APEI entry in MAINTAINERS by dropping the reviewers who have not been responsive for over a year and adding a list of new reviewers. Signed-off-by: Rafael J. Wysocki Acked-by: Hanjun Guo Acked-by: Mauro Carvalho Chehab Acked-by: Shuai Xue Link: https://patch.msgid.link/12722151.O9o76ZdvQC@rjwysocki.net Signed-off-by: Rafael J. Wysocki commit 496deecb020d14ba89ba7084fbc3024f91687023 Author: Hiago De Franco Date: Sun Jun 29 14:25:11 2025 -0300 remoteproc: imx_rproc: skip clock enable when M-core is managed by the SCU For the i.MX8X and i.MX8 family SoCs, when the Cortex-M core is powered up and started by the Cortex-A core using the bootloader (e.g., via the U-Boot bootaux command), both M-core and Linux run within the same SCFW (System Controller Firmware) partition. With that, Linux has permission to control the M-core. But once the M-core is started by the bootloader, the SCFW automatically enables its clock and sets the clock rate. If Linux later attempts to enable the same clock via clk_prepare_enable(), the SCFW returns a 'LOCKED' error, as the clock is already configured by the SCFW. This causes the probe function in imx_rproc.c to fail, leading to the M-core power domain being shut down while the core is still running. This results in a fault from the SCU (System Controller Unit) and triggers a system reset. To address this issue, ignore handling the clk for i.MX8X and i.MX8 M-core, as SCFW already takes care of enabling and configuring the clock. Suggested-by: Peng Fan Reviewed-by: Ulf Hansson Reviewed-by: Peng Fan Signed-off-by: Hiago De Franco Acked-by: Mathieu Poirier Link: https://lore.kernel.org/r/20250629172512.14857-3-hiagofranco@gmail.com Signed-off-by: Ulf Hansson commit 09813cde376d9d8f30eaf761534532101a0a7755 Author: Hiago De Franco Date: Sun Jun 29 14:25:10 2025 -0300 pmdomain: core: introduce dev_pm_genpd_is_on() This helper function returns the current power status of a given generic power domain. As example, remoteproc/imx_rproc.c can now use this function to check the power status of the remote core to properly set "attached" or "offline" modes. Suggested-by: Ulf Hansson Reviewed-by: Bjorn Andersson Reviewed-by: Peng Fan Signed-off-by: Hiago De Franco Link: https://lore.kernel.org/r/20250629172512.14857-2-hiagofranco@gmail.com Signed-off-by: Ulf Hansson commit d03fcf50ba56f4479685b951506422eeca230853 Author: Dan Williams Date: Fri Jul 11 16:49:32 2025 -0700 cxl: Convert to ACQUIRE() for conditional rwsem locking Use ACQUIRE() to cleanup conditional locking paths in the CXL driver The ACQUIRE() macro and its associated ACQUIRE_ERR() helpers, like scoped_cond_guard(), arrange for scoped-based conditional locking. Unlike scoped_cond_guard(), these macros arrange for an ERR_PTR() to be retrieved representing the state of the conditional lock. The goal of this conversion is to complete the removal of all explicit unlock calls in the subsystem. I.e. the methods to acquire a lock are solely via guard(), scoped_guard() (for limited cases), or ACQUIRE(). All unlock is implicit / scope-based. In order to make sure all lock sites are converted, the existing rwsem's are consolidated and renamed in 'struct cxl_rwsem'. While that makes the patch noisier it gives a clean cut-off between old-world (explicit unlock allowed), and new world (explicit unlock deleted). Cc: David Lechner Cc: Peter Zijlstra Cc: Linus Torvalds Cc: Ingo Molnar Cc: Fabio M. De Francesco Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Dave Jiang Cc: Alison Schofield Cc: Vishal Verma Cc: Ira Weiny Cc: Shiju Jose Acked-by: Peter Zijlstra (Intel) Signed-off-by: Dan Williams Reviewed-by: Jonathan Cameron Reviewed-by: Fabio M. De Francesco Reviewed-by: Dave Jiang Tested-by: Shiju Jose Link: https://patch.msgid.link/20250711234932.671292-9-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit b3a88225519cfd05d71b99946d37476c941145b8 Author: Dan Williams Date: Fri Jul 11 16:49:31 2025 -0700 cxl/region: Consolidate cxl_decoder_kill_region() and cxl_region_detach() Both detach_target() and cxld_unregister() want to tear down a cxl_region when an endpoint decoder is either detached or destroyed. When a region is to be destroyed cxl_region_detach() releases cxl_region_rwsem unbinds the cxl_region driver and re-acquires the rwsem. This "reverse" locking pattern is difficult to reason about, not amenable to scope-based cleanup, and the minor differences in the calling context of detach_target() and cxld_unregister() currently results in the cxl_decoder_kill_region() wrapper. Introduce cxl_decoder_detach() to wrap a core __cxl_decoder_detach() that serves both cases. I.e. either detaching a known position in a region (interruptible), or detaching an endpoint decoder if it is found to be a member of a region (uninterruptible). Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Dave Jiang Cc: Alison Schofield Cc: Vishal Verma Cc: Ira Weiny Acked-by: Peter Zijlstra (Intel) Signed-off-by: Dan Williams Reviewed-by: Fabio M. De Francesco Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Reviewed-by: Davidlohr Bueso Link: https://patch.msgid.link/20250711234932.671292-8-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 695d9455af282056b53baf9782da5bcec3409a57 Author: Dan Williams Date: Fri Jul 11 16:49:30 2025 -0700 cxl/region: Move ready-to-probe state check to a helper Rather than unlocking the region rwsem in the middle of cxl_region_probe() create a helper for determining when the region is ready-to-probe. Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Dave Jiang Cc: Alison Schofield Cc: Vishal Verma Cc: Ira Weiny Acked-by: Peter Zijlstra (Intel) Reviewed-by: Dave Jiang Signed-off-by: Dan Williams Reviewed-by: Jonathan Cameron Reviewed-by: Fabio M. De Francesco Link: https://patch.msgid.link/20250711234932.671292-7-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit a235d7d963e82ac026eca968b71da376534dc9b9 Author: Dan Williams Date: Fri Jul 11 16:49:29 2025 -0700 cxl/region: Split commit_store() into __commit() and queue_reset() helpers The complexity of dropping the lock is removed in favor of splitting commit operations to a helper, and leaving all the complexities of "decommit" for commit_store() to coordinate the different locking contexts. The CPU cache-invalidation in the decommit path is solely handled now by cxl_region_decode_reset(). Previously the CPU caches were being needlessly flushed twice in the decommit path where the first flush had no guarantee that the memory would not be immediately re-dirtied. Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Dave Jiang Cc: Alison Schofield Cc: Vishal Verma Cc: Ira Weiny Acked-by: Peter Zijlstra (Intel) Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Signed-off-by: Dan Williams Reviewed-by: Fabio M. De Francesco Link: https://patch.msgid.link/20250711234932.671292-6-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 55a89d9c99a9a79a7c2c7cb88c2ae9e86868a60b Author: Dan Williams Date: Fri Jul 11 16:49:28 2025 -0700 cxl/decoder: Drop pointless locking cxl_dpa_rwsem coordinates changes to dpa allocation settings for a given decoder. cxl_decoder_reset() has no need for a consistent snapshot of the dpa settings since it is merely clearing out whatever was there previously. Otherwise, cxl_region_rwsem protects against 'reset' racing 'setup'. In preparation for converting to rw_semaphore_acquire semantics, drop this locking. Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Dave Jiang Cc: Alison Schofield Cc: Vishal Verma Cc: Ira Weiny Acked-by: Peter Zijlstra (Intel) Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Reviewed-by: Davidlohr Bueso Signed-off-by: Dan Williams Link: https://patch.msgid.link/20250711234932.671292-5-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 7cb3b42a6bce4e604ca948e6ede543542b49fb54 Author: Dan Williams Date: Fri Jul 11 16:49:27 2025 -0700 cxl/decoder: Move decoder register programming to a helper In preparation for converting to rw_semaphore_acquire semantics move the contents of an open-coded {down,up}_read(&cxl_dpa_rwsem) section to a helper function. Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Dave Jiang Cc: Alison Schofield Cc: Vishal Verma Cc: Ira Weiny Acked-by: Peter Zijlstra (Intel) Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Signed-off-by: Dan Williams Link: https://patch.msgid.link/20250711234932.671292-4-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 683513084acb978fb7f401b9e4dce7e3866af172 Author: Dan Williams Date: Fri Jul 11 16:49:26 2025 -0700 cxl/mbox: Convert poison list mutex to ACQUIRE() Towards removing all explicit unlock calls in the CXL subsystem, convert the conditional poison list mutex to use a conditional lock guard. Rename the lock to have the compiler validate that all existing call sites are converted. Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Dave Jiang Cc: Alison Schofield Cc: Vishal Verma Cc: Ira Weiny Acked-by: Peter Zijlstra (Intel) Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Signed-off-by: Dan Williams Link: https://patch.msgid.link/20250711234932.671292-3-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 857d18f23ab17284d1b6de6f61f4e74958596376 Author: Peter Zijlstra Date: Fri Jul 11 16:49:25 2025 -0700 cleanup: Introduce ACQUIRE() and ACQUIRE_ERR() for conditional locks scoped_cond_guard(), automatic cleanup for conditional locks, has a couple pain points: * It causes existing straight-line code to be re-indented into a new bracketed scope. While this can be mitigated by a new helper function to contain the scope, that is not always a comfortable conversion. * The return code from the conditional lock is tossed in favor of a scheme to pass a 'return err;' statement to the macro. Other attempts to clean this up, to behave more like guard() [1], got hung up trying to both establish and evaluate the conditional lock in one statement. ACQUIRE() solves this by reflecting the result of the condition in the automatic variable established by the lock CLASS(). The result is separately retrieved with the ACQUIRE_ERR() helper, effectively a PTR_ERR() operation. Link: http://lore.kernel.org/all/Z1LBnX9TpZLR5Dkf@gmail.com [1] Link: http://patch.msgid.link/20250512105026.GP4439@noisy.programming.kicks-ass.net Link: http://patch.msgid.link/20250512185817.GA1808@noisy.programming.kicks-ass.net Cc: Ingo Molnar Cc: Linus Torvalds Cc: David Lechner Cc: Fabio M. De Francesco Signed-off-by: Peter Zijlstra (Intel) [djbw: wrap Peter's proposal with changelog and comments] Co-developed-by: Dan Williams Signed-off-by: Dan Williams Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250711234932.671292-2-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 35ad7e181541aa5757f9f316768d3e64403ec843 Author: Jiaxun Yang Date: Sat Jun 7 13:43:56 2025 +0100 MIPS: mm: tlb-r4k: Uniquify TLB entries on init Hardware or bootloader will initialize TLB entries to any value, which may collide with kernel's UNIQUE_ENTRYHI value. On MIPS microAptiv/M5150 family of cores this will trigger machine check exception and cause boot failure. On M5150 simulation this could happen 7 times out of 1000 boots. Replace local_flush_tlb_all() with r4k_tlb_uniquify() which probes each TLB ENTRIHI unique value for collisions before it's written, and in case of collision try a different ASID. Cc: stable@kernel.org Signed-off-by: Jiaxun Yang Signed-off-by: Thomas Bogendoerfer commit 95d692f9aba7c13b5b3e8d842656c47bde7e551f Author: Ian Rogers Date: Tue Jul 15 17:46:35 2025 -0700 perf flamegraph: Fix minor pylint/type hint issues Switch to assuming python3. Fix minor pylint issues on line length, repeated compares, not using f-strings and variable case. Add type hints and check with mypy. Signed-off-by: Ian Rogers Tested-by: Namhyung Kim Link: https://lore.kernel.org/r/20250716004635.31161-1-irogers@google.com Signed-off-by: Namhyung Kim commit da863e772ece95bcdf4f010bcd8ee1bd404d51c5 Merge: 03aa2ed9e187e4 4ed357f72a0e0a Author: Mark Brown Date: Wed Jul 16 18:33:28 2025 +0100 Add SDCA DAI ops helpers Merge series from Charles Keepax : First, a couple of minor code fixups to already submitted code. Then some patches to add new DAI ops helpers for the SDCA stuff, these allow configuring things like the sample rate and finding out which SoundWire port should be used for a specific SDCA streaming input/output terminal. Still a few bits of outstanding work here (propogation of Cluster information particularly) but his should be good enough to get some basic use-cases working. Hopefully we are getting fairly close to completing a first version of the SDCA work now. Should be one more series to add FDL (firmware downloading), then we should be able to send a first version of the actual SDCA class driver itself. commit 41ab92d35ccd2d66bfb049bd34cd95f0304b0240 Author: Ville Syrjälä Date: Tue Jul 1 12:07:22 2025 +0300 drm: Make passing of format info to drm_helper_mode_fill_fb_struct() mandatory Now that everyone passes along the format info to drm_helper_mode_fill_fb_struct() we can make this behaviour mandatory and drop the extra lookup. Reviewed-by: Thomas Zimmermann Reviewed-by: Laurent Pinchart Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-20-ville.syrjala@linux.intel.com commit 3f019d749671b21c31cf1290e6c6a9f107e78cb8 Author: Ville Syrjälä Date: Tue Jul 1 12:07:21 2025 +0300 drm/vmwgfx: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. Cc: Zack Rusin Cc: Broadcom internal kernel review list Reviewed-by: Thomas Zimmermann Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-19-ville.syrjala@linux.intel.com commit e7e9cde252c9b3a5315c0a993fe3643719a4c52d Author: Ville Syrjälä Date: Tue Jul 1 12:07:20 2025 +0300 drm/virtio: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. Cc: David Airlie Cc: Gerd Hoffmann Cc: Dmitry Osipenko Cc: Gurchetan Singh Cc: Chia-I Wu Cc: virtualization@lists.linux.dev Reviewed-by: Thomas Zimmermann Acked-by: Dmitry Osipenko Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-18-ville.syrjala@linux.intel.com commit b146e3e03b628bee694aaa95b4885d96834c1b56 Author: Ville Syrjälä Date: Tue Jul 1 12:07:19 2025 +0300 drm/tegra: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. For the fbdev case a manual drm_get_format_info() lookup is needed. Cc: Thierry Reding Cc: Mikko Perttunen Cc: linux-tegra@vger.kernel.org Reviewed-by: Thomas Zimmermann Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-17-ville.syrjala@linux.intel.com commit 1506b103105e7f1608da41f8b33e5727088d0211 Author: Ville Syrjälä Date: Tue Jul 1 12:07:18 2025 +0300 drm/msm: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookups. For the fbdev case a manual drm_get_format_info() lookup is needed. Cc: Rob Clark Cc: Abhinav Kumar Cc: Dmitry Baryshkov Cc: Sean Paul Cc: Marijn Suijten Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Reviewed-by: Thomas Zimmermann Acked-by: Dmitry Baryshkov Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-16-ville.syrjala@linux.intel.com commit 7a46d03936727f2342686cbc90e073271b1827db Author: Ville Syrjälä Date: Tue Jul 1 12:07:17 2025 +0300 drm/komeda: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. Cc: Liviu Dudau Reviewed-by: Thomas Zimmermann Reviewed-by: Liviu Dudau Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-15-ville.syrjala@linux.intel.com commit 800df9e50ca2c87675f23783d18d9e60d0801525 Author: Ville Syrjälä Date: Tue Jul 1 12:07:16 2025 +0300 drm/i915: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. For the fbdev case a manual drm_get_format_info() lookup is needed. Reviewed-by: Thomas Zimmermann Acked-by: Rodrigo Vivi Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-14-ville.syrjala@linux.intel.com commit 4a792c59203b650b90ddbc36d055591a1547ac5c Author: Ville Syrjälä Date: Tue Jul 1 12:07:15 2025 +0300 drm/gma500: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. For the fbdev case a manual drm_get_format_info() lookup is needed. Cc: Patrik Jakobsson Reviewed-by: Thomas Zimmermann Acked-by: Patrik Jakobsson Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-13-ville.syrjala@linux.intel.com commit d26e853410fd82d174c83e267d9f809ddd1672e6 Author: Ville Syrjälä Date: Tue Jul 1 12:07:14 2025 +0300 drm/exynos: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. For the fbdev case a manual drm_get_format_info() lookup is needed. Cc: Inki Dae Cc: Seung-Woo Kim Cc: Kyungmin Park Reviewed-by: Thomas Zimmermann Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-12-ville.syrjala@linux.intel.com commit 797f8fc4cc839bc7023ca752285f1ec5993aeaeb Author: Ville Syrjälä Date: Tue Jul 1 12:07:13 2025 +0300 drm/armada: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. For the fbdev case a manual drm_get_format_info() lookup is needed. Cc: Russell King Reviewed-by: Thomas Zimmermann Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-11-ville.syrjala@linux.intel.com commit b4d360701b76b8f2505b2e349b89f54fc87c678e Author: Ville Syrjälä Date: Tue Jul 1 12:07:12 2025 +0300 drm/amdgpu: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Plumb the format info from .fb_create() all the way to drm_helper_mode_fill_fb_struct() to avoid the redundant lookup. Cc: Alex Deucher Cc: amd-gfx@lists.freedesktop.org Reviewed-by: Thomas Zimmermann Acked-by: Alex Deucher Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-10-ville.syrjala@linux.intel.com commit 283da9e3a9a43e07188f038fc278140a73e781cf Author: Ville Syrjälä Date: Tue Jul 1 12:07:11 2025 +0300 drm/gem/afbc: Eliminate redundant drm_get_format_info() Pass along the format info from .fb_create() to aliminate the redundant drm_get_format_info() calls from the afbc code. Cc: Sandy Huang Cc: "Heiko Stübner" Cc: Andy Yan Reviewed-by: Thomas Zimmermann Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-9-ville.syrjala@linux.intel.com commit 04a5889cf75aa5b59bd1e13c33eccaf49f3f9d81 Author: Ville Syrjälä Date: Tue Jul 1 12:07:10 2025 +0300 drm/gem: Pass along the format info from .fb_create() to drm_helper_mode_fill_fb_struct() Pass along the format info from .fb_create() to eliminate the redundant drm_get_format_info() calls from the gem fb code. v2: Fix kernel docs (Laurent) Cc: Dave Airlie Cc: Gerd Hoffmann Cc: Sandy Huang Cc: "Heiko Stübner" Cc: Andy Yan Cc: Oleksandr Andrushchenko Cc: virtualization@lists.linux.dev Cc: spice-devel@lists.freedesktop.org Cc: Laurent Pinchart Reviewed-by: Thomas Zimmermann Reviewed-by: Laurent Pinchart Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-8-ville.syrjala@linux.intel.com commit e3c5074b1fc2b49c456d8dc567d59b800b45e267 Author: Ville Syrjälä Date: Tue Jul 1 12:07:09 2025 +0300 drm/malidp: Pass along the format info from .fb_create() malidp_verify_afbc_framebuffer_size() Plumb the format info from .fb_create() all the way to malidp_verify_afbc_framebuffer_size() to avoid the redundant lookup. Cc: Liviu Dudau Reviewed-by: Thomas Zimmermann Reviewed-by: Liviu Dudau Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-7-ville.syrjala@linux.intel.com commit a34cc7bf1034280904f9683e260f9d9e9fd4b84f Author: Ville Syrjälä Date: Tue Jul 1 12:07:08 2025 +0300 drm: Allow the caller to pass in the format info to drm_helper_mode_fill_fb_struct() Soon all drivers should have the format info already available in the places where they call drm_helper_mode_fill_fb_struct(). Allow it to be passed along into drm_helper_mode_fill_fb_struct() instead of doing yet another redundant lookup. Start by always passing in NULL and still doing the extra lookup. The actual changes to avoid the lookup will follow. Done with cocci (with some manual fixups): @@ identifier dev, fb, mode_cmd; expression get_format_info; @@ void drm_helper_mode_fill_fb_struct(struct drm_device *dev, struct drm_framebuffer *fb, + const struct drm_format_info *info, const struct drm_mode_fb_cmd2 *mode_cmd) { ... - fb->format = get_format_info; + fb->format = info ?: get_format_info; ... } @@ identifier dev, fb, mode_cmd; @@ void drm_helper_mode_fill_fb_struct(struct drm_device *dev, struct drm_framebuffer *fb, + const struct drm_format_info *info, const struct drm_mode_fb_cmd2 *mode_cmd); @@ expression dev, fb, mode_cmd; @@ drm_helper_mode_fill_fb_struct(dev, fb + ,NULL ,mode_cmd); Cc: Alex Deucher Cc: Liviu Dudau Cc: Russell King Cc: Inki Dae Cc: Seung-Woo Kim Cc: Kyungmin Park Cc: Patrik Jakobsson Cc: Rob Clark Cc: Abhinav Kumar Cc: Dmitry Baryshkov Cc: Sean Paul Cc: Marijn Suijten Cc: Lyude Paul Cc: Danilo Krummrich Cc: Tomi Valkeinen Cc: Thierry Reding Cc: Mikko Perttunen Cc: Gerd Hoffmann Cc: Dmitry Osipenko Cc: Gurchetan Singh Cc: Chia-I Wu Cc: Zack Rusin Cc: Broadcom internal kernel review list Cc: amd-gfx@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Cc: linux-tegra@vger.kernel.org Cc: virtualization@lists.linux.dev Reviewed-by: Thomas Zimmermann Reviewed-by: Laurent Pinchart Reviewed-by: Dmitry Baryshkov Reviewed-by: Liviu Dudau Acked-by: Alex Deucher Acked-by: Rodrigo Vivi Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-6-ville.syrjala@linux.intel.com commit 81112eaac559ccd451b3dce3bbb64d6b69083961 Author: Ville Syrjälä Date: Tue Jul 1 12:07:07 2025 +0300 drm: Pass the format info to .fb_create() Pass along the format information from the top to .fb_create() so that we can avoid redundant (and somewhat expensive) lookups in the drivers. Done with cocci (with some manual fixups): @@ identifier func =~ ".*create.*"; identifier dev, file, mode_cmd; @@ struct drm_framebuffer *func( struct drm_device *dev, struct drm_file *file, + const struct drm_format_info *info, const struct drm_mode_fb_cmd2 *mode_cmd) { ... ( - const struct drm_format_info *info = drm_get_format_info(...); | - const struct drm_format_info *info; ... - info = drm_get_format_info(...); ) <... - if (!info) - return ...; ...> } @@ identifier func =~ ".*create.*"; identifier dev, file, mode_cmd; @@ struct drm_framebuffer *func( struct drm_device *dev, struct drm_file *file, + const struct drm_format_info *info, const struct drm_mode_fb_cmd2 *mode_cmd) { ... } @find@ identifier fb_create_func =~ ".*create.*"; identifier dev, file, mode_cmd; @@ struct drm_framebuffer *fb_create_func( struct drm_device *dev, struct drm_file *file, + const struct drm_format_info *info, const struct drm_mode_fb_cmd2 *mode_cmd); @@ identifier find.fb_create_func; expression dev, file, mode_cmd; @@ fb_create_func(dev, file + ,info ,mode_cmd) @@ expression dev, file, mode_cmd; @@ drm_gem_fb_create(dev, file + ,info ,mode_cmd) @@ expression dev, file, mode_cmd; @@ drm_gem_fb_create_with_dirty(dev, file + ,info ,mode_cmd) @@ expression dev, file_priv, mode_cmd; identifier info, fb; @@ info = drm_get_format_info(...); ... fb = dev->mode_config.funcs->fb_create(dev, file_priv + ,info ,mode_cmd); @@ identifier dev, file_priv, mode_cmd; @@ struct drm_mode_config_funcs { ... struct drm_framebuffer *(*fb_create)(struct drm_device *dev, struct drm_file *file_priv, + const struct drm_format_info *info, const struct drm_mode_fb_cmd2 *mode_cmd); ... }; v2: Fix kernel docs (Laurent) Fix commit msg (Geert) Cc: Alex Deucher Cc: Liviu Dudau Cc: Maxime Ripard Cc: Russell King Cc: Inki Dae Cc: Seung-Woo Kim Cc: Kyungmin Park Cc: Patrik Jakobsson Cc: Chun-Kuang Hu Cc: Philipp Zabel Cc: Rob Clark Cc: Abhinav Kumar Cc: Dmitry Baryshkov Cc: Sean Paul Cc: Marijn Suijten Cc: Marek Vasut Cc: Stefan Agner Cc: Lyude Paul Cc: Danilo Krummrich Cc: Tomi Valkeinen Cc: Dave Airlie Cc: Gerd Hoffmann Cc: Kieran Bingham Cc: Biju Das Cc: Sandy Huang Cc: "Heiko Stübner" Cc: Andy Yan Cc: Thierry Reding Cc: Mikko Perttunen Cc: Dave Stevenson Cc: "Maíra Canal" Cc: Raspberry Pi Kernel Maintenance Cc: Dmitry Osipenko Cc: Gurchetan Singh Cc: Chia-I Wu Cc: Zack Rusin Cc: Broadcom internal kernel review list Cc: Oleksandr Andrushchenko Cc: amd-gfx@lists.freedesktop.org Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Cc: virtualization@lists.linux.dev Cc: spice-devel@lists.freedesktop.org Cc: linux-renesas-soc@vger.kernel.org Cc: linux-tegra@vger.kernel.org Cc: Laurent Pinchart Reviewed-by: Geert Uytterhoeven Reviewed-by: Thomas Zimmermann Reviewed-by: Dmitry Baryshkov Acked-by: Liviu Dudau Reviewed-by: Laurent Pinchart Acked-by: Alex Deucher Acked-by: Rodrigo Vivi Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-5-ville.syrjala@linux.intel.com commit d5d6340c0b65ce1340c7403b5fc5e54fc8239dab Author: Ville Syrjälä Date: Tue Jul 1 12:07:06 2025 +0300 drm: Look up the format info earlier Look up the format info already in drm_internal_framebuffer_create() so that we can later pass it along to .fb_create(). Currently various drivers are doing additional lookups in their .fb_create() implementations, and these lookups are rather expensive now (given how many different pixel formats we have). v2: Fix commit msg (Thomas) Reviewed-by: Thomas Zimmermann Reviewed-by: Laurent Pinchart Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-4-ville.syrjala@linux.intel.com commit 0e7d5874fb6b80c44be3cfbcf1cf356e81d91232 Author: Ville Syrjälä Date: Tue Jul 1 12:07:05 2025 +0300 drm: Pass pixel_format+modifier directly to drm_get_format_info() Decouple drm_get_format_info() from struct drm_mode_fb_cmd2 and just pass the pixel format+modifier combo in by hand. We may want to use drm_get_format_info() outside of the normal addfb paths where we won't have a struct drm_mode_fb_cmd2, and creating a temporary one just for this seems silly. Done with cocci: @@ identifier dev, mode_cmd; @@ struct drm_format_info * drm_get_format_info(struct drm_device *dev, - const struct drm_mode_fb_cmd2 *mode_cmd + u32 pixel_format, u64 modifier ) { <... ( - mode_cmd->pixel_format + pixel_format | - mode_cmd->modifier[0] + modifier ) ...> } @@ identifier dev, mode_cmd; @@ struct drm_format_info * drm_get_format_info(struct drm_device *dev, - const struct drm_mode_fb_cmd2 *mode_cmd + u32 pixel_format, u64 modifier ); @@ expression dev, mode_cmd; @@ - drm_get_format_info(dev, mode_cmd) + drm_get_format_info(dev, mode_cmd->pixel_format, mode_cmd->modifier[0]) v2: Fix kernel docs (Laurent) Drop drm_mode_fb_cmd2 forward declaration (Thomas) Cc: Liviu Dudau Cc: Russell King Cc: Inki Dae Cc: Seung-Woo Kim Cc: Kyungmin Park Cc: Patrik Jakobsson Cc: Chun-Kuang Hu Cc: Philipp Zabel Cc: Rob Clark Cc: Abhinav Kumar Cc: Dmitry Baryshkov Cc: Sean Paul Cc: Marijn Suijten Cc: Marek Vasut Cc: Stefan Agner Cc: Lyude Paul Cc: Danilo Krummrich Cc: Tomi Valkeinen Cc: Alex Deucher Cc: Sandy Huang Cc: "Heiko Stübner" Cc: Andy Yan Cc: Thierry Reding Cc: Mikko Perttunen Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Cc: nouveau@lists.freedesktop.org Cc: amd-gfx@lists.freedesktop.org Cc: linux-tegra@vger.kernel.org Reviewed-by: Thomas Zimmermann Reviewed-by: Laurent Pinchart Reviewed-by: Liviu Dudau Acked-by: Alex Deucher Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-3-ville.syrjala@linux.intel.com commit 0389e4256eb29ee80598129b8004db5bbbd6fbe4 Author: Ville Syrjälä Date: Tue Jul 1 12:07:04 2025 +0300 drm: Pass pixel_format+modifier to .get_format_info() Decouple .get_format_info() from struct drm_mode_fb_cmd2 and just pass the pixel format+modifier combo in by hand. We may want to use .get_format_info() outside of the normal addfb paths where we won't have a struct drm_mode_fb_cmd2, and creating a temporary one just for this seems silly. v2: Fix intel_fb_get_format_info() docs (Laurent) Cc: Harry Wentland Cc: Leo Li Cc: Rodrigo Siqueira Cc: Alex Deucher Cc: amd-gfx@lists.freedesktop.org Cc: Laurent Pinchart Reviewed-by: Thomas Zimmermann Reviewed-by: Laurent Pinchart Acked-by: Alex Deucher Acked-by: Rodrigo Vivi Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250701090722.13645-2-ville.syrjala@linux.intel.com commit b9ace0647f044042d88b30ea7bd5130e4ad626a2 Author: Markus Elfring Date: Tue Jun 10 11:44:20 2025 +0200 MIPS: SGI-IP27: Delete an unnecessary check before kfree() in hub_domain_free() It can be known that the function “kfree” performs a null pointer check for its input parameter. It is therefore not needed to repeat such a check before its call. Thus remove a redundant pointer check. The source code was transformed by using the Coccinelle software. Signed-off-by: Markus Elfring Signed-off-by: Thomas Bogendoerfer commit 01557e349c352b30113698e129fde42321da6390 Author: Mateusz Jończyk Date: Sun Jul 13 12:04:34 2025 +0200 mips/malta,loongson2ef: use generic mc146818_get_time function mc146818_get_cmos_time() is now mostly equivalent to mc146818_get_time() from drivers/rtc/rtc-mc146818-lib.c, with the latter using a more advanced algorithm (which checks the UIP bit in the CMOS). The Malta and Loongson2ef platforms, the only users of mc146818_get_cmos_time() have RTC devices that should be MC146818 compatible. So, rewrite mc146818_get_cmos_time() in a way that uses mc146818_get_time() and add CONFIG_RTC_MC146818_LIB as a dependency of CONFIG_MIPS_MALTA and CONFIG_CPU_LOONGSON2EF. The should be safe as: - malta_defconfig already uses a standard RTC CMOS driver (CONFIG_RTC_DRV_CMOS=y). The Malta board has an Intel 82371EB (PIIX4E) south bridge with the CMOS RTC, so should work correctly with the modification, - Loongson2e and 2f apparently use the VIA686B south bridge and the AMD CS5536 south bridge respectively (at least according to Kconfig). I have checked datasheets of both and these appear to be MC146818 software compatible. Signed-off-by: Mateusz Jończyk Signed-off-by: Thomas Bogendoerfer commit 6e68ee347555b1b37b42195210b138a105387f01 Author: Mateusz Jończyk Date: Sun Jul 13 12:04:33 2025 +0200 mips: remove redundant macro mc146818_decode_year The mc146818_decode_year macro is used only in mc146818_get_cmos_time(), which in turn is called only in arch/mips/loongson2ef/common/time.c and arch/mips/mti-malta/malta-time.c so on mach-jazz it is unused and can be removed. On other platforms it is defined in the same way, so it can be safely folded into mc146818_get_cmos_time(). Signed-off-by: Mateusz Jończyk Signed-off-by: Thomas Bogendoerfer commit 3b3c4f91404659fb21ed5db818a623d274266d2a Author: Mateusz Jończyk Date: Sun Jul 13 12:04:32 2025 +0200 mips/mach-rm: remove custom mc146818rtc.h file The mc146818_decode_year macro is used only in mc146818_get_cmos_time, which in turn is called only in arch/mips/loongson2ef/common/time.c and arch/mips/mti-malta/malta-time.c So no SNI or mach-rm content. SNI did not use mc146818_get_cmos_time apparently since commit 06cf5583fd9a ("[MIPS] SNI RM updates") in 2007. Signed-off-by: Mateusz Jończyk Signed-off-by: Thomas Bogendoerfer commit 97c6f7dffd3192b9b010be6e3658340573495d00 Author: Mateusz Jończyk Date: Sun Jul 13 12:04:31 2025 +0200 mips: remove unused function mc146818_set_rtc_mmss I have checked carefully: this function is unused, so remove it. The last caller appears to have been removed in 2007 in commit 4b550488f894 ("[MIPS] Deforest the function pointer jungle in the time code.") mc146818-time.h is included only in three files: - arch/mips/mti-malta/malta-time.c - arch/mips/loongson64/numa.c - arch/mips/loongson2ef/common/time.c Also, remove unused macros USEC_AFTER/USEC_BEFORE. Signed-off-by: Mateusz Jończyk Signed-off-by: Thomas Bogendoerfer commit db6f8fcd56438a078ef61779ff68068a0886a79b Author: Gregory CLEMENT Date: Fri Jul 11 11:54:21 2025 +0200 MIPS: CPS: Optimise delay CPU calibration for SMP On MIPS architecture with CPS-based SMP support, all CPU cores in the same cluster run at the same frequency since they share the same L2 cache, requiring a fixed CPU/L2 cache ratio. This allows to implement calibrate_delay_is_known(), which will return 0 (triggering calibration) only for the primary CPU of each cluster. For other CPUs, we can simply reuse the value from their cluster's primary CPU core. With the introduction of this patch, a configuration running 32 cores spread across two clusters sees a significant reduction in boot time by approximately 600 milliseconds. Reviewed-by: Jiaxun Yang Signed-off-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit c71085f2c0f18f025784ce975358adcccaa8c041 Author: Gregory CLEMENT Date: Fri Jul 11 11:54:20 2025 +0200 MIPS: CPS: Improve mips_cps_first_online_in_cluster() The initial implementation of this function goes through all the CPUs in a cluster to determine if the current CPU is the only one running. This process occurs every time the function is called. However, during boot, we already perform this task, so let's take advantage of this opportunity to create and fill a CPU bitmask that can be easily and efficiently used later. This patch modifies the function to allow providing the first available online CPU when one already exists, which is necessary for delay CPU calibration optimization. Reviewed-by: Jiaxun Yang Signed-off-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit 07f8888ee7df5189e64839abb26842dc6c2da371 Author: Gregory CLEMENT Date: Thu Jul 10 16:54:42 2025 +0200 MIPS: disable MMID when not supported by the hardware It is possible that MMID is supported at the CPU level, but its integration in a SoC prevents its usage. For instance, if the System-level Interconnect (also known as Network on Chip) does not support global invalidation, then the MMID feature is not usable. The current implementation of MMID relies on the GINV* instructions. This patch allows the disabling of MMID based on a device tree property, as this issue cannot be detected at runtime. MMID is set up very early during the boot process, even before device tree data can be accessed. Therefore, when we determine whether MMID needs to be disabled, some MMID setup has already been performed for the boot CPU. Consequently, we must revert the MMID setup on the first CPU before disabling the feature for the subsequent CPUs that will be initialized later. Signed-off-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit ca943354f2ccb82bb7c73c2e8d5eb355b102f75e Author: Théo Lebrun Date: Fri Jul 4 13:47:11 2025 +0200 MIPS: eyeq5_defconfig: add I2C subsystem, driver and temp sensor driver Enable I2C support on the EyeQ5 platform. The evaluation board has a temperature sensor mounted which helps test the integration. Signed-off-by: Théo Lebrun Acked-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit 0ca9aba59cc9cabc7986a29ec4099ef660c53dbb Author: Théo Lebrun Date: Fri Jul 4 13:47:10 2025 +0200 MIPS: eyeq5_defconfig: add GPIO subsystem & driver Enable GPIO support on the EyeQ5 platform. Signed-off-by: Théo Lebrun Acked-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit e235f02633e67161e97c7989664014e20736a672 Author: Théo Lebrun Date: Fri Jul 4 13:47:09 2025 +0200 MIPS: mobileye: eyeq5: add two GPIO bank nodes This platform uses the same GPIO controller as Nomadik. It however has its own pinconf & pinmux controller. EyeQ5 is the first platform to use gpio-nomadik independently from pinctrl-nomadik. Signed-off-by: Théo Lebrun Acked-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit bc8607609610b36c1c4e9bf6b2bb30dd38517aa7 Author: Théo Lebrun Date: Fri Jul 4 13:47:08 2025 +0200 MIPS: mobileye: eyeq5: add evaluation board I2C temp sensor Declare the temperature sensor on I2C bus 2. Its label is the schematics identifier. Acked-by: Linus Walleij Acked-by: Andi Shyti Signed-off-by: Théo Lebrun Acked-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit c1dbf4c8c2721b479dfcf33c80a3542eb75a22be Author: Théo Lebrun Date: Fri Jul 4 13:47:07 2025 +0200 MIPS: mobileye: eyeq5: add 5 I2C controller nodes Add the SoC I2C controller nodes to the platform devicetree. Use a default bus frequency of 400kHz. They are AMBA devices that are matched on PeriphID. Set transfer timeout to 10ms instead of Linux's default of 200ms. Acked-by: Linus Walleij Acked-by: Andi Shyti Signed-off-by: Théo Lebrun Acked-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit daf3082f8949468bfe8b7ac282f89161c235d968 Author: Théo Lebrun Date: Fri Jul 4 13:47:06 2025 +0200 MIPS: eyeq5_defconfig: Update for v6.16-rc1 - Sort by moving CONFIG_PAGE_SIZE_16KB=y. - Drop CONFIG_MACH_EYEQ5=y because it is the default: # arch/mips/mobileye/Kconfig choice prompt "Mobileye EyeQ SoC selection" default MACH_EYEQ5 - Drop CONFIG_SPARSEMEM_MANUAL=y because: # mm/Kconfig choice prompt "Memory model" depends on SELECT_MEMORY_MODEL default SPARSEMEM_MANUAL if ARCH_SPARSEMEM_DEFAULT default FLATMEM_MANUAL # arch/mips/Kconfig config EYEQ select ARCH_SPARSEMEM_DEFAULT if 64BIT Signed-off-by: Théo Lebrun Acked-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit 844615dd0f2d95c018ec66b943e08af22b62aff3 Author: Shiji Yang Date: Thu Jul 3 21:06:32 2025 +0800 MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} These functions are exported but their prototypes are not defined. This patch adds the missing function prototypes to fix the following compilation warnings: arch/mips/kernel/vpe-mt.c:180:7: error: no previous prototype for 'vpe_alloc' [-Werror=missing-prototypes] 180 | void *vpe_alloc(void) | ^~~~~~~~~ arch/mips/kernel/vpe-mt.c:198:5: error: no previous prototype for 'vpe_start' [-Werror=missing-prototypes] 198 | int vpe_start(void *vpe, unsigned long start) | ^~~~~~~~~ arch/mips/kernel/vpe-mt.c:208:5: error: no previous prototype for 'vpe_stop' [-Werror=missing-prototypes] 208 | int vpe_stop(void *vpe) | ^~~~~~~~ arch/mips/kernel/vpe-mt.c:229:5: error: no previous prototype for 'vpe_free' [-Werror=missing-prototypes] 229 | int vpe_free(void *vpe) | ^~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit 801c6592bf4c9892389352586ba36173ae9e8f9e Author: Geert Uytterhoeven Date: Wed Jul 9 21:08:05 2025 +0200 watchdog: renesas_wdt: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas WDT watchdog driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/3d6d46ff56c908880a167ffb2a74c713060a1a57.1752088043.git.geert+renesas@glider.be Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 40efc43eb7ffb5a4e2f998c13b8cfb555e671b92 Author: Ziyan Fu Date: Fri Jul 4 15:35:18 2025 +0800 watchdog: iTCO_wdt: Report error if timeout configuration fails The driver probes with the invalid timeout value when 'iTCO_wdt_set_timeout()' fails, as its return value is not checked. In this case, when executing "wdctl", we may get: Device: /dev/watchdog0 Timeout: 30 seconds Timeleft: 613 seconds The timeout value is the value of "heartbeat" or "WATCHDOG_TIMEOUT", and the timeleft value is calculated from the register value we actually read (0xffff) by masking with 0x3ff and converting ticks to seconds (* 6 / 10). Add error handling to return the failure code if 'iTCO_wdt_set_timeout()' fails, ensuring the driver probe fails and prevents invalid operation. Signed-off-by: Ziyan Fu Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250704073518.7838-1-13281011316@163.com Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 3b3643e1cd6f276810640ee04e41c04e7a753c0f Author: Rob Herring (Arm) Date: Thu Jul 3 13:35:18 2025 -0500 watchdog: rti_wdt: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. The error handling is a bit different. "memory-region" is optional, so failed lookup is not an error. But then an error in of_address_to_resource() is treated as an error. However, that distinction is not really important. Either the region is available and usable or it is not. So now, it is just of_reserved_mem_region_to_resource() which is checked for an error. Signed-off-by: Rob Herring (Arm) Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/20250703183518.2075108-1-robh@kernel.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit 0987760b27834548052bd716e040681cec9e822d Author: Frank Li Date: Tue Jun 24 16:12:27 2025 -0400 dt-bindings: watchdog: nxp,pnx4008-wdt: allow clocks property Allow clocks property to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/lpc/lpc3250-phy3250.dtb: watchdog@4003c000 (nxp,pnx4008-wdt): Unevaluated properties are not allowed ('clocks' was unexpected) Signed-off-by: Frank Li Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250624201227.2515275-1-Frank.Li@nxp.com Signed-off-by: Wim Van Sebroeck commit 8b61d8ca751bc15875b50e0ff6ac3ba0cf95a529 Author: Dan Carpenter Date: Wed May 28 23:22:19 2025 +0300 watchdog: ziirave_wdt: check record length in ziirave_firm_verify() The "rec->len" value comes from the firmware. We generally do trust firmware, but it's always better to double check. If the length value is too large it would lead to memory corruption when we set "data[i] = ret;" Fixes: 217209db0204 ("watchdog: ziirave_wdt: Add support to upload the firmware.") Signed-off-by: Dan Carpenter Reviewed-by: Guenter Roeck Link: https://lore.kernel.org/r/3b58b453f0faa8b968c90523f52c11908b56c346.1748463049.git.dan.carpenter@linaro.org Signed-off-by: Guenter Roeck Signed-off-by: Wim Van Sebroeck commit ab17ead0e0ee8650cd1cf4e481b1ed0ee9731956 Author: Johannes Thumshirn Date: Wed Jul 16 15:36:31 2025 +0200 block: fix blk_zone_append_update_request_bio() kernel-doc Stephen reported new 'make htmldocs' warnings introduced by 4cc21a00762b ("block: add tracepoint for blk_zone_update_request_bio"). One is a wrong function name in the tracepoint's kernel-doc and one is a wrong function parameter. Fix these so 'make htmldocs' is warning free again for the block layer tracepoints. Fixes: 4cc21a00762b ("block: add tracepoint for blk_zone_update_request_bio") Reported-by: Stephen Rothwell Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20250716133631.94898-1-johannes.thumshirn@wdc.com Signed-off-by: Jens Axboe commit bc1c2f0ae355f7e30b5baecdfb89d2b148aa0515 Author: John Garry Date: Wed Jul 9 10:48:14 2025 +0000 md/raid10: fix set but not used variable in sync_request_write() Building with W=1 reports the following: drivers/md/raid10.c: In function ‘sync_request_write’: drivers/md/raid10.c:2441:21: error: variable ‘d’ set but not used [-Werror=unused-but-set-variable] 2441 | int d; | ^ cc1: all warnings being treated as errors Remove the usage of that variable. Fixes: 752d0464b78a ("md: clean up accounting for issued sync IO") Signed-off-by: John Garry Link: https://lore.kernel.org/linux-raid/20250709104814.2307276-1-john.g.garry@oracle.com Signed-off-by: Yu Kuai commit 03aa2ed9e187e42f25b3871b691d535fc19156c4 Author: Balamurugan C Date: Wed Jul 16 16:23:00 2025 +0800 ASoC: Intel: sof_rt5682: Add HDMI-In capture with rt5682 support for PTL. Added match table entry on ptl machines to support HDMI-In capture with rt5682 I2S audio codec. also added the respective quirk configuration in rt5682 machine driver. Signed-off-by: Balamurugan C Signed-off-by: Bard Liao Link: https://patch.msgid.link/20250716082300.1810352-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 951a6d8d41289b86a564ee5563ededa702b62b1b Author: Dan Carpenter Date: Tue Jul 15 18:01:39 2025 -0500 spi: stm32-ospi: Fix NULL vs IS_ERR() bug in stm32_ospi_get_resources() This code was changed from using devm_ioremap() which returns NULL to using devm_ioremap_resource() which returns error pointers. Update the error checking to match. Fixes: defe01abfb7f ("spi: stm32-ospi: Use of_reserved_mem_region_to_resource() for "memory-region"") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/fb2a26a2-119b-4b5a-8d44-b29e2c736081@sabinyo.mountain Signed-off-by: Mark Brown commit d618363a53aed24c94442b58c4f59e33222eb092 Author: Maxime Ripard Date: Wed Jun 25 17:14:37 2025 +0200 drm/tests: edid: Add edid-decode --check output Some of our EDIDs are (rightfully) invalid, but most of them should be valid. Let's add the edid-decode --check of these EDIDs when they were generated, so we know what to expect going forward, and a comment to explicitly mention when we expect them to be broken. Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250625-drm-update-edid-v1-3-2d963743ab9e@kernel.org Signed-off-by: Maxime Ripard commit b17ade59aac4b23abff7c58bc4e19398b05c7b43 Author: Maxime Ripard Date: Wed Jun 25 17:14:36 2025 +0200 drm/tests: edid: Update CTA-861 HDMI Vendor Specific Data Block For some reason, the HDMI VSDBs in our kunit EDIDs had a length longer than expected. While this was harmless, we should get rid of it to make it somewhat predictable. Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250625-drm-update-edid-v1-2-2d963743ab9e@kernel.org Signed-off-by: Maxime Ripard commit 1ec99dfe9eb0cdc576249e8b75de25f860123629 Author: E Shattow Date: Tue Jul 15 21:04:54 2025 -0700 riscv: dts: starfive: jh7110-common: add status power led node Add status power led node for StarFive VisionFive2 and variant boards. Signed-off-by: E Shattow Signed-off-by: Conor Dooley commit 2a84cb3ede80896ff45dab8798cb86d91ec3877d Author: E Shattow Date: Tue Jul 15 23:19:33 2025 -0700 riscv: dts: starfive: jh7110-milkv-mars sort properties Improve style with node property order sort of common properties before vendor prefixes Signed-off-by: E Shattow Acked-by: Emil Renner Berthing Signed-off-by: Conor Dooley commit 2bf85c45db96d83e082daa2903fd2a3019b7ad18 Author: Maxime Ripard Date: Wed Jun 25 17:14:35 2025 +0200 drm/tests: edid: Fix monitor range limits For some reason, some EDIDs used by kunit had Monitor Range Limits making no sense, and not matching the edid-decode output in the comment. While they were in the comments as: Display Range Limits: Monitor ranges (GTF): 50-70 Hz V, 30-70 kHz H, max dotclock 150 MHz They were actually: Display Range Limits: Monitor ranges (GTF): 50-70 Hz V, 0-0 kHz H, max dotclock 1960 MHz Fix that section of the EDIDs to match the expected edid-decode output. Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250625-drm-update-edid-v1-1-2d963743ab9e@kernel.org Signed-off-by: Maxime Ripard commit d27da6792c805f5b4d88f21e8ba2069b1f2d41ea Author: Anusha Srivatsa Date: Thu Jul 10 23:31:25 2025 -0500 drm/panel/boe-himax8279d: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-14-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit 51929b6850a92a40db1270ea7234ac5d325aafac Author: Anusha Srivatsa Date: Thu Jul 10 23:31:24 2025 -0500 drm/panel/boe-tv101wum-nl6: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-13-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit 46c8779be619159a9774846b022286fbf861fe8e Author: Anusha Srivatsa Date: Thu Jul 10 23:31:23 2025 -0500 drm/panel/himax-hx83102: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-12-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit ea8642fe79662546aa3bbd2d3315df4cc3367d89 Author: Anusha Srivatsa Date: Thu Jul 10 23:31:22 2025 -0500 drm/panel/ilitek-ili9882t: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-11-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit d29ab79c6f59a626028dac3c5177648e4417bd3f Author: Anusha Srivatsa Date: Thu Jul 10 23:31:21 2025 -0500 drm/panel/lpm102a188a: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-10-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit b669ce70f459dc40ed7c501940a99c7046736155 Author: Anusha Srivatsa Date: Thu Jul 10 23:31:20 2025 -0500 drm/panel/jdi-lt070me05000: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-9-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit 95ec5c606dfdd73641e11ac481128f48e7cb6cfc Author: Anusha Srivatsa Date: Thu Jul 10 23:31:19 2025 -0500 drm/panel/khadas-ts050: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-8-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit 6a855c7f5685fa06d33727d62484e116478994d3 Author: Anusha Srivatsa Date: Thu Jul 10 23:31:18 2025 -0500 drm/panel/kd097d04: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-7-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit daeca2b7c7321bae49ceb7520004f2059e66d35c Author: Anusha Srivatsa Date: Thu Jul 10 23:31:17 2025 -0500 drm/panel/lg-sw43408: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-6-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit a8f268ac9d46355e48ff24d0c0a1dbaccdb800ca Author: Anusha Srivatsa Date: Thu Jul 10 23:31:16 2025 -0500 drm/panel/novatek-nt36672a: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-5-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit 6afbf43edfae07cb74ea3e66984e2b6ac1c2083a Author: Anusha Srivatsa Date: Thu Jul 10 23:31:15 2025 -0500 drm/panel/osd101t2587-53ts: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-4-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit 8e4e733d9543061b4a988077d119d298c56e3bef Author: Anusha Srivatsa Date: Thu Jul 10 23:31:14 2025 -0500 drm/panel/vvx10f034n00: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-3-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit 6299cb4a211caeb7d2d8cec091e256e5ad428730 Author: Anusha Srivatsa Date: Thu Jul 10 23:31:13 2025 -0500 drm/panel/raspberrypi: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-2-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit 1e57377dad3d194f1001b9ddd9f91582057e6030 Author: Anusha Srivatsa Date: Thu Jul 10 23:31:12 2025 -0500 drm/panel/lq101r1sx01: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. In the call to the new API, avoid using explicit type and use __typeof() for more type safety. Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250710-b4-driver-convert-last-part-july-v1-1-de73ba81b2f5@redhat.com Signed-off-by: Maxime Ripard commit ef616b9763e374454957a8785a068479fa5665a6 Merge: 63be976da99426 d9f334fca54489 Author: Mark Brown Date: Wed Jul 16 15:37:46 2025 +0100 Add a bare-minimum Regulator abstraction Merge series from Daniel Almeida : Add basic rust bindings for the regulator API. commit 0ebc9a7ecf6acecf8bdf3a3cb02b6073df4a2288 Author: Norman Maurer Date: Tue Jul 15 16:02:50 2025 +0200 io_uring/net: Support multishot receive len cap At the moment its very hard to do fine grained backpressure when using multishot as the kernel might produce a lot of completions before the user has a chance to cancel a previous submitted multishot recv. This change adds support to issue a multishot recv that is capped by a len, which means the kernel will only rearm until X amount of data is received. When the limit is reached the completion will signal to the user that a re-arm needs to happen manually by not setting the IORING_CQE_F_MORE flag. Signed-off-by: Norman Maurer Link: https://lore.kernel.org/r/20250715140249.31186-1-norman_maurer@apple.com Signed-off-by: Jens Axboe commit 557c024ca7250bb65ae60f16c02074106c2f197b Author: Andrew Price Date: Wed Jul 16 14:12:07 2025 +0100 gfs2: Validate i_depth for exhash directories A fuzzer test introduced corruption that ends up with a depth of 0 in dir_e_read(), causing an undefined shift by 32 at: index = hash >> (32 - dip->i_depth); As calculated in an open-coded way in dir_make_exhash(), the minimum depth for an exhash directory is ilog2(sdp->sd_hash_ptrs) and 0 is invalid as sdp->sd_hash_ptrs is fixed as sdp->bsize / 16 at mount time. So we can avoid the undefined behaviour by checking for depth values lower than the minimum in gfs2_dinode_in(). Values greater than the maximum are already being checked for there. Also switch the calculation in dir_make_exhash() to use ilog2() to clarify how the depth is calculated. Tested with the syzkaller repro.c and xfstests '-g quick'. Reported-by: syzbot+4708579bb230a0582a57@syzkaller.appspotmail.com Signed-off-by: Andrew Price Signed-off-by: Andreas Gruenbacher commit cbf218627d6a5092e653942baa261a10d1444798 Author: James Morse Date: Fri Jul 11 18:27:43 2025 +0000 arm64: cacheinfo: Provide helper to compress MPIDR value into u32 Filesystems like resctrl use the cache-id exposed via sysfs to identify groups of CPUs. The value is also used for PCIe cache steering tags. On DT platforms cache-id is not something that is described in the device-tree, but instead generated from the smallest MPIDR of the CPUs associated with that cache. The cache-id exposed to user-space has historically been 32 bits. MPIDR values may be larger than 32 bits. MPIDR only has 32 bits worth of affinity data, but the aff3 field lives above 32bits. The corresponding lower bits are masked out by MPIDR_HWID_BITMASK and contain an SMT flag and Uni-Processor flag. Swizzzle the aff3 field into the bottom 32 bits and using that. In case more affinity fields are added in the future, the upper RES0 area should be checked. Returning a value greater than 32 bits from this helper will cause the caller to give up on allocating cache-ids. Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Link: https://lore.kernel.org/r/20250711182743.30141-4-james.morse@arm.com Signed-off-by: Greg Kroah-Hartman commit 9a697eff25c97dd11877de04fd1be60af32d6d2d Author: James Morse Date: Fri Jul 11 18:27:42 2025 +0000 cacheinfo: Add arch hook to compress CPU h/w id into 32 bits for cache-id Filesystems like resctrl use the cache-id exposed via sysfs to identify groups of CPUs. The value is also used for PCIe cache steering tags. On DT platforms cache-id is not something that is described in the device-tree, but instead generated from the smallest CPU h/w id of the CPUs associated with that cache. CPU h/w ids may be larger than 32 bits. Add a hook to allow architectures to compress the value from the devicetree into 32 bits. Returning the same value is always safe as cache_of_set_id() will stop if a value larger than 32 bits is seen. For example, on arm64 the value is the MPIDR affinity register, which only has 32 bits of affinity data, but spread accross the 64 bit field. An arch-specific bit swizzle gives a 32 bit value. Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Link: https://lore.kernel.org/r/20250711182743.30141-3-james.morse@arm.com Signed-off-by: Greg Kroah-Hartman commit 6b585f4ce6e4cde967bffae4f6cd9066094967ac Author: Rob Herring Date: Fri Jul 11 18:27:41 2025 +0000 cacheinfo: Set cache 'id' based on DT data Use the minimum CPU h/w id of the CPUs associated with the cache for the cache 'id'. This will provide a stable id value for a given system. As we need to check all possible CPUs, we can't use the shared_cpu_map which is just online CPUs. As there's not a cache to CPUs mapping in DT, we have to walk all CPU nodes and then walk cache levels. The cache_id exposed to user-space has historically been 32 bits, and is too late to change. This value is parsed into a u32 by user-space libraries such as libvirt: https://github.com/libvirt/libvirt/blob/master/src/util/virresctrl.c#L1588 Give up on assigning cache-id's if a CPU h/w id greater than 32 bits is found. match_cache_node() does not make use of the __free() cleanup helpers because of_find_next_cache_node(prev) does not drop a reference to prev, and its too easy to accidentally drop the reference on cpu, which belongs to for_each_of_cpu_node(). Cc: "Rafael J. Wysocki" Signed-off-by: Rob Herring [ ben: converted to use the __free cleanup idiom ] Signed-off-by: Ben Horgan [ morse: Add checks to give up if a value larger than 32 bits is seen. ] Signed-off-by: James Morse Reviewed-by: Jonathan Cameron Reviewed-by: Gavin Shan Link: https://lore.kernel.org/r/20250711182743.30141-2-james.morse@arm.com Signed-off-by: Greg Kroah-Hartman commit 981569a06f704ac9c4eed249f47426e1be1a5636 Merge: f2e467a48287c8 ae21c0c0ac56aa Author: Christian Brauner Date: Wed Jul 16 14:48:24 2025 +0200 Merge patch series "fs: refactor write_begin/write_end and add ext4 IOCB_DONTCACHE support" 陈涛涛 Taotao Chen says: This patch series refactors the address_space_operations write_begin() and write_end() callbacks to take const struct kiocb * as their first argument, allowing IOCB flags such as IOCB_DONTCACHE to propagate to the filesystem's buffered I/O path. Ext4 is updated to implement handling of the IOCB_DONTCACHE flag and advertises support via the FOP_DONTCACHE file operation flag. Additionally, the i915 driver's shmem write paths are updated to bypass the legacy write_begin/write_end interface in favor of directly calling write_iter() with a constructed synchronous kiocb. Another i915 change replaces a manual write loop with kernel_write() during GEM shmem object creation. Tested with ext4 and i915 GEM workloads. * patches from https://lore.kernel.org/20250716093559.217344-1-chentaotao@didiglobal.com: ext4: support uncached buffered I/O mm/pagemap: add write_begin_get_folio() helper function fs: change write_begin/write_end interface to take struct kiocb * drm/i915: Refactor shmem_pwrite() to use kiocb and write_iter drm/i915: Use kernel_write() in shmem object create Link: https://lore.kernel.org/20250716093559.217344-1-chentaotao@didiglobal.com Signed-off-by: Christian Brauner commit ae21c0c0ac56aa734327e9c8b7dfef4270ab54d4 Author: Taotao Chen Date: Wed Jul 16 09:36:09 2025 +0000 ext4: support uncached buffered I/O Set FOP_DONTCACHE in ext4_file_operations to declare support for uncached buffered I/O. To handle this flag, update ext4_write_begin() and ext4_da_write_begin() to use write_begin_get_folio(), which encapsulates FGP_DONTCACHE logic based on iocb->ki_flags. Part of a series refactoring address_space_operations write_begin and write_end callbacks to use struct kiocb for passing write context and flags. Signed-off-by: Taotao Chen Link: https://lore.kernel.org/20250716093559.217344-6-chentaotao@didiglobal.com Signed-off-by: Christian Brauner commit b799474b9aeb46ec698874d4de1a799de8b5f64f Author: Taotao Chen Date: Wed Jul 16 09:36:08 2025 +0000 mm/pagemap: add write_begin_get_folio() helper function Add write_begin_get_folio() to simplify the common folio lookup logic used by filesystem ->write_begin() implementations. This helper wraps __filemap_get_folio() with common flags such as FGP_WRITEBEGIN, conditional FGP_DONTCACHE, and set folio order based on the write length. Part of a series refactoring address_space_operations write_begin and write_end callbacks to use struct kiocb for passing write context and flags. Signed-off-by: Taotao Chen Link: https://lore.kernel.org/20250716093559.217344-5-chentaotao@didiglobal.com Signed-off-by: Christian Brauner commit e9d8e2bf23206825ca9b4d3caf587945ba807939 Author: Taotao Chen Date: Wed Jul 16 09:36:06 2025 +0000 fs: change write_begin/write_end interface to take struct kiocb * Change the address_space_operations callbacks write_begin() and write_end() to take struct kiocb * as the first argument instead of struct file *. Update all affected function prototypes, implementations, call sites, and related documentation across VFS, filesystems, and block layer. Part of a series refactoring address_space_operations write_begin and write_end callbacks to use struct kiocb for passing write context and flags. Signed-off-by: Taotao Chen Link: https://lore.kernel.org/20250716093559.217344-4-chentaotao@didiglobal.com Signed-off-by: Christian Brauner commit 048832a3f4003113c3a0f060b08376c103622099 Author: Taotao Chen Date: Wed Jul 16 09:36:04 2025 +0000 drm/i915: Refactor shmem_pwrite() to use kiocb and write_iter Refactors shmem_pwrite() to replace the ->write_begin/end logic with a write_iter-based implementation using kiocb and iov_iter. While kernel_write() was considered, it caused about 50% performance regression. vfs_write() is not exported for kernel use. Therefore, file->f_op->write_iter() is called directly with a synchronously initialized kiocb to preserve performance and remove write_begin usage. Performance results use gem_pwrite on Intel CPU i7-10700 (average of 10 runs): - ./gem_pwrite --run-subtest bench -s 16384 Before: 0.205s, After: 0.214s - ./gem_pwrite --run-subtest bench -s 524288 Before: 6.1021s, After: 4.8047s Part of a series refactoring address_space_operations write_begin and write_end callbacks to use struct kiocb for passing write context and flags. Signed-off-by: Taotao Chen Link: https://lore.kernel.org/20250716093559.217344-3-chentaotao@didiglobal.com Signed-off-by: Christian Brauner commit e7b840fd4956da86e93a8258155cf3e127f509e7 Author: Taotao Chen Date: Wed Jul 16 09:36:03 2025 +0000 drm/i915: Use kernel_write() in shmem object create Replace the write_begin/write_end loop in i915_gem_object_create_shmem_from_data() with call to kernel_write(). This function initializes shmem-backed GEM objects. kernel_write() simplifies the code by removing manual folio handling. Part of a series refactoring address_space_operations write_begin and write_end callbacks to use struct kiocb for passing write context and flags. Signed-off-by: Taotao Chen Link: https://lore.kernel.org/20250716093559.217344-2-chentaotao@didiglobal.com Signed-off-by: Christian Brauner commit f2e467a48287c868818085aa35389a224d226732 Author: Jann Horn Date: Fri Jul 11 18:33:36 2025 +0200 eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons: - They don't look upwards in the tree. - If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed ("epoll: limit paths"). Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops. A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files. As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion problem").) To fix it: 1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited. 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk. 3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges. Fixes: 22bacca48a17 ("epoll: prevent creating circular epoll structures") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn Link: https://lore.kernel.org/20250711-epoll-recursion-fix-v1-1-fb2457c33292@google.com Signed-off-by: Christian Brauner commit 45e06a9d7496c7063c2321e06371ecf086d28ab9 Author: Frank Li Date: Sat Jul 12 19:19:04 2025 +0100 dt-bindings: nvmem: convert vf610-ocotp.txt to yaml format Convert vf610-ocotp.txt to yaml format. Additional changes: - Remove label in examples. - Add include file in examples. - Move reg just after compatible in examples. - Add ref: nvmem.yaml and nvmem-deprecated-cells.yaml - Remove #address-cells and #size-cells from required list to match existed dts file. Signed-off-by: Frank Li Reviewed-by: Krzysztof Kozlowski Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250712181905.6738-9-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 657339fd3f011fac24447bda25e969e6daa80807 Author: Chen-Yu Tsai Date: Sat Jul 12 19:19:03 2025 +0100 dt-bindings: nvmem: mediatek: efuse: split MT8186/MT8188 from base version On MT8186 and MT8188 one of the NVMEM cells contains the GPU speed bin value. In combination with the GPU OPP bindings, on these two platforms there is an implied scheme of converting the cell value to what the GPU OPP "opp-supported-hw" property matches. This does not apply to the base mediatek,efuse hardware, nor does it apply to any of the other platforms that do not have the GPU speed bin cell. The platform maintainer argues that this makes the compatibles incompatible with the base "mediatek,efuse" compatible, as shown in the link given. Deprecate the MT8186/MT8188 + "mediatek,efuse" combination, and add new entries with MT8186 being the base model and MT8188 falling back to MT8186. Link: https://lore.kernel.org/all/11028242-afe4-474a-9d76-cd1bd9208987@collabora.com/ Fixes: ff1df1886f43 ("dt-bindings: nvmem: mediatek: efuse: Add support for MT8188") Cc: Johnson Wang Signed-off-by: Chen-Yu Tsai Acked-by: Conor Dooley Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250712181905.6738-8-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit b45f8ad2322af62640a14ba8199a6221980b653a Author: Mikhail Kalashnikov Date: Sat Jul 12 19:19:02 2025 +0100 dt-bindings: nvmem: SID: Add binding for A523 SID controller The SID controller should be compatible with A64 and others SoC with 0x200 offset. Signed-off-by: Mikhail Kalashnikov Acked-by: "Rob Herring (Arm)" Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250712181905.6738-7-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit fc0368121686065287a24b6bf7deda20a9fafcd7 Author: Greg Kroah-Hartman Date: Sat Jul 12 19:19:01 2025 +0100 nvmem: make nvmem_bus_type constant Now that the driver core can properly handle constant struct bus_type, move the nvmem_bus_type variable to be a constant structure as well, placing it into read-only memory which can not be modified at runtime. Cc: Srinivas Kandagatla Reviewed-by: Greg Kroah-Hartman Signed-off-by: Srinivas Kandagatla Signed-off-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250712181905.6738-6-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 9d9659b054c8ff888c33e3efcbf09db4c4ab9dc6 Author: Frank Li Date: Sat Jul 12 19:19:00 2025 +0100 dt-bindings: nvmem: convert lpc1857-eeprom.txt to yaml format Convert lpc1857-eeprom.txt to yaml format. Signed-off-by: Frank Li Reviewed-by: Krzysztof Kozlowski Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250712181905.6738-5-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0e0de622c23a76a49581a418bb25148edfa55a10 Author: Alok Tiwari Date: Sat Jul 12 19:18:59 2025 +0100 nvmem: core: Fix typos in comments and MODULE_AUTHOR strings This patch fixes minor typo issues for nvmem-core.c: Corrects "form" to "from" in multiple function descriptions. Fixes missing closing angle brackets in MODULE_AUTHOR entries. These changes improve readability and formatting consistency. Signed-off-by: Alok Tiwari Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250712181905.6738-4-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit d44870ff2ad5123c74b81ac198c793a2caf84c35 Author: Sven Peter Date: Sat Jul 12 19:18:58 2025 +0100 dt-bindings: nvmem: fixed-layout: Allow optional bit positions NVMEM nodes can optionally include the bits property to specify the bit position of the cell within a byte. Extend patternProperties to allow adding the bit offset to the node address to be able to distinguish nodes with the same address but different bit positions, e.g. trim@54,4 { reg = <0x54 1>; bits = <4 2>; }; trim@54,0 { reg = <0x54 1>; bits = <0 4>; }; Before the conversion to NVMEM layouts in commit bd912c991d2e ("dt-bindings: nvmem: layouts: add fixed-layout") this extension was originally added with commit 4b2545dd19ed ("dt-bindings: nvmem: Extend patternProperties to optionally indicate bit position") to the now deprecated layout. Signed-off-by: Sven Peter Reviewed-by: "Rob Herring (Arm)" Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250712181905.6738-3-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit bc827ae21394acef43aa1ff47c79c2ab1c8ed589 Author: Sven Peter Date: Sat Jul 12 19:18:57 2025 +0100 nvmem: apple: drop default ARCH_APPLE in Kconfig When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Signed-off-by: Sven Peter Reviewed-by: Janne Grunau Signed-off-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250712181905.6738-2-srini@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5eac636917486f3f072328d7f5bcdc22bbc9a1d1 Author: Greg Kroah-Hartman Date: Tue Jul 1 14:07:01 2025 +0200 fsi: make fsi_bus_type constant Now that the driver core can properly handle constant struct bus_type, move the fsi_bus_type variable to be a constant structure as well, placing it into read-only memory which can not be modified at runtime. Cc: Ninad Palsule Cc: linux-fsi@lists.ozlabs.org Reviewed-by: Eddie James Link: https://lore.kernel.org/r/2025070100-overblown-busily-a04b@gregkh Signed-off-by: Greg Kroah-Hartman commit b8e3603a57e118dc53028b9d27cfbe487df4278c Author: Rob Herring (Arm) Date: Thu Jul 3 13:34:38 2025 -0500 fsi: master-ast-cf: Use of_reserved_mem_region_to_resource for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Signed-off-by: "Rob Herring (Arm)" Reviewed-by: Eddie James Link: https://lore.kernel.org/r/20250703183439.2073555-1-robh@kernel.org Signed-off-by: Greg Kroah-Hartman commit 966c5cd72be8989c8a559ddef8e8ff07a37c5eb0 Author: Ricky Wu Date: Fri Jul 11 22:01:43 2025 +0800 misc: rtsx: usb: Ensure mmc child device is active when card is present When a card is present in the reader, the driver currently defers autosuspend by returning -EAGAIN during the suspend callback to trigger USB remote wakeup signaling. However, this does not guarantee that the mmc child device has been resumed, which may cause issues if it remains suspended while the card is accessible. This patch ensures that all child devices, including the mmc host controller, are explicitly resumed before returning -EAGAIN. This fixes a corner case introduced by earlier remote wakeup handling, improving reliability of runtime PM when a card is inserted. Fixes: 883a87ddf2f1 ("misc: rtsx_usb: Use USB remote wakeup signaling for card insertion detection") Cc: stable@vger.kernel.org Signed-off-by: Ricky Wu Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20250711140143.2105224-1-ricky_wu@realtek.com Signed-off-by: Greg Kroah-Hartman commit 29f4103b258517bdacb50eead7e063d5e794d556 Author: Xu Yilun Date: Sat Jul 12 02:37:04 2025 +0800 MAINTAINERS: Update FPGA MANAGER maintainer Hao's email no longer works. Remove it from MAINTAINERS. Yilun takes over his maintainer entry. Signed-off-by: Xu Yilun Link: https://lore.kernel.org/r/20250711183704.1788255-1-yilun.xu@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 8ad6249c51d0ea41ad75d770178d8e4efdbc9948 Author: Alexander Sverdlin Date: Thu Jul 3 00:28:22 2025 +0200 eeprom: at25: convert to spi-mem API Replace the RAW SPI accesses with spi-mem API. The latter will fall back to RAW SPI accesses if spi-mem callbacks are not implemented by a controller driver. Notable advantages: - read function now allocates a bounce buffer for SPI DMA compatibility, similar to write function; - the driver can now be used in conjunction with SPI controller drivers providing spi-mem API only, e.g. spi-nxp-fspi. - during the initial probe the driver polls busy/ready status bit for 25ms instead of giving up instantly and hoping that the FW didn't write the EEPROM Notes: - mutex_lock() has been dropped from fm25_aux_read() because the latter is only being called in probe phase and therefore cannot race with at25_ee_read() or at25_ee_write() Quick 4KB block size test with CY15B102Q 256KB F-RAM over spi_omap2_mcspi driver (no spi-mem ops provided, fallback to raw SPI inside spi-mem): OP | throughput, KB/s | change --------+-----------------------+------- write | 1717.847 -> 1656.684 | -3.6% read | 1115.868 -> 1059.367 | -5.1% The lower throughtput probably comes from the 3 messages per SPI transfer inside spi-mem instead of hand-crafted 2 messages per transfer in the former at25 code. However, if the raw SPI access is not preserved, then the driver doesn't grow from the lines-of-code perspective and subjectively could be considered even a bit simpler. Higher performance impact on the read operation could be explained by the newly introduced bounce buffer in read operation. I didn't find any explanation or guarantee, why would a bounce buffer be not needed on the read side, so I assume it's a pure luck that nobody read EEPROM into some variable on stack on an architecture where kernel stack would be not DMA-able. Cc: Michael Walle Cc: Hui Wang Link: https://lore.kernel.org/all/28ab8b72afee1af59b628f7389f0d7f5@kernel.org/ Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250702222823.864803-1-alexander.sverdlin@siemens.com Signed-off-by: Greg Kroah-Hartman commit 8282013b56059c34590ac0245c74ea7ed7642924 Author: Lizhi Xu Date: Thu Jul 3 15:53:34 2025 +0800 vmci: Prevent the dispatching of uninitialized payloads The reproducer executes the host's unlocked_ioctl call in two different tasks. When init_context fails, the struct vmci_event_ctx is not fully initialized when executing vmci_datagram_dispatch() to send events to all vm contexts. This affects the datagram taken from the datagram queue of its context by another task, because the datagram payload is not initialized according to the size payload_size, which causes the kernel data to leak to the user space. Before dispatching the datagram, and before setting the payload content, explicitly set the payload content to 0 to avoid data leakage caused by incomplete payload initialization. To avoid the oob check failure when executing __compiletime_lessthan() in memset(), directly use the address of the vmci_event_ctx instance ev to replace ev.msg.hdr, because their addresses are the same. Fixes: 28d6692cd8fb ("VMCI: context implementation.") Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95 Tested-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com Signed-off-by: Lizhi Xu Link: https://lore.kernel.org/r/20250703075334.856445-1-lizhi.xu@windriver.com Signed-off-by: Greg Kroah-Hartman commit cf4d2ce1eded8de0a678f5e473322eef84adb5e8 Author: Alexander Sverdlin Date: Thu Jul 3 00:29:26 2025 +0200 eeprom: at25: fram: Detect and support inside-out chip variants Infineon seems to be confused with the order ID bytes should be presented by the FRAM chips and to be on the safe side they offer chips which are either JEDEC conform or the full opposite of the latter. Examples of the chips which present ID bytes in the reversed order are: CY15B102QN CY15B204QSN Let's support them nevertheless. Except reversing the ID bytes, they also have quite different density encoding even across EXCELON(tm) family. The patch has been tested with the above two chips. Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250702222927.864875-1-alexander.sverdlin@siemens.com Signed-off-by: Greg Kroah-Hartman commit 239df3e4b4752524e7c0fb3417c218d8063654b4 Author: Brahmajit Das Date: Wed Jul 2 19:29:55 2025 +0530 samples: mei: Fix building on musl libc The header bits/wordsize.h is glibc specific and on building on musl with allyesconfig results in samples/mei/mei-amt-version.c:77:10: fatal error: bits/wordsize.h: No such file or directory 77 | #include | ^~~~~~~~~~~~~~~~~ mei-amt-version.c build file without bits/wordsize.h on musl and glibc. However on musl we get the follwing error without sys/time.h samples/mei/mei-amt-version.c: In function 'mei_recv_msg': samples/mei/mei-amt-version.c:159:24: error: storage size of 'tv' isn't known 159 | struct timeval tv; | ^~ samples/mei/mei-amt-version.c:160:9: error: unknown type name 'fd_set' 160 | fd_set set; | ^~~~~~ samples/mei/mei-amt-version.c:168:9: error: implicit declaration of function 'FD_ZERO' [-Wimplicit-function-declaration] 168 | FD_ZERO(&set); | ^~~~~~~ samples/mei/mei-amt-version.c:169:9: error: implicit declaration of function 'FD_SET'; did you mean 'L_SET'? [-Wimplicit-function-declaration] 169 | FD_SET(me->fd, &set); | ^~~~~~ | L_SET samples/mei/mei-amt-version.c:170:14: error: implicit declaration of function 'select' [-Wimplicit-function-declaration] 170 | rc = select(me->fd + 1, &set, NULL, NULL, &tv); | ^~~~~~ samples/mei/mei-amt-version.c:171:23: error: implicit declaration of function 'FD_ISSET' [-Wimplicit-function-declaration] 171 | if (rc > 0 && FD_ISSET(me->fd, &set)) { | ^~~~~~~~ samples/mei/mei-amt-version.c:159:24: warning: unused variable 'tv' [-Wunused-variable] 159 | struct timeval tv; | ^~ Hence the the file has been included. Fixes: c52827cc4ddf ("staging/mei: add mei user space example") Signed-off-by: Brahmajit Das Link: https://lore.kernel.org/r/20250702135955.24955-1-listout@listout.xyz Signed-off-by: Greg Kroah-Hartman commit e8b18c11731d3631559d13269dfb0437dc63106f Author: Krzysztof Kozlowski Date: Wed Jul 16 08:49:04 2025 +0200 cdx: Fix missing GENERIC_MSI_IRQ on compile test CDX_BUS driver uses msi_setup_device_data() which is selected by GENERIC_MSI_IRQ, thus compile testing without the latter failed: /usr/bin/ld: drivers/cdx/cdx.o: in function `cdx_probe': build/drivers/cdx/cdx.c:314: undefined reference to `msi_setup_device_data' Reported-by: Randy Dunlap Closes: https://lore.kernel.org/all/b2c54a12-480c-448a-8b90-333cb03d9c14@infradead.org/ Fixes: 7f81907b7e3f ("cdx: Enable compile testing") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250716064903.52397-2-krzysztof.kozlowski@linaro.org Signed-off-by: Greg Kroah-Hartman commit 73cca2a7467b1ca91f7a7371a38b538061c7e58e Author: Rob Herring (Arm) Date: Thu Jul 3 13:34:54 2025 -0500 misc: fastrpc: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. The error handling is a bit different. "memory-region" is optional, so failed lookup is not an error. But then an error in of_reserved_mem_lookup() is treated as an error. However, that distinction is not really important. Either the region is available and usable or it is not. So now, it is just of_reserved_mem_region_to_resource() which is checked for an error. Signed-off-by: "Rob Herring (Arm)" Reviewed-by: Dmitry Baryshkov Reviewed-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250703183455.2074215-1-robh@kernel.org Signed-off-by: Greg Kroah-Hartman commit 77e49c3588689cf3c9a344c7cc80fb4e61c1375e Author: Abhinav Ananthu Date: Mon Jul 7 09:47:20 2025 +0200 mcb: use sysfs_emit_at() instead of scnprintf() in show functions This change improves clarity and ensures proper bounds checking in line with the preferred sysfs_emit() API usage for sysfs 'show' functions. The PAGE_SIZE check is now handled internally by the helper. No functional change intended. Signed-off-by: Abhinav Ananthu Signed-off-by: Johannes Thumshirn Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20250707074720.40051-2-jth@kernel.org Signed-off-by: Greg Kroah-Hartman commit d1934ed9803c6a36280fbe5a9e91dd7df432bfe7 Author: Tiffany Yang Date: Mon Jul 14 11:53:19 2025 -0700 binder: encapsulate individual alloc test cases Each case tested by the binder allocator test is defined by 3 parameters: the end alignment type of each requested buffer allocation, whether those buffers share the front or back pages of the allotted address space, and the order in which those buffers should be released. The alignment type represents how a binder buffer may be laid out within or across page boundaries and relative to other buffers, and it's used along with whether the buffers cover part (sharing the front pages) of or all (sharing the back pages) of the vma to calculate the sizes passed into each test. binder_alloc_test_alloc recursively generates each possible arrangement of alignment types and then tests that the binder_alloc code tracks pages correctly when those buffers are allocated and then freed in every possible order at both ends of the address space. While they provide comprehensive coverage, they are poor candidates to be represented as KUnit test cases, which must be statically enumerated. For 5 buffers and 5 end alignment types, the test case array would have 750,000 entries. This change structures the recursive calls into meaningful test cases so that failures are easier to interpret. Signed-off-by: Tiffany Yang Acked-by: Carlos Llamas Link: https://lore.kernel.org/r/20250714185321.2417234-7-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman commit f6544dcdd0d2feb74f395072d8df52e3bea4be51 Author: Tiffany Yang Date: Mon Jul 14 11:53:18 2025 -0700 binder: Convert binder_alloc selftests to KUnit Convert the existing binder_alloc_selftest tests into KUnit tests. These tests allocate and free an exhaustive combination of buffers with various sizes and alignments. This change allows them to be run without blocking or otherwise interfering with other processes in binder. This test is refactored into more meaningful cases in the subsequent patch. Signed-off-by: Tiffany Yang Acked-by: Carlos Llamas Link: https://lore.kernel.org/r/20250714185321.2417234-6-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman commit 5e024582f494c6ff5eb2bec5183fd1eb35462500 Author: Tiffany Yang Date: Mon Jul 14 11:53:17 2025 -0700 binder: Scaffolding for binder_alloc KUnit tests Add setup and teardown for testing binder allocator code with KUnit. Include minimal test cases to verify that tests are initialized correctly. Tested-by: Rae Moar Signed-off-by: Tiffany Yang Acked-by: Carlos Llamas Link: https://lore.kernel.org/r/20250714185321.2417234-5-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman commit bdfa89c489296f092751fcee23b5d171c9fdc7f5 Author: Tiffany Yang Date: Mon Jul 14 11:53:16 2025 -0700 kunit: test: Export kunit_attach_mm() Tests can allocate from virtual memory using kunit_vm_mmap(), which transparently creates and attaches an mm_struct to the test runner if one is not already attached. This is suitable for most cases, except for when the code under test must access a task's mm before performing an mmap. Expose kunit_attach_mm() as part of the interface for those cases. This does not change the existing behavior. Cc: David Gow Signed-off-by: Tiffany Yang Reviewed-by: Carlos Llamas Link: https://lore.kernel.org/r/20250714185321.2417234-4-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman commit 4328a52642993a0f64c6f9f39b93d2abea0b1a72 Author: Tiffany Yang Date: Mon Jul 14 11:53:15 2025 -0700 binder: Store lru freelist in binder_alloc Store a pointer to the free pages list that the binder allocator should use for a process inside of struct binder_alloc. This change allows binder allocator code to be tested and debugged deterministically while a system is using binder; i.e., without interfering with other binder processes and independently of the shrinker. This is necessary to convert the current binder_alloc_selftest into a kunit test that does not rely on hijacking an existing binder_proc to run. A binder process's binder_alloc->freelist should not be changed after it is initialized. A sole exception is the process that runs the existing binder_alloc selftest. Its freelist can be temporarily replaced for the duration of the test because it runs as a single thread before any pages can be added to the global binder freelist, and the test frees every page it allocates before dropping the binder_selftest_lock. This exception allows the existing selftest to be used to check for regressions, but it will be dropped when the binder_alloc tests are converted to kunit in a subsequent patch in this series. Signed-off-by: Tiffany Yang Acked-by: Carlos Llamas Link: https://lore.kernel.org/r/20250714185321.2417234-3-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman commit bea3e7bfa2957d986683543cbf57092715f9a91b Author: Tiffany Yang Date: Mon Jul 14 11:53:14 2025 -0700 binder: Fix selftest page indexing The binder allocator selftest was only checking the last page of buffers that ended on a page boundary. Correct the page indexing to account for buffers that are not page-aligned. Signed-off-by: Tiffany Yang Acked-by: Carlos Llamas Link: https://lore.kernel.org/r/20250714185321.2417234-2-ynaffit@google.com Signed-off-by: Greg Kroah-Hartman commit 01afddcac630b8c6a5f44ac5d0e508ca440e44a2 Author: Dmitry Antipov Date: Thu Jun 26 10:30:54 2025 +0300 binder: use guards for plain mutex- and spinlock-protected sections Use 'guard(mutex)' and 'guard(spinlock)' for plain (i.e. non-scoped) mutex- and spinlock-protected sections, respectively, thus making locking a bit simpler. Briefly tested with 'stress-ng --binderfs'. Signed-off-by: Dmitry Antipov Reviewed-by: Alice Ryhl Acked-by: Carlos Llamas Link: https://lore.kernel.org/r/20250626073054.7706-2-dmantipov@yandex.ru Signed-off-by: Greg Kroah-Hartman commit 1da2dca2fb3ab241da86890312f2bfb9c1d0d6c3 Author: Dmitry Antipov Date: Thu Jun 26 10:30:53 2025 +0300 binder: use kstrdup() in binderfs_binder_device_create() In 'binderfs_binder_device_create()', use 'kstrdup()' to copy the newly created device's name, thus making the former a bit simpler. Signed-off-by: Dmitry Antipov Acked-by: Carlos Llamas Reviewed-by: "Tiffany Y. Yang" Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250626073054.7706-1-dmantipov@yandex.ru Signed-off-by: Greg Kroah-Hartman commit 4eda2606181ca3b5e76d2ed8717d5ca2eab91e18 Author: Thomas Richter Date: Wed Jun 25 07:43:37 2025 +0200 s390/pai_crypto: Rename PAI Crypto event 4210 The PAI crypto event number 4210 is named PCC_COMPUTE_LAST_BLOCK_CMAC_USING_ENCRYPTED_AES_256A According to the z16 and z17 Principle of Operation documents SA22-7832-13 and SA22-7832-14 the event is named PCC_COMPUTE_LAST_BLOCK_CMAC_USING_ENCRYPTED_AES_256 without a trailing 'A'. Adjust this event name. Signed-off-by: Thomas Richter Reviewed-by: Sumanth Korikkar Signed-off-by: Alexander Gordeev commit 35cff7af7598b9eb143cc0556e5532e2ded3b61a Author: Sakari Ailus Date: Tue May 20 13:34:37 2025 +0300 container_of: Document container_of() is not to be used in new code There is a warning in the kerneldoc documentation of container_of() that constness of its ptr argument is lost. While this is a valid suggestion container_of_const() should be used instead, the vast majority of new code still uses container_of(): $ git diff v6.13 v6.14|grep container_of\(|wc -l 646 $ git diff v6.13 v6.14|grep container_of_const|wc -l 9 Make an explicit recommendation to use container_of_const(). Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250520103437.468691-1-sakari.ailus@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 6beb4ec0f9fdff4c4c6eb8ed8654fe8396c2b6e0 Author: Johan Hovold Date: Tue Jul 8 10:46:54 2025 +0200 driver core: auxiliary bus: fix OF node leak Make sure to drop the OF node reference taken when creating an auxiliary device using auxiliary_device_create() when the device is later released. Fixes: eaa0d30216c1 ("driver core: auxiliary bus: add device creation helpers") Cc: Jerome Brunet Signed-off-by: Johan Hovold Reviewed-by: Danilo Krummrich Reviewed-by: Jerome Brunet Link: https://lore.kernel.org/r/20250708084654.15145-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman commit f751fe2a2acbe8cc20da35f118f589ac3b316b78 Author: Meng Shao Liu Date: Wed Jul 16 14:46:29 2025 +0800 samples/kobject: make attribute_group const The attr_group structures are allocated once and never modified at runtime. Also to match the const‑qualified parameter of sysfs_create_group(). Signed-off-by: Meng Shao Liu Link: https://lore.kernel.org/r/dc94227eaf337a2b92ab77dffa0da9f7f1f84c4e.1752646650.git.sau525@gmail.com Signed-off-by: Greg Kroah-Hartman commit 42573e4df8e2318fce6a711e0f9cafc9e3dc1483 Author: Meng Shao Liu Date: Wed Jul 16 14:46:28 2025 +0800 samples/kobject: fix path comment The introductory comment still says the example creates /sys/kernel/kobject-example, but the code actually creates /sys/kernel/kobject_example. Update both comments to reflect the actual sysfs paths. Also, fix "tree"->"three" typo in kset-example.c. Signed-off-by: Meng Shao Liu Link: https://lore.kernel.org/r/5be61d284a1850f573658f1c105f0b6062e41332.1752646650.git.sau525@gmail.com Signed-off-by: Greg Kroah-Hartman commit d929cc75e9791def049a90998aaab8934196131c Author: Darshan Rathod Date: Wed Jul 16 09:59:05 2025 +0000 spi: gpio: Use explicit 'unsigned int' for parameter types The C standard allows 'unsigned' as a shorthand for 'unsigned int'. For improved code clarity and consistency with the prevailing kernel coding style, replace the shorthand with the more explicit 'unsigned int' type for function parameters. This is a purely stylistic cleanup and has no functional impact on the generated code. Signed-off-by: Darshan Rathod Link: https://patch.msgid.link/20250716095906.21812-1-darshanrathod475@gmail.com Signed-off-by: Mark Brown commit 63be976da994260ea116c431a2e61485dbede1b0 Author: Jeff Chang Date: Wed Jul 16 10:08:30 2025 +0800 regulator: rt6160: Add rt6166 vout min_uV setting for compatible 1. remove unintentional GPL change 2. using switch case for Device ID probe check. Signed-off-by: Jeff Chang Link: https://patch.msgid.link/20250716021230.2660564-1-jeff_chang@richtek.com Signed-off-by: Mark Brown commit 8778837f0a5b7c1bc5dbf0cccd7619fec6981588 Author: Alexander Stein Date: Wed Jul 16 08:57:07 2025 +0200 ASoC: codec: tlv320aic32x4: Fix reset GPIO check rstn_gpio being a GPIO descriptor the check is wrong (inverted) for releasing the reset of the codec. Fixes: 790d5f8ee6f2 ("ASoC: codec: tlv320aic32x4: Convert to GPIO descriptors") Signed-off-by: Alexander Stein Reviewed-by: Peng Fan Link: https://patch.msgid.link/20250716065708.4041153-1-alexander.stein@ew.tq-group.com Signed-off-by: Mark Brown commit aa84580e058c4d7567b2a5e5a9d12f94af75d297 Author: Krzysztof Kozlowski Date: Wed Jul 16 09:49:58 2025 +0200 ASoC: dt-bindings: qcom,lpass-va-macro: Define clock-names in top-level Device variants use different amount of clock inputs, but all of them are in the same order, 'clock-names' in top-level properties can define the list and each if:then: block can only narrow the number of items. This is preferred syntax, because it keeps list unified among devices and encourages adding new entries to the end of the list, instead of adding them in the middle. The change has no functional impact, but partially reverts approach implemented in commit cfad817095e1 ("ASoC: dt-bindings: qcom,lpass-va-macro: Add missing NPL clock"). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250716074957.102402-2-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit a55863ba4c9ea9febe81ecf7dba36e7989a37b7e Author: Javier Martinez Canillas Date: Tue Jul 15 13:03:54 2025 +0200 drm/sitronix/st7571-i2c: Add support for the ST7567 Controller The Sitronix ST7567 is a monochrome Dot Matrix LCD Controller that has SPI, I2C and parallel interfaces. The st7571-i2c driver only has support for I2C so displays using other transport interfaces are currently not supported. The DRM_FORMAT_R1 pixel format and data commands are the same than what is used by the ST7571 controller, so only is needed a different callback that implements the expected initialization sequence for the ST7567 chip. Reviewed-by: Marcus Folkesson Reviewed-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250715110411.448343-6-javierm@redhat.com Signed-off-by: Javier Martinez Canillas commit d2bfb999640fcc5759ddae5ea9a5b98a03da9fd3 Author: Javier Martinez Canillas Date: Tue Jul 15 13:03:53 2025 +0200 dt-bindings: display: Add Sitronix ST7567 LCD Controller Sitronix ST7567 is a monochrome Dot Matrix LCD Controller. Reviewed-by: Rob Herring (Arm) Reviewed-by: Marcus Folkesson Link: https://lore.kernel.org/r/20250715110411.448343-5-javierm@redhat.com Signed-off-by: Javier Martinez Canillas commit d9ace6d5508020040fa39edbc72a1c544a99bbbe Author: Javier Martinez Canillas Date: Tue Jul 15 13:03:52 2025 +0200 drm/sitronix/st7571-i2c: Add an indirection level to parse DT Other Sitronix display controllers might need a different parsing DT logic, so lets add a .parse_dt callback to struct st7571_panel_data. Suggested-by: Thomas Zimmermann Reviewed-by: Marcus Folkesson Link: https://lore.kernel.org/r/20250715110411.448343-4-javierm@redhat.com Signed-off-by: Javier Martinez Canillas commit 720799d9462ccade1deb8d05d8b63e2cfd7f4e41 Author: Javier Martinez Canillas Date: Tue Jul 15 13:03:51 2025 +0200 drm/sitronix/st7571-i2c: Log probe deferral cause for GPIO get failure The driver already uses the dev_err_probe() helper (that only prints error messages for the -EPROBE_DEFER case) when fails to get any other resource. Also do the same when it fails to obtain the reset GPIO. Reviewed-by: Marcus Folkesson Link: https://lore.kernel.org/r/20250715110411.448343-3-javierm@redhat.com Signed-off-by: Javier Martinez Canillas commit 1d043d6c00b010c186ad0ddab0a0b9bd648e9bf1 Author: Javier Martinez Canillas Date: Tue Jul 15 13:03:50 2025 +0200 drm/sitronix/st7571-i2c: Fix encoder callbacks function names It seems the driver took some inspiration from ssd130x and some of the functions (encoder callbacks) were not renamed to use a st7571_ prefix. Reviewed-by: Marcus Folkesson Link: https://lore.kernel.org/r/20250715110411.448343-2-javierm@redhat.com Signed-off-by: Javier Martinez Canillas commit c3ad4ec3fdaba1f5367dd15b5a2e6dc9a9cde3f1 Merge: e70821288f697e 21b34a3a204ed6 Author: Ulf Hansson Date: Wed Jul 16 12:05:36 2025 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v6.16-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit e70821288f697ec67a7119e78d9558e82cabb36c Author: Binbin Zhou Date: Wed Jul 16 14:44:21 2025 +0800 mmc: loongson2: Unify the function prefixes for loongson2_mmc_pdata The function prefixes for loongson2_mmc_pdata follow two naming conventions: SoC-based and DMA-based. First, DMA-based prefixes are the preferred choice, as they clearly highlight differences, such as prepare_dma; however, for functions related to SoC, such as reorder_cmd_data, it is agreed to use the smallest SoC name as the fallback prefix, such as ls2k0500. No functional change intended. Suggested-by: Huacai Chen Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/20250716064421.3823418-1-zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 553d38234091969bb28fd0841f92f5d8578daab7 Author: Dan Carpenter Date: Tue Jul 15 18:00:58 2025 -0500 mmc: loongson2: Fix error code in loongson2_mmc_resource_request() There is a cut and paste bug so we accidentally return the wrong variable. It should be "ret" instead of PTR_ERR(host->clk). Fixes: 2115772014bd ("mmc: loongson2: Add Loongson-2K SD/SDIO controller driver") Signed-off-by: Dan Carpenter Reviewed-by: Binbin Zhou Link: https://lore.kernel.org/r/847bf395-6d62-49c9-a39d-8e82c5b17bf7@sabinyo.mountain Signed-off-by: Ulf Hansson commit ce32eff1cf3ae8ac2596171dd0af1657634c83eb Author: Greg Kroah-Hartman Date: Tue Jul 1 13:06:16 2025 +0200 staging: greybus: gbphy: fix up const issue with the match callback gbphy_dev_match_id() should be taking a const pointer, as the pointer passed to it from the container_of() call was const to start with (it was accidentally cast away with the call.) Fix this all up by correctly marking the pointer types. Cc: Alex Elder Cc: greybus-dev@lists.linaro.org Fixes: d69d80484598 ("driver core: have match() callback in struct bus_type take a const *") Reviewed-by: Johan Hovold Link: https://lore.kernel.org/r/2025070115-reoccupy-showy-e2ad@gregkh Signed-off-by: Greg Kroah-Hartman commit 27cb8f702eb789f97f7a8bd5a91d76c65a937b2f Author: Binbin Zhou Date: Mon Jul 14 14:45:42 2025 +0800 gpio: loongson-64bit: Extend GPIO irq support Add the interrupt enable register offset (inten_offset) so that GPIO interrupts can be enabled normally on more models. According to the latest interface specifications, the definition of GPIO interrupts in ACPI is similar to that in FDT. The GPIO interrupts are listed one by one according to the GPIO number, and the corresponding interrupt number can be obtained directly through the GPIO number specified by the consumer. Signed-off-by: Xi Ruoyao Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/20250714064542.2276247-1-zhoubinbin@loongson.cn [Bartosz: tweaked the commit message] Signed-off-by: Bartosz Golaszewski commit 76689eb526673d2dfab82d49c41e03caaff838fe Author: Christian König Date: Thu Jul 10 16:25:21 2025 +0200 drm/ttm: remove ttm_bo_validate_swapout test The test is quite fragile since it tries to allocate halve available system memory + 1 page. If the system has either not enough memory to make the allocation work with other things running in parallel or to much memory so the allocation fails as to large/invalid the test will fail. Completely remove the test. We already validate swapout on the device level and that test seems to be stable. Signed-off-by: Christian König Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250710144129.1803-2-christian.koenig@amd.com commit 8b824e9d2d0acf9f8c7f33fa8afd6016e8bb9ab4 Author: Christian König Date: Thu Jul 10 15:45:20 2025 +0200 drm/ttm: fix locking in test ttm_bo_validate_no_placement_signaled The test works even without it, but lockdep starts screaming when it is activated. Trivially fix it by acquiring the lock before we try to allocate something. Signed-off-by: Christian König Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250710144129.1803-1-christian.koenig@amd.com commit 103f5d8c35b3d22b700f1f6d585e499b2df62df6 Author: Mikulas Patocka Date: Mon Jul 14 18:17:15 2025 +0200 tty: omit need_resched() before cond_resched() There's no need to call need_resched() because cond_resched() will do nothing if need_resched() returns false. Signed-off-by: Mikulas Patocka Link: https://lore.kernel.org/r/5a11ad09-5508-933c-f044-6a236bf00557@redhat.com Signed-off-by: Greg Kroah-Hartman commit a48e897b6999eec1da6dc37e9af834dd2a88a0bb Author: Chaitanya Vadrevu Date: Fri Jul 11 15:04:18 2025 -0500 serial: 8250_ni: Reorder local variables Reorder local variables in ni16550_probe to follow reverse Christmas tree style. Cc: Jason Smith Cc: Gratian Crisan Signed-off-by: Chaitanya Vadrevu Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20250711200418.1858682-3-chaitanya.vadrevu@emerson.com Signed-off-by: Greg Kroah-Hartman commit 515c8e2245dd36916f4cbafb2ac19fae836fd560 Author: Chaitanya Vadrevu Date: Fri Jul 11 15:04:17 2025 -0500 serial: 8250_ni: Fix build warning Allocate memory on heap instead of stack to fix following warning that clang version 20.1.2 produces on W=1 build. drivers/tty/serial/8250/8250_ni.c:277:12: warning: stack frame size (1072) exceeds limit (1024) in 'ni16550_probe' [-Wframe-larger-than] 277 | static int ni16550_probe(struct platform_device *pdev) | ^ 1 warning generated. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507030557.vIewJJQO-lkp@intel.com/ Cc: Jason Smith Cc: Gratian Crisan Signed-off-by: Chaitanya Vadrevu Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20250711200418.1858682-2-chaitanya.vadrevu@emerson.com Signed-off-by: Greg Kroah-Hartman commit 65acd0d86f2fa104fc0a0c9d86aa1ee6b1a4763e Author: Geert Uytterhoeven Date: Wed Jul 9 21:01:20 2025 +0200 serial: sh-sci: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas SuperH SCI(F) serial port driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/a5628fe028362ae3f8729021a7864dd39f7869bf.1752086885.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 5103fbb7b59f7a078284a345d82bdab0f0ee6d08 Author: Dan Carpenter Date: Tue Jul 15 17:58:34 2025 -0500 gpio: viperboard: Unlock on error in vprbrd_gpiob_direction_output() Unlock before returning if vprbrd_gpiob_setdir() fails. Fixes: 55e2d1eec110 ("gpio: viperboard: use new GPIO line value setter callbacks") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/9e72018c-e46e-4e55-83e4-503da4d022fc@sabinyo.mountain Signed-off-by: Bartosz Golaszewski commit 687d974a218a719f7e729bef9c498ec36f18115e Author: Sowon Na Date: Wed Jul 2 10:33:09 2025 +0900 dt-bindings: soc: samsung: exynos-sysreg: add hsi2 for ExynosAutov920 Add hsi2 compatible for ExynosAutov920 ufs shareability register to set io coherency of the ExynosAutov920 ufs. Signed-off-by: Sowon Na Link: https://lore.kernel.org/r/20250702013316.2837427-4-sowon.na@samsung.com Signed-off-by: Krzysztof Kozlowski commit 0c0438d444a7814783099c9028823bff5977e4f0 Author: Bartosz Golaszewski Date: Fri Jul 4 14:58:57 2025 +0200 gpio: TODO: remove the task for the sysfs rework Remove the completed task tracking the rework of the sysfs interface and add a new task to track the removal of the legacy bits and pieces. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-10-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski commit e69c6db4cdbc149ff090f1449a114c33ba766dc8 Author: Bartosz Golaszewski Date: Fri Jul 4 14:58:56 2025 +0200 gpio: sysfs: allow disabling the legacy parts of the GPIO sysfs interface Add a Kconfig switch allowing to disable the legacy parts of the GPIO sysfs interface. This means that even though we keep the /sys/class/gpio/ directory, it no longer contains the global export/unexport attribute pair (instead, the user should use the per-chip export/unpexport) nor the gpiochip$BASE entries. This option default to y if GPIO sysfs is enabled but we'll default it to n at some point in the future. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-9-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski commit 4fa93223e03eea3243db83786f556b6c1494de3e Author: Bartosz Golaszewski Date: Fri Jul 4 14:58:55 2025 +0200 gpio: sysfs: export the GPIO directory locally in the gpiochip directory As a way to allow the user-space to stop referring to GPIOs by their global numbers, introduce a parallel group of line attributes for exported GPIO that live inside the GPIO chip class device and are referred to by their HW offset within their parent chip. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-8-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski commit 1cd53df733c21ae0d344a2dec941a3e2a06fefd9 Author: Bartosz Golaszewski Date: Fri Jul 4 14:58:54 2025 +0200 gpio: sysfs: don't look up exported lines as class devices In preparation for adding a parallel, per-chip attribute group for exported GPIO lines, stop using class device APIs to refer to it in the code. When unregistering the chip, don't call class_find_device() but instead store exported lines in a linked list inside the GPIO chip data object and look it up there. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-7-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski commit f7d4fb62d04542646a48de08b10354692f3b98ce Author: Bartosz Golaszewski Date: Fri Jul 4 14:58:53 2025 +0200 gpio: sysfs: don't use driver data in sysfs callbacks for line attributes Currently each exported GPIO is represented in sysfs as a separate class device. This allows us to simply use dev_get_drvdata() to retrieve the pointer passed to device_create_with_groups() from sysfs ops callbacks. However, we're preparing to add a parallel set of per-line sysfs attributes that will live inside the associated gpiochip group. They are not registered as class devices and so have the parent device passed as argument to their callbacks (the GPIO chip class device). Put the attribute structs inside the GPIO descriptor data and dereference the relevant ones using container_of() in the callbacks. This way, we'll be able to reuse the same code for both the legacy and new GPIO attributes. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-6-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski commit 12faec7ed1793221c1dc9f69575a814528d74691 Author: Bartosz Golaszewski Date: Fri Jul 4 14:58:52 2025 +0200 gpio: sysfs: rename the data variable in gpiod_(un)export() In preparation for future commits which will make use of descriptor AND GPIO-device data in the same functions rename the former from data to desc_data separately which will make future changes smaller and easier to read. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-5-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski commit 7c49c1298f3ab3331008e85ac22b2d32b4bb450f Author: Bartosz Golaszewski Date: Fri Jul 4 14:58:51 2025 +0200 gpio: sysfs: pass gpiod_data directly to internal GPIO sysfs functions We don't use any fields from struct device in gpio_sysfs_request_irq(), gpio_sysfs_free_irq() and gpio_sysfs_set_active_low(). We only use the dev argument to get the associated struct gpiod_data pointer with dev_get_drvdata(). To make the transition to not using dev_get_drvdata() across line callbacks for sysfs attributes easier, pass gpiod_data directly to these functions instead of having it wrapped in struct device. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-4-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski commit c38c3a349b7bb994252e93c7c122fa0b50ddf12b Author: Bartosz Golaszewski Date: Fri Jul 4 14:58:50 2025 +0200 gpio: sysfs: only get the dirent reference for the value attr once There's no reason to retrieve the reference to the sysfs dirent every time we request an interrupt, we can as well only do it once when exporting the GPIO. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-3-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski commit 2028f854b3f5b3816cd5d5dd83057a873eddc4d6 Author: Bartosz Golaszewski Date: Fri Jul 4 14:58:49 2025 +0200 gpio: sysfs: add a parallel class device for each GPIO chip using device IDs In order to enable moving away from the global GPIO numberspace-based exporting of lines over sysfs: add a parallel, per-chip entry under /sys/class/gpio/ for every registered GPIO chip, denoted by device ID in the file name and not its base GPIO number. Compared to the existing chip group: it does not contain the "base" attribute as the goal of this change is to not refer to GPIOs by their global number from user-space anymore. It also contains its own, per-chip export/unexport attribute pair which allow to export lines by their hardware offset within the chip. Caveat #1: the new device cannot be a link to (or be linked to by) the existing "gpiochip" entry as we cannot create links in /sys/class/xyz/. Caveat #2: the new entry cannot be named "gpiochipX" as it could conflict with devices whose base is statically defined to a low number. Let's go with "chipX" instead. While at it: the chip label is unique so update the untrue statement when extending the docs. Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-2-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski commit 32ad0b9a17f9aa8dd9308feda671bda98b274d24 Author: Bartosz Golaszewski Date: Fri Jul 4 14:58:48 2025 +0200 gpio: sysfs: use gpiod_is_equal() to compare GPIO descriptors We have a dedicated comparator for GPIO descriptors that performs additional checks and hides the implementation detail of whether the same GPIO can be associated with two separate struct gpio_desc objects. Use it in sysfs code Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250704-gpio-sysfs-chip-export-v4-1-9289d8758243@linaro.org Signed-off-by: Bartosz Golaszewski commit 26b6443826d98ac1f5c780788549b8df30e12fa2 Author: Bartosz Golaszewski Date: Tue Jul 15 10:19:45 2025 +0200 gpio: wcove: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250715-gpiochip-set-rv-gpio-remaining-v2-2-072b4cf06330@linaro.org Signed-off-by: Bartosz Golaszewski commit 03d4bd5729f3adb3dbf923ab08affb5bad262d53 Author: Bartosz Golaszewski Date: Tue Jul 15 10:19:44 2025 +0200 gpio: wcove: use regmap_assign_bits() in .set() Replace the if-else with a direct call to the regmap_assign_bits() helper and save a couple lines of code. Reviewed-by: Kuppuswamy Sathyanarayanan Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250715-gpiochip-set-rv-gpio-remaining-v2-1-072b4cf06330@linaro.org Signed-off-by: Bartosz Golaszewski commit e85931d1cd699307e6a3f1060cbe4c42748f3fff Author: Dan Carpenter Date: Tue Jul 15 18:03:17 2025 -0500 fs: tighten a sanity check in file_attr_to_fileattr() The fattr->fa_xflags is a u64 that comes from the user. This is a sanity check to ensure that the users are only setting allowed flags. The problem is that it doesn't check the upper 32 bits. It doesn't really affect anything but for more flexibility in the future, we want to enforce users zero out those bits. Fixes: be7efb2d20d6 ("fs: introduce file_getattr and file_setattr syscalls") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/baf7b808-bcf2-4ac1-9313-882c91cc87b2@sabinyo.mountain Signed-off-by: Christian Brauner commit 0a686b9c4f847dc21346df8e56d5b119918fefef Author: Nathan Chancellor Date: Mon Jul 14 11:30:04 2025 -0700 iio: adc: ad_sigma_delta: Select IIO_BUFFER_DMAENGINE and SPI_OFFLOAD CONFIG_AD_SIGMA_DELTA uses several symbols that it does not explicitly select. If no other enabled driver selects them, the build fails with either a linker failure if the driver is built in or a modpost failure if the driver is a module. ld.lld: error: undefined symbol: devm_spi_offload_rx_stream_request_dma_chan ld.lld: error: undefined symbol: devm_iio_dmaengine_buffer_setup_with_handle ld.lld: error: undefined symbol: devm_spi_offload_trigger_get ld.lld: error: undefined symbol: devm_spi_offload_get ld.lld: error: undefined symbol: spi_offload_trigger_enable ld.lld: error: undefined symbol: spi_offload_trigger_disable Select the necessary Kconfig symbols to include these functions in the build to clear up the errors. Fixes: 219da3ea842a ("iio: adc: ad_sigma_delta: add SPI offload support") Signed-off-by: Nathan Chancellor Reviewed-by: David Lechner Link: https://patch.msgid.link/20250714-iio-ad_sigma_delta-fix-kconfig-selects-v1-1-32e0d6da0423@kernel.org Signed-off-by: Jonathan Cameron commit 6fa908abd19cc35c205f343b79c67ff38dbc9b76 Author: David Lechner Date: Thu Jul 10 15:43:40 2025 -0500 iio: adc: ad7173: fix setting ODR in probe Fix the setting of the ODR register value in the probe function for AD7177. The AD7177 chip has a different ODR value after reset than the other chips (0x7 vs. 0x0) and 0 is a reserved value on that chip. The driver already has this information available in odr_start_value and uses it when checking valid values when writing to the sampling_frequency attribute, but failed to set the correct initial value in the probe function. Fixes: 37ae8381ccda ("iio: adc: ad7173: add support for additional models") Signed-off-by: David Lechner Link: https://patch.msgid.link/20250710-iio-adc-ad7173-fix-setting-odr-in-probe-v1-1-78a100fec998@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit 1d9a21ffb43b6fd326ead98f0d0afd6d104b739a Author: David Lechner Date: Tue Jul 8 20:38:33 2025 -0500 iio: adc: ad7173: fix calibration channel Fix the channel index values passed to ad_sd_calibrate() in ad7173_calibrate_all(). ad7173_calibrate_all() expects these values to be that of the CHANNELx register assigned to the channel, not the datasheet INPUTx number of the channel. The incorrect values were causing register writes to fail for some channels because they set the WEN bit that must always be 0 for register access and set the R/W bit to read instead of write. For other channels, the channel number was just wrong because the CHANNELx registers are generally assigned in reverse order and so almost never match the INPUTx numbers. Fixes: 031bdc8aee01 ("iio: adc: ad7173: add calibration support") Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250708-iio-adc-ad7313-fix-calibration-channel-v1-1-e6174e2c7cbf@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit 92c247216918fcaa64244248ee38a0f1d342278c Author: David Lechner Date: Sun Jul 6 13:53:08 2025 -0500 iio: adc: ad7173: fix num_slots Fix the num_slots value for most chips in the ad7173 driver. The correct value is the number of CHANNELx registers on the chip. In commit 4310e15b3140 ("iio: adc: ad7173: don't make copy of ad_sigma_delta_info struct"), we refactored struct ad_sigma_delta_info to be static const data instead of being dynamically populated during driver probe. However, there was an existing bug in commit 76a1e6a42802 ("iio: adc: ad7173: add AD7173 driver") where num_slots was incorrectly set to the number of CONFIGx registers instead of the number of CHANNELx registers. This bug was partially propagated to the refactored code in that the 16-channel chips were only given 8 slots instead of 16 although we did managed to fix the 8-channel chips and one of the 4-channel chips in that commit. However, we botched two of the 4-channel chips and ended up incorrectly giving them 8 slots during the refactoring. This patch fixes that mistake on the 4-channel chips and also corrects the 16-channel chips to have 16 slots. Fixes: 4310e15b3140 ("iio: adc: ad7173: don't make copy of ad_sigma_delta_info struct") Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250706-iio-adc-ad7173-fix-num_slots-on-most-chips-v3-1-d1f5453198a7@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit 0eb8d7b25397330beab8ee62c681975b79f37223 Author: David Lechner Date: Thu Jul 3 14:51:17 2025 -0500 iio: adc: ad7173: fix channels index for syscalib_mode Fix the index used to look up the channel when accessing the syscalib_mode attribute. The address field is a 0-based index (same as scan_index) that it used to access the channel in the ad7173_channels array throughout the driver. The channels field, on the other hand, may not match the address field depending on the channel configuration specified in the device tree and could result in an out-of-bounds access. Fixes: 031bdc8aee01 ("iio: adc: ad7173: add calibration support") Signed-off-by: David Lechner Link: https://patch.msgid.link/20250703-iio-adc-ad7173-fix-channels-index-for-syscalib_mode-v1-1-7fdaedb9cac0@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit 66d4374d97f85516b5a22418c5e798aed2606dec Author: David Lechner Date: Thu Jul 3 16:07:44 2025 -0500 iio: adc: ad_sigma_delta: change to buffer predisable Change the buffer disable callback from postdisable to predisable. This balances the existing posteanble callback. Using postdisable with posteanble can be problematic, for example, if update_scan_mode fails, it would call postdisable without ever having called posteanble, so the drivers using this would be in an unexpected state when postdisable was called. Fixes: af3008485ea0 ("iio:adc: Add common code for ADI Sigma Delta devices") Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250703-iio-adc-ad_sigma_delta-buffer-predisable-v1-1-f2ab85138f1f@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit ad5468af799e94feef8acb2d03eb0bb724e94037 Author: Ignacio Pena Date: Wed Jul 16 01:33:56 2025 -0400 staging: sm750fb: fix function parameter alignment Fix checkpatch warning about improper function parameter alignment in sm750_hw_cursor_set_pos function call. Signed-off-by: Ignacio Pena Link: https://lore.kernel.org/r/20250716053357.64711-1-ignacio.pena87@gmail.com Signed-off-by: Greg Kroah-Hartman commit 473b892dd7ad2af8bf9fccb0e47e83cd8f4c3af1 Author: Michael Straube Date: Tue Jul 15 20:28:14 2025 +0200 staging: rtl8723bs: remove struct hal_ops After previous patches, struct hal_ops is finally empty now. Remove the structure and related initialization functions. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-12-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 86dcc99669e253dd68838a5ff24fac1c11913a8d Author: Michael Straube Date: Tue Jul 15 20:28:13 2025 +0200 staging: rtl8723bs: remove function pointer c2h_id_filter Remove function pointer c2h_id_filter from struct hal_ops and use c2h_id_filter_ccx_8723b directly to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-11-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 95e57a278080e2e2a6985643dfba3a31e3f104a1 Author: Michael Straube Date: Tue Jul 15 20:28:12 2025 +0200 staging: rtl8723bs: remove function pointer hal_reset_security_engine The function pointer hal_reset_security_engine is never set. As a consequence, the function rtw_hal_reset_security_engine does nothing. Remove both to reduce dead code. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-10-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit f742f77d96fcd6dde4e34a2312e43d9caa9c253a Author: Michael Straube Date: Tue Jul 15 20:28:11 2025 +0200 staging: rtl8723bs: remove function pointer xmit_thread_handler Remove function pointer xmit_thread_handler and use rtl8723bs_xmit_buf_handler directly to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-9-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit afbb082971100dc9994ecd1f33a7d298518f1856 Author: Michael Straube Date: Tue Jul 15 20:28:10 2025 +0200 staging: rtl8723bs: remove macro hal_xmit_handler Remove the macro hal_xmit_handler and use rtl8723bs_xmit_buf_handler directly to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-8-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8757b8dd63b2af093f14a4e6c247e41710259c84 Author: Michael Straube Date: Tue Jul 15 20:28:09 2025 +0200 staging: rtl8723bs: remove function pointer fill_h2c_cmd Remove function pointer fill_h2c_cmd and use FillH2CCmd8723B directly to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-7-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 206d5db1231dd45c09bd10c50d46becadaf8df95 Author: Michael Straube Date: Tue Jul 15 20:28:08 2025 +0200 staging: rtl8723bs: remove macro FillH2CCmd The macro FillH2CCmd is not used, remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-6-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit c9517302a086b0682d44d5752b86e2526bd1c177 Author: Michael Straube Date: Tue Jul 15 20:28:07 2025 +0200 staging: rtl8723bs: remove function pointer c2h_handler Remove function pointer c2h_handler and use c2h_handler_8723b directly to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-5-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 328463611a0c878c5e5f97082179958ca6085c92 Author: Michael Straube Date: Tue Jul 15 20:28:06 2025 +0200 staging: rtl8723bs: remove function pointer hal_notch_filter Remove function pointer hal_notch_filter and use hal_notch_filter_8723b directly to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9a318cec56d917cfc44c8f40462849d47d392e21 Author: Michael Straube Date: Tue Jul 15 20:28:05 2025 +0200 staging: rtl8723bs: remove wrapper rtl8723b_SetHalODMVar Remove the wrapper function rtl8723b_SetHalODMVar and use SetHalODMVar directly to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit a468ce2e33e2805ed26fd4733e1e288e56cafeb8 Author: Michael Straube Date: Tue Jul 15 20:28:04 2025 +0200 staging: rtl8723bs: remove function pointer SetHalODMVarHandler Remove function pointer SetHalODMVarHandler and use rtl8723b_SetHalODMVar directly to reduce code complexity. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250715182814.212708-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 546527b92d7e72dcd827675a2d3e580002b09cc1 Author: Damien Le Moal Date: Wed Jul 16 11:03:15 2025 +0900 Documentation: driver-api: Update libata error handler information Update ``->error_handler()`` section of the libata documentation file Documentation/driver-api/libata.rst to remove the reference to the function ata_do_eh() as that function was removed. The reference to the function ata_bmdma_drive_eh() is also removed as that function does not exist at all. And while at it, cleanup the description of the various reset operations using a bullet list. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Martin K. Petersen Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250716020315.235457-4-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit a4daf088a77323154514eb1f8626bbdf9329cfd4 Author: Damien Le Moal Date: Wed Jul 16 11:03:14 2025 +0900 ata: libata-eh: Simplify reset operation management Introduce struct ata_reset_operations to aggregate in a single structure the definitions of the 4 reset methods (prereset, softreset, hardreset and postreset) for a port. This new structure is used in struct ata_port to define the reset methods for a regular port (reset field) and for a port-multiplier port (pmp_reset field). A pointer to either of these fields replaces the 4 reset method arguments passed to ata_eh_recover() and ata_eh_reset(). The definition of the reset methods for all drivers is changed to use the reset and pmp_reset fields in struct ata_port_operations. A large number of files is modifed, but no functional changes are introduced. Suggested-by: Niklas Cassel Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Martin K. Petersen Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250716020315.235457-3-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit df6f9a918ea856fc288b9001b0414c5be136d7d0 Author: Damien Le Moal Date: Wed Jul 16 11:03:13 2025 +0900 ata: libata-eh: Remove ata_do_eh() The only reason for ata_do_eh() to exist is that the two caller sites, ata_std_error_handler() and ata_sff_error_handler() may pass it a NULL hardreset operation so that the built-in (generic) hardreset operation for a driver is ignored if the adapter SCR access is not available. However, ata_std_error_handler() and ata_sff_error_handler() modifications of the hardreset port operation can easily be combined as they are mutually exclusive. That is, a driver using sata_std_hardreset() as its hardreset operation cannot use sata_sff_hardreset() and vice-versa. With this observation, ata_do_eh() can be removed and its code moved to ata_std_error_handler(). The condition used to ignore the built-in hardreset port operation is modified to be the one that was used in ata_sff_error_handler(). This requires defining a stub for the function sata_sff_hardreset() to avoid compilation errors when CONFIG_ATA_SFF is not enabled. Furthermore, instead of modifying the local hardreset operation definition, set the ATA_LFLAG_NO_HRST link flag to prevent the use of built-in hardreset methods for ports without a valid scr_read function. This flag is checked in ata_eh_reset() and if set, the hardreset method is ignored. This change simplifies ata_sff_error_handler() as this function now only needs to call ata_std_error_handler(). No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Martin K. Petersen Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250716020315.235457-2-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit ce23f29e7dfb5320c9e32edb5f4737ad4b732abb Author: Al Viro Date: Sat Jul 12 12:48:12 2025 -0400 mshv_eventfd: convert to CLASS(fd) similar to 66635b077624 ("assorted variants of irqfd setup: convert to CLASS(fd)") a year ago... Acked-by: Wei Liu Reviewed-by: Nuno Das Neves Signed-off-by: Al Viro commit 6456ccbd2ff72814b3c1b2e2a3a2145a2ced858d Author: John Johansen Date: Wed Jun 4 01:45:05 2025 -0700 apparmor: fix regression in fs based unix sockets when using old abi Policy loaded using abi 7 socket mediation was not being applied correctly in all cases. In some cases with fs based unix sockets a subset of permissions where allowed when they should have been denied. This was happening because the check for if the socket was an fs based unix socket came before the abi check. But the abi check is where the correct path is selected, so having the fs unix socket check occur early would cause the wrong code path to be used. Fix this by pushing the fs unix to be done after the abi check. Fixes: dcd7a559411e ("apparmor: gate make fine grained unix mediation behind v9 abi") Signed-off-by: John Johansen commit 50d56a1a366a3a5e7e41d9efff1a5e4ee7bf98a7 Author: John Johansen Date: Sat Jun 14 13:49:34 2025 -0700 apparmor: fix AA_DEBUG_LABEL() AA_DEBUG_LABEL() was not specifying it vargs, which is needed so it can output debug parameters. Fixes: 71e6cff3e0dd ("apparmor: Improve debug print infrastructure") Signed-off-by: John Johansen commit a30a9fdb66319466a7c76b455524d27c75d2b05b Author: John Johansen Date: Sat Jun 14 13:49:02 2025 -0700 apparmor: fix af_unix auditing to include all address information The auditing of addresses currently doesn't include the source address and mixes source and foreign/peer under the same audit name. Fix this so source is always addr, and the foreign/peer is peer_addr. Fixes: c05e705812d1 ("apparmor: add fine grained af_unix mediation") Signed-off-by: John Johansen commit bc6e5f6933b8e7b74858ac830d5b9b4ca10a099a Author: John Johansen Date: Tue Apr 1 15:28:13 2025 -0700 apparmor: Remove use of the double lock The use of the double lock is not necessary and problematic. Instead pull the bits that need locks into their own sections and grab the needed references. Fixes: c05e705812d1 ("apparmor: add fine grained af_unix mediation") Signed-off-by: John Johansen commit 6afb0a7bc95a61e40c38c58e2bcf6c88fff68d67 Author: John Johansen Date: Sun Jun 22 04:09:06 2025 -0700 apparmor: update kernel doc comments for xxx_label_crit_section Add a kernel doc header for __end_current_label_crit_section(), and update the header for __begin_current_label_crit_section(). Fixes: b42ecc5f58ef ("apparmor: make __begin_current_label_crit_section() indicate whether put is needed") Signed-off-by: John Johansen commit 87cc7b00114f6f751d25f6a5f05128dc27ef64db Author: Mateusz Guzik Date: Tue Mar 18 23:06:41 2025 +0100 apparmor: make __begin_current_label_crit_section() indicate whether put is needed Same as aa_get_newest_cred_label_condref(). This avoids a bunch of work overall and allows the compiler to note when no clean up is necessary, allowing for tail calls. This in particular happens in apparmor_file_permission(), which manages to tail call aa_file_perm() 105 bytes in (vs a regular call 112 bytes in followed by branches to figure out if clean up is needed). Signed-off-by: Mateusz Guzik Signed-off-by: John Johansen commit 37a3741d27b64012ab6a5d9c92b514b977349dbb Author: John Johansen Date: Mon Jun 30 00:06:22 2025 -0700 Revert "apparmor: use SHA-256 library API instead of crypto_shash API" This reverts commit e9ed1eb8f6217e53843d82ecf2d50f8d1a93e77c. Eric has requested that this patch be taken through the libcrypto-next tree, instead. Signed-off-by: John Johansen commit aff426f35966e6e77ecfe065984344a7d834eaa9 Author: John Johansen Date: Fri May 23 21:04:51 2025 -0700 apparmor: mitigate parser generating large xtables Some versions of the parser are generating an xtable transition per state in the state machine, even when the state machine isn't using the transition table. The parser bug is triggered by commit 2e12c5f06017 ("apparmor: add additional flags to extended permission.") In addition to fixing this in userspace, mitigate this in the kernel as part of the policy verification checks by detecting this situation and adjusting to what is actually used, or if not used at all freeing it, so we are not wasting unneeded memory on policy. Fixes: 2e12c5f06017 ("apparmor: add additional flags to extended permission.") Signed-off-by: John Johansen commit 908a97eba8c8b510996bf5d77d1e3070d59caa6d Author: Joel Fernandes Date: Tue Jul 15 16:01:52 2025 -0400 rcu: Refactor expedited handling check in rcu_read_unlock_special() Extract the complex expedited handling condition in rcu_read_unlock_special() into a separate function rcu_unlock_needs_exp_handling() with detailed comments explaining each condition. This improves code readability. No functional change intended. Reviewed-by: "Paul E. McKenney" Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 2a73ebf267fe26fb1fb5c8f085be986dfe9faf83 Author: Paul E. McKenney Date: Tue Jul 1 17:23:30 2025 -0700 checkpatch: Remove SRCU-lite deprecation Now that SRCU-lite has been removed from the kernel, let's remove the now-redundant deprecation from checkpatch.pl. Signed-off-by: "Paul E. McKenney" Signed-off-by: Neeraj Upadhyay (AMD) commit 623baa01d5b43ca06ba337751d9a4f62199d1715 Author: Paul E. McKenney Date: Tue Jul 1 17:23:29 2025 -0700 srcu: Remove SRCU-lite implementation This commit removes the SRCU-lite implementation, which has been replaced by SRCU-fast. Both SRCU-lite and SRCU-fast provide faster readers by dropping the smp_mb() call from their lock and unlock primitives, but incur a pair of added RCU grace periods during the SRCU grace period. There is a trivial mapping from the SRCU-lite API to that of SRCU-fast, so there should be no transition issues. [ paulmck: Apply Christoph Hellwig feedback. ] Signed-off-by: "Paul E. McKenney" Signed-off-by: Neeraj Upadhyay (AMD) commit 3aea745a2a82e8397d2f30326f0dcf5f375dd7c8 Author: Paul E. McKenney Date: Tue Jun 3 13:49:53 2025 -0700 srcu: Expedite SRCU-fast grace periods Currently, SRCU-fast grace periods use synchronize_rcu() to provide the needed ordering with readers, even given an expedited SRCU-fast grace period, which isn't all that expedited. This commit therefore instead uses synchronize_rcu_expedited() if there is an expedited SRCU-fast grace period in flight. Of course, given an non-expedited SRCU-fast grace period blocked in synchronize_rcu(), a later request for an expedited SRCU-fast grace period will wait for that synchronize_rcu() to return before switching to use of synchronize_rcu_expedited(). If this turns out to be a real problem for a production workload, we can increase the complexity (but likely also degrade the energy efficiency) to speed things up further. Signed-off-by: Paul E. McKenney Cc: Andrii Nakryiko Cc: Alexei Starovoitov Signed-off-by: Neeraj Upadhyay (AMD) commit 941ab0b369c983f7867de54c8579fd7f1676ee3c Author: Paul E. McKenney Date: Tue Jul 1 17:23:28 2025 -0700 rcutorture: Remove support for SRCU-lite Because SRCU-lite is being replaced by SRCU-fast, this commit removes support for SRCU-lite from rcutorture.c Both SRCU-lite and SRCU-fast provide faster readers by dropping the smp_mb() call from their lock and unlock primitives, but incur a pair of added RCU grace periods during the SRCU grace period. There is a trivial mapping from the SRCU-lite API to that of SRCU-fast, so there should be no transition issues. [ paulmck: Apply Christoph Hellwig feedback. ] Signed-off-by: "Paul E. McKenney" Signed-off-by: Neeraj Upadhyay (AMD) commit d08d409126d7d5ad2d8ceac77fb97f2d892e9f85 Author: Paul E. McKenney Date: Tue Jul 1 17:23:27 2025 -0700 rcutorture: Remove SRCU-lite scenarios This commit prepares for the removal of SRCU-Lite by removing the SRCU-L rcutorture scenario that tests it. Both SRCU-lite and SRCU-fast provide faster readers by dropping the smp_mb() call from their lock and unlock primitives, but incur a pair of added RCU grace periods during the SRCU grace period. There is a trivial mapping from the SRCU-lite API to that of SRCU-fast, so there should be no transition issues. [ paulmck: Apply Christoph Hellwig feedback. ] Signed-off-by: "Paul E. McKenney" Signed-off-by: Neeraj Upadhyay (AMD) commit cbd5d35e6ddc47b4cde5c96a0d5f00da0f8e881f Author: Paul E. McKenney Date: Tue Jul 1 17:23:26 2025 -0700 torture: Remove support for SRCU-lite Because SRCU-lite is being replaced by SRCU-fast, this commit removes support for SRCU-lite from refscale.c. Both SRCU-lite and SRCU-fast provide faster readers by dropping the smp_mb() call from their lock and unlock primitives, but incur a pair of added RCU grace periods during the SRCU grace period. There is a trivial mapping from the SRCU-lite API to that of SRCU-fast, so there should be no transition issues. [ paulmck: Apply Christoph Hellwig feedback. ] Signed-off-by: "Paul E. McKenney" Signed-off-by: Neeraj Upadhyay (AMD) commit 748d7923b53ff7bcb3d825ef765d8461d7af1794 Author: Paul E. McKenney Date: Fri Jun 6 03:47:11 2025 -0700 torture: Make torture.sh --allmodconfig testing fail on warnings Currently, the torture.sh --allmodconfig testing looks solely at the exit code from the kernel build, and thus fails to flag many compiler warnings. This commit therefore checks the kernel-build output for compiler diagnostics. Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit 17f4698a9e6092dd59e5dd616b21095ba9c8b6fe Author: Paul E. McKenney Date: Thu Jun 5 14:36:04 2025 -0700 torture: Add "ERROR" diagnostic for testing kernel-build output Some recent kernel-build failures have featured "ERROR", so this commit adds it to the list checked by kvm-build.sh. Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit 3aee453496026451fe126e53d43db6d687b51209 Author: Paul E. McKenney Date: Thu Jun 5 07:19:34 2025 -0700 torture: Make torture.sh tolerate runs having bad kvm.sh arguments Currently, torture.sh assumes excessive levels of reviewer competence and thus fails to gracefully handle cases where it is tricked into giving kvm.sh invalid arguments. This commit therefore upgrades error handling to more gracefully handle this situation. Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit d57300010d38a8eb518fa05d305bef1343716431 Author: Paul E. McKenney Date: Tue Jun 3 19:35:13 2025 -0700 torture: Add textid.txt file to --do-allmodconfig and --do-rcu-rust runs This commit causes the torture.sh --do-allmodconfig and --do-rcu-rust parameters to add testid.txt files to their results directories, thus allowing easier analysis of the results of a series of runs kicked off by "git bisect". Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit 0783f216423fff1acafae3b464b95e05ac596e12 Author: Paul E. McKenney Date: Tue Jun 3 18:03:53 2025 -0700 torture: Extract testid.txt generation to separate script The kvm.sh script places a testid.txt file in the top-level results directory in order to identify the tree and commit that was tested. This works well, but there are scripts other than kvm.sh that also create results directories, and it would be good for them to also identify exactly what was tested. This commit therefore extracts the testid.txt generation to a new mktestid.sh script so that it can be easily used elsewhere. Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit ce243b71cfef7e44401c8b2ca93cdc206f8393d4 Author: Paul E. McKenney Date: Thu May 15 16:12:00 2025 -0700 torture: Suppress "find" diagnostics from torture.sh --do-none run When torture.sh is told to do nothing, it produces a couple of distracting diagnostics from the "find" command: find: ‘’: No such file or directory find: ‘’: No such file or directory This is pointless chatter and could cause confusion. This commit therefore suppresses these diagnostics when there is nothing to find. Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit a883f273431804adfac6048f5e71a041f5626f64 Author: Paul E. McKenney Date: Thu May 15 15:30:01 2025 -0700 torture: Provide EXPERT Kconfig option for arm64 KCSAN torture.sh runs The arm64 architecture requires that KCSAN-enabled kernels be built with the CONFIG_EXPERT=y Kconfig option. This commit therefore causes the torture.sh script to provide this option, but only for --kcsan runs on arm64 systems. Signed-off-by: Paul E. McKenney Cc: Marco Elver Cc: Dmitry Vyukov Cc: Catalin Marinas Cc: Will Deacon Cc: Cc: Acked-by: Will Deacon Signed-off-by: Neeraj Upadhyay (AMD) commit b41642c87716bbd09797b1e4ea7d904f06c39b7b Author: Joel Fernandes Date: Tue Jul 8 10:22:19 2025 -0400 rcu: Fix rcu_read_unlock() deadloop due to IRQ work During rcu_read_unlock_special(), if this happens during irq_exit(), we can lockup if an IPI is issued. This is because the IPI itself triggers the irq_exit() path causing a recursive lock up. This is precisely what Xiongfeng found when invoking a BPF program on the trace_tick_stop() tracepoint As shown in the trace below. Fix by managing the irq_work state correctly. irq_exit() __irq_exit_rcu() /* in_hardirq() returns false after this */ preempt_count_sub(HARDIRQ_OFFSET) tick_irq_exit() tick_nohz_irq_exit() tick_nohz_stop_sched_tick() trace_tick_stop() /* a bpf prog is hooked on this trace point */ __bpf_trace_tick_stop() bpf_trace_run2() rcu_read_unlock_special() /* will send a IPI to itself */ irq_work_queue_on(&rdp->defer_qs_iw, rdp->cpu); A simple reproducer can also be obtained by doing the following in tick_irq_exit(). It will hang on boot without the patch: static inline void tick_irq_exit(void) { + rcu_read_lock(); + WRITE_ONCE(current->rcu_read_unlock_special.b.need_qs, true); + rcu_read_unlock(); + Reported-by: Xiongfeng Wang Closes: https://lore.kernel.org/all/9acd5f9f-6732-7701-6880-4b51190aa070@huawei.com/ Tested-by: Qi Xi Signed-off-by: Joel Fernandes Reviewed-by: "Paul E. McKenney" Reported-by: Linux Kernel Functional Testing [neeraj: Apply Frederic's suggested fix for PREEMPT_RT] Signed-off-by: Neeraj Upadhyay (AMD) commit d827673d8a4e69937dd3731da2686a2d8206aef5 Author: Uladzislau Rezki (Sony) Date: Wed Jul 2 16:59:37 2025 +0200 Documentation/kernel-parameters: Update rcu_normal_wake_from_gp doc Update the documentation about rcu_normal_wake_from_gp parameter. Reviewed-by: Joel Fernandes Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Frederic Weisbecker Signed-off-by: Neeraj Upadhyay (AMD) commit 78370df5c3574cdc5c6de7844481b4dc0ef4f172 Author: Uladzislau Rezki (Sony) Date: Wed Jul 2 16:59:36 2025 +0200 rcu: Enable rcu_normal_wake_from_gp on small systems Automatically enable the rcu_normal_wake_from_gp parameter on systems with a small number of CPUs. The activation threshold is set to 16 CPUs. This helps to reduce a latency of normal synchronize_rcu() API by waking up GP-waiters earlier and decoupling synchronize_rcu() callers from regular callback handling. A benchmark running 64 parallel jobs(system with 64 CPUs) invoking synchronize_rcu() demonstrates a notable latency reduction with the setting enabled. Latency distribution (microseconds): 0 - 9999 : 1 10000 - 19999 : 4 20000 - 29999 : 399 30000 - 39999 : 3197 40000 - 49999 : 10428 50000 - 59999 : 17363 60000 - 69999 : 15529 70000 - 79999 : 9287 80000 - 89999 : 4249 90000 - 99999 : 1915 100000 - 109999 : 922 110000 - 119999 : 390 120000 - 129999 : 187 ... 0 - 9999 : 1 10000 - 19999 : 234 20000 - 29999 : 6678 30000 - 39999 : 33463 40000 - 49999 : 20669 50000 - 59999 : 2766 60000 - 69999 : 183 ... Reviewed-by: Joel Fernandes Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Frederic Weisbecker Signed-off-by: Neeraj Upadhyay (AMD) commit 90c09d57caeca94e6f3f87c49e96a91edd40cbfd Author: Paul E. McKenney Date: Thu Apr 24 16:49:53 2025 -0700 rcu: Protect ->defer_qs_iw_pending from data race On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest. In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally. The per-CPU rcu_data structure's ->defer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special(). This resulted in the following KCSAN splat: ------------------------------------------------------------------------ BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8: rcu_read_unlock_special+0x175/0x260 __rcu_read_unlock+0x92/0xa0 rt_spin_unlock+0x9b/0xc0 __local_bh_enable+0x10d/0x170 __local_bh_enable_ip+0xfb/0x150 rcu_do_batch+0x595/0xc40 rcu_cpu_kthread+0x4e9/0x830 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8: rcu_preempt_deferred_qs_handler+0x1e/0x30 irq_work_single+0xaf/0x160 run_irq_workd+0x91/0xc0 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 no locks held by irq_work/8/88. irq event stamp: 200272 hardirqs last enabled at (200272): [] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [] __schedule+0x129/0xd70 softirqs last enabled at (0): [] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ------------------------------------------------------------------------ The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->defer_qs_iw_pending field. This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending field. This suffices because this handler is not a fast path. Signed-off-by: Paul E. McKenney Reviewed-by: Frederic Weisbecker Signed-off-by: Neeraj Upadhyay (AMD) commit 3096d238ec490f013263f8496ad1a1049f476856 Author: Marc Zyngier Date: Mon Jul 14 12:55:03 2025 +0100 KVM: arm64: Tighten the definition of FEAT_PMUv3p9 The current definition of FEAT_PMUv3p9 doesn't check for the lack of an IMPDEF PMU, which is encoded as 0b1111, but considered unsigned. Use the recently introduced helper to address the issue (which is harmless, as KVM never advertises an IMPDEF PMU). Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714115503.3334242-6-maz@kernel.org Signed-off-by: Oliver Upton commit cd64587f10b12919a0291570850f07ddd2e5e827 Author: Marc Zyngier Date: Mon Jul 14 12:55:02 2025 +0100 KVM: arm64: Convert MDCR_EL2 to config-driven sanitisation As for other registers, convert the determination of the RES0 bits affecting MDCR_EL2 to be driven by a table extracted from the 2025-06 JSON drop Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714115503.3334242-5-maz@kernel.org Signed-off-by: Oliver Upton commit 6bd4a274b026ee2abc77074f1880d7d89303daff Author: Marc Zyngier Date: Mon Jul 14 12:55:01 2025 +0100 KVM: arm64: Convert SCTLR_EL1 to config-driven sanitisation As for other registers, convert the determination of the RES0 bits affecting SCTLR_EL1 to be driven by a table extracted from the 2025-06 JSON drop Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714115503.3334242-4-maz@kernel.org Signed-off-by: Oliver Upton commit 001e032c0f3f71ba508ed64a0c4c79708cfcde38 Author: Marc Zyngier Date: Mon Jul 14 12:55:00 2025 +0100 KVM: arm64: Convert TCR2_EL2 to config-driven sanitisation As for other registers, convert the determination of the RES0 bits affecting TCR2_EL2 to be driven by a table extracted from the 2025-06 JSON drop. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714115503.3334242-3-maz@kernel.org Signed-off-by: Oliver Upton commit a3ed7da911c1c9870fbd0f37bee09877b4d540b0 Author: Marc Zyngier Date: Mon Jul 14 12:54:59 2025 +0100 arm64: sysreg: Add THE/ASID2 controls to TCR2_ELx FEAT_THE and FEAT_ASID2 add new controls to the TCR2_ELx registers. Add them to the register descriptions. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714115503.3334242-2-maz@kernel.org [ fix whitespace ] Signed-off-by: Oliver Upton commit f68df3aee7d17a0fedc6cd9983dd2940ca692f2b Author: Marc Zyngier Date: Mon Jul 14 13:26:34 2025 +0100 KVM: arm64: Document registers exposed via KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS We never documented which GICv3 registers are available for save/restore via the KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS interface. Let's take the opportunity of adding the EL2 registers to document the whole thing in one go. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714122634.3334816-12-maz@kernel.org [ oliver: fix trailing whitespace ] Signed-off-by: Oliver Upton commit 3a90b6f2796493a0e2f989361e2b7d5f9de2f451 Author: Marc Zyngier Date: Mon Jul 14 13:26:33 2025 +0100 KVM: arm64: selftests: get-reg-list: Add base EL2 registers Add the EL2 registers and the eventual dependencies, effectively doubling the number of test vectors. Oh well. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714122634.3334816-11-maz@kernel.org Signed-off-by: Oliver Upton commit 9a4071807909c8aafcb598bb807fdc1a1eb3c214 Author: Marc Zyngier Date: Mon Jul 14 13:26:32 2025 +0100 KVM: arm64: selftests: get-reg-list: Simplify feature dependency Describing the dependencies between registers and features is on the masochistic side of things, with hard-coded values that would be better taken from the existing description. Add a couple of helpers to that effect, and repaint the dependency array. More could be done to improve this test, but my interest is wearing thin... Signed-off-by: Marc Zyngier Tested-by: Itaru Kitayama Link: https://lore.kernel.org/r/20250714122634.3334816-10-maz@kernel.org Signed-off-by: Oliver Upton commit a0aae0a9a70e7be6a1ff71fbece5f153f596b6d6 Author: Marc Zyngier Date: Mon Jul 14 13:26:31 2025 +0100 KVM: arm64: Advertise FGT2 registers to userspace While a guest is able to use the FEAT_FGT2 registers, we're missing them being exposed to userspace. Add them to the (very long) list. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714122634.3334816-9-maz@kernel.org Signed-off-by: Oliver Upton commit 72c62700b27922e3ea456f01684c8e5e29755544 Author: Marc Zyngier Date: Mon Jul 14 13:26:30 2025 +0100 KVM: arm64: Condition FGT registers on feature availability We shouldn't expose the FEAT_FGT registers unconditionally. Make them dependent on FEAT_FGT being actually advertised to the guest. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714122634.3334816-8-maz@kernel.org Signed-off-by: Oliver Upton commit 9fe9663e47e2124b569fcd3691b1bbc32c360cef Author: Marc Zyngier Date: Mon Jul 14 13:26:29 2025 +0100 KVM: arm64: Expose GICv3 EL2 registers via KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS Expose all the GICv3 EL2 registers through the usual GICv3 save/restore interface, making it possible for a VMM to access the EL2 state. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714122634.3334816-7-maz@kernel.org Signed-off-by: Oliver Upton commit 1d14c97145621632caaccf89a45c9b74ad36dab8 Author: Marc Zyngier Date: Mon Jul 14 13:26:28 2025 +0100 KVM: arm64: Let GICv3 save/restore honor visibility attribute The GICv3 save/restore code never needed any visibility attribute, but that's about to change. Make vgic_v3_has_cpu_sysregs_attr() check the visibility in case a register is hidden. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714122634.3334816-6-maz@kernel.org Signed-off-by: Oliver Upton commit ce7a1cff2e4c4ec185bae25a7c53609407d2c5eb Author: Marc Zyngier Date: Mon Jul 14 13:26:27 2025 +0100 KVM: arm64: Define helper for ICH_VTR_EL2 Move the computation of the ICH_VTR_EL2 value to a common location, so that it can be reused by the save/restore code. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714122634.3334816-5-maz@kernel.org Signed-off-by: Oliver Upton commit c6ef468610800259fb1551b1e8c2f5bec7e15e44 Author: Marc Zyngier Date: Mon Jul 14 13:26:26 2025 +0100 KVM: arm64: Define constant value for ICC_SRE_EL2 Move the bag of bits defining the value of ICC_SRE_EL2 to a common spot so that it can be reused by the save/restore code. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714122634.3334816-4-maz@kernel.org Signed-off-by: Oliver Upton commit c70a4027f5f37b3a8e8af6cc4b3b6c7641245297 Author: Marc Zyngier Date: Mon Jul 14 13:26:25 2025 +0100 KVM: arm64: Don't advertise ICH_*_EL2 registers through GET_ONE_REG It appears that exposing the GICv3 EL2 registers through the usual sysreg interface is not consistent with the way we expose the EL1 registers. The latter are exposed via the GICv3 device interface instead, and there is no reason why the EL2 registers should get a different treatement. Hide the registers from userspace until the GICv3 code grows the required infrastructure. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714122634.3334816-3-maz@kernel.org Signed-off-by: Oliver Upton commit 1095b32665cf1085d76fc1af283dc0bd3c986169 Author: Marc Zyngier Date: Mon Jul 14 13:26:24 2025 +0100 KVM: arm64: Make RVBAR_EL2 accesses UNDEF We always expose a virtual CPU that has EL3 when NV is enabled, irrespective of EL3 being actually implemented in HW. Therefore, as per the architecture, RVBAR_EL2 must UNDEF, since EL2 is not the highest implemented exception level. This is consistent with RMR_EL2 also triggering an UNDEF. Adjust the handling of RVBAR_EL2 accordingly. Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20250714122634.3334816-2-maz@kernel.org Signed-off-by: Oliver Upton commit efa1368ba9f4b6e081c0fdd73245b0ba6ef75bda Author: Oliver Upton Date: Mon Jul 14 23:25:07 2025 -0700 KVM: arm64: Commit exceptions from KVM_SET_VCPU_EVENTS immediately syzkaller has found that it can trip a warning in KVM's exception emulation infrastructure by repeatedly injecting exceptions into the guest. While it's unlikely that a reasonable VMM will do this, further investigation of the issue reveals that KVM can potentially discard the "pending" SEA state. While the handling of KVM_GET_VCPU_EVENTS presumes that userspace-injected SEAs are realized immediately, in reality the emulated exception entry is deferred until the next call to KVM_RUN. Hack-a-fix the immediate issues by committing the pending exceptions to the vCPU's architectural state immediately in KVM_SET_VCPU_EVENTS. This is no different to the way KVM-injected exceptions are handled in KVM_RUN where we potentially call __kvm_adjust_pc() before returning to userspace. Reported-by: syzbot+4e09b1432de3774b86ae@syzkaller.appspotmail.com Reported-by: syzbot+1f6f096afda6f4f8f565@syzkaller.appspotmail.com Reviewed-by: Marc Zyngier Signed-off-by: Oliver Upton commit c3886ccaadf8fdc2c91bfbdcdca36ccdc6ef8f70 Merge: ce6030afe45902 b0aabb3b1efbf2 Author: Jakub Kicinski Date: Tue Jul 15 16:50:06 2025 -0700 Merge branch 'net-hns3-use-seq_file-for-debugfs' Jijie Shao says: ==================== net: hns3: use seq_file for debugfs Arnd reported that there are two build warning for on-stasck buffer oversize. As Arnd's suggestion, using seq file way to avoid the stack buffer or kmalloc buffer allocating. v2: https://lore.kernel.org/20250711061725.225585-1-shaojijie@huawei.com v1: https://lore.kernel.org/20250708130029.1310872-1-shaojijie@huawei.com ==================== Link: https://patch.msgid.link/20250714061037.2616413-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit b0aabb3b1efbf2b4c65118acfa01b50ec9a8df71 Author: Jian Shen Date: Mon Jul 14 14:10:37 2025 +0800 net: hns3: use seq_file for files in tx_bd_info/ and rx_bd_info/ in debugfs This patch use seq_file for the following nodes: tx_bd_queue_*/rx_bd_queue_* This patch is the last modification to debugfs file. Unused functions and variables are removed together. Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250714061037.2616413-11-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 9e1545b48818e0503fcaacf692644d7e1107f992 Author: Yonglong Liu Date: Mon Jul 14 14:10:36 2025 +0800 net: hns3: use seq_file for files in common/ of hclge layer This patch use seq_file for the following nodes: mng_tbl/loopback/interrupt_info/reset_info/imp_info/ncl_config/ mac_tnl_status/service_task_info/vlan_config/ptp_info This patch is the last modification to debugfs file of hclge layer. Unused functions and variables are removed together. Signed-off-by: Yonglong Liu Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250714061037.2616413-10-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 3945d94c9f4b11c0155e23888dbeaec3284ebff2 Author: Jijie Shao Date: Mon Jul 14 14:10:35 2025 +0800 net: hns3: use seq_file for files in fd/ in debugfs This patch use seq_file for the following nodes: fd_tcam/fd_counter Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250714061037.2616413-9-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 2363145ad86e701481bbe884eeda5c35c9ac658c Author: Jijie Shao Date: Mon Jul 14 14:10:34 2025 +0800 net: hns3: use seq_file for files in reg/ in debugfs This patch use seq_file for the following nodes: bios_common/ssu/igu_egu/rpu/ncsi/rtc/ppp/rcb/tqp/mac/dcb Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250714061037.2616413-8-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 00f9ea261d9c7ad24a2634373498523eb78c34ac Author: Yonglong Liu Date: Mon Jul 14 14:10:33 2025 +0800 net: hns3: use seq_file for files in mac_list/ in debugfs This patch use seq_file for the following nodes: uc/mc Signed-off-by: Yonglong Liu Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250714061037.2616413-7-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 08a6476e28759e237e6eb180f59bc3431e476aa4 Author: Jian Shen Date: Mon Jul 14 14:10:32 2025 +0800 net: hns3: use seq_file for files in tm/ in debugfs Use seq_file for files in debugfs. This is the first modification for reading in hclge_debugfs.c. This patch use seq_file for the following nodes: tm_nodes/tm_priority/tm_qset/tm_map/tm_pg/tm_port/tc_sch_info/ qos_pause_cfg/qos_pri_map/qos_dscp_map/qos_buf_cfg Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250714061037.2616413-6-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 2b65524d106e65fc7c1d2c2910066d7687136cfb Author: Jijie Shao Date: Mon Jul 14 14:10:31 2025 +0800 net: hns3: use seq_file for files in common/ of hns3 layer This patch use seq_file for the following nodes: dev_info/coalesce_info/page_pool_info Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250714061037.2616413-5-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit eced3d1c41db8753cd78ed1b54e18f6d6f8e1df5 Author: Jian Shen Date: Mon Jul 14 14:10:30 2025 +0800 net: hns3: use seq_file for files in queue/ in debugfs This patch use seq_file for the following nodes: rx_queue_info/queue_map Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250714061037.2616413-4-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit c557c183262614e41155728483358884fe5c26a2 Author: Jian Shen Date: Mon Jul 14 14:10:29 2025 +0800 net: hns3: clean up the build warning in debugfs by use seq file Arnd reported that there are two build warning for on-stasck buffer oversize. As Arnd's suggestion, using seq file way to avoid the stack buffer or kmalloc buffer allocating. Reported-by: Arnd Bergmann Closes: https://lore.kernel.org/all/20250610092113.2639248-1-arnd@kernel.org/ Signed-off-by: Jian Shen Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250714061037.2616413-3-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 277ed0cc9d73552b37451eb6d0e35977633221ae Author: Jijie Shao Date: Mon Jul 14 14:10:28 2025 +0800 net: hns3: remove tx spare info from debugfs. The tx spare info in debugfs is not very useful, and there are related statistics available for troubleshooting. This patch removes the tx spare info from debugfs. Signed-off-by: Jijie Shao Reviewed-by: Andrew Lunn Acked-by: Arnd Bergmann Link: https://patch.msgid.link/20250714061037.2616413-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit ce6030afe4590221ff40e3e873600c65e7be56e7 Author: Yue Haibing Date: Mon Jul 14 16:17:32 2025 +0800 ipv6: mcast: Remove unnecessary null check in ip6_mc_find_dev() These is no need to check null for idev before return NULL. Signed-off-by: Yue Haibing Reviewed-by: Simon Horman Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250714081732.3109764-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 5cc7fce3493c8627c74260de5b2479da6d508277 Author: Al Viro Date: Sun Jul 13 19:01:34 2025 +0100 don't open-code kernel_accept() in rds_tcp_accept_one() rds_tcp_accept_one() starts with a pretty much verbatim copy of kernel_accept(). Might as well use the real thing... That code went into mainline in 2009, kernel_accept() had been added in Aug 2006, the copyright on rds/tcp_listen.c is "Copyright (c) 2006 Oracle", so it's entirely possible that it predates the introduction of kernel_accept(). Signed-off-by: Al Viro Link: https://patch.msgid.link/20250713180134.GC1880847@ZenIV Signed-off-by: Jakub Kicinski commit c34632dbb29ba7016f1cd2e629ac9dd07f84ce50 Author: Andy Gospodarek Date: Mon Jul 14 13:02:02 2025 -0400 bnxt: move bnxt_hsi.h to include/linux/bnxt/hsi.h This moves bnxt_hsi.h contents to a common location so it can be properly referenced by bnxt_en, bnxt_re, and bnge. Signed-off-by: Andy Gospodarek Signed-off-by: Michael Chan Signed-off-by: Pavan Chebbi Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250714170202.39688-1-gospo@broadcom.com Signed-off-by: Jakub Kicinski commit 8ecb65b7b68ea48350833ba59c1257718e859768 Merge: 7c098cd5eaae55 d49ac7744f578b Author: Miguel Ojeda Date: Tue Jul 15 23:42:55 2025 +0200 Merge tag 'alloc-next-v6.17-2025-07-15' of https://github.com/Rust-for-Linux/linux into rust-next Pull alloc and DMA updates from Danilo Krummrich: Box: - Implement Borrow / BorrowMut for Box. Vec: - Implement Default for Vec. - Implement Borrow / BorrowMut for Vec. DMA: - Clarify wording and be consistent in 'coherent' nomenclature. - Convert the read!() / write!() macros to return a Result. - Add as_slice() / write() methods in CoherentAllocation. - Fix doc-comment of dma_handle(). - Expose count() and size() in CoherentAllocation and add the corresponding type invariants. - Implement CoherentAllocation::dma_handle_with_offset(). - Require mutable reference for as_slice_mut() and write(). MAINTAINERS: - Add Vlastimil Babka, Liam R. Howlett, Uladzislau Rezki and Lorenzo Stoakes as reviewers (thanks everyone). * tag 'alloc-next-v6.17-2025-07-15' of https://github.com/Rust-for-Linux/linux: MAINTAINERS: add mm folks as reviewers to rust alloc rust: dma: require mutable reference for as_slice_mut() and write() rust: dma: add dma_handle_with_offset method to CoherentAllocation rust: dma: expose the count and size of CoherentAllocation rust: dma: fix doc-comment of dma_handle() rust: dma: add as_slice/write functions for CoherentAllocation rust: dma: convert the read/write macros to return Result rust: dma: clarify wording and be consistent in `coherent` nomenclature rust: alloc: implement `Borrow` and `BorrowMut` for `KBox` rust: alloc: implement `Borrow` and `BorrowMut` for `Vec` rust: vec: impl Default for Vec with any allocator commit 3f998cd512960dc08438a3011030aa61a4cf80fd Merge: dd10ed1caf25d5 15247b5a63f506 Author: Mark Brown Date: Tue Jul 15 22:40:13 2025 +0100 SDCA Bug Fixes Merge series from Charles Keepax : Some small SDCA bug fixes reported from various sources. An array bounds check, an uninitialised variable and some memory allocations that should zero initialise. Charles Keepax (3): ASoC: SDCA: Fix off by one error in IRQ bound check ASoC: SDCA: Avoid use of uninitialised local name variable ASoC: SDCA: Update memory allocations to zero initialise sound/soc/sdca/sdca_asoc.c | 12 ++++++------ sound/soc/sdca/sdca_interrupts.c | 5 ++--- 2 files changed, 8 insertions(+), 9 deletions(-) -- 2.39.5 commit e860a98c8aebd8de82c0ee901acf5a759acd4570 Author: Yonghong Song Date: Tue Jul 15 11:59:10 2025 -0700 selftests/bpf: Fix build error due to certain uninitialized variables With the latest llvm21 compiler, I hit several errors when building bpf selftests. Some of errors look like below: test_maps.c:565:40: error: variable 'val' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 565 | assert(bpf_map_update_elem(fd, NULL, &val, 0) < 0 && | ^~~ prog_tests/bpf_iter.c:400:25: error: variable 'c' is uninitialized when passed as a const pointer argument here [-Werror,-Wuninitialized-const-pointer] 400 | write(finish_pipe[1], &c, 1); | ^ Some other errors have similar the pattern as the above. These errors are fixed by initializing those variables properly. Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250715185910.3659447-1-yonghong.song@linux.dev commit d5255ae7ec48ac1f702e95b472801dbb7bf1e97f Author: Rob Herring (Arm) Date: Tue Jul 15 15:27:10 2025 -0500 spi: dt-bindings: spi-mux: Drop "spi-max-frequency" as required There's little reason to require the SPI mux to define a maximum bus frequency as the muxing is just the chip select and devices still define their maximum freq. In fact, several users don't set "spi-max-frequency" which caused warnings. Signed-off-by: Rob Herring (Arm) Reviewed-by: Chris Packham Link: https://patch.msgid.link/20250715202711.1882103-1-robh@kernel.org Signed-off-by: Mark Brown commit 7c098cd5eaae557934f4e4ea0b2809a9972f6a5a Author: Alice Ryhl Date: Fri Jul 11 07:59:40 2025 +0000 workqueue: rust: add delayed work items This patch is being sent for use in the various Rust GPU drivers that are under development. It provides the additional feature of work items that are executed after a delay. The design of the existing workqueue is rather extensible, as most of the logic is reused for delayed work items even though a different work item type is required. The new logic consists of: * A new DelayedWork struct that wraps struct delayed_work. * A new impl_has_delayed_work! macro that provides adjusted versions of the container_of logic, that is suitable with delayed work items. * A `enqueue_delayed` method that can enqueue a delayed work item. This patch does *not* rely on the fact that `struct delayed_work` contains `struct work_struct` at offset zero. It will continue to work even if the layout is changed to hold the `work` field at a different offset. Please see the example introduced at the top of the file for example usage of delayed work items. Acked-by: Tejun Heo Reviewed-by: Boqun Feng Signed-off-by: Alice Ryhl Link: https://lore.kernel.org/r/20250711-workqueue-delay-v3-1-3fe17b18b9d1@google.com [ Replaced `as _` with `as ffi::c_int` to clean warning. - Miguel ] Signed-off-by: Miguel Ojeda commit dd10ed1caf25d5040062e5a9f50516d179f0dd9e Merge: bfd291279f87a2 d5f317fd5cd9df Author: Mark Brown Date: Tue Jul 15 21:44:05 2025 +0100 ASoC: convert from clk round_rate() to Merge series from Brian Masney : The round_rate() clk ops is deprecated in the clk framework in favor of the determine_rate() clk ops, so let's go ahead and convert the drivers in the rtc subsystem using the Coccinelle semantic patch posted below. I did a few minor cosmetic cleanups of the code in a few cases. Coccinelle semantic patch: virtual patch // Look up the current name of the round_rate function @ has_round_rate @ identifier round_rate_name =~ ".*_round_rate"; identifier hw_param, rate_param, parent_rate_param; @@ long round_rate_name(struct clk_hw *hw_param, unsigned long rate_param, unsigned long *parent_rate_param) { ... } // Rename the route_rate function name to determine_rate() @ script:python generate_name depends on has_round_rate @ round_rate_name << has_round_rate.round_rate_name; new_name; @@ coccinelle.new_name = round_rate_name.replace("_round_rate", "_determine_rate") // Change rate to req->rate; also change occurrences of 'return XXX'. @ chg_rate depends on generate_name @ identifier has_round_rate.round_rate_name; identifier has_round_rate.hw_param; identifier has_round_rate.rate_param; identifier has_round_rate.parent_rate_param; identifier ERR =~ "E.*"; expression E; @@ long round_rate_name(struct clk_hw *hw_param, unsigned long rate_param, unsigned long *parent_rate_param) { <... ( -return -ERR; +return -ERR; | - return rate_param; + return 0; | - return E; + req->rate = E; + + return 0; | - rate_param + req->rate ) ...> } // Coccinelle only transforms the first occurrence of the rate parameter // Run a second time. FIXME: Is there a better way to do this? @ chg_rate2 depends on generate_name @ identifier has_round_rate.round_rate_name; identifier has_round_rate.hw_param; identifier has_round_rate.rate_param; identifier has_round_rate.parent_rate_param; @@ long round_rate_name(struct clk_hw *hw_param, unsigned long rate_param, unsigned long *parent_rate_param) { <... - rate_param + req->rate ...> } // Change parent_rate to req->best_parent_rate @ chg_parent_rate depends on generate_name @ identifier has_round_rate.round_rate_name; identifier has_round_rate.hw_param; identifier has_round_rate.rate_param; identifier has_round_rate.parent_rate_param; @@ long round_rate_name(struct clk_hw *hw_param, unsigned long rate_param, unsigned long *parent_rate_param) { <... ( - *parent_rate_param + req->best_parent_rate | - parent_rate_param + &req->best_parent_rate ) ...> } // Convert the function definition from round_rate() to determine_rate() @ func_definition depends on chg_rate @ identifier has_round_rate.round_rate_name; identifier has_round_rate.hw_param; identifier has_round_rate.rate_param; identifier has_round_rate.parent_rate_param; identifier generate_name.new_name; @@ - long round_rate_name(struct clk_hw *hw_param, unsigned long rate_param, - unsigned long *parent_rate_param) + int new_name(struct clk_hw *hw, struct clk_rate_request *req) { ... } // Update the ops from round_rate() to determine_rate() @ ops depends on func_definition @ identifier has_round_rate.round_rate_name; identifier generate_name.new_name; @@ { ..., - .round_rate = round_rate_name, + .determine_rate = new_name, ..., } Note that I used coccinelle 1.2 instead of 1.3 since the newer version adds unnecessary braces as described in this post. https://lore.kernel.org/cocci/67642477-5f3e-4b2a-914d-579a54f48cbd@intel.com/ commit 64fb810bce03a4e2b4d3ecbba04bb97da3536dd8 Author: Alice Ryhl Date: Tue Jun 24 15:27:56 2025 +0000 rust: types: rename Opaque::raw_get to cast_into In the previous patch we added Opaque::cast_from() that performs the opposite operation to Opaque::raw_get(). For consistency with this naming, rename raw_get() to cast_from(). There are a few other options such as calling cast_from() something closer to raw_get() rather than renaming this method. However, I could not find a great naming scheme that works with raw_get(). The previous version of this patch used from_raw(), but functions of that name typically have a different signature, so that's not a great option. Suggested-by: Danilo Krummrich Signed-off-by: Alice Ryhl Acked-by: Benno Lossin Acked-by: Andreas Hindborg Acked-by: Boqun Feng Reviewed-by: Danilo Krummrich Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250624-opaque-from-raw-v2-2-e4da40bdc59c@google.com [ Removed `HrTimer::raw_get` change. - Miguel ] Signed-off-by: Miguel Ojeda commit 78447d4545b2ea76ee04f4e46d473639483158b2 Author: Robin Murphy Date: Fri Apr 25 14:39:29 2025 +0100 PCI: Fix driver_managed_dma check Since it's not currently safe to take device_lock() in the IOMMU probe path, that can race against really_probe() setting dev->driver before attempting to bind. The race itself isn't so bad, since we're only concerned with dereferencing dev->driver itself anyway, but sadly my attempt to implement the check with minimal churn leads to a kind of Time-of-Check to Time-of-Use (TOCTOU) issue, where dev->driver becomes valid after to_pci_driver(NULL) is already computed, and thus the check fails to work as intended. Will and I both hit this with the platform bus, but the pattern here is the same, so fix it for correctness too. Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path") Reported-by: Will McVicker Signed-off-by: Robin Murphy Signed-off-by: Bjorn Helgaas Reviewed-by: Will McVicker Link: https://patch.msgid.link/20250425133929.646493-4-robin.murphy@arm.com commit b3060198483bac43ec113c62ae3837076f61f5de Author: Artem Sadovnikov Date: Tue Jul 1 14:40:17 2025 +0000 vfio/mlx5: fix possible overflow in tracking max message size MLX cap pg_track_log_max_msg_size consists of 5 bits, value of which is used as power of 2 for max_msg_size. This can lead to multiplication overflow between max_msg_size (u32) and integer constant, and afterwards incorrect value is being written to rq_size. Fix this issue by extending integer constant to u64 type. Found by Linux Verification Center (linuxtesting.org) with SVACE. Suggested-by: Alex Williamson Signed-off-by: Artem Sadovnikov Reviewed-by: Yishai Hadas Link: https://lore.kernel.org/r/20250701144017.2410-2-a.sadovnikov@ispras.ru Signed-off-by: Alex Williamson commit cae58415830f326822593ec01deebe5fdaeb33a2 Author: Bagas Sanjaya Date: Tue Jul 15 09:42:58 2025 +0700 Documentation: ioctl-number: Don't repeat macro names Don't repeat mentioning macro names (_IO, _IOW, _IOR, and _IOWR) to keep the wording effective. Signed-off-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250715024258.16882-3-bagasdotme@gmail.com commit 67ffcabd2d935949387bb616247566d3c28122e0 Author: Bagas Sanjaya Date: Tue Jul 15 09:42:57 2025 +0700 Documentation: ioctl-number: Shorten macros table The macros table has three columns: the second one is "an" and the third one writes "an ioctl with ... parameters". Simplify the table by adding heading row that indicates macro name and accepted parameters. Signed-off-by: Bagas Sanjaya Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250715024258.16882-2-bagasdotme@gmail.com commit 44bdcff53f012f4e78a749dd818f38283b9d2fbc Author: Bagas Sanjaya Date: Mon Jul 14 08:57:10 2025 +0700 Documentation: ioctl-number: Correct full path to papr-physical-attestation.h Commit 03c9d1a5a30d93 ("Documentation: Fix description format for powerpc RTAS ioctls") fixes Sphinx warning by chopping arch/ path component of papr-physical-attestation.h to fit existing "Include File" column. Now that the column has been widened just enough for that header file, add back its arch/ path component. Reviewed-by: Haren Myneni Signed-off-by: Bagas Sanjaya Acked-by: Madhavan Srinivasan Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250714015711.14525-4-bagasdotme@gmail.com commit 15afd5def819e4df2a29cef6fcfa6ae7ba167c0f Author: Bagas Sanjaya Date: Mon Jul 14 08:57:09 2025 +0700 Documentation: ioctl-number: Extend "Include File" column width Extend width of "Include File" column to fit full path to papr-physical-attestation.h in later commit. Reviewed-by: Haren Myneni Signed-off-by: Bagas Sanjaya Acked-by: Madhavan Srinivasan Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250714015711.14525-3-bagasdotme@gmail.com commit 3dfa97bd93614c15418ba7b5c727f6c5bb617174 Author: Bagas Sanjaya Date: Mon Jul 14 08:57:08 2025 +0700 Documentation: ioctl-number: Fix linuxppc-dev mailto link Spell out full Linux PPC mailing list address like other subsystem mailing lists listed in the table. Reviewed-by: Haren Myneni Signed-off-by: Bagas Sanjaya Acked-by: Madhavan Srinivasan Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250714015711.14525-2-bagasdotme@gmail.com commit 2afcd629449bc8b34ca99823df8507c28b6af779 Author: Matthias Frank Date: Wed Jul 9 22:06:07 2025 -0700 overlayfs.rst: fix typos Grammatical fixes Signed-off-by: Matthias Frank Acked-by: Amir Goldstein Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250710050607.2891-1-frank.mt125@gmail.com commit f587722aa5c9e620fd8692054f0159da60052697 Merge: 2abdc8818c2aad 40020fe8e3a403 Author: Jonathan Corbet Date: Tue Jul 15 13:46:42 2025 -0600 Merge branch 'kdoc-item2' into docs-mw The kerneldoc parsing phase gathers all of the information about the declarations of interest, then passes it through to the output phase as a dict that is an unstructured blob of information; this organization has its origins in the Perl version of the program. It results in an interface that is difficult to reason about, dozen-parameter function calls, and other ills. Introduce a new class (KdocItem) to carry this information between the parser and the output modules, and, step by step, modify the system to use this class in a more structured way. This could be taken further by creating a subclass of KdocItem for each declaration type (function, struct, ...), but that is probably more structure than we need. The result is (I hope) clearer code, the removal of a bunch of boilerplate, and no changes to the generated output. commit 40020fe8e3a4038ed6fb4b3115ad4c60fd354ab3 Author: Jonathan Corbet Date: Thu Jul 10 17:24:07 2025 -0600 docs: kdoc: emit a warning for ancient versions of Python Versions of Python prior to 3.7 do not guarantee to remember the insertion order of dicts; since kernel-doc depends on that guarantee, running with such older versions could result in output with reordered sections. Python 3.9 is the minimum for the kernel as a whole, so this should not be a problem, but put in a warning just in case somebody tries to use something older. Suggested-by: Mauro Carvalho Chehab Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit 636d4d9ec641025b98e8df4623a77ecc09026209 Author: Jonathan Corbet Date: Wed Jul 2 14:53:32 2025 -0600 docs: kdoc: clean up check_sections() entry.sectcheck is just a duplicate of our list of sections that is only passed to check_sections(); its main purpose seems to be to avoid checking the special named sections. Rework check_sections() to not use that field (which is then deleted), tocheck for the known sections directly, and tighten up the logic in general. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit bd5628bf60abd6f283d1fd8bdcff45c272971c6b Author: Jonathan Corbet Date: Wed Jul 2 13:55:56 2025 -0600 docs: kdoc: directly access the always-there KdocItem fields They are part of the interface, so use them directly. This allows the removal of the transitional __dict__ hack in KdocItem. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit 08b8dc43d18d5d0c4791cc630d5cddf98eaa51ea Author: Jonathan Corbet Date: Wed Jul 2 13:34:40 2025 -0600 docs: kdoc: straighten up dump_declaration() Get rid of the excess "return" statements in dump_declaration(), along with a line of never-executed dead code. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit a0db2051d7e1fca9a63a8643f1f187ff0b5931f1 Author: Jonathan Corbet Date: Wed Jul 2 13:17:59 2025 -0600 docs: kdoc: Regularize the use of the declaration name Each declaration type passes through the name in a unique field of the "args" blob - even though we have always just passed the name separately. Get rid of all the weird names and just use the common version. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit de6f7ac91a08d723a6eaa9c5bbce30c5a126c861 Author: Jonathan Corbet Date: Wed Jul 2 13:05:56 2025 -0600 docs: kdoc: Coalesce parameter-list handling Callers to output_declaration() always pass the parameter information from self.entry; remove all of the boilerplate arguments and just get at that information directly. Formalize its placement in the KdocItem class. It would be nice to get rid of parameterlist as well, but that has the effect of reordering the output of function parameters and struct fields to match the order in the kerneldoc comment rather than in the declaration. One could argue about which is more correct, but the ordering has been left unchanged for now. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit efacdf85135ae02a8c25452e40547b773bb1b6b3 Author: Jonathan Corbet Date: Wed Jul 2 11:12:27 2025 -0600 docs: kdoc: use self.entry.parameterlist directly in check_sections() Callers of check_sections() join parameterlist into a single string, which is then immediately split back into the original list. Rather than do all that, just use parameterlist directly in check_sections(). Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit 172bee3376ab29fbf38b09bf01d6f06f7f6c39e1 Author: Jonathan Corbet Date: Wed Jul 2 11:04:43 2025 -0600 docs: kdoc: remove the "struct_actual" machinery The code goes out of its way to create a special list of parameters in entry.struct_actual that is just like entry.parameterlist, but with extra junk. The only use of that information, in check_sections(), promptly strips all the extra junk back out. Drop all that extra work and just use parameterlist. No output changes. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit 8d7338752d76c3854a5c54cf7df976c539baab5b Author: Jonathan Corbet Date: Tue Jul 1 16:47:59 2025 -0600 docs: kdoc: Centralize handling of the item section list The section list always comes directly from the under-construction entry and is used uniformly. Formalize section handling in the KdocItem class, and have output_declaration() load the sections directly from the entry, eliminating a lot of duplicated, verbose parameters. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit 8d9d122915492ea6984f32e5df30cef5c582f062 Author: Jonathan Corbet Date: Tue Jul 1 16:21:24 2025 -0600 docs: kdoc: drop "sectionlist" Python dicts (as of 3.7) are guaranteed to remember the insertion order of items, so we do not need a separate list for that purpose. Drop the per-entry sectionlist variable and just rely on native dict ordering. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit 2abdc8818c2aad2764c1b014283c126ef43b2364 Author: Andrew Donnellan Date: Tue Jul 15 16:15:29 2025 +1000 Documentation: core-api: entry: Fix typo "systcalls" -> "syscalls" Fix a typo: "systcalls" should be "syscalls". Cc: Thomas Gleixner Cc: Nicolas Saenz Julienne Signed-off-by: Andrew Donnellan Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250715061529.56268-1-ajd@linux.ibm.com commit 869cab3acef76f4ee48e31953a84120871c1db26 Merge: f55b3ca3cf1d16 744cc616b8d80a Author: Jonathan Corbet Date: Tue Jul 15 13:20:32 2025 -0600 Merge tag 'chinese-doc-6.16-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/alexs/linux into docs-mw Chinese translation docs for 6.16-rc1 from Alex Shi This is the Chinese translation subtree for 6.16-rc1. It includes few changes: - Updates to the process documentation - Added translations for network and speculation docs - Polished zh_CN/how-to.rst The above patches have been tested by 'make htmldocs' commit 8802e168437840ea0b1d5ca571cd3e95681e9e2b Author: Alice Ryhl Date: Tue Jun 24 15:27:55 2025 +0000 rust: types: add Opaque::cast_from Since commit b20fbbc08a36 ("rust: check type of `$ptr` in `container_of!`") we have enforced that the field pointer passed to container_of! must match the declared field. This caused mismatches when using a pointer to bindings::x for fields of type Opaque. This situation encourages the user to simply pass field.cast() to the container_of! macro, but this is not great because you might accidentally pass a *mut bindings::y when the field type is Opaque, which would be wrong. To help catch this kind of mistake, add a new Opaque::cast_from that wraps a raw pointer in Opaque without changing the inner type. Also update the docs to reflect this as well as some existing users. Signed-off-by: Alice Ryhl Acked-by: Andreas Hindborg Acked-by: Boqun Feng Reviewed-by: Danilo Krummrich Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250624-opaque-from-raw-v2-1-e4da40bdc59c@google.com Signed-off-by: Miguel Ojeda commit 4ed357f72a0e0a691304e5f14a3323811c8ce862 Author: Charles Keepax Date: Mon Jul 7 13:41:55 2025 +0100 ASoC: SDCA: Add hw_params() helper function Add a helper function that can be called from hw_params() in the DAI ops to configure the SDCA Cluster, Clock and Usage controls. These setup the channels, sample rate, and bit depths that will be used by the Terminal. Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250707124155.2596744-8-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 264d3d776fb1a428706b0ca0f679bbed876fe7c9 Author: Charles Keepax Date: Mon Jul 7 13:41:54 2025 +0100 ASoC: SDCA: Add a helper to get the SoundWire port number Add a helper function to extract the SoundWire hardware port number from the SDCA DataPort Selector Control. Typically this would be called from hw_params() and used to call sdw_stream_add_slave(). Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250707124155.2596744-7-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 7b0d60dbb468fa82e9053292cdc8a5436400bfaf Author: Charles Keepax Date: Mon Jul 7 13:41:53 2025 +0100 ASoC: SDCA: Add helper to add DAI constraints Currently the core SDCA code simply creates a place holder available channels from 1 to SDCA_MAX_CHANNEL_COUNT. Add a helper function that will constrain the number of channels based on the actual available SDCA Clusters in DisCo. Currently this code only handles Input Terminal Entities as they directly specify the Cluster. More work will be required later for Output Terminals which inherit their Cluster. Typically this new helper would be called from the DAIs startup callback. Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250707124155.2596744-6-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 5f86d41d0410b072b5f4875ef5d38bf8d18eed55 Author: Charles Keepax Date: Mon Jul 7 13:41:52 2025 +0100 ASoC: soc-dai: Add private data to snd_soc_dai Add a private data pointer that can be used to store context along with the DAI. This will be useful to allow the SDCA class library to store data separately from the CODEC driver itself. Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250707124155.2596744-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit c57ad862462f064c0bd943a5828f5e0eca469ca5 Author: Charles Keepax Date: Mon Jul 7 13:41:51 2025 +0100 ASoC: SDCA: Move SDCA search functions and export The ASoC code for SDCA contains several helper functions that search for controls/ranges/etc. As the code evolves these helpers are likely to be useful to anything interacting with the stored DisCo data. Move the helpers into sdca_function.c and export them so other modules can also use them. Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250707124155.2596744-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit cbcb5f5c2be523ef0908df290b3033138bd4c185 Author: Charles Keepax Date: Mon Jul 7 13:41:50 2025 +0100 ASoC: SDCA: Remove overly chatty input pin list warning An input pin list is not generally required, so a warning on the absence of one is a little extreme, remove this warning message. Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250707124155.2596744-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 4eb6ad5d2080681b531db2c1764246f9a868062f Author: Charles Keepax Date: Mon Jul 7 13:41:49 2025 +0100 ASoC: SDCA: Allow read-only controls to be deferrable The current SDCA Control parsing only checks the deferrable flag for Read/Write and Dual Ranked controls. However, reads can defer as well as writes so Read Only controls should also check for the deferrable flag. Add the handling for this into find_sdca_entity_control(). Fixes: 42b144cb6a2d ("ASoC: SDCA: Add SDCA Control parsing") Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250707124155.2596744-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit a2fbecdbbb9d7706fd3ec25f0dead83a2d542943 Author: Krishna Chaitanya Chundru Date: Wed Jul 2 16:50:42 2025 +0530 PCI: qcom: Add support for parsing the new Root Port binding The DT binding has moved the PHY, PERST# properties to Root Port node from the Host Bridge node. So add support for parsing the new binding. The new binding uses 'reset-gpios' property for PERST#, hence parse the same property in the driver instead of the legacy 'perst-gpios'. To maintain DT backwards compatibility, fallback to the legacy method of parsing the host bridge node if the properties are not present in the Root Port node. Signed-off-by: Krishna Chaitanya Chundru [mani: refactored the root port parsing code, fixed a bug & commit message rewording] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250702-perst-v5-2-920b3d1f6ee1@qti.qualcomm.com commit 38fcbfbd4207ec3fe47f66c2a16df7f5a857e198 Author: Krishna Chaitanya Chundru Date: Wed Jul 2 16:50:41 2025 +0530 dt-bindings: PCI: qcom: Move PHY & reset GPIO to Root Port node Move the phys, phy-names, reset-gpios properties to the PCIe Root Port node from Host Bridge node, as agreed upon here [1]. Update the qcom,pcie-common.yaml to include the 'phys' property in the Root Port node. 'phy-names' property is not needed in Root Port since each Root Port supports only one PHY. Also, there is already 'reset-gpios' property defined for PERST# in pci-bus-common.yaml, so use that property instead of 'perst-gpios'. For backward compatibility, do not remove any existing properties in the bridge node, but mark them as 'deprecated' instead. [1] https://lore.kernel.org/linux-pci/20241211192014.GA3302752@bhelgaas/ Signed-off-by: Krishna Chaitanya Chundru [mani: commit message rewording] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250702-perst-v5-1-920b3d1f6ee1@qti.qualcomm.com commit 7d944c0f146986a532087e15abb66a27c7890ca1 Author: Mayank Rana Date: Mon Jun 16 15:42:59 2025 -0700 PCI: qcom: Add support for Qualcomm SA8255p based PCIe Root Complex Add functionality to enable resource management (like clocks, regulators, PHY) through firmware and enumerate ECAM compliant Root Complex on SA8255p SoC, where the PCIe Root Complex is firmware managed and configured into ECAM compliant mode. Signed-off-by: Mayank Rana [mani: minor code cleanups and commit message rewording] Signed-off-by: Manivannan Sadhasivam [bhelgaas: add "ECAM" in comment] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250616224259.3549811-5-mayank.rana@oss.qualcomm.com commit 8723c146ad4ca17d340213f3676ce1829668b79b Author: Jens Axboe Date: Tue Jul 15 12:20:06 2025 -0600 io_uring: deduplicate wakeup handling Both io_poll_wq_wake() and io_cqring_wake() contain the exact same code, and most of the comment in the latter applies equally to both. Move the test and wakeup handling into a basic helper that they can both use, and move part of the comment that applies generically to this new helper. Signed-off-by: Jens Axboe commit d7c7c051e8e5f781c98310709f3feaf7e634251b Author: Mayank Rana Date: Mon Jun 16 15:42:58 2025 -0700 dt-bindings: PCI: qcom,pcie-sa8255p: Document ECAM compliant PCIe root complex Document the required configuration to enable the PCIe Root Complex on SA8255p, which is managed by firmware using power-domain based handling and configured as ECAM compliant. Signed-off-by: Mayank Rana Signed-off-by: Manivannan Sadhasivam [bhelgaas: add "ECAM" in reg description] Signed-off-by: Bjorn Helgaas Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250616224259.3549811-4-mayank.rana@oss.qualcomm.com commit b2501f327b8a136dbdd1fe7bad5d113eeda2827a Author: Diederik de Haas Date: Wed Jul 9 15:15:23 2025 +0200 arm64: dts: rockchip: Drop regulator-compatible property on rk3399 The regulator-compatible property has never existed in the regulator/fcs,fan53555.yaml binding, so drop it. This fixes the following DTB validation warnings: Unevaluated properties are not allowed ('regulator-compatible' was unexpected) Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250709132323.128757-11-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit 2fe00f4611637db677be51d7812dc177e4019b6a Author: Diederik de Haas Date: Wed Jul 9 15:15:22 2025 +0200 arm64: dts: rockchip: Drop unneeded address+size-cells on px30 On nodes with compatible "rockchip,px30-usb2phy-grf", the #address-cells and #size-cells are required and consequently their child nodes should have unit addresses. That is not the case for the px30-pmugrf and px30-grf nodes, so remove them there. This fixes the following DTB validation warnings: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" property Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250709132323.128757-10-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit 8c17c938dd94f70fd37db476f8b965dd2775b874 Author: Diederik de Haas Date: Wed Jul 9 15:15:21 2025 +0200 arm64: dts: rockchip: Fix LCD panel port on rk3566-pinetab2 The MIPI DSI connector on the PineTab2 only has 1 port with 1 endpoint, so drop the unit-address properties. While at it, move 'rotation' property to its proper sorting position. This fixes the following DTB validation warnings: node has a unit name, but no reg or ranges property Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250709132323.128757-9-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit 4ac334d40e7022f091c65480cb7a01bc89135989 Author: Diederik de Haas Date: Wed Jul 9 15:15:20 2025 +0200 arm64: dts: rockchip: Move mipi_out node on rk3399 haikou demo dtso According to the DTS coding style [1] referenced nodes should be sorted alpha-numerically so move mipi_out to be after mipi_in_panel. [1] https://www.kernel.org/doc/html/latest/devicetree/bindings/dts-coding-style.html#order-of-nodes Signed-off-by: Diederik de Haas Reviewed-by: Quentin Schulz Link: https://lore.kernel.org/r/20250709132323.128757-8-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit dfb549bbca62fe4b2c06bf203a3a9c1f86fcfae2 Author: Diederik de Haas Date: Wed Jul 9 15:15:19 2025 +0200 arm64: dts: rockchip: Simplify mipi_out endpoint on rk3399 RP64 dtso The only thing actually added here is a single endpoint on mipi_out, which is already defined in rk3399-base.dtsi, so it's simpler to just reference that phandle, which allows the removal of several properties. Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250709132323.128757-7-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit 25937eb02f0a5a7e30fe97333ecc94ec5582ecb3 Author: Diederik de Haas Date: Wed Jul 9 15:15:18 2025 +0200 arm64: dts: rockchip: Simplify edp endpoints on several rk3399 boards The only thing actually added here is a single endpoint on edp_out, which is already defined in rk3399-base.dtsi, so it's simpler to just reference that phandle, which allows the removal of several properties. This fixes the following DTB validation warnings: graph node has single child node 'endpoint@0', #address-cells/#size-cells are not necessary Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250709132323.128757-6-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit 776d8e75d4a3a422a680648e30c5bfe607a99805 Author: Diederik de Haas Date: Wed Jul 9 15:15:17 2025 +0200 arm64: dts: rockchip: Simplify VOP port definition on rk3328 When there's only 1 endpoint, there is no need for a unit-address and removing that allows removing of related properties as well. This fixes the following DTB validation warnings: graph node has single child node 'endpoint@0', #address-cells/#size-cells are not necessary Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250709132323.128757-5-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit 01ceec076ba10cb6c9f5642f996203170412cd78 Author: Caleb Sander Mateos Date: Tue Jul 15 09:42:43 2025 -0600 ublk: remove unused req argument from ublk_sub_req_ref() Since commit b749965edda8 ("ublk: remove ublk_commit_and_fetch()"), ublk_sub_req_ref() no longer uses its struct request *req argument. So drop the argument from ublk_sub_req_ref(), and from ublk_need_complete_req(), which only passes it to ublk_sub_req_ref(). Signed-off-by: Caleb Sander Mateos Link: https://lore.kernel.org/r/20250715154244.1626810-1-csander@purestorage.com Signed-off-by: Jens Axboe commit fff8e0504499a929f26e2fb7cf7e2c9854e37b91 Author: Thomas Zimmermann Date: Tue Jul 15 11:50:54 2025 +0200 drm/radeon: Do not hold console lock during resume The function radeon_resume_kms() acquires the console lock. It is inconsistent, as it depends on the notify_client argument. That lock then covers a number of suspend operations that are unrelated to the console. Remove the calls to console_lock() and console_unlock() from the radeon function. The console lock is only required by DRM's fbdev emulation, which acquires it as necessary. Also fixes a possible circular dependency between the console lock and the client-list mutex, where the mutex is supposed to be taken first. Signed-off-by: Thomas Zimmermann Signed-off-by: Alex Deucher commit 612ec7c69d04cb58beb1332c2806da9f2f47a3ae Author: Thomas Zimmermann Date: Tue Jul 15 11:50:53 2025 +0200 drm/radeon: Do not hold console lock while suspending clients The radeon driver holds the console lock while suspending in-kernel DRM clients. This creates a circular dependency with the client-list mutex, which is supposed to be acquired first. Reported when combining radeon with another DRM driver. Therefore, do not take the console lock in radeon, but let the fbdev DRM client acquire the lock when needed. This is what all other DRM drivers so. Signed-off-by: Thomas Zimmermann Reported-by: Jeff Johnson Closes: https://lore.kernel.org/dri-devel/0a087cfd-bd4c-48f1-aa2f-4a3b12593935@oss.qualcomm.com/ Suggested-by: Ville Syrjälä Signed-off-by: Alex Deucher commit 48ee3d8e5e0eff999e3031524e0b29e1e0f18d51 Author: ganglxie Date: Fri Jul 11 16:20:12 2025 +0800 drm/amdgpu: refine bad page loading when in the same nps mode when loading bad page in the same nps mode, need to set the other fields fields in eeprom records manually besides retired_page Signed-off-by: ganglxie Reviewed-by: Tao Zhou Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 660261df61fb7fd972aae0f09b17c2b899f1e282 Author: ganglxie Date: Wed Jul 2 16:56:22 2025 +0800 drm/amdgpu: refine eeprom data check add eeprom data checksum check before driver unload. reset eeprom and save correct data to eeprom when check failed Signed-off-by: ganglxie Reviewed-by: Tao Zhou Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 340231cdceec2c45995d773a358ca3c341f151aa Author: Melissa Wen Date: Mon Jul 7 16:52:05 2025 -0400 drm/amd/display: Disable CRTC degamma LUT for DCN401 In DCN401 pre-blending degamma LUT isn't affecting cursor as in previous DCN version. As this is not the behavior close to what is expected for CRTC degamma LUT, disable CRTC degamma LUT property in this HW. Link: https://gitlab.freedesktop.org/drm/amd/-/issues/4176 --- When enabling HDR on KDE, it takes the first CRTC 1D LUT available and apply a color transformation (Gamma 2.2 -> PQ). AMD driver usually advertises a CRTC degamma LUT as the first CRTC 1D LUT, but it's actually applied pre-blending. In previous HW version, it seems to work fine because the 1D LUT was applied to cursor too, but DCN401 presents a different behavior and the 1D LUT isn't affecting the hardware cursor. To address the wrong gamma on cursor with HDR (see the link), I came up with this patch that disables CRTC degamma LUT in this hw, since it presents a different behavior than others. With this KDE sees CRTC regamma LUT as the first post-blending 1D LUT available. This is actually more consistent with AMD color pipeline. It was tested by the reporter, since I don't have the HW available for local testing and debugging. Melissa --- Reviewed-by: Harry Wentland Signed-off-by: Melissa Wen Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ad19aa07445c2313c996040408a18b75db8f604c Author: Ivan Lipski Date: Wed Jul 2 15:34:30 2025 -0400 drm/amd/display: Revert "Add DPP & HUBP reset if power gate enabled on DCN314" This reverts commit 99e25e4683d7cfdf79dcc328e11bb6c924c77566. [Why & How] This commit caused a blank screen on internal display when projecting to an external display on DCN314. Reviewed-by: Aric Cyr Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 18f0817d2e9af479a40a1be4d83a849894d6b3f8 Author: Aurabindo Pillai Date: Fri May 2 09:51:04 2025 -0400 drm/amd/display: Initial support for SmartMux SmartMux is a mechanism to switch the GPU being used for scanout in a hybrid configuration. This is used for devices with an eDP and two GPUs. This is only valid when the system has a physical switch (Multiplexer) in the board to switch between the two GPUs. When a graphically intensive workload like a game is being run, the system can be switch the active display to the dGPU, so that we can avoid copying the buffer from dGPU to APU for scanout. This helps with latency and FPS. When power consumption is preferred, the system can be switched to the APU. Reviewed-by: Alvin Lee Signed-off-by: Aurabindo Pillai Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fa699acb8e9be2341ee318077fa119acc7d5f329 Author: Clayton King Date: Thu Jun 19 13:54:26 2025 -0400 drm/amd/display: Free memory allocation [WHY] Free memory to avoid memory leak Reviewed-by: Joshua Aberback Signed-off-by: Clayton King Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 1f26214d268bc2176d9b2374731a6ec4f369030d Author: Ovidiu Bunea Date: Thu Mar 27 16:36:17 2025 -0400 drm/amd/display: Add HPO encoder support to Replay [why & how] UHBR link rate capable eDPs will use HPO for encoding. Need to pass HPO stream and link encoder instances to DMCUB for Replay FSM to know which instances to use. Reviewed-by: Charlene Liu Signed-off-by: Ovidiu Bunea Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 3bfce48b109fcb9d561a39f69f073dfc1df55ead Author: Ovidiu Bunea Date: Wed Mar 12 23:07:39 2025 -0400 drm/amd/display: Add support for Panel Replay on DP1 eDP (panel_inst=1) [why & how] DP1 eDP is still considered a single-eDP case and should support Panel Replay. Modify secondary eDP policy to reflect this and update Replay state accordingly. Reviewed-by: Charlene Liu Signed-off-by: Ovidiu Bunea Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 504f9bdd3a1588604b0452bfe927ff86e5f6e6df Author: Michael Strauss Date: Tue Feb 18 09:23:44 2025 -0500 drm/amd/display: Fix FIXED_VS retimer clock gen source override [WHY] For SQ128 pattern some vendor-specific overrides are required. Previously a hardcoded clock gen source value was incorrectly programmed, causing our override to retimer's clock source override to be ignored. Due to some PHY issues on certain APU programs, we see failures on retimer bypass ports extend to electrical testing downstream of PHY due to some host clock jitter which the retimer follows. [HOW] Fix typo to use correct clock gen source override of 0xC4 rather than 0x4C. Reviewed-by: Charlene Liu Signed-off-by: Michael Strauss Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 42fcf48f7b3037bc885db2e0c19ec9941029a134 Author: Leo Chen Date: Mon Jun 16 15:33:06 2025 -0400 drm/amd/display: New Behavior for debug option disable_ips_in_vpb [Why & How] To facilitate debugging, the following behaviors are defined for existing debug option disable_ips_in_vpb 0 - Enable IPS in LVP - let driver decide (legacy) 1 - Disable IPS in LVP 2 - Enable IPS1 and RCG in LVP 3 - Enable IPS1 Z8, IPS1 and RCG in LVP Reviewed-by: Duncan Ma Signed-off-by: Leo Chen Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c5c33903d7aed0f16cc300c27da984f89a159cf2 Author: Leo Chen Date: Thu May 15 14:16:39 2025 -0400 drm/amd/display: Add static pg implementations for future use [Why & How] Add static pg implementations and debug flags for future use. Reviewed-by: Duncan Ma Signed-off-by: Leo Chen Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit a8a21bafa1b964ea566c69152c3299fefcb6c0c5 Author: Duncan Ma Date: Fri May 2 12:40:48 2025 -0400 drm/amd/display: Notify DMUB on HW Release [Why & How] DMUB shall be notified on driver hardware release. Implement notification. Reviewed-by: Duncan Ma Signed-off-by: Duncan Ma Signed-off-by: Ivan Lipski Signed-off-by: Alex Deucher commit f9dbe8eb1b3d0120271c455e209731000cedc23f Author: Leo Chen Date: Tue Apr 1 00:14:01 2025 -0400 drm/amd/display: Adding missing driver code for IPSv2.0 [Why & How] Aligned IPS FW state with DMCUB IPS FW state Added debug option disable_ips_rcg to modify RCG behaviour in IPS modes. Updated existing debug option disable_ips to align with new changes introduced by IPSv2.0 Reviewed-by: Duncan Ma Signed-off-by: Leo Chen Signed-off-by: Ivan Lipski Signed-off-by: Alex Deucher commit 2ee27baf5c7cbaa97d58288c46de12dfe47cde78 Author: Duncan Ma Date: Mon Mar 31 12:35:11 2025 -0400 drm/amd/display: Notify display idle on D3 [Why & How] Display idle notification shall be sent by driver on D3 entry. Implement notification to DMUB and PMFW. Reviewed-by: Duncan Ma Signed-off-by: Duncan Ma Signed-off-by: Ivan Lipski Signed-off-by: Alex Deucher commit f354556e29f40ef44fa8b13dc914817db3537e20 Author: Charlene Liu Date: Thu Jun 26 16:36:17 2025 -0400 drm/amd/display: limit clear_update_flags to dcn32 and above [why] dc has some code out of sync: dc_commit_updates_for_stream handles v1/v2/v3, but dc_update_planes_and_stream makes v1 asic to use v2. as a reression fix: limit clear_update_flags to dcn32 or newer asic. need to follow up that v1 asic using v2 issue. Reviewed-by: Syed Hassan Signed-off-by: Charlene Liu Signed-off-by: Ivan Lipski Signed-off-by: Alex Deucher commit 3f2b24a1ef359d4a8313dc919bf772aeb6b54c9b Author: Fudongwang Date: Tue Jun 24 17:49:47 2025 +0800 drm/amd/display: Monitor patch to ignore EDID audio SAB check [Why & How] Some monitor have audio output but SAB data is zero. Skip check this in this case. Reviewed-by: Charlene Liu Reviewed-by: Jun Lei Signed-off-by: Fudongwang Signed-off-by: Ivan Lipski Signed-off-by: Alex Deucher commit aef3af22a4560cad02f864c5ebd6372b516cceeb Author: Ilya Bakoulin Date: Tue Jun 24 16:51:16 2025 -0400 drm/amd/display: Add definitions to support DID Type5 descriptors [Why/How] Add the timing source needed to support DID Type5. Reviewed-by: Aric Cyr Signed-off-by: Ilya Bakoulin Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d7b618bc41ee3d44c070212dff93949702ede997 Author: Dillon Varone Date: Fri Jun 20 16:23:43 2025 -0400 drm/amd/display: Refactor DSC cap calculations [WHY] DSC block level should only be responsible for reporting single DSC instance capabilities. Factoring in ODM combine requirements should be handled in dc_dsc.c. Both components should acquire clocks from clk_mgr to determine throughput capabilities instead of relying on hard coded values as these can differ by SoC and SKU. [HOW] 1) Add dsc_get_single_enc_caps to acquire single DSC instance capabilities (replacing dsc_get_enc_caps), factoring in DSCCLK 2) add build_dsc_enc_caps to combine single DSC instance capabilities 3) account for max pixel rate per pipe (DISPCLK) when calculating minimum slice count Reviewed-by: Wenjing Liu Signed-off-by: Dillon Varone Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit a1619668d41f6f3c26b5dc5bff68456eeaa02cbe Author: Karthi Kandasamy Date: Wed Jun 11 15:46:27 2025 +0200 drm/amd/display: Make dcn401_initialize_min_clocks() available to other compilation units [Why & How] Expose dcn401_initialize_min_clocks() for future use and add additional check for IP register. Reviewed-by: Nevenko Stupar Signed-off-by: Karthi Kandasamy Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 26ad78fffc66886207d793527775120b45166200 Author: Yihan Zhu Date: Thu Jun 19 15:26:30 2025 -0400 drm/amd/display: MPC basic allocation logic and TMZ [WHY & HOW] Adding basic logic to allocate unused RMCM block and TMZ support. Reviewed-by: Krunoslav Kovac Signed-off-by: Yihan Zhu Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 04d57f4462a6c39f04711550aa60c42c8ed5d25d Author: Dominik Kaszewski Date: Tue Jun 24 12:40:25 2025 +0200 drm/amd/display: Workaround for stuck I2C arbitrage [Why] When booting without an HDMI display connected, the I2C registers are not initialized correctly, leading to DC_I2C_ARBITRATION register getting stuck with DC_I2C_REG_RW_CNTL_STATUS == USED_BY_SW. [How] * Correct TOCTOU race condition in engine acquire logic which did not check against DMUB trying to acquire it at the same time. * Deassert SOFT_RESET before acquire, as it can block access to other I2C registers. * Add a workaround in release, checking that after triggerring DC_I2C_SW_DONE_USING_I2C_REG, DC_I2C_REG_RW_CNTL_STATUS != USED_BY_SW. If necessary, trigger DC_I2C_SW_DONE_USING_I2C_REG again. * Remove unnecessary clear of DC_I2C_SW_USE_I2C_REG_REQ, which engine ignores according to specification. Reviewed-by: Alvin Lee Signed-off-by: Dominik Kaszewski Signed-off-by: Ivan Lipski Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 48cb9c3b21474864beb9e19cb4f7b4ccb50de77b Author: Ce Sun Date: Fri Jul 11 17:57:25 2025 +0800 drm/amdgpu: The interrupt source was not released When the driver is unloaded, the interrupt source of the rma device is not released, resulting in the failure of hw_init when loading again using bad_page_threshold. Signed-off-by: Ce Sun Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit fa301127ba9a22f40b4261f569f1fc8b3d66e04e Author: Han Gao Date: Wed Jul 9 14:51:38 2025 +0800 drm/amdkfd: enable kfd on LoongArch systems KFD has been confirmed that can run on LoongArch systems. It's necessary to support CONFIG_HSA_AMD on LoongArch. Signed-off-by: Han Gao Signed-off-by: Felix Kuehling Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 7a5b69d60e448e134c7afa023e2a960d012b7a4f Author: Alex Deucher Date: Mon Jul 7 11:30:14 2025 -0400 drm/amdgpu/vcn5: add additional ring reset error checking Start and stop can fail, so add checks. Fixes: b54695dae995 ("drm/amd: Add per-ring reset for vcn v5.0.0 use") Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: Mario Limonciello commit 1b556bcc3837441b9f75d2c7df44e8e312b550e7 Author: Alex Deucher Date: Mon Jul 7 11:28:33 2025 -0400 drm/amdgpu/vcn4.0.5: add additional ring reset error checking Start and stop can fail, so add checks. Fixes: d1a46cdd0053 ("drm/amd: Add per-ring reset for vcn v4.0.5 use") Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: Mario Limonciello commit d115a63f816035f976e14b7eba8f14e8e33c0945 Author: Alex Deucher Date: Mon Jul 7 11:26:14 2025 -0400 drm/amdgpu/vcn4: add additional ring reset error checking Start and stop can fail, so add checks. Fixes: b8b6e6f1654d ("drm/amd: Add per-ring reset for vcn v4.0.0 use") Reviewed-by: Mario Limonciello Signed-off-by: Alex Deucher Cc: Mario Limonciello commit a4b2ba8f631d3e44b30b9b46ee290fbfe608b7d0 Author: Alex Deucher Date: Mon Jul 7 09:56:35 2025 -0400 drm/amdgpu/gfx10: fix kiq locking in KCQ reset The ring test needs to be inside the lock. Fixes: 097af47d3cfb ("drm/amdgpu/gfx10: wait for reset done before remap") Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: Jiadong Zhu commit 08f116c59310728ea8b7e9dc3086569006c861cf Author: Alex Deucher Date: Mon Jul 7 09:42:23 2025 -0400 drm/amdgpu/gfx9.4.3: fix kiq locking in KCQ reset The ring test needs to be inside the lock. Fixes: 4c953e53cc34 ("drm/amdgpu/gfx_9.4.3: wait for reset done before remap") Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: Jiadong Zhu commit 730ea5074dac1b105717316be5d9c18b09829385 Author: Alex Deucher Date: Mon Jul 7 09:38:27 2025 -0400 drm/amdgpu/gfx9: fix kiq locking in KCQ reset The ring test needs to be inside the lock. Fixes: fdbd69486b46 ("drm/amdgpu/gfx9: wait for reset done before remap") Reviewed-by: Christian König Signed-off-by: Alex Deucher Cc: Jiadong Zhu commit 8ff4a4b98d1f82544460a9e9c04dbe9d0ac0322f Author: Lijo Lazar Date: Sat Jul 5 08:45:08 2025 +0530 drm/amdgpu: Use cached partition mode, if valid For current partition mode queries, return the mode cached in partition manager whenever it's valid. Signed-off-by: Lijo Lazar Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 300386d117a98961fc1d612d1f1a61997d731b8a Author: Jameson Thies Date: Fri Jul 11 20:20:33 2025 +0000 usb: typec: ucsi: Add poll_cci operation to cros_ec_ucsi cros_ec_ucsi fails to allocate a UCSI instance in it's probe function because it does not define all operations checked by ucsi_create. Update cros_ec_ucsi operations to use the same function for read_cci and poll_cci. Signed-off-by: Jameson Thies Reviewed-by: Benson Leung Link: https://lore.kernel.org/r/20250711202033.2201305-1-jthies@google.com Signed-off-by: Greg Kroah-Hartman commit 8a0ca581402b40f3f13a1b8fc96ae5ab1384a041 Author: André Draszik Date: Mon Jul 7 11:50:29 2025 +0100 usb: typec: tcpm/tcpci_maxim: enable PROBE_PREFER_ASYNCHRONOUS This driver works fine with asynchronous probe. Signed-off-by: André Draszik Reviewed-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20250707-max77759-irq-wake-v1-3-d367f633e4bc@linaro.org Signed-off-by: Greg Kroah-Hartman commit 286d9e5abed003b4b27f9e601e6e2d6abb98294e Author: André Draszik Date: Mon Jul 7 11:50:28 2025 +0100 usb: typec: tcpm/tcpci_maxim: drop CONFIG_OF The general recommendation is to not use of_match_ptr() or CONFIG_OF ifdef. Drop them. Signed-off-by: André Draszik Reviewed-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20250707-max77759-irq-wake-v1-2-d367f633e4bc@linaro.org Signed-off-by: Greg Kroah-Hartman commit 31611223fb34a3e9320cdfc4f4395072a13ea78e Author: André Draszik Date: Mon Jul 7 11:50:27 2025 +0100 usb: typec: tcpm/tcpci_maxim: fix irq wake usage This driver calls enable_irq_wake() during probe() unconditionally, and never issues the required corresponding disable_irq_wake() to disable hardware interrupt wakeup signals. Additionally, whether or not a device should wake-up the system is meant to be a policy decision based on sysfs (.../power/wakeup) in the first place. Update the driver to use the standard approach to enable/disable IRQ wake during the suspend/resume callbacks. This solves both issues described above. Signed-off-by: André Draszik Reviewed-by: Badhri Jagan Sridharan Link: https://lore.kernel.org/r/20250707-max77759-irq-wake-v1-1-d367f633e4bc@linaro.org Signed-off-by: Greg Kroah-Hartman commit a1abefe004da0f9a2d65637f40659241fe12c6ac Author: Geert Uytterhoeven Date: Wed Jul 9 21:07:08 2025 +0200 usb: gadget: udc: renesas_usb3: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas USB3.0 Peripheral controller driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the check for CONFIG_PM_SLEEP, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled, while increasing build coverage. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/424d6c7843c5bfd47c0e1d8d02aa030581530bb1.1752087999.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit 782aee5bd3419bdf19ca85354f3164db59444de4 Author: Geert Uytterhoeven Date: Wed Jul 9 21:06:26 2025 +0200 usb: renesas_usbhs: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas USBHS driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/e1136dcd351a19b2e7145436bea1f38faa93a677.1752087914.git.geert+renesas@glider.be Signed-off-by: Greg Kroah-Hartman commit c6efba9271dd9549f8bbf2593d41d902000185a1 Author: Frank Li Date: Mon Jun 23 16:30:10 2025 -0400 dt-bindings: usb: convert lpc32xx-udc.txt to yaml format Convert lpc32xx-udc.txt to yaml format. Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250623203011.2473290-1-Frank.Li@nxp.com Signed-off-by: Greg Kroah-Hartman commit 0c927d478486fbc96a225aeae6705e7152700c87 Author: Florian Fainelli Date: Tue Jul 1 10:55:38 2025 -0700 ARM: dts: broadcom: Fix bcm7445 memory controller compatible The memory controller node compatible string was incompletely specified and used the fallback compatible. After commit 501be7cecec9 ("dt-bindings: memory-controller: Define fallback compatible") however, we need to fully specify the compatible string. Fixes: 501be7cecec9 ("dt-bindings: memory-controller: Define fallback compatible") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507011302.ZqNlBKWX-lkp@intel.com/ Link: https://lore.kernel.org/r/20250701175538.1633435-1-florian.fainelli@broadcom.com Signed-off-by: Florian Fainelli commit 0bcc0f5e98bebd05e44261df3c33d274084eab60 Author: Dale Whinham Date: Mon Jul 14 18:35:38 2025 +0100 dt-bindings: display: panel: samsung,atna30dw01: document ATNA30DW01 The Samsung ATNA30DW01 panel is a 13" AMOLED eDP panel. It is similar to the ATNA33XC20 except that it is smaller and has a higher resolution. Tested-by: Jérôme de Bretagne Signed-off-by: Dale Whinham Acked-by: Rob Herring (Arm) Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250714173554.14223-3-daleyo@gmail.com commit 65a5520a27570787b17e6f0b093829fc7e0514e2 Author: Marc Zyngier Date: Tue Jul 15 18:11:12 2025 +0100 arm64: smp: Fix pNMI setup after GICv5 rework Breno reports that pNMIs are not behaving the way they should since they were reworked for GICv5. Turns out we feed the IRQ number to the pNMI helper instead of the IPI number -- not a good idea. Fix it by providing the correct number (duh). Fixes: ba1004f861d16 ("arm64: smp: Support non-SGIs for IPIs") Reported-by: Breno Leitao Suggested-by: Lorenzo Pieralisi Signed-off-by: Marc Zyngier commit 35928bc38db69a2af26624e35a250c1e0f9a6a3f Author: Wang Haoran Date: Tue Jul 15 21:17:00 2025 +0800 EDAC/{skx_common,i10nm}: Use scnprintf() for safer buffer handling snprintf() is fragile when its return value will be used to append additional data to a buffer. Use scnprintf() instead. Signed-off-by: Wang Haoran Signed-off-by: Tony Luck Tested-by: Qiuxu Zhuo Reviewed-by: Qiuxu Zhuo Link: https://lore.kernel.org/r/20250715131700.1092720-1-haoranwangsec@gmail.com commit 399444a87acdea5d21c218bc8e9b621fea1cd218 Author: Richard Zhu Date: Tue Jul 8 17:10:03 2025 +0800 PCI: imx6: Add IMX8MM_EP and IMX8MP_EP fixed 256-byte BAR 4 in epc_features For IMX8MM_EP and IMX8MP_EP, add fixed 256-byte BAR 4 and reserved BAR 5 in imx8m_pcie_epc_features. Fixes: 75c2f26da03f ("PCI: imx6: Add i.MX PCIe EP mode support") Signed-off-by: Richard Zhu [bhelgaas: add details in subject] Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250708091003.2582846-3-hongxing.zhu@nxp.com commit c523fa63ac1d452abeeb4e699560ec3365037f32 Author: Richard Zhu Date: Tue Jul 8 17:10:02 2025 +0800 PCI: imx6: Add IMX8MQ_EP third 64-bit BAR in epc_features IMX8MQ_EP has three 64-bit BAR0/2/4 capable and programmable BARs. For IMX8MQ_EP, use imx8q_pcie_epc_features (64-bit BARs 0, 2, 4) instead of imx8m_pcie_epc_features (64-bit BARs 0, 2). Fixes: 75c2f26da03f ("PCI: imx6: Add i.MX PCIe EP mode support") Signed-off-by: Richard Zhu [bhelgaas: add details in subject] Signed-off-by: Bjorn Helgaas Reviewed-by: Frank Li Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250708091003.2582846-2-hongxing.zhu@nxp.com commit 65c12b104cb942d588a1a093acc4537fb3d3b129 Author: Baochen Qiang Date: Tue Jun 3 10:25:28 2025 +0800 wifi: ath11k: fix sleeping-in-atomic in ath11k_mac_op_set_bitrate_mask() ath11k_mac_disable_peer_fixed_rate() is passed as the iterator to ieee80211_iterate_stations_atomic(). Note in this case the iterator is required to be atomic, however ath11k_mac_disable_peer_fixed_rate() does not follow it as it might sleep. Consequently below warning is seen: BUG: sleeping function called from invalid context at wmi.c:304 Call Trace: dump_stack_lvl __might_resched.cold ath11k_wmi_cmd_send ath11k_wmi_set_peer_param ath11k_mac_disable_peer_fixed_rate ieee80211_iterate_stations_atomic ath11k_mac_op_set_bitrate_mask.cold Change to ieee80211_iterate_stations_mtx() to fix this issue. Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.30 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Signed-off-by: Baochen Qiang Link: https://patch.msgid.link/20250603-ath11k-use-non-atomic-iterator-v1-1-d75762068d56@quicinc.com Signed-off-by: Jeff Johnson commit 15247b5a63f506125360fa45d7aa1fbe8b903b95 Author: Charles Keepax Date: Tue Jul 15 16:17:23 2025 +0100 ASoC: SDCA: Update memory allocations to zero initialise All the memory allocations in the SDCA ASoC helpers rely on fields being zero initialised, the code should use kzalloc not kmalloc. Reported-by: Shuming Fan Fixes: 2c8b3a8e6aa8 ("ASoC: SDCA: Create DAPM widgets and routes from DisCo") Fixes: c3ca24e3fcb6 ("ASoC: SDCA: Create ALSA controls from DisCo") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20250715151723.2964336-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 71562278a189af2ca202eafa0ab71a9b68469207 Author: Charles Keepax Date: Tue Jul 15 16:17:22 2025 +0100 ASoC: SDCA: Avoid use of uninitialised local name variable The local name variable is accidentally left over from an earlier version of the code. Remove the variable and its uninitialised usage. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202507150415.M1tCgi3p-lkp@intel.com/ Fixes: b126394d9ec6 ("ASoC: SDCA: Generic interrupt support") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20250715151723.2964336-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 3f2e4c11925ee24a34853b0d608ab85df2430555 Author: Charles Keepax Date: Tue Jul 15 16:17:21 2025 +0100 ASoC: SDCA: Fix off by one error in IRQ bound check Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202507150415.M1tCgi3p-lkp@intel.com/ Fixes: b126394d9ec6 ("ASoC: SDCA: Generic interrupt support") Signed-off-by: Charles Keepax Link: https://patch.msgid.link/20250715151723.2964336-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 91703041697c9d2e8dffe5b3a159198ba0dd24e7 Author: Lukas Wunner Date: Fri Jul 4 09:38:33 2025 +0200 PCI: Allow built-in drivers to use async initial probing The PCI core has historically not allowed built-in drivers to opt in to async initial probing: Drivers may set "PROBE_PREFER_ASYNCHRONOUS", but initial probing always happens synchronously. That's because the PCI core uses device_attach() instead of device_initial_probe(). Should a driver return -EPROBE_DEFER on initial probe, reprobing later on does honor the PROBE_PREFER_ASYNCHRONOUS setting. Modular drivers are also allowed to probe asynchronously, which is inconsistent. The choice of device_attach() is likely not deliberate: It was introduced in 2013 with commit 58d9a38f6fac ("PCI: Skip attaching driver in device_add()"), but asynchronous probing was added two years later with commit 765230b5f084 ("driver-core: add asynchronous probing support for drivers"). According to the kernel-doc of "enum probe_type", "the end goal is to switch the kernel to use asynchronous probing by default". To this end, use device_initial_probe() to allow asynchronous initial probing. The function returns void, making the return value check unnecessary. Initial PCI probing often takes on the order of seconds even on laptops, so this may speed up booting significantly. A small number of PCI drivers already opt in to asynchronous probing. Their maintainers (who are all cc'ed) should watch out for issues, now that asynchronous probing is not just allowed for deferred and modular probing, but also initial probing: hl_pci_driver drivers/accel/habanalabs/common/habanalabs_drv.c cxl_pci_driver drivers/cxl/pci.c quicki2c_driver drivers/hid/intel-thc-hid/intel-quicki2c/pci-quicki2c.c quickspi_driver drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c i801_driver drivers/i2c/busses/i2c-i801.c mei_me_driver drivers/misc/mei/pci-me.c mei_vsc_drv drivers/misc/mei/platform-vsc.c sdhci_driver drivers/mmc/host/sdhci-pci-core.c nvme_driver drivers/nvme/host/pci.c ehci_pci_driver drivers/usb/host/ehci-pci.c hvfb_pci_stub_driver drivers/video/fbdev/hyperv_fb.c All other driver maintainers may test asynchronous probing by specifying the command line parameter "driver_async_probe=drv_name1,drv_name2,...", and on success setting "probe_type = PROBE_PREFER_ASYNCHRONOUS" in the pci_driver struct. Signed-off-by: Lukas Wunner [bhelgaas: updated commit log per https://lore.kernel.org/r/aHYUh7WoDlhHckxd@wunner.de] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/53abe6f5ac7c631f95f5d061aa748b192eda0379.1751614426.git.lukas@wunner.de commit 5dceb7dc745c755d61e01ae4d214a800025044fd Author: Qianfeng Rong Date: Tue Jul 15 20:16:48 2025 +0800 wifi: ath5k: Use max() to improve code Use max() to reduce the code and improve its readability. Reviewed-by: Jiri Slaby Signed-off-by: Qianfeng Rong Link: https://patch.msgid.link/20250715121721.266713-3-rongqianfeng@vivo.com Signed-off-by: Jeff Johnson commit 8ac2a383d4ce9e6229494c2a36df876800e6750e Author: Baochen Qiang Date: Tue Jul 15 10:07:35 2025 +0800 wifi: ath12k: remove unneeded semicolon in ath12k_mac_parse_tx_pwr_env() Kernel bot warns about this unneeded semicolon: drivers/net/wireless/ath/ath12k/mac.c:9785:2-3: Unneeded semicolon Remove it. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507132355.ljWuxxjd-lkp@intel.com/ Signed-off-by: Baochen Qiang Link: https://patch.msgid.link/20250715-ath12k-unneed-semicolon-v1-1-9972fd4cef07@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 136aad17e14250c815dcfc2e3cf9926e763b7436 Author: Sriram R Date: Mon Jul 14 16:44:38 2025 +0530 wifi: ath12k: Validate peer_id before searching for peer In RX WBM error path, error packet is received with invalid peer_id (0x3FFF) as there is no peer associated with that packet. However, this invalid peer_id coincides with the ML peer_id valid bit mask, causing an unnecessary search in the ML peer list. Prevent searching the peer list for invalid peer_id and return NULL. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sriram R Signed-off-by: Nagarajan Maran Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250714111438.1134438-1-nagarajan.maran@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 66b3ebc77d23d6574a965bdbfe41de8aeb7f384e Author: Aaradhana Sahu Date: Fri Jul 11 09:24:20 2025 +0530 wifi: ath12k: Use HTT_TCL_METADATA_VER_V1 in FTM mode Currently host sends HTT_TCL_METADATA_VER_V2 to the firmware regardless of the operating mode (Mission or FTM). Firmware expects additional software information (like peer ID, vdev ID, and link ID) in Tx packets when HTT_TCL_METADATA_VER_V2 is set. However, in FTM (Factory Test Mode) mode, no vdev is created on the host side (this is expected). As a result, the firmware fails to find the expected vdev during packet processing and ends up dropping packets. To fix this, send HTT_TCL_METADATA_VER_V1 in FTM mode because FTM mode doesn't support HTT_TCL_METADATA_VER_V2. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Fixes: 5d964966bd3f ("wifi: ath12k: Update HTT_TCL_METADATA version and bit mask definitions") Signed-off-by: Aaradhana Sahu Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250711035420.1509029-1-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit d96d9ac8d2f197f31ea3de931dde1a217950f4ad Author: Mikhail Kalashnikov Date: Fri Jul 11 11:57:29 2025 +0800 arm64: dts: allwinner: a523: enable Mali GPU for all boards All devices based on the A523/A527/H728/T527 processors contain a G57 MC1 GPU. Enable the DT nodes for this GPU and specify a regulator that supplies power to the SoC's VDD_GPU pins. The other parameters are set in the SoC dtsi, so are board independent. Signed-off-by: Mikhail Kalashnikov Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250711035730.17507-4-iuncuim@gmail.com Signed-off-by: Chen-Yu Tsai commit 3d99e0dc888727a21b45ca64ff7b0cddbd17dd16 Author: Mikhail Kalashnikov Date: Fri Jul 11 11:57:28 2025 +0800 arm64: dts: allwinner: a523: add Mali GPU node The Allwinner A523 SoC features the Mali-G57 MC1 GPU, which belongs to the Mali Valhall (v9) family. There is a power domain specifically for this GPU that needs to be enabled to utilize it. To enable in a specific device, we need to enable the gpu node and specify the “mali-supply” regulator additionally in the device tree. Signed-off-by: Mikhail Kalashnikov Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250711035730.17507-3-iuncuim@gmail.com Signed-off-by: Chen-Yu Tsai commit 3b430dce33a8b48ddcae4e26991b2516e0431e84 Author: Chen-Yu Tsai Date: Sat Jul 12 15:40:21 2025 +0800 arm64: dts: allwinner: a523: Add power controller device nodes The A523 SoC family has two power controllers, one based on the existing PPU, and one newer one based on ARM's PCK-600. Add device nodes for both of them. Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250712074021.805953-6-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit ca5ad734d30f30a577f705926d6e16a87513a2a7 Merge: 082c6a2d06c083 f99d4fccd21851 Author: Chen-Yu Tsai Date: Tue Jul 15 23:34:10 2025 +0800 Merge branch 'dt' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm into sunxi/dt-for-6.17 Signed-off-by: Chen-Yu Tsai commit 12f33ef6c2aaa410b7ccf039289fe2b04ab2252f Author: Alan Stern Date: Sun Jul 13 11:36:12 2025 -0400 HID: core: Improve the kerneldoc for hid_report_len() The kerneldoc for hid_report_len() needs to be improved. The description of the @report argument is ungrammatical, and the documentation does not explain under what circumstances the report length will include the byte reserved for the report ID. Let's fix up the kerneldoc. Signed-off-by: Alan Stern Link: https://patch.msgid.link/1c8416cb-7347-4a06-b00a-20518069d263@rowland.harvard.edu Signed-off-by: Benjamin Tissoires commit f261196d4bf1d413383eb1667e6eb199ff9af875 Author: Takashi Iwai Date: Tue Jul 15 09:51:22 2025 +0200 mips: loongson3_defconfig: Update HD-audio configs Since the reorganization of HD-audio drivers, Realtek driver has been split. Update to the new Kconfigs to catch up. Fixes: aeeb85f26c3b ("ALSA: hda: Split Realtek HD-audio codec driver") Link: https://patch.msgid.link/20250715075237.28476-3-tiwai@suse.de Signed-off-by: Takashi Iwai commit 859d97606f032d10d4633e17541f07f1f355e282 Author: Takashi Iwai Date: Tue Jul 15 09:51:21 2025 +0200 arm: multi_v7_defconfig: Update HD-audio configs Since the reorganization of HD-audio drivers, Realtek and HDMI codec drivers have been split. Update to the new Kconfigs to catch up. Fixes: aeeb85f26c3b ("ALSA: hda: Split Realtek HD-audio codec driver") Fixes: 73cd0490819d ("ALSA: hda/hdmi: Split vendor codec drivers") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/20250715170422.5162c666@canb.auug.org.au Link: https://patch.msgid.link/20250715075237.28476-2-tiwai@suse.de Signed-off-by: Takashi Iwai commit 12b3d697c812aaf356e82d9e1f351fbb2ea97500 Author: Robert Richter Date: Fri Jul 11 17:15:27 2025 +0200 cxl: Remove core/acpi.c and cxl core dependency on ACPI From Dave [1]: """ It was a mistake to introduce core/acpi.c and putting ACPI dependency on cxl_core when adding the extended linear cache support. """ Current implementation calls hmat_get_extended_linear_cache_size() of the ACPI subsystem. That external reference causes issue running cxl_test as there is no way to "mock" that function and ignore it when using cxl test. Instead of working around that using cxlrd ops and extensively expanding cxl_test code [1], just move HMAT calls out of the core module to cxl_acpi. Implement this by adding a @cache_size member to struct cxl_root_decoder. During initialization the cache size is determined and added to the root decoder object in cxl_acpi. Later on in cxl_core the cache_size parameter is used to setup extended linear caching. [1] https://patch.msgid.link/20250610172938.139428-1-dave.jiang@intel.com [ dj: Remove core/acpi.o from tools/testing/cxl/Kbuild ] [ dj: Add kdoc for cxlrd->cache_size ] Cc: Dave Jiang Signed-off-by: Robert Richter Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20250711151529.787470-1-rrichter@amd.com Signed-off-by: Dave Jiang commit 2aa8ccab5ae67281e4d3660f8d9ee68d8b76fcef Author: Hugo Villeneuve Date: Mon Jul 14 09:37:30 2025 -0400 gpio: pca953x: use regmap_update_bits() to improve performance Using regmap_update_bits() allows to reduce the number of I2C transfers when updating bits that haven't changed on non-volatile registers. For example on a PCAL6416, when changing a GPIO direction from input to output, the number of I2C transfers can be reduced from 4 to just 1 if the pull resistors configuration hasn't changed and the output value is the same as before. Signed-off-by: Hugo Villeneuve Link: https://lore.kernel.org/r/20250714133730.6353-1-hugo@hugovil.com Signed-off-by: Bartosz Golaszewski commit 4ad9e44c76b301e786eb4cdab890eac8c7eebd42 Author: Luca Weiss Date: Sun Jul 13 10:05:32 2025 +0200 dt-bindings: mmc: sdhci-msm: document the Milos SDHCI Controller Document the SDHCI Controller on the Milos SoC. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250713-sm7635-fp6-initial-v2-10-e8f9a789505b@fairphone.com Signed-off-by: Ulf Hansson commit fcddcb7e8f38a40db99f87a962c5d0a153a76566 Author: Guillaume La Roque Date: Tue Jul 15 10:50:08 2025 +0200 pmdomain: ti: Select PM_GENERIC_DOMAINS Select PM_GENERIC_DOMAINS instead of depending on it to ensure it is always enabled when TI_SCI_PM_DOMAINS is selected. Since PM_GENERIC_DOMAINS is an implicit symbol, it can only be enabled through 'select' and cannot be explicitly enabled in configuration. This simplifies the dependency chain and prevents build issues Signed-off-by: Guillaume La Roque Reviewed-by: Nishanth Menon Link: https://lore.kernel.org/r/20250715-depspmdomain-v2-1-6f0eda3ce824@baylibre.com Signed-off-by: Ulf Hansson commit d9f334fca5448907cc47ba8553926f9ba148512f Author: Daniel Almeida Date: Mon Jul 14 15:52:05 2025 -0300 MAINTAINERS: add regulator.rs to the regulator API entry Add this file to the regulator API entry as requested by Mark Brown. Signed-off-by: Daniel Almeida Acked-by: Miguel Ojeda Link: https://patch.msgid.link/20250714-topics-tyr-regulator2-v8-2-c7ab3955d524@collabora.com Signed-off-by: Mark Brown commit 9b614ceada7cb846de1a1c3bb0b29b0a2726ef45 Author: Daniel Almeida Date: Mon Jul 14 15:52:04 2025 -0300 rust: regulator: add a bare minimum regulator abstraction Add a bare minimum regulator abstraction to be used by Rust drivers. This abstraction adds a small subset of the regulator API, which is thought to be sufficient for the drivers we have now. Regulators provide the power needed by many hardware blocks and thus are likely to be needed by a lot of drivers. It was tested on rk3588, where it was used to power up the "mali" regulator in order to power up the GPU. Reviewed-by: Alexandre Courbot Signed-off-by: Daniel Almeida Reviewed-by: Alice Ryhl Link: https://patch.msgid.link/20250714-topics-tyr-regulator2-v8-1-c7ab3955d524@collabora.com Signed-off-by: Mark Brown commit 73254f49164f12ca6e0a849883953b91c4e168eb Author: Chen-Yu Tsai Date: Sat Jul 12 15:40:20 2025 +0800 pmdomain: sunxi: sun20i-ppu: change to tristate and enable for ARCH_SUNXI There is no reason why the sun20i-ppu cannot be built as a module. So change it to tristate. Also enable it by default for ARCH_SUNXI since this driver is required for some peripherals to work, and update the help text to reflect this requirement. This aligns it with the new PCK-600 driver. Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250712074021.805953-5-wens@kernel.org Signed-off-by: Ulf Hansson commit 76e4310115ca66d28166cf94bb1edf37a750363a Author: Chen-Yu Tsai Date: Sat Jul 12 15:40:19 2025 +0800 pmdomain: sunxi: add driver for Allwinner A523's PCK-600 power controller Allwinner A523 family has a second power controller, named PCK-600 in the datasheets and BSP. It is likely based on ARM's PCK-600 hardware block, with some additional delay controls. The only documentation for this hardware is the BSP driver. The standard registers defined in ARM's Power Policy Unit Architecture Specification line up. Some extra delay controls are found in the reserved range of registers. Add a driver for this power controller. Delay control register values and power domain names are from the BSP driver. Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250712074021.805953-4-wens@kernel.org Signed-off-by: Ulf Hansson commit 982aaa683d20804c21c6b8b1ca295ae531c91df5 Author: Chen-Yu Tsai Date: Sat Jul 12 15:40:18 2025 +0800 pmdomain: sunxi: sun20i-ppu: add A523 support A523 has a PPU like the one in the Allwinner D1 SoC. Add a compatible entry and a list of power domain names for it. Reviewed-by: Andre Przywara Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250712074021.805953-3-wens@kernel.org Signed-off-by: Ulf Hansson commit e56828f4df139b49cb837198ef8f3d2f13db65cb Author: Ming Lei Date: Sun Jul 13 22:34:12 2025 +0800 selftests: ublk: add utils.h Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-18-ming.lei@redhat.com Signed-off-by: Jens Axboe commit c1dc9b0d9e48380c868acd338c8912ebb7d75f0a Author: Ming Lei Date: Sun Jul 13 22:34:11 2025 +0800 selftests: ublk: add helper ublk_handle_uring_cmd() for handle ublk command Add helper ublk_handle_uring_cmd() for handling ublk command, and make ublk_handle_cqe() more readable. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-17-ming.lei@redhat.com Signed-off-by: Jens Axboe commit a66f89017673881e85e65a460cfdec35da4f07f2 Author: Ming Lei Date: Sun Jul 13 22:34:10 2025 +0800 selftests: ublk: improve flags naming Improve all kinds of flags naming by adding its host structure suffix for making code more readable. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-16-ming.lei@redhat.com Signed-off-by: Jens Axboe commit c3a6d48f86da1df277ef4f95f147a7f7f5cd6f44 Author: Ming Lei Date: Sun Jul 13 22:34:09 2025 +0800 selftests: ublk: remove ublk queue self-defined flags Remove ublk queue self-defined flags, and use the uapi flags directly. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-15-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 92dda98424feebb5f9b9135e30219342b80791b3 Author: Ming Lei Date: Sun Jul 13 22:34:08 2025 +0800 selftests: ublk: pass 'ublk_thread *' to more common helpers Pass 'ublk_thread *' to more common helpers, then we can avoid to store this reference into 'struct ublk_io'. Prepare for supporting to handle IO via different task context. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-14-ming.lei@redhat.com Signed-off-by: Jens Axboe commit e0054835bf6850245e17417fdbe80e232737e537 Author: Ming Lei Date: Sun Jul 13 22:34:07 2025 +0800 selftests: ublk: pass 'ublk_thread *' to ->queue_io() and ->tgt_io_done() 'struct thread' is task local structure, and the related code will become more readable if we pass it via parameter. Meantime pass 'ublk_thread *' to ublk_io_alloc_sqes(), and this way is natural since we use per-thread io_uring for handling IO. More importantly it helps much for removing the current ubq_daemon or per-io-task limit. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-13-ming.lei@redhat.com Signed-off-by: Jens Axboe commit b36c73251aaec6c9941b5493637a9007d0a56616 Author: Ming Lei Date: Sun Jul 13 22:34:06 2025 +0800 selftests: ublk: remove `tag` parameter of ->tgt_io_done() The `tag` parameter can be figured out from cqe->user_data, and that is also the only way to get the info, so remove `tag` parameter, and let target code retrieve it from cqe->user_data. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-12-ming.lei@redhat.com Signed-off-by: Jens Axboe commit ef92541d99c1c1319e5254d5f5380959962abb87 Author: Ming Lei Date: Sun Jul 13 22:34:05 2025 +0800 ublk: pass 'const struct ublk_io *' to ublk_[un]map_io() Pass 'const struct ublk_io *' to ublk_[un]map_io() since just io->addr and io->res are read in the two helpers. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-11-ming.lei@redhat.com Signed-off-by: Jens Axboe commit b749965edda8fcf0fd3e188c56845e991eaa63c9 Author: Ming Lei Date: Sun Jul 13 22:34:04 2025 +0800 ublk: remove ublk_commit_and_fetch() Remove ublk_commit_and_fetch() and open code request completion. Consolidate accesses to struct ublk_io in UBLK_IO_COMMIT_AND_FETCH_REQ. When the ublk_io daemon task restriction is relaxed in the future, ublk_io will need to be protected by a lock. Unregister the auto-registered buffer and complete the request last, as these don't need to happen under the lock. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-10-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 3446583f81fc3b98dddaac15b37d9c4ff2b569af Author: Ming Lei Date: Sun Jul 13 22:34:03 2025 +0800 ublk: add helper ublk_check_fetch_buf() Add a helper ublk_check_fetch_buf() to validate UBLK_IO_FETCH_REQ's addr. This doesn't require access to the ublk_io, so it can be done before taking the ublk_device mutex. This way also fixes one missing return value of -EINVAL in case of early failure from ublk_fetch(). Fixes: b69b8edfb27d ("ublk: properly serialize all FETCH_REQs") Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-9-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 21bb9facb1e78c50cf8bd5a51571fb8cbec3fb9d Author: Ming Lei Date: Sun Jul 13 22:34:02 2025 +0800 ublk: store auto buffer register data into `struct ublk_io` We can share space of `io->addr` for storing auto buffer register data and user space buffer address. So store auto buffer register data into `struct ublk_io`. Prepare for supporting batch IO in which many ublk IOs share single uring_cmd, so we can't store auto buffer register data into uring_cmd pdu. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-8-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 52460dda3a775a73f226312b43c0a0211e8665ea Author: Ming Lei Date: Sun Jul 13 22:34:01 2025 +0800 ublk: move auto buffer register handling into one dedicated helper Move check & clearing UBLK_IO_FLAG_AUTO_BUF_REG to ublk_handle_auto_buf_reg(), also return buffer index from this helper. Also move ublk_set_auto_buf_reg() to this single helper too. Add ublk_config_io_buf() for setting up ublk io buffer, covers both ublk buffer copy or auto buffer register. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-7-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 7ebdba87cf2a248aad10aff6b5fb1ca7c6b0add7 Author: Ming Lei Date: Sun Jul 13 22:34:00 2025 +0800 ublk: avoid to pass `struct ublksrv_io_cmd *` to ublk_commit_and_fetch() Refactor ublk_commit_and_fetch() in the following way for removing parameter of `struct ublksrv_io_cmd *`: - return `struct request *` from ublk_fill_io_cmd(), so that we can use request reference reliably in this way cause both request and io_uring_cmd reference share same storage - move ublk_fill_io_cmd() before calling into ublk_commit_and_fetch(), so that ublk_fill_io_cmd() could be run with per-io lock held for supporting command batch. - pass ->zone_append_lba to ublk_commit_and_fetch() directly The main motivation is to reproduce ublk_commit_and_fetch() for fetching io command batch with multishot uring_cmd. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-6-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 07bc706431799e7cf5209e8afdd8071d400266e7 Author: Ming Lei Date: Sun Jul 13 22:33:59 2025 +0800 ublk: let ublk_fill_io_cmd() cover more things Let ublk_fill_io_cmd() clear UBLK_IO_FLAG_OWNED_BY_SRV too. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-5-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 7074feeca41d09713d70e619a34d9e7b4e219f8c Author: Ming Lei Date: Sun Jul 13 22:33:58 2025 +0800 ublk: move fake timeout logic into __ublk_complete_rq() Almost every block driver deals with fake timeout logic around real request completion code. Also the existing way may cause request reference count leak, so move the logic into __ublk_complete_rq(), then we can skip the completion in the last step like other drivers. Reviewed-by: Caleb Sander Mateos Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-4-ming.lei@redhat.com Signed-off-by: Jens Axboe commit dd7a8507319e22141fa2e107d81cba18a4007d92 Author: Ming Lei Date: Sun Jul 13 22:33:57 2025 +0800 ublk: look up ublk task via its pid in timeout handler Look up ublk process via its pid in timeout handler, so we can avoid to touch io->task, because it is fragile to touch task structure. It is fine to kill ublk server process and this way is simpler. Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-3-ming.lei@redhat.com Signed-off-by: Jens Axboe commit c2c8089f325ed703fd5123b39e2dece1dd605904 Author: Ming Lei Date: Sun Jul 13 22:33:56 2025 +0800 ublk: validate ublk server pid ublk server pid(the `tgid` of the process opening the ublk device) is stored in `ublk_device->ublksrv_tgid`. This `tgid` is then checked against the `ublksrv_pid` in `ublk_ctrl_start_dev` and `ublk_ctrl_end_recovery`. This ensures that correct ublk server pid is stored in device info. Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Signed-off-by: Ming Lei Link: https://lore.kernel.org/r/20250713143415.2857561-2-ming.lei@redhat.com Signed-off-by: Jens Axboe commit 353f4ce91660e0eb067e3f8858dbaba076364cc7 Merge: d87547e08b097a f99d4fccd21851 Author: Ulf Hansson Date: Tue Jul 15 16:03:54 2025 +0200 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the DT bindings to be tested together with changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit 2e92ac61c9012ae4bcde2838c5f57f85e4b2623c Author: Johannes Thumshirn Date: Tue Jul 15 13:53:24 2025 +0200 block: add trace messages to zone write plugging Add tracepoints to zone write plugging plug and unplug events. Examples for these events are: kworker/u10:4-393 [001] d..1. 282.991660: disk_zone_wplug_add_bio: 8,0 zone 16, BIO 8388608 + 128 kworker/0:1H-58 [ [000] d..1. 283.083294: blk_zone_wplug_bio: 8,0 zone 15, BIO 7864320 + 128 Reviewed-by: Chaitanya Kulkarni Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20250715115324.53308-6-johannes.thumshirn@wdc.com Signed-off-by: Jens Axboe commit 4020d22f0d08ccfc0d00a254a90250ff07333607 Author: Johannes Thumshirn Date: Tue Jul 15 13:53:23 2025 +0200 block: add tracepoint for blkdev_zone_mgmt Add a tracepoint for blkdev_zone_mgmt to trace zone management commands submitted by higher layers like file systems or user space. An example output for this tracepoint is as follows: mkfs.btrfs-203 [001] ..... 42.877493: blkdev_zone_mgmt: 8,0 ZRS 5242880 + 0 This example output shows a REQ_OP_ZONE_RESET operation submitted by mkfs.btrfs. Reviewed-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Bart Van Assche Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20250715115324.53308-5-johannes.thumshirn@wdc.com Signed-off-by: Jens Axboe commit 4cc21a00762b5bd4dcd743317a56c2dba500fd89 Author: Johannes Thumshirn Date: Tue Jul 15 13:53:22 2025 +0200 block: add tracepoint for blk_zone_update_request_bio Add a tracepoint in blk_zone_update_request_bio() to trace the bio sector update on ZONE APPEND completions. An example for this tracepoint is as follows: -0 [001] d.h1. 381.746444: blk_zone_update_request_bio: 259,5 ZAS 131072 () 1048832 + 256 none,0,0 [swapper/1] Reviewed-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Bart Van Assche Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20250715115324.53308-4-johannes.thumshirn@wdc.com Signed-off-by: Jens Axboe commit 5022dae76234b3fcd219e03e091fd0b829690af6 Author: Johannes Thumshirn Date: Tue Jul 15 13:53:21 2025 +0200 block: split blk_zone_update_request_bio into two functions blk_zone_update_request_bio() does two things. First it checks if the request to be completed was written via ZONE APPEND and if yes it then updates the sector to the one that the data was written to. This is small enough to be an inline function. But upcoming changes adding a tracepoint don't work if the function is inlined. Split the function into two, the first is blk_req_bio_is_zone_append() checking if the sector needs to be updated. This can still be an inline function. The second is blk_zone_append_update_request_bio() doing the sector update. Reviewed-by: Damien Le Moal Reviewed-by: Christoph Hellwig Reviewed-by: Chaitanya Kulkarni Reviewed-by: Bart Van Assche Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20250715115324.53308-3-johannes.thumshirn@wdc.com Signed-off-by: Jens Axboe commit bd116214d53c66dc7f863822af171b20c06b4784 Author: Johannes Thumshirn Date: Tue Jul 15 13:53:20 2025 +0200 blktrace: add zoned block commands to blk_fill_rwbs Add zoned block commands to blk_fill_rwbs: - ZONE APPEND will be decoded as 'ZA' - ZONE RESET will be decoded as 'ZR' - ZONE RESET ALL will be decoded as 'ZRA' - ZONE FINISH will be decoded as 'ZF' - ZONE OPEN will be decoded as 'ZO' - ZONE CLOSE will be decoded as 'ZC' Reviewed-by: Chaitanya Kulkarni Signed-off-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20250715115324.53308-2-johannes.thumshirn@wdc.com Signed-off-by: Jens Axboe commit f99d4fccd2185176baf4ecac9a49d280fc62b953 Author: Chen-Yu Tsai Date: Sat Jul 12 15:40:17 2025 +0800 dt-bindings: power: Add A523 PPU and PCK600 power controllers The A523 PPU is likely the same kind of hardware seen on previous SoCs. The A523 PCK600, as the name suggests, is likely a customized version of ARM's PCK-600 power controller. Comparing the BSP driver against ARM's PPU datasheet shows that the basic registers line up, but Allwinner's hardware has some additional delay controls in the reserved register range. As such it is likely not fully compatible with the standard ARM version. Document A523 PPU and PCK600 compatibles. Also reorder the compatible string entries so they are grouped and ordered by family first, then by SoC model. Reviewed-by: Andre Przywara Reviewed-by: Rob Herring (Arm) Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250712074021.805953-2-wens@kernel.org Signed-off-by: Ulf Hansson commit cc43eea3e1ef99ea4a5057e7b6bfcd9ed8e2a1d0 Merge: 2427d69c3dba3f 683d532dfc9657 Author: Linus Walleij Date: Tue Jul 15 15:59:48 2025 +0200 Merge tag 'samsung-pinctrl-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/samsung into devel Samsung pinctrl drivers changes for v6.17 Add support for programming wake up for Google GS101 SoC pin controllers, so the SoC can be properly woken up from low power states. Signed-off-by: Linus Walleij commit 75fdf823f94b18fa29ecbad9f39ecf8c57e8b8c6 Author: Mark Brown Date: Mon Jul 14 12:21:27 2025 +0100 arm64/gcs: Don't call gcs_free() when releasing task_struct Currently we call gcs_free() when releasing task_struct but this is redundant, it attempts to deallocate any kernel managed userspace GCS which should no longer be relevant and resets values in the struct we're in the process of freeing. By the time arch_release_task_struct() is called the mm will have been disassociated from the task so the check for a mm in gcs_free() will always be false, for threads that are exiting leaving the mm active deactivate_mm() will have been called previously and freed any kernel managed GCS. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250714-arm64-gcs-release-task-v2-1-8a83cadfc846@kernel.org Signed-off-by: Will Deacon commit 7ee2c3c0dac3727b4e424c8e93de7d5d9d00bcac Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:48 2025 +0200 thermal: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) Cc: Amit Kucheria Cc: Thara Gopinath Cc: Rafael J. Wysocki Cc: Daniel Lezcano Cc: Zhang Rui Cc: Lukasz Luba Cc: Thierry Reding Cc: Jonathan Hunter Cc: linux-arm-msm@vger.kernel.org Cc: linux-tegra@vger.kernel.org Link: https://lore.kernel.org/r/20250611104348.192092-20-jirislaby@kernel.org Signed-off-by: Daniel Lezcano commit 992e2ed0abf25d9567c61af9f3c552d6d9024e04 Author: Christophe JAILLET Date: Sun May 25 11:40:04 2025 +0200 thermal: Constify struct thermal_zone_device_ops 'struct thermal_zone_device_ops' are not modified in these drivers. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 28116 5168 128 33412 8284 drivers/thermal/armada_thermal.o After: ===== text data bss dec hex filename 28244 5040 128 33412 8284 drivers/thermal/armada_thermal.o Signed-off-by: Christophe JAILLET Reviewed-by: Frank Li Reviewed-by: Miquel Raynal # For Armada Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/5bba3bf0139e2418b306a0f9a2f1f81ef49e88a6.1748165978.git.christophe.jaillet@wanadoo.fr Signed-off-by: Daniel Lezcano commit eb514766e0e0d2064c8700a79441e43e85008381 Author: Christophe JAILLET Date: Sun May 25 14:32:30 2025 +0200 thermal/drivers/loongson2: Constify struct thermal_zone_device_ops 'struct thermal_zone_device_ops' could be left unmodified in this driver. Constifying this structure moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. This partly reverts commit 734b5def91b5 ("thermal/drivers/loongson2: Add Loongson-2K2000 support") which removed the const qualifier. Instead, define two different structures. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 5089 1160 0 6249 1869 drivers/thermal/loongson2_thermal.o After: ===== text data bss dec hex filename 5464 1128 0 6592 19c0 drivers/thermal/loongson2_thermal.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/5f5f815f85a9450bca7848c6d47a1fee840f47e5.1748176328.git.christophe.jaillet@wanadoo.fr Signed-off-by: Daniel Lezcano commit 51888393cc64dd0462d0b96c13ab94873abbc030 Author: Rafael J. Wysocki Date: Wed Jul 9 12:41:45 2025 +0200 PM: runtime: Take active children into account in pm_runtime_get_if_in_use() For all practical purposes, there is no difference between the situation in which a given device is not ignoring children and its active child count is nonzero and the situation in which its runtime PM usage counter is nonzero. However, pm_runtime_get_if_in_use() will only increment the device's usage counter and return 1 in the latter case. For consistency, make it do so in the former case either by adjusting pm_runtime_get_conditional() and update the related kerneldoc comments accordingly. Fixes: c111566bea7c ("PM: runtime: Add pm_runtime_get_if_active()") Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Reviewed-by: Sakari Ailus Cc: 5.10+ # 5.10+: c0ef3df8dbae: PM: runtime: Simplify pm_runtime_get_if_active() usage Cc: 5.10+ # 5.10+ Link: https://patch.msgid.link/12700973.O9o76ZdvQC@rjwysocki.net commit 47e6715bb7ea388a9a3a13d31918827ba3aa3f4a Author: Danilo Krummrich Date: Sun Jul 13 20:26:54 2025 +0200 rust: device: implement Device::as_bound() Provide an unsafe functions for abstractions to convert a regular &Device to a &Device. This is useful for registrations that provide certain guarantees for the scope of their callbacks, such as IRQs or certain class device registrations (e.g. PWM, miscdevice). Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250713182737.64448-2-dakr@kernel.org [ Remove unnecessary cast(). - Danilo ] Signed-off-by: Danilo Krummrich commit 2096d42d82dc983d9db861bd6585723bd24a0819 Author: Rafael J. Wysocki Date: Thu Jul 10 15:12:20 2025 +0200 kexec_core: Drop redundant pm_restore_gfp_mask() call Drop the direct pm_restore_gfp_mask() call from the KEXEC_JUMP flow in kernel_kexec() because it is redundant. Namely, dpm_resume_end() called beforehand in the same code path invokes that function and it is sufficient to invoke it once. Signed-off-by: Rafael J. Wysocki Acked-by: Baoquan He Reviewed-by: Mario Limonciello Link: https://patch.msgid.link/1949230.tdWV9SEqCh@rjwysocki.net [ rjw: Rebase after fixing up previous changes ] Signed-off-by: Rafael J. Wysocki commit 996afb6efd1a345736f9a888e4d6c7d4f3752aa5 Author: Rafael J. Wysocki Date: Thu Jul 10 15:10:41 2025 +0200 kexec_core: Fix error code path in the KEXEC_JUMP flow If dpm_suspend_start() fails, dpm_resume_end() must be called to recover devices whose suspend callbacks have been called, but this does not happen in the KEXEC_JUMP flow's error path due to a confused goto target label. Address this by using the correct target label in the goto statement in question and drop the Resume_console label that is not used any more. Fixes: 2965faa5e03d ("kexec: split kexec_load syscall from kexec core code") Signed-off-by: Rafael J. Wysocki Acked-by: Baoquan He Reviewed-by: Mario Limonciello Link: https://patch.msgid.link/2396879.ElGaqSPkdT@rjwysocki.net [ rjw: Drop unused label and amend the changelog ] Signed-off-by: Rafael J. Wysocki commit 80b1516e07c53f0b4df2f53d53f8fac4052d6ac2 Author: Rafael J. Wysocki Date: Wed Jul 9 19:31:07 2025 +0200 PM: sleep: Clean up MAINTAINERS entries for suspend and hibernation Since Pavel Machek and Len Brown do not actually maintain the system suspend and hibernation code, change their records in the relevant MAINTAINERS entries to reviewers. While at it, use Len Brown's kernel.org address in the suspend-to-RAM MAINTAINERS record. Signed-off-by: Rafael J. Wysocki Link: https://patch.msgid.link/2798682.mvXUDI8C0e@rjwysocki.net Link: https://lore.kernel.org/linux-pm/20250313091403.50077-1-krzysztof.kozlowski@linaro.org/ [ rjw: Add a Link tag relevant to this change, edit changelog ] Signed-off-by: Rafael J. Wysocki commit 85aa5b16fef7040213581df9ff093dae27bf8675 Author: Danilo Krummrich Date: Sun Jul 13 20:26:53 2025 +0200 rust: devres: provide an accessor for the device Provide an accessor for the Device a Devres instance has been created with. For instance, this is useful when registrations want to provide a &Device for a scope that is protected by Devres. Suggested-by: Benno Lossin Acked-by: Greg Kroah-Hartman Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250713182737.64448-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 91ae26b06aab476bdd8b56cd99e127f029490330 Author: Danilo Krummrich Date: Mon Jul 14 13:32:35 2025 +0200 rust: devres: initialize Devres::inner::data last Users may want to access the Devres object from callbacks registered through the initialization of Devres::inner::data. For those accesses to be valid, Devres::inner::data must be initialized last [1]. Credit to Boqun for spotting this [2]. Link: https://lore.kernel.org/lkml/DBBPHO26CPBS.2OVI1OERCB2J5@kernel.org/ [1] Link: https://lore.kernel.org/lkml/aHSmxWeIy3L-AKIV@Mac.home/ [2] Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250714113712.22158-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit d5f317fd5cd9dfdf5bbe11384001817760c12b75 Author: Brian Masney Date: Thu Jul 10 11:51:12 2025 -0400 ASoC: stm: stm32_sai_sub: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://patch.msgid.link/20250710-sound-clk-round-rate-v1-6-4a9c3bb6ff3a@redhat.com Signed-off-by: Mark Brown commit afd529d740028a41fa750d4491b106cecbccba3e Author: Brian Masney Date: Thu Jul 10 11:51:11 2025 -0400 ASoC: stm: stm32_i2s: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://patch.msgid.link/20250710-sound-clk-round-rate-v1-5-4a9c3bb6ff3a@redhat.com Signed-off-by: Mark Brown commit fc62ed665eb2e8fb0f1e12ab9cdb578666704a76 Author: Brian Masney Date: Thu Jul 10 11:51:10 2025 -0400 ASoC: qcom: qdsp6: q6dsp-lpass-clocks: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Konrad Dybcio Link: https://patch.msgid.link/20250710-sound-clk-round-rate-v1-4-4a9c3bb6ff3a@redhat.com Signed-off-by: Mark Brown commit a37d9c8aef1c78876eff0bc8980a889c083de89d Author: Brian Masney Date: Thu Jul 10 11:51:09 2025 -0400 ASoC: codecs: rt5682s: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://patch.msgid.link/20250710-sound-clk-round-rate-v1-3-4a9c3bb6ff3a@redhat.com Signed-off-by: Mark Brown commit 4e15a10f6fb254e33d73a6da3c4d00e3e64d2eb8 Author: Brian Masney Date: Thu Jul 10 11:51:08 2025 -0400 ASoC: codecs: rt5682: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://patch.msgid.link/20250710-sound-clk-round-rate-v1-2-4a9c3bb6ff3a@redhat.com Signed-off-by: Mark Brown commit 8a4d73121d6bd9a70895e65d6d1014ed6b0a6c8e Author: Brian Masney Date: Thu Jul 10 11:51:07 2025 -0400 ASoC: codecs: da7219: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Link: https://patch.msgid.link/20250710-sound-clk-round-rate-v1-1-4a9c3bb6ff3a@redhat.com Signed-off-by: Mark Brown commit 6f8584a4826f01a55d3d0c4bbad5961f1de52fc9 Author: Raphael Gallais-Pou Date: Mon Jun 9 23:21:09 2025 +0200 spi: st: Switch from CONFIG_PM_SLEEP guards to pm_sleep_ptr() Letting the compiler remove these functions when the kernel is built without CONFIG_PM_SLEEP support is simpler and less error prone than the use of #ifdef based kernel configuration guards. Signed-off-by: Raphael Gallais-Pou Link: https://patch.msgid.link/20250609-update_pm_macro-v1-1-819a53ef0eed@gmail.com Signed-off-by: Mark Brown commit 5de0fb6a5a86bc2b020001005403a7d933d3c773 Author: Ana Oliveira Date: Tue Jul 15 08:25:13 2025 -0300 staging: rtl8723bs: os_dep: remove blank line before close brace '}' Fix checkpatch error "CHECK: Blank lines aren't necessary before a close brace '}'" in sdio_ops_linux.c:309. Signed-off-by: Ana Oliveira Link: https://lore.kernel.org/r/20250715112513.4541-1-anac.amplar@gmail.com Signed-off-by: Greg Kroah-Hartman commit a622663dbf874ae5ae2326a9878ceb410c8a34a4 Author: Andy Yan Date: Tue Jul 15 13:47:52 2025 +0800 drm/bridge: megachips-stdpxxxx-ge-b850v3-fw: Fix a compile error due to bridge->detect parameter changes Fix the compile error due to bridge->detect parameter changes. Reported-by: Dixit Ashutosh Closes: https://lore.kernel.org/dri-devel/175250667117.3567548.8371527247937906463.b4-ty@oss.qualcomm.com/T/#m8ecd00a05a330bc9c76f11c981daafcb30a7c2e0 Fixes: 5d156a9c3d5e ("drm/bridge: Pass down connector to drm bridge detect hook") Signed-off-by: Andy Yan Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250715054754.800765-1-andyshrk@163.com Signed-off-by: Dmitry Baryshkov commit d9c37a4904ec21ef7d45880fe023c11341869c28 Author: Qu Wenruo Date: Mon Jul 14 14:55:57 2025 +0930 fs: add a new remove_bdev() callback Currently all filesystems which implement super_operations::shutdown() can not afford losing a device. Thus fs_bdev_mark_dead() will just call the ->shutdown() callback for the involved filesystem. But it will no longer be the case, as multi-device filesystems like btrfs and bcachefs can handle certain device loss without the need to shutdown the whole filesystem. To allow those multi-device filesystems to be integrated to use fs_holder_ops: - Add a new super_operations::remove_bdev() callback - Try ->remove_bdev() callback first inside fs_bdev_mark_dead() If the callback returned 0, meaning the fs can handling the device loss, then exit without doing anything else. If there is no such callback or the callback returned non-zero value, continue to shutdown the filesystem as usual. This means the new remove_bdev() should only do the check on whether the operation can continue, and if so do the fs specific handlings. The shutdown handling should still be handled by the existing ->shutdown() callback. For all existing filesystems with shutdown callback, there is no change to the code nor behavior. Btrfs is going to implement both the ->remove_bdev() and ->shutdown() callbacks soon. Signed-off-by: Qu Wenruo Link: https://lore.kernel.org/09909fcff7f2763cc037fec97ac2482bdc0a12cb.1752470276.git.wqu@suse.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 4be430b2659b6d25df1cae46ed5b86bed72755f7 Merge: 21e9b7d11218e7 5323af351e7524 Author: Marc Kleine-Budde Date: Tue Jul 15 13:32:08 2025 +0200 Merge patch series "can: Kconfig: add missing COMPILE_TEST" Vincent Mailhol says: The ti_hecc and tscan1 CAN drivers can not be built on an x86_64 platform. Add the COMPILE_TEST dependency to allow build testing. Doing that, a so far unnoticed W=0 warning showed up in ti_hecc. Fix this warning. To prevent any potential noise in some future git bisect, the warning is fixed before introducing COMPILE_TEST. Note that the mscan and mpc5xxx drivers have the same issue but those two use some helper functions, such as in_8() and out_8(), which are only available on the powerpc platform. Those two drivers would require some deeper code refactor to be built on x86_64 and are thus left out of scope. Link: https://patch.msgid.link/20250715-can-compile-test-v2-0-f7fd566db86f@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 5323af351e7524497930b7793153ff68ee5c0ec1 Author: Vincent Mailhol Date: Tue Jul 15 20:28:13 2025 +0900 can: tscan1: Kconfig: add COMPILE_TEST tscan1 depends on ISA. It also has a hidden dependency on HAS_IOPORT as reported by the kernel test bot [1]. That dependency is implied by ISA which explains why this was not an issue so far. Add both COMPILE_TEST and HAS_IOPORT to the dependency list so that this driver can also be built on other platforms. [1] https://lore.kernel.org/linux-can/202507141417.qAMrchyV-lkp@intel.com/ Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250715-can-compile-test-v2-3-f7fd566db86f@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 0e7896b95f2bd7deb0e66074f6acc1de4f69da1e Author: Vincent Mailhol Date: Tue Jul 15 20:28:12 2025 +0900 can: ti_hecc: Kconfig: add COMPILE_TEST ti_hecc depends on ARM. Add COMPILE_TEST to the dependency list so that this driver can also be built on other platforms. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250715-can-compile-test-v2-2-f7fd566db86f@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 7cae4d04717b002cffe41169da3f239c845a0723 Author: Vincent Mailhol Date: Tue Jul 15 20:28:11 2025 +0900 can: ti_hecc: fix -Woverflow compiler warning Fix below default (W=0) warning: drivers/net/can/ti_hecc.c: In function 'ti_hecc_start': drivers/net/can/ti_hecc.c:386:20: warning: conversion from 'long unsigned int' to 'u32' {aka 'unsigned int'} changes value from '18446744073709551599' to '4294967279' [-Woverflow] 386 | mbx_mask = ~BIT(HECC_RX_LAST_MBOX); | ^ Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20250715-can-compile-test-v2-1-f7fd566db86f@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 9fb32803dfba63697080db7969bc3aa1bf323dc3 Author: Maíra Canal Date: Mon Jul 14 19:07:09 2025 -0300 drm/panfrost: Use DRM_GPU_SCHED_STAT_NO_HANG to skip the reset Panfrost can skip the reset if TDR has fired before the free-job worker. Currently, since Panfrost doesn't take any action on these scenarios, the job is being leaked, considering that `free_job()` won't be called. To avoid such leaks, inform the scheduler that the job did not actually timeout and no reset was performed through the new status code DRM_GPU_SCHED_STAT_NO_HANG. Reviewed-by: Steven Price Link: https://lore.kernel.org/r/20250714-sched-skip-reset-v6-8-5c5ba4f55039@igalia.com Signed-off-by: Maíra Canal commit 53dcd0eaa271e870ca5d0b203be67b468214c1bc Author: Maíra Canal Date: Mon Jul 14 19:07:08 2025 -0300 drm/xe: Use DRM_GPU_SCHED_STAT_NO_HANG to skip the reset Xe can skip the reset if TDR has fired before the free job worker and can also re-arm the timeout timer in some scenarios. Instead of manipulating scheduler's internals, inform the scheduler that the job did not actually timeout and no reset was performed through the new status code DRM_GPU_SCHED_STAT_NO_HANG. Note that, in the first case, there is no need to restart submission if it hasn't been stopped. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250714-sched-skip-reset-v6-7-5c5ba4f55039@igalia.com Signed-off-by: Maíra Canal commit 8902c2b17a6ec723ab7924bc4113bef47603c0dc Author: Maíra Canal Date: Mon Jul 14 19:07:07 2025 -0300 drm/etnaviv: Use DRM_GPU_SCHED_STAT_NO_HANG to skip the reset Etnaviv can skip a hardware reset in two situations: 1. TDR has fired before the free-job worker and the timeout is spurious. 2. The GPU is still making progress on the front-end and we can give the job a chance to complete. Instead of manipulating scheduler's internals, inform the scheduler that the job did not actually timeout and no reset was performed through the new status code DRM_GPU_SCHED_STAT_NO_HANG. Reviewed-by: Lucas Stach Link: https://lore.kernel.org/r/20250714-sched-skip-reset-v6-6-5c5ba4f55039@igalia.com Signed-off-by: Maíra Canal commit 6b37fbacd087fbd517b6b276ca8bebd1dc052fb7 Author: Maíra Canal Date: Mon Jul 14 19:07:06 2025 -0300 drm/v3d: Use DRM_GPU_SCHED_STAT_NO_HANG to skip the reset When a CL/CSD job times out, we check if the GPU has made any progress since the last timeout. If so, instead of resetting the hardware, we skip the reset and allow the timer to be rearmed. This gives long-running jobs a chance to complete. Instead of manipulating scheduler's internals, inform the scheduler that the job did not actually timeout and no reset was performed through the new status code DRM_GPU_SCHED_STAT_NO_HANG. Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250714-sched-skip-reset-v6-5-5c5ba4f55039@igalia.com Signed-off-by: Maíra Canal commit 1472e7549f84c472a9ebb9a8bb0aaafe985ea608 Author: Maíra Canal Date: Mon Jul 14 19:07:05 2025 -0300 drm/sched: Add new test for DRM_GPU_SCHED_STAT_NO_HANG Add a test to submit a single job against a scheduler with the timeout configured and verify that if the job is still running, the timeout handler will skip the reset and allow the job to complete. Reviewed-by: Tvrtko Ursulin Reviewed-by: Philipp Stanner Link: https://lore.kernel.org/r/20250714-sched-skip-reset-v6-4-5c5ba4f55039@igalia.com Signed-off-by: Maíra Canal commit 9b9b5a3605b9a5ef1d412e47b2ae70090c8d3580 Author: Maíra Canal Date: Mon Jul 14 19:07:04 2025 -0300 drm/sched: Make timeout KUnit tests faster As more KUnit tests are introduced to evaluate the basic capabilities of the `timedout_job()` hook, the test suite will continue to increase in duration. To reduce the overall running time of the test suite, decrease the scheduler's timeout for the timeout tests. Before this commit: [15:42:26] Elapsed time: 15.637s total, 0.002s configuring, 10.387s building, 5.229s running After this commit: [15:45:26] Elapsed time: 9.263s total, 0.002s configuring, 5.168s building, 4.037s running Reviewed-by: Tvrtko Ursulin Acked-by: Philipp Stanner Link: https://lore.kernel.org/r/20250714-sched-skip-reset-v6-3-5c5ba4f55039@igalia.com Signed-off-by: Maíra Canal commit 0b1217bfdfddf664c15954d1d51ee18ed88a2ccf Author: Maíra Canal Date: Mon Jul 14 19:07:03 2025 -0300 drm/sched: Allow drivers to skip the reset and keep on running When the DRM scheduler times out, it's possible that the GPU isn't hung; instead, a job just took unusually long (longer than the timeout) but is still running, and there is, thus, no reason to reset the hardware. This can occur in two scenarios: 1. The job is taking longer than the timeout, but the driver determined through a GPU-specific mechanism that the hardware is still making progress. Hence, the driver would like the scheduler to skip the timeout and treat the job as still pending from then onward. This happens in v3d, Etnaviv, and Xe. 2. Timeout has fired before the free-job worker. Consequently, the scheduler calls `sched->ops->timedout_job()` for a job that isn't timed out. These two scenarios are problematic because the job was removed from the `sched->pending_list` before calling `sched->ops->timedout_job()`, which means that when the job finishes, it won't be freed by the scheduler though `sched->ops->free_job()` - leading to a memory leak. To solve these problems, create a new `drm_gpu_sched_stat`, called DRM_GPU_SCHED_STAT_NO_HANG, which allows a driver to skip the reset. The new status will indicate that the job must be reinserted into `sched->pending_list`, and the hardware / driver will still complete that job. Reviewed-by: Philipp Stanner Link: https://lore.kernel.org/r/20250714-sched-skip-reset-v6-2-5c5ba4f55039@igalia.com Signed-off-by: Maíra Canal commit 0a5dc1b67ef5c7e851b57764a2aab8cc4341a7b7 Author: Maíra Canal Date: Mon Jul 14 19:07:02 2025 -0300 drm/sched: Rename DRM_GPU_SCHED_STAT_NOMINAL to DRM_GPU_SCHED_STAT_RESET Among the scheduler's statuses, the only one that indicates an error is DRM_GPU_SCHED_STAT_ENODEV. Any status other than DRM_GPU_SCHED_STAT_ENODEV signifies that the operation succeeded and the GPU is in a nominal state. However, to provide more information about the GPU's status, it is needed to convey more information than just "OK". Therefore, rename DRM_GPU_SCHED_STAT_NOMINAL to DRM_GPU_SCHED_STAT_RESET, which better communicates the meaning of this status. The status DRM_GPU_SCHED_STAT_RESET indicates that the GPU has hung, but it has been successfully reset and is now in a nominal state again. Reviewed-by: Philipp Stanner Link: https://lore.kernel.org/r/20250714-sched-skip-reset-v6-1-5c5ba4f55039@igalia.com Signed-off-by: Maíra Canal commit 003322be55c650b30f0c836e1dc99d708d787a32 Merge: 9a44b5e36cd699 24bc49d158c784 Author: Johannes Berg Date: Tue Jul 15 13:20:51 2025 +0200 Merge tag 'iwlwifi-next-2025-07-15' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi features, notably - cleanup of unsupported APIs - add a API range per RF - transport layer cleanups - a few small fixes ==================== Signed-off-by: Johannes Berg commit 5c8f12cf1e64e0e8e6cb80b0c935389973e8be8d Author: Andrew Price Date: Mon Jul 14 16:21:15 2025 +0100 gfs2: Set .migrate_folio in gfs2_{rgrp,meta}_aops Clears up the warning added in 7ee3647243e5 ("migrate: Remove call to ->writepage") that occurs in various xfstests, causing "something found in dmesg" failures. [ 341.136573] gfs2_meta_aops does not implement migrate_folio [ 341.136953] WARNING: CPU: 1 PID: 36 at mm/migrate.c:944 move_to_new_folio+0x2f8/0x300 Signed-off-by: Andrew Price Signed-off-by: Andreas Gruenbacher commit d9c9115c6127636efbdc0fad8184bed1cd42fe3c Author: Diederik de Haas Date: Wed Jul 9 15:15:15 2025 +0200 arm64: dts: rockchip: Move dsi address+size-cells from SoC to rk3399 boards The #address-cells and #size-cells properties are not useful on the DSI controller node; they are only useful/required on ports and panel(s). So remove them from the controller node and add them where actually needed on the various rk3399 based boards. This fixes the following DTB validation warnings: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" property Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250709132323.128757-3-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit 98921ad2494a85aa7edde33a3a478b9ae3d621ef Author: Diederik de Haas Date: Wed Jul 9 15:15:14 2025 +0200 arm64: dts: rockchip: Move dsi address+size-cells from SoC to px30 boards The #address-cells and #size-cells properties are not useful on the DSI controller node; they are only useful/required on ports and panel(s). So remove them from the controller node and add them where actually needed on the various px30 based boards, which includes rk3326. This fixes the following DTB validation warnings: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" property Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250709132323.128757-2-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit a81648768178f6adf171d98db486b4b2613f645a Author: Michal Wajdeczko Date: Fri Jul 11 21:33:16 2025 +0200 drm/xe/pf: Invalidate LMTT after completing changes Once we finish populating all leaf pages in the VF's LMTT we should make sure that hardware will not access any stale data. Explicitly force LMTT invalidation (as it was already planned in the past). Signed-off-by: Michal Wajdeczko Cc: Michał Winiarski Cc: Piotr Piórkowski Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250711193316.1920-7-michal.wajdeczko@intel.com commit e497957fee3025ef72090b2ab29dd1070602bf6e Author: Michal Wajdeczko Date: Fri Jul 11 21:33:15 2025 +0200 drm/xe/pf: Invalidate LMTT during LMEM unprovisioning Invalidate LMTT immediately after removing VF's LMTT page tables and clearing root PTE in the LMTT PD to avoid any invalid access by the hardware (and VF) due to stale data. Signed-off-by: Michal Wajdeczko Cc: Michał Winiarski Cc: Piotr Piórkowski Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250711193316.1920-6-michal.wajdeczko@intel.com commit 68ae022278a1a756e1bd9bdd56ba8702eece4558 Author: Michal Wajdeczko Date: Fri Jul 11 21:33:14 2025 +0200 drm/xe/pf: Force GuC virtualization mode By default the GuC starts in the 'native' mode and enables the VGT mode (aka 'virtualization' mode) only after it receives at least one set of VF configuration data. While this happens naturally while PF begins VFs provisioning, we might need this sooner as some actions, like TLB_INVALIDATION_ALL(0x7002), is supported by the GuC only in the VGT mode. And this becomes a real problem if we would want to use above action to invalidate the LMTT early during VFs auto-provisioning, before VFs are enabled, as such H2G would be rejected: [ ] xe 0000:4d:00.0: [drm] *ERROR* GT0: FAST_REQ H2G fence 0x804e failed! e=0x30, h=0 [ ] xe 0000:4d:00.0: [drm] *ERROR* GT0: Fence 0x804e was used by action 0x7002 sent at: h2g_write+0x33e/0x870 [xe] __guc_ct_send_locked+0x1e1/0x1110 [xe] guc_ct_send_locked+0x9f/0x740 [xe] xe_guc_ct_send_locked+0x19/0x60 [xe] send_tlb_invalidation+0xc2/0x470 [xe] xe_gt_tlb_invalidation_all_async+0x45/0xa0 [xe] xe_gt_tlb_invalidation_all+0x4b/0xa0 [xe] lmtt_invalidate_hw+0x64/0x1a0 [xe] xe_lmtt_invalidate_hw+0x5c/0x340 [xe] pf_update_vf_lmtt+0x398/0xae0 [xe] pf_provision_vf_lmem+0x350/0xa60 [xe] xe_gt_sriov_pf_config_bulk_set_lmem+0xe2/0x410 [xe] xe_gt_sriov_pf_config_set_fair_lmem+0x1c6/0x620 [xe] xe_gt_sriov_pf_config_set_fair+0xd5/0x3f0 [xe] xe_pci_sriov_configure+0x360/0x1200 [xe] sriov_numvfs_store+0xbc/0x1d0 dev_attr_store+0x17/0x40 sysfs_kf_write+0x4a/0x80 kernfs_fop_write_iter+0x166/0x220 vfs_write+0x2ba/0x580 ksys_write+0x77/0x100 __x64_sys_write+0x19/0x30 x64_sys_call+0x2bf/0x2660 do_syscall_64+0x93/0x7a0 entry_SYSCALL_64_after_hwframe+0x76/0x7e [ ] xe 0000:4d:00.0: [drm] *ERROR* GT0: CT dequeue failed: -71 [ ] xe 0000:4d:00.0: [drm] GT0: trying reset from receive_g2h [xe] This could be mitigated by pushing earlier a PF self-configuration with some hard-coded values that cover unlimited access to the GGTT, use of all GuC contexts and doorbells. This step is sufficient for the GuC to switch into the VGT mode. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250711193316.1920-5-michal.wajdeczko@intel.com commit 92ba2032a18dd61ca65ac832134217493fbc8bcf Author: Michal Wajdeczko Date: Fri Jul 11 21:33:13 2025 +0200 drm/xe/pf: Move GGTT config KLVs encoding to helper In upcoming patch we will want to encode GGTT config KLVs based on raw numbers, without relying on the allocated GGTT node. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250711193316.1920-4-michal.wajdeczko@intel.com commit 1c38dd6afa4a8ecce28e94da794fd1d205c30f51 Author: Michal Wajdeczko Date: Fri Jul 11 21:33:12 2025 +0200 drm/xe/pf: Resend PF provisioning after GT reset If we reload the GuC due to suspend/resume or GT reset then we have to resend not only any VFs provisioning data, but also PF configuration, like scheduling parameters (EQ, PT), as otherwise GuC will continue to use default values. Fixes: 411220808cee ("drm/xe/pf: Restart VFs provisioning after GT reset") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250711193316.1920-3-michal.wajdeczko@intel.com commit 9f50b729dd61dfb9f4d7c66900d22a7c7353a8c0 Author: Michal Wajdeczko Date: Fri Jul 11 21:33:11 2025 +0200 drm/xe/pf: Prepare to stop SR-IOV support prior GT reset As part of the resume or GT reset, the PF driver schedules work which is then used to complete restarting of the SR-IOV support, including resending to the GuC configurations of provisioned VFs. However, in case of short delay between those two actions, which could be seen by triggering a GT reset on the suspened device: $ echo 1 > /sys/kernel/debug/dri/0000:00:02.0/gt0/force_reset this PF worker might be still busy, which lead to errors due to just stopped or disabled GuC CTB communication: [ ] xe 0000:00:02.0: [drm:xe_gt_resume [xe]] GT0: resumed [ ] xe 0000:00:02.0: [drm] GT0: trying reset from force_reset_show [xe] [ ] xe 0000:00:02.0: [drm] GT0: reset queued [ ] xe 0000:00:02.0: [drm] GT0: reset started [ ] xe 0000:00:02.0: [drm:guc_ct_change_state [xe]] GT0: GuC CT communication channel stopped [ ] xe 0000:00:02.0: [drm:guc_ct_send_recv [xe]] GT0: H2G request 0x5503 canceled! [ ] xe 0000:00:02.0: [drm] GT0: PF: Failed to push VF1 12 config KLVs (-ECANCELED) [ ] xe 0000:00:02.0: [drm] GT0: PF: Failed to push VF1 configuration (-ECANCELED) [ ] xe 0000:00:02.0: [drm:guc_ct_change_state [xe]] GT0: GuC CT communication channel disabled [ ] xe 0000:00:02.0: [drm] GT0: PF: Failed to push VF2 12 config KLVs (-ENODEV) [ ] xe 0000:00:02.0: [drm] GT0: PF: Failed to push VF2 configuration (-ENODEV) [ ] xe 0000:00:02.0: [drm] GT0: PF: Failed to push 2 of 2 VFs configurations [ ] xe 0000:00:02.0: [drm:pf_worker_restart_func [xe]] GT0: PF: restart completed While this VFs reprovisioning will be successful during next spin of the worker, to avoid those errors, make sure to cancel restart worker if we are about to trigger next reset. Fixes: 411220808cee ("drm/xe/pf: Restart VFs provisioning after GT reset") Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250711193316.1920-2-michal.wajdeczko@intel.com commit fd5fde69fd413b03e25fb3b8e2ce375c02e74b0d Author: Diederik de Haas Date: Wed Jul 9 15:15:16 2025 +0200 dt-bindings: display: rockchip,dw-mipi-dsi: Drop address/size cells The "rockchip,dw-mipi-dsi" binding has allOf "snps,dw-mipi-dsi.yaml" which has allOf "dsi-controller.yaml", which already has #address-cells and #size-cells defined as '1' and '0' respectively. So drop this re-definition. Signed-off-by: Diederik de Haas Reviewed-by: "Rob Herring (Arm)" Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250709132323.128757-4-didi.debian@cknow.org commit 39215bb3b0d929f336b6c82ff1665a3377ca0d4f Author: Dheeraj Kumar Srivastava Date: Wed Jul 2 15:08:04 2025 +0530 iommu/amd: Add documentation for AMD IOMMU debugfs support Add documentation describing how to use AMD IOMMU debugfs support to dump IOMMU data structures - IRT table, Device table, Registers (MMIO and Capability) and command buffer. Signed-off-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20250702093804.849-9-dheerajkumar.srivastava@amd.com Signed-off-by: Will Deacon commit 349ad6d5263a6299aae64ad59d82bb5b03b478fa Author: Dheeraj Kumar Srivastava Date: Wed Jul 2 15:08:03 2025 +0530 iommu/amd: Add debugfs support to dump IRT Table In cases where we have an issue in the device interrupt path with IOMMU interrupt remapping enabled, dumping valid IRT table entries for the device is very useful and good input for debugging the issue. eg. -> To dump irte entries for a particular device #echo "c4:00.0" > /sys/kernel/debug/iommu/amd/devid #cat /sys/kernel/debug/iommu/amd/irqtbl | less or #echo "0000:c4:00.0" > /sys/kernel/debug/iommu/amd/devid #cat /sys/kernel/debug/iommu/amd/irqtbl | less Signed-off-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20250702093804.849-8-dheerajkumar.srivastava@amd.com Signed-off-by: Will Deacon commit b484577824452e526191cb87f297f78dadd97dda Author: Dheeraj Kumar Srivastava Date: Wed Jul 2 15:08:02 2025 +0530 iommu/amd: Add debugfs support to dump device table IOMMU uses device table data structure to get per-device information for DMA remapping, interrupt remapping, and other functionalities. It's a valuable data structure to visualize for debugging issues related to IOMMU. eg. -> To dump device table entry for a particular device #echo 0000:c4:00.0 > /sys/kernel/debug/iommu/amd/devid #cat /sys/kernel/debug/iommu/amd/devtbl or #echo c4:00.0 > /sys/kernel/debug/iommu/amd/devid #cat /sys/kernel/debug/iommu/amd/devtbl Signed-off-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20250702093804.849-7-dheerajkumar.srivastava@amd.com Signed-off-by: Will Deacon commit 2e98940f123d9c69d4759078aea9a536244c98d3 Author: Dheeraj Kumar Srivastava Date: Wed Jul 2 15:08:01 2025 +0530 iommu/amd: Add support for device id user input Dumping IOMMU data structures like device table, IRT, etc., for all devices on the system will be a lot of data dumped in a file. Also, user may want to dump and analyze these data structures just for one or few devices. So dumping IOMMU data structures like device table, IRT etc for all devices is not a good approach. Add "device id" user input to be used for dumping IOMMU data structures like device table, IRT etc in AMD IOMMU debugfs. eg. 1. # echo 0000:01:00.0 > /sys/kernel/debug/iommu/amd/devid # cat /sys/kernel/debug/iommu/amd/devid Output : 0000:01:00.0 2. # echo 01:00.0 > /sys/kernel/debug/iommu/amd/devid # cat /sys/kernel/debug/iommu/amd/devid Output : 0000:01:00.0 Signed-off-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20250702093804.849-6-dheerajkumar.srivastava@amd.com Signed-off-by: Will Deacon commit fb3af1f4fefb78f9180446aae2834e11a6f7d134 Author: Dheeraj Kumar Srivastava Date: Wed Jul 2 15:08:00 2025 +0530 iommu/amd: Add debugfs support to dump IOMMU command buffer IOMMU driver sends command to IOMMU hardware via command buffer. In cases where IOMMU hardware fails to process commands in command buffer, dumping it is a valuable input to debug the issue. IOMMU hardware processes command buffer entry at offset equals to the head pointer. Dumping just the entry at the head pointer may not always be useful. The current head may not be pointing to the entry of the command buffer which is causing the issue. IOMMU Hardware may have processed the entry and updated the head pointer. So dumping the entire command buffer gives a broad understanding of what hardware was/is doing. The command buffer dump will have all entries from start to end of the command buffer. Along with that, it will have a head and tail command buffer pointer register dump to facilitate where the IOMMU driver and hardware are in the command buffer for injecting and processing the entries respectively. Command buffer is a per IOMMU data structure. So dumping on per IOMMU basis. eg. -> To get command buffer dump for iommu (say, iommu00) #cat /sys/kernel/debug/iommu/amd/iommu00/cmdbuf Signed-off-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20250702093804.849-5-dheerajkumar.srivastava@amd.com Signed-off-by: Will Deacon commit 4d9c5d5a1dc940e44084e5cab780e1646501b6c1 Author: Dheeraj Kumar Srivastava Date: Wed Jul 2 15:07:59 2025 +0530 iommu/amd: Add debugfs support to dump IOMMU Capability registers IOMMU Capability registers defines capabilities of IOMMU and information needed for initialising MMIO registers and device table. This is useful to dump these registers for debugging IOMMU related issues. e.g. -> To get capability registers value at offset 0x10 for iommu (say, iommu00) # echo "0x10" > /sys/kernel/debug/iommu/amd/iommu00/capability # cat /sys/kernel/debug/iommu/amd/iommu00/capability Signed-off-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20250702093804.849-4-dheerajkumar.srivastava@amd.com Signed-off-by: Will Deacon commit 7a4ee419e8c144b747a8915856e91a034d7c8f34 Author: Dheeraj Kumar Srivastava Date: Wed Jul 2 15:07:58 2025 +0530 iommu/amd: Add debugfs support to dump IOMMU MMIO registers Analyzing IOMMU MMIO registers gives a view of what IOMMU is configured with on the system and is helpful to debug issues with IOMMU. eg. -> To get mmio registers value at offset 0x18 for iommu (say, iommu00) # echo "0x18" > /sys/kernel/debug/iommu/amd/iommu00/mmio # cat /sys/kernel/debug/iommu/amd/iommu00/mmio Signed-off-by: Dheeraj Kumar Srivastava Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20250702093804.849-3-dheerajkumar.srivastava@amd.com Signed-off-by: Will Deacon commit ad48b1dd14fb217e0a0b0af46744a3d1f6f26dea Author: Dheeraj Kumar Srivastava Date: Wed Jul 2 15:07:57 2025 +0530 iommu/amd: Refactor AMD IOMMU debugfs initial setup Rearrange initial setup of AMD IOMMU debugfs to segregate per IOMMU setup and setup which is common for all IOMMUs. This ensures that common debugfs paths (introduced in subsequent patches) are created only once instead of being created for each IOMMU. With the change, there is no need to use lock as amd_iommu_debugfs_setup() will be called only once during AMD IOMMU initialization. So remove lock acquisition in amd_iommu_debugfs_setup(). Signed-off-by: Dheeraj Kumar Srivastava Reviewed-by: Suravee Suthikulpanit Reviewed-by: Vasant Hegde Link: https://lore.kernel.org/r/20250702093804.849-2-dheerajkumar.srivastava@amd.com Signed-off-by: Will Deacon commit 2f0187392cbab96ee6a1fa28d34da9474939ede5 Author: Luca Weiss Date: Sun Jul 13 10:05:23 2025 +0200 dt-bindings: arm-smmu: document the support on Milos Add compatible for smmu representing support on the Milos SoC. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250713-sm7635-fp6-initial-v2-1-e8f9a789505b@fairphone.com Signed-off-by: Will Deacon commit ae019f0bdfbef3e0671e7b954321e92fc24c7e54 Author: Jonas Karlman Date: Wed Jul 9 21:08:28 2025 +0000 arm64: dts: rockchip: Fix UART DMA support for RK3528 Trying to use UART2 DMA for Bluetooth on ArmSoM Sige1 result in tx timeout when using dma-names = "tx", "rx" as required by the dt-binding: Bluetooth: hci0: command 0x0c03 tx timeout Bluetooth: hci0: BCM: Reset failed (-110) Change the dmas order to fix UART DMA support on RK3528. With this fixed Bluetooth can be loaded using DMA on ArmSoM Sige1: Bluetooth: hci0: BCM: chip id 159 Bluetooth: hci0: BCM: features 0x0f Bluetooth: hci0: BCM4362A2 Bluetooth: hci0: BCM4362A2 (000.017.017) build 0000 Bluetooth: hci0: BCM4362A2 'brcm/BCM4362A2.hcd' Patch Bluetooth: hci0: BCM: features 0x0f Bluetooth: hci0: BCM43752A2 UART 37.4MHz Ampak AP6398 sLNA iLNA CL1 [Version: 1091.1173] Bluetooth: hci0: BCM4362A2 (000.017.017) build 1173 Fixes: ab6fcb58aedf ("arm64: dts: rockchip: Add UART DMA support for RK3528") Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20250709210831.3170458-1-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 954f07012794a3aa7ae89e56f070eaa1643af50b Author: Diederik de Haas Date: Fri Jul 11 16:20:37 2025 +0200 arm64: dts: rockchip: Add reset button to NanoPi R5S The NanoPi R5S LTS version has a reset button, which is connected via GPIO. Note that the non-LTS version does not have the reset button and therefore on page 19 of the schematic version 2204 it is marked 'NC', but it is connected on the LTS version. Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250711142138.197445-1-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit a2df3aead3e023857330a803c664ee97a7bd9b97 Author: Diederik de Haas Date: Sun Jul 13 18:16:36 2025 +0200 arm64: dts: rockchip: Add rtc0 alias for NanoPi R5S + R5C The RTC_HCTOSYS_DEVICE module defaults to rtc0 and should (highly) preferable be assigned to a battery backed RTC module as it is used to (re)initialize the system clock. The R5S and R5C have a connector for a RTC battery which is used by HYM8563 RTC. Both devices also have another RTC from the rk809 PMIC. To make sure the HYM8563 is always assigned rtc0, add an alias for it. Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250713161723.270963-1-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit 55e8757c696210292cfda6f1464991d6f5c4300f Merge: a8594c956cc9dc e6d8e7dbc5a363 Author: Paolo Abeni Date: Tue Jul 15 12:08:41 2025 +0200 Merge branch 'net-mctp-improved-bind-handling' Matt Johnston says: ==================== net: mctp: Improved bind handling This series improves a couple of aspects of MCTP bind() handling. MCTP wasn't checking whether the same MCTP type was bound by multiple sockets. That would result in messages being received by an arbitrary socket, which isn't useful behaviour. Instead it makes more sense to have the duplicate binds fail, the same as other network protocols. An exception is made for more-specific binds to particular MCTP addresses. It is also useful to be able to limit a bind to only receive incoming request messages (MCTP TO bit set) from a specific peer+type, so that individual processes can communicate with separate MCTP peers. One example is a PLDM firmware update requester, which will initiate communication with a device, and then the device will connect back to the requester process. These limited binds are implemented by a connect() call on the socket prior to bind. connect() isn't used in the general case for MCTP, since a plain send() wouldn't provide the required MCTP tag argument for addressing. Signed-off-by: Matt Johnston ==================== Link: https://patch.msgid.link/20250710-mctp-bind-v4-0-8ec2f6460c56@codeconstruct.com.au Signed-off-by: Paolo Abeni commit e6d8e7dbc5a363a8e55a65f3bbe7f9f44f0aeb4f Author: Matt Johnston Date: Thu Jul 10 16:56:01 2025 +0800 net: mctp: Add bind lookup test Test the preference order of bound socket matches with a series of test packets. Signed-off-by: Matt Johnston Link: https://patch.msgid.link/20250710-mctp-bind-v4-8-8ec2f6460c56@codeconstruct.com.au Signed-off-by: Paolo Abeni commit b7e28129b667dede890bc7bd340a77e325df156a Author: Matt Johnston Date: Thu Jul 10 16:56:00 2025 +0800 net: mctp: Test conflicts of connect() with bind() The addition of connect() adds new conflict cases to test. Signed-off-by: Matt Johnston Link: https://patch.msgid.link/20250710-mctp-bind-v4-7-8ec2f6460c56@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 3549eb08e5505823857838b5cf5f08567702d054 Author: Matt Johnston Date: Thu Jul 10 16:55:59 2025 +0800 net: mctp: Allow limiting binds to a peer address Prior to calling bind() a program may call connect() on a socket to restrict to a remote peer address. Using connect() is the normal mechanism to specify a remote network peer, so we use that here. In MCTP connect() is only used for bound sockets - send() is not available for MCTP since a tag must be provided for each message. The smctp_type must match between connect() and bind() calls. Signed-off-by: Matt Johnston Link: https://patch.msgid.link/20250710-mctp-bind-v4-6-8ec2f6460c56@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 1aeed732f4f885ad36280ca4afb331fa42bf7263 Author: Matt Johnston Date: Thu Jul 10 16:55:58 2025 +0800 net: mctp: Use hashtable for binds Ensure that a specific EID (remote or local) bind will match in preference to a MCTP_ADDR_ANY bind. This adds infrastructure for binding a socket to receive messages from a specific remote peer address, a future commit will expose an API for this. Signed-off-by: Matt Johnston Link: https://patch.msgid.link/20250710-mctp-bind-v4-5-8ec2f6460c56@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 4ec4b7fc04a7217a6a581ac132bd0fb6abc2f4d5 Author: Matt Johnston Date: Thu Jul 10 16:55:57 2025 +0800 net: mctp: Add test for conflicting bind()s Test pairwise combinations of bind addresses and types. Signed-off-by: Matt Johnston Link: https://patch.msgid.link/20250710-mctp-bind-v4-4-8ec2f6460c56@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 5000268c298219396cc01b8c3363a578cd168085 Author: Matt Johnston Date: Thu Jul 10 16:55:56 2025 +0800 net: mctp: Treat MCTP_NET_ANY specially in bind() When a specific EID is passed as a bind address, it only makes sense to interpret with an actual network ID, so resolve that to the default network at bind time. For bind address of MCTP_ADDR_ANY, we want to be able to capture traffic to any network and address, so keep the current behaviour of matching traffic from any network interface (don't interpret MCTP_NET_ANY as the default network ID). Signed-off-by: Matt Johnston Link: https://patch.msgid.link/20250710-mctp-bind-v4-3-8ec2f6460c56@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 3954502377ec05a1b37e2dc9bef0bacd4bbd71b2 Author: Matt Johnston Date: Thu Jul 10 16:55:55 2025 +0800 net: mctp: Prevent duplicate binds Disallow bind() calls that have the same arguments as existing bound sockets. Previously multiple sockets could bind() to the same type/local address, with an arbitrary socket receiving matched messages. This is only a partial fix, a future commit will define precedence order for MCTP_ADDR_ANY versus specific EID bind(), which are allowed to exist together. Signed-off-by: Matt Johnston Link: https://patch.msgid.link/20250710-mctp-bind-v4-2-8ec2f6460c56@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 3558ab79a2f22086c040542f4e4e6b005bc28a06 Author: Matt Johnston Date: Thu Jul 10 16:55:54 2025 +0800 net: mctp: mctp_test_route_extaddr_input cleanup The sock was not being released. Other than leaking, the stale socket will conflict with subsequent bind() calls in unrelated MCTP tests. Fixes: 46ee16462fed ("net: mctp: test: Add extaddr routing output test") Signed-off-by: Matt Johnston Link: https://patch.msgid.link/20250710-mctp-bind-v4-1-8ec2f6460c56@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 7f2b41ac3f29f682cde113f1d0b4b43d261902fe Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:24 2025 +0530 x86/apic: Move apic_update_irq_cfg() call to apic_update_vector() All callers of apic_update_vector() also call apic_update_irq_cfg() after it. So, move the apic_update_irq_cfg() call to apic_update_vector(). No functional change intended. Signed-off-by: Neeraj Upadhyay Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250709033242.267892-18-Neeraj.Upadhyay@amd.com commit 3ccc82e31d6a66600f14f6622a944f580b04da43 Author: Alice Ryhl Date: Tue Jul 15 07:51:40 2025 +0000 vfs: add Rust files to MAINTAINERS These files are maintained by the VFS subsystem, thus add them to the relevant MAINTAINERS entry to ensure that the maintainers are ccd on relevant changes. Signed-off-by: Alice Ryhl Link: https://lore.kernel.org/20250715075140.3174832-1-aliceryhl@google.com Signed-off-by: Christian Brauner commit e1876fb015c3edcc7f665e5955afad7009644ab6 Author: Peng Jiang Date: Fri Jul 4 14:38:17 2025 +0800 kprobes: Add missing kerneldoc for __get_insn_slot Add kerneldoc for '__get_insn_slot' function to fix W=1 warnings: kernel/kprobes.c:141 function parameter 'c' not described in '__get_insn_slot' Link: https://lore.kernel.org/all/20250704143817707TOCcfTRWsO5OAbQ2eYoU9@zte.com.cn/ Signed-off-by: Peng Jiang Signed-off-by: Masami Hiramatsu (Google) commit 21e9b7d11218e7ba009e74bf51abacf0534f5626 Author: Khaled Elnaggar Date: Sat Jul 12 16:36:07 2025 +0300 can: janz-ican3: use sysfs_emit() in fwinfo_show() As recommended in Documentation/filesystems/sysfs.rst, show() callbacks should use sysfs_emit() or sysfs_emit_at() to format values returned to userspace. Replace scnprintf() with sysfs_emit() in fwinfo_show(). Signed-off-by: Khaled Elnaggar Link: https://patch.msgid.link/20250712133609.331904-1-khaledelnaggarlinux@gmail.com Signed-off-by: Marc Kleine-Budde commit 9a44b5e36cd699fdd2150a63fab225ac510c1971 Author: Sarika Sharma Date: Mon Jul 14 14:14:05 2025 +0530 wifi: cfg80211: fix double free for link_sinfo in nl80211_station_dump() Currently, the link_sinfo structure is being freed twice in nl80211_dump_station(), once after the send_station() call and again in the error handling path. This results in a double free of both link_sinfo and link_sinfo->pertid, which might lead to undefined behavior or kernel crashes. Hence, fix by ensuring cfg80211_sinfo_release_content() is only invoked once during execution of nl80211_station_dump(). Fixes: 49e47223ecc4 ("wifi: cfg80211: allocate memory for link_station info structure") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/81f30515-a83d-4b05-a9d1-e349969df9e9@sabinyo.mountain/ Reported-by: syzbot+4ba6272678aa468132c8@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/68655325.a70a0220.5d25f.0316.GAE@google.com Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250714084405.178066-1-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit e9a896d498506af16d52ee33b80c1cdb4f36350d Author: Aditya Kumar Singh Date: Mon Jul 14 09:37:42 2025 +0530 wifi: cfg80211: fix off channel operation allowed check for MLO In cfg80211_off_channel_oper_allowed(), the current logic disallows off-channel operations if any link operates on a radar channel, assuming such channels cannot be vacated. This assumption holds for non-MLO interfaces but not for MLO. With MLO and multi-radio devices, different links may operate on separate radios. This allows one link to scan off-channel while another remains on a radar channel. For example, in a 5 GHz split-phy setup, the lower band can scan while the upper band stays on a radar channel. Off-channel operations can be allowed if the radio/link onto which the input channel falls is different from the radio/link which has an active radar channel. Therefore, fix cfg80211_off_channel_oper_allowed() by returning false only if the requested channel maps to the same radio as an active radar channel. Allow off-channel operations when the requested channel is on a different radio, as in MLO with multi-radio setups. Signed-off-by: Aditya Kumar Singh Signed-off-by: Amith A Link: https://patch.msgid.link/20250714040742.538550-1-quic_amitajit@quicinc.com Signed-off-by: Johannes Berg commit 8e5bf103b3ada972ea890ae6aa2118ff9b8c321c Author: Krzysztof Kozlowski Date: Thu Jul 10 09:34:45 2025 +0200 arm64: samsung: MAINTAINERS: Add Tesla FSD DTS to Exynos entry Effectively all Tesla FSD DTS patches go via Samsung Exynos SoC maintainer, so add the pattern to make it obvious and reduce the chances patches won't reach these maintainers. Cc: Peter Griffin Cc: André Draszik Cc: Tudor Ambarus Cc: Alim Akhtar Reviewed-by: Alim Akhtar Reviewed-by: André Draszik Link: https://lore.kernel.org/r/20250710073443.13788-4-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 7f311e5ac36b6cf9cc0734d89546e643f33b684a Author: Krzysztof Kozlowski Date: Thu Jul 10 09:34:44 2025 +0200 arm64: tesla/google: MAINTAINERS: Reference "SoC clean" maintainer profile Effectively all Tesla FSD and Google GS101 DTS patches go via Samsung SoC maintainer, who applies the same rules as for Samsung SoC: DTS must be fully DT bindings compliant (`dtbs_check W=1`). Existing sources already are compliant, so just document that implicit rule by mentioning respective maintainer profile in their entries. Cc: Peter Griffin Cc: André Draszik Cc: Tudor Ambarus Cc: Alim Akhtar Reviewed-by: Alim Akhtar Reviewed-by: Peter Griffin Reviewed-by: André Draszik Link: https://lore.kernel.org/r/20250710073443.13788-3-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 9975aeebe2908cdd552ee59607754755459fad52 Author: Maharaja Kennadyrajan Date: Fri Jul 11 09:08:46 2025 +0530 wifi: mac80211: use RCU-safe iteration in ieee80211_csa_finish The ieee80211_csa_finish() function currently uses for_each_sdata_link() to iterate over links of sdata. However, this macro internally uses wiphy_dereference(), which expects the wiphy->mtx lock to be held. When ieee80211_csa_finish() is invoked under an RCU read-side critical section (e.g., under rcu_read_lock()), this leads to a warning from the RCU debugging framework. WARNING: suspicious RCU usage net/mac80211/cfg.c:3830 suspicious rcu_dereference_protected() usage! This warning is triggered because wiphy_dereference() is not safe to use without holding the wiphy mutex, and it is being used in an RCU context without the required locking. Fix this by introducing and using a new macro, for_each_sdata_link_rcu(), which performs RCU-safe iteration over sdata links using list_for_each_entry_rcu() and rcu_dereference(). This ensures that the link pointers are accessed safely under RCU and eliminates the warning. Fixes: f600832794c9 ("wifi: mac80211: restructure tx profile retrieval for MLO MBSSID") Signed-off-by: Maharaja Kennadyrajan Link: https://patch.msgid.link/20250711033846.40455-1-maharaja.kennadyrajan@oss.qualcomm.com [unindent like the non-RCU macro] Signed-off-by: Johannes Berg commit a8594c956cc9dc6799554a554bc422d1ffd4c46b Author: Yue Haibing Date: Mon Jul 14 16:19:49 2025 +0800 ipv6: mcast: Avoid a duplicate pointer check in mld_del_delrec() Avoid duplicate non-null pointer check for pmc in mld_del_delrec(). No functional changes. Signed-off-by: Yue Haibing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250714081949.3109947-1-yuehaibing@huawei.com Signed-off-by: Paolo Abeni commit 3df924c8f7d9223481feaac149a8ab93db9c0e11 Author: Alex Gavin Date: Thu Jul 10 14:14:30 2025 -0700 wifi: mac80211_hwsim: Update comments in header - Reorders 'HWSIM_ATTR_PAD' to after 'HWSIM_ATTR_FREQ', matching order in 'enum hwsim_attrs' - Change references from old commands to new names - Fixes typos Signed-off-by: Alex Gavin Link: https://patch.msgid.link/20250710211437.8516-1-alex.gavin@candelatech.com Signed-off-by: Johannes Berg commit f7130c9e3e12574168314496634db98af1317caf Author: Yuvarani V Date: Thu Jul 10 11:04:28 2025 +0530 wifi: mac80211: parse unsolicited broadcast probe response data During commands like channel switch and color change, the updated unsolicited broadcast probe response template may be provided. However, this data is not parsed or acted upon in mac80211. Add support to parse it and set the BSS changed flag BSS_CHANGED_UNSOL_BCAST_PROBE_RESP so that drivers could take further action. Signed-off-by: Yuvarani V Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250710-update_unsol_bcast_probe_resp-v2-2-31aca39d3b30@oss.qualcomm.com Signed-off-by: Johannes Berg commit c932be7262323011ae8caa050811300b85347050 Author: Yuvarani V Date: Thu Jul 10 11:04:27 2025 +0530 wifi: cfg80211: parse attribute to update unsolicited probe response template At present, the updated unsolicited broadcast probe response template is not processed during userspace commands such as channel switch or color change. This leads to an issue where older incorrect unsolicited probe response is still used during these events. Add support to parse the netlink attribute and store it so that mac80211/drivers can use it to set the BSS_CHANGED_UNSOL_BCAST_PROBE_RESP flag in order to send the updated unsolicited broadcast probe response templates during these events. Signed-off-by: Yuvarani V Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250710-update_unsol_bcast_probe_resp-v2-1-31aca39d3b30@oss.qualcomm.com Signed-off-by: Johannes Berg commit a597432cc9e640439370d9dc95952220cc13fc2b Author: Johannes Berg Date: Wed Jul 9 23:38:03 2025 +0300 wifi: mac80211: don't use TPE data from assoc response Since there's no TPE element in the (re)assoc response, trying to use the data from it just leads to using the defaults, even though the real values had been set during authentication from the discovered BSS information. Fix this by simply not handling the TPE data in assoc response since it's not intended to be present, if it changes later the necessary changes will be made by tracking beacons later. As a side effect, by passing the real frame subtype, now print a correct value for ML reconfiguration responses. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.caa1ca853f5a.I588271f386731978163aa9d84ae75d6f79633e16@changeid Signed-off-by: Johannes Berg commit 93370f2d37f50757a810da409efc0223c342527e Author: Miri Korenblit Date: Wed Jul 9 23:38:02 2025 +0300 wifi: mac80211: handle WLAN_HT_ACTION_NOTIFY_CHANWIDTH async If this action frame, with the value of IEEE80211_HT_CHANWIDTH_ANY, arrives right after a beacon that changed the operational bandwidth from 20 MHz to 40 MHz, then updating the rate control bandwidth to 40 can race with updating the chanctx width (that happens in the beacon proccesing) back to 40 MHz: cpu0 cpu1 ieee80211_rx_mgmt_beacon ieee80211_config_bw ieee80211_link_change_chanreq (*)ieee80211_link_update_chanreq ieee80211_rx_h_action (**)ieee80211_sta_cur_vht_bw (***) ieee80211_recalc_chanctx_chantype in (**), the maximum between the capability width and the bss width is returned. But the bss width was just updated to 40 in (*), so the action frame handling code will increase the width of the rate control before the chanctx was increased (in ***), leading to a FW error (at least in iwlwifi driver. But this is wrong regardless). Fix this by simply handling the action frame async, so it won't race with the beacon proccessing. Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218632 Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.bb9dc6f36c35.I39782d6077424e075974c3bee4277761494a1527@changeid Signed-off-by: Johannes Berg commit 6ee152b0cd45643ef0a1697585b97b63985ea79d Author: Johannes Berg Date: Wed Jul 9 23:38:01 2025 +0300 wifi: mac80211: simplify __ieee80211_rx_h_amsdu() loop The loop handling individual subframes can be simplified to not use a somewhat confusing goto inside the loop. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.a217a1e8c667.I5283df9627912c06c8327b5786d6b715c6f3a4e1@changeid Signed-off-by: Johannes Berg commit 63df3956903748c5f374a0dfe7a89490714a4625 Author: Miri Korenblit Date: Wed Jul 9 23:38:00 2025 +0300 wifi: mac80211: don't mark keys for inactive links as uploaded During resume, the driver can call ieee80211_add_gtk_rekey for keys that are not programmed into the device, e.g. keys of inactive links. Don't mark such a key as uploaded to avoid removing it later from the driver/device. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.655094412b0b.Iacae31af3ba2a705da0a9baea976c2f799d65dc4@changeid Signed-off-by: Johannes Berg commit 44ff9dae52cb275a1876d6f52fb2af5995149a83 Author: Miri Korenblit Date: Wed Jul 9 23:37:59 2025 +0300 wifi: mac80211: only assign chanctx in reconfig At the end of reconfig we are activating all the links that were active before the error. During the activation, _ieee80211_link_use_channel will unassign and re-assign the chanctx from/to the link. But we only need to do the assign, as we are re-building the state as it was before the reconfig. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.6245c3ae7031.Ia5f68992c7c112bea8a426c9339f50c88be3a9ca@changeid Signed-off-by: Johannes Berg commit 2813d22149909d5eca67c079b63b8c93a2864339 Author: Ilan Peer Date: Wed Jul 9 23:37:58 2025 +0300 wifi: mac80211_hwsim: Declare support for AP scanning To support testing scenarios. Signed-off-by: Ilan Peer Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.6916e0a49955.I48e374ad7e3ea5877a5e93e5c5fe8301465771c8@changeid Signed-off-by: Johannes Berg commit 8d313426d5029698daf68ee98d9fa6caa0cf370e Author: Johannes Berg Date: Wed Jul 9 23:37:57 2025 +0300 wifi: mac80211: clean up cipher suite handling Under the previous commit's assumption that FIPS isn't supported by hardware, we don't need to modify the cipher suite list, but just need to use the software one instead of the driver's in this case, so clean up the code. Also fix it to exclude TKIP in this case, since that's also dependent on RC4. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.cff427e8f8a5.I744d1ea6a37e3ea55ae8bc3e770acee734eff268@changeid Signed-off-by: Johannes Berg commit 5241526dede93e6f1011b6b5e905801e24675ece Author: Johannes Berg Date: Wed Jul 9 23:37:56 2025 +0300 wifi: mac80211: don't send keys to driver when fips_enabled When fips_enabled is set, don't send any keys to the driver (including possibly WoWLAN KEK/KCK material), assuming that no device exists with the necessary certifications. If this turns out to be false in the future, we can add a HW flag. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.e5eebc2b19d8.I968ef8c9ffb48d464ada78685bd25d22349fb063@changeid Signed-off-by: Johannes Berg commit 14450be2332a49445106403492a367412b8c23f4 Author: Ilan Peer Date: Wed Jul 9 23:37:55 2025 +0300 wifi: cfg80211: Fix interface type validation Fix a condition that verified valid values of interface types. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.7ad199ca5939.I0ac1ff74798bf59a87a57f2e18f2153c308b119b@changeid Signed-off-by: Johannes Berg commit 8aec30bb11280d932d0349e8d0727a6f29f8fcc4 Author: Johannes Berg Date: Wed Jul 9 23:37:54 2025 +0300 wifi: mac80211: remove ieee80211_link_unreserve_chanctx() return value All the paths that could return an error are considered misuses of the function and WARN already, and none of the callers ever check the return value. Remove it. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.5b436ee3c20c.Ieff61ec510939adb5fe6da4840557b649b3aa820@changeid Signed-off-by: Johannes Berg commit a6d521bafcb290294128a51b13dbf4baae5748fc Author: Johannes Berg Date: Wed Jul 9 23:37:53 2025 +0300 wifi: mac80211: don't unreserve never reserved chanctx If a link has no chanctx, indicating it is an inactive link that we tracked CSA for, then attempting to unreserve the reserved chanctx will throw a warning and fail, since there never was a reserved chanctx. Skip the unreserve. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709233537.022192f4b1ae.Ib58156ac13e674a9f4d714735be0764a244c0aae@changeid Signed-off-by: Johannes Berg commit 50459501b9a212dbe7a673727589ee105a8a9954 Author: Thomas Fourier Date: Wed Jul 9 13:13:34 2025 +0200 mwl8k: Add missing check after DMA map The DMA map functions can fail and should be tested for errors. If the mapping fails, unmap and return an error. Fixes: 788838ebe8a4 ("mwl8k: use pci_unmap_addr{,set}() to keep track of unmap addresses on rx") Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20250709111339.25360-2-fourier.thomas@gmail.com Signed-off-by: Johannes Berg commit 1772e571b332fdc480289c241f2273a808c5568d Author: Johannes Berg Date: Tue Jul 8 12:58:49 2025 +0200 wifi: mac80211: make VHT opmode NSS ignore a debug message There's no need to always print it, it's only useful for debugging specific client issues. Make it a debug message. Reported-by: Paul Menzel Link: https://lore.kernel.org/linux-wireless/20250529070922.3467-1-pmenzel@molgen.mpg.de/ Link: https://patch.msgid.link/20250708105849.22448-2-johannes@sipsolutions.net Signed-off-by: Johannes Berg commit 3ab928f06ea9d7e1fa6f656d5ef7c8408f59db2f Author: Ananthu C V Date: Mon Jul 14 19:33:10 2025 +0530 staging: rtl8723bs: remove unncessary multiple blank lines fix "CHECK: Please don't use multiple blank lines" in drivers/staging/rtl8723bs/os_dep/os_intfs.c:102 Signed-off-by: Ananthu C V Link: https://lore.kernel.org/r/20250714140307.51506-1-weepingclown@debian.org Signed-off-by: Greg Kroah-Hartman commit f117262cf1581b0aa7c711bb4f18d9e237a7a539 Author: Andrei Zeucianu Date: Mon Jul 14 15:46:11 2025 +0200 staging: rtl8723bs: hal: remove blank line before close brace Fix checkpatch error "CHECK: Blank lines aren't necessary before a close brace '}' in odm_DIG.c:374. Signed-off-by: Andrei Zeucianu Link: https://lore.kernel.org/r/20250714134611.119442-1-benjaminpotron@gmail.com Signed-off-by: Greg Kroah-Hartman commit 851b2f7969382295a03de171ba4543e6b1e2f9e0 Author: Alexandre Viard Date: Mon Jul 14 15:32:30 2025 +0200 staging: rtl8723bs: os_dep: remove whitespace after cast. Fix checkpatch error "CHECK: No space is necessary after a cast" in sdio_intf.c:292 Signed-off-by: Alexandre Viard Link: https://lore.kernel.org/r/20250714133238.67997-1-xela@viard.dev Signed-off-by: Greg Kroah-Hartman commit 905f499e20301127226f3ef636a7cad28e41c2d9 Author: Vincent Caron Date: Mon Jul 14 15:17:43 2025 +0200 staging: rtl8723bs: remove spurious if-block braces Fix checkpatch "WARNING: braces {} are not necessary for single statement blocks" in rtl8723bs/os_dep/os_intfs.c:1207. Signed-off-by: Vincent Caron Link: https://lore.kernel.org/r/20250714131743.343482-1-vcaron@bearstech.com Signed-off-by: Greg Kroah-Hartman commit aea29410dcccad21c8f02a824aeb6e96ab668f31 Author: Ravi Kant Sharma Date: Mon Jul 14 09:28:34 2025 -0400 staging: rtl8723bs: remove blank line before close brace. Fix checkpatch CHECK Blank lines aren't necessary before a close brace '}' FILE: drivers/staging/rtl8723bs/os_dep/os_intfs.c:631. Signed-off-by: Ravi Kant Sharma Link: https://lore.kernel.org/r/20250714132834.79911-1-contact@r4v1.net Signed-off-by: Greg Kroah-Hartman commit 4bf0d122e646db2b9b855a6d93f372f95df05f6a Author: Jonathan Dupart Date: Mon Jul 14 15:23:41 2025 +0200 staging: rtl8723bs: hal: add spaces around ternary operator Adhere to Linux kernel coding style according to checkpatch : CHECK: spaces required around that ':' (ctx:VxV) Signed-off-by: Jonathan Dupart Link: https://lore.kernel.org/r/20250714132343.1613229-1-jonathan+kernel@dupart.org Signed-off-by: Greg Kroah-Hartman commit b56d3239e34171020de6e105ea1c2e7c44ae4a0b Author: Akhil Varkey Date: Mon Jul 14 15:56:03 2025 +0200 staging: greybus: power_supply fix alignment Fix checkpatch check "CHECK:Alignment should match open parenthesis" Signed-off-by: Akhil Varkey Link: https://lore.kernel.org/r/20250714135606.41671-1-akhilvarkey@disroot.org Signed-off-by: Greg Kroah-Hartman commit 1fd45d1efc73005ff180007b05c8a8c0af5f3244 Author: Abhinav Krishna C K Date: Mon Jul 14 15:45:32 2025 +0200 staging: greybus: Documentation: firmware: Move logical AND to previous line Fix checkpatch CHECK: "Logical continuations should be on the previous line" in firmware.c:123 Signed-off-by: Abhinav Krishna C K Link: https://lore.kernel.org/r/20250714134537.59218-1-me@abhy.me Signed-off-by: Greg Kroah-Hartman commit ee38e132719949fdb97c131bc1b970649e446e6c Author: Simon Chopin Date: Mon Jul 14 15:31:33 2025 +0200 staging: greybus: Documentation: firmware.c: fix whitespace alignments This addresses all instances of the checkpatch.pl warning "CHECK: Alignment should match open parenthesis" in this file. Signed-off-by: Simon Chopin Link: https://lore.kernel.org/r/20250714133148.442401-1-schopin@ubuntu.com Signed-off-by: Greg Kroah-Hartman commit 1b6766034c64d471f65fc692b808a7618cbd7bc3 Author: Nadzeya Hutsko Date: Mon Jul 14 15:24:09 2025 +0200 staging: vme_user: fixed alignment should match open parenthesis Fixed the scripts/checkpatch.pl warning in drivers/staging/vme_user/vme_fake.c:1064 Signed-off-by: Nadzeya Hutsko Link: https://lore.kernel.org/r/20250714132409.26875-1-nadzya.info@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9e233052608b6023dbe21ee6ff5ef51e70c96cdb Author: Michael Straube Date: Sun Jul 13 12:02:29 2025 +0200 staging: rtl8723bs: Efuse_WordEnableDataWrite() is not used The function Efuse_WordEnableDataWrite() defined in rtw_efuse.c is not used. Remove the function and code it is calling, i.e. the function pointer (*Efuse_WordEnableDataWrite) in struct hal_ops and the function Hal_EfuseWordEnableDataWrite() to which it points. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250713100229.13917-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit e70513bd98e3912b431b196e3cf53ac821598e6a Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:56 2025 +0200 gpio: zynqmp-modepin: set line value in .direction_output() It's ok to not do anything specific when setting direction but the callback should still respect the line value the user requests. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-19-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 680450b358b73823c82d150330aacc52e286be08 Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:55 2025 +0200 gpio: zynqmp-modepin: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-18-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 815c9769ba0e2e184eac570e596391a1ca58b8c8 Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:54 2025 +0200 gpio: zynq: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-17-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit ee6e05eb5fe27a45678848fb92a2a5db6b3fea84 Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:53 2025 +0200 gpio: zevio: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-16-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 383a02f6d421bf7703703aeb3e7270426b2fc30c Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:52 2025 +0200 gpio: xtensa: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-15-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 735ddc67ab88d35378cb79cfa5ac5f87db0775fb Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:51 2025 +0200 gpio: xtensa: remove unneeded .set() callback GPIO core deals just fine with input-only controllers not implementing the .set() callback. Remove the unneeded dummy implementation. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-14-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit ae8bcae8487293cb1de201734ab4779a2438618a Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:50 2025 +0200 gpio: xra1403: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-13-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 6d0f71cd58aaf107dab3ea5a50e9f725d4691043 Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:49 2025 +0200 gpio: xlp: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-12-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit c719fd3e3991b16460babf70036bf39cdbbb7a90 Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:48 2025 +0200 gpio: xlp: drop unneeded ngpio checks GPIO core already makes sure that offsets higher than the number of GPIOs are never passed to controller callbacks. We can remove the unnecessary check. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-11-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 1919ea19a4ff8d534fb2789453a69f86f70a493b Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:47 2025 +0200 gpio: xilinx: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-10-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 0933fc87f31da17871d6cf255dd9a3de86658685 Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:46 2025 +0200 gpio: xgene: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-9-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 47b427311d959fd3235485c08f367cd14df282ab Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:45 2025 +0200 gpio: wm8994: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-8-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit f7a680e9c2e512f903c385ed1a71732389788aa0 Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:44 2025 +0200 gpio: wm8350: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-7-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 023a24f83edf9abe0fbb66929d286cec5a09afbb Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:43 2025 +0200 gpio: wm831x: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-6-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit dd94adf7da36281b5d1bc40ee8ac265082576f4c Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:42 2025 +0200 gpio: winbond: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-5-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 637c3054e9a5337d303577584d575c247138dae9 Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:40 2025 +0200 gpio: wcd934x: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-3-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit ff0f0d7c6587e38c308be9905e36f86e98fb9c1f Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:39 2025 +0200 gpio: wcd934x: check the return value of regmap_update_bits() regmap_update_bits() can fail so check its return value in wcd_gpio_direction_output() for consistency with the rest of the code and propagate any errors. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-2-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit db12cdc8224845bbe31c1d7e5e7d2c2dde4847dc Author: Bartosz Golaszewski Date: Wed Jul 9 08:41:38 2025 +0200 gpio: vx855: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250709-gpiochip-set-rv-gpio-remaining-v1-1-b8950f69618d@linaro.org Signed-off-by: Bartosz Golaszewski commit 7828740b064ab30e9ea4593772d11cffdf2c129c Merge: 891667cefd16e7 e201c19ddeed6b Author: Takashi Iwai Date: Tue Jul 15 09:54:17 2025 +0200 Merge branch 'for-linus' into for-next Pull yet another HD-audio codec quirk update from 6.16 devel branch. Signed-off-by: Takashi Iwai commit 8db1d772484dfa959044dd43dc28482c8c543b74 Author: Namhyung Kim Date: Sun Jul 13 22:21:43 2025 -0700 perf ftrace latency: Add -e option to measure time between two events In addition to the function latency, it can measure events latencies. Some kernel tracepoints are paired and it's menningful to measure how long it takes between the two events. The latency is tracked for the same thread. Currently it only uses BPF to do the work but it can be lifted later. Instead of having separate a BPF program for each tracepoint, it only uses generic 'event_begin' and 'event_end' programs to attach to any (raw) tracepoints. $ sudo perf ftrace latency -a -b --hide-empty \ -e i915_request_wait_begin,i915_request_wait_end -- sleep 1 # DURATION | COUNT | GRAPH | 256 - 512 us | 4 | ###### | 2 - 4 ms | 2 | ### | 4 - 8 ms | 12 | ################### | 8 - 16 ms | 10 | ################ | # statistics (in usec) total time: 194915 avg time: 6961 max time: 12855 min time: 373 count: 28 Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250714052143.342851-1-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 10299c07c94aa0997fa43523b53301e713a6415d Author: Kees Cook Date: Sat Jun 28 16:40:38 2025 -0700 kunit/fortify: Add back "volatile" for sizeof() constants It seems the Clang can see through OPTIMIZER_HIDE_VAR when the constant is coming from sizeof. Adding "volatile" back to these variables solves this false positive without reintroducing the issues that originally led to switching to OPTIMIZER_HIDE_VAR in the first place[1]. Reported-by: Nathan Chancellor Closes: https://github.com/ClangBuiltLinux/linux/issues/2075 [1] Cc: Jannik Glückert Suggested-by: Nathan Chancellor Fixes: 6ee149f61bcc ("kunit/fortify: Replace "volatile" with OPTIMIZER_HIDE_VAR()") Reviewed-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250628234034.work.800-kees@kernel.org Signed-off-by: Kees Cook commit a55128d392e86507a0e6672ebcdf20d1dd77744b Author: Dave Martin Date: Tue Jul 1 14:56:16 2025 +0100 binfmt_elf: Warn on missing or suspicious regset note names Now that all regset definitions declare an explicit note name, warn if the note name is missing when generating a core dump. Simplify the fallback to always guess "LINUX", which is appropriate for all Linux-specific notes (i.e., all newly added notes, for a long time now). The one standard exception (PR_FPREG) will no longer have an "unexpected" note name overridden, but a warning will still be emitted. Also warn if the specified note name doesn't match the legacy pattern -- but don't bother to override the name in this case. This warning can be removed in future if new note types emerge that require a specific note name that is not "LINUX". No functional change, beyond the extra noise in dmesg and not overriding an unexpected note name for PR_FPREG any more. Now that all upstream arches are ported to use USER_REGSET_NOTE_TYPE(), new regsets created by copy-pasting existing code should end up correct by construction. Signed-off-by: Dave Martin Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-24-Dave.Martin@arm.com Signed-off-by: Kees Cook commit cb32fb722f4be5f5761ff1bf2fcde41de49cf1ef Author: Dave Martin Date: Tue Jul 1 14:56:15 2025 +0100 xtensa: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Chris Zankel Cc: Max Filippov Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-23-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 40d3a88594b5c1ec8feac4da269cba99b7c428fd Author: Dave Martin Date: Tue Jul 1 14:56:14 2025 +0100 um: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Richard Weinberger Cc: Anton Ivanov Cc: Johannes Berg Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: H. Peter Anvin Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-um@lists.infradead.org Cc: x86@kernel.org Acked-by: Johannes Berg Tested-by: Johannes Berg Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-22-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 3de0414dec7bf4da3e7bcdd155402233e8106229 Author: Dave Martin Date: Tue Jul 1 14:56:13 2025 +0100 x86/ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: H. Peter Anvin Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: x86@kernel.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-21-Dave.Martin@arm.com Signed-off-by: Kees Cook commit c9d4cb25e94e0c2a5ff3e3cdc7da624d42c3aa33 Author: Dave Martin Date: Tue Jul 1 14:56:12 2025 +0100 sparc: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: David S. Miller Cc: Andreas Larsson Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: sparclinux@vger.kernel.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-20-Dave.Martin@arm.com Signed-off-by: Kees Cook commit afe74eecd88f33fae3f277c52f010998e24daca0 Author: Dave Martin Date: Tue Jul 1 14:56:11 2025 +0100 sh: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Yoshinori Sato Cc: Rich Felker Cc: John Paul Adrian Glaubitz Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-sh@vger.kernel.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-19-Dave.Martin@arm.com Signed-off-by: Kees Cook commit d6a883cb40fc14e9b2996bafe733b684df70109c Author: Dave Martin Date: Tue Jul 1 14:56:10 2025 +0100 s390/ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Sven Schnelle Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-s390@vger.kernel.org Acked-by: Alexander Gordeev Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-18-Dave.Martin@arm.com Signed-off-by: Kees Cook commit c9502cc7bef53eea7305c4a3827e14f37f570562 Author: Dave Martin Date: Tue Jul 1 14:56:09 2025 +0100 riscv: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Albert Ou Cc: Alexandre Ghiti Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-riscv@lists.infradead.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-17-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 307035acefbd6ce31e6f7086c064a645a39ba980 Author: Dave Martin Date: Tue Jul 1 14:56:08 2025 +0100 powerpc/ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linuxppc-dev@lists.ozlabs.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-16-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 92acdd819b5d7e5052426c631806977fdf98f7e5 Author: Dave Martin Date: Tue Jul 1 14:56:07 2025 +0100 parisc: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: James E.J. Bottomley Cc: Helge Deller Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-parisc@vger.kernel.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-15-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 10cd957a895fa88f053e210bbe39986a176401f2 Author: Dave Martin Date: Tue Jul 1 14:56:06 2025 +0100 openrisc: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Jonas Bonn Cc: Stefan Kristiansson Cc: Stafford Horne Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-openrisc@vger.kernel.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-14-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 8368cd0e4636c75a585804cb882925e373d1cb62 Author: Dave Martin Date: Tue Jul 1 14:56:05 2025 +0100 nios2: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Dinh Nguyen Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-13-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 18bd88faa24619b2c3601fad0e9d79629ff6f652 Author: Dave Martin Date: Tue Jul 1 14:56:04 2025 +0100 MIPS: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Thomas Bogendoerfer Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-mips@vger.kernel.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-12-Dave.Martin@arm.com Signed-off-by: Kees Cook commit e572168e8d2a2f17f7ddcd15680ee2b87a282f3c Author: Dave Martin Date: Tue Jul 1 14:56:03 2025 +0100 m68k: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Geert Uytterhoeven Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-m68k@lists.linux-m68k.org Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-11-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 1260e3b135848d4cecb0eee5a2fdd2cb823401e7 Author: Dave Martin Date: Tue Jul 1 14:56:02 2025 +0100 LoongArch: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Huacai Chen Cc: WANG Xuerui Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: loongarch@lists.linux.dev Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-10-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 55821111b1b3d8eaa77751b15d064fd58a36fcf3 Author: Dave Martin Date: Tue Jul 1 14:56:01 2025 +0100 hexagon: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Brian Cain Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-hexagon@vger.kernel.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-9-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 2c2fb861fc5942766c2b03bb03d5d8e2f7f865a8 Author: Dave Martin Date: Tue Jul 1 14:56:00 2025 +0100 csky: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Guo Ren Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-csky@vger.kernel.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-8-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 87b0d081dc981191c82780eb482e9d04c5837a6d Author: Dave Martin Date: Tue Jul 1 14:55:59 2025 +0100 arm64: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. This does not affect the correctness of switch(note_type) and similar code, since note type values known to Linux for coredump purposes were already required to be unique. Signed-off-by: Dave Martin Cc: Catalin Marinas Cc: Will Deacon Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-arm-kernel@lists.infradead.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-7-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 49b849d11cd1f89d923e4bcb42500328f5b36b95 Author: Dave Martin Date: Tue Jul 1 14:55:58 2025 +0100 ARM: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Russell King Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-arm-kernel@lists.infradead.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-6-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 237dc8d7962727c1d532238236e3815ecb6e6c9e Author: Dave Martin Date: Tue Jul 1 14:55:57 2025 +0100 ARC: ptrace: Use USER_REGSET_NOTE_TYPE() to specify regset note names Instead of having the core code guess the note name for each regset, use USER_REGSET_NOTE_TYPE() to pick the correct name from elf.h. Signed-off-by: Dave Martin Cc: Vineet Gupta Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Cc: linux-snps-arc@lists.infradead.org Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-5-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 9674a1be4dd57579cee2aecfa1480e7790105078 Author: Dave Martin Date: Tue Jul 1 14:55:56 2025 +0100 binfmt_elf: Dump non-arch notes with strictly matching name and type The note names for some arch-independent coredump notes are specified manually, albeit by referring to the NN_ #define corresponding to the NT_ #define that specifies the note type. Now that there are no exceptional cases, refactor fill_note() to pick the correct NN_ and NT_ macros implcitly for the requested note type. Signed-off-by: Dave Martin Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-4-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 85a7f9cbf8a83cfe0aca04053a832206c4ad1272 Author: Dave Martin Date: Tue Jul 1 14:55:55 2025 +0100 regset: Add explicit core note name in struct user_regset There is currently hard-coded logic spread around the tree for determining the note name for regset notes emitted in coredumps. Now that the names are declared explicitly in , this can be simplified. In preparation for getting rid of the special-case logic, add an explicit core_note_name field in struct user_regset for specifying the note name explicitly. To help avoid mistakes, a convenience macro USER_REGSET_NOTE_TYPE() is provided to set .core_note_type and .core_note_name based on the note type. When dumping core, use the new field to set the note name, if the regset specifies it. Signed-off-by: Dave Martin Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Acked-by: Alexander Gordeev # s390 Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-3-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 6fd9e1aa078490ed6e79307465269629fcb43018 Author: Dave Martin Date: Tue Jul 1 14:55:54 2025 +0100 regset: Fix kerneldoc for struct regset_get() in user_regset Commit 7717cb9bdd04 ("regset: new method and helpers for it") added a new interface ->regset_get() for struct user_regset, and commit 1e6986c9db21 ("regset: kill ->get()") got rid of the old interface. The kerneldoc comment block was never updated to take account of this change, though. Update it. No functional change. Signed-off-by: Dave Martin Cc: Oleg Nesterov Cc: Kees Cook Cc: Akihiko Odaki Reviewed-by: Akihiko Odaki Link: https://lore.kernel.org/r/20250701135616.29630-2-Dave.Martin@arm.com Signed-off-by: Kees Cook commit 7a3cedafccf8e7d038ad4cfec5b38052647ceac5 Author: Breno Leitao Date: Fri Mar 21 02:30:49 2025 -0700 lockdep: Speed up lockdep_unregister_key() with expedited RCU synchronization lockdep_unregister_key() is called from critical code paths, including sections where rtnl_lock() is held. For example, when replacing a qdisc in a network device, network egress traffic is disabled while __qdisc_destroy() is called for every network queue. If lockdep is enabled, __qdisc_destroy() calls lockdep_unregister_key(), which gets blocked waiting for synchronize_rcu() to complete. For example, a simple tc command to replace a qdisc could take 13 seconds: # time /usr/sbin/tc qdisc replace dev eth0 root handle 0x1: mq real 0m13.195s user 0m0.001s sys 0m2.746s During this time, network egress is completely frozen while waiting for RCU synchronization. Use synchronize_rcu_expedited() instead to minimize the impact on critical operations like network connectivity changes. This improves 10x the function call to tc, when replacing the qdisc for a network card. # time /usr/sbin/tc qdisc replace dev eth0 root handle 0x1: mq real 0m1.789s user 0m0.000s sys 0m1.613s [boqun: Fixed the comment and add more information for the temporary workaround, and add TODO information for hazptr] Reported-by: Erik Lundgren Signed-off-by: Breno Leitao Reviewed-by: Paul E. McKenney Reviewed-by: Eric Dumazet Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250321-lockdep-v1-1-78b732d195fb@debian.org commit 1dfe5ea6dbb3e03073f5426d65394694683b8692 Author: Ran Xiaokai Date: Fri Jul 4 01:52:18 2025 +0000 locking/mutex: Remove redundant #ifdefs hung_task_{set,clear}_blocker() is already guarded by CONFIG_DETECT_HUNG_TASK_BLOCKER in hung_task.h, So remove the redudant check of #ifdef. Signed-off-by: Ran Xiaokai Acked-by: Waiman Long Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250704015218.359754-1-ranxiaokai627@163.com commit bd27cfb58c2803923702cd80289b35b7b8108859 Author: Arnd Bergmann Date: Wed Apr 9 14:22:58 2025 +0200 locking/lockdep: Change 'static const' variables to enum values gcc warns about 'static const' variables even in headers when building with -Wunused-const-variables enabled: In file included from kernel/locking/lockdep_proc.c:25: kernel/locking/lockdep_internals.h:69:28: error: 'LOCKF_USED_IN_IRQ_READ' defined but not used [-Werror=unused-const-variable=] 69 | static const unsigned long LOCKF_USED_IN_IRQ_READ = | ^~~~~~~~~~~~~~~~~~~~~~ kernel/locking/lockdep_internals.h:63:28: error: 'LOCKF_ENABLED_IRQ_READ' defined but not used [-Werror=unused-const-variable=] 63 | static const unsigned long LOCKF_ENABLED_IRQ_READ = | ^~~~~~~~~~~~~~~~~~~~~~ kernel/locking/lockdep_internals.h:57:28: error: 'LOCKF_USED_IN_IRQ' defined but not used [-Werror=unused-const-variable=] 57 | static const unsigned long LOCKF_USED_IN_IRQ = | ^~~~~~~~~~~~~~~~~ kernel/locking/lockdep_internals.h:51:28: error: 'LOCKF_ENABLED_IRQ' defined but not used [-Werror=unused-const-variable=] 51 | static const unsigned long LOCKF_ENABLED_IRQ = | ^~~~~~~~~~~~~~~~~ This one is easy to avoid by changing the generated constant definition into an equivalent enum. Tested-by: Andy Shevchenko Signed-off-by: Arnd Bergmann Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250409122314.2848028-6-arnd@kernel.org commit d7c36d6350b5a4b27256eaeeea3b72621a819c9a Author: Arnd Bergmann Date: Tue Jun 10 11:29:21 2025 +0200 locking/lockdep: Avoid struct return in lock_stats() Returning a large structure from the lock_stats() function causes clang to have multiple copies of it on the stack and copy between them, which can end up exceeding the frame size warning limit: kernel/locking/lockdep.c:300:25: error: stack frame size (1464) exceeds limit (1280) in 'lock_stats' [-Werror,-Wframe-larger-than] 300 | struct lock_class_stats lock_stats(struct lock_class *class) Change the calling conventions to directly operate on the caller's copy, which apparently is what gcc does already. Signed-off-by: Arnd Bergmann Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250610092941.2642847-1-arnd@kernel.org commit 3f66b5b401b58c38f613563e7d01719dfa6b9e52 Author: Rob Herring (Arm) Date: Thu Jul 10 13:07:55 2025 -0500 dt-bindings: interrupt-controller: Convert apm,xgene1-msi to DT schema Convert the Applied Micro X-Gene MSI controller binding to DT schema format. MSI controllers go in interrupt-controller directory so move the schema there. Link: https://lore.kernel.org/r/20250710180757.2970583-1-robh@kernel.org Signed-off-by: Rob Herring (Arm) commit b12f423d598fd874df9ecfb2436789d582fda8e6 Author: Zhang Yi Date: Mon Jul 7 22:08:14 2025 +0800 ext4: limit the maximum folio order In environments with a page size of 64KB, the maximum size of a folio can reach up to 128MB. Consequently, during the write-back of folios, the 'rsv_blocks' will be overestimated to 1,577, which can make pressure on the journal space where the journal is small. This can easily exceed the limit of a single transaction. Besides, an excessively large folio is meaningless and will instead increase the overhead of traversing the bhs within the folio. Therefore, limit the maximum order of a folio to 2048 filesystem blocks. Reported-by: Naresh Kamboju Reported-by: Joseph Qi Closes: https://lore.kernel.org/linux-ext4/CA+G9fYsyYQ3ZL4xaSg1-Tt5Evto7Zd+hgNWZEa9cQLbahA1+xg@mail.gmail.com/ Signed-off-by: Zhang Yi Tested-by: Joseph Qi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250707140814.542883-12-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit a7ce9ca1aaf93d55e32e915700d0ef9f69a781c9 Author: Svyatoslav Ryhel Date: Mon Jul 14 11:17:11 2025 +0300 drivers: cpufreq: add Tegra114 support Tegra114 is fully compatible with existing Tegra124 cpufreq driver. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Thierry Reding Signed-off-by: Viresh Kumar commit a507f8230d60d7e21aac390ee83eb625cb6021d9 Author: Ritvik Gupta Date: Mon Jul 14 00:32:44 2025 +0530 rust: cpumask: Replace `MaybeUninit` and `mem::zeroed` with `Opaque` APIs Replace the following unsafe initializations: 1. `MaybeUninit::uninit().assume_init()` with `Opaque::uninit()` 2. `core::mem::zeroed()` with `Opaque::zeroed()` Suggested-by: Benno Lossin Link: https://github.com/Rust-for-Linux/linux/issues/1178 Suggested-by: Alice Ryhl Link: https://lore.kernel.org/rust-for-linux/CAH5fLgj0OoCn56OkNUmiPQ=RAVa_VmS-yMZ4TNBSpGPNtZ5D0A@mail.gmail.com/ Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Signed-off-by: Ritvik Gupta Signed-off-by: Viresh Kumar commit e7ffc0af0e722b4634f997dcf63594b3c65a5884 Author: Andreas Gruenbacher Date: Mon Jun 23 22:20:55 2025 +0200 gfs2: a minor finish_xmote cleanup As a minor clean-up to commit 1fc05c8d8426 ("gfs2: cancel timed-out glock requests"), when a demote request is in progress in finish_xmote(), there is no point in waking up the glock holder at the head of the queue because the reply from dlm cannot be on behalf of that glock holder. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 92cef39bb3c1734a9b55693047720198c90f8a4f Author: Andreas Gruenbacher Date: Tue Jun 24 20:41:37 2025 +0200 gfs2: simplify finish_xmote As a follow-up to commit a431d49243a0 ("gfs2: Fix request cancelation bug"), it turns out that any call to finish_xmote() is always followed by a call to run_queue(), either * directly when glock_work_func() calls finish_xmote() before calling run_queue(), or * indirectly when do_xmote() calls finish_xmote() before calling gfs2_glock_queue_work(), which queues a call to glock_work_func() in work queue context, so remove the code in finish_xmote() that duplicates the functionality of run_queue(). In addition, the code this commit removes is missing a check for the GLF_DEMOTE flag which indicates that no further promotes should be performed, so if that code didn't get removed, that check would have to be added. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 6e417b3eb836432860284edb75c48f436adb4feb Author: Andreas Gruenbacher Date: Wed Jun 25 14:41:58 2025 +0200 gfs2: sanitize the gdlm_ast -> finish_xmote interface When gdlm_ast() is called with a non-zero status code, this means that the requested operation did not succeed and the current lock state didn't change. Turn that into a non-zero LM_OUT_* status code (with ret & ~LM_OUT_ST_MASK != 0) instead of pretending that dlm returned the current lock state. That way, we can easily change finish_xmote() to only update gl->gl_state when the state has actually changed. Signed-off-by: Andreas Gruenbacher Reviewed-by: Andrew Price commit 02eb7a8eee20b9ec6aafd5e17c5c41b53e8b13ef Author: Gerd Hoffmann Date: Fri Jul 11 07:44:46 2025 +0200 efi: add API doc entry for ovmf_debug_log Document the newly added sysfs ABI for accessing the in-memory debug log provided by OVMF EFI firmware (when enabled) Signed-off-by: Gerd Hoffmann Acked-by: Jonathan Corbet Signed-off-by: Ard Biesheuvel commit 526b000991b557c40ea53e64ba24bb9e0fff0071 Author: Bitterblue Smith Date: Sun Jul 13 22:27:32 2025 +0300 wifi: rtw88: Fix macid assigned to TDLS station When working in station mode, TDLS peers are assigned macid 0, even though 0 was already assigned to the AP. This causes the connection with the AP to stop working after the TDLS connection is torn down. Assign the next available macid to TDLS peers, same as client stations in AP mode. Fixes: 902cb7b11f9a ("wifi: rtw88: assign mac_id for vif/sta and update to TX desc") Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/58648c09-8553-4bcc-a977-9dc9afd63780@gmail.com commit 5f936768300f65d5856d6adf0f8591e2ae716727 Author: Andrey Skvortsov Date: Fri Jul 11 11:47:40 2025 +0300 wifi: rtw88: enable TX reports for the management queue This is needed for AP mode. Otherwise client sees the network, but can't connect to it. REG_FWHW_TXQ_CTRL+1 is set to WLAN_TXQ_RPT_EN (0x1F) in common mac init function (__rtw8723x_mac_init), but the value was overwritten from mac table later. Tables with register values for phy parameters initialization are copied from vendor driver usually. When table will be regenerated, manual modifications to it may be lost. To avoid regressions in this case new callback mac_postinit is introduced, that is called after parameters from table are set. Tested on rtl8723cs, that reuses rtw8703b driver. Signed-off-by: Andrey Skvortsov Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250711084740.3396766-1-andrej.skvortzov@gmail.com commit d76a1abcf57734d2bcd4a7ec051617edd4513d7f Author: Martin Kaistra Date: Wed Jul 9 14:15:22 2025 +0200 wifi: rtl8xxxu: Fix RX skb size for aggregation disabled Commit 1e5b3b3fe9e0 ("rtl8xxxu: Adjust RX skb size to include space for phystats") increased the skb size when aggregation is enabled but decreased it for the aggregation disabled case. As a result, if a frame near the maximum size is received, rtl8xxxu_rx_complete() is called with status -EOVERFLOW and then the driver starts to malfunction and no further communication is possible. Restore the skb size in the aggregation disabled case. Fixes: 1e5b3b3fe9e0 ("rtl8xxxu: Adjust RX skb size to include space for phystats") Signed-off-by: Martin Kaistra Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250709121522.1992366-1-martin.kaistra@linutronix.de commit cefcf74ae02623a80acffe5f662ed6523575ed46 Author: Zong-Zhe Yang Date: Thu Jul 10 12:24:23 2025 +0800 wifi: rtw89: 8852b: implement RFK multi-channel handling and support chanctx up to 2 To support multiple channels, 2 for this case, RFK requires to record each calibration result for each channel in different RFK tables, and also needs to notify FW. Then, when FW runs in MCC (multi-channel concurrency), it can switch to the corresponding calibration result according to the channel. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-15-pkshih@realtek.com commit 504937dbaddb2149d5031e924100e285d7325eef Author: Zong-Zhe Yang Date: Thu Jul 10 12:24:22 2025 +0800 wifi: rtw89: 8852b: configure FW version for SCAN_OFFLOAD_EXTRA_OP feature After v0.29.128.0, RTL8852B FW supports SCAN_OFFLOAD_EXTRA_OP feature. With it, FW can do back-op and TX NULL frames on the second connection. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-14-pkshih@realtek.com commit 21911ad80512f9e4e642b9e8ecd7130e32cb63d3 Author: Zong-Zhe Yang Date: Thu Jul 10 12:24:21 2025 +0800 wifi: rtw89: 8852bt: implement RFK multi-channel handling and support chanctx up to 2 To support multiple channels, 2 for this case, RFK requires to record each calibration result for each channel in different RFK tables, and also needs to notify FW. Then, when FW runs in MCC (multi-channel concurrency), it can switch to the corresponding calibration result according to the channel. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-13-pkshih@realtek.com commit 868676662b08f43cd26a2bc3492d6a7fa1eb3414 Author: Zong-Zhe Yang Date: Thu Jul 10 12:24:20 2025 +0800 wifi: rtw89: 8852bt: configure FW version for SCAN_OFFLOAD_EXTRA_OP feature After v0.29.127.0, RTL8852BT FW supports SCAN_OFFLOAD_EXTRA_OP feature. With it, FW can do back-op and TX NULL frames on the second connection. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-12-pkshih@realtek.com commit 094bb62c580dc6608736c6df4d4f238386050bf4 Author: Chih-Kang Chang Date: Thu Jul 10 12:24:19 2025 +0800 wifi: rtw89: tweak tx wake notify matching condition 8852BT needs to call TX wake notify once entering Leisure Power Save. 8852C needs to call TX wake notify after entering low power mode. Other AX chips only MGMT packets needs to call TX wake after entering low power mode. BE chips no need to call TX wake. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-11-pkshih@realtek.com commit e044f5d40f49bfd4beab517e7fe2988d3d8ce66d Author: Chih-Kang Chang Date: Thu Jul 10 12:24:18 2025 +0800 wifi: rtw89: update SER L2 type default value 8852BT after FW 0.29.127, 8852B after FW 0.29.128 and 8922A after FW 0.35.79, the SER L2 flow determines different L2 types by parameter, the zero value will trigger FW SER L2 assert. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-10-pkshih@realtek.com commit 06baf9bfa6ca8db7d5f32e12e27d1dc1b7cb3a8a Merge: a86eb2a60dcc2e 906893cf2cf275 Author: Jakub Kicinski Date: Mon Jul 14 18:40:51 2025 -0700 Merge branch 'tcp-receiver-changes' Eric Dumazet says: ==================== tcp: receiver changes Before accepting an incoming packet: - Make sure to not accept a packet beyond advertized RWIN. If not, increment a new SNMP counter (LINUX_MIB_BEYOND_WINDOW) - ooo packets should update rcv_mss and tp->scaling_ratio. - Make sure to not accept packet beyond sk_rcvbuf limit. This series includes three associated packetdrill tests. ==================== Link: https://patch.msgid.link/20250711114006.480026-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 906893cf2cf275bf33eeff2c76a621c4b60c9bba Author: Eric Dumazet Date: Fri Jul 11 11:40:06 2025 +0000 selftests/net: packetdrill: add tcp_rcv_toobig.pkt Check that TCP receiver behavior after "tcp: stronger sk_rcvbuf checks" Too fat packet is dropped unless receive queue is empty. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250711114006.480026-9-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1d2fbaad7cd8cc96899179f9898ad2787a15f0a0 Author: Eric Dumazet Date: Fri Jul 11 11:40:05 2025 +0000 tcp: stronger sk_rcvbuf checks Currently, TCP stack accepts incoming packet if sizes of receive queues are below sk->sk_rcvbuf limit. This can cause memory overshoot if the packet is big, like an 1/2 MB BIG TCP one. Refine the check to take into account the incoming skb truesize. Note that we still accept the packet if the receive queue is empty, to not completely freeze TCP flows in pathological conditions. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250711114006.480026-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit 75dff0584cce79203ee9968c66c7589150fed591 Author: Eric Dumazet Date: Fri Jul 11 11:40:04 2025 +0000 tcp: add const to tcp_try_rmem_schedule() and sk_rmem_schedule() skb These functions to not modify the skb, add a const qualifier. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250711114006.480026-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit 445e0cc38d498e341f36f2e3a9cacf1ddf0b09b6 Author: Eric Dumazet Date: Fri Jul 11 11:40:03 2025 +0000 selftests/net: packetdrill: add tcp_ooo_rcv_mss.pkt We make sure tcpi_rcv_mss and tp->scaling_ratio are correctly updated if no in-order packet has been received yet. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250711114006.480026-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 38d7e444336567bae1c7b21fc18b7ceaaa5643a0 Author: Eric Dumazet Date: Fri Jul 11 11:40:02 2025 +0000 tcp: call tcp_measure_rcv_mss() for ooo packets tcp_measure_rcv_mss() is used to update icsk->icsk_ack.rcv_mss (tcpi_rcv_mss in tcp_info) and tp->scaling_ratio. Calling it from tcp_data_queue_ofo() makes sure these fields are updated, and permits a better tuning of sk->sk_rcvbuf, in the case a new flow receives many ooo packets. Fixes: dfa2f0483360 ("tcp: get rid of sysctl_tcp_adv_win_scale") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250711114006.480026-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit f5fda1a86884cf20d9b5842221b963bb16bcebf1 Author: Eric Dumazet Date: Fri Jul 11 11:40:01 2025 +0000 selftests/net: packetdrill: add tcp_rcv_big_endseq.pkt This test checks TCP behavior when receiving a packet beyond the window. It checks the new TcpExtBeyondWindow SNMP counter. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250711114006.480026-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6c758062c64dfbd61862801fbde4e0702f4f3a23 Author: Eric Dumazet Date: Fri Jul 11 11:40:00 2025 +0000 tcp: add LINUX_MIB_BEYOND_WINDOW Add a new SNMP MIB : LINUX_MIB_BEYOND_WINDOW Incremented when an incoming packet is received beyond the receiver window. nstat -az | grep TcpExtBeyondWindow Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250711114006.480026-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9ca48d616ed76b284f946667a3cb7961205c8ee3 Author: Eric Dumazet Date: Fri Jul 11 11:39:59 2025 +0000 tcp: do not accept packets beyond window Currently, TCP accepts incoming packets which might go beyond the offered RWIN. Add to tcp_sequence() the validation of packet end sequence. Add the corresponding check in the fast path. We relax this new constraint if the receive queue is empty, to not freeze flows from buggy peers. Add a new drop reason : SKB_DROP_REASON_TCP_INVALID_END_SEQUENCE. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250711114006.480026-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5693bdd58de48bc91831d8d2e60f78595205c6eb Author: Zong-Zhe Yang Date: Thu Jul 10 12:24:17 2025 +0800 wifi: rtw89: introduce fw feature group and redefine CRASH_TRIGGER Some FW features may have variants on how to deal with in leaf functions, e.g. H2C commands. However, from SW component point of view, it might not matter which variant is supported exactly. In some cases, SW component may just care whether any of the variants is supported or not. So, introduce a concept of FW feature group which can manage a set of FW features and can easily be checked if at least one of them is supported. Since CRASH_TRIGGER will have variants and then matches the case mentioned above, so redefine CRASH_TRIGGER as a FW feature group and add a variant of type 0 for original handling. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-9-pkshih@realtek.com commit 86bc643afd72c28c25831c87df6e6d0b016c5004 Author: Aaron Kling Date: Tue Jul 8 02:30:42 2025 -0500 efistub: Lower default log level Some uefi implementations will write the efistub logs to the display over a splash image. This is not desirable for debug and info logs, so lower the default efi log level to exclude them. Suggested-by: Ard Biesheuvel Signed-off-by: Aaron Kling Signed-off-by: Ard Biesheuvel commit 65093fab65cb79d6ae6abaefc5ebe0427cbd1c5a Author: Chih-Kang Chang Date: Thu Jul 10 12:24:16 2025 +0800 wifi: rtw89: check LPS H2C command complete by C2H reg instead of done ack 8852B after FW 0.29.127, 8852BT after FW 0.29.127 and 8922A after FW 0.35.76 driver check LPS H2C command received by FW using C2H reg instead of done ack. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-8-pkshih@realtek.com commit 83f84f263420b4a11c1b3c1ba0723c3d374b33ad Author: Chih-Kang Chang Date: Thu Jul 10 12:24:15 2025 +0800 wifi: rtw89: mcc: solve GO's TBTT change and TBTT too close to NoA issue For some implementation acting as GO under MCC(GO+STA), the GO's TBTT might change after STA roams to another AP. This could result the new GO beacon TX at the STA timeslot of GC+STA, causing GC beacon loss. Therefore, if the GC detects beacon loss, it will pause MCC and remain on the GO side for 100 TU to detect the new TBTT beacon. Additionally, some implementation acting as GO under MCC might TX beacon too close to the NoA period. The GC calculates timeslot pattern the TOB (time offset behind) or TOA(time offset ahead) less than the minimum RX beacon time, which leads to beacon loss. Therefore, disable the beacon filter in this case. Then, if the GO's TBTT changed, the pattern TOB/TOA greater than the minimum RX beacon time, the beacon filter should be retriggered during MCC update. Moreover, if the beacon filter is disabled initially but the GO timeslot change, causing QoS null data detection fail, also pause MCC to detect new TBTT beacon. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-7-pkshih@realtek.com commit d0b87d9eaf76703b81e511d05db29a5e7ef6c3e0 Author: Chih-Kang Chang Date: Thu Jul 10 12:24:14 2025 +0800 wifi: rtw89: extend HW scan of WiFi 7 chips for extra OP chan when concurrency HW scan of WiFi 7 chips supports multiple op channel configurations. When concurrency, fill two channels info to HW scan to avoid packet lost. However, the OP chan timing is arranged by FW, and the actual stay period depends on AP. It's hard to calculate total scan time for once NoA in advance. Therefore, change the scan back to GO OP channel every 200TU and TX beacon to ensure GC doesn't beacon loss. Additionally, add a period NoA with large duration to ensure GC doesn't TX packet during GO scanning and can still listen beacon at TBTT to update the new NoA info after scan complete. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-6-pkshih@realtek.com commit 6332feafe37fdd0a336ab01b42fdfb5e6b8ee083 Author: Chih-Kang Chang Date: Thu Jul 10 12:24:13 2025 +0800 wifi: rtw89: mcc: when MCC stop forcing to stay at GO role MCC stop might triggered by scan, and need to force to stay at GO role to keep TX beacon. Also, AX chips need to TX more 3 beacons to ensure GC can receive once NoA beacon before scan when GC in courtesy mode. BE chips no needs to TX 3 more beacon because it can TX beacon every 200TU during scan, even GC in courtesy mode can receive beacon every 600TU. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-5-pkshih@realtek.com commit 025e39032df5cc5c110de3693f63e81cf49968be Author: Chih-Kang Chang Date: Thu Jul 10 12:24:12 2025 +0800 wifi: rtw89: mcc: enlarge GO NoA duration to cover channel switching time MCC require time to switch channel when changing timeslot. If GC TX nulldata 0 while GO is switching channel, GO can't receive it. Therefore, enlarge the GO NoA duration to cover the channel switching time. However, the enlarged NoA duration might cause GC's timeslot less than minimum of RX beacon time. Therefore, adjust strict and anchor pattern condition to avoid it. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-4-pkshih@realtek.com commit 9126020ab03c60053819c19294f46fc6ce11b52e Author: Chih-Kang Chang Date: Thu Jul 10 12:24:11 2025 +0800 wifi: rtw89: add DIG suspend/resume flow when scan and connection The PD lower bound set after one interface is connected, If second interface needs to connect, packets might not be detected because the PD lower bound is too high. Therefore, a DIG suspend/resume flow is added to decrease the PD lower bound during scanning or connection, and the original PD level is resumed afterward. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-3-pkshih@realtek.com commit ad22869bc5a64a5a51f27951ced772499b2bf4bc Author: Chih-Kang Chang Date: Thu Jul 10 12:24:10 2025 +0800 wifi: rtw89: mcc: add H2C command to support different PD level in MCC Packet detection(PD) lower bound is the threshold for sensing packet, and it is dynamically calculated based on RSSI. In MCC, the two interfaces have different RSSI values, so it is necessary to set different values to ensure packets can be received. Therefore, add H2C command to let firmware to switch PD lower bound when MCC mode. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250710042423.73617-2-pkshih@realtek.com commit a86eb2a60dcc2e23d86d24272d474f0ddecc824e Author: Arnd Bergmann Date: Fri Jul 11 10:23:34 2025 +0200 net: wangxun: fix LIBWX dependencies again Two more drivers got added that use LIBWX and cause a build warning WARNING: unmet direct dependencies detected for LIBWX Depends on [m]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_WANGXUN [=y] && PTP_1588_CLOCK_OPTIONAL [=m] Selected by [y]: - NGBEVF [=y] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_WANGXUN [=y] && PCI_MSI [=y] Selected by [m]: - NGBE [=m] && NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_WANGXUN [=y] && PCI [=y] && PTP_1588_CLOCK_OPTIONAL [=m] ld: drivers/net/ethernet/wangxun/libwx/wx_lib.o: in function `wx_clean_tx_irq': wx_lib.c:(.text+0x5a68): undefined reference to `ptp_schedule_worker' ld: drivers/net/ethernet/wangxun/libwx/wx_ethtool.o: in function `wx_nway_reset': wx_ethtool.c:(.text+0x880): undefined reference to `phylink_ethtool_nway_reset' Add the same dependency on PTP_1588_CLOCK_OPTIONAL to the two driver using this library module, following the pattern from commit 8fa19c2c69fb ("net: wangxun: fix LIBWX dependencies"). Fixes: 377d180bd71c ("net: wangxun: add txgbevf build") Fixes: a0008a3658a3 ("net: wangxun: add ngbevf build") Signed-off-by: Arnd Bergmann Reviewed-by: Simon Horman Tested-by: Simon Horman # build-tested Link: https://patch.msgid.link/20250711082339.1372821-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit b99d7cd36da835544da02d75b6398eb7b26412ee Author: Zong-Zhe Yang Date: Wed Jul 9 14:50:06 2025 +0800 wifi: rtw89: regd/acpi: support 6 GHz VLP policy via ACPI DSM Process ACPI DSM function 11 to get 6 GHz VLP support by country. If not allowed, return error to block the connection. By default, i.e. ACPI DSM function is not configured, disallow 6 GHz VLP on country US and country CA, because some platform-level certifications are needed in FCC regulation before operating on 6 GHz VLP connection. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250709065006.32028-5-pkshih@realtek.com commit 08fbc2b6881b5228cb961b1efa6cb4bf41193105 Author: Zong-Zhe Yang Date: Wed Jul 9 14:50:05 2025 +0800 wifi: rtw89: regd/acpi: support regulatory rules via ACPI DSM and parse rule of regd_UK ACPI DSM function 10 is defined for the enablement for Realtek regulatory rules. The first rule is whether to allow regd_UK regulatory settings or not. If not, the strict one, i.e. regd_ETSI, regulatory settings will be used on country GB. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250709065006.32028-4-pkshih@realtek.com commit 01186c303ba363262d546eadd0adde6f37df91b2 Author: Zong-Zhe Yang Date: Wed Jul 9 14:50:04 2025 +0800 wifi: rtw89: regd/acpi: update field definition to specific country in UNII-4 conf Originally, fields of ACPI DSM function 6 were handled for countries following specific regulatory. BIT(0) for countries following FCC regulatory BIT(1) for countries following IC regulatory Now, update to the following (one field for one specific country). BIT(0) for country US BIT(1) for country CA Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250709065006.32028-3-pkshih@realtek.com commit 75bb7774a16b1e835f67baff6f5174ca17491db6 Author: Zong-Zhe Yang Date: Wed Jul 9 14:50:03 2025 +0800 wifi: rtw89: regd/acpi: support country CA by BIT(1) in 6 GHz SP conf ACPI DSM function 7 is used to decide whether 6 GHz Standard Power (SP) is allowed on given countries. Now, add BIT(1) for country CA. Besides, for searching country index, replace for-loop with index getter function. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250709065006.32028-2-pkshih@realtek.com commit add4c4850363d7c1b72e8fce9ccb21fdd2cf5dc9 Author: jackysliu <1972843537@qq.com> Date: Tue Jun 24 19:58:24 2025 +0800 scsi: bfa: Double-free fix When the bfad_im_probe() function fails during initialization, the memory pointed to by bfad->im is freed without setting bfad->im to NULL. Subsequently, during driver uninstallation, when the state machine enters the bfad_sm_stopping state and calls the bfad_im_probe_undo() function, it attempts to free the memory pointed to by bfad->im again, thereby triggering a double-free vulnerability. Set bfad->im to NULL if probing fails. Signed-off-by: jackysliu <1972843537@qq.com> Link: https://lore.kernel.org/r/tencent_3BB950D6D2D470976F55FC879206DE0B9A09@qq.com Signed-off-by: Martin K. Petersen commit 2677010e7793451c20d895c477c4dc76f6e6a10e Author: Samiullah Khawaja Date: Thu Jul 10 21:12:03 2025 +0000 Add support to set NAPI threaded for individual NAPI A net device has a threaded sysctl that can be used to enable threaded NAPI polling on all of the NAPI contexts under that device. Allow enabling threaded NAPI polling at individual NAPI level using netlink. Extend the netlink operation `napi-set` and allow setting the threaded attribute of a NAPI. This will enable the threaded polling on a NAPI context. Add a test in `nl_netdev.py` that verifies various cases of threaded NAPI being set at NAPI and at device level. Tested ./tools/testing/selftests/net/nl_netdev.py TAP version 13 1..7 ok 1 nl_netdev.empty_check ok 2 nl_netdev.lo_check ok 3 nl_netdev.page_pool_check ok 4 nl_netdev.napi_list_check ok 5 nl_netdev.dev_set_threaded ok 6 nl_netdev.napi_set_threaded ok 7 nl_netdev.nsim_rxq_reset_down # Totals: pass:7 fail:0 xfail:0 xpass:0 skip:0 error:0 Signed-off-by: Samiullah Khawaja Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250710211203.3979655-1-skhawaja@google.com Signed-off-by: Jakub Kicinski commit b99a50672513a1445ce777041e3b4d2f829a40d6 Merge: 063bec4444d54e 5a6f304f39c24c Author: Martin K. Petersen Date: Mon Jul 14 21:00:41 2025 -0400 Merge patch series "ufs: ufs-qcom: Align programming sequence as per HW spec" Nitin Rawat says: This patch series adds programming support for Qualcomm UFS to align with Hardware Specification. In this patch series below changes are taken care. 1. Enable QUnipro Internal Clock Gating 2. Update esi_vec_mask for HW major version >= 6 Link: https://lore.kernel.org/r/20250714075336.2133-1-quic_nitirawa@quicinc.com Signed-off-by: Martin K. Petersen commit 063bec4444d54e5f35d11949c5c90eaa1ff84c11 Author: Thomas Fourier Date: Fri Jun 27 16:24:47 2025 +0200 scsi: isci: Fix dma_unmap_sg() nents value The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: ddcc7e347a89 ("isci: fix dma_unmap_sg usage") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250627142451.241713-2-fourier.thomas@gmail.com Signed-off-by: Martin K. Petersen commit 0141618727bc929fe868153d21797f10ce5bef3f Author: Thomas Fourier Date: Fri Jun 27 15:48:18 2025 +0200 scsi: mvsas: Fix dma_unmap_sg() nents value The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: b5762948263d ("[SCSI] mvsas: Add Marvell 6440 SAS/SATA driver") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250627134822.234813-2-fourier.thomas@gmail.com Signed-off-by: Martin K. Petersen commit 3a988d0b65d7d1713ce7596eae288a293f3b938e Author: Thomas Fourier Date: Fri Jun 27 13:41:13 2025 +0200 scsi: elx: efct: Fix dma_unmap_sg() nents value The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: 692e5d73a811 ("scsi: elx: efct: LIO backend interface routines") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250627114117.188480-2-fourier.thomas@gmail.com Signed-off-by: Martin K. Petersen commit 25236d4844ad8631a3ff12f1b33aaa27ac74172d Author: Ewan D. Milne Date: Mon Jul 7 16:22:25 2025 -0400 scsi: scsi_transport_fc: Change to use per-rport devloss_work_q Configurations with large numbers of FC rports per host instance are taking a very long time to complete all devloss work. Increase potential parallelism by using a per-rport devloss_work_q for dev_loss_work and fast_io_fail_work. Signed-off-by: Ewan D. Milne Link: https://lore.kernel.org/r/20250707202225.1203189-1-emilne@redhat.com Reviewed-by: Hannes Reinecke Signed-off-by: Martin K. Petersen commit 01aad16c2257ab8ff33b152b972c9f2e1af47912 Author: André Draszik Date: Mon Jul 7 18:05:27 2025 +0100 scsi: ufs: exynos: Fix programming of HCI_UTRL_NEXUS_TYPE On Google gs101, the number of UTP transfer request slots (nutrs) is 32, and in this case the driver ends up programming the UTRL_NEXUS_TYPE incorrectly as 0. This is because the left hand side of the shift is 1, which is of type int, i.e. 31 bits wide. Shifting by more than that width results in undefined behaviour. Fix this by switching to the BIT() macro, which applies correct type casting as required. This ensures the correct value is written to UTRL_NEXUS_TYPE (0xffffffff on gs101), and it also fixes a UBSAN shift warning: UBSAN: shift-out-of-bounds in drivers/ufs/host/ufs-exynos.c:1113:21 shift exponent 32 is too large for 32-bit type 'int' For consistency, apply the same change to the nutmrs / UTMRL_NEXUS_TYPE write. Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs") Cc: stable@vger.kernel.org Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250707-ufs-exynos-shift-v1-1-1418e161ae40@linaro.org Reviewed-by: Bart Van Assche Reviewed-by: Peter Griffin Signed-off-by: Martin K. Petersen commit 6070bd558aee1eb5114e1676165bf0ccaa08240a Author: Bagas Sanjaya Date: Wed Jul 2 10:58:23 2025 +0700 scsi: core: Fix kernel doc for scsi_track_queue_full() Sphinx reports indentation warning on scsi_track_queue_full() return values: Documentation/driver-api/scsi:101: ./drivers/scsi/scsi.c:247: ERROR: Unexpected indentation. [docutils] Fix the warning by making the return values listing a bullet list. Fixes: eb44820c28bc ("[SCSI] Add Documentation and integrate into docbook build") Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20250702035822.18072-2-bagasdotme@gmail.com Signed-off-by: Martin K. Petersen commit 023a293b9cd0bb86a9b50cd7688a3d9d266826db Author: Thomas Fourier Date: Mon Jun 30 13:18:02 2025 +0200 scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: 88a678bbc34c ("ibmvscsis: Initial commit of IBM VSCSI Tgt Driver") Signed-off-by: Thomas Fourier Link: https://lore.kernel.org/r/20250630111803.94389-2-fourier.thomas@gmail.com Signed-off-by: Martin K. Petersen commit 278577d85081717e6acb36af094d8556fcde56e5 Author: Ankit Dange Date: Sat Jun 28 18:23:20 2025 +0530 scsi: ibmvscsi_tgt: Fix typo in comment Correct the misspelling of "transitition" to "transition" in a comment in ibmvscsi_tgt.c for clarity. Signed-off-by: Ankit Dange Link: https://lore.kernel.org/r/20250628125320.295824-1-ankitdange37@gmail.com Signed-off-by: Martin K. Petersen commit ae996aeb0e495471e171d0d59d97f344c9a29968 Merge: 8314312c5286e5 e1c9a704f2c53a Author: Martin K. Petersen Date: Mon Jul 14 20:56:16 2025 -0400 Merge patch series "mpi3mr: Few minor bug fixes" Ranjan Kumar says: Few minor fixes of mpi3mr driver. Link: https://lore.kernel.org/r/20250627194539.48851-1-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit a44312d58e78cfe8f0e72435101b7a9187b21d46 Author: Sean Anderson Date: Thu Jul 10 16:14:53 2025 -0400 net: phy: Don't register LEDs for genphy If a PHY has no driver, the genphy driver is probed/removed directly in phy_attach/detach. If the PHY's ofnode has an "leds" subnode, then the LEDs will be (un)registered when probing/removing the genphy driver. This could occur if the leds are for a non-generic driver that isn't loaded for whatever reason. Synchronously removing the PHY device in phy_detach leads to the following deadlock: rtnl_lock() ndo_close() ... phy_detach() phy_remove() phy_leds_unregister() led_classdev_unregister() led_trigger_set() netdev_trigger_deactivate() unregister_netdevice_notifier() rtnl_lock() There is a corresponding deadlock on the open/register side of things (and that one is reported by lockdep), but it requires a race while this one is deterministic. Regular drivers do not have this problem since they are probed asynchronously (without RTNL held). Generic PHYs do not support LEDs anyway, so don't bother registering them. [JakubL this is a net-next version of commit f0f2b992d818 ("net: phy: Don't register LEDs for genphy"), which uses APIs removed in -next.] Signed-off-by: Sean Anderson Link: https://patch.msgid.link/20250710201454.1280277-1-sean.anderson@linux.dev Signed-off-by: Jakub Kicinski commit e1c9a704f2c53acf4d55e43281339560781102e7 Author: Ranjan Kumar Date: Sat Jun 28 01:15:39 2025 +0530 scsi: mpi3mr: Update driver version to 8.14.0.5.50 Updated driver version to 8.14.0.5.50 Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/r/20250627194539.48851-5-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit c91e140c82eb58724c435f623702e51cc7896646 Author: Ranjan Kumar Date: Sat Jun 28 01:15:38 2025 +0530 scsi: mpi3mr: Serialize admin queue BAR writes on 32-bit systems On 32-bit systems, 64-bit BAR writes to admin queue registers are performed as two 32-bit writes. Without locking, this can cause partial writes when accessed concurrently. Updated per-queue spinlocks is used to serialize these writes and prevent race conditions. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Cc: stable@vger.kernel.org Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/r/20250627194539.48851-4-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit 6853885b21cb1d7157cc14c9d30cc17141565bae Author: Ranjan Kumar Date: Sat Jun 28 01:15:37 2025 +0530 scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers The volatile qualifier is redundant for __iomem pointers. Cleaned up usage in mpi3mr_writeq() and sysif_regs pointer as per Upstream compliance. Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/r/20250627194539.48851-3-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit e6327c4acf925bb6d6d387d76fc3bd94471e10d8 Author: Ranjan Kumar Date: Sat Jun 28 01:15:36 2025 +0530 scsi: mpi3mr: Fix race between config read submit and interrupt completion The "is_waiting" flag was updated after calling complete(), which could lead to a race where the waiting thread wakes up before the flag is cleared. This may cause a missed wakeup or stale state check. Reorder the operations to update "is_waiting" before signaling completion to ensure consistent state. Fixes: 824a156633df ("scsi: mpi3mr: Base driver code") Cc: stable@vger.kernel.org Co-developed-by: Chandrakanth Patil Signed-off-by: Chandrakanth Patil Signed-off-by: Ranjan Kumar Link: https://lore.kernel.org/r/20250627194539.48851-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen commit ff2ac4df58adb6d7721bb0ce6069e1bd0e613126 Author: Breno Leitao Date: Fri Jul 11 10:06:59 2025 -0700 netdevsim: implement peer queue flow control Add flow control mechanism between paired netdevsim devices to stop the TX queue during high traffic scenarios. When a receive queue becomes congested (approaching NSIM_RING_SIZE limit), the corresponding transmit queue on the peer device is stopped using netif_subqueue_try_stop(). Once the receive queue has sufficient capacity again, the peer's transmit queue is resumed with netif_tx_wake_queue(). Key changes: * Add nsim_stop_peer_tx_queue() to pause peer TX when RX queue is full * Add nsim_start_peer_tx_queue() to resume peer TX when RX queue drains * Implement queue mapping validation to ensure TX/RX queue count match * Wake all queues during device unlinking to prevent stuck queues * Use RCU protection when accessing peer device references * wake the queues when changing the queue numbers * Remove IFF_NO_QUEUE given it will enqueue packets now The flow control only activates when devices have matching TX/RX queue counts to ensure proper queue mapping. Suggested-by: Jakub Kicinski Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250711-netdev_flow_control-v3-1-aa1d5a155762@debian.org Signed-off-by: Jakub Kicinski commit 5777d1871bf69d435e57e639fcf132d2d0c00883 Author: Oscar Maes Date: Thu Jul 10 16:27:14 2025 +0200 selftests: net: add test for variable PMTU in broadcast routes Added a test for variable PMTU in broadcast routes. This test uses iputils' ping and attempts to send a ping between two peers, which should result in a regular echo reply. This test will fail when the receiving peer does not receive the echo request due to a lack of packet fragmentation. Signed-off-by: Oscar Maes Link: https://patch.msgid.link/20250710142714.12986-2-oscmaes92@gmail.com Signed-off-by: Jakub Kicinski commit 9e30ecf23b1b8f091f7d08b27968dea83aae7908 Author: Oscar Maes Date: Thu Jul 10 16:27:13 2025 +0200 net: ipv4: fix incorrect MTU in broadcast routes Currently, __mkroute_output overrules the MTU value configured for broadcast routes. This buggy behaviour can be reproduced with: ip link set dev eth1 mtu 9000 ip route del broadcast 192.168.0.255 dev eth1 proto kernel scope link src 192.168.0.2 ip route add broadcast 192.168.0.255 dev eth1 proto kernel scope link src 192.168.0.2 mtu 1500 The maximum packet size should be 1500, but it is actually 8000: ping -b 192.168.0.255 -s 8000 Fix __mkroute_output to allow MTU values to be configured for for broadcast routes (to support a mixed-MTU local-area-network). Signed-off-by: Oscar Maes Link: https://patch.msgid.link/20250710142714.12986-1-oscmaes92@gmail.com Signed-off-by: Jakub Kicinski commit 2f4053db0b13eb59693f910855c053f523333e89 Merge: 5b41a682cbcabd cd1746cb6555a2 Author: Jakub Kicinski Date: Mon Jul 14 17:26:57 2025 -0700 Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2025-07-14 * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: IFC updates for disabled host PF net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc RDMA/mlx5: Fix UMR modifying of mkey page size net/mlx5: Expose HCA capability bits for mkey max page size ==================== Link: https://patch.msgid.link/1752481357-34780-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 5b41a682cbcabdc1f0cee58c5209c42f5422a0c6 Merge: 08a305b2a5b8e1 0e6639c8505d70 Author: Jakub Kicinski Date: Mon Jul 14 17:26:20 2025 -0700 Merge tag 'linux-can-next-for-6.17-20250711' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-07-11 The first patch is by Geert Uytterhoeven and converts the rcar_can driver to DEFINE_SIMPLE_DEV_PM_OPS. The last patch is by Biju Das and removes unused macros from the rcar_canfd driver. * tag 'linux-can-next-for-6.17-20250711' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: can: rcar_canfd: Drop unused macros can: rcar_can: Convert to DEFINE_SIMPLE_DEV_PM_OPS() ==================== Link: https://patch.msgid.link/20250711101706.2822687-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 08a305b2a5b8e125120bcf670ffe775c86cf1f59 Author: Dr. David Alan Gilbert Date: Sat Jul 12 21:57:59 2025 +0100 net/x25: Remove unused x25_terminate_link() x25_terminate_link() has been unused since the last use was removed in 2020 by: commit 7eed751b3b2a ("net/x25: handle additional netdev events") Remove it. Signed-off-by: Dr. David Alan Gilbert Acked-by: Martin Schiller Link: https://patch.msgid.link/20250712205759.278777-1-linux@treblig.org Signed-off-by: Jakub Kicinski commit 5ae3bcc20446b486f479c4df69e4186d6fecbcb4 Author: Jakub Kicinski Date: Fri Jul 11 18:20:05 2025 -0700 selftests: drv-net: add rss_api to the Makefile I missed adding rss_api.py to the Makefile. The NIPA Makefile checking script was scanning for shell scripts only, so it didn't flag it either. Fixes: 4d13c6c449af ("selftests: drv-net: test RSS Netlink notifications") Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250712012005.4010263-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 53d20606c40678d425cc03f0978c614dca51f25e Author: Alok Tiwari Date: Fri Jul 11 07:05:30 2025 -0700 net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() The buffer bgx_sel used in snprintf() was too small to safely hold the formatted string "BGX%d" for all valid bgx_id values. This caused a -Wformat-truncation warning with `Werror` enabled during build. Increase the buffer size from 5 to 7 and use `sizeof(bgx_sel)` in snprintf() to ensure safety and suppress the warning. Build warning: CC drivers/net/ethernet/cavium/thunder/thunder_bgx.o drivers/net/ethernet/cavium/thunder/thunder_bgx.c: In function ‘bgx_acpi_match_id’: drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1434:27: error: ‘%d’ directive output may be truncated writing between 1 and 3 bytes into a region of size 2 [-Werror=format-truncation=] snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id); ^~ drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1434:23: note: directive argument in the range [0, 255] snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id); ^~~~~~~ drivers/net/ethernet/cavium/thunder/thunder_bgx.c:1434:2: note: ‘snprintf’ output between 5 and 7 bytes into a destination of size 5 snprintf(bgx_sel, 5, "BGX%d", bgx->bgx_id); compiler warning due to insufficient snprintf buffer size. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250711140532.2463602-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit c0a3923adafa79bebaac9a5d0b1fbfdbf2ea1d9b Merge: 2a683d00528601 d39e1342d045e5 Author: Jakub Kicinski Date: Mon Jul 14 17:14:34 2025 -0700 Merge branch 'net-fec-add-some-optimizations' Wei Fang says: ==================== net: fec: add some optimizations Add some optimizations to the fec driver, see each patch for details. v1: https://lore.kernel.org/20250710090902.1171180-1-wei.fang@nxp.com ==================== Link: https://patch.msgid.link/20250711091639.1374411-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit d39e1342d045e56d56756f91f93bc883fc9a5934 Author: Wei Fang Date: Fri Jul 11 17:16:39 2025 +0800 net: fec: add fec_set_hw_mac_addr() helper function In the current driver, the MAC address is set in both fec_restart() and fec_set_mac_address(), so a generic helper function fec_set_hw_mac_addr() is added to set the hardware MAC address to make the code more compact. Signed-off-by: Wei Fang Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250711091639.1374411-4-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 2d33dc6058157d91c5b76b7380bbc27d72595d2c Author: Wei Fang Date: Fri Jul 11 17:16:38 2025 +0800 net: fec: add more macros for bits of FEC_ECR There are also some RCR bits that are not defined but are used by the driver, so add macro definitions for these bits to improve readability and maintainability. In addition, although FEC_RCR_HALFDPX has been defined, it is not used in the driver. According to the description of FEC_RCR[1] in RM, it is used to disable receive on transmit. Therefore, it is more appropriate to redefine FEC_RCR[1] as FEC_RCR_DRT. Signed-off-by: Wei Fang Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20250711091639.1374411-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 893bb0beed4d1cc51343346981f53f727dc01cb3 Author: Wei Fang Date: Fri Jul 11 17:16:37 2025 +0800 net: fec: use phy_interface_mode_is_rgmii() to check RGMII mode Use the generic helper function phy_interface_mode_is_rgmii() to check RGMII mode. Signed-off-by: Wei Fang Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/20250711091639.1374411-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 2a683d005286018c6f47ef0e432829655a6a21a3 Author: Kuniyuki Iwashima Date: Fri Jul 11 05:10:59 2025 +0000 dev: Pass netdevice_tracker to dev_get_by_flags_rcu(). This is a follow-up for commit eb1ac9ff6c4a5 ("ipv6: anycast: Don't hold RTNL for IPV6_JOIN_ANYCAST."). We should not add a new device lookup API without netdevice_tracker. Let's pass netdevice_tracker to dev_get_by_flags_rcu() and rename it with netdev_ prefix to match other newer APIs. Note that we always use GFP_ATOMIC for netdev_hold() as it's expected to be called under RCU. Suggested-by: Jakub Kicinski Link: https://lore.kernel.org/netdev/20250708184053.102109f6@kernel.org/ Signed-off-by: Kuniyuki Iwashima Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250711051120.2866855-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit f25a7eaa897f21396e99f90809af82ca553c9d14 Author: Biju Das Date: Fri Jul 11 06:40:21 2025 +0100 net: phy: micrel: Add ksz9131_resume() The Renesas RZ/G3E SMARC EVK uses KSZ9131RNXC phy. On deep power state, PHY loses the power and on wakeup the rgmii delays are not reconfigured causing it to fail. Replace the callback kszphy_resume()->ksz9131_resume() for reconfiguring the rgmii_delay when it exits from PM suspend state. Signed-off-by: Biju Das Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250711054029.48536-1-biju.das.jz@bp.renesas.com Signed-off-by: Jakub Kicinski commit b1915b18e1d00eb4e8babcdc2ca3a64b43e20e9a Author: Jens Axboe Date: Mon Jul 14 16:36:08 2025 -0600 io_uring/net: cast min_not_zero() type kernel test robot reports that xtensa complains about different signedness for a min_not_zero() comparison. Cast the int part to size_t to avoid this issue. Fixes: e227c8cdb47b ("io_uring/net: use passed in 'len' in io_recv_buf_select()") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507150504.zO5FsCPm-lkp@intel.com/ Signed-off-by: Jens Axboe commit dcbe5a466c123a475bb66492749549f09b5cab00 Author: Kai Huang Date: Mon Jul 14 10:20:19 2025 +1200 KVM: x86: Reject KVM_SET_TSC_KHZ VM ioctl when vCPUs have been created Reject the KVM_SET_TSC_KHZ VM ioctl when vCPUs have been created and update the documentation to reflect it. The VM scope KVM_SET_TSC_KHZ ioctl is used to set up the default TSC frequency that all subsequently created vCPUs can use. It is only intended to be called before any vCPU is created. Allowing it to be called after that only results in confusion but nothing good. Note this is an ABI change. But currently in Qemu (the de facto userspace VMM) only TDX uses this VM ioctl, and it is only called once before creating any vCPU, therefore the risk of breaking userspace is pretty low. Suggested-by: Sean Christopherson Signed-off-by: Kai Huang Reviewed-by: Xiaoyao Li Reviewed-by: Chao Gao Reviewed-by: Nikunj A Dadhania Link: https://lore.kernel.org/r/135a35223ce8d01cea06b6cef30bfe494ec85827.1752444335.git.kai.huang@intel.com Signed-off-by: Sean Christopherson commit 5a6f304f39c24c1a2c3023fbfda81b0042354c3f Author: Nitin Rawat Date: Mon Jul 14 13:23:36 2025 +0530 scsi: ufs: ufs-qcom: Enable QUnipro Internal Clock Gating Enable internal clock gating for Qualcomm UFS host controller by setting the following attributes to 1 during host controller initialization: - DL_VS_CLK_CFG - PA_VS_CLK_CFG_REG - DME_VS_CORE_CLK_CTRL.DME_HW_CGC_EN This change is necessary to support the internal clock gating mechanism in Qualcomm UFS host controller. This is power saving feature and hence driver can continue to function correctly despite any error in enabling these feature. Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250714075336.2133-4-quic_nitirawa@quicinc.com Signed-off-by: Martin K. Petersen commit c49601642f95c8c6787acb07881f2495bc8aeb27 Author: Nitin Rawat Date: Mon Jul 14 13:23:35 2025 +0530 scsi: ufs: core: Add ufshcd_dme_rmw() to modify DME attributes Introduce ufshcd_dme_rmw() API to read, modify, and write DME attributes in UFS host controllers using a mask and value. Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250714075336.2133-3-quic_nitirawa@quicinc.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 7a9d5195a7f5871a4ad4e55fc567a2b3bee49a59 Author: Bao D. Nguyen Date: Mon Jul 14 13:23:34 2025 +0530 scsi: ufs: ufs-qcom: Update esi_vec_mask for HW major version >= 6 The MCQ feature and ESI are supported by all Qualcomm UFS controller versions 6 and above. Therefore, update the ESI vector mask in the UFS_MEM_CFG3 register for platforms with major version number of 6 or higher. Reviewed-by: Manivannan Sadhasivam Signed-off-by: Bao D. Nguyen Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250714075336.2133-2-quic_nitirawa@quicinc.com Signed-off-by: Martin K. Petersen commit 7db6e66663681abda54f81d5916db3a3b8b1a13d Author: Sergey Bashirov Date: Wed Jul 2 16:32:21 2025 +0300 pNFS: Fix disk addr range check in block/scsi layout At the end of the isect translation, disc_addr represents the physical disk offset. Thus, end calculated from disk_addr is also a physical disk offset. Therefore, range checking should be done using map->disk_offset, not map->start. Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250702133226.212537-1-sergeybashirov@gmail.com Signed-off-by: Trond Myklebust commit 81438498a285759f31e843ac4800f82a5ce6521f Author: Sergey Bashirov Date: Tue Jul 1 15:21:48 2025 +0300 pNFS: Fix stripe mapping in block/scsi layout Because of integer division, we need to carefully calculate the disk offset. Consider the example below for a stripe of 6 volumes, a chunk size of 4096, and an offset of 70000. chunk = div_u64(offset, dev->chunk_size) = 70000 / 4096 = 17 offset = chunk * dev->chunk_size = 17 * 4096 = 69632 disk_offset_wrong = div_u64(offset, dev->nr_children) = 69632 / 6 = 11605 disk_chunk = div_u64(chunk, dev->nr_children) = 17 / 6 = 2 disk_offset = disk_chunk * dev->chunk_size = 2 * 4096 = 8192 Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250701122341.199112-1-sergeybashirov@gmail.com Signed-off-by: Trond Myklebust commit d897d81671bc4615c80f4f3bd5e6b218f59df50c Author: Sergey Bashirov Date: Mon Jun 30 21:35:29 2025 +0300 pNFS: Handle RPC size limit for layoutcommits When there are too many block extents for a layoutcommit, they may not all fit into the maximum-sized RPC. This patch allows the generic pnfs code to properly handle -ENOSPC returned by the block/scsi layout driver and trigger additional layoutcommits if necessary. Co-developed-by: Konstantin Evtushenko Signed-off-by: Konstantin Evtushenko Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250630183537.196479-5-sergeybashirov@gmail.com Signed-off-by: Trond Myklebust commit 66642bbee595e5fa8fc4ce7c8706c3697da239fe Author: Sergey Bashirov Date: Mon Jun 30 21:35:28 2025 +0300 pNFS: Add prepare commit trace to block/scsi layout Replace dprintk with trace event in ext_tree_prepare_commit() function. Co-developed-by: Konstantin Evtushenko Signed-off-by: Konstantin Evtushenko Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250630183537.196479-4-sergeybashirov@gmail.com Signed-off-by: Trond Myklebust commit d84c4754f8740915da9977a282f72a3b2b0e0ac9 Author: Sergey Bashirov Date: Mon Jun 30 21:35:27 2025 +0300 pNFS: Fix extent encoding in block/scsi layout The ext_tree_encode_commit() function may be called multiple times for the same file, layout, and last written byte if the provided buffer is not large enough to encode all extents in it. The first problem is that the last written byte field must be zeroed only on a successful call, otherwise we will lose its actual value and get an integer overflow on the next encoding attempt. The second problem is that we can't count and encode in one pass. The extent state changes during encoding, so if we return -ENOSPC but have already encoded some extents into a small buffer, they will not be re-encoded into a new larger buffer on the next try. As a result, the client never commits these extents to the server. Co-developed-by: Konstantin Evtushenko Signed-off-by: Konstantin Evtushenko Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250630183537.196479-3-sergeybashirov@gmail.com Signed-off-by: Trond Myklebust commit 9768797c219326699778fba9cd3b607b2f1e7950 Author: Sergey Bashirov Date: Mon Jun 30 21:35:26 2025 +0300 pNFS: Fix uninited ptr deref in block/scsi layout The error occurs on the third attempt to encode extents. When function ext_tree_prepare_commit() reallocates a larger buffer to retry encoding extents, the "layoutupdate_pages" page array is initialized only after the retry loop. But ext_tree_free_commitdata() is called on every iteration and tries to put pages in the array, thus dereferencing uninitialized pointers. An additional problem is that there is no limit on the maximum possible buffer_size. When there are too many extents, the client may create a layoutcommit that is larger than the maximum possible RPC size accepted by the server. During testing, we observed two typical scenarios. First, one memory page for extents is enough when we work with small files, append data to the end of the file, or preallocate extents before writing. But when we fill a new large file without preallocating, the number of extents can be huge, and counting the number of written extents in ext_tree_encode_commit() does not help much. Since this number increases even more between unlocking and locking of ext_tree, the reallocated buffer may not be large enough again and again. Co-developed-by: Konstantin Evtushenko Signed-off-by: Konstantin Evtushenko Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250630183537.196479-2-sergeybashirov@gmail.com Signed-off-by: Trond Myklebust commit 3b3bc9a1f730dc24f9765dc70de65ad10888333e Author: Dr. David Alan Gilbert Date: Tue Feb 18 21:52:50 2025 +0000 NFS: Remove unused function nfs_umount nfs_umount() has been unused since 2013's commit 4580a92d44e2 ("NFS: Use server-recommended security flavor by default (NFSv3)") Remove it. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250218215250.263709-1-linux@treblig.org Signed-off-by: Trond Myklebust commit 48693d119b2114f8eaf8b8f972b29e05ae581ad4 Author: Dr. David Alan Gilbert Date: Sun Jul 13 00:30:06 2025 +0100 SUNRPC: Remove unused xdr functions Remove a bunch of unused xdr_*decode* functions: The last use of xdr_decode_netobj() was removed in 2021 by: commit 7cf96b6d0104 ("lockd: Update the NLMv4 SHARE arguments decoder to use struct xdr_stream") The last use of xdr_decode_string_inplace() was removed in 2021 by: commit 3049e974a7c7 ("lockd: Update the NLMv4 FREE_ALL arguments decoder to use struct xdr_stream") The last use of xdr_stream_decode_opaque() was removed in 2024 by: commit fed8a17c61ff ("xdrgen: typedefs should use the built-in string and opaque functions") The functions xdr_stream_decode_string() and xdr_stream_decode_opaque_dup() were both added in 2018 by the commit 0e779aa70308 ("SUNRPC: Add helpers for decoding opaque and string types") but never used. Remove them. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250712233006.403226-1-linux@treblig.org Signed-off-by: Trond Myklebust commit 87268f7a4f1fb7243bba5a4aa6199720b54f72dd Author: Christoph Hellwig Date: Thu May 15 13:50:56 2025 +0200 nfs: create a kernel keyring Create a kernel .nfs keyring similar to the nvme .nvme one. Unlike for a userspace-created keyrind, tlshd is a possesor of the keys with this and thus the keys don't need user read permissions. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Link: https://lore.kernel.org/r/20250515115107.33052-3-hch@lst.de Signed-off-by: Trond Myklebust commit 90c9550a8d65fb9b1bf87baf97a04ed91bf61b33 Author: Christoph Hellwig Date: Thu May 15 13:50:55 2025 +0200 NFS: support the kernel keyring for TLS Allow tlshd to use a per-mount key from the kernel keyring similar to NVMe over TCP. Note that tlshd expects keys and certificates stored in the kernel keyring to be in DER format, not the PEM format used for file based keys and certificates, so they need to be converted before they are added to the keyring, which is a bit unexpected. Signed-off-by: Christoph Hellwig Reviewed-by: Sagi Grimberg Link: https://lore.kernel.org/r/20250515115107.33052-2-hch@lst.de Signed-off-by: Trond Myklebust commit 72508db0fe1762f2cfcff1cb4cf28a8e645bdd43 Author: Trond Myklebust Date: Tue Jun 24 17:32:09 2025 -0400 NFS: Allow folio migration for the case of mode == MIGRATE_SYNC When the mode is MIGRATE_SYNC, we are allowed to call nfs_wb_folio() under the folio lock. Reviewed-by: Benjamin Coddington Signed-off-by: Trond Myklebust commit b0b7cdc99431655aec3f3afcf05e3eeca0f8dd79 Author: Jeff Layton Date: Wed Jun 18 09:19:15 2025 -0400 nfs: new tracepoint in match_stateid operation Add new tracepoints in the NFSv4 match_stateid minorversion op that show the info in both stateids. Reviewed-by: Benjamin Coddington Signed-off-by: Jeff Layton Link: https://lore.kernel.org/r/20250618-nfs-tracepoints-v2-4-540c9fb48da2@kernel.org Signed-off-by: Trond Myklebust commit 5dd03d14b3a9595ea320a55c499ebf85b422392f Author: Jeff Layton Date: Wed Jun 18 09:19:14 2025 -0400 nfs: new tracepoint in nfs_delegation_need_return Add a tracepoint in the function that decides whether to return a delegation to the server. Reviewed-by: Benjamin Coddington Signed-off-by: Jeff Layton Link: https://lore.kernel.org/r/20250618-nfs-tracepoints-v2-3-540c9fb48da2@kernel.org Signed-off-by: Trond Myklebust commit 0139a30ada76d154ff48dfe7a1d2056f7d7ae023 Author: Jeff Layton Date: Wed Jun 18 09:19:13 2025 -0400 nfs: add a tracepoint to nfs_inode_detach_delegation_locked We have tracepoints for setting a delegation and reclaiming them. Add a tracepoint for when the delegation is being detached from the inode. Reviewed-by: Benjamin Coddington Signed-off-by: Jeff Layton Link: https://lore.kernel.org/r/20250618-nfs-tracepoints-v2-2-540c9fb48da2@kernel.org Signed-off-by: Trond Myklebust commit 8c206b0a121e4195f892f298628791f3b848fef0 Author: Jeff Layton Date: Wed Jun 18 09:19:12 2025 -0400 nfs: add cache_validity to the nfs_inode_event tracepoints Managing the cache_validity flags is the deep voodoo of NFS cache coherency. Let's have a little extra visibility into that value via the nfs_inode_event tracepoints. Reviewed-by: Benjamin Coddington Signed-off-by: Jeff Layton Link: https://lore.kernel.org/r/20250618-nfs-tracepoints-v2-1-540c9fb48da2@kernel.org Signed-off-by: Trond Myklebust commit 2c665d91c2a2d8b5bdf1374d1253b3c89fca4ede Author: Anthony Iliopoulos Date: Fri Jun 13 11:44:39 2025 +0200 NFS: remove unused pnfs_ld_data field from struct nfs_server The last code that was using this was removed via commit 20d655d6197d ("pnfs/blocklayout: use the device id cache") which was merged in v3.18-rc1, so it can be removed completely. Signed-off-by: Anthony Iliopoulos Link: https://lore.kernel.org/r/20250613094439.82338-4-ailiop@suse.com Signed-off-by: Trond Myklebust commit 74a33326cfe8e62ebe0a65ba01ea8a8bceb532f8 Author: Anthony Iliopoulos Date: Fri Jun 13 11:44:38 2025 +0200 NFS: remove unused time_delta field from struct nfs_server The last code that was using this was removed via commit ca0daa277aca ("NFS: Cache aggressively when file is open for writing") which was merged in v4.8-rc1, so it can be removed completely. Signed-off-by: Anthony Iliopoulos Link: https://lore.kernel.org/r/20250613094439.82338-3-ailiop@suse.com Signed-off-by: Trond Myklebust commit 0715a72ee9a38461eac4b34388b772914f269119 Author: Anthony Iliopoulos Date: Fri Jun 13 11:44:37 2025 +0200 NFS: remove unused wpages field from struct nfs_server The wpages field is not serving any purpose since commit c63c7b051395 ("NFS: Fix a race when doing NFS write coalescing") which was merged in v2.6.22-rc1. Remove it completely. Signed-off-by: Anthony Iliopoulos Link: https://lore.kernel.org/r/20250613094439.82338-2-ailiop@suse.com Signed-off-by: Trond Myklebust commit a9e21837208d63f42a3387bdf826605c1904be9b Author: Tigran Mkrtchyan Date: Tue Jun 10 17:12:46 2025 +0200 pnfs: add pnfs_ds_connect trace point This tracepoint aims to expose pnfs DS connect status Signed-off-by: Tigran Mkrtchyan Reviewed-by: Benjamin Coddington Link: https://lore.kernel.org/r/20250610151246.9147-1-tigran.mkrtchyan@desy.de Signed-off-by: Trond Myklebust commit c1b0b9d79fdf8a86451eac914fe6f5cf39bbfc5f Author: NeilBrown Date: Mon Jun 9 08:15:17 2025 +1000 nfs: use lock_two_nondirectories() Rather than open-coding this function call it to make intention clear and to use "correct" nesting levels (parent and child are for directories). This is purely cosmetic with no expected change in behaviour. Signed-off-by: NeilBrown Link: https://lore.kernel.org/r/174942091741.608730.3327223511347232829@noble.neil.brown.name Signed-off-by: Trond Myklebust commit 4b5427414749233fb2315a89c9fa64328cf5ec03 Author: Trond Myklebust Date: Thu May 29 06:45:47 2025 -0400 NFS: Return the file btime in the statx results when appropriate If the server supports the NFSv4.x "create_time" attribute, then return it as part of the statx results. Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Link: https://lore.kernel.org/r/eae27d6467e08aaa67e0ac6ae7119263a0f83349.1748515333.git.bcodding@redhat.com Signed-off-by: Trond Myklebust commit 1c7ae2dd3f0e6d07ec0a5a348f2561f2171b9c81 Author: Anne Marie Merritt Date: Thu May 29 06:45:46 2025 -0400 nfs: Add timecreate to nfs inode Add tracking of the create time (a.k.a. btime) along with corresponding bitfields, request, and decode xdr routines. Signed-off-by: Anne Marie Merritt Signed-off-by: Lance Shelton Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Link: https://lore.kernel.org/r/1e3677b0655fa2bbaba0817b41d111d94a06e5ee.1748515333.git.bcodding@redhat.com Signed-off-by: Trond Myklebust commit ce60ab3964782df9ba34f0a64c0bc766dd508bde Author: Trond Myklebust Date: Thu May 29 06:45:45 2025 -0400 Expand the type of nfs_fattr->valid We need to be able to track more than 32 attributes per inode. Signed-off-by: Trond Myklebust Signed-off-by: Lance Shelton Signed-off-by: Benjamin Coddington Reviewed-by: Jeff Layton Link: https://lore.kernel.org/r/1e3405fca54efd0be7c91c1da77917b94f5dfcc4.1748515333.git.bcodding@redhat.com Signed-off-by: Trond Myklebust commit 6f38f8c574642a822f2e85f079fa29a49176c49c Author: Zheyun Shen Date: Thu May 22 16:37:32 2025 -0700 KVM: SVM: Flush cache only on CPUs running SEV guest On AMD CPUs without ensuring cache consistency, each memory page reclamation in an SEV guest triggers a call to do WBNOINVD/WBINVD on all CPUs, thereby affecting the performance of other programs on the host. Typically, an AMD server may have 128 cores or more, while the SEV guest might only utilize 8 of these cores. Meanwhile, host can use qemu-affinity to bind these 8 vCPUs to specific physical CPUs. Therefore, keeping a record of the physical core numbers each time a vCPU runs can help avoid flushing the cache for all CPUs every time. Take care to allocate the cpumask used to track which CPUs have run a vCPU when copying or moving an "encryption context", as nothing guarantees memory in a mirror VM is a strict subset of the ASID owner, and the destination VM for intrahost migration needs to maintain it's own set of CPUs. E.g. for intrahost migration, if a CPU was used for the source VM but not the destination VM, then it can only have cached memory that was accessible to the source VM. And a CPU that was run in the source is also used by the destination is no different than a CPU that was run in the destination only. Note, KVM is guaranteed to do flush caches prior to sev_vm_destroy(), thanks to kvm_arch_guest_memory_reclaimed for SEV and SEV-ES, and kvm_arch_gmem_invalidate() for SEV-SNP. I.e. it's safe to free the cpumask prior to unregistering encrypted regions and freeing the ASID. Opportunistically clean up sev_vm_destroy()'s comment regarding what is (implicitly, what isn't) skipped for mirror VMs. Cc: Srikanth Aithal Reviewed-by: Tom Lendacky Signed-off-by: Zheyun Shen Link: https://lore.kernel.org/r/20250522233733.3176144-9-seanjc@google.com Link: https://lore.kernel.org/all/935a82e3-f7ad-47d7-aaaf-f3d2b62ed768@amd.com Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson commit 6e375b236317c19cf3e4da40285ef5b2f0da1899 Merge: 8efa26fcbf8a7f f126f0ce7c830d Author: Martin KaFai Lau Date: Mon Jul 14 12:09:10 2025 -0700 Merge branch 'bpf-tcp-exactly-once-socket-iteration' Jordan Rife says: ==================== bpf: tcp: Exactly-once socket iteration TCP socket iterators use iter->offset to track progress through a bucket, which is a measure of the number of matching sockets from the current bucket that have been seen or processed by the iterator. On subsequent iterations, if the current bucket has unprocessed items, we skip at least iter->offset matching items in the bucket before adding any remaining items to the next batch. However, iter->offset isn't always an accurate measure of "things already seen" when the underlying bucket changes between reads, which can lead to repeated or skipped sockets. Instead, this series remembers the cookies of the sockets we haven't seen yet in the current bucket and resumes from the first cookie in that list that we can find on the next iteration. This is a continuation of the work started in [1]. This series largely replicates the patterns applied to UDP socket iterators, applying them instead to TCP socket iterators. CHANGES ======= v5 -> v6: * In patch ten ("selftests/bpf: Create established sockets in socket iterator tests"), use poll() to choose a socket that has a connection ready to be accept()ed. Before, connect_to_server would set the O_NONBLOCK flag on all listening sockets so that accept_from_one could loop through them all and find the one that connect_to_addr_str connected to. However, this is subtly buggy and could potentially lead to test flakes, since the 3 way handshake isn't necessarily done when connect returns, so it's possible none of the accept() calls succeed. Use poll() instead to guarantee that the socket we accept() from is ready and eliminate the need for the O_NONBLOCK flag (Martin). v4 -> v5: * Move WARN_ON_ONCE before the `done` label in patch two ("bpf: tcp: Make sure iter->batch always contains a full bucket snapshot"") (Martin). * Remove unnecessary kfunc declaration in patch eleven ("selftests/bpf: Create iter_tcp_destroy test program") (Martin). * Make sure to close the socket fd at the end of `destroy` in patch twelve ("selftests/bpf: Add tests for bucket resume logic in established sockets") (Martin). v3 -> v4: * Drop braces around sk_nulls_for_each_from in patch five ("bpf: tcp: Avoid socket skips and repeats during iteration") (Stanislav). * Add a break after the TCP_SEQ_STATE_ESTABLISHED case in patch five (Stanislav). * Add an `if (sock_type == SOCK_STREAM)` check before assigning TCP_LISTEN to skel->rodata->ss in patch eight ("selftests/bpf: Allow for iteration over multiple states") to more clearly express the intent that the option is only consumed for SOCK_STREAM tests (Stanislav). * Move the `i = 0` assignment into the for loop in patch ten ("selftests/bpf: Create established sockets in socket iterator tests") (Stanislav). v2 -> v3: * Unroll the loop inside bpf_iter_tcp_batch to make the logic easier to follow in patch two ("bpf: tcp: Make sure iter->batch always contains a full bucket snapshot"). This gets rid of the `resizes` variable from v2 and eliminates the extra conditional that checks how many batch resize attempts have occurred so far (Stanislav). Note: This changes the behavior slightly. Before, in the case that the second call to tcp_seek_last_pos (and later bpf_iter_tcp_resume) advances to a new bucket, which may happen if the current bucket is emptied after releasing its lock, the `resizes` "budget" would be reset, the net effect being that we would try a batch resize with GFP_USER at most once per bucket. Now, we try to resize the batch with GFP_USER at most once per call, so it makes it slightly more likely that we hit the GFP_NOWAIT scenario. However, this edge case should be rare in practice anyway, and the new behavior is more or less consistent with the original retry logic, so avoid the loop and prefer code clarity. * Move the call to bpf_iter_tcp_put_batch out of bpf_iter_tcp_realloc_batch and call it directly before invoking bpf_iter_tcp_realloc_batch with GFP_USER inside bpf_iter_tcp_batch. /Don't/ call it before invoking bpf_iter_tcp_realloc_batch the second time while we hold the lock with GFP_NOWAIT. This avoids a conditional inside bpf_iter_tcp_realloc_batch from v2 that only calls bpf_iter_tcp_put_batch if flags != GFP_NOWAIT and is a bit more explicit (Stanislav). * Adjust patch five ("bpf: tcp: Avoid socket skips and repeats during iteration") to fit with the new logic in patch two. v1 -> v2: * In patch five ("bpf: tcp: Avoid socket skips and repeats during iteration"), remove unnecessary bucket bounds checks in bpf_iter_tcp_resume. In either case, if st->bucket is outside the current table's range then bpf_iter_tcp_resume_* calls *_get_first which immediately returns NULL anyway and the logic will fall through. (Martin) * Add a check at the top of bpf_iter_tcp_resume_listening and bpf_iter_tcp_resume_established to see if we're done with the current bucket and advance it immediately instead of wasting time finding the first matching socket in that bucket with (listening|established)_get_first. In v1, we originally discussed adding logic to advance the bucket in bpf_iter_tcp_seq_next and bpf_iter_tcp_seq_stop, but after trying this the logic seemed harder to track. Overall, keeping everything inside bpf_iter_tcp_resume_* seemed a bit clearer. (Martin) * Instead of using a timeout in the last patch ("selftests/bpf: Add tests for bucket resume logic in established sockets") to wait for sockets to leave the ehash table after calling close(), use bpf_sock_destroy to deterministically destroy and remove them. This introduces one more patch ("selftests/bpf: Create iter_tcp_destroy test program") to create the iterator program that destroys a selected socket. Drive this through a destroy() function in the last patch which, just like close(), accepts a socket file descriptor. (Martin) * Introduce one more patch ("selftests/bpf: Allow for iteration over multiple states") to fix a latent bug in iter_tcp_soreuse where the sk->sk_state != TCP_LISTEN check was ignored. Add the "ss" variable to allow test code to configure which socket states to allow. [1]: https://lore.kernel.org/bpf/20250502161528.264630-1-jordan@jrife.io/ ==================== Link: https://patch.msgid.link/20250714180919.127192-1-jordan@jrife.io Signed-off-by: Martin KaFai Lau commit f126f0ce7c830d538ca047f3a3bdc64669812d9c Author: Jordan Rife Date: Mon Jul 14 11:09:16 2025 -0700 selftests/bpf: Add tests for bucket resume logic in established sockets Replicate the set of test cases used for UDP socket iterators to test similar scenarios for TCP established sockets. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Acked-by: Stanislav Fomichev commit 8fc0c5a82d04e1582b666e3c407340e66493608f Author: Jordan Rife Date: Mon Jul 14 11:09:15 2025 -0700 selftests/bpf: Create iter_tcp_destroy test program Prepare for bucket resume tests for established TCP sockets by creating a program to immediately destroy and remove sockets from the TCP ehash table, since close() is not deterministic. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Acked-by: Stanislav Fomichev commit 07ebabbbfe9b4c95e8f1f144f21c07fe830fa501 Author: Jordan Rife Date: Mon Jul 14 11:09:14 2025 -0700 selftests/bpf: Create established sockets in socket iterator tests Prepare for bucket resume tests for established TCP sockets by creating established sockets. Collect socket fds from connect() and accept() sides and pass them to test cases. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Acked-by: Stanislav Fomichev commit 08327292e7093de9b68ef02fe975738799ceedf4 Author: Jordan Rife Date: Mon Jul 14 11:09:13 2025 -0700 selftests/bpf: Make ehash buckets configurable in socket iterator tests Prepare for bucket resume tests for established TCP sockets by making the number of ehash buckets configurable. Subsequent patches force all established sockets into the same bucket by setting ehash_buckets to one. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Acked-by: Stanislav Fomichev commit b89798e79cf79b03af8797391f1f844efe924819 Author: Christoph Hellwig Date: Fri Jul 11 10:12:32 2025 +0200 jfs: stop using write_cache_pages Stop using the obsolete write_cache_pages and use writeback_iter directly. Signed-off-by: Christoph Hellwig Signed-off-by: Dave Kleikamp commit 2d91b3765cd05016335cd5df5e5c6a29708ec058 Author: Lizhi Xu Date: Fri Jun 13 11:05:34 2025 +0800 jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so its inode pages are not truncated. This causes the bugon to be triggered when executing clear_inode() because nrpages is greater than 0. Reported-by: syzbot+6e516bb515d93230bc7b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6e516bb515d93230bc7b Signed-off-by: Lizhi Xu Signed-off-by: Dave Kleikamp commit 1014354cd8d40e81e9a6e9037a10ebfc0b656d27 Author: Suchit Karunakaran Date: Thu Jun 5 23:26:34 2025 +0530 jfs: jfs_xtree: replace XT_GETPAGE macro with xt_getpage() Replace legacy XT_GETPAGE macro with an inline function that returns a xtpage_t pointer and update all instances of XT_GETPAGE in jfs_xtree.c Signed-off-by: Suchit Karunakaran Simplified xt_getpage by removing size and rc arguments. Signed-off-by: Dave Kleikamp commit 2d04df8116426b6c7b9f8b9b371250f666a2a2fb Author: Edward Adam Davis Date: Wed Jun 4 14:48:43 2025 +0800 jfs: Regular file corruption check The reproducer builds a corrupted file on disk with a negative i_size value. Add a check when opening this file to avoid subsequent operation failures. Reported-by: syzbot+630f6d40b3ccabc8e96e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=630f6d40b3ccabc8e96e Tested-by: syzbot+630f6d40b3ccabc8e96e@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Signed-off-by: Dave Kleikamp commit c214006856ff52a8ff17ed8da52d50601d54f9ce Author: Arnaud Lecomte Date: Thu Apr 24 00:13:51 2025 +0200 jfs: upper bound check of tree index in dbAllocAG When computing the tree index in dbAllocAG, we never check if we are out of bounds realative to the size of the stree. This could happen in a scenario where the filesystem metadata are corrupted. Reported-by: syzbot+cffd18309153948f3c3e@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=cffd18309153948f3c3e Tested-by: syzbot+cffd18309153948f3c3e@syzkaller.appspotmail.com Signed-off-by: Arnaud Lecomte Signed-off-by: Dave Kleikamp commit a68a6bef0e75fb9e5aea1399d8538f4e3584dab1 Author: Andreas Hindborg Date: Thu Jun 12 15:09:44 2025 +0200 rust: types: require `ForeignOwnable::into_foreign` return non-null The intended implementations of `ForeignOwnable` will not return null pointers from `into_foreign`, as this would render the implementation of `try_from_foreign` useless. Current users of `ForeignOwnable` rely on `into_foreign` returning non-null pointers. So require `into_foreign` to return non-null pointers. Suggested-by: Benno Lossin Suggested-by: Alice Ryhl Signed-off-by: Andreas Hindborg Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250612-pointed-to-v3-2-b009006d86a1@kernel.org Signed-off-by: Miguel Ojeda commit 12717ebeffcf3e34063dbc1e1b7f34924150c7c9 Author: Andreas Hindborg Date: Thu Jun 12 15:09:43 2025 +0200 rust: types: add FOREIGN_ALIGN to ForeignOwnable The current implementation of `ForeignOwnable` is leaking the type of the opaque pointer to consumers of the API. This allows consumers of the opaque pointer to rely on the information that can be extracted from the pointer type. To prevent this, change the API to the version suggested by Maira Canal (link below): Remove `ForeignOwnable::PointedTo` in favor of a constant, which specifies the alignment of the pointers returned by `into_foreign`. With this change, `ArcInner` no longer needs `pub` visibility, so change it to private. Suggested-by: Alice Ryhl Suggested-by: Maíra Canal Link: https://lore.kernel.org/r/20240309235927.168915-3-mcanal@igalia.com Acked-by: Danilo Krummrich Reviewed-by: Benno Lossin Signed-off-by: Andreas Hindborg Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250612-pointed-to-v3-1-b009006d86a1@kernel.org Signed-off-by: Miguel Ojeda commit b6f885060e8e24f1a1a9205ba41a0524964e8c30 Author: Onur Özkan Date: Tue Jul 8 10:58:50 2025 +0300 rust: rbtree: simplify finding `current` in `remove_current` The previous version used a verbose `match` to get `current`, which may be slightly confusing at first glance. This change makes it shorter and more clearly expresses the intent: prefer `next` if available, otherwise fall back to `prev`. Signed-off-by: Onur Özkan Reviewed-by: Alice Ryhl Reviewed-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250708075850.25789-1-work@onurozkan.dev Signed-off-by: Miguel Ojeda commit 8ffb945647f8740e2eab81ace8c87f9734c85f95 Author: Krishna Ketan Rai Date: Sun Jun 29 20:55:32 2025 +0530 rust: helpers: sort includes alphabetically The helper includes should be sorted alphabetically as indicated by the comment at the top of the file, but they were not. Sort them properly. Suggested-by: Alice Ryhl Link: https://github.com/Rust-for-Linux/linux/issues/1174 Signed-off-by: Krishna Ketan Rai Link: https://lore.kernel.org/r/20250629152533.889-1-prafulrai522@gmail.com Signed-off-by: Miguel Ojeda commit 60ecf796cdc8638c570a4ad06bae6a0d48a8986d Author: Alice Ryhl Date: Mon Jun 16 13:45:57 2025 +0000 rust: uaccess: use newtype for user pointers Currently, Rust code uses a typedef for unsigned long to represent userspace addresses. This is unfortunate because it means that userspace addresses could accidentally be mixed up with other integers. To alleviate that, we introduce a new UserPtr struct that wraps a raw pointer to represent a userspace address. By using a struct, type checking enforces that userspace addresses cannot be mixed up with anything else. This is similar to the __user annotation in C that detects cases where user pointers are mixed with non-user pointers. Note that unlike __user pointers in C, this type is just a pointer without a target type. This means that it can't detect cases such as mixing up which struct this user pointer references. However, that is okay due to the way this is intended to be used - generally, you create a UserPtr in your ioctl callback from the provided usize *before* dispatching on which ioctl is in use, and then after dispatching on the ioctl you pass the UserPtr into a UserSliceReader or UserSliceWriter; selecting the target type does not happen until you have obtained the UserSliceReader/Writer. The UserPtr type is not marked with #[derive(Debug)], which means that it's not possible to print values of this type. This avoids ASLR leakage. The type is added to the prelude as it is a fairly fundamental type similar to c_int. The wrapping_add() method is renamed to wrapping_byte_add() for consistency with the method name found on raw pointers. Reviewed-by: Benno Lossin Reviewed-by: Danilo Krummrich Reviewed-by: Christian Schrefl Reviewed-by: Boqun Feng Reviewed-by: Greg Kroah-Hartman Signed-off-by: Alice Ryhl Link: https://lore.kernel.org/r/20250616-userptr-newtype-v3-1-5ff7b2d18d9e@google.com [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit 601b1d0d9395c711383452bd0d47037afbbb4bcf Author: Arnd Bergmann Date: Mon Jul 14 22:57:38 2025 +0200 iommu/tegra241-cmdqv: import IOMMUFD module namespace The tegra variant of smmu-v3 now uses the iommufd mmap interface but is missing the corresponding import: ERROR: modpost: module arm_smmu_v3 uses symbol _iommufd_object_depend from namespace IOMMUFD, but does not import it. ERROR: modpost: module arm_smmu_v3 uses symbol iommufd_viommu_report_event from namespace IOMMUFD, but does not import it. ERROR: modpost: module arm_smmu_v3 uses symbol _iommufd_destroy_mmap from namespace IOMMUFD, but does not import it. ERROR: modpost: module arm_smmu_v3 uses symbol _iommufd_object_undepend from namespace IOMMUFD, but does not import it. ERROR: modpost: module arm_smmu_v3 uses symbol _iommufd_alloc_mmap from namespace IOMMUFD, but does not import it. Fixes: b135de24cfc0 ("iommu/tegra241-cmdqv: Add user-space use support") Link: https://patch.msgid.link/r/20250714205747.3475772-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Signed-off-by: Jason Gunthorpe commit 7bce7ae1a1f6cfbc81ed60ddf65b306bb1ebf8f2 Author: Mikhail Kalashnikov Date: Fri Jul 11 11:57:27 2025 +0800 dt-bindings: gpu: mali-bifrost: Add Allwinner A523 compatible Add a compatible for the Allwinner A523 SoC, with an integrated ARM Mali G57 MC1 (Valhall-JM) GPU. Signed-off-by: Mikhail Kalashnikov Link: https://lore.kernel.org/r/20250711035730.17507-2-iuncuim@gmail.com Signed-off-by: Rob Herring (Arm) commit 3f0a014f3b6b5a953a6d13d358a39154d5cdf688 Author: Krzysztof Kozlowski Date: Sun Jul 13 14:46:39 2025 +0200 docs: dt: writing-schema: Document preferred order of properties Document established Devicetree bindings maintainers review practice: using DTS coding style property order in both 'properties' and 'required' secions. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250713-dt-bindings-docs-v2-4-672c898054ae@linaro.org Signed-off-by: Rob Herring (Arm) commit 6a57cf210711c068a650bd86acae4a88303dfd5d Author: Krzysztof Kozlowski Date: Sun Jul 13 14:46:38 2025 +0200 docs: dt: writing-bindings: Document discouraged instance IDs Document established Devicetree bindings maintainers review practice: instance indexes, either as properties or as custom new OF alias, are not accepted. Recommended way is to use, depending on the situation/hardware: different compatible, cell arguments or syscon phandle arguments. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250713-dt-bindings-docs-v2-3-672c898054ae@linaro.org Signed-off-by: Rob Herring (Arm) commit a1d87a3586152f52856b449c4787f21cb35d430f Author: Krzysztof Kozlowski Date: Sun Jul 13 14:46:37 2025 +0200 docs: dt: writing-bindings: Document compatible and filename naming Document established Devicetree bindings maintainers review practices: 1. Compatibles should not use bus suffixes to encode the type of interface, because the parent bus node defines that interface, e.g. "vendor,device" instead of "vendor,device-i2c" + "vendor,device-spi". 2. If the compatible represents the device as a whole, it should not contain the type of device in the name. 3. Filenames should match compatible. The best if match is 100%, but if binding has multiple compatibles, then one of the fallbacks should be used. Alternatively a genericish name is allowed if it follows "vendor,device" style. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250713-dt-bindings-docs-v2-2-672c898054ae@linaro.org Signed-off-by: Rob Herring (Arm) commit 651fcd25527cd2ac0116530ca53c637d02562bca Author: Krzysztof Kozlowski Date: Sun Jul 13 14:46:36 2025 +0200 docs: dt: submitting-patches: Avoid 'YAML' in the subject and add an example Patches adding new device bindings should avoid 'YAML' keyword in the subject, because all bindings are supposed to be in DT schema format, which uses YAML. The DT schema is welcomed only in case of patches doing conversion. Effectively people get confused that subject should not contain anything else than device name after the prefix, so add two recommended examples. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250713-dt-bindings-docs-v2-1-672c898054ae@linaro.org Signed-off-by: Rob Herring (Arm) commit f4d51b6ce51dfa9c0a238416f47dfe4726be4e70 Author: Lucas De Marchi Date: Thu Jul 10 13:33:49 2025 -0700 drm/xe/lrc: Add table with LRC layout Add a table to document the LRC's BO layout to make it easier to visualize how each region stacks on top of each other. Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250710-lrc-refactors-v2-4-a5e2ca03f6bd@intel.com Signed-off-by: Lucas De Marchi commit aded26ccaaa87ec9d7665eb7be25be4c70672b28 Author: Tvrtko Ursulin Date: Thu Jul 10 13:33:52 2025 -0700 drm/xe: Waste fewer instructions in emit_wa_job() I was debugging some unrelated issue and noticed the current code was very verbose. We can improve it easily by using the more common batch buffer building pattern. Before: bb->cs[bb->len++] = MI_LOAD_REGISTER_REG | MI_LRR_DST_CS_MMIO; c4d: 41 8b 56 10 mov 0x10(%r14),%edx c51: 49 8b 4e 08 mov 0x8(%r14),%rcx c55: 8d 72 01 lea 0x1(%rdx),%esi c58: 41 89 76 10 mov %esi,0x10(%r14) c5c: c7 04 91 01 00 08 15 movl $0x15080001,(%rcx,%rdx,4) bb->cs[bb->len++] = entry->reg.addr; c63: 8b 08 mov (%rax),%ecx c65: 41 8b 56 10 mov 0x10(%r14),%edx c69: 49 8b 76 08 mov 0x8(%r14),%rsi c6d: 81 e1 ff ff 3f 00 and $0x3fffff,%ecx c73: 8d 7a 01 lea 0x1(%rdx),%edi c76: 41 89 7e 10 mov %edi,0x10(%r14) c7a: 89 0c 96 mov %ecx,(%rsi,%rdx,4) ..etc.. After: *cs++ = MI_LOAD_REGISTER_REG | MI_LRR_DST_CS_MMIO; c52: 41 c7 04 24 01 00 08 movl $0x15080001,(%r12) c59: 15 *cs++ = entry->reg.addr; c5a: 8b 10 mov (%rax),%edx ..etc.. Resulting in the following binary change: add/remove: 0/0 grow/shrink: 0/2 up/down: 0/-348 (-348) Function old new delta xe_gt_record_default_lrcs.cold 304 296 -8 xe_gt_record_default_lrcs 2200 1860 -340 Total: Before=13554, After=13206, chg -2.57% Signed-off-by: Tvrtko Ursulin Reviewed-by: Lucas De Marchi Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250710-lrc-refactors-v2-7-a5e2ca03f6bd@intel.com Signed-off-by: Lucas De Marchi commit f4b538245f6a52fbe196b44a95c02aae566e3fb5 Author: Lucas De Marchi Date: Thu Jul 10 13:33:51 2025 -0700 drm/xe/gt: Drop third submission for default context There's no need to submit the nop job again on the first queue. Any state needed is already saved when the first LRC is switched out. The comment is a little misleading regarding indirect W/A: first of all there's still no indirect W/A enabled and secondly, even after they are, there's no need to submit this job again for having their state propagated: the indirect W/A will actually run on every LRC switch. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250710-lrc-refactors-v2-6-a5e2ca03f6bd@intel.com Signed-off-by: Lucas De Marchi commit 6d891d22c627adaf9c759bceab0fc44f5ed6b8ae Author: Lucas De Marchi Date: Thu Jul 10 13:33:50 2025 -0700 drm/xe/lrc: Remove leftover TODO/FIXME There isn't anything to set for CTX_TIMESTAMP handling in the empty LRC: that is set on every LRC init since it should always start from 0 rather than the value saved in the image after first submission. The FIXME about perma-pinning also doesn't make much sense as we will always going to pin the lrc and the GGTT mapping has nothing to do with VM bind. Nuke these leftover comments. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250710-lrc-refactors-v2-5-a5e2ca03f6bd@intel.com Signed-off-by: Lucas De Marchi commit fab2cc0c09fd4e6ebfa645af0914fd5917478e7f Author: Lucas De Marchi Date: Thu Jul 10 13:33:48 2025 -0700 drm/xe/gt: Extract emit_job_sync() Both the nop and wa jobs are going through the same boiler plate calls to emit the job with a timeout and handling error for both bb and job. Extract emit_job_sync() so those functions create the bb, handling possible errors and delegate the part about really emitting the job and waiting for its completion. Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250710-lrc-refactors-v2-3-a5e2ca03f6bd@intel.com Signed-off-by: Lucas De Marchi commit e4cb5823ba3e2668ef5c164898e2aa2c0ad73742 Author: Lucas De Marchi Date: Thu Jul 10 13:33:47 2025 -0700 drm/xe: Count dwords before allocating The bb allocation in emit_wa_job() is wrong in 2 ways: first it's allocating enough space for the 3DSTATE or hardcoding 4k depending on the engine. In the first case it doesn't account for the WAs and in the former it may not be sufficient. Secondly it's using the size instead of number of dwords, causing the buffer to be 4x bigger than needed: xe_bb_new() receives number of dwords as parameter and its declaration was also not following its implementation. Lastly, reword the debug message since it's not only about the LRC WAs anymore as it also include the 3DSTATE for render. While it's unlikely this is causing any real issue, let's calculate the needed space and allocate just enough. Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250710-lrc-refactors-v2-2-a5e2ca03f6bd@intel.com Signed-off-by: Lucas De Marchi commit 76650bcf2ae49106a9164406c90feba4c3135763 Author: Lucas De Marchi Date: Thu Jul 10 13:33:46 2025 -0700 drm/xe/lrc: Reduce scope of empty lrc data The only case in which new lrc data is created from scratch is when it's called prior to recording the default lrc. There's no need to check for NULL init_data since in that case the function already failed: just move the allocation where it's needed. Reviewed-by: Tvrtko Ursulin Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250710-lrc-refactors-v2-1-a5e2ca03f6bd@intel.com Signed-off-by: Lucas De Marchi commit 84f890414a12b8d1480045b92a5e4e6ac4ab3419 Author: Michał Winiarski Date: Wed Jul 2 11:35:22 2025 +0200 PCI/IOV: Allow drivers to control VF BAR size Drivers could leverage the fact that the VF BAR MMIO reservation is created for total number of VFs supported by the device by resizing the BAR to larger size when smaller number of VFs is enabled. Add pci_iov_vf_bar_set_size() to control the size and a pci_iov_vf_bar_get_sizes() helper to get the VF BAR sizes that will allow up to num_vfs to be successfully enabled with the current underlying reservation size. Signed-off-by: Michał Winiarski Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20250702093522.518099-6-michal.winiarski@intel.com commit e1ba95a168e6f771960c0afc4e44984cf5cf659c Author: Michał Winiarski Date: Wed Jul 2 11:35:21 2025 +0200 PCI/IOV: Check that VF BAR fits within the reservation When the resource representing a VF MMIO BAR reservation is created, its size is always large enough to accommodate the BAR of all SR-IOV Virtual Functions that can potentially be created (total VFs). If for whatever reason it's not possible to accommodate all VFs, the resource is not assigned and no VFs can be created. An upcoming change will allow VF BAR size to be modified by drivers at a later point in time, which means that the check for resource assignment is no longer sufficient. Add an additional check that verifies that the VF BAR for all enabled VFs fits within the underlying reservation resource. Signed-off-by: Michał Winiarski Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20250702093522.518099-5-michal.winiarski@intel.com commit e200f4f7eab52bb7affcd92bf079958326c154d5 Author: Michał Winiarski Date: Wed Jul 2 11:35:20 2025 +0200 PCI/IOV: Allow IOV resources to be resized in pci_resize_resource() Similar to regular resizable BARs, VF BARs can also be resized. The capability layout is the same as PCI_EXT_CAP_ID_REBAR, which means we can reuse most of the implementation, the only difference being resource size calculation (which is multiplied by total VFs) and memory decoding (which is controlled by a separate VF MSE field in SR-IOV cap). Extend the pci_resize_resource() function to accept IOV resources. See PCIe r6.2, sec 7.8.7. Signed-off-by: Michał Winiarski Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20250702093522.518099-4-michal.winiarski@intel.com commit 535bdbeaacf96a8c4ef8d726382fb8fae97f168f Author: Michał Winiarski Date: Wed Jul 2 11:35:19 2025 +0200 PCI/IOV: Add pci_resource_num_to_vf_bar() to convert VF BAR number to/from IOV resource There are multiple places where conversions between IOV resources and corresponding VF BAR numbers are done. Extract the logic to pci_resource_num_from_vf_bar() and pci_resource_num_to_vf_bar() helpers. Suggested-by: Ilpo Järvinen Signed-off-by: Michał Winiarski Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Acked-by: Christian König Link: https://patch.msgid.link/20250702093522.518099-3-michal.winiarski@intel.com commit 5a8f77e24a30bbce2fa57926f3dede84894fd10a Author: Michał Winiarski Date: Wed Jul 2 11:35:18 2025 +0200 PCI/IOV: Restore VF resizable BAR state after reset Similar to regular resizable BARs, VF BARs can also be resized, e.g. by the system firmware or the PCI subsystem itself. The capability layout is the same as PCI_EXT_CAP_ID_REBAR. Add the capability ID and restore it as a part of IOV state. See PCIe r6.2, sec 7.8.7. Signed-off-by: Michał Winiarski Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Reviewed-by: Christian König Link: https://patch.msgid.link/20250702093522.518099-2-michal.winiarski@intel.com commit 0877ad1c4e7ab0b873c3a63c157ed2ae34eab77b Author: Nikolay Borisov Date: Mon Jul 14 20:02:58 2025 +0300 x86/mm: Remove duplicated __PAGE_KERNEL(_EXEC) definitions __PAGE_KERNEL(_EXEC) is defined twice, just remove the superfluous set. No functional changes. Signed-off-by: Nikolay Borisov Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250714170258.390175-1-nik.borisov@suse.com commit f00468124a08a7ecd6f2ed932c57d86a1fc249db Author: Jordan Rife Date: Mon Jul 14 11:09:12 2025 -0700 selftests/bpf: Allow for iteration over multiple states Add parentheses around loopback address check to fix up logic and make the socket state filter configurable for the TCP socket iterators. Iterators can skip the socket state check by setting ss to 0. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Acked-by: Stanislav Fomichev commit 346066c3278f3baa61b1abc8a03721ed2684efe7 Author: Jordan Rife Date: Mon Jul 14 11:09:11 2025 -0700 selftests/bpf: Allow for iteration over multiple ports Prepare to test TCP socket iteration over both listening and established sockets by allowing the BPF iterator programs to skip the port check. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Acked-by: Stanislav Fomichev commit da1d987d3b39a91e53be888c29610f57fb67bbe0 Author: Jordan Rife Date: Mon Jul 14 11:09:10 2025 -0700 selftests/bpf: Add tests for bucket resume logic in listening sockets Replicate the set of test cases used for UDP socket iterators to test similar scenarios for TCP listening sockets. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Acked-by: Stanislav Fomichev commit f5080f612a1c587bf636bb23d2a2f4de276d60e4 Author: Jordan Rife Date: Mon Jul 14 11:09:09 2025 -0700 bpf: tcp: Avoid socket skips and repeats during iteration Replace the offset-based approach for tracking progress through a bucket in the TCP table with one based on socket cookies. Remember the cookies of unprocessed sockets from the last batch and use this list to pick up where we left off or, in the case that the next socket disappears between reads, find the first socket after that point that still exists in the bucket and resume from there. This approach guarantees that all sockets that existed when iteration began and continue to exist throughout will be visited exactly once. Sockets that are added to the table during iteration may or may not be seen, but if they are they will be seen exactly once. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Acked-by: Stanislav Fomichev commit efeb820951ebf3778830256496ff72d00d135310 Author: Jordan Rife Date: Mon Jul 14 11:09:08 2025 -0700 bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items Prepare for the next patch that tracks cookies between iterations by converting struct sock **batch to union bpf_tcp_iter_batch_item *batch inside struct bpf_tcp_iter_state. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Reviewed-by: Kuniyuki Iwashima Acked-by: Stanislav Fomichev commit e25ab9b874a4bd8c6e3e5ce66cbe8a1dd4096e2e Author: Jordan Rife Date: Mon Jul 14 11:09:07 2025 -0700 bpf: tcp: Get rid of st_bucket_done Get rid of the st_bucket_done field to simplify TCP iterator state and logic. Before, st_bucket_done could be false if bpf_iter_tcp_batch returned a partial batch; however, with the last patch ("bpf: tcp: Make sure iter->batch always contains a full bucket snapshot"), st_bucket_done == true is equivalent to iter->cur_sk == iter->end_sk. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Reviewed-by: Kuniyuki Iwashima Acked-by: Stanislav Fomichev commit cdec67a489d4fdae3e83e04fca0419136a83c4c2 Author: Jordan Rife Date: Mon Jul 14 11:09:06 2025 -0700 bpf: tcp: Make sure iter->batch always contains a full bucket snapshot Require that iter->batch always contains a full bucket snapshot. This invariant is important to avoid skipping or repeating sockets during iteration when combined with the next few patches. Before, there were two cases where a call to bpf_iter_tcp_batch may only capture part of a bucket: 1. When bpf_iter_tcp_realloc_batch() returns -ENOMEM. 2. When more sockets are added to the bucket while calling bpf_iter_tcp_realloc_batch(), making the updated batch size insufficient. In cases where the batch size only covers part of a bucket, it is possible to forget which sockets were already visited, especially if we have to process a bucket in more than two batches. This forces us to choose between repeating or skipping sockets, so don't allow this: 1. Stop iteration and propagate -ENOMEM up to userspace if reallocation fails instead of continuing with a partial batch. 2. Try bpf_iter_tcp_realloc_batch() with GFP_USER just as before, but if we still aren't able to capture the full bucket, call bpf_iter_tcp_realloc_batch() again while holding the bucket lock to guarantee the bucket does not change. On the second attempt use GFP_NOWAIT since we hold onto the spin lock. I did some manual testing to exercise the code paths where GFP_NOWAIT is used and where ERR_PTR(err) is returned. I used the realloc test cases included later in this series to trigger a scenario where a realloc happens inside bpf_iter_tcp_batch and made a small code tweak to force the first realloc attempt to allocate a too-small batch, thus requiring another attempt with GFP_NOWAIT. Some printks showed both reallocs with the tests passing: Jun 27 00:00:53 crow kernel: again GFP_USER Jun 27 00:00:53 crow kernel: again GFP_NOWAIT Jun 27 00:00:53 crow kernel: again GFP_USER Jun 27 00:00:53 crow kernel: again GFP_NOWAIT With this setup, I also forced each of the bpf_iter_tcp_realloc_batch calls to return -ENOMEM to ensure that iteration ends and that the read() in userspace fails. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Reviewed-by: Kuniyuki Iwashima Acked-by: Stanislav Fomichev commit 8271bec9fc1cfe522b1a18cacbefd6712a3d41c2 Author: Jordan Rife Date: Mon Jul 14 11:09:05 2025 -0700 bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch Prepare for the next patch which needs to be able to choose either GFP_USER or GFP_NOWAIT for calls to bpf_iter_tcp_realloc_batch. Signed-off-by: Jordan Rife Signed-off-by: Martin KaFai Lau Reviewed-by: Kuniyuki Iwashima Acked-by: Stanislav Fomichev commit 66b130607908417a126de7fdc55f0c671ac365e6 Author: Eric Biggers Date: Sat Jul 12 16:23:06 2025 -0700 lib/crypto: tests: Add KUnit tests for SHA-1 and HMAC-SHA1 Add a KUnit test suite for the SHA-1 library functions, including the corresponding HMAC support. The core test logic is in the previously-added hash-test-template.h. This commit just adds the actual KUnit suite, and it adds the generated test vectors to the tree so that gen-hash-testvecs.py won't have to be run at build time. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-16-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6dd4d9f7919e73bc7ad247eca82e8be1c123af0a Author: Eric Biggers Date: Wed Jul 9 13:01:12 2025 -0700 lib/crypto: tests: Add KUnit tests for Poly1305 Add a KUnit test suite for the Poly1305 functions. Most of its test cases are instantiated from hash-test-template.h, which is also used by the SHA-2 tests. A couple additional test cases are also included to test edge cases specific to Poly1305. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250709200112.258500-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 571eaeddb67df84c4fd59c5496866c049fb25efe Author: Eric Biggers Date: Wed Jul 9 13:01:11 2025 -0700 lib/crypto: tests: Add KUnit tests for SHA-384 and SHA-512 Add KUnit test suites for the SHA-384 and SHA-512 library functions, including the corresponding HMAC support. The core test logic is in the previously-added hash-test-template.h. This commit just adds the actual KUnit suites, and it adds the generated test vectors to the tree so that gen-hash-testvecs.py won't have to be run at build time. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250709200112.258500-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 4dcf6caddaa0471c134bf0c869086fd0b57a9cc4 Author: Eric Biggers Date: Wed Jul 9 13:01:10 2025 -0700 lib/crypto: tests: Add KUnit tests for SHA-224 and SHA-256 Add KUnit test suites for the SHA-224 and SHA-256 library functions, including the corresponding HMAC support. The core test logic is in the previously-added hash-test-template.h. This commit just adds the actual KUnit suites, and it adds the generated test vectors to the tree so that gen-hash-testvecs.py won't have to be run at build time. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250709200112.258500-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 950a81224e8bda92813c5ecf851f488c94f06aba Author: Eric Biggers Date: Wed Jul 9 13:01:09 2025 -0700 lib/crypto: tests: Add hash-test-template.h and gen-hash-testvecs.py Add hash-test-template.h which generates the following KUnit test cases for hash functions: test_hash_test_vectors test_hash_all_lens_up_to_4096 test_hash_incremental_updates test_hash_buffer_overruns test_hash_overlaps test_hash_alignment_consistency test_hash_ctx_zeroization test_hash_interrupt_context_1 test_hash_interrupt_context_2 test_hmac (when HMAC is supported) benchmark_hash (when CONFIG_CRYPTO_LIB_BENCHMARK=y) The initial use cases for this will be sha224_kunit, sha256_kunit, sha384_kunit, sha512_kunit, and poly1305_kunit. Add a Python script gen-hash-testvecs.py which generates the test vectors required by test_hash_test_vectors, test_hash_all_lens_up_to_4096, and test_hmac. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250709200112.258500-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 998646b3c1129188f1fdffac3779feb9708b4b4a Author: Eric Biggers Date: Mon Jun 30 10:22:24 2025 -0700 fsverity: Switch from crypto_shash to SHA-2 library fsverity supports two hash algorithms: SHA-256 and SHA-512. Since both of these have a library API now, just use the library API instead of crypto_shash. Even with multiple algorithms, the library-based code still ends up being quite a bit simpler, due to how clumsy the old-school crypto API is. The library-based code is also more efficient, since it avoids overheads such as indirect calls. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630172224.46909-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b309bf7c3e35e86e414921ff655a9578016a1788 Author: Eric Biggers Date: Sat Jun 14 15:17:23 2025 -0700 fsverity: Explicitly include Fix build warnings with W=1 that started appearing after commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1"). Link: https://lore.kernel.org/r/20250614221723.131827-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit f93c27092a5b61b2ac1a29f1d063a15eb09512f2 Author: Eric Biggers Date: Mon Jun 30 10:48:05 2025 -0700 apparmor: use SHA-256 library API instead of crypto_shash API This user of SHA-256 does not support any other algorithm, so the crypto_shash abstraction provides no value. Just use the SHA-256 library API instead, which is much simpler and easier to use. Acked-by: John Johansen Link: https://lore.kernel.org/r/20250630174805.59010-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c76ed8790b3018fe36647d9aae96e0373f321184 Author: Eric Biggers Date: Sat Jul 12 16:23:05 2025 -0700 crypto: sha1 - Remove sha1_base.h sha1_base.h is no longer used, so remove it. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-15-ebiggers@kernel.org Signed-off-by: Eric Biggers commit f3d6cb3dc0394b866bc0d1e15157ce45844cf3d3 Author: Eric Biggers Date: Sat Jul 12 16:23:04 2025 -0700 lib/crypto: x86/sha1: Migrate optimized code into library Instead of exposing the x86-optimized SHA-1 code via x86-specific crypto_shash algorithms, instead just implement the sha1_blocks() library function. This is much simpler, it makes the SHA-1 library functions be x86-optimized, and it fixes the longstanding issue where the x86-optimized SHA-1 code was disabled by default. SHA-1 still remains available through crypto_shash, but individual architectures no longer need to handle it. To match sha1_blocks(), change the type of the nblocks parameter of the assembly functions from int to size_t. The assembly functions actually already treated it as size_t. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-14-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9b71d269d10a37ff47823895339b514a4a73689d Author: David Lechner Date: Fri Jul 11 15:44:31 2025 -0500 iio: ABI: fix correctness of I and Q modifiers Update the IIO ABI documentation to reflect the actual usage of channels with I and Q modifiers. These are currently only used in a few drivers: frequency/admv1013 (kernel v5.17): - in_altvoltageY-altvoltageZ_i_calibphase - in_altvoltageY-altvoltageZ_q_calibphase - in_altvoltageY_i_calibbias - in_altvoltageY_q_calibbias frequency/admv1014 (kernel v5.18): - in_altvoltageY_i_phase - in_altvoltageY_q_phase - in_altvoltageY_i_offset - in_altvoltageY_q_offset - in_altvoltageY_i_calibscale_course - in_altvoltageY_i_calibscale_fine - in_altvoltageY_q_calibscale_course - in_altvoltageY_q_calibscale_fine frequency/adrf6780 (kernel v5.16): - out_altvoltageY_i_phase - out_altvoltageY_q_phase There are no _raw or _scale attributes in use, so those are all removed. There are no currentY attributes in use with these modifiers, so those are also removed. All of the voltageY are changed to altvoltageY since that is how they are actually used. None of these channels are used with scan buffers, so all of those attributes are removed as well. And the {in,out}_altvoltageY_{i,q}_phase attributes were missing so those are added. The differential channel names for admv1013 are fixed. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250711-iio-abi-fix-i-and-q-modifiers-v1-1-35963c9c8c01@baylibre.com Signed-off-by: Jonathan Cameron commit e3d455def515af8c9305367511f410e99c750563 Author: Waqar Hameed Date: Fri Jul 4 18:14:38 2025 +0200 iio: Add driver for Nicera D3-323-AA PIR sensor Nicera D3-323-AA is a PIR sensor for human detection. It has support for raw data measurements and detection notification. The communication protocol is custom made and therefore needs to be GPIO bit banged. The device has two main settings that can be configured: a threshold value for detection and a band-pass filter. The configurable parameters for the band-pass filter are the high-pass and low-pass cutoff frequencies and its peak gain. Map these settings to the corresponding parameters in the `iio` framework. Raw data measurements can be obtained from the device. However, since we rely on bit banging, it will be rather cumbersome with buffer support. The main reason being that the data protocol has strict timing requirements (it's serial like UART), and it's mainly used during debugging since in real-world applications only the event notification is of importance. Therefore, only add support for events (for now). Signed-off-by: Waqar Hameed Link: https://patch.msgid.link/29f84da1431f4a3f17fdeef27297a4ab14455404.1751636734.git.waqar.hameed@axis.com Signed-off-by: Jonathan Cameron commit f432a7f9e141635932117d9a483635ba04af229d Author: Waqar Hameed Date: Fri Jul 4 18:14:38 2025 +0200 dt-bindings: iio: proximity: Add Nicera D3-323-AA PIR sensor Nicera D3-323-AA is a PIR sensor for human detection. It has two GPIOs for detection and data communication. Signed-off-by: Waqar Hameed Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/19a2744cebaee57fe5349986094168524baa9838.1751636734.git.waqar.hameed@axis.com Signed-off-by: Jonathan Cameron commit d8cf50c28c0d2a5e4075e06f88bca2db7f26edd7 Author: Waqar Hameed Date: Fri Jul 4 18:14:37 2025 +0200 dt-bindings: vendor-prefixes: Add Nicera Nicera (Nippon Ceramic Co.) is a manufacturer of a wide range of sensors. For example infrared, ultrasonic, gas sensors and much more. Acked-by: Krzysztof Kozlowski Signed-off-by: Waqar Hameed Link: https://patch.msgid.link/b52e82aa312a52c03d2b6c58cf329884d1829d29.1751636734.git.waqar.hameed@axis.com Signed-off-by: Jonathan Cameron commit 9eca012a9fac1cb26cceae080dd3c9fcd432bd7f Author: Krzysztof Kozlowski Date: Sun Jul 13 17:59:58 2025 +0200 iio: dac: vf610: Simplify with devm_clk_get_enabled() Driver is getting clock and almost immediately enabling it, with no relevant code executed between, thus the probe path and cleanups can be simplified with devm_clk_get_enabled(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250713-iio-clk-get-enabled-v1-4-70abc1f9ce6c@linaro.org Signed-off-by: Jonathan Cameron commit 89ef9c6be52e291f8a66b4b83e8252a875a171c2 Author: Krzysztof Kozlowski Date: Sun Jul 13 17:59:57 2025 +0200 iio: adc: vf610: Simplify with dev_err_probe Use dev_err_probe() to make error code handling simpler and handle deferred probe nicely (avoid spamming logs). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250713-iio-clk-get-enabled-v1-3-70abc1f9ce6c@linaro.org Signed-off-by: Jonathan Cameron commit a56e41a34ce95c44c3c13245987c2b3db8d9762d Author: Krzysztof Kozlowski Date: Sun Jul 13 17:59:56 2025 +0200 iio: adc: vf610: Drop -ENOMEM error message Core already prints detailed error messages on ENOMEM errors and drivers should avoid repeating it. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250713-iio-clk-get-enabled-v1-2-70abc1f9ce6c@linaro.org Signed-off-by: Jonathan Cameron commit 50467d899a3fc3ea36b944bcc155f26aa0bd2023 Author: David Lechner Date: Wed Jul 9 21:20:01 2025 -0500 iio: imu: bno055: make bno055_sysfs_attr const Add const qualifier to struct bno055_sysfs_attr and its array fields. All of this is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250709-iio-const-data-19-v2-2-fb3fc9191251@baylibre.com Signed-off-by: Jonathan Cameron commit 399b883ec828e436f1a721bf8551b4da8727e65b Author: David Lechner Date: Wed Jul 9 21:20:00 2025 -0500 iio: imu: bno055: fix OOB access of hw_xlate array Fix a potential out-of-bounds array access of the hw_xlate array in bno055.c. In bno055_get_regmask(), hw_xlate was iterated over the length of the vals array instead of the length of the hw_xlate array. In the case of bno055_gyr_scale, the vals array is larger than the hw_xlate array, so this could result in an out-of-bounds access. In practice, this shouldn't happen though because a match should always be found which breaks out of the for loop before it iterates beyond the end of the hw_xlate array. By adding a new hw_xlate_len field to the bno055_sysfs_attr, we can be sure we are iterating over the correct length. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507100510.rGt1YOOx-lkp@intel.com/ Fixes: 4aefe1c2bd0c ("iio: imu: add Bosch Sensortec BNO055 core driver") Signed-off-by: David Lechner Link: https://patch.msgid.link/20250709-iio-const-data-19-v2-1-fb3fc9191251@baylibre.com Cc: Signed-off-by: Jonathan Cameron commit 8749c54202df93af2a01c15865b07eea1e64b6d9 Author: Aleksander Jan Bajkowski Date: Wed Jul 9 00:04:03 2025 +0200 dt-bindings: iio: adc: Add support for MT7981 The temperature sensor in the MT7981 is same as in the MT7986. Add compatible string for mt7981. Signed-off-by: Aleksander Jan Bajkowski Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250708220405.1072393-2-olek2@wp.pl Signed-off-by: Jonathan Cameron commit 964d6d5f1adc6c8b8b459afcf3050ff1cdde2367 Author: Jonathan Cameron Date: Sun Jun 29 19:36:49 2025 +0100 iio: accel: kionix-kx022a: Apply approximate iwyu principles to includes Motivated by the W=1 warning about export.h that was introduced this cycle this is an attempt to apply an approximation of the principles of including whatever is used in the file directly. Helped by the include-what-you-use tool. Reasoning: - Drop linux/moduleparam.h as completely unused. - linux/array_size.h for ARRAY_SIZE() - linux/bitmap.h for for_each_set_bit - linux/errno.h for error codes. - linux/export.h for EXPORT_SYMBOL*() - linux/math64.h for do_div - alternative would be asm/div64.h - linux/minmax.h for min() - linux/sysfs.h for sysfs_emit() - linux/time64.h for USEC_PER_MSEC - linux/iio/buffer.h for iio_push_to_buffers_with_timestamp() - asm/byteorder.h for le16_to_cpu() Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250629183649.184479-1-jic23@kernel.org Signed-off-by: Jonathan Cameron commit 6098df897d1355a4ae209e84de08697f4a961f38 Author: Marcelo Schmitt Date: Mon Jul 7 10:54:29 2025 -0300 iio: adc: ad4170-4: Add support for weigh scale, thermocouple, and RTD sens The AD4170-4 design provides features to aid interfacing with weigh scales, thermocouples, and RTD sensors, which are set up with additional circuitry for proper sensor operation. A key characteristic of those sensors is that the circuit they are in must be excited with a single, a pair, or two pairs of signals. The external circuit can be excited either by a voltage supply or by AD4170-4 excitation signals. The sensor can then be read through a different pair of lines that are connected to the AD4170-4 ADC. Extend the ad4170-4 driver to handle external circuit sensors. Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/52686943040ecad34cc89833d4d5d37f1a51f412.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit 03223844b8f2ef98813798dfc93bf63019475d59 Author: Marcelo Schmitt Date: Mon Jul 7 10:54:09 2025 -0300 iio: adc: ad4170-4: Add support for internal temperature sensor The AD4170-4 has an internal temperature sensor that can be read using the ADC. Whenever possible, configure an IIO channel to provide the chip's temperature. Reviewed-by: Nuno Sá Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/71ac994060cf79a6c49f39b0c7d04c6c9cbbab00.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit c1e289a0364b4fffb91f3bbd278d623e14922d1f Author: Marcelo Schmitt Date: Mon Jul 7 10:53:48 2025 -0300 iio: adc: ad4170-4: Add GPIO controller support The AD4170-4 has four multifunctional pins that can be used as GPIOs. The GPIO functionality can be accessed when the AD4170-4 chip is not busy performing continuous data capture or handling any other register read/write request. Also, the AD4170-4 does not provide any interrupt based on GPIO pin states so AD4170-4 GPIOs can't be used as interrupt sources. Implement gpio_chip callbacks to make AD4170-4 GPIO pins controllable through the gpiochip interface. Acked-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/e031189d4b7e20cf02dd13220ab1ddf4798760c2.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit 4e5fde6677829652c8159b713e8e3866f68af0a9 Author: Marcelo Schmitt Date: Mon Jul 7 10:53:27 2025 -0300 iio: adc: ad4170-4: Add clock provider support The AD4170-4 chip can use an externally supplied clock at the XTAL2 pin, or an external crystal connected to the XTAL1 and XTAL2 pins. Alternatively, the AD4170-4 can provide its 16 MHz internal clock at the XTAL2 pin. In addition, the chip has a programmable clock divider that allows dividing the external or internal clock frequency, however, control for that is not provided in this patch. Extend the AD4170-4 driver so it effectively uses the provided external clock, if any, or supplies its own clock as a clock provider. Reviewed-by: Nuno Sá Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/68697c7613b1a69d752e541caef28d08b3e59bc1.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit 602a89566cf2b6e6db0da5c7c020e77e276369c2 Author: Marcelo Schmitt Date: Mon Jul 7 10:53:08 2025 -0300 iio: adc: ad4170-4: Add timestamp channel Add timestamp channel allowing to record the moment at which ADC samples are captured in buffered read mode. Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/e0af7e5424898bee0f3edfbb017133624efc169d.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit 9c1d4f4aef0a4f5f91151f9457a90d9ce02eb77e Author: Marcelo Schmitt Date: Mon Jul 7 10:52:46 2025 -0300 iio: adc: ad4170-4: Add support for buffered data capture Extend the AD4170-4 driver to allow buffered data capture in continuous read mode. In continuous read mode, the chip skips the instruction phase and outputs just ADC sample data, enabling faster sample rates to be reached. The internal channel sequencer always starts sampling from channel 0 and channel 0 must be enabled if more than one channel is selected for data capture. The scan mask validation callback checks if the aforementioned condition is met. Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/10ed544d31aa86eb40f93ea947f151d3d9827952.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit a770f70b4f5b154ccb026e661b11b012e544ecc9 Author: Marcelo Schmitt Date: Mon Jul 7 10:52:25 2025 -0300 iio: adc: ad4170-4: Add digital filter and sample frequency config support Add support for sinc3, sinc5, and averaged sinc5 digital filters along with sample frequency configuration. Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/31f4226b4172b0bbb26daa054b74b25b1966c7b2.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit 99992f6348a136a5d8a672613d00a354969041f0 Author: Marcelo Schmitt Date: Mon Jul 7 10:51:59 2025 -0300 Documentation: ABI: IIO: Add sinc5+avg to the filter_type_available list Add the sinc5+avg filter type to the list of possible values for the filter_type_available attribute. The sinc5+avg filter type is handled by the ad4170 driver. Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/7ae9ec6da3a3f0c33206880fcba35a17531cf219.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit cdd03d50e206cf2dba5fc0fb06faf7717c0a7bef Author: Marcelo Schmitt Date: Mon Jul 7 10:51:29 2025 -0300 iio: adc: ad4170-4: Add support for calibration bias Add support for ADC calibration bias/offset configuration. Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/f240fce693d62ec8d587885074bf540e01919b31.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit be2cdc5cb244506dc0a9198ca184ca1c7ff88a1c Author: Marcelo Schmitt Date: Mon Jul 7 10:51:05 2025 -0300 iio: adc: ad4170-4: Add support for calibration gain Add support for ADC calibration gain configuration. Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/ea8d07cad9b7b6106f0b5664c403ed080b362a6b.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit 5731f2a06c0f6ba5d03fea9d588abcde8ba8f075 Author: Ana-Maria Cusco Date: Mon Jul 7 10:50:44 2025 -0300 iio: adc: Add basic support for AD4170-4 The AD4170-4 is a multichannel, low noise, 24-bit precision sigma-delta analog to digital converter. The AD4170-4 design offers a flexible data acquisition solution with crosspoint multiplexed analog inputs, configurable ADC voltage reference inputs, ultra-low noise integrated PGA, digital filtering, wide range of configurable output data rates, internal oscillator and temperature sensor, four GPIOs, and integrated features for interfacing with load cell weigh scales, RTD, and thermocouple sensors. Add basic support for the AD4170-4 ADC with the following features: - Single-shot read. - Analog front end PGA configuration. - Differential and pseudo-differential input configuration. Signed-off-by: Ana-Maria Cusco Co-developed-by: Marcelo Schmitt Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/ce3fd150bd63a2aed6eb6fe59aad6d60c0f9fb67.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit 1b3cee41235b9d66ae0da50c1a6e740d92c61c1b Author: Marcelo Schmitt Date: Mon Jul 7 10:50:18 2025 -0300 dt-bindings: iio: adc: Add AD4170-4 Add device tree documentation for AD4170-4 and similar sigma-delta ADCs. The AD4170-4 is a 24-bit, multichannel, sigma-delta ADC. Acked-by: Conor Dooley Signed-off-by: Marcelo Schmitt Link: https://patch.msgid.link/aa4b3be541c7b759560f8e0c5340a456cb2f3801.1751895245.git.marcelo.schmitt@analog.com Signed-off-by: Jonathan Cameron commit 7586eb9b67995b3d6824a886783dab5e80b7e8d2 Author: Jean-Baptiste Maneyrol Date: Mon Jun 30 21:47:31 2025 +0200 iio: imu: inv_icm42600: add wakeup functionality for Wake-on-Motion When Wake-on-Motion is on, enable system wakeup and keep the chip on for waking up the system with an interrupt. Signed-off-by: Jean-Baptiste Maneyrol Link: https://patch.msgid.link/20250630-losd-3-inv-icm42600-add-wom-support-v6-3-5bb0c84800d9@tdk.com Signed-off-by: Jonathan Cameron commit 50cfaa9a46c8ba42cb4a999dfc9c7baa0943cc5a Author: Jean-Baptiste Maneyrol Date: Mon Jun 30 21:47:30 2025 +0200 iio: imu: inv_icm42600: add WoM support Add WoM as accel roc rising x|y|z event. Signed-off-by: Jean-Baptiste Maneyrol Link: https://patch.msgid.link/20250630-losd-3-inv-icm42600-add-wom-support-v6-2-5bb0c84800d9@tdk.com Signed-off-by: Jonathan Cameron commit 0c122c280e78150b0c666fb69db0000cdd1d7e0a Author: Jean-Baptiste Maneyrol Date: Mon Jun 30 21:47:29 2025 +0200 iio: imu: inv_icm42600: reorganize DMA aligned buffers in structure Move all DMA aligned buffers together at the end of the structure. 1. Timestamp anynomous structure is not used with DMA so it doesn't belong after __aligned(IIO_DMA_MINALIGN). 2. struct inv_icm42600_fifo contains it's own __aligned(IIO_DMA_MINALIGN) within it at the end so it should not be after __aligned(IIO_DMA_MINALIGN) in the outer struct either. 3. Normally 1 would have been considered a bug, but because of the extra alignment from 2, it actually was OK, but we shouldn't be relying on such quirks. Signed-off-by: Jean-Baptiste Maneyrol Link: https://patch.msgid.link/20250630-losd-3-inv-icm42600-add-wom-support-v6-1-5bb0c84800d9@tdk.com Signed-off-by: Jonathan Cameron commit f057897dcbffd60f439fd240150ac94cc36c13a4 Author: Lothar Rubusch Date: Wed Jul 2 23:03:09 2025 +0000 iio: accel: adxl345: simplify reading the FIFO Bulk FIFO reading can be streamlined by eliminating redundant variables and simplifying the process of reading x-, y-, and z-axis measurement sets. This is a refactoring change with no expected impact on functionality. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250702230315.19297-3-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 7a7242d86231f489476653b3d7baf020cab3d786 Author: Lothar Rubusch Date: Wed Jul 2 23:03:08 2025 +0000 iio: accel: adxl345: simplify interrupt mapping Refactor the sensor interrupt mapping by utilizing regmap_assign_bits(), which accepts a boolean value directly. Introduce a helper function to streamline the identification of the configured interrupt line pin. Also, use identifiers from units.h to represent the full 8-bit register when setting bits. This is a purely refactoring change and does not affect functionality. Signed-off-by: Lothar Rubusch Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250702230315.19297-2-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 0755fd550cde901923203dabd75e3f4de08bc9dc Author: Lothar Rubusch Date: Wed Jul 2 23:08:19 2025 +0000 docs: iio: add ADXL313 accelerometer Add documentation for the ADXL313 accelerometer driver. Reviewed-by: Andy Shevchenko Signed-off-by: Lothar Rubusch Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250702230819.19353-9-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit c751059985e02467c7fa6b14676c1d56d089b3cc Author: Eric Biggers Date: Sat Jul 12 16:23:03 2025 -0700 lib/crypto: sparc/sha1: Migrate optimized code into library Instead of exposing the sparc-optimized SHA-1 code via sparc-specific crypto_shash algorithms, instead just implement the sha1_blocks() library function. This is much simpler, it makes the SHA-1 library functions be sparc-optimized, and it fixes the longstanding issue where the sparc-optimized SHA-1 code was disabled by default. SHA-1 still remains available through crypto_shash, but individual architectures no longer need to handle it. Note: to see the diff from arch/sparc/crypto/sha1_glue.c to lib/crypto/sparc/sha1.h, view this commit with 'git show -M10'. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-13-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 377982d5618a7b80bf2ad3eed9aa62691e984d50 Author: Eric Biggers Date: Sat Jul 12 16:23:02 2025 -0700 lib/crypto: s390/sha1: Migrate optimized code into library Instead of exposing the s390-optimized SHA-1 code via s390-specific crypto_shash algorithms, instead just implement the sha1_blocks() library function. This is much simpler, it makes the SHA-1 library functions be s390-optimized, and it fixes the longstanding issue where the s390-optimized SHA-1 code was disabled by default. SHA-1 still remains available through crypto_shash, but individual architectures no longer need to handle it. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-12-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6b9ae8cfaa7abc65f9fc8bd93f0c707c31b7ce85 Author: Eric Biggers Date: Sat Jul 12 16:23:01 2025 -0700 lib/crypto: powerpc/sha1: Migrate optimized code into library Instead of exposing the powerpc-optimized SHA-1 code via powerpc-specific crypto_shash algorithms, instead just implement the sha1_blocks() library function. This is much simpler, it makes the SHA-1 library functions be powerpc-optimized, and it fixes the longstanding issue where the powerpc-optimized SHA-1 code was disabled by default. SHA-1 still remains available through crypto_shash, but individual architectures no longer need to handle it. Note: to see the diff from arch/powerpc/crypto/sha1-spe-glue.c to lib/crypto/powerpc/sha1.h, view this commit with 'git show -M10'. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-11-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b6ac1dac2f18d1f9714804654ad0643d5aeef4d5 Author: Eric Biggers Date: Sat Jul 12 16:23:00 2025 -0700 lib/crypto: mips/sha1: Migrate optimized code into library Instead of exposing the mips-optimized SHA-1 code via mips-specific crypto_shash algorithms, instead just implement the sha1_blocks() library function. This is much simpler, it makes the SHA-1 library functions be mips-optimized, and it fixes the longstanding issue where the mips-optimized SHA-1 code was disabled by default. SHA-1 still remains available through crypto_shash, but individual architectures no longer need to handle it. Note: to see the diff from arch/mips/cavium-octeon/crypto/octeon-sha1.c to lib/crypto/mips/sha1.h, view this commit with 'git show -M10'. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 00d549bb89e471b7df550459fcb51ffbded39cbf Author: Eric Biggers Date: Sat Jul 12 16:22:59 2025 -0700 lib/crypto: arm64/sha1: Migrate optimized code into library Instead of exposing the arm64-optimized SHA-1 code via arm64-specific crypto_shash algorithms, instead just implement the sha1_blocks() library function. This is much simpler, it makes the SHA-1 library functions be arm64-optimized, and it fixes the longstanding issue where the arm64-optimized SHA-1 code was disabled by default. SHA-1 still remains available through crypto_shash, but individual architectures no longer need to handle it. Remove support for SHA-1 finalization from assembly code, since the library does not yet support architecture-specific overrides of the finalization. (Support for that has been omitted for now, for simplicity and because usually it isn't performance-critical.) To match sha1_blocks(), change the type of the nblocks parameter and the return value of __sha1_ce_transform() from int to size_t. Update the assembly code accordingly. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 70cb6ca58fddb02e269fe743ba75d53d577b5b1c Author: Eric Biggers Date: Sat Jul 12 16:22:58 2025 -0700 lib/crypto: arm/sha1: Migrate optimized code into library Instead of exposing the arm-optimized SHA-1 code via arm-specific crypto_shash algorithms, instead just implement the sha1_blocks() library function. This is much simpler, it makes the SHA-1 library functions be arm-optimized, and it fixes the longstanding issue where the arm-optimized SHA-1 code was disabled by default. SHA-1 still remains available through crypto_shash, but individual architectures no longer need to handle it. To match sha1_blocks(), change the type of the nblocks parameter of the assembly functions from int to size_t. The assembly functions actually already treated it as size_t. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6aa53e861c1a0c042690c9b7c5c153088ae61079 Author: Joshua Hay Date: Tue Jul 8 16:05:54 2025 -0500 idpf: implement get LAN MMIO memory regions The RDMA driver needs to map its own MMIO regions for the sake of performance, meaning the IDPF needs to avoid mapping portions of the BAR space. However, to be HW agnostic, the IDPF cannot assume where these are and must avoid mapping hard coded regions as much as possible. The IDPF maps the bare minimum to load and communicate with the control plane, i.e., the mailbox registers and the reset state registers. Because of how and when mailbox register offsets are initialized, it is easier to adjust the existing defines to be relative to the mailbox region starting address. Use a specific mailbox register write function that uses these relative offsets. The reset state register addresses are calculated the same way as for other registers, described below. The IDPF then calls a new virtchnl op to fetch a list of MMIO regions that it should map. The addresses for the registers in these regions are calculated by determining what region the register resides in, adjusting the offset to be relative to that region, and then adding the register's offset to that region's mapped address. If the new virtchnl op is not supported, the IDPF will fallback to mapping the whole bar. However, it will still map them as separate regions outside the mailbox and reset state registers. This way we can use the same logic in both cases to access the MMIO space. Reviewed-by: Madhu Chittim Signed-off-by: Joshua Hay Signed-off-by: Tatyana Nikolova Signed-off-by: Tony Nguyen commit ed6e1c8796a4fad45e61e3a0c4d9f90b62809052 Author: Joshua Hay Date: Tue Jul 8 16:05:53 2025 -0500 idpf: implement IDC vport aux driver MTU change handler The only event an RDMA vport aux driver cares about right now is an MTU change on its underlying vport. Implement and plumb the handler to signal the pre MTU change event and post MTU change events to the RDMA vport aux driver. Reviewed-by: Madhu Chittim Signed-off-by: Joshua Hay Signed-off-by: Tatyana Nikolova Signed-off-by: Tony Nguyen commit bf86a012e6762330cd78952330d4b7809976aa2f Author: Joshua Hay Date: Tue Jul 8 16:05:52 2025 -0500 idpf: implement remaining IDC RDMA core callbacks and handlers Implement the idpf_idc_request_reset and idpf_idc_rdma_vc_send_sync callbacks for the rdma core auxiliary driver to issue reset events to the idpf and send (synchronous) virtchnl messages to the control plane respectively. Implement and plumb the reset handler for the opposite flow as well, i.e. when the idpf is resetiing and needs to notify the rdma core auxiliary driver. Reviewed-by: Madhu Chittim Signed-off-by: Joshua Hay Signed-off-by: Tatyana Nikolova Signed-off-by: Tony Nguyen commit be91128c579c86d295da4325f6ac4710e4e6d2b4 Author: Joshua Hay Date: Tue Jul 8 16:05:51 2025 -0500 idpf: implement RDMA vport auxiliary dev create, init, and destroy Implement the functions to create, initialize, and destroy an RDMA vport auxiliary device. The vport aux dev creation is dependent on the core aux device to call idpf_idc_vport_dev_ctrl to signal that it is ready for vport aux devices. Implement that core callback to either create and initialize the vport aux dev or deinitialize. RDMA vport aux dev creation is also dependent on the control plane to tell us the vport is RDMA enabled. Add a flag in the create vport message to signal individual vport RDMA capabilities. Reviewed-by: Madhu Chittim Signed-off-by: Joshua Hay Signed-off-by: Tatyana Nikolova Signed-off-by: Tony Nguyen commit f4312e6bfa2a98e94dacc75f96f916b76bdf4259 Author: Joshua Hay Date: Tue Jul 8 16:05:50 2025 -0500 idpf: implement core RDMA auxiliary dev create, init, and destroy Add the initial idpf_idc.c file with the functions to kick off the IDC initialization, create and initialize a core RDMA auxiliary device, and destroy said device. The RDMA core has a dependency on the vports being created by the control plane before it can be initialized. Therefore, once all the vports are up after a hard reset (either during driver load a function level reset), the core RDMA device info will be created. It is populated with the function type (as distinguished by the IDC initialization function pointer), the core idc_ops function points (just stubs for now), the reserved RDMA MSIX table, and various other info the core RDMA auxiliary driver will need. It is then plugged on to the bus. During a function level reset or driver unload, the device will be unplugged from the bus and destroyed. Reviewed-by: Madhu Chittim Signed-off-by: Joshua Hay Signed-off-by: Tatyana Nikolova Signed-off-by: Tony Nguyen commit bfc5cc8b5aecc9b0249322e39d8d6f65bd7c91ac Author: Joshua Hay Date: Tue Jul 8 16:05:49 2025 -0500 idpf: use reserved RDMA vectors from control plane Fetch the number of reserved RDMA vectors from the control plane. Adjust the number of reserved LAN vectors if necessary. Adjust the minimum number of vectors the OS should reserve to include RDMA; and fail if the OS cannot reserve enough vectors for the minimum number of LAN and RDMA vectors required. Create a separate msix table for the reserved RDMA vectors, which will just get handed off to the RDMA core device to do with what it will. Reviewed-by: Madhu Chittim Signed-off-by: Joshua Hay Signed-off-by: Tatyana Nikolova Signed-off-by: Tony Nguyen commit 1a304a2f8f7dbe25f555721f502227f9197145ed Author: Val Packett Date: Sun Jul 6 17:50:27 2025 -0300 drm/panel-edp: Add BOE NE14QDM panel for Dell Latitude 7455 Cannot confirm which variant exactly it is, as the EDID alphanumeric data contains '0RGNR' <0x80> 'NE14QDM' and ends there; but it's 60 Hz and with touch. I do not have access to datasheets for these panels, so the timing is a guess that was tested to work fine on this laptop. Raw EDID dump: 00 ff ff ff ff ff ff 00 09 e5 1e 0b 00 00 00 00 10 20 01 04 a5 1e 13 78 07 fd 85 a7 53 4c 9b 25 0f 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 a7 6d 00 a0 a0 40 78 60 30 20 36 00 2e bc 10 00 00 1a b9 57 00 a0 a0 40 78 60 30 20 36 00 2e bc 10 00 00 1a 00 00 00 fe 00 30 52 47 4e 52 80 4e 45 31 34 51 44 4d 00 00 00 00 00 02 41 31 a8 00 01 00 00 1a 41 0a 20 20 00 8f Signed-off-by: Val Packett Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250706205723.9790-7-val@packett.cool commit 0ae204405095abfbc2d694ee0fbb49bcbbe55c57 Author: Lifeng Zheng Date: Wed Jul 9 18:41:45 2025 +0800 cpufreq: Exit governor when failed to start old governor Detect the result of starting old governor in cpufreq_set_policy(). If it fails, exit the governor and clear policy->governor. Signed-off-by: Lifeng Zheng Link: https://patch.msgid.link/20250709104145.2348017-5-zhenglifeng1@huawei.com Signed-off-by: Rafael J. Wysocki commit 908981d85f86c5e2b39dfe0b2267c6d44d9c48f7 Author: Lifeng Zheng Date: Wed Jul 9 18:41:44 2025 +0800 cpufreq: Move the check of cpufreq_driver->get into cpufreq_verify_current_freq() Move the check of cpufreq_driver->get into cpufreq_verify_current_freq() in case of calling it without check. Signed-off-by: Lifeng Zheng Link: https://patch.msgid.link/20250709104145.2348017-4-zhenglifeng1@huawei.com Signed-off-by: Rafael J. Wysocki commit d1378d1d7edb3a4c4935a44fe834ae135be03564 Author: Lifeng Zheng Date: Wed Jul 9 18:41:43 2025 +0800 cpufreq: Init policy->rwsem before it may be possibly used In cpufreq_policy_put_kobj(), policy->rwsem is used. But in cpufreq_policy_alloc(), if freq_qos_add_notifier() returns an error, error path via err_kobj_remove or err_min_qos_notifier will be reached and cpufreq_policy_put_kobj() will be called before policy->rwsem is initialized. Thus, the calling of init_rwsem() should be moved to where before these two error paths can be reached. Fixes: 67d874c3b2c6 ("cpufreq: Register notifiers with the PM QoS framework") Signed-off-by: Lifeng Zheng Link: https://patch.msgid.link/20250709104145.2348017-3-zhenglifeng1@huawei.com Signed-off-by: Rafael J. Wysocki commit 2a6c727387062a2ea79eb6cf5004820cb1b0afe2 Author: Lifeng Zheng Date: Wed Jul 9 18:41:42 2025 +0800 cpufreq: Initialize cpufreq-based frequency-invariance later The cpufreq-based invariance is enabled in cpufreq_register_driver(), but never disabled after registration fails. Move the invariance initialization to where all other initializations have been successfully done to solve this problem. Fixes: 874f63531064 ("cpufreq: report whether cpufreq supports Frequency Invariance (FI)") Signed-off-by: Lifeng Zheng Link: https://patch.msgid.link/20250709104145.2348017-2-zhenglifeng1@huawei.com [ rjw: New subject ] Signed-off-by: Rafael J. Wysocki commit 5d6ecaaa922611ec3ca067723ccefafb543010ee Author: Lifeng Zheng Date: Mon Jun 23 21:33:59 2025 +0800 cpufreq: Remove duplicate check in __cpufreq_offline() The has_target() checks in __cpufreq_offline() are duplicate. Remove one of them and put the operations of exiting governor together with storing last governor's name. Signed-off-by: Lifeng Zheng Link: https://patch.msgid.link/20250623133402.3120230-5-zhenglifeng1@huawei.com Signed-off-by: Rafael J. Wysocki commit 2e554cfa259fe07085a4fcff7d2ec4b7041bbd9c Author: Lifeng Zheng Date: Mon Jun 23 21:33:58 2025 +0800 cpufreq: Contain scaling_cur_freq.attr in cpufreq_attrs After commit c034b02e213d ("cpufreq: expose scaling_cur_freq sysfs file for set_policy() drivers"), the file scaling_cur_freq is exposed to all drivers. No need to create this file separately. It's better to be contained in cpufreq_attrs. Signed-off-by: Lifeng Zheng Link: https://patch.msgid.link/20250623133402.3120230-4-zhenglifeng1@huawei.com Signed-off-by: Rafael J. Wysocki commit fc64e0421598aaa87d61184f6777b52614a095be Author: Li RongQing Date: Mon Jun 23 18:56:01 2025 +0800 cpufreq: intel_pstate: Add Granite Rapids support in no-HWP mode Users may disable HWP in firmware, in which case intel_pstate wouldn't load unless the CPU model is explicitly supported. Signed-off-by: Li RongQing Link: https://patch.msgid.link/20250623105601.3924-1-lirongqing@baidu.com Signed-off-by: Rafael J. Wysocki commit 1cefe495cacba5fb0417da3a75a1a76e3546d176 Author: Rafael J. Wysocki Date: Mon Jun 16 20:19:19 2025 +0200 cpufreq: intel_pstate: Always use HWP_DESIRED_PERF in passive mode In the passive mode, intel_cpufreq_update_pstate() sets HWP_MIN_PERF in accordance with the target frequency to ensure delivering adequate performance, but it sets HWP_DESIRED_PERF to 0, so the processor has no indication that the desired performance level is actually equal to the floor one. This may cause it to choose a performance point way above the desired level. Moreover, this is inconsistent with intel_cpufreq_adjust_perf() which actually sets HWP_DESIRED_PERF in accordance with the target performance value. Address this by adjusting intel_cpufreq_update_pstate() to pass target_pstate as both the minimum and the desired performance levels to intel_cpufreq_hwp_update(). Fixes: a365ab6b9dfb ("cpufreq: intel_pstate: Implement the ->adjust_perf() callback") Signed-off-by: Rafael J. Wysocki Tested-by: Shashank Balaji Link: https://patch.msgid.link/6173276.lOV4Wx5bFT@rjwysocki.net commit e339967eecf1305557f7c697e1bc10b5cc495454 Author: Sergey Bashirov Date: Sat Jun 21 19:52:44 2025 +0300 nfsd: Drop dprintk in blocklayout xdr functions Minor clean up. Instead of dprintk there are appropriate error codes. Signed-off-by: Sergey Bashirov Reviewed-by: Jeff Layton Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit 24569f0249f800f8289ab690b99ab330ca6e425f Author: Jeff Layton Date: Fri Jun 20 08:16:06 2025 -0400 sunrpc: make svc_tcp_sendmsg() take a signed sentp pointer The return value of sock_sendmsg() is signed, and svc_tcp_sendto() wants a signed value to return. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 2bac9a4c5f452d42a78ce07596ef88f75978b536 Author: Jeff Layton Date: Fri Jun 20 08:16:05 2025 -0400 sunrpc: rearrange struct svc_rqst for fewer cachelines This shrinks the struct by 4 bytes, but also takes it from 19 to 18 cachelines on x86_64. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 0f2b8ee6303da559bb73aed92d62d5928dac7b83 Author: Jeff Layton Date: Fri Jun 20 08:16:04 2025 -0400 sunrpc: return better error in svcauth_gss_accept() on alloc failure This ends up returning AUTH_BADCRED when memory allocation fails today. Fix it to return AUTH_FAILED, which better indicates a failure on the server. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit c8af9d3d4be25dd25845c6d67b32f30d01bf921a Author: Jeff Layton Date: Fri Jun 20 08:16:03 2025 -0400 sunrpc: reset rq_accept_statp when starting a new RPC rq_accept_statp should point to the location of the accept_status in the reply. This field is not reset between RPCs so if svc_authenticate or pg_authenticate return SVC_DENIED without setting the pointer, it could result in the status being written to the wrong place. This pointer starts its lifetime as NULL. Reset it on every iteration so we get consistent behavior if this happens. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 6f0e26243b02f440938ab7a3782eb730f2247fb1 Author: Jeff Layton Date: Fri Jun 20 08:16:02 2025 -0400 sunrpc: remove SVC_SYSERR Nothing returns this error code. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit d49afc90a3ba3af4507049fb43cb128d9a9c66d5 Author: Jeff Layton Date: Fri Jun 20 08:16:01 2025 -0400 sunrpc: fix handling of unknown auth status codes In the case of an unknown error code from svc_authenticate or pg_authenticate, return AUTH_ERROR with a status of AUTH_FAILED. Also add the other auth_stat value from RFC 5531, and document all the status codes. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 03963793c82598ff89bcca11aba8444721f91009 Author: Chuck Lever Date: Fri Jun 20 08:31:55 2025 -0400 NFSD: Simplify struct knfsd_fh Compilers are allowed to insert padding and reorder the fields in a struct, so using a union of an array and a struct in struct knfsd_fh is not reliable. The position of elements in an array is more reliable. Suggested-by: Christoph Hellwig Reviewed-by: Jeff Layton Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit edf7b905bc1d4dac1ed3645f0c1e8b7aa8d0e8b8 Author: Chuck Lever Date: Fri Jun 20 08:31:54 2025 -0400 NFSD: Access a knfsd_fh's fsid by pointer I'm about to remove the union in struct knfsd_fh. First step is to add an accessor function for the file handle's fsid portion. Reviewed-by: Jeff Layton Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit e58691ea4c8a20ce11421da66205b584c97ca3cb Author: Chuck Lever Date: Wed Jun 18 08:58:03 2025 -0400 Revert "NFSD: Force all NFSv4.2 COPY requests to be synchronous" In the past several kernel releases, we've made NFSv4.2 async copy reliable: - The Linux NFS client and server now both implement and use the NFSv4.2 OFFLOAD_STATUS operation - The Linux NFS server keeps copy stateids around longer - The Linux NFS client and server now both implement referring call lists And resilient against DoS: - The Linux NFS server limits the number of concurrent async copy operations Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit e609e3869e27e85d4bc598bfd632ac6287deebdf Author: Gustavo A. R. Silva Date: Mon Jun 16 16:31:03 2025 -0600 NFSD: Avoid multiple -Wflex-array-member-not-at-end warnings Replace flexible-array member with a fixed-size array. With this changes, fix many instances of the following type of warnings: fs/nfsd/nfsfh.h:79:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] fs/nfsd/state.h:763:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] fs/nfsd/state.h:669:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] fs/nfsd/state.h:549:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] fs/nfsd/xdr4.h:705:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] fs/nfsd/xdr4.h:678:33: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Jeff Layton Reviewed-by: NeilBrown Signed-off-by: Chuck Lever commit 3f3503adb3328e9b2c031ad8d27889ecfa2a6bf7 Author: Chuck Lever Date: Fri Jun 13 16:08:47 2025 -0400 NFSD: Use vfs_iocb_iter_write() Refactor: Enable the use of IOCB flags to control NFSD's individual write operations. This allows the eventual use of atomic, uncached, direct, or asynchronous writes. Suggested-by: NeilBrown Reviewed-by: Christoph Hellwig Reviewed-by: NeilBrown Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 37fe6f1be50f1f1485407078d7afb456bde642ca Author: Chuck Lever Date: Fri Jun 13 16:08:46 2025 -0400 NFSD: Use vfs_iocb_iter_read() Refactor: Enable the use of IOCB flags to control NFSD's individual read operations (when not using splice). This allows the eventual use of atomic, uncached, direct, or asynchronous reads. Suggested-by: Christoph Hellwig Reviewed-by: NeilBrown Reviewed-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 61df439a326872b6464517fb6a2b989ac924b9a5 Author: Chuck Lever Date: Thu Jun 19 10:20:01 2025 -0400 NFSD: Clean up kdoc for nfsd_open_local_fh() Sparse reports that the synopsis of nfsd_open_local_fh() does not match its kdoc comment. Introduced by commit e6f7e1487ab5 ("nfs_localio: simplify interface to nfsd for getting nfsd_file"). Signed-off-by: Chuck Lever commit 6aa12e07a48ccd95062f7345d0aa571e92407a7f Author: Chuck Lever Date: Fri Jun 13 16:07:47 2025 -0400 NFSD: Clean up kdoc for nfsd_file_put_local() Sparse reports that the synopsis of nfsd_file_put_local() does not match its kdoc comment. Introduced by commit c25a89770d1f ("nfs_localio: change nfsd_file_put_local() to take a pointer to __rcu pointer") . Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 9fdd5533c72291d1cbac77b3d35945e547cb8b4b Author: Chuck Lever Date: Fri Jun 13 16:07:46 2025 -0400 NFSD: Remove definition for trace_nfsd_ctl_maxconn trace_nfsd_ctl_maxconn() was removed by commit a4b853f183a1 ("sunrpc: remove all connection limit configuration") but did not remove the event. Reported-by: Steven Rostedt Closes: https://lore.kernel.org/linux-nfs/5ccae2f9-1560-4ac5-b506-b235ed4e4f4f@oracle.com/T/#t Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit d18a38abddd2ebeddb2a65f823eb590c9c9150bd Author: Chuck Lever Date: Fri Jun 13 16:07:45 2025 -0400 NFSD: Remove definition for trace_nfsd_file_gc_recent Event nfsd_file_gc_recent was added by commit 64912122a4f8 ("nfsd: filecache: introduce NFSD_FILE_RECENT") but never used. Reported-by: Steven Rostedt Closes: https://lore.kernel.org/linux-nfs/5ccae2f9-1560-4ac5-b506-b235ed4e4f4f@oracle.com/T/#t Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit ef42c5522d0adc96d3e0a5ab745df1a55cbd8039 Author: Chuck Lever Date: Fri Jun 13 16:07:44 2025 -0400 NFSD: Remove definitions for unused trace_nfsd_file_lru trace points Events nfsd_file_lru_add_disposed and nfsd_file_lru_del_disposed were added by commit 4a0e73e635e3 ("NFSD: Leave open files out of the filecache LRU") but they were never used. Reported-by: Steven Rostedt Closes: https://lore.kernel.org/linux-nfs/5ccae2f9-1560-4ac5-b506-b235ed4e4f4f@oracle.com/T/#t Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 2cb860fddf9af7d1a699545cfcc994b9613b1372 Author: Chuck Lever Date: Fri Jun 13 16:07:43 2025 -0400 NFSD: Remove definition for trace_nfsd_file_unhash_and_queue trace_nfsd_file_unhash_and_queue() was removed by commit ac3a2585f018 ("nfsd: rework refcounting in filecache"). Reported-by: Steven Rostedt Closes: https://lore.kernel.org/linux-nfs/5ccae2f9-1560-4ac5-b506-b235ed4e4f4f@oracle.com/T/#t Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 26d05e1c37d276905bc921384b5a75158fca284b Author: Sergey Bashirov Date: Fri Jun 13 00:42:49 2025 +0300 nfsd: Use correct error code when decoding extents Update error codes in decoding functions of block and scsi layout drivers to match the core nfsd code. NFS4ERR_EINVAL means that the server was able to decode the request, but the decoded values are invalid. Use NFS4ERR_BADXDR instead to indicate a decoding error. And ENOMEM is changed to nfs code NFS4ERR_DELAY. Signed-off-by: Sergey Bashirov Reviewed-by: Christoph Hellwig Signed-off-by: Chuck Lever commit 48aab1606fa80027143a445224f552b4eeea845b Author: Chuck Lever Date: Tue Jun 10 12:05:09 2025 -0400 NFSD: Remove the cap on number of operations per NFSv4 COMPOUND This limit has always been a sanity check; in nearly all cases a large COMPOUND is a sign of a malfunctioning client. The only real limit on COMPOUND size and complexity is the size of NFSD's send and receive buffers. However, there are a few cases where a large COMPOUND is sane. For example, when a client implementation wants to walk down a long file pathname in a single round trip. A small risk is that now a client can construct a COMPOUND request that can keep a single nfsd thread busy for quite some time. Suggested-by: Jeff Layton Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit a2d61427fb4b630b94ed9bd457dd8bc239b83e4b Author: Chuck Lever Date: Tue Jun 10 12:05:08 2025 -0400 NFSD: Make nfsd_genl_rqstp::rq_ops array best-effort To enable NFSD to handle NFSv4 COMPOUNDs of unrestricted size, resize the array in struct nfsd_genl_rqstp so it saves only up to 16 operations per COMPOUND. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 71bc2c6c413b78e5a47b4a62284f712d9f719007 Author: Chuck Lever Date: Tue Jun 10 12:05:07 2025 -0400 NFSD: Rename a function parameter Clean up: A function parameter called "rqstp" typically refers to an object of type "struct svc_rqst", so it's confusing when such an parameter refers to a different struct type with field names that are very similar to svc_rqst. Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 9c65001c57164033ad08b654c8b5ae35512ddf4a Author: Dai Ngo Date: Tue Jun 10 08:35:28 2025 -0700 NFSD: detect mismatch of file handle and delegation stateid in OPEN op When the client sends an OPEN with claim type CLAIM_DELEG_CUR_FH or CLAIM_DELEGATION_CUR, the delegation stateid and the file handle must belong to the same file, otherwise return NFS4ERR_INVAL. Note that RFC8881, section 8.2.4, mandates the server to return NFS4ERR_BAD_STATEID if the selected table entry does not match the current filehandle. However returning NFS4ERR_BAD_STATEID in the OPEN causes the client to retry the operation and therefor get the client into a loop. To avoid this situation we return NFS4ERR_INVAL instead. Reported-by: Petro Pavlov Fixes: c44c5eeb2c02 ("[PATCH] nfsd4: add open state code for CLAIM_DELEGATE_CUR") Cc: stable@vger.kernel.org Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 908e4ead7f757504d8b345452730636e298cbf68 Author: Jeff Layton Date: Wed Jun 4 12:01:10 2025 -0400 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() Lei Lu recently reported that nfsd4_setclientid_confirm() did not check the return value from get_client_locked(). a SETCLIENTID_CONFIRM could race with a confirmed client expiring and fail to get a reference. That could later lead to a UAF. Fix this by getting a reference early in the case where there is an extant confirmed client. If that fails then treat it as if there were no confirmed client found at all. In the case where the unconfirmed client is expiring, just fail and return the result from get_client_locked(). Reported-by: lei lu Closes: https://lore.kernel.org/linux-nfs/CAEBF3_b=UvqzNKdnfD_52L05Mqrqui9vZ2eFamgAbV0WG+FNWQ@mail.gmail.com/ Fixes: d20c11d86d8f ("nfsd: Protect session creation and client confirm using client_lock") Cc: stable@vger.kernel.org Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit fdc368e96d0eaf2bc4d593753d7b4e572b4e20f2 Author: Su Hui Date: Wed Jun 4 11:47:26 2025 +0800 nfsd: Change the type of ek_fsidtype from int to u8 and use kstrtou8 The valid values for ek_fsidtype are actually 0-7 so it's better to change the type to u8. Also using kstrtou8() to relpace simple_strtoul(), kstrtou8() is safer and more suitable for u8. Suggested-by: NeilBrown Signed-off-by: Su Hui Signed-off-by: Chuck Lever commit f26c93053074bba9342b74632c195a043a825ac5 Author: Jeff Layton Date: Tue May 27 20:12:48 2025 -0400 sunrpc: new tracepoints around svc thread wakeups Convert the svc_wake_up tracepoint into svc_pool_thread_event class. Have it also record the pool id, and add new tracepoints for when the thread is already running and for when there are no idle threads. Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever commit 1aa3f767e0eaf1ed652be680aa3a3955ab2a9a0c Author: Christoph Hellwig Date: Thu May 15 13:48:47 2025 +0200 sunrpc: unexport csum_partial_copy_to_xdr csum_partial_copy_to_xdr is only used inside the sunrpc module, so remove the export. Signed-off-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 37149988eaabc3daaa6046015c18173d8d26e0e1 Author: Christoph Hellwig Date: Thu May 15 13:48:46 2025 +0200 sunrpc: simplify xdr_partial_copy_from_skb csum_partial_copy_to_xdr can handle a checksumming and non-checksumming case and implements this using a callback, which leads to a lot of boilerplate code and indirect calls in the fast path. Switch to storing a need_checksum flag in struct xdr_skb_reader instead to remove the indirect call and simplify the code. Signed-off-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 8d43417e93073699b521f603286140415b24968b Author: Christoph Hellwig Date: Thu May 15 13:48:45 2025 +0200 sunrpc: simplify xdr_init_encode_pages The rqst argument to xdr_init_encode_pages is set to NULL by all callers, and pages is always set to buf->pages. Remove the two arguments and hardcode the assignments. Signed-off-by: Christoph Hellwig Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 3b8737ce5bd4a9fcfede7d966f824e321d9066d4 Author: Dai Ngo Date: Tue May 13 09:10:51 2025 -0700 NFSD: release read access of nfs4_file when a write delegation is returned When a write delegation is returned, check if read access was added to nfs4_file when client opens file with WRONLY, and release it. Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit e7a8ebc305f26cab608e59a916a4ae89d6656c5f Author: Dai Ngo Date: Tue May 13 09:08:28 2025 -0700 NFSD: Offer write delegation for OPEN with OPEN4_SHARE_ACCESS_WRITE RFC8881, section 9.1.2 says: "In the case of READ, the server may perform the corresponding check on the access mode, or it may choose to allow READ for OPEN4_SHARE_ACCESS_WRITE, to accommodate clients whose WRITE implementation may unavoidably do reads (e.g., due to buffer cache constraints)." and in section 10.4.1: "Similarly, when closing a file opened for OPEN4_SHARE_ACCESS_WRITE/ OPEN4_SHARE_ACCESS_BOTH and if an OPEN_DELEGATE_WRITE delegation is in effect" This patch allows READ using write delegation stateid granted on OPENs with OPEN4_SHARE_ACCESS_WRITE only, to accommodate clients whose WRITE implementation may unavoidably do (e.g., due to buffer cache constraints). For write delegation granted for OPEN with OPEN4_SHARE_ACCESS_WRITE a new nfsd_file and a struct file are allocated to use for reads. The nfsd_file is freed when the file is closed by release_all_access. Suggested-by: Chuck Lever Signed-off-by: Dai Ngo Reviewed-by: Jeff Layton Signed-off-by: Chuck Lever commit 5510bd89da24508f0e9ae04396e7eb6929ec0e18 Author: Nicolin Chen Date: Thu Jul 10 13:23:54 2025 -0700 iommufd: Do not allow _iommufd_object_alloc_ucmd if abort op is set An abort op was introduced to allow its caller to invoke it within a lock in the caller's function. On the other hand, _iommufd_object_alloc_ucmd() would invoke the abort op in iommufd_object_abort_and_destroy() that must be outside the caller's lock. So, these two cannot work together. Add a validation in the _iommufd_object_alloc_ucmd(). Pick -EOPNOTSUPP to reject the function call, indicating that the object allocator is buggy. Link: https://patch.msgid.link/r/20250710202354.1658511-1-nicolinc@nvidia.com Suggested-by: Xu Yilun Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Xu Yilun Signed-off-by: Jason Gunthorpe commit 24bc49d158c7848b56faf7b9023c92f751a74921 Author: Miri Korenblit Date: Fri Jul 11 18:34:29 2025 +0300 wifi: iwlwifi: remove support of several iwl_ppag_table_cmd versions We only need to support version 1, 5 and 7. Remove versions 2, 3, 4 and 6. Reviewed-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.10d91f675505.Idd3a6da568261ee738918f290168a2ddaa87196b@changeid commit 493681d9f95bdf119af077ea05eeb42476e1f488 Author: Miri Korenblit Date: Fri Jul 11 18:34:28 2025 +0300 wifi: iwlwifi: remove support of version 4 of iwl_wowlan_rsc_tsc_params_cmd This are not used in any of our devices. Remove it. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.89156be9bc7f.I5ff5c1055eaf4fef9bd73233ea4d95504634ceed@changeid commit ee86cd90c91e8820c2509bbbba02f4e3c5e1e3c6 Author: Miri Korenblit Date: Fri Jul 11 18:34:27 2025 +0300 wifi: iwlwifi: remove support of versions 4 and 5 of iwl_alive_ntf These are not used in any of our devices. Remove them. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.dd784443be53.I4ff3b2392294f5df2625a71e2deee3364e9708f6@changeid commit 0356e509d373fb9e320f283a2da8f0c0ea9371e0 Author: Miri Korenblit Date: Fri Jul 11 18:34:26 2025 +0300 wifi: iwlwifi: mld: remove support for iwl_mcc_update_resp versions iwlmld was planned to be used for HR/GF, which has versions 5/6, but it was decided at the end to use iwlmvm for HR/GF, so iwlmld only needs to support version 8. Remove versions 5 and 6 support. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.9c64bfbb16cb.I109bee4d4bf455cbffbb8d2340023338bcab886d@changeid commit 7cc5f89bfbc309e8027eda255a1db0957c7fca86 Author: Miri Korenblit Date: Fri Jul 11 18:34:25 2025 +0300 wifi: iwlwifi: mld: Revert "wifi: iwlwifi: mld: allow EMLSR with 2.4 GHz when BT is ON" Due to a hw bug, this feature won't be enabled. Revert its implementation. This reverts commit 37808a3788fd ("wifi: iwlwifi: mld: allow EMLSR with 2.4 GHz when BT is ON") Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.57755ac3f39d.I63ae0ee3e6cdc9b11175ad15927aaad3b8f8f47a@changeid commit 0ce92d548b44649a8de706f9bb9e74a4ed2f18a7 Author: Miri Korenblit Date: Fri Jul 11 18:34:24 2025 +0300 wifi: iwlwifi: mld: Revert "wifi: iwlwifi: mld: add kunit test for emlsr with bt on" Due to a hw bug, this feature won't be enabled. Revert its tests. This reverts commit f7cc80b871ee ("wifi: iwlwifi: mld: add kunit test for emlsr with bt on") Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.5fdf77497ad2.I1160f1dcff734cb42baa8fbf8aac121a1a24a4c5@changeid commit 3735526d3e1c852dd9a3c05d82896a456819adc9 Author: Emmanuel Grumbach Date: Fri Jul 11 18:34:23 2025 +0300 wifi: iwlwifi: mld: support iwl_omi_send_status_notif version 2 The firmware provides the station id, use it since it makes our lives easier. No need to assume we have a single BSS vif, and look up the station id to whom the OMI was sent. Signed-off-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.7d2cd878855f.I8625ebb2c4e1fb484aafd16a07549f2eeb506e08@changeid commit 8bec2ec156903e12a8b45a57ae9bca409ead5646 Author: Miri Korenblit Date: Fri Jul 11 18:34:22 2025 +0300 wifi: iwlwifi: mld: remove support for iwl_geo_tx_power_profiles_cmd version 4 iwlmld was planned to be used for HR/GF, which has version 4, but it was decided at the end to use iwlmvm for HR/GF, so iwlmld only needs to support version 5. Remove version 4 support. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.faeb1e6bac2a.I1a29b16f59b67c103d1f91dedee27e04cd7fdfdd@changeid commit 9696454c920382d8c856a9c2ae4703af4b416e0b Author: Miri Korenblit Date: Fri Jul 11 18:34:21 2025 +0300 wifi: iwlwifi: remove an unused struct iwl_reduce_tx_power_cmd is not used anywhere, remove it. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.313285673570.I87c646f8b9b83d63c7c6c293cc5d454c32d852c2@changeid commit 100f38b0aeca07ccdd11a9f452d42ec6b81c8a5b Author: Miri Korenblit Date: Fri Jul 11 18:34:20 2025 +0300 wifi: iwlwifi: mld: remove support for REDUCE_TX_POWER_CMD ver 9 iwlmld was planned to be used for HR, which has version 9, but it was decided at the end to use iwlmvm for HR, so iwlmld only needs to support version 10. Remove version 9 support. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.aeeb617abfae.I05101972506180644c42be5096c1b2afa36c625a@changeid commit e3fd06d1d8869747e02a022e3c9045a3187f3aa5 Author: Miri Korenblit Date: Fri Jul 11 18:34:19 2025 +0300 wifi: iwlwifi: mvm: remove support for REDUCE_TX_POWER_CMD ver 6 and 7 These versions are no longer used in any of our devices. Remove them. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.05fabbda0a2f.Id55eeb4f337eb52163621ca202d97a3539bf3f53@changeid commit bf6ce412d8fad3ae26bed3e9a1167cef8224d926 Author: Pagadala Yesu Anjaneyulu Date: Fri Jul 11 18:34:18 2025 +0300 wifi: iwlwifi: mvm: Add dump handler to iwl_mvm Implement a dump handler in the iwl_mvm operation mode to collect firmware dump upon trigger from trans layer. Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.366fc31fd551.I976cb17edd85a461043c7a4c7f4895bfaec9174a@changeid commit f2829c89e296005ba1dbd95515d5b95790b9be0c Author: Johannes Berg Date: Fri Jul 11 18:34:17 2025 +0300 wifi: iwlwifi: mvm/mld: use average RSSI for beacons When connected to an AP, the PHY will typically be tuned to a higher bandwidth than the beacons are transmitted on, as they are normally only transmitted on 20 MHz. This can mean that another STA is simultaneously transmitting on another channel of the higher bandwidth, and apparently this energy may be taken into account by the PHY, resulting in elevated energy readings. To work around this, track the firmware's corrected beacon energy data and replace the RSSI in beacons by that. The replacement happens for all beacons received in the context of the current MAC or link (depending on FW version), in which case the filters will drop all else. For a scan, which is only tuning to 20 MHz channels, the MAC/link ID will be one that isn't found (the AUX ID 4), and no correction will be done (nor is it needed.) Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.324bfe7027ff.I160f947e7aab30e0110a7019ed46186e57c3de14@changeid commit 91b9f31d5c88789e29733369eec92408ce6e97ee Author: Johannes Berg Date: Fri Jul 11 18:34:16 2025 +0300 wifi: iwlwifi: mvm: remove extra link ID Since the iwlmvm driver now only supports pre-MLO devices, we no longer need to maintain an extra explicit link ID; valid MAC IDs and link IDs are both in the range 0-3 and the driver always has a 1:1 MAC/link correspondence. Thus, simply use the MAC ID as the link ID as well. This simplifies some further work because on RX the ID is given but there is some confusion about which versions of the firmware report MAC and which report link ID. While at it, clarify iwl_mvm_handle_missed_beacons_notif() code a bit so it doesn't look like an invalid vif pointer is being used. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.005aa5fe34fe.Ib0c1187453f46ce49dc0f9f58907ee21f5b52634@changeid commit 9f9c762705d937a1284c3289583351d549746c02 Author: Pagadala Yesu Anjaneyulu Date: Fri Jul 11 18:34:15 2025 +0300 wifi: iwlwifi: mvm: remove IWL_MVM_ESR_EXIT_FAIL_ENTRY EHT capable devices will only use iwlmld. So we can remove EMLSR code from iwlmvm. As part of removal, remove IWL_MVM_ESR_EXIT_FAIL_ENTRY EMLSR state. Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250711183056.a69dc9c6ba49.I7f9fbc1f954b4c118625a4b8d51c72f3c84936da@changeid commit b533b8e5a1f90aa15bb6e021cbf84cba2ea23e00 Author: Michal Wajdeczko Date: Sun Jul 13 12:36:25 2025 +0200 drm/xe/vf: Store negotiated VF/PF ABI version at device level There is no need to maintain PF ABI version on per-GT level. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250713103625.1964-8-michal.wajdeczko@intel.com commit a6c384b24f13bc3f315c226287601727b1e74969 Author: Michal Wajdeczko Date: Sun Jul 13 12:36:24 2025 +0200 drm/xe/pf: Stop requiring VF/PF version negotiation on every GT While some VF/PF relay actions must be handled on the GT level, like query for runtime registers, it was clarified by the arch team that initial version negotiation can be done by the VF just once, by using any available GuC/GT. Move handling of the VF/PF ABI version negotiation on the PF side from the GT level functions to the device level functions. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Acked-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250713103625.1964-7-michal.wajdeczko@intel.com commit d962178a882a1db2f56953e0f956685a12eeb83f Author: Michal Wajdeczko Date: Sun Jul 13 12:36:23 2025 +0200 drm/xe/pf: Expose basic info about VFs in debugfs We already have function to print summary about VFs, but we missed to add debugfs attribute to make it visible. Do it now. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250713103625.1964-6-michal.wajdeczko@intel.com commit ffab82b062a8e75f8877de363c9e203be7a241a7 Author: Michal Wajdeczko Date: Sun Jul 13 12:36:22 2025 +0200 drm/xe: Introduce xe_gt_is_main_type helper Instead of checking for not being a media type GT provide a small helper to explicitly express our intentions. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250713103625.1964-5-michal.wajdeczko@intel.com commit 76293a83a9db7fb52e48f5ee320c3c6708f05a8e Author: Michal Wajdeczko Date: Sun Jul 13 12:36:21 2025 +0200 drm/xe: Introduce xe_tile_is_root helper Instead of looking at the tile->id member provide a small helper to explicitly express our intentions. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250713103625.1964-4-michal.wajdeczko@intel.com commit 73c0e8054fcf36883c1a20d5e2e91fb8ed24d3ea Author: Michal Wajdeczko Date: Sun Jul 13 12:36:20 2025 +0200 drm/xe: Move PF and VF device types to separate headers We plan to add more PF and VF types and mixing them in a single file is not desired. Move them out to new dedicated files. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Acked-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250713103625.1964-3-michal.wajdeczko@intel.com commit 159df89564c5d1fcd794e54ad48e1a05c64c7bc8 Author: Adrián Larumbe Date: Fri Jul 11 16:45:53 2025 +0100 drm/panthor: Remove dead VM flushing code Commit ec62d37d2c0d("drm/panthor: Fix the fast-reset logic") did away with the only reference to panthor_vm_flush_all(), so let's get rid of the orphaned definition. Signed-off-by: Adrián Larumbe Reviewed-by: Liviu Dudau Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250711154557.739326-1-adrian.larumbe@collabora.com commit b10a74abcfc5c61afc63a567c457038be57eeb6e Author: Eric Biggers Date: Sat Jul 12 16:22:57 2025 -0700 crypto: sha1 - Use same state format as legacy drivers Same as sha256 and sha512: Use the state format that the generic partial block handling code produces, as requested by Herbert, even though this is applicable only to legacy drivers. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 8bc79ab67d78e2991b9d6cf0b63789189212375a Author: Eric Biggers Date: Sat Jul 12 16:22:56 2025 -0700 crypto: sha1 - Wrap library and add HMAC support Like I did for crypto/sha512.c, rework crypto/sha1_generic.c (renamed to crypto/sha1.c) to simply wrap the normal library functions instead of accessing the low-level block function directly. Also add support for HMAC-SHA1, again just wrapping the library functions. Since the replacement crypto_shash algorithms are implemented using the (potentially arch-optimized) library functions, give them driver names ending with "-lib" rather than "-generic". Update crypto/testmgr.c and an odd driver to take this change in driver name into account. Note: to see the diff from crypto/sha1_generic.c to crypto/sha1.c, view this commit with 'git show -M10'. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 4cbc84471bb606ddfaf424709dd8d56b56d7ae7b Author: Eric Biggers Date: Sat Jul 12 16:22:55 2025 -0700 lib/crypto: sha1: Add HMAC support Add HMAC support to the SHA-1 library, again following what was done for SHA-2. Besides providing the basis for a more streamlined "hmac(sha1)" shash, this will also be useful for multiple in-kernel users such as net/sctp/auth.c, net/ipv6/seg6_hmac.c, and security/keys/trusted-keys/trusted_tpm1.c. Those are currently using crypto_shash, but using the library functions would be much simpler. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 90860aef630c5c9e58d05044f2866fcbfa7aa4d9 Author: Eric Biggers Date: Sat Jul 12 16:22:54 2025 -0700 lib/crypto: sha1: Add SHA-1 library functions Add a library interface for SHA-1, following the SHA-2 one. As was the case with SHA-2, this will be useful for various in-kernel users. The crypto_shash interface will be reimplemented on top of it as well. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2427d69c3dba3f9bce73d36c2c0adf37b5aee5d9 Merge: ebbe8bfe07f0c7 3b4408038da935 Author: Linus Walleij Date: Mon Jul 14 17:55:30 2025 +0200 Merge tag 'intel-pinctrl-v6.16-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pinctrl/intel into devel intel-pinctrl for v6.16-1 * Use new GPIO line value setter callbacks (Bartosz Golaszewski) * Add missed export.h to the main driver The following is an automated git shortlog grouped by driver: baytrail: - use new GPIO line value setter callbacks cherryview: - use new GPIO line value setter callbacks intel: - fix build warnings about export.h - use new GPIO line value setter callbacks lynxpoint: - use new GPIO line value setter callbacks Signed-off-by: Linus Walleij commit 7dcae5288a0967493ba1b15e8194cb6bfb1a23ca Author: Michal Wajdeczko Date: Sun Jul 13 12:36:19 2025 +0200 drm/xe: Combine PF and VF device data into union There is no need to keep PF and VF data fields fully separate since we can be only in one mode at the time. Move them into a anonymous union to save few bytes. Signed-off-by: Michal Wajdeczko Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250713103625.1964-2-michal.wajdeczko@intel.com commit ebbe8bfe07f0c7c09276c12bfd65c8fd9941b06a Author: Clément Le Goffic Date: Fri Jul 11 09:41:21 2025 +0200 MAINTAINERS: add Clément Le Goffic as STM32 HDP maintainer Add Clément Le Goffic as STM32 HDP maintainer. Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/20250711-hdp-upstream-v7-3-faeecf7aaee1@foss.st.com Signed-off-by: Linus Walleij commit 8eabf5ddbb08c2261de839a97c4257b79a15f60f Author: Clément Le Goffic Date: Fri Jul 11 09:41:20 2025 +0200 pinctrl: stm32: Introduce HDP driver This patch introduce the driver for the Hardware Debug Port available on STM32MP platforms. The HDP allows the observation of internal SoC signals by using multiplexers. Each HDP port can provide up to 16 internal signals (one of them can be software controlled as a GPO). Reviewed-by: Linus Walleij Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/20250711-hdp-upstream-v7-2-faeecf7aaee1@foss.st.com Signed-off-by: Linus Walleij commit 912275c325f47dfa6a247fb845f0265e7dfa6ebd Author: Clément Le Goffic Date: Fri Jul 11 09:41:19 2025 +0200 dt-bindings: pinctrl: stm32: Introduce HDP 'HDP' stands for Hardware Debug Port, it is an hardware block in STMicrolectronics' MPUs that let the user decide which internal SoC's signal to observe. It provides 8 ports and for each port there is up to 16 different signals that can be output. Signals are different for each MPU. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/20250711-hdp-upstream-v7-1-faeecf7aaee1@foss.st.com [Fixed up Clement's new email address] Signed-off-by: Linus Walleij commit 620d3d1025581b9f1b883452788b6f409ff04170 Author: Luca Weiss Date: Wed Jul 2 17:56:17 2025 +0200 pinctrl: qcom: Add Milos pinctrl driver Add pinctrl driver for TLMM block found in the Milos SoC. Signed-off-by: Luca Weiss Reviewed-by: Bjorn Andersson Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/20250702-sm7635-pinctrl-v2-2-c138624b9924@fairphone.com Signed-off-by: Linus Walleij commit 8d4aec43f6e7c52691ffa13c71ca03c6853a0f65 Author: Xin Wang Date: Fri Jul 11 06:09:24 2025 +0000 drm/xe: Update register definitions in LRC layout header Update the register definitions in xe_lrc_layout.h to align with the official hardware specification (Bspec) terminology. Specifically: - rename PVC_CTX_ACC_CTR_THOLD to CTX_ACC_CTR_THOLD - rename PVC_CTX_ASID to CTX_ASID Signed-off-by: Xin Wang Reviewed-by: Stuart Summers Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250711060924.7373-1-x.wang@intel.com Signed-off-by: Lucas De Marchi commit 5d156a9c3d5ea3dbec192121259dee2c2f938fa1 Author: Andy Yan Date: Thu Jul 3 20:49:53 2025 +0800 drm/bridge: Pass down connector to drm bridge detect hook In some application scenarios, we hope to get the corresponding connector when the bridge's detect hook is invoked. In most cases, we can get the connector by drm_atomic_get_connector_for_encoder if the encoder attached to the bridge is enabled, however there will still be some scenarios where the detect hook of the bridge is called but the corresponding encoder has not been enabled yet. For instance, this occurs when the device is hot plug in for the first time. Since the call to bridge's detect is initiated by the connector, passing down the corresponding connector directly will make things simpler. Signed-off-by: Andy Yan Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250703125027.311109-3-andyshrk@163.com [DB: added the chunk to the cdn-dp driver] Signed-off-by: Dmitry Baryshkov commit 02bb63d1a59341032b8e7e4021e18d044bdb1786 Author: Andy Yan Date: Thu Jul 3 20:49:52 2025 +0800 drm/bridge: Make dp/hdmi_audio_* callback keep the same paramter order with get_modes Make the dp/hdmi_audio_* callback maintain the same parameter order as get_modes and edid_read: first the bridge, then the connector. Signed-off-by: Andy Yan Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250703125027.311109-2-andyshrk@163.com [DB: added the chunk to the cdn-dp driver] Signed-off-by: Dmitry Baryshkov commit 9503ca2ccafec51ee9e533d6f3aef14a589fc106 Author: Eric Biggers Date: Sat Jul 12 16:22:53 2025 -0700 lib/crypto: sha1: Rename sha1_init() to sha1_init_raw() Rename the existing sha1_init() to sha1_init_raw(), since it conflicts with the upcoming library function. This will later be removed, but this keeps the kernel building for the introduction of the library. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 56119446f89fbab40f3a160e9c3de33687cd85cf Author: Eric Biggers Date: Sat Jul 12 16:22:52 2025 -0700 crypto: x86/sha1 - Rename conflicting symbol Rename x86's sha1_update() to sha1_update_x86(), since it conflicts with the upcoming sha1_update() library function. Note: the affected code will be superseded by later commits that migrate the arch-optimized SHA-1 code into the library. This commit simply keeps the kernel building for the initial introduction of the library. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250712232329.818226-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit fba12307633933917a799fa2cda5bfc324b3f114 Author: Tvrtko Ursulin Date: Fri Jul 11 17:01:51 2025 +0100 drm/xe: Add plumbing for indirect context workarounds Some upcoming workarounds need to be emitted from the indirect workaround context so lets add some plumbing where they will be able to easily slot in. No functional changes for now since everything is still deactivated. Signed-off-by: Tvrtko Ursulin Bspec: 45954 Cc: Lucas De Marchi Cc: Matt Roper Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250711160153.49833-7-tvrtko.ursulin@igalia.com Signed-off-by: Lucas De Marchi commit 7941ad696506917fa6228f44be2df0c2f0909a62 Author: Eric Biggers Date: Fri Jul 11 14:58:43 2025 -0700 lib/crypto: sha2: Add hmac_sha*_init_usingrawkey() While the HMAC library functions support both incremental and one-shot computation and both prepared and raw keys, the combination of raw key + incremental was missing. It turns out that several potential users of the HMAC library functions (tpm2-sessions.c, smb2transport.c, trusted_tpm1.c) want exactly that. Therefore, add the missing functions hmac_sha*_init_usingrawkey(). Implement them in an optimized way that directly initializes the HMAC context without a separate key preparation step. Reimplement the one-shot raw key functions hmac_sha*_usingrawkey() on top of the new functions, which makes them a bit more efficient. Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250711215844.41715-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6e07c5e166597de1d7943ecf2539cad18c0e2ce1 Author: Eric Biggers Date: Fri Jul 11 14:28:22 2025 -0700 lib/crypto: arm/poly1305: Remove unneeded empty weak function Fix poly1305-armv4.pl to not do '.globl poly1305_blocks_neon' when poly1305_blocks_neon() is not defined. Then, remove the empty __weak definition of poly1305_blocks_neon(), which was still needed only because of that unnecessary globl statement. (It also used to be needed because the compiler could generate calls to it when CONFIG_KERNEL_MODE_NEON=n, but that has been fixed.) Thanks to Arnd Bergmann for reporting that the globl statement in the asm file was still depending on the weak symbol. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250711212822.6372-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 8671bad873ebeb082afcf7b4501395c374da6023 Author: Luis Claudio R. Goncalves Date: Mon Jul 7 11:03:59 2025 -0300 sched: Do not call __put_task_struct() on rt if pi_blocked_on is set With PREEMPT_RT enabled, some of the calls to put_task_struct() coming from rt_mutex_adjust_prio_chain() could happen in preemptible context and with a mutex enqueued. That could lead to this sequence: rt_mutex_adjust_prio_chain() put_task_struct() __put_task_struct() sched_ext_free() spin_lock_irqsave() rtlock_lock() ---> TRIGGERS lockdep_assert(!current->pi_blocked_on); This is not a SCHED_EXT bug. The first cleanup function called by __put_task_struct() is sched_ext_free() and it happens to take a (RT) spin_lock, which in the scenario described above, would trigger the lockdep assertion of "!current->pi_blocked_on". Crystal Wood was able to identify the problem as __put_task_struct() being called during rt_mutex_adjust_prio_chain(), in the context of a process with a mutex enqueued. Instead of adding more complex conditions to decide when to directly call __put_task_struct() and when to defer the call, unconditionally resort to the deferred call on PREEMPT_RT to simplify the code. Fixes: 893cdaaa3977 ("sched: avoid false lockdep splat in put_task_struct()") Suggested-by: Crystal Wood Signed-off-by: Luis Claudio R. Goncalves Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Wander Lairson Costa Reviewed-by: Valentin Schneider Reviewed-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/aGvTz5VaPFyj0pBV@uudg.org commit 7de9d4f946383f48ec393b6e9ad0c20e49e174e7 Author: Peter Zijlstra Date: Sat Jul 12 03:33:49 2025 +0000 sched: Start blocked_on chain processing in find_proxy_task() Start to flesh out the real find_proxy_task() implementation, but avoid the migration cases for now, in those cases just deactivate the donor task and pick again. To ensure the donor task or other blocked tasks in the chain aren't migrated away while we're running the proxy, also tweak the fair class logic to avoid migrating donor or mutex blocked tasks. [jstultz: This change was split out from the larger proxy patch] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Juri Lelli Signed-off-by: Valentin Schneider Signed-off-by: Connor O'Brien Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Link: https://lkml.kernel.org/r/20250712033407.2383110-9-jstultz@google.com commit be39617e38e0b1939a6014d77ee6f14707d59b1b Author: Valentin Schneider Date: Sat Jul 12 03:33:48 2025 +0000 sched: Fix proxy/current (push,pull)ability Proxy execution forms atomic pairs of tasks: The waiting donor task (scheduling context) and a proxy (execution context). The donor task, along with the rest of the blocked chain, follows the proxy wrt CPU placement. They can be the same task, in which case push/pull doesn't need any modification. When they are different, however, FIFO1 & FIFO42: ,-> RT42 | | blocked-on | v blocked_donor | mutex | | owner | v `-- RT1 RT1 RT42 CPU0 CPU1 ^ ^ | | overloaded !overloaded rq prio = 42 rq prio = 0 RT1 is eligible to be pushed to CPU1, but should that happen it will "carry" RT42 along. Clearly here neither RT1 nor RT42 must be seen as push/pullable. Unfortunately, only the donor task is usually dequeued from the rq, and the proxy'ed execution context (rq->curr) remains on the rq. This can cause RT1 to be selected for migration from logic like the rt pushable_list. Thus, adda a dequeue/enqueue cycle on the proxy task before __schedule returns, which allows the sched class logic to avoid adding the now current task to the pushable_list. Furthermore, tasks becoming blocked on a mutex don't need an explicit dequeue/enqueue cycle to be made (push/pull)able: they have to be running to block on a mutex, thus they will eventually hit put_prev_task(). Signed-off-by: Valentin Schneider Signed-off-by: Connor O'Brien Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Link: https://lkml.kernel.org/r/20250712033407.2383110-8-jstultz@google.com commit be41bde4c3a86de4be5cd3d1ca613e24664e68dc Author: John Stultz Date: Sat Jul 12 03:33:47 2025 +0000 sched: Add an initial sketch of the find_proxy_task() function Add a find_proxy_task() function which doesn't do much. When we select a blocked task to run, we will just deactivate it and pick again. The exception being if it has become unblocked after find_proxy_task() was called. This allows us to validate keeping blocked tasks on the runqueue and later deactivating them is working ok, stressing the failure cases for when a proxy isn't found. Greatly simplified from patch by: Peter Zijlstra (Intel) Juri Lelli Valentin Schneider Connor O'Brien [jstultz: Split out from larger proxy patch and simplified for review and testing.] Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Link: https://lkml.kernel.org/r/20250712033407.2383110-7-jstultz@google.com commit aa4f74dfd42ba4399f785fb9c460a11bd1756f0a Author: John Stultz Date: Sat Jul 12 03:33:46 2025 +0000 sched: Fix runtime accounting w/ split exec & sched contexts Without proxy-exec, we normally charge the "current" task for both its vruntime as well as its sum_exec_runtime. With proxy, however, we have two "current" contexts: the scheduler context and the execution context. We want to charge the execution context rq->curr (ie: proxy/lock holder) execution time to its sum_exec_runtime (so it's clear to userland the rq->curr task *is* running), as well as its thread group. However the rest of the time accounting (such a vruntime and cgroup accounting), we charge against the scheduler context (rq->donor) task, because it is from that task that the time is being "donated". If the donor and curr tasks are the same, then it's the same as without proxy. Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Link: https://lkml.kernel.org/r/20250712033407.2383110-6-jstultz@google.com commit 865d8cfb1672089e4b628d6899ac5c6e49787150 Author: John Stultz Date: Sat Jul 12 03:33:45 2025 +0000 sched: Move update_curr_task logic into update_curr_se Absorb update_curr_task() into update_curr_se(), and in the process simplify update_curr_common(). This will make the next step a bit easier. Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Link: https://lkml.kernel.org/r/20250712033407.2383110-5-jstultz@google.com commit a4f0b6fef4b08e9928449206390133e48ac185a7 Author: Valentin Schneider Date: Sat Jul 12 03:33:44 2025 +0000 locking/mutex: Add p->blocked_on wrappers for correctness checks This lets us assert mutex::wait_lock is held whenever we access p->blocked_on, as well as warn us for unexpected state changes. [fix conflicts, call in more places] [jstultz: tweaked commit subject, reworked a good bit] Signed-off-by: Valentin Schneider Signed-off-by: Connor O'Brien Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Link: https://lkml.kernel.org/r/20250712033407.2383110-4-jstultz@google.com commit 44e4e0297c3c01987399bb9973f4d22a096a62c2 Author: Peter Zijlstra Date: Sat Jul 12 03:33:43 2025 +0000 locking/mutex: Rework task_struct::blocked_on Track the blocked-on relation for mutexes, to allow following this relation at schedule time. task | blocked-on v mutex | owner v task This all will be used for tracking blocked-task/mutex chains with the prox-execution patch in a similar fashion to how priority inheritance is done with rt_mutexes. For serialization, blocked-on is only set by the task itself (current). And both when setting or clearing (potentially by others), is done while holding the mutex::wait_lock. [minor changes while rebasing] [jstultz: Fix blocked_on tracking in __mutex_lock_common in error paths] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Juri Lelli Signed-off-by: Connor O'Brien Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Link: https://lkml.kernel.org/r/20250712033407.2383110-3-jstultz@google.com commit 25c411fce735dda29de26f58d3fce52d4824380c Author: John Stultz Date: Sat Jul 12 03:33:42 2025 +0000 sched: Add CONFIG_SCHED_PROXY_EXEC & boot argument to enable/disable Add a CONFIG_SCHED_PROXY_EXEC option, along with a boot argument sched_proxy_exec= that can be used to disable the feature at boot time if CONFIG_SCHED_PROXY_EXEC was enabled. Also uses this option to allow the rq->donor to be different from rq->curr. Signed-off-by: John Stultz Signed-off-by: Peter Zijlstra (Intel) Tested-by: K Prateek Nayak Link: https://lkml.kernel.org/r/20250712033407.2383110-2-jstultz@google.com commit 8f2146159b3a24d4fde0479c5e19f31908419004 Merge: 1eec89a671413c 36569780b0d64d Author: Peter Zijlstra Date: Mon Jul 14 17:16:28 2025 +0200 Merge branch 'tip/sched/urgent' Avoid merge conflicts Signed-off-by: Peter Zijlstra commit 70045cf6593cbf0740956ea9b7b4269142c6ee38 Author: Juergen Gross Date: Thu Jul 3 09:32:59 2025 +0200 xen/gntdev: remove struct gntdev_copy_batch from stack When compiling the kernel with LLVM, the following warning was issued: drivers/xen/gntdev.c:991: warning: stack frame size (1160) exceeds limit (1024) in function 'gntdev_ioctl' The main reason is struct gntdev_copy_batch which is located on the stack and has a size of nearly 1kb. For performance reasons it shouldn't by just dynamically allocated instead, so allocate a new instance when needed and instead of freeing it put it into a list of free structs anchored in struct gntdev_priv. Fixes: a4cdb556cae0 ("xen/gntdev: add ioctl for grant copy") Reported-by: Abinash Singh Reviewed-by: Stefano Stabellini Signed-off-by: Juergen Gross Message-ID: <20250703073259.17356-1-jgross@suse.com> commit a3397b24ae0045113189424442bcaa14cbc696e2 Author: Tvrtko Ursulin Date: Fri Jul 11 17:01:50 2025 +0100 drm/xe: Allow specifying number of extra dwords at the end of wa bb emission Indirect context setup will need more than one. Signed-off-by: Tvrtko Ursulin Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250711160153.49833-6-tvrtko.ursulin@igalia.com Signed-off-by: Lucas De Marchi commit 5ce511ad2b1e2c449e26dba11ac5027c1a142e19 Author: Tvrtko Ursulin Date: Fri Jul 11 17:01:49 2025 +0100 drm/xe: Track number of written dwords from workaround batch buffer emission Indirect context setup will need to get to the number of written dwords. Lets add it as an output parameter so it can be accessed from the finish helper regardless of whether code is writing directly or via an shadow buffer. Signed-off-by: Tvrtko Ursulin Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250711160153.49833-5-tvrtko.ursulin@igalia.com Signed-off-by: Lucas De Marchi commit 1ec31d355c2d225f50dfb70dcaab07bf3afee0ed Author: Tvrtko Ursulin Date: Fri Jul 11 17:01:48 2025 +0100 drm/xe: Rename utilization workaround emission function Lucas suggested to consolidate to a slightly different naming scheme which will align with the upcoming additions better. Signed-off-by: Tvrtko Ursulin Suggested-by: Lucas De Marchi Cc: Matt Roper Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250711160153.49833-4-tvrtko.ursulin@igalia.com Signed-off-by: Lucas De Marchi commit 81b79670a37e6d796cbab3d18e77b7540f405067 Author: Tvrtko Ursulin Date: Fri Jul 11 17:01:47 2025 +0100 drm/xe: Pass wa bb setup arguments in a struct Group the function arguments in a struct for more readable code and easier extending. Signed-off-by: Tvrtko Ursulin Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250711160153.49833-3-tvrtko.ursulin@igalia.com Signed-off-by: Lucas De Marchi commit 9df5e79bf1a30b94dc068ab2ed2279e40f430b88 Author: Ingo Molnar Date: Thu May 15 15:27:11 2025 +0200 x86/tools: insn_sanity.c: Emit standard build success messages The standard 'success' output of insn_decoder_test spams build logs with: arch/x86/tools/insn_sanity: Success: decoded and checked 1000000 random instructions with 0 errors (seed:0x2e263877) Prefix the message with the standard ' ' (two spaces) used by kbuild to denote regular build messages, making it easier for tools to filter out warnings and errors. Signed-off-by: Ingo Molnar Signed-off-by: Borislav Petkov (AMD) Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: David Woodhouse Cc: H. Peter Anvin Cc: Jürgen Groß Cc: Linus Torvalds Cc: Masahiro Yamada Cc: Michal Marek Cc: Peter Zijlstra Cc: Vitaly Kuznetsov Link: https://lore.kernel.org/r/20250515132719.31868-6-mingo@kernel.org commit b238e382bb140ead4fddc8e0de9c30e6c3381799 Author: Ingo Molnar Date: Thu May 15 15:27:10 2025 +0200 x86/tools: insn_decoder_test.c: Emit standard build success messages The standard 'success' output of insn_decoder_test spams build logs with: arch/x86/tools/insn_decoder_test: success: Decoded and checked 8258521 instructions Prefix the message with the standard ' ' (two spaces) used by kbuild to denote regular build messages, making it easier for tools to filter out warnings and errors. Signed-off-by: Ingo Molnar Signed-off-by: Borislav Petkov (AMD) Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: David Woodhouse Cc: H. Peter Anvin Cc: Jürgen Groß Cc: Linus Torvalds Cc: Masahiro Yamada Cc: Michal Marek Cc: Peter Zijlstra Cc: Vitaly Kuznetsov Link: https://lore.kernel.org/r/20250515132719.31868-5-mingo@kernel.org commit fa7c2a2460198983e16734fea8251b705775ac11 Author: Tvrtko Ursulin Date: Fri Jul 11 17:01:46 2025 +0100 drm/xe: Generalize wa bb emission code Generalize the wa bb emission by splitting it into three phases - setup, emit and finish, and extract setup and finish steps into helpers. This will enable using the same infrastructure for emitting the indirect context workarounds. Signed-off-by: Tvrtko Ursulin Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250711160153.49833-2-tvrtko.ursulin@igalia.com Signed-off-by: Lucas De Marchi commit e08c0fa02e4ea02b4494b7bcb2e9cac99439f725 Author: Lucas De Marchi Date: Fri Jul 11 14:49:12 2025 -0700 drm/xe: Fix missing kernel-doc Fix warning: Warning: drivers/gpu/drm/xe/xe_device_types.h:658 struct member 'wa_active' not described in 'xe_device' Fixes: 661a6950e061 ("drm/xe: Add infrastructure for Device OOB workarounds") Cc: Matt Atwood Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250711214911.2009714-2-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi commit 8f3d1c9fb04e2ae018d06b4cacc49e146120facc Author: Dr. David Alan Gilbert Date: Sun Jul 13 16:25:31 2025 +0100 drm/xe: Remove unused functions xe_bo_create_from_data() last use was removed in 2023 by commit 0e1a47fcabc8 ("drm/xe: Add a helper for DRM device-lifetime BO create") xe_rtp_match_first_gslice_fused_off() last use was removed in 2023 by commit 4e124151fcfc ("drm/xe/dg2: Drop pre-production workarounds") Remove them, and xe_dss_mask_empty whose last use was by xe_rtp_match_first_gslice_fused_off(). (Xe has a bunch ofother symbols that have been added but not used, given how new it is, I've left those, as opposed to these that had the code that used them removed). Reviewed-by: Lucas De Marchi Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250713152531.219326-1-linux@treblig.org Signed-off-by: Lucas De Marchi commit e480898e767c54a883e965fc306e2ece013cbca5 Author: Yicong Yang Date: Thu Jun 19 20:55:55 2025 +0800 drivers/perf: hisi: Support PMUs with no interrupt We'll have PMUs don't have an interrupt to indicate the counter overflow, but the Uncore PMU core assume all the PMUs have interrupt. So handle this case in the core. The existing PMUs won't be affected. Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20250619125557.57372-7-yangyicong@huawei.com Signed-off-by: Will Deacon commit 35f5b36e8cc2d241083ee0f08fa8b5366bde6f22 Author: Junhao He Date: Thu Jun 19 20:55:54 2025 +0800 drivers/perf: hisi: Relax the event number check of v2 PMUs The supported event number range of each Uncore PMUs is provided by each driver in hisi_pmu::check_event and out of range events will be rejected. A later version with expanded event number range needs to register the PMU with updated hisi_pmu::check_event even if it's the only update, which means the expanded events cannot be used unless the driver's updated. However the unsupported events won't be counted by the hardware so we can relax the event number check to allow the use the expanded events. Reviewed-by: Jonathan Cameron Signed-off-by: Junhao He Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20250619125557.57372-6-yangyicong@huawei.com Signed-off-by: Will Deacon commit 1fd20ba0a1dcaf3bf8757c0e0b8ff754ab25b228 Author: Junhao He Date: Thu Jun 19 20:55:53 2025 +0800 drivers/perf: hisi: Add support for HiSilicon SLLC v3 PMU driver SLLC v3 PMU has the following changes compared to previous version: a) update the register layout b) update the definition of SRCID_CTRL and TGTID_CTRL registers. To be compatible with v2, we use maximum width (11 bits) and mask the extra length for themselves. c) remove latency events (driver does not need to be adapted). SLLC v3 PMU is identified with HID HISI0264. Signed-off-by: Junhao He Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20250619125557.57372-5-yangyicong@huawei.com Signed-off-by: Will Deacon commit 29614c55fe6ff8e5ddee9c6247d5c3dbe05ca8bc Author: Junhao He Date: Thu Jun 19 20:55:52 2025 +0800 drivers/perf: hisi: Use ACPI driver_data to retrieve SLLC PMU information Make use of struct acpi_device_id::driver_data for version specific information rather than judge the version register. This will help to simplify the probe process and also a bit easier for extension. Factor out SLLC register definition to struct hisi_sllc_pmu_regs. No functional changes intended. Reviewed-by: Jonathan Cameron Signed-off-by: Junhao He Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20250619125557.57372-4-yangyicong@huawei.com Signed-off-by: Will Deacon commit 17aa34e86936d0dba4e7c05c55ffc3e12c0ccec9 Author: Junhao He Date: Thu Jun 19 20:55:51 2025 +0800 drivers/perf: hisi: Add support for HiSilicon DDRC v3 PMU driver HiSilicon DDRC v3 PMU has the different interrupt register offset compared to the v2. Add device information of v3 PMU with ACPI HID HISI0235. Signed-off-by: Junhao He Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20250619125557.57372-3-yangyicong@huawei.com Signed-off-by: Will Deacon commit dc86791ff68c38a2954c3bf2c444b6d6d9da52f3 Author: Junhao He Date: Thu Jun 19 20:55:50 2025 +0800 drivers/perf: hisi: Simplify the probe process for each DDRC version Version 1 and 2 of DDRC PMU also use different HID. Make use of struct acpi_device_id::driver_data for version specific information rather than judge the version register. This will help to simplify the probe process and also a bit easier for extension. In order to support this extend struct hisi_pmu_dev_info for version specific counter bits and event range. Signed-off-by: Junhao He Reviewed-by: Jonathan Cameron Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20250619125557.57372-2-yangyicong@huawei.com Signed-off-by: Will Deacon commit 9d2abd4162fca8a1eb46f664268dffad35c8ad20 Author: Sriram R Date: Fri Jul 11 14:47:04 2025 +0530 wifi: ath12k: Add support to enqueue management frame at MLD level A multi-link client can use any link for transmissions. It can decide to put one link in power save mode for longer periods while listening on the other links as per MLD listen interval. Unicast management frames sent to that link station might get dropped if that link station is in power save mode or inactive. In such cases, firmware can take decision on which link to use. Allow the firmware to decide on which link management frame should be sent on, by filling the hardware link with maximum value of u32, so that the firmware will not have a specific link to transmit data on and so the management frames will be link agnostic. For QCN devices, all action frames are marked as link agnostic. For WCN devices, if the device is configured as an AP, then all frames other than probe response frames, authentication frames, association response frames, re-association response frames and ADDBA response frames are marked as link agnostic and if the device is configured as a station, then all frames other than probe request frames, authentication frames, de-authentication frames and ADDBA response frames are marked as link agnostic. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Sriram R Co-developed-by: Roopni Devanathan Signed-off-by: Roopni Devanathan Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250711091704.3704379-1-quic_rdevanat@quicinc.com Signed-off-by: Jeff Johnson commit 545b669403d72cc4a1cf5d93b3fce0b6a85833f7 Author: Aaradhana Sahu Date: Tue Jul 8 23:41:02 2025 +0530 wifi: ath12k: Enable memory profile selection for QCN9274 The QCN9274 supports two memory profiles: a default profile and a low-memory profile. The driver signals the firmware to enable low-memory optimizations using the QMI initialization service. Add support to select the low-memory profile on system with less than 512 MB RAM. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Aaradhana Sahu Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250708181102.4111054-5-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 6397b92bbb00f7cda024056c8c8a10594a27ccaa Author: Aaradhana Sahu Date: Tue Jul 8 23:41:01 2025 +0530 wifi: ath12k: Refactor macros to use memory profile-based values Refactor macros to compute values dynamically at runtime based on the ath12k_mem_profile_based_param structure. Remove hardcoded logic to allow driver to operate more efficiently in memory-constrained platforms without significant functional impact. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Aaradhana Sahu Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250708181102.4111054-4-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit d11d81c46987720e022dd4008d4d1f1f63312e3e Author: Aaradhana Sahu Date: Tue Jul 8 23:41:00 2025 +0530 wifi: ath12k: Remove redundant TID calculation for QCN9274 Currently, host sends num_tids (number of TID (Traffic Identifier)) value to firmware via WMI_INIT_CMD during WMI initialization. However, the firmware does not use this value, as it determines the number of TIDs using its own internal logic. Hence, remove the redundant num_tids calculation logic for QCN9274. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Aaradhana Sahu Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250708181102.4111054-3-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit defae535dd63b1eb78ba87d5b8c0b4fb5418fe0c Author: Aaradhana Sahu Date: Tue Jul 8 23:40:59 2025 +0530 wifi: ath12k: Add a table of parameters entries impacting memory consumption Introduce ath12k_mem_profile_based_param structure to define configuration parameters for both default and low-memory profiles. Add support for enabling the low-memory profile in the follow-up patch by making the following changes: - Reduce sizes for transmit, receive, and monitor descriptor rings. - Reduce transmit and receive descriptor count. - Limit the maximum number of virtual devices (vdevs) to 9. - Reduce the maximum number of client support per radio. Centralize these parameters in the ath12k_mem_profile_based_param structure to simplify switching between memory profiles. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Aaradhana Sahu Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250708181102.4111054-2-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 6453e7cc32d1fd69344311224dbd00692eadc592 Author: Ingo Molnar Date: Fri Jun 13 10:00:27 2025 +0200 x86/kconfig/32: Refresh defconfig Refresh the x86-32 defconfig to pick up changes in the general Kconfig environment: removed options, different defaults, renames, etc. No changes to the actual result of 'make ARCH=i386 defconfig'. [ bp: Fold in a fix as reported by Andy: https://lore.kernel.org/r/20250626150118.318836-1-andriy.shevchenko@linux.intel.com ] Signed-off-by: Ingo Molnar Signed-off-by: Borislav Petkov (AMD) Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: David Woodhouse Cc: H. Peter Anvin Cc: Jürgen Groß Cc: Linus Torvalds Cc: Masahiro Yamada Cc: Michal Marek Cc: Peter Zijlstra Cc: Vitaly Kuznetsov Link: https://lore.kernel.org/r/20250515132719.31868-2-mingo@kernel.org commit 89f0b9ccd31479db17dcc59db29a6fcdb677746c Author: Shouping Wang Date: Fri Jul 11 19:15:17 2025 +0100 perf/arm-ni: Support sharing IRQs within an NI instance NI-700 has a distinct PMU interrupt output for each Clock Domain, however some integrations may still combine these together externally. The initial driver didn't attempt to support this, in anticipation of a more general solution for IRQ sharing between system PMU instances, but that's still a way off, so let's make this intermediate step for now to at least allow sharing IRQs within an individual NI instance. Now that CPU affinity and migration are cleaned up, it's fairly straightforward to adopt similar logic to arm-cmn, to identify CDs with a common interrupt and loop over them directly in the handler. Signed-off-by: Shouping Wang [ rm: Rework for affinity handling, cosmetics, new commit message ] Signed-off-by: Robin Murphy Link: https://lore.kernel.org/r/f62db639d3b54c959ec477db7b8ccecbef1ca310.1752256072.git.robin.murphy@arm.com Signed-off-by: Will Deacon commit 6a5dc6c7534eaafa362fa82f8ff060567b0577f1 Author: Robin Murphy Date: Fri Jul 11 19:15:16 2025 +0100 perf/arm-ni: Consolidate CPU affinity handling Since overflow interrupts from the individual PMUs are infrequent and unlikely to coincide, and we make no attempt to balance them across CPUs anyway, there's really not much point tracking a separate CPU affinity per PMU. Move the CPU affinity and hotplug migration up to the NI instance level. Tested-by: Shouping Wang Signed-off-by: Robin Murphy Link: https://lore.kernel.org/r/00b622872006c2f0c89485e343b1cb8caaa79c47.1752256072.git.robin.murphy@arm.com Signed-off-by: Will Deacon commit 43728a6434f9eca0385fd180d8452a5071678a5b Author: Jisheng Zhang Date: Mon Jul 14 09:04:56 2025 +0800 regulator: tps6286x-regulator: Fix a copy & paste error The volatile_reg function is named as tps6287x_volatile_reg by mistake when enabing the REGCACHE_MAPLE support. Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20250714010456.4906-1-jszhang@kernel.org Signed-off-by: Mark Brown commit 7cdb433bb44cdc87dc5260cdf15bf03cc1cd1814 Author: Alexander Kochetkov Date: Thu Jul 3 17:04:53 2025 +0300 ARM: rockchip: fix kernel hang during smp initialization In order to bring up secondary CPUs main CPU write trampoline code to SRAM. The trampoline code is written while secondary CPUs are powered on (at least that true for RK3188 CPU). Sometimes that leads to kernel hang. Probably because secondary CPU execute trampoline code while kernel doesn't expect. The patch moves SRAM initialization step to the point where all secondary CPUs are powered down. That fixes rarely hangs on RK3188: [ 0.091568] CPU0: thread -1, cpu 0, socket 0, mpidr 80000000 [ 0.091996] rockchip_smp_prepare_cpus: ncores 4 Signed-off-by: Alexander Kochetkov Link: https://lore.kernel.org/r/20250703140453.1273027-1-al.kochet@gmail.com Signed-off-by: Heiko Stuebner commit 0259de6331df405079b7aa13bf1398e6413cb866 Author: Alok Tiwari Date: Tue Jun 24 12:43:40 2025 -0700 perf/cxlpmu: Fix typos in cxl_pmu.c comments and documentation Fix several minor typo errors in comments: - Remove duplicated word "a" in "a a VID / GroupID". - Correct "Opcopdes" to "Opcodes" in CXL spec reference. - Fix spelling of "implemnted" to "implemented". Improves code readability and documentation consistency. Signed-off-by: Alok Tiwari Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20250624194350.109790-4-alok.a.tiwari@oracle.com Signed-off-by: Will Deacon commit 3e870815ccf5bc75274158f0b5e234fce6f93229 Author: Alok Tiwari Date: Tue Jun 24 12:43:39 2025 -0700 perf/cxlpmu: Remove unintended newline from IRQ name format string The IRQ name format string used in devm_kasprintf() mistakenly included a newline character "\n". This could lead to confusing log output or misformatted names in sysfs or debug messages. This fix removes the newline to ensure proper IRQ naming. Signed-off-by: Alok Tiwari Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20250624194350.109790-3-alok.a.tiwari@oracle.com Signed-off-by: Will Deacon commit 6ae58c74e7aa9aa6045d82996caa482ef2fdfbc4 Author: Alok Tiwari Date: Tue Jun 24 12:43:38 2025 -0700 perf/cxlpmu: Fix devm_kcalloc() argument order in cxl_pmu_probe() The previous code mistakenly swapped the count and size parameters. This fix corrects the argument order in devm_kcalloc() to follow the conventional count, size form, avoiding potential confusion or bugs. Signed-off-by: Alok Tiwari Reviewed-by: Jonathan Cameron Link: https://lore.kernel.org/r/20250624194350.109790-2-alok.a.tiwari@oracle.com Signed-off-by: Will Deacon commit 891667cefd16e71cd847c75dbdc272acd996bb68 Merge: 0bdbce25855f02 40b1c2f9b29929 Author: Takashi Iwai Date: Mon Jul 14 14:29:49 2025 +0200 Merge branch 'for-linus' into for-next Signed-off-by: Takashi Iwai commit de747bd023c09b5b7f3bf5c952d7b1da77a9caaa Author: Alice Ryhl Date: Mon Jun 23 13:57:27 2025 +0000 poll: rust: allow poll_table ptrs to be null It's possible for a poll_table to be null. This can happen if an end-user just wants to know if a resource has events right now without registering a waiter for when events become available. Furthermore, these null pointers should be handled transparently by the API, so we should not change `from_ptr` to return an `Option`. Thus, change `PollTable` to wrap a raw pointer rather than use a reference so that you can pass null. Comments mentioning `struct poll_table` are changed to just `poll_table` since `poll_table` is a typedef. (It's a typedef because it's supposed to be opaque.) Reviewed-by: Benno Lossin Signed-off-by: Alice Ryhl commit 2d70fdd9b5c9a10c5a4b15179b425ff554b60c6d Author: Kaustabh Chakraborty Date: Sat Jul 12 17:19:30 2025 +0530 iommu/exynos: add support for reserved regions The bootloader configures a reserved memory region for framebuffer, which is protected by the IOMMU. The kernel-side driver is oblivious as of which memory region is set up by the bootloader. In such case, the IOMMU tries to reference the reserved region - which is not reserved in the kernel anymore - and it results in an unrecoverable page fault. More information about it is provided in [1]. Add support for reserved regions using iommu_dma_get_resv_regions(). For OF supported boards, this requires defining the region in the iommu-addresses property of the IOMMU owner's node. Link: https://lore.kernel.org/r/544ad69cba52a9b87447e3ac1c7fa8c3@disroot.org [1] Signed-off-by: Kaustabh Chakraborty Link: https://lore.kernel.org/r/20250712-exynos-sysmmu-resv-regions-v1-1-e79681fcab1a@disroot.org Signed-off-by: Will Deacon commit 7da2fdaaa1e6062686ac96a9f096c2d7847533e4 Author: Jie Zhan Date: Mon Jun 23 22:34:01 2025 +0800 PM / devfreq: Add HiSilicon uncore frequency scaling driver Add the HiSilicon uncore frequency scaling driver for Kunpeng SoCs based on the devfreq framework. The uncore domain contains shared computing resources, including system interconnects and L3 cache. The uncore frequency significantly impacts the system-wide performance as well as power consumption. This driver adds support for runtime management of uncore frequency from kernel and userspace. The main function includes setting and getting frequencies, changing frequency scaling policies, and querying the list of CPUs whose performance is significantly related to this uncore frequency domain, etc. The driver communicates with a platform controller through an ACPI PCC mailbox to take the actual actions of frequency scaling. Co-developed-by: Lifeng Zheng Signed-off-by: Lifeng Zheng Reviewed-by: Jonathan Cameron Reviewed-by: Huisong Li Signed-off-by: Jie Zhan Signed-off-by: Chanwoo Choi Link: https://patchwork.kernel.org/project/linux-pm/patch/20250623143401.4095045-3-zhanjie9@hisilicon.com/ commit 45b9d1da6ca0d0285140f8779793b537e4560d45 Author: Jie Zhan Date: Mon Jun 23 22:34:00 2025 +0800 PM / devfreq: Allow devfreq driver to add custom sysfs ABIs Extend the devfreq_dev_profile to allow drivers optionally create device-specific sysfs ABIs together with other common devfreq ABIs under the devfreq device path. Reviewed-by: Jonathan Cameron Reviewed-by: Huisong Li Signed-off-by: Jie Zhan Signed-off-by: Chanwoo Choi Link: https://patchwork.kernel.org/project/linux-pm/patch/20250623143401.4095045-2-zhanjie9@hisilicon.com/ commit b9bb7e814cd0c3633791327a96749a1f9b7f3ef4 Author: Dmitry Baryshkov Date: Sat Jul 5 19:08:33 2025 +0300 iommu/arm-smmu: disable PRR on SM8250 On SM8250 / QRB5165-RB5 using PRR bits resets the device, most likely because of the hyp limitations. Disable PRR support on that platform. Fixes: 7f2ef1bfc758 ("iommu/arm-smmu: Add support for PRR bit setup") Signed-off-by: Dmitry Baryshkov Reviewed-by: Akhil P Oommen Reviewed-by: Rob Clark Link: https://lore.kernel.org/r/20250705-iommu-fix-prr-v2-1-406fecc37cf8@oss.qualcomm.com Signed-off-by: Will Deacon commit 49f42634e8054e57d09c7f9ef5e4527e116059cb Author: Nicolin Chen Date: Fri Jul 11 13:40:20 2025 -0700 iommu/arm-smmu-v3: Revert vmaster in the error path The error path for err_free_master_domain leaks the vmaster. Move all the kfrees for vmaster into the goto error section. Fixes: cfea71aea921 ("iommu/arm-smmu-v3: Put iopf enablement in the domain attach path") Cc: stable@vger.kernel.org Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Link: https://lore.kernel.org/r/20250711204020.1677884-1-nicolinc@nvidia.com Signed-off-by: Will Deacon commit ec7ca73144e9ca98ed278523b9bf30e1c775c0a9 Author: Daniel Mentz Date: Tue Jul 8 21:17:05 2025 +0000 iommu/io-pgtable-arm: Remove unused macro iopte_prot Commit 33729a5fc0ca ("iommu/io-pgtable-arm: Remove split on unmap behavior") removed the last user of the macro iopte_prot. Remove the macro definition of iopte_prot as well as three other related definitions. Fixes: 33729a5fc0ca ("iommu/io-pgtable-arm: Remove split on unmap behavior") Signed-off-by: Daniel Mentz Reviewed-by: Liviu Dudau Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20250708211705.1567787-1-danielmentz@google.com Signed-off-by: Will Deacon commit d87547e08b097a4b62ce5f9c9a1393ce6f305b6f Merge: 0745658aebbe77 621a88dbfe9006 Author: Ulf Hansson Date: Mon Jul 14 13:11:03 2025 +0200 pmdomain: Merge branch fixes into next Merge the pmdomain fixes for v6.16-rc[n] into the next branch, to allow them to get tested together with the new changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit f7fa8520f30373ce99c436c4d57c76befdacbef3 Author: Alexey Klimov Date: Fri Jun 13 18:32:38 2025 +0100 iommu/arm-smmu-qcom: Add SM6115 MDSS compatible Add the SM6115 MDSS compatible to clients compatible list, as it also needs that workaround. Without this workaround, for example, QRB4210 RB2 which is based on SM4250/SM6115 generates a lot of smmu unhandled context faults during boot: arm_smmu_context_fault: 116854 callbacks suppressed arm-smmu c600000.iommu: Unhandled context fault: fsr=0x402, iova=0x5c0ec600, fsynr=0x320021, cbfrsynra=0x420, cb=5 arm-smmu c600000.iommu: FSR = 00000402 [Format=2 TF], SID=0x420 arm-smmu c600000.iommu: FSYNR0 = 00320021 [S1CBNDX=50 PNU PLVL=1] arm-smmu c600000.iommu: Unhandled context fault: fsr=0x402, iova=0x5c0d7800, fsynr=0x320021, cbfrsynra=0x420, cb=5 arm-smmu c600000.iommu: FSR = 00000402 [Format=2 TF], SID=0x420 and also failed initialisation of lontium lt9611uxc, gpu and dpu is observed: (binding MDSS components triggered by lt9611uxc have failed) ------------[ cut here ]------------ !aspace WARNING: CPU: 6 PID: 324 at drivers/gpu/drm/msm/msm_gem_vma.c:130 msm_gem_vma_init+0x150/0x18c [msm] Modules linked in: ... (long list of modules) CPU: 6 UID: 0 PID: 324 Comm: (udev-worker) Not tainted 6.15.0-03037-gaacc73ceeb8b #4 PREEMPT Hardware name: Qualcomm Technologies, Inc. QRB4210 RB2 (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : msm_gem_vma_init+0x150/0x18c [msm] lr : msm_gem_vma_init+0x150/0x18c [msm] sp : ffff80008144b280 ... Call trace: msm_gem_vma_init+0x150/0x18c [msm] (P) get_vma_locked+0xc0/0x194 [msm] msm_gem_get_and_pin_iova_range+0x4c/0xdc [msm] msm_gem_kernel_new+0x48/0x160 [msm] msm_gpu_init+0x34c/0x53c [msm] adreno_gpu_init+0x1b0/0x2d8 [msm] a6xx_gpu_init+0x1e8/0x9e0 [msm] adreno_bind+0x2b8/0x348 [msm] component_bind_all+0x100/0x230 msm_drm_bind+0x13c/0x3d0 [msm] try_to_bring_up_aggregate_device+0x164/0x1d0 __component_add+0xa4/0x174 component_add+0x14/0x20 dsi_dev_attach+0x20/0x34 [msm] dsi_host_attach+0x58/0x98 [msm] devm_mipi_dsi_attach+0x34/0x90 lt9611uxc_attach_dsi.isra.0+0x94/0x124 [lontium_lt9611uxc] lt9611uxc_probe+0x540/0x5fc [lontium_lt9611uxc] i2c_device_probe+0x148/0x2a8 really_probe+0xbc/0x2c0 __driver_probe_device+0x78/0x120 driver_probe_device+0x3c/0x154 __driver_attach+0x90/0x1a0 bus_for_each_dev+0x68/0xb8 driver_attach+0x24/0x30 bus_add_driver+0xe4/0x208 driver_register+0x68/0x124 i2c_register_driver+0x48/0xcc lt9611uxc_driver_init+0x20/0x1000 [lontium_lt9611uxc] do_one_initcall+0x60/0x1d4 do_init_module+0x54/0x1fc load_module+0x1748/0x1c8c init_module_from_file+0x74/0xa0 __arm64_sys_finit_module+0x130/0x2f8 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x2c/0x80 el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ---[ end trace 0000000000000000 ]--- msm_dpu 5e01000.display-controller: [drm:msm_gpu_init [msm]] *ERROR* could not allocate memptrs: -22 msm_dpu 5e01000.display-controller: failed to load adreno gpu platform a400000.remoteproc:glink-edge:apr:service@7:dais: Adding to iommu group 19 msm_dpu 5e01000.display-controller: failed to bind 5900000.gpu (ops a3xx_ops [msm]): -22 msm_dpu 5e01000.display-controller: adev bind failed: -22 lt9611uxc 0-002b: failed to attach dsi to host lt9611uxc 0-002b: probe with driver lt9611uxc failed with error -22 Suggested-by: Bjorn Andersson Reviewed-by: Dmitry Baryshkov Fixes: 3581b7062cec ("drm/msm/disp/dpu1: add support for display on SM6115") Cc: stable@vger.kernel.org Signed-off-by: Alexey Klimov Link: https://lore.kernel.org/r/20250613173238.15061-1-alexey.klimov@linaro.org Signed-off-by: Will Deacon commit c3bc361393b289df3499f5a87276367c71fae7c6 Author: Uwe Kleine-König Date: Tue May 13 22:39:02 2025 +0200 PM / devfreq: sun8i-a33-mbus: Simplify by using more devm functions Use devm allocators for enabling the bus clock and clk_rate_exclusive_get(). This simplifies error handling and the remove callback. Reviewed-by: Chen-Yu Tsai Signed-off-by: Uwe Kleine-König Tested-by: Corentin LABBE Link: https://patchwork.kernel.org/project/linux-pm/patch/20250513203908.205060-2-u.kleine-koenig@baylibre.com/ Signed-off-by: Chanwoo Choi commit 78c5845fbbf6aaeb9959c5fbaee5cc53ef5f38c2 Author: Chanwoo Choi Date: Fri Feb 7 16:13:50 2025 -1000 PM / devfreq: Fix a index typo in trans_stat Fixes: 4920ee6dcfaf ("PM / devfreq: Convert to use sysfs_emit_at() API") Signed-off-by: pls Link: https://patchwork.kernel.org/project/linux-pm/patch/20250515143100.17849-1-chanwoo@kernel.org/ Signed-off-by: Chanwoo Choi commit bab7834c03820eb11269bc48f07c3800192460d2 Author: Lifeng Zheng Date: Mon Apr 21 11:00:20 2025 +0800 PM / devfreq: Check governor before using governor->name Commit 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") removes governor_name and uses governor->name to replace it. But devfreq->governor may be NULL and directly using devfreq->governor->name may cause null pointer exception. Move the check of governor to before using governor->name. Fixes: 96ffcdf239de ("PM / devfreq: Remove redundant governor_name from struct devfreq") Signed-off-by: Lifeng Zheng Link: https://lore.kernel.org/lkml/20250421030020.3108405-5-zhenglifeng1@huawei.com/ Signed-off-by: Chanwoo Choi commit a98d36802f677d90333cc431e23f13cd53608a96 Author: Lifeng Zheng Date: Mon Apr 21 11:00:19 2025 +0800 PM / devfreq: Remove redundant devfreq_get_freq_range() calling in devfreq_add_device() The calling of devfreq_get_freq_range() in devfreq_add_device() is redundant because min_freq and max_freq are never used. Remove it. Signed-off-by: Lifeng Zheng Link: https://lore.kernel.org/lkml/20250421030020.3108405-4-zhenglifeng1@huawei.com/ Signed-off-by: Chanwoo Choi commit 5487f2595bc821348848b0708f42df825d856f9e Author: Lifeng Zheng Date: Mon Apr 21 11:00:18 2025 +0800 PM / devfreq: Limit max_freq with scaling_min_freq Limit max_freq in devfreq_get_freq_range() with scaling_min_freq to avoid showing an unreachable freq when reading it. Use macro clamp to simplify code. Signed-off-by: Lifeng Zheng Link: https://lore.kernel.org/lkml/20250421030020.3108405-3-zhenglifeng1@huawei.com/ Signed-off-by: Chanwoo Choi commit 914cc799b28f17d369d5b4db3b941957d18157e8 Author: Lifeng Zheng Date: Mon Apr 21 11:00:17 2025 +0800 PM / devfreq: governor: Replace sscanf() with kstrtoul() in set_freq_store() Replace sscanf() with kstrtoul() in set_freq_store() and check the result to avoid invalid input. Signed-off-by: Lifeng Zheng Link: https://lore.kernel.org/lkml/20250421030020.3108405-2-zhenglifeng1@huawei.com/ Signed-off-by: Chanwoo Choi commit ced24bf4352c2216e413d1b81f6675950473e7f6 Author: Jason Gunthorpe Date: Fri Jul 11 10:16:38 2025 -0300 iommu/qcom: Fix pgsize_bitmap qcom uses the ARM_32_LPAE_S1 format which uses the ARM long descriptor page table. Eventually arm_32_lpae_alloc_pgtable_s1() will adjust the pgsize_bitmap with: cfg->pgsize_bitmap &= (SZ_4K | SZ_2M | SZ_1G); So the current declaration is nonsensical. Fix it to be just SZ_4K which is what it has actually been using so far. Most likely the qcom driver copy and pasted the pgsize_bitmap from something using the ARM_V7S format. Fixes: db64591de4b2 ("iommu/qcom: Remove iommu_ops pgsize_bitmap") Reported-by: Naresh Kamboju Closes: https://lore.kernel.org/all/CA+G9fYvif6kDDFar5ZK4Dff3XThSrhaZaJundjQYujaJW978yg@mail.gmail.com/ Tested-by: Linux Kernel Functional Testing Signed-off-by: Jason Gunthorpe Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/0-v1-65a7964d2545+195-qcom_pgsize_jgg@nvidia.com Signed-off-by: Will Deacon commit b88b7e2096665dec5931c1d20b0b6269aa4bfaa4 Merge: b30d390812c855 3aa47d2ec83316 Author: Mark Brown Date: Mon Jul 14 11:34:22 2025 +0100 Add RPMh regulator support for PM7550 & PMR735B Merge series from Luca Weiss : Document and add support for the regulators on PM7550 and PMR735B, which can be paired with the Milos SoC. commit bfd291279f87a2cf2bebbf93d654a352b6bcd083 Merge: e977f3811effb0 790d5f8ee6f2a2 Author: Mark Brown Date: Mon Jul 14 11:34:16 2025 +0100 ASoC: codec: Convert to GPIO descriptors for Merge series from Peng Fan : This patchset is a pick up of patch 1,2 from [1]. And I also collect Linus's R-b for patch 2. After this patchset, there is only one user of of_gpio.h left in sound driver(pxa2xx-ac97). of_gpio.h is deprecated, update the driver to use GPIO descriptors. Patch 1 is to drop legacy platform data which in-tree no users are using it Patch 2 is to convert to GPIO descriptors Checking the DTS that use the device, all are using GPIOD_ACTIVE_LOW polarity for reset-gpios, so all should work as expected with this patch. [1] https://lore.kernel.org/all/20250408-asoc-gpio-v1-0-c0db9d3fd6e9@nxp.com/ commit e977f3811effb0f4b50824fcadd6b40d2b4d867f Merge: 5f120ccf28c5f7 5030abcb0aa330 Author: Mark Brown Date: Mon Jul 14 11:34:12 2025 +0100 Update SDCA Kconfig Merge series from Charles Keepax : Tidy up a bunch of makefile and Kconfig things, and pull the HID and IRQ into the main SDCA module. Changes since v1: - Don't expose SND_SOC_SDCA to the user - Simplify the makefile bits for HID and IRQ Thanks, Charles Charles Keepax (2): ASoC: SDCA: Kconfig/Makefile fixups ASoC: SDCA: Pull HID and IRQ into the primary SDCA module sound/soc/sdca/Kconfig | 13 +++++++++---- sound/soc/sdca/Makefile | 12 ++++-------- sound/soc/sdca/sdca_functions.c | 1 - sound/soc/sdca/sdca_hid.c | 2 +- sound/soc/sdca/sdca_interrupts.c | 8 ++++---- 5 files changed, 18 insertions(+), 18 deletions(-) -- 2.39.5 commit 5f120ccf28c5f73d9801d34cad2d29280f2682ec Merge: af241e3fa4d823 f00e06296ba3f0 Author: Mark Brown Date: Mon Jul 14 11:34:08 2025 +0100 ASoC: set bias_level at if Merge series from Kuninori Morimoto : ASoC has 2 functions to set bias level. (A) snd_soc_dapm_force_bias_level() (B) snd_soc_dapm_set_bias_level() (A) sets dapm->bias_level, but (B) is not. I think we should set it on both (A) and (B). I think it is miss or bug, but Samsung is the only vendor that feels a problem about this. I think this patch (= [1/5]) is correct approach, but some non-samsung vendor might get affect from this patch-set, so I added [RFC] on this patch-set. Furthermore, (B) cares both Card and Component, (A) cares Component only. I guess it is the reason why it is called as "force" bias_level function. (A) is used from each drivers, (B) is used from soc-dapm only. I'm not 100% sure though, except special cases, each driver should use (B), I guess ? commit e934464e098ebfc212c72d3022f1d31b88929768 Author: Ethan Milon Date: Mon Jul 14 12:50:28 2025 +0800 iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range The logic in cache_tag_flush_all() to iterate over cache tags and issue TLB invalidations is largely duplicated in cache_tag_flush_range(), with the only difference being the range parameters. Extend cache_tag_flush_range() to handle a full address space flush when called with start = 0 and end = ULONG_MAX. This allows cache_tag_flush_all() to simply delegate to cache_tag_flush_range() Signed-off-by: Ethan Milon Link: https://lore.kernel.org/r/20250708214821.30967-2-ethan.milon@eviden.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250714045028.958850-12-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit 3141153816bf4f0257747bd4dda176d38f1a9a49 Author: Ethan Milon Date: Mon Jul 14 12:50:27 2025 +0800 iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all The function cache_tag_flush_all() was originally implemented with incorrect device TLB invalidation logic that does not handle PASID, in commit c4d27ffaa8eb ("iommu/vt-d: Add cache tag invalidation helpers") This causes regressions where full address space TLB invalidations occur with a PASID attached, such as during transparent hugepage unmapping in SVA configurations or when calling iommu_flush_iotlb_all(). In these cases, the device receives a TLB invalidation that lacks PASID. This incorrect logic was later extracted into cache_tag_flush_devtlb_all(), in commit 3297d047cd7f ("iommu/vt-d: Refactor IOTLB and Dev-IOTLB flush for batching") The fix replaces the call to cache_tag_flush_devtlb_all() with cache_tag_flush_devtlb_psi(), which properly handles PASID. Fixes: 4f609dbff51b ("iommu/vt-d: Use cache helpers in arch_invalidate_secondary_tlbs") Fixes: 4e589a53685c ("iommu/vt-d: Use cache_tag_flush_all() in flush_iotlb_all") Signed-off-by: Ethan Milon Link: https://lore.kernel.org/r/20250708214821.30967-1-ethan.milon@eviden.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250714045028.958850-11-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit 85cfaacc99377a63e47412eeef66eff77197acea Author: Jason Gunthorpe Date: Mon Jul 14 12:50:26 2025 +0800 iommu/vt-d: Split paging_domain_compatible() Make First/Second stage specific functions that follow the same pattern in intel_iommu_domain_alloc_first/second_stage() for computing EOPNOTSUPP. This makes the code easier to understand as if we couldn't create a domain with the parameters for this IOMMU instance then we certainly are not compatible with it. Check superpage support directly against the per-stage cap bits and the pgsize_bitmap. Add a note that the force_snooping is read without locking. The locking needs to cover the compatible check and the add of the device to the list. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/7-v3-dbbe6f7e7ae3+124ffe-vtd_prep_jgg@nvidia.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250714045028.958850-10-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit 0fa6f0893466c9fc0a149d215cfcee760e41cb00 Author: Jason Gunthorpe Date: Mon Jul 14 12:50:25 2025 +0800 iommu/vt-d: Split intel_iommu_enforce_cache_coherency() First Stage and Second Stage have very different ways to deny no-snoop. The first stage uses the PGSNP bit which is global per-PASID so enabling requires loading new PASID entries for all the attached devices. Second stage uses a bit per PTE, so enabling just requires telling future maps to set the bit. Since we now have two domain ops we can have two functions that can directly code their required actions instead of a bunch of logic dancing around use_first_level. Combine domain_set_force_snooping() into the new functions since they are the only caller. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/6-v3-dbbe6f7e7ae3+124ffe-vtd_prep_jgg@nvidia.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250714045028.958850-9-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit b33125296b5047115469b8a3b74c0fdbf4976548 Author: Jason Gunthorpe Date: Mon Jul 14 12:50:24 2025 +0800 iommu/vt-d: Create unique domain ops for each stage Use the domain ops pointer to tell what kind of domain it is instead of the internal use_first_level indication. This also protects against wrongly using a SVA/nested/IDENTITY/BLOCKED domain type in places they should not be. The only remaining uses of use_first_level outside the paging domain are in paging_domain_compatible() and intel_iommu_enforce_cache_coherency(). Thus, remove the useless sets of use_first_level in intel_svm_domain_alloc() and intel_iommu_domain_alloc_nested(). None of the unique ops for these domain types ever reference it on their call chains. Add a WARN_ON() check in domain_context_mapping_one() as it only works with second stage. This is preparation for iommupt which will have different ops for each of the stages. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/5-v3-dbbe6f7e7ae3+124ffe-vtd_prep_jgg@nvidia.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250714045028.958850-8-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit b9434ba97c44f5744ea537adfd1f9f3fe102681c Author: Jason Gunthorpe Date: Mon Jul 14 12:50:23 2025 +0800 iommu/vt-d: Split intel_iommu_domain_alloc_paging_flags() Create stage specific functions that check the stage specific conditions if each stage can be supported. Have intel_iommu_domain_alloc_paging_flags() call both stages in sequence until one does not return EOPNOTSUPP and prefer to use the first stage if available and suitable for the requested flags. Move second stage only operations like nested_parent and dirty_tracking into the second stage function for clarity. Move initialization of the iommu_domain members into paging_domain_alloc(). Drop initialization of domain->owner as the callers all do it. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/4-v3-dbbe6f7e7ae3+124ffe-vtd_prep_jgg@nvidia.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250714045028.958850-7-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit 5c3687d5789cfff8d285a2c76bceb47f145bf01f Author: Jason Gunthorpe Date: Mon Jul 14 12:50:22 2025 +0800 iommu/vt-d: Do not wipe out the page table NID when devices detach The NID is used to control which NUMA node memory for the page table is allocated it from. It should be a permanent property of the page table when it was allocated and not change during attach/detach of devices. Reviewed-by: Wei Wang Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/3-v3-dbbe6f7e7ae3+124ffe-vtd_prep_jgg@nvidia.com Signed-off-by: Lu Baolu Fixes: 7c204426b818 ("iommu/vt-d: Add domain_alloc_paging support") Link: https://lore.kernel.org/r/20250714045028.958850-6-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit 00939bebe51c23d325c9796ad57ace49833a5813 Author: Jason Gunthorpe Date: Mon Jul 14 12:50:21 2025 +0800 iommu/vt-d: Fold domain_exit() into intel_iommu_domain_free() It has only one caller, no need for two functions. Correct the WARN_ON() error handling to leak the entire page table if the HW is still referencing it so we don't UAF during WARN_ON recovery. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/2-v3-dbbe6f7e7ae3+124ffe-vtd_prep_jgg@nvidia.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250714045028.958850-5-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit cd0d0e4e48d817215695e1cc9114c6f614fb629f Author: Jason Gunthorpe Date: Mon Jul 14 12:50:20 2025 +0800 iommu/vt-d: Lift the __pa to domain_setup_first_level/intel_svm_set_dev_pasid() Pass the phys_addr_t down through the call chain from the top instead of passing a pgd_t * KVA. This moves the __pa() into domain_setup_first_level() which is the first function to obtain the pgd from the IOMMU page table in this call chain. The SVA flow is also adjusted to get the pa of the mm->pgd. iommput will move the __pa() into iommupt code, it never shares the KVA of the page table with the driver. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Link: https://lore.kernel.org/r/1-v3-dbbe6f7e7ae3+124ffe-vtd_prep_jgg@nvidia.com Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250714045028.958850-4-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit 12724ce3fe1a3d8f30d56e48b4f272d8860d1970 Author: Lu Baolu Date: Mon Jul 14 12:50:19 2025 +0800 iommu/vt-d: Optimize iotlb_sync_map for non-caching/non-RWBF modes The iotlb_sync_map iommu ops allows drivers to perform necessary cache flushes when new mappings are established. For the Intel iommu driver, this callback specifically serves two purposes: - To flush caches when a second-stage page table is attached to a device whose iommu is operating in caching mode (CAP_REG.CM==1). - To explicitly flush internal write buffers to ensure updates to memory- resident remapping structures are visible to hardware (CAP_REG.RWBF==1). However, in scenarios where neither caching mode nor the RWBF flag is active, the cache_tag_flush_range_np() helper, which is called in the iotlb_sync_map path, effectively becomes a no-op. Despite being a no-op, cache_tag_flush_range_np() involves iterating through all cache tags of the iommu's attached to the domain, protected by a spinlock. This unnecessary execution path introduces overhead, leading to a measurable I/O performance regression. On systems with NVMes under the same bridge, performance was observed to drop from approximately ~6150 MiB/s down to ~4985 MiB/s. Introduce a flag in the dmar_domain structure. This flag will only be set when iotlb_sync_map is required (i.e., when CM or RWBF is set). The cache_tag_flush_range_np() is called only for domains where this flag is set. This flag, once set, is immutable, given that there won't be mixed configurations in real-world scenarios where some IOMMUs in a system operate in caching mode while others do not. Theoretically, the immutability of this flag does not impact functionality. Reported-by: Ioanna Alifieraki Closes: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2115738 Link: https://lore.kernel.org/r/20250701171154.52435-1-ioanna-maria.alifieraki@canonical.com Fixes: 129dab6e1286 ("iommu/vt-d: Use cache_tag_flush_range_np() in iotlb_sync_map") Cc: stable@vger.kernel.org Signed-off-by: Lu Baolu Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20250703031545.3378602-1-baolu.lu@linux.intel.com Link: https://lore.kernel.org/r/20250714045028.958850-3-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit bd26cd9d815acba56204c8b2af45af96d221c962 Author: Vineeth Pillai (Google) Date: Mon Jul 14 12:50:18 2025 +0800 iommu/vt-d: Remove the CONFIG_X86 wrapping from iommu init hook iommu init hook is wrapped in CONFI_X86 and is a remnant of dmar.c when it was a common code in "drivers/pci/dmar.c". This was added in commit (9d5ce73a64be2 x86: intel-iommu: Convert detect_intel_iommu to use iommu_init hook) Now this is built only for x86. This config wrap could be removed. Signed-off-by: Vineeth Pillai (Google) Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20250616131740.3499289-1-vineeth@bitbyteword.org Signed-off-by: Lu Baolu Link: https://lore.kernel.org/r/20250714045028.958850-2-baolu.lu@linux.intel.com Signed-off-by: Will Deacon commit b1dc7f097b78eb8d25b071ead2384b07a549692b Author: Shubhrajyoti Datta Date: Sun Jul 13 10:37:53 2025 +0530 EDAC/synopsys: Clear the ECC counters on init Clear the ECC error and counter registers during initialization/probe to avoid reporting stale errors that may have occurred before EDAC registration. For that, unify the Zynq and ZynqMP ECC state reading paths and simplify the code. [ bp: Massage commit message. Fix an -Wsometimes-uninitialized warning as reported by Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507141048.obUv3ZUm-lkp@intel.com ] Signed-off-by: Shubhrajyoti Datta Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250713050753.7042-1-shubhrajyoti.datta@amd.com commit 0745658aebbe77bcb3ba82f184087e12af2f3df5 Author: Ulf Hansson Date: Fri Jul 11 13:47:19 2025 +0200 pmdomain: samsung: Fix splash-screen handover by enforcing a sync_state It's has been reported that some Samsung platforms fails to boot with genpd's new sync_state support. Typically the problem exists for platforms where bootloaders are turning on the splash-screen and handing it over to be managed by the kernel. However, at this point, it's not clear how to correctly solve the problem. Although, to make the platforms boot again, let's add a temporary hack in the samsung power-domain provider driver, which enforces a sync_state that allows the power-domains to be reset before consumer devices starts to be attached. Reported-by: Marek Szyprowski Link: https://lore.kernel.org/all/212a1a56-08a5-48a5-9e98-23de632168d0@samsung.com Acked-by: Krzysztof Kozlowski Tested-by: Marek Szyprowski Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250711114719.189441-1-ulf.hansson@linaro.org commit 1eec89a671413ce38df9fe9e70f5130a9eb79a59 Author: K Prateek Nayak Date: Fri Jul 11 11:20:30 2025 +0530 sched/topology: Remove sched_domain_topology_level::flags Support for overlapping domains added in commit e3589f6c81e4 ("sched: Allow for overlapping sched_domain spans") also allowed forcefully setting SD_OVERLAP for !NUMA domains via FORCE_SD_OVERLAP sched_feat(). Since NUMA domains had to be presumed overlapping to ensure correct behavior, "sched_domain_topology_level::flags" was introduced. NUMA domains added the SDTL_OVERLAP flag would ensure SD_OVERLAP was always added during build_sched_domains() for these domains, even when FORCE_SD_OVERLAP was off. Condition for adding the SD_OVERLAP flag at the aforementioned commit was as follows: if (tl->flags & SDTL_OVERLAP || sched_feat(FORCE_SD_OVERLAP)) sd->flags |= SD_OVERLAP; The FORCE_SD_OVERLAP debug feature was removed in commit af85596c74de ("sched/topology: Remove FORCE_SD_OVERLAP") which left the NUMA domains as the exclusive users of SDTL_OVERLAP, SD_OVERLAP, and SD_NUMA flags. Get rid of SDTL_OVERLAP and SD_OVERLAP as they have become redundant and instead rely on SD_NUMA to detect the only overlapping domain currently supported. Since SDTL_OVERLAP was the only user of "tl->flags", get rid of "sched_domain_topology_level::flags" too. Signed-off-by: K Prateek Nayak Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/ba4dbdf8-bc37-493d-b2e0-2efb00ea3e19@amd.com commit f79c9aa446d638190578515afcd06d6c9d72da55 Author: Li Chen Date: Thu Jul 10 18:57:10 2025 +0800 x86/smpboot: avoid SMT domain attach/destroy if SMT is not enabled Currently, the SMT domain is added into sched_domain_topology by default. If cpu_attach_domain() finds that the CPU SMT domain’s cpumask_weight is just 1, it will destroy it. On a large machine, such as one with 512 cores, this results in 512 redundant domain attach/destroy operations. Avoid these unnecessary operations by simply checking cpu_smt_num_threads and skip SMT domain if the SMT domain is not enabled. Suggested-by: K Prateek Nayak Signed-off-by: Li Chen Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Tested-by: K Prateek Nayak Link: https://lore.kernel.org/r/20250710105715.66594-5-me@linux.beauty commit fbc2010d92e595dc13d8048db2419f963c8cb25e Author: Li Chen Date: Thu Jul 10 18:57:09 2025 +0800 x86/smpboot: moves x86_topology to static initialize and truncate The #ifdeffery and the initializers in build_sched_topology() are just disgusting. Statically initialize the domain levels in the topology array and let build_sched_topology() invalidate the package domain level when NUMA in package is available. Suggested-by: Thomas Gleixner Signed-off-by: Li Chen Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Tested-by: K Prateek Nayak Link: https://lore.kernel.org/r/20250710105715.66594-4-me@linux.beauty commit 992de2b02509bed68f693ea5a68b07cd586197b7 Author: Li Chen Date: Thu Jul 10 18:57:08 2025 +0800 x86/smpboot: remove redundant CONFIG_SCHED_SMT On x86 CONFIG_SCHED_SMT is default y if SMP is enabled, so let's simply drop CONFIG_SCHED_SMT. Suggested-by: Thomas Gleixner Signed-off-by: Li Chen Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Tested-by: K Prateek Nayak Link: https://lore.kernel.org/r/20250710105715.66594-3-me@linux.beauty commit e075f4360931263f5ec006ea5dadc065e5e98eb8 Author: Li Chen Date: Thu Jul 10 18:57:07 2025 +0800 smpboot: introduce SDTL_INIT() helper to tidy sched topology setup Define a small SDTL_INIT(maskfn, flagsfn, name) macro and use it to build the sched_domain_topology_level array. Purely a cleanup; behaviour is unchanged. Suggested-by: Thomas Gleixner Signed-off-by: Li Chen Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: K Prateek Nayak Tested-by: K Prateek Nayak Link: https://lore.kernel.org/r/20250710105715.66594-2-me@linux.beauty commit 634c24068abf8f325e520e663250e4a32a95ea0e Author: Juri Lelli Date: Fri Jun 27 13:51:18 2025 +0200 tools/sched: Add dl_bw_dump.py for printing bandwidth accounting info dl_rq bandwidth accounting information is crucial for the correct functioning of SCHED_DEADLINE. Add a drgn script for accessing that information at runtime, so that it's easier to check and debug issues related to it. Signed-off-by: Juri Lelli Signed-off-by: Peter Zijlstra (Intel) Tested-by: Marcel Ziswiler # nuc & rock5b Link: https://lore.kernel.org/r/20250627115118.438797-6-juri.lelli@redhat.com commit 9fdb12c88e9ba75e2d831fb397dd27f03a534968 Author: Juri Lelli Date: Fri Jun 27 13:51:17 2025 +0200 tools/sched: Add root_domains_dump.py which dumps root domains info Root domains information is somewhat hard to access at runtime. Even with sched_debug and sched_verbose, such information is only printed on kernel console when domains are modified. Add a simple drgn script to more easily retrieve root domains information at runtime. Since tools/sched is a new directory, add it to MAINTAINERS as well. Signed-off-by: Juri Lelli Signed-off-by: Peter Zijlstra (Intel) Tested-by: Marcel Ziswiler # nuc & rock5b Link: https://lore.kernel.org/r/20250627115118.438797-5-juri.lelli@redhat.com commit 440989c10f4e32620e9e2717ca52c3ed7ae11048 Author: Juri Lelli Date: Fri Jun 27 13:51:16 2025 +0200 sched/deadline: Fix accounting after global limits change A global limits change (sched_rt_handler() logic) currently leaves stale and/or incorrect values in variables related to accounting (e.g. extra_bw). Properly clean up per runqueue variables before implementing the change and rebuild scheduling domains (so that accounting is also properly restored) after such a change is complete. Reported-by: Marcel Ziswiler Signed-off-by: Juri Lelli Signed-off-by: Peter Zijlstra (Intel) Tested-by: Marcel Ziswiler # nuc & rock5b Link: https://lore.kernel.org/r/20250627115118.438797-4-juri.lelli@redhat.com commit fcc9276c4d331cd1fe9319d793e80b02e09727f5 Author: Juri Lelli Date: Fri Jun 27 13:51:15 2025 +0200 sched/deadline: Reset extra_bw to max_bw when clearing root domains dl_clear_root_domain() doesn't take into account the fact that per-rq extra_bw variables retain values computed before root domain changes, resulting in broken accounting. Fix it by resetting extra_bw to max_bw before restoring back dl-servers contributions. Fixes: 2ff899e351643 ("sched/deadline: Rebuild root domain accounting after every update") Reported-by: Marcel Ziswiler Signed-off-by: Juri Lelli Signed-off-by: Peter Zijlstra (Intel) Tested-by: Marcel Ziswiler # nuc & rock5b Link: https://lore.kernel.org/r/20250627115118.438797-3-juri.lelli@redhat.com commit 9f239df55546ee1d28f0976130136ffd1cad0fd7 Author: Juri Lelli Date: Fri Jun 27 13:51:14 2025 +0200 sched/deadline: Initialize dl_servers after SMP dl-servers are currently initialized too early at boot when CPUs are not fully up (only boot CPU is). This results in miscalculation of per runqueue DEADLINE variables like extra_bw (which needs a stable CPU count). Move initialization of dl-servers later on after SMP has been initialized and CPUs are all online, so that CPU count is stable and DEADLINE variables can be computed correctly. Fixes: d741f297bceaf ("sched/fair: Fair server interface") Reported-by: Marcel Ziswiler Signed-off-by: Juri Lelli Signed-off-by: Peter Zijlstra (Intel) Acked-by: Waiman Long Tested-by: Marcel Ziswiler # nuc & rock5b Link: https://lore.kernel.org/r/20250627115118.438797-2-juri.lelli@redhat.com commit 2f368b5f93430e58f5006d6d5be4916753130cb0 Merge: 19272b37aa4f83 5699b7e21d2091 Author: Christian Brauner Date: Mon Jul 14 10:51:38 2025 +0200 Merge patch series "refactor the iomap writeback code v5" Christoph Hellwig says: This is an alternative approach to the writeback part of the "fuse: use iomap for buffered writes + writeback" series from Joanne. The big difference compared to Joanne's version is that I hope the split between the generic and ioend/bio based writeback code is a bit cleaner here. We have two methods that define the split between the generic writeback code, and the implemementation of it, and all knowledge of ioends and bios now sits below that layer. This version passes testing on xfs, and gets as far as mainline for gfs2 (crashes in generic/361). * patches from https://lore.kernel.org/20250710133343.399917-1-hch@lst.de: iomap: build the writeback code without CONFIG_BLOCK iomap: add read_folio_range() handler for buffered writes iomap: improve argument passing to iomap_read_folio_sync iomap: replace iomap_folio_ops with iomap_write_ops iomap: export iomap_writeback_folio iomap: move folio_unlock out of iomap_writeback_folio iomap: rename iomap_writepage_map to iomap_writeback_folio iomap: move all ioend handling to ioend.c iomap: add public helpers for uptodate state manipulation iomap: hide ioends from the generic writeback code iomap: refactor the writeback interface iomap: cleanup the pending writeback tracking in iomap_writepage_map_blocks iomap: pass more arguments using the iomap writeback context iomap: header diet Link: https://lore.kernel.org/20250710133343.399917-1-hch@lst.de Signed-off-by: Christian Brauner commit 5699b7e21d20912952cdb93c486ef8ed1257c47c Author: Christoph Hellwig Date: Thu Jul 10 15:33:38 2025 +0200 iomap: build the writeback code without CONFIG_BLOCK Allow fuse to use the iomap writeback code even when CONFIG_BLOCK is not enabled. Do this with an ifdef instead of a separate file to keep the iomap_folio_state local to buffered-io.c. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-15-hch@lst.de Reviewed-by: Darrick J. Wong Reviewed-by: Joanne Koong Signed-off-by: Christian Brauner commit c5690dd0197809bc5305f474a71b2e71e7eac0ff Author: Christoph Hellwig Date: Thu Jul 10 15:33:37 2025 +0200 iomap: add read_folio_range() handler for buffered writes Add a read_folio_range() handler for buffered writes that filesystems may pass in if they wish to provide a custom handler for synchronously reading in the contents of a folio. Signed-off-by: Joanne Koong [hch: renamed to read_folio_range, pass less arguments] Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-14-hch@lst.de Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit e6caf01d3f57687777d0e15400ffdd3917ce7f72 Author: Christoph Hellwig Date: Thu Jul 10 15:33:36 2025 +0200 iomap: improve argument passing to iomap_read_folio_sync Pass the iomap_iter and derive the map inside iomap_read_folio_sync instead of in the caller, and use the more descriptive srcmap name for the source iomap. Stop passing the offset into folio argument as it can be derived from the folio and the file offset. Rename the variables for the offset into the file and the length to be more descriptive and match the rest of the code. Rename the function itself to iomap_read_folio_range to make the use more clear. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-13-hch@lst.de Reviewed-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 2a5574fc57d13031f869c409181bdeadd75770e1 Author: Christoph Hellwig Date: Thu Jul 10 15:33:35 2025 +0200 iomap: replace iomap_folio_ops with iomap_write_ops The iomap_folio_ops are only used for buffered writes, including the zero and unshare variants. Rename them to iomap_write_ops to better describe the usage, and pass them through the call chain like the other operation specific methods instead of through the iomap. xfs_iomap_valid grows a IOMAP_HOLE check to keep the existing behavior that never attached the folio_ops to a iomap representing a hole. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-12-hch@lst.de Acked-by: Damien Le Moal Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 8b217cf779cba2b10112f6845dcbbb7e6f4b3d75 Author: Christoph Hellwig Date: Thu Jul 10 15:33:34 2025 +0200 iomap: export iomap_writeback_folio Allow fuse to use iomap_writeback_folio for folio laundering. Note that the caller needs to manually submit the pending writeback context. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-11-hch@lst.de Reviewed-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit f8b6a94a4ccafa95433798ad486c548c22624028 Author: Joanne Koong Date: Thu Jul 10 15:33:33 2025 +0200 iomap: move folio_unlock out of iomap_writeback_folio Move unlocking the folio out of iomap_writeback_folio into the caller. This means the end writeback machinery is now run with the folio locked when no writeback happened, or writeback completed extremely fast. Note that having the folio locked over the call to folio_end_writeback in iomap_writeback_folio means that the dropbehind handling there will never run because the trylock fails. The only way this can happen is if the writepage either never wrote back any dirty data at all, in which case the dropbehind handling isn't needed, or if all writeback finished instantly, which is rather unlikely. Even in the latter case the dropbehind handling is an optional optimization so skipping it will not cause correctness issues. This prepares for exporting iomap_writeback_folio for use in folio laundering. Signed-off-by: Joanne Koong [hch: split from a larger patch] Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-10-hch@lst.de Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 58f0d5a30427738118c19e195e9b8897e52afddb Author: Christoph Hellwig Date: Thu Jul 10 15:33:32 2025 +0200 iomap: rename iomap_writepage_map to iomap_writeback_folio ->writepage is gone, and our naming wasn't always that great to start with. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-9-hch@lst.de Reviewed-by: Brian Foster Reviewed-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 8f02cecd80b993041406f017e0c9a2a041bbc884 Author: Christoph Hellwig Date: Thu Jul 10 15:33:31 2025 +0200 iomap: move all ioend handling to ioend.c Now that the writeback code has the proper abstractions, all the ioend code can be self-contained in ioend.c. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-8-hch@lst.de Reviewed-by: Brian Foster Reviewed-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 9caf1ea80cedf7d35d9371c44fbe5f84b0da667a Author: Joanne Koong Date: Thu Jul 10 15:33:30 2025 +0200 iomap: add public helpers for uptodate state manipulation Add a new iomap_start_folio_write helper to abstract away the write_bytes_pending handling, and export it and the existing iomap_finish_folio_write for non-iomap writeback in fuse. Signed-off-by: Joanne Koong [hch: split from a larger patch] Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-7-hch@lst.de Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit f4fa7981fa26c664cc540cbce9bcb7ffe02a8912 Author: Christoph Hellwig Date: Thu Jul 10 15:33:29 2025 +0200 iomap: hide ioends from the generic writeback code Replace the ioend pointer in iomap_writeback_ctx with a void *wb_ctx one to facilitate non-block, non-ioend writeback for use. Rename the submit_ioend method to writeback_submit and make it mandatory so that the generic writeback code stops seeing ioends and bios. Co-developed-by: Joanne Koong Signed-off-by: Joanne Koong Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-6-hch@lst.de Acked-by: Damien Le Moal Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit fb7399cf2d0b33825b8039f95c45395c7deba25c Author: Christoph Hellwig Date: Thu Jul 10 15:33:28 2025 +0200 iomap: refactor the writeback interface Replace ->map_blocks with a new ->writeback_range, which differs in the following ways: - it must also queue up the I/O for writeback, that is called into the slightly refactored and extended in scope iomap_add_to_ioend for each region - can handle only a part of the requested region, that is the retry loop for partial mappings moves to the caller - handles cleanup on failures as well, and thus also replaces the discard_folio method only implemented by XFS. This will allow to use the iomap writeback code also for file systems that are not block based like fuse. Co-developed-by: Joanne Koong Signed-off-by: Joanne Koong Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-5-hch@lst.de Acked-by: Damien Le Moal # zonefs Reviewed-by: Brian Foster Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 40368a6acb95635824f6a45ec1de6233977309f3 Author: Joanne Koong Date: Thu Jul 10 15:33:27 2025 +0200 iomap: cleanup the pending writeback tracking in iomap_writepage_map_blocks We don't care about the count of outstanding ioends, just if there is one. Replace the count variable passed to iomap_writepage_map_blocks with a boolean to make that more clear. Signed-off-by: Joanne Koong [hch: rename the variable, update the commit message] Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-4-hch@lst.de Reviewed-by: Brian Foster Reviewed-by: Johannes Thumshirn Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 67fd9615a782b11cd0c62823d722a815c9e1eb75 Author: Christoph Hellwig Date: Thu Jul 10 15:33:26 2025 +0200 iomap: pass more arguments using the iomap writeback context Add inode and wpc fields to pass the inode and writeback context that are needed in the entire writeback call chain, and let the callers initialize all fields in the writeback context before calling iomap_writepages to simplify the argument passing. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-3-hch@lst.de Reviewed-by: Brian Foster Reviewed-by: Joanne Koong Reviewed-by: Johannes Thumshirn Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 8cd0a39cab5644539956a44af5f768bf7e45b55a Author: Christoph Hellwig Date: Thu Jul 10 15:33:25 2025 +0200 iomap: header diet Drop various unused #include statements. Signed-off-by: Christoph Hellwig Link: https://lore.kernel.org/20250710133343.399917-2-hch@lst.de Reviewed-by: Joanne Koong Reviewed-by: Darrick J. Wong Signed-off-by: Christian Brauner commit 1f531e35c146cca22dc6f4a1bc657098f146f358 Author: Al Viro Date: Sat Jul 12 06:41:57 2025 +0100 don't bother with path_get()/path_put() in unix_open_file() Once unix_sock ->path is set, we are guaranteed that its ->path will remain unchanged (and pinned) until the socket is closed. OTOH, dentry_open() does not modify the path passed to it. IOW, there's no need to copy unix_sk(sk)->path in unix_open_file() - we can just pass it to dentry_open() and be done with that. Signed-off-by: Al Viro Link: https://lore.kernel.org/20250712054157.GZ1880847@ZenIV Reviewed-by: Kuniyuki Iwashima Signed-off-by: Christian Brauner commit 532c8b51b3a8676cbf533a291f8156774f30ea87 Author: Al Viro Date: Sat Jul 12 06:09:16 2025 +0100 xen: fix UAF in dmabuf_exp_from_pages() [dma_buf_fd() fixes; no preferences regarding the tree it goes through - up to xen folks] As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF. dma_buf_fd() is a combination of reserving a descriptor and fd_install(). gntdev dmabuf_exp_from_pages() calls it and then proceeds to access the objects destroyed on close - starting with gntdev_dmabuf itself. Fix that by doing reserving descriptor before anything else and do fd_install() only when everything had been set up. Fixes: a240d6e42e28 ("xen/gntdev: Implement dma-buf export functionality") Signed-off-by: Al Viro Acked-by: Juergen Gross Message-ID: <20250712050916.GY1880847@ZenIV> Signed-off-by: Juergen Gross commit 0df11950099887520cc8bf22a790a5535be30e8d Author: Dr. David Alan Gilbert Date: Sun Jul 13 14:26:25 2025 +0100 xen: Remove some deadcode (x) Remove three uncalled functions: xenbus_mkdir() was added in 2007 by commit 4bac07c993d0 ("xen: add the Xenbus sysfs and virtual device hotplug driver") but has remained unused. xen_get_runstate_snapshot() last use was removed in 2016 by commit 6ba286ad8457 ("xen: support runqueue steal time on xen") which replaces the use by the _cpu version. xen_resume_notifier_unregister() last use was removed in 2017 by commit 1914f0cd203c ("xen/acpi: upload PM state from init-domain to Xen") Remove them. Signed-off-by: "Dr. David Alan Gilbert" Reviewed-by: Juergen Gross Signed-off-by: Juergen Gross Message-ID: <20250713132625.164728-1-linux@treblig.org> commit c79626899ddb613a1119dd2e8176bdcb26cd9100 Author: Ryan Chung Date: Tue Jul 8 09:14:40 2025 +0900 xen-pciback: Replace scnprintf() with sysfs_emit_at() This is the third revision (v3) of this patch series. No changes since v2—only adding Reviewed-by lines. Reviewed-by: Juergen Gross Signed-off-by: Ryan Chung Signed-off-by: Juergen Gross Message-ID: <20250708001444.86155-1-seokwoo.chung130@gmail.com> commit b7efeb081ed3b80c6af38c285f5c3b5d15c560e9 Author: Peng Jiang Date: Fri Jun 20 08:41:04 2025 +0800 xen/xenbus: fix W=1 build warning in xenbus_va_dev_error function This patch fixes a W=1 format-string warning reported by GCC 12.3.0 by annotating xenbus_switch_fatal() and xenbus_va_dev_error() with the __printf attribute. The attribute enables compile-time validation of printf-style format strings in these functions. The original warning trace: drivers/xen/xenbus/xenbus_client.c:304:9: warning: function 'xenbus_va_dev_error' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] Signed-off-by: Peng Jiang Reviewed-by: Juergen Gross Message-ID: <20250620084104786r5xoR16_AmYZMJLnno3_Q@zte.com.cn> Signed-off-by: Juergen Gross commit 148fbaf571697bb1ff2d50ca232a9ac190519fd1 Author: Andy Shevchenko Date: Fri Jul 11 14:36:50 2025 +0300 ata: pata_rdc: Use registered definition for the RDC vendor Convert to PCI_VDEVICE() and use registered definition for RDC vendor from pci_ids.h. Signed-off-by: Andy Shevchenko Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20250711113650.1475307-1-andriy.shevchenko@linux.intel.com [cassel: add ata: prefix to subject, fix typo in Damien's Rb tag] Signed-off-by: Niklas Cassel commit c3ff7f06c7876bc292cac1c7d4df3d0bfd74f3b7 Author: I Viswanath Date: Wed Jul 9 20:37:18 2025 +0530 i2c: Clarify behavior of I2C_M_RD flag Update the description of I2C_M_RD to clarify that not setting it signals a write transaction Signed-off-by: I Viswanath Signed-off-by: Wolfram Sang commit 80395c3b47577c12121d4e408e7b9478f7f88d02 Author: Brian Masney Date: Thu Jul 3 19:22:34 2025 -0400 clk: sunxi-ng: ccu_nm: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. I manually fixed up one minor formatting issue that occurred after applying the semantic patch: req->rate = ccu_nm_find_best(&nm->common, req->best_parent_rate, req->rate, &_nm); I manually changed it to: req->rate = ccu_nm_find_best(&nm->common, req->best_parent_rate, req->rate, &_nm); Signed-off-by: Brian Masney Reviewed-by: Maxime Ripard Link: https://patch.msgid.link/20250703-clk-cocci-drop-round-rate-v1-10-3a8da898367e@redhat.com Signed-off-by: Chen-Yu Tsai commit 8bc614c6ac3c97cef385aebc6520ddcfa0fca8f7 Author: Brian Masney Date: Thu Jul 3 19:22:33 2025 -0400 clk: sunxi-ng: ccu_nkmp: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Maxime Ripard Link: https://patch.msgid.link/20250703-clk-cocci-drop-round-rate-v1-9-3a8da898367e@redhat.com Signed-off-by: Chen-Yu Tsai commit 2b0d4f1b3f8524b413208d47099c445eaf7c18f5 Author: Brian Masney Date: Thu Jul 3 19:22:32 2025 -0400 clk: sunxi-ng: ccu_nk: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Maxime Ripard Link: https://patch.msgid.link/20250703-clk-cocci-drop-round-rate-v1-8-3a8da898367e@redhat.com Signed-off-by: Chen-Yu Tsai commit ee9c15ca0f628435334afef74d2ff03112d80bf0 Author: Brian Masney Date: Thu Jul 3 19:22:31 2025 -0400 clk: sunxi-ng: ccu_gate: convert from round_rate() to determine_rate() The round_rate() clk ops is deprecated, so migrate this driver from round_rate() to determine_rate() using the Coccinelle semantic patch on the cover letter of this series. Signed-off-by: Brian Masney Reviewed-by: Maxime Ripard Link: https://patch.msgid.link/20250703-clk-cocci-drop-round-rate-v1-7-3a8da898367e@redhat.com Signed-off-by: Chen-Yu Tsai commit ea879ce83d360aa13acd54cf6af913885b69ed44 Author: Paul Kocialkowski Date: Fri Jul 4 17:40:08 2025 +0200 clk: sunxi-ng: v3s: Assign the de and tcon clocks to the video pll It appears (based on experimentation) that both the de and tcon clocks need to have the same parent for the two units to work together. Assign them both to the video pll by manually clearing the parent selection bits (effectively setting index 0) and marking the clocks with the CLK_SET_RATE_NO_REPARENT flag, which ensures that they will never use a different parent. The video pll is also a possible parent for the camera subsystem, but it can use the dedicated isp pll if needed so there should be no negative side-effect due to this change. Note that ccu_mux_helper_set_parent cannot be used at this stage as it requires the clock driver to be initialized and this configuration is best done before the clock driver is available to consumers. Signed-off-by: Paul Kocialkowski Link: https://patch.msgid.link/20250704154008.3463257-2-paulk@sys-base.io Signed-off-by: Chen-Yu Tsai commit e8ab346f9907a1a3aa2f0e5decf849925c06ae2e Author: Paul Kocialkowski Date: Fri Jul 4 17:40:07 2025 +0200 clk: sunxi-ng: v3s: Fix de clock definition The de clock is marked with CLK_SET_RATE_PARENT, which is really not necessary (as confirmed from experimentation) and significantly restricts flexibility for other clocks using the same parent. In addition the source selection (parent) field is marked as using 2 bits, when it the documentation reports that it uses 3. Fix both issues in the de clock definition. Fixes: d0f11d14b0bc ("clk: sunxi-ng: add support for V3s CCU") Signed-off-by: Paul Kocialkowski Link: https://patch.msgid.link/20250704154008.3463257-1-paulk@sys-base.io Signed-off-by: Chen-Yu Tsai commit 5137d6c8906b55b3c7b5d1aa5a549753ec8520f5 Author: Zhang Yi Date: Mon Jul 7 22:08:13 2025 +0800 ext4: fix insufficient credits calculation in ext4_meta_trans_blocks() The calculation of journal credits in ext4_meta_trans_blocks() should include pextents, as each extent separately may be allocated from a different group and thus need to update different bitmap and group descriptor block. Fixes: 0e32d8617012 ("ext4: correct the journal credits calculations of allocating blocks") Reported-by: Jan Kara Closes: https://lore.kernel.org/linux-ext4/nhxfuu53wyacsrq7xqgxvgzcggyscu2tbabginahcygvmc45hy@t4fvmyeky33e/ Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Link: https://patch.msgid.link/20250707140814.542883-11-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 57661f28756c59510e31543520b5b8f5e591f384 Author: Zhang Yi Date: Mon Jul 7 22:08:12 2025 +0800 ext4: replace ext4_writepage_trans_blocks() After ext4 supports large folios, the semantics of reserving credits in pages is no longer applicable. In most scenarios, reserving credits in extents is sufficient. Therefore, introduce ext4_chunk_trans_extent() to replace ext4_writepage_trans_blocks(). move_extent_per_page() is the only remaining location where we are still processing extents in pages. Suggested-by: Jan Kara Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250707140814.542883-10-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit bbbf150f3f85619569ac19dc6458cca7c492e715 Author: Zhang Yi Date: Mon Jul 7 22:08:11 2025 +0800 ext4: reserved credits for one extent during the folio writeback After ext4 supports large folios, reserving journal credits for one maximum-ordered folio based on the worst case cenario during the writeback process can easily exceed the maximum transaction credits. Additionally, reserving journal credits for one page is also no longer appropriate. Currently, the folio writeback process can either extend the journal credits or initiate a new transaction if the currently reserved journal credits are insufficient. Therefore, it can be modified to reserve credits for only one extent at the outset. In most cases involving continuous mapping, these credits are generally adequate, and we may only need to perform some basic credit expansion. However, in extreme cases where the block size and folio size differ significantly, or when the folios are sufficiently discontinuous, it may be necessary to restart a new transaction and resubmit the folios. Suggested-by: Jan Kara Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250707140814.542883-9-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 95ad8ee45cdbc321c135a2db895d48b374ef0f87 Author: Zhang Yi Date: Mon Jul 7 22:08:10 2025 +0800 ext4: correct the reserved credits for extent conversion Now, we reserve journal credits for converting extents in only one page to written state when the I/O operation is complete. This is insufficient when large folio is enabled. Fix this by reserving credits for converting up to one extent per block in the largest 2MB folio, this calculation should only involve extents index and leaf blocks, so it should not estimate too many credits. Fixes: 7ac67301e82f ("ext4: enable large folio for regular file") Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Link: https://patch.msgid.link/20250707140814.542883-8-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 6b132759b0fe78e518abafb62190c294100db6d6 Author: Zhang Yi Date: Mon Jul 7 22:08:09 2025 +0800 ext4: enhance tracepoints during the folios writeback After mpage_map_and_submit_extent() supports restarting handle if credits are insufficient during allocating blocks, it is more likely to exit the current mapping iteration and continue to process the current processing partially mapped folio again. The existing tracepoints are not sufficient to track this situation, so enhance the tracepoints to track the writeback position and the return value before and after submitting the folios. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250707140814.542883-7-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit e2c4c49dee64ca2f42ad2958cbe1805de96b6732 Author: Zhang Yi Date: Mon Jul 7 22:08:08 2025 +0800 ext4: restart handle if credits are insufficient during allocating blocks After large folios are supported on ext4, writing back a sufficiently large and discontinuous folio may consume a significant number of journal credits, placing considerable strain on the journal. For example, in a 20GB filesystem with 1K block size and 1MB journal size, writing back a 2MB folio could require thousands of credits in the worst-case scenario (when each block is discontinuous and distributed across different block groups), potentially exceeding the journal size. This issue can also occur in ext4_write_begin() and ext4_page_mkwrite() when delalloc is not enabled. Fix this by ensuring that there are sufficient journal credits before allocating an extent in mpage_map_one_extent() and ext4_block_write_begin(). If there are not enough credits, return -EAGAIN, exit the current mapping loop, restart a new handle and a new transaction, and allocating blocks on this folio again in the next iteration. Suggested-by: Jan Kara Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250707140814.542883-6-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 2bddafea3d0d85ee9ac3cf5ba9a4b2f2d2f50257 Author: Zhang Yi Date: Mon Jul 7 22:08:07 2025 +0800 ext4: refactor the block allocation process of ext4_page_mkwrite() The block allocation process and error handling in ext4_page_mkwrite() is complex now. Refactor it by introducing a new helper function, ext4_block_page_mkwrite(). It will call ext4_block_write_begin() to allocate blocks instead of directly calling block_page_mkwrite(). Preparing to implement retry logic in a subsequent patch to address situations where the reserved journal credits are insufficient. Additionally, this modification will help prevent potential deadlocks that may occur when waiting for folio writeback while holding the transaction handle. Suggested-by: Jan Kara Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250707140814.542883-5-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit ded2d726a3041fce8afd88005cbfe15cd4737702 Author: Zhang Yi Date: Mon Jul 7 22:08:06 2025 +0800 ext4: fix stale data if it bail out of the extents mapping loop During the process of writing back folios, if mpage_map_and_submit_extent() exits the extent mapping loop due to an ENOSPC or ENOMEM error, it may result in stale data or filesystem inconsistency in environments where the block size is smaller than the folio size. When mapping a discontinuous folio in mpage_map_and_submit_extent(), some buffers may have already be mapped. If we exit the mapping loop prematurely, the folio data within the mapped range will not be written back, and the file's disk size will not be updated. Once the transaction that includes this range of extents is committed, this can lead to stale data or filesystem inconsistency. Fix this by submitting the current processing partially mapped folio. Suggested-by: Jan Kara Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250707140814.542883-4-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit f922c8c2461b022a2efd9914484901fb358a5b2a Author: Zhang Yi Date: Mon Jul 7 22:08:05 2025 +0800 ext4: move the calculation of wbc->nr_to_write to mpage_folio_done() mpage_folio_done() should be a more appropriate place than mpage_submit_folio() for updating the wbc->nr_to_write after we have submitted a fully mapped folio. Preparing to make mpage_submit_folio() allows to submit partially mapped folio that is still under processing. Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Reviewed-by: Baokun Li Link: https://patch.msgid.link/20250707140814.542883-3-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 1bfe6354e0975fe89c3d25e81b6546d205556a4b Author: Zhang Yi Date: Mon Jul 7 22:08:04 2025 +0800 ext4: process folios writeback in bytes Since ext4 supports large folios, processing writebacks in pages is no longer appropriate, it can be modified to process writebacks in bytes. Suggested-by: Jan Kara Signed-off-by: Zhang Yi Reviewed-by: Jan Kara Link: https://patch.msgid.link/20250707140814.542883-2-yi.zhang@huaweicloud.com Signed-off-by: Theodore Ts'o commit 26dda57695090e05c1a99c3e8f802f862d1ac474 Author: Masami Hiramatsu (Google) Date: Thu Jul 10 11:24:17 2025 +0900 tools/bootconfig: Cleanup bootconfig footer size calculations There are many same pattern of 8 + BOOTCONFIG_MAGIC_LEN for calculating the size of bootconfig footer. Use BOOTCONFIG_FOOTER_SIZE macro to clean up those magic numbers. Link: https://lore.kernel.org/all/175211425693.2591046.16029516706923643510.stgit@mhiramat.tok.corp.google.com/ Signed-off-by: Masami Hiramatsu (Google) commit a141656ac81517207b1ed0dafdbada72d70d2900 Author: Masami Hiramatsu (Google) Date: Thu Jul 10 11:24:09 2025 +0900 tools/bootconfig: Replace some echo with printf for more portability Since echo is not portable, use printf instead. This fixes a wrong test result formatting in some environment. (showing "\t\t[OK]") Also this uses printf command for generating test data instead of echo. Link: https://lore.kernel.org/all/175211424942.2591046.5439447789303314213.stgit@mhiramat.tok.corp.google.com/ Signed-off-by: Masami Hiramatsu (Google) commit bfed3dd2a1974896cb75556ac3af71c1c391cec4 Author: Masami Hiramatsu (Google) Date: Thu Jul 10 11:24:02 2025 +0900 tools/bootconfig: Improve portability Since 'stat' command and 'truncate' command are GNU extension, use 'wc' and 'dd' commands instead. Link: https://lore.kernel.org/all/175211424184.2591046.3523297993175066026.stgit@mhiramat.tok.corp.google.com/ Signed-off-by: Masami Hiramatsu (Google) commit 63989c7798be94f667880dbff18c22b5e769bb07 Author: Bhaskar Chowdhury Date: Wed Jul 9 08:27:59 2025 +0530 tools: bootconfig: Regex enclosed with quotes to make syntax highlight proper As suggested, changed the square brackets escaping to quote the whole Regex class. Link: https://lore.kernel.org/all/20250709030141.27483-1-unixbhaskar@gmail.com/ Signed-off-by: Bhaskar Chowdhury Signed-off-by: Masami Hiramatsu (Google) commit fed48693bdfeca666f7536ba88a05e9a4e5523b6 Author: SeongJae Park Date: Sun Jul 6 12:32:07 2025 -0700 mm/damon/reclaim: use parameter context correctly damon_reclaim_apply_parameters() allocates a new DAMON context, stages user-specified DAMON parameters on it, and commits to running DAMON context at once, using damon_commit_ctx(). The code is mistakenly over-writing the monitoring attributes and the reclaim scheme on the running context. It is not causing a real problem for monitoring attributes, but the scheme overwriting can remove scheme's internal status such as charged quota. Fix the wrong use of the parameter context. Link: https://lkml.kernel.org/r/20250706193207.39810-7-sj@kernel.org Fixes: 11ddcfc257a3 ("mm/damon/reclaim: use damon_commit_ctx()") Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit b91b82e241822ef1f287c3a8214f7bdeef4e85b2 Author: SeongJae Park Date: Sun Jul 6 12:32:06 2025 -0700 mm/damon/lru_sort: reset enabled when DAMON start failed When the startup fails, 'enabled' parameter is not reset. As a result, users show the parameter 'Y' while it is not really working. Fix it by resetting 'enabled' to 'false' when the work is failed. Link: https://lkml.kernel.org/r/20250706193207.39810-6-sj@kernel.org Fixes: 7a034fbba336 ("mm/damon/lru_sort: enable and disable synchronously") Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 737e40d5eb2f6507113285cb52c50a4a6b01f44a Author: SeongJae Park Date: Sun Jul 6 12:32:05 2025 -0700 mm/damon/reclaim: reset enabled when DAMON start failed When the startup fails, 'enabled' parameter is not reset. As a result, users show the parameter 'Y' while it is not really working. Fix it by resetting 'enabled' to 'false' when the work is failed. Link: https://lkml.kernel.org/r/20250706193207.39810-5-sj@kernel.org Fixes: 04e98764befa ("mm/damon/reclaim: enable and disable synchronously") Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 964314344eab7bc43e38a32be281c5ea0609773b Author: SeongJae Park Date: Sun Jul 6 12:32:04 2025 -0700 samples/damon/mtier: support boot time enable setup If 'enable' parameter of the 'mtier' DAMON sample module is set at boot time via the kernel command line, memory allocation is tried before the slab is initialized. As a result kernel NULL pointer dereference BUG can happen. Fix it by checking the initialization status. Link: https://lkml.kernel.org/r/20250706193207.39810-4-sj@kernel.org Fixes: 82a08bde3cf7 ("samples/damon: implement a DAMON module for memory tiering") Signed-off-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit 2780505ec2b42c07853b34640bc63279ac2bb53b Author: SeongJae Park Date: Sun Jul 6 12:32:03 2025 -0700 samples/damon/prcl: fix boot time enable crash If 'enable' parameter of the 'prcl' DAMON sample module is set at boot time via the kernel command line, memory allocation is tried before the slab is initialized. As a result kernel NULL pointer dereference BUG can happen. Fix it by checking the initialization status. Link: https://lkml.kernel.org/r/20250706193207.39810-3-sj@kernel.org Fixes: 2aca254620a8 ("samples/damon: introduce a skeleton of a smaple DAMON module for proactive reclamation") Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 0ed1165c37277822b519f519d0982d36efc30006 Author: SeongJae Park Date: Sun Jul 6 12:32:02 2025 -0700 samples/damon/wsse: fix boot time enable handling Patch series "mm/damon: fix misc bugs in DAMON modules". From manual code review, I found below bugs in DAMON modules. DAMON sample modules crash if those are enabled at boot time, via kernel command line. A similar issue was found and fixed on DAMON non-sample modules in the past, but we didn't check that for sample modules. DAMON non-sample modules are not setting 'enabled' parameters accordingly when real enabling is failed. Honggyu found and fixed[1] this type of bugs in DAMON sample modules, and my inspection was motivated by the great work. Kudos to Honggyu. Finally, DAMON_RECLIAM is mistakenly losing scheme internal status due to misuse of damon_commit_ctx(). DAMON_LRU_SORT has a similar misuse, but fortunately it is not causing real status loss. Fix the bugs. Since these are similar patterns of bugs that were found in the past, it would be better to add tests or refactor the code, in future. This patch (of 6): If 'enable' parameter of the 'wsse' DAMON sample module is set at boot time via the kernel command line, memory allocation is tried before the slab is initialized. As a result kernel NULL pointer dereference BUG can happen. Fix it by checking the initialization status. Link: https://lkml.kernel.org/r/20250706193207.39810-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250706193207.39810-2-sj@kernel.org Link: https://lore.kernel.org/20250702000205.1921-1-honggyu.kim@sk.com [1] Fixes: b757c6cfc696 ("samples/damon/wsse: start and stop DAMON as the user requests") Signed-off-by: SeongJae Park Cc: Signed-off-by: Andrew Morton commit a86d695193bfab3f130f9275c275e4e143dcd2e3 Author: SeongJae Park Date: Fri Jul 4 15:14:08 2025 -0700 mm/damon: add trace event for effective size quota Aim-oriented DAMOS quota auto-tuning is an important and recommended feature for DAMOS users. Add a trace event for the observability of the tuned quota and tuning itself. [sj@kernel.org: initialize sidx in damos_trace_esz()] Link: https://lkml.kernel.org/r/20250705172003.52324-1-sj@kernel.org [sj@kernel.org: make damos_esz unconditional trace event] Link: https://lkml.kernel.org/r/20250709182843.35812-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250704221408.38510-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: kernel test robot Signed-off-by: Andrew Morton commit 214db70287277096e77d804284066ce1c07297dd Author: SeongJae Park Date: Fri Jul 4 15:14:07 2025 -0700 mm/damon: add trace event for auto-tuned monitoring intervals Patch series "mm/damon: add trace events for auto-tuned monitoring intervals and DAMOS quota". The aim-oriented auto-tuning features for monitoring intervals and DAMOS quota are important and recommended. Add tracepoints for observabilities of those tuned values and the tuning itself. This patch (of 2): Aim-oriented monitoring intervals auto-tuning is an important and recommended feature for DAMON users. Add a trace event for the observability of the tuned intervals and tuning itself. Link: https://lkml.kernel.org/r/20250704221408.38510-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250704221408.38510-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: kernel test robot Signed-off-by: Andrew Morton commit 7f810385fde490a831fdba36978a52a927b23922 Author: Dev Jain Date: Fri Jul 4 09:34:17 2025 +0530 khugepaged: reduce race probability between migration and khugepaged Suppose a folio is under migration, and khugepaged is also trying to collapse it. collapse_pte_mapped_thp() will retrieve the folio from the page cache via filemap_lock_folio(), thus taking a reference on the folio and sleeping on the folio lock, since the lock is held by the migration path. Migration will then fail in __folio_migrate_mapping -> folio_ref_freeze. Reduce the probability of such a race happening (leading to migration failure) by bailing out if we detect a PMD is marked with a migration entry. This fixes the migration-shared-anon-thp testcase failure on Apple M3. Note that, this is not a "fix" since it only reduces the chance of interference of khugepaged with migration, wherein both the kernel functionalities are deemed "best-effort". Link: https://lkml.kernel.org/r/20250704040417.63826-1-dev.jain@arm.com Signed-off-by: Dev Jain Acked-by: David Hildenbrand Acked-by: Oscar Salvador Reviewed-by: Anshuman Khandual Reviewed-by: Zi Yan Reviewed-by: Baolin Wang Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit ee58e38489772f356c1ac79e0724183497e43249 Author: Raghavendra K T Date: Wed Jul 2 06:43:19 2025 +0000 lib/test_vmalloc.c: introduce xfail for failing tests The test align_shift_alloc_test is expected to fail. Reporting the test as fail confuses to be a genuine failure. Introduce widely used xfail sematics to address the issue. Note: a warn_alloc dump similar to below is still expected: Call Trace: dump_stack_lvl+0x64/0x80 warn_alloc+0x137/0x1b0 ? __get_vm_area_node+0x134/0x140 Snippet of dmesg after change: Summary: random_size_align_alloc_test passed: 1 failed: 0 xfailed: 0 .. Summary: align_shift_alloc_test passed: 0 failed: 0 xfailed: 1 .. Summary: pcpu_alloc_test passed: 1 failed: 0 xfailed: 0 .. Link: https://lkml.kernel.org/r/20250702064319.885-1-raghavendra.kt@amd.com Signed-off-by: Raghavendra K T Reviewed-by: "Uladzislau Rezki (Sony)" Cc: Dev Jain Signed-off-by: Andrew Morton commit 9640b17a89a86f40df47bfc831a8afeff0c7eabc Author: David Hildenbrand Date: Fri Jul 4 12:25:23 2025 +0200 mm/balloon_compaction: provide single balloon_page_insert() and balloon_mapping_gfp_mask() Let's just special-case based on IS_ENABLED(CONFIG_BALLOON_COMPACTION) like we did for balloon_page_finalize(). Link: https://lkml.kernel.org/r/20250704102524.326966-30-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: Harry Yoo Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit f5e43012b86aa6a0b0ad5881cb68bfb872826c22 Author: David Hildenbrand Date: Fri Jul 4 12:25:22 2025 +0200 mm/balloon_compaction: "movable_ops" doc updates Let's bring the docs up-to-date. Setting PG_movable_ops + page->private very likely still requires to be performed under documented locks: it's complicated. We will rework this in the future, as we will try avoiding using the page lock. Link: https://lkml.kernel.org/r/20250704102524.326966-29-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: Harry Yoo Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit 677e0e35d6cdd972cc6e5de65869fe698856267b Author: David Hildenbrand Date: Fri Jul 4 12:25:21 2025 +0200 docs/mm: convert from "Non-LRU page migration" to "movable_ops page migration" Let's bring the docs up-to-date. Link: https://lkml.kernel.org/r/20250704102524.326966-28-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit df25569d401e36327b339c3f5b3265d74eae90f2 Author: David Hildenbrand Date: Fri Jul 4 12:25:20 2025 +0200 mm: rename PAGE_MAPPING_* to FOLIO_MAPPING_* Now that the mapping flags are only used for folios, let's rename the defines. Link: https://lkml.kernel.org/r/20250704102524.326966-27-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 78cb1a13c42a6d843e21389f74d1edb90ed07288 Author: David Hildenbrand Date: Fri Jul 4 12:25:19 2025 +0200 mm: simplify folio_expected_ref_count() Now that PAGE_MAPPING_MOVABLE is gone, we can simplify and rely on the folio_test_anon() test only. ... but staring at the users, this function should never even have been called on movable_ops pages. E.g., * __buffer_migrate_folio() does not make sense for them * folio_migrate_mapping() does not make sense for them * migrate_huge_page_move_mapping() does not make sense for them * __migrate_folio() does not make sense for them * ... and khugepaged should never stumble over them Let's simply refuse typed pages (which includes slab) except hugetlb, and WARN. Link: https://lkml.kernel.org/r/20250704102524.326966-26-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit beb2cdeed673150cdfad653dd2e7c9999c230f57 Author: David Hildenbrand Date: Fri Jul 4 12:25:18 2025 +0200 mm/page-flags: remove folio_mapping_flags() It's unused and the page counterpart is gone, so let's remove it. Link: https://lkml.kernel.org/r/20250704102524.326966-25-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 5799c0ed0aff65989b04ca3f517401e4ee94da10 Author: David Hildenbrand Date: Fri Jul 4 12:25:17 2025 +0200 mm/page-alloc: remove PageMappingFlags() As PageMappingFlags() now only indicates anon (incl. KSM) folios, we can now simply check for PageAnon() and remove PageMappingFlags(). ... and while at it, use the folio instead and operate on folio->mapping. Link: https://lkml.kernel.org/r/20250704102524.326966-24-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit bd56d30242039826160d95a65cb14c1cd65e6488 Author: David Hildenbrand Date: Fri Jul 4 12:25:16 2025 +0200 mm/page-flags: rename PAGE_MAPPING_MOVABLE to PAGE_MAPPING_ANON_KSM KSM is the only remaining user, let's rename the flag. While at it, adjust to remaining page -> folio in the doc. Link: https://lkml.kernel.org/r/20250704102524.326966-23-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 92f091769fde42509ca7685e67c9951f2350ceb7 Author: David Hildenbrand Date: Fri Jul 4 12:25:15 2025 +0200 mm: rename PG_isolated to PG_movable_ops_isolated Let's rename the flag to make it clearer where it applies (not folios ...). While at it, define the flag only with CONFIG_MIGRATION. Link: https://lkml.kernel.org/r/20250704102524.326966-22-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 3d388584d59985e95f5bfb9dbd9776fa1bb1ec8a Author: David Hildenbrand Date: Fri Jul 4 12:25:14 2025 +0200 mm: convert "movable" flag in page->mapping to a page flag Instead, let's use a page flag. As the page flag can result in false-positives, glue it to the page types for which we support/implement movable_ops page migration. We are reusing PG_uptodate, that is for example used to track file system state and does not apply to movable_ops pages. So warning in case it is set in page_has_movable_ops() on other page types could result in false-positive warnings. Likely we could set the bit using a non-atomic update: in contrast to page->mapping, we could have others trying to update the flags concurrently when trying to lock the folio. In isolate_movable_ops_page(), we already take care of that by checking if the page has movable_ops before locking it. Let's start with the atomic variant, we could later switch to the non-atomic variant once we are sure other cases are similarly fine. Once we perform the switch, we'll have to introduce __SETPAGEFLAG_NOOP(). [david@redhat.com: add missing `:' in kerneldoc] Link: https://lkml.kernel.org/r/d96e2916-2c43-462c-b6a1-2375ef397d8b@redhat.com Link: https://lkml.kernel.org/r/20250704102524.326966-21-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: Harry Yoo Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 84caf98838a3e5f4bdb344c13679e1067ffbf094 Author: David Hildenbrand Date: Fri Jul 4 12:25:13 2025 +0200 mm: stop storing migration_ops in page->mapping ... instead, look them up statically based on the page type. Maybe in the future we want a registration interface? At least for now, it can be easily handled using the two page types that actually support page migration. The remaining usage of page->mapping is to flag such pages as actually being movable (having movable_ops), which we will change next. Link: https://lkml.kernel.org/r/20250704102524.326966-20-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 457d7b3adb11576ce5f3ae0d9a4987ace213bed2 Author: David Hildenbrand Date: Fri Jul 4 12:25:12 2025 +0200 mm: remove __folio_test_movable() Convert to page_has_movable_ops(). While at it, cleanup relevant code a bit. The data_race() in migrate_folio_unmap() is questionable: we already hold a page reference, and concurrent modifications can no longer happen (iow: __ClearPageMovable() no longer exists). Drop it for now, we'll rework page_has_movable_ops() soon either way to no longer rely on page->mapping. Wherever we cast from folio to page now is a clear sign that this code has to be decoupled. Link: https://lkml.kernel.org/r/20250704102524.326966-19-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 9f56c08a89222ddee6d8d574d69cbd500405fb46 Author: David Hildenbrand Date: Fri Jul 4 12:25:11 2025 +0200 mm/page_isolation: drop __folio_test_movable() check for large folios Currently, we only support migration of individual movable_ops pages, so we can not run into that. Link: https://lkml.kernel.org/r/20250704102524.326966-18-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit d4fb4587bd73b6b773397f5fed52a5e4bd4dec8b Author: David Hildenbrand Date: Fri Jul 4 12:25:10 2025 +0200 mm: rename __PageMovable() to page_has_movable_ops() Let's make it clearer that we are talking about movable_ops pages. While at it, convert a VM_BUG_ON to a VM_WARN_ON_ONCE_PAGE. Link: https://lkml.kernel.org/r/20250704102524.326966-17-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 22d103aef090dc688a88881fb955376dec1228d5 Author: David Hildenbrand Date: Fri Jul 4 12:25:09 2025 +0200 mm/migration: remove PageMovable() Previously, if __ClearPageMovable() were invoked on a page, this would cause __PageMovable() to return false, but due to the continued existence of page movable ops, PageMovable() would have returned true. With __ClearPageMovable() gone, the two are exactly equivalent. So we can replace PageMovable() checks by __PageMovable(). In fact, __PageMovable() cannot change until a page is freed, so we can turn some PageMovable() into sanity checks for __PageMovable(). Link: https://lkml.kernel.org/r/20250704102524.326966-16-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 34727dee04994c8ceb1bb8a927af0a88e52e103c Author: David Hildenbrand Date: Fri Jul 4 12:25:08 2025 +0200 mm/migrate: remove __ClearPageMovable() Unused, let's remove it. The Chinese docs in Documentation/translations/zh_CN/mm/page_migration.rst still mention it, but that whole docs is destined to get outdated and updated by somebody that actually speaks that language. Link: https://lkml.kernel.org/r/20250704102524.326966-15-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Harry Yoo Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 3544c4faccb8f0867bc65f8007ee70bfb5054305 Author: David Hildenbrand Date: Fri Jul 4 12:25:07 2025 +0200 mm/balloon_compaction: stop using __ClearPageMovable() We can just look at the balloon device (stored in page->private), to see if the page is still part of the balloon. As isolated balloon pages cannot get released (they are taken off the balloon list while isolated), we don't have to worry about this case in the putback and migration callback. Add a WARN_ON_ONCE for now. Link: https://lkml.kernel.org/r/20250704102524.326966-14-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: Harry Yoo Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit a109262734c527296f0a945825f568c78dc804f2 Author: David Hildenbrand Date: Fri Jul 4 12:25:06 2025 +0200 mm/zsmalloc: stop using __ClearPageMovable() Instead, let's check in the callbacks if the page was already destroyed, which can be checked by looking at zpdesc->zspage (see reset_zpdesc()). If we detect that the page was destroyed: (1) Fail isolation, just like the migration core would (2) Fake migration success just like the migration core would In the putback case there is nothing to do, as we don't do anything just like the migration core would do. In the future, we should look into not letting these pages get destroyed while they are isolated -- and instead delaying that to the putback/migration call. Add a TODO for that. Link: https://lkml.kernel.org/r/20250704102524.326966-13-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Harry Yoo Reviewed-by: Lorenzo Stoakes Reviewed-by: Sergey Senozhatsky Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit be4a3e9c185264e9ad0fe02c1c5d81b8386bd50c Author: David Hildenbrand Date: Fri Jul 4 12:25:05 2025 +0200 mm/migrate: move movable_ops page handling out of move_to_new_folio() Let's move that handling directly into migrate_folio_move(), so we can simplify move_to_new_folio(). While at it, fixup the documentation a bit. Note that unmap_and_move_huge_page() does not care, because it only deals with actual folios. (we only support migration of individual movable_ops pages) Link: https://lkml.kernel.org/r/20250704102524.326966-12-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Harry Yoo Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 07e5355eeead3a715bb48ffe13499dd3d0178e52 Author: David Hildenbrand Date: Fri Jul 4 12:25:04 2025 +0200 mm/migrate: remove folio_test_movable() and folio_movable_ops() Folios will have nothing to do with movable_ops page migration. These functions are now unused, so let's remove them. Note that __folio_test_movable() and friends will be removed separately next, after more rework. Link: https://lkml.kernel.org/r/20250704102524.326966-11-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit b9ed00483d4cbacca04edb11984d8daf09e9ae22 Author: David Hildenbrand Date: Fri Jul 4 12:25:03 2025 +0200 mm/migrate: factor out movable_ops page handling into migrate_movable_ops_page() Let's factor it out, simplifying the calling code. Before this change, we would have called flush_dcache_folio() also on movable_ops pages. As documented in Documentation/core-api/cachetlb.rst: "This routine need only be called for page cache pages which can potentially ever be mapped into the address space of a user process." So don't do it for movable_ops pages. If there would ever be such a movable_ops page user, it should do the flushing itself after performing the copy. Note that we can now change folio_mapping_flags() to folio_test_anon() to make it clearer, because movable_ops pages will never take that path. [akpm@linux-foundation.org: fix kerneldoc] Link: https://lkml.kernel.org/r/20250704102524.326966-10-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: Harry Yoo Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit d808f1f672a17441f7ef0eff2f0f387d6267ed7c Author: David Hildenbrand Date: Fri Jul 4 12:25:02 2025 +0200 mm/migrate: rename putback_movable_folio() to putback_movable_ops_page() ... and factor the complete handling of movable_ops pages out. Convert it similar to isolate_movable_ops_page(). While at it, convert the VM_BUG_ON_FOLIO() into a VM_WARN_ON_PAGE(). Link: https://lkml.kernel.org/r/20250704102524.326966-9-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Reviewed-by: Harry Yoo Reviewed-by: Zi Yan Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 6ef0c1976b8fab938e732c2fb751fa8965153b2e Author: David Hildenbrand Date: Fri Jul 4 12:25:01 2025 +0200 mm/migrate: rename isolate_movable_page() to isolate_movable_ops_page() ... and start moving back to per-page things that will absolutely not be folio things in the future. Add documentation and a comment that the remaining folio stuff (lock, refcount) will have to be reworked as well. While at it, convert the VM_BUG_ON() into a WARN_ON_ONCE() and handle it gracefully (relevant with further changes), and convert a WARN_ON_ONCE() into a VM_WARN_ON_ONCE_PAGE(). Note that we will leave anything that needs a rework (lock, refcount, ->lru) to be using folios for now: that perfectly highlights the problematic bits. Link: https://lkml.kernel.org/r/20250704102524.326966-8-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Reviewed-by: Harry Yoo Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 5ec3583309ef94fcceed6807aed93b50e801b84a Author: David Hildenbrand Date: Fri Jul 4 12:25:00 2025 +0200 mm/zsmalloc: make PageZsmalloc() sticky until the page is freed Let the page freeing code handle clearing the page type. Being able to identify balloon pages until actually freed is a requirement for upcoming movable_ops migration changes. Link: https://lkml.kernel.org/r/20250704102524.326966-7-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Sergey Senozhatsky Acked-by: Harry Yoo Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 65aabd88dffda68639808e0827cfef624a1cd55f Author: David Hildenbrand Date: Fri Jul 4 12:24:59 2025 +0200 mm/balloon_compaction: make PageOffline sticky until the page is freed Let the page freeing code handle clearing the page type. Being able to identify balloon pages until actually freed is a requirement for upcoming movable_ops migration changes. Link: https://lkml.kernel.org/r/20250704102524.326966-6-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Zi Yan Acked-by: Harry Yoo Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 2dfcd1608f3a96364f10de7fcfe28727c0292e5d Author: David Hildenbrand Date: Fri Jul 4 12:24:58 2025 +0200 mm/page_alloc: let page freeing clear any set page type Currently, any user of page types must clear that type before freeing a page back to the buddy, otherwise we'll run into mapcount related sanity checks (because the page type currently overlays the page mapcount). Let's allow for not clearing the page type by page type users by letting the buddy handle it instead. We'll focus on having a page type set on the first page of a larger allocation only. With this change, we can reliably identify typed folios even though they might be in the process of getting freed, which will come in handy in migration code (at least in the transition phase). In the future we might want to warn on some page types. Instead of having an "allow list", let's rather wait until we know about once that should go on such a "disallow list". Link: https://lkml.kernel.org/r/20250704102524.326966-5-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Zi Yan Acked-by: Harry Yoo Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit e22a58a2143f86f55f8d44ccdcf4ed443dde18ad Author: David Hildenbrand Date: Fri Jul 4 12:24:57 2025 +0200 mm/zsmalloc: drop PageIsolated() related VM_BUG_ONs Let's drop these checks; these are conditions the core migration code must make sure will hold either way, no need to double check. Link: https://lkml.kernel.org/r/20250704102524.326966-4-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Sergey Senozhatsky Acked-by: Harry Yoo Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Signed-off-by: Andrew Morton commit 15504b1163007bbfbd9a63460d5c14737c16e96d Author: David Hildenbrand Date: Fri Jul 4 12:24:56 2025 +0200 mm/balloon_compaction: convert balloon_page_delete() to balloon_page_finalize() Let's move the removal of the page from the balloon list into the single caller, to remove the dependency on the PG_isolated flag and clarify locking requirements. Note that for now, balloon_page_delete() was used on two paths: (1) Removing a page from the balloon for deflation through balloon_page_list_dequeue() (2) Removing an isolated page from the balloon for migration in the per-driver migration handlers. Isolated pages were already removed from the balloon list during isolation. So instead of relying on the flag, we can just distinguish both cases directly and handle it accordingly in the caller. We'll shuffle the operations a bit such that they logically make more sense (e.g., remove from the list before clearing flags). In balloon migration functions we can now move the balloon_page_finalize() out of the balloon lock and perform the finalization just before dropping the balloon reference. Document that the page lock is currently required when modifying the movability aspects of a page; hopefully we can soon decouple this from the page lock. Link: https://lkml.kernel.org/r/20250704102524.326966-3-david@redhat.com Signed-off-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: Harry Yoo Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Cc: Zi Yan Signed-off-by: Andrew Morton commit fb05f992b6bbb4702307d96f00703ee637b24dbf Author: David Hildenbrand Date: Fri Jul 4 12:24:55 2025 +0200 mm/balloon_compaction: we cannot have isolated pages in the balloon list Patch series "mm/migration: rework movable_ops page migration (part 1)", v2. In the future, as we decouple "struct page" from "struct folio", pages that support "non-lru page migration" -- movable_ops page migration such as memory balloons and zsmalloc -- will no longer be folios. They will not have ->mapping, ->lru, and likely no refcount and no page lock. But they will have a type and flags 🙂 This is the first part (other parts not written yet) of decoupling movable_ops page migration from folio migration. In this series, we get rid of the ->mapping usage, and start cleaning up the code + separating it from folio migration. Migration core will have to be further reworked to not treat movable_ops pages like folios. This is the first step into that direction. This patch (of 29): The core will set PG_isolated only after mops->isolate_page() was called. In case of the balloon, that is where we will remove it from the balloon list. So we cannot have isolated pages in the balloon list. Let's drop this unnecessary check. Link: https://lkml.kernel.org/r/20250704102524.326966-2-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Zi Yan Reviewed-by: Lorenzo Stoakes Cc: Alistair Popple Cc: Al Viro Cc: Arnd Bergmann Cc: Brendan Jackman Cc: Byungchul Park Cc: Chengming Zhou Cc: Christian Brauner Cc: Christophe Leroy Cc: Eugenio Pé rez Cc: Greg Kroah-Hartman Cc: Gregory Price Cc: "Huang, Ying" Cc: Jan Kara Cc: Jason Gunthorpe Cc: Jason Wang Cc: Jerrin Shaji George Cc: Johannes Weiner Cc: John Hubbard Cc: Jonathan Corbet Cc: Joshua Hahn Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Mathew Brost Cc: Matthew Wilcox (Oracle) Cc: Miaohe Lin Cc: Michael Ellerman Cc: "Michael S. Tsirkin" Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Naoya Horiguchi Cc: Nicholas Piggin Cc: Oscar Salvador Cc: Peter Xu Cc: Qi Zheng Cc: Rakie Kim Cc: Rik van Riel Cc: Sergey Senozhatsky Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Xuan Zhuo Cc: xu xin Cc: Harry Yoo Signed-off-by: Andrew Morton commit 4e25f85b9f85d238fe012cb18cd040172344d7e6 Author: Lorenzo Stoakes Date: Wed Jul 2 09:47:17 2025 +0100 tools/testing/selftests: add mremap() unfaulted/faulted test cases Assert that mremap() behaviour is as expected when moving around unfaulted VMAs immediately adjacent to faulted ones, as well as moving around faulted VMAs and placing them back immediately adjacent to the VMA from which they were moved. This also introduces a shared helper for the syscall version of mremap() so we don't encounter any issues with libc filtering parameters. Link: https://lkml.kernel.org/r/20250702084717.21360-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Cc: Jann Horn Cc: Liam Howlett Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 526f36f3f47b9ad29ffb1bf668b7f295287ee11b Author: Dev Jain Date: Thu Jul 3 12:03:38 2025 +0530 maple tree: add some comments Add comments explaining the fields for maple_metadata, since "end" is ambiguous and "gap" can be confused as the largest gap, whereas it is actually the offset of the largest gap. Add comment for mas_ascend() to explain, whose min and max we are trying to find. Explain that, for example, if we are already on offset zero, then the parent min is mas->min, otherwise we need to walk up to find the implied pivot min. Link: https://lkml.kernel.org/r/20250703063338.51509-1-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Liam R. Howlett Cc: Wei Yang Signed-off-by: Andrew Morton commit 8aa2c0bf0aa92044c8f20ba250448356da509859 Author: Mike Rapoport (Microsoft) Date: Thu Jul 3 21:47:11 2025 +0300 cma: move memory allocation to a helper function __cma_declare_contiguous_nid() tries to allocate memory in several ways: * on systems with 64 bit physical address and enough memory it first attempts to allocate memory just above 4GiB * if that fails, on systems with HIGHMEM the next attempt is from high memory * and at last, if none of the previous attempts succeeded, or was even tried because of incompatible configuration, the memory is allocated anywhere within specified limits. Move all the allocation logic to a helper function to make these steps more obvious. Link: https://lkml.kernel.org/r/20250703184711.3485940-4-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Acked-by: Oscar Salvador Cc: Alexandre Ghiti Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit bef5871662efe251b9dae937d35b6d0db9fa127e Author: Mike Rapoport (Microsoft) Date: Thu Jul 3 21:47:10 2025 +0300 cma: split reservation of fixed area into a helper function Move the check that verifies that reservation of fixed area does not cross HIGHMEM boundary and the actual memblock_resrve() call into a helper function. This makes code more readable and decouples logic related to CONFIG_HIGHMEM from the core functionality of __cma_declare_contiguous_nid(). Link: https://lkml.kernel.org/r/20250703184711.3485940-3-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Oscar Salvador Acked-by: David Hildenbrand Cc: Alexandre Ghiti Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit 20089ebd756c3b13c6f24650ab1d518f76ad173d Author: Mike Rapoport (Microsoft) Date: Thu Jul 3 21:47:09 2025 +0300 cma: move __cma_declare_contiguous_nid() before its usage Patch series "cma: factor out allocation logic from __cma_declare_contiguous_nid", v2. We've discussed earlier that HIGHMEM related logic is spread all over __cma_declare_contiguous_nid(). These patches decouple it into helper functions. This patch (of 3): Move __cma_declare_contiguous_nid() before its usage and kill forward declaration. Link: https://lkml.kernel.org/r/20250703184711.3485940-1-rppt@kernel.org Link: https://lkml.kernel.org/r/20250703184711.3485940-2-rppt@kernel.org Signed-off-by: Mike Rapoport (Microsoft) Acked-by: Oscar Salvador Acked-by: David Hildenbrand Cc: Alexandre Ghiti Cc: Pratyush Yadav Signed-off-by: Andrew Morton commit f63f7e9bfbacf8d948e41a481a14d5a14bbbeb64 Author: Xuanye Liu Date: Wed Jul 2 14:23:59 2025 +0800 mm: remove outdated filename comment in percpu-stats.c The comment had the old filename. It's also unnecessary, so drop it. Link: https://lkml.kernel.org/r/20250702062400.207619-1-liuqiye2025@163.com Signed-off-by: Xuanye Liu Signed-off-by: Andrew Morton commit 5bd3b163e374462c05c055ff091582d757929d3f Author: Xuanye Liu Date: Wed Jul 2 15:12:35 2025 +0800 mm: fix spelling issue in swap.h recliam -> reclaim Link: https://lkml.kernel.org/r/20250702071235.212794-1-liuqiye2025@163.com Signed-off-by: Xuanye Liu Signed-off-by: Andrew Morton commit 11f45931ccfd14f2f3ca3cf9cafd0e9317e9008a Author: Thorsten Blum Date: Mon Jun 30 15:23:18 2025 +0200 mm/cma: use str_plural() in cma_declare_contiguous_multi() Use the string choice helper function str_plural() to simplify the code and to fix the following Coccinelle/coccicheck warning reported by string_choices.cocci: opportunity for str_plural(nr) Link: https://lkml.kernel.org/r/20250630132318.41339-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Dev Jain Tested-by: Dev Jain Reviewed-by: Anshuman Khandual Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit 1c0841140b5bd09f03e568d4d9341c874c396511 Author: Oscar Salvador Date: Mon Jun 30 16:42:12 2025 +0200 mm,hugetlb: drop unlikelys from hugetlb_fault The unlikely predates an era where we were checking for hwpoisoned/migration entries prior to checking whether the pte was present. Currently, we check for the pte to be a migration/hwpoison entry after we have checked that is not present, so it must be either one or the other. Link: https://lkml.kernel.org/r/20250627102904.107202-6-osalvador@suse.de Link: https://lkml.kernel.org/r/20250630144212.156938-6-osalvador@suse.de Signed-off-by: Oscar Salvador Acked-by: David Hildenbrand Cc: Gavin Guo Cc: Muchun Song Cc: Peter Xu Signed-off-by: Andrew Morton commit cced784d2cb2a708cdfe4784514c2a10af3af37d Author: Oscar Salvador Date: Mon Jun 30 16:42:11 2025 +0200 mm,hugetlb: drop obsolete comment about non-present pte and second faults There is a comment in hugetlb_fault() that does not hold anymore. This one: /* * vmf.orig_pte could be a migration/hwpoison vmf.orig_pte at this * point, so this check prevents the kernel from going below assuming * that we have an active hugepage in pagecache. This goto expects * the 2nd page fault, and is_hugetlb_entry_(migration|hwpoisoned) * check will properly handle it. */ This was written because back in the day we used to do: hugetlb_fault () { ptep = huge_pte_offset(...) if (ptep) { entry = huge_ptep_get(ptep) if (unlikely(is_hugetlb_entry_migration(entry)) ... else if (unlikely(is_hugetlb_entry_hwpoisoned(entry))) ... } ... ... /* * entry could be a migration/hwpoison entry at this point, so this * check prevents the kernel from going below assuming that we have * a active hugepage in pagecache. This goto expects the 2nd page fault, * and is_hugetlb_entry_(migration|hwpoisoned) check will properly * handle it. */ if (!pte_present(entry)) goto out_mutex; ... } The code was designed to check for hwpoisoned/migration entries upfront, and then bail out if further down the pte was not present anymore, relying on the second fault to properly handle migration/hwpoison entries that time around. The way we handle this is different nowadays, so drop the misleading comment. Link: https://lkml.kernel.org/r/20250627102904.107202-5-osalvador@suse.de Link: https://lkml.kernel.org/r/20250630144212.156938-5-osalvador@suse.de Signed-off-by: Oscar Salvador Acked-by: David Hildenbrand Cc: Gavin Guo Cc: Muchun Song Cc: Peter Xu Signed-off-by: Andrew Morton commit d531fd2ccf6b5ad95b718b5748e086f8d4aacf56 Author: Oscar Salvador Date: Mon Jun 30 16:42:10 2025 +0200 mm,hugetlb: rename anon_rmap to new_anon_folio and make it boolean anon_rmap is used to determine whether the new allocated folio is anonymous. Rename it to something more meaningul like new_anon_folio and make it boolean, as we use it like that. While we are at it, drop 'new_pagecache_folio' as 'new_anon_folio' is enough to check whether we need to restore the consumed reservation. Link: https://lkml.kernel.org/r/20250627102904.107202-4-osalvador@suse.de Link: https://lkml.kernel.org/r/20250630144212.156938-4-osalvador@suse.de Signed-off-by: Oscar Salvador Acked-by: David Hildenbrand Cc: Gavin Guo Cc: Muchun Song Cc: Peter Xu Signed-off-by: Andrew Morton commit 9293fb4765527c0d2375eb441d045a5a75f5210d Author: Oscar Salvador Date: Mon Jun 30 16:42:09 2025 +0200 mm,hugetlb: sort out folio locking in the faulting path Recent conversations showed that there was a misunderstanding about why we were locking the folio prior to call in hugetlb_wp(). In fact, as soon as we have the folio mapped into the pagetables, we no longer need to hold it locked, because we know that no concurrent truncation could have happened. There is only one case where the folio needs to be locked, and that is when we are handling an anonymous folio, because hugetlb_wp() will check whether it can re-use it exclusively for the process that is faulting it in. So, pass the folio locked to hugetlb_wp() when that is the case. Link: https://lkml.kernel.org/r/20250627102904.107202-3-osalvador@suse.de Link: https://lkml.kernel.org/r/20250630144212.156938-3-osalvador@suse.de Signed-off-by: Oscar Salvador Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Gavin Guo Cc: Muchun Song Cc: Peter Xu Signed-off-by: Andrew Morton commit 2ae1ab9934c785b855583e3eabd208d6f3ac91e1 Author: Oscar Salvador Date: Mon Jun 30 16:42:08 2025 +0200 mm,hugetlb: change mechanism to detect a COW on private mapping Patch series "Misc rework on hugetlb faulting path", v4. This patchset aims to give some love to the hugetlb faulting path, doing so by removing obsolete comments that are no longer true, sorting out the folio lock, and changing the mechanism we use to determine whether we are COWing a private mapping already. The most important patch of the series is #1, as it fixes a deadlock that was described in [1], where two processes were holding the same lock for the folio in the pagecache, and then deadlocked in the mutex. Note that this can also happen for anymous folios. This has been tested using this reproducer, below Looking up and locking the folio in the pagecache was done to check whether that folio was the same folio we had mapped in our pagetables, meaning that if it was different we knew that we already mapped that folio privately, so any further CoW would be made on a private mapping, which lead us to the question: __Was the reservation for that address consumed?__ That is all we care about, because if it was indeed consumed and we are the owner and we cannot allocate more folios, we need to unmap the folio from the processes pagetables and make it exclusive for us. We figured we do not need to look up the folio at all, and it is just enough to check whether the folio we have mapped is anonymous, which means we mapped it privately, so the reservation was indeed consumed. Patch#2 sorts out folio locking in the faulting path, reducing the scope of it ,only taking it when we are dealing with an anonymous folio and document it. More details in the patch. Patch#3-5 are cleanups. Here is the reproducer: #include #include #include #include #include #define PROTECTION (PROT_READ | PROT_WRITE) #define LENGTH (2UL*1024*1024) #define ADDR (void *)(0x0UL) #define FLAGS (MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB) void __read(char *addr) { int i = 0; printf("a[%d]: %c\n", i, addr[i]); } void fill(char *addr) { addr[0] = 'd'; printf("addr: %c\n", addr[0]); } int main(void) { void *addr; pid_t pid, wpid; int status; addr = mmap(ADDR, LENGTH, PROTECTION, FLAGS, -1, 0); if (addr == MAP_FAILED) { perror("mmap"); return -1; } printf("Parent faulting in RO\n"); __read(addr); sleep (10); printf("Forking\n"); pid = fork(); switch (pid) { case -1: perror("fork"); break; case 0: sleep (4); printf("Child: Faulting in\n"); fill(addr); exit(0); break; default: printf("Parent: Faulting in\n"); fill(addr); while((wpid = wait(&status)) > 0); if (munmap(addr, LENGTH)) perror("munmap"); } return 0; } You will also have to add a delay in hugetlb_wp, after releasing the mutex and before unmapping, so the window is large enough to reproduce it reliably. : --- a/mm/hugetlb.c : +++ b/mm/hugetlb.c : @@ -38,6 +38,7 @@ : #include : #include : #include : +#include : : #include : #include : @@ -6261,6 +6262,8 @@ static vm_fault_t hugetlb_wp(struct vm_fault *vmf) : hugetlb_vma_unlock_read(vma); : mutex_unlock(&hugetlb_fault_mutex_table[hash]); : : + mdelay(8000); : + : unmap_ref_private(mm, vma, old_folio, vmf->address); : : mutex_lock(&hugetlb_fault_mutex_table[hash]); This patch (of 5): hugetlb_wp() checks whether the process is trying to COW on a private mapping in order to know whether the reservation for that address was already consumed. If it was consumed and we are the ownner of the mapping, the folio will have to be unmapped from the other processes. Currently, that check is done by looking up the folio in the pagecache and compare it to the folio which is mapped in our pagetables. If it differs, it means we already mapped it privately before, consuming a reservation on the way. All we are interested in is whether the mapped folio is anonymous, so we can simplify and check for that instead. Link: https://lkml.kernel.org/r/20250630144212.156938-1-osalvador@suse.de Link: https://lkml.kernel.org/r/20250627102904.107202-1-osalvador@suse.de Link: https://lkml.kernel.org/r/20250627102904.107202-2-osalvador@suse.de Link: https://lore.kernel.org/lkml/20250513093448.592150-1-gavinguo@igalia.com/ [1] Link: https://lkml.kernel.org/r/20250630144212.156938-2-osalvador@suse.de Fixes: 40549ba8f8e0 ("hugetlb: use new vma_lock for pmd sharing synchronization") Signed-off-by: Oscar Salvador Reported-by: Gavin Guo Closes: https://lore.kernel.org/lkml/20250513093448.592150-1-gavinguo@igalia.com/ Suggested-by: Peter Xu Acked-by: David Hildenbrand Cc: Muchun Song Signed-off-by: Andrew Morton commit c26ad45ba538434e87290c7db5a93fe11263f593 Author: Gerald Schaefer Date: Mon Jun 30 18:47:25 2025 +0200 mm/debug_vm_pgtable: use a swp_entry_t input value for swap tests The various __pte/pmd_to_swp_entry and __swp_entry_to_pte/pmd helper functions are expected to operate on swap PTE/PMD entries, not on present and mapped entries. Reflect this in the swap tests by using a swp_entry_t as input value, and convert it to a swap PTE/PMD for testing, similar to how it is already done in pte_swap_exclusive_tests(). Move the swap entry creation from there to init_args() and store it in args, so it can also be used in other functions. The pte/pmd_swap_tests() are also changed to compare entries instead of pfn values, again similar to pte_swap_exclusive_tests(). pte/pmd_pfn() helpers are also not expected to operate on swap PTE/PMD entries at all. Also update documentation, to reflect that the helpers operate on swap PTE/PMD entries and not present and mapped entries, and use correct names, i.e. __swp_to_pte/pmd_entry -> __swp_entry_to_pte/pmd. For consistency, also change pte/pmd_swap_soft_dirty_tests() to use args->swp_entry instead of a present and mapped PTE/PMD. Link: https://lore.kernel.org/all/20250623184321.927418-1-gerald.schaefer@linux.ibm.com Link: https://lkml.kernel.org/r/20250630164726.930405-1-gerald.schaefer@linux.ibm.com Signed-off-by: Gerald Schaefer Acked-by: David Hildenbrand Reviewed-by: Anshuman Khandual Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 2a83529026c23fc7d8bbf544c6c8d52df7cb9d93 Author: Thorsten Blum Date: Mon Jun 30 19:18:26 2025 +0200 mm/hugetlb: use str_plural() in report_hugepages() Use the string choice helper function str_plural() to simplify the code and to fix the following Coccinelle/coccicheck warning reported by string_choices.cocci: opportunity for str_plural(nrinvalid) Link: https://lkml.kernel.org/r/20250630171826.114008-2-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Acked-by: David Hildenbrand Acked-by: Oscar Salvador Reviewed-by: Dev Jain Reviewed-by: Anshuman Khandual Cc: Muchun Song Signed-off-by: Andrew Morton commit b112a4e0a1af5745f987a1692553bf02c890babc Author: Jeongjun Park Date: Thu Jul 3 15:56:00 2025 +0900 mm/percpu: prevent concurrency problem for pcpu_nr_populated read with spin lock pcpu_nr_pages() reads pcpu_nr_populated without any protection, which causes a data race between read/write. However, since this is an intended race, we should add a data_race annotation instead of add a spin lock. [akpm@linux-foundation.org: move pcpu_nr_units multiplication outside data_race(), per Vlastimil] Link: https://lkml.kernel.org/r/20250703065600.132221-1-aha310510@gmail.com Fixes: 7e8a6304d541 ("/proc/meminfo: add percpu populated pages count") Signed-off-by: Jeongjun Park Reported-by: syzbot+e5bd32b79413e86f389e@syzkaller.appspotmail.com Suggested-by: Shakeel Butt Cc: Christoph Lameter (Ampere) Cc: David Rientjes Cc: Dennis Zhou Cc: Roman Gushchin Cc: Tejun Heo Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 603cb4aa09a14157ba412ba4db9dffebb79eb598 Author: SeongJae Park Date: Sat Jun 28 09:04:28 2025 -0700 selftests/damon/sysfs.py: test DAMOS schemes parameters setup Add DAMON sysfs interface functionality tests for basic DAMOS schemes parameters setup. Link: https://lkml.kernel.org/r/20250628160428.53115-7-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 7e6bcf354f3ea5cc409a7210a4b3834585e61954 Author: SeongJae Park Date: Sat Jun 28 09:04:27 2025 -0700 selftests/damon/sysfs.py: test adaptive targets parameter Add DAMON sysfs interface functionality tests for setup of basic adaptive targets parameters. Link: https://lkml.kernel.org/r/20250628160428.53115-6-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit ae3ab07e0d0488925008c19f03ba02d7818c85af Author: SeongJae Park Date: Sat Jun 28 09:04:26 2025 -0700 selftests/damon/sysfs.py: test monitoring attribute parameters Add DAMON sysfs interface functionality tests for DAMON monitoring attribute parameters, including intervals, intervals tuning goals, and min/max number of regions. Link: https://lkml.kernel.org/r/20250628160428.53115-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 4ece01897627ddeefcede4ac709cd99763994dc4 Author: SeongJae Park Date: Sat Jun 28 09:04:25 2025 -0700 selftests/damon: add python and drgn-based DAMON sysfs test Add a python-written DAMON sysfs functionality selftest. It sets DAMON parameters using Python module _damon_sysfs, reads updated kernel internal DAMON status and parameters using a 'drgn' script, namely drgn_dump_damon_status.py, and compare if the resulted DAMON internal status is as expected. The test is very minimum at the moment. Link: https://lkml.kernel.org/r/20250628160428.53115-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit e227472ebf00b6b5187915826c41258c472edb0a Author: SeongJae Park Date: Sat Jun 28 09:04:24 2025 -0700 selftests/damon/_damon_sysfs: set Kdamond.pid in start() _damon_sysfs.py is a Python module for reading and writing DAMON sysfs for testing. It is not reading resulting kdamond pids. Read and update those when starting kdamonds. Link: https://lkml.kernel.org/r/20250628160428.53115-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit f3e8e1e51362680f221f98626924098c8b3c6634 Author: SeongJae Park Date: Sat Jun 28 09:04:23 2025 -0700 selftests/damon: add drgn script for extracting damon status Patch series "selftests/damon: add python and drgn based DAMON sysfs functionality tests". DAMON sysfs interface is the bridge between the user space and the kernel space for DAMON parameters. There is no good and simple test to see if the parameters are set as expected. Existing DAMON selftests therefore test end-to-end features. For example, damos_quota_goal.py runs a DAMOS scheme with quota goal set against a test program running an artificial access pattern, and see if the result is as expected. Such tests cover only a few part of DAMON. Adding more tests is also complicated. Finally, the reliability of the test itself on different systems is bad. 'drgn' is a tool that can extract kernel internal data structures like DAMON parameters. Add a test that passes specific DAMON parameters via DAMON sysfs reusing _damon_sysfs.py, extract resulting DAMON parameters via 'drgn', and compare those. Note that this test is not adding exhaustive tests of all DAMON parameters and input combinations but very basic things. Advancing the test infrastructure and adding more tests are future works. This patch (of 6): 'drgn' is a useful tool for extracting kernel internal data structures such as DAMON's parameter and running status. Add a 'drgn' script that extracts such DAMON internal data at runtime, for using it as a tool for seeing if a test input has made expected results in the kernel. The script saves or prints out the DAMON internal data as a json file or string. This is for making use of it not very depends on 'drgn'. If 'drgn' is not available on a test setup and we find alternative tools for doing that, the json-based tests can be updated to use an alternative tool in future. Note that the script is tested with 'drgn v0.0.22'. Link: https://lkml.kernel.org/r/20250628160428.53115-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250628160428.53115-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit dd3d25f055e86a7f5958381beba99d67927d4e65 Author: Peter Xu Date: Fri Jun 27 12:07:39 2025 -0400 mm: deduplicate mm_get_unmapped_area() Essentially it sets vm_flags==0 for mm_get_unmapped_area_vmflags(). Use the helper instead to dedup the lines. Link: https://lkml.kernel.org/r/20250627160739.2124768-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Jason Gunthorpe Reviewed-by: Oscar Salvador Reviewed-by: Zi Yan Reviewed-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Acked-by: David Hildenbrand Reviewed-by: Dev Jain Reviewed-by: Anshuman Khandual Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Jann Horn Cc: Huacai Chen Cc: Muchun Song Cc: Thomas Bogendoerfer Signed-off-by: Andrew Morton commit eff41389d8249a1a5a67faa440255ed8e526803a Author: Peter Xu Date: Fri Jun 27 12:07:07 2025 -0400 mm/hugetlb: remove prepare_hugepage_range() Only mips and loongarch implemented this API, however what it does was checking against stack overflow for either len or addr. That's already done in arch's arch_get_unmapped_area*() functions, even though it may not be 100% identical checks. For example, for both of the architectures, there will be a trivial difference on how stack top was defined. The old code uses STACK_TOP which may be slightly smaller than TASK_SIZE on either of them, but the hope is that shouldn't be a problem. It means the whole API is pretty much obsolete at least now, remove it completely. Link: https://lkml.kernel.org/r/20250627160707.2124580-1-peterx@redhat.com Signed-off-by: Peter Xu Reviewed-by: Jason Gunthorpe Reviewed-by: Oscar Salvador Acked-by: David Hildenbrand Reviewed-by: Liam R. Howlett Reviewed-by: Anshuman Khandual Cc: Huacai Chen Cc: Thomas Bogendoerfer Cc: Muchun Song Cc: Jann Horn Cc: Lorenzo Stoakes Cc: Pedro Falcato Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit c5e67d40a10234541e220750297304df79aaedd0 Author: Yunjeong Mun Date: Fri Jun 27 09:33:29 2025 -0700 samples/damon/mtier: add parameters for node0 memory usage Change the hard-coded quota goal metric values into sysfs knobs: `node0_mem_used_bp` and `node0_mem_free_bp`. These knobs represent the used and free memory ratio of node0 in basis points (bp, where 1 bp = 0.01%). As mentioned in [1], this patch is developed under the assumption that node0 is always the fast-tier in a two-tiers memory setup. [1] https://lore.kernel.org/linux-mm/20250420194030.75838-8-sj@kernel.org/ Link: https://lkml.kernel.org/r/20250627163329.50997-1-sj@kernel.org Link: https://patch.msgid.link/20250619050313.1535-1-yunjeong.mun@sk.com Signed-off-by: Yunjeong Mun Signed-off-by: SeongJae Park Suggested-by: Honggyu Kim Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit d1554fb6302093d353c8bf4601f9bf994b836904 Author: Zi Yan Date: Mon Jun 16 22:11:14 2025 -0400 mm/page_isolation: remove migratetype parameter from more functions migratetype is no longer overwritten during pageblock isolation, start_isolate_page_range(), has_unmovable_pages(), and set_migratetype_isolate() no longer need which migratetype to restore during isolation failure. For has_unmoable_pages(), it needs to know if the isolation is for CMA allocation, so adding PB_ISOLATE_MODE_CMA_ALLOC provide the information. At the same time change isolation flags to enum pb_isolate_mode (PB_ISOLATE_MODE_MEM_OFFLINE, PB_ISOLATE_MODE_CMA_ALLOC, PB_ISOLATE_MODE_OTHER). Remove REPORT_FAILURE and check PB_ISOLATE_MODE_MEM_OFFLINE, since only PB_ISOLATE_MODE_MEM_OFFLINE reports isolation failures. alloc_contig_range() no longer needs migratetype. Replace it with a newly defined acr_flags_t to tell if an allocation is for CMA. So does __alloc_contig_migrate_range(). Add ACR_FLAGS_NONE (set to 0) to indicate ordinary allocations. Link: https://lkml.kernel.org/r/20250617021115.2331563-7-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Baolin Wang Cc: Brendan Jackman Cc: Johannes Weiner Cc: Kirill A. Shuemov Cc: Mel Gorman Cc: Michal Hocko Cc: Oscar Salvador Cc: Richard Chang Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 7a3324eb66f616408fdaaff8a1289c0a9b333748 Author: Zi Yan Date: Mon Jun 16 22:11:13 2025 -0400 mm/page_isolation: remove migratetype from undo_isolate_page_range() Since migratetype is no longer overwritten during pageblock isolation, undoing pageblock isolation no longer needs which migratetype to restore. Link: https://lkml.kernel.org/r/20250617021115.2331563-6-ziy@nvidia.com Signed-off-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Vlastimil Babka Cc: Baolin Wang Cc: Brendan Jackman Cc: Johannes Weiner Cc: Kirill A. Shuemov Cc: Mel Gorman Cc: Michal Hocko Cc: Oscar Salvador Cc: Richard Chang Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit b1df9c5713dc41229667aa44eaea2399e8de9470 Author: Zi Yan Date: Mon Jun 16 22:11:12 2025 -0400 mm/page_isolation: remove migratetype from move_freepages_block_isolate() Since migratetype is no longer overwritten during pageblock isolation, moving a pageblock out of MIGRATE_ISOLATE no longer needs a new migratetype. Add pageblock_isolate_and_move_free_pages() and pageblock_unisolate_and_move_free_pages() to be explicit about the page isolation operations. Both share the common code in __move_freepages_block_isolate(), which is renamed from move_freepages_block_isolate(). Add toggle_pageblock_isolate() to flip pageblock isolation bit in __move_freepages_block_isolate(). Make set_pageblock_migratetype() only accept non MIGRATE_ISOLATE types, so that one should use set_pageblock_isolate() to isolate pageblocks. As a result, move pageblock migratetype code out of __move_freepages_block(). Link: https://lkml.kernel.org/r/20250617021115.2331563-5-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Baolin Wang Cc: Brendan Jackman Cc: Johannes Weiner Cc: Kirill A. Shuemov Cc: Mel Gorman Cc: Michal Hocko Cc: Oscar Salvador Cc: Richard Chang Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 1bc3587a88d291a37dab12d6c14aa7da53304251 Author: Zi Yan Date: Mon Jun 16 22:11:11 2025 -0400 mm/page_alloc: add support for initializing pageblock as isolated MIGRATE_ISOLATE is a standalone bit, so a pageblock cannot be initialized to just MIGRATE_ISOLATE. Add init_pageblock_migratetype() to enable initialize a pageblock with a migratetype and isolated. Link: https://lkml.kernel.org/r/20250617021115.2331563-4-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Baolin Wang Cc: Brendan Jackman Cc: Johannes Weiner Cc: Kirill A. Shuemov Cc: Mel Gorman Cc: Michal Hocko Cc: Oscar Salvador Cc: Richard Chang Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit e904bce2d9d43e0f370e238457a13847d161570b Author: Zi Yan Date: Mon Jun 16 22:11:10 2025 -0400 mm/page_isolation: make page isolation a standalone bit During page isolation, the original migratetype is overwritten, since MIGRATE_* are enums and stored in pageblock bitmaps. Change MIGRATE_ISOLATE to be stored a standalone bit, PB_migrate_isolate, like PB_compact_skip, so that migratetype is not lost during pageblock isolation. Link: https://lkml.kernel.org/r/20250617021115.2331563-3-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Baolin Wang Cc: Brendan Jackman Cc: Johannes Weiner Cc: Kirill A. Shuemov Cc: Mel Gorman Cc: Michal Hocko Cc: Oscar Salvador Cc: Richard Chang Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 42f46ed99ac6c07adf7f3bcbe9040b0c52d62d0f Author: Zi Yan Date: Mon Jun 16 22:11:09 2025 -0400 mm/page_alloc: pageblock flags functions clean up Patch series "Make MIGRATE_ISOLATE a standalone bit", v10. This patchset moves MIGRATE_ISOLATE to a standalone bit to avoid being overwritten during pageblock isolation process. Currently, MIGRATE_ISOLATE is part of enum migratetype (in include/linux/mmzone.h), thus, setting a pageblock to MIGRATE_ISOLATE overwrites its original migratetype. This causes pageblock migratetype loss during alloc_contig_range() and memory offline, especially when the process fails due to a failed pageblock isolation and the code tries to undo the finished pageblock isolations. In terms of performance for changing pageblock types, no performance change is observed: 1. I used perf to collect stats of offlining and onlining all memory of a 40GB VM 10 times and see that get_pfnblock_flags_mask() and set_pfnblock_flags_mask() take about 0.12% and 0.02% of the whole process respectively with and without this patchset across 3 runs. 2. I used perf to collect stats of dd from /dev/random to a 40GB tmpfs file and find get_pfnblock_flags_mask() takes about 0.05% of the process with and without this patchset across 3 runs. This patch (of 6): No functional change is intended. 1. Add __NR_PAGEBLOCK_BITS for the number of pageblock flag bits and use roundup_pow_of_two(__NR_PAGEBLOCK_BITS) as NR_PAGEBLOCK_BITS to take right amount of bits for pageblock flags. 2. Rename PB_migrate_skip to PB_compact_skip. 3. Add {get,set,clear}_pfnblock_bit() to operate one a standalone bit, like PB_compact_skip. 3. Make {get,set}_pfnblock_flags_mask() internal functions and use {get,set}_pfnblock_migratetype() for pageblock migratetype operations. 4. Move pageblock flags common code to get_pfnblock_bitmap_bitidx(). 3. Use MIGRATETYPE_MASK to get the migratetype of a pageblock from its flags. 4. Use PB_migrate_end in the definition of MIGRATETYPE_MASK instead of PB_migrate_bits. 5. Add a comment on is_migrate_cma_folio() to prevent one from changing it to use get_pageblock_migratetype() and causing issues. Link: https://lkml.kernel.org/r/20250617021115.2331563-1-ziy@nvidia.com Link: https://lkml.kernel.org/r/20250617021115.2331563-2-ziy@nvidia.com Signed-off-by: Zi Yan Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Baolin Wang Cc: Brendan Jackman Cc: Johannes Weiner Cc: Kirill A. Shuemov Cc: Mel Gorman Cc: Michal Hocko Cc: Oscar Salvador Cc: Richard Chang Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit d2a9721d807de405b198291badcc807700746781 Author: Oscar Salvador Date: Mon Jun 16 15:51:54 2025 +0200 mm,memory_hotplug: drop status_change_nid parameter from memory_notify There no users left of status_change_nid, so drop it from memory_notify struct. Link: https://lkml.kernel.org/r/20250616135158.450136-12-osalvador@suse.de Signed-off-by: Oscar Salvador Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Reviewed-by: Vlastimil Babka Cc: Harry Yoo Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Joanthan Cameron Cc: Rakie Kim Signed-off-by: Andrew Morton commit 1a19c91b9706625684dc109e3fb0d0b2a003c7c5 Author: Oscar Salvador Date: Mon Jun 16 15:51:53 2025 +0200 mm,page_ext: derive the node from the pfn page_ext is the only user of 'status_change_nid', which is set in online/offline operations, to know to which node we are adding/removing memory. Prior to call any notifiers, the memmap is initialized via, which among other things, sets the node the pages belong to, to all corresponging pages. This means that there is no need to keep using 'status_change_nid' since we can derive the node from the pfn. This will allow us to finally drop 'status_change_nid' from the memory_notify struct. Link: https://lkml.kernel.org/r/20250616135158.450136-11-osalvador@suse.de Signed-off-by: Oscar Salvador Suggested-by: David Hildenbrand Reviewed-by: Harry Yoo Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Joanthan Cameron Cc: Rakie Kim Signed-off-by: Andrew Morton commit cf0b61adf23f2cfaa360cd7d81d224c0bde7f413 Author: Oscar Salvador Date: Mon Jun 16 15:51:52 2025 +0200 mm,mempolicy: use node-notifier instead of memory-notifier mempolicy is only concerned when a numa node changes its memory state, because it needs to take this node into account for the auto-weighted memory policy system. So stop using the memory notifier and use the new numa node notifer instead. Link: https://lkml.kernel.org/r/20250616135158.450136-10-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: Jonathan Cameron Reviewed-by: Harry Yoo Reviewed-by: Vlastimil Babka Reviewed-by: Rakie Kim Acked-by: David Hildenbrand Reviewed-by: Gregory Price Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Signed-off-by: Andrew Morton commit 8e1bf051c524c6e95194cebf64a839285301d735 Author: Oscar Salvador Date: Mon Jun 16 15:51:51 2025 +0200 kernel,cpuset: use node-notifier instead of memory-notifier cpuset is only concerned when a numa node changes its memory state, as it needs to know the current numa nodes with memory to keep an updated mems_allowed mask. So stop using the memory notifier and use the new numa node notifer instead. Link: https://lkml.kernel.org/r/20250616135158.450136-9-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: Jonathan Cameron Reviewed-by: Harry Yoo Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Rakie Kim Signed-off-by: Andrew Morton commit 487d45d1abeee242a4b12795015584fa8d8f2e67 Author: Oscar Salvador Date: Mon Jun 16 15:51:50 2025 +0200 drivers,hmat: use node-notifier instead of memory-notifier hmat driver is only concerned when a numa node changes its memory state, specifically when a numa node with memory comes into play for the first time, because it will register the memory_targets belonging to that numa node. So stop using the memory notifier and use the new numa node notifer instead. Link: https://lkml.kernel.org/r/20250616135158.450136-8-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: Jonathan Cameron Reviewed-by: Harry Yoo Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Rakie Kim Signed-off-by: Andrew Morton commit 41a9344bb732cf9af5d7a004a836754fa0e7cf56 Author: Oscar Salvador Date: Mon Jun 16 15:51:49 2025 +0200 drivers,cxl: use node-notifier instead of memory-notifier memory-tier is only concerned when a numa node changes its memory state, specifically when a numa node with memory comes into play for the first time, because it needs to get its performance attributes to build a proper demotion chain. So stop using the memory notifier and use the new numa node notifer instead. Link: https://lkml.kernel.org/r/20250616135158.450136-7-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: Jonathan Cameron Reviewed-by: Harry Yoo Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Rakie Kim Signed-off-by: Andrew Morton commit 265ab0869783d99b9dfbfda1697ce6989441aa04 Author: Oscar Salvador Date: Mon Jun 16 15:51:48 2025 +0200 mm,memory-tiers: use node-notifier instead of memory-notifier memory-tier is only concerned when a numa node changes its memory state, because it then needs to re-create the demotion list. So stop using the memory notifier and use the new numa node notifer instead. Link: https://lkml.kernel.org/r/20250616135158.450136-6-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: Jonathan Cameron Reviewed-by: Harry Yoo Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Rakie Kim Signed-off-by: Andrew Morton commit 5a20c096a165b8533c714aa9f1db06fee6fe4739 Author: Oscar Salvador Date: Mon Jun 16 15:51:47 2025 +0200 mm,slub: use node-notifier instead of memory-notifier slub is only concerned when a numa node changes its memory state, so stop using the memory notifier and use the new numa node notifer instead. [akpm@linux-foundation.org: slub.c needs node.h for struct node_notify] Link: https://lore.kernel.org/oe-kbuild-all/202506202144.dGkFxasv-lkp@intel.com/ Link: https://lkml.kernel.org/r/20250616135158.450136-5-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: Jonathan Cameron Reviewed-by: Harry Yoo Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Rakie Kim Signed-off-by: Andrew Morton commit 67929de108479dbb78496b61af5c24072fc16d8d Author: Oscar Salvador Date: Mon Jun 16 15:51:46 2025 +0200 mm,memory_hotplug: implement numa node notifier There are at least six consumers of hotplug_memory_notifier that what they really are interested in is whether any numa node changed its state, e.g: going from having memory to not having memory and vice versa. Implement a specific notifier for numa nodes when their state gets changed, which will later be used by those consumers that are only interested in numa node state changes. Add documentation as well. [dan.carpenter@linaro.org: set failure reason in offline_pages()] Link: https://lkml.kernel.org/r/be4fd31b-7d09-46b0-8329-6d0464ffa7a5@sabinyo.mountain Link: https://lkml.kernel.org/r/20250616135158.450136-4-osalvador@suse.de Signed-off-by: Oscar Salvador Signed-off-by: Dan Carpenter Reviewed-by: Jonathan Cameron Reviewed-by: Harry Yoo Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Rakie Kim Signed-off-by: Andrew Morton commit 8d2882a8edb8621d37fd8931e0686070cc6cc189 Author: Oscar Salvador Date: Mon Jun 16 15:51:45 2025 +0200 mm,memory_hotplug: remove status_change_nid_normal and update documentation Now that the last user of status_change_nid_normal is gone, we can remove it. Update documentation accordingly. Link: https://lkml.kernel.org/r/20250616135158.450136-3-osalvador@suse.de Signed-off-by: Oscar Salvador Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Harry Yoo Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Joanthan Cameron Cc: Rakie Kim Signed-off-by: Andrew Morton commit 1bf47d4195e4518973024cfc0777491ff796e883 Author: Oscar Salvador Date: Mon Jun 16 15:51:44 2025 +0200 mm,slub: do not special case N_NORMAL nodes for slab_nodes Patch series "Implement numa node notifier", v7. Memory notifier is a tool that allow consumers to get notified whenever memory gets onlined or offlined in the system. Currently, there are 10 consumers of that, but 5 out of those 10 consumers are only interested in getting notifications when a numa node changes its memory state. That means going from memoryless to memory-aware of vice versa. Which means that for every {online,offline}_pages operation they get notified even though the numa node might not have changed its state. This is suboptimal, and we want to decouple numa node state changes from memory state changes. While we are doing this, remove status_change_nid_normal, as the only current user (slub) does not really need it. This allows us to further simplify and clean up the code. The first patch gets rid of status_change_nid_normal in slub. The second patch implements a numa node notifier that does just that, and have those consumers register in there, so they get notified only when they are interested. The third patch replaces 'status_change_nid{_normal}' fields within memory_notify with a 'nid', as that is only what we need for memory notifer and update the only user of it (page_ext). Consumers that are only interested in numa node states change are: - memory-tier - slub - cpuset - hmat - cxl - autoweight-mempolicy This patch (of 11): Currently, slab_mem_going_online_callback() checks whether the node has N_NORMAL memory in order to be set in slab_nodes. While it is true that getting rid of that enforcing would mean ending up with movables nodes in slab_nodes, the memory waste that comes with that is negligible. So stop checking for status_change_nid_normal and just use status_change_nid instead which works for both types of memory. Also, once we allocate the kmem_cache_node cache for the node in slab_mem_online_callback(), we never deallocate it in slab_mem_offline_callback() when the node goes memoryless, so we can just get rid of it. The side effects are that we will stop clearing the node from slab_nodes, and also that newly created kmem caches after node hotremove will now allocate their kmem_cache_node for the node(s) that was hotremoved, but these should be negligible. Link: https://lkml.kernel.org/r/20250616135158.450136-1-osalvador@suse.de Link: https://lkml.kernel.org/r/20250616135158.450136-2-osalvador@suse.de Signed-off-by: Oscar Salvador Suggested-by: David Hildenbrand Reviewed-by: Vlastimil Babka Reviewed-by: Harry Yoo Acked-by: David Hildenbrand Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> Cc: Joanthan Cameron Cc: Rakie Kim Signed-off-by: Andrew Morton commit 9992554c9ca3eb929daf8ccb02cfbcb3dbc27d4f Author: Vlastimil Babka Date: Tue Jun 24 15:03:48 2025 +0200 mm, madvise: use standard madvise locking in madvise_set_anon_name() Use madvise_lock()/madvise_unlock() in madvise_set_anon_name() in the same way as in do_madvise(). This narrows the lock scope a bit and reuses existing functionality. get_lock_mode() already picks the correct MADVISE_MMAP_WRITE_LOCK mode for __MADV_SET_ANON_VMA_NAME so we can just remove the explicit assignment. There is a user visible change in that the prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME...) might now return -EINTR. Link: https://lkml.kernel.org/r/20250624-anon_name_cleanup-v2-4-600075462a11@suse.cz Signed-off-by: Vlastimil Babka Tested-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Suren Baghdasaryan Reviewed-by: Lorenzo Stoakes Cc: Colin Cross Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: SeongJae Park Signed-off-by: Andrew Morton commit 986738ce446ab0cb0b6ed71509b19ace69d22bf7 Author: Vlastimil Babka Date: Tue Jun 24 15:03:47 2025 +0200 mm, madvise: move madvise_set_anon_name() down the file Preparatory change so that we can use madvise_lock()/unlock() in the function without forward declarations or more thorough shuffling. No functional change. Move as a separate commit helps git heuristics to detect it properly. Link: https://lkml.kernel.org/r/20250624-anon_name_cleanup-v2-3-600075462a11@suse.cz Signed-off-by: Vlastimil Babka Tested-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Suren Baghdasaryan Reviewed-by: Lorenzo Stoakes Cc: Colin Cross Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: SeongJae Park Signed-off-by: Andrew Morton commit 6b233784b198e0d6dbfd526341b6ec51ffd30020 Author: Vlastimil Babka Date: Tue Jun 24 15:03:46 2025 +0200 mm, madvise: extract mm code from prctl_set_vma() to mm/madvise.c Setting anon_name is done via madvise_set_anon_name() and behaves a lot of like other madvise operations. However, apparently because madvise() has lacked the 4th argument and prctl() not, the userspace entry point has been implemented via prctl(PR_SET_VMA, ...) and handled first by prctl_set_vma(). Currently prctl_set_vma() lives in kernel/sys.c but setting the vma->anon_name is mm-specific code so extract it to a new set_anon_vma_name() function under mm. mm/madvise.c seems to be the most straightforward place as that's where madvise_set_anon_name() lives. Stop declaring the latter in mm.h and instead declare set_anon_vma_name(). Link: https://lkml.kernel.org/r/20250624-anon_name_cleanup-v2-2-600075462a11@suse.cz Signed-off-by: Vlastimil Babka Acked-by: David Hildenbrand Tested-by: Lorenzo Stoakes Reviewed-by: Suren Baghdasaryan Reviewed-by: Lorenzo Stoakes Cc: Colin Cross Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: SeongJae Park Signed-off-by: Andrew Morton commit 980d05955835bfdc054243e5ad95de803d2c19a7 Author: Vlastimil Babka Date: Tue Jun 24 15:03:45 2025 +0200 mm, madvise: simplify anon_name handling Patch series "madvise anon_name cleanups", v2. While reviewing Lorenzo's madvise cleanups I've noticed that we can handle anon_name in madvise code much better, so sending that as patch 1. Initially I wanted to do first move the existing logic from madvise_vma_behavior() to madvise_update_vma() as a separate patch before the actual simplification but that would require adding anon_vma_name_put() in error handling paths only to be removed again, so it's a single patch to avoid churn. It's also an opportunity to move some mm code from prctl under mm, hence patch 2. After code moving preparation in patch 3, also unify madvise lock handling for madvise_set_anon_name() in patch 4. This patch (of 4): Since the introduction in 9a10064f5625 ("mm: add a field to store names for private anonymous memory") the code to set anon_name on a vma has been using madvise_update_vma() to call replace_anon_vma_name(). Since the former is called also by a number of other madvise behaviours that do not set a new anon_name, they have been passing the existing anon_name of the vma to make replace_anon_vma_name() a no-op. This is rather wasteful as it needs anon_vma_name_eq() to determine the no-op situations, and checks for when replace_anon_vma_name() is allowed (the vma is anon/shmem) duplicate the checks already done earlier in madvise_vma_behavior(). It has also lead to commit 942341dcc574 ("mm: fix use-after-free when anon vma name is used after vma is freed") adding anon_name refcount get/put operations exactly to the cases that actually do not change anon_name - just so the replace_anon_vma_name() can keep safely determining it has nothing to do. The recent madvise cleanups made this suboptimal handling very obvious, but happily also allow for an easy fix. madvise_update_vma() now has the complete information whether it's been called to set a new anon_name, so stop passing it the existing vma's name and doing the refcount get/put in its only caller madvise_vma_behavior(). In madvise_update_vma() itself, limit calling of replace_anon_vma_name() only to cases where we are setting a new name, otherwise we know it's a no-op. We can rely solely on the __MADV_SET_ANON_VMA_NAME behaviour and can remove the duplicate checks for vma being anon/shmem that were done already in madvise_vma_behavior(). Additionally, by using vma_modify_flags() when not modifying the anon_name, avoid explicitly passing the existing vma's anon_name and storing a pointer to it in struct madv_behavior or a local variable. This prevents the danger of accessing a freed anon_name after vma merging, previously fixed by commit 942341dcc574. Link: https://lkml.kernel.org/r/20250624-anon_name_cleanup-v2-0-600075462a11@suse.cz Link: https://lkml.kernel.org/r/20250624-anon_name_cleanup-v2-1-600075462a11@suse.cz Signed-off-by: Vlastimil Babka Acked-by: David Hildenbrand Reviewed-by: Suren Baghdasaryan Reviewed-by: Lorenzo Stoakes Tested-by: Lorenzo Stoakes Cc: Colin Cross Cc: Jann Horn Cc: Liam Howlett Cc: Michal Hocko Cc: Mike Rapoport Cc: SeongJae Park Signed-off-by: Andrew Morton commit e24d552a17e92714d4f62e112d536babd6428acb Author: Lorenzo Stoakes Date: Fri Jun 20 16:33:05 2025 +0100 mm/madvise: eliminate very confusing manipulation of prev VMA The madvise code has for the longest time had very confusing code around the 'prev' VMA pointer passed around various functions which, in all cases except madvise_update_vma(), is unused and instead simply updated as soon as the function is invoked. To compound the confusion, the prev pointer is also used to indicate to the caller that the mmap lock has been dropped and that we can therefore not safely access the end of the current VMA (which might have been updated by madvise_update_vma()). Clear up this confusion by not setting prev = vma anywhere except in madvise_walk_vmas(), update all references to prev which will always be equal to vma after madvise_vma_behavior() is invoked, and adding a flag to indicate that the lock has been dropped to make this explicit. Additionally, drop a redundant BUG_ON() from madvise_collapse(), which is simply reiterating the BUG_ON(mmap_locked) above it (note that BUG_ON() is not appropriate here, but we leave existing code as-is). We finally adjust the madvise_walk_vmas() logic to be a little clearer - delaying the assignment of the end of the range to the start of the new range until the last moment and handling the lock being dropped scenario immediately. Additionally add some explanatory comments. [lorenzo.stoakes@oracle.com: fix very subtle bug] Link: https://lkml.kernel.org/r/dca94cde-8afb-4eab-8e57-3f508624d670@lucifer.local Link: https://lkml.kernel.org/r/63d281c5df2e64225ab5b4bda398b45e22818701.1750433500.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Reviewed-by: Zi Yan Reviewed-by: SeongJae Park Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jann Horn Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 946fc11af061c3cd08943a96f6ea8c7e6fec95e1 Author: Lorenzo Stoakes Date: Fri Jun 20 16:33:04 2025 +0100 mm/madvise: thread all madvise state through madv_behavior Doing so means we can get rid of all the weird struct vm_area_struct **prev stuff, everything becomes consistent and in future if we want to make change to behaviour there's a single place where all relevant state is stored. This also allows us to update try_vma_read_lock() to be a little more succinct and set up state for us, as well as cleaning up madvise_update_vma(). We also update the debug assertion prior to madvise_update_vma() to assert that this is a write operation as correctly pointed out by Barry in the relevant thread. We can't reasonably update the madvise functions that live outside of mm/madvise.c so we leave those as-is. Link: https://lkml.kernel.org/r/7b345ab82ef51e551f8bc0c4f7be25712871629d.1750433500.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Zi Yan Reviewed-by: Vlastimil Babka Reviewed-by: SeongJae Park Cc: Baolin Wang Cc: Barry Song Cc: David Hildenbrand Cc: Dev Jain Cc: Jann Horn Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit c0f611507a7aa4d8a401ec6ce8bf4e8abc0a1515 Author: Lorenzo Stoakes Date: Fri Jun 20 16:33:03 2025 +0100 mm/madvise: thread VMA range state through madvise_behavior Rather than updating start and a confusing local parameter 'tmp' in madvise_walk_vmas(), instead store the current range being operated upon in the struct madvise_behavior helper object in a range pair and use this consistently in all operations. This makes it clearer what is going on and opens the door to further cleanup now we store state regarding what is currently being operated upon here. Link: https://lkml.kernel.org/r/518480ceb48553d3c280bc2b0b5e77bbad840147.1750433500.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Reviewed-by: Zi Yan Reviewed-by: SeongJae Park Reviewed-by: Barry Song Cc: Baolin Wang Cc: David Hildenbrand Cc: Dev Jain Cc: Jann Horn Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 20d3aea927808b0283dff8d3a59a722801b92664 Author: Lorenzo Stoakes Date: Fri Jun 20 16:33:02 2025 +0100 mm/madvise: thread mm_struct through madvise_behavior There's no need to thread a pointer to the mm_struct nor have different functions signatures for each behaviour, instead store state in the struct madvise_behavior object consistently and use it for all madvise() actions. Link: https://lkml.kernel.org/r/a47d850b0111735e026d438c3300c0e3b7f439f4.1750433500.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Reviewed-by: Zi Yan Reviewed-by: SeongJae Park Reviewed-by: Barry Song Cc: Baolin Wang Cc: David Hildenbrand Cc: Dev Jain Cc: Jann Horn Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit 58fc12f77eb962360ecf80abd3e1c2790b50786d Author: Lorenzo Stoakes Date: Fri Jun 20 16:33:01 2025 +0100 mm/madvise: remove the visitor pattern and thread anon_vma state Patch series "madvise cleanup", v2. This is a series of patches that helps address a number of historic problems in the madvise() implementation: * Eliminate the visitor pattern and having the code which is implemented for both the anon_vma_name implementation and ordinary madvise() operations use the same madvise_vma_behavior() implementation. * Thread state through the madvise_behavior state object - this object, very usefully introduced by SJ, is already used to transmit state through operations. This series extends this by having all madvise() operations use this, including anon_vma_name. * Thread range, VMA state through madvise_behavior - This helps avoid a lot of the confusing code around range and VMA state and again keeps things consistent and with a single 'source of truth'. * Addressing the very strange behaviour around the passed around struct vm_area_struct **prev pointer - all read-only users do absolutely nothing with the prev pointer. The only function that uses it is madvise_update_vma(), and in all cases prev is always reset to VMA. Fix this by no longer having aything but madvise_update_vma() reference prev, and having madvise_walk_vmas() update prev in each instance. Additionally make it clear that the meaningful change in vma state is when madvise_update_vma() potentially merges a VMA, so explicitly retrieve the VMA in this case. * Update and clarify the madvise_walk_vmas() function - this is a source of a great deal of confusion, so simplify, stop using prev = NULL to signify that the mmap lock has been dropped (!) and make that explicit, and add some comments to explain what's going on. This patch (of 5): Now we have the madvise_behavior helper struct we no longer need to mess around with void* pointers in order to propagate anon_vma_name, and this means we can get rid of the confusing and inconsistent visitor pattern implementation in madvise_vma_anon_name(). This means we now have a single state object that threads through most of madvise()'s logic and a single code path which executes the majority of madvise() behaviour (we maintain separate logic for failure injection and memory population for the time being). We are able to remove the visitor pattern by handling the anon_vma_name setting logic via an internal madvise flag - __MADV_SET_ANON_VMA_NAME. This uses a negative value so it isn't reasonable that we will ever add this as a UAPI flag. Additionally, the madvise_behavior_valid() check ensures that user-specified behaviours are strictly only those we permit which, of course, this flag will be excluded from. We are able to propagate the anon_vma_name object through use of the madvise_behavior helper struct. Doing this results in a can_modify_vma_madv() check for anonymous VMA name changes, however this will cause no issues as this operation is not prohibited. We can also then reuse more code and drop the redundant madvise_vma_anon_name() function altogether. Additionally separate out behaviours that update VMAs from those that do not. Link: https://lkml.kernel.org/r/cover.1750433500.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/c5094bfccb41ecd19d4e9bcaa1c4a11e00158bba.1750433500.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Zi Yan Reviewed-by: SeongJae Park Reviewed-by: Barry Song Acked-by: David Hildenbrand Cc: Baolin Wang Cc: Dev Jain Cc: Jann Horn Cc: Lance Yang Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 17bbbefbf6715a543ff4713e26f7b8e6b7a876d6 Author: Alice Ryhl Date: Mon Jun 16 12:41:48 2025 +0000 rust: uaccess: add UserSliceReader::strcpy_into_buf This patch adds a more convenient method for reading C strings from userspace. Logic is added to NUL-terminate the buffer when necessary so that a &CStr can be returned. Note that we treat attempts to read past `self.length` as a fault, so this returns EFAULT if that limit is exceeded before `buf.len()` is reached. Reviewed-by: Danilo Krummrich Signed-off-by: Alice Ryhl Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250616-strncpy-from-user-v5-2-2d3fb0e1f5af@google.com [ Use `from_mut` to clean `clippy::ref_as_ptr` lint. Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit 8da881d39c1b7fd4a211587ba40f1c936909a11a Author: Alice Ryhl Date: Mon Jun 16 12:41:47 2025 +0000 rust: uaccess: add strncpy_from_user This patch adds a direct wrapper around the C function of the same name. It's not really intended for direct use by Rust code since strncpy_from_user has a somewhat unfortunate API where it only nul-terminates the buffer if there's space for the nul-terminator. This means that a direct Rust wrapper around it could not return a &CStr since the buffer may not be a cstring. However, we still add the method to build more convenient APIs on top of it, which will happen in subsequent patches. Reviewed-by: Danilo Krummrich Reviewed-by: Greg Kroah-Hartman Reviewed-by: Boqun Feng Reviewed-by: Benno Lossin Signed-off-by: Alice Ryhl Link: https://lore.kernel.org/r/20250616-strncpy-from-user-v5-1-2d3fb0e1f5af@google.com [ Reworded title. - Miguel ] Signed-off-by: Miguel Ojeda commit b06c4311711c57c5e558bd29824b08f0a6e2a155 Author: Jakub Kicinski Date: Thu Jul 10 10:51:15 2025 -0700 tools: ynl: default to --process-unknown in installed mode We default to raising an exception when unknown attrs are found to make sure those are noticed during development. When YNL CLI is "installed" and used by sysadmins erroring out is not going to be helpful. It's far more likely the user space is older than the kernel in that case, than that some attr is misdefined or missing. Signed-off-by: Jakub Kicinski Reviewed-by: Donald Hunter Signed-off-by: David S. Miller commit 3aa47d2ec83316c24e1ed15a492b331802dc6a69 Author: Luca Weiss Date: Fri Jul 11 09:28:42 2025 +0200 regulator: qcom-rpmh: add support for pm7550 regulators Add RPMH regulators exposed by Qualcomm Technologies, Inc. PM7550 PMIC. It has 6 FTS525 (FT-SMPS) and 23 LDOs with 3 different types. L1-L11 are LDO515 LV NMOS, L12-L13 are LDO515 MV PMOS, L14-L23 are LDO512 MV PMOS. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20250711-pm7550-pmr735b-rpmh-regs-v2-4-bca8cc15c199@fairphone.com Signed-off-by: Mark Brown commit 28758434900ff4c4dce4e104fb5982ef3c0141ba Author: Luca Weiss Date: Fri Jul 11 09:28:41 2025 +0200 regulator: qcom-rpmh: add support for pmr735b regulators Add RPMH regulators exposed by Qualcomm Technologies, Inc. PMR735B PMIC. It has 12 LDOs with 2 different types, L4 & L10 are LDO512 LV PMOS and the rest are LDO512 NMOS. Reviewed-by: Konrad Dybcio Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20250711-pm7550-pmr735b-rpmh-regs-v2-3-bca8cc15c199@fairphone.com Signed-off-by: Mark Brown commit 20a01de0808364c26836cc8f47ed3b59a40a927d Author: Luca Weiss Date: Fri Jul 11 09:28:40 2025 +0200 regulator: dt-bindings: qcom,rpmh: Add PMR735B compatible Add the PMR735B compatible for the regulators in the PMIC found with the Milos SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20250711-pm7550-pmr735b-rpmh-regs-v2-2-bca8cc15c199@fairphone.com Signed-off-by: Mark Brown commit 729ff4a936c6f3faba78aaa8bc4291b6477c6576 Author: Luca Weiss Date: Fri Jul 11 09:28:39 2025 +0200 regulator: dt-bindings: qcom,rpmh: Add PM7550 compatible Add the PM7550 compatible for the regulators in the PMIC found with the Milos SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20250711-pm7550-pmr735b-rpmh-regs-v2-1-bca8cc15c199@fairphone.com Signed-off-by: Mark Brown commit af241e3fa4d823f8af899c92fd50d020816a1860 Author: Shengjiu Wang Date: Tue Jul 8 16:53:17 2025 +0800 ASoC: fsl-asoc-card: add sysclk_ratio for calculate sysclk frequency The sysclk frequency can be calculated from sample rate multiply ratio. When sysclk_freq is not configured, but sysclk_ratio is configured, then calculate sysclk frequency according to sysclk_ratio. Apply this change for wm8524 codec. Signed-off-by: Shengjiu Wang Link: https://patch.msgid.link/20250708085318.2563521-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 790d5f8ee6f2a27686d042abbce16b4e03ac1608 Author: Peng Fan Date: Thu Jul 10 20:40:03 2025 +0800 ASoC: codec: tlv320aic32x4: Convert to GPIO descriptors of_gpio.h is deprecated, update the driver to use GPIO descriptors. - Use devm_gpiod_get_optional to get GPIO descriptor, and set consumer name. - Use gpiod_set_value to configure output value. While at here, reorder the included headers. Checking the DTS that use the device, all are using GPIOD_ACTIVE_LOW polarity for reset-gpios, so all should work as expected with this patch. Cc: Markus Niebel Cc: Alexander Stein Reviewed-by: Linus Walleij Tested-by: Alexander Stein Signed-off-by: Peng Fan Link: https://patch.msgid.link/20250710-asoc-gpio-1-v2-3-2233b272a1a6@nxp.com Signed-off-by: Mark Brown commit b709c1aef5e15db3aff5749fc7ed9c61b8d0a322 Author: Peng Fan Date: Thu Jul 10 20:40:02 2025 +0800 ASoC: codec: tlv320aic32x4: Sort headers alphabetically Sort headers alphabetically to easily insert new ones and drop unused ones. Signed-off-by: Peng Fan Reviewed-by: Alexander Stein Link: https://patch.msgid.link/20250710-asoc-gpio-1-v2-2-2233b272a1a6@nxp.com Signed-off-by: Mark Brown commit 69d5b62c4bded309332add0fac6760239ff47a68 Author: Peng Fan Date: Thu Jul 10 20:40:01 2025 +0800 ASoC: codec: tlv320aic32x4: Drop aic32x4_pdata usage There is no machine is using aic32x4_pdata as platform_data, so remove the dead code. Cc: Markus Niebel Cc: Alexander Stein Reviewed-by: Alexander Stein Signed-off-by: Peng Fan Reviewed-by: Linus Walleij Link: https://patch.msgid.link/20250710-asoc-gpio-1-v2-1-2233b272a1a6@nxp.com Signed-off-by: Mark Brown commit f00e06296ba3f0d8440030afe8cc2258758b7af7 Author: Kuninori Morimoto Date: Fri Jul 11 02:27:19 2025 +0000 ASoC: samsung: littlemill: don't set dapm->bias_level directly snd_soc_dapm_set_bias_level() (A) will set dapm->bias_level (a) inside. No need to set it by each callback function. Remove it. (A) static int snd_soc_dapm_set_bias_level(...) { ... /* success */ if (ret == 0) (a) snd_soc_dapm_init_bias_level(dapm, level); ... } Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ldov4g3c.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 4421e455d2c33a86cdb19f3a0854a59de1542321 Author: Kuninori Morimoto Date: Fri Jul 11 02:27:12 2025 +0000 ASoC: samsung: tobermory: don't set dapm->bias_level directly snd_soc_dapm_set_bias_level() (A) will set dapm->bias_level (a) inside. No need to set it by each callback function. Remove it. (A) static int snd_soc_dapm_set_bias_level(...) { ... /* success */ if (ret == 0) (a) snd_soc_dapm_init_bias_level(dapm, level); ... } Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ms9b4g3j.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d2f423a4f4ecabd852c5ee5076596399488d4b75 Author: Kuninori Morimoto Date: Fri Jul 11 02:27:04 2025 +0000 ASoC: samsung: speyside: don't set dapm->bias_level directly snd_soc_dapm_set_bias_level() (A) will set dapm->bias_level (a) inside. No need to set it by each callback function. Remove it. (A) static int snd_soc_dapm_set_bias_level(...) { ... /* success */ if (ret == 0) (a) snd_soc_dapm_init_bias_level(dapm, level); ... } Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87o6tr4g3r.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 88f60cb4b8c96241d86a68da57dc5b52488240cf Author: Kuninori Morimoto Date: Fri Jul 11 02:26:54 2025 +0000 ASoC: samsung: bell: don't set dapm->bias_level directly snd_soc_dapm_set_bias_level() (A) will set dapm->bias_level (a) inside. No need to set it by each callback function. Remove it. (A) static int snd_soc_dapm_set_bias_level(...) { ... /* success */ if (ret == 0) (a) snd_soc_dapm_init_bias_level(dapm, level); ... } Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ple74g47.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f40ecc2743652c0b0f19935f81baf57c601eb7f0 Author: Kuninori Morimoto Date: Fri Jul 11 02:26:39 2025 +0000 ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed ASoC has 2 functions to set bias level. (A) snd_soc_dapm_force_bias_level() (B) snd_soc_dapm_set_bias_level() snd_soc_dapm_force_bias_level() (A) will set dapm->bias_level (a) if successed. (A) int snd_soc_dapm_force_bias_level(...) { ... if (ret == 0) (a) dapm->bias_level = level; ... } snd_soc_dapm_set_bias_level() (B) is also a function that sets bias_level. It will call snd_soc_dapm_force_bias_level() (A) inside, but doesn't set dapm->bias_level by itself. One note is that (A) might not be called. (B) static int snd_soc_dapm_set_bias_level(...) { ... ret = snd_soc_card_set_bias_level(...); ... if (dapm != &card->dapm) (A) ret = snd_soc_dapm_force_bias_level(...); ... ret = snd_soc_card_set_bias_level_post(...); ... } dapm->bias_level will be set if (A) was called, but might not be set if (B) was called, even though it calles set_bias_level() function. We should set dapm->bias_level if we calls snd_soc_dapm_set_bias_level() (B), too. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87qzyn4g4h.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5030abcb0aa3304bf91497844ffa9607a2d4ad5d Author: Charles Keepax Date: Fri Jul 11 11:06:16 2025 +0100 ASoC: SDCA: Pull HID and IRQ into the primary SDCA module If the HID or the IRQ are selected as options they will always require loading alongside the main SDCA module. Since it will never be possible to run without them the value of keeping them as separate modules is fairly limited. Pull them into the main SDCA module to simplify things still further. Signed-off-by: Charles Keepax Reviewed-by: Arnd Bergmann Link: https://patch.msgid.link/20250711100616.296329-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 6894e49b7b62cdb0edbcaaa23ea0218edb3b02dd Author: Charles Keepax Date: Fri Jul 11 11:06:15 2025 +0100 ASoC: SDCA: Kconfig/Makefile fixups Tidy up a few bits of the SDCA Kconfig. Default both HID and IRQ to enabled, since typically if one wants SDCA all the functionality will be expected. Finally, update the IRQ support to match the changes made to the HID support. Signed-off-by: Charles Keepax Reviewed-by: Arnd Bergmann Link: https://patch.msgid.link/20250711100616.296329-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 9eb73f92a0b003f2fb9091085c51a4a4554c887d Author: Christophe JAILLET Date: Sun Jul 13 17:09:24 2025 +0200 net: dsa: mt7530: Constify struct regmap_config 'struct regmap_config' are not modified in these drivers. They be statically defined instead of allocated and populated at run-time. The main benefits are: - it saves some memory at runtime - the structures can be declared as 'const', which is always better for structures that hold some function pointers - the code is less verbose Signed-off-by: Christophe JAILLET Reviewed-by: Daniel Golle Signed-off-by: David S. Miller commit e8fa0481ea15ba1d40a836fa5dbfc1f49680fba8 Merge: 2009a2d5696944 fc3870dc5cadb7 Author: Miguel Ojeda Date: Sun Jul 13 23:05:14 2025 +0200 Merge tag 'pin-init-v6.17' of https://github.com/Rust-for-Linux/linux into rust-next Pull pin-init updates from Benno Lossin: "Added: - 'impl [Pin]Init for Result', so results are now (pin-)initializers. - 'Zeroable::init_zeroed()' delegating to 'init_zeroed()'. - New 'zeroed()', a safe version of 'mem::zeroed()' and also provide it via 'Zeroable::zeroed()'. - Implement 'Zeroable' for 'Option<&T>' and 'Option<&mut T>'. - Implement 'Zeroable' for 'Option<[unsafe] [extern "abi"] fn(...args...) -> ret>' for '"Rust"' and '"C"' ABIs and up to 20 arguments. Changed: - Blanket impls of 'Init' and 'PinInit' from 'impl [Pin]Init for T' to 'impl [Pin]Init for T'. - Renamed 'zeroed()' to 'init_zeroed()'. Upstream dev news: - More CI improvements to deny warnings, use '--all-targets'. Also check the synchronization status of the two '-next' branches in upstream and the kernel." Acked-by: Andreas Hindborg * tag 'pin-init-v6.17' of https://github.com/Rust-for-Linux/linux: rust: pin-init: examples, tests: use `ignore` instead of conditionally compiling tests rust: init: remove doctest's `Error::from_errno` workaround rust: init: re-enable doctests rust: pin-init: implement `ZeroableOption` for function pointers with up to 20 arguments rust: pin-init: change `impl Zeroable for Option>` to `ZeroableOption for NonNull` rust: pin-init: implement `ZeroableOption` for `&T` and `&mut T` rust: pin-init: add `zeroed()` & `Zeroable::zeroed()` functions rust: pin-init: add `Zeroable::init_zeroed` rust: pin-init: rename `zeroed` to `init_zeroed` rust: pin-init: feature-gate the `stack_init_reuse` test on the `std` feature rust: pin-init: examples: pthread_mutex: disable the main test for miri rust: pin-init: examples, tests: add conditional compilation in order to compile under any feature combination rust: pin-init: change blanket impls for `[Pin]Init` and add one for `Result` rust: pin-init: improve safety documentation for `impl [Pin]Init for T` commit d274c77ffa202b70ad01d579f33b73b4de123375 Author: Yao Zi Date: Thu Jul 10 09:21:34 2025 +0000 clk: thead: th1520-ap: Correctly refer the parent of osc_12m The "osc_12m" fixed factor clock refers the external oscillator by setting clk_parent_data.fw_name to osc_24m, which is obviously wrong since no clock-names property is allowed for compatible thead,th1520-clk-ap. Refer the oscillator as parent by index instead. Fixes: ae81b69fd2b1 ("clk: thead: Add support for T-Head TH1520 AP_SUBSYS clocks") Signed-off-by: Yao Zi Reviewed-by: Drew Fustini Signed-off-by: Drew Fustini commit cb1bdf0797acd79c53a899f72a06ab8c1ebc5bcb Author: Purva Yeshi Date: Sun Jul 13 12:30:20 2025 +0530 block: floppy: Fix uninitialized use of outparam Fix Smatch-detected error: drivers/block/floppy.c:3569 fd_locked_ioctl() error: uninitialized symbol 'outparam'. Smatch may incorrectly warn about uninitialized use of 'outparam' in fd_locked_ioctl(), even though all _IOC_READ commands guarantee its initialization. Initialize outparam to NULL to make this explicit and suppress the false positive. Signed-off-by: Purva Yeshi Reviewed-by: Denis Efremov Link: https://lore.kernel.org/r/20250713070020.14530-1-purvayeshi550@gmail.com Signed-off-by: Jens Axboe commit f7e9077a1649877d4b33ce91d58711d393a63c1b Author: Tiwei Bie Date: Fri Jul 11 14:50:21 2025 +0800 um: Stop tracking stub's PID via userspace_pid[] The PID of the stub process can be obtained from current_mm_id(). There is no need to track it via userspace_pid[]. Stop doing that to simplify the code. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250711065021.2535362-4-tiwei.bie@linux.dev Signed-off-by: Johannes Berg commit b3fb0eb5c28766e3768f9f5b2968d33da00c4cea Author: Tiwei Bie Date: Fri Jul 11 14:50:20 2025 +0800 um: Remove the pid parameter of handle_trap() It's no longer used. Remove it. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250711065021.2535362-3-tiwei.bie@linux.dev Signed-off-by: Johannes Berg commit cba737fa595f076f4b11df045d74bf6dfbc8db2f Author: Tiwei Bie Date: Fri Jul 11 14:50:19 2025 +0800 um: Use err consistently in userspace() Avoid declaring a new variable 'ret' inside the 'if (using_seccomp)' block, as the existing 'err' variable declared at the top of the function already serves the same purpose. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250711065021.2535362-2-tiwei.bie@linux.dev Signed-off-by: Johannes Berg commit 297a5fe7368a1b2d5baa9047b823127d09d83dfb Merge: 19272b37aa4f83 c79550f69f0f21 Author: Stephen Boyd Date: Sun Jul 13 09:53:50 2025 -0700 Merge tag 'spacemit-clk-for-6.17-1' of https://github.com/spacemit-com/linux into clk-spacemit Pull SpacemiT clk driver updates from Yixun Lan: - Mark SpacemiT pll1_d8 clk as critical - Add reset support for SpacemiT K1 SoC * tag 'spacemit-clk-for-6.17-1' of https://github.com/spacemit-com/linux: reset: spacemit: add support for SpacemiT CCU resets clk: spacemit: mark K1 pll1_d8 as critical clk: spacemit: define three reset-only CCUs clk: spacemit: set up reset auxiliary devices soc: spacemit: create a header for clock/reset registers dt-bindings: soc: spacemit: define spacemit,k1-ccu resets commit 2a5cebd0fcaf6567c16409c93fe4b0f287a11df9 Merge: 19272b37aa4f83 2d539f31ab0eb3 Author: Stephen Boyd Date: Sun Jul 13 09:38:26 2025 -0700 Merge tag 'samsung-clk-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into clk-samsung Pull Samsung SoC clk driver updates from Krzysztof Kozlowski: - Fixes for clock topology on Google GS101 - Add HSI2 clk controller on ExynosAutov920 - Minor comment fix for Exynos850 clk driver * tag 'samsung-clk-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: clk: samsung: exynosautov920: add block hsi2 clock support dt-bindings: clock: exynosautov920: add hsi2 clock definitions dt-bindings: clock: exynosautov920: sort clock definitions clk: samsung: exynos850: fix a comment clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD commit b1712f94f7fcacf6b3dc4d9b73fd161bb3f2bb70 Merge: 19272b37aa4f83 0ab2d84f94dae4 Author: Stephen Boyd Date: Sun Jul 13 09:19:45 2025 -0700 Merge tag 'renesas-clk-for-v6.17-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into clk-renesas Pull Renesas clk driver updates from Geert Uytterhoeven: - Add Expanded Serial Peripheral Interface (xSPI) clocks and resets on Renesas RZ/V2H(P) and RZ/V2N - Add SPI (RSPI) clocks and resets on Renesas RZ/V2H(P) - Add SDHI and I2C clocks on Renesas RZ/T2H and RZ/N2H - Add Ethernet clocks and resets on Renesas RZ/G3E - Initial support for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs - Add Ethernet clocks and resets on Renesas RZ/V2H and RZ/V2N - Add timer, I2C, watchdog, GPU, and USB2.0 clocks and resets on Renesas RZ/V2N - Rework Module Stop and Power Domain support on the Renesas RZ/G2L family of SoCs (especially on RZ/G3S) - Add I3C clocks and resets on Renesas RZ/G3E * tag 'renesas-clk-for-v6.17-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers: (42 commits) clk: renesas: r9a08g045: Add MSTOP for coupled clocks as well clk: renesas: r9a09g047: Add clock and reset signals for the GBETH IPs clk: renesas: r9a09g057: Add XSPI clock/reset clk: renesas: r9a09g056: Add XSPI clock/reset clk: renesas: rzv2h: Add fixed-factor module clocks with status reporting clk: renesas: r9a09g057: Add support for xspi mux and divider clk: renesas: r9a09g056: Add support for xspi mux and divider clk: renesas: r9a09g077: Add RIIC module clocks clk: renesas: r9a09g077: Add PLL2 and SDHI clock support clk: renesas: rzv2h: Drop redundant base pointer from pll_clk clk: renesas: r9a09g057: Add entries for the RSPIs dt-bindings: clock: renesas,r9a09g077/87: Add SDHI_CLKHS clock ID dt-bindings: clock: renesas,r9a09g056/57-cpg: Add XSPI core clock clk: renesas: rzv2h: Add missing include file clk: renesas: rzv2h: Use devm_kmemdup_array() clk: renesas: Add CPG/MSSR support to RZ/N2H SoC clk: renesas: r9a09g077: Add PCLKL core clock dt-bindings: clock: renesas,cpg-mssr: Document RZ/N2H support dt-bindings: soc: renesas: Document RZ/N2H (R9A09G087) SoC dt-bindings: clock: renesas,r9a09g077: Add PCLKL core clock ID ... commit 97d4d7742d0986426cc48f58b6baae04953eae04 Author: Anjelique Melendez Date: Thu Jul 10 15:45:55 2025 -0700 thermal/drivers/qcom-spmi-temp-alarm: Add support for LITE PMIC peripherals Add support for TEMP_ALARM LITE PMIC peripherals. This subtype utilizes a pair of registers to configure a warning interrupt threshold temperature and an automatic hardware shutdown threshold temperature. Co-developed-by: David Collins Signed-off-by: David Collins Signed-off-by: Anjelique Melendez Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250710224555.3047790-6-anjelique.melendez@oss.qualcomm.com Signed-off-by: Daniel Lezcano commit 348e104715744f4c97fb3408ee91b543eedc8af1 Author: Anjelique Melendez Date: Thu Jul 10 15:45:54 2025 -0700 thermal/drivers/qcom-spmi-temp-alarm: Add support for GEN2 rev 2 PMIC peripherals Add support for TEMP_ALARM GEN2 PMIC peripherals with digital major revision 2. This revision utilizes individual temp DAC registers to set the threshold temperature for over-temperature stages 1 (warning), 2 (system shutdown), and 3 (emergency shutdown) instead of a single register to specify a set of thresholds. Co-developed-by: David Collins Signed-off-by: David Collins Signed-off-by: Anjelique Melendez Link: https://lore.kernel.org/r/20250710224555.3047790-5-anjelique.melendez@oss.qualcomm.com Signed-off-by: Daniel Lezcano commit 1f835c6a4c844d7667ba0f8e47e685549719f0d6 Author: Anjelique Melendez Date: Thu Jul 10 15:45:53 2025 -0700 thermal/drivers/qcom-spmi-temp-alarm: Prepare to support additional Temp Alarm subtypes In preparation to support newer temp alarm subtypes, add the "ops", "sync_thresholds" and "configure_trip_temps" references to spmi_temp_alarm_data. This will allow for each Temp Alarm subtype to define its own thermal_zone_device_ops and properly initialize and configure thermal trip temperature. Signed-off-by: Anjelique Melendez Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250710224555.3047790-4-anjelique.melendez@oss.qualcomm.com Signed-off-by: Daniel Lezcano commit 703f13285a6c5d94e67e5fe2a8c15ee51e1d76ca Author: Anjelique Melendez Date: Thu Jul 10 15:45:52 2025 -0700 thermal/drivers/qcom-spmi-temp-alarm: Add temp alarm data struct based on HW subtype Currently multiple if/else statements are used in functions to decipher between SPMI temp alarm Gen 1, Gen 2 and Gen 2 Rev 1 functionality. Instead refactor the driver so that SPMI temp alarm chips will have reference to a spmi_temp_alarm_data struct which defines data and function callbacks based on the HW subtype. Signed-off-by: Anjelique Melendez Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250710224555.3047790-3-anjelique.melendez@oss.qualcomm.com Signed-off-by: Daniel Lezcano commit f8e157ff2df46ddabd930815d196895976227831 Author: David Collins Date: Thu Jul 10 15:45:51 2025 -0700 thermal/drivers/qcom-spmi-temp-alarm: Enable stage 2 shutdown when required Certain TEMP_ALARM GEN2 PMIC peripherals need over-temperature stage 2 automatic PMIC partial shutdown. This will ensure that in the event of reaching the hotter stage 3 over-temperature threshold, repeated faults will be avoided during the automatic PMIC hardware full shutdown. Modify the stage 2 shutdown control logic to ensure that stage 2 shutdown is enabled on all affected PMICs. Read the digital major and minor revision registers to identify these PMICs. Signed-off-by: David Collins Signed-off-by: Anjelique Melendez Link: https://lore.kernel.org/r/20250710224555.3047790-2-anjelique.melendez@oss.qualcomm.com Signed-off-by: Daniel Lezcano commit b9e50363178a40c76bebaf2f00faa2b0b6baf8d1 Author: Thomas Weißschuh Date: Sat Jul 12 11:00:56 2025 +0200 selftests/nolibc: add x32 test configuration Nolibc supports the x32 ABI on x86. Add a testcase to make sure the support stays functional. QEMU user does not have support for x32, so skip the test there. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250712-nolibc-x32-v1-2-6d81cb798710@weissschuh.net commit d5094bcb5bfdfea2cf0de8aaf77cc65db56cbdb5 Author: Thomas Weißschuh Date: Sat Jul 12 11:00:55 2025 +0200 tools/nolibc: define time_t in terms of __kernel_old_time_t Nolibc assumes that the kernel ABI is using a time values that are as large as a long integer. For most ABIs this holds true. But for x32 this is not correct, as it uses 32bit longs but 64bit times. Also the 'struct stat' implementation of nolibc relies on timespec::tv_sec and time_t being the same type. While timespec::tv_sec comes from the kernel and is of type __kernel_old_time_t, time_t is defined within nolibc. Switch to the __kernel_old_time_t to always get the correct type. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250712-nolibc-x32-v1-1-6d81cb798710@weissschuh.net Acked-by: Willy Tarreau commit 56d080b9776185da9ffc4e001d5878681ba9456b Author: Lothar Rubusch Date: Wed Jul 2 23:08:18 2025 +0000 iio: accel: adxl313: add AC coupled activity/inactivity events Introduce AC-coupled activity and inactivity as MAG_ADAPTIVE events. This adds a new set of threshold and duration configuration options, ensures proper handling of event disabling, and extends the use of the link bit to support complementary event configurations. For example, either ACTIVITY or ACTIVITY_AC can be enabled, but only the most recently set configuration will remain active. Disabling ACTIVITY will have no effect if ACTIVITY_AC is currently enabled, as the event types must match (i.e., ACTIVITY_AC must be explicitly disabled). When either INACTIVITY or INACTIVITY_AC is enabled alongside an activity event, the link bit is set. With the link bit and auto-sleep enabled, activity and inactivity events represent changes in the sensor's power-saving state and are only triggered upon actual state transitions. Since AC coupling uses separate bits for activity and inactivity, each can be configured independently. For instance, ACTIVITY can be linked with INACTIVITY_AC. If one of the linked events is disabled, the link bit is cleared. In that case, the remaining event will no longer reflect a state transition but will instead trigger based on periodic inactivity or whenever the activity threshold is exceeded. Signed-off-by: Lothar Rubusch Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250702230819.19353-8-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 554396d4b0be5cdec4654fd3456c08886aa8da3e Author: Lothar Rubusch Date: Wed Jul 2 23:08:17 2025 +0000 iio: accel: adxl313: implement power-save on inactivity Configure the link bit to associate activity and inactivity sensing, allowing the sensor to reflect its internal power-saving state. Additionally, enable the auto-sleep bit to transition the sensor into auto-sleep mode during periods of inactivity, as outlined in the datasheet. Reviewed-by: Andy Shevchenko Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250702230819.19353-7-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit e3fc1cadf226eacdf44565b3f3455dfc7d8785f5 Author: Lothar Rubusch Date: Wed Jul 2 23:08:16 2025 +0000 iio: accel: adxl313: add inactivity sensing Enhance the interrupt handler to process inactivity events. Introduce functions to configure the threshold and period registers for inactivity detection, as well as to enable or disable the inactivity feature. Extend the fake IIO channel to handle inactivity events by combining the x, y, and z axes using a logical AND operation. Signed-off-by: Lothar Rubusch Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250702230819.19353-6-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 385eb69ee6ec1fecc475bc1e09f640e2a205c38b Author: Lothar Rubusch Date: Wed Jul 2 23:08:15 2025 +0000 iio: accel: adxl313: add activity sensing Add support for configuring an activity detection threshold. Extend the interrupt handler to process activity-related interrupts, and provide functions to set the threshold as well as to enable or disable activity sensing. Additionally, introduce a virtual channel that represents the logical AND of the x, y, and z axes in the IIO channel. This patch serves as a preparatory step; some definitions and functions introduced here are intended to be extended later to support inactivity detection. Signed-off-by: Lothar Rubusch Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250702230819.19353-5-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit ff8093fa6ba4dd7235a7ad57d5c61b5d3bc9ad8a Author: Lothar Rubusch Date: Wed Jul 2 23:08:14 2025 +0000 iio: accel: adxl313: add buffered FIFO watermark with interrupt handling Cover the following tasks: - Add scan_mask and scan_index to the IIO channel configuration. The scan_index sets up buffer usage. According to the datasheet, the ADXL313 uses a 13-bit wide data field in full-resolution mode. Set the signedness, number of storage bits, and endianness accordingly. - Parse the devicetree for an optional interrupt line and configure the interrupt mapping based on its presence. If no interrupt line is specified, keep the FIFO in bypass mode as currently implemented. - Set up the interrupt handler. Add register access to detect and evaluate interrupts. Implement functions to clear status registers and reset the FIFO. - Implement FIFO watermark configuration and handling. Allow the watermark level to be set, evaluate the corresponding interrupt, read the FIFO contents, and push the data to the IIO channel. Signed-off-by: Lothar Rubusch Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250702230819.19353-4-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit a1576623416a564c6561c722279c03fd0128f39d Author: Lothar Rubusch Date: Wed Jul 2 23:08:13 2025 +0000 iio: accel: adxl313: add function to enable measurement Refactor the control of measurement and standby modes for the sensor. Instead of directly writing to the register, encapsulate this operation in a dedicated function that handles enabling and disabling measurement. This approach will reduce code duplication wherever sensor configuration changes are required. In subsequent patches, measurement mode will be set to standby as part of this process. Additionally, simplify the control mask to include only the measurement bit. The sleep bit governs a different behavior—putting the sensor into sleep mode, not just standby for configuration—and is currently unused. Therefore, there's no need to include both the sleep and measurement bits in the same mask. Reviewed-by: Andy Shevchenko Signed-off-by: Lothar Rubusch Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250702230819.19353-3-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit ec489d91571ee85aa70f8a25f3882a6e97390ab4 Author: Lothar Rubusch Date: Wed Jul 2 23:08:12 2025 +0000 iio: accel: adxl313: make use of regmap cache Setup regmap cache to cache register configuration, reducing bus traffic for repeated accesses to non volatile registers. Reviewed-by: Andy Shevchenko Signed-off-by: Lothar Rubusch Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250702230819.19353-2-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 1a4deda6c68f1aca86e7667bb1073581d849e40c Author: AngeloGioacchino Del Regno Date: Thu Jul 3 16:11:46 2025 +0200 iio: adc: mt6359: Add support for MediaTek MT6373 PMIC AUXADC MediaTek MT6373 is a PMIC found on MT8196/MT6991 board designs and communicates with the SoC over SPMI. This PMIC integrates an Auxiliary ADC (AUXADC) which has a grand total of 54 channels, of which usually only 9 are used as this is usually paired with MT6363 on the same board. For the Auxiliary ADC part, this reuses the same register layout as the MT6363 PMIC, but exposes only a subset of the ADC chans. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250703141146.171431-7-angelogioacchino.delregno@collabora.com Signed-off-by: Jonathan Cameron commit d6f49313272b2d28b9a51b10e3bb2de2bf26fe55 Author: AngeloGioacchino Del Regno Date: Thu Jul 3 16:11:45 2025 +0200 iio: adc: mt6359: Add support for MediaTek MT6363 PMIC AUXADC MediaTek MT6363 is a PMIC found on MT8196/MT6991 board designs and communicates with the SoC over SPMI. This PMIC integrates an Auxiliary ADC (AUXADC) which has a grand total of 54 ADC channels: 49 PMIC-internal channels, 2 external NTC thermistor channels and 2 generic ADC channels (mapped to 7 PMIC ADC external inputs). To use a generic ADC channel it is necessary to enable one of the PMIC ADC inputs at a time and only then start the reading, so in this case it is possible to read only one external input for each generic ADC channel. Due to the lack of documentation, this implementation supports using only one generic ADC channel, hence supports reading only one external input at a time. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250703141146.171431-6-angelogioacchino.delregno@collabora.com Signed-off-by: Jonathan Cameron commit dbcbed76d02fb7d518bbb40284a70c1d43a70fe2 Author: AngeloGioacchino Del Regno Date: Thu Jul 3 16:11:44 2025 +0200 iio: adc: mt6359: Move reference voltage to platform data In preparation to add support for new PMICs, add a `vref_mv` member to struct mtk_pmic_auxadc_info and use it in place of the AUXADC_VOLT_FULL definition. As a consequence, the definition was also removed. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250703141146.171431-5-angelogioacchino.delregno@collabora.com Signed-off-by: Jonathan Cameron commit f8bb423f4952bf1e494668a488498c3afc5010de Author: AngeloGioacchino Del Regno Date: Thu Jul 3 16:11:43 2025 +0200 iio: adc: mt6359: Add ready register index and mask to channel data In preparation for adding support for the AUXADC block found in the MT6363 PMIC, add the ready register index and mask to the mtk_pmic_auxadc_chan structure, populate those in the channel description for all of the already supported SoCs and make use of them in the .read_imp() callbacks. Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250703141146.171431-4-angelogioacchino.delregno@collabora.com Signed-off-by: Jonathan Cameron commit 00da77d1d226b9d8298262fd61b6281abd89a9d4 Author: AngeloGioacchino Del Regno Date: Thu Jul 3 16:11:42 2025 +0200 dt-bindings: iio: adc: mt6359: Add MT6373 PMIC AuxADC Add a compatible and channel bindings for MediaTek's MT6373 PMIC, featuring an Auxiliary ADC IP with 15 ADC channels for external (SoC) temperatures and external voltage inputs. Acked-by: Rob Herring (Arm) Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250703141146.171431-3-angelogioacchino.delregno@collabora.com Signed-off-by: Jonathan Cameron commit 3df2817d5a949646a17bc87677520b358644ee70 Author: AngeloGioacchino Del Regno Date: Thu Jul 3 16:11:41 2025 +0200 dt-bindings: iio: adc: mt6359: Add MT6363 PMIC AuxADC Add a compatible and channel bindings for MediaTek's MT6363 PMIC, featuring an Auxiliary ADC IP with 15 ADC channels used for both internal temperatures and voltages and for external voltage inputs. Acked-by: Rob Herring (Arm) Reviewed-by: Nícolas F. R. A. Prado Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250703141146.171431-2-angelogioacchino.delregno@collabora.com Signed-off-by: Jonathan Cameron commit 1b0dc9385895e3084584f0069c40b111146f71f5 Author: David Lechner Date: Wed Jul 2 08:23:00 2025 -0500 iio: adc: ad4000: don't use shift_right() Drop use of shift_right() macro for unsigned value. The shift_right() macro is intended for signed values and is not needed for unsigned values. This was found by a static analysis tool [1]. Link: https://github.com/analogdevicesinc/linux/pull/2831/files#diff-c14a34a6492576d22e7192cc0f61ad0083190aeb627191596fe12462f0c6f21aR557 [1] Signed-off-by: David Lechner Reviewed-by: Marcelo Schmitt Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250702-iio-adc-ad4000-don-t-use-shift_right-v1-1-041c2d6c3950@baylibre.com Signed-off-by: Jonathan Cameron commit 219da3ea842a156e5808176e11db256db9798f6c Author: David Lechner Date: Tue Jul 1 16:37:59 2025 -0500 iio: adc: ad_sigma_delta: add SPI offload support Add SPI offload support to the ad_sigma_delta module. When the SPI controller has SPI offload capabilities, the module will now use that for buffered reads instead of the RDY interrupt trigger. Drivers that use the ad_sigma_delta module will have to opt into this by setting supports_spi_offload since each driver will likely need additional changes before SPI offload can be used. This will allow us to gradually enable SPI offload support for each driver. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250701-iio-adc-ad7173-add-spi-offload-support-v3-11-42abb83e3dac@baylibre.com Signed-off-by: Jonathan Cameron commit db63e45a7da0678652c69f7cbed2cbf2a9922b39 Author: David Lechner Date: Tue Jul 1 16:37:56 2025 -0500 iio: adc: ad_sigma_delta: use spi_optimize_message() Use spi_optimize_message() to improve the performance of buffered reads. By setting up the SPI message and pre-optimizing it in the buffer postenable callback, we can reduce overhead during each sample read. A rough estimate shows that this reduced the CPU usage of the interrupt handler thread from 22% to 16% using an EVAL-AD4112ARDZ board on a DE10-Nano (measuring a single channel at the default 6.2 kHz sample rate). Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250701-iio-adc-ad7173-add-spi-offload-support-v3-8-42abb83e3dac@baylibre.com Signed-off-by: Jonathan Cameron commit 1519bedf884c0a7c316906459d8c7da12113a8a9 Author: David Lechner Date: Tue Jul 1 16:37:55 2025 -0500 iio: adc: ad_sigma_delta: refactor setting read address Refactor code to set the read address in a separate function. This code is already duplicated twice and we will need to use it a third time in a later commit. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250701-iio-adc-ad7173-add-spi-offload-support-v3-7-42abb83e3dac@baylibre.com Signed-off-by: Jonathan Cameron commit 86d8d6b8b9a79ef9cdbd6de76f951a7282bb7883 Author: David Lechner Date: Tue Jul 1 16:37:54 2025 -0500 iio: adc: ad_sigma_delta: audit included headers Drop linux/iio/sysfs.h since it is unused and replace linux/kernel.h with more explicit headers. There are a couple of other headers added weren't covered by kernel.h, like linux/gpio/consumer.h that are added since the module makes use of those APIs as well. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250701-iio-adc-ad7173-add-spi-offload-support-v3-6-42abb83e3dac@baylibre.com Signed-off-by: Jonathan Cameron commit e916934b591585140a59ac899ac356cd4a1f269f Author: David Lechner Date: Tue Jul 1 16:37:53 2025 -0500 iio: adc: ad_sigma_delta: use BITS_TO_BYTES() macro Use the BITS_TO_BYTES() macro instead of dividing by 8 to convert bits to bytes. This makes it more obvious what unit conversion is taking place. In one instance, we also avoid the temporary assignment to a variable as it was confusing that reg_size was being used with two different units (bits and bytes). scan_type is factored out to reduce line wrapping. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250701-iio-adc-ad7173-add-spi-offload-support-v3-5-42abb83e3dac@baylibre.com Signed-off-by: Jonathan Cameron commit 1a913da6cfda0139bfe1fe203858d5ba30ac853d Author: David Lechner Date: Tue Jul 1 16:37:52 2025 -0500 iio: adc: ad_sigma_delta: use sizeof() in ALIGN() Use sizeof() instead of hardcoding the size of the timestamp in the ALIGN() macro. This makes it a bit more obvious what the intention of the code is. Suggested-by: Andy Shevchenko Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250701-iio-adc-ad7173-add-spi-offload-support-v3-4-42abb83e3dac@baylibre.com Signed-off-by: Jonathan Cameron commit 11d58620dfd0c52b0c49b04d28707c7a5a2d00ae Author: David Lechner Date: Tue Jul 1 16:37:51 2025 -0500 iio: adc: ad_sigma_delta: use u8 instead of uint8_t Replace uint8_t with u8 in the ad_sigma_delta driver. Technically, uint8_t comes from the C standard library, while u8 is a Linux kernel type. Since we don't use the C standard library in the kernel, we should use the kernel types instead. There is also one instance where int64_t is replaced with s64. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250701-iio-adc-ad7173-add-spi-offload-support-v3-3-42abb83e3dac@baylibre.com Signed-off-by: Jonathan Cameron commit 67189665e0630d1eaec539a50b37d1022db65dca Author: David Lechner Date: Tue Jul 1 16:37:50 2025 -0500 iio: adc: ad_sigma_delta: sort includes Sort includes in alphabetical order and fix grouping before we add more. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250701-iio-adc-ad7173-add-spi-offload-support-v3-2-42abb83e3dac@baylibre.com Signed-off-by: Jonathan Cameron commit 5a2f15c5a8e017d0951e6dc62aa7b5b634f56881 Author: David Lechner Date: Tue Jul 1 16:37:49 2025 -0500 iio: adc: ad_sigma_delta: don't overallocate scan buffer Fix overallocating the size of the scan buffer by converting bits to bytes. The size is meant to be in bytes, so scanbits needs to be divided by 8. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250701-iio-adc-ad7173-add-spi-offload-support-v3-1-42abb83e3dac@baylibre.com Signed-off-by: Jonathan Cameron commit 7bf7b62ee997384865fcedd314463c1507617361 Author: Chelsy Ratnawat Date: Tue Jul 1 08:47:20 2025 -0700 iio: imu: inv_mpu6050: Replace scnprintf with sysfs_emit Documentation/filesystems/sysfs.rst mentions that show() should only use sysfs_emit() or sysfs_emit_at() when formating the value to be returned to user space. So replace scnprintf() with sysfs_emit(). Signed-off-by: Chelsy Ratnawat Reviewed-by: Andy Shevchenko Acked-by: Jean-Baptiste Maneyrol Link: https://patch.msgid.link/20250701154720.54276-1-chelsyratnawat2001@gmail.com Signed-off-by: Jonathan Cameron commit 0f7797f6a819a004301135186b6b43658b672dd9 Author: David Lechner Date: Sat Jun 28 13:15:10 2025 -0500 iio: pressure: dlhl60d: Use separate structures rather than an array for chip info Change the dlhl60d driver to use individual chip info structures instead of an array. This reduces the verbosity of the code. Also, the data is now const as it should have been in the first place. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-24-v2-1-1c90073d1323@baylibre.com Signed-off-by: Jonathan Cameron commit 50df7043036957ba1584eb72fb45bb61e1ffbc15 Author: David Lechner Date: Sat Jun 28 12:52:31 2025 -0500 iio: light: cm3232: make struct cm3232_als_info const Add const qualifier to struct cm3232_als_info. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-20-v1-2-2bf90b03f9f1@baylibre.com Signed-off-by: Jonathan Cameron commit 8f02a8d6a7bfcf742bf65202eee3b8a5fc1f374f Author: David Lechner Date: Sat Jun 28 12:52:30 2025 -0500 iio: light: cm3232: move calibscale to struct cm3232_chip Move the calibscale field from struct cm3232_als_info to struct cm3232_chip. The chip info struct is supposed to be const while the driver data struct should contain mutable fields. Since calibscale is a mutable field, it should be in the driver data struct. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-20-v1-1-2bf90b03f9f1@baylibre.com Signed-off-by: Jonathan Cameron commit 2ef920e0e5c06c2bf200a1f1e1019a9a5111a90e Author: David Lechner Date: Sat Jun 28 12:27:46 2025 -0500 iio: imu: adis16400: Use separate structures rather than an array for chip info Change the adis16400 driver to use individual chip info structures instead of an array. This reduces the verbosity of the code. Also, the data is now const as it should have been in the first place. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-17-v1-1-a215ebb653ec@baylibre.com Signed-off-by: Jonathan Cameron commit 00a468c9312645c61ebe3c272a4cbf3dc2f82187 Author: Jonathan Santos Date: Wed Jun 11 08:52:03 2025 -0300 iio: adc: ad7768-1: add low pass -3dB cutoff attribute Ad7768-1 has a different -3db frequency multiplier depending on the filter type configured. The cutoff frequency also varies according to the current ODR. Add a readonly low pass -3dB frequency cutoff attribute to clarify to the user which bandwidth is being allowed depending on the filter configurations. Reviewed-by: Marcelo Schmitt Reviewed-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Santos Link: https://patch.msgid.link/804d66f1858014d7278aec3344d81c223661e878.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit 5eef68d672b777e930df0fef1a970e9aacbce343 Author: David Lechner Date: Sat Jun 28 11:16:51 2025 -0500 iio: adc: ad7124: Use separate structures rather than array for chip info Change the ad7124 driver to use individual chip info structures instead of an array. This reduces the verbosity of the code. Also, the data is now const as it should have been in the first place. Signed-off-by: David Lechner Acked-by: Uwe Kleine-König Link: https://patch.msgid.link/20250628-iio-const-data-5-v1-1-9e56c2f77979@baylibre.com Signed-off-by: Jonathan Cameron commit b1a6eac557f3f6f188beb8a7e12de1c66a8d38da Author: David Lechner Date: Sat Jun 28 13:23:49 2025 -0500 iio: proximity: vcnl3020: make vcnl3020_property const Add const qualifier to struct vcnl3020_property vcnl3020_led_current_property. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-25-v1-2-5d99cf17790e@baylibre.com Signed-off-by: Jonathan Cameron commit 96337ede943508a2d900768f8ef68f83c178c7fd Author: David Lechner Date: Sat Jun 28 13:23:48 2025 -0500 iio: proximity: vcnl3020: pass struct vcnl3020_property by pointer Pass struct vcnl3020_property by pointer instead of by value to avoid copying the entire struct. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-25-v1-1-5d99cf17790e@baylibre.com Signed-off-by: Jonathan Cameron commit 5b322dc49a1b2077e6e366a9008f44c7aa55ad7f Author: David Lechner Date: Sat Jun 28 12:58:11 2025 -0500 iio: pressure: abp060mg: make abp_config const Add const qualifier to struct abp_config abp_config[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-23-v1-1-542cfadce9d0@baylibre.com Signed-off-by: Jonathan Cameron commit 54fde97fa8ebf8d5baf0f5d8b93c4594afa0ddce Author: David Lechner Date: Sat Jun 28 12:56:30 2025 -0500 iio: light: zopt2201: make zopt2201_scale const Add const qualifier to struct zopt2201_scale zopt2201_scale_*[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-22-v1-1-fc9ebdc5f5c3@baylibre.com Signed-off-by: Jonathan Cameron commit d94fc241a948e6be476a07fea606bf9817df9628 Author: David Lechner Date: Sat Jun 28 12:54:37 2025 -0500 iio: light: isl76682: make isl76682_range_table const Add const qualifier to struct isl76682_range isl76682_range_table[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-21-v1-1-2597d8eda30f@baylibre.com Signed-off-by: Jonathan Cameron commit 8c2e602225f0a96f2c5c65de8ab06e304081e542 Author: Donald Hunter Date: Fri Jul 11 18:04:56 2025 +0100 tools: ynl: process unknown for enum values Extend the process_unknown handing to enum values and flags. Tested by removing entries from rt-link.yaml and rt-neigh.yaml: ./tools/net/ynl/pyynl/cli.py --family rt-link --dump getlink \ --process-unknown --output-json | jq '.[0] | ."ifi-flags"' [ "up", "Unknown(6)", "loopback", "Unknown(16)" ] ./tools/net/ynl/pyynl/cli.py --family rt-neigh --dump getneigh \ --process-unknown --output-json | jq '.[] | ."ndm-type"' "unicast" "Unknown(5)" "Unknown(5)" "unicast" "Unknown(5)" "unicast" "broadcast" Signed-off-by: Donald Hunter Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller commit a6cfa4c8833944f8912c1fa7f95795753f6376ea Author: Mario Limonciello Date: Sat Jul 12 18:37:12 2025 -0500 PM: hibernate: Add stub for pm_hibernate_is_recovering() Randy reports that amdgpu fails to compile with the following error: ERROR: modpost: "pm_hibernate_is_recovering" [drivers/gpu/drm/amd/amdgpu/amdgpu.ko] undefined! This happens because pm_hibernate_is_recovering() is only compiled when CONFIG_PM_SLEEP is set. Add a stub for it so that drivers don't need to depend upon CONFIG_PM. Cc: Samuel Zhang Reported-by: Randy Dunlap Closes: https://lore.kernel.org/dri-devel/CAJZ5v0h1CX+aTu7dFy6vB-9LM6t5J4rt7Su3qVnq1xx-BFAm=Q@mail.gmail.com/T/#m2b9fe212b35fde11d58fcbc4e0727bc02ebba7b0 Fixes: c2aaddbd2dede ("PM: hibernate: add new api pm_hibernate_is_recovering()") Acked-by: Rafael J. Wysocki Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20250712233715.821424-1-superm1@kernel.org Signed-off-by: Mario Limonciello commit e502df58b5e3767c00e887744b6eff43b7fde3ea Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:25 2025 +0200 gpio: virtio: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Acked-by: Viresh Kumar Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-12-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit 55e2d1eec110f1278324882714b64465e4e58ced Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:24 2025 +0200 gpio: viperboard: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-11-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit 42fbbe31634d116a7f6bee75c0ae455bf10a7737 Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:23 2025 +0200 gpio: uniphier: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Acked-by: Kunihiko Hayashi Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-10-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit 79880eba2c0feed895e6d2aa8f7e5489d113d653 Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:22 2025 +0200 gpio: twl6040: set line value in .direction_out() It's ok for a GPIO controller to be output-only but the .direction_out() callback must also set the requested line value. Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-9-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit 77ba4640cc1564f29b280040b312688b79039c4c Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:21 2025 +0200 gpio: twl6040: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-8-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit 0446ce284bebe192be6e0da6e969379dc3dac587 Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:20 2025 +0200 gpio: twl4030: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-7-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit ed8497dc6683cd285ef4335a315d398524c4af52 Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:19 2025 +0200 gpio: ts4900: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-6-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit 9ade48906b62fc7c5b999422891408a4f02c255a Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:18 2025 +0200 gpio: tqmx86: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Acked-by: Matthias Schiffer Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-5-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit e41e51f07b1c8a642fed121d01da37c1c2994f89 Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:17 2025 +0200 gpio: tps68470: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-4-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit 22cbcfe36e9724fda06ca873e20777d863445ab8 Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:16 2025 +0200 gpio: tps65912: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-3-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit a0b2a6bbff8c26aafdecd320f38f52c341d5cafa Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:15 2025 +0200 gpio: tps65912: check the return value of regmap_update_bits() regmap_update_bits() can fail, check its return value like we do elsewhere in the driver. Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-2-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit 3e498b3c7b96a17037b5777c56ccff33d3bfbca5 Author: Bartosz Golaszewski Date: Mon Jul 7 09:50:14 2025 +0200 gpio: tps65910: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250707-gpiochip-set-rv-gpio-round4-v1-1-35668aaaf6d2@linaro.org Signed-off-by: Bartosz Golaszewski commit 1bec20dfa3d81be716e7ff5a6343bdec1d29b828 Author: Bartosz Golaszewski Date: Mon Jul 7 16:13:13 2025 +0200 gpiolib: don't use GPIO global numbers in debugfs output One of the users of global GPIO numbers in the kernel are the debugfs callbacks in GPIO drivers. Before converting any custom .dbg_show() callbacks in individual modules, let's first make GPIO core stop using GPIO base in debugfs output. Use hardware offsets instead. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250707141313.73169-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 084f35b84f57e059b542ea44240a51b294a096a1 Author: Zhiyue Qiu Date: Thu Jul 10 03:29:55 2025 -0700 RDMA/mana_ib: add additional port counters Add packet and request port counters to mana_ib. Signed-off-by: Zhiyue Qiu Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/1752143395-5324-1-git-send-email-kotaranov@linux.microsoft.com Reviewed-by: Long Li Signed-off-by: Leon Romanovsky commit 62de0e67328e9503459a24b9343c3358937cdeef Author: Shiraz Saleem Date: Thu Jul 10 03:24:45 2025 -0700 RDMA/mana_ib: Fix DSCP value in modify QP Convert the traffic_class in GRH to a DSCP value as required by the HW. Fixes: e095405b45bb ("RDMA/mana_ib: Modify QP state") Signed-off-by: Shiraz Saleem Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/1752143085-4169-1-git-send-email-kotaranov@linux.microsoft.com Reviewed-by: Long Li Signed-off-by: Leon Romanovsky commit 9fb3dd85197f5e5901a81b104a0f8b513148d138 Author: Michael Margolin Date: Tue Jul 8 20:23:08 2025 +0000 RDMA/efa: Add CQ with external memory support Add an option to create CQ using external memory instead of allocating in the driver. The memory can be passed from userspace by dmabuf fd and an offset or a VA. One of the possible usages is creating CQs that reside in accelerator memory, allowing low latency asynchronous direct polling from the accelerator device. Add a capability bit to reflect on the feature support. Reviewed-by: Daniel Kranzdorf Reviewed-by: Yonatan Nachum Signed-off-by: Michael Margolin Link: https://patch.msgid.link/20250708202308.24783-4-mrgolin@amazon.com Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit c897c2c8b8e82981df10df546c753ac857612937 Author: Michael Margolin Date: Tue Jul 8 20:23:07 2025 +0000 RDMA/core: Add umem "is_contiguous" and "start_dma_addr" helpers In some cases drivers may need to check if a given umem is contiguous. Add a helper function in core code so that drivers don't need to deal with umem or scatter-gather lists structure. Additionally add a helper for getting umem's start DMA address and use it in other helper functions that open code it. Signed-off-by: Michael Margolin Link: https://patch.msgid.link/20250708202308.24783-3-mrgolin@amazon.com Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit 1a40c362ae265ca4004f7373b34c22af6810f6cb Author: Michael Margolin Date: Tue Jul 8 20:23:06 2025 +0000 RDMA/uverbs: Add a common way to create CQ with umem Add ioctl command attributes and a common handling for the option to create CQs with memory buffers passed from userspace. When required attributes are supplied, create umem and provide it for driver's use. The extension enables creation of CQs on top of preallocated CPU virtual or device memory buffers, by supplying VA or dmabuf fd, in a common way. Drivers can support this flow by initializing a new create_cq_umem fp field in their ops struct, with a function that can handle the new parameter. Signed-off-by: Michael Margolin Link: https://patch.msgid.link/20250708202308.24783-2-mrgolin@amazon.com Reviewed-by: Jason Gunthorpe Signed-off-by: Leon Romanovsky commit cd1746cb6555a2238c4aae9f9d60b637a61bf177 Author: Daniel Jurgens Date: Wed Jul 9 15:41:07 2025 +0300 net/mlx5: IFC updates for disabled host PF The port 2 host PF can be disabled, this bit reflects that setting. Signed-off-by: Daniel Jurgens Reviewed-by: William Tu Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1752064867-16874-3-git-send-email-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit cbe080f931f48bc7b054008fc2567d1c8c247a89 Author: Carolina Jubran Date: Wed Jul 9 15:41:06 2025 +0300 net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc Introduce the `disciplined_fr_counter` capability bit to indicate that the device’s free-running cycle counter is disciplined to real-time. Signed-off-by: Carolina Jubran Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Link: https://patch.msgid.link/1752064867-16874-2-git-send-email-tariqt@nvidia.com Signed-off-by: Leon Romanovsky commit e73242aa14d2ec7f4a1a13688366bb36dc0fe5b7 Author: Edward Srouji Date: Wed Jul 9 09:42:11 2025 +0300 RDMA/mlx5: Optimize DMABUF mkey page size The current implementation of DMABUF memory registration uses a fixed page size for the memory key (mkey), which can lead to suboptimal performance when the underlying memory layout may offer better page size. The optimization improves performance by reducing the number of page table entries required for the mkey, leading to less MTT/KSM descriptors that the HCA must go through to find translations, fewer cache-lines, and shorter UMR work requests on mkey updates such as when re-registering or reusing a cacheable mkey. To ensure safe page size updates, the implementation uses a 5-step process: 1. Make the first X entries non-present, while X is calculated to be minimal according to a large page shift that can be used to cover the MR length. 2. Update the page size to the large supported page size 3. Load the remaining N-X entries according to the (optimized) page shift 4. Update the page size according to the (optimized) page shift 5. Load the first X entries with the correct translations This ensures that at no point is the MR accessible with a partially updated translation table, maintaining correctness and preventing access to stale or inconsistent mappings, such as having an mkey advertising the new page size while some of the underlying page table entries still contain the old page size translations. Signed-off-by: Edward Srouji Reviewed-by: Michael Guralnik Link: https://patch.msgid.link/bc05a6b2142c02f96a90635f9a4458ee4bbbf39f.1751979184.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit fcfb03597b7d7737aac6bdfda1f7b5d152cfed73 Author: Michael Guralnik Date: Wed Jul 9 09:42:10 2025 +0300 RDMA/mlx5: Align mkc page size capability check to PRM Align the capabilities checked when using the log_page_size 6th bit in the mkey context to the PRM definition. The upper and lower bounds are set by max/min caps, and modification of the 6th bit by UMR is allowed only when a specific UMR cap is set. Current implementation falsely assumes all page sizes up-to 2^63 are supported when the UMR cap is set. In case the upper bound cap is lower than 63, this might result a FW syndrome on mkey creation, e.g: mlx5_core 0000:c1:00.0: mlx5_cmd_out_err:832:(pid 0): CREATE_MKEY(0×200) op_mod(0×0) failed, status bad parameter(0×3), syndrome (0×38a711), err(-22) Previous cap enforcement is still correct for all current HW, FW and driver combinations. However, this patch aligns the code to be PRM compliant in the general case. Signed-off-by: Michael Guralnik Link: https://patch.msgid.link/eab4eeb4785105a4bb5eb362dc0b3662cd840412.1751979184.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 9879bddf5ab47ad3d889d31ca7550605a4207dba Merge: 98269398c02ab2 c4f96972c3c206 Author: Leon Romanovsky Date: Sun Jul 13 03:00:21 2025 -0400 Optimize DMABUF mkey page size in mlx5 From Edward: This patch series enables the mlx5 driver to dynamically choose the optimal page size for a DMABUF-based memory key (mkey), rather than always registering with a fixed page size. Previously, DMABUF memory registration used a fixed 4K page size for mkeys which could lead to suboptimal performance when the underlying memory layout may offer better page sizes. This approach did not take advantage of larger page size capabilities advertised by the HCA, and the driver was not setting the proper page size mask in the mkey mask when performing page size changes, potentially leading to invalid registrations when updating to a very large pages. This series improves DMABUF performance by dynamically selecting the best page size for a given memory region (MR) both at creation time and on page fault occurrences, based on the underlying layout and fixing related gaps and bugs. By doing so, we reduce the number of page table entries (and thus MTT/ KSM descriptors) that the HCA must traverse, which in turn reduces cache-line fetches. Thanks * mlx5-next: RDMA/mlx5: Fix UMR modifying of mkey page size net/mlx5: Expose HCA capability bits for mkey max page size Signed-off-by: Leon Romanovsky commit c4f96972c3c206ac8f6770b5ecd5320b561d0058 Author: Edward Srouji Date: Wed Jul 9 09:42:09 2025 +0300 RDMA/mlx5: Fix UMR modifying of mkey page size When changing the page size on an mkey, the driver needs to set the appropriate bits in the mkey mask to indicate which fields are being modified. The 6th bit of a page size in mlx5 driver is considered an extension, and this bit has a dedicated capability and mask bits. Previously, the driver was not setting this mask in the mkey mask when performing page size changes, regardless of its hardware support, potentially leading to an incorrect page size updates. This fixes the issue by setting the relevant bit in the mkey mask when performing page size changes on an mkey and the 6th bit of this field is supported by the hardware. Fixes: cef7dde8836a ("net/mlx5: Expand mkey page size to support 6 bits") Signed-off-by: Edward Srouji Reviewed-by: Michael Guralnik Link: https://patch.msgid.link/9f43a9c73bf2db6085a99dc836f7137e76579f09.1751979184.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 8feaf9832be52be16e588029366e27940f6b88ea Author: Michael Guralnik Date: Wed Jul 9 09:42:08 2025 +0300 net/mlx5: Expose HCA capability bits for mkey max page size Expose the HCA capability for maximal page size that can be configured for an mkey. Used for enforcing capabilities when working with highly contiguous memory and using large page sizes. Signed-off-by: Michael Guralnik Link: https://patch.msgid.link/3e4d3fda37934430f65f72601519e22bf396fd05.1751979184.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 4f25d7f1439f12233768dce853260b8302424d16 Author: Frank Li Date: Thu May 22 13:56:51 2025 -0400 arm64: dts: imx8q: add camera ov5640 support for imx8qm-mek and imx8qxp-mek Add ov5640 overlay file for imx8qm-mek and imx8qxp-mek board. Camera can connect different CSI port. So use dts overlay file to handle these difference connect options. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit a073e8577f1816cfd2cff25d0a4ffbeb064b48ae Author: Baolin Liu Date: Tue May 27 13:38:05 2025 +0800 ext4: remove unused EXT_STATS macro from ext4_extents.h The EXT_STATS macro in fs/ext4/ext4_extents.h has been defined but never used in the codebase since its introduction. This patch removes it. Analysis: 1. No references found in fs/ext4/ or other kernel code. 2. No impact on compilation or functionality. 3. Git history shows it was never utilized. Signed-off-by: Baolin Liu Reviewed-by: Baokun Li Link: https://patch.msgid.link/20250527053805.1550912-1-liubaolin12138@163.com Signed-off-by: Theodore Ts'o commit cac3d177c045d1ff88ce4b64859c13de133564ed Merge: fdc3bc3497946c db6cc3f4ac2e6c Author: Andrew Morton Date: Sat Jul 12 14:48:26 2025 -0700 Merge branch 'mm-hotfixes-stable' into mm-stable to pick up changes which are required for a merge of the series "mm: folio_pte_batch() improvements". commit 6e4098382b667e6ef485fbf09cd7ddd2e54fe6aa Author: Jens Axboe Date: Fri Jul 11 15:41:02 2025 -0600 io_uring/poll: cleanup apoll freeing No point having REQ_F_POLLED in both IO_REQ_CLEAN_FLAGS and in IO_REQ_CLEAN_SLOW_FLAGS, and having both io_free_batch_list() and then io_clean_op() check for it and clean it. Move REQ_F_POLLED to IO_REQ_CLEAN_SLOW_FLAGS and drop it from IO_REQ_CLEAN_FLAGS, and have only io_free_batch_list() do the check and freeing. Link: https://lore.kernel.org/io-uring/20250712000344.1579663-2-axboe@kernel.dk Signed-off-by: Jens Axboe commit 7b41a2341fa62babda5d5c7a32c632e9eba2ee11 Author: Sebastian Reichel Date: Mon Jul 7 01:26:58 2025 +0200 power: supply: core: fix static checker warning static checker complains, that the block already breaks if IS_ERR(np) and thus the extra !IS_ERR(np) check in the while condition is superfluous. Avoid the extra check by using while(true) instead. This should not change the runtime behavior at all and I expect the binary to be more or less the same for an optimizing compiler. Fixes: f368f87b22da ("power: supply: core: convert to fwnnode") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-pm/285c9c39-482c-480c-8b0b-07111e39fdfe@sabinyo.mountain/ Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250707-fix-psy-static-checker-warning-v1-1-42d555c2b68a@collabora.com Signed-off-by: Sebastian Reichel commit e07caae73557d144a9237fb977dfee08befa015f Author: Sebastian Chlad Date: Wed Jul 2 18:40:10 2025 +0200 selftests: cgroup: Fix missing newline in test_zswap_writeback_one Fixes malformed test output due to missing newline Signed-off-by: Sebastian Chlad Signed-off-by: Tejun Heo commit c7d7713e36a6ab4c42e40c952d5ba7a51b1091b0 Author: Sebastian Chlad Date: Wed Jul 2 15:23:36 2025 +0200 selftests: cgroup: Allow longer timeout for kmem_dead_cgroups cleanup The test_kmem_dead_cgroups test currently assumes that RCU and memory reclaim will complete within 5 seconds. In some environments this timeout may be insufficient, leading to spurious test failures. This patch introduces max_time set to 20 which is then used in the test. After 5th sec the debug message is printed to indicate the cleanup is still ongoing. In the system under test with 16 CPUs the original test was failing most of the time and the cleanup time took usually approx. 6sec. Further tests were conducted with and without do_rcu_barrier and the results (respectively) are as follow: quantiles 0 0.25 0.5 0.75 1 1 2 3 8 20 (mean = 4.7667) 3 5 8 8 20 (mean = 7.6667) Acked-by: Michal Koutny Signed-off-by: Sebastian Chlad Signed-off-by: Tejun Heo commit 95a042a0c8ecd3c1e886648f6f6ab9c7e4403db9 Author: Takashi Sakamoto Date: Thu Jul 10 22:19:16 2025 +0900 firewire: ohci: reduce the size of common context structure by extracting members into AT structure In commit 386a4153a2c1 ("firewire: ohci: cache the context run bit"), a running member was added to the context structure to cache the running state of a given DMA context. Although this member is accessible from IR, IT, and AT contexts, it is currently used only by the AT context. Additionally, the context structure includes a work item, which is also used by the AT context. Both members are unnecessary for IR and IT contexts. This commit refactors the code by moving these two members into a new structure specific to AT context. Link: https://lore.kernel.org/r/20250710131916.31289-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 203b862057d08fbabcd4e475707751c0f2a9258b Author: Matthew Gerlach Date: Wed Jun 25 08:14:42 2025 -0700 arm64: dts: altera: socfpga_stratix10: update internal oscillators Add the clock-frequency property to the cb_intosc_ls_clk and cb_intosc_hs_div2_clk device tree nodes. The f2s_free_clk is implemented by custom logic in the FPGA; so it should be disabled in the dtsi by default and enabled by a dts for a specific FPGA design on a specific board. Signed-off-by: Matthew Gerlach Signed-off-by: Dinh Nguyen commit 1dfe3ca86a9c43e2e49be6c4235b3170c5059e46 Author: Dinh Nguyen Date: Sun Jun 22 06:52:49 2025 -0500 arm64: dts: socfpga: swvp: remove phy-addr in the GMAC node This addresses this warning: socfpga_stratix10_swvp.dtb: ethernet@ff800000 (altr,socfpga-stmmac-a10-s10): 'phy-addr' does not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Dinh Nguyen commit 6c6a4d395d0e1be2e99c4f7bc48ddd009ba795e5 Author: Dinh Nguyen Date: Thu Jun 5 13:19:20 2025 -0500 arm64: dts: socfpga: swvp: remove cpu1-start-addr The cpu1-start-addr property is only applicable to 32-bit SoCFPGA platforms. Removing this property will take care of warnings like this: socfpga_stratix10_swvp.dtb: sysmgr@ffd12000: cpu1-start-addr: False schema does not allow 4291846704 Signed-off-by: Dinh Nguyen commit 501b04d5a824015638d49d705d3a5ce05ca5ba5c Author: Dinh Nguyen Date: Wed Jun 4 15:18:07 2025 -0500 arm64: dts: socfpga: swvp: remove altr,modrst-offset 'altr,modrst-offset' property is not applicable for arm64 SoCFPGA platforms. This will fix this dtbs_check warning: socfpga_stratix10_swvp.dtb: rstmgr@ffd11000: altr,modrst-offset: False schema does not allow 32 Signed-off-by: Dinh Nguyen commit 1de7dfb3594033cff9882642ae404354e5f19627 Author: Dinh Nguyen Date: Wed Jun 4 14:49:55 2025 -0500 arm64: dts: socfpga: stratix10: fix dtbs_check for rstmgr Add the default "altr,rst-mgr" to the rstmgr node on Stratix10. This fixes this warning: arch/arm64/boot/dts/altera:33:10 rstmgr@ffd11000 (altr,stratix10-rst-mgr): compatible: 'oneOf' conditional failed, one must be fixed: Signed-off-by: Dinh Nguyen commit cd51991a21e7b4780cac3b17bf5d89d07df13266 Author: Dinh Nguyen Date: Wed Jun 4 13:44:08 2025 -0500 arm64: dts: socfpga: agilex: fix dtbs_check warning for f2s-free-clk The f2s-free-clk requires a clock-frequency value. We put in an arbitrary value of 100 MHz for a constant. The true clock frequency would get generated in an FPGA design and the bootloader will populated in actual hardware designs. This fixes warning like this: arch/arm64/boot/dts/intel:34:8 4 f2s-free-clk (fixed-clock): 'clock-frequency' is a required property Signed-off-by: Dinh Nguyen commit c0ffeb648000acdc932da7a9d33fd65e9263c54c Author: Zheng Qixing Date: Mon Jul 7 15:54:12 2025 +0800 md: allow removing faulty rdev during resync During RAID resync, faulty rdev cannot be removed and will result in "Device or resource busy" error when attempting hot removal. Reproduction steps: mdadm -Cv /dev/md0 -l1 -n3 -e1.2 /dev/sd{b..d} mdadm /dev/md0 -f /dev/sdb mdadm /dev/md0 -r /dev/sdb -> mdadm: hot remove failed for /dev/sdb: Device or resource busy After commit 4b10a3bc67c1 ("md: ensure resync is prioritized over recovery"), when a device becomes faulty during resync, the md_choose_sync_action() function returns early without calling remove_and_add_spares(), preventing faulty device removal. This patch extracts a helper function remove_spares() to support removing faulty devices during RAID resync operations. Fixes: 4b10a3bc67c1 ("md: ensure resync is prioritized over recovery") Signed-off-by: Zheng Qixing Reviewed-by: Li Nan Link: https://lore.kernel.org/linux-raid/20250707075412.150301-1-zhengqixing@huaweicloud.com Signed-off-by: Yu Kuai commit 3ec8db61e7852b0d0637483c8fd249533d701bff Author: Ryo Takakura Date: Sun Jun 1 10:37:02 2025 +0900 md/raid5: unset WQ_CPU_INTENSIVE for raid5 unbound workqueue When specified with WQ_CPU_INTENSIVE, the workqueue doesn't participate in concurrency management. This behaviour is already accounted for WQ_UNBOUND workqueues given that they are assigned to their own worker threads. Unset WQ_CPU_INTENSIVE as the use of flag has no effect when used with WQ_UNBOUND. Signed-off-by: Ryo Takakura Acked-by: Tejun Heo Link: https://lore.kernel.org/linux-raid/20250601013702.64640-1-ryotkkr98@gmail.com Signed-off-by: Yu Kuai commit 790abe4d77af736e2521ef121fae8c6ed2799773 Author: Xiao Ni Date: Wed Jun 11 15:31:08 2025 +0800 md: remove/add redundancy group only in level change del_gendisk is called in synchronous way now. So it doesn't need to handle redundancy group in stop path separately. Reviewed-by: Yu Kuai Signed-off-by: Xiao Ni Link: https://lore.kernel.org/linux-raid/20250611073108.25463-4-xni@redhat.com Signed-off-by: Yu Kuai commit 5f286f33553d600e6c2fb5a23dd6afcf99b3ebac Author: Xiao Ni Date: Wed Jun 11 15:31:07 2025 +0800 md: Don't clear MD_CLOSING until mddev is freed UNTIL_STOP is used to avoid mddev is freed on the last close before adding disks to mddev. And it should be cleared when stopping an array which is mentioned in commit efeb53c0e572 ("md: Allow md devices to be created by name."). So reset ->hold_active to 0 in md_clean. And MD_CLOSING should be kept until mddev is freed to avoid reopen. Reviewed-by: Yu Kuai Signed-off-by: Xiao Ni Link: https://lore.kernel.org/linux-raid/20250611073108.25463-3-xni@redhat.com Signed-off-by: Yu Kuai commit 9e59d609763f70a992a8f3808dabcce60f14eb5c Author: Xiao Ni Date: Wed Jun 11 15:31:06 2025 +0800 md: call del_gendisk in control path Now del_gendisk and put_disk are called asynchronously in workqueue work. The asynchronous way has a problem that the device node can still exist after mdadm --stop command returns in a short window. So udev rule can open this device node and create the struct mddev in kernel again. So put del_gendisk in control path and still leave put_disk in md_kobj_release to avoid uaf of gendisk. Function del_gendisk can't be called with reconfig_mutex. If it's called with reconfig mutex, a deadlock can happen. del_gendisk waits all sysfs files access to finish and sysfs file access waits reconfig mutex. So put del_gendisk after releasing reconfig mutex. But there is still a window that sysfs can be accessed between mddev_unlock and del_gendisk. So some actions (add disk, change level, .e.g) can happen which lead unexpected results. MD_DELETED is used to resolve this problem. MD_DELETED is set before releasing reconfig mutex and it should be checked for these sysfs access which need reconfig mutex. For sysfs access which don't need reconfig mutex, del_gendisk will wait them to finish. But it doesn't need to do this in function mddev_lock_nointr. There are ten places that call it. * Five of them are in dm raid which we don't need to care. MD_DELETED is only used for md raid. * stop_sync_thread, md_do_sync and md_start_sync are related sync request, and it needs to wait sync thread to finish before stopping an array. * md_ioctl: md_open is called before md_ioctl, so ->openers is added. It will fail to stop the array. So it doesn't need to check MD_DELETED here * md_set_readonly: It needs to call mddev_set_closing_and_sync_blockdev when setting readonly or read_auto. So it will fail to stop the array too because MD_CLOSING is already set. Reviewed-by: Yu Kuai Signed-off-by: Xiao Ni Link: https://lore.kernel.org/linux-raid/20250611073108.25463-2-xni@redhat.com Signed-off-by: Yu Kuai commit 082c6a2d06c0831d236760a29953355845eee988 Author: Mikhail Kalashnikov Date: Thu Jul 3 23:11:31 2025 +0800 arm64: dts: allwinner: A523: Add SID controller node The SID controller should be compatible with A64 and others SoC with 0x200 offset. Signed-off-by: Mikhail Kalashnikov Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250703151132.2642378-8-iuncuim@gmail.com [wens@csie.org: Fixed position of SID device node] Signed-off-by: Chen-Yu Tsai commit 8f128f357dfe5907a6f3432ffb1f444e93f1fbf2 Author: Paul Kocialkowski Date: Mon Jul 7 18:51:55 2025 +0200 arm64: dts: allwinner: a133-liontron-h-a133l: Add Ethernet support The Liontron H-A133L board features an Ethernet controller with a JLSemi JL1101 PHY. Its reset pin is tied to the PH12 GPIO. Note that the reset pin must be handled as a bus-wide reset GPIO in order to let the MDIO core properly reset it before trying to read its identification registers. There's no other device on the MDIO bus. The datasheet of the PHY mentions that the reset signal must be held for 1 ms to take effect. Make it 2 ms (and the same for post-delay) to be on the safe side without wasting too much time during boot. Signed-off-by: Paul Kocialkowski Reviewed-by: Andre Przywara Tested-by: Andre Przywara Link: https://patch.msgid.link/20250707165155.581579-5-paulk@sys-base.io Signed-off-by: Chen-Yu Tsai commit 4e3be5629f1f6de30d3fbcdc357e7da948ccf698 Author: Paul Kocialkowski Date: Mon Jul 7 18:51:54 2025 +0200 arm64: dts: allwinner: a100: Add EMAC support The Allwinner A100/A133 Ethernet MAC (EMAC) is compatible with the A64 one and needs access to the syscon register for control of the top-level integration of the unit. Note that there are two such controllers on the sun50iw10 die, which are the same unit with a different top-level syscon register offset. Signed-off-by: Paul Kocialkowski Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250707165155.581579-4-paulk@sys-base.io Signed-off-by: Chen-Yu Tsai commit 28e4499a9ad68129d41db10b7481c61738fdb3d1 Author: Paul Kocialkowski Date: Mon Jul 7 18:51:53 2025 +0200 arm64: dts: allwinner: a100: Add pin definitions for RGMII/RMII The Allwinner A100/A133 supports both RGMII and RMII for its Ethernet MAC (EMAC) controller. Add corresponding pin definitions. Note that the sun50iw10 die actually includes two ethernet controllers, the second of which is rarely exposed to pins. Call the first controller "emac0" to distinguish it from the second that may be added later. Signed-off-by: Paul Kocialkowski Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250707165155.581579-3-paulk@sys-base.io Signed-off-by: Chen-Yu Tsai commit d968e50b5c26642754492dea23cbd3592bde62d8 Author: Detlev Casanova Date: Mon Jun 23 12:07:22 2025 -0400 media: rkvdec: Unstage the driver The TODO list for unstaging being empty, the driver can now be moved to the main media folder. Also add myself as maintainer. Signed-off-by: Detlev Casanova Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit e165f6eda53519d31ecb58603a53fcb03fd75eb5 Author: Detlev Casanova Date: Mon Jun 23 12:07:21 2025 -0400 media: rkvdec: Remove TODO file 2 items are present in the TODO file: - HEVC support - Evaluate adding helper for rkvdec_request_validate Missing HEVC support is not a reason for a driver to be in staging, support for different features of the hardware can be added in drivers in the main tree. The rkvdec_request_validate function was simplified in commit 54676d5f5630 ("media: rkvdec: Do not require all controls to be present in every request") by not setting controls that have not changed. As it now basically just calls vb2_request_validate(), there is no need for a helper. Signed-off-by: Detlev Casanova Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit a5c4a652647609938e0ce4ff1f3d4ad4cdac6262 Author: Detlev Casanova Date: Mon Jun 23 12:07:16 2025 -0400 media: dt-bindings: rockchip: Add RK3576 Video Decoder bindings The video decoder in RK3576 (vdpu383) is described the same way as the one in RK3588 (vdpu381). A new compatible is added as the driver implementation will be different. Signed-off-by: Detlev Casanova Acked-by: Rob Herring (Arm) Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit c6ffb7e1fb90b28d95b054564f89a3fba0e0d077 Author: Detlev Casanova Date: Mon Jun 23 12:07:15 2025 -0400 media: dt-bindings: rockchip: Document RK3588 Video Decoder bindings Document the Rockchip RK3588 Video Decoder bindings. Signed-off-by: Detlev Casanova Reviewed-by: Conor Dooley Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 77ce8e4d6de72a4b8b8c4595a8c1c2305f3ac469 Author: Ming Qian Date: Thu Apr 24 18:33:24 2025 +0800 media: amphion: Support dmabuf and v4l2 buffer without binding When using VB2_DMABUF, the relationship between dma-buf and v4l2 buffer may not one-to-one, a single dma-buf may be queued via different v4l2 buffers, and different dma-bufs may be queued via the same v4l2 buffer, so it's not appropriate to use the v4l2 buffer index as the frame store id. We can generate a frame store id according to the dma address. Then for a given dma-buf, the id is fixed. Driver now manages the frame store and vb2-buffer states independently. When a dmabuf is queued via another v4l2 buffer before the buffer is released by firmware, need to pend it until firmware release it. Signed-off-by: Ming Qian Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 3f6702e1be8a06e70c60720162a77c8b3a4b69d3 Author: Hugues Fruchet Date: Thu Nov 21 14:19:04 2024 +0100 media: verisilicon: postproc: 4K support Support input larger than 4096x2048 using extended input width/height fields of swreg92. This is needed to decode large WebP or JPEG pictures. Signed-off-by: Hugues Fruchet Reviewed-by: Nicolas Dufresne Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit f7546da1d6eb8928efb89b7faacbd6c2f8f0de5c Author: Marek Szyprowski Date: Fri Jul 11 11:41:58 2025 +0200 media: v4l2: Add support for NV12M tiled variants to v4l2_format_info() Commit 6f1466123d73 ("media: s5p-mfc: Add YV12 and I420 multiplanar format support") added support for the new formats to s5p-mfc driver, what in turn required some internal calls to the v4l2_format_info() function while setting up formats. This in turn broke support for the "old" tiled NV12MT* formats, which are not recognized by this function. Fix this by adding those variants of NV12M pixel format to v4l2_format_info() function database. Fixes: 6f1466123d73 ("media: s5p-mfc: Add YV12 and I420 multiplanar format support") Cc: stable@vger.kernel.org Signed-off-by: Marek Szyprowski Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 33927f3d0ecdcff06326d6e4edb6166aed42811c Author: Al Viro Date: Sat Jul 12 06:02:31 2025 +0100 habanalabs: fix UAF in export_dmabuf() As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland (it's a race, but it's a userland race and there's nothing the kernel can do about it). However, if we follow fd_install() with any kind of access to objects that would be destroyed on close (be it the struct file itself or anything destroyed by its ->release()), we have a UAF. dma_buf_fd() is a combination of reserving a descriptor and fd_install(). habanalabs export_dmabuf() calls it and then proceeds to access the objects destroyed on close. In particular, it grabs an extra reference to another struct file that will be dropped as part of ->release() for ours; that "will be" is actually "might have already been". Fix that by reserving descriptor before anything else and do fd_install() only when everything had been set up. As a side benefit, we no longer have the failure exit with file already created, but reference to underlying file (as well as ->dmabuf_export_cnt, etc.) not grabbed yet; unlike dma_buf_fd(), fd_install() can't fail. Fixes: db1a8dd916aa ("habanalabs: add support for dma-buf exporter") Signed-off-by: Al Viro commit 7e49538288e523427beedd26993d446afef1a6fb Author: Jan Kara Date: Fri Jul 11 18:32:03 2025 +0200 loop: Avoid updating block size under exclusive owner Syzbot came up with a reproducer where a loop device block size is changed underneath a mounted filesystem. This causes a mismatch between the block device block size and the block size stored in the superblock causing confusion in various places such as fs/buffer.c. The particular issue triggered by syzbot was a warning in __getblk_slow() due to requested buffer size not matching block device block size. Fix the problem by getting exclusive hold of the loop device to change its block size. This fails if somebody (such as filesystem) has already an exclusive ownership of the block device and thus prevents modifying the loop device under some exclusive owner which doesn't expect it. Reported-by: syzbot+01ef7a8da81a975e1ccd@syzkaller.appspotmail.com Signed-off-by: Jan Kara Tested-by: syzbot+01ef7a8da81a975e1ccd@syzkaller.appspotmail.com Link: https://lore.kernel.org/r/20250711163202.19623-2-jack@suse.cz Signed-off-by: Jens Axboe commit a52f9f0d77f20efc285908a28b5697603b6597c7 Merge: 19d181d8a0c20f 7dc284702bcd06 Author: Jakub Kicinski Date: Fri Jul 11 17:50:26 2025 -0700 Merge tag 'batadv-next-pullrequest-20250710' of git://git.open-mesh.org/linux-merge Simon Wunderlich says: ==================== This cleanup patchset includes the following patches: - bump version strings, by Simon Wunderlich - batman-adv: store hard_iface as iflink private data, by Matthias Schiffer * tag 'batadv-next-pullrequest-20250710' of git://git.open-mesh.org/linux-merge: batman-adv: store hard_iface as iflink private data batman-adv: Start new development cycle ==================== Link: https://patch.msgid.link/20250710164501.153872-1-sw@simonwunderlich.de Signed-off-by: Jakub Kicinski commit 19d181d8a0c20fda43c820dbddb1cb4bd477b81c Merge: a393644d7d1614 2d925db5b2c6e0 Author: Jakub Kicinski Date: Fri Jul 11 17:33:06 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== ice: cleanups and preparation for live migration Jake Keller says: Various cleanups and preparation to the ice driver code for supporting SR-IOV live migration. The logic for unpacking Rx queue context data is added. This is the inverse of the existing packing logic. Thanks to this is trivial to add. Code to enable both reading and writing the Tx queue context for a queue over a shared hardware register interface is added. Thanks to ice_adapter, this is locked across all PFs that need to use it, preventing concurrency issues with multiple PFs. The RSS hash configuration requested by a VF is cached within the VF structure. This will be used to track and restore the same configuration during migration load. ice_sriov_set_msix_vec_count() is updated to use pci_iov_vf_id() instead of open-coding a worse equivalent, and checks to avoid rebuilding MSI-X if the current request is for the existing amount of vectors. A new ice_get_vf_by_dev() helper function is added to simplify accessing a VF from its PCI device structure. This will be used more heavily within the live migration code itself. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: introduce ice_get_vf_by_dev() wrapper ice: avoid rebuilding if MSI-X vector count is unchanged ice: use pci_iov_vf_id() to get VF ID ice: expose VF functions used by live migration ice: move ice_vsi_update_l2tsel to ice_lib.c ice: save RSS hash configuration for migration ice: add functions to get and set Tx queue context ice: add support for reading and unpacking Rx queue context ==================== Link: https://patch.msgid.link/20250710214518.1824208-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit a393644d7d161430207b9de167b798d05c7d684a Author: Alok Tiwari Date: Thu Jul 10 11:37:34 2025 -0700 net: ll_temac: Fix incorrect PHY node reference in debug message In temac_probe(), the debug message intended to print the resolved PHY node was mistakenly using the controller node temac_np instead of the actual PHY node lp->phy_node. This patch corrects the log to reference the correct device tree node. Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250710183737.2385156-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit f0600fe94986f70f433f4a1a0664658a079b2feb Author: Eric Dumazet Date: Thu Jul 10 15:56:41 2025 +0000 selftests/net: packetdrill: add --mss option to three tests Three tests are cooking GSO packets but do not provide gso_size information to the kernel, triggering this message: TCP: tun0: Driver has suspect GRO implementation, TCP performance may be compromised. Add --mss option to avoid this warning. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250710155641.3028726-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9ae277096fab54cfa01a6dc8b8ca93bc0907b700 Merge: 650fe2a9dd2900 963c94c95a3161 Author: Jakub Kicinski Date: Fri Jul 11 17:00:19 2025 -0700 Merge branch 'netdevsim-support-setting-a-permanent-address' Toke Høiland-Jørgensen says: ==================== netdevsim: support setting a permanent address Network management daemons that match on the device permanent address currently have no virtual interface types to test against. NetworkManager, in particular, has carried an out of tree patch to set the permanent address on netdevsim devices to use in its CI for this purpose. This series adds support to netdevsim to set a permanent address on port creation, and adds a test script to test setting and getting of the different L2 address types. v3: https://lore.kernel.org/20250706-netdevsim-perm_addr-v3-0-88123e2b2027@redhat.com v2: https://lore.kernel.org/20250702-netdevsim-perm_addr-v2-0-66359a6288f0@redhat.com v1: https://lore.kernel.org/20250203-netdevsim-perm_addr-v1-1-10084bc93044@redhat.com ==================== Link: https://patch.msgid.link/20250710-netdevsim-perm_addr-v4-0-c9db2fecf3bf@redhat.com Signed-off-by: Jakub Kicinski commit 963c94c95a3161487b0e3d9f75848b3c161e9def Author: Toke Høiland-Jørgensen Date: Thu Jul 10 13:18:34 2025 +0200 selftests: net: add netdev-l2addr.sh for testing L2 address functionality Add a new test script to the network selftests which tests getting and setting of layer 2 addresses through netlink, including the newly added support for setting a permaddr on netdevsim devices. Reviewed-by: Simon Horman Signed-off-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250710-netdevsim-perm_addr-v4-2-c9db2fecf3bf@redhat.com Signed-off-by: Jakub Kicinski commit 54cb59cf81b02de847178c054eed7957170e9386 Author: Toke Høiland-Jørgensen Date: Thu Jul 10 13:18:33 2025 +0200 net: netdevsim: Support setting dev->perm_addr on port creation Network management daemons that match on the device permanent address currently have no virtual interface types to test against. NetworkManager, in particular, has carried an out of tree patch to set the permanent address on netdevsim devices to use in its CI for this purpose. To support this use case, support setting netdev->perm_addr when creating a netdevsim port. Reviewed-by: Simon Horman Signed-off-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250710-netdevsim-perm_addr-v4-1-c9db2fecf3bf@redhat.com Signed-off-by: Jakub Kicinski commit 650fe2a9dd290078b782fb2e13dd4f5104a5de8b Author: Vishwanath Seshagiri Date: Thu Jul 10 09:53:37 2025 -0700 selftests: flip local/remote endpoints in iou-zcrx.py The iou-zcrx selftest currently runs the server on the remote host and the client on the local host. This commit flips the endpoints such that server runs on localhost and client on remote. This change brings the iou-zcrx selftest in convention with other selftests. Drive-by fix for a missing import exception that happens when the network interface has less than 2 combined channels. Test plan: ran iou-zcrx.py selftest between 2 physical machines Signed-off-by: Vishwanath Seshagiri Link: https://patch.msgid.link/20250710165337.614159-1-vishs@meta.com Signed-off-by: Jakub Kicinski commit 4159a55f29e153e3d1d9f78f9476a022368f26b0 Author: Edward Cree Date: Thu Jul 10 18:32:13 2025 +0100 sfc: falcon: refactor and document ef4_ethtool_get_rxfh_fields The code had some rather odd control flow inherited from when it was shared with siena and ef10 before this driver was split out. Simplify that for easier reading. Also add a comment explaining why we return the values we do, since some Falcon documents and datasheets confusingly mention the part supporting 4-tuple UDP hashing. (I couldn't find any record of exactly what was "broken" about the original Falcon A hash, I'm just trusting that falcon_init_rx_cfg() had a good reason for not using it.) Signed-off-by: Edward Cree Link: https://patch.msgid.link/20250710173213.1638397-1-edward.cree@amd.com Signed-off-by: Jakub Kicinski commit f45b45cbfae394583394051444f766fff3c151f5 Merge: 0346000aaab8cf 1f376373bd225c Author: Jakub Kicinski Date: Fri Jul 11 16:01:23 2025 -0700 Merge branch 'net_sched-act-extend-rcu-use-in-dump-methods' Eric Dumazet says: ==================== net_sched: act: extend RCU use in dump() methods We are trying to get away from central RTNL in favor of fine-grained mutexes. While looking at net/sched, I found that act already uses RCU in the fast path for the most cases, and could also be used in dump() methods. This series is not complete and will be followed by a second one. v1: https://lore.kernel.org/20250707130110.619822-1-edumazet@google.com ==================== Link: https://patch.msgid.link/20250709090204.797558-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1f376373bd225c90381b745e38fa65a9386f7f8e Author: Eric Dumazet Date: Wed Jul 9 09:02:03 2025 +0000 net_sched: act_skbedit: use RCU in tcf_skbedit_dump() Also storing tcf_action into struct tcf_skbedit_params makes sure there is no discrepancy in tcf_skbedit_act(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250709090204.797558-12-edumazet@google.com Signed-off-by: Jakub Kicinski commit cec7a5c6c695ba2226b6120dc330e3bea3ea96f8 Author: Eric Dumazet Date: Wed Jul 9 09:02:02 2025 +0000 net_sched: act_police: use RCU in tcf_police_dump() Also storing tcf_action into struct tcf_police_params makes sure there is no discrepancy in tcf_police_act(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250709090204.797558-11-edumazet@google.com Signed-off-by: Jakub Kicinski commit 9d096746572616a50cac4906f528a1959c0ee1c2 Author: Eric Dumazet Date: Wed Jul 9 09:02:01 2025 +0000 net_sched: act_pedit: use RCU in tcf_pedit_dump() Also storing tcf_action into struct tcf_pedit_params makes sure there is no discrepancy in tcf_pedit_act(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250709090204.797558-10-edumazet@google.com Signed-off-by: Jakub Kicinski commit 5d28928668a2ef6182401ddca7ab4064bf349e3e Author: Eric Dumazet Date: Wed Jul 9 09:02:00 2025 +0000 net_sched: act_nat: use RCU in tcf_nat_dump() Also storing tcf_action into struct tcf_nat_params makes sure there is no discrepancy in tcf_nat_act(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250709090204.797558-9-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8151684e339996ffe6d65968c5eea154366539f4 Author: Eric Dumazet Date: Wed Jul 9 09:01:59 2025 +0000 net_sched: act_mpls: use RCU in tcf_mpls_dump() Also storing tcf_action into struct tcf_mpls_params makes sure there is no discrepancy in tcf_mpls_act(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250709090204.797558-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit 799c94178cf9c9e80575b05b7479396de8b42b61 Author: Eric Dumazet Date: Wed Jul 9 09:01:58 2025 +0000 net_sched: act_ctinfo: use RCU in tcf_ctinfo_dump() Also storing tcf_action into struct tcf_ctinfo_params makes sure there is no discrepancy in tcf_ctinfo_act(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250709090204.797558-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit d300335b4e18672913dd792ff9f49e6cccf41d26 Author: Eric Dumazet Date: Wed Jul 9 09:01:57 2025 +0000 net_sched: act_ctinfo: use atomic64_t for three counters Commit 21c167aa0ba9 ("net/sched: act_ctinfo: use percpu stats") missed that stats_dscp_set, stats_dscp_error and stats_cpmark_set might be written (and read) locklessly. Use atomic64_t for these three fields, I doubt act_ctinfo is used heavily on big SMP hosts anyway. Fixes: 24ec483cec98 ("net: sched: Introduce act_ctinfo action") Signed-off-by: Eric Dumazet Cc: Pedro Tammela Link: https://patch.msgid.link/20250709090204.797558-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit 554e66bad84ce4181ad91a2ae9cc74c7c440e836 Author: Eric Dumazet Date: Wed Jul 9 09:01:56 2025 +0000 net_sched: act_ct: use RCU in tcf_ct_dump() Also storing tcf_action into struct tcf_ct_params makes sure there is no discrepancy in tcf_ct_act(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250709090204.797558-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit ba9dc9c14038b5f721e193f9e69ab73fd2f7bdd2 Author: Eric Dumazet Date: Wed Jul 9 09:01:55 2025 +0000 net_sched: act_csum: use RCU in tcf_csum_dump() Also storing tcf_action into struct tcf_csum_params makes sure there is no discrepancy in tcf_csum_act(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250709090204.797558-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 0d752877705c0252ef2726e4c63c5573f048951c Author: Eric Dumazet Date: Wed Jul 9 09:01:54 2025 +0000 net_sched: act_connmark: use RCU in tcf_connmark_dump() Also storing tcf_action into struct tcf_connmark_parms makes sure there is no discrepancy in tcf_connmark_act(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250709090204.797558-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 30dbb2d0e16fce445581049ebcd9043837a843ac Author: Eric Dumazet Date: Wed Jul 9 09:01:53 2025 +0000 net_sched: act: annotate data-races in tcf_lastuse_update() and tcf_tm_dump() tcf_tm_dump() reads fields that can be changed concurrently, and tcf_lastuse_update() might race against itself. Add READ_ONCE() and WRITE_ONCE() annotations. Fetch jiffies once in tcf_tm_dump(). Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250709090204.797558-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 0346000aaab8cf8baf4ae40c48a5779a03971e80 Author: Jakub Kicinski Date: Wed Jul 9 13:59:10 2025 -0700 eth: fbnic: fix ubsan complaints about OOB accesses UBSAN complains that we reach beyond the end of the log entry: UBSAN: array-index-out-of-bounds in drivers/net/ethernet/meta/fbnic/fbnic_fw_log.c:94:50 index 71 is out of range for type 'char [*]' Call Trace: ubsan_epilogue+0x5/0x2b fbnic_fw_log_write+0x120/0x960 fbnic_fw_parse_logs+0x161/0x210 We're just taking the address of the character after the array, so this really seems like something that should be legal. But whatever, easy enough to silence by doing direct pointer math. Fixes: c2b93d6beca8 ("eth: fbnic: Create ring buffer for firmware logs") Reviewed-by: Alexander Duyck Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250709205910.3107691-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2f82e99546626719816e881ebd468688447cac1f Author: Liming Wu Date: Thu Jul 10 10:32:08 2025 +0800 virtio_net: simplify tx queue wake condition check Consolidate the two nested if conditions for checking tx queue wake conditions into a single combined condition. This improves code readability without changing functionality. And move netif_tx_wake_queue into if condition to reduce unnecessary checks for queue stops. Signed-off-by: Liming Wu Tested-by: Lei Yang Acked-by: Jason Wang Link: https://patch.msgid.link/20250710023208.846-1-liming.wu@jaguarmicro.com Signed-off-by: Jakub Kicinski commit ecdec65ec78d67d3ebd17edc88b88312054abe0d Author: William Liu Date: Tue Jul 8 16:44:05 2025 +0000 selftests/tc-testing: Add tests for restrictions on netem duplication Ensure that a duplicating netem cannot exist in a tree with other netems in both qdisc addition and change. This is meant to prevent the soft lockup and OOM loop scenario discussed in [1]. Also adjust a HFSC's re-entrancy test case with netem for this new restriction - KASAN still triggers upon its failure. [1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/ Signed-off-by: William Liu Reviewed-by: Savino Dicanosa Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20250708164219.875521-1-will@willsroot.io Signed-off-by: Jakub Kicinski commit ec8e0e3d7adef940cdf9475e2352c0680189d14e Author: William Liu Date: Tue Jul 8 16:43:26 2025 +0000 net/sched: Restrict conditions for adding duplicating netems to qdisc tree netem_enqueue's duplication prevention logic breaks when a netem resides in a qdisc tree with other netems - this can lead to a soft lockup and OOM loop in netem_dequeue, as seen in [1]. Ensure that a duplicating netem cannot exist in a tree with other netems. Previous approaches suggested in discussions in chronological order: 1) Track duplication status or ttl in the sk_buff struct. Considered too specific a use case to extend such a struct, though this would be a resilient fix and address other previous and potential future DOS bugs like the one described in loopy fun [2]. 2) Restrict netem_enqueue recursion depth like in act_mirred with a per cpu variable. However, netem_dequeue can call enqueue on its child, and the depth restriction could be bypassed if the child is a netem. 3) Use the same approach as in 2, but add metadata in netem_skb_cb to handle the netem_dequeue case and track a packet's involvement in duplication. This is an overly complex approach, and Jamal notes that the skb cb can be overwritten to circumvent this safeguard. 4) Prevent the addition of a netem to a qdisc tree if its ancestral path contains a netem. However, filters and actions can cause a packet to change paths when re-enqueued to the root from netem duplication, leading us to the current solution: prevent a duplicating netem from inhabiting the same tree as other netems. [1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/ [2] https://lwn.net/Articles/719297/ Fixes: 0afb51e72855 ("[PKT_SCHED]: netem: reinsert for duplication") Reported-by: William Liu Reported-by: Savino Dicanosa Signed-off-by: William Liu Signed-off-by: Savino Dicanosa Acked-by: Jamal Hadi Salim Link: https://patch.msgid.link/20250708164141.875402-1-will@willsroot.io Signed-off-by: Jakub Kicinski commit f84a15b90d96f3da99f67fea2e116850d99fb7c4 Author: Jinliang Zheng Date: Tue Jun 10 21:01:58 2025 +0800 locking/rwsem: Use OWNER_NONSPINNABLE directly instead of OWNER_SPINNABLE After commit 7d43f1ce9dd0 ("locking/rwsem: Enable time-based spinning on reader-owned rwsem"), OWNER_SPINNABLE contains all possible values except OWNER_NONSPINNABLE, namely OWNER_NULL | OWNER_WRITER | OWNER_READER. Therefore, it is better to use OWNER_NONSPINNABLE directly to determine whether to exit optimistic spin. And, remove useless OWNER_SPINNABLE to simplify the code. Signed-off-by: Jinliang Zheng Acked-by: Waiman Long Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250610130158.4876-1-alexjlzheng@tencent.com commit 99214efedea521f1b79fa2a28ff142e933fc3eba Author: Jason Devers Date: Thu Dec 12 10:47:53 2024 -0500 rust: sync: Add #[must_use] to Lock::try_lock() The `Lock::try_lock()` function returns an `Option>`, but it currently does not issue a warning if the return value is unused. To avoid potential bugs, the `#[must_use]` annotation is added to ensure proper usage. Note that `T` is `#[must_use]` but `Option` is not. For more context, see: https://github.com/rust-lang/rust/issues/71368. Suggested-by: Alice Ryhl Link: https://github.com/Rust-for-Linux/linux/issues/1133 Signed-off-by: Jason Devers Reviewed-by: Alice Ryhl Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20241212154753.139563-1-dev.json2@gmail.com commit daec29dcc8731b7596690ab9f647839e4584a86d Author: Thomas Weißschuh Date: Tue Jun 17 19:08:14 2025 +0200 locking/mutex: Mark devm_mutex_init() as __must_check devm_mutex_init() can fail. With CONFIG_DEBUG_MUTEXES=y the mutex will be marked as unusable and trigger errors on usage. Enforce all callers check the return value through the compiler. As devm_mutex_init() itself is a macro, it can not be annotated directly. Annotate __devm_mutex_init() instead. Unfortunately __must_check/warn_unused_result don't propagate through statement expression. So move the statement expression into the argument list of the call to __devm_mutex_init() through a helper macro. Suggested-by: Peter Zijlstra Signed-off-by: Thomas Weißschuh Reviewed-by: Andy Shevchenko Reviewed-by: Bartosz Golaszewski Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250617-must_check-devm_mutex_init-v7-3-d9e449f4d224@weissschuh.net commit 3b07bb900af7f43f13f9ff398b4c6ca1dee217cd Author: Thomas Weißschuh Date: Tue Jun 17 19:08:13 2025 +0200 leds: lp8860: Check return value of devm_mutex_init() devm_mutex_init() can fail. With CONFIG_DEBUG_MUTEXES=y the mutex will be marked as unusable and trigger errors on usage. Add the missed check. Fixes: 87a59548af95 ("leds: lp8860: Use new mutex guards to cleanup function exits") Signed-off-by: Thomas Weißschuh Acked-by: Andrew Davis Acked-by: Lee Jones Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250617-must_check-devm_mutex_init-v7-2-d9e449f4d224@weissschuh.net commit d24a54e032021cf381af3c3cf119cc5cf6b3c1be Author: Thomas Weißschuh Date: Tue Jun 17 19:08:12 2025 +0200 spi: spi-nxp-fspi: Check return value of devm_mutex_init() devm_mutex_init() can fail. With CONFIG_DEBUG_MUTEXES=y the mutex will be marked as unusable and trigger errors on usage. Add the missed check. Fixes: 48900813abd2 ("spi: spi-nxp-fspi: remove the goto in probe") Signed-off-by: Thomas Weißschuh Reviewed-by: Mark Brown Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250617-must_check-devm_mutex_init-v7-1-d9e449f4d224@weissschuh.net commit 7e11e01d1f1d00cb308f9351511e9597a4f70678 Merge: 3a252ff9d8b6dc a886d26f2c8f9e Author: Simona Vetter Date: Fri Jul 11 23:55:40 2025 +0200 Merge tag 'amd-drm-next-6.17-2025-07-11' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.17-2025-07-11: amdgpu: - Clean up function signatures - GC 10 KGQ reset fix - SDMA reset cleanups - Misc fixes - LVDS fixes - UserQ fix amdkfd: - Reset fix Signed-off-by: Simona Vetter From: Alex Deucher Link: https://patchwork.freedesktop.org/patch/msgid/20250711205548.21052-1-alexander.deucher@amd.com commit e908f58b6beb337cbe4481d52c3f5c78167b1aab Author: Alex Williamson Date: Thu Jun 26 16:56:18 2025 -0600 vfio/pci: Separate SR-IOV VF dev_set In the below noted Fixes commit we introduced a reflck mutex to allow better scaling between devices for open and close. The reflck was based on the hot reset granularity, device level for root bus devices which cannot support hot reset or bus/slot reset otherwise. Overlooked in this were SR-IOV VFs, where there's also no bus reset option, but the default for a non-root-bus, non-slot-based device is bus level reflck granularity. The reflck mutex has since become the dev_set mutex (via commit 2cd8b14aaa66 ("vfio/pci: Move to the device set infrastructure")) and is our defacto serialization for various operations and ioctls. It still seems to be the case though that sets of vfio-pci devices really only need serialization relative to hot resets affecting the entire set, which is not relevant to SR-IOV VFs. As described in the Closes link below, this serialization contributes to startup latency when multiple VFs sharing the same "bus" are opened concurrently. Mark the device itself as the basis of the dev_set for SR-IOV VFs. Reported-by: Aaron Lewis Closes: https://lore.kernel.org/all/20250626180424.632628-1-aaronlewis@google.com Tested-by: Aaron Lewis Fixes: e309df5b0c9e ("vfio/pci: Parallelize device open and release") Reviewed-by: Yi Liu Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20250626225623.1180952-1-alex.williamson@redhat.com Signed-off-by: Alex Williamson commit fe24d5bc635e103a517ec201c3cb571eeab8be2f Author: Brett Creeley Date: Wed Jul 2 09:37:44 2025 -0700 vfio/pds: Fix missing detach_ioas op When CONFIG_IOMMUFD is enabled and a device is bound to the pds_vfio_pci driver, the following WARN_ON() trace is seen and probe fails: WARNING: CPU: 0 PID: 5040 at drivers/vfio/vfio_main.c:317 __vfio_register_dev+0x130/0x140 [vfio] <...> pds_vfio_pci 0000:08:00.1: probe with driver pds_vfio_pci failed with error -22 This is because the driver's vfio_device_ops.detach_ioas isn't set. Fix this by using the generic vfio_iommufd_physical_detach_ioas function. Fixes: 38fe3975b4c2 ("vfio/pds: Initial support for pds VFIO driver") Signed-off-by: Brett Creeley Reviewed-by: Kevin Tian Link: https://lore.kernel.org/r/20250702163744.69767-1-brett.creeley@amd.com Signed-off-by: Alex Williamson commit 9f65592b7e1f24569bb6ced064df5b4319f725ce Author: Eric Biggers Date: Sun Jul 6 16:11:00 2025 -0700 lib/crypto: x86/poly1305: Fix performance regression on short messages Restore the len >= 288 condition on using the AVX implementation, which was incidentally removed by commit 318c53ae02f2 ("crypto: x86/poly1305 - Add block-only interface"). This check took into account the overhead in key power computation, kernel-mode "FPU", and tail handling associated with the AVX code. Indeed, restoring this check slightly improves performance for len < 256 as measured using poly1305_kunit on an "AMD Ryzen AI 9 365" (Zen 5) CPU: Length Before After ====== ========== ========== 1 30 MB/s 36 MB/s 16 516 MB/s 598 MB/s 64 1700 MB/s 1882 MB/s 127 2265 MB/s 2651 MB/s 128 2457 MB/s 2827 MB/s 200 2702 MB/s 3238 MB/s 256 3841 MB/s 3768 MB/s 511 4580 MB/s 4585 MB/s 512 5430 MB/s 5398 MB/s 1024 7268 MB/s 7305 MB/s 3173 8999 MB/s 8948 MB/s 4096 9942 MB/s 9921 MB/s 16384 10557 MB/s 10545 MB/s While the optimal threshold for this CPU might be slightly lower than 288 (see the len == 256 case), other CPUs would need to be tested too, and these sorts of benchmarks can underestimate the true cost of kernel-mode "FPU". Therefore, for now just restore the 288 threshold. Fixes: 318c53ae02f2 ("crypto: x86/poly1305 - Add block-only interface") Cc: stable@vger.kernel.org Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250706231100.176113-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 16f2c30e290e04135b70ad374fb7e1d1ed9ff5e7 Author: Eric Biggers Date: Sun Jul 6 16:10:59 2025 -0700 lib/crypto: x86/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD usability check and base conversion that were removed by commit 318c53ae02f2 ("crypto: x86/poly1305 - Add block-only interface"). This safety check is cheap and is well worth eliminating a footgun. While the Poly1305 functions should not be called when SIMD registers are unusable, if they are anyway, they should just do the right thing instead of corrupting random tasks' registers and/or computing incorrect MACs. Fixing this is also needed for poly1305_kunit to pass. Just use irq_fpu_usable() instead of the original crypto_simd_usable(), since poly1305_kunit won't rely on crypto_simd_disabled_for_test. Fixes: 318c53ae02f2 ("crypto: x86/poly1305 - Add block-only interface") Cc: stable@vger.kernel.org Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250706231100.176113-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit eec76ea5a7213c48529a46eed1b343e5cee3aaab Author: Eric Biggers Date: Sun Jul 6 16:10:58 2025 -0700 lib/crypto: arm64/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD usability check that was removed by commit a59e5468a921 ("crypto: arm64/poly1305 - Add block-only interface"). This safety check is cheap and is well worth eliminating a footgun. While the Poly1305 functions should not be called when SIMD registers are unusable, if they are anyway, they should just do the right thing instead of corrupting random tasks' registers and/or computing incorrect MACs. Fixing this is also needed for poly1305_kunit to pass. Just use may_use_simd() instead of the original crypto_simd_usable(), since poly1305_kunit won't rely on crypto_simd_disabled_for_test. Fixes: a59e5468a921 ("crypto: arm64/poly1305 - Add block-only interface") Cc: stable@vger.kernel.org Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250706231100.176113-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 52c3e242f4d0043186b70d65460ba1767f27494a Author: Eric Biggers Date: Sun Jul 6 16:10:57 2025 -0700 lib/crypto: arm/poly1305: Fix register corruption in no-SIMD contexts Restore the SIMD usability check that was removed by commit 773426f4771b ("crypto: arm/poly1305 - Add block-only interface"). This safety check is cheap and is well worth eliminating a footgun. While the Poly1305 functions should not be called when SIMD registers are unusable, if they are anyway, they should just do the right thing instead of corrupting random tasks' registers and/or computing incorrect MACs. Fixing this is also needed for poly1305_kunit to pass. Just use may_use_simd() instead of the original crypto_simd_usable(), since poly1305_kunit won't rely on crypto_simd_disabled_for_test. Fixes: 773426f4771b ("crypto: arm/poly1305 - Add block-only interface") Cc: stable@vger.kernel.org Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250706231100.176113-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit c5da1f66940d8015cbf95c2501345c83eb6ba0ab Author: Dan Carpenter Date: Fri May 23 19:08:45 2025 +0300 ext4: remove unnecessary duplicate check in ext4_map_blocks() The previous lines ensure that EXT4_GET_BLOCKS_QUERY_LAST_IN_LEAF is set so remove this duplicate check. Signed-off-by: Dan Carpenter Reviewed-by: Ritesh Harjani (IBM) Link: https://patch.msgid.link/aDCdjUhpzxB64vkD@stanley.mountain Signed-off-by: Theodore Ts'o commit 982ddd59ed97dc7e63efd97ed50273ffb817bd41 Author: Jacob Pan Date: Wed Jun 18 16:46:18 2025 -0700 vfio: Prevent open_count decrement to negative When vfio_df_close() is called with open_count=0, it triggers a warning in vfio_assert_device_open() but still decrements open_count to -1. This allows a subsequent open to incorrectly pass the open_count == 0 check, leading to unintended behavior, such as setting df->access_granted = true. For example, running an IOMMUFD compat no-IOMMU device with VFIO tests (https://github.com/awilliam/tests/blob/master/vfio-noiommu-pci-device-open.c) results in a warning and a failed VFIO_GROUP_GET_DEVICE_FD ioctl on the first run, but the second run succeeds incorrectly. Add checks to avoid decrementing open_count below zero. Fixes: 05f37e1c03b6 ("vfio: Pass struct vfio_device_file * to vfio_device_open/close()") Reviewed-by: Jason Gunthorpe Reviewed-by: Yi Liu Signed-off-by: Jacob Pan Link: https://lore.kernel.org/r/20250618234618.1910456-2-jacob.pan@linux.microsoft.com Signed-off-by: Alex Williamson commit b25e271b377999191b12f0afbe1861edcf57e3fe Author: Jacob Pan Date: Wed Jun 18 16:46:17 2025 -0700 vfio: Fix unbalanced vfio_df_close call in no-iommu mode For devices with no-iommu enabled in IOMMUFD VFIO compat mode, the group open path skips vfio_df_open(), leaving open_count at 0. This causes a warning in vfio_assert_device_open(device) when vfio_df_close() is called during group close. The correct behavior is to skip only the IOMMUFD bind in the device open path for no-iommu devices. Commit 6086efe73498 omitted vfio_df_open(), which was too broad. This patch restores the previous behavior, ensuring the vfio_df_open is called in the group open path. Fixes: 6086efe73498 ("vfio-iommufd: Move noiommu compat validation out of vfio_iommufd_bind()") Suggested-by: Alex Williamson Suggested-by: Jason Gunthorpe Signed-off-by: Jacob Pan Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20250618234618.1910456-1-jacob.pan@linux.microsoft.com Signed-off-by: Alex Williamson commit 7b6db1731a642be2ac89168d6aa9be6383796844 Author: Lucas De Marchi Date: Thu Jun 26 14:25:53 2025 -0700 drm/xe: Normalize default param values Document xe module params with the default values following a similar strategy for all of them: 1) Define a DEFAULT_* macro with the default value. When the value can't be directly stringified, also define a *_STR variant 2) Use __stringify() or the _STR variant to make sure the default value shows up in the param description This allows us to show the correct default according to the configuration. max_vfs for example was wrongly documented for CONFIG_DRM_XE_DEBUG and svm_notifier_size didn't have its default documented. Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250626-guc-log-level-v3-1-c3ed8b452e91@intel.com Signed-off-by: Lucas De Marchi commit 81e139db6900503a2e68009764054fad128fbf95 Author: Lucas De Marchi Date: Thu Jul 10 14:34:41 2025 -0700 drm/xe/migrate: Fix alignment check The check would fail if the address is unaligned, but not when accounting the offset. Instead of `buf | offset` it should have been `buf + offset`. To make it more readable and also drop the uintptr_t, just use the IS_ALIGNED() macro. Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access") Reviewed-by: Matthew Brost Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250710-migrate-aligned-v1-1-44003ef3c078@intel.com Signed-off-by: Lucas De Marchi commit b4aff7ed7a4c1360e8b29d545c7bc9e05af1a995 Author: Ian Rogers Date: Thu Jul 10 16:51:26 2025 -0700 perf python: Set index error for invalid thread/cpu map items Returning NULL for out of bound CPU or thread map items causes internal errors. Fix by correctly setting the error to be an index error. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-14-irogers@google.com Signed-off-by: Namhyung Kim commit 421c5f39adcdf292ca5c7162f40ed6d120d136a8 Author: Ian Rogers Date: Thu Jul 10 16:51:25 2025 -0700 perf python: Improve leader copying from evlist The struct pyrf_evlist embeds the evlist requiring the copying from things like parsed events. The copying logic handles the leader being the event itself, but if the leader group event is a different in the list it will cause an evsel to point to the evsel in the list that was copied from which is bad. Fix this by adding another pass over the evlist rewriting leaders, simplified by the introductin of two evlist helpers. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-13-irogers@google.com Signed-off-by: Namhyung Kim commit 6183afcba9c1c810656ddb36170106aaf3cf778c Author: Ian Rogers Date: Thu Jul 10 16:51:24 2025 -0700 perf python: Correct pyrf_evsel__read for tool PMUs Tool PMUs assume that stat's process_counter_values is being used to read the counters. Specifically they hold onto old values in evsel->prev_raw_counts and give the cumulative count based off of this value. Update pyrf_evsel__read to allocate counts and prev_raw_counts, use evsel__read_counter rather than perf_evsel__read so tool PMUs are read from not just perf_event_open events, make the returned pyrf_counts_values contain the delta value rather than the cumulative value. Fixes: 739621f65702 ("perf python: Add evsel read method") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-12-irogers@google.com Signed-off-by: Namhyung Kim commit 64ec9b997f3a9462901a404ad60f452f76dd2d6e Author: Ian Rogers Date: Thu Jul 10 16:51:23 2025 -0700 perf python: Fix thread check in pyrf_evsel__read The CPU index is incorrectly checked rather than the thread index. Fixes: 739621f65702 ("perf python: Add evsel read method") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-11-irogers@google.com Signed-off-by: Namhyung Kim commit 7d5b635d9f4314c93bc1f9828f5d757decb860bc Author: Ian Rogers Date: Thu Jul 10 16:51:22 2025 -0700 perf python: In str(evsel) use the evsel__pmu_name helper The evsel__pmu_name helper will internally use evsel__find_pmu that handles legacy events, extended types, etc. in determining a PMU and will provide a better value than just trying to access the PMU's name directly as the PMU may not have been computed. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-10-irogers@google.com Signed-off-by: Namhyung Kim commit 5c255832deaf34d74c0adf2200eb50a8bba0fc00 Author: Ian Rogers Date: Thu Jul 10 16:51:21 2025 -0700 perf jevents: If the long_desc and desc are identical then drop the long_desc If the short and long descriptions are the same then save space and don't store both of them. When storing the desc in the perf_pmu_alias, don't duplicate the desc into the long_desc. By avoiding storing the duplicate the size of the events string in the binary on x86 is reduced by 29,840 bytes. Fix tests that expect a duplicated description. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-9-irogers@google.com Signed-off-by: Namhyung Kim commit 3787cdaf387cdc14a9a000624742b4ee0a509244 Author: Ian Rogers Date: Thu Jul 10 16:51:20 2025 -0700 perf expr: Accumulate rather than replace in the context counts Metrics will fill in the context to have mappings from an event to a count. When counts are added they replace existing mappings which generally shouldn't exist with aggregation. Switch to accumulating to better support cases where perf stat's aggregation isn't used and we may see a counter more than once. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-8-irogers@google.com Signed-off-by: Namhyung Kim commit faebee18d720d9e209946ece3e468c06cf13f5ec Author: Ian Rogers Date: Thu Jul 10 16:51:19 2025 -0700 perf stat: Move metric list from config to evlist The rblist of metric_event that then have a list of associated metric_expr is moved out of the stat_config and into the evlist. This is done as part of refactoring things for python, having the state split in two places complicates that implementation. The evlist is doing the harder work of enabling and disabling events, the metrics are needed to compute a value and it doesn't seem unreasonable to hang them from the evlist. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-7-irogers@google.com Signed-off-by: Namhyung Kim commit cb336b6aaeb44be281df9a03684ddeadd3afab60 Author: Ian Rogers Date: Thu Jul 10 16:51:18 2025 -0700 perf metricgroup: Factor out for-each function and move out printing Factor metricgroup__for_each_metric into its own function handling regular and sys metrics. Make the metric adding and printing code use it, move the printing code into print-events files. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-6-irogers@google.com Signed-off-by: Namhyung Kim commit 8c75dc742089c702cab6d0f21be80c5ddd3c6067 Author: Ian Rogers Date: Thu Jul 10 16:51:17 2025 -0700 perf pmu: Tolerate failure to read the type for wellknown PMUs If sysfs isn't mounted then we may fail to read a PMU's type. In this situation resort to lookup of wellknown types. Only applies to software, tracepoint and breakpoint PMUs. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-5-irogers@google.com Signed-off-by: Namhyung Kim commit bcc7693ad100ef9c778621edee2295b8c02f2271 Author: Ian Rogers Date: Thu Jul 10 16:51:16 2025 -0700 perf spark: Fix includes and add SPDX scnprintf is declared in linux/kernel.h, directly depend upon it. Add missing SPDX comments. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-4-irogers@google.com Signed-off-by: Namhyung Kim commit 679c098cd2db458b1899e4410150d41a550ec6d6 Author: Ian Rogers Date: Thu Jul 10 16:51:15 2025 -0700 perf parse-events: Minor tidy up of event_type helper Add missing breakpoint and raw types. Avoid a switch, just use a lookup array. Switch the type to unsigned to avoid checking negative values. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-3-irogers@google.com Signed-off-by: Namhyung Kim commit 28f5aa8184c9c9b8eab35fa3884c416fe75e88e4 Author: Ian Rogers Date: Thu Jul 10 16:51:14 2025 -0700 perf hwmon_pmu: Avoid shortening hwmon PMU name Long names like ucsi_source_psy_USBC000:001 when prefixed with hwmon_ exceed the buffer size and the last digit is lost. This causes confusion with similar names like ucsi_source_psy_USBC000:002. Extend the buffer size to avoid this. Fixes: 53cc0b351ec9 ("perf hwmon_pmu: Add a tool PMU exposing events from hwmon in sysfs") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250710235126.1086011-2-irogers@google.com Signed-off-by: Namhyung Kim commit 4a6cdecaa1497f1fbbd1d5307a225b6ca5a62a90 Author: Leo Yan Date: Fri Jul 11 12:10:15 2025 +0100 perf tests bp_account: Fix leaked file descriptor Since the commit e9846f5ead26 ("perf test: In forked mode add check that fds aren't leaked"), the test "Breakpoint accounting" reports the error: # perf test -vvv "Breakpoint accounting" 20: Breakpoint accounting: --- start --- test child forked, pid 373 failed opening event 0 failed opening event 0 watchpoints count 4, breakpoints count 6, has_ioctl 1, share 0 wp 0 created wp 1 created wp 2 created wp 3 created wp 0 modified to bp wp max created ---- end(0) ---- Leak of file descriptor 7 that opened: 'anon_inode:[perf_event]' A watchpoint's file descriptor was not properly released. This patch fixes the leak. Fixes: 032db28e5fa3 ("perf tests: Add breakpoint accounting/modify test") Reported-by: Aishwarya TCV Signed-off-by: Leo Yan Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250711-perf_fix_breakpoint_accounting-v1-1-b314393023f9@arm.com Signed-off-by: Namhyung Kim commit 0cad34fb7c5d12a9b61862744e7130e9ce3bc58f Merge: a339dd699a7aa0 c7979c3917fa13 Author: Jakub Kicinski Date: Thu Jul 10 10:08:47 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.16-rc6-2). No conflicts. Adjacent changes: drivers/net/wireless/mediatek/mt76/mt7925/mcu.c c701574c5412 ("wifi: mt76: mt7925: fix invalid array index in ssid assignment during hw scan") b3a431fe2e39 ("wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()") drivers/net/wireless/mediatek/mt76/mt7996/mac.c 62da647a2b20 ("wifi: mt76: mt7996: Add MLO support to mt7996_tx_check_aggr()") dc66a129adf1 ("wifi: mt76: add a wrapper for wcid access with validation") drivers/net/wireless/mediatek/mt76/mt7996/main.c 3dd6f67c669c ("wifi: mt76: Move RCU section in mt7996_mcu_add_rate_ctrl()") 8989d8e90f5f ("wifi: mt76: mt7996: Do not set wcid.sta to 1 in mt7996_mac_sta_event()") net/mac80211/cfg.c 58fcb1b4287c ("wifi: mac80211: reject VHT opmode for unsupported channel widths") 037dc18ac3fb ("wifi: mac80211: add support for storing station S1G capabilities") Signed-off-by: Jakub Kicinski commit fd7dac34fda486785ce979a1d38d9760bad2b77d Author: Luca Weiss Date: Wed Jul 2 17:56:16 2025 +0200 dt-bindings: pinctrl: document the Milos Top Level Mode Multiplexer Document the Top Level Mode Multiplexer on the Milos Platform. Signed-off-by: Luca Weiss Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/20250702-sm7635-pinctrl-v2-1-c138624b9924@fairphone.com Signed-off-by: Linus Walleij commit 9a425da913cf4ea23040334301fce87be2dab384 Author: Nam Cao Date: Fri Jul 11 13:20:43 2025 +0200 panic: Fix up description of vpanic() The description above vpanic() has the wrong function name. Fix it up. Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Gabriele Monaco Cc: Josh Poimboeuf Cc: Petr Mladek Link: https://lore.kernel.org/23a7e8add6546b155371b7e0fbb37bb1def13d6e.1752232374.git.namcao@linutronix.de Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/lkml/20250711183802.2d8c124d@canb.auug.org.au/ Acked-by: Peter Zijlstra (Intel) Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 90a01bdcbd01513d6b7f79a98a03daf2c7b5ccde Author: Nam Cao Date: Fri Jul 11 13:20:42 2025 +0200 objtool: Add vpanic() to the noreturn list vpanic() does not return. However, objtool doesn't know this and gets confused: kernel/trace/rv/reactor_panic.o: warning: objtool: rv_panic_reaction(): unexpected end of section .text Add vpanic() to the list of noreturn functions. Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Gabriele Monaco Cc: Josh Poimboeuf Cc: Petr Mladek Link: https://lore.kernel.org/073f826ebec18b2bb59cba88606cd865d8039fd2.1752232374.git.namcao@linutronix.de Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507110826.2ekbVdWZ-lkp@intel.com/ Acked-by: Peter Zijlstra (Intel) Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 52e06d25bdcf8026cd1c951ff7f910e21c4afa04 Author: Luca Weiss Date: Wed Jul 9 13:46:35 2025 +0200 pinctrl: qcom: spmi: Add PM7550 PM7550 is a PMIC, featuring 12 GPIOs. Describe it. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/20250709-sm7635-pmxr2230-v2-4-09777dab0a95@fairphone.com Signed-off-by: Linus Walleij commit 2feab53ac467d7f274830f30c218afa6ce89e39e Author: Luca Weiss Date: Wed Jul 9 13:46:34 2025 +0200 dt-bindings: pinctrl: qcom,pmic-gpio: Add PM7550 support Update the Qualcomm Technologies, Inc. PMIC GPIO binding documentation to include the compatible string for the PM7550 PMICs. Signed-off-by: Luca Weiss Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/20250709-sm7635-pmxr2230-v2-3-09777dab0a95@fairphone.com Signed-off-by: Linus Walleij commit 19dca764dbb54bf5af11311016c9d8d69c1f5131 Author: Luca Weiss Date: Wed Jul 9 13:22:28 2025 +0200 pinctrl: qcom: spmi: Add PMIV0104 PMIV0104 is a PMIC, featuring 10 GPIOs. Describe it. Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Link: https://lore.kernel.org/20250709-sm7635-pmiv0104-v2-3-ebf18895edd6@fairphone.com Signed-off-by: Linus Walleij commit ac6242b7ba0bedf4097846717ec366904aaab01b Author: Luca Weiss Date: Wed Jul 9 13:22:27 2025 +0200 dt-bindings: pinctrl: qcom,pmic-gpio: Add PMIV0104 support Update the Qualcomm Technologies, Inc. PMIC GPIO binding documentation to include the compatible string for the PMIV0104 PMICs. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Link: https://lore.kernel.org/20250709-sm7635-pmiv0104-v2-2-ebf18895edd6@fairphone.com Signed-off-by: Linus Walleij commit 0b075c011032f88d1cfde3b45d6dcf08b44140eb Author: Mukesh Ojha Date: Tue Jul 8 13:28:38 2025 +0530 pinmux: fix race causing mux_owner NULL with active mux_usecount commit 5a3e85c3c397 ("pinmux: Use sequential access to access desc->pinmux data") tried to address the issue when two client of the same gpio calls pinctrl_select_state() for the same functionality, was resulting in NULL pointer issue while accessing desc->mux_owner. However, issue was not completely fixed due to the way it was handled and it can still result in the same NULL pointer. The issue occurs due to the following interleaving: cpu0 (process A) cpu1 (process B) pin_request() { pin_free() { mutex_lock() desc->mux_usecount--; //becomes 0 .. mutex_unlock() mutex_lock(desc->mux) desc->mux_usecount++; // becomes 1 desc->mux_owner = owner; mutex_unlock(desc->mux) mutex_lock(desc->mux) desc->mux_owner = NULL; mutex_unlock(desc->mux) This sequence leads to a state where the pin appears to be in use (`mux_usecount == 1`) but has no owner (`mux_owner == NULL`), which can cause NULL pointer on next pin_request on the same pin. Ensure that updates to mux_usecount and mux_owner are performed atomically under the same lock. Only clear mux_owner when mux_usecount reaches zero and no new owner has been assigned. Fixes: 5a3e85c3c397 ("pinmux: Use sequential access to access desc->pinmux data") Signed-off-by: Mukesh Ojha Link: https://lore.kernel.org/20250708-pinmux-race-fix-v2-1-8ae9e8a0d1a1@oss.qualcomm.com Signed-off-by: Linus Walleij commit ac51d04144433116948dcb22a315b89f96b219cb Merge: 64daf134941208 7000167796a00d Author: Linus Walleij Date: Fri Jul 11 20:12:20 2025 +0200 Merge tag 'renesas-pinctrl-for-v6.17-tag2' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel pinctrl: renesas: Updates for v6.17 (take two) - Sort Kconfig symbols and improve their descriptions, - Simplify PINCTRL_RZV2M logic. Signed-off-by: Linus Walleij commit ea2aecdf7a954a8c0015e185cc870c4191d1d93f Merge: d81526a6ebff4a 601a3956fead68 Author: Andrii Nakryiko Date: Fri Jul 11 10:30:43 2025 -0700 Merge branch 'move-attach_type-into-bpf_link' Tao Chen says: ==================== Move attach_type into bpf_link Andrii suggested moving the attach_type into bpf_link, the previous discussion is as follows: https://lore.kernel.org/bpf/CAEf4BzY7TZRjxpCJM-+LYgEqe23YFj5Uv3isb7gat2-HU4OSng@mail.gmail.com patch1 add attach_type in bpf_link, and pass it to bpf_link_init, which will init the attach_type field. patch2-7 remove the attach_type in struct bpf_xx_link, update the info with bpf_link attach_type. There are some functions finally call bpf_link_init but do not have bpf_attr from user or do not need to init attach_type from user like bpf_raw_tracepoint_open, now use prog->expected_attach_type to init attach_type. bpf_struct_ops_map_update_elem bpf_raw_tracepoint_open bpf_struct_ops_test_run Feedback of any kind is welcome, thanks. ==================== Link: https://patch.msgid.link/20250710032038.888700-1-chen.dylane@linux.dev Signed-off-by: Andrii Nakryiko commit 601a3956fead680691cdf0b0108bdb27eea5108b Author: Tao Chen Date: Thu Jul 10 11:20:38 2025 +0800 netkit: Remove location field in netkit_link Use attach_type in bpf_link to replace the location field, and remove location field in netkit_link. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Acked-by: Daniel Borkmann Acked-by: Nikolay Aleksandrov Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20250710032038.888700-8-chen.dylane@linux.dev commit 0eeeebdcc5feeec48118f7a3df2ac818e694ccc7 Author: Tao Chen Date: Thu Jul 10 11:20:37 2025 +0800 bpf: Remove attach_type in bpf_tracing_link Use attach_type in bpf_link, and remove it in bpf_tracing_link. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20250710032038.888700-7-chen.dylane@linux.dev commit 2a76a80c7ffc9894b90126af7b17584195b40b7a Author: Tao Chen Date: Thu Jul 10 11:20:36 2025 +0800 bpf: Remove attach_type in bpf_netns_link Use attach_type in bpf_link, and remove it in bpf_netns_link. And move netns_type field to the end to fill the byte hole. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Reviewed-by: Jakub Sitnicki Acked-by: Jiri Olsa Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20250710032038.888700-6-chen.dylane@linux.dev commit 6e816e1c052b453a93aeb8b57ede9acde58c458d Author: Tao Chen Date: Thu Jul 10 11:20:35 2025 +0800 bpf: Remove location field in tcx_link Use attach_type in bpf_link to replace the location filed, and remove location field in tcx_link. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Acked-by: Daniel Borkmann Acked-by: Jiri Olsa Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/20250710032038.888700-5-chen.dylane@linux.dev commit 33f69f736570d9ca4d54e241a42da26ea1b3d13a Author: Tao Chen Date: Thu Jul 10 11:20:34 2025 +0800 bpf: Remove attach_type in sockmap_link Use attach_type in bpf_link, and remove it in sockmap_link. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Acked-by: Daniel Borkmann Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20250710032038.888700-4-chen.dylane@linux.dev commit 9b8d543dc2bbf5d3a1e2d60049df94ae2bc68b28 Author: Tao Chen Date: Thu Jul 10 11:20:33 2025 +0800 bpf: Remove attach_type in bpf_cgroup_link Use attach_type in bpf_link, and remove it in bpf_cgroup_link. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Acked-by: Daniel Borkmann Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20250710032038.888700-3-chen.dylane@linux.dev commit b725441f02c2b31c04a95d0e9ca5420fa029a767 Author: Tao Chen Date: Thu Jul 10 11:20:32 2025 +0800 bpf: Add attach_type field to bpf_link Attach_type will be set when a link is created by user. It is better to record attach_type in bpf_link generically and have it available universally for all link types. So add the attach_type field in bpf_link and move the sleepable field to avoid unnecessary gap padding. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Acked-by: Daniel Borkmann Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20250710032038.888700-2-chen.dylane@linux.dev commit d81526a6ebff4ac2358b71d40271c8f95212fac1 Author: Paul Chaignon Date: Thu Jul 10 20:21:41 2025 +0200 selftests/bpf: Range analysis test case for JSET This patch adds coverage for the warning detected by syzkaller and fixed in the previous patch. Without the previous patch, this test fails with: verifier bug: REG INVARIANTS VIOLATION (false_reg1): range bounds violation u64=[0x0, 0x0] s64=[0x0, 0x0] u32=[0x1, 0x0] s32=[0x0, 0x0] var_off=(0x0, 0x0)(1) Signed-off-by: Paul Chaignon Acked-by: Yonghong Song Link: https://lore.kernel.org/r/c7893be1170fdbcf64e0200c110cdbd360ce7086.1752171365.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 6279846b9b2532e1b04559ef8bd0dec049f29383 Author: Paul Chaignon Date: Thu Jul 10 20:20:53 2025 +0200 bpf: Forget ranges when refining tnum after JSET Syzbot reported a kernel warning due to a range invariant violation on the following BPF program. 0: call bpf_get_netns_cookie 1: if r0 == 0 goto 2: if r0 & Oxffffffff goto The issue is on the path where we fall through both jumps. That path is unreachable at runtime: after insn 1, we know r0 != 0, but with the sign extension on the jset, we would only fallthrough insn 2 if r0 == 0. Unfortunately, is_branch_taken() isn't currently able to figure this out, so the verifier walks all branches. The verifier then refines the register bounds using the second condition and we end up with inconsistent bounds on this unreachable path: 1: if r0 == 0 goto r0: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0xffffffffffffffff) 2: if r0 & 0xffffffff goto r0 before reg_bounds_sync: u64=[0x1, 0xffffffffffffffff] var_off=(0, 0) r0 after reg_bounds_sync: u64=[0x1, 0] var_off=(0, 0) Improving the range refinement for JSET to cover all cases is tricky. We also don't expect many users to rely on JSET given LLVM doesn't generate those instructions. So instead of improving the range refinement for JSETs, Eduard suggested we forget the ranges whenever we're narrowing tnums after a JSET. This patch implements that approach. Reported-by: syzbot+c711ce17dd78e5d4fdcf@syzkaller.appspotmail.com Suggested-by: Eduard Zingerman Acked-by: Yonghong Song Acked-by: Eduard Zingerman Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/9d4fd6432a095d281f815770608fdcd16028ce0b.1752171365.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 2b1fd82cbaffef05a35bd04ba2d62d96f4d8a622 Merge: ad97cb2ed06a6b 9f9559f0acc42e Author: Alexei Starovoitov Date: Fri Jul 11 10:43:55 2025 -0700 Merge branch 'bpf-arena-add-kfunc-for-reserving-arena-memory' Emil Tsalapatis says: ==================== bpf/arena: Add kfunc for reserving arena memory Add a new kfunc for BPF arenas that reserves a region of the mapping to prevent it from being mapped. These regions serve as guards against out-of-bounds accesses and are useful for debugging arena-related code. >From v3 (20250709015712.97099-1-emil@etsalapatis.com) ------------------------------------------------------ - Added Acked-by tags by Yonghong. - Replace hardcoded error numbers in selftests (Yonghong). - Fixed selftest for partially freeing a reserved region (Yonghong). >From v2 (20250702003351.197234-1-emil@etsalapatis.com) ------------------------------------------------------ - Removed -EALREADY and replaced with -EINVAL to bring error handling in line with the rest of the BPF code (Alexei). >From v1 (20250620031118.245601-1-emil@etsalapatis.com) ------------------------------------------------------ - Removed the additional guard range tree. Adjusted tests accordingly. Reserved regions now behave like allocated regions, and can be unreserved using bpf_arena_free_pages(). They can also be allocated from userspace through minor faults. It is up to the user to prevent erroneous frees and/or use the BPF_F_SEGV_ON_FAULT flag to catch stray userspace accesses (Alexei). - Changed terminology from guard pages to reserved pages (Alexei, Kartikeya). Signed-off-by: Emil Tsalapatis ==================== Link: https://patch.msgid.link/20250709191312.29840-1-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 9f9559f0acc42e98709017951144ef6334dad187 Author: Emil Tsalapatis Date: Wed Jul 9 15:13:12 2025 -0400 selftests/bpf: add selftests for bpf_arena_reserve_pages Add selftests for the new bpf_arena_reserve_pages kfunc. Acked-by: Yonghong Song Signed-off-by: Emil Tsalapatis Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250709191312.29840-3-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 8fc3d2d8b5016adf63a3a6d21c189677fa653a4a Author: Emil Tsalapatis Date: Wed Jul 9 15:13:11 2025 -0400 bpf/arena: add bpf_arena_reserve_pages kfunc Add a new BPF arena kfunc for reserving a range of arena virtual addresses without backing them with pages. This prevents the range from being populated using bpf_arena_alloc_pages(). Acked-by: Yonghong Song Signed-off-by: Emil Tsalapatis Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250709191312.29840-2-emil@etsalapatis.com Signed-off-by: Alexei Starovoitov commit 4a1eaf7d110aa54c2b0e891cb450a6ab37a6c3dd Author: Matthew Brost Date: Thu Jul 10 13:54:13 2025 -0700 drm/xe: Remove references to CONFIG_DRM_XE_DEVMEM_MIRROR The prefetch code was referencing CONFIG_DRM_XE_DEVMEM_MIRROR, which has been replaced by CONFIG_DRM_XE_PAGEMAP. As a result, prefetches were limited to SRAM. Update the code to use CONFIG_DRM_XE_PAGEMAP instead of the deprecated option. Fixes: f86ad0ed620c ("drm/gpusvm, drm/pagemap: Move migration functionality to drm_pagemap") Signed-off-by: Matthew Brost Reviewed-by: Jonathan Cavitt Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250710205413.1105595-1-matthew.brost@intel.com commit beb72acb5b38dbe670d8eb752d1ad7a32f9c4119 Author: Matthew Brost Date: Thu Jul 10 12:12:08 2025 -0700 drm/xe: Move page fault init after topology init We need the topology to determine GT page fault queue size, move page fault init after topology init. Cc: stable@vger.kernel.org Fixes: 3338e4f90c14 ("drm/xe: Use topology to determine page fault queue size") Signed-off-by: Matthew Brost Reviewed-by: Jonathan Cavitt Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250710191208.1040215-1-matthew.brost@intel.com commit 32b2d3a57e26804ca96d82a222667ac0fa226cb7 Author: Nicolin Chen Date: Wed Jul 9 22:59:21 2025 -0700 iommu/tegra241-cmdqv: Add IOMMU_VEVENTQ_TYPE_TEGRA241_CMDQV support Add a new vEVENTQ type for VINTFs that are assigned to the user space. Simply report the two 64-bit LVCMDQ_ERR_MAPs register values. Link: https://patch.msgid.link/r/68161a980da41fa5022841209638aeff258557b5.1752126748.git.nicolinc@nvidia.com Reviewed-by: Alok Tiwari Reviewed-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 4dc0d12474f9d4833c3dd96b73d61e406d3f5dc7 Author: Nicolin Chen Date: Wed Jul 9 22:59:20 2025 -0700 iommu/tegra241-cmdqv: Add user-space use support The CMDQV HW supports a user-space use for virtualization cases. It allows the VM to issue guest-level TLBI or ATC_INV commands directly to the queue and executes them without a VMEXIT, as HW will replace the VMID field in a TLBI command and the SID field in an ATC_INV command with the preset VMID and SID. This is built upon the vIOMMU infrastructure by allowing VMM to allocate a VINTF (as a vIOMMU object) and assign VCMDQs (HW QUEUE objs) to the VINTF. So firstly, replace the standard vSMMU model with the VINTF implementation but reuse the standard cache_invalidate op (for unsupported commands) and the standard alloc_domain_nested op (for standard nested STE). Each VINTF has two 64KB MMIO pages (128B per logical VCMDQ): - Page0 (directly accessed by guest) has all the control and status bits. - Page1 (trapped by VMM) has guest-owned queue memory location/size info. VMM should trap the emulated VINTF0's page1 of the guest VM for the guest- level VCMDQ location/size info and forward that to the kernel to translate to a physical memory location to program the VCMDQ HW during an allocation call. Then, it should mmap the assigned VINTF's page0 to the VINTF0 page0 of the guest VM. This allows the guest OS to read and write the guest-own VINTF's page0 for direct control of the VCMDQ HW. For ATC invalidation commands that hold an SID, it requires all devices to register their virtual SIDs to the SID_MATCH registers and their physical SIDs to the pairing SID_REPLACE registers, so that HW can use those as a lookup table to replace those virtual SIDs with the correct physical SIDs. Thus, implement the driver-allocated vDEVICE op with a tegra241_vintf_sid structure to allocate SID_REPLACE and to program the SIDs accordingly. This enables the HW accelerated feature for NVIDIA Grace CPU. Compared to the standard SMMUv3 operating in the nested translation mode trapping CMDQ for TLBI and ATC_INV commands, this gives a huge performance improvement: 70% to 90% reductions of invalidation time were measured by various DMA unmap tests running in a guest OS. Link: https://patch.msgid.link/r/fb0eab83f529440b6aa181798912a6f0afa21eb0.1752126748.git.nicolinc@nvidia.com Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 81f81db6328b2bab1b64cb1ebaa4c560bf91db9f Author: Nicolin Chen Date: Wed Jul 9 22:59:19 2025 -0700 iommu/tegra241-cmdqv: Do not statically map LVCMDQs To simplify the mappings from global VCMDQs to VINTFs' LVCMDQs, the design chose to do static allocations and mappings in the global reset function. However, with the user-owned VINTF support, it exposes a security concern: if user space VM only wants one LVCMDQ for a VINTF, statically mapping two or more LVCMDQs creates a hidden VCMDQ that user space could DoS attack by writing random stuff to overwhelm the kernel with unhandleable IRQs. Thus, to support the user-owned VINTF feature, a LVCMDQ mapping has to be done dynamically. HW allows pre-assigning global VCMDQs in the CMDQ_ALLOC registers, without finalizing the mappings by keeping CMDQV_CMDQ_ALLOCATED=0. So, add a pair of map/unmap helper that simply sets/clears that bit. For kernel-owned VINTF0, move LVCMDQ mappings to tegra241_vintf_hw_init(), and the unmappings to tegra241_vintf_hw_deinit(). For user-owned VINTFs that will be added, the mappings/unmappings will be on demand upon an LVCMDQ allocation from the user space. However, the dynamic LVCMDQ mapping/unmapping can complicate the timing of calling tegra241_vcmdq_hw_init/deinit(), which write LVCMDQ address space, i.e. requiring LVCMDQ to be mapped. Highlight that with a note to the top of either of them. Link: https://patch.msgid.link/r/be115a8f75537632daf5995b3e583d8a76553fba.1752126748.git.nicolinc@nvidia.com Acked-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 589899ee299e5314fae847d2ad0f86c2ffa94739 Author: Nicolin Chen Date: Wed Jul 9 22:59:18 2025 -0700 iommu/tegra241-cmdqv: Simplify deinit flow in tegra241_cmdqv_remove_vintf() The current flow of tegra241_cmdqv_remove_vintf() is: 1. For each LVCMDQ, tegra241_vintf_remove_lvcmdq(): a. Disable the LVCMDQ HW b. Release the LVCMDQ SW resource 2. For current VINTF, tegra241_vintf_hw_deinit(): c. Disable all LVCMDQ HWs d. Disable VINTF HW Obviously, the step 1.a and the step 2.c are redundant. Since tegra241_vintf_hw_deinit() disables all of its LVCMDQ HWs, it could simplify the flow in tegra241_cmdqv_remove_vintf() by calling that first: 1. For current VINTF, tegra241_vintf_hw_deinit(): a. Disable all LVCMDQ HWs b. Disable VINTF HW 2. Release all LVCMDQ SW resources Drop tegra241_vintf_remove_lvcmdq(), and move tegra241_vintf_free_lvcmdq() as the new step 2. Link: https://patch.msgid.link/r/86c97c8c4ee9ca192e7e7fa3007c10399d792ce6.1752126748.git.nicolinc@nvidia.com Acked-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 1eb468744ccaafeaee145505d0aa5fd6227bd72f Author: Nicolin Chen Date: Wed Jul 9 22:59:17 2025 -0700 iommu/tegra241-cmdqv: Use request_threaded_irq A vEVENT can be reported only from a threaded IRQ context. Change to using request_threaded_irq to support that. Link: https://patch.msgid.link/r/f160193980e3b273afbd1d9cfc3e360084c05ba6.1752126748.git.nicolinc@nvidia.com Acked-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 9eb6a666df7f7a50e0a99c4c101864b8bb0dd685 Author: Nicolin Chen Date: Wed Jul 9 22:59:16 2025 -0700 iommu/arm-smmu-v3-iommufd: Add hw_info to impl_ops This will be used by Tegra241 CMDQV implementation to report a non-default HW info data. Link: https://patch.msgid.link/r/8a3bf5709358eb21aed2e8434534c30ecf83917c.1752126748.git.nicolinc@nvidia.com Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 61dd912ee02e4d1d412e1090c6e5d7f8cd0779df Author: Nicolin Chen Date: Wed Jul 9 22:59:15 2025 -0700 iommu/arm-smmu-v3-iommufd: Add vsmmu_size/type and vsmmu_init impl ops An impl driver might want to allocate its own type of vIOMMU object or the standard IOMMU_VIOMMU_TYPE_ARM_SMMUV3 by setting up its own SW/HW bits, as the tegra241-cmdqv driver will add IOMMU_VIOMMU_TYPE_TEGRA241_CMDQV. Add vsmmu_size/type and vsmmu_init to struct arm_smmu_impl_ops. Prioritize them in arm_smmu_get_viommu_size() and arm_vsmmu_init(). Link: https://patch.msgid.link/r/375ac2b056764534bb7c10ecc4f34a0bae82b108.1752126748.git.nicolinc@nvidia.com Reviewed-by: Pranjal Shrivastava Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 3a35f7d4a4673edf6f02422bb2d78b17c667e167 Author: Nicolin Chen Date: Wed Jul 9 22:59:14 2025 -0700 iommufd/selftest: Update hw_info coverage for an input data_type Test both IOMMU_HW_INFO_TYPE_DEFAULT and IOMMU_HW_INFO_TYPE_SELFTEST, and add a negative test for an unsupported type. Also drop the unused mask in test_cmd_get_hw_capabilities() as checkpatch is complaining. Link: https://patch.msgid.link/r/f01a1e50cd7366f217cbf192ad0b2b79e0eb89f0.1752126748.git.nicolinc@nvidia.com Signed-off-by: Nicolin Chen Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe commit a9f10bab2e5084d6746391fccd7bef6ac87620b8 Author: Nicolin Chen Date: Wed Jul 9 22:59:13 2025 -0700 iommufd: Allow an input data_type via iommu_hw_info The iommu_hw_info can output via the out_data_type field the vendor data type from a driver, but this only allows driver to report one data type. Now, with SMMUv3 having a Tegra241 CMDQV implementation, it has two sets of types and data structs to report. One way to support that is to use the same type field bidirectionally. Reuse the same field by adding an "in_data_type", allowing user space to request for a specific type and to get the corresponding data. For backward compatibility, since the ioctl handler has never checked an input value, add an IOMMU_HW_INFO_FLAG_INPUT_TYPE to switch between the old output-only field and the new bidirectional field. Link: https://patch.msgid.link/r/887378a7167e1786d9d13cde0c36263ed61823d7.1752126748.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 62622a8753fa6af3c104f9552863e6473b92fb31 Author: Nicolin Chen Date: Wed Jul 9 22:59:12 2025 -0700 iommu: Allow an input type in hw_info op The hw_info uAPI will support a bidirectional data_type field that can be used as an input field for user space to request for a specific info data. To prepare for the uAPI update, change the iommu layer first: - Add a new IOMMU_HW_INFO_TYPE_DEFAULT as an input, for which driver can output its only (or firstly) supported type - Update the kdoc accordingly - Roll out the type validation in the existing drivers Link: https://patch.msgid.link/r/00f4a2d3d930721f61367014717b3ba2d1e82a81.1752126748.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Pranjal Shrivastava Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 035c9211f05befe3fa2765c00356d32974176a94 Author: Nicolin Chen Date: Wed Jul 9 22:59:11 2025 -0700 Documentation: userspace-api: iommufd: Update HW QUEUE With the introduction of the new object and its infrastructure, update the doc to reflect that. Link: https://patch.msgid.link/r/caa3ddc0d9bacf05c5b3e02c5f306ff3172cc54d.1752126748.git.nicolinc@nvidia.com Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Lu Baolu Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 80478a2b450e984b5d270d0d7088912d64e84303 Author: Nicolin Chen Date: Wed Jul 9 22:59:10 2025 -0700 iommufd/selftest: Add coverage for the new mmap interface Extend the loopback test to a new mmap page. Link: https://patch.msgid.link/r/b02b1220c955c3cf9ea5dd9fe9349ab1b4f8e20b.1752126748.git.nicolinc@nvidia.com Signed-off-by: Nicolin Chen Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe commit 56e9a0d8e53f56f313d332888a32a44a71f3a9ab Author: Nicolin Chen Date: Wed Jul 9 22:59:09 2025 -0700 iommufd: Add mmap interface For vIOMMU passing through HW resources to user space (VMs), allowing a VM to control the passed through HW directly by accessing hardware registers, add an mmap infrastructure to map the physical MMIO pages to user space. Maintain a maple tree per ictx as a translation table managing mmappable regions, from an allocated for-user mmap offset to an iommufd_mmap struct, where it stores the real physical address range for io_remap_pfn_range(). Keep track of the lifecycle of the mmappable region by taking refcount of its owner, so as to enforce user space to unmap the region first before it can destroy its owner object. To allow an IOMMU driver to add and delete mmappable regions onto/from the maple tree, add iommufd_viommu_alloc/destroy_mmap helpers. Link: https://patch.msgid.link/r/9a888a326b12aa5fe940083eae1156304e210fe0.1752126748.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Reviewed-by: Lu Baolu Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit c56c437b140ed9c9e91d82f4ca705cdb021a9343 Author: Hans de Goede Date: Tue Jul 8 12:46:22 2025 +0200 media: uvcvideo: Use a count variable for meta_formats instead of 0 terminating The code dealing with the 0 terminated meta_formats array is a bit klunky especially for the uvc_meta_v4l2_enum_formats() case. Instead of 0 terminating add an unsigned int nmeta_formats member to struct uvc_device and use that. This leads to slightly cleaner code. Signed-off-by: Hans de Goede Reviewed-by: Ricardo Ribalda Tested-by: Ricardo Ribalda # Camera with MSXU_CONTROL_METADATA Link: https://lore.kernel.org/r/20250708104622.73237-2-hansg@kernel.org Signed-off-by: Hans Verkuil commit 6cb786f040ad35b23b4a7bff8b9d772f22909d48 Author: Ricardo Ribalda Date: Mon Jul 7 18:34:05 2025 +0000 media: uvcvideo: Auto-set UVC_QUIRK_MSXU_META If the camera supports the MSXU_CONTROL_METADATA control, auto set the MSXU_META quirk. Reviewed-by: Hans de Goede Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250707-uvc-meta-v8-5-ed17f8b1218b@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 2ab4019aa34dc2aec4a0824fbf1e49300884fbbf Author: Ricardo Ribalda Date: Mon Jul 7 18:34:04 2025 +0000 media: uvcvideo: Introduce V4L2_META_FMT_UVC_MSXU_1_5 The UVC driver provides two metadata types V4L2_META_FMT_UVC, and V4L2_META_FMT_D4XX. The only difference between the two of them is that V4L2_META_FMT_UVC only copies PTS, SCR, size and flags, and V4L2_META_FMT_D4XX copies the whole metadata section. Now we only enable V4L2_META_FMT_D4XX for the Intel D4xx family of devices, but it is useful to have the whole metadata payload for any device where vendors include other metadata, such as the one described by Microsoft: https://learn.microsoft.com/en-us/windows-hardware/drivers/stream/mf-capture-metadata This patch introduces a new format V4L2_META_FMT_UVC_MSXU_1_5, that is identical to V4L2_META_FMT_D4XX. Let the user enable this format with a quirk for now. This way they can test if their devices provide useful metadata without rebuilding the kernel. They can later contribute patches to auto-quirk their devices. We will also work in methods to auto-detect devices compatible with this new metadata format. Suggested-by: Hans de Goede Reviewed-by: Hans de Goede Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250707-uvc-meta-v8-4-ed17f8b1218b@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 0bb51c8897395de5bd5f571874130aec214ef534 Author: Ricardo Ribalda Date: Mon Jul 7 18:34:03 2025 +0000 media: uvcvideo: Introduce dev->meta_formats Right now, there driver supports devices with one or two metadata formats. Prepare it to support more than two metadata formats. This is achieved with the introduction of a new field `meta_formats`, that contains the array of metadata formats supported by the device, in the order expected by userspace. Suggested-by: Hans de Goede Signed-off-by: Ricardo Ribalda Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250707-uvc-meta-v8-3-ed17f8b1218b@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit e1ad27027587cc9ea03889c63d9d402a61d8e553 Author: Ricardo Ribalda Date: Mon Jul 7 18:34:02 2025 +0000 media: Documentation: Add note about UVCH length field The documentation currently describes the UVC length field as the "length of the rest of the block", which can be misleading. The driver limits the data copied to a maximum of 12 bytes. This change adds a clarifying sentence to the documentation to make this restriction explicit. Reviewed-by: Hans de Goede Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250707-uvc-meta-v8-2-ed17f8b1218b@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit bda2859bff0b9596a19648f3740c697ce4c71496 Author: Ricardo Ribalda Date: Mon Jul 7 18:34:01 2025 +0000 media: uvcvideo: Do not mark valid metadata as invalid Currently, the driver performs a length check of the metadata buffer before the actual metadata size is known and before the metadata is decided to be copied. This results in valid metadata buffers being incorrectly marked as invalid. Move the length check to occur after the metadata size is determined and is decided to be copied. Cc: stable@vger.kernel.org Fixes: 088ead255245 ("media: uvcvideo: Add a metadata device node") Reviewed-by: Laurent Pinchart Reviewed-by: Hans de Goede Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250707-uvc-meta-v8-1-ed17f8b1218b@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 2acded8aa2c89b858495488f6a14cd1d04fc5784 Author: Ricardo Ribalda Date: Tue Jul 1 06:45:19 2025 +0000 media: uvcvideo: uvc_v4l2_unlocked_ioctl: Invert PM logic Instead of listing the IOCTLs that do not need to turn on the camera, list the IOCTLs that need to turn it on. This makes the code more maintainable. This patch changes the behaviour for unsupported IOCTLs. Those IOCTLs will not turn on the camera. Suggested-by: Hans Verkuil Reviewed-by: Hans de Goede Reviewed-by: Hans Verkuil Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250701-uvc-grannular-invert-v4-7-8003b9b89f68@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 1657624a69fcfd3f27ba6223e1c8fb6a16815568 Author: Ricardo Ribalda Date: Tue Jul 1 06:45:18 2025 +0000 media: core: export v4l2_translate_cmd video_translate_cmd() can be useful for drivers to convert between the VIDIOC_*32 and VIDIOC_ defines. Let's export it. Now that the function is exported, use this opportunity to rename the function with the v4l2_ prefix, that is less ambiguous than video_ The VIDIOC_*32 defines are not accessible by the drivers, they live in v4l2-compat-ioctl32.c. Reviewed-by: Hans Verkuil Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250701-uvc-grannular-invert-v4-6-8003b9b89f68@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit a03e32e60141058d46ea8cf4631654c43c740fdb Author: Ricardo Ribalda Date: Tue Jul 1 06:45:17 2025 +0000 media: uvcvideo: Turn on the camera if V4L2_EVENT_SUB_FL_SEND_INITIAL If we subscribe to an event with V4L2_EVENT_SUB_FL_SEND_INITIAL, the driver needs to report back some values that require the camera to be powered on. But VIDIOC_SUBSCRIBE_EVENT is not part of the ioctls that turn on the camera. We could unconditionally turn on the camera during VIDIOC_SUBSCRIBE_EVENT, but it is more efficient to turn it on only during V4L2_EVENT_SUB_FL_SEND_INITIAL, which we believe is not a common usecase. To avoid a list_del if uvc_pm_get() fails, we move list_add_tail to the end of the function. Reviewed-by: Hans de Goede Fixes: d1b618e79548 ("media: uvcvideo: Do not turn on the camera for some ioctls") Cc: stable@vger.kernel.org Reviewed-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250701-uvc-grannular-invert-v4-5-8003b9b89f68@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 7dd56c47784a466b03df62ca766207f483353cdc Author: Ricardo Ribalda Date: Mon Jun 16 15:24:41 2025 +0000 media: uvcvideo: Remove stream->is_streaming field The is_streaming field is used by modular PM to know if the device is currently streaming or not. With the transition to vb2 and fop helpers, we can use vb2 functions for the same functionality. The great benefit is that vb2 already tracks the streaming state for us. Reviewed-by: Hans de Goede Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250616-uvc-fop-v4-4-250286570ee7@chromium.org Reviewed-by: Hans Verkuil Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 54828c0d4f909bd706e15cfaa29758f2c1d59212 Author: Ricardo Ribalda Date: Mon Jun 16 15:24:40 2025 +0000 media: uvcvideo: Split uvc_stop_streaming() uvc_stop_streaming() is used for meta and video nodes. Split the function in two to avoid confusion. Use this opportunity to rename uvc_start_streaming() to uvc_start_streaming_video(), as it is only called by the video nodes. Reviewed-by: Hans de Goede Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250616-uvc-fop-v4-3-250286570ee7@chromium.org Reviewed-by: Hans Verkuil Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit b7ef53670321327f45de8bde5d38f1215927336f Author: Ricardo Ribalda Date: Mon Jun 16 15:24:39 2025 +0000 media: uvcvideo: Handle locks in uvc_queue_return_buffers Most of the calls to uvc_queue_return_buffers() wrap the call with spin_lock_irq()/spin_unlock_irq(). Rename uvc_queue_return_buffers to __uvc_queue_return_buffers to indicate that this is the version that does not handle locks and create a new version of the function that handles the lock. Reviewed-by: Hans de Goede Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250616-uvc-fop-v4-2-250286570ee7@chromium.org Reviewed-by: Hans Verkuil Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit c93d73c9c2cfa7658f7100d201a47c4856746222 Author: Hans Verkuil Date: Mon Jun 16 15:24:38 2025 +0000 media: uvcvideo: Use vb2 ioctl and fop helpers When uvc was written the vb2 ioctl and file operation helpers didn't exist. This patch switches uvc over to those helpers, which removes a lot of boilerplate code and allows us to drop the 'privileges' scheme, since that's now handled inside the vb2 helpers. This makes it possible for uvc to fix the v4l2-compliance streaming tests: warn: v4l2-test-formats.cpp(1075): Could not set fmt2 This patch introduces a change on behavior on the uvcdriver to be aligned with the rest of the subsystem. Now S_INPUT, S_PARM and S_FORMAT do no grant exclusive ownership of the device. There are other side effects, some better than others: - Locking is now more coarse than before, the queue is locked for almost every ioctl. - vidioc_querybuf() can now work when the queue is busy. Future patches should look into the locking architecture of UVC to remove one of stream->mutex or queue->mutex. Reviewed-by: Hans de Goede Reviewed-by: Hans Verkuil Co-developed-by: Ricardo Ribalda Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250616-uvc-fop-v4-1-250286570ee7@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 1a11201668e8635602577dcf06f2e96c591d8819 Author: Jan Kara Date: Fri Jul 11 19:01:20 2025 +0200 udf: Verify partition map count Verify that number of partition maps isn't insanely high which can lead to large allocation in udf_sb_alloc_partition_maps(). All partition maps have to fit in the LVD which is in a single block. Reported-by: syzbot+478f2c1a6f0f447a46bb@syzkaller.appspotmail.com Signed-off-by: Jan Kara commit a339dd699a7aa01bce4b38c8d81def310cf2bca0 Author: Mohsin Bashir Date: Thu Jul 10 11:43:47 2025 -0700 selftests: drv-net: Add bpftool util Add bpf utility to simplify the use of bpftool for XDP tests included in this series. Signed-off-by: Mohsin Bashir Link: https://patch.msgid.link/20250710184351.63797-2-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 185d3490feb324433a91aa5a4296f76e4c0b87c5 Author: Christoph Hellwig Date: Fri Jul 11 10:10:36 2025 +0200 udf: stop using write_cache_pages Stop using the obsolete write_cache_pages and use writeback_iter directly. Use the chance to refactor the inacb writeback code to not have a separate writeback helper. Signed-off-by: Christoph Hellwig Signed-off-by: Jan Kara Link: https://patch.msgid.link/20250711081036.564232-1-hch@lst.de commit bdf2d9fd3a86538b8c7368989248b857b5f1bcf1 Author: Li Ming Date: Fri Jul 11 11:23:57 2025 +0800 cxl/core: Using cxl_resource_contains_addr() to check address availability Helper function cxl_resource_contains_addr() can be used to check if a resource range contains an input address. Use it to replace all code that checks whether a resource range contains a DPA/HPA/SPA. Signed-off-by: Li Ming Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250711032357.127355-4-ming.li@zohomail.com Signed-off-by: Dave Jiang commit 03ff65c02559e8da32be231d7f10fe899233ceae Author: Li Ming Date: Fri Jul 11 11:23:56 2025 +0800 cxl/edac: Fix wrong dpa checking for PPR operation Per Table 8-143. "Get Partition Info Output Payload" in CXL r3.2 section 8.2.10.9.2.1 "Get Partition Info(Opcode 4100h)", DPA 0 is a valid address of a CXL device. However, cxl_do_ppr() considers it as an invalid address, so that user will get an -EINVAL when user calls the sysfs interface of the edac driver to trigger a Post Package Repair(PPR) operation for DPA 0 on a CXL device. The correct implementation should be checking if the input DPA is in the DPA range of the CXL device. Fixes: be9b359e056a ("cxl/edac: Add CXL memory device soft PPR control feature") Signed-off-by: Li Ming Tested-by: Shiju Jose Reviewed-by: Shiju Jose Reviewed-by: Dave Jiang Reviewed-by: Alison Schofield Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250711032357.127355-3-ming.li@zohomail.com Signed-off-by: Dave Jiang commit 5b6031c832c2747d58d3f0130098d965ef050b9a Author: Li Ming Date: Fri Jul 11 11:23:55 2025 +0800 cxl/core: Introduce a new helper cxl_resource_contains_addr() In CXL subsystem, many functions need to check an address availability by checking if the resource range contains the address. Providing a new helper function cxl_resource_contains_addr() to check if the resource range contains the input address. Suggested-by: Alison Schofield Signed-off-by: Li Ming Tested-by: Shiju Jose Reviewed-by: Andy Shevchenko Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Reviewed-by: Alison Schofield Link: https://patch.msgid.link/20250711032357.127355-2-ming.li@zohomail.com Signed-off-by: Dave Jiang commit 979c5ce4a37680063d87fe13d662ed68e06e77c3 Author: Sivashankari Madhavan Date: Wed Jul 9 19:05:54 2025 +0530 wifi: ath12k: support average ack rssi in station dump Currently, the ACK RSSI value is not shown in station dump. Enable WMI resource flag for ACK RSSI in WMI INIT command to add ACK RSSI value in management TX completion event from WMI. Update ACK RSSI value obtained in management and data frame completion path to ieee80211_tx_info. Also advertise NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT flag during hardware register to mac80211 layer so that ACK RSSI is added to station dump message. Example output : Station aa:bb:cc:dd:ee:ff (on wlp88s0) inactive time: 46584 ms rx bytes: 955 rx packets: 10 tx bytes: 769 tx packets: 6 tx retries: 81 tx failed: 0 rx drop misc: 0 signal: -39 dBm signal avg: -40 dBm tx bitrate: 6.0 MBit/s tx duration: 1185 us rx bitrate: 309.7 MBit/s 40MHz HE-MCS 6 HE-NSS 2 HE-GI 0 HE-DCM 0 rx duration: 0 us last ack signal:-41 dBm avg ack signal: -40 dBm authorized: yes authenticated: yes ....... Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Sivashankari Madhavan Signed-off-by: Sowmiya Sree Elavalagan Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250709133554.622463-1-quic_ssreeela@quicinc.com Signed-off-by: Jeff Johnson commit a026dc61cffd98541e048f3c88d3280bcd105bd4 Author: David Kaplan Date: Mon Jul 7 13:33:15 2025 -0500 x86/bugs: Print enabled attack vectors Print the status of enabled attack vectors and SMT mitigation status in the boot log for easier reporting and debugging. This information will also be available through sysfs. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-21-david.kaplan@amd.com commit 6b21d2f0dc73699e468c877515472c52a5837f8f Author: David Kaplan Date: Wed Jul 9 10:58:44 2025 -0500 x86/bugs: Add attack vector controls for TSA Use attack vector controls to determine which TSA mitigation to use. [ bp: Simplify the condition in the select function for better readability. ] Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250709155844.3279471-1-david.kaplan@amd.com commit 02c7d5b8e0d123185817f533ed12622ed1c695e5 Author: David Kaplan Date: Mon Jul 7 13:33:14 2025 -0500 x86/pti: Add attack vector controls for PTI Disable PTI mitigation if user->kernel attack vector mitigations are disabled. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-20-david.kaplan@amd.com commit 0cdd2c4f35cf9bb9466b36724b658d11ff453f04 Author: David Kaplan Date: Mon Jul 7 13:33:13 2025 -0500 x86/bugs: Add attack vector controls for ITS Use attack vector controls to determine if ITS mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-19-david.kaplan@amd.com commit eda718fde6159b2e64978637ebb3f1ae98180555 Author: David Kaplan Date: Mon Jul 7 13:33:12 2025 -0500 x86/bugs: Add attack vector controls for SRSO Use attack vector controls to determine if SRSO mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-18-david.kaplan@amd.com commit 2f970a526975f4437bdc9a4ba550ecc7e66d861d Author: David Kaplan Date: Mon Jul 7 13:33:11 2025 -0500 x86/bugs: Add attack vector controls for L1TF Use attack vector controls to determine if L1TF mitigation is required. Disable SMT if cross-thread protection is desired. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-17-david.kaplan@amd.com commit fdf99228e2f4e0486dc629e87fcece42abfe3f9c Author: David Kaplan Date: Mon Jul 7 13:33:10 2025 -0500 x86/bugs: Add attack vector controls for spectre_v2 Use attack vector controls to determine if spectre_v2 mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-16-david.kaplan@amd.com commit ddcd4d3cb37c8ad60cdbaaffe93f85e15e2babb5 Author: David Kaplan Date: Mon Jul 7 13:33:09 2025 -0500 x86/bugs: Add attack vector controls for BHI Use attack vector controls to determine if BHI mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-15-david.kaplan@amd.com commit 07a659edcf6eb56f7906fc415f46e3a7f37d5383 Author: David Kaplan Date: Mon Jul 7 13:33:08 2025 -0500 x86/bugs: Add attack vector controls for spectre_v2_user Use attack vector controls to determine if spectre_v2_user mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-14-david.kaplan@amd.com commit 9687eb2399379ae4e5b5cc1bccdf893c753dcffb Author: David Kaplan Date: Mon Jul 7 13:33:07 2025 -0500 x86/bugs: Add attack vector controls for retbleed Use attack vector controls to determine if retbleed mitigation is required. Disable SMT if cross-thread protection is desired and STIBP is not available. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-13-david.kaplan@amd.com commit 19a5f3ea4394bf813a03d1ff0efe59a7f74cc12c Author: David Kaplan Date: Mon Jul 7 13:33:06 2025 -0500 x86/bugs: Add attack vector controls for spectre_v1 Use attack vector controls to determine if spectre_v1 mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-12-david.kaplan@amd.com commit 8c7261abcb7ad1df493773fd52ff3ddce37a25e6 Author: David Kaplan Date: Mon Jul 7 13:33:05 2025 -0500 x86/bugs: Add attack vector controls for GDS Use attack vector controls to determine if GDS mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-11-david.kaplan@amd.com commit 71dc301c26e9503350cf4e736022cc1eb8e986a7 Author: David Kaplan Date: Mon Jul 7 13:33:04 2025 -0500 x86/bugs: Add attack vector controls for SRBDS Use attack vector controls to determine if SRBDS mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-10-david.kaplan@amd.com commit 54b53dca650bb273655a9a9b5a5b5a3fced0bcc1 Author: David Kaplan Date: Mon Jul 7 13:33:03 2025 -0500 x86/bugs: Add attack vector controls for RFDS Use attack vector controls to determine if RFDS mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-9-david.kaplan@amd.com commit de6f0921ba49f5e07f57eb227dcb69ebb4776911 Author: David Kaplan Date: Mon Jul 7 13:33:02 2025 -0500 x86/bugs: Add attack vector controls for MMIO Use attack vectors controls to determine if MMIO mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-8-david.kaplan@amd.com commit 736565d4edcd8b6dad50fca0c0134e7918e3d61c Author: David Kaplan Date: Mon Jul 7 13:33:01 2025 -0500 x86/bugs: Add attack vector controls for TAA Use attack vector controls to determine if TAA mitigation is required. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-7-david.kaplan@amd.com commit e3a88d4c068242c00a1d6ddfd3c711fc22983f75 Author: David Kaplan Date: Mon Jul 7 13:33:00 2025 -0500 x86/bugs: Add attack vector controls for MDS Use attack vector controls to determine if MDS mitigation is required. The global mitigations=off command now simply disables all attack vectors so explicit checking of mitigations=off is no longer needed. If cross-thread attack mitigations are required, disable SMT. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-6-david.kaplan@amd.com commit 2d31d2874663cde2cab8c18bfb52ed8be6dfa958 Author: David Kaplan Date: Mon Jul 7 13:32:59 2025 -0500 x86/bugs: Define attack vectors relevant for each bug Add a function which defines which vulnerabilities should be mitigated based on the selected attack vector controls. The selections here are based on the individual characteristics of each vulnerability. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-5-david.kaplan@amd.com commit 735e59204b5eb5aa55ba64be5d8ff4223b197816 Author: David Kaplan Date: Mon Jul 7 13:32:58 2025 -0500 x86/Kconfig: Add arch attack vector support ARCH_HAS_CPU_ATTACK_VECTORS should be set for architectures which implement the new attack-vector based controls for CPU mitigations. If an arch does not support attack-vector based controls then an attempt to use them results in a warning. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-4-david.kaplan@amd.com commit 19c24f7ee39af503b9731067b91add627b70ecb6 Author: David Kaplan Date: Mon Jul 7 13:32:57 2025 -0500 cpu: Define attack vectors Define 4 new attack vectors that are used for controlling CPU speculation mitigations. These may be individually disabled as part of the mitigations= command line. Attack vector controls are combined with global options like 'auto' or 'auto,nosmt' like 'mitigations=auto,no_user_kernel'. The global options come first in the mitigations= string. Cross-thread mitigations can either remain enabled fully, including potentially disabling SMT ('auto,nosmt'), remain enabled except for disabling SMT ('auto'), or entirely disabled through the new 'no_cross_thread' attack vector option. The default settings for these attack vectors are consistent with existing kernel defaults, other than the automatic disabling of VM-based attack vectors if KVM support is not present. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250707183316.1349127-3-david.kaplan@amd.com commit 1caa1b0509eaec2ea111b875da4eddb44edc9ea5 Author: David Kaplan Date: Wed Jul 9 10:57:31 2025 -0500 Documentation/x86: Document new attack vector controls Document the 5 new attack vector command line options, how they interact with existing vulnerability controls, and recommendations on when they can be disabled. Note that while mitigating against untrusted userspace requires both user-to-kernel and user-to-user protection, these are kept separate. The kernel can control what code executes inside of it and that may affect the risk associated with vulnerabilities especially if new kernel mitigations are implemented. The same isn't typically true of userspace. In other words, the risk associated with user-to-user or guest-to-guest attacks is unlikely to change over time. While the risk associated with user-to-kernel or guest-to-host attacks may change. Therefore, these controls are separated. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250709155731.3279419-1-david.kaplan@amd.com commit 6e38b9fcbfa3053e1b5d2806a7233078d712bd34 Author: Arnd Bergmann Date: Wed Jul 9 17:17:28 2025 +0200 platform/x86: lenovo: gamezone needs "other mode" Registering the "other mode" notifier fails if that is disabled: x86_64-linux-ld: drivers/platform/x86/lenovo/wmi-gamezone.o: in function `lwmi_gz_probe': wmi-gamezone.c:(.text+0x336): undefined reference to `devm_lwmi_om_register_notifier' This could be fixed by adding a stub helper, but a Kconfig 'select' seems simpler here. Fixes: 22024ac5366f ("platform/x86: Add Lenovo Gamezone WMI Driver") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250709151734.1268435-1-arnd@kernel.org [ij: retained the other selects as wmi-gamezone is using them directly.] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c12fe703cab93f9d8bfe0ff32b58e7b1fd52be1f Author: Matthew Auld Date: Thu Jul 10 14:41:29 2025 +0100 drm/xe/migrate: fix copy direction in access_memory After we do the modification on the host side, ensure we write the result back to VRAM and not the other way around, otherwise the modification will be lost if treated like a read. Fixes: 270172f64b11 ("drm/xe: Update xe_ttm_access_memory to use GPU for non-visible access") Signed-off-by: Matthew Auld Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250710134128.800756-2-matthew.auld@intel.com commit ea045a0de3b9de8f917f0149783bae8dc14fcbb2 Author: Pagadala Yesu Anjaneyulu Date: Thu Jul 10 21:28:32 2025 +0300 wifi: iwlwifi: add support for accepting raw DSM tables by firmware Firmware would assert on undefined bits in DSM-originated DWs. With this change, Firmware introduces a fail-safe mechanism and removes the assert behavior. This ensures robustness when handling raw DSM table data. Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.eee871df03c9.I2be2eaa16437e84aa1be0c6c95ec334034ce7e50@changeid commit 8513096a3457374dba0b39782923b1e80f88a5ae Author: Johannes Berg Date: Thu Jul 10 21:28:31 2025 +0300 wifi: iwlwifi: pcie: don't WARN on bad firmware input Don't WARN, which results in a useless backtrace, but just use IWL_FW_CHECK() instead. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.4aedc0979beb.I3bd4d4296c7245261651603708456b7c67f55539@changeid commit 8580be27e2cd9cbfa754e884c8bb705776204d18 Author: Miri Korenblit Date: Thu Jul 10 21:28:30 2025 +0300 wifi: iwlwifi: mld: don't remove all keys in mcast rekey In the current code, if there was a rekey, we remove all the existing keys from mac80211, then re-add the ones that the FW sent with ieee80211_gtk_rekey_add, (newer FW will send also the existing GTKs/BIGTKs) and then update the sequence number. Instead of removing and re-adding the existing keys for no good reason, we can just update the sequence of all keys, also of the ones that are going to be replaced, and update again after the replace. This change is required because ieee80211_gtk_rekey_add is going to be changed to lookup the cipher from the old key instead of receiving it as an argument, and for this it will need the old key(s), so we can't remove all keys. Note that with this change, in case that a key that existed before wowlan is replaced, mac80211 will now call the driver to remove the old key and add the new one (as opposed the previous behaviour, in which the key was removed by the driver itself). Of course we don't want to run the set_key callbacks in this case, so just return early. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.f0b5e19f77f5.I958f4926f168cdad6d4d7720ebde2f5e812b297d@changeid commit 50dc4270ba606085de1d209b0e714b78872c9098 Author: Miri Korenblit Date: Thu Jul 10 21:28:29 2025 +0300 wifi: iwlwifi: mvm: don't remove all keys in mcast rekey In the current code, if there was a rekey, we remove all the existing keys from mac80211, then re-add the ones that the FW sent with ieee80211_gtk_rekey_add, (newer FW will send also the existing GTKs/BIGTKs) and then update the sequence number. Instead of removing and re-adding the existing keys for no good reason, we can just update the sequence of all keys, also of the ones that are going to be replaced, and update again after the replace. This change is required because ieee80211_gtk_rekey_add is going to be changed to lookup the cipher from the old key instead of receiving it as an argument, and for this it will need the old key(s), so we can't remove all keys. Note that with this change, in case that a key that existed before wowlan is replaced, mac80211 will now call the driver to remove the old key and add the new one (as opposed the previous behaviour, in which the key was removed by the driver itself). Of course we don't want to run the set_key callbacks in this case, so just return early. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.10091484e38e.I45daf089189f606f3879ca4538fb46303d761710@changeid commit 5bb88e36cf13b18510f837a25580a518687566d4 Author: Miri Korenblit Date: Thu Jul 10 21:28:28 2025 +0300 wifi: iwlwifi: mvm: always set the key idx in gtk_seq For older APIs, gtk_seq[0].key_id will be set to -1, while other code assumes that it will always be a valid gtk key idx. Since the FW does provide the idx for those APIs, simply set it. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.2a5a5e4d7b19.Ib795751119070495c0c95526cd36bd7f87594f56@changeid commit 61be9803f322ab46f31ba944c6ef7de195891f64 Author: Miri Korenblit Date: Thu Jul 10 21:28:27 2025 +0300 wifi: iwlwifi: mvm: set gtk id also in older FWs We use gtk[i].id, but it is not even set in older FW APIs (iwl_wowlan_status_v6 and iwl_wowlan_status_v7). Set it also in older FWs. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.e91e49590414.I27d2fdbed1c54aee59929fa11ec169f07e159406@changeid commit 5bc741e1b1d580fe73d48b14c5b111c413de2acf Author: Johannes Berg Date: Thu Jul 10 21:28:26 2025 +0300 wifi: iwlwifi: fix HE/EHT capabilities The default capabilities were set to much more than the hardware currently is intended to support, and then masked off for only the GL MAC type. However, this was due to some miscommunication and is incorrect, it should've been masked off for all current and planned MACs/RFs. Instead of doing this removing and adding of capabilities, simply list the ones that currently apply to all devices. If this changes for a new device type we can change the code, but at least the driver won't erroneously advertise some capabilities that aren't actually implemented in hardware. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.69b9dac7d906.I7885499bc80453d5a84285ec927f5e89f9adfb21@changeid commit 11c5cc9ec6d9e09cd052f5a75574f5989b37f16c Author: Rotem Kerem Date: Thu Jul 10 21:28:25 2025 +0300 wifi: iwlwifi: add iwl_trans_is_dead() API Add iwl_trans_is_dead() function to be called by the op modes instead of directly checking the trans status bits. This hides the trans internal implementation details from callers. Signed-off-by: Rotem Kerem Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.cd89d8013261.I214b7ffbabc393593fb57831d61d1a9ffa318a1e@changeid commit c7236b1f5ac42e475f2413b76ff24936c6c96c95 Author: Rotem Kerem Date: Thu Jul 10 21:28:24 2025 +0300 wifi: iwlwifi: add iwl_trans_device_enabled() API add iwl_trans_device_enabled() function to be called by the op modes instead of directly checking the trans status bits. This hides the trans internal implementation details. Signed-off-by: Rotem Kerem Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.bb957ba9e130.I6ab825caf41308fb0f7aa1c266f50457fd0c496e@changeid commit 200945e6a6837b33386a8c9233950046170f36c3 Author: Rotem Kerem Date: Thu Jul 10 21:28:23 2025 +0300 wifi: iwlwifi: add suppress_cmd_error_once() API Add iwl_trans_suppress_cmd_error_once() function to be called by the op modes instead of directly checking the trans status bits. This hides the trans internal implementation details from callers. Signed-off-by: Rotem Kerem Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.e061ae241fd3.Ie2043c4e237196ebcfe195006d3d76371de48a55@changeid commit 278881748143186d7839c0cc1aa9f3d8d90a755f Author: Johannes Berg Date: Thu Jul 10 21:28:22 2025 +0300 wifi: iwlwifi: mld: restrict puncturing disable to FM Later RFs will always do puncturing, regardless of BIOS configuration, and earlier RFs aren't supported in MLD. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.6fa9c44964c1.I46a4cd744a769ec2ac3c8f9a04882140449394b8@changeid commit 0ac7a266c3232dc68ddf03c366c21b5b16975d7e Author: Johannes Berg Date: Thu Jul 10 21:28:21 2025 +0300 wifi: iwlwifi: mvm: remove regulatory puncturing setup We don't have puncturing before EHT, and EHT devices aren't supported in iwlmvm, so remove the regulatory puncturing setup code. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.b2a28a99725b.I72ba276cb705c02cea8f68e27ef3935d5120cfee@changeid commit 589bc6ec069fd0bb71765a3e4b0257c2ba0984f0 Author: Avraham Stern Date: Thu Jul 10 21:28:20 2025 +0300 wifi: iwlwifi: mld: update expected range response notification version The last version for the range response notification is 10. Update the expected version accordingly. Signed-off-by: Avraham Stern Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.377d24e29ac6.I44119a4e793bba35b46e1d35e2c378ce6f901bfd@changeid commit 0d17b0c1ab8f18648f66ad17c1b1cc6ceb740a02 Author: Avraham Stern Date: Thu Jul 10 21:28:19 2025 +0300 wifi: iwlwifi: mld: update the P2P device mac before starting the GO When a GO is started, the P2P device mac is updated to indicate that frames for the P2P device mac should be filtered in while the GO is active. However, this configuration is done after the GO is already started so it doesn't take effect. Fix it by updating the P2P device mac before adding the broadcast station, which actually starts the GO. Signed-off-by: Avraham Stern Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.463a0ad545f9.I85a25484d787b65f6a27e794285911e319df0b2d@changeid commit d1f5f881ac2c5dc185a88c7bfe47d2b3ecbbc501 Author: Avraham Stern Date: Thu Jul 10 21:28:18 2025 +0300 wifi: iwlwifi: mld: fix scan request validation The scan request validation function uses bitwise and instead of logical and. Fix it. Signed-off-by: Avraham Stern Reviewed-by: Daniel Gabay Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250710212632.ec7d665f56a4.I416816b491fafa5d3efdf0a4be78356eedf2bd95@changeid commit 3c2c00572fc3e0b128f75c7ce9c3f70ca457cc3b Author: Svyatoslav Ryhel Date: Tue Apr 29 09:18:02 2025 +0300 ARM: tegra: chagall: Add embedded controller node Add embedded controller node to Pegatron Chagall device-tree. Signed-off-by: Svyatoslav Ryhel Link: https://lore.kernel.org/r/20250429061803.9581-5-clamor95@gmail.com Signed-off-by: Thierry Reding commit 118a745e617a43bd0047c72ebff931cd09179dbc Author: Svyatoslav Ryhel Date: Mon Jun 16 10:39:47 2025 +0300 ARM: tegra: Add device-tree for Asus Portable AiO P1801-T Add a device-tree for the Asus Portable AiO P1801-T, which is a NVIDIA Tegra30-based 2-in-1 detachable tablet, originally running Android. The tablet was also sold together with a PC docking station as the Transformer AiO P1801. Tested-by: Andreas Westman Dorcsak # P1801-T with dock Co-developed-by: Maxim Schwalm Signed-off-by: Maxim Schwalm Signed-off-by: Svyatoslav Ryhel Link: https://lore.kernel.org/r/20250616073947.13675-3-clamor95@gmail.com Signed-off-by: Thierry Reding commit ad8247beb4c45acd29ded24c8e956bb96ece84d6 Author: Maxim Schwalm Date: Mon Jun 16 10:39:46 2025 +0300 dt-bindings: arm: tegra: Add Asus Portable AiO P1801-T Add a compatible for the Asus Portable AiO P1801-T. Signed-off-by: Maxim Schwalm Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250616073947.13675-2-clamor95@gmail.com Signed-off-by: Thierry Reding commit 6382c27389c266e90b31151a79d81fa6e122d2d6 Author: Arnd Bergmann Date: Fri Jul 11 09:27:09 2025 +0200 platform/x86/intel/pmt/discovery: fix format string warning When -Wformat-security is enabled, this new code triggers it: drivers/platform/x86/intel/pmt/discovery.c: In function 'pmt_features_discovery': drivers/platform/x86/intel/pmt/discovery.c:505:36: error: format not a string literal and no format arguments [-Werror=format-security] 505 | pmt_feature_names[feature->id]); Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250711072718.2748415-1-arnd@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d01e4f1e7aa8833f549ac61a0bbcdc395533269b Author: Thierry Reding Date: Thu Jul 10 01:13:59 2025 +0200 arm64: tegra: Add p3971-0089+p3834-0008 support The P3971-0089+P3834-0008 is an engineering reference platform for the Tegra264 SoC. Link: https://lore.kernel.org/r/20250709231401.3767130-3-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit b7117911e13cf5343d0f160507719afd5c25b31c Author: Thierry Reding Date: Thu Jul 10 01:14:00 2025 +0200 arm64: tegra: Add memory controller on Tegra264 Link: https://lore.kernel.org/r/20250709231401.3767130-4-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 65ef237e4810f6bb0f44b250d963b48790dec369 Author: Thierry Reding Date: Thu Jul 10 01:13:58 2025 +0200 arm64: tegra: Add Tegra264 support Add basic support for the Tegra264 SoC, sufficient for booting into an initial ramdisk. Link: https://lore.kernel.org/r/20250709231401.3767130-2-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit f1358b134418ff4c90dc522f339e0342c881d5bd Merge: 19272b37aa4f83 0b226380d4cce2 Author: Thierry Reding Date: Fri Jul 11 16:50:17 2025 +0200 Merge branch 'for-6.17/dt-bindings' into for-6.17/arm64/dt commit 2401dc4dcdd02920faa9a8c4384f1503a15e779a Author: Sumit Gupta Date: Thu Jul 10 00:21:47 2025 +0200 memory: tegra: Add Tegra264 MC and EMC support Add support to enable Memory Controller (MC) and External Memory Controller (EMC) drivers for Tegra264. The nodes for MC and EMC are mostly the same as Tegra234 but differ in number of channels and interrupt numbers. The patch also adds the bandwidth manager definitions required for Tegra264 and uses them to populate the memory client table. All of these are needed to properly enable memory interconnect (ICC) support. Signed-off-by: Sumit Gupta Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250709222147.3758356-3-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 1f7bc0ec363bf931dc864c3a66a132d7da9136bc Merge: 19272b37aa4f83 0b226380d4cce2 Author: Thierry Reding Date: Fri Jul 11 16:49:21 2025 +0200 Merge branch 'for-6.17/dt-bindings' into for-6.17/memory commit 992c6940fd4595659317dafbcca2bbb6004e9a3e Author: Maxim Schwalm Date: Tue Jun 17 10:03:19 2025 +0300 dt-bindings: arm: tegra: Add Asus VivoTab RT TF600T Add a compatible for the Asus VivoTab RT TF600T. Signed-off-by: Maxim Schwalm Signed-off-by: Svyatoslav Ryhel Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250617070320.9153-2-clamor95@gmail.com Signed-off-by: Thierry Reding commit 319cc06db42ac0cd6256a26b4ea21b52a6fe6308 Author: Thierry Reding Date: Tue Jul 8 10:28:11 2025 +0200 dt-bindings: Add Tegra264 clock and reset definitions The BPMP firmware on Tegra264 defines a set of IDs for clock and reset resources. These are not enumerations but provided by hardware, and 0 is a reserved value, hence the numbering starts at 1. Acked-by: Rob Herring (Arm) Signed-off-by: Thierry Reding commit ad83c4cd19b259a69515ae26410bc9cef7b1f938 Author: Thierry Reding Date: Wed May 7 16:37:57 2025 +0200 dt-bindings: tegra: Document P3971-0089+P3834-0008 Platform This is an engineering reference platform for the Tegra264 SoC. Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250507143802.1230919-4-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 9ef6e3a1c69c5ecbe702c62ac620e5777aadead4 Author: Thierry Reding Date: Wed May 7 16:37:56 2025 +0200 dt-bindings: rtc: tegra: Document Tegra264 RTC Add the compatible string for the RTC block found on the Tegra264 SoC. Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250507143802.1230919-3-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit bb8c97571db58e149a820dfca44ba2d960182247 Author: Thierry Reding Date: Wed May 7 16:37:55 2025 +0200 dt-bindings: dma: Add Tegra264 compatible string Document the compatible string used for the GPCDMA controller on Tegra264. Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250507143802.1230919-2-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 320b762893e73b44f02e8cf60ebc9bd4fec1c7cd Author: Thierry Reding Date: Tue May 6 15:31:12 2025 +0200 dt-bindings: misc: Document Tegra264 APBMISC compatible Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250506133118.1011777-6-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 52f117f8a715085661a37cc7cb47f2d4720ef7e1 Author: Thierry Reding Date: Tue May 6 15:31:11 2025 +0200 dt-bindings: firmware: Document Tegra264 BPMP While the BPMP found on Tegra264 is similar to the versions found on previous chips and should be backwards-compatible, some changes could eventually be needed. Anticipate such changes and introduce a chip- specific compatible string. Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250506133118.1011777-5-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 276b86f6f665f52d9ad408d956a33420089c5962 Author: Thierry Reding Date: Tue May 6 15:31:10 2025 +0200 dt-bindings: mailbox: tegra-hsp: Properly sort compatible string list Device tree maintainers prefer all single entry cases to be grouped under an enum. Furthermore, alphanumeric ordering is easier for the majority of people to understand than ordering by release, which is quirky. Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250506133118.1011777-4-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 3e11c77250925480ffcffde345f24641b86f035a Author: Thierry Reding Date: Tue May 6 15:31:09 2025 +0200 dt-bindings: mailbox: tegra-hsp: Bump number of shared interrupts It turns out that some instances of the HSP block on Tegra264 can have up to 16 shared interrupts, so bump the maximum number of allowed interrupts. Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250506133118.1011777-3-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 0b226380d4cce2e6ee50800d861934d474a30121 Author: Sumit Gupta Date: Thu Jul 10 00:21:46 2025 +0200 dt-bindings: memory: tegra: Add Tegra264 support Add bindings for the Memory Controller (MC) and External Memory Controller (EMC) found on the Tegra264 SoC. Tegra264 SoC has a different number of interrupt lines for MC sub-units: UCF_SOC, hub, hub common, syncpoint and MC channel. The total number of interrupt lines is eight. Update maxItems for MC interrupts accordingly. This also adds a header containing the memory client ID definitions that are used by the interconnects property in DT and the tegra_mc_client table in the MC driver. These IDs are defined by the hardware, so the numbering doesn't start at 0 and contains holes. Also added are the stream IDs for various hardware blocks found on Tegra264. These are allocated as blocks of 256 IDs and each block can be subdivided for additional fine-grained isolation if needed. Signed-off-by: Sumit Gupta [treding@nvidia.com: add SMMU stream IDs, squash patches] Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250709222147.3758356-2-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit cbbdea0dc4293bc5d902179766c5a89eebd4496c Author: Thierry Reding Date: Tue May 6 15:31:08 2025 +0200 dt-bindings: tegra: pmc: Add Tegra264 compatible The PMC found on Tegra264 is similar to the version in earlier chips but some of the register offsets and bitfields differ, so add a specific compatible string for this new generation. Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250506133118.1011777-2-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 917b10d90990fd2138b5dbc2d22cfa428c070ade Author: Alice Ryhl Date: Fri Jul 11 08:04:38 2025 +0000 drm: rust: rename as_ref() to from_raw() for drm constructors The prefix as_* should not be used for a constructor. Constructors usually use the prefix from_* instead. Some prior art in the stdlib: Box::from_raw, CString::from_raw, Rc::from_raw, Arc::from_raw, Waker::from_raw, File::from_raw_fd. There is also prior art in the kernel crate: cpufreq::Policy::from_raw, fs::File::from_raw_file, Kuid::from_raw, ARef::from_raw, SeqFile::from_raw, VmaNew::from_raw, Io::from_raw. Link: https://lore.kernel.org/r/aCd8D5IA0RXZvtcv@pollux Signed-off-by: Alice Ryhl Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250711-device-as-ref-v2-2-1b16ab6402d7@google.com commit 20896914da8ad24df0a77e24887912d87754fb83 Author: Nicolin Chen Date: Wed Jul 9 22:59:08 2025 -0700 iommufd/selftest: Add coverage for IOMMUFD_CMD_HW_QUEUE_ALLOC Some simple tests for IOMMUFD_CMD_HW_QUEUE_ALLOC infrastructure covering the new iommufd_hw_queue_depend/undepend() helpers. Link: https://patch.msgid.link/r/e8a194d187d7ef445f43e4a3c04fb39472050afd.1752126748.git.nicolinc@nvidia.com Signed-off-by: Nicolin Chen Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe commit 0b37d892d0425811618a737037b0212884cc25ae Author: Nicolin Chen Date: Wed Jul 9 22:59:07 2025 -0700 iommufd/driver: Add iommufd_hw_queue_depend/undepend() helpers NVIDIA Virtual Command Queue is one of the iommufd users exposing vIOMMU features to user space VMs. Its hardware has a strict rule when mapping and unmapping multiple global CMDQVs to/from a VM-owned VINTF, requiring mappings in ascending order and unmappings in descending order. The tegra241-cmdqv driver can apply the rule for a mapping in the LVCMDQ allocation handler. However, it can't do the same for an unmapping since user space could start random destroy calls breaking the rule, while the destroy op in the driver level can't reject a destroy call as it returns void. Add iommufd_hw_queue_depend/undepend for-driver helpers, allowing LVCMDQ allocator to refcount_inc() a sibling LVCMDQ object and LVCMDQ destroyer to refcount_dec(), so that iommufd core will help block a random destroy call that breaks the rule. This is a bit of compromise, because a driver might end up with abusing the API that deadlocks the objects. So restrict the API to a dependency between two driver-allocated objects of the same type, as iommufd would unlikely build any core-level dependency in this case. And encourage to use the macro version that currently supports the HW QUEUE objects only. Link: https://patch.msgid.link/r/2735c32e759c82f2e6c87cb32134eaf09b7589b5.1752126748.git.nicolinc@nvidia.com Reviewed-by: Lu Baolu Reviewed-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 2238ddc2b0560734c2dabb1c1fb4b342b5193625 Author: Nicolin Chen Date: Wed Jul 9 22:59:06 2025 -0700 iommufd/viommu: Add IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl Introduce a new IOMMUFD_CMD_HW_QUEUE_ALLOC ioctl for user space to allocate a HW QUEUE object for a vIOMMU specific HW-accelerated queue, e.g.: - NVIDIA's Virtual Command Queue - AMD vIOMMU's Command Buffer, Event Log Buffers, and PPR Log Buffers Since this is introduced with NVIDIA's VCMDQs that access the guest memory in the physical address space, add an iommufd_hw_queue_alloc_phys() helper that will create an access object to the queue memory in the IOAS, to avoid the mappings of the guest memory from being unmapped, during the life cycle of the HW queue object. AMD's HW will need an hw_queue_init op that is mutually exclusive with the hw_queue_init_phys op, and their case will bypass the access part, i.e. no iommufd_hw_queue_alloc_phys() call. Link: https://patch.msgid.link/r/dab4ace747deb46c1fe70a5c663307f46990ae56.1752126748.git.nicolinc@nvidia.com Reviewed-by: Pranjal Shrivastava Reviewed-by: Kevin Tian Reviewed-by: Lu Baolu Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit e2e9360022585c21dc30d2b19f5866c252f40806 Author: Nicolin Chen Date: Wed Jul 9 22:59:05 2025 -0700 iommufd/viommu: Introduce IOMMUFD_OBJ_HW_QUEUE and its related struct Add IOMMUFD_OBJ_HW_QUEUE with an iommufd_hw_queue structure, representing a HW-accelerated queue type of IOMMU's physical queue that can be passed through to a user space VM for direct hardware control, such as: - NVIDIA's Virtual Command Queue - AMD vIOMMU's Command Buffer, Event Log Buffers, and PPR Log Buffers Add new viommu ops for iommufd to communicate with IOMMU drivers to fetch supported HW queue structure size and to forward user space ioctls to the IOMMU drivers for initialization/destroy. As the existing HWs, NVIDIA's VCMDQs access the guest memory via physical addresses, while AMD's Buffers access the guest memory via guest physical addresses (i.e. iova of the nesting parent HWPT). Separate two mutually exclusive hw_queue_init and hw_queue_init_phys ops to indicate whether a vIOMMU HW accesses the guest queue in the guest physical space (via iova) or the host physical space (via pa). In a latter case, the iommufd core will validate the physical pages of a given guest queue, to ensure the underlying physical pages are contiguous and pinned. Since this is introduced with NVIDIA's VCMDQs, add hw_queue_init_phys for now, and leave some notes for hw_queue_init in the near future (for AMD). Either NVIDIA's or AMD's HW is a multi-queue model: NVIDIA's will be only one type in enum iommu_hw_queue_type, while AMD's will be three different types (two of which will have multi queues). Compared to letting the core manage multiple queues with three types per vIOMMU object, it'd be easier for the driver to manage that by having three different driver-structure arrays per vIOMMU object. Thus, pass in the index to the init op. Link: https://patch.msgid.link/r/6939b73699e278e60ce167e911b3d9be68882bad.1752126748.git.nicolinc@nvidia.com Reviewed-by: Lu Baolu Reviewed-by: Pranjal Shrivastava Reviewed-by: Vasant Hegde Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit ed42eee797ff3dc889ade63c1dd7c4f430699e23 Author: Nicolin Chen Date: Wed Jul 9 22:59:04 2025 -0700 iommufd/viommu: Add driver-defined vDEVICE support NVIDIA VCMDQ driver will have a driver-defined vDEVICE structure and do some HW configurations with that. To allow IOMMU drivers to define their own vDEVICE structures, move the struct iommufd_vdevice to the public header and provide a pair of viommu ops, similar to get_viommu_size and viommu_init. Doing this, however, creates a new window between the vDEVICE allocation and its driver-level initialization, during which an abort could happen but it can't invoke a driver destroy function from the struct viommu_ops since the driver structure isn't initialized yet. vIOMMU object doesn't have this problem, since its destroy op is set via the viommu_ops by the driver viommu_init function. Thus, vDEVICE should do something similar: add a destroy function pointer inside the struct iommufd_vdevice instead of the struct iommufd_viommu_ops. Note that there is unlikely a use case for a type dependent vDEVICE, so a static vdevice_size is probably enough for the near term instead of a get_vdevice_size function op. Link: https://patch.msgid.link/r/1e751c01da7863c669314d8e27fdb89eabcf5605.1752126748.git.nicolinc@nvidia.com Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Reviewed-by: Lu Baolu Reviewed-by: Vasant Hegde Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 27b77ea5feaa8fcf385ea99ce757982b0ac9d1f0 Author: Nicolin Chen Date: Wed Jul 9 22:59:03 2025 -0700 iommufd/access: Bypass access->ops->unmap for internal use The access object has been used externally by VFIO mdev devices, allowing them to pin/unpin physical pages (via needs_pin_pages). Meanwhile, a racy unmap can occur in this case, so these devices usually implement an unmap handler, invoked by iommufd_access_notify_unmap(). The new HW queue object will need the same pin/unpin feature, although it (unlike the mdev case) wants to reject any unmap attempt, during its life cycle. Instead, it would not implement an unmap handler. Thus, bypass any access->ops->unmap access call when the access is marked as internal. Also, an area being pinned by an internal access should reject any unmap request. This cannot be done inside iommufd_access_notify_unmap() as it's a per-iopt action. Add a "num_locks" counter in the struct iopt_area, set that in iopt_area_add_access() when the caller is an internal access. Link: https://patch.msgid.link/r/6df9a43febf79c0379091ec59747276ce9d2493b.1752126748.git.nicolinc@nvidia.com Suggested-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 7497e947bc1d3f761b46c2105c8ae37af98add54 Author: Sebastian Andrzej Siewior Date: Thu Jul 10 13:00:11 2025 +0200 perf bench futex: Remove support for IMMUTABLE It has been decided to remove the support IMMUTABLE futex. perf bench was one of the eary users for testing purposes. Now that the API is removed before it could be used in an official release, remove the bits from perf, too. Remove Remove support for IMMUTABLE futex. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250710110011.384614-7-bigeasy@linutronix.de commit 16adc7f136dc143fdaa0d465172d7a1e6d5ae3c5 Author: Sebastian Andrzej Siewior Date: Thu Jul 10 13:00:10 2025 +0200 selftests/futex: Remove support for IMMUTABLE Testing for the IMMUTABLE part of the futex interface is not needed after the removal of the interface. Remove support for IMMUTABLE from the sefltest. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250710110011.384614-6-bigeasy@linutronix.de commit 760e6f7befbab9a84c54457a8ee45313b7b91ee5 Author: Sebastian Andrzej Siewior Date: Thu Jul 10 13:00:09 2025 +0200 futex: Remove support for IMMUTABLE The FH_FLAG_IMMUTABLE flag was meant to avoid the reference counting on the private hash and so to avoid the performance regression on big machines. With the switch to per-CPU counter this is no longer needed. That flag was never useable on any released kernel. Remove any support for IMMUTABLE while preserve the flags argument and enforce it to be zero. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250710110011.384614-5-bigeasy@linutronix.de commit fb3c553da7fa9991f9b1436d91dbb78c7477c86a Author: Sebastian Andrzej Siewior Date: Thu Jul 10 13:00:08 2025 +0200 futex: Make futex_private_hash_get() static futex_private_hash_get() is not used outside if its compilation unit. Make it static. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250710110011.384614-4-bigeasy@linutronix.de commit 56180dd20c19e5b0fa34822997a9ac66b517e7b3 Author: Peter Zijlstra Date: Thu Jul 10 13:00:07 2025 +0200 futex: Use RCU-based per-CPU reference counting instead of rcuref_t The use of rcuref_t for reference counting introduces a performance bottleneck when accessed concurrently by multiple threads during futex operations. Replace rcuref_t with special crafted per-CPU reference counters. The lifetime logic remains the same. The newly allocate private hash starts in FR_PERCPU state. In this state, each futex operation that requires the private hash uses a per-CPU counter (an unsigned int) for incrementing or decrementing the reference count. When the private hash is about to be replaced, the per-CPU counters are migrated to a atomic_t counter mm_struct::futex_atomic. The migration process: - Waiting for one RCU grace period to ensure all users observe the current private hash. This can be skipped if a grace period elapsed since the private hash was assigned. - futex_private_hash::state is set to FR_ATOMIC, forcing all users to use mm_struct::futex_atomic for reference counting. - After a RCU grace period, all users are guaranteed to be using the atomic counter. The per-CPU counters can now be summed up and added to the atomic_t counter. If the resulting count is zero, the hash can be safely replaced. Otherwise, active users still hold a valid reference. - Once the atomic reference count drops to zero, the next futex operation will switch to the new private hash. call_rcu_hurry() is used to speed up transition which otherwise might be delay with RCU_LAZY. There is nothing wrong with using call_rcu(). The side effects would be that on auto scaling the new hash is used later and the SET_SLOTS prctl() will block longer. [bigeasy: commit description + mm get/ put_async] Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250710110011.384614-3-bigeasy@linutronix.de commit a255b78d14324f8a4a49f88e983b9f00818d1194 Author: Sebastian Andrzej Siewior Date: Thu Jul 10 13:00:06 2025 +0200 selftests/futex: Adapt the private hash test to RCU related changes The auto scaling on create creation used to automatically assign the new hash because there was the private hash was unused and could be replaced right away. This is already racy because if the private hash is in use by a thread then the visibile resize will be delayed. With the upcoming change to wait for a RCU grace period before the hash can be assigned, the test will always fail. If the reported number of hash buckets is not updated after an auto scaling event, block on an acquired lock with a timeout. The timeout is the delay to wait towards a grace period and locking and a locked pthread_mutex_t ensure that glibc calls into kernel using futex operation which will assign new private hash if available. This will retry every 100ms up to 2 seconds in total. Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250710110011.384614-2-bigeasy@linutronix.de commit 5c21c5f22d0701ac6c1cafc0e8de4bf42e5c53e5 Author: Christian Brauner Date: Fri Jul 11 15:47:48 2025 +0200 cleanup: add a scoped version of CLASS() This will make it possible to use: scoped_class() { } constructs to limit variables to certain scopes and still perform auto-cleanup. Signed-off-by: Christian Brauner commit 1bb94ff5ab4be2485884e0a46483f12629f3bb92 Author: Christoph Hellwig Date: Fri Jul 11 13:22:50 2025 +0200 nvme-pci: don't allocate dma_vec for IOVA mappings Not only do IOVA mappings no need the separate dma_vec tracking, it also won't free it and thus leak the allocations. Fixes: b8b7570a7ec8 ("nvme-pci: fix dma unmapping when using PRPs and not using the IOVA mapping") Reported-by: Klara Modin Signed-off-by: Christoph Hellwig Tested-by: Klara Modin Link: https://lore.kernel.org/r/20250711112250.633269-1-hch@lst.de Signed-off-by: Jens Axboe commit b45f9f910aa28fc6151ac5d1ff107522b4a6b1af Author: Olivier Benjamin Date: Fri Jun 20 17:21:35 2025 +0200 arm64: dts: rockchip: describe the OV8858 user camera on PinePhone Pro Add the description of the front/user camera (OV8858) on the PinePhone Pro to the device dts file. It receives commands over SCCB, an I2C-compatible protocol, at I2C address 0x36 and transmits data over CSI-MIPI. I confirmed this address experimentally. The pin control mapping was again extracted from the PinePhone Pro schematic v1.0 as well as the RK3399 datasheet revision 1.8. Table 2-3 in section 2.8 of the RK3399 datasheet contains the mapping of IO functions for the SoC pins. Page 52 shows GPIO1_A4, page 54 shows GPIO2_B4. For the reset (RESET) signal: page 11 quadrant D2 | p.18 q.B3-4 | p.18 q.C2 RK3399_E.R28 -> GPIO1_A4 -> Camera2_RST -> MIPI_RST1 -> OV8858.12 For the powerdown (PWDN) signal: page 9 quadrants D4-5 | p.18 q.B2 RK3399_L.F31 -> GPIO2_B4 -> DVP_PDN0_H -> OV8858.14 Helped-by: Dragan Simic Co-developed-by: Ondrej Jirman Signed-off-by: Ondrej Jirman Signed-off-by: Olivier Benjamin Link: https://lore.kernel.org/r/20250620-camera-v4-4-0201a8ed5fae@bootlin.com Signed-off-by: Heiko Stuebner commit 9336eb829a18bba910620cb2e3fc55fcdd4aeecc Author: Olivier Benjamin Date: Fri Jun 20 17:21:34 2025 +0200 arm64: dts: rockchip: describe I2c Bus 1 and IMX258 world camera on PinePhone Pro Add the description of the rear/world camera (IMX258) on the PinePhone Pro to the device dts file. It receives commands on the I2C Bus 1 at address 0x1a and transmits data over CSI-MIPI. The I2C address for IMX258 can be found in the IMX258-0AQH5 Software Reference Manual, page 24, section 2.3.1: 0b0011010 = 0x1a. Section 3 indicates the module has 4 pairs of data lines. While 4-lane mode is nominal, 2-lane mode should also be supported. The pin muxing info was extracted from the PinePhone Pro schematic v1.0 as well as the RK3399 datasheet revision 1.8. Table 2-3 in section 2.8 of the RK3399 datasheet contains the mapping of IO functions for the SoC pins. Page 52 shows GPIO1_A0, page 54 shows GPIO2_D4. For I2C power, the PinePhone Pro schematic page 11 quadrants A4 and A5: RK3399_J.AA8 and RK3399_J.Y8 get power from vcaa1v8_codec, so turn it on The IMX258 also uses the following regulators, expected by its driver: - vana (2.8V analog), called AVDD2V8_DVP on P.18 q.C1 and derived from VCC1V8_S3 on P.13 q.B2 - vdig (1.2V digital core), called DVDD_DVP on P.18 q.C1 and shown on P.18 q.D3 to be equivalent to VCC1V2_DVP derived from VCC3V3_SYS on P.13 q.B3. Note that this regulator's voltage is inconsistently labeled either 1.2V or 1.5V RK3399_J.AG1 is GPIO4_A1/I2C1_SDA, RK3399_J.Y6 is GPIO4_A2/I2C1_SCL This is the default pinctrl "i2c1_xfer" for i2c1 from rk3399-base. For the reset (RESET) signal: page 11 quadrant D2 | p.18 q.C3-4 | p.18 q.C2 RK3399_E.R25 -> GPIO1_A0 -> Camera_RST -> MIPI_RST0 -> IMX258.12 For the powerdown (PWDN) signal: page 11 quadrants B4-5 | p.18 q.C2 RK3399_G.AF8 -> GPIO2_D4 -> DVP_PDN1_H -> IMX258.14 Helped-by: Dragan Simic Co-developed-by: Ondrej Jirman Signed-off-by: Ondrej Jirman Signed-off-by: Olivier Benjamin Link: https://lore.kernel.org/r/20250620-camera-v4-3-0201a8ed5fae@bootlin.com Signed-off-by: Heiko Stuebner commit f2792bf1c7a54ef23fb3a84286b66f427bfc4853 Author: Jonas Karlman Date: Sat Jun 21 11:38:57 2025 +0000 arm64: dts: rockchip: Fix pinctrl node names for RK3528 Following warnings can be observed with CHECK_DTBS=y for the RK3528: rk3528-pinctrl.dtsi:101.36-105.5: Warning (node_name_chars_strict): /pinctrl/fephy/fephym0-led_dpx: Character '_' not recommended in node name rk3528-pinctrl.dtsi:108.38-112.5: Warning (node_name_chars_strict): /pinctrl/fephy/fephym0-led_link: Character '_' not recommended in node name rk3528-pinctrl.dtsi:115.36-119.5: Warning (node_name_chars_strict): /pinctrl/fephy/fephym0-led_spd: Character '_' not recommended in node name rk3528-pinctrl.dtsi:122.36-126.5: Warning (node_name_chars_strict): /pinctrl/fephy/fephym1-led_dpx: Character '_' not recommended in node name rk3528-pinctrl.dtsi:129.38-133.5: Warning (node_name_chars_strict): /pinctrl/fephy/fephym1-led_link: Character '_' not recommended in node name rk3528-pinctrl.dtsi:136.36-140.5: Warning (node_name_chars_strict): /pinctrl/fephy/fephym1-led_spd: Character '_' not recommended in node name rk3528-pinctrl.dtsi:782.32-790.5: Warning (node_name_chars_strict): /pinctrl/rgmii/rgmii-rx_bus2: Character '_' not recommended in node name rk3528-pinctrl.dtsi:793.32-801.5: Warning (node_name_chars_strict): /pinctrl/rgmii/rgmii-tx_bus2: Character '_' not recommended in node name rk3528-pinctrl.dtsi:804.36-810.5: Warning (node_name_chars_strict): /pinctrl/rgmii/rgmii-rgmii_clk: Character '_' not recommended in node name rk3528-pinctrl.dtsi:813.36-823.5: Warning (node_name_chars_strict): /pinctrl/rgmii/rgmii-rgmii_bus: Character '_' not recommended in node name Rename the affected nodes to fix these warnings. Fixes: a31fad19ae39 ("arm64: dts: rockchip: Add pinctrl and gpio nodes for RK3528") Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20250621113859.2146400-1-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 96cbdfdd3ac20700b9b1c251fb15c944f33a424a Author: John Clark Date: Sat Jun 28 10:32:29 2025 -0400 arm64: dts: rockchip: Add FriendlyElec NanoPi M5 support Add device tree for FriendlyElec NanoPi M5 with Rockchip RK3576 SoC (4x Cortex-A72, 4x Cortex-A53, Mali-G52 MC3 GPU, 6 TOPS NPU). Enables basic booting and connectivity. Supported features: - RK3576 SoC - 4GB LPDDR4X or 8GB/16GB LPDDR5 - 16MB SPI Nor Flash - 2x 1Gbps Ethernet - 2x USB 3.2 Gen 1 Type-A ports - M.2 M-Key PCIe 2.1 x1 NVMe support - M.2 E-Key SDIO connector - microSD UHS-I - HDMI 1.4/2.0 (up to 4096x2304@60Hz) - 30-pin GPIO (2x SPI, 4x UART, 3x I2C, 5x PWM, 20x GPIO) - Debug UART - RTC with HYM8563TS - Power via USB-C (PD, 6V~20V) Signed-off-by: John Clark Link: https://lore.kernel.org/r/20250628143229.74460-3-inindev@gmail.com Signed-off-by: Heiko Stuebner commit 863993ff9c6c0e6ecaf942e0d625e5df134e464f Author: John Clark Date: Sat Jun 28 10:32:28 2025 -0400 dt-bindings: arm: rockchip: add FriendlyElec NanoPi M5 board Add device tree documentation for rk3576-nanopi-m5 Signed-off-by: John Clark Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250628143229.74460-2-inindev@gmail.com Signed-off-by: Heiko Stuebner commit e82f642b9821384045915dc30e73df7de8424827 Author: Quentin Schulz Date: Fri Jun 27 12:53:57 2025 +0200 arm64: dts: rockchip: force PMIC reset behavior to restart PMU on RK3588 Tiger The bootloader for RK3588 Tiger currently forces the PMIC reset behavior (stored in RST_FUN bitfield in register SYS_CFG3 of the PMIC) to 0b1X which is incorrect for our devices. It is required to restart the PMU as otherwise the companion microcontroller cannot detect the PMIC (and by extension the full product and main SoC) being rebooted which is an issue as that is used to reset a few things like the PWM beeper and watchdogs. Let's add the new rockchip,reset-mode property to make sure the PMIC reset behavior is the expected one. Signed-off-by: Quentin Schulz Link: https://lore.kernel.org/r/20250627-rk8xx-rst-fun-v4-5-ce05d041b45f@cherry.de Signed-off-by: Heiko Stuebner commit ee907113430aa02a8202c91bb574c385ecc28aa2 Author: Quentin Schulz Date: Fri Jun 27 12:53:56 2025 +0200 arm64: dts: rockchip: force PMIC reset behavior to restart PMU on RK3588 Jaguar The bootloader for RK3588 Jaguar currently forces the PMIC reset behavior (stored in RST_FUN bitfield in register SYS_CFG3 of the PMIC) to 0b1X which is incorrect for our devices. It is required to restart the PMU as otherwise the companion microcontroller cannot detect the PMIC (and by extension the full product and main SoC) being rebooted which is an issue as that is used to reset a few things like the PWM beeper and watchdogs. Let's add the new rockchip,reset-mode property to make sure the PMIC reset behavior is the expected one. Signed-off-by: Quentin Schulz Link: https://lore.kernel.org/r/20250627-rk8xx-rst-fun-v4-4-ce05d041b45f@cherry.de Signed-off-by: Heiko Stuebner commit 304be20e65ca08fc2e9cb58eb939a0054d8a8b81 Author: Quentin Schulz Date: Fri Jun 27 12:53:55 2025 +0200 arm64: dts: rockchip: add header for RK8XX PMIC constants To make it easier to read the device tree, let's add constants for the rockchip,reset-mode property values that are currently only applicable to RK806 PMIC. Signed-off-by: Quentin Schulz [dt-maintainers did not consider this part of the binding, so we're keeping the header in the devicetree directory] Link: https://lore.kernel.org/r/20250627-rk8xx-rst-fun-v4-3-ce05d041b45f@cherry.de Signed-off-by: Heiko Stuebner commit e6066edc9413191479b05596ba06c40908f44e22 Author: Nicolas Frattaroli Date: Mon Jun 30 12:19:27 2025 +0200 arm64: dts: rockchip: add HDMI audio on ROCK 4D Much like the Sige5, the ROCK 4D also has an HDMI port, so is capable of providing HDMI audio output as well. Enable the SoC's hdmi_sound card, and also enable the SoC audio controller (sai6) that feeds into it. Signed-off-by: Nicolas Frattaroli Tested-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250630-rock4d-audio-v1-4-0b3c8e8fda9c@collabora.com Signed-off-by: Heiko Stuebner commit eebf59470a76a38d0c43005a34483e1a52a33de0 Author: Nicolas Frattaroli Date: Mon Jun 30 17:36:35 2025 +0200 arm64: dts: rockchip: theoretically enable Wi-Fi on ROCK 4D The production version of the ROCK 4D appears to sport a AICSEMI AIC8800D80 USB Wi-Fi + BT chipset. This chip does not yet have a mainline driver. Add the necessary rfkill node and wifi regulator node to at least make it show up in lsusb output. The regulator is set as always-on, as like 2 hours deep into debugging why onboard_usb_dev.c wouldn't try enabling the regulator the device needs to actually show up and thus bind to onboard_usb_dev.c, I decided that it's not worth the effort. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250630-rock4d-reg-usb-wifi-v1-3-1057f412d98c@collabora.com Signed-off-by: Heiko Stuebner commit 787595b423d855bfcbf724822fd1e663ad368d08 Author: Nicolas Frattaroli Date: Mon Jun 30 17:36:34 2025 +0200 arm64: dts: rockchip: complete USB nodes on ROCK 4D The ROCK 4D uses both USB controllers, and both of which in host mode. However, it still names one of the supplies for them "OTG" in the schematic. Fix the "host" supply's input, and add the "otg" supply. Enable the remaining USB PHY nodes, and the first controller node as well. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250630-rock4d-reg-usb-wifi-v1-2-1057f412d98c@collabora.com Signed-off-by: Heiko Stuebner commit 9a625a284bfdb902f27f2949063731d189adda3c Author: Nicolas Frattaroli Date: Mon Jun 30 17:36:33 2025 +0200 arm64: dts: rockchip: adjust dcin regulator on ROCK 4D The ROCK 4D's actual DC input is 5V, and the schematic names it as being 5V as well. Rename the regulator, and change the voltage it claims to be at. Furthermore, fix vcc_1v1_nldo_s3's vin-supply as coming from vcc_5v0_sys, and not the DCIN, as per the schematic. This makes no functional change; both regulators are always on, and one feeds into the other. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250630-rock4d-reg-usb-wifi-v1-1-1057f412d98c@collabora.com Signed-off-by: Heiko Stuebner commit 83f96a7eaaf0e3ac1b1447f74a8d3b2213187b6e Author: Arnd Bergmann Date: Fri Jul 11 10:24:03 2025 +0200 firmware: tegra: bpmp: Fix build failure for tegra264-only config The definition of tegra186_bpmp_ops was not updated in sync with the use in bpmp.c: drivers/firmware/tegra/bpmp.c:856:17: error: 'tegra186_bpmp_ops' undeclared here (not in a function); did you mean 'tegra_bpmp_ops'? 856 | .ops = &tegra186_bpmp_ops, aarch64-linux-ld: drivers/firmware/tegra/bpmp.o:(.rodata+0x2f0): undefined reference to `tegra186_bpmp_ops' Update the Makefile as needed. There is really no need to hide the declaration based on the configuration, so just expose it unconditionally so it never has to be updated again for the next SoC. Fixes: 94bce2cf7cf6 ("firmware: tegra: bpmp: Add support on Tegra264") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250711082409.1398497-1-arnd@kernel.org Signed-off-by: Thierry Reding commit fadd1e6231b1bd54a39707c6454ee5e5aa6cdcc6 Merge: 0f26870a989bf6 5f83d6337c9c43 Author: David S. Miller Date: Fri Jul 11 12:57:02 2025 +0100 Merge branch 'hv-msi-parent-domain' into main Nam Cao says: ==================== Subject: [PATCH for-netdev v2 0/2] PCI: hv: MSI parent domain conversion This series originally belongs to a bigger series sent to PCI tree: https://lore.kernel.org/linux-pci/024f0122314198fe0a42fef01af53e8953a687ec.1750858083.git.namcao@linutronix.de/ However, during review, we noticed that the patch conflicts with another patch in netdev tree: https://lore.kernel.org/netdev/1749651015-9668-1-git-send-email-shradhagupta@linux.microsoft.com/ As this series has no dependency with the rest of the series, we think it is best to split out this one and send it to netdev, to avoid conflict resolution headache later on. Can netdev maintainers please pick it up? ==================== Signed-off-by: David S. Miller commit 5f83d6337c9c436d7b1a6580ca060122cb937551 Author: Nam Cao Date: Mon Jul 7 10:20:16 2025 +0200 PCI: hv: Switch to msi_create_parent_irq_domain() Move away from the legacy MSI domain setup, switch to use msi_create_parent_irq_domain(). While doing the conversion, I noticed that hv_compose_msi_msg() is doing more than it is supposed to (composing message). This function also allocates and populates struct tran_int_desc, which should be done in hv_pcie_domain_alloc() instead. It works, but it is not the correct design. However, I have no hardware to test such change, therefore I leave a TODO note. Acked-by: Bjorn Helgaas Reviewed-by: Thomas Gleixner Signed-off-by: Nam Cao Reviewed-by: Michael Kelley Tested-by: Michael Kelley Signed-off-by: David S. Miller commit a6b0465bd2833f3ca9e92d8c9a422b7be6e40fc9 Author: Nam Cao Date: Mon Jul 7 10:20:15 2025 +0200 irqdomain: Export irq_domain_free_irqs_top() Export irq_domain_free_irqs_top(), making it usable for drivers compiled as modules. Reviewed-by: Michael Kelley Reviewed-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: David S. Miller commit 0bdbce25855f021187d16d4ffbb92102b9f13788 Author: Takashi Iwai Date: Fri Jul 11 10:30:50 2025 +0200 ALSA: hda: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Link: https://patch.msgid.link/20250711083051.18759-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 9cf8d2b8a0764a074725921177caa0860fca5eb3 Merge: 86731a2a651e58 f3e7970d0e65d9 Author: Arnd Bergmann Date: Fri Jul 11 13:22:28 2025 +0200 Merge branch 'newsoc/pxa1908' into soc/newsoc This adds initial support for the Marvell PXA1908 SoC and "samsung,coreprimevelte", a smartphone using the SoC. *Important note*: There is a regression on all of the v6.16 RCs where the board does not boot unrelated to the patches in this set. See: https://lore.kernel.org/regressions/3367665.aeNJFYEL58@radijator/ USB works and the phone can boot a rootfs from an SD card, but there are some warnings in the dmesg: During SMP initialization: [ 0.006519] CPU features: SANITY CHECK: Unexpected variation in SYS_CNTFRQ_EL0. Boot CPU: 0x000000018cba80, CPU1: 0x00000000000000 [ 0.006542] CPU features: Unsupported CPU feature variation detected. [ 0.006589] CPU1: Booted secondary processor 0x0000000001 [0x410fd032] [ 0.010710] Detected VIPT I-cache on CPU2 [ 0.010716] CPU features: SANITY CHECK: Unexpected variation in SYS_CNTFRQ_EL0. Boot CPU: 0x000000018cba80, CPU2: 0x00000000000000 [ 0.010758] CPU2: Booted secondary processor 0x0000000002 [0x410fd032] [ 0.014849] Detected VIPT I-cache on CPU3 [ 0.014855] CPU features: SANITY CHECK: Unexpected variation in SYS_CNTFRQ_EL0. Boot CPU: 0x000000018cba80, CPU3: 0x00000000000000 [ 0.014895] CPU3: Booted secondary processor 0x0000000003 [0x410fd032] SMMU probing fails: [ 0.101798] arm-smmu c0010000.iommu: probing hardware configuration... [ 0.101809] arm-smmu c0010000.iommu: SMMUv1 with: [ 0.101816] arm-smmu c0010000.iommu: no translation support! A 3.14 based Marvell tree is available on GitHub acorn-marvell/brillo_pxa_kernel, and a Samsung one on GitHub CoderCharmander/g361f-kernel. Andreas Färber attempted to upstream support for this SoC in 2017: https://lore.kernel.org/lkml/20170222022929.10540-1-afaerber@suse.de/ Signed-off-by: Duje Mihanović Signed-off-by: Arnd Bergmann * newsoc/pxa1908: MAINTAINERS: add myself as Marvell PXA1908 maintainer arm64: dts: Add DTS for Marvell PXA1908 and samsung,coreprimevelte arm64: Kconfig.platforms: Add config for Marvell PXA1908 platform dt-bindings: marvell: Document PXA1908 SoC and samsung,coreprimevelte dt-bindings: mmc: sdhci-pxa: restrict pinctrl to pxav1 commit f3e7970d0e65d98ce964a997e9e990d802bffdfc Author: Duje Mihanović Date: Tue Jul 8 19:09:50 2025 +0200 MAINTAINERS: add myself as Marvell PXA1908 maintainer Add myself as the maintainer for Marvell PXA1908 SoC support. Signed-off-by: Duje Mihanović Link: https://lore.kernel.org/r/20250708-pxa1908-lkml-v16-5-b4392c484180@dujemihanovic.xyz Signed-off-by: Arnd Bergmann commit 3938bc65493f152cb434e609f0c43c035ff4922a Author: Duje Mihanović Date: Tue Jul 8 19:09:49 2025 +0200 arm64: dts: Add DTS for Marvell PXA1908 and samsung,coreprimevelte Add DTS for Marvell PXA1908 SoC and Samsung Galaxy Core Prime Value Edition LTE, a smartphone based on said SoC. Signed-off-by: Duje Mihanović Link: https://lore.kernel.org/r/20250708-pxa1908-lkml-v16-4-b4392c484180@dujemihanovic.xyz Signed-off-by: Arnd Bergmann commit 1eb07e99ef39808612e12edaac6ef10f27485a27 Author: Duje Mihanović Date: Tue Jul 8 19:09:48 2025 +0200 arm64: Kconfig.platforms: Add config for Marvell PXA1908 platform Add ARCH_MMP configuration option for Marvell PXA1908 SoC. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Duje Mihanović Link: https://lore.kernel.org/r/20250708-pxa1908-lkml-v16-3-b4392c484180@dujemihanovic.xyz Signed-off-by: Arnd Bergmann commit a3e506bd9058de84d845b1225e0d7f2763b71e93 Author: Duje Mihanović Date: Tue Jul 8 19:09:47 2025 +0200 dt-bindings: marvell: Document PXA1908 SoC and samsung,coreprimevelte Add dt bindings for the Marvell PXA1908 SoC and the Samsung Galaxy Core Prime VE LTE phone (model number SM-G361F) using the SoC. The SoC comes with 4 Cortex-A53 cores clocked up to ~1.2GHz and a Vivante GC7000UL GPU. The phone also has a 4.5" 480x800 touchscreen, 8GB eMMC and 1GB of LPDDR3 RAM. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Duje Mihanović Link: https://lore.kernel.org/r/20250708-pxa1908-lkml-v16-2-b4392c484180@dujemihanovic.xyz Signed-off-by: Arnd Bergmann commit d2b87d92bcb7659971ff893e9284971700db9fed Author: Duje Mihanović Date: Tue Jul 8 19:09:46 2025 +0200 dt-bindings: mmc: sdhci-pxa: restrict pinctrl to pxav1 The current pinctrl properties apply only to the pxav1 controller. Adding one default pinctrl node to a pxav3 controller therefore causes a schema warning. Check the existing properties only on pxav1. pxav2 and pxav3 may add their own set of pinctrl properties if and when needed. Signed-off-by: Duje Mihanović Link: https://lore.kernel.org/r/20250708-pxa1908-lkml-v16-1-b4392c484180@dujemihanovic.xyz Signed-off-by: Arnd Bergmann commit 328d48cc0a644bc54c2ab27ee584f3510ae8c6ec Author: Geert Uytterhoeven Date: Wed Jul 9 20:43:59 2025 +0200 gpio: rcar: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas R-Car GPIO driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the check for CONFIG_PM_SLEEP, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled, while increasing build coverage. Signed-off-by: Geert Uytterhoeven Reviewed-by: Niklas Söderlund Link: https://lore.kernel.org/r/e201140426daacaa799d73e2f76bfd96b6f5718f.1752086619.git.geert+renesas@glider.be Signed-off-by: Bartosz Golaszewski commit 42b0ef01e6b5e9c77b383d32c25a0ec2a735d08a Author: Arnd Bergmann Date: Fri Jul 11 10:46:51 2025 +0200 block: fix FS_IOC_GETLBMD_CAP parsing in blkdev_common_ioctl() Anders and Naresh found that the addition of the FS_IOC_GETLBMD_CAP handling in the blockdev ioctl handler breaks all ioctls with _IOC_NR==2, as the new command is not added to the switch but only a few of the command bits are check. Move the check into the blk_get_meta_cap() function itself and make it return -ENOIOCTLCMD for any unsupported command code, including those with a smaller size that previously returned -EINVAL. For consistency this also drops the check for NULL 'arg' that is really useless, as any invalid pointer should return -EFAULT. Fixes: 9eb22f7fedfc ("fs: add ioctl to query metadata and protection info capabilities") Link: https://lore.kernel.org/all/CA+G9fYvk9HHE5UJ7cdJHTcY6P5JKnp+_e+sdC5U-ZQFTP9_hqQ@mail.gmail.com/ Reported-by: Naresh Kamboju Cc: Anders Roxell Cc: Naresh Kamboju Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/20250711084708.2714436-1-arnd@kernel.org Tested-by: Anders Roxell Signed-off-by: Christian Brauner commit 0e6639c8505d70e821bc27f951a0ff6303f10d4d Author: Biju Das Date: Wed Jul 2 13:05:29 2025 +0100 can: rcar_canfd: Drop unused macros Drop unused macros from the rcar_canfd.c. Reported-by: Vincent Mailhol Closes: https://lore.kernel.org/all/7ff93ff9-f578-4be2-bdc6-5b09eab64fe6@wanadoo.fr/ Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/20250702120539.98490-1-biju.das.jz@bp.renesas.com Signed-off-by: Marc Kleine-Budde commit fd4716a1512294b5e0fbd9f890e38aac13bc28e0 Merge: ec3cae639482a8 f747cde5e71b17 Author: Rafael J. Wysocki Date: Fri Jul 11 11:39:59 2025 +0200 Merge back earlier changes related to system suspend and hibernation commit 25883e286e7a2a73b5bbd7e7a80c4d4fcefd297e Author: Geert Uytterhoeven Date: Wed Jul 9 20:36:21 2025 +0200 can: rcar_can: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas R-Car CAN driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, and reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/6ffe085f6e2548f53674dd11704b388cf4b303e9.1752086078.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 3a252ff9d8b6dc22b20463bfcb31a4e8992b0e8f Merge: 9800bf6fae3bce 11895f375939d6 Author: Simona Vetter Date: Fri Jul 11 11:25:34 2025 +0200 Merge tag 'drm-intel-next-2025-07-10' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Driver Changes: - DSI panel's version 2 mipi-sequences fix (Hans) Signed-off-by: Simona Vetter From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/aHA-qrFQ00TaNsGr@intel.com commit e65cb011349e653ded541dddd6469c2ca813edcf Author: Andy Shevchenko Date: Thu Jul 10 20:00:23 2025 +0300 Documentation: ACPI: Fix parent device references The _CRS resources in many cases want to have ResourceSource field to be a type of ACPI String. This means that to compile properly we need to enclosure the name path into double quotes. This will in practice defer the interpretation to a run-time stage, However, this may be interpreted differently on different OSes and ACPI interpreter implementations. In particular ACPICA might not correctly recognize the leading '^' (caret) character and will not resolve the relative name path properly. On top of that, this piece may be used in SSDTs which are loaded after the DSDT and on itself may also not resolve relative name paths outside of their own scopes. With this all said, fix documentation to use fully-qualified name paths always to avoid any misinterpretations, which is proven to work. Fixes: 8eb5c87a92c0 ("i2c: add ACPI support for I2C mux ports") Reported-by: Yevhen Kondrashyn Cc: All applicable Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250710170225.961303-1-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit b528e896fa570844d654b5a4617a97fa770a1030 Author: Tejas Upadhyay Date: Thu Jul 10 10:29:45 2025 +0530 drm/xe: Dont skip TLB invalidations on VF Skipping TLB invalidations on VF causing unrecoverable faults. Probable reason for skipping TLB invalidations on SRIOV could be lack of support for instruction MI_FLUSH_DW_STORE_INDEX. Add back TLB flush with some additional handling. Helps in resolving, [ 704.913454] xe 0000:00:02.1: [drm:pf_queue_work_func [xe]] ASID: 0 VFID: 0 PDATA: 0x0d92 Faulted Address: 0x0000000002fa0000 FaultType: 0 AccessType: 1 FaultLevel: 0 EngineClass: 3 bcs EngineInstance: 8 [ 704.913551] xe 0000:00:02.1: [drm:pf_queue_work_func [xe]] Fault response: Unsuccessful -22 V2: - Use Xmas tree (MichalW) Suggested-by: Matthew Brost Fixes: 97515d0b3ed92 ("drm/xe/vf: Don't emit access to Global HWSP if VF") Reviewed-by: Matthew Brost Link: https://patchwork.freedesktop.org/patch/msgid/20250710045945.1023840-1-tejas.upadhyay@intel.com Signed-off-by: Tejas Upadhyay commit 9800bf6fae3bcee42c14bf172f7f6342c3d3d305 Merge: 6e85c1ec0e68fd 94de94d24ea8cf Author: Simona Vetter Date: Fri Jul 11 11:08:52 2025 +0200 Merge tag 'drm-xe-next-2025-07-10' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - Documentation fixes (Shuicheng) Cross-subsystem Changes: - MTD intel-dg driver for dgfx non-volatile memory device (Sasha) - i2c: designware changes to allow i2c integration with BMG (Heikki) Core Changes: - Restructure migration in preparation for multi-device (Brost, Thomas) - Expose fan control and voltage regulator version on sysfs (Raag) Driver Changes: - Add WildCat Lake support (Roper) - Add aux bus child device driver for NVM on DGFX (Sasha) - Some refactor and fixes to allow cleaner BMG w/a (Lucas, Maarten, Auld) - BMG w/a (Vinay) - Improve handling of aborted probe (Michal) - Do not wedge device on killed exec queues (Brost) - Init changes for flicker-free boot (Maarten) - Fix out-of-bounds field write in MI_STORE_DATA_IMM (Jia) - Enable the GuC Dynamic Inhibit Context Switch optimization (Daniele) - Drop bo->size (Brost) - Builds and KConfig fixes (Harry, Maarten) - Consolidate LRC offset calculations (Tvrtko) - Fix potential leak in hw_engine_group (Michal) - Future-proof for multi-tile + multi-GT cases (Roper) - Validate gt in pmu event (Riana) - SRIOV PF: Clear all LMTT pages on alloc (Michal) - Allocate PF queue size on pow2 boundary (Brost) - SRIOV VF: Make multi-GT migration less error prone (Tomasz) - Revert indirect ring state patch to fix random LRC context switches failures (Brost) - Fix compressed VRAM handling (Auld) - Add one additional BMG PCI ID (Ravi) - Recommend GuC v70.46.2 for BMG, LNL, DG2 (Julia) - Add GuC and HuC to PTL (Daniele) - Drop PTL force_probe requirement (Atwood) - Fix error flow in display suspend (Shuicheng) - Disable GuC communication on hardware initialization error (Zhanjun) - Devcoredump fixes and clean up (Shuicheng) - SRIOV PF: Downgrade some info to debug (Michal) - Don't allocate temporary GuC policies object (Michal) - Support for I2C attached MCUs (Heikki, Raag, Riana) - Add GPU memory bo trace points (Juston) - SRIOV VF: Skip some W/a (Michal) - Correct comment of xe_pm_set_vram_threshold (Shuicheng) - Cancel ongoing H2G requests when stopping CT (Michal) Signed-off-by: Simona Vetter From: Rodrigo Vivi Link: https://patchwork.freedesktop.org/patch/msgid/aHA7184UnWlONORU@intel.com commit 6e85c1ec0e68fdd5753bd622925439fbaf777ff2 Merge: 203dcde881561f fe69a391808404 Author: Simona Vetter Date: Fri Jul 11 11:00:32 2025 +0200 Merge tag 'drm-misc-next-2025-07-10' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 6.17: UAPI Changes: Cross-subsystem Changes: Core Changes: Driver Changes: - amdgpu: debugfs improvements - ast: Improve hardware generations implementation - dma-buf heaps: - Give the CMA heap a stable name - panthor: fix UAF in debugfs - rockchip: Convert inno_hdmi to a bridge - sti: Convert to devm_drm_bridge_alloc() - vkms: Use faux_device - bridge: - Improve CEC handling code, convertions to devm_drm_bridge_alloc() Signed-off-by: Simona Vetter From: Maxime Ripard Link: https://patchwork.freedesktop.org/patch/msgid/20250710-observant-elite-dingo-acfd6d@houat commit 440bd77d25a61985358404bc578598817ff475c3 Author: Max Krummenacher Date: Tue Jul 8 15:51:42 2025 +0200 arm64: dts: freescale: imx8mp-toradex-smarc: remove gpio hog Remove the gpio hog node which forces using DSI signals rather than the second LVDS channels signals. The dsi signals are not used in any of the current device trees. Leave that decision to the actual device tree which will also define the consumer of the signals. Signed-off-by: Max Krummenacher Signed-off-by: Shawn Guo commit 29d34c678cf82341cb0bedb3179d59c56856a80f Author: Max Krummenacher Date: Tue Jul 8 15:51:41 2025 +0200 arm64: dts: freescale: imx8mp-toradex-smarc: fix lvds dsi mux gpio The MUX which either outputs DSI or 2nd channel LVDS signals is part of the SoM. Move the pinmuxing of the GPIO used for controlling the MUX to the SoM dtsi file. Fixes: 97dc91c04558 ("arm64: dts: freescale: add Toradex SMARC iMX8MP") Signed-off-by: Max Krummenacher Signed-off-by: Shawn Guo commit 29ba95537d800de0f53c606afd00da905bce22eb Author: Tim Harvey Date: Mon Jul 7 13:17:02 2025 -0700 arm64: dts: imx8mm-venice-gw7904: Increase HS400 USDHC clock speed The IMX8M reference manuals indicate in the USDHC Clock generator section that the clock rate for DDR is 1/2 the input clock therefore HS400 rates clocked at 200Mhz require a 400Mhz SDHC clock. This showed about a 1.5x improvement in read performance for the eMMC's used on the various imx8m{m,n,p}-venice boards. Fixes: b999bdaf0597 ("arm64: dts: imx: Add i.mx8mm Gateworks gw7904 dts support") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit 9cee27cc82a6954af2e012f170356f8cae28b42a Author: Tim Harvey Date: Mon Jul 7 13:17:01 2025 -0700 arm64: dts: imx8mm-venice-gw7903: Increase HS400 USDHC clock speed The IMX8M reference manuals indicate in the USDHC Clock generator section that the clock rate for DDR is 1/2 the input clock therefore HS400 rates clocked at 200Mhz require a 400Mhz SDHC clock. This showed about a 1.5x improvement in read performance for the eMMC's used on the various imx8m{m,n,p}-venice boards. Fixes: a72ba91e5bc7 ("arm64: dts: imx: Add i.mx8mm Gateworks gw7903 dts support") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit 2ef45ff68c985e3312a141deece2eeaab1f7ada0 Author: Tim Harvey Date: Mon Jul 7 13:17:00 2025 -0700 arm64: dts: imx8mn-venice-gw7902: Increase HS400 USDHC clock speed The IMX8M reference manuals indicate in the USDHC Clock generator section that the clock rate for DDR is 1/2 the input clock therefore HS400 rates clocked at 200Mhz require a 400Mhz SDHC clock. This showed about a 1.5x improvement in read performance for the eMMC's used on the various imx8m{m,n,p}-venice boards. Fixes: ef484dfcf6f7 ("arm64: dts: imx: Add i.mx8mm/imx8mn Gateworks gw7902 dts support") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit abc467727773996f40e9eacb963ae9f441db40be Author: Tim Harvey Date: Mon Jul 7 13:16:59 2025 -0700 arm64: dts: imx8mm-venice-gw7902: Increase HS400 USDHC clock speed The IMX8M reference manuals indicate in the USDHC Clock generator section that the clock rate for DDR is 1/2 the input clock therefore HS400 rates clocked at 200Mhz require a 400Mhz SDHC clock. This showed about a 1.5x improvement in read performance for the eMMC's used on the various imx8m{m,n,p}-venice boards. Fixes: ef484dfcf6f7 ("arm64: dts: imx: Add i.mx8mm/imx8mn Gateworks gw7902 dts support") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit bd49cb58b59f1c2e27495f347a460f45be71200d Author: Tim Harvey Date: Mon Jul 7 13:16:58 2025 -0700 arm64: dts: imx8mm-venice-gw7901: Increase HS400 USDHC clock speed The IMX8M reference manuals indicate in the USDHC Clock generator section that the clock rate for DDR is 1/2 the input clock therefore HS400 rates clocked at 200Mhz require a 400Mhz SDHC clock. This showed about a 1.5x improvement in read performance for the eMMC's used on the various imx8m{m,n,p}-venice boards. Fixes: 2b1649a83afc ("arm64: dts: imx: Add i.mx8mm Gateworks gw7901 dts support") Signed-off-by: Tim Harvey Link: https://lore.kernel.org/stable/20250707201702.2930066-3-tharvey%40gateworks.com Signed-off-by: Shawn Guo commit 81b07d51cda761eecc36bed907a1c88d2adeb689 Author: Tim Harvey Date: Mon Jul 7 13:16:57 2025 -0700 arm64: dts: imx8mp-venice-gw702x: Increase HS400 USDHC clock speed The IMX8M reference manuals indicate in the USDHC Clock generator section that the clock rate for DDR is 1/2 the input clock therefore HS400 rates clocked at 200Mhz require a 400Mhz SDHC clock. This showed about a 1.5x improvement in read performance for the eMMC's used on the various imx8mp-venice boards. Fixes: 0d5b288c2110 ("arm64: dts: freescale: Add imx8mp-venice-gw7905-2x") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit c5d9a362c737ec444fcea44c270d28b04a723003 Author: Tim Harvey Date: Mon Jul 7 13:16:56 2025 -0700 arm64: dts: imx8mm-venice-gw700x: Increase HS400 USDHC clock speed The IMX8M reference manuals indicate in the USDHC Clock generator section that the clock rate for DDR is 1/2 the input clock therefore HS400 rates clocked at 200Mhz require a 400Mhz SDHC clock. This showed about a 1.5x improvement in read performance for the eMMC's used on the various imx8m{m,n,p}-venice boards. Fixes: 6f30b27c5ef5 ("arm64: dts: imx8mm: Add Gateworks i.MX 8M Mini Development Kits") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit 64b853f685035ba8c90574433e986955bcfb0704 Author: Ioana Ciornei Date: Mon Jul 7 18:33:31 2025 +0300 arm64: dts: lx2160a-qds: add the two on-board RGMII PHYs Describe the two LX2160AQDS on-board RGMII PHYs on their respective MDIO buses behind the MDIO multiplexer. Signed-off-by: Ioana Ciornei Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 911e3962564861704451a7abeafd4e2383559e47 Author: Yannic Moog Date: Wed Jun 11 15:05:31 2025 +0200 arm64: dts: add imx95-libra-rdk-fpsc board Add device tree for the Libra-i.MX 95 FPSC board. The Libra is a pure development board and has hardware to support FPSC-24-A.0 set of features. The phyCORE-i.MX 95 FPSC [1] SoM uses only a subset of the hardware features of the Libra board. The phyCORE-i.MX 95 FPSC itself is a System on Module designed around the i.MX 95 SoC. The SoM and board utilize the Future Proof Solder Core [2] BGA standard to connect to each other. To be able to easily map FPSC interface names to SoC interfaces, the FPSC interface names are added as inline comments. Example: &lpi2c5 { /* I2C2 */ pinctrl-0 = <&pinctrl_lpi2c5>; [...] }; Here, I2C2 is the FPSC interface name. The lpi2c5 instance of the i.MX 95 SoC is used to fulfill the i2c functionality and its signals are routed to the FPSC I2C2 signal pins: pinctrl_lpi2c5: lpi2c5grp { fsl,pins = < IMX95_PAD_GPIO_IO22__LPI2C5_SDA 0x40000b9e /* I2C2_SDA */ IMX95_PAD_GPIO_IO23__LPI2C5_SCL 0x40000b9e /* I2C2_SCL */ >; }; [1] https://www.phytec.eu/en/produkte/system-on-modules/phycore-imx-95-fpsc/ [2] https://www.phytec.eu/en/produkte/system-on-modules/fpsc/ Signed-off-by: Yannic Moog Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 5876f25015168f0014d4d11f4f37e87da730c03e Author: Frank Li Date: Thu May 22 13:56:50 2025 -0400 arm64: dts: imx8q: add linux,cma node for imx8qm-mek and imx8qxp-mek Add linux,cma node because some devices, such as camera, need big continue physical memory. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 2217f824371491ea07e0ec31022195280cddf20b Author: Frank Li Date: Thu May 22 13:56:49 2025 -0400 arm64: dts: imx8: add capture controller for i.MX8's img subsystem Add CSI related nodes (i2c, irqsteer, csi, lpcg) for i.MX8 img subsystem. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 153c039a73572752efa0035a49b8f2af8ef3aadc Author: Frank Li Date: Wed May 21 13:34:04 2025 -0400 arm64: dts: imx95: add jpeg encode and decode nodes Add jpeg encode\decode and related nodes for i.MX95. Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit f478e7ae181730966601e420e44d534aab1a0b9e Author: Primoz Fiser Date: Tue Jul 8 06:22:06 2025 +0200 arm64: dts: imx93-phyboard-nash: Add PEB-WLBT-07 overlay Add overlay to support PHYTEC PEB-WLBT-07 WiFi/Bluetooth evaluation adapter on phyBOARD-Nash-i.MX93 board. Adapter uses the u-blox MAYA-W2 module (IW612 chipset) which is capable of Wi-Fi 6 and Bluetooth 5.4 LE. Signed-off-by: Primoz Fiser Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 6696cc94f313ce0ab85d7d3eeca92c0790b5695f Author: Primoz Fiser Date: Tue Jul 8 06:22:05 2025 +0200 arm64: dts: imx93-phyboard-segin: Add PEB-WLBT-05 overlay Add support for PEB-WLBT-05 WLAN/BT adapter on phyBOARD-Segin-i.MX93. The PEB-WLBT-05 is equipped with a Sterling-LWB radio module, which is capable of Wi-Fi 802.11 b/g/n and Bluetooth 4.2. Signed-off-by: Primoz Fiser Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 8755dcbdb9afe2ba78c3efb96536c5d95a48959f Author: Primoz Fiser Date: Tue Jul 8 06:22:04 2025 +0200 arm64: dts: imx93-phyboard-segin: Add PEB-EVAL-01 overlay Add overlay to support PEB-EVAL-01 adapter on phyBOARD-Segin-i.MX93. This is a PHYTEC evaluation module with three LEDs and two input buttons that users can attach to the board expansion connector X16. Note that, due to compatibility with existing PHYTEC platforms using the phyBOARD-Segin carrier board such as i.MX6UL and STM32MP1, we face some hardware limitations and can thus only support one user LED (D2) and one button (S2) on the i.MX93 variant of the phyBOARD-Segin. Signed-off-by: Primoz Fiser Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit c53625013b1ef678d67ca5c7f3e53e7081b7ec94 Author: Primoz Fiser Date: Tue Jul 8 06:22:03 2025 +0200 arm64: dts: imx93-phycore-som: Add RPMsg overlay Add an overlay used for remote processor inter-core communication between A55 and M33 cores on the phyCORE-i.MX93 SoM based boards. Overlay adds the required reserved memory regions and enables the mailbox unit and the M33 core for RPMsg (Remote Processor Messaging Framework). Signed-off-by: Primoz Fiser Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 3cb39706da205e4b603c185af8fdcaa378d44987 Author: Alexander Stein Date: Tue Jul 1 08:24:56 2025 +0200 arm64: dts: freescale: tqmls10xx: Add vdd-supply for spi-nor flash (Q)SPI NOR flash is supplied by 1.8V. Add the corresponding supply. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit f7154e0bae4f3d436b9e6b6af496c10e53d0449e Author: Alexander Stein Date: Tue Jul 1 08:24:55 2025 +0200 arm64: dts: freescale: tqmls10xx-mbls10xxa: Add vdd-supply for i2c mux The I²C mux controller is supplied by 3.3V rail. Add the corresponding supply. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 07c6d74b4fc26fc88188286887437167ed76f3fb Author: Alexander Stein Date: Tue Jul 1 08:24:54 2025 +0200 arm64: dts: tqmls1046a: Enable SFP interfaces There are two SFP interfaces usable on TQMLS1046A. Enable all the corresponding nodes. U-Boot will configure the connection if the RCW is configured accordingly. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit c19c913a91c1f7a2889e7cebe68bec71beaae70a Author: Alexander Stein Date: Tue Jul 1 08:24:53 2025 +0200 arm64: dts: tqmls1043a: Enable SFP interface There is an SFP interface usable on TQMLS1043A. Enable all the corresponding nodes. U-Boot will configure the connection if the RCW is configured accordingly. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 8dde4ab40975eb8cf5175ed0aad5a7981f1d11e6 Author: Alexander Stein Date: Tue Jul 1 08:24:52 2025 +0200 arm64: dts: tqmls10xxa: Move SFP cage definition to common place SFP is placed on mainboard, available to TQMLS1043A/1046A/1088A. Provide it in a common place, disabled by default. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 4763fbd26bc18c36848a31ce7f419e6d7c073231 Author: Alexander Stein Date: Tue Jul 1 08:24:51 2025 +0200 arm64: dts: fsl-ls1088a: Remove superfluous address and size cells The jedec SPI-NOR flash node itself has no partitions, but the partitions subnode. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 69f209070bf2e8ca78f2f975cc168b6a061a28d8 Author: Alexander Stein Date: Tue Jul 1 08:24:50 2025 +0200 arm64: dts: fsl-ls1046a: Remove superfluous address and size cells The jedec SPI-NOR flash node itself has no partitions, but the partitions subnode. Signed-off-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit b5e54dc1217993d85cbb7815678daf007e9d13fc Author: Alexander Stein Date: Tue Jul 1 08:24:49 2025 +0200 arm64: dts: fsl-ls1043a: Remove superfluous address and size cells The jedec SPI-NOR flash node itself has no partitions, but the partitions subnode. Signed-off-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit e6673464cece1cb7cd7b1e443f6076cd02b8912f Author: Sherry Sun Date: Wed Jul 2 14:27:24 2025 +0800 arm64: dts: imx94: add missing clock related properties to flexcan1 Add missing clocks and clock-names properties for flexcan1 in imx94.dtsi to align with other FlexCAN instances. Fixes: b0d011d4841b ("arm64: dts: freescale: Add basic dtsi for imx943") Signed-off-by: Sherry Sun Signed-off-by: Shawn Guo commit fc077c4c74bbcb0f86cab11aa30e0deeb24bd65b Author: Adam Ford Date: Thu Jul 3 06:38:10 2025 -0500 arm64: dts: imx8mn: Configure DMA on UART2 UART2 is often used as the console, so the DMA was likely left off on purpose, since it's recommended to not use the DMA on the console. Because, the driver checks to see if the UART is used for the console when determining if it should initialize DMA, it should be safe to enable DMA on UART2 for all users. Signed-off-by: Adam Ford Reviewed-by: Ahmad Fatoum Signed-off-by: Shawn Guo commit a69f7234e01bbd43f57d6d4eee59ab348eaec6cc Author: Adam Ford Date: Thu Jul 3 06:38:09 2025 -0500 arm64: dts: imx8mm: Configure DMA on UART2 UART2 is often used as the console, so the DMA was likely left off on purpose, since it's recommended to not use the DMA on the console. Because, the driver checks to see if the UART is used for the console when determining if it should initialize DMA, it should be safe to enable DMA on UART2 for all users. Signed-off-by: Adam Ford Reviewed-by: Fabio Estevam Reviewed-by: Ahmad Fatoum Signed-off-by: Shawn Guo commit 607135b85f2b210cd7f108d0f0aad320d897db20 Author: Alexander Stein Date: Tue Jul 1 08:21:55 2025 +0200 arm64: dts: fsl-ls1046a: Add missing DMA entries for I2C & LPUART Only i2c0 had it's DMA channels configured. Add the missing one. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 8536b259d042514fa532543dbf65ac8ac03ed925 Author: Alexander Stein Date: Tue Jul 1 08:21:54 2025 +0200 arm64: dts: fsl-ls1043a: Add missing DMA entries for I2C & LPUART Only i2c0 had it's DMA channels configured. Add the missing one. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 2a23ec9b6cf5e43969834df04a9a28170ade743f Author: Primoz Fiser Date: Thu Jun 26 09:16:29 2025 +0200 arm64: dts: freescale: imx93-phycore-som: Add watchdog ext-reset-output pin On phyCORE-i.MX93 SoM, the SoC WDOG_ANY output line is connected to the external pca9451a PMIC WDOG_B input. Apply pinctrl and set the property "fsl,ext-reset-output" for watchdog to trigger board reset via PMIC on timeout/reset. Signed-off-by: Primoz Fiser Signed-off-by: Shawn Guo commit e16ad6c79906bba5e2ac499492b6a5b29ab19d6c Author: Adam Ford Date: Fri Jun 20 16:34:46 2025 -0500 arm64: dts: imx8mn-beacon: Fix HS400 USDHC clock speed The reference manual for the i.MX8MN states the clock rate in MMC mode is 1/2 of the input clock, therefore to properly run at HS400 rates, the input clock must be 400MHz to operate at 200MHz. Currently the clock is set to 200MHz which is half the rate it should be, so the throughput is half of what it should be for HS400 operation. Fixes: 36ca3c8ccb53 ("arm64: dts: imx: Add Beacon i.MX8M Nano development kit") Signed-off-by: Adam Ford Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit f83f69097a302ed2a2775975ddcf12e6a5ac6ec3 Author: Adam Ford Date: Fri Jun 20 16:34:45 2025 -0500 arm64: dts: imx8mm-beacon: Fix HS400 USDHC clock speed The reference manual for the i.MX8MM states the clock rate in MMC mode is 1/2 of the input clock, therefore to properly run at HS400 rates, the input clock must be 400MHz to operate at 200MHz. Currently the clock is set to 200MHz which is half the rate it should be, so the throughput is half of what it should be for HS400 operation. Fixes: 593816fa2f35 ("arm64: dts: imx: Add Beacon i.MX8m-Mini development kit") Signed-off-by: Adam Ford Reviewed-by: Fabio Estevam Signed-off-by: Shawn Guo commit 2e87fbee1df502246d7c95988ed078500bad7dd8 Author: Alexander Stein Date: Thu Jun 19 07:45:11 2025 +0200 arm64: dts: tqma8mpql-mba8mpxl-lvds: Rename overlay to include display name This platform supports several displays, so rename the overlay to reflect the actual display being used. This also aligns the name to the other TQMa8M* modules. Apply the same change for MBa8MP-RAS314 as well, as it uses the same overlay. Signed-off-by: Alexander Stein Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit ca3b49fc3d0d67ed3e41a42eef4eeb9b3ded58ca Author: Laurentiu Mihalcea Date: Tue Jun 17 10:52:20 2025 -0400 arm64: dts: imx8qm-mek: support revd board's wm8962 codec The i.MX8QM MEK RevD board is a reworked version of the i.MX8QM MEK board, which includes some sensor and component changes. One of these components is the WM8962 codec, which is meant to replace the WM8960 codec present on i.MX8QM MEK. To avoid having to introduce a devicetree overlay or another DTS, the WM8962 can be supported by using a virtual I2C MUX since both of the codecs share the same I2C address. Signed-off-by: Laurentiu Mihalcea Signed-off-by: Shawn Guo commit 0216cffc4f3e2201b28df2620c473f6d2fc7fa79 Author: Laurentiu Mihalcea Date: Tue Jun 17 10:52:19 2025 -0400 arm64: dts: imx8qxp-mek: support wcpu board's wm8962 codec The i.MX8QXP WCPU MEK board is a reworked version of the i.MX8QXP MEK board, which includes some sensor and component changes. One of these components is the WM8962 codec, which is meant to replace the WM8960 codec present on i.MX8QXP MEK. To avoid having to introduce a devicetree overlay or another DTS, the WM8962 can be supported by using a virtual I2C MUX since both of the codecs share the same I2C address. Signed-off-by: Laurentiu Mihalcea Signed-off-by: Shawn Guo commit 3522ec076f5d8b3e814f21b65dc97ce8a53f2662 Author: Shengjiu Wang Date: Tue Jun 17 15:26:46 2025 +0800 arm64: dts: imx8mp-evk: Use fsl-asoc-card to replace simple card In order to support Asynchronous Sample Rate Converter (ASRC), switch to fsl-asoc-card driver for the wm8960 sound card. Signed-off-by: Shengjiu Wang Signed-off-by: Shawn Guo commit d8cc9860c79ae3eff9e30d794cf2f5cf11456c1e Author: Joy Zou Date: Mon Jun 16 14:12:59 2025 -0400 arm64: dts: imx93: add edma error interrupt support Add edma error irq for imx93. Signed-off-by: Joy Zou Reviewed-by: Alberto Merciai Tested-by: Alberto Merciai Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit cd2c5cac2e154c8a2f70368c8b3a240b9047a939 Author: João Paulo Gonçalves Date: Fri Jun 13 13:35:04 2025 -0300 arm64: dts: freescale: imx8mp-toradex-smarc: add fan cooling levels The fan controller on this board cannot work in automatic mode, and requires software control, the reason is that it has no temperature sensor connected. Given that this board is a development kit and does not have any specific fan, add a default single cooling level that would enable the fan to spin with a 100% duty cycle, enabling a safe default. Signed-off-by: João Paulo Gonçalves Signed-off-by: Shawn Guo commit 0b249223fdce3af039f074457232b4f1c9c5d39e Author: Adam Ford Date: Wed Jun 11 19:39:22 2025 -0500 arm64: dts: imx8mp: Configure VPU clocks for overdrive The defaults for this SoC are configured for overdrive mode, but the VPU clocks are currently configured for nominal mode. Increase VPU_G1_CLK_ROOT to 800MHZ from 600MHz, Increase VPU_G2_CLK_ROOT to 700MHZ from 500MHz, and Increase VPU_BUS_CLK_ROOT to 800MHz from 600MHz. This requires adjusting the clock parents. Since there is already 800MHz clock references, move the VPU_BUS and G1 clocks to it. This frees up the VPU_PLL to be configured at 700MHz to run the G2 clock at 700MHz. Signed-off-by: Adam Ford Reviewed-by: Marco Felsch Signed-off-by: Shawn Guo commit 6856b62dc8c0b9eeb331ff004cf057383ee6ef0c Author: Adam Ford Date: Wed Jun 11 19:39:21 2025 -0500 arm64: dts: imx8mp-nominal: Explicitly configure nominal VPU clocks In preparation for increasing the default VPU clocks to overdrive, configure the nominal values first to avoid running the nominal devices out of spec when imx8mp.dtsi is changed. Signed-off-by: Adam Ford Reviewed-by: Ahmad Fatoum Reviewed-by: Peng Fan Signed-off-by: Adam Ford Reviewed-by: Marco Felsch Signed-off-by: Shawn Guo commit f9ac378b0d3802eb6e2c49a74ae458c83d199499 Author: Marco Felsch Date: Wed Jun 11 19:39:20 2025 -0500 arm64: dts: imx8mp: fix VPU_BUS clock setting The VPU_PLL clock must be set before the VPU_BUS clock which is derived from the VPU_PLL clock else the VPU_BUS clock is 300MHz and not 600MHz. Signed-off-by: Marco Felsch Signed-off-by: Adam Ford Signed-off-by: Shawn Guo commit 851f8bab3489fce7d988b3f9d602867d348cb21f Author: Marco Felsch Date: Wed Jun 11 19:39:19 2025 -0500 arm64: dts: imx8mp: drop gpcv2 vpu power-domains and clocks The GPCv2 G1, G2 and VC8000E power-domain don't need to reference the VPUMIX power-domain nor their module clocks since the power and reset handling is done by the VPUMIX blkctrl driver. Signed-off-by: Marco Felsch Signed-off-by: Adam Ford LGTM: Peng Fan Tested-by: Adam Ford #imx8mp-beacon-kit Signed-off-by: Shawn Guo commit 5da259600d307f061aa34e56ded106d052a9d98a Author: Horia Geantă Date: Wed Jun 11 11:38:09 2025 +0000 arm64: dts: freescale: imx8qxp/imx8qm: Add CAAM support The iMX8QXP and iMX8QM have a CAAM (Cryptographic Acceleration and Assurance Module) like many other iMXs. Add the definitions for it. Job Rings 0 and 1 are bound to the SECO (Security Controller) ARM core and are not exposed outside it. There's no point to define them in the bindings as they cannot be used outside the SECO. Signed-off-by: Horia Geantă Signed-off-by: John Ernberg Reviewed-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 5158ec2566b7744a014b1499abcb4b0497883e63 Author: Damien Le Moal Date: Fri Jul 11 17:21:58 2025 +0900 ata: libata-eh: Make ata_eh_followup_srst_needed() return a bool ata_eh_followup_srst_needed() returns an integer used as a boolean. So change this function to return that type. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Niklas Cassel Link: https://lore.kernel.org/r/20250711082158.220047-1-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 5080cf6339d387720cb8def1001c61c779d9edcb Author: Laurentiu Mihalcea Date: Mon Jul 7 19:46:27 2025 -0400 bus: imx-aipstz: allow creating pdevs for child buses devm_of_platform_populate() passes a NULL as the bus OF match table to the underlying of_platform_populate(), meaning child bus devices of the AIPSTZ bridge will not have its children devices created. Since some SoCs (e.g. i.MX8MP) use this particular setup (e.g. SPBA bus, which is a child of AIPSTZ5 and has multiple child nodes), the driver needs to support it. Therefore, replace devm_of_platform_populate() with of_platform_populate() and pass a reference to the bus OF match table to it. For now, the only possible child buses are simple buses. Since the usage of devres is dropped, the complementary operation of of_platform_populate() needs to be called during the driver's removal. Signed-off-by: Laurentiu Mihalcea Fixes: 796cba2dd4d9 ("bus: add driver for IMX AIPSTZ bridge") Reported-by: Alexander Stein Closes: https://lore.kernel.org/lkml/5029548.31r3eYUQgx@steina-w/#t Tested-by: Alexander Stein Signed-off-by: Shawn Guo commit 5a8e7b4eaaa232d747517fe34ba6867139a4cea8 Author: Max Shevchenko Date: Wed Jul 2 13:50:48 2025 +0300 ARM: dts: mediatek: add basic support for Lenovo A369i board This smartphone uses a MediaTek MT6572 system-on-chip with 512MB of RAM. It can currently boot into initramfs with a working UART and Simple Framebuffer using already initialized panel by the bootloader. Signed-off-by: Max Shevchenko Link: https://lore.kernel.org/r/20250702-mt6572-v4-11-bde75b7ed445@proton.me Signed-off-by: AngeloGioacchino Del Regno commit 7f3f9e565316d4c9c739569d46ae812b8c1e0535 Author: Max Shevchenko Date: Wed Jul 2 13:50:47 2025 +0300 ARM: dts: mediatek: add basic support for JTY D101 board This tablet uses a MediaTek MT6572 system-on-chip with 1GB of RAM. It can currently boot into initramfs with a working UART and Simple Framebuffer using already initialized panel by the bootloader. Signed-off-by: Max Shevchenko Link: https://lore.kernel.org/r/20250702-mt6572-v4-10-bde75b7ed445@proton.me Signed-off-by: AngeloGioacchino Del Regno commit 38a9dac26704382c0a33c46854c7beae2a5cc74c Author: Max Shevchenko Date: Wed Jul 2 13:50:46 2025 +0300 ARM: dts: mediatek: add basic support for MT6572 SoC Add basic support for the MediaTek MT6572 SoC. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Max Shevchenko Link: https://lore.kernel.org/r/20250702-mt6572-v4-9-bde75b7ed445@proton.me Signed-off-by: AngeloGioacchino Del Regno commit d45bacd6be2d9a75f2bad5ed011e087b479f801a Author: Max Shevchenko Date: Wed Jul 2 13:50:43 2025 +0300 dt-bindings: arm: mediatek: add boards based on the MT6572 SoC Add entries for the JTY D101 tablet and the Lenovo A369i smartphone. Reviewed-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Max Shevchenko Link: https://lore.kernel.org/r/20250702-mt6572-v4-6-bde75b7ed445@proton.me Signed-off-by: AngeloGioacchino Del Regno commit f47d6e3ce61f0fe00798d6ce90a54511ef5c0000 Author: Max Shevchenko Date: Wed Jul 2 13:50:42 2025 +0300 dt-bindings: vendor-prefixes: add JTY JTY produced low-cost Android tablets based on various MediaTek MT65xx SoCs. Reviewed-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Acked-by: Guenter Roeck Signed-off-by: Max Shevchenko Link: https://lore.kernel.org/r/20250702-mt6572-v4-5-bde75b7ed445@proton.me Signed-off-by: AngeloGioacchino Del Regno commit 085e9f15a739f5f2c8622e82e3fe3c57ddff61f1 Author: Max Shevchenko Date: Wed Jul 2 13:50:41 2025 +0300 dt-bindings: watchdog: mediatek,mtk-wdt: add MT6572 Add a compatible string for watchdog on the MT6572 SoC. Reviewed-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Reviewed-by: Guenter Roeck Signed-off-by: Max Shevchenko Link: https://lore.kernel.org/r/20250702-mt6572-v4-4-bde75b7ed445@proton.me Signed-off-by: AngeloGioacchino Del Regno commit 9272cff87d3343bffaf279ffbdfd0522fc8a76df Author: Max Shevchenko Date: Wed Jul 2 13:50:39 2025 +0300 dt-bindings: interrupt-controller: mediatek,mt6577-sysirq: add MT6572 Add a compatible string for sysirq on the MT6572 SoC. Reviewed-by: AngeloGioacchino Del Regno Acked-by: Rob Herring (Arm) Signed-off-by: Max Shevchenko Link: https://lore.kernel.org/r/20250702-mt6572-v4-2-bde75b7ed445@proton.me Signed-off-by: AngeloGioacchino Del Regno commit b23de67d4b69963f961611ac8e2352488677dd2e Author: Bence Csókás Date: Wed Jul 9 09:26:41 2025 +0200 ARM: dts: imx6-gw: Replace license text comment with SPDX identifier Replace verbatim license text with a `SPDX-License-Identifier`. The comment header mis-attributes this license to be "X11", but the license text does not include the last line "Except as contained in this notice, the name of the X Consortium shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from the X Consortium.". Therefore, this license is actually equivalent to the SPDX "MIT" license (confirmed by text diffing). Cc: Tim Harvey Signed-off-by: Bence Csókás Acked-by: Tim Harvey Signed-off-by: Shawn Guo commit 201e41980eb8bd5103a54e1dd7881087d0e9dafc Author: Frieder Schrempf Date: Wed Jul 9 09:15:55 2025 +0200 ARM: dts: imx6ul-kontron-sl-common: Fix QSPI NAND node name Rename QSPI NAND node to 'flash@0' in order to fix the following dt-schema warning: spi-flash@0 (spi-nand): $nodename:0: 'spi-flash@0' does not match '^(flash|.*sram|nand)(@.*)?$' Signed-off-by: Frieder Schrempf Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 39abdc053b9fb60f4bcf79ef0a73eecf06cb695d Author: Eberhard Stoll Date: Wed Jul 9 09:15:54 2025 +0200 ARM: dts: imx6ul-kontron-sl-common: Add SPI NOR partitions Describe the partitions for the bootloader and the environment on the SPI NOR. While at it also fix the order of the properties in the flash node itself. Signed-off-by: Eberhard Stoll Signed-off-by: Frieder Schrempf Signed-off-by: Shawn Guo commit 47ef5256124fb939d8157b13ca048c902435cf23 Author: Annette Kobou Date: Tue Jul 8 14:24:41 2025 +0200 ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface The polarity of the DE signal of the transceiver is active-high for sending. Therefore rs485-rts-active-low is wrong and needs to be removed to make RS485 transmissions work. Signed-off-by: Annette Kobou Signed-off-by: Frieder Schrempf Fixes: 1ea4b76cdfde ("ARM: dts: imx6ul-kontron-n6310: Add Kontron i.MX6UL N6310 SoM and boards") Signed-off-by: Shawn Guo commit 20e672e65844469fc36a52326dfea80f1068705a Author: Max Shevchenko Date: Wed Jul 2 13:50:45 2025 +0300 ARM: mediatek: add MT6572 smp bring up code Add support for booting the secondary CPU on the MT6572 SoC. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Max Shevchenko Link: https://lore.kernel.org/r/20250702-mt6572-v4-8-bde75b7ed445@proton.me Signed-off-by: AngeloGioacchino Del Regno commit 8d26effc113b844eb6224cd84a052ac13631133c Author: Max Shevchenko Date: Wed Jul 2 13:50:44 2025 +0300 ARM: mediatek: add board_dt_compat entry for the MT6572 SoC Add a compatible string for the MT6572 SoC. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Max Shevchenko Link: https://lore.kernel.org/r/20250702-mt6572-v4-7-bde75b7ed445@proton.me Signed-off-by: AngeloGioacchino Del Regno commit 0c8e393941d25ea13a659f184c6dc76194a473b5 Author: Takashi Iwai Date: Wed Jul 9 18:04:30 2025 +0200 ALSA: hda: Return the codec init error properly at snd_hda_codec_build_controls() The error from snd_hda_codec_init() was ignored in snd_hda_codec_build_controls(), which should have been taken account and abort the flow. Fix it now. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-28-tiwai@suse.de commit 0c4eebafea5fefef264f2f8f1c88bbe1e53efedf Author: Takashi Iwai Date: Wed Jul 9 18:04:29 2025 +0200 MAINTAINERS: Adjust to the new HD-audio driver paths The HD-audio drivers are moved under sound/hda now. Correct the locations. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-27-tiwai@suse.de commit 691351de31684b98a7366b08cd278bb057b51fce Author: Takashi Iwai Date: Wed Jul 9 18:04:28 2025 +0200 ALSA: hda: Drop superfluous driver->ops NULL checks After all conversions, driver->ops became a must in most places (except for the codec power setup which might be called before binding to the codec driver), hence we can get rid of the superfluous driver->ops NULL checks, too. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-26-tiwai@suse.de commit cabaf5908e586156d1d59f3fb8c51d2b169bc636 Author: Takashi Iwai Date: Wed Jul 9 18:04:27 2025 +0200 ALSA: hda: Drop old codec binding method Now that all patch_ops usage have been converted to the new hda_codec_ops probe, we can drop patch_ops from the hda_codec, together with the calls of patch_ops callbacks. The hda_codec_ops.free callback is removed as all have been replaced with the new remove callback. Also, correct comments mentioning "patch"; it's replaced with "codec driver". Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-25-tiwai@suse.de commit ad781b550f9a8829e3dae4bd3d18c4a126a53d04 Author: Takashi Iwai Date: Wed Jul 9 18:04:26 2025 +0200 ALSA: hda/hdmi: Rewrite to new probe method Convert the HDMI codec drivers to use the new hda_codec_ops probe. The Intel and Nvidia-MCP HDMI drivers needed slightly more changes to deal with the unified callbacks among all models. Also another non-trivial change is Intel driver's set_power_state callback. An additional NULL check of codec->spec is needed there since the set_power_state() may be called before the probe gets called (e.g. in ASoC hda codec hda_codec_probe()). Other than that, no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-24-tiwai@suse.de commit 6cce08122f7096c045ed72b734e2e00ab46fd111 Author: Takashi Iwai Date: Wed Jul 9 18:04:25 2025 +0200 ALSA: hda/ca0132: Rewrite to new probe method Convert the CA0132 codec driver to use the new hda_codec_ops probe. No functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-23-tiwai@suse.de commit eb2f0844140fdb569e05b5521087dff6892c27cd Author: Takashi Iwai Date: Wed Jul 9 18:04:24 2025 +0200 ALSA: hda/sigmatel: Rewrite to new probe method Convert the Sigmatel/IDT codec driver to use the new hda_codec_ops probe. No functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-22-tiwai@suse.de commit be60c1290967d410597a6bc6a0982dfb8b3392e3 Author: Takashi Iwai Date: Wed Jul 9 18:04:23 2025 +0200 ALSA: hda/via: Rewrite to new probe method Convert the VIA codec driver to use the new hda_codec_ops probe. No functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-21-tiwai@suse.de commit 51a1e7f4131ad150039d8b99088d1f7fdf1bc369 Author: Takashi Iwai Date: Wed Jul 9 18:04:22 2025 +0200 ALSA: hda/si3054: Rewrite to new probe method Convert the SI3054 codec driver to use the new hda_codec_ops probe. No functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-20-tiwai@suse.de commit 3cea41383450319d0e130c6339f023f307723d6d Author: Takashi Iwai Date: Wed Jul 9 18:04:21 2025 +0200 ALSA: hda/senary: Rewrite to new probe method Convert the Senary codec driver to use the new hda_codec_ops probe. No functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-19-tiwai@suse.de commit dec96130eae338fc04756df52d8492713755610d Author: Takashi Iwai Date: Wed Jul 9 18:04:20 2025 +0200 ALSA: hda/conexant: Rewrite to new probe method Convert the Conexant codec driver to use the new hda_codec_ops probe. No functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-18-tiwai@suse.de commit e4c9f524a12c2e5fbd3dc1fb4c0bdadbe4d89f6f Author: Takashi Iwai Date: Wed Jul 9 18:04:19 2025 +0200 ALSA: hda/cs8409: Rewrite to new probe method Convert the CS8409 codec driver to use the new hda_codec_ops probe. The Dolphin support needs an override of unsol_event callback, and redirect via spec->unsol_event function pointer for now. Other than that, no functional changes. Reviewed-by: Richard Fitzgerald Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-17-tiwai@suse.de commit 1cb8744a36c7e8faa7098207f835af22a65717b5 Author: Takashi Iwai Date: Wed Jul 9 18:04:18 2025 +0200 ALSA: hda/cirrus: Split to cs420x and cs421x drivers Since the codec ops for CS420x and CS421x are fairly independent, split the cirrus codec driver into two drivers, snd-hda-codec-cs420x and snd-hda-code-cs421x. Together with the split, convert to the new hda_codec_ops probe. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-16-tiwai@suse.de commit dbe3e4ab57dd92b1f6bd9ba39aff43aa7a53749a Author: Takashi Iwai Date: Wed Jul 9 18:04:17 2025 +0200 ALSA: hda/ca0110: Rewrite to new probe method Convert the CA0110 codec driver to use the new hda_codec_ops probe. No functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-15-tiwai@suse.de commit f025ef0316ce3650e8f4dc9de2709869c9217dac Author: Takashi Iwai Date: Wed Jul 9 18:04:16 2025 +0200 ALSA: hda/analog: Rewrite to new probe method Convert the Analog Device codec driver to use the new hda_codec_ops probe. The probe function had to be unified and branched with the model type specified via driver_data instead. Other than that, no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-14-tiwai@suse.de commit 0f1e8306dcbef54f64368aefaff175d5a135671b Author: Takashi Iwai Date: Wed Jul 9 18:04:15 2025 +0200 ALSA: hda/cmedia: Rewrite to new probe method Convert the C-Media codec driver to use the new hda_codec_ops probe. Since the CM9825 uses a completely different probe and codec ops, factor out to an individual codec driver, snd-hda-codec-cm9825. Other than that, no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-13-tiwai@suse.de commit e1d695b45fd112810b4621f7e1bb48d197f5ef6a Author: Takashi Iwai Date: Wed Jul 9 18:04:14 2025 +0200 ALSA: hda/realtek: Rewrite to new probe method Convert the Realtek codec drivers to use the new hda_codec_ops probe. No functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-12-tiwai@suse.de commit 1d0e6926ef8755d7a520c566d57eec1e4083ac8b Author: Takashi Iwai Date: Wed Jul 9 18:04:13 2025 +0200 ALSA: hda/generic: Rewrite to new probe method Convert the generic HD-audio codec driver to use the new hda_codec_ops probe. No functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-11-tiwai@suse.de commit 6bf917e9aacc360e76b74249209a4290f2e8404b Author: Takashi Iwai Date: Wed Jul 9 18:04:12 2025 +0200 ALSA: hda: Introduce hda_codec_driver ops Until now, we use "patch_ops" embedded in hda_codec object for defining the callbacks that are used in various places to manage HD-audio codec. But from the device driver POV, this should have been rather the driver ops, instead of the callbacks in the codec object. This patch defines the driver ops for HD-audio codec driver as the replacement. We reuse the same struct hda_codec_ops, and this is put as hda_codec_driver.ops. When the driver->ops callbacks are defined, they are called primarily instead of codec->patch_ops callbacks. With converting to the driver ops, there is no need to pass the ugly patch_ops handling in hda_device_id tables. That is, driver_data field of hda_device_id becomes really optional and it can be used for passing the codec-specific data (e.g. specifying a model). The codec entries after the conversion should be with HDA_CODEC_ID() and co, instead of the former HDA_CODEC_ENTRY(). Once after converting all codec drivers to use driver ops, we can get rid of codec patch_ops. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-10-tiwai@suse.de commit 73cd0490819d2a693928c5977280dd31b756cb42 Author: Takashi Iwai Date: Wed Jul 9 18:04:11 2025 +0200 ALSA: hda/hdmi: Split vendor codec drivers In the past, we unified HD-audio HDMI codec driver once with a slight hope that more vendors will follow the standard, but in reality, the driver received more and more vendor-specific code. In order to make the messy code a bit more understandable, this patch splits the HDMI codec driver into multiple drivers again. Namely, the vendor-specific code for Intel, AMD and Nvidia are moved into the own drivers, while we split the common HDMI code to two drivers, the generic HDMI driver and the simple HDMI driver. So, now we have: - The generic HDMI driver (snd-hda-codec-hdmi): providing the common helpers, also supports Glenfly HDMI codecs and some other codecs that don't need vendor-specific stuff - The simple HDMI driver (snd-hda-codec-simplehdmi): devices with no dynamic PCM assignment and with fixed channels, mostly used by some other drivers, but this driver alone suffices for VIA HDMI codec support, too - Intel HDMI driver (snd-hda-codec-intelhdmi): bound with i915 / Xe DRM, based on the generic HDMI driver - AMD/ATI HDMI driver (snd-hda-codec-atihdmi): optionally bound with radeon / amdgpu DRM, based on the generic HDMI driver - Nvidia HDMI driver (snd-hda-codec-nvhdmi); optionally bound with nouveau DRM, based on the generic HDMI driver - Legacy Nvidia HDMI driver (snd-hda-codec-nvhdmi-mcp): for 2ch or 8ch outputs, based on the simple HDMI driver - Nvidia Tegra HDMI driver (snd-hda-codec-tegrahdmi): based on the generic HDMI driver Along with the driver split, the enable_silent_stream module option is moved to snd-hda-codec-intelhdmi, too, as it's an Intel-specific feature. Most of the changes here are just to split and move the code to different files, as well as to rename/expose the functions that are commonly used by drivers. The silent stream handling code is slightly modified for putting the stuff into Intel driver; now a new callback "silent_stream" is defined in hdmi_ops, and it's called in silent_stream_enable() and *_disable() functions. The runtime-PM handling in silent_stream_enable() was cleaned up, and rather taking the runtime PM refcount in the silent_stream() callback appropriately, instead. Other than that, there should be no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-9-tiwai@suse.de commit aeeb85f26c3bbef6f702ac20167c45812251501d Author: Takashi Iwai Date: Wed Jul 9 18:04:10 2025 +0200 ALSA: hda: Split Realtek HD-audio codec driver The snd-hda-codec-realtek driver supports many different codec models and accumulated lots of quirks. Now let's split it to multiple modules per probe function, i.e. for ALC260, ALC262, ALC269, etc. The common code and quirks are provided by the common library module, snd-hda-codec-realtek-lib now. One drawback of this action is that many symbols have to be exported. But they are limited with SND_HDA_CODEC_REALTEK namespace, at least. This patch tries to be idiomatic and doesn't try to rewrite the existing code. We can move the codec model-specific code into each codec driver later. The HD-audio sub-codec component binding is currently specific to ALC269, hence the management is moved into alc269.c. After that, alc_free() became identical with snd_hda_gen_free(), and it's replaced as a macro just to call snd_hda_gen_free(). Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-8-tiwai@suse.de commit 6014e9021b28e634935c776c0271b5cbcabdc5d6 Author: Takashi Iwai Date: Wed Jul 9 18:04:09 2025 +0200 ALSA: hda: Move codec drivers into sound/hda/codecs directory Now move the all remaining codec drivers from sound/pci/hda to sound/hda/codecs subdirectory. Some drivers are put under the further vendor subdirectory, and the vendor helper code (*_helper.c) are put under helpers subdirectory. Also the sub-codec drivers are moved under a different subdirectory, sound/hda/codecs/sub-codecs, for distinguishing from the main HD-audio codec drivers. The prefix patch_ and hda_ as well as the suffix _helper are dropped from file names as they are mostly superfluous. No functional changes but just file path shuffling. Reviewed-by: Richard Fitzgerald Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-7-tiwai@suse.de commit 2d9223d2d64cb5216859ced6cc33fb3b04e5f98f Author: Takashi Iwai Date: Wed Jul 9 18:04:08 2025 +0200 ALSA: hda: Move controller drivers into sound/hda/controllers directory Now HD-audio controller drivers are moved into sound/hda/controllers directory as a part of HD-audio code reorganization. Most of drivers are independent from PCI bus, hence it makes more sense to put under sound/hda. The hda_ prefix is dropped from most of files at moving, as it's more or less superfluous. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-6-tiwai@suse.de commit 146355ee880e6d15ba12e2baf5be70e5efe07796 Author: Takashi Iwai Date: Wed Jul 9 18:04:07 2025 +0200 ALSA: hda: Move CONFIG_SND_HDA_PREALLOC_SIZE into sound/hda/common CONFIG_SND_HDA_PREALLOC_SIZE is used only by controller.c in sound/hda/common, hence it depends on CONFIG_SND_HDA. Move the definition to the right place inside SND_HDA if/endif block in sound/hda/common/Kconfig. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-5-tiwai@suse.de commit 05be28fe8521f183f945d052d5019197e5934f0e Author: Takashi Iwai Date: Wed Jul 9 18:04:06 2025 +0200 ALSA: hda: Move common codec driver into sound/hda/common directory The snd-hda-codec module contains the most of common code used by both HD-audio controller and codec drivers, and it's basically independent from PCI. Let's move the code to sound/hda/common directory as a part of code reorganization. The hda_ prefix is dropped from the most of file names as it's rather superfluous. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-4-tiwai@suse.de commit b2660d1ebde1ba8f3edf963f3aac2bea884457c3 Author: Takashi Iwai Date: Wed Jul 9 18:04:05 2025 +0200 ALSA: hda: Move HD-audio core stuff into sound/hda/core This is a part of HD-audio code restructuring. Simply move the current code of sound/hda/* into the subdirectory sound/hda/core, so that more stuff can be moved into sound/hda cleanly later. Most of file names with hdac_ and hdac_ext_ prefix are renamed without the prefix, since they can be identified well in the directory name and superfluous. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-3-tiwai@suse.de commit ed677858d4fe8d165952c1794898d6fc0b65ddfe Author: Takashi Iwai Date: Wed Jul 9 18:04:04 2025 +0200 ALSA: hda: Move widget capability macros into hdaudio.h The get_wcaps() and co are used not only by HD-audio core but also other driver code, hence it'd be better to put into the common header instead of local.h. OTOH, there are macros of the same name like get_wcaps() that are still used in sound/pci/hda/* locally, and those conflict with each other. So we need to rename get_wcaps() (to be moved from hda-core) with the proper snd_hdac prefix for avoiding name conflicts, and define in the common hdaudio.h. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250709160434.1859-2-tiwai@suse.de commit bee60f019606827363d7e355b2e859e29e928c3a Author: Takashi Iwai Date: Thu Jul 10 12:07:25 2025 +0200 ALSA: core: Copy string more safely Replace the remaining strcpy() and sprintf() usages in the ALSA core code with the safer versions. The first strcpy() points actually to card->id, hence just use strscpy() with card->id instead. The append of suffix string is slightly rewritten so that we can use scnprintf() and strscpy(). Only for safety, no actual behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-104-tiwai@suse.de commit 53beb4d0ed8f9bf31ba30e65953abb473b191bd0 Author: Takashi Iwai Date: Thu Jul 10 12:07:24 2025 +0200 ALSA: usb-audio: Copy string more safely Replace strcpy() and sprintf() usages in the USB audio drivers with the safer versions (strscpy() and scnprintf()) with the proper max size evaluation. Only for safety, no actual behavior change. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-103-tiwai@suse.de commit f15be4dca2a622fa397eae43f03e71e68e50a266 Author: Takashi Iwai Date: Thu Jul 10 12:07:23 2025 +0200 ALSA: cmipci: Copy string more safely The probe code uses sprintf() and strcat() without caring about the string buffer size. Replace with safer code. Only a cosmetic safety matter, no functional changes intended. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-102-tiwai@suse.de commit 926359588170882ab39c578774a989a5237a3747 Author: Takashi Iwai Date: Thu Jul 10 12:07:22 2025 +0200 ALSA: ac97: Copy string more safely snd_ac97_get_name() blindly assumes that the name buffer is large enough, but we should be more careful. Pass the max buffer length and allow trimming to the size. Only a cosmetic safety matter, no functional changes intended. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-101-tiwai@suse.de commit a9b25e8a437586fb1e1749caae96e305dc9e4906 Author: Takashi Iwai Date: Thu Jul 10 12:07:21 2025 +0200 ALSA: usb-audio: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-100-tiwai@suse.de commit 414e4f01f663d9d46cee98d1c8d2ef33f10ec26e Author: Takashi Iwai Date: Thu Jul 10 12:07:20 2025 +0200 ALSA: ua101: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-99-tiwai@suse.de commit f3d81c058f4878f31bbf9dcb33b0acc41d02675c Author: Takashi Iwai Date: Thu Jul 10 12:07:19 2025 +0200 ALSA: usx2y: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-98-tiwai@suse.de commit 2d41b6f40637210a6f41642cfb343d339fa95b52 Author: Takashi Iwai Date: Thu Jul 10 12:07:18 2025 +0200 ALSA: line6: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-97-tiwai@suse.de commit 19a28b8c7f9f63019fa1b6ccfbbe78f5fd4bc77c Author: Takashi Iwai Date: Thu Jul 10 12:07:17 2025 +0200 ALSA: 6fire: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-96-tiwai@suse.de commit 2173cee16c2cad741d14c2eb17d39928f7b162c9 Author: Takashi Iwai Date: Thu Jul 10 12:07:16 2025 +0200 ALSA: synth: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-95-tiwai@suse.de commit 3fb167d7ceb7f22462743df93d9ed7f06eeaf6d0 Author: Takashi Iwai Date: Thu Jul 10 12:07:15 2025 +0200 ALSA: spi: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-94-tiwai@suse.de commit fee48aed6b8d87667128b2c937fcedecc7da7c1c Author: Takashi Iwai Date: Thu Jul 10 12:07:14 2025 +0200 ALSA: sparc: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-93-tiwai@suse.de commit 61d4db8f7c6c63fd4dfba67bda86754770eed627 Author: Takashi Iwai Date: Thu Jul 10 12:07:13 2025 +0200 ALSA: sh: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-92-tiwai@suse.de commit 292e4adb954b8584b74bff0d1f9044af297fa248 Author: Takashi Iwai Date: Thu Jul 10 12:07:12 2025 +0200 ALSA: ppc: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-91-tiwai@suse.de commit 704a54b84f567ecbefdce250f455c9ff2d4f3860 Author: Takashi Iwai Date: Thu Jul 10 12:07:11 2025 +0200 ALSA: vxpocket: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-90-tiwai@suse.de commit a5546578af79da589e27d50441ef6881de21e65d Author: Takashi Iwai Date: Thu Jul 10 12:07:10 2025 +0200 ALSA: pdaudiocf: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-89-tiwai@suse.de commit 362c6bbe367c769ef4526c4a2d3cebfcbc58d0ee Author: Takashi Iwai Date: Thu Jul 10 12:07:09 2025 +0200 ALSA: ymfpci: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-88-tiwai@suse.de commit fd86b9bbf5663b8f4752bbf780be55fd8437bf00 Author: Takashi Iwai Date: Thu Jul 10 12:07:08 2025 +0200 ALSA: via82xx: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-87-tiwai@suse.de commit b28309eac3b755d9021544960e6f6ea0507678fd Author: Takashi Iwai Date: Thu Jul 10 12:07:07 2025 +0200 ALSA: trident: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-86-tiwai@suse.de commit 7ffad83d527e7ab3ac33df47e93dd94eccffc15f Author: Takashi Iwai Date: Thu Jul 10 12:07:06 2025 +0200 ALSA: sonicvibes: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-85-tiwai@suse.de commit b097bdf5e92d4bcb5eb9bb76165558d0c11f5cb9 Author: Takashi Iwai Date: Thu Jul 10 12:07:05 2025 +0200 ALSA: sis7019: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-84-tiwai@suse.de commit a8b1aba400a9348d474ffc5ba9a34fbd10f2107f Author: Takashi Iwai Date: Thu Jul 10 12:07:04 2025 +0200 ALSA: rme9652: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-83-tiwai@suse.de commit 4a9b01c7e58602a084edcb36bfce0b80f2775691 Author: Takashi Iwai Date: Thu Jul 10 12:07:03 2025 +0200 ALSA: hdspm: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-82-tiwai@suse.de commit 43b90c3fe5528abb638ebc4a84924c08d636f82f Author: Takashi Iwai Date: Thu Jul 10 12:07:02 2025 +0200 ALSA: hdsp: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-81-tiwai@suse.de commit 50301b7a02c341b09d3191c9ea02b3d04bdd2bb8 Author: Takashi Iwai Date: Thu Jul 10 12:07:01 2025 +0200 ALSA: rme96: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-80-tiwai@suse.de commit ca485569ca35c4a5dd4e744ef4d4f9ef9c5a3e1b Author: Takashi Iwai Date: Thu Jul 10 12:07:00 2025 +0200 ALSA: rme32: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-79-tiwai@suse.de commit 9885bd7c4ce531c784cc1ce6b3f07ba84480ff5b Author: Takashi Iwai Date: Thu Jul 10 12:06:59 2025 +0200 ALSA: riptide: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-78-tiwai@suse.de commit c810473253842bf8df21bd0dee5195ef62d95a3c Author: Takashi Iwai Date: Thu Jul 10 12:06:58 2025 +0200 ALSA: pcxhr: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-77-tiwai@suse.de commit 1c8e3ebdfe3342b885cdf519d0bbc9e5a494c60a Author: Takashi Iwai Date: Thu Jul 10 12:06:57 2025 +0200 ALSA: oxygen: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-76-tiwai@suse.de commit 6ffb7be30ba0c064e3b42c3d643a1419b9ccc981 Author: Takashi Iwai Date: Thu Jul 10 12:06:56 2025 +0200 ALSA: nm256: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-75-tiwai@suse.de commit ed04b49e21f05b0f84bbaa86a59abd3ef64de946 Author: Takashi Iwai Date: Thu Jul 10 12:06:55 2025 +0200 ALSA: mixart: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-74-tiwai@suse.de commit c1b4f94c7645c58111cf53eb5165ab5fc65ec67d Author: Takashi Iwai Date: Thu Jul 10 12:06:54 2025 +0200 ALSA: maestro3: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-73-tiwai@suse.de commit ec4894f82775c9abe14afef9a29b913ee549ec06 Author: Takashi Iwai Date: Thu Jul 10 12:06:53 2025 +0200 ALSA: lx6464es: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-72-tiwai@suse.de commit cc519d221f9c8f1ff574b7fec0d875fb76a436b8 Author: Takashi Iwai Date: Thu Jul 10 12:06:52 2025 +0200 ALSA: lola: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-71-tiwai@suse.de commit 22b331f5a2a0e6534214b38c58d806d2aa43ae82 Author: Takashi Iwai Date: Thu Jul 10 12:06:51 2025 +0200 ALSA: korg1212: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-70-tiwai@suse.de commit 9a86ffe73b22260bd25274a6fb0579f77f20342a Author: Takashi Iwai Date: Thu Jul 10 12:06:50 2025 +0200 ALSA: intel8x0: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-69-tiwai@suse.de commit f79d7aef3e4e260bef96be3638f9b37f9c70fdf1 Author: Takashi Iwai Date: Thu Jul 10 12:06:49 2025 +0200 ALSA: ice1724: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-68-tiwai@suse.de commit b51681287f9c9fb14436d3705e268b1d65c19b2d Author: Takashi Iwai Date: Thu Jul 10 12:06:48 2025 +0200 ALSA: ice1712: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-67-tiwai@suse.de commit 7deb4eac7d65a37c138076565f2717c2a6c63342 Author: Takashi Iwai Date: Thu Jul 10 12:06:47 2025 +0200 ALSA: fm801: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-66-tiwai@suse.de commit 42b68e73568d3ddb4b571d9277fceeff91aded0b Author: Takashi Iwai Date: Thu Jul 10 12:06:46 2025 +0200 ALSA: es1968: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-65-tiwai@suse.de commit 6df1d279dbfb0498ec984e55d11d91c56728ad77 Author: Takashi Iwai Date: Thu Jul 10 12:06:45 2025 +0200 ALSA: es1938: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-64-tiwai@suse.de commit d24457cae235e97d00fd6305d76b3858d2390a8b Author: Takashi Iwai Date: Thu Jul 10 12:06:44 2025 +0200 ALSA: ens1370: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-63-tiwai@suse.de commit 3ddbb87d99946b6d21ded58f983fb4642ad57845 Author: Takashi Iwai Date: Thu Jul 10 12:06:43 2025 +0200 ALSA: emu10k1: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-62-tiwai@suse.de commit 7bab02a32c6ae08aeb60aa6f85363cd5847d0911 Author: Takashi Iwai Date: Thu Jul 10 12:06:42 2025 +0200 ALSA: echoaudio: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-61-tiwai@suse.de commit ea9deed52d7f196454456f775fddf53328e90f2a Author: Takashi Iwai Date: Thu Jul 10 12:06:41 2025 +0200 ALSA: ctxfi: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-60-tiwai@suse.de commit fe9502be46f7b76b9d95fc5df7b018f48b8a22ce Author: Takashi Iwai Date: Thu Jul 10 12:06:40 2025 +0200 ALSA: cs5535audio: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-59-tiwai@suse.de commit 2d5239eab8ee2d474b5c1a70475f6fe87c74ba57 Author: Takashi Iwai Date: Thu Jul 10 12:06:39 2025 +0200 ALSA: cs5530: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-58-tiwai@suse.de commit 0eb71ea6d7f3e64137c19e8d4a3bdcffc57c5b05 Author: Takashi Iwai Date: Thu Jul 10 12:06:38 2025 +0200 ALSA: cs46xx: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-57-tiwai@suse.de commit e3502b8672cafc679b57717e4f9c1abca8106061 Author: Takashi Iwai Date: Thu Jul 10 12:06:37 2025 +0200 ALSA: cs4281: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-56-tiwai@suse.de commit e43c8878e9dd7f9dc0b75c8f57bdeaa351efe3ef Author: Takashi Iwai Date: Thu Jul 10 12:06:36 2025 +0200 ALSA: cmipci: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-55-tiwai@suse.de commit 32aeb8606936d4f928aa28fb85c2785b5fa5870e Author: Takashi Iwai Date: Thu Jul 10 12:06:35 2025 +0200 ALSA: ca0106: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-54-tiwai@suse.de commit dd4fcc8f04929a53a8001915266a7beccc5e0652 Author: Takashi Iwai Date: Thu Jul 10 12:06:34 2025 +0200 ALSA: bt87x: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-53-tiwai@suse.de commit 8b1208d70ae49c56e7742f172ae6f39fcebca2ba Author: Takashi Iwai Date: Thu Jul 10 12:06:33 2025 +0200 ALSA: azt3328: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-52-tiwai@suse.de commit f6e41e48d994f4e569df2f4be69f12e9b5641b87 Author: Takashi Iwai Date: Thu Jul 10 12:06:32 2025 +0200 ALSA: aw2: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-51-tiwai@suse.de commit 5cd156964fe731f0c852ed5c51b9b64aaf046a53 Author: Takashi Iwai Date: Thu Jul 10 12:06:31 2025 +0200 ALSA: au88x0: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-50-tiwai@suse.de commit 2dc364f96536b7b5e6c32f8dc5fa4917d92acf4c Author: Takashi Iwai Date: Thu Jul 10 12:06:30 2025 +0200 ALSA: atiixp: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-49-tiwai@suse.de commit 1882c12ae2ab01d52b33d72b7b3203c44819a8f9 Author: Takashi Iwai Date: Thu Jul 10 12:06:29 2025 +0200 ALSA: asihpi: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-48-tiwai@suse.de commit 1813fa7c587a35aa1d73e1d6d4f1599ecac8bd33 Author: Takashi Iwai Date: Thu Jul 10 12:06:28 2025 +0200 ALSA: als4000: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-47-tiwai@suse.de commit 03b0a614e2292a4afcaf5d196752d02803e2e6ca Author: Takashi Iwai Date: Thu Jul 10 12:06:27 2025 +0200 ALSA: als300: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-46-tiwai@suse.de commit 3edc76a671f761f6797e55cab88157f43256dedd Author: Takashi Iwai Date: Thu Jul 10 12:06:26 2025 +0200 ALSA: ali5451: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-45-tiwai@suse.de commit 1d68ba24a79c2dce7cdb4bfbc6fdd8e0b2e69b85 Author: Takashi Iwai Date: Thu Jul 10 12:06:25 2025 +0200 ALSA: ak4531: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-44-tiwai@suse.de commit 48102e32203178012567e6b78192e707d5ca7668 Author: Takashi Iwai Date: Thu Jul 10 12:06:24 2025 +0200 ALSA: ad1889: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-43-tiwai@suse.de commit c9b7c4b628817f8aae757924210f55374362e91d Author: Takashi Iwai Date: Thu Jul 10 12:06:23 2025 +0200 ALSA: ac97: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-42-tiwai@suse.de commit c9b41682945f3c389bd230aa74bd1409df31b521 Author: Takashi Iwai Date: Thu Jul 10 12:06:22 2025 +0200 ALSA: parisc: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-41-tiwai@suse.de commit 7169b6a6763d5a879f42ce1a1aad72b6d611e375 Author: Takashi Iwai Date: Thu Jul 10 12:06:21 2025 +0200 ALSA: mips: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-40-tiwai@suse.de commit fc52ff69c5f1b144bfc9edaa7160fde993c874f5 Author: Takashi Iwai Date: Thu Jul 10 12:06:20 2025 +0200 ALSA: wss: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-39-tiwai@suse.de commit 2e2a2feb915c90d2a2be96373339157e11a614fb Author: Takashi Iwai Date: Thu Jul 10 12:06:19 2025 +0200 ALSA: wavefront: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-38-tiwai@suse.de commit 96b1776d019a7f1865fc3078c68650654319b509 Author: Takashi Iwai Date: Thu Jul 10 12:06:18 2025 +0200 ALSA: sscape: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-37-tiwai@suse.de commit c8eef317e66bb958eaa3b156386fdd3962706bf0 Author: Takashi Iwai Date: Thu Jul 10 12:06:17 2025 +0200 ALSA: sc6000: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-36-tiwai@suse.de commit b4a82a97c4d4126143e08966405c6b3b653d3b0d Author: Takashi Iwai Date: Thu Jul 10 12:06:16 2025 +0200 ALSA: opti9xx: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-35-tiwai@suse.de commit c7eaa0ebed3589fe416aac22b2deb23c7ee4ff4f Author: Takashi Iwai Date: Thu Jul 10 12:06:15 2025 +0200 ALSA: opl3sa2: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-34-tiwai@suse.de commit 9c4e42967dc5c358d4bec463b71a9ac7c7b9e855 Author: Takashi Iwai Date: Thu Jul 10 12:06:14 2025 +0200 ALSA: msnd: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-33-tiwai@suse.de commit 72b1baa1d650dd8b15c8a60daff2e37889d0e627 Author: Takashi Iwai Date: Thu Jul 10 12:06:13 2025 +0200 ALSA: gus: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-32-tiwai@suse.de commit 74987a0cc4614477a9a5279f645a6d4b0dd66d74 Author: Takashi Iwai Date: Thu Jul 10 12:06:12 2025 +0200 ALSA: galaxy: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-31-tiwai@suse.de commit 962dba349a76dd6872371c793f074704e57d2dc9 Author: Takashi Iwai Date: Thu Jul 10 12:06:11 2025 +0200 ALSA: es18xx: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-30-tiwai@suse.de commit 22095c0515e0cb34738e1600b54f8bceb7cf7b42 Author: Takashi Iwai Date: Thu Jul 10 12:06:10 2025 +0200 ALSA: es1688: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-29-tiwai@suse.de commit 9a5cca8d838bc67da5c742ab1776d952364eccb5 Author: Takashi Iwai Date: Thu Jul 10 12:06:09 2025 +0200 ALSA: cs423x: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-28-tiwai@suse.de commit 4e55e03e4c17150218c6869cee7cb754bd291522 Author: Takashi Iwai Date: Thu Jul 10 12:06:08 2025 +0200 ALSA: cmi8330: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-27-tiwai@suse.de commit 231d135055a685e75b7d815e2aacdf85cb5bcc3e Author: Takashi Iwai Date: Thu Jul 10 12:06:07 2025 +0200 ALSA: cmi8328: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-26-tiwai@suse.de commit dd9de1a144e10d5498ea1f0fb4ab70fa6d953ff0 Author: Takashi Iwai Date: Thu Jul 10 12:06:06 2025 +0200 ALSA: als100: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-25-tiwai@suse.de commit 461cef4d7d0270b5d11c2738c3a0a4e099351718 Author: Takashi Iwai Date: Thu Jul 10 12:06:05 2025 +0200 ALSA: adlib: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-24-tiwai@suse.de commit 94d7b8beae3574fe7167b8e0f31d1d480442ccdf Author: Takashi Iwai Date: Thu Jul 10 12:06:04 2025 +0200 ALSA: ad1816a: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-23-tiwai@suse.de commit c03ebbdfddc1a8ae5a50a77819069688f0cffbe3 Author: Takashi Iwai Date: Thu Jul 10 12:06:03 2025 +0200 ALSA: firewire: tascam: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/20250710100727.22653-22-tiwai@suse.de commit 74e4255b2058642eb7913d9da442cee6b740cae9 Author: Takashi Iwai Date: Thu Jul 10 12:06:02 2025 +0200 ALSA: firewire: oxfw: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/20250710100727.22653-21-tiwai@suse.de commit 97f54683816dad23896c3a93a83253044369f3f0 Author: Takashi Iwai Date: Thu Jul 10 12:06:01 2025 +0200 ALSA: firewire: motu: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/20250710100727.22653-20-tiwai@suse.de commit 6e96433010646c71a9f14ea305bda46189360b3a Author: Takashi Iwai Date: Thu Jul 10 12:06:00 2025 +0200 ALSA: firewire: isight: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/20250710100727.22653-19-tiwai@suse.de commit fcd7979273af35d79999bfd0e897fa34d4b047d5 Author: Takashi Iwai Date: Thu Jul 10 12:05:59 2025 +0200 ALSA: firewire: fireworks: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/20250710100727.22653-18-tiwai@suse.de commit 4b366c9d78e70bbf2e52f0a2fa2aca3e505ce95e Author: Takashi Iwai Date: Thu Jul 10 12:05:58 2025 +0200 ALSA: firewire: fireface: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/20250710100727.22653-17-tiwai@suse.de commit 662dacfc6466e9eb07ae6be18799b62dbdaa2a0a Author: Takashi Iwai Date: Thu Jul 10 12:05:57 2025 +0200 ALSA: firewire: digi00x: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/20250710100727.22653-16-tiwai@suse.de commit ae2cdfc616722533332db129dbec385e32f467e0 Author: Takashi Iwai Date: Thu Jul 10 12:05:56 2025 +0200 ALSA: firewire: dice: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/20250710100727.22653-15-tiwai@suse.de commit f9f63cb6eb91b67244c0fb5e91e98638178eadac Author: Takashi Iwai Date: Thu Jul 10 12:05:55 2025 +0200 ALSA: firewire: bebob: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Reviewed-by: Takashi Sakamoto Link: https://patch.msgid.link/20250710100727.22653-14-tiwai@suse.de commit c4a38b94bad184a140d357541e50576d4f288592 Author: Takashi Iwai Date: Thu Jul 10 12:05:54 2025 +0200 ALSA: vx: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-13-tiwai@suse.de commit 73e86d3666379b458e93e8a76fcd019f006b000d Author: Takashi Iwai Date: Thu Jul 10 12:05:53 2025 +0200 ALSA: virmidi: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-12-tiwai@suse.de commit a725f6fa5835e518b1b52176894f62da7e587c45 Author: Takashi Iwai Date: Thu Jul 10 12:05:52 2025 +0200 ALSA: serial-u16550: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-11-tiwai@suse.de commit eb264bc529545756f314f14fa294681178f27fd9 Author: Takashi Iwai Date: Thu Jul 10 12:05:51 2025 +0200 ALSA: serial-generic: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-10-tiwai@suse.de commit 7ba740ecf54cf1990e37607545d7e96673166f1e Author: Takashi Iwai Date: Thu Jul 10 12:05:50 2025 +0200 ALSA: portman2x4: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-9-tiwai@suse.de commit 6d352251e905c13f4363ca7780a94ee703077900 Author: Takashi Iwai Date: Thu Jul 10 12:05:49 2025 +0200 ALSA: pcsp: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-8-tiwai@suse.de commit 0676ccf26f1cfb4a9aff96f933f52580357049db Author: Takashi Iwai Date: Thu Jul 10 12:05:48 2025 +0200 ALSA: opl4: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-7-tiwai@suse.de commit bb246ab0943d4a8253e001d03b607b046f7588b3 Author: Takashi Iwai Date: Thu Jul 10 12:05:47 2025 +0200 ALSA: opl3: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-6-tiwai@suse.de commit 59cea894bf3b80a4a3581ea614d465bf54474272 Author: Takashi Iwai Date: Thu Jul 10 12:05:46 2025 +0200 ALSA: mpu401: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-5-tiwai@suse.de commit 7df6224dec68eaa266663206d899a77d7a947541 Author: Takashi Iwai Date: Thu Jul 10 12:05:45 2025 +0200 ALSA: seq: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-4-tiwai@suse.de commit d8cd23a0d2da68650a0710908aeefbe8b799fec3 Author: Takashi Iwai Date: Thu Jul 10 12:05:44 2025 +0200 ALSA: rawmidi: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-3-tiwai@suse.de commit 8bb0a5fcde7b424172e48cf2b85664e7fe201417 Author: Takashi Iwai Date: Thu Jul 10 12:05:43 2025 +0200 ALSA: control: Use safer strscpy() instead of strcpy() Use a safer function strscpy() instead of strcpy() for copying to arrays. Only idiomatic code replacement, and no functional changes. Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250710100727.22653-2-tiwai@suse.de commit 3829d81b6958632602bee7a8272005d1a4ce298f Merge: 907e01b3ce4cee d9b99eb3d76a60 Author: Takashi Iwai Date: Fri Jul 11 09:50:06 2025 +0200 Merge branch 'for-linus' into for-next Back-merge 6.16 devel branch for large patch sets including string cleanups and HD-audio reorganization Signed-off-by: Takashi Iwai commit f794181b723141faa071d73b258a073e2c82d6ac Author: Yannic Moog Date: Wed Jun 11 15:05:30 2025 +0200 dt-bindings: add imx95-libra-rdk-fpsc imx95-libra-rdk-fpsc is a development board based on the phyCORE-i.MX 95 Plus FPSC SoM. Add its description and binding. Acked-by: Conor Dooley Signed-off-by: Yannic Moog Signed-off-by: Shawn Guo commit c694bc8b612ddd0dd70e122a00f39cb1e2e6927f Author: Easwar Hariharan Date: Thu Jul 3 08:54:33 2025 -0700 iommu/amd: Enable PASID and ATS capabilities in the correct order Per the PCIe spec, behavior of the PASID capability is undefined if the value of the PASID Enable bit changes while the Enable bit of the function's ATS control register is Set. Unfortunately, pdev_enable_caps() does exactly that by ordering enabling ATS for the device before enabling PASID. Cc: Suravee Suthikulpanit Cc: Vasant Hegde Cc: Jason Gunthorpe Cc: Jerry Snitselaar Fixes: eda8c2860ab679 ("iommu/amd: Enable device ATS/PASID/PRI capabilities independently") Signed-off-by: Easwar Hariharan Reviewed-by: Vasant Hegde Reviewed-by: Jason Gunthorpe Link: https://lore.kernel.org/r/20250703155433.6221-1-eahariha@linux.microsoft.com Signed-off-by: Joerg Roedel commit 8129b9e8e32cb1a8976bbe5d7d14f215639758d2 Author: Tiwei Bie Date: Wed Jul 9 09:00:21 2025 +0800 um: vfio: Support adding devices via mconsole It can be used when we want to pass through PCI devices to UML while it's up and running. PCI devices can be passed through to UML using the same syntax as the command line option: (mconsole) config vfio_uml.device= Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250709010021.1076902-1-tiwei.bie@linux.dev Signed-off-by: Johannes Berg commit 4c916e3b224a02019b3cc3983a15f32bfd9a22df Author: Tiwei Bie Date: Tue Jul 8 17:04:03 2025 +0800 um: rtc: Avoid shadowing err in uml_rtc_start() Remove the declaration of 'err' inside the 'if (timetravel)' block, as it would otherwise be unavailable outside that block, potentially leading to uml_rtc_start() returning an uninitialized value. Fixes: dde8b58d5127 ("um: add a pseudo RTC") Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250708090403.1067440-5-tiwei.bie@linux.dev Signed-off-by: Johannes Berg commit 5d2c5b8c410c13995aeee7fdf52b7184a084d506 Author: Tiwei Bie Date: Tue Jul 8 17:04:02 2025 +0800 um: Avoid redefining ARCH_HAS_CACHE_LINE_SIZE There is a generic ARCH_HAS_CACHE_LINE_SIZE option introduced by commit c2280be81de4 ("mm: generalize ARCH_HAS_CACHE_LINE_SIZE") in mm/Kconfig. Select that instead. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250708090403.1067440-4-tiwei.bie@linux.dev Signed-off-by: Johannes Berg commit 409a0c00c490d3b7c077e316a9261462241acda7 Author: Tiwei Bie Date: Tue Jul 8 17:04:01 2025 +0800 um: Make mm_list and mm_list_lock static They are only used within mmu.c. Make them static. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250708090403.1067440-3-tiwei.bie@linux.dev Signed-off-by: Johannes Berg commit 159e76514b9565f92ca5beebc1f92faed21a03aa Author: Tiwei Bie Date: Tue Jul 8 17:04:00 2025 +0800 um: Make unscheduled_userspace_iterations static It's only used within process.c. Make it static. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250708090403.1067440-2-tiwei.bie@linux.dev Signed-off-by: Johannes Berg commit b9e2f2246eb2b5617d53af7b5e4e1b8c916f26a8 Author: Thomas Weißschuh Date: Fri Jul 4 14:34:47 2025 +0200 um: Re-evaluate thread flags repeatedly The thread flags may change during their processing. For example a task_work can queue a new signal to be sent. This signal should be delivered before returning to usespace again. Evaluate the flags repeatedly similar to other architectures. Signed-off-by: Thomas Weißschuh Reviewed-by: Nam Cao Link: https://patch.msgid.link/20250704-uml-thread_flags-v1-1-0e293fd8d627@linutronix.de Signed-off-by: Johannes Berg commit ac1ad16f10523c2c60aef0abeb8a850ea6d06ced Author: Johannes Berg Date: Fri Jul 4 14:12:42 2025 +0200 um: simplify syscall header files Since Thomas's recent commit 2af10530639b ("um/x86: Add system call table to header file") , we now have two extern declarations of the syscall table, one internal and one external, and they don't even match on 32-bit. Clean this up and remove all the extra code. Reviewed-by: Thomas Weißschuh Link: https://patch.msgid.link/20250704141243.a68366f6acc3.If8587a4aafdb90644fc6d0b2f5e31a2d1887915f@changeid Signed-off-by: Johannes Berg commit 2a713f04eddd97f5893de73b1ccd789e69ac0a8d Author: Thomas Weißschuh Date: Thu Jul 3 14:38:55 2025 +0200 um/ptrace: Implement HAVE_SYSCALL_TRACEPOINTS Implement syscall tracepoints through the generic tracing infrastructure. Signed-off-by: Thomas Weißschuh Reviewed-by: Nam Cao Link: https://patch.msgid.link/20250703-uml-have_syscall_tracepoints-v1-2-23c1d3808578@linutronix.de Signed-off-by: Johannes Berg commit 32a15664efe9b44b64a7179b47cc7742af5098c2 Author: Thomas Weißschuh Date: Thu Jul 3 14:38:54 2025 +0200 um/x86: Add system call table to header file The generic system call tracing infrastructure requires access to the system call table. The symbol is already visible to the linker but is lacking a public declaration. Add a public declaration. Signed-off-by: Thomas Weißschuh Reviewed-by: Nam Cao Link: https://patch.msgid.link/20250703-uml-have_syscall_tracepoints-v1-1-23c1d3808578@linutronix.de Signed-off-by: Johannes Berg commit c36e5eb9dd3258f654d05d8c1f09d03126dc2488 Author: Nam Cao Date: Mon Jun 30 08:51:16 2025 +0200 um: virt-pci: Switch to msi_create_parent_irq_domain() Move away from the legacy MSI domain setup, switch to use msi_create_parent_irq_domain(). Signed-off-by: Nam Cao Acked-by: Johannes Berg Tested-by: Johannes Berg Link: https://patch.msgid.link/5f0bd8e877e7bfdfb1a7e99d6b126caf6a7eea48.1751266049.git.namcao@linutronix.de Signed-off-by: Johannes Berg commit 974e6cfd8d7b61c3fa27a9dd6ed452b7e7a06de9 Author: Hrushikesh Salunke Date: Tue Jul 8 17:09:42 2025 +0530 arm64: dts: ti: k3-am69-sk: Add idle-states for remaining SERDES instances In AM69 SoC there are 4 instances of the 4 lane SERDES. So in "serdes_ln_ctrl" node there are total 16 entries in "mux-reg-mask" property. But "idle-states" is defined only for the lanes of first two SERDES instances. SERDES lane mapping is left at its reset state of "zero" for all four lanes of SERDES2 and SERDES4. The reset state of "zero" corresponds to the following configuration: Lanes 0 and 1 of SERDES2 are unused CPSW MAC Ports 1 and 2 mapped to lanes 2 and 3 of SERDES2 EDP Lanes 0, 1, 2 and 3 mapped to lanes 0, 1, 2 and 3 of SERDES4 For completeness, define the "idle-states" for the lanes of remaining SERDES instances. Signed-off-by: Hrushikesh Salunke Reviewed-by: Siddharth Vadapalli Link: https://lore.kernel.org/r/20250708113942.4137917-1-h-salunke@ti.com Signed-off-by: Vignesh Raghavendra commit 289c5862b6c8984bbe840a6cd590225c6dd271f3 Author: Bryan Brattlof Date: Thu Jul 10 07:03:10 2025 -0500 arm64: dts: ti: k3-am62a7-sk: add boot phase tags The 'bootph-all' tag was added to the dt-schema to describe the various nodes used during the different phases of bootup with DT. Add the bootph-all tag to all nodes that are used during the early stages of bootup by the bootloaders. This includes the console UART along with the SD and eMMC nodes and its required regulators for the 3v3 to 1v8 transition and the various nodes for Ethernet booting. Signed-off-by: Bryan Brattlof Link: https://lore.kernel.org/r/20250710-62a-uboot-cleanup-v2-1-9e04a7db1f54@ti.com Signed-off-by: Vignesh Raghavendra commit df62b42b0f37c4fe71613383c6a083dfff7f2c86 Author: Bryan Brattlof Date: Thu Jul 10 09:39:00 2025 -0500 arm64: dts: ti: k3-am654-base-board: add boot phase tags The 'bootph-all' tag was added to the dt-schema to describe the various nodes used during the different phases of bootup with DT. Add the bootph-all tag to all nodes that are used in the bootloader for the AM654 reference board. UARTs used as a console, the SD and eMMC nodes along with the needed regulators for UHS modes, and the needed nodes for OSPI boot are all marked with 'bootph-all' to handle the various boot modes the board is capable of Signed-off-by: Bryan Brattlof Link: https://lore.kernel.org/r/20250710-65-boot-phases-v2-2-d431deb88783@ti.com Signed-off-by: Vignesh Raghavendra commit 3302e07346fea5709621a71c2cdb93ffbef2108a Author: Bryan Brattlof Date: Thu Jul 10 09:38:59 2025 -0500 arm64: dts: ti: k3-am65: add boot phase tags The 'bootph-all' tag was added to the dt-schema to describe the various nodes used during the different phases of bootup with DT. Add the bootph-all tag to all required nodes for all AM65x platforms. Mark the mailbox and ring accelerators needed to communicate the with various vendor firmware and the power, clock and reset nodes along with the MMR for the chip-id to facilitate detecting the SoC and which silicon version during the early stages of bootup with 'bootph-all' as they are used during all phases of bootup -- Changes in v2: - removed tag from &mcu_udmap{} node Signed-off-by: Bryan Brattlof Link: https://lore.kernel.org/r/20250710-65-boot-phases-v2-1-d431deb88783@ti.com Signed-off-by: Vignesh Raghavendra commit 908d9d56c8264536b9e10d682c08781a54527d7b Author: Michal Wajdeczko Date: Thu Jul 10 10:30:40 2025 +0000 drm/xe/sriov: Mark BMG as SR-IOV capable Enable SR-IOV support for BMG platforms. Note that as other flags from the platform descriptor, it only means it may have that capability: it still depends on runtime checks for the proper support in HW and firmware. Signed-off-by: Michal Wajdeczko Tested-by: Jakub Kolakowski Signed-off-by: Jakub Kolakowski Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250710103040.375610-3-jakub1.kolakowski@intel.com Signed-off-by: Lucas De Marchi commit ab229c2b72c35739e8ffb70af11190ff40f38701 Author: Abhishek Pandit-Subedi Date: Fri Jul 11 00:35:01 2025 +0000 platform/chrome: cros_ec_typec: Add role swap ops Add the pr_set and dr_set typec_operations to registered typec ports. This enables sysfs to control power and data role when the port is capable of doing so. Signed-off-by: Abhishek Pandit-Subedi Co-developed-by: Radu Vele Signed-off-by: Radu Vele Link: https://lore.kernel.org/r/20250711003502.857536-1-raduvele@google.com Signed-off-by: Tzung-Bi Shih commit 75cd37c5f28b85979fd5a65174013010f6b78f27 Author: Johan Korsnes Date: Sun Mar 23 20:11:16 2025 +0100 arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX This option was removed from the Kconfig in commit 8c710f75256b ("net/sched: Retire tcindex classifier") but it was not removed from the defconfigs. Fixes: 8c710f75256b ("net/sched: Retire tcindex classifier") Signed-off-by: Johan Korsnes Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250323191116.113482-1-johan.korsnes@gmail.com commit e82fff08327e295b825e38af8dd3197cbc87f7a8 Author: Ankit Chauhan Date: Fri Jun 20 08:17:05 2025 +0530 misc: ocxl: Replace scnprintf() with sysfs_emit() in sysfs show functions Replace scnprintf() with sysfs_emit() in sysfs show functions. These helpers are preferred in sysfs callbacks because they automatically handle buffer size and improve safety and readability. Signed-off-by: Ankit Chauhan Acked-by: Andrew Donnellan Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250620024705.11321-1-ankitchauhan2065@gmail.com commit b6f3801727e47a0ec45ea86fa17ca727f1d4940b Author: Jinliang Zheng Date: Tue Apr 29 19:17:22 2025 +0800 ext4: remove duplicate check for EXT4_FC_REPLAY EXT4_FC_REPLAY will be checked in ext4_es_lookup_extent(). If it is set, ext4_es_lookup_extent() will return 0. Remove the repeated check for EXT4_FC_REPLAY in ext4_map_blocks() to simplify the code. Signed-off-by: Jinliang Zheng Reviewed-by: Zhang Yi Link: https://patch.msgid.link/20250429111722.294975-1-alexjlzheng@tencent.com Signed-off-by: Theodore Ts'o commit 0f26870a989bf69957ed69d10c7ffc57ca5a7f52 Merge: 0106424ae408e1 8df1b40de76979 Author: Jakub Kicinski Date: Thu Jul 10 18:18:40 2025 -0700 Merge tag 'nf-next-25-07-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next (v2) The following series contains an initial small batch of Netfilter updates for net-next: 1) Remove DCCP conntrack support, keep DCCP matches around in order to avoid breakage when loading ruleset, add Kconfig to wrap the code so it can be disabled by distributors. 2) Remove buggy code aiming at shrinking netlink deletion event, then re-add it correctly in another patch. This is to prevent -stable to pick up on a fix that breaks old userspace. From Phil Sutter. 3) Missing WARN_ON_ONCE() to check for lockdep_commit_lock_is_held() to uncover bugs. From Fedor Pchelkin. * tag 'nf-next-25-07-10' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: nf_tables: adjust lockdep assertions handling netfilter: nf_tables: Reintroduce shortened deletion notifications netfilter: nf_tables: Drop dead code from fill_*_info routines netfilter: conntrack: remove DCCP protocol support ==================== Link: https://patch.msgid.link/20250710010706.2861281-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski commit 0106424ae408e1ddc32bfc4f5f9f3d009ee7343f Merge: 380a8891fdcb4e af350ee72e9dda Author: Jakub Kicinski Date: Thu Jul 10 18:13:52 2025 -0700 Merge branch 'net-ftgmac100-add-soc-reset-support-for-rmii-mode' Jacky Chou says: ==================== net: ftgmac100: Add SoC reset support for RMII mode This patch series adds support for an optional reset line to the ftgmac100 ethernet controller, as used on Aspeed SoCs. On these SoCs, the internal MAC reset is not sufficient to reset the RMII interface. By providing a SoC-level reset via the device tree "resets" property, the driver can properly reset both the MAC and RMII logic, ensuring correct operation in RMII mode. The series includes: - Device tree binding update to document the new "resets" property. - Addition of MAC1/2/3/4 reset definitions for AST2600. - Driver changes to assert/deassert the reset line as needed. This improves reliability and initialization of the MAC in RMII mode on Aspeed platforms. ==================== Link: https://patch.msgid.link/20250709070809.2560688-1-jacky_chou@aspeedtech.com Signed-off-by: Jakub Kicinski commit af350ee72e9dda474af4697ff59601cb73387b31 Author: Jacky Chou Date: Wed Jul 9 15:08:09 2025 +0800 net: ftgmac100: Add optional reset control for RMII mode on Aspeed SoCs On Aspeed SoCs, the internal MAC reset is insufficient to fully reset the RMII interface; only the SoC-level reset line can properly reset the RMII logic. This patch adds support for an optional "resets" property in the device tree, allowing the driver to assert and deassert the SoC reset line when operating in RMII mode. This ensures the MAC and RMII interface are correctly reset and initialized. Signed-off-by: Jacky Chou Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250709070809.2560688-5-jacky_chou@aspeedtech.com Signed-off-by: Jakub Kicinski commit 4dc5f7b2c0ccf233d16c5f3090208d70954f1e2a Author: Jacky Chou Date: Wed Jul 9 15:08:07 2025 +0800 dt-bindings: clock: ast2600: Add reset definitions for MAC1 and MAC2 Add ASPEED_RESET_MAC1 and ASPEED_RESET_MAC2 reset definitions to the ast2600-clock binding header. These are required for proper reset control of the MAC1 and MAC2 ethernet controllers on the AST2600 SoC. Signed-off-by: Jacky Chou Acked-by: Conor Dooley Acked-by: Stephen Boyd Link: https://patch.msgid.link/20250709070809.2560688-3-jacky_chou@aspeedtech.com Signed-off-by: Jakub Kicinski commit fc6c8af6d784961b7f19bf0870baa1cdab5f7ad5 Author: Jacky Chou Date: Wed Jul 9 15:08:06 2025 +0800 dt-bindings: net: ftgmac100: Add resets property In Aspeed AST2600 design, the MAC internal delay on MAC register cannot fully reset the RMII interfaces, it may cause the RMII incompletely. Therefore, we need to add resets property to do SoC-level reset line to reset the whole MAC function that includes ftgmac, RGMII and RMII. Signed-off-by: Jacky Chou Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250709070809.2560688-2-jacky_chou@aspeedtech.com Signed-off-by: Jakub Kicinski commit 380a8891fdcb4e81bc30074c497e6892a827eb2a Author: Shradha Gupta Date: Wed Jul 9 06:43:00 2025 -0700 net: mana: fix spelling for mana_gd_deregiser_irq() Fix the typo in function name mana_gd_deregiser_irq() Signed-off-by: Shradha Gupta Reviewed-by: Simon Horman Link: https://patch.msgid.link/1752068580-27215-1-git-send-email-shradhagupta@linux.microsoft.com Signed-off-by: Jakub Kicinski commit d12b3dc106090b358fb67b7c0c717a0884327ddf Author: Arnd Bergmann Date: Wed Jul 9 17:32:04 2025 +0200 net: pse-pd: pd692x0: reduce stack usage in pd692x0_setup_pi_matrix The pd692x0_manager array in this function is really too big to fit on the stack, though this never triggered a warning until a recent patch made it slightly bigger: drivers/net/pse-pd/pd692x0.c: In function 'pd692x0_setup_pi_matrix': drivers/net/pse-pd/pd692x0.c:1210:1: error: the frame size of 1584 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] Change the function to dynamically allocate the array here. Fixes: 359754013e6a ("net: pse-pd: pd692x0: Add support for PSE PI priority feature") Signed-off-by: Arnd Bergmann Reviewed-by: Kory Maincent Link: https://patch.msgid.link/20250709153210.1920125-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit acd7c710f76a9cbb06d1ea6e9889df1781469d6d Merge: 809f683324df70 0c8754b75e6916 Author: Jakub Kicinski Date: Thu Jul 10 17:57:53 2025 -0700 Merge branch 'ethtool-rss-report-which-fields-are-configured-for-hashing' Jakub Kicinski says: ==================== ethtool: rss: report which fields are configured for hashing Add support for reading flow hash configuration via Netlink ethtool. $ ynl --family ethtool --dump rss-get [{ "header": { "dev-index": 1, "dev-name": "enp1s0" }, "hfunc": 1, "hkey": b"...", "indir": [0, 1, ...], "flow-hash": { "ether": {"l2da"}, "ah-esp4": {"ip-src", "ip-dst"}, "ah-esp6": {"ip-src", "ip-dst"}, "ah4": {"ip-src", "ip-dst"}, "ah6": {"ip-src", "ip-dst"}, "esp4": {"ip-src", "ip-dst"}, "esp6": {"ip-src", "ip-dst"}, "ip4": {"ip-src", "ip-dst"}, "ip6": {"ip-src", "ip-dst"}, "sctp4": {"ip-src", "ip-dst"}, "sctp6": {"ip-src", "ip-dst"}, "udp4": {"ip-src", "ip-dst"}, "udp6": {"ip-src", "ip-dst"} "tcp4": {"l4-b-0-1", "l4-b-2-3", "ip-src", "ip-dst"}, "tcp6": {"l4-b-0-1", "l4-b-2-3", "ip-src", "ip-dst"}, }, }] ==================== Link: https://patch.msgid.link/20250708220640.2738464-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 0c8754b75e69160ae4bf5436c01447b2e77e181c Author: Jakub Kicinski Date: Tue Jul 8 15:06:40 2025 -0700 selftests: drv-net: test RSS header field configuration Test reading RXFH fields over IOCTL and netlink. # ./tools/testing/selftests/drivers/net/hw/rss_api.py TAP version 13 1..3 ok 1 rss_api.test_rxfh_indir_ntf ok 2 rss_api.test_rxfh_indir_ctx_ntf ok 3 rss_api.test_rxfh_fields # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 Link: https://patch.msgid.link/20250708220640.2738464-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 178331743ca860561f60d04a7797a2fce13f0784 Author: Jakub Kicinski Date: Tue Jul 8 15:06:39 2025 -0700 ethtool: rss: report which fields are configured for hashing Implement ETHTOOL_GRXFH over Netlink. The number of flow types is reasonable (around 20) so report all of them at once for simplicity. Do not maintain the flow ID mapping with ioctl at the uAPI level. This gives us a chance to clean up the confusion that come from RxNFC vs RxFH (flow direction vs hashing) in the ioctl. Try to align with the names used in ethtool CLI, they seem to have stood the test of time just fine. One annoyance is that we still call L4 ports the weird names, but I guess they also apply to IPSec (where they cover the SPI) so it is what it is. $ ynl --family ethtool --dump rss-get { "header": { "dev-index": 1, "dev-name": "enp1s0" }, "hfunc": 1, "hkey": b"...", "indir": [0, 1, ...], "flow-hash": { "ether": {"l2da"}, "ah-esp4": {"ip-src", "ip-dst"}, "ah-esp6": {"ip-src", "ip-dst"}, "ah4": {"ip-src", "ip-dst"}, "ah6": {"ip-src", "ip-dst"}, "esp4": {"ip-src", "ip-dst"}, "esp6": {"ip-src", "ip-dst"}, "ip4": {"ip-src", "ip-dst"}, "ip6": {"ip-src", "ip-dst"}, "sctp4": {"ip-src", "ip-dst"}, "sctp6": {"ip-src", "ip-dst"}, "udp4": {"ip-src", "ip-dst"}, "udp6": {"ip-src", "ip-dst"} "tcp4": {"l4-b-0-1", "l4-b-2-3", "ip-src", "ip-dst"}, "tcp6": {"l4-b-0-1", "l4-b-2-3", "ip-src", "ip-dst"}, }, } Link: https://patch.msgid.link/20250708220640.2738464-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d7974697de4d6fa1a1ed9ca43616a8500046f25a Author: Jakub Kicinski Date: Tue Jul 8 15:06:38 2025 -0700 ethtool: mark ETHER_FLOW as usable for Rx hash Looks like some drivers (ena, enetc, fbnic.. there's probably more) consider ETHER_FLOW to be legitimate target for flow hashing. I'm not sure how intentional that is from the uAPI perspective vs just an effect of ethtool IOCTL doing minimal input validation. But Netlink will do strict validation, so we need to decide whether we allow this use case or not. I don't see a strong reason against it, and rejecting it would potentially regress a number of drivers. So update the comments and flow_type_hashable(). Link: https://patch.msgid.link/20250708220640.2738464-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f7c595c9d9f4cce9ec335f0d3c5d875bb547f9d5 Author: Jakub Kicinski Date: Tue Jul 8 15:06:37 2025 -0700 tools: ynl: decode enums in auto-ints Use enum decoding on auto-ints. Looks like we only had enum auto-ints for input values until now. Upcoming RSS work will need this to declare an attribute with flags as a uint. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250708220640.2738464-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 400244eaa2c99da01a48f6323045f84411afce83 Author: Jakub Kicinski Date: Tue Jul 8 15:06:36 2025 -0700 ethtool: rss: make sure dump takes the rss lock After commit 040cef30b5e6 ("net: ethtool: move get_rxfh callback under the rss_lock") we're expected to take rss_lock around get. Switch dump to using the new prep helper and move the locking into it. Link: https://patch.msgid.link/20250708220640.2738464-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 809f683324df708a0f048d484f74d18a6398a30e Merge: 96698d1898bc79 6b04716cdcac37 Author: Jakub Kicinski Date: Thu Jul 10 17:24:21 2025 -0700 Merge tag 'wireless-next-2025-07-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== Quite a bit more work, notably: - mt76: firmware recovery improvements, MLO work - iwlwifi: use embedded PNVM in (to be released) FW images to fix compatibility issues - cfg80211/mac80211: extended regulatory info support (6 GHz) - cfg80211: use "faux device" for regulatory * tag 'wireless-next-2025-07-10' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (48 commits) wifi: mac80211: don't complete management TX on SAE commit wifi: cfg80211/mac80211: implement dot11ExtendedRegInfoSupport wifi: mac80211: send extended MLD capa/ops if AP has it wifi: mac80211: copy first_part into HW scan wifi: cfg80211: add a flag for the first part of a scan wifi: mac80211: remove DISALLOW_PUNCTURING_5GHZ code wifi: cfg80211: only verify part of Extended MLD Capabilities wifi: nl80211: make nl80211_check_scan_flags() type safe wifi: cfg80211: hide scan internals wifi: mac80211: fix deactivated link CSA wifi: mac80211: add mandatory bitrate support for 6 GHz wifi: mac80211: remove spurious blank line wifi: mac80211: verify state before connection wifi: mac80211: avoid weird state in error path wifi: iwlwifi: mvm: remove support for iwl_wowlan_info_notif_v4 wifi: iwlwifi: bump minimum API version in BZ wifi: iwlwifi: mvm: remove unneeded argument wifi: iwlwifi: mvm: remove MLO GTK rekey code wifi: iwlwifi: pcie: rename iwl_pci_gen1_2_probe() argument wifi: iwlwifi: match discrete/integrated to fix some names ... ==================== Link: https://patch.msgid.link/20250710123113.24878-3-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 77fa16c8f8ee2736f9fe49d5244bec5c35ea3c5b Author: Matt Atwood Date: Wed Jul 9 15:16:05 2025 -0700 drm/xe: extend Wa_15015404425 to apply to PTL Wa_15015404425 only needs to be applied on PTL platforms with an A step compute die. There is no way to map PCI revid to the compute die stepping. The easiest way to figure out compute die stepping our end is to map the media IP's stepping to the compute die. For PTL, compute die has an A stepping if and only if the media IP's stepping is also A-step (This relationship is determined on a per platform basis and just happens to be this way on PTL). In addition this workaround is a chicken-and-egg problem. Wa_15015404425 requires that all register reads be preceded by four dummy MMIO writes (including during early driver init and even pre-OS firmware). The driver needs to perform some MMIO reads during init which include the GMD_ID register that contains the Media IPs stepping. To handle this in the safest manner assume the workaround applies to all of PTL during driver probe and deactivate the workaround after. The overall solution becomes a set of two workarounds: * 15015404425 - a Device OOB workaround that's always active for PTL * 15015404425_disable - a GT OOB workaround that applies to PTL platfroms with a B0 or later stepping The first of these workarounds issues dummy MMIO writes we do when reading registers. The second guards logic that disables the first once we have the necessary information later in the probe process. v2: rename SoC to device, avoid null pointer dereference, update commit message. v3: rebase v5: move disable check into xe_device_probe to avoid linking in xe_wa into xe_pci, reword commit message v6: squash extension and b0 support into 1 patch Reviewed-by: Lucas De Marchi Signed-off-by: Matt Atwood Link: https://lore.kernel.org/r/20250709221605.172516-7-matthew.s.atwood@intel.com Signed-off-by: Lucas De Marchi commit ac596dee8008885664274efcebf8ca7538fc2ddc Author: Matt Atwood Date: Wed Jul 9 15:16:04 2025 -0700 drm/xe: Move Wa_15015404425 to use the new XE_DEVICE_WA macro Move Wa_15015404425 to use the new implemented OOB macro XE_DEVICE_WA() v2: rename from SoC to Device v5: move workaround call back into the flush call v6: remove redundant commenting Reviewed-by: Lucas De Marchi Signed-off-by: Matt Atwood Link: https://lore.kernel.org/r/20250709221605.172516-6-matthew.s.atwood@intel.com Signed-off-by: Lucas De Marchi commit 661a6950e061e3cc976597273180e19126b32e19 Author: Matt Atwood Date: Wed Jul 9 15:16:03 2025 -0700 drm/xe: Add infrastructure for Device OOB workarounds Some workarounds need to be able to be applied ahead of any GT initialization for example 15015404425. This patch creates XE_DEVICE_WA macro, in the same vein as XE_WA. This macro can be used ahead of GT initialization, and can be tracked in sysfs. This should alleviate some of the complexities that exist in i915. v2: name change SoC to Device, address style issues v5: split into separate patch from RTP changes, put oob within a struct, move the initiation of oob workarounds into xe_device_probe_early(), clean up the comments around XE_WA. Reviewed-by: Lucas De Marchi Signed-off-by: Matt Atwood Link: https://lore.kernel.org/r/20250709221605.172516-5-matthew.s.atwood@intel.com Signed-off-by: Lucas De Marchi commit e7201d98ca196b72901686d47003a4bde3865364 Author: Matt Atwood Date: Wed Jul 9 15:16:02 2025 -0700 drm/xe: add new type to RTP context Prepare the RTP context to be used before GT init. Add the xe device as a type, put WARN_ONs to protect existing RTP_MATCHes. v5: split out into separate patch, change definition order v6: catch missing cases for checking gt init Reviewed-by: Lucas De Marchi Signed-off-by: Matt Atwood Link: https://lore.kernel.org/r/20250709221605.172516-4-matthew.s.atwood@intel.com Signed-off-by: Lucas De Marchi commit f037e0b78e6da6c0f0243b57bb433929a37e6a8f Author: Matt Atwood Date: Wed Jul 9 15:16:01 2025 -0700 drm/xe: add xe_device_wa infrastructure There are some workarounds that must be appplied before gt init, wa_15015404425 for example. Instead of sprinking them conditionally throughout the driver as we did for i915 generate an oob.rules file reusing the RTP infrastructure to make these easier to track. v2: rename xe_soc_wa to xe_device_wa v5: derive prefix from argument rather than hard coding the values. v6: split out xe_gen-wa_oob changes Signed-off-by: Matt Atwood Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250709221605.172516-3-matthew.s.atwood@intel.com Signed-off-by: Lucas De Marchi commit b0a2ee5567ab0d83ff1f7f7542fead46233f0d04 Author: Matt Atwood Date: Wed Jul 9 15:16:00 2025 -0700 drm/xe: prepare xe_gen_wa_oob to be multi-use There is a need for additional oob rules files. Make the current gen file more robust to support more files. Signed-off-by: Matt Atwood Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250709221605.172516-2-matthew.s.atwood@intel.com Signed-off-by: Lucas De Marchi commit 96698d1898bc79c783990ac7d5458b7c8f8e0b69 Author: Wang Liang Date: Tue Jul 8 11:33:42 2025 +0800 net: replace ND_PRINTK with dynamic debug ND_PRINTK with val > 1 only works when the ND_DEBUG was set in compilation phase. Replace it with dynamic debug. Convert ND_PRINTK with val <= 1 to net_{err,warn}_ratelimited, and convert the rest to net_dbg_ratelimited. Suggested-by: Ido Schimmel Signed-off-by: Wang Liang Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20250708033342.1627636-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit cd258940b33e03c522aabb6e1fdc6da76632e7b2 Merge: a6f1220489c9b8 d40c1ddd9b4d4b Author: Jakub Kicinski Date: Thu Jul 10 15:26:57 2025 -0700 Merge branch 'riscv-sophgo-add-ethernet-support-for-sg2042' Inochi Amaoto says: ==================== riscv: sophgo: Add ethernet support for SG2042 The ethernet controller of SG2042 is Synopsys DesignWare IP with tx clock. Add device id for it. This patch can only be tested on a SG2042 evb board, as pioneer does not expose this device. The user dts patch link: https://lore.kernel.org/linux-riscv/cover.1751700954.git.rabenda.cn@gmail.com ==================== Link: https://patch.msgid.link/20250708064052.507094-1-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit d40c1ddd9b4d4b3a3cc6f526a922a027d092f174 Author: Inochi Amaoto Date: Tue Jul 8 14:40:51 2025 +0800 net: stmmac: platform: Add snps,dwmac-5.00a IP compatible string Add "snps,dwmac-5.30a" compatible string for 5.00a version that can avoid to define some platform data in the glue layer. Signed-off-by: Inochi Amaoto Tested-by: Han Gao Link: https://patch.msgid.link/20250708064052.507094-4-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 543009e2d4cd57366604280e83d3e7bdd2ab512a Author: Inochi Amaoto Date: Tue Jul 8 14:40:50 2025 +0800 net: stmmac: dwmac-sophgo: Add support for Sophgo SG2042 SoC Adds device id of the ethernet controller on the Sophgo SG2042 SoC. Signed-off-by: Inochi Amaoto Tested-by: Han Gao Link: https://patch.msgid.link/20250708064052.507094-3-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit e281c48a7336e2f6dd4cd30e1cee4c0592af6c62 Author: Inochi Amaoto Date: Tue Jul 8 14:40:49 2025 +0800 dt-bindings: net: sophgo,sg2044-dwmac: Add support for Sophgo SG2042 dwmac The GMAC IP on SG2042 is a standard Synopsys DesignWare MAC (version 5.00a) with tx clock. Add necessary compatible string for this device. Signed-off-by: Inochi Amaoto Tested-by: Han Gao Acked-by: Conor Dooley Link: https://patch.msgid.link/20250708064052.507094-2-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit a6f1220489c9b8ae8292323269b6aef701760e9a Merge: b430f6c38da629 66a44adf4c3db0 Author: Jakub Kicinski Date: Thu Jul 10 15:02:23 2025 -0700 Merge branch 'further-mt7988-devicetree-work' Frank Wunderlich says: ==================== further mt7988 devicetree work This series continues mt7988 devicetree work - Extend cpu frequency scaling with CCI - GPIO leds - Basic network-support (ethernet controller + builtin switch + SFP Cages) depencies (i hope this list is complete and latest patches/series linked): support interrupt-names is optional again as i re-added the reserved IRQs (they are not unusable as i thought and can allow features in future) https://patchwork.kernel.org/project/netdevbpf/patch/20250619132125.78368-2-linux@fw-web.de/ needs change in mtk ethernet driver for the sram to be read from separate node: https://patchwork.kernel.org/project/netdevbpf/patch/c2b9242229d06af4e468204bcf42daa1535c3a72.1751461762.git.daniel@makrotopia.org/ for SFP-Function (macs currently disabled): PCS clearance which is a 1.5 year discussion currently ongoing Daniel asked netdev for a way 2 go: https://lore.kernel.org/netdev/aEwfME3dYisQtdCj@pidgin.makrotopia.org/ e.g. something like this (one of): * https://patchwork.kernel.org/project/netdevbpf/patch/20250610233134.3588011-4-sean.anderson@linux.dev/ (v6) * https://patchwork.kernel.org/project/netdevbpf/patch/20250511201250.3789083-4-ansuelsmth@gmail.com/ (v4) * https://patchwork.kernel.org/project/netdevbpf/patch/ba4e359584a6b3bc4b3470822c42186d5b0856f9.1721910728.git.daniel@makrotopia.org/ full usxgmii driver: https://patchwork.kernel.org/project/netdevbpf/patch/07845ec900ba41ff992875dce12c622277592c32.1702352117.git.daniel@makrotopia.org/ first PCS-discussion is here: https://patchwork.kernel.org/project/netdevbpf/patch/8aa905080bdb6760875d62cb3b2b41258837f80e.1702352117.git.daniel@makrotopia.org/ some more here: https://lore.kernel.org/netdev/20250511201250.3789083-4-ansuelsmth@gmail.com/ and then dts nodes for sgmiisys+usxgmii+2g5 firmware when above depencies are solved the mac1/2 can be enabled and 2.5G phy/SFP slots will work. ==================== Link: https://patch.msgid.link/20250709111147.11843-1-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 66a44adf4c3db082cfccd82679004346a66d1ea8 Author: Frank Wunderlich Date: Wed Jul 9 13:09:42 2025 +0200 dt-bindings: net: dsa: mediatek,mt7530: add internal mdio bus Mt7988 buildin switch has own mdio bus where ge-phys are connected. Add related property for this. Signed-off-by: Frank Wunderlich Reviewed-by: Rob Herring (Arm) Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250709111147.11843-7-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 588cb646ce709770d31f8dc0d2f63e8f86763a9d Author: Frank Wunderlich Date: Wed Jul 9 13:09:41 2025 +0200 dt-bindings: net: dsa: mediatek,mt7530: add dsa-port definition for mt7988 Add own dsa-port binding for SoC with internal switch where only phy-mode 'internal' is valid. Signed-off-by: Frank Wunderlich Reviewed-by: Rob Herring (Arm) Reviewed-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250709111147.11843-6-linux@fw-web.de Signed-off-by: Jakub Kicinski commit c4582a31efd92ea74ecf75c727443a167dfe0577 Author: Frank Wunderlich Date: Wed Jul 9 13:09:40 2025 +0200 dt-bindings: net: mediatek,net: add sram property Meditak Filogic SoCs (MT798x) have dedicated MMIO-SRAM for dma operations. MT7981 and MT7986 currently use static offset to ethernet MAC register which will be changed in separate patch once this way is accepted. Add "sram" property to map ethernet controller to dedicated mmio-sram node. Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250709111147.11843-5-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 23ac2a71bdbd5d12616d46f276b7a7a06e74a8c3 Author: Frank Wunderlich Date: Wed Jul 9 13:09:39 2025 +0200 dt-bindings: net: mediatek,net: allow irq names In preparation for MT7988 and RSS/LRO allow the interrupt-names property. In this way driver can request the interrupts by name which is much more readable in the driver code and SoC's dtsi than relying on a specific order. Frame-engine-IRQs (fe0..3): MT7621, MT7628: 1 FE-IRQ MT7622, MT7623: 3 FE-IRQs (only two used by the driver for now) MT7981, MT7986: 4 FE-IRQs (only two used by the driver for now) RSS/LRO IRQs (pdma0..3) additional only on Filogic (MT798x) with count of 4. So all IRQ-names (8) for Filogic. Set boundaries for all compatibles same as irq count. Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250709111147.11843-4-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 356dea0baf4c0903ac188bf18e8ff1af0866c930 Author: Frank Wunderlich Date: Wed Jul 9 13:09:38 2025 +0200 dt-bindings: net: mediatek,net: allow up to 8 IRQs Increase the maximum IRQ count to 8 (4 FE + 4 RSS/LRO). Frame-engine-IRQs (max 4): MT7621, MT7628: 1 FE-IRQ MT7622, MT7623: 3 FE-IRQs (only two used by the driver for now) MT7981, MT7986, MT7988: 4 FE-IRQs (only two used by the driver for now) Mediatek Filogic SoCs (mt798x) have 4 additional IRQs for RSS and/or LRO. So MT798x have 8 IRQs in total. MT7981 does not have a ethernet-node yet. MT7986 Ethernet node is updated with RSS/LRO IRQs in this series. MT7988 Ethernet node is added in this series. Signed-off-by: Frank Wunderlich Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250709111147.11843-3-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 29712b437339bf9ae36affa6b922340b059cd153 Author: Frank Wunderlich Date: Wed Jul 9 13:09:37 2025 +0200 dt-bindings: net: mediatek,net: update mac subnode pattern for mt7988 MT7888 have 3 Macs and so its nodes have names from mac0 - mac2. Update pattern to fix this. Signed-off-by: Frank Wunderlich Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250709111147.11843-2-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 5d8b97c946777118930e1cfb075cab59a139ca7c Author: Nicolas Bouchinet Date: Tue Jun 24 16:48:51 2025 +0200 MAINTAINERS: Add Xiu and myself as Lockdown maintainers The Lockdown LSM has been unmaintained for some time now. It requires some work to ensure it works as intended. Xiu Jianfeng and I volunteer to maintain the LSM. Signed-off-by: Nicolas Bouchinet Acked-by: Xiu Jianfeng Signed-off-by: Paul Moore commit 667efb341917bde19f5d7517b65defcdaed67c9e Author: André Almeida Date: Fri Jul 4 00:06:29 2025 -0300 drm/amdgpu: Fix lifetime of struct amdgpu_task_info after ring reset When a ring reset happens, amdgpu calls drm_dev_wedged_event() using struct amdgpu_task_info *ti as one of the arguments. After using *ti, a call to amdgpu_vm_put_task_info(ti) is required to correctly track its lifetime. However, it's called from a place that the ring reset path never reaches due to a goto after drm_dev_wedged_event() is called. Move amdgpu_vm_put_task_info() bellow the exit label to make sure that it's called regardless of the code path. amdgpu_vm_put_task_info() can only accept a valid address or NULL as argument, so initialise *ti to make sure we can call this function if *ti isn't used. Fixes: a72002cb181f ("drm/amdgpu: Make use of drm_wedge_task_info") Reported-by: Dave Airlie Closes: https://lore.kernel.org/dri-devel/CAPM=9tz0rQP8VZWKWyuF8kUMqRScxqoa6aVdwWw9=5yYxyYQ2Q@mail.gmail.com/ Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250704030629.1064397-1-andrealmeid@igalia.com Signed-off-by: André Almeida commit 2d925db5b2c6e0c70166de928f34cebf6844b8fd Author: Jacob Keller Date: Wed Jun 18 15:24:43 2025 -0700 ice: introduce ice_get_vf_by_dev() wrapper The ice_get_vf_by_id() function is used to obtain a reference to a VF structure based on its ID. The ice_sriov_set_msix_vec_count() function needs to get a VF reference starting from the VF PCI device, and uses pci_iov_vf_id() to get the VF ID. This pattern is currently uncommon in the ice driver. However, the live migration module will introduce many more such locations. Add a helper wrapper ice_get_vf_by_dev() which takes the VF PCI device and calls ice_get_vf_by_id() using pci_iov_vf_id() to get the VF ID. Signed-off-by: Jacob Keller Reviewed-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 922683498e847ef8b2db14afb2c52b7184dde466 Author: Jacob Keller Date: Wed Jun 18 15:24:42 2025 -0700 ice: avoid rebuilding if MSI-X vector count is unchanged Commit 05c16687e0cc ("ice: set MSI-X vector count on VF") added support to change the vector count for VFs as part of ice_sriov_set_msix_vec_count(). This function modifies and rebuilds the target VF with the requested number of MSI-X vectors. Future support for live migration will add a call to ice_sriov_set_msix_vec_count() to ensure that a migrated VF has the proper MSI-X vector count. In most cases, this request will be to set the MSI-X vector count to its current value. In that case, no work is necessary. Rather than requiring the caller to check this, update the function to check and exit early if the vector count is already at the requested value. This avoids an unnecessary VF rebuild. Signed-off-by: Jacob Keller Reviewed-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 4ef21c83ea4bb33aa12f2e927bbaabbd1bdd2ae9 Author: Jacob Keller Date: Wed Jun 18 15:24:41 2025 -0700 ice: use pci_iov_vf_id() to get VF ID The ice_sriov_set_msix_vec_count() obtains the VF device ID in a strange way by iterating over the possible VF IDs and calling pci_iov_virtfn_devfn to calculate the device and function combos and compare them to the pdev->devfn. This is unnecessary. The pci_iov_vf_id() helper already exists which does the reverse calculation of pci_iov_virtfn_devfn(), which is much simpler and avoids the loop construction. Use this instead. Signed-off-by: Jacob Keller Reviewed-by: Przemek Kitszel Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 066c2715ada8f839fa4c272fcf87ee11d36f20d4 Author: Jacob Keller Date: Wed Jun 18 15:24:40 2025 -0700 ice: expose VF functions used by live migration The live migration process will require configuring the target VF with the data provided from the source host. A few helper functions in ice_sriov.c and ice_virtchnl.c will be needed for this process, but are currently static. Expose these functions in their respective headers so that the live migration module can use them during the migration process. Signed-off-by: Jacob Keller Reviewed-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 4f98ac2d8e53c414ef79d7ea1fd0201e45d76779 Author: Jacob Keller Date: Wed Jun 18 15:24:39 2025 -0700 ice: move ice_vsi_update_l2tsel to ice_lib.c A future change is going to need to call ice_vsi_update_l2tsel from a new context outside of ice_virtchnl.c Since this function deals with a generic VSI, move it into ice_lib.c to enable calling it from other places in the ice driver. Signed-off-by: Jacob Keller Reviewed-by: Madhu Chittim Reviewed-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 5ff8d956235725b1fa455375dcdad33046c3e3be Author: Jacob Keller Date: Wed Jun 18 15:24:38 2025 -0700 ice: save RSS hash configuration for migration The VF can program the RSS hash configuration over virtchnl. It does this by sending a u64 bitmask which represents the current hash configuration. It is not trivial to reverse the hardware configuration back to this hash set for migration. Instead, save the value to the ice_vf structure when its modified by the VF. The rss_hashcfg value is an 8-byte field. Make room for it in ice_vf by re-arranging some of the existing fields. There is a 4-byte gap after the first_vector_idx, and a 4-byte gap between max_tx_rate and vf_states. Move first_vector_idx into the later 4-byte gap, creating an 8 byte area where rss_hashcfg can be placed. Also move the num_msix field near min_tx_rate, filling 2 bytes of a 3 byte hole. The end result of these changes enables placing the rss_hashcfg field into the structure while also saving 8 bytes in size. It looks like there are a handful of more possible cleanups to reduce the size even further, but those have been left as a future cleanup. Signed-off-by: Jacob Keller Reviewed-by: Przemek Kitszel Reviewed-by: Madhu Chittim Signed-off-by: Tony Nguyen commit b6f82e9b79b1b0d6eb8861502c6069b7cdff03f9 Author: Jacob Keller Date: Wed Jun 18 15:24:37 2025 -0700 ice: add functions to get and set Tx queue context The live migration driver will need to save and restore the Tx queue context state from the hardware registers. This state contains both static fields which do not change during Tx traffic as well as dynamic fields which may change during Tx traffic. Unlike the Rx context, the Tx queue context is accessed indirectly from GLCOMM_QTX_CNTX_CTL and GLCOMM_QTX_CNTX_DATA registers. These registers are shared by multiple PFs on the same PCIe card. Multiple PFs cannot safely access the registers simultaneously, and there is no hardware semaphore or logic to control access. To handle this, introduce the txq_ctx_lock to the ice_adapter structure. This is similar to the ptp_gltsyn_time_lock. All PFs on the same adapter share this structure, and use it to serialize access to the registers to prevent error. Add a new functions to get and set the Tx queue context through the GLCOMM_QTX_CNTX_CTL interface. The hardware context values are stored in the registers using the same packed format as the Admin Queue buffer. The hardware buffer is 40 bytes wide, as it contains an additional 18 bytes of internal state not sent with the Admin Queue buffer. For this reason, a separate typedef and packing function must be used. We can share the same packed fields definitions because we never need to unpack the internal state. This is preferred, as it ensures the internal state is zero'd when writing into HW, and avoids issues with reading by u32 registers into a buffer of 22 bytes in length. Thanks to the typedefs, misuse of the API with the wrong size buffer can easily be caught at compile time. Note reading this data from hardware is essential because the current Tx queue context may be different from the context as initially programmed by the driver during VF initialization. When migrating a VF we must ensure the target VF has identical context as the source VF did. Co-developed-by: Yahui Cao Signed-off-by: Yahui Cao Signed-off-by: Jacob Keller Reviewed-by: Madhu Chittim Reviewed-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit bd3b8e53e244fec2255ab037242230847559161a Author: Thierry Reding Date: Thu Jul 10 01:14:01 2025 +0200 arm64: defconfig: Enable Tegra241 and Tegra264 Enable the configuration options for these newer generations of Tegra so that support for them gets built by default. Link: https://lore.kernel.org/r/20250709231401.3767130-5-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit cf590b239c98ff7772c61a9124dbcb5f250e9395 Author: André Almeida Date: Fri Jul 4 16:07:24 2025 -0300 drm/doc: Fix grammar for "Task information" Remove the repetitive wording at the end of "Task information" section. Reviewed-by: Raag Jadav Acked-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20250704190724.1159416-3-andrealmeid@igalia.com Signed-off-by: André Almeida commit e41315787dda23daf146afb03b844d2c5880b72b Author: André Almeida Date: Fri Jul 4 16:07:23 2025 -0300 drm: Add missing struct drm_wedge_task_info kernel doc Fix the following kernel doc warning: include/drm/drm_device.h:40: warning: Function parameter or struct member 'pid' not described in 'drm_wedge_task_info' include/drm/drm_device.h:40: warning: Function parameter or struct member 'comm' not described in 'drm_wedge_task_info' Fixes: 183bccafa176 ("drm: Create a task info option for wedge events") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/lkml/20250618151307.4a1a5e17@canb.auug.org.au/ Reviewed-by: Raag Jadav Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20250704190724.1159416-2-andrealmeid@igalia.com Signed-off-by: André Almeida commit b59df66c0876891ad406844f238f6b322741e521 Author: André Almeida Date: Fri Jul 4 16:07:22 2025 -0300 drm/doc: Fix title underline for "Task information" Fix the following warning: Documentation/gpu/drm-uapi.rst:450: WARNING: Title underline too short. Task information --------------- [docutils] Fixes: cd37124b4093 ("drm/doc: Add a section about "Task information" for the wedge API") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/lkml/20250618150333.5ded99a0@canb.auug.org.au/ Reviewed-by: Raag Jadav Acked-by: Randy Dunlap Tested-by: Randy Dunlap Tested-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20250704190724.1159416-1-andrealmeid@igalia.com Signed-off-by: André Almeida commit b430f6c38da629381f43b5ee723bd7e325ffa784 Merge: 3321e97eab71df bbca931fce262c Author: Jakub Kicinski Date: Thu Jul 10 13:32:35 2025 -0700 Merge branch 'virtio_udp_tunnel_08_07_2025' of https://github.com/pabeni/linux-devel Paolo Abeni says: ==================== virtio: introduce GSO over UDP tunnel Some virtualized deployments use UDP tunnel pervasively and are impacted negatively by the lack of GSO support for such kind of traffic in the virtual NIC driver. The virtio_net specification recently introduced support for GSO over UDP tunnel, this series updates the virtio implementation to support such a feature. Currently the kernel virtio support limits the feature space to 64, while the virtio specification allows for a larger number of features. Specifically the GSO-over-UDP-tunnel-related virtio features use bits 65-69. The first four patches in this series rework the virtio and vhost feature support to cope with up to 128 bits. The limit is set by a define and could be easily raised in future, as needed. This implementation choice is aimed at keeping the code churn as limited as possible. For the same reason, only the virtio_net driver is reworked to leverage the extended feature space; all other virtio/vhost drivers are unaffected, but could be upgraded to support the extended features space in a later time. The last four patches bring in the actual GSO over UDP tunnel support. As per specification, some additional fields are introduced into the virtio net header to support the new offload. The presence of such fields depends on the negotiated features. New helpers are introduced to convert the UDP-tunneled skb metadata to an extended virtio net header and vice versa. Such helpers are used by the tun and virtio_net driver to cope with the newly supported offloads. Tested with basic stream transfer with all the possible permutations of host kernel/qemu/guest kernel with/without GSO over UDP tunnel support. ==================== Link: https://patch.msgid.link/cover.1751874094.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 07b7c2b4eca3f83ce9cd5ee3fa1c7c001d721c69 Author: Moon Hee Lee Date: Thu Jun 26 12:16:26 2025 -0700 selftests: breakpoints: use suspend_stats to reliably check suspend success The step_after_suspend_test verifies that the system successfully suspended and resumed by setting a timerfd and checking whether the timer fully expired. However, this method is unreliable due to timing races. In practice, the system may take time to enter suspend, during which the timer may expire just before or during the transition. As a result, the remaining time after resume may show non-zero nanoseconds, even if suspend/resume completed successfully. This leads to false test failures. Replace the timer-based check with a read from /sys/power/suspend_stats/success. This counter is incremented only after a full suspend/resume cycle, providing a reliable and race-free indicator. Also remove the unused file descriptor for /sys/power/state, which remained after switching to a system() call to trigger suspend [1]. [1] https://lore.kernel.org/all/20240930224025.2858767-1-yifei.l.liu@oracle.com/ Link: https://lore.kernel.org/r/20250626191626.36794-1-moonhee.lee.ca@gmail.com Fixes: c66be905cda2 ("selftests: breakpoints: use remaining time to check if suspend succeed") Signed-off-by: Moon Hee Lee Signed-off-by: Shuah Khan commit 34db4fba81916a2001d7a503dfcf718c08ed5c42 Author: Sergio González Collado Date: Sun Jul 6 22:18:55 2025 +0200 kunit: fix longest symbol length test The kunit test that checks the longests symbol length [1], has triggered warnings in some pilelines when symbol prefixes are used [2][3]. The test will to depend on !PREFIX_SYMBOLS and !CFI_CLANG as sujested in [4] and on !GCOV_KERNEL. [1] https://lore.kernel.org/rust-for-linux/CABVgOSm=5Q0fM6neBhxSbOUHBgNzmwf2V22vsYC10YRBT=kN1g@mail.gmail.com/T/#t [2] https://lore.kernel.org/all/20250328112156.2614513-1-arnd@kernel.org/T/#u [3] https://lore.kernel.org/rust-for-linux/bbd03b37-c4d9-4a92-9be2-75aaf8c19815@infradead.org/T/#t [4] https://lore.kernel.org/linux-kselftest/20250427200916.GA1661412@ax162/T/#t Link: https://lore.kernel.org/r/20250706201855.232451-1-sergio.collado@gmail.com Reviewed-by: Rae Moar Signed-off-by: Sergio González Collado Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Shuah Khan commit 94de94d24ea8cf567ec7254a723c3192c72c2ca6 Author: Michal Wajdeczko Date: Wed Jul 9 19:40:38 2025 +0200 drm/xe/guc: Cancel ongoing H2G requests when stopping CT Once we have started a GT reset sequence, which includes stopping GuC CTB communication, we should also cancel all ongoing H2G send- recv requests, as either GuC is already dead, or due to imminent reset GuC will not be able to reply, or due to internal cleanup we will lose pending fences. With this we will report dedicated -ECANCELED error instead of misleading -ETIME. Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Reviewed-by: Jonathan Cavitt Acked-by: Matthew Brost Link: https://lore.kernel.org/r/20250709174038.1876-4-michal.wajdeczko@intel.com commit 4ecdcf9caf519fbab1aa01b431339387fed00fb8 Author: Michal Wajdeczko Date: Wed Jul 9 19:40:37 2025 +0200 drm/xe/guc: Move state change logger to helper In the state change helper we are already doing extra stuff, move debug state logger there to cover all state changes. Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Reviewed-by: Jonathan Cavitt Acked-by: Matthew Brost Link: https://lore.kernel.org/r/20250709174038.1876-3-michal.wajdeczko@intel.com commit 1b822b7f564b8e06ac49509baad4468927a9f852 Author: Michal Wajdeczko Date: Wed Jul 9 19:40:36 2025 +0200 drm/xe/guc: Rename CT state change helper In this helper we are already doing much more than just setting a new CT state and its name was little misleading. Rename it. Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Reviewed-by: Jonathan Cavitt Acked-by: Matthew Brost Link: https://lore.kernel.org/r/20250709174038.1876-2-michal.wajdeczko@intel.com commit fa65058063cbaba6e519b5291a7e2e9e0fa24ae3 Author: Eric Biggers Date: Wed Jul 9 23:07:53 2025 -0700 ceph: Remove gfp_t argument from ceph_fscrypt_encrypt_*() This argument is no longer used, so remove it. Reviewed-by: Alex Markuze Link: https://lore.kernel.org/r/20250710060754.637098-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 47462586f91358499897fddb20f6bb9cec5f4213 Author: Eric Biggers Date: Wed Jul 9 23:07:52 2025 -0700 fscrypt: Remove gfp_t argument from fscrypt_encrypt_block_inplace() This argument is no longer used, so remove it. Reviewed-by: Alex Markuze Link: https://lore.kernel.org/r/20250710060754.637098-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a9a95ecd9d3a24402a302595ee12029772a9f593 Author: Eric Biggers Date: Wed Jul 9 23:07:51 2025 -0700 fscrypt: Remove gfp_t argument from fscrypt_crypt_data_unit() This argument is no longer used, so remove it. Link: https://lore.kernel.org/r/20250710060754.637098-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 52e7e0d8893327ea83373c02b597ec809b94db76 Author: Eric Biggers Date: Wed Jul 9 23:07:50 2025 -0700 fscrypt: Switch to sync_skcipher and on-stack requests Now that fscrypt uses only synchronous skciphers, switch to the actual sync_skcipher API and the corresponding on-stack requests. This eliminates a heap allocation per en/decryption operation. Link: https://lore.kernel.org/r/20250710060754.637098-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 53d9218d8d38cd33e065cc46db996608adec6687 Author: Eric Biggers Date: Wed Jul 9 23:07:49 2025 -0700 fscrypt: Drop FORBID_WEAK_KEYS flag for AES-ECB This flag only has an effect for DES, 3DES, and XTS mode. It does nothing for AES-ECB, as there is no concept of weak keys for AES. Link: https://lore.kernel.org/r/20250710060754.637098-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 71ffd1dc5234f522a7647dd30ca8fc9eefe8da1b Author: Eric Biggers Date: Wed Jul 9 23:07:48 2025 -0700 fscrypt: Don't use asynchronous CryptoAPI algorithms Now that fscrypt's incomplete support for non-inline crypto engines has been removed, and none of the CPU-based algorithms have the CRYPTO_ALG_ASYNC flag set anymore, there is no need to accommodate asynchronous algorithms. Therefore, explicitly allocate only synchronous algorithms. Then, remove the code that handled waiting for asynchronous en/decryption operations to complete. This commit should *not* be backported to kernels that lack commit 0ba6ec5b2972 ("crypto: x86/aes - stop using the SIMD helper"), as then it would disable the use of the optimized AES code on x86. Link: https://lore.kernel.org/r/20250710060754.637098-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 0efec0500117947f924e5ac83be40f96378af85a Author: Shuicheng Lin Date: Tue Jul 8 02:14:51 2025 +0000 drm/xe/pm: Correct comment of xe_pm_set_vram_threshold() The parameter threshold is with size in MiB, not in bits. Correct it to avoid any confusion. v2: s/mb/MiB, s/vram/VRAM, fix return section. (Michal) Fixes: 30c399529f4c ("drm/xe: Document Xe PM component") Cc: Michal Wajdeczko Cc: Rodrigo Vivi Signed-off-by: Shuicheng Lin Link: https://lore.kernel.org/r/20250708021450.3602087-2-shuicheng.lin@intel.com Reviewed-by: Stuart Summers Signed-off-by: Rodrigo Vivi commit ef41603d09f124fcebb86bcc4a648ffafbfa120b Author: Jacob Keller Date: Wed Jun 18 15:24:36 2025 -0700 ice: add support for reading and unpacking Rx queue context In order to support live migration, the ice driver will need to read certain data from the Rx queue context. This is stored in the hardware in a packed format. Since we use for the mapping between the packed hardware format and the unpacked structure, it is trivial to enable unpacking support via the unpack_fields() function. Add the ice_unpack_rxq_ctx() function based on the unpack_fields() API. Re-use the same field definitions from the packing implementation. Add ice_copy_rxq_ctx_from_hw() to copy the Rx queue context data from the hardware registers. Use these to implement ice_read_rxq_ctx() which will return the Rx queue context to the caller in its unpacked ice_rlan_ctx struct. This will enable the migration logic access to the relevant data about the Rx device queues. It can easily be copied to the target system as part of the migration payload, where it will be used to configure the Rx queues. Signed-off-by: Jacob Keller Reviewed-by: Madhu Chittim Reviewed-by: Przemek Kitszel Signed-off-by: Tony Nguyen commit 6a8afb9fff6478e7944794f089181e93df1c728a Author: Jens Axboe Date: Mon Jul 7 19:38:45 2025 -0600 io_uring/net: allow multishot receive per-invocation cap If an application is handling multiple receive streams using recv multishot, then the amount of retries and buffer peeking for multishot and bundles can process too much per socket before moving on. This isn't directly controllable by the application. By default, io_uring will retry a recv MULTISHOT_MAX_RETRY (32) times, if the socket keeps having data to receive. And if using bundles, then each bundle peek will potentially map up to PEEK_MAX_IMPORT (256) iovecs of data. Once these limits are hit, then a requeue operation will be done, where the request will get retried after other pending requests have had a time to get executed. Add support for capping the per-invocation receive length, before a requeue condition is considered for each receive. This is done by setting sqe->mshot_len to the byte value. For example, if this is set to 1024, then each receive will be requeued by 1024 bytes received. Link: https://lore.kernel.org/io-uring/20250709203420.1321689-4-axboe@kernel.dk Signed-off-by: Jens Axboe commit 3919b695932dd1990b5c7fd44fc52361f8e2ac5f Author: Jens Axboe Date: Mon Jul 7 16:54:12 2025 -0600 io_uring/net: move io_sr_msg->retry_flags to io_sr_msg->flags There's plenty of space left, as sr->flags is a 16-bit type. The UAPI bits are the lower 8 bits, as that's all that sqe->ioprio can carry in the SQE anyway. Use a few of the upper 8 bits for internal uses, rather than have two separate flags entries. Link: https://lore.kernel.org/io-uring/20250709203420.1321689-2-axboe@kernel.dk Signed-off-by: Jens Axboe commit e227c8cdb47b586ebf20b6b4caca0a30bb7e6b68 Author: Jens Axboe Date: Mon Jul 7 19:36:57 2025 -0600 io_uring/net: use passed in 'len' in io_recv_buf_select() len is a pointer to the desired len, use that rather than grab it from sr->len again. No functional changes as of this patch, but it does prepare io_recv_buf_select() for getting passed in a value that differs from sr->len. Link: https://lore.kernel.org/io-uring/20250709203420.1321689-3-axboe@kernel.dk Signed-off-by: Jens Axboe commit 3321e97eab71df7d632b35276da9f8503e6e040f Merge: e090f978054e1c bc9ff192a6c940 Author: Jakub Kicinski Date: Thu Jul 10 10:08:47 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.16-rc6). No conflicts. Adjacent changes: Documentation/devicetree/bindings/net/allwinner,sun8i-a83t-emac.yaml 0a12c435a1d6 ("dt-bindings: net: sun8i-emac: Add A100 EMAC compatible") b3603c0466a8 ("dt-bindings: net: sun8i-emac: Rename A523 EMAC0 to GMAC0") Signed-off-by: Jakub Kicinski commit 7c2f3ec7707188d8d5269ae2dce97d7be3e9f261 Author: Avraham Stern Date: Wed Jul 9 23:05:43 2025 +0300 wifi: iwlwifi: mvm: fix scan request validation The scan request validation function uses bitwise and instead of logical and. Fix it. Signed-off-by: Avraham Stern Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.3fbc1f27871b.I7a8ee91f463c1a2d9d8561c8232e196885d02c43@changeid commit 65d4df4ebeedfc12277cad1230dff3fe0bc6cde4 Author: Miri Korenblit Date: Wed Jul 9 23:05:42 2025 +0300 wifi: iwlwifi: pcie: add a missing include pcie/utils.h needs to include iwl-io.h for the iwl_read/iwl_write calls. Add it. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.716e8b54ebcb.If75c28a85b5ba4c2661bdf4ce20b97dbe7d2abb2@changeid commit b6b7b33e5acfb942415eb6f5adc4af3b13f1251a Author: Itamar Shalev Date: Wed Jul 9 23:05:41 2025 +0300 wifi: iwlwifi: trans: remove retake_ownership parameter from sw_reset Remove the retake_ownership parameter from the sw_reset function, as it was always set to true and is not needed by other opmodes. Simplify the sw_reset API function. Signed-off-by: Itamar Shalev Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.0a103d021815.I2a3da6f83aa691496a53a548bd73bddd4d4d2db8@changeid commit 617b19600d1c2eb9834c7f372ae55b9b26c1e4c8 Author: Miri Korenblit Date: Wed Jul 9 23:05:40 2025 +0300 wifi: iwlwifi: assign a FW API range for GF GF device is frozen on API 100, so it is not allowed to use FW APIs higher than that. Make sure of that by assigning a MIN and MAX API range for GF. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.3409de06db40.I2110ee6c0a2f5ff1e16156c5875f83d7a1723857@changeid commit db35444d557fe7f481bd649f7c5a75f8103e87f3 Author: Miri Korenblit Date: Wed Jul 9 23:05:39 2025 +0300 wifi: iwlwifi: assign a FW API range for HR HR device is frozen on API 100, so it is not allowed to use FW APIs higher than that. Make sure of that by assigning a MIN and MAX API range for HR. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.ea54c00de44d.I47340ecaefbf40bb0bd254485d242b7f39df85b1@changeid commit 320b2da0288733df03d1771d079b93fac83ed8f2 Author: Johannes Berg Date: Wed Jul 9 23:05:38 2025 +0300 wifi: iwlwifi: pcie: accept new devices for MVM-only configs For newer MACs, the MVM opmode may be used for older firmware images or when the RF isn't EHT/WiFi7 capable. List such devices in the PCI device list when MLD isn't built. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.483c8112f655.Ic05530048fc0b67b1cd8772882a595d56b204e65@changeid commit be27286f91f7c92dd7d54ae257e528cf8a526924 Author: Itamar Shalev Date: Wed Jul 9 23:05:37 2025 +0300 wifi: iwlwifi: pcie: inform me when op mode leaving Transport gen2 didn't inform ME when the op mode is leaving. Signed-off-by: Itamar Shalev Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.abd840f5e998.I3a3fe174ea55a30daa04a0a3e9a6264913677045@changeid commit 48d41b73316c801423ede39ed1eafef7d6eef391 Author: Itamar Shalev Date: Wed Jul 9 23:05:36 2025 +0300 wifi: iwlwifi: simplify iwl_poll_bits_mask return value Update iwl_poll_bits_mask to return 0 on success or an error code. Remove timing information from the return value, as it is unused. Signed-off-by: Itamar Shalev Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.f77b9f484a78.Iae8ef99a94e25c23044e2c36244cda2b55328447@changeid commit adf382eac0b5555fe01f8aeb08f9a6873be02586 Author: Miri Korenblit Date: Wed Jul 9 23:05:35 2025 +0300 wifi: iwlwifi: mvm: remove support for iwl_wowlan_status_v9 FWs with this version are no longer supported on any device. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.22864efb5074.I51f270f8848970fd2ca1078c14ad31f4a8853e7d@changeid commit 762ee87417794b6720b8b55b26c066d0995a7836 Author: Miri Korenblit Date: Wed Jul 9 23:05:34 2025 +0300 wifi: iwlwifi: mvm: remove support for iwl_wowlan_status_v12 FWs with this version are no longer supported on any device. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.1b9177bfbe1d.I53c1527cc5097f05df352b6f2f99282b00a5d7ac@changeid commit 8f30c98440d22ae77a702bda8197f74368dd5ce9 Author: Miri Korenblit Date: Wed Jul 9 23:05:33 2025 +0300 wifi: iwlwifi: add a reference to iwl_wowlan_info_notif_v3 Mark this structure as one of the structures that represent WOWLAN_INFO_NOTIFICATION Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.19ebfa430c5c.Ie5aca3f0af11cc3137c6b6862a13777bae0cb06b@changeid commit 51c6b2857ea3204dd5096e95139901328d782294 Author: Miri Korenblit Date: Wed Jul 9 23:05:32 2025 +0300 wifi: iwlwifi: mvm: remove support for iwl_wowlan_info_notif_v2 FWs with this version are no longer supported on any device. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.d92f63207232.I8961ffbe04d0d9439d48a17840497ac926967914@changeid commit 35a13ce4820f8294740dfab8f8b0fba50e298920 Author: Miri Korenblit Date: Wed Jul 9 23:05:31 2025 +0300 wifi: iwlwifi: bump minimum API version for SO/MA/TY Stop supporting older FWs. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709230308.64f504f3690d.Idc95ca09101e52b4980b292945abe944c24fc5d1@changeid commit e9901c6a6057426d8682eeb776f0fe9c325318e9 Author: Miri Korenblit Date: Wed Jul 9 23:05:30 2025 +0300 wifi: iwlwifi: assign a FW API range for JF JF device is frozen on API 77. This prevented us from bumping the minimum FW API of SO (and get rid of older FWs). This is because SO can be combined with JF and then FW API 77 should be used. Now as we have separate FW API ranges for the mac and the crf, we can define for JF its own FW API range. This will allow bumping the minimum FW API of SO Independently. Do that now. Signed-off-by: Miri Korenblit Reviewed-by: Johannes Berg Link: https://patch.msgid.link/20250709200543.1628666-3-miriam.rachel.korenblit@intel.com commit 6fdd41b25fb4154bcde7a38ca1c98e072fa1177c Author: Miri Korenblit Date: Wed Jul 9 23:05:29 2025 +0300 wifi: iwlwifi: handle non-overlapping API ranges The option to set an api_version_min/max also to the RF was added. In the case that both the MAC and the RF has a range defined, we take the narrower range of both. This doesn't work for non-overlapping ranges. In this case, we should just take the lower range of both. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709200543.1628666-2-miriam.rachel.korenblit@intel.com commit b95a9d313642c9f3abebb77a04b41bb7bdd0feef Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:21 2025 +0530 x86/apic: Rename 'reg_off' to 'reg' Rename the 'reg_off' parameter of apic_{set|get}_reg() to 'reg' to match other usages in apic.h. No functional change intended. Reviewed-by: Tianyu Lan Signed-off-by: Neeraj Upadhyay Link: https://lore.kernel.org/r/20250709033242.267892-15-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit 17776e6c203bd3a9be795fb0a2fd72191a201ac9 Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:20 2025 +0530 x86/apic: KVM: Move apic_test)vector() to common code Move apic_test_vector() to apic.h in order to reuse it in the Secure AVIC guest APIC driver in later patches to test vector state in the APIC backing page. No functional change intended. Signed-off-by: Neeraj Upadhyay Acked-by: Sean Christopherson Link: https://lore.kernel.org/r/20250709033242.267892-14-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit fe954bcd577e703acdef597903079c991740f6bf Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:19 2025 +0530 x86/apic: KVM: Move lapic set/clear_vector() helpers to common code Move apic_clear_vector() and apic_set_vector() helper functions to apic.h in order to reuse them in the Secure AVIC guest APIC driver in later patches to atomically set/clear vectors in the APIC backing page. No functional change intended. Signed-off-by: Neeraj Upadhyay Acked-by: Sean Christopherson Link: https://lore.kernel.org/r/20250709033242.267892-13-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit 3d3a9083da1e7f5f933455411c1e96b37ae37772 Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:18 2025 +0530 x86/apic: KVM: Move lapic get/set helpers to common code Move the apic_get_reg(), apic_set_reg(), apic_get_reg64() and apic_set_reg64() helper functions to apic.h in order to reuse them in the Secure AVIC guest APIC driver in later patches to read/write registers from/to the APIC backing page. No functional change intended. Signed-off-by: Neeraj Upadhyay Acked-by: Sean Christopherson Link: https://lore.kernel.org/r/20250709033242.267892-12-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit 39e81633f65eeb474215c95991c19f31b5a19a11 Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:17 2025 +0530 x86/apic: KVM: Move apic_find_highest_vector() to a common header In preparation for using apic_find_highest_vector() in Secure AVIC guest APIC driver, move it and associated macros to apic.h. No functional change intended. Acked-by: Sean Christopherson Signed-off-by: Neeraj Upadhyay Link: https://lore.kernel.org/r/20250709033242.267892-11-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit b5f8980f29ce20357c6ee364a83c55f2bdf2dfde Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:16 2025 +0530 KVM: x86: Rename lapic set/clear vector helpers In preparation for moving kvm-internal kvm_lapic_set_vector(), kvm_lapic_clear_vector() to apic.h for use in Secure AVIC APIC driver, rename them as part of the APIC API. No functional change intended. Signed-off-by: Neeraj Upadhyay Acked-by: Sean Christopherson Link: https://lore.kernel.org/r/20250709033242.267892-10-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit 9c23bc4fec2b3b0324cac39ad7ec88206cc52da3 Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:15 2025 +0530 KVM: x86: Rename lapic get/set_reg64() helpers In preparation for moving kvm-internal __kvm_lapic_set_reg64(), __kvm_lapic_get_reg64() to apic.h for use in Secure AVIC APIC driver, rename them as part of the APIC API. No functional change intended. Signed-off-by: Neeraj Upadhyay Acked-by: Sean Christopherson Link: https://lore.kernel.org/r/20250709033242.267892-9-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit b9bd231913cf25bfaa6b5f10c2a629934697a189 Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:14 2025 +0530 KVM: x86: Rename lapic get/set_reg() helpers In preparation for moving kvm-internal __kvm_lapic_set_reg(), __kvm_lapic_get_reg() to apic.h for use in Secure AVIC APIC driver, rename them as part of the APIC API. No functional change intended. Signed-off-by: Neeraj Upadhyay Acked-by: Sean Christopherson Link: https://lore.kernel.org/r/20250709033242.267892-8-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit bdaccfe4e5179fe503febcd459ffe202d8097f6e Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:13 2025 +0530 KVM: x86: Rename find_highest_vector() In preparation for moving kvm-internal find_highest_vector() to apic.h for use in Secure AVIC APIC driver, rename find_highest_vector() to apic_find_highest_vector() as part of the APIC API. No functional change intended. Signed-off-by: Neeraj Upadhyay Acked-by: Sean Christopherson Link: https://lore.kernel.org/r/20250709033242.267892-7-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit e2fa7905b293750ee75573eeee3e54575ded8217 Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:12 2025 +0530 KVM: x86: Change lapic regs base address to void pointer Change APIC base address from "char *" to "void *" in KVM lapic's set/get helper functions. Pointer arithmetic for "void *" and "char *" operate identically. With "void *" there is less of a chance of doing the wrong thing, e.g. neglecting to cast and reading a byte instead of the desired APIC register size. No functional change intended. Signed-off-by: Neeraj Upadhyay Acked-by: Sean Christopherson Link: https://lore.kernel.org/r/20250709033242.267892-6-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit 9cbb5fd156d777cc09f57af20505e5e17ad6263b Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:11 2025 +0530 KVM: x86: Rename VEC_POS/REG_POS macro usages In preparation for moving most of the KVM's lapic helpers which use VEC_POS/REG_POS macros to common APIC header for use in Secure AVIC APIC driver, rename all VEC_POS/REG_POS macro usages to APIC_VECTOR_TO_BIT_NUMBER/APIC_VECTOR_TO_REG_OFFSET and remove VEC_POS/REG_POS. While at it, clean up line wrap in find_highest_vector(). No functional change intended. Signed-off-by: Neeraj Upadhyay Acked-by: Sean Christopherson Link: https://lore.kernel.org/r/20250709033242.267892-5-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit dc98e3bd494bef9c8933ee9ace254aac48efe506 Author: Sean Christopherson Date: Wed Jul 9 09:02:10 2025 +0530 x86/apic: KVM: Deduplicate APIC vector => register+bit math Consolidate KVM's {REG,VEC}_POS() macros and lapic_vector_set_in_irr()'s open coded equivalent logic in anticipation of the kernel gaining more usage of vector => reg+bit lookups. Use lapic_vector_set_in_irr()'s math as using divides for both the bit number and register offset makes it easier to connect the dots, and for at least one user, fixup_irqs(), "/ 32 * 0x10" generates ever so slightly better code with gcc-14 (shaves a whole 3 bytes from the code stream): ((v) >> 5) << 4: c1 ef 05 shr $0x5,%edi c1 e7 04 shl $0x4,%edi 81 c7 00 02 00 00 add $0x200,%edi (v) / 32 * 0x10: c1 ef 05 shr $0x5,%edi 83 c7 20 add $0x20,%edi c1 e7 04 shl $0x4,%edi Keep KVM's tersely named macros as "wrappers" to avoid unnecessary churn in KVM, and because the shorter names yield more readable code overall in KVM. The new macros type cast the vector parameter to "unsigned int". This is required from better code generation for cases where an "int" is passed to these macros in KVM code. int v; ((v) >> 5) << 4: c1 f8 05 sar $0x5,%eax c1 e0 04 shl $0x4,%eax ((v) / 32 * 0x10): 85 ff test %edi,%edi 8d 47 1f lea 0x1f(%rdi),%eax 0f 49 c7 cmovns %edi,%eax c1 f8 05 sar $0x5,%eax c1 e0 04 shl $0x4,%eax ((unsigned int)(v) / 32 * 0x10): c1 f8 05 sar $0x5,%eax c1 e0 04 shl $0x4,%eax (v) & (32 - 1): 89 f8 mov %edi,%eax 83 e0 1f and $0x1f,%eax (v) % 32 89 fa mov %edi,%edx c1 fa 1f sar $0x1f,%edx c1 ea 1b shr $0x1b,%edx 8d 04 17 lea (%rdi,%rdx,1),%eax 83 e0 1f and $0x1f,%eax 29 d0 sub %edx,%eax (unsigned int)(v) % 32: 89 f8 mov %edi,%eax 83 e0 1f and $0x1f,%eax Overall kvm.ko text size is impacted if "unsigned int" is not used. Bin Orig New (w/o unsigned int) New (w/ unsigned int) lapic.o 28580 28772 28580 kvm.o 670810 671002 670810 kvm.ko 708079 708271 708079 No functional change intended. [Neeraj: Type cast vec macro param to "unsigned int", provide data in commit log on "unsigned int" requirement] Signed-off-by: Neeraj Upadhyay Link: https://lore.kernel.org/r/20250709033242.267892-4-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit 3fb7b83e2a720dc96aa275f42380cf488e6f9737 Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:09 2025 +0530 KVM: x86: Remove redundant parentheses around 'bitmap' When doing pointer arithmetic in apic_test_vector() and kvm_lapic_{set|clear}_vector(), remove the unnecessary parentheses surrounding the 'bitmap' parameter. No functional change intended. Reviewed-by: Borislav Petkov (AMD) Signed-off-by: Neeraj Upadhyay Link: https://lore.kernel.org/r/20250709033242.267892-3-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit ac48017020a5f97d7ef1a5cd90278587474dd593 Author: Neeraj Upadhyay Date: Wed Jul 9 09:02:08 2025 +0530 KVM: x86: Open code setting/clearing of bits in the ISR Remove __apic_test_and_set_vector() and __apic_test_and_clear_vector(), because the _only_ register that's safe to modify with a non-atomic operation is ISR, because KVM isn't running the vCPU, i.e. hardware can't service an IRQ or process an EOI for the relevant (virtual) APIC. No functional change intended. Suggested-by: Sean Christopherson Signed-off-by: Neeraj Upadhyay Acked-by: Sean Christopherson Link: https://lore.kernel.org/r/20250709033242.267892-2-Neeraj.Upadhyay@amd.com Signed-off-by: Sean Christopherson commit a77896eea33db6fe393d1db1380e2e52f74546a2 Author: Kevin Loughlin Date: Thu May 22 16:37:31 2025 -0700 KVM: SEV: Prefer WBNOINVD over WBINVD for cache maintenance efficiency AMD CPUs currently execute WBINVD in the host when unregistering SEV guest memory or when deactivating SEV guests. Such cache maintenance is performed to prevent data corruption, wherein the encrypted (C=1) version of a dirty cache line might otherwise only be written back after the memory is written in a different context (ex: C=0), yielding corruption. However, WBINVD is performance-costly, especially because it invalidates processor caches. Strictly-speaking, unless the SEV ASID is being recycled (meaning the SNP firmware requires the use of WBINVD prior to DF_FLUSH), the cache invalidation triggered by WBINVD is unnecessary; only the writeback is needed to prevent data corruption in remaining scenarios. To improve performance in these scenarios, use WBNOINVD when available instead of WBINVD. WBNOINVD still writes back all dirty lines (preventing host data corruption by SEV guests) but does *not* invalidate processor caches. Note that the implementation of wbnoinvd() ensures fall back to WBINVD if WBNOINVD is unavailable. In anticipation of forthcoming optimizations to limit the WBNOINVD only to physical CPUs that have executed SEV guests, place the call to wbnoinvd_on_all_cpus() in a wrapper function sev_writeback_caches(). Signed-off-by: Kevin Loughlin Reviewed-by: Mingwei Zhang Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250201000259.3289143-3-kevinloughlin@google.com [sean: tweak comment regarding CLFUSH] Cc: Francesco Lavra Link: https://lore.kernel.org/r/20250522233733.3176144-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 7e00013bd33995dddb604dc94f6c970d6603d5ec Author: Zheyun Shen Date: Thu May 22 16:37:30 2025 -0700 KVM: SVM: Remove wbinvd in sev_vm_destroy() Before sev_vm_destroy() is called, kvm_arch_guest_memory_reclaimed() has been called for SEV and SEV-ES and kvm_arch_gmem_invalidate() has been called for SEV-SNP. These functions have already handled flushing the memory. Therefore, this wbinvd_on_all_cpus() can simply be dropped. Suggested-by: Sean Christopherson Signed-off-by: Zheyun Shen Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250522233733.3176144-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 55aed8c2dbc4d95121c20a509d95e2ef3c1d7d09 Author: Sean Christopherson Date: Thu May 22 16:37:29 2025 -0700 KVM: x86: Use wbinvd_on_cpu() instead of an open-coded equivalent Use wbinvd_on_cpu() to target a single CPU instead of open-coding an equivalent, and drop KVM's wbinvd_ipi() now that all users have switched to x86 library versions. No functional change intended. Reviewed-by: Tom Lendacky Link: https://lore.kernel.org/r/20250522233733.3176144-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 1d2e2503e506ddc499cbb7afdc8b70bcf6fe241f Author: Michal Wajdeczko Date: Thu Jul 10 10:30:39 2025 +0000 drm/xe/bmg: Don't use WA 16023588340 and 22019338487 on VF These workarounds are not applicable for use by the VFs. Signed-off-by: Michal Wajdeczko Tested-by: Jakub Kolakowski Reviewed-by: Satyanarayana K V P Signed-off-by: Jakub Kolakowski Link: https://lore.kernel.org/r/20250710103040.375610-2-jakub1.kolakowski@intel.com Signed-off-by: Lucas De Marchi commit 2885daf47081dd1aaf1a588e9d001eb343df1f90 Author: Sebastian Andrzej Siewior Date: Thu Jul 10 10:27:48 2025 +0200 lib/smp_processor_id: Make migration check unconditional of SMP Commit cac5cefbade90 ("sched/smp: Make SMP unconditional") migrate_disable() even on UP builds. Commit 06ddd17521bf1 ("sched/smp: Always define is_percpu_thread() and scheduler_ipi()") made is_percpu_thread() check the affinity mask instead replying always true for UP mask. As a consequence smp_processor_id() now complains if invoked within a migrate_disable() section because is_percpu_thread() checks its mask and the migration check is left out. Make migration check unconditional of SMP. Fixes: cac5cefbade90 ("sched/smp: Make SMP unconditional") Closes: https://lore.kernel.org/oe-lkp/202507100448.6b88d6f1-lkp@intel.com Reported-by: kernel test robot Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Chen Yu Link: https://lore.kernel.org/r/20250710082748.-DPO1rjO@linutronix.de commit 530694f54dd5e097866999bbaebc5c133e5507b6 Author: Samuel Zhang Date: Thu Jul 10 14:23:13 2025 +0800 drm/amdgpu: do not resume device in thaw for normal hibernation For normal hibernation, GPU do not need to be resumed in thaw since it is not involved in writing the hibernation image. Skip resume in this case can reduce the hibernation time. On VM with 8 * 192GB VRAM dGPUs, 98% VRAM usage and 1.7TB system memory, this can save 50 minutes. Signed-off-by: Samuel Zhang Tested-by: Mario Limonciello Reviewed-by: Mario Limonciello Reviewed-by: Lijo Lazar Link: https://lore.kernel.org/r/20250710062313.3226149-6-guoqing.zhang@amd.com Signed-off-by: Mario Limonciello commit c2aaddbd2deded9d3301f1bafed242a0f71baba8 Author: Samuel Zhang Date: Thu Jul 10 14:23:12 2025 +0800 PM: hibernate: add new api pm_hibernate_is_recovering() dev_pm_ops.thaw() is called in following cases: * normal case: after hibernation image has been created. * error case 1: creation of a hibernation image has failed. * error case 2: restoration from a hibernation image has failed. For normal case, it is called mainly for resume storage devices for saving the hibernation image. Other devices that are not involved in the image saving do not need to resume the device. But since there's no api to know which case thaw() is called, device drivers can't conditionally resume device in thaw(). The new pm_hibernate_is_recovering() is such a api to query if thaw() is called in normal case. Signed-off-by: Samuel Zhang Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20250710062313.3226149-5-guoqing.zhang@amd.com Signed-off-by: Mario Limonciello commit 2640e819474f4a9ec78aa3cdb9063e4b5cf18ae4 Author: Samuel Zhang Date: Thu Jul 10 14:23:11 2025 +0800 PM: hibernate: shrink shmem pages after dev_pm_ops.prepare() When hibernate with data center dGPUs, huge number of VRAM data will be moved to shmem during dev_pm_ops.prepare(). These shmem pages take a lot of system memory so that there's no enough free memory for creating the hibernation image. This will cause hibernation fail and abort. After dev_pm_ops.prepare(), call shrink_all_memory() to force move shmem pages to swap disk and reclaim the pages, so that there's enough system memory for hibernation image and less pages needed to copy to the image. This patch can only flush and free about half shmem pages. It will be better to flush and free more pages, even all of shmem pages, so that there're less pages to be copied to the hibernation image and the overall hibernation time can be reduced. Signed-off-by: Samuel Zhang Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20250710062313.3226149-4-guoqing.zhang@amd.com Signed-off-by: Mario Limonciello commit 924dda024f3bea64be5f3ac067a075e466739dc9 Author: Samuel Zhang Date: Thu Jul 10 14:23:10 2025 +0800 drm/amdgpu: move GTT to shmem after eviction for hibernation When hibernate with data center dGPUs, huge number of VRAM BOs evicted to GTT and takes too much system memory. This will cause hibernation fail due to insufficient memory for creating the hibernation image. Move GTT BOs to shmem in KMD, then shmem to swap disk in kernel hibernation code to make room for hibernation image. Signed-off-by: Samuel Zhang Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250710062313.3226149-3-guoqing.zhang@amd.com Signed-off-by: Mario Limonciello commit 40b6a946d21ee7b2b6d394bb2f1cdd3973aa9da5 Author: Samuel Zhang Date: Thu Jul 10 14:23:09 2025 +0800 drm/ttm: add new api ttm_device_prepare_hibernation() This new api is used for hibernation to move GTT BOs to shmem after VRAM eviction. shmem will be flushed to swap disk later to reduce the system memory usage for hibernation. Signed-off-by: Samuel Zhang Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250710062313.3226149-2-guoqing.zhang@amd.com Signed-off-by: Mario Limonciello commit 1c26c3bbdee11f3fad0c74b8f09aef488dcf4b62 Author: Nicolin Chen Date: Wed Jul 9 22:59:02 2025 -0700 iommufd/access: Add internal APIs for HW queue to use The new HW queue object, as an internal iommufd object, wants to reuse the struct iommufd_access to pin some iova range in the iopt. However, an access generally takes the refcount of an ictx. So, in such an internal case, a deadlock could happen when the release of the ictx has to wait for the release of the access first when releasing a hw_queue object, which could wait for the release of the ictx that is refcounted: ictx --releases--> hw_queue --releases--> access ^ | |_________________releases________________v To address this, add a set of lightweight internal APIs to unlink the ictx and the access, i.e. no ictx refcounting by the access: ictx --releases--> hw_queue --releases--> access Then, there's no point in setting the access->ictx. So simply define !ictx as an flag for an internal use and add an inline helper. Link: https://patch.msgid.link/r/d8d84bf99cbebec56034b57b966a3d431385b90d.1752126748.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 0e3e0b0c08e388cd9e05bb4d17534bd36bedc9fe Author: Nicolin Chen Date: Wed Jul 9 22:59:01 2025 -0700 iommufd/selftest: Add coverage for viommu data Extend the existing test_cmd/err_viommu_alloc helpers to accept optional user data. And add a TEST_F for a loopback test. Link: https://patch.msgid.link/r/8ceb64d30e9953f29270a7d341032ca439317271.1752126748.git.nicolinc@nvidia.com Reviewed-by: Pranjal Shrivastava Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit afeaf592c1d435b8773471880c6c349506569cac Author: Nicolin Chen Date: Wed Jul 9 22:59:00 2025 -0700 iommufd/selftest: Support user_data in mock_viommu_alloc Add a simple user_data for an input-to-output loopback test. Link: https://patch.msgid.link/r/cae4632bb3d98a1efb3b77488fbf81814f2041c6.1752126748.git.nicolinc@nvidia.com Reviewed-by: Pranjal Shrivastava Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 1976cdf61ce9b6f97b5212676a3b9f74c68f6073 Author: Nicolin Chen Date: Wed Jul 9 22:58:59 2025 -0700 iommufd/viommu: Allow driver-specific user data for a vIOMMU object The new type of vIOMMU for tegra241-cmdqv driver needs a driver-specific user data. So, add data_len/uptr to the iommu_viommu_alloc uAPI and pass it in via the viommu_init iommu op. Link: https://patch.msgid.link/r/2315b0e164b355746387e960745ac9154caec124.1752126748.git.nicolinc@nvidia.com Reviewed-by: Jason Gunthorpe Reviewed-by: Lu Baolu Acked-by: Pranjal Shrivastava Acked-by: Alok Tiwari Reviewed-by: Vasant Hegde Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit c3436d42f812faffac94f8fb3fb246ab43ffdffe Author: Nicolin Chen Date: Wed Jul 9 22:58:58 2025 -0700 iommu: Pass in a driver-level user data structure to viommu_init op The new type of vIOMMU for tegra241-cmdqv allows user space VM to use one of its virtual command queue HW resources exclusively. This requires user space to mmap the corresponding MMIO page from kernel space for direct HW control. To forward the mmap info (offset and length), iommufd should add a driver specific data structure to the IOMMUFD_CMD_VIOMMU_ALLOC ioctl, for driver to output the info during the vIOMMU initialization back to user space. Similar to the existing ioctls and their IOMMU handlers, add a user_data to viommu_init op to bridge between iommufd and drivers. Link: https://patch.msgid.link/r/90bd5637dab7f5507c7a64d2c4826e70431e45a4.1752126748.git.nicolinc@nvidia.com Reviewed-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Pranjal Shrivastava Reviewed-by: Kevin Tian Reviewed-by: Vasant Hegde Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 3fcf56a2393b399f289a473181ce6b19f716b59d Author: Nicolin Chen Date: Wed Jul 9 22:58:57 2025 -0700 iommu: Add iommu_copy_struct_to_user helper Similar to the iommu_copy_struct_from_user helper receiving data from the user space, add an iommu_copy_struct_to_user helper to report output data back to the user space data pointer. Link: https://patch.msgid.link/r/fa292c2a730aadd77085ec3a8272360c96eabb9c.1752126748.git.nicolinc@nvidia.com Reviewed-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Pranjal Shrivastava Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 4b57c057f9e6668ae442b19902dab8a73fe7b209 Author: Nicolin Chen Date: Wed Jul 9 22:58:56 2025 -0700 iommu: Use enum iommu_hw_info_type for type in hw_info op Replace u32 to make it clear. No functional changes. Also simplify the kdoc since the type itself is clear enough. Link: https://patch.msgid.link/r/651c50dee8ab900f691202ef0204cd5a43fdd6a2.1752126748.git.nicolinc@nvidia.com Reviewed-by: Pranjal Shrivastava Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit c50a5de2c465232f30c731bc98f564ddb6229377 Author: Nicolin Chen Date: Wed Jul 9 22:58:55 2025 -0700 iommufd/viommu: Explicitly define vdev->virt_id The "id" is too general to get its meaning easily. Rename it explicitly to "virt_id" and update the kdocs for readability. No functional changes. Link: https://patch.msgid.link/r/1fac22d645e6ee555675726faf3798a68315b044.1752126748.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Reviewed-by: Vasant Hegde Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit fca02263f27eee093379844ac0fb280bf70e6aed Author: Nicolin Chen Date: Wed Jul 9 22:58:54 2025 -0700 iommufd: Correct virt_id kdoc at struct iommu_vdevice_alloc The userspace-api iommufd.rst has described it correctly but the uAPI doc was remained uncorrected. Thus, fix it. Link: https://patch.msgid.link/r/2cdcecaf2babee16fda7545ccad4e5bed7a5032d.1752126748.git.nicolinc@nvidia.com Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit b23e09f9997771b4b739c1c694fa832b5fa2de02 Author: Nicolin Chen Date: Wed Jul 9 22:58:53 2025 -0700 iommufd: Report unmapped bytes in the error path of iopt_unmap_iova_range There are callers that read the unmapped bytes even when rc != 0. Thus, do not forget to report it in the error path too. Fixes: 8d40205f6093 ("iommufd: Add kAPI toward external drivers for kernel access") Link: https://patch.msgid.link/r/e2b61303bbc008ba1a4e2d7c2a2894749b59fdac.1752126748.git.nicolinc@nvidia.com Cc: stable@vger.kernel.org Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Signed-off-by: Jason Gunthorpe commit 11895f375939d60efe7ed5dddc1cffe2e79f976c Author: Hans de Goede Date: Mon Jul 7 23:14:12 2025 +0200 drm/i915/bios: Apply vlv_fixup_mipi_sequences() to v2 mipi-sequences too It turns out that the fixup from vlv_fixup_mipi_sequences() is necessary for some DSI panel's with version 2 mipi-sequences too. Specifically the Acer Iconia One 8 A1-840 (not to be confused with the A1-840FHD which is different) has the following sequences: BDB block 53 (1284 bytes) - MIPI sequence block: Sequence block version v2 Panel 0 * Sequence 2 - MIPI_SEQ_INIT_OTP GPIO index 9, source 0, set 0 (0x00) Delay: 50000 us GPIO index 9, source 0, set 1 (0x01) Delay: 6000 us GPIO index 9, source 0, set 0 (0x00) Delay: 6000 us GPIO index 9, source 0, set 1 (0x01) Delay: 25000 us Send DCS: Port A, VC 0, LP, Type 39, Length 5, Data ff aa 55 a5 80 Send DCS: Port A, VC 0, LP, Type 39, Length 3, Data 6f 11 00 ... Send DCS: Port A, VC 0, LP, Type 05, Length 1, Data 29 Delay: 120000 us Sequence 4 - MIPI_SEQ_DISPLAY_OFF Send DCS: Port A, VC 0, LP, Type 05, Length 1, Data 28 Delay: 105000 us Send DCS: Port A, VC 0, LP, Type 05, Length 2, Data 10 00 Delay: 10000 us Sequence 5 - MIPI_SEQ_ASSERT_RESET Delay: 10000 us GPIO index 9, source 0, set 0 (0x00) Notice how there is no MIPI_SEQ_DEASSERT_RESET, instead the deassert is done at the beginning of MIPI_SEQ_INIT_OTP, which is exactly what the fixup from vlv_fixup_mipi_sequences() fixes up. Extend it to also apply to v2 sequences, this fixes the panel not working on the Acer Iconia One 8 A1-840. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14605 Signed-off-by: Hans de Goede Acked-by: Jani Nikula Link: https://lore.kernel.org/r/20250703143824.7121-1-hansg@kernel.org Signed-off-by: Rodrigo Vivi commit bead8800222768dab1a421206350d530b0c45254 Author: Philipp Stanner Date: Thu Jul 10 14:54:12 2025 +0200 drm/nouveau: Remove waitque for sched teardown struct nouveau_sched contains a waitque needed to prevent drm_sched_fini() from being called while there are still jobs pending. Doing so so far would have caused memory leaks. With the new memleak-free mode of operation switched on in drm_sched_fini() by providing the callback nouveau_sched_cancel_job() the waitque is not necessary anymore. Remove the waitque. Acked-by: Danilo Krummrich Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250710125412.128476-10-phasta@kernel.org commit 5f46f5c7af8c632de3742dc0cf3cb9a05bd52437 Author: Philipp Stanner Date: Thu Jul 10 14:54:11 2025 +0200 drm/nouveau: Add new callback for scheduler teardown There is a new callback for always tearing the scheduler down in a leak-free, deadlock-free manner. Port Nouveau as its first user by providing the scheduler with a callback that ensures the fence context gets killed in drm_sched_fini(). Acked-by: Danilo Krummrich Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250710125412.128476-9-phasta@kernel.org commit 89b2675198abf1879b68c65dc0256d92c9eabb04 Author: Philipp Stanner Date: Thu Jul 10 14:54:10 2025 +0200 drm/nouveau: Make fence container helper usable driver-wide In order to implement a new DRM GPU scheduler callback in Nouveau, a helper for obtaining a nouveau_fence from a dma_fence is necessary. Such a helper exists already inside nouveau_fence.c, called from_fence(). Make that helper available to other C files with a more precise name. Acked-by: Danilo Krummrich Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250710125412.128476-8-phasta@kernel.org commit d1e5ba835f786fe83ecfbf09ba5c1a0060e87b6e Author: Philipp Stanner Date: Thu Jul 10 14:54:09 2025 +0200 drm/sched: Warn if pending_list is not empty drm_sched_fini() can leak jobs under certain circumstances. Warn if that happens. Acked-by: Danilo Krummrich Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250710125412.128476-7-phasta@kernel.org commit c2668a0e03501a26cedc82e32fe9f3f692d330db Author: Philipp Stanner Date: Thu Jul 10 14:54:08 2025 +0200 drm/sched/tests: Add unit test for cancel_job() The scheduler unit tests now provide a new callback, cancel_job(). This callback gets used by drm_sched_fini() for all still pending jobs to cancel them. Implement a new unit test to test this. Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250710125412.128476-6-phasta@kernel.org commit 4576de9b79779a6f49ecac829ff5d8984eeb5d0b Author: Philipp Stanner Date: Thu Jul 10 14:54:07 2025 +0200 drm/sched/tests: Implement cancel_job() callback The GPU Scheduler now supports a new callback, cancel_job(), which lets the scheduler cancel all jobs which might not yet be freed when drm_sched_fini() runs. Using this callback allows for significantly simplifying the mock scheduler teardown code. Implement the cancel_job() callback and adjust the code where necessary. Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250710125412.128476-5-phasta@kernel.org commit bf8bbaefaa6ae0a07971ea57b3208df60e8ad0a4 Author: Philipp Stanner Date: Thu Jul 10 14:54:06 2025 +0200 drm/sched: Avoid memory leaks with cancel_job() callback Since its inception, the GPU scheduler can leak memory if the driver calls drm_sched_fini() while there are still jobs in flight. The simplest way to solve this in a backwards compatible manner is by adding a new callback, drm_sched_backend_ops.cancel_job(), which instructs the driver to signal the hardware fence associated with the job. Afterwards, the scheduler can safely use the established free_job() callback for freeing the job. Implement the new backend_ops callback cancel_job(). Suggested-by: Tvrtko Ursulin Link: https://lore.kernel.org/dri-devel/20250418113211.69956-1-tvrtko.ursulin@igalia.com/ Reviewed-by: Maíra Canal Acked-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250710125412.128476-4-phasta@kernel.org commit 1a32f7427eb3d1248bc64cd745b93f88cc838933 Author: Patrick Delaunay Date: Thu May 15 15:12:40 2025 +0200 arm64: dts: st: remove empty line in stm32mp251.dtsi Remove unnecessary empty line in stm32mp251.dtsi Signed-off-by: Patrick Delaunay Link: https://lore.kernel.org/r/20250515151238.2.Ia426b4ef1d1200247a950ef9abd54a94dc520acb@changeid Signed-off-by: Alexandre Torgue commit 9ec406ac4b7de3e8040a503429d1a5d389bfdaf6 Author: Patrick Delaunay Date: Thu May 15 15:12:39 2025 +0200 arm64: dts: st: fix timer used for ticks Remove always-on on generic ARM timer as the clock source provided by STGEN is deactivated in low power mode, STOP1 by example. Fixes: 5d30d03aaf78 ("arm64: dts: st: introduce stm32mp25 SoCs family") Signed-off-by: Patrick Delaunay Link: https://lore.kernel.org/r/20250515151238.1.I85271ddb811a7cf73532fec90de7281cb24ce260@changeid Signed-off-by: Alexandre Torgue commit ce3d39fae3d35fc9f09a7d65bffc218fbdebd002 Author: Juston Li Date: Wed Jul 9 12:23:14 2025 -0700 drm/xe/bo: add GPU memory trace points Add TRACE_GPU_MEM tracepoints for tracking global GPU memory usage. These are required by VSR on Android 12+ for reporting GPU driver memory allocations. v5: - Drop process_mem tracking - Set the gpu_id field to dev->primary->index (Lucas, Tvrtko) - Formatting cleanup under 80 columns v3: - Use now configurable CONFIG_TRACE_GPU_MEM instead of adding a per-driver Kconfig (Lucas) v2: - Use u64 as preferred by checkpatch (Tvrtko) - Fix errors in comments/Kconfig description (Tvrtko) - drop redundant "CONFIG" in Kconfig Signed-off-by: Juston Li Reviewed-by: Tvrtko Ursulin Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250709192313.479336-2-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi commit 27ba973caaf85ff3a2a23eca33d6dc9b4fe405e8 Author: Karthikeyan Kathirvel Date: Wed Jun 4 15:46:20 2025 +0530 wifi: ath12k: allow beacon protection keys to be installed in hardware Install beacon protection keys in hardware for AP modes only if hardware supports it, as indicated by the WMI service bit WMI_TLV_SERVICE_BEACON_PROTECTION_SUPPORT. Allow keyidx up to 7, since beacon protection uses keyidx 6 and 7. Control this feature by setting bit 0 of feature_enable_bitmap when sending the WMI_BCN_TMPL_CMDID command to firmware. Check for the beacon protection enabled bit in both tx and non-tx profiles for MBSSID cases. If set in either profile, enable the beacon protection feature in firmware for transmitted vif. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Karthikeyan Kathirvel Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250604101620.2948103-1-karthikeyan.kathirvel@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 0424cc3d70f6bd72e6501c730b1f95ba966e2ee9 Author: P Praneesh Date: Thu Jun 5 10:31:35 2025 +0530 wifi: ath12k: set RX_FLAG_SKIP_MONITOR in WBM error path Packets delivered to mac80211 from the WBM error path currently do not have the RX_FLAG_SKIP_MONITOR flag set in status->flag. As a result, mac80211 performs unnecessary monitor mode checks on each packet, even though these packets are not intended for monitor mode processing. In regular rx path, this flag is explicitly set to avoid such overhead. Align the WBM error path behavior by setting RX_FLAG_SKIP_MONITOR to prevent redundant per-packet checks in mac80211. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: P Praneesh Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250605050135.1802902-1-praneesh.p@oss.qualcomm.com Signed-off-by: Jeff Johnson commit fee9b1f6691120182136edacf590f52d62d9de7f Author: Jeff Johnson Date: Wed Jul 2 14:29:12 2025 -0700 wifi: ath12k: pack HTT pdev rate stats structs In order to ensure the HTT DebugFS structs shared with firmware have matching alignment, the structs should be packed. Most of the structs are correctly packed, however the following are not: ath12k_htt_tx_pdev_rate_stats_tlv ath12k_htt_rx_pdev_rate_stats_tlv ath12k_htt_rx_pdev_rate_ext_stats_tlv So pack those structs. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: ba42b22aa336 ("wifi: ath12k: Dump PDEV transmit rate HTT stats") Fixes: a24cd7583003 ("wifi: ath12k: Dump PDEV receive rate HTT stats") Fixes: 7a3e8eec8d18 ("wifi: ath12k: Dump additional PDEV receive rate HTT stats") Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250702-debugfs_htt_packed-v1-1-07bd18b31e79@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 2109e98503bc1c01c399feac68cc8b7faf6d0a4a Author: Harshitha Prem Date: Tue Jul 1 19:29:02 2025 +0530 wifi: ath12k: update unsupported bandwidth flags in reg rules The maximum bandwidth an interface can operate in is defined by the configured country. However, currently, it is able to operate in bandwidths greater than the allowed bandwidth. For example, the Central African Republic (CF) supports a maximum bandwidth of 40 MHz in both the 2 GHz and 5 GHz bands, but an interface is still able to operate in bandwidths higher than 40 MHz. This issue arises because the regulatory rules in the regd are not updated with these restrictions received from firmware on the maximum bandwidth. Hence, update the regulatory rules with unsupported bandwidth flags based on the maximum bandwidth to ensure compliance with country-specific regulations. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Harshitha Prem Signed-off-by: Amith A Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250701135902.722851-1-quic_amitajit@quicinc.com Signed-off-by: Jeff Johnson commit 1aee3a44fad2adeaa8f1a3aafd7c0154924af666 Author: Benjamin Tissoires Date: Wed Jul 9 11:08:51 2025 +0200 selftests/hid: sync python tests to hid-tools 0.10 hid-tools 0.10 fixes one inconvenience introduced by commit 6a9e76f75c1a ("HID: multitouch: Disable touchpad on firmware level while not in use") This change added a new callback when a hid-nultitouch device is opened or closed to put the underlying device into a given operating mode. However, in the test cases, that means that while the single threaded test is run, it opens the device but has to react to the device while the open() is still running. hid-tools now implements a minimal thread to circumvent this. This makes the HID kernel tests in sync with hid-tools 0.10. This has the net effect of running the full HID python testsuite in 6 minutes instead of 1 hour. Reviewed-by: Peter Hutterer Link: https://patch.msgid.link/20250709-wip-fix-ci-v1-3-b7df4c271cf8@kernel.org Signed-off-by: Benjamin Tissoires commit 642f9b2d608cc2239d22957ca1dc557d07470b50 Author: Benjamin Tissoires Date: Wed Jul 9 11:08:50 2025 +0200 selftests/hid: sync the python tests to hid-tools 0.8 Instead of backporting one by one each commits, let's pull them in bulk and refer to the hid-tools project for a detailed history. The short summary is: - make use of dataclass when possible, to avoid tuples - wacom: remove unused uhdev parameter - various small fixes not worth mentioning Reviewed-by: Peter Hutterer Link: https://patch.msgid.link/20250709-wip-fix-ci-v1-2-b7df4c271cf8@kernel.org Signed-off-by: Benjamin Tissoires commit c85a8cb9b8d3a3dd9bb12879b28fc377dd24272b Author: Benjamin Tissoires Date: Wed Jul 9 11:08:49 2025 +0200 selftests/hid: run ruff format on the python part We aim at syncing with the hid-tools repo on gitlab.freedesktop.org/libevdev/hid-tools. One of the commits is this mechanical formatting, so pull it over here so changes are not hidden by those. Reviewed-by: Peter Hutterer Link: https://patch.msgid.link/20250709-wip-fix-ci-v1-1-b7df4c271cf8@kernel.org Signed-off-by: Benjamin Tissoires commit f5c5d29522ecb3b6797130995e74e4774caf4548 Author: Riana Tauro Date: Tue Jul 1 15:22:52 2025 +0300 drm/xe/xe_i2c: Add support for i2c in survivability mode Initialize i2c in survivability mode to allow firmware update of Add-In Management Controller (AMC) in survivability mode. Signed-off-by: Riana Tauro Signed-off-by: Heikki Krogerus Reviewed-by: Raag Jadav Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20250701122252.2590230-6-heikki.krogerus@linux.intel.com Signed-off-by: Rodrigo Vivi commit 0ea07b69517a16808ea700b3226ddfa4484f23b9 Author: Raag Jadav Date: Tue Jul 1 15:22:51 2025 +0300 drm/xe/pm: Wire up suspend/resume for I2C controller Wire up suspend/resume handles for I2C controller to match its power state with SGUnit. Signed-off-by: Raag Jadav Signed-off-by: Heikki Krogerus Reviewed-by: Karthik Poosa Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20250701122252.2590230-5-heikki.krogerus@linux.intel.com Signed-off-by: Rodrigo Vivi commit f0e53aadd702c64b2c2090996751c9be043f9e80 Author: Heikki Krogerus Date: Tue Jul 1 15:22:50 2025 +0300 drm/xe: Support for I2C attached MCUs Adding adaption/glue layer where the I2C host adapter (Synopsys DesignWare I2C adapter) and the I2C clients (the microcontroller units) are enumerated. The microcontroller units (MCU) that are attached to the GPU depend on the OEM. The initially supported MCU will be the Add-In Management Controller (AMC). Co-developed-by: Michael J. Ruhl Signed-off-by: Michael J. Ruhl Signed-off-by: Heikki Krogerus Reviewed-by: Rodrigo Vivi Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20250701122252.2590230-4-heikki.krogerus@linux.intel.com Signed-off-by: Rodrigo Vivi [Rodrigo fixed the co-developed tags and SPDX format in the .c file] commit f6a8e9f3de4567c71ef9f5f13719df69a8b96081 Author: Heikki Krogerus Date: Tue Jul 1 15:22:49 2025 +0300 i2c: designware: Add quirk for Intel Xe The regmap is coming from the parent also in case of Xe GPUs. Reusing the Wangxun quirk for that. Acked-by: Jarkko Nikula Co-developed-by: Michael J. Ruhl Signed-off-by: Michael J. Ruhl Signed-off-by: Heikki Krogerus Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20250701122252.2590230-3-heikki.krogerus@linux.intel.com Signed-off-by: Rodrigo Vivi [Rodrigo fixed the co-developed tags while merging] commit 22290cc904d9f5b882748573a16ccf8c6d632d92 Author: Heikki Krogerus Date: Tue Jul 1 15:22:48 2025 +0300 i2c: designware: Use polling by default when there is no irq resource The irq resource itself can be used as a generic way to determine when polling is needed. This not only removes the need for special additional device properties that would soon be needed when the platform may or may not have the irq, but it also removes the need to check the platform in the first place in order to determine is polling needed or not. Signed-off-by: Heikki Krogerus Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20250701122252.2590230-2-heikki.krogerus@linux.intel.com Signed-off-by: Rodrigo Vivi commit 621a4220793b6d7bf29c66e2d82b9290225b2cf6 Author: Michal Wajdeczko Date: Wed Jul 2 16:25:04 2025 +0200 drm/xe/guc: Don't allocate temporary policies object Since we are already using reusable buffer objects from the GuC buffer cache, we can directly write into their CPU pointers and spare unnecessary temporary allocation. While around, also make sure to clear obtained buffer, to avoid sending some stale data. Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250702142504.1656-1-michal.wajdeczko@intel.com commit e090f978054e1cfcd970234589168fcbcba33976 Merge: 45e359be1ce88f 37bfeebc12a4ca Author: Paolo Abeni Date: Thu Jul 10 15:41:03 2025 +0200 Merge branch 'net-dsa-rzn1_a5psw-add-compile_test' Rosen Penev says: ==================== net: dsa: rzn1_a5psw: add COMPILE_TEST Allows the various bots to test compilation. Also threw in a small devm conversion for enabling clocks. ==================== Link: https://patch.msgid.link/20250708014144.2514-1-rosenp@gmail.com Signed-off-by: Paolo Abeni commit 37bfeebc12a4cab3c4c94b5429a4cb7eb3e42e79 Author: Rosen Penev Date: Mon Jul 7 18:41:44 2025 -0700 net: dsa: rzn1_a5psw: use devm to enable clocks The remove function has these in the wrong order. The switch should be unregistered last. Simpler to use devm so that the right thing is done. Signed-off-by: Rosen Penev Link: https://patch.msgid.link/20250708014144.2514-3-rosenp@gmail.com Signed-off-by: Paolo Abeni commit f38ae0c62ec8e549e752be2e23d25c142dca96c5 Author: Rosen Penev Date: Mon Jul 7 18:41:43 2025 -0700 net: dsa: rzn1_a5psw: add COMPILE_TEST There's no architecture specific requirement for it to compile. Allows the bots to test compilation properly. Signed-off-by: Rosen Penev Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250708014144.2514-2-rosenp@gmail.com Signed-off-by: Paolo Abeni commit 81bf24f1ac77029bf858c0da081088eb62b1b230 Author: Mark Brown Date: Thu Jul 10 12:12:20 2025 +0100 KVM: selftests: Add CONFIG_EVENTFD for irqfd selftest In 7e9b231c402a ("KVM: selftests: Add a KVM_IRQFD test to verify uniqueness requirements") we added a test for the newly added irqfd support but since this feature works with eventfds it won't work unless the kernel has been built wth eventfd support. Add CONFIG_EVENTFD to the list of required options for the KVM selftests. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250710-kvm-selftests-eventfd-config-v1-1-78c276e4b80f@kernel.org Signed-off-by: Sean Christopherson commit ec50ec378e3fd83bde9b3d622ceac3509a60b6b5 Author: Breno Leitao Date: Thu Jul 10 05:57:26 2025 -0700 ipmi: Use dev_warn_ratelimited() for incorrect message warnings During BMC firmware upgrades on live systems, the ipmi_msghandler generates excessive "BMC returned incorrect response" warnings while the BMC is temporarily offline. This can flood system logs in large deployments. Replace dev_warn() with dev_warn_ratelimited() to throttle these warnings and prevent log spam during BMC maintenance operations. Signed-off-by: Breno Leitao Message-ID: <20250710-ipmi_ratelimit-v1-1-6d417015ebe9@debian.org> Signed-off-by: Corey Minyard commit ee2736848f1c9b64a9b1321d839f084ce80d4e66 Author: Yury Norov [NVIDIA] Date: Wed Jun 4 17:39:06 2025 -0400 cpuidle: dt: fix opencoded for_each_cpu() in idle_state_valid() The function opencodes the for_each_cpu_from() by using an open for-loop. Fix that in sake of readability. While there, drop the 'valid' variable as it's pretty useless here. Signed-off-by: Yury Norov [NVIDIA] Link: https://patch.msgid.link/20250604213908.27819-1-yury.norov@gmail.com Signed-off-by: Rafael J. Wysocki commit 26ff041e2a13cefe74b4533fd7bbff3114521422 Author: Lukas Bulwahn Date: Mon May 12 15:43:32 2025 +0200 MAINTAINERS: adjust file entry in INTEL STRATIX10 FIRMWARE DRIVERS Commit fbfb64987062 ("dt-bindings: firmware: stratix10: Convert to json-schema") renames intel,stratix10-svc.txt to intel,stratix10-svc.yaml in Documentation/devicetree/bindings/firmware/ as part of this dt-binding conversion, but misses to adjust the file entry in INTEL STRATIX10 FIRMWARE DRIVERS. Adjust the file entry after the conversion. Signed-off-by: Lukas Bulwahn Acked-by: Dinh Nguyen Link: https://lore.kernel.org/r/20250512134332.36366-1-lukas.bulwahn@redhat.com Signed-off-by: Rob Herring (Arm) commit 45e359be1ce88fb22e61fa3aa23b2e450a6cae03 Author: Jason Xing Date: Sat Jul 5 00:01:38 2025 +0800 net: xsk: introduce XDP_MAX_TX_SKB_BUDGET setsockopt This patch provides a setsockopt method to let applications leverage to adjust how many descs to be handled at most in one send syscall. It mitigates the situation where the default value (32) that is too small leads to higher frequency of triggering send syscall. Considering the prosperity/complexity the applications have, there is no absolutely ideal suggestion fitting all cases. So keep 32 as its default value like before. The patch does the following things: - Add XDP_MAX_TX_SKB_BUDGET socket option. - Set max_tx_budget to 32 by default in the initialization phase as a per-socket granular control. - Set the range of max_tx_budget as [32, xs->tx->nentries]. The idea behind this comes out of real workloads in production. We use a user-level stack with xsk support to accelerate sending packets and minimize triggering syscalls. When the packets are aggregated, it's not hard to hit the upper bound (namely, 32). The moment user-space stack fetches the -EAGAIN error number passed from sendto(), it will loop to try again until all the expected descs from tx ring are sent out to the driver. Enlarging the XDP_MAX_TX_SKB_BUDGET value contributes to less frequency of sendto() and higher throughput/PPS. Here is what I did in production, along with some numbers as follows: For one application I saw lately, I suggested using 128 as max_tx_budget because I saw two limitations without changing any default configuration: 1) XDP_MAX_TX_SKB_BUDGET, 2) socket sndbuf which is 212992 decided by net.core.wmem_default. As to XDP_MAX_TX_SKB_BUDGET, the scenario behind this was I counted how many descs are transmitted to the driver at one time of sendto() based on [1] patch and then I calculated the possibility of hitting the upper bound. Finally I chose 128 as a suitable value because 1) it covers most of the cases, 2) a higher number would not bring evident results. After twisting the parameters, a stable improvement of around 4% for both PPS and throughput and less resources consumption were found to be observed by strace -c -p xxx: 1) %time was decreased by 7.8% 2) error counter was decreased from 18367 to 572 [1]: https://lore.kernel.org/all/20250619093641.70700-1-kerneljasonxing@gmail.com/ Signed-off-by: Jason Xing Acked-by: Maciej Fijalkowski Link: https://patch.msgid.link/20250704160138.48677-1-kerneljasonxing@gmail.com Signed-off-by: Paolo Abeni commit b6d0427cfc699243fc1f82087b58f63d389321aa Author: Ilya Leoshkevich Date: Wed Jun 25 17:36:52 2025 +0200 scripts/gdb/symbols: make lx-symbols skip the s390 decompressor When one starts QEMU with the -S flag and attaches GDB, the kernel is not yet loaded, and the current instruction is an entry point to the decompressor. In case the intention is to debug the early kernel boot, and not the decompressor, e.g., put a breakpoint on some kernel function and see all the invocations, one has to skip the decompressor. There are many ways to do this, and so far people wrote private scripts or memorized certain command sequences. Make it work out of the box like this: $ gdb -ex 'target remote :6812' -ex 'source vmlinux-gdb.py' vmlinux Remote debugging using :6812 0x0000000000010000 in ?? () (gdb) lx-symbols loading vmlinux (gdb) x/i $pc => 0x3ffe0100000 : lghi %r2,0 Implement this by reading the address of the jump_to_kernel() function from the lowcore, and step until DAT is turned on. Signed-off-by: Ilya Leoshkevich Acked-by: Jan Kiszka Tested-by: Alexander Gordeev Link: https://lore.kernel.org/r/20250625154220.75300-3-iii@linux.ibm.com Signed-off-by: Alexander Gordeev commit 996f7f292b7e190138738bd9213616a544837a41 Author: Ilya Leoshkevich Date: Wed Jun 25 17:36:51 2025 +0200 s390/boot: Introduce jump_to_kernel() function Introduce a global function that jumps from the decompressor to the decompressed kernel. Put its address into svc_old_psw, from where GDB can take it without loading decompressor symbols. It should be available throughout the entire decompressor execution, because it's placed there statically, and nothing in the decompressor uses the SVC instruction. Acked-by: Heiko Carstens Signed-off-by: Ilya Leoshkevich Tested-by: Alexander Gordeev Link: https://lore.kernel.org/r/20250625154220.75300-2-iii@linux.ibm.com Signed-off-by: Alexander Gordeev commit b367017cdac21781a74eff4e208d3d38e1f38d3f Author: Sven Schnelle Date: Thu Jul 3 13:50:27 2025 +0200 s390/stp: Remove udelay from stp_sync_clock() When an stp sync check is handled on a system with multiple cpus each cpu gets a machine check but only the first one actually handles the sync operation. All other CPUs spin waiting for the first one to finish with a short udelay(). But udelay can't be used here as the first CPU modifies tod_clock_base before performing the sync op. During this timeframe get_tod_clock_monotonic() might return a non-monotonic time. The time spent waiting should be very short and udelay is a busy loop anyways, therefore simply remove the udelay. Reviewed-by: Heiko Carstens Signed-off-by: Sven Schnelle Signed-off-by: Alexander Gordeev commit f747cde5e71b1701a107c3a2e223e5b4a6cb4c52 Author: Tudor Ambarus Date: Wed Jul 9 12:31:16 2025 +0000 PM: sleep: add kernel parameter to disable asynchronous suspend/resume On some platforms, device dependencies are not properly represented by device links, which can cause issues when asynchronous power management is enabled. While it is possible to disable this via sysfs, doing so at runtime can race with the first system suspend event. This patch introduces a kernel command-line parameter, "pm_async", which can be set to "off" to globally disable asynchronous suspend and resume operations from early boot. It effectively provides a way to set the initial value of the existing pm_async sysfs knob at boot time. This offers a robust method to fall back to synchronous (sequential) operation, which can stabilize platforms with problematic dependencies and also serve as a useful debugging tool. The default behavior remains unchanged (asynchronous enabled). To disable it, boot the kernel with the "pm_async=off" parameter. Signed-off-by: Tudor Ambarus Acked-by: Randy Dunlap Link: https://patch.msgid.link/20250709-pm-async-off-v3-1-cb69a6fc8d04@linaro.org Signed-off-by: Rafael J. Wysocki commit 1fbe023d30da84d11299dfab496f40daae423940 Author: Michal Wajdeczko Date: Thu Jul 3 16:57:09 2025 +0200 drm/xe/pf: Print configuration KLVs using debug printer While we print VF's configuration KLVs only under DEBUG_SRIOV config, we should be doing it at debug level, not info level. Signed-off-by: Michal Wajdeczko Cc: Lukasz Laguna Reviewed-by: Lukasz Laguna Link: https://lore.kernel.org/r/20250703145709.1832-1-michal.wajdeczko@intel.com commit 89cd027c94ab8ede68f61920c84478c5becf07ca Author: Michal Wajdeczko Date: Wed Jun 4 21:00:20 2025 +0200 drm/xe/pf: Print runtime registers using debug printer While we already print VF's runtime registers only under DEBUG_SRIOV config, we should be still doing it at debug level, not info. Signed-off-by: Michal Wajdeczko Reviewed-by: Lukasz Laguna Link: https://lore.kernel.org/r/20250604190021.725-2-michal.wajdeczko@intel.com commit 01d40d3c146449e8538bfffc65e90bfbfc2a99e8 Author: Ulf Hansson Date: Thu Jul 10 12:26:56 2025 +0200 Documentation: power: Remove info about non-existing QoS interfaces cpu_latency_qos_add|remove_notifier() doesn't exist, hence let's drop the documentation of them. Signed-off-by: Ulf Hansson Link: https://patch.msgid.link/20250710102656.127654-1-ulf.hansson@linaro.org Signed-off-by: Rafael J. Wysocki commit 132b62280a9dbe38c627183ae7f1611de3ee0d9a Author: Andy Yan Date: Sun Jun 15 20:39:05 2025 +0800 clk: rockchip: rk3568: Add PLL rate for 132MHz Add PLL rate for 132 MHz to allow raydium-rm67200 panel with 1080x1920 resolution to run at 60 fps that driven by VPLL. Signed-off-by: Andy Yan Link: https://lore.kernel.org/r/20250615123922.661998-1-andyshrk@163.com Signed-off-by: Heiko Stuebner commit cee06ca7a6748f7d5d7ea40876dcbc0af26bf34e Author: Dan Carpenter Date: Wed Jun 25 10:22:32 2025 -0500 media: imx8mq-mipi-csi2: Fix error code in imx8mq_mipi_csi_parse_dt() This was returning IS_ERR() where PTR_ERR() was intended. Fixes: 642b70d526ab ("media: imx8mq-mipi-csi2: Add support for i.MX8QXP") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Reviewed-by: Laurent Pinchart Reviewed-by: Frank Li Reviewed-by: Rui Miguel Silva Link: https://lore.kernel.org/r/9b6c7925-c9c4-44bd-acd5-1ef0e698eb87@sabinyo.mountain Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit c9596e882032827a5c7f99a5ca481cd46251a473 Author: Niklas Söderlund Date: Sat Jul 5 10:37:41 2025 +0200 media: v4l2-subdev: Remove g_pixelaspect operation There are no consumers or implementations left in tree for the subdevice operation g_pixelaspect, delete it. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250705083741.77517-4-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 7dd0d6d15c29a78e3cef31546e3b12f3818b63ad Author: Niklas Söderlund Date: Sat Jul 5 10:37:40 2025 +0200 media: adv748x: Remove g_pixelaspect implementation There are no consumer left of g_pixelaspect in the tree, remove the implementation from the adv748x driver in preparation of removing it from struct v4l2_subdev_video_ops all together. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250705083741.77517-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 78c633ae02988688c80029b898ce334f3392cb42 Author: Niklas Söderlund Date: Sat Jul 5 10:37:39 2025 +0200 media: adv7180: Remove g_pixelaspect implementation There are no consumer left of g_pixelaspect in the tree, remove the implementation from the adv7180 driver in preparation of removing it from struct v4l2_subdev_video_ops all together. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250705083741.77517-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 145437cc545271e1fa3072ef9e899551547a9822 Author: Tomi Valkeinen Date: Fri May 30 16:50:30 2025 +0300 media: rcar-csi2: Use the pad version of v4l2_get_link_freq() The pad-aware version of v4l2_get_link_freq() tries to retrieve the link frequency from the media bus configuration using the get_mbus_config operation, and only if the subdevice does not implement this operation falls back to the old method of getting it using the V4L2_CID_LINK_FREQ or V4L2_CID_PIXEL_RATE control. Update the VIN driver to use the pad-aware version to be able to support subdevices that only provides the link frequency in the media bus configuration. As the implementation falls back to the old method if the subdevice doesn't support get_mbus_config, or doesn't provide a link frequency in the v4l2_mbus_config struct, this is fully backward compatible. Signed-off-by: Tomi Valkeinen Reviewed-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250530-rcar-streams-v3-1-026655df7138@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 4fdc3431e03b9c11803f399f91837fca487029a1 Author: Zheyun Shen Date: Thu May 22 16:37:28 2025 -0700 x86/lib: Add WBINVD and WBNOINVD helpers to target multiple CPUs Extract KVM's open-coded calls to do writeback caches on multiple CPUs to common library helpers for both WBINVD and WBNOINVD (KVM will use both). Put the onus on the caller to check for a non-empty mask to simplify the SMP=n implementation, e.g. so that it doesn't need to check that the one and only CPU in the system is present in the mask. [sean: move to lib, add SMP=n helpers, clarify usage] Signed-off-by: Zheyun Shen Signed-off-by: Sean Christopherson Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250128015345.7929-2-szy0127@sjtu.edu.cn Link: https://lore.kernel.org/20250522233733.3176144-5-seanjc@google.com commit 07f99c3fbe6e322bdb222fbfd59f708ced799cc5 Author: Kevin Loughlin Date: Thu May 22 16:37:27 2025 -0700 x86/lib: Add WBNOINVD helper functions In line with WBINVD usage, add WBNOINVD helper functions. Explicitly fall back to WBINVD (via alternative()) if WBNOINVD isn't supported even though the instruction itself is backwards compatible (WBNOINVD is WBINVD with an ignored REP prefix), so that disabling X86_FEATURE_WBNOINVD behaves as one would expect, e.g. in case there's a hardware issue that affects WBNOINVD. Opportunistically, add comments explaining the architectural behavior of WBINVD and WBNOINVD, and provide hints and pointers to uarch-specific behavior. Note, alternative() ensures compatibility with early boot code as needed. [ bp: Massage, fix typos, make export _GPL. ] Signed-off-by: Kevin Loughlin Co-developed-by: Sean Christopherson Signed-off-by: Sean Christopherson Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Reviewed-by: Kai Huang Acked-by: Ingo Molnar Link: https://lore.kernel.org/20250522233733.3176144-4-seanjc@google.com commit e638081751a292560a8aed36ec72e8f65b057892 Author: Sean Christopherson Date: Thu May 22 16:37:26 2025 -0700 x86/lib: Drop the unused return value from wbinvd_on_all_cpus() Drop wbinvd_on_all_cpus()'s return value; both the "real" version and the stub always return '0', and none of the callers check the return. Signed-off-by: Sean Christopherson Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250522233733.3176144-3-seanjc@google.com commit b30d390812c8559c5835f8ae5f490b38488fafc8 Author: Michael Walle Date: Thu Jul 3 13:31:53 2025 +0200 regulator: tps6594-regulator: Add TI TPS652G1 PMIC regulators The TI TPS652G1 is a stripped down version of the TPS65224 PMIC. It doesn't feature the multiphase buck converter nor any voltage monitoring. Due to the latter there are no interrupts serviced. In case of the TPS652G1 any interrupt related setup is just skipped. Signed-off-by: Michael Walle Acked-by: Mark Brown Link: https://patch.msgid.link/20250703113153.2447110-9-mwalle@kernel.org Signed-off-by: Mark Brown commit e64ee27abfe1e9baea14b31c0a6b6bf93ac8652c Author: Michael Walle Date: Thu Jul 3 13:31:52 2025 +0200 regulator: tps6594-regulator: refactor variant descriptions Instead of using conditionals or tri state operators throughout the .probe() provide a description per variant. This will make it much easier to add new variants later. While at it, make the variable naming more consistent. This patch is only compile-time tested. Signed-off-by: Michael Walle Acked-by: Mark Brown Link: https://patch.msgid.link/20250703113153.2447110-8-mwalle@kernel.org Signed-off-by: Mark Brown commit 180a135eafa9e05657559bb04cc9eb6a86ca45f3 Author: Michael Walle Date: Thu Jul 3 13:31:51 2025 +0200 regulator: tps6594-regulator: remove hardcoded buck config Commit 00c826525fba ("regulator: tps6594-regulator: Add TI TPS65224 PMIC regulators") added support for the TPS65224 and made the description of the multi-phase buck converter variable depending on the variant of the PMIC. But this was just done for MUTLI_BUCK12 and MULTI_BUCK12_34 configs probably because this variant only supports a multi-phase configuration on buck 1 and 2. Remove the hardcoded value for the remaining two configs, too as future PMIC variants might also support these. This is a preparation patch to refactor the regulator description and is compile-time only tested. Signed-off-by: Michael Walle Acked-by: Mark Brown Link: https://patch.msgid.link/20250703113153.2447110-7-mwalle@kernel.org Signed-off-by: Mark Brown commit 16d1a9bf36ef649b1fdb866985b4b87584491fac Author: Michael Walle Date: Thu Jul 3 13:31:50 2025 +0200 regulator: tps6594-regulator: remove interrupt_count In .probe() interrupt_count and nr_types is essentially the same. It contains the number of different interrupt per LDO or buck converter. Drop one. This is a preparation patch to further simplify the handling of different variants of this PMIC. This patch is only compile-time tested. Signed-off-by: Michael Walle Acked-by: Mark Brown Link: https://patch.msgid.link/20250703113153.2447110-6-mwalle@kernel.org Signed-off-by: Mark Brown commit 1d738dbb252f66dd909a662d85c67b93314d7ae7 Author: Sean Christopherson Date: Thu May 22 16:37:25 2025 -0700 drm/gpu: Remove dead checks on wbinvd_on_all_cpus()'s return value Remove the checks and associated pr_err() on wbinvd_on_all_cpus() failure, as the helper has unconditionally returned 0/success since commit caa759323c73 ("smp: Remove smp_call_function() and on_each_cpu() return values"). Signed-off-by: Sean Christopherson Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250522233733.3176144-2-seanjc@google.com commit 0c1ff10328213b894a2468c979ff4469c8f71f24 Merge: 5054740e0092aa d90171bc2e5f69 Author: Mark Brown Date: Thu Jul 10 12:05:59 2025 +0100 regulator: Merge tps6594 driver changes This will be needed to add support for TPS652G1 which also has regulator dependencies. commit d90171bc2e5f69c038d1807e6f64fba3d1ad6bee Author: Michael Walle Date: Thu Jul 3 13:31:46 2025 +0200 dt-bindings: mfd: ti,tps6594: Add TI TPS652G1 PMIC The TPS652G1 is a stripped down version of the TPS65224. From a software point of view, it lacks any voltage monitoring, the watchdog, the ESM and the ADC. Signed-off-by: Michael Walle Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250703113153.2447110-2-mwalle@kernel.org Signed-off-by: Lee Jones commit 95703a099e094c00a0714f4d6fa6d9f142ff3fda Author: Sakari Ailus Date: Mon Jun 23 10:06:19 2025 +0300 media: ivsc: Add MAINTAINERS entry The IVSC drivers seem to have never had a MAINTAINERS entry so add one now. Signed-off-by: Sakari Ailus Acked-by: Zhang Lixu Acked-by: Bingbu Cao Signed-off-by: Hans Verkuil commit eb6ab8a997ad7425d118fb73d327dac7456b3621 Author: Arnd Bergmann Date: Wed Jul 9 16:57:31 2025 +0200 media: staging/ipu7: add CONFIG_PCI dependency This driver fails to build when PCI is disabled: drivers/staging/media/ipu7/ipu7.c: In function 'ipu7_pci_config_setup': drivers/staging/media/ipu7/ipu7.c:2260:15: error: implicit declaration of function 'pci_enable_msi'; did you mean 'pci_enable_sriov'? [-Wimplicit-function-declaration] drivers/staging/media/ipu7/ipu7.c:2775:1: error: data definition has no type or storage class [-Werror] driver(ipu7_pci_driver); drivers/staging/media/ipu7/ipu7.c:2764:26: error: 'ipu7_pci_driver' defined but not used [-Werror=unused-variable] Add the required Kconfig dependency. Signed-off-by: Arnd Bergmann Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 6af7e00a92e04e0ea41bbe4b83deac9bb11fe4c5 Author: Arnd Bergmann Date: Wed Jul 9 16:56:56 2025 +0200 media: staging/ipu7: avoid division by 64-bit value On 32-bit targets, this causes a link failure: x86_64-linux-ld: drivers/staging/media/ipu7/ipu7-isys-csi-phy.o: in function `ipu7_isys_phy_config': ipu7-isys-csi-phy.c:(.text+0x1509): undefined reference to `__udivdi3' Note that this does not divide a 64-bit number by a 32-bit one as usual, but the other way round, which is something that the compiler should really be able to figure out but does not (as of gcc-15). A few lines higher, a similar division is done using the incorrect div_u64() that truncates the 64-bit divisor to 32 bits. Change both to use the safe but slow div64_u64() helper. Fixes: a516d36bdc3d ("media: staging/ipu7: add IPU7 input system device driver") Signed-off-by: Arnd Bergmann Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2946bac895e3f1d9a1a97a726339ed3e4d439d19 Author: Niklas Söderlund Date: Thu Jul 3 23:42:06 2025 +0200 media: i2c: imx290: Remove unneeded assignment of subdev device pointer The core helper v4l2_i2c_subdev_init() already assignees the subdevices dev pointer to the device associated with the i2c client passed to it. And 'imx290->dev' is assigned to '&client->dev' already in probe before calling imx290_subdev_init(). Remove the duplicated open-coded assignment in the driver, there is no reason to do it twice. Signed-off-by: Niklas Söderlund Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 76142b137b968d47b35cdd8d1dc924677d319c8b Author: Zhang Shurong Date: Sun Jul 6 00:31:09 2025 +0800 media: ov2659: Fix memory leaks in ov2659_probe() ov2659_probe() doesn't properly free control handler resources in failure paths, causing memory leaks. Add v4l2_ctrl_handler_free() to prevent these memory leaks and reorder the ctrl_handler assignment for better code flow. Fixes: c4c0283ab3cd ("[media] media: i2c: add support for omnivision's ov2659 sensor") Cc: stable@vger.kernel.org Signed-off-by: Zhang Shurong Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit ae42c6fe531425ef2f47e82f96851427d24bbf6b Author: Julien Massot Date: Mon Jun 30 12:46:43 2025 +0200 media: ti: j721e-csi2rx: fix list_del corruption If ti_csi2rx_start_dma() fails in ti_csi2rx_dma_callback(), the buffer is marked done with VB2_BUF_STATE_ERROR but is not removed from the DMA queue. This causes the same buffer to be retried in the next iteration, resulting in a double list_del() and eventual list corruption. Fix this by removing the buffer from the queue before calling vb2_buffer_done() on error. This resolves a crash due to list_del corruption: [ 37.811243] j721e-csi2rx 30102000.ticsi2rx: Failed to queue the next buffer for DMA [ 37.832187] slab kmalloc-2k start ffff00000255b000 pointer offset 1064 size 2048 [ 37.839761] list_del corruption. next->prev should be ffff00000255bc28, but was ffff00000255d428. (next=ffff00000255b428) [ 37.850799] ------------[ cut here ]------------ [ 37.855424] kernel BUG at lib/list_debug.c:65! [ 37.859876] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP [ 37.866061] Modules linked in: i2c_dev usb_f_rndis u_ether libcomposite dwc3 udc_core usb_common aes_ce_blk aes_ce_cipher ghash_ce gf128mul sha1_ce cpufreq_dt dwc3_am62 phy_gmii_sel sa2ul [ 37.882830] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.16.0-rc3+ #28 VOLUNTARY [ 37.890851] Hardware name: Bosch STLA-GSRV2-B0 (DT) [ 37.895737] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 37.902703] pc : __list_del_entry_valid_or_report+0xdc/0x114 [ 37.908390] lr : __list_del_entry_valid_or_report+0xdc/0x114 [ 37.914059] sp : ffff800080003db0 [ 37.917375] x29: ffff800080003db0 x28: 0000000000000007 x27: ffff800080e50000 [ 37.924521] x26: 0000000000000000 x25: ffff0000016abb50 x24: dead000000000122 [ 37.931666] x23: ffff0000016abb78 x22: ffff0000016ab080 x21: ffff800080003de0 [ 37.938810] x20: ffff00000255bc00 x19: ffff00000255b800 x18: 000000000000000a [ 37.945956] x17: 20747562202c3832 x16: 6362353532303030 x15: 0720072007200720 [ 37.953101] x14: 0720072007200720 x13: 0720072007200720 x12: 00000000ffffffea [ 37.960248] x11: ffff800080003b18 x10: 00000000ffffefff x9 : ffff800080f5b568 [ 37.967396] x8 : ffff800080f5b5c0 x7 : 0000000000017fe8 x6 : c0000000ffffefff [ 37.974542] x5 : ffff00000fea6688 x4 : 0000000000000000 x3 : 0000000000000000 [ 37.981686] x2 : 0000000000000000 x1 : ffff800080ef2b40 x0 : 000000000000006d [ 37.988832] Call trace: [ 37.991281] __list_del_entry_valid_or_report+0xdc/0x114 (P) [ 37.996959] ti_csi2rx_dma_callback+0x84/0x1c4 [ 38.001419] udma_vchan_complete+0x1e0/0x344 [ 38.005705] tasklet_action_common+0x118/0x310 [ 38.010163] tasklet_action+0x30/0x3c [ 38.013832] handle_softirqs+0x10c/0x2e0 [ 38.017761] __do_softirq+0x14/0x20 [ 38.021256] ____do_softirq+0x10/0x20 [ 38.024931] call_on_irq_stack+0x24/0x60 [ 38.028873] do_softirq_own_stack+0x1c/0x40 [ 38.033064] __irq_exit_rcu+0x130/0x15c [ 38.036909] irq_exit_rcu+0x10/0x20 [ 38.040403] el1_interrupt+0x38/0x60 [ 38.043987] el1h_64_irq_handler+0x18/0x24 [ 38.048091] el1h_64_irq+0x6c/0x70 [ 38.051501] default_idle_call+0x34/0xe0 (P) [ 38.055783] do_idle+0x1f8/0x250 [ 38.059021] cpu_startup_entry+0x34/0x3c [ 38.062951] rest_init+0xb4/0xc0 [ 38.066186] console_on_rootfs+0x0/0x6c [ 38.070031] __primary_switched+0x88/0x90 [ 38.074059] Code: b00037e0 91378000 f9400462 97e9bf49 (d4210000) [ 38.080168] ---[ end trace 0000000000000000 ]--- [ 38.084795] Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt [ 38.092197] SMP: stopping secondary CPUs [ 38.096139] Kernel Offset: disabled [ 38.099631] CPU features: 0x0000,00002000,02000801,0400420b [ 38.105202] Memory Limit: none [ 38.108260] ---[ end Kernel panic - not syncing: Oops - BUG: Fatal exception in interrupt ]--- Fixes: b4a3d877dc92 ("media: ti: Add CSI2RX support for J721E") Cc: stable@vger.kernel.org Suggested-by: Sjoerd Simons Signed-off-by: Sjoerd Simons Signed-off-by: Julien Massot Reviewed-by: Jai Luthra Tested-by: Dirk Behme Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 020f602b068c9ce18d5056d02c8302199377d98d Author: Bingbu Cao Date: Mon Jun 30 17:04:20 2025 +0800 media: hi556: correct the test pattern configuration Hynix hi556 support 8 test pattern modes: hi556_test_pattern_menu[] = { { "Disabled", "Solid Colour", "100% Colour Bars", "Fade To Grey Colour Bars", "PN9", "Gradient Horizontal", "Gradient Vertical", "Check Board", "Slant Pattern", } The test pattern is set by a 8-bit register according to the specification. +--------+-------------------------------+ | BIT[0] | Solid color | +--------+-------------------------------+ | BIT[1] | Color bar | +--------+-------------------------------+ | BIT[2] | Fade to grey color bar | +--------+-------------------------------+ | BIT[3] | PN9 | +--------+-------------------------------+ | BIT[4] | Gradient horizontal | +--------+-------------------------------+ | BIT[5] | Gradient vertical | +--------+-------------------------------+ | BIT[6] | Check board | +--------+-------------------------------+ | BIT[7] | Slant pattern | +--------+-------------------------------+ Based on function above, current test pattern programming is wrong. This patch fixes it by 'BIT(pattern - 1)'. If pattern is 0, driver will disable the test pattern generation and set the pattern to 0. Fixes: e62138403a84 ("media: hi556: Add support for Hi-556 sensor") Cc: stable@vger.kernel.org Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 871a99ff4d726485eefa6ab55bc84a72ef219e6a Author: Hans de Goede Date: Thu Jul 3 17:03:15 2025 +0200 media: i2c: Automatically select common options for lens drivers In commit 7d3c7d2a2914 ("media: i2c: Add a camera sensor top level menu") a top level menu was added for sensor drivers so that all sensor drivers would depend on I2C and so that MEDIA_CONTROLLER, V4L2_FWNODE and VIDEO_V4L2_SUBDEV_API would be automatically selected for all sensor drivers. All lens drivers must depend on I2C and VIDEO_DEV and must select MEDIA_CONTROLLER, V4L2_FWNODE and VIDEO_V4L2_SUBDEV_API and most already do, but e.g. VIDEO_V4L2_SUBDEV_API is not consistenly selected. Change the "Lens drivers" menu into a menuconfig option with the necessary depends and selects. This ensures that these options are depended on / selected consistently and simplifies the Kconfig snippets for the various lens voice coil drivers. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202411061152.VKd9JYpa-lkp@intel.com/ Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 375fc903e57cb3ca4d2d5408de98d6369d4c8334 Author: Hans de Goede Date: Sat May 31 21:05:34 2025 +0200 media: hi556: Support full range of power rails Use regulator_bulk_* to get the array of potential power rails for the hi556. Previously the driver only supported avdd as only avdd is used on IPU6 designs. But other designs may also need the driver to control the other power rails and the new INT3472 handshake support also makes use of dvdd on IPU6 designs. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2368506 Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 99f2211a9d89fe34b3fa847fd7a4475171406cd0 Author: Hans de Goede Date: Sat May 31 21:05:33 2025 +0200 media: hi556: Fix reset GPIO timings probe() requests the reset GPIO to be set to high when getting it. Immeditately after this hi556_resume() is called and sets the GPIO low. If the GPIO was low before requesting it this will result in the GPIO only very briefly spiking high and the sensor not being properly reset. The same problem also happens on back to back runtime suspend + resume. Fix this by adding a sleep of 2 ms in hi556_resume() before setting the GPIO low (if there is a reset GPIO). The final sleep is kept unconditional, because if there is e.g. no reset GPIO but a controllable clock then the sensor also needs some time after enabling the clock. Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 00e0b9455fb4c74fc777289a129f646b4cb112f8 Author: Mehdi Djait Date: Mon Jun 23 15:51:16 2025 +0200 media: v4l2-common: Add the missing Raw Bayer pixel formats Add the Raw Bayer pixel formats infos for: 10-bit packed Bayer formats 12-bit packed Bayer formats 14-bit Bayer formats 14-bit packed Bayer formats 16-bit Bayer formats Signed-off-by: Mehdi Djait Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 1fff2ee377e1c2230054e65092def460dd40b587 Author: Mehdi Djait Date: Mon Jun 23 15:51:15 2025 +0200 media: uapi: videodev2: Fix comment for 12-bit packed Bayer formats For 12-bit packed Bayer formats: every two consecutive samples are packed into three bytes. Fix the corresponding comment. Signed-off-by: Mehdi Djait Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2260d1fa5d0e7967d6596e26bc39d46200cede0c Author: Devarsh Thakkar Date: Wed Mar 12 16:51:40 2025 +0530 media: ti: j721e-csi2rx: Allow passing cache hints from user-space User-space can provide cache hints to enable software managed cache operations or skip certain cache operations using memory flags and buffer flags. This is useful for SoCs such as AM62px which do not support hardware cache coherency. This is tested on AM62px with yavta capture by passing V4L2_MEMORY_FLAG_NON_COHERENT while using VIDIOC_REQBUFS and V4L2_BUF_FLAG_NO_CACHE_CLEAN while using VIDIOC_QBUF and ~5x reduction in memcpy time is seen for copying captured frame to DDR. Link: https://e2e.ti.com/support/processors-group/processors/f/processors-forum/1452545/am62p-the-ads6311-radar-camera-has-lost-frame-capture/5580472#5580472 Signed-off-by: Devarsh Thakkar Acked-by: Jai Luthra [Sakari Ailus: Reword and rewrap the commit message a little.] Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 9f2d0da9b8c3477cd5ed4e1ed1e58bb44184561b Author: Yemike Abhilash Chandra Date: Wed Apr 16 17:49:38 2025 +0530 media: cadence: csi2rx: Enable csi2rx_err_irq interrupt and add support for VIDIOC_LOG_STATUS Enable the csi2rx_err_irq interrupt to record any errors during streaming and also add support for VIDIOC_LOG_STATUS ioctl. This allows users to retrieve detailed error information during streaming, including FIFO overflow, packet errors, and ECC errors. Signed-off-by: Yemike Abhilash Chandra Reviewed-by: Changhuang Liang Tested-by: Jai Luthra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit afba5eaf69c1aad199638d830af9c2eb3f8c2e6e Author: Yemike Abhilash Chandra Date: Wed Apr 16 17:49:37 2025 +0530 dt-bindings: media: cdns,csi2rx.yaml: Add optional interrupts for cdns-csi2rx The Cadence CSI2RX IP exposes 2 interrupts [0] 12.7 camera subsystem. So, add support for optional interrupts and interrupt-names properties. [0]: http://www.ti.com/lit/pdf/spruil1 Acked-by: Krzysztof Kozlowski Reviewed-by: Jai Luthra Signed-off-by: Yemike Abhilash Chandra Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 0bb005ac7268cc414bc216ad78adb63c281fc862 Author: Sakari Ailus Date: Wed Jun 4 00:57:57 2025 +0300 media: v4l2-subdev: Add debug prints to v4l2_subdev_collect_streams() Print streams found by v4l2_subdev_collect_streams() at debug level. This could be useful in debugging drivers, userspace programs or the framework itself. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit f98691668ecd644ce63d20d8dd7baf892a6b873d Author: Sakari Ailus Date: Wed Jun 4 00:32:36 2025 +0300 media: v4l2-subdev: Print early in v4l2_subdev_{enable,disable}_streams() Print debug messages early in v4l2_subdev_enable_streams() and v4l2_subdev_disable_streams(), before sanity checks take place. This can help figuring out why something goes wrong, in driver development or otherwise. Also print the name of the sub-device where streaming is to be enabled or disabled. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 7a8212f3bcfab753602599da644fb5bdeaf8ff2d Author: Sakari Ailus Date: Wed Jun 11 15:40:42 2025 +0300 media: v4l: Make media_entity_to_video_device() NULL-safe Make media_entity_to_video_device(NULL) return NULL, instead of an invalid pointer value. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 09ef95213880e32dc0e9612bae023e61c69b392e Author: Sakari Ailus Date: Fri May 9 18:47:36 2025 +0300 media: ipu6: isys: Set minimum height to 1 For image data generally 2 seems like a minimum height that surely won't cause any issues, but some sensors have metadata the height of which is just one line. Set the minimum height to 1. Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit ff49672a28f3a856717f09d61380e524e243121f Author: Sakari Ailus Date: Tue Jun 3 00:08:51 2025 +0300 media: ipu6: isys: Use correct pads for xlate_streams() The pad argument to v4l2_subdev_state_xlate_streams() is incorrect, static pad number is used for the source pad even though the pad number is dependent on the stream. Fix it. Fixes: 3a5c59ad926b ("media: ipu6: Rework CSI-2 sub-device streaming control") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit fe69a391808404977b1f002a6e7447de3de7a88e Author: Simona Vetter Date: Wed Jul 9 15:52:20 2025 +0200 drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code The object is potentially already gone after the drm_gem_object_put(). In general the object should be fully constructed before calling drm_gem_handle_create(), except the debugfs tracking uses a separate lock and list and separate flag to denotate whether the object is actually initialized. Since I'm touching this all anyway simplify this by only adding the object to the debugfs when it's ready for that, which allows us to delete that separate flag. panthor_gem_debugfs_bo_rm() already checks whether we've actually been added to the list or this is some error path cleanup. v2: Fix build issues for !CONFIG_DEBUGFS (Adrián) v3: Add linebreak and remove outdated comment (Liviu) Fixes: a3707f53eb3f ("drm/panthor: show device-wide list of DRM GEM objects over DebugFS") Cc: Adrián Larumbe Cc: Boris Brezillon Cc: Steven Price Cc: Liviu Dudau Reviewed-by: Liviu Dudau Signed-off-by: Simona Vetter Signed-off-by: Simona Vetter Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250709135220.1428931-1-simona.vetter@ffwll.ch commit e2fe8ad8f1e62c424b8b73cc89d1bc53d19c41b2 Author: Sebastian Reichel Date: Fri Jul 4 19:14:14 2025 +0200 arm64: dts: rockchip: Enable HDMI receiver on RK3588 EVB1 Enable HDMI input port of the RK3588 EVB1. Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250704-rk3588-evb1-hdmi-rx-v1-1-248315c36ccd@kernel.org Signed-off-by: Heiko Stuebner commit cd803da7c033e376a66793a43ee98e136bc6cc25 Author: Sebastian Reichel Date: Fri Jul 4 19:31:59 2025 +0200 arm64: dts: rockchip: fix PHY handling for ROCK 4D Old revisions of the ROCK 4D board have a dedicated crystal to supply the RTL8211F PHY's 25MHz clock input. At least some newer revisions instead use REFCLKO25M_GMAC0_OUT. The DT already has this half-prepared, but there are some issues: 1. The DT relies on auto-selecting the right PHY driver, which requires that it works good enough to read the ID registers. This does not work without the clock, which is handled by the PHY driver. By updating the compatible to contain the RTL8211F IDs, so that the operating system can choose the right PHY driver without relying on a pre-powered PHY. 2. Despite the name REFCLKO25M_GMAC0_OUT could also provide a different frequency, so ensure it is explicitly set to 25 MHz as expected by the PHY. 3. While at it switch from deprecated "enable-gpio" to standard "enable-gpios". Fixes: a0fb7eca9c09 ("arm64: dts: rockchip: Add Radxa ROCK 4D device tree") Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250704-rk3576-rock4d-phy-handling-fixes-v1-1-1d64130c4139@kernel.org Signed-off-by: Heiko Stuebner commit f6420de1c810e282c34de65c70e6cc6177c12394 Author: Michael Walle Date: Fri Jun 13 13:45:14 2025 +0200 pinctrl: pinctrl-tps6594: Add TPS652G1 PMIC pinctrl and GPIO The TPS652G1 is a stripped down version of the TPS65224. Compared to the TPS65224 it lacks some pin mux functions, like the ADC, voltage monitoring and the second I2C bus. Signed-off-by: Michael Walle Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250613114518.1772109-4-mwalle@kernel.org Signed-off-by: Lee Jones commit 9cba6a7ebf65c603b80c0b3c7fa8c7c03f1b704c Author: Michael Walle Date: Fri Jun 13 13:45:13 2025 +0200 misc: tps6594-pfsm: Add TI TPS652G1 PMIC PFSM The TPS652G1 is a stripped down TPS65224, but the PFSM is the same. Thus, handle it the same way as the TPS65224 in the driver. Signed-off-by: Michael Walle Acked-by: Arnd Bergmann # drivers/misc/ Link: https://lore.kernel.org/r/20250613114518.1772109-3-mwalle@kernel.org Signed-off-by: Lee Jones commit 626bb0a45584d544d84eab909795ccb355062bcc Author: Michael Walle Date: Fri Jun 13 13:45:12 2025 +0200 mfd: tps6594: Add TI TPS652G1 support The TPS652G1 is a stripped down version of the TPS65224. From a software point of view, it lacks any voltage monitoring, the watchdog, the ESM and the ADC. Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20250613114518.1772109-2-mwalle@kernel.org Signed-off-by: Lee Jones commit 06b29cb849bc0437edd68373a1e8152f0bcd30e7 Author: Andy Yan Date: Sun Jul 6 19:38:24 2025 +0800 arm64: dts: rockchip: Enable mipi dsi on rk3568-evb1-v10 Enable the w552793baa 1080x1920 dsi panel on rk3568 evb1. Signed-off-by: Andy Yan Link: https://lore.kernel.org/r/20250706113831.330799-1-andyshrk@163.com Signed-off-by: Heiko Stuebner commit 00abee2b18342d6c2f6f37225682fa7ca0d33142 Author: Detlev Casanova Date: Tue Jul 8 11:50:10 2025 -0400 arm64: dts: rockchip: Add UFS support on the ROCK 4D This device supports removable UFS chips, add support for it. Signed-off-by: Detlev Casanova Link: https://lore.kernel.org/r/20250708155010.401446-1-detlev.casanova@collabora.com Signed-off-by: Heiko Stuebner commit 25a36912dc4456c519858179997e5375e76d6104 Author: Sergio Perez Gonzalez Date: Mon Jul 7 12:55:41 2025 -0600 mmc: loongson2: prevent integer overflow in ret variable In loongson2_mmc_dll_mode_init(), `ret` variable is declared as u32 but it is expected to hold an int value. Fixes: d0f8e961deae ("mmc: loongson2: Add Loongson-2K2000 SD/SDIO/eMMC controller driver") Reported-by: https://scan7.scan.coverity.com/#/project-view/53936/11354?selectedIssue=1644958 Signed-off-by: Sergio Perez Gonzalez Reviewed-by: Binbin Zhou Link: https://lore.kernel.org/r/20250707185545.46275-1-sperezglz@gmail.com Signed-off-by: Ulf Hansson commit 7d61715c58a39edc5f74fc7366487726fc223530 Author: Geert Uytterhoeven Date: Wed Jul 9 21:02:09 2025 +0200 spi: rspi: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas RSPI/QSPI driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the check for CONFIG_PM_SLEEP without impacting code size, while increasing build coverage. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/0b64c1c3803e6d3eeb3ae9cd8921d4fe67f37118.1752087701.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit 3106db4ead939a70d332a66214eccce6805b991f Author: Geert Uytterhoeven Date: Wed Jul 9 21:02:33 2025 +0200 spi: sh-msiof: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the Renesas SuperH MSIOF driver from SIMPLE_DEV_PM_OPS() to DEFINE_SIMPLE_DEV_PM_OPS() and pm_sleep_ptr(). This lets us drop the check for CONFIG_PM_SLEEP without impacting code size, while increasing build coverage. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/108c136f2cab9aa8bc8ac90d14a05e66fb87deb0.1752087740.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit 469d7ea8e99124e4def5d98f928ffb4a659aa1c8 Author: Darshan Rathod Date: Thu Jul 10 04:50:57 2025 +0000 spi: xilinx: Fix block comment style and minor cleanups This patch fixes block comment style issues and minor code cleanups as reported by checkpatch.pl. Signed-off-by: Darshan Rathod Link: https://patch.msgid.link/20250710045058.1325-1-darshanrathod475@gmail.com Signed-off-by: Mark Brown commit 25f4e1d7193d1438715bb0f05b6aa8df3f7b434f Author: Thorsten Blum Date: Thu Jul 3 19:19:34 2025 +0200 crypto: zstd - replace zero-length array with flexible array member Replace the deprecated zero-length array with a modern flexible array member in the struct zstd_ctx. No functional changes intended. Link: https://github.com/KSPP/linux/issues/78 Signed-off-by: Thorsten Blum Reviewed-by: Kees Cook Signed-off-by: Herbert Xu commit 03ba056e63d3b2d3774c7a8cf40f5a31b968b612 Author: Suman Kumar Chakraborty Date: Mon Jun 30 10:24:18 2025 +0100 crypto: zstd - fix duplicate check warning Fix the following warnings reported by the static analyzer Smatch: crypto/zstd.c:273 zstd_decompress() warn: duplicate check 'scur' (previous on line 235) Fixes: f5ad93ffb541 ("crypto: zstd - convert to acomp") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-crypto/92929e50-5650-40be-8c0a-de81e77f0acf@sabinyo.mountain/ Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 76fdb7eb4e1c91086ce9c3db6972c2ed48c96afb Author: Aleksa Sarai Date: Tue Jul 8 23:21:51 2025 +1000 uapi: export PROCFS_ROOT_INO The root inode of /proc having a fixed inode number has been part of the core kernel ABI since its inception, and recently some userspace programs (mainly container runtimes) have started to explicitly depend on this behaviour. The main reason this is useful to userspace is that by checking that a suspect /proc handle has fstype PROC_SUPER_MAGIC and is PROCFS_ROOT_INO, they can then use openat2(RESOLVE_{NO_{XDEV,MAGICLINK},BENEATH}) to ensure that there isn't a bind-mount that replaces some procfs file with a different one. This kind of attack has lead to security issues in container runtimes in the past (such as CVE-2019-19921) and libraries like libpathrs[1] use this feature of procfs to provide safe procfs handling functions. There was also some trailing whitespace in the "struct proc_dir_entry" initialiser, so fix that up as well. [1]: https://github.com/openSUSE/libpathrs Signed-off-by: Aleksa Sarai Link: https://lore.kernel.org/20250708-uapi-procfs-root-ino-v1-1-6ae61e97c79b@cyphar.com Signed-off-by: Christian Brauner commit 3bc4e4410830d556b0f40dfa6671bfcaeacc1599 Author: Jan Kara Date: Wed Jul 9 11:06:36 2025 +0200 vfs: Remove unnecessary list_for_each_entry_safe() from evict_inodes() evict_inodes() uses list_for_each_entry_safe() to iterate sb->s_inodes list. However, since we use i_lru list entry for our local temporary list of inodes to destroy, the inode is guaranteed to stay in sb->s_inodes list while we hold sb->s_inode_list_lock. So there is no real need for safe iteration variant and we can use list_for_each_entry() just fine. Signed-off-by: Jan Kara Link: https://lore.kernel.org/20250709090635.26319-2-jack@suse.cz Reviewed-by: Matthew Wilcox (Oracle) Signed-off-by: Christian Brauner commit 22c2ed6996ac34df506040a069fac3e5100b5c0e Author: Brian Norris Date: Wed Jul 2 16:52:00 2025 -0700 checkpatch: check for missing sentinels in ID arrays All of the ID tables based on (of_device_id, pci_device_id, ...) require their arrays to end in an empty sentinel value. That's usually spelled with an empty initializer entry (e.g., "{}"), but also sometimes with explicit 0 entries, field initializers (e.g., '.id = ""'), or even a macro entry (like PCMCIA_DEVICE_NULL). Without a sentinel, device-matching code may read out of bounds. I've found a number of such bugs in driver reviews, and we even occasionally commit one to the tree. See commit 5751eee5c620 ("i2c: nomadik: Add missing sentinel to match table") for example. Teach checkpatch to find these ID tables, and complain if it looks like there wasn't a sentinel value. Test output: $ git format-patch -1 a0d15cc47f29be6d --stdout | scripts/checkpatch.pl - ERROR: missing sentinel in ID array #57: FILE: drivers/i2c/busses/i2c-nomadik.c:1073: +static const struct of_device_id nmk_i2c_eyeq_match_table[] = { { .compatible = "XXXXXXXXXXXXXXXXXX", .data = (void *)(NMK_I2C_EYEQ_FLAG_32B_BUS | NMK_I2C_EYEQ_FLAG_IS_EYEQ5), }, }; total: 1 errors, 0 warnings, 66 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. "[PATCH] i2c: nomadik: switch from of_device_is_compatible() to" has style problems, please review. NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. When run across the entire tree (scripts/checkpatch.pl -q --types MISSING_SENTINEL -f ...), false positives exist: * where macros are used that hide the table from analysis (e.g., drivers/gpu/drm/radeon/radeon_drv.c / radeon_PCI_IDS). There are fewer than 5 of these. * where such tables are processed correctly via ARRAY_SIZE() (fewer than 5 instances). This is by far not the typical usage of *_device_id arrays. * some odd parsing artifacts, where ctx_statement_block() seems to quit in the middle of a block due to #if/#else/#endif. Also, not every "struct *_device_id" is in fact a sentinel-requiring structure, but even with such types, false positives are very rare. Link: https://lkml.kernel.org/r/20250702235245.1007351-1-briannorris@chromium.org Signed-off-by: Brian Norris Acked-by: Joe Perches Cc: Andy Whitcroft Cc: Brian Norris Cc: Dwaipayan Ray Cc: Lukas Bulwahn Signed-off-by: Andrew Morton commit 1f04e0e65209be3148a20b4b370e01d02b7ac445 Author: Moon Hee Lee Date: Mon Jun 23 11:34:06 2025 -0700 selftests: ptrace: add set_syscall_info to .gitignore Add the set_syscall_info test binary to .gitignore to avoid tracking build artifacts in the ptrace selftests directory. Link: https://lkml.kernel.org/r/20250623183405.133434-2-moonhee.lee.ca@gmail.com Signed-off-by: Moon Hee Lee Cc: "Dmitry V. Levin" Cc: Oleg Nesterov Cc: Shuah Khan Signed-off-by: Andrew Morton commit d0118d7d20bbf9a76f75840bc3b0da0f4d092da9 Author: Tetsuo Handa Date: Mon Jun 30 19:21:31 2025 +0900 ocfs2: update d_splice_alias() return code checking When commit d3556babd7fa ("ocfs2: fix d_splice_alias() return code checking") was merged into v3.18-rc3, d_splice_alias() was returning one of a valid dentry, NULL or an ERR_PTR. When commit b5ae6b15bd73 ("merge d_materialise_unique() into d_splice_alias()") was merged into v3.19-rc1, d_splice_alias() started returning -ELOOP as one of ERR_PTR values. Now, when syzkaller mounts a crafted ocfs2 filesystem image that hits d_splice_alias() == -ELOOP case from ocfs2_lookup(), ocfs2_lookup() fails to handle -ELOOP case and generic_shutdown_super() hits "VFS: Busy inodes after unmount" message. Instead of calling ocfs2_dentry_attach_lock() or ocfs2_dentry_attach_gen() when d_splice_alias() returned an ERR_PTR value, change ocfs2_lookup() to bail out immediately. Also, ocfs2_lookup() needs to call dupt() when ocfs2_dentry_attach_lock() returned an ERR_PTR value. Link: https://lkml.kernel.org/r/da5be67d-2a0b-4b93-85d6-42f3b7440135@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Reported-by: syzbot Closes: https://syzkaller.appspot.com/bug?extid=1134d3a5b062e9665a7a Suggested-by: Al Viro Reviewed-by: Joseph Qi Cc: Al Viro Cc: Joel Becker Cc: Mark Fasheh Cc: Richard Weinberger Cc: Tetsuo Handa Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit ad0039db42179064f9b60eab67c797f7359fdefc Author: Su Hui Date: Thu Jun 26 18:54:41 2025 +0800 fs/proc/vmcore: a few cleanups for vmcore_add_device_dump() There are two cleanups for vmcore_add_device_dump(). Return -ENOMEM directly rather than goto the label to simplify the code and use scoped_guard() to simplify the lock/unlock code. Link: https://lkml.kernel.org/r/20250626105440.1053139-1-suhui@nfschina.com Signed-off-by: Su Hui Reviewed-by: Dan Carpenter Cc: Baoquan He Cc: Dave Young Cc: Suhui Cc: Vivek Goyal Signed-off-by: Andrew Morton commit 37d0f07bc5a2d2736021c9090ce796b8a66571ba Author: Sachin Mokashi Date: Tue Jun 24 10:12:20 2025 -0400 mailmap: update Sachin Mokashi's email address As previous contributions were made with the older email address, which is no longer in use. Update my new address to map the old one. Link: https://lkml.kernel.org/r/20250624141220.1264691-1-sachin.mokashi@intel.com Signed-off-by: Sachin Mokashi Signed-off-by: Andrew Morton commit 0c954c57f9e1fcf5d1b3e1be5320978bfaf9cbed Author: Tetsuo Handa Date: Mon Jun 23 23:54:20 2025 +0900 ocfs2: embed actual values into ocfs2_sysfile_lock_key names Since lockdep_set_class() uses stringified key name via macro, calling lockdep_set_class() with an array causes lockdep warning messages to report variable name than actual index number. Change ocfs2_init_locked_inode() to pass actual index number for better readability of lockdep reports. This patch does not change behavior. Before: Chain exists of: &ocfs2_sysfile_lock_key[args->fi_sysfile_type] --> jbd2_handle --> &oi->ip_xattr_sem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&oi->ip_xattr_sem); lock(jbd2_handle); lock(&oi->ip_xattr_sem); lock(&ocfs2_sysfile_lock_key[args->fi_sysfile_type]); *** DEADLOCK *** After: Chain exists of: &ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE] --> jbd2_handle --> &oi->ip_xattr_sem Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock(&oi->ip_xattr_sem); lock(jbd2_handle); lock(&oi->ip_xattr_sem); lock(&ocfs2_sysfile_lock_key[EXTENT_ALLOC_SYSTEM_INODE]); *** DEADLOCK *** Link: https://lkml.kernel.org/r/29348724-639c-443d-bbce-65c3a0a13a38@I-love.SAKURA.ne.jp Signed-off-by: Tetsuo Handa Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 01bda05819b89b38eebad7e2034b8ab14eee5207 Author: Yaxin Wang Date: Thu Jun 19 21:18:43 2025 +0800 tools/accounting/delaytop: add delaytop to record top-n task delay Problem ======= The "getdelays" can only display the latency of a single task by specifying a PID, but it has the following limitations: 1. single-task perspective: only supports querying the latency (CPU, I/O, memory, etc.) of an individual task via PID and cannot provide a global analysis of high-latency processes across the system. 2. lack of High-Latency process awareness: when the overall system latency is high (e.g., a spike in CPU latency), there is no way to quickly identify the top N processes contributing to the highest latency. 3. poor interactivity: It lacks dynamic sorting and refresh capabilities (similar to top), making it difficult to monitor latency changes in real time. Solution ======== To address these limitations, we introduce the "delaytop" with the following capabilities: 1. system view: monitors latency metrics (CPU, I/O, memory, IRQ, etc.) for all system processes 2. supports field-based sorting (e.g., default sort by CPU latency in descending order) 3. dynamic interactive interface: focus on specific processes with --pid; limit displayed entries with --processes 20; control monitoring duration with --iterations; Use case ======== bash# ./delaytop Top 20 processes (sorted by CPU delay): PID TGID COMMAND CPU(ms) IO(ms) SWAP(ms) RCL(ms) THR(ms) CMP(ms) WP(ms) IRQ(ms) --------------------------------------------------------------------------------------------- 26 26 kworker/1:0H 5.55 0.00 0.00 0.00 0.00 0.00 0.00 0.00 32 32 kworker/2:0H-kb 2.93 0.00 0.00 0.00 0.00 0.00 0.00 0.00 38 38 kworker/3:0H-ev 2.88 0.00 0.00 0.00 0.00 0.00 0.00 0.00 84 84 kworker/R-vfio- 1.62 0.00 0.00 0.00 0.00 0.00 0.00 0.00 24 24 ksoftirqd/1 1.43 0.00 0.00 0.00 0.00 0.00 0.00 0.00 19 19 idle_inject/0 0.99 0.00 0.00 0.00 0.00 0.00 0.00 0.00 16 16 rcu_exp_par_gp_ 0.87 0.00 0.00 0.00 0.00 0.00 0.00 0.00 11 11 kworker/0:1 0.87 0.00 0.00 0.00 0.00 0.00 0.00 0.00 22 22 idle_inject/1 0.80 0.00 0.00 0.00 0.00 0.00 0.00 0.00 3 3 pool_workqueue_ 0.74 0.00 0.00 0.00 0.00 0.00 0.00 0.00 81 81 scsi_eh_1 0.59 0.00 0.00 0.00 0.00 0.00 0.00 0.00 30 30 ksoftirqd/2 0.42 0.00 0.00 0.00 0.00 0.00 0.00 0.00 36 36 ksoftirqd/3 0.37 0.00 0.00 0.00 0.00 0.00 0.00 0.00 9 9 kworker/0:0-eve 0.36 0.00 0.00 0.00 0.00 0.00 0.00 0.00 8 8 kworker/R-netns 0.34 0.00 0.00 0.00 0.00 0.00 0.00 0.00 76 76 kworker/1:1-pm 0.32 0.00 0.00 0.00 0.00 0.00 0.00 0.00 21 21 cpuhp/1 0.30 0.00 0.00 0.00 0.00 0.00 0.00 0.00 4 4 kworker/R-rcu_g 0.21 0.00 0.00 0.00 0.00 0.00 0.00 0.00 12 12 kworker/u16:0-i 0.20 0.00 0.00 0.00 0.00 0.00 0.00 0.00 1 1 init 0.18 0.00 0.00 0.00 0.00 0.00 0.08 0.00 Link: https://lkml.kernel.org/r/20250619211843633h05gWrBDMFkEH6xAVm_5y@zte.com.cn Co-developed-by: Fan Yu Signed-off-by: Fan Yu Signed-off-by: Yaxin Wang Cc: Balbir Singh Cc: David Hildenbrand Cc: Peilin He Cc: Qiang Tu Cc: wangyong Cc: xu xin Cc: Yang Yang Cc: ye xingchen Cc: Yunkai Zhang Signed-off-by: Andrew Morton commit 896f612273dacfdc7a635315394ccf285c257208 Author: Li Chen Date: Fri Jun 20 10:02:31 2025 +0800 fs: fat: Prevent fsfuzzer from dominating the console fsfuzzer may make many invalid access for FAT-fs and generate many kmsg like "FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb)". For platforms & os that enables hardware serial device whose speed are slow, this may cause softlockup easily. So let's ratelimit the error log. The log as below: [11916.242560] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.254485] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.266388] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.278287] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.290180] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.302068] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.313962] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.325848] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.337732] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.349619] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.361505] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.373391] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.385272] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.397144] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.409025] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.420909] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.432791] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.444674] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.456558] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.468446] FAT-fs (loop2): error, invalid access to FAT (entry 0x00000ccb) [11916.480352] watchdog: BUG: soft lockup - CPU#58 stuck for 26s! [cat:2446035] [11916.480357] Modules linked in: ... [11916.480503] CPU: 58 PID: 2446035 Comm: cat Kdump: loaded Tainted: ... [11916.480508] Hardware name: vclusters VSFT5000 B/VSFT5000 B, BIOS ... [11916.480510] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [11916.480513] pc : console_emit_next_record+0x1b4/0x288 [11916.480524] lr : console_emit_next_record+0x1ac/0x288 [11916.480525] sp : ffff80009bcdae90 [11916.480527] x29: ffff80009bcdaec0 x28: ffff800082513810 x27: 0000000000000001 [11916.480530] x26: 0000000000000001 x25: ffff800081f66000 x24: 0000000000000000 [11916.480533] x23: 0000000000000000 x22: ffff80009bcdaf8f x21: 0000000000000001 [11916.480535] x20: 0000000000000000 x19: ffff800082513810 x18: ffffffffffffffff [11916.480538] x17: 0000000000000002 x16: 0000000000000001 x15: ffff80009bcdab30 [11916.480541] x14: 0000000000000000 x13: 205d353330363434 x12: 32545b5d36343438 [11916.480543] x11: 652820544146206f x10: 7420737365636361 x9 : ffff800080159a6c [11916.480546] x8 : 69202c726f727265 x7 : 545b5d3634343836 x6 : 342e36313931315b [11916.480549] x5 : ffff800082513a01 x4 : ffff80009bcdad31 x3 : 0000000000000000 [11916.480551] x2 : 00000000ffffffff x1 : 0000000001b9b000 x0 : ffff8000836cef00 [11916.480554] Call trace: [11916.480557] console_emit_next_record+0x1b4/0x288 [11916.480560] console_flush_all+0xcc/0x190 [11916.480563] console_unlock+0x78/0x138 [11916.480565] vprintk_emit+0x1c4/0x210 [11916.480568] vprintk_default+0x40/0x58 [11916.480570] vprintk+0x84/0xc8 [11916.480572] _printk+0x68/0xa0 [11916.480578] _fat_msg+0x6c/0xa0 [fat] [11916.480593] __fat_fs_error+0xf8/0x118 [fat] [11916.480601] fat_ent_read+0x164/0x238 [fat] [11916.480609] fat_get_cluster+0x180/0x2c8 [fat] [11916.480617] fat_get_mapped_cluster+0xb8/0x170 [fat] Link: https://lkml.kernel.org/r/20250620020231.9292-1-me@linux.beauty Signed-off-by: Li Chen Acked-by: OGAWA Hirofumi Cc: Christian Brauner Signed-off-by: Andrew Morton commit fed307b67c5bbb17b72c54816cd1bce61c23b4d7 Author: Jiazi Li Date: Fri Jun 20 18:07:56 2025 +0800 kthread: update comment for __to_kthread With commit 343f4c49f243 ("kthread: Don't allocate kthread_struct for init and umh") and commit 753550eb0ce1 ("fork: Explicitly set PF_KTHREAD"), umh task no longer have struct kthread and PF_KTHREAD flag. Update the comment to describe what the current rules are to detect is something is a kthread. Link: https://lkml.kernel.org/r/20250620100801.23185-1-jqqlijiazi@gmail.com Signed-off-by: Jiazi Li Signed-off-by: mingzhu.wang Suggested-by Eric W . Biederman Reviewed-by: "Eric W. Biederman" Cc: Peter Zijlstra Signed-off-by: Andrew Morton commit caf728dfa7789f7096e8cd4341b4bf8f671f5c1d Author: Arnd Bergmann Date: Fri Jun 20 13:19:04 2025 +0200 lib: test_objagg: split test_hints_case() into two functions With sanitizers enabled, this function uses a lot of stack, causing a harmless warning: lib/test_objagg.c: In function 'test_hints_case.constprop': lib/test_objagg.c:994:1: error: the frame size of 1440 bytes is larger than 1408 bytes [-Werror=frame-larger-than=] Most of this is from the two 'struct world' structures. Since most of the work in this function is duplicated for the two, split it up into separate functions that each use one of them. The combined stack usage is still the same here, but there is no warning any more, and the code is still safe because of the known call chain. Link: https://lkml.kernel.org/r/20250620111907.3395296-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Cc: Jiri Pirko Signed-off-by: Andrew Morton commit 4d71d99f361f54bd18a94370ea08e562e511c4e9 Author: Andrew Morton Date: Thu Jun 19 16:13:17 2025 -0700 MAINTAINERS: add lib/raid6/ to "SOFTWARE RAID" Cc: Song Liu Cc: Yu Kuai Cc: Herbert Xu Signed-off-by: Andrew Morton commit 1857fcc847443b0238cb64584b43d8c3a9049a0a Author: Herbert Xu Date: Mon Mar 17 17:02:28 2025 +0800 lib/raid6: replace custom zero page with ZERO_PAGE Use the system-wide zero page instead of a custom zero page. [herbert@gondor.apana.org.au: update lib/raid6/recov_rvv.c, per Klara] Link: https://lkml.kernel.org/r/aFkUnXWtxcgOTVkw@gondor.apana.org.au Link: https://lkml.kernel.org/r/Z9flJNkWQICx0PXk@gondor.apana.org.au Signed-off-by: Herbert Xu Cc: Song Liu Cc: Yu Kuai Cc: Klara Modin Signed-off-by: Andrew Morton commit 41a7f737685eed2700654720d3faaffdf0132135 Author: Johannes Berg Date: Wed Jun 18 15:46:02 2025 +0200 scripts: gdb: move MNT_* constants to gdb-parsed Since these are now no longer defines, but in an enum. Link: https://lkml.kernel.org/r/20250618134629.25700-2-johannes@sipsolutions.net Fixes: 101f2bbab541 ("fs: convert mount flags to enum") Reviewed-by: Benjamin Berg Signed-off-by: Johannes Berg Cc: Jan Kiszka Cc: Kieran Bingham Cc: Stephen Brennan Signed-off-by: Andrew Morton commit 64960497ea86a5d09176c296c3616aa7c8668624 Author: Pasha Tatashin Date: Wed Jun 18 15:34:33 2025 +0200 fork: clean up ifdef logic around stack allocation There is an unneeded OR in the ifdef functions that are used to allocate and free kernel stacks based on direct map or vmap. Adding dynamic stack support would complicate this logic even further. Therefore, clean up by changing the order so OR is no longer needed. Link: https://lkml.kernel.org/r/20250618-fork-fixes-v4-1-2e05a2e1f5fc@linaro.org Signed-off-by: Pasha Tatashin Link: https://lore.kernel.org/20240311164638.2015063-3-pasha.tatashin@soleen.com Signed-off-by: Linus Walleij Cc: Mateusz Guzik Signed-off-by: Andrew Morton commit 816a8800326833becc93f607eb706fc542c28d75 Author: Long Li Date: Tue Jun 17 09:25:34 2025 +0800 ocfs2: remove redundant NULL check in rename path The code checks newfe_bh for NULL after it has already been dereferenced to access b_data. This NULL check is unnecessary for two reasons: 1. If ocfs2_inode_lock() succeeds (returns >= 0), newfe_bh is guaranteed to be valid. 2. We've already dereferenced newfe_bh to access b_data, so it must be non-NULL at this point. Remove the redundant NULL check in the trace_ocfs2_rename_over_existing() call to improve code clarity. Link: https://lkml.kernel.org/r/20250617012534.3458669-1-leo.lilong@huawei.com Signed-off-by: Long Li Reviewed-by: Su Yue Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 2ae826799932ff89409f56636ad3c25578fe7cf5 Author: Lizhi Xu Date: Mon Jun 16 09:31:40 2025 +0800 ocfs2: reset folio to NULL when get folio fails The reproducer uses FAULT_INJECTION to make memory allocation fail, which causes __filemap_get_folio() to fail, when initializing w_folios[i] in ocfs2_grab_folios_for_write(), it only returns an error code and the value of w_folios[i] is the error code, which causes ocfs2_unlock_and_free_folios() to recycle the invalid w_folios[i] when releasing folios. Link: https://lkml.kernel.org/r/20250616013140.3602219-1-lizhi.xu@windriver.com Reported-by: syzbot+c2ea94ae47cd7e3881ec@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=c2ea94ae47cd7e3881ec Signed-off-by: Lizhi Xu Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Cc: Signed-off-by: Andrew Morton commit aa644c405291a419e92b112e2279c01c410e9a26 Author: Jiri Olsa Date: Wed May 14 12:18:09 2025 +0200 uprobes: revert ref_ctr_offset in uprobe_unregister error path There's error path that could lead to inactive uprobe: 1) uprobe_register succeeds - updates instruction to int3 and changes ref_ctr from 0 to 1 2) uprobe_unregister fails - int3 stays in place, but ref_ctr is changed to 0 (it's not restored to 1 in the fail path) uprobe is leaked 3) another uprobe_register comes and re-uses the leaked uprobe and succeds - but int3 is already in place, so ref_ctr update is skipped and it stays 0 - uprobe CAN NOT be triggered now 4) uprobe_unregister fails because ref_ctr value is unexpected Fix this by reverting the updated ref_ctr value back to 1 in step 2), which is the case when uprobe_unregister fails (int3 stays in place), but we have already updated refctr. The new scenario will go as follows: 1) uprobe_register succeeds - updates instruction to int3 and changes ref_ctr from 0 to 1 2) uprobe_unregister fails - int3 stays in place and ref_ctr is reverted to 1.. uprobe is leaked 3) another uprobe_register comes and re-uses the leaked uprobe and succeds - but int3 is already in place, so ref_ctr update is skipped and it stays 1 - uprobe CAN be triggered now 4) uprobe_unregister succeeds Link: https://lkml.kernel.org/r/20250514101809.2010193-1-jolsa@kernel.org Fixes: 1cc33161a83d ("uprobes: Support SDT markers having reference count (semaphore)") Signed-off-by: Jiri Olsa Acked-by: David Hildenbrand Acked-by: Oleg Nesterov Suggested-by: Oleg Nesterov Cc: Andrii Nakryiko Cc: "Masami Hiramatsu (Google)" Cc: Peter Zijlstra Signed-off-by: Andrew Morton commit 5eee4c2b2aebfd3c8f11d9722e49d838da4e4150 Author: Antonio Borneo Date: Mon Jun 16 09:59:13 2025 +0200 checkpatch: use utf-8 match for spell checking The current code that checks for misspelling verifies, in a more complex regex, if $rawline matches [^\w]($misspellings)[^\w] Being $rawline a byte-string, a utf-8 character in $rawline can match the non-word-char [^\w]. E.g.: ./scripts/checkpatch.pl --git 81c2f059ab9 WARNING: 'ment' may be misspelled - perhaps 'meant'? #36: FILE: MAINTAINERS:14360: +M: Clément Léger ^^^^ Use a utf-8 version of $rawline for spell checking. Link: https://lkml.kernel.org/r/20250616-b4-checkpatch-upstream-v2-1-5600ce4a3b43@foss.st.com Signed-off-by: Antonio Borneo Signed-off-by: Clément Le Goffic Cc: Andy Whitcroft Cc: Dwaipayan Ray Cc: Joe Perches Cc: Lukas Bulwahn Signed-off-by: Andrew Morton commit e795000e755c309d1f9bd2a0590eca38b4625f3a Author: Nicolas Pitre Date: Mon Jun 16 15:22:44 2025 -0400 mul_u64_u64_div_u64: fix the division-by-zero behavior The current implementation forces a compile-time 1/0 division, which generates an undefined instruction (ud2 on x86) rather than a proper runtime division-by-zero exception. Change to trigger an actual div-by-0 exception at runtime, consistent with other division operations. Use a non-1 dividend to prevent the compiler from optimizing the division into a comparison. Link: https://lkml.kernel.org/r/q246p466-1453-qon9-29so-37105116009q@onlyvoer.pbz Signed-off-by: Nicolas Pitre Cc: Biju Das Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Thomas Weißschuh Cc: Uwe Kleine-König Cc: David Laight Signed-off-by: Andrew Morton commit d71b90e5ba83b32b4e3980f8c07ba2012ad9378a Author: Fushuai Wang Date: Sun Jun 15 11:09:30 2025 +0800 exit: fix misleading comment in forget_original_parent() The commit 482a3767e508 ("exit: reparent: call forget_original_parent() under tasklist_lock") moved the comment from exit_notify() to forget_original_parent(). However, the forget_original_parent() only handles (A), while (B) is handled in kill_orphaned_pgrp(). So remove the unrelated part. Link: https://lkml.kernel.org/r/20250615030930.58051-1-wangfushuai@baidu.com Signed-off-by: Fushuai Wang Acked-by: Oleg Nesterov Cc: Andrii Nakryiko Cc: Christian Brauner Cc: Mateusz Guzik Cc: Michal Hocko Cc: Pasha Tatashin Cc: wangfushuai Signed-off-by: Andrew Morton commit ad2c8079e9d5637f6d66cb5ce5cf49768ae87658 Author: Wei Nanxin Date: Sun Jun 15 20:32:37 2025 +0800 kcov: fix typo in comment of kcov_fault_in_area change '__santizer_cov_trace_pc()' to '__sanitizer_cov_trace_pc()' Link: https://lkml.kernel.org/r/20250615123237.110144-1-n9winx@163.com Signed-off-by: Wei Nanxin Cc: Andrey Konovalov Cc: Macro Elver Signed-off-by: Andrew Morton commit 19f3cb64a25b80db667a00182785577fae465b3e Author: Jason Xing Date: Thu Jun 12 14:12:01 2025 +0800 relayfs: support a counter tracking if data is too big to write It really doesn't matter if the user/admin knows what the last too big value is. Record how many times this case is triggered would be helpful. Solve the existing issue where relay_reset() doesn't restore the value. Store the counter in the per-cpu buffer structure instead of the global buffer structure. It also solves the racy condition which is likely to happen when a few of per-cpu buffers encounter the too big data case and then access the global field last_toobig without lock protection. Remove the printk in relay_close() since kernel module can directly call relay_stats() as they want. Link: https://lkml.kernel.org/r/20250612061201.34272-6-kerneljasonxing@gmail.com Signed-off-by: Jason Xing Reviewed-by: Yushan Zhou Reviewed-by: Masami Hiramatsu (Google) Cc: Jens Axboe Cc: Mathieu Desnoyers Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 7f2173894f7bfe63bcb241f419b15ed5ce79f0d1 Author: Jason Xing Date: Thu Jun 12 14:12:00 2025 +0800 blktrace: use rbuf->stats.full as a drop indicator in relayfs Replace internal subbuf_start in blktrace with the default policy in relayfs. Remove dropped field from struct blktrace. Correspondingly, call the common helper in relay. By incrementing full_count to keep track of how many times we encountered a full buffer issue, user space will know how many events were lost. Link: https://lkml.kernel.org/r/20250612061201.34272-5-kerneljasonxing@gmail.com Signed-off-by: Jason Xing Reviewed-by: Yushan Zhou Reviewed-by: Jens Axboe Reviewed-by: Masami Hiramatsu (Google) Cc: Mathieu Desnoyers Cc: Steven Rostedt Signed-off-by: Andrew Morton commit a53202ce7fbafd24f854865b02eff891e246c550 Author: Jason Xing Date: Thu Jun 12 14:11:59 2025 +0800 relayfs: introduce getting relayfs statistics function In this version, only support getting the counter for buffer full and implement the framework of how it works. Users can pass certain flag to fetch what field/statistics they expect to know. Each time it only returns one result. So do not pass multiple flags. Link: https://lkml.kernel.org/r/20250612061201.34272-4-kerneljasonxing@gmail.com Signed-off-by: Jason Xing Reviewed-by: Yushan Zhou Reviewed-by: Masami Hiramatsu (Google) Cc: Jens Axboe Cc: Mathieu Desnoyers Cc: Steven Rostedt Signed-off-by: Andrew Morton commit ca01a90ae7bf9bb22137e719366bdc0f387675c2 Author: Jason Xing Date: Thu Jun 12 14:11:58 2025 +0800 relayfs: support a counter tracking if per-cpu buffers is full When using relay mechanism, we often encounter the case where new data are lost or old unconsumed data are overwritten because of slow reader. Add 'full' field in per-cpu buffer structure to detect if the above case is happening. Relay has two modes: 1) non-overwrite mode, 2) overwrite mode. So buffer being full here respectively means: 1) relayfs doesn't intend to accept new data and then simply drop them, or 2) relayfs is going to start over again and overwrite old unread data with new data. Note: this counter doesn't need any explicit lock to protect from being modified by different threads for the better performance consideration. Writers calling __relay_write/relay_write should consider how to use the lock and ensure it performs under the lock protection, thus it's not necessary to add a new small lock here. Link: https://lkml.kernel.org/r/20250612061201.34272-3-kerneljasonxing@gmail.com Signed-off-by: Jason Xing Reviewed-by: Yushan Zhou Reviewed-by: Jens Axboe Reviewed-by: Masami Hiramatsu (Google) Cc: Mathieu Desnoyers Cc: Steven Rostedt Signed-off-by: Andrew Morton commit 2489e958129ff7cbf26a34ee33cdc9ccbd68fe3c Author: Jason Xing Date: Thu Jun 12 14:11:57 2025 +0800 relayfs: abolish prev_padding Patch series "relayfs: misc changes", v5. The series mostly focuses on the error counters which helps every user debug their own kernel module. This patch (of 5): prev_padding represents the unused space of certain subbuffer. If the content of a call of relay_write() exceeds the limit of the remainder of this subbuffer, it will skip storing in the rest space and record the start point as buf->prev_padding in relay_switch_subbuf(). Since the buf is a per-cpu big buffer, the point of prev_padding as a global value for the whole buffer instead of a single subbuffer (whose padding info is stored in buf->padding[]) seems meaningless from the real use cases, so we don't bother to record it any more. Link: https://lkml.kernel.org/r/20250612061201.34272-1-kerneljasonxing@gmail.com Link: https://lkml.kernel.org/r/20250612061201.34272-2-kerneljasonxing@gmail.com Signed-off-by: Jason Xing Reviewed-by: Yushan Zhou Reviewed-by: Masami Hiramatsu (Google) Cc: Jens Axboe Cc: Mathieu Desnoyers Cc: Steven Rostedt Signed-off-by: Andrew Morton commit c9e3fb050e9cb0d3a833b2c62b35ea42cdd81e89 Author: Matthew Wilcox (Oracle) Date: Thu Jun 12 15:39:01 2025 +0100 squashfs: use folios in squashfs_bio_read_cached() Remove an access to page->mapping and a few calls to the old page-based APIs. This doesn't support large folios, but it's still a nice improvement. Link: https://lkml.kernel.org/r/20250612143903.2849289-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Phillip Lougher Signed-off-by: Andrew Morton commit ca742a822a32aca68adb8ffa75a7d9c8887c41d1 Author: Matthew Wilcox (Oracle) Date: Thu Jun 12 15:39:00 2025 +0100 squashfs: pass the inode to squashfs_readahead_fragment() Patch series "squashfs: Remove page->mapping references". We're close to being able to kill page->mapping. These two patches get us a little bit closer. This patch (of 2): Eliminate a reference to page->mapping by passing the inode from the caller. Link: https://lkml.kernel.org/r/20250612143903.2849289-1-willy@infradead.org Link: https://lkml.kernel.org/r/20250612143903.2849289-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Cc: Phillip Lougher Signed-off-by: Andrew Morton commit 0ba5a25ad1c951fa25baa8c30a526b647ab50d47 Author: Elijah Wright Date: Tue Jun 10 15:56:28 2025 -0700 kernel: relay: use __GFP_ZERO in relay_alloc_buf Passing the __GFP_ZERO flag to alloc_page should result in less overhead th= an using memset() Link: https://lkml.kernel.org/r/20250610225639.314970-3-git@elijahs.space Signed-off-by: Elijah Wright Signed-off-by: Andrew Morton commit f7b0ff2bc91d8bb2ba9fdb182da39dd9733b1c50 Author: Linus Walleij Date: Fri May 9 09:25:09 2025 +0200 fork: define a local GFP_VMAP_STACK The current allocation of VMAP stack memory is using (THREADINFO_GFP & ~__GFP_ACCOUNT) which is a complicated way of saying (GFP_KERNEL | __GFP_ZERO): : define THREADINFO_GFP (GFP_KERNEL_ACCOUNT | __GFP_ZERO) : define GFP_KERNEL_ACCOUNT (GFP_KERNEL | __GFP_ACCOUNT) This is an unfortunate side-effect of independent changes blurring the picture: commit 19809c2da28aee5860ad9a2eff760730a0710df0 changed (THREADINFO_GFP | __GFP_HIGHMEM) to just THREADINFO_GFP since highmem became implicit. commit 9b6f7e163cd0f468d1b9696b785659d3c27c8667 then added stack caching and rewrote the allocation to (THREADINFO_GFP & ~__GFP_ACCOUNT) as cached stacks need to be accounted separately. However that code, when it eventually accounts the memory does this: ret = memcg_kmem_charge(vm->pages[i], GFP_KERNEL, 0) so the memory is charged as a GFP_KERNEL allocation. Define a unique GFP_VMAP_STACK to use GFP_KERNEL | __GFP_ZERO and move the comment there. Link: https://lkml.kernel.org/r/20250509-gfp-stack-v1-1-82f6f7efc210@linaro.org Signed-off-by: Linus Walleij Reported-by: Mateusz Guzik Cc: Pasha Tatashin Cc: Mike Rapoport (Microsoft) Signed-off-by: Andrew Morton commit 449e0b4ed5a16c72289a786c5333fc97520402bf Author: Pasha Tatashin Date: Fri May 9 08:29:27 2025 +0200 fork: clean-up naming of vm_stack/vm_struct variables in vmap stacks code There are two data types: "struct vm_struct" and "struct vm_stack" that have the same local variable names: vm_stack, or vm, or s, which makes the code confusing to read. Change the code so the naming is consistent: struct vm_struct is always called vm_area struct vm_stack is always called vm_stack One change altering vfree(vm_stack) to vfree(vm_area->addr) may look like a semantic change but it is not: vm_area->addr points to the vm_stack. This was done to improve readability. [linus.walleij@linaro.org: rebased and added new users of the variable names, address review comments] Link: https://lore.kernel.org/20240311164638.2015063-4-pasha.tatashin@soleen.com Link: https://lkml.kernel.org/r/20250509-fork-fixes-v3-2-e6c69dd356f2@linaro.org Signed-off-by: Pasha Tatashin Signed-off-by: Linus Walleij Acked-by: Mike Rapoport (Microsoft) Cc: Mateusz Guzik Signed-off-by: Andrew Morton commit 08e2153dd9440ebe6bb82d4dfd7b10bdf14c660c Author: Thorsten Blum Date: Wed May 21 14:18:38 2025 +0200 alpha: replace sprintf()/strcpy() with scnprintf()/strscpy() Replace sprintf() with the safer variant scnprintf() and use its return value instead of calculating the string length again using strlen(). Use strscpy() instead of the deprecated strcpy(). No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Link: https://lkml.kernel.org/r/20250521121840.5653-1-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Cc: Alexander Gordeev Cc: Geert Uytterhoeven Cc: guoweikang Cc: Matt Turner Cc: Mike Rapoport Cc: Richard Henderson Signed-off-by: Andrew Morton commit 85df0d505ed64d72c86822733f648074d1ae2bca Author: Su Hui Date: Tue May 27 17:23:34 2025 +0800 ocfs2: replace simple_strtol with kstrtol kstrtol() is better because simple_strtol() ignores overflow. And using kstrtol() is more concise. Link: https://lkml.kernel.org/r/20250527092333.1917391-1-suhui@nfschina.com Signed-off-by: Su Hui Reviewed-by: Joseph Qi Cc: Mark Fasheh Cc: Joel Becker Cc: Junxiao Bi Cc: Changwei Ge Cc: Jun Piao Signed-off-by: Andrew Morton commit 50b4233a22b1ee9ccd0e847597de66ce21329ddb Author: Julian Vetter Date: Tue Jun 3 15:21:21 2025 +0200 include/linux/jhash.h: replace __get_unaligned_cpu32 in jhash function __get_unaligned_cpu32() is deprecated. So, replace it with the more generic get_unaligned() and just cast the input parameter. Link: https://lkml.kernel.org/r/20250603132121.3674066-1-julian@outer-limits.org Signed-off-by: Julian Vetter Cc: Arnd Bergmann Cc: Wei-Hsin Yeh Signed-off-by: Andrew Morton commit 93c73ab1776fc06f3bee91e249026aad2975e8bf Author: Al Viro Date: Thu Jul 10 01:43:55 2025 -0400 gpib: use file_inode() Signed-off-by: Al Viro commit fdc3bc3497946c6b416a17628907581657102e60 Author: Li Wang Date: Tue Jun 24 11:27:48 2025 +0800 ksm_tests: skip hugepage test when Transparent Hugepages are disabled Some systems (e.g. minimal or real-time kernels) may not enable Transparent Hugepages (THP), causing MADV_HUGEPAGE to return EINVAL. This patch introduces a runtime check using the existing THP sysfs interface and skips the hugepage merging test (`-H`) when THP is not available. To avoid those failures: # ----------------------------- # running ./ksm_tests -H -s 100 # ----------------------------- # ksm_tests: MADV_HUGEPAGE: Invalid argument # [FAIL] not ok 1 ksm_tests -H -s 100 # exit=2 # -------------------- # running ./khugepaged # -------------------- # Reading PMD pagesize failed# [FAIL] not ok 1 khugepaged # exit=1 # -------------------- # running ./soft-dirty # -------------------- # TAP version 13 # 1..15 # ok 1 Test test_simple # ok 2 Test test_vma_reuse dirty bit of allocated page # ok 3 Test test_vma_reuse dirty bit of reused address page # Bail out! Reading PMD pagesize failed# Planned tests != run tests (15 != 3) # # Totals: pass:3 fail:0 xfail:0 xpass:0 skip:0 error:0 # [FAIL] not ok 1 soft-dirty # exit=1 # SUMMARY: PASS=0 SKIP=0 FAIL=1 # ------------------- # running ./migration # ------------------- # TAP version 13 # 1..3 # # Starting 3 tests from 1 test cases. # # RUN migration.private_anon ... # # OK migration.private_anon # ok 1 migration.private_anon # # RUN migration.shared_anon ... # # OK migration.shared_anon # ok 2 migration.shared_anon # # RUN migration.private_anon_thp ... # # migration.c:196:private_anon_thp:Expected madvise(ptr, TWOMEG, MADV_HUGEPAGE) (-1) == 0 (0) # # private_anon_thp: Test terminated by assertion # # FAIL migration.private_anon_thp # not ok 3 migration.private_anon_thp # # FAILED: 2 / 3 tests passed. # # Totals: pass:2 fail:1 xfail:0 xpass:0 skip:0 error:0 # [FAIL] not ok 1 migration # exit=1 It's true that CONFIG_TRANSPARENT_HUGEPAGE=y is explicitly enabled in tools/testing/selftests/mm/config, so ideally the runtime environment should also support THP. However, in practice, we've found that on some systems: - THP is disabled at boot time (transparent_hugepage=never) - Or manually disabled via sysfs - Or unavailable in RT kernels, containers, or minimal CI environments In these cases, the test will fail with EINVAL on madvise(MADV_HUGEPAGE), even though the kernel config is correct. To make the test suite more robust and avoid false negatives, this patch adds a runtime check for /sys/kernel/mm/transparent_hugepage/enabled. If THP is not available, the hugepage test (-H) is skipped with a clear message. Link: https://lkml.kernel.org/r/20250624032748.393836-1-liwang@redhat.com Signed-off-by: Li Wang Cc: Aruna Ramakrishna Cc: Bagas Sanjaya Cc: Catalin Marinas Cc: Dave Hansen Cc: David Hildenbrand Cc: Joey Gouly Cc: Johannes Weiner Cc: Keith Lucas Cc: Ryan Roberts Cc: Shuah Khan Cc: Lorenzo Stoakes Signed-off-by: Andrew Morton commit 98db4b5472ed8a64e418b895054c5fb123c038bf Author: Li Wang Date: Tue Jun 24 12:24:11 2025 +0800 selftests/mm: fix UFFDIO_API usage with proper two-step feature negotiation The current implementation of test_unmerge_uffd_wp() explicitly sets `uffdio_api.features = UFFD_FEATURE_PAGEFAULT_FLAG_WP` before calling UFFDIO_API. This can cause the ioctl() call to fail with EINVAL on kernels that do not support UFFD-WP, leading the test to fail unnecessarily: # ------------------------------ # running ./ksm_functional_tests # ------------------------------ # TAP version 13 # 1..9 # # [RUN] test_unmerge # ok 1 Pages were unmerged # # [RUN] test_unmerge_zero_pages # ok 2 KSM zero pages were unmerged # # [RUN] test_unmerge_discarded # ok 3 Pages were unmerged # # [RUN] test_unmerge_uffd_wp # not ok 4 UFFDIO_API failed <----- # # [RUN] test_prot_none # ok 5 Pages were unmerged # # [RUN] test_prctl # ok 6 Setting/clearing PR_SET_MEMORY_MERGE works # # [RUN] test_prctl_fork # # No pages got merged # # [RUN] test_prctl_fork_exec # ok 7 PR_SET_MEMORY_MERGE value is inherited # # [RUN] test_prctl_unmerge # ok 8 Pages were unmerged # Bail out! 1 out of 8 tests failed # # Planned tests != run tests (9 != 8) # # Totals: pass:7 fail:1 xfail:0 xpass:0 skip:0 error:0 # [FAIL] This patch improves compatibility and robustness of the UFFD-WP test (test_unmerge_uffd_wp) by correctly implementing the UFFDIO_API two-step handshake as recommended by the userfaultfd(2) man page. Key changes: 1. Use features=0 in the initial UFFDIO_API call to query supported feature bits, rather than immediately requesting WP support. 2. Skip the test gracefully if: - UFFDIO_API fails with EINVAL (e.g. unsupported API version), or - UFFD_FEATURE_PAGEFAULT_FLAG_WP is not advertised by the kernel. 3. Close the initial userfaultfd and create a new one before enabling the required feature, since UFFDIO_API can only be called once per fd. 4. Improve diagnostics by distinguishing between expected and unexpected failures, using strerror() to report errors. This ensures the test behaves correctly across a wider range of kernel versions and configurations, while preserving the intended behavior on kernels that support UFFD-WP. [liwang@redhat.com: fail the test if sys_userfaultfd() fails, per David] Link: https://lkml.kernel.org/r/20250625004645.400520-1-liwang@redhat.com Link: https://lkml.kernel.org/r/20250624042411.395285-1-liwang@redhat.com Signed-off-by: Li Wang Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Aruna Ramakrishna Cc: Bagas Sanjaya Cc: Catalin Marinas Cc: Dave Hansen Cc: Joey Gouly Cc: Johannes Weiner Cc: Keith Lucas Cc: Ryan Roberts Cc: Shuah Khan Cc: Axel Rasmussen Cc: Li Wang Cc: Mike Rapoport Cc: Nadav Amit Cc: Peter Xu Signed-off-by: Andrew Morton commit 1f0bce2fa8c6bfd65cf78ad6ef6e0948fc55c7bb Author: Liam R. Howlett Date: Tue Jun 24 11:48:23 2025 -0400 maple_tree: add testing for restoring maple state to active Restoring maple status to ma_active on overflow/underflow when mas->node was NULL could have happened in the past, but was masked by a bug in mas_walk(). Add test cases that triggered the bug when the node was mas->node prior to fixing the maple state setup. Add a few extra tests around restoring the active maple status. Link: https://lore.kernel.org/all/202506191556.6bfc7b93-lkp@intel.com/ Link: https://lkml.kernel.org/r/20250624154823.52221-2-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Reviewed-by: Wei Yang Signed-off-by: Andrew Morton commit 12f1d7931283106306a8822c5279013b8a0f1242 Author: Liam R. Howlett Date: Tue Jun 24 11:48:22 2025 -0400 maple_tree: fix status setup on restore to active During the initial call with a maple state, an error status may be set before a valid node is populated into the maple state node. Subsequent calls with the maple state may restore the state into an active state with no node set. This was masked by the mas_walk() always resetting the status to ma_start and result in an extra walk in this rare scenario. Don't restore the state to active unless there is a value in the structs node. This also allows mas_walk() to be fixed to use the active state without exposing an issue. User visible results are marginal performance improvements when an active state can be restored and used instead of rewalking the tree. Stable is not Cc'ed because the existing code is stable and the performance gains are not worth the risk. Link: https://lore.kernel.org/all/20250611011253.19515-1-richard.weiyang@gmail.com/ Link: https://lore.kernel.org/all/20250407231354.11771-1-richard.weiyang@gmail.com/ Link: https://lore.kernel.org/all/202506191556.6bfc7b93-lkp@intel.com/ Link: https://lkml.kernel.org/r/20250624154823.52221-1-Liam.Howlett@oracle.com Fixes: a8091f039c1e ("maple_tree: add MAS_UNDERFLOW and MAS_OVERFLOW states") Signed-off-by: Liam R. Howlett Reported-by: Wei Yang Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202506191556.6bfc7b93-lkp@intel.com Reviewed-by: Wei Yang Signed-off-by: Andrew Morton commit 67c94320571f37efd6d88b8c23a3a69ece63fb7f Author: Moon Hee Lee Date: Wed Jun 25 19:07:58 2025 -0700 selftests/mm: remove duplicate .gitignore entries Remove redundant entries in .gitignore confirmed by: $ sort tools/testing/selftests/mm/.gitignore | uniq -d hugetlb_dio pkey_sighandler_tests_32 pkey_sighandler_tests_64 These entries were originally added by [1], and later duplicated by [2]. [1] https://lore.kernel.org/all/20240924185911.117937-1-lorenzo.stoakes@oracle.com/ [2] https://lore.kernel.org/all/20241125064036.413536-1-lizhijian@fujitsu.com/ Link: https://lkml.kernel.org/r/20250626020758.163243-1-moonhee.lee.ca@gmail.com Signed-off-by: Moon Hee Lee Reviewed-by: Dev Jain Cc: Shuah Khan Signed-off-by: Andrew Morton commit d2ef92cd2a31ba7c0d0eb0dd5c1acf381f161fcd Author: Sabyrzhan Tasbolatov Date: Sun Jun 22 10:19:06 2025 +0500 mm: unexport globally copy_to_kernel_nofault copy_to_kernel_nofault() is an internal helper which should not be visible to loadable modules – exporting it would give exploit code a cheap oracle to probe kernel addresses. Instead, keep the helper un-exported and compile the kunit case that exercises it only when mm/kasan/kasan_test.o is linked into vmlinux. [snovitoll@gmail.com: add a brief comment to `#ifndef MODULE`] Link: https://lkml.kernel.org/r/20250622141142.79332-1-snovitoll@gmail.com Link: https://lkml.kernel.org/r/20250622051906.67374-1-snovitoll@gmail.com Fixes: ca79a00bb9a8 ("kasan: migrate copy_user_test to kunit") Signed-off-by: Sabyrzhan Tasbolatov Suggested-by: Christoph Hellwig Suggested-by: Marco Elver Acked-by: David Hildenbrand Reviewed-by: Andrey Konovalov Cc: Alexander Potapenko Cc: Andrey Ryabinin Cc: Arnd Bergmann Cc: Dmitriy Vyukov Cc: Vincenzo Frascino Signed-off-by: Andrew Morton commit d8e77a0b636485364d70b86addf0c76bf9bccc4f Author: Uladzislau Rezki (Sony) Date: Mon Jun 23 20:40:35 2025 +0200 lib/test_vmalloc.c: restrict default test mask to avoid test warnings When the vmalloc test is built into the kernel, it runs automatically during the boot. The current-default "run_test_mask" includes all test cases, including those which are designed to fail and which trigger kernel warnings. These kernel splats can be misinterpreted as actual kernel bugs, leading to false alarms and unnecessary reports. To address this, limit the default test mask to only the first few tests which are expected to pass cleanly. These tests are safe and should not generate any warnings unless there is a real bug. Users who wish to explicitly run specific test cases have to pass the run_test_mask as a boot parameter or at module load time. Link: https://lkml.kernel.org/r/20250623184035.581229-2-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Baoquan He Cc: Harry Yoo Cc: Suren Baghdasaryan Cc: David Wang <00107082@163.com> Signed-off-by: Andrew Morton commit 2e728505494b21b874fa87fce233c63b43d74434 Author: Uladzislau Rezki (Sony) Date: Mon Jun 23 20:40:34 2025 +0200 lib/test_vmalloc.c: use late_initcall() if built-in for init ordering When the vmalloc test code is compiled as a built-in, use late_initcall() instead of module_init() to defer a vmalloc test execution until most subsystems are up and running. It avoids interfering with components that may not yet be initialized at module_init() time. For example, there was a recent report of memory profiling infrastructure not being ready early enough leading to kernel crash. By using late_initcall() in the built-in case, we ensure the tests are run at a safer point during a boot sequence. Link: https://lkml.kernel.org/r/20250623184035.581229-1-urezki@gmail.com Signed-off-by: Uladzislau Rezki (Sony) Reviewed-by: Baoquan He Cc: Harry Yoo Cc: Suren Baghdasaryan Cc: David Wang <00107082@163.com> Signed-off-by: Andrew Morton commit d1600be2f68a6f79a1ea3993b7ab84fcbb824879 Author: SeongJae Park Date: Sun Jun 22 14:37:59 2025 -0700 mm/damon/sysfs: decouple from damon_ops_id Decouple DAMON sysfs interface from damon_ops_id. For this, define and use new mm/damon/sysfs.c internal data structure that maps the user-space keywords and damon_ops_id, instead of having the implicit and unflexible array index rule. Link: https://lkml.kernel.org/r/20250622213759.50930-6-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit a39346daecc302e82a2c930c65f26519c106573e Author: SeongJae Park Date: Sun Jun 22 14:37:58 2025 -0700 mm/damon/sysfs-schemes: decouple from damos_filter_type Decouple DAMOS sysfs interface from damos_filter_type. For this, define and use new sysfs-schemes internal data structure that maps the user-space keywords and damos_filter_type, instead of having the implicit and unflexible array index rule. Link: https://lkml.kernel.org/r/20250622213759.50930-5-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 041f54604f2c5fc3a363cdf0002389bb98b1e560 Author: SeongJae Park Date: Sun Jun 22 14:37:57 2025 -0700 mm/damon/sysfs-schemes: decouple from damos_wmark_metric Decouple DAMOS sysfs interface from damos_wmark_metric. For this, define and use new sysfs-schemes internal data structure that maps the user-space keywords and damos_wmark_metric, instead of having the implicit and unflexible array index rule. Link: https://lkml.kernel.org/r/20250622213759.50930-4-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 2bbf41ee98565ca36d80975614b8dcfc32ea3c58 Author: SeongJae Park Date: Sun Jun 22 14:37:56 2025 -0700 mm/damon/sysfs-schemes: decouple from damos_action Decouple DAMOS sysfs interface from damos_action. For this, define and use new sysfs-schemes internal data structure that maps the user-space keywords and damos_action, instead of having the implicit and unflexible array index rule. [akpm@linux-foundation.org: make damos_sysfs_action_names static] Closes: https://lore.kernel.org/oe-kbuild-all/202506271655.b8yfEZIT-lkp@intel.com/ Link: https://lkml.kernel.org/r/20250622213759.50930-3-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit b7482f91ea1d3ff3288c3678c37dcfe70124d26c Author: SeongJae Park Date: Sun Jun 22 14:37:55 2025 -0700 mm/damon/sysfs-schemes: decouple from damos_quota_goal_metric Patch series "mm/damon: decouple sysfs from core". DAMON sysfs interface is coupled with core layer. It maintains some of its keywords arrays be synchronized with matching DAMON core API enums. It is unnecessary coupling that makes separated changes for different layers difficult. Decouple the layers by introducing new data structure for the mappings on DAMON sysfs interface. This patch (of 5): Decouple DAMOS sysfs interface from damos_quota_goal_metric. For this, define and use new sysfs-schemes internal data structure that maps the user-space keywords and damos_quota_goal_metric, instead of having the implicit and unflexible array index rule. Link: https://lkml.kernel.org/r/20250622213759.50930-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250622213759.50930-2-sj@kernel.org Signed-off-by: SeongJae Park Signed-off-by: Andrew Morton commit 59305202c67fea50378dcad0cc199dbc13a0e99a Author: Anshuman Khandual Date: Fri Jun 20 10:54:27 2025 +0530 mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() Memory hot remove unmaps and tears down various kernel page table regions as required. The ptdump code can race with concurrent modifications of the kernel page tables. When leaf entries are modified concurrently, the dump code may log stale or inconsistent information for a VA range, but this is otherwise not harmful. But when intermediate levels of kernel page table are freed, the dump code will continue to use memory that has been freed and potentially reallocated for another purpose. In such cases, the ptdump code may dereference bogus addresses, leading to a number of potential problems. To avoid the above mentioned race condition, platforms such as arm64, riscv and s390 take memory hotplug lock, while dumping kernel page table via the sysfs interface /sys/kernel/debug/kernel_page_tables. Similar race condition exists while checking for pages that might have been marked W+X via /sys/kernel/debug/kernel_page_tables/check_wx_pages which in turn calls ptdump_check_wx(). Instead of solving this race condition again, let's just move the memory hotplug lock inside generic ptdump_check_wx() which will benefit both the scenarios. Drop get_online_mems() and put_online_mems() combination from all existing platform ptdump code paths. Link: https://lkml.kernel.org/r/20250620052427.2092093-1-anshuman.khandual@arm.com Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove") Signed-off-by: Anshuman Khandual Acked-by: David Hildenbrand Reviewed-by: Dev Jain Acked-by: Alexander Gordeev [s390] Cc: Catalin Marinas Cc: Will Deacon Cc: Ryan Roberts Cc: Paul Walmsley Cc: Palmer Dabbelt Cc: Alexander Gordeev Cc: Gerald Schaefer Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Christian Borntraeger Cc: Sven Schnelle Cc: Signed-off-by: Andrew Morton commit ab7ed56a03ce0196260bc29ab844eb4e54afee66 Author: Peter Xu Date: Fri Jun 20 11:00:58 2025 -0400 selftests/mm: reduce uffd-unit-test poison test to minimum The test will still generate quite some unwanted MCE error messages to syslog. There was old proposal ratelimiting the MCE messages from kernel, but that has risk of hiding real useful information on production systems. We can at least reduce the test to minimum to not over-pollute dmesg, however trying to not lose its coverage too much. [peterx@redhat.com: reduce uffd-unit-test poison test to minimum] Link: https://lkml.kernel.org/r/aF2RSsjuEOtzXcUa@x1.local Link: https://lkml.kernel.org/r/20250620150058.1729489-1-peterx@redhat.com Signed-off-by: Peter Xu Cc: Axel Rasmussen Cc: Brendan Jackman Cc: David Hildenbrand Cc: Shuah Khan Signed-off-by: Andrew Morton commit 592b939b59b43a817ce6d79900793982d452bb5d Author: Dev Jain Date: Tue Jun 24 13:37:48 2025 +0530 maple tree: use goto label to simplify code Use the underflow goto label to set the status to ma_underflow and return NULL, as is being done elsewhere. [akpm@linux-foundation.org: add newline, per Liam (and remove one, per akpm)] Link: https://lkml.kernel.org/r/20250624080748.4855-1-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Liam R. Howlett Reviewed-by: Wei Yang Signed-off-by: Andrew Morton commit dfa3cf0bc018ff15e02ce19906be00a287ff2395 Author: SeongJae Park Date: Thu Jun 19 11:36:08 2025 -0700 selftets/damon: add a test for memcg_path leak There was a memory leak bug in DAMOS sysfs memcg_path file. Add a selftest to ensure the bug never comes back. Link: https://lkml.kernel.org/r/20250619183608.6647-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Shuah Khan Signed-off-by: Andrew Morton commit 5d26b5bdc64625049d98efc0f5bfddd83709c154 Author: Alistair Popple Date: Thu Jun 19 18:58:06 2025 +1000 mm/memremap: remove unused devmap_managed_key It's no longer used so remove it. Link: https://lkml.kernel.org/r/11516e39f33f809292ffccab1d46062f9bc248b3.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Reviewed-by: Jason Gunthorpe Acked-by: David Hildenbrand Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Christoph Hellwig Cc: Chunyan Zhang Cc: Dan Williams Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit 21aa65bf82a78c1e70447a45a85e533689b7f1a7 Author: Alistair Popple Date: Thu Jun 19 18:58:05 2025 +1000 mm: remove callers of pfn_t functionality All PFN_* pfn_t flags have been removed. Therefore there is no longer a need for the pfn_t type and all uses can be replaced with normal pfns. Link: https://lkml.kernel.org/r/bbedfa576c9822f8032494efbe43544628698b1f.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Reviewed-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Acked-by: David Hildenbrand Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Chunyan Zhang Cc: Dan Williams Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit 984921edea68bf24bcc87e1317bfc90451ff46c6 Author: Alistair Popple Date: Thu Jun 19 18:58:04 2025 +1000 mm: remove PFN_DEV, PFN_MAP, PFN_SPECIAL, PFN_SG_CHAIN and PFN_SG_LAST The PFN_MAP flag is no longer used for anything, so remove it. The PFN_SG_CHAIN and PFN_SG_LAST flags never appear to have been used so also remove them. The last user of PFN_SPECIAL was removed by 653d7825c149 ("dcssblk: mark DAX broken, remove FS_DAX_LIMITED support"). Users of PFN_DEV were removed earlier in this series by "mm: Remove remaining uses of PFN_DEV". Link: https://lkml.kernel.org/r/670b3950d70b4d97b905bb597dadfd3633de4314.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Acked-by: David Hildenbrand Reviewed-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Reviewed-by: Dan Williams Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Chunyan Zhang Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit d438d273417055241ebaaf1ba3be23459fc27cba Author: Alistair Popple Date: Thu Jun 19 18:58:03 2025 +1000 mm: remove devmap related functions and page table bits Now that DAX and all other reference counts to ZONE_DEVICE pages are managed normally there is no need for the special devmap PTE/PMD/PUD page table bits. So drop all references to these, freeing up a software defined page table bit on architectures supporting it. Link: https://lkml.kernel.org/r/6389398c32cc9daa3dfcaa9f79c7972525d310ce.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Acked-by: Will Deacon # arm64 Acked-by: David Hildenbrand Suggested-by: Chunyan Zhang Reviewed-by: Björn Töpel Reviewed-by: Jason Gunthorpe Cc: Balbir Singh Cc: Björn Töpel Cc: Christoph Hellwig Cc: Dan Williams Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 28dc88c39ecfe7de5033fa05cdd24fd1a9f8267d Author: Alistair Popple Date: Thu Jun 19 18:58:02 2025 +1000 fs/dax: remove FS_DAX_LIMITED config option The dcssblk driver was the last user of FS_DAX_LIMITED. That was marked broken by 653d7825c149 ("dcssblk: mark DAX broken, remove FS_DAX_LIMITED support") to allow removal of PFN_SPECIAL. However the FS_DAX_LIMITED config option itself was not removed, so do that now. Link: https://lkml.kernel.org/r/b47bf164b4a1013d736fa1a3d501bc8b8e71311f.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Acked-by: David Hildenbrand Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Christoph Hellwig Cc: Chunyan Zhang Cc: Dan Williams Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: Jason Gunthorpe Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit bea0cc7cf4a51e8d3a0042212df3b83b49df58a7 Author: Alistair Popple Date: Thu Jun 19 18:58:01 2025 +1000 powerpc: remove checks for devmap pages and PMDs/PUDs PFN_DEV no longer exists. This means no devmap PMDs or PUDs will be created, so checking for them is redundant. Instead mappings of pages that would have previously returned true for pXd_devmap() will return true for pXd_trans_huge() Link: https://lkml.kernel.org/r/31f63cc8dd518f9e2ec300681fe302eb4adf49b4.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Reviewed-by: Jason Gunthorpe Acked-by: David Hildenbrand Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Christoph Hellwig Cc: Chunyan Zhang Cc: Dan Williams Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit 2f4e882d955b19ff7b216d6a29a77fcba045b7cc Author: Alistair Popple Date: Thu Jun 19 18:58:00 2025 +1000 mm/khugepaged: remove redundant pmd_devmap() check The pmd_devmap() check in check_pmd_state() is redundant because the only user of pmd_devmap were device dax and fs dax. However all callers of check_pmd_state() first call thp_vma_allowable_order() to check if the vma should be scanned. Except when called from a page fault this always returns 0 for dax vma's, hence we would never expect to see a pmd_devmap entry. Link: https://lkml.kernel.org/r/a68175fd3a37e9b72cc82c1d63fd8b69691a85b5.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Acked-by: David Hildenbrand Reviewed-by: Jason Gunthorpe Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Christoph Hellwig Cc: Chunyan Zhang Cc: Dan Williams Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit 8a6a984c2e0ea406459b445a3910a454bece3aa1 Author: Alistair Popple Date: Thu Jun 19 18:57:59 2025 +1000 mm: remove redundant pXd_devmap calls DAX was the only thing that created pmd_devmap and pud_devmap entries however it no longer does as DAX pages are now refcounted normally and pXd_trans_huge() returns true for those. Therefore checking both pXd_devmap and pXd_trans_huge() is redundant and the former can be removed without changing behaviour as it will always be false. Link: https://lkml.kernel.org/r/d58f089dc16b7feb7c6728164f37dea65d64a0d3.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Christoph Hellwig Cc: Chunyan Zhang Cc: Dan Williams Cc: David Hildenbrand Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: Jason Gunthorpe Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit 7b2ae3c47f65bc75985caaaba9f2fb601eebca20 Author: Alistair Popple Date: Thu Jun 19 18:57:58 2025 +1000 mm/huge_memory: remove pXd_devmap usage from insert_pXd_pfn() Nothing uses PFN_DEV anymore so no need to create devmap pXd's when mapping a PFN. Instead special mappings will be created which ensures vm_normal_page_pXd() will not return pages which don't have an associated page. This could change behaviour slightly on architectures where pXd_devmap() does not imply pXd_special() as the normal page checks would have fallen through to checking VM_PFNMAP/MIXEDMAP instead, which in theory at least could have returned a page. However vm_normal_page_pXd() should never have been returning pages for pXd_devmap() entries anyway, so anything relying on that would have been a bug. Link: https://lkml.kernel.org/r/cd8658f9ff10afcfffd8b145a39d98bf1c595ffa.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Christoph Hellwig Cc: Chunyan Zhang Cc: Dan Williams Cc: David Hildenbrand Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: Jason Gunthorpe Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit fd2825b0760a10a9626986cca64f5664302ffdfc Author: Alistair Popple Date: Thu Jun 19 18:57:57 2025 +1000 mm/gup: remove pXX_devmap usage from get_user_pages() GUP uses pXX_devmap() calls to see if it needs to a get a reference on the associated pgmap data structure to ensure the pages won't go away. However it's a driver responsibility to ensure that if pages are mapped (ie. discoverable by GUP) that they are not offlined or removed from the memmap so there is no need to hold a reference on the pgmap data structure to ensure this. Furthermore mappings with PFN_DEV are no longer created, hence this effectively dead code anyway so can be removed. Link: https://lkml.kernel.org/r/708b2be76876659ec5261fe5d059b07268b98b36.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Reviewed-by: Jason Gunthorpe Reviewed-by: Dan Williams Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Christoph Hellwig Cc: Chunyan Zhang Cc: David Hildenbrand Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit 4b1d3145c1045d4b0db4622cd2c224a247f25a20 Author: Alistair Popple Date: Thu Jun 19 18:57:56 2025 +1000 mm: convert vmf_insert_mixed() from using pte_devmap to pte_special DAX no longer requires device PTEs as it always has a ZONE_DEVICE page associated with the PTE that can be reference counted normally. Other users of pte_devmap are drivers that set PFN_DEV when calling vmf_insert_mixed() which ensures vm_normal_page() returns NULL for these entries. There is no reason to distinguish these pte_devmap users so in order to free up a PTE bit use pte_special instead for entries created with vmf_insert_mixed(). This will ensure vm_normal_page() will continue to return NULL for these pages. Architectures that don't support pte_special also don't support pte_devmap so those will continue to rely on pfn_valid() to determine if the page can be mapped. Link: https://lkml.kernel.org/r/93086bd446e7bf8e4c85345613ac18f706b01f60.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Reviewed-by: Jason Gunthorpe Reviewed-by: Dan Williams Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Christoph Hellwig Cc: Chunyan Zhang Cc: David Hildenbrand Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit 79065255abc4b0fae843f539f7f5f0fe9fcac1e6 Author: Alistair Popple Date: Thu Jun 19 18:57:55 2025 +1000 mm: remove remaining uses of PFN_DEV PFN_DEV was used by callers of dax_direct_access() to figure out if the returned PFN is associated with a page using pfn_t_has_page() or not. However all DAX PFNs now require an assoicated ZONE_DEVICE page so can assume a page exists. Other users of PFN_DEV were setting it before calling vmf_insert_mixed(). This is unnecessary as it is no longer checked, instead relying on pfn_valid() to determine if there is an associated page or not. Link: https://lkml.kernel.org/r/74b293aebc21b941090bc3e7aeafa91b57c821a5.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Reviewed-by: Christoph Hellwig Reviewed-by: Jason Gunthorpe Reviewed-by: Dan Williams Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Chunyan Zhang Cc: David Hildenbrand Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit 6b4a80e424cd2f99ca7262a8c0c725ec82e57b8a Author: Alistair Popple Date: Thu Jun 19 18:57:54 2025 +1000 mm: filter zone device pages returned from folio_walk_start() Previously dax pages were skipped by the pagewalk code as pud_special() or vm_normal_page{_pmd}() would be false for DAX pages. Now that dax pages are refcounted normally that is no longer the case, so the pagewalk code will start returning them. Most callers already explicitly filter for DAX or zone device pages so don't need updating. However some don't, so add checks to those callers. Link: https://lkml.kernel.org/r/4ecb7b357fc5b435588024770b88bbb695c30090.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Cc: Balbir Singh Cc: Björn Töpel Cc: Björn Töpel Cc: Christoph Hellwig Cc: Chunyan Zhang Cc: Dan Williams Cc: David Hildenbrand Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: Jason Gunthorpe Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Will Deacon Signed-off-by: Andrew Morton commit 0544f3f78da3d7d2baf546e70773a8d66cdb127e Author: Alistair Popple Date: Thu Jun 19 18:57:53 2025 +1000 mm: convert pXd_devmap checks to vma_is_dax Patch series "mm: Remove pXX_devmap page table bit and pfn_t type", v3. All users of dax now require a ZONE_DEVICE page which is properly refcounted. This means there is no longer any need for the PFN_DEV, PFN_MAP and PFN_SPECIAL flags. Furthermore the PFN_SG_CHAIN and PFN_SG_LAST flags never appear to have been used. It is therefore possible to remove the pfn_t type and replace any usage with raw pfns. The remaining users of PFN_DEV have simply passed this to vmf_insert_mixed() to create pte_devmap() mappings. It is unclear why this was the case but presumably to ensure vm_normal_page() does not return these pages. These users can be trivially converted to raw pfns and creating a pXX_special() mapping to ensure vm_normal_page() still doesn't return these pages. Now that there are no users of PFN_DEV we can remove the devmap page table bit and all associated functions and macros, freeing up a software page table bit. This patch (of 14): Currently dax is the only user of pmd and pud mapped ZONE_DEVICE pages. Therefore page walkers that want to exclude DAX pages can check pmd_devmap or pud_devmap. However soon dax will no longer set PFN_DEV, meaning dax pages are mapped as normal pages. Ensure page walkers that currently use pXd_devmap to skip DAX pages continue to do so by adding explicit checks of the VMA instead. Remove vma_is_dax() check from mm/userfaultfd.c as validate_move_areas() will already skip DAX VMA's on account of them not being anonymous. The check in userfaultfd_must_wait() is also redundant as vma_can_userfault() should have already filtered out dax vma's. For HMM the pud_devmap check seems unnecessary as there is no reason we shouldn't be able to handle any leaf PUD here so remove it also. Link: https://lkml.kernel.org/r/cover.176965585864cb8d2cf41464b44dcc0471e643a0.1750323463.git-series.apopple@nvidia.com Link: https://lkml.kernel.org/r/f0611f6f475f48fcdf34c65084a359aefef4cccc.1750323463.git-series.apopple@nvidia.com Signed-off-by: Alistair Popple Reviewed-by: Jason Gunthorpe Reviewed-by: Dan Williams Cc: Balbir Singh Cc: Björn Töpel Cc: Christoph Hellwig Cc: Chunyan Zhang Cc: David Hildenbrand Cc: Deepak Gupta Cc: Gerald Schaefer Cc: Inki Dae Cc: John Groves Cc: John Hubbard Cc: Lorenzo Stoakes Cc: Matthew Wilcox (Oracle) Cc: Björn Töpel Cc: Will Deacon Signed-off-by: Andrew Morton commit 59b5ed409d03bc8b7bb153d78afcd7cea9d7bbfa Author: Hao Ge Date: Wed Jun 18 09:58:09 2025 +0800 mm/percpu: conditionally define _shared_alloc_tag via CONFIG_ARCH_MODULE_NEEDS_WEAK_PER_CPU Recently discovered this entry while checking kallsyms on ARM64: ffff800083e509c0 D _shared_alloc_tag If ARCH_NEEDS_WEAK_PER_CPU is not defined(it is only defined for s390 and alpha architectures), there's no need to statically define the percpu variable _shared_alloc_tag. Therefore, we need to implement isolation for this purpose. When building the core kernel code for s390 or alpha architectures, ARCH_NEEDS_WEAK_PER_CPU remains undefined (as it is gated by #if defined(MODULE)). However, when building modules for these architectures, the macro is explicitly defined. Therefore, we remove all instances of ARCH_NEEDS_WEAK_PER_CPU from the code and introduced CONFIG_ARCH_MODULE_NEEDS_WEAK_PER_CPU to replace the relevant logic. We can now conditionally define the perpcu variable _shared_alloc_tag based on CONFIG_ARCH_MODULE_NEEDS_WEAK_PER_CPU. This allows architectures (such as s390/alpha) that require weak definitions for percpu variables in modules to include the definition, while others can omit it via compile-time exclusion. Link: https://lkml.kernel.org/r/20250618015809.1235761-1-hao.ge@linux.dev Signed-off-by: Hao Ge Suggested-by: Suren Baghdasaryan Acked-by: Alexander Gordeev [s390] Acked-by: Mike Rapoport (Microsoft) Cc: Chistoph Lameter Cc: Christian Borntraeger Cc: David Hildenbrand Cc: Dennis Zhou Cc: Heiko Carstens Cc: Kent Overstreet Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Matt Turner Cc: Richard Henderson Cc: Sven Schnelle Cc: Tejun Heo Cc: Vasily Gorbik Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit cf34cfbf1784be7ce9f22789aa157535eff2195f Author: Vivek Kasireddy Date: Tue Jun 17 22:30:55 2025 -0700 selftests/udmabuf: add a test to pin first before writing to memfd Unlike the existing tests, this new test will create a memfd (backed by hugetlb) and pin the folios in it (a small subset) before writing/ populating it with data. This is a valid use-case that invokes the memfd_alloc_folio() kernel API and is expected to work unless there aren't enough hugetlb folios to satisfy the allocation needs. Link: https://lkml.kernel.org/r/20250618053415.1036185-4-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Cc: Gerd Hoffmann Cc: Steve Sistare Cc: Muchun Song Cc: David Hildenbrand Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 717cf9357325055ab6b41c4e0581f4d67601eb58 Author: Vivek Kasireddy Date: Tue Jun 17 22:30:54 2025 -0700 mm/memfd: reserve hugetlb folios before allocation When we try to allocate a folio via alloc_hugetlb_folio_reserve(), we need to ensure that there is an active reservation associated with the allocation. Otherwise, our allocation request would fail if there are no active reservations made at that moment against any other allocations. This is because alloc_hugetlb_folio_reserve() checks h->resv_huge_pages before proceeding with the allocation. Therefore, to address this issue, we just need to make a reservation (by calling hugetlb_reserve_pages()) before we try to allocate the folio. This will also ensure that proper region/subpool accounting is done associated with our allocation. Link: https://lkml.kernel.org/r/20250618053415.1036185-3-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Cc: Steve Sistare Cc: Muchun Song Cc: David Hildenbrand Cc: Gerd Hoffmann Cc: Oscar Salvador Signed-off-by: Andrew Morton commit 986f5f2b4be3b7eab9ecd85c472d03a2191d6fc0 Author: Vivek Kasireddy Date: Tue Jun 17 22:30:53 2025 -0700 mm/hugetlb: make hugetlb_reserve_pages() return nr of entries updated Patch series "mm/memfd: Reserve hugetlb folios before allocation", v4. There are cases when we try to pin a folio but discover that it has not been faulted-in. So, we try to allocate it in memfd_alloc_folio() but the allocation request may not succeed if there are no active reservations in the system at that instant. Therefore, making a reservation (by calling hugetlb_reserve_pages()) associated with the allocation will ensure that our request would not fail due to lack of reservations. This will also ensure that proper region/subpool accounting is done with our allocation. This patch (of 3): Currently, hugetlb_reserve_pages() returns a bool to indicate whether the reservation map update for the range [from, to] was successful or not. This is not sufficient for the case where the caller needs to determine how many entries were updated for the range. Therefore, have hugetlb_reserve_pages() return the number of entries updated in the reservation map associated with the range [from, to]. Also, update the callers of hugetlb_reserve_pages() to handle the new return value. Link: https://lkml.kernel.org/r/20250618053415.1036185-1-vivek.kasireddy@intel.com Link: https://lkml.kernel.org/r/20250618053415.1036185-2-vivek.kasireddy@intel.com Signed-off-by: Vivek Kasireddy Cc: Steve Sistare Cc: Muchun Song Cc: David Hildenbrand Cc: Gerd Hoffmann Cc: Oscar Salvador Signed-off-by: Andrew Morton commit d29d64afa2b20d9bd210c01bfff78545675b5135 Author: Petr Pavlu Date: Wed Jun 18 14:50:35 2025 +0200 codetag: avoid unused alloc_tags sections/symbols With CONFIG_MEM_ALLOC_PROFILING=n, vmlinux and all modules unnecessarily contain the symbols __start_alloc_tags and __stop_alloc_tags, which define an empty range. In the case of modules, the presence of these symbols also forces the linker to create an empty .codetag.alloc_tags section. Update codetag.lds.h to make the data conditional on CONFIG_MEM_ALLOC_PROFILING. Link: https://lkml.kernel.org/r/20250618125037.53182-1-petr.pavlu@suse.com Signed-off-by: Petr Pavlu Reviewed-by: Kent Overstreet Reviewed-by: Suren Baghdasaryan Cc: Arnd Bergmann Cc: Casey Chen Cc: Petr Pavlu Signed-off-by: Andrew Morton commit f9550e1fcf3bef802c18fadc5c65485b66b28a63 Author: Nathan Gao Date: Wed Jun 18 09:33:31 2025 -0700 mm/damon: fix minor typos in damon header Fix typos in include/linux/damon.h. Link: https://lkml.kernel.org/r/20250618163331.54910-1-sj@kernel.org Signed-off-by: Nathan Gao Reviewed-by: SeongJae Park Signed-off-by: Andrew Morton commit d75fa3c9475048356e50357e8a71745e5c1bd740 Author: Lorenzo Stoakes Date: Wed Jun 18 20:42:54 2025 +0100 mm: update architecture and driver code to use vm_flags_t In future we intend to change the vm_flags_t type, so it isn't correct for architecture and driver code to assume it is unsigned long. Correct this assumption across the board. Overall, this patch does not introduce any functional change. Link: https://lkml.kernel.org/r/b6eb1894abc5555ece80bb08af5c022ef780c8bc.1750274467.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Mike Rapoport (Microsoft) Acked-by: Christian Brauner Reviewed-by: Vlastimil Babka Reviewed-by: Oscar Salvador Reviewed-by: Pedro Falcato Acked-by: Catalin Marinas [arm64] Acked-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Jarkko Sakkinen Reviewed-by: Anshuman Khandual Cc: Jann Horn Cc: Kees Cook Cc: Liam R. Howlett Cc: Jan Kara Signed-off-by: Andrew Morton commit bfbe71109fa40e8cc05a0f99e6734b7d76ee00b0 Author: Lorenzo Stoakes Date: Wed Jun 18 20:42:53 2025 +0100 mm: update core kernel code to use vm_flags_t consistently The core kernel code is currently very inconsistent in its use of vm_flags_t vs. unsigned long. This prevents us from changing the type of vm_flags_t in the future and is simply not correct, so correct this. While this results in rather a lot of churn, it is a critical pre-requisite for a future planned change to VMA flag type. Additionally, update VMA userland tests to account for the changes. To make review easier and to break things into smaller parts, driver and architecture-specific changes is left for a subsequent commit. The code has been adjusted to cascade the changes across all calling code as far as is needed. We will adjust architecture-specific and driver code in a subsequent patch. Overall, this patch does not introduce any functional change. Link: https://lkml.kernel.org/r/d1588e7bb96d1ea3fe7b9df2c699d5b4592d901d.1750274467.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Kees Cook Acked-by: Mike Rapoport (Microsoft) Acked-by: Jan Kara Acked-by: Christian Brauner Reviewed-by: Vlastimil Babka Acked-by: Oscar Salvador Reviewed-by: Pedro Falcato Acked-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Anshuman Khandual Cc: Jann Horn Cc: Liam R. Howlett Cc: Catalin Marinas Cc: Jarkko Sakkinen Signed-off-by: Andrew Morton commit 78ddaa358ec4cdd60bd0e243ced1c83a52c30241 Author: Lorenzo Stoakes Date: Wed Jun 18 20:42:52 2025 +0100 mm: change vm_get_page_prot() to accept vm_flags_t argument Patch series "use vm_flags_t consistently". The VMA flags field vma->vm_flags is of type vm_flags_t. Right now this is exactly equivalent to unsigned long, but it should not be assumed to be. Much code that references vma->vm_flags already correctly uses vm_flags_t, but a fairly large chunk of code simply uses unsigned long and assumes that the two are equivalent. This series corrects that and has us use vm_flags_t consistently. This series is motivated by the desire to, in a future series, adjust vm_flags_t to be a u64 regardless of whether the kernel is 32-bit or 64-bit in order to deal with the VMA flag exhaustion issue and avoid all the various problems that arise from it (being unable to use certain features in 32-bit, being unable to add new flags except for 64-bit, etc.) This is therefore a critical first step towards that goal. At any rate, using the correct type is of value regardless. We additionally take the opportunity to refer to VMA flags as vm_flags where possible to make clear what we're referring to. Overall, this series does not introduce any functional change. This patch (of 3): We abstract the type of the VMA flags to vm_flags_t, however in may places it is simply assumed this is unsigned long, which is simply incorrect. At the moment this is simply an incongruity, however in future we plan to change this type and therefore this change is a critical requirement for doing so. Overall, this patch does not introduce any functional change. [lorenzo.stoakes@oracle.com: add missing vm_get_page_prot() instance, remove include] Link: https://lkml.kernel.org/r/552f88e1-2df8-4e95-92b8-812f7c8db829@lucifer.local Link: https://lkml.kernel.org/r/cover.1750274467.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/a12769720a2743f235643b158c4f4f0a9911daf0.1750274467.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Mike Rapoport (Microsoft) Acked-by: Christian Brauner Reviewed-by: Vlastimil Babka Reviewed-by: Oscar Salvador Reviewed-by: Pedro Falcato Acked-by: Catalin Marinas [arm64] Acked-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Anshuman Khandual Cc: Liam R. Howlett Cc: Lorenzo Stoakes Cc: Jann Horn Cc: Kees Cook Cc: Jan Kara Cc: Jarkko Sakkinen Signed-off-by: Andrew Morton commit e1b1fe45573aa9919c18c13fcf6ec688534f92e3 Author: SeongJae Park Date: Mon Jun 16 10:23:46 2025 -0700 Revert "mm: make alloc_demote_folio externally invokable for migration" This reverts commit a00ce85af2a1be494d3b0c9457e8e81cdcce2a89. Commit a00ce85af2a1 ("mm: make alloc_demote_folio externally invokable for migration") was made to let DAMOS_MIGRATE_{HOT,COLD} call the function. But a previous commit made DAMOS_MIGRATE_{HOT,COLD} call alloc_migration_target() instead. Hence there are no more callers of the function outside of vmscan.c. Revert the commit to make the function static again. Link: https://lkml.kernel.org/r/20250616172346.67659-4-sj@kernel.org Signed-off-by: SeongJae Park Reviewed-by: Joshua Hahn Cc: David Hildenbrand Cc: Honggyu Kim Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Signed-off-by: Andrew Morton commit 29ea04095b9697951621dd5a7843108948d056b8 Author: SeongJae Park Date: Mon Jun 16 10:23:45 2025 -0700 Revert "mm: rename alloc_demote_folio to alloc_migrate_folio" This reverts commit 8f75267d22bdf8e3baf70f2fa7092d8c2f58da71. Commit 8f75267d22bd ("mm: rename alloc_demote_folio to alloc_migrate_folio") was to reflect the fact the function is called for not only demotion, but also general migrations from DAMOS_MIGRATE_{HOT,COLD}. The previous commit made the DAMOS actions to not use alloc_migrate_folio(), though. So, demote_folio_list() is the only caller of alloc_migrate_folio(), and the name could now be rather confusing. Revert the renaming commit. Link: https://lkml.kernel.org/r/20250616172346.67659-3-sj@kernel.org Signed-off-by: SeongJae Park Reviewed-by: Joshua Hahn Cc: David Hildenbrand Cc: Honggyu Kim Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Signed-off-by: Andrew Morton commit b435415eed536d7a35516a82f5995d87035cc830 Author: SeongJae Park Date: Mon Jun 16 10:23:44 2025 -0700 mm/damon/paddr: use alloc_migartion_target() with no migration fallback nodemask Patch series "mm/damon: use alloc_migrate_target() for DAMOS_MIGRATE_{HOT,COLD}". DAMOS_MIGRATE_{HOT,COLD} implementation resembles that for demotion, and hence the behavior is also similar to that. But, since those are not only for demotion but general migrations, it would be better to match with that for move_pages() system call. Make the implementation and the behavior more similar to move_pages() by not setting migration fallback nodes, and using alloc_migration_target() instead of alloc_migrate_folio(). alloc_migrate_folio() was renamed from alloc_demote_folio() and been non-static function, to let DAMOS_MIGRATE_{HOT,COLD} call it. As alloc_migration_target() is called instead, the renaming and de-static changes are no more required but could only make future code readers be confused. Revert the changes, too. This patch (of 3): DAMOS_MIGRATE_{HOT,COLD} implementation resembles that for demote_folio_list(). Because those are not only for demotion but general folio migrations, it makes more sense to behave similarly to move_pages() system call. Make the behavior more similar to move_pages(), by using alloc_migration_target() instead of alloc_migrate_folio(), without fallback nodemask. Link: https://lkml.kernel.org/r/20250616172346.67659-2-sj@kernel.org Signed-off-by: SeongJae Park Reviewed-by: Joshua Hahn Cc: David Hildenbrand Cc: Honggyu Kim Cc: Johannes Weiner Cc: Lorenzo Stoakes Cc: Michal Hocko Cc: Qi Zheng Cc: Shakeel Butt Signed-off-by: Andrew Morton commit ec3681e873132831ba2a9c0de43f2839c9533e94 Author: Liam R. Howlett Date: Mon Jun 16 14:45:21 2025 -0400 tools/testing/radix-tree: test maple tree chaining mas_preallocate() calls Testing calling multiple mas_preallocate() calls in a row after adjusting the maple state. Ensures new calls to mas_preallocate() will change the number of allocated nodes. Link: https://lkml.kernel.org/r/20250616184521.3382795-4-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Acked-by: Lorenzo Stoakes Cc: Hailong Liu Cc: "Liam R. Howlett" Cc: Matthew Wilcox (Oracle) Cc: Peng Zhang Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit f687fd5af8bf0358259278319f5bc18fc8c547cb Author: Liam R. Howlett Date: Mon Jun 16 14:45:19 2025 -0400 testing/radix-tree/maple: increase readers and reduce delay for faster machines Faster machines may not see the initial or updated value in the race condition. Reduce the delay so that faster machines are less likely to fail testing of the race conditions. Link: https://lkml.kernel.org/r/20250616184521.3382795-2-Liam.Howlett@oracle.com Signed-off-by: Liam R. Howlett Reviewed-by: Lorenzo Stoakes Cc: Hailong Liu Cc: Matthew Wilcox (Oracle) Cc: Peng Zhang Cc: Sidhartha Kumar Cc: Suren Baghdasaryan Signed-off-by: Andrew Morton commit fa493f50df3adaddf9707d14b2f972ddd388f452 Author: Baolin Wang Date: Fri Jun 13 17:12:19 2025 +0800 mm: huge_memory: fix the check for allowed huge orders in shmem Shmem already supports mTHP, and shmem_allowable_huge_orders() will return the huge orders allowed by shmem. However, there is no check against the 'orders' parameter passed by __thp_vma_allowable_orders(), which can lead to incorrect check results for __thp_vma_allowable_orders(). For example, when a user wants to check if shmem supports PMD-sized THP by thp_vma_allowable_order(), if shmem only enables 64K mTHP, the current logic would cause thp_vma_allowable_order() to return true, implying that shmem allows PMD-sized THP allocation, which it actually does not. I don't think this will cause a significant impact on users, and this will only have some impact on the shmem THP collapse. That is to say, even though the shmem sysfs setting does not enable the PMD-sized THP, the thp_vma_allowable_order() still indicates that shmem allows PMD-sized collapse, meaning it might successfully collapse into THP, or it might not (for example, thp_vma_suitable_order() check failed in the collapse process). However, this still does not align with the shmem sysfs configuration, fix it. Link: https://lkml.kernel.org/r/529affb3220153d0d5a542960b535cdfc33f51d7.1749804835.git.baolin.wang@linux.alibaba.com Fixes: 26c7d8413aaf ("mm: thp: support "THPeligible" semantics for mTHP with anonymous shmem") Signed-off-by: Baolin Wang Reviewed-by: Lorenzo Stoakes Acked-by: Zi Yan Acked-by: David Hildenbrand Cc: Barry Song Cc: Dev Jain Cc: Liam Howlett Cc: Mariano Pache Cc: Ryan Roberts Signed-off-by: Andrew Morton commit 3e49aa8e6510be458c1120d6d2a9deac9bc40253 Author: Mark Brown Date: Fri Jun 13 12:44:07 2025 +0100 selftest/mm: skip if fallocate() is unsupported in gup_longterm Currently gup_longterm assumes that filesystems support fallocate() and uses that to allocate space in files, however this is an optional feature and is in particular not implemented by NFSv3 which is commonly used in CI systems leading to spurious failures. Check for lack of support and report a skip instead for that case. Link: https://lkml.kernel.org/r/20250613-selftest-mm-gup-longterm-fallocate-nfs-v1-1-758a104c175f@kernel.org Signed-off-by: Mark Brown Cc: David Hildenbrand Cc: Shuah Khan Signed-off-by: Andrew Morton commit 4535cb331cfbdbc73d42887330e46e87a4589e6d Author: Lorenzo Stoakes Date: Fri Jun 13 19:48:07 2025 +0100 mm/vma: use vmg->target to specify target VMA for new VMA merge In commit 3a75ccba047b ("mm: simplify vma merge structure and expand comments") we introduced the vmg->target field to make the merging of existing VMAs simpler - clarifying precisely which VMA would eventually become the merged VMA once the merge operation was complete. New VMA merging did not get quite the same treatment, retaining the rather confusing convention of storing the target VMA in vmg->middle. This patch corrects this state of affairs, utilising vmg->target for this purpose for both vma_merge_new_range() and also for vma_expand(). We retain the WARN_ON for vmg->middle being specified in vma_merge_new_range() as doing so would make no sense, but add an additional debug assert for setting vmg->target. This patch additionally updates VMA userland testing to account for this change. [lorenzo.stoakes@oracle.com: make comment consistent in vma_expand()] Link: https://lkml.kernel.org/r/c54f45e3-a6ac-4749-93c0-cc9e3080ee37@lucifer.local Link: https://lkml.kernel.org/r/20250613184807.108089-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Vlastimil Babka Cc: Jann Horn Cc: Kees Cook Cc: Liam Howlett Signed-off-by: Andrew Morton commit 9e82db9c0cdafa068969373b4bad140f72988e32 Author: Matthew Wilcox (Oracle) Date: Fri Jun 13 20:48:23 2025 +0100 highmem: remove a use of folio->page Call folio_address() instead of page_address(). Link: https://lkml.kernel.org/r/20250613194825.3175276-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: David Hildenbrand Signed-off-by: Andrew Morton commit 32925ee63beb7e1a3fad25e2f54cefa2d32612de Author: Matthew Wilcox (Oracle) Date: Fri Jun 13 20:47:43 2025 +0100 secretmem: remove uses of struct page Use filemap_lock_folio() instead of find_lock_page() to retrieve a folio from the page cache. [lorenzo.stoakes@oracle.com: fix check of filemap_lock_folio() return value] Link: https://lkml.kernel.org/r/fdbca1d0-01a3-4653-85ed-cf257bb848be@lucifer.local Link: https://lkml.kernel.org/r/20250613194744.3175157-1-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Lorenzo Stoakes Reviewed-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Signed-off-by: Andrew Morton commit 02825c0925fbd53c085e88a1b7603eee8c9c6751 Author: David Hildenbrand Date: Fri Jun 13 11:27:02 2025 +0200 mm/huge_memory: don't mark refcounted folios special in vmf_insert_folio_pud() Marking PUDs that map a "normal" refcounted folios as special is against our rules documented for vm_normal_page(). normal (refcounted) folios shall never have the page table mapping marked as special. Fortunately, there are not that many pud_special() check that can be mislead and are right now rather harmless: e.g., none so far bases decisions whether to grab a folio reference on that decision. Well, and GUP-fast will fallback to GUP-slow. All in all, so far no big implications as it seems. Getting this right will get more important as we introduce folio_normal_page_pud() and start using it in more place where we currently special-case based on other VMA flags. Fix it just like we fixed vmf_insert_folio_pmd(). Add folio_mk_pud() to mimic what we do with folio_mk_pmd(). Link: https://lkml.kernel.org/r/20250613092702.1943533-4-david@redhat.com Fixes: dbe54153296d ("mm/huge_memory: add vmf_insert_folio_pud()") Signed-off-by: David Hildenbrand Reviewed-by: Dan Williams Reviewed-by: Lorenzo Stoakes Reviewed-by: Jason Gunthorpe Tested-by: Dan Williams Reviewed-by: Oscar Salvador Cc: Alistair Popple Cc: Baolin Wang Cc: Dev Jain Cc: Liam Howlett Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit c4297465d4ca27f1f7c9e6c698b13c77d9ed50b9 Author: David Hildenbrand Date: Fri Jun 13 11:27:01 2025 +0200 mm/huge_memory: don't mark refcounted folios special in vmf_insert_folio_pmd() Marking PMDs that map a "normal" refcounted folios as special is against our rules documented for vm_normal_page(): normal (refcounted) folios shall never have the page table mapping marked as special. Fortunately, there are not that many pmd_special() check that can be mislead, and most vm_normal_page_pmd()/vm_normal_folio_pmd() users that would get this wrong right now are rather harmless: e.g., none so far bases decisions whether to grab a folio reference on that decision. Well, and GUP-fast will fallback to GUP-slow. All in all, so far no big implications as it seems. Getting this right will get more important as we use folio_normal_page_pmd() in more places. Fix it by teaching insert_pfn_pmd() to properly handle folios and pfns -- moving refcount/mapcount/etc handling in there, renaming it to insert_pmd(), and distinguishing between both cases using a new simple "struct folio_or_pfn" structure. Use folio_mk_pmd() to create a pmd for a folio cleanly. Link: https://lkml.kernel.org/r/20250613092702.1943533-3-david@redhat.com Fixes: 6c88f72691f8 ("mm/huge_memory: add vmf_insert_folio_pmd()") Signed-off-by: David Hildenbrand Reviewed-by: Jason Gunthorpe Reviewed-by: Lorenzo Stoakes Reviewed-by: Dan Williams Tested-by: Dan Williams Reviewed-by: Oscar Salvador Cc: Alistair Popple Cc: Baolin Wang Cc: Dev Jain Cc: Liam Howlett Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Signed-off-by: Andrew Morton commit 09fefdca80aebd1023e827cb0ee174983d829d18 Author: David Hildenbrand Date: Fri Jun 13 11:27:00 2025 +0200 mm/huge_memory: don't ignore queried cachemode in vmf_insert_pfn_pud() Patch series "mm/huge_memory: vmf_insert_folio_*() and vmf_insert_pfn_pud() fixes", v3. While working on improving vm_normal_page() and friends, I stumbled over this issues: refcounted "normal" folios must not be marked using pmd_special() / pud_special(). Otherwise, we're effectively telling the system that these folios are no "normal", violating the rules we documented for vm_normal_page(). Fortunately, there are not many pmd_special()/pud_special() users yet. So far there doesn't seem to be serious damage. Tested using the ndctl tests ("ndctl:dax" suite). This patch (of 3): We set up the cache mode but ... don't forward the updated pgprot to insert_pfn_pud(). Only a problem on x86-64 PAT when mapping PFNs using PUDs that require a special cachemode. Fix it by using the proper pgprot where the cachemode was setup. It is unclear in which configurations we would get the cachemode wrong: through vfio seems possible. Getting cachemodes wrong is usually ... bad. As the fix is easy, let's backport it to stable. Identified by code inspection. Link: https://lkml.kernel.org/r/20250613092702.1943533-1-david@redhat.com Link: https://lkml.kernel.org/r/20250613092702.1943533-2-david@redhat.com Fixes: 7b806d229ef1 ("mm: remove vmf_insert_pfn_xxx_prot() for huge page-table entries") Signed-off-by: David Hildenbrand Reviewed-by: Dan Williams Reviewed-by: Lorenzo Stoakes Reviewed-by: Jason Gunthorpe Reviewed-by: Oscar Salvador Tested-by: Dan Williams Cc: Alistair Popple Cc: Baolin Wang Cc: Dev Jain Cc: Liam Howlett Cc: Mariano Pache Cc: Michal Hocko Cc: Mike Rapoport Cc: Ryan Roberts Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Zi Yan Cc: Signed-off-by: Andrew Morton commit f081a460bbac54c5ec460aac42079974ee413bd6 Author: Baolin Wang Date: Fri Jun 13 09:49:20 2025 +0800 selftests: mm: add shmem collapse as a default test item Currently, we only test anonymous memory collapse by default. We should also add shmem collapse as a default test item to catch issues that could break the test cases. Link: https://lkml.kernel.org/r/a30b1529b399f2e649b5a05c3d352f41a68faeae.1749779183.git.baolin.wang@linux.alibaba.com Signed-off-by: Baolin Wang Reviewed-by: Dev Jain Tested-by: Dev Jain Acked-by: David Hildenbrand Acked-by: Zi Yan Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Ryan Roberts Cc: Shuah Khan Signed-off-by: Andrew Morton commit 7962e05a835f5a40fed4f13f415d6a48b00a93c3 Author: Baolin Wang Date: Fri Jun 13 09:49:19 2025 +0800 selftests: khugepaged: fix the shmem collapse failure When running the khugepaged selftest for shmem (./khugepaged all:shmem), I encountered the following test failures: : Run test: collapse_full (khugepaged:shmem) : Collapse multiple fully populated PTE table.... Fail : ... : Run test: collapse_single_pte_entry (khugepaged:shmem) : Collapse PTE table with single PTE entry present.... Fail : ... : Run test: collapse_full_of_compound (khugepaged:shmem) : Allocate huge page... OK : Split huge page leaving single PTE page table full of compound pages... OK : Collapse PTE table full of compound pages.... Fail The reason for the failure is that it will set MADV_NOHUGEPAGE to prevent khugepaged from continuing to scan shmem VMA after khugepaged finishes scanning in the wait_for_scan() function. Moreover, shmem requires a refault to establish PMD mappings. However, after commit 2b0f922323cc ("mm: don't install PMD mappings when THPs are disabled by the hw/process/vma"), PMD mappings are prevented if the VMA is set with MADV_NOHUGEPAGE flag, so shmem cannot establish PMD mappings during refault. One way to fix this issue is to move the MADV_NOHUGEPAGE setting after the shmem refault. After shmem refault and check huge, the test case will unmap the shmem immediately. So it seems unnecessary to set the MADV_NOHUGEPAGE. Then we can simply drop the MADV_NOHUGEPAGE setting, and all khugepaged test cases passed. Link: https://lkml.kernel.org/r/d8502fc50d0304c2afd27ced062b1d636b7a872e.1749779183.git.baolin.wang@linux.alibaba.com Fixes: 2b0f922323cc ("mm: don't install PMD mappings when THPs are disabled by the hw/process/vma") Signed-off-by: Baolin Wang Reviewed-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Dev Jain Tested-by: Dev Jain Tested-by: Mario Casquero Cc: Barry Song Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Mariano Pache Cc: Ryan Roberts Cc: Shuah Khan Signed-off-by: Andrew Morton commit 234dda7a49ff94154b527784687f549b9f1417c1 Author: Matthew Wilcox (Oracle) Date: Thu Jun 12 15:34:41 2025 +0100 mm: remove zero_user() All users have now been converted to either memzero_page() or folio_zero_range(). Link: https://lkml.kernel.org/r/20250612143443.2848197-6-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Alex Markuze Cc: Christoph Hellwig Cc: Ilya Dryomov Cc: Ira Weiny Cc: Jens Axboe Cc: Xiubo Li Cc: Dan Carpenter Cc: Viacheslav Dubeyko Signed-off-by: Andrew Morton commit 7431f3a201b8954550ac930944870100b6627ac8 Author: Matthew Wilcox (Oracle) Date: Thu Jun 12 15:34:40 2025 +0100 ceph: convert ceph_zero_partial_page() to use a folio Retrieve a folio from the pagecache instead of a page and operate on it. Removes several hidden calls to compound_head() along with calls to deprecated functions like wait_on_page_writeback() and find_lock_page(). [dan.carpenter@linaro.org: fix NULL vs IS_ERR() bug in ceph_zero_partial_page()] Link: https://lkml.kernel.org/r/685c1424.050a0220.baa8.d6a1@mx.google.com Link: https://lkml.kernel.org/r/20250612143443.2848197-5-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Dan Carpenter Cc: Christoph Hellwig Cc: Ilya Dryomov Cc: Ira Weiny Cc: Jens Axboe Cc: Xiubo Li Cc: Dan Carpenter Cc: Alex Markuze Cc: Viacheslav Dubeyko Signed-off-by: Andrew Morton commit 88b478e55ce42c62819a3cde948f85508bdb9adb Author: Matthew Wilcox (Oracle) Date: Thu Jun 12 15:34:39 2025 +0100 direct-io: use memzero_page() memzero_page() is the new name for zero_user(). Link: https://lkml.kernel.org/r/20250612143443.2848197-4-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Alex Markuze Cc: Christoph Hellwig Cc: Ilya Dryomov Cc: Ira Weiny Cc: Jens Axboe Cc: Xiubo Li Cc: Dan Carpenter Cc: Viacheslav Dubeyko Signed-off-by: Andrew Morton commit 1a80ff0f8896750156f22dbf2d4591d79bb2a155 Author: Matthew Wilcox (Oracle) Date: Thu Jun 12 15:34:38 2025 +0100 null_blk: use memzero_page() memzero_page() is the new name for zero_user(). Link: https://lkml.kernel.org/r/20250612143443.2848197-3-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Alex Markuze Cc: Christoph Hellwig Cc: Ilya Dryomov Cc: Ira Weiny Cc: Jens Axboe Cc: Xiubo Li Cc: Dan Carpenter Cc: Viacheslav Dubeyko Signed-off-by: Andrew Morton commit ff20487308f4124fcbe806616773c88672b738f1 Author: Matthew Wilcox (Oracle) Date: Thu Jun 12 15:34:37 2025 +0100 bio: use memzero_page() in bio_truncate() Patch series "Remove zero_user()". The zero_user() API is almost unused these days. Finish the job of removing it. This patch (of 5): memzero_page() is the new name for zero_user(). Link: https://lkml.kernel.org/r/20250612143443.2848197-1-willy@infradead.org Link: https://lkml.kernel.org/r/20250612143443.2848197-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Alex Markuze Cc: Christoph Hellwig Cc: Ira Weiny Cc: Jens Axboe Cc: Ilya Dryomov Cc: Xiubo Li Cc: Dan Carpenter Cc: Viacheslav Dubeyko Signed-off-by: Andrew Morton commit a984f16fba2cbadfd8f3310cf506a484dc5bdeb6 Author: Shivank Garg Date: Wed Jun 11 05:27:07 2025 +0000 mm: use folio_expected_ref_count() helper for reference counting Replace open-coded folio reference count calculations with the folio_expected_ref_count(). No functional changes intended. Link: https://lkml.kernel.org/r/20250611052706.515408-2-shivankg@amd.com Signed-off-by: Shivank Garg Acked-by: David Hildenbrand Reviewed-by: Oscar Salvador Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Alistair Popple Cc: Arnaldo Carvalho de Melo Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Marc Rutland Cc: "Masami Hiramatsu (Google)" Cc: Matthew Wilcox (Oracle) Cc: Namhyung kim Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Steven Rostedt Signed-off-by: Andrew Morton commit a788b6e571f3cb1aceb1611e97010be7334cbd63 Author: Pu Lehui Date: Wed Jun 11 10:01:06 2025 +0000 selftests/mm: use generic read_sysfs in thuge-gen test As generic read_sysfs is available in vm_utils, let's use is in thuge-gen test. Link: https://lkml.kernel.org/r/20250611100106.1331197-1-pulehui@huaweicloud.com Signed-off-by: Pu Lehui Reviewed-by: Lorenzo Stoakes Cc: Shuah Khan Signed-off-by: Andrew Morton commit 4f8ba33bbdfc475fdc1ac5de6a93f5de93203ed5 Author: Barry Song Date: Wed Jun 11 22:47:45 2025 +1200 mm: madvise: use per_vma lock for MADV_FREE MADV_FREE is another option, besides MADV_DONTNEED, for dynamic memory freeing in user-space native or Java heap memory management. For example, jemalloc can be configured to use MADV_FREE, and recent versions of the Android Java heap have also increasingly adopted MADV_FREE. Supporting per-VMA locking for MADV_FREE thus appears increasingly necessary. We have replaced walk_page_range() with walk_page_range_vma(). Along with the proposed madvise_lock_mode by Lorenzo, the necessary infrastructure is now in place to begin exploring per-VMA locking support for MADV_FREE and potentially other madvise using walk_page_range_vma(). This patch adds support for the PGWALK_VMA_RDLOCK walk_lock mode in walk_page_range_vma(), and leverages madvise_lock_mode from madv_behavior to select the appropriate walk_lock—either mmap_lock or per-VMA lock—based on the context. Because we now dynamically update the walk_ops->walk_lock field, we must ensure this is thread-safe. The madvise_free_walk_ops is now defined as a stack variable instead of a global constant. Link: https://lkml.kernel.org/r/20250611104745.57405-1-21cnbao@gmail.com Signed-off-by: Barry Song Acked-by: David Hildenbrand Reviewed-by: Lorenzo Stoakes Acked-by: SeongJae Park Cc: "Liam R. Howlett" Cc: Vlastimil Babka Cc: Jann Horn Cc: Suren Baghdasaryan Cc: Lokesh Gidra Cc: Mike Rapoport Cc: Michal Hocko Cc: Tangquan Zheng Cc: Qi Zheng Signed-off-by: Andrew Morton commit f822a9a81a31311d67f260aea96005540b18ab07 Author: Dev Jain Date: Tue Jun 10 09:20:43 2025 +0530 mm: optimize mremap() by PTE batching Use folio_pte_batch() to optimize move_ptes(). On arm64, if the ptes are painted with the contig bit, then ptep_get() will iterate through all 16 entries to collect a/d bits. Hence this optimization will result in a 16x reduction in the number of ptep_get() calls. Next, ptep_get_and_clear() will eventually call contpte_try_unfold() on every contig block, thus flushing the TLB for the complete large folio range. Instead, use get_and_clear_full_ptes() so as to elide TLBIs on each contig block, and only do them on the starting and ending contig block. For split folios, there will be no pte batching; nr_ptes will be 1. For pagetable splitting, the ptes will still point to the same large folio; for arm64, this results in the optimization described above, and for other arches (including the general case), a minor improvement is expected due to a reduction in the number of function calls. Link: https://lkml.kernel.org/r/20250610035043.75448-3-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Barry Song Reviewed-by: Lorenzo Stoakes Reviewed-by: Pedro Falcato Cc: Anshuman Khandual Cc: Bang Li Cc: Baolin Wang Cc: bibo mao Cc: David Hildenbrand Cc: Hugh Dickins Cc: Ingo Molnar Cc: Jann Horn Cc: Lance Yang Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Qi Zheng Cc: Ryan Roberts Cc: Vlastimil Babka Cc: Yang Shi Cc: Zi Yan Signed-off-by: Andrew Morton commit 94dab12d86cf77ff0b8f667dc98af6d997422cb4 Author: Dev Jain Date: Tue Jun 10 09:20:42 2025 +0530 mm: call pointers to ptes as ptep Patch series "Optimize mremap() for large folios", v4. Currently move_ptes() iterates through ptes one by one. If the underlying folio mapped by the ptes is large, we can process those ptes in a batch using folio_pte_batch(), thus clearing and setting the PTEs in one go. For arm64 specifically, this results in a 16x reduction in the number of ptep_get() calls (since on a contig block, ptep_get() on arm64 will iterate through all 16 entries to collect a/d bits), and we also elide extra TLBIs through get_and_clear_full_ptes, replacing ptep_get_and_clear. Mapping 1M of memory with 64K folios, memsetting it, remapping it to src + 1M, and munmapping it 10,000 times, the average execution time reduces from 1.9 to 1.2 seconds, giving a 37% performance optimization, on Apple M3 (arm64). No regression is observed for small folios. Test program for reference: #define _GNU_SOURCE #include #include #include #include #include #include #define SIZE (1UL << 20) // 1M int main(void) { void *new_addr, *addr; for (int i = 0; i < 10000; ++i) { addr = mmap((void *)(1UL << 30), SIZE, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (addr == MAP_FAILED) { perror("mmap"); return 1; } memset(addr, 0xAA, SIZE); new_addr = mremap(addr, SIZE, SIZE, MREMAP_MAYMOVE | MREMAP_FIXED, addr + SIZE); if (new_addr != (addr + SIZE)) { perror("mremap"); return 1; } munmap(new_addr, SIZE); } } This patch (of 2): Avoid confusion between pte_t* and pte_t data types by suffixing pointer type variables with p. No functional change. Link: https://lkml.kernel.org/r/20250610035043.75448-1-dev.jain@arm.com Link: https://lkml.kernel.org/r/20250610035043.75448-2-dev.jain@arm.com Signed-off-by: Dev Jain Reviewed-by: Barry Song Reviewed-by: Anshuman Khandual Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Pedro Falcato Cc: Bang Li Cc: Baolin Wang Cc: bibo mao Cc: Hugh Dickins Cc: Ingo Molnar Cc: Jann Horn Cc: Lance Yang Cc: Liam Howlett Cc: Matthew Wilcox (Oracle) Cc: Peter Xu Cc: Qi Zheng Cc: Ryan Roberts Cc: Vlastimil Babka Cc: Yang Shi Cc: Zi Yan Signed-off-by: Andrew Morton commit cce35103135c7ffc7bebc32ebfc74fe1f2c3cb5d Author: Li Zhijian Date: Tue Jun 10 14:27:51 2025 +0800 mm/memory-tier: fix abstract distance calculation overflow In mt_perf_to_adistance(), the calculation of abstract distance (adist) involves multiplying several int values including MEMTIER_ADISTANCE_DRAM. *adist = MEMTIER_ADISTANCE_DRAM * (perf->read_latency + perf->write_latency) / (default_dram_perf.read_latency + default_dram_perf.write_latency) * (default_dram_perf.read_bandwidth + default_dram_perf.write_bandwidth) / (perf->read_bandwidth + perf->write_bandwidth); Since these values can be large, the multiplication may exceed the maximum value of an int (INT_MAX) and overflow (Our platform did), leading to an incorrect adist. User-visible impact: The memory tiering subsystem will misinterpret slow memory (like CXL) as faster than DRAM, causing inappropriate demotion of pages from CXL (slow memory) to DRAM (fast memory). For example, we will see the following demotion chains from the dmesg, where Node0,1 are DRAM, and Node2,3 are CXL node: Demotion targets for Node 0: null Demotion targets for Node 1: null Demotion targets for Node 2: preferred: 0-1, fallback: 0-1 Demotion targets for Node 3: preferred: 0-1, fallback: 0-1 Change MEMTIER_ADISTANCE_DRAM to be a long constant by writing it with the 'L' suffix. This prevents the overflow because the multiplication will then be done in the long type which has a larger range. Link: https://lkml.kernel.org/r/20250611023439.2845785-1-lizhijian@fujitsu.com Link: https://lkml.kernel.org/r/20250610062751.2365436-1-lizhijian@fujitsu.com Fixes: 3718c02dbd4c ("acpi, hmat: calculate abstract distance with HMAT") Signed-off-by: Li Zhijian Reviewed-by: Huang Ying Acked-by: Balbir Singh Reviewed-by: Donet Tom Reviewed-by: Oscar Salvador Cc: Signed-off-by: Andrew Morton commit 9f44df50fee4d2f6cb374177244ccfa9f0a5cc95 Author: David Wang <00107082@163.com> Date: Mon Jun 9 14:44:08 2025 +0800 alloc_tag: keep codetag iterator active between read() When reading /proc/allocinfo, for each read syscall, seq_file would invoke start/stop callbacks. In start callback, a memory is alloced to store iterator and the iterator would start from beginning to walk linearly to current read position. seq_file read() takes at most 4096 bytes, even if read with a larger user space buffer, meaning read out all of /proc/allocinfo, tens of read syscalls are needed. For example, a 306036 bytes allocinfo files need 76 reads: $ sudo cat /proc/allocinfo | wc 3964 16678 306036 $ sudo strace -T -e read cat /proc/allocinfo ... read(3, " 4096 1 arch/x86/k"..., 131072) = 4063 <0.000062> ... read(3, " 0 0 sound/core"..., 131072) = 4021 <0.000150> ... For those n=3964 lines, each read takes about m=3964/76=52 lines, since iterator restart from beginning for each read(), it would move forward m steps on 1st read 2*m steps on 2nd read 3*m steps on 3rd read ... n steps on last read As read() along, those linear seek steps make read() calls slower and slower. Adding those up, codetag iterator moves about O(n*n/m) steps, making data structure traversal take significant part of the whole reading. Profiling when stress reading /proc/allocinfo confirms it: vfs_read(99.959% 1677299/1677995) proc_reg_read_iter(99.856% 1674881/1677299) seq_read_iter(99.959% 1674191/1674881) allocinfo_start(75.664% 1266755/1674191) codetag_next_ct(79.217% 1003487/1266755) <--- srso_return_thunk(1.264% 16011/1266755) __kmalloc_cache_noprof(0.102% 1296/1266755) ... allocinfo_show(21.287% 356378/1674191) allocinfo_next(1.530% 25621/1674191) codetag_next_ct() takes major part. A private data alloced at open() time can be used to carry iterator alive across read() calls, and avoid the memory allocation and iterator reset for each read(). This way, only O(1) memory allocation and O(n) steps iterating, and `time` shows performance improvement from ~7ms to ~4ms. Profiling with the change: vfs_read(99.865% 1581073/1583214) proc_reg_read_iter(99.485% 1572934/1581073) seq_read_iter(99.846% 1570519/1572934) allocinfo_show(87.428% 1373074/1570519) seq_buf_printf(83.695% 1149196/1373074) seq_buf_putc(1.917% 26321/1373074) _find_next_bit(1.531% 21023/1373074) ... codetag_to_text(0.490% 6727/1373074) ... allocinfo_next(6.275% 98543/1570519) ... allocinfo_start(0.369% 5790/1570519) ... Now seq_buf_printf() takes major part. Link: https://lkml.kernel.org/r/20250609064408.112783-1-00107082@163.com Signed-off-by: David Wang <00107082@163.com> Acked-by: Suren Baghdasaryan Cc: Kent Overstreet Cc: Tim Chen Signed-off-by: Andrew Morton commit b0da7709c28c35e0a51d4b1b350c9028358dfb14 Author: David Wang <00107082@163.com> Date: Mon Jun 9 14:42:00 2025 +0800 alloc_tag: add sequence number for module and iterator Codetag iterator use pair to guarantee the validness. But both id and address can be reused, there is theoretical possibility when module inserted right after another module removed, kmalloc returns an address same as the address kfree by previous module and IDR key reuses the key recently removed. Add a sequence number to codetag_module and code_iterator, the sequence number is strickly incremented whenever a module is loaded. An iterator is valid if and only if its sequence number match codetag_module's. Link: https://lkml.kernel.org/r/20250609064200.112639-1-00107082@163.com Signed-off-by: David Wang <00107082@163.com> Acked-by: Suren Baghdasaryan Cc: Kent Overstreet Cc: Tim Chen Signed-off-by: Andrew Morton commit a03db236aebfaeadf79396dbd570896b870bda01 Author: Li Zhe Date: Fri Jun 6 10:37:42 2025 +0800 gup: optimize longterm pin_user_pages() for large folio In the current implementation of longterm pin_user_pages(), we invoke collect_longterm_unpinnable_folios(). This function iterates through the list to check whether each folio belongs to the "longterm_unpinnabled" category. The folios in this list essentially correspond to a contiguous region of userspace addresses, with each folio representing a physical address in increments of PAGESIZE. If this userspace address range is mapped with large folio, we can optimize the performance of function collect_longterm_unpinnable_folios() by reducing the using of READ_ONCE() invoked in pofs_get_folio()->page_folio()->_compound_head(). Also, we can simplify the logic of collect_longterm_unpinnable_folios(). Instead of comparing with prev_folio after calling pofs_get_folio(), we can check whether the next page is within the same folio. The performance test results, based on v6.15, obtained through the gup_test tool from the kernel source tree are as follows. We achieve an improvement of over 66% for large folio with pagesize=2M. For small folio, we have only observed a very slight degradation in performance. Without this patch: [root@localhost ~] ./gup_test -HL -m 8192 -n 512 TAP version 13 1..1 # PIN_LONGTERM_BENCHMARK: Time: get:14391 put:10858 us# ok 1 ioctl status 0 # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 [root@localhost ~]# ./gup_test -LT -m 8192 -n 512 TAP version 13 1..1 # PIN_LONGTERM_BENCHMARK: Time: get:130538 put:31676 us# ok 1 ioctl status 0 # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 With this patch: [root@localhost ~] ./gup_test -HL -m 8192 -n 512 TAP version 13 1..1 # PIN_LONGTERM_BENCHMARK: Time: get:4867 put:10516 us# ok 1 ioctl status 0 # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 [root@localhost ~]# ./gup_test -LT -m 8192 -n 512 TAP version 13 1..1 # PIN_LONGTERM_BENCHMARK: Time: get:131798 put:31328 us# ok 1 ioctl status 0 # Totals: pass:1 fail:0 xfail:0 xpass:0 skip:0 error:0 [lizhe.67@bytedance.com: whitespace fix, per David] Link: https://lkml.kernel.org/r/20250606091917.91384-1-lizhe.67@bytedance.com Link: https://lkml.kernel.org/r/20250606023742.58344-1-lizhe.67@bytedance.com Signed-off-by: Li Zhe Cc: David Hildenbrand Cc: Dev Jain Cc: Jason Gunthorpe Cc: John Hubbard Cc: Muchun Song Cc: Peter Xu Signed-off-by: Andrew Morton commit 96d81e4766f9e88b66a0502b5a7f34a4c20ac754 Author: Lorenzo Stoakes Date: Thu Jun 5 14:51:04 2025 +0100 mm/pagewalk: split walk_page_range_novma() into kernel/user parts walk_page_range_novma() is rather confusing - it supports two modes, one used often, the other used only for debugging. The first mode is the common case of traversal of kernel page tables, which is what nearly all callers use this for. Secondly it provides an unusual debugging interface that allows for the traversal of page tables in a userland range of memory even for that memory which is not described by a VMA. It is far from certain that such page tables should even exist, but perhaps this is precisely why it is useful as a debugging mechanism. As a result, this is utilised by ptdump only. Historically, things were reversed - ptdump was the only user, and other parts of the kernel evolved to use the kernel page table walking here. Since we have some complicated and confusing locking rules for the novma case, it makes sense to separate the two usages into their own functions. Doing this also provide self-documentation as to the intent of the caller - are they doing something rather unusual or are they simply doing a standard kernel page table walk? We therefore establish two separate functions - walk_page_range_debug() for this single usage, and walk_kernel_page_table_range() for general kernel page table walking. The walk_page_range_debug() function is currently used to traverse both userland and kernel mappings, so we maintain this and in the case of kernel mappings being traversed, we have walk_page_range_debug() invoke walk_kernel_page_table_range() internally. We additionally make walk_page_range_debug() internal to mm. Link: https://lkml.kernel.org/r/20250605135104.90720-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: Mike Rapoport (Microsoft) Acked-by: Qi Zheng Reviewed-by: Oscar Salvador Reviewed-by: Suren Baghdasaryan Reviewed-by: Vlastimil Babka Acked-by: David Hildenbrand Cc: Albert Ou Cc: Alexandre Ghiti Cc: Barry Song Cc: Huacai Chen Cc: Jann Horn Cc: Jonas Bonn Cc: Liam Howlett Cc: Michal Hocko Cc: Muchun Song Cc: Palmer Dabbelt Cc: Paul Walmsley Cc: Stafford Horne Cc: Stefan Kristiansson Cc: WANG Xuerui Signed-off-by: Andrew Morton commit 03dfefdacfe7127ff9c8a5167b0e72f6ab9fb9db Author: Ye Liu Date: Tue Jun 10 16:37:30 2025 +0800 mm/memfd: clarify error handling labels in memfd_create() err_name --> err_free_name (fd failure case) err_fd --> err_free_fd (file failure case) Link: https://lkml.kernel.org/r/20250610083730.527619-1-ye.liu@linux.dev Signed-off-by: Ye Liu Signed-off-by: Andrew Morton commit 6046a3bed1c2b028e692f7606e3450d1c93e8fdd Author: Arnd Bergmann Date: Tue Jun 10 11:21:50 2025 +0200 lib/test_hmm: reduce stack usage The various test ioctl handlers use arrays of 64 integers that add up to 1KiB of stack data, which in turn leads to exceeding the warning limit in some configurations: lib/test_hmm.c:935:12: error: stack frame size (1408) exceeds limit (1280) in 'dmirror_migrate_to_device' [-Werror,-Wframe-larger-than] Use half the size for these arrays, in order to stay under the warning limits. The code can already deal with arbitrary lengths, but this may be a little less efficient. Link: https://lkml.kernel.org/r/20250610092159.2639515-1-arnd@kernel.org Signed-off-by: Arnd Bergmann Cc: Alistair Popple Cc: David Hildenbrand Cc: Jason Gunthorpe Cc: Jeff Johnson Cc: Jerome Glisse Cc: Thorsten Blum Signed-off-by: Andrew Morton commit ba78585585d9f5ec4dd32de7b3027a86fe33cee0 Author: Mark Brown Date: Tue Jun 10 15:07:44 2025 +0100 selftests/mm: check for YAMA ptrace_scope configuraiton before modifying it When running the memfd_secret test run_vmtests.sh unconditionally tries to confgiure the YAMA LSM's ptrace_scope configuration, leading to an error if YAMA is not in the running kernel: # ./run_vmtests.sh: line 432: /proc/sys/kernel/yama/ptrace_scope: No such file or directory # # ---------------------- # # running ./memfd_secret # # ---------------------- Check that this file is present before trying to write to it. The indentation here is a bit odd, and it doesn't seem great that we configure but don't restore ptrace_scope. Link: https://lkml.kernel.org/r/20250610-selftest-mm-enable-yama-v1-1-0097b6713116@kernel.org Signed-off-by: Mark Brown Acked-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Cc: Shuah Khan Signed-off-by: Andrew Morton commit 4ff52d4a2de1c2adc77b2cca82b542cd916b42a9 Author: Mark Brown Date: Tue Jun 10 15:13:57 2025 +0100 selftests/mm: add messages about test errors to the cow tests It is not sufficiently clear what the individual tests in the cow test program are checking so add messages for the failure cases. Link: https://lkml.kernel.org/r/20250610-selftest-mm-cow-tweaks-v1-4-43cd7457500f@kernel.org Signed-off-by: Mark Brown Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Shuah Khan Signed-off-by: Andrew Morton commit 32dc2d5e3f0de7a62dd85b2ec2be2964449c4796 Author: Mark Brown Date: Tue Jun 10 15:13:56 2025 +0100 selftests/mm: don't compare return values to in cow Tweak the coding style for checking for non-zero return values. While we're at it also remove a now redundant oring of the madvise() return code. Link: https://lkml.kernel.org/r/20250610-selftest-mm-cow-tweaks-v1-3-43cd7457500f@kernel.org Signed-off-by: Mark Brown Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Shuah Khan Signed-off-by: Andrew Morton commit 5fbfb1f39da0a5cbfe66e9ab67790e607b8f6e58 Author: Mark Brown Date: Tue Jun 10 15:13:55 2025 +0100 selftests/mm: convert some cow error reports to ksft_perror() This prints the errno and a string decode of it. Link: https://lkml.kernel.org/r/20250610-selftest-mm-cow-tweaks-v1-2-43cd7457500f@kernel.org Signed-off-by: Mark Brown Acked-by: David Hildenbrand Cc: Shuah Khan Signed-off-by: Andrew Morton commit be3d3343d467905b14fe62cb1dafa68906e4d5ed Author: Mark Brown Date: Tue Jun 10 15:13:54 2025 +0100 kselftest/mm: clarify errors for pipe() Patch series "selftests/mm: Tweaks to the cow test". A collection of non-functional updates from David Hildenbrand's review. This patch (of 4): Specify that errors reported from pipe() failures are the result of failures. Link: https://lkml.kernel.org/r/20250610-selftest-mm-cow-tweaks-v1-0-43cd7457500f@kernel.org Link: https://lkml.kernel.org/r/20250610-selftest-mm-cow-tweaks-v1-1-43cd7457500f@kernel.org Signed-off-by: Mark Brown Suggested-by: David Hildenbrand Acked-by: David Hildenbrand Cc: Mark Brown Cc: Shuah Khan Signed-off-by: Andrew Morton commit 7e43195c609f0499e46c6bfa9472e39c76af445b Author: Casey Chen Date: Tue Jun 10 10:22:58 2025 -0600 alloc_tag: remove empty module tag section The empty MOD_CODETAG_SECTIONS() macro added an incomplete .data section in module linker script, which caused symbol lookup tools like gdb to misinterpret symbol addresses e.g., __ib_process_cq incorrectly mapping to unrelated functions like below. (gdb) disas __ib_process_cq Dump of assembler code for function trace_event_fields_cq_schedule: Removing the empty section restores proper symbol resolution and layout, ensuring .data placement behaves as expected. Link: https://lkml.kernel.org/r/20250610162258.324645-1-cachen@purestorage.com Fixes: 0db6f8d7820a ("alloc_tag: load module tags into separate contiguous memory") 22d407b164ff ("lib: add allocation tagging support for memory allocation profiling") Signed-off-by: Casey Chen Reviewed-by: Yuanyuan Zhong Acked-by: Suren Baghdasaryan Cc: Arnd Bergmann Cc: Kent Overstreet Cc: Luis Chamberalin Cc: Pasha Tatashin Signed-off-by: Andrew Morton commit 38b0ece6d76374b989928021b5d310be11b99b5c Author: Ryan Roberts Date: Mon Jun 9 10:27:27 2025 +0100 mm/filemap: allow arch to request folio size for exec memory Change the readahead config so that if it is being requested for an executable mapping, do a synchronous read into a set of folios with an arch-specified order and in a naturally aligned manner. We no longer center the read on the faulting page but simply align it down to the previous natural boundary. Additionally, we don't bother with an asynchronous part. On arm64 if memory is physically contiguous and naturally aligned to the "contpte" size, we can use contpte mappings, which improves utilization of the TLB. When paired with the "multi-size THP" feature, this works well to reduce dTLB pressure. However iTLB pressure is still high due to executable mappings having a low likelihood of being in the required folio size and mapping alignment, even when the filesystem supports readahead into large folios (e.g. XFS). The reason for the low likelihood is that the current readahead algorithm starts with an order-0 folio and increases the folio order by 2 every time the readahead mark is hit. But most executable memory tends to be accessed randomly and so the readahead mark is rarely hit and most executable folios remain order-0. So let's special-case the read(ahead) logic for executable mappings. The trade-off is performance improvement (due to more efficient storage of the translations in iTLB) vs potential for making reclaim more difficult (due to the folios being larger so if a part of the folio is hot the whole thing is considered hot). But executable memory is a small portion of the overall system memory so I doubt this will even register from a reclaim perspective. I've chosen 64K folio size for arm64 which benefits both the 4K and 16K base page size configs. Crucially the same amount of data is still read (usually 128K) so I'm not expecting any read amplification issues. I don't anticipate any write amplification because text is always RO. Note that the text region of an ELF file could be populated into the page cache for other reasons than taking a fault in a mmapped area. The most common case is due to the loader read()ing the header which can be shared with the beginning of text. So some text will still remain in small folios, but this simple, best effort change provides good performance improvements as is. Confine this special-case approach to the bounds of the VMA. This prevents wasting memory for any padding that might exist in the file between sections. Previously the padding would have been contained in order-0 folios and would be easy to reclaim. But now it would be part of a larger folio so more difficult to reclaim. Solve this by simply not reading it into memory in the first place. Benchmarking ============ The below shows pgbench and redis benchmarks on Graviton3 arm64 system. First, confirmation that this patch causes more text to be contained in 64K folios: +----------------------+---------------+---------------+---------------+ | File-backed folios by| system boot | pgbench | redis | | size as percentage of+-------+-------+-------+-------+-------+-------+ | all mapped text mem |before | after |before | after |before | after | +======================+=======+=======+=======+=======+=======+=======+ | base-page-4kB | 78% | 30% | 78% | 11% | 73% | 14% | | thp-aligned-8kB | 1% | 0% | 0% | 0% | 1% | 0% | | thp-aligned-16kB | 17% | 4% | 17% | 3% | 20% | 4% | | thp-aligned-32kB | 1% | 1% | 1% | 2% | 1% | 1% | | thp-aligned-64kB | 3% | 63% | 3% | 81% | 4% | 77% | | thp-aligned-128kB | 0% | 1% | 1% | 1% | 1% | 2% | | thp-unaligned-64kB | 0% | 0% | 0% | 1% | 0% | 1% | | thp-unaligned-128kB | 0% | 1% | 0% | 0% | 0% | 0% | | thp-partial | 0% | 0% | 0% | 1% | 0% | 1% | +----------------------+-------+-------+-------+-------+-------+-------+ | cont-aligned-64kB | 4% | 65% | 4% | 83% | 6% | 79% | +----------------------+-------+-------+-------+-------+-------+-------+ The above shows that for both workloads (each isolated with cgroups) as well as the general system state after boot, the amount of text backed by 4K and 16K folios reduces and the amount backed by 64K folios increases significantly. And the amount of text that is contpte-mapped significantly increases (see last row). And this is reflected in performance improvement. "(I)" indicates a statistically significant improvement. Note TPS and Reqs/sec are rates so bigger is better, ms is time so smaller is better: +-------------+-------------------------------------------+------------+ | Benchmark | Result Class | Improvemnt | +=============+===========================================+============+ | pts/pgbench | Scale: 1 Clients: 1 RO (TPS) | (I) 3.47% | | | Scale: 1 Clients: 1 RO - Latency (ms) | -2.88% | | | Scale: 1 Clients: 250 RO (TPS) | (I) 5.02% | | | Scale: 1 Clients: 250 RO - Latency (ms) | (I) -4.79% | | | Scale: 1 Clients: 1000 RO (TPS) | (I) 6.16% | | | Scale: 1 Clients: 1000 RO - Latency (ms) | (I) -5.82% | | | Scale: 100 Clients: 1 RO (TPS) | 2.51% | | | Scale: 100 Clients: 1 RO - Latency (ms) | -3.51% | | | Scale: 100 Clients: 250 RO (TPS) | (I) 4.75% | | | Scale: 100 Clients: 250 RO - Latency (ms) | (I) -4.44% | | | Scale: 100 Clients: 1000 RO (TPS) | (I) 6.34% | | | Scale: 100 Clients: 1000 RO - Latency (ms)| (I) -5.95% | +-------------+-------------------------------------------+------------+ | pts/redis | Test: GET Connections: 50 (Reqs/sec) | (I) 3.20% | | | Test: GET Connections: 1000 (Reqs/sec) | (I) 2.55% | | | Test: LPOP Connections: 50 (Reqs/sec) | (I) 4.59% | | | Test: LPOP Connections: 1000 (Reqs/sec) | (I) 4.81% | | | Test: LPUSH Connections: 50 (Reqs/sec) | (I) 5.31% | | | Test: LPUSH Connections: 1000 (Reqs/sec) | (I) 4.36% | | | Test: SADD Connections: 50 (Reqs/sec) | (I) 2.64% | | | Test: SADD Connections: 1000 (Reqs/sec) | (I) 4.15% | | | Test: SET Connections: 50 (Reqs/sec) | (I) 3.11% | | | Test: SET Connections: 1000 (Reqs/sec) | (I) 3.36% | +-------------+-------------------------------------------+------------+ [ryan.roberts@arm.com: fix use-after-free] Link: https://lkml.kernel.org/r/ea7f9da7-9a9f-4b85-9d0a-35b320f5ed25@arm.com [ryan.roberts@arm.com: use the vma_pages() helper instead of open-coding] Link: https://lkml.kernel.org/r/0e0f674b-3b7e-494f-ae7a-fc9dbb98dad4@arm.com Link: https://lkml.kernel.org/r/20250609092729.274960-6-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Reviewed-by: Jan Kara Acked-by: Will Deacon Cc: Chaitanya S Prakash Cc: David Hildenbrand Signed-off-by: Andrew Morton commit c4602f9fa77fc6bb956ca51a23e7a39439e75cb6 Author: Ryan Roberts Date: Mon Jun 9 10:27:26 2025 +0100 mm/readahead: store folio order in struct file_ra_state Previously the folio order of the previous readahead request was inferred from the folio who's readahead marker was hit. But due to the way we have to round to non-natural boundaries sometimes, this first folio in the readahead block is often smaller than the preferred order for that request. This means that for cases where the initial sync readahead is poorly aligned, the folio order will ramp up much more slowly. So instead, let's store the order in struct file_ra_state so we are not affected by any required alignment. We previously made enough room in the struct for a 16 order field. This should be plenty big enough since we are limited to MAX_PAGECACHE_ORDER anyway, which is certainly never larger than ~20. Since we now pass order in struct file_ra_state, page_cache_ra_order() no longer needs it's new_order parameter, so let's remove that. Worked example: Here we are touching pages 17-256 sequentially just as we did in the previous commit, but now that we are remembering the preferred order explicitly, we no longer have the slow ramp up problem. Note specifically that we no longer have 2 rounds (2x ~128K) of order-2 folios: TYPE STARTOFFS ENDOFFS SIZE STARTPG ENDPG NRPG ORDER RA ----- ---------- ---------- ---------- ------- ------- ----- ----- -- HOLE 0x00000000 0x00001000 4096 0 1 1 FOLIO 0x00001000 0x00002000 4096 1 2 1 0 FOLIO 0x00002000 0x00003000 4096 2 3 1 0 FOLIO 0x00003000 0x00004000 4096 3 4 1 0 FOLIO 0x00004000 0x00005000 4096 4 5 1 0 FOLIO 0x00005000 0x00006000 4096 5 6 1 0 FOLIO 0x00006000 0x00007000 4096 6 7 1 0 FOLIO 0x00007000 0x00008000 4096 7 8 1 0 FOLIO 0x00008000 0x00009000 4096 8 9 1 0 FOLIO 0x00009000 0x0000a000 4096 9 10 1 0 FOLIO 0x0000a000 0x0000b000 4096 10 11 1 0 FOLIO 0x0000b000 0x0000c000 4096 11 12 1 0 FOLIO 0x0000c000 0x0000d000 4096 12 13 1 0 FOLIO 0x0000d000 0x0000e000 4096 13 14 1 0 FOLIO 0x0000e000 0x0000f000 4096 14 15 1 0 FOLIO 0x0000f000 0x00010000 4096 15 16 1 0 FOLIO 0x00010000 0x00011000 4096 16 17 1 0 FOLIO 0x00011000 0x00012000 4096 17 18 1 0 FOLIO 0x00012000 0x00013000 4096 18 19 1 0 FOLIO 0x00013000 0x00014000 4096 19 20 1 0 FOLIO 0x00014000 0x00015000 4096 20 21 1 0 FOLIO 0x00015000 0x00016000 4096 21 22 1 0 FOLIO 0x00016000 0x00017000 4096 22 23 1 0 FOLIO 0x00017000 0x00018000 4096 23 24 1 0 FOLIO 0x00018000 0x00019000 4096 24 25 1 0 FOLIO 0x00019000 0x0001a000 4096 25 26 1 0 FOLIO 0x0001a000 0x0001b000 4096 26 27 1 0 FOLIO 0x0001b000 0x0001c000 4096 27 28 1 0 FOLIO 0x0001c000 0x0001d000 4096 28 29 1 0 FOLIO 0x0001d000 0x0001e000 4096 29 30 1 0 FOLIO 0x0001e000 0x0001f000 4096 30 31 1 0 FOLIO 0x0001f000 0x00020000 4096 31 32 1 0 FOLIO 0x00020000 0x00021000 4096 32 33 1 0 FOLIO 0x00021000 0x00022000 4096 33 34 1 0 FOLIO 0x00022000 0x00024000 8192 34 36 2 1 FOLIO 0x00024000 0x00028000 16384 36 40 4 2 FOLIO 0x00028000 0x0002c000 16384 40 44 4 2 FOLIO 0x0002c000 0x00030000 16384 44 48 4 2 FOLIO 0x00030000 0x00034000 16384 48 52 4 2 FOLIO 0x00034000 0x00038000 16384 52 56 4 2 FOLIO 0x00038000 0x0003c000 16384 56 60 4 2 FOLIO 0x0003c000 0x00040000 16384 60 64 4 2 FOLIO 0x00040000 0x00050000 65536 64 80 16 4 FOLIO 0x00050000 0x00060000 65536 80 96 16 4 FOLIO 0x00060000 0x00080000 131072 96 128 32 5 FOLIO 0x00080000 0x000a0000 131072 128 160 32 5 FOLIO 0x000a0000 0x000c0000 131072 160 192 32 5 FOLIO 0x000c0000 0x000e0000 131072 192 224 32 5 FOLIO 0x000e0000 0x00100000 131072 224 256 32 5 FOLIO 0x00100000 0x00120000 131072 256 288 32 5 FOLIO 0x00120000 0x00140000 131072 288 320 32 5 Y HOLE 0x00140000 0x00800000 7077888 320 2048 1728 Link: https://lkml.kernel.org/r/20250609092729.274960-5-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Reviewed-by: Jan Kara Cc: Chaitanya S Prakash Cc: David Hildenbrand Cc: Will Deacon Signed-off-by: Andrew Morton commit f5e8b140cd1324cf2c9c17487b8f444098624797 Author: Ryan Roberts Date: Mon Jun 9 10:27:25 2025 +0100 mm/readahead: make space in struct file_ra_state We need to be able to store the preferred folio order associated with a readahead request in the struct file_ra_state so that we can more accurately increase the order across subsequent readahead requests. But struct file_ra_state is per-struct file, so we don't really want to increase it's size. mmap_miss is currently 32 bits but it is only counted up to 10 * MMAP_LOTSAMISS, which is currently defined as 1000. So 16 bits should be plenty. Redefine it to unsigned short, making room for order as unsigned short in follow up commit. Link: https://lkml.kernel.org/r/20250609092729.274960-4-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Acked-by: David Hildenbrand Reviewed-by: Jan Kara Cc: Chaitanya S Prakash Cc: Will Deacon Signed-off-by: Andrew Morton commit 18ebe55a9236b33d519fcc8669730cd02386a2dc Author: Ryan Roberts Date: Mon Jun 9 10:27:24 2025 +0100 mm/readahead: terminate async readahead on natural boundary Previously asynchonous readahead would read ra_pages (usually 128K) directly after the end of the synchonous readahead and given the synchronous readahead portion had no alignment guarantees (beyond page boundaries) it is possible (and likely) that the end of the initial 128K region would not fall on a natural boundary for the folio size being used. Therefore smaller folios were used to align down to the required boundary, both at the end of the previous readahead block and at the start of the new one. In the worst cases, this can result in never properly ramping up the folio size, and instead getting stuck oscillating between order-0, -1 and -2 folios. The next readahead will try to use folios whose order is +2 bigger than the folio that had the readahead marker. But because of the alignment requirements, that folio (the first one in the readahead block) can end up being order-0 in some cases. There will be 2 modifications to solve this issue: 1) Calculate the readahead size so the end is aligned to a folio boundary. This prevents needing to allocate small folios to align down at the end of the window and fixes the oscillation problem. 2) Remember the "preferred folio order" in the ra state instead of inferring it from the folio with the readahead marker. This solves the slow ramp up problem (discussed in a subsequent patch). This patch addresses (1) only. A subsequent patch will address (2). Worked example: The following shows the previous pathalogical behaviour when the initial synchronous readahead is unaligned. We start reading at page 17 in the file and read sequentially from there. I'm showing a dump of the pages in the page cache just after we read the first page of the folio with the readahead marker. Initially there are no pages in the page cache: TYPE STARTOFFS ENDOFFS SIZE STARTPG ENDPG NRPG ORDER RA ----- ---------- ---------- ---------- ------- ------- ----- ----- -- HOLE 0x00000000 0x00800000 8388608 0 2048 2048 Then we access page 17, causing synchonous read-around of 128K with a readahead marker set up at page 25. So far, all as expected: TYPE STARTOFFS ENDOFFS SIZE STARTPG ENDPG NRPG ORDER RA ----- ---------- ---------- ---------- ------- ------- ----- ----- -- HOLE 0x00000000 0x00001000 4096 0 1 1 FOLIO 0x00001000 0x00002000 4096 1 2 1 0 FOLIO 0x00002000 0x00003000 4096 2 3 1 0 FOLIO 0x00003000 0x00004000 4096 3 4 1 0 FOLIO 0x00004000 0x00005000 4096 4 5 1 0 FOLIO 0x00005000 0x00006000 4096 5 6 1 0 FOLIO 0x00006000 0x00007000 4096 6 7 1 0 FOLIO 0x00007000 0x00008000 4096 7 8 1 0 FOLIO 0x00008000 0x00009000 4096 8 9 1 0 FOLIO 0x00009000 0x0000a000 4096 9 10 1 0 FOLIO 0x0000a000 0x0000b000 4096 10 11 1 0 FOLIO 0x0000b000 0x0000c000 4096 11 12 1 0 FOLIO 0x0000c000 0x0000d000 4096 12 13 1 0 FOLIO 0x0000d000 0x0000e000 4096 13 14 1 0 FOLIO 0x0000e000 0x0000f000 4096 14 15 1 0 FOLIO 0x0000f000 0x00010000 4096 15 16 1 0 FOLIO 0x00010000 0x00011000 4096 16 17 1 0 FOLIO 0x00011000 0x00012000 4096 17 18 1 0 FOLIO 0x00012000 0x00013000 4096 18 19 1 0 FOLIO 0x00013000 0x00014000 4096 19 20 1 0 FOLIO 0x00014000 0x00015000 4096 20 21 1 0 FOLIO 0x00015000 0x00016000 4096 21 22 1 0 FOLIO 0x00016000 0x00017000 4096 22 23 1 0 FOLIO 0x00017000 0x00018000 4096 23 24 1 0 FOLIO 0x00018000 0x00019000 4096 24 25 1 0 FOLIO 0x00019000 0x0001a000 4096 25 26 1 0 Y FOLIO 0x0001a000 0x0001b000 4096 26 27 1 0 FOLIO 0x0001b000 0x0001c000 4096 27 28 1 0 FOLIO 0x0001c000 0x0001d000 4096 28 29 1 0 FOLIO 0x0001d000 0x0001e000 4096 29 30 1 0 FOLIO 0x0001e000 0x0001f000 4096 30 31 1 0 FOLIO 0x0001f000 0x00020000 4096 31 32 1 0 FOLIO 0x00020000 0x00021000 4096 32 33 1 0 HOLE 0x00021000 0x00800000 8253440 33 2048 2015 Now access pages 18-25 inclusive. This causes an asynchronous 128K readahead starting at page 33. But since we are unaligned, even though the preferred folio order is 2, the first folio in this batch (the one with the new readahead marker) is order-0: TYPE STARTOFFS ENDOFFS SIZE STARTPG ENDPG NRPG ORDER RA ----- ---------- ---------- ---------- ------- ------- ----- ----- -- HOLE 0x00000000 0x00001000 4096 0 1 1 FOLIO 0x00001000 0x00002000 4096 1 2 1 0 FOLIO 0x00002000 0x00003000 4096 2 3 1 0 FOLIO 0x00003000 0x00004000 4096 3 4 1 0 FOLIO 0x00004000 0x00005000 4096 4 5 1 0 FOLIO 0x00005000 0x00006000 4096 5 6 1 0 FOLIO 0x00006000 0x00007000 4096 6 7 1 0 FOLIO 0x00007000 0x00008000 4096 7 8 1 0 FOLIO 0x00008000 0x00009000 4096 8 9 1 0 FOLIO 0x00009000 0x0000a000 4096 9 10 1 0 FOLIO 0x0000a000 0x0000b000 4096 10 11 1 0 FOLIO 0x0000b000 0x0000c000 4096 11 12 1 0 FOLIO 0x0000c000 0x0000d000 4096 12 13 1 0 FOLIO 0x0000d000 0x0000e000 4096 13 14 1 0 FOLIO 0x0000e000 0x0000f000 4096 14 15 1 0 FOLIO 0x0000f000 0x00010000 4096 15 16 1 0 FOLIO 0x00010000 0x00011000 4096 16 17 1 0 FOLIO 0x00011000 0x00012000 4096 17 18 1 0 FOLIO 0x00012000 0x00013000 4096 18 19 1 0 FOLIO 0x00013000 0x00014000 4096 19 20 1 0 FOLIO 0x00014000 0x00015000 4096 20 21 1 0 FOLIO 0x00015000 0x00016000 4096 21 22 1 0 FOLIO 0x00016000 0x00017000 4096 22 23 1 0 FOLIO 0x00017000 0x00018000 4096 23 24 1 0 FOLIO 0x00018000 0x00019000 4096 24 25 1 0 FOLIO 0x00019000 0x0001a000 4096 25 26 1 0 FOLIO 0x0001a000 0x0001b000 4096 26 27 1 0 FOLIO 0x0001b000 0x0001c000 4096 27 28 1 0 FOLIO 0x0001c000 0x0001d000 4096 28 29 1 0 FOLIO 0x0001d000 0x0001e000 4096 29 30 1 0 FOLIO 0x0001e000 0x0001f000 4096 30 31 1 0 FOLIO 0x0001f000 0x00020000 4096 31 32 1 0 FOLIO 0x00020000 0x00021000 4096 32 33 1 0 FOLIO 0x00021000 0x00022000 4096 33 34 1 0 Y FOLIO 0x00022000 0x00024000 8192 34 36 2 1 FOLIO 0x00024000 0x00028000 16384 36 40 4 2 FOLIO 0x00028000 0x0002c000 16384 40 44 4 2 FOLIO 0x0002c000 0x00030000 16384 44 48 4 2 FOLIO 0x00030000 0x00034000 16384 48 52 4 2 FOLIO 0x00034000 0x00038000 16384 52 56 4 2 FOLIO 0x00038000 0x0003c000 16384 56 60 4 2 FOLIO 0x0003c000 0x00040000 16384 60 64 4 2 FOLIO 0x00040000 0x00041000 4096 64 65 1 0 HOLE 0x00041000 0x00800000 8122368 65 2048 1983 Which means that when we now read pages 26-33 and readahead is kicked off again, the new preferred order is 2 (0 + 2), not 4 as we intended: TYPE STARTOFFS ENDOFFS SIZE STARTPG ENDPG NRPG ORDER RA ----- ---------- ---------- ---------- ------- ------- ----- ----- -- HOLE 0x00000000 0x00001000 4096 0 1 1 FOLIO 0x00001000 0x00002000 4096 1 2 1 0 FOLIO 0x00002000 0x00003000 4096 2 3 1 0 FOLIO 0x00003000 0x00004000 4096 3 4 1 0 FOLIO 0x00004000 0x00005000 4096 4 5 1 0 FOLIO 0x00005000 0x00006000 4096 5 6 1 0 FOLIO 0x00006000 0x00007000 4096 6 7 1 0 FOLIO 0x00007000 0x00008000 4096 7 8 1 0 FOLIO 0x00008000 0x00009000 4096 8 9 1 0 FOLIO 0x00009000 0x0000a000 4096 9 10 1 0 FOLIO 0x0000a000 0x0000b000 4096 10 11 1 0 FOLIO 0x0000b000 0x0000c000 4096 11 12 1 0 FOLIO 0x0000c000 0x0000d000 4096 12 13 1 0 FOLIO 0x0000d000 0x0000e000 4096 13 14 1 0 FOLIO 0x0000e000 0x0000f000 4096 14 15 1 0 FOLIO 0x0000f000 0x00010000 4096 15 16 1 0 FOLIO 0x00010000 0x00011000 4096 16 17 1 0 FOLIO 0x00011000 0x00012000 4096 17 18 1 0 FOLIO 0x00012000 0x00013000 4096 18 19 1 0 FOLIO 0x00013000 0x00014000 4096 19 20 1 0 FOLIO 0x00014000 0x00015000 4096 20 21 1 0 FOLIO 0x00015000 0x00016000 4096 21 22 1 0 FOLIO 0x00016000 0x00017000 4096 22 23 1 0 FOLIO 0x00017000 0x00018000 4096 23 24 1 0 FOLIO 0x00018000 0x00019000 4096 24 25 1 0 FOLIO 0x00019000 0x0001a000 4096 25 26 1 0 FOLIO 0x0001a000 0x0001b000 4096 26 27 1 0 FOLIO 0x0001b000 0x0001c000 4096 27 28 1 0 FOLIO 0x0001c000 0x0001d000 4096 28 29 1 0 FOLIO 0x0001d000 0x0001e000 4096 29 30 1 0 FOLIO 0x0001e000 0x0001f000 4096 30 31 1 0 FOLIO 0x0001f000 0x00020000 4096 31 32 1 0 FOLIO 0x00020000 0x00021000 4096 32 33 1 0 FOLIO 0x00021000 0x00022000 4096 33 34 1 0 FOLIO 0x00022000 0x00024000 8192 34 36 2 1 FOLIO 0x00024000 0x00028000 16384 36 40 4 2 FOLIO 0x00028000 0x0002c000 16384 40 44 4 2 FOLIO 0x0002c000 0x00030000 16384 44 48 4 2 FOLIO 0x00030000 0x00034000 16384 48 52 4 2 FOLIO 0x00034000 0x00038000 16384 52 56 4 2 FOLIO 0x00038000 0x0003c000 16384 56 60 4 2 FOLIO 0x0003c000 0x00040000 16384 60 64 4 2 FOLIO 0x00040000 0x00041000 4096 64 65 1 0 FOLIO 0x00041000 0x00042000 4096 65 66 1 0 Y FOLIO 0x00042000 0x00044000 8192 66 68 2 1 FOLIO 0x00044000 0x00048000 16384 68 72 4 2 FOLIO 0x00048000 0x0004c000 16384 72 76 4 2 FOLIO 0x0004c000 0x00050000 16384 76 80 4 2 FOLIO 0x00050000 0x00054000 16384 80 84 4 2 FOLIO 0x00054000 0x00058000 16384 84 88 4 2 FOLIO 0x00058000 0x0005c000 16384 88 92 4 2 FOLIO 0x0005c000 0x00060000 16384 92 96 4 2 FOLIO 0x00060000 0x00061000 4096 96 97 1 0 HOLE 0x00061000 0x00800000 7991296 97 2048 1951 This ramp up from order-0 with smaller orders at the edges for alignment cycle continues all the way to the end of the file (not shown). After the change, we round down the end boundary to the order boundary so we no longer get stuck in the cycle and can ramp up the order over time. Note that the rate of the ramp up is still not as we would expect it. We will fix that next. Here we are touching pages 17-256 sequentially: TYPE STARTOFFS ENDOFFS SIZE STARTPG ENDPG NRPG ORDER RA ----- ---------- ---------- ---------- ------- ------- ----- ----- -- HOLE 0x00000000 0x00001000 4096 0 1 1 FOLIO 0x00001000 0x00002000 4096 1 2 1 0 FOLIO 0x00002000 0x00003000 4096 2 3 1 0 FOLIO 0x00003000 0x00004000 4096 3 4 1 0 FOLIO 0x00004000 0x00005000 4096 4 5 1 0 FOLIO 0x00005000 0x00006000 4096 5 6 1 0 FOLIO 0x00006000 0x00007000 4096 6 7 1 0 FOLIO 0x00007000 0x00008000 4096 7 8 1 0 FOLIO 0x00008000 0x00009000 4096 8 9 1 0 FOLIO 0x00009000 0x0000a000 4096 9 10 1 0 FOLIO 0x0000a000 0x0000b000 4096 10 11 1 0 FOLIO 0x0000b000 0x0000c000 4096 11 12 1 0 FOLIO 0x0000c000 0x0000d000 4096 12 13 1 0 FOLIO 0x0000d000 0x0000e000 4096 13 14 1 0 FOLIO 0x0000e000 0x0000f000 4096 14 15 1 0 FOLIO 0x0000f000 0x00010000 4096 15 16 1 0 FOLIO 0x00010000 0x00011000 4096 16 17 1 0 FOLIO 0x00011000 0x00012000 4096 17 18 1 0 FOLIO 0x00012000 0x00013000 4096 18 19 1 0 FOLIO 0x00013000 0x00014000 4096 19 20 1 0 FOLIO 0x00014000 0x00015000 4096 20 21 1 0 FOLIO 0x00015000 0x00016000 4096 21 22 1 0 FOLIO 0x00016000 0x00017000 4096 22 23 1 0 FOLIO 0x00017000 0x00018000 4096 23 24 1 0 FOLIO 0x00018000 0x00019000 4096 24 25 1 0 FOLIO 0x00019000 0x0001a000 4096 25 26 1 0 FOLIO 0x0001a000 0x0001b000 4096 26 27 1 0 FOLIO 0x0001b000 0x0001c000 4096 27 28 1 0 FOLIO 0x0001c000 0x0001d000 4096 28 29 1 0 FOLIO 0x0001d000 0x0001e000 4096 29 30 1 0 FOLIO 0x0001e000 0x0001f000 4096 30 31 1 0 FOLIO 0x0001f000 0x00020000 4096 31 32 1 0 FOLIO 0x00020000 0x00021000 4096 32 33 1 0 FOLIO 0x00021000 0x00022000 4096 33 34 1 0 FOLIO 0x00022000 0x00024000 8192 34 36 2 1 FOLIO 0x00024000 0x00028000 16384 36 40 4 2 FOLIO 0x00028000 0x0002c000 16384 40 44 4 2 FOLIO 0x0002c000 0x00030000 16384 44 48 4 2 FOLIO 0x00030000 0x00034000 16384 48 52 4 2 FOLIO 0x00034000 0x00038000 16384 52 56 4 2 FOLIO 0x00038000 0x0003c000 16384 56 60 4 2 FOLIO 0x0003c000 0x00040000 16384 60 64 4 2 FOLIO 0x00040000 0x00044000 16384 64 68 4 2 FOLIO 0x00044000 0x00048000 16384 68 72 4 2 FOLIO 0x00048000 0x0004c000 16384 72 76 4 2 FOLIO 0x0004c000 0x00050000 16384 76 80 4 2 FOLIO 0x00050000 0x00054000 16384 80 84 4 2 FOLIO 0x00054000 0x00058000 16384 84 88 4 2 FOLIO 0x00058000 0x0005c000 16384 88 92 4 2 FOLIO 0x0005c000 0x00060000 16384 92 96 4 2 FOLIO 0x00060000 0x00070000 65536 96 112 16 4 FOLIO 0x00070000 0x00080000 65536 112 128 16 4 FOLIO 0x00080000 0x000a0000 131072 128 160 32 5 FOLIO 0x000a0000 0x000c0000 131072 160 192 32 5 FOLIO 0x000c0000 0x000e0000 131072 192 224 32 5 FOLIO 0x000e0000 0x00100000 131072 224 256 32 5 FOLIO 0x00100000 0x00120000 131072 256 288 32 5 FOLIO 0x00120000 0x00140000 131072 288 320 32 5 Y HOLE 0x00140000 0x00800000 7077888 320 2048 1728 Link: https://lkml.kernel.org/r/20250609092729.274960-3-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Reviewed-by: Jan Kara Cc: Chaitanya S Prakash Cc: David Hildenbrand Cc: Will Deacon Signed-off-by: Andrew Morton commit bdb86f6b87633cc020f8225ae09d336da7826724 Author: Ryan Roberts Date: Mon Jun 9 10:27:23 2025 +0100 mm/readahead: honour new_order in page_cache_ra_order() Patch series "Readahead tweaks for larger folios", v5. This series adds some tweaks to readahead so that it does a better job of ramping up folio sizes as readahead extends further into the file. And it additionally special-cases executable mappings to allow the arch to request a preferred folio size for text. This patch (of 5): page_cache_ra_order() takes a parameter called new_order, which is intended to express the preferred order of the folios that will be allocated for the readahead operation. Most callers indeed call this with their preferred new order. But page_cache_async_ra() calls it with the preferred order of the previous readahead request (actually the order of the folio that had the readahead marker, which may be smaller when alignment comes into play). And despite the parameter name, page_cache_ra_order() always treats it at the old order, adding 2 to it on entry. As a result, a cold readahead always starts with order-2 folios. Let's fix this behaviour by always passing in the *new* order. Worked example: Prior to the change, mmaping an 8MB file and touching each page sequentially, resulted in the following, where we start with order-2 folios for the first 128K then ramp up to order-4 for the next 128K, then get clamped to order-5 for the rest of the file because pa_pages is limited to 128K: TYPE STARTOFFS ENDOFFS SIZE STARTPG ENDPG NRPG ORDER ----- ---------- ---------- --------- ------- ------- ----- ----- FOLIO 0x00000000 0x00004000 16384 0 4 4 2 FOLIO 0x00004000 0x00008000 16384 4 8 4 2 FOLIO 0x00008000 0x0000c000 16384 8 12 4 2 FOLIO 0x0000c000 0x00010000 16384 12 16 4 2 FOLIO 0x00010000 0x00014000 16384 16 20 4 2 FOLIO 0x00014000 0x00018000 16384 20 24 4 2 FOLIO 0x00018000 0x0001c000 16384 24 28 4 2 FOLIO 0x0001c000 0x00020000 16384 28 32 4 2 FOLIO 0x00020000 0x00030000 65536 32 48 16 4 FOLIO 0x00030000 0x00040000 65536 48 64 16 4 FOLIO 0x00040000 0x00060000 131072 64 96 32 5 FOLIO 0x00060000 0x00080000 131072 96 128 32 5 FOLIO 0x00080000 0x000a0000 131072 128 160 32 5 FOLIO 0x000a0000 0x000c0000 131072 160 192 32 5 ... After the change, the same operation results in the first 128K being order-0, then we start ramping up to order-2, -4, and finally get clamped at order-5: TYPE STARTOFFS ENDOFFS SIZE STARTPG ENDPG NRPG ORDER ----- ---------- ---------- --------- ------- ------- ----- ----- FOLIO 0x00000000 0x00001000 4096 0 1 1 0 FOLIO 0x00001000 0x00002000 4096 1 2 1 0 FOLIO 0x00002000 0x00003000 4096 2 3 1 0 FOLIO 0x00003000 0x00004000 4096 3 4 1 0 FOLIO 0x00004000 0x00005000 4096 4 5 1 0 FOLIO 0x00005000 0x00006000 4096 5 6 1 0 FOLIO 0x00006000 0x00007000 4096 6 7 1 0 FOLIO 0x00007000 0x00008000 4096 7 8 1 0 FOLIO 0x00008000 0x00009000 4096 8 9 1 0 FOLIO 0x00009000 0x0000a000 4096 9 10 1 0 FOLIO 0x0000a000 0x0000b000 4096 10 11 1 0 FOLIO 0x0000b000 0x0000c000 4096 11 12 1 0 FOLIO 0x0000c000 0x0000d000 4096 12 13 1 0 FOLIO 0x0000d000 0x0000e000 4096 13 14 1 0 FOLIO 0x0000e000 0x0000f000 4096 14 15 1 0 FOLIO 0x0000f000 0x00010000 4096 15 16 1 0 FOLIO 0x00010000 0x00011000 4096 16 17 1 0 FOLIO 0x00011000 0x00012000 4096 17 18 1 0 FOLIO 0x00012000 0x00013000 4096 18 19 1 0 FOLIO 0x00013000 0x00014000 4096 19 20 1 0 FOLIO 0x00014000 0x00015000 4096 20 21 1 0 FOLIO 0x00015000 0x00016000 4096 21 22 1 0 FOLIO 0x00016000 0x00017000 4096 22 23 1 0 FOLIO 0x00017000 0x00018000 4096 23 24 1 0 FOLIO 0x00018000 0x00019000 4096 24 25 1 0 FOLIO 0x00019000 0x0001a000 4096 25 26 1 0 FOLIO 0x0001a000 0x0001b000 4096 26 27 1 0 FOLIO 0x0001b000 0x0001c000 4096 27 28 1 0 FOLIO 0x0001c000 0x0001d000 4096 28 29 1 0 FOLIO 0x0001d000 0x0001e000 4096 29 30 1 0 FOLIO 0x0001e000 0x0001f000 4096 30 31 1 0 FOLIO 0x0001f000 0x00020000 4096 31 32 1 0 FOLIO 0x00020000 0x00024000 16384 32 36 4 2 FOLIO 0x00024000 0x00028000 16384 36 40 4 2 FOLIO 0x00028000 0x0002c000 16384 40 44 4 2 FOLIO 0x0002c000 0x00030000 16384 44 48 4 2 FOLIO 0x00030000 0x00034000 16384 48 52 4 2 FOLIO 0x00034000 0x00038000 16384 52 56 4 2 FOLIO 0x00038000 0x0003c000 16384 56 60 4 2 FOLIO 0x0003c000 0x00040000 16384 60 64 4 2 FOLIO 0x00040000 0x00050000 65536 64 80 16 4 FOLIO 0x00050000 0x00060000 65536 80 96 16 4 FOLIO 0x00060000 0x00080000 131072 96 128 32 5 FOLIO 0x00080000 0x000a0000 131072 128 160 32 5 FOLIO 0x000a0000 0x000c0000 131072 160 192 32 5 FOLIO 0x000c0000 0x000e0000 131072 192 224 32 5 ... Link: https://lkml.kernel.org/r/20250609092729.274960-1-ryan.roberts@arm.com Link: https://lkml.kernel.org/r/20250609092729.274960-2-ryan.roberts@arm.com Signed-off-by: Ryan Roberts Acked-by: David Hildenbrand Reviewed-by: Jan Kara Tested-by: Chaitanya S Prakash Cc: Will Deacon Signed-off-by: Andrew Morton commit 1ec8a6e30e9c4ad06ea5e94536623c59c4ae2400 Author: Joshua Hahn Date: Mon Jun 2 09:23:40 2025 -0700 mm/mempolicy: skip unnecessary synchronize_rcu() By unconditionally setting wi_state to NULL and conditionally calling synchronize_rcu(), we can save an unncessary call when there is no old_wi_state. Link: https://lkml.kernel.org/r/20250602162345.2595696-2-joshua.hahnjy@gmail.com Signed-off-by: Joshua Hahn Suggested-by: David Hildenbrand Reviewed-by: Huang Ying Cc: Alistair Popple Cc: Byungchul Park Cc: Gregory Price Cc: "Huang, Ying" Cc: kernel test robot Cc: Mathew Brost Cc: Rakie Kim Cc: Zi Yan Signed-off-by: Andrew Morton commit 1e6b17b4237dacb02e9cfeaed35d889bbc9e8a84 Author: Dev Jain Date: Wed Jun 4 09:45:33 2025 +0530 xarray: add a BUG_ON() to ensure caller is not sibling Suppose xas is pointing somewhere near the end of the multi-entry batch. Then it may happen that the computed slot already falls beyond the batch, thus breaking the loop due to !xa_is_sibling(), and computing the wrong order. For example, suppose we have a shift-6 node having an order-9 entry => 8 - 1 = 7 siblings, so assume the slots are at offset 0 till 7 in this node. If xas->xa_offset is 6, then the code will compute order as 1 + xas->xa_node->shift = 7. Therefore, the order computation must start from the beginning of the multi-slot entries, that is, the non-sibling entry. Thus ensure that the caller is aware of this by triggering a BUG when the entry is a sibling entry. Note that this BUG_ON() is only active while running selftests, so there is no overhead in a running kernel. Link: https://lkml.kernel.org/r/20250604041533.91198-1-dev.jain@arm.com Signed-off-by: Dev Jain Acked-by: Zi Yan Cc: "Aneesh Kumar K.V" Cc: Anshuman Khandual Cc: David Hildenbrand Cc: Matthew Wilcox (Oracle) Cc: Ryan Roberts Signed-off-by: Andrew Morton commit ff7ec8dc1b646296f8d94c39339e8d3833d16c05 Author: wangzijie Date: Sat Jun 7 10:13:53 2025 +0800 proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. It's a gap in proc_reg_open() after commit 654b33ada4ab("proc: fix UAF in proc_get_inode()"). Followed by AI Viro's suggestion, fix it in same manner. Link: https://lkml.kernel.org/r/20250607021353.1127963-1-wangzijie1@honor.com Fixes: 3f61631d47f1 ("take care to handle NULL ->proc_lseek()") Signed-off-by: wangzijie Reviewed-by: Alexey Dobriyan Cc: Alexei Starovoitov Cc: Al Viro Cc: "Edgecombe, Rick P" Cc: Kirill A. Shuemov Signed-off-by: Andrew Morton commit a6fde7add78d122f5e09cb6280f99c4b5ead7d56 Author: Barry Song Date: Sun Jun 8 10:01:50 2025 +1200 mm: use per_vma lock for MADV_DONTNEED Certain madvise operations, especially MADV_DONTNEED, occur far more frequently than other madvise options, particularly in native and Java heaps for dynamic memory management. Currently, the mmap_lock is always held during these operations, even when unnecessary. This causes lock contention and can lead to severe priority inversion, where low-priority threads—such as Android's HeapTaskDaemon— hold the lock and block higher-priority threads. This patch enables the use of per-VMA locks when the advised range lies entirely within a single VMA, avoiding the need for full VMA traversal. In practice, userspace heaps rarely issue MADV_DONTNEED across multiple VMAs. Tangquan's testing shows that over 99.5% of memory reclaimed by Android benefits from this per-VMA lock optimization. After extended runtime, 217,735 madvise calls from HeapTaskDaemon used the per-VMA path, while only 1,231 fell back to mmap_lock. To simplify handling, the implementation falls back to the standard mmap_lock if userfaultfd is enabled on the VMA, avoiding the complexity of userfaultfd_remove(). Many thanks to Lorenzo's work[1] on "mm/madvise: support VMA read locks for MADV_DONTNEED[_LOCKED]" Then use this mechanism to permit VMA locking to be done later in the madvise() logic and also to allow altering of the locking mode to permit falling back to an mmap read lock if required." One important point, as pointed out by Jann[2], is that untagged_addr_remote() requires holding mmap_lock. This is because address tagging on x86 and RISC-V is quite complex. Until untagged_addr_remote() becomes atomic—which seems unlikely in the near future—we cannot support per-VMA locks for remote processes. So for now, only local processes are supported. Lance said: : Just to put some numbers on it, I ran a micro-benchmark with 100 : parallel threads, where each thread calls madvise() on its own 1GiB : chunk of 64KiB mTHP-backed memory. The performance gain is huge: : : 1) MADV_DONTNEED saw its average time drop from 0.0508s to 0.0270s : (~47% faster) : : 2) MADV_FREE saw its average time drop from 0.3078s to 0.1095s (~64% : faster) [lorenzo.stoakes@oracle.com: avoid any chance of uninitialised pointer deref] Link: https://lkml.kernel.org/r/309d22ca-6cd9-4601-8402-d441a07d9443@lucifer.local Link: https://lore.kernel.org/all/0b96ce61-a52c-4036-b5b6-5c50783db51f@lucifer.local/ [1] Link: https://lore.kernel.org/all/CAG48ez11zi-1jicHUZtLhyoNPGGVB+ROeAJCUw48bsjk4bbEkA@mail.gmail.com/ [2] Link: https://lkml.kernel.org/r/20250607220150.2980-1-21cnbao@gmail.com Signed-off-by: Barry Song Signed-off-by: Lorenzo Stoakes Reviewed-by: Lorenzo Stoakes Acked-by: Qi Zheng Cc: "Liam R. Howlett" Cc: David Hildenbrand Cc: Vlastimil Babka Cc: Jann Horn Cc: Suren Baghdasaryan Cc: Lokesh Gidra Cc: Tangquan Zheng Cc: Lance Yang Signed-off-by: Andrew Morton commit 5e00e31867d16e235bb693b900c85e86dc2c3464 Author: Tal Zussman Date: Thu Jun 19 21:24:26 2025 -0400 userfaultfd: remove UFFD_CLOEXEC, UFFD_NONBLOCK, and UFFD_FLAGS_SET UFFD_CLOEXEC, UFFD_NONBLOCK, and UFFD_FLAGS_SET have been unused since they were added in commit 932b18e0aec6 ("userfaultfd: linux/userfaultfd_k.h"). Remove them and the associated BUILD_BUG_ON() checks. Link: https://lkml.kernel.org/r/20250619-uffd-fixes-v3-4-a7274d3bd5e4@columbia.edu Signed-off-by: Tal Zussman Acked-by: David Hildenbrand Acked-by: Peter Xu Cc: Al Viro Cc: Andrea Arcangeli Cc: Christian Brauner Cc: Jan Kara Cc: Jason A. Donenfeld Signed-off-by: Andrew Morton commit 31defc3b01d907e3e899de9e7002a6a63998f07a Author: Tal Zussman Date: Thu Jun 19 21:24:25 2025 -0400 userfaultfd: remove (VM_)BUG_ON()s BUG_ON() is deprecated [1]. Convert all the BUG_ON()s and VM_BUG_ON()s to use VM_WARN_ON_ONCE(). There are a few additional cases that are converted or modified: - Convert the printk(KERN_WARNING ...) in handle_userfault() to use pr_warn(). - Convert the WARN_ON_ONCE()s in move_pages() to use VM_WARN_ON_ONCE(), as the relevant conditions are already checked in validate_range() in move_pages()'s caller. - Convert the VM_WARN_ON()'s in move_pages() to VM_WARN_ON_ONCE(). These cases should never happen and are similar to those in mfill_atomic() and mfill_atomic_hugetlb(), which were previously BUG_ON()s. move_pages() was added later than those functions and makes use of VM_WARN_ON() as a replacement for the deprecated BUG_ON(), but. VM_WARN_ON_ONCE() is likely a better direct replacement. - Convert the WARN_ON() for !VM_MAYWRITE in userfaultfd_unregister() and userfaultfd_register_range() to VM_WARN_ON_ONCE(). This condition is enforced in userfaultfd_register() so it should never happen, and can be converted to a debug check. [1] https://www.kernel.org/doc/html/v6.15/process/coding-style.html#use-warn-rather-than-bug Link: https://lkml.kernel.org/r/20250619-uffd-fixes-v3-3-a7274d3bd5e4@columbia.edu Signed-off-by: Tal Zussman Cc: Al Viro Cc: Andrea Arcangeli Cc: Christian Brauner Cc: David Hildenbrand Cc: Jan Kara Cc: Jason A. Donenfeld Cc: Peter Xu Signed-off-by: Andrew Morton commit 23ec90eb122faaf0468f450c5d5857a794956c75 Author: Tal Zussman Date: Thu Jun 19 21:24:24 2025 -0400 userfaultfd: prevent unregistering VMAs through a different userfaultfd Currently, a VMA registered with a uffd can be unregistered through a different uffd associated with the same mm_struct. The existing behavior is slightly broken and may incorrectly reject unregistering some VMAs due to the following check: if (!vma_can_userfault(cur, cur->vm_flags, wp_async)) goto out_unlock; where wp_async is derived from ctx, not from cur. For example, a file-backed VMA registered with wp_async enabled and UFFD_WP mode cannot be unregistered through a uffd that does not have wp_async enabled. Rather than fix this and maintain this odd behavior, make unregistration stricter by requiring VMAs to be unregistered through the same uffd they were registered with. Additionally, reorder the BUG() checks to avoid the aforementioned wp_async issue in them. Convert the existing check to VM_WARN_ON_ONCE() as BUG_ON() is deprecated. This change slightly modifies the ABI. It should not be backported to -stable. It is expected that no one depends on this behavior, and no such cases are known. While at it, correct the comment for the no userfaultfd case. This seems to be a copy-paste artifact from the analogous userfaultfd_register() check. Link: https://lkml.kernel.org/r/20250619-uffd-fixes-v3-2-a7274d3bd5e4@columbia.edu Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Tal Zussman Acked-by: David Hildenbrand Cc: Al Viro Cc: Andrea Arcangeli Cc: Christian Brauner Cc: Jan Kara Cc: Jason A. Donenfeld Cc: Peter Xu Signed-off-by: Andrew Morton commit 7208cc6497c2615ed5a334b52c92ae98bda91198 Author: Tal Zussman Date: Thu Jun 19 21:24:23 2025 -0400 userfaultfd: correctly prevent registering VM_DROPPABLE regions Patch series "mm: userfaultfd: assorted fixes and cleanups", v3. Two fixes and two cleanups for userfaultfd. Note that the third patch yields a small change in the ABI, but we seem to have concluded that it is acceptable in this case. This patch (of 4): vma_can_userfault() masks off non-userfaultfd VM flags from vm_flags. The vm_flags & VM_DROPPABLE test will then always be false, incorrectly allowing VM_DROPPABLE regions to be registered with userfaultfd. Additionally, vm_flags is not guaranteed to correspond to the actual VMA's flags. Fix this test by checking the VMA's flags directly. Link: https://lkml.kernel.org/r/20250619-uffd-fixes-v3-0-a7274d3bd5e4@columbia.edu Link: https://lore.kernel.org/linux-mm/5a875a3a-2243-4eab-856f-bc53ccfec3ea@redhat.com/ Link: https://lkml.kernel.org/r/20250619-uffd-fixes-v3-1-a7274d3bd5e4@columbia.edu Fixes: 9651fcedf7b9 ("mm: add MAP_DROPPABLE for designating always lazily freeable mappings") Signed-off-by: Tal Zussman Acked-by: David Hildenbrand Acked-by: Peter Xu Acked-by: Jason A. Donenfeld Cc: Al Viro Cc: Andrea Arcangeli Cc: Christian Brauner Cc: Jan Kara Signed-off-by: Andrew Morton commit a5352f8a40a8d1b385abeca0b2cff5d2468e31a1 Author: Donet Tom Date: Wed May 28 12:18:04 2025 -0500 drivers/base/node: rename __register_one_node() to register_one_node() The register_one_node() function was a simple wrapper around __register_one_node(). To simplify the code, register_one_node() has been removed, and __register_one_node() has been renamed to register_one_node(). Link: https://lkml.kernel.org/r/8262cd0f44eeb048a1fcd3ac8382760d7f7dea60.1748452242.git.donettom@linux.ibm.com Signed-off-by: Donet Tom Acked-by: David Hildenbrand Cc: Mike Rapoport (Microsoft) Cc: Oscar Salvador Cc: Zi Yan Signed-off-by: Andrew Morton commit 10f09d82f8b7c25bbd0b6d5142ff6df6e634132d Author: Donet Tom Date: Wed May 28 12:18:03 2025 -0500 drivers/base/node: rename register_memory_blocks_under_node() and remove context argument The function register_memory_blocks_under_node() is now only called from the memory hotplug path, as register_memory_blocks_under_node_early() handles registration during early boot. Therefore, the context argument used to differentiate between early boot and hotplug is no longer needed and was removed. Since the function is only called from the hotplug path, we renamed register_memory_blocks_under_node() to register_memory_blocks_under_node_hotplug() Link: https://lkml.kernel.org/r/907c22292b0ee4975107876efc875c75c11badd9.1748452242.git.donettom@linux.ibm.com Signed-off-by: Donet Tom Acked-by: Oscar Salvador Acked-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Acked-by: Zi Yan Signed-off-by: Andrew Morton commit ac24f6cd87d88150fc6c1fef904794571f62dc5e Author: Donet Tom Date: Wed May 28 12:18:02 2025 -0500 drivers/base/node: remove register_memory_blocks_under_node() function call from register_one_node register_one_node() is now only called via cpu_up() → __try_online_node() during CPU hotplug operations to online a node. At this stage, the node has not yet had any memory added. As a result, there are no memory blocks to walk or register, so calling register_memory_blocks_under_node() is unnecessary. Therefore, the call to register_memory_blocks_under_node() has been removed from register_one_node(). Link: https://lkml.kernel.org/r/ecf07075b1a41015fcf58823997d5c2ed7b8c18f.1748452242.git.donettom@linux.ibm.com Signed-off-by: Donet Tom Acked-by: Oscar Salvador Acked-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Cc: Zi Yan Signed-off-by: Andrew Morton commit 69e944b1606a0b6ba4663dc4fd9f43c2b85cdf54 Author: Donet Tom Date: Wed May 28 12:18:01 2025 -0500 drivers/base/node: remove register_mem_block_under_node_early() The function register_mem_block_under_node_early() is no longer used, as register_memory_blocks_under_node_early() now handles memory block registration during early boot. Removed register_mem_block_under_node_early() and get_nid_for_pfn(), the latter was only used by the former. Link: https://lkml.kernel.org/r/22e0c5d20f1d33a91d0436ad22d96628cf084d1b.1748452242.git.donettom@linux.ibm.com Signed-off-by: Donet Tom Acked-by: Oscar Salvador Acked-by: Mike Rapoport (Microsoft) Acked-by: David Hildenbrand Acked-by: Zi Yan Signed-off-by: Andrew Morton commit 4f745def815d86eece3614aa0cd10a25cf94fed4 Author: Donet Tom Date: Wed May 28 12:18:00 2025 -0500 drivers/base/node: optimize memory block registration to reduce boot time Patch series "drivers/base/node.c: optimization and cleanups", v7. This patch (of 7) During node device initialization, `memory blocks` are registered under each NUMA node. The `memory blocks` to be registered are identified using the node's start and end PFNs, which are obtained from the node's pg_data However, not all PFNs within this range necessarily belong to the same node—some may belong to other nodes. Additionally, due to the discontiguous nature of physical memory, certain sections within a `memory block` may be absent. As a result, `memory blocks` that fall between a node's start and end PFNs may span across multiple nodes, and some sections within those blocks may be missing. `Memory blocks` have a fixed size, which is architecture dependent. Due to these considerations, the memory block registration is currently performed as follows: for_each_online_node(nid): start_pfn = pgdat->node_start_pfn; end_pfn = pgdat->node_start_pfn + node_spanned_pages; for_each_memory_block_between(PFN_PHYS(start_pfn), PFN_PHYS(end_pfn)) mem_blk = memory_block_id(pfn_to_section_nr(pfn)); pfn_mb_start=section_nr_to_pfn(mem_blk->start_section_nr) pfn_mb_end = pfn_start + memory_block_pfns - 1 for (pfn = pfn_mb_start; pfn < pfn_mb_end; pfn++): if (get_nid_for_pfn(pfn) != nid): continue; else do_register_memory_block_under_node(nid, mem_blk, MEMINIT_EARLY); Here, we derive the start and end PFNs from the node's pg_data, then determine the memory blocks that may belong to the node. For each `memory block` in this range, we inspect all PFNs it contains and check their associated NUMA node ID. If a PFN within the block matches the current node, the memory block is registered under that node. If CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled, get_nid_for_pfn() performs a binary search in the `memblock regions` to determine the NUMA node ID for a given PFN. If it is not enabled, the node ID is retrieved directly from the struct page. On large systems, this process can become time-consuming, especially since we iterate over each `memory block` and all PFNs within it until a match is found. When CONFIG_DEFERRED_STRUCT_PAGE_INIT is enabled, the additional overhead of the binary search increases the execution time significantly, potentially leading to soft lockups during boot. In this patch, we iterate over `memblock region` to identify the `memory blocks` that belong to the current NUMA node. `memblock regions` are contiguous memory ranges, each associated with a single NUMA node, and they do not span across multiple nodes. for_each_memory_region(r): // r => region if (!node_online(r->nid)): continue; else for_each_memory_block_between(r->base, r->base + r->size - 1): do_register_memory_block_under_node(r->nid, mem_blk, MEMINIT_EARLY); We iterate over all memblock regions, and if the node associated with the region is online, we calculate the start and end memory blocks based on the region's start and end PFNs. We then register all the memory blocks within that range under the region node. Test Results on My system with 32TB RAM ======================================= 1. Boot time with CONFIG_DEFERRED_STRUCT_PAGE_INIT enabled. Without this patch ------------------ Startup finished in 1min 16.528s (kernel) With this patch --------------- Startup finished in 17.236s (kernel) - 78% Improvement 2. Boot time with CONFIG_DEFERRED_STRUCT_PAGE_INIT disabled. Without this patch ------------------ Startup finished in 28.320s (kernel) With this patch --------------- Startup finished in 15.621s (kernel) - 46% Improvement [donettom@linux.ibm.com: restore removed extra line] Link: https://lkml.kernel.org/r/20250609140354.467908-1-donettom@linux.ibm.com Link: https://lkml.kernel.org/r/2a0a05c2dffc62a742bf1dd030098be4ce99be28.1748452241.git.donettom@linux.ibm.com Link: https://lkml.kernel.org/r/2a0a05c2dffc62a742bf1dd030098be4ce99be28.1748452241.git.donettom@linux.ibm.com Signed-off-by: Donet Tom Acked-by: David Hildenbrand Acked-by: Oscar Salvador Acked-by: Mike Rapoport (Microsoft) Acked-by: Zi Yan Signed-off-by: Andrew Morton commit bbcaee20e03ecaeeecba32a703816a0d4502b6c4 Author: Chi Zhiling Date: Thu Jun 5 13:49:35 2025 +0800 readahead: fix return value of page_cache_next_miss() when no hole is found max_scan in page_cache_next_miss always decreases to zero when no hole is found, causing the return value to be index + 0. Fix this by preserving the max_scan value throughout the loop. Jan said "From what I know and have seen in the past, wrong responses from page_cache_next_miss() can lead to readahead window reduction and thus reduced read speeds." Link: https://lkml.kernel.org/r/20250605054935.2323451-1-chizhiling@163.com Fixes: 901a269ff3d5 ("filemap: fix page_cache_next_miss() when no hole found") Signed-off-by: Chi Zhiling Reviewed-by: Jan Kara Cc: Josef Bacik Cc: Matthew Wilcox (Oracle) Cc: Signed-off-by: Andrew Morton commit 08e21e241210a3a124cfafd33db3dbda49b6f43d Author: Richard Chang Date: Thu Jun 5 07:25:32 2025 +0000 mm/cma: pair the trace_cma_alloc_start/finish In the bad input validation cases, there is no trace_cma_alloc_finish to match the trace_cma_alloc_start. Move the trace_cma_alloc_start event after the validations. Link: https://lkml.kernel.org/r/20250605072532.972081-1-richardycc@google.com Signed-off-by: Richard Chang Acked-by: David Hildenbrand Cc: Kalesh Singh Cc: Martin Liu Cc: Minchan Kim Signed-off-by: Andrew Morton commit 99edea30058bb5dd6c2fee6fa0c703fa4bc4b140 Author: Barry Song Date: Thu Jun 5 20:31:44 2025 +1200 mm: madvise: use walk_page_range_vma() instead of walk_page_range() We've already found the VMA within madvise_walk_vmas() before calling specific madvise behavior functions like madvise_free_single_vma(). So calling walk_page_range() and doing find_vma() again seems unnecessary. It also prevents potential optimizations in those madvise callbacks, particularly the use of dedicated per-VMA locking. [v-songbaohua@oppo.com: revert the walk_page_range_vma change for MADV_GUARD_INSTALL] Link: https://lkml.kernel.org/r/20250609105513.10901-1-21cnbao@gmail.com Link: https://lkml.kernel.org/r/20250605083144.43046-1-21cnbao@gmail.com Signed-off-by: Barry Song Reviewed-by: Anshuman Khandual Reviewed-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Oscar Salvador Reviewed-by: Harry Yoo Reviewed-by: Dev Jain Reviewed-by: Vlastimil Babka Reviewed-by: Ryan Roberts Tested-by: Lorenzo Stoakes Cc: "Liam R. Howlett" Cc: Jann Horn Cc: Suren Baghdasaryan Cc: Lokesh Gidra Cc: Tangquan Zheng Signed-off-by: Andrew Morton commit a8fb49c6abbbe5c71e1a8a888ef2c4b3e341d169 Author: Christoph Hellwig Date: Tue Jun 10 07:49:42 2025 +0200 mm: remove the for_reclaim field from struct writeback_control This field is now only set to one in the i915 gem code that only calls writeback_iter on it, which ignores the flag. All other checks are thuse dead code and the field can be removed. Link: https://lkml.kernel.org/r/20250610054959.2057526-7-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Baolin Wang Cc: Chengming Zhou Cc: Hugh Dickins Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 624043dbd5be03cc5a2b9175c3934e6fb0ef7c70 Author: Christoph Hellwig Date: Tue Jun 10 07:49:41 2025 +0200 mm: stop passing a writeback_control structure to swap_writeout swap_writeout only needs the swap_iocb cookie from the writeback_control structure, so pass it explicitly. Link: https://lkml.kernel.org/r/20250610054959.2057526-6-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Baolin Wang Cc: Chengming Zhou Cc: Hugh Dickins Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 2ba8ffcefe81241fab73aa0f59142a2c9ace575b Author: Christoph Hellwig Date: Tue Jun 10 07:49:40 2025 +0200 mm: stop passing a writeback_control structure to __swap_writepage __swap_writepage only needs the swap_iocb cookie from the writeback_control structure, so pass it explicitly and remove the now unused swap_iocb member from struct writeback_control. Link: https://lkml.kernel.org/r/20250610054959.2057526-5-hch@lst.de Signed-off-by: Christoph Hellwig Acked-by: Nhat Pham Cc: Baolin Wang Cc: Chengming Zhou Cc: Hugh Dickins Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Signed-off-by: Andrew Morton commit 2d1844cdbe89d04d4f679a1a01e165fea1741bab Author: Christoph Hellwig Date: Tue Jun 10 07:49:39 2025 +0200 mm: tidy up swap_writeout Use a goto label to consolidate the unlock folio and return pattern and don't bother with an else after a return / goto. Link: https://lkml.kernel.org/r/20250610054959.2057526-4-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Baolin Wang Cc: Chengming Zhou Cc: Hugh Dickins Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 44b1b073eb36143ec65a918c0fbaa582f3ec2aa1 Author: Christoph Hellwig Date: Tue Jun 10 07:49:38 2025 +0200 mm: stop passing a writeback_control structure to shmem_writeout shmem_writeout only needs the swap_iocb cookie and the split folio list. Pass those explicitly and remove the now unused list member from struct writeback_control. Link: https://lkml.kernel.org/r/20250610054959.2057526-3-hch@lst.de Signed-off-by: Christoph Hellwig Cc: Baolin Wang Cc: Chengming Zhou Cc: Hugh Dickins Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 86c4a946436e6ab3d9b0d02afd5d33ebf63528c5 Author: Christoph Hellwig Date: Tue Jun 10 07:49:37 2025 +0200 mm: split out a writeout helper from pageout Patch series "stop passing a writeback_control to swap/shmem writeout", v3. This series was intended to remove the last remaining users of AOP_WRITEPAGE_ACTIVATE after my other pending patches removed the rest, but spectacularly failed at that. But instead it nicely improves the code, and removes two pointers from struct writeback_control. This patch (of 6): Move the code to write back swap / shmem folios into a self-contained helper to keep prepare for refactoring it. Link: https://lkml.kernel.org/r/20250610054959.2057526-1-hch@lst.de Link: https://lkml.kernel.org/r/20250610054959.2057526-2-hch@lst.de Signed-off-by: Christoph Hellwig Reviewed-by: Baolin Wang Cc: Chengming Zhou Cc: Hugh Dickins Cc: Johannes Weiner Cc: Matthew Wilcox (Oracle) Cc: Nhat Pham Signed-off-by: Andrew Morton commit 453742ba5b3cf36af348c1313f2b32f7ea4c5897 Author: Kairui Song Date: Tue May 27 02:06:38 2025 +0800 mm, list_lru: refactor the locking code Cocci is confused by the try lock then release RCU and return logic here. So separate the try lock part out into a standalone helper. The code is easier to follow too. No feature change, fixes: cocci warnings: (new ones prefixed by >>) >> mm/list_lru.c:82:3-9: preceding lock on line 77 >> mm/list_lru.c:82:3-9: preceding lock on line 77 mm/list_lru.c:82:3-9: preceding lock on line 75 mm/list_lru.c:82:3-9: preceding lock on line 75 Link: https://lkml.kernel.org/r/20250526180638.14609-1-ryncsn@gmail.com Signed-off-by: Kairui Song Reported-by: kernel test robot Reported-by: Julia Lawall Closes: https://lore.kernel.org/r/202505252043.pbT1tBHJ-lkp@intel.com/ Reviewed-by: Qi Zheng Reviewed-by: Muchun Song Reviewed-by: SeongJae Park Cc: Chengming Zhou Cc: Johannes Weiner Cc: Kairui Song Cc: Roman Gushchin Signed-off-by: Andrew Morton commit 3800d55250976b7a4bd42c255b267bc242669709 Author: Zi Yan Date: Wed Jun 4 17:14:27 2025 -0400 mm: rename CONFIG_PAGE_BLOCK_ORDER to CONFIG_PAGE_BLOCK_MAX_ORDER The config is in fact an additional upper limit of pageblock_order, so rename it to avoid confusion. Link: https://lkml.kernel.org/r/20250604211427.1590859-1-ziy@nvidia.com Signed-off-by: Zi Yan Acked-by: David Hildenbrand Reviewed-by: Oscar Salvador Acked-by: Juan Yescas Reviewed-by: Anshuman Khandual Acked-by: Vlastimil Babka Cc: "Isaac J. Manjarres" Cc: Kalesh Singh Cc: Liam Howlett Cc: Lorenzo Stoakes Cc: Masahiro Yamada Cc: Michal Hocko Cc: Mike Rapoport Cc: Minchan Kim Cc: Suren Baghdasaryan Cc: T.J. Mercier Signed-off-by: Andrew Morton commit 792b429db7e0217faf7bce9fe46e7708135cf83c Author: David Hildenbrand Date: Wed Jun 4 16:05:44 2025 +0200 mm/gup: remove (VM_)BUG_ONs Especially once we hit one of the assertions in sanity_check_pinned_pages(), observing follow-up assertions failing in other code can give good clues about what went wrong, so use VM_WARN_ON_ONCE instead. While at it, let's just convert all VM_BUG_ON to VM_WARN_ON_ONCE as well. Add one comment for the pfn_valid() check. We have to introduce VM_WARN_ON_ONCE_VMA() to make that fly. Drop the BUG_ON after mmap_read_lock_killable(), if that ever returns something > 0 we're in bigger trouble. Convert the other BUG_ON's into VM_WARN_ON_ONCE as well, they are in a similar domain "should never happen", but more reasonable to check for during early testing. [david@redhat.com: use the _FOLIO variant where possible, per Lorenzo] Link: https://lkml.kernel.org/r/844bd929-a551-48e3-a12e-285cd65ba580@redhat.com Link: https://lkml.kernel.org/r/20250604140544.688711-1-david@redhat.com Signed-off-by: David Hildenbrand Acked-by: Vlastimil Babka Reviewed-by: Suren Baghdasaryan Reviewed-by: Lorenzo Stoakes Acked-by: SeongJae Park Reviewed-by: Liam R. Howlett Acked-by: Michal Hocko Reviewed-by: John Hubbard Cc: Mike Rapoport Cc: Jason Gunthorpe Cc: Peter Xu Signed-off-by: Andrew Morton commit 7c33c6c47456c55ca043bb95a34968ef022bf625 Author: SeongJae Park Date: Wed Jun 4 11:31:27 2025 -0700 Docs/admin-guide/mm/damon: add DAMON_STAT usage document Document DAMON_STAT usage and add a link to it on DAMON admin-guide page. Link: https://lkml.kernel.org/r/20250604183127.13968-5-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit e5d2585d9e859df712e5c9308bf19f83927e0021 Author: SeongJae Park Date: Wed Jun 4 11:31:26 2025 -0700 mm/damon/stat: calculate and expose idle time percentiles Knowing how much memory is how cold can be useful for understanding coldness and utilization efficiency of memory. The raw form of DAMON's monitoring results has the information. Convert the raw results into the per-byte idle time distributions and expose it as percentiles metric to users, as a read-only DAMON_STAT parameter. In detail, the metrics are calculated as follows. First, DAMON's per-region access frequency and age information is converted into per-byte idle time. If access frequency of a region is higher than zero, every byte of the region has zero idle time. If the access frequency of a region is zero, every byte of the region has idle time as the age of the region. Then the logic sorts the per-byte idle times and provides the value at 0/100, 1/100, ..., 99/100 and 100/100 location of the sorted array. The metric can be easily aggregated and compared on large scale production systems. For example, if an average of 75-th percentile idle time of machines that collected on similar time is two minutes, it means the system's 25 percent memory is not accessed at all for two minutes or more on average. If a workload considers two minutes as unit work time, we can conclude its working set size is only 75 percent of the memory. If the system utilizes proactive reclamation and it supports coldness-based thresholds like DAMON_RECLAIM, the idle time percentiles can be used to find a more safe or aggressive coldness threshold for aimed memory saving. Link: https://lkml.kernel.org/r/20250604183127.13968-4-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit fabdd1e911da43cddbf17acf930171ba4b944477 Author: SeongJae Park Date: Wed Jun 4 11:31:25 2025 -0700 mm/damon/stat: calculate and expose estimated memory bandwidth The raw form of DAMON's monitoring results captures many details of the information. However, not every bit of the information is always required for understanding practical access patterns. Especially on real world production systems of high scale time and size, the raw form is difficult to be aggregated and compared. Convert the raw monitoring results into a single number metric, namely estimated memory bandwidth and expose it to users as a read-only DAMON_STAT parameter. The metric represents access intensiveness (hotness) of the system. It can easily be aggregated and compared for high level understanding of the access pattern on large systems. Link: https://lkml.kernel.org/r/20250604183127.13968-3-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit 369c415e60732b7c8ed33368891581246f580d7a Author: SeongJae Park Date: Wed Jun 4 11:31:24 2025 -0700 mm/damon: introduce DAMON_STAT module Patch series "mm/damon: introduce DAMON_STAT for simple and practical access monitoring", v2. DAMON-based access monitoring is not simple due to required DAMON control and results visualizations. Introduce a static kernel module for making it simple. The module can be enabled without manual setup and provides access pattern metrics that easy to fetch and understand the practical access pattern information, namely estimated memory bandwidth and memory idle time percentiles. Background and Problems ======================= DAMON can be used for monitoring data access patterns of the system and workloads. Specifically, users can start DAMON to monitor access events on specific address space with fine controls including address ranges to monitor and time intervals between samplings and aggregations. The resulting access information snapshot contains access frequency (nr_accesses) and how long the frequency was kept (age) for each byte. The monitoring usage is not simple and practical enough for production usage. Users should first start DAMON with a number of parameters, and wait until DAMON's monitoring results capture a reasonable amount of the time data (age). In production, such manual start and wait is impractical to capture useful information from a high number of machines in a timely manner. The monitoring result is also too detailed to be used on production environments. The raw results are hard to be aggregated and/or compared for production environments having a large scale of time, space and machines fleet. Users have to implement and use their own automation of DAMON control and results processing. It is repetitive and challenging since there is no good reference or guideline for such automation. Solution: DAMON_STAT ==================== Implement such automation in kernel space as a static kernel module, namely DAMON_STAT. It can be enabled at build, boot, or run time via its build configuration or module parameter. It monitors the entire physical address space with monitoring intervals that auto-tuned for a reasonable amount of access observations and minimum overhead. It converts the raw monitoring results into simpler metrics that can easily be aggregated and compared, namely estimated memory bandwidth and idle time percentiles. Understanding of the metrics and the user interface of DAMON_STAT is essential. Refer to the commit messages of the second and the third patches of this patch series for more details about the metrics. For the user interface, the standard module parameters system is used. Refer to the fourth patch of this patch series for details of the user interface. Discussions =========== The module aims to be useful on production environments constructed with a large number of machines that run a long time. The auto-tuned monitoring intervals ensure a reasonable quality of the outputs. The auto-tuning also ensures its overhead be reasonable and low enough to be enabled always on the production. The simplified monitoring results metrics can be useful for showing both coldness (idle time percentiles) and hotness (memory bandwidth) of the system's access pattern. We expect the information can be useful for assessing system memory utilization and inspiring optimizations or investigations on both kernel and user space memory management logics for large scale fleets. We hence expect the module is good enough to be just used in most environments. For special cases that require a custom access monitoring automation, users will still benefit by using DAMON_STAT as a reference or a guideline for their specialized automation. This patch (of 4): To use DAMON for monitoring access patterns of the system, users should manually start DAMON via DAMON sysfs ABI with a number of parameters for specifying the monitoring target address space, address ranges, and monitoring intervals. After that, users should also wait until desired amount of time data is captured into DAMON's monitoring results. It is bothersome and take a long time to be practical for access monitoring on large fleet level production environments. For access-aware system operations use cases like proactive cold memory reclamation, similar problems existed. We we solved those by introducing dedicated static kernel modules such as DAMON_RECLAIM. Implement such static kernel module for access monitoring, namely DAMON_STAT. It monitors the entire physical address space with auto-tuned monitoring intervals. The auto-tuning is set to capture 4 % of observable access events in each snapshot while keeping the sampling intervals 5 milliseconds in minimum and 10 seconds in maximum. From a few production environments, we confirmed this setup provides high quality monitoring results with minimum overheads. The module therefore receives only one user input, whether to enable or disable it. It can be set on build or boot time via build configuration or kernel boot command line. It can also be overridden at runtime. Note that this commit only implements the DAMON control part of the module. Users could get the monitoring results via damon:damon_aggregated tracepoint, but that's of course not the recommended way. Following commits will implement convenient and optimized ways for serving the monitoring results to users. [sj@kernel.org: use IS_ENABLED() for enabled initial value] Link: https://lkml.kernel.org/r/20250604205619.18929-1-sj@kernel.org [sj@kernel.org: reset enabled when DAMON start failed] Link: https://lkml.kernel.org/r/20250706184750.36588-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250604183127.13968-1-sj@kernel.org Link: https://lkml.kernel.org/r/20250604183127.13968-2-sj@kernel.org Signed-off-by: SeongJae Park Cc: Jonathan Corbet Signed-off-by: Andrew Morton commit e399a07a8a527dd023ca720a338fc508bedd364f Author: Caleb Sander Mateos Date: Fri Apr 11 10:17:45 2025 -0600 mm: remove unused mmap tracepoints The vma_mas_szero and vma_store tracepoints are unused since commit fbcc3104b843 ("mmap: convert __vma_adjust() to use vma iterator"). Remove them so they are no longer listed as available tracepoints. Link: https://lkml.kernel.org/r/20250411161746.1043239-1-csander@purestorage.com Signed-off-by: Caleb Sander Mateos Reported-by: Eric Mueller Reviewed-by: Liam R. Howlett Cc: Jann Horn Cc: Lorenzo Stoakes Cc: "Masami Hiramatsu (Google)" Cc: Mathieu Desnoyers Cc: Steven Rostedt Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit bafa31a1ceab70c70df40ff09b88f359cd0117c4 Author: Paul Menzel Date: Tue Jun 3 08:13:03 2025 +0200 mm: Kconfig: use verb *use* in plural form in description *workloads* is plural requiring the verb *use* in plural form. Link: https://lkml.kernel.org/r/20250603061303.479551-2-pmenzel@molgen.mpg.de Fixes: e13e7922d034 ("mm: add CONFIG_PAGE_BLOCK_ORDER to select page block order") Signed-off-by: Paul Menzel Acked-by: Mike Rapoport (Microsoft) Reviewed-by: Lorenzo Stoakes Reviewed-by: Zi Yan Signed-off-by: Andrew Morton commit cdf48aa83279d4369ec6195f716468950c4440ca Author: Sidhartha Kumar Date: Wed May 28 15:20:13 2025 -0400 mm/hugetlb: convert hugetlb_change_protection() to folios The for loop inside hugetlb_change_protection() increments by the huge page size: psize = huge_page_size(h); for (; address < end; address += psize) so we are operating on the head page of the huge pages between address and end. We can safely convert the struct page usage to struct folio. Link: https://lkml.kernel.org/r/20250528192013.91130-1-sidhartha.kumar@oracle.com Signed-off-by: Sidhartha Kumar Reviewed-by: Matthew Wilcox (Oracle) Reviewed-by: Oscar Salvador Cc: Muchun Song Cc: Sidhartha Kumar Signed-off-by: Andrew Morton commit 4a1ff347e44ce45e8a5c15f466574583b019e4f9 Author: Lorenzo Stoakes Date: Thu May 29 18:15:48 2025 +0100 tools/testing/selftests: add VMA merge tests for KSM merge Add test to assert that we have now allowed merging of VMAs when KSM merging-by-default has been set by prctl(PR_SET_MEMORY_MERGE, ...). We simply perform a trivial mapping of adjacent VMAs expecting a merge, however prior to recent changes implementing this mode earlier than before, these merges would not have succeeded. Assert that we have fixed this! Link: https://lkml.kernel.org/r/6dec7aabf062c6b121cfac992c9c716cefdda00c.1748537921.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Chengming Zhou Tested-by: Chengming Zhou Reviewed-by: Liam R. Howlett Acked-by: Vlastimil Babka Cc: Al Viro Cc: Christian Brauner Cc: David Hildenbrand Cc: Jan Kara Cc: Jann Horn Cc: Stefan Roesch Cc: Xu Xin Signed-off-by: Andrew Morton commit cf7e7a3503df0b71afd68ee84e9a09d4514cc2dd Author: Lorenzo Stoakes Date: Thu May 29 18:15:47 2025 +0100 mm: prevent KSM from breaking VMA merging for new VMAs If a user wishes to enable KSM mergeability for an entire process and all fork/exec'd processes that come after it, they use the prctl() PR_SET_MEMORY_MERGE operation. This defaults all newly mapped VMAs to have the VM_MERGEABLE VMA flag set (in order to indicate they are KSM mergeable), as well as setting this flag for all existing VMAs and propagating this across fork/exec. However it also breaks VMA merging for new VMAs, both in the process and all forked (and fork/exec'd) child processes. This is because when a new mapping is proposed, the flags specified will never have VM_MERGEABLE set. However all adjacent VMAs will already have VM_MERGEABLE set, rendering VMAs unmergeable by default. To work around this, we try to set the VM_MERGEABLE flag prior to attempting a merge. In the case of brk() this can always be done. However on mmap() things are more complicated - while KSM is not supported for MAP_SHARED file-backed mappings, it is supported for MAP_PRIVATE file-backed mappings. These mappings may have deprecated .mmap() callbacks specified which could, in theory, adjust flags and thus KSM eligibility. So we check to determine whether this is possible. If not, we set VM_MERGEABLE prior to the merge attempt on mmap(), otherwise we retain the previous behaviour. This fixes VMA merging for all new anonymous mappings, which covers the majority of real-world cases, so we should see a significant improvement in VMA mergeability. For MAP_PRIVATE file-backed mappings, those which implement the .mmap_prepare() hook and shmem are both known to be safe, so we allow these, disallowing all other cases. Also add stubs for newly introduced function invocations to VMA userland testing. [lorenzo.stoakes@oracle.com: correctly invoke late KSM check after mmap hook] Link: https://lkml.kernel.org/r/5861f8f6-cf5a-4d82-a062-139fb3f9cddb@lucifer.local Link: https://lkml.kernel.org/r/3ba660af716d87a18ca5b4e635f2101edeb56340.1748537921.git.lorenzo.stoakes@oracle.com Fixes: d7597f59d1d3 ("mm: add new api to enable ksm per process") # please no backport! Signed-off-by: Lorenzo Stoakes Reviewed-by: Chengming Zhou Acked-by: David Hildenbrand Reviewed-by: Liam R. Howlett Reviewed-by: Vlastimil Babka Reviewed-by: Xu Xin Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Stefan Roesch Signed-off-by: Andrew Morton commit b914c47d46da2ac66425521d304cbc8729153556 Author: Lorenzo Stoakes Date: Thu May 29 18:15:46 2025 +0100 mm: ksm: refer to special VMAs via VM_SPECIAL in ksm_compatible() There's no need to spell out all the special cases, also doing it this way makes it absolutely clear that we preclude unmergeable VMAs in general, and puts the other excluded flags in stark and clear contrast. Link: https://lkml.kernel.org/r/c8be5b055163b164c8824020164076ee3b9389bd.1748537921.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Chengming Zhou Reviewed-by: Vlastimil Babka Reviewed-by: Xu Xin Reviewed-by: Liam R. Howlett Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Stefan Roesch Signed-off-by: Andrew Morton commit de195c67bfcbc770bb6327bbfd3010f1c371216a Author: Lorenzo Stoakes Date: Thu May 29 18:15:45 2025 +0100 mm: ksm: have KSM VMA checks not require a VMA pointer Patch series "mm: ksm: prevent KSM from breaking merging of new VMAs", v3. When KSM-by-default is established using prctl(PR_SET_MEMORY_MERGE), this defaults all newly mapped VMAs to having VM_MERGEABLE set, and thus makes them available to KSM for samepage merging. It also sets VM_MERGEABLE in all existing VMAs. However this causes an issue upon mapping of new VMAs - the initial flags will never have VM_MERGEABLE set when attempting a merge with adjacent VMAs (this is set later in the mmap() logic), and adjacent VMAs will ALWAYS have VM_MERGEABLE set. This renders all newly mapped VMAs unmergeable. To avoid this, this series performs the check for PR_SET_MEMORY_MERGE far earlier in the mmap() logic, prior to the merge being attempted. However we run into complexity with the depreciated .mmap() callback - if a driver hooks this, it might change flags which adjust KSM merge eligibility. We have to worry about this because, while KSM is only applicable to private mappings, this includes both anonymous and MAP_PRIVATE-mapped file-backed mappings. This isn't a problem for brk(), where the VMA must be anonymous. However in mmap() we must be conservative - if the VMA is anonymous then we can always proceed, however if not, we permit only shmem mappings (whose .mmap hook does not affect KSM eligibility) and drivers which implement .mmap_prepare() (invoked prior to the KSM eligibility check). If we can't be sure of the driver changing things, then we maintain the same behaviour of performing the KSM check later in the mmap() logic (and thus losing new VMA mergeability). A great many use-cases for this logic will use anonymous mappings any rate, so this change should already cover the majority of actual KSM use-cases. This patch (of 4): In subsequent commits we are going to determine KSM eligibility prior to a VMA being constructed, at which point we will of course not yet have access to a VMA pointer. It is trivial to boil down the check logic to be parameterised on mm_struct, file and VMA flags, so do so. As a part of this change, additionally expose and use file_is_dax() to determine whether a file is being mapped under a DAX inode. Link: https://lkml.kernel.org/r/cover.1748537921.git.lorenzo.stoakes@oracle.com Link: https://lkml.kernel.org/r/36ad13eb50cdbd8aac6dcfba22c65d5031667295.1748537921.git.lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Acked-by: David Hildenbrand Reviewed-by: Chengming Zhou Reviewed-by: Vlastimil Babka Reviewed-by: Xu Xin Reviewed-by: Liam R. Howlett Cc: Al Viro Cc: Christian Brauner Cc: Jan Kara Cc: Jann Horn Cc: Stefan Roesch Signed-off-by: Andrew Morton commit fee8870a09c84347f1bd51ba094489869a0df33d Author: Ye Liu Date: Fri May 30 13:58:55 2025 +0800 tools/mm: add script to display page state for a given PID and VADDR Introduces a new drgn script, `show_page_info.py`, which allows users to analyze the state of a page given a process ID (PID) and a virtual address (VADDR). This can help kernel developers or debuggers easily inspect page-related information in a live kernel or vmcore. The script extracts information such as the page flags, mapping, and other metadata relevant to diagnosing memory issues. Output example: sudo ./show_page_info.py 1 0x7fc988181000 PID: 1 Comm: systemd mm: 0xffff8d22c4089700 RAW: 0017ffffc000416c fffff939062ff708 fffff939062ffe08 ffff8d23062a12a8 RAW: 0000000000000000 ffff8d2323438f60 0000002500000007 ffff8d23203ff500 Page Address: 0xfffff93905664e00 Page Flags: PG_referenced|PG_uptodate|PG_lru|PG_head|PG_active| PG_private|PG_reported|PG_has_hwpoisoned Page Size: 4096 Page PFN: 0x159938 Page Physical: 0x159938000 Page Virtual: 0xffff8d2319938000 Page Refcount: 37 Page Mapcount: 7 Page Index: 0x0 Page Memcg Data: 0xffff8d23203ff500 Memcg Name: init.scope Memcg Path: /sys/fs/cgroup/memory/init.scope Page Mapping: 0xffff8d23062a12a8 Page Anon/File: File Page VMA: 0xffff8d22e06e0e40 VMA Start: 0x7fc988181000 VMA End: 0x7fc988185000 This page is part of a compound page. This page is the head page of a compound page. Head Page: 0xfffff93905664e00 Compound Order: 2 Number of Pages: 4 Link: https://lkml.kernel.org/r/20250530055855.687067-1-ye.liu@linux.dev Signed-off-by: Ye Liu Tested-by: SeongJae Park Reviewed-by: Stephen Brennan Cc: Florian Weimer Cc: Omar Sandoval Cc: "Paul E . McKenney" Cc: Sweet Tea Dorminy Signed-off-by: Andrew Morton commit af827e0904899f14e0cd8e629fea6d55022e53a9 Author: Koichiro Den Date: Sat May 31 01:23:53 2025 +0900 mm: vmscan: apply proportional reclaim pressure for memcg when MGLRU is enabled The scan implementation for MGLRU was missing proportional reclaim pressure for memcg, which contradicts the description in Documentation/admin-guide/cgroup-v2.rst (memory.{low,min} section). This issue can be observed in kselftest cgroup:test_memcontrol (specifically test_memcg_min and test_memcg_low). The following table shows the actual values observed in my local test env (on xfs) and the error "e", which is the symmetric absolute percentage error from the ideal values of 29M for c[0] and 21M for c[1]. test_memcg_min | MGLRU enabled | MGLRU enabled | MGLRU disabled | Without patch | With patch | -----|-----------------|-----------------|--------------- c[0] | 25964544 (e=8%) | 28770304 (e=3%) | 27820032 (e=4%) c[1] | 26214400 (e=9%) | 23998464 (e=4%) | 24776704 (e=6%) test_memcg_low | MGLRU enabled | MGLRU enabled | MGLRU disabled | Without patch | With patch | -----|-----------------|-----------------|--------------- c[0] | 26214400 (e=7%) | 27930624 (e=4%) | 27688960 (e=5%) c[1] | 26214400 (e=9%) | 24764416 (e=6%) | 24920064 (e=6%) Factor out the proportioning logic to a new function and have MGLRU reuse it. While at it, update the eviction behavior via debugfs 'lru_gen' interface ('-' command with an explicit 'nr_to_reclaim' parameter) to ensure eviction is limited to the specified number. Link: https://lkml.kernel.org/r/20250530162353.541882-1-den@valinux.co.jp Signed-off-by: Koichiro Den Reviewed-by: Yuanchu Xie Cc: Yu Zhao Cc: Axel Rasmussen Signed-off-by: Andrew Morton commit 80d1a8130934ae7ff64c40e5495169ac40f3a916 Author: Lorenzo Stoakes Date: Wed Jun 4 19:03:08 2025 +0100 docs/mm: expand vma doc to highlight pte freeing, non-vma traversal The process addresses documentation already contains a great deal of information about mmap/VMA locking and page table traversal and manipulation. However it waves it hands about non-VMA traversal. Add a section for this and explain the caveats around this kind of traversal. Additionally, commit 6375e95f381e ("mm: pgtable: reclaim empty PTE page in madvise(MADV_DONTNEED)") caused zapping to also free empty PTE page tables. Highlight this. Link: https://lkml.kernel.org/r/20250604180308.137116-1-lorenzo.stoakes@oracle.com Signed-off-by: Lorenzo Stoakes Reviewed-by: Bagas Sanjaya Cc: Jann Horn Cc: Jonathan Corbet Cc: Liam Howlett Cc: Qi Zheng Cc: Shakeel Butt Cc: Suren Baghdasaryan Cc: Vlastimil Babka Signed-off-by: Andrew Morton commit 3091b61505028702438b3677820b2b786eda755b Author: Matthew Wilcox (Oracle) Date: Wed Jun 4 20:03:26 2025 +0100 mm: restore documentation for __free_pages() The documentation was converted to be for ___free_pages(), which doesn't need documentation as it's static. Link: https://lkml.kernel.org/r/20250604190327.814086-1-willy@infradead.org Fixes: 8c57b687e833 (mm, bpf: Introduce free_pages_nolock()) Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Vlastimil Babka Cc: Alexei Starovoitov Signed-off-by: Andrew Morton commit 89a0284bf92e498c8d24a4ce37949eaf4a5101a9 Author: Chintan Vankar Date: Wed Jul 9 16:23:26 2025 +0530 arm64: dts: ti: k3-am69-sk: Add bootph-all property to enable Ethernet boot Ethernet boot requires CPSW nodes to be present starting from R5 SPL stage. Add bootph-all property to required nodes to enable Ethernet boot for SK-AM69. Reviewed-by: Siddharth Vadapalli Signed-off-by: Chintan Vankar Link: https://lore.kernel.org/r/20250709105326.232608-5-c-vankar@ti.com Signed-off-by: Vignesh Raghavendra commit ab9ec669cf74b6499c0de4f42a6dd756a4e4e2a1 Author: Chintan Vankar Date: Wed Jul 9 16:23:25 2025 +0530 arm64: dts: ti: k3-j722s-evm: Add bootph-all property to enable Ethernet boot Ethernet boot requires CPSW nodes to be present starting from R5 SPL stage. Add bootph-all property to required nodes to enable Ethernet boot for J722S-EVM. Reviewed-by: Roger Quadros Signed-off-by: Chintan Vankar Link: https://lore.kernel.org/r/20250709105326.232608-4-c-vankar@ti.com Signed-off-by: Vignesh Raghavendra commit d6ad164e05844be63210900536108812aa00d2fe Author: Chintan Vankar Date: Wed Jul 9 16:23:24 2025 +0530 arm64: dts: ti: k3-am62p5-sk: Add bootph-all property to enable Ethernet boot Ethernet boot requires CPSW nodes to be present starting from R5 SPL stage. Add bootph-all property to required nodes to enable Ethernet boot for AM62P5-SK. Reviewed-by: Roger Quadros Signed-off-by: Chintan Vankar Link: https://lore.kernel.org/r/20250709105326.232608-3-c-vankar@ti.com Signed-off-by: Vignesh Raghavendra commit 7cc984fb30d5c2a780fee0f4b2d4ad2001961c6b Author: Chintan Vankar Date: Wed Jul 9 16:23:23 2025 +0530 arm64: dts: ti: k3-am68-sk-base-board: Add bootph-all property to enable Ethernet boot Ethernet boot requires CPSW nodes to be present starting from R5 SPL stage. Add bootph-all property to required nodes to enable Ethernet boot on SK-AM68. Reviewed-by: Siddharth Vadapalli Signed-off-by: Chintan Vankar Link: https://lore.kernel.org/r/20250709105326.232608-2-c-vankar@ti.com Signed-off-by: Vignesh Raghavendra commit 1544bca2f188e47256b61ae5e24ea93a292bb559 Author: Paresh Bhagat Date: Tue Jul 8 14:28:39 2025 +0530 arm64: dts: ti: Add support for AM62D2-EVM AM62D-EVM evaluation module (EVM) is a low-cost expandable platform board designed for AM62D2 SoC from TI. It supports the following interfaces: * 4 GB LPDDR4 RAM * x2 Gigabit Ethernet expansion connectors * x4 3.5mm TRS Audio Jack Line In * x4 3.5mm TRS Audio Jack Line Out * x2 Audio expansion connectors * x1 Type-A USB 2.0, x1 Type-C dual-role device (DRD) USB 2.0 * x1 UHS-1 capable micro SD card slot * 32 GB eMMC Flash * 512 Mb OSPI NOR flash * x4 UARTs via USB 2.0-B * XDS110 for onboard JTAG debug using USB * Temperature sensors, user push buttons and LEDs Although AM62D2 and AM62A7 differ in peripheral capabilities example multimedia, VPAC, and display subsystems, the core architecture remains same. To reduce duplication, AM62D support reuses the AM62A dtsi and the necessary overrides will be handled in SOC specific dtsi file and a board specific dts. Add basic support for AM62D2-EVM. Schematics Link - https://www.ti.com/lit/zip/sprcal5 Signed-off-by: Paresh Bhagat Signed-off-by: Siddharth Vadapalli Reviewed-by: Andrew Davis Reviewed-by: Bryan Brattlof Link: https://lore.kernel.org/r/20250708085839.1498505-5-p-bhagat@ti.com Signed-off-by: Vignesh Raghavendra commit 106f43ab41fa968c5ce3920e281870b99a519b13 Author: Paresh Bhagat Date: Tue Jul 8 14:28:38 2025 +0530 arm64: dts: ti: Add pinctrl entries for AM62D2 family of SoCs Update k3-pinctrl file to include pin definitions for AM62D2 family of SoCs. Signed-off-by: Paresh Bhagat Reviewed-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250708085839.1498505-4-p-bhagat@ti.com Signed-off-by: Vignesh Raghavendra commit 6f4b2a487352fa775bea4393d2455d334ccc97d4 Author: Paresh Bhagat Date: Tue Jul 8 14:28:37 2025 +0530 dt-bindings: arm: ti: Add AM62D2 SoC and Boards The AM62D2 SoC, part of the K3 architecture, is built for high-performance DSP tasks in automotive audio, pro audio, radar, sonar, and medical imaging. It features up to four Cortex-A53 cores (1.4GHz), two Cortex-R5F cores, and a C7x DSP with 2 TOPS MMA. Key interfaces include multi-channel McASP audio, TSN-capable Gigabit Ethernet, and a range of peripherals (UART, SPI, I2C, CAN, USB, eMMC/SD, OSPI, CSI). It supports LPDDR4/DDR4, secure boot with hardware security, and low-power modes with CAN/GPIO/UART wakeup. This SoC is of part K3 AM62x family, which includes the AM62A and AM62P variants. A key distinction is that the AM62D does not include multimedia components such as the video encoder/decoder, MJPEG encoder, Vision Processing Accelerator (VPAC) for image signal processing, or the display subsystem. Additionally, the AM62D has a different pin configuration compared to the AM62A, which impacts embedded software development. This adds dt bindings for TI's AM62D2 family of devices. More details about the SoCs can be found in the Technical Reference Manual: https://www.ti.com/lit/pdf/sprujd4 Signed-off-by: Paresh Bhagat Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250708085839.1498505-3-p-bhagat@ti.com Signed-off-by: Vignesh Raghavendra commit 1704b0462220beabda1ddb4b386e1295defa39fd Author: Paresh Bhagat Date: Tue Jul 8 14:28:36 2025 +0530 arm64: dts: ti: Add bootph property to nodes at source for am62a Add bootph property directly into the original definitions of relevant nodes (e.g., power domains, USB controllers, and other peripherals) within their respective DTSI files (ex. main, mcu, and wakeup) for am62a. By defining bootph in the nodes source definitions instead of appending it later in final DTS files, this change ensures that the property is inherently present wherever the nodes are reused across derived device trees. Signed-off-by: Paresh Bhagat Reviewed-by: Bryan Brattlof Link: https://lore.kernel.org/r/20250708085839.1498505-2-p-bhagat@ti.com Signed-off-by: Vignesh Raghavendra commit c65d34296b2252897e37835d6007bbd01b255742 Merge: 5d6fc6b4d0b2ae a194be578376f7 Author: Jakub Kicinski Date: Wed Jul 9 19:47:47 2025 -0700 Merge branch 'net-mlx5-misc-changes-2025-07-09' Tariq Toukan says: ==================== net/mlx5: misc changes 2025-07-09 This series contains misc enhancements to the mlx5 driver. ==================== Link: https://patch.msgid.link/1752009387-13300-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit a194be578376f7365db9bf1b8193c74546c86121 Author: Tariq Toukan Date: Wed Jul 9 00:16:27 2025 +0300 net/mlx5e: RX, Remove unnecessary RQT redirects RQTs (Receive Queue Table) should redirect traffic to the channels' RQs when they're active. Otherwise, redirect to the designated "drop RQ". RQTs are created in "inactive" state, pointing to the "drop RQ". In activate and de-activate flows, do not "deactivate" the rest of RQTs (beyond the num of channels), as they are already inactive. This cuts down unnecessary execution of FW commands (MODIFY_RQT), and improves the latency of open/close channels or configuration change. Perf: NIC: Connect-X7. Configuration: 1 combined channel, max num channels 248. Measure time for "interface up + interface down". Before: 0.313 sec After: 0.057 sec (5.5x faster) 247 MODIFY_RQT commands saved in interface up. 247 MODIFY_RQT commands saved in interface down. Signed-off-by: Tariq Toukan Reviewed-by: Dragos Tatulea Reviewed-by: Simon Horman Link: https://patch.msgid.link/1752009387-13300-6-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit d980f371b134d5d66d082161171a6be613975dfc Author: Maor Gottlieb Date: Wed Jul 9 00:16:26 2025 +0300 net/mlx5: Warn when write combining is not supported Warn if write combining is not supported, as it can impact latency. Add the warning message to be printed only when the driver actually run the test and detect unsupported state, rather than when inheriting parent's result for SFs. Signed-off-by: Maor Gottlieb Reviewed-by: Michael Guralnik Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1752009387-13300-5-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit c0ca344d796cf00c169f63f09eea0f4905778be1 Author: Gal Pressman Date: Wed Jul 9 00:16:25 2025 +0300 net/mlx5e: Replace recursive VLAN push handling with an iterative loop mlx5e_tc_act_vlan_add_push_action() uses tail-recursion to walk through a stack of VLAN devices. There is no need for a complicated recursion with unnecessary stack consumption and less obvious code flow, rewrite the function so that it uses a do while loop instead. Signed-off-by: Gal Pressman Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1752009387-13300-4-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 122d86aa2a0c8950ea958a3d258eccbb5872bd68 Author: Cosmin Ratiu Date: Wed Jul 9 00:16:24 2025 +0300 net/mlx5e: CT: extract a memcmp from a spinlock section This reduces the time the lock is held and reduces contention. Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1752009387-13300-3-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit ade89d1f2486e5189b3a3f0a9e917defa4ff0779 Author: Carolina Jubran Date: Wed Jul 9 00:16:23 2025 +0300 net/mlx5e: Remove unused VLAN insertion logic in TX path The VLAN insertion capability (`wqe_vlan_insert`) was never enabled on all mlx5 devices. When VLAN TX offload is advertised but this capability is not supported, the driver uses inline headers to insert the VLAN tag. To support this, the driver used to set the `MLX5E_SQ_STATE_VLAN_NEED_L2_INLINE` bit to enforce L2 inline mode when `wqe_vlan_insert` was not supported. Since the capability is disabled on all devices, this logic was always active, and the SQ flag has become redundant. L2 inline is enforced unconditionally for VLAN-tagged packets. The `skb_vlan_tag_present()` check in the else-if block of `mlx5e_sq_xmit_wqe()` is never true by this point in the TX flow, as the VLAN tag has already been inserted by the driver using inline headers. As a result, this code is never executed. Remove the redundant SQ state, dead VLAN insertion code block, and related logic. Signed-off-by: Carolina Jubran Signed-off-by: Tariq Toukan Reviewed-by: Simon Horman Link: https://patch.msgid.link/1752009387-13300-2-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 5d6fc6b4d0b2aee373dba41a25ede2651769ac48 Author: Stefano Garzarella Date: Tue Jul 8 13:17:01 2025 +0200 vsock/test: fix test for null ptr deref when transport changes In test_stream_transport_change_client(), the client sends CONTROL_CONTINUE on each iteration, even when connect() is unsuccessful. This causes a flood of control messages in the server that hangs around for more than 10 seconds after the test finishes, triggering several timeouts and causing subsequent tests to fail. This was discovered in testing a newly proposed test that failed in this way on the client side: ... 33 - SOCK_STREAM transport change null-ptr-deref...ok 34 - SOCK_STREAM ioctl(SIOCINQ) functionality...recv timed out The CONTROL_CONTINUE message is used only to tell to the server to call accept() to consume successful connections, so that subsequent connect() will not fail for finding the queue full. Send CONTROL_CONTINUE message only when the connect() has succeeded, or found the queue full. Note that the second connect() can also succeed if the first one was interrupted after sending the request. Fixes: 3a764d93385c ("vsock/test: Add test for null ptr deref when transport changes") Cc: leonardi@redhat.com Signed-off-by: Stefano Garzarella Reviewed-by: Luigi Leonardi Link: https://patch.msgid.link/20250708111701.129585-1-sgarzare@redhat.com Signed-off-by: Jakub Kicinski commit b9274abe9803877ad36b28213d00eb414a9c0a95 Merge: 6dfcbd7d1d6579 3117a11fff5af9 Author: Jakub Kicinski Date: Wed Jul 9 19:32:32 2025 -0700 Merge branch 'net-phy-bcm54811-phy-initialization' says: ==================== net: phy: bcm54811: PHY initialization Proper bcm54811 PHY driver initialization for MII-Lite. The bcm54811 PHY in MLP package must be setup for MII-Lite interface mode by software. Normally, the PHY to MAC interface is selected in hardware by setting the bootstrap pins of the PHY. However, MII and MII-Lite share the same hardware setup and must be distinguished by software, setting appropriate bit in a configuration register. The MII-Lite interface mode is non-standard one, defined by Broadcom for some of their PHYs. The MII-Lite lightness consist in omitting RXER, TXER, CRS and COL signals of the standard MII interface. Absence of COL them makes half-duplex links modes impossible but does not interfere with Broadcom's BroadR-Reach link modes, because they are full-duplex only. To do it in a clean way, MII-Lite must be introduced first, including its limitation to link modes (no half-duplex), because it is a prerequisite for the patch #3 of this series. The patch #4 does not depend on MII-Lite directly but both #3 and #4 are necessary for bcm54811 to work properly without additional configuration steps to be done - for example in the bootloader, before the kernel starts. PATCH 1 - Add MII-Lite PHY interface mode as defined by Broadcom for their two-wire PHYs. It can be used with most Ethernet controllers under certain limitations (no half-duplex link modes etc.). PATCH 2 - Add MII-Lite PHY interface type PATCH 3 - Activation of MII-Lite interface mode on Broadcom bcm5481x PHYs PATCH 4 - Initialize the BCM54811 PHY properly so that it conforms to the datasheet regarding a reserved bit in the LRE Control register, which must be written to zero after every device reset. Ignore the LDS capability bit in LRE Status register on bcm54811. ==================== Link: https://patch.msgid.link/20250708090140.61355-1-kamilh@axis.com Signed-off-by: Jakub Kicinski commit 3117a11fff5af9e74f4946f07cb3ca083cbbdf4b Author: Kamil Horák - 2N Date: Tue Jul 8 11:01:40 2025 +0200 net: phy: bcm54811: PHY initialization Reset the bit 12 in PHY's LRE Control register upon initialization. According to the datasheet, this bit must be written to zero after every device reset. Signed-off-by: Kamil Horák - 2N Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250708090140.61355-5-kamilh@axis.com Signed-off-by: Jakub Kicinski commit 34bf222824f6c9ac03620ee18aaf93d3b6138db3 Author: Kamil Horák - 2N Date: Tue Jul 8 11:01:39 2025 +0200 net: phy: bcm5481x: MII-Lite activation Broadcom PHYs featuring the BroadR-Reach two-wire link mode are usually capable to operate in simplified MII mode, without TXER, RXER, CRS and COL signals as defined for the MII. The absence of COL signal makes half-duplex link modes impossible, however, the BroadR-Reach modes are all full-duplex only. Depending on the IC encapsulation, there exist MII-Lite-only PHYs such as bcm54811 in MLP. The PHY itself is hardware-strapped to select among multiple RGMII and MII-Lite modes, but the MII-Lite mode must be also activated by software. Add MII-Lite activation for bcm5481x PHYs. Signed-off-by: Kamil Horák - 2N Reviewed-by: Florian Fainelli Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250708090140.61355-4-kamilh@axis.com Signed-off-by: Jakub Kicinski commit fbe937473f3ab8e2ba163840f5563108881340dd Author: Kamil Horák - 2N Date: Tue Jul 8 11:01:38 2025 +0200 dt-bindings: ethernet-phy: add MII-Lite phy interface type Some Broadcom PHYs are capable to operate in simplified MII mode, without TXER, RXER, CRS and COL signals as defined for the MII. The MII-Lite mode can be used on most Ethernet controllers with full MII interface by just leaving the input signals (RXER, CRS, COL) inactive. The absence of COL signal makes half-duplex link modes impossible but does not interfere with BroadR-Reach link modes on Broadcom PHYs, because they are all full-duplex only. Add new interface type "mii-lite" to phy-connection-type enum. Signed-off-by: Kamil Horák - 2N Reviewed-by: Maxime Chevallier Reviewed-by: Florian Fainelli Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250708090140.61355-3-kamilh@axis.com Signed-off-by: Jakub Kicinski commit 67c0170566b55b1f6ee3567c94ff679104277e2d Author: Kamil Horák - 2N Date: Tue Jul 8 11:01:37 2025 +0200 net: phy: MII-Lite PHY interface mode Some Broadcom PHYs are capable to operate in simplified MII mode, without TXER, RXER, CRS and COL signals as defined for the MII. The MII-Lite mode can be used on most Ethernet controllers with full MII interface by just leaving the input signals (RXER, CRS, COL) inactive. The absence of COL signal makes half-duplex link modes impossible but does not interfere with BroadR-Reach link modes on Broadcom PHYs, because they are all full-duplex only. Add MII-Lite interface mode, especially for Broadcom two-wire PHYs. Signed-off-by: Kamil Horák - 2N Reviewed-by: Maxime Chevallier Reviewed-by: Florian Fainelli Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250708090140.61355-2-kamilh@axis.com Signed-off-by: Jakub Kicinski commit 6dfcbd7d1d657994a57b53ad4be834eb783f32bc Author: Zqiang Date: Tue Jul 8 16:16:53 2025 +0800 net: usb: enable the work after stop usbnet by ip down/up Oleksij reported that: The smsc95xx driver fails after one down/up cycle, like this: $ nmcli device set enu1u1 managed no $ p a a 10.10.10.1/24 dev enu1u1 $ ping -c 4 10.10.10.3 $ ip l s dev enu1u1 down $ ip l s dev enu1u1 up $ ping -c 4 10.10.10.3 The second ping does not reach the host. Networking also fails on other interfaces. Enable the work by replacing the disable_work_sync() with cancel_work_sync(). [Jun Miao: completely write the commit changelog] Fixes: 2c04d279e857 ("net: usb: Convert tasklet API to new bottom half workqueue mechanism") Reported-by: Oleksij Rempel Tested-by: Oleksij Rempel Signed-off-by: Zqiang Signed-off-by: Jun Miao Link: https://patch.msgid.link/20250708081653.307815-1-jun.miao@intel.com Signed-off-by: Jakub Kicinski commit 3b932976e0a1372ceaba0ceddec27e07d49e5715 Merge: 819802e25a091e 613165683d3448 Author: Jakub Kicinski Date: Wed Jul 9 19:30:00 2025 -0700 Merge branch 'vsock-introduce-siocinq-ioctl-support' Xuewei Niu says: ==================== vsock: Introduce SIOCINQ ioctl support Introduce SIOCINQ ioctl support for vsock, indicating the length of unread bytes. Similar with SIOCOUTQ ioctl, the information is transport-dependent. The first patch adds SIOCINQ ioctl support in AF_VSOCK. Thanks to @dexuan, the second patch is to fix the issue where hyper-v `hvs_stream_has_data()` doesn't return the readable bytes. The third patch wraps the ioctl into `ioctl_int()`, which implements a retry mechanism to prevent immediate failure. The last one adds two test cases to check the functionality. The changes have been tested, and the results are as expected. ==================== Link: https://patch.msgid.link/20250708-siocinq-v6-0-3775f9a9e359@antgroup.com Signed-off-by: Jakub Kicinski commit 613165683d344801c1d11fcacda6733f3b679e51 Author: Xuewei Niu Date: Tue Jul 8 14:36:14 2025 +0800 test/vsock: Add ioctl SIOCINQ tests Add SIOCINQ ioctl tests for both SOCK_STREAM and SOCK_SEQPACKET. The client waits for the server to send data, and checks if the SIOCINQ ioctl value matches the data size. After consuming the data, the client checks if the SIOCINQ value is 0. Signed-off-by: Xuewei Niu Reviewed-by: Stefano Garzarella Tested-by: Luigi Leonardi Reviewed-by: Luigi Leonardi Link: https://patch.msgid.link/20250708-siocinq-v6-4-3775f9a9e359@antgroup.com Signed-off-by: Jakub Kicinski commit 53548d6bffacc610ee883d3c0e99eb476fb606d3 Author: Xuewei Niu Date: Tue Jul 8 14:36:13 2025 +0800 test/vsock: Add retry mechanism to ioctl wrapper Wrap the ioctl in `ioctl_int()`, which takes a pointer to the actual int value and an expected int value. The function will not return until either the ioctl returns the expected value or a timeout occurs, thus avoiding immediate failure. Signed-off-by: Xuewei Niu Reviewed-by: Stefano Garzarella Reviewed-by: Luigi Leonardi Link: https://patch.msgid.link/20250708-siocinq-v6-3-3775f9a9e359@antgroup.com Signed-off-by: Jakub Kicinski commit f7c72265927540fb24c99fee8a54da7db537656c Author: Xuewei Niu Date: Tue Jul 8 14:36:12 2025 +0800 vsock: Add support for SIOCINQ ioctl Add support for SIOCINQ ioctl, indicating the length of bytes unread in the socket. The value is obtained from `vsock_stream_has_data()`. Signed-off-by: Xuewei Niu Reviewed-by: Stefano Garzarella Reviewed-by: Luigi Leonardi Link: https://patch.msgid.link/20250708-siocinq-v6-2-3775f9a9e359@antgroup.com Signed-off-by: Jakub Kicinski commit f0c5827d07cb34dfcf7d8751f1681151f547a268 Author: Dexuan Cui Date: Tue Jul 8 14:36:11 2025 +0800 hv_sock: Return the readable bytes in hvs_stream_has_data() When hv_sock was originally added, __vsock_stream_recvmsg() and vsock_stream_has_data() actually only needed to know whether there is any readable data or not, so hvs_stream_has_data() was written to return 1 or 0 for simplicity. However, now hvs_stream_has_data() should return the readable bytes because vsock_data_ready() -> vsock_stream_has_data() needs to know the actual bytes rather than a boolean value of 1 or 0. The SIOCINQ ioctl support also needs hvs_stream_has_data() to return the readable bytes. Let hvs_stream_has_data() return the readable bytes of the payload in the next host-to-guest VMBus hv_sock packet. Note: there may be multiple incoming hv_sock packets pending in the VMBus channel's ringbuffer, but so far there is not a VMBus API that allows us to know all the readable bytes in total without reading and caching the payload of the multiple packets, so let's just return the readable bytes of the next single packet. In the future, we'll either add a VMBus API that allows us to know the total readable bytes without touching the data in the ringbuffer, or the hv_sock driver needs to understand the VMBus packet format and parse the packets directly. Signed-off-by: Dexuan Cui Signed-off-by: Xuewei Niu Acked-by: Stefano Garzarella Acked-by: Wei Liu Link: https://patch.msgid.link/20250708-siocinq-v6-1-3775f9a9e359@antgroup.com Signed-off-by: Jakub Kicinski commit 819802e25a091e9ef8d37fc01b47f013af50c416 Author: Jason Xing Date: Tue Jul 8 14:29:07 2025 +0800 Documentation: xsk: correct the obsolete references and examples The modified lines are mainly related to the following commits[1][2] which remove those tests and examples. Since samples/bpf has been deprecated, we can refer to more examples that are easily searched in the various xdp-projects, like the following link: https://github.com/xdp-project/bpf-examples/tree/main/AF_XDP-example [1] commit f36600634282 ("libbpf: move xsk.{c,h} into selftests/bpf") [2] commit cfb5a2dbf141 ("bpf, samples: Remove AF_XDP samples") Signed-off-by: Jason Xing Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Maciej Fijalkowski Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250708062907.11557-1-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 76d727ae02b527426c73a446b9291df376db8944 Author: Feng Yang Date: Tue Jul 8 13:40:53 2025 +0800 skbuff: Add MSG_MORE flag to optimize tcp large packet transmission When using sockmap for forwarding, the average latency for different packet sizes after sending 10,000 packets is as follows: size old(us) new(us) 512 56 55 1472 58 58 1600 106 81 3000 145 105 5000 182 125 Suggested-by: Eric Dumazet Signed-off-by: Feng Yang Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250708054053.39551-1-yangfeng59949@163.com Signed-off-by: Jakub Kicinski commit fb6045762901d37b28b90a01228c25dbb99bcc7c Merge: d991666b7b699a 31326d98416e89 Author: Jakub Kicinski Date: Wed Jul 9 19:25:03 2025 -0700 Merge branch 'converge-on-using-secs_to_jiffies-part-two' Easwar Hariharan says: ==================== Converge on using secs_to_jiffies() part two This is the second series (part 1*) that converts users of msecs_to_jiffies() that either use the multiply pattern of either of: - msecs_to_jiffies(N*1000) or - msecs_to_jiffies(N*MSEC_PER_SEC) where N is a constant or an expression, to avoid the multiplication. The conversion is made with Coccinelle with the secs_to_jiffies() script in scripts/coccinelle/misc. Attention is paid to what the best change can be rather than restricting to what the tool provides. v1: https://lore.kernel.org/20250219-netdev-secs-to-jiffies-part-2-v1-0-c484cc63611b@linux.microsoft.com ==================== Link: https://patch.msgid.link/20250707-netdev-secs-to-jiffies-part-2-v2-0-b7817036342f@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 31326d98416e894f464ff8d9198adc06e5dd53a7 Author: Easwar Hariharan Date: Mon Jul 7 15:03:33 2025 -0700 net: ipconfig: convert timeouts to secs_to_jiffies() Commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()") introduced secs_to_jiffies(). As the value here is a multiple of 1000, use secs_to_jiffies() instead of msecs_to_jiffies to avoid the multiplication. This is converted using scripts/coccinelle/misc/secs_to_jiffies.cocci with the following Coccinelle rules: @depends on patch@ expression E; @@ -msecs_to_jiffies(E * 1000) +secs_to_jiffies(E) -msecs_to_jiffies(E * MSEC_PER_SEC) +secs_to_jiffies(E) While here, manually convert a couple timeouts denominated in seconds Signed-off-by: Easwar Hariharan Link: https://patch.msgid.link/20250707-netdev-secs-to-jiffies-part-2-v2-2-b7817036342f@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 4814f9110ec6b7b2a25ec0c397f996ce34d31115 Author: Easwar Hariharan Date: Mon Jul 7 15:03:32 2025 -0700 net/smc: convert timeouts to secs_to_jiffies() Commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()") introduced secs_to_jiffies(). As the value here is a multiple of 1000, use secs_to_jiffies() instead of msecs_to_jiffies to avoid the multiplication. This is converted using scripts/coccinelle/misc/secs_to_jiffies.cocci with the following Coccinelle rules: @depends on patch@ expression E; @@ -msecs_to_jiffies(E * 1000) +secs_to_jiffies(E) -msecs_to_jiffies(E * MSEC_PER_SEC) +secs_to_jiffies(E) Signed-off-by: Easwar Hariharan Reviewed-by: Dust Li Reviewed-by: Guangguan Wang Link: https://patch.msgid.link/20250707-netdev-secs-to-jiffies-part-2-v2-1-b7817036342f@linux.microsoft.com Signed-off-by: Jakub Kicinski commit d991666b7b699aebeb5ac3e8eb32434f4912a893 Author: Bailey Forrest Date: Mon Jul 7 14:01:07 2025 -0700 gve: make IRQ handlers and page allocation NUMA aware All memory in GVE is currently allocated without regard for the NUMA node of the device. Because access to NUMA-local memory access is significantly cheaper than access to a remote node, this change attempts to ensure that page frags used in the RX path, including page pool frags, are allocated on the NUMA node local to the gVNIC device. Note that this attempt is best-effort. If necessary, the driver will still allocate non-local memory, as __GFP_THISNODE is not passed. Descriptor ring allocations are not updated, as dma_alloc_coherent handles that. This change also modifies the IRQ affinity setting to only select CPUs from the node local to the device, preserving the behavior that TX and RX queues of the same index share CPU affinity. Signed-off-by: Bailey Forrest Signed-off-by: Joshua Washington Reviewed-by: Willem de Bruijn Signed-off-by: Harshitha Ramamurthy Signed-off-by: Jeroen de Borst Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250707210107.2742029-1-jeroendb@google.com Signed-off-by: Jakub Kicinski commit 11b5d56d37f2fe6b093f5b4599370f21a33b6409 Merge: f47e8f618c7d2e ce26d7ca50a529 Author: Jakub Kicinski Date: Wed Jul 9 19:08:56 2025 -0700 Merge branch 'add-microchip-zl3073x-support-part-1' Ivan Vecera says: ==================== Add Microchip ZL3073x support (part 1) Add support for Microchip Azurite DPLL/PTP/SyncE chip family that provides DPLL and PTP functionality. This series bring first part that adds the core functionality and basic DPLL support. The next part of the series will bring additional DPLL functionality like eSync support, phase offset and frequency offset reporting and phase adjustments. Testing was done by myself and by Prathosh Satish on Microchip EDS2 development board with ZL30732 DPLL chip connected over I2C bus. ==================== Link: https://patch.msgid.link/20250704182202.1641943-1-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit ce26d7ca50a5298e025a92190b697de4903cea77 Author: Ivan Vecera Date: Fri Jul 4 20:22:02 2025 +0200 dpll: zl3073x: Add support to get/set frequency on pins Add support to get/set frequency on pins. The frequency for input pins (references) is computed in the device according this formula: freq = base_freq * multiplier * (nominator / denominator) where the base_freq comes from the list of supported base frequencies and other parameters are arbitrary numbers. All these parameters are 16-bit unsigned integers. The frequency for output pin is determined by the frequency of synthesizer the output pin is connected to and divisor of the output to which is the given pin belongs. The resulting frequency of the P-pin and the N-pin from this output pair depends on the signal format of this output pair. The device supports so-called N-divided signal formats where for the N-pin there is an additional divisor. The frequencies for both pins from such output pair are computed: P-pin-freq = synth_freq / output_div N-pin-freq = synth_freq / output_div / n_div For other signal-format types both P and N pin have the same frequency based only synth frequency and output divisor. Implement output pin callbacks to get and set frequency. The frequency setting for the output non-N-divided signal format is simple as we have to compute just new output divisor. For N-divided formats it is more complex because by changing of output divisor we change frequency for both P and N pins. In this case if we are changing frequency for P-pin we have to compute also new N-divisor for N-pin to keep its current frequency. From this and the above it follows that the frequency of the N-pin cannot be higher than the frequency of the P-pin and the callback must take this limitation into account. Co-developed-by: Prathosh Satish Signed-off-by: Prathosh Satish Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-13-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit bf33c93c1a160301a577d098c700411545e9a0c2 Author: Ivan Vecera Date: Fri Jul 4 20:22:01 2025 +0200 dpll: zl3073x: Implement input pin state setting in automatic mode Implement input pin state setting when the DPLL is running in automatic mode. Unlike manual mode, the DPLL mode switching is not used here and the implementation uses special priority value (15) to make the given pin non-selectable. When the user sets state of the pin as disconnected the driver internally sets its priority in HW to 15 that prevents the DPLL to choose this input pin. Conversely, if the pin status is set to selectable, the driver sets the pin priority in HW to the original saved value. Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-12-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 12ba92f0a6defd60cb0c518c69fce19d7d27660d Author: Ivan Vecera Date: Fri Jul 4 20:22:00 2025 +0200 dpll: zl3073x: Add support to get/set priority on input pins Add support for getting and setting input pin priority. Implement required callbacks and set appropriate capability for input pins. Although the pin priority make sense only if the DPLL is running in automatic mode we have to expose this capability unconditionally because input pins (references) are shared between all DPLLs where one of them can run in automatic mode while the other one not. Co-developed-by: Prathosh Satish Signed-off-by: Prathosh Satish Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-11-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 9686c8b0167605232fc777a14907089e092a23e6 Author: Ivan Vecera Date: Fri Jul 4 20:21:59 2025 +0200 dpll: zl3073x: Implement input pin selection in manual mode Implement input pin state setting if the DPLL is running in manual mode. The driver indicates manual mode if the DPLL mode is one of ref-lock, forced-holdover, freerun. Use these modes to implement input pin state change between connected and disconnected states. When the user set the particular pin as connected the driver marks this input pin as forced reference and switches the DPLL mode to ref-lock. When the use set the pin as disconnected the driver switches the DPLL to freerun or forced holdover mode. The switch to holdover mode is done if the DPLL has holdover capability (e.g is currently locked with holdover acquired). Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-10-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 75a71ecc24125f92eaed45f0b9bd90373f73ec6f Author: Ivan Vecera Date: Fri Jul 4 20:21:58 2025 +0200 dpll: zl3073x: Register DPLL devices and pins Enumerate all available DPLL channels and registers a DPLL device for each of them. Check all input references and outputs and register DPLL pins for them. Number of registered DPLL pins depends on configuration of references and outputs. If the reference or output is configured as differential one then only one DPLL pin is registered. Both references and outputs can be also disabled from firmware configuration and in this case no DPLL pins are registered. All registrable references are registered to all available DPLL devices with exception of DPLLs that are configured in NCO (numerically controlled oscillator) mode. In this mode DPLL channel acts as PHC and cannot be locked to any reference. Device outputs are connected to one of synthesizers and each synthesizer is driven by some DPLL channel. So output pins belonging to given output are registered to DPLL device that drives associated synthesizer. Finally add kworker task to monitor async changes on all DPLL channels and input pins and to notify about them DPLL core. Output pins are not monitored as their parameters are not changed asynchronously by the device. Co-developed-by: Prathosh Satish Signed-off-by: Prathosh Satish Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-9-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit a99a9f0ebdaaae14fe1d69d046633bce6110d0c2 Author: Ivan Vecera Date: Fri Jul 4 20:21:57 2025 +0200 dpll: zl3073x: Read DPLL types and pin properties from system firmware Add support for reading of DPLL types and optional pin properties from the system firmware (DT, ACPI...). The DPLL types are stored in property 'dpll-types' as string array and possible values 'pps' and 'eec' are mapped to DPLL enums DPLL_TYPE_PPS and DPLL_TYPE_EEC. The pin properties are stored under 'input-pins' and 'output-pins' sub-nodes and the following ones are supported: * reg integer that specifies pin index * label string that is used by driver as board label * connection-type string that indicates pin connection type * supported-frequencies-hz array of u64 values what frequencies are supported / allowed for given pin with respect to hardware wiring Do not blindly trust system firmware and filter out frequencies that cannot be configured/represented in device (input frequencies have to be factorized by one of the base frequencies and output frequencies have to divide configured synthesizer frequency). Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-8-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit b7d907d1f84a3c51d7fcc83e30a0227cfea77172 Author: Ivan Vecera Date: Fri Jul 4 20:21:56 2025 +0200 dpll: zl3073x: Fetch invariants during probe Several configuration parameters will remain constant at runtime, so we can load them during probe to avoid excessive reads from the hardware. Read the following parameters from the device during probe and store them for later use: * enablement status and frequencies of the synthesizers and their associated DPLL channels * enablement status and type (single-ended or differential) of input pins * associated synthesizers, signal format, and enablement status of outputs Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-7-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 2df8e64e01c10a4b75ea7797629f9e764a840eb0 Author: Ivan Vecera Date: Fri Jul 4 20:21:55 2025 +0200 dpll: Add basic Microchip ZL3073x support Microchip Azurite ZL3073x represents chip family providing DPLL and optionally PHC (PTP) functionality. The chips can be connected be connected over I2C or SPI bus. They have the following characteristics: * up to 5 separate DPLL units (channels) * 5 synthesizers * 10 input pins (references) * 10 outputs * 20 output pins (output pin pair shares one output) * Each reference and output can operate in either differential or single-ended mode (differential mode uses 2 pins) * Each output is connected to one of the synthesizers * Each synthesizer is driven by one of the DPLL unit The device uses 7-bit addresses and 8-bits values. It exposes 8-, 16-, 32- and 48-bits registers in address range <0x000,0x77F>. Due to 7bit addressing, the range is organized into pages of 128 bytes, with each page containing a page selector register at address 0x7F. For reading/writing multi-byte registers, the device supports bulk transfers. Add basic functionality to access device registers, probe functionality both I2C and SPI cases and add devlink support to provide info and to set clock ID parameter. Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-6-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit de9ccf2296ac323a571e442b5730ca9cc259fbf0 Author: Ivan Vecera Date: Fri Jul 4 20:21:54 2025 +0200 devlink: Add new "clock_id" generic device param Add a new device generic parameter to specify clock ID that should be used by the device for registering DPLL devices and pins. Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-5-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit c0ef1446959101d23fdf1b1bdefc6613a83dba03 Author: Ivan Vecera Date: Fri Jul 4 20:21:53 2025 +0200 devlink: Add support for u64 parameters Only 8, 16 and 32-bit integers are supported for numeric devlink parameters. The subsequent patch adds support for DPLL clock ID that is defined as 64-bit number. Add support for u64 parameter type. Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-4-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 9f149c5d6dbe3b9b54704a6f342958ef28392dd0 Author: Ivan Vecera Date: Fri Jul 4 20:21:52 2025 +0200 dt-bindings: dpll: Add support for Microchip Azurite chip family Add DT bindings for Microchip Azurite DPLL chip family. These chips provide up to 5 independent DPLL channels, 10 differential or single-ended inputs and 10 differential or 20 single-ended outputs. They can be connected via I2C or SPI busses. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-3-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit 0afcee10dda16ae2c80732eecf43b586eb0750fc Author: Ivan Vecera Date: Fri Jul 4 20:21:51 2025 +0200 dt-bindings: dpll: Add DPLL device and pin Add a common DT schema for DPLL device and its associated pins. The DPLL (device phase-locked loop) is a device used for precise clock synchronization in networking and telecom hardware. The device includes one or more DPLLs (channels) and one or more physical input/output pins. Each DPLL channel is used either to provide a pulse-per-clock signal or to drive an Ethernet equipment clock. The input and output pins have the following properties: * label: specifies board label * connection type: specifies its usage depending on wiring * list of supported or allowed frequencies: depending on how the pin is connected and where) * embedded sync capability: indicates whether the pin supports this Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ivan Vecera Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250704182202.1641943-2-ivecera@redhat.com Signed-off-by: Jakub Kicinski commit f47e8f618c7d2e51b0ea5f22ad550e7f62ec45c1 Author: Bui Quang Minh Date: Sat Jul 5 14:55:14 2025 +0700 virtio-net: xsk: rx: move the xdp->data adjustment to buf_to_xdp() This commit does not do any functional changes. It moves xdp->data adjustment for buffer other than first buffer to buf_to_xdp() helper so that the xdp_buff adjustment does not scatter over different functions. Signed-off-by: Bui Quang Minh Link: https://patch.msgid.link/20250705075515.34260-1-minhquangbui99@gmail.com Signed-off-by: Jakub Kicinski commit b4bb2ac099ca0b944695be41ade5562d895a8751 Merge: 6a971e48e2d8d7 cfeedf6a420d67 Author: Jakub Kicinski Date: Wed Jul 9 18:39:15 2025 -0700 Merge branch 'add-vf-drivers-for-wangxun-virtual-functions' Mengyuan Lou says: ==================== Add vf drivers for wangxun virtual functions Introduces basic support for Wangxun’s virtual function (VF) network drivers, specifically txgbevf and ngbevf. These drivers provide SR-IOV VF functionality for Wangxun 10/25/40G network devices. The first three patches add common APIs for Wangxun VF drivers, including mailbox communication and shared initialization logic.These abstractions are placed in libwx to reduce duplication across VF drivers. Patches 4–8 introduce the txgbevf driver, including: PCI device initialization, Hardware reset, Interrupt setup, Rx/Tx datapath implementation and link status changeing flow. Patches 9–12 implement the ngbevf driver, mirroring the functionality added in txgbevf. v2: https://lore.kernel.org/20250625102058.19898-1-mengyuanlou@net-swift.com v1: https://lore.kernel.org/20250611083559.14175-1-mengyuanlou@net-swift.com ==================== Link: https://patch.msgid.link/20250704094923.652-1-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit cfeedf6a420d673078062995218457c6e3c4e6c3 Author: Mengyuan Lou Date: Fri Jul 4 17:49:23 2025 +0800 net: ngbevf: add link update flow Add link update flow to wangxun 1G virtual functions. Get link status from pf in mbox, and if it is failed then check the vx_status, because vx_status switching is too slow. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-13-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit 0f71e3a6e59daa000bcebdbeab6bafda3747f3f9 Author: Mengyuan Lou Date: Fri Jul 4 17:49:22 2025 +0800 net: ngbevf: init interrupts and request irqs Add specific parameters for irq alloc, then use wx_init_interrupt_scheme to initialize interrupt allocation in probe. Add .ndo_start_xmit support and start all queues. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-12-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit 85494c9bf5b0e14757fdcc75f9bff2f6f47dcb62 Author: Mengyuan Lou Date: Fri Jul 4 17:49:21 2025 +0800 net: ngbevf: add sw init pci info and reset hardware Do sw init and reset hw for ngbevf virtual functions, then register netdev. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-11-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit a0008a3658a34a54e77f2568bdaa2626233b1459 Author: Mengyuan Lou Date: Fri Jul 4 17:49:20 2025 +0800 net: wangxun: add ngbevf build Add doc build infrastructure for ngbevf driver. Implement the basic PCI driver loading and unloading interface. Initialize the id_table which support 1G virtual functions for Wangxun. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-10-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit bf68010acc4bc84c1fef6adb2ac76565f3c55d60 Author: Mengyuan Lou Date: Fri Jul 4 17:49:19 2025 +0800 net: txgbevf: add link update flow Add link update flow to wangxun 10/25/40G virtual functions. Get link status from pf in mbox, and if it is failed then check the vx_status, because vx_status switching is too slow. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-9-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit ce12ba254655a2dbffc103d184046213025191aa Author: Mengyuan Lou Date: Fri Jul 4 17:49:18 2025 +0800 net: txgbevf: Support Rx and Tx process path Improve the configuration of Rx and Tx ring. Setup and alloc resources. Configure Rx and Tx unit on hardware. Add .ndo_start_xmit support and start all queues. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-8-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit fd0a2e03bf6083354994c2efe2bd12e369c0c830 Author: Mengyuan Lou Date: Fri Jul 4 17:49:17 2025 +0800 net: txgbevf: init interrupts and request irqs Add irq alloc flow functions for vf. Alloc pcie msix irqs for drivers and request_irq for tx/rx rings and misc other events. If the application is successful, config vertors for interrupts. Enable interrupts mask in wxvf_irq_enable. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-7-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit 4ee8afb44aeeeaa9120007d4c420bf63ac63cbc7 Author: Mengyuan Lou Date: Fri Jul 4 17:49:16 2025 +0800 net: txgbevf: add sw init pci info and reset hardware Add sw init and reset hw for txgbevf virtual functions which initialize basic parameters, and then register netdev. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-6-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit 377d180bd71cd79f7134465d8af598ea764560da Author: Mengyuan Lou Date: Fri Jul 4 17:49:15 2025 +0800 net: wangxun: add txgbevf build Add doc build infrastructure for txgbevf driver. Implement the basic PCI driver loading and unloading interface. Initialize the id_table which support 10/25/40G virtual functions for Wangxun. Ioremap the space of bar0 and bar4 which will be used. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-5-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit eb4898fde1de8cf09f8a6b344dbd87536e0b1170 Author: Mengyuan Lou Date: Fri Jul 4 17:49:14 2025 +0800 net: libwx: add wangxun vf common api Add common wx_configure_vf and wx_set_mac_vf for ngbevf and txgbevf. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-4-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit ba3b8490bc2e4eabe5801ac180d13b58f0ecc059 Author: Mengyuan Lou Date: Fri Jul 4 17:49:13 2025 +0800 net: libwx: add base vf api for vf drivers Implement mbox_write_and_read_ack functions which are used to set basic functions like set_mac, get_link.etc for vf. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-3-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit 8259946e67037a34c0cb97885a377362b11f84c9 Author: Mengyuan Lou Date: Fri Jul 4 17:49:12 2025 +0800 net: libwx: add mailbox api for wangxun vf drivers Implements the mailbox interfaces for Wangxun vf drivers which will be used in txgbevf and ngbevf. Signed-off-by: Mengyuan Lou Link: https://patch.msgid.link/20250704094923.652-2-mengyuanlou@net-swift.com Signed-off-by: Jakub Kicinski commit 8df1b40de76979bb8e975201d07b71103d5de820 Author: Fedor Pchelkin Date: Tue Jun 24 14:12:15 2025 +0300 netfilter: nf_tables: adjust lockdep assertions handling It's needed to check the return value of lockdep_commit_lock_is_held(), otherwise there's no point in this assertion as it doesn't print any debug information on itself. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool. Fixes: b04df3da1b5c ("netfilter: nf_tables: do not defer rule destruction via call_rcu") Reported-by: Alexey Khoroshilov Signed-off-by: Fedor Pchelkin Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso commit a1050dd071682d2c9d8d6d5c96119f8f401b62f0 Author: Phil Sutter Date: Fri Jun 13 15:37:03 2025 +0200 netfilter: nf_tables: Reintroduce shortened deletion notifications Restore commit 28339b21a365 ("netfilter: nf_tables: do not send complete notification of deletions") and fix it: - Avoid upfront modification of 'event' variable so the conditionals become effective. - Always include NFTA_OBJ_TYPE attribute in object notifications, user space requires it for proper deserialisation. - Catch DESTROY events, too. Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 8080357a8c6cf4905bbd8969412c19d34be3395e Author: Phil Sutter Date: Fri Jun 13 15:37:02 2025 +0200 netfilter: nf_tables: Drop dead code from fill_*_info routines This practically reverts commit 28339b21a365 ("netfilter: nf_tables: do not send complete notification of deletions"): The feature was never effective, due to prior modification of 'event' variable the conditional early return never happened. User space also relies upon the current behaviour, so better reintroduce the shortened deletion notifications once it is fixed. Fixes: 28339b21a365 ("netfilter: nf_tables: do not send complete notification of deletions") Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso commit 6a971e48e2d8d7fb5be2a94b6f521e9bd35d0fdc Author: Inochi Amaoto Date: Thu Jul 3 10:12:19 2025 +0800 dt-bindings: net: Add support for Sophgo CV1800 dwmac The GMAC IP on CV1800 series SoC is a standard Synopsys DesignWare MAC (version 3.70a). Add necessary compatible string for this device. Signed-off-by: Inochi Amaoto Acked-by: Conor Dooley Link: https://patch.msgid.link/20250703021220.124195-1-inochiama@gmail.com Signed-off-by: Jakub Kicinski commit 437889b926b30093048eba31cd1fde00ca8df316 Author: Artem Sadovnikov Date: Tue Jun 17 15:21:09 2025 +0000 fgraph: Make pid_str size match the comment The comment above buffer mentions sign, 10 bytes width for number and null terminator, but buffer itself isn't large enough to hold that much data. This is a cosmetic change, since PID cannot be negative, other than -1. Found by Linux Verification Center (linuxtesting.org) with SVACE. Link: https://lore.kernel.org/20250617152110.2530-1-a.sadovnikov@ispras.ru Signed-off-by: Artem Sadovnikov Reviewed-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit ca296d32ece38b07113bad64e08add75073a0e2b Author: Masami Hiramatsu (Google) Date: Wed Jun 4 09:10:21 2025 +0900 tracing: ring_buffer: Rewind persistent ring buffer on reboot Rewind persistent ring buffer pages which have been read in the previous boot. Those pages are highly possible to be lost before writing it to the disk if the previous kernel crashed. In this case, the trace data is kept on the persistent ring buffer, but it can not be read because its commit size has been reset after read. This skips clearing the commit size of each sub-buffer and recover it after reboot. Note: If you read the previous boot data via trace_pipe, that is not accessible in that time. But reboot without clearing (or reusing) the read data, the read data is recovered again in the next boot. Thus, when you read the previous boot data, clear it by `echo > trace`. Cc: Mathieu Desnoyers Link: https://lore.kernel.org/174899582116.955054.773265393511190051.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt (Google) commit 8b428f42f3edfd62422aa7ad87049ab232a2eaa9 Author: Ming Lei Date: Wed Jul 9 19:17:44 2025 +0800 nbd: fix lockdep deadlock warning nbd grabs device lock nbd->config_lock for updating nr_hw_queues, this ways cause the following lock dependency: -> #2 (&disk->open_mutex){+.+.}-{4:4}: lock_acquire kernel/locking/lockdep.c:5871 [inline] lock_acquire+0x1ac/0x448 kernel/locking/lockdep.c:5828 __mutex_lock_common kernel/locking/mutex.c:602 [inline] __mutex_lock+0x166/0x1292 kernel/locking/mutex.c:747 mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:799 __del_gendisk+0x132/0xac6 block/genhd.c:706 del_gendisk+0xf6/0x19a block/genhd.c:819 nbd_dev_remove+0x3c/0xf2 drivers/block/nbd.c:268 nbd_dev_remove_work+0x1c/0x26 drivers/block/nbd.c:284 process_one_work+0x96a/0x1f32 kernel/workqueue.c:3238 process_scheduled_works kernel/workqueue.c:3321 [inline] worker_thread+0x5ce/0xde8 kernel/workqueue.c:3402 kthread+0x39c/0x7d4 kernel/kthread.c:464 ret_from_fork_kernel+0x2a/0xbb2 arch/riscv/kernel/process.c:214 ret_from_fork_kernel_asm+0x16/0x18 arch/riscv/kernel/entry.S:327 -> #1 (&set->update_nr_hwq_lock){++++}-{4:4}: lock_acquire kernel/locking/lockdep.c:5871 [inline] lock_acquire+0x1ac/0x448 kernel/locking/lockdep.c:5828 down_write+0x9c/0x19a kernel/locking/rwsem.c:1577 blk_mq_update_nr_hw_queues+0x3e/0xb86 block/blk-mq.c:5041 nbd_start_device+0x140/0xb2c drivers/block/nbd.c:1476 nbd_genl_connect+0xae0/0x1b24 drivers/block/nbd.c:2201 genl_family_rcv_msg_doit+0x206/0x2e6 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x514/0x78e net/netlink/genetlink.c:1210 netlink_rcv_skb+0x206/0x3be net/netlink/af_netlink.c:2534 genl_rcv+0x36/0x4c net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline] netlink_unicast+0x4f0/0x82c net/netlink/af_netlink.c:1339 netlink_sendmsg+0x85e/0xdd6 net/netlink/af_netlink.c:1883 sock_sendmsg_nosec net/socket.c:712 [inline] __sock_sendmsg+0xcc/0x160 net/socket.c:727 ____sys_sendmsg+0x63e/0x79c net/socket.c:2566 ___sys_sendmsg+0x144/0x1e6 net/socket.c:2620 __sys_sendmsg+0x188/0x246 net/socket.c:2652 __do_sys_sendmsg net/socket.c:2657 [inline] __se_sys_sendmsg net/socket.c:2655 [inline] __riscv_sys_sendmsg+0x70/0xa2 net/socket.c:2655 syscall_handler+0x94/0x118 arch/riscv/include/asm/syscall.h:112 do_trap_ecall_u+0x396/0x530 arch/riscv/kernel/traps.c:341 handle_exception+0x146/0x152 arch/riscv/kernel/entry.S:197 -> #0 (&nbd->config_lock){+.+.}-{4:4}: check_noncircular+0x132/0x146 kernel/locking/lockdep.c:2178 check_prev_add kernel/locking/lockdep.c:3168 [inline] check_prevs_add kernel/locking/lockdep.c:3287 [inline] validate_chain kernel/locking/lockdep.c:3911 [inline] __lock_acquire+0x12b2/0x24ea kernel/locking/lockdep.c:5240 lock_acquire kernel/locking/lockdep.c:5871 [inline] lock_acquire+0x1ac/0x448 kernel/locking/lockdep.c:5828 __mutex_lock_common kernel/locking/mutex.c:602 [inline] __mutex_lock+0x166/0x1292 kernel/locking/mutex.c:747 mutex_lock_nested+0x14/0x1c kernel/locking/mutex.c:799 refcount_dec_and_mutex_lock+0x60/0xd8 lib/refcount.c:118 nbd_config_put+0x3a/0x610 drivers/block/nbd.c:1423 nbd_release+0x94/0x15c drivers/block/nbd.c:1735 blkdev_put_whole+0xac/0xee block/bdev.c:721 bdev_release+0x3fe/0x600 block/bdev.c:1144 blkdev_release+0x1a/0x26 block/fops.c:684 __fput+0x382/0xa8c fs/file_table.c:465 ____fput+0x1c/0x26 fs/file_table.c:493 task_work_run+0x16a/0x25e kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0x118/0x134 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_trap_ecall_u+0x3f0/0x530 arch/riscv/kernel/traps.c:355 handle_exception+0x146/0x152 arch/riscv/kernel/entry.S:197 Also it isn't necessary to require nbd->config_lock, because blk_mq_update_nr_hw_queues() does grab tagset lock for sync everything. Fixes the issue by releasing ->config_lock & retry in case of concurrent updating nr_hw_queues. Fixes: 98e68f67020c ("block: prevent adding/deleting disk during updating nr_hw_queues") Reported-by: syzbot+2bcecf3c38cb3e8fdc8d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6855034f.a00a0220.137b3.0031.GAE@google.com Reviewed-by: Yu Kuai Cc: Nilay Shroff Signed-off-by: Ming Lei Reviewed-by: Nilay Shroff Link: https://lore.kernel.org/r/20250709111744.2353050-1-ming.lei@redhat.com Signed-off-by: Jens Axboe commit cdc36b66cd41d0f6e18e86d7aa50554c852f97e2 Author: Raag Jadav Date: Wed Jul 9 22:12:24 2025 +0530 drm/xe: Expose fan control and voltage regulator version Add sysfs attributes for late binding features which expose bound version to the user. v2: Rework attribute and macro naming (Badal) v3: Drop fancy formatting (Rodrigo) v4: Form version string using local variables (Rodrigo) Signed-off-by: Raag Jadav Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250709164224.2676086-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi commit 878e1e94a8aafb2f93a333a1aaed5e1c5f17e339 Author: Ricardo Neri Date: Fri Jun 20 17:30:20 2025 -0700 tracing/sched: Remove obsolete comment on suffixes Commit ac01fa73f530 ("tracepoint: Have tracepoints created with DECLARE_ TRACE() have _tp suffix") makes it unnecessary to manually add a suffix. Remove a now obsolete comment. Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Ricardo Neri Link: https://lore.kernel.org/20250620-rneri-tp-comment-fix-v1-1-e0f6495ac33c@linux.intel.com Signed-off-by: Ricardo Neri Signed-off-by: Steven Rostedt (Google) commit fac5493251a680cb74343895d0e76843624a90d8 Author: Nam Cao Date: Wed Jul 9 21:21:23 2025 +0200 rv: Allow to configure the number of per-task monitor Now that there are 2 monitors for real-time applications, users may want to enable both of them simultaneously. Make the number of per-task monitor configurable. Default it to 2 for now. Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/93e83313fc4ba7f6e66f4abe80ca5f5494d658d0.1752088709.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 670ff946b9bd398749450ad1b8a4bd4e78c82a2b Author: Nam Cao Date: Wed Jul 9 21:21:22 2025 +0200 rv: Add documentation for rtapp monitor Add documentation describing the rtapp monitor. Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/df0242d74c12511e82cc9d73c082def91a160c74.1752088709.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit f74f8bb246cf22f27752977da62079cb615f55b2 Author: Nam Cao Date: Wed Jul 9 21:21:21 2025 +0200 rv: Add rtapp_sleep monitor Add a monitor for checking that real-time tasks do not go to sleep in a manner that may cause undesirable latency. Also change RV depends on TRACING to RV select TRACING to avoid the following recursive dependency: error: recursive dependency detected! symbol TRACING is selected by PREEMPTIRQ_TRACEPOINTS symbol PREEMPTIRQ_TRACEPOINTS depends on TRACE_IRQFLAGS symbol TRACE_IRQFLAGS is selected by RV_MON_SLEEP symbol RV_MON_SLEEP depends on RV symbol RV depends on TRACING Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/75bc5bcc741d153aa279c95faf778dff35c5c8ad.1752088709.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 9162620eb604d7461da5b02ec379bb50c3c3b604 Author: Nam Cao Date: Wed Jul 9 21:21:20 2025 +0200 rv: Add rtapp_pagefault monitor Userspace real-time applications may have design flaws that they raise page faults in real-time threads, and thus have unexpected latencies. Add an linear temporal logic monitor to detect this scenario. Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/78fea8a2de6d058241d3c6502c1a92910772b0ed.1752088709.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit a37c71ca412d90365e143581582c4ecd3a90508f Author: Nam Cao Date: Wed Jul 9 21:21:19 2025 +0200 riscv: mm: Add page fault trace points Add page fault trace points, which are useful to implement RV monitor that watches page faults. Signed-off-by: Nam Cao Acked-by: Alexandre Ghiti Signed-off-by: Steven Rostedt (Google) commit 886fc86e9419a2bf61713ba566eb6edd8e6aa989 Author: Nam Cao Date: Wed Jul 9 21:21:18 2025 +0200 rv: Add rtapp container monitor Add the container "rtapp" which is the monitor collection for detecting problems with real-time applications. The monitors will be added in the follow-up commits. Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/fb18b87631d386271de00959d8d4826f23fcd1cd.1752088709.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit a9769a5b987838f03f3dd57b097794cd4c691098 Author: Nam Cao Date: Wed Jul 9 21:21:17 2025 +0200 rv: Add support for LTL monitors While attempting to implement DA monitors for some complex specifications, deterministic automaton is found to be inappropriate as the specification language. The automaton is complicated, hard to understand, and error-prone. For these cases, linear temporal logic is more suitable as the specification language. Add support for linear temporal logic runtime verification monitor. Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Gabriele Monaco Link: https://lore.kernel.org/d366c1fed60ed4e8f6451f3c15a99755f2740b5f.1752088709.git.namcao@linutronix.de Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit c94d27c01b1ff2e26ca347524b3527534e285a39 Author: Nam Cao Date: Wed Jul 9 21:21:16 2025 +0200 rv: rename CONFIG_DA_MON_EVENTS to CONFIG_RV_MON_EVENTS CONFIG_DA_MON_EVENTS is not specific to deterministic automaton. It could be used for other monitor types. Therefore rename it to CONFIG_RV_MON_EVENTS. This prepares for the introduction of linear temporal logic monitor. Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/507210517123d887c1d208aa2fd45ec69765d3f0.1752088709.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit ff4e233d8ab70fe6ae460ecc8c0e5b24dd0fedb0 Author: Nam Cao Date: Wed Jul 9 21:21:15 2025 +0200 rv: Let the reactors take care of buffers Each RV monitor has one static buffer to send to the reactors. If multiple errors are detected simultaneously, the one buffer could be overwritten. Instead, leave it to the reactors to handle buffering. Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 3f045de7f557850ca6b3632c6d45c2cdaf948694 Author: Nam Cao Date: Wed Jul 9 21:21:14 2025 +0200 panic: Add vpanic() vpanic() is useful for implementing runtime verification reactors. Add it. Signed-off-by: Nam Cao Reviewed-by: Petr Mladek Signed-off-by: Steven Rostedt (Google) commit 0af3ecdde58676f6c42eeec07d6816d5bf87ff88 Author: Nam Cao Date: Wed Jul 9 21:21:13 2025 +0200 printk: Make vprintk_deferred() public vprintk_deferred() is useful for implementing runtime verification reactors. Make it public. Signed-off-by: Nam Cao Reviewed-by: Petr Mladek Signed-off-by: Steven Rostedt (Google) commit 2d088762631b212eb0809e112642843844ef64eb Author: Nam Cao Date: Wed Jul 9 21:21:12 2025 +0200 rv: Add #undef TRACE_INCLUDE_FILE Without "#undef TRACE_INCLUDE_FILE", there could be a build error due to TRACE_INCLUDE_FILE being redefined. Therefore add it. Also fix a typo while at it. Cc: John Ogness Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/f805e074581e927bb176c742c981fa7675b6ebe5.1752088709.git.namcao@linutronix.de Reviewed-by: Gabriele Monaco Signed-off-by: Nam Cao Signed-off-by: Steven Rostedt (Google) commit 93a7aedc4cc4476da54ea45f3ed5308aabafef75 Author: Lad Prabhakar Date: Tue Jun 24 18:16:05 2025 +0100 dt-bindings: memory: renesas,rzg3e-xspi: Document RZ/V2H(P) and RZ/V2N support Document support for the Expanded Serial Peripheral Interface (xSPI) controller found on the Renesas RZ/V2H(P) (R9A09G057) and RZ/V2N (R9A09G056) SoCs. The xSPI hardware block on these SoCs is functionally identical to the one on the RZ/G3E (R9A09G047) SoC. Therefore, the existing driver can be reused without modification by using `renesas,r9a09g047-xspi` as a fallback compatible. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250624171605.469724-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Krzysztof Kozlowski commit 75bb2ddea9640b663e4b2eaa06e15196f6f11a95 Author: Andreas Gruenbacher Date: Tue Jul 8 21:21:27 2025 +0200 gfs2: Minor do_xmote cancelation fix Commit 6cb3b1c2df87 changed how finish_xmote() clears the GLF_LOCK flag, but it failed to adjust the equivalent code in do_xmote(). Fix that. Fixes: 6cb3b1c2df87 ("gfs2: Fix additional unlikely request cancelation race") Signed-off-by: Andreas Gruenbacher commit c1cfc87e49525853ebe9dce2ffce6332eb811fa6 Author: Chao Yu Date: Mon Jul 7 19:46:14 2025 +0800 f2fs: introduce is_cur{seg,sec}() There are redundant codes in IS_CUR{SEG,SEC}() macros, let's introduce inline is_cur{seg,sec}() functions, and use a loop in it for cleanup. Meanwhile, it enhances expansibility, as it doesn't need to change is_cur{seg,sec}() when we add a new log header. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit a509a55f8eecc8970b3980c6f06886bbff0e2f68 Author: Chao Yu Date: Tue Jul 8 17:56:57 2025 +0800 f2fs: fix to avoid panic in f2fs_evict_inode As syzbot [1] reported as below: R10: 0000000000000100 R11: 0000000000000206 R12: 00007ffe17473450 R13: 00007f28b1c10854 R14: 000000000000dae5 R15: 00007ffe17474520 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 Read of size 8 at addr ffff88812d962278 by task syz-executor/564 CPU: 1 PID: 564 Comm: syz-executor Tainted: G W 6.1.129-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0xee/0x158 lib/dump_stack.c:106 print_address_description+0x71/0x210 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:427 kasan_report+0x122/0x150 mm/kasan/report.c:531 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:351 __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 __list_del_entry include/linux/list.h:134 [inline] list_del_init include/linux/list.h:206 [inline] f2fs_inode_synced+0xf7/0x2e0 fs/f2fs/super.c:1531 f2fs_update_inode+0x74/0x1c40 fs/f2fs/inode.c:585 f2fs_update_inode_page+0x137/0x170 fs/f2fs/inode.c:703 f2fs_write_inode+0x4ec/0x770 fs/f2fs/inode.c:731 write_inode fs/fs-writeback.c:1460 [inline] __writeback_single_inode+0x4a0/0xab0 fs/fs-writeback.c:1677 writeback_single_inode+0x221/0x8b0 fs/fs-writeback.c:1733 sync_inode_metadata+0xb6/0x110 fs/fs-writeback.c:2789 f2fs_sync_inode_meta+0x16d/0x2a0 fs/f2fs/checkpoint.c:1159 block_operations fs/f2fs/checkpoint.c:1269 [inline] f2fs_write_checkpoint+0xca3/0x2100 fs/f2fs/checkpoint.c:1658 kill_f2fs_super+0x231/0x390 fs/f2fs/super.c:4668 deactivate_locked_super+0x98/0x100 fs/super.c:332 deactivate_super+0xaf/0xe0 fs/super.c:363 cleanup_mnt+0x45f/0x4e0 fs/namespace.c:1186 __cleanup_mnt+0x19/0x20 fs/namespace.c:1193 task_work_run+0x1c6/0x230 kernel/task_work.c:203 exit_task_work include/linux/task_work.h:39 [inline] do_exit+0x9fb/0x2410 kernel/exit.c:871 do_group_exit+0x210/0x2d0 kernel/exit.c:1021 __do_sys_exit_group kernel/exit.c:1032 [inline] __se_sys_exit_group kernel/exit.c:1030 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1030 x64_sys_call+0x7b4/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f28b1b8e169 Code: Unable to access opcode bytes at 0x7f28b1b8e13f. RSP: 002b:00007ffe174710a8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f28b1c10879 RCX: 00007f28b1b8e169 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000002 R08: 00007ffe1746ee47 R09: 00007ffe17472360 R10: 0000000000000009 R11: 0000000000000246 R12: 00007ffe17472360 R13: 00007f28b1c10854 R14: 000000000000dae5 R15: 00007ffe17474520 Allocated by task 569: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_alloc_info+0x25/0x30 mm/kasan/generic.c:505 __kasan_slab_alloc+0x72/0x80 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x4f/0x2c0 mm/slab.h:737 slab_alloc_node mm/slub.c:3398 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc_lru+0x104/0x220 mm/slub.c:3429 alloc_inode_sb include/linux/fs.h:3245 [inline] f2fs_alloc_inode+0x2d/0x340 fs/f2fs/super.c:1419 alloc_inode fs/inode.c:261 [inline] iget_locked+0x186/0x880 fs/inode.c:1373 f2fs_iget+0x55/0x4c60 fs/f2fs/inode.c:483 f2fs_lookup+0x366/0xab0 fs/f2fs/namei.c:487 __lookup_slow+0x2a3/0x3d0 fs/namei.c:1690 lookup_slow+0x57/0x70 fs/namei.c:1707 walk_component+0x2e6/0x410 fs/namei.c:1998 lookup_last fs/namei.c:2455 [inline] path_lookupat+0x180/0x490 fs/namei.c:2479 filename_lookup+0x1f0/0x500 fs/namei.c:2508 vfs_statx+0x10b/0x660 fs/stat.c:229 vfs_fstatat fs/stat.c:267 [inline] vfs_lstat include/linux/fs.h:3424 [inline] __do_sys_newlstat fs/stat.c:423 [inline] __se_sys_newlstat+0xd5/0x350 fs/stat.c:417 __x64_sys_newlstat+0x5b/0x70 fs/stat.c:417 x64_sys_call+0x393/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:7 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 13: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x31/0x50 mm/kasan/generic.c:516 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:236 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1750 slab_free mm/slub.c:3661 [inline] kmem_cache_free+0x12d/0x2a0 mm/slub.c:3683 f2fs_free_inode+0x24/0x30 fs/f2fs/super.c:1562 i_callback+0x4c/0x70 fs/inode.c:250 rcu_do_batch+0x503/0xb80 kernel/rcu/tree.c:2297 rcu_core+0x5a2/0xe70 kernel/rcu/tree.c:2557 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2574 handle_softirqs+0x178/0x500 kernel/softirq.c:578 run_ksoftirqd+0x28/0x30 kernel/softirq.c:945 smpboot_thread_fn+0x45a/0x8c0 kernel/smpboot.c:164 kthread+0x270/0x310 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Last potentially related work creation: kasan_save_stack+0x3a/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xb6/0xc0 mm/kasan/generic.c:486 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496 call_rcu+0xd4/0xf70 kernel/rcu/tree.c:2845 destroy_inode fs/inode.c:316 [inline] evict+0x7da/0x870 fs/inode.c:720 iput_final fs/inode.c:1834 [inline] iput+0x62b/0x830 fs/inode.c:1860 do_unlinkat+0x356/0x540 fs/namei.c:4397 __do_sys_unlink fs/namei.c:4438 [inline] __se_sys_unlink fs/namei.c:4436 [inline] __x64_sys_unlink+0x49/0x50 fs/namei.c:4436 x64_sys_call+0x958/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:88 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff88812d961f20 which belongs to the cache f2fs_inode_cache of size 1200 The buggy address is located 856 bytes inside of 1200-byte region [ffff88812d961f20, ffff88812d9623d0) The buggy address belongs to the physical page: page:ffffea0004b65800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12d960 head:ffffea0004b65800 order:2 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff88810a94c500 raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Reclaimable, gfp_mask 0x1d2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 569, tgid 568 (syz.2.16), ts 55943246141, free_ts 0 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1d0/0x1f0 mm/page_alloc.c:2532 prep_new_page mm/page_alloc.c:2539 [inline] get_page_from_freelist+0x2e63/0x2ef0 mm/page_alloc.c:4328 __alloc_pages+0x235/0x4b0 mm/page_alloc.c:5605 alloc_slab_page include/linux/gfp.h:-1 [inline] allocate_slab mm/slub.c:1939 [inline] new_slab+0xec/0x4b0 mm/slub.c:1992 ___slab_alloc+0x6f6/0xb50 mm/slub.c:3180 __slab_alloc+0x5e/0xa0 mm/slub.c:3279 slab_alloc_node mm/slub.c:3364 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc_lru+0x13f/0x220 mm/slub.c:3429 alloc_inode_sb include/linux/fs.h:3245 [inline] f2fs_alloc_inode+0x2d/0x340 fs/f2fs/super.c:1419 alloc_inode fs/inode.c:261 [inline] iget_locked+0x186/0x880 fs/inode.c:1373 f2fs_iget+0x55/0x4c60 fs/f2fs/inode.c:483 f2fs_fill_super+0x3ad7/0x6bb0 fs/f2fs/super.c:4293 mount_bdev+0x2ae/0x3e0 fs/super.c:1443 f2fs_mount+0x34/0x40 fs/f2fs/super.c:4642 legacy_get_tree+0xea/0x190 fs/fs_context.c:632 vfs_get_tree+0x89/0x260 fs/super.c:1573 do_new_mount+0x25a/0xa20 fs/namespace.c:3056 page_owner free stack trace missing Memory state around the buggy address: ffff88812d962100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812d962180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88812d962200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88812d962280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88812d962300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== [1] https://syzkaller.appspot.com/x/report.txt?x=13448368580000 This bug can be reproduced w/ the reproducer [2], once we enable CONFIG_F2FS_CHECK_FS config, the reproducer will trigger panic as below, so the direct reason of this bug is the same as the one below patch [3] fixed. kernel BUG at fs/f2fs/inode.c:857! RIP: 0010:f2fs_evict_inode+0x1204/0x1a20 Call Trace: evict+0x32a/0x7a0 do_unlinkat+0x37b/0x5b0 __x64_sys_unlink+0xad/0x100 do_syscall_64+0x5a/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0010:f2fs_evict_inode+0x1204/0x1a20 [2] https://syzkaller.appspot.com/x/repro.c?x=17495ccc580000 [3] https://lore.kernel.org/linux-f2fs-devel/20250702120321.1080759-1-chao@kernel.org Tracepoints before panic: f2fs_unlink_enter: dev = (7,0), dir ino = 3, i_size = 4096, i_blocks = 8, name = file1 f2fs_unlink_exit: dev = (7,0), ino = 7, ret = 0 f2fs_evict_inode: dev = (7,0), ino = 7, pino = 3, i_mode = 0x81ed, i_size = 10, i_nlink = 0, i_blocks = 0, i_advise = 0x0 f2fs_truncate_node: dev = (7,0), ino = 7, nid = 8, block_address = 0x3c05 f2fs_unlink_enter: dev = (7,0), dir ino = 3, i_size = 4096, i_blocks = 8, name = file3 f2fs_unlink_exit: dev = (7,0), ino = 8, ret = 0 f2fs_evict_inode: dev = (7,0), ino = 8, pino = 3, i_mode = 0x81ed, i_size = 9000, i_nlink = 0, i_blocks = 24, i_advise = 0x4 f2fs_truncate: dev = (7,0), ino = 8, pino = 3, i_mode = 0x81ed, i_size = 0, i_nlink = 0, i_blocks = 24, i_advise = 0x4 f2fs_truncate_blocks_enter: dev = (7,0), ino = 8, i_size = 0, i_blocks = 24, start file offset = 0 f2fs_truncate_blocks_exit: dev = (7,0), ino = 8, ret = -2 The root cause is: in the fuzzed image, dnode #8 belongs to inode #7, after inode #7 eviction, dnode #8 was dropped. However there is dirent that has ino #8, so, once we unlink file3, in f2fs_evict_inode(), both f2fs_truncate() and f2fs_update_inode_page() will fail due to we can not load node #8, result in we missed to call f2fs_inode_synced() to clear inode dirty status. Let's fix this by calling f2fs_inode_synced() in error path of f2fs_evict_inode(). PS: As I verified, the reproducer [2] can trigger this bug in v6.1.129, but it failed in v6.16-rc4, this is because the testcase will stop due to other corruption has been detected by f2fs: F2FS-fs (loop0): inconsistent node block, node_type:2, nid:8, node_footer[nid:8,ino:8,ofs:0,cpver:5013063228981249506,blkaddr:15366] F2FS-fs (loop0): f2fs_lookup: inode (ino=9) has zero i_nlink Fixes: 0f18b462b2e5 ("f2fs: flush inode metadata when checkpoint is doing") Closes: https://syzkaller.appspot.com/x/report.txt?x=13448368580000 Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7c30d79930132466f5be7d0b57add14d1a016bda Author: Chao Yu Date: Tue Jul 8 17:53:39 2025 +0800 f2fs: fix to avoid UAF in f2fs_sync_inode_meta() syzbot reported an UAF issue as below: [1] [2] [1] https://syzkaller.appspot.com/text?tag=CrashReport&x=16594c60580000 ================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 Read of size 8 at addr ffff888100567dc8 by task kworker/u4:0/8 CPU: 1 PID: 8 Comm: kworker/u4:0 Tainted: G W 6.1.129-syzkaller-00017-g642656a36791 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:316 [inline] print_report+0x158/0x4e0 mm/kasan/report.c:427 kasan_report+0x13c/0x170 mm/kasan/report.c:531 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:351 __list_del_entry_valid+0xa6/0x130 lib/list_debug.c:62 __list_del_entry include/linux/list.h:134 [inline] list_del_init include/linux/list.h:206 [inline] f2fs_inode_synced+0x100/0x2e0 fs/f2fs/super.c:1553 f2fs_update_inode+0x72/0x1c40 fs/f2fs/inode.c:588 f2fs_update_inode_page+0x135/0x170 fs/f2fs/inode.c:706 f2fs_write_inode+0x416/0x790 fs/f2fs/inode.c:734 write_inode fs/fs-writeback.c:1460 [inline] __writeback_single_inode+0x4cf/0xb80 fs/fs-writeback.c:1677 writeback_sb_inodes+0xb32/0x1910 fs/fs-writeback.c:1903 __writeback_inodes_wb+0x118/0x3f0 fs/fs-writeback.c:1974 wb_writeback+0x3da/0xa00 fs/fs-writeback.c:2081 wb_check_background_flush fs/fs-writeback.c:2151 [inline] wb_do_writeback fs/fs-writeback.c:2239 [inline] wb_workfn+0xbba/0x1030 fs/fs-writeback.c:2266 process_one_work+0x73d/0xcb0 kernel/workqueue.c:2299 worker_thread+0xa60/0x1260 kernel/workqueue.c:2446 kthread+0x26d/0x300 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Allocated by task 298: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:333 kasan_slab_alloc include/linux/kasan.h:202 [inline] slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:768 slab_alloc_node mm/slub.c:3421 [inline] slab_alloc mm/slub.c:3431 [inline] __kmem_cache_alloc_lru mm/slub.c:3438 [inline] kmem_cache_alloc_lru+0x102/0x270 mm/slub.c:3454 alloc_inode_sb include/linux/fs.h:3255 [inline] f2fs_alloc_inode+0x2d/0x350 fs/f2fs/super.c:1437 alloc_inode fs/inode.c:261 [inline] iget_locked+0x18c/0x7e0 fs/inode.c:1373 f2fs_iget+0x55/0x4ca0 fs/f2fs/inode.c:486 f2fs_lookup+0x3c1/0xb50 fs/f2fs/namei.c:484 __lookup_slow+0x2b9/0x3e0 fs/namei.c:1689 lookup_slow+0x5a/0x80 fs/namei.c:1706 walk_component+0x2e7/0x410 fs/namei.c:1997 lookup_last fs/namei.c:2454 [inline] path_lookupat+0x16d/0x450 fs/namei.c:2478 filename_lookup+0x251/0x600 fs/namei.c:2507 vfs_statx+0x107/0x4b0 fs/stat.c:229 vfs_fstatat fs/stat.c:267 [inline] vfs_lstat include/linux/fs.h:3434 [inline] __do_sys_newlstat fs/stat.c:423 [inline] __se_sys_newlstat+0xda/0x7c0 fs/stat.c:417 __x64_sys_newlstat+0x5b/0x70 fs/stat.c:417 x64_sys_call+0x52/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:7 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 0: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x131/0x180 mm/kasan/common.c:241 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:249 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1745 [inline] slab_free_freelist_hook mm/slub.c:1771 [inline] slab_free mm/slub.c:3686 [inline] kmem_cache_free+0x291/0x560 mm/slub.c:3711 f2fs_free_inode+0x24/0x30 fs/f2fs/super.c:1584 i_callback+0x4b/0x70 fs/inode.c:250 rcu_do_batch+0x552/0xbe0 kernel/rcu/tree.c:2297 rcu_core+0x502/0xf40 kernel/rcu/tree.c:2557 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2574 handle_softirqs+0x1db/0x650 kernel/softirq.c:624 __do_softirq kernel/softirq.c:662 [inline] invoke_softirq kernel/softirq.c:479 [inline] __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:711 irq_exit_rcu+0x9/0x10 kernel/softirq.c:723 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline] sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1118 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:691 Last potentially related work creation: kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45 __kasan_record_aux_stack+0xb4/0xc0 mm/kasan/generic.c:486 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496 __call_rcu_common kernel/rcu/tree.c:2807 [inline] call_rcu+0xdc/0x10f0 kernel/rcu/tree.c:2926 destroy_inode fs/inode.c:316 [inline] evict+0x87d/0x930 fs/inode.c:720 iput_final fs/inode.c:1834 [inline] iput+0x616/0x690 fs/inode.c:1860 do_unlinkat+0x4e1/0x920 fs/namei.c:4396 __do_sys_unlink fs/namei.c:4437 [inline] __se_sys_unlink fs/namei.c:4435 [inline] __x64_sys_unlink+0x49/0x50 fs/namei.c:4435 x64_sys_call+0x289/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:88 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x3b/0x80 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff888100567a10 which belongs to the cache f2fs_inode_cache of size 1360 The buggy address is located 952 bytes inside of 1360-byte region [ffff888100567a10, ffff888100567f60) The buggy address belongs to the physical page: page:ffffea0004015800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x100560 head:ffffea0004015800 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head|zone=1) raw: 4000000000010200 0000000000000000 dead000000000122 ffff8881002c4d80 raw: 0000000000000000 0000000080160016 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Reclaimable, gfp_mask 0xd2050(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_RECLAIMABLE), pid 298, tgid 298 (syz-executor330), ts 26489303743, free_ts 0 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x213/0x220 mm/page_alloc.c:2637 prep_new_page+0x1b/0x110 mm/page_alloc.c:2644 get_page_from_freelist+0x3a98/0x3b10 mm/page_alloc.c:4539 __alloc_pages+0x234/0x610 mm/page_alloc.c:5837 alloc_slab_page+0x6c/0xf0 include/linux/gfp.h:-1 allocate_slab mm/slub.c:1962 [inline] new_slab+0x90/0x3e0 mm/slub.c:2015 ___slab_alloc+0x6f9/0xb80 mm/slub.c:3203 __slab_alloc+0x5d/0xa0 mm/slub.c:3302 slab_alloc_node mm/slub.c:3387 [inline] slab_alloc mm/slub.c:3431 [inline] __kmem_cache_alloc_lru mm/slub.c:3438 [inline] kmem_cache_alloc_lru+0x149/0x270 mm/slub.c:3454 alloc_inode_sb include/linux/fs.h:3255 [inline] f2fs_alloc_inode+0x2d/0x350 fs/f2fs/super.c:1437 alloc_inode fs/inode.c:261 [inline] iget_locked+0x18c/0x7e0 fs/inode.c:1373 f2fs_iget+0x55/0x4ca0 fs/f2fs/inode.c:486 f2fs_fill_super+0x5360/0x6dc0 fs/f2fs/super.c:4488 mount_bdev+0x282/0x3b0 fs/super.c:1445 f2fs_mount+0x34/0x40 fs/f2fs/super.c:4743 legacy_get_tree+0xf1/0x190 fs/fs_context.c:632 page_owner free stack trace missing Memory state around the buggy address: ffff888100567c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888100567d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888100567d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888100567e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888100567e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== [2] https://syzkaller.appspot.com/text?tag=CrashLog&x=13654c60580000 [ 24.675720][ T28] audit: type=1400 audit(1745327318.732:72): avc: denied { write } for pid=298 comm="syz-executor399" name="/" dev="loop0" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 24.705426][ T296] ------------[ cut here ]------------ [ 24.706608][ T28] audit: type=1400 audit(1745327318.732:73): avc: denied { remove_name } for pid=298 comm="syz-executor399" name="file0" dev="loop0" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 24.711550][ T296] WARNING: CPU: 0 PID: 296 at fs/f2fs/inode.c:847 f2fs_evict_inode+0x1262/0x1540 [ 24.734141][ T28] audit: type=1400 audit(1745327318.732:74): avc: denied { rename } for pid=298 comm="syz-executor399" name="file0" dev="loop0" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 24.742969][ T296] Modules linked in: [ 24.765201][ T28] audit: type=1400 audit(1745327318.732:75): avc: denied { add_name } for pid=298 comm="syz-executor399" name="bus" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 24.768847][ T296] CPU: 0 PID: 296 Comm: syz-executor399 Not tainted 6.1.129-syzkaller-00017-g642656a36791 #0 [ 24.799506][ T296] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 [ 24.809401][ T296] RIP: 0010:f2fs_evict_inode+0x1262/0x1540 [ 24.815018][ T296] Code: 34 70 4a ff eb 0d e8 2d 70 4a ff 4d 89 e5 4c 8b 64 24 18 48 8b 5c 24 28 4c 89 e7 e8 78 38 03 00 e9 84 fc ff ff e8 0e 70 4a ff <0f> 0b 4c 89 f7 be 08 00 00 00 e8 7f 21 92 ff f0 41 80 0e 04 e9 61 [ 24.834584][ T296] RSP: 0018:ffffc90000db7a40 EFLAGS: 00010293 [ 24.840465][ T296] RAX: ffffffff822aca42 RBX: 0000000000000002 RCX: ffff888110948000 [ 24.848291][ T296] RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 [ 24.856064][ T296] RBP: ffffc90000db7bb0 R08: ffffffff822ac6a8 R09: ffffed10200b005d [ 24.864073][ T296] R10: 0000000000000000 R11: dffffc0000000001 R12: ffff888100580000 [ 24.871812][ T296] R13: dffffc0000000000 R14: ffff88810fef4078 R15: 1ffff920001b6f5c The root cause is w/ a fuzzed image, f2fs may missed to clear FI_DIRTY_INODE flag for target inode, after f2fs_evict_inode(), the inode is still linked in sbi->inode_list[DIRTY_META] global list, once it triggers checkpoint, f2fs_sync_inode_meta() may access the released inode. In f2fs_evict_inode(), let's always call f2fs_inode_synced() to clear FI_DIRTY_INODE flag and drop inode from global dirty list to avoid this UAF issue. Fixes: 0f18b462b2e5 ("f2fs: flush inode metadata when checkpoint is doing") Closes: https://syzkaller.appspot.com/bug?extid=849174b2efaf0d8be6ba Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 81b6ecca2f15922e8d653dc037df5871e754be6e Author: Chao Yu Date: Wed Jul 2 14:49:25 2025 +0800 f2fs: doc: fix wrong quota mount option description We should use "{usr,grp,prj}jquota=" to disable journaled quota, rather than using off{usr,grp,prj}jquota. Fixes: 4b2414d04e99 ("f2fs: support journalled quota") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e9705c61b1dbe7bac9dc189de434994d8a76b191 Author: Jiazi Li Date: Thu Jul 3 14:13:04 2025 +0800 f2fs: use kfree() instead of kvfree() to free some memory options in f2fs_fill_super is alloc by kstrdup: options = kstrdup((const char *)data, GFP_KERNEL) sit_bitmap[_mir], nat_bitmap[_mir] are alloc by kmemdup: sit_i->sit_bitmap = kmemdup(src_bitmap, sit_bitmap_size, GFP_KERNEL); sit_i->sit_bitmap_mir = kmemdup(src_bitmap, sit_bitmap_size, GFP_KERNEL); nm_i->nat_bitmap = kmemdup(version_bitmap, nm_i->bitmap_size, GFP_KERNEL); nm_i->nat_bitmap_mir = kmemdup(version_bitmap, nm_i->bitmap_size, GFP_KERNEL); write_io is alloc by f2fs_kmalloc: sbi->write_io[i] = f2fs_kmalloc(sbi, array_size(n, sizeof(struct f2fs_bio_info)) Use kfree is more efficient. Signed-off-by: Jiazi Li Signed-off-by: peixuan.qiu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 2c6e2cb9e7228181e93ae8957f403affd8abf0e2 Author: Andreas Gruenbacher Date: Fri May 23 23:23:12 2025 +0200 gfs2: Remove GIF_ALLOC_FAILED flag Get rid of the GIF_ALLOC_FAILED flag; we can now be confident that the additional consistency check isn't needed. Signed-off-by: Andreas Gruenbacher commit 00983d248c005f98535a5d6423fab414d640c112 Author: Andreas Gruenbacher Date: Thu Apr 24 17:33:53 2025 +0200 gfs2: Use SECTOR_SIZE and SECTOR_SHIFT Use the SECTOR_SIZE and SECTOR_SHIFT constants where appropriate instead of hardcoding their values. Reported-by: Damien Le Moal Signed-off-by: Andreas Gruenbacher commit 88172700423c27c0123fdb05b8c4a62444cfcba2 Author: Håkon Bugge Date: Fri Jun 27 12:50:33 2025 +0200 docs/memory-barriers.txt: Add wait_event_cmd() and wait_event_exclusive_cmd() Add said functions to Documentation/memory-barriers.txt. Signed-off-by: Håkon Bugge -- v1 -> v2: * Changed the prosaic part to kernel-doc style and moved it to include/linux/wait.h in another commit Signed-off-by: Paul E. McKenney commit f9e4e0a663d239f944649c5201879c7471615dd0 Author: Oliver Upton Date: Tue Jul 8 16:06:32 2025 -0700 KVM: arm64: selftests: Test ESR propagation for vSError injection Ensure that vSErrors taken in the guest have an appropriate ESR_ELx value for the expected exception. Additionally, switch the EASE test to install the SEA handler at the SError offset, as the ESR is still expected to match an SEA in that case. Link: https://lore.kernel.org/r/20250708230632.1954240-3-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit f6e2262dfa1a01b981dc394be39bd022e9ecaebd Author: Oliver Upton Date: Tue Jul 8 16:06:31 2025 -0700 KVM: arm64: Populate ESR_ELx.EC for emulated SError injection The hardware vSError injection mechanism populates ESR_ELx.EC as part of ESR propagation and the contents of VSESR_EL2 populate the ISS field. Of course, this means our emulated injection needs to set up the EC correctly for an SError too. Fixes: ce66109cec86 ("KVM: arm64: nv: Take "masked" aborts to EL2 when HCRX_EL2.TMEA is set") Link: https://lore.kernel.org/r/20250708230632.1954240-2-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 95826e1ed3592cb81262c7e533ddea60751095c9 Author: Sean Christopherson Date: Wed Jun 25 17:12:25 2025 -0700 KVM: selftests: Convert arch_timer tests to common helpers to pin task Convert the arch timer tests to use __pin_task_to_cpu() and pin_self_to_cpu(). No functional change intended. Link: https://lore.kernel.org/r/20250626001225.744268-6-seanjc@google.com Signed-off-by: Sean Christopherson commit df98ce784aebdf4b1448ec2abfbbcd8f48b2e295 Author: Jim Mattson Date: Wed Jun 25 17:12:24 2025 -0700 KVM: selftests: Test behavior of KVM_X86_DISABLE_EXITS_APERFMPERF For a VCPU thread pinned to a single LPU, verify that interleaved host and guest reads of IA32_[AM]PERF return strictly increasing values when APERFMPERF exiting is disabled. Run the test in both L1 and L2 to verify that KVM passes through the APERF and MPERF MSRs when L1 doesn't want to intercept them (or any MSRs). Signed-off-by: Jim Mattson Link: https://lore.kernel.org/r/20250530185239.2335185-4-jmattson@google.com Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250626001225.744268-5-seanjc@google.com Signed-off-by: Sean Christopherson commit e83ee6f76c33de80d5fe4cec523e2b95bfc5e3ea Author: Sean Christopherson Date: Wed Jun 25 17:12:23 2025 -0700 KVM: selftests: Expand set of APIs for pinning tasks to a single CPU Expand kvm_pin_this_task_to_pcpu() into a set of APIs to allow pinning a task (or self) to a CPU (any or specific). This will allow deduplicating code throughout a variety of selftests. Opportunistically use "self" instead of "this_task" as it is both more concise and less ambiguous. Link: https://lore.kernel.org/r/20250626001225.744268-4-seanjc@google.com Signed-off-by: Sean Christopherson commit a7cec20845a67ff4f3c924255519341f37d993f9 Author: Jim Mattson Date: Wed Jun 25 17:12:22 2025 -0700 KVM: x86: Provide a capability to disable APERF/MPERF read intercepts Allow a guest to read the physical IA32_APERF and IA32_MPERF MSRs without interception. The IA32_APERF and IA32_MPERF MSRs are not virtualized. Writes are not handled at all. The MSR values are not zeroed on vCPU creation, saved on suspend, or restored on resume. No accommodation is made for processor migration or for sharing a logical processor with other tasks. No adjustments are made for non-unit TSC multipliers. The MSRs do not account for time the same way as the comparable PMU events, whether the PMU is virtualized by the traditional emulation method or the new mediated pass-through approach. Nonetheless, in a properly constrained environment, this capability can be combined with a guest CPUID table that advertises support for CPUID.6:ECX.APERFMPERF[bit 0] to induce a Linux guest to report the effective physical CPU frequency in /proc/cpuinfo. Moreover, there is no performance cost for this capability. Signed-off-by: Jim Mattson Link: https://lore.kernel.org/r/20250530185239.2335185-3-jmattson@google.com Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250626001225.744268-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 6fbef8615d3588450045f014c6015d0beeff6cf2 Author: Jim Mattson Date: Wed Jun 25 17:12:21 2025 -0700 KVM: x86: Replace growing set of *_in_guest bools with a u64 Store each "disabled exit" boolean in a single bit rather than a byte. No functional change intended. Suggested-by: Sean Christopherson Signed-off-by: Jim Mattson Link: https://lore.kernel.org/r/20250530185239.2335185-2-jmattson@google.com Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250626001225.744268-2-seanjc@google.com Signed-off-by: Sean Christopherson commit e88cfd50b60602c1084bf989c2503abac5b99fd6 Author: Xin Li Date: Thu Jun 26 10:35:21 2025 -0700 KVM: x86: Advertise support for LKGS Advertise support for LKGS (load into IA32_KERNEL_GS_BASE) to userspace if the instruction is supported by the underlying CPU. LKGS is introduced with FRED to completely eliminate the need to swapgs explicilty. It behaves like the MOV to GS instruction except that it loads the base address into the IA32_KERNEL_GS_BASE MSR instead of the GS segment’s descriptor cache, which is exactly what Linux kernel does to load a user level GS base. Thus there is no need to SWAPGS away from the kernel GS base. LKGS is an independent CPU feature that works correctly in a KVM guest without requiring explicit enablement. Signed-off-by: Xin Li (Intel) Link: https://lore.kernel.org/r/20250626173521.2301088-1-xin@zytor.com Signed-off-by: Sean Christopherson commit e1ef1c57ff70751a62b93d513e7009155ea0b0c1 Author: Sean Christopherson Date: Thu Jun 26 09:14:20 2025 -0700 KVM: VMX: Add a macro to track which DEBUGCTL bits are host-owned Add VMX_HOST_OWNED_DEBUGCTL_BITS to track which bits are host-owned, i.e. need to be preserved when running the guest, to dedup the logic without having to incur a memory load to get at kvm_x86_ops.HOST_OWNED_DEBUGCTL. No functional change intended. Suggested-by: Maxim Levitsky Reviewed-by: Maxim Levitsky Link: https://lore.kernel.org/all/aF1yni8U6XNkyfRf@google.com Signed-off-by: Sean Christopherson commit 750aef513c610a37a13732ec64902428b839715e Author: Benjamin Berg Date: Wed Jul 9 17:55:10 2025 +0200 selftests/nolibc: show failed run if test process crashes The logic would not catch if the test process crashes and would incorrectly report a "success" state. Fix this by looking for the final "Total number of errors:" message and printing "failure" if it was not seen. Signed-off-by: Benjamin Berg Link: https://lore.kernel.org/r/20250709155512.971080-2-benjamin@sipsolutions.net [Thomas: fix patch prefix] Signed-off-by: Thomas Weißschuh commit a12a23720c135a299ed914adf623387c7404e014 Author: Thomas Richter Date: Wed Jul 9 09:24:52 2025 +0200 perf list: Remove trailing A in PAI crypto event 4210 According to the z16 and z17 Principle of Operation documents SA22-7832-13 and SA22-7832-14 the event 4210 is named PCC_COMPUTE_LAST_BLOCK_CMAC_USING_ENCRYPTED_AES_256 without a trailing 'A'. Adjust the json definition files for this event and remove the trailing 'A' character. PCC_COMPUTE_LAST_BLOCK_CMAC_USING_ENCRYPTED_AES_256A Also remove a black ' ' between the dash '-' and the number: xxx-AES- 192 ----> xxx-AES-192 Suggested-by: Ingo Franzki Signed-off-by: Thomas Richter Reviewed-by: Ian Rogers Acked-by: Sumanth Korikkar Link: https://lore.kernel.org/r/20250709072452.1595257-1-tmricht@linux.ibm.com Signed-off-by: Namhyung Kim commit fde494e9058dce6240bc746657f005c3aa51e2e8 Merge: 98b5dab4d22181 8e786a85c0a3c0 Author: Borislav Petkov (AMD) Date: Wed Jul 9 18:16:53 2025 +0200 Merge tag 'tsa_x86_bugs_for_6.16' into tip-x86-bugs Pick up TSA changes from mainline so that attack vectors work can continue ontop. Signed-off-by: Borislav Petkov (AMD) commit bd4d5d3faadcdf5d65377f14dcbaa4dbb27ee637 Author: Yixun Lan Date: Tue Jul 8 09:44:56 2025 +0800 riscv: defconfig: spacemit: enable sdhci driver for K1 SoC Enable sdhci driver support for SpacemiT K1 SoC, so eMMC storage will be probed and activated, Tested on the Banana Pi BPI-F3 board. Signed-off-by: Yixun Lan Signed-off-by: Conor Dooley commit 9615e017464dfbe72e12e36592b7c5b65e9203fd Author: Krzysztof Kozlowski Date: Sun Jul 6 11:58:05 2025 +0200 dt-bindings: arm: sunxi: Combine board variants into enums The common style in all bindings for enumerating similar variants is to use 'enum', not 'oneOf', so all boards of same variant or using same SoM should be grouped under enum. It is more readable, more compact and makes easier to find actual devices from the same family/type. Also there is completely no point to repeat the compatible in the description (incircuit,icnova-a20-adb4006 implies this is "ICnova A20 ADB4006" and pine64,pinephone-1.2 implies "Pine64 PinePhone (1.2)"). Combine two easily visible cases: ICnova A20 and Pine64 PinePhone. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250706095804.50475-2-krzysztof.kozlowski@linaro.org Signed-off-by: Chen-Yu Tsai commit ad4655653a6c463026ed3c300e5fb34f39abff48 Author: Arnd Bergmann Date: Wed Jul 9 17:24:17 2025 +0200 ASoC: SDCA: fix HID dependency It is not possible to enable SND_SOC_SDCA_HID when SND_SOC_SDCA is built-in but HID is in a loadable module, as that results in a link failure: x86_64-linux-ld: sound/soc/sdca/sdca_functions.o: in function `find_sdca_entity_hide': sdca_functions.c:(.text+0x25b): undefined reference to `sdca_add_hid_device' Change SND_SOC_SDCA_HID into a 'bool' option that can only be enabled if this results in a working build, and change the Makefile so this driver is a loadable module if possible. Fixes: ac558015dfd8 ("ASoC: SDCA: add a HID device for HIDE entity") Reviewed-by: Charles Keepax Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250709152430.1498427-1-arnd@kernel.org Signed-off-by: Mark Brown commit f5b92c7449a2905963083836150f1085ce9d58c9 Merge: c61da55412a082 67bdd67aedcec8 Author: Mark Brown Date: Wed Jul 9 16:36:11 2025 +0100 ASoC: don't set dapm->bias_level directly Merge series from Kuninori Morimoto : We have many set_bias_level functions, thus dapm->bias_level should be handled by owner function, not by its callback functions. commit 8ae70af2477b7c7e5829765e563de3e5367104ed Author: Svyatoslav Ryhel Date: Tue Jun 17 10:03:20 2025 +0300 ARM: tegra: Add device-tree for ASUS VivoTab RT TF600T Add device-tree for ASUS VivoTab RT TF600T, which is NVIDIA Tegra30-based tablet device with Windows RT. Signed-off-by: Svyatoslav Ryhel Link: https://lore.kernel.org/r/20250617070320.9153-3-clamor95@gmail.com Signed-off-by: Thierry Reding commit 0cf6d425d39cfc1b676fbf9dea36ecd68eeb27ee Author: Bartosz Golaszewski Date: Mon Jun 30 15:03:57 2025 +0200 gpio: sim: allow to mark simulated lines as invalid Add a new line-level, boolean property to the gpio-sim configfs interface called 'valid'. It's set by default and the user can unset it to make the line be included in the standard `gpio-reserved-ranges` property when the chip is registered with GPIO core. This allows users to specify which lines should not be available for requesting as GPIOs. Link: https://lore.kernel.org/r/20250630130358.40352-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 907e01b3ce4cee04aed33cdffcd444d6bd2a684e Author: Thorsten Blum Date: Wed Jul 9 14:46:52 2025 +0200 ALSA: echoaudio: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250709124655.1195-1-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit d49ac7744f578bcc8708a845cce24d3b91f86260 Author: Lorenzo Stoakes Date: Tue Jul 8 19:37:47 2025 +0100 MAINTAINERS: add mm folks as reviewers to rust alloc The alloc implementation is a thin wrapper over slab/vmalloc, so to help out on the mm side of things and to be cc'd on changes, add some mm people as reviewers. Signed-off-by: Lorenzo Stoakes Acked-by: Uladzislau Rezki (Sony) Acked-by: Vlastimil Babka Acked-by: Liam R. Howlett Link: https://lore.kernel.org/r/20250708183747.104286-1-lorenzo.stoakes@oracle.com Signed-off-by: Danilo Krummrich commit c2ac67b5b1f8cb80fd717592e16368ef2e71514b Author: Sakari Ailus Date: Fri Jul 4 10:54:34 2025 +0300 mmc: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250704075434.3220506-1-sakari.ailus@linux.intel.com Signed-off-by: Ulf Hansson commit 16e3dea53b2ee324bf3520281ca0588f55d9855c Merge: db58532188ebf5 cd4da713f99651 Author: Ulf Hansson Date: Wed Jul 9 15:52:38 2025 +0200 mmc: Merge tag pm-runtime-6.17-rc1 into next Merge the tag pm-runtime-6.17-rc1 from git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm into next Runtime PM updates related to autosuspend for 6.17 Make several autosuspend functions mark last busy stamp and update the documentation accordingly (Sakari Ailus). This is needed to allow additional changes to the mmc subsystem to be queued for v6.17 too. Signed-off-by: Ulf Hansson commit 48925ba7dfa7337f54c5bae6738b2f0bb4055b06 Author: Jonathan Velez Date: Wed Jul 9 13:33:30 2025 +0000 ata: libata-transport: replace scnprintf with sysfs_emit for simple attributes sprintf, snprintf, and scnprintf do not consider the PAGE_SIZE maximum of the temporary buffer used for outputting sysfs content and they may overrun the PAGE_SIZE buffer length. To avoid output defects with the ATA transport class simple attributes, use sysfs_emit instead of scnprintf(). This aligns with the sysfs guidance provided in Documentation/filesystems/sysfs.rst. Signed-off-by: Jonathan Velez Reviewed-by: Damien Le Moal Link: https://lore.kernel.org/r/20250709133330.3546-1-jonvelez12345@gmail.com Signed-off-by: Niklas Cassel commit c61da55412a08268ea0cdef99dea11f7ade934ee Author: Peter Ujfalusi Date: Wed Jul 9 10:57:45 2025 +0800 ASoC: sdw_utils: Add missed component_name strings for speaker amps Several speaker amp was missed when the compoennt_name was added, which results missing " spk:" from the components string, confusing UCM. Fixes: f792733e08d5 ("ASoC: sdw_utils: add component_name string to dai_info") Cc: stable@vger.kernel.org Signed-off-by: Peter Ujfalusi Signed-off-by: Bard Liao Link: https://patch.msgid.link/20250709025745.1285788-1-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 0f168e7be696a17487e83d1d47e5a408a181080f Author: Shixiong Ou Date: Wed Jul 9 18:34:38 2025 +0800 fbcon: Fix outdated registered_fb reference in comment The variable was renamed to fbcon_registered_fb, but this comment was not updated along with the change. Correct it to avoid confusion. Signed-off-by: Shixiong Ou Fixes: efc3acbc105a ("fbcon: Maintain a private array of fb_info") [sima: Add Fixes: line.] Signed-off-by: Simona Vetter Link: https://patchwork.freedesktop.org/patch/msgid/20250709103438.572309-1-oushixiong1025@163.com commit b1092465e24bd943bb4c630d98d9c48635d7655c Merge: d7b8f8e20813f0 b74710eaff314d Author: Rafael J. Wysocki Date: Wed Jul 9 15:10:04 2025 +0200 Merge tag 'linux-cpupower-6.17-rc1-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux Merge cpupower utility changes for 6.17-rc1 from Shuah Khan: "Fixes - snapshot-order of tsc,mperf, clock in mperf_stop() - printing of CORE, CPU fields in cpupower-monitor Improves Python binding's Makefile" * tag 'linux-cpupower-6.17-rc1-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux: cpupower: Improve Python binding's Makefile pm: cpupower: Fix printing of CORE, CPU fields in cpupower-monitor pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() commit e7cd58d2fdf8b3d2cb8c1d7a6d8eac2c67e5e18b Author: Jerome Brunet Date: Tue Jun 3 19:03:40 2025 +0200 PCI: endpoint: pci-epf-vntb: Allow BAR assignment via configfs The current BAR configuration for the PCI vNTB endpoint function allocates BARs in order, which lacks flexibility and does not account for platform-specific quirks. This is problematic on Renesas platforms, where BAR_4 is a fixed 256B region that ends up being used for MW1, despite being better suited for doorbells. Add new configfs attributes to allow users to specify arbitrary BAR assignments. If no configuration is provided, the driver retains its original behavior of sequential BAR allocation, preserving compatibility with existing userspace setups. This enables use cases such as assigning BAR_2 for MW1 and using the limited BAR_4 for doorbells on Renesas platforms. Signed-off-by: Jerome Brunet [mani: adjusted the indent of EPF_NTB_BAR_W, fixed kdoc & squashed bar fix] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Link: https://patch.msgid.link/20250603-pci-vntb-bar-mapping-v2-3-fc685a22ad28@baylibre.com commit 820845ce37b0fb8a4b43a7fbe745e59f6199fb27 Author: Thomas Zimmermann Date: Sun Jul 6 18:26:45 2025 +0200 drm/ast: Gen7: Switch default registers to gen4+ state Change the default register settings for Gen7 to mach Gen4 and later. Gen7 currently uses the settings for Gen1, which is most likely incorrect. Using Gen4+ settings enables E2M linear-access modes in VGACRA2. It appears to be related to the chip's PCIE2MBOX feature, which is unused. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250706162816.211552-11-tzimmermann@suse.de commit 22518e93135f42d6dcc72b6850b7890207c19be5 Author: Thomas Zimmermann Date: Sun Jul 6 18:26:44 2025 +0200 drm/ast: Gen7: Disable VGASR0[1] as on Gen4+ Set VGACRB6[5], which disables asynchronous sequencer resets via VGASR0[1]. This was most likely an oversight when adding support for Gen7. Aligns Gen7 with the earlier Gen4+. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250706162816.211552-10-tzimmermann@suse.de commit b1ce4ab06f70fa1dea6b4b6a372aa43989c55897 Author: Thomas Zimmermann Date: Sun Jul 6 18:26:43 2025 +0200 drm/ast: Split ast_set_def_ext_reg() by chip generation Duplicate ast_set_def_ext_reg() for individual chip generations and move call it into per-chip source files. Remove the original code. AST2100 and AST2500 reuse the function from earlier chips. AST2600 appears to be incorrect as it uses an older function. Keep this behavior for now. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250706162816.211552-9-tzimmermann@suse.de commit eb104c69db707ce0208f753a897dadd39f51342f Author: Thomas Zimmermann Date: Sun Jul 6 18:26:42 2025 +0200 drm/ast: Handle known struct ast_dramstruct with helpers Most of struct ast_dramstruct stores hardware state. Some index values have known or special meaning. The known values are - 0xffff - Terminal entry in the array - 0xff00 - Delays the programming for usecs - 0x0004 - Sets the type of DRAM Add constants and helper macros for these cases. Also add a helper macro for testing. Update Gen1 and Gen2+ accordingly. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250706162816.211552-8-tzimmermann@suse.de commit f28f15e6d009c029a28eebc10944362346e34554 Author: Thomas Zimmermann Date: Sun Jul 6 18:26:41 2025 +0200 drm/ast: Move struct ast_dramstruct to ast_post.h Declare struct ast_dramstruct in ast_post.h and remove its original header file. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250706162816.211552-7-tzimmermann@suse.de commit 1be08550e6e72e8ab29e909db266130b59a47277 Author: Thomas Zimmermann Date: Sun Jul 6 18:26:40 2025 +0200 drm/ast: Move Gen2+ and Gen1 POST code to separate source files Move POST code for Gen2+ and Gen1 to separate source files and hide it in ast_2100_post() ans ast_2000_post(). With P2A configuration, the POST logic for these chip generations has been mingled in ast_init_dram_reg(). Hence, handle all generations in a single change. The split simplifies both cases. Also move the DRAM init tables for each Gen into the respective source file. No changes to the overall logic. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250706162816.211552-6-tzimmermann@suse.de commit 0f336e9cffeef3c0655aca400a4574e0a140deeb Author: Thomas Zimmermann Date: Sun Jul 6 18:26:39 2025 +0200 drm/ast: Move Gen4+ POST code to separate source file Move POST code for Gen4+ to separate source file and hide it in ast_2300_post(). With P2A configuration, it performs a full board POST and enables the transmitter chip; otherwise it only enables the transmitter chip. Also fix coding style in several places. No changes to the overall logic. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250706162816.211552-5-tzimmermann@suse.de commit 3c1ec4e8cbd6ff45d9eb7c9ba6675dfdce90ee8a Author: Thomas Zimmermann Date: Sun Jul 6 18:26:38 2025 +0200 drm/ast: Move Gen6+ POST code to separate source file Move POST code for Gen6+ to separate source file and hide it in ast_2500_post(). With P2A configuration, it performs a full board POST; otherwise it enables the transmitter chip. No changes to the overall logic. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250706162816.211552-4-tzimmermann@suse.de commit f67fb980e19d86664da8d04c6e10f7c2b35de404 Author: Thomas Zimmermann Date: Sun Jul 6 18:26:37 2025 +0200 drm/ast: Move Gen7+ POST code to separate source file Move POST code for Gen7+ to separate source file and hide it in ast_2600_post(). There's not much going on here except for enabling the DP transmitter chip. v2: - simplify logic (Jocelyn) Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250706162816.211552-3-tzimmermann@suse.de commit 26ef96ee165d3cf4b3182a1fd9b01ee96c078c21 Author: Thomas Zimmermann Date: Sun Jul 6 18:26:36 2025 +0200 drm/ast: Declare helpers for POST in header Provide POST helpers in header file before splitting up the AST POST code. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250706162816.211552-2-tzimmermann@suse.de commit 84daa158bb5e72ec279ab168892df86a25d3c459 Author: Sumit Gupta Date: Thu Jul 3 16:08:29 2025 +0530 soc/tegra: cbb: Add support for CBB fabrics in Tegra254 Add support for CBB 2.0 based fabrics in Tegra254 SoC using ACPI. Fabrics reporting errors are: C2C, GPU and Display_Cluster. Tegra254 uses a hardware based lookup to get target node address, so the target_map tables for each fabric are no longer needed. Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit fa4854a9f5d6630df060a4aa5894f9b4eb8cc3ef Author: Sumit Gupta Date: Thu Jul 3 16:08:28 2025 +0530 soc/tegra: cbb: Add support for CBB fabrics in Tegra264 Add support for CBB 2.0 based fabrics in Tegra264 SoC using DT. Fabrics reporting errors are: SYSTEM, TOP0, UPHY0 and VISION. Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit 5f2c2c439983ca3a208a0175f7793c355fab8566 Author: Sumit Gupta Date: Thu Jul 3 16:08:26 2025 +0530 soc/tegra: cbb: Support HW lookup to get timed out target address Add support for hardware based lookup to get the address of the timed out target node. This features is added in upcoming SoCs and avoids the need for creating per fabric target_map tables in the driver. Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit 25de5c8fe0801361182b41c42f086bd089feda14 Author: Sumit Gupta Date: Thu Jul 3 16:08:25 2025 +0530 soc/tegra: cbb: Improve handling for per SoC fabric data Improve handling for the per SoC fabrics and targets. The below changes make them more flexible and ready for future SoC's. - Added SoC prefix to Fabric_ID enums. - Rename *lookup_target_timeout() to *sw_lookup_target_timeout() to make it separate from HW based lookup function to be added later. - Moved target_map within fabric_lookup table to make it easy to check whether SW vs HW lookup is supported and handle accordingly. - Slight improvements to some error prints. Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit 2f2c32f9cc940f908b42d070207c6d503362793c Author: Sumit Gupta Date: Thu Jul 3 16:08:24 2025 +0530 soc/tegra: cbb: Make error interrupt enable and status per SoC Make the error interrupt enable and error status fields as per SoC. Both of these fields can change for different SoC's. Moving them to per SoC data helps to set or clear the required bits only for a SoC. Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit 9c150799677719bf06e31dfb86b34965e535e3dc Author: Sumit Gupta Date: Thu Jul 3 16:08:23 2025 +0530 soc/tegra: cbb: Change master/slave to initiator/target Change usage of 'Master/Slave' to 'Initiator/Target' as per the new convention. Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit a0647bca8966db04b79af72851ebd04224a4da40 Author: Sumit Gupta Date: Thu Jul 3 16:08:22 2025 +0530 soc/tegra: cbb: Clear ERR_FORCE register with ERR_STATUS When error is injected with the ERR_FORCE register, then this register is not auto cleared on clearing the ERR_STATUS register. This causes repeated interrupts on error injection. To fix, set the ERR_FORCE to zero along with clearing the ERR_STATUS register after handling error. Fixes: fc2f151d2314 ("soc/tegra: cbb: Add driver for Tegra234 CBB 2.0") Signed-off-by: Sumit Gupta Signed-off-by: Thierry Reding commit bde430fb669d03a0025fd90485dc26acfafd9b4f Author: Suma Hegde Date: Wed Jul 9 10:54:13 2025 +0000 platform/x86/amd/hsmp: Enhance the print messages to prevent confusion When the HSMP ACPI device is present, loading the amd_hsmp.ko module incorrectly displays the message "HSMP is not supported on Family:%x model:%x\n" despite being supported by the hsmp_acpi.ko module, leading to confusion. To address this issue, relocate the acpi_dev_present() check to the beginning of the hsmp_plt_init() and revise the print message to better reflect the current support status. Additionally, add more error messages in the error paths and debug messages to indicate successful probing for both hsmp_acpi.ko and amd_hsmp.ko modules. Reviewed-by: Naveen Krishna Chatradhi Signed-off-by: Suma Hegde Link: https://lore.kernel.org/r/20250709105413.2487851-1-suma.hegde@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dbe4efea38d0a79ed58069499368e08b815952c6 Author: Rob Herring (Arm) Date: Thu Jul 3 13:34:34 2025 -0500 firmware: tegra: bpmp: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250703183434.2073375-1-robh@kernel.org Signed-off-by: Thierry Reding commit 398e67e0f5ae04b29bcc9cbf342e339fe9d3f6f1 Author: Aaron Kling Date: Thu May 22 11:11:24 2025 -0500 ARM: tegra: Use I/O memcpy to write to IRAM Kasan crashes the kernel trying to check boundaries when using the normal memcpy. Signed-off-by: Aaron Kling Link: https://lore.kernel.org/r/20250522-mach-tegra-kasan-v1-1-419041b8addb@gmail.com Signed-off-by: Thierry Reding commit 0666e3fe95ab55c295984f2f51277ec27d3f190c Author: Thierry Bultel Date: Mon Jun 30 21:23:23 2025 +0100 serial: sh-sci: Add support for RZ/T2H SCI Define a new RSCI port type, and the RSCI 32 bits registers set. The RZ/T2H SCI has a a fifo, and a quite different set of registers from the original SH SCI ones. DMA is not supported yet. Signed-off-by: Thierry Bultel Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250630202323.279809-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 1d26517d11de7fc9408c22429b8e75963314420d Author: Thierry Bultel Date: Mon Jun 30 21:23:22 2025 +0100 serial: sh-sci: Use private port ID New port types cannot be added in serial_core.h, which is shared with userspace. In order to support new port types, the coming new ones will have BIT(7) set in the id value, and in this case, uartport->type is set to PORT_GENERIC. This commit therefore changes all the places where the port type is read, by not relying on uartport->type but on the private value stored in struct sci_port. Signed-off-by: Thierry Bultel Signed-off-by: Lad Prabhakar Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250630202323.279809-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 13af95c7f602cf3644f3145530ec2e80a88659eb Author: Lad Prabhakar Date: Mon Jun 30 21:23:21 2025 +0100 serial: sh-sci: Replace direct stop_rx/stop_tx calls with port ops in sci_shutdown() Replace direct calls to sci_stop_rx() and sci_stop_tx() with port ops callbacks in sci_shutdown(). This enables the RSCI driver, which reuses the SCI core but implements its own stop_rx and stop_tx logic, to reuse sci_shutdown() without duplicating code. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250630202323.279809-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 64a2e41b8ef7771554374a0ac8386648fc6db2ba Author: Lad Prabhakar Date: Mon Jun 30 21:23:20 2025 +0100 dt-bindings: serial: rsci: Update maintainer entry Add myself as the maintainer for the Renesas RSCI device tree binding, as Thierry Bultel no longer works for Renesas. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250630202323.279809-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit dfa983c98cf76b4f22f3b8e3f30b9672c969f70a Author: Thierry Bultel Date: Mon Jun 30 21:23:19 2025 +0100 dt-bindings: serial: renesas,rsci: Add optional secondary clock input Update the RSCI binding to support an optional secondary clock input on the RZ/T2H SoC. At boot, the RSCI operates using the default synchronous clock (PCLKM core clock), which is enabled by the bootloader. However, to support a wider range of baud rates, the hardware also requires an asynchronous external clock input. Clock selection is controlled internally by the CCR3 register in the RSCI block. Due to an incomplete understanding of the hardware, the original binding defined only a single clock ("fck"), which is insufficient to describe the full capabilities of the RSCI on RZ/T2H. This update corrects the binding by allowing up to three clocks and defining the `clock-names` as "operation", "bus", and optionally "sck" for the asynchronous clock input. This is an ABI change, as it modifies the expected number and names of clocks. However, since there are no in-kernel consumers of this binding yet, the change is considered safe and non-disruptive. Also remove the unneeded `serial0` alias from the DTS example and use the R9A09G077_CLK_PCLKM macro for core clock. Signed-off-by: Thierry Bultel Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250630202323.279809-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit a553ab200ef456a264aa0ebb8cb55a924e406ed3 Author: Kuninori Morimoto Date: Thu Jul 3 04:52:22 2025 +0000 serial: sh-sci: Add R-Car Gen5 support Add "rcar-gen5-scif" compatible string for R-Car Gen5 support. Signed-off-by: Nghia Nguyen Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/87cyahdgfu.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Greg Kroah-Hartman commit 6ac1d604737279313bbd55797460204f21044327 Author: Nghia Nguyen Date: Thu Jul 3 04:51:50 2025 +0000 dt-bindings: serial: sh-sci: Document r8a78000 bindings R-Car X5H (R8A78000) SoC has the R-Car Gen5 compatible SCIF and HSCIF ports, so document the SoC specific bindings. [Kuninori: tidyup for upstreaming] Signed-off-by: Nghia Nguyen Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/87ecuxdggq.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Greg Kroah-Hartman commit f7a676a4842b629bd6638a612c519f9e060cd72a Author: Andy Shevchenko Date: Tue Jul 1 16:41:38 2025 +0300 serial: 8520_ce4100: Reuse mem_serial_in() in ce4100_mem_serial_in() In one place in ce4100_mem_serial_in() the code may be replaced with mem_serial_in() call. Do it so and collapse two conditionals into one. Suggested-by: Jiri Slaby Signed-off-by: Andy Shevchenko Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20250701134200.2621898-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 0b9ca2dcabc3c8816a6ee75599cab7bef3330609 Author: Vincent Guittot Date: Tue Jul 8 18:56:30 2025 +0200 sched/fair: Always trigger resched at the end of a protected period Always trigger a resched after a protected period even if the entity is still eligible. It can happen that an entity remains eligible at the end of the protected period but must let an entity with a shorter slice to run in order to keep its lag shorter than slice. This is particulalry true with run to parity which tries to maximize the lag. Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250708165630.1948751-7-vincent.guittot@linaro.org commit 3a0baa8e6c570c252999cb651398a88f8f990b4a Author: Vincent Guittot Date: Tue Jul 8 18:56:29 2025 +0200 sched/fair: Fix entity's lag with run to parity When an entity is enqueued without preempting current, we must ensure that the slice protection is updated to take into account the slice duration of the newly enqueued task so that its lag will not exceed its slice (+ tick). Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250708165630.1948751-6-vincent.guittot@linaro.org commit 052c3d87c82ea4ee83232b747512847b4e8c9976 Author: Vincent Guittot Date: Tue Jul 8 18:56:28 2025 +0200 sched/fair: Limit run to parity to the min slice of enqueued entities Run to parity ensures that current will get a chance to run its full slice in one go but this can create large latency and/or lag for entities with shorter slice that have exhausted their previous slice and wait to run their next slice. Clamp the run to parity to the shortest slice of all enqueued entities. Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250708165630.1948751-5-vincent.guittot@linaro.org commit 9de74a9850b9468ac2f515bfbe0844e0bfae869d Author: Vincent Guittot Date: Tue Jul 8 18:56:27 2025 +0200 sched/fair: Remove spurious shorter slice preemption Even if the waking task can preempt current, it might not be the one selected by pick_task_fair. Check that the waking task will be selected if we cancel the slice protection before doing so. Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250708165630.1948751-4-vincent.guittot@linaro.org commit 74eec63661d46a7153d04c2e0249eeb76cc76d44 Author: Vincent Guittot Date: Tue Jul 8 18:56:26 2025 +0200 sched/fair: Fix NO_RUN_TO_PARITY case EEVDF expects the scheduler to allocate a time quantum to the selected entity and then pick a new entity for next quantum. Although this notion of time quantum is not strictly doable in our case, we can ensure a minimum runtime for each task most of the time and pick a new entity after a minimum time has elapsed. Reuse the slice protection of run to parity to ensure such runtime quantum. Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250708165630.1948751-3-vincent.guittot@linaro.org commit 9cdb4fe20cd239c848b5c3f5753d83a9443ba329 Author: Vincent Guittot Date: Tue Jul 8 18:56:25 2025 +0200 sched/fair: Use protect_slice() instead of direct comparison Replace the test by the relevant protect_slice() function. Signed-off-by: Vincent Guittot Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dhaval Giani (AMD) Link: https://lkml.kernel.org/r/20250708165630.1948751-2-vincent.guittot@linaro.org commit cccb45d7c4295bbfeba616582d0249f2d21e6df5 Author: Peter Zijlstra Date: Tue May 20 11:19:30 2025 +0200 sched/deadline: Less agressive dl_server handling Chris reported that commit 5f6bd380c7bd ("sched/rt: Remove default bandwidth control") caused a significant dip in his favourite benchmark of the day. Simply disabling dl_server cured things. His workload hammers the 0->1, 1->0 transitions, and the dl_server_{start,stop}() overhead kills it -- fairly obviously a bad idea in hind sight and all that. Change things around to only disable the dl_server when there has not been a fair task around for a whole period. Since the default period is 1 second, this ensures the benchmark never trips this, overhead gone. Fixes: 557a6bfc662c ("sched/fair: Add trivial fair server") Reported-by: Chris Mason Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Juri Lelli Acked-by: Juri Lelli Link: https://lkml.kernel.org/r/20250702121158.465086194@infradead.org commit 570c8efd5eb79c3725ba439ce105ed1bedc5acd9 Author: Peter Zijlstra Date: Fri May 23 17:28:00 2025 +0200 sched/psi: Optimize psi_group_change() cpu_clock() usage Dietmar reported that commit 3840cbe24cf0 ("sched: psi: fix bogus pressure spikes from aggregation race") caused a regression for him on a high context switch rate benchmark (schbench) due to the now repeating cpu_clock() calls. In particular the problem is that get_recent_times() will extrapolate the current state to 'now'. But if an update uses a timestamp from before the start of the update, it is possible to get two reads with inconsistent results. It is effectively back-dating an update. (note that this all hard-relies on the clock being synchronized across CPUs -- if this is not the case, all bets are off). Combine this problem with the fact that there are per-group-per-cpu seqcounts, the commit in question pushed the clock read into the group iteration, causing tree-depth cpu_clock() calls. On architectures where cpu_clock() has appreciable overhead, this hurts. Instead move to a per-cpu seqcount, which allows us to have a single clock read for all group updates, increasing internal consistency and lowering update overhead. This comes at the cost of a longer update side (proportional to the tree depth) which can cause the read side to retry more often. Fixes: 3840cbe24cf0 ("sched: psi: fix bogus pressure spikes from aggregation race") Reported-by: Dietmar Eggemann Signed-off-by: Peter Zijlstra (Intel) Acked-by: Johannes Weiner Tested-by: Dietmar Eggemann , Link: https://lkml.kernel.org/20250522084844.GC31726@noisy.programming.kicks-ass.net commit 155213a2aed42c85361bf4f5c817f5cb68951c3b Author: Chris Mason Date: Thu Jun 26 07:39:10 2025 -0700 sched/fair: Bump sd->max_newidle_lb_cost when newidle balance fails schbench (https://github.com/masoncl/schbench.git) is showing a regression from previous production kernels that bisected down to: sched/fair: Remove sysctl_sched_migration_cost condition (c5b0a7eefc) The schbench command line was: schbench -L -m 4 -M auto -t 256 -n 0 -r 0 -s 0 This creates 4 message threads pinned to CPUs 0-3, and 256x4 worker threads spread across the rest of the CPUs. Neither the worker threads or the message threads do any work, they just wake each other up and go back to sleep as soon as possible. The end result is the first 4 CPUs are pegged waking up those 1024 workers, and the rest of the CPUs are constantly banging in and out of idle. If I take a v6.9 Linus kernel and revert that one commit, performance goes from 3.4M RPS to 5.4M RPS. schedstat shows there are ~100x more new idle balance operations, and profiling shows the worker threads are spending ~20% of their CPU time on new idle balance. schedstats also shows that almost all of these new idle balance attemps are failing to find busy groups. The fix used here is to crank up the cost of the newidle balance whenever it fails. Since we don't want sd->max_newidle_lb_cost to grow out of control, this also changes update_newidle_cost() to use sysctl_sched_migration_cost as the upper limit on max_newidle_lb_cost. Signed-off-by: Chris Mason Signed-off-by: Peter Zijlstra (Intel) Acked-by: Vincent Guittot Link: https://lkml.kernel.org/r/20250626144017.1510594-2-clm@fb.com commit 829f5a6308ce11c3edaa31498a825f8c41b9e9aa Author: Kan Liang Date: Mon Jul 7 13:17:50 2025 -0700 perf/x86/intel/uncore: Add iMC freerunning for Panther Lake PTL uncore imc freerunning counters are the same as the previous HW. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250707201750.616527-5-kan.liang@linux.intel.com commit 64ad6d6ede0cff2997e707dcb051bd4987508c27 Author: Kan Liang Date: Mon Jul 7 13:17:49 2025 -0700 perf/x86/intel/uncore: Add Panther Lake support The Panther Lake supports CBOX, MC, sNCU, and HBO uncore PMON. The CBOX is similar to Lunar Lake. The only difference is the number of CBOX. The other three uncore PMON can be retrieved from the discovery table. The global control register resides in the sNCU. The global freeze bit is set by default. It must be cleared before monitoring any uncore counters. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250707201750.616527-4-kan.liang@linux.intel.com commit fca24bf2b6b619770d7f1222c0284791d7766239 Author: Kan Liang Date: Mon Jul 7 13:17:48 2025 -0700 perf/x86/intel/uncore: Support customized MMIO map size For a server platform, the MMIO map size is always 0x4000. However, a client platform may have a smaller map size. Make the map size customizable. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250707201750.616527-3-kan.liang@linux.intel.com commit cf002dafedd06241175e4dbce39ba90a4b75822c Author: Kan Liang Date: Mon Jul 7 13:17:47 2025 -0700 perf/x86/intel/uncore: Support MSR portal for discovery tables Starting from the Panther Lake, the discovery table mechanism is also supported in client platforms. The difference is that the portal of the global discovery table is retrieved from an MSR. The layout of discovery tables are the same as the server platforms. Factor out __parse_discovery_table() to parse discover tables. The uncore PMON is Die scope. Need to parse the discovery tables for each die. Signed-off-by: Kan Liang Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250707201750.616527-2-kan.liang@linux.intel.com commit 192595a60a3e42998ac7b12abe71efbe49749f5e Merge: 68e4dadacb7faa 86ccd4d3e8bc9e Author: Mark Brown Date: Wed Jul 9 12:37:01 2025 +0100 ASoC: Intel: add support for new devices Merge series from Bard Liao : Add support for new devices on Intel platforms. commit 3964d07dd821efe9680e90c51c86661a98e60a0f Author: Al Viro Date: Tue Jul 8 03:57:34 2025 +0100 lpfc: don't use file->f_path.dentry for comparisons If you want a home-grown switch, at least use enum for selector... Signed-off-by: Al Viro Link: https://lore.kernel.org/r/20250708025734.GT1880847@ZenIV Reviewed-by: Justin Tee Signed-off-by: Greg Kroah-Hartman commit 4c0727e56831cf3646c604131e2eea25c734c9eb Author: Al Viro Date: Wed Jul 2 22:28:18 2025 +0100 blk-mq-debugfs: use debugfs_get_aux() instead of manually stashing the data pointer into parent directory inode's ->i_private, just pass it to debugfs_create_file_aux() so that it can be extracted without that insane chasing through ->d_parent. Signed-off-by: Al Viro Link: https://lore.kernel.org/r/20250702212818.GJ3406663@ZenIV Signed-off-by: Greg Kroah-Hartman commit 9d3b96be2ee81a7d6ad08cb5094753f06382db1b Author: Al Viro Date: Wed Jul 2 22:26:16 2025 +0100 debugfs_get_aux(): allow storing non-const void * typechecking is up to users, anyway... Signed-off-by: Al Viro Link: https://lore.kernel.org/r/20250702212616.GI3406663@ZenIV Signed-off-by: Greg Kroah-Hartman commit 00bbe512e60f681aef132f0dd2c92eb6521acef1 Author: Al Viro Date: Wed Jul 2 22:25:42 2025 +0100 fix tt_command_write() 1) unbalanced debugfs_file_get(). Not needed in the first place - file_operations are accessed only via debugfs_create_file(), so debugfs wrappers will take care of that itself. 2) kmalloc() for a buffer used only for duration of a function is not a problem, but for a buffer no longer than 16 bytes? 3) strstr() is for finding substrings; for finding a character there's strchr(). Signed-off-by: Al Viro Acked-by: "Rafael J. Wysocki" Link: https://lore.kernel.org/r/20250702212542.GH3406663@ZenIV Signed-off-by: Greg Kroah-Hartman commit d9bc88aa54d6aa22ff1e850a86be7a37f0503889 Author: Al Viro Date: Wed Jul 2 22:24:19 2025 +0100 debugfs: split short and full proxy wrappers, kill debugfs_real_fops() All users outside of fs/debugfs/file.c are gone, in there we can just fully split the wrappers for full and short cases and be done with that. Signed-off-by: Al Viro Link: https://lore.kernel.org/r/20250702212419.GG3406663@ZenIV Signed-off-by: Greg Kroah-Hartman commit 1c1ec6f00e20296a9db044977dafaada070c581f Author: Al Viro Date: Wed Jul 2 22:22:05 2025 +0100 netronome: don't bother with debugfs_real_fops() Just turn nfp_tx_q_show() into a wrapper for helper that gets told whether it's tx or xdp via an explicit argument and have nfp_xdp_q_show() call the underlying helper instead. Signed-off-by: Al Viro Reviewed-by: Louis Peens Link: https://lore.kernel.org/r/20250702212205.GF3406663@ZenIV Signed-off-by: Greg Kroah-Hartman commit a7694ff11aa9d97d0f690351a964544849e5158d Author: Al Viro Date: Wed Jul 2 22:17:39 2025 +0100 vmscan: don't bother with debugfs_real_fops() ... not when it's used only to check which file is used; debugfs_create_file_aux_num() allows to stash a number into debugfs entry and debugfs_get_aux_num() extracts it. Signed-off-by: Al Viro Braino-spotted-by: Matthew Wilcox Link: https://lore.kernel.org/r/20250702211739.GE3406663@ZenIV Signed-off-by: Greg Kroah-Hartman commit 460e36ee6f84c2df4d194ee788e3ca116e8c563b Author: Al Viro Date: Wed Jul 2 22:16:50 2025 +0100 resctrl: get rid of pointless debugfs_file_{get,put}() ->write() of file_operations that gets used only via debugfs_create_file() is called only under debugfs_file_get() Signed-off-by: Al Viro Acked-by: Reinette Chatre Link: https://lore.kernel.org/r/20250702211650.GD3406663@ZenIV Signed-off-by: Greg Kroah-Hartman commit 8009fb751d2c355b4fb83ca158c6b75590d3a3c1 Author: Al Viro Date: Wed Jul 2 22:16:02 2025 +0100 regmap: get rid of redundant debugfs_file_{get,put}() pointless in ->read()/->write() of file_operations used only via debugfs_create_file() Signed-off-by: Al Viro Link: https://lore.kernel.org/r/20250702211602.GC3406663@ZenIV Signed-off-by: Greg Kroah-Hartman commit 2b4b80cfcf25e613148a2cd6b273b200b0064b40 Author: Al Viro Date: Wed Jul 2 22:15:08 2025 +0100 hfi1: get rid of redundant debugfs_file_{get,put}() All files in question are created via debugfs_create_file(), so exclusion with removals is provided by debugfs wrappers; as the matter of fact, hfi1-private wrappers had been redundant at least since 2017... Signed-off-by: Al Viro Link: https://lore.kernel.org/r/20250702211508.GB3406663@ZenIV Signed-off-by: Greg Kroah-Hartman commit 327a206c0e1484b960e7804954d568bf80bad93c Author: Al Viro Date: Wed Jul 2 22:14:08 2025 +0100 zynqmp: don't bother with debugfs_file_{get,put}() in proxied fops When debugfs file has been created by debugfs_create_file_unsafe(), we do need the file_operations methods to use debugfs_file_{get,put}() to prevent concurrent removal; for files created by debugfs_create_file() that is done in the wrappers that call underlying methods, so there's no point whatsoever duplicating that in the underlying methods themselves. Signed-off-by: Al Viro Link: https://lore.kernel.org/r/20250702211408.GA3406663@ZenIV Signed-off-by: Greg Kroah-Hartman commit eb34a0b5fee736c559404691b4c3ec48c5375a8c Author: Ulf Hansson Date: Tue Jul 1 13:47:26 2025 +0200 cpuidle: riscv-sbi: Drop redundant sync_state support The recent updates to the genpd core, can entirely manage the sync_state support for the cpuidle-riscv-sbi-domain. More precisely, genpd prevents our ->power_off() callback from being invoked, until all of our consumers are ready for it. Let's therefore drop the sync_state support for the cpuidle-riscv-sbi-domain as it has become redundant. Cc: Anup Patel Cc: linux-riscv@lists.infradead.org Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Reviewed-by: Rahul Pathak Reviewed-by: Anup Patel Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-25-ulf.hansson@linaro.org commit 039d2b0a1b6222c2f964de827368e87e286ae554 Author: Ulf Hansson Date: Tue Jul 1 13:47:25 2025 +0200 cpuidle: psci: Drop redundant sync_state support The recent updates to the genpd core, can entirely manage the sync_state support for the cpuidle-psci-domain. More precisely, genpd prevents our ->power_off() callback from being invoked, until all of our consumers are ready for it. Let's therefore drop the sync_state support for the cpuidle-psci-domain as it has become redundant. Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-24-ulf.hansson@linaro.org commit 0e789b491ba04c31de5c71249487593e386baa67 Author: Ulf Hansson Date: Tue Jul 1 13:47:24 2025 +0200 pmdomain: core: Leave powered-on genpds on until sync_state Powering-off a genpd that was on during boot, before all of its consumer devices have been probed, is certainly prone to problems. For OF based platforms we can rely on using the sync_state mechanism that the fw_devlink provides, to understand when all consumers for a genpd provider have been probed. Let's therefore prevent these genpds from being powered-off until the ->sync_state() callback gets called. Note that, for non-OF based platform we will keep relying on the late_initcall_sync, which seems to be the best we can do for now. Suggested-by: Saravana Kannan Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-23-ulf.hansson@linaro.org commit 13a4b7fb62600e1c0738fdb0b7176555ff05aadf Author: Ulf Hansson Date: Tue Jul 1 13:47:23 2025 +0200 pmdomain: core: Leave powered-on genpds on until late_initcall_sync Powering-off a genpd that was on during boot, before all of its consumer devices have been probed, is certainly prone to problems. As a step to improve this situation, let's prevent these genpds from being powered-off until genpd_power_off_unused() gets called, which is a late_initcall_sync(). Note that, this still doesn't guarantee that all the consumer devices has been probed before we allow to power-off the genpds. Yet, this should be a step in the right direction. Suggested-by: Saravana Kannan Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-22-ulf.hansson@linaro.org commit f66c65686abdf317f6ea1ebd3a76a2cdb2020d06 Author: Ulf Hansson Date: Tue Jul 1 13:47:22 2025 +0200 pmdomain: core: Default to use of_genpd_sync_state() for genpd providers Unless the typical platform driver that act as genpd provider, has its own ->sync_state() callback implemented let's default to use of_genpd_sync_state(). More precisely, while adding a genpd OF provider let's assign the ->sync_state() callback, in case the fwnode has a device and its driver doesn't have the ->sync_state() set already. In this way the typical platform driver doesn't need to assign ->sync_state(), unless it has some additional things to manage beyond genpds. Suggested-by: Saravana Kannan Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-21-ulf.hansson@linaro.org commit 2b5630e9886f9121535d421ebfb240a9535f3f1e Author: Saravana Kannan Date: Tue Jul 1 13:47:21 2025 +0200 driver core: Add dev_set_drv_sync_state() This can be used by frameworks to set the sync_state() helper functions for drivers that don't already have them set. Signed-off-by: Saravana Kannan Acked-by: Greg Kroah-Hartman Reviewed-by: Abel Vesa Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-20-ulf.hansson@linaro.org commit 3b7b8acacf372945b4855a136634775c064a57f8 Author: Ulf Hansson Date: Tue Jul 1 13:47:20 2025 +0200 pmdomain: core: Add common ->sync_state() support for genpd providers If the genpd provider's fwnode doesn't have an associated struct device with it, we can make use of the generic genpd->dev and it corresponding driver internally in genpd to manage ->sync_state(). More precisely, while adding a genpd OF provider let's check if the fwnode has a device and if not, make the preparation to handle ->sync_state() internally through the genpd_provider_driver and the genpd_provider_bus. Note that, genpd providers may opt out from this behaviour by setting the GENPD_FLAG_NO_SYNC_STATE config options for the genpds in question. Suggested-by: Saravana Kannan Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-19-ulf.hansson@linaro.org commit 9a4681a485ee1203ac968065490a8eeaa6615503 Author: Ulf Hansson Date: Tue Jul 1 13:47:19 2025 +0200 driver core: Export get_dev_from_fwnode() It has turned out get_dev_from_fwnode() is useful at a few other places outside of the driver core, as in gpiolib.c for example. Therefore let's make it available as a common helper function. Suggested-by: Saravana Kannan Cc: Greg Kroah-Hartman Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Acked-by: Greg Kroah-Hartman Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-18-ulf.hansson@linaro.org commit 29ea33866d6d905acc45208fdf75da89e2b00000 Author: Ulf Hansson Date: Tue Jul 1 13:47:18 2025 +0200 firmware: xilinx: Use of_genpd_sync_state() To make sure genpd tries to power off unused PM domains, let's call of_genpd_sync_state() from our own ->sync_state() callback. Cc: Michal Simek Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-17-ulf.hansson@linaro.org commit 10086a4f391f4b9c969a21e785e7fa0fa6c023e5 Author: Ulf Hansson Date: Tue Jul 1 13:47:17 2025 +0200 firmware: xilinx: Don't share zynqmp_pm_init_finalize() As there no longer any users outside the zynqmp firmware driver of zynqmp_pm_init_finalize(), let's turn into a local static function. Cc: Michal Simek Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-16-ulf.hansson@linaro.org commit 3da405ead6511e4f3c6b34ac92c1961ca5723f18 Author: Ulf Hansson Date: Tue Jul 1 13:47:16 2025 +0200 firmware/pmdomain: xilinx: Move ->sync_state() support to firmware driver Rather than having the genpd provider to add device_links for each device that gets attached, to implement the ->sync_state() support, let's rely on fw_devlink to do this for us. In this way, we can simplify the code by moving the ->sync_state() callback into the firmware driver, so let's do that. Cc: Michael Tretter Cc: Michal Simek Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-15-ulf.hansson@linaro.org commit c237dbbc1f10dd547cafb4780fa16e731d5cf438 Author: Ulf Hansson Date: Tue Jul 1 13:47:15 2025 +0200 pmdomain: qcom: rpmhpd: Use of_genpd_sync_state() To make sure genpd tries to power off unused PM domains, let's call of_genpd_sync_state() from our own ->sync_state() callback. Cc: Bjorn Andersson Cc: Konrad Dybcio Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-14-ulf.hansson@linaro.org commit 5b1d21d75e9d12f1c2f7db0e3c9ef01feceb357d Author: Ulf Hansson Date: Tue Jul 1 13:47:14 2025 +0200 pmdomain: qcom: rpmpd: Use of_genpd_sync_state() To make sure genpd tries to power off unused PM domains, let's call of_genpd_sync_state() from our own ->sync_state() callback. Cc: Bjorn Andersson Cc: Konrad Dybcio Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-13-ulf.hansson@linaro.org commit ee766b0175861ef2b2e774d2c49eba9a6b38dc7a Author: Ulf Hansson Date: Tue Jul 1 13:47:13 2025 +0200 cpuidle: riscv-sbi: Opt-out from genpd's common ->sync_state() support The riscv-sbi-domain implements its own specific ->sync_state() callback. Let's set the GENPD_FLAG_NO_SYNC_STATE to inform genpd about it. Moreover, let's call of_genpd_sync_state() to make sure genpd tries to power off unused PM domains. Cc: Anup Patel Cc: linux-riscv@lists.infradead.org Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Reviewed-by: Anup Patel Reviewed-by: Rahul Pathak Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-12-ulf.hansson@linaro.org commit 7cfa380de70301e444e12376470c81de9e154a2f Author: Ulf Hansson Date: Tue Jul 1 13:47:12 2025 +0200 cpuidle: psci: Opt-out from genpd's common ->sync_state() support The cpuidle-psci-domain implements its own specific ->sync_state() callback. Let's set the GENPD_FLAG_NO_SYNC_STATE to inform genpd about it. Moreover, let's call of_genpd_sync_state() to make sure genpd tries to power off unused PM domains. Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-11-ulf.hansson@linaro.org commit 8efc9b195b5f19894e50990e81bbc6799c035b79 Author: Ulf Hansson Date: Tue Jul 1 13:47:11 2025 +0200 soc/tegra: pmc: Opt-out from genpd's common ->sync_state() support Tegra implements its own specific ->sync_state() callback for the genpd providers. Let's set the GENPD_FLAG_NO_SYNC_STATE to inform genpd about it. Moreover, let's call of_genpd_sync_state() to make sure genpd tries to power off unused PM domains. Cc: Thierry Reding Cc: Jonathan Hunter Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-10-ulf.hansson@linaro.org commit c8c196220ce5eba9b7d4aca37a7fd4bbb965d2ed Author: Ulf Hansson Date: Tue Jul 1 13:47:10 2025 +0200 pmdomain: core: Prepare to add the common ->sync_state() support Before we can implement the common ->sync_state() support in genpd, we need to allow a few specific genpd providers to opt out from the new behaviour. Let's introduce GENPD_FLAG_NO_SYNC_STATE as a new genpd config option, to allow providers to opt out. Suggested-by: Saravana Kannan Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-9-ulf.hansson@linaro.org commit 6c3b746fd536b7612b23e5c2041365014b85082e Author: Ulf Hansson Date: Tue Jul 1 13:47:09 2025 +0200 pmdomain: core: Export a common ->sync_state() helper for genpd providers In some cases the typical platform driver that act as genpd provider, may need its own ->sync_state() callback to manage various things. In this regards, the provider most likely wants to allow its corresponding genpds to be powered-off. For this reason, let's introduce a new genpd helper function, of_genpd_sync_state() that helps genpd provider drivers to achieve this. Suggested-by: Saravana Kannan Reviewed-by: Abel Vesa Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-8-ulf.hansson@linaro.org commit 18a3a510ecfd0e508e8e41160dea0493cdfa297c Author: Ulf Hansson Date: Tue Jul 1 13:47:08 2025 +0200 pmdomain: core: Add the genpd->dev to the genpd provider bus To take the next step for a more common handling of the genpd providers, let's add the genpd->dev to the genpd provider bus when registering a genpd OF provider. Also note, to allow us to add devices to the genpd provider bus we need to make sure the bus has been registered first, which is done via a core_initcall. Hence, calls to of_genpd_add_provider_simple|onecell() must be done after the bus has been registered, else they will fail. Suggested-by: Saravana Kannan Reviewed-by: Abel Vesa Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-7-ulf.hansson@linaro.org commit 31cb75077003acb81b34b8d204a8997138536a55 Author: Ulf Hansson Date: Tue Jul 1 13:47:07 2025 +0200 pmdomain: core: Add a bus and a driver for genpd providers When we create a genpd via pm_genpd_init() we are initializing a corresponding struct device for it, but we don't add the device to any bus_type. It has not really been needed as the device is used as cookie to help us manage OPP tables. However, to prepare to make better use of the device, let's add a new genpd provider bus_type and a corresponding genpd provider driver. Subsequent changes will make use of this. Suggested-by: Saravana Kannan Reviewed-by: Abel Vesa Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen # TI AM62A,Xilinx ZynqMP ZCU106 Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-6-ulf.hansson@linaro.org commit 60fe1ca5bc6ca1971c23e26078e33366de84d53e Author: Ulf Hansson Date: Tue Jul 1 13:47:06 2025 +0200 pmdomain: core: Prevent registering devices before the bus We must not register a consumer device to the genpd bus, before registering the bus itself. Even if this doesn't seem to be an issue, let's add a simple check to make sure we really avoid this from happening. Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-5-ulf.hansson@linaro.org commit b27e9842b89a35fa233f9ca6f7072bd63952accc Author: Ulf Hansson Date: Tue Jul 1 13:47:05 2025 +0200 pmdomain: renesas: rcar-gen4-sysc: Move init to postcore_initcall Subsequent changes to genpd adds a limitation that registering a genpd OF providers must be done after its bus registration, which is at core_initcall. To adopt to this, let's move to a postcore_initcall. Suggested-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-4-ulf.hansson@linaro.org commit 7b2b9aeec13e881f165169aa2425d0146afa216b Author: Ulf Hansson Date: Tue Jul 1 13:47:04 2025 +0200 pmdomain: renesas: rmobile-sysc: Move init to postcore_initcall Subsequent changes to genpd adds a limitation that registering a genpd OF providers must be done after its bus registration, which is at core_initcall. To adopt to this, let's move to a postcore_initcall. Suggested-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-3-ulf.hansson@linaro.org commit c5ae5a0c61120d0c917f4c8ae1af3e35326f29e8 Author: Ulf Hansson Date: Tue Jul 1 13:47:03 2025 +0200 pmdomain: renesas: rcar-sysc: Add genpd OF provider at postcore_initcall Subsequent changes to genpd adds a limitation that registering a genpd OF providers must be done after its bus registration, which is at core_initcall. To adopt to this, let's split the initialization into two steps. The first part keep registering the PM domains with genpd at early_initcall, as this is needed to bringup the CPUs for R-Car H1, by calling rcar_sysc_power_up_cpu(). The second and new part, moves the registration of the genpd OF provider to a postcore_initcall(). Suggested-by: Geert Uytterhoeven Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250701114733.636510-2-ulf.hansson@linaro.org commit 9f2cbfcda595b6d741adf71058c60476b8d21028 Author: Luca Weiss Date: Mon Jul 7 12:18:11 2025 +0200 pmdomain: qcom: rpmhpd: Add Milos power domains Add the power domains exposed by RPMH in the Qualcomm Milos platform. Signed-off-by: Luca Weiss Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250707-sm7635-rpmhpd-v2-2-b4aa37acb065@fairphone.com Signed-off-by: Ulf Hansson commit 90e88ef86e3fedf4b0f64a977e81e0f4e6cc004a Merge: 3b2ded23053842 cb1f2ebec676b6 Author: Ulf Hansson Date: Wed Jul 9 13:16:25 2025 +0200 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the DT bindings to be tested together with changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit cb1f2ebec676b661725787081d7fff96bafe629e Author: Luca Weiss Date: Mon Jul 7 12:18:10 2025 +0200 dt-bindings: power: qcom,rpmpd: document the Milos RPMh Power Domains Document the RPMh Power Domains on the Milos (e.g. SM7635) SoC. Signed-off-by: Luca Weiss Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250707-sm7635-rpmhpd-v2-1-b4aa37acb065@fairphone.com Signed-off-by: Ulf Hansson commit 9b355cdb63b1e43434d7ac57430d3e68de58338d Author: Greg Kroah-Hartman Date: Tue Jul 1 12:54:22 2025 +0200 x86/microcode: Move away from using a fake platform device Downloading firmware needs a device to hang off of, and so a platform device seemed like the simplest way to do this. Now that we have a faux device interface, use that instead as this "microcode device" is not anything resembling a platform device at all. Signed-off-by: Greg Kroah-Hartman Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/2025070121-omission-small-9308@gregkh commit 1b0ee85ee7967a4d7a68080c3f6a66af69e4e0b4 Author: Christophe JAILLET Date: Sat Jul 5 11:52:33 2025 +0200 staging: gpib: Fix error handling paths in cb_gpib_probe() If cb_gpib_config() fails, 'info' needs to be freed, as already done in the remove function. While at it, remove a pointless comment related to gpib_attach(). Fixes: e9dc69956d4d ("staging: gpib: Add Computer Boards GPIB driver") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/bf89d6f2f8b8c680720d02061fc4ebdd805deca8.1751709098.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman commit 4f7ac4d07a7a42d26af0537b8df69ec1b906c0a7 Author: Harshit Mogalapalli Date: Thu Jul 3 00:05:30 2025 -0700 staging: gpib: lpvo_usb_gpib: Remove unreachable return statement usb_gpib_read() has a return statement after if else which is unreachable, clean this up. Signed-off-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20250703070542.1957371-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Greg Kroah-Hartman commit bdfa82f5b8998a6311a8ef0cf89ad413f5cd9ea4 Author: Harshit Mogalapalli Date: Wed Jul 2 23:52:14 2025 -0700 staging: gpib: cec: Fix inconsistent indentation in cec_pci_attach() This is a cleanup which fixes inconsistent indentation. This is found with smatch. drivers/staging/gpib/cec/cec_gpib.c:305 cec_pci_attach() warn: inconsistent indenting Signed-off-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20250703065224.1956688-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Greg Kroah-Hartman commit aa07b790d79226f9bd0731d2c065db2823867cc5 Author: Harshit Mogalapalli Date: Wed Jul 2 23:46:20 2025 -0700 staging: gpib: Fix error code in board_type_ioctl() When copy_from_user() fails it return number of bytes it wasn't able to copy. So the correct return value when copy_from_user() fails is -EFAULT. Fixes: 9dde4559e939 ("staging: gpib: Add GPIB common core driver") Signed-off-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20250703064633.1955893-1-harshit.m.mogalapalli@oracle.com Signed-off-by: Greg Kroah-Hartman commit 3e92c919553c97ba77e84830417cbc62df5883c2 Author: Abdun Nihaal Date: Tue Jul 1 22:15:36 2025 +0530 staging: fbtft: cleanup error handling in fbtft_framebuffer_alloc() The error handling in fbtft_framebuffer_alloc() mixes managed allocation and plain allocation, and performs error handling in an order different from the order in fbtft_framebuffer_release(). Fix them by moving vmem allocation closer to where it is used, and using plain kzalloc() for txbuf allocation. Also remove the duplicate call to fb_deferred_io_cleanup(). Suggested-by: Andy Shevchenko Suggested-by: Dan Carpenter Signed-off-by: Abdun Nihaal Reviewed-by: Andy Shevchenko Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250701164537.243282-1-abdun.nihaal@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3b2ded23053842c78fa4f057cd7beb299093af2f Author: Christophe JAILLET Date: Sun Jul 6 17:45:41 2025 +0200 pmdomain: amlogic: Constify struct meson_secure_pwrc_domain_data 'struct meson_secure_pwrc_domain_data' are not modified in these drivers. Constifying these structures moves some data to a read-only section, so increases overall security. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 9248 408 0 9656 25b8 drivers/pmdomain/amlogic/meson-secure-pwrc.o After: ===== text data bss dec hex filename 9344 304 0 9648 25b0 drivers/pmdomain/amlogic/meson-secure-pwrc.o Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/e71abd8d75dd842690e5a11e38037bcf5feac189.1751816732.git.christophe.jaillet@wanadoo.fr Signed-off-by: Ulf Hansson commit a4abebf362d620d041baaa7c2e6c2bb5b6af3a69 Author: Kuninori Morimoto Date: Thu Jul 3 01:49:20 2025 +0000 pmdomain: renesas: sort Renesas Kconfig configs Renesas Kconfig is using "SoC chip number" for CONFIG symbol, but is using "SoC chip name" for menu description. Because of it, it looks random order when we run "make menuconfig". commit 6d5aded8d57f ("soc: renesas: Sort driver description title") sorted Renesas Kconfig by "menu description title order" (= SoC chip name), but it makes confusable to add new config, because developer usually checks CONFIG symbols (= SoC chip number). Let's indicate both "SoC chip number" and "SoC chip name" in description and sort it again. Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/87ikkacacf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Ulf Hansson commit 0875e89125460c77f86e1a2eac5f280fefd7573f Author: Kuninori Morimoto Date: Thu Jul 3 01:49:09 2025 +0000 pmdomain: renesas: use menu for Renesas Current Renesas PM Domains appears on top page. Let's create new menu for Renesas. Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/87jz4qcacr.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Ulf Hansson commit f42309733cf4ace0089bd7d0c8154138bf6ed15a Merge: da3d0b772f6f04 500ba332844162 Author: Ulf Hansson Date: Wed Jul 9 12:53:30 2025 +0200 pmdomain: Merge branch fixes into next Merge the pmdomain fixes for v6.16-rc[n] into the next branch, to allow them to get tested together with the new changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit 3b08f8a34a2061d89a2411d04a675b3860d4f9cc Author: João Paulo Gonçalves Date: Mon Jun 23 13:12:27 2025 -0300 arm64: dts: ti: k3-am62p-verdin: Adjust temperature trip points While the TI AM62P supports a junction temperature (Tj) of up to 125°C for industrial and automotive parts, Toradex Verdin-AM62P hardware lifetime guarantees consider a 105°C Tj. Change the passive trip points to 95°C and the critical trip points to 105°C to be compliant with the hardware specifications. Signed-off-by: João Paulo Gonçalves Link: https://lore.kernel.org/r/20250623-b4-verdin-am62p-cooling-device-v1-2-cc185ba5843d@toradex.com Signed-off-by: Vignesh Raghavendra commit f02dccbe9641c4be467d22f4d5712523d902e94d Author: João Paulo Gonçalves Date: Mon Jun 23 13:12:26 2025 -0300 arm64: dts: ti: k3-am62p-j722s: Enable freq throttling on thermal alert Enable throttling down the CPU frequency when an alert temperature threshold is reached before the critical temperature for shutdown. Signed-off-by: João Paulo Gonçalves Link: https://lore.kernel.org/r/20250623-b4-verdin-am62p-cooling-device-v1-1-cc185ba5843d@toradex.com Signed-off-by: Vignesh Raghavendra commit f393a761763c542761abcf978252d431269366d6 Author: Gerd Hoffmann Date: Tue Jul 8 14:56:23 2025 +0200 efi: add ovmf debug log driver Recent OVMF versions (edk2-stable202508 + newer) can write their debug log to a memory buffer. This driver exposes the log content via sysfs (/sys/firmware/efi/ovmf_debug_log). Signed-off-by: Gerd Hoffmann Signed-off-by: Ard Biesheuvel commit 854acbe75ff406ea2c72ef3048578dfd99425ba9 Author: Jared Kangas Date: Tue Jun 10 06:12:31 2025 -0700 dma-buf: heaps: Give default CMA heap a fixed name The CMA heap's name in devtmpfs can vary depending on how the heap is defined. Its name defaults to "reserved", but if a CMA area is defined in the devicetree, the heap takes on the devicetree node's name, such as "default-pool" or "linux,cma". To simplify naming, unconditionally name it "default_cma_region", but keep a legacy node in place backed by the same underlying allocator for backwards compatibility. Reviewed-by: Maxime Ripard Signed-off-by: Jared Kangas Signed-off-by: Sumit Semwal Link: https://lore.kernel.org/r/20250610131231.1724627-4-jkangas@redhat.com commit 86e59cc5069700361041aa5bf536a8a66be6b9ec Author: Jared Kangas Date: Tue Jun 10 06:12:30 2025 -0700 dma-buf: heaps: Parameterize heap name in __add_cma_heap() Prepare for the introduction of a fixed-name CMA heap by replacing the unused void pointer parameter in __add_cma_heap() with the heap name. Reviewed-by: Maxime Ripard Acked-by: John Stultz Signed-off-by: Jared Kangas Signed-off-by: Sumit Semwal Link: https://lore.kernel.org/r/20250610131231.1724627-3-jkangas@redhat.com commit c2d636dc6359efc68fbb84b44485789edcbba9f9 Author: Jared Kangas Date: Tue Jun 10 06:12:29 2025 -0700 Documentation: dma-buf: heaps: Fix code markup Code snippets should be wrapped in double backticks to follow reStructuredText semantics; the use of single backticks uses the :title-reference: role by default, which isn't quite what we want. Add double backticks to code snippets to fix this. Reviewed-by: Maxime Ripard Signed-off-by: Jared Kangas Signed-off-by: Sumit Semwal Link: https://lore.kernel.org/r/20250610131231.1724627-2-jkangas@redhat.com commit a951020202b88cee91feab00b36946c62e5a71d3 Author: T.J. Mercier Date: Thu Apr 17 18:09:41 2025 +0000 dma-buf: system_heap: No separate allocation for attachment sg_tables struct dma_heap_attachment is a separate allocation from the struct sg_table it contains, but there is no reason for this. Let's use the slab allocator just once instead of twice for dma_heap_attachment. Signed-off-by: T.J. Mercier Reviewed-by: Christian König Signed-off-by: Sumit Semwal Link: https://lore.kernel.org/r/20250417180943.1559755-1-tjmercier@google.com commit b4b4dbfa96dea8e299a47ef877eb0cfe210a7291 Author: Xu Yang Date: Fri Jul 4 17:57:51 2025 +0800 media: stk1160: use usb_alloc_noncoherent/usb_free_noncoherent() This will use USB noncoherent API to alloc/free urb buffers, then stk1160 driver needn't to do dma sync operations by itself. Signed-off-by: Xu Yang Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250704095751.73765-4-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 41b2a7eb1db8899545ebabc9fb7f2eef2e018ada Author: Xu Yang Date: Fri Jul 4 17:57:50 2025 +0800 media: uvcvideo: use usb_alloc_noncoherent/usb_free_noncoherent() This will use USB noncoherent API to alloc/free urb buffers, then uvc driver needn't to do dma sync operations by itself. Reviewed-by: Ricardo Ribalda Signed-off-by: Xu Yang Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250704095751.73765-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 488e6eaab88cfa4b6fd2e2bb72fac9cfdc8c403b Author: Xu Yang Date: Fri Jul 4 17:57:49 2025 +0800 usb: core: add dma-noncoherent buffer alloc and free API This will add usb_alloc_noncoherent() and usb_free_noncoherent() functions to support alloc and free buffer in a dma-noncoherent way. To explicit manage the memory ownership for the kernel and device, this will also add usb_dma_noncoherent_sync_for_cpu/device() functions and call it at proper time. The management requires the user save sg_table returned by usb_alloc_noncoherent() to urb->sgt. Signed-off-by: Xu Yang Reviewed-by: Alan Stern Link: https://lore.kernel.org/r/20250704095751.73765-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 6b04716cdcac37bdbacde34def08bc6fdb5fc4e2 Author: Johannes Berg Date: Mon Jun 9 21:35:27 2025 +0300 wifi: mac80211: don't complete management TX on SAE commit When SAE commit is sent and received in response, there's no ordering for the SAE confirm messages. As such, don't call drivers to stop listening on the channel when the confirm message is still expected. This fixes an issue if the local confirm is transmitted later than the AP's confirm, for iwlwifi (and possibly mt76) the AP's confirm would then get lost since the device isn't on the channel at the time the AP transmit the confirm. For iwlwifi at least, this also improves the overall timing of the authentication handshake (by about 15ms according to the report), likely since the session protection won't be aborted and rescheduled. Note that even before this, mgd_complete_tx() wasn't always called for each call to mgd_prepare_tx() (e.g. in the case of WEP key shared authentication), and the current drivers that have the complete callback don't seem to mind. Document this as well though. Reported-by: Jan Hendrik Farr Closes: https://lore.kernel.org/all/aB30Ea2kRG24LINR@archlinux/ Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213232.12691580e140.I3f1d3127acabcd58348a110ab11044213cf147d3@changeid Signed-off-by: Johannes Berg commit a11ec0dc920b2a23da9d88063b5f15d7eada6128 Author: Somashekhar Puttagangaiah Date: Mon Jun 9 21:35:26 2025 +0300 wifi: cfg80211/mac80211: implement dot11ExtendedRegInfoSupport Implement dot11ExtendedRegInfoSupport to advertise non-AP station regulatory power capability as part of regulatory connectivity element in (Re)Association request frames so that AP can achieve maximum client connectivity. Control field which was interpreted using value of 3-bits B5 to B3, now uses value of 4-bits B6 to B3 to interpret the type of AP. Hence update IEEE80211_HE_6GHZ_OPER_CTRL_REG_INFO to parse 4-bits control field. If older AP still updates only 3-bits value of control field, station can still interpret the value as per section E.2.7 of IEEE 802.11 REVme D7.0 and support the appropriate AP type. Also update IEEE80211_6GHZ_CTRL_REG_INDOOR_SP_AP as the value of standard power AP is changed to 8 instead of 4 so that AP can support both LPI AP and SP AP to maximize the connectivity with stations. For backward compatibility, keeping value 4 as old AP by limiting it to SP AP only. Signed-off-by: Somashekhar Puttagangaiah Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213232.90cdef116aad.I85da390fbee59355e3855691933e6a5e55c47ac4@changeid [fix kernel-doc] Signed-off-by: Johannes Berg commit a9681efa1b69bcc39735cae6fd3c8170fb56a775 Author: Johannes Berg Date: Mon Jun 9 21:35:25 2025 +0300 wifi: mac80211: send extended MLD capa/ops if AP has it Currently the code only sends extended MLD capa/ops in strict mode, but if the AP has it then it should also be able to parse it. There could be cases where the AP doesn't have it but we would want to advertise it (e.g. if the AP supports nothing but we want to have BTM.), but given the broken deployed APs out there right now this is the best we can do. Signed-off-by: Johannes Berg Reviewed-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213232.c9b8b3a6ca77.I1153d4283d1fbb9e5db60e7b939cc133a6345db5@changeid Signed-off-by: Johannes Berg commit ff1ac756eaaadd5e271c5834b2ae80a447a49008 Author: Benjamin Berg Date: Mon Jun 9 21:35:24 2025 +0300 wifi: mac80211: copy first_part into HW scan cfg80211 now reports whether this is the first part of a scan. Copy that information into the driver request. Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213231.63f6078bd7be.Ia6e5cee945e6d9617c2f427552d89d23c92eee83@changeid Signed-off-by: Johannes Berg commit 62c57ebb3107842482bc5e3568a0202295a8db0d Author: Benjamin Berg Date: Mon Jun 9 21:35:23 2025 +0300 wifi: cfg80211: add a flag for the first part of a scan When there are no non-6 GHz channels, then the 6 GHz scan is the first part of a split scan. Add a boolean denoting whether the scan is the first part of a scan as it might be useful to drivers for internal bookkeeping. This flag is also set if the scan is not split. Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213231.07e5a8a452ec.Ibf18f513e507422078fb31b28947e582a20df87a@changeid Signed-off-by: Johannes Berg commit 984462751d57047828ff4a799cc7d4670a2cfeb2 Author: Johannes Berg Date: Mon Jun 9 21:35:22 2025 +0300 wifi: mac80211: remove DISALLOW_PUNCTURING_5GHZ code Since iwlwifi was the only driver using this and no longer does, we can remove all this code. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213231.4dff5fb8890f.Ie531f912b252a0042c18c0734db50c3afe1adfb5@changeid Signed-off-by: Johannes Berg commit afebe192ebfef7f6e0be0a070325995771bcd7e8 Author: Benjamin Berg Date: Mon Jun 9 21:35:21 2025 +0300 wifi: cfg80211: only verify part of Extended MLD Capabilities We verify that the Extended MLD Capabilities are matching between links. However, some bits are reserved and in particular the Recommended Max Links subfield may not necessarily match. So only verify the known subfields that can reliably be expected to be the same. More information can be found in Table 9-417o, in IEEE P802.11be/D7.0. Signed-off-by: Benjamin Berg Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213231.a2fad48dd3e6.Iae1740cd2ac833bc4a64fd2af718e1485158fd42@changeid Signed-off-by: Johannes Berg commit a1d9979c36a4362cdee628bf2b30d83aab611098 Author: Johannes Berg Date: Mon Jun 9 21:35:20 2025 +0300 wifi: nl80211: make nl80211_check_scan_flags() type safe The cast from void * here coupled with the boolean argument on what to cast to is confusing and really not needed, just split the code and make a type-safe interface. It seems to even reduce the code size slightly, at least on x86-64. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213231.bdb3c96570b0.Ia153e6ce06dc9a636ff5bcc1d52468a1afd06e13@changeid Signed-off-by: Johannes Berg commit f0df91b6a7120d85c873f5e77bc183fb6eccda16 Author: Johannes Berg Date: Mon Jun 9 21:35:19 2025 +0300 wifi: cfg80211: hide scan internals Hide the internal scan fields from mac80211 and drivers, the 'notified' variable is for internal tracking, and the 'info' is output that's passed to cfg80211_scan_done() and stored only for delayed userspace notification. Signed-off-by: Johannes Berg Reviewed-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213231.6a62e41858e2.I004f66e9c087cc6e6ae4a24951cf470961ee9466@changeid Signed-off-by: Johannes Berg commit 6f9e701c16a733a7d123b9e52101cf56ca5a0a4e Author: Johannes Berg Date: Mon Jun 9 21:35:18 2025 +0300 wifi: mac80211: fix deactivated link CSA If the link is deactivated and the CSA completes, then that needs to update the link station's bandwidth (only the AP STA can exist at this point, no TDLS on inactive links) and set the CSA to no longer be active. Fix this. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213231.07f120cf687d.I5a868c501ee73fcc2355d61c2ee06e5f444b350f@changeid Signed-off-by: Johannes Berg commit bc7566fbc49afc3c92cdb0da2a5d8f51bcef1f58 Author: Somashekhar Puttagangaiah Date: Mon Jun 9 21:35:17 2025 +0300 wifi: mac80211: add mandatory bitrate support for 6 GHz When a new station is added, ensure that mandatory bit-rates are enabled for 6 GHz band. Signed-off-by: Somashekhar Puttagangaiah Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213231.4aecd7f3b85b.I33a54872a3267c9f6155ce537d6c9c2a31c3f117@changeid Signed-off-by: Johannes Berg commit 798dd0e2609e0680407dcaa35703c37a32f61316 Author: Johannes Berg Date: Mon Jun 9 21:35:16 2025 +0300 wifi: mac80211: remove spurious blank line ieee80211_process_ml_reconf_resp() has a blank line between an if statement and the covered code, remove it. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609213231.a1f4ceae700d.I1d7aae17cc466c1648f31c42b935165db85d2809@changeid Signed-off-by: Johannes Berg commit eb7186bd827d055f026e5464c02f95ba6b1f2d03 Author: Miri Korenblit Date: Mon Jun 9 21:35:15 2025 +0300 wifi: mac80211: verify state before connection ieee80211_prep_connection is supposed to be called when both bitmaps (valid_links and active_links) are cleared. Make sure of it and WARN if this is not the case, to avoid weird issues. Signed-off-by: Miri Korenblit Reviewed-by: Johannes Berg Link: https://patch.msgid.link/20250609213231.f616c7b693df.Ie983155627ad0d2e7c19c30ce642915246d0ed9d@changeid Signed-off-by: Johannes Berg commit 34f888e3405acefc3a353227aa850dd0a37e709d Author: Thomas Weißschuh Date: Tue Jul 1 10:57:59 2025 +0200 vdso/gettimeofday: Return bool from clock_getres() helpers The internal helpers are effectively using boolean results, while pretending to use error numbers. Switch the return type to bool for more clarity. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-5-df7d9f87b9b8@linutronix.de commit ad64d71d7409a0602b50ee71c7f9663a3385c286 Author: Thomas Weißschuh Date: Tue Jul 1 10:57:58 2025 +0200 vdso/helpers: Add helpers for seqlocks of single vdso_clock Auxiliary clocks will have their vDSO data in a dedicated 'struct vdso_clock', which needs to be synchronized independently. Add a helper to synchronize a single vDSO clock. [ tglx: Move the SMP memory barriers to the call sites and get rid of the confusing first/last arguments and conditional barriers ] Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-4-df7d9f87b9b8@linutronix.de commit 76164ca0d113e6a9f3033f948c739586fc606ed1 Author: Thomas Weißschuh Date: Tue Jul 1 10:57:57 2025 +0200 vdso/vsyscall: Split up __arch_update_vsyscall() into __arch_update_vdso_clock() The upcoming auxiliary clocks need this hook, too. To separate the architecture hooks from the timekeeper internals, refactor the hook to only operate on a single vDSO clock. While at it, use a more robust #define for the hook override. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-3-df7d9f87b9b8@linutronix.de commit 6fedaf682a5e1866efdaddc70ff0ada329825d53 Author: Thomas Weißschuh Date: Tue Jul 1 10:57:56 2025 +0200 vdso/vsyscall: Introduce a helper to fill clock configurations The logic to configure a 'struct vdso_clock' from a 'struct tk_read_base' is copied two times. Split it into a shared function to reduce the duplication, especially as another user will be added for auxiliary clocks. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701-vdso-auxclock-v1-2-df7d9f87b9b8@linutronix.de commit 068f7b64bf2054e20bbbd0782aa11f6ff8d17105 Merge: 8959338617a85e e04c78d86a9699 Author: Thomas Gleixner Date: Wed Jul 9 11:51:34 2025 +0200 Merge v6.16-rc2 into timers/ptp to pick up the __GENMASK() fix, otherwise the AUX clock VDSO patches fail to compile for compat. Signed-off-by: Thomas Gleixner commit 62d6b81e8bd207ad44eff39d1a0fe17f0df510a5 Author: Arnd Bergmann Date: Wed Jul 9 09:01:01 2025 +0200 firmware: arm_scmi: Convert to SYSTEM_SLEEP_PM_OPS The old SET_SYSTEM_SLEEP_PM_OPS() macro leads to a warning about an unused function: | drivers/firmware/arm_scmi/scmi_power_control.c:363:12: error: | 'scmi_system_power_resume' defined but not used [-Werror=unused-function] | static int scmi_system_power_resume(struct device *dev) The proper way to do this these days is to use SYSTEM_SLEEP_PM_OPS() and pm_sleep_ptr(). Fixes: 9a0658d3991e ("firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume") Signed-off-by: Arnd Bergmann Acked-by: Peng Fan Message-Id: <20250709070107.1388512-1-arnd@kernel.org> Signed-off-by: Sudeep Holla commit fe88fb3421161f3abd974ee2ecbe2d9195f98812 Author: Tvrtko Ursulin Date: Tue Jul 8 13:21:21 2025 +0100 drm/sched: Consolidate drm_sched_rq_select_entity_rr Extract out two copies of the identical code to drm_sched_rq_select_entity_rr()'s epilogue to make it smaller and more readable. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Reviewed-by: Matthew Brost [phasta: commit message] Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250708122121.75689-1-tvrtko.ursulin@igalia.com commit be1ba9ed221ffb95a8bb15f4c83d0694225ba808 Author: Miri Korenblit Date: Mon Jun 9 21:35:13 2025 +0300 wifi: mac80211: avoid weird state in error path If we get to the error path of ieee80211_prep_connection, for example because of a FW issue, then ieee80211_vif_set_links is called with 0. But the call to drv_change_vif_links from ieee80211_vif_update_links will probably fail as well, for the same reason. In this case, the valid_links and active_links bitmaps will be reverted to the value of the failing connection. Then, in the next connection, due to the logic of ieee80211_set_vif_links_bitmaps, valid_links will be set to the ID of the new connection assoc link, but the active_links will remain with the ID of the old connection's assoc link. If those IDs are different, we get into a weird state of valid_links and active_links being different. One of the consequences of this state is to call drv_change_vif_links with new_links as 0, since the & operation between the bitmaps will be 0. Since a removal of a link should always succeed, ignore the return value of drv_change_vif_links if it was called to only remove links, which is the case for the ieee80211_prep_connection's error path. That way, the bitmaps will not be reverted to have the value from the failing connection and will have 0, so the next connection will have a good state. Signed-off-by: Miri Korenblit Reviewed-by: Johannes Berg Link: https://patch.msgid.link/20250609213231.ba2011fb435f.Id87ff6dab5e1cf757b54094ac2d714c656165059@changeid Signed-off-by: Johannes Berg commit c8c5e97da9fe77177181930838acb3090a08b7bb Merge: cc2b7221328931 34f2573661e3e6 Author: Johannes Berg Date: Wed Jul 9 11:39:23 2025 +0200 Merge tag 'iwlwifi-next-2025-07-09' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi features, notably: - PNVM integrated in the ucode image - more cleanups in the transport layer ==================== Signed-off-by: Johannes Berg commit 602d565d3c10dfb2dfd397f65078cb603a26a513 Author: Luca Ceresoli Date: Tue Jul 8 17:24:43 2025 +0200 drm/sti: hda: convert to devm_drm_bridge_alloc() API devm_drm_bridge_alloc() is the new API to be used for allocating (and partially initializing) a private driver struct embedding a struct drm_bridge. This driver was missed during the automated conversion in commit 9c399719cfb9 ("drm: convert many bridge drivers from devm_kzalloc() to devm_drm_bridge_alloc() API") and following commits. The lack of conversion for this driver is a bug since commit a7748dd127ea ("drm/bridge: get/put the bridge reference in drm_bridge_add/remove()") which is the first commmit having added a drm_bridge_get/put() pair and thus exposing the incorrect initial refcount issue. Fix this by switching the driver to the new API. Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/ce9c6aa3-5372-468f-a4bf-5a261259e459@samsung.com/ Fixes: a7748dd127ea ("drm/bridge: get/put the bridge reference in drm_bridge_add/remove()") Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250708-drm-bridge-convert-to-alloc-api-leftovers-v1-2-6285de8c3759@bootlin.com Signed-off-by: Luca Ceresoli commit ac4531424d907f3983e919a7bda2b90ea0cede4f Author: Luca Ceresoli Date: Tue Jul 8 17:24:42 2025 +0200 drm/sti: hdmi: convert to devm_drm_bridge_alloc() API devm_drm_bridge_alloc() is the new API to be used for allocating (and partially initializing) a private driver struct embedding a struct drm_bridge. This driver was missed during the automated conversion in commit 9c399719cfb9 ("drm: convert many bridge drivers from devm_kzalloc() to devm_drm_bridge_alloc() API") and following commits. The lack of conversion for this driver is a bug since commit a7748dd127ea ("drm/bridge: get/put the bridge reference in drm_bridge_add/remove()") which is the first commmit having added a drm_bridge_get/put() pair and thus exposing the incorrect initial refcount issue. Fix this by switching the driver to the new API. Reported-by: Marek Szyprowski Closes: https://lore.kernel.org/all/ce9c6aa3-5372-468f-a4bf-5a261259e459@samsung.com/ Fixes: a7748dd127ea ("drm/bridge: get/put the bridge reference in drm_bridge_add/remove()") Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250708-drm-bridge-convert-to-alloc-api-leftovers-v1-1-6285de8c3759@bootlin.com Signed-off-by: Luca Ceresoli commit a582469541a3f39bed452c50c5d2744620b6db02 Author: Sakari Ailus Date: Fri Jul 4 10:54:43 2025 +0300 pwm: img: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250704075443.3221370-1-sakari.ailus@linux.intel.com Signed-off-by: Uwe Kleine-König commit 2b2aeaa12c804e52f2ba635899f2b7f2d4623874 Merge: edd3bcb1801e1b cd4da713f99651 Author: Uwe Kleine-König Date: Wed Jul 9 10:48:21 2025 +0200 Merge tag 'pm-runtime-6.17-rc1' of https://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Runtime PM updates related to autosuspend for 6.17 Make several autosuspend functions mark last busy stamp and update the documentation accordingly (Sakari Ailus). commit 34f2573661e3e644efaf383178af634a2fd67828 Author: Miri Korenblit Date: Wed Jul 9 08:16:34 2025 +0300 wifi: iwlwifi: mvm: remove support for iwl_wowlan_info_notif_v4 FWs with this version are no longer supported on any device. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.1668a7430521.I488d69251aed62f0b11a2553f972a1730bc8b6cf@changeid commit e9b7a0264baf9b4aa55ff3ddae275d26b56f476b Author: Miri Korenblit Date: Wed Jul 9 08:16:33 2025 +0300 wifi: iwlwifi: bump minimum API version in BZ Stop supporting older FWs Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.71404c289481.Iea4f3d36e18029a817ec5d6641d08ac5ee025678@changeid commit 915d3522563b6ca672d76b0bf459062ffd575fe6 Author: Miri Korenblit Date: Wed Jul 9 08:16:32 2025 +0300 wifi: iwlwifi: mvm: remove unneeded argument iwl_mvm_set_key_rx_seq is called only once when the installed argument is false. Remove this argument. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.2586112afd70.Iddf9a2b24546cb3a1506d68ca41ed215f88cff5c@changeid commit cb09c80f5904cd99d2e2419733a502f7bdc209b9 Author: Miri Korenblit Date: Wed Jul 9 08:16:31 2025 +0300 wifi: iwlwifi: mvm: remove MLO GTK rekey code iwlmvm driver does not support MLO. Remove this code Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.4957e50dee91.I2a432256dbc3069e0300e1f833e10a93d203f538@changeid commit 8a4583d6264c1c5a4124b93f5f110adec1163e6d Author: Johannes Berg Date: Wed Jul 9 08:16:30 2025 +0300 wifi: iwlwifi: pcie: rename iwl_pci_gen1_2_probe() argument Using 'trans' for the mac config is confusing, rename the argument to 'mac_cfg'. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.72d87406f8d7.I8b39f01e06ad7791efe718c267cbf367233920a3@changeid commit c5fbdf0ba7c1a6ed52dc3650bee73ce00c86cf7f Author: Johannes Berg Date: Wed Jul 9 08:16:29 2025 +0300 wifi: iwlwifi: match discrete/integrated to fix some names Some device names were wrong because our internal data suggested that discrete Ga devices have B-step RF, when they actually have C-step. However, matching the step for them is bad anyway. Change the code to be able to find the devinfo depending on the device being integrated or discrete. This is only for the names, since the RF config cannot be different for the same RF because it's discrete or integrated, so add a kunit test that ensures both (a) the RF config is the same and (b) the name is different (the latter really only because that's the whole point of having a match on the discrete/integrated bit.) Remove the RF step matching since it's no longer needed now. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.e048a94659f1.Ie5919c70e9d8e3a28152aaf3cdffd19ed3d4f5c7@changeid commit 43375cf823479693a095f51db4fe2f3f1e168eaa Author: Johannes Berg Date: Wed Jul 9 08:16:28 2025 +0300 wifi: iwlwifi: remove Intel driver load message There's really not much value in printing something just because the driver loaded, remove that message. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.fe33c279a45d.I16a9cbcfce92a1d1b8b26a20ea9911e8a5a0b1cc@changeid commit c0a44a7bd26c7ed39f96ca3cd31c2f94bedbf5e8 Author: Johannes Berg Date: Wed Jul 9 08:16:27 2025 +0300 wifi: iwlwifi: mvm/mld: make PHC messages debug messages These have no real value for normal users, print them as debug messages instead. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.bd2df0705d89.Ic6f042588ef17719653c077ff89a8b9149c22f92@changeid commit 46f29dbfa9c8208eb1f7a6ec7e14a9de6823ad36 Author: Miri Korenblit Date: Wed Jul 9 08:16:26 2025 +0300 wifi: iwlwifi: trans: remove iwl_trans_init We needed it for setting up trans parameters that could change later in the probe flow. This is no longer true, now we know all the parameters before we allocate the trans, so we can just send the right parameters to iwl_trans_alloc and have all initializations done there. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit .../net/wireless/intel/iwlwifi/iwl-trans.c | 25 ++-------- .../net/wireless/intel/iwlwifi/iwl-trans.h | 8 +-- .../intel/iwlwifi/pcie/gen1_2/trans.c | 50 ++++++++++++------- 3 files changed, 41 insertions(+), 42 deletions(-) Link: https://patch.msgid.link/20250709081300.9602fde079de.Iaede14c91095560852f9b441f1e16546b0a06bdd@changeid commit e1dbd37f145af4e3ed39c0f2fea879f68c94e721 Author: Miri Korenblit Date: Wed Jul 9 08:16:25 2025 +0300 wifi: iwlwifi: pcie move common probe logic Move the parts of the probe that are not gen specific to the common probe function. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.91aee0874e79.Ib762365933d4dd4fc0bf07833226cd7118dee0a1@changeid commit 318f54a6486c769e796cf5bee1a822111b7fc98d Author: Miri Korenblit Date: Wed Jul 9 08:16:24 2025 +0300 wifi: iwlwifi: bump FW API to 102 for BZ/SC/DR Start supporting FW API version 102 on those devices. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.da98a7b6be42.I77150bbf55eb160dbe0ef75c3e28afc053f27ec3@changeid commit 0b261b014a99fa9f9879fb6b819d67c13f0731a1 Author: Yedidya Benshimol Date: Wed Jul 9 08:16:23 2025 +0300 wifi: iwlwifi: pcie: Move txcmd size/align calculation to callers Refactor iwl_trans_init to accept txcmd_size and txcmd_align as parameters instead of calculating them internally. Signed-off-by: Yedidya Benshimol Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.237285d81461.I3552860dd062a523606c8a5c85c9a6f0d4f04262@changeid commit 377edee91b8977615ea5154817e07387ef67720c Author: Yedidya Benshimol Date: Wed Jul 9 08:16:22 2025 +0300 wifi: iwlwifi: pcie move gen1_2 probe to gen1_2/trans.c In the process of splitting the transport's different generations, move gen1_2's probe flow and relevant helper functions to the gen1_2 subfolder Signed-off-by: Yedidya Benshimol Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.29b909144e1a.Idaa77eddd6650cf6f113833d2fbc8d3ef08cfd8f@changeid commit 563abc938f21e2cb7d6ce895fb853f966b2c1f38 Author: Johannes Berg Date: Wed Jul 9 08:16:21 2025 +0300 wifi: iwlwifi: use PNVM data embedded in .ucode files Given compatibility issues with external PNVM data that doesn't match the firmware it was designed with/for, future firmware releases will include the PNVM data in the firmware files directly, avoiding those mismatch issues. Make the driver load and use that embedded PNVM data in preference of external files, falling back to the external file if it isn't present. Co-developed-by: Emmanuel Grumbach Signed-off-by: Emmanuel Grumbach Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.c843f77aa2d3.I7200f8dd40ef82aff1f5574fdd3966913cda592c@changeid commit 14db492738d922a982a1efdc9a4613d414c73a72 Author: Rotem Kerem Date: Wed Jul 9 08:16:20 2025 +0300 wifi: iwlwifi: Add an helper function for polling bits Add iwl_poll_bits helper to simplify calls to iwl_poll_bit for the case when the bits and mask arguments are equal. Signed-off-by: Rotem Kerem Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250709081300.6bbc4bccc597.Ic7a10a7f8a9a32a9a9feecaf6e3a48fa37479f2d@changeid commit 428f6f3a56ac85f37a07a3fe5149b593185d5c4c Author: Nathan Chancellor Date: Tue Jul 8 16:41:01 2025 -0700 platform/x86/intel/pmt/discovery: Fix size_t specifiers for 32-bit When building i386 allmodconfig, there are two warnings in the newly added discovery code: drivers/platform/x86/intel/pmt/discovery.c: In function 'pmt_feature_get_feature_table': drivers/platform/x86/intel/pmt/discovery.c:427:35: error: format '%ld' expects argument of type 'long int', but argument 2 has type 'size_t' {aka 'unsigned int'} [-Werror=format=] 427 | if (WARN(size > res_size, "Bad table size %ld > %pa", size, &res_size)) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~ | | | size_t {aka unsigned int} ... drivers/platform/x86/intel/pmt/discovery.c:427:53: note: format string is defined here 427 | if (WARN(size > res_size, "Bad table size %ld > %pa", size, &res_size)) | ~~^ | | | long int | %d drivers/platform/x86/intel/pmt/discovery-kunit.c: In function 'validate_pmt_regions': include/linux/kern_levels.h:5:25: error: format '%lu' expects argument of type 'long unsigned int', but argument 4 has type 'size_t' {aka 'unsigned int'} [-Werror=format=] ... drivers/platform/x86/intel/pmt/discovery-kunit.c:35:17: note: in expansion of macro 'kunit_info' 35 | kunit_info(test, "\t\taddr=%p, size=%lu, num_rmids=%u", region->addr, region->size, | ^~~~~~~~~~ size_t is 'unsigned long' for 64-bit platforms but 'unsigned int' for 32-bit platforms, so '%ld' is not correct. Use the proper size_t specifier, '%zu', to resolve the warnings on 32-bit platforms while not affecting 64-bit platforms. Reported-by: Randy Dunlap Reported-by: kernelci.org bot Fixes: d9a078809356 ("platform/x86/intel/pmt: Add PMT Discovery driver") Fixes: b9707d46a959 ("platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API") Closes: https://lore.kernel.org/all/CACo-S-29Degjym-azsJNSd1yofLOB2_Rf5xpa9b7L-14OPn7wQ@mail.gmail.com/ Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250708-discovery-pmt-fix-32-bit-formats-v1-1-296a5fc9c3d4@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 03d5236014a5d298c26b2ca80e5834aa844574b3 Author: Sunil Khatri Date: Wed Jul 9 12:46:18 2025 +0530 drm/amdgpu: fix the logic to validate fpriv and root bo Fix the smatch warning, smatch warnings: drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c:2146 amdgpu_pt_info_read() error: we previously assumed 'fpriv' could be null (see line 2146) "if (!fpriv && !fpriv->vm.root.bo)", It has to be an OR condition rather than an AND which makes an NULL dereference in case fpriv is NULL. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507090525.9rDWGhz3-lkp@intel.com/ Signed-off-by: Sunil Khatri Link: https://lore.kernel.org/r/20250709071618.591866-1-sunil.khatri@amd.com Reviewed-by: Christian König Signed-off-by: Christian König commit 8f9abaff41de5b5f977b6d0372073563241cb5df Author: Sunil Khatri Date: Tue Jul 8 15:45:51 2025 +0530 drm/amdgpu: fix MQD debugfs undefined symbol when DEBUG_FS=n Fix undefined reference to amdgpu_mqd_info_fops during debugfs_create_file if DEBUG_FS=n Signed-off-by: Sunil Khatri Link: https://lore.kernel.org/r/20250708101551.68033-1-sunil.khatri@amd.com Reviewed-by: Christian König Signed-off-by: Christian König commit 0ae93389b6c84fbbc6414a5c78f50d65eea8cf35 Author: Aaron Kling Date: Mon Jul 7 16:17:15 2025 -0500 cpufreq: tegra124: Allow building as a module This requires four changes: * Using the cpufreq-dt register helper to establish a hard dependency for depmod to track * Adding a remove routine to remove the cpufreq-dt device * Adding a exit routine to handle cleaning up the driver * Populating module license Signed-off-by: Aaron Kling Signed-off-by: Viresh Kumar commit d812734842f8ab3100e7cee8716b35be5a31a22a Author: Aaron Kling Date: Mon Jul 7 16:17:14 2025 -0500 cpufreq: dt: Add register helper Cpufreq-dt currently exports no functions. This means that drivers that are based on cpufreq-dt have no way of establishing a depmod dependency on it. This helper allows that link. Signed-off-by: Aaron Kling Signed-off-by: Viresh Kumar commit 3254f54a3abda7080acfe51d7cbfabd7bba64d5a Author: Aaron Kling Date: Mon Jul 7 16:17:13 2025 -0500 cpufreq: Export disable_cpufreq() This is used by the tegra124-cpufreq driver. Signed-off-by: Aaron Kling Acked-by: Rafael J. Wysocki Signed-off-by: Viresh Kumar commit defe01abfb7f5c5bd53c723b8577d4fcd64faa5a Author: Rob Herring (Arm) Date: Tue Jul 8 21:16:37 2025 -0500 spi: stm32-ospi: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250709021638.2047365-1-robh@kernel.org Signed-off-by: Mark Brown commit 68e4dadacb7faa393b532b41bbf99a2dbfec3b1b Author: Geert Uytterhoeven Date: Tue Jul 8 17:47:29 2025 +0200 ASoC: img: Imagination Technologies sound should depend on MIPS Before, all Imagination sound symbols were gated by the SND_SOC_IMG symbol, offering the user a simple option to hide them all. After the removal of this gate symbol, all symbols are exposed to the user, even when configuring a kernel for a non-Imagination platform. Fix this by adding a dependency on MIPS, to prevent asking the user about these drivers when configuring a kernel for a different architecture. Fixes: b13f7eef9ff82e01 ("ASoC: img: Standardize ASoC menu") Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/242832f225ae68018111648ea9934dc059741567.1751989463.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit 98269398c02ab20eb9ed6d77416023a2627049d8 Author: Leon Romanovsky Date: Tue Jul 8 12:31:39 2025 +0300 RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration The call to rdma_uattrs_has_raw_cap() is placed in mlx5 fs.c file, which is compiled without relation to CONFIG_INFINIBAND_USER_ACCESS. Despite the check is used only in flows with CONFIG_INFINIBAND_USER_ACCESS=y|m, the compilers generate the following error for CONFIG_INFINIBAND_USER_ACCESS=n builds. >> ERROR: modpost: "rdma_uattrs_has_raw_cap" [drivers/infiniband/hw/mlx5/mlx5_ib.ko] undefined! Fixes: f458ccd2aa2c ("RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507080725.bh7xrhpg-lkp@intel.com/ Link: https://patch.msgid.link/72dee6b379bd709255a5d8e8010b576d50e47170.1751967071.git.leon@kernel.org Reviewed-by: Zhu Yanjun Reviewed-by: Parav Pandit Signed-off-by: Leon Romanovsky commit 7cf636c99b257c1b4b12066ab34fd5f06e8d892f Author: Heiko Carstens Date: Tue Jul 1 18:12:06 2025 +0200 s390/early: Copy last breaking event address to pt_regs In case of an early crash the early program check handler also prints the last breaking event address which is contained within the pt_regs structure. However it is not initialized, and therefore a more or less random value is printed in case of a crash. Copy the last breaking event address from lowcore to pt_regs in case of an early program check to address this. This also makes it easier to analyze early crashes. Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 475ac071bade37644538fd7c4765aede7dbfba34 Author: Basel Nassar Date: Sun Jul 6 07:07:40 2025 +0000 RDMA/efa: Add Network HW statistics counters Update device API and request network counters. Expose newly added counters through ib core counters mechanism. Reviewed-by: David Shoolman Reviewed-by: Yonatan Nachum Signed-off-by: Basel Nassar Signed-off-by: Michael Margolin Link: https://patch.msgid.link/20250706070740.22534-1-mrgolin@amazon.com Signed-off-by: Leon Romanovsky commit 8ab05a5456bb9556bbf7d500a4b1b3b261ed6894 Author: Vlad Dumitrescu Date: Mon Jun 30 13:16:44 2025 +0300 IB/cm: Use separate agent w/o flow control for REP Most responses (e.g., RTU) are not subject to flow control, as there is no further response expected. However, REPs are both requests (waiting for RTUs) and responses (being waited by REQs). With agent-level flow control added to the MAD layer, REPs can get delayed by outstanding REQs. This can cause a problem in a scenario such as 2 hosts connecting to each other at the same time. Both hosts fill the flow control outstanding slots with REQs. The corresponding REPs are now blocked behind those REQs, and neither side can make progress until REQs time out. Add a separate MAD agent which is only used to send REPs. This agent does not have a recv_handler as it doesn't process responses nor does it register to receive requests. Disable flow control for agents w/o a recv_handler, as they aren't waiting for responses. This allows the newly added REP agent to send even when clients are slow to generate RTU, which would be needed to unblock flow control outstanding slots. Relax check in ib_post_send_mad to allow retries for this agent. REPs will be retried by the MAD layer until CM layer receives a response (e.g., RTU) on the normal agent and cancels them. Suggested-by: Sean Hefty Reviewed-by: Maher Sanalla Reviewed-by: Sean Hefty Signed-off-by: Vlad Dumitrescu Signed-off-by: Or Har-Toov Link: https://patch.msgid.link/9ac12d0842b849e2c8537d6e291ee0af9f79855c.1751278420.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 314cb74cea847db6226f3eaba4167198501d7ba3 Author: Or Har-Toov Date: Mon Jun 30 13:16:43 2025 +0300 IB/mad: Add flow control for solicited MADs Currently, MADs sent via an agent are being forwarded directly to the corresponding MAD QP layer. MADs with a timeout value set and requiring a response (solicited MADs) will be resent if the timeout expires without receiving a response. In a congested subnet, flooding MAD QP layer with more solicited send requests from the agent will only worsen the situation by triggering more timeouts and therefore more retries. Thus, add flow control for non-user solicited MADs to block agents from issuing new solicited MAD requests to the MAD QP until outstanding requests are completed and the MAD QP is ready to process additional requests. While at it, keep track of the total outstanding solicited MAD work requests in send or wait list. The number of outstanding send WRs will be limited by a fraction of the RQ size, and any new send WR that exceeds that limit will be held in a backlog list. Backlog MADs will be forwarded to agent send list only once the total number of outstanding send WRs falls below the limit. Unsolicited MADs, RMPP MADs and MADs which are not SA, SMP or CM are not subject to this flow control mechanism and will not be affected by this change. For this purpose, a new state is introduced: - 'IB_MAD_STATE_QUEUED': MAD is in backlog list Signed-off-by: Or Har-Toov Signed-off-by: Vlad Dumitrescu Link: https://patch.msgid.link/c0ecaa1821badee124cd13f3bf860f67ce453beb.1751278420.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 1cf0d8990155c132019371bae96b5cfac661c0a9 Author: Or Har-Toov Date: Mon Jun 30 13:16:42 2025 +0300 IB/mad: Add state machine to MAD layer Replace the use of refcount, timeout and status with a 'state' field to track the status of MADs send work requests (WRs). The state machine better represents the stages in the MAD lifecycle, specifically indicating whether the MAD is waiting for a completion, waiting for a response, was canceld or is done. The existing refcount only takes two values: 1 : MAD is waiting either for completion or for response. 2 : MAD is waiting for both response and completion. Also when a response was received before a completion notification. The status field represents if the MAD was canceled at some point in the flow. The timeout is used to represent if a response was received. The current state transitions are not clearly visible, and developers needs to infer the state from the refcount's, timeout's or status's value, which is error-prone and difficult to follow. Thus, replace with a state machine as the following: - 'IB_MAD_STATE_INIT': MAD is in the making and is not yet in any list - 'IB_MAD_STATE_SEND_START': MAD was sent to the QP and is waiting for completion notification in send list - 'IB_MAD_STATE_WAIT_RESP': MAD send completed successfully, waiting for a response in wait list - 'IB_MAD_STATE_EARLY_RESP': Response came early, before send completion notification, MAD is in the send list - 'IB_MAD_STATE_CANCELED': MAD was canceled while in send or wait list - 'IB_MAD_STATE_DONE': MAD processing completed, MAD is in no list Adding the state machine also make it possible to remove the double call for ib_mad_complete_send_wr in case of an early response and the use of a done list in case of a regular response. While at it, define a helper to clear error MADs which will handle freeing MADs that timed out or have been cancelled. Signed-off-by: Or Har-Toov Signed-off-by: Vlad Dumitrescu Link: https://patch.msgid.link/48e6ae8689dc7bb8b4ba6e5ec562e1b018db88a8.1751278420.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 387727d7e5d9c2499aafbd04e22c9d39e8eec4c5 Author: Neha Malcom Francis Date: Thu Jun 5 12:05:06 2025 +0530 arm64: dts: ti: k3-j784s4-j742s2-main-common: Add PBIST_14 node Add DT node for PBIST_14 that is responsible for triggering the PBIST self-tests for the MAIN_R5_2_x cores. Reviewed-by: Udit Kumar Signed-off-by: Neha Malcom Francis Link: https://lore.kernel.org/r/20250605063506.2005637-3-n-francis@ti.com Signed-off-by: Vignesh Raghavendra commit 04ee170b69749851c74666079ac8f64dba52a2f1 Author: Neha Malcom Francis Date: Thu Jun 5 12:05:05 2025 +0530 dt-bindings: soc: ti: bist: Add BIST for K3 devices Document the binding for TI K3 BIST (Built-In Self Test) block. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Neha Malcom Francis Link: https://lore.kernel.org/r/20250605063506.2005637-2-n-francis@ti.com Signed-off-by: Vignesh Raghavendra commit 265f70af805f33a0dfc90f50cc0f116f702c3811 Author: Judith Mendez Date: Mon Jul 7 14:12:50 2025 -0500 arm64: dts: ti: k3-am62-main: Remove eMMC High Speed DDR support For eMMC, High Speed DDR mode is not supported [0], so remove mmc-ddr-1_8v flag which adds the capability. [0] https://www.ti.com/lit/gpn/am625 Fixes: c37c58fdeb8a ("arm64: dts: ti: k3-am62: Add more peripheral nodes") Cc: stable@vger.kernel.org Signed-off-by: Judith Mendez Link: https://lore.kernel.org/r/20250707191250.3953990-1-jm@ti.com Signed-off-by: Vignesh Raghavendra commit a0b8da04153eb61cc2eaeeea5cc404e91e557f6b Author: Judith Mendez Date: Mon Jul 7 14:08:30 2025 -0500 arm64: dts: ti: k3-am62*: Move eMMC pinmux to top level board file This moves pinmux child nodes for sdhci0 node from k3-am62x-sk-common to each top level board file. This is needed since we require internal pullups for AM62x SK and not for AM62 LP SK since it has external pullups on DATA 1-7. Internal pulls are required for AM62 SK as per JESD84 spec recommendation to prevent unconnected lines floating. Fixes: d19a66ae488a ("arm64: dts: ti: k3-am625-sk: Enable on board peripherals") Cc: stable@vger.kernel.org Signed-off-by: Judith Mendez Link: https://lore.kernel.org/r/20250707190830.3951619-1-jm@ti.com Signed-off-by: Vignesh Raghavendra commit 8e44ac61abaae56fc6eb537a04ed78b458c5b984 Author: Hong Guan Date: Mon Jul 7 11:55:13 2025 -0500 arm64: dts: ti: k3-am62a7-sk: fix pinmux for main_uart1 main_uart1 reserved for TIFS firmware traces is routed to the onboard FT4232 via a FET switch which is connected to pin A21 and B21 of the SoC and not E17 and C17. Fix it. Fixes: cf39ff15cc01a ("arm64: dts: ti: k3-am62a7-sk: Describe main_uart1 and wkup_uart") Cc: stable@vger.kernel.org Signed-off-by: Hong Guan [bb@ti.com: expanded commit message] Signed-off-by: Bryan Brattlof Link: https://lore.kernel.org/r/20250707-uart-fixes-v1-1-8164147218b0@ti.com Signed-off-by: Vignesh Raghavendra commit 57fa4ba6d0a4669fd8f2557e760442d684374f3c Author: Vivian Wang Date: Mon Jun 23 18:04:18 2025 +0800 riscv: dts: spacemit: Move eMMC under storage-bus for K1 SDHCI devices in Spacemit K1 use storage-bus translations. Move the node emmc under storage-bus to reflect this fact. Signed-off-by: Vivian Wang Link: https://lore.kernel.org/r/20250623-k1-dma-buses-rfc-wip-v1-3-c0144082061f@iscas.ac.cn Signed-off-by: Yixun Lan commit 277f8525ed7248d7994af03b7617e339006e654a Author: Vivian Wang Date: Mon Jun 23 18:04:17 2025 +0800 riscv: dts: spacemit: Move UARTs under dma-bus for K1 UART devices in Spacemit K1 use dma-bus DMA translations. Move these nodes under dma-bus to reflect this fact. Signed-off-by: Vivian Wang Reviewed-by: Guodong Xu Link: https://lore.kernel.org/r/20250623-k1-dma-buses-rfc-wip-v1-2-c0144082061f@iscas.ac.cn Signed-off-by: Yixun Lan commit 2f793d0f8f062a1d5fef32d9734560a1f10a5598 Author: Vivian Wang Date: Mon Jun 23 18:04:16 2025 +0800 riscv: dts: spacemit: Add DMA translation buses for K1 The SpacemiT K1 has various static translations of DMA accesses. Add these as simple-bus nodes with dma-ranges. Devices actually using these translations will be added to or moved inside the bus nodes in later patches. The bus names are assigned according to consensus with SpacemiT [1]. Link: https://lore.kernel.org/r/CAH1PCMaC+imcMZCFYtRdmH6ge=dPgnANn_GqVfsGRS=+YhyJCw@mail.gmail.com [1] Signed-off-by: Vivian Wang Reviewed-by: Guodong Xu Link: https://lore.kernel.org/r/20250623-k1-dma-buses-rfc-wip-v1-1-c0144082061f@iscas.ac.cn Signed-off-by: Yixun Lan commit c71dbeb4c03a3c0f67d45fe2b1ac21d2f4cf4875 Author: Guodong Xu Date: Tue Apr 29 16:50:46 2025 +0800 riscv: dts: spacemit: add pwm14_1 pinctrl setting This patch adds the option 1 (hence the name pwm14_1) pinctrl configuration for PWM14 on the SpacemiT K1 SoC. PWM14 option 1 is used for PWM-based backlight control on MIPI displays. This configuration is present on all existing K1 development boards, such as the Banana Pi BPI-F3 and the Milk-V Jupiter. For reference, a more complete list of PWM0-PWM19 pinctrl configurations including all options can be found in [1]. Note: Since the corresponding functionality for other pins is not yet in use or ready for upstreaming, this patch includes only the pwm14_1 setting. [1] https://lore.kernel.org/all/20250411131423.3802611-7-guodong@riscstar.com/ Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20250429085048.1310409-5-guodong@riscstar.com Signed-off-by: Yixun Lan commit 66f56c7a64213948341521b5310064586a05c80e Author: Guodong Xu Date: Tue Apr 29 16:50:45 2025 +0800 riscv: dts: spacemit: add PWM support for K1 SoC The SpacemiT K1 SoC features a PWM controller with 20 independent channels. Add the corresponding 20 PWM nodes to the device tree. Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20250429085048.1310409-4-guodong@riscstar.com Signed-off-by: Yixun Lan commit bca4146b1f66dbca07591bfd6ad695c699b5a093 Author: Andrew Davis Date: Wed Jul 2 09:53:14 2025 -0500 arm64: dts: ti: Enable overlays for all DTB files Allow overlays to be applied to any DTB without manually enabling it for each file. This adds around ~10% to the total size of the DTB files on average. Signed-off-by: Andrew Davis Acked-by: Bryan Brattlof Link: https://lore.kernel.org/r/20250702145314.71996-1-afd@ti.com Signed-off-by: Vignesh Raghavendra commit b1a8daa7cf2650637f6cca6aaf014bee89672120 Author: Parth Pancholi Date: Thu Jul 3 10:45:34 2025 +0200 arm64: dts: ti: k3-am62p-verdin: fix PWM_3_DSI GPIO direction PWM_3_DSI is used as the HDMI Hot-Plug Detect (HPD) GPIO for the Verdin DSI-to-HDMI adapter. After the commit 33bab9d84e52 ("arm64: dts: ti: k3-am62p: fix pinctrl settings"), the pin was incorrectly set as output without RXACTIVE, breaking HPD detection and display functionality. The issue was previously hidden and worked by chance before the mentioned pinctrl fix. Fix the pinmux configuration to correctly set PWM_3_DSI GPIO as an input. Fixes: 87f95ea316ac ("arm64: dts: ti: Add Toradex Verdin AM62P") Signed-off-by: Parth Pancholi Reviewed-by: Francesco Dolcini Link: https://lore.kernel.org/r/20250703084534.1649594-1-parth105105@gmail.com Signed-off-by: Vignesh Raghavendra commit 5b272127884bded21576a6ddceca13725a351c63 Author: Alexander Sverdlin Date: Tue Jul 1 12:54:35 2025 +0200 arm64: dts: ti: k3-pinctrl: Enable Schmitt Trigger by default Switch Schmitt Trigger functions for PIN_INPUT* macros by default. This is HW PoR configuration, the slew rate requirements without ST enabled are pretty tough for these devices. We've noticed spurious GPIO interrupts even with noise-free edges but not meeting slew rate requirements (3.3E+6 V/s for 3.3v LVCMOS). It's not obvious why one might want to disable the PoR-enabled ST on any pin. Just enable it by default. As it's not possible to provide OR-able macros to disable the ST, shall anyone require it, provide a set of new macros with _NOST suffix. Fixes: fe49f2d776f7 ("arm64: dts: ti: Use local header for pinctrl register values") Cc: stable@vger.kernel.org Signed-off-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250701105437.3539924-1-alexander.sverdlin@siemens.com [vigneshr@ti.com: Add Fixes tag] Signed-off-by: Vignesh Raghavendra commit bde5b1a1553c5e96367afd4da64de947ae4b6f84 Author: Srish Srinivasan Date: Wed Jun 11 02:49:07 2025 +0530 integrity/platform_certs: Allow loading of keys in the static key management mode On PLPKS enabled PowerVM LPAR, there is no provision to load signed third-party kernel modules when the key management mode is static. This is because keys from secure boot secvars are only loaded when the key management mode is dynamic. Allow loading of the trustedcadb and moduledb keys even in the static key management mode, where the secvar format string takes the form "ibm,plpks-sb-v0". Signed-off-by: Srish Srinivasan Tested-by: R Nageswara Sastry Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250610211907.101384-4-ssrish@linux.ibm.com commit c1d96cd9a10bfea6aea71aaca6a161d98320edc5 Author: Srish Srinivasan Date: Wed Jun 11 02:49:06 2025 +0530 powerpc/secvar: Expose secvars relevant to the key management mode The PLPKS enabled PowerVM LPAR sysfs exposes all of the secure boot secvars irrespective of the key management mode. The PowerVM LPAR supports static and dynamic key management for secure boot. The key management option can be updated in the management console. The secvars PK, trustedcadb, and moduledb can be consumed both in the static and dynamic key management modes for the loading of signed third-party kernel modules. However, other secvars i.e. KEK, grubdb, grubdbx, sbat, db and dbx, which are used to verify the grub and kernel images, are consumed only in the dynamic key management mode. Expose only PK, trustedcadb, and moduledb in the static key management mode. Co-developed-by: Souradeep Signed-off-by: Souradeep Signed-off-by: Srish Srinivasan Tested-by: R Nageswara Sastry Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250610211907.101384-3-ssrish@linux.ibm.com commit fbf355f32b98903c572544ead7fc0db79583c3a2 Author: Srish Srinivasan Date: Wed Jun 11 02:49:05 2025 +0530 powerpc/pseries: Correct secvar format representation for static key management On a PLPKS enabled PowerVM LPAR, the secvar format property for static key management is misrepresented as "ibm,plpks-sb-unknown", creating reason for confusion. Static key management mode uses fixed, built-in keys. Dynamic key management mode allows keys to be updated in production to handle security updates without firmware rebuilds. Define a function named plpks_get_sb_keymgmt_mode() to retrieve the key management mode based on the existence of the SB_VERSION property in the firmware. Set the secvar format property to either "ibm,plpks-sb-v" or "ibm,plpks-sb-v0" based on the key management mode, and return the length of the secvar format property. Co-developed-by: Souradeep Signed-off-by: Souradeep Signed-off-by: Srish Srinivasan Tested-by: R Nageswara Sastry Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250610211907.101384-2-ssrish@linux.ibm.com commit 760b9b4f6de9a33ca56a05f950cabe82138d25bd Author: Thomas Fourier Date: Tue Jun 10 16:29:11 2025 +0200 (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer If the device configuration fails (if `dma_dev->device_config()`), `sg_dma_address(&sg)` is not initialized and the jump to `err_dma_prep` leads to calling `dma_unmap_single()` on `sg_dma_address(&sg)`. Signed-off-by: Thomas Fourier Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250610142918.169540-2-fourier.thomas@gmail.com commit 8314312c5286e53045a6c37128ea9ddd9cd5e217 Author: Bart Van Assche Date: Tue Jun 24 14:05:40 2025 -0700 scsi: core: Use scsi_cmd_priv() instead of open-coding it Improve code readability without modifying the behavior of the code. Cc: Hannes Reinecke Cc: John Garry Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250624210541.512910-4-bvanassche@acm.org Reviewed-by: John Garry Signed-off-by: Martin K. Petersen commit b152f199fa43ef96ecb29cefafa1e9b0e02b6f3d Author: Xose Vazquez Perez Date: Tue Jun 24 21:09:25 2025 +0200 scsi: qla2xxx: Remove firmware URL The historic QLogic firmware URL redirects to a Marvell page that only provides drivers. Refer to linux-firmware instead. Cc: Nilesh Javali Cc: James E.J. Bottomley Cc: Martin K. Petersen Cc: QLOGIC ML Cc: LINUX SCSI ML Signed-off-by: Xose Vazquez Perez Link: https://lore.kernel.org/r/20250624190926.115009-1-xose.vazquez@gmail.com Signed-off-by: Martin K. Petersen commit ea988b450690448d5b12ce743a598ade7a8c34b1 Author: Eric Dumazet Date: Mon Jul 7 09:16:34 2025 +0000 udp: remove udp_tunnel_gro_init() Use DEFINE_MUTEX() to initialize udp_tunnel_gro_type_lock. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250707091634.311974-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8a00a173d1a43362ec11e47c09fc5c0b1aa92091 Author: Matthew Gerlach Date: Mon Jul 7 08:44:09 2025 -0700 dt-bindings: net: altr,socfpga-stmmac.yaml: add minItems to iommus Add missing 'minItems: 1' to iommus property of the Altera SOCFPGA SoC implementation of the Synopsys DWMAC. Fixes: 6d359cf464f4 ("dt-bindings: net: Convert socfpga-dwmac bindings to yaml") Signed-off-by: Matthew Gerlach Reviewed-by: Yanteng Si Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250707154409.15527-1-matthew.gerlach@altera.com Signed-off-by: Jakub Kicinski commit ad97cb2ed06a6ba9025fd8bd14fa24369550cbb5 Author: Eduard Zingerman Date: Tue Jul 8 15:08:56 2025 -0700 selftests/bpf: Remove enum64 case from __arg_untrusted test suite The enum64 type used by verifier_global_ptr_args test case requires CONFIG_SCHED_CLASS_EXT. At the moment selftets do not depend on this option. There are just a few enum64 types in the kernel. Instead of tying selftests to implementation details of unrelated sub-systems, just remove enum64 test case. Simple enums are covered and that should be sufficient. Fixes: 68cca81fd57f ("selftests/bpf: tests for __arg_untrusted void * global func params") Reported-by: Amery Hung Signed-off-by: Eduard Zingerman Tested-by: Amery Hung Link: https://lore.kernel.org/r/20250708220856.3059578-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit f7728ea8377127ef77108cfd665ce6b295b14615 Author: Linus Walleij Date: Fri Jul 4 14:54:26 2025 +0200 net: dt-bindings: ixp4xx-ethernet: Support fixed links This ethernet controller is using fixed links for DSA switches in two already existing device trees, so make sure the checker does not complain like this: intel-ixp42x-linksys-wrv54g.dtb: ethernet@c8009000 (intel,ixp4xx-ethernet): 'fixed-link' does not match any of the regexes: '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/net/intel,ixp4xx-ethernet.yaml# intel-ixp42x-usrobotics-usr8200.dtb: ethernet@c800a000 (intel,ixp4xx-ethernet): 'fixed-link' does not match any of the regexes: '^pinctrl-[0-9]+$' from schema $id: http://devicetree.org/schemas/net/intel,ixp4xx-ethernet.yaml# Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507040609.K9KytWBA-lkp@intel.com/ Signed-off-by: Linus Walleij Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250704-ixp4xx-ethernet-binding-fix-v1-1-8ac360d5bc9b@linaro.org Signed-off-by: Jakub Kicinski commit cc59f3b68542a2ef05e7afd0cc329ff8b8a649d0 Author: Bart Van Assche Date: Mon Jun 23 14:59:01 2025 -0700 scsi: ufs: core: Improve return value documentation Some functions return a negative value to indicate an error while other functions return a value != 0 to indicate an error. Document the return value behavior where this documentation is missing and fix the return value documentation where necessary. Add warnings to detect mismatches between documentation and implementation. This matters because several sysfs callback functions only work correctly if a negative value is returned upon error. Signed-off-by: Bart Van Assche Link: https://lore.kernel.org/r/20250623215909.4169007-1-bvanassche@acm.org Signed-off-by: Martin K. Petersen commit eecbb1692f7af0b2e59c8073136c7e9afb86efb5 Merge: 01af00018733ba db38443dcd9f66 Author: Jakub Kicinski Date: Tue Jul 8 18:32:41 2025 -0700 Merge branch 'ipv6-drop-rtnl-from-mcast-c-and-anycast-c' Kuniyuki Iwashima says: ==================== ipv6: Drop RTNL from mcast.c and anycast.c This is a prep series for RCU conversion of RTM_NEWNEIGH, which needs RTNL during neigh_table.{pconstructor,pdestructor}() touching IPv6 multicast code. Currently, IPv6 multicast code is protected by lock_sock() and inet6_dev->mc_lock, and RTNL is not actually needed. In addition, anycast code is also in the same situation and does not need RTNL at all. This series removes RTNL from net/ipv6/{mcast.c,anycast.c} and finally removes setsockopt_needs_rtnl() from do_ipv6_setsockopt(). v2: https://lore.kernel.org/20250624202616.526600-1-kuni1840@gmail.com v1: https://lore.kernel.org/20250616233417.1153427-1-kuni1840@gmail.com ==================== Link: https://patch.msgid.link/20250702230210.3115355-1-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit db38443dcd9f662e05f8fb3e51f6ea6248c135fd Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:32 2025 -0700 ipv6: Remove setsockopt_needs_rtnl(). We no longer need to hold RTNL for IPv6 socket options. Let's remove setsockopt_needs_rtnl(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-16-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit eb1ac9ff6c4a5720b1a1476233be374c5dc44bff Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:31 2025 -0700 ipv6: anycast: Don't hold RTNL for IPV6_JOIN_ANYCAST. inet6_sk(sk)->ipv6_ac_list is protected by lock_sock(). In ipv6_sock_ac_join(), only __dev_get_by_index(), __dev_get_by_flags(), and __in6_dev_get() require RTNL. __dev_get_by_flags() is only used by ipv6_sock_ac_join() and can be converted to RCU version. Let's replace RCU version helper and drop RTNL from IPV6_JOIN_ANYCAST. setsockopt_needs_rtnl() will be removed in the next patch. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-15-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 976fa9b2054f5b5f5eb5488bdc1a230f734992c4 Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:30 2025 -0700 ipv6: anycast: Unify two error paths in ipv6_sock_ac_join(). The next patch will replace __dev_get_by_index() and __dev_get_by_flags() to RCU + refcount version. Then, we will need to call dev_put() in some error paths. Let's unify two error paths to make the next patch cleaner. Note that we add READ_ONCE() for net->ipv6.devconf_all->forwarding and idev->conf.forwarding as we will drop RTNL that protects them. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-14-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit f7fdf13bf103bbe8885f722d63fd9377d034d35f Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:29 2025 -0700 ipv6: anycast: Don't hold RTNL for IPV6_LEAVE_ANYCAST and IPV6_ADDRFORM. inet6_sk(sk)->ipv6_ac_list is protected by lock_sock(). In ipv6_sock_ac_drop() and ipv6_sock_ac_close(), only __dev_get_by_index() and __in6_dev_get() requrie RTNL. Let's replace them with dev_get_by_index() and in6_dev_get() and drop RTNL from IPV6_LEAVE_ANYCAST and IPV6_ADDRFORM. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-13-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 7b6b53a76fcc01797bc37b72c9043a16a6bc0b94 Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:28 2025 -0700 ipv6: anycast: Don't use rtnl_dereference(). inet6_dev->ac_list is protected by inet6_dev->lock, so rtnl_dereference() is a bit rough annotation. As done in mcast.c, we can use ac_dereference() that checks if inet6_dev->lock is held. Let's replace rtnl_dereference() with a new helper ac_dereference(). Note that now addrconf_join_solict() / addrconf_leave_solict() in __ipv6_dev_ac_inc() / __ipv6_dev_ac_dec() does not need RTNL, so we can remove ASSERT_RTNL() there. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-12-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 49b8223fa9c12caa86e31af43c87c938b4438c96 Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:27 2025 -0700 ipv6: mcast: Remove unnecessary ASSERT_RTNL and comment. Now, RTNL is not needed for mcast code, and what's commented in ip6_mc_msfget() is apparent by for_each_pmc_socklock(), which has lockdep annotation for lock_sock(). Let's remove the comment and ASSERT_RTNL() in ipv6_mc_rejoin_groups(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-11-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit e6e14d582dd2cbee362c48a1865f8d03ca0a5611 Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:26 2025 -0700 ipv6: mcast: Don't hold RTNL for MCAST_ socket options. In ip6_mc_source() and ip6_mc_msfilter(), per-socket mld data is protected by lock_sock() and inet6_dev->mc_lock is also held for some per-interface functions. ip6_mc_find_dev_rtnl() only depends on RTNL. If we want to remove it, we need to check inet6_dev->dead under mc_lock to close the race with addrconf_ifdown(), as mentioned earlier. Let's do that and drop RTNL for the rest of MCAST_ socket options. Note that ip6_mc_msfilter() has unnecessary lock dances and they are integrated into one to avoid the last-minute error and simplify the error handling. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-10-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 1e589db3892efde1f76c33ffd2a9da31a5883a3b Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:25 2025 -0700 ipv6: mcast: Don't hold RTNL in ipv6_sock_mc_close(). In __ipv6_sock_mc_close(), per-socket mld data is protected by lock_sock(), and only __dev_get_by_index() and __in6_dev_get() require RTNL. Let's call __ipv6_sock_mc_drop() and drop RTNL in ipv6_sock_mc_close(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-9-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 2ceb71ce7d34e751f91bbca9da3513a2bc29089c Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:24 2025 -0700 ipv6: mcast: Don't hold RTNL for IPV6_DROP_MEMBERSHIP and MCAST_LEAVE_GROUP. In __ipv6_sock_mc_drop(), per-socket mld data is protected by lock_sock(), and only __dev_get_by_index() and __in6_dev_get() require RTNL. Let's use dev_get_by_index() and in6_dev_get() and drop RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. Note that __ipv6_sock_mc_drop() is factorised to reuse in the next patch. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-8-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 1767bb2d47b715a106287a8f963d9ec6cbab4e69 Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:23 2025 -0700 ipv6: mcast: Don't hold RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. In __ipv6_sock_mc_join(), per-socket mld data is protected by lock_sock(), and only __dev_get_by_index() requires RTNL. Let's use dev_get_by_index() and drop RTNL for IPV6_ADD_MEMBERSHIP and MCAST_JOIN_GROUP. Note that we must call rt6_lookup() and dev_hold() under RCU. If rt6_lookup() returns an entry from the exception table, dst_dev_put() could change rt->dev.dst to loopback concurrently, and the original device could lose the refcount before dev_hold() and unblock device registration. dst_dev_put() is called from NETDEV_UNREGISTER and synchronize_net() follows it, so as long as rt6_lookup() and dev_hold() are called within the same RCU critical section, the dev is alive. Even if the race happens, they are synchronised by idev->dead and mcast addresses are cleaned up. For the racy access to rt->dst.dev, we use dst_dev(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-7-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit e01b193e0b50ae849bf60067e111446f19ee2f20 Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:22 2025 -0700 ipv6: mcast: Use in6_dev_get() in ipv6_dev_mc_dec(). As well as __ipv6_dev_mc_inc(), all code in __ipv6_dev_mc_dec() are protected by inet6_dev->mc_lock, and RTNL is not needed. Let's use in6_dev_get() in ipv6_dev_mc_dec() and remove ASSERT_RTNL() in __ipv6_dev_mc_dec(). Now, we can remove the RTNL comment above addrconf_leave_solict() too. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-6-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit d22faae8c55522aa21583598ea2898dc46bc7024 Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:21 2025 -0700 ipv6: mcast: Remove mca_get(). Since commit 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data"), the newly allocated struct ifmcaddr6 cannot be removed until inet6_dev->mc_lock is released, so mca_get() and mc_put() are unnecessary. Let's remove the extra refcounting. Note that mca_get() was only used in __ipv6_dev_mc_inc(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-5-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit dbd40f318cf2f59759bd170c401adc20ba360a3e Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:20 2025 -0700 ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). Since commit 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data"), every multicast resource is protected by inet6_dev->mc_lock. RTNL is unnecessary in terms of protection but still needed for synchronisation between addrconf_ifdown() and __ipv6_dev_mc_inc(). Once we removed RTNL, there would be a race below, where we could add a multicast address to a dead inet6_dev. CPU1 CPU2 ==== ==== addrconf_ifdown() __ipv6_dev_mc_inc() if (idev->dead) <-- false dead = true return -ENODEV; ipv6_mc_destroy_dev() / ipv6_mc_down() mutex_lock(&idev->mc_lock) ... mutex_unlock(&idev->mc_lock) mutex_lock(&idev->mc_lock) ... mutex_unlock(&idev->mc_lock) The race window can be easily closed by checking inet6_dev->dead under inet6_dev->mc_lock in __ipv6_dev_mc_inc() as addrconf_ifdown() will acquire it after marking inet6_dev dead. Let's check inet6_dev->dead under mc_lock in __ipv6_dev_mc_inc(). Note that now __ipv6_dev_mc_inc() no longer depends on RTNL and we can remove ASSERT_RTNL() there and the RTNL comment above addrconf_join_solict(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-4-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 818ae1a5ecb41d82ad180a99c39111f051894d90 Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:19 2025 -0700 ipv6: mcast: Replace locking comments with lockdep annotations. Commit 63ed8de4be81 ("mld: add mc_lock for protecting per-interface mld data") added the same comments regarding locking to many functions. Let's replace the comments with lockdep annotation, which is more helpful. Note that we just remove the comment for mld_clear_zeros() and mld_send_cr(), where mc_dereference() is used in the entry of the function. While at it, a comment for __ipv6_sock_mc_join() is moved back to the correct place. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-3-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit fb60b74e4e5b8e808d51704a678dbf109ee8e6b5 Author: Kuniyuki Iwashima Date: Wed Jul 2 16:01:18 2025 -0700 ipv6: ndisc: Remove __in6_dev_get() in pndisc_{constructor,destructor}(). ipv6_dev_mc_{inc,dec}() has the same check. Let's remove __in6_dev_get() from pndisc_constructor() and pndisc_destructor(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250702230210.3115355-2-kuni1840@gmail.com Signed-off-by: Jakub Kicinski commit 01af00018733ba862b38d37cd0f06f36239cc8b5 Merge: 042ef6aafd3fa2 680acde13ffd10 Author: Jakub Kicinski Date: Tue Jul 8 18:28:10 2025 -0700 Merge branch 'net-xsk-update-tx-queue-consumer' Jason Xing says: ==================== net: xsk: update tx queue consumer Patch 1 makes sure the consumer is updated at the end of generic xmit. Patch 2 adds corresponding test. ==================== Link: https://patch.msgid.link/20250703141712.33190-1-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 680acde13ffd10ae4b95ed7d8f1633df38180462 Author: Jason Xing Date: Thu Jul 3 22:17:12 2025 +0800 selftests/bpf: add a new test to check the consumer update case The subtest sends 33 packets at one time on purpose to see if xsk exitting __xsk_generic_xmit() updates the global consumer of tx queue when reaching the max loop (max_tx_budget, 32 by default). The number 33 can avoid xskq_cons_peek_desc() updates the consumer when it's about to quit sending, to accurately check if the issue that the first patch resolves remains. The new case will not check this issue in zero copy mode. Signed-off-by: Jason Xing Acked-by: Maciej Fijalkowski Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250703141712.33190-3-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 1eb8b0dac1899c4f806b00253ac03b1a039663c0 Author: Jason Xing Date: Thu Jul 3 22:17:11 2025 +0800 net: xsk: update tx queue consumer immediately after transmission For afxdp, the return value of sendto() syscall doesn't reflect how many descs handled in the kernel. One of use cases is that when user-space application tries to know the number of transmitted skbs and then decides if it continues to send, say, is it stopped due to max tx budget? The following formular can be used after sending to learn how many skbs/descs the kernel takes care of: tx_queue.consumers_before - tx_queue.consumers_after Prior to the current patch, in non-zc mode, the consumer of tx queue is not immediately updated at the end of each sendto syscall when error occurs, which leads to the consumer value out-of-dated from the perspective of user space. So this patch requires store operation to pass the cached value to the shared value to handle the problem. More than those explicit errors appearing in the while() loop in __xsk_generic_xmit(), there are a few possible error cases that might be neglected in the following call trace: __xsk_generic_xmit() xskq_cons_peek_desc() xskq_cons_read_desc() xskq_cons_is_valid_desc() It will also cause the premature exit in the while() loop even if not all the descs are consumed. Based on the above analysis, using @sent_frame could cover all the possible cases where it might lead to out-of-dated global state of consumer after finishing __xsk_generic_xmit(). The patch also adds a common helper __xsk_tx_release() to keep align with the zc mode usage in xsk_tx_release(). Signed-off-by: Jason Xing Acked-by: Maciej Fijalkowski Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250703141712.33190-2-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit 042ef6aafd3fa22a0398c1c25c2dc742cba78eed Merge: d18e43dddf2e7f e0f60ba041a008 Author: Jakub Kicinski Date: Tue Jul 8 18:05:27 2025 -0700 Merge branch 'af_unix-introduce-so_inq-scm_inq' Kuniyuki Iwashima says: ==================== af_unix: Introduce SO_INQ & SCM_INQ. We have an application that uses almost the same code for TCP and AF_UNIX (SOCK_STREAM). The application uses TCP_INQ for TCP, but AF_UNIX doesn't have it and requires an extra syscall, ioctl(SIOCINQ) or getsockopt(SO_MEMINFO) as an alternative. Also, ioctl(SIOCINQ) for AF_UNIX SOCK_STREAM is more expensive because it needs to iterate all skb in the receive queue. This series adds a cached field for SIOCINQ to speed it up and introduce SO_INQ, the generic version of TCP_INQ to get the queue length as cmsg in each recvmsg(). ==================== Link: https://patch.msgid.link/20250702223606.1054680-1-kuniyu@google.com Signed-off-by: Jakub Kicinski commit e0f60ba041a0088a48a5064583e8c36306a8f7e3 Author: Kuniyuki Iwashima Date: Wed Jul 2 22:35:19 2025 +0000 selftest: af_unix: Add test for SO_INQ. Let's add a simple test to check the basic functionality of SO_INQ. The test does the following: 1. Create socketpair in self->fd[] 2. Enable SO_INQ 3. Send data via self->fd[0] 4. Receive data from self->fd[1] 5. Compare the SCM_INQ cmsg with ioctl(SIOCINQ) Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250702223606.1054680-8-kuniyu@google.com Signed-off-by: Jakub Kicinski commit df30285b3670bf52e1e5512e4d4482bec5e93c16 Author: Kuniyuki Iwashima Date: Wed Jul 2 22:35:18 2025 +0000 af_unix: Introduce SO_INQ. We have an application that uses almost the same code for TCP and AF_UNIX (SOCK_STREAM). TCP can use TCP_INQ, but AF_UNIX doesn't have it and requires an extra syscall, ioctl(SIOCINQ) or getsockopt(SO_MEMINFO) as an alternative. Let's introduce the generic version of TCP_INQ. If SO_INQ is enabled, recvmsg() will put a cmsg of SCM_INQ that contains the exact value of ioctl(SIOCINQ). The cmsg is also included when msg->msg_get_inq is non-zero to make sockets io_uring-friendly. Note that SOCK_CUSTOM_SOCKOPT is flagged only for SOCK_STREAM to override setsockopt() for SOL_SOCKET. By having the flag in struct unix_sock, instead of struct sock, we can later add SO_INQ support for TCP and reuse tcp_sk(sk)->recvmsg_inq. Note also that supporting custom getsockopt() for SOL_SOCKET will need preparation for other SOCK_CUSTOM_SOCKOPT users (UDP, vsock, MPTCP). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250702223606.1054680-7-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 8b77338eb2af74bb93986e4a8cfd86724168fe39 Author: Kuniyuki Iwashima Date: Wed Jul 2 22:35:17 2025 +0000 af_unix: Cache state->msg in unix_stream_read_generic(). In unix_stream_read_generic(), state->msg is fetched multiple times. Let's cache it in a local variable. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250702223606.1054680-6-kuniyu@google.com Signed-off-by: Jakub Kicinski commit f4e1fb04c12384fb1b69a95c33527b515a652a74 Author: Kuniyuki Iwashima Date: Wed Jul 2 22:35:16 2025 +0000 af_unix: Use cached value for SOCK_STREAM in unix_inq_len(). Compared to TCP, ioctl(SIOCINQ) for AF_UNIX SOCK_STREAM socket is more expensive, as unix_inq_len() requires iterating through the receive queue and accumulating skb->len. Let's cache the value for SOCK_STREAM to a new field during sendmsg() and recvmsg(). The field is protected by the receive queue lock. Note that ioctl(SIOCINQ) for SOCK_DGRAM returns the length of the first skb in the queue. SOCK_SEQPACKET still requires iterating through the queue because we do not touch functions shared with unix_dgram_ops. But, if really needed, we can support it by switching __skb_try_recv_datagram() to a custom version. Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250702223606.1054680-5-kuniyu@google.com Signed-off-by: Jakub Kicinski commit d0aac85449dec992bb8dc2503f2cb9e94ef436db Author: Kuniyuki Iwashima Date: Wed Jul 2 22:35:15 2025 +0000 af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). unix_stream_read_skb() calls skb_recv_datagram() with MSG_DONTWAIT, which is mostly equivalent to sock_error(sk) + skb_dequeue(). In the following patch, we will add a new field to cache the number of bytes in the receive queue. Then, we want to avoid introducing atomic ops in the fast path, so we will reuse the receive queue lock. As a preparation for the change, let's not use skb_recv_datagram() in unix_stream_read_skb(). Note that sock_error() is now moved out of the u->iolock mutex as the mutex does not synchronise the peer's close() at all. Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250702223606.1054680-4-kuniyu@google.com Signed-off-by: Jakub Kicinski commit 772f01049c4b722b28b3f7025b4996379f127ebf Author: Kuniyuki Iwashima Date: Wed Jul 2 22:35:14 2025 +0000 af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). unix_stream_read_skb() checks SOCK_DEAD only when the dequeued skb is OOB skb. unix_stream_read_skb() is called for a SOCK_STREAM socket in SOCKMAP when data is sent to it. The function is invoked via sk_psock_verdict_data_ready(), which is set to sk->sk_data_ready(). During sendmsg(), we check if the receiver has SOCK_DEAD, so there is no point in checking it again later in ->read_skb(). Also, unix_read_skb() for SOCK_DGRAM does not have the test either. Let's remove the SOCK_DEAD test in unix_stream_read_skb(). Signed-off-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250702223606.1054680-3-kuniyu@google.com Signed-off-by: Jakub Kicinski commit b429a5ad19cb4efe63d18388a2a4deebcba742c6 Author: Kuniyuki Iwashima Date: Wed Jul 2 22:35:13 2025 +0000 af_unix: Don't hold unix_state_lock() in __unix_dgram_recvmsg(). When __skb_try_recv_datagram() returns NULL in __unix_dgram_recvmsg(), we hold unix_state_lock() unconditionally. This is because SOCK_SEQPACKET sk needs to return EOF in case its peer has been close()d concurrently. This behaviour totally depends on the timing of the peer's close() and reading sk->sk_shutdown, and taking the lock does not play a role. Let's drop the lock from __unix_dgram_recvmsg() and use READ_ONCE(). Signed-off-by: Kuniyuki Iwashima Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250702223606.1054680-2-kuniyu@google.com Signed-off-by: Jakub Kicinski commit d18e43dddf2e7f4d16764cca14032631ab8ef012 Merge: 80b0dd1c4ed45d 432407c86993a4 Author: Jakub Kicinski Date: Tue Jul 8 17:05:50 2025 -0700 Merge branch 'eth-fbnic-add-firmware-logging-support' Lee Trager says: ==================== eth: fbnic: Add firmware logging support Firmware running on fbnic generates device logs. These logs contain useful information about the device which may or may not be related to the host. Logs are stored in a ring buffer and accessible through DebugFS. ==================== Link: https://patch.msgid.link/20250702192207.697368-1-lee@trager.us Signed-off-by: Jakub Kicinski commit 432407c86993a40d9d3d0bdaf231dfbd79fee39c Author: Lee Trager Date: Wed Jul 2 12:12:12 2025 -0700 eth: fbnic: Create fw_log file in DebugFS Allow reading the firmware log in DebugFS by accessing the fw_log file. Buffer is read while a spinlock is acquired. Signed-off-by: Lee Trager Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250702192207.697368-7-lee@trager.us Signed-off-by: Jakub Kicinski commit ecc53b1b46c892d2e3cf3cf4393b6d219dc4ae3f Author: Lee Trager Date: Wed Jul 2 12:12:11 2025 -0700 eth: fbnic: Enable firmware logging The firmware log buffer is enabled during probe and freed during remove. Early versions of firmware do not support sending logs. Once the mailbox is up driver will enable logging when supported firmware versions are detected. Logging is disabled before the mailbox is freed. Signed-off-by: Lee Trager Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250702192207.697368-6-lee@trager.us Signed-off-by: Jakub Kicinski commit 2e972f32ae5ff7a5592c627932f0001b8fe04a36 Author: Lee Trager Date: Wed Jul 2 12:12:10 2025 -0700 eth: fbnic: Add mailbox support for firmware logs By default firmware will not send logs to the host. This must be explicitly enabled by the driver. The mailbox has the concept of a flag which is a u32 used as a boolean. Lack of flag defaults to a value of false. When enabling logging historical logs may be optionally requested. These are log messages generated by the NIC before the driver was loaded. The driver also sends a log version to support changing the logging format in the future. [SEND_LOGS_REQ] = { [SEND_LOGS] /* flag to request log reporting */ [SEND_LOGS_HISTORY] /* flag to request historical logs */ [SEND_LOGS_VERSION] /* u32 indicating the log format version */ } Logs may be sent to the user either one at a time, or when historical logs are requested in bulk. Firmware may not send more than 14 messages in bulk to prevent flooding the mailbox. [LOG_MSG] = { [LOG_INDEX] /* entry 0 - u64 index of log */ [LOG_MSEC] /* entry 0 - u32 timestamp of log */ [LOG_MSG] /* entry 0 - char log message up to 256 */ [LOG_LENGTH] /* u32 of remaining log items in arrays */ [LOG_INDEX_ARRAY] = { [LOG_INDEX] /* entry 1 - u64 index of log */ [LOG_INDEX] /* entry 2 - u64 index of log */ ... } [LOG_MSEC_ARRAY] = { [LOG_MSEC] /* entry 1 - u32 timestamp of log */ [LOG_MSEC] /* entry 2 - u32 timestamp of log */ ... } [LOG_MSG_ARRAY] = { [LOG_MSG] /* entry 1 - char log message up to 256 */ [LOG_MSG] /* entry 2 - char log message up to 256 */ ... } } Signed-off-by: Lee Trager Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250702192207.697368-5-lee@trager.us Signed-off-by: Jakub Kicinski commit c2b93d6beca8526fb38ccc834def1c987afe24fc Author: Lee Trager Date: Wed Jul 2 12:12:09 2025 -0700 eth: fbnic: Create ring buffer for firmware logs When enabled, firmware may send logs messages which are specific to the device and not the host. Create a ring buffer to store these messages which are read by a user through DebugFS. Buffer access is protected by a spinlock. Signed-off-by: Lee Trager Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250702192207.697368-4-lee@trager.us Signed-off-by: Jakub Kicinski commit e48f6620ee81105bf9414db7cd990bb488603b47 Author: Lee Trager Date: Wed Jul 2 12:12:08 2025 -0700 eth: fbnic: Use FIELD_PREP to generate minimum firmware version Create a new macro based on FIELD_PREP to generate easily readable minimum firmware version ints. This macro will prevent the mistake from the previous patch from happening again. Signed-off-by: Lee Trager Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250702192207.697368-3-lee@trager.us Signed-off-by: Jakub Kicinski commit dd62e960a755cc66bd57068a30ca881339a2957a Author: Lee Trager Date: Wed Jul 2 12:12:07 2025 -0700 eth: fbnic: Fix incorrect minimum firmware version The full minimum version is 0.10.6-0. The six is now correctly defined as patch and shifted appropriately. 0.10.6-0 is a preproduction version of firmware which was released over a year and a half ago. All production devices meet this requirement. Signed-off-by: Lee Trager Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250702192207.697368-2-lee@trager.us Signed-off-by: Jakub Kicinski commit 80b0dd1c4ed45d3ce4cbf6ef91b960c2cb850578 Merge: 0a49abff43782d 70f238c902b8c0 Author: Jakub Kicinski Date: Tue Jul 8 16:59:56 2025 -0700 Merge branch 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux Tariq Toukan says: ==================== mlx5-next updates 2025-07-08 The following pull-request contains common mlx5 updates for your *net-next* tree. v2: https://lore.kernel.org/1751574385-24672-1-git-send-email-tariqt@nvidia.com * 'mlx5-next' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux: net/mlx5: Check device memory pointer before usage net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow net/mlx5: Add IFC bits for PCIe Congestion Event object net/mlx5: Small refactor for general object capabilities net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain ==================== Link: https://patch.msgid.link/1752002102-11316-1-git-send-email-tariqt@nvidia.com Signed-off-by: Jakub Kicinski commit 012b1043420c0bc62e52902499de40b66f37fd6a Author: Yury Norov [NVIDIA] Date: Thu Jun 19 14:26:24 2025 -0400 cpumask: introduce cpumask_random() Propagate find_random_bit() to cpumask API. CC: Andrew Morton Signed-off-by: "Yury Norov [NVIDIA]" commit c56f97c5c71f17d781461d44acb777cd21521b81 Author: Yury Norov [NVIDIA] Date: Thu Jun 19 14:26:23 2025 -0400 bitmap: generalize node_random() Generalize node_random() and make it available to general bitmaps and cpumasks users. Notice, find_first_bit() is generally faster than find_nth_bit(), and we employ it when there's a single set bit in the bitmap. See commit 3e061d924fe9c7b4 ("lib/nodemask: optimize node_random for nodemask with single NUMA node"). CC: Andrew Morton Signed-off-by: "Yury Norov [NVIDIA]" commit 215a3f91713383a3c0d2da82d223a608a3c17ac1 Author: Joel Fernandes Date: Tue Jul 8 15:49:48 2025 +0900 Documentation: gpu: nova-core: Document basics of the Falcon Instances of the Falcon microcontroller appear in modern Nvidia GPUs and are crucial to the GPU boot process. Document some concepts which will make nova-core boot code easier to digest. All the information is derived from public sources such as public documents, OpenRM and Nouveau code. Signed-off-by: Joel Fernandes Reviewed-by: Bagas Sanjaya Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250708-nova-docs-v4-8-9d188772c4c7@nvidia.com Signed-off-by: Danilo Krummrich commit e5e716dbfc8200be57408b2b3294f152913bd8bd Author: Joel Fernandes Date: Tue Jul 8 15:49:47 2025 +0900 Documentation: gpu: nova-core: Document fwsec operation and layout Add explanation of fwsec with diagrams. This helps clarify how the nova-core falcon boot works. Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250708-nova-docs-v4-7-9d188772c4c7@nvidia.com Signed-off-by: Danilo Krummrich commit 952e62240738437dff23f9561e9f3d92a2fc8b99 Author: Joel Fernandes Date: Tue Jul 8 15:49:46 2025 +0900 Documentation: gpu: nova-core: Document devinit process devinit is mentioned in the code. This patch explains it so it is clear what it does. devinit is not only essential at boot-time, but also at runtime due to suspend-resume and things like re-clocking. Signed-off-by: Joel Fernandes Reviewed-by: Bagas Sanjaya Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250708-nova-docs-v4-6-9d188772c4c7@nvidia.com Signed-off-by: Danilo Krummrich commit 5ec879e29948d57f71a54cc943296e5ddc6e8fcb Author: Joel Fernandes Date: Tue Jul 8 15:49:45 2025 +0900 Documentation: gpu: nova-core: Document vbios layout Add detailed explanation and block diagrams of the layout of the vBIOS on Nvidia GPUs. This is important to understand how nova-core boots an Nvidia GPU. [ Applied Timur Tabi's feedback on providing link to BIT documentation. ] Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250708-nova-docs-v4-5-9d188772c4c7@nvidia.com Signed-off-by: Danilo Krummrich commit 7feefbd2a28bf125c4155e49f6c5f7dcd18f9a1b Author: Alexandre Courbot Date: Tue Jul 8 15:49:44 2025 +0900 gpu: nova-core: convert `/*` comments to `//` The second form is preferred, and there was no reason to use the first. Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250708-nova-docs-v4-4-9d188772c4c7@nvidia.com Signed-off-by: Danilo Krummrich commit adc353c0bfb243ebfd29b6222fa3bf149169a6de Author: Arnd Bergmann Date: Fri Jun 20 13:12:12 2025 +0200 kernel: trace: preemptirq_delay_test: use offstack cpu mask A CPU mask on the stack is broken for large values of CONFIG_NR_CPUS: kernel/trace/preemptirq_delay_test.c: In function ‘preemptirq_delay_run’: kernel/trace/preemptirq_delay_test.c:143:1: error: the frame size of 8512 bytes is larger than 1536 bytes [-Werror=frame-larger-than=] Fall back to dynamic allocation here. Cc: Masami Hiramatsu Cc: Song Chen Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250620111215.3365305-1-arnd@kernel.org Fixes: 4b9091e1c194 ("kernel: trace: preemptirq_delay_test: add cpu affinity") Signed-off-by: Arnd Bergmann Signed-off-by: Steven Rostedt (Google) commit 0b980688f630a69f510556eea6f8c21e250f1a02 Author: Joel Fernandes Date: Tue Jul 8 15:49:43 2025 +0900 gpu: nova-core: Clarify falcon code Add documentation strings, comments and AES mode for completeness to the Falcon signatures. Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250708-nova-docs-v4-3-9d188772c4c7@nvidia.com Signed-off-by: Danilo Krummrich commit 3aceaa539cfe3a2e62bd92e6697d9fae1c20c0be Author: Steven Rostedt Date: Mon Jun 9 13:17:32 2025 -0400 tracing: Use queue_rcu_work() to free filters Freeing of filters requires to wait for both an RCU grace period as well as a RCU task trace wait period after they have been detached from their lists. The trace task period can be quite large so the freeing of the filters was moved to use the call_rcu*() routines. The problem with that is that the callback functions of call_rcu*() is done from a soft irq and can cause latencies if the callback takes a bit of time. The filters are freed per event in a system and the syscalls system contains an event per system call, which can be over 700 events. Freeing 700 filters in a bottom half is undesirable. Instead, move the freeing to use queue_rcu_work() which is done in task context. Link: https://lore.kernel.org/all/9a2f0cd0-1561-4206-8966-f93ccd25927f@paulmck-laptop/ Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250609131732.04fd303b@gandalf.local.home Fixes: a9d0aab5eb33 ("tracing: Fix regression of filter waiting a long time on RCU synchronization") Suggested-by: "Paul E. McKenney" Reviewed-by: Paul E. McKenney Signed-off-by: Steven Rostedt (Google) commit 88c79ecfb68fac057a0201db883518b662a0417d Author: Yury Norov Date: Wed Jun 4 20:06:50 2025 -0400 tracing: Replace opencoded cpumask_next_wrap() in move_to_next_cpu() The dedicated cpumask_next_wrap() is more verbose and effective than cpumask_next() followed by cpumask_first(). Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://lore.kernel.org/20250605000651.45281-1-yury.norov@gmail.com Signed-off-by: Yury Norov Signed-off-by: Steven Rostedt (Google) commit 4d3e891388ee8fa6b35d8a528ec0f8f9239799df Author: Joel Fernandes Date: Tue Jul 8 15:49:42 2025 +0900 gpu: nova-core: Clarify sysmembar operations sysmembar is a critical operation that the GSP falcon needs to perform in the reset sequence. Add some code comments to clarify. [acourbot@nvdidia.com: move relevant documentation to SysmemFlush type] Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250708-nova-docs-v4-2-9d188772c4c7@nvidia.com [ Minor grammar fix in the PFB register documentation. - Danilo ] Signed-off-by: Danilo Krummrich commit 017ef1228d735965419ff118fe1b89089e772c42 Author: Shuicheng Lin Date: Mon Jul 7 00:49:14 2025 +0000 drm/xe: Release runtime pm for error path of xe_devcoredump_read() xe_pm_runtime_put() is missed to be called for the error path in xe_devcoredump_read(). Add function description comments for xe_devcoredump_read() to help understand it. v2: more detail function comments and refine goto logic (Matt) Fixes: c4a2e5f865b7 ("drm/xe: Add devcoredump chunking") Cc: stable@vger.kernel.org Reviewed-by: Matthew Brost Signed-off-by: Shuicheng Lin Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250707004911.3502904-6-shuicheng.lin@intel.com commit 8ce560d8e1c6449adb9dc5517ef91404c7810c94 Author: Shuicheng Lin Date: Mon Jul 7 00:49:13 2025 +0000 drm/xe: Remove unused code in devcoredump_snapshot() The deleted code is no longer needed because patch "drm/xe/guc: Plumb GuC-capture into dev coredump" has removed the related usage code. Remove the code to tidy up the function. v2: s/bacause/because Reviewed-by: Zhanjun Dong Reviewed-by: Matthew Brost Cc: Rodrigo Vivi Signed-off-by: Shuicheng Lin Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250707004911.3502904-5-shuicheng.lin@intel.com commit 4a4d4e320a4d0b51f56c4a4bede11d595aa502da Author: Joel Fernandes Date: Tue Jul 8 15:49:41 2025 +0900 gpu: nova-core: Add code comments related to devinit Add several code comments to reduce acronym soup and explain how devinit magic and bootflow works before driver loads. These are essential for debug and development of the nova driver. [acourbot@nvidia.com: reformat and reword a couple of sentences] Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250708-nova-docs-v4-1-9d188772c4c7@nvidia.com Signed-off-by: Danilo Krummrich commit 5f512533b7aa780488c15e001791d1b8000ad50e Author: Danilo Krummrich Date: Sat Jun 21 21:43:34 2025 +0200 samples: rust: pci: reset pci-testdev in unbind() Reset the pci-testdev when the driver is unbound from its device. Link: https://lore.kernel.org/r/20250621195118.124245-9-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 18ebb25dfa18c09474fed78b20808fa445370666 Author: Danilo Krummrich Date: Sat Jun 21 21:43:33 2025 +0200 rust: pci: implement Driver::unbind() Currently, there's really only one core callback for drivers, which is probe(). Now, this isn't entirely true, since there is also the drop() callback of the driver type (serving as the driver's private data), which is returned by probe() and is dropped in remove(). On the C side remove() mainly serves two purposes: (1) Tear down the device that is operated by the driver, e.g. call bus specific functions, write I/O memory to reset the device, etc. (2) Free the resources that have been allocated by a driver for a specific device. The drop() callback mentioned above is intended to cover (2) as the Rust idiomatic way. However, it is partially insufficient and inefficient to cover (1) properly, since drop() can't be called with additional arguments, such as the reference to the corresponding device that has the correct device context, i.e. the Core device context. This makes it inefficient (but not impossible) to access device resources, e.g. to write device registers, and impossible to call device methods, which are only accessible under the Core device context. In order to solve this, add an additional callback for (1), which we call unbind(). The reason for calling it unbind() is that, unlike remove(), it is *only* meant to be used to perform teardown operations on the device (1), but *not* to release resources (2). Link: https://lore.kernel.org/r/20250621195118.124245-8-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 4be5f3fff151e49b0e7a82d33d4d12e91840abde Author: Danilo Krummrich Date: Sat Jun 21 21:43:32 2025 +0200 rust: platform: implement Driver::unbind() Currently, there's really only one core callback for drivers, which is probe(). Now, this isn't entirely true, since there is also the drop() callback of the driver type (serving as the driver's private data), which is returned by probe() and is dropped in remove(). On the C side remove() mainly serves two purposes: (1) Tear down the device that is operated by the driver, e.g. call bus specific functions, write I/O memory to reset the device, etc. (2) Free the resources that have been allocated by a driver for a specific device. The drop() callback mentioned above is intended to cover (2) as the Rust idiomatic way. However, it is partially insufficient and inefficient to cover (1) properly, since drop() can't be called with additional arguments, such as the reference to the corresponding device that has the correct device context, i.e. the Core device context. This makes it inefficient (but not impossible) to access device resources, e.g. to write device registers, and impossible to call device methods, which are only accessible under the Core device context. In order to solve this, add an additional callback for (1), which we call unbind(). The reason for calling it unbind() is that, unlike remove(), it is *only* meant to be used to perform teardown operations on the device (1), but *not* to release resources (2). Link: https://lore.kernel.org/r/20250621195118.124245-7-dakr@kernel.org Signed-off-by: Danilo Krummrich commit c46f60246f9ae372ecc1f10976a8af3914b3f79e Author: Danilo Krummrich Date: Sat Jun 21 21:43:31 2025 +0200 rust: auxiliary: use generic device drvdata accessors Take advantage of the generic drvdata accessors of the generic Device type. While at it, use from_result() instead of match. Link: https://lore.kernel.org/r/20250621195118.124245-6-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 4231712c8e9840c023192032d438f98061b9ee1f Author: Danilo Krummrich Date: Sat Jun 21 21:43:30 2025 +0200 rust: pci: use generic device drvdata accessors Take advantage of the generic drvdata accessors of the generic Device type. While at it, use from_result() instead of match. Link: https://lore.kernel.org/r/20250621195118.124245-5-dakr@kernel.org Signed-off-by: Danilo Krummrich commit f0a68a912c673d8899d863c2f01f1ef7006e0b11 Author: Danilo Krummrich Date: Sat Jun 21 21:43:29 2025 +0200 rust: platform: use generic device drvdata accessors Take advantage of the generic drvdata accessors of the generic Device type. While at it, use from_result() instead of match. Link: https://lore.kernel.org/r/20250621195118.124245-4-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 880dec12a25890e8f5626f04c58d38003f1a5585 Author: Danilo Krummrich Date: Sat Jun 21 21:43:28 2025 +0200 rust: device: add drvdata accessors Implement generic accessors for the private data of a driver bound to a device. Those accessors should be used by bus abstractions from their corresponding core callbacks, such as probe(), remove(), etc. Implementing them for device::CoreInternal guarantees that driver's can't interfere with the logic implemented by the bus abstraction. Acked-by: Benno Lossin Link: https://lore.kernel.org/r/20250621195118.124245-3-dakr@kernel.org [ Improve safety comment as proposed by Benno. - Danilo ] Signed-off-by: Danilo Krummrich commit fa7486d3f9470c58c5971caba7244cc8773672e0 Author: Danilo Krummrich Date: Sat Jun 21 21:43:27 2025 +0200 rust: device: introduce device::CoreInternal Introduce an internal device context, which is semantically equivalent to the Core device context, but reserved for bus abstractions. This allows implementing methods for the Device type, which are limited to be used within the core context of bus abstractions, i.e. restrict the availability for drivers. Link: https://lore.kernel.org/r/20250621195118.124245-2-dakr@kernel.org [ Rename device::Internal to device::CoreInternal. - Danilo ] Signed-off-by: Danilo Krummrich commit b2c4ac219fa46bb6535a8147ac1611b3d6481aa2 Author: Zhanjun Dong Date: Mon Jul 7 19:11:08 2025 -0400 drm/xe/uc: Disable GuC communication on hardware initialization error Disable GuC communication on Xe micro controller hardware initialization error. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4917 Reviewed-by: Jonathan Cavitt Reviewed-by: Matthew Brost Signed-off-by: Zhanjun Dong Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250707231108.3217573-1-zhanjun.dong@intel.com commit ff2aa6495d4beafa84cfdd8c61fc00785fee3d9a Author: Sascha Bischoff Date: Fri Jun 27 10:09:02 2025 +0000 KVM: arm64: gic-v5: Probe for GICv5 Add in a probe function for GICv5 which enables support for GICv3 guests on a GICv5 host, if FEAT_GCIE_LEGACY is supported by the hardware. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Link: https://lore.kernel.org/r/20250627100847.1022515-6-sascha.bischoff@arm.com Signed-off-by: Oliver Upton commit c017e49ed1381001ba7a6521daae8f968b11cf09 Author: Sascha Bischoff Date: Fri Jun 27 10:09:02 2025 +0000 KVM: arm64: gic-v5: Support GICv3 compat Add support for GICv3 compat mode (FEAT_GCIE_LEGACY) which allows a GICv5 host to run GICv3-based VMs. This change enables the VHE/nVHE/hVHE/protected modes, but does not support nested virtualization. A lazy-disable approach is taken for compat mode; it is enabled on the vgic_v3_load path but not disabled on the vgic_v3_put path. A non-GICv3 VM, i.e., one based on GICv5, is responsible for disabling compat mode on the corresponding vgic_v5_load path. Currently, GICv5 is not supported, and hence compat mode is not disabled again once it is enabled, and this function is intentionally omitted from the code. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Link: https://lore.kernel.org/r/20250627100847.1022515-5-sascha.bischoff@arm.com Signed-off-by: Oliver Upton commit b62f4b5dec91b62af2791fb7004f91c92ed1444f Author: Sascha Bischoff Date: Fri Jun 27 10:09:01 2025 +0000 arm64/sysreg: Add ICH_VCTLR_EL2 This system register is required to enable/disable V3 legacy mode when running on a GICv5 host. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Link: https://lore.kernel.org/r/20250627100847.1022515-4-sascha.bischoff@arm.com Signed-off-by: Oliver Upton commit 1ec38ce3d024bebdff2a9ffb526e4d198605204d Author: Sascha Bischoff Date: Fri Jun 27 10:09:01 2025 +0000 irqchip/gic-v5: Populate struct gic_kvm_info Populate the gic_kvm_info struct based on support for FEAT_GCIE_LEGACY. The struct is used by KVM to probe for a compatible GIC. Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Reviewed-by: Lorenzo Pieralisi Link: https://lore.kernel.org/r/20250627100847.1022515-3-sascha.bischoff@arm.com Signed-off-by: Oliver Upton commit 244e9a89ca765cc2395fc7a83833fb79731299fc Author: Sascha Bischoff Date: Fri Jun 27 10:09:01 2025 +0000 irqchip/gic-v5: Skip deactivate for forwarded PPI interrupts If a PPI interrupt is forwarded to a guest, skip the deactivate and only EOI. Rely on the guest deactivating both the virtual and physical interrupts (due to ICH_LRx_EL2.HW being set) later on as part of handling the injected interrupt. This mimics the behaviour seen on native GICv3. This is part of adding support for the GICv3 compatibility mode on a GICv5 host. Reviewed-by: Lorenzo Pieralisi Co-authored-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Sascha Bischoff Link: https://lore.kernel.org/r/20250627100847.1022515-2-sascha.bischoff@arm.com Signed-off-by: Oliver Upton commit 83dcee17855c4e5af037ae3262809036de127903 Author: Shuicheng Lin Date: Tue Jul 8 03:54:25 2025 +0000 drm/xe/pm: Restore display pm if there is error after display suspend xe_bo_evict_all() is called after xe_display_pm_suspend(). So if there is error with xe_bo_evict_all(), display pm should be restored. Fixes: 51462211f4a9 ("drm/xe/pxp: add PXP PM support") Fixes: cb8f81c17531 ("drm/xe/display: Make display suspend/resume work on discrete") Cc: Maarten Lankhorst Cc: Daniele Ceraolo Spurio Cc: John Harrison Signed-off-by: Shuicheng Lin Reviewed-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250708035424.3608190-2-shuicheng.lin@intel.com Signed-off-by: Rodrigo Vivi commit aacb37f597d0b50800a233ab2c29c195a1595147 Author: Eric Biggers Date: Mon Jun 30 10:22:23 2025 -0700 lib/crypto: hash_info: Move hash_info.c into lib/crypto/ crypto/hash_info.c just contains a couple of arrays that map HASH_ALGO_* algorithm IDs to properties of those algorithms. It is compiled only when CRYPTO_HASH_INFO=y, but currently CRYPTO_HASH_INFO depends on CRYPTO. Since this can be useful without the old-school crypto API, move it into lib/crypto/ so that it no longer depends on CRYPTO. This eliminates the need for FS_VERITY to select CRYPTO after it's been converted to use lib/crypto/. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630172224.46909-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 0a49abff43782de9546497392caab0f8bc507545 Merge: 19c066f940666b cd7e8841b61f78 Author: Jakub Kicinski Date: Tue Jul 8 11:56:42 2025 -0700 Merge branch 'net-migrate-remaining-drivers-to-dedicated-_rxfh_context-ops' Jakub Kicinski says: ==================== net: migrate remaining drivers to dedicated _rxfh_context ops Around a year ago Ed added dedicated ops for managing RSS contexts. This significantly improved the clarity of the driver facing API. Migrate the remaining 3 drivers and remove the old way of muxing the RSS context operations via .set_rxfh(). v2: https://lore.kernel.org/20250702030606.1776293-1-kuba@kernel.org v1: https://lore.kernel.org/20250630160953.1093267-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250707184115.2285277-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit cd7e8841b61f78542456ac59a165bdbe7765f496 Author: Jakub Kicinski Date: Mon Jul 7 11:41:15 2025 -0700 net: ethtool: reduce indent for _rxfh_context ops Now that we don't have the compat code we can reduce the indent a little. No functional changes. Reviewed-by: Gal Pressman Reviewed-by: Edward Cree Link: https://patch.msgid.link/20250707184115.2285277-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4e655028c29fbc455fdbbd3ca074443361adfa44 Author: Jakub Kicinski Date: Mon Jul 7 11:41:14 2025 -0700 net: ethtool: remove the compat code for _rxfh_context ops All drivers are now converted to dedicated _rxfh_context ops. Remove the use of >set_rxfh() to manage additional contexts. Reviewed-by: Gal Pressman Reviewed-by: Edward Cree Link: https://patch.msgid.link/20250707184115.2285277-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit afc55a0659a60c6b5cde2907c9454ce8fcb0844f Author: Jakub Kicinski Date: Mon Jul 7 11:41:13 2025 -0700 eth: mlx5: migrate to the *_rxfh_context ops Convert mlx5 to dedicated RXFH ops. This is a fairly shallow conversion, TBH, most of the driver code stays as is, but we let the core allocate the context ID for the driver. mlx5e_rx_res_rss_get_rxfh() and friends are made void, since core only calls the driver for context 0. The second call is right after context creation so it must exist (tm). Tested with drivers/net/hw/rss_ctx.py on MCX6. Reviewed-by: Gal Pressman Link: https://patch.msgid.link/20250707184115.2285277-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit be78c83a8bbb838bed75798a55da59f3b86851c6 Author: Jakub Kicinski Date: Mon Jul 7 11:41:12 2025 -0700 eth: ice: drop the dead code related to rss_contexts ICE appears to have some odd form of rss_context use plumbed in for .get_rxfh. The .set_rxfh side does not support creating contexts, however, so this must be dead code. For at least a year now (since commit 7964e7884643 ("net: ethtool: use the tracking array for get_rxfh on custom RSS contexts")) we have not been calling .get_rxfh with a non-zero rss_context. We just get the info from the RSS XArray under dev->ethtool. Remove what must be dead code in the driver, clear the support flags. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250707184115.2285277-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 62e01d8c4170f32d074ee68aa92a7e7e89380539 Author: Jakub Kicinski Date: Mon Jul 7 11:41:11 2025 -0700 eth: otx2: migrate to the *_rxfh_context ops otx2 only supports additional indirection tables (no separate keys etc.) so the conversion to dedicated callbacks and core-allocated context is mostly removing the code which stores the extra tables in the driver. Core already stores the indirection tables for additional contexts, and doesn't call .get for them. One subtle change here is that we'll now start with the table covering all queues, not directing all traffic to queue 0. This is what core expects if the user doesn't pass the initial indir table explicitly (there's a WARN_ON() in the core trying to make sure driver authors don't forget to populate ctx to defaults). Drivers implementing .create_rxfh_context don't have to set cap_rss_ctx_supported, so remove it. Tested-by: Geetha Sowjanya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250707184115.2285277-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 0b593ef12afce0124612d90cd1768a64d3f27a65 Author: Oliver Upton Date: Tue Jul 8 10:25:32 2025 -0700 KVM: arm64: selftests: Catch up set_id_regs with the kernel Add test coverage for ID_AA64MMFR3_EL1 and the recently added FEAT_DoubleFault2. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-28-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 55ea75f5b27381d4b23e5617de80860a6e7c0477 Author: Oliver Upton Date: Tue Jul 8 10:25:31 2025 -0700 KVM: arm64: selftests: Add SCTLR2_EL1 to get-reg-list Handle SCTLR2_EL1 specially as it is only visible to userspace when FEAT_SCTLR2 is implemented for the VM. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-27-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit a90aac55324920de988cc447f4227c04ad769351 Author: Oliver Upton Date: Tue Jul 8 10:25:30 2025 -0700 KVM: arm64: selftests: Test SEAs are taken to SError vector when EASE=1 Ensure KVM routes SEAs to the correct vector depending on SCTLR2_EL1.EASE. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-26-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 2858ea3083f088a76b439f5b88b6d4f032dabc0c Author: Oliver Upton Date: Tue Jul 8 10:25:29 2025 -0700 KVM: arm64: selftests: Add basic SError injection test Add tests for SError injection considering KVM is more directly involved in delivery: - Pending SErrors are taken at the first CSE after SErrors are unmasked - Pending SErrors aren't taken and remain pending if SErrors are masked - Unmasked SErrors are taken immediately when injected (implementation detail) Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-25-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit bfb7a30b19861e559d64b7f2c3202d948fbf93ea Author: Oliver Upton Date: Tue Jul 8 10:25:28 2025 -0700 KVM: arm64: Don't retire MMIO instruction w/ pending (emulated) SError KVM might have an emulated SError queued for the guest if userspace returned an abort for MMIO. Better yet, it could actually be a *synchronous* exception in disguise if SCTLR2_ELx.EASE is set. Don't advance PC if KVM owes an emulated SError, just like the handling of emulated SEA injection. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-24-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit a3c4a00dbe2013ecc35f910606bd615eaff34cc7 Author: Oliver Upton Date: Tue Jul 8 10:25:27 2025 -0700 KVM: arm64: Advertise support for FEAT_DoubleFault2 KVM's external abort injection now respects the exception routing wreckage due to FEAT_DoubleFault2. Advertise the feature. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-23-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 075c2dc7367e7e80d83adae8db597e48ceb7ba94 Author: Oliver Upton Date: Tue Jul 8 10:25:26 2025 -0700 KVM: arm64: Advertise support for FEAT_SCTLR2 Everything is in place to handle the additional state for SCTLR2_ELx, which is all that FEAT_SCTLR2 implies. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-22-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 1f1c08d9896cf439cca829960df3d6ec3c03619b Author: Oliver Upton Date: Tue Jul 8 10:25:25 2025 -0700 KVM: arm64: nv: Enable vSErrors when HCRX_EL2.TMEA is set Per R_CDCKC, vSErrors are enabled if HCRX_EL2.TMEA is set, regardless of HCR_EL2.AMO. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-21-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 59b6d08666f0424f3e0ade08ab664fac65a09c5d Author: Oliver Upton Date: Tue Jul 8 10:25:24 2025 -0700 KVM: arm64: nv: Honor SError routing effects of SCTLR2_ELx.NMEA As the name might imply, when NMEA is set SErrors are non-maskable and can be taken regardless of PSTATE.A. As is the recurring theme with DoubleFault2, the effects on SError routing are entirely backwards to this. If at EL1, NMEA is *not* considered for SError routing when TMEA is set and the exception is taken to EL2 when PSTATE.A is set. Link: https://lore.kernel.org/r/20250708172532.1699409-20-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit ce66109cec867c9afd2ee1ecf1aff8d73cdb2f89 Author: Oliver Upton Date: Tue Jul 8 10:25:23 2025 -0700 KVM: arm64: nv: Take "masked" aborts to EL2 when HCRX_EL2.TMEA is set HCRX_EL2.TMEA further modifies the external abort behavior where unmasked aborts are taken to EL1 and masked aborts are taken to EL2. It's rather weird when you consider that SEAs are, well, *synchronous* and therefore not actually maskable. However, for the purposes of exception routing, they're considered "masked" if the A flag is set. This gets a bit hairier when considering the fact that TMEA also enables vSErrors, i.e. KVM has delegated the HW vSError context to the guest hypervisor. We can keep the vSError context delegation as-is by taking advantage of a couple properties: - If SErrors are unmasked, the 'physical' SError can be taken in-context immediately. In other words, KVM can emulate the EL1 SError while preserving vEL2's ownership of the vSError context. - If SErrors are masked, the 'physical' SError is taken to EL2 immediately and needs the usual nested exception entry. Note that the new in-context handling has the benign effect where unmasked SError injections are emulated even for non-nested VMs. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-19-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit fff97df2a0bd215979ae224b97e3e4075030a953 Author: Oliver Upton Date: Tue Jul 8 10:25:22 2025 -0700 KVM: arm64: Route SEAs to the SError vector when EASE is set One of the finest additions of FEAT_DoubleFault2 is the ability for software to request *synchronous* external aborts be taken to the SError vector, which of coure are *asynchronous* in nature. Opinions be damned, implement the architecture and send SEAs to the SError vector if EASE is set for the target context. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-18-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 178ec0ae35f8a2181a60a2e7c31d8671cbb56f3a Author: Oliver Upton Date: Tue Jul 8 10:25:21 2025 -0700 KVM: arm64: nv: Ensure Address size faults affect correct ESR For historical reasons, Address size faults are first injected into the guest as an SEA and ESR_EL1 is subsequently modified to reflect the correct FSC. Of course, when dealing with a vEL2 this should poke ESR_EL2. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-17-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 720ef4611c46724a42aea0773248735e4fac509f Author: Oliver Upton Date: Tue Jul 8 10:25:20 2025 -0700 KVM: arm64: Factor out helper for selecting exception target EL Pull out the exception target selection from pend_sync_exception() for general use. Use PSR_MODE_ELxh as a shorthand for the target EL, as SP_ELx selection is handled further along in the hyp's exception emulation. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-16-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit abc693fef30c76eccd29c5db41b122675ac3d102 Author: Oliver Upton Date: Tue Jul 8 10:25:19 2025 -0700 KVM: arm64: Describe SCTLR2_ELx RESx masks External abort injection will soon rely on a sanitised view of SCTLR2_ELx to determine exception routing. Compute the RESx masks. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-15-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 7fb7660b9c0b27ea9043c0f1218d39d3511eabdc Author: Oliver Upton Date: Tue Jul 8 10:25:18 2025 -0700 KVM: arm64: Enable SCTLR2 when advertised to the guest HCRX_EL2.SCTLR2En needs to be set for SCTLR2_EL1 to take effect in hardware (in addition to disabling traps). Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-14-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 02dd33ec88311ed1ce491476cfc5ade7d6505cc2 Author: Oliver Upton Date: Tue Jul 8 10:25:17 2025 -0700 KVM: arm64: Context switch SCTLR2_ELx when advertised to the guest Restore SCTLR2_EL1 with the correct value for the given context when FEAT_SCTLR2 is advertised to the guest. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-13-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 81fbef164766c8fe5b39b91557b47c88946949cc Author: Oliver Upton Date: Tue Jul 8 10:25:16 2025 -0700 KVM: arm64: Wire up SCTLR2_ELx sysreg descriptors Set up the sysreg descriptors for SCTLR2_ELx, along with the associated storage and VNCR mapping. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-12-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 0ead48acc9356eeee41de3aaad7164da40bac7f0 Author: Oliver Upton Date: Tue Jul 8 10:25:15 2025 -0700 KVM: arm64: nv: Describe trap behavior of SCTLR2_EL1 Add the complete trap description for SCTLR2_EL1, including FGT and the inverted HCRX bit. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-11-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit a99456abd834ef03c06ac49ed884853716b8b66e Author: Oliver Upton Date: Tue Jul 8 10:25:14 2025 -0700 KVM: arm64: nv: Advertise support for FEAT_RAS Now that the missing bits for vSError injection/deferral have been added we can merrily claim support for FEAT_RAS. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-10-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 18fbc24707db71793d5187576e09448cf48f8394 Author: Oliver Upton Date: Tue Jul 8 10:25:13 2025 -0700 KVM: arm64: nv: Use guest hypervisor's vSError state When HCR_EL2.AMO is set, physical SErrors are routed to EL2 and virtual SError injection is enabled for EL1. Conceptually treating host-initiated SErrors as 'physical', this means we can delegate control of the vSError injection context to the guest hypervisor when nesting && AMO is set. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-9-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 211fced460f2528339560d443df44b1c7feafaf0 Author: Oliver Upton Date: Tue Jul 8 10:25:12 2025 -0700 KVM: arm64: nv: Add FEAT_RAS vSError sys regs to table Prepare to implement RAS for NV by adding the missing EL2 sysregs for the vSError context. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-8-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 77ee70a073575977b403e9add25f185d614217d8 Author: Oliver Upton Date: Tue Jul 8 10:25:11 2025 -0700 KVM: arm64: nv: Honor SError exception routing / masking To date KVM has used HCR_EL2.VSE to track the state of a pending SError for the guest. With this bit set, hardware respects the EL1 exception routing / masking rules and injects the vSError when appropriate. This isn't correct for NV guests as hardware is oblivious to vEL2's intentions for SErrors. Better yet, with FEAT_NV2 the guest can change the routing behind our back as HCR_EL2 is redirected to memory. Cope with this mess by: - Using a flag (instead of HCR_EL2.VSE) to track the pending SError state when SErrors are unconditionally masked for the current context - Resampling the routing / masking of a pending SError on every guest entry/exit - Emulating exception entry when SError routing implies a translation regime change Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-7-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 9aba641b9ec2a9f443a6c666c054c5e98ef550b5 Author: Oliver Upton Date: Tue Jul 8 10:25:10 2025 -0700 KVM: arm64: nv: Respect exception routing rules for SEAs Synchronous external aborts are taken to EL2 if ELIsInHost() or HCR_EL2.TEA=1. Rework the SEA injection plumbing to respect the imposed routing of the guest hypervisor and opportunistically rephrase things to make their function a bit more obvious. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-6-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 1bba3900ca18bdae28d1b9fa10f16a8f8cb2ada1 Author: Zqiang Date: Wed May 7 19:26:05 2025 +0800 rcu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer access In the preparation stage of CPU online, if the corresponding the rdp's->nocb_cb_kthread does not exist, will be created, there is a situation where the rdp's rcuop kthreads creation fails, and then de-offload this CPU's rdp, does not assign this CPU's rdp->nocb_cb_kthread pointer, but this rdp's->nocb_gp_rdp and rdp's->rdp_gp->nocb_gp_kthread is still valid. This will cause the subsequent re-offload operation of this offline CPU, which will pass the conditional check and the kthread_unpark() will access invalid rdp's->nocb_cb_kthread pointer. This commit therefore use rdp's->nocb_gp_kthread instead of rdp_gp's->nocb_gp_kthread for safety check. Signed-off-by: Zqiang Reviewed-by: Frederic Weisbecker Signed-off-by: Neeraj Upadhyay (AMD) commit e67645bb7f3f48e0dd794ca813ede75f61e1b31b Author: Pavel Begunkov Date: Wed Jul 2 15:29:09 2025 +0100 io_uring/zcrx: prepare fallback for larger pages io_zcrx_copy_chunk() processes one page at a time, which won't be sufficient when the net_iov size grows. Introduce a structure keeping the target niov page and other parameters, it's more convenient and can be reused later. And add a helper function that can efficient copy buffers of an arbitrary length. For 64bit archs the loop inside should be compiled out. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/e84bc705a4e1edeb9aefff470d96558d8232388f.1751466461.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 1b4dc1ff0a8887c2fbb83a48e87284375ab4b02a Author: Pavel Begunkov Date: Wed Jul 2 15:29:08 2025 +0100 io_uring/zcrx: assert area type in io_zcrx_iov_page Add a simple debug assertion to io_zcrx_iov_page() making it's not trying to return pages for a dmabuf area. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/c3c30a926a18436a399a1768f3cc86c76cd17fa7.1751466461.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit b84621d96ee0221e0bfbf9f477bbec7a5077c464 Author: Pavel Begunkov Date: Wed Jul 2 15:29:07 2025 +0100 io_uring/zcrx: allocate sgtable for umem areas Currently, dma addresses for umem areas are stored directly in niovs. It's memory efficient but inconvenient. I need a better format 1) to share code with dmabuf areas, and 2) for disentangling page, folio and niov sizes. dmabuf already provides sg_table, create one for user memory as well. Signed-off-by: Pavel Begunkov Reviewed-by: David Wei Link: https://lore.kernel.org/r/f3c15081827c1bf5427d3a2e693bc526476b87ee.1751466461.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 54e89a93ef05d1a7c9996ff12e42eeecb4f66697 Author: Pavel Begunkov Date: Wed Jul 2 15:29:06 2025 +0100 io_uring/zcrx: introduce io_populate_area_dma Add a helper that initialises page-pool dma addresses from a sg table. It'll be reused in following patches. Signed-off-by: Pavel Begunkov Reviewed-by: David Wei Link: https://lore.kernel.org/r/a8972a77be9b5675abc585d6e2e6e30f9c7dbd85.1751466461.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 06897ddfc523cea415bd139148c5276b8b61b016 Author: Pavel Begunkov Date: Wed Jul 2 15:29:05 2025 +0100 io_uring/zcrx: return error from io_zcrx_map_area_* io_zcrx_map_area_*() helpers return the number of processed niovs, which we use to unroll some of the mappings for user memory areas. It's unhandy, and dmabuf doesn't care about it. Return an error code instead and move failure partial unmapping into io_zcrx_map_area_umem(). Signed-off-by: Pavel Begunkov Reviewed-by: David Wei Link: https://lore.kernel.org/r/42668e82be3a84b07ee8fc76d1d6d5ac0f137fe5.1751466461.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit e9a9ddb15b092eb4dc0d34a3e043e73f2510a6b0 Author: Pavel Begunkov Date: Wed Jul 2 15:29:04 2025 +0100 io_uring/zcrx: always pass page to io_zcrx_copy_chunk io_zcrx_copy_chunk() currently takes either a page or virtual address. Unify the parameters, make it take pages and resolve the linear part into a page the same way general networking code does that. Signed-off-by: Pavel Begunkov Reviewed-by: David Wei Link: https://lore.kernel.org/r/b8f9f4bac027f5f44a9ccf85350912d1db41ceb8.1751466461.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 00c9c9628b49e368d140cfa61d7df9b8922ec2a8 Author: Sarah Newman Date: Fri Jun 27 11:57:28 2025 +0200 drbd: add missing kref_get in handle_write_conflicts With `two-primaries` enabled, DRBD tries to detect "concurrent" writes and handle write conflicts, so that even if you write to the same sector simultaneously on both nodes, they end up with the identical data once the writes are completed. In handling "superseeded" writes, we forgot a kref_get, resulting in a premature drbd_destroy_device and use after free, and further to kernel crashes with symptoms. Relevance: No one should use DRBD as a random data generator, and apparently all users of "two-primaries" handle concurrent writes correctly on layer up. That is cluster file systems use some distributed lock manager, and live migration in virtualization environments stops writes on one node before starting writes on the other node. Which means that other than for "test cases", this code path is never taken in real life. FYI, in DRBD 9, things are handled differently nowadays. We still detect "write conflicts", but no longer try to be smart about them. We decided to disconnect hard instead: upper layers must not submit concurrent writes. If they do, that's their fault. Signed-off-by: Sarah Newman Signed-off-by: Lars Ellenberg Signed-off-by: Christoph Böhmwalder Link: https://lore.kernel.org/r/20250627095728.800688-1-christoph.boehmwalder@linbit.com Signed-off-by: Jens Axboe commit 8e1fab9cccc7b806b0cffdceabb09b310b83b553 Author: Thomas Fourier Date: Fri Jun 27 14:11:19 2025 +0200 block: mtip32xx: Fix usage of dma_map_sg() The dma_map_sg() can fail and, in case of failure, returns 0. If it fails, mtip_hw_submit_io() returns an error. The dma_unmap_sg() requires the nents parameter to be the same as the one passed to dma_map_sg(). This patch saves the nents in command->scatter_ents. Fixes: 88523a61558a ("block: Add driver for Micron RealSSD pcie flash cards") Signed-off-by: Thomas Fourier Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250627121123.203731-2-fourier.thomas@gmail.com Signed-off-by: Jens Axboe commit fc39760cd0f432cd399a209c43dcb887fffdb6dc Author: Frederic Weisbecker Date: Tue Apr 29 15:43:03 2025 +0200 rcu/exp: Warn on QS requested on dying CPU It is not possible to send an IPI to a dying CPU that has passed the CPUHP_TEARDOWN_CPU stage. Remaining unhandled IPIs are handled later at CPUHP_AP_SMPCFD_DYING stage by stop machine. This is the last opportunity for RCU exp handler to request an expedited quiescent state. And the upcoming final context switch between stop machine and idle must have reported the requested context switch. Therefore, it should not be possible to observe a pending requested expedited quiescent state when RCU finally stops watching the outgoing CPU. Once IPIs aren't possible anymore, the QS for the target CPU will be reported on its behalf by the RCU exp kworker. Provide an assertion to verify those expectations. Reviewed-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit bf0a57445d3fddfb47046aeccf4f5cb938a4e996 Author: Frederic Weisbecker Date: Tue Apr 29 15:43:02 2025 +0200 rcu/exp: Remove needless CPU up quiescent state report A CPU coming online checks for an ongoing grace period and reports a quiescent state accordingly if needed. This special treatment that shortcuts the expedited IPI finds its origin as an optimization purpose on the following commit: 338b0f760e84 (rcu: Better hotplug handling for synchronize_sched_expedited() The point is to avoid an IPI while waiting for a CPU to become online or failing to become offline. However this is pointless and even error prone for several reasons: * If the CPU has been seen offline in the first round scanning offline and idle CPUs, no IPI is even tried and the quiescent state is reported on behalf of the CPU. * This means that if the IPI fails, the CPU just became offline. So it's unlikely to become online right away, unless the cpu hotplug operation failed and rolled back, which is a rare event that can wait a jiffy for a new IPI to be issued. * But then the "optimization" applying on failing CPU hotplug down only applies to !PREEMPT_RCU. * This force reports a quiescent state even if ->cpu_no_qs.b.exp is not set. As a result it can race with remote QS reports on the same rdp. Fortunately it happens to be OK but an accident is waiting to happen. For all those reasons, remove this optimization that doesn't look worthy to keep around. Reported-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker Reviewed-by: Paul E. McKenney Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 4b9432ed65cb3a692e8d8bd86abb93f5f2dc5b69 Author: Frederic Weisbecker Date: Tue Apr 29 15:43:01 2025 +0200 rcu/exp: Remove confusing needless full barrier on task unblock A full memory barrier in the RCU-PREEMPT task unblock path advertizes to order the context switch (or rather the accesses prior to rcu_read_unlock()) with the expedited grace period fastpath. However the grace period can not complete without the rnp calling into rcu_report_exp_rnp() with the node locked. This reports the quiescent state in a fully ordered fashion against updater's accesses thanks to: 1) The READ-SIDE smp_mb__after_unlock_lock() barrier across nodes locking while propagating QS up to the root. 2) The UPDATE-SIDE smp_mb__after_unlock_lock() barrier while holding the the root rnp to wait/check for the GP completion. 3) The (perhaps redundant given step 1) and 2)) smp_mb() in rcu_seq_end() before the grace period completes. This makes the explicit barrier in this place superfluous. Therefore remove it as it is confusing. Acked-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit aae35f4ffbf20a09c5a5188ef5ddb3a4b5038df0 Author: Oliver Upton Date: Tue Jul 8 10:25:09 2025 -0700 KVM: arm64: Treat vCPU with pending SError as runnable Per R_VRLPB, a pending SError is a WFI wakeup event regardless of PSTATE.A, meaning that the vCPU is runnable. Sample VSE in addition to the other IRQ lines. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-5-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 1d6fea7663b2d3fc8569cf14c91a49fb9b37067b Author: Marc Zyngier Date: Tue Jul 8 10:25:08 2025 -0700 KVM: arm64: Add helper to identify a nested context A common idiom in the KVM code is to check if we are currently dealing with a "nested" context, defined as having NV enabled, but being in the EL1&0 translation regime. This is usually expressed as: if (vcpu_has_nv(vcpu) && !is_hyp_ctxt(vcpu) ... ) which is a mouthful and a bit hard to read, specially when followed by additional conditions. Introduce a new helper that encapsulate these two terms, allowing the above to be written as if (is_nested_context(vcpu) ... ) which is both shorter and easier to read, and makes more obvious the potential for simplification on some code paths. Signed-off-by: Marc Zyngier Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-4-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit e3fd66620f10cddfcfe062404cf0ed170133bb43 Author: Oliver Upton Date: Tue Jul 8 10:25:07 2025 -0700 arm64: Detect FEAT_DoubleFault2 KVM will soon support FEAT_DoubleFault2. Add a descriptor for the corresponding ID register field. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-3-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit bf49e73dde7dd54bb52e67e0a1b72e748a04d0b4 Author: Oliver Upton Date: Tue Jul 8 10:25:06 2025 -0700 arm64: Detect FEAT_SCTLR2 KVM is about to pick up support for SCTLR2. Add cpucap for later use in the guest/host context switch hot path. Reviewed-by: Marc Zyngier Link: https://lore.kernel.org/r/20250708172532.1699409-2-oliver.upton@linux.dev Signed-off-by: Oliver Upton commit 53bb952a625fd3247647c7a28366ce990a579415 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:21 2025 +0200 arm64: Kconfig: Enable GICv5 Enable GICv5 driver code for the ARM64 architecture. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-31-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 42d36969e307cf0c7a523755a6f66cecb69cd32c Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:20 2025 +0200 docs: arm64: gic-v5: Document booting requirements for GICv5 Document the requirements for booting a kernel on a system implementing a GICv5 interrupt controller. Specifically, other than DT/ACPI providing the required firmware representation, define what traps must be disabled if the kernel is booted at EL1 on a system where EL2 is implemented. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-30-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 695949d8b16f11f2f172d8d0c7ccc1ae09ed6cb7 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:19 2025 +0200 irqchip/gic-v5: Add GICv5 IWB support The GICv5 architecture implements the Interrupt Wire Bridge (IWB) in order to support wired interrupts that cannot be connected directly to an IRS and instead uses the ITS to translate a wire event into an IRQ signal. Add the wired-to-MSI IWB driver to manage IWB wired interrupts. An IWB is connected to an ITS and it has its own deviceID for all interrupt wires that it manages; the IWB input wire number must be exposed to the ITS as an eventID with a 1:1 mapping. This eventID is not programmable and therefore requires a new msi_alloc_info_t flag to make sure the ITS driver does not allocate an eventid for the wire but rather it uses the msi_alloc_info_t.hwirq number to gather the ITS eventID. Co-developed-by: Sascha Bischoff Signed-off-by: Sascha Bischoff Co-developed-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Thomas Gleixner Cc: Marc Zyngier Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-29-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 57d72196dfc8502b7e376ecdffb11c4f8766f26d Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:18 2025 +0200 irqchip/gic-v5: Add GICv5 ITS support The GICv5 architecture implements Interrupt Translation Service (ITS) components in order to translate events coming from peripherals into interrupt events delivered to the connected IRSes. Events (ie MSI memory writes to ITS translate frame), are translated by the ITS using tables kept in memory. ITS translation tables for peripherals is kept in memory storage (device table [DT] and Interrupt Translation Table [ITT]) that is allocated by the driver on boot. Both tables can be 1- or 2-level; the structure is chosen by the driver after probing the ITS HW parameters and checking the allowed table splits and supported {device/event}_IDbits. DT table entries are allocated on demand (ie when a device is probed); the DT table is sized using the number of supported deviceID bits in that that's a system design decision (ie the number of deviceID bits implemented should reflect the number of devices expected in a system) therefore it makes sense to allocate a DT table that can cater for the maximum number of devices. DT and ITT tables are allocated using the kmalloc interface; the allocation size may be smaller than a page or larger, and must provide contiguous memory pages. LPIs INTIDs backing the device events are allocated one-by-one and only upon Linux IRQ allocation; this to avoid preallocating a large number of LPIs to cover the HW device MSI vector size whereas few MSI entries are actually enabled by a device. ITS cacheability/shareability attributes are programmed according to the provided firmware ITS description. The GICv5 partially reuses the GICv3 ITS MSI parent infrastructure and adds functions required to retrieve the ITS translate frame addresses out of msi-map and msi-parent properties to implement the GICv5 ITS MSI parent callbacks. Co-developed-by: Sascha Bischoff Signed-off-by: Sascha Bischoff Co-developed-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Thomas Gleixner Cc: Marc Zyngier Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-28-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 8b65db1e93a227ad9cc1b67cb221b06869f0b35f Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:17 2025 +0200 irqchip/msi-lib: Add IRQ_DOMAIN_FLAG_FWNODE_PARENT handling In some irqchip implementations the fwnode representing the IRQdomain and the MSI controller fwnode do not match; in particular the IRQdomain fwnode is the MSI controller fwnode parent. To support selecting such IRQ domains, add a flag in core IRQ domain code that explicitly tells the MSI lib to use the parent fwnode while carrying out IRQ domain selection. Update the msi-lib select callback with the resulting logic. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Thomas Gleixner Cc: Marc Zyngier Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-27-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit b4ead12d95002b9c65e3c646cf73e0a91c608024 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:16 2025 +0200 irqchip/gic-v3: Rename GICv3 ITS MSI parent The GICv5 ITS will reuse some GICv3 ITS MSI parent functions therefore it makes sense to keep the code functionality in a compilation unit shared by the two drivers. Rename the GICv3 ITS MSI parent file and update the related Kconfig/Makefile entries to pave the way for code sharing. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Thomas Gleixner Cc: Marc Zyngier Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-26-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit cd0ec59affb1f31347170bbafadb9c5cc716bca9 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:15 2025 +0200 PCI/MSI: Add pci_msi_map_rid_ctlr_node() helper function IRQchip drivers need a PCI/MSI function to map a RID to a MSI controller deviceID namespace and at the same time retrieve the struct device_node pointer of the MSI controller the RID is mapped to. Add pci_msi_map_rid_ctlr_node() to achieve this purpose. Cc Bjorn Helgaas Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Thomas Gleixner Cc: Marc Zyngier Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-25-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 31fd3becb920e0b31b99cf202ace637f75dd7e78 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:14 2025 +0200 of/irq: Add of_msi_xlate() helper function Add an of_msi_xlate() helper that maps a device ID and returns the device node of the MSI controller the device ID is mapped to. Required by core functions that need an MSI controller device node pointer at the same time as a mapped device ID, of_msi_map_id() is not sufficient for that purpose. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Rob Herring Cc: Marc Zyngier Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-24-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 03a28dc39838e67164728ad410081352b1589d78 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:13 2025 +0200 irqchip/gic-v5: Enable GICv5 SMP booting Set up IPIs by allocating IPI IRQs for all cpus and call into arm64 core code to initialise IPIs IRQ descriptors and request the related IRQ. Implement hotplug callback to enable interrupts on a cpu and register the cpu with an IRS. Co-developed-by: Sascha Bischoff Signed-off-by: Sascha Bischoff Co-developed-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Thomas Gleixner Cc: Marc Zyngier Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-23-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 0f0101325876859eb463792d4df3fd22b6539d29 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:12 2025 +0200 irqchip/gic-v5: Add GICv5 LPI/IPI support An IRS supports Logical Peripheral Interrupts (LPIs) and implement Linux IPIs on top of it. LPIs are used for interrupt signals that are translated by a GICv5 ITS (Interrupt Translation Service) but also for software generated IRQs - namely interrupts that are not driven by a HW signal, ie IPIs. LPIs rely on memory storage for interrupt routing and state. LPIs state and routing information is kept in the Interrupt State Table (IST). IRSes provide support for 1- or 2-level IST tables configured to support a maximum number of interrupts that depend on the OS configuration and the HW capabilities. On systems that provide 2-level IST support, always allow the maximum number of LPIs; On systems with only 1-level support, limit the number of LPIs to 2^12 to prevent wasting memory (presumably a system that supports a 1-level only IST is not expecting a large number of interrupts). On a 2-level IST system, L2 entries are allocated on demand. The IST table memory is allocated using the kmalloc() interface; the allocation required may be smaller than a page and must be made up of contiguous physical pages if larger than a page. On systems where the IRS is not cache-coherent with the CPUs, cache mainteinance operations are executed to clean and invalidate the allocated memory to the point of coherency making it visible to the IRS components. On GICv5 systems, IPIs are implemented using LPIs. Add an LPI IRQ domain and implement an IPI-specific IRQ domain created as a child/subdomain of the LPI domain to allocate the required number of LPIs needed to implement the IPIs. IPIs are backed by LPIs, add LPIs allocation/de-allocation functions. The LPI INTID namespace is managed using an IDA to alloc/free LPI INTIDs. Associate an IPI irqchip with IPI IRQ descriptors to provide core code with the irqchip.ipi_send_single() method required to raise an IPI. Co-developed-by: Sascha Bischoff Signed-off-by: Sascha Bischoff Co-developed-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Thomas Gleixner Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-22-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 5cb1b6dab2def316671ea2565291a86ad58b884c Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:11 2025 +0200 irqchip/gic-v5: Add GICv5 IRS/SPI support The GICv5 Interrupt Routing Service (IRS) component implements interrupt management and routing in the GICv5 architecture. A GICv5 system comprises one or more IRSes, that together handle the interrupt routing and state for the system. An IRS supports Shared Peripheral Interrupts (SPIs), that are interrupt sources directly connected to the IRS; they do not rely on memory for storage. The number of supported SPIs is fixed for a given implementation and can be probed through IRS IDR registers. SPI interrupt state and routing are managed through GICv5 instructions. Each core (PE in GICv5 terms) in a GICv5 system is identified with an Interrupt AFFinity ID (IAFFID). An IRS manages a set of cores that are connected to it. Firmware provides a topology description that the driver uses to detect to which IRS a CPU (ie an IAFFID) is associated with. Use probeable information and firmware description to initialize the IRSes and implement GICv5 IRS SPIs support through an SPI-specific IRQ domain. The GICv5 IRS driver: - Probes IRSes in the system to detect SPI ranges - Associates an IRS with a set of cores connected to it - Adds an IRQchip structure for SPI handling SPIs priority is set to a value corresponding to the lowest permissible priority in the system (taking into account the implemented priority bits of the IRS and CPU interface). Since all IRQs are set to the same priority value, the value itself does not matter as long as it is a valid one. Co-developed-by: Sascha Bischoff Signed-off-by: Sascha Bischoff Co-developed-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Thomas Gleixner Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-21-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 7ec80fb3f025825e860b433685fb801d6de34bf3 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:10 2025 +0200 irqchip/gic-v5: Add GICv5 PPI support The GICv5 CPU interface implements support for PE-Private Peripheral Interrupts (PPI), that are handled (enabled/prioritized/delivered) entirely within the CPU interface hardware. To enable PPI interrupts, implement the baseline GICv5 host kernel driver infrastructure required to handle interrupts on a GICv5 system. Add the exception handling code path and definitions for GICv5 instructions. Add GICv5 PPI handling code as a specific IRQ domain to: - Set-up PPI priority - Manage PPI configuration and state - Manage IRQ flow handler - IRQs allocation/free - Hook-up a PPI specific IRQchip to provide the relevant methods PPI IRQ priority is chosen as the minimum allowed priority by the system design (after probing the number of priority bits implemented by the CPU interface). Co-developed-by: Sascha Bischoff Signed-off-by: Sascha Bischoff Co-developed-by: Timothy Hayes Signed-off-by: Timothy Hayes Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Thomas Gleixner Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-20-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit e62e1e9493aa7aeba6670db6373031533a4d4ced Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:09 2025 +0200 arm64: Add support for GICv5 GSB barriers The GICv5 architecture introduces two barriers instructions (GSB SYS, GSB ACK) that are used to manage interrupt effects. Rework macro used to emit the SB barrier instruction and implement the GSB barriers on top of it. Suggested-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-19-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit ba1004f861d16f24179f14f13f70c09227ccbffb Author: Marc Zyngier Date: Thu Jul 3 12:25:08 2025 +0200 arm64: smp: Support non-SGIs for IPIs The arm64 arch has relied so far on GIC architectural software generated interrupt (SGIs) to handle IPIs. Those are per-cpu software generated interrupts. arm64 architecture code that allocates the IPIs virtual IRQs and IRQ descriptors was written accordingly. On GICv5 systems, IPIs are implemented using LPIs that are not per-cpu interrupts - they are just normal routable IRQs. Add arch code to set-up IPIs on systems where they are handled using normal routable IRQs. For those systems, force the IRQ affinity (and make it immutable) to the cpu a given IRQ was assigned to. Signed-off-by: Timothy Hayes [lpieralisi: changed affinity set-up, log] Signed-off-by: Lorenzo Pieralisi Cc: Will Deacon Cc: Catalin Marinas Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-18-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 988699f9e6b61d25a1448f7ff3c4a80b41e9d9e6 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:07 2025 +0200 arm64: cpucaps: Add GICv5 CPU interface (GCIE) capability Implement the GCIE capability as a strict boot cpu capability to detect whether architectural GICv5 support is available in HW. Plug it in with a naming consistent with the existing GICv3 CPU interface capability. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-17-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 0bb5b6faa0d562f6f392ba94873f6aa01cf75c2b Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:06 2025 +0200 arm64: cpucaps: Rename GICv3 CPU interface capability In preparation for adding a GICv5 CPU interface capability, rework the existing GICv3 CPUIF capability - change its name and description so that the subsequent GICv5 CPUIF capability can be added with a more consistent naming on top. Suggested-by: Mark Rutland Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-16-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 25374470f91aebbb1ca3f589f0ce57fd39b2d6d3 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:05 2025 +0200 arm64: Disable GICv5 read/write/instruction traps GICv5 trap configuration registers value is UNKNOWN at reset. Initialize GICv5 EL2 trap configuration registers to prevent trapping GICv5 instruction/register access upon entering the kernel. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-15-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 42555929dd250e3502a6963aa57332bb1672f5f2 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:04 2025 +0200 arm64/sysreg: Add ICH_HFGITR_EL2 Add ICH_HFGITR_EL2 register description to sysreg. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-14-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 45d9f8e195cf1374270fedf7d1e0f697068eb49f Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:03 2025 +0200 arm64/sysreg: Add ICH_HFGWTR_EL2 Add ICH_HFGWTR_EL2 register description to sysreg. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-13-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 2e00c5463f6c19b096a016501d50862cf0e3e610 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:02 2025 +0200 arm64/sysreg: Add ICH_HFGRTR_EL2 Add ICH_HFGRTR_EL2 register description. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-12-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit f987581aa78ee4bba5fd1b83296f4a6ddd228c79 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:01 2025 +0200 arm64/sysreg: Add ICC_IDR0_EL1 Add ICC_IDR0_EL1 register description. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-11-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit cfd051c5c83112e9b69e8b24546207191643f41b Author: Lorenzo Pieralisi Date: Thu Jul 3 12:25:00 2025 +0200 arm64/sysreg: Add ICC_PCR_EL1 Add ICC_PCR_EL1 register description. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-10-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 4edcfaf951a28b0663f4e05222d00ac992fab82c Author: Lorenzo Pieralisi Date: Thu Jul 3 12:24:59 2025 +0200 arm64/sysreg: Add ICC_CR0_EL1 Add ICC_CR0_EL1 register description. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-9-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 3037134b1b627afce46669a781a8e9d42437de4c Author: Lorenzo Pieralisi Date: Thu Jul 3 12:24:58 2025 +0200 arm64/sysreg: Add ICC_PPI_{C/S}PENDR_EL1 Add ICC_PPI_{C/S}PENDR_EL1 registers description. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-8-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit d4e375d8fee50ec50b63e47fc6efd1e1e75adb8e Author: Lorenzo Pieralisi Date: Thu Jul 3 12:24:57 2025 +0200 arm64/sysreg: Add ICC_PPI_{C/S}ACTIVER_EL1 Add ICC_PPI_{C/S}ACTIVER_EL1 registers description. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-7-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 231d9dd790bf160d8441912116bbf7435aa32fc1 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:24:56 2025 +0200 arm64/sysreg: Add ICC_PPI_ENABLER_EL1 Add ICC_PPI_ENABLER_EL1 registers sysreg description. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-6-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 4ee38cd9af9dd72ee26645e90eb26b6251ba9acb Author: Lorenzo Pieralisi Date: Thu Jul 3 12:24:55 2025 +0200 arm64/sysreg: Add ICC_PPI_HMR_EL1 Add ICC_PPI_HMR_EL1 registers sysreg description. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-5-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit fb0ad5ed5676f0a8cbee4cd148db1b692bda8a4b Author: Lorenzo Pieralisi Date: Thu Jul 3 12:24:54 2025 +0200 arm64/sysreg: Add ICC_ICSR_EL1 Add ICC_ICSR_EL1 register sysreg description. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-4-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 1bd7238dc705f07dea14040a59378e4b1be7164a Author: Lorenzo Pieralisi Date: Thu Jul 3 12:24:53 2025 +0200 arm64/sysreg: Add ICC_PPI_PRIORITY_EL1 Add ICC_PPI_PRIORITY_EL1 sysreg description. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-3-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 2a30a8124c55804b03a2ec064dbbe1a2bd1d9ad8 Author: Lorenzo Pieralisi Date: Thu Jul 3 12:24:52 2025 +0200 arm64/sysreg: Add GCIE field to ID_AA64PFR2_EL1 Add field reporting the GCIE feature to ID_AA64PFR2_EL1 sysreg. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Jonathan Cameron Reviewed-by: Marc Zyngier Cc: Will Deacon Cc: Catalin Marinas Cc: Marc Zyngier Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-2-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit 7d7299bd07c667e915d62109c10b84cb646fe66a Author: Lorenzo Pieralisi Date: Thu Jul 3 12:24:51 2025 +0200 dt-bindings: interrupt-controller: Add Arm GICv5 The GICv5 interrupt controller architecture is composed of: - one or more Interrupt Routing Service (IRS) - zero or more Interrupt Translation Service (ITS) - zero or more Interrupt Wire Bridge (IWB) Describe a GICv5 implementation by specifying a top level node corresponding to the GICv5 system component. IRS nodes are added as GICv5 system component children. An ITS is associated with an IRS so ITS nodes are described as IRS children - use the hierarchy explicitly in the device tree to define the association. IWB nodes are described as a separate schema. An IWB is connected to a single ITS, the connection is made explicit through the msi-parent property and therefore is not required to be explicit through a parent-child relationship in the device tree. Signed-off-by: Lorenzo Pieralisi Reviewed-by: Rob Herring (Arm) Reviewed-by: Marc Zyngier Cc: Conor Dooley Cc: Rob Herring Cc: Krzysztof Kozlowski Cc: Marc Zyngier Link: https://lore.kernel.org/r/20250703-gicv5-host-v7-1-12e71f1b3528@kernel.org Signed-off-by: Marc Zyngier commit f6f9760320a93930e70ad6016afbabc475bcdd09 Author: Colin Ian King Date: Tue Jul 8 16:18:05 2025 +0100 char: ipmi: remove redundant variable 'type' and check The variable 'type' is assigned the value SI_INVALID which is zero and later checks of 'type' is non-zero (which is always false). The variable is not referenced anywhere else, so it is redundant and so is the check, so remove these. Signed-off-by: Colin Ian King Message-ID: <20250708151805.1893858-1-colin.i.king@gmail.com> Signed-off-by: Corey Minyard commit ba2ff3e1b640ca7aa0841be3dae94daa6b60bf49 Author: Leo Yan Date: Fri Jun 27 17:30:28 2025 +0100 perf: arm_spe: Relax period restriction The minimum interval specified the PMSIDR_EL1.Interval field is a hardware recommendation. However, this value is set by hardware designer before the production. It is not actual hardware limitation but tools currently have no way to test shorter periods. This change relaxes the limitation by allowing any non-zero periods, with simplifying code with clamp_t(). The downside is that small periods may increase the risk of AUX ring buffer overruns. When an overrun occurs, the perf core layer will trigger an irq work to disable the event and wake up the tool in user space to read the trace data. After the tool finishes reading, it will re-enable the AUX event. Signed-off-by: Leo Yan Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20250627163028.3503122-1-leo.yan@arm.com Signed-off-by: Will Deacon commit 58074a0fce66c6c97b35ce8a28ed4e7b780f9a8f Author: Rob Herring (Arm) Date: Wed Jun 11 13:01:14 2025 -0500 perf: arm_pmuv3: Add support for the Branch Record Buffer Extension (BRBE) The ARMv9.2 architecture introduces the optional Branch Record Buffer Extension (BRBE), which records information about branches as they are executed into set of branch record registers. BRBE is similar to x86's Last Branch Record (LBR) and PowerPC's Branch History Rolling Buffer (BHRB). BRBE supports filtering by exception level and can filter just the source or target address if excluded to avoid leaking privileged addresses. The h/w filter would be sufficient except when there are multiple events with disjoint filtering requirements. In this case, BRBE is configured with a union of all the events' desired branches, and then the recorded branches are filtered based on each event's filter. For example, with one event capturing kernel events and another event capturing user events, BRBE will be configured to capture both kernel and user branches. When handling event overflow, the branch records have to be filtered by software to only include kernel or user branch addresses for that event. In contrast, x86 simply configures LBR using the last installed event which seems broken. It is possible on x86 to configure branch filter such that no branches are ever recorded (e.g. -j save_type). For BRBE, events with a configuration that will result in no samples are rejected. Recording branches in KVM guests is not supported like x86. However, perf on x86 allows requesting branch recording in guests. The guest events are recorded, but the resulting branches are all from the host. For BRBE, events with branch recording and "exclude_host" set are rejected. Requiring "exclude_guest" to be set did not work. The default for the perf tool does set "exclude_guest" if no exception level options are specified. However, specifying kernel or user events defaults to including both host and guest. In this case, only host branches are recorded. BRBE can support some additional exception branch types compared to x86. On x86, all exceptions other than syscalls are recorded as IRQ. With BRBE, it is possible to better categorize these exceptions. One limitation relative to x86 is we cannot distinguish a syscall return from other exception returns. So all exception returns are recorded as ERET type. The FIQ branch type is omitted as the only FIQ user is Apple platforms which don't support BRBE. The debug branch types are omitted as there is no clear need for them. BRBE records are invalidated whenever events are reconfigured, a new task is scheduled in, or after recording is paused (and the records have been recorded for the event). The architecture allows branch records to be invalidated by the PE under implementation defined conditions. It is expected that these conditions are rare. Cc: Catalin Marinas Co-developed-by: Anshuman Khandual Signed-off-by: Anshuman Khandual Co-developed-by: Mark Rutland Signed-off-by: Mark Rutland Tested-by: James Clark Signed-off-by: Rob Herring (Arm) tested-by: Adam Young Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250611-arm-brbe-v19-v23-4-e7775563036e@kernel.org [will: Fix sparse warnings about mixed declarations and code. Fix C99 comment syntax.] Signed-off-by: Will Deacon commit 5d95cbf21a4a550f2a2050c947083de2587cf46d Author: Juston Li Date: Wed Jun 11 15:51:23 2025 -0700 gpu/trace: make TRACE_GPU_MEM configurable Move the source to a better place in Device Drivers -> Graphics support now that its configurable. v4: - Move source location (Tvrtko) v3: - Patch introduced to replace per-driver config (Lucas) Signed-off-by: Juston Li Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250611225145.1739201-1-justonli@chromium.org Signed-off-by: Lucas De Marchi commit 9df56b46cd9de4fc51f5e0fbccf5143d7dcb2dcf Author: Guodong Xu Date: Tue Apr 29 16:50:48 2025 +0800 riscv: defconfig: Enable PWM support for SpacemiT K1 SoC Enable CONFIG_PWM and CONFIG_PWM_PXA in the defconfig to support the PWM controller used on the SpacemiT K1 SoC. Signed-off-by: Guodong Xu Reviewed-by: Yixun Lan Signed-off-by: Conor Dooley commit 493e9b0852999c46bbb2d67111b478179f7ae207 Author: Geert Uytterhoeven Date: Tue Jul 8 17:36:48 2025 +0200 riscv: defconfig: Remove CONFIG_SND_SOC_STARFIVE=m The SND_SOC_STARFIVE Kconfig symbol was removed, but it is still enabled in the RISC-V defconfig. Just remove it, as it is no longer needed. Fixes: acc317e5254a739e ("ASoC: starfive: Standardize ASoC menu") Signed-off-by: Geert Uytterhoeven Signed-off-by: Conor Dooley commit bbca931fce262cdb3e5fddcc39e62f3bf9ac25cc Author: Paolo Abeni Date: Tue Jul 8 18:04:28 2025 +0200 vhost/net: enable gso over UDP tunnel support. Vhost net need to know the exact virtio net hdr size to be able to copy such header correctly. Teach it about the newly defined UDP tunnel-related option and update the hdr size computation accordingly. Acked-by: Jason Wang Signed-off-by: Paolo Abeni commit 288f30435132d2f9e7a29ec9b9745a4f9dc7fd37 Author: Paolo Abeni Date: Tue Jul 8 17:55:30 2025 +0200 tun: enable gso over UDP tunnel support. Add new tun features to represent the newly introduced virtio GSO over UDP tunnel offload. Allows detection and selection of such features via the existing TUNSETOFFLOAD ioctl and compute the expected virtio header size and tunnel header offset using the current netdev features, so that we can plug almost seamless the newly introduced virtio helpers to serialize the extended virtio header. Acked-by: Jason Wang Signed-off-by: Paolo Abeni --- v6 -> v7: - rebased v4 -> v5: - encapsulate the guest feature guessing in a tun helper - dropped irrelevant check on xdp buff headroom - do not remove unrelated black line - avoid line len > 80 char v3 -> v4: - virtio tnl-related fields are at fixed offset, cleanup the code accordingly. - use netdev features instead of flags bit to check for the configured offload - drop packet in case of enabled features/configured hdr size mismatch v2 -> v3: - cleaned-up uAPI comments - use explicit struct layout instead of raw buf. commit 56a06bd40fab64448aa6b84aa06b3dc470c1254a Author: Paolo Abeni Date: Tue Jul 8 17:55:02 2025 +0200 virtio_net: enable gso over UDP tunnel support. If the related virtio feature is set, enable transmission and reception of gso over UDP tunnel packets. Most of the work is done by the previously introduced helper, just need to determine the UDP tunnel features inside the virtio_net_hdr and update accordingly the virtio net hdr size. Acked-by: Jason Wang Signed-off-by: Paolo Abeni commit a2fb4bc4e2a6a031683910d85b278c1d25ae5420 Author: Paolo Abeni Date: Tue Jul 8 17:54:59 2025 +0200 net: implement virtio helpers to handle UDP GSO tunneling. The virtio specification are introducing support for GSO over UDP tunnel. This patch brings in the needed defines and the additional virtio hdr parsing/building helpers. The UDP tunnel support uses additional fields in the virtio hdr, and such fields location can change depending on other negotiated features - specifically VIRTIO_NET_F_HASH_REPORT. Try to be as conservative as possible with the new field validation. Existing implementation for plain GSO offloads allow for invalid/ self-contradictory values of such fields. With GSO over UDP tunnel we can be more strict, with no need to deal with legacy implementation. Since the checksum-related field validation is asymmetric in the driver and in the device, introduce a separate helper to implement the new checks (to be used only on the driver side). Note that while the feature space exceeds the 64-bit boundaries, the guest offload space is fixed by the specification of the VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET command to a 64-bit size. Prior to the UDP tunnel GSO support, each guest offload bit corresponded to the feature bit with the same value and vice versa. Due to the limited 'guest offload' space, relevant features in the high 64 bits are 'mapped' to free bits in the lower range. That is simpler than defining a new command (and associated features) to exchange an extended guest offloads set. As a consequence, the uAPIs also specify the mapped guest offload value corresponding to the UDP tunnel GSO features. Acked-by: Jason Wang Signed-off-by: Paolo Abeni -- v4 -> v5: - avoid lines above 80 chars v3 -> v4: - fixed offset for UDP GSO tunnel, update accordingly the helpers - tried to clarified vlan_hlen semantic - virtio_net_chk_data_valid() -> virtio_net_handle_csum_offload() v2 -> v3: - add definitions for possible vnet hdr layouts with tunnel support v1 -> v2: - 'relay' -> 'rely' typo - less unclear comment WRT enforced inner GSO checks - inner header fields are allowed only with 'modern' virtio, thus are always le - clarified in the commit message the need for 'mapped features' defines - assume little_endian is true when UDP GSO is enabled. - fix inner proto type value commit 3b17aa13015cc50e2e3a0eac13c128002628a99c Author: Paolo Abeni Date: Tue Jul 8 17:54:57 2025 +0200 virtio_net: add supports for extended offloads The virtio_net driver needs it to implement GSO over UDP tunnel offload. The only missing piece is mapping them to/from the extended features. Acked-by: Jason Wang Signed-off-by: Paolo Abeni commit 333c515d189657c934470c9b0b8a8fedb016ce6f Author: Paolo Abeni Date: Tue Jul 8 17:54:54 2025 +0200 vhost-net: allow configuring extended features Use the extended feature type for 'acked_features' and implement two new ioctls operation allowing the user-space to set/query an unbounded amount of features. The actual number of processed features is limited by VIRTIO_FEATURES_MAX and attempts to set features above such limit fail with EOPNOTSUPP. Note that: the legacy ioctls implicitly truncate the negotiated features to the lower 64 bits range and the 'acked_backend_features' field don't need conversion, as the only negotiated feature there is in the low 64 bit range. Acked-by: Jason Wang Signed-off-by: Paolo Abeni commit 69b9461512246599ed80cf13358e7e6aff7285f9 Author: Paolo Abeni Date: Tue Jul 8 17:54:52 2025 +0200 virtio_pci_modern: allow configuring extended features The virtio specifications allows for up to 128 bits for the device features. Soon we are going to use some of the 'extended' bits features (above 64) for the virtio_net driver. Extend the virtio pci modern driver to support configuring the full virtio features range, replacing the unrolled loops reading and writing the features space with explicit one bounded to the actual features space size in word and implementing the get_extended_features callback. Note that in vp_finalize_features() we only need to cache the lower 64 features bits, to process the transport features. Acked-by: Jason Wang Signed-off-by: Paolo Abeni commit e7d4c1c5a54648fd5b787a4a0f81521ec7260bcd Author: Paolo Abeni Date: Tue Jul 8 17:54:49 2025 +0200 virtio: introduce extended features The virtio specifications allows for up to 128 bits for the device features. Soon we are going to use some of the 'extended' bits features (above 64) for the virtio_net driver. Introduce extended features as a fixed size array of u64. To minimize the diffstat allows legacy driver to access the low 64 bits via a transparent union. Introduce an extended get_extended_features configuration callback that devices supporting the extended features range must implement in place of the traditional one. Note that legacy and transport features don't need any change, as they are always in the low 64 bit range. Acked-by: Jason Wang Signed-off-by: Paolo Abeni commit eade9f57ca7245cc59072706f0f1fdbc446fda61 Author: Paolo Abeni Date: Tue Jul 8 17:54:46 2025 +0200 scripts/kernel_doc.py: properly handle VIRTIO_DECLARE_FEATURES The mentioned macro introduce by the next patch will foul kdoc; fully expand the mentioned macro to avoid the issue. Signed-off-by: Paolo Abeni commit 19c066f940666bf6c0982635e4441100ca8d75bc Author: Xin Guo Date: Sun Jul 6 00:36:47 2025 +0800 tcp: update the outdated ref draft-ietf-tcpm-rack As RACK-TLP was published as a standards-track RFC8985, so the outdated ref draft-ietf-tcpm-rack need to be updated. Signed-off-by: Xin Guo Reviewed-by: Neal Cardwell Link: https://patch.msgid.link/20250705163647.301231-1-guoxin0309@gmail.com Signed-off-by: Jakub Kicinski commit c523058713abac66b0d83ae12a0574d76cd7df2b Author: Heiner Kallweit Date: Thu Jul 3 07:55:52 2025 +0200 net: phy: declare package-related struct members only if CONFIG_PHY_PACKAGE is enabled Now that we have an own config symbol for the PHY package module, we can use it to reduce size of these structs if it isn't enabled. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/f0daefa4-406a-4a06-a4f0-7e31309f82bc@gmail.com Signed-off-by: Jakub Kicinski commit a41851bea7bfb627d00dc51252857019594b5758 Author: Fengyuan Gong Date: Wed Jul 2 16:07:41 2025 +0000 net: account for encap headers in qdisc pkt len Refine qdisc_pkt_len_init to include headers up through the inner transport header when computing header size for encapsulations. Also refine net/sched/sch_cake.c borrowed from qdisc_pkt_len_init(). Signed-off-by: Fengyuan Gong Reviewed-by: Willem de Bruijn Reviewed-by: Eric Dumazet Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250702160741.1204919-1-gfengyuan@google.com Signed-off-by: Jakub Kicinski commit 7725a35e7409cf00fa03717e87e00a810eacfbf7 Merge: effdbb29fdd205 401581f2863e86 Author: Jakub Kicinski Date: Tue Jul 8 08:54:28 2025 -0700 Merge branch 'support-some-features-for-the-hibmcge-driver' Jijie Shao says: ==================== Support some features for the HIBMCGE driver v4: https://lore.kernel.org/20250701125446.720176-1-shaojijie@huawei.com v3: https://lore.kernel.org/20250626020613.637949-1-shaojijie@huawei.com v2: https://lore.kernel.org/20250623034129.838246-1-shaojijie@huawei.com v1: https://lore.kernel.org/20250619144423.2661528-1-shaojijie@huawei.com ==================== Link: https://patch.msgid.link/20250702125716.2875169-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 401581f2863e869a0ea628a755d219ada8eac791 Author: Jijie Shao Date: Wed Jul 2 20:57:16 2025 +0800 net: hibmcge: configure FIFO thresholds according to the MAC controller documentation Configure FIFO thresholds according to the MAC controller documentation Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702125716.2875169-4-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 1051404babef52e0d2d768ec3adceddb19f85704 Author: Jijie Shao Date: Wed Jul 2 20:57:15 2025 +0800 net: hibmcge: adjust the burst len configuration of the MAC controller to improve TX performance. Adjust the burst len configuration of the MAC controller to improve TX performance. Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702125716.2875169-3-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 1d7cd7a9c69c2f59ee80a15bd6f3650aa518125a Author: Jijie Shao Date: Wed Jul 2 20:57:14 2025 +0800 net: hibmcge: support scenario without PHY Currently, the driver uses phylib to operate PHY by default. On some boards, the PHY device is separated from the MAC device. As a result, the hibmcge driver cannot operate the PHY device. In this patch, the driver determines whether a PHY is available based on register configuration. If no PHY is available, the driver will use fixed_phy to register fake phydev. Signed-off-by: Jijie Shao Reviewed-by: Larysa Zaremba Link: https://patch.msgid.link/20250702125716.2875169-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 3e89a8c6835476aa782da80585dee9ddae651eea Author: Andy Yan Date: Mon Apr 21 18:21:54 2025 +0800 drm/rockchip: vop2: Fix the update of LAYER/PORT select registers when there are multi display output on rk3588/rk3568 The all video ports of rk3568/rk3588 share the same OVL_LAYER_SEL and OVL_PORT_SEL registers, and the configuration of these two registers can be set to take effect when the vsync signal arrives at a certain Video Port. If two threads for two display output choose to update these two registers simultaneously to meet their own plane adjustment requirements(change plane zpos or switch plane from one crtc to another), then no matter which Video Port'svsync signal we choose to follow for these two registers, the display output of the other Video Port will be abnormal. This is because the configuration of this Video Port does not take effect at the right time (its configuration should take effect when its VSYNC signal arrives). In order to solve this problem, when performing plane migration or change the zpos of planes, there are two things to be observed and followed: 1. When a plane is migrated from one VP to another, the configuration of the layer can only take effect after the Port mux configuration is enabled. 2. When change the zpos of planes, we must ensure that the change for the previous VP takes effect before we proceed to change the next VP. Otherwise, the new configuration might overwrite the previous one for the previous VP, or it could lead to the configuration of the previous VP being take effect along with the VSYNC of the new VP. This issue only occurs in scenarios where multi-display output is enabled. Fixes: c5996e4ab109 ("drm/rockchip: vop2: Make overlay layer select register configuration take effect by vsync") Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250421102156.424480-1-andyshrk@163.com commit 6a1b9229ecf11f409edd9392c96bded1672ea5f3 Author: Andy Yan Date: Mon May 12 20:46:09 2025 +0800 drm/rockchip: inno_hdmi: Simpify clk get/enable by devm_clk_get_enabled api Make use of devm_clk_get_enabled() to replace devm_clk_get() and clk_prepare_enable(), which will make the cleanup of clk code simpler. Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250512124615.2848731-9-andyshrk@163.com commit 078bb17c7bbfe5bb119943fb7a9ef4f9a8c8c543 Author: Andy Yan Date: Mon May 12 20:46:08 2025 +0800 drm/rockchip: inno_hdmi: switch i2c registration to devm functions Switch from i2c_add_adapter() to resource managed devm_i2c_add_adapter(), which will make the cleanup code more simpler. Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250512124615.2848731-8-andyshrk@163.com commit 1749267beee76bfd8108f5071afb870903c83dab Author: Andy Yan Date: Mon May 12 20:46:07 2025 +0800 drm/rockchip: inno_hdmi: Use sleep_range instead of udelay usleep_range is preferred over udelay. Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250512124615.2848731-7-andyshrk@163.com commit 52ac749b4505339a321b9695fe9d2977294c98da Author: Andy Yan Date: Mon May 12 20:46:06 2025 +0800 drm/rockchip: inno_hdmi: Move ddc/i2c configuration and HOTPLUG unmute to inno_hdmi_init_hw Putting these scattered initialization code together is helpful for the following migration to the DRM bridge driver mode. Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250512124615.2848731-6-andyshrk@163.com commit 55137487bdee89189873e437452a077bb591f33a Author: Andy Yan Date: Mon May 12 20:46:05 2025 +0800 drm/rockchip: inno_hdmi: Rename function inno_hdmi_reset to inno_hdmi_init_hw This function not only configure hardware reset register, but also do some other configurations. Therefore, it is more appropriate to name it inno_hdmi_init_hw, which will also facilitate the addition of other functions to this function in the following patch. Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250512124615.2848731-5-andyshrk@163.com commit effdbb29fdd205db9a816077844bca9f79a1feec Author: Faisal Bukhari Date: Sat Jul 5 08:38:41 2025 +0530 netlink: spelling: fix appened -> appended in a comment Fix spelling mistake in net/netlink/af_netlink.c appened -> appended Signed-off-by: Faisal Bukhari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250705030841.353424-1-faisalbukhari523@gmail.com Signed-off-by: Jakub Kicinski commit 301af832db545fee3590e49ebf0649cdf2ca04d8 Merge: e27dba1951cec8 ab34e14258cd3b Author: Jakub Kicinski Date: Tue Jul 8 08:37:22 2025 -0700 Merge branch 'net-remove-unused-function-parameters-in-skbuff-c' Michal Luczaj says: ==================== net: Remove unused function parameters in skbuff.c Couple of cleanup patches to get rid of unused function parameters around skbuff.c, plus little things spotted along the way. Offshoot of my question in [1], but way more contained. Found by adding "-Wunused-parameter -Wno-error" to KBUILD_CFLAGS and grepping for specific skbuff.c warnings. [1]: https://lore.kernel.org/netdev/972af569-0c90-4585-9e1f-f2266dab6ec6@rbox.co/ v2: https://lore.kernel.org/20250626-splice-drop-unused-v2-0-3268fac1af89@rbox.co v1: https://lore.kernel.org/20250624-splice-drop-unused-v1-0-cf641a676d04@rbox.co ==================== Link: https://patch.msgid.link/20250702-splice-drop-unused-v3-0-55f68b60d2b7@rbox.co Signed-off-by: Jakub Kicinski commit ab34e14258cd3b6d93ce2d6539a83f740dea8219 Author: Michal Luczaj Date: Wed Jul 2 15:38:12 2025 +0200 net: skbuff: Drop unused @skb Since its introduction in commit 6fa01ccd8830 ("skbuff: Add pskb_extract() helper function"), pskb_carve_frag_list() never used the argument @skb. Drop it and adapt the only caller. No functional change intended. Reviewed-by: Simon Horman Signed-off-by: Michal Luczaj Signed-off-by: Jakub Kicinski commit ad0ac6cd9c046e7726e4cd5b985f19750ddcdf34 Author: Michal Luczaj Date: Wed Jul 2 15:38:11 2025 +0200 net: skbuff: Drop unused @skb Since its introduction in commit ce098da1497c ("skbuff: Introduce slab_build_skb()"), __slab_build_skb() never used the @skb argument. Remove it and adapt both callers. No functional change intended. Reviewed-by: Simon Horman Signed-off-by: Michal Luczaj Signed-off-by: Jakub Kicinski commit 25489a4f556414445d342951615178368ee45cde Author: Michal Luczaj Date: Wed Jul 2 15:38:08 2025 +0200 net: splice: Drop unused @gfp Since its introduction in commit 2e910b95329c ("net: Add a function to splice pages into an skbuff for MSG_SPLICE_PAGES"), skb_splice_from_iter() never used the @gfp argument. Remove it and adapt callers. No functional change intended. Reviewed-by: Simon Horman Signed-off-by: Michal Luczaj Link: https://patch.msgid.link/20250702-splice-drop-unused-v3-2-55f68b60d2b7@rbox.co Signed-off-by: Jakub Kicinski commit 1024f1207161bd1c9e3460d4ca94ab8f4f48519a Author: Michal Luczaj Date: Wed Jul 2 15:38:07 2025 +0200 net: splice: Drop unused @pipe Since commit 41c73a0d44c9 ("net: speedup skb_splice_bits()"), __splice_segment() and spd_fill_page() do not use the @pipe argument. Drop it. While adapting the callers, move one line to enforce reverse xmas tree order. No functional change intended. Reviewed-by: Simon Horman Signed-off-by: Michal Luczaj Link: https://patch.msgid.link/20250702-splice-drop-unused-v3-1-55f68b60d2b7@rbox.co Signed-off-by: Jakub Kicinski commit 7431c5462c7f20b7f111c9957a007b8de5b8a76a Author: Andy Yan Date: Mon May 12 20:46:04 2025 +0800 drm/rockchip: inno_hdmi: Remove unnecessary parentheses to make checkpatch happy Remove unnecessary parentheses to make checkpatch happy. Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250512124615.2848731-4-andyshrk@163.com commit 372a927f93fe0477dd1a5f15f11888391f8ef33f Author: Andy Yan Date: Mon May 12 20:46:03 2025 +0800 drm/rockchip: inno_hdmi: Refactor register macros to make checkpatch happy 1. Prefer using the BIT macro 2. Macro argument 'n' as '(n)' to avoid precedence issues 3. Add a blank line after enum declarations Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250512124615.2848731-3-andyshrk@163.com commit 9c3111df6a681f7b0057f05e7211a98d240237eb Author: Andy Yan Date: Mon May 12 20:46:02 2025 +0800 drm/rockchip: inno_hdmi: Merge register definition to c file Since this register definition is only use in one single c file, there is no need to put it in a separate header. Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250512124615.2848731-2-andyshrk@163.com commit 52008d6fe7fa84ecf23864c5cc373beb085f30b9 Author: Yumeng Fang Date: Thu May 15 20:35:54 2025 +0800 drm/rockchip: dw_hdmi: Use dev_err_probe() to simplify code In the probe path, dev_err() can be replaced with dev_err_probe() which will check if error code is -EPROBE_DEFER and prints the error name. It also sets the defer probe reason which can be checked later through debugfs. Signed-off-by: Yumeng Fang Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250515203554564-j1jBXUXR6bdiN6zARicC@zte.com.cn commit afbbca25d06e2d361016da43dbb90f3a6034913b Author: Chaoyi Chen Date: Thu May 29 15:13:34 2025 +0800 drm/rockchip: cdn-dp: Convert to drm bridge Convert it to drm bridge driver, it will be convenient for us to migrate the connector part to the display driver later. Considering that some code depend on the connector, the following changes have been made: - Only process edid in &drm_bridge_funcs.edid_read(), so no need to store additional edid info. - Now cdn_dp_get_sink_capability() only focused on reading DPCD_REV. - Update bpc info in cdn_dp_bridge_atomic_enable() instead of cdn_dp_encoder_mode_set(). Actually, the bpc data will be used in cdn_dp_bridge_atomic_enable(). - Switch to use DRM_BRIDGE_OP_DP_AUDIO helpers. This patch also convert to use devm_drm_bridge_alloc() API. Tested with RK3399 EVB IND board. Signed-off-by: Chaoyi Chen Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250529071334.441-1-kernel@airkyi.com commit f9f68bf1d0efeadb6c427c9dbb30f307a7def19b Author: Heiko Stuebner Date: Tue Jun 10 23:27:48 2025 +0200 drm/rockchip: vop2: fail cleanly if missing a primary plane for a video-port Each window of a vop2 is usable by a specific set of video ports, so while binding the vop2, we look through the list of available windows trying to find one designated as primary-plane and usable by that specific port. The code later wants to use drm_crtc_init_with_planes with that found primary plane, but nothing has checked so far if a primary plane was actually found. For whatever reason, the rk3576 vp2 does not have a usable primary window (if vp0 is also in use) which brought the issue to light and ended in a null-pointer dereference further down. As we expect a primary-plane to exist for a video-port, add a check at the end of the window-iteration and fail probing if none was found. Fixes: 604be85547ce ("drm/rockchip: Add VOP2 driver") Reviewed-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250610212748.1062375-1-heiko@sntech.de commit 40a382aae1d4a4ca07fe19b0d16b4fbc1eeace9f Author: Chaoyi Chen Date: Mon May 26 09:58:34 2025 +0800 drm/rockchip: lvds: Convert to drm bridge Convert it to drm bridge driver, it will be convenient for us to migrate the connector part to the display driver later. Signed-off-by: Chaoyi Chen [on a not-upstream px30 board with lvds display] Tested-by: Heiko Stuebner Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250526015834.102-1-kernel@airkyi.com commit e27dba1951cec8385e20d6700990d819c0de4ba0 Author: Rob Herring (Arm) Date: Thu Jul 3 13:34:57 2025 -0500 net: Use of_reserved_mem_region_to_resource{_byname}() for "memory-region" Use the newly added of_reserved_mem_region_to_resource{_byname}() functions to handle "memory-region" properties. The error handling is a bit different for mtk_wed_mcu_load_firmware(). A failed match of the "memory-region-names" would skip the entry, but then other errors in the lookup and retrieval of the address would not skip the entry. However, that distinction is not really important. Either the region is available and usable or it is not. So now, errors from of_reserved_mem_region_to_resource() are ignored so the region is simply skipped. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250703183459.2074381-1-robh@kernel.org Signed-off-by: Jakub Kicinski commit f142028e30ca96cd0f490be7af54a60f59de7a45 Author: Ahelenia Ziemiańska Date: Thu Jul 3 20:21:20 2025 +0200 gve: global: fix "for a while" typo Signed-off-by: Ahelenia Ziemiańska Reviewed-by: Simon Horman Link: https://patch.msgid.link/5zsbhtyox3cvbntuvhigsn42uooescbvdhrat6s3d6rczznzg5@tarta.nabijaczleweli.xyz Signed-off-by: Jakub Kicinski commit 60687c2c5c3d04ba4704300dce460c55455f7abe Author: Ahelenia Ziemiańska Date: Thu Jul 3 20:21:16 2025 +0200 atm: lanai: fix "take a while" typo Signed-off-by: Ahelenia Ziemiańska Reviewed-by: Simon Horman Link: https://patch.msgid.link/mn5rh6i773csmcrpfcr6bogvv2auypz2jwjn6dap2rxousxnw5@tarta.nabijaczleweli.xyz Signed-off-by: Jakub Kicinski commit b5daf93b809d13a194f8a8eeacfab1cfa241bbc3 Author: Cristian Marussi Date: Mon Jul 7 15:42:20 2025 +0100 firmware: arm_scmi: Avoid notifier registration for unsupported events Some platforms may be configured to not support notification events from certain sources. This scenario is already handled gracefully by avoiding any attempt to send a notification enable request for those sources, as such requests would inevitably fail. However, in a more extreme case, a platform might not support even a single source for a given event type. In this situation, allowing notifier registration is meaningless. Attempting to register a notifier would serve no purpose and only result in unnecessary overhead. To address this, we now detect such conditions during the protocol initialization. When identified, we flag the unsupported event types and reject any subsequent notifier registration attempts for them with -ENOTSUPP. This early rejection avoids redundant processing and simplifies runtime logic. Signed-off-by: Cristian Marussi Message-Id: <20250707144220.485365-1-cristian.marussi@arm.com> Signed-off-by: Sudeep Holla commit d7567e9b9ba53861390830ee18b9fb2035ca81c4 Author: Anshuman Khandual Date: Wed Jun 11 13:01:13 2025 -0500 KVM: arm64: nvhe: Disable branch generation in nVHE guests While BRBE can record branches within guests, the host recording branches in guests is not supported by perf (though events are). Support for BRBE in guests will supported by providing direct access to BRBE within the guests. That is how x86 LBR works for guests. Therefore, BRBE needs to be disabled on guest entry and restored on exit. For nVHE, this requires explicit handling for guests. Before entering a guest, save the BRBE state and disable the it. When returning to the host, restore the state. For VHE, it is not necessary. We initialize BRBCR_EL1.{E1BRE,E0BRE}=={0,0} at boot time, and HCR_EL2.TGE==1 while running in the host. We configure BRBCR_EL2.{E2BRE,E0HBRE} to enable branch recording in the host. When entering the guest, we set HCR_EL2.TGE==0 which means BRBCR_EL1 is used instead of BRBCR_EL2. Consequently for VHE, BRBE recording is disabled at EL1 and EL0 when running a guest. Should recording in guests (by the host) ever be desired, the perf ABI will need to be extended to distinguish guest addresses (struct perf_branch_entry.priv) for starters. BRBE records would also need to be invalidated on guest entry/exit as guest/host EL1 and EL0 records can't be distinguished. Signed-off-by: Anshuman Khandual Signed-off-by: Mark Rutland Co-developed-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) Tested-by: James Clark Reviewed-by: Leo Yan Reviewed-by: Suzuki K Poulose Acked-by: Marc Zyngier Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250611-arm-brbe-v19-v23-3-e7775563036e@kernel.org Signed-off-by: Will Deacon commit ae344bcb0d4967f6aa5f7b02f86bcfd389e513e4 Author: Anshuman Khandual Date: Wed Jun 11 13:01:12 2025 -0500 arm64: Handle BRBE booting requirements To use the Branch Record Buffer Extension (BRBE), some configuration is necessary at EL3 and EL2. This patch documents the requirements and adds the initial EL2 setup code, which largely consists of configuring the fine-grained traps and initializing a couple of BRBE control registers. Before this patch, __init_el2_fgt() would initialize HDFGRTR_EL2 and HDFGWTR_EL2 with the same value, relying on the read/write trap controls for a register occupying the same bit position in either register. The 'nBRBIDR' trap control only exists in bit 59 of HDFGRTR_EL2, while bit 59 of HDFGWTR_EL2 is RES0, and so this assumption no longer holds. To handle HDFGRTR_EL2 and HDFGWTR_EL2 having (slightly) different bit layouts, __init_el2_fgt() is changed to accumulate the HDFGRTR_EL2 and HDFGWTR_EL2 control bits separately. While making this change the open-coded value (1 << 62) is replaced with HDFG{R,W}TR_EL2_nPMSNEVFR_EL1_MASK. The BRBCR_EL1 and BRBCR_EL2 registers are unusual and require special initialisation: even though they are subject to E2H renaming, both have an effect regardless of HCR_EL2.TGE, even when running at EL2. So we must initialize BRBCR_EL2 in case we run in nVHE mode. This is handled in __init_el2_brbe() with a comment to explain the situation. Cc: Marc Zyngier Cc: Oliver Upton Reviewed-by: Leo Yan Tested-by: James Clark Signed-off-by: Anshuman Khandual [Mark: rewrite commit message, fix typo in comment] Signed-off-by: Mark Rutland Co-developed-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) tested-by: Adam Young Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250611-arm-brbe-v19-v23-2-e7775563036e@kernel.org Signed-off-by: Will Deacon commit 52e4a56ab8b85a11ffc017eaec5b2f38642a43ba Author: Anshuman Khandual Date: Wed Jun 11 13:01:11 2025 -0500 arm64/sysreg: Add BRBE registers and fields This patch adds definitions related to the Branch Record Buffer Extension (BRBE) as per ARM DDI 0487K.a. These will be used by KVM and a BRBE driver in subsequent patches. Some existing BRBE definitions in asm/sysreg.h are replaced with equivalent generated definitions. Cc: Marc Zyngier Reviewed-by: Mark Brown Signed-off-by: Anshuman Khandual Signed-off-by: Mark Rutland Tested-by: James Clark Acked-by: Will Deacon Signed-off-by: Rob Herring (Arm) tested-by: Adam Young Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250611-arm-brbe-v19-v23-1-e7775563036e@kernel.org Signed-off-by: Will Deacon commit 0e86f3eb83c0d90ec082ceac925a500ec6ad604e Author: Colin Ian King Date: Thu Jul 3 11:22:19 2025 +0100 net/mlx5: Fix spelling mistake "disabliing" -> "disabling" There is a spelling mistake in a NL_SET_ERR_MSG_MOD message. Fix it. Signed-off-by: Colin Ian King Reviewed-by: Mark Bloch Link: https://patch.msgid.link/20250703102219.1248399-1-colin.i.king@gmail.com Signed-off-by: Jakub Kicinski commit e21354aea4b4420b53c44e36828607a7c94a994c Merge: 482c7e296edc0f 203dcde881561f Author: Maarten Lankhorst Date: Tue Jul 8 16:49:07 2025 +0200 Merge remote-tracking branch 'drm/drm-next' into drm-misc-next Pull in drm-intel-next for the updates to drm panic handling. Signed-off-by: Maarten Lankhorst commit 25050181b61aa0153f3a378a5472d134f8e4ef25 Author: Pankaj Raghav Date: Mon Jun 30 12:40:18 2025 +0200 fs/libfs: don't assume blocksize <= PAGE_SIZE in generic_check_addressable Since [1], it is possible for filesystems to have blocksize > PAGE_SIZE of the system. Remove the assumption and make the check generic for all blocksizes in generic_check_addressable(). [1] https://lore.kernel.org/linux-xfs/20240822135018.1931258-1-kernel@pankajraghav.com/ Reviewed-by: Jan Kara Signed-off-by: Pankaj Raghav Link: https://lore.kernel.org/20250630104018.213985-1-p.raghav@samsung.com Reviewed-by: Zhang Yi Reviewed-by: Baokun Li Signed-off-by: Christian Brauner commit 77eb64439ad52d8afb57bb4dae24a2743c68f50d Author: Pankaj Raghav Date: Thu Jun 26 13:32:23 2025 +0200 fs/buffer: remove the min and max limit checks in __getblk_slow() All filesystems will already check the max and min value of their block size during their initialization. __getblk_slow() is a very low-level function to have these checks. Remove them and only check for logical block size alignment. As this check with logical block size alignment might never trigger, add WARN_ON_ONCE() to the check. As WARN_ON_ONCE() will already print the stack, remove the call to dump_stack(). Suggested-by: Matthew Wilcox Reviewed-by: Jan Kara Signed-off-by: Pankaj Raghav Link: https://lore.kernel.org/20250626113223.181399-1-p.raghav@samsung.com Reviewed-by: Baokun Li Signed-off-by: Christian Brauner commit 04a2c4b4511d186b0fce685da21085a5d4acd370 Author: Sasha Levin Date: Sun Jun 29 03:40:21 2025 -0400 fs: Prevent file descriptor table allocations exceeding INT_MAX When sysctl_nr_open is set to a very high value (for example, 1073741816 as set by systemd), processes attempting to use file descriptors near the limit can trigger massive memory allocation attempts that exceed INT_MAX, resulting in a WARNING in mm/slub.c: WARNING: CPU: 0 PID: 44 at mm/slub.c:5027 __kvmalloc_node_noprof+0x21a/0x288 This happens because kvmalloc_array() and kvmalloc() check if the requested size exceeds INT_MAX and emit a warning when the allocation is not flagged with __GFP_NOWARN. Specifically, when nr_open is set to 1073741816 (0x3ffffff8) and a process calls dup2(oldfd, 1073741880), the kernel attempts to allocate: - File descriptor array: 1073741880 * 8 bytes = 8,589,935,040 bytes - Multiple bitmaps: ~400MB - Total allocation size: > 8GB (exceeding INT_MAX = 2,147,483,647) Reproducer: 1. Set /proc/sys/fs/nr_open to 1073741816: # echo 1073741816 > /proc/sys/fs/nr_open 2. Run a program that uses a high file descriptor: #include #include int main() { struct rlimit rlim = {1073741824, 1073741824}; setrlimit(RLIMIT_NOFILE, &rlim); dup2(2, 1073741880); // Triggers the warning return 0; } 3. Observe WARNING in dmesg at mm/slub.c:5027 systemd commit a8b627a introduced automatic bumping of fs.nr_open to the maximum possible value. The rationale was that systems with memory control groups (memcg) no longer need separate file descriptor limits since memory is properly accounted. However, this change overlooked that: 1. The kernel's allocation functions still enforce INT_MAX as a maximum size regardless of memcg accounting 2. Programs and tests that legitimately test file descriptor limits can inadvertently trigger massive allocations 3. The resulting allocations (>8GB) are impractical and will always fail systemd's algorithm starts with INT_MAX and keeps halving the value until the kernel accepts it. On most systems, this results in nr_open being set to 1073741816 (0x3ffffff8), which is just under 1GB of file descriptors. While processes rarely use file descriptors near this limit in normal operation, certain selftests (like tools/testing/selftests/core/unshare_test.c) and programs that test file descriptor limits can trigger this issue. Fix this by adding a check in alloc_fdtable() to ensure the requested allocation size does not exceed INT_MAX. This causes the operation to fail with -EMFILE instead of triggering a kernel warning and avoids the impractical >8GB memory allocation request. Fixes: 9cfe015aa424 ("get rid of NR_OPEN and introduce a sysctl_nr_open") Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin Link: https://lore.kernel.org/20250629074021.1038845-1-sashal@kernel.org Signed-off-by: Christian Brauner commit f55b3ca3cf1d1652c4b3481b671940461331d69f Author: Ahelenia Ziemiańska Date: Thu Jul 3 20:21:09 2025 +0200 tracing: doc: fix "for a while" typo Signed-off-by: Ahelenia Ziemiańska Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/xygdnynf7m55p7d27ovzqtdjaa7pua3bxuk5c22cnmoovaji5e@tarta.nabijaczleweli.xyz commit 3ed92345e920e6448f4f8788985dd8294a668e6b Author: Sumeet Pawnikar Date: Sat Jul 5 20:46:17 2025 +0530 Documentation: Remove duplicate word size in bootconfig Remove duplicate word size in bootconfig.rst Signed-off-by: Sumeet Pawnikar Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250705151618.4806-1-sumeet4linux@gmail.com commit 5d77dcc07fde1a544e822bf5af745fede32623cf Author: Jonathan Corbet Date: Thu Jul 3 12:44:03 2025 -0600 docs: kdoc: pretty up dump_enum() Add some comments to dump_enum to help the next person who has to figure out what it is actually doing. Reviewed-by: Mauro Carvalho Chehab Tested-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250703184403.274408-8-corbet@lwn.net commit 92fb8091c0728418e4980ccb22d1db5a1737fe5a Author: Jonathan Corbet Date: Thu Jul 3 12:44:02 2025 -0600 docs: kdoc: Remove a Python 2 comment We no longer support Python 2 in the docs build chain at all, so we certainly do not need to admonish folks to keep this file working with it. Cc: Jani Nikula Reviewed-by: Mauro Carvalho Chehab Acked-by: Jani Nikula Tested-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250703184403.274408-7-corbet@lwn.net commit 414ccf92ae07486f84572d88fe02a256c852dca1 Author: Jonathan Corbet Date: Thu Jul 3 12:44:01 2025 -0600 docs: kdoc: some tweaks to process_proto_function() Add a set of comments to process_proto_function and reorganize the logic slightly; no functional change. Reviewed-by: Mauro Carvalho Chehab Tested-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250703184403.274408-6-corbet@lwn.net commit b8ac0259f80e12d12cc72572c097b31caf524c88 Author: Jonathan Corbet Date: Thu Jul 3 12:44:00 2025 -0600 docs: kdoc: rework type prototype parsing process_proto_type() is using a complex regex and a "while True" loop to split a declaration into chunks and, in the end, count brackets. Switch to using a simpler regex to just do the split directly, and handle each chunk as it comes. The result is, IMO, easier to understand and reason about. The old algorithm would occasionally elide the space between function parameters; see struct rng_alg->generate(), foe example. The only output difference is to not elide that space, which is more correct. Reviewed-by: Mauro Carvalho Chehab Tested-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250703184403.274408-5-corbet@lwn.net commit 061a1c1a27c9ea7ae5d99f72b579d542e767a3e2 Author: Jonathan Corbet Date: Thu Jul 3 12:43:59 2025 -0600 docs: kdoc: remove the brcount floor in process_proto_type() Putting the floor under brcount does not change the output in any way, just remove it. Change the termination test from ==0 to <=0 to prevent infinite loops in case somebody does something truly wacko in the code. Reviewed-by: Mauro Carvalho Chehab Tested-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250703184403.274408-4-corbet@lwn.net commit 8078e0ed1f3f3bac776b412b0f85ada86f91fef0 Author: Jonathan Corbet Date: Thu Jul 3 12:43:58 2025 -0600 docs: kdoc: micro-optimize KernRe Rework _add_regex() to avoid doing the lookup twice for the (hopefully common) cache-hit case. Reviewed-by: Mauro Carvalho Chehab Tested-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250703184403.274408-3-corbet@lwn.net commit e7e540363cc52207c5245ad934180db1a1f96522 Author: Jonathan Corbet Date: Thu Jul 3 12:43:57 2025 -0600 docs: kdoc: don't reinvent string.strip() process_proto_type() and process_proto_function() reinventing the strip() string method with a whole series of separate regexes; take all that out and just use strip(). The previous implementation also (in process_proto_type()) removed C++ comments *after* the above dance, leaving trailing whitespace in that case; now we do the stripping afterward. This results in exactly one output change: the removal of a spurious space in the definition of BACKLIGHT_POWER_REDUCED - see https://docs.kernel.org/gpu/backlight.html#c.backlight_properties. I note that we are putting semicolons after #define lines that really shouldn't be there - a task for another day. Reviewed-by: Mauro Carvalho Chehab Tested-by: Akira Yokosawa Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250703184403.274408-2-corbet@lwn.net commit 5a593def8bb61a6c036069f1c166a6fe62c0a49a Author: Jens Axboe Date: Tue Jul 8 07:57:02 2025 -0600 Documentation: remove reference to pktcdvd in cdrom documentation pktcdvd got killed in a previous commit, remove the reference to it as well in the cdrom documentation. Fixes: 1cea5180f2f8 ("block: remove pktcdvd driver") Reported-by: Stephen Rothwell Signed-off-by: Jens Axboe commit 94de1dfd4729c21c156051ffd1ee30cfdab1b58e Author: Matt Atwood Date: Mon Jul 7 13:19:59 2025 -0700 drm/xe/ptl: Drop force_probe requirement Panther Lake has proven to be stable through testing and use. Remove the force_probe requirement and enable the platform by default. Signed-off-by: Matt Atwood Link: https://lore.kernel.org/r/20250707201959.319406-1-matthew.s.atwood@intel.com Signed-off-by: Rodrigo Vivi commit e22da4685013922ade8e7b5e727ac6804fe5b51e Author: Hannes Reinecke Date: Tue Jul 1 16:46:57 2025 +0200 net/handshake: Add new parameter 'HANDSHAKE_A_ACCEPT_KEYRING' Add a new netlink parameter 'HANDSHAKE_A_ACCEPT_KEYRING' to provide the serial number of the keyring to use. Signed-off-by: Hannes Reinecke Reviewed-by: Chuck Lever Acked-by: Jakub Kicinski Link: https://patch.msgid.link/20250701144657.104401-1-hare@kernel.org Signed-off-by: Paolo Abeni commit 344b6580472451390d070c65c27f59716a1deecb Author: Masahiro Yamada Date: Wed Jun 25 21:55:20 2025 +0900 arm64: fix unnecessary rebuilding when CONFIG_DEBUG_EFI=y When CONFIG_DEBUG_EFI is enabled, some objects are needlessly rebuilt. [Steps to reproduce] Enable CONFIG_DEBUG_EFI and run 'make' twice in a clean source tree. On the second run, arch/arm64/kernel/head.o is rebuilt even though no files have changed. $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- clean $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- [ snip ] $ make ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- CALL scripts/checksyscalls.sh AS arch/arm64/kernel/head.o AR arch/arm64/kernel/built-in.a AR arch/arm64/built-in.a AR built-in.a [ snip ] The issue is caused by the use of the $(realpath ...) function. At the time arch/arm64/kernel/Makefile is parsed on the first run, $(objtree)/vmlinux does not exist. As a result, $(realpath $(objtree)/vmlinux) expands to an empty string. On the second run of Make, $(objtree)/vmlinux already exists, so $(realpath $(objtree)/vmlinux) expands to the absolute path of vmlinux. However, this change in the command line causes arch/arm64/kernel/head.o to be rebuilt. To address this issue, use $(abspath ...) instead, which does not require the file to exist. While $(abspath ...) does not resolve symlinks, this should be fine from a debugging perspective. The GNU Make manual [1] clearly explains the difference between the two: $(realpath names...) For each file name in names return the canonical absolute name. A canonical name does not contain any . or .. components, nor any repeated path separators (/) or symlinks. In case of a failure the empty string is returned. Consult the realpath(3) documentation for a list of possible failure causes. $(abspath namees...) For each file name in names return an absolute name that does not contain any . or .. components, nor any repeated path separators (/). Note that, in contrast to realpath function, abspath does not resolve symlinks and does not require the file names to refer to an existing file or directory. Use the wildcard function to test for existence. The same problem exists in drivers/firmware/efi/libstub/Makefile.zboot. On the first run of Make, $(obj)/vmlinuz.efi.elf does not exist when the Makefile is parsed, so -DZBOOT_EFI_PATH is set to an empty string. Replace $(realpath ...) with $(abspath ...) there as well. [1]: https://www.gnu.org/software/make/manual/make.html#File-Name-Functions Fixes: 757b435aaabe ("efi: arm64: Add vmlinux debug link to the Image binary") Fixes: a050910972bb ("efi/libstub: implement generic EFI zboot") Signed-off-by: Masahiro Yamada Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250625125555.2504734-1-masahiroy@kernel.org Signed-off-by: Will Deacon commit 5d288658eec1a2e00ccd231d2b336eed58c0e5c2 Author: Wang Liang Date: Wed Jul 2 18:44:17 2025 +0800 net: replace ADDRLABEL with dynamic debug ADDRLABEL only works when it was set in compilation phase. Replace it with net_dbg_ratelimited(). Signed-off-by: Wang Liang Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702104417.1526138-1-wangliang74@huawei.com Signed-off-by: Paolo Abeni commit b8b7570a7ec872f2a27b775c4f8710ca8a357adf Author: Christoph Hellwig Date: Mon Jul 7 14:52:23 2025 +0200 nvme-pci: fix dma unmapping when using PRPs and not using the IOVA mapping The current version of the blk_rq_dma_map support in nvme-pci tries to reconstruct the DMA mappings from the on the wire descriptors if they are needed for unmapping. While this is not the case for the direct mapping fast path and the IOVA path, it is needed for the non-IOVA slow path, e.g. when using the interconnect is not dma coherent, when using swiotlb bounce buffering, or a IOMMU mapping that can't coalesce. While the reconstruction is easy and works fine for the SGL path, where the on the wire representation maps 1:1 to DMA mappings, the code to reconstruct the DMA mapping ranges from PRPs can't always work, as a given PRP layout can come from different DMA mappings, and the current code doesn't even always get that right. Give up on this approach and track the actual DMA mapping when actually needed again. Fixes: 7ce3c1dd78fc ("nvme-pci: convert the data mapping to blk_rq_dma_map") Reported-by: Ben Copeland Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Tested-by: Jens Axboe Link: https://lore.kernel.org/r/20250707125223.3022531-1-hch@lst.de Signed-off-by: Jens Axboe commit 9d1869f0f537d26005a521a141dde759fc3303f5 Author: Breno Leitao Date: Mon Jul 7 09:01:08 2025 -0700 arm64: remove CONFIG_VMAP_STACK checks from entry code With VMAP_STACK now always enabled on arm64, remove all CONFIG_VMAP_STACK conditionals from entry handling in arch/arm64/kernel/entry-common.c and arch/arm64/kernel/entry.S. This change unconditionally includes the bad stack handling and overflow detection logic, simplifying the code and reflecting the mandatory use of VMAP_STACK for all arm64 kernel builds. Signed-off-by: Breno Leitao Acked-by: Ard Biesheuvel Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707-arm64_vmap-v1-8-8de98ca0f91c@debian.org Signed-off-by: Will Deacon commit 3e72b9e9f01a4851640a095de688a031d9259f5d Author: Breno Leitao Date: Mon Jul 7 09:01:07 2025 -0700 arm64: remove CONFIG_VMAP_STACK checks from SDEI stack handling With VMAP_STACK now always enabled on arm64, remove all CONFIG_VMAP_STACK conditionals from SDEI stack allocation and initialization in arch/arm64/kernel/sdei.c. This change unconditionally defines the SDEI stack pointers and replaces runtime checks with BUILD_BUG_ON() assertions, ensuring that the code is only built when VMAP_STACK is enabled. This simplifies the logic and reflects the mandatory use of VMAP_STACK for all arm64 kernel builds. Signed-off-by: Breno Leitao Acked-by: Ard Biesheuvel Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707-arm64_vmap-v1-7-8de98ca0f91c@debian.org Signed-off-by: Will Deacon commit 907cb5cd8efdae8672b7fd45047d130a430179f6 Author: Breno Leitao Date: Mon Jul 7 09:01:06 2025 -0700 arm64: remove CONFIG_VMAP_STACK checks from stacktrace overflow logic With VMAP_STACK now always enabled on arm64, remove all CONFIG_VMAP_STACK conditionals from overflow stack handling in stacktrace code. This change unconditionally defines the per-CPU overflow_stack and stackinfo_get_overflow() helper in arch/arm64/include/asm/stacktrace.h, and always includes the overflow stack in the stack_info array in arch/arm64/kernel/stacktrace.c. Also, drop redundant CONFIG_VMAP_STACK checks from SDEI stack declarations. Signed-off-by: Breno Leitao Acked-by: Ard Biesheuvel Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707-arm64_vmap-v1-6-8de98ca0f91c@debian.org Signed-off-by: Will Deacon commit e5692bba1e6667441836e13f723112e4aeec3028 Author: Breno Leitao Date: Mon Jul 7 09:01:05 2025 -0700 arm64: remove CONFIG_VMAP_STACK conditionals from traps overflow stack With VMAP_STACK now always enabled on arm64, remove the CONFIG_VMAP_STACK checks from overflow stack definitions and related code in arch/arm64/kernel/traps.c. The overflow_stack and panic_bad_stack() logic are now unconditionally included, simplifying the source and matching the mandatory stack model. Signed-off-by: Breno Leitao Acked-by: Ard Biesheuvel Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707-arm64_vmap-v1-5-8de98ca0f91c@debian.org Signed-off-by: Will Deacon commit c4a5699d5cefd9d6a6a1d326297d5de6e8e0adde Author: Breno Leitao Date: Mon Jul 7 09:01:04 2025 -0700 arm64: remove CONFIG_VMAP_STACK conditionals from irq stack setup With VMAP_STACK always enabled on arm64, drop the CONFIG_VMAP_STACK checks and legacy irq stack allocation from arch/arm64/kernel/irq.c. The code now unconditionally uses the VMAP_STACK path for irq stack initialization, simplifying the logic. Signed-off-by: Breno Leitao Acked-by: Ard Biesheuvel Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707-arm64_vmap-v1-4-8de98ca0f91c@debian.org Signed-off-by: Will Deacon commit 0909c719c17b7a3e88dd1ee231b4a136c946c39e Author: Breno Leitao Date: Mon Jul 7 09:01:03 2025 -0700 arm64: Remove CONFIG_VMAP_STACK conditionals from THREAD_SHIFT and THREAD_ALIGN Now that VMAP_STACK is always enabled on arm64, remove the CONFIG_VMAP_STACK conditional logic from the definitions of THREAD_SHIFT and THREAD_ALIGN in arch/arm64/include/asm/memory.h. This simplifies the code by unconditionally setting THREAD_ALIGN to (2 * THREAD_SIZE) and adjusting the THREAD_SHIFT definition to only depend on MIN_THREAD_SHIFT and PAGE_SHIFT. This change reflects the updated arm64 stack model, where all kernel threads use virtually mapped stacks with guard pages, and ensures alignment and stack sizing are consistently handled. Signed-off-by: Breno Leitao Acked-by: Ard Biesheuvel Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707-arm64_vmap-v1-3-8de98ca0f91c@debian.org Signed-off-by: Will Deacon commit 63829521a8e8fd8852305b521ba8cb7b41722365 Author: Breno Leitao Date: Mon Jul 7 09:01:02 2025 -0700 arm64: efi: Remove CONFIG_VMAP_STACK check Remove the CONFIG_VMAP_STACK check in arm64_efi_rt_init() since VMAP_STACK is now always enabled on arm64. The arch_alloc_vmap_stack() call will fail to build if VMAP_STACK is not set, providing sufficient protection without the explicit runtime check. Signed-off-by: Breno Leitao Acked-by: Ard Biesheuvel Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707-arm64_vmap-v1-2-8de98ca0f91c@debian.org Signed-off-by: Will Deacon commit ef6861b8e6dd7d933e29022b6620c42085b907f9 Author: Breno Leitao Date: Mon Jul 7 09:01:01 2025 -0700 arm64: Mandate VMAP_STACK On arm64, VMAP_STACK has been enabled by default for a while now, and the only reason to disable it was a historical lack of support for KASAN_VMALLOC. Today there's no good reason to disable VMAP_STACK. Mandate VMAP_STACK, which will allow code to be simplified in subsequent patches. Suggested-by: Will Deacon Signed-off-by: Breno Leitao Acked-by: Ard Biesheuvel Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707-arm64_vmap-v1-1-8de98ca0f91c@debian.org Signed-off-by: Will Deacon commit 203dcde881561f1a4ee1084e2ee438fb4522c94a Merge: 69d09a26096c18 8290d37ad2b087 Author: Simona Vetter Date: Tue Jul 8 14:31:19 2025 +0200 Merge tag 'drm-msm-next-2025-07-05' of https://gitlab.freedesktop.org/drm/msm into drm-next Updates for v6.17 CI: - uprev mesa and ci-templates - use shallow clone to speed up build jobs - remove sdm845/cheza jobs. These runners are no more (RIP dear chezas) - fix runner tag for i915 cml runners - uprev igt to pull in msm test fixes Core: - VM_BIND support! - single source of truth for UBWC configuration. Adds a global soc driver for UBWC config which is used from display and GPU. (And later vidc/camera/etc) - Decouple ties between GPU and KMS, adding a `separate_gpu_kms` modparam to allow the GPU and KMS to bind to separate DRM devices. This should better deal with more exotic SoC configurations where the number of GPUs is different from number of DPUs. The default behavior is to still come up as a single unified DRM device to avoid surprising userspace. DP: - major rework of the I/O accessors DPU: - use version checks instead of feature bits - SM8750 support - set min_prefill_lines for SC8180X DSI: - SM8750 support GPU: - speedbin support for X1-85 - X1-45 support MDSS: - SM8750 support Signed-off-by: Simona Vetter From: Robin Clark Link: https://patchwork.freedesktop.org/patch/msgid/CACSVV0217R+kpoWQJeuYGHf6q_4aFyEJuKa=dZZKOnLQzFwppg@mail.gmail.com commit a8b8cce9d96d65dfe3d89abf02033151f8b7d670 Author: Ada Couprie Diaz Date: Mon Jul 7 12:41:09 2025 +0100 arm64: debug: remove debug exception registration infrastructure Now that debug exceptions are handled individually and without the need for dynamic registration, remove the unused registration infrastructure. This removes the external caller for `debug_exception_enter()` and `debug_exception_exit()`. Make them static again and remove them from the header. Remove `early_brk64()` as it has been made redundant by (arm64: debug: split brk64 exception entry) and is not used anymore. Note : in `early_brk64()` `bug_brk_handler()` is called unconditionally as a fall-through, but now `call_break_hook()` only calls it if the immediate matches. This does not change the behaviour in early boot, as if `bug_brk_handler()` was called on a non-BUG immediate it would return DBG_HOOK_ERROR anyway, which `call_break_hook()` will do if no immediate matches. Remove `trap_init()`, as it would be empty and a weak definition already exists in `init/main.c`. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-14-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit fc5e5d0477c532054ce8692fd16fdaab2cb8946f Author: Ada Couprie Diaz Date: Mon Jul 7 12:41:08 2025 +0100 arm64: debug: split bkpt32 exception entry Currently all debug exceptions share common entry code and are routed to `do_debug_exception()`, which calls dynamically-registered handlers for each specific debug exception. This is unfortunate as different debug exceptions have different entry handling requirements, and it would be better to handle these distinct requirements earlier. The BKPT32 exception can only be triggered by a BKPT instruction. Thus, we know that the PC is a legitimate address and isn't being used to train a branch predictor with a bogus address : we don't need to call `arm64_apply_bp_hardening()`. The handler for this exception only pends a signal and doesn't depend on any per-CPU state : we don't need to inhibit preemption, nor do we need to keep the DAIF exceptions masked, so we can unmask them earlier. Split the BKPT32 exception entry and adjust function signatures and its behaviour to match its relaxed constraints compared to other debug exceptions. We can also remove `NOKRPOBE_SYMBOL`, as this cannot lead to a kprobe recursion. This replaces the last usage of `el0_dbg()`, so remove it. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-13-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit 31575e11ecf7e44face72d1e624cb147a9283733 Author: Ada Couprie Diaz Date: Mon Jul 7 12:41:07 2025 +0100 arm64: debug: split brk64 exception entry Currently all debug exceptions share common entry code and are routed to `do_debug_exception()`, which calls dynamically-registered handlers for each specific debug exception. This is unfortunate as different debug exceptions have different entry handling requirements, and it would be better to handle these distinct requirements earlier. The BRK64 instruction can only be triggered by a BRK instruction. Thus, we know that the PC is a legitimate address and isn't being used to train a branch predictor with a bogus address : we don't need to call `arm64_apply_bp_hardening()`. We do not need to handle the Cortex-A76 erratum #1463225 either, as it only relevant for single stepping at EL1. BRK64 does not write FAR_EL1 either, as only hardware watchpoints do so. Split the BRK64 exception entry, adjust the function signature, and its behaviour to match the lack of needed mitigations. Further, as the EL0 and EL1 code paths are cleanly separated, we can split `do_brk64()` into `do_el0_brk64()` and `do_el1_brk64()`, and call them directly from the relevant entry paths. Use `die()` directly for the EL1 error path, as in `do_el1_bti()` and `do_el1_undef()`. We can also remove `NOKRPOBE_SYMBOL` for the EL0 path, as it cannot lead to a kprobe recursion. When taking a BRK64 exception from EL0, the exception handling is safely preemptible : the only possible handler is `uprobe_brk_handler()`. It only operates on task-local data and properly checks its validity, then raises a Thread Information Flag, processed before returning to userspace in `do_notify_resume()`, which is already preemptible. Thus we can safely unmask interrupts and enable preemption before handling the break itself, fixing a PREEMPT_RT issue where the handler could call a sleeping function with preemption disabled. Given that the break hook registration is handled statically in `call_break_hook` since (arm64: debug: call software break handlers statically) and that we now bypass the exception handler registration, this change renders `early_brk64` redundant : its functionality is now handled through the post-init path. This also removes the last usage of `el1_dbg()`. This also removes the last usage of `el0_dbg()` without `CONFIG_COMPAT`. Mark it `__maybe_unused`, to prevent a warning when building this patch without `CONFIG_COMPAT`, as the following patch removes `el0_dbg()`. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-12-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit 413f0bba005dacf2484bb8ecce212fab9be79d81 Author: Ada Couprie Diaz Date: Mon Jul 7 12:41:06 2025 +0100 arm64: debug: split hardware watchpoint exception entry Currently all debug exceptions share common entry code and are routed to `do_debug_exception()`, which calls dynamically-registered handlers for each specific debug exception. This is unfortunate as different debug exceptions have different entry handling requirements, and it would be better to handle these distinct requirements earlier. Hardware watchpoints are the only debug exceptions that will write FAR_EL1, so we need to preserve it and pass it down. However, they cannot be used to maliciously train branch predictors, so we can omit calling `arm64_bp_hardening()`, nor do they need to handle the Cortex-A76 erratum #1463225, as it only applies to single stepping exceptions. As the hardware watchpoint handler only returns 0 and never triggers the call to `arm64_notify_die()`, we can call it directly from `entry-common.c`. Split the hardware watchpoint exception entry and adjust the behaviour to match the lack of needed mitigations. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-11-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit 0ac7584c08ceff13fc1e3082a0104548688d6b00 Author: Ada Couprie Diaz Date: Mon Jul 7 12:41:05 2025 +0100 arm64: debug: split single stepping exception entry Currently all debug exceptions share common entry code and are routed to `do_debug_exception()`, which calls dynamically-registered handlers for each specific debug exception. This is unfortunate as different debug exceptions have different entry handling requirements, and it would be better to handle these distinct requirements earlier. The single stepping exception has the most constraints : it can be exploited to train branch predictors and it needs special handling at EL1 for the Cortex-A76 erratum #1463225. We need to conserve all those mitigations. However, it does not write an address at FAR_EL1, as only hardware watchpoints do so. The single-step handler does its own signaling if it needs to and only returns 0, so we can call it directly from `entry-common.c`. Split the single stepping exception entry, adjust the function signature, keep the security mitigation and erratum handling. Further, as the EL0 and EL1 code paths are cleanly separated, we can split `do_softstep()` into `do_el0_softstep()` and `do_el1_softstep()` and call them directly from the relevant entry paths. We can also remove `NOKPROBE_SYMBOL` for the EL0 path, as it cannot lead to a kprobe recursion. Move the call to `arm64_apply_bp_hardening()` to `entry-common.c` so that we can do it as early as possible, and only for the exceptions coming from EL0, where it is needed. This is safe to do as it is `noinstr`, as are all the functions it may call. `el0_ia()` and `el0_pc()` already call it this way. When taking a soft-step exception from EL0, most of the single stepping handling is safely preemptible : the only possible handler is `uprobe_single_step_handler()`. It only operates on task-local data and properly checks its validity, then raises a Thread Information Flag, processed before returning to userspace in `do_notify_resume()`, which is already preemptible. However, the soft-step handler first calls `reinstall_suspended_bps()` to check if there is any hardware breakpoint or watchpoint pending or already stepped through. This cannot be preempted as it manipulates the hardware breakpoint and watchpoint registers. Move the call to `try_step_suspended_breakpoints()` to `entry-common.c` and adjust the relevant comments. We can now safely unmask interrupts before handling the step itself, fixing a PREEMPT_RT issue where the handler could call a sleeping function with preemption disabled. Signed-off-by: Ada Couprie Diaz Closes: https://lore.kernel.org/linux-arm-kernel/Z6YW_Kx4S2tmj2BP@uudg.org/ Tested-by: Luis Claudio R. Goncalves Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-10-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit 80691d35523de3292b64c2ffa444aab3d55e51ba Author: Ada Couprie Diaz Date: Mon Jul 7 12:41:04 2025 +0100 arm64: debug: refactor reinstall_suspended_bps() `reinstall_suspended_bps()` plays a key part in the stepping process when we have hardware breakpoints and watchpoints enabled. It checks if we need to step one, will re-enable it if it has been handled and will return whether or not we need to proceed with a single-step. However, the current naming and return values make it harder to understand the logic and goal of the function. Rename it `try_step_suspended_breakpoints()` and change the return value to a boolean, aligning it with similar functions used in `do_el0_undef()` like `try_emulate_mrs()`, and making its behaviour more obvious. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Anshuman Khandual Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-9-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit 43e2ae77fcab8a01101a2e5da528b5222b338e5f Author: Ada Couprie Diaz Date: Mon Jul 7 12:41:03 2025 +0100 arm64: debug: split hardware breakpoint exception entry Currently all debug exceptions share common entry code and are routed to `do_debug_exception()`, which calls dynamically-registered handlers for each specific debug exception. This is unfortunate as different debug exceptions have different entry handling requirements, and it would be better to handle these distinct requirements earlier. Hardware breakpoints exceptions are generated by the hardware after user configuration. As such, they can be exploited when training branch predictors outside of the userspace VA range: they still need to call `arm64_apply_bp_hardening()` if needed to mitigate against this attack. However, they do not need to handle the Cortex-A76 erratum #1463225 as it only applies to single stepping exceptions. It does not set an address in FAR_EL1 either, only the hardware watchpoint does. As the hardware breakpoint handler only returns 0 and never triggers the call to `arm64_notify_die()`, we can call it directly from `entry-common.c`. Split the hardware breakpoint exception entry, adjust the function signature, and handling of the Cortex-A76 erratum to fit the behaviour of the exception. Move the call to `arm64_apply_bp_hardening()` to `entry-common.c` so that we can do it as early as possible, and only for the exceptions coming from EL0, where it is needed. This is safe to do as it is `noinstr`, as are all the functions it may call. `el0_ia()` and `el0_pc()` already call it this way. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-8-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit eaff68b3286116d499a3d4e513a36d772faba587 Author: Ada Couprie Diaz Date: Mon Jul 7 12:41:02 2025 +0100 arm64: entry: Add entry and exit functions for debug exceptions Move the `debug_exception_enter()` and `debug_exception_exit()` functions from mm/fault.c, as they are needed to split the debug exceptions entry paths from the current unified one. Make them externally visible in include/asm/exception.h until the caller in mm/fault.c is cleaned up. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Anshuman Khandual Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-7-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit d4e0b12620946a4011ad695490211fc38bf5cb42 Author: Ada Couprie Diaz Date: Mon Jul 7 12:41:01 2025 +0100 arm64: debug: remove break/step handler registration infrastructure Remove all infrastructure for the dynamic registration previously used by software breakpoints and stepping handlers. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Anshuman Khandual Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-6-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit 403b48aad5b3e857b8c2576ce6a421f3d23dd6a6 Author: Ada Couprie Diaz Date: Mon Jul 7 12:41:00 2025 +0100 arm64: debug: call step handlers statically Software stepping checks for the correct handler by iterating over a list of dynamically registered handlers and calling all of them until one handles the exception. This is the only generic way to handle software stepping handlers in arm64 as the exception does not provide an immediate that could be checked, contrary to software breakpoints. However, the registration mechanism is not exported and has only two current users : the KGDB stepping handler, and the uprobe single step handler. Given that one comes from user mode and the other from kernel mode, call the appropriate one by checking the source EL of the exception. Add a stand-in that returns DBG_HOOK_ERROR when the configuration options are not enabled. Remove `arch_init_uprobes()` as it is not useful anymore and is specific to arm64. Unify the naming of the handler to XXX_single_step_handler(), making it clear they are related. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-5-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit 6adfdc5e2ef9c71a76d8d127a2eb54f0fbe9be5e Author: Ada Couprie Diaz Date: Mon Jul 7 12:40:59 2025 +0100 arm64: debug: call software breakpoint handlers statically Software breakpoints pass an immediate value in ESR ("comment") that can be used to call a specialized handler (KGDB, KASAN...). We do so in two different ways : - During early boot, `early_brk64` statically checks against known immediates and calls the corresponding handler, - During init, handlers are dynamically registered into a list. When called, the generic software breakpoint handler will iterate over the list to find the appropriate handler. The dynamic registration does not provide any benefit here as it is not exported and all its uses are within the arm64 tree. It also depends on an RCU list, whose safe access currently relies on the non-preemptible state of `do_debug_exception`. Replace the list iteration logic in `call_break_hooks` to call the breakpoint handlers statically if they are enabled, like in `early_brk64`. Expose the handlers in their respective headers to be reachable from `arch/arm64/kernel/debug-monitors.c` at link time. Unify the naming of the software breakpoint handlers to XXX_brk_handler(), making it clear they are related and to differentiate from the hardware breakpoints. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Will Deacon Acked-by: Mark Rutland Link: https://lore.kernel.org/r/20250707114109.35672-4-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit b1e2d95524e4d0f5b643394c739212869e95cf6a Author: Ada Couprie Diaz Date: Mon Jul 7 12:40:58 2025 +0100 arm64: refactor aarch32_break_handler() `aarch32_break_handler()` is called in `do_el0_undef()` when we are trying to handle an exception whose Exception Syndrome is unknown. It checks if the instruction hit might be a 32-bit arm break (be it A32 or T2), and sends a SIGTRAP to userspace if it is so that it can be handled. However, this is badly represented in the naming of the function, and is not consistent with the other functions called with the same logic in `do_el0_undef()`. Rename it `try_handle_aarch32_break()` and change the return value to a boolean to align with the logic of the other tentative handlers in `do_el0_undef()`, the previous error code being ignored anyway. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Anshuman Khandual Acked-by: Mark Rutland Reviewed-by: Will Deacon Link: https://lore.kernel.org/r/20250707114109.35672-3-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit ad8b22648b7d0bc6f84230508436b1aafc2e2516 Author: Ada Couprie Diaz Date: Mon Jul 7 12:40:57 2025 +0100 arm64: debug: clean up single_step_handler logic Remove the unnecessary boolean which always checks if the handler was found and return early instead. Signed-off-by: Ada Couprie Diaz Tested-by: Luis Claudio R. Goncalves Reviewed-by: Anshuman Khandual Acked-by: Mark Rutland Reviewed-by: Will Deacon Link: https://lore.kernel.org/r/20250707114109.35672-2-ada.coupriediaz@arm.com Signed-off-by: Will Deacon commit 62c51c2b38724e80654af04e1ee09e99eece5925 Author: Krzysztof Kozlowski Date: Mon Jul 7 11:50:22 2025 +0200 docs: dt: writing-bindings: Consistently use single-whitespace Document uses only single whitespace after full stop, so fix inconsistency. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250707095019.66792-6-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit b57ce9630bab1a468643fd5fb34d42cb936f0cb0 Author: Krzysztof Kozlowski Date: Mon Jul 7 11:50:21 2025 +0200 docs: dt: writing-bindings: Express better expectations of "specific" Devicetree bindings are supposed to be specific in terms of compatibles and other properties. Short "specific" has many implications, so extend the description to cover them: 1. Mention no family names and avoid generic SoC fallbacks in compatible. The list grew, mixing DO's and DON'T's, so split it into multiple items. 2. No properties implied by the compatible. 3. Document desired lack of ABI impact and acceptable solution if such needs arises: clearly marking it in commit msg. All above follows established Devicetree bindings maintainers review practice, so no new rules in practice are introduced here. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250707095019.66792-5-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit 49ed6868c10e2a11bb44ea836ecf88ca4122f303 Author: Krzysztof Kozlowski Date: Mon Jul 7 11:50:20 2025 +0200 docs: dt: writing-bindings: Rephrase typical fallback (superset) usage When speaking about compatibles for new devices comparing to "prior implementations", usually we expect new device to come with more features, thus logically it is a superset, not subset, of "prior implementations". Suggested-by: Conor Dooley Signed-off-by: Krzysztof Kozlowski Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250707095019.66792-4-krzysztof.kozlowski@linaro.org Signed-off-by: Rob Herring (Arm) commit 69d09a26096c187742fa7040ef9b2925becf00f4 Merge: 17d081ef84a6f3 d6a59ee852758b Author: Simona Vetter Date: Tue Jul 8 14:07:44 2025 +0200 Merge tag 'drm-intel-next-2025-07-04' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 feature pull #2 for v6.17: Features and functionality: - Add drm_panic support for both i915 and xe drivers (Jocelyn Falempe) - Add initial flip queue implementation, disabled by default, for LNL and PTL (Ville) - Add support for Wildcat Lake (WCL) display, version 30.02 (Matt Roper, Matt Atwood, Dnyaneshwar) - Extend drm_panel and follower support to DDI eDP (Arun) Refactoring and cleanups: - Make all global state objects opaque (Jani) - Move display works to display specific unordered workqueue (Luca) - Add and use struct drm_device based pcode interface (Jani, Lucas) - Use clamp() instead of max()+min() combo (Ankit) - Simplify wait for power well disable (Jani) - Various stylistics cleanups and renames (Jani) Fixes: - Deal with loss of pipe DMC state (Ville) - Fix PTL HDCP2 stream status check (Suraj) - Add workaround for ADL-P DKL PHY DP and HDMI (Nemesa) - Fix skl_print_wm_changes() stack usage with KMSAN (Arnd Bergmann) - Fix PCON capability reads on non-branch devices (Chaitanya) - Fix which platforms have ultra joiner (Ankit) DRM core changes: - Add ttm_bo_kmap_try_from_panic() for xe drm_panic support (Jocelyn Falempe) - Add private pointer to struct drm_scanout buffer for xe/i915 drm_panic support (Jocelyn Falempe) Merges: - Backmerge drm-next for drm_panel and xe changes (Jani) Signed-off-by: Simona Vetter From: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/6d728bf6ef23681b00dfbc7da9aeae41042dee02@intel.com commit 84a7d6797e6a03705e6b48c613fa424662049d87 Author: Eric Dumazet Date: Wed Jul 2 07:12:30 2025 +0000 net/sched: acp_api: no longer acquire RTNL in tc_action_net_exit() tc_action_net_exit() got an rtnl exclusion in commit a159d3c4b829 ("net_sched: acquire RTNL in tc_action_net_exit()") Since then, commit 16af6067392c ("net: sched: implement reference counted action release") made this RTNL exclusion obsolete for most cases. Only tcf_action_offload_del() might still require it. Move the rtnl locking into tcf_idrinfo_destroy() when an offload action is found. Most netns do not have actions, yet deleting them is adding a lot of pressure on RTNL, which is for many the most contended mutex in the kernel. We are moving to a per-netns 'rtnl', so tc_action_net_exit() will not be able to grab 'rtnl' a single time for a batch of netns. Before the patch: perf probe -a rtnl_lock perf record -e probe:rtnl_lock -a /bin/bash -c 'unshare -n "/bin/true"; sleep 1' [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.305 MB perf.data (25 samples) ] After the patch: perf record -e probe:rtnl_lock -a /bin/bash -c 'unshare -n "/bin/true"; sleep 1' [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.304 MB perf.data (9 samples) ] Signed-off-by: Eric Dumazet Cc: Vlad Buslov Cc: Jiri Pirko Cc: Marcelo Ricardo Leitner Link: https://patch.msgid.link/20250702071230.1892674-1-edumazet@google.com Signed-off-by: Paolo Abeni commit d23647fd547bdfa7958a264153218e5178c5c89c Merge: 05cc60ef27c9b7 48e1736e5dc1dc Author: Paolo Abeni Date: Tue Jul 8 12:41:45 2025 +0200 Merge branch 'net-mctp-add-support-for-gateway-routing' Jeremy Kerr says: ==================== net: mctp: Add support for gateway routing This series adds a gateway route type for the MCTP core, allowing non-local EIDs as the match for a route. Example setup using the mctp tools: mctp route add 9 via mctpi2c0 mctp neigh add 9 dev mctpi2c0 lladdr 0x1d mctp route add 10 gw 9 - will route packets to eid 10 through mctpi2c0, using a dest lladdr of 0x1d (ie, that of the directly-attached eid 9). The core change to support this is the introduction of a struct mctp_dst, which represents the result of a route lookup. Since this involves a bit of surgery through the routing code, we add a few tests along the way. We're introducing an ABI change in the new RTM_{NEW,GET,DEL}ROUTE netlink formats, with the support for a RTA_GATEWAY attribute. Because we need a network ID specified to fully-qualify a gateway EID, the RTA_GATEWAY attribute carries the (net, eid) tuple in full: struct mctp_fq_addr { unsigned int net; mctp_eid_t eid; } Of course, any questions, comments etc are most welcome. Signed-off-by: Jeremy Kerr ==================== Link: https://patch.msgid.link/20250702-dev-forwarding-v5-0-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 48e1736e5dc1dce875fdaba9b99c01dd4cd226a0 Author: Jeremy Kerr Date: Wed Jul 2 14:20:14 2025 +0800 net: mctp: test: Add tests for gateway routes Add a few kunit tests for the gateway routing. Because we have multiple route types now (direct and gateway), rename mctp_test_create_route to mctp_test_create_route_direct, and add a _gateway variant too. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-14-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit ad39c12fcee34b8980a80ad5c803bca9906fbd4e Author: Jeremy Kerr Date: Wed Jul 2 14:20:13 2025 +0800 net: mctp: add gateway routing support This change allows for gateway routing, where a route table entry may reference a routable endpoint (by network and EID), instead of routing directly to a netdevice. We add support for a RTM_GATEWAY attribute for netlink route updates, with an attribute format of: struct mctp_fq_addr { unsigned int net; mctp_eid_t eid; } - we need the net here to uniquely identify the target EID, as we no longer have the device reference directly (which would provide the net id in the case of direct routes). This makes route lookups recursive, as a route lookup that returns a gateway route must be resolved into a direct route (ie, to a device) eventually. We provide a limit to the route lookups, to prevent infinite loop routing. The route lookup populates a new 'nexthop' field in the dst structure, which now specifies the key for the neighbour table lookup on device output, rather than using the packet destination address directly. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-13-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 28ddbb2abe13776d3835f4bda535edd46336870a Author: Jeremy Kerr Date: Wed Jul 2 14:20:12 2025 +0800 net: mctp: allow NL parsing directly into a struct mctp_route The netlink route parsing functions end up setting a bunch of output variables from the rt attributes. This will get messy when the routes become more complex. So, split the rt parsing into two types: a lookup (returning route target data suitable for a route lookup, like when deleting a route) and a populate (setting fields of a struct mctp_route). In doing this, we need to separate the route allocation from mctp_route_add, so add some comments on the lifetime semantics for the latter. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-12-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 4a1de053d7f0940936f6602ad53fe077bb10ff7f Author: Jeremy Kerr Date: Wed Jul 2 14:20:11 2025 +0800 net: mctp: remove routes by netid, not by device In upcoming changes, a route may not have a device associated. Since the route is matched on the (network, eid) tuple, pass the netid itself into mctp_route_remove. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-11-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 48e6aa60bf281e86372d174d96fb1147f02743b3 Author: Jeremy Kerr Date: Wed Jul 2 14:20:10 2025 +0800 net: mctp: pass net into route creation We may not have a mdev pointer, from which we currently extract the net. Instead, pass the net directly. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-10-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 9b4a8c38f4fe8f6ed51032165c0fc34007d88415 Author: Jeremy Kerr Date: Wed Jul 2 14:20:09 2025 +0800 net: mctp: test: Add initial socket tests Recent changes have modified the extaddr path a little, so add a couple of kunit tests to af-mctp.c. These check that we're correctly passing lladdr data between sendmsg/recvmsg and the routing layer. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-9-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 19396179a0f1f912b22c051afb468482b0d9466f Author: Jeremy Kerr Date: Wed Jul 2 14:20:08 2025 +0800 net: mctp: test: add sock test infrastructure Add a new test object, for use with the af_mctp socket code. This is intially empty, but we'll start populating actual tests in an upcoming change. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-8-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 80bcf05e54e0e269515192c3a2ceff736a730492 Author: Jeremy Kerr Date: Wed Jul 2 14:20:07 2025 +0800 net: mctp: test: move functions into utils.[ch] A future change will add another mctp test .c file, so move some of the common test setup from route.c into the utils object. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-7-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 46ee16462fed5c3a065b603d677a9a36462dab7d Author: Jeremy Kerr Date: Wed Jul 2 14:20:06 2025 +0800 net: mctp: test: Add extaddr routing output test Test that the routing code preserves the haddr data in a skb through an input route operation. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-6-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 96b341a8e78272b70905a5ac8b01e0cb97ae07de Author: Jeremy Kerr Date: Wed Jul 2 14:20:05 2025 +0800 net: mctp: test: Add an addressed device constructor Upcoming tests will check semantics of hardware addressing, which require a dev with ->addr_len != 0. Add a constructor to create a MCTP interface using a physically-addressed bus type. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-5-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 3007f90ec0385304ab5794e9585427b73f40e32f Author: Jeremy Kerr Date: Wed Jul 2 14:20:04 2025 +0800 net: mctp: separate cb from direct-addressing routing Now that we have the dst->haddr populated by sendmsg (when extended addressing is in use), we no longer need to stash the link-layer address in the skb->cb. Instead, only use skb->cb for incoming lladdr data. While we're at it: remove cb->src, as was never used. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-4-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 269936db5eb3962fe290b1dc4dbf1859cd5a04dd Author: Jeremy Kerr Date: Wed Jul 2 14:20:03 2025 +0800 net: mctp: separate routing database from routing operations This change adds a struct mctp_dst, representing the result of a routing lookup. This decouples the struct mctp_route from the actual implementation of a routing operation. This will allow for future routing changes which may require more involved lookup logic, such as gateway routing - which may require multiple traversals of the routing table. Since we only use the struct mctp_route at lookup time, we no longer hold routes over a routing operation, as we only need it to populate the dst. However, we do hold the dev while the dst is active. This requires some changes to the route test infrastructure, as we no longer have a mock route to handle the route output operation, and transient dsts are created by the routing code, so we can't override them as easily. Instead, we use kunit->priv to stash a packet queue, and a custom dst_output function queues into that packet queue, which we can use for later expectations. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-3-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit fc2b87d036e2155b16f8c53c8198df7b376fd616 Author: Jeremy Kerr Date: Wed Jul 2 14:20:02 2025 +0800 net: mctp: test: make cloned_frag buffers more appropriately-sized In our input_cloned_frag test, we currently allocate our test buffers arbitrarily-sized at 100 bytes. We only expect to receive a max of 15 bytes from the socket, so reduce to a more appropriate size. There are some upcoming changes to the routing code which hit a frame-size limit on s390, so reduce the usage before that lands. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-2-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit e0f3c79cc0bbf4925de1afde5abf148b7f7f4398 Author: Jeremy Kerr Date: Wed Jul 2 14:20:01 2025 +0800 net: mctp: don't use source cb data when forwarding, ensure pkt_type is set In the output path, only check the skb->cb data when we know it's from a local socket; input packets will have source address information there instead. In order to detect when we're forwarding, set skb->pkt_type on input/output. Signed-off-by: Jeremy Kerr Link: https://patch.msgid.link/20250702-dev-forwarding-v5-1-1468191da8a4@codeconstruct.com.au Signed-off-by: Paolo Abeni commit 145a2a9e27562926c592645a05d682fe8e1f82e9 Author: Lad Prabhakar Date: Fri Jul 4 15:08:23 2025 +0100 arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable serial NOR FLASH Enable MT25QU512ABB8E12 FLASH connected to XSPI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250704140823.163572-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 885bf52d044ad24acab2b7f4d9e7a0d233dc8f13 Author: Lad Prabhakar Date: Fri Jul 4 15:08:22 2025 +0100 arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable serial NOR FLASH Enable MT25QU512ABB8E12 FLASH connected to XSPI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250704140823.163572-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 7449d4d58da7cf579b4ee6d7cbeef7cabcb4c512 Author: Lad Prabhakar Date: Fri Jul 4 15:08:21 2025 +0100 arm64: dts: renesas: r9a09g057: Add XSPI node Add XSPI node to RZ/V2H(P) ("R9A09G057") SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250704140823.163572-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 3b443f01b3dda8d9f95e97c14c17b4c15273dab4 Author: Lad Prabhakar Date: Fri Jul 4 15:08:20 2025 +0100 arm64: dts: renesas: r9a09g056: Add XSPI node Add XSPI node to RZ/V2N ("R9A09G056") SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250704140823.163572-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 4590e8dc04e016e7ba796a64445790ff99d29d1d Merge: ed62c3807d3310 5e4e8c1415c181 Author: Geert Uytterhoeven Date: Tue Jul 8 12:06:13 2025 +0200 Merge tag 'renesas-r9a09g057-dt-binding-defs-tag4' into renesas-dts-for-v6.17 Renesas RZ/V2N and RZ/V2H XSPI Clock DT Binding Definitions Expanded Serial Peripheral Interface (XSPI) clock DT binding definitions for the Renesas RZ/V2N (R9A09G056) and RZ/V2H (R9A09G057) SoCs, shared by driver and DT source files. commit 2d9f884ceae80ae5ceba90990fb8d824943602d5 Author: Kuninori Morimoto Date: Fri Jun 27 04:41:20 2025 +0000 soc: renesas: Sort Renesas Kconfig configs Renesas Kconfig is using "SoC serial number" for CONFIG symbol, but is using "SoC chip name" for menu description. Because of it, it looks random order when we run "make menuconfig". commit 6d5aded8d57fc ("soc: renesas: Sort driver description title") sorted Renesas Kconfig by menu description title order, but it makes confusable to add new config. Let's unify "ARMxx Platform support for ${CHIP_NUMBER} (${CHIP_NAME}), and sort it again. Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/877c0xhk3z.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Geert Uytterhoeven commit ed62c3807d3310f555ff02c1cd9b071d69faa38e Author: Lad Prabhakar Date: Fri Jul 4 00:55:44 2025 +0100 arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Fix pinctrl node name for GBETH1 Rename the GBETH1 pinctrl node from "eth0" to "eth1" to avoid duplicate node names in the DT and correctly reflect the label "eth1_pins". Fixes: f111192baa80 ("arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable GBETH") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250703235544.715433-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit ffcc8c2e97ca29494687201557fd984d16d5cc4c Author: Lad Prabhakar Date: Fri Jul 4 00:55:43 2025 +0100 arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Fix pinctrl node name for GBETH1 Rename the GBETH1 pinctrl node from "eth0" to "eth1" to avoid duplicate node names in the DT and correctly reflect the label "eth1_pins". Fixes: 802292ee27a7 ("arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable GBETH") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250703235544.715433-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 7e5624e231eea73a6a2c2d0b837a085267590167 Author: Niklas Söderlund Date: Tue Jul 1 13:26:08 2025 +0200 arm64: dts: renesas: r8a779g3-sparrow-hawk-fan-pwm: Add missing install target The target to consider the dtbo file for installation is missing, add it. Fixes: a719915e76f2 ("arm64: dts: renesas: r8a779g3: Add Retronix R-Car V4H Sparrow Hawk board support") Signed-off-by: Niklas Söderlund Reviewed-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/20250701112612.3957799-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Geert Uytterhoeven commit 0c62020d2a51edba49c73e8469d0fdade8a5cacc Author: John Madieu Date: Wed Jul 2 02:57:06 2025 +0200 arm64: dts: renesas: rzg3e-smarc-som: Enable eth{0-1} (GBETH) interfaces Enable the Gigabit Ethernet Interfaces (GBETH) populated on the RZ/G3E SMARC EVK Signed-off-by: John Madieu Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250702005706.1200059-5-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 9e95446b0cf93a91bc3b3b64c6d423f4024a6ff0 Author: Biju Das Date: Wed Jul 2 10:27:53 2025 +0100 arm64: dts: renesas: r9a09g047e57-smarc: Add gpio keys RZ/G3E SMARC EVK has 3 user buttons called USER_SW1, USER_SW2 and USER_SW3 and SLEEP button with NMI support. Add a DT node in device tree to instantiate the gpio-keys driver for these buttons. The system can enter into STR state by pressing the sleep button and wakeup from STR is done by pressing power button. The USER_SW{1,2,3} configured as wakeup-source, so it can wakeup the system during s2idle. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250702092755.70847-1-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 0ab2d84f94dae48c3e7605cdc99dbb4e7c7b206a Author: Claudiu Beznea Date: Fri Jul 4 16:43:26 2025 +0300 clk: renesas: r9a08g045: Add MSTOP for coupled clocks as well If MSTOP is not added for both clocks in a coupled pair, and the clocks are not disabled in the reverse order of their enable sequence, the MSTOP may remain enabled when disabling the clocks. This happens because rzg2l_mod_clock_endisable() executes for coupled clocks only when a single clock from the pair is enabled. If one clock has no MSTOP defined, it can result in the MSTOP configuration being left active when the clocks are disabled out of order (i.e., not in the reverse order of enabling). Fixes: c49695952746 ("clk: renesas: r9a08g045: Drop power domain instantiation") Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250704134328.3614317-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit e6e54229f328c30a1b4ecba1253f9d314dd42e33 Author: John Madieu Date: Wed Jul 2 02:57:03 2025 +0200 clk: renesas: r9a09g047: Add clock and reset signals for the GBETH IPs Add clock and reset entries for the Gigabit Ethernet Interfaces (GBETH 0-1) IPs found on the RZ/G3E SoC. This includes various PLLs, dividers, and mux clocks needed by these two GBETH IPs. Reviewed-by: Biju Das Signed-off-by: John Madieu Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250702005706.1200059-2-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit cc2b722132893164bcb3cee4f08ed056e126eb6c Author: Hari Chandrakanthan Date: Mon Jun 30 14:11:19 2025 +0530 wifi: mac80211: fix rx link assignment for non-MLO stations Currently, ieee80211_rx_data_set_sta() does not correctly handle the case where the interface supports multiple links (MLO), but the station does not (non-MLO). This can lead to incorrect link assignment or unexpected warnings when accessing link information. Hence, add a fix to check if the station lacks valid link support and use its default link ID for rx->link assignment. If the station unexpectedly has valid links, fall back to the default link. This ensures correct link association and prevents potential issues in mixed MLO/non-MLO environments. Signed-off-by: Hari Chandrakanthan Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250630084119.3583593-1-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit 05cc60ef27c9b7fb46972223e04ef3f797940154 Merge: 0234362d0af464 2f9afffc399d45 Author: Paolo Abeni Date: Tue Jul 8 10:59:58 2025 +0200 Merge branch 'add-broadcast_neighbor-for-no-stacking-networking-arch' Tonghao Zhang says: ==================== add broadcast_neighbor for no-stacking networking arch For no-stacking networking arch, and enable the bond mode 4(lacp) in datacenter, the switch require arp/nd packets as session synchronization. More details please see patch. Cc: Jay Vosburgh Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Steven Rostedt Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nikolay Aleksandrov Cc: Zengbing Tu ==================== Link: https://patch.msgid.link/cover.1751031306.git.tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit 2f9afffc399d450c68a4dbebd7865b8e631a3cff Author: Tonghao Zhang Date: Fri Jun 27 21:49:30 2025 +0800 net: bonding: send peer notify when failure recovery In LACP mode with broadcast_neighbor enabled, after LACP protocol recovery, the port can transmit packets. However, if the bond port doesn't send gratuitous ARP/ND packets to the switch, the switch won't return packets through the current interface. This causes traffic imbalance. To resolve this issue, when LACP protocol recovers, send ARP/ND packets if broadcast_neighbor is enabled. Cc: Jay Vosburgh Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Steven Rostedt Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nikolay Aleksandrov Signed-off-by: Tonghao Zhang Signed-off-by: Zengbing Tu Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/3993652dc093fffa9504ce1c2448fb9dea31d2d2.1751031306.git.tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit 3d98ee52659c3f1d3913ae5b97f7743c5247752c Author: Tonghao Zhang Date: Fri Jun 27 21:49:29 2025 +0800 net: bonding: add broadcast_neighbor netlink option User can config or display the bonding broadcast_neighbor option via iproute2/netlink. Cc: Jay Vosburgh Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Steven Rostedt Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nikolay Aleksandrov Signed-off-by: Tonghao Zhang Signed-off-by: Zengbing Tu Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/76b90700ba5b98027dfb51a2f3c5cfea0440a21b.1751031306.git.tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit ce7a381697cb3958ffe0b45e5028ac69444e9288 Author: Tonghao Zhang Date: Fri Jun 27 21:49:28 2025 +0800 net: bonding: add broadcast_neighbor option for 802.3ad Stacking technology is a type of technology used to expand ports on Ethernet switches. It is widely used as a common access method in large-scale Internet data center architectures. Years of practice have proved that stacking technology has advantages and disadvantages in high-reliability network architecture scenarios. For instance, in stacking networking arch, conventional switch system upgrades require multiple stacked devices to restart at the same time. Therefore, it is inevitable that the business will be interrupted for a while. It is for this reason that "no-stacking" in data centers has become a trend. Additionally, when the stacking link connecting the switches fails or is abnormal, the stack will split. Although it is not common, it still happens in actual operation. The problem is that after the split, it is equivalent to two switches with the same configuration appearing in the network, causing network configuration conflicts and ultimately interrupting the services carried by the stacking system. To improve network stability, "non-stacking" solutions have been increasingly adopted, particularly by public cloud providers and tech companies like Alibaba, Tencent, and Didi. "non-stacking" is a method of mimicing switch stacking that convinces a LACP peer, bonding in this case, connected to a set of "non-stacked" switches that all of its ports are connected to a single switch (i.e., LACP aggregator), as if those switches were stacked. This enables the LACP peer's ports to aggregate together, and requires (a) special switch configuration, described in the linked article, and (b) modifications to the bonding 802.3ad (LACP) mode to send all ARP/ND packets across all ports of the active aggregator. Note that, with multiple aggregators, the current broadcast mode logic will send only packets to the selected aggregator(s). +-----------+ +-----------+ | switch1 | | switch2 | +-----------+ +-----------+ ^ ^ | | +-----------------+ | bond4 lacp | +-----------------+ | | | NIC1 | NIC2 +-----------------+ | server | +-----------------+ - https://www.ruijie.com/fr-fr/support/tech-gallery/de-stack-data-center-network-architecture/ Cc: Jay Vosburgh Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Jonathan Corbet Cc: Andrew Lunn Cc: Steven Rostedt Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Nikolay Aleksandrov Signed-off-by: Tonghao Zhang Signed-off-by: Zengbing Tu Link: https://patch.msgid.link/84d0a044514157bb856a10b6d03a1028c4883561.1751031306.git.tonghao@bamaicloud.com Signed-off-by: Paolo Abeni commit 86ccd4d3e8bc9eeb5dde4080fcc67e0505d1d2c6 Author: Mac Chiang Date: Tue Jul 8 16:00:29 2025 +0800 ASoC: Intel: soc-acpi-intel-lnl-match: add rt1320_l12_rt714_l0 support This patch add acpi matching support for the rt1320 left and right amplifiers on soundwire link 1 and 2, and the rt714 dmic on soundwire link 0. Signed-off-by: Mac Chiang Reviewed-by: Péter Ujfalusi Signed-off-by: Bard Liao Link: https://patch.msgid.link/20250708080030.1257790-5-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit e149d870687a5cfd702b700d81ae75ec6f41dd57 Author: Mac Chiang Date: Tue Jul 8 16:00:28 2025 +0800 ASoC: Intel: soc-acpi-intel-ptl-match: add support ptl-rt721-l0 This patch adds support for rt721 on Soundwire Link 0. Signed-off-by: Mac Chiang Reviewed-by: Liam Girdwood Signed-off-by: Bard Liao Link: https://patch.msgid.link/20250708080030.1257790-4-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit fb00ab1f39369e49d25c74f0d41e4c1ec2f12576 Author: Balamurugan C Date: Tue Jul 8 16:00:27 2025 +0800 ASoC: Intel: soc-acpi: Add entry for HDMI_In capture support in PTL match table Adding HDMI-In capture via I2S feature support in PTL platform. Signed-off-by: Balamurugan C Reviewed-by: Liam Girdwood Signed-off-by: Bard Liao Link: https://patch.msgid.link/20250708080030.1257790-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 2813f535b5847771d9e56df678c523a7e64f860e Author: Balamurugan C Date: Tue Jul 8 16:00:26 2025 +0800 ASoC: Intel: soc-acpi: Add entry for sof_es8336 in PTL match table. Adding ES83x6 I2S codec support for PTL platforms and entry in match table. Signed-off-by: Balamurugan C Reviewed-by: Liam Girdwood Signed-off-by: Bard Liao Link: https://patch.msgid.link/20250708080030.1257790-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 67bdd67aedcec8c63e3158c3c82991fbde0c4d22 Author: Kuninori Morimoto Date: Tue Jul 8 02:46:46 2025 +0000 ASoC: rt715: don't set dapm->bias_level snd_soc_component_set_bias_level() (A) which will call .set_bias_level() callback (B) will be called from snd_soc_dapm_force_bias_level() (C) only, and it sets dapm->bias_level (D) inside. No need to set it by each driver. Remove it. (A) int snd_soc_component_set_bias_level(...) { ... if (component->driver->set_bias_level) (B) ret = component->driver->set_bias_level(...); ... } (C) int snd_soc_dapm_force_bias_level(...) { ... if (dapm->component) (A) ret = snd_soc_component_set_bias_level(...); if (ret == 0) (D) dapm->bias_level = level; ... } Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87plebmmax.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a3c3e84fc495dd983374f041e145e13df3525a15 Author: Kuninori Morimoto Date: Tue Jul 8 02:46:42 2025 +0000 ASoC: rt700: don't set dapm->bias_level snd_soc_component_set_bias_level() (A) which will call .set_bias_level() callback (B) will be called from snd_soc_dapm_force_bias_level() (C) only, and it sets dapm->bias_level (D) inside. No need to set it by each driver. Remove it. (A) int snd_soc_component_set_bias_level(...) { ... if (component->driver->set_bias_level) (B) ret = component->driver->set_bias_level(...); ... } (C) int snd_soc_dapm_force_bias_level(...) { ... if (dapm->component) (A) ret = snd_soc_component_set_bias_level(...); if (ret == 0) (D) dapm->bias_level = level; ... } Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87qzyrmmb2.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 76760b9dbbf8088ef31afb60d92b955f88ad1288 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:47 2025 +0200 soc: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) Cc: Qiang Zhao Cc: Christophe Leroy Cc: Thierry Reding Cc: Jonathan Hunter Cc: linux-arm-kernel@lists.infradead.org Cc: linuxppc-dev@lists.ozlabs.org Acked-by: Thierry Reding Link: https://lore.kernel.org/linuxppc-dev/20250611104348.192092-19-jirislaby@kernel.org/ Signed-off-by: Christophe Leroy commit a683a5b2ba23598ad343e5ec10a4ef4077497fc9 Author: Al Viro Date: Wed Jul 2 06:34:37 2025 +0100 fold fs_struct->{lock,seq} into a seqlock The combination of spinlock_t lock and seqcount_spinlock_t seq in struct fs_struct is an open-coded seqlock_t (see linux/seqlock_types.h). Combine and switch to equivalent seqlock_t primitives. AFAICS, that does end up with the same sequence of underlying operations in all cases. While we are at it, get_fs_pwd() is open-coded verbatim in get_path_from_fd(); rather than applying conversion to it, replace with the call of get_fs_pwd() there. Not worth splitting the commit for that, IMO... A bit of historical background - conversion of seqlock_t to use of seqcount_spinlock_t happened several months after the same had been done to struct fs_struct; switching fs_struct to seqlock_t could've been done immediately after that, but it looks like nobody had gotten around to that until now. Signed-off-by: Al Viro Link: https://lore.kernel.org/20250702053437.GC1880847@ZenIV Acked-by: Ahmed S. Darwish Acked-by: Peter Zijlstra (Intel) Reviewed-by: Christian Brauner Signed-off-by: Christian Brauner commit f440a12d264de3c960aa7b78286c1c350b196bc5 Author: Greg Kroah-Hartman Date: Tue Jul 1 12:56:17 2025 +0200 wifi: cfg80211: move away from using a fake platform device Downloading regulatory "firmware" needs a device to hang off of, and so a platform device seemed like the simplest way to do this. Now that we have a faux device interface, use that instead as this "regulatory device" is not anything resembling a platform device at all. Cc: Johannes Berg Cc: Signed-off-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2025070116-growing-skeptic-494c@gregkh Signed-off-by: Johannes Berg commit aa4938815133118be6ccc4edeb7e3ee81da76aa3 Merge: 6b9fd8857b9fc4 e553ac0d7616d6 Author: Johannes Berg Date: Tue Jul 8 09:42:28 2025 +0200 Merge tag 'mt76-next-2025-07-07' of https://github.com/nbd168/wireless Felix Fietkay says: =================== mt76 patches for 6.17 - firmware recovery improvements for mt7915 - mlo improvements - fixes =================== Signed-off-by: Johannes Berg commit a49f0abd8959048af18c6c690b065eb0d65b2d21 Author: Konstantin Komarov Date: Fri Jul 4 15:11:32 2025 +0200 Revert "fs/ntfs3: Replace inode_trylock with inode_lock" This reverts commit 69505fe98f198ee813898cbcaf6770949636430b. Initially, conditional lock acquisition was removed to fix an xfstest bug that was observed during internal testing. The deadlock reported by syzbot is resolved by reintroducing conditional acquisition. The xfstest bug no longer occurs on kernel version 6.16-rc1 during internal testing. I assume that changes in other modules may have contributed to this. Fixes: 69505fe98f19 ("fs/ntfs3: Replace inode_trylock with inode_lock") Reported-by: syzbot+a91fcdbd2698f99db8f4@syzkaller.appspotmail.com Suggested-by: Lorenzo Stoakes Signed-off-by: Konstantin Komarov commit f6f6be0c4faf0e0faa3ed5253458186c2d598226 Author: Thomas Weißschuh Date: Fri Jun 20 13:00:28 2025 +0200 tools/nolibc: drop s390 clang target override tools/scripts/Makefile.include now has the same override, removing the need for the one in the nolibc Makefile. Drop the superfluous custom override. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250620-tools-cross-s390-v2-2-ecda886e00e5@linutronix.de Signed-off-by: Thomas Weißschuh commit a40f0cdce78be8a559ee8a85c908049c65a410b2 Author: Thomas Weißschuh Date: Fri Jun 20 13:00:27 2025 +0200 tools/build: Fix s390(x) cross-compilation with clang The heuristic to derive a clang target triple from a GCC one does not work for s390. GCC uses "s390-linux" while clang expects "s390x-linux" or "powerz-linux". Add an explicit override. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250620-tools-cross-s390-v2-1-ecda886e00e5@linutronix.de Signed-off-by: Thomas Weißschuh commit 3e43442d4994c9e1e202c98129a87e330f7faaed Author: Hans Verkuil Date: Sun Jul 6 12:55:40 2025 +0200 media: vivid: fix wrong pixel_array control size The pixel_array control size was calculated incorrectly: the dimensions were swapped (dims[0] should be the height), and the values should be the width or height divided by PIXEL_ARRAY_DIV and rounded up. So don't use roundup, but use DIV_ROUND_UP instead. This bug is harmless in the sense that nothing will break, except that it consumes way too much memory for this control. Fixes: 6bc7643d1b9c ("media: vivid: add pixel_array test control") Cc: Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 1610f15cba05e27ed74d42138b9bec45a315ead7 Author: Hans Verkuil Date: Tue Jun 24 08:30:46 2025 +0200 .mailmap: update Hans Verkuil's email addresses Use hverkuil@kernel.org as the main address for kernel work. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 486225f952c04a618312e68a68044256559b974a Author: Peng Fan Date: Mon Jul 7 14:37:53 2025 +0800 MAINTAINERS: Update i.MX entry Add two patterns: - Documentation/devicetree/bindings/firmware/fsl* - Documentation/devicetree/bindings/firmware/nxp* Signed-off-by: Peng Fan Signed-off-by: Shawn Guo commit 52ccf19527fd300afc1be5ed19623c303077311f Author: Bartosz Golaszewski Date: Tue Jun 10 14:38:50 2025 +0200 soc: fsl: qe: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-soc-v1-1-1a0c36c9deed@linaro.org Signed-off-by: Christophe Leroy commit 54d32a9754a096b2d449588f89c38d5dec52eb49 Author: Abdelrahman Fekry Date: Fri Jul 4 19:10:51 2025 +0300 media: atomisp: Remove custom sysfs attributes from atomisp_drvfs.c Continue the cleanup of the AtomISP driver, as discussed with Hans and Andy in [1]. Tackle TODO item: "Remove custom sysfs files created by atomisp_drvfs.c": - Remove the sysfs attributes `dbglvl`, `dbgfun`, and `dbgopt`. - Delete their associated show/store handler functions. - Remove the corresponding attribute group definitions. Link: https://lore.kernel.org/all/836dc6b6-2821-47fc-8f24-0838f979af76@kernel.org/ [1] Suggested-by: Hans de Goede Reviewed-by: Andy Shevchenko Signed-off-by: Abdelrahman Fekry Link: https://lore.kernel.org/r/20250704161051.16733-1-abdelrahmanfekry375@gmail.com [hansg@kernel.org: Completely remove the now empty atomisp_drvfs files] Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit bd290dddb0d74b3cd34d2cca15d66105dc4a00d4 Author: Abdelrahman Fekry Date: Sat Jun 28 08:25:36 2025 +0300 media: atomisp: Fix premature setting of HMM_BO_DEVICE_INITED flag The HMM_BO_DEVICE_INITED flag was being set in hmm_bo_device_init() before key initialization steps like kmem_cache_create(), kmem_cache_alloc(), and __bo_init(). This means that if any of these steps fail, the flag remains set, misleading other parts of the driver (e.g. hmm_bo_alloc()) into thinking the device is initialized. This could lead to undefined behavior or invalid memory use. Additionally, since __bo_init() is called from inside hmm_bo_device_init() after the flag was already set, its internal check for HMM_BO_DEVICE_INITED is redundant. - Move the flag assignment to the end after all allocations succeed. - Remove redundant check of the flag inside __bo_init() See the link [1] below for a backtrace which happens when deliberately triggering the problem of the flag getting set too early. Link: https://lore.kernel.org/linux-media/CAGn2d8ONZpOHXex8kjeUDgRPiMqKp8vZ=xhGbEDGphV1t7ZEFw@mail.gmail.com/ [1] Signed-off-by: Abdelrahman Fekry Link: https://lore.kernel.org/r/20250628052536.43737-1-abdelrahmanfekry375@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 5e2330ef08f4d7c7692ee55d272c0bb489258915 Author: Abdelrahman Fekry Date: Fri Jun 27 13:06:04 2025 +0300 media: atomisp: Remove debug sysfs attributes active_bo and free_bo The sysfs attributes active_bo and free_bo expose internal buffer state used only for debugging purposes. These are not part of any standard kernel ABI, and need to be removed before this driver may be moved out of drivers/staging. - Remove active_bo and free_bo attributes - Remove group registration calls form hmm_init() and hmm_cleanup() Suggested-by: Hans de Goede Signed-off-by: Abdelrahman Fekry Reviewed-by: Andy Shevchenko Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250627100604.29061-1-abdelrahmanfekry375@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 379f5e1587310b7a0b12b2cd515b66271a1dfc5c Author: Andy Shevchenko Date: Mon May 19 18:46:49 2025 +0300 media: atomisp: Remove no more used macros from math_support.h After recent cleanups the few macros become unused. Remove them. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250519155028.526453-4-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede Tested-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 782fc724bfa44daa2e69e364426ea67b66deb1b3 Author: Andy Shevchenko Date: Mon May 19 18:46:48 2025 +0300 media: atomisp: Replace macros from math_support.h Replace rarely used macros by generic ones from Linux kernel headers. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250519155028.526453-3-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede Tested-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 58913d96525b266d7cf9e6ec787ad1c7df355b2b Author: Andy Shevchenko Date: Mon May 19 18:46:47 2025 +0300 media: atomisp: Remove unused header There are some unused definitions that are using macros from math_support.h. In order to have cleaner future changes, remove them first. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250519155028.526453-2-andriy.shevchenko@linux.intel.com Reviewed-by: Hans de Goede Tested-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 3c92c08cd413ef87ae68785cd09a2a9f940521fc Author: Thomas Andreatta Date: Thu Jun 19 10:44:24 2025 +0200 media: atomisp: ov2722: Fix struct definition style Reorder const qualifier in array declaration. Signed-off-by: Thomas Andreatta Link: https://lore.kernel.org/r/20250619084420.146151-4-thomas.andreatta2000@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 51c19651a7dc74a255041acc0b1c91a197088f0e Author: Thomas Andreatta Date: Thu Jun 19 10:44:22 2025 +0200 media: atomisp: gc2235: Fix struct definition style Reorder const qualifier in array declaration. Signed-off-by: Thomas Andreatta Link: https://lore.kernel.org/r/20250619084420.146151-3-thomas.andreatta2000@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 11d3d8dd0252c15eae380760439403d3b333ba5f Author: Thomas Andreatta Date: Thu Jun 19 10:44:20 2025 +0200 media: atomisp: gc0310: Remove redundant debug message Checkpatch fix: deleted `dev_dbg()` printing the name of the function. ftrace can be used instead. Signed-off-by: Thomas Andreatta Link: https://lore.kernel.org/r/20250619084420.146151-2-thomas.andreatta2000@gmail.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit 4ea35dbdaf5f914ce78b5197ae2e3dcee58c1280 Author: Hans de Goede Date: Sat May 17 13:41:05 2025 +0200 media: atomisp: gc0310: Drop gc0310_g_skip_frames() The g_skip_frames sensor-op is obsolete, drop it. Signed-off-by: Hans de Goede Reviewed-by: Kieran Bingham Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-23-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 3c30c8948d8143d1ed38234b3614e81229a7f6b3 Author: Hans de Goede Date: Sat May 17 13:41:04 2025 +0200 media: atomisp: gc0310: Drop gc0310_get_frame_interval() On raw camera sensors the framerate is controlled through vblank (and optional) hblank controls. Having a get_frame_interval makes no sense in this case, drop it. Signed-off-by: Hans de Goede Reviewed-by: Kieran Bingham Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-22-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 4aaa74642d8c808f9602e4b9d276ea4d32c34515 Author: Hans de Goede Date: Sat May 17 13:41:03 2025 +0200 media: atomisp: gc0310: runtime-PM fixes The i2c-client's power-domain has already been powered up when probe() gets called. So e.g. ACPI resources for regulators and clks have already been enabled and only the GPIOs need to be set to the on state. Instead of calling pm_runtime_set_suspended() while the domain is already powered up and then have detect() do a pm_runtime_get() to set the GPIOs do the following: 1. Call gc0310_power_on() to only set the GPIOs 2. Set the device's runtime-PM state to active instead of suspended 3. Avoid the device getting suspended as soon as pm_runtime_enable() gets called by calling pm_runtime_get() before _enable(), this means moving the pm_runtime_get() / _put() from detect() to probe () This fixes power_on() not getting called when runtime-PM is not enabled in the Kconfig and this keeps the sensor powered-up while registering it avoiding unnecessary power cycles. Also modify gc0310_remove() to power-off the device if it is in active state when gc0310_remove() runs. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-21-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 4d697daae8d82201f57c013c745b734cf5f8fd04 Author: Hans de Goede Date: Sat May 17 13:41:02 2025 +0200 media: atomisp: gc0310: Move and rename suspend/resume functions Move the suspend()/resume() functions to above gc0310_detect() and rename the functions to power_off()/power_on(). No functional changes, this is a preparation patch for reworking the runtime-pm handling in probe() and remove(). Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-20-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 0f8b9632fa87eab457171198e1de8430536cace4 Author: Hans de Goede Date: Sat May 17 13:41:01 2025 +0200 media: atomisp: gc0310: Switch to using sd.active_state fmt Stop having a v4l2_mbus_framefmt mode.fmt driver-data member to store the fmt for the active-state, instead use sd.active_state fmt. This also removes the need for gc0310_get_pad_format() since v4l2_subdev_state_get_format() now will return the correct v4l2_mbus_framefmt for all whence values. Instead of switching gc0310_set_fmt() from gc0310_get_pad_format() to v4l2_subdev_state_get_format() just drop it entirely since there is only 1 fixed mode. Otherwise the new gc0310_set_fmt() would be 100% the same as v4l2_subdev_get_fmt() after this. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-19-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit e0e182ad80e90149d6d73e709d004a640bdce3ae Author: Hans de Goede Date: Sat May 17 13:41:00 2025 +0200 media: atomisp: gc0310: Use v4l2_subdev_get_fmt() as v4l2_subdev_pad_ops.get_fmt() Now that the sd-state's fmt is properly initialized by internal_ops.init_state(), the driver can be safely switched to v4l2_subdev_get_fmt(). Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-18-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 01027ffed991f8e4f05e4d73cd91f17681d1bf51 Author: Hans de Goede Date: Sat May 17 13:40:59 2025 +0200 media: atomisp: gc0310: Implement internal_ops.init_state Implement internal_ops.init_state to fill in the v4l2_mbus_framefmt struct in newly allocated sd-state structs. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-17-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 1e29696182f68b88cf2e459cc928eecc5770b459 Author: Hans de Goede Date: Sat May 17 13:40:58 2025 +0200 media: atomisp: gc0310: Switch to using the sub-device state lock Switch to using the sub-device state lock and properly call v4l2_subdev_init_finalize() / v4l2_subdev_cleanup() on probe() / remove(). Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-16-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 889740337f29c12f7eb32c281869654cfe3e32b5 Author: Hans de Goede Date: Sat May 17 13:40:57 2025 +0200 media: atomisp: gc0310: Switch to {enable,disable}_streams Switch from s_stream() to enable_streams() and disable_streams() pad operations. They are preferred and required for streams support. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-15-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit 9a21a940681c0ba22d7e9e341a4ab560939fce4b Author: Hans de Goede Date: Sat May 17 13:40:56 2025 +0200 media: atomisp: gc0310: Remove unused is_streaming variable is_streaming is only set and never read, drop it. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-14-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit f934362be2165ca22c3fb460bf5ae9468e5187f5 Author: Hans de Goede Date: Sat May 17 13:40:55 2025 +0200 media: atomisp: gc0310: Fix power on/off sleep times Reduce the unnecessary long msleep(100) done on stream start to 10 ms and move this to gc0310_resume() so that it is also done on the initial power-up done by gc0310_detect(), which should fix gc0310_detect() sometimes failing. While at it switch the sleeps from msleep() / usleep_range() to fsleep(). Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-13-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit b9ea99652e973ebdcde855f10c85f690da86cd8d Author: Hans de Goede Date: Sat May 17 13:40:54 2025 +0200 media: atomisp: gc0310: Add check_hwcfg() function Add a check_hwcfg() function to check if the external clk-freq, CSI link-freq and lane-count match the driver's expectations. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-12-hansg@kernel.org Signed-off-by: Mauro Carvalho Chehab commit bddd68a844f5a1c5ecc2f0409e7a2e7789169477 Author: Hans de Goede Date: Sun Jul 6 11:53:53 2025 +0200 media: atomisp: gc0310: Limit max exposure value to mode-height + vblank When an exposure value > (mode-height + vblank) gets set the sensor will automatically increase vblank, lowering the framerate. This is not desirable, limit exposure the maximum exposure to mode-height + vblank to avoid the unwanted framerate slowdown. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-11-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit c9524e6b90824ccfb96eac2e88f377f50c6d13ce Author: Hans de Goede Date: Sun Jul 6 11:53:40 2025 +0200 media: atomisp: gc0310: Add camera orientation and sensor rotation controls Add camera orientation and sensor rotation controls using the v4l2_fwnode_device_parse() and v4l2_ctrl_new_fwnode_properties() helpers. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-10-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit c914e3971f3ee3d09463b8d0f7802ee83eb728f6 Author: Hans de Goede Date: Sun Jul 6 11:53:24 2025 +0200 media: atomisp: gc0310: Add vblank and hblank controls Add support for the vblank and hblank controls, these controls are mandatory for using the sensor driver with libcamera. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-9-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit cd3a72c6430c6edb77268a3653858908c5427e76 Author: Hans de Goede Date: Sun Jul 6 11:53:15 2025 +0200 media: atomisp: gc0310: Add link-frequency and pixelrate controls Add support for the pixelrate control as expected by libcamera, while at it also add the link-frequency control. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250517114106.43494-8-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit 5446808037f6a4db04210db3bf95b216f9588076 Author: Hans de Goede Date: Sun Jul 6 11:47:22 2025 +0200 media: atomisp: gc0310: Add selection API support Add support for the selection API as expected by libcamera. Note the driver only supports a single fixed resolution and no cropping, so this is a simple read-only implementation. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-7-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit 782101916bf23fdee62e2b317472678a3a3fb231 Author: Hans de Goede Date: Fri Jul 4 22:54:19 2025 +0200 media: atomisp: gc0310: Use V4L2_CID_ANALOGUE_GAIN for gain control Use V4L2_CID_ANALOGUE_GAIN for gain control, as expected by userspace. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250517114106.43494-6-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit 2c3a35f27db887c0eb1944ab516e670da0765b42 Author: Hans de Goede Date: Fri Jul 4 21:20:16 2025 +0200 media: atomisp: gc0310: Switch to CCI register access helpers Switch the GC0310 driver over to the CCI register access helpers. While at it also add a _REG prefix to all register address defines to make clear they are register addresses and group register value defines together with the address definition. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-5-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit 58eec766d28a59542cbc898e75fbe5a893a27174 Author: Hans de Goede Date: Fri Jul 4 21:18:27 2025 +0200 media: atomisp: gc0310: Modify vblank value to run at 30 fps Currently the sensor is running 30.9 fps, increase vblank to have it actually run at 30.0 fps. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-4-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit 214b24b4cdb2decd61d2f79116fe4d4ad9a7dd4c Author: Hans de Goede Date: Fri Jul 4 21:18:15 2025 +0200 media: atomisp: gc0310: Drop unused GC0310_FOCAL_LENGTH_NUM define Drop the unused GC0310_FOCAL_LENGTH_NUM define, the focal-length is a property of the sensor-module, not of the raw sensor itself. Signed-off-by: Hans de Goede Reviewed-by: Kieran Bingham Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-3-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit e3b95e64d508d0e869d3fb7bdef6559f976bbdef Author: Hans de Goede Date: Fri Jul 4 21:17:29 2025 +0200 media: atomisp: gc0310: Rename "dev" function variable to "sensor" Many functions on the gc0310 driver use a function local variable called "dev" but these variable's type is not "struct device *" type as one would expect based on the name. Instead they point to the gc0310 driver data struct. Rename these variables to sensor to make their purpose more clear. Signed-off-by: Hans de Goede Reviewed-by: Kieran Bingham Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250517114106.43494-2-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit ed3bc38ff5cbc431f9b155610046f8f404437bb5 Author: Pablo Date: Sat May 3 17:00:30 2025 -0300 media: atomisp: Fix ia_css_vf.host.c coding style Fix a coding style: "ERROR: that open brace { should be on the previous line" issue reported in ia_css_vf.host.c:94. Signed-off-by: Pablo Link: https://lore.kernel.org/r/20250503200030.5982-1-pablo@pablo.ct.ws Signed-off-by: Hans de Goede Signed-off-by: Mauro Carvalho Chehab commit cf101966f4e283b3748c7b04f3a58026da176095 Author: Hans de Goede Date: Fri Jul 4 11:24:02 2025 +0200 media: atomisp: Switch to int3472 driver sensor GPIO mapping code Replace the duplicate code for calling the special Intel camera sensor GPIO type _DSM (79234640-9e10-4fea-a5c1-b5aa8b19756f) and mapping GPIOs to the sensor with a call to int3472_discrete_parse_crs() from the int3472 driver. Besides avoiding code duplication the int3472 version of the code also supports more features, like mapping the powerdown GPIO to a regulator on the mt9m114 which is necessary to make the camera on the Asus T100TA work. Signed-off-by: Hans de Goede Acked-by: Sakari Ailus Link: https://lore.kernel.org/r/20250507184737.154747-7-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit 0193cce58b196603427e925683b54f2f64ef031c Author: Hans de Goede Date: Fri Jul 4 11:21:34 2025 +0200 media: atomisp: Fix "stop stream timeout." error Commit c7194b21809e ("media: atomisp: On streamoff wait for buffers owned by the CSS to be given back") added draining of the CSS buffer queue to the beginning of atomisp_stop_stream(). But it turns out that when telling the CSS to stop streaming it needs at least 1 buffer queued, because the CSS firmware waits for a frame to be completed before stopping and without buffers it cannot complete a frame. At the end of atomisp_stop_stream() it is always safe to return buffer ownership to the videobuf2-core. Either atomisp_css_stop() has successfully stopped the stream; or the atomisp_reset() later on which power-cycles the ISP will definitely have stopped the stream. Drop the draining of the CSS buffer queue to fix the "stop stream timeout." error and move the atomisp_flush_video_pipe() call after atomisp_reset(), passing false for the warn_on_css_frames flag since some buffers still being marked as owned by the CSS expected on stream off. Also increase the timeout in destroy_stream(), since this waits for the last frame to be completed this can take longer then 40 ms. When e.g. using a framerate of 15 fps, this could take 66ms, make the timeout 200 ms to be on the safe side. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250505210008.152659-6-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit f01d091c3e2b198ac0485fb83e420a0ba8d070bd Author: Hans de Goede Date: Fri Jul 4 11:21:08 2025 +0200 media: atomisp: Always free MIPI / CSI-receiver buffers from ia_css_uninit() The atomisp interrupt handling will free the MIPI / CSI-receiver buffers when processing a frame-completion event if the stop_requested flag is set, but only in the ISP2400 / BYT, not in the ISP2401 / CHT case. There are 2 problems with this: 1. Since this is only done in the BYT case the "mipi frames are not freed." warning always triggers on CHT devices. 2. There are 2 stop_requested flags, ia_css_pipe.stop_requested and ia_css_pipeline.stop_requested. The ISR checks the ia_css_pipe flag, but atomisp_css_stop() sets the ia_css_pipeline.stop_requested flag. So even on BYT freeing the buffers from the ISR never happens. This likely is a good thing since the buffers get freed on the first frame completion event and there might be multiple frames queued up. Fix things by completely dropping the freeing of the MIPI buffers from the ISR as well as the stop_requested flag always freeing the buffers from ia_css_uninit(). Also drop the warning since this now always is expected behavior. Note that ia_css_uninit() get called whenever streaming is stopped through atomisp_stop_stream() calling atomisp_reset() so the buffers are still freed whenever streaming is stopped. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250505210008.152659-5-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit 2194e6066ae092864cc5a92400826c9758f75a57 Author: Hans de Goede Date: Fri Jul 4 11:20:56 2025 +0200 media: atomisp: Stop pipeline on atomisp_css_start() failure atomisp_start_streaming() starts the media pipeline before calling atomisp_css_start(). On atomisp_css_start() failures stop the pipeline before returning the error. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250505210008.152659-4-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit 41dd1f2fac325bdc39318665a91040097b2cd26c Author: Hans de Goede Date: Fri Jul 4 11:20:46 2025 +0200 media: atomisp: Properly stop the ISP stream on sensor streamon errors When v4l2_subdev_call(sensor, s_stream, 1) fails atomisp_start_streaming() was not properly returning the buffer ownership back to the videobuf2-core code, resulting in: [ 1318.153447] ------------[ cut here ]------------ [ 1318.153499] WARNING: CPU: 0 PID: 4856 at drivers/media/common/videobuf2/videobuf2-core.c:1803 vb2_start_streaming+0xcb/0x160 [videobuf2_common] ... [ 1318.154551] Call Trace: [ 1318.154560] [ 1318.154571] ? __warn.cold+0xb7/0x14a [ 1318.154591] ? vb2_start_streaming+0xcb/0x160 [videobuf2_common] [ 1318.154617] ? report_bug+0xe0/0x180 [ 1318.154640] ? handle_bug+0x5e/0xa0 [ 1318.154652] ? exc_invalid_op+0x14/0x70 [ 1318.154665] ? asm_exc_invalid_op+0x16/0x20 [ 1318.154697] ? vb2_start_streaming+0xcb/0x160 [videobuf2_common] [ 1318.154723] ? vb2_start_streaming+0x70/0x160 [videobuf2_common] [ 1318.154748] vb2_core_streamon+0xa2/0x100 [videobuf2_common] The sensor streamon call is the last thing that atomisp_start_streaming() does and it was failing to undo all of the previous steps in general. Refactor atomisp_stop_streaming() into an atomisp_stop_stream() helper and call that on sensor streamon failure to properly clean things up. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250505210008.152659-3-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit 0a345630c980b6a274d9d4b1e9fd833bfc1a6959 Author: Hans de Goede Date: Fri Jul 4 11:20:30 2025 +0200 media: atomisp: Move atomisp_stop_streaming() above atomisp_start_streaming() Move atomisp_stop_streaming() above atomisp_start_streaming(), this is a preparation patch for making atomisp_start_streaming() properly cleanup if starting the sensor stream fails. No functional change, only moving a block of code up. Signed-off-by: Hans de Goede Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250505210008.152659-2-hdegoede@redhat.com Signed-off-by: Mauro Carvalho Chehab commit 5701c792c7b9348adca640f24bb01d69ba657e03 Author: Hans Verkuil Date: Mon Jun 30 13:08:50 2025 +0200 media: cec: cec-gpio: reading hpd/5v is allowed to sleep Reading the hpd or 5v gpios is something that can sleep, so rework the code to allow this. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit e068fbdf4ccb503dd05126361b6e587abc0e7d9f Author: Hans Verkuil Date: Mon Jun 30 13:08:49 2025 +0200 media: cec: cec-gpio: rename functions Ensure that the interrupt function names clearly state for which gpio they are (cec/hpd/5v). No functional changes. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit a8c42a5bf5ea9914d662db799a1d5c93c2176a5c Author: Hans Verkuil Date: Mon Jun 30 13:08:48 2025 +0200 Documentation: media: cec: update error inj doc Document rx-no-low-drive and the new support to inject glitches. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit a9fc2adc142379ffb10e28c580470bc7ddb2e06c Author: Hans Verkuil Date: Mon Jun 30 13:08:47 2025 +0200 media: cec: core: add rx-no-low-drive setting If rx-no-low-drive is set, then the CEC pin framework will disable the detection of situations where a Low Drive has to be generated. So if this is set, then we will never generate Low Drives. This helps testing whether other CEC devices generate Low Drive pulses by ensuring it is not us that is generating them. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 36e713438ae3519ef46f3dd1093045627718311b Author: Hans Verkuil Date: Mon Jun 30 13:08:46 2025 +0200 media: cec: core: add glitch error injection This adds support for inserting 'glitches' after a falling and/or rising edge. This tests what happens when there are little voltage spikes after falling or rising edges, which can be caused due to noise or reflections on the CEC line. A proper CEC implementation will deglitch this, but a poor implementation can create a Low Drive pulse in response, effectively making CEC unusable. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 5bcc50cb55c2bdc24aafffef9ad1529839ddc948 Author: Hans Verkuil Date: Wed Jun 25 08:35:36 2025 +0200 media: i2c: adv7604/tc358743/tda1997x: HPD low for HZ / 7 When the EDID is updated, the hotplug detect signal must remain low for 100 ms minimum. Currently these three drivers use that exact minimum, but some HDMI transmitters need the HPD to be low for a bit longer before they detect that they need to read the EDID again. Experience shows that HZ / 7 (= 143 ms) is a good value. So change HZ / 10 to HZ / 7. Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab commit 0234362d0af4649bc2ff745e94d06d0c6f0a46ce Merge: 4b62261def0b60 a9aec713d0d9d6 Author: Jakub Kicinski Date: Mon Jul 7 19:12:19 2025 -0700 Merge branch 'net-mlx5-hws-optimize-matchers-icm-usage' Mark Bloch says: ==================== net/mlx5: HWS, Optimize matchers ICM usage This series optimizes ICM usage for unidirectional rules and empty matchers and with the last patch we make hardware steering the default FDB steering provider for NICs that don't support software steering. Hardware steering (HWS) uses a type of rule table container (RTC) that is unidirectional, so matchers consist of two RTCs to accommodate bidirectional rules. This small series enables resizing the two RTCs independently by tracking the number of rules separately. For extreme cases where all rules are unidirectional, this results in saving close to half the memory footprint. Results for inserting 1M unidirectional rules using a simple module: Pages Memory Before this patch: 300k 1.5GiB After this patch: 160k 900MiB The 'Pages' column measures the number of 4KiB pages the device requests for itself (the ICM). The 'Memory' column is the difference between peak usage and baseline usage (before starting the test) as reported by `free -h`. In addition, second to last patch of the series handles a case where all the matcher's rules were deleted: the large RTCs of the matcher are no longer required, and we can save some more ICM by shrinking the matcher to its initial size. Finally the last patch makes hardware steering the default mode when in swichdev for NICs that don't have software steering support. ==================== Link: https://patch.msgid.link/20250703185431.445571-1-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit a9aec713d0d9d6c3d918df26c61ee42ee2c28676 Author: Moshe Shemesh Date: Thu Jul 3 21:54:31 2025 +0300 net/mlx5: Add HWS as secondary steering mode Add HW Steering (HWS) as a secondary option for device steering mode. If the device does not support SW Steering (SWS), HW Steering will be used as the default, provided it is supported. FW Steering will now be selected as the default only if both HWS and SWS are unavailable. Signed-off-by: Moshe Shemesh Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250703185431.445571-11-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 96e4c4a1a5bc6b6bc1ba48c6dfd2246df24f2f63 Author: Yevgeny Kliteynik Date: Thu Jul 3 21:54:30 2025 +0300 net/mlx5: HWS, Shrink empty matchers Matcher size is dynamic: it starts at initial size, and then it grows through rehash as more and more rules are added to this matcher. When rules are deleted, matcher's size is not decreased. Rehash approach is greedy. The idea is: if the matcher got to a certain size at some point, chances are - it will get to this size again, so it is better to avoid costly rehash operations whenever possible. However, when all the rules of the matcher are deleted, this should be viewed as special case. If the matcher actually got to the point where it has zero rules, it might be an indication that some usecase from the past is no longer happening. This is where some ICM can be freed. This patch handles this case: when a number of rules in a matcher goes down to zero, the matcher's tables are shrunk to the initial size. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Vlad Dogaru Signed-off-by: Mark Bloch Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250703185431.445571-10-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 29063103f864fb63f7f7c436e670c5804df1b55b Author: Yevgeny Kliteynik Date: Thu Jul 3 21:54:29 2025 +0300 net/mlx5: HWS, Rearrange to prevent forward declaration As a preparation for the following patch that will add support for shrinking empty matchers, rearrange the code to prevent forward declaration of functions. Signed-off-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250703185431.445571-9-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 6b44fffdc7b792e1d32b104c76504c3722e9704f Author: Vlad Dogaru Date: Thu Jul 3 21:54:28 2025 +0300 net/mlx5: HWS, Track matcher sizes individually Track and grow matcher sizes individually for RX and TX RTCs. This allows RX-only or TX-only use cases to effectively halve the device resources they use. For testing we used a simple module that inserts 1M RX-only rules and measured the number of pages the device requests, and memory usage as reported by `free -h`. Pages Memory Before this patch: 300k 1.5GiB After this patch: 160k 900MiB Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250703185431.445571-8-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit c8332ce096913bc6624cdbd5276fa49dc92fa532 Author: Vlad Dogaru Date: Thu Jul 3 21:54:27 2025 +0300 net/mlx5: HWS, Decouple matcher RX and TX sizes Kernel HWS only uses FDB tables and, as such, creates two lower level containers (RTCs) for each matcher: one for RX and one for TX. Allow these RTCs to differ in size by converting the size part of the matcher attribute to a two element array. Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Reviewed-by: Simon Horman Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250703185431.445571-7-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 59807d071724f4e639fa9ebf841b12fb97e5dbf2 Author: Vlad Dogaru Date: Thu Jul 3 21:54:26 2025 +0300 net/mlx5: HWS, Create STEs directly from matcher Matchers were using the pool abstraction solely as a convenience to allocate two STE ranges. The pool's core functionality, that of allocating individual items from the range, was unused. Matchers rely either on the hardware to hash rules into a table, or on a user-provided index. Remove the STE pool from the matcher and allocate the STE ranges manually instead. Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Reviewed-by: Simon Horman Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250703185431.445571-6-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 3dcac700d20b9e426386d7f59f1601db038fbf1c Author: Vlad Dogaru Date: Thu Jul 3 21:54:25 2025 +0300 net/mlx5: HWS, Refactor rule skip logic Reduce nesting by adding a couple of early return statements. Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250703185431.445571-5-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit d8e7ab591b506b56dc96021674938d0c7905e656 Author: Vlad Dogaru Date: Thu Jul 3 21:54:24 2025 +0300 net/mlx5: HWS, Export rule skip logic The bwc layer will use `mlx5hws_rule_skip` to keep track of numbers of RX and TX rules individually, so export this function for future usage. Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250703185431.445571-4-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 26b06579d50d5f0462c45b63291b90ea85664237 Author: Yevgeny Kliteynik Date: Thu Jul 3 21:54:23 2025 +0300 net/mlx5: HWS, remove incorrect comment Removing incorrect comment section that is probably some copy-paste artifact. Signed-off-by: Yevgeny Kliteynik Reviewed-by: Vlad Dogaru Reviewed-by: Simon Horman Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250703185431.445571-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 60afb51c89414b3d0061226415651f29a7eaf932 Author: Vlad Dogaru Date: Thu Jul 3 21:54:22 2025 +0300 net/mlx5: HWS, remove unused create_dest_array parameter `flow_source` is not used anywhere in mlx5hws_action_create_dest_array. Signed-off-by: Vlad Dogaru Signed-off-by: Yevgeny Kliteynik Reviewed-by: Simon Horman Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250703185431.445571-2-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 4b62261def0b607133b6dc6d916d830006253b27 Merge: 95f6fedd623bc4 a31cb447b5473c Author: Jakub Kicinski Date: Mon Jul 7 19:06:13 2025 -0700 Merge branch '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-07-03 Vladimir Oltean converts Intel drivers (ice, igc, igb, ixgbe, i40e) to utilize new timestamping API (ndo_hwtstamp_get() and ndo_hwtstamp_set()). For ixgbe: Paul, Don, Slawomir, and Radoslaw add Malicious Driver Detection (MDD) support for X550 and E610 devices to detect, report, and handle potentially malicious VFs. Simon Horman corrects spelling mistakes. For igbvf: Kohei Enju removes a couple of unreported counters and adds reporting of Tx timeouts. * '10GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: igbvf: add tx_timeout_count to ethtool statistics igbvf: remove unused interrupt counter fields from struct igbvf_adapter ixgbe: spelling corrections ixgbe: turn off MDD while modifying SRRCTL ixgbe: add Tx hang detection unhandled MDD ixgbe: check for MDD events ixgbe: add MDD support i40e: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() ixgbe: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() igb: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() igc: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() ice: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() ==================== Link: https://patch.msgid.link/20250703174242.3829277-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit fdf003f30b99e232cd3e61cc42d836ed14d08ccb Author: Andrew Jeffery Date: Mon Jun 16 22:43:47 2025 +0930 soc: aspeed: lpc-snoop: Lift channel config to const structs The shifts and masks for each channel are defined by hardware and are not something that changes at runtime. Accordingly, describe the information in an array of const structs and associate elements with each channel instance, removing the need for the switch and handling of its default case. Link: https://patch.msgid.link/20250616-aspeed-lpc-snoop-fixes-v2-10-3cdd59c934d3@codeconstruct.com.au Signed-off-by: Andrew Jeffery commit 4483e3c481bd2d026813434f3cd93381386cd1fa Author: Andrew Jeffery Date: Mon Jun 16 22:43:46 2025 +0930 soc: aspeed: lpc-snoop: Consolidate channel initialisation Previously, channel initialisation was a bit perilous with respect to resource cleanup in error paths. While the implementation had issues, it at least made an effort to eliminate some of its problems by first testing whether any channels were enabled, and bailing out if not. Having improved the robustness of resource handling in probe() we can now rearrange the initial channel test to be located with the subsequent test, and rework the unrolled conditional logic to use a loop for an improvement in readability. Link: https://patch.msgid.link/20250616-aspeed-lpc-snoop-fixes-v2-9-3cdd59c934d3@codeconstruct.com.au Acked-by: Jean Delvare Signed-off-by: Andrew Jeffery commit fa4ffb06d8e4c243ca1073d321068ee8ab384b4b Author: Andrew Jeffery Date: Mon Jun 16 22:43:45 2025 +0930 soc: aspeed: lpc-snoop: Use dev_err_probe() where possible Exploit that it returns the provided error to eliminate some lines, and return the actual error involved rather than -ENODEV. Link: https://patch.msgid.link/20250616-aspeed-lpc-snoop-fixes-v2-8-3cdd59c934d3@codeconstruct.com.au Acked-by: Jean Delvare Signed-off-by: Andrew Jeffery commit 08ebd4c56aa23c710fa9d6832ae1df225d35ea0c Author: Andrew Jeffery Date: Mon Jun 16 22:43:44 2025 +0930 soc: aspeed: lpc-snoop: Switch to devm_clk_get_enabled() Simplify clock handling as done in other drivers. Link: https://patch.msgid.link/20250616-aspeed-lpc-snoop-fixes-v2-7-3cdd59c934d3@codeconstruct.com.au Acked-by: Jean Delvare Signed-off-by: Andrew Jeffery commit 6c64e1a828a20f841f3fcfe64bca6b1437d15f21 Author: Andrew Jeffery Date: Mon Jun 16 22:43:43 2025 +0930 soc: aspeed: lpc-snoop: Rearrange channel paths Order assignments such that tests for conditions not involving resource acquisition are ordered before those testing acquired resources, and order managed resource acquisition before unmanaged where possible. This way we minimise the amount of manual cleanup required. In the process, improve readability of the code by introducing a channel pointer that takes the place of the repeated object lookups. Acked-by: Jean Delvare Link: https://patch.msgid.link/20250616-aspeed-lpc-snoop-fixes-v2-6-3cdd59c934d3@codeconstruct.com.au Signed-off-by: Andrew Jeffery commit e88c9a712f9acc699ee69246d838bfca95956bf3 Author: Andrew Jeffery Date: Mon Jun 16 22:43:42 2025 +0930 soc: aspeed: lpc-snoop: Rename 'channel' to 'index' in channel paths We'll introduce another 'channel' variable shortly Acked-by: Jean Delvare Link: https://patch.msgid.link/20250616-aspeed-lpc-snoop-fixes-v2-5-3cdd59c934d3@codeconstruct.com.au Signed-off-by: Andrew Jeffery commit 3e9c15784a583ad242e3374839d1ce849876e11a Author: Andrew Jeffery Date: Mon Jun 16 22:43:41 2025 +0930 soc: aspeed: lpc-snoop: Constrain parameters in channel paths Ensure pointers and the channel index are valid before use. Link: https://patch.msgid.link/20250616-aspeed-lpc-snoop-fixes-v2-4-3cdd59c934d3@codeconstruct.com.au Signed-off-by: Andrew Jeffery commit 3795e993931f2120bf64b8cdf03bb8c4f988b920 Author: Andrew Jeffery Date: Mon Jun 16 22:43:40 2025 +0930 soc: aspeed: lpc-snoop: Ensure model_data is valid of_device_get_match_data() can return NULL, though shouldn't in current circumstances. Regardless, initialise model_data closer to use so it's clear we need to test for validity prior to dereferencing. Acked-by: Jean Delvare Link: https://patch.msgid.link/20250616-aspeed-lpc-snoop-fixes-v2-3-3cdd59c934d3@codeconstruct.com.au Signed-off-by: Andrew Jeffery commit 95f6fedd623bc4fdd93d1c7e61898cb1d46da7a9 Merge: 8d5d927d963b7d 320164a6e17213 Author: Jakub Kicinski Date: Mon Jul 7 19:02:39 2025 -0700 Merge branch 'net-phylink-support-autoneg-configuration-for-sfps' Russell King says: ==================== net: phylink: support !autoneg configuration for SFPs This series comes from discussion during a patch series that was posted at the beginning of April, but these patches were never posted (I was too busy!) We restrict ->sfp_interfaces to those that the host system supports, and ensure that ->sfp_interfaces is cleared when a SFP is removed. We then add phylink_sfp_select_interface_speed() which will select an appropriate interface from ->sfp_interfaces for the speed, and use that in our phylink_ethtool_ksettings_set() when a SFP bus is present on a directly connected host (not with a PHY.) ==================== Link: https://patch.msgid.link/aGT_hoBELDysGbrp@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 320164a6e172137bcefea669f0ff6ee3f4c8611e Author: Russell King (Oracle) Date: Wed Jul 2 10:44:34 2025 +0100 net: phylink: add phylink_sfp_select_interface_speed() Add phylink_sfp_select_interface_speed() which attempts to select the SFP interface based on the ethtool speed when autoneg is turned off. This allows users to turn off autoneg for SFPs that support multiple interface modes, and have an appropriate interface mode selected. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Link: https://patch.msgid.link/E1uWu14-005KXo-IO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b0fdff22d520bde77f3c7119b6999a08544129b6 Author: Russell King (Oracle) Date: Wed Jul 2 10:44:29 2025 +0100 net: phylink: clear SFP interfaces when not in use Clear the SFP interfaces bitmap when we're not using it - in other words, when a module is unplugged, or we're using a PHY on the module. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1uWu0z-005KXi-EM@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit ff1fce1bdd7b96b6e84518c277569dabbfb18c7d Author: Russell King (Oracle) Date: Wed Jul 2 10:44:24 2025 +0100 net: phylink: restrict SFP interfaces to those that are supported When configuring an optical SFP interface, restrict the bitmap of SFP interfaces (pl->sfp_interfaces) to those that are supported by the host, rather than calculating this in a local variable. This will allow us to avoid recomputing this in the phylink_ethtool_ksettings_set() path. Signed-off-by: Russell King (Oracle) Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/E1uWu0u-005KXc-A4@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 8d5d927d963b7db8e8c7cda572541f80a69272b0 Merge: 11bd57844f526b 13a68c1ed754ba Author: Jakub Kicinski Date: Mon Jul 7 18:54:08 2025 -0700 Merge branch 'introducing-broadcom-bnge-ethernet-driver' Vikas Gupta says: ==================== Introducing Broadcom BNGE Ethernet Driver This patch series introduces the Ethernet driver for Broadcom’s BCM5770X chip family, which supports 50/100/200/400/800 Gbps link speeds. The driver is built as the bng_en.ko kernel module. To keep the series within a reviewable size (~5K lines of code), this initial submission focuses on the core infrastructure and initialization, including: 1) PCIe support (device IDs, probe/remove) 2) Devlink support 3) Firmware communication mechanism 4) Creation of network device 5) PF Resource management (rings, IRQs, etc. for netdev & aux dev) Support for Tx/Rx datapaths, link management, ethtool/devlink operations and additional features will be introduced in the subsequent patch series. The bng_en driver shares the bnxt_hsi.h file with the bnxt_en driver, as the bng_en driver leverages the hardware communication protocol used by the bnxt_en driver. ==================== Link: https://patch.msgid.link/20250701143511.280702-1-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 13a68c1ed754baeef864dfcbc81e358e8fd25b8b Author: Vikas Gupta Date: Tue Jul 1 14:35:08 2025 +0000 bng_en: Add a network device Add a network device with netdev features enabled. Some features are enabled based on the capabilities advertised by the firmware. Add the skeleton of minimal netdev operations. Additionally, initialize the parameters for rings (TX/RX/Completion). Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250701143511.280702-11-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 3fa9e977a0cd0f3719c614be2130b2457d95e059 Author: Vikas Gupta Date: Tue Jul 1 14:35:07 2025 +0000 bng_en: Initialize default configuration Query resources from the firmware and, based on the availability of resources, initialize the default settings. The default settings include: 1. Rings and other resource reservations with the firmware. This ensures that resources are reserved before network and auxiliary devices are created. 2. Mapping the BAR, which helps access doorbells since its size is known after querying the firmware. 3. Retrieving the TCs and hardware CoS queue mappings. Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250701143511.280702-10-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 18a975389fcc810143c5e62294f52192f942b665 Author: Vikas Gupta Date: Tue Jul 1 14:35:06 2025 +0000 bng_en: Add irq allocation support Add irq allocation functions. This will help to allocate IRQs to both netdev and RoCE aux devices. Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250701143511.280702-9-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 627c67f038d2e9a956bc25e083bcbf9b357630d2 Author: Vikas Gupta Date: Tue Jul 1 14:35:05 2025 +0000 bng_en: Add resource management support Get the resources and capabilities from the firmware. Add functions to manage the resources with the firmware. These functions will help netdev reserve the resources with the firmware before registering the device in future patches. The resources and their information, such as the maximum available and reserved, are part of the members present in the bnge_hw_resc struct. The bnge_reserve_rings() function also populates the RSS table entries once the RX rings are reserved with the firmware. Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250701143511.280702-8-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 29c5b358f385503fbd46423352cd8526669a12fb Author: Vikas Gupta Date: Tue Jul 1 14:35:04 2025 +0000 bng_en: Add backing store support Backing store or context memory on the host helps the device to manage rings, stats and other resources. Context memory is allocated with the help of ring alloc/free functions. Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250701143511.280702-7-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 27544c0ecb4ca50954a109475932e681ea77cd6d Author: Vikas Gupta Date: Tue Jul 1 14:35:03 2025 +0000 bng_en: Add ring memory allocation support Add ring allocation/free mechanism which help to allocate rings (TX/RX/Completion) and backing stores memory on the host for the device. Future patches will use these functions. Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250701143511.280702-6-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit fb7d8b61c1f77a5d47fc5cc057d6095acfbedd92 Author: Vikas Gupta Date: Tue Jul 1 14:35:02 2025 +0000 bng_en: Add initial interaction with firmware Query firmware with the help of basic firmware commands and cache the capabilities. With the help of basic commands start the initialization process of the driver with the firmware. Since basic information is available from the firmware, register with devlink. Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250701143511.280702-5-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 7037d1d8979653e4da384b732d2f38d151b9f493 Author: Vikas Gupta Date: Tue Jul 1 14:35:01 2025 +0000 bng_en: Add firmware communication mechanism Add support to communicate with the firmware. Future patches will use these functions to send the messages to the firmware. Functions support allocating request/response buffers to send a particular command. Each command has certain timeout value to which the driver waits for response from the firmware. In error case, commands may be either timed out waiting on response from the firmware or may return a specific error code. Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250701143511.280702-4-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 9099bfa1158a119b1cfd38b4de3ab16d24f841fe Author: Vikas Gupta Date: Tue Jul 1 14:35:00 2025 +0000 bng_en: Add devlink interface Allocate a base device and devlink interface with minimal devlink ops. Add dsn and board related information. Map PCIe BAR (bar0), which helps to communicate with the firmware. Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250701143511.280702-3-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 74715c4ab0fa0c0911ba78cb639db6b8da88b085 Author: Vikas Gupta Date: Tue Jul 1 14:34:59 2025 +0000 bng_en: Add PCI interface Add basic pci interface to the driver which supports the BCM5770X NIC family. Signed-off-by: Vikas Gupta Reviewed-by: Bhargava Chenna Marreddy Reviewed-by: Rajashekar Hudumula Link: https://patch.msgid.link/20250701143511.280702-2-vikas.gupta@broadcom.com Signed-off-by: Jakub Kicinski commit 11bd57844f526b75b0e2e97622a31666896ad64e Merge: 49402a628e959c 3dc6c76391cbe5 Author: Jakub Kicinski Date: Mon Jul 7 18:52:59 2025 -0700 Merge branch 'netpoll-factor-out-functions-from-netpoll_send_udp-and-add-ipv6-selftest' Breno Leitao says: ==================== netpoll: Factor out functions from netpoll_send_udp() and add ipv6 selftest Refactors the netpoll UDP transmit path to improve code clarity, maintainability, and protocol-layer encapsulation. Function netpoll_send_udp() has more than 100 LoC, which is hard to understand and review. After this patchset, it has only 32 LoC, which is more manageable. The series systematically moves the construction of protocol headers (UDP, IPv4, IPv6, Ethernet) out of the core `netpoll_send_udp()` function into dedicated static helpers: - `push_udp()` for UDP header setup - `push_ipv4()` and `push_ipv6()` for IP header setup - `push_eth()` for Ethernet header setup This results in a clean, layered abstraction that mirrors the protocol stack, reduces code duplication, and improves readability. Also, to make sure this is not breaking anything, add IPv6 selftest to netconsole tests, which will exercise this code. This test would also pick problems similiar to the one fixed by f599020702698 ("net: netpoll: Initialize UDP checksum field before checksumming"), which was embarrassin we didn't have a selftest catch it. Anyway, there are **no functional changes** intended in this patchset. v1: https://lore.kernel.org/20250627-netpoll_untagle_ip-v1-0-61a21692f84a@debian.org ==================== Link: https://patch.msgid.link/20250702-netpoll_untagle_ip-v2-0-13cf3db24e2b@debian.org Signed-off-by: Jakub Kicinski commit 3dc6c76391cbe5ec7f87531d992beaf7dccc6ff4 Author: Breno Leitao Date: Wed Jul 2 03:06:39 2025 -0700 selftests: net: Add IPv6 support to netconsole basic tests Add IPv6 support to the netconsole basic functionality tests by: - Introducing separate IPv4 and IPv6 address variables (SRCIP4/SRCIP6, DSTIP4/DSTIP6) to replace the single SRCIP/DSTIP variables - Adding select_ipv4_or_ipv6() function to choose protocol version - Updating socat configuration to use UDP6-LISTEN for IPv6 tests - Adding wait_for_port() wrapper to handle protocol-specific port waiting - Expanding test matrix to run both basic and extended formats against both IPv4 and IPv6 protocols - Improving cleanup to kill any remaining socat processes - Adding sleep delays for better IPv6 packet handling reliability The test now validates netconsole functionality across both IP versions, improving test coverage for dual-stack network environments. This test would avoid the regression fixed by commit f59902070269 ("net: netpoll: Initialize UDP checksum field before checksumming") Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702-netpoll_untagle_ip-v2-7-13cf3db24e2b@debian.org Signed-off-by: Jakub Kicinski commit eb4e773f13fb701e3dfc2059afd21a2dcdb2d0ba Author: Breno Leitao Date: Wed Jul 2 03:06:38 2025 -0700 netpoll: move Ethernet setup to push_eth() helper Refactor Ethernet header population into dedicated function, completing the layered abstraction with: - push_eth() for link layer - push_udp() for transport - push_ipv4()/push_ipv6() for network Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702-netpoll_untagle_ip-v2-6-13cf3db24e2b@debian.org Signed-off-by: Jakub Kicinski commit cacfb1f4e9f6e9b1f15517841b0ef19ae83b38be Author: Breno Leitao Date: Wed Jul 2 03:06:37 2025 -0700 netpoll: factor out UDP header setup into push_udp() helper Move UDP header construction from netpoll_send_udp() into a new static helper function push_udp(). This completes the protocol layer refactoring by: 1. Creating a dedicated helper for UDP header assembly 2. Removing UDP-specific logic from the main send function 3. Establishing a consistent pattern with existing IPv4/IPv6 helpers: - push_udp() - push_ipv4() - push_ipv6() The change improves code organization and maintains the encapsulation pattern established in previous refactorings. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702-netpoll_untagle_ip-v2-5-13cf3db24e2b@debian.org Signed-off-by: Jakub Kicinski commit 8c27639dbe549a58415c83a078c28e6b00c73f0f Author: Breno Leitao Date: Wed Jul 2 03:06:36 2025 -0700 netpoll: factor out IPv4 header setup into push_ipv4() helper Move IPv4 header construction from netpoll_send_udp() into a new static helper function push_ipv4(). This completes the refactoring started with IPv6 header handling, creating symmetric helper functions for both IP versions. Changes include: 1. Extracting IPv4 header setup logic into push_ipv4() 2. Replacing inline IPv4 code with helper call 3. Moving eth assignment after helper calls for consistency The refactoring reduces code duplication and improves maintainability by isolating IP version-specific logic. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702-netpoll_untagle_ip-v2-4-13cf3db24e2b@debian.org Signed-off-by: Jakub Kicinski commit 839388f39aee525db68e8ed61c966f4ba794d20d Author: Breno Leitao Date: Wed Jul 2 03:06:35 2025 -0700 netpoll: factor out IPv6 header setup into push_ipv6() helper Move IPv6 header construction from netpoll_send_udp() into a new static helper function, push_ipv6(). This refactoring reduces code duplication and improves readability in netpoll_send_udp(). Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702-netpoll_untagle_ip-v2-3-13cf3db24e2b@debian.org Signed-off-by: Jakub Kicinski commit 01dae7a61c1a9bfdc204b602c83313fd08889a91 Author: Breno Leitao Date: Wed Jul 2 03:06:34 2025 -0700 netpoll: factor out UDP checksum calculation into helper Extract UDP checksum calculation logic from netpoll_send_udp() into a new static helper function netpoll_udp_checksum(). This reduces code duplication and improves readability for both IPv4 and IPv6 cases. No functional change intended. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702-netpoll_untagle_ip-v2-2-13cf3db24e2b@debian.org Signed-off-by: Jakub Kicinski commit 4b52cdfcce21d3cc207a1ddb691e1f8c1fcda6fc Author: Breno Leitao Date: Wed Jul 2 03:06:33 2025 -0700 netpoll: Improve code clarity with explicit struct size calculations Replace pointer-dereference sizeof() operations with explicit struct names for improved readability and maintainability. This change: 1. Replaces `sizeof(*udph)` with `sizeof(struct udphdr)` 2. Replaces `sizeof(*ip6h)` with `sizeof(struct ipv6hdr)` 3. Replaces `sizeof(*iph)` with `sizeof(struct iphdr)` This will make it easy to move code in the upcoming patches. No functional changes are introduced by this patch. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250702-netpoll_untagle_ip-v2-1-13cf3db24e2b@debian.org Signed-off-by: Jakub Kicinski commit 49402a628e959c1cb42c0b3bd9336b20f358c632 Merge: 6058099da5e5eb 04c7aaccdcf60a Author: Jakub Kicinski Date: Mon Jul 7 18:50:48 2025 -0700 Merge branch 'net-ethernet-mtk_eth_soc-improve-device-tree-handling' Daniel Golle says: ==================== net: ethernet: mtk_eth_soc: improve device tree handling This series further improves the mtk_eth_soc driver in preparation to complete upstream support for the MediaTek MT7988 SoC family. Frank Wunderlich's previous attempt to have the ethernet node included in mt7988a.dtsi and cover support for MT7988 in the device tree bindings was criticized for the way mtk_eth_soc references SRAM in device tree[1]. Having a 2nd 'reg' property, like introduced by commit ebb1e4f9cf38 ("net: ethernet: mtk_eth_soc: add support for in-SoC SRAM") isn't acceptable and a dedicated "mmio-sram" node should be used instead. In order to make the code more clean and readable, the existing hardcoded offsets for the scratch ring, RX and TX rings are dropped in favor of using the generic allocator. However, support for the hardcoded offset of the SRAM itself being included as part of the Ethernet's "reg" MMIO space is kept as it will still be required in order to support existing legacy device trees of the MT7986 SoC family. While at it also replace confusing error messages when using legacy device trees without "interrupt-names" with a warning informing users that they are using a legacy device tree. [1]: https://patchwork.ozlabs.org/comment/3533543/ ==================== Link: https://patch.msgid.link/cover.1751461762.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 04c7aaccdcf60a0aff94acdd182561a6dd4c51c5 Author: Daniel Golle Date: Wed Jul 2 14:14:56 2025 +0100 net: ethernet: mtk_eth_soc: use generic allocator for SRAM Use a dedicated "mmio-sram" node and the generic allocator instead of open-coding SRAM allocation for DMA rings. Keep support for legacy device trees but notify the user via a warning to update, and let the ethernet driver create the gen_pool in this case. Co-developed-by: Frank Wunderlich Signed-off-by: Frank Wunderlich Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/c2b9242229d06af4e468204bcf42daa1535c3a72.1751461762.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit d717d32f517f79da11065fd6334c780a495ef097 Author: Daniel Golle Date: Wed Jul 2 14:14:39 2025 +0100 net: ethernet: mtk_eth_soc: fix kernel-doc comment Fix and add some missing field descriptions to kernel-doc comment of struct mtk_eth. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/748e7de848e45ecdc84fbb78e34e9e13b9aa4329.1751461762.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit e81d36d48880ab3f2b351ce3df799acaa8b11c4f Author: Daniel Golle Date: Wed Jul 2 14:14:29 2025 +0100 net: ethernet: mtk_eth_soc: improve support for named interrupts Use platform_get_irq_byname_optional() to avoid outputting error messages when using legacy device trees which rely identifying interrupts only by index. Instead, output a warning notifying the user to update their device tree. Signed-off-by: Daniel Golle Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/aeccd00eccb7186d39d2c16292019b3b22ec53b8.1751461762.git.daniel@makrotopia.org Signed-off-by: Jakub Kicinski commit 6058099da5e5eb057751905e587328affb93a81a Author: Eric Dumazet Date: Wed Jul 2 06:15:58 2025 +0000 net: remove RTNL use for /proc/sys/net/core/rps_default_mask Use a dedicated mutex instead. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250702061558.1585870-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit d8bf56a0ca10af7936de8bbdd510c33041dacecc Author: Byungchul Park Date: Wed Jul 2 14:32:56 2025 +0900 page_pool: make page_pool_get_dma_addr() just wrap page_pool_get_dma_addr_netmem() The page pool members in struct page cannot be removed unless it's not allowed to access any of them via struct page. Do not access 'page->dma_addr' directly in page_pool_get_dma_addr() but just wrap page_pool_get_dma_addr_netmem() safely. Signed-off-by: Byungchul Park Reviewed-by: Mina Almasry Reviewed-by: Ilias Apalodimas Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Pavel Begunkov Acked-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/20250702053256.4594-6-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 4369d40da2f28ae1d3caadd4eb5d7b7f49a3776f Author: Byungchul Park Date: Wed Jul 2 14:32:55 2025 +0900 netmem: use _Generic to cover const casting for page_to_netmem() The current page_to_netmem() doesn't cover const casting resulting in trying to cast const struct page * to const netmem_ref fails. To cover the case, change page_to_netmem() to use macro and _Generic. Signed-off-by: Byungchul Park Reviewed-by: Mina Almasry Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Pavel Begunkov Link: https://patch.msgid.link/20250702053256.4594-5-byungchul@sk.com Signed-off-by: Jakub Kicinski commit b56ce86846225d6bc96ca9428ad945b4d86b96d5 Author: Byungchul Park Date: Wed Jul 2 14:32:54 2025 +0900 page_pool: rename __page_pool_alloc_pages_slow() to __page_pool_alloc_netmems_slow() Now that __page_pool_alloc_pages_slow() is for allocating netmem, not struct page, rename it to __page_pool_alloc_netmems_slow() to reflect what it does. Signed-off-by: Byungchul Park Reviewed-by: Mina Almasry Reviewed-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250702053256.4594-4-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 4ad125ae380bf0bd55d6e1efb492d2ad4f867030 Author: Byungchul Park Date: Wed Jul 2 14:32:53 2025 +0900 page_pool: rename __page_pool_release_page_dma() to __page_pool_release_netmem_dma() Now that __page_pool_release_page_dma() is for releasing netmem, not struct page, rename it to __page_pool_release_netmem_dma() to reflect what it does. Signed-off-by: Byungchul Park Reviewed-by: Mina Almasry Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Pavel Begunkov Reviewed-by: Ilias Apalodimas Link: https://patch.msgid.link/20250702053256.4594-3-byungchul@sk.com Signed-off-by: Jakub Kicinski commit 61a33247533465c9d65daadaee60d5f2bcf62779 Author: Byungchul Park Date: Wed Jul 2 14:32:52 2025 +0900 page_pool: rename page_pool_return_page() to page_pool_return_netmem() Now that page_pool_return_page() is for returning netmem, not struct page, rename it to page_pool_return_netmem() to reflect what it does. Signed-off-by: Byungchul Park Reviewed-by: Mina Almasry Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Pavel Begunkov Reviewed-by: Ilias Apalodimas Link: https://patch.msgid.link/20250702053256.4594-2-byungchul@sk.com Signed-off-by: Jakub Kicinski commit e2793101d6a99cc8b2f7793aeceada09c18719ae Author: David Thompson Date: Tue Jul 1 14:03:24 2025 -0400 mlxbf_gige: emit messages during open and probe failures The open() and probe() functions of the mlxbf_gige driver check for errors during initialization, but do not provide details regarding the errors. The mlxbf_gige driver should provide error details in the kernel log, noting what step of initialization failed. Signed-off-by: David Thompson Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250701180324.29683-1-davthompson@nvidia.com Signed-off-by: Jakub Kicinski commit f55ce5a6cd33211c8cc5bce0554b6ac710a6a28b Author: Ankit Agrawal Date: Sat Jul 5 07:17:17 2025 +0000 KVM: arm64: Expose new KVM cap for cacheable PFNMAP Introduce a new KVM capability to expose to the userspace whether cacheable mapping of PFNMAP is supported. The ability to safely do the cacheable mapping of PFNMAP is contingent on S2FWB and ARM64_HAS_CACHE_DIC. S2FWB allows KVM to avoid flushing the D cache, ARM64_HAS_CACHE_DIC allows KVM to avoid flushing the icache and turns icache_inval_pou() into a NOP. The cap would be false if those requirements are missing and is checked by making use of kvm_arch_supports_cacheable_pfnmap. This capability would allow userspace to discover the support. It could for instance be used by userspace to prevent live-migration across FWB and non-FWB hosts. CC: Catalin Marinas CC: Jason Gunthorpe CC: Oliver Upton CC: David Hildenbrand Suggested-by: Marc Zyngier Reviewed-by: Jason Gunthorpe Tested-by: Donald Dutile Signed-off-by: Ankit Agrawal Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20250705071717.5062-7-ankita@nvidia.com Signed-off-by: Oliver Upton commit 0c67288e0c8bc1e39d7057fbae65bf57ca943676 Author: Ankit Agrawal Date: Sat Jul 5 07:17:15 2025 +0000 KVM: arm64: Allow cacheable stage 2 mapping using VMA flags KVM currently forces non-cacheable memory attributes (either Normal-NC or Device-nGnRE) for a region based on pfn_is_map_memory(), i.e. whether or not the kernel has a cacheable alias for it. This is necessary in situations where KVM needs to perform CMOs on the region but is unnecessarily restrictive when hardware obviates the need for CMOs. KVM doesn't need to perform any CMOs on hardware with FEAT_S2FWB and CTR_EL0.DIC. As luck would have it, there are implementations in the wild that need to map regions of a device with cacheable attributes to function properly. An example of this is Nvidia's Grace Hopper/Blackwell systems where GPU memory is interchangeable with DDR and retains properties such as cacheability, unaligned accesses, atomics and handling of executable faults. Of course, for this to work in a VM the GPU memory needs to have a cacheable mapping at stage-2. Allow cacheable stage-2 mappings to be created on supporting hardware when the VMA has cacheable memory attributes. Check these preconditions during memslot creation (in addition to fault handling) to potentially 'fail-fast' as a courtesy to userspace. CC: Oliver Upton CC: Sean Christopherson Suggested-by: Jason Gunthorpe Suggested-by: Catalin Marinas Suggested-by: David Hildenbrand Tested-by: Donald Dutile Signed-off-by: Ankit Agrawal Reviewed-by: David Hildenbrand Reviewed-by: Jason Gunthorpe Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20250705071717.5062-6-ankita@nvidia.com [ Oliver: refine changelog, squash kvm_supports_cacheable_pfnmap() patch ] Signed-off-by: Oliver Upton commit 585189332afe02c99e66c6a0d328fe05e456ff6a Author: Ian Rogers Date: Mon Jun 30 09:31:00 2025 -0700 perf vendor events: Update TigerLake events Update events from v1.17 to v1.18. Bring in the event updates v1.18: https://github.com/intel/perfmon/commit/943fea37d0d54232605f12abf72a812ac314cd1d Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-16-irogers@google.com Signed-off-by: Namhyung Kim commit 80c6b82226c1d34e6bcad8e88c4cf319b43d5d3a Author: Ian Rogers Date: Mon Jun 30 09:30:59 2025 -0700 perf vendor events: Update SkylakeX events Update events from v1.36 to v1.37. Bring in the event updates v1.37: https://github.com/intel/perfmon/commit/6ee8e4cadda8b6954bd84236e20fab95e345578f Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-15-irogers@google.com Signed-off-by: Namhyung Kim commit 336473ad0771890fc4106da08efa3cef4b30b106 Author: Ian Rogers Date: Mon Jun 30 09:30:58 2025 -0700 perf vendor events: Update SierraForest events Update events from v1.09 to v1.11. Bring in the event updates v1.11: https://github.com/intel/perfmon/commit/6b824df1dba3948146281c8ba2a8c3e7bf7f7c51 https://github.com/intel/perfmon/commit/4b0346fbee2b04dd34526522250116aee525c922 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-14-irogers@google.com Signed-off-by: Namhyung Kim commit 8704418511944eb417e35af30da5cb4a0b3676a9 Author: Ian Rogers Date: Mon Jun 30 09:30:57 2025 -0700 perf vendor events: Update SapphireRapids events Update events from v1.25 to v1.28. Bring in the event updates v1.28: https://github.com/intel/perfmon/commit/990bfdff270adf08d408534d6d66ba47ec6adb34 https://github.com/intel/perfmon/commit/b7b4d7f18cf9a893438777a571abc7ecc087368b Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-13-irogers@google.com Signed-off-by: Namhyung Kim commit 1f9e24e4df0099c407bc7eeed931baf58d9144a9 Author: Ian Rogers Date: Mon Jun 30 09:30:56 2025 -0700 perf vendor events: Add PantherLake events Bring in the events at v1.00: https://github.com/intel/perfmon/commit/d90a6737d0e4e6fbea4a5951e829615fd8317c24 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-12-irogers@google.com Signed-off-by: Namhyung Kim commit a04ab3e59d6a2be27a45d54aef706c7080c7db4e Author: Ian Rogers Date: Mon Jun 30 09:30:55 2025 -0700 perf vendor events: Update MeteorLake events Update events from v1.13 to v1.14. Bring in the event updates v1.14: https://github.com/intel/perfmon/commit/6c53969b8d1a83afe6ae90149c8dd4ee416027ef Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-11-irogers@google.com Signed-off-by: Namhyung Kim commit efafab4f491532c3293eeb1edeb9fcb2844d46b9 Author: Ian Rogers Date: Mon Jun 30 09:30:54 2025 -0700 perf vendor events: Update LunarLake events Update events from v1.11 to v1.14. Bring in the event updates v1.14: https://github.com/intel/perfmon/commit/95634fec10542c0c466eb2c6d9a81e0c24fb1123 https://github.com/intel/perfmon/commit/84a49938387ac592af0a622273e4e8e4997e987d Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-10-irogers@google.com Signed-off-by: Namhyung Kim commit 0a6b21da26e22b68a43cc763253a9ad0a8a24c1a Author: Ian Rogers Date: Mon Jun 30 09:30:53 2025 -0700 perf vendor events: Update IcelakeX events Update events from v1.27 to v1.28. Bring in the event updates v1.28: https://github.com/intel/perfmon/commit/c52728a46cf37ba271c09b1eb7093cfc82dfbf29 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-9-irogers@google.com Signed-off-by: Namhyung Kim commit 81699249168750fd7bf9101d2e98b5133d5c23f2 Author: Ian Rogers Date: Mon Jun 30 09:30:52 2025 -0700 perf vendor events: Update GraniteRapids events Update events from v1.08 to v1.10. Bring in the event updates v1.10 https://github.com/intel/perfmon/commit/96259a932e2ce5f70ed7d347ca92fdeb78f83aa5 https://github.com/intel/perfmon/commit/19e315c8d2e0b44e170a6e60de44c9359062a6aa Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-8-irogers@google.com Signed-off-by: Namhyung Kim commit 25da8939d615dc6cac67a57b320b2793691b39aa Author: Ian Rogers Date: Mon Jun 30 09:30:51 2025 -0700 perf vendor events: Update GrandRidge events Update events from v1.07 to v1.09. Bring in the event updates v1.09: https://github.com/intel/perfmon/commit/8c74d09c8544421256a79f4f21e548ad756f5b7f https://github.com/intel/perfmon/commit/18c7d2a75e45eacf5553f900ae2097a1290f5bed Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-7-irogers@google.com Signed-off-by: Namhyung Kim commit 31c8714cf5b91da62ae549323fc41e32609a5b4b Author: Ian Rogers Date: Mon Jun 30 09:30:50 2025 -0700 perf vendor events: Update EmeraldRapids events Update events from v1.11 to v1.14. Bring in the event updates v1.14: https://github.com/intel/perfmon/commit/6f6e4c8c906992b450cb2014d0501a9ec1cda0d0 https://github.com/intel/perfmon/commit/e363f82276c129aec60402a1d64efbbd41af844e Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-6-irogers@google.com Signed-off-by: Namhyung Kim commit 73a33656896f87962c47462ff8ebda03d9094e0a Author: Ian Rogers Date: Mon Jun 30 09:30:49 2025 -0700 perf vendor events: Update CascadelakeX events Update events from v1.23 to v1.25. Bring in the event updates v1.25: https://github.com/intel/perfmon/commit/86f146e15626b0fd3b032cab4538cafaaf2d0635 https://github.com/intel/perfmon/commit/fef03ffc333ae44d1e9d695b4e67e5bbb4429729 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-5-irogers@google.com Signed-off-by: Namhyung Kim commit e7c38d634cad1c71220767375c6e276de72c2dbf Author: Ian Rogers Date: Mon Jun 30 09:30:48 2025 -0700 perf vendor events: Update Arrowlake events Update events from v1.08 to v1.09. Bring in the event updates v1.09: https://github.com/intel/perfmon/commit/cf3be6daf0a751ad270b67890dfdb2261dfc75da Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-4-irogers@google.com Signed-off-by: Namhyung Kim commit e393a7b9202b0958dca0398732f4e38869a71668 Author: Ian Rogers Date: Mon Jun 30 09:30:47 2025 -0700 perf vendor events: Update AlderlakeN events Update events from v1.29 to v1.31. Bring in the event updates v1.31: https://github.com/intel/perfmon/commit/5a1269c8af70e32a548e74e1fda736189c398ddc https://github.com/intel/perfmon/commit/76c6d2c348c067e9ae1b616b35ee982da6d873b4 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-3-irogers@google.com Signed-off-by: Namhyung Kim commit a292d5733c5e9c0febaf901295eacb13e2df636c Author: Ian Rogers Date: Mon Jun 30 09:30:46 2025 -0700 perf vendor events: Update Alderlake events Update events from v1.29 to v1.31. Bring in the event updates v1.31: https://github.com/intel/perfmon/commit/5a1269c8af70e32a548e74e1fda736189c398ddc https://github.com/intel/perfmon/commit/76c6d2c348c067e9ae1b616b35ee982da6d873b4 Signed-off-by: Ian Rogers Tested-by: Thomas Falcon Link: https://lore.kernel.org/r/20250630163101.1920170-2-irogers@google.com Signed-off-by: Namhyung Kim commit 2a8dfab26677ae37243a40d170704588f791cfd3 Author: Ankit Agrawal Date: Sat Jul 5 07:17:14 2025 +0000 KVM: arm64: Block cacheable PFNMAP mapping Fixes a security bug due to mismatched attributes between S1 and S2 mapping. Currently, it is possible for a region to be cacheable in the userspace VMA, but mapped non cached in S2. This creates a potential issue where the VMM may sanitize cacheable memory across VMs using cacheable stores, ensuring it is zeroed. However, if KVM subsequently assigns this memory to a VM as uncached, the VM could end up accessing stale, non-zeroed data from a previous VM, leading to unintended data exposure. This is a security risk. Block such mismatch attributes case by returning EINVAL when userspace try to map PFNMAP cacheable. Only allow NORMAL_NC and DEVICE_*. CC: Oliver Upton CC: Catalin Marinas CC: Sean Christopherson Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Reviewed-by: David Hildenbrand Tested-by: Donald Dutile Signed-off-by: Ankit Agrawal Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20250705071717.5062-4-ankita@nvidia.com Signed-off-by: Oliver Upton commit 825aea662b492571877b32aeeae13689fd9fbee4 Author: Jens Axboe Date: Mon Jul 7 16:46:30 2025 -0600 io_uring/rw: cast rw->flags assignment to rwf_t kernel test robot reports that a recent change of the sqe->rw_flags field throws a sparse warning on 32-bit archs: >> io_uring/rw.c:291:19: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __kernel_rwf_t [usertype] flags @@ got unsigned int @@ io_uring/rw.c:291:19: sparse: expected restricted __kernel_rwf_t [usertype] flags io_uring/rw.c:291:19: sparse: got unsigned int Force cast it to rwf_t to silence that new sparse warning. Fixes: cf73d9970ea4 ("io_uring: don't use int for ABI") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507032211.PwSNPNSP-lkp@intel.com/ Signed-off-by: Jens Axboe commit a1bff3d6cc454d65a3a654cd3fcd0c90f1fb45fb Author: Aditya Kumar Singh Date: Mon Jun 30 10:15:31 2025 +0530 wifi: ath12k: Add num_stations counter for each interface Currently, ath12k driver maintains a counter to store the number of stations connected to each radio. However, at certain times like debugging, it is useful to know number of stations connected to any one of the interface in that radio. Add support to maintain a counter for number of stations connected to each interface. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Aditya Kumar Singh Signed-off-by: Roopni Devanathan Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250630044531.3490058-1-quic_rdevanat@quicinc.com Signed-off-by: Jeff Johnson commit acab697c32f7a38ec0e9721ac02febd295e8df74 Author: Sarika Sharma Date: Mon Jun 30 12:14:31 2025 +0530 wifi: ath12k: properly set bit for pdev mask for firmware PPDU_STATS request Currently, the HTT_H2T_MSG_TYPE_PPDU_STATS_CFG request uses bits 8 to 15 as the bitmask for HTT_PPDU_STATS_CFG_PDEV_ID for firmware PPDU_STATS. However, bit 8 is reserved for SOC stats, and the actual PDEV ID should be encoded using bits 9 to 15. This leads to incorrect PDEV ID encoding in the request, causing it to either ignore the request or apply it to the wrong PDEV. Additionally, pdev_mask calculation is done as pdev_mask = 1 << (i + 1); (i.e. i= num_rxmda_per_pdev) but this is not valid for multiple pdevs(multi-MAC configurations) with 1 rxdma per pdev, as this will mask the same value for all pdevs. To correctly identify each and exact MAC in multi-MAC configurations, the calculation should include ar->pdev_idx: pdev_mask = 1 << i + ar->pdev_idx; Due to these issues, the firmware does not send PPDU_STATS for the intended PDEV, leading to inaccurate and incomplete statistics on the host. This might trigger certain WARN_ON() conditions in host that rely on these statistics. Hence, change the bitmask for HTT_PPDU_STATS_CFG_PDEV_ID as bit 9 to 15 to properly fill the pdev id in request message and change the pdev_mask calculation to consider ar->pdev_idx to mask pdev correctly. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sarika Sharma Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250630064431.3446333-1-quic_sarishar@quicinc.com Signed-off-by: Jeff Johnson commit 80570587e418f361e7ce3f9200477f728b38c94b Author: Aaradhana Sahu Date: Mon Jun 30 08:45:02 2025 +0530 wifi: ath12k: Block radio bring-up in FTM mode Ensure that all radios remain down when the driver operates in Factory Test Mode (FTM). Reject any userspace attempts to bring up an interface in this mode. Currently, the driver allows userspace to bring up the interface even though it operates in FTM mode, which violates FTM constraints and leads to FTM command failures. Hence, block the radio start when the driver is in FTM mode. Also, remove ath12k_ftm_mode check from ath12k_drain_tx() because FTM mode check is already handled in the caller function (ath12k_mac_op_start()). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: 3bc374cbc49e ("wifi: ath12k: add factory test mode support") Signed-off-by: Aaradhana Sahu Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250630031502.8902-1-aaradhana.sahu@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 93a1cdb9cd94c7b8a2aac33e4b13ca61d712f5eb Author: Aditya Kumar Singh Date: Mon Jun 30 09:45:16 2025 +0530 wifi: ath12k: advertise NL80211_FEATURE_TX_POWER_INSERTION support Now that driver is capable of inserting Tx power, advertise the support for the same to upper layers. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Aditya Kumar Singh Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250630-support-for-tx-power-insertion-v1-2-77f45484d5bb@oss.qualcomm.com Signed-off-by: Jeff Johnson commit d45d015448fcfbb5dde7c09f2b0dffe5d689e6ca Author: Aditya Kumar Singh Date: Mon Jun 30 09:45:15 2025 +0530 wifi: ath12k: add support for Tx Power insertion in RRM action frame For certain action frames like the TPC Report IE in the spectrum management TPC Report action frame, and in the Radio Measurement Link Measurement Report action frame there is a requirement to fill in the current and max Tx power of the device in the packet. Add support to populate these fields in the relevant packets. In software-encrypted cases such as PMF, skip insertion since the packets are already encrypted and cannot be modified. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Aditya Kumar Singh Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250630-support-for-tx-power-insertion-v1-1-77f45484d5bb@oss.qualcomm.com Signed-off-by: Jeff Johnson commit a0b963e1da5bff03a43c87b96ae3c0ed78a11960 Author: Sarika Sharma Date: Tue Jul 1 16:29:27 2025 +0530 wifi: ath12k: fetch tx_retry and tx_failed from htt_ppdu_stats_user_cmpltn_common_tlv Currently, tx_retries and tx_failed are updated only in mac80211 during tx_completion path for sta->deflink. This works fine for non-ML station but for multi-link (ML) station, these values should be updated for sta->link[link_id] as per tx link_id. However, in tx_completion path there is no way to determine the link_id for which packet is retried or failed. Therefore, update the tx_retries and tx_failed in arsta structure from htt_ppdu_stats_user_cmpltn_common_tlv during ath12k_update_per_peer_tx_stats() call to utilize the values from arsta. Also, during 'iw dev xxxx station dump' populate the tx_retries and tx_failed in station_info structure to ensure values are correctly reflected. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sarika Sharma Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250701105927.803342-6-quic_sarishar@quicinc.com Signed-off-by: Jeff Johnson commit e0618fca1af294f2e52ec3545d76ee5d937c177e Author: Sarika Sharma Date: Tue Jul 1 16:29:26 2025 +0530 wifi: ath12k: correctly update bw for ofdma packets Currently, arsta->txrate.bw is filled from ath12k_mac_bw_to_mac80211_bw(bw) during ath12k_update_per_peer_tx_stats(). But in tx_completion path bw is filled differently if ppdu_type is ofdma for HE/EHT rates. Hence, update arsta->txrate.bw correctly if packet is ofdma for HE and EHT rate. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sarika Sharma Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250701105927.803342-5-quic_sarishar@quicinc.com Signed-off-by: Jeff Johnson commit ebde0514b4f4e78b5f9629179ca947d98b77da15 Author: Sarika Sharma Date: Tue Jul 1 16:29:25 2025 +0530 wifi: ath12k: add EHT support for TX rate Currently, TX rates are not supported for EHT. Hence, add EHT handling for TX rates and update the EHT-specific fields in arsta accordingly. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sarika Sharma Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250701105927.803342-4-quic_sarishar@quicinc.com Signed-off-by: Jeff Johnson commit 3b8aa249d0fce93590888a6ed3d22b458091ecb9 Author: Sarika Sharma Date: Tue Jul 1 16:29:24 2025 +0530 wifi: ath12k: add link support for multi-link in arsta Currently, statistics in arsta are updated at deflink for both non-ML and multi-link(ML) station. Link statistics are not updated for multi-link operation(MLO). Hence, add support to correctly obtain the link ID if the peer is ML, fetch the arsta from the appropriate link ID, and update the statistics in the corresponding arsta. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sarika Sharma Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250701105927.803342-3-quic_sarishar@quicinc.com Signed-off-by: Jeff Johnson commit ebebe66ec208d37e3368b91e2033907cb5140821 Author: Sarika Sharma Date: Tue Jul 1 16:29:23 2025 +0530 wifi: ath12k: fill link station statistics for MLO Introduce ath12k_mac_op_link_sta_statistics(), to report link level station statistics for MLO. The link_station_info structure is filled from arsta and arsta is fetch from corresponding ahsta->link[link_id]. Therefore, this will be helpful to check the link related statistics. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sarika Sharma Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250701105927.803342-2-quic_sarishar@quicinc.com Signed-off-by: Jeff Johnson commit 5054740e0092aac528c0589251f612b3b41c9e7b Author: Jisheng Zhang Date: Sun Jun 29 17:57:16 2025 +0800 regulator: sy8827n: make enable gpio NONEXCLUSIVE On some platforms, the sy8827n enable gpio may also be used for other purpose, so make it NONEXCLUSIVE to support this case. Signed-off-by: Jisheng Zhang Acked-by: Bartosz Golaszewski Link: https://patch.msgid.link/20250629095716.841-1-jszhang@kernel.org Signed-off-by: Mark Brown commit 114b06ee108cabc82b995fbac6672230a9776936 Author: Geraldo Nascimento Date: Mon Jun 30 19:24:57 2025 -0300 PCI: rockchip: Set Target Link Speed to 5.0 GT/s before retraining Rockchip controllers can support up to 5.0 GT/s link speed. But the driver doesn't set the Target Link Speed currently. This may cause failure in retraining the link to 5.0 GT/s if supported by the endpoint. So set the Target Link Speed to 5.0 GT/s in the Link Control and Status Register 2. Fixes: e77f847df54c ("PCI: rockchip: Add Rockchip PCIe controller support") Signed-off-by: Geraldo Nascimento [mani: fixed whitespace warning, commit message rewording, added fixes tag] Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Tested-by: Robin Murphy Cc: stable@vger.kernel.org Link: https://patch.msgid.link/0afa6bc47b7f50e2e81b0b47d51c66feb0fb565f.1751322015.git.geraldogabriel@gmail.com commit cbbfe9f683f0f9b6a1da2eaa53b995a4b5961086 Author: Geraldo Nascimento Date: Mon Jun 30 19:24:41 2025 -0300 PCI: rockchip: Use standard PCIe definitions Current code uses custom-defined register offsets and bitfields for the standard PCIe registers. This creates duplication as the PCI header already defines them. So, switch to using the standard PCIe definitions and drop the custom ones. Suggested-by: Bjorn Helgaas Signed-off-by: Geraldo Nascimento [mani: commit message rewording] Signed-off-by: Manivannan Sadhasivam [bhelgaas: include bitfield.h] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/e81700ef4b49f584bc8834bfb07b6d8995fc1f42.1751322015.git.geraldogabriel@gmail.com commit 0bafe291cb429d39b5ff70bcf7b2f3ab026dcb02 Author: Frank Li Date: Mon Jun 2 10:28:41 2025 -0400 dt-bindings: rtc: nxp,lpc1788-rtc: add compatible string nxp,lpc1850-rtc Add compatible string nxp,lpc1850-rtc and fallback to nxp,lpc1788-rtc. Fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/lpc/lpc4337-ciaa.dtb: rtc@40046000 (nxp,lpc1850-rtc): compatible: ['nxp,lpc1850-rtc', 'nxp,lpc1788-rtc'] is too long Signed-off-by: Frank Li Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250602142842.942700-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni commit d754e2c4aaeadb342036f89d8afc78db6ba2e210 Author: Frank Li Date: Tue Jun 24 16:17:32 2025 -0400 dt-bindings: rtc: move nxp,lpc3220-rtc to separated file from trivial-rtc.yaml nxp,lpc3220-rtc have clocks property, so move it from trivial-rtc.yaml. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250624201733.2515971-1-Frank.Li@nxp.com Signed-off-by: Alexandre Belloni commit 590951f908f25c7e4d6822f0109e7e230d7b0a89 Author: Rob Herring (Arm) Date: Sun Jun 8 17:42:51 2025 -0500 dt-bindings: Move sophgo,cv1800b-rtc to rtc directory The $id path for the sophgo,cv1800b-rtc binding was missing part of the path 'soc'. However, the correct place for RTC bindings (even if it's also a "syscon") is the rtc directory, so move the binding there while fixing the $id value. Fixes: 76517429dbfd ("dt-bindings: soc: sophgo: add RTC support for Sophgo CV1800 series") Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250608224252.3902421-1-robh@kernel.org Signed-off-by: Alexandre Belloni commit a089bb2822a49b0c5777a8936f82c1f8629231fb Author: Masami Hiramatsu (Google) Date: Thu Jul 3 13:26:43 2025 +0900 selftests: tracing: Use mutex_unlock for testing glob filter Since commit c5b6ababd21a ("locking/mutex: implement mutex_trylock_nested") makes mutex_trylock() as an inlined function if CONFIG_DEBUG_LOCK_ALLOC=y, we can not use mutex_trylock() for testing the glob filter of ftrace. Use mutex_unlock instead. Link: https://lore.kernel.org/r/175151680309.2149615.9795104805153538717.stgit@mhiramat.tok.corp.google.com Signed-off-by: Masami Hiramatsu (Google) Acked-by: Steven Rostedt (Google) Signed-off-by: Shuah Khan commit 95d32c7ee05001ea6ecd0d9c415dd00599a7dc56 Author: Shuah Khan Date: Thu Jul 3 17:17:46 2025 -0600 selftests: print installation complete message Add installation complete message to Makefile install logic. Link: https://lore.kernel.org/r/20250703231747.37544-1-skhan@linuxfoundation.org Signed-off-by: Shuah Khan commit 59f44c9ccc3bb68aa3b062b8e57ce0e1ee2fca75 Author: Ilya Maximets Date: Wed Jul 2 17:50:34 2025 +0200 net: openvswitch: allow providing upcall pid for the 'execute' command When a packet enters OVS datapath and there is no flow to handle it, packet goes to userspace through a MISS upcall. With per-CPU upcall dispatch mechanism, we're using the current CPU id to select the Netlink PID on which to send this packet. This allows us to send packets from the same traffic flow through the same handler. The handler will process the packet, install required flow into the kernel and re-inject the original packet via OVS_PACKET_CMD_EXECUTE. While handling OVS_PACKET_CMD_EXECUTE, however, we may hit a recirculation action that will pass the (likely modified) packet through the flow lookup again. And if the flow is not found, the packet will be sent to userspace again through another MISS upcall. However, the handler thread in userspace is likely running on a different CPU core, and the OVS_PACKET_CMD_EXECUTE request is handled in the syscall context of that thread. So, when the time comes to send the packet through another upcall, the per-CPU dispatch will choose a different Netlink PID, and this packet will end up processed by a different handler thread on a different CPU. The process continues as long as there are new recirculations, each time the packet goes to a different handler thread before it is sent out of the OVS datapath to the destination port. In real setups the number of recirculations can go up to 4 or 5, sometimes more. There is always a chance to re-order packets while processing upcalls, because userspace will first install the flow and then re-inject the original packet. So, there is a race window when the flow is already installed and the second packet can match it and be forwarded to the destination before the first packet is re-injected. But the fact that packets are going through multiple upcalls handled by different userspace threads makes the reordering noticeably more likely, because we not only have a race between the kernel and a userspace handler (which is hard to avoid), but also between multiple userspace handlers. For example, let's assume that 10 packets got enqueued through a MISS upcall for handler-1, it will start processing them, will install the flow into the kernel and start re-injecting packets back, from where they will go through another MISS to handler-2. Handler-2 will install the flow into the kernel and start re-injecting the packets, while handler-1 continues to re-inject the last of the 10 packets, they will hit the flow installed by handler-2 and be forwarded without going to the handler-2, while handler-2 still re-injects the first of these 10 packets. Given multiple recirculations and misses, these 10 packets may end up completely mixed up on the output from the datapath. Let's allow userspace to specify on which Netlink PID the packets should be upcalled while processing OVS_PACKET_CMD_EXECUTE. This makes it possible to ensure that all the packets are processed by the same handler thread in the userspace even with them being upcalled multiple times in the process. Packets will remain in order since they will be enqueued to the same socket and re-injected in the same order. This doesn't eliminate re-ordering as stated above, since we still have a race between kernel and the userspace thread, but it allows to eliminate races between multiple userspace threads. Userspace knows the PID of the socket on which the original upcall is received, so there is no need to send it up from the kernel. Solution requires storing the value somewhere for the duration of the packet processing. There are two potential places for this: our skb extension or the per-CPU storage. It's not clear which is better, so just following currently used scheme of storing this kind of things along the skb. We still have a decent amount of space in the cb. Signed-off-by: Ilya Maximets Acked-by: Flavio Leitner Acked-by: Eelco Chaudron Acked-by: Aaron Conole Link: https://patch.msgid.link/20250702155043.2331772-1-i.maximets@ovn.org Signed-off-by: Jakub Kicinski commit 5c3f832de23658ed4e1240476aeb60ac362d9add Author: Heiner Kallweit Date: Thu Jul 3 07:49:12 2025 +0200 net: usb: lan78xx: stop including phy_fixed.h Since e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management") this header isn't needed any longer. Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/626d389a-0f33-4b45-8949-ad53e89c36f5@gmail.com Signed-off-by: Jakub Kicinski commit a3a4be32b69c99fc20a66e0de83b91f8c882bf4c Author: Albin Törnqvist Date: Tue Jun 24 13:48:39 2025 +0200 arm: dts: ti: omap: Fixup pinheader typo This commit fixes a typo introduced in commit ee368a10d0df ("ARM: dts: am335x-boneblack.dts: unique gpio-line-names"). gpio0_7 is located on the P9 header on the BBB. This was verified with a BeagleBone Black by toggling the pin and checking with a multimeter that it corresponds to pin 42 on the P9 header. Signed-off-by: Albin Törnqvist Link: https://lore.kernel.org/r/20250624114839.1465115-2-albin.tornqvist@codiax.se Fixes: ee368a10d0df ("ARM: dts: am335x-boneblack.dts: unique gpio-line-names") Signed-off-by: Kevin Hilman commit 539e87dd661f5ce321019c27ab15cad55345e429 Author: Felix Brack Date: Thu May 29 15:53:24 2025 +0200 ARM: dts: am335x-pdu001: Fix RS-485 transceiver switching The wiring of the RS-485 transceiver of UART0 of the PDU-001 board allows sending or receiving date exclusively. In other words: no character transmitted will ever be received. Hence the tx-filter counter in the OMAP serial driver can't work correctly as it relies on receiving the transmitted characters. This in turn will prevent reception of data unless we disable the tx-filter counter. This patch disables the tx-filter counter by enabling the DTS setting rs485-rx-during-tx. This might sound like the opposite to be done but it uses the enabling of rs485-rx-during-tx not for receiving the data transmitted but for disabling the tx-fiter counter. Tested-by: Felix Brack Signed-off-by: Felix Brack Link: https://lore.kernel.org/r/20250529135324.182868-1-fb@ltec.ch Signed-off-by: Kevin Hilman commit 12aa3e0cb0c6f8d406be00bc9f5d89bfbee7b9d9 Author: Wolfram Sang Date: Mon Jul 7 13:54:08 2025 +0200 i3c: prefix hexadecimal entries in sysfs Hexadecimal values in sysfs should be prefixed with '0x' like e.g. PCI and SCSI already do it. Also ensure the two digit length since BCR and DCR are a byte in size. Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250707115409.73545-2-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 8d53c0d645e3b2a1e341ffb4dbea345c55035c6b Author: Wolfram Sang Date: Sat Jun 28 21:20:30 2025 +0200 i3c: master: cdns: replace ENOTSUPP with SUSV4-compliant EOPNOTSUPP Replace non-standard ENOTSUPP with the SUSV4-defined error code EOPNOTSUPP to fix below checkpatch warning: "ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP" Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250628192027.3932-8-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 566aebedee37789644bcc976fd6d98ccf8de375b Author: Wolfram Sang Date: Sat Jun 28 21:20:29 2025 +0200 i3c: dw: replace ENOTSUPP with SUSV4-compliant EOPNOTSUPP Replace non-standard ENOTSUPP with the SUSV4-defined error code EOPNOTSUPP to fix below checkpatch warning: "ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP" Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250628192027.3932-7-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit d10a4c323883c41cf1b652309e61c48bce248e35 Author: Wolfram Sang Date: Sat Jun 28 21:20:28 2025 +0200 i3c: master: replace ENOTSUPP with SUSV4-compliant EOPNOTSUPP Replace non-standard ENOTSUPP with the SUSV4-defined error code EOPNOTSUPP to fix below checkpatch warning: "ENOTSUPP is not a SUSV4 error code, prefer EOPNOTSUPP" Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250628192027.3932-6-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 447270cdb41b1c8c3621bb14b93a6749f942556e Author: Wolfram Sang Date: Fri Jul 4 22:44:32 2025 +0200 i3c: don't fail if GETHDRCAP is unsupported 'I3C_BCR_HDR_CAP' is still spec v1.0 and has been renamed to 'advanced capabilities' in v1.1 onwards. The ST pressure sensor LPS22DF does not have HDR, but has the 'advanced cap' bit set. The core still wants to get additional information using the CCC 'GETHDRCAP' (or GETCAPS in v1.1 onwards). Not all controllers support this CCC and will notify the upper layers about it. For instantiating the device, we can ignore this unsupported CCC as standard communication will work. Without this patch, the device will not be instantiated at all. Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250704204524.6124-1-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit f12682148262aa6deed32c0593c67658573d0600 Author: Mario Limonciello Date: Mon Jun 9 15:05:18 2025 -0500 x86/itmt: Add debugfs file to show core priorities Multiple drivers can report priorities to ITMT. To aid in debugging any issues with the values reported by drivers introduce a debugfs file to read out the values. Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-14-superm1@kernel.org commit 13bc67a96ea5bc9dba0b91704d1f7212b65686f3 Author: Mario Limonciello Date: Mon Jun 9 15:05:17 2025 -0500 platform/x86/amd: hfi: Add debugfs support Add a dump of the class and capabilities table to debugfs to assist with debugging scheduler issues. Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Gautham R. Shenoy Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-13-superm1@kernel.org commit 216fe0d7680b2503e09edd1d7dca73305806591c Author: Mario Limonciello Date: Mon Jun 9 15:05:16 2025 -0500 platform/x86/amd: hfi: Set ITMT priority from ranking data The static ranking data that is read at module load should be used to set up the priorities for the cores relative to the performance values. Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Gautham R. Shenoy Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-12-superm1@kernel.org commit bfea2b3b4f2346510ec45a0c22450e1564f48f88 Author: Mario Limonciello Date: Mon Jun 9 15:05:15 2025 -0500 cpufreq/amd-pstate: Disable preferred cores on designs with workload classification On designs that have workload classification, it's preferred that the amd-hfi driver is used to provide hints to the scheduler of which cores to use instead of the amd-pstate driver. Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Gautham R. Shenoy Reviewed-by: Perry Yuan Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-11-superm1@kernel.org commit 9e8f6bf782a96d45a25ef9bc17db06bafb6b3e21 Author: Perry Yuan Date: Mon Jun 9 15:05:14 2025 -0500 x86/process: Clear hardware feedback history for AMD processors Incorporate a mechanism within the context switching code to reset the hardware history for AMD processors. Specifically, when a task is switched in, the class ID is read and the hardware workload classification history of the CPU firmware is reset. Then, the workload classification for the next running thread is begun. [ bp: Massage commit message. ] Signed-off-by: Perry Yuan Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-10-superm1@kernel.org commit 263e66f9c35922d0cfd961df6d7a492820143792 Author: Perry Yuan Date: Mon Jun 9 15:05:13 2025 -0500 platform/x86: hfi: Add power management callback Introduce power management callbacks for the `amd_hfi` driver. Specifically, add the `suspend` and `resume` callbacks to handle the necessary operations during system low power states and wake-up. Signed-off-by: Perry Yuan Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Gautham R. Shenoy Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-9-superm1@kernel.org commit bb20421c05fc0a0fd70a3f8af076319f7dec4cf1 Author: Perry Yuan Date: Mon Jun 9 15:05:12 2025 -0500 platform/x86: hfi: Add online and offline callback support There are some firmware parameters that need to be configured when a CPU core is brought online or offline. When a CPU is online, it will initialize the workload classification parameters to CPU firmware which will trigger the workload class ID updating function. Once the CPU is going offline, it will need to disable the workload classification function and clear the history. Signed-off-by: Perry Yuan Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Gautham R. Shenoy Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-8-superm1@kernel.org commit bb96a315b4d84904edd2dae17910f10022ab71d5 Merge: 12826a49f029cd 08dc0f5cc26a20 Author: Mark Brown Date: Mon Jul 7 21:02:59 2025 +0100 ASoC: soc-dapm: cleanups Merge series from Kuninori Morimoto : This is prepare to hiding snd_soc_dapm_context inside soc-dapm.c commit b6ffe4d9e074561f95a728e1f822ed15e533ec6e Author: Perry Yuan Date: Mon Jun 9 15:05:11 2025 -0500 platform/x86: hfi: Init per-cpu scores for each class Initialize per CPU score `amd_hfi_ipcc_scores` which store energy score and performance score data for each class. Classic and dense cores are ranked according to those values as energy efficiency capability or performance capability. OS scheduler will pick cores from the ranking list on each class ID for the thread which provide the class id got from hardware feedback interface. Signed-off-by: Perry Yuan Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Gautham R. Shenoy Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-7-superm1@kernel.org commit d4e95ea7a78e46be2f2fe529fe578d3834c453a2 Author: Perry Yuan Date: Mon Jun 9 15:05:10 2025 -0500 platform/x86: hfi: Parse CPU core ranking data from shared memory When `amd_hfi` driver is loaded, it will use PCCT subspace type 4 table to retrieve the shared memory address which contains the CPU core ranking table. This table includes a header that specifies the number of ranking data entries to be parsed and rank each CPU core with the Performance and Energy Efficiency capability as implemented by the CPU power management firmware. Once the table has been parsed, each CPU is assigned a ranking score within its class. Subsequently, when the scheduler selects cores, it chooses from the ranking list based on the assigned scores in each class, thereby ensuring the optimal selection of CPU cores according to their predefined classifications and priorities. Signed-off-by: Perry Yuan Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Ilpo Järvinen Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-6-superm1@kernel.org commit ba2ebd52a22eb7306a2093924920a125ad91215a Author: Claudiu Beznea Date: Thu Jul 3 14:27:08 2025 +0300 driver core: platform: Drop dev_pm_domain_detach() call On the Renesas RZ/G3S (and other Renesas SoCs, e.g., RZ/G2{L, LC, UL}), clocks are managed through PM domains. These PM domains, registered on behalf of the clock controller driver, are configured with GENPD_FLAG_PM_CLK. In most of the Renesas drivers used by RZ SoCs, the clocks are enabled/disabled using runtime PM APIs. The power domains may also have power_on/power_off support implemented. After the device PM domain is powered off any CPU accesses to these domains leads to system aborts. During probe, devices are attached to the PM domain controlling their clocks and power. Similarly, during removal, devices are detached from the PM domain. The detachment call stack is as follows: device_driver_detach() -> device_release_driver_internal() -> __device_release_driver() -> device_remove() -> platform_remove() -> dev_pm_domain_detach() During driver unbind, after the device is detached from its PM domain, the device_unbind_cleanup() function is called, which subsequently invokes devres_release_all(). This function handles devres resource cleanup. If runtime PM is enabled in driver probe via devm_pm_runtime_enable(), the cleanup process triggers the action or reset function for disabling runtime PM. This function is pm_runtime_disable_action(), which leads to the following call stack of interest when called: pm_runtime_disable_action() -> pm_runtime_dont_use_autosuspend() -> __pm_runtime_use_autosuspend() -> update_autosuspend() -> rpm_idle() The rpm_idle() function attempts to resume the device at runtime. However, at the point it is called, the device is no longer part of a PM domain (which manages clocks and power states). If the driver implements its own runtime PM APIs for specific functionalities - such as the rzg2l_adc driver - while also relying on the power domain subsystem for power management, rpm_idle() will invoke the driver's runtime PM API. However, since the device is no longer part of a PM domain at this point, the PM domain's runtime PM APIs will not be called. This leads to system aborts on Renesas SoCs. Another identified case is when a subsystem performs various cleanups using device_unbind_cleanup(), calling driver-specific APIs in the process. A known example is the thermal subsystem, which may call driver- specific APIs to disable the thermal device. The relevant call stack in this case is: device_driver_detach() -> device_release_driver_internal() -> device_unbind_cleanup() -> devres_release_all() -> devm_thermal_of_zone_release() -> thermal_zone_device_disable() -> thermal_zone_device_set_mode() -> struct thermal_zone_device_ops::change_mode() At the moment the driver-specific change_mode() API is called, the device is no longer part of its PM domain. Accessing its registers without proper power management leads to system aborts. Drop the call to dev_pm_domain_detach() from the platform bus remove function and rely on the newly introduced call in device_unbind_cleanup(). This ensures the same effect, but the call now occurs after all driver-specific devres resources have been freed. Signed-off-by: Claudiu Beznea Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/20250703112708.1621607-4-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Rafael J. Wysocki commit f99508074e78fea17f06d753d9ef453b174ec98e Author: Claudiu Beznea Date: Thu Jul 3 14:27:07 2025 +0300 PM: domains: Detach on device_unbind_cleanup() The dev_pm_domain_attach() function is typically used in bus code alongside dev_pm_domain_detach(), often following patterns like: static int bus_probe(struct device *_dev) { struct bus_driver *drv = to_bus_driver(dev->driver); struct bus_device *dev = to_bus_device(_dev); int ret; // ... ret = dev_pm_domain_attach(_dev, true); if (ret) return ret; if (drv->probe) ret = drv->probe(dev); // ... } static void bus_remove(struct device *_dev) { struct bus_driver *drv = to_bus_driver(dev->driver); struct bus_device *dev = to_bus_device(_dev); if (drv->remove) drv->remove(dev); dev_pm_domain_detach(_dev); } When the driver's probe function uses devres-managed resources that depend on the power domain state, those resources are released later during device_unbind_cleanup(). Releasing devres-managed resources that depend on the power domain state after detaching the device from its PM domain can cause failures. For example, if the driver uses devm_pm_runtime_enable() in its probe function, and the device's clocks are managed by the PM domain, then during removal the runtime PM is disabled in device_unbind_cleanup() after the clocks have been removed from the PM domain. It may happen that the devm_pm_runtime_enable() action causes the device to be runtime- resumed. If the driver specific runtime PM APIs access registers directly, this will lead to accessing device registers without clocks being enabled. Similar issues may occur with other devres actions that access device registers. Add detach_power_off member to struct dev_pm_info, to be used later in device_unbind_cleanup() as the power_off argument for dev_pm_domain_detach(). This is a preparatory step toward removing dev_pm_domain_detach() calls from bus remove functions. Since the current PM domain detach functions (genpd_dev_pm_detach() and acpi_dev_pm_detach()) already set dev->pm_domain = NULL, there should be no issues with bus drivers that still call dev_pm_domain_detach() in their remove functions. Signed-off-by: Claudiu Beznea Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/20250703112708.1621607-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Rafael J. Wysocki commit d42c7c6fd66a6e2a78ae1da666c5df6c2fde8389 Author: Claudiu Beznea Date: Thu Jul 3 14:27:06 2025 +0300 PM: domains: Add flags to specify power on attach/detach Calling dev_pm_domain_attach()/dev_pm_domain_detach() in bus driver probe/remove functions can affect system behavior when the drivers attached to the bus use devres-managed resources. Since devres actions may need to access device registers, calling dev_pm_domain_detach() too early, i.e., before these actions complete, can cause failures on some systems. One such example is Renesas RZ/G3S SoC-based platforms. If the device clocks are managed via PM domains, invoking dev_pm_domain_detach() in the bus driver's remove function removes the device's clocks from the PM domain, preventing any subsequent pm_runtime_resume*() calls from enabling those clocks. The second argument of dev_pm_domain_attach() specifies whether the PM domain should be powered on during attachment. Likewise, the second argument of dev_pm_domain_detach() indicates whether the domain should be powered off during detachment. Upcoming changes address the issue described above (initially for the platform bus only) by deferring the call to dev_pm_domain_detach() until after devres_release_all() in device_unbind_cleanup(). The detach_power_off field in struct dev_pm_info stores the detach power off info from the second argument of dev_pm_domain_attach(). Because there are cases where the device's PM domain power-on/off behavior must be conditional (e.g., in i2c_device_probe()), the patch introduces PD_FLAG_ATTACH_POWER_ON and PD_FLAG_DETACH_POWER_OFF flags to be passed to dev_pm_domain_attach(). Finally, dev_pm_domain_attach() and its users are updated to use the newly introduced PD_FLAG_ATTACH_POWER_ON and PD_FLAG_DETACH_POWER_OFF macros. This change is preparatory. Signed-off-by: Claudiu Beznea Reviewed-by: Mathieu Poirier Acked-by: Wolfram Sang # I2C Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/20250703112708.1621607-2-claudiu.beznea.uj@bp.renesas.com [ rjw: Changelog adjustments ] Signed-off-by: Rafael J. Wysocki commit 05a61c6cb631a13465f9d3cc875b65a21d40568a Author: Qiuxu Zhuo Date: Fri Jul 4 23:16:09 2025 +0800 EDAC/ie31200: Add Intel Raptor Lake-HX SoCs support Intel Raptor Lake-HX SoC shares the same memory controller registers as Raptor Lake-S SoC. Add a compute die ID for Raptor Lake-HX SoCs with Out-of-Band ECC capability for EDAC support. Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Tested-by: Laurens SEGHERS Link: https://lore.kernel.org/r/20250704151609.7833-4-qiuxu.zhuo@intel.com commit 773d8bb5ba7f64ee708caecb8deb0930bc1e1cf7 Author: Lili Li Date: Fri Jul 4 23:16:08 2025 +0800 EDAC/igen6: Add Intel Wildcat Lake SoCs support Intel Wildcat Lake is a mobile derivative of Panther Lake with one memory controller. Wildcat Lake SoCs share the same IBECC registers with Meteor Lake-P SoCs. Add a compute die ID and a new configuration structure for Wildcat Lake SoCs with In-Band ECC capability for EDAC support. Signed-off-by: Lili Li Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Link: https://lore.kernel.org/r/20250704151609.7833-3-qiuxu.zhuo@intel.com commit a886d26f2c8f9e3f3c1869ae368d09c75daac553 Author: Vitaly Prosyak Date: Wed Jul 2 08:35:30 2025 -0400 drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0 [ +0.000020] BUG: KASAN: slab-use-after-free in amdgpu_userq_suspend+0x51a/0x5a0 [amdgpu] [ +0.000817] Read of size 8 at addr ffff88812eec8c58 by task amd_pci_unplug/1733 [ +0.000027] CPU: 10 UID: 0 PID: 1733 Comm: amd_pci_unplug Tainted: G W 6.14.0+ #2 [ +0.000009] Tainted: [W]=WARN [ +0.000003] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000004] Call Trace: [ +0.000004] [ +0.000003] dump_stack_lvl+0x76/0xa0 [ +0.000011] print_report+0xce/0x600 [ +0.000009] ? srso_return_thunk+0x5/0x5f [ +0.000006] ? kasan_complete_mode_report_info+0x76/0x200 [ +0.000007] ? kasan_addr_to_slab+0xd/0xb0 [ +0.000006] ? amdgpu_userq_suspend+0x51a/0x5a0 [amdgpu] [ +0.000707] kasan_report+0xbe/0x110 [ +0.000006] ? amdgpu_userq_suspend+0x51a/0x5a0 [amdgpu] [ +0.000541] __asan_report_load8_noabort+0x14/0x30 [ +0.000005] amdgpu_userq_suspend+0x51a/0x5a0 [amdgpu] [ +0.000535] ? stop_cpsch+0x396/0x600 [amdgpu] [ +0.000556] ? stop_cpsch+0x429/0x600 [amdgpu] [ +0.000536] ? __pfx_amdgpu_userq_suspend+0x10/0x10 [amdgpu] [ +0.000536] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? kgd2kfd_suspend+0x132/0x1d0 [amdgpu] [ +0.000542] amdgpu_device_fini_hw+0x581/0xe90 [amdgpu] [ +0.000485] ? down_write+0xbb/0x140 [ +0.000007] ? __mutex_unlock_slowpath.constprop.0+0x317/0x360 [ +0.000005] ? __pfx_amdgpu_device_fini_hw+0x10/0x10 [amdgpu] [ +0.000482] ? __kasan_check_write+0x14/0x30 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? up_write+0x55/0xb0 [ +0.000007] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? blocking_notifier_chain_unregister+0x6c/0xc0 [ +0.000008] amdgpu_driver_unload_kms+0x69/0x90 [amdgpu] [ +0.000484] amdgpu_pci_remove+0x93/0x130 [amdgpu] [ +0.000482] pci_device_remove+0xae/0x1e0 [ +0.000008] device_remove+0xc7/0x180 [ +0.000008] device_release_driver_internal+0x3d4/0x5a0 [ +0.000007] device_release_driver+0x12/0x20 [ +0.000004] pci_stop_bus_device+0x104/0x150 [ +0.000006] pci_stop_and_remove_bus_device_locked+0x1b/0x40 [ +0.000005] remove_store+0xd7/0xf0 [ +0.000005] ? __pfx_remove_store+0x10/0x10 [ +0.000006] ? __pfx__copy_from_iter+0x10/0x10 [ +0.000006] ? __pfx_dev_attr_store+0x10/0x10 [ +0.000006] dev_attr_store+0x3f/0x80 [ +0.000006] sysfs_kf_write+0x125/0x1d0 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? __kasan_check_write+0x14/0x30 [ +0.000005] kernfs_fop_write_iter+0x2ea/0x490 [ +0.000005] ? rw_verify_area+0x70/0x420 [ +0.000005] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ +0.000006] vfs_write+0x90d/0xe70 [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000005] ? __pfx_vfs_write+0x10/0x10 [ +0.000004] ? local_clock+0x15/0x30 [ +0.000008] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __kasan_slab_free+0x5f/0x80 [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __kasan_check_read+0x11/0x20 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? fdget_pos+0x1d3/0x500 [ +0.000007] ksys_write+0x119/0x220 [ +0.000005] ? putname+0x1c/0x30 [ +0.000006] ? __pfx_ksys_write+0x10/0x10 [ +0.000007] __x64_sys_write+0x72/0xc0 [ +0.000006] x64_sys_call+0x18ab/0x26f0 [ +0.000006] do_syscall_64+0x7c/0x170 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __pfx___x64_sys_openat+0x10/0x10 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __kasan_check_read+0x11/0x20 [ +0.000003] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? fpregs_assert_state_consistent+0x21/0xb0 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? syscall_exit_to_user_mode+0x4e/0x240 [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? do_syscall_64+0x88/0x170 [ +0.000003] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? irqentry_exit+0x43/0x50 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? exc_page_fault+0x7c/0x110 [ +0.000006] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000006] RIP: 0033:0x7480c0b14887 [ +0.000005] Code: 10 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24 [ +0.000005] RSP: 002b:00007fff142b0058 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ +0.000006] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007480c0b14887 [ +0.000003] RDX: 0000000000000001 RSI: 00007480c0e7365a RDI: 0000000000000004 [ +0.000003] RBP: 00007fff142b0080 R08: 0000563b2e73c170 R09: 0000000000000000 [ +0.000003] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff142b02f8 [ +0.000003] R13: 0000563b159a72a9 R14: 0000563b159a9d48 R15: 00007480c0f19040 [ +0.000008] [ +0.000445] Allocated by task 427 on cpu 5 at 29.342331s: [ +0.000011] kasan_save_stack+0x28/0x60 [ +0.000006] kasan_save_track+0x18/0x70 [ +0.000006] kasan_save_alloc_info+0x38/0x60 [ +0.000005] __kasan_kmalloc+0xc1/0xd0 [ +0.000006] __kmalloc_cache_noprof+0x1bd/0x430 [ +0.000007] amdgpu_driver_open_kms+0x172/0x760 [amdgpu] [ +0.000493] drm_file_alloc+0x569/0x9a0 [ +0.000007] drm_client_init+0x1b7/0x410 [ +0.000007] drm_fbdev_client_setup+0x174/0x470 [ +0.000006] drm_client_setup+0x8a/0xf0 [ +0.000006] amdgpu_pci_probe+0x510/0x10c0 [amdgpu] [ +0.000483] local_pci_probe+0xe7/0x1b0 [ +0.000006] pci_device_probe+0x5bf/0x890 [ +0.000006] really_probe+0x1fd/0x950 [ +0.000005] __driver_probe_device+0x307/0x410 [ +0.000006] driver_probe_device+0x4e/0x150 [ +0.000005] __driver_attach+0x223/0x510 [ +0.000006] bus_for_each_dev+0x102/0x1a0 [ +0.000005] driver_attach+0x3d/0x60 [ +0.000006] bus_add_driver+0x309/0x650 [ +0.000005] driver_register+0x13d/0x490 [ +0.000006] __pci_register_driver+0x1ee/0x2b0 [ +0.000006] rfcomm_dlc_clear_state+0x69/0x220 [rfcomm] [ +0.000011] do_one_initcall+0x9c/0x3e0 [ +0.000007] do_init_module+0x29e/0x7f0 [ +0.000006] load_module+0x5c75/0x7c80 [ +0.000006] init_module_from_file+0x106/0x180 [ +0.000006] idempotent_init_module+0x377/0x740 [ +0.000006] __x64_sys_finit_module+0xd7/0x180 [ +0.000006] x64_sys_call+0x1f0b/0x26f0 [ +0.000006] do_syscall_64+0x7c/0x170 [ +0.000005] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000013] Freed by task 1733 on cpu 5 at 59.907086s: [ +0.000011] kasan_save_stack+0x28/0x60 [ +0.000006] kasan_save_track+0x18/0x70 [ +0.000005] kasan_save_free_info+0x3b/0x60 [ +0.000005] __kasan_slab_free+0x54/0x80 [ +0.000006] kfree+0x127/0x470 [ +0.000006] amdgpu_driver_postclose_kms+0x455/0x760 [amdgpu] [ +0.000493] drm_file_free.part.0+0x5b1/0xba0 [ +0.000006] drm_file_free+0x13/0x30 [ +0.000006] drm_client_release+0x1c4/0x2b0 [ +0.000006] drm_fbdev_ttm_fb_destroy+0xd2/0x120 [drm_ttm_helper] [ +0.000007] put_fb_info+0x97/0xe0 [ +0.000007] unregister_framebuffer+0x197/0x380 [ +0.000005] drm_fb_helper_unregister_info+0x94/0x100 [ +0.000005] drm_fbdev_client_unregister+0x3c/0x80 [ +0.000007] drm_client_dev_unregister+0x144/0x330 [ +0.000006] drm_dev_unregister+0x49/0x1b0 [ +0.000006] drm_dev_unplug+0x4c/0xd0 [ +0.000006] amdgpu_pci_remove+0x58/0x130 [amdgpu] [ +0.000484] pci_device_remove+0xae/0x1e0 [ +0.000008] device_remove+0xc7/0x180 [ +0.000007] device_release_driver_internal+0x3d4/0x5a0 [ +0.000006] device_release_driver+0x12/0x20 [ +0.000007] pci_stop_bus_device+0x104/0x150 [ +0.000006] pci_stop_and_remove_bus_device_locked+0x1b/0x40 [ +0.000006] remove_store+0xd7/0xf0 [ +0.000006] dev_attr_store+0x3f/0x80 [ +0.000005] sysfs_kf_write+0x125/0x1d0 [ +0.000006] kernfs_fop_write_iter+0x2ea/0x490 [ +0.000006] vfs_write+0x90d/0xe70 [ +0.000006] ksys_write+0x119/0x220 [ +0.000006] __x64_sys_write+0x72/0xc0 [ +0.000006] x64_sys_call+0x18ab/0x26f0 [ +0.000005] do_syscall_64+0x7c/0x170 [ +0.000006] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000012] The buggy address belongs to the object at ffff88812eec8000 which belongs to the cache kmalloc-rnd-07-4k of size 4096 [ +0.000016] The buggy address is located 3160 bytes inside of freed 4096-byte region [ffff88812eec8000, ffff88812eec9000) [ +0.000023] The buggy address belongs to the physical page: [ +0.000009] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12eec8 [ +0.000007] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ +0.000005] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) [ +0.000007] page_type: f5(slab) [ +0.000008] raw: 0017ffffc0000040 ffff888100054500 dead000000000122 0000000000000000 [ +0.000005] raw: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ +0.000006] head: 0017ffffc0000040 ffff888100054500 dead000000000122 0000000000000000 [ +0.000005] head: 0000000000000000 0000000080040004 00000000f5000000 0000000000000000 [ +0.000006] head: 0017ffffc0000003 ffffea0004bbb201 ffffffffffffffff 0000000000000000 [ +0.000005] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ +0.000005] page dumped because: kasan: bad access detected [ +0.000010] Memory state around the buggy address: [ +0.000009] ffff88812eec8b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000012] ffff88812eec8b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] >ffff88812eec8c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] ^ [ +0.000010] ffff88812eec8c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] ffff88812eec8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] ================================================================== The use-after-free occurs because a delayed work item (`suspend_work`) may still be pending or running when resources it accesses are freed during device removal or file close. The previous code used `flush_work(&fpriv->evf_mgr.suspend_work.work)`, which does not wait for delayed work that has not yet started. As a result, the delayed work could run after its memory was freed, causing a use-after-free. By switching to `flush_delayed_work(&fpriv->evf_mgr.suspend_work)`, we ensure that the kernel waits for both queued and delayed work to finish before freeing memory, closing this race. Fixes: adba0929736a ("drm/amdgpu: Fix Illegal opcode in command stream Error") Signed-off-by: Vitaly Prosyak Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 9ad08c1115646533097c8a799ad046bf5127b04a Author: Qiuxu Zhuo Date: Fri Jul 4 23:16:07 2025 +0800 EDAC/i10nm: Add Intel Granite Rapids-D support The Granite Rapids-D CPU model uses memory controller registers similar to those of the Granite Rapids server CPU but with a different memory controller MMIO base. Add the Granite Rapids-D CPU model ID and use the new memory controller MMIO base for EDAC support. Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Tested-by: VikasX Chougule Link: https://lore.kernel.org/r/20250704151609.7833-2-qiuxu.zhuo@intel.com commit a73345b866ff8bbd93135af667c973a8fb4b2c40 Author: Vitaly Prosyak Date: Tue Jun 24 12:05:10 2025 -0400 Revert "drm/amdgpu: fix slab-use-after-free in amdgpu_userq_mgr_fini" This reverts commit 5fb90421fa0fbe0a968274912101fe917bf1c47b. The original patch moved `amdgpu_userq_mgr_fini()` to the driver's `postclose` callback, which is called after `drm_gem_release()` in the DRM file cleanup sequence.If a user application crashes or aborts without cleaning up its user queues, 'drm_gem_release()` may free GEM objects that are still referenced by active user queues, leading to use-after-free. By reverting, we ensure that user queues are disabled and cleaned up before any GEM objects are released, preventing this class of bug. However, this reintroduces a race during PCI hot-unplug, where device removal can race with per-file cleanup, leading to use-after-free in suspend/unplug paths. This will be fixed in the next patch. Fixes: 5fb90421fa0f ("drm/amdgpu: fix slab-use-after-free in amdgpu_userq_mgr_fini+0x70c") Signed-off-by: Vitaly Prosyak Acked-by: Alex Deucher Reviewed-by: Christian König Signed-off-by: Alex Deucher commit df2719088b6a8084960ed6e2ddc7066ffc5b558d Author: Alex Deucher Date: Tue Jul 1 16:13:17 2025 -0400 drm/amd/display: Use scaling for non-native resolutions on LVDS [Why] Common resolutions are added to supported modes to enable compatibility scenarios that compositors may use to do things like clone displays. There is no guarantee however that the panel will natively support these modes. [How] If the compositor hasn't enabled scaling but a non-native resolution has been picked for an LVDS panel turn the scaler on anyway. This will ensure compatibility. Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 6d396e7ac1ce36079147933aa77ea977b03a8a9d Author: Alex Deucher Date: Tue Jul 1 16:09:19 2025 -0400 drm/amd/display: Disable common modes for LVDS [Why] Common modes are added to LVDS for compatibility in clone mode, but not all panels support them. Non-native modes were disabled in the past but this caused problems because compositors didn't use scaling for non native modes. Now non-native modes on LVDS will enable the scaler by default. [How] Check the connector type. If the connector is LVDS avoid adding common modes. Reviewed-by: Harry Wentland Signed-off-by: Alex Deucher commit 0c3c2e334c4fd00ed7a8ddb9c163a8c1138af1f1 Author: Alex Deucher Date: Thu Jun 26 08:58:21 2025 -0400 drm/amdgpu/sdma: allow caller to handle kernel rings in engine reset Add a parameter to amdgpu_sdma_reset_engine() to let the caller handle the kernel rings. This allows the kernel rings to back up their unprocessed state if the reset comes in via the drm scheduler rather than KFD. Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit f8410a17d377d062ef381316669653fb0ba0edc5 Author: Alex Deucher Date: Thu Jun 26 08:49:07 2025 -0400 drm/amdgpu/sdma: consolidate engine reset handling Move the force completion handling into the common engine reset function. No need to duplicate it for every IP version. Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit 91134e800894fc6992cb0cdadea4cc94fe21b6e2 Author: Lijo Lazar Date: Mon Jun 30 10:07:14 2025 +0530 drm/amdkfd: Avoid queue reset if disabled If ring reset is disabled, skip resetting queues. Instead, fall back to device based reset. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 9888f73679b72394bcee4f2af304456f03ceed8b Author: Lijo Lazar Date: Tue Jul 1 14:48:00 2025 +0530 drm/amdgpu: Add a noverbose flag to psp_wait_for For extended wait with retries on a PSP register value, add a noverbose flag to avoid excessive error messages on each timeout. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit a54e4639c4ef37a0241bac7d2a77f2e6ffb57099 Author: Fedor Pchelkin Date: Mon Jun 30 23:26:17 2025 +0300 drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value There is a small typo in phm_wait_on_indirect_register(). Swap mask and value arguments provided to phm_wait_on_register() so that they satisfy the function signature and actual usage scheme. Found by Linux Verification Center (linuxtesting.org) with Svace static analysis tool. In practice this doesn't fix any issues because the only place this function is used uses the same value for the value and mask. Fixes: 3bace3591493 ("drm/amd/powerplay: add hardware manager sub-component") Signed-off-by: Fedor Pchelkin Signed-off-by: Alex Deucher commit 14b2d71a9a24727f1b9f2131ed5eb2e345840a3a Author: Alex Deucher Date: Thu Jun 26 17:51:02 2025 -0400 drm/amdgpu/gfx10: fix KGQ reset sequence Need to reinit the ring before remapping it and all of the KIQ handling needs to be within the kiq lock. Fixes: 1741281a157f ("drm/amdgpu/gfx10: add ring reset callbacks") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 127ed492ad2df0aa2351a1ad32a793ae7d91161b Author: Lijo Lazar Date: Mon Jun 30 19:11:33 2025 +0530 drm/amdgpu: Pass adev pointer to functions Pass amdgpu device context instead of drm device context to some amdgpu_device_* functions. DRM device context is not required in those functions. No functional change. Signed-off-by: Lijo Lazar Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 4c93e2c34154d36c9eab54d81d8ec22fa2e2afd6 Author: Daniele Ceraolo Spurio Date: Thu Jun 26 11:28:12 2025 -0700 drm/xe/ptl: Add HuC FW definition for PTL Add the unversioned define for the PTL HuC FW. Signed-off-by: Daniele Ceraolo Spurio Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250626182805.1701096-15-daniele.ceraolospurio@intel.com commit 5cdb71d3b0db88d26ca34984fe61755faf681626 Author: Daniele Ceraolo Spurio Date: Thu Jun 26 11:28:11 2025 -0700 drm/xe/ptl: Add GuC FW definition for PTL The first official GuC relase for PTL is 70.47.0, which maps to API version 1.22.4. Signed-off-by: Daniele Ceraolo Spurio Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250626182805.1701096-14-daniele.ceraolospurio@intel.com commit 0b64addcae7f04745bc5f62d41e27268052f812e Author: Julia Filipchuk Date: Thu Jun 26 11:28:10 2025 -0700 drm/xe/guc: Recommend GuC v70.46.2 for BMG, LNL, DG2 UAPI compatibility version 1.22.2 Resolves various bugs. Recommend newer version. Signed-off-by: Julia Filipchuk Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Daniele Ceraolo Spurio Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250626182805.1701096-13-daniele.ceraolospurio@intel.com commit 5d902ee5609a299748dc1f9eb56cf36ad3275ea9 Author: Perry Yuan Date: Mon Jun 9 15:05:09 2025 -0500 platform/x86: hfi: Introduce AMD Hardware Feedback Interface Driver The AMD Heterogeneous core design and Hardware Feedback Interface (HFI) provide behavioral classification and a dynamically updated ranking table for the scheduler to use when choosing cores for tasks. There are two CPU core types defined: Classic and Dense. Classic cores are the standard performance cores, while Dense cores are optimized for area and efficiency. Heterogeneous compute refers to CPU implementations that are comprised of more than one architectural class, each with two capabilities. This means each CPU reports two separate capabilities: "perf" and "eff". Each capability lists all core ranking numbers between 0 and 255, where a higher number represents a higher capability. Heterogeneous systems can also extend to more than two architectural classes. The purpose of the scheduling feedback mechanism is to provide information to the operating system scheduler in real time, allowing the scheduler to direct threads to the optimal core during task scheduling. All core ranking data are provided by the PMFW via a shared memory ranking table, which the driver reads and uses to update core capabilities to the scheduler. When the hardware updates the table, it generates a platform interrupt to notify the OS to read the new ranking table. Signed-off-by: Perry Yuan Co-developed-by: Mario Limonciello Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Gautham R. Shenoy Reviewed-by: Shyam Sundar S K Acked-by: Ilpo Järvinen Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 Link: https://lore.kernel.org/20250609200518.3616080-5-superm1@kernel.org commit a3c4f3396b82849a04ffe12584c69d340f2b8610 Author: Perry Yuan Date: Mon Jun 9 15:05:08 2025 -0500 x86/msr-index: Add AMD workload classification MSRs Introduce new MSR registers for AMD hardware feedback support. They provide workload classification and configuration capabilities. Signed-off-by: Perry Yuan Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Gautham R. Shenoy Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-4-superm1@kernel.org commit 31b294e522a1ecf83298aa78ecdd7b57578b5b65 Author: Mario Limonciello Date: Mon Jun 9 15:05:07 2025 -0500 MAINTAINERS: Add maintainer entry for AMD Hardware Feedback Driver Introduce the `amd_hfi` driver into the MAINTAINERS file. The driver will support AMD Heterogeneous Core design which provides hardware feedback to the OS scheduler. Moving forward, Mario will be responsible for the maintenance and Perry will assist on review of patches related to this driver. Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-3-superm1@kernel.org commit 11390345ba0c101a7bd904139d154d6328773379 Author: Perry Yuan Date: Mon Jun 9 15:05:06 2025 -0500 Documentation/x86: Add AMD Hardware Feedback Interface documentation Introduce a new documentation file, `amd_hfi.rst`, which delves into the implementation details of the AMD Hardware Feedback Interface and its associated driver, `amd_hfi`. This documentation describes how the driver provides hint to the OS scheduling which depends on the capability of core performance and efficiency ranking data. This documentation describes: * The design of the driver * How the driver provides hints to the OS scheduling * How the driver interfaces with the kernel for efficiency ranking data. Signed-off-by: Perry Yuan Signed-off-by: Mario Limonciello Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Bagas Sanjaya Reviewed-by: Mario Limonciello Acked-by: Ilpo Järvinen Link: https://lore.kernel.org/20250609200518.3616080-2-superm1@kernel.org commit c9d52116c5d4ce6ef004fb6a06f98000e71d1b90 Author: Sumeet Pawnikar Date: Sat Jul 5 16:30:04 2025 +0530 ACPI: fan: Update debug message in fan_get_state_acpi4() Update invalid control value returned debug print with appropriate message as no matching fps control value for checking fan fps count condition. Signed-off-by: Sumeet Pawnikar Link: https://patch.msgid.link/20250705110005.4343-1-sumeet4linux@gmail.com> [ rjw: Subject edits ] Signed-off-by: Rafael J. Wysocki commit 3db5648c4d608b5483470efc1da9780b081242dd Author: Zhu Qiyu Date: Fri Jul 4 01:41:04 2025 +0000 ACPI: PRM: Reduce unnecessary printing to avoid user confusion Commit 088984c8d54c ("ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context") introduced non-essential printing "Failed to find VA for GUID: xxxx, PA: 0x0" which may confuse users to think that something wrong is going on while it is not the case. According to the PRM Spec Section 4.1.2 [1], both static data buffer address and ACPI parameter buffer address may be NULL if they are not needed, so there is no need to print out the "Failed to find VA ... " in those cases. Link: https://uefi.org/sites/default/files/resources/Platform%20Runtime%20Mechanism%20-%20with%20legal%20notice.pdf # [1] Signed-off-by: Zhu Qiyu Link: https://patch.msgid.link/20250704014104.82524-1-qiyuzhu2@amd.com [ rjw: Edits in new comments, subject and changelog ] Signed-off-by: Rafael J. Wysocki commit e71b59b4817b845f638225f29405a5435c047d72 Author: Eslam Khafagy Date: Fri Jul 4 03:40:00 2025 +0300 ACPI: fan: Replace sprintf() with sysfs_emit() Replace sprintf() with sysfs_emit() in function show_fine_grain_control() in according to Documentation/filesystems/sysfs.rst. Link: https://lore.kernel.org/all/20250621055200.166361-1-abdelrahmanfekry375@gmail.com/ Signed-off-by: Eslam Khafagy Link: https://patch.msgid.link/20250704004002.70839-1-eslam.medhat1993@gmail.com Signed-off-by: Rafael J. Wysocki commit c8aea83c735ec5a853db495592a1b6b5e6db859b Author: Tony Luck Date: Thu Jul 3 13:04:21 2025 -0700 ACPI: APEI: EINJ: Fix trigger actions The trigger events are in BIOS memory immediately following the acpi_einj_trigger structure. These were not copied to regular kernel memory for use by apei_exec_ctx_init() so injections in "notrigger=0" mode failed with a message like this: APEI: Invalid action table, unknown instruction type: 123 Fix by allocating a "table_size" block of memory and copying the whole table for use in the rest of the trigger flow. Fixes: 1a35c88302a3 ("ACPI: APEI: EINJ: Fix kernel test sparse warnings") Reported-by: Yi1 Lai Signed-off-by: Tony Luck Link: https://patch.msgid.link/20250703200421.28012-1-tony.luck@intel.com Signed-off-by: Rafael J. Wysocki commit e553ac0d7616d6bcd06ed0c5f6126ce83097b31a Author: Leon Yen Date: Fri Apr 18 17:37:40 2025 +0800 wifi: mt76: mt7921s: Introduce SDIO WiFi/BT combo module card reset Add a hardware reset method to recover from the SDIO bus error that cannot be resolved by the current WiFi/BT subsystem reset. Signed-off-by: Leon Yen Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250418093740.3814909-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 55e95ce469d0c61041bae48b2ebb7fcbf6d1ba7f Author: Ming Yen Hsieh Date: Wed Jun 25 15:56:11 2025 +0800 wifi: mt76: mt792x: improve monitor interface handling Enable IEEE80211_HW_NO_VIRTUAL_MONITOR to ensure the driver is notified of all monitor interfaces and their channels. Signed-off-by: Ming Yen Hsieh Link: https://patch.msgid.link/20250625075611.1407687-1-mingyen.hsieh@mediatek.com Signed-off-by: Felix Fietkau commit 1298de13d12841f054277151d8ffa7786abd2645 Author: Lorenzo Bianconi Date: Wed Jun 25 19:40:30 2025 +0200 wifi: mt76: Get rid of dma_sync_single_for_device() for MMIO devices Since the page_pool for MT76 MMIO devices are created with PP_FLAG_DMA_SYNC_DEV flag, we do not need to sync_for_device each page received from the pool since it is already done by the page_pool codebase. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250625-mt76-sync-for-device-v1-1-e687e3278e1a@kernel.org Signed-off-by: Felix Fietkau commit 344dd6a4c91960d9640ab15770efd18526ac3fa3 Author: Lorenzo Bianconi Date: Fri Jul 4 15:08:13 2025 +0200 wifi: mt76: mt7996: Move num_sta accounting in mt7996_mac_sta_{add,remove}_links Move phy num_sta accounting in mt7996_mac_sta_add() and mt7996_mac_sta_remove() routines in order to take into account all possibles MLO links. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-9-356456c73f43@kernel.org Signed-off-by: Felix Fietkau commit 62da647a2b20fc0b8d47c7d11880d95927300305 Author: Lorenzo Bianconi Date: Fri Jul 4 15:08:12 2025 +0200 wifi: mt76: mt7996: Add MLO support to mt7996_tx_check_aggr() Generalize mt7996_tx_check_aggr() and mt7996_txwi_free() routines to introduce MLO support for MT7996 driver. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-8-356456c73f43@kernel.org Signed-off-by: Felix Fietkau commit a59650a2270190905fdab79431140371feb35251 Author: Lorenzo Bianconi Date: Fri Jul 4 15:08:11 2025 +0200 wifi: mt76: mt7996: Fix valid_links bitmask in mt7996_mac_sta_{add,remove} sta->valid_links bitmask can be set even for non-MLO client. Fixes: dd82a9e02c054 ("wifi: mt76: mt7996: Rely on mt7996_sta_link in sta_add/sta_remove callbacks") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-7-356456c73f43@kernel.org Signed-off-by: Felix Fietkau commit 64cbf0d7ce9afe20666da90ec6ecaec6ba5ac64b Author: Lorenzo Bianconi Date: Fri Jul 4 15:08:10 2025 +0200 wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx() Fis possible Out-Of-Boundary access in mt7996_tx routine if link_id is set to IEEE80211_LINK_UNSPECIFIED Fixes: 3ce8acb86b661 ("wifi: mt76: mt7996: Update mt7996_tx to MLO support") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-6-356456c73f43@kernel.org Signed-off-by: Felix Fietkau commit 59ea7af6f9ce218b86f9f46520819247c3a5f97b Author: Lorenzo Bianconi Date: Fri Jul 4 15:08:09 2025 +0200 wifi: mt76: mt7996: Fix mlink lookup in mt7996_tx_prepare_skb Use proper link_id in mt7996_tx_prepare_skb routine for mlink lookup. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-5-356456c73f43@kernel.org Signed-off-by: Felix Fietkau commit 8989d8e90f5fb29cd2c3518135798bb9d658d303 Author: Lorenzo Bianconi Date: Fri Jul 4 15:08:08 2025 +0200 wifi: mt76: mt7996: Do not set wcid.sta to 1 in mt7996_mac_sta_event() msta_link->wcid.sta is already set to 1 in mt7996_mac_sta_init_link routine. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-4-356456c73f43@kernel.org Signed-off-by: Felix Fietkau commit 1a1cce6b52e59999ce4e4e230b91e5db5327b158 Author: Lorenzo Bianconi Date: Fri Jul 4 15:08:07 2025 +0200 wifi: mt76: mt7996: Rely on for_each_sta_active_link() in mt7996_mcu_sta_mld_setup_tlv() Reuse for_each_sta_active_link utility macro in mt7996_mcu_sta_mld_setup_tlv routine. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-3-356456c73f43@kernel.org Signed-off-by: Felix Fietkau commit e8d7eef07199887161cd6f3c062406628781f8b6 Author: Lorenzo Bianconi Date: Fri Jul 4 15:08:06 2025 +0200 wifi: mt76: mt7996: Fix secondary link lookup in mt7996_mcu_sta_mld_setup_tlv() Use proper link_id value for secondary link lookup in mt7996_mcu_sta_mld_setup_tlv routine. Fixes: 00cef41d9d8f5 ("wifi: mt76: mt7996: Add mt7996_mcu_sta_mld_setup_tlv() and mt7996_mcu_sta_eht_mld_tlv()") Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-2-356456c73f43@kernel.org Signed-off-by: Felix Fietkau commit 53a5d72bdd70e262623b6009cc4754927b428bad Author: Felix Fietkau Date: Fri Jul 4 15:08:05 2025 +0200 wifi: mt76: fix vif link allocation Reuse the vif deflink for link_id = 0 in order to avoid confusion with vif->bss_conf, which also gets a link id of 0. Link: https://patch.msgid.link/20250704-mt7996-mlo-fixes-v1-1-356456c73f43@kernel.org Signed-off-by: Felix Fietkau commit 3413bc0cf16e38db53830c837b4bf639fb2126ef Author: Tao Chen Date: Fri Jul 4 00:37:00 2025 +0800 bpf: Clean code with bpf_copy_to_user() No logic change, use bpf_copy_to_user() to clean code. Signed-off-by: Tao Chen Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250703163700.677628-1-chen.dylane@linux.dev Signed-off-by: Alexei Starovoitov commit 9a0658d3991e6c82df87584b253454842f22f965 Author: Peng Fan Date: Fri Jul 4 11:09:36 2025 +0800 firmware: arm_scmi: power_control: Ensure SCMI_SYSPOWER_IDLE is set early during resume Fix a race condition where a second suspend notification from another SCMI agent wakes the system before SCMI_SYSPOWER_IDLE is set, leading to ignored suspend requests. This is due to interrupts triggering early execution of `scmi_userspace_notifier()` before the SCMI state is updated. To resolve this, set SCMI_SYSPOWER_IDLE earlier in the device resume path, prior to `thaw_processes()`. This ensures the SCMI state is correct when the notifier runs, allowing the system to suspend again as expected. On some platforms using SCMI, SCP cannot distinguish between CPU idle and suspend since both result in cluster power-off. By explicitly setting the idle state early, the Linux SCMI agent can correctly re-suspend in response to external notifications. Signed-off-by: Peng Fan Message-Id: <20250704-scmi-pm-v2-2-9316cec2f9cc@nxp.com> Signed-off-by: Sudeep Holla commit 76e65f7a0e0fb41d636c11b688db6393676f4bf4 Author: Peng Fan Date: Fri Jul 4 11:09:35 2025 +0800 firmware: arm_scmi: Add power management operations to SCMI bus Introduce suspend and resume power management callbacks for `scmi_bus_type`, modeled after `platform_pm_ops`. This enables SCMI devices on the bus to implement their own suspend and resume behavior, allowing for more fine-grained power control at the device level. Signed-off-by: Peng Fan Message-Id: <20250704-scmi-pm-v2-1-9316cec2f9cc@nxp.com> Signed-off-by: Sudeep Holla commit 192e3aa145292bad69f1d702ab21755ae07dda40 Author: Paul Chaignon Date: Mon Jul 7 13:50:35 2025 +0200 selftests/bpf: Negative test case for tail call map This patch adds a negative test case for the following verifier error. expected prog array map for tail call Acked-by: Yonghong Song Signed-off-by: Paul Chaignon Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/aGu0i1X_jII-3aFa@mail.gmail.com Signed-off-by: Alexei Starovoitov commit df4b1eebd8d1985d2016bc02fe3ea27c2e628e56 Merge: 0f626c98fd1033 92974cef83b560 Author: Alexei Starovoitov Date: Mon Jul 7 08:32:34 2025 -0700 Merge branch 'bpf-fix-and-test-aux-usage-after-do_check_insn' Luis Gerhorst says: ==================== bpf: Fix and test aux usage after do_check_insn() Fix cur_aux()->nospec_result test after do_check_insn() referring to the to-be-analyzed (potentially unsafe) instruction, not the already-analyzed (safe) instruction. This might allow a unsafe insn to slip through on a speculative path. Create some tests from the reproducer [1]. Commit d6f1c85f2253 ("bpf: Fall back to nospec for Spectre v1") should not be in any stable kernel yet, therefore bpf-next should suffice. [1] https://lore.kernel.org/bpf/685b3c1b.050a0220.2303ee.0010.GAE@google.com/ Changes since v2: - Use insn_aux variable instead of introducing prev_aux() as suggested by Eduard (and therefore also drop patch 1) - v2: https://lore.kernel.org/bpf/20250628145016.784256-1-luis.gerhorst@fau.de/ Changes since v1: - Fix compiler error due to missed rename of prev_insn_idx in first patch - v1: https://lore.kernel.org/bpf/20250628125927.763088-1-luis.gerhorst@fau.de/ Changes since RFC: - Introduce prev_aux() as suggested by Alexei. For this, we must move the env->prev_insn_idx assignment to happen directly after do_check_insn(), for which I have created a separate commit. This patch could be simplified by using a local prev_aux variable as sugested by Eduard, but I figured one might find the new assignment-strategy easier to understand (before, prev_insn_idx and env->prev_insn_idx were out-of-sync for the latter part of the loop). Also, like this we do not have an additional prev_* variable that must be kept in-sync and the local variable's usage (old prev_insn_idx, new tmp) is much more local. If you think it would be better to not take the risk and keep the fix simple by just introducing the prev_aux variable, let me know. - Change WARN_ON_ONCE() to verifier_bug_if() as suggested by Alexei - Change assertion to check instruction is BPF_JMP[32] as suggested by Eduard - RFC: https://lore.kernel.org/bpf/8734bmoemx.fsf@fau.de/ ==================== Link: https://patch.msgid.link/20250705190908.1756862-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 92974cef83b560175fc52acb53aa833cb1e93306 Author: Luis Gerhorst Date: Sat Jul 5 21:09:08 2025 +0200 selftests/bpf: Add Spectre v4 tests Add the following tests: 1. A test with an (unimportant) ldimm64 (16 byte insn) and a Spectre-v4--induced nospec that clarifies and serves as a basic Spectre v4 test. 2. Make sure a Spectre v4 nospec_result does not prevent a Spectre v1 nospec from being added before the dangerous instruction (tests that [1] is fixed). 3. Combine the two, which is the combination that triggers the warning in [2]. This is because the unanalyzed stack write has nospec_result set, but the ldimm64 (which was just analyzed) had incremented insn_idx by 2. That violates the assertion that nospec_result is only used after insns that increment insn_idx by 1 (i.e., stack writes). [1] https://lore.kernel.org/bpf/4266fd5de04092aa4971cbef14f1b4b96961f432.camel@gmail.com/ [2] https://lore.kernel.org/bpf/685b3c1b.050a0220.2303ee.0010.GAE@google.com/ Signed-off-by: Luis Gerhorst Link: https://lore.kernel.org/r/20250705190908.1756862-3-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit dadb59104c6441f54d0c42bba3e4bd11e25fc6d9 Author: Luis Gerhorst Date: Sat Jul 5 21:09:07 2025 +0200 bpf: Fix aux usage after do_check_insn() We must terminate the speculative analysis if the just-analyzed insn had nospec_result set. Using cur_aux() here is wrong because insn_idx might have been incremented by do_check_insn(). Therefore, introduce and use insn_aux variable. Also change cur_aux(env)->nospec in case do_check_insn() ever manages to increment insn_idx but still fail. Change the warning to check the insn class (which prevents it from triggering for ldimm64, for which nospec_result would not be problematic) and use verifier_bug_if(). In line with Eduard's suggestion, do not introduce prev_aux() because that requires one to understand that after do_check_insn() call what was current became previous. This would at-least require a comment. Fixes: d6f1c85f2253 ("bpf: Fall back to nospec for Spectre v1") Reported-by: Paul Chaignon Reported-by: Eduard Zingerman Reported-by: syzbot+dc27c5fb8388e38d2d37@syzkaller.appspotmail.com Link: https://lore.kernel.org/bpf/685b3c1b.050a0220.2303ee.0010.GAE@google.com/ Link: https://lore.kernel.org/bpf/4266fd5de04092aa4971cbef14f1b4b96961f432.camel@gmail.com/ Suggested-by: Eduard Zingerman Signed-off-by: Luis Gerhorst Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250705190908.1756862-2-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 0f626c98fd10330da0420029a1c4fa35e39fb873 Author: Saket Kumar Bhaskar Date: Mon Jul 7 12:47:35 2025 +0530 selftests/bpf: Set CONFIG_PACKET=y for selftests BPF selftest fails to build with below error: CLNG-BPF [test_progs] lsm_cgroup.bpf.o progs/lsm_cgroup.c:105:21: error: variable has incomplete type 'struct sockaddr_ll' 105 | struct sockaddr_ll sa = {}; | ^ progs/lsm_cgroup.c:105:9: note: forward declaration of 'struct sockaddr_ll' 105 | struct sockaddr_ll sa = {}; | ^ 1 error generated. lsm_cgroup selftest requires sockaddr_ll structure which is not there in vmlinux.h when the kernel is built with CONFIG_PACKET=m. Enabling CONFIG_PACKET=y ensures that sockaddr_ll is available in vmlinux, allowing it to be captured in the generated vmlinux.h for bpf selftests. Reported-by: Sachin P Bappalige Signed-off-by: Saket Kumar Bhaskar Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250707071735.705137-1-skb99@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 0074250c35a4ad9b21ee91b78f62906d8b7942bf Merge: 6e5cae9ddae7f1 bfa2bb9abd99be Author: Alexei Starovoitov Date: Mon Jul 7 08:30:15 2025 -0700 Merge branch 'bpf-streams-fixes' Kumar Kartikeya Dwivedi says: ==================== BPF Streams - Fixes This set contains some fixes for recently reported issues for BPF streams. Please check individual patches for details. ==================== Link: https://patch.msgid.link/20250705053035.3020320-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit bfa2bb9abd99beff078eaf9d9b59dbd4eb726040 Author: Kumar Kartikeya Dwivedi Date: Fri Jul 4 22:30:35 2025 -0700 bpf: Fix improper int-to-ptr cast in dump_stack_cb On 32-bit platforms, we'll try to convert a u64 directly to a pointer type which is 32-bit, which causes the compiler to complain about cast from an integer of a different size to a pointer type. Cast to long before casting to the pointer type to match the pointer width. Reported-by: kernelci.org bot Reported-by: Randy Dunlap Fixes: d7c431cafcb4 ("bpf: Add dump_stack() analogue to print to BPF stderr") Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20250705053035.3020320-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 116c8f474722bd06f314ca88fb1a01e5526e3366 Author: Kumar Kartikeya Dwivedi Date: Fri Jul 4 22:30:34 2025 -0700 bpf: Fix bounds for bpf_prog_get_file_line linfo loop We may overrun the bounds because linfo and jited_linfo are already advanced to prog->aux->linfo_idx, hence we must only iterate the remaining elements until we reach prog->aux->nr_linfo. Adjust the nr_linfo calculation to fix this. Reported in [0]. [0]: https://lore.kernel.org/bpf/f3527af3b0620ce36e299e97e7532d2555018de2.camel@gmail.com Reported-by: Eduard Zingerman Fixes: 0e521efaf363 ("bpf: Add function to extract program source info") Signed-off-by: Kumar Kartikeya Dwivedi Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250705053035.3020320-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 6e5cae9ddae7f14f5bffc34d12f45af756f86658 Merge: 03fe01ddd1d8be 68cca81fd57fd9 Author: Alexei Starovoitov Date: Mon Jul 7 08:25:07 2025 -0700 Merge branch 'bpf-additional-use-cases-for-untrusted-ptr_to_mem' Eduard Zingerman says: ==================== bpf: additional use-cases for untrusted PTR_TO_MEM This patch set introduces two usability enhancements leveraging untrusted pointers to mem: - When reading a pointer field from a PTR_TO_BTF_ID, the resulting value is now assumed to be PTR_TO_MEM|MEM_RDONLY|PTR_UNTRUSTED instead of SCALAR_VALUE, provided the pointer points to a primitive type. - __arg_untrusted attribute for global function parameters, allowed for pointer arguments of both structural and primitive types: - For structural types, the attribute produces PTR_TO_BTF_ID|PTR_UNTRUSTED. - For primitive types, it yields PTR_TO_MEM|MEM_RDONLY|PTR_UNTRUSTED. Here are examples enabled by the series: struct foo { int *arr; }; ... p = bpf_core_cast(..., struct foo); bpf_for(i, 0, ...) { ... p->arr[i] ... // load at any offset is allowed } int memcmp(void *a __arg_untrusted, void *b __arg_untrusted, size_t n) { bpf_for(i, 0, n) if (a[i] - b[i]) // load at any offset is allowed return ...; return 0; } The patch-set was inspired by Anrii's series [1]. The goal of that series was to define a generic global glob_match function, capable to accept any pointer type: __weak int glob_match(const char *pat, const char *str); char filename_glob[32]; void foo(...) { ... task = bpf_get_current_task_btf(); filename = task->mm->exe_file->f_path.dentry->d_name.name; ... match_glob(filename_glob, // pointer to map value filename) ... // scalar } At the moment, there is no straightforward way to express such a function. This patch-set makes it possible to define it as follows: __weak int glob_match(const char *pat __arg_untrusted, const char *str __arg_untrusted); [1] https://github.com/anakryiko/linux/tree/bpf-mem-cast Changelog: v1: https://lore.kernel.org/bpf/20250702224209.3300396-1-eddyz87@gmail.com/ v1 -> v2: - Added safety check in btf_prepare_func_args() to ensure that only struct or primitive types could be combined with __arg_untrusted (Alexei). - Removed unnecessary 'continue' btf_check_func_arg_match() (Alexei). - Added test cases for __arg_untrusted pointers to enum and __arg_untrusted combined with non-kernel type (Kumar). - Added acks from Kumar. ==================== Link: https://patch.msgid.link/20250704230354.1323244-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 68cca81fd57fd9f5b8fd8da0dccd1d00522592f9 Author: Eduard Zingerman Date: Fri Jul 4 16:03:54 2025 -0700 selftests/bpf: tests for __arg_untrusted void * global func params Check usage of __arg_untrusted parameters of primitive type: - passing of {trusted, untrusted, map value, scalar value, values with variable offset} to untrusted `void *`, `char *` or enum is ok; - varifier represents such parameters as rdonly_untrusted_mem(sz=0). Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250704230354.1323244-9-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit c4aa454c64ae022e5a9d55b3c31e9b8dd8a1544f Author: Eduard Zingerman Date: Fri Jul 4 16:03:53 2025 -0700 bpf: support for void/primitive __arg_untrusted global func params Allow specifying __arg_untrusted for void */char */int */long * parameters. Treat such parameters as PTR_TO_MEM|MEM_RDONLY|PTR_UNTRUSTED of size zero. Intended usage is as follows: int memcmp(char *a __arg_untrusted, char *b __arg_untrusted, size_t n) { bpf_for(i, 0, n) { if (a[i] - b[i]) // load at any offset is allowed return a[i] - b[i]; } return 0; } Allocate register id for ARG_PTR_TO_MEM parameters only when PTR_MAYBE_NULL is set. Register id for PTR_TO_MEM is used only to propagate non-null status after conditionals. Suggested-by: Alexei Starovoitov Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250704230354.1323244-8-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 54ac2c9418af2f115ca42419e6c6633b88f3d49d Author: Eduard Zingerman Date: Fri Jul 4 16:03:52 2025 -0700 selftests/bpf: test cases for __arg_untrusted Check usage of __arg_untrusted parameters with PTR_TO_BTF_ID: - combining __arg_untrusted with other tags is forbidden; - non-kernel (program local) types for __arg_untrusted are forbidden; - passing of {trusted, untrusted, map value, scalar value, values with variable offset} to untrusted is ok; - passing of PTR_TO_BTF_ID with a different type to untrusted is ok; - passing of untrusted to trusted is forbidden. Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250704230354.1323244-7-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit aaa0e57e693083b997f21064689710dfe98b326c Author: Eduard Zingerman Date: Fri Jul 4 16:03:51 2025 -0700 libbpf: __arg_untrusted in bpf_helpers.h Make btf_decl_tag("arg:untrusted") available for libbpf users via macro. Makes the following usage possible: void foo(struct bar *p __arg_untrusted) { ... } void bar(struct foo *p __arg_trusted) { ... foo(p->buz->bar); // buz derefrence looses __trusted ... } Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250704230354.1323244-6-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 182f7df70419f368c4310dc151677d574e53c44a Author: Eduard Zingerman Date: Fri Jul 4 16:03:50 2025 -0700 bpf: attribute __arg_untrusted for global function parameters Add support for PTR_TO_BTF_ID | PTR_UNTRUSTED global function parameters. Anything is allowed to pass to such parameters, as these are read-only and probe read instructions would protect against invalid memory access. Suggested-by: Alexei Starovoitov Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250704230354.1323244-5-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit f1f5d6f25d098e21b0a53237cfd055fc28787c46 Author: Eduard Zingerman Date: Fri Jul 4 16:03:49 2025 -0700 selftests/bpf: ptr_to_btf_id struct walk ending with primitive pointer Validate that reading a PTR_TO_BTF_ID field produces a value of type PTR_TO_MEM|MEM_RDONLY|PTR_UNTRUSTED, if field is a pointer to a primitive type. Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250704230354.1323244-4-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 2d5c91e1cc14c3511d163ac36ee869ecf3a29cc2 Author: Eduard Zingerman Date: Fri Jul 4 16:03:48 2025 -0700 bpf: rdonly_untrusted_mem for btf id walk pointer leafs When processing a load from a PTR_TO_BTF_ID, the verifier calculates the type of the loaded structure field based on the load offset. For example, given the following types: struct foo { struct foo *a; int *b; } *p; The verifier would calculate the type of `p->a` as a pointer to `struct foo`. However, the type of `p->b` is currently calculated as a SCALAR_VALUE. This commit updates the logic for processing PTR_TO_BTF_ID to instead calculate the type of p->b as PTR_TO_MEM|MEM_RDONLY|PTR_UNTRUSTED. This change allows further dereferencing of such pointers (using probe memory instructions). Suggested-by: Alexei Starovoitov Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250704230354.1323244-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit b9d44bc9fd30550052d0854d71b0c0731dc9f053 Author: Eduard Zingerman Date: Fri Jul 4 16:03:47 2025 -0700 bpf: make makr_btf_ld_reg return error for unexpected reg types Non-functional change: mark_btf_ld_reg() expects 'reg_type' parameter to be either SCALAR_VALUE or PTR_TO_BTF_ID. Next commit expands this set, so update this function to fail if unexpected type is passed. Also update callers to propagate the error. Acked-by: Kumar Kartikeya Dwivedi Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250704230354.1323244-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 08dc0f5cc26a203e8008c38d9b436c079e7dbb45 Author: Kuninori Morimoto Date: Tue Jul 1 00:11:23 2025 +0000 ASoC: soc-dapm: add prefix on soc_dapm_dev_attrs soc_dapm_dev_attrs is global variable. Let's add snd_soc_ prefix. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ikkchis6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9d33f9ca4404e532453a0305ce11bf76a9945c5d Author: Kuninori Morimoto Date: Tue Jul 1 00:11:15 2025 +0000 ASoC: soc-dapm: add prefix on dapm_xxx_event() dapm_xxx_event() is global function. Let's add snd_soc_ prefix. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87jz4shisc.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 805c019fbb94795e391974f673c5b3e57b825f6d Author: Kuninori Morimoto Date: Tue Jul 1 00:11:08 2025 +0000 ASoC: soc-dapm: add prefix on dapm_mark_endpoints_dirty() dapm_mark_endpoints_dirty() is global function. Let's add snd_soc_ prefix. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ldp8hisj.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 1ac23653840f784d0f5846ac253d04ecef9a26f6 Author: Kuninori Morimoto Date: Tue Jul 1 00:11:03 2025 +0000 ASoC: soc-dapm: use common name for dapm Let's use "dapm", instead of "d". This is prepare for dapm cleanup. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ms9ohisp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit fbd09117a38e5ff477040629f7b5fc442883746a Author: Kuninori Morimoto Date: Tue Jul 1 00:10:57 2025 +0000 ASoC: soc-dapm: use component instead of cmpnt Use normal "component" instead of short "cmpnt" Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87o6u4hisu.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit f02ccc8c0b99382807bac0065918a90ba974e9ab Author: Kuninori Morimoto Date: Tue Jul 1 00:10:51 2025 +0000 ASoC: soc-dapm: reordering header definitions Because header defined randomly, it needs name definitions on top of soc-dapm.h. it is not needed if definitions are implemented in correct order. This patch has big change from change-line point of view, but is just reordering, nothing changed in meaning. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87plekhit0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0d516af948536c3fdefadd465a516e1f1317f696 Author: Kuninori Morimoto Date: Tue Jul 1 00:10:45 2025 +0000 ASoC: soc-dapm: reordering function definitions Because functions are defined randomly, it needs function name definitions on top of soc-dapm.c. it is not needed if functions are implemented in correct order. This patch has big change from change-line point of view, but is just reordering, nothing changed in meaning. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87qzz0hit6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit d6f240031afbd780431ef289357373e2bbf2f793 Author: Kuninori Morimoto Date: Tue Jul 1 00:10:39 2025 +0000 ASoC: soc-dapm: remove snd_soc_dapm_weak_routes() No one is using snd_soc_dapm_weak_routes(), let's remove it. Because snd_soc_dapm_weak_routes() was removed, path->weak is not needed either. Remove it, too. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87sejghitd.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 2ec1067d1e5acb9e7aeb1fe6d5178424fc3107ab Author: Kuninori Morimoto Date: Tue Jul 1 00:10:33 2025 +0000 ASoC: soc-dapm: remove snd_soc_dapm_nc_pin[_unlocked]() snd_soc_dapm_nc_pin() was added in commit 5817b52a298a ("ALSA: ASoC: Allow machine drivers to mark pins as not connected") at 2008. It is identical to snd_soc_dapm_disable_pin[_unlocked](). It was expected to be updated, but were enough as-is for this 17 years. We might update these, but renaming function name by define is enough for now. We can re-create these if needed in the future. Let's remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87tt3whitj.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 58baaea26659ab24ba396afd592c2423aefc067c Author: Kuninori Morimoto Date: Tue Jul 1 00:10:27 2025 +0000 ASoC: soc-dapm: remove EXPORT_SYMBOL_GPL() for snd_soc_dapm_free() snd_soc_dapm_free() is called from soc-dapm.c / soc-core.c only. All these are compiled by snd-soc-core-y. So EXPORT_SYMBOL_GPL() is not needed. Remove it. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87v7ochitp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit e199e85556bd83806baf4689cbecfa31c41a6cfa Author: Kuninori Morimoto Date: Tue Jul 1 00:10:20 2025 +0000 ASoC: soc-dapm: remove unnecessary definition Below functions are already defined in soc-dapm.h, it is not necessary in soc-dapm.c. Remove these snd_soc_dapm_new_control() snd_soc_dapm_new_control_unlocked() Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87wm8shitv.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 45d0376e4970417c9a5ab17af7f40d817015ae32 Merge: 51106b830ad9dc 2fca750160f290 Author: Mark Brown Date: Mon Jul 7 16:12:21 2025 +0100 treewide: Remove redundant Merge series from Sakari Ailus : Late last year I posted a set to switch to __pm_runtime_mark_last_busy() and gradually get rid of explicit pm_runtime_mark_last_busy() calls in drivers, embedding them in the appropriate pm_runtime_*autosuspend*() calls. The overall feedback I got at the time was that this is an unnecessary intermediate step, and removing the pm_runtime_mark_last_busy() calls can be done after adding them to the relevant Runtime PM autosuspend related functions. commit 482c7e296edc0f594e8869a789a40be53c49bd6a Author: Thomas Zimmermann Date: Thu Jun 19 13:27:01 2025 +0200 drm/tegra: Use dma_buf from GEM object instance Avoid dereferencing struct drm_gem_object.import_attach for the imported dma-buf. The dma_buf field in the GEM object instance refers to the same buffer. Prepares to make import_attach an implementation detail of PRIME. Signed-off-by: Thomas Zimmermann Reviewed-by: Christian König Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20250619113100.70292-3-tzimmermann@suse.de commit 7f67c360bc73bed0a980652e921ec14a15fcf1bf Author: Thomas Zimmermann Date: Thu Jun 19 13:27:00 2025 +0200 drm/tegra: Test for imported buffers with drm_gem_is_imported() Instead of testing import_attach for imported GEM buffers, invoke drm_gem_is_imported() to do the test. Signed-off-by: Thomas Zimmermann Reviewed-by: Christian König Signed-off-by: Thierry Reding Link: https://lore.kernel.org/r/20250619113100.70292-2-tzimmermann@suse.de commit 28254bcf96bf93b9089540490c2f8081bf4e4d45 Author: Wolfram Sang Date: Mon May 19 13:21:04 2025 +0200 ARM: dts: marvell: kirkwood: use recent scl/sda gpio bindings We have dedictaded bindings for scl/sda nowadays. Switch away from the deprecated plain 'gpios' property. Signed-off-by: Wolfram Sang Signed-off-by: Gregory CLEMENT commit 90ec89d68ffaf36d7abfcc14908edd6e4803c4ea Author: Kuninori Morimoto Date: Fri Jul 4 02:47:31 2025 +0000 arm: orion: use string choices helper We can use string choices helper, let's use it. Signed-off-by: Kuninori Morimoto Reviewed-by: Andrew Lunn Signed-off-by: Gregory CLEMENT commit 216887f79d9878d9cb169729fea3bb16c56db465 Author: Ankit Agrawal Date: Sat Jul 5 07:17:13 2025 +0000 KVM: arm64: Assume non-PFNMAP/MIXEDMAP VMAs can be mapped cacheable Despite its name, kvm_is_device_pfn() is actually used to determine if a given PFN has a kernel mapping that can be used to perform cache maintenance, as it calls pfn_is_map_memory() internally. Expand the helper into its single callsite and further condition the check on the VMA having either VM_PFNMAP or VM_MIXEDMAP set. VMAs that set neither of these flags must always contain Normal, struct page backed memory with valid aliases in the kernel address space. Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Reviewed-by: David Hildenbrand Tested-by: Donald Dutile Signed-off-by: Ankit Agrawal Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20250705071717.5062-3-ankita@nvidia.com [ Oliver: fixed typos, refined changelog ] Signed-off-by: Oliver Upton commit 8cc9dc1ae4fb075e29e2d5cf2386761d3497049a Author: Ankit Agrawal Date: Sat Jul 5 07:17:12 2025 +0000 KVM: arm64: Rename the device variable to s2_force_noncacheable To perform cache maintenance on a region of memory, KVM/arm64 relies on that region having a cacheable alias in the kernel's address space which can be used with CMO instructions. The 'device' variable is somewhat of a misnomer, as it actually indicates whether or not the stage-2 alias is allowed to have cacheable memory attributes. The resulting stage-2 memory attributes are further modified by VM_ALLOW_ANY_UNCACHED, selecting between Normal-NC or Device-nGnRE depending on what the endpoint supports. Rename the to s2_force_noncacheable such that its purpose is a bit more obvious. CC: Catalin Marinas Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Reviewed-by: David Hildenbrand Tested-by: Donald Dutile Signed-off-by: Ankit Agrawal Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20250705071717.5062-2-ankita@nvidia.com [ Oliver: addressed typos, wound up rewriting changelog ] Signed-off-by: Oliver Upton commit c79550f69f0f21be069385c20cd6490b862ba2a5 Merge: 7554729de27daf c479d7cf06c3d6 Author: Yixun Lan Date: Mon Jul 7 22:07:15 2025 +0800 Merge tag 'spacemit-reset-for-6.17-1' of https://github.com/spacemit-com/linux RISC-V SpacemiT Reset for 6.17 - Add reset driver support for K1 SoC * tag 'spacemit-reset-for-6.17-1': reset: spacemit: add support for SpacemiT CCU resets clk: spacemit: define three reset-only CCUs clk: spacemit: set up reset auxiliary devices soc: spacemit: create a header for clock/reset registers dt-bindings: soc: spacemit: define spacemit,k1-ccu resets Signed-off-by: Yixun Lan commit c479d7cf06c3d65532442fa368b058e05dbba1a2 Author: Alex Elder Date: Wed Jul 2 06:37:07 2025 -0500 reset: spacemit: add support for SpacemiT CCU resets Implement reset support for SpacemiT CCUs. A SpacemiT reset controller device is an auxiliary device associated with a clock controller (CCU). This patch defines the reset controllers for the MPMU, APBC, and MPMU CCUs, which already define clock controllers. It also adds RCPU, RCPU2, and ACPB2 CCUs, which only define resets. Signed-off-by: Alex Elder Reviewed-by: Philipp Zabel Reviewed-by: Yixun Lan Acked-by: Philipp Zabel Link: https://lore.kernel.org/r/20250702113709.291748-6-elder@riscstar.com Signed-off-by: Yixun Lan commit 31db7b6a78b7651973c66b7cf479209b20c55290 Author: Thomas Weißschuh Date: Mon Jul 7 14:58:11 2025 +0200 tools/nolibc: avoid false-positive -Wmaybe-uninitialized through waitpid() The compiler does not know that waitid() will only ever return 0 or -1. If waitid() would return a positive value than waitpid() would return that same value and *status would not be initialized. However users calling waitpid() know that the only possible return values of it are 0 or -1. They therefore might check for errors with 'ret == -1' or 'ret < 0' and use *status otherwise. The compiler will then warn about the usage of a potentially uninitialized variable. Example: $ cat test.c #include #include int main(void) { int ret, status; ret = waitpid(0, &status, 0); if (ret == -1) return 0; printf("status %x\n", status); return 0; } $ gcc --version gcc (GCC) 15.1.1 20250425 $ gcc -Wall -Os -Werror -nostdlib -nostdinc -static -Iusr/include -Itools/include/nolibc/ -o /dev/null test.c test.c: In function ‘main’: test.c:12:9: error: ‘status’ may be used uninitialized [-Werror=maybe-uninitialized] 12 | printf("status %x\n", status); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ test.c:6:18: note: ‘status’ was declared here 6 | int ret, status; | ^~~~~~ cc1: all warnings being treated as errors Avoid the warning by normalizing waitid() errors to '-1' in waitpid(). Fixes: 0c89abf5ab3f ("tools/nolibc: implement waitpid() in terms of waitid()") Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250707-nolibc-waitpid-uninitialized-v1-1-dcd4e70bcd8f@linutronix.de Signed-off-by: Thomas Weißschuh commit cedb945101df021e9c7546b7bf490bec4dbc9cc8 Author: Greg Kroah-Hartman Date: Tue Jul 1 12:51:15 2025 +0200 drm/vgem/vgem_drv convert to use faux_device The vgem driver does not need to create a platform device, as there is no real platform resources associated it, it only did so because it was simple to do that in order to get a device to use for resource management of drm resources. Change the driver to use the faux device instead as this is NOT a real platform device. Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: Simona Vetter Cc: dri-devel@lists.freedesktop.org Reviewed-by: Thomas Zimmermann Reviewed-by: Lyude Paul Signed-off-by: Greg Kroah-Hartman Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/2025070114-iron-shiny-b92e@gregkh commit 5686601908d80ce668ac9b5dc51053c1082f683b Author: Greg Kroah-Hartman Date: Tue Jul 1 12:49:48 2025 +0200 drm/vkms: convert to use faux_device The vkms driver does not need to create a platform device, as there is no real platform resources associated it, it only did so because it was simple to do that in order to get a device to use for resource management of drm resources. Change the driver to use the faux device instead as this is NOT a real platform device. Tested-by: Louis Chauvet Reviewed-by: Louis Chauvet Reviewed-by: Thomas Zimmermann Cc: Haneen Mohammed Cc: Simona Vetter Cc: Melissa Wen Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: David Airlie Cc: dri-devel@lists.freedesktop.org Reviewed-by: Lyude Paul Signed-off-by: Greg Kroah-Hartman Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/2025070147-antics-pleat-edd2@gregkh commit e7a1cbca0b4255ac3e03f53d440fa38f7a41d8cc Author: Thomas Zimmermann Date: Mon Jun 30 16:34:11 2025 +0200 drm/gem-shmem: Do not map s/g table by default The vast majority of drivers that use GEM-SHMEM helpers do not use an s/g table for imported buffers; specifically all drivers that use DRM_GEM_SHMEM_DRIVER_OPS. Therefore convert the initializer macro to DRM_GEM_SHMEM_DRIVER_OPS_NO_MAP_SGT and remove the latter. This helps to avoid swiotbl errors, such as seen with some Aspeed systems ast 0000:07:00.0: swiotlb buffer is full (sz: 3145728 bytes), total 32768 (slots), used 0 (slots) The error is caused by the system's limited DMA capabilities and can happen with any GEM-SHMEM-based driver. It results in a performance penalty. In the case of vgem and vkms, the devices do not support DMA at all, which can result in failure to map the buffer object into the kernel's address space. [1][2] Avoiding the s/g table fixes this problem. The other drivers based on GEM-SHMEM, imagination, lima, panfrost, panthor, v3d and virtio, use the s/g table of imported buffers. Neither driver uses the default initializer, so they won't be affected by this change. Signed-off-by: Thomas Zimmermann Reported-by: Zenghui Yu Closes: https://lore.kernel.org/dri-devel/6d22bce3-4533-4cfa-96ba-64352b715741@linux.dev/ # [1] Reported-by: José Expósito Closes: https://lore.kernel.org/dri-devel/20250311172054.2903-1-jose.exposito89@gmail.com/ # [2] Tested-by: Zenghui Yu Reviewed-by: Christian König Reviewed-by: Louis Chauvet Link: https://lore.kernel.org/r/20250630143537.309052-1-tzimmermann@suse.de commit 56036d6af41a473a8129fc960a5ab3673eda13d5 Author: Stuart Hayes Date: Mon Jun 9 13:46:57 2025 -0500 platform/x86: dell_rbu: Remove unused struct Stop using an entire struct packet_data just for its embedded list_head. Signed-off-by: Stuart Hayes Link: https://lore.kernel.org/r/20250609184659.7210-4-stuart.w.hayes@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1cea5180f2f812c444ceebdc40f5d001bedd030d Author: Jens Axboe Date: Sat Jul 5 14:19:50 2025 -0600 block: remove pktcdvd driver This driver has long outlived it's utility, and it's broken and unloved. The main use case for this was direct mount with UDF of cd-rw drives that required 32kb packets. It would collect writes into that size and write them out in multiples of that. That's not a common use case anymore, the world has moved on from those kinds of media. To make matters worse, it's actively breaking setups where it's not even required or useful. Link: https://lore.kernel.org/linux-block/fxg6dksau4jsk3u5xldlyo2m7qgiux6vtdrz5rywseotsouqdv@urcrwz6qtd3r/ Link: https://lore.kernel.org/linux-block/dcc4836e-6da9-4208-ad27-bbd44b3a2063@kernel.dk/ Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Jens Axboe commit 18c590e012d35b0551ba70798efd0b8d6c66c585 Author: Thierry Reding Date: Tue May 6 15:31:18 2025 +0200 arm64: defconfig: Enable Tegra HSP and BPMP Selecting the IVC, HSP and BPMP drivers via Kconfig is problematic because it can create conflicting configurations. Instead, enable them in the default configuration. Link: https://lore.kernel.org/r/20250506133118.1011777-12-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 94bce2cf7cf6ee4f52e1632b66d67345067725db Author: Thierry Reding Date: Tue May 6 15:31:17 2025 +0200 firmware: tegra: bpmp: Add support on Tegra264 Support for Tegra264 depends on the Tegra186 support, so make sure the latter is enabled. Link: https://lore.kernel.org/r/20250506133118.1011777-11-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 78eb18020a88a4eed15f5af7700ed570642ff8f1 Author: Thierry Reding Date: Tue May 6 15:31:16 2025 +0200 firmware: tegra: Fix IVC dependency problems The IVC code is library code that other drivers need to select if they need that library. However, if the symbol is user-selectable this can lead to conflicts. Fix this by making the symbol only selectable for COMPILE_TEST and add a select TEGRA_IVC to TEGRA_BPMP, which is currently the only user. Link: https://lore.kernel.org/r/20250506133118.1011777-10-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 7ddca4500140053ab0d0fba4f30f9bdcf66985d0 Author: Thierry Reding Date: Tue May 6 15:31:15 2025 +0200 soc/tegra: Add Tegra264 APBMISC compatible string Link: https://lore.kernel.org/r/20250506133118.1011777-9-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 519b078998ce6e729f98dccf35505b4756985d11 Author: Konstantin Komarov Date: Tue Jun 24 16:35:39 2025 +0300 fs/ntfs3: Exclude call make_bad_inode for live nodes. Use ntfs_inode field 'ni_bad' to mark inode as bad (if something went wrong) and to avoid any operations Suggested-by: Al Viro Signed-off-by: Konstantin Komarov commit 5cddd546df0fa21316735d1d60fe826886e0dc21 Author: Rahul Rameshbabu Date: Sun Jul 6 04:00:32 2025 +0000 rust: pci: fix documentation related to Device instances Device instances in the pci crate represent a valid struct pci_dev, not a struct device. Fixes: 7b948a2af6b5 ("rust: pci: fix unrestricted &mut pci::Device") Signed-off-by: Rahul Rameshbabu Link: https://lore.kernel.org/r/20250706035944.18442-3-sergeantsagara@protonmail.com Signed-off-by: Danilo Krummrich commit 5273adad12ff9eee4a56da951da073858060dd37 Author: Thierry Reding Date: Tue May 6 15:31:14 2025 +0200 soc/tegra: pmc: Add Tegra264 support The PMC block on Tegra264 has undergone a few small changes since it's Tegra234 predecessor. Match on the new compatible string to select the updated SoC-specific data. Link: https://lore.kernel.org/r/20250506133118.1011777-8-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 14bdb1be98629b5413f315c51294975dc3802f65 Author: Thierry Reding Date: Tue May 6 15:31:13 2025 +0200 soc/tegra: Enable support for Tegra264 Tegra264 is the successor to Tegra234, with various improvements and new hardware. Link: https://lore.kernel.org/r/20250506133118.1011777-7-thierry.reding@gmail.com Signed-off-by: Thierry Reding commit 866032d5625a761e7e8e9164c22c90b3c9840179 Merge: 1a4aabc27e9567 b65b8ed7e80dd7 Author: Rafael J. Wysocki Date: Mon Jul 7 14:12:13 2025 +0200 Merge branch 'thermal-intel' Merge Intel thermal drivers updates for 6.17: - Add Wildcat Lake PCI ID to the int340x processor_thermal driver (Srinivas Pandruvada). - Add debugfs interface to override the temperature set by the firmware in the platform temperature control (PTC) interface and add a new sysfs control attribute called thermal_tolerance to it (Srinivas Pandruvada). * thermal-intel: thermal: int340x: processor_thermal: Add Wildcat Lake PCI ID thermal: intel: int340x: Allow temperature override thermal: intel: int340x: Add throttling control interface to PTC commit cb863540e7c756abe7e709673a3e073c6a7aa8c0 Author: Luca Ceresoli Date: Fri Jul 4 01:30:18 2025 +0200 drm/bridge: tc358767: fix uninitialized variable regression Commit a59a27176914 ("drm/bridge: tc358767: convert to devm_drm_bridge_alloc() API") split tc_probe_bridge_endpoint() in two functions, thus duplicating the loop over the endpoints in each of those functions. However it missed duplicating the of_graph_parse_endpoint() call which initializes the struct of_endpoint, resulting in an uninitialized read. Fixes: a59a27176914 ("drm/bridge: tc358767: convert to devm_drm_bridge_alloc() API") Cc: stable@vger.kernel.org Reported-by: Colin King (gmail) Closes: https://lore.kernel.org/all/056b34c3-c1ea-4b8c-9672-c98903ffd012@gmail.com/ Reviewed-by: Colin Ian King Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250704-drm-bridge-alloc-fix-tc358767-regression-v2-1-ec0e511bedd0@bootlin.com Signed-off-by: Luca Ceresoli commit c5fccfe9e4e9d210a7e9de1ecb96c6edc33a518c Author: Damien Le Moal Date: Fri Jul 4 19:45:52 2025 +0900 ata: libata-eh: use bool for fastdrain in ata_eh_set_pending() Use the bool type for the fastdrain argument of ata_eh_set_pending(), as it should be. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Link: https://lore.kernel.org/r/20250704104552.310630-1-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 7aae547bbe442affc4afe176b157fab820a12437 Author: Damien Le Moal Date: Fri Jul 4 19:46:00 2025 +0900 ata: libata: Introduce ata_port_eh_scheduled() Introduce the inline helper function ata_port_eh_scheduled() to test if EH is pending (ATA_PFLAG_EH_PENDING port flag is set) or running (ATA_PFLAG_EH_IN_PROGRESS port flag is set) for a port. Use this helper in ata_port_wait_eh() and __ata_scsi_queuecmd() to replace the hardcoded port flag tests. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Link: https://lore.kernel.org/r/20250704104601.310643-1-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 48f05c3b4b701ae7687fd44d462c88b7ac67e952 Author: Marek Szyprowski Date: Fri Jun 27 18:56:52 2025 +0200 drm/bridge: analogix_dp: Use devm_drm_bridge_alloc() API devm_drm_bridge_alloc() is the new API to be used for allocating (and partially initializing) a private driver struct embedding a struct drm_bridge. Analogix DP driver somehow missed the automated conversion in commit 9c399719cfb9 ("drm: convert many bridge drivers from devm_kzalloc() to devm_drm_bridge_alloc() API"), what causes the following warning: ------------[ cut here ]------------ WARNING: lib/refcount.c:25 at drm_bridge_attach+0x2c/0x248, CPU#1: kworker/u8:1/34 refcount_t: addition on 0; use-after-free. Modules linked in: CPU: 1 UID: 0 PID: 34 Comm: kworker/u8:1 Not tainted 6.16.0-rc3-next-20250627-dirty #15839 PREEMPT Hardware name: Samsung Exynos (Flattened Device Tree) Workqueue: events_unbound deferred_probe_work_func Call trace: unwind_backtrace from show_stack+0x10/0x14 show_stack from dump_stack_lvl+0x68/0x88 dump_stack_lvl from __warn+0x94/0x1f0 __warn from warn_slowpath_fmt+0x124/0x1bc warn_slowpath_fmt from drm_bridge_attach+0x2c/0x248 drm_bridge_attach from analogix_dp_bind+0x70/0xc8 analogix_dp_bind from exynos_dp_bind+0x58/0xc4 exynos_dp_bind from component_bind_all+0x11c/0x27c component_bind_all from exynos_drm_bind+0xe8/0x198 exynos_drm_bind from try_to_bring_up_aggregate_device+0x200/0x2d8 try_to_bring_up_aggregate_device from __component_add+0xb0/0x170 __component_add from exynos_dp_probe+0xc0/0x164 exynos_dp_probe from platform_probe+0x5c/0xb8 platform_probe from really_probe+0xe0/0x3d8 really_probe from __driver_probe_device+0x9c/0x1e0 __driver_probe_device from driver_probe_device+0x30/0xc0 driver_probe_device from __device_attach_driver+0xa8/0x120 __device_attach_driver from bus_for_each_drv+0x84/0xdc bus_for_each_drv from __device_attach+0xb0/0x20c __device_attach from bus_probe_device+0x8c/0x90 bus_probe_device from deferred_probe_work_func+0x98/0xe0 deferred_probe_work_func from process_one_work+0x24c/0x70c process_one_work from worker_thread+0x1b8/0x3bc worker_thread from kthread+0x13c/0x264 kthread from ret_from_fork+0x14/0x28 ... ---[ end trace 0000000000000000 ]--- Fix this by switching the driver to the new API. Note the above warning only appears starting with commit a7748dd127ea ("drm/bridge: get/put the bridge reference in drm_bridge_add/remove()") which is the first commmit having added a drm_bridge_get/put() pair and thus exposing the incorrect initial refcount issue. Signed-off-by: Marek Szyprowski Fixes: a7748dd127ea ("drm/bridge: get/put the bridge reference in drm_bridge_add/remove()") Reviewed-by: Luca Ceresoli Link: https://lore.kernel.org/r/20250627165652.580798-1-m.szyprowski@samsung.com [Luca: add Fixes tag and mention the reason in commit message] Signed-off-by: Luca Ceresoli commit f3b7a65ce551ee7800f759ec7e198ee5030243dc Merge: 7788278ff267f8 70f238c902b8c0 Author: Leon Romanovsky Date: Mon Jul 7 06:29:16 2025 -0400 Merge branch 'mlx5-next' into wip/leon-for-next * mlx5-next: net/mlx5: Check device memory pointer before usage net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow net/mlx5: Add IFC bits for PCIe Congestion Event object net/mlx5: Small refactor for general object capabilities commit a6ed5691b2428cc578908ee050d5d4908a6e065e Merge: e04f97c8be2952 da9029b47d7906 Author: Christian Brauner Date: Mon Jun 16 17:01:31 2025 +0200 Merge patch series "coredump: further cleanups" Christian Brauner says: Continue reworking the coredump code so it's easier to follow and modify in the future. * Each method is moved into a separate helper. * The cleanup code is simplified and unified. * Entangle the dependency between the pipe coredump rate limiting and the common exit path. It's likely that there'll be more. * patches from https://lore.kernel.org/20250612-work-coredump-massage-v1-0-315c0c34ba94@kernel.org: (24 commits) coredump: add coredump_skip() helper coredump: avoid pointless variable coredump: order auto cleanup variables at the top coredump: add coredump_cleanup() coredump: auto cleanup prepare_creds() cred: add auto cleanup method coredump: directly return coredump: auto cleanup argv coredump: add coredump_write() coredump: use a single helper for the socket coredump: move pipe specific file check into coredump_pipe() coredump: split pipe coredumping into coredump_pipe() coredump: move core_pipe_count to global variable coredump: prepare to simplify exit paths coredump: split file coredumping into coredump_file() coredump: rename do_coredump() to vfs_coredump() selftests/coredump: make sure invalid paths are rejected coredump: validate socket path in coredump_parse() coredump: don't allow ".." in coredump socket path fs: move name_contains_dotdot() to header ... Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-0-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit da9029b47d790675dcd82a6d9e332bc41e1a17f1 Author: Christian Brauner Date: Thu Jun 12 15:25:38 2025 +0200 coredump: add coredump_skip() helper Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-24-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 9dd88f3626462e4ffd008196e053d4004e44427b Author: Christian Brauner Date: Thu Jun 12 15:25:37 2025 +0200 coredump: avoid pointless variable we don't use that value at all so don't bother with it in the first place. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-23-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit ae20958b37acf82da4928910ca6351719b5ddba7 Author: Christian Brauner Date: Thu Jun 12 15:25:36 2025 +0200 coredump: order auto cleanup variables at the top so they're easy to spot. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-22-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit cfd6c12293d7cc257f27770399a3d8f11bf7d25c Author: Christian Brauner Date: Thu Jun 12 15:25:35 2025 +0200 coredump: add coredump_cleanup() Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-21-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 7a568fcdad7c75a1ee196921cf651de607c2c5d5 Author: Christian Brauner Date: Thu Jun 12 15:25:34 2025 +0200 coredump: auto cleanup prepare_creds() which will allow us to simplify the exit path in further patches. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-20-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 377d7860c960ac8e672881bc50353d867e2f94a4 Author: Christian Brauner Date: Thu Jun 12 15:25:33 2025 +0200 cred: add auto cleanup method Add a simple auto cleanup method for struct cred. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-19-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 8434fac512d35597488b13e23cc85e2903f5c8ae Author: Christian Brauner Date: Thu Jun 12 15:25:32 2025 +0200 coredump: directly return instead of jumping to a pointless cleanup label. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-18-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 4a9f5d7fb6649af534c36aa8cc9c1aa51b172ad9 Author: Christian Brauner Date: Thu Jun 12 15:25:31 2025 +0200 coredump: auto cleanup argv to prepare for a simpler exit path. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-17-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 3a4db72d0368c5f618e18a12580d5c5dca7b2839 Author: Christian Brauner Date: Thu Jun 12 15:25:30 2025 +0200 coredump: add coredump_write() to encapsulate that logic simplifying vfs_coredump() even further. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-16-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit d6527db34d08d7d411c377a25c05fff30eeba9ea Author: Christian Brauner Date: Thu Jun 12 15:25:29 2025 +0200 coredump: use a single helper for the socket Don't split it into multiple functions. Just use a single one like we do for coredump_file() and coredump_pipe() now. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-15-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 5153053692987035a82bb4a6714ea12a5bd2bfdc Author: Christian Brauner Date: Thu Jun 12 15:25:28 2025 +0200 coredump: move pipe specific file check into coredump_pipe() There's no point in having this eyesore in the middle of vfs_coredump(). Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-14-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 9f29a347d7b1b2022dfc6e5a93d4f2a7b34f5d4d Author: Christian Brauner Date: Thu Jun 12 15:25:27 2025 +0200 coredump: split pipe coredumping into coredump_pipe() * Move that whole mess into a separate helper instead of having all that hanging around in vfs_coredump() directly. Cleanup paths are already centralized. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-13-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit a9b906f15995e18b700a7e7791865ecf2f1cee65 Author: Louis-Alexis Eyraud Date: Thu Jul 3 17:41:05 2025 +0200 arm64: dts: mediatek: mt8395-genio-1200-evk: Add MT6359 PMIC key support Add in mt8395-genio-1200-evk devicetree file a sub node in pmic for the mt6359-keys compatible to add the Power and Home MT6359 PMIC keys support. Signed-off-by: Louis-Alexis Eyraud Link: https://lore.kernel.org/r/20250703-add-mt6359-pmic-keys-support-v1-3-21a4d2774e34@collabora.com Signed-off-by: AngeloGioacchino Del Regno commit cf0cdde64b3246aca28961ec169ba1c5e9295d8d Author: Louis-Alexis Eyraud Date: Thu Jul 3 17:41:04 2025 +0200 arm64: dts: mediatek: mt8390-genio-common: Add Home MT6359 PMIC key support Add in mt8390-genio-common dtsi file the support of Home MT6359 PMIC key. Signed-off-by: Louis-Alexis Eyraud Link: https://lore.kernel.org/r/20250703-add-mt6359-pmic-keys-support-v1-2-21a4d2774e34@collabora.com Signed-off-by: AngeloGioacchino Del Regno commit 5a40efb8c9d26e51db8acc61e920c3eda9407c02 Author: Frank Wunderlich Date: Sun Jul 6 15:22:08 2025 +0200 arm64: dts: mediatek: mt7988a-bpi-r4: add gpio leds Bananapi R4 has a green and a blue led which can be switched by gpio. Green led is for running state so default on. Green led also shares pin with eeprom writeprotect where led off allows writing to eeprom. Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250706132213.20412-14-linux@fw-web.de [Angelo: Fixed missing dt-bindings/leds/common.h header inclusion] Signed-off-by: AngeloGioacchino Del Regno commit db05490d417d75802955978f3b615e85e9293f5b Author: Bence Csókás Date: Thu Jul 3 11:09:24 2025 +0200 ARM: dts: imx6-karo: Replace license text comment with SPDX identifier Replace verbatim license text with a `SPDX-License-Identifier` The comment header mis-attributes this license to be "X11", but the license text does not include the last line "Except as contained in this notice, the name of the X Consortium shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from the X Consortium.". Therefore, this license is actually equivalent to the SPDX "MIT" license (confirmed by text diffing). Cc: Lothar Waßmann Acked-By: Lothar Waßmann Signed-off-by: Bence Csókás Signed-off-by: Shawn Guo commit d1b07cc0868fe14f4540cbc48c1a7c1a8055e284 Author: Dan Carpenter Date: Thu Jul 3 20:20:44 2025 -0500 arm64: dts: s32g: Add USB device tree information for s32g2/s32g3 This adds the USB support for the s32g2 and s32g3 SoCs. Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/e3e5041e-254d-44c3-b645-532d4d7a8f9e@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman commit 08c8767ada7137c9403e2e20eb5b8f7387214391 Author: Ghennadi Procopciuc Date: Thu Jul 3 20:20:39 2025 -0500 usb: chipidea: s32g: Add usb support for s32g3 Enable USB driver for the s32g3 USB device. Signed-off-by: Ghennadi Procopciuc Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/1733ae21-7257-4fdd-8249-7eaebbf769a2@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman commit a4a27565464e9a2eee99bd83e2071a3a6898a0a2 Author: Ghennadi Procopciuc Date: Thu Jul 3 20:20:33 2025 -0500 usb: chipidea: s32g: Add usb support for s32g2 Enable USB driver for s32g2. This chip has an errata ERR050474[1] so we need to set S32G_UCMALLBE to avoid some memory corruption. I have include the description below: ERR050474: USB : USB data may be corrupted if transaction size is non-multiple of 32bits Description When USB issues narrow length transfers i.e. AHB transaction size is less than 4bytes, data for that transaction will get corrupted. Narrow length transactions can occur if the transaction size is non-multiple of four bytes, error scenarios terminate the transactions early or if the address offset programmed in QTD is 4 Byte unaligned. This happens because the SoC NOC is not able to handle the byte strobes generated by USB controller and is dependent on its internally generates byte strobes. Workaround Narrow transfers work properly on bypassing USB controller’s byte generation logic. This can be done by setting UCMALLBE (bit 15, USB Core Master All Byte Enable) bit of UOTGNC_CR. Link: https://www.nxp.com/webapp/Download?colCode=S32G2_1P77B Signed-off-by: Ghennadi Procopciuc Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/abb2ed5d-f01a-48f6-b1ae-6f8f39ae40fa@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman commit e8dcc89dabec0e3ea8ab975a33eaf57f125f6ef1 Author: Ghennadi Procopciuc Date: Thu Jul 3 20:20:18 2025 -0500 dt-bindings: usb: Add compatible strings for s32g2/s32g3 Add the compatible strings for the NXP s32g2 and s32g3. These chips are mostly compatible. The one difference is that the s32g2-usbmisc device has an errata ERR050474 which requires a special flag to be set for handling packages that aren't 4 byte aligned. Signed-off-by: Ghennadi Procopciuc Signed-off-by: Dan Carpenter Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/596d188a-9a2d-41e5-af70-c99bc2b7ca7a@sabinyo.mountain Signed-off-by: Greg Kroah-Hartman commit 7168c06d9ba0932466272ac8bfbdd793a4fab636 Author: Sumanth Gavini Date: Thu Jul 3 19:34:22 2025 -0500 usb: gadget: f_uac2: replace scnprintf() with sysfs_emit() Documentation/filesystems/sysfs.rst mentions that show() should only use sysfs_emit() or sysfs_emit_at() when formating the value to be returned to user space. So replace scnprintf() with sysfs_emit(). Signed-off-by: Sumanth Gavini Link: https://lore.kernel.org/r/20250704003425.467299-1-sumanth.gavini@yahoo.com Signed-off-by: Greg Kroah-Hartman commit 6c99a046edfac782b5ec3a3a1a5f0633bed28563 Author: Maria Garcia Date: Thu Jul 3 22:57:40 2025 +0200 gpio: pca953x: Add support for TI TCA6418 The TI TCA6418 is a 18-channel I2C I/O expander. It is slightly different to other models from the same family, such as TCA6416, but has enough in common with them to make it work with just a few tweaks, which are explained in the code's documentation. Signed-off-by: Maria Garcia Link: https://lore.kernel.org/r/20250703205740.45385-3-mariagarcia7293@gmail.com Signed-off-by: Bartosz Golaszewski commit 453de04bf722bc939bfa2f1341eb6b3389605912 Author: Maria Garcia Date: Thu Jul 3 22:57:39 2025 +0200 dt-bindings: gpio: pca95xx: add TI TCA6418 The TCA6418E is a 18-channel I2C I/O expander with integrated ESD protection. Signed-off-by: Maria Garcia Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250703205740.45385-2-mariagarcia7293@gmail.com Signed-off-by: Bartosz Golaszewski commit b581e472d95d584d2e30e34f3e055d9754faddb2 Author: Ingo Rohloff Date: Tue Jul 1 13:36:02 2025 +0200 usb: gadget: f_fs: Remove unnecessary spinlocks. Commit 24729b307eefc ("usb: gadget: f_fs: Fix race between aio_cancel() and AIO request complete") moved the call to usb_ep_free_request() from ffs_epfile_async_io_complete() to ffs_user_copy_worker(). In ffs_user_copy_worker(), ki_complete() is called before usb_ep_free_request(). Once ki_complete() returns, ffs_aio_cancel() can no longer be invoked for the completed kiocb, as ki_complete() removes it from the &ctx->active_reqs list in aio.c. ffs_aio_cancel() only applies to kiocb instances still present on this list. The potential race between ki_complete() and ffs_aio_cancel() is already guarded by the &ctx->ctx_lock spinlock in aio.c. As a result, there is no race condition between the usb_ep_dequeue() call in ffs_aio_cancel() and the usb_ep_free_request() call in ffs_user_copy_worker(). Consequently, the spin lock/unlock operations on &io_data->ffs->eps_lock are no longer necessary. Signed-off-by: Ingo Rohloff Link: https://lore.kernel.org/r/20250701113602.33402-2-ingo.rohloff@lauterbach.com Signed-off-by: Greg Kroah-Hartman commit 6693750a6f8e5237233b96f6363a5afcbf498ad7 Author: Johannes Schneider Date: Sun Jun 29 11:04:14 2025 +0200 usb: dwc3: gadget: Simplify TRB reclaim logic by removing redundant 'chain' argument Now that the TRB reclaim logic always inspects the TRB's CHN (Chain) bit directly to determine whether a TRB is part of a chain, the explicit 'chain' parameter passed into dwc3_gadget_ep_reclaim_completed_trb() is no longer necessary. This cleanup simplifies the reclaim code by avoiding duplication of chain state tracking, and makes the reclaim logic rely entirely on the hardware descriptor flags — which are already present and accurate at this stage. No functional changes intended. Acked-by: Thinh Nguyen Signed-off-by: Johannes Schneider Link: https://lore.kernel.org/r/20250629090414.294308-2-johannes.schneider@leica-geosystems.com Signed-off-by: Greg Kroah-Hartman commit c5f0cd2bd6ae8376b01232766ffd8d30042dfaa9 Author: Sakari Ailus Date: Fri Jul 4 10:54:08 2025 +0300 gpio: arizona: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Reviewed-by: Charles Keepax Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250704075408.3217690-1-sakari.ailus@linux.intel.com Signed-off-by: Bartosz Golaszewski commit 2b7eec2ec3015f52fc74cf45d0408925e984ecd1 Author: Lucas De Marchi Date: Fri Jun 27 14:47:47 2025 -0700 usb: early: xhci-dbc: Fix early_ioremap leak Using the kernel param earlyprintk=xdbc,keep without proper hardware setup leads to this: [ ] xhci_dbc:early_xdbc_parse_parameter: dbgp_num: 0 ... [ ] xhci_dbc:early_xdbc_setup_hardware: failed to setup the connection to host ... [ ] calling kmemleak_late_init+0x0/0xa0 @ 1 [ ] kmemleak: Kernel memory leak detector initialized (mem pool available: 14919) [ ] kmemleak: Automatic memory scanning thread started [ ] initcall kmemleak_late_init+0x0/0xa0 returned 0 after 417 usecs [ ] calling check_early_ioremap_leak+0x0/0x70 @ 1 [ ] ------------[ cut here ]------------ [ ] Debug warning: early ioremap leak of 1 areas detected. please boot with early_ioremap_debug and report the dmesg. [ ] WARNING: CPU: 11 PID: 1 at mm/early_ioremap.c:90 check_early_ioremap_leak+0x4e/0x70 When early_xdbc_setup_hardware() fails, make sure to call early_iounmap() since xdbc_init() won't handle it. Signed-off-by: Lucas De Marchi Fixes: aeb9dd1de98c ("usb/early: Add driver for xhci debug capability") Link: https://lore.kernel.org/r/20250627-xdbc-v1-1-43cc8c317b1b@intel.com Signed-off-by: Greg Kroah-Hartman commit 0c43c19bf7a6cf2883b4a7ff08171be4af8ef814 Merge: 62783c30d78aec 2d1beba54fdaac Author: Greg Kroah-Hartman Date: Mon Jul 7 11:03:53 2025 +0200 Merge tag 'thunderbolt-for-v6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt into usb-next Mika writes: thunderbolt: Changes for v6.17 merge window This includes just a single trivial documentation fix. It has been in linux-next with no reported issues. * tag 'thunderbolt-for-v6.17-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/westeri/thunderbolt: thunderbolt: Fix typos in documentation comments commit 62783c30d78aecf9810dae46fd4d11420ad38b74 Author: Yuhao Jiang Date: Mon Jun 23 17:48:44 2025 +0800 USB: gadget: f_hid: Fix memory leak in hidg_bind error path In hidg_bind(), if alloc_workqueue() fails after usb_assign_descriptors() has successfully allocated the USB descriptors, the current error handling does not call usb_free_all_descriptors() to free the allocated descriptors, resulting in a memory leak. Restructure the error handling by adding proper cleanup labels: - fail_free_all: cleans up workqueue and descriptors - fail_free_descs: cleans up descriptors only - fail: original cleanup for earlier failures This ensures that allocated resources are properly freed in reverse order of their allocation, preventing the memory leak when alloc_workqueue() fails. Fixes: a139c98f760ef ("USB: gadget: f_hid: Add GET_REPORT via userspace IOCTL") Cc: stable@vger.kernel.org Signed-off-by: Yuhao Jiang Link: https://lore.kernel.org/r/20250623094844.244977-1-danisjiang@gmail.com Signed-off-by: Greg Kroah-Hartman commit bc51660cd5fd2d0ee9a65b59e0c65e2d1b65975a Author: Frank Wunderlich Date: Sun Jul 6 15:22:07 2025 +0200 arm64: dts: mediatek: mt7988a-bpi-r4: drop unused pins Pins were moved from SoC dtsi to Board level dtsi without cleaning up to needed ones. Drop the unused pins now. Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250706132213.20412-13-linux@fw-web.de Signed-off-by: AngeloGioacchino Del Regno commit b5a4ad957114b59a74b3e3f598ae0785dd86cd32 Author: Frank Wunderlich Date: Sun Jul 6 15:22:06 2025 +0200 arm64: dts: mediatek: mt7988a-bpi-r4: add proc-supply for cci CCI requires proc-supply. Add it on board level. Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250706132213.20412-12-linux@fw-web.de Signed-off-by: AngeloGioacchino Del Regno commit 0cbdb6d04689f8c05074e348c8e0a42b229ef9a3 Author: Frank Wunderlich Date: Sun Jul 6 15:22:03 2025 +0200 arm64: dts: mediatek: mt7988: add cci node Add cci devicetree node for cpu frequency scaling. Signed-off-by: Daniel Golle Signed-off-by: Frank Wunderlich Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250706132213.20412-9-linux@fw-web.de Signed-off-by: AngeloGioacchino Del Regno commit bd9e0f5d90959d2d07986084fbd58042b62aa549 Author: Frank Wunderlich Date: Sun Jul 6 15:22:02 2025 +0200 dt-bindings: interconnect: add mt7988-cci compatible Add compatible for Mediatek MT7988 SoC with mediatek,mt8183-cci fallback which is taken by driver. Signed-off-by: Frank Wunderlich Acked-by: Rob Herring (Arm) Reviewed-by: AngeloGioacchino Del Regno Acked-by: Georgi Djakov Link: https://lore.kernel.org/r/20250706132213.20412-8-linux@fw-web.de Signed-off-by: AngeloGioacchino Del Regno commit d172b9237e47ff918336d4f88b2eac9f91ebf800 Author: Lorenzo Bianconi Date: Tue May 20 15:41:35 2025 +0200 arm64: dts: airoha: en7581: Add ethernet nodes to EN7581 SoC evaluation board Introduce ethernet controller nodes to EN7581 SoC and EN7581 evaluation board. Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/20250520-en7581-net-v1-1-5317f8e829ad@kernel.org Signed-off-by: AngeloGioacchino Del Regno commit 1fcb7608a0eac3f86d4ac4a3241dfc5eb86a5393 Author: Laura Nao Date: Tue Mar 18 11:22:59 2025 +0100 arm64: dts: mediatek: mt8192-asurada-spherion: Mark trackpads as fail-needs-probe Different Spherion variants use different trackpads on the same I2C2 bus. Instead of enabling all of them by default, mark them as "fail-needs-probe" and let the implementation determine which one is actually present. Additionally, move the trackpad pinctrl entry back to the individual trackpad nodes. Signed-off-by: Laura Nao Reviewed-by: Chen-Yu Tsai Reviewed-by: Nícolas F. R. A. Prado Tested-by: Nícolas F. R. A. Prado Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250318102259.189289-3-laura.nao@collabora.com Signed-off-by: AngeloGioacchino Del Regno commit 85c767d2d36fa9d505266b2038931c5b745e6678 Author: Chen-Yu Tsai Date: Tue Jun 17 16:20:03 2025 +0800 arm64: dts: mediatek: mt8186: Add Squirtle Chromebooks Add a device tree for the MT8186 based Squirtle Chromebooks, also known as the Acer Chromebook Spin 311 (R724T). The device is a 2-in-1 convertible. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250617082004.1653492-7-wenst@chromium.org Signed-off-by: AngeloGioacchino Del Regno commit 57ac6f86ee9ab446e49d7c72eef10b2b44d58f9e Author: Chen-Yu Tsai Date: Tue Jun 17 16:20:02 2025 +0800 arm64: dts: mediatek: mt8186: Merge Voltorb device trees There are only two different SKUs of Voltorb, and the only difference between them is whether a touchscreen is present or not. This can be detected by a simple I2C transfer to the address, instead of having separate device trees. Merge the two device trees together and simplify the compatible string list. The dtsi is still kept separate since there is an incoming device that shares the same design, but with slightly difference components. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250617082004.1653492-6-wenst@chromium.org Signed-off-by: AngeloGioacchino Del Regno commit 8609434f64ce5892eb3e39c20f7181e5f495b91b Author: Chen-Yu Tsai Date: Tue Jun 17 16:20:01 2025 +0800 arm64: dts: mediatek: mt8186-steelix: Mark second source components for probing Steelix design has two possible trackpad component sources. Currently they are all marked as available, along with having workarounds for shared pinctrl muxing and GPIOs. Instead, mark them all as "fail-needs-probe" and have the implementation try to probe which one is present. Also remove the shared resource workaround by moving the pinctrl entry for the trackpad interrupt line back into the individual trackpad nodes. Cc: stable+noautosel@kernel.org # Needs accompanying new driver to work Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250617082004.1653492-5-wenst@chromium.org Signed-off-by: AngeloGioacchino Del Regno commit 8101382c24b9ecfe3f56225410f92913b4fa8730 Author: Chen-Yu Tsai Date: Tue Jun 17 16:20:00 2025 +0800 dt-bindings: arm: mediatek: Add MT8186 Squirtle Chromebooks Add an entry for the MT8186 based Squirtle Chromebooks, also known as the Acer Chromebook Spin 311 (R724T). The device is a 2-in-1 convertible. Acked-by: Rob Herring (Arm) Reviewed-by: Benson Leung Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250617082004.1653492-4-wenst@chromium.org Signed-off-by: AngeloGioacchino Del Regno commit 32239b8900a4c8481017e1e86e2ec81db155a784 Author: Chen-Yu Tsai Date: Tue Jun 17 16:19:59 2025 +0800 dt-bindings: arm: mediatek: Merge MT8186 Voltorb entries There are only two different SKUs of Voltorb, and the only difference between them is whether a touchscreen is present or not. This can be detected by a simple I2C transfer to the address, instead of having separate compatible strings and device trees. Drop the SKU-specific compatible strings and just keep the generic "google,voltorb" one. Acked-by: Rob Herring (Arm) Reviewed-by: Benson Leung Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250617082004.1653492-3-wenst@chromium.org Signed-off-by: AngeloGioacchino Del Regno commit ac725f9780b7b66ee4d7405e998282ddbd137399 Merge: e3ec7ad5ab139a cd4da713f99651 Author: Bartosz Golaszewski Date: Mon Jul 7 10:00:33 2025 +0200 Merge tag 'pm-runtime-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm into gpio/for-next Runtime PM updates related to autosuspend for 6.17 Make several autosuspend functions mark last busy stamp and update the documentation accordingly (Sakari Ailus). commit 3263a554f396422b07ab42831c2f106f9596b9f4 Author: Thorsten Blum Date: Sun Jul 6 18:09:03 2025 +0200 ALSA: mts64: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250706160906.416270-1-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit c1dc61aede55a571d34fe20415b1413a3c86ee24 Author: Manivannan Sadhasivam Date: Tue Jul 1 17:38:56 2025 +0530 PCI: dwc: Make dw_pcie_ptm_ops static dw_pcie_ptm_ops is not used outside of this file, so make it static. This also fixes the sparse warning: drivers/pci/controller/dwc/pcie-designware-debugfs.c:868:27: warning: symbol 'dw_pcie_ptm_ops' was not declared. Should it be static? Fixes: 852a1fdd34a8 ("PCI: dwc: Add debugfs support for PTM context") Reported-by: Bjorn Helgaas Closes: https://lore.kernel.org/linux-pci/20250617231210.GA1172093@bhelgaas Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250701120856.15839-1-mani@kernel.org commit e3ec7ad5ab139ad9e0ed8931ba562f95698c3b2f Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:13 2025 +0200 gpio: tps6586x: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-12-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit fc0e4091afa9b6c02f1cc2ddec75b248c25cefe6 Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:12 2025 +0200 gpio: tps65219: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-11-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit 4ca81a1f3a46603986cbdd11348433b0746ce483 Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:11 2025 +0200 gpio: tps65218: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-10-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit 913cbf8a0d4b0554d66cdc608b231cdf2401a496 Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:10 2025 +0200 gpio: tps65218: remove unneeded callbacks GPIO core can handle output-only chips that don't implement the get() and direction_input() callbacks. There's no need to provide dummy implementation of the latter in the driver so drop it. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-9-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit 2a5be7a80b3b1036fba5dae13dd55c97fb7eabaa Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:09 2025 +0200 gpio: tps65086: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-8-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit 4ffdd9d8a37eaf4e25855e1038b9e1091401c252 Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:08 2025 +0200 gpio: tpic2810: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-7-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit 00c337cc68c34302fc0af2d9ac47be5c638d4a78 Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:07 2025 +0200 gpio: tpic2810: remove unneeded callbacks GPIO core can handle output-only chips that don't implement the get() and direction_input() callbacks. There's no need to provide dummy implementation of the latter in the driver so drop it. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-6-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit dd66f8862f8418d989a8e342ff7af26bf4a0ae8f Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:06 2025 +0200 gpio: timberdale: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-5-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit ecf0c0278f4799f6af245131f02dbb8587f87d29 Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:05 2025 +0200 gpio: thunderx: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-4-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit 8a81d128e1377a7662d0913bc5013eb8a90c3e33 Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:04 2025 +0200 gpio: tegra: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-3-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit 871e1aee00298fccbda04eacd9e3bb5f46f446b9 Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:03 2025 +0200 gpio: tegra186: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-2-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit 47c228d9fc9fe7e3b6f0e7f88f40779f0bb96469 Author: Bartosz Golaszewski Date: Wed Jul 2 11:14:02 2025 +0200 gpio: tegra186: don't call the set() callback directly Drivers should not dereference GPIO chip callbacks directly. Move the module's set() function higher to make it available to the direction_output() callback and call it instead. Link: https://lore.kernel.org/r/20250702-gpiochip-set-rv-gpio-round3-v1-1-0d23be74f71d@linaro.org Signed-off-by: Bartosz Golaszewski commit 34c029c20300b9b3072f40875b899ef9c40e69cc Author: Bartosz Golaszewski Date: Wed Jul 2 11:22:15 2025 +0200 gpio: en7523: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-8-6b77aab684d8@linaro.org Signed-off-by: Bartosz Golaszewski commit bd9a0dec2d49836e7d186642600e0f668fab33ed Author: Bartosz Golaszewski Date: Wed Jul 2 11:22:14 2025 +0200 gpio: 74xx-mmio: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-7-6b77aab684d8@linaro.org Signed-off-by: Bartosz Golaszewski commit 47ecff3839cac71c6b7f89b7860f6f76a4c07b65 Author: Bartosz Golaszewski Date: Wed Jul 2 11:22:13 2025 +0200 gpio: cadence: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-6-6b77aab684d8@linaro.org Signed-off-by: Bartosz Golaszewski commit 76045e90400b7ecc60a33526a505124b0cce1d7a Author: Bartosz Golaszewski Date: Wed Jul 2 11:22:12 2025 +0200 gpio: cadence: use lock guards Simplify the code by using lock guards for the bgpio_lock. While at it: move the gpio/driver.h include into its correct place alphabetically. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-5-6b77aab684d8@linaro.org Signed-off-by: Bartosz Golaszewski commit fd0f0d1a1e71d736deed3593470b3b03f8e76df7 Author: Bartosz Golaszewski Date: Wed Jul 2 11:22:11 2025 +0200 gpio: clps711x: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-4-6b77aab684d8@linaro.org Signed-off-by: Bartosz Golaszewski commit 1f129b15c2dea84ce12ee3120c7fffdb7bfc7395 Author: Bartosz Golaszewski Date: Wed Jul 2 11:22:10 2025 +0200 gpio: mxc: use new generic GPIO chip API Convert the driver to using the new generic GPIO chip interfaces from linux/gpio/generic.h. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-3-6b77aab684d8@linaro.org Signed-off-by: Bartosz Golaszewski commit ba441322c7aac4735d78fc6781e497a01fb8eac7 Author: Bartosz Golaszewski Date: Wed Jul 2 11:22:09 2025 +0200 gpio: mxc: use lock guards for the generic GPIO chip lock Simplify the code by using lock guards for the bgpio_lock. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-2-6b77aab684d8@linaro.org Signed-off-by: Bartosz Golaszewski commit 8595375e4fded27de24b189c692c2c50051a7b3b Author: Bartosz Golaszewski Date: Wed Jul 2 11:22:08 2025 +0200 gpio: generic: add new generic GPIO chip API As the first step in removing the fields specific to the gpio-mmio module from struct gpio_chip, we introduce a new set of generic GPIO chip interfaces that are meant to replace the existing bgpio_ ones. The new initialization function - gpio_generic_chip_init() - takes a configuration structure as argument instead of 9 separate parameters. This will allow easy extension if needed in the future. We hide the locking details behind a set of helpers in order to be able to move the raw spinlock out of struct gpio_chip without the users noticing. For now, the new APIs just wrap the existing ones. Once all users have been converted to the new interfaces, we'll pull them into gpio-mmio and implement them in a backward-compatible way while also moving all fields specific to the generic GPIO chip into struct gpio_generic_chip. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250702-gpio-mmio-rework-v2-1-6b77aab684d8@linaro.org Signed-off-by: Bartosz Golaszewski commit 179a666951d315bd6b47e3016df772956f71231b Merge: 527db0a8811697 9bad4bec5daddb Author: Bartosz Golaszewski Date: Mon Jul 7 09:42:37 2025 +0200 Merge tag 'gpio-mmio-remove-bgpio-pdata-for-v6.17-rc1' into gpio/for-next Immutable branch between GPIO, MFD and ARM-SoC for v6.17-rc1 Remove struct bgpio_pdata after converting its users to generic device properties. commit 9bad4bec5daddbb296481af759f9d56c849ba96f Author: Bartosz Golaszewski Date: Tue Jul 1 13:49:40 2025 +0200 gpio: mmio: remove struct bgpio_pdata With no more users, we can now remove struct bgpio_pdata. Move the relevant bits from bgpio_parse_fw() into bgpio_pdev_probe() while maintaining the logical ordering (get flags before calling bgpio_init()). Link: https://lore.kernel.org/r/20250701-gpio-mmio-pdata-v2-6-ebf34d273497@linaro.org Signed-off-by: Bartosz Golaszewski commit bb9c88d5b0fabe05b0ed4b843efe78ac1c4712f0 Author: Bartosz Golaszewski Date: Tue Jul 1 13:49:39 2025 +0200 ARM: s3c: crag6410: use generic device properties for gpio-mmio The GPIO device in crag6410 is registered with struct bgpio_pdata passed as platform_data to the gpio-mmio driver. We want to remove the bgpio_pdata from the kernel and the gpio-mmio driver is now also able to get the relevant values from the software node. Set up device properties and switch to using platform_device_info to register the device as platform_add_devices() doesn't allow us to pass device properties to the driver model. Acked-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Reviewed-by: Charles Keepax Link: https://lore.kernel.org/r/20250701-gpio-mmio-pdata-v2-5-ebf34d273497@linaro.org Signed-off-by: Bartosz Golaszewski commit 094017efe332d411a8d6ac41fd8d0a4f81f72a99 Author: Bartosz Golaszewski Date: Tue Jul 1 13:49:38 2025 +0200 ARM: omap1: ams-delta: use generic device properties for gpio-mmio The two latch GPIO devices in ams-delta are registered with struct bgpio_pdata passed as platform_data to the gpio-mmio driver. We want to remove the bgpio_pdata from the kernel and the gpio-mmio driver is now also able to get the relevant values from the software node. Set up device properties and switch to using platform_device_info to register the devices as platform_add_devices() doesn't allow us to pass device properties to the driver model. Reviewed-by: Linus Walleij Acked-by: Janusz Krzysztofik Link: https://lore.kernel.org/r/20250701-gpio-mmio-pdata-v2-4-ebf34d273497@linaro.org Signed-off-by: Bartosz Golaszewski commit 11cd2e582bf4da87b5fc0f9b07e194daaf212651 Author: Bartosz Golaszewski Date: Tue Jul 1 13:49:37 2025 +0200 mfd: vexpress-sysreg: set-up software nodes for gpio-mmio Replace struct bgpio_pdata - that we plan to remove - with software nodes containing properties encoding the same values thatr can now be parsed by gpio-mmio. Acked-by: Lee Jones Reviewed-by: Liviu Dudau Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250701-gpio-mmio-pdata-v2-3-ebf34d273497@linaro.org Signed-off-by: Bartosz Golaszewski commit c4a834840596c8b9e388d430154959390f9f96e4 Author: Bartosz Golaszewski Date: Tue Jul 1 13:49:36 2025 +0200 gpio: mmio: get chip label and GPIO base from device properties Ahead of removing struct bgpio_pdata support from the gpio-mmio generic module, let's add support for getting the relevant values from generic device properties. "label" is a semi-standardized property in some GPIO drivers so let's go with it. There's no standard "base" property, so let's use the name "gpio-mmio,base" to tie it to this driver specifically. The number of GPIOs will be retrieved using gpiochip_get_ngpios() so there's no need to look it up in the software node. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250701-gpio-mmio-pdata-v2-2-ebf34d273497@linaro.org Signed-off-by: Bartosz Golaszewski commit e567269e246809223fafaee7d421ae17a832fae5 Author: Bartosz Golaszewski Date: Tue Jul 1 13:49:35 2025 +0200 gpio: mmio: drop the big-endian platform device variant There are no more users of the "basic-mmio-gpio-be" platform device ID in the kernel. We can safely drop it. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250701-gpio-mmio-pdata-v2-1-ebf34d273497@linaro.org Signed-off-by: Bartosz Golaszewski commit 527db0a8811697968df30797eae2e1d5f8b6964c Author: Bartosz Golaszewski Date: Mon Jun 23 09:57:16 2025 +0200 gpio: reg: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the legacy generic gpio-reg module to using them. We have to update the two legacy ARM platforms that use it at the same time as they call the set_multiple() callbacks directly (they shouldn't but it's old technical debt I suppose). Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250623-gpiochip-set-rv-gpio-v3-1-90f0e170a846@linaro.org Signed-off-by: Bartosz Golaszewski commit edd3bcb1801e1bb98f4f81485140e18c86406ced Author: Michal Wilczynski Date: Wed Jul 2 15:45:29 2025 +0200 pwm: Expose PWM_WFHWSIZE in public header The WFHWSIZE constant defines the maximum size for the hardware-specific waveform representation buffer. It is currently local to drivers/pwm/core.c, which makes it inaccessible to external tools like bindgen. Move the constant to include/linux/pwm.h to make it part of the public API. As part of this change, rename it to PWM_WFHWSIZE to follow standard kernel conventions for namespacing macros in public headers. This allows bindgen to automatically generate a corresponding constant for the Rust PWM abstractions, ensuring the value remains synchronized between the C core and Rust code and preventing future maintenance issues. Signed-off-by: Michal Wilczynski Link: https://lore.kernel.org/r/20250702-rust-next-pwm-working-fan-for-sending-v7-1-67ef39ff1d29@samsung.com Signed-off-by: Uwe Kleine-König commit 4cd2f417a0acdced4335fa19dc75b3a80941d60d Author: Frank Li Date: Wed Jun 25 12:19:08 2025 -0400 dt-bindings: pwm: Convert lpc32xx-pwm.txt to yaml format Convert pc32xx-pwm.txt to yaml format. Additional changes: - add ref to pwm.yaml - add clocks - restrict #pwm-cells to 3 Signed-off-by: Frank Li Reviewed-by: Vladimir Zapolskiy Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250625161909.2541315-1-Frank.Li@nxp.com Signed-off-by: Uwe Kleine-König commit 10e9b32d9a14edbbed902dd5447a1ca3cd487935 Author: Uwe Kleine-König Date: Tue Jun 24 12:05:00 2025 +0200 docs: pwm: Adapt Locking paragraph to reality We have the distinction between pwm_apply_atomic() and pwm_apply_might_sleep() since commit c748a6d77c06 (pwm: Rename pwm_apply_state() to pwm_apply_might_sleep()) contained in v6.8-rc1. Locking in the core was introduced in commit 1cc2e1faafb3 ("pwm: Add more locking", contained in v6.13-rc1) to serialize per-chip callbacks and device removal. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250624100500.1429163-2-u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 2c06a2178926993f77e52f77e6b0c540e3d771ce Author: Uwe Kleine-König Date: Tue Jun 24 20:15:44 2025 +0200 pwm: twl-led: Drop driver local locking The pwm core already serializes .apply(). twl6030's .request() and .free() are also already serialized against .apply() because there is only a single PWM. So the mutex doesn't add any additional protection and can be dropped. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/c1c7f646190f7cb2fe43b10959aa8dade80cb79e.1750788649.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit dce0df8ac14fd2b4d00c17bc893fe3f3b06c853c Author: Uwe Kleine-König Date: Tue Jun 24 20:15:43 2025 +0200 pwm: sun4i: Drop driver local locking The pwm core serializes calls to .apply(), so the driver lock doesn't add any protection and can safely be dropped. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/87b71c46b82b787959f0cea314d3010f16a50a29.1750788649.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit d2c8bdc72fa906d78cac4f87ad9d75692fe47a9f Author: Uwe Kleine-König Date: Tue Jun 24 20:15:42 2025 +0200 pwm: sti: Drop driver local locking The pwm core already serializes calls to .apply(), so the driver local mutex adds no protection and can be dropped. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/7ad150e40b45d6cb16fee633dcd6390a49a327a1.1750788649.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 9470e7d11fe2b6c21a35327175d51a06afd3fca9 Author: Uwe Kleine-König Date: Tue Jun 24 20:15:41 2025 +0200 pwm: microchip-core: Drop driver local locking The pwm core already serializes .apply() and .get_state(), so the driver local lock is always free and adds no protection. Drop it. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/6d6ef0376ea0058b040eec3b257e324493a083f1.1750788649.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 33d73bde06e9ab7862e8e8482ad1a9c4fa1a57f2 Author: Uwe Kleine-König Date: Tue Jun 24 20:15:40 2025 +0200 pwm: lpc18xx-sct: Drop driver local locking Both mutexes are only used in one function each. These functions are only called by the .apply() callback. As the .apply() calls are serialized by the core since commit 1cc2e1faafb3 ("pwm: Add more locking") the mutexes have no effect apart from runtime overhead. Drop them. Signed-off-by: Uwe Kleine-König Reviewed-by: Vladimir Zapolskiy Link: https://lore.kernel.org/r/4f7a2da37adbfe4743564245119045826d86eca6.1750788649.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 7c1a529a240b1c84204b9f45cc05f0db0fb17402 Author: Uwe Kleine-König Date: Tue Jun 24 20:15:39 2025 +0200 pwm: fsl-ftm: Drop driver local locking The pwm core serializes calls to .apply(), so the driver local lock isn't needed for that. It only has the effect to serialize .apply() with .request() and .free() for a different PWM, and .request() and .free against each other. But given that .request and .free() only do a single regmap operation under the lock and regmap itself serializes register accesses, it might happen without the lock that the calls are interleaved now, but affecting different PWMs, so nothing bad can happen. So the mutex has no effect and can be dropped. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/6b72104e5e1823170c7c9664189cc0f2ca5c2347.1750788649.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit f0d91b16dcb3d3daa013572caf76720fffcd7bab Author: Uwe Kleine-König Date: Tue Jun 24 20:15:38 2025 +0200 pwm: clps711x: Drop driver local locking The pwm core serializes calls to .apply(), so the spinlock adds no additional protection. Disabling the irq is also irrelevant as the driver isn't an atomic one and so the callbacks cannot be called from atomic context. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/d4931dc0c0d657d80722cfe7d97cb4fb4ccec90e.1750788649.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 62df49917eb4aa378c21cb2f6a7093749870da96 Author: Uwe Kleine-König Date: Tue Jun 24 20:15:37 2025 +0200 pwm: atmel: Drop driver local locking The two functions making use of the lock are only called transitively from .apply(). Calls to .apply() are already serialized by the pwm core so the lock in the driver has no effect and can safely be dropped. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/5ad3417aecd4dc6eca9699e21691e3725ea0bb87.1750788649.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 0191c80e8a288d38f3f5a17dd0bb6a3b08c6e464 Author: Marek Vasut Date: Mon Jun 30 00:07:20 2025 +0200 pwm: argon-fan-hat: Add Argon40 Fan HAT support Add trivial PWM driver for Argon40 Fan HAT, which is a RaspberryPi blower fan hat which can be controlled over I2C. Model this device as a PWM, so the pwm-fan can be attached to it and handle thermal zones and RPM management in a generic manner. Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20250629220757.936212-3-marek.vasut+renesas@mailbox.org Signed-off-by: Uwe Kleine-König commit f6bd99a2d24ecccb560771dde13eff2d0808d897 Author: Marek Vasut Date: Mon Jun 30 00:07:19 2025 +0200 dt-bindings: pwm: argon40,fan-hat: Document Argon40 Fan HAT Document trivial PWM on Argon40 Fan HAT, which is a RaspberryPi blower fan hat which can be controlled over I2C. Reviewed-by: Rob Herring (Arm) Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20250629220757.936212-2-marek.vasut+renesas@mailbox.org Signed-off-by: Uwe Kleine-König commit 6fdd4d8c84f36c4814ec7d499e9fb88b170669c5 Author: Marek Vasut Date: Mon Jun 30 00:07:18 2025 +0200 dt-bindings: vendor-prefixes: Document Argon40 Argon 40 Technologies Limited is a SBC expansion board vendor. Document the prefix. For details see https://argon40.com . Acked-by: Conor Dooley Signed-off-by: Marek Vasut Link: https://lore.kernel.org/r/20250629220757.936212-1-marek.vasut+renesas@mailbox.org Signed-off-by: Uwe Kleine-König commit e47026facf73a8431a4cdb90f11918c84af98597 Author: AngeloGioacchino Del Regno Date: Mon Jun 23 14:01:18 2025 +0200 pwm: pwm-mediatek: Add support for PWM IP V3.0.2 in MT6991/MT8196 Add support for the PWM IP version 3.0.2, found in MediaTek's Dimensity 9400 MT6991 and in the MT8196 Chromebook SoC: this needs a new register offset array and also a different offset for the PWM_CK_26M_SEL register. Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250623120118.109170-4-angelogioacchino.delregno@collabora.com Signed-off-by: Uwe Kleine-König commit d4f1e7a2fe029ec7ca2c32ec10b58a84b56d719d Author: AngeloGioacchino Del Regno Date: Mon Jun 23 14:01:17 2025 +0200 pwm: pwm-mediatek: Pass PWM_CK_26M_SEL from platform data In preparation for adding support for new SoCs, remove variable has_ck_26m_sel from pwm_mediatek_of_data and replace it with a u16 pwm_ck_26m_sel_reg, meant to hold the register offset for PWM_CK_26M_SEL. Also, since the reg offset is guaranteed to never be zero, the logic to check for "has_ck_26m_sel" is changed to check if the register offset in pwm_ck_26m_sel_reg is more than zero. Analogously, when writing, use the register offset from platform data instead of using the PWM_CK_26M_SEL definition. Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250623120118.109170-3-angelogioacchino.delregno@collabora.com Signed-off-by: Uwe Kleine-König commit 3bb9948921784b6c9cc2f5ed8df7bdf8ab4ffaf3 Author: AngeloGioacchino Del Regno Date: Mon Jun 23 14:01:16 2025 +0200 dt-bindings: pwm: mediatek,mt2712-pwm: Add support for MT6991/MT8196 Add compatible strings for the MediaTek Dimensity 9400 MT6991 and for the MT8196 Chromebook SoC, having the same PWM IP v3.0.2. Signed-off-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250623120118.109170-2-angelogioacchino.delregno@collabora.com Signed-off-by: Uwe Kleine-König commit 56ad79b848d4a1e9ae270687f6f41835911eba87 Author: Frank Li Date: Mon Jun 16 15:04:34 2025 -0400 dt-bindings: pwm: convert lpc1850-sct-pwm.txt to yaml format Convert lpc1850-sct-pwm.txt to yaml format. Additional changes: - add ref pwm.yaml. - add resets property to match existed dts. Reviewed-by: Rob Herring (Arm) Reviewed-by: Vladimir Zapolskiy Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250616190435.1998078-1-Frank.Li@nxp.com Signed-off-by: Uwe Kleine-König commit 0b4d1abe5ca568c5b7f667345ec2b5ad0fb2e54b Author: Nicolas Frattaroli Date: Mon Jun 16 17:14:17 2025 +0200 pwm: rockchip: Round period/duty down on apply, up on get With CONFIG_PWM_DEBUG=y, the rockchip PWM driver produces warnings like this: rockchip-pwm fd8b0010.pwm: .apply is supposed to round down duty_cycle (requested: 23529/50000, applied: 23542/50000) This is because the driver chooses ROUND_CLOSEST for purported idempotency reasons. However, it's possible to keep idempotency while always rounding down in .apply(). Do this by making .get_state() always round up, and making .apply() always round down. This is done with u64 maths, and setting both period and duty to U32_MAX (the biggest the hardware can support) if they would exceed their 32 bits confines. Fixes: 12f9ce4a5198 ("pwm: rockchip: Fix period and duty cycle approximation") Fixes: 1ebb74cf3537 ("pwm: rockchip: Add support for hardware readout") Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250616-rockchip-pwm-rounding-fix-v2-1-a9c65acad7b6@collabora.com Signed-off-by: Uwe Kleine-König commit fd0b06972a8f92d57358e62267f5925721c73c6e Author: Fabrice Gasnier Date: Fri Jan 10 10:19:18 2025 +0100 pwm: stm32: add support for stm32mp25 Add support for STM32MP25 SoC. Use newly introduced compatible to handle new features along with registers and bits diversity. The MFD part of the driver fills in ipidr, so it is used to check the hardware configuration register, when available to gather the number of PWM channels and complementary outputs. Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20250110091922.980627-5-fabrice.gasnier@foss.st.com Signed-off-by: Uwe Kleine-König commit 076a2f3d54a95330709a39c95bde7f19660673da Author: David Lechner Date: Thu May 29 11:53:18 2025 -0500 dt-bindings: pwm: adi,axi-pwmgen: Update documentation link Change the documentation link to point to the location with the most up-to-date information. Signed-off-by: David Lechner Link: https://lore.kernel.org/r/20250529-pwm-axi-pwmgen-add-external-clock-v3-1-5d8809a7da91@baylibre.com Signed-off-by: Uwe Kleine-König commit 21d5daad93547c36732b6568dfb8ad88004b2d68 Author: Longbin Li Date: Wed May 28 18:11:38 2025 +0800 pwm: sophgo-sg2042: Add support for SG2044 Add PWM controller for SG2044 on base of SG2042. Reviewed-by: Chen Wang Tested-by: Chen Wang Signed-off-by: Longbin Li Link: https://lore.kernel.org/r/20250528101139.28702-4-looong.bin@gmail.com Signed-off-by: Uwe Kleine-König commit 8c805dfafd9b9d82a4bdb2e804d85f3be0435aeb Author: Longbin Li Date: Wed May 28 18:11:37 2025 +0800 pwm: sophgo-sg2042: Reorganize the code structure As the driver logic can be used in both SG2042 and SG2044, it will be better to reorganize the code structure. Reviewed-by: Chen Wang Tested-by: Chen Wang Signed-off-by: Longbin Li Link: https://lore.kernel.org/r/20250528101139.28702-3-looong.bin@gmail.com Signed-off-by: Uwe Kleine-König commit 2b66b67530b828ce939c050d7d3366a80ef22d7a Author: Longbin Li Date: Wed May 28 18:11:36 2025 +0800 dt-bindings: pwm: sophgo: Add pwm controller for SG2044 Add compatible string for PWM controller on SG2044. Tested-by: Chen Wang Reviewed-by: Chen Wang Acked-by: Krzysztof Kozlowski Acked-by: Rob Herring (Arm) Signed-off-by: Longbin Li Link: https://lore.kernel.org/r/20250528101139.28702-2-looong.bin@gmail.com Signed-off-by: Uwe Kleine-König commit 6df3aac763fa995260ab0545c1e54f0c21b2feb8 Author: Nylon Chen Date: Thu May 29 11:53:41 2025 +0800 pwm: sifive: Fix rounding and idempotency issues in apply and get_state This fix ensures consistent rounding and avoids mismatches between applied and reported PWM values that could trigger false idempotency failures in debug checks This change ensures: - real_period is now calculated using DIV_ROUND_UP_ULL() to avoid underestimation. - duty_cycle is rounded up to match the fractional computation in apply() - apply() truncates the result to compensate for get_state's rounding up logic These fixes resolve issues like: .apply is supposed to round down duty_cycle (requested: 360/504000, applied: 361/504124) .apply is not idempotent (ena=1 pol=0 1739692/4032985) -> (ena=1 pol=0 1739630/4032985) Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505080303.dBfU5YMS-lkp@intel.com/ Co-developed-by: Zong Li Signed-off-by: Zong Li Signed-off-by: Nylon Chen Link: https://lore.kernel.org/r/20250529035341.51736-4-nylon.chen@sifive.com Signed-off-by: Uwe Kleine-König commit 7dbc4432ea6bf9d709391eb57f1e9fb44e99845a Author: Nylon Chen Date: Thu May 29 11:53:40 2025 +0800 pwm: sifive: Fix PWM algorithm and clarify inverted compare behavior The `frac` variable represents the pulse inactive time, and the result of this algorithm is the pulse active time. Therefore, we must reverse the result. Although the SiFive Reference Manual states "pwms >= pwmcmpX -> HIGH", the hardware behavior is inverted due to a fixed XNOR with 0. As a result, the pwmcmp register actually defines the low (inactive) portion of the pulse. The reference is SiFive FU740-C000 Manual[0] Link: https://sifive.cdn.prismic.io/sifive/1a82e600-1f93-4f41-b2d8-86ed8b16acba_fu740-c000-manual-v1p6.pdf [0] Co-developed-by: Zong Li Signed-off-by: Zong Li Co-developed-by: Vincent Chen Signed-off-by: Vincent Chen Signed-off-by: Nylon Chen Link: https://lore.kernel.org/r/20250529035341.51736-3-nylon.chen@sifive.com Signed-off-by: Uwe Kleine-König commit f4bcf818e5d6474c981ef16153827458a2b57181 Author: Nylon Chen Date: Thu May 29 11:53:39 2025 +0800 riscv: dts: sifive: unleashed/unmatched: Remove PWM controlled LED's active-low properties This removes the active-low properties of the PWM-controlled LEDs in the HiFive Unmatched device tree. The reference is hifive-unleashed-a00.pdf[0] and hifive-unmatched-schematics-v3.pdf[1]. Link: https://sifive.cdn.prismic.io/sifive/c52a8e32-05ce-4aaf-95c8-7bf8453f8698_hifive-unleashed-a00-schematics-1.pdf [0] Link: https://sifive.cdn.prismic.io/sifive/6a06d6c0-6e66-49b5-8e9e-e68ce76f4192_hifive-unmatched-schematics-v3.pdf [1] Acked-by: Conor Dooley Reviewed-by: Conor Dooley Signed-off-by: Vincent Chen Signed-off-by: Nylon Chen Link: https://lore.kernel.org/r/20250529035341.51736-2-nylon.chen@sifive.com Signed-off-by: Uwe Kleine-König commit 27b5dfe4b4eaf490df6fa9d5d0bf95cd51abf563 Author: Guodong Xu Date: Tue Apr 29 16:50:47 2025 +0800 pwm: pxa: Allow to enable for SpacemiT K1 SoC The SpacemiT K1 SoC uses devices similar to the ones on PXA SoCs. Add ARCH_SPACEMIT as one of the possible architectures this driver can be enabled for. Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20250429085048.1310409-6-guodong@riscstar.com [ukleinek: reword commit log] Signed-off-by: Uwe Kleine-König commit 52d2d14d9e49b8c33ff718d2036084d0c92f23f1 Author: Guodong Xu Date: Tue Apr 29 16:50:44 2025 +0800 pwm: pxa: Add optional reset control Support optional reset control for the PWM PXA driver. During probe, it acquires the reset controller using devm_reset_control_get_optional_exclusive_deasserted() to get and deassert the reset controller to enable the PWM channel. Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20250429085048.1310409-3-guodong@riscstar.com [ukleinek: Fix conflict with commit df08fff8add2 ("pwm: pxa: Improve using dev_err_probe()")] Signed-off-by: Uwe Kleine-König commit 08e0b981231fd467204764f162087d6d9d1359af Author: Guodong Xu Date: Tue Apr 29 16:50:43 2025 +0800 dt-bindings: pwm: marvell,pxa-pwm: Add SpacemiT K1 PWM support The SpacemiT K1 SoC reuses the Marvell PXA910-compatible PWM controller with one notable difference: the addition of a resets property. To make the device tree pass schema validation (make dtbs_check W=3), this patch updates the binding to accept spacemit,k1-pwm as a compatible string, when used in conjunction with the fallback marvell,pxa910-pwm. Support for the optional resets property is also added, as it is required by the K1 integration but was not present in the original Marvell bindings. Since the PWM reset line may be deasserted during the early bootloader stage, making the resets property optional avoids potential double-deassertion, which could otherwise cause flickering on displays that use PWM for backlight control. Additionally, this patch adjusts the required value of the #pwm-cells property for the new compatible string: - For "spacemit,k1-pwm", #pwm-cells must be set to 3. - For existing Marvell compatibles, #pwm-cells remains 1. Background of #pwm-cells change is by an ongoing community discussion about increasing the #pwm-cells value from 1 to 3 for all Marvell PXA PWM devices. These devices are currently the only ones whose bindings do not pass the line index as the first argument. See [1] for further details. [1] https://lore.kernel.org/all/cover.1738842938.git.u.kleine-koenig@baylibre.com/ Reviewed-by: Rob Herring (Arm) # v2 Signed-off-by: Guodong Xu Link: https://lore.kernel.org/r/20250429085048.1310409-2-guodong@riscstar.com Signed-off-by: Uwe Kleine-König commit 9c06f26ba5f5da14bcac405c7a652dcf578a785d Author: Uwe Kleine-König Date: Wed Apr 30 13:56:01 2025 +0200 pwm: Add support for pwmchip devices for faster and easier userspace access With this change each pwmchip defining the new-style waveform callbacks can be accessed from userspace via a character device. Compared to the sysfs-API this is faster and allows to pass the whole configuration in a single ioctl allowing atomic application and thus reducing glitches. On an STM32MP13 I see: root@DistroKit:~ time pwmtestperf real 0m 1.27s user 0m 0.02s sys 0m 1.21s root@DistroKit:~ rm /dev/pwmchip0 root@DistroKit:~ time pwmtestperf real 0m 3.61s user 0m 0.27s sys 0m 3.26s pwmtestperf does essentially: for i in 0 .. 50000: pwm_set_waveform(duty_length_ns=i, period_length_ns=50000, duty_offset_ns=0) and in the presence of /dev/pwmchip0 is uses the ioctls introduced here, without that device it uses /sys/class/pwm/pwmchip0. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/ad4a4e49ae3f8ea81e23cac1ac12b338c3bf5c5b.1746010245.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König commit 7788278ff267f831bab39a377beaa7e08d79c2a9 Author: Kalesh AP Date: Fri Jul 4 10:08:57 2025 +0530 RDMA/bnxt_re: Use macro instead of hard coded value 1. Defined a macro for the hard coded value. 2. "access" field in the request structure is of type "u8". Updated the mask accordingly. Signed-off-by: Kalesh AP Signed-off-by: Shravya KN Link: https://patch.msgid.link/20250704043857.19158-4-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Hongguang Gao Signed-off-by: Leon Romanovsky commit 0aed817380d620987b2d5c573fdd2f01c30976a4 Author: Selvin Xavier Date: Fri Jul 4 10:08:56 2025 +0530 RDMA/bnxt_re: Support 2G message size bnxt_qplib_put_sges is calculating the length in a signed int. So handling the 2G message size is not working since it is considered as negative. Use a unsigned number to calculate the total message length. As per the spec, IB message size shall be between zero and 2^31 bytes (inclusive). So adding a check for 2G message size. Signed-off-by: Selvin Xavier Signed-off-by: Shravya KN Link: https://patch.msgid.link/20250704043857.19158-3-kalesh-anakkur.purayil@broadcom.com Reviewed-by: Saravanan Vajravel Reviewed-by: Kalesh AP Signed-off-by: Leon Romanovsky commit 09d231ab569ca97478445ccc1ad44ab026de39b1 Author: Kalesh AP Date: Fri Jul 4 10:08:55 2025 +0530 RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM Since both "length" and "offset" are of type u32, there is no functional issue here. Reviewed-by: Saravanan Vajravel Signed-off-by: Shravya KN Signed-off-by: Kalesh AP Link: https://patch.msgid.link/20250704043857.19158-2-kalesh-anakkur.purayil@broadcom.com Signed-off-by: Leon Romanovsky commit 79d56805c5068f2bc81518043e043c3dedd1c82a Author: Junxian Huang Date: Thu Jul 3 19:39:05 2025 +0800 RDMA/hns: Fix -Wframe-larger-than issue Fix -Wframe-larger-than issue by allocating memory for qpc struct with kzalloc() instead of using stack memory. Fixes: 606bf89e98ef ("RDMA/hns: Refactor for hns_roce_v2_modify_qp function") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506240032.CSgIyFct-lkp@intel.com/ Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20250703113905.3597124-7-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 5338abb299f0cd764edf78a7e71a0b746af35030 Author: Junxian Huang Date: Thu Jul 3 19:39:04 2025 +0800 RDMA/hns: Drop GFP_NOWARN GFP_NOWARN silences all warnings on dma_alloc_coherent() failure, which might otherwise help with troubleshooting. Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20250703113905.3597124-6-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 278c18a4a78a9a6bf529ef45ccde512a5686ea9d Author: Junxian Huang Date: Thu Jul 3 19:39:03 2025 +0800 RDMA/hns: Fix accessing uninitialized resources hr_dev->pgdir_list and hr_dev->pgdir_mutex won't be initialized if CQ/QP record db are not enabled, but they are also needed when using SRQ with SRQ record db enabled. Simplified the logic by always initailizing the reosurces. Fixes: c9813b0b9992 ("RDMA/hns: Support SRQ record doorbell") Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20250703113905.3597124-5-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 2c2ec0106c0f1f12d4eefd11de318ac47557a750 Author: Junxian Huang Date: Thu Jul 3 19:39:02 2025 +0800 RDMA/hns: Get message length of ack_req from FW ACK_REQ_FREQ indicates the number of packets (after MTU fragmentation) HW sends before setting an ACK request. When MTU is greater than or equal to 1024, the current ACK_REQ_FREQ value causes HW to request an ACK for every MTU fragment. The processing of a large number of ACKs severely impacts HW performance when sending large size payloads. Get message length of ack_req from FW so that we can adjust this parameter according to different situations. There are several constraints for ACK_REQ_FREQ: 1. mtu * (2 ^ ACK_REQ_FREQ) should not be too large, otherwise it may cause some unexpected retries when sending large payload. 2. ACK_REQ_FREQ should be larger than or equal to LP_PKTN_INI. 3. ACK_REQ_FREQ must be equal to LP_PKTN_INI when using LDCP or HC3 congestion control algorithm. Fixes: 56518a603fd2 ("RDMA/hns: Modify the value of long message loopback slice") Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20250703113905.3597124-4-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 005b6187705bc9723518ce19c5cb911fc1f7ef07 Author: Artem Sadovnikov Date: Sun Jun 29 23:12:12 2025 +0000 refscale: Check that nreaders and loops multiplication doesn't overflow The nreaders and loops variables are exposed as module parameters, which, in certain combinations, can lead to multiplication overflow. Besides, loops parameter is defined as long, while through the code is used as int, which can cause truncation on 64-bit kernels and possible zeroes where they shouldn't appear. Since code uses result of multiplication as int anyway, it only makes sense to replace loops with int. Multiplication overflow check is also added due to possible multiplication between two very big numbers. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 653ed64b01dc ("refperf: Add a test to measure performance of read-side synchronization") Signed-off-by: Artem Sadovnikov Signed-off-by: Neeraj Upadhyay (AMD) commit a33ad03aaed2c39d29a27a64ee55ff919810de59 Author: Frederic Weisbecker Date: Tue Mar 18 10:23:36 2025 +0100 rcu/nocb: Dump gp state even if rdp gp itself is not offloaded When a stall is detected, the state of each NOCB CPU is dumped along with the state of each NOCB group. The latter part however is incidentally ignored if the NOCB group leader happens not to be offloaded itself. Fix this to make sure related precious informations aren't lost over a stall report. Reported-by: "Paul E. McKenney" Signed-off-by: Frederic Weisbecker Reviewed-by: "Paul E. McKenney" Signed-off-by: Neeraj Upadhyay (AMD) commit 181698af38d3f93381229ad89c09b5bd0496661a Author: Mengbiao Xiong Date: Tue Jun 24 14:54:18 2025 +0800 crypto: ccp - Fix crash when rebind ccp device for ccp.ko When CONFIG_CRYPTO_DEV_CCP_DEBUGFS is enabled, rebinding the ccp device causes the following crash: $ echo '0000:0a:00.2' > /sys/bus/pci/drivers/ccp/unbind $ echo '0000:0a:00.2' > /sys/bus/pci/drivers/ccp/bind [ 204.976930] BUG: kernel NULL pointer dereference, address: 0000000000000098 [ 204.978026] #PF: supervisor write access in kernel mode [ 204.979126] #PF: error_code(0x0002) - not-present page [ 204.980226] PGD 0 P4D 0 [ 204.981317] Oops: Oops: 0002 [#1] SMP NOPTI ... [ 204.997852] Call Trace: [ 204.999074] [ 205.000297] start_creating+0x9f/0x1c0 [ 205.001533] debugfs_create_dir+0x1f/0x170 [ 205.002769] ? srso_return_thunk+0x5/0x5f [ 205.004000] ccp5_debugfs_setup+0x87/0x170 [ccp] [ 205.005241] ccp5_init+0x8b2/0x960 [ccp] [ 205.006469] ccp_dev_init+0xd4/0x150 [ccp] [ 205.007709] sp_init+0x5f/0x80 [ccp] [ 205.008942] sp_pci_probe+0x283/0x2e0 [ccp] [ 205.010165] ? srso_return_thunk+0x5/0x5f [ 205.011376] local_pci_probe+0x4f/0xb0 [ 205.012584] pci_device_probe+0xdb/0x230 [ 205.013810] really_probe+0xed/0x380 [ 205.015024] __driver_probe_device+0x7e/0x160 [ 205.016240] device_driver_attach+0x2f/0x60 [ 205.017457] bind_store+0x7c/0xb0 [ 205.018663] drv_attr_store+0x28/0x40 [ 205.019868] sysfs_kf_write+0x5f/0x70 [ 205.021065] kernfs_fop_write_iter+0x145/0x1d0 [ 205.022267] vfs_write+0x308/0x440 [ 205.023453] ksys_write+0x6d/0xe0 [ 205.024616] __x64_sys_write+0x1e/0x30 [ 205.025778] x64_sys_call+0x16ba/0x2150 [ 205.026942] do_syscall_64+0x56/0x1e0 [ 205.028108] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 205.029276] RIP: 0033:0x7fbc36f10104 [ 205.030420] Code: 89 02 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 8d 05 e1 08 2e 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 f3 c3 66 90 41 54 55 49 89 d4 53 48 89 f5 This patch sets ccp_debugfs_dir to NULL after destroying it in ccp5_debugfs_destroy, allowing the directory dentry to be recreated when rebinding the ccp device. Tested on AMD Ryzen 7 1700X. Fixes: 3cdbe346ed3f ("crypto: ccp - Add debugfs entries for CCP information") Signed-off-by: Mengbiao Xiong Reviewed-by: Tom Lendacky Signed-off-by: Herbert Xu commit 735b72568c73875269a6b73ab9543a70f6ac8a9f Author: Markus Theil Date: Sat Jun 21 13:36:43 2025 +0200 crypto: jitter - fix intermediary handling The intermediary value was included in the wrong hash state. While there, adapt to user-space by setting the timestamp to 0 if stuck and inserting the values nevertheless. Acked-by: Stephan Mueller Signed-off-by: Markus Theil Signed-off-by: Herbert Xu commit cb7fa6b6fc71e0c801e271aa498e2f19e6df2931 Author: Thomas Fourier Date: Fri Jun 20 09:29:26 2025 +0200 crypto: inside-secure - Fix `dma_unmap_sg()` nents value The `dma_unmap_sg()` functions should be called with the same nents as the `dma_map_sg()`, not the value the map function returned. Fixes: c957f8b3e2e5 ("crypto: inside-secure - avoid unmapping DMA memory that was not mapped") Signed-off-by: Thomas Fourier Reviewed-by: Antoine Tenart Signed-off-by: Herbert Xu commit b4abeccb8d39db7d9b51cb0098d6458760b30a75 Author: Alexey Kardashevskiy Date: Tue Jun 17 19:43:54 2025 +1000 crypto: ccp - Fix locking on alloc failure handling The __snp_alloc_firmware_pages() helper allocates pages in the firmware state (alloc + rmpupdate). In case of failed rmpupdate, it tries reclaiming pages with already changed state. This requires calling the PSP firmware and since there is sev_cmd_mutex to guard such calls, the helper takes a "locked" parameter so specify if the lock needs to be held. Most calls happen from snp_alloc_firmware_page() which executes without the lock. However commit 24512afa4336 ("crypto: ccp: Handle the legacy TMR allocation when SNP is enabled") switched sev_fw_alloc() from alloc_pages() (which does not call the PSP) to __snp_alloc_firmware_pages() (which does) but did not account for the fact that sev_fw_alloc() is called from __sev_platform_init_locked() (via __sev_platform_init_handle_tmr()) and executes with the lock held. Add a "locked" parameter to __snp_alloc_firmware_pages(). Make sev_fw_alloc() use the new parameter to prevent potential deadlock in rmp_mark_pages_firmware() if rmpupdate() failed. Fixes: 24512afa4336 ("crypto: ccp: Handle the legacy TMR allocation when SNP is enabled") Signed-off-by: Alexey Kardashevskiy Reviewed-by: Tom Lendacky Reviewed-by: Pratik R. Sampat Signed-off-by: Herbert Xu commit fcb96956c921f1aae7e7b477f2435c56f77a31b4 Author: Yangtao Li Date: Thu May 29 00:18:06 2025 -0600 hfsplus: remove mutex_lock check in hfsplus_free_extents Syzbot reported an issue in hfsplus filesystem: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4400 at fs/hfsplus/extents.c:346 hfsplus_free_extents+0x700/0xad0 Call Trace: hfsplus_file_truncate+0x768/0xbb0 fs/hfsplus/extents.c:606 hfsplus_write_begin+0xc2/0xd0 fs/hfsplus/inode.c:56 cont_expand_zero fs/buffer.c:2383 [inline] cont_write_begin+0x2cf/0x860 fs/buffer.c:2446 hfsplus_write_begin+0x86/0xd0 fs/hfsplus/inode.c:52 generic_cont_expand_simple+0x151/0x250 fs/buffer.c:2347 hfsplus_setattr+0x168/0x280 fs/hfsplus/inode.c:263 notify_change+0xe38/0x10f0 fs/attr.c:420 do_truncate+0x1fb/0x2e0 fs/open.c:65 do_sys_ftruncate+0x2eb/0x380 fs/open.c:193 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd To avoid deadlock, Commit 31651c607151 ("hfsplus: avoid deadlock on file truncation") unlock extree before hfsplus_free_extents(), and add check wheather extree is locked in hfsplus_free_extents(). However, when operations such as hfsplus_file_release, hfsplus_setattr, hfsplus_unlink, and hfsplus_get_block are executed concurrently in different files, it is very likely to trigger the WARN_ON, which will lead syzbot and xfstest to consider it as an abnormality. The comment above this warning also describes one of the easy triggering situations, which can easily trigger and cause xfstest&syzbot to report errors. [task A] [task B] ->hfsplus_file_release ->hfsplus_file_truncate ->hfs_find_init ->mutex_lock ->mutex_unlock ->hfsplus_write_begin ->hfsplus_get_block ->hfsplus_file_extend ->hfsplus_ext_read_extent ->hfs_find_init ->mutex_lock ->hfsplus_free_extents WARN_ON(mutex_is_locked) !!! Several threads could try to lock the shared extents tree. And warning can be triggered in one thread when another thread has locked the tree. This is the wrong behavior of the code and we need to remove the warning. Fixes: 31651c607151f ("hfsplus: avoid deadlock on file truncation") Reported-by: syzbot+8c0bc9f818702ff75b76@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/00000000000057fa4605ef101c4c@google.com/ Signed-off-by: Yangtao Li Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250529061807.2213498-1-frank.li@vivo.com Signed-off-by: Viacheslav Dubeyko commit 4c831f30475a222046ded25560c3810117a6cff6 Author: Yangtao Li Date: Thu May 29 08:00:32 2025 -0600 hfs: make splice write available again Since 5.10, splice() or sendfile() return EINVAL. This was caused by commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops"). This patch initializes the splice_write field in file_operations, like most file systems do, to restore the functionality. Fixes: 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops") Signed-off-by: Yangtao Li Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250529140033.2296791-2-frank.li@vivo.com Signed-off-by: Viacheslav Dubeyko commit 2eafb669da0bf71fac0838bff13594970674e2b4 Author: Yangtao Li Date: Thu May 29 08:00:31 2025 -0600 hfsplus: make splice write available again Since 5.10, splice() or sendfile() return EINVAL. This was caused by commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops"). This patch initializes the splice_write field in file_operations, like most file systems do, to restore the functionality. Fixes: 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops") Signed-off-by: Yangtao Li Reviewed-by: Viacheslav Dubeyko Signed-off-by: Viacheslav Dubeyko Link: https://lore.kernel.org/r/20250529140033.2296791-1-frank.li@vivo.com Signed-off-by: Viacheslav Dubeyko commit d3ed6d6981f4756f145766753c872482bc3b28d3 Author: Viacheslav Dubeyko Date: Tue Apr 29 17:12:11 2025 -0700 hfs: fix not erasing deleted b-tree node issue The generic/001 test of xfstests suite fails and corrupts the HFS volume: sudo ./check generic/001 FSTYP -- hfs PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc2+ #3 SMP PREEMPT_DYNAMIC Fri Apr 25 17:13:00 PDT 2> MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/001 32s ... _check_generic_filesystem: filesystem on /dev/loop50 is inconsistent (see /home/slavad/XFSTESTS-2/xfstests-dev/results//generic/001.full for details) Ran: generic/001 Failures: generic/001 Failed 1 of 1 tests fsck.hfs -d -n ./test-image.bin ** ./test-image.bin (NO WRITE) Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. Executing fsck_hfs (version 540.1-Linux). ** Checking HFS volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. Unused node is not erased (node = 2) Unused node is not erased (node = 4) Unused node is not erased (node = 253) Unused node is not erased (node = 254) Unused node is not erased (node = 255) Unused node is not erased (node = 256) ** Checking catalog hierarchy. ** Checking volume bitmap. ** Checking volume information. Verify Status: VIStat = 0x0000, ABTStat = 0x0000 EBTStat = 0x0000 CBTStat = 0x0004 CatStat = 0x00000000 ** The volume untitled was found corrupt and needs to be repaired. volume type is HFS primary MDB is at block 2 0x02 alternate MDB is at block 20971518 0x13ffffe primary VHB is at block 0 0x00 alternate VHB is at block 0 0x00 sector size = 512 0x200 VolumeObject flags = 0x19 total sectors for volume = 20971520 0x1400000 total sectors for embedded volume = 0 0x00 This patch adds logic of clearing the deleted b-tree node. sudo ./check generic/001 FSTYP -- hfs PLATFORM -- Linux/x86_64 hfsplus-testing-0001 6.15.0-rc2+ #3 SMP PREEMPT_DYNAMIC Fri Apr 25 17:13:00 PDT 2025 MKFS_OPTIONS -- /dev/loop51 MOUNT_OPTIONS -- /dev/loop51 /mnt/scratch generic/001 9s ... 32s Ran: generic/001 Passed all 1 tests fsck.hfs -d -n ./test-image.bin ** ./test-image.bin (NO WRITE) Using cacheBlockSize=32K cacheTotalBlock=1024 cacheSize=32768K. Executing fsck_hfs (version 540.1-Linux). ** Checking HFS volume. The volume name is untitled ** Checking extents overflow file. ** Checking catalog file. ** Checking catalog hierarchy. ** Checking volume bitmap. ** Checking volume information. ** The volume untitled appears to be OK. Signed-off-by: Viacheslav Dubeyko Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20250430001211.1912533-1-slava@dubeyko.com Signed-off-by: Viacheslav Dubeyko commit f9335bb4f5d4f3b913efd5872c2794d027dd85a6 Author: Sakari Ailus Date: Fri Jul 4 10:54:42 2025 +0300 power: supply: twl4030_charger: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250704075442.3221330-1-sakari.ailus@linux.intel.com Signed-off-by: Sebastian Reichel commit 2453753f395e68af947d9ac6ce37bf0eb40f7123 Author: Sakari Ailus Date: Fri Jul 4 10:54:42 2025 +0300 power: supply: bq24190: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://lore.kernel.org/r/20250704075442.3221283-1-sakari.ailus@linux.intel.com Signed-off-by: Sebastian Reichel commit 61b8c39deb4b6d314f942a4a33565575c9b0c3d5 Merge: d375b70a0f47a0 cd4da713f99651 Author: Sebastian Reichel Date: Mon Jul 7 00:53:35 2025 +0200 Merge tag 'pm-runtime-6.17-rc1' Runtime PM updates related to autosuspend for 6.17 Make several autosuspend functions mark last busy stamp and update the documentation accordingly (Sakari Ailus). Signed-off-by: Sebastian Reichel commit 1bc8890264804a6ec393a0a0c1b72ec509f95236 Merge: cf73d9970ea4f8 6f11adcc6f36ff Author: Jens Axboe Date: Sun Jul 6 16:42:23 2025 -0600 Merge branch 'io_uring-6.16' into for-6.17/io_uring Merge in 6.16 io_uring fixes, to avoid clashes with pending net and settings changes. * io_uring-6.16: io_uring: gate REQ_F_ISREG on !S_ANON_INODE as well io_uring/kbuf: flag partial buffer mappings io_uring/net: mark iov as dynamically allocated even for single segments io_uring: fix resource leak in io_import_dmabuf() io_uring: don't assume uaddr alignment in io_vec_fill_bvec io_uring/rsrc: don't rely on user vaddr alignment io_uring/rsrc: fix folio unpinning io_uring: make fallocate be hashed work commit de713ccb99345be302adf507274d1b190dd2302e Author: Chen-Yu Tsai Date: Sun Jun 29 00:16:08 2025 +0800 arm64: dts: allwinner: t527: Add OrangePi 4A board The OrangePi 4A is a typical Raspberry Pi model B sized development board from Xunlong designed around an Allwinner T527 SoC. The board has the following features: - Allwinner T527 SoC - AXP717B + AXP323 PMICs - Up to 4GB LPDDR4 DRAM - micro SD slot - optional eMMC module - M.2 slot for PCIe 2.0 x1 - 16 MB SPI-NOR flash - 4x USB 2.0 type-A ports (one can be used in gadget mode) - 1x Gigabit ethernet w/ Motorcomm PHY (through yet to be supported GMAC200) - 3.5mm audio jack via internal audio codec - HDMI 2.0 output - eDP, MIPI CSI (2-lane and 4-lane) and MIPI DSI (4-lane) connectors - USB type-C port purely for power - AP6256 (Broadcom BCM4345) WiFi 5.0 + BT 5.0 - unsoldered headers for ADC and an additional USB 2.0 host port - 40-pin GPIO header Add a device tree for it, enabling all peripherals currently supported. Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250628161608.3072968-6-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 64f2f7bc4acb7928b39cac4a9a932e77b966f31c Author: Chen-Yu Tsai Date: Sun Jun 29 00:16:07 2025 +0800 arm64: dts: allwinner: a523: Add UART1 pins UART1 is normally used to connect to the Bluetooth side of a Broadcom WiFi+BT combo chip. The connection uses 4 pins. Add pinmux nodes for UART1, one for the RX/TX pins, and one for the RTS/CTS pins. Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250628161608.3072968-5-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 84c4a16e00f5aadbb1a3bdecc6bbfee35b7c45c8 Author: Chen-Yu Tsai Date: Sun Jun 29 00:16:06 2025 +0800 arm64: dts: allwinner: a523: Move rgmii0 pins to correct location Nodes are supposed to be sorted by address, or if no addresses apply, by node name. The rgmii0 pins are out of order, possibly due to multiple patches adding pin mux settings conflicting. Move the rgmii0 pins to the correct location. Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250628161608.3072968-4-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 6e2662c07a90e9f782158b7d6eda2766f65e9c36 Author: Chen-Yu Tsai Date: Sun Jun 29 00:16:05 2025 +0800 arm64: dts: allwinner: a523: Move mmc nodes to correct position When the mmc nodes were added to the dtsi file, they were inserted in the incorrect position. Move them to the correct place. Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250628161608.3072968-3-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit bbe7cf4bab161a50ce631c9dd7724df333cdf12d Author: Chen-Yu Tsai Date: Sun Jun 29 00:16:04 2025 +0800 dt-bindings: arm: sunxi: Add Xunlong OrangePi 4A board The OrangePi 4A is a typical Raspberry Pi model B sized development board from Xunlong designed around an Allwinner T527 SoC. Add its compatible name to the list of valid ones. Reviewed-by: Andre Przywara Acked-by: Conor Dooley Link: https://patch.msgid.link/20250628161608.3072968-2-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 744cc616b8d80ae57b6fdb3d23dd2fa27bd25d2f Author: Qiu Yutan Date: Mon Jun 30 18:56:30 2025 +0800 Docs/zh_CN: Translate alias.rst to Simplified Chinese translate the "alias.rst" into Simplified Chinese Update to commit 735dadf894f0("docs: networking: Convert alias.txt to rst") Alex Shi: Modify networking/index.rst for merge issue. Signed-off-by: Qiu Yutan Signed-off-by: Jiang Kun Reviewed-by: Yanteng Si Reviewed-by: xu xin Signed-off-by: Alex Shi commit 6b818ef57d0140ad96d300dbb0e0c3e372add9ac Author: Wang Yaxin Date: Sat Jul 5 11:08:47 2025 +0800 Docs/zh_CN: Translate netmem.rst to Simplified Chinese translate the "netmem.rst" into Simplified Chinese. Update the translation through commit 383faec0fd64 ("net: enable driver support for netmem TX") Signed-off-by: Wang Yaxin Signed-off-by: Jiang Kun Reviewed-by: xu xin Reviewed-by: Yanteng Si Signed-off-by: Alex Shi commit 3278971a26a69e83d90c128a59edd5b3880f2236 Author: Wang Yaxin Date: Sat Jul 5 11:06:49 2025 +0800 Docs/zh_CN: Translate xfrm_proc.rst to Simplified Chinese translate the "xfrm_proc.rst" into Simplified Chinese. Update the translation through commit 304b44f0d5a4 ("xfrm: Add dir validation to "in" data path lookup") Signed-off-by: Wang Yaxin Signed-off-by: Jiang Kun Reviewed-by: Yanteng Si Signed-off-by: Alex Shi commit 53301ceb7395a27f0ab12b5c540927015108f082 Author: Wang Yaxin Date: Sat Jul 5 11:04:24 2025 +0800 Docs/zh_CN: Translate netif-msg.rst to Simplified Chinese translate the "netif-msg.rst" into Simplified Chinese. Update the translation through commit c4d5dff60f0a ("docs: networking: convert netif-msg.txt to ReST") Signed-off-by: Wang Yaxin Signed-off-by: Jiang Kun Reviewed-by: Yanteng Si Signed-off-by: Alex Shi commit 31df8330ee3f161e589896aeca0cbf5a5edcd5db Author: Dongliang Mu Date: Wed Jun 18 20:53:10 2025 +0800 docs/zh_CN: update git command examples in how-to.rst This patch leverages `checkout -b` to shorten branch & checkout and fix the missing checkout. Signed-off-by: Dongliang Mu Acked-by: Yanteng Si Signed-off-by: Alex Shi commit e33f256dbc293a1a3a31f18d56f659e7a27a491a Author: Dan Carpenter Date: Wed Jul 2 07:55:10 2025 -0500 drm/dp: Clean up white space in drm_edp_backlight_probe_state() This code needs to be indented one more tab. Signed-off-by: Dan Carpenter Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/30b896c2-ae71-4cf2-9511-2713da7e1632@sabinyo.mountain Signed-off-by: Dmitry Baryshkov commit cce91f29c088ba902dd2abfc9c3216ba9a2fb2fe Author: Thierry Reding Date: Fri Jun 13 14:28:38 2025 +0200 drm/fbdev-client: Skip DRM clients if modesetting is absent Recent generations of Tegra have moved the display components outside of host1x, leading to a device that has no CRTCs attached and hence doesn't support any of the modesetting functionality. When this is detected, the driver clears the DRIVER_MODESET and DRIVER_ATOMIC flags for the device. Unfortunately, this causes the following errors during boot: [ 15.418958] ERR KERN drm drm: [drm] *ERROR* Failed to register client: -95 [ 15.425311] WARNING KERN drm drm: [drm] Failed to set up DRM client; error -95 These originate from the fbdev client checking for the presence of the DRIVER_MODESET flag and returning -EOPNOTSUPP. However, if a driver does not support DRIVER_MODESET this is entirely expected and the error isn't helpful. Prevent this misleading error message by setting up the DRM clients only if modesetting is enabled. Changes in v2: - use DRIVER_MODESET check to avoid registering any clients Reported-by: Jonathan Hunter Signed-off-by: Thierry Reding Acked-by: Jon Hunter Tested-by: Jon Hunter Reviewed-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250613122838.2082334-1-thierry.reding@gmail.com Signed-off-by: Dmitry Baryshkov commit c8995932db2bad6fa093ac64dbaf7a3e8870eafa Author: Finn Thain Date: Tue Jun 24 14:32:48 2025 +1000 m68k: mac: Improve clocksource driver commentary qemu-system-m68k -M q800 has an old bug that causes the kernel to occasionally complain about a soft lockup: watchdog: BUG: soft lockup - CPU#0 stuck for 5107s! There isn't any actual lockup. The via1 clocksource produced a large jump in jiffies, causing the watchdog to detect a stale timestamp. The 32-bit clocksource counter runs at 783360 Hz and its period is about 5482 seconds. Applying the "nanosecond" approximation used in get_timestamp() in kernel/watchdog.c then yields the duration reported in the log message above (always 5107 or 5108 in my tests): 0xffffffff / VIA_CLOCK_FREQ * 10**9 / 2**30 = 5106.209 seconds It is notoriously difficult to correctly emulate a MOS6522 VIA chip. So it seems wise to document the VIA clocksource driver better, especially those hardware behaviours which the kernel relies upon. Cc: Joshua Thompson Signed-off-by: Finn Thain Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/f7b4c02a1c8ed74ccceb5535d7e1e202deada8ce.1750739568.git.fthain@linux-m68k.org Signed-off-by: Geert Uytterhoeven commit c4958c118cd9beb81bddeab6dbb17694b76deee2 Author: Geert Uytterhoeven Date: Mon Jun 16 21:37:07 2025 +0200 m68k: defconfig: Update defconfigs for v6.16-rc2 - Enable modular build of the SCTP network protocol (no longer auto-enabled since now commit 6f8b4788266c7df3 ("dlm: drop SCTP Kconfig dependency")), - Enable modular build of OpenVPN data channel offload, - Enable modular build of Btrfs and XFS filesystem support, and Universal TUN/TAP device driver support (no longer auto-enabled since commit 92f3c5a0051d2b56 ("lib/test_kmod: do not hardcode/depend on any filesystem")), - Enable modular build of Null crypto algorithms (no longer auto-enabled since commit 0c08c72980ea8218 ("crypto: krb5enc - do not select CRYPTO_NULL")), - Drop CONFIG_CRYPTO_CHACHA20POLY1305=m (selected by OVPN), - Enable modular build of the simple prime number generator for testing (no longer auto-enabled since commit 3f2925174f8bd811 ("lib/prime_numbers: KUnit test should not select PRIME_NUMBERS")), - Enable the benchmark in the (modular) KUnit tests for CRC functions. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/365889e04f7289fdcb393911c18639486a0d3e73.1750102111.git.geert@linux-m68k.org commit 7164aacfcea221e66c41ae02712a549a59892cff Author: Thomas Huth Date: Wed Jun 11 13:40:56 2025 +0200 m68k: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This is almost a completely mechanical patch (done with a simple "sed -i" statement), with one comment tweaked manually in arch/m68k/include/asm/mac_baboon.h (which was missing underscores). Signed-off-by: Thomas Huth Acked-by: Greg Ungerer Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611114056.118309-3-thuth@redhat.com Signed-off-by: Geert Uytterhoeven commit 16eea8d2d3c1d325b3b5f25c1e073874082aac74 Author: Thomas Huth Date: Wed Jun 11 13:40:55 2025 +0200 m68k: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembly code. This is a completely mechanical patch (done with a simple "sed -i" statement). Signed-off-by: Thomas Huth Acked-by: Greg Ungerer Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611114056.118309-2-thuth@redhat.com Signed-off-by: Geert Uytterhoeven commit 4fbdd56edf1f0b3e338c90a011bbae1a677ac884 Author: Daniel Palmer Date: Wed Apr 16 20:42:40 2025 +0900 m68k: Enable dead code elimination Allow the experimental dead code elimination config to be enabled. For my 68000 nommu config this frees up a few hundred K of memory so seems worth while. Boot and build tested on nommu and mmu enabled configs. Before: Memory: 5388K/8192K available (1986K kernel code, 114K rwdata, 244K rodata, 92K init, 41K bss, 2624K reserved, 0K cma-reserved) After Memory: 5684K/8192K available (1714K kernel code, 112K rwdata, 228K rodata, 92K init, 37K bss, 2328K reserved, 0K cma-reserved) Signed-off-by: Daniel Palmer Acked-by: Greg Ungerer Tested-by: Finn Thain Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250416114240.2929832-1-daniel@0x0f.com Signed-off-by: Geert Uytterhoeven commit 83f672a7f69ec38b1bbb27221e342937f68c11c7 Author: Finn Thain Date: Tue Apr 1 11:26:44 2025 +1100 m68k: Don't unregister boot console needlessly When MACH_IS_MVME147, the boot console calls mvme147_scc_write() to generate console output. That will continue to work even after debug_cons_nputs() becomes unavailable so there's no need to unregister the boot console. Take the opportunity to remove a repeated MACH_IS_* test. Use the actual .write method (instead of a wrapper) and test that pointer instead. This means adding an unused parameter to debug_cons_nputs() for consistency with the struct console API. early_printk.c is only built when CONFIG_EARLY_PRINTK=y. As of late, head.S is only built when CONFIG_MMU_MOTOROLA=y. So let the former symbol depend on the latter, to obviate some ifdef conditionals. Cc: Daniel Palmer Fixes: 077b33b9e283 ("m68k: mvme147: Reinstate early console") Signed-off-by: Finn Thain Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/d1d4328e5aa9a87bd8352529ce62b767731c0530.1743467205.git.fthain@linux-m68k.org Signed-off-by: Geert Uytterhoeven commit e911044c28ed200c3dcf59bf532e092e770488d0 Author: Finn Thain Date: Fri Mar 28 09:39:55 2025 +1100 m68k: Remove unused "cursor home" code from debug console The cursor home operation is unused and seems undesirable for logging. Remove it. The console_not_cr label actually means "not line feed and not carriage return either" so take the opportunity to replace it with something less confusing. Rectify some inconsistent whitespace while we're here. Signed-off-by: Finn Thain Tested-by: Stan Johnson Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/ec2d443d3c3213028bbbab7c2e0382cd53db75fe.1743115195.git.fthain@linux-m68k.org Signed-off-by: Geert Uytterhoeven commit 0da6458417d74449e5daf845cdd4eb4d6ec6ec87 Author: Finn Thain Date: Fri Mar 28 09:39:55 2025 +1100 m68k: Avoid pointless recursion in debug console rendering The recursive call to console_putc to effect a carriage return is needlessly slow and complicated. Instead, just clear the column counter directly. Setup %a0 earlier to avoid a repeated comparison. Signed-off-by: Finn Thain Tested-by: Stan Johnson Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/a6104f41918bed4fd17f92c45df94ac7a5d30e40.1743115195.git.fthain@linux-m68k.org Signed-off-by: Geert Uytterhoeven commit 210a1ce8ed4391b64a888b3fb4b5611a13f5ccc7 Author: Finn Thain Date: Fri Mar 28 09:39:55 2025 +1100 m68k: Fix lost column on framebuffer debug console Move the cursor position rightward after rendering the character, not before. This avoids complications that arise when the recursive console_putc call has to wrap the line and/or scroll the display. This also fixes the linewrap bug that crops off the rightmost column. When the cursor is at the bottom of the display, a linefeed will not move the cursor position further downward. Instead, the display scrolls upward. Avoid the repeated add/subtract sequence by way of a single subtraction at the initialization of console_struct_num_rows. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Finn Thain Tested-by: Stan Johnson Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/9d4e8c68a456d5f2bc254ac6f87a472d066ebd5e.1743115195.git.fthain@linux-m68k.org Signed-off-by: Geert Uytterhoeven commit 946a7281982530d333eaee62bd1726f25908b3a9 Author: Rik van Riel Date: Wed Jul 2 13:52:54 2025 -0400 smp: Wait only if work was enqueued Whenever work is enqueued for a remote CPU, smp_call_function_many_cond() may need to wait for that work to be completed. However, if no work is enqueued for a remote CPU, because the condition func() evaluated to false for all CPUs, there is no need to wait. Set run_remote only if work was enqueued on remote CPUs. Document the difference between "work enqueued", and "CPU needs to be woken up" Suggested-by: Jann Horn Signed-off-by: Rik van Riel Signed-off-by: Thomas Gleixner Reviewed-by: Yury Norov (NVIDIA) Link: https://lore.kernel.org/all/20250703203019.11331ac3@fangorn commit bae712b66cbc315915567665849e4cdf347dbd0a Author: David Lechner Date: Sat Jun 28 12:31:43 2025 -0500 iio: imu: bmi160: make bmi160_regs const Add const qualifier to struct bmi160_regs bmi160_regs[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-18-v1-1-dad85ac392ae@baylibre.com Signed-off-by: Jonathan Cameron commit ca494204c646b4661efe374fa1ab27171dffc89a Author: David Lechner Date: Sat Jun 28 12:15:24 2025 -0500 iio: dac: ltc2688: make ltc2688_dither_ext_info const Add const qualifier to struct iio_chan_spec_ext_info ltc2688_dither_ext_info[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-16-v1-1-9b6514588b05@baylibre.com Signed-off-by: Jonathan Cameron commit f7f9a33734c0f201652422f150bf427f7223bd78 Author: David Lechner Date: Sat Jun 28 12:11:46 2025 -0500 iio: dac: ad5770r: make ad5770r_rng_tbl const Add const qualifier to struct ad5770r_output_modes ad5770r_rng_tbl[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-15-v1-1-b86ae055004c@baylibre.com Signed-off-by: Jonathan Cameron commit f391719dd1b8438bd7b8525575bd6130d4ba1395 Author: David Lechner Date: Sat Jun 28 12:09:26 2025 -0500 iio: common: hid-sensor-attributes: make unit_conversion const Add const qualifier to struct unit_conversion[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-14-v1-1-4faa8015e122@baylibre.com Signed-off-by: Jonathan Cameron commit 1e9e9669ff3dbc8029c71e189e8ca5d6cede9edf Author: David Lechner Date: Sat Jun 28 12:06:35 2025 -0500 iio: chemical: atlas-ezo-sensor: make atlas_ezo_devices const Add const qualifier to struct atlas_ezo_device atlas_ezo_devices[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-13-v1-1-2a7fd592a07c@baylibre.com Signed-off-by: Jonathan Cameron commit 9d531de209fd3d355dab8201fe2c47cfc465ecf0 Author: David Lechner Date: Sat Jun 28 12:01:29 2025 -0500 iio: amplifiers: ad8366: make ad8366_info const Add const qualifier to struct ad8366_info ad8366_infos[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-12-v1-1-88029e48a26b@baylibre.com Signed-off-by: Jonathan Cameron commit 0084ccd7dcd7b7ceb201ead59ff27525f61540c3 Author: David Lechner Date: Sat Jun 28 11:39:33 2025 -0500 iio: adc: stm32-adc: make stm32_adc_trig_info const Add const qualifier to struct stm32_adc_trig_info. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-10-v1-1-0ba93ac792c8@baylibre.com Signed-off-by: Jonathan Cameron commit 89b971055a3ed507f6e3485513913c6f36df07fd Author: David Lechner Date: Sat Jun 28 11:36:01 2025 -0500 iio: adc: qcom-vadc: make scale_adc5_fn const Add const qualifier to struct qcom_adc5_scale_type scale_adc5_fn[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-9-v1-1-188ca6e904ee@baylibre.com Signed-off-by: Jonathan Cameron commit bf9b1ffe157b3a1646bf774494f766ef618a1047 Author: David Lechner Date: Sat Jun 28 11:31:02 2025 -0500 iio: adc: mp2629_adc: make mp2629_channels const Add const qualifier to struct iio_chan_spec mp2629_channels[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-8-v1-1-32ce79494d4a@baylibre.com Signed-off-by: Jonathan Cameron commit fc0f5322a3710ea68c88e3c23d940eca6d6344e6 Author: David Lechner Date: Sat Jun 28 11:23:58 2025 -0500 iio: adc: axp20x_adc: make axp717_maps const Add const qualifier to struct iio_map axp717_maps[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-7-v1-1-10008d0a4c2f@baylibre.com Signed-off-by: Jonathan Cameron commit 1ca58056bc2a0038ed6f021f3364936eeaf0c921 Author: David Lechner Date: Sat Jun 28 11:19:36 2025 -0500 iio: adc: at91_adc: make at91_adc_caps const Add const qualifier to struct at91_adc_caps at91sam*_caps. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-6-v1-1-fbb1ca5edc8d@baylibre.com Signed-off-by: Jonathan Cameron commit 89c3d59a9252afa80fa2211fcc598fca24ee63fc Author: David Lechner Date: Sat Jun 28 11:09:25 2025 -0500 iio: adc: ad7091r8: make ad7091r_init_info const Add const qualifier to struct ad7091r_init_info ad7091r*_init_info. This is read-only data so it can be made const. Signed-off-by: David Lechner Acked-by: Marcelo Schmitt Link: https://patch.msgid.link/20250628-iio-const-data-4-v1-1-4e0f93c9cf83@baylibre.com Signed-off-by: Jonathan Cameron commit 0e919ffcc73f34ffb06cb931a28d5d616c73cbe7 Author: David Lechner Date: Sat Jun 28 11:06:48 2025 -0500 iio: adc: ad7091r5: make ad7091r5_init_info const Add const qualifier to struct ad7091r_init_info ad7091r5_init_info. This is read-only data so it can be made const. Signed-off-by: David Lechner Acked-by: Marcelo Schmitt Link: https://patch.msgid.link/20250628-iio-const-data-3-v1-1-13d3f0af5f3f@baylibre.com Signed-off-by: Jonathan Cameron commit 3307461aead6523952c0ba28c9d0537b3328ed7c Author: David Lechner Date: Sat Jun 28 11:00:07 2025 -0500 iio: accel: mma9553: make mma9553_event_info const Add const qualifier to struct mma9553_event_info mma9553_event_info[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-2-v1-1-a61da3a0941e@baylibre.com Signed-off-by: Jonathan Cameron commit 31c3bed202dd9b20d1fda7bbde60c450b6c316a1 Author: David Lechner Date: Sat Jun 28 10:56:20 2025 -0500 iio: accel: adxl345: make adxl345_events const Add const qualifier to struct iio_event_spec adxl345_events[]. This is read-only data so it can be made const. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250628-iio-const-data-1-v1-1-a32d96d01c2f@baylibre.com Signed-off-by: Jonathan Cameron commit 47ae96104b16fa467f52feac8f2227915b5f0d04 Author: Frank Li Date: Tue Jun 24 16:13:02 2025 -0400 dt-bindings: iio: adc: nxp,lpc3220-adc: allow clocks property Allow clocks property to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/lpc/lpc3250-ea3250.dtb: adc@40048000 (nxp,lpc3220-adc): 'clocks' does not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Frank Li Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250624201302.2515391-1-Frank.Li@nxp.com Signed-off-by: Jonathan Cameron commit 8956547c5063a4796ced7cf253947d06b62d9552 Author: David Lechner Date: Tue Jun 24 22:44:51 2025 +0000 iio: adc: ad7380: remove unused oversampling_ratio getter Remove a call to ad7380_get_osr() in ad7380_init_offload_msg. The returned value is never used. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250624-iio-adc-ad7380-remove-unused-oversampling_ratio-getter-v1-1-26cbee356860@baylibre.com Signed-off-by: Jonathan Cameron commit 695b7c42d97b2a819b5602f16eed89d08fb45981 Author: Antoniu Miclaus Date: Thu Jun 26 13:40:24 2025 +0300 iio: adc: ad4851: add spi 3-wire support Add support for 3-wire configuration within the driver. By default 4-wire configuration is used. Signed-off-by: Antoniu Miclaus Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250626104024.8645-2-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit 0fbd8017ab965e416870843ba504abd19bfef3b2 Author: Antoniu Miclaus Date: Thu Jun 26 13:40:23 2025 +0300 dt-bindings: iio: adc: ad4851: add spi-3wire Add devicetree support for spi 3-wire configuration. Signed-off-by: Antoniu Miclaus Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250626104024.8645-1-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit b1c5f11dd183c7a7aec7350e298198ca1b8a7b25 Author: David Lechner Date: Fri Jun 20 09:30:46 2025 -0500 iio: adc: ad7173: simplify clock enable/disable Use devm_clk_get_enabled() instead of devm_clk_get(), clk_prepare_enable(), devm_add_action_or_reset() to simplify the code as it effectively does the same thing. We can also drop ext_clk from struct ad7173_state since it is not used anywhere else. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250620-iio-adc-ad7173-simplify-clock-enable-disable-v1-1-8bc693b190ec@baylibre.com Signed-off-by: Jonathan Cameron commit e602ee39986a3500762f8c05db84e931492293d4 Author: Gustavo Silva Date: Mon Jun 16 20:53:10 2025 -0300 iio: imu: bmi270: add step counter watermark event Add support for generating events when the step counter reaches the configurable watermark. Reviewed-by: Andy Shevchenko Signed-off-by: Gustavo Silva Link: https://patch.msgid.link/20250616-bmi270-events-v3-2-16e37588604f@gmail.com Signed-off-by: Jonathan Cameron commit 7c62cd9c796a4e1b38a23cb70e56275cf7c7ac77 Author: Gustavo Silva Date: Mon Jun 16 20:53:09 2025 -0300 iio: imu: bmi270: add channel for step counter Add a channel for enabling/disabling the step counter, reading the number of steps and resetting the counter. Reviewed-by: Andy Shevchenko Signed-off-by: Gustavo Silva Link: https://patch.msgid.link/20250616-bmi270-events-v3-1-16e37588604f@gmail.com Signed-off-by: Jonathan Cameron commit 4a40129087a4c32135bb1177a57bbbe6ee646f1a Author: Thomas Weißschuh Date: Fri Jul 4 15:43:13 2025 +0200 selftests/nolibc: correctly report errors from printf() and friends When an error is encountered by printf() it needs to be reported. errno() is already set by the callback. sprintf() is different, but that keeps working and is already tested. Also add a new test. Fixes: 7e4346f4a3a6 ("tools/nolibc/stdio: add a minimal [vf]printf() implementation") Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250704-nolibc-printf-error-v1-2-74b7a092433b@linutronix.de Signed-off-by: Thomas Weißschuh commit 2b1ed5f7f8ab82597abfff56a39f056f8592df43 Author: Thomas Weißschuh Date: Fri Jul 4 15:43:12 2025 +0200 selftests/nolibc: create /dev/full when running as PID 1 An upcoming testcase will use /dev/full. Make sure it is always present. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250704-nolibc-printf-error-v1-1-74b7a092433b@linutronix.de Signed-off-by: Thomas Weißschuh commit 7c02bc4088af55195f16bfa565127b4864c7e248 Author: Thomas Weißschuh Date: Fri Jul 4 16:19:48 2025 +0200 tools/nolibc: add support for clock_nanosleep() and nanosleep() Also add some tests. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250704-nolibc-nanosleep-v1-1-d79c19701952@linutronix.de Signed-off-by: Thomas Weißschuh commit db15ec7abd33ce245120f36be91f56f0ba0b247e Author: Tamir Duberstein Date: Fri Jul 4 15:50:11 2025 -0400 rust: miscdevice: remove unnecessary import `kernel::str::CStr` is included in the prelude. Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250704-cstr-include-miscdevice-v1-1-bb9e9b17c892@gmail.com Signed-off-by: Greg Kroah-Hartman commit fc2f0135a913d0ed3aa5dab2bef193e4e23ca5a7 Author: Sakari Ailus Date: Fri Jul 4 10:54:55 2025 +0300 ALSA: hda: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250704075455.3222438-1-sakari.ailus@linux.intel.com Signed-off-by: Takashi Iwai commit 5b32627c8ead7534c528bd57e896d0e9dcd4542a Author: Sakari Ailus Date: Fri Jul 4 10:55:00 2025 +0300 ALSA: intel_hdmi: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250704075500.3222950-1-sakari.ailus@linux.intel.com Signed-off-by: Takashi Iwai commit b228467e86fa7a12768680a5d12785034bb5b19c Merge: 6eda9429501508 cd4da713f99651 Author: Takashi Iwai Date: Sun Jul 6 10:24:46 2025 +0200 Merge tag 'pm-runtime-6.17-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm into for-next Runtime PM updates related to autosuspend for 6.17 Make several autosuspend functions mark last busy stamp and update the documentation accordingly (Sakari Ailus). Signed-off-by: Takashi Iwai commit 6eda9429501508196001845998bb8c73307d311a Author: GalaxySnail Date: Tue Jun 24 18:17:17 2025 +0800 ALSA: hda: add MODULE_FIRMWARE for cs35l41/cs35l56 add firmware information in the .modinfo section, so that userspace tools can find out firmware required by cs35l41/cs35l56 kernel module Signed-off-by: GalaxySnail Reviewed-by: Richard Fitzgerald Link: https://patch.msgid.link/20250624101716.2365302-2-me@glxys.nl Signed-off-by: Takashi Iwai commit a094f846276068d21878b47cf552cf18ee3720fb Author: Baojun Xu Date: Sat Jul 5 10:53:33 2025 +0800 ALSA: hda/tas2781: Add bus name in device name check Device name start from bus name, as we use strstarts() to do compare, need add it for TXNW2781 device. Fixes: b2904df0a347 ("ALSA: hda/tas2781: Add compatible for hardware id TIAS2781 and TXNW2781") Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20250705025333.24346-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit 998b41cb20b02c4e28ac558e4e7f8609d659ec05 Author: wenglianfa Date: Thu Jul 3 19:39:01 2025 +0800 RDMA/hns: Fix HW configurations not cleared in error flow hns_roce_clear_extdb_list_info() will eventually do some HW configurations through FW, and they need to be cleared by calling hns_roce_function_clear() when the initialization fails. Fixes: 7e78dd816e45 ("RDMA/hns: Clear extended doorbell info before using") Signed-off-by: wenglianfa Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20250703113905.3597124-3-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit c6957b95ecc5b63c5a4bb4ecc28af326cf8f6dc8 Author: wenglianfa Date: Thu Jul 3 19:39:00 2025 +0800 RDMA/hns: Fix double destruction of rsv_qp rsv_qp may be double destroyed in error flow, first in free_mr_init(), and then in hns_roce_exit(). Fix it by moving the free_mr_init() call into hns_roce_v2_init(). list_del corruption, ffff589732eb9b50->next is LIST_POISON1 (dead000000000100) WARNING: CPU: 8 PID: 1047115 at lib/list_debug.c:53 __list_del_entry_valid+0x148/0x240 ... Call trace: __list_del_entry_valid+0x148/0x240 hns_roce_qp_remove+0x4c/0x3f0 [hns_roce_hw_v2] hns_roce_v2_destroy_qp_common+0x1dc/0x5f4 [hns_roce_hw_v2] hns_roce_v2_destroy_qp+0x22c/0x46c [hns_roce_hw_v2] free_mr_exit+0x6c/0x120 [hns_roce_hw_v2] hns_roce_v2_exit+0x170/0x200 [hns_roce_hw_v2] hns_roce_exit+0x118/0x350 [hns_roce_hw_v2] __hns_roce_hw_v2_init_instance+0x1c8/0x304 [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify_init+0x170/0x21c [hns_roce_hw_v2] hns_roce_hw_v2_reset_notify+0x6c/0x190 [hns_roce_hw_v2] hclge_notify_roce_client+0x6c/0x160 [hclge] hclge_reset_rebuild+0x150/0x5c0 [hclge] hclge_reset+0x10c/0x140 [hclge] hclge_reset_subtask+0x80/0x104 [hclge] hclge_reset_service_task+0x168/0x3ac [hclge] hclge_service_task+0x50/0x100 [hclge] process_one_work+0x250/0x9a0 worker_thread+0x324/0x990 kthread+0x190/0x210 ret_from_fork+0x10/0x18 Fixes: fd8489294dd2 ("RDMA/hns: Fix Use-After-Free of rsv_qp on HIP08") Signed-off-by: wenglianfa Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20250703113905.3597124-2-huangjunxian6@hisilicon.com Signed-off-by: Leon Romanovsky commit 4b295f4fdc80e9b13bd2ca05f4c9434fa0857cab Author: Bitterblue Smith Date: Sat Jul 5 22:39:21 2025 +0300 wifi: rtw89: Enable the new rtw89_8852bu module Enable compilation of the new rtw89_8852bu module. Tested mostly in station mode, and a little bit in AP mode. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/627e9e92-6f10-45de-a340-19b10d7bad82@gmail.com commit 0ed2a8b1a14e9ebaa72a98b8ee9938cb16c2d606 Author: Bitterblue Smith Date: Sat Jul 5 22:38:55 2025 +0300 wifi: rtw89: Add rtw8852bu.c This is the entry point for the new rtw89_8852bu module. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/bac25b31-8146-4738-b8f2-eba66c51f3d8@gmail.com commit f56b4446d07ac42ef7e71789a9256fa2f8260876 Author: Bitterblue Smith Date: Sat Jul 5 22:38:35 2025 +0300 wifi: rtw89: 8852b: Add rtw8852b_hfc_param_ini_usb "hfc" means "hci fc" which is "Host Control Interface Flow Control". These are some parameters needed for RTL8852BU. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/40dd1597-27d8-4316-ac3b-4bf7ff9f3e2f@gmail.com commit b57b556a02e6ac1192ab57d5c3a045ad34182b7a Author: Bitterblue Smith Date: Sat Jul 5 22:38:14 2025 +0300 wifi: rtw89: 8852b: Add rtw8852b_dle_mem_usb3 "dle" could be "Data Link Engine" or "Double Link Engine". These are some parameters needed for RTL8852BU. In this case the same parameters are used for USB 2 and USB 3. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/7224021b-4fb5-44bc-aeb1-3a6fd3625f2a@gmail.com commit 0980de01da08338d4a7ceaf5e7ab25a56142c75a Author: Bitterblue Smith Date: Sat Jul 5 22:37:32 2025 +0300 wifi: rtw89: 8852b: Fix rtw8852b_pwr_{on,off}_func() for USB There are a few differences in the power on/off functions between PCIE and USB. The changes in the power off function in particular are needed for the RTL8832BU to be able to power on again after it's powered off. While the RTL8832BU appears to work without the changes in the power on function, it's probably best to implement them, in case they are needed in some situations. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/c12da54f-88e6-4b11-8587-36f9cac13bf3@gmail.com commit 5e9184ae7207c828d3721e9fdaeeb61da0994995 Author: Bitterblue Smith Date: Sat Jul 5 22:36:59 2025 +0300 wifi: rtw89: 8852bx: Accept USB devices and load their MAC address Make __rtw8852bx_read_efuse() accept USB devices and load the MAC address from the correct offset. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/1f58d168-67a9-4d86-9e6a-73789c7a59f4@gmail.com commit 40818680d8350dc35b1d1ac31c75038d13461126 Author: Cristian Ciocaltea Date: Fri Jul 4 14:52:54 2025 +0300 drm/bridge: adv7511: Fix DRM_BRIDGE_OP_HDMI_{AUDIO|CEC_ADAPTER} setup When driver is built with either CONFIG_DRM_I2C_ADV7511_AUDIO or CONFIG_DRM_I2C_ADV7511_CEC disabled, drm_bridge_connector_init() is expected to fail with -EINVAL. That is because all required audio (or CEC) related callbacks in adv7511_bridge_funcs ended up being NULL. Set DRM_BRIDGE_OP_HDMI_AUDIO and DRM_BRIDGE_OP_HDMI_CEC_ADAPTER bridge ops only when the aforementioned kernel config options have been enabled. Fixes: ae01d3183d27 ("drm/bridge: adv7511: switch to the HDMI connector helpers") Signed-off-by: Cristian Ciocaltea Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250704-adv7511-bridge-ops-fix-v1-1-c1385922066e@collabora.com Signed-off-by: Dmitry Baryshkov commit b78287c54bd87924ee328d51336b44a74304d7cc Author: Cristian Ciocaltea Date: Fri Jul 4 15:10:45 2025 +0300 drm/bridge: Fix kdoc comment for DRM_BRIDGE_OP_HDMI_CEC_ADAPTER Correct the kernel-doc comment for DRM_BRIDGE_OP_HDMI_CEC_ADAPTER member of enum drm_bridge_ops. This seems to be just a copy-paste artifact from DRM_BRIDGE_OP_HDMI_CEC_NOTIFIER above. Signed-off-by: Cristian Ciocaltea Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250704-drm-bridge-kdoc-fix-v1-1-b08c67212851@collabora.com Signed-off-by: Dmitry Baryshkov commit 8290d37ad2b087bbcfe65fa5bcaf260e184b250a Author: Rob Clark Date: Sat Jul 5 09:57:05 2025 -0700 drm/msm: Small function param doc fix Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202507032334.9SCwc952-lkp@intel.com/ Signed-off-by: Rob Clark commit 98f11fd1cf92c32f988e3699d1148fb2e317dd29 Author: Rob Clark Date: Sat Jul 5 07:52:41 2025 -0700 drm/msm: Take the ioctls away from the KMS-only driver KMS-only drivers should only allocate dumb buffers. The driver custom ioctls are only meant for the usermode gpu driver (mesa), and not for general consumption, so they don't make sense for standalone KMS drivers. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662598/ commit ee82e5a2c5155d06ef0b7ab4bac8cb4bb8a2893a Author: Rob Clark Date: Sat Jul 5 07:52:40 2025 -0700 drm/msm: Clean up split driver features Avoid the possibility of missing features between the split and unified drm driver cases by defining DRIVER_FEATURES_GPU / KMS and using those in the drm_driver initializations. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662595/ commit 6d16cd5769bbb5eb62974e8eddb97fca830b49fd Author: Tamir Duberstein Date: Fri Jul 4 16:11:02 2025 -0400 rust: devres: remove unused import As far as I can tell, `c_str` was never used, hence remove it. Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250704-cstr-include-devres-v1-1-4ee9e56fca09@gmail.com Signed-off-by: Danilo Krummrich commit 65f8f0d4e0b45dc784f18a7ca4739e1df12b950a Author: Tamir Duberstein Date: Fri Jul 4 15:50:44 2025 -0400 rust: auxiliary: remove unnecessary import `kernel::str::CStr` is included in the prelude. Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250704-cstr-include-aux-v1-1-e1a404ae92ac@gmail.com Signed-off-by: Danilo Krummrich commit 8ae33576ead8fb71505515df8c938b3e0ae5b37c Author: Tamir Duberstein Date: Fri Jul 4 15:49:54 2025 -0400 rust: platform: remove unnecessary import `kernel::str::CStr` is included in the prelude. Signed-off-by: Tamir Duberstein Link: https://lore.kernel.org/r/20250704-cstr-include-platform-v1-1-ff7803ee7a81@gmail.com Signed-off-by: Danilo Krummrich commit 217ed15bd399980981f90f4332bc7ad4b05baa7e Author: Dmitry Baryshkov Date: Sat Jul 5 13:02:35 2025 +0300 drm/msm: enable separate binding of GPU and display devices There are cases when we want to have separate DRM devices for GPU and display pipelines. One example is development, when it is beneficial to be able to bind the GPU driver separately, without the display pipeline (and without the hacks adding "amd,imageon" to the compatible string). Another example is some of Qualcomm platforms, which have two MDSS units, but only one GPU. With current approach it is next to impossible to support this usecase properly, while separate binding allows users to have three DRM devices: two for MDSS units and a single headless GPU. Add kernel param msm.separate_gpu_kms, which if set to true forces creation of separate display and GPU DRM devices. Mesa supports this setup by using the kmsro wrapper. The param is disabled by default, in order to be able to test userspace for the compatibility issues. Simple clients are able to handle this setup automatically. Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662590/ [Rob: renamed the modparam to separate_gpu_kms, and add missing DRIVER_GEM_GPUVA] Signed-off-by: Rob Clark commit 643515a9cd091b2a3eff18fdd5caa30c5d816889 Author: Dmitry Baryshkov Date: Sat Jul 5 13:02:34 2025 +0300 drm/msm: rework binding of Imageon GPUs Currently the msm driver creates an extra interim platform device for Imageon GPUs. This is not ideal, as the device doesn't have corresponding OF node. If the headless mode is used for newer GPUs, then the msm_use_mmu() function can not detect corresponding IOMMU devices. Also the DRM device (although it's headless) is created with modesetting flags being set. To solve all these issues, rework the way the Imageon devices are bound. Remove the interim device, don't register a component and instead use a cut-down version of the normal functions to probe or remove the driver. Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662584/ Signed-off-by: Rob Clark commit 27c3547323ebfdcc11e36deedbc78237e7dff352 Author: Dmitry Baryshkov Date: Sat Jul 5 13:02:33 2025 +0300 drm/msm: rearrange symbol selection Move symbol selection to be more fine grained: select DP helpers only if DP driver is also enabled, move KMS and display helpers to the newly introduced DRM_MSM_KMS. Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662589/ Signed-off-by: Rob Clark commit 4f89cf40d01ee26fb7eb50f65bae53daf4c3f569 Author: Dmitry Baryshkov Date: Sat Jul 5 13:02:32 2025 +0300 drm/msm: bail out late_init_minor() if it is not a GPU device Both perf and hangrd make sense only for GPU devices. Bail out if we are registering a KMS-only device. Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662583/ Signed-off-by: Rob Clark commit 98290b0a7d605431480e63ccdb6a118a21a0866c Author: Dmitry Baryshkov Date: Sat Jul 5 13:02:31 2025 +0300 drm/msm: make it possible to disable KMS-related code. If the Adreno device is used in a headless mode, there is no need to build all KMS components. Build corresponding parts conditionally, only selecting them if modeset support is actually required. Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662581/ Signed-off-by: Rob Clark commit e10e1a4010f36201d77ed062c651900d559eb0b4 Author: Dmitry Baryshkov Date: Sat Jul 5 13:02:30 2025 +0300 drm/msm: move KMS driver data to msm_kms Data for HDMI, DSI and DP blocks only makes sense for the KMS parts of the driver. Move corresponding data pointers from struct msm_drm_private to struct msm_kms. Suggested-by: Abhinav Kumar Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662580/ Signed-off-by: Rob Clark commit 0bb2335f06cc014abdc27101240e79f7b61f84c3 Author: Dmitry Baryshkov Date: Sat Jul 5 13:02:29 2025 +0300 drm/msm: get rid of msm_drm_private::num_crtcs Drop superfluous msm_drm_private::num_crtcs in favour of using drm_mode_config::num_crtc or MAX_CRCS as appropriate. Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662578/ Signed-off-by: Rob Clark commit 9d065a3fefd4476677dea80b5b093884a1f124da Author: Dmitry Baryshkov Date: Sat Jul 5 13:02:28 2025 +0300 drm/msm/mdp4: get rid of mdp4_crtc.id There is no reason to store CRTC id, it's a part of the drm_crtc. Drop this member and use drm_crtc.name for the warning message. Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662576/ Signed-off-by: Rob Clark commit 0c2dda82b1456e978e5a202018bb2966fe659bfc Author: Dmitry Baryshkov Date: Sat Jul 5 13:02:27 2025 +0300 drm/msm: move helper calls to msm_kms.c Extract two more KMS-related codepieces to msm_kms.c, removing last pieces of KMS code from msm_drv.c. Reviewed-by: Abhinav Kumar Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662574/ Signed-off-by: Rob Clark commit a409b78fcdf724422fa030bd5ef177ebf3b7608a Author: Dmitry Baryshkov Date: Sat Jul 5 13:02:26 2025 +0300 drm/msm: move wq handling to KMS code The global workqueue is only used for vblanks inside KMS code. Move allocation / flushing / deallcation of it to msm_kms.c Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662573/ Signed-off-by: Rob Clark commit 19920ab98e17af4e733ec4c69881d8ce433d3f1d Author: Cristian Ciocaltea Date: Thu Jul 3 23:05:45 2025 +0300 drm/display: hdmi-cec-helper: Fix adapter unregistration Attempting to reload a kernel module of an HDMI driver making use of the new CEC helpers revealed a resource deallocation issue, i.e. the entries in /dev/cec* keep growing. Moreover, after a couple of tries the kernel crashes and the whole system freezes: [ 47.515950] Unable to handle kernel paging request at virtual address 0020072007200778 [...] [ 47.521707] Internal error: Oops: 0000000096000004 [#1] SMP [...] [ 47.537597] Call trace: [ 47.537815] klist_next+0x20/0x1b8 (P) [ 47.538152] device_reorder_to_tail+0x74/0x120 [ 47.538548] device_reorder_to_tail+0x6c/0x120 [ 47.538944] device_pm_move_to_tail+0x78/0xd0 [ 47.539334] deferred_probe_work_func+0x9c/0x110 [ 47.539747] process_one_work+0x328/0x638 [ 47.540108] worker_thread+0x264/0x390 [ 47.540445] kthread+0x20c/0x230 [ 47.540735] ret_from_fork+0x10/0x20 Do a proper cleanup by calling cec_unregister_adapter() instead of cec_delete_adapter() in the managed release action handler. Fixes: 8b1a8f8b2002 ("drm/display: add CEC helpers code") Signed-off-by: Cristian Ciocaltea Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250703-hdmi-cec-helper-unreg-fix-v1-1-7e7b0eb578bb@collabora.com Signed-off-by: Dmitry Baryshkov commit 31e4add7a395224005ba4fc34a5fdcd5889bd0fb Author: Tamir Duberstein Date: Fri Jul 4 15:50:27 2025 -0400 rust: drm: remove unnecessary imports `kernel::str::CStr` is included in the prelude. Signed-off-by: Tamir Duberstein Signed-off-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250704-cstr-include-drm-v1-1-a279dfc4d753@gmail.com commit 49a27c6c392dec46c826ee586f7ec8973acaeed7 Author: Kaustabh Chakraborty Date: Thu Jun 26 13:02:58 2025 +0530 arm64: dts: exynos7870-j6lte: reduce memory ranges to base amount The device is available in multiple variants with differing RAM capacities. The memory range defined in the 0x80000000 bank exceeds the address range of the memory controller, which eventually leads to ARM SError crashes. Reduce the bank size to a value which is available to all devices. The bootloader must be responsible for identifying the RAM capacity and editing the memory node accordingly. Fixes: d6f3a7f91fdb ("arm64: dts: exynos: add initial devicetree support for exynos7870") Cc: stable@vger.kernel.org # v6.16 Signed-off-by: Kaustabh Chakraborty Link: https://lore.kernel.org/r/20250626-exynos7870-dts-fixes-v1-3-349987874d9a@disroot.org Signed-off-by: Krzysztof Kozlowski commit 2bdfa35a7bb6e3a319e7a290baa44720bc96e5e4 Author: Kaustabh Chakraborty Date: Thu Jun 26 13:02:57 2025 +0530 arm64: dts: exynos7870-on7xelte: reduce memory ranges to base amount The device is available in multiple variants with differing RAM capacities. The memory range defined in the 0x80000000 bank exceeds the address range of the memory controller, which eventually leads to ARM SError crashes. Reduce the bank size to a value which is available to all devices. The bootloader must be responsible for identifying the RAM capacity and editing the memory node accordingly. Fixes: d6f3a7f91fdb ("arm64: dts: exynos: add initial devicetree support for exynos7870") Cc: stable@vger.kernel.org # v6.16 Signed-off-by: Kaustabh Chakraborty Link: https://lore.kernel.org/r/20250626-exynos7870-dts-fixes-v1-2-349987874d9a@disroot.org Signed-off-by: Krzysztof Kozlowski commit e9355e894aebcbeacffd284644749190cc5f33a4 Author: Kaustabh Chakraborty Date: Thu Jun 26 13:02:56 2025 +0530 arm64: dts: exynos7870: add quirk to disable USB2 LPM in gadget mode In gadget mode, USB connections are sluggish. The device won't send packets to the host unless the host sends packets to the device. For instance, SSH-ing through the USB network would apparently not work unless you're flood-pinging the device's IP. Add the property snps,usb2-gadget-lpm-disable to the dwc3 node, which seems to solve this issue. Fixes: d6f3a7f91fdb ("arm64: dts: exynos: add initial devicetree support for exynos7870") Cc: stable@vger.kernel.org # v6.16 Signed-off-by: Kaustabh Chakraborty Link: https://lore.kernel.org/r/20250626-exynos7870-dts-fixes-v1-1-349987874d9a@disroot.org Signed-off-by: Krzysztof Kozlowski commit 314862edb13d52c481ecc330c9d3fec0507cd9bb Author: Mihai Sain Date: Thu Jun 19 10:06:36 2025 +0300 ARM: dts: microchip: sama7g5: Add cache configuration for cpu node Describe the cache memories according with datasheet chapter 15.2: - L1 cache configuration with 32KB for both data and instruction cache. - L2 cache configuration with 256KB unified cache. Before this patch the kernel reported the warning: [ 0.171425] cacheinfo: Unable to detect cache hierarchy for CPU 0 Signed-off-by: Mihai Sain Link: https://lore.kernel.org/r/20250619070636.8844-3-mihai.sain@microchip.com Signed-off-by: Claudiu Beznea commit 4101c8274b093519019761e174c81980f7b30f56 Author: Mihai Sain Date: Thu Jun 19 10:06:35 2025 +0300 ARM: dts: microchip: sama7d65: Add cache configuration for cpu node Describe the cache memories according with datasheet chapter 15.2: - L1 cache configuration with 32KB for both data and instruction cache. - L2 cache configuration with 256KB unified cache. Before this patch the kernel reported the warning: [ 0.161955] cacheinfo: Unable to detect cache hierarchy for CPU 0 Signed-off-by: Mihai Sain Link: https://lore.kernel.org/r/20250619070636.8844-2-mihai.sain@microchip.com Signed-off-by: Claudiu Beznea commit 1e2e0ed390cc3c074817b2026a59da008b6cd2a6 Author: Mihai Sain Date: Wed Jun 25 09:49:34 2025 +0300 ARM: dts: microchip: sama5d4: Update the cache configuration for CPU Add the memory size properties for L1 and L2 according with block diagram from datasheet: - L1 cache configuration with 32 KB for both data and instruction cache. - L2 cache configuration with 128 KB unified cache. [root@sama5d4 ~]$ lscpu Architecture: armv7l Byte Order: Little Endian CPU(s): 1 On-line CPU(s) list: 0 Vendor ID: ARM Model name: Cortex-A5 Caches (sum of all): L1d: 32 KiB (1 instance) L1i: 32 KiB (1 instance) L2: 128 KiB (1 instance) Signed-off-by: Mihai Sain Link: https://lore.kernel.org/r/20250625064934.4828-4-mihai.sain@microchip.com Signed-off-by: Claudiu Beznea commit 31a820245903f75e6f5d908561fe5d3eab94f057 Author: Mihai Sain Date: Wed Jun 25 09:49:33 2025 +0300 ARM: dts: microchip: sama5d3: Update the cache configuration for CPU Add the memory size properties for L1 according with block diagram from datasheet: - L1 cache configuration with 32 KB for both data and instruction cache. [root@sama5d3 ~]$ lscpu Architecture: armv7l Byte Order: Little Endian CPU(s): 1 On-line CPU(s) list: 0 Vendor ID: ARM Model name: Cortex-A5 Caches (sum of all): L1d: 32 KiB (1 instance) L1i: 32 KiB (1 instance) Signed-off-by: Mihai Sain Link: https://lore.kernel.org/r/20250625064934.4828-3-mihai.sain@microchip.com Signed-off-by: Claudiu Beznea commit ab435d1265e9667c49b91210ef1162a9fb928580 Author: Mihai Sain Date: Wed Jun 25 09:49:32 2025 +0300 ARM: dts: microchip: sama5d2: Update the cache configuration for CPU Add the memory size properties for L1 and L2 according with block diagram from datasheet: - L1 cache configuration with 32 KB for both data and instruction cache. - L2 cache configuration with 128 KB unified cache. [root@sama5d2 ~]$ lscpu Architecture: armv7l Byte Order: Little Endian CPU(s): 1 On-line CPU(s) list: 0 Vendor ID: ARM Model name: Cortex-A5 Caches (sum of all): L1d: 32 KiB (1 instance) L1i: 32 KiB (1 instance) L2: 128 KiB (1 instance) Signed-off-by: Mihai Sain Link: https://lore.kernel.org/r/20250625064934.4828-2-mihai.sain@microchip.com Signed-off-by: Claudiu Beznea commit 683d532dfc9657ab8aae25204f378352ed144646 Author: Peter Griffin Date: Wed Jul 2 13:15:24 2025 +0100 pinctrl: samsung: Fix gs101 irq chip When adding the dedicated gs101_wkup_irq_chip struct to support the eint wakeup mask the .eint_con, eint_mask and .eint_pend fields were missed. The result is that irqs on gs101 for the buttons etc are broken. Reported-by: André Draszik Fixes: 2642f55d44ce ("pinctrl: samsung: add support for gs101 wakeup mask programming") Signed-off-by: Peter Griffin Tested-by: André Draszik Link: https://lore.kernel.org/r/20250702-fix-gs101-irqchip-v1-1-ccc84b44ad72@linaro.org Signed-off-by: Krzysztof Kozlowski commit 81c3b7256f9ec3c9f7659e4a2aec8d8ead0d4c3b Merge: cf16f408364efd 3c2bd251d2039c Author: Greg Kroah-Hartman Date: Sat Jul 5 07:51:39 2025 +0200 Merge merge point of tag 'usb-6.16-rc5' into usb-next We need the USB fixes in here as well to build on top of for other changes that depend on them. Signed-off-by: Greg Kroah-Hartman commit a452510aad53f665eb422784ff525c4889aa246f Author: Konrad Dybcio Date: Thu Jun 26 11:02:41 2025 +0200 drm/msm/adreno: Switch to the common UBWC config struct Now that Adreno specifics are out of the way, use the common config (but leave the HBB hardcoding in place until that is wired up on the other side). Acked-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660985/ Signed-off-by: Rob Clark commit 2728285988c3e94ce92104a58b4cee848c4602de Author: Konrad Dybcio Date: Thu Jun 26 11:02:40 2025 +0200 soc: qcom: ubwc: Fill in UBWC swizzle cfg for platforms that lack one The UBWC 1.0 case is easy - it must be all 3 enabled. UBWC2.0 and 3.x require that level1 is removed, follow suit. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660983/ Signed-off-by: Rob Clark commit 709dd2ff2357734f5a0b2ef68e1f7c4256543a70 Author: Konrad Dybcio Date: Thu Jun 26 11:02:39 2025 +0200 soc: qcom: ubwc: Add #defines for UBWC swizzle bits Make the values a bit more meaningful. This commit is intentionally cross-subsystem to ease review, as the patchset is intended to be merged together, with a maintainer consensus. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660981/ Signed-off-by: Rob Clark commit caf5ad18a2b49e3b20b1dc65e928851d409bcd1c Author: Konrad Dybcio Date: Thu Jun 26 11:02:38 2025 +0200 soc: qcom: ubwc: Fix SM6125's ubwc_swizzle value The value of 7 (a.k.a. GENMASK(2, 0), a.k.a. disabling levels 1-3 of swizzling) is what we want on this platform (and others with a UBWC 1.0 encoder). Fix it to make mesa happy (the hardware doesn't care about the 2 higher bits, as they weren't consumed on this platform). Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660980/ Signed-off-by: Rob Clark commit 8f18e879576cad2b1a276dd91dd6cccee608ca45 Author: Konrad Dybcio Date: Thu Jun 26 11:02:37 2025 +0200 drm/msm/a6xx: Simplify min_acc_len calculation It's only necessary for some lower end parts. Also rename it to min_acc_len_64b to denote that if set, the minimum access length is 64 bits, 32b otherwise. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660977/ Signed-off-by: Rob Clark commit b6ce504c715541eec92a42f2b828ed97742926d6 Author: Konrad Dybcio Date: Thu Jun 26 11:02:36 2025 +0200 drm/msm/a6xx: Resolve the meaning of rgb565_predicator It's supposed to be on when the UBWC encoder version is >= 4.0. Drop the per-GPU assignments. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660975/ Signed-off-by: Rob Clark commit c59e9c966e8e0470c723f1c0c6ba3b13e5978b29 Author: Konrad Dybcio Date: Thu Jun 26 11:02:35 2025 +0200 drm/msm/a6xx: Replace '2' with BIT(1) in level2_swizzling_dis calc ubwc_swizzle is a bitmask. Check for a bit to make it more obvious. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660973/ Signed-off-by: Rob Clark commit 87cfc79dcd605056247c62d65ea41ce6c65cdbe3 Author: Konrad Dybcio Date: Thu Jun 26 11:02:34 2025 +0200 drm/msm/a6xx: Resolve the meaning of UBWC_MODE This bit is set iff the UBWC version is 1.0. That notably does not include QCM2290's "no UBWC". This commit is intentionally cross-subsystem to ease review, as the patchset is intended to be merged together, with a maintainer consensus. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660971/ Signed-off-by: Rob Clark commit 32ef24e51f7ff4dd5eaeb3e0f06f0ad36143bdc6 Author: Konrad Dybcio Date: Thu Jun 26 11:02:33 2025 +0200 drm/msm/a6xx: Simplify uavflagprd_inv detection Instead of setting it on a gpu-per-gpu basis, converge it to the intended "is A650 family or A7xx". Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660969/ Signed-off-by: Rob Clark commit 367380d2b5500fc29b87953e2c6da872bc0fb2e5 Author: Konrad Dybcio Date: Thu Jun 26 11:02:32 2025 +0200 drm/msm/a6xx: Resolve the meaning of AMSBC The bit must be set to 1 if the UBWC encoder version is >= 3.0, drop it as a separate field. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660967/ Signed-off-by: Rob Clark commit 560c98b4a464215b04193c9ad7a4c07486ccf9c8 Author: Konrad Dybcio Date: Thu Jun 26 11:02:31 2025 +0200 drm/msm/a6xx: Get a handle to the common UBWC config Start the great despaghettification by getting a pointer to the common UBWC configuration, which houses e.g. UBWC versions that we need to make decisions. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660965/ Signed-off-by: Rob Clark commit 45a2974157d2d8b6f26911582d64089cab992d8b Author: Konrad Dybcio Date: Thu Jun 26 11:02:30 2025 +0200 drm/msm: Use the central UBWC config database As discussed a lot in the past, the UBWC config must be coherent across a number of IP blocks (currently display and GPU, but it also may/will concern camera/video as the drivers evolve). So far, we've been trying to keep the values reasonable in each of the two drivers separately, but it really make sense to do so centrally, especially given certain fields (e.g. HBB) may need to be gathered dynamically. To reduce room for error, move to fetching the config from a central source, so that the data programmed into the hardware is consistent across all multimedia blocks that request it. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660963/ Signed-off-by: Rob Clark commit 227d4ce0b09eba29aa69740e43643afb9b41b229 Author: Konrad Dybcio Date: Thu Jun 26 11:02:29 2025 +0200 drm/msm: Offset MDSS HBB value by 13 The Adreno part of the driver exposes this value to userspace, and the SMEM data source also presents a x+13 value. Keep things coherent and make the value uniform across them. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660961/ Signed-off-by: Rob Clark commit 1924272b9ce1edc5694e6d112097fd51e821980e Author: Konrad Dybcio Date: Thu Jun 26 11:02:28 2025 +0200 soc: qcom: Add UBWC config provider Add a file that will serve as a single source of truth for UBWC configuration data for various multimedia blocks. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Patchwork: https://patchwork.freedesktop.org/patch/660959/ Signed-off-by: Rob Clark commit 6733d8276ac02a8790e571d2af4a69a9039d0522 Author: Rob Clark Date: Thu Jul 3 10:51:19 2025 -0700 drm/msm: Update register xml Sync register xml from mesa commit eb3e0b7164a3 ("freedreno/a6xx: Split descriptors out into their own file"). Signed-off-by: Rob Clark Acked-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662470/ commit b74fae5492d1429c03b57a423d0837a3bdc4b397 Author: Rob Clark Date: Sun Jun 29 13:13:25 2025 -0700 drm/msm: Add VM_BIND throttling A large number of (unsorted or separate) small (<2MB) mappings can cause a lot of, probably unnecessary, prealloc pages. Ie. a single 4k page size mapping will pre-allocate 3 pages (for levels 2-4) for the pagetable. Which can chew up a large amount of unneeded memory. So add a mechanism to put an upper bound on the # of pre-alloc pages. Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661529/ commit 3bebfd53af0f7c8ea55094ba7b8b8b907024bb7b Author: Rob Clark Date: Sun Jun 29 13:13:24 2025 -0700 drm/msm: Defer VMA unmap for fb unpins With the conversion to drm_gpuvm, we lost the lazy VMA cleanup, which means that fb cleanup/unpin when pageflipping to new scanout buffers immediately unmaps the scanout buffer. This is costly (with tlbinv, it can be 4-6ms for a 1080p scanout buffer, and more for higher resolutions)! To avoid this, introduce a vma_ref, which is incremented whenever userspace has a GEM handle or dma-buf fd. When unpinning if the vm is the kms->vm we defer tearing down the VMA until the vma_ref drops to zero. If the buffer is still part of a flip-chain then userspace will be holding some sort of reference to the BO, either via a GEM handle and/or dma-buf fd. So this avoids unmapping the VMA when there is a strong possibility that it will be needed again. Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661538/ commit 8d4c21718cebf316daa36d06c7206d72e738fa16 Author: Rob Clark Date: Sun Jun 29 13:13:23 2025 -0700 drm/msm: Bump UAPI version Bump version to signal to userspace that VM_BIND is supported. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661535/ commit 0a1ff88ec5b60b41ba830c5bf08b6cd8f45ab411 Author: Rob Clark Date: Sun Jun 29 13:13:22 2025 -0700 drm/msm: use trylock for debugfs This resolves a potential deadlock vs msm_gem_vm_close(). Otherwise for _NO_SHARE buffers msm_gem_describe() could be trying to acquire the shared vm resv, while already holding priv->obj_lock. But _vm_close() might drop the last reference to a GEM obj while already holding the vm resv, and msm_gem_free_object() needs to grab priv->obj_lock, a locking inversion. OTOH this is only for debugfs and it isn't critical if we undercount by skipping a locked obj. So just use trylock() and move along if we can't get the lock. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661525/ commit 05a249683455bf1099de28d7f189c6013aae4794 Author: Rob Clark Date: Sun Jun 29 13:13:21 2025 -0700 drm/msm: Add mmu prealloc tracepoint So we can monitor how many pages are getting preallocated vs how many get used. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661521/ commit 0b4339c55ef59ff753c8d505596961edd7b887da Author: Rob Clark Date: Sun Jun 29 13:13:20 2025 -0700 drm/msm: Add VMA unmap reason Make the VM log a bit more useful by providing a reason for the unmap (ie. closing VM vs evict/purge, etc) Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661527/ commit 9edc52967cc7fcd430749cdd8866aa68f25422bf Author: Rob Clark Date: Sun Jun 29 13:13:19 2025 -0700 drm/msm: Add VM logging for VM_BIND updates When userspace opts in to VM_BIND, the submit no longer holds references keeping the VMA alive. This makes it difficult to distinguish between UMD/KMD/app bugs. So add a debug option for logging the most recent VM updates and capturing these in GPU devcoredumps. The submitqueue id is also captured, a value of zero means the operation did not go via a submitqueue (ie. comes from msm_gem_vm_close() tearing down the remaining mappings when the device file is closed. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661518/ commit 2e6a8a1fe2b262a6dfd0a65041fcd830ee1e7143 Author: Rob Clark Date: Sun Jun 29 13:13:18 2025 -0700 drm/msm: Add VM_BIND ioctl Add a VM_BIND ioctl for binding/unbinding buffers into a VM. This is only supported if userspace has opted in to MSM_PARAM_EN_VM_BIND. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661524/ commit ecfd9fa83fa03ba5e9e860189757d9761e72f31c Author: Rob Clark Date: Sun Jun 29 13:13:17 2025 -0700 drm/msm: Split out map/unmap ops With async VM_BIND, the actual pgtable updates are deferred. Synchronously, a list of map/unmap ops will be generated, but the actual pgtable changes are deferred. To support that, split out op handlers and change the existing non-VM_BIND paths to use them. Note in particular, the vma itself may already be destroyed/freed by the time an UNMAP op runs (or even a MAP op if there is a later queued UNMAP). For this reason, the op handlers cannot reference the vma pointer. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661516/ commit e601ea31d66ba83d565cae9cfa45cbbcdd8286dd Author: Rob Clark Date: Sun Jun 29 13:13:16 2025 -0700 drm/msm: Support pgtable preallocation Introduce a mechanism to count the worst case # of pages required in a VM_BIND op. Note that previously we would have had to somehow account for allocations in unmap, when splitting a block. This behavior was removed in commit 33729a5fc0ca ("iommu/io-pgtable-arm: Remove split on unmap behavior)" Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661515/ commit 2b93efeb83bd2d4bc82817109a1973acb8129173 Author: Rob Clark Date: Sun Jun 29 13:13:15 2025 -0700 drm/msm: Support IO_PGTABLE_QUIRK_NO_WARN_ON With user managed VMs and multiple queues, it is in theory possible to trigger map/unmap errors. These will (in a later patch) mark the VM as unusable. But we want to tell the io-pgtable helpers not to spam the log. In addition, in the unmap path, we don't want to bail early from the unmap, to ensure we don't leave some dangling pages mapped. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661520/ commit 92395af63a9958615edfa9d4ef1ea72c92a00410 Author: Rob Clark Date: Sun Jun 29 13:13:14 2025 -0700 drm/msm: Add VM_BIND submitqueue This submitqueue type isn't tied to a hw ringbuffer, but instead executes on the CPU for performing async VM_BIND ops. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661517/ commit cefb919cfa5359c72325be8c7dc8a245c85c2756 Author: Rob Clark Date: Sun Jun 29 13:13:13 2025 -0700 drm/msm: Use DMA_RESV_USAGE_BOOKKEEP/KERNEL Any place we wait for a BO to become idle, we should use BOOKKEEP usage, to ensure that it waits for _any_ activity. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661506/ commit e1341f91450525b94474b75d5e77587d1d84e52c Author: Rob Clark Date: Sun Jun 29 13:13:12 2025 -0700 drm/msm: Extract out syncobj helpers We'll be re-using these for the VM_BIND ioctl. Also, rename a few things in the uapi header to reflect that syncobj use is not specific to the submit ioctl. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661512/ commit 06ebb4f043999d42916b78697eebfbc12cc1c0f8 Author: Rob Clark Date: Sun Jun 29 13:13:11 2025 -0700 drm/msm: rd dumping support for sparse As with devcoredump, we need to iterate the VMAs to figure out what to dump. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661510/ commit af9aa6f316b3dae53318a044e975dae979cc022b Author: Rob Clark Date: Sun Jun 29 13:13:10 2025 -0700 drm/msm: Crashdump support for sparse In this case, we need to iterate the VMAs looking for ones with MSM_VMA_DUMP flag. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661504/ commit 4570dbb8a62410862528fe80cebad4ad4fdd9f5e Author: Rob Clark Date: Sun Jun 29 13:13:09 2025 -0700 drm/msm: rd dumping prep for sparse mappings Similar to the previous commit, add support for dumping partial mappings. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661514/ commit 757cff73e122666fae96eb0be567f6897c6c853c Author: Rob Clark Date: Sun Jun 29 13:13:08 2025 -0700 drm/msm: Crashdump prep for sparse mappings In this case, userspace could request dumping partial GEM obj mappings. Also drop use of should_dump() helper, which really only makes sense in the old submit->bos[] table world. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661496/ commit b58e12a66e47eaf95b31bbefbc260e5a0b3e638c Author: Rob Clark Date: Sun Jun 29 13:13:07 2025 -0700 drm/msm: Add _NO_SHARE flag Buffers that are not shared between contexts can share a single resv object. This way drm_gpuvm will not track them as external objects, and submit-time validating overhead will be O(1) for all N non-shared BOs, instead of O(n). Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661497/ commit 6a4d287a1ae6e49f8ef57fcb2a512c2b0bbef966 Author: Rob Clark Date: Sun Jun 29 13:13:06 2025 -0700 drm/msm: Mark VM as unusable on GPU hangs If userspace has opted-in to VM_BIND, then GPU hangs and VM_BIND errors will mark the VM as unusable. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661499/ commit feb8ef4636a457a1fd916a3ae575f552935e69b9 Author: Rob Clark Date: Sun Jun 29 13:13:05 2025 -0700 drm/msm: Add opt-in for VM_BIND Add a SET_PARAM for userspace to request to manage to the VM itself, instead of getting a kernel managed VM. In order to transition to a userspace managed VM, this param must be set before any mappings are created. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661494/ commit 6bf32afd37eb6806403eff8b8e5c85ccf5723c9b Author: Rob Clark Date: Sun Jun 29 13:13:04 2025 -0700 drm/msm: Lazily create context VM In the next commit, a way for userspace to opt-in to userspace managed VM is added. For this to work, we need to defer creation of the VM until it is needed. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661490/ commit 5b5582c6b8845cb11e7c62443b0b243953f716da Author: Rob Clark Date: Sun Jun 29 13:13:03 2025 -0700 drm/msm: Drop queued submits on lastclose() If we haven't written the submit into the ringbuffer yet, then drop it. The submit still retires through the normal path, to preserve fence signalling order, but we can skip the IB's to userspace cmdstream. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661489/ commit 7e34b8f6ed1e2d705668959cebd5aef3d5ba1b8b Author: Rob Clark Date: Sun Jun 29 13:13:02 2025 -0700 drm/msm: Rename msm_gem_vma_purge() -> _unmap() This is a more descriptive name. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661487/ commit dbbde63c9e9d472743a88f975baac412ba93f29d Author: Rob Clark Date: Sun Jun 29 13:13:01 2025 -0700 drm/msm: Add PRR support Add PRR (Partial Resident Region) is a bypass address which make GPU writes go to /dev/null and reads return zero. This is used to implement vulkan sparse residency. To support PRR/NULL mappings, we allocate a page to reserve a physical address which we know will not be used as part of a GEM object, and configure the SMMU to use this address for PRR/NULL mappings. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661486/ commit 2c7ad9925523f644fe808b243921ebd5c01590e5 Author: Rob Clark Date: Sun Jun 29 13:13:00 2025 -0700 drm/msm: Add mmu support for non-zero offset Only needs to be supported for iopgtables mmu, the other cases are either only used for kernel managed mappings (where offset is always zero) or devices which do not support sparse bindings. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661501/ commit 62a28e272b87aee1b225942cf80505da1e220def Author: Rob Clark Date: Sun Jun 29 13:12:59 2025 -0700 drm/msm: Split out helper to get iommu prot flags We'll re-use this in the vm_bind path. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661484/ commit 37889600f58ea554943d48a86e30f635005f6712 Author: Rob Clark Date: Sun Jun 29 13:12:58 2025 -0700 drm/msm: Use drm_gpuvm types more Most of the driver code doesn't need to reach in to msm specific fields, so just use the drm_gpuvm/drm_gpuva types directly. This should hopefully improve commonality with other drivers and make the code easier to understand. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661483/ commit fe4952b5f27cca5d143d3de249562d4cc984c1d6 Author: Rob Clark Date: Sun Jun 29 13:12:57 2025 -0700 drm/msm: Convert vm locking Convert to using the gpuvm's r_obj for serializing access to the VM. This way we can use the drm_exec helper for dealing with deadlock detection and backoff. This will let us deal with upcoming locking order conflicts with the VM_BIND implmentation (ie. in some scenarious we need to acquire the obj lock first, for ex. to iterate all the VMs an obj is bound in, and in other scenarious we need to acquire the VM lock first). Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661478/ commit 111fdd2198e63b1e19ce015d95692d27bf6ce3fa Author: Rob Clark Date: Sun Jun 29 13:12:56 2025 -0700 drm/msm: drm_gpuvm conversion Now that we've realigned deletion and allocation, switch over to using drm_gpuvm/drm_gpuva. This allows us to support multiple VMAs per BO per VM, to allow mapping different parts of a single BO at different virtual addresses, which is a key requirement for sparse/VM_BIND. This prepares us for using drm_gpuvm to translate a batch of MAP/ MAP_NULL/UNMAP operations from userspace into a sequence of map/remap/ unmap steps for updating the page tables. Since, unlike our prior vm/vma setup, with drm_gpuvm the vm_bo holds a reference to the GEM object. To prevent reference loops causing us to leak all GEM objects, we implicitly tear down the mapping when the GEM handle is close or when the obj is unpinned. Which means the submit needs to also hold a reference to the vm_bo, to prevent the VMA from being torn down while the submit is in-flight. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661479/ commit cdd73b1666079a73d061396f361df55d59fe96e6 Author: Ariel Otilibili Date: Wed Jul 2 12:00:21 2025 +0200 uapi: fix broken link in linux/capability.h The link to the libcap library is outdated. Instead, use a link to the libcap2 library. As well, give the complete reference of the POSIX compliance. Signed-off-by: Ariel Otilibili Acked-by: Andrew G. Morgan Reviewed-by: Paul Moore Signed-off-by: Serge Hallyn commit 2fca750160f29015ab1109bb478537a4e415f7cd Author: Sakari Ailus Date: Fri Jul 4 10:54:47 2025 +0300 spi: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250704075447.3221784-1-sakari.ailus@linux.intel.com Signed-off-by: Mark Brown commit 12826a49f029cd7ed794b1973ee31922f0e08e6f Merge: 571defe0dff3f1 2bd9648d5a8d32 Author: Mark Brown Date: Fri Jul 4 22:42:36 2025 +0100 treewide: Remove redundant Merge series from Sakari Ailus : Late last year I posted a set to switch to __pm_runtime_mark_last_busy() and gradually get rid of explicit pm_runtime_mark_last_busy() calls in drivers, embedding them in the appropriate pm_runtime_*autosuspend*() calls. The overall feedback I got at the time was that this is an unnecessary intermediate step, and removing the pm_runtime_mark_last_busy() calls can be done after adding them to the relevant Runtime PM autosuspend related functions. commit 2bd9648d5a8d329ca734ca2c273a80934867471e Author: Sakari Ailus Date: Fri Jul 4 10:54:59 2025 +0300 ASoC: SOF: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Acked-by: Peter Ujfalusi Link: https://patch.msgid.link/20250704075459.3222908-1-sakari.ailus@linux.intel.com Signed-off-by: Mark Brown commit e879f14d88c8ce4ecb647d80983f74b2fdd9f18b Author: Sakari Ailus Date: Fri Jul 4 10:54:58 2025 +0300 ASoC: component: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250704075458.3222817-1-sakari.ailus@linux.intel.com Signed-off-by: Mark Brown commit 077e700cd709b9a0334bd442a1a4090c9de0d152 Author: Sakari Ailus Date: Fri Jul 4 10:54:57 2025 +0300 ASoC: Intel: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250704075457.3222746-1-sakari.ailus@linux.intel.com Signed-off-by: Mark Brown commit bbe5e3c433a34e7f7bc762c390abb38205f821c5 Author: Sakari Ailus Date: Fri Jul 4 10:54:56 2025 +0300 ASoC: codecs: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250704075456.3222642-1-sakari.ailus@linux.intel.com Signed-off-by: Mark Brown commit 9069141d1d9c585a20e43037c2f9c00d9d3fc9eb Author: Sakari Ailus Date: Fri Jul 4 10:54:55 2025 +0300 ASoC: atmel: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250704075455.3222541-1-sakari.ailus@linux.intel.com Signed-off-by: Mark Brown commit 571defe0dff3f1e4180bd0db79283d3d5bf74a71 Author: Peng Fan Date: Fri Jul 4 21:09:06 2025 +0800 ASoC: codec: rockchip_sai: Remove including of_gpio.h of_gpio.h is deprecated. And there is no user in this driver using API in of_gpio.h, so remove it. Signed-off-by: Peng Fan Acked-by: Nicolas Frattaroli Link: https://patch.msgid.link/20250704130906.1207134-1-peng.fan@nxp.com Signed-off-by: Mark Brown commit 8ac37c88f991257215400ad30ee9087dbc7c0a1b Author: Rob Clark Date: Sun Jun 29 13:12:55 2025 -0700 drm/msm: Refcount framebuffer pins We were already keeping a refcount of # of prepares (pins), to clear the iova array. Use that to avoid unpinning the iova until the last cleanup (unpin). This way, when msm_gem_unpin_iova() actually tears down the mapping, we won't have problems if the fb is being scanned out on another display (for example). Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661477/ commit 4d0f62e4fe1072bc49eaf2677e2fb877e4e68f64 Author: Rob Clark Date: Sun Jun 29 13:12:54 2025 -0700 drm/msm: Stop passing vm to msm_framebuffer The fb only deals with kms->vm, so make that explicit. This will start letting us refcount the # of times the fb is pinned, so we can only unpin the vma after last user of the fb is done. Having a single reference count really only works if there is only a single vm. Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661476/ commit 001ddc857c5ba1b093b289d2f52002bcbe95d177 Author: Rob Clark Date: Sun Jun 29 13:12:53 2025 -0700 drm/msm: Don't close VMAs on purge Previously we'd also tear down the VMA, making the address space available again. But with drm_gpuvm conversion, this would require holding the locks of all VMs the GEM object is mapped in. Which is problematic for the shrinker. Instead just let the VMA hang around until the GEM object is freed. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661472/ commit b5e7a2f1a396f3cf80800a215878183059c3808e Author: Rob Clark Date: Sun Jun 29 13:12:52 2025 -0700 drm/msm: Collapse vma close and delete This fits better drm_gpuvm/drm_gpuva. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661470/ commit da0e1407beb3a40e1b78418b257b849befb24bc6 Author: Rob Clark Date: Sun Jun 29 13:12:51 2025 -0700 drm/msm: Collapse vma allocation and initialization Now that we've dropped vram carveout support, we can collapse vma allocation and initialization. This better matches how things work with drm_gpuvm. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661471/ commit eab7766c79fd472d33a3a73a0d301cfe8a7c7246 Author: Rob Clark Date: Sun Jun 29 13:12:50 2025 -0700 drm/msm: Remove vram carveout support It is standing in the way of drm_gpuvm / VM_BIND support. Not to mention frequently broken and rarely tested. And I think only needed for a 10yr old not quite upstream SoC (msm8974). Maybe we can add support back in later, but I'm doubtful. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661467/ commit 057e55f337c5bb2aecc8967dc045c266a4e6c49d Author: Rob Clark Date: Sun Jun 29 13:12:49 2025 -0700 drm/msm: Rename msm_gem_address_space -> msm_gem_vm Re-aligning naming to better match drm_gpuvm terminology will make things less confusing at the end of the drm_gpuvm conversion. This is just rename churn, no functional change. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661466/ commit fd05abf3fbe8b2702c5a90f791a4ab5406ffb48c Author: Rob Clark Date: Sun Jun 29 13:12:48 2025 -0700 drm/msm: Improve msm_context comments Just some tidying up. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661461/ commit 0594e2de62f696d62ae84d043d81c887ac00e2d1 Author: Rob Clark Date: Sun Jun 29 13:12:47 2025 -0700 drm/msm: Rename msm_file_private -> msm_context This is a more descriptive name. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661459/ commit 02070f04987524caf77d4bf4c94ebceb783b7bcc Author: Rob Clark Date: Sun Jun 29 13:12:46 2025 -0700 drm/gem: Add ww_acquire_ctx support to drm_gem_lru_scan() If the callback is going to have to attempt to grab more locks, it is useful to have an ww_acquire_ctx to avoid locking order problems. Why not use the drm_exec helper instead? Mainly because (a) where ww_acquire_init() is called is awkward, and (b) we don't really need to retry after backoff, we can just move on to the next object. Signed-off-by: Rob Clark Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661463/ commit 471920ce25d50bb39bfdaf3c3d9bc9dde30fa265 Author: Rob Clark Date: Sun Jun 29 13:12:45 2025 -0700 drm/gpuvm: Add locking helpers For UNMAP/REMAP steps we could be needing to lock objects that are not explicitly listed in the VM_BIND ioctl in order to tear-down unmapped VAs. These helpers handle locking/preparing the needed objects. Note that these functions do not strictly require the VM changes to be applied before the next drm_gpuvm_sm_map_lock()/_unmap_lock() call. In the case that VM changes from an earlier drm_gpuvm_sm_map()/_unmap() call result in a differing sequence of steps when the VM changes are actually applied, it will be the same set of GEM objects involved, so the locking is still correct. v2: Rename to drm_gpuvm_sm_*_exec_locked() [Danilo] v3: Expand comments to show expected usage, and explain how the usage is safe in the case of overlapping driver VM_BIND ops. Signed-off-by: Rob Clark Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Acked-by: Danilo Krummrich Patchwork: https://patchwork.freedesktop.org/patch/661458/ commit 9d712c50c30fface9b2a64251d9a7ac5fa7d3c4a Author: Rob Clark Date: Sun Jun 29 13:12:44 2025 -0700 drm/gpuvm: Fix doc comments Correctly summerize drm_gpuvm_sm_map/unmap, and fix the parameter order and names. Just something I noticed in passing. v2: Don't rename the arg names in prototypes to match function declarations [Danilo] Signed-off-by: Rob Clark Acked-by: Danilo Krummrich Tested-by: Antonino Maniscalco Reviewed-by: Antonino Maniscalco Patchwork: https://patchwork.freedesktop.org/patch/661456/ commit 1c8c354098ea9d4376a58c96ae6b65288a6f15d8 Author: Yuan Chen Date: Fri Jun 27 10:16:43 2025 +0800 drm/msm: Add error handling for krealloc in metadata setup Function msm_ioctl_gem_info_set_metadata() now checks for krealloc failure and returns -ENOMEM, avoiding potential NULL pointer dereference. Explicitly avoids __GFP_NOFAIL due to deadlock risks and allocation constraints. Signed-off-by: Yuan Chen Patchwork: https://patchwork.freedesktop.org/patch/661235/ Signed-off-by: Rob Clark commit 024bd19bab0843f020053793223433eb852b93a2 Author: Akhil P Oommen Date: Mon Jun 23 19:42:08 2025 +0530 drm/msm/adreno: Add Adreno X1-45 support Add support for Adreno X1-45 GPU present Snapdragon X1P42100 series of compute chipsets. This GPU is a smaller version of X1-85 GPU with lower core count and smaller internal memories. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Tested-by: Jens Glathe Tested-by: Aleksandrs Vinarskis # x1-26-100 Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/660217/ Signed-off-by: Rob Clark commit 349d6418201272a32ef75142d95d31069a27a5ba Author: Akhil P Oommen Date: Mon Jun 23 19:42:06 2025 +0530 dt-bindings: opp: adreno: Update regex of OPP entry In some cases, an OPP may have multiple variants to describe the differences in the resources between SKUs. As an example, we may want to vote different peak bandwidths in different SKUs for the same frequency and the OPP node names can have an additional integer suffix to denote this difference like below: opp-666000000-0 { opp-hz = /bits/ 64 <666000000>; opp-level = ; opp-peak-kBps = <8171875>; qcom,opp-acd-level = <0xa82d5ffd>; opp-supported-hw = <0xf>; }; /* Only applicable for SKUs which has 666Mhz as Fmax */ opp-666000000-1 { opp-hz = /bits/ 64 <666000000>; opp-level = ; opp-peak-kBps = <16500000>; qcom,opp-acd-level = <0xa82d5ffd>; opp-supported-hw = <0x10>; }; Update the regex to allow this usecase. Tested-by: Jens Glathe Acked-by: Viresh Kumar Reviewed-by: Krzysztof Kozlowski Tested-by: Aleksandrs Vinarskis # x1-26-100 Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/660213/ Signed-off-by: Rob Clark commit 1c402295c10891988fb2a6fc658e6e95d4852a20 Author: Akhil P Oommen Date: Tue Jul 1 21:50:45 2025 +0530 dt-bindings: power: qcom,rpmpd: add Turbo L5 corner Update the RPMH level definitions to include TURBO_L5 corner. Acked-by: Krzysztof Kozlowski Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/661840/ Signed-off-by: Rob Clark commit 5f5ab8992ee5403e7cbbe919c6d57204e5b60fc6 Author: Akhil P Oommen Date: Tue Jul 1 21:50:44 2025 +0530 drm/msm/adreno: Add speedbin support for X1-85 Add the speedbin table to the X1-85's entry in the catalogue to enable SKU detection. Signed-off-by: Akhil P Oommen Patchwork: https://patchwork.freedesktop.org/patch/661837/ Signed-off-by: Rob Clark commit 3a312a085cb9dee10240847bc20b1976eff45219 Author: Rob Clark Date: Fri Jul 4 10:44:32 2025 -0700 drm/ci: Uprev igt Pull in igt updates that are a dependency for VM_BIND, and will reduce msm_mapping flakes. Skip msm_mapping@memptrs on sc7180 (the test should be checking for preemption support, and skipping if it is not supported). Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/77 Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/662524/ commit b41c1d8d07906786c60893980d52688f31d114a6 Author: Eric Biggers Date: Fri Jul 4 00:03:22 2025 -0700 fscrypt: Don't use problematic non-inline crypto engines Make fscrypt no longer use Crypto API drivers for non-inline crypto engines, even when the Crypto API prioritizes them over CPU-based code (which unfortunately it often does). These drivers tend to be really problematic, especially for fscrypt's workload. This commit has no effect on inline crypto engines, which are different and do work well. Specifically, exclude drivers that have CRYPTO_ALG_KERN_DRIVER_ONLY or CRYPTO_ALG_ALLOCATES_MEMORY set. (Later, CRYPTO_ALG_ASYNC should be excluded too. That's omitted for now to keep this commit backportable, since until recently some CPU-based code had CRYPTO_ALG_ASYNC set.) There are two major issues with these drivers: bugs and performance. First, these drivers tend to be buggy. They're fundamentally much more error-prone and harder to test than the CPU-based code. They often don't get tested before kernel releases, and even if they do, the crypto self-tests don't properly test these drivers. Released drivers have en/decrypted or hashed data incorrectly. These bugs cause issues for fscrypt users who often didn't even want to use these drivers, e.g.: - https://github.com/google/fscryptctl/issues/32 - https://github.com/google/fscryptctl/issues/9 - https://lore.kernel.org/r/PH0PR02MB731916ECDB6C613665863B6CFFAA2@PH0PR02MB7319.namprd02.prod.outlook.com These drivers have also similarly caused issues for dm-crypt users, including data corruption and deadlocks. Since Linux v5.10, dm-crypt has disabled most of them by excluding CRYPTO_ALG_ALLOCATES_MEMORY. Second, these drivers tend to be *much* slower than the CPU-based code. This may seem counterintuitive, but benchmarks clearly show it. There's a *lot* of overhead associated with going to a hardware driver, off the CPU, and back again. To prove this, I gathered as many systems with this type of crypto engine as I could, and I measured synchronous encryption of 4096-byte messages (which matches fscrypt's workload): Intel Emerald Rapids server: AES-256-XTS: xts-aes-vaes-avx512 16171 MB/s [CPU-based, Vector AES] qat_aes_xts 289 MB/s [Offload, Intel QuickAssist] Qualcomm SM8650 HDK: AES-256-XTS: xts-aes-ce 4301 MB/s [CPU-based, ARMv8 Crypto Extensions] xts-aes-qce 73 MB/s [Offload, Qualcomm Crypto Engine] i.MX 8M Nano LPDDR4 EVK: AES-256-XTS: xts-aes-ce 647 MB/s [CPU-based, ARMv8 Crypto Extensions] xts(ecb-aes-caam) 20 MB/s [Offload, CAAM] AES-128-CBC-ESSIV: essiv(cbc-aes-caam,sha256-lib) 23 MB/s [Offload, CAAM] STM32MP157F-DK2: AES-256-XTS: xts-aes-neonbs 13.2 MB/s [CPU-based, ARM NEON] xts(stm32-ecb-aes) 3.1 MB/s [Offload, STM32 crypto engine] AES-128-CBC-ESSIV: essiv(cbc-aes-neonbs,sha256-lib) 14.7 MB/s [CPU-based, ARM NEON] essiv(stm32-cbc-aes,sha256-lib) 3.2 MB/s [Offload, STM32 crypto engine] Adiantum: adiantum(xchacha12-arm,aes-arm,nhpoly1305-neon) 52.8 MB/s [CPU-based, ARM scalar + NEON] So, there was no case in which the crypto engine was even *close* to being faster. On the first three, which have AES instructions in the CPU, the CPU was 30 to 55 times faster (!). Even on STM32MP157F-DK2 which has a Cortex-A7 CPU that doesn't have AES instructions, AES was over 4 times faster on the CPU. And Adiantum encryption, which is what actually should be used on CPUs like that, was over 17 times faster. Other justifications that have been given for these non-inline crypto engines (almost always coming from the hardware vendors, not actual users) don't seem very plausible either: - The crypto engine throughput could be improved by processing multiple requests concurrently. Currently irrelevant to fscrypt, since it doesn't do that. This would also be complex, and unhelpful in many cases. 2 of the 4 engines I tested even had only one queue. - Some of the engines, e.g. STM32, support hardware keys. Also currently irrelevant to fscrypt, since it doesn't support these. Interestingly, the STM32 driver itself doesn't support this either. - Free up CPU for other tasks and/or reduce energy usage. Not very plausible considering the "short" message length, driver overhead, and scheduling overhead. There's just very little time for the CPU to do something else like run another task or enter low-power state, before the message finishes and it's time to process the next one. - Some of these engines resist power analysis and electromagnetic attacks, while the CPU-based crypto generally does not. In theory, this sounds great. In practice, if this benefit requires the use of an off-CPU offload that massively regresses performance and has a low-quality, buggy driver, the price for this hardening (which is not relevant to most fscrypt users, and tends to be incomplete) is just too high. Inline crypto engines are much more promising here, as are on-CPU solutions like RISC-V High Assurance Cryptography. Fixes: b30ab0e03407 ("ext4 crypto: add ext4 encryption facilities") Cc: stable@vger.kernel.org Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250704070322.20692-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 57b15e9260a31438e91cf83dbfcb63333b24c684 Author: Eric Biggers Date: Thu Jul 3 19:39:58 2025 -0700 lib/crypto: x86/sha256: Remove unnecessary checks for nblocks==0 Since sha256_blocks() is called only with nblocks >= 1, remove unnecessary checks for nblocks == 0 from the x86 SHA-256 assembly code. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250704023958.73274-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a8c60a9aca778d7fd22d6c9b1af702d6f952b87f Author: Eric Biggers Date: Thu Jul 3 19:39:57 2025 -0700 lib/crypto: x86/sha256: Move static_call above kernel-mode FPU section As I did for sha512_blocks(), reorganize x86's sha256_blocks() to be just a static_call. To achieve that, for each assembly function add a C function that handles the kernel-mode FPU section and fallback. While this increases total code size slightly, the amount of code actually executed on a given system does not increase, and it is slightly more efficient since it eliminates the extra static_key. It also makes the assembly functions be called with standard direct calls instead of static calls, eliminating the need for ANNOTATE_NOENDBR. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250704023958.73274-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b34c9803aabd85189ffacc0d3cdb9ce4515c2b4d Author: Eric Biggers Date: Mon Jun 30 09:06:45 2025 -0700 lib/crypto: sha256: Document the SHA-224 and SHA-256 API Add kerneldoc comments, consistent with the kerneldoc comments of the SHA-384 and SHA-512 API. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-15-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 773d2b99bb76131f65f98828221142ccd2cec856 Author: Eric Biggers Date: Mon Jun 30 09:06:44 2025 -0700 lib/crypto: sha256: Sync sha256_update() with sha512_update() The BLOCK_HASH_UPDATE_BLOCKS macro is difficult to read. For now, let's just write the update explicitly in the straightforward way, mirroring sha512_update(). It's possible that we'll bring back a macro for this later, but it needs to be properly justified and hopefully a bit more readable. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-14-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e96cb9507f2d8ba150d417dcd283204564945831 Author: Eric Biggers Date: Mon Jun 30 09:06:43 2025 -0700 lib/crypto: sha256: Consolidate into single module Consolidate the CPU-based SHA-256 code into a single module, following what I did with SHA-512: - Each arch now provides a header file lib/crypto/$(SRCARCH)/sha256.h, replacing lib/crypto/$(SRCARCH)/sha256.c. The header defines sha256_blocks() and optionally sha256_mod_init_arch(). It is included by lib/crypto/sha256.c, and thus the code gets built into the single libsha256 module, with proper inlining and dead code elimination. - sha256_blocks_generic() is moved from lib/crypto/sha256-generic.c into lib/crypto/sha256.c. It's now a static function marked with __maybe_unused, so the compiler automatically eliminates it in any cases where it's not used. - Whether arch-optimized SHA-256 is buildable is now controlled centrally by lib/crypto/Kconfig instead of by lib/crypto/$(SRCARCH)/Kconfig. The conditions for enabling it remain the same as before, and it remains enabled by default. - Any additional arch-specific translation units for the optimized SHA-256 code (such as assembly files) are now compiled by lib/crypto/Makefile instead of lib/crypto/$(SRCARCH)/Makefile. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-13-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9f9846a72eec406db9e1eadcad1dd5e90aa0f355 Author: Eric Biggers Date: Mon Jun 30 09:06:42 2025 -0700 lib/crypto: sha256: Remove sha256_is_arch_optimized() Remove sha256_is_arch_optimized(), since it is no longer used. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-12-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 07f090959bba437dd531bd2e08440ec6bf588878 Author: Eric Biggers Date: Mon Jun 30 09:06:41 2025 -0700 crypto: sha256 - Use same state format as legacy drivers Make the export and import functions for the sha224, sha256, hmac(sha224), and hmac(sha256) shash algorithms use the same format as the padlock-sha and nx-sha256 drivers, as required by Herbert. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-11-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e0cd3716910385ba1ccbd433c860516cf806fc71 Author: Eric Biggers Date: Mon Jun 30 09:06:40 2025 -0700 crypto: sha256 - Wrap library and add HMAC support Like I did for crypto/sha512.c, rework crypto/sha256.c to simply wrap the normal library functions instead of accessing the low-level arch- optimized and generic block functions directly. Also add support for HMAC-SHA224 and HMAC-SHA256, again just wrapping the library functions. Since the replacement crypto_shash algorithms are implemented using the (potentially arch-optimized) library functions, give them driver names ending with "-lib" rather than "-generic". Update crypto/testmgr.c and a couple odd drivers to take this change in driver name into account. Besides the above cases which are accounted for, there are no known cases where the driver names were being depended on. There is potential for confusion for people manually checking /proc/crypto (e.g. https://lore.kernel.org/r/9e33c893-2466-4d4e-afb1-966334e451a2@linux.ibm.com/), but really people just need to get used to the driver name not being meaningful for the software algorithms. Historically, the optimized code was disabled by default, so there was some purpose to checking whether it was enabled or not. However, this is now fixed for all SHA-2 algorithms, and the library code just always does the right thing. E.g. if the CPU supports SHA-256 instructions, they are used. This change does also mean that the generic partial block handling code in crypto/shash.c, which got added in 6.16, no longer gets used. But that's fine; the library has to implement the partial block handling anyway, and it's better to do it in the library since the block size and other properties of the algorithm are all fixed at compile time there, resulting in more streamlined code. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 077833cd600908359391bd22d5350c9106ea238c Author: Eric Biggers Date: Mon Jun 30 09:06:39 2025 -0700 lib/crypto: sha256: Add HMAC-SHA224 and HMAC-SHA256 support Since HMAC support is commonly needed and is fairly simple, include it as a first-class citizen of the SHA-256 library. The API supports both incremental and one-shot computation, and either preparing the key ahead of time or just using a raw key. The implementation is much more streamlined than crypto/hmac.c. I've kept it consistent with the HMAC-SHA384 and HMAC-SHA512 code as much as possible. Testing of these functions will be via sha224_kunit and sha256_kunit, added by a later commit. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 4c855d5069ee2edbcf62fafc7f1a5d4cfea1bce1 Author: Eric Biggers Date: Mon Jun 30 09:06:38 2025 -0700 lib/crypto: sha256: Propagate sha256_block_state type to implementations The previous commit made the SHA-256 compression function state be strongly typed, but it wasn't propagated all the way down to the implementations of it. Do that now. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b86ced882b8e667758afddffd8d6354197842110 Author: Eric Biggers Date: Mon Jun 30 09:06:37 2025 -0700 lib/crypto: sha256: Make library API use strongly-typed contexts Currently the SHA-224 and SHA-256 library functions can be mixed arbitrarily, even in ways that are incorrect, for example using sha224_init() and sha256_final(). This is because they operate on the same structure, sha256_state. Introduce stronger typing, as I did for SHA-384 and SHA-512. Also as I did for SHA-384 and SHA-512, use the names *_ctx instead of *_state. The *_ctx names have the following small benefits: - They're shorter. - They avoid an ambiguity with the compression function state. - They're consistent with the well-known OpenSSL API. - Users usually name the variable 'sctx' anyway, which suggests that *_ctx would be the more natural name for the actual struct. Therefore: update the SHA-224 and SHA-256 APIs, implementation, and calling code accordingly. In the new structs, also strongly-type the compression function state. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6fa4b292204b15e0e269a9fd33bc99b5e36b6883 Author: Eric Biggers Date: Mon Jun 30 09:06:36 2025 -0700 lib/crypto: sha256: Add sha224() and sha224_update() Add a one-shot SHA-224 computation function sha224(), for consistency with sha256(), sha384(), and sha512() which all already exist. Similarly, add sha224_update(). While for now it's identical to sha256_update(), omitting it makes the API harder to use since users have to "know" which functions are the same between SHA-224 and SHA-256. Also, this is a prerequisite for using different context types for each. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9f97707bdb1e479ea15e14e5525164f5f1128e97 Author: Eric Biggers Date: Mon Jun 30 09:06:35 2025 -0700 lib/crypto: sha256: Remove sha256_blocks_simd() Instead of having both sha256_blocks_arch() and sha256_blocks_simd(), instead have just sha256_blocks_arch() which uses the most efficient implementation that is available in the calling context. This is simpler, as it reduces the API surface. It's also safer, since sha256_blocks_arch() just works in all contexts, including contexts where the FPU/SIMD/vector registers cannot be used. This doesn't mean that SHA-256 computations *should* be done in such contexts, but rather we should just do the right thing instead of corrupting a random task's registers. Eliminating this footgun and simplifying the code is well worth the very small performance cost of doing the check. Note: in the case of arm and arm64, what used to be sha256_blocks_arch() is renamed back to its original name of sha256_block_data_order(). sha256_blocks_arch() is now used for the higher-level dispatch function. This renaming also required an update to lib/crypto/arm64/sha512.h, since sha2-armv8.pl is shared by both SHA-256 and SHA-512. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 3135d5be7c27841526d98150c245304ab312e9f4 Author: Eric Biggers Date: Mon Jun 30 09:06:34 2025 -0700 lib/crypto: sha256: Reorder some code First, move the declarations of sha224_init/update/final to be just above the corresponding SHA-256 code, matching the order that I used for SHA-384 and SHA-512. In sha2.h, the end result is that SHA-224, SHA-256, SHA-384, and SHA-512 are all in the logical order. Second, move sha224_block_init() and sha256_block_init() to be just below crypto_sha256_state. In later changes, these functions as well as struct crypto_sha256_state will no longer be used by the library functions. They'll remain just for some legacy offload drivers. This gets them into a logical place in the file for that. No code changes other than reordering. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 85de1929e17e71fafc51473ba1d14101e80180f5 Author: Eric Biggers Date: Mon Jun 30 09:06:33 2025 -0700 cxl/test: Simplify fw_buf_checksum_show() First, just use sha256() instead of a sequence of sha256_init(), sha256_update(), and sha256_final(). The result is the same. Second, use *phN instead of open-coding the conversion of bytes to hex. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1cf5cdf8d2ae3a55cc4890c02feb5da18e423e5d Author: Eric Biggers Date: Mon Jun 30 09:06:32 2025 -0700 libceph: Rename hmac_sha256() to ceph_hmac_sha256() Rename hmac_sha256() to ceph_hmac_sha256(), to avoid a naming conflict with the upcoming hmac_sha256() library function. This code will be able to use the HMAC-SHA256 library, but that's left for a later commit. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160645.3198-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 860a831de138a7ad6bc86019adaf10eb84c02655 Author: Robin Murphy Date: Wed Jul 2 15:08:13 2025 +0100 perf/arm: Add missing .suppress_bind_attrs PMU drivers should set .suppress_bind_attrs so that userspace is denied the opportunity to pull the driver out from underneath an in-use PMU (with predictably unpleasant consequences). Somehow both the CMN and NI drivers have managed to miss this; put that right. Signed-off-by: Robin Murphy Reviewed-by: Leo Yan Link: https://lore.kernel.org/r/acd48c341b33b96804a3969ee00b355d40c546e2.1751465293.git.robin.murphy@arm.com Signed-off-by: Will Deacon commit a7bfae21457c3e46d16868c0bc923e509b4a83e2 Author: Robin Murphy Date: Fri Jun 27 18:42:39 2025 +0100 perf/arm-cmn: Reduce stack usage during discovery Arnd reports that Clang's aggressive inlining of arm_cmn_discover() can lead to stack frame size warnings, and while we could simply prevent such inlining to hide the issue, it seems more productive to actually heed the warning and do something about the overall stack footprint. The xp_region array is already rather large, and CMN_MAX_XPS might only grow larger in future, however it only serves as a convenience to save repeating the first level's worth of register reads in the second pass of discovery. There's no performance concern here, and it only takes a small tweak to the flow to re-extract the offsets instead of stashing them, so let's just do that and save several hundred bytes of stack. Reported-by: Arnd Bergmann Signed-off-by: Robin Murphy Reviewed-and-tested-by: Ilkka Koskinen Link: https://lore.kernel.org/r/e7dd41bf0f1b098e2e4b01ef91318a4b272abff8.1751046159.git.robin.murphy@arm.com Signed-off-by: Will Deacon commit b6e37b27bf6802fd4ec1446e05058da4e1ddce64 Author: Colin Ian King Date: Wed Jun 11 14:39:17 2025 +0100 perf: imx9_perf: make the read-only array mask static const Don't populate the read-only array mask on the stack at run time, instead make it static const. Signed-off-by: Colin Ian King Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250611133917.170888-1-colin.i.king@gmail.com Signed-off-by: Will Deacon commit 8b177e9a4ecd09f2ae15b952cd88a0a3344ee5a0 Author: Zhiyuan Dai Date: Thu May 22 11:21:22 2025 +0800 perf/arm-cmn: Broaden module description for wider interconnect support The current MODULE_DESCRIPTION only mentions CMN-600, but this driver now supports several Arm mesh interconnects including CMN-650, CMN-700, CI-700, and CMN-S3. Update the MODULE_DESCRIPTION to reflect the expanded scope. Signed-off-by: Zhiyuan Dai Link: https://lore.kernel.org/r/20250522032122.949373-1-daizhiyuan@phytium.com.cn Signed-off-by: Will Deacon commit c872d7c837382517c51a76dfdcf550332cfab231 Author: Robin Murphy Date: Tue May 13 16:38:58 2025 +0100 perf/arm-ni: Set initial IRQ affinity While we do request our IRQs with the right flags to stop their affinity changing unexpectedly, we forgot to actually set it to start with. Oops. Cc: stable@vger.kernel.org Fixes: 4d5a7680f2b4 ("perf: Add driver for Arm NI-700 interconnect PMU") Signed-off-by: Robin Murphy Tested-by: Shouping Wang Link: https://lore.kernel.org/r/614ced9149ee8324e58930862bd82cbf46228d27.1747149165.git.robin.murphy@arm.com Signed-off-by: Will Deacon commit 769fced9433ec0c12a3815ed1001e90b511da5cf Merge: 427ceac823e588 c61e94e5e4e6bc Author: Mark Brown Date: Fri Jul 4 16:55:48 2025 +0100 treewide: Remove redundant Merge series from Sakari Ailus : Late last year I posted a set to switch to __pm_runtime_mark_last_busy() and gradually get rid of explicit pm_runtime_mark_last_busy() calls in drivers, embedding them in the appropriate pm_runtime_*autosuspend*() calls. The overall feedback I got at the time was that this is an unnecessary intermediate step, and removing the pm_runtime_mark_last_busy() calls can be done after adding them to the relevant Runtime PM autosuspend related functions. The latter part has been done and is present in Rafael's tree at the moment, also see : git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git \ pm-runtime-6.17-rc1 commit 10d77a8c60b2b117868a64875a55c4c8db6f1f2e Author: Uday Shankar Date: Thu Jul 3 23:41:08 2025 -0600 ublk: introduce and use ublk_set_canceling helper For performance reasons (minimizing the number of cache lines accessed in the hot path), we store the "canceling" state redundantly - there is one flag in the device, which can be considered the source of truth, and per-queue copies of that flag. This redundancy can cause confusion, and opens the door to bugs where the state is set inconsistently. Try to guard against these bugs by introducing a ublk_set_canceling helper which is the sole mutator of both the per-device and per-queue canceling state. This helper always sets the state consistently. Use the helper in all places where we need to modify the canceling state. No functional changes are expected. Signed-off-by: Uday Shankar Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250703-ublk_too_many_quiesce-v2-2-3527b5339eeb@purestorage.com Signed-off-by: Jens Axboe commit 2fa9c93035e17380cafa897ee1a4d503881a3770 Author: Uday Shankar Date: Thu Jul 3 23:41:07 2025 -0600 ublk: speed up ublk server exit handling Recently, we've observed a few cases where a ublk server is able to complete restart more quickly than the driver can process the exit of the previous ublk server. The new ublk server comes up, attempts recovery of the preexisting ublk devices, and observes them still in state UBLK_S_DEV_LIVE. While this is possible due to the asynchronous nature of io_uring cleanup and should therefore be handled properly in the ublk server, it is still preferable to make ublk server exit handling faster if possible, as we should strive for it to not be a limiting factor in how fast a ublk server can restart and provide service again. Analysis of the issue showed that the vast majority of the time spent in handling the ublk server exit was in calls to blk_mq_quiesce_queue, which is essentially just a (relatively expensive) call to synchronize_rcu. The ublk server exit path currently issues an unnecessarily large number of calls to blk_mq_quiesce_queue, for two reasons: 1. It tries to call blk_mq_quiesce_queue once per ublk_queue. However, blk_mq_quiesce_queue targets the request_queue of the underlying ublk device, of which there is only one. So the number of calls is larger than necessary by a factor of nr_hw_queues. 2. In practice, it calls blk_mq_quiesce_queue _more_ than once per ublk_queue. This is because of a data race where we read ubq->canceling without any locking when deciding if we should call ublk_start_cancel. It is thus possible for two calls to ublk_uring_cmd_cancel_fn against the same ublk_queue to both call ublk_start_cancel against the same ublk_queue. Fix this by making the "canceling" flag a per-device state. This actually matches the existing code better, as there are several places where the flag is set or cleared for all queues simultaneously, and there is the general expectation that cancellation corresponds with ublk server exit. This per-device canceling flag is then checked under a (new) lock (addressing the data race (2) above), and the queue is only quiesced if it is cleared (addressing (1) above). The result is just one call to blk_mq_quiesce_queue per ublk device. To minimize the number of cache lines that are accessed in the hot path, the per-queue canceling flag is kept. The values of the per-device canceling flag and all per-queue canceling flags should always match. In our setup, where one ublk server handles I/O for 128 ublk devices, each having 24 hardware queues of depth 4096, here are the results before and after this patch, where teardown time is measured from the first call to io_ring_ctx_wait_and_kill to the return from the last ublk_ch_release: before after number of calls to blk_mq_quiesce_queue: 6469 256 teardown time: 11.14s 2.44s There are still some potential optimizations here, but this takes care of a big chunk of the ublk server exit handling delay. Signed-off-by: Uday Shankar Reviewed-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250703-ublk_too_many_quiesce-v2-1-3527b5339eeb@purestorage.com Signed-off-by: Jens Axboe commit 551507e0d0bf32ce1d7d27533c4b98307380804c Author: Alessio Belle Date: Tue Jun 24 16:01:31 2025 +0100 drm/imagination: Clear runtime PM errors while resetting the GPU The runtime PM might be left in error state if one of the callbacks returned an error, e.g. if the (auto)suspend callback failed following a firmware crash. When that happens, any further attempt to acquire or release a power reference will then also fail, making it impossible to do anything else with the GPU. The driver logic will eventually reach the reset code. In pvr_power_reset(), replace pvr_power_get() with a new API pvr_power_get_clear() which also attempts to clear any runtime PM error state if acquiring a power reference is not possible. Signed-off-by: Alessio Belle Reviewed-by: Matt Coster Link: https://lore.kernel.org/r/20250624-clear-rpm-errors-gpu-reset-v1-1-b8ff2ae55aac@imgtec.com Signed-off-by: Matt Coster commit 587c1c00f75565567d1f26a333a3392f7a21c28c Author: Tomeu Vizoso Date: Thu May 22 11:29:40 2025 +0200 arm64: dts: amlogic: Enable the npu node for Alta and VIM3 We now have support in Mesa and everything is ready in distros such as Debian. Signed-off-by: Tomeu Vizoso Link: https://lore.kernel.org/r/20250522092940.3293889-1-tomeu@tomeuvizoso.net Signed-off-by: Neil Armstrong commit fb183c8d7a5a90cdee953701d8a5b92642a2e917 Author: Xianwei Zhao Date: Tue May 27 13:23:33 2025 +0800 dts: arm64: amlogic: add S6 pinctrl node Add pinctrl device to support Amlogic S6. Signed-off-by: Xianwei Zhao Link: https://lore.kernel.org/r/20250527-s6-s7-pinctrl-v3-6-44f6a0451519@amlogic.com Signed-off-by: Neil Armstrong commit bd42a25d696e0d5ccc9e27de388d4ca9ff52f710 Author: Xianwei Zhao Date: Tue May 27 13:23:32 2025 +0800 dts: arm64: amlogic: add S7D pinctrl node Add pinctrl device to support Amlogic S7D. Signed-off-by: Xianwei Zhao Link: https://lore.kernel.org/r/20250527-s6-s7-pinctrl-v3-5-44f6a0451519@amlogic.com Signed-off-by: Neil Armstrong commit 9291207753c733dcd9f1c08749950323f7f071e8 Author: Xianwei Zhao Date: Tue May 27 13:23:31 2025 +0800 dts: arm64: amlogic: add S7 pinctrl node Add pinctrl device to support Amlogic S7. Signed-off-by: Xianwei Zhao Link: https://lore.kernel.org/r/20250527-s6-s7-pinctrl-v3-4-44f6a0451519@amlogic.com Signed-off-by: Neil Armstrong commit b33f8cfb2b4d91c4bb7c16b354138cc205befed2 Author: J. Neuschäfer Date: Fri Jun 13 15:39:14 2025 +0200 arm64: dts: amlogic: Add Ugoos AM3 The Ugoos AM3 is a small set-top box based on the Amlogic S912 SoC, with a board design that is very close to the Q20x development boards. The MMC max-frequency properties are copied from the downstream device tree. https://ugoos.com/ugoos-am3-16g The following functionality has been tested and is known to work: - debug serial port - "update" button inside the case - USB host mode, on all three ports - HDMI video/audio output - eMMC, MicroSD, and SDIO WLAN - S/PDIF audio output - Ethernet - Infrared remote control input The following functionality doesn't seem to work: - USB role switching and device mode on the "OTG" port - case LED Reviewed-by: Martin Blumenstingl Reviewed-by: Neil Armstrong Signed-off-by: J. Neuschäfer Link: https://lore.kernel.org/r/20250613-ugoos-am3-v3-2-f8a43e6bbfdb@posteo.net Signed-off-by: Neil Armstrong commit ef491ab7cbf6a460476a41d8b5dbd8a4394282ba Author: J. Neuschäfer Date: Fri Jun 13 15:39:13 2025 +0200 dt-bindings: arm: amlogic: Add Ugoos AM3 The Ugoos AM3 is a small set-top box based on the Amlogic S912 SoC. https://ugoos.com/ugoos-am3-16g Acked-by: Krzysztof Kozlowski Reviewed-by: Martin Blumenstingl Signed-off-by: J. Neuschäfer Link: https://lore.kernel.org/r/20250613-ugoos-am3-v3-1-f8a43e6bbfdb@posteo.net Signed-off-by: Neil Armstrong commit cd9ef86573b5cca654b6ae7077d637cb422c9b4c Author: Krzysztof Kozlowski Date: Thu Apr 24 10:47:21 2025 +0200 arm64: dts: amlogic: Align wifi node name with bindings Since commit 3c3606793f7e ("dt-bindings: wireless: bcm4329-fmac: Use wireless-controller.yaml schema"), bindings expect 'wifi' as node name: meson-gxm-rbox-pro.dtb: brcmf@1: $nodename:0: 'brcmf@1' does not match '^wifi(@.*)?$' Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250424084721.105113-1-krzysztof.kozlowski@linaro.org Signed-off-by: Neil Armstrong commit ca115d7e754691c0219eec95ec94dbac7f87daef Author: Christian Brauner Date: Thu Jul 3 09:36:41 2025 +0200 tree-wide: s/struct fileattr/struct file_kattr/g Now that we expose struct file_attr as our uapi struct rename all the internal struct to struct file_kattr to clearly communicate that it is a kernel internal struct. This is similar to struct mount_{k}attr and others. Link: https://lore.kernel.org/20250703-restlaufzeit-baurecht-9ed44552b481@brauner Signed-off-by: Christian Brauner commit c03ea34cbf88dd778197a929b3269003567def55 Author: Sunil Khatri Date: Fri Jul 4 13:25:48 2025 +0530 drm/amdgpu: add support of debugfs for mqd information Add debugfs support for mqd for each queue of the client. The address exposed to debugfs could be used to dump the mqd. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250704075548.1549849-5-sunil.khatri@amd.com Signed-off-by: Christian König commit 719b378d371899c8bbaf0ce5f42bf7db4be819f9 Author: Sunil Khatri Date: Fri Jul 4 13:25:47 2025 +0530 drm/amdgpu: add debugfs support for VM pagetable per client Add a debugfs file under the client directory which shares the root page table base address of the VM. This address could be used to dump the pagetable for debug memory issues. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250704075548.1549849-4-sunil.khatri@amd.com Signed-off-by: Christian König commit 1fd45bc21cecea390ab9c21a2406bbbe3eed4b93 Author: Sunil Khatri Date: Fri Jul 4 13:25:46 2025 +0530 drm: add debugfs support on per client-id basis add support to add a directory for each client-id with root at the dri level. Since the clients are unique and not just related to one single drm device, so it makes more sense to add all the client based nodes with root as dri. Also create a debugfs file which show the process information for the client and create a symlink back to the parent drm device from each client. Signed-off-by: Sunil Khatri Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250704075548.1549849-3-sunil.khatri@amd.com Signed-off-by: Christian König commit 348fe34a6186a53acda44a3501d4e5a4f1f5958e Author: Sunil Khatri Date: Fri Jul 4 13:25:45 2025 +0530 drm: move drm based debugfs funcs to drm_debugfs.c Requirement is to create per client-id based directories to hold key debugging information and for that access to root debugfs dentry is need which is not in one place and that information cannot be stored in drm_device. Move the debugfs functionality from drm_drv.c and drm_accel.c to drm_debugfs.c This enables debugfs root node reference directly drm_debugfs.c and hence enable to create per client-id directory. v8: Create drm_accel dentry only if it's config is enabled (Jeff, Hugo) v8: Merge drm_drv and drm_accel debugfs patches (Koenig, Christian) v10: Since we moved drm_debugfs_root, hence to handle drm bridge debugfs add a new function which call drm_bridge_debugfs_params where drm_debugfs_root is accessible. Suggested-by: Christian König Signed-off-by: Sunil Khatri Link: https://lore.kernel.org/r/20250704075548.1549849-2-sunil.khatri@amd.com Reviewed-by: Christian König Signed-off-by: Christian König commit ccfb15b8158c11a8304204aeac354c7b1cfb18a3 Author: Vodapalli, Ravi Kumar Date: Fri Jul 4 16:05:27 2025 +0530 drm/xe/bmg: Add one additional PCI ID One additional PCI ID is added in Bspec for BMG, Add it so that driver recognizes this device with this new ID. Bspec: 68090 Cc: stable@vger.kernel.org # v6.12+ Signed-off-by: Vodapalli, Ravi Kumar Reviewed-by: Shekhar Chauhan Acked-by: Matthew Auld Signed-off-by: Matthew Auld Link: https://lore.kernel.org/r/20250704103527.100178-1-ravi.kumar.vodapalli@intel.com commit cd86e80b77b2f3d9e72c2d27a967b666d2c47a44 Author: Randy Dunlap Date: Tue Jun 17 11:56:11 2025 -0700 drm/msm/dp: add linux/io.h header to fix build errors Add header to pull in readl/writel and friends. This eliminates the following build errors: drivers/gpu/drm/msm/dp/dp_panel.c: In function 'msm_dp_read_link': drivers/gpu/drm/msm/dp/dp_panel.c:33:16: error: implicit declaration of function 'readl_relaxed' [-Wimplicit-function-declaration] 33 | return readl_relaxed(panel->link_base + offset); drivers/gpu/drm/msm/dp/dp_panel.c: In function 'msm_dp_write_link': drivers/gpu/drm/msm/dp/dp_panel.c:43:9: error: implicit declaration of function 'writel' [-Wimplicit-function-declaration] 43 | writel(data, panel->link_base + offset); Fixes: 603fc0fc30bf ("drm/msm/dp: drop the msm_dp_catalog module") Signed-off-by: Randy Dunlap Cc: Stephen Boyd Cc: Dmitry Baryshkov Cc: Dmitry Baryshkov Cc: Dmitry Baryshkov Cc: Rob Clark Cc: linux-arm-msm@vger.kernel.org Cc: freedreno@lists.freedesktop.org Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/659442/ Link: https://lore.kernel.org/r/20250617185611.2965223-1-rdunlap@infradead.org Signed-off-by: Dmitry Baryshkov commit e450952b92f915600bfa88910445341fbbf3e8ca Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:42 2025 +0200 drm/msm/mdss: Add support for SM8750 Add support for the Qualcomm SM8750 platform. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659625/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-13-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit 68baf83364e159720da8b68da3f0fb3f7e34c8fe Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:41 2025 +0200 drm/msm/dpu: Implement LM crossbar for v12.0 DPU v12.0 DPU on SM8750 comes with new LM crossbar that requires each pipe rectangle to be programmed separately in blend stage. Implement support for this along with a new CTL_LAYER_ACTIVE register and setting the blend stage in layer mixer code. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659632/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-12-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit b567e928664626b0716e3a60be0a5f0cef4701c8 Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:40 2025 +0200 drm/msm/dpu: Implement CTL_PIPE_ACTIVE for v12.0 DPU v12.0 DPU on SM8750 comes with new CTL_PIPE_ACTIVE register for selective activation of pipes, which replaces earlier dpu_hw_ctl_setup_blendstage() code path for newer devices. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659630/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-11-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit 8984f97cc857cf64aca7a4104c6dde555a20bc06 Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:39 2025 +0200 drm/msm/dpu: Implement 10-bit color alpha for v12.0 DPU v12.0 DPU on SM8750 comes with 10-bit color alpha. Add register differences and new implementations of setup_alpha_out(), setup_border_color() and setup_blend_config(). Notable changes in v6: Correct fg_alpha shift on new DPU, pointed out by Abel Vesas. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659629/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-10-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit afff6425a3aa5b309b273c9639775203a733a14f Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:38 2025 +0200 drm/msm/dpu: Consistently use u32 instead of uint32_t Linux coding style asks to use kernel types like u32 instead of uint32_t and code already has it in other places, so unify the remaining pieces. Reviewed-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659623/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-9-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit c2577fc1740d3aa89aaf8a7c5d144e7bfb6171bf Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:37 2025 +0200 drm/msm/dpu: Add support for SM8750 Add DPU version v12.0 support for the Qualcomm SM8750 platform. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659622/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-8-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit 80dd5911cbfdc2f6ae904341d41a7a8bd8cc546c Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:36 2025 +0200 drm/msm/dsi: Add support for SM8750 Add support for DSI on Qualcomm SM8750 SoC with notable difference: DSI PHY PLLs, the parents of pixel and byte clocks, cannot be used as parents before DSI PHY is configured, the PLLs are prepared and their initial rate is set. Therefore assigned-clock-parents are not working here and driver is responsible for reparenting clocks with proper procedure: see dsi_clk_init_6g_v2_9(). Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659619/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-7-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit 1337d7ebfb6d083aaf751fcf0d1dab8b98c6eb8f Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:35 2025 +0200 drm/msm/dsi/phy: Add support for SM8750 Add support for DSI PHY v7.0 on Qualcomm SM8750 SoC which comes with an incompatible hardware interface change: ICODE_ACCUM_STATUS_LOW and ALOG_OBSV_BUS_STATUS_1 registers - their offsets were just switched. Currently these registers are not used in the driver, so the easiest is to document both but keep them commented out to avoid conflict. Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659616/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-6-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit 6b93840116df5531fbb4ef470cc9814662532b7c Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:34 2025 +0200 dt-bindings: display/msm: qcom,sm8750-mdss: Add SM8750 Add MDSS/MDP display subsystem for Qualcomm SM8750 SoC, next generation with two revisions up of the IP block comparing to SM8650. Reviewed-by: Rob Herring (Arm) Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659614/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-5-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit 1ea958223c06a2c41fbd52f9fdd1e8d9afd4bd40 Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:33 2025 +0200 dt-bindings: display/msm: qcom,sm8650-dpu: Add SM8750 Add DPU for Qualcomm SM8750 SoC which has several differences, new blocks and changes in registers, making it incompatible with SM8650. Acked-by: Rob Herring (Arm) Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659612/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-4-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit 1364e7e66fc814243f1fc43a3dffff0a696a3ad5 Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:32 2025 +0200 dt-bindings: display/msm: dp-controller: Add SM8750 Add DisplayPort controller for Qualcomm SM8750 SoC which so far looks fully compatible with earlier SM8650 variant - both are of version v1.5.1 of the IP block. Datasheet also mentions that both support 4x MST for DPTX0 and 2x MST for DPTX1. Acked-by: Rob Herring (Arm) Reviewed-by: Dmitry Baryshkov Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659611/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-3-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit 34bdf809a567ccefa1984ccda010c4b5de6c68c8 Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:31 2025 +0200 dt-bindings: display/msm: dsi-controller-main: Add SM8750 Add DSI controller for Qualcomm SM8750 SoC which is quite different from previous (SM8650) generation. It does not allow the display clock controller clocks like "byte" and "pixel" to be reparented to DSI PHY PLLs while the DSI PHY PLL is not configured (not prepared, rate not set). Therefore assigned-clock-parents are not working here and driver is responsible for reparenting clocks with proper procedure. These clocks are now inputs to the DSI controller device. Except that SM8750 DSI comes with several differences, new blocks and changes in registers, making it incompatible with SM8650. Reviewed-by: Rob Herring (Arm) Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659609/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-2-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit c257d2c8481a9abed995184b053c7dde45e7cc37 Author: Krzysztof Kozlowski Date: Wed Jun 18 16:32:30 2025 +0200 dt-bindings: display/msm: dsi-phy-7nm: Add SM8750 Add DSI PHY v7.0 for Qualcomm SM8750 SoC which is quite different from previous (SM8650) generation. Acked-by: Rob Herring (Arm) Signed-off-by: Krzysztof Kozlowski Patchwork: https://patchwork.freedesktop.org/patch/659615/ Link: https://lore.kernel.org/r/20250618-b4-sm8750-display-v7-1-a591c609743d@linaro.org Signed-off-by: Dmitry Baryshkov commit 5136acc40afc0261802e5cb01b04f871bf6d876b Author: Konrad Dybcio Date: Tue Jun 10 14:50:03 2025 +0200 drm/msm/dpu: Fill in min_prefill_lines for SC8180X Based on the downstream release, predictably same value as for SM8150. Signed-off-by: Konrad Dybcio Fixes: f3af2d6ee9ab ("drm/msm/dpu: Add SC8180x to hw catalog") Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/657794/ Link: https://lore.kernel.org/r/20250610-topic-dpu_8180_mpl-v1-1-f480cd22f11c@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 603fc0fc30bf69e78a7a5febdb1431bd49d87f22 Author: Dmitry Baryshkov Date: Sun May 18 14:21:44 2025 +0300 drm/msm/dp: drop the msm_dp_catalog module Now as the msm_dp_catalog module became nearly empty, drop it, accessing registers directly from the corresponding submodules. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654332/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-11-2f0ec3ec000d@oss.qualcomm.com commit d11f5a7a00dbe0585b567da551b756dc49cb06f4 Author: Dmitry Baryshkov Date: Sun May 18 14:21:43 2025 +0300 drm/msm/dp: move interrupt handling to dp_ctrl It makes it easier to keep all interrupts-related code in dp_ctrl submodule. Move all functions to dp_ctrl.c. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654330/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-10-2f0ec3ec000d@oss.qualcomm.com commit e30cab9dd623aad4deef6d1cdce0743179aff64b Author: Dmitry Baryshkov Date: Sun May 18 14:21:42 2025 +0300 drm/msm/dp: move more AUX functions to dp_aux.c Move several misnamed functions accessing AUX bus to dp_aux.c, further cleaning up dp_catalog submodule. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654333/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-9-2f0ec3ec000d@oss.qualcomm.com commit 2b3d6611b2ae50cab37e68cbae7b3ef8f9276c86 Author: Dmitry Baryshkov Date: Sun May 18 14:21:41 2025 +0300 drm/msm/dp: move/inline ctrl register functions Move CTRL-related functions to dp_ctrl.c, inlining one line wrappers during this process. The enable/disable functions have been split to the enable/disable or enter/exit pairs. The IRQ and HPD related functions are left in dp_catalog.c, pending later cleanup. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654328/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-8-2f0ec3ec000d@oss.qualcomm.com commit db3f715e8863693a4f351565a937a651cb4ce6a5 Author: Dmitry Baryshkov Date: Sun May 18 14:21:40 2025 +0300 drm/msm/dp: move/inline audio related functions Move audio-related functions to dp_audio.c, following up the cleanup done by the rest of the submodules. Inline functions with simple register access patterns. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654325/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-7-2f0ec3ec000d@oss.qualcomm.com commit 51d976ecaa6b81e4284fb6c758abb2bc85cf2ae0 Author: Dmitry Baryshkov Date: Sun May 18 14:21:39 2025 +0300 drm/msm/dp: move/inline panel related functions Move panel-related functions to dp_panel.c, following up the cleanup done by the rest of the submodules. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654321/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-6-2f0ec3ec000d@oss.qualcomm.com commit 39b9a68bf45cd2f8dbef0fe697ecedcc6631f701 Author: Dmitry Baryshkov Date: Sun May 18 14:21:38 2025 +0300 drm/msm/dp: move/inline AUX register functions Move all register-level functions to dp_aux.c, inlining one line wrappers during this process. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654322/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-5-2f0ec3ec000d@oss.qualcomm.com commit d803592e116413aa04679901ec85c5f74245739e Author: Dmitry Baryshkov Date: Sun May 18 14:21:37 2025 +0300 drm/msm/dp: move I/O functions to global header Move msm_dp_read()/msm_write_foo() functions to the dp_catalog.h, allowing other modules to access the data directly. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654318/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-4-2f0ec3ec000d@oss.qualcomm.com commit 56d802f61a8c2883eaa325b4c12f788bf993f149 Author: Dmitry Baryshkov Date: Sun May 18 14:21:36 2025 +0300 drm/msm/dp: pull I/O data out of msm_dp_catalog_private() Having I/O regions inside a msm_dp_catalog_private() results in extra layers of one-line wrappers for accessing the data. Move I/O region base and size to the globally visible struct msm_dp_catalog. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654319/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-3-2f0ec3ec000d@oss.qualcomm.com commit 7b38d53d46128dafe8966be4c0be55971eabb394 Author: Dmitry Baryshkov Date: Sun May 18 14:21:35 2025 +0300 drm/msm/dp: read hw revision only once There is little point in rereading DP controller revision over and over again. Read it once, after the first software reset. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654316/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-2-2f0ec3ec000d@oss.qualcomm.com commit 3f93d35c9cd364bee222a6793e4af7baae305a7d Author: Dmitry Baryshkov Date: Sun May 18 14:21:34 2025 +0300 drm/msm/dp: split MMSS_DP_DSC_DTO register write to a separate function It's the dp_panel's duty to clear the MMSS_DP_DSC_DTO register. Once DP driver gets DSC support, it will handle that register in other places too. Split a call to write 0x0 to that register to a separate function. Reviewed-by: Stephen Boyd Tested-by: Stephen Boyd # sc7180-trogdor Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/654314/ Link: https://lore.kernel.org/r/20250518-fd-dp-audio-fixup-v6-1-2f0ec3ec000d@oss.qualcomm.com commit 139d99644acec30a62f00d1990df565015b1cccf Author: Dmitry Baryshkov Date: Thu May 22 22:03:49 2025 +0300 drm/msm/dpu: move features out of the DPU_HW_BLK_INFO As features bits are now unused by some of the hardware block configuration structures, remove the 'features' from the DPU_HW_BLK_INFO so that it doesn't get included into hw info structures by default and only include it when necessary. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655420/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-30-3b2085a07884@oss.qualcomm.com commit 3d6cce0b6333759b888a8360385d977f71eb225e Author: Dmitry Baryshkov Date: Thu May 22 22:03:48 2025 +0300 drm/msm/dpu: drop ununused MIXER features Drop unused LM features from the current codebase. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655411/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-29-3b2085a07884@oss.qualcomm.com commit 7a4647f3adfcd28ad636c373f7e58b054fb5c01d Author: Dmitry Baryshkov Date: Thu May 22 22:03:47 2025 +0300 drm/msm/dpu: drop ununused PINGPONG features All existing PINGPONG feature bits are completely unused. Drop them from the current codebase. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655409/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-28-3b2085a07884@oss.qualcomm.com commit f1a3c64ed2902e7ad3eb60a6c36cb573439279e3 Author: Dmitry Baryshkov Date: Thu May 22 22:03:46 2025 +0300 drm/msm/dpu: drop unused MDP TOP features Drop unused MDP TOP features from the current codebase. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655412/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-27-3b2085a07884@oss.qualcomm.com commit 914a4b960d5fca9e0e56238d566b3430719b3380 Author: Dmitry Baryshkov Date: Thu May 22 22:03:45 2025 +0300 drm/msm/dpu: get rid of DPU_SSPP_QOS_8LVL Continue migration to the MDSS-revision based checks and replace DPU_SSPP_QOS_8LVL feature bit with the core_major_ver >= 4 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655406/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-26-3b2085a07884@oss.qualcomm.com commit 3e6d0543c03a5b43ecd6176f8d9fff7664db19af Author: Dmitry Baryshkov Date: Thu May 22 22:03:44 2025 +0300 drm/msm/dpu: get rid of DPU_WB_INPUT_CTRL Continue migration to the MDSS-revision based checks and replace DPU_WB_INPUT_CTRL feature bit with the core_major_ver >= 5 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655407/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-25-3b2085a07884@oss.qualcomm.com commit ca4f289eef79dbe048371a1c18f0795b9d36a476 Author: Dmitry Baryshkov Date: Thu May 22 22:03:43 2025 +0300 drm/msm/dpu: get rid of DPU_DSC_OUTPUT_CTRL Continue migration to the MDSS-revision based checks and replace DPU_DSC_OUTPUT_CTRL feature bit with the core_major_ver >= 5 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655404/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-24-3b2085a07884@oss.qualcomm.com commit de72346295ed55cbe869144aa66bc2baf2515ef4 Author: Dmitry Baryshkov Date: Thu May 22 22:03:42 2025 +0300 drm/msm/dpu: get rid of DPU_DSC_HW_REV_1_2 Continue migration to the MDSS-revision based checks and replace DPU_DSC_HW_REV_1_2 feature bit with the core_major_ver >= 7 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655403/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-23-3b2085a07884@oss.qualcomm.com commit 4115a6806b996094a09ea882dbac87d9f29b9a59 Author: Dmitry Baryshkov Date: Thu May 22 22:03:41 2025 +0300 drm/msm/dpu: get rid of DPU_DIM_LAYER Continue migration to the MDSS-revision based checks and drop the DPU_DIM_LAYER feature bit. It is currently unused, but can be replaed with the core_major_ver >= 4 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655418/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-22-3b2085a07884@oss.qualcomm.com commit 2154cff6308951fa40efb7a9b141dc2b2a2b4eb7 Author: Dmitry Baryshkov Date: Thu May 22 22:03:40 2025 +0300 drm/msm/dpu: get rid of DPU_MIXER_COMBINED_ALPHA Continue migration to the MDSS-revision based checks and replace DPU_MIXER_COMBINED_ALPHA feature bit with the core_major_ver >= 4 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655398/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-21-3b2085a07884@oss.qualcomm.com commit ff63c4a486cd7650f18a64fd51c426d638e43c6c Author: Dmitry Baryshkov Date: Thu May 22 22:03:39 2025 +0300 drm/msm/dpu: get rid of DPU_MDP_AUDIO_SELECT Continue migration to the MDSS-revision based checks and replace DPU_MDP_AUDIO_SELECT feature bit with the core_major_ver == 4 || core_major_ver == 5 check. Signed-off-by: Dmitry Baryshkov Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Patchwork: https://patchwork.freedesktop.org/patch/655399/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-20-3b2085a07884@oss.qualcomm.com commit bd88789bbd807afbc857c36db7c72205ecc86a6f Author: Dmitry Baryshkov Date: Thu May 22 22:03:38 2025 +0300 drm/msm/dpu: get rid of DPU_MDP_PERIPH_0_REMOVED Continue migration to the MDSS-revision based checks and replace DPU_MDP_PERIPH_0_REMOVED feature bit with the core_major_ver >= 8 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655400/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-19-3b2085a07884@oss.qualcomm.com commit a48871823a4ba81e532f8a42cc79a46b69e41490 Author: Dmitry Baryshkov Date: Thu May 22 22:03:37 2025 +0300 drm/msm/dpu: get rid of DPU_MDP_VSYNC_SEL Continue migration to the MDSS-revision based checks and replace DPU_MDP_VSYNC_SEL feature bit with the core_major_ver < 5 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655395/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-18-3b2085a07884@oss.qualcomm.com commit 5ef71e181cfd17402e9404965fb6b48358e1f573 Author: Dmitry Baryshkov Date: Thu May 22 22:03:36 2025 +0300 drm/msm/dpu: get rid of DPU_PINGPONG_DITHER Continue migration to the MDSS-revision based checks and replace DPU_PINGPONG_DITHER feature bit with the core_major_ver >= 3 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655393/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-17-3b2085a07884@oss.qualcomm.com commit fcdd6cbba0cb4981a178e176d3dfb827b47eceb8 Author: Dmitry Baryshkov Date: Thu May 22 22:03:35 2025 +0300 drm/msm/dpu: get rid of DPU_PINGPONG_DSC Continue migration to the MDSS-revision based checks and replace DPU_PINGPONG_DSC feature bit with the core_major_ver < 7 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655390/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-16-3b2085a07884@oss.qualcomm.com commit 458de858d2dc8df5068e2d0e514a34f44831e7fc Author: Dmitry Baryshkov Date: Thu May 22 22:03:34 2025 +0300 drm/msm/dpu: get rid of DPU_INTF_INPUT_CTRL Continue migration to the MDSS-revision based checks and replace DPU_INTF_INPUT_CTRL feature bit with the core_major_ver >= 5 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655389/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-15-3b2085a07884@oss.qualcomm.com commit e432d2e15454435c24b532eb026e05f0a403d644 Author: Dmitry Baryshkov Date: Thu May 22 22:03:33 2025 +0300 drm/msm/dpu: get rid of DPU_INTF_STATUS_SUPPORTED Continue migration to the MDSS-revision based checks and replace DPU_INTF_STATUS_SUPPORTED feature bit with the core_major_ver >= 5 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655384/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-14-3b2085a07884@oss.qualcomm.com commit 19bcbadf925b9001c0460dc991a5fe30c9315545 Author: Dmitry Baryshkov Date: Thu May 22 22:03:32 2025 +0300 drm/msm/dpu: get rid of DPU_DATA_HCTL_EN Continue migration to the MDSS-revision based checks and replace DPU_DATA_HCTL_EN feature bit with the core_major_ver >= 5 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655381/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-13-3b2085a07884@oss.qualcomm.com commit 74e1b4283d7e962fc8cf22c80c866813950a6797 Author: Dmitry Baryshkov Date: Thu May 22 22:03:31 2025 +0300 drm/msm/dpu: get rid of DPU_CTL_VM_CFG Continue migration to the MDSS-revision based checks and replace DPU_CTL_VM_CFG feature bit with the core_major_ver >= 7 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655385/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-12-3b2085a07884@oss.qualcomm.com commit 20d36dae58947dbfef94c3495335f97e9b071194 Author: Dmitry Baryshkov Date: Thu May 22 22:03:30 2025 +0300 drm/msm/dpu: get rid of DPU_CTL_DSPP_SUB_BLOCK_FLUSH Continue migration to the MDSS-revision based checks and replace DPU_CTL_DSPP_SUB_BLOCK_FLUSH feature bit with the core_major_ver >= 7 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655380/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-11-3b2085a07884@oss.qualcomm.com commit 2287f32e32a083f07e593f550bf304220912dc2e Author: Dmitry Baryshkov Date: Thu May 22 22:03:29 2025 +0300 drm/msm/dpu: get rid of DPU_CTL_FETCH_ACTIVE Continue migration to the MDSS-revision based checks and replace DPU_CTL_FETCH_ACTIVE feature bit with the core_major_ver >= 7 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655379/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-10-3b2085a07884@oss.qualcomm.com commit ef31cf538b987efd5ade8e5e4fdcdd3242fb172a Author: Dmitry Baryshkov Date: Thu May 22 22:03:28 2025 +0300 drm/msm/dpu: get rid of DPU_CTL_ACTIVE_CFG Continue migration to the MDSS-revision based checks and replace DPU_CTL_ACTIVE_CFG feature bit with the core_major_ver >= 5 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655376/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-9-3b2085a07884@oss.qualcomm.com commit 2ae7e2cdf468a5f148e584ea6737a7c52b2ef7fe Author: Dmitry Baryshkov Date: Thu May 22 22:03:27 2025 +0300 drm/msm/dpu: get rid of DPU_CTL_HAS_LAYER_EXT4 Continue migration to the MDSS-revision based checks and replace DPU_CTL_HAS_LAYER_EXT4 feature bit with the core_major_ver >= 9 check. Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655371/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-8-3b2085a07884@oss.qualcomm.com commit 9b2a5bff792d6020c258e8dc94148a7216c85043 Author: Dmitry Baryshkov Date: Thu May 22 22:03:26 2025 +0300 drm/msm/dpu: remove DSPP_SC7180_MASK Stop declaring DPU_DSPP_PCC as a part of the DSPP features, use the presence of the PCC sblk to check whether PCC is present in the hardware or not. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655373/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-7-3b2085a07884@oss.qualcomm.com commit a150c9042fc044a5b5e69daf106f544b94f99ba3 Author: Dmitry Baryshkov Date: Thu May 22 22:03:25 2025 +0300 drm/msm/dpu: inline _setup_mixer_ops() Inline the _setup_mixer_ops() function, it makes it easier to handle different conditions involving LM configuration. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655369/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-6-3b2085a07884@oss.qualcomm.com commit 6ba16b49bf453f2851c8a10863d6b883f38461e0 Author: Dmitry Baryshkov Date: Thu May 22 22:03:24 2025 +0300 drm/msm/dpu: inline _setup_dspp_ops() Inline the _setup_dspp_ops() function, it makes it easier to handle different conditions involving DSPP configuration. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655372/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-5-3b2085a07884@oss.qualcomm.com commit b2dc5ea3fb4df93b27757f2027de571eb8cdaffa Author: Dmitry Baryshkov Date: Thu May 22 22:03:23 2025 +0300 drm/msm/dpu: inline _setup_dsc_ops() Inline the _setup_dsc_ops() function, it makes it easier to handle different conditions involving DSC configuration. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655365/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-4-3b2085a07884@oss.qualcomm.com commit 60bd327651eca982f6cecc6eb49025bfa514fd49 Author: Dmitry Baryshkov Date: Thu May 22 22:03:22 2025 +0300 drm/msm/dpu: inline _setup_ctl_ops() Inline the _setup_ctl_ops() function, it makes it easier to handle different conditions involving CTL configuration. Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655367/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-3-3b2085a07884@oss.qualcomm.com commit 9375fb3ebd88c3c2f941dba94f20e41399b5d365 Author: Dmitry Baryshkov Date: Thu May 22 22:03:21 2025 +0300 drm/msm/dpu: drop INTF_SC7280_MASK The INTF_SC7280_MASK is equal to the INTF_SC7180_MASK. Stop defining a separate symbol and use the INTF_SC7180_MASK instead. Signed-off-by: Dmitry Baryshkov Reviewed-by: Abhinav Kumar Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655364/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-2-3b2085a07884@oss.qualcomm.com commit 219a2867597896abec7287b019370d1d0f457f04 Author: Dmitry Baryshkov Date: Thu May 22 22:03:20 2025 +0300 drm/msm/dpu: stop passing mdss_ver to setup_timing_gen() As a preparation to further MDSS-revision cleanups stop passing MDSS revision to the setup_timing_gen() callback. Instead store a pointer to it inside struct dpu_hw_intf and use it diretly. It's not that the MDSS revision can chance between dpu_hw_intf_init() and dpu_encoder_phys_vid_setup_timing_engine(). Signed-off-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/655362/ Link: https://lore.kernel.org/r/20250522-dpu-drop-features-v5-1-3b2085a07884@oss.qualcomm.com commit 9cbc40521bc4ab49ee6af44eb2757eb114300473 Author: Tvrtko Ursulin Date: Fri Jul 4 14:07:53 2025 +0100 drm/sched: De-clutter drm_sched_init Move work queue allocation into a helper for a more streamlined function body. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Danilo Krummrich Cc: Matthew Brost Cc: Philipp Stanner Reviewed-by: Maíra Canal Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250704130754.89935-1-tvrtko.ursulin@igalia.com commit 9f711c9321cffe3e03709176873c277fa911c366 Author: Al Viro Date: Wed Jul 2 22:16:02 2025 +0100 regmap: get rid of redundant debugfs_file_{get,put}() pointless in ->read()/->write() of file_operations used only via debugfs_create_file() Signed-off-by: Al Viro Link: https://patch.msgid.link/20250702211602.GC3406663@ZenIV Signed-off-by: Mark Brown commit 7a884442aeb694c28ac90a1fb023856039ef57ee Author: Yicong Yang Date: Tue Jul 1 19:02:14 2025 +0800 arm64/watchdog_hld: Add a cpufreq notifier for update watchdog thresh arm64 depends on the cpufreq driver to gain the maximum cpu frequency to convert the watchdog_thresh to perf event period. cpufreq drivers like cppc_cpufreq will be initialized lately after the initializing of the hard lockup detector so just use a safe cpufreq which will be inaccurency. Use a cpufreq notifier to adjust the event's period to a more accurate one. Reviewed-by: Jie Zhan Reviewed-by: Douglas Anderson Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20250701110214.27242-3-yangyicong@huawei.com Signed-off-by: Will Deacon commit 60bc47b5a0b164082d448815d7db3066266aa3ed Author: Yicong Yang Date: Tue Jul 1 19:02:13 2025 +0800 watchdog/perf: Provide function for adjusting the event period Architecture's using perf events for hard lockup detection needs to convert the watchdog_thresh to the event's period, some architecture for example arm64 perform this conversion using the CPU's maximum frequency which will be acquired by cpufreq. However by the time the lockup detector's initialized the cpufreq driver may not be initialized, thus launch a watchdog with inaccurate period. Provide a function hardlockup_detector_perf_adjust_period() to allowing adjust the event period. Then architecture can update with more accurate period if cpufreq is initialized. Reviewed-by: Douglas Anderson Signed-off-by: Yicong Yang Link: https://lore.kernel.org/r/20250701110214.27242-2-yangyicong@huawei.com Signed-off-by: Will Deacon commit c61e94e5e4e6bc50064119e6a779564d1d2ac0e7 Author: Sakari Ailus Date: Fri Jul 4 10:54:44 2025 +0300 regulator: stm32-vrefbuf: Remove redundant pm_runtime_mark_last_busy() calls pm_runtime_put_autosuspend(), pm_runtime_put_sync_autosuspend(), pm_runtime_autosuspend() and pm_request_autosuspend() now include a call to pm_runtime_mark_last_busy(). Remove the now-reduntant explicit call to pm_runtime_mark_last_busy(). Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250704075444.3221445-1-sakari.ailus@linux.intel.com Signed-off-by: Mark Brown commit bc163baef57002c08b3afe64cdd2f55f55a765eb Author: Rob Herring (Arm) Date: Thu Jul 3 13:35:21 2025 -0500 ASoC: Use of_reserved_mem_region_to_resource() for "memory-region" Use the newly added of_reserved_mem_region_to_resource() function to handle "memory-region" properties. Signed-off-by: Rob Herring (Arm) Reviewed-by: Tzung-Bi Shih Reviewed-by: Cheng-Yi Chiang Link: https://patch.msgid.link/20250703183523.2075276-1-robh@kernel.org Signed-off-by: Mark Brown commit f7a2fd776e57bd6468644bdecd91ab3aba57ba58 Author: Matthew Auld Date: Tue Jul 1 11:39:50 2025 +0100 drm/xe/bmg: fix compressed VRAM handling There looks to be an issue in our compression handling when the BO pages are very fragmented, where we choose to skip the identity map and instead fall back to emitting the PTEs by hand when migrating memory, such that we can hopefully do more work per blit operation. However in such a case we need to ensure the src PTEs are correctly tagged with a compression enabled PAT index on dgpu xe2+, otherwise the copy will simply treat the src memory as uncompressed, leading to corruption if the memory was compressed by the user. To fix this pass along use_comp_pat into emit_pte() on the src side, to indicate that compression should be considered. v2 (Jonathan): tweak the commit message Fixes: 523f191cc0c7 ("drm/xe/xe_migrate: Handle migration logic for xe2+ dgfx") Signed-off-by: Matthew Auld Cc: Himal Prasad Ghimiray Cc: Thomas Hellström Cc: Akshata Jahagirdar Cc: # v6.12+ Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250701103949.83116-2-matthew.auld@intel.com commit 1536aa0fb1e09cb50f401ec4852c60f38173d751 Author: Mark Brown Date: Thu Jul 3 17:00:17 2025 +0100 kselftest/arm64: Add a test for vfork() with GCS Ensure that we've got at least some coverage of the special cases around vfork() by adding a test case in basic-gcs doing the same thing as the plain fork() one - vfork(), do a few checks and then return to the parent. Signed-off-by: Mark Brown Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20250703-arm64-gcs-vfork-exit-v3-3-1e9a9d2ddbbe@kernel.org Signed-off-by: Thomas Weißschuh commit 696bf15792524aa869ebdbee2643881a77491a83 Author: Mark Brown Date: Thu Jul 3 17:00:18 2025 +0100 selftests/nolibc: Add coverage of vfork() Generalise the existing fork() test to also cover the newly added vfork() implementation. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250703-arm64-gcs-vfork-exit-v3-4-1e9a9d2ddbbe@kernel.org Signed-off-by: Thomas Weißschuh commit fb476dfb13d2f087563b88163167c4b7329462fc Author: Mark Brown Date: Thu Jul 3 17:00:16 2025 +0100 tools/nolibc: Provide vfork() To allow testing of vfork() support in the arm64 basic-gcs test provide an implementation for nolibc, using the vfork() syscall if one is available and otherwise clone3(). We implement in terms of clone3() since the order of the arguments for clone() varies between architectures. As for fork() SPARC returns the parent PID rather than 0 in the child for vfork() so needs custom handling. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250703-arm64-gcs-vfork-exit-v3-2-1e9a9d2ddbbe@kernel.org Signed-off-by: Thomas Weißschuh commit 8c11625afb3042e89d549dcdf7ada220aecd9778 Author: Mark Brown Date: Thu Jul 3 17:00:15 2025 +0100 tools/nolibc: Replace ifdef with if defined() in sys.h Thomas has requested that if defined() be used in place of ifdef but currently ifdef is used consistently in sys.h. Update all the instances of ifdef to if defined(). Suggested-by: Thomas Weißschuh Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250703-arm64-gcs-vfork-exit-v3-1-1e9a9d2ddbbe@kernel.org Signed-off-by: Thomas Weißschuh commit 02217ad447d7b1dd592cfc8253a07375d0b32aa7 Author: Thomas Weißschuh Date: Mon Jun 23 23:15:54 2025 +0200 tools/nolibc: add support for SuperH Add support for SuperH/"sh" to nolibc. Only sh4 is tested for now. The startup code is special: __nolibc_entrypoint_epilogue() calls __builtin_unreachable() which emits a call to abort(). To make this work a function prologue is generated to set up a GOT pointer which corrupts "sp". __builtin_unreachable() is necessary for __attribute__((noreturn)). Also depending on compiler flags (for example -fPIC) even more prologue is generated. Work around this by defining a nested function in asm. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70216 Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Acked-by: Rob Landley Acked-by: D. Jeff Dionne Tested-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20250623-nolibc-sh-v2-3-0f5b4b303025@weissschuh.net commit 4c5ba7acd74f950fbff1e4fb9c038c4446635659 Author: Tiwei Bie Date: Fri Jun 6 20:44:26 2025 +0800 um: virtio_pcidev: Rename UM_PCI_STAT_WAITING Rename it to VIRTIO_PCIDEV_STAT_WAITING to make the code slightly more consistent. It was missed when refactoring virtio_pcidev into a separate module. Signed-off-by: Tiwei Bie Link: https://patch.msgid.link/20250606124428.148164-3-tiwei.btw@antgroup.com Signed-off-by: Johannes Berg commit 000006155029e81ee36835f1d5c42830d57b0e21 Author: Patrice Chotard Date: Mon Jun 30 10:44:53 2025 +0200 arm64: defconfig: Enable STM32 Octo Memory Manager and OcstoSPI driver Enable STM32 OctoSPI driver. Enable STM32 Octo Memory Manager (OMM) driver which is needed for OSPI usage on STM32MP257F-EV1 board. Signed-off-by: Patrice Chotard Link: https://lore.kernel.org/r/20250630-upstream_omm_ospi_defconfig-v11-1-6e934fabe698@foss.st.com Signed-off-by: Alexandre Torgue commit fadfd41a49ce563ab3ed05bd512cb78c26823e4b Author: Amelie Delaunay Date: Tue Jun 3 11:02:13 2025 +0200 ARM: dts: stm32: add stm32mp157f-dk2 board support STM32MP157F-DK2 board embeds a STM32MP157F SoC. This SoC contains the same level of feature than a STM32MP157C SOC but A7 clock frequency can reach 800MHz, hence the inclusion of the newly introduced stm32mp15xf.dtsi. As for other latest STM32 MPU families, STM32MP157F-DK2 relies on OP-TEE SCMI services for SoC clock and reset controllers resources, and for PMIC, now under OP-TEE control. That's why stm32mp157f-dk2-scmi.dtsi is introduced, to move all clocks, resets and regulators to SCMI-based ones. To "disable" SCMI, just need to comment stm32mp157f-dk2-scmi.dtsi inclusion and to replace &scmi_v3v3 with &v3v3, then to disable arm_wdt and to enable i2c4 and its subnodes for PMIC support by Linux. Reconfigure usbotg for dual role with type-C support if needed. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20250603-stm32mp157f-dk2-v2-7-5be0854a9299@foss.st.com Signed-off-by: Alexandre Torgue commit ef21a063d123af0e5773ee60695fb2218a25ee67 Author: Himanshu Bhavani Date: Tue Jun 3 11:02:12 2025 +0200 dt-bindings: arm: stm32: add STM32MP157F-DK2 board compatible Add the "st,stm32mp157f-dk2" compatible string to the STM32 SoC bindings. The MP157F is functionally similar to the MP157C. Signed-off-by: Himanshu Bhavani Signed-off-by: Amelie Delaunay Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250603-stm32mp157f-dk2-v2-6-5be0854a9299@foss.st.com Signed-off-by: Alexandre Torgue commit d1e88874c0f63cc923fc215fb95e5fd55a507d58 Author: Etienne Carriere Date: Tue Jun 3 11:02:11 2025 +0200 ARM: dts: stm32: optee async notif interrupt for MP15 scmi variants Define the interrupt used by OP-TEE async notif on stm32mp15 scmi based platforms. Signed-off-by: Etienne Carriere Link: https://lore.kernel.org/r/20250603-stm32mp157f-dk2-v2-5-5be0854a9299@foss.st.com Signed-off-by: Alexandre Torgue commit bcd6cc9ee13a5cb2c323b45f6b177e4296f9f164 Author: Amelie Delaunay Date: Tue Jun 3 11:02:10 2025 +0200 ARM: dts: stm32: use internal regulators bindings for MP15 scmi variants Use the SCMI voltage domain bindings for internal regulators on stm32mp15. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20250603-stm32mp157f-dk2-v2-4-5be0854a9299@foss.st.com Signed-off-by: Alexandre Torgue commit 9bc35edb9ac76b23285e7ceafa1576ce53da9b6c Author: Etienne Carriere Date: Tue Jun 3 11:02:09 2025 +0200 dt-bindings: regulator: Add STM32MP15 SCMI regulator identifiers These bindings will be used for the SCMI voltage domain. Signed-off-by: Etienne Carriere Signed-off-by: Pascal Paillet Signed-off-by: Amelie Delaunay Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250603-stm32mp157f-dk2-v2-3-5be0854a9299@foss.st.com Signed-off-by: Alexandre Torgue commit 8ac2fba023cfb2f0ead73e527b5920369db625eb Author: Amelie Delaunay Date: Tue Jun 3 11:02:08 2025 +0200 ARM: dts: stm32: use 'typec' generic name for stusb1600 on stm32mp15xx-dkx Adopt generic node name 'typec' for stusb1600, which is the USB Type-C controller on stm32mp157x Discovery Kits. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20250603-stm32mp157f-dk2-v2-2-5be0854a9299@foss.st.com Signed-off-by: Alexandre Torgue commit ab2e0f4f6cbfa8220e75a29cf80abbd8eeec7879 Author: Alexandre Torgue Date: Tue Jun 3 11:02:07 2025 +0200 ARM: dts: stm32: fullfill diversity with OPP for STM32M15xF SOCs This commit creates new file to manage security features and supported OPP on STM32MP15xF SOCs. On STM32MP15xY, "Y" gives information: -Y = A means no cryp IP and no secure boot + A7-CPU@650MHz. -Y = C means cryp IP + optee + secure boot + A7-CPU@650MHz. -Y = D means no cryp IP and no secure boot + A7-CPU@800MHz. -Y = F means cryp IP + optee + secure boot + A7-CPU@800MHz. It fullfills the initial STM32MP15x SoC diversity introduced by commit 0eda69b6c5f9 ("ARM: dts: stm32: Manage security diversity for STM32M15x SOCs"). Signed-off-by: Alexandre Torgue Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20250603-stm32mp157f-dk2-v2-1-5be0854a9299@foss.st.com Signed-off-by: Alexandre Torgue commit ebf53abe62b0eddeecfee9cc1421f63c665de651 Author: Olivier Moysan Date: Wed May 21 17:04:18 2025 +0200 ARM: dts: stm32: add system-clock-direction-out on stm32mp15xx-dkx The commit 5725bce709db ("ASoC: simple-card-utils: Unify clock direction by clk_direction") corrupts the audio on STM32MP15 DK sound cards. The parent clock is not correctly set, because set_sai_ck_rate() is not executed in stm32_sai_set_sysclk() callback. This occurs because set_sysclk() is called with the wrong direction, SND_SOC_CLOCK_IN instead of SND_SOC_CLOCK_OUT. Add system-clock-direction-out property in SAI2A endpoint node of STM32MP15XX-DKX device tree, to specify the MCLK clock direction. Signed-off-by: Olivier Moysan Link: https://lore.kernel.org/r/20250521150418.488152-1-olivier.moysan@foss.st.com Signed-off-by: Alexandre Torgue commit 9259e150de55d7ae4c38f78ff01b6110d543c635 Author: Fabrice Gasnier Date: Fri Jan 10 10:19:19 2025 +0100 arm64: defconfig: enable STM32 timers drivers Enable the STM32 timer drivers: MFD, counter, PWM and trigger as module. These drivers can be used on STM32MP25. Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20250110091922.980627-6-fabrice.gasnier@foss.st.com Signed-off-by: Alexandre Torgue commit 986fa0721c1f1f5447ab3f8e36cc9d4ae17bce3f Author: Fabrice Gasnier Date: Fri Jan 10 10:19:22 2025 +0100 arm64: dts: st: add timer nodes on stm32mp257f-ev1 Configure timer nodes on stm32mp257f-ev1: - Timer3 CH2 is available on mikroBUS connector for PWM - timer8 CH1, timer8 CH4, timer10 CH1 and timer12 CH2 are available on EXPANSION connector. Timers are kept disabled by default, so the pins can be used for any other purpose (and the timers can be assigned to any of the processors). Arbitrary choice is to use all these timers as PWM (or counter on internal clock signal), except for timer10 that is configured with CH1 as an input (for capture). Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20250110091922.980627-9-fabrice.gasnier@foss.st.com Signed-off-by: Alexandre Torgue commit 0b22e2e5648f8e40d77706000565c544c5104c3d Author: Fabrice Gasnier Date: Fri Jan 10 10:19:21 2025 +0100 arm64: dts: st: add timer pins for stm32mp257f-ev1 Add timer pins available on stm32mp257f-ev1, configured for PWM: - timer3 CH2 is available on mikroBUS connector - timer8 CH1, timer8 CH4, timer10 CH1 and timer12 CH2 are available on EXPANSION connector Arbitrary define all these pins to be used as PWM (output) channels, except for timer10 CH1, to be used as counter input. Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20250110091922.980627-8-fabrice.gasnier@foss.st.com Signed-off-by: Alexandre Torgue commit 339571778a61087efb16f45449b61e3bb41a7688 Author: Fabrice Gasnier Date: Fri Jan 10 10:19:20 2025 +0100 arm64: dts: st: add timer nodes on stm32mp251 Add timers support on STM32MP25 SoC. Use dedicated compatible to handle new features and instances introduced with this SoC. STM32MP25 SoC has various timer flavours, each group has its own specific feature list: - Advanced-control timers (TIM1/TIM8/TIM20) - General-purpose timers (TIM2/TIM3/TIM4/TIM5) - Basic timers (TIM6/TIM7) - General-purpose timers (TIM10/TIM11/TIM12/TIM13/TIM14) - General purpose timers (TIM15/TIM16/TIM17) Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/20250110091922.980627-7-fabrice.gasnier@foss.st.com Signed-off-by: Alexandre Torgue commit 31921e87b2d2614e261096fdabedef1db7679611 Author: Damien Le Moal Date: Thu Jul 3 19:36:22 2025 +0900 ata: libata-core: Rename ata_do_set_mode() With the renaming of libata-eh ata_set_mode() function to ata_eh_set_mode(), libata-core function ata_do_set_mode() can now be renamed to the simpler ata_set_mode(). All the call sites of the former ata_do_set_mode() are updated to use the new function name. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Link: https://lore.kernel.org/r/20250703103622.291272-5-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 6ba4d05c1425fe220d95395b4485443ce895bb95 Author: Damien Le Moal Date: Thu Jul 3 19:36:21 2025 +0900 ata: libata-eh: Rename and make ata_set_mode() static The function ata_set_mode() is defined and used only in libata-eh.c. Make this function static and rename it ata_eh_set_mode() to make it clear where its definition is. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Link: https://lore.kernel.org/r/20250703103622.291272-4-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 6cbd989626b5695ec083e2a419372f10d0125900 Author: Damien Le Moal Date: Thu Jul 3 19:36:20 2025 +0900 ata: libata-core: Make ata_dev_cleanup_cdl_resources() static The function ata_dev_cleanup_cdl_resources() is called only from ata_dev_init_cdl_resources() and ata_dev_free_resources() which are both defined in drivers/ata/libata-core.c. So there is no need for ata_dev_cleanup_cdl_resources() to be visible from outside of this file. Change this function definition to be a static function. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Link: https://lore.kernel.org/r/20250703103622.291272-3-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 6d4405b16d37090a0c905079eab951cfb5044a65 Author: Damien Le Moal Date: Thu Jul 3 19:36:19 2025 +0900 ata: libata-core: Cache the general purpose log directory The function ata_log_supported() tests if a log page is supported by a device using the General Purpose Log Directory log page, which lists the size of all surported log pages. However, this log page is read from the device using ata_read_log_page() every time ata_log_supported() is called. That is not necessary. Avoid reading the General Purpose Log Directory log page by caching its content in the gp_log_dir buffer defined as part of struct ata_device. The functions ata_read_log_directory() and ata_clear_log_directory() are introduced to manage this buffer. ata_clear_log_directory() zero-fill the gp_log_dir buffer every time ata_dev_configure() is called, that is, when the device is first scanned and when it is being revalidated. The function ata_log_supported() is modified to call ata_read_log_directory() instead of ata_read_log_page(). The function ata_read_log_directory() calls ata_read_log_page() to read the General Purpose Log Directory log page from the device only if the first 16-bits word of the log is not equal to 0x0001, that is, it is not equal to the ACS mandated value for the log version. With this, the log page is read from the device only once for every ata_dev_configure() call. For instance, with pr_debug enabled, a call to ata_dev_configure() before this patch generates the following log page accesses: ata3.00: read log page - log 0x0, page 0x0 ata3.00: read log page - log 0x13, page 0x0 ata3.00: read log page - log 0x0, page 0x0 ata3.00: read log page - log 0x12, page 0x0 ata3.00: read log page - log 0x0, page 0x0 ata3.00: read log page - log 0x30, page 0x0 ata3.00: read log page - log 0x30, page 0x8 ata3.00: read log page - log 0x0, page 0x0 ata3.00: read log page - log 0x0, page 0x0 ata3.00: read log page - log 0x0, page 0x0 ata3.00: read log page - log 0x30, page 0x0 ata3.00: read log page - log 0x0, page 0x0 ata3.00: read log page - log 0x30, page 0x0 ata3.00: read log page - log 0x30, page 0x3 ata3.00: read log page - log 0x30, page 0x4 ata3.00: read log page - log 0x18, page 0x0 That is, the general purpose log directory page is read 7 times. With this patch applied, the number of accesses to this log page is reduced to one: ata3.00: read log page - log 0x0, page 0x0 ata3.00: read log page - log 0x13, page 0x0 ata3.00: read log page - log 0x12, page 0x0 ata3.00: read log page - log 0x30, page 0x0 ata3.00: read log page - log 0x30, page 0x8 ata3.00: read log page - log 0x30, page 0x0 ata3.00: read log page - log 0x30, page 0x0 ata3.00: read log page - log 0x30, page 0x3 ata3.00: read log page - log 0x30, page 0x4 ata3.00: read log page - log 0x18, page 0x0 Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Link: https://lore.kernel.org/r/20250703103622.291272-2-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit a695cad6954b1fc776039ccc8a23278e1509871d Author: Robin Murphy Date: Fri Jun 27 16:07:10 2025 +0100 iommu/mediatek-v1: Tidy up probe_finalize Krzysztof points out that although the driver now supports COMPILE_TEST for other architectures, it does not build cleanly with W=1 where the stubbed-out ARM API can lead to an unused variable warning. Since this is effectively the correct intent of the code in such cases, mark it as __maybe_unused, tidying up some cruft in the process. Reported-by: Krzysztof Kozlowski Signed-off-by: Robin Murphy Reviewed-by: Krzysztof Kozlowski Reviewed-by: Yong Wu Link: https://lore.kernel.org/r/7c78149504900bc6c98a9c48f4418934b72d89ac.1751036478.git.robin.murphy@arm.com Signed-off-by: Joerg Roedel commit 8154f3c0fd946db58ba1eed49a4f1126300f734a Author: Marc Zyngier Date: Thu Jun 26 16:48:55 2025 +0200 iommu/intel: Convert to msi_create_parent_irq_domain() helper Now that we have a concise helper to create an MSI parent domain, switch the Intel IOMMU remapping over to that. Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Link: https://lore.kernel.org/all/20241204124549.607054-10-maz@kernel.org Link: https://lore.kernel.org/r/169c793c50be8493cfd9d11affb00e9ed6341c36.1750858125.git.namcao@linutronix.de Signed-off-by: Joerg Roedel commit 0eaa67ad3a0989d01bdd9ec27fec4adebfb31c06 Author: Marc Zyngier Date: Thu Jun 26 16:48:54 2025 +0200 iommu/amd: Convert to msi_create_parent_irq_domain() helper Now that we have a concise helper to create an MSI parent domain, switch the AMD IOMMU remapping over to that. Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Link: https://lore.kernel.org/all/20241204124549.607054-9-maz@kernel.org Link: https://lore.kernel.org/r/92e5ae97a03e4ffc272349d0863cd2cc8f904c44.1750858125.git.namcao@linutronix.de Signed-off-by: Joerg Roedel commit 64daf134941208e7dd30bf04c8c97764c2f0c2b1 Author: Paul Kocialkowski Date: Tue Jul 1 22:11:20 2025 +0200 pinctrl: sunxi: v3s: Fix wrong comment about UART2 pinmux The original comment doesn't match the pin attribution, probably due to a hasty copy/paste. Signed-off-by: Paul Kocialkowski Reviewed-by: Icenowy Zheng Link: https://lore.kernel.org/20250701201124.812882-2-paulk@sys-base.io Signed-off-by: Linus Walleij commit 5f931b56848017c40b2975d96253ce0a341ef424 Merge: 86731a2a651e58 1cf74da68cffc9 Author: Arnd Bergmann Date: Fri Jul 4 09:44:54 2025 +0200 Merge tag 'renesas-drivers-for-v6.17-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers Renesas driver updates for v6.17 - Initial support for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs, - Convert the RZ/V2M External Power Sequence Controller (PWC) driver to the new GPIO line value setter callbacks. * tag 'renesas-drivers-for-v6.17-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: soc: renesas: pwc-rzv2m: Use new GPIO line value setter callbacks soc: renesas: Add RZ/N2H (R9A09G087) config option soc: renesas: Add RZ/T2H (R9A09G077) config option Link: https://lore.kernel.org/r/cover.1751026661.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 7a5b467e5d1a4b1968b590e3d09d895590a83ff6 Merge: 867673063e1da9 861bdc6314a495 Author: Christian Brauner Date: Fri Jul 4 09:32:42 2025 +0200 Merge patch series "allow to create pidfds for reaped tasks with SCM_PIDFD" This is a logical continuation of the earlier work to create pidfds for reaped tasks through the SO_PEERPIDFD socket option merged in 923ea4d4482b ("Merge patch series "net, pidfs: enable handing out pidfds for reaped sk->sk_peer_pid""). * patches from https://lore.kernel.org/20250703222314.309967-1-aleksandr.mikhalitsyn@canonical.com: selftests: net: extend SCM_PIDFD test to cover stale pidfds af_unix: enable handing out pidfds for reaped tasks in SCM_PIDFD af_unix: stash pidfs dentry when needed af_unix/scm: fix whitespace errors af_unix: introduce and use scm_replace_pid() helper af_unix: introduce unix_skb_to_scm helper af_unix: rework unix_maybe_add_creds() to allow sleep Link: https://lore.kernel.org/20250703222314.309967-1-aleksandr.mikhalitsyn@canonical.com Signed-off-by: Christian Brauner commit 861bdc6314a49520d9b3778b763461517c1321c0 Author: Alexander Mikhalitsyn Date: Fri Jul 4 00:23:11 2025 +0200 selftests: net: extend SCM_PIDFD test to cover stale pidfds Extend SCM_PIDFD test scenarios to also cover dead task's pidfd retrieval and reading its exit info. Cc: linux-kselftest@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org Cc: Shuah Khan Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Christian Brauner Cc: Kuniyuki Iwashima Cc: Lennart Poettering Cc: Luca Boccassi Cc: David Rheinsberg Signed-off-by: Alexander Mikhalitsyn Link: https://lore.kernel.org/20250703222314.309967-8-aleksandr.mikhalitsyn@canonical.com Reviewed-by: Christian Brauner Signed-off-by: Christian Brauner commit c679d17d3f2d895b34e660673141ad250889831f Author: Alexander Mikhalitsyn Date: Fri Jul 4 00:23:10 2025 +0200 af_unix: enable handing out pidfds for reaped tasks in SCM_PIDFD Now everything is ready to pass PIDFD_STALE to pidfd_prepare(). This will allow opening pidfd for reaped tasks. Cc: linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Willem de Bruijn Cc: Leon Romanovsky Cc: Arnd Bergmann Cc: Christian Brauner Cc: Kuniyuki Iwashima Cc: Lennart Poettering Cc: Luca Boccassi Cc: David Rheinsberg Signed-off-by: Alexander Mikhalitsyn Link: https://lore.kernel.org/20250703222314.309967-7-aleksandr.mikhalitsyn@canonical.com Reviewed-by: Christian Brauner Reviewed-by: Kuniyuki Iwashima Signed-off-by: Christian Brauner commit 2775832f71e53a294c93fa4b343a71787a87e5d3 Author: Alexander Mikhalitsyn Date: Fri Jul 4 00:23:09 2025 +0200 af_unix: stash pidfs dentry when needed We need to ensure that pidfs dentry is allocated when we meet any struct pid for the first time. This will allows us to open pidfd even after the task it corresponds to is reaped. Basically, we need to identify all places where we fill skb/scm_cookie with struct pid reference for the first time and call pidfs_register_pid(). Tricky thing here is that we have a few places where this happends depending on what userspace is doing: - [__scm_replace_pid()] explicitly sending an SCM_CREDENTIALS message and specified pid in a numeric format - [unix_maybe_add_creds()] enabled SO_PASSCRED/SO_PASSPIDFD but didn't send SCM_CREDENTIALS explicitly - [scm_send()] force_creds is true. Netlink case, we don't need to touch it. Cc: linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Leon Romanovsky Cc: Arnd Bergmann Cc: Christian Brauner Cc: Kuniyuki Iwashima Cc: Lennart Poettering Cc: Luca Boccassi Cc: David Rheinsberg Signed-off-by: Alexander Mikhalitsyn Link: https://lore.kernel.org/20250703222314.309967-6-aleksandr.mikhalitsyn@canonical.com Reviewed-by: Kuniyuki Iwashima Signed-off-by: Christian Brauner commit 2b9996417e4ec231c91818f9ea8107ae62ef75ad Author: Alexander Mikhalitsyn Date: Fri Jul 4 00:23:08 2025 +0200 af_unix/scm: fix whitespace errors Fix whitespace/formatting errors. Cc: linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Leon Romanovsky Cc: Arnd Bergmann Cc: Christian Brauner Cc: Kuniyuki Iwashima Cc: Lennart Poettering Cc: Luca Boccassi Cc: David Rheinsberg Signed-off-by: Alexander Mikhalitsyn Link: https://lore.kernel.org/20250703222314.309967-5-aleksandr.mikhalitsyn@canonical.com Reviewed-by: Kuniyuki Iwashima Signed-off-by: Christian Brauner commit 30580dc96a3e6e146006e811ad1d01ef8a82a509 Author: Alexander Mikhalitsyn Date: Fri Jul 4 00:23:07 2025 +0200 af_unix: introduce and use scm_replace_pid() helper Existing logic in __scm_send() related to filling an struct scm_cookie with a proper struct pid reference is already pretty tricky. Let's simplify it a bit by introducing a new helper. This helper will be extended in one of the next patches. Cc: linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Willem de Bruijn Cc: Leon Romanovsky Cc: Arnd Bergmann Cc: Christian Brauner Cc: Kuniyuki Iwashima Cc: Lennart Poettering Cc: Luca Boccassi Cc: David Rheinsberg Signed-off-by: Alexander Mikhalitsyn Link: https://lore.kernel.org/20250703222314.309967-4-aleksandr.mikhalitsyn@canonical.com Reviewed-by: Kuniyuki Iwashima Signed-off-by: Christian Brauner commit ee47976264cd499426c89328827970ffb6acd406 Author: Alexander Mikhalitsyn Date: Fri Jul 4 00:23:06 2025 +0200 af_unix: introduce unix_skb_to_scm helper Instead of open-coding let's consolidate this logic in a separate helper. This will simplify further changes. Cc: linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Leon Romanovsky Cc: Arnd Bergmann Cc: Christian Brauner Cc: Kuniyuki Iwashima Cc: Lennart Poettering Cc: Luca Boccassi Cc: David Rheinsberg Signed-off-by: Alexander Mikhalitsyn Link: https://lore.kernel.org/20250703222314.309967-3-aleksandr.mikhalitsyn@canonical.com Reviewed-by: Kuniyuki Iwashima Reviewed-by: Christian Brauner Signed-off-by: Christian Brauner commit 9bedee7cdf4cb7f9a4928f10567b326eaab8125d Author: Alexander Mikhalitsyn Date: Fri Jul 4 00:23:05 2025 +0200 af_unix: rework unix_maybe_add_creds() to allow sleep As a preparation for the next patches we need to allow sleeping in unix_maybe_add_creds() and also return err. Currently, we can't do that as unix_maybe_add_creds() is being called under unix_state_lock(). There is no need for this, really. So let's move call sites of this helper a bit and do necessary function signature changes. Cc: linux-kernel@vger.kernel.org Cc: netdev@vger.kernel.org Cc: David S. Miller Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Simon Horman Cc: Leon Romanovsky Cc: Arnd Bergmann Cc: Christian Brauner Cc: Kuniyuki Iwashima Cc: Lennart Poettering Cc: Luca Boccassi Cc: David Rheinsberg Signed-off-by: Alexander Mikhalitsyn Link: https://lore.kernel.org/20250703222314.309967-2-aleksandr.mikhalitsyn@canonical.com Reviewed-by: Christian Brauner Reviewed-by: Kuniyuki Iwashima Signed-off-by: Christian Brauner commit 990cd3e93a760fd9abed0594a06975dd5e543dc3 Author: Andrew Davis Date: Tue Jun 24 13:42:45 2025 -0500 ARM: Switch to new sys-off handler API Kernel now supports chained power-off handlers. Use register_platform_power_off() that registers a platform level power-off handler. Legacy pm_power_off() will be removed once all drivers and archs are converted to the new sys-off API. Signed-off-by: Andrew Davis Reviewed-by: Andre Przywara Acked-by: Alexey Charkov Link: https://lore.kernel.org/r/20250624184245.343657-1-afd@ti.com Signed-off-by: Arnd Bergmann commit 95cfe23285a6de17f11715378c93e6aee6d0ca75 Author: Jianbo Liu Date: Thu Jul 3 11:45:27 2025 +0300 xfrm: Skip redundant statistics update for crypto offload In the crypto offload path, every packet is still processed by the software stack. The state's statistics required for the expiration check are being updated in software. However, the code also calls xfrm_dev_state_update_stats(), which triggers a query to the hardware device to fetch statistics. This hardware query is redundant and introduces unnecessary performance overhead. Skip this call when it's crypto offload (not packet offload) to avoid the unnecessary hardware access, thereby improving performance. Signed-off-by: Jianbo Liu Reviewed-by: Leon Romanovsky Signed-off-by: Steffen Klassert commit 0d3d3d01947b842d3c8934394f5210143a54db4a Author: Takashi Iwai Date: Fri Jul 4 09:11:06 2025 +0200 ALSA: hda: Add device entry for QEMU QEMU HD-audio device (1af4:0021) is handled by the generic HD-audio codec driver, hence it's better to have an explicit device ID listing, so that we can avoid the superfluous vendor driver matching. Link: https://patch.msgid.link/20250704071107.14626-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a48d994ca321caaa82cb657eceae7722416a0c07 Author: Thorsten Blum Date: Fri Jul 4 00:52:36 2025 +0200 ALSA: hda: Remove old commented out sanity check The sanity check has been commented out for more than 12 years since commit d5657ec9f4ad ("ALSA: hda - Disable the sanity check in snd_hda_add_pincfg()") - remove it. Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250703225238.308359-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 66271c155d88e9e3a6ad92df946efde6645ec851 Author: Eric Biggers Date: Thu Jun 19 12:31:49 2025 -0700 fscrypt: Drop obsolete recommendation to enable optimized SHA-512 Since the crypto kconfig options are being fixed to enable optimized SHA-512 automatically (https://lore.kernel.org/linux-crypto/20250616014019.415791-1-ebiggers@kernel.org/), it is no longer necessary to give a recommendation to enable it. Link: https://lore.kernel.org/r/20250619193149.138315-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 998adc8cd5cbd4f45446ab7ad8bc1e1e7b62d7a1 Author: Uwe Kleine-König Date: Fri Mar 28 18:14:05 2025 +0100 ARM: dts: stm32: Add nvmem-cells to ethernet nodes for constant mac-addresses The efuse device tree description already has the two labels pointing to the efuse nodes that specify the mac-addresses to be used. Wire them up to the ethernet nodes. This is enough to make barebox pick the right mac-addresses and pass them to Linux. Suggested-by: Ahmad Fatoum Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250328171406.3307778-2-u.kleine-koenig@baylibre.com Signed-off-by: Alexandre Torgue commit 72a600a27ff53aaf94c81d5ddb9795139b56881e Author: Thorsten Blum Date: Thu Jul 3 15:42:52 2025 +0200 ALSA: mtpav: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250703134255.3948-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit a8598c7de1bcd94461ca54c972efa9b4ea501fb9 Author: Sakari Ailus Date: Thu Jul 3 17:53:19 2025 +0300 media: ipu7: Drop IPU8 PCI ID for now This driver is intended for IPU7 at the moment so drop the IPU8 PCI ID. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 241a3be4775651703bfd25531a618825458fcf54 Merge: 06d6ebf35c37f4 44bba869d25985 Author: Arnd Bergmann Date: Fri Jul 4 08:12:32 2025 +0200 Merge tag 'arm-soc/for-6.17/defconfig-arm64' of https://github.com/Broadcom/stblinux into soc/defconfig This pull request contains ARM64 defconfig updates for 6.17, please pull the following: - Andrea updates the defconfig to enable the RP1 misc, clock and gpio drivers as as well as turn on CONFIG_OF_OVERLAY which is necessary to apply the RP1 overlay file * tag 'arm-soc/for-6.17/defconfig-arm64' of https://github.com/Broadcom/stblinux: arm64: defconfig: Enable OF_OVERLAY option arm64: defconfig: Enable RP1 misc/clock/gpio drivers Link: https://lore.kernel.org/r/20250630190216.1518354-1-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit 06d6ebf35c37f47750307ea05c605be6a996e2eb Merge: 86731a2a651e58 910aa7765a7a12 Author: Arnd Bergmann Date: Fri Jul 4 08:11:54 2025 +0200 Merge tag 'renesas-arm-defconfig-for-v6.17-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/defconfig Renesas ARM defconfig updates for v6.17 - Enable modular support for Renesas RZ/V2H USB2PHY Port Reset Control in the ARM64 defconfig, - Refresh shmobile_defconfig for v6.16-rc2. * tag 'renesas-arm-defconfig-for-v6.17-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: ARM: shmobile: defconfig: Refresh for v6.16-rc2 arm64: defconfig: Enable RZ/V2H(P) USB2 PHY controller reset driver Link: https://lore.kernel.org/r/cover.1751026659.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 6b9fd8857b9fc4dd62e7cd300327f0e48dd76642 Merge: 5f712c3877f99d 17bbde2e1716e2 Author: Paolo Abeni Date: Fri Jul 4 08:03:18 2025 +0200 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.16-rc5). No conflicts. No adjacent changes. Signed-off-by: Paolo Abeni commit fefaa8d7f8012249729a987d3abce747ffab0ca7 Author: Francesco Dolcini Date: Tue Jul 1 10:16:43 2025 +0200 arm64: dts: ti: k3-am62p-verdin: add SD_1 CD pull-up Add internal pull-up to the SD_1 card detect signal, without this the CD signal is floating and spurious detects events can happen. Fixes: 87f95ea316ac ("arm64: dts: ti: Add Toradex Verdin AM62P") Signed-off-by: Francesco Dolcini Link: https://lore.kernel.org/r/20250701081643.71406-1-francesco@dolcini.it Signed-off-by: Vignesh Raghavendra commit 1c15e359ba53b297ba5fd72bbf626ede72c3de3e Author: Marshall Zhan Date: Mon Jun 30 15:31:37 2025 +0800 ARM: dts: aspeed: yosemite4: add gpio name for uart mux sel Add gpio line name to support multiplexed console Signed-off-by: Marshall Zhan Link: https://patch.msgid.link/20250630073138.3315947-1-marshall_zhan@wiwynn.com Signed-off-by: Andrew Jeffery commit 9237e0a207ac61b77eec84e917e63683959ef009 Author: Fred Chen Date: Wed Jun 25 15:38:38 2025 +0800 ARM: dts: aspeed: santabarbara: Add Meta Santabarbara BMC Add linux device tree entry related to the Meta (Facebook) compute node system using an AST2600 BMC. This node is named "Santabarbara". It is a compute node with accelerator module. The system monitors voltage and temperature for the CPU, switch, and NIC components on the motherboard and switch board. Signed-off-by: Fred Chen Link: https://patch.msgid.link/20250625073847.4054971-3-fredchen.openbmc@gmail.com Signed-off-by: Andrew Jeffery commit 462af36699b62ae1e765f7c5533cebb1def4a534 Author: Fred Chen Date: Wed Jun 25 15:38:37 2025 +0800 dt-bindings: arm: aspeed: add Meta Santabarbara board Document the new compatibles used on Facebook Santabarbara. Signed-off-by: Fred Chen Link: https://patch.msgid.link/20250625073847.4054971-2-fredchen.openbmc@gmail.com Acked-by: Rob Herring (Arm) Signed-off-by: Andrew Jeffery commit ab5e4c9777361c45160be2ec1a129e0c35c5363d Author: Cosmo Chou Date: Sun Jun 22 11:42:47 2025 +0800 ARM: dts: aspeed: bletchley: enable USB PD negotiation - Enable USB Power Delivery with revision 2.0 for all sleds - Configure dual power/data roles with sink preference Signed-off-by: Cosmo Chou Link: https://patch.msgid.link/20250622034247.3985727-1-chou.cosmo@gmail.com Signed-off-by: Andrew Jeffery commit f0d03c44ee61d045065762e124db61a4326e5a6e Author: Ankit Chauhan Date: Thu Jun 12 13:20:57 2025 +0530 ARM: dts: aspeed: lanyang: Fix 'lable' typo in LED nodes Fix an obvious spelling error in the DTS file for the Lanyang BMC ("lable" -> "label"). This was reported by bugzilla a few years ago but never got fixed. Reported-by: Jens Schleusener Closes: https://bugzilla.kernel.org/show_bug.cgi?id=205891 Signed-off-by: Ankit Chauhan Link: https://patch.msgid.link/20250612075057.80433-1-ankitchauhan2065@gmail.com [arj: Replace U+2192 with '->'] Signed-off-by: Andrew Jeffery commit 2236141ed3d6f31f53147c26208dafef6051ae43 Author: Peter Yin Date: Wed Jun 11 16:05:14 2025 +0800 ARM: dts: aspeed: harma: add mmc health Add a GPIO expander node at address 0x13 on i2c11 bus to monitor MMC health status via a dedicated GPIO line. Signed-off-by: Peter Yin Link: https://patch.msgid.link/20250611080514.3123335-6-peteryin.openbmc@gmail.com Signed-off-by: Andrew Jeffery commit ce5b2797b4fada53f669a6d474b2cbceb5c883a1 Author: Peter Yin Date: Wed Jun 11 16:05:13 2025 +0800 ARM: dts: aspeed: Harma: revise gpio bride pin for battery Update the GPIO bridge pin configuration for the battery circuit on the Harma platform to reflect the correct hardware design. Signed-off-by: Peter Yin Link: https://patch.msgid.link/20250611080514.3123335-5-peteryin.openbmc@gmail.com Signed-off-by: Andrew Jeffery commit de5cdbff1e682b3608b76e0258426d1b4d2ab4d2 Author: Peter Yin Date: Wed Jun 11 16:05:12 2025 +0800 ARM: dts: aspeed: harma: add ADC128D818 for voltage monitoring Add the ADC128D818 device to I2C bus 29 to support voltage monitoring on the Harma platform. This enables accurate measurement of system voltages through the onboard ADC. Signed-off-by: Peter Yin Link: https://patch.msgid.link/20250611080514.3123335-4-peteryin.openbmc@gmail.com Signed-off-by: Andrew Jeffery commit 32885aa268e1c2f2ad81ab129b10664af12ee532 Author: Peter Yin Date: Wed Jun 11 16:05:11 2025 +0800 ARM: dts: aspeed: harma: add fan board I/O expander Add GPIO I/O expander node for the fan board to detect and monitor fan board status. Signed-off-by: Peter Yin Link: https://patch.msgid.link/20250611080514.3123335-3-peteryin.openbmc@gmail.com Signed-off-by: Andrew Jeffery commit cffc64d37db365c7eec6371ead20336da01455e9 Author: Peter Yin Date: Wed Jun 11 16:05:10 2025 +0800 ARM: dts: aspeed: harma: add E1.S power monitor Add the E1.S power monitor device node to the Harma device tree to enable power monitoring functionality for E1.S drives. Signed-off-by: Peter Yin Link: https://patch.msgid.link/20250611080514.3123335-2-peteryin.openbmc@gmail.com Signed-off-by: Andrew Jeffery commit 4770567623929e6f34367d94c2d25b7c5f5cb177 Author: Potin Lai Date: Wed Jun 11 01:02:09 2025 +0800 ARM: dts: aspeed: catalina: Enable MCTP for frontend NIC management Add the `mctp-controller` property and MCTP nodes to enable support for frontend NIC management via PLDM over MCTP. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250611-catalina-mctp-i2c-10-15-v1-1-2a882e461ed9@gmail.com Signed-off-by: Andrew Jeffery commit 480dd4dddfc510c70e45f3d35a7df8a8a1511a7b Author: Chin-Yen Lee Date: Tue Jul 1 15:38:39 2025 +0800 wifi: rtw89: enter power save mode aggressively Currently the driver allows the WiFi chip enter power save mode by checking the transmitting and receiving traffic is very low per two seconds. But it's hard for some applications to enter power save mode, like video streaming, which sends burst traffic regularly for other side to buffer and only send little traffic at most time. So adjust the criteria to enter power save while lower than 10Mbps and check it per 100ms. Thus WiFi chip could reduce power consumption under these applications. Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250701073839.31905-1-pkshih@realtek.com commit 0030088148d5a070f445c1522989e490b311286b Author: Bitterblue Smith Date: Mon Jun 30 23:47:52 2025 +0300 wifi: rtw89: Enable the new USB modules Enable compilation of the new rtw89_usb and rtw89_8851bu modules. Tested mostly in station mode, and a little bit in AP mode. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/4968a9d5-02c8-4d35-a5ad-b75ece8f5d36@gmail.com commit 52cf4432378568ba1ed275b5aecc61c66dad7368 Author: Bitterblue Smith Date: Mon Jun 30 23:47:19 2025 +0300 wifi: rtw89: Add rtw8851bu.c This is the entry point for the new rtw89_8851bu module. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/9d40c265-2982-4073-84a3-d3781defdbca@gmail.com commit 2135c28be6a84313580a974f7d6890830b83107e Author: Bitterblue Smith Date: Mon Jun 30 23:46:55 2025 +0300 wifi: rtw89: Add usb.{c,h} Add basic USB support. No TX/RX aggregation, no switching to USB 3 mode. RTL8851BU and RTL8832BU work. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/f9ad1664-2d63-4a8f-88bf-c7b7bececbfe@gmail.com commit ed88640ea1ac441d5cda98f7c478fcdf34263fa7 Author: Bitterblue Smith Date: Mon Jun 30 23:46:32 2025 +0300 wifi: rtw89: Add some definitions for USB Add various register and bit definitions which will be used by the new USB driver. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/5812bb0c-20d0-48df-916d-25225eee8132@gmail.com commit e2b71603333a9dd73ee88347d8894fffc3456ac1 Author: Bitterblue Smith Date: Mon Jun 30 23:45:55 2025 +0300 wifi: rtw89: Fix rtw89_mac_power_switch() for USB Clear some bits in some registers in order to allow RTL8851BU to power on. This is done both when powering on and when powering off because that's what the vendor driver does. Also tested with RTL8832BU and RTL8832CU. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/a39da939-d640-4486-ad38-f658f220afc8@gmail.com commit e906a11753c96d553c4ace3201f57e08e21bfdba Author: Bitterblue Smith Date: Mon Jun 30 23:45:32 2025 +0300 wifi: rtw89: 8851b: Modify rtw8851b_pwr_{on,off}_func() for USB There are a few differences in the power on/off functions between PCIE and USB. While the RTL8851BU appears to work without these changes, it's probably best to implement them, in case they are needed in some situations. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/469f6882-1859-464d-8a84-9ef1b6c8ce3e@gmail.com commit 0740c6beefae03066a562e3047959528d8893709 Author: Bitterblue Smith Date: Mon Jun 30 23:45:02 2025 +0300 wifi: rtw89: Hide some errors when the device is unplugged A few unnecessary error messages are printed when the device is unplugged. "read swsi busy" in particular can appear ~1000 times when RTL8851BU is unplugged. Add a new flag RTW89_FLAG_UNPLUGGED and print some error messages only when this flag is not set. The new USB driver will set the flag when the device is unplugged. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/cc18b739-6f38-4c1a-a681-1e2a0d4ed60d@gmail.com commit ec542d5e4bf660463d8d578ecebb511cbfe66558 Author: Bitterblue Smith Date: Mon Jun 30 23:44:28 2025 +0300 wifi: rtw89: Add extra TX headroom for USB In the case of USB the TX descriptor is transmitted in the same buffer as the 802.11 frame, so add the required headroom. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/91fb7579-60e5-4a06-8007-3312639beea6@gmail.com commit a3b871a0f7c083c2a632a31da8bc3de554ae8550 Author: Bitterblue Smith Date: Mon Jun 30 23:43:25 2025 +0300 wifi: rtw89: Disable deep power saving for USB/SDIO Disable deep power saving for USB and SDIO because rtw89_mac_send_rpwm() is called in atomic context and accessing hardware registers results in "scheduling while atomic" errors. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/0f49eceb-0de0-47e2-ba36-3c6a0dddd17d@gmail.com commit 02a44c2630318b880d49000f151a6d1e450e76e2 Author: Bitterblue Smith Date: Mon Jun 30 23:42:55 2025 +0300 wifi: rtw89: Add rtw8851b_hfc_param_ini_usb "hfc" means "hci fc" which is "Host Control Interface Flow Control". These are some parameters needed for RTL8851BU. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/a0dec631-de05-4302-9ef1-e730eb233f08@gmail.com commit 3c63450c872300546f2454e5972719dc725f8416 Author: Bitterblue Smith Date: Mon Jun 30 23:42:24 2025 +0300 wifi: rtw89: Add rtw8851b_dle_mem_usb{2,3} Add rtw8851b_dle_mem_usb2 and rtw8851b_dle_mem_usb3 and their various quotas and sizes in struct rtw89_mac_size_set. "dle" could be "Data Link Engine" or "Double Link Engine". These are some parameters needed for RTL8851BU. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/91622304-614e-4e91-bf2f-7688cf44070b@gmail.com commit 82870ba25f32b8f38fb882ce1336789f11bae969 Author: Bitterblue Smith Date: Mon Jun 30 23:42:01 2025 +0300 wifi: rtw89: Make hfc_param_ini in rtw89_chip_info an array USB and SDIO will need different sets of values, so make hfc_param_ini in struct rtw89_chip_info an array. Also make param_ini a pointer instead of copying the struct. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/1356f901-9ebf-451e-827f-50dd3efda534@gmail.com commit ee47816f24a1c07ea31f251546c75b42362d6cef Author: Bitterblue Smith Date: Mon Jun 30 23:41:34 2025 +0300 wifi: rtw89: Make dle_mem in rtw89_chip_info an array USB 2, USB 3, and SDIO will need different sets of values compared to PCIe. Add a new dle_type member in struct rtw89_hci_info and make dle_mem in struct rtw89_chip_info an array to hold the four different sets of values. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/c9152735-dbc4-4473-ae29-a79625cfbf78@gmail.com commit 4b6ea5a381979239758a1979cdf29f8d34201110 Author: Bitterblue Smith Date: Mon Jun 30 23:40:58 2025 +0300 wifi: rtw89: 8851b: Accept USB devices and load their MAC address Make rtw8851b_read_efuse() accept USB devices and load the MAC address from the correct offset. Signed-off-by: Bitterblue Smith Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/6b2a1382-3be4-4038-8005-cf96922e4332@gmail.com commit 03fe01ddd1d8be7799419ea5e5f228a0186ae8c2 Merge: 032547272eb088 82bc4abf28d814 Author: Alexei Starovoitov Date: Thu Jul 3 19:31:30 2025 -0700 Merge branch 'bpf-reduce-verifier-stack-frame-size' Yonghong Song says: ==================== bpf: Reduce verifier stack frame size Arnd Bergmann reported an issue ([1]) where clang compiler (less than llvm18) may trigger an error where the stack frame size exceeds the limit. I can reproduce the error like below: kernel/bpf/verifier.c:24491:5: error: stack frame size (2552) exceeds limit (1280) in 'bpf_check' [-Werror,-Wframe-larger-than] kernel/bpf/verifier.c:19921:12: error: stack frame size (1368) exceeds limit (1280) in 'do_check' [-Werror,-Wframe-larger-than] This patch series fixed the above two errors by reducing stack size. See each individual patches for details. [1] https://lore.kernel.org/bpf/20250620113846.3950478-1-arnd@kernel.org/ Changelogs: v2 -> v3: - v2: https://lore.kernel.org/bpf/20250702171134.2370432-1-yonghong.song@linux.dev/ - Rename env->callchain to env->callchain_buf so it is clear that - env->callchain_buf is used for a temp buf. v1 -> v2: - v1: https://lore.kernel.org/bpf/20250702053332.1991516-1-yonghong.song@linux.dev/ - Simplify assignment to struct bpf_insn pointer in do_misc_fixups(). - Restore original implementation in opt_hard_wire_dead_code_branches() as only one insn on the stack. - Avoid unnecessary insns for 64bit modulo (mod 0/-1) operations. ==================== Link: https://patch.msgid.link/20250703141101.1482025-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 82bc4abf28d8147dd5da9ba52f0aa1bac23c125e Author: Yonghong Song Date: Thu Jul 3 07:11:17 2025 -0700 bpf: Avoid putting struct bpf_scc_callchain variables on the stack Add a 'struct bpf_scc_callchain callchain_buf' field in bpf_verifier_env. This way, the previous bpf_scc_callchain local variables can be replaced by taking address of env->callchain_buf. This can reduce stack usage and fix the following error: kernel/bpf/verifier.c:19921:12: error: stack frame size (1368) exceeds limit (1280) in 'do_check' [-Werror,-Wframe-larger-than] Reported-by: Arnd Bergmann Acked-by: Jiri Olsa Acked-by: Eduard Zingerman Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250703141117.1485108-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 45e9cd38aa8df9f4673d73bb86f7c9626d513a76 Author: Yonghong Song Date: Thu Jul 3 07:11:11 2025 -0700 bpf: Reduce stack frame size by using env->insn_buf for bpf insns Arnd Bergmann reported an issue ([1]) where clang compiler (less than llvm18) may trigger an error where the stack frame size exceeds the limit. I can reproduce the error like below: kernel/bpf/verifier.c:24491:5: error: stack frame size (2552) exceeds limit (1280) in 'bpf_check' [-Werror,-Wframe-larger-than] kernel/bpf/verifier.c:19921:12: error: stack frame size (1368) exceeds limit (1280) in 'do_check' [-Werror,-Wframe-larger-than] Use env->insn_buf for bpf insns instead of putting these insns on the stack. This can resolve the above 'bpf_check' error. The 'do_check' error will be resolved in the next patch. [1] https://lore.kernel.org/bpf/20250620113846.3950478-1-arnd@kernel.org/ Reported-by: Arnd Bergmann Tested-by: Arnd Bergmann Acked-by: Jiri Olsa Acked-by: Eduard Zingerman Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250703141111.1484521-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 3b87251439b2abf207b9b2cc03bf8d29ae6bb257 Author: Yonghong Song Date: Thu Jul 3 07:11:06 2025 -0700 bpf: Simplify assignment to struct bpf_insn pointer in do_misc_fixups() In verifier.c, the following code patterns (in two places) struct bpf_insn *patch = &insn_buf[0]; can be simplified to struct bpf_insn *patch = insn_buf; which is easier to understand. Acked-by: Eduard Zingerman Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250703141106.1483216-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 032547272eb0884470165e6a8fd73b80688e847f Author: Paul Chaignon Date: Thu Jul 3 23:35:09 2025 +0200 bpf: Avoid warning on unexpected map for tail call Before handling the tail call in record_func_key(), we check that the map is of the expected type and log a verifier error if it isn't. Such an error however doesn't indicate anything wrong with the verifier. The check for map<>func compatibility is done after record_func_key(), by check_map_func_compatibility(). Therefore, this patch logs the error as a typical reject instead of a verifier error. Fixes: d2e4c1e6c294 ("bpf: Constant map key tracking for prog array pokes") Fixes: 0df1a55afa83 ("bpf: Warn on internal verifier errors") Reported-by: syzbot+efb099d5833bca355e51@syzkaller.appspotmail.com Signed-off-by: Paul Chaignon Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/1f395b74e73022e47e04a31735f258babf305420.1751578055.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov commit 71b4a9959e228708c702008d99273ad65442e21e Merge: da7e9c0a7fbc5b 5697683e133d05 Author: Alexei Starovoitov Date: Thu Jul 3 19:30:07 2025 -0700 Merge branch 'bpf-standard-streams' Kumar Kartikeya Dwivedi says: ==================== BPF Standard Streams This set introduces a standard output interface with two streams, namely stdout and stderr, for BPF programs. The idea is that these streams will be written to by BPF programs and the kernel, and serve as standard interfaces for informing user space of any BPF runtime violations. Users can also utilize them for printing normal messages for debugging usage, as is the case with bpf_printk() and trace pipe interface. BPF programs and the kernel can use these streams to output messages. User space can dump these messages using bpftool. The stream interface itself is implemented using a lockless list, so that we can queue messages from any context. Every printk statement into the stream leads to memory allocation. Allocation itself relies on try_alloc_pages() to construct a bespoke bump allocator to carve out elements. If this fails, we finally give up and drop the message. See commit logs for more details. Two scenarios are covered: - Deadlocks and timeouts in rqspinlock. - Timeouts for may_goto. In each we provide the stack trace and source information for the offending BPF programs. Both the C source line and the file and line numbers are printed. The output format is as follows: ERROR: AA or ABBA deadlock detected for bpf_res_spin_lock Attempted lock = 0xff11000108f3a5e0 Total held locks = 1 Held lock[ 0] = 0xff11000108f3a5e0 CPU: 48 UID: 0 PID: 786 Comm: test_progs Call trace: bpf_stream_stage_dump_stack+0xb0/0xd0 bpf_prog_report_rqspinlock_violation+0x10b/0x130 bpf_res_spin_lock+0x8c/0xa0 bpf_prog_3699ea119d1f6ed8_foo+0xe5/0x140 if (!bpf_res_spin_lock(&v2->lock)) @ stream_bpftool.c:62 bpf_prog_9b324ec4a1b2a5c0_stream_bpftool_dump_prog_stream+0x7e/0x2d0 foo(stream); @ stream_bpftool.c:93 bpf_prog_test_run_syscall+0x102/0x240 __sys_bpf+0xd68/0x2bf0 __x64_sys_bpf+0x1e/0x30 do_syscall_64+0x68/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e ERROR: Timeout detected for may_goto instruction CPU: 48 UID: 0 PID: 786 Comm: test_progs Call trace: bpf_stream_stage_dump_stack+0xb0/0xd0 bpf_prog_report_may_goto_violation+0x6a/0x90 bpf_check_timed_may_goto+0x4d/0xa0 arch_bpf_timed_may_goto+0x21/0x40 bpf_prog_3699ea119d1f6ed8_foo+0x12f/0x140 while (can_loop) @ stream_bpftool.c:71 bpf_prog_9b324ec4a1b2a5c0_stream_bpftool_dump_prog_stream+0x7e/0x2d0 foo(stream); @ stream_bpftool.c:93 bpf_prog_test_run_syscall+0x102/0x240 __sys_bpf+0xd68/0x2bf0 __x64_sys_bpf+0x1e/0x30 do_syscall_64+0x68/0x140 entry_SYSCALL_64_after_hwframe+0x76/0x7e Changelog: ---------- v4 -> v5 v4: https://lore.kernel.org/bpf/20250702031737.407548-1-memxor@gmail.com * Add acks from Emil. * Address various nits. * Add extra failure tests. * Make deadlock test a little more robust to catch problems. v3 -> v4 v3: https://lore.kernel.org/bpf/20250624031252.2966759-1-memxor@gmail.com * Switch to alloc_pages_nolock(), avoid incorrect memcg accounting. (Alexei) * We will figure out proper accounting later. * Drop error limit logic, restrict stream capacity to 100,000 bytes. (Alexei) * Remove extra invocation of is_bpf_text_address(). (Jiri) * Avoid emitting NULL byte into the stream text, adjust regex in selftests. (Alexei) * Add comment around rcu_read_lock() for bpf_prog_ksym_find. (Alexei) * Tighten stream capacity check selftest. * Add acks from Andrii. v2 -> v3 v2: https://lore.kernel.org/bpf/20250524011849.681425-1-memxor@gmail.com * Fix bug when handling single element stream stage. (Eduard) * Move to mutex for protection of stream read and copy_to_user(). (Alexei) * Split bprintf refactor into its own patch. (Alexei) * Move kfunc definition to common_btf_ids to avoid initcall proliferation. (Alexei) * Return line number by reference in bpf_prog_get_file_line. (Alexei) * Remove NULL checks for BTF name pointer. (Alexei) * Add WARN_ON_ONCE(!rcu_read_lock_held()) in bpf_prog_ksym_find. (Eduard) * Remove hardcoded stream stage from macros. (Alexei, Eduard) * Move refactoring hunks to their own patch. (Alexei) * Add empty opts parameter for future extensibility to libbpf API. (Andrii, Eduard) * Add BPF_STREAM_{STDOUT,STDERR} to UAPI. (Andrii) * Add code to match on backtrace output. (Eduard) * Fix misc nits. * Add acks. v1 -> v2 v1: https://lore.kernel.org/bpf/20250507171720.1958296-1-memxor@gmail.com * Drop arena page fault prints, will be done as follow up. (Alexei) * Defer Andrii's request to reuse code and Alan's suggestion of error counts to follow up. * Drop bpf_dynptr_from_mem_slice patch. * Drop some acks due to heavy reworking. * Fix KASAN splat in bpf_prog_get_file_line. (Eduard) * Collapse bpf_prog_ksym_find and is_bpf_text_address into single call. (Eduard) * Add missing RCU read lock in bpf_prog_ksym_find. * Fix incorrect error handling in dump_stack_cb. * Simplify libbpf macro. (Eduard, Andrii) * Introduce bpf_prog_stream_read() libbpf API. (Eduard, Alexei, Andrii) * Drop BPF prog from the bpftool, use libbpf API. * Rework selftests. RFC v1 -> v1 RFC v1: https://lore.kernel.org/bpf/20250414161443.1146103-1-memxor@gmail.com * Rebase on bpf-next/master. * Change output in dump_stack to also print source line. (Alexei) * Simplify API to single pop() operation. (Eduard, Alexei) * Add kdoc for bpf_dynptr_from_mem_slice. * Fix -EINVAL returned from prog_dump_stream. (Eduard) * Split dump_stack() patch into multiple commits. * Add macro wrapping stream staging API. * Change bpftool command from dump to tracelog. (Quentin) * Add bpftool documentation and bash completion. (Quentin) * Change license of bpftool to Dual BSD/GPL. * Simplify memory allocator. (Alexei) * No overflow into second page. * Remove bpf_mem_alloc() fallback. * Symlink bpftool BPF program and exercise as selftest. (Eduard) * Verify output after dumping from ringbuf. (Eduard) * More failure cases to check API invariants. * Remove patches for dynptr lifetime fixes (split into separate set). * Limit maximum error messages, and add stream capacity. (Eduard) ==================== Link: https://patch.msgid.link/20250703204818.925464-1-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 5697683e133d05e6333ee1f12a7e8dd402593258 Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:18 2025 -0700 selftests/bpf: Add tests for prog streams Add selftests to stress test the various facets of the stream API, memory allocation pattern, and ensuring dumping support is tested and functional. Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-13-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 876f5ebd58a9ac42f48a7ead3d5b274a314e0ace Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:17 2025 -0700 bpftool: Add support for dumping streams Add support for printing the BPF stream contents of a program in bpftool. The new bpftool prog tracelog command is extended to take stdout and stderr arguments, and then the prog specification. The bpf_prog_stream_read() API added in previous patch is simply reused to grab data and then it is dumped to the respective file. The stdout data is sent to stdout, and stderr is printed to stderr. Cc: Quentin Monnet Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-12-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 3bbc1ba9cc0d9a7ccc194883489a4e460ca5080b Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:16 2025 -0700 libbpf: Introduce bpf_prog_stream_read() API Introduce a libbpf API so that users can read data from a given BPF stream for a BPF prog fd. For now, only the low-level syscall wrapper is provided, we can add a bpf_program__* accessor as a follow up if needed. Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-11-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 21a3afc76a317b9fb214c5afcfd5e1587b2ae9b3 Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:15 2025 -0700 libbpf: Add bpf_stream_printk() macro Add a convenience macro to print data to the BPF streams. BPF_STDOUT and BPF_STDERR stream IDs in the vmlinux.h can be passed to the macro to print to the respective streams. Acked-by: Andrii Nakryiko Acked-by: Eduard Zingerman Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-10-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit ecec5b5743bf964f3e2bb5486daee058344d9066 Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:14 2025 -0700 bpf: Report rqspinlock deadlocks/timeout to BPF stderr Begin reporting rqspinlock deadlocks and timeout to BPF program's stderr. Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-9-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit e8d01330225210a8af55f5683fb2ca726717ee16 Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:13 2025 -0700 bpf: Report may_goto timeout to BPF stderr Begin reporting may_goto timeouts to BPF program's stderr stream. Acked-by: Eduard Zingerman Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-8-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit d7c431cafcb4917b0d87b5cd10637cd47b6c8d79 Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:12 2025 -0700 bpf: Add dump_stack() analogue to print to BPF stderr Introduce a kernel function which is the analogue of dump_stack() printing some useful information and the stack trace. This is not exposed to BPF programs yet, but can be made available in the future. When we have a program counter for a BPF program in the stack trace, also additionally output the filename and line number to make the trace helpful. The rest of the trace can be passed into ./decode_stacktrace.sh to obtain the line numbers for kernel symbols. Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-7-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit f0c53fd4a742f957da7077a691a85ef9775907dc Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:11 2025 -0700 bpf: Add function to find program from stack trace In preparation of figuring out the closest program that led to the current point in the kernel, implement a function that scans through the stack trace and finds out the closest BPF program when walking down the stack trace. Special care needs to be taken to skip over kernel and BPF subprog frames. We basically scan until we find a BPF main prog frame. The assumption is that if a program calls into us transitively, we'll hit it along the way. If not, we end up returning NULL. Contextually the function will be used in places where we know the program may have called into us. Due to reliance on arch_bpf_stack_walk(), this function only works on x86 with CONFIG_UNWINDER_ORC, arm64, and s390. Remove the warning from arch_bpf_stack_walk as well since we call it outside bpf_throw() context. Acked-by: Eduard Zingerman Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-6-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit d090326860096df9dac6f27cff76d3f8df44d4f1 Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:10 2025 -0700 bpf: Ensure RCU lock is held around bpf_prog_ksym_find Add a warning to ensure RCU lock is held around tree lookup, and then fix one of the invocations in bpf_stack_walker. The program has an active stack frame and won't disappear. Use the opportunity to remove unneeded invocation of is_bpf_text_address. Fixes: f18b03fabaa9 ("bpf: Implement BPF exceptions") Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-5-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 0e521efaf36350b8f783984541efa56f560c90b0 Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:09 2025 -0700 bpf: Add function to extract program source info Prepare a function for use in future patches that can extract the file info, line info, and the source line number for a given BPF program provided it's program counter. Only the basename of the file path is provided, given it can be excessively long in some cases. This will be used in later patches to print source info to the BPF stream. Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-4-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 5ab154f1463a111e1dc8fd5d31eaa7a2a71fe2e6 Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:08 2025 -0700 bpf: Introduce BPF standard streams Add support for a stream API to the kernel and expose related kfuncs to BPF programs. Two streams are exposed, BPF_STDOUT and BPF_STDERR. These can be used for printing messages that can be consumed from user space, thus it's similar in spirit to existing trace_pipe interface. The kernel will use the BPF_STDERR stream to notify the program of any errors encountered at runtime. BPF programs themselves may use both streams for writing debug messages. BPF library-like code may use BPF_STDERR to print warnings or errors on misuse at runtime. The implementation of a stream is as follows. Everytime a message is emitted from the kernel (directly, or through a BPF program), a record is allocated by bump allocating from per-cpu region backed by a page obtained using alloc_pages_nolock(). This ensures that we can allocate memory from any context. The eventual plan is to discard this scheme in favor of Alexei's kmalloc_nolock() [0]. This record is then locklessly inserted into a list (llist_add()) so that the printing side doesn't require holding any locks, and works in any context. Each stream has a maximum capacity of 4MB of text, and each printed message is accounted against this limit. Messages from a program are emitted using the bpf_stream_vprintk kfunc, which takes a stream_id argument in addition to working otherwise similar to bpf_trace_vprintk. The bprintf buffer helpers are extracted out to be reused for printing the string into them before copying it into the stream, so that we can (with the defined max limit) format a string and know its true length before performing allocations of the stream element. For consuming elements from a stream, we expose a bpf(2) syscall command named BPF_PROG_STREAM_READ_BY_FD, which allows reading data from the stream of a given prog_fd into a user space buffer. The main logic is implemented in bpf_stream_read(). The log messages are queued in bpf_stream::log by the bpf_stream_vprintk kfunc, and then pulled and ordered correctly in the stream backlog. For this purpose, we hold a lock around bpf_stream_backlog_peek(), as llist_del_first() (if we maintained a second lockless list for the backlog) wouldn't be safe from multiple threads anyway. Then, if we fail to find something in the backlog log, we splice out everything from the lockless log, and place it in the backlog log, and then return the head of the backlog. Once the full length of the element is consumed, we will pop it and free it. The lockless list bpf_stream::log is a LIFO stack. Elements obtained using a llist_del_all() operation are in LIFO order, thus would break the chronological ordering if printed directly. Hence, this batch of messages is first reversed. Then, it is stashed into a separate list in the stream, i.e. the backlog_log. The head of this list is the actual message that should always be returned to the caller. All of this is done in bpf_stream_backlog_fill(). From the kernel side, the writing into the stream will be a bit more involved than the typical printk. First, the kernel typically may print a collection of messages into the stream, and parallel writers into the stream may suffer from interleaving of messages. To ensure each group of messages is visible atomically, we can lift the advantage of using a lockless list for pushing in messages. To enable this, we add a bpf_stream_stage() macro, and require kernel users to use bpf_stream_printk statements for the passed expression to write into the stream. Underneath the macro, we have a message staging API, where a bpf_stream_stage object on the stack accumulates the messages being printed into a local llist_head, and then a commit operation splices the whole batch into the stream's lockless log list. This is especially pertinent for rqspinlock deadlock messages printed to program streams. After this change, we see each deadlock invocation as a non-interleaving contiguous message without any confusion on the reader's part, improving their user experience in debugging the fault. While programs cannot benefit from this staged stream writing API, they could just as well hold an rqspinlock around their print statements to serialize messages, hence this is kept kernel-internal for now. Overall, this infrastructure provides NMI-safe any context printing of messages to two dedicated streams. Later patches will add support for printing splats in case of BPF arena page faults, rqspinlock deadlocks, and cond_break timeouts, and integration of this facility into bpftool for dumping messages to user space. [0]: https://lore.kernel.org/bpf/20250501032718.65476-1-alexei.starovoitov@gmail.com Reviewed-by: Eduard Zingerman Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 0426729f46cd1f6354fad07267a21579186a5757 Author: Kumar Kartikeya Dwivedi Date: Thu Jul 3 13:48:07 2025 -0700 bpf: Refactor bprintf buffer support Refactor code to be able to get and put bprintf buffers and use bpf_printf_prepare independently. This will be used in the next patch to implement BPF streams support, particularly as a staging buffer for strings that need to be formatted and then allocated and pushed into a stream. Reviewed-by: Emil Tsalapatis Signed-off-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250703204818.925464-2-memxor@gmail.com Signed-off-by: Alexei Starovoitov commit 58f1510a8b6deb9872a23bc636b4859c08518f66 Author: Ping-Ke Shih Date: Fri Jun 27 11:53:38 2025 +0800 wifi: rtw89: 8851b: rfk: update IQK to 0x14 Update IQK along with TX/RX clock to 960MHz and 1920MHz to improve performance. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250627035338.16637-1-pkshih@realtek.com commit da7e9c0a7fbc5b8552575db16c991e82b7c5fa5c Author: Tao Chen Date: Wed Jul 2 23:39:58 2025 +0800 bpf: Add show_fdinfo for kprobe_multi Show kprobe_multi link info with fdinfo, the info as follows: link_type: kprobe_multi link_id: 1 prog_tag: a69740b9746f7da8 prog_id: 21 kprobe_cnt: 8 missed: 0 cookie func 1 bpf_fentry_test1+0x0/0x20 7 bpf_fentry_test2+0x0/0x20 2 bpf_fentry_test3+0x0/0x20 3 bpf_fentry_test4+0x0/0x20 4 bpf_fentry_test5+0x0/0x20 5 bpf_fentry_test6+0x0/0x20 6 bpf_fentry_test7+0x0/0x20 8 bpf_fentry_test8+0x0/0x10 Signed-off-by: Tao Chen Link: https://lore.kernel.org/r/20250702153958.639852-3-chen.dylane@linux.dev Signed-off-by: Alexei Starovoitov commit b4dfe26fbf56f7b3e50764268e14b73f1632bfc0 Author: Tao Chen Date: Wed Jul 2 23:39:57 2025 +0800 bpf: Add show_fdinfo for uprobe_multi Show uprobe_multi link info with fdinfo, the info as follows: link_type: uprobe_multi link_id: 9 prog_tag: e729f789e34a8eca prog_id: 39 uprobe_cnt: 3 pid: 0 path: /home/dylane/bpf/tools/testing/selftests/bpf/test_progs cookie offset ref_ctr_offset 3 0xa69f13 0x0 1 0xa69f1e 0x0 2 0xa69f29 0x0 Signed-off-by: Tao Chen Link: https://lore.kernel.org/r/20250702153958.639852-2-chen.dylane@linux.dev Signed-off-by: Alexei Starovoitov commit 803f0700a3bbf528c4c624a22f87d08178ca0fbe Author: Tao Chen Date: Wed Jul 2 23:39:56 2025 +0800 bpf: Show precise link_type for {uprobe,kprobe}_multi fdinfo Alexei suggested, 'link_type' can be more precise and differentiate for human in fdinfo. In fact BPF_LINK_TYPE_KPROBE_MULTI includes kretprobe_multi type, the same as BPF_LINK_TYPE_UPROBE_MULTI, so we can show it more concretely. link_type: kprobe_multi link_id: 1 prog_tag: d2b307e915f0dd37 ... link_type: kretprobe_multi link_id: 2 prog_tag: ab9ea0545870781d ... link_type: uprobe_multi link_id: 9 prog_tag: e729f789e34a8eca ... link_type: uretprobe_multi link_id: 10 prog_tag: 7db356c03e61a4d4 Co-developed-by: Jiri Olsa Signed-off-by: Jiri Olsa Signed-off-by: Tao Chen Link: https://lore.kernel.org/r/20250702153958.639852-1-chen.dylane@linux.dev Signed-off-by: Alexei Starovoitov commit 56624544c8a63f85f6811b0c2c090d38ca6ab8dc Author: Ping-Ke Shih Date: Fri Jun 27 11:53:28 2025 +0800 wifi: rtw89: 8851b: rfk: update DPK to 0x11 Update DPK with TX/RX clock to 960MHz and 1920MHz, which improve performance on certain chips. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250627035328.16577-1-pkshih@realtek.com commit de2a9b2837608945d725d94d8dea44377e2fc291 Author: Ping-Ke Shih Date: Fri Jun 27 11:51:59 2025 +0800 wifi: rtw89: 8851b: update NCTL 0xB To support new commands in DPK 0x11, update NCTL to version 0xB. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250627035201.16416-5-pkshih@realtek.com commit 408d55331f961b4dbbcaa2edf63999ab2b2e3907 Author: Ping-Ke Shih Date: Fri Jun 27 11:51:58 2025 +0800 wifi: rtw89: 8851b: adjust ADC setting for RF calibration To get expected result of RF calibration at runtime, adjust ADC setting ahead for coming changes of RF calibration. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250627035201.16416-4-pkshih@realtek.com commit 64d0633f1c476ed234355f7dca3c9cf83bb9f38b Author: Ping-Ke Shih Date: Fri Jun 27 11:51:57 2025 +0800 wifi: rtw89: 8851b: set ADC bandwidth select according to calibration value To handle hardware characteristic of ADC, calibrate the function and add a efuse field to record result, which driver uses it to set proper value accordingly. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250627035201.16416-3-pkshih@realtek.com commit 626afc6cd5369bbf3c4b487ab1bb87a7e5ff0b3b Author: Ping-Ke Shih Date: Fri Jun 27 11:51:56 2025 +0800 wifi: rtw89: 8851b: rfk: extend DPK path_ok type to u8 Originally the type of path_ok is bool to denote that DPK is ready on certain path and can be enabled. For RTL8851B, hardware design can support more than one calibration set, so use type u8 instead to record the hardware set in current use. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250627035201.16416-2-pkshih@realtek.com commit 34d9a2aa7f5015f69899a8f665b052b8dcf87317 Author: Pei Xiao Date: Tue Jun 24 10:52:40 2025 +0800 wifi: rtw88: coex: Use bitwise instead of arithmetic operator for flags This silences the following coccinelle warning: WARNING: sum of probable bitmasks, consider | Compile tested only. Signed-off-by: Pei Xiao Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/c68a8642c325f626ac34ccee71d9d9aa69f0c92c.1750733428.git.xiaopei01@kylinos.cn commit e74a1c6a8e8af2422fce125c29b14f1d3fab5b5c Author: Sergey Senozhatsky Date: Fri Jun 27 16:18:21 2025 +0900 zram: pass buffer offset to zcomp_available_show() In most cases zcomp_available_show() is the only emitting function that is called from sysfs read() handler, so it assumes that there is a whole PAGE_SIZE buffer to work with. There is an exception, however: recomp_algorithm_show(). In recomp_algorithm_show() we prepend the buffer with priority number before we pass it to zcomp_available_show(), so it cannot assume PAGE_SIZE anymore and must take recomp_algorithm_show() modifications into consideration. Therefore we need to pass buffer offset to zcomp_available_show(). Also convert it to use sysfs_emit_at(), to stay aligned with the rest of zram's sysfs read() handlers. On practice we are never even close to using the whole PAGE_SIZE buffer, so that's not a critical bug, but still. Signed-off-by: Sergey Senozhatsky Link: https://lore.kernel.org/r/20250627071840.1394242-1-senozhatsky@chromium.org Signed-off-by: Jens Axboe commit 264a3fdab2365395e43d3a0b40162a29e61ffa22 Author: Rahul Kumar Date: Fri Jun 27 09:22:56 2025 +0530 block: zram: replace scnprintf() with sysfs_emit() in *_show() functions Replace scnprintf() with sysfs_emit() or sysfs_emit_at() in sysfs *_show() functions in zram_drv.c to follow the kernel's guidelines from Documentation/filesystems/sysfs.rst. This improves consistency, safety, and makes the code easier to maintain and update in the future. Signed-off-by: Rahul Kumar Reviewed-by: Sergey Senozhatsky Link: https://lore.kernel.org/r/20250627035256.1120740-1-rk0006818@gmail.com Signed-off-by: Jens Axboe commit 17d081ef84a6f3c2a1867cc753d7c8459a34d829 Merge: ca39a371742058 b4cd18f485687a Author: Dave Airlie Date: Fri Jul 4 11:54:21 2025 +1000 Merge tag 'drm-misc-next-2025-07-03' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 6.17: UAPI Changes: Cross-subsystem Changes: Core Changes: - bridge: More reference counting - dp: Implement backlight control helpers - fourcc: Add half-float and 32b float formats, RGB161616, BGR161616 - mipi-dsi: Drop MIPI_DSI_MODE_VSYNC_FLUSH flag - ttm: Improve eviction Driver Changes: - i915: Use backlight control helpers for eDP - tidss: Add AM65x OLDI bridge support - panels: - panel-edp: Add CMN N116BCJ-EAK support - raydium-rm67200: misc cleanups, optional reset - new panel: DJN HX83112B Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250703-chirpy-lilac-dalmatian-2c5838@houat commit ca39a37174205808911700c9469ce58d3ce5ee8e Merge: 7e2818386aad54 dccf655f69002d Author: Dave Airlie Date: Fri Jul 4 11:43:29 2025 +1000 Merge tag 'drm-intel-gt-next-2025-07-02' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next Driver Changes: Fixes/improvements/new stuff: - Avoid GuC scheduling stalls [guc] (Julia Filipchuk) - Remove force_probe requirement for DG1 (Ville Syrjälä) - Handle errors correctly to avoid losing GuC-2-Host messages [guc] (Jesus Narvaez) - Avoid double wakeref put if GuC context deregister failed [guc] (Jesus Narvaez) - Avoid timeline memory leak with signals and legacy platforms [ringbuf] (Janusz Krzysztofik) - Fix MEI (discrete) interrupt handler on RT kernels [gsc] (Junxiao Chang) Miscellaneous: - Allow larger memory allocation [selftest] (Mikolaj Wasiak) - Use provided dma_fence_is_chain (Tvrtko Ursulin) - Fix build error with GCOV and AutoFDO enabled [pmu] (Tzung-Bi Shih) - Fix build error some more (Arnd Bergmann) - Reduce stack usage in igt_vma_pin1() (Arnd Bergmann) - Move out engine related macros from i915_drv.h (Krzysztof Karas) - Move GEM_QUIRK_PIN_SWIZZLED_PAGES to i915_gem.h (Krzysztof Karas) Signed-off-by: Dave Airlie From: Tvrtko Ursulin Link: https://lore.kernel.org/r/aGTjUBeOQFw26bRT@linux commit 7554729de27daf6d54bcf8689d863bbe267828bf Author: Alex Elder Date: Thu Jun 12 17:48:55 2025 -0500 clk: spacemit: mark K1 pll1_d8 as critical The pll1_d8 clock is enabled by the boot loader, and is ultimately a parent for numerous clocks, including those used by APB and AXI buses. Guodong Xu discovered that this clock got disabled while responding to getting -EPROBE_DEFER when requesting a reset controller. The needed clock (CLK_DMA, along with its parents) had already been enabled. To respond to the probe deferral return, the CLK_DMA clock was disabled, and this led to parent clocks also reducing their enable count. When the enable count for pll1_d8 was decremented it became 0, which caused it to be disabled. This led to a system hang. Marking that clock critical resolves this by preventing it from being disabled. Define a new macro CCU_FACTOR_GATE_DEFINE() to allow clock flags to be supplied for a CCU_FACTOR_GATE clock. Fixes: 1b72c59db0add ("clk: spacemit: Add clock support for SpacemiT K1 SoC") Signed-off-by: Alex Elder Tested-by: Guodong Xu Reviewed-by: Haylen Chu Link: https://lore.kernel.org/r/20250612224856.1105924-1-elder@riscstar.com Signed-off-by: Yixun Lan commit 2c0cf4fed0f440200833ddfc24ea02de2cdc217c Author: Alex Elder Date: Wed Jul 2 06:37:08 2025 -0500 riscv: dts: spacemit: add reset support for the K1 SoC Define syscon nodes for the RCPU, RCPU2, and APBC2 SpacemiT CCUS, which currently support resets but not clocks in the SpacemiT K1. Signed-off-by: Alex Elder Reviewed-by: Philipp Zabel Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250702113709.291748-7-elder@riscstar.com Signed-off-by: Yixun Lan commit aadc509afc3630f666f4ef00bf86bdeeedb9b7cb Merge: 37df56ac500222 25a59e813cd2ca Author: Yixun Lan Date: Fri Jul 4 08:36:12 2025 +0800 Merge tag 'spacemit-reset-binding-for-6.17-1' of https://github.com/spacemit-com/linux RISC-V SpacemiT Binding for 6.17 - Reset DT Binding for K1 SoC * tag 'spacemit-reset-binding-for-6.17-1': dt-bindings: soc: spacemit: define spacemit,k1-ccu resets Signed-off-by: Yixun Lan commit 7e2818386aad54ba5ab70e228c555814d33bdad1 Merge: f41830c57bb8e7 2ecdb61f76ebd3 Author: Dave Airlie Date: Fri Jul 4 10:06:22 2025 +1000 Merge tag 'amd-drm-next-6.17-2025-07-01' of https://gitlab.freedesktop.org/agd5f/linux into drm-next amd-drm-next-6.17-2025-07-01: amdgpu: - FAMS2 fixes - OLED fixes - Misc cleanups - AUX fixes - DMCUB updates - SR-IOV hibernation support - RAS updates - DP tunneling fixes - DML2 fixes - Backlight improvements - Suspend improvements - Use scaling for non-native modes on eDP - SDMA 4.4.x fixes - PCIe DPM fixes - SDMA 5.x fixes - Cleaner shader updates for GC 9.x - Remove fence slab - ISP genpd support - Parition handling rework - SDMA FW checks for userq support - Add missing firmware declaration - Fix leak in amdgpu_ctx_mgr_entity_fini() - Freesync fix - Ring reset refactoring - Legacy dpm verbosity changes amdkfd: - GWS fix - mtype fix for ext coherent system memory - MMU notifier fix - gfx7/8 fix radeon: - CS validation support for additional GL extensions - Bump driver version for new CS validation checks From: Alex Deucher Link: https://lore.kernel.org/r/20250701194707.32905-1-alexander.deucher@amd.com Signed-off-by: Dave Airlie commit bc25e6bf032e8fb17e6985c6393a6cdee6010a28 Author: Louis-Alexis Eyraud Date: Thu Jul 3 17:41:03 2025 +0200 Input: mtk-pmic-keys - add support for MT6359 PMIC keys Add PMIC key support on MT6359 SoC. Signed-off-by: Louis-Alexis Eyraud Link: https://lore.kernel.org/r/20250703-add-mt6359-pmic-keys-support-v1-1-21a4d2774e34@collabora.com Signed-off-by: Dmitry Torokhov commit 4f5ee6405f8bde3d8c037531e0c57be5cd32de3d Author: Wolfram Sang Date: Thu Jun 5 11:47:58 2025 +0200 i3c: add patchwork entry to MAINTAINERS Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250605094757.8655-2-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 290ce8b2d0745e45a3155268184523a8c75996f1 Author: Jorge Marques Date: Sun Jun 22 12:11:07 2025 +0200 i3c: master: Initialize ret in i3c_i2c_notifier_call() Set ret to -EINVAL if i3c_i2c_notifier_call() receives an invalid action, resolving uninitialized warning. Signed-off-by: Jorge Marques Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250622-i3c-master-ret-uninitialized-v1-1-aabb5625c932@analog.com Signed-off-by: Alexandre Belloni commit a747e01adad2715bc002755ee15ef72360190ffc Author: Wolfram Sang Date: Wed Jun 4 12:18:30 2025 +0200 i3c: master: svc: use adapter timeout value for I2C transfers I2C adapters have their own timeout value which can be changed by userspace if desired. Use it for I2C transfers. The default is 1Hz, so the default behaviour is unchanged. Signed-off-by: Wolfram Sang Reviewed-by: Miquel Raynal Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250604101831.56585-5-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit c0a90eb55a69fc9016f4a0b19bb03708d6b1d0b7 Author: Wolfram Sang Date: Wed Jun 4 12:18:29 2025 +0200 i3c: mipi-i3c-hci: use adapter timeout value for I2C transfers I2C adapters have their own timeout value which can be changed by userspace if desired. Use it for I2C transfers. The default is 1Hz, so the default behaviour is unchanged. Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250604101831.56585-4-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit be27ed672878bdfb38580b491270f38cc5c36b38 Author: Wolfram Sang Date: Wed Jun 4 12:18:28 2025 +0200 i3c: master: cdns: use adapter timeout value for I2C transfers I2C adapters have their own timeout value which can be changed by userspace if desired. Use it for I2C transfers. The default is 1Hz, so the default behaviour is unchanged. Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250604101831.56585-3-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit 1b84691e7870bc5b6a66a1e81abe0eae8359dfce Author: Wolfram Sang Date: Wed Jun 4 12:18:27 2025 +0200 i3c: dw: use adapter timeout value for I2C transfers I2C adapters have their own timeout value which can be changed by userspace if desired. Use it for I2C transfers. The default is 1Hz, so the default behaviour is unchanged. Signed-off-by: Wolfram Sang Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250604101831.56585-2-wsa+renesas@sang-engineering.com Signed-off-by: Alexandre Belloni commit eaa655c2e5beaf2b29c69006d66f80149edebe1e Merge: b306791037bc72 52161035571cd6 Author: Linus Walleij Date: Fri Jul 4 00:22:48 2025 +0200 Merge tag 'renesas-pinctrl-for-v6.17-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-drivers into devel pinctrl: renesas: Updates for v6.17 - Use the new GPIO line value setter callbacks, - Validate pins before setting a mux function on RZ/G2L. Signed-off-by: Linus Walleij commit 1f24c0d819903cc30145d5fd8387f93ef637a62a Merge: 38d95beb4b2430 7b29689263fb21 Author: Andrii Nakryiko Date: Thu Jul 3 15:21:20 2025 -0700 Merge branch 'bpf-add-bpf_dynptr_memset-kfunc' Ihor Solodrai says: ==================== bpf: add bpf_dynptr_memset() kfunc Implement bpf_dynptr_memset() kfunc and add tests for it. v3->v4: * do error checks after slice, nits v2->v3: * nits and slow-path loop rewrite (Andrii) * simplify xdp chunks test (Mykyta) v1->v2: * handle non-linear buffers with bpf_dynptr_write() * change function signature to include offset arg * add more test cases v3: https://lore.kernel.org/bpf/20250630212113.573097-1-isolodrai@meta.com/ v2: https://lore.kernel.org/bpf/20250624205240.1311453-1-isolodrai@meta.com/ v1: https://lore.kernel.org/bpf/20250618223310.3684760-1-isolodrai@meta.com/ ==================== Link: https://patch.msgid.link/20250702210309.3115903-1-isolodrai@meta.com Signed-off-by: Andrii Nakryiko commit 7b29689263fb21cd0394a664d7d2d1cbc9d1fff1 Author: Ihor Solodrai Date: Wed Jul 2 14:03:09 2025 -0700 selftests/bpf: Add test cases for bpf_dynptr_memset() Add tests to verify the behavior of bpf_dynptr_memset(): * normal memset 0 * normal memset non-0 * memset with an offset * memset in dynptr that was adjusted * error: size overflow * error: offset+size overflow * error: readonly dynptr * memset into non-linear xdp dynptr Signed-off-by: Ihor Solodrai Signed-off-by: Andrii Nakryiko Acked-by: Mykyta Yatsenko Link: https://lore.kernel.org/bpf/20250702210309.3115903-3-isolodrai@meta.com commit 5fc5d8fded57e5de0c0b56b00c4cfc522aa8c572 Author: Ihor Solodrai Date: Wed Jul 2 14:03:08 2025 -0700 bpf: Add bpf_dynptr_memset() kfunc Currently there is no straightforward way to fill dynptr memory with a value (most commonly zero). One can do it with bpf_dynptr_write(), but a temporary buffer is necessary for that. Implement bpf_dynptr_memset() - an analogue of memset() from libc. Signed-off-by: Ihor Solodrai Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250702210309.3115903-2-isolodrai@meta.com commit b306791037bc7274c10372c4f3d777b0deb08f06 Author: Jack Ping CHNG Date: Fri Jun 27 08:54:19 2025 +0800 pinctrl: equilibrium: Add request and free hooks Add request and free gpio_chip hooks to support gpio allocation and release in the driver. Signed-off-by: Jack Ping CHNG Link: https://lore.kernel.org/20250627005419.3124660-1-jchng@maxlinear.com Signed-off-by: Linus Walleij commit b838fb5f16a355ef851b1ed7ac31aaf4dc7f45a0 Author: Antonio Borneo Date: Tue Jun 10 17:18:37 2025 +0200 dt-bindings: pinctrl: stm32: Add missing blank lines Separate the properties through a blank line. Signed-off-by: Antonio Borneo Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/20250610151837.299244-6-antonio.borneo@foss.st.com Signed-off-by: Linus Walleij commit d3eed11b9cf84166ec38ba68ab892fcd9261b810 Author: Frank Li Date: Fri Jun 6 12:03:58 2025 -0400 dt-bindings: pinctrl: convert nxp,lpc1850-scu.txt to yaml format Convert nxp,lpc1850-scu.txt to yaml format. Additional changes: - keep child name *_cfg to align legancy very old platform dts file. - remove label in examples. - just keep one examples. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/20250606160359.1356555-1-Frank.Li@nxp.com Signed-off-by: Linus Walleij commit 56ffb63749f4a1e88c282b763c458f3ed73d8c27 Author: Yuanjie Yang Date: Tue Jun 24 17:06:00 2025 +0800 pinctrl: qcom: add multi TLMM region option parameter Add support for selecting multiple TLMM regions using the tlmm-test tool. The current implementation only selects the TLMM Node region 0, which can lead to incorrect region selection. QCS 615 TLMM Node dts reg: tlmm: pinctrl@3100000 { compatible = "qcom,qcs615-tlmm"; reg = <0x0 0x03100000 0x0 0x300000>, <0x0 0x03500000 0x0 0x300000>, <0x0 0x03d00000 0x0 0x300000>; reg-names = "east", "west", "south"; QCS615 gpio57 is in the south region with an offset of 0x39000, and its address is 0x3d39000. However, the default region selection is region 0 (east region), resulting in a wrong calculated address of 0x3139000. Add a tlmm option parameter named tlmm_reg_name to select the region. If the user does not input the parameter, the default region is 0. Signed-off-by: Yuanjie Yang Link: https://lore.kernel.org/20250624090600.91063-1-quic_yuanjiey@quicinc.com Signed-off-by: Linus Walleij commit 7de0d60f6345e701ca8b9a05fe2faa03ad868ccf Author: Konrad Dybcio Date: Wed May 21 15:38:13 2025 +0200 arm64: dts: qcom: sm8150: Drop unrelated clocks from PCIe hosts The TBU clock belongs to the Translation Buffer Unit, part of the SMMU. The ref clock is already being driven upstream through some of the branches. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250521-topic-8150_pcie_drop_clocks-v1-4-3d42e84f6453@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit cb9ce20ebb2e6300a43dd26f2f6444e983688108 Author: Konrad Dybcio Date: Wed May 21 15:38:12 2025 +0200 arm64: dts: qcom: sc8180x: Drop unrelated clocks from PCIe hosts The TBU clock belongs to the Translation Buffer Unit, part of the SMMU. The ref clock is already being driven upstream through some of the branches. Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250521-topic-8150_pcie_drop_clocks-v1-3-3d42e84f6453@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 358b2511d7e687a243383fbbba9cb21b242f48b8 Author: Thomas Weißschuh Date: Mon Jun 23 23:15:53 2025 +0200 selftests/nolibc: use file driver for QEMU serial For the test implementation of the SuperH architecture a second serial serial port needs to be used. Unfortunately the currently used 'stdio' driver does not support multiple serial ports at the same time. Switch to the 'file' driver which does support multiple ports and is sufficient for the nolibc-test usecase. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Tested-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20250623-nolibc-sh-v2-2-0f5b4b303025@weissschuh.net commit 439fa8756a107043b54555096bd1da22e0d5cffd Author: Thomas Weißschuh Date: Mon Jun 23 23:15:52 2025 +0200 selftests/nolibc: fix EXTRACONFIG variables ordering The variable block got disordered at some point. Use the correct ordering. Signed-off-by: Thomas Weißschuh Acked-by: Willy Tarreau Tested-by: John Paul Adrian Glaubitz Link: https://lore.kernel.org/r/20250623-nolibc-sh-v2-1-0f5b4b303025@weissschuh.net commit 03d85ab36bcbcbe9dc962fccd3f8e54d7bb93b35 Author: Matthew Brost Date: Tue Jul 1 20:58:46 2025 -0700 Revert "drm/xe/xe2: Enable Indirect Ring State support for Xe2" This reverts commit fe0154cf8222d9e38c60ccc124adb2f9b5272371. Seeing some unexplained random failures during LRC context switches with indirect ring state enabled. The failures were always there, but the repro rate increased with the addition of WA BB as a separate BO. Commit 3a1edef8f4b5 ("drm/xe: Make WA BB part of LRC BO") helped to reduce the issues in the context switches, but didn't eliminate them completely. Indirect ring state is not required for any current features, so disable for now until failures can be root caused. Cc: stable@vger.kernel.org Fixes: fe0154cf8222 ("drm/xe/xe2: Enable Indirect Ring State support for Xe2") Signed-off-by: Matthew Brost Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250702035846.3178344-1-matthew.brost@intel.com Signed-off-by: Lucas De Marchi commit 7eba6a80fef4187d70ed4c4ef5a2cd8cde09ef95 Author: Tomasz Lis Date: Mon Jun 30 17:21:55 2025 +0200 drm/xe/vf: Make multi-GT migration less error prone There is a remote chance that after migration, some GTs will not send the MIGRATED interrupt, or due to current VF KMD state the interrupt will not lead to marking the GT for recovery. Requiring IRQs from all GTs before starting migration introduces the possibility that the process will get stalled due to one GuC. One could argue it is also waste of time to wait for all IRQs, but we should get them all IRQs as soon as VGPU starts, so that's not really an impactful argument. Still, not waiting for all GTs makes it easier to handle situations: * where one GuC IRQ is missing * where state before probe is unclean - getting MIGRATED IRQ as soon as interrupts are enabled * where multiple migrations happen close to each other To help with these cases, this patch alters the post-migration recovery so that recovery task is started as soon as one GuC IRQ is handled, and other GTs are included in recovery later as the subsequent IRQs are serviced. The post-migration recovery can now be called for any selection of GTs, and it will perform recovery on all GTs for which IRQs have arrived, even multiple times if necessary. v2: Typos and style fixes v3: Transferring gt_flags by value rather than reference to last function where it is used Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Cc: Michal Winiarski Cc: Satyanarayana K V P Acked-by: Satyanarayana K V P Reviewed-by: Michal Winiarski Link: https://lore.kernel.org/r/20250630152155.195648-1-tomasz.lis@intel.com Signed-off-by: Michał Winiarski commit 093ae7a033cfde536db997e7dc4e829ce65fb38a Author: Xavier Xia Date: Tue Jun 24 23:25:49 2025 +0800 arm64/mm: Optimize loop to reduce redundant operations of contpte_ptep_get This commit optimizes the contpte_ptep_get and contpte_ptep_get_lockless function by adding early termination logic. It checks if the dirty and young bits of orig_pte are already set and skips redundant bit-setting operations during the loop. This reduces unnecessary iterations and improves performance. In order to verify the optimization performance, a test function has been designed. The function's execution time and instruction statistics have been traced using perf, and the following are the operation results on a certain Qualcomm mobile phone chip: Test Code: #include #include #include #define PAGE_SIZE 4096 #define CONT_PTES 16 #define TEST_SIZE (4096* CONT_PTES * PAGE_SIZE) #define YOUNG_BIT 8 void rwdata(char *buf) { for (size_t i = 0; i < TEST_SIZE; i += PAGE_SIZE) { buf[i] = 'a'; volatile char c = buf[i]; } } void clear_young_dirty(char *buf) { if (madvise(buf, TEST_SIZE, MADV_FREE) == -1) { perror("madvise free failed"); free(buf); exit(EXIT_FAILURE); } if (madvise(buf, TEST_SIZE, MADV_COLD) == -1) { perror("madvise free failed"); free(buf); exit(EXIT_FAILURE); } } void set_one_young(char *buf) { for (size_t i = 0; i < TEST_SIZE; i += CONT_PTES * PAGE_SIZE) { volatile char c = buf[i + YOUNG_BIT * PAGE_SIZE]; } } void test_contpte_perf() { char *buf; int ret = posix_memalign((void **)&buf, CONT_PTES * PAGE_SIZE, TEST_SIZE); if ((ret != 0) || ((unsigned long)buf % CONT_PTES * PAGE_SIZE)) { perror("posix_memalign failed"); exit(EXIT_FAILURE); } rwdata(buf); #if TEST_CASE2 || TEST_CASE3 clear_young_dirty(buf); #endif #if TEST_CASE2 set_one_young(buf); #endif for (int j = 0; j < 500; j++) { mlock(buf, TEST_SIZE); munlock(buf, TEST_SIZE); } free(buf); } int main(void) { test_contpte_perf(); return 0; } Descriptions of three test scenarios Scenario 1 The data of all 16 PTEs are both dirty and young. #define TEST_CASE2 0 #define TEST_CASE3 0 Scenario 2 Among the 16 PTEs, only the 8th one is young, and there are no dirty ones. #define TEST_CASE2 1 #define TEST_CASE3 0 Scenario 3 Among the 16 PTEs, there are neither young nor dirty ones. #define TEST_CASE2 0 #define TEST_CASE3 1 Test results |Scenario 1 | Original| Optimized| |-------------------|---------------|----------------| |instructions | 37912436160| 18731580031| |test time | 4.2797| 2.2949| |overhead of | | | |contpte_ptep_get() | 21.31%| 4.80%| |Scenario 2 | Original| Optimized| |-------------------|---------------|----------------| |instructions | 36701270862| 36115790086| |test time | 3.2335| 3.0874| |Overhead of | | | |contpte_ptep_get() | 32.26%| 33.57%| |Scenario 3 | Original| Optimized| |-------------------|---------------|----------------| |instructions | 36706279735| 36750881878| |test time | 3.2008| 3.1249| |Overhead of | | | |contpte_ptep_get() | 31.94%| 34.59%| For Scenario 1, optimized code can achieve an instruction benefit of 50.59% and a time benefit of 46.38%. For Scenario 2, optimized code can achieve an instruction count benefit of 1.6% and a time benefit of 4.5%. For Scenario 3, since all the PTEs have neither the young nor the dirty flag, the branches taken by optimized code should be the same as those of the original code. In fact, the test results of optimized code seem to be closer to those of the original code. Ryan re-ran these tests on Apple M2 with 4K base pages + 64K mTHP. Scenario 1: reduced to 56% of baseline execution time Scenario 2: reduced to 89% of baseline execution time Scenario 3: reduced to 91% of baseline execution time It can be proven through test function that the optimization for contpte_ptep_get is effective. Since the logic of contpte_ptep_get_lockless is similar to that of contpte_ptep_get, the same optimization scheme is also adopted for it. Reviewed-by: Ryan Roberts Tested-by: Ryan Roberts Reviewed-by: Barry Song Signed-off-by: Xavier Xia Link: https://lore.kernel.org/r/20250624152549.2647828-1-xavier.qyxia@gmail.com Signed-off-by: Catalin Marinas commit 30ff3c981e48b37a93249a96675b450469ac13a6 Author: Anshuman Khandual Date: Fri Jun 13 08:06:46 2025 +0530 KVM: selftests: Change MDSCR_EL1 register holding variables as uint64_t Change MDSCR_EL1 register holding local variables as uint64_t that reflects its true register width as well. Cc: Oliver Upton Cc: Joey Gouly Cc: kvm@vger.kernel.org Cc: kvmarm@lists.linux.dev Cc: linux-kernel@vger.kernel.org Cc: linux-kselftest@vger.kernel.org Cc: linux-arm-kernel@lists.infradead.org Acked-by: Marc Zyngier Reviewed-by: Ada Couprie Diaz Signed-off-by: Anshuman Khandual Link: https://lore.kernel.org/r/20250613023646.1215700-3-anshuman.khandual@arm.com Signed-off-by: Catalin Marinas commit d3a80c5109a358943bde903f7dea3be469377ea5 Author: Anshuman Khandual Date: Fri Jun 13 08:06:45 2025 +0530 arm64/debug: Drop redundant DBG_MDSCR_* macros MDSCR_EL1 has already been defined in tools sysreg format and hence can be used in all debug monitor related call paths. But using generated sysreg definitions causes build warnings because there is a mismatch between mdscr variable (u32) and GENMASK() based masks (long unsigned int). Convert all variables handling MDSCR_EL1 register as u64 which also reflects its true width as well. -------------------------------------------------------------------------- arch/arm64/kernel/debug-monitors.c: In function ‘disable_debug_monitors’: arch/arm64/kernel/debug-monitors.c:108:13: warning: conversion from ‘long unsigned int’ to ‘u32’ {aka ‘unsigned int’} changes value from ‘18446744073709518847’ to ‘4294934527’ [-Woverflow] 108 | disable = ~MDSCR_EL1_MDE; | ^ -------------------------------------------------------------------------- While here, replace an open encoding with MDSCR_EL1_TDCC in __cpu_setup(). Cc: Will Deacon Cc: Mark Rutland Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Reviewed-by: Ada Couprie Diaz Signed-off-by: Anshuman Khandual Link: https://lore.kernel.org/r/20250613023646.1215700-2-anshuman.khandual@arm.com Signed-off-by: Catalin Marinas commit cc4b392718dcbf64301681f8a3daa8a013cf6427 Author: Namhyung Kim Date: Wed Jul 2 18:49:42 2025 -0700 perf test: Add more test cases to sched test $ sudo ./perf test -vv 92 92: perf sched tests: --- start --- test child forked, pid 1360101 Sched record pid 1360105's current affinity list: 0-3 pid 1360105's new affinity list: 0 pid 1360107's current affinity list: 0-3 pid 1360107's new affinity list: 0 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 4.330 MB /tmp/__perf_test_sched.perf.data.b3319 (12246 samples) ] Sched latency Sched script Sched map Sched timehist Samples of sched_switch event do not have callchains. ---- end(0) ---- 92: perf sched tests : Ok Reviewed-by: Ian Rogers Tested-by: Ian Rogers Link: https://lore.kernel.org/r/20250703014942.1369397-9-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 2009a2d5696944d85c34d75e691a6f3884e787c0 Author: Alexandre Courbot Date: Mon Jun 16 12:34:06 2025 +0900 rust: sync: implement `Borrow` and `BorrowMut` for `Arc` types Implement `Borrow` and `BorrowMut` for `UniqueArc`, and `Borrow` for `Arc`. This allows these containers to be used in generic APIs asking for types implementing those traits. `T` and `&mut T` also implement those traits allowing users to use either owned, shared or borrowed values. `ForeignOwnable` makes a call to its own `borrow` method which must be disambiguated. Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250616-borrow_impls-v4-2-36f9beb3fe6a@nvidia.com Signed-off-by: Miguel Ojeda commit e68b1c0098b959cb88afce5c93dd6a9324e6da78 Author: Namhyung Kim Date: Wed Jul 2 18:49:41 2025 -0700 perf sched: Fix memory leaks in 'perf sched latency' The work_atoms should be freed after use. Add free_work_atoms() to make sure to release all. It should use list_splice_init() when merging atoms to prevent accessing invalid pointers. Fixes: b1ffe8f3e0c96f552 ("perf sched: Finish latency => atom rename and misc cleanups") Reviewed-by: Ian Rogers Tested-by: Ian Rogers Link: https://lore.kernel.org/r/20250703014942.1369397-8-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 7a4002ec9e0fced907179da94f67c3082d7b4162 Author: Namhyung Kim Date: Wed Jul 2 18:49:40 2025 -0700 perf sched: Use RC_CHK_EQUAL() to compare pointers So that it can check two pointers to the same object properly when REFCNT_CHECKING is on. Fixes: 78c32f4cb12f9430 ("libperf rc_check: Add RC_CHK_EQUAL") Reviewed-by: Ian Rogers Tested-by: Ian Rogers Link: https://lore.kernel.org/r/20250703014942.1369397-7-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 117e5c33b1c44037af016d77ce6c0b086d55535f Author: Namhyung Kim Date: Wed Jul 2 18:49:39 2025 -0700 perf sched: Fix memory leaks for evsel->priv in timehist It uses evsel->priv to save per-cpu timing information. It should be freed when the evsel is released. Add the priv destructor for evsel same as thread to handle that. Fixes: 49394a2a24c78ce0 ("perf sched timehist: Introduce timehist command") Reviewed-by: Ian Rogers Tested-by: Ian Rogers Link: https://lore.kernel.org/r/20250703014942.1369397-6-namhyung@kernel.org Signed-off-by: Namhyung Kim commit e2eb59260c4f6bac403491d0112891766b8650d1 Author: Namhyung Kim Date: Wed Jul 2 18:49:38 2025 -0700 perf sched: Fix thread leaks in 'perf sched timehist' Add missing thread__put() after machine__findnew_thread() or timehist_get_thread(). Also idle threads' last_thread should be refcounted properly. Fixes: 699b5b920db04a6f ("perf sched timehist: Save callchain when entering idle") Reviewed-by: Ian Rogers Tested-by: Ian Rogers Link: https://lore.kernel.org/r/20250703014942.1369397-5-namhyung@kernel.org Signed-off-by: Namhyung Kim commit dc3a80c98884d86389b3b572c50ccc7f502cd41b Author: Namhyung Kim Date: Wed Jul 2 18:49:37 2025 -0700 perf sched: Fix memory leaks in 'perf sched map' It maintains per-cpu pointers for the current thread but it doesn't release the refcounts. Fixes: 5e895278697c014e ("perf sched: Move curr_thread initialization to perf_sched__map()") Reviewed-by: Ian Rogers Tested-by: Ian Rogers Link: https://lore.kernel.org/r/20250703014942.1369397-4-namhyung@kernel.org Signed-off-by: Namhyung Kim commit aa9fdd106bab8c478d37eba5703c0950ad5c0d4f Author: Namhyung Kim Date: Wed Jul 2 18:49:36 2025 -0700 perf sched: Free thread->priv using priv_destructor In many perf sched subcommand saves priv data structure in the thread but it forgot to free them. As it's an opaque type with 'void *', it needs to register that knows how to free the data. In this case, just regular 'free()' is fine. Fixes: 04cb4fc4d40a5bf1 ("perf thread: Allow tools to register a thread->priv destructor") Reviewed-by: Ian Rogers Tested-by: Ian Rogers Link: https://lore.kernel.org/r/20250703014942.1369397-3-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 10d9b89203765fb776512742c13af8dd92821842 Author: Namhyung Kim Date: Wed Jul 2 18:49:35 2025 -0700 perf sched: Make sure it frees the usage string The parse_options_subcommand() allocates the usage string based on the given subcommands. So it should reach the end of the function to free the string to prevent memory leaks. Fixes: 1a5efc9e13f357ab ("libsubcmd: Don't free the usage string") Reviewed-by: Ian Rogers Tested-by: Ian Rogers Link: https://lore.kernel.org/r/20250703014942.1369397-2-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 8081ca8d6be8c4b08b5d2fa06b2129f00aa95451 Author: Ian Rogers Date: Wed Jul 2 22:36:22 2025 -0700 perf tests make: Add NO_LIBDW=1 to minimal and add standalone test Missing testing coverage of NO_LIBDW=1 and add NO_LIBDW=1 to the minimal test configuration. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250703053622.3141424-1-irogers@google.com Signed-off-by: Namhyung Kim commit 6c21316e52959f60e9367a41a7893d8459d7dfab Author: Ian Rogers Date: Wed Jul 2 21:20:00 2025 -0700 perf header: Fix pipe mode header dumping The pipe mode header dumping was accidentally removed when tracing of header feature events in pipe mode was added. Minor spelling tweak to header test failure message. Fixes: 61051f9a8452 ("perf header: In pipe mode dump features without --header/-I") Signed-off-by: Ian Rogers Tested-by: Namhyung Kim Link: https://lore.kernel.org/r/20250703042000.2740640-1-irogers@google.com Signed-off-by: Namhyung Kim commit b3a431fe2e399b2e0cc5f43f7e9d63d63d3710ee Author: Dan Carpenter Date: Tue May 27 08:55:38 2025 +0300 wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan() The ssid->ssids[] and sreq->ssids[] arrays have MT7925_RNR_SCAN_MAX_BSSIDS elements so this >= needs to be > to prevent an out of bounds access. Fixes: 8284815ca161 ("wifi: mt76: mt7925: add RNR scan support for 6GHz") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/aDVT2tPhG_8T0Qla@stanley.mountain Signed-off-by: Felix Fietkau commit ac9c50c79eaef5fca0f165e45d0c5880606db53e Author: David Bauer Date: Wed Apr 2 02:45:27 2025 +0200 wifi: mt76: mt7915: mcu: re-init MCU before loading FW patch Restart the MCU and release the patch semaphore before loading the MCU patch firmware from the host. This fixes failures upon error recovery in case the semaphore was previously taken and never released by the host. This happens from time to time upon triggering a full-chip error recovery. Under this circumstance, the hardware restart fails and the radio is rendered inoperational. Signed-off-by: David Bauer Link: https://patch.msgid.link/20250402004528.1036715-3-mail@david-bauer.net Signed-off-by: Felix Fietkau commit b018d52ede75c079fcc0158680e578f8f8c75d02 Author: David Bauer Date: Wed Apr 2 02:45:25 2025 +0200 wifi: mt76: mt7915: mcu: lower default timeout The default timeout set in mt76_connac2_mcu_fill_message of 20 seconds leads to excessive stalling in case messages are lost. Testing showed that a smaller timeout of 5 seconds is sufficient in normal operation. Signed-off-by: David Bauer Link: https://patch.msgid.link/20250402004528.1036715-1-mail@david-bauer.net Signed-off-by: Felix Fietkau commit efd31873cdb3e5580fb76eeded6314856f52b06e Author: David Bauer Date: Wed Apr 2 02:45:26 2025 +0200 wifi: mt76: mt7915: mcu: increase eeprom command timeout Increase the timeout for MCU_EXT_CMD_EFUSE_BUFFER_MODE command. Regular retries upon hardware-recovery have been observed. Increasing the timeout slightly remedies this problem. Signed-off-by: David Bauer Link: https://patch.msgid.link/20250402004528.1036715-2-mail@david-bauer.net Signed-off-by: Felix Fietkau commit 491b9783126303755717c0cbde0b08ee59b6abab Author: Matthew Brost Date: Wed Jul 2 14:35:11 2025 -0700 drm/xe: Allocate PF queue size on pow2 boundary CIRC_SPACE does not work unless the size argument is a power of 2, allocate PF queue size on power of 2 boundary. Cc: stable@vger.kernel.org Fixes: 3338e4f90c14 ("drm/xe: Use topology to determine page fault queue size") Fixes: 29582e0ea75c ("drm/xe: Add page queue multiplier") Signed-off-by: Matthew Brost Reviewed-by: Francois Dugast Link: https://lore.kernel.org/r/20250702213511.3226167-1-matthew.brost@intel.com commit 97ba207a994f7d0cc58f19d448e98db6735f5e77 Author: Miguel Ojeda Date: Tue Jul 1 19:46:56 2025 +0200 rust: acpi: remove unneeded cast to clean future Clippy warning A future Clippy warning, `clippy::as_underscore`, is getting enabled in parallel in the rust-next tree: error: using `as _` conversion --> rust/kernel/acpi.rs:25:9 | 25 | self.0.driver_data as _ | ^^^^^^^^^^^^^^^^^^^^^^- | | | help: consider giving the type explicitly: `usize` The type is already `ulong`, which nowadays is always `usize`, so the cast is unneeded. Thus remove it, which in turn will avoid the warning in the future. Other abstractions of device tables do not use a cast here either. Signed-off-by: Miguel Ojeda Reviewed-by: Trevor Gross Link: https://lore.kernel.org/r/20250701174656.62205-1-ojeda@kernel.org Signed-off-by: Greg Kroah-Hartman commit 86c947b363f003153768d879ee15f8358cbf29c5 Author: Matthew Brost Date: Wed Jul 2 16:28:31 2025 -0700 drm: Simplify drmm_alloc_ordered_workqueue return Rather than returning ERR_PTR or NULL on failure, replace the NULL return with ERR_PTR(-ENOMEM). This simplifies error handling at the caller. While here, add kernel documentation for drmm_alloc_ordered_workqueue. Cc: Louis Chauvet Signed-off-by: Matthew Brost Reviewed-by: Louis Chauvet Link: https://lore.kernel.org/r/20250702232831.3271328-2-matthew.brost@intel.com commit a31cb447b5473cdc08732ec6362202a1ba8e2fe1 Author: Kohei Enju Date: Fri Jun 13 01:16:26 2025 +0900 igbvf: add tx_timeout_count to ethtool statistics Add `tx_timeout_count` to ethtool statistics to provide visibility into transmit timeout events, bringing igbvf in line with other Intel ethernet drivers. Currently `tx_timeout_count` is incremented in igbvf_watchdog_task() and igbvf_tx_timeout() but is not exposed to userspace nor used elsewhere in the driver. Before: # ethtool -S ens5 | grep tx tx_packets: 43 tx_bytes: 4408 tx_restart_queue: 0 After: # ethtool -S ens5 | grep tx tx_packets: 41 tx_bytes: 4241 tx_restart_queue: 0 tx_timeout_count: 0 Tested-by: Kohei Enju Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 9ebca2374dbb194a358bdd8a32c1cf9227a7a490 Author: Kohei Enju Date: Fri Jun 13 01:13:40 2025 +0900 igbvf: remove unused interrupt counter fields from struct igbvf_adapter Remove `int_counter0` and `int_counter1` from struct igbvf_adapter since they are only incremented in interrupt handlers igbvf_intr_msix_rx() and igbvf_msix_other(), but never read or used anywhere in the driver. Note that igbvf_intr_msix_tx() does not have similar counter increments, suggesting that these were likely overlooked during development. Eliminate the fields and their unnecessary accesses in interrupt handlers. Tested-by: Kohei Enju Signed-off-by: Kohei Enju Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit b91c0e4d63d99c8816f1a29d2be9ca42d8792e63 Author: Simon Horman Date: Sat Jun 21 12:50:40 2025 +0100 ixgbe: spelling corrections Correct spelling as flagged by codespell. Signed-off-by: Simon Horman Signed-off-by: Tony Nguyen commit 1a3ebc59f7175c9b41e488fe6e4c47b85fcbe275 Author: Radoslaw Tyl Date: Mon Feb 17 10:06:36 2025 +0100 ixgbe: turn off MDD while modifying SRRCTL Modifying SRRCTL register can generate MDD event. Turn MDD off during SRRCTL register write to prevent generating MDD. Fix RCT in ixgbe_set_rx_drop_en(). Reviewed-by: Marcin Szycik Reviewed-by: Przemek Kitszel Signed-off-by: Radoslaw Tyl Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit b11aa9614df095ee6f15640873dfa6aaf51dd7ef Author: Slawomir Mrozowicz Date: Mon Feb 17 10:06:35 2025 +0100 ixgbe: add Tx hang detection unhandled MDD Add Tx Hang detection due to an unhandled MDD Event. Previously, a malicious VF could disable the entire port causing TX to hang on the E610 card. Those events that caused PF to freeze were not detected as an MDD event and usually required a Tx Hang watchdog timer to catch the suspension, and perform a physical function reset. Implement flows in the affected PF driver in such a way to check the cause of the hang, detect it as an MDD event and log an entry of the malicious VF that caused the Hang. The PF blocks the malicious VF, if it continues to be the source of several MDD events. Reviewed-by: Przemek Kitszel Reviewed-by: Marcin Szycik Signed-off-by: Slawomir Mrozowicz Co-developed-by: Michal Swiatkowski Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit da3ab95f9b0609b1f62142991690b257e6c32bad Author: Don Skidmore Date: Mon Feb 17 10:06:34 2025 +0100 ixgbe: check for MDD events When an event is detected it is logged and, for the time being, the queue is immediately re-enabled. This is due to the lack of an API to the hypervisor so it could deal with it as it chooses. Reviewed-by: Przemek Kitszel Reviewed-by: Jedrzej Jagielski Reviewed-by: Marcin Szycik Signed-off-by: Don Skidmore Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit d5e3152037f32196f6c9b0eee2816af16e16e6ba Author: Paul Greenwalt Date: Mon Feb 17 10:06:33 2025 +0100 ixgbe: add MDD support Add malicious driver detection to ixgbe driver. The supported devices are E610 and X550. Handling MDD events is enabled while VFs are created and turned off when they are disabled. There is no runtime command to enable or disable MDD independently. MDD event is logged when malicious VF driver is detected. For example VF can try to send incorrect Tx descriptor (TSO on, but length field not correct). It can be reproduced by manipulating the driver, or using driver with incorrect descriptor values. Example log: "Malicious event on VF 0 tx:128 rx:128" Reviewed-by: Przemek Kitszel Reviewed-by: Jedrzej Jagielski Reviewed-by: Marcin Szycik Signed-off-by: Paul Greenwalt Signed-off-by: Michal Swiatkowski Reviewed-by: Simon Horman Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit 8cc249787783feb4ad02e6a9138e058b5f23f8eb Author: Vladimir Oltean Date: Tue May 13 13:11:32 2025 +0300 i40e: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() New timestamping API was introduced in commit 66f7223039c0 ("net: add NDOs for configuring hardware timestamping") from kernel v6.6. It is time to convert the Intel i40e driver to the new API, so that timestamping configuration can be removed from the ndo_eth_ioctl() path completely. Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Vadim Fedorenko Reviewed-by: Milena Olech Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 8f3f4995e8ca0716b8ff352baa754e0b24ed2810 Author: Vladimir Oltean Date: Tue May 13 13:11:31 2025 +0300 ixgbe: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() New timestamping API was introduced in commit 66f7223039c0 ("net: add NDOs for configuring hardware timestamping") from kernel v6.6. It is time to convert the Intel ixgbe driver to the new API, so that timestamping configuration can be removed from the ndo_eth_ioctl() path completely. Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Vadim Fedorenko Reviewed-by: Milena Olech Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit b88428d3fc55a0beb88d4439f5f269b57de3a92f Author: Vladimir Oltean Date: Tue May 13 13:11:30 2025 +0300 igb: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() New timestamping API was introduced in commit 66f7223039c0 ("net: add NDOs for configuring hardware timestamping") from kernel v6.6. It is time to convert the Intel igb driver to the new API, so that timestamping configuration can be removed from the ndo_eth_ioctl() path completely. Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Vadim Fedorenko Reviewed-by: Milena Olech Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 033d0bcf4a1f784bdd41f9610e228cc91802bb98 Author: Vladimir Oltean Date: Tue May 13 13:11:29 2025 +0300 igc: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() New timestamping API was introduced in commit 66f7223039c0 ("net: add NDOs for configuring hardware timestamping") from kernel v6.6. It is time to convert the Intel igc driver to the new API, so that timestamping configuration can be removed from the ndo_eth_ioctl() path completely. Signed-off-by: Vladimir Oltean Reviewed-by: Simon Horman Reviewed-by: Vitaly Lifshits Reviewed-by: Vadim Fedorenko Reviewed-by: Milena Olech Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit 23ddacab4e81d9949eac818be2983ccdb6a25eee Author: Vladimir Oltean Date: Tue May 13 13:11:28 2025 +0300 ice: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() New timestamping API was introduced in commit 66f7223039c0 ("net: add NDOs for configuring hardware timestamping") from kernel v6.6. It is time to convert the Intel ice driver to the new API, so that timestamping configuration can be removed from the ndo_eth_ioctl() path completely. Signed-off-by: Vladimir Oltean Acked-by: Jacob Keller Reviewed-by: Simon Horman Reviewed-by: Vadim Fedorenko Reviewed-by: Milena Olech Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 209be2857bcc4bae88ef1b0981da2db99f84dbb5 Author: Tanmay Shah Date: Fri Jun 20 12:57:28 2025 -0700 remoteproc: xlnx: Add shutdown callback In case of kexec call, each driver's shutdown callback is called. Handle this call for rproc driver and shutdown/detach each core that was powered on before. This is needed for proper Life Cycle Management of remote processor. Otherwise on next linux boot, remote processor can't be started due to bad refcount of power-domain managed by platform management controller. Signed-off-by: Tanmay Shah Link: https://lore.kernel.org/r/20250620195728.3216935-1-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier commit 51106b830ad9dc0a2cf932e27a921e01de2df876 Merge: 7105fdd54a14be 913bf8d50cbd14 Author: Mark Brown Date: Thu Jul 3 17:02:43 2025 +0100 spi: spi-qpic-snand: enable 8 bits ECC strength Merge series from Gabor Juhos : This small patch set adds support for 8 bits ECC strength, which widens the range of the usable SPI NAND chips with the driver. The first one is a preparatory patch which adds some defines which allows to avoid using magic values, and the second patch implements the actual support. The series should be integrated via the SPI tree, as that contains prerequisite changes. commit fd8fca21629d8e1a68e7900ad804946e3b66eddb Author: Meng Li Date: Sun Jun 8 11:06:15 2025 +0800 dt-bindings: watchdog: fsl-imx-wdt: add compatible string fsl,ls1046a-wdt Add compatible string fsl,ls1046a-wdt for ls1046a SoC. fsl,ls1046a-wdt allows big-endian property. Signed-off-by: Meng Li Reviewed-by: Rob Herring (Arm) Reviewed-by: Ahmad Fatoum Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250608030616.3874517-2-Meng.Li@windriver.com Signed-off-by: Rob Herring (Arm) commit 024b84f661674dcfa1341c90ce654c485c4ab756 Author: Alex Elder Date: Wed Jul 2 06:37:06 2025 -0500 clk: spacemit: define three reset-only CCUs Three CCUs on the SpacemiT K1 SoC implement only resets, not clocks. Define the CCU data for these resets so their auxiliary devices get created. Signed-off-by: Alex Elder Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250702113709.291748-5-elder@riscstar.com Signed-off-by: Yixun Lan commit 988543522ebd6a9af53c288833503f0501e401b0 Author: Alex Elder Date: Wed Jul 2 06:37:05 2025 -0500 clk: spacemit: set up reset auxiliary devices Add a new reset_name field to the spacemit_ccu_data structure. If it is non-null, the CCU implements a reset controller, and the name will be used in the name for the auxiliary device that implements it. Define a new type to hold an auxiliary device as well as the regmap pointer that will be needed by CCU reset controllers. Set up code to initialize and add an auxiliary device for any CCU that implements reset functionality. Make it optional for a CCU to implement a clock controller. This doesn't apply to any of the existing CCUs but will for some new ones that will be added soon. Signed-off-by: Alex Elder Reviewed-by: Haylen Chu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250702113709.291748-4-elder@riscstar.com Signed-off-by: Yixun Lan commit bf6239ddaa6a73a44cd8ea3afec5fc82ed900038 Author: Alex Elder Date: Wed Jul 2 06:37:04 2025 -0500 soc: spacemit: create a header for clock/reset registers Move the definitions of register offsets and fields used by the SpacemiT K1 SoC CCUs into a separate header file, so that they can be shared by the reset driver that will be found under drivers/reset. Signed-off-by: Alex Elder Reviewed-by: Haylen Chu Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250702113709.291748-3-elder@riscstar.com Signed-off-by: Yixun Lan commit 46dc57406887dd02565cb264224194a6776d882b Author: Sivan Zohar-Kotzer Date: Wed Jul 2 01:13:55 2025 +0300 powercap: dtpm_cpu: Fix NULL pointer dereference in get_pd_power_uw() The get_pd_power_uw() function can crash with a NULL pointer dereference when em_cpu_get() returns NULL. This occurs when a CPU becomes impossible during runtime, causing get_cpu_device() to return NULL, which propagates through em_cpu_get() and leads to a crash when em_span_cpus() dereferences the NULL pointer. Add a NULL check after em_cpu_get() and return 0 if unavailable, matching the existing fallback behavior in __dtpm_cpu_setup(). Fixes: eb82bace8931 ("powercap/drivers/dtpm: Scale the power with the load") Signed-off-by: Sivan Zohar-Kotzer Link: https://patch.msgid.link/20250701221355.96916-1-sivany32@gmail.com [ rjw: Drop an excess empty code line ] Signed-off-by: Rafael J. Wysocki commit f8e656382b4aa45ae51135b72262044550224920 Author: Philip Radford Date: Mon Jun 30 10:55:43 2025 +0000 include: trace: Add tracepoint support for inflight xfer count Enhance the existing SCMI transfer tracepoints by including the current in-flight transfer count in `scmi_xfer_begin` and `scmi_xfer_end`. Introduce a new helper `scmi_inflight_count()` to retrieve the active transfer count from the SCMI debug counters when debug is enabled. This trace data is useful for visualizing transfer activity over time and identifying congestion or unexpected behavior in SCMI messaging. Reviewed-by: Cristian Marussi Signed-off-by: Philip Radford Message-Id: <20250630105544.531723-4-philip.radford@arm.com> Signed-off-by: Sudeep Holla commit a9cd861e61ae80b441af87f332bc3f44aa0b7c02 Author: Philip Radford Date: Mon Jun 30 10:55:42 2025 +0000 firmware: arm_scmi: Track number of inflight SCMI transfers Add a new debug counter, `XFERS_INFLIGHT`, to track the number of currently active in-flight SCMI message transfers. This helps in understanding system behavior and diagnosing potential issues with pending or stuck messages. The counter is incremented when a transfer is registered as in-flight, and decremented when it completes and is released. It is automatically added to debugfs for visibility through SCMI debugfs. Reviewed-by: Cristian Marussi Signed-off-by: Philip Radford Message-Id: <20250630105544.531723-3-philip.radford@arm.com> Signed-off-by: Sudeep Holla commit 555e9174ef06b7bfc54a3127a8d8fc47d55d04f4 Author: Philip Radford Date: Mon Jun 30 10:55:41 2025 +0000 firmware: arm_scmi: Add support for debug counter decrement Introduce a new `scmi_dec_count` helper to complement the existing `scmi_inc_count`, allowing controlled decrement of SCMI debug counters. This provides symmetry in debug counter management and enables accurate tracking of counters that may both increase and decrease, such as those used for in-flight message tracking. Only active when CONFIG_ARM_SCMI_DEBUG_COUNTERS is enabled. Reviewed-by: Cristian Marussi Signed-off-by: Philip Radford Message-Id: <20250630105544.531723-2-philip.radford@arm.com> Signed-off-by: Sudeep Holla commit 2ee49a6143b6313b8808ff505eb85958126d7e7e Merge: df5e674c7a9976 657e413c277898 Author: Arnd Bergmann Date: Thu Jul 3 17:12:48 2025 +0200 Merge tag 'arm-soc/for-6.17/devicetree-arm64' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM64-based SoCs Device Tree updates for 6.17, please pull the following: - Linus updates the 64-bit BCMBCA SoCs Device Tree with the common peripherals that exit as well as correct IRQ assignments - Andrea adds support for the RP1 companion chip on the Raspberry Pi 5 systems with clocks, gpios, pinctrl, all of that using an overlay to describe those peripherals - Rob drops the interrupt-parent property from the GICv2M node on Northstar2 SoCs * tag 'arm-soc/for-6.17/devicetree-arm64' of https://github.com/Broadcom/stblinux: arm64: dts: broadcom: northstar2: Drop GIC V2M "interrupt-parent" arm64: dts: broadcom: Add overlay for RP1 device arm64: dts: broadcom: Add board DTS for Rpi5 which includes RP1 node arm64: dts: bcm2712: Add external clock for RP1 chipset on Rpi5 arm64: dts: rp1: Add support for RaspberryPi's RP1 device dt-bindings: misc: Add device specific bindings for RaspberryPi RP1 dt-bindings: pinctrl: Add RaspberryPi RP1 gpio/pinctrl/pinmux bindings dt-bindings: clock: Add RaspberryPi RP1 clock bindings ARM64: dts: bcm63158: Add BCMBCA peripherals ARM64: dts: bcm6858: Add BCMBCA peripherals ARM64: dts: bcm6856: Add BCMBCA peripherals ARM64: dts: bcm4908: Add BCMBCA peripherals Link: https://lore.kernel.org/r/20250630190216.1518354-3-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit 2e3a7476ec3989e77270b9481e76e137824b17c0 Author: Michael Walle Date: Tue Jul 1 16:04:26 2025 +0200 mtd: spi-nor: Fix spi_nor_try_unlock_all() Commit ff67592cbdfc ("mtd: spi-nor: Introduce spi_nor_set_mtd_info()") moved all initialization of the mtd fields at the end of spi_nor_scan(). Normally, the mtd info is only needed for the mtd ops on the device, with one exception: spi_nor_try_unlock_all(), which will also make use of the mtd->size parameter. With that commit, the size will always be zero because it is not initialized. Fix that by not using the size of the mtd_info struct, but use the size from struct spi_nor_flash_parameter. Fixes: ff67592cbdfc ("mtd: spi-nor: Introduce spi_nor_set_mtd_info()") Cc: stable@vger.kernel.org Reported-by: Jean-Marc Ranger Closes: https://lore.kernel.org/all/DM6PR06MB561177323DC5207E34AF2A06C547A@DM6PR06MB5611.namprd06.prod.outlook.com/ Tested-by: Jean-Marc Ranger Signed-off-by: Michael Walle Reviewed-by: Pratyush Yadav Signed-off-by: Pratyush Yadav Link: https://lore.kernel.org/r/20250701140426.2355182-1-mwalle@kernel.org commit df5e674c7a9976319d594c7dd287b0db5c4ed821 Author: Andrew Jeffery Date: Wed Jul 2 10:53:54 2025 +0930 MAINTAINERS: Switch ASPEED tree to shared BMC repository We now have a shared repo with write access provided to M:s for the ASPEED SoCs. Cc: Joel Stanley Signed-off-by: Andrew Jeffery Signed-off-by: Arnd Bergmann commit f19dc0489ed52f527e9b198b86b0b807ebbfa4e5 Author: Rafael J. Wysocki Date: Fri Jun 27 21:29:16 2025 +0200 PCI/PM: Set power.strict_midlayer in pci_pm_init() The PCI bus type does not expect its runtime PM suspend callback function, pci_pm_runtime_suspend(), to be invoked at all during system- wide suspend and resume, and it does not expect its runtime resume callback function, pci_pm_runtime_resume(), to be invoked at any point when runtime PM is disabled for the given device during system-wide suspend and resume, so make it express that expectation by setting power.strict_midlayer for all PCI devices in pci_pm_prepare() and clear it in pci_pm_complete(). Signed-off-by: Rafael J. Wysocki Acked-by: Bjorn Helgaas Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/1925097.atdPhlSkOF@rjwysocki.net commit 325e3778eac3916f3451f8ceccafdc31427ccdd1 Author: Rafael J. Wysocki Date: Fri Jun 27 21:25:22 2025 +0200 ACPI: PM: Set/clear power.strict_midlayer in prepare/complete The ACPI general PM domain and the LPSS PM domain do not expect their mid-layer runtime PM suspend callbacks to be invoked at all during system-wide suspend and resume and they do not expect their runtime resume callbacks to be invoked at any point when runtime PM is disabled for the given device during system suspend and resume, so make acpi_subsys_prepare() set power.strict_midlayer for the given device to express that expectation and make acpi_subsys_complete() clear it. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/4463062.ejJDZkT8p0@rjwysocki.net commit ffda4ca4608ea811aee2aace211bbf27c68a8853 Author: Rafael J. Wysocki Date: Fri Jun 27 21:23:42 2025 +0200 PM: sleep: Add strict_midlayer flag to struct dev_pm_info Add a new flag, called strict_midlayer, to struct dev_pm_info, along with helper functions for updating and reading its value, to allow middle layer code that provides proper callbacks for device suspend- resume during system-wide PM transitions to let pm_runtime_force_suspend() and and pm_runtime_force_resume() know that they should only invoke runtime PM callbacks coming from the device's driver. Namely, if this flag is set, pm_runtime_force_suspend() and and pm_runtime_force_resume() will invoke runtime PM callbacks provided by the device's driver directly with the assumption that they have been called via a middle layer callback for device suspend or resume, respectively. For instance, acpi_general_pm_domain provides specific callback functions for system suspend, acpi_subsys_suspend(), acpi_subsys_suspend_late() and acpi_subsys_suspend_noirq(), and it does not expect its runtime suspend callback function, acpi_subsys_runtime_suspend(), to be invoked at any point during system suspend. In particular, it does not expect that function to be called from within any of the system suspend callback functions mentioned above which would happen if a device driver collaborating with acpi_general_pm_domain used pm_runtime_force_suspend() as its callback function for any system suspend phase later than "prepare". The new flag allows this expectation of acpi_general_pm_domain to be formally expressed, which is going to be done subsequently. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/24017035.6Emhk5qWAg@rjwysocki.net commit 2b2dcf08116d6e96a446c8f3216b2479701e39aa Author: Rafael J. Wysocki Date: Fri Jun 27 21:20:40 2025 +0200 PM: runtime: Introduce __rpm_get_driver_callback() Add a special function for computing the address of the runtime PM callback given by an offset relative to the start of the device driver's struct dev_pm_ops and use it to obtain the driver callback in __rpm_get_callback(). Also put the shared part of the callback address computation into a separate helper function to avoid code duplication and explicit pointer type casts. The new __rpm_get_driver_callback() will be used subsequently for implementing callback lookup in pm_runtime_force_suspend/resume(). No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/2054356.usQuhbGJ8B@rjwysocki.net commit ab5ce09709b5f3cc73124bd1f2d6de06c1a4b6be Author: Rafael J. Wysocki Date: Fri Jun 27 21:19:31 2025 +0200 PM: Check power.needs_force_resume in pm_runtime_force_suspend() Add a power.needs_force_resume check to pm_runtime_force_suspend() so it need not rely on the runtime PM status of the device when deciding whether or not to return early. With the new check in place, pm_runtime_force_suspend() will also skip devices with the runtime PM status equal to RPM_ACTIVE if they have power.needs_force_resume set, so it won't need to change the RPM status of the device to RPM_SUSPENDED in addition to setting power.needs_force_resume in the case when pm_runtime_need_not_resume() return false. That allows the runtime PM status update to be removed from pm_runtime_force_resume(), so the runtime PM status remains unchanged between the pm_runtime_force_suspend() and pm_runtime_force_resume() calls. This change potentially unbreaks drivers that call pm_runtime_force_suspend() from their ->remove() callbacks because currently, if the device being unbound from its driver has a parent with enabled runtime PM and/or (possibly) device links respecting runtime PM to suppliers, and it is RPM_ACTIVE when the remove takes place, pm_runtime_force_suspend() will not drop the parent's child count and the suppliers' runtime PM usage counters after force-suspending the device unless pm_runtime_need_not_resume() returns 'true' for it. Moreover, because pm_runtime_force_suspend() changes the device's runtime PM status to RPM_SUSPENDED, in the above case pm_runtime_reinit() will not cause those counters to drop, so they will remain nonzero forever effectively preventing the devices in question from runtime-suspending going forward. This change is also needed for pm_runtime_force_suspend() to work with PCI PM and ACPI PM after subsequent changes. Namely, say DPM_FLAG_SMART_SUSPEND is set for a PCI device and its driver uses pm_runtime_force_suspend() as its ->suspend() callback. If pm_runtime_force_suspend() changed the runtime PM status of the device to RPM_SUSPENDED, pci_pm_suspend_noirq() would skip the device due to the dev_pm_skip_suspend() check. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/1855933.VLH7GnMWUR@rjwysocki.net commit 89d9cec3b1e9c49bae9375a2db6dc49bc7468af0 Author: Rafael J. Wysocki Date: Fri Jun 27 21:16:05 2025 +0200 PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() Clear power.needs_force_resume in pm_runtime_reinit() in case it has been set by pm_runtime_force_suspend() invoked from a driver remove callback. Suggested-by: Ulf Hansson Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/9495163.CDJkKcVGEf@rjwysocki.net commit e21bd84c2f1dd2900adb343a796bc88101ce48d0 Author: Rafael J. Wysocki Date: Fri Jun 27 21:15:59 2025 +0200 PM: Make pm_runtime_force_resume() work with DPM_FLAG_SMART_SUSPEND Curently, drivers using pm_runtime_force_suspend/resume() cannot set DPM_FLAG_SMART_SUSPEND because the devices with that flag set may need to be resumed during system-wide resume regardless of whether or not they have power.needs_force_resume set. That can happen due to a dependency resolved at the beginning of a system-wide resume transition (for instance, a bus type or PM domain has decided to resume a subordinate device with DPM_FLAG_SMART_SUSPEND and its parent and suppliers also need to be resumed). To overcome this limitation, modify pm_runtime_force_resume() to check the device's power.smart_suspend flag (which is set for devices with DPM_FLAG_SMART_SUSPEND set that meet some additional requirements) and the device's runtime PM status in addition to power.needs_force_resume. Also change it to clear power.smart_suspend to ensure that it will not handle the same device twice during one transition. The underlying observation is that there are two cases in which the device needs to be resumed by pm_runtime_force_resume(). One of them is when the device has power.needs_force_resume set, which means that pm_runtime_force_suspend() has suspended it and decided that it should be resumed during the subsequent system resume. The other one is when power.smart_suspend is set and the device's runtume PM status is RPM_ACTIVE. Update kerneldoc comments in accordance with the code changes. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/3662906.iIbC2pHGDl@rjwysocki.net commit c021c1b38f90d639423c1369625daa703a8472ea Author: Rafael J. Wysocki Date: Fri Jun 27 21:08:48 2025 +0200 PM: Move two sleep-related functions under CONFIG_PM_SLEEP Since pm_runtime_force_resume() and pm_runtime_need_not_resume() are only needed for handling system-wide PM transitions, there is no reason to compile them in if CONFIG_PM_SLEEP is unset. Accordingly, move them under CONFIG_PM_SLEEP and make the static inline stub for pm_runtime_force_resume() return an error to indicate that it should not be used outside CONFIG_PM_SLEEP. Putting pm_runtime_force_resume() also allows subsequent changes to be more straightforward because this function is going to access a device PM flag that is only defined when CONFIG_PM_SLEEP is set. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/3384523.aeNJFYEL58@rjwysocki.net commit 200046d827188f878a61c01539c4315370577c73 Author: Rafael J. Wysocki Date: Fri Jun 27 21:06:34 2025 +0200 PM: Use true/false as power.needs_force_resume values Since power.needs_force_resume is a bool field, use true/false as its values instead of 1/0, respectively. Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Link: https://patch.msgid.link/2254988.irdbgypaU6@rjwysocki.net commit 36bbb14ee7436a2c48af1655d7a56720e19c00c9 Author: Uwe Kleine-König Date: Tue Jul 1 16:58:03 2025 +0200 ARM: dts: lpc32xx: Add #pwm-cells property to the two SoC PWMs If these PWMs are to be used, a #pwm-cells property is necessary. The right location for that is in the SoC's dtsi file to not make machine.dts files repeat the value for each usage. Currently the machines based on nxp/lpc/lpc32xx.dtsi don't make use of the PWMs, so there are no properties to drop there. Reviewed-by: Vladimir Zapolskiy Signed-off-by: Uwe Kleine-König Signed-off-by: Arnd Bergmann commit 7eb5b8d0b2df8d4d9c39c892ccb3179419bec2c5 Merge: 0dc89a25468e3e 8df00d6bdb0ab9 Author: Arnd Bergmann Date: Thu Jul 3 17:06:46 2025 +0200 Merge tag 'arm-soc/for-6.17/devicetree' of https://github.com/Broadcom/stblinux into soc/dt This pull request contains Broadcom ARM-based SoCs Device Tree updates for 6.17, please pull the following: - Linus makes a number of updates to the BCMBCA SoCs Device Tree files to correct UART interrupt numbers, add interrupts to the RNG block, and leverage the fact that all SoCs have the same peripherals at the same aperture - Uwe corrects the Merakia MX6X DTS file to have #pwm-cells = 3 as per the binding * tag 'arm-soc/for-6.17/devicetree' of https://github.com/Broadcom/stblinux: ARM: dts: bcm958625-meraki-mx6x: Use #pwm-cells = <3> ARM: dts: bcm63178: Add BCMBCA peripherals ARM: dts: bcm63148: Add BCMBCA peripherals ARM: dts: bcm63138: Add BCMBCA peripherals ARM: dts: bcm6878: Add BCMBCA peripherals ARM: dts: bcm6855: Add BCMBCA peripherals ARM: dts: bcm6846: Add interrupt to RNG dt-bindings: rng: r200: Add interrupt property ARM: dts: bcm6878: Correct UART0 IRQ number Link: https://lore.kernel.org/r/20250630190216.1518354-2-florian.fainelli@broadcom.com Signed-off-by: Arnd Bergmann commit 12da2e6ccd8a4ce47e9ae395c7edd327d73ab475 Author: Frank Li Date: Fri May 23 11:52:58 2025 -0400 dt-bindings: mtd: jedec,spi-nor: Add atmel,at26* compatible string Add atmel,at26* compatible string to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/vf/vf610-twr.dtb: /soc/bus@40000000/spi@4002c000/at26df081a@0: failed to match any schema with compatible: ['atmel,at26df081a'] Signed-off-by: Frank Li Acked-by: Conor Dooley Acked-by: Pratyush Yadav Signed-off-by: Pratyush Yadav Link: https://lore.kernel.org/r/20250523155258.546003-1-Frank.Li@nxp.com commit 9047685cfd2911c36ce89a16270aafa71057c507 Author: Andy Shevchenko Date: Thu Jun 26 18:42:44 2025 +0300 PM: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250626154244.324265-1-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit a45ab839f52f3f00ac3dae18a50e902efd216de2 Author: Takahiro Kuwano Date: Thu Jun 12 16:44:27 2025 +0900 mtd: spi-nor: spansion: Fixup params->set_4byte_addr_mode for SEMPER Infineon SEMPER flash family does not support E9h opcode as Exit 4-byte mode (EX4B). Therefore, params->set_4byte_addr_mode is not determined by BFPT parse. Fixup it up by introducing vendor specific EX4B opcode (B8h) and function. Fixes: c87c9b11c53ce ("mtd: spi-nor: spansion: Determine current address mode") Signed-off-by: Takahiro Kuwano Acked-by: Tudor Ambarus Acked-by: Pratyush Yadav Signed-off-by: Pratyush Yadav Link: https://lore.kernel.org/r/20250612074427.22263-1-Takahiro.Kuwano@infineon.com commit 0dc89a25468e3e26180875ac54bc23f3c0d8ab9e Merge: 3e0111b604b508 41ffbb1c42d30a Author: Arnd Bergmann Date: Thu Jul 3 16:54:28 2025 +0200 Merge tag 'renesas-dts-for-v6.17-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DTS updates for v6.17 - Add SPI FLASH, camera, and Ethernet support on the RZ/G3E SoC and/or the RZ/G3E SoM and SMARC Carrier-II EVK development board, - Add Ethernet, USB2, and PMIC support on the RZ/V2H and RZ/V2N SoCs and EVK boards, - Add timer, I2C, watchdog, and GPU support on the RZ/V2N SoC and the RZ/V2N EVK board, - Add debug LED support for the RZN1D-DB development board, - Improve PCIe clock description on the Retronix Sparrow Hawk board, - Miscellaneous fixes and improvements. * tag 'renesas-dts-for-v6.17-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: (34 commits) arm64: dts: renesas: r9a09g047: Add GBETH nodes arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Rename fixed regulator node names arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Add RAA215300 PMIC arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Add RAA215300 PMIC arm64: dts: renesas: rcar-gen3: Add bootph-all to sysinfo EEPROMs arm64: dts: renesas: sparrow-hawk: Describe split PCIe clock arm64: dts: renesas: r8a779g0: Describe PCIe root ports arm64: dts: renesas: ebisu: Add CAN0 support ARM: dts: renesas: r9a06g032: Add second clock input to RTC arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable USB2.0 support arm64: dts: renesas: r9a09g056: Add USB2.0 support arm64: dts: renesas: r8a779g3-sparrow-hawk: Sort DTS ARM: dts: renesas: r9a06g032-rzn1d400-db: Describe debug LEDs arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable USB2.0 support PCI/pwrctrl: Add optional slot clock for PCI slots arm64: dts: renesas: r9a09g057: Add USB2.0 support arm64: dts: renesas: r9a09g047e57-smarc: Enable CRU, CSI support arm64: dts: renesas: renesas-smarc2: Enable I2C0 node arm64: dts: renesas: r9a09g047e57-smarc: Add I2C0 pincontrol arm64: dts: renesas: r9a09g047: Add CRU, CSI2 nodes ... Link: https://lore.kernel.org/r/cover.1751026664.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 3e0111b604b5083eaf6948eb7c0e0c8af692c9f6 Merge: 0d495db1b9bd4c 37c78e3a456fc7 Author: Arnd Bergmann Date: Thu Jul 3 16:53:58 2025 +0200 Merge tag 'renesas-dt-bindings-for-v6.17-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt Renesas DT binding updates for v6.17 - Document more board part numbers. * tag 'renesas-dt-bindings-for-v6.17-tag1' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel: dt-bindings: soc: renesas: Document RZ/T2H Evaluation Board part number dt-bindings: soc: renesas: Document RZ/V2H EVK board part number Link: https://lore.kernel.org/r/cover.1751026663.git.geert+renesas@glider.be Signed-off-by: Arnd Bergmann commit 06799631d52261162d356623d14381d9f30223dc Author: Rafael J. Wysocki Date: Mon Jun 23 14:55:05 2025 +0200 PM: sleep: Make async suspend handle suppliers like parents Avoid starting "async" suspend processing upfront for devices that have consumers and start "async" suspend processing for a device's suppliers right after suspending the device itself. Suggested-by: Saravana Kannan Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Reviewed-by: Sudeep Holla Link: https://patch.msgid.link/3384525.44csPzL39Z@rjwysocki.net commit ed18738fff025df2a424d3b21e895992e6cb230a Author: Rafael J. Wysocki Date: Mon Jun 23 14:54:39 2025 +0200 PM: sleep: Make async resume handle consumers like children Avoid starting "async" resume processing upfront for devices that have suppliers and start "async" resume processing for a device's consumers right after resuming the device itself. Suggested-by: Saravana Kannan Signed-off-by: Rafael J. Wysocki Reviewed-by: Ulf Hansson Reviewed-by: Sudeep Holla Link: https://patch.msgid.link/3378088.aeNJFYEL58@rjwysocki.net commit d8b73ce1c5fc60cff8628d406caf7a5a5cecb1c7 Author: Christophe JAILLET Date: Sun May 25 18:53:31 2025 +0200 mtd: spi-nor: Constify struct spi_nor_fixups 'struct spi_nor_fixups' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 23304 13168 0 36472 8e78 drivers/mtd/spi-nor/micron-st.o After: ===== text data bss dec hex filename 23560 12912 0 36472 8e78 drivers/mtd/spi-nor/micron-st.o Signed-off-by: Christophe JAILLET Acked-by: Pratyush Yadav Signed-off-by: Pratyush Yadav Link: https://lore.kernel.org/r/aa641732ba707ce3690217825c3ca7373ffde4f9.1748191985.git.christophe.jaillet@wanadoo.fr commit 1a4aabc27e95674837f2e25f4ef340c0469e6203 Author: Hsin-Te Yuan Date: Fri Jun 20 10:41:43 2025 +0000 thermal: sysfs: Return ENODATA instead of EAGAIN for reads According to POSIX spec, EAGAIN returned by read with O_NONBLOCK set means the read would block. Hence, the common implementation in nonblocking model will poll the file when the nonblocking read returns EAGAIN. However, when the target file is thermal zone, this mechanism will totally malfunction because thermal zone doesn't implement sysfs notification and thus the poll will never return. For example, the read in Golang implemnts such method and sometimes hangs at reading some thermal zones via sysfs. Change to return -ENODATA instead of -EAGAIN to userspace. Signed-off-by: Hsin-Te Yuan Link: https://patch.msgid.link/20250620-temp-v3-1-6becc6aeb66c@chromium.org Signed-off-by: Rafael J. Wysocki commit 3fae6918a3e27cce20ded2551f863fb05d4bef8d Author: Michal Wajdeczko Date: Wed Jul 2 00:00:52 2025 +0200 drm/xe/pf: Clear all LMTT pages on alloc Our LMEM buffer objects are not cleared by default on alloc and during VF provisioning we only setup LMTT PTEs for the actually provisioned LMEM range. But beyond that valid range we might leave some stale data that could either point to some other VFs allocations or even to the PF pages. Explicitly clear all new LMTT page to avoid the risk that a malicious VF would try to exploit that gap. While around add asserts to catch any undesired PTE overwrites and low-level debug traces to track LMTT PT life-cycle. Fixes: b1d204058218 ("drm/xe/pf: Introduce Local Memory Translation Table") Signed-off-by: Michal Wajdeczko Cc: Michał Winiarski Cc: Lukasz Laguna Reviewed-by: Michał Winiarski Reviewed-by: Piotr Piórkowski Link: https://lore.kernel.org/r/20250701220052.1612-1-michal.wajdeczko@intel.com commit 5e8be76a7c37b98876704cf211ac0ab674304f4f Author: Zhongqiu Han Date: Tue Jun 17 16:46:50 2025 +0800 PM: sleep: Drop superfluous might_sleep() calls Drop superfluous might_sleep() calls from dpm_resume(), dpm_complete(), and dpm_prepare(). These functions already invoke primitives that implicitly check for sleep in atomic context: - dpm_resume() and dpm_complete() invoke mutex_lock(), which internally triggers might_sleep(). - dpm_prepare() calls wait_for_device_probe(), which internally uses flush_work(), and thus might_sleep(). These annotations are unnecessary and can be dropped to reduce clutter. Signed-off-by: Zhongqiu Han Link: https://patch.msgid.link/20250617084650.341262-1-quic_zhonhan@quicinc.com Signed-off-by: Rafael J. Wysocki commit 0d495db1b9bd4c3eefc201c5e1c92fd1b96ecf2e Author: Rob Herring (Arm) Date: Mon Jun 9 16:57:06 2025 -0500 arm64: dts: cavium: thunder2: Add missing PL011 "uartclk" The PL011 IP has 2 clock inputs for UART core/baud and APB bus. The Thunder2 SoC is missing the core "uartclk". In this case, the Linux driver uses single clock for both clock inputs. Let's assume that's how the h/w is wired and make the DT reflect that. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250609215706.3009692-2-robh@kernel.org Signed-off-by: Arnd Bergmann commit f060fee24a52d6d9d6c0d963c24da7f2b42a3d5d Author: Rob Herring (Arm) Date: Mon Jun 9 16:54:57 2025 -0500 arm64: dts: lg: Add missing PL011 "uartclk" The PL011 IP has 2 clock inputs for UART core/baud and APB bus. The LG131x SoCs are missing the core "uartclk". In this case, the Linux driver uses single clock for both clock inputs. Let's assume that's how the h/w is wired and make the DT reflect that. Signed-off-by: Rob Herring (Arm) Acked-by: Chanho Min Link: https://lore.kernel.org/r/20250609-dt-lg-fixes-v1-2-e210e797c2d7@kernel.org Signed-off-by: Arnd Bergmann commit caec315724f086c734688bd44f4c3a7a19526731 Author: Rob Herring (Arm) Date: Mon Jun 9 16:54:56 2025 -0500 arm64: dts: lg: Refactor common LG1312 and LG1313 parts The LG1312 and LG1313 DT are almost identical with the exception of the ethernet node. Refactor the common parts into a separate .dtsi file and include it. Signed-off-by: Rob Herring (Arm) Acked-by: Chanho Min Link: https://lore.kernel.org/r/20250609-dt-lg-fixes-v1-1-e210e797c2d7@kernel.org Signed-off-by: Arnd Bergmann commit 25a59e813cd2ca728047f657d64f9b29480be393 Author: Alex Elder Date: Wed Jul 2 06:37:03 2025 -0500 dt-bindings: soc: spacemit: define spacemit,k1-ccu resets There are additional SpacemiT syscon CCUs whose registers control both clocks and resets: RCPU, RCPU2, and APBC2. Unlike those defined previously, these will (initially) support only resets. They do not incorporate power domain functionality. Previously the clock properties were required for all compatible nodes. Make that requirement only apply to the three existing CCUs (APBC, APMU, and MPMU), so that the new reset-only CCUs can go without specifying them. Define the index values for resets associated with all SpacemiT K1 syscon nodes, including those with clocks already defined, as well as the new ones (without clocks). Signed-off-by: Alex Elder Reviewed-by: Krzysztof Kozlowski Reviewed-by: Yixun Lan Link: https://lore.kernel.org/r/20250702113709.291748-2-elder@riscstar.com Signed-off-by: Yixun Lan commit 5f712c3877f99d5b5e4d011955c6467ae0e535a6 Author: Yue Haibing Date: Tue Jul 1 12:12:35 2025 +0800 ipv6: Cleanup fib6_drop_pcpu_from() Since commit 0e2338749192 ("ipv6: fix races in ip6_dst_destroy()"), 'table' is unused in __fib6_drop_pcpu_from(), no need pass it from fib6_drop_pcpu_from(). Signed-off-by: Yue Haibing Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250701041235.1333687-1-yuehaibing@huawei.com Signed-off-by: Paolo Abeni commit 4266e8fa56d3d982bf451d382a410b9db432015c Author: tuhaowen Date: Wed Jun 11 11:23:45 2025 +0800 PM: sleep: console: Fix the black screen issue When the computer enters sleep status without a monitor connected, the system switches the console to the virtual terminal tty63(SUSPEND_CONSOLE). If a monitor is subsequently connected before waking up, the system skips the required VT restoration process during wake-up, leaving the console on tty63 instead of switching back to tty1. To fix this issue, a global flag vt_switch_done is introduced to record whether the system has successfully switched to the suspend console via vt_move_to_console() during suspend. If the switch was completed, vt_switch_done is set to 1. Later during resume, this flag is checked to ensure that the original console is restored properly by calling vt_move_to_console(orig_fgconsole, 0). This prevents scenarios where the resume logic skips console restoration due to incorrect detection of the console state, especially when a monitor is reconnected before waking up. Signed-off-by: tuhaowen Link: https://patch.msgid.link/20250611032345.29962-1-tuhaowen@uniontech.com Signed-off-by: Rafael J. Wysocki commit 129676952ee0672480cd50ac028330ef9e92b98f Merge: 792eacd32481a6 2f1fa26eef6548 Author: Paolo Abeni Date: Thu Jul 3 15:51:47 2025 +0200 Merge branch 'another-ip-sysctl-docs-cleanup' Bagas Sanjaya says: ==================== Another ip-sysctl docs cleanup Inspired by Abdelrahman's cleanup [1]. This time, mostly formatting conversion to bullet lists. [1]: https://lore.kernel.org/linux-doc/20250624150923.40590-1-abdelrahmanfekry375@gmail.com/ ==================== Link: https://patch.msgid.link/20250701031300.19088-1-bagasdotme@gmail.com Signed-off-by: Paolo Abeni commit 2f1fa26eef6548ab10cf49cea56390d5e5ccdbdd Author: Bagas Sanjaya Date: Tue Jul 1 10:13:00 2025 +0700 net: ip-sysctl: Add link to SCTP IPv4 scoping draft addr_scope_policy description contains pointer to SCTP IPv4 scoping draft but not its IETF Datatracker link. Add it. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250701031300.19088-6-bagasdotme@gmail.com Signed-off-by: Paolo Abeni commit 82b05660005923c4a07254c90ec54647a2edf128 Author: Bagas Sanjaya Date: Tue Jul 1 10:12:59 2025 +0700 net: ip-sysctl: Format SCTP-related memory parameters description as bullet list The description for vector elements of SCTP-related memory usage parameters (sctp{r,w,}mem) is formatted as normal paragraphs rather than bullet list. Convert the description to the latter. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250701031300.19088-5-bagasdotme@gmail.com Signed-off-by: Paolo Abeni commit 98bc1d41f2c586bdcc927443f59236d9d301fe7a Author: Bagas Sanjaya Date: Tue Jul 1 10:12:58 2025 +0700 net: ip-sysctl: Format pf_{enable,expose} boolean lists as bullet lists These lists' items were separated by newlines but without bullet list marker. Turn the lists into proper bullet list. While at it, also reword values description for pf_expose to not repeat mentioning SCTP_PEER_ADDR_CHANGE and SCTP_GET_PEER_ADDR_INFO sockopt. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250701031300.19088-4-bagasdotme@gmail.com Signed-off-by: Paolo Abeni commit 2040058db3026d286df224756631e85dbe85ef93 Author: Bagas Sanjaya Date: Tue Jul 1 10:12:57 2025 +0700 net: ip-sysctl: Format possible value range of ioam6_id{,_wide} as bullet list Format possible value range bounds of ioam6_id and ioam6_id_wide as bullet list instead of running paragraph. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250701031300.19088-3-bagasdotme@gmail.com Signed-off-by: Paolo Abeni commit 501aeb1ef4630f2a942815f0e6260e7ad4afa23e Author: Bagas Sanjaya Date: Tue Jul 1 10:12:56 2025 +0700 net: ip-sysctl: Format Private VLAN proxy arp aliases as bullet list Alias names list for private VLAN proxy arp technology is formatted as indented paragraph instead. Make it bullet list as it is better fit for this purpose. Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250701031300.19088-2-bagasdotme@gmail.com Signed-off-by: Paolo Abeni commit 94b59d5f567a148a3eb25265a4e60f8605ff8423 Author: Nam Cao Date: Thu Jun 26 16:49:09 2025 +0200 irqchip/ls-scfg-msi: Switch to use msi_create_parent_irq_domain() Move away from the legacy MSI domain setup, switch to use msi_create_parent_irq_domain(). Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/6d23d93fa1f1e65526698f97c9888fa5d12abc7b.1750860131.git.namcao@linutronix.de commit bafb2901317ff53c0add8b40e96267ad2d2e8ffb Author: Nam Cao Date: Thu Jun 26 16:49:08 2025 +0200 irqchip/armada-370-xp: Switch to msi_create_parent_irq_domain() Move away from the legacy MSI domain setup, switch to use msi_create_parent_irq_domain(). Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/976892e3ce64fcf52387833abee08ddfa47d2a82.1750860131.git.namcao@linutronix.de commit 7a91ad7ebd618d89c0966f19fe453701b1e17494 Author: Thomas Gleixner Date: Thu Jun 26 16:49:07 2025 +0200 irqchip/alpine-msi: Switch to msi_create_parent_irq_domain() Move away from the legacy MSI domain setup, switch to use msi_create_parent_irq_domain(). Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/ec08fea004e7c3aa18c3f5657a8cafeb1adfcc1d.1750860131.git.namcao@linutronix.de commit f7c2dd9f4c2d93b8dfb30dcc91b7e241fc1f5811 Author: Thomas Gleixner Date: Thu Jun 26 16:49:06 2025 +0200 irqchip/alpine-msi: Convert to __free Tidy up the code with __free. No functional change. Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/ff2c9460d03e44cb2946521dbae5ce800d34523e.1750860131.git.namcao@linutronix.de commit 71476f915f92cd9fb209f8729d700703ec3c36bc Author: Thomas Gleixner Date: Thu Jun 26 16:49:05 2025 +0200 irqchip/alpine-msi: Convert to lock guards Convert lock/unlock pairs to guards and tidy up the code. No functional change. Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/7886b9595aaf8e102f79364784f68dec9c49b023.1750860131.git.namcao@linutronix.de commit 6e44ac411255e0a48674862b53f2b1b47148c209 Author: Thomas Gleixner Date: Thu Jun 26 16:49:04 2025 +0200 irqchip/alpine-msi: Clean up whitespace style Tidy up the coding style. Only formatting changes. Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/3bbf719fcd974b0f52a832552b986116bdc70203.1750860131.git.namcao@linutronix.de commit 7c0dbd80de036d400525b8df862be665d321d0fc Author: Thomas Gleixner Date: Thu Jun 26 16:49:03 2025 +0200 irqchip/sg2042-msi: Switch to msi_create_parent_irq_domain() Switch to use the concise helper to create an MSI parent domain. Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Reviewed-by: Chen Wang Link: https://lore.kernel.org/all/3e901db1a4c87678af053019774d95b73bfb9ef9.1750860131.git.namcao@linutronix.de commit 7f91d608cc43ea7f417caf097a87d2619a0e2747 Author: Thomas Gleixner Date: Thu Jun 26 16:49:02 2025 +0200 irqchip/loongson-pch-msi.c: Switch to msi_create_parent_irq_domain() Switch to use the concise helper to create an MSI parent domain. Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/7ae78d7b7e33ad8ca1ec2ba28957546c81ba86f7.1750860131.git.namcao@linutronix.de commit c7cc7b122a4cf1235b53e5bb5f441ce95d8b0cd2 Author: Marc Zyngier Date: Thu Jun 26 16:49:01 2025 +0200 irqchip/imx-mu-msi: Convert to msi_create_parent_irq_domain() helper Now that we have a concise helper to create an MSI parent domain, switch the IMX letter soup over to that. Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Reviewed-by: Frank Li Link: https://lore.kernel.org/all/4f05fff99b6cc5875d2f4dadd31707e2dedaafc8.1750860131.git.namcao@linutronix.de Link: https://lore.kernel.org/all/20241204124549.607054-7-maz@kernel.org commit 59422904dd9855f94d00dc66598bef1bd2663894 Author: Marc Zyngier Date: Thu Jun 26 16:49:00 2025 +0200 irqchip/riscv-imsic: Convert to msi_create_parent_irq_domain() helper Now that we have a concise helper to create an MSI parent domain, switch the RISC-V letter soup over to that. Signed-off-by: Marc Zyngier Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/b906a38d443577de45923b335d80fc54c5638da0.1750860131.git.namcao@linutronix.de Link: https://lore.kernel.org/all/20241204124549.607054-6-maz@kernel.org commit 91650ca5efcf4be00eae5620ad571ce4cdf66ab5 Author: Thomas Gleixner Date: Thu Jun 26 16:48:59 2025 +0200 irqchip/bcm2712-mip: Switch to msi_create_parent_irq_domain() Switch to use the concise helper to create an MSI parent domain. Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/92a6d68db014e945337c10649a41605da05783da.1750860131.git.namcao@linutronix.de commit 858e65af91351f8842bbe2c5ae6f100778783f42 Author: Thomas Gleixner Date: Thu Jun 26 16:48:58 2025 +0200 irqdomain: Add device pointer to irq_domain_info and msi_domain_info Add device pointer to irq_domain_info and msi_domain_info, so that the device can be specified at domain creation time. Signed-off-by: Thomas Gleixner Signed-off-by: Nam Cao Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/943e52403b20cf13c320d55bd4446b4562466aab.1750860131.git.namcao@linutronix.de commit c5ddd03bc5c4ac92703060001d8912cacb3c2765 Author: Bingbu Cao Date: Thu May 29 12:13:23 2025 +0800 media: staging/ipu7: add Makefile, Kconfig and to-do file for IPU7 Add Kconfig and Makefile for IPU7 driver and also update the Makefile to build the IPU7 driver. Also add a to-do file to list the TODOs. Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 3f9b2dc8800c9933a5b7de2cc59517815fc77e46 Author: Bingbu Cao Date: Thu May 29 12:13:22 2025 +0800 MAINTAINERS: add maintainers for Intel IPU7 input system driver Update MAINTAINERS file for Intel IPU7 input system staging driver. Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit a516d36bdc3d8373f904af57c95e76d6f921cf1c Author: Bingbu Cao Date: Thu May 29 12:13:21 2025 +0800 media: staging/ipu7: add IPU7 input system device driver The main input system driver mainly cover the basic hardware setup, v4l2 devices registration, firmware stream interfaces and interrupt handling. Input system CSI2 receiver is exposed as a v4l2 sub-device. Each CSI2 sub-device represent one single CSI2 hardware port which be linked with external sub-device such camera sensor by linked with ISYS CSI2's sink pad. The CSI2 source pad is linked to the sink pad of video capture device. Register V4L2 video device and setup the VB2 queues to support video capture. Video streaming callback will trigger the input system driver to construct a input system stream configuration for firmware based on data type and stream ID and then queue buffers to firmware to do capture. IPU7 CSI-2 D-PHY hardware is a Synopsys DWC MIPI CSI2 Rx IP, the driver program the DPHY to receive MIPI data from camera sensors. Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2788a049ba59fb2f90cd0d8658a8a01ce9b2797b Author: Bingbu Cao Date: Thu May 29 12:13:20 2025 +0800 media: staging/ipu7: add IPU7 firmware ABI headers IPU7 firmware defines the ABIs between firmware and software, this patch adds a series of ABI headers. Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit cc5de519299d35fe34905303186abd8cac252163 Author: Bingbu Cao Date: Thu May 29 12:13:19 2025 +0800 media: staging/ipu7: add firmware parse, syscom interface and boot IPU7 irmware is generated and released as signed Code Partition Directory (CPD) format file which is aligned with the SPI flash code partition definition. The driver parses the CPD based on the layout. Syscom is an inter-process(or) communication mechanism between an IPU and host. Syscom uses message queues for message exchange between IPU and host. Each message queue has its consumer and producer, host queue messages to firmware as the producer and then firmware to dequeue the messages as consumer and vice versa. IPU and host use shared registers or memory to reside the read and write indices which are updated by consumer and producer. IPU7 firmware defined its boot sequence, driver setup the boot configuration and program the boot parameters to start and run the firmware. Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 71d81c25683a7cace187cdeeb232b51bb72a0d04 Author: Bingbu Cao Date: Thu May 29 12:13:18 2025 +0800 media: staging/ipu7: add IPU7 DMA APIs and MMU mapping The Intel IPU7 has internal microprocessor which runs the firmware The microprocessor accesses system DRAM by its internal 32-bit virtual address space. Driver should setup the MMU table and expose the DMA APIs for memory buffer mapping. This patch adds the IPU MMU and a DMA mapping implementation to setup the internal MMU hardware. Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit b7fe4c0019b12d60ece3e99eeb0ccfd5a1d103e5 Author: Bingbu Cao Date: Thu May 29 12:13:17 2025 +0800 media: staging/ipu7: add Intel IPU7 PCI device driver Intel Image Processing Unit 7th Gen includes input and processing systems and the hardware presents itself as a single PCI device in system same as IPU6. The IPU7 PCI device driver basically does PCI configurations, basic hardware configuration by its buttress interfaces, loads the firmware binary, register the auxiliary device which serve for the ISYS device driver. Signed-off-by: Bingbu Cao Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 792eacd32481a6e3dfa1c73573c96235b0f22957 Merge: 4f38a6db7bcfc4 17c395bba1a398 Author: Paolo Abeni Date: Thu Jul 3 15:36:12 2025 +0200 Merge branch 'ptp-provide-support-for-auxiliary-clocks-for-ptp_sys_offset_extended' Thomas Gleixner says: ==================== ptp: Provide support for auxiliary clocks for PTP_SYS_OFFSET_EXTENDED This is a follow up to the V1 series, which can be found here: https://lore.kernel.org/all/20250626124327.667087805@linutronix.de to address the merge logistics problem, which I created myself. Changes vs. V1: - Make patch 1, which provides the timestamping function temporarily define CLOCK_AUX* if undefined so that it can be merged independently, - Add a missing check for CONFIG_POSIX_AUX_CLOCK in the PTP IOCTL - Picked up tags Merge logistics if agreed on: 1) Patch #1 is applied to the tip tree on top of plain v6.16-rc1 and tagged 2) That tag is merged into tip:timers/ptp and the temporary CLOCK_AUX define is removed in a subsequent commit 3) Network folks merge the tag and apply patches #2 + #3 So the only fallout from this are the extra merges in both trees and the cleanup commit in the tip tree. But that way there are no dependencies and no duplicate commits with different SHAs. Thoughts? Due to the above constraints there is no branch offered to pull from right now. Sorry for the inconveniance. Should have thought about that earlier. ==================== Link: https://patch.msgid.link/20250701130923.579834908@linutronix.de Signed-off-by: Paolo Abeni commit 17c395bba1a3983b1b1918286979bae5f6851f33 Author: Thomas Gleixner Date: Tue Jul 1 15:27:02 2025 +0200 ptp: Enable auxiliary clocks for PTP_SYS_OFFSET_EXTENDED Allow ioctl(PTP_SYS_OFFSET_EXTENDED*) to select CLOCK_AUX clock ids for generating the pre and post hardware readout timestamps. Aside of adding these clocks to the clock ID validation, this also requires to check the timestamp to be valid, i.e. the seconds value being greater than or equal zero. This is necessary because AUX clocks can be asynchronously enabled or disabled, so there is no way to validate the availability upfront. The same could have been achieved by handing the return value of ktime_get_aux_ts64() all the way down to the IOCTL call site, but that'd require to modify all existing ptp::gettimex64() callbacks and their inner call chains. The timestamp check achieves the same with less churn and less complicated code all over the place. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250701132628.491315452@linutronix.de Signed-off-by: Paolo Abeni commit 4c09a4cebd0320c5381afad3fb6f997f20082a3b Author: Thomas Gleixner Date: Tue Jul 1 15:27:00 2025 +0200 ptp: Use ktime_get_clock_ts64() for timestamping The inlined ptp_read_system_[pre|post]ts() switch cases expand to a copious amount of text in drivers, e.g. ~500 bytes in e1000e. Adding auxiliary clock support to the inlines would increase it further. Replace the inline switch case with a call to ktime_get_clock_ts64(), which reduces the code size in drivers and allows to access auxiliary clocks once they are enabled in the IOCTL parameter filter. No functional change. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Acked-by: John Stultz Link: https://patch.msgid.link/20250701132628.426168092@linutronix.de Signed-off-by: Paolo Abeni commit 4f38a6db7bcfc4502c08f4095d2abf686828cff9 Merge: 135faae6321880 5b605dbee07dda Author: Paolo Abeni Date: Thu Jul 3 15:35:07 2025 +0200 Merge tag 'ktime-get-clock-ts64-for-ptp' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Base implementation for PTP with a temporary CLOCK_AUX* workaround to allow integration of depending changes into the networking tree. Signed-off-by: Paolo Abeni commit 13edf7539211d8f7d0068ce3ed143005f1da3547 Author: Sebastian Ott Date: Thu Jul 3 14:42:15 2025 +0200 ACPI: processor: fix acpi_object initialization Initialization of the local acpi_object in acpi_processor_get_info() only sets the first 4 bytes to zero and is thus incomplete. This is indicated by messages like: acpi ACPI0007:be: Invalid PBLK length [166288104] Fix this by initializing all 16 bytes of the processor member of that union. Signed-off-by: Sebastian Ott Link: https://patch.msgid.link/20250703124215.12522-1-sebott@redhat.com Signed-off-by: Rafael J. Wysocki commit db58532188ebf51d52b1d7693d9e94c76b926e9f Author: Sarthak Garg Date: Tue Jul 1 15:36:59 2025 +0530 mmc: sdhci-msm: Ensure SD card power isn't ON when card removed Many mobile phones feature multi-card tray designs, where the same tray is used for both SD and SIM cards. If the SD card is placed at the outermost location in the tray, the SIM card may come in contact with SD card power-supply while removing the tray, possibly resulting in SIM damage. To prevent that, make sure the SD card is really inserted by reading the Card Detect pin state. If it's not, turn off the power in sdhci_msm_check_power_status() and also set the BUS_FAIL power state on the controller as part of pwr_irq handling for BUS_ON request. Signed-off-by: Sarthak Garg Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250701100659.3310386-1-quic_sartgarg@quicinc.com Signed-off-by: Ulf Hansson commit 135faae63218808475501b1d4eab8b2342a131f9 Author: Seth Forshee (DigitalOcean) Date: Wed Jun 25 11:01:24 2025 -0500 bonding: don't force LACPDU tx to ~333 ms boundaries The timer which ensures that no more than 3 LACPDUs are transmitted in a second rearms itself every 333ms regardless of whether an LACPDU is transmitted when the timer expires. This causes LACPDU tx to be delayed until the next expiration of the timer, which effectively aligns LACPDUs to ~333ms boundaries. This results in a variable amount of jitter in the timing of periodic LACPDUs. Change this to only rearm the timer when an LACPDU is actually sent, allowing tx at any point after the timer has expired. Signed-off-by: Seth Forshee (DigitalOcean) Reviewed-by: Carlos Bilbao Link: https://patch.msgid.link/20250625-fix-lacpdu-jitter-v1-1-4d0ee627e1ba@kernel.org Signed-off-by: Paolo Abeni commit 4734c8b46b901cff2feda8b82abc710b65dc31c1 Author: Breno Leitao Date: Wed Jul 2 08:39:51 2025 -0700 ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path When a GHES (Generic Hardware Error Source) triggers a panic, add the TAINT_MACHINE_CHECK taint flag to the kernel. This explicitly marks the kernel as tainted due to a machine check event, improving diagnostics and post-mortem analysis. The taint is set with LOCKDEP_STILL_OK to indicate lockdep remains valid. At large scale deployment, this helps to quickly determine panics that are coming due to hardware failures. Signed-off-by: Breno Leitao Reviewed-by: Tony Luck Link: https://patch.msgid.link/20250702-add_tain-v1-1-9187b10914b9@debian.org Signed-off-by: Rafael J. Wysocki commit 8959338617a85e35820e3a7fa21801cf55b068bf Author: Thomas Gleixner Date: Thu Jul 3 14:39:28 2025 +0200 timekeeping: Remove the temporary CLOCK_AUX workaround ktime_get_clock_ts64() was provided for the networking tree as a stand alone commit based on v6.16-rc1. It contains a temporary workaround for the CLOCK_AUX* defines, which are only available in the timekeeping tree. As this commit is now merged into the timers/ptp branch, which contains the real CLOCK_AUX* defines, the workaround is obsolete. Remove it. Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250701130923.579834908@linutronix.de commit a6d9638d4da9740c189c141510584161ffd84307 Merge: 7b95663a3d96b3 5b605dbee07dda Author: Thomas Gleixner Date: Thu Jul 3 14:35:53 2025 +0200 Merge tag 'ktime-get-clock-ts64-for-ptp' into timers/ptp Pull the base implementation of ktime_get_clock_ts64() for PTP, which contains a temporary CLOCK_AUX* workaround. That was created to allow integration of depending changes into the networking tree. The workaround is going to be removed in a subsequent change in the timekeeping tree. Signed-off-by: Thomas Gleixner commit 5b605dbee07dda8fd538af1f07cbf1baf0a49cbc Author: Thomas Gleixner Date: Tue Jul 1 15:26:58 2025 +0200 timekeeping: Provide ktime_get_clock_ts64() PTP implements an inline switch case for taking timestamps from various POSIX clock IDs, which already consumes quite some text space. Expanding it for auxiliary clocks really becomes too big for inlining. Provide a out of line version. The function invalidates the timestamp in case the clock is invalid. The invalidation allows to implement a validation check without the need to propagate a return value through deep existing call chains. Due to merge logistics this temporarily defines CLOCK_AUX[_LAST] if undefined, so that the plain branch, which does not contain any of the core timekeeper changes, can be pulled into the networking tree as prerequisite for the PTP side changes. These temporary defines are removed after that branch is merged into the tip::timers/ptp branch. That way the result in -next or upstream in the next merge window has zero dependencies. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Acked-by: John Stultz Link: https://lore.kernel.org/all/20250701132628.357686408@linutronix.de commit 886eade45257554fa0f76e61d9f14bdbc753ec11 Merge: f6ad15395e8f5a ff09b71bf9daec Author: Ulf Hansson Date: Thu Jul 3 14:17:35 2025 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v6.16-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit f6ad15395e8f5a6d5e86d14fdf401ec70f1cbe0c Author: Sayali Lokhande Date: Wed Jul 2 14:29:25 2025 +0530 dt-bindings: mmc: Add sdhci compatible for qcs8300 Document the sdhci compatible for Qualcomm qcs8300 to support function for emmc on the Soc. Signed-off-by: Sayali Lokhande Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250702085927.10370-2-quic_sayalil@quicinc.com Signed-off-by: Ulf Hansson commit baee26a9d6cd3d3c6c3c03c56270aa647a67e4bd Author: Shengjiu Wang Date: Fri Jun 20 13:52:29 2025 +0800 ASoC: fsl_mqs: rename system manager indices for i.MX95 The system manager indices names are different for each platform, rename the indices for i.MX95 to differentiate with other platform. Signed-off-by: Shengjiu Wang Reviewed-by: Peng Fan Link: https://patch.msgid.link/20250620055229.965942-3-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 9931d2899eec3737f4e4fa9fc900be7329816e94 Author: Shengjiu Wang Date: Fri Jun 20 13:52:28 2025 +0800 ASoC: fsl_mqs: Distinguish different modules by system manager indices On i.MX94, the MQS2 also needs to be configured by SCMI interface, add sm_index variable in struct fsl_mqs_soc_data to distinguish the MQS1 and MQS2 on this platform. Add the system manager indices for i.MX94 in the header file. Signed-off-by: Shengjiu Wang Reviewed-by: Peng Fan Link: https://patch.msgid.link/20250620055229.965942-2-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit fd72f265bb00d2dd2a3bbad7ec45520025e3a926 Author: Pablo Neira Ayuso Date: Thu May 22 16:52:23 2025 +0200 netfilter: conntrack: remove DCCP protocol support The DCCP socket family has now been removed from this tree, see: 8bb3212be4b4 ("Merge branch 'net-retire-dccp-socket'") Remove connection tracking and NAT support for this protocol, this should not pose a problem because no DCCP traffic is expected to be seen on the wire. As for the code for matching on dccp header for iptables and nftables, mark it as deprecated and keep it in place. Ruleset restoration is an atomic operation. Without dccp matching support, an astray match on dccp could break this operation leaving your computer with no policy in place, so let's follow a more conservative approach for matches. Add CONFIG_NFT_EXTHDR_DCCP which is set to 'n' by default to deprecate dccp extension support. Similarly, label CONFIG_NETFILTER_XT_MATCH_DCCP as deprecated too and also set it to 'n' by default. Code to match on DCCP protocol from ebtables also remains in place, this is just a few checks on IPPROTO_DCCP from _check() path which is exercised when ruleset is loaded. There is another use of IPPROTO_DCCP from the _check() path in the iptables multiport match. Another check for IPPROTO_DCCP from the packet in the reject target is also removed. So let's schedule removal of the dccp matching for a second stage, this should not interfer with the dccp retirement since this is only matching on the dccp header. Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: Kuniyuki Iwashima Reviewed-by: Simon Horman Signed-off-by: Pablo Neira Ayuso commit 57cd4af7654eed26e48984dd34f6997fcd83c841 Author: Benoît Monin Date: Thu Jun 26 16:43:31 2025 +0200 mmc: sdhci-cadence: use of_property_present Instead of using of_property_read_bool to check the presence of the cdns,phy-* properties in the device tree, use of_property_present in function sdhci_cdns_phy_param_count. This silences the following warning messages since the cdns,phy-* properties are all u32, not boolean. OF: /soc/sdhci@d8010000: Read of boolean property 'cdns,phy-input-delay-legacy' with a value. OF: /soc/sdhci@d8010000: Read of boolean property 'cdns,phy-input-delay-mmc-highspeed' with a value. OF: /soc/sdhci@d8010000: Read of boolean property 'cdns,phy-input-delay-mmc-ddr' with a value. OF: /soc/sdhci@d8010000: Read of boolean property 'cdns,phy-dll-delay-sdclk' with a value. OF: /soc/sdhci@d8010000: Read of boolean property 'cdns,phy-dll-delay-sdclk-hsmmc' with a value. Signed-off-by: Benoît Monin Link: https://lore.kernel.org/r/e244c1377f7b2ad5d026c9d9368a08de3887129f.1750943549.git.benoit.monin@bootlin.com Signed-off-by: Ulf Hansson commit 7105fdd54a14bee49371b39374a61b3c967d74cb Author: Rob Herring (Arm) Date: Wed Jul 2 17:26:42 2025 -0500 spi: dt-bindings: Convert marvell,orion-spi to DT schema Convert the Marvell Orion SPI binding to schema. Update compatible strings to what is in use. Generally, "marvell,orion-spi" is a fallback compatible, but newer variants only use "marvell,armada-380-spi". Mark cell-index as deprecated and not required as some instances don't use it already. Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250702222643.2761617-1-robh@kernel.org Signed-off-by: Mark Brown commit d0f8e961deae82e077d7f2ced1a20106605cf4e9 Author: Binbin Zhou Date: Tue Jun 24 19:58:40 2025 +0800 mmc: loongson2: Add Loongson-2K2000 SD/SDIO/eMMC controller driver This patch describes the two MMC controllers of the Loongson-2K2000 SoC, one providing an eMMC interface and the other exporting an SD/SDIO interface. Compared to the Loongson-2K1000's MMC controllers, their internals are similar, except that we use an internally exclusive DMA engine instead of an externally shared APBDMA engine. Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/1df46b976abd36003bd553ad8a039e5c97369df0.1750765495.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 96e72886a41623ed1ee189f46edb12cee66fab9e Author: Binbin Zhou Date: Tue Jun 24 19:58:12 2025 +0800 dt-bindings: mmc: loongson,ls2k0500-mmc: Add compatible for Loongson-2K2000 Add the devicetree compatible for Loongson-2K2000 EMMC/SD/SDIO controller. Acked-by: Conor Dooley Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/2274fcccd27d7c03bc026fd2a43727bdf5af1ef5.1750765495.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 2115772014bdac368317e997ed15016cf2792665 Author: Binbin Zhou Date: Tue Jun 24 19:58:11 2025 +0800 mmc: loongson2: Add Loongson-2K SD/SDIO controller driver The MMC controllers on the Loongson-2K series CPUs are similar, except for the interface characteristics and the use of DMA controllers. This patch describes the MMC controllers on the Loongson-2K0500/2K1000, with the distinguishing feature being the use of an externally shared APBDMA engine. Signed-off-by: Binbin Zhou Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/c0a9f0c0279d8e09165c6e2d694b0c35f7fc7e31.1750765495.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit fe62ee33fcf9248530b4339a8cf9ec4c6147d3b4 Author: Binbin Zhou Date: Tue Jun 24 19:58:10 2025 +0800 dt-bindings: mmc: Add Loongson-2K SD/SDIO/eMMC controller binding Add the Loongson-2K SoC's SD/SDIO/eMMC controller binding with DT schema format using json-schema. Signed-off-by: Binbin Zhou Reviewed-by: Rob Herring (Arm) Reviewed-by: Huacai Chen Link: https://lore.kernel.org/r/949c55be120a806ea3d74b47fa2cc96ced2905fc.1750765495.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 31c2e10cecc48a90da09670893d91ecf6b6a8917 Author: Li Dong Date: Fri Jun 20 12:35:17 2025 +0800 mmc: Convert ternary operator to str_true_false() helper Replace direct ternary condition check with existing helper function str_true_false() to improve code readability and maintain consistency. Signed-off-by: Li Dong Link: https://lore.kernel.org/r/20250620043517.172705-1-lidong@vivo.com Signed-off-by: Ulf Hansson commit b5a1f9870f9828bd6625d6c946c66be4983d56f6 Author: Masahiro Yamada Date: Sun Jun 8 10:51:34 2025 +0900 mips: boot: use 'targets' instead of extra-y in Makefile vmlinux.bin.* files are built as prerequisites of other objects. There is no need to use extra-y, which is planned for deprecation. Signed-off-by: Masahiro Yamada Signed-off-by: Thomas Bogendoerfer commit e9f4a6b3421e936c3ee9d74710243897d74dbaa2 Author: Thomas Weißschuh Date: Wed Jun 11 13:28:26 2025 +0200 MIPS: Don't crash in stack_top() for tasks without ABI or vDSO Not all tasks have an ABI associated or vDSO mapped, for example kthreads never do. If such a task ever ends up calling stack_top(), it will derefence the NULL ABI pointer and crash. This can for example happen when using kunit: mips_stack_top+0x28/0xc0 arch_pick_mmap_layout+0x190/0x220 kunit_vm_mmap_init+0xf8/0x138 __kunit_add_resource+0x40/0xa8 kunit_vm_mmap+0x88/0xd8 usercopy_test_init+0xb8/0x240 kunit_try_run_case+0x5c/0x1a8 kunit_generic_run_threadfn_adapter+0x28/0x50 kthread+0x118/0x240 ret_from_kernel_thread+0x14/0x1c Only dereference the ABI point if it is set. The GIC page is also included as it is specific to the vDSO. Also move the randomization adjustment into the same conditional. Signed-off-by: Thomas Weißschuh Reviewed-by: David Gow Reviewed-by: Huacai Chen Signed-off-by: Thomas Bogendoerfer commit da1fe323261f6a3e1a959e59c24f86186e8a9f4f Author: Rosen Penev Date: Sun Jun 8 20:08:51 2025 -0700 mips: dts: qca: add wmac support Now that OF ahb support was added to the ath9k driver, we can use it to enable and use the SoC wireless found in these chipsets. Signed-off-by: Rosen Penev Reviewed-by: Krzysztof Kozlowski Signed-off-by: Thomas Bogendoerfer commit f973fe6528335033d12efe49815f6bfa63bfd666 Author: Benoît Monin Date: Tue Jun 17 15:25:56 2025 +0200 MIPS: eyeq5_defconfig: add cadence MMC/SDHCI driver Enable MMC support on eyeQ5 platform so it can be used as the root partition. Signed-off-by: Benoît Monin Acked-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit 2de84c70ffcd5dea6050fb343d1a61c0e22e2b5b Author: Benoît Monin Date: Tue Jun 17 15:25:55 2025 +0200 MIPS: mobileye: dts: eyeq5: add the emmc controller Add the MMC/SDHCI controller found in the eyeQ5 SoC. It is based on the cadence sd4hc controller and support modes up to HS400 enhanced strobe. Signed-off-by: Benoît Monin Acked-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit e1c98b1f5f88ece4740f5c33d919f64a7dd6dfec Author: Benoît Monin Date: Tue Jun 17 15:25:54 2025 +0200 MIPS: eyeq6_defconfig: add cadence MMC/SDHCI driver Enable MMC support on eyeQ6 platform so it can be used as the root partition. Signed-off-by: Benoît Monin Acked-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit 71ad8d3c463ead1fc9392dfaff2fd977856c07d5 Author: Benoît Monin Date: Tue Jun 17 15:25:53 2025 +0200 MIPS: mobileye: dts: eyeq6h: add the emmc controller Add the MMC/SDHCI controller found in the eyeQ6 SoC. It is based on the cadence sd4hc controller and support modes up to HS400 enhanced strobe. Signed-off-by: Benoît Monin Acked-by: Gregory CLEMENT Signed-off-by: Thomas Bogendoerfer commit 9c9a7ff9882fc6ba7d2f4050697e8bb80383e8dc Author: Shiji Yang Date: Wed Jun 18 22:53:23 2025 +0800 MIPS: lantiq: falcon: sysctrl: fix request memory check logic request_mem_region() will return NULL instead of error code when the memory request fails. Therefore, we should check if the return value is non-zero instead of less than zero. In this way, this patch also fixes the build warnings: arch/mips/lantiq/falcon/sysctrl.c:214:50: error: ordered comparison of pointer with integer zero [-Werror=extra] 214 | res_status.name) < 0) || | ^ arch/mips/lantiq/falcon/sysctrl.c:216:47: error: ordered comparison of pointer with integer zero [-Werror=extra] 216 | res_ebu.name) < 0) || | ^ arch/mips/lantiq/falcon/sysctrl.c:219:50: error: ordered comparison of pointer with integer zero [-Werror=extra] 219 | res_sys[0].name) < 0) || | ^ arch/mips/lantiq/falcon/sysctrl.c:222:50: error: ordered comparison of pointer with integer zero [-Werror=extra] 222 | res_sys[1].name) < 0) || | ^ arch/mips/lantiq/falcon/sysctrl.c:225:50: error: ordered comparison of pointer with integer zero [-Werror=extra] 225 | res_sys[2].name) < 0)) | Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit 8a6156bd26240177e710fd8623bc2eb0ef0092cf Author: Shiji Yang Date: Wed Jun 18 22:53:22 2025 +0800 MIPS: lantiq: falcon: sysctrl: add missing header prom.h "prom.h" includes the prototype of ltq_soc_init(). Fix warning: arch/mips/lantiq/falcon/sysctrl.c:185:13: error: no previous prototype for 'ltq_soc_init' [-Werror=missing-prototypes] 185 | void __init ltq_soc_init(void) | ^~~~~~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit 01432b513638b0ffb080aa211b5b7f7ecf316f24 Author: Shiji Yang Date: Wed Jun 18 22:53:21 2025 +0800 MIPS: lantiq: falcon: sysctrl: remove unused falcon_trigger_hrst() This is a defined but unused function. Fix warning: arch/mips/lantiq/falcon/sysctrl.c:75:6: error: no previous prototype for 'falcon_trigger_hrst' [-Werror=missing-prototypes] 75 | void falcon_trigger_hrst(int level) | ^~~~~~~~~~~~~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit d97930fbf2d2aa00e7da9be7f128754920486953 Author: Shiji Yang Date: Wed Jun 18 22:53:20 2025 +0800 MIPS: lantiq: falcon: fix misc missing-prototypes warnings Fix the following build warnings: arch/mips/lantiq/falcon/prom.c:39:13: error: no previous prototype for 'ltq_soc_nmi_setup' [-Werror=missing-prototypes] 39 | void __init ltq_soc_nmi_setup(void) | ^~~~~~~~~~~~~~~~~ arch/mips/lantiq/falcon/prom.c:46:13: error: no previous prototype for 'ltq_soc_ejtag_setup' [-Werror=missing-prototypes] 46 | void __init ltq_soc_ejtag_setup(void) | ^~~~~~~~~~~~~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit 3f8565be1e848de86c1cc98285ac27a4a9bcb161 Author: Shiji Yang Date: Wed Jun 18 22:53:18 2025 +0800 MIPS: lantiq: xway: add prototype for ltq_get_cp1_base() ltq_get_cp1_base() is an exported function, we must define its prototype on header file. Fix warning: arch/mips/lantiq/xway/vmmc.c:22:15: error: no previous prototype for 'ltq_get_cp1_base' [-Werror=missing-prototypes] 22 | unsigned int *ltq_get_cp1_base(void) | ^~~~~~~~~~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit e23bd7f95a86c4fc5da5499a3bdc95aa7518f7eb Author: Shiji Yang Date: Wed Jun 18 22:53:24 2025 +0800 MIPS: lantiq: xway: gptu: mark gptu_init() as static Fix the following missing-prototypes warning: arch/mips/lantiq/xway/gptu.c:197:12: error: no previous prototype for 'gptu_init' [-Werror=missing-prototypes] 197 | int __init gptu_init(void) | ^~~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit de521c6d99d755bbdfa0f1f35299a3e2b02b0dfe Author: Shiji Yang Date: Wed Jun 18 22:53:14 2025 +0800 MIPS: lantiq: xway: mark ltq_ar9_sys_hz() as static Fix the following missing-prototypes warning: arch/mips/lantiq/xway/clk.c:77:15: error: no previous prototype for 'ltq_ar9_sys_hz' [-Werror=missing-prototypes] 77 | unsigned long ltq_ar9_sys_hz(void) | ^~~~~~~~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit b93d8b1cab299bc76f574f9e3cb8aafcfafc0037 Author: Lad Prabhakar Date: Tue Jun 17 17:49:14 2025 +0100 dt-bindings: mmc: renesas,sdhi: Document RZ/T2H and RZ/N2H support Add SDHI bindings for the Renesas RZ/T2H (a.k.a R9A09G077) and RZ/N2H (a.k.a R9A09G087) SoCs. Use `renesas,sdhi-r9a09g057` as a fallback since the SD/MMC block on these SoCs is identical to the one on RZ/V2H(P), allowing reuse of the existing driver without modifications. Update the binding schema to reflect differences: unlike RZ/V2H(P), RZ/T2H and RZ/N2H do not require the `resets` property and use only a two clocks instead of four. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250617164914.158091-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Ulf Hansson commit 9e8ebfe677f9101bbfe1f75d548a5aec581e8213 Author: Mark Brown Date: Mon Jun 9 16:25:33 2025 +0100 kselftest/arm64: Specify SVE data when testing VL set in sve-ptrace Since f916dd32a943 ("arm64/fpsimd: ptrace: Mandate SVE payload for streaming-mode state") we reject attempts to write to the streaming mode regset even if there is no register data supplied, causing the tests for setting vector lengths and setting SVE_VL_INHERIT in sve-ptrace to spuriously fail. Set the flag to avoid the issue, we still support not supplying register data. Acked-by: Mark Rutland Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250609-kselftest-arm64-ssve-fixups-v2-3-998fcfa6f240@kernel.org Signed-off-by: Catalin Marinas commit 94ab150010f430a36c72e2fe5b7da44a625a6ad5 Author: Mark Brown Date: Mon Jun 9 16:25:32 2025 +0100 kselftest/arm64: Fix test for streaming FPSIMD write in sve-ptrace Since f916dd32a943 ("arm64/fpsimd: ptrace: Mandate SVE payload for streaming-mode state") we do not support writing FPSIMD payload data when writing NT_ARM_SSVE but the sve-ptrace test has an explicit test for this being supported which was not updated to reflect the new behaviour. Fix the test to expect a failure when writing FPSIMD data to the streaming mode register set. Acked-by: Mark Rutland Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250609-kselftest-arm64-ssve-fixups-v2-2-998fcfa6f240@kernel.org Signed-off-by: Catalin Marinas commit 867446f090589626497638f70b10be5e61a0b925 Author: Mark Brown Date: Mon Jun 9 16:25:31 2025 +0100 kselftest/arm64: Fix check for setting new VLs in sve-ptrace The check that the new vector length we set was the expected one was typoed to an assignment statement which for some reason the compilers didn't spot, most likely due to the macros involved. Fixes: a1d7111257cd ("selftests: arm64: More comprehensively test the SVE ptrace interface") Acked-by: Mark Rutland Acked-by: Dev Jain Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250609-kselftest-arm64-ssve-fixups-v2-1-998fcfa6f240@kernel.org Signed-off-by: Catalin Marinas commit 6d80cb73131db19a9d625dad93d5dbc53513c6cb Author: Mark Brown Date: Mon Jun 9 14:29:10 2025 +0100 kselftest/arm64: Convert tpidr2 test to use kselftest.h Recent work by Thomas Weißschuh means that it is now possible to use kselftest.h with nolibc. Convert the tpidr2 test which is nolibc specific to use kselftest.h, making it look more standard and ensuring it gets the benefit of any work done on kselftest.h. Signed-off-by: Mark Brown Link: https://lore.kernel.org/r/20250609-kselftest-arm64-nolibc-header-v1-1-16ee1c6fbfed@kernel.org Signed-off-by: Catalin Marinas commit 196dbace08243bbd4639cdb3d8ec655b2da361bd Author: Rob Herring (Arm) Date: Wed Jul 2 17:26:08 2025 -0500 dt-bindings: reset: Convert snps,dw-reset to DT schema Convert the Synopsys Designware Reset Controller binding to schema. It is a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250702222609.2760718-1-robh@kernel.org Signed-off-by: Philipp Zabel commit c26e8dcd9d4e86d788c5bf7a5dd0ea70a95ab067 Author: Bryan O'Donoghue Date: Thu Jun 26 02:24:33 2025 +0100 media: qcom: camss: Remove extraneous -supply postfix on supply names The -supply postfix is wrong but wasn't noticed on the CRD devices or indeed the Dell devices, however on Lenovo devices the error comes up. Fixes: 1830cf0f56c3 ("media: qcom: camss: Add x1e80100 specific support") Cc: stable@vger.kernel.org Signed-off-by: Bryan O'Donoghue [bod: reworded commit log per Konrad's feedback] Reviewed-by: Konrad Dybcio Signed-off-by: Hans Verkuil commit 49ce78f176d2110ab6cf42fa68b4c9cd8de3abe8 Author: Vladimir Zapolskiy Date: Tue May 13 17:23:53 2025 +0300 MAINTAINERS: add myself as a CAMSS patch reviewer Add myself as a review of Qualcomm CAMSS subsystem patches. Signed-off-by: Vladimir Zapolskiy Acked-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 6181e48f53628613293c458a54c0a8b42169bc98 Author: Vladimir Zapolskiy Date: Tue May 13 17:23:50 2025 +0300 media: qcom: camss: simplify camss_subdev_notifier_complete() function For sake of code simplicity and readability reduce the function code by one level of indentation, the change is non-functional. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue [bod: Fixed indentation error] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 0d9f889fed6ba5d27f1f6740e9af4583f68088d9 Author: Vladimir Zapolskiy Date: Tue May 13 17:23:48 2025 +0300 media: qcom: camss: register camss media device before subdevices A media device can and at least for sake of simplicity should be registered before V4L2 devices including the ones added on async completion. The change removes the second and out of camss_probe() media device registration path, and it allows to get a working ISP media device independently from connected or not sensor devices. Signed-off-by: Vladimir Zapolskiy Acked-by: Neil Armstrong Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit ed4b86828d67609ca9c120265e7c5d3f71686ffa Author: Vladimir Zapolskiy Date: Tue May 13 17:23:46 2025 +0300 media: qcom: camss: remove duplicated csiphy_formats_sc7280 data It's sufficient to have just one previously set csiphy_formats_sdm845 data. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 69080ec3d0daba8a894025476c98ab16b5a505a4 Author: Vladimir Zapolskiy Date: Tue May 13 17:23:45 2025 +0300 media: qcom: camss: cleanup media device allocated resource on error path A call to media_device_init() requires media_device_cleanup() counterpart to complete cleanup and release any allocated resources. This has been done in the driver .remove() right from the beginning, but error paths on .probe() shall also be fixed. Fixes: a1d7c116fcf7 ("media: camms: Add core files") Cc: stable@vger.kernel.org Signed-off-by: Vladimir Zapolskiy Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 868423c834a29981fe3a77d32caf645c6b91a4c5 Author: Bryan O'Donoghue Date: Thu Jun 12 09:07:15 2025 +0100 media: qcom: camss: csiphy-3ph: Fix inadvertent dropping of SDM660/SDM670 phy init The moving of init sequence hook from gen2() to subdev_init() doesn't account for gen1 devices such as SDM660 and SDM670. The switch should find the right offset for gen2 PHYs only, not reject gen1. Remove the default error case to restore gen1 CSIPHY support. Cc: stable@vger.kernel.org Fixes: fbce0ca24c3a ("media: qcom: camss: csiphy-3ph: Move CSIPHY variables to data field inside csiphy struct") Signed-off-by: Bryan O'Donoghue Reviewed-by: Vladimir Zapolskiy Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 164202f682030cf8702f11cb63ccbcf2a81b2e75 Author: Richard Acayan Date: Mon May 26 19:28:39 2025 -0400 media: qcom: camss: Power pipeline only when streaming The libcamera plugin for Pipewire may keep an open file descriptor to the video device, even while streaming. This simplifies its operation, as it only needs to keep track of a number instead of a file path. When the video device is open but not streaming, the pipeline can be powered off. Move the pipeline power management to the prepare_streaming and unprepare_streaming functions. Signed-off-by: Richard Acayan Reviewed-by: Bryan O'Donoghue Tested-by: Bryan O'Donoghue Reviewed-by: Vladimir Zapolskiy Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 1da245b6b73436be0d9936bb472f8a55900193cb Author: Vladimir Zapolskiy Date: Tue Jun 24 12:42:53 2025 +0300 dt-bindings: media: qcom,x1e80100-camss: Fix isp unit address According to the devicetree specification a unit address shall match the first address value of the reg property. Reviewed-by: Bryan O'Donoghue Signed-off-by: Vladimir Zapolskiy Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit b8ef764aff5be003c149ea593e4caa99253cac5c Author: Vladimir Zapolskiy Date: Fri May 2 23:41:42 2025 +0300 dt-bindings: media: qcom,x1e80100-camss: Remove clock-lanes port property Since clock lanes under CSIPHY are hard-wired and non-selectable, it makes sense to remove this port property. The change follows the same logic as found in commit 336136e197e2 ("media: dt-bindings: media: camss: Remove clock-lane property"). Signed-off-by: Vladimir Zapolskiy Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 7b1747f8ad5d5d00c429bb9128025e6868005745 Author: Vladimir Zapolskiy Date: Fri May 2 23:41:41 2025 +0300 dt-bindings: media: qcom,x1e80100-camss: Add optional bus-type property Since CSIPHY IP on modern Qualcomm SoCs supports D-PHY and C-PHY interfaces, it might be necessary to specify it explicitly for some particular devices. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 0e7691fb51720b602c8bc16dd03c66d5b9fd4dc1 Author: Vladimir Zapolskiy Date: Fri May 2 23:41:40 2025 +0300 dt-bindings: media: qcom,x1e80100-camss: Tighten the property regex pattern There are 4 CSIPHY ports on X1E80100, it'd be preferred to tinker a too loose the regexp, which covers all these port names. Signed-off-by: Vladimir Zapolskiy Acked-by: Bryan O'Donoghue Reviewed-by: Krzysztof Kozlowski Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit f6940b79fcb6e9bae200cb24452b2880b9d1d7dd Author: Akhil P Oommen Date: Wed Jun 11 11:13:44 2025 +0530 media: iris: Fix opp scaling of power domains Pass PD_FLAG_REQUIRED_OPP flag to allow opp framework to scale the rpmpd power domains. Signed-off-by: Akhil P Oommen Reviewed-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 478c4478610d307b710e69b858243bcd78f522de Author: Dikshita Agarwal Date: Fri May 9 14:09:12 2025 +0530 media: iris: Add codec specific check for VP9 decoder drain handling Add a codec specific for the VP9 decoder to ensure that a non-null buffer is sent to the firmware during drain. The firmware enforces a check for VP9 decoder that the number of buffers queued and dequeued on the output plane should match. When a null buffer is sent, the firmware does not return a response for it, leading to a count mismatch and an assertion failure from the firmware. Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit e1f5d32608ec3c04e41c2c467b99c9a4a3f42d5b Author: Dikshita Agarwal Date: Fri May 9 14:09:11 2025 +0530 media: iris: Add internal buffer calculation for HEVC and VP9 decoders Add internal buffer count and size calculations for HEVC and VP9 decoders. Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil [hverkuil: add __maybe_unused to size_mp2d_lb_fe_top_data] commit 820ac7fe2796958cb3c398c050fb213d290afd19 Author: Dikshita Agarwal Date: Fri May 9 14:09:10 2025 +0530 media: iris: Set mandatory properties for HEVC and VP9 decoders. Subscribe and set mandatory properties to the firmware for HEVC and VP9 decoders. Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit f44ef2d4058bdde343431f05a7cbcb9982c4b8f6 Author: Dikshita Agarwal Date: Fri May 9 14:09:09 2025 +0530 media: iris: Add platform capabilities for HEVC and VP9 decoders Add platform capabilities for HEVC and VP9 codecs in decoder driver with related hooks. Reviewed-by: Bryan O'Donoghue Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit fde6161d91bb72791b515bae5741c17e4ab6f8e8 Author: Dikshita Agarwal Date: Fri May 9 14:09:08 2025 +0530 media: iris: Add HEVC and VP9 formats for decoder Extend the decoder driver's supported formats to include HEVC (H.265) and VP9. This change updates the format enumeration (VIDIOC_ENUM_FMT) and allows setting these formats via VIDIOC_S_FMT. Reviewed-by: Bryan O'Donoghue Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit c7501fa5fb85acd54e65c763b1796bf67701eb3c Author: Dikshita Agarwal Date: Fri May 9 14:09:07 2025 +0530 media: iris: Add a comment to explain usage of MBPS Add a comment to explain usage of MBPS and define a macro for 8K resolution for better readability Acked-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 0aebab4968efad155511a7d1584bb2ab74d8bc42 Author: Dikshita Agarwal Date: Fri May 9 14:09:06 2025 +0530 media: iris: Remove redundant buffer count check in stream off Currently, the stream off process checks the count of buffers in v4l2_m2m_queues using v4l2_m2m_for_each_src_buf_safe and v4l2_m2m_for_each_dst_buf_safe APIs. If the count is non-zero, it returns an error. This check is redundant as the V4L2 framework already handles buffer management internally. Remove the unnecessary buffer count check in stream off, simplifying the process and relying on V4L2's internal mechanisms for buffer management. Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit f15cb8652b4f49e7cd217f572b29aa64c21e8970 Author: Dikshita Agarwal Date: Fri May 9 14:09:05 2025 +0530 media: iris: Improve last flag handling Improve the handling of the V4L2_BUF_FLAG_LAST flag in the driver: - Ensure that the last flag is not sent multiple times. - Attach the last flag to the first capture buffer returned during flush, triggered by a sequence change, addressing cases where the firmware does not set the last flag. Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit ac72ad9deafa4b8e8cbb3ce27a95906b915f802f Author: Dikshita Agarwal Date: Fri May 9 14:09:04 2025 +0530 media: iris: Add handling for no show frames Firmware sends the picture type as NO_SHOW for frames which are not supposed to be displayed, add handling for the same in driver to drop them. Acked-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit b791dcfcba3a0c46fb3e2decab31d2340c5dc313 Author: Dikshita Agarwal Date: Fri May 9 14:09:03 2025 +0530 media: iris: Add handling for corrupt and drop frames Firmware attach DATACORRUPT/DROP buffer flags for the frames which needs to be dropped, handle it by setting VB2_BUF_STATE_ERROR for these buffers before calling buf_done. Reviewed-by: Bryan O'Donoghue Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit b7a898184e74a8261c34f1265139ac1799ee4e1c Author: Dikshita Agarwal Date: Fri May 9 14:09:02 2025 +0530 media: iris: Remove unnecessary re-initialization of flush completion Currently, The flush completion signal is being re-initialized even though no response is expected during a sequence change. Simplify the code by removing re-initialization of flush completion signal as it is redundant. Cc: stable@vger.kernel.org Fixes: 84e17adae3e3 ("media: iris: add support for dynamic resolution change") Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 1e27e9ffce59ac41cde71673d74eb368a533cdb2 Author: Dikshita Agarwal Date: Fri May 9 14:09:01 2025 +0530 media: iris: Skip flush on first sequence change Add a condition to skip the flush operation during the first sequence change event. At this point, the capture queue is not streaming, making the flush unnecessary. Cc: stable@vger.kernel.org Fixes: 84e17adae3e3 ("media: iris: add support for dynamic resolution change") Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 7adc11e6abf619d0bb0c05918d5da5b9d4bcb81e Author: Dikshita Agarwal Date: Fri May 9 14:09:00 2025 +0530 media: iris: Send V4L2_BUF_FLAG_ERROR for capture buffers with 0 filled length Firmware sends capture buffers with 0 filled length which are not to be displayed and should be dropped by client. To achieve the same, add V4L2_BUF_FLAG_ERROR to such buffers by making sure: - These 0 length buffers are not returned as result of flush. - Its not a buffer with LAST flag enabled which will also have 0 filled length. Cc: stable@vger.kernel.org Fixes: d09100763bed ("media: iris: add support for drain sequence") Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 91c6d55b477e1b66578c268214e915dff9f5ea57 Author: Dikshita Agarwal Date: Fri May 9 14:08:59 2025 +0530 media: iris: Fix buffer preparation failure during resolution change When the resolution changes, the driver internally updates the width and height, but the client continue to queue buffers with the older resolution until the last flag is received. This results in a mismatch when the buffers are prepared, causing failure due to outdated size. Introduce a check to prevent size validation during buffer preparation if a resolution reconfiguration is in progress, to handle this. Cc: stable@vger.kernel.org Fixes: 17f2a485ca67 ("media: iris: implement vb2 ops for buf_queue and firmware response") Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 9bf58db157139abcd60e425e5718c8e6a917f9dc Author: Dikshita Agarwal Date: Fri May 9 14:08:58 2025 +0530 media: iris: Track flush responses to prevent premature completion Currently, two types of flush commands are queued to the firmware, the first flush queued as part of sequence change, does not wait for a response, while the second flush queued as part of stop, expects a completion response before proceeding further. Due to timing issue, the flush response corresponding to the first command could arrive after the second flush is issued. This casuses the driver to incorrectly assume that the second flush has completed, leading to the premature signaling of flush_completion. To address this, introduce a counter to track the number of pending flush responses and signal flush completion only when all expected responses are received. Cc: stable@vger.kernel.org Fixes: 11712ce70f8e ("media: iris: implement vb2 streaming ops") Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 58edc8a68de7af45a4c815636595daa530f02c13 Author: Dikshita Agarwal Date: Fri May 9 14:08:57 2025 +0530 media: iris: Fix typo in depth variable Correct a typo from "dpeth" to "depth". Cc: stable@vger.kernel.org Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon") Acked-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 0f837559ccdd275c5a059e6ac4d5034b03409f1d Author: Dikshita Agarwal Date: Fri May 9 14:08:56 2025 +0530 media: iris: Fix NULL pointer dereference A warning reported by smatch indicated a possible null pointer dereference where one of the arguments to API "iris_hfi_gen2_handle_system_error" could sometimes be null. To fix this, add a check to validate that the argument passed is not null before accessing its members. Cc: stable@vger.kernel.org Fixes: fb583a214337 ("media: iris: introduce host firmware interface with necessary hooks") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-media/634cc9b8-f099-4b54-8556-d879fb2b5169@stanley.mountain/ Acked-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit c314a28cdabe45f050fe7bd403ddeaf4b9c960d1 Author: Dikshita Agarwal Date: Fri May 9 14:08:55 2025 +0530 media: iris: Fix missing function pointer initialization The function pointers responsible for setting firmware properties were never initialized in the instance capability structure, causing it to remain NULL. As a result, the firmware properties were not being set correctly. Fix this by properly assigning the function pointers from the core capability to the instance capability, ensuring that the properties are correctly applied to the firmware. Cc: stable@vger.kernel.org Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon") Acked-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit a693b4a3e7a95c010bedef4c8b3122bd8b0961b7 Author: Dikshita Agarwal Date: Fri May 9 14:08:54 2025 +0530 media: iris: Remove deprecated property setting to firmware HFI_PROPERTY_CONFIG_VDEC_POST_LOOP_DEBLOCKER is deprecated and no longer supported on current firmware, remove setting the same to firmware. Cc: stable@vger.kernel.org Fixes: 79865252acb6 ("media: iris: enable video driver probe of SM8250 SoC") Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 03e29ab0e94831fcca2f62c96121fd14263b399b Author: Dikshita Agarwal Date: Fri May 9 14:08:53 2025 +0530 media: iris: Remove error check for non-zero v4l2 controls Remove the check for non-zero number of v4l2 controls as some SOCs might not expose any capability which requires v4l2 control. Cc: stable@vger.kernel.org Fixes: 33be1dde17e3 ("media: iris: implement iris v4l2_ctrl_ops") Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 2781662dee7bbb9675e5440f5dff4e3991dc5624 Author: Dikshita Agarwal Date: Fri May 9 14:08:52 2025 +0530 media: iris: Prevent HFI queue writes when core is in deinit state The current check only considers the core error state before allowing writes to the HFI queues. However, the core can also transition to the deinit state due to a system error triggered by the response thread. In such cases, writing to the HFI queues should not be allowed. Fix this by adding a check for the core deinit state, ensuring that writes are rejected when core is not in a valid state. Cc: stable@vger.kernel.org Fixes: fb583a214337 ("media: iris: introduce host firmware interface with necessary hooks") Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit f3516f856d1f11d9dff7d72491d474a2bae1cf8e Author: Dikshita Agarwal Date: Fri May 9 14:08:51 2025 +0530 media: iris: Drop port check for session property response Currently, port check enforces that session property response must arrive only on the BITSTREAM port. However, firmware can send some responses on other port as well. Remove the strict port validation to correctly handle session property responses from the firmware. Cc: stable@vger.kernel.org Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon") Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit caf2055487694b6cb52f2ecb161c6c5de660dd72 Author: Dikshita Agarwal Date: Fri May 9 14:08:50 2025 +0530 media: iris: Avoid updating frame size to firmware during reconfig During reconfig, the firmware sends the resolution aligned to 8 bytes. If the driver sends the same resolution back to the firmware the resolution will be aligned to 16 bytes not 8. The alignment mismatch would then subsequently cause the firmware to send another redundant sequence change event. Fix this by not setting the resolution property during reconfig. Cc: stable@vger.kernel.org Fixes: 3a19d7b9e08b ("media: iris: implement set properties to firmware during streamon") Reviewed-by: Bryan O'Donoghue Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 8aadfd445373b74de4a5cd36736843ae01856636 Author: Dikshita Agarwal Date: Fri May 9 14:08:49 2025 +0530 media: iris: Update CAPTURE format info based on OUTPUT format Update the width, height and buffer size of CAPTURE based on the resolution set to OUTPUT via VIDIOC_S_FMT. This is required to set the updated capture resolution to firmware when S_FMT is called only for OUTPUT. Cc: stable@vger.kernel.org Fixes: b530b95de22c ("media: iris: implement s_fmt, g_fmt and try_fmt ioctls") Reviewed-by: Bryan O'Donoghue Acked-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit d2abb1ff5a3c13321d407ee19865d0d8d834c7c6 Author: Dikshita Agarwal Date: Fri May 9 14:08:48 2025 +0530 media: iris: Verify internal buffer release on close Validate all internal buffers queued to firmware are released back to driver on close. This helps ensure buffer lifecycle correctness and aids in debugging any resporce leaks. Cc: stable@vger.kernel.org Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 7c452ffda30c0460c568273993a3d3c611486467 Author: Dikshita Agarwal Date: Fri May 9 14:08:47 2025 +0530 media: iris: Skip destroying internal buffer if not dequeued Firmware might hold the DPB buffers for reference in case of sequence change, so skip destroying buffers for which QUEUED flag is not removed. Cc: stable@vger.kernel.org Fixes: 73702f45db81 ("media: iris: allocate, initialize and queue internal buffers") Reviewed-by: Vikash Garodia Tested-by: Neil Armstrong # on SM8550-QRD Tested-by: Neil Armstrong # on SM8550-HDK Tested-by: Neil Armstrong # on SM8650-QRD Tested-by: Neil Armstrong # on SM8650-HDK Signed-off-by: Dikshita Agarwal Tested-by: Vikash Garodia # on sa8775p-ride Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit ee3b94f22638e0f7a1893d95d87b08698b680052 Author: Konrad Dybcio Date: Sat May 31 14:22:00 2025 +0200 media: venus: Fix MSM8998 frequency table Fill in the correct data for the production SKU. Fixes: 193b3dac29a4 ("media: venus: add msm8998 support") Cc: stable@vger.kernel.org Signed-off-by: Konrad Dybcio Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Reviewed-by: Dmitry Baryshkov Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 640803003cd903cea73dc6a86bf6963e238e2b3f Author: Jorge Ramirez-Ortiz Date: Thu Jun 19 09:48:30 2025 +0200 media: venus: hfi: explicitly release IRQ during teardown Ensure the IRQ is disabled - and all pending handlers completed - before dismantling the interrupt routing and clearing related pointers. This prevents any possibility of the interrupt triggering after the handler context has been invalidated. Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Cc: stable@vger.kernel.org Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Dikshita Agarwal Tested-by: Dikshita Agarwal # RB5 Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 06d6770ff0d8cc8dfd392329a8cc03e2a83e7289 Author: Vedang Nagar Date: Mon May 19 12:42:22 2025 +0530 media: venus: Fix OOB read due to missing payload bound check Currently, The event_seq_changed() handler processes a variable number of properties sent by the firmware. The number of properties is indicated by the firmware and used to iterate over the payload. However, the payload size is not being validated against the actual message length. This can lead to out-of-bounds memory access if the firmware provides a property count that exceeds the data available in the payload. Such a condition can result in kernel crashes or potential information leaks if memory beyond the buffer is accessed. Fix this by properly validating the remaining size of the payload before each property access and updating bounds accordingly as properties are parsed. This ensures that property parsing is safely bounded within the received message buffer and protects against malformed or malicious firmware behavior. Fixes: 09c2845e8fe4 ("[media] media: venus: hfi: add Host Firmware Interface (HFI)") Cc: stable@vger.kernel.org Signed-off-by: Vedang Nagar Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Co-developed-by: Dikshita Agarwal Signed-off-by: Dikshita Agarwal Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 49befc830daa743e051a65468c05c2ff9e8580e6 Author: Vedang Nagar Date: Mon May 19 12:42:21 2025 +0530 media: venus: Add a check for packet size after reading from shared memory Add a check to ensure that the packet size does not exceed the number of available words after reading the packet header from shared memory. This ensures that the size provided by the firmware is safe to process and prevent potential out-of-bounds memory access. Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files") Cc: stable@vger.kernel.org Signed-off-by: Vedang Nagar Co-developed-by: Dikshita Agarwal Signed-off-by: Dikshita Agarwal Reviewed-by: Bryan O'Donoghue Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 3200144a2fa4209dc084a19941b9b203b43580f0 Author: Jorge Ramirez-Ortiz Date: Fri Jun 6 17:25:22 2025 +0200 media: venus: protect against spurious interrupts during probe Make sure the interrupt handler is initialized before the interrupt is registered. If the IRQ is registered before hfi_create(), it's possible that an interrupt fires before the handler setup is complete, leading to a NULL dereference. This error condition has been observed during system boot on Rb3Gen2. Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") Cc: stable@vger.kernel.org Signed-off-by: Jorge Ramirez-Ortiz Reviewed-by: Bryan O'Donoghue Reviewed-by: Vikash Garodia Reviewed-by: Dikshita Agarwal Tested-by: Dikshita Agarwal # RB5 Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit b179234b5e59013f8772da17b273f463f9720bdd Author: Renjiang Han Date: Thu Jun 12 07:53:51 2025 +0530 media: venus: pm_helpers: use opp-table for the frequency Some platforms (such as qcs615 and sc7180) use the same core but have different frequency tables. Using the opp-table allows us to separate the core description from the frequency data and supports the use of fallback compatibles. Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Signed-off-by: Renjiang Han Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit c056064a207c914c8e50d1a6312a5fa65dcbae5f Author: Ricardo Ribalda Date: Mon Jun 16 15:29:18 2025 +0000 media: venus: vdec: Make the range of us_per_frame explicit Fps bigger than 0.000232829 fps, this fits in a 32 bit us_per_frame. There is no need to do a 64 bit division here. Also, the driver only works with whole fps. Found by cocci: drivers/media/platform/qcom/venus/vdec.c:488:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead. Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Tested-by: Bryan O'Donoghue # qrb5615-rb5 Signed-off-by: Ricardo Ribalda Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 3a905e52c97ba79b7d9abf22005bab55c12eb620 Author: Ricardo Ribalda Date: Mon Jun 16 15:29:17 2025 +0000 media: venus: venc: Make the range of us_per_frame explicit Fps bigger than 0.000232829 fps, this fits in a 32 bit us_per_frame. There is no need to do a 64 bit division here. Also, the driver only works with whole fps. Found with cocci: drivers/media/platform/qcom/venus/venc.c:418:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead. Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Signed-off-by: Ricardo Ribalda Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 417c01b92ec278a1118a05c6ad8a796eaa0c9c52 Author: Ricardo Ribalda Date: Mon Jun 16 15:29:15 2025 +0000 media: venus: venc: Clamp param smaller than 1fps and bigger than 240 The driver uses "whole" fps in all its calculations (e.g. in load_per_instance()). Those calculation expect an fps bigger than 1, and not big enough to overflow. Clamp the param if the user provides a value that will result in an invalid fps. Reported-by: Hans Verkuil Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 Fixes: aaaa93eda64b ("[media] media: venus: venc: add video encoder files") Cc: stable@vger.kernel.org Signed-off-by: Ricardo Ribalda [bod: Change "parm" to "param"] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit 377dc500d253f0b26732b2cb062e89668aef890a Author: Ricardo Ribalda Date: Mon Jun 16 15:29:14 2025 +0000 media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. The driver uses "whole" fps in all its calculations (e.g. in load_per_instance()). Those calculation expect an fps bigger than 1, and not big enough to overflow. Clamp the value if the user provides a param that will result in an invalid fps. Reported-by: Hans Verkuil Closes: https://lore.kernel.org/linux-media/f11653a7-bc49-48cd-9cdb-1659147453e4@xs4all.nl/T/#m91cd962ac942834654f94c92206e2f85ff7d97f0 Fixes: 7472c1c69138 ("[media] media: venus: vdec: add video decoder files") Cc: stable@vger.kernel.org Tested-by: Bryan O'Donoghue # qrb5615-rb5 Reviewed-by: Bryan O'Donoghue Signed-off-by: Ricardo Ribalda [bod: Change "parm" to "param"] Signed-off-by: Bryan O'Donoghue Signed-off-by: Hans Verkuil commit cfbbf275ffcf05c82994b8787b0d1974aa1569d8 Author: Aaron Kling Date: Wed Jul 2 13:22:51 2025 -0500 gpio: palmas: Allow building as a module The driver works fine as a module, so allowing building as such. This adds an exit handler to support module unload. Signed-off-by: Aaron Kling Link: https://lore.kernel.org/r/20250702-gpio-palmas-gpio-v4-1-26ba48252f27@gmail.com Signed-off-by: Bartosz Golaszewski commit 93c05057873120e337dfc2138cb66efbc9e6b403 Merge: b033bc5a9a7d95 45ee66c37f9bd8 Author: Bartosz Golaszewski Date: Thu Jul 3 10:35:04 2025 +0200 Merge tag 'ib-mfd-gpio-input-pwm-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd into gpio/for-next Immutable branch between MFD, GPIO, Input and PWM due for the v6.17 merge window commit 8f5d9bed6122b8d96508436e5ad2498bb797eb6b Author: Greg Kroah-Hartman Date: Thu Jul 3 10:30:09 2025 +0200 Revert "vmci: Prevent the dispatching of uninitialized payloads" This reverts commit bfb4cf9fb97e4063f0aa62e9e398025fb6625031. While the code "looks" correct, the compiler has no way to know that doing "fun" pointer math like this really isn't a write off the end of the structure as there is no hint anywhere that the structure has data at the end of it. This causes the following build warning: In function 'fortify_memset_chk', inlined from 'ctx_fire_notification.isra' at drivers/misc/vmw_vmci/vmci_context.c:254:3: include/linux/fortify-string.h:480:25: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning] 480 | __write_overflow_field(p_size_field, size); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ So revert it for now and it can come back in the future in a "sane" way that either correctly makes the structure know that there is trailing data, OR just the payload structure is properly referenced and zeroed out. Fixes: bfb4cf9fb97e ("vmci: Prevent the dispatching of uninitialized payloads") Cc: Stephen Rothwell Cc: Lizhi Xu Link: https://lore.kernel.org/r/20250703171021.0aee1482@canb.auug.org.au Signed-off-by: Greg Kroah-Hartman commit d398a68e8bcf430e231cccfbaa27cb25a7a6f224 Merge: 5bc34be478d09c 7e611710acf966 Author: Peter Zijlstra Date: Thu Jul 3 10:24:39 2025 +0200 Merge tag 'rust-sched.2025.06.24' of git://git.kernel.org/pub/scm/linux/kernel/git/boqun/linux into sched/core Rust task & schedule changes for v6.17: - Make Task, CondVar and PollCondVar methods inline to avoid unnecessary function calls - Add might_sleep() support for Rust code: Rust's "#[track_caller]" mechanism is used so that Rust's might_sleep() doesn't need to be defined as a macro Signed-off-by: Peter Zijlstra # -----BEGIN PGP SIGNATURE----- # # iQEzBAABCAAdFiEEj5IosQTPz8XU1wRHSXnow7UH+rgFAmhbLOgACgkQSXnow7UH # +riscwf/e/+KmJTox5/JOqs6yxxQdCHMaGnMK62E5AII7NsiUI8+XB9z6efzCMmy # kS2W7aCmBZX67Y1B/xRL/ArHMBAJBi/CrCedZJcmzfB9aMa4Lj4mgiPkbUXkxE6Q # F5CDQK21ftu+0Q7Hhlq92ec17ZWodOvNxCFBBmjtQqUvBzj0dY45jcG7brs+N+1Z # t9UO3YokzukNqpIXTpG0HFP+XNafWWCgn9iIQ44lRxIaAoPI44uJjh1OXLTrZ1M9 # EMWYIrsY3b71Im78l6pzr+UOzJdJLI+QCBiz7ySLYz3kZ5dEfFdJOsumbc0G8A69 # VSGDFPEbJxZYuMxrH0E44XmxH4rJdA== # =gD/Y # -----END PGP SIGNATURE----- # gpg: Signature made Wed 25 Jun 2025 12:55:36 AM CEST # gpg: using RSA key 8F9228B104CFCFC5D4D704474979E8C3B507FAB8 # gpg: Can't check signature: No public key commit b9707d46a95962bb4e28ae1929015e419ad6aff7 Author: David E. Box Date: Wed Jul 2 19:28:30 2025 -0700 platform/x86/intel/pmt: KUNIT test for PMT Enhanced Discovery API Adds a KUNIT test for the intel_pmt_get_regions_by_feature() API. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-16-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 42dabe5442887946b16e64c6ebe91d2671a96fbb Author: David E. Box Date: Wed Jul 2 19:28:29 2025 -0700 platform/x86/intel/pmt/telemetry: Add API to retrieve telemetry regions by feature Introduce a new API, intel_pmt_get_regions_by_feature(), that gathers telemetry regions based on a provided capability flag. This API enables retrieval of regions with various capabilities (for example, RMID-based telemetry) and provides a unified interface for accessing them. Resource management is handled via reference counting using intel_pmt_put_feature_group(). Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-15-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 86fc85c75bcd9b0f28afadd60c9f890669b42ba4 Author: David E. Box Date: Wed Jul 2 19:28:28 2025 -0700 platform/x86/intel/pmt/discovery: Get telemetry attributes Add intel_pmt_get_features() in PMT Discovery to enable the PMT Telemetry driver to obtain attributes of the aggregated telemetry spaces it enumerates. The function gathers feature flags and associated data (like the number of RMIDs) from each PMT entry, laying the groundwork for a future kernel interface that will allow direct access to telemetry regions based on their capabilities. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-14-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c9699057521834862616ce159a47bd33920f0d9f Author: David E. Box Date: Wed Jul 2 19:28:27 2025 -0700 platform/x86/intel/tpmi: Get OOBMSM CPU mapping from TPMI Copy TPMI’s OOBMSM platform info into a common area within VSEC private data via intel_vsec_set_mapping(). This enables other Intel VSEC features to access the CPU mapping without additional queries. Additionally, designate the TPMI driver as a supplier for the Telemetry driver, ensuring it can obtain the necessary platform information for future feature extensions. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-13-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a885a2780937afac4f31f00d11663f50d05dfb35 Author: David E. Box Date: Wed Jul 2 19:28:26 2025 -0700 platform/x86/intel/vsec: Set OOBMSM to CPU mapping Add functions, intel_vsec_set/get_mapping(), to set and retrieve the OOBMSM-to-CPU mapping data in the private data of the parent Intel VSEC driver. With this mapping information available, other Intel VSEC features on the same OOBMSM device can easily access and use the mapping data, allowing each of the OOBMSM features to map to the CPUs they provides data for. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-12-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 934954df0f44de5e10afc1af84c06f78149f15fe Author: David E. Box Date: Wed Jul 2 19:28:25 2025 -0700 platform/x86/intel/tpmi: Relocate platform info to intel_vsec.h The TPMI platform information provides a mapping of OOBMSM PCI devices to logical CPUs. Since this mapping is consistent across all OOBMSM features (e.g., TPMI, PMT, SDSi), it can be leveraged by multiple drivers. To facilitate reuse, relocate the struct intel_tpmi_plat_info to intel_vsec.h, renaming it to struct oobmsm_plat_info, making it accessible to other features. While modifying headers, place them in alphabetical order. Signed-off-by: David E. Box Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250703022832.1302928-11-david.e.box@linux.intel.com Signed-off-by: Ilpo Järvinen commit 2e7ba52110ef15d29846b40eb28b400f1fb1834a Author: David E. Box Date: Wed Jul 2 19:28:24 2025 -0700 docs: Add ABI documentation for intel_pmt feature directories Add a new sysfs ABI documentation file describing the layout and content of the features-/ directory used by Intel PMT (Platform Monitoring Technology). This directory exposes telemetry and control feature details for a given PMT PCI device. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-10-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d9a0788093565c300f7c8dd034dbfa6ac4da9aa6 Author: David E. Box Date: Wed Jul 2 19:28:23 2025 -0700 platform/x86/intel/pmt: Add PMT Discovery driver This patch introduces a new driver to enumerate and expose Intel Platform Monitoring Technology (PMT) capabilities via a simple discovery mechanism. The PMT Discovery driver parses hardware-provided discovery tables from Intel Out of Band Management Services Modules (OOBMSM) and extracts feature information for various providers (such as TPMI, Telemetry, Crash Log, etc). This unified interface simplifies the process of determining which manageability and telemetry features are supported by a given platform. This new feature is described in the Intel Platform Monitoring Technology 3.0 specification, section 6.6 Capability. Key changes and additions: New file drivers/platform/x86/intel/pmt/discovery.c: – Implements the discovery logic to map the discovery resource, read the feature discovery table, and validate feature parameters. New file drivers/platform/x86/intel/pmt/features.c: – Defines feature names, layouts, and associated capability masks. – Provides a mapping between raw hardware attributes and sysfs representations for easier integration with user-space tools. New header include/linux/intel_pmt_features.h: – Declares constants, masks, and feature identifiers used across the PMT framework. Sysfs integration: – Feature attributes are exposed under /sys/class/intel_pmt. – Each device is represented by a subfolder within the intel_pmt class, named using its DBDF (Domain:Bus:Device.Function), e.g.: features-0000:00:03.1 – Example directory layout for a device: /sys/class/intel_pmt/features-0000:00:03.1/ ├── accelerator_telemetry ├── crash_log ├── per_core_environment_telemetry ├── per_core_performance_telemetry ├── per_rmid_energy_telemetry ├── per_rmid_perf_telemetry ├── tpmi_control ├── tracing └── uncore_telemetry By exposing PMT feature details through sysfs and integrating with the existing PMT class, this driver paves the way for more streamlined integration of PMT-based manageability and telemetry tools. Link: https://www.intel.com/content/www/us/en/content-details/710389/intel-platform-monitoring-technology-intel-pmt-external-specification.html Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-9-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 10f32796e86c04f73b7f8580cc9483765ed19f49 Author: David E. Box Date: Wed Jul 2 19:28:22 2025 -0700 platform/x86/intel/vsec: Add new Discovery feature Add the PCIe VSEC ID for new Intel Platform Monitoring Technology Capability Discovery feature. Discovery provides detailed information for the various Intel VSEC features. Also make the driver a supplier for TPMI and Telemetry drivers which will use the information. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-8-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e4436e98672c7993cdfd7743efd0fcaa8df7cc17 Author: David E. Box Date: Wed Jul 2 19:28:21 2025 -0700 platform/x86/intel/vsec: Skip driverless features If a feature lacks a corresponding driver and that feature is also a supplier, registering it would be prevent the consumer driver from probing. Introduces logic to skip such features during device registration. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-7-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 1f3855ea7d6b03f68c2eec7a0bcd537cedcc6680 Author: David E. Box Date: Wed Jul 2 19:28:20 2025 -0700 platform/x86/intel/vsec: Skip absent features during initialization Some VSEC features depend on the presence of supplier features that may not always be present. To prevent unnecessary retries and device linking during initialization, introduce logic to skip attempts to link consumers to missing suppliers. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-6-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 8a67d4b49bbdebcd255abde9e652092c3de3b657 Author: David E. Box Date: Wed Jul 2 19:28:19 2025 -0700 platform/x86/intel/vsec: Add device links to enforce dependencies New Intel VSEC features will have dependencies on other features, requiring certain supplier drivers to be probed before their consumers. To enforce this dependency ordering, introduce device links using device_link_add(), ensuring that suppliers are fully registered before consumers are probed. - Add device link tracking by storing supplier devices and tracking their state. - Implement intel_vsec_link_devices() to establish links between suppliers and consumers based on feature dependencies. - Add get_consumer_dependencies() to retrieve supplier-consumer relationships. - Modify feature registration logic: * Consumers now check that all required suppliers are registered before being initialized. * suppliers_ready() verifies that all required supplier devices are available. - Prevent potential null consumer name issue in sysfs: - Use dev_set_name() when creating auxiliary devices to ensure a unique, non-null consumer name. - Update intel_vsec_pci_probe() to loop up to the number of possible features or when all devices are registered, whichever comes first. - Introduce VSEC_CAP_UNUSED to prevent sub-features (registered via exported APIs) from being mistakenly linked. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-5-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b0631f8a5740c55b52d02174cc4c9c84cc7a16a1 Author: David E. Box Date: Wed Jul 2 19:28:18 2025 -0700 platform/x86/intel/vsec: Create wrapper to walk PCI config space Combine three PCI config space walkers — intel_vsec_walk_dvsec(), intel_vsec_walk_vsec(), and intel_vsec_walk_header() — into a new wrapper function, intel_vsec_feature_walk(). This refactoring simplifies the probe logic and lays the groundwork for future patches that will loop over these calls. No functional changes. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-4-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dc957ab6aa05c118c3da0542428a4d6602aa2d2d Author: David E. Box Date: Wed Jul 2 19:28:17 2025 -0700 platform/x86/intel/vsec: Add private data for per-device data Introduce a new private structure, struct vsec_priv, to hold a pointer to the platform-specific information. Although the driver didn’t previously require this per-device data, adding it now lays the groundwork for upcoming patches that will manage such data. No functional changes. Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-3-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit fb1311b3f171bbb3c07cc7764ec981605564c83a Author: David E. Box Date: Wed Jul 2 19:28:16 2025 -0700 MAINTAINERS: Add link to documentation of Intel PMT ABI Add a link to the documentation for the Intel Platform Monitoring Technology ABI in Documentation/ABI/testing/sysfs-class-intel_pmt Signed-off-by: David E. Box Link: https://lore.kernel.org/r/20250703022832.1302928-2-david.e.box@linux.intel.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit edc4b183b794baefb54aa0baeb810fe3ac65d826 Author: Derek J. Clark Date: Tue Jul 1 20:38:26 2025 -0700 platform/x86: Add Lenovo Other Mode WMI Driver Adds lenovo-wmi-other driver which provides the Lenovo "Other Mode" WMI interface that comes on some Lenovo "Gaming Series" hardware. Provides a firmware-attributes class which enables the use of tunable knobs for SPL, SPPT, and FPPT. Reviewed-by: Alok Tiwari Reviewed-by: Armin Wolf Signed-off-by: Derek J. Clark Link: https://lore.kernel.org/r/20250702033826.1057762-7-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 22024ac5366f065a7b931bee5b62e2588521c4f0 Author: Derek J. Clark Date: Tue Jul 1 20:38:25 2025 -0700 platform/x86: Add Lenovo Gamezone WMI Driver Adds lenovo-wmi-gamezone driver which provides the Lenovo Gamezone WMI interface that comes on Lenovo "Gaming Series" hardware. Provides ACPI platform profiles over WMI. Reviewed-by: Armin Wolf Signed-off-by: Derek J. Clark Link: https://lore.kernel.org/r/20250702033826.1057762-6-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e1a5fe662b593108d14cd0481019601698f9fbe8 Author: Derek J. Clark Date: Tue Jul 1 20:38:24 2025 -0700 platform/x86: Add Lenovo Capability Data 01 WMI Driver Adds lenovo-wmi-capdata01 driver which provides the LENOVO_CAPABILITY_DATA_01 WMI data block that comes on "Other Mode" enabled hardware. Provides an interface for querying if a given attribute is supported by the hardware, as well as its default_value, max_value, min_value, and step increment. Reviewed-by: Alok Tiwari Reviewed-by: Armin Wolf Signed-off-by: Derek J. Clark Link: https://lore.kernel.org/r/20250702033826.1057762-5-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 949bf144bdc72e87018197ae71aa4959f17885d5 Author: Derek J. Clark Date: Tue Jul 1 20:38:23 2025 -0700 platform/x86: Add Lenovo WMI Events Driver Adds lenovo-wmi-events driver. The events driver is designed as a general entrypoint for all Lenovo WMI Events. It acts as a notification chain head that will process event data and pass it on to registered drivers so they can react to the events. Currently only the Gamezone interface Thermal Mode Event GUID is implemented in this driver. It is documented in the Gamezone documentation. Suggested-by: Armin Wolf Reviewed-by: Alok Tiwari Reviewed-by: Armin Wolf Reviewed-by: Mario Limonciello Signed-off-by: Derek J. Clark Link: https://lore.kernel.org/r/20250702033826.1057762-4-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit e521d16e76cd9ea99c585e064f4e7daf657b1451 Author: Derek J. Clark Date: Tue Jul 1 20:38:22 2025 -0700 platform/x86: Add lenovo-wmi-helpers Adds lenovo-wmi-helpers, which provides a common wrapper function for wmidev_evaluate_method that does data validation and error handling. Reviewed-by: Alok Tiwari Reviewed-by: Armin Wolf Reviewed-by: Mario Limonciello Signed-off-by: Derek J. Clark Link: https://lore.kernel.org/r/20250702033826.1057762-3-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 57139e126a30ce64f111c78b1b9e37b39a2b7424 Author: Derek J. Clark Date: Tue Jul 1 20:38:21 2025 -0700 platform/x86: Add lenovo-wmi-* driver Documentation Adds documentation for new lenovo-wmi drivers. Reviewed-by: Alok Tiwari Reviewed-by: Armin Wolf Reviewed-by: Mario Limonciello Signed-off-by: Derek J. Clark Link: https://lore.kernel.org/r/20250702033826.1057762-2-derekjohn.clark@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 230cdd8a5f4bc7ebe8cadb6f532911544af6fb3c Author: Aditya Garg Date: Mon Jun 30 12:37:14 2025 +0000 HID: magicmouse: use secs_to_jiffies() for battery timeout The kernel now has a secs_to_jiffies() function which expands to a simpler code than msecs_to_jiffies(). Use the same for battery timeout which was using 60000 milliseconds (60 seconds). Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 6907c976fff38710406fa148cd82e892e7292d56 Author: Aditya Garg Date: Mon Jun 30 12:37:14 2025 +0000 HID: apple: use secs_to_jiffies() for battery timeout The kernel now has a secs_to_jiffies() function which expands to a simpler code than msecs_to_jiffies(). Use the same for battery timeout which was using 60000 milliseconds (60 seconds). Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 9bdc30e35cbc1aa78ccf01040354209f1e11ca22 Author: Aditya Garg Date: Mon Jun 30 12:37:13 2025 +0000 HID: magicmouse: avoid setting up battery timer when not needed Currently, the battery timer is set up for all devices using hid-magicmouse, irrespective of whether they actually need it or not. The current implementation requires the battery timer for Magic Mouse 2 and Magic Trackpad 2 when connected via USB only. Add checks to ensure that the battery timer is only set up when they are connected via USB. Fixes: 0b91b4e4dae6 ("HID: magicmouse: Report battery level over USB") Cc: stable@vger.kernel.org Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit c061046fe9ce3ff31fb9a807144a2630ad349c17 Author: Aditya Garg Date: Mon Jun 30 12:37:13 2025 +0000 HID: apple: avoid setting up battery timer for devices without battery Currently, the battery timer is set up for all devices using hid-apple, irrespective of whether they actually have a battery or not. APPLE_RDESC_BATTERY is a quirk that indicates the device has a battery and needs the battery timer. This patch checks for this quirk before setting up the timer, ensuring that only devices with a battery will have the timer set up. Fixes: 6e143293e17a ("HID: apple: Report Magic Keyboard battery over USB") Cc: stable@vger.kernel.org Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 3a807f3ff9eaaeead81576c5a72d226d519a2fe7 Author: Basavaraj Natikar Date: Mon Jun 23 14:24:53 2025 +0530 HID: amd_sfh: Enable operating mode Add changes to enable operating modes in the driver to allow the FW to activate and retrieve data from relevant sensors. This enables the FW to take necessary actions based on the operating modes. Tested-by: Eric Naim Co-developed-by: Akshata MukundShetty Signed-off-by: Akshata MukundShetty Signed-off-by: Basavaraj Natikar Reviewed-by: Mario Limonciello Signed-off-by: Jiri Kosina commit 9671854582f971c84507728d4a00aa779e5a0811 Author: Joshua Goins Date: Sun Jun 22 22:42:54 2025 -0400 HID: uclogic: Add support for XP-PEN Artist 22R Pro Adds support for the XP-PEN Artist 22R Pro, including stylus, tablet frame and pen pressure. The tablet has 20 buttons, but need to be remapped in order since the device reports invalid keycodes. Existing tablet functionality should not be inhibited, as BTN0-8 is still used. New initialization functions are added since the device differs slightly from other UGEE v2 devices. Signed-off-by: Joshua Goins Signed-off-by: Jiri Kosina commit 88193ae66b042925aee3ee7ffeeeaddb70131e7f Author: Daniel Scally Date: Wed Jun 25 10:20:32 2025 +0100 media: platform: rzg2l-cru: Add support for RAW10/12/14 data Add support to the rzg2l-cru driver to capture 10/12/14 bit bayer data and output it into the CRU's 64-bit packed pixel format. Reviewed-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Reviewed-by: Lad Prabhakar Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20250625-rzg2l-cru-v6-6-a9099ed26c14@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 907122f552089da25fe8f3d072d1222bd99dec9b Author: Daniel Scally Date: Mon Jun 30 16:06:51 2025 +0100 media: rzg2l-cru: Support multiple mbus codes per pixel format As a preliminary step for supporting the CRU pixel formats, extend the driver such that multiple media bus codes can support each of the output pixel formats. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20250630150651.2698237-1-dan.scally@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit ace92ccef0c9bee4fad192b151c1aed9eef7f7c9 Author: Daniel Scally Date: Wed Jun 25 10:20:30 2025 +0100 media: platform: rzg2l-cru: Use v4l2_fill_pixfmt() Rather than open-code a calculation of the format's bytesperline and sizeimage, use the v4l2_fill_pixfmt() helper. This makes it easier to support the CRU packed pixel formats without over complicating the driver. This change makes the .bpp member of struct rzg2l_cru_ip_format superfluous - remove them. Reviewed-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Reviewed-by: Lad Prabhakar Tested-by: Lad Prabhakar Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20250625-rzg2l-cru-v6-4-a9099ed26c14@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit ac261abe73e3db462340645a84291ec384df7191 Author: Daniel Scally Date: Wed Jun 25 10:20:29 2025 +0100 media: platform: rzg2l-cru: Use v4l2_get_link_freq() The rzg2l_csi2_calc_mbps() function currently tries to calculate the link frequency for a CSI2 bus using the V4L2_CID_PIXEL_RATE control of the remote subdevice. Switch the function to v4l2_get_link_freq() which correctly targets V4L2_CID_LINK_FREQ before falling back on V4L2_CID_PIXEL_RATE if the former is unavailable. Reviewed-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Reviewed-by: Lad Prabhakar Tested-by: Lad Prabhakar Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20250625-rzg2l-cru-v6-3-a9099ed26c14@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit d225bdb6ede7595cddead722503aa9ec7b0a646d Author: Daniel Scally Date: Wed Jun 25 10:20:28 2025 +0100 media: rzg2l-cru: Add vidioc_enum_framesizes() Add a callback to implement the VIDIOC_ENUM_FRAMESIZES ioctl for the CRU driver. Reviewed-by: Laurent Pinchart Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20250625-rzg2l-cru-v6-2-a9099ed26c14@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 78584431e2cea6b60909cfa23c90ac8b33ab4198 Author: Daniel Scally Date: Mon Jun 30 23:27:34 2025 +0100 media: v4l2: Add Renesas Camera Receiver Unit pixel formats The Renesas Camera Receiver Unit in the RZ/V2H SoC can output RAW data captured from an image sensor without conversion to an RGB/YUV format. In that case the data are packed into 64-bit blocks, with a variable amount of padding in the most significant bits depending on the bitdepth of the data. Add new V4L2 pixel format codes for the new formats, along with documentation to describe them. Reviewed-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Signed-off-by: Daniel Scally Link: https://lore.kernel.org/r/20250630222734.2712390-1-dan.scally@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit f57e365573757ea2752d0c17cb58cdfdd61a43e6 Author: Jacopo Mondi Date: Wed Jun 18 17:42:47 2025 +0200 media: vsp1: Add missing export.h As reported by the Kernel Test Robot, the newly merged vspx driver exports a few symbols but doesn't include the export.h header. While at it, include the header file in vsp1_drm.c which exports symbols as well. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506181950.r9PRdV59-lkp@intel.com/ Signed-off-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250618-vspx-include-export-v1-1-95a2da4ec465@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 9f0fb0309485e96d5b45e71e901cd994be4d63dc Author: Laurent Pinchart Date: Mon Jun 16 16:46:38 2025 +0300 media: vsp1: Use lockdep assertions to enforce documented conventions A few functions have documented locking conventions. Documentation is nice, but runtime checks are better. Enforce the conventions with lockdep assertions. Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Reviewed-by: Kieran Bingham Signed-off-by: Hans Verkuil commit e5dd01ea96107ff5fc3f13b333302292ea2e627f Author: Lad Prabhakar Date: Tue Apr 29 10:16:09 2025 +0100 media: renesas: rzg2l-cru: Fix typo in rzg3e_fifo_empty name Correct the misnamed FIFO-empty helper for the RZ/G3E CRU. Rename `rz3e_fifo_empty` to `rzg3e_fifo_empty` to match the intended naming convention. Reported-by: Biju Das Closes: https://lore.kernel.org/all/TY3PR01MB11346E57A3DF8D8A90A405E4686812@TY3PR01MB11346.jpnprd01.prod.outlook.com/ Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Reviewed-by: Tommaso Merciai Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250429091609.9947-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 8b7b5e1bfb72c52dd2cfd82cc14dc4e66c6b94a9 Author: Lad Prabhakar Date: Tue Apr 29 10:16:08 2025 +0100 media: renesas: rzg2l-cru: Simplify FIFO empty check Collapse FIFO empty helper into a single return statement by removing the redundant `if (amnfifopntr_w == amnfifopntr_r_y) return true;` path. Make `rzg2l_fifo_empty()` directly return `amnfifopntr_w == amnfifopntr_r_y` to improve readability without changing behavior. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/aAtQThCibZCROETx@stanley.mountain/ Signed-off-by: Lad Prabhakar Reviewed-by: Laurent Pinchart Reviewed-by: Geert Uytterhoeven Reviewed-by: Tommaso Merciai Tested-by: Tommaso Merciai Link: https://lore.kernel.org/r/20250429091609.9947-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 095e5d400cbf7df3f84fbdca08bfe9abb5a4f3ee Author: Tommaso Merciai Date: Mon May 26 09:52:33 2025 +0200 media: rzg2l-cru: Fix typo in rzg2l_cru_of_id_table struct Correct the misnamed .data member for the RZ/G2L CRU. Rename `rzgl2_cru_info` to `rzg2l_cru_info` to match the intended naming convention. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250526075236.13489-1-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit aa89281bbc0b61610c96074c6390aed44474ebd0 Author: Jacopo Mondi Date: Thu Jun 12 16:58:21 2025 +0200 media: pisp_be: Use clamp() and define max sizes Use the clamp() function from minmax.h and provide a define for the max sizes as they will be used in subsequent patches. Reviewed-by: Daniel Scally Reviewed-by: Stefan Klug Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit e9bb2eacc7222ff8210903eb3b7d56709cc53228 Author: Jacopo Mondi Date: Mon Aug 26 15:30:54 2024 +0200 media: pisp_be: Fix pm_runtime underrun in probe During the probe() routine, the PiSP BE driver needs to power up the interface in order to identify and initialize the hardware. The driver resumes the interface by calling the pispbe_runtime_resume() function directly, without going through the pm_runtime helpers, but later suspends it by calling pm_runtime_put_autosuspend(). This causes a PM usage count imbalance at probe time, notified by the runtime_pm framework with the below message in the system log: pispbe 1000880000.pisp_be: Runtime PM usage count underflow! Fix this by resuming the interface using the pm runtime helpers instead of calling the resume function directly and use the pm_runtime framework in the probe() error path. While at it, remove manual suspend of the interface in the remove() function. The driver cannot be unloaded if in use, so simply disable runtime pm. To simplify the implementation, make the driver depend on PM as the RPI5 platform where the ISP is integrated in uses the PM framework by default. Fixes: 12187bd5d4f8 ("media: raspberrypi: Add support for PiSP BE") Cc: stable@vger.kernel.org Tested-by: Naushir Patuck Reviewed-by: Naushir Patuck Reviewed-by: Laurent Pinchart Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 972eed08261fb1048afea8e8f7db05b5531eed66 Author: Jacopo Mondi Date: Mon Aug 5 16:55:35 2024 +0200 media: pisp_be: Split jobs creation and scheduling Currently the 'pispbe_schedule()' function does two things: 1) Tries to assemble a job by inspecting all the video node queues to make sure all the required buffers are available 2) Submit the job to the hardware The pispbe_schedule() function is called at: - video device start_streaming() time - video device qbuf() time - irq handler As assembling a job requires inspecting all queues, it is a rather time consuming operation which is better not run in IRQ context. To avoid executing the time consuming job creation in interrupt context split the job creation and job scheduling in two distinct operations. When a well-formed job is created, append it to the newly introduced 'pispbe->job_queue' where it will be dequeued from by the scheduling routine. As the per-node 'ready_queue' buffer list is only accessed in vb2 ops callbacks, protected by the node->queue_lock mutex, it is not necessary to guard it with a dedicated spinlock so drop it. Also use the spin_lock_irq() variant in all functions not called from an IRQ context where the spin_lock_irqsave() version was used. Reviewed-by: Naushir Patuck Reviewed-by: Laurent Pinchart Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit a773b6141610e625abedaff29ac674a75c77a609 Author: Jacopo Mondi Date: Mon Aug 26 12:29:50 2024 +0200 media: pisp_be: Remove config validation from schedule() The config parameters buffer is already validated in pisp_be_validate_config() at .buf_prepare() time. However some of the same validations are also performed at pispbe_schedule() time. In particular the function checks that: 1) config.num_tiles is valid 2) At least one of the BAYER or RGB input is enabled The input config validation is already performed in pisp_be_validate_config() and while job.hw_enables is modified by pispbe_xlate_addrs(), the function only resets the input masks if - there is no input buffer available, but pispbe_prepare_job() fails before calling pispbe_xlate_addrs() in this case - bayer_enable is 0, but in this case rgb_enable is valid as guaranteed by pisp_be_validate_config() - only outputs are reset in rgb_enable For this reasons there is no need to repeat the check at pispbe_schedule() time. The num_tiles validation can be moved to pisp_be_validate_config() as well. As num_tiles is a u32 it can'be be < 0, so change the sanity check accordingly. Reviewed-by: Laurent Pinchart Reviewed-by: Naushir Patuck Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 3ae896614000902090fa42489a34fa54b720012d Author: Jacopo Mondi Date: Mon Aug 26 12:24:04 2024 +0200 media: pisp_be: Drop reference to non-existing function A comment in the pisp_be driver references the pispbe_schedule_internal() function which doesn't exist. Drop it. Reviewed-by: Laurent Pinchart Reviewed-by: Naushir Patuck Signed-off-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit cf80c02a9fdb6c5bc8508beb6a0f6a1294fc32f6 Author: Dan Carpenter Date: Tue Jul 1 13:08:42 2025 -0500 wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start() Preserve the error code if iwl_setup_deferred_work() fails. The current code returns ERR_PTR(0) (which is NULL) on this path. I believe the missing error code potentially leads to a use after free involving debugfs. Fixes: 90a0d9f33996 ("iwlwifi: Add missing check for alloc_ordered_workqueue") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/a7a1cd2c-ce01-461a-9afd-dbe535f8df01@sabinyo.mountain Signed-off-by: Miri Korenblit commit 350db61fbeb940502a16e74153ee5954d03622e9 Author: Al Viro Date: Sun Mar 23 00:51:10 2025 -0400 rpc_create_client_dir(): return 0 or -E... Callers couldn't care less which dentry did we get - anything valid is treated as success. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 3ee735ef5a034616c3a60401ee31182eefcc3e4a Author: Al Viro Date: Thu Mar 6 23:46:50 2025 -0500 rpc_create_client_dir(): don't bother with rpc_populate() not for a single file... Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit db83fa912ef26f1ce3f4aa55a09fd7ce94730a4d Author: Al Viro Date: Tue Feb 20 23:38:36 2024 -0500 rpc_new_dir(): the last argument is always NULL All callers except the one in rpc_populate() pass explicit NULL there; rpc_populate() passes its last argument ('private') instead, but in the only call of rpc_populate() that creates any subdirectories (when creating fixed subdirectories of root) private itself is NULL. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 805060a69c3e5961c55dc5e53bcdcec323a2aa4c Author: Al Viro Date: Tue Feb 20 22:23:09 2024 -0500 rpc_pipe: expand the calls of rpc_mkdir_populate() ... and get rid of convoluted callbacks. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 065e88fa33fad17059541e3ad3f05e4097650773 Author: Al Viro Date: Sat Mar 22 20:26:21 2025 -0400 rpc_gssd_dummy_populate(): don't bother with rpc_populate() Just have it create gssd (in root), clntXX in gssd, then info and gssd in clntXX - all with explicit rpc_new_dir()/rpc_new_file()/rpc_mkpipe_dentry(). Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit a117bf4caab2877c5ca050c005a1a7ca49a801f4 Author: Al Viro Date: Sat Mar 22 20:23:12 2025 -0400 rpc_mkpipe_dentry(): switch to simple_start_creating() ... and make sure we set the fs-private part of inode up before attaching it to dentry. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 5c1da75895c037822546c24a10fa45d4bef6fb79 Author: Al Viro Date: Sat Mar 22 20:10:44 2025 -0400 rpc_pipe: saner primitive for creating regular files rpc_new_file(); similar to rpc_new_dir(), except that here we pass file_operations as well. Callers don't care about dentry, just return 0 or -E... Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit fc1abdca51ed7ddfe3fa8090a5b1f9ef9a792a22 Author: Al Viro Date: Sat Mar 22 19:50:20 2025 -0400 rpc_pipe: saner primitive for creating subdirectories All users of __rpc_mkdir() have the same form - start_creating(), followed, in case of success, by __rpc_mkdir() and unlocking parent. Combine that into a single helper, expanding __rpc_mkdir() into it, along with the call of __rpc_create_common() in it. Don't mess with d_drop() + d_add() - just d_instantiate() and be done with that. The reason __rpc_create_common() goes for that dance is that dentry it gets might or might not be hashed; here we know it's hashed. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 41a6b9e52b21544c334830bfe68fb78d6677caa0 Author: Al Viro Date: Sat Mar 22 19:39:40 2025 -0400 rpc_pipe: don't overdo directory locking Don't try to hold directories locked more than VFS requires; lock just before getting a child to be made positive (using simple_start_creating()) and unlock as soon as the child is created. There's no benefit in keeping the parent locked while populating the child - it won't stop dcache lookups anyway. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 19a6314a997f6adde0c100ecf9224d1ab43c9603 Author: Al Viro Date: Tue Feb 20 02:41:59 2024 -0500 rpc_mkpipe_dentry(): saner calling conventions Instead of returning a dentry or ERR_PTR(-E...), return 0 and store dentry into pipe->dentry on success and return -E... on failure. Callers are happier that way... NOTE: dummy rpc_pipe is getting ->dentry set; we never access that, since we 1) never call rpc_unlink() for it (dentry is taken out by ->kill_sb()) 2) never call rpc_queue_upcall() for it (writing to that sucker fails; no downcalls are ever submitted, so no replies are going to arrive) IOW, having that ->dentry set (and left dangling) is harmless, if ugly; cleaner solution will take more massage. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit bccea4ed060f1f6476ac7a0649ffa73f77d6e94c Author: Al Viro Date: Tue Feb 20 00:24:19 2024 -0500 rpc_unlink(): saner calling conventions 1) pass it pipe instead of pipe->dentry 2) zero pipe->dentry afterwards 3) it always returns 0; why bother? Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 8be22c49646e47452e74aa0b97ea50fb04c271ed Author: Al Viro Date: Mon Feb 19 23:32:22 2024 -0500 rpc_populate(): lift cleanup into callers rpc_populate() is called either from fill_super (where we don't need to remove any files on failure - rpc_kill_sb() will take them all out anyway) or from rpc_mkdir_populate(), where we need to remove the directory we'd been trying to populate along with whatever we'd put into it before we failed. Simpler to combine that into simple_recursive_removal() there. Note that rpc_pipe is overlocking directories quite a bit - locked parent is no obstacle to finding a child in dcache, so keeping it locked won't prevent userland observing a partially built subtree. All we need is to follow minimal VFS requirements; it's not as if clients used directory locking for exclusion - tree changes are serialized, but that's done on ->pipefs_sb_lock. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 3829b30e771bbfff62fbe7eff555e7a6e0d4b5cd Author: Al Viro Date: Mon Feb 19 23:24:41 2024 -0500 rpc_unlink(): use simple_recursive_removal() note that the callback of simple_recursive_removal() is called with the parent locked; the victim isn't locked by the caller. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 8e7490c40eff4fa36eac40f015c407caf5a1cc77 Author: Al Viro Date: Wed May 8 21:29:34 2024 -0400 rpc_{rmdir_,}depopulate(): use simple_recursive_removal() instead no need to give an exact list of objects to be remove when it's simply every child of the victim directory. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 4b2f61af8a8f1e0f54d6105e887f8da5ad1d3ddc Author: Al Viro Date: Mon Feb 19 23:09:20 2024 -0500 rpc_pipe: clean failure exits in fill_super ->kill_sb() will be called immediately after a failure return anyway, so we don't need to bother with notifier chain and rpc_gssd_dummy_depopulate(). What's more, rpc_gssd_dummy_populate() failure exits do not need to bother with __rpc_depopulate() - anything added to the tree will be taken out by ->kill_sb(). Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit 59200f45267481582f4e42334a510f01d0b89449 Author: Al Viro Date: Sat Mar 22 21:06:11 2025 -0400 new helper: simple_start_creating() Set the things up for kernel-initiated creation of object in a tree-in-dcache filesystem. With respect to locking it's an equivalent of filename_create() - we either get a negative dentry with locked parent, or ERR_PTR() and no locks taken. tracefs and debugfs had that open-coded as part of their object creation machinery; switched to calling new helper. Reviewed-by: Jeff Layton Signed-off-by: Al Viro commit bad356bb50e64170f8af14a00797a04313846aeb Author: Al Viro Date: Mon Mar 10 00:45:20 2025 -0400 functionfs, gadgetfs: use simple_recursive_removal() usual mount leaks if something had been bound on top of disappearing files there. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 1664a91025f9a85c4592864a4001c28100a2fca5 Author: Al Viro Date: Wed May 8 23:15:55 2024 -0400 kill binderfs_remove_file() don't try to open-code simple_recursive_removal(), especially when you miss things like d_invalidate()... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit fcaac5b427686c9ba521c4e08a5f595fb89e669f Author: Al Viro Date: Mon Mar 10 00:39:02 2025 -0400 fuse_ctl: use simple_recursive_removal() easier that way - no need to keep that array of dentry references, etc. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 7b7a8ca43fcf027f8aabd7c0629c2d39bfd97300 Author: Al Viro Date: Mon Mar 10 00:34:08 2025 -0400 pstore: switch to locked_recursive_removal() rather than playing with manual d_invalidate() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit eacb58fdcaefac63d32c3c095152e97dc9425ea8 Author: Al Viro Date: Sat Mar 8 19:54:09 2025 -0500 binfmt_misc: switch to locked_recursive_removal() ... fixing a mount leak, strictly speaking. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 8c0e092e3875fe834ca37a2953c91cb42cc0ceeb Author: Al Viro Date: Thu May 9 16:36:24 2024 -0400 spufs: switch to locked_recursive_removal() ... and fix an old deadlock on spufs_mkdir() failures to populate subdirectory - spufs_rmdir() had always been taking lock on the victim, so doing it while the victim is locked is a bad idea. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 9fd45235fdd2c2615a03c86ebe5a88b050dc5680 Author: Al Viro Date: Thu May 9 16:32:51 2024 -0400 add locked_recursive_removal() simple_recursive_removal() assumes that parent is not locked and locks it when it finally gets to removing the victim itself. Usually that's what we want, but there are places where the parent is *already* locked and we need it to stay that way. In those cases simple_recursive_removal() would, of course, deadlock, so we have to play racy games with unlocking/relocking the parent around the call or open-code the entire thing. A better solution is to provide a variant that expects to be called with the parent already locked by the caller. Parent should be locked with I_MUTEX_PARENT, to avoid false positives from lockdep. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 2a8061ee5e41034eb14170ec4517b5583dbeff9f Author: Al Viro Date: Wed Jul 2 22:30:32 2025 -0400 better lockdep annotations for simple_recursive_removal() We want a class that nests outside of I_MUTEX_NORMAL (for the sake of callbacks that might want to lock the victim) and inside I_MUTEX_PARENT (so that a variant of that could be used with parent of the victim held locked by the caller). In reality, simple_recursive_removal() * never holds two locks at once * holds the lock on parent of dentry passed to callback * is used only on the trees with fixed topology, so the depths are not changing. So the locking order is actually fine. AFAICS, the best solution is to assign I_MUTEX_CHILD to the locks grabbed by that thing. Reported-by: syzbot+169de184e9defe7fe709@syzkaller.appspotmail.com Signed-off-by: Al Viro commit e9846f5ead26d2ed2eea0987e3991a667fc38d22 Author: Ian Rogers Date: Tue Jun 24 12:03:25 2025 -0700 perf test: In forked mode add check that fds aren't leaked When a test is forked no file descriptors should be open, however, parent ones may have been inherited - in particular those of the pipes of other forked child test processes. Add a loop to clean-up/close those file descriptors prior to running the test. At the end of the test assert that no additional file descriptors are present as this would indicate a file descriptor leak. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250624190326.2038704-6-irogers@google.com Signed-off-by: Namhyung Kim commit e793e2c0f188fb7a7998224f14241c0d87df5249 Author: Ian Rogers Date: Tue Jun 24 12:03:24 2025 -0700 perf dso: With ref count checking, avoid dso_data holding dso live With the dso_data embedded in a dso there is a reference counted pointer to the dso rather than using container_of with reference count checking. This data can hold the dso live meaning that no dso__put ever deletes it. Add a check for this case and close the dso_data when it happens. There isn't an infinite loop as the dso_data clears the file descriptor prior to putting on the dso. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250624190326.2038704-5-irogers@google.com Signed-off-by: Namhyung Kim commit d1f18106778b4d1af5ca6bde191e05e075c7e697 Author: Ian Rogers Date: Tue Jun 24 12:03:23 2025 -0700 perf hwmon_pmu: Hold path rather than fd Hold the path to the hwmon_pmu rather than the file descriptor. The file descriptor is somewhat problematic in that it reflects the directory state when opened, something that may vary in testing. Using a path simplifies testing and to some extent cleanup as the hwmon_pmu is owned by the pmus list and intentionally global and leaked when perf terminates, the file descriptor being left open looks like a leak. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250624190326.2038704-4-irogers@google.com Signed-off-by: Namhyung Kim commit 7a8557fc4aa12cffc97e5c8a1b8b8fd0275464b2 Author: Ian Rogers Date: Tue Jun 24 12:03:22 2025 -0700 perf test code-reading: Avoid a leak of cpus and threads The perf_evlist__set_maps does the necessary gets on the arguments passed, so the reference count bumping isn't necessary and creates a memory leak. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250624190326.2038704-3-irogers@google.com Signed-off-by: Namhyung Kim commit 63a088e999de3f431f87d9a367933da894ddb613 Author: Ian Rogers Date: Tue Jun 24 12:03:21 2025 -0700 perf dso: Add missed dso__put to dso__load_kcore The kcore loading creates a set of list nodes that have reference counted references to maps of the kcore. The list node freeing in the success path wasn't releasing the maps, add the missing puts. It is unclear why this leak was being missed by leak sanitizer. Fixes: 83720209961f ("perf map: Move map list node into symbol") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250624190326.2038704-2-irogers@google.com Signed-off-by: Namhyung Kim commit d4ae1620c6209661ced9244d058f3582d1847dca Author: Ian Rogers Date: Wed Jul 2 10:54:02 2025 -0700 perf genelf: Fix NO_LIBDW=1 build With NO_LIBDW=1 a new unused-parameter warning/error has appeared: ``` util/genelf.c: In function ‘jit_write_elf’: util/genelf.c:163:32: error: unused parameter ‘load_addr’ [-Werror=unused-parameter] 163 | jit_write_elf(int fd, uint64_t load_addr, const char *sym, ``` Fixes: e3f612c1d8f3 ("perf genelf: Remove libcrypto dependency and use built-in sha1()") Signed-off-by: Ian Rogers Tested-by: Namhyung Kim Link: https://lore.kernel.org/r/20250702175402.761818-1-irogers@google.com Signed-off-by: Namhyung Kim commit 508b228942b291cb69f11027c07ca17ab2ac03bc Author: Thomas Richter Date: Mon Jun 23 15:27:31 2025 +0200 perf list: Add IBM z17 event descriptions Update IBM z17 counter description using document SA23-2260-08: "The Load-Program-Parameter and the CPU-Measurement Facilities" released in May 2025 to include counter definitions for IBM z17 counter sets: * Basic counter set * Problem/user counter set * Crypto counter set. Use document SA23-2261-09: "The CPU-Measurement Facility Extended Counters Definition for z10, z196/z114, zEC12/zBC12, z13/z13s, z14, z15, z16 and z17" released on April 2025 to include counter definitions for IBM z17 * Extended counter set * MT-Diagnostic counter set. Use document SA22-7832-14: "z/Architecture Principles of Operation." released in April 2025 to include counter definitions for IBM z17 * PAI-Crypto counter set * PAI-Extention counter set. Use document "CPU MF Formulas and Updates April 2025" released in April 2025 to include metric calculations. Signed-off-by: Thomas Richter Acked-by: Sumanth Korikkar Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250623132731.899525-1-tmricht@linux.ibm.com Signed-off-by: Namhyung Kim commit 1fdf938168c4d26fa279d4f204768690d1f9c4ae Author: Namhyung Kim Date: Tue Jul 1 13:10:27 2025 -0700 perf tools: Fix use-after-free in help_unknown_cmd() Currently perf aborts when it finds an invalid command. I guess it depends on the environment as I have some custom commands in the path. $ perf bad-command perf: 'bad-command' is not a perf-command. See 'perf --help'. Aborted (core dumped) It's because the exclude_cmds() in libsubcmd has a use-after-free when it removes some entries. After copying one to another entry, it keeps the pointer in the both position. And the next copy operation will free the later one but it's the same entry in the previous one. For example, let's say cmds = { A, B, C, D, E } and excludes = { B, E }. ci cj ei cmds-name excludes -----------+-------------------- 0 0 0 | A B : cmp < 0, ci == cj 1 1 0 | B B : cmp == 0 2 1 1 | C E : cmp < 0, ci != cj At this point, it frees cmds->names[1] and cmds->names[1] is assigned to cmds->names[2]. 3 2 1 | D E : cmp < 0, ci != cj Now it frees cmds->names[2] but it's the same as cmds->names[1]. So accessing cmds->names[1] will be invalid. This makes the subcmd tests succeed. $ perf test subcmd 69: libsubcmd help tests : 69.1: Load subcmd names : Ok 69.2: Uniquify subcmd names : Ok 69.3: Exclude duplicate subcmd names : Ok Fixes: 4b96679170c6 ("libsubcmd: Avoid SEGV/use-after-free when commands aren't excluded") Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250701201027.1171561-3-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 39107ccbc6967461ed8471e5a7a881e4429ecf31 Author: Matthew Wilcox (Oracle) Date: Wed Jul 2 10:48:48 2025 +0800 bcache: switch from pages to folios in read_super() Retrieve a folio from the page cache instead of a page. Removes a hidden call to compound_head(). Then be sure to call folio_put() instead of put_page() to release it. That doesn't save any calls to compound_head(), just moves them around. Signed-off-by: Matthew Wilcox (Oracle) Signed-off-by: Coly Li Acked-back: Coly Li Link: https://lore.kernel.org/r/20250702024848.343370-1-colyli@kernel.org [axboe: commit message massaging] Signed-off-by: Jens Axboe commit cf73d9970ea4f8cace5d8f02d2565a2723003112 Author: Pavel Begunkov Date: Wed Jul 2 21:31:54 2025 +0100 io_uring: don't use int for ABI __kernel_rwf_t is defined as int, the actual size of which is implementation defined. It won't go well if some compiler / archs ever defines it as i64, so replace it with __u32, hoping that there is no one using i16 for it. Cc: stable@vger.kernel.org Fixes: 2b188cc1bb857 ("Add io_uring IO interface") Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/47c666c4ee1df2018863af3a2028af18feef11ed.1751412511.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit daa01d954b13a178c216b6a91f8451a7b83b3bf6 Author: Caleb Sander Mateos Date: Thu Jun 19 08:34:34 2025 -0600 io_uring/rsrc: skip atomic refcount for uncloned buffers io_buffer_unmap() performs an atomic decrement of the io_mapped_ubuf's reference count in case it has been cloned into another io_ring_ctx's registered buffer table. This is an expensive operation and unnecessary in the common case that the io_mapped_ubuf is only registered once. Load the reference count first and check whether it's 1. In that case, skip the atomic decrement and immediately free the io_mapped_ubuf. Signed-off-by: Caleb Sander Mateos Link: https://lore.kernel.org/r/20250619143435.3474028-1-csander@purestorage.com Signed-off-by: Jens Axboe commit 38d573a624a54ccde1384ead8af0780fe4005c2b Author: WangYuli Date: Mon Jun 23 15:19:33 2025 +0800 gitignore: allow .pylintrc to be tracked The .pylintrc file was introduced by commit 02df8e3b333c ("docs: add a .pylintrc file with sys path for docs scripts") to provide Python path configuration for documentation scripts. However, the generic ".*" rule in .gitignore causes this tracked file to be ignored, leading to warnings during kernel builds. Add !.pylintrc to the exception list to explicitly allow this configuration file to be tracked by git, consistent with other development tool configuration files like .clang-format and .rustfmt.toml. This resolves the build warning: .pylintrc: warning: ignored by one of the .gitignore files Fixes: 02df8e3b333c ("docs: add a .pylintrc file with sys path for docs scripts") Signed-off-by: WangYuli Reviewed-by: Miguel Ojeda Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/1A357750FF71847E+20250623071933.311947-1-wangyuli@uniontech.com commit b9329f51677e5ca3288ab652f488e99d5db11693 Author: Riana Tauro Date: Mon Jun 30 15:07:41 2025 +0530 drm/xe/xe_pmu: Validate gt in event supported Validate gt instead of checking gt_id is lesser than max gts per tile Signed-off-by: Riana Tauro Reviewed-by: Lucas De Marchi Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250630093741.2435281-1-riana.tauro@intel.com Signed-off-by: Matt Roper commit d4eb4a010262ea7801e576d1033b355910f2f7d4 Author: Matt Roper Date: Tue Jul 1 13:13:28 2025 -0700 drm/xe/xe_query: Use separate iterator while filling GT list The 'id' value updated by for_each_gt() is the uapi GT ID of the GTs being iterated over, and may skip over values if a GT is not present on the device. Use a separate iterator for GT list array assignments to ensure that the array will be filled properly on future platforms where index in the GT query list may not match the uapi ID. v2: - Include the missing increment of the iterator. (Jonathan) Cc: Jonathan Cavitt Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250701201320.2514369-16-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 457123d5a0351792280c7441107db49560bdd3c3 Author: Matt Roper Date: Tue Jul 1 13:13:27 2025 -0700 drm/xe: Don't compare GT ID to GT count when determining valid GTs On current platforms with multiple GTs, all of the GT IDs are consecutive; as a result we know that the GT IDs range from 0 to gt_count-1 and can determine if a GT ID is valid by comparing against the count. The consecutive nature of GT IDs may not hold true on future platforms if/when we have platforms that are both multi-tile and have multiple GTs within each tile. Once such platforms exist, it's quite possible that we could wind up with something like a GT list composed of IDs 0, 2, and 3 with no GT 1 (which would be a 2-tile platform with media only on the second tile). To future-proof the code we should stop comparing against the GT count to determine whether a GT ID is valid or not. Instead we should do an actual lookup of the ID to determine whether the GT exists. This also means that our GT loop macro should not end at the GT count, but should rather examine the entire space up to (# of tiles) * (max GT per tile) to ensure it doesn't stop prematurely. Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250701201320.2514369-15-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit bd6a4b978584cb633be0d5cdfbf79803fd31da07 Author: Matt Roper Date: Tue Jul 1 13:13:26 2025 -0700 drm/xe: Assign GT IDs properly on multi-tile + multi-GT platforms Although "multi-tile" and "multiple GTs per tile" are mutually-exclusive characteristics on all of our platforms today, this may not always be true. Assign GT IDs according to xe->info.max_gt_per_tile in a way that should work even if future platforms have different configurations. This patch should not change the behavior of current platforms; it only future-proofs for potential future designs. v2: - Re-calculate gt_count if tile count gets reduced by MTCFG. (PVC CI) Reviewed-by: Ravi Kumar Vodapalli Link: https://lore.kernel.org/r/20250701201320.2514369-14-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit fb72cd2104a9a57c390fe773e0c6ff58679a0a12 Author: Matt Roper Date: Tue Jul 1 13:13:25 2025 -0700 drm/xe/tests/pci: Ensure all platforms have a valid GT/tile count Add a simple kunit test to ensure each platform's GT per tile count is non-zero and does not exceed the global XE_MAX_GT_PER_TILE definition. We need to move 'struct xe_subplatform_desc' from the .c file to the types header to ensure it is accessible from the kunit test. v2: - Rebase on latest xe_pci test rework from Michal and convert to a parameterized test that runs on each PCI ID supported by the driver. Cc: Michal Wajdeczko Reviewed-by: Ravi Kumar Vodapalli Link: https://lore.kernel.org/r/20250701201320.2514369-13-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit f8e0f4c526a4332e568b2384671ca9d016e0c5a5 Author: Matt Roper Date: Tue Jul 1 13:13:24 2025 -0700 drm/xe: Track maximum GTs per tile on a per-platform basis Today all of our platforms fall into one of three cases: * Single tile platforms with a single (primary) GT * Single tile platforms with two GTs (primary + media) * Two-tile platforms with a single GT (primary) in each Our numbering of GTs has been a bit inconsistent between platforms (e.g., GT1 is the media GT on some platforms, but the second tile's primary GT on others). In the future we'll likely have platforms that are both multi-tile and multi-GT, which will make the situation more confusing. We could also wind up with more than just two types of GTs at some point in the future. Going forward we should standardize the way we assign uapi GT IDs to internal GT structures. Let's declare that for userspace GT ID n, GT[n]'s tile = n / (max gt per tile) GT[n]'s slot within tile = n % (max gt per tile) We don't want the GT numbering to change for any of our current platforms since the current IDs are part of our ABI contract with userspace so this means we should track the 'max gt per tile' value on a per-platform basis rather than just using a single value across the driver. Encode this into device descriptors in xe_pci.c and use the per-platform number for various checks in the code. Constant XE_MAX_GT_PER_TILE will remain just as the maximum across all platforms for easy of sizing array allocations. Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250701201320.2514369-12-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 0fc957c20df343f82d4c3b934bcb21cc51dd49b0 Author: Matt Roper Date: Tue Jul 1 13:13:23 2025 -0700 drm/xe: Export xe_step_name for kunit tests xe_step_name() is used by xe_assert(), so adding assertions to functions like xe_device_get_gt() will result in ERROR: modpost: "xe_step_name" [drivers/gpu/drm/xe/tests/xe_test.ko] undefined! while building the kunit tests. Export xe_step_name to avoid these build failures when adding assertions. Reviewed-by: Michal Wajdeczko Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250701201320.2514369-11-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 1ce50d4e0691b8d1664de78133a5e5d3457a2577 Author: Bagas Sanjaya Date: Fri Jun 20 17:56:44 2025 +0700 Documentation: ext4: Move inode table short docs into its own file The short description of inode table is in bitmaps.rst alongside the proper bitmpas documentation. The docs file is short enough that it fits whole browser screen on desktop, which implies that when readers click "Inode Table", they will essentially see bitmaps docs. Move inode table short description. Signed-off-by: Bagas Sanjaya Acked-by: Theodore Ts'o Acked-by: Darrick J. Wong Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250620105643.25141-7-bagasdotme@gmail.com commit 36dc5367f415e799b251d0ff8b2f399238cae332 Author: Bagas Sanjaya Date: Fri Jun 20 17:56:43 2025 +0700 Documentation: ext4: blockgroup: Add explicit title heading Block groups documentation has three, first-level section headings. These headings' text become toctree entries and the first one "Layout" becomes docs title in the output, which isn't conveying the docs contents. Add explicit title heading and demote the rest. Signed-off-by: Bagas Sanjaya Acked-by: Theodore Ts'o Acked-by: Darrick J. Wong Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250620105643.25141-6-bagasdotme@gmail.com commit 5717d2dc3a8955dce1e7b0758409ee74864a5d26 Author: Bagas Sanjaya Date: Fri Jun 20 17:56:42 2025 +0700 Documentation: ext4: atomic_writes: Demote last three sections Last three sections of atomic block writes documentation are adorned as first-level title headings, which erroneously increase toctree entries in overview.rst. Demote them. Fixes: 0bf1f51e34c4 ("ext4: Add atomic block write documentation") Signed-off-by: Bagas Sanjaya Acked-by: Theodore Ts'o Acked-by: Darrick J. Wong Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250620105643.25141-5-bagasdotme@gmail.com commit 859fac2cd68368a93d3ade4decb891347407f76d Author: Bagas Sanjaya Date: Fri Jun 20 17:56:41 2025 +0700 Documentation: ext4: Reduce toctree depth Reduce toctree depth from 6 to 2 to only show individual docs titles on top-level toctree (index.rst) and to not spoil the entire hierarchy. Signed-off-by: Bagas Sanjaya Acked-by: Theodore Ts'o Acked-by: Darrick J. Wong Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250620105643.25141-4-bagasdotme@gmail.com commit 6e1429fb108136cab3e4be423338ae5c01513a46 Author: Bagas Sanjaya Date: Fri Jun 20 17:56:40 2025 +0700 Documentation: ext4: Convert includes into toctrees ext4 docs are organized in three master docs (overview.rst, globals.rst, and dynamic.rst), in which these include other docs via include:: directive. These docs sturcture is better served by toctrees instead. Convert the master docs to use toctrees. Fixes: 0bf1f51e34c4 ("ext4: Add atomic block write documentation") Signed-off-by: Bagas Sanjaya Acked-by: Theodore Ts'o Acked-by: Darrick J. Wong Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250620105643.25141-3-bagasdotme@gmail.com commit 8b98f34ce1d8c520403362cb785231f9898eb3ff Author: Chenguang Zhao Date: Wed Jul 2 13:58:20 2025 +0800 net: ipv6: Fix spelling mistake change 'Maximium' to 'Maximum' Signed-off-by: Chenguang Zhao Reviewed-by: Simon Horman Acked-by: Paul Moore Link: https://patch.msgid.link/20250702055820.112190-1-zhaochenguang@kylinos.cn Signed-off-by: Jakub Kicinski commit 19b323e9327a54539703f924cb9329e74aebd6a1 Merge: 97b2409f28e0d6 23ca32e4ead48f Author: Jakub Kicinski Date: Wed Jul 2 15:39:07 2025 -0700 Merge branch 'support-rate-management-on-traffic-classes-in-devlink-and-mlx5' Mark Bloch says: ==================== Support rate management on traffic classes in devlink and mlx5 This patch series extends the devlink-rate API to support traffic class (TC) bandwidth management, enabling more granular control over traffic shaping and rate limiting across multiple TCs. The API now allows users to specify bandwidth proportions for different traffic classes in a single command. This is particularly useful for managing Enhanced Transmission Selection (ETS) for groups of Virtual Functions (VFs), allowing precise bandwidth allocation across traffic classes. Additionally the series refines the QoS handling in net/mlx5 to support TC arbitration and bandwidth management on vports and rate nodes. Discussions on traffic class shaping in net-shapers began in V5 [1], where we discussed with maintainers whether net-shapers should support traffic classes and how this could be implemented. Later, after further conversations with Paolo Abeni and Simon Horman, Cosmin provided an update [2], confirming that net-shapers' tree-based hierarchy aligns well with traffic classes when treated as distinct subsets of netdev queues. Since mlx5 enforces a 1:1 mapping between TX queues and traffic classes, this approach seems feasible, though some open questions remain regarding queue reconfiguration and certain mlx5 scheduling behaviors. Building on that discussion, Cosmin has now shared a concrete implementation plan on the netdev mailing list [3]. The plan, developed in collaboration with Paolo and Simon, outlines how net-shapers can be extended to support the same use cases currently covered by devlink-rate, with the eventual goal of aligning both and simplifying the shaping infrastructure in the kernel. This work was presented at Netdev 0x19 in Zagreb [4]. There we presented how TC scheduling is enforced in mlx5 hardware, which led to discussions on the mailing list. A summary of how things work: Classification means labeling a packet with a traffic class based on the packet's DSCP or VLAN PCP field, then treating packets with different traffic classes differently during transmit processing. In a virtualized setup, VFs are untrusted and do not control classification or shaping. Classification is done by the hardware using a prio-to-TC mapping set by the hypervisor. VFs only select which send queue to use and are expected to respect the classification logic by sending each traffic class on its dedicated queue. As stated in the net-shapers plan [3], each transmit queue should carry only a single traffic class. Mixing classes in a single queue can lead to HOL blocking. In the mlx5 implementation, if the queue used does not match the classified traffic class, the hardware moves the queue to the correct TC scheduler. This movement is not a reclassification; it’s a necessary enforcement step to ensure traffic class isolation is maintained. Extend devlink-rate API to support rate management on TCs: - devlink: Extend the devlink rate API to support traffic class bandwidth management Introduce a no-op implementation: - net/mlx5: Add no-op implementation for setting tc-bw on rate objects Add support for enabling and disabling TC QoS on vports and nodes: - net/mlx5: Add support for setting tc-bw on nodes - net/mlx5: Add traffic class scheduling support for vport QoS Support for setting tc-bw on rate objects: - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw [1] https://lore.kernel.org/netdev/20241204220931.254964-1-tariqt@nvidia.com/ [2] https://lore.kernel.org/netdev/67df1a562614b553dcab043f347a0d7c5393ff83.camel@nvidia.com/ [3] https://lore.kernel.org/netdev/d9831d0c940a7b77419abe7c7330e822bbfd1cfb.camel@nvidia.com/T/ [4] https://netdevconf.info/0x19/sessions/talk/optimizing-bandwidth-allocation-with-ets-and-traffic-classes.html ==================== Link: https://patch.msgid.link/20250629142138.361537-1-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 23ca32e4ead48f68e37000f2552b973ef1439acb Author: Carolina Jubran Date: Sun Jun 29 17:21:38 2025 +0300 selftests: drv-net: Add test for devlink-rate traffic class bandwidth distribution This test suite validates the functionality of the devlink-rate API for traffic class (TC) bandwidth allocation. It ensures that bandwidth can be distributed between different traffic classes as configured, and verifies that explicit TC-to-queue mapping is required for the allocation to be effective. The first test (test_no_tc_mapping_bandwidth) is marked as expected failure on mlx5, since the hardware automatically enforces traffic class separation by dynamically moving queues to the correct TC scheduler, even without explicit TC-to-queue mapping configuration. Test output on mlx5: 1..2 # Created VF interface: eth5 # Created VLAN eth5.101 on eth5 with tc 3 and IP 198.51.100.2 # Created VLAN eth5.102 on eth5 with tc 4 and IP 198.51.100.10 # Set representor eth4 up and added to bridge # Bandwidth check results without TC mapping: # TC 3: 0.19 Gbits/sec # TC 4: 0.76 Gbits/sec # Total bandwidth: 0.95 Gbits/sec # TC 3 percentage: 20.0% # TC 4 percentage: 80.0% ok 1 devlink_rate_tc_bw.test_no_tc_mapping_bandwidth # XFAIL Bandwidth matched 80/20 split without TC mapping # Created VF interface: eth5 # Created VLAN eth5.101 on eth5 with tc 3 and IP 198.51.100.2 # Created VLAN eth5.102 on eth5 with tc 4 and IP 198.51.100.10 # Set representor eth4 up and added to bridge # Bandwidth check results with TC mapping: # TC 3: 0.21 Gbits/sec # TC 4: 0.78 Gbits/sec # Total bandwidth: 0.98 Gbits/sec # TC 3 percentage: 21.1% # TC 4 percentage: 78.9% # Bandwidth is distributed as 80/20 with TC mapping ok 2 devlink_rate_tc_bw.test_tc_mapping_bandwidth # Totals: pass:1 fail:0 xfail:1 xpass:0 skip:0 error:0 Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Reviewed-by: Nimrod Oren Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250629142138.361537-9-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit cf7e73770d1bc0492b20e2b0222a59c6bafbd8ff Author: Carolina Jubran Date: Sun Jun 29 17:21:37 2025 +0300 net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw Introduce support for managing Traffic Class (TC) arbiter nodes and associated vports TC nodes within the E-Switch QoS hierarchy. This patch adds support for the new scheduling node type, `SCHED_NODE_TYPE_VPORTS_TC_TSAR`, and implements full support for setting tc-bw on both vports and nodes. Key changes include: - Introduced the new scheduling node type, `SCHED_NODE_TYPE_VPORTS_TC_TSAR`, for managing vports within the TC arbiter node. - New helper functions for creating and destroying vports TC nodes under the TC arbiter. - Updated the minimum rate normalization function to skip nodes of type `SCHED_NODE_TYPE_VPORTS_TC_TSAR`. Vports TC TSARs have bandwidth shares configured on them but not minimum rates, so their `min_rate` cannot be normalized. - Implementation of `esw_qos_tc_arbiter_scheduling_setup()` and `esw_qos_tc_arbiter_scheduling_teardown()` for initializing and cleaning up TC arbiter scheduling elements. These functions now fully support tc-bw configuration on TC arbiter nodes. - Introduced a new helper `esw_qos_calculate_tc_bw_divider()` to compute the total TC bandwidth share, which is used as a divider for normalizing each TC's share. - Added `esw_qos_tc_arbiter_get_bw_shares()` and `esw_qos_set_tc_arbiter_bw_shares()` to handle the settings of bandwidth shares for vports traffic class TSARs. - `esw_qos_set_tc_arbiter_bw_shares()` normalizes each TC share based on the total and the firmware's maximum allowed TSAR bandwidth share. - Refactored `mlx5_esw_devlink_rate_node_tc_bw_set()` and `mlx5_esw_devlink_rate_leaf_tc_bw_set()` to fully support configuring tc-bw on devlink rate nodes and vports, respectively. - Refactored `mlx5_esw_qos_node_update_parent()` to ensure that tc-bw configuration remains compatible with setting a parent on a rate node, preserving level hierarchy functionality. - Refactored `esw_qos_calc_bw_share()` to generalize its input so it can be used for both minimum rate and bandwidth share calculations. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250629142138.361537-8-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 97733d1e00a001b1708247af366280154df83b93 Author: Carolina Jubran Date: Sun Jun 29 17:21:36 2025 +0300 net/mlx5: Add traffic class scheduling support for vport QoS Introduce support for traffic class (TC) scheduling on vports by allowing the vport to own multiple TC scheduling nodes. This patch enables more granular control of QoS by defining three distinct QoS states for vports, each providing unique scheduling behavior: 1. Regular QoS: The `sched_node` represents the vport directly, handling QoS as a single scheduling entity. 2. TC QoS on the vport: The `sched_node` acts as a TC arbiter, enabling TC scheduling directly on the vport. 3. TC QoS on the parent node: The `sched_node` functions as a rate limiter, with TC arbitration enabled at the parent level, associating multiple scheduling nodes with each vport. Key changes include: - Added support for new scheduling elements, vport traffic class and rate limiter. - New helper functions for creating, destroying, and restoring vport TC scheduling nodes, handling transitions between regular QoS and TC arbitration states. - Updated `esw_qos_vport_enable()` and `esw_qos_vport_disable()` to support both regular QoS and TC arbitration states, ensuring consistent transitions between scheduling modes. - Introduced a `sched_nodes` array under `vport->qos` to store multiple TC scheduling nodes per vport, enabling finer control over per-TC QoS. - Enhanced `esw_qos_vport_update_parent()` to handle transitions between the three QoS states based on the current and new parent node types. This patch lays the groundwork for future support for configuring tc-bw on vports. Although the infrastructure is in place, full support for tc-bw is not yet implemented; attempts to set tc-bw on vports will return `-EOPNOTSUPP`. No functional changes are introduced at this stage. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250629142138.361537-7-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 96619c485fa69195ea61a9f288a00383f40b5280 Author: Carolina Jubran Date: Sun Jun 29 17:21:35 2025 +0300 net/mlx5: Add support for setting tc-bw on nodes Introduce support for enabling and disabling Traffic Class (TC) arbitration for existing devlink rate nodes. This patch adds support for a new scheduling node type, `SCHED_NODE_TYPE_TC_ARBITER_TSAR`. Key changes include: - New helper functions for transitioning existing rate nodes to TC arbiter nodes and vice versa. These functions handle the allocation of TC arbiter nodes, copying of child nodes, and restoring vport QoS settings when TC arbitration is disabled. - Implementation of `mlx5_esw_devlink_rate_node_tc_bw_set()` to manage tc-bw configuration on nodes. - Introduced stubs for `esw_qos_tc_arbiter_scheduling_setup()` and `esw_qos_tc_arbiter_scheduling_teardown()`, which will be extended in future patches to provide full support for tc-bw on devlink rate objects. - Validation functions for tc-bw settings, allowing graceful handling of unsupported traffic class bandwidth configurations. - Updated `__esw_qos_alloc_node()` to insert the new node into the parent’s children list only if the parent is not NULL. For the root TSAR, the new node is inserted directly after the allocation call. - Don't allow `tc-bw` configuration for nodes containing non-leaf children. This patch lays the groundwork for future support for configuring tc-bw on devlink rate nodes. Although the infrastructure is in place, full support for tc-bw is not yet implemented; attempts to set tc-bw on nodes will return `-EOPNOTSUPP`. No functional changes are introduced at this stage. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250629142138.361537-6-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 71092821244a6a8e5bce7eb6154b4e5012302194 Author: Carolina Jubran Date: Sun Jun 29 17:21:34 2025 +0300 net/mlx5: Add no-op implementation for setting tc-bw on rate objects Introduce `mlx5_esw_devlink_rate_node_tc_bw_set()` and `mlx5_esw_devlink_rate_leaf_tc_bw_set()` with no-op logic. Future patches will add support for setting traffic class bandwidth on rate objects. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250629142138.361537-5-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 236156d80d5efd942fc395a078d6ec6d810c2c40 Author: Carolina Jubran Date: Sun Jun 29 17:21:33 2025 +0300 selftest: netdevsim: Add devlink rate tc-bw test Test verifies that netdevsim correctly implements devlink ops callbacks that set tc-bw on leaf or node rate object. Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250629142138.361537-4-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 566e8f108fc7847f2a8676ec6a101d37b7dd0fb4 Author: Carolina Jubran Date: Sun Jun 29 17:21:32 2025 +0300 devlink: Extend devlink rate API with traffic classes bandwidth management Introduce support for specifying relative bandwidth shares between traffic classes (TC) in the devlink-rate API. This new option allows users to allocate bandwidth across multiple traffic classes in a single command. This feature provides a more granular control over traffic management, especially for scenarios requiring Enhanced Transmission Selection. Users can now define a relative bandwidth share for each traffic class. For example, assigning share values of 20 to TC0 (TCP/UDP) and 80 to TC5 (RoCE) will result in TC0 receiving 20% and TC5 receiving 80% of the total bandwidth. The actual percentage each class receives depends on the ratio of its share value to the sum of all shares. Example: DEV=pci/0000:08:00.0 $ devlink port function rate add $DEV/vfs_group tx_share 10Gbit \ tx_max 50Gbit tc-bw 0:20 1:0 2:0 3:0 4:0 5:80 6:0 7:0 $ devlink port function rate set $DEV/vfs_group \ tc-bw 0:20 1:0 2:0 3:0 4:0 5:20 6:60 7:0 Example usage with ynl: ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/devlink.yaml \ --do rate-set --json '{ "bus-name": "pci", "dev-name": "0000:08:00.0", "port-index": 1, "rate-tc-bws": [ {"rate-tc-index": 0, "rate-tc-bw": 50}, {"rate-tc-index": 1, "rate-tc-bw": 50}, {"rate-tc-index": 2, "rate-tc-bw": 0}, {"rate-tc-index": 3, "rate-tc-bw": 0}, {"rate-tc-index": 4, "rate-tc-bw": 0}, {"rate-tc-index": 5, "rate-tc-bw": 0}, {"rate-tc-index": 6, "rate-tc-bw": 0}, {"rate-tc-index": 7, "rate-tc-bw": 0} ] }' ./tools/net/ynl/cli.py --spec Documentation/netlink/specs/devlink.yaml \ --do rate-get --json '{ "bus-name": "pci", "dev-name": "0000:08:00.0", "port-index": 1 }' output for rate-get: {'bus-name': 'pci', 'dev-name': '0000:08:00.0', 'port-index': 1, 'rate-tc-bws': [{'rate-tc-bw': 50, 'rate-tc-index': 0}, {'rate-tc-bw': 50, 'rate-tc-index': 1}, {'rate-tc-bw': 0, 'rate-tc-index': 2}, {'rate-tc-bw': 0, 'rate-tc-index': 3}, {'rate-tc-bw': 0, 'rate-tc-index': 4}, {'rate-tc-bw': 0, 'rate-tc-index': 5}, {'rate-tc-bw': 0, 'rate-tc-index': 6}, {'rate-tc-bw': 0, 'rate-tc-index': 7}], 'rate-tx-max': 0, 'rate-tx-priority': 0, 'rate-tx-share': 0, 'rate-tx-weight': 0, 'rate-type': 'leaf'} Signed-off-by: Carolina Jubran Reviewed-by: Cosmin Ratiu Reviewed-by: Jiri Pirko Signed-off-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250629142138.361537-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 42401c42389622424f2973ec57414f033ae6be8f Author: Carolina Jubran Date: Sun Jun 29 17:21:31 2025 +0300 netlink: introduce type-checking attribute iteration for nlmsg Add the nlmsg_for_each_attr_type() macro to simplify iteration over attributes of a specific type in a Netlink message. Convert existing users in vxlan and nfsd to use the new macro. Suggested-by: Jakub Kicinski Signed-off-by: Carolina Jubran Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250629142138.361537-2-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 97b2409f28e0d69e5ab62df0798be8bd744a770f Author: Jason Wang Date: Tue Jul 1 09:03:52 2025 +0800 vhost-net: reduce one userspace copy when building XDP buff We used to do twice copy_from_iter() to copy virtio-net and packet separately. This introduce overheads for userspace access hardening as well as SMAP (for x86 it's stac/clac). So this patch tries to use one copy_from_iter() to copy them once and move the virtio-net header afterwards to reduce overheads. Testpmd + vhost_net shows 10% improvement from 5.45Mpps to 6.0Mpps. Signed-off-by: Jason Wang Link: https://patch.msgid.link/20250701010352.74515-2-jasowang@redhat.com Signed-off-by: Jakub Kicinski commit 4d313f2bd22213caace3fe4fb02977b527f9c6c3 Author: Jason Wang Date: Tue Jul 1 09:03:51 2025 +0800 tun: remove unnecessary tun_xdp_hdr structure With f95f0f95cfb7("net, xdp: Introduce xdp_init_buff utility routine"), buffer length could be stored as frame size so there's no need to have a dedicated tun_xdp_hdr structure. We can simply store virtio net header instead. Acked-by: Willem de Bruijn Signed-off-by: Jason Wang Link: https://patch.msgid.link/20250701010352.74515-1-jasowang@redhat.com Signed-off-by: Jakub Kicinski commit 285c895fba9e42dfdc9eea1c3001585d9ee58233 Merge: 04b1d18c5bae0e 81d572a551f43c Author: Jakub Kicinski Date: Wed Jul 2 15:07:18 2025 -0700 Merge branch 'preserve-msg_zerocopy-with-forwarding' Willem de Bruijn says: ==================== preserve MSG_ZEROCOPY with forwarding Avoid false positive copying of zerocopy skb frags when entering the ingress path if the skb is not queued locally but forwarded. Patch 1 for more details and feature. Patch 2 converts the existing selftest to a pass/fail test and adds coverage for this new feature. ==================== Link: https://patch.msgid.link/20250630194312.1571410-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit 81d572a551f43c01380e4aa39a6b9f331c931fbc Author: Willem de Bruijn Date: Mon Jun 30 15:42:12 2025 -0400 selftest: net: extend msg_zerocopy test with forwarding Zerocopy skbs are converted to regular copy skbs when data is queued to a local socket. This happens in the existing test with a sender and receiver communicating over a veth device. Zerocopy skbs are sent without copying if egressing a device. Verify that this behavior is maintained even in the common container setup where data is forwarded over a veth to the physical device. Update msg_zerocopy.sh to 1. Have a dummy network device to simulate a physical device. 2. Have forwarding enabled between veth and dummy. 3. Add a tx-only test that sends out dummy via the forwarding path. 4. Verify the exitcode of the sender, which signals zerocopy success. As dummy drops all packets, this cannot be a TCP connection. Test the new case with unconnected UDP only. Update msg_zerocopy.c to - Accept an argument whether send with zerocopy is expected. - Return an exitcode whether behavior matched that expectation. Signed-off-by: Willem de Bruijn Link: https://patch.msgid.link/20250630194312.1571410-3-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit d2527ad3a9e1f3031095d65376a94a8e640b2b74 Author: Willem de Bruijn Date: Mon Jun 30 15:42:11 2025 -0400 net: preserve MSG_ZEROCOPY with forwarding MSG_ZEROCOPY data must be copied before data is queued to local sockets, to avoid indefinite timeout until memory release. This test is performed by skb_orphan_frags_rx, which is called when looping an egress skb to packet sockets, error queue or ingress path. To preserve zerocopy for skbs that are looped to ingress but are then forwarded to an egress device rather than delivered locally, defer this last check until an skb enters the local IP receive path. This is analogous to existing behavior of skb_clear_delivery_time. Signed-off-by: Willem de Bruijn Link: https://patch.msgid.link/20250630194312.1571410-2-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit 04b1d18c5bae0e3c40207953658b1f62182d4829 Merge: 6d359cf464f40b 3a764d93385ca8 Author: Jakub Kicinski Date: Wed Jul 2 15:05:24 2025 -0700 Merge branch 'vsock-test-check-for-null-ptr-deref-when-transport-changes' Luigi Leonardi says: ==================== vsock/test: check for null-ptr-deref when transport changes This series introduces a new test that checks for a null pointer dereference that may happen when there is a transport change[1]. This bug was fixed in [2]. Note that this test *cannot* fail, it hangs if it triggers a kernel oops. The intended use-case is to run it and then check if there is any oops in the dmesg. This test is based on Hyunwoo Kim's[3] and Michal's python reproducers[4]. [1]https://lore.kernel.org/netdev/Z2LvdTTQR7dBmPb5@v4bel-B760M-AORUS-ELITE-AX/ [2]https://lore.kernel.org/netdev/20250110083511.30419-1-sgarzare@redhat.com/ [3]https://lore.kernel.org/netdev/Z2LvdTTQR7dBmPb5@v4bel-B760M-AORUS-ELITE-AX/#t [4]https://lore.kernel.org/netdev/2b3062e3-bdaa-4c94-a3c0-2930595b9670@rbox.co/ v4: https://lore.kernel.org/20250624-test_vsock-v4-1-087c9c8e25a2@redhat.com v3: https://lore.kernel.org/20250611-test_vsock-v3-1-8414a2d4df62@redhat.com v2: https://lore.kernel.org/20250314-test_vsock-v2-1-3c0a1d878a6d@redhat.com v1: https://lore.kernel.org/20250306-test_vsock-v1-0-0320b5accf92@redhat.com ==================== Link: https://patch.msgid.link/20250630-test_vsock-v5-0-2492e141e80b@redhat.com Signed-off-by: Jakub Kicinski commit 3a764d93385ca8bea38bbec8f2e4da0442890616 Author: Luigi Leonardi Date: Mon Jun 30 18:33:04 2025 +0200 vsock/test: Add test for null ptr deref when transport changes Add a new test to ensure that when the transport changes a null pointer dereference does not occur. The bug was reported upstream [1] and fixed with commit 2cb7c756f605 ("vsock/virtio: discard packets if the transport changes"). KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067] CPU: 2 UID: 0 PID: 463 Comm: kworker/2:3 Not tainted Workqueue: vsock-loopback vsock_loopback_work RIP: 0010:vsock_stream_has_data+0x44/0x70 Call Trace: virtio_transport_do_close+0x68/0x1a0 virtio_transport_recv_pkt+0x1045/0x2ae4 vsock_loopback_work+0x27d/0x3f0 process_one_work+0x846/0x1420 worker_thread+0x5b3/0xf80 kthread+0x35a/0x700 ret_from_fork+0x2d/0x70 ret_from_fork_asm+0x1a/0x30 Note that this test may not fail in a kernel without the fix, but it may hang on the client side if it triggers a kernel oops. This works by creating a socket, trying to connect to a server, and then executing a second connect operation on the same socket but to a different CID (0). This triggers a transport change. If the connect operation is interrupted by a signal, this could cause a null-ptr-deref. Since this bug is non-deterministic, we need to try several times. It is reasonable to assume that the bug will show up within the timeout period. If there is a G2H transport loaded in the system, the bug is not triggered and this test will always pass. This is because `vsock_assign_transport`, when using CID 0, like in this case, sets vsk->transport to `transport_g2h` that is not NULL if a G2H transport is available. [1]https://lore.kernel.org/netdev/Z2LvdTTQR7dBmPb5@v4bel-B760M-AORUS-ELITE-AX/ Suggested-by: Hyunwoo Kim Suggested-by: Michal Luczaj Signed-off-by: Luigi Leonardi Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250630-test_vsock-v5-2-2492e141e80b@redhat.com Signed-off-by: Jakub Kicinski commit e84b20b25d37622641953568ac54f0c63c409fef Author: Luigi Leonardi Date: Mon Jun 30 18:33:03 2025 +0200 vsock/test: Add macros to identify transports Add three new macros: TRANSPORTS_G2H, TRANSPORTS_H2G and TRANSPORTS_LOCAL. They can be used to identify the type of the transport(s) loaded when using the `get_transports()` function. Suggested-by: Stefano Garzarella Signed-off-by: Luigi Leonardi Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250630-test_vsock-v5-1-2492e141e80b@redhat.com Signed-off-by: Jakub Kicinski commit 6d359cf464f40baadf5e5595613c38a12f5829ef Author: Matthew Gerlach Date: Mon Jun 30 14:37:48 2025 -0700 dt-bindings: net: Convert socfpga-dwmac bindings to yaml Convert the bindings for socfpga-dwmac to yaml. Since the original text contained descriptions for two separate nodes, two separate yaml files were created. Signed-off-by: Mun Yew Tham Signed-off-by: Matthew Gerlach Reviewed-by: Maxime Chevallier Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250630213748.71919-1-matthew.gerlach@altera.com Signed-off-by: Jakub Kicinski commit 9e2a7ad4ae909d1ec0e1b1bde4ff67a75962c41b Author: Raju Rangoju Date: Tue Jul 1 17:49:29 2025 +0530 amd-xgbe: add support for giant packet size AMD XGBE hardware supports giant Ethernet frames up to 16K bytes. Add support for configuring and enabling giant packet handling in the driver. - Define new register fields and macros for giant packet support. - Update the jumbo frame configuration logic to enable giant packet mode when MTU exceeds the jumbo threshold. Acked-by: Shyam Sundar S K Signed-off-by: Raju Rangoju Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250701121929.319690-1-Raju.Rangoju@amd.com Signed-off-by: Jakub Kicinski commit 7d2dabaa1796e54d442c02b4d108336730982baf Author: Eric Dumazet Date: Tue Jul 1 08:45:40 2025 +0000 net: ifb: support BIG TCP packets Set the driver limit to GSO_MAX_SIZE (512 KB). This allows the admin/user to set a GSO limit up to this value, to avoid segmenting too large GRO packets in the netem -> ifb path. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250701084540.459261-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7945fe4858663f2d3b80b5ddcc939efbeba4f36e Merge: 8077b9a911d7cb 46a94e44b9ec4d Author: Jakub Kicinski Date: Wed Jul 2 14:32:32 2025 -0700 Merge branch 'net-add-data-race-annotations-around-dst-fields' Eric Dumazet says: ==================== net: add data-race annotations around dst fields Add annotations around various dst fields, which can change under us. Add four helpers to prepare better dst->dev protection, and start using them. More to come later. v1: https://lore.kernel.org/20250627112526.3615031-1-edumazet@google.com ==================== Link: https://patch.msgid.link/20250630121934.3399505-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 46a94e44b9ec4d8d20108a1748c410d71a8dc759 Author: Eric Dumazet Date: Mon Jun 30 12:19:34 2025 +0000 ipv6: ip6_mc_input() and ip6_mr_input() cleanups Both functions are always called under RCU. We remove the extra rcu_read_lock()/rcu_read_unlock(). We use skb_dst_dev_net_rcu() instead of skb_dst_dev_net(). We use dev_net_rcu() instead of dev_net(). Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-11-edumazet@google.com Signed-off-by: Jakub Kicinski commit 93d1cff35adc522a5d21e722eee1071f3f7dc716 Author: Eric Dumazet Date: Mon Jun 30 12:19:33 2025 +0000 ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers Use the new helpers as a step to deal with potential dst->dev races. v2: fix typo in ipv6_rthdr_rcv() (kernel test robot ) Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-10-edumazet@google.com Signed-off-by: Jakub Kicinski commit 1caf27297215a5241f9bfc9c07336349d9034ee3 Author: Eric Dumazet Date: Mon Jun 30 12:19:32 2025 +0000 ipv6: adopt dst_dev() helper Use the new helper as a step to deal with potential dst->dev races. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-9-edumazet@google.com Signed-off-by: Jakub Kicinski commit a74fc62eec155ca5a6da8ff3856f3dc87fe24558 Author: Eric Dumazet Date: Mon Jun 30 12:19:31 2025 +0000 ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu] Use the new helpers as a first step to deal with potential dst->dev races. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-8-edumazet@google.com Signed-off-by: Jakub Kicinski commit 88fe14253e181878c2ddb51a298ae8c468a63010 Author: Eric Dumazet Date: Mon Jun 30 12:19:30 2025 +0000 net: dst: add four helpers to annotate data-races around dst->dev dst->dev is read locklessly in many contexts, and written in dst_dev_put(). Fixing all the races is going to need many changes. We probably will have to add full RCU protection. Add three helpers to ease this painful process. static inline struct net_device *dst_dev(const struct dst_entry *dst) { return READ_ONCE(dst->dev); } static inline struct net_device *skb_dst_dev(const struct sk_buff *skb) { return dst_dev(skb_dst(skb)); } static inline struct net *skb_dst_dev_net(const struct sk_buff *skb) { return dev_net(skb_dst_dev(skb)); } static inline struct net *skb_dst_dev_net_rcu(const struct sk_buff *skb) { return dev_net_rcu(skb_dst_dev(skb)); } Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-7-edumazet@google.com Signed-off-by: Jakub Kicinski commit 2dce8c52a98995c4719def6f88629ab1581c0b82 Author: Eric Dumazet Date: Mon Jun 30 12:19:29 2025 +0000 net: dst: annotate data-races around dst->output dst_dev_put() can overwrite dst->output while other cpus might read this field (for instance from dst_output()) Add READ_ONCE()/WRITE_ONCE() annotations to suppress potential issues. We will likely need RCU protection in the future. Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-6-edumazet@google.com Signed-off-by: Jakub Kicinski commit f1c5fd34891a1c242885f48c2e4dc52df180f311 Author: Eric Dumazet Date: Mon Jun 30 12:19:28 2025 +0000 net: dst: annotate data-races around dst->input dst_dev_put() can overwrite dst->input while other cpus might read this field (for instance from dst_input()) Add READ_ONCE()/WRITE_ONCE() annotations to suppress potential issues. We will likely need full RCU protection later. Fixes: 4a6ce2b6f2ec ("net: introduce a new function dst_dev_put()") Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8f2b2282d04a5d5bcbec22f91572bb6803cfc771 Author: Eric Dumazet Date: Mon Jun 30 12:19:27 2025 +0000 net: dst: annotate data-races around dst->lastuse (dst_entry)->lastuse is read and written locklessly, add corresponding annotations. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 36229b2caca2228b834c03fb83867022485a0563 Author: Eric Dumazet Date: Mon Jun 30 12:19:26 2025 +0000 net: dst: annotate data-races around dst->expires (dst_entry)->expires is read and written locklessly, add corresponding annotations. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8a402bbe54760dea67f1b2980c727761b47994d7 Author: Eric Dumazet Date: Mon Jun 30 12:19:25 2025 +0000 net: dst: annotate data-races around dst->obsolete (dst_entry)->obsolete is read locklessly, add corresponding annotations. Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250630121934.3399505-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8077b9a911d7cb0f606217f645d82c7b083ca238 Merge: a8065af3346ebd e3d4825124bce0 Author: Jakub Kicinski Date: Wed Jul 2 14:22:04 2025 -0700 Merge branch 'net-introduce-net_aligned_data' Eric Dumazet says: ==================== net: introduce net_aligned_data ____cacheline_aligned_in_smp on small fields like tcp_memory_allocated and udp_memory_allocated is not good enough. It makes sure to put these fields at the start of a cache line, but does not prevent the linker from using the cache line for other fields, with potential performance impact. nm -v vmlinux|egrep -5 "tcp_memory_allocated|udp_memory_allocated" ... ffffffff83e35cc0 B tcp_memory_allocated ffffffff83e35cc8 b __key.0 ffffffff83e35cc8 b __tcp_tx_delay_enabled.1 ffffffff83e35ce0 b tcp_orphan_timer ... ffffffff849dddc0 B udp_memory_allocated ffffffff849dddc8 B udp_encap_needed_key ffffffff849dddd8 B udpv6_encap_needed_key ffffffff849dddf0 b inetsw_lock One solution is to move these sensitive fields to a structure, so that the compiler is forced to add empty holes between each member. nm -v vmlinux|egrep -2 "tcp_memory_allocated|udp_memory_allocated|net_aligned_data" ffffffff885af970 b mem_id_init ffffffff885af980 b __key.0 ffffffff885af9c0 B net_aligned_data ffffffff885afa80 B page_pool_mem_providers ffffffff885afa90 b __key.2 v1: https://lore.kernel.org/netdev/20250627200551.348096-1-edumazet@google.com/ ==================== Link: https://patch.msgid.link/20250630093540.3052835-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit e3d4825124bce0d1f72187fabcf972b7c0b6cb9b Author: Eric Dumazet Date: Mon Jun 30 09:35:40 2025 +0000 udp: move udp_memory_allocated into net_aligned_data ____cacheline_aligned_in_smp attribute only makes sure to align a field to a cache line. It does not prevent the linker to use the remaining of the cache line for other variables, causing potential false sharing. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250630093540.3052835-5-edumazet@google.com Signed-off-by: Jakub Kicinski commit 83081337419cb692eca4ee475d936b1fdcfd49f6 Author: Eric Dumazet Date: Mon Jun 30 09:35:39 2025 +0000 tcp: move tcp_memory_allocated into net_aligned_data ____cacheline_aligned_in_smp attribute only makes sure to align a field to a cache line. It does not prevent the linker to use the remaining of the cache line for other variables, causing potential false sharing. Move tcp_memory_allocated into a dedicated cache line. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250630093540.3052835-4-edumazet@google.com Signed-off-by: Jakub Kicinski commit 998642e999d23324c5dbf38149606d09cec2c377 Author: Eric Dumazet Date: Mon Jun 30 09:35:38 2025 +0000 net: move net_cookie into net_aligned_data Using per-cpu data for net->net_cookie generation is overkill, because even busy hosts do not create hundreds of netns per second. Make sure to put net_cookie in a private cache line to avoid potential false sharing. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250630093540.3052835-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3715b5df09b92168a4492b48bb7ea70d89f9d8f3 Author: Eric Dumazet Date: Mon Jun 30 09:35:37 2025 +0000 net: add struct net_aligned_data This structure will hold networking data that must consume a full cache line to avoid accidental false sharing. Signed-off-by: Eric Dumazet Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250630093540.3052835-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit a8065af3346ebd7c76ebc113451fb3ba94cf7769 Author: zhangjianrong Date: Sat Jun 28 17:38:13 2025 +0800 net: thunderbolt: Enable end-to-end flow control also in transmit According to USB4 specification, if E2E flow control is disabled for the Transmit Descriptor Ring, the Host Interface Adapter Layer shall not require any credits to be available before transmitting a Tunneled Packet from this Transmit Descriptor Ring, so e2e flow control should be enabled in both directions. Acked-by: Mika Westerberg Link: https://lore.kernel.org/20250624153805.GC2824380@black.fi.intel.com Signed-off-by: zhangjianrong Link: https://patch.msgid.link/20250628093813.647005-1-zhangjianrong5@huawei.com Signed-off-by: Jakub Kicinski commit 8ec31cb17cd355cea25cdb8496d9b3fbf1321647 Author: zhangjianrong Date: Sat Jun 28 17:49:20 2025 +0800 net: thunderbolt: Fix the parameter passing of tb_xdomain_enable_paths()/tb_xdomain_disable_paths() According to the description of tb_xdomain_enable_paths(), the third parameter represents the transmit ring and the fifth parameter represents the receive ring. tb_xdomain_disable_paths() is the same case. [Jakub] Mika says: it works now because both rings ->hop is the same Acked-by: Mika Westerberg Link: https://lore.kernel.org/20250625051149.GD2824380@black.fi.intel.com Signed-off-by: zhangjianrong Link: https://patch.msgid.link/20250628094920.656658-1-zhangjianrong5@huawei.com Signed-off-by: Jakub Kicinski commit d6a59ee852758bc69c4cc821954db277a2bd5b93 Author: Jocelyn Falempe Date: Mon Jun 30 16:41:08 2025 +0200 drm/ttm: Remove unneeded blank line in comment There is an unneeded blank line in the documentation of the function ttm_bo_kmap_try_from_panic(). Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506290453.NeTXAb7S-lkp@intel.com/ Fixes: 718370ff28328 ("drm/ttm: Add ttm_bo_kmap_try_from_panic()") Signed-off-by: Jocelyn Falempe Reviewed-by: Christian König Acked-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250630144154.44661-1-jfalempe@redhat.com Signed-off-by: Lucas De Marchi commit 703f9074a8e10ac3fe939025233acb7c47529608 Author: Jonathan Corbet Date: Tue Jul 1 15:54:09 2025 -0600 docs: kdoc: simplify the output-item passing Since our output items contain their name, we don't need to pass it separately. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit 60016e0116b8d33f95e797b011799e717766ec13 Author: Jonathan Corbet Date: Tue Jul 1 15:31:11 2025 -0600 docs: kdoc; Add a rudimentary class to represent output items This class is intended to replace the unstructured dict used to accumulate an entry to pass to an output module. For now, it remains unstructured, but it works well enough that the output classes don't notice the difference. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit 3d6c2bc7629c8b1bfd75416767122096bb75ba7b Author: Lad Prabhakar Date: Fri Jun 27 20:37:42 2025 +0100 arm64: dts: renesas: Add CN15 eMMC and SD overlays for RZ/V2H and RZ/V2N EVKs Introduce device tree overlays for supporting the eMMC (RTK0EF0186B02000BJ) and microSD (RTK0EF0186B01000BJ) sub-boards connected via the CN15 connector on the RZ/V2H and RZ/V2N evaluation kits. These overlays enable SDHI0 with appropriate pin control settings, power regulators, and GPIO handling. Both sub-boards are supported using shared overlay files that can be applied to either EVK due to their identical connector layout and interface support. To support this, new DT overlay files are added: - `rzv2-evk-cn15-emmc.dtso` for eMMC - `rzv2-evk-cn15-sd.dtso` for microSD Additionally, the base DTS files for both EVKs are updated to include a fixed 1.8V regulator (`reg_1p8v`) needed by the eMMC sub-board and potential future use cases such as HDMI output. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250627193742.110818-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 424ada15dee7e9e54e04e3203e73529dce7ebe70 Author: Geert Uytterhoeven Date: Thu Jun 26 11:51:35 2025 +0200 arm64: dts: renesas: r8a779h2: Add Gray Hawk Single support The Gray Hawk Single board with R-Car V4M-7 (R8A779H2) uses an updated version of the R-Car V4M (R8A779H0) SoC. For now, there are no visible differences compared to the variant equipped with an R-Car V4M (R8A779H0) SoC. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/d2e0e7b746063368b83148100aa553cff55b8b60.1750931027.git.geert+renesas@glider.be commit 9f252558104e7e028aaa15fc1daaeedace89187e Author: Tam Nguyen Date: Thu Jun 26 11:51:34 2025 +0200 arm64: dts: renesas: Add Renesas R8A779H2 SoC support Add support for the Renesas R-Car V4M-7 (R8A779H2) SoC, which is an updated version of the R-Car V4M (R8A779H0) SoC. Signed-off-by: Tam Nguyen Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/294ca4211c5a73942dc2ca04ae6d3c384d534f2b.1750931027.git.geert+renesas@glider.be commit ceff7d21a1a2d9ebc14efca68fd8ec0e99c937f0 Author: Geert Uytterhoeven Date: Thu Jun 26 11:51:33 2025 +0200 arm64: dts: renesas: Factor out Gray Hawk Single board support Move the common parts for the Renesas Gray Hawk Single board to gray-hawk-single.dtsi, to enable future reuse. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/a3e89836fde8073ac320734cec67f89ddfa8879a.1750931027.git.geert+renesas@glider.be commit f2ce1fd2d991c53d61951b3c90eda2d3b0a023ec Author: Geert Uytterhoeven Date: Thu Jun 26 11:51:32 2025 +0200 dt-bindings: soc: renesas: Document R-Car V4M-7 Gray Hawk Single Document the compatible values for the Renesas R-Car V4M-7 (R8A779H2) SoC, as used on the Renesas Gray Hawk Single board. R-Car V4M-7 is an updated version of R-Car V4M (R8A779H0). Signed-off-by: Geert Uytterhoeven Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/b4283a68aa01c82d4435ee8334093dcbdf5bd4d2.1750931027.git.geert+renesas@glider.be commit fc7dd515374455f07cdd24b8bad3c7952e812bff Author: Lad Prabhakar Date: Fri Jun 27 21:42:37 2025 +0100 clk: renesas: r9a09g057: Add XSPI clock/reset Add clock and reset entries for the XSPI interface on the R9A09G057 SoC. While at it, rename CLK_PLLCM33_DIV4_PLLCM33 to CLK_PLLCM33_GEAR to align with the terminology used in the hardware manual. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250627204237.214635-7-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 20e31205ae1075d0eda174838d2b537424f81a13 Author: Lad Prabhakar Date: Fri Jun 27 21:42:36 2025 +0100 clk: renesas: r9a09g056: Add XSPI clock/reset Add XSPI clock and reset entries. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250627204237.214635-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 87239caea4dfbe69b34ddb6dd35fc58f2d395257 Author: Lad Prabhakar Date: Fri Jun 27 21:42:35 2025 +0100 clk: renesas: rzv2h: Add fixed-factor module clocks with status reporting Add support for fixed-factor module clocks that can report their enable status through the module status monitor. Introduce a new clock type, CLK_TYPE_FF_MOD_STATUS, and define the associated structure, rzv2h_ff_mod_status_clk, to manage these clocks. Implement the .is_enabled callback by reading the module status register using monitor index and bit definitions. Provide a helper macro, DEF_FIXED_MOD_STATUS, to simplify the definition of such clocks. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250627204237.214635-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 7aada0abe9676d90d95fce065a8227e5d494f611 Author: Lad Prabhakar Date: Fri Jun 27 21:42:34 2025 +0100 clk: renesas: r9a09g057: Add support for xspi mux and divider The mux smux2_xspi_clk{0,1} used for selecting spi and spix2 clocks and pllcm33_xspi divider to select different clock rates. Add support for both. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250627204237.214635-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 2a4c0e785a30debcdaf34f31ff4c1d3c35bbfad8 Author: Lad Prabhakar Date: Fri Jun 27 21:42:33 2025 +0100 clk: renesas: r9a09g056: Add support for xspi mux and divider The mux smux2_xspi_clk{0,1} used for selecting spi and spix2 clocks and pllcm33_xspi divider to select different clock rates. Add support for both. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250627204237.214635-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 15bf4a46174aa4aff346d17f28821cb9cb6f0034 Merge: 0475a478d0a88c 5e4e8c1415c181 Author: Geert Uytterhoeven Date: Wed Jul 2 20:53:12 2025 +0200 Merge tag 'renesas-r9a09g057-dt-binding-defs-tag4' into renesas-clk-for-v6.17 Renesas RZ/V2N and RZ/V2H XSPI Clock DT Binding Definitions Expanded Serial Peripheral Interface (XSPI) clock DT binding definitions for the Renesas RZ/V2N (R9A09G056) and RZ/V2H (R9A09G057) SoCs, shared by driver and DT source files. commit 0475a478d0a88c7ec31763697eb01b25957bece3 Author: Lad Prabhakar Date: Wed Jun 25 15:17:05 2025 +0100 clk: renesas: r9a09g077: Add RIIC module clocks Add RIIC module clocks for: iic0, iic1, and iic2. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250625141705.151383-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 09d50e09fab65f42d4656e9b01f225db7d311348 Author: Lad Prabhakar Date: Wed Jun 25 15:17:04 2025 +0100 clk: renesas: r9a09g077: Add PLL2 and SDHI clock support Add support for PLL2 to the R9A09G077 (RZ/T2H) clock definitions and register it as the source for the high-speed SDHI clock (SDHI_CLKHS) operating at 800MHz. Also add fixed-factor clock PCLKAM derived from CLK_PLL4D1, and define module clocks for SDHI0 and SDHI1, both of which use PCLKAM as their clock source. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250625141705.151383-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 8f9ad7670b6e4b434ac65449ac3e31aada1bef4c Merge: 8250a8a9b10f45 2a76193f7cc03d Author: Geert Uytterhoeven Date: Wed Jul 2 20:49:48 2025 +0200 Merge tag 'renesas-r9a09g087-dt-binding-defs-tag2' into renesas-clk-for-v6.17 Renesas RZ/T2H and RZ/N2H SDHI Clock DT Binding Definitions SDHI clock DT binding definitions for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs, shared by driver and DT source files. commit 38d95beb4b24301362f8bdae7fbdb82d74b803ca Author: Mykyta Yatsenko Date: Wed Jul 2 18:56:22 2025 +0100 selftests/bpf: Allow veristat compile standalone Veristat is synced into the standalone repo, where it compiles without kernel private dependencies. This patch fixes compilation errors in standalone veristat. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250702175622.358405-1-mykyta.yatsenko5@gmail.com commit 8250a8a9b10f459a40460104e6d6064c98283d1e Author: Lad Prabhakar Date: Tue Jun 24 16:30:49 2025 +0100 clk: renesas: rzv2h: Drop redundant base pointer from pll_clk The base address can be accessed via the priv pointer already present in struct pll_clk, making the separate base field redundant. Remove the base member and its assignment. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250624153049.462535-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 6132643bfdc928696205207027bce81d23b7ce59 Author: Fabrizio Castro Date: Tue Jun 24 20:22:59 2025 +0100 clk: renesas: r9a09g057: Add entries for the RSPIs Add clock and reset entries for the Renesas RZ/V2H(P) RSPI IPs. Signed-off-by: Fabrizio Castro Reviewed-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250624192304.338979-2-fabrizio.castro.jz@renesas.com Signed-off-by: Geert Uytterhoeven commit 2a76193f7cc03de5b2745d069926ebc431dd5ba4 Author: Lad Prabhakar Date: Wed Jun 25 15:17:03 2025 +0100 dt-bindings: clock: renesas,r9a09g077/87: Add SDHI_CLKHS clock ID Add the SDHI high-speed clock (SDHI_CLKHS) definition for the Renesas RZ/T2H (R9A09G077) and RZ/N2H (R9A09G087) SoCs. SDHI_CLKHS is used as a core clock for the SDHI IP and operates at 800MHz. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250625141705.151383-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 5e4e8c1415c181ce311a0b5936ef301edd57c5d1 Author: Lad Prabhakar Date: Fri Jun 27 21:42:32 2025 +0100 dt-bindings: clock: renesas,r9a09g056/57-cpg: Add XSPI core clock Add XSPI core clock definitions to the clock bindings for the Renesas R9A09G056 and R9A09G057 SoCs. These clocks IDs are used to support XSPI interface. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250627204237.214635-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 7000167796a00d64322dc3ed0c0970e31d481ed6 Author: Geert Uytterhoeven Date: Thu Jun 26 15:50:39 2025 +0200 pinctrl: renesas: Simplify PINCTRL_RZV2M logic PINCTRL_RZV2M is selected by ARCH_R9A09G011, hence there is no need to depend on the latter. Move the dependency on COMPILE_TEST to the symbol prompt, like is done for all other auto-selected pin control symbols. Signed-off-by: Geert Uytterhoeven Reviewed-by: Lad Prabhakar Link: https://lore.kernel.org/d74843e06f73cd4c6e822d65f606e6042a50a0b7.1750945516.git.geert+renesas@glider.be commit 8ca43e41fc94b72e274301365f8f32c2536515c7 Author: Kuninori Morimoto Date: Tue Jun 24 05:11:31 2025 +0000 pinctrl: renesas: Unify config naming Renesas SoC has chip number / chip name. Some SoC is using chip number, and some SoC is using chip name on current Renesas pincontrol Kconfig. Let's unify "pin control support for ${CHIP_NUMBER} (${CHIP_NAME}). Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/87bjqdraf1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Geert Uytterhoeven commit 93e20e2b7a556e7c1699e48ebd4dd6b2ce929d43 Author: Kuninori Morimoto Date: Tue Jun 24 05:11:14 2025 +0000 pinctrl: renesas: Sort Renesas Kconfig configs Current Renesas Kconfig is randomly arranged. Let's sort it by alphabetical/number order, same as Makefile. Signed-off-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/87cyatrafh.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Geert Uytterhoeven commit 151c1f989bcbe5972b9c26b04f10de3c47eb177c Author: Andy Shevchenko Date: Thu Jun 26 16:26:05 2025 +0300 ACPI: LPSS: Remove AudioDSP related ID The AudioDSP drivers are in control for all functions of the hardware they have (they are multi-functional devices). The LPSS driver prepares for enumeration only single devices, such as DMA, UART, SPI, I²C. Hence the registration of AudioDSP should not be covered. Moreover, the very same ACPI _HID has been added by the catpt driver a few years ago. And even more serious issue with this, is that the register window at offset 0x800 is actually D-SRAM0 in case of AudioDSP and writing to it is a data corruption. That all being said, remove the AudioDSP ID from the LPSS driver, where it doesn't belong to. Fixes: c2f8783fa2d0 ("ASoC: Intel: Add common SST driver loader on ACPI systems") Reviewed-by: Cezary Rojewski Tested-by: Cezary Rojewski Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250626132635.221064-1-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 70f238c902b8c0461ae6fbb8d1a0bbddc4350eea Author: Stav Aviram Date: Tue Jul 1 15:08:12 2025 +0300 net/mlx5: Check device memory pointer before usage Add a NULL check before accessing device memory to prevent a crash if dev->dm allocation in mlx5_init_once() fails. Fixes: c9b9dcb430b3 ("net/mlx5: Move device memory management to mlx5_core") Signed-off-by: Stav Aviram Link: https://patch.msgid.link/c88711327f4d74d5cebc730dc629607e989ca187.1751370035.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 02943ac2f6fbba8fc5e57c57e7cbc2d7c67ebf0d Author: Patrisious Haddad Date: Wed Jul 2 13:24:04 2025 +0300 net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow Failing during the initialization of root_namespace didn't cleanup the priorities of the namespace on which the failure occurred. Properly cleanup said priorities on failure. Fixes: 52931f55159e ("net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain") Signed-off-by: Patrisious Haddad Link: https://patch.msgid.link/78cf89b5d8452caf1e979350b30ada6904362f66.1751451780.git.leon@kernel.org Reviewed-by: Simon Horman Signed-off-by: Leon Romanovsky commit 904cf14f9135a18c9efe8327362f5dfd3c0f3a3f Author: Andy Shevchenko Date: Thu Jun 26 16:01:09 2025 +0300 Documentation: firmware-guide: gpio-properties: Spelling and style fixes - Use consistent style for active-high and active-low - For C and ASL code snippets use 4-space indentation consistently - Interleave case examples with the explanations of the certain case - Remove or add commas when appropriate Signed-off-by: Andy Shevchenko Reviewed-by: Mika Westerberg Link: https://patch.msgid.link/20250626130109.215848-1-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 66c1f381d8b3282a191e8d93faac938647dfbc70 Author: Abdelrahman Fekry Date: Sat Jun 21 08:52:00 2025 +0300 ACPI: fan: Replace sprintf()/scnprintf() with sysfs_emit() in show() functions Update two sysfs show() functions in the ACPI fan driver to use sysfs_emit() and sysfs_emit_at() instead of sprintf() and scnprintf(). - show_fan_speed(): replaced sprintf() with sysfs_emit(). - show_state(): replaced scnprintf() with sysfs_emit() for the first write, and retained sysfs_emit_at() for incremental writes. This change is in accordance with Documentation/filesystems/sysfs.rst, which recommends using sysfs_emit/sysfs_emit_at in all sysfs show() callbacks for buffer safety, clarity, and consistency. Signed-off-by: Abdelrahman Fekry Link: https://patch.msgid.link/20250621055200.166361-1-abdelrahmanfekry375@gmail.com Signed-off-by: Rafael J. Wysocki commit 1f488fb91378e923dd67870292dcc36df85a814e Author: Yeoreum Yun Date: Wed Jun 18 10:29:57 2025 +0100 kselftest/arm64/mte: Add MTE_STORE_ONLY testcases Since ARMv8.9, FEAT_MTE_STORE_ONLY can be used to restrict raise of tag check fault on store operation only. Adds new test cases using MTE_STORE_ONLY feature. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618092957.2069907-9-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 391ca7c81b85cc10a0a202c6ed6a4c65e374604b Author: Yeoreum Yun Date: Wed Jun 18 10:29:56 2025 +0100 kselftest/arm64/mte: Preparation for mte store only test Since ARMv8.9, FEAT_MTE_STORE_ONLY can be used to restrict raise of tag check fault on store operation only. This patch is preparation for testing FEAT_MTE_STORE_ONLY It shouldn't change test result. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618092957.2069907-8-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 964a07426eb8bfc3a6aed8d07eeeca77f44f6d91 Author: Yeoreum Yun Date: Wed Jun 18 10:29:55 2025 +0100 kselftest/arm64/abi: Add MTE_STORE_ONLY feature hwcap test add MTE_STORE_ONLY feature hwcap test. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618092957.2069907-7-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 7502bdb43aa2a978d8f7ed0d1e2272cca1702317 Author: Yeoreum Yun Date: Wed Jun 18 10:29:54 2025 +0100 KVM: arm64: Expose MTE_STORE_ONLY feature to guest expose MTE_STORE_ONLY feature to guest. Signed-off-by: Yeoreum Yun Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20250618092957.2069907-6-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit f620372209bfe5b1c468540320a0bc3549d6afc7 Author: Yeoreum Yun Date: Wed Jun 18 10:29:53 2025 +0100 arm64/hwcaps: Add MTE_STORE_ONLY hwcaps Since ARMv8.9, FEAT_MTE_STORE_ONLY can be used to restrict raise of tag check fault on store operation only. add MTE_STORE_ONLY hwcaps so that user can use this feature. Signed-off-by: Yeoreum Yun Link: https://lore.kernel.org/r/20250618092957.2069907-5-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 4d51ff5bba00a13ca9b0b24883fa7adb07a167fc Author: Yeoreum Yun Date: Wed Jun 18 10:29:52 2025 +0100 arm64/kernel: Support store-only mte tag check Introduce new flag -- MTE_CTRL_STORE_ONLY used to set store-only tag check. This flag isn't overridden by prefered tcf flag setting but set together with prefered setting of way to report tag check fault. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618092957.2069907-4-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit b1fabef37bd504f378a203fd8b9227b8fa65b193 Author: Yeoreum Yun Date: Wed Jun 18 10:29:51 2025 +0100 prctl: Introduce PR_MTE_STORE_ONLY PR_MTE_STORE_ONLY is used to restrict the MTE tag check for store opeartion only. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Tested-by: Mark Brown Link: https://lore.kernel.org/r/20250618092957.2069907-3-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 33e943a228535fe5eb64b746d2b7b6b187aaa77a Author: Yeoreum Yun Date: Wed Jun 18 10:29:50 2025 +0100 arm64/cpufeature: Add MTE_STORE_ONLY feature Since ARMv8.9, FEAT_MTE_STORE_ONLY can be used to restrict raise of tag check fault on store operation only. add MTE_STORE_ONLY feature. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618092957.2069907-2-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 65fdafd6765f677494ab0cb35b8237eb742a18e5 Author: Paul Chaignon Date: Wed Jul 2 15:54:54 2025 +0200 bpf: Avoid warning on multiple referenced args in call The description of full helper calls in syzkaller [1] and the addition of kernel warnings in commit 0df1a55afa83 ("bpf: Warn on internal verifier errors") allowed syzbot to reach a verifier state that was thought to indicate a verifier bug [2]: 12: (85) call bpf_tcp_raw_gen_syncookie_ipv4#204 verifier bug: more than one arg with ref_obj_id R2 2 2 This error can be reproduced with the program from the previous commit: 0: (b7) r2 = 20 1: (b7) r3 = 0 2: (18) r1 = 0xffff92cee3cbc600 4: (85) call bpf_ringbuf_reserve#131 5: (55) if r0 == 0x0 goto pc+3 6: (bf) r1 = r0 7: (bf) r2 = r0 8: (85) call bpf_tcp_raw_gen_syncookie_ipv4#204 9: (95) exit bpf_tcp_raw_gen_syncookie_ipv4 expects R1 and R2 to be ARG_PTR_TO_FIXED_SIZE_MEM (with a size of at least sizeof(struct iphdr) for R1). R0 is a ring buffer payload of 20B and therefore matches this requirement. The verifier reaches the check on ref_obj_id while verifying R2 and rejects the program because the helper isn't supposed to take two referenced arguments. This case is a legitimate rejection and doesn't indicate a kernel bug, so we shouldn't log it as such and shouldn't emit a kernel warning. Link: https://github.com/google/syzkaller/pull/4313 [1] Link: https://lore.kernel.org/all/686491d6.a70a0220.3b7e22.20ea.GAE@google.com/T/ [2] Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") Fixes: 0df1a55afa83 ("bpf: Warn on internal verifier errors") Reported-by: syzbot+69014a227f8edad4d8c6@syzkaller.appspotmail.com Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/cd09afbfd7bef10bbc432d72693f78ffdc1e8ee5.1751463262.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko commit 7ec899ac90a205090275cd4a5c96c9606a93f3a1 Author: Paul Chaignon Date: Wed Jul 2 15:53:23 2025 +0200 selftests/bpf: Negative test case for ref_obj_id in args This patch adds a test case, as shown below, for the verifier error "more than one arg with ref_obj_id". 0: (b7) r2 = 20 1: (b7) r3 = 0 2: (18) r1 = 0xffff92cee3cbc600 4: (85) call bpf_ringbuf_reserve#131 5: (55) if r0 == 0x0 goto pc+3 6: (bf) r1 = r0 7: (bf) r2 = r0 8: (85) call bpf_tcp_raw_gen_syncookie_ipv4#204 9: (95) exit This error is currently incorrectly reported as a verifier bug, with a warning. The next patch in this series will address that. Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/3ba78e6cda47ccafd6ea70dadbc718d020154664.1751463262.git.paul.chaignon@gmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko commit a90f5f7370c283863d3872f231debc9b2227b27f Author: Eduard Zingerman Date: Wed Jul 2 00:36:20 2025 -0700 selftests/bpf: null checks for rdonly_untrusted_mem should be preserved Test case checking that verifier does not assume rdonly_untrusted_mem values as not null. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250702073620.897517-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko commit c3b9faac9bd690263e03b78eb78c75cae5ff7509 Author: Eduard Zingerman Date: Wed Jul 2 00:36:19 2025 -0700 bpf: avoid jump misprediction for PTR_TO_MEM | PTR_UNTRUSTED Commit f2362a57aeff ("bpf: allow void* cast using bpf_rdonly_cast()") added a notion of PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED type. This simultaneously introduced a bug in jump prediction logic for situations like below: p = bpf_rdonly_cast(..., 0); if (p) a(); else b(); Here verifier would wrongly predict that else branch cannot be taken. This happens because: - Function reg_not_null() assumes that PTR_TO_MEM w/o PTR_MAYBE_NULL flag cannot be zero. - The call to bpf_rdonly_cast() returns a rdonly_untrusted_mem value w/o PTR_MAYBE_NULL flag. Tracking of PTR_MAYBE_NULL flag for untrusted PTR_TO_MEM does not make sense, as the main purpose of the flag is to catch null pointer access errors. Such errors are not possible on load of PTR_UNTRUSTED values and verifier makes sure that PTR_UNTRUSTED can't be passed to helpers or kfuncs. Hence, modify reg_not_null() to assume that nullness of untrusted PTR_TO_MEM is not known. Fixes: f2362a57aeff ("bpf: allow void* cast using bpf_rdonly_cast()") Suggested-by: Alexei Starovoitov Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250702073620.897517-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov Signed-off-by: Andrii Nakryiko commit 07ee18a0bc946b6b407942c88faed089e20f47d1 Author: Matteo Croce Date: Tue Jul 1 20:31:23 2025 +0200 selftests/bpf: Don't call fsopen() as privileged user In the BPF token example, the fsopen() syscall is called as privileged user. This is unneeded because fsopen() can be called also as unprivileged user from the user namespace. As the `fs_fd` file descriptor which was sent back and forth is still the same, keep it open instead of cloning and closing it twice via SCM_RIGHTS. cfr. https://github.com/systemd/systemd/pull/36134 Signed-off-by: Matteo Croce Signed-off-by: Andrii Nakryiko Acked-by: Christian Brauner Link: https://lore.kernel.org/bpf/20250701183123.31781-1-technoboy85@gmail.com commit 4a89166ee0750b4bd9edc6f386f5ed9a49f36897 Author: Rafael J. Wysocki Date: Mon Jun 16 20:20:28 2025 +0200 ACPI: PM: Set .detach in acpi_general_pm_domain definition Instead of setting the .detach callback pointer for acpi_general_pm_domain every time it is attached to a device, which is confusing, set it once in the definition of acpi_general_pm_domain. No intentional functional impact. Signed-off-by: Rafael J. Wysocki Reviewed-by: Mika Westerberg Link: https://patch.msgid.link/4665476.LvFx2qVVIh@rjwysocki.net Signed-off-by: Rafael J. Wysocki commit e0e9506523fea415e0d5abaa103fd67dc8a39696 Author: Yury Norov [NVIDIA] Date: Sun Jun 22 20:00:09 2025 -0400 smp: Defer check for local execution in smp_call_function_many_cond() Defer check for local execution to the actual place where it is needed, which removes the extra local variable. Signed-off-by: Yury Norov [NVIDIA] Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250623000010.10124-5-yury.norov@gmail.com commit d09674f98cdbf5dc2288cd5e2d0e63b6e5f723b2 Author: Yeoreum Yun Date: Wed Jun 18 09:45:13 2025 +0100 kselftest/arm64/mte: Add mtefar tests on check_mmap_options If FEAT_MTE_TAGGED_FAR (Armv8.9) is supported, bits 63:60 of the fault address are preserved in response to synchronous tag check faults (SEGV_MTESERR). This patch adds new test cases using address tags (bits 63:60), corresponding to each existing test in check_mmap_option. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618084513.1761345-11-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 64a64e5d12f070405800745c674916fbbf2b9283 Author: Yeoreum Yun Date: Wed Jun 18 09:45:12 2025 +0100 kselftest/arm64/mte: Refactor check_mmap_option test Before add mtefar testcase on check_mmap_option.c, refactor check_mmap_option: - make testcase suite array with test options (mem_type, mte_sync type and etc) to use general testcase pattern - generate each test case name acoording to test options. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618084513.1761345-10-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 49cee364c8665c5951162a0e193d10a86e3e6011 Author: Yeoreum Yun Date: Wed Jun 18 09:45:11 2025 +0100 kselftest/arm64/mte: Add verification for address tag in signal handler Add the address tag [63:60] verification when synchronous mte fault is happen. when signal handler is registered with SA_EXPOSE_TAGBITS, address includes not only memory tag [59:56] but also address tag. Therefore, when verify fault address location, remove both tags Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618084513.1761345-9-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit ed434c6e081327e9d0685d4b5e4cd067246f8be6 Author: Yeoreum Yun Date: Wed Jun 18 09:45:10 2025 +0100 kselftest/arm64/mte: Add address tag related macro and function Add address tag related macro and function to test MTE_FAR feature. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618084513.1761345-8-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 2e3e356560ef54605a1c779ae8dcd7889ff2875d Author: Yeoreum Yun Date: Wed Jun 18 09:45:09 2025 +0100 kselftest/arm64/mte: Check MTE_FAR feature is supported To run the MTE_FAR test when cpu supports MTE_FAR feature, check the MTE_FAR feature is supported in mte test. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618084513.1761345-7-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit cfafa517c9e658756511e210e7288efe21554bcf Author: Yeoreum Yun Date: Wed Jun 18 09:45:08 2025 +0100 kselftest/arm64/mte: Register mte signal handler with SA_EXPOSE_TAGBITS To test address tag[63:60] and memory tag[59:56] is preserved when memory tag fault happen, Let mte_register_signal() to register signal handler with SA_EXPOSE_TAGBITS. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618084513.1761345-6-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 49a9942ff80c99dabdc4a76011d755524e72fd9d Author: Yeoreum Yun Date: Wed Jun 18 09:45:07 2025 +0100 kselftest/arm64: Add MTE_FAR hwcap test add MTE_FAR hwcap test on kselftest. Signed-off-by: Yeoreum Yun Reviewed-by: Mark Brown Link: https://lore.kernel.org/r/20250618084513.1761345-5-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 61eae495da68fe3d17ed6e8d3ebcdb8c9a2f7c44 Author: Yeoreum Yun Date: Wed Jun 18 09:45:06 2025 +0100 KVM: arm64: Expose FEAT_MTE_TAGGED_FAR feature to guest expose FEAT_MTE_TAGGED_FAR feature to guest. Signed-off-by: Yeoreum Yun Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20250618084513.1761345-4-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 7c7f55039b8d69567acc953964b656a8b126c30a Author: Yeoreum Yun Date: Wed Jun 18 09:45:05 2025 +0100 arm64: Report address tag when FEAT_MTE_TAGGED_FAR is supported If FEAT_MTE_TAGGED_FAR (Armv8.9) is supported, bits 63:60 of the fault address are preserved in response to synchronous tag check faults (SEGV_MTESERR). This patch modifies below to support this feature: - Use the original FAR_EL1 value when an MTE tag check fault occurs, if ARM64_MTE_FAR is supported so that not only logical tag (bits 59:56) but also address tag (bits 63:60] being reported too. - Add HWCAP for mtefar to let user know bits 63:60 includes address tag information when when FEAT_MTE_TAGGED_FAR is supported. Applications that require this information should install a signal handler with the SA_EXPOSE_TAGBITS flag. While this introduces a minor ABI change, most applications do not set this flag and therefore will not be affected. Signed-off-by: Yeoreum Yun Link: https://lore.kernel.org/r/20250618084513.1761345-3-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 66984536899f49d388424cf9b158b0a664217cf6 Author: Yeoreum Yun Date: Wed Jun 18 09:45:04 2025 +0100 arm64/cpufeature: Add FEAT_MTE_TAGGED_FAR feature Add FEAT_MTE_TAGGED_FAR cpucap which makes FAR_ELx report all non-address bits on a synchronous MTE tag check fault since Armv8.9 Signed-off-by: Yeoreum Yun Acked-by: Yury Khrustalev Link: https://lore.kernel.org/r/20250618084513.1761345-2-yeoreum.yun@arm.com Signed-off-by: Catalin Marinas commit 239afba8b9f3b0fcfd464d5ffeaed0ed4441c5a4 Author: Andy Shevchenko Date: Mon Jun 30 12:39:06 2025 +0300 leds: pca955x: Avoid potential overflow when filling default_label (take 2) GCC compiler v8.5.0 is not happy about printing into a too short buffer (when build with `make W=1`): drivers/leds/leds-pca955x.c:696:5: note: 'snprintf' output between 2 and 11 bytes into a destination of size 8 Unfortunately this is a false positive from the old GCC versions, but we may still improve the code by using '%hhu' format specifier and reduce buffer size by 4 bytes. Fixes: bd3d14932923 ("leds: pca955x: Avoid potential overflow when filling default_label") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506282159.TXfvorYl-lkp@intel.com/ Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250630093906.1715800-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit cb335325b1431152f696c53e32465ba192cd119a Author: Andy Shevchenko Date: Mon Jun 30 12:26:39 2025 +0300 leds: Unexport of_led_get() There are no users outside the module. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250630092639.1574860-1-andriy.shevchenko@linux.intel.com Signed-off-by: Lee Jones commit 913bf8d50cbd144c87e9660b591781179182ff59 Author: Gabor Juhos Date: Wed Jul 2 14:35:24 2025 +0200 spi: spi-qpic-snand: add support for 8 bits ECC strength Even though the hardware supports 8 bits ECC strength, but that is not handled in the driver yet. This change adds the missing bits in order to allow using the driver with chips which require 8 bits ECC strength. No functional changes intended with regard to the existing 4 bits ECC strength support. Tested on an IPQ9574 platform using a GigaDevice GD5F2GM7REYIG chip. Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250702-qpic-snand-8bit-ecc-v2-2-ae2c17a30bb7@gmail.com Signed-off-by: Mark Brown commit 0dc7e656ddd54c3267b7cc18c1ac8ec1297ed02f Author: Gabor Juhos Date: Wed Jul 2 14:35:23 2025 +0200 mtd: nand: qpic-common: add defines for ECC_MODE values Add defines for the values of the ECC_MODE field of the NAND_DEV0_ECC_CFG register and change both the 'qcom-nandc' and 'spi-qpic-snand' drivers to use those instead of magic numbers. No functional changes. This is in preparation for adding 8 bit ECC strength support for the 'spi-qpic-snand' driver. Reviewed-by: Md Sadre Alam Signed-off-by: Gabor Juhos Acked-by: Miquel Raynal Link: https://patch.msgid.link/20250702-qpic-snand-8bit-ecc-v2-1-ae2c17a30bb7@gmail.com Signed-off-by: Mark Brown commit 662416578541723a185278b7047d8b0112d3f600 Merge: 19272b37aa4f83 be7efb2d20d67f Author: Christian Brauner Date: Tue Jul 1 14:15:14 2025 +0200 Merge patch series "fs: introduce file_getattr and file_setattr syscalls" Andrey Albershteyn says: This patchset introduced two new syscalls file_getattr() and file_setattr(). These syscalls are similar to FS_IOC_FSSETXATTR ioctl() except they use *at() semantics. Therefore, there's no need to open the file to get a fd. These syscalls allow userspace to set filesystem inode attributes on special files. One of the usage examples is XFS quota projects. XFS has project quotas which could be attached to a directory. All new inodes in these directories inherit project ID set on parent directory. The project is created from userspace by opening and calling FS_IOC_FSSETXATTR on each inode. This is not possible for special files such as FIFO, SOCK, BLK etc. Therefore, some inodes are left with empty project ID. Those inodes then are not shown in the quota accounting but still exist in the directory. This is not critical but in the case when special files are created in the directory with already existing project quota, these new inodes inherit extended attributes. This creates a mix of special files with and without attributes. Moreover, special files with attributes don't have a possibility to become clear or change the attributes. This, in turn, prevents userspace from re-creating quota project on these existing files. An xfstests test generic/766 with basic coverage is at: https://github.com/alberand/xfstests/commits/b4/file-attr/ NAME file_getattr/file_setattr - get/set filesystem inode attributes SYNOPSIS #include /* Definition of SYS_* constants */ #include long syscall(SYS_file_getattr, int dirfd, const char *pathname, struct fsx_fileattr *fsx, size_t size, unsigned int at_flags); long syscall(SYS_file_setattr, int dirfd, const char *pathname, struct fsx_fileattr *fsx, size_t size, unsigned int at_flags); Note: glibc doesn't provide for file_getattr()/file_setattr(), use syscall(2) instead. DESCRIPTION The file_getattr()/file_setattr() are used to set extended file attributes. These syscalls take dirfd in conjunction with the pathname argument. The syscall then operates on inode opened according to openat(2) semantics. This is an alternative to FS_IOC_FSGETXATTR/FS_IOC_FSSETXATTR ioctl with a difference that file don't need to be open as file can be referenced with a path instead of fd. By having this one can manipulated filesystem inode attributes not only on regular files but also on special ones. This is not possible with FS_IOC_FSSETXATTR ioctl as ioctl() can not be called on special files directly for the filesystem inode. at_flags can be set to AT_SYMLINK_NOFOLLOW or AT_EMPTY_PATH. RETURN VALUE On success, 0 is returned. On error, -1 is returned, and errno is set to indicate the error. ERRORS EINVAL Invalid at_flag specified (only AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH is supported). EINVAL Size was smaller than any known version of struct fsx_fileattr. EINVAL Invalid combination of parameters provided in fsx_fileattr for this type of file. E2BIG Size of input argument struct fsx_fileattr is too big. EBADF Invalid file descriptor was provided. EPERM No permission to change this file. EOPNOTSUPP Filesystem does not support setting attributes on this type of inode HISTORY Added in Linux 6.16. EXAMPLE Create directory and file "mkdir ./dir && touch ./dir/foo" and then execute the following program: #include #include #include #include #include #include #include #if !defined(SYS_file_getattr) && defined(__x86_64__) #define SYS_file_getattr 468 #define SYS_file_setattr 469 struct fsx_fileattr { __u32 fsx_xflags; __u32 fsx_extsize; __u32 fsx_nextents; __u32 fsx_projid; __u32 fsx_cowextsize; }; #endif int main(int argc, char **argv) { int dfd; int error; struct fsx_fileattr fsx; dfd = open("./dir", O_RDONLY); if (dfd == -1) { printf("can not open ./dir"); return dfd; } error = syscall(SYS_file_getattr, dfd, "./foo", &fsx, sizeof(struct fsx_fileattr), 0); if (error) { printf("can not call SYS_file_getattr: %s", strerror(errno)); return error; } printf("./dir/foo flags: %d\n", fsx.fsx_xflags); fsx.fsx_xflags |= FS_XFLAG_NODUMP; error = syscall(SYS_file_setattr, dfd, "./foo", &fsx, sizeof(struct fsx_fileattr), 0); if (error) { printf("can not call SYS_file_setattr: %s", strerror(errno)); return error; } printf("./dir/foo flags: %d\n", fsx.fsx_xflags); return error; } SEE ALSO ioctl(2), ioctl_iflags(2), ioctl_xfs_fsgetxattr(2), openat(2) * patches from https://lore.kernel.org/20250630-xattrat-syscall-v6-0-c4e3bc35227b@kernel.org: fs: introduce file_getattr and file_setattr syscalls fs: prepare for extending file_get/setattr() fs: make vfs_fileattr_[get|set] return -EOPNOSUPP selinux: implement inode_file_[g|s]etattr hooks lsm: introduce new hooks for setting/getting inode fsxattr fs: split fileattr related helpers into separate file Link: https://lore.kernel.org/20250630-xattrat-syscall-v6-0-c4e3bc35227b@kernel.org Signed-off-by: Christian Brauner commit be7efb2d20d67f334a7de2aef77ae6c69367e646 Author: Andrey Albershteyn Date: Mon Jun 30 18:20:16 2025 +0200 fs: introduce file_getattr and file_setattr syscalls Introduce file_getattr() and file_setattr() syscalls to manipulate inode extended attributes. The syscalls takes pair of file descriptor and pathname. Then it operates on inode opened accroding to openat() semantics. The struct file_attr is passed to obtain/change extended attributes. This is an alternative to FS_IOC_FSSETXATTR ioctl with a difference that file don't need to be open as we can reference it with a path instead of fd. By having this we can manipulated inode extended attributes not only on regular files but also on special ones. This is not possible with FS_IOC_FSSETXATTR ioctl as with special files we can not call ioctl() directly on the filesystem inode using fd. This patch adds two new syscalls which allows userspace to get/set extended inode attributes on special files by using parent directory and a path - *at() like syscall. CC: linux-api@vger.kernel.org CC: linux-fsdevel@vger.kernel.org CC: linux-xfs@vger.kernel.org Signed-off-by: Andrey Albershteyn Link: https://lore.kernel.org/20250630-xattrat-syscall-v6-6-c4e3bc35227b@kernel.org Acked-by: Arnd Bergmann Signed-off-by: Christian Brauner commit 30cd59961981ae235c59aca61715f6732f65d8cc Author: Thorsten Blum Date: Tue Jul 1 14:05:25 2025 +0200 ALSA: pcmtest: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250701120525.185831-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit e448d578264a9512d38deb8c418954d5f3e20712 Author: Pavel Begunkov Date: Mon Jun 30 19:16:56 2025 +0100 io_uring/mock: add trivial poll handler Add a flag that enables polling on the mock file. For now it's trivially says that there is always data available, it'll be extended in the future. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/f16de043ec4876d65fae294fc99ade57415fba0c.1750599274.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 0c98a44329c10bf904434524425cb42043513bd6 Author: Pavel Begunkov Date: Mon Jun 30 19:16:55 2025 +0100 io_uring/mock: support for async read/write Let the user to specify a delay to read/write request. io_uring will start a timer, return -EIOCBQUEUED and complete the request asynchronously after the delay pass. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/38f9d2e143fda8522c90a724b74630e68f9bbd16.1750599274.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 2f71d2386f4feed5bfb9ee7b3d2c0ad953db1fa5 Author: Pavel Begunkov Date: Mon Jun 30 19:16:54 2025 +0100 io_uring/mock: allow to choose FMODE_NOWAIT Add an option to choose whether the file supports FMODE_NOWAIT, that changes the execution path io_uring request takes. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/1e532565b05a05b23589d237c24ee1a3d90c2fd9.1750599274.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit d1aa0346571436203a24cc3fc0c80f14cabbd630 Author: Pavel Begunkov Date: Mon Jun 30 19:16:53 2025 +0100 io_uring/mock: add sync read/write Add support for synchronous zero read/write for mock files. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/571f3c9fe688e918256a06a722d3db6ced9ca3d5.1750599274.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 4aac001f780388b252534396feaf49b250eae27f Author: Pavel Begunkov Date: Mon Jun 30 19:16:52 2025 +0100 io_uring/mock: add cmd using vectored regbufs There is a command api allowing to import vectored registered buffers, add a new mock command that uses the feature and simply copies the specified registered buffer into user space or vice versa. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/229a113fd7de6b27dbef9567f7c0bf4475c9017d.1750599274.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 3a0ae385f69e9b2d87c9b017c4ffb5567c015197 Author: Pavel Begunkov Date: Mon Jun 30 19:16:51 2025 +0100 io_uring/mock: add basic infra for test mock files io_uring commands provide an ioctl style interface for files to implement file specific operations. io_uring provides many features and advanced api to commands, and it's getting hard to test as it requires specific files/devices. Add basic infrastucture for creating special mock files that will be implementing the cmd api and using various io_uring features we want to test. It'll also be useful to test some more obscure read/write/polling edge cases in the future. Suggested-by: chase xd Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/93f21b0af58c1367a2b22635d5a7d694ad0272fc.1750599274.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 41a5f82885e152c364e587ab30df4e582e96b73a Author: Geert Uytterhoeven Date: Wed Jul 2 10:53:54 2025 +0200 irqchip/renesas-rzv2h: Remove unneeded includes The RZ/V2H ICU driver does not use clocks, of_address, or syscore. Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/d4fbffc39af2eaa7bc50a0a97ffb3a22e3c4cb6a.1751446168.git.geert+renesas@glider.be commit a82ce08775bc5b50613d48ab7e41b25fc46825af Author: Pradeep Kumar Chitrapu Date: Mon Jun 30 18:04:08 2025 -0700 wifi: ath12k: add extended NSS bandwidth support for 160 MHz Currently rx and tx MCS map for 160 MHz under HE capabilities are not updating properly, when 160 MHz is configured with NSS lesser than max NSS support. Fix this by utilizing nss_ratio_enabled and nss_ratio_info fields sent by firmware in service ready event. However, if firmware advertises EXT NSS BW support in VHT caps as 1(1x2) and when nss_ratio_info indicates 1:1, reset the EXT NSS BW Support in VHT caps to 0 which indicates 1x1. This is to avoid incorrectly choosing 1:2 NSS ratio when using the default VHT caps advertised by firmware. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Signed-off-by: Pradeep Kumar Chitrapu Acked-by: Jeff Johnson Link: https://patch.msgid.link/20250701010408.1257201-10-quic_pradeepc@quicinc.com Signed-off-by: Jeff Johnson commit 18ab9d038fadd35d8a4ac5db87ad16dde78f5fdc Author: Pradeep Kumar Chitrapu Date: Mon Jun 30 18:04:07 2025 -0700 wifi: ath12k: add support for 160 MHz bandwidth Add support to configure maximum NSS in 160 MHz bandwidth. Firmware advertises support for handling NSS ratio information as a part of service ready ext event using nss_ratio_enabled flag. Save this information in ath12k_pdev_cap to calculate NSS ratio. Additionally, reorder the code by moving ath12k_peer_assoc_h_phymode() before ath12k_peer_assoc_h_vht() to ensure that arg->peer_phymode correctly reflects the bandwidth in the max NSS calculation. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Co-developed-by: P Praneesh Signed-off-by: P Praneesh Signed-off-by: Pradeep Kumar Chitrapu Acked-by: Jeff Johnson Link: https://patch.msgid.link/20250701010408.1257201-9-quic_pradeepc@quicinc.com Signed-off-by: Jeff Johnson commit dd25a004fb66c60934fa9572298671c1eb1c06c2 Author: Pradeep Kumar Chitrapu Date: Mon Jun 30 18:04:06 2025 -0700 wifi: ath12k: clean up 80P80 support Clean up unused 80P80 references as hardware does not support it. This is applicable to both QCN9274 and WCN7850. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Signed-off-by: Pradeep Kumar Chitrapu Acked-by: Jeff Johnson Link: https://patch.msgid.link/20250701010408.1257201-8-quic_pradeepc@quicinc.com Signed-off-by: Jeff Johnson commit 9ad6b169ddef679a64727e3870a6177c78f24b05 Author: Pradeep Kumar Chitrapu Date: Mon Jun 30 18:04:05 2025 -0700 wifi: ath12k: add support for setting fixed HE rate/GI/LTF Add support to set fixed HE rate/GI/LTF values using nl80211. Reuse parts of the existing code path already used for HT/VHT to implement the new helpers symmetrically, similar to how HT/VHT is handled. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Co-developed-by: Muna Sinada Signed-off-by: Muna Sinada Signed-off-by: Pradeep Kumar Chitrapu Link: https://patch.msgid.link/20250701010408.1257201-7-quic_pradeepc@quicinc.com Signed-off-by: Jeff Johnson commit 5ab7479a063d1b557fa59999de701ad8a4624b84 Author: Pradeep Kumar Chitrapu Date: Mon Jun 30 18:04:03 2025 -0700 wifi: ath12k: generate rx and tx mcs maps for supported HE mcs Generate rx and tx mcs maps in ath12k_mac_set_hemcsmap() based on number of supported tx/rx chains and set them in supported mcs/nss for HE capabilities. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Co-developed-by: Muna Sinada Signed-off-by: Muna Sinada Signed-off-by: Pradeep Kumar Chitrapu Acked-by: Jeff Johnson Link: https://patch.msgid.link/20250701010408.1257201-5-quic_pradeepc@quicinc.com Signed-off-by: Jeff Johnson commit 1eafb8d15d8af39ac7b4d78d69b17f85aa8e00fa Author: Pradeep Kumar Chitrapu Date: Mon Jun 30 18:04:02 2025 -0700 wifi: ath12k: move HE MCS mapper to a separate function Refactor the HE MCS mapper functionality in ath12k_mac_copy_he_cap() into a new function. This helps improve readability, extensibility and will be used when adding support for 160 MHz bandwidth in subsequent patches. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Co-developed-by: Muna Sinada Signed-off-by: Muna Sinada Signed-off-by: Pradeep Kumar Chitrapu Acked-by: Jeff Johnson Link: https://patch.msgid.link/20250701010408.1257201-4-quic_pradeepc@quicinc.com Signed-off-by: Jeff Johnson commit df8207bc0b4895c18e98a4b084806222b592d9f1 Author: Pradeep Kumar Chitrapu Date: Mon Jun 30 18:04:01 2025 -0700 wifi: ath12k: push EHT MU-MIMO params to hardware Currently, only the EHT IE in management frames is updated with respect to MU-MIMO configurations, but this change is not reflected in the hardware. Add support to propagate MU-MIMO configurations to the hardware as well for AP mode. Similar support for STA mode will be added in future. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Co-developed-by: Muna Sinada Signed-off-by: Muna Sinada Signed-off-by: Pradeep Kumar Chitrapu Acked-by: Jeff Johnson Link: https://patch.msgid.link/20250701010408.1257201-3-quic_pradeepc@quicinc.com Signed-off-by: Jeff Johnson commit 5d6707e88e7fe2d603ad45c5fe7eba096be9533a Author: Pradeep Kumar Chitrapu Date: Mon Jun 30 18:04:00 2025 -0700 wifi: ath12k: push HE MU-MIMO params to hardware Currently, only the HE IE in management frames is updated with respect to MU-MIMO configurations, but this change is not reflected in the hardware. Add support to propagate MU-MIMO configurations to the hardware as well. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1 Co-developed-by: Muna Sinada Signed-off-by: Muna Sinada Signed-off-by: Pradeep Kumar Chitrapu Acked-by: Jeff Johnson Link: https://patch.msgid.link/20250701010408.1257201-2-quic_pradeepc@quicinc.com Signed-off-by: Jeff Johnson commit 62ac3b380334ca0be4f7b2b1bfb3dbbaf2efcfa7 Author: Paul Kocialkowski Date: Tue Jul 1 22:15:34 2025 +0200 ARM: dts: sun8i: v3: Add RGB666 LCD PD pins definition The V3 supports RGB666 LCD output on PD pins, which are not available on the V3s package. Signed-off-by: Paul Kocialkowski Link: https://patch.msgid.link/20250701201534.815513-2-paulk@sys-base.io Signed-off-by: Chen-Yu Tsai commit fdc0682e1153a6180eaab35033b05ad4ce35b6a5 Author: Paul Kocialkowski Date: Tue Jul 1 22:15:33 2025 +0200 ARM: dts: sun8i: v3s: Add RGB666 LCD PE pins definition The V3s (and other packages) supports RGB666 LCD output on PE pins. Signed-off-by: Paul Kocialkowski Link: https://patch.msgid.link/20250701201534.815513-1-paulk@sys-base.io Signed-off-by: Chen-Yu Tsai commit 8a65268500b00ecee5402ef9f80618ff73f30707 Author: Jerome Brunet Date: Mon Jun 23 18:37:39 2025 +0200 clk: amlogic: s4: remove unused data Following the removal of the clk_regmap clock table from the s4-peripherals clock controller driver, it appears some clocks are unused, which means these are not exported or even registered. In all likelihood, these clocks have not been tested. Remove the unused clocks for now. These can added back later when they have been properly tested. Reviewed-by: Chuan Liu Link: https://lore.kernel.org/r/20250623-amlogic-clk-drop-clk-regmap-tables-v4-3-ff04918211cc@baylibre.com Signed-off-by: Jerome Brunet commit 4cb53fff9db2751f9d94e45c3bcac13f4be4458b Author: Jerome Brunet Date: Mon Jun 23 18:37:38 2025 +0200 clk: amlogic: drop clk_regmap tables Remove the clk_regmap tables that are used to keep track which clock need to be initialised before being registered. The initialisation is now done by the .init() operation of clk_regmap. This rework saves a bit memory and makes maintenance a bit easier. Link: https://lore.kernel.org/r/20250623-amlogic-clk-drop-clk-regmap-tables-v4-2-ff04918211cc@baylibre.com Signed-off-by: Jerome Brunet commit 21ed19d1186314940d4300c39bf54fe0a410ee44 Author: Jerome Brunet Date: Mon Jun 23 18:37:37 2025 +0200 clk: amlogic: get regmap with clk_regmap_init Add clk_regmap_init() and use it with all clock types which derive from clk_regmap. This helps initialise clk_regmap clocks without requiring tables to keep track of the clock using this type. The way it is done couples clk_regmap with the controllers, which is not ideal. This is a temporary solution to get rid of the tables. The situation will eventually be improved. Link: https://lore.kernel.org/r/20250623-amlogic-clk-drop-clk-regmap-tables-v4-1-ff04918211cc@baylibre.com Signed-off-by: Jerome Brunet commit b27a58ecdf5f88496340156eb33130e1f0d0f5d1 Merge: 0c0ef1d9096771 34d340d48e595f Author: Mark Brown Date: Wed Jul 2 14:38:08 2025 +0100 Add sound card support for QCS8275 Merge series from Prasad Kumpatla : This patchset adds support for sound card on Qualcomm QCS8275 boards. commit 276e136bff7edcdecc6e206c81594ef06aa40743 Author: Amir Goldstein Date: Mon Jun 30 18:20:15 2025 +0200 fs: prepare for extending file_get/setattr() We intend to add support for more xflags to selective filesystems and We cannot rely on copy_struct_from_user() to detect this extension. In preparation of extending the API, do not allow setting xflags unknown by this kernel version. Also do not pass the read-only flags and read-only field fsx_nextents to filesystem. These changes should not affect existing chattr programs that use the ioctl to get fsxattr before setting the new values. Link: https://lore.kernel.org/linux-fsdevel/20250216164029.20673-4-pali@kernel.org/ Cc: Pali Rohár Cc: Andrey Albershteyn Signed-off-by: Amir Goldstein Signed-off-by: Andrey Albershteyn Link: https://lore.kernel.org/20250630-xattrat-syscall-v6-5-c4e3bc35227b@kernel.org Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 474b155adf3927d2c944423045757b54aa1ca4de Author: Andrey Albershteyn Date: Mon Jun 30 18:20:14 2025 +0200 fs: make vfs_fileattr_[get|set] return -EOPNOTSUPP Future patches will add new syscalls which use these functions. As this interface won't be used for ioctls only, the EOPNOSUPP is more appropriate return code. This patch converts return code from ENOIOCTLCMD to EOPNOSUPP for vfs_fileattr_get and vfs_fileattr_set. To save old behavior translate EOPNOSUPP back for current users - overlayfs, encryptfs and fs/ioctl.c. Signed-off-by: Andrey Albershteyn Link: https://lore.kernel.org/20250630-xattrat-syscall-v6-4-c4e3bc35227b@kernel.org Signed-off-by: Christian Brauner commit 70619d40e8307b4b2ce1d08405e7b827c61ba4a8 Author: Christian Brauner Date: Wed Jul 2 13:53:21 2025 +0200 selftests/kernfs: test xattr retrieval Make sure that listxattr() returns zero and that getxattr() returns ENODATA when no extended attributs are set. Use /sys/kernel/warn_count as that always exists and is a read-only file. Link: https://lore.kernel.org/20250702-hochmoderne-abklatsch-af9c605b57b2@brauner Signed-off-by: Christian Brauner commit 05a039312428457582708a4fcbd799b1a6e97f62 Merge: 19272b37aa4f83 21eebc655b0f8e Author: Christian Brauner Date: Mon Jun 23 13:01:26 2025 +0200 Merge patch series "Introduce bpf_cgroup_read_xattr" Song Liu says: Introduce a new kfunc bpf_cgroup_read_xattr, which can read xattr from cgroupfs nodes. The primary users are LSMs, cgroup programs, and sched_ext. * patches from https://lore.kernel.org/20250623063854.1896364-1-song@kernel.org: selftests/bpf: Add tests for bpf_cgroup_read_xattr bpf: Mark cgroup_subsys_state->cgroup RCU safe bpf: Introduce bpf_cgroup_read_xattr to read xattr of cgroup's node kernfs: remove iattr_mutex Link: https://lore.kernel.org/20250623063854.1896364-1-song@kernel.org Signed-off-by: Christian Brauner commit 21eebc655b0f8e84fcac2cf5e20e9eb31d17a982 Author: Song Liu Date: Sun Jun 22 23:38:54 2025 -0700 selftests/bpf: Add tests for bpf_cgroup_read_xattr Add tests for different scenarios with bpf_cgroup_read_xattr: 1. Read cgroup xattr from bpf_cgroup_from_id; 2. Read cgroup xattr from bpf_cgroup_ancestor; 3. Read cgroup xattr from css_iter; 4. Use bpf_cgroup_read_xattr in LSM hook security_socket_connect. 5. Use bpf_cgroup_read_xattr in cgroup program. Signed-off-by: Song Liu Link: https://lore.kernel.org/20250623063854.1896364-5-song@kernel.org Signed-off-by: Christian Brauner commit 5bc9557c9f17c38ed8c9070c1d369d49eabea1a9 Author: Song Liu Date: Sun Jun 22 23:38:53 2025 -0700 bpf: Mark cgroup_subsys_state->cgroup RCU safe Mark struct cgroup_subsys_state->cgroup as safe under RCU read lock. This will enable accessing css->cgroup from a bpf css iterator. Signed-off-by: Song Liu Link: https://lore.kernel.org/20250623063854.1896364-4-song@kernel.org Acked-by: Tejun Heo Signed-off-by: Christian Brauner commit b95ee9049c93b05da66599d6e0d1fcfea291360b Author: Song Liu Date: Sun Jun 22 23:38:52 2025 -0700 bpf: Introduce bpf_cgroup_read_xattr to read xattr of cgroup's node BPF programs, such as LSM and sched_ext, would benefit from tags on cgroups. One common practice to apply such tags is to set xattrs on cgroupfs folders. Introduce kfunc bpf_cgroup_read_xattr, which allows reading cgroup's xattr. Note that, we already have bpf_get_[file|dentry]_xattr. However, these two APIs are not ideal for reading cgroupfs xattrs, because: 1) These two APIs only works in sleepable contexts; 2) There is no kfunc that matches current cgroup to cgroupfs dentry. bpf_cgroup_read_xattr is generic and can be useful for many program types. It is also safe, because it requires trusted or rcu protected argument (KF_RCU). Therefore, we make it available to all program types. Signed-off-by: Song Liu Link: https://lore.kernel.org/20250623063854.1896364-3-song@kernel.org Acked-by: Tejun Heo Signed-off-by: Christian Brauner commit fb7b30cb0e31bce904b4ec6a20e863351f9fee82 Author: Christian Brauner Date: Sun Jun 22 23:38:51 2025 -0700 kernfs: remove iattr_mutex All allocations of struct kernfs_iattrs are serialized through a global mutex. Simply do a racy allocation and let the first one win. I bet most callers are under inode->i_rwsem anyway and it wouldn't be needed but let's not require that. Acked-by: Greg Kroah-Hartman Acked-by: Tejun Heo Signed-off-by: Song Liu Link: https://lore.kernel.org/20250623063854.1896364-2-song@kernel.org Signed-off-by: Christian Brauner commit d97394bf381eda85d04bec68b72dbc397744fcc3 Author: Shiji Yang Date: Wed Jun 18 22:53:17 2025 +0800 MIPS: lantiq: irq: fix misc missing-prototypes warnings Fix the following build warnings: arch/mips/lantiq/irq.c:340:12: error: no previous prototype for 'icu_of_init' [-Werror=missing-prototypes] 340 | int __init icu_of_init(struct device_node *node, struct device_node *parent) | ^~~~~~~~~~~ arch/mips/lantiq/irq.c:418:5: error: no previous prototype for 'get_c0_perfcount_int' [-Werror=missing-prototypes] 418 | int get_c0_perfcount_int(void) | ^~~~~~~~~~~~~~~~~~~~ arch/mips/lantiq/irq.c:424:14: error: no previous prototype for 'get_c0_compare_int' [-Werror=missing-prototypes] 424 | unsigned int get_c0_compare_int(void) | ^~~~~~~~~~~~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit c714186debb45fc88098b666d46cb29ff728e06d Author: Shiji Yang Date: Wed Jun 18 22:53:16 2025 +0800 MIPS: lantiq: xway: mark dcdc_init() as static Fix the following missing-prototypes build warning: arch/mips/lantiq/xway/dcdc.c:49:12: error: no previous prototype for 'dcdc_init' [-Werror=missing-prototypes] 49 | int __init dcdc_init(void) | ^~~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit 50162a0c6e014c4954ee4443109b7a4251b377fc Author: Shiji Yang Date: Wed Jun 18 22:53:19 2025 +0800 MIPS: pci: lantiq: marks pcibios_init() as static Fix the following missing-prototypes build warning: arch/mips/pci/pci-lantiq.c:239:12: error: no previous prototype for 'pcibios_init' [-Werror=missing-prototypes] 239 | int __init pcibios_init(void) | ^~~~~~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit cff836f0bb0c53fcf43c12e32ee499cdf7e4a584 Author: Shiji Yang Date: Wed Jun 18 22:53:15 2025 +0800 MIPS: lantiq: xway: mark dma_init() as static Fix the following missing-prototypes build warning: arch/mips/lantiq/xway/dma.c:293:1: error: no previous prototype for 'dma_init' [-Werror=missing-prototypes] 293 | dma_init(void) | ^~~~~~~~ Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit 3376910ff827e11976633bd28d3e43e24131eefe Author: Huacai Chen Date: Sun Jun 8 22:20:10 2025 +0800 MIPS/Loongson: Fix build warnings about export.h After commit a934a57a42f64a4 ("scripts/misc-check: check missing #include when W=1") and 7d95680d64ac8e836c ("scripts/misc-check: check unnecessary #include when W=1"), we get some build warnings with W=1: arch/mips/loongson64/setup.c: warning: EXPORT_SYMBOL() is not used, but #include is present So fix these build warnings for MIPS/Loongson. Signed-off-by: Huacai Chen Reviewed-by: Masahiro Yamada Signed-off-by: Thomas Bogendoerfer commit 67979060740f7f978c8cb580ccea6c91154150f9 Author: Michal Wajdeczko Date: Fri Jun 27 20:41:43 2025 +0200 drm/xe/hw_engine_group: Fix potential leak If we fail to allocate a workqueue we will leak kzalloc'ed group object since it was designed to be kfree'ed in the drmm cleanup action, but we didn't have a chance to register this action yet. To avoid this leak allocate a group object using drmm_kzalloc() and start using predefined drmm action to release the workqueue. Signed-off-by: Michal Wajdeczko Cc: Francois Dugast Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250627184143.1480-1-michal.wajdeczko@intel.com commit 9591220e7a6c12c788b1fc013c39af26edf99538 Author: Geert Uytterhoeven Date: Tue Jun 10 15:28:04 2025 +0200 MIPS: txx9: Constify bin_attribute arguments of txx9_sram_{read,write}() If CONFIG_MACH_TX49XX=y: arch/mips/txx9/generic/setup.c: In function ‘txx9_sramc_init’: arch/mips/txx9/generic/setup.c:839:32: error: assignment to ‘ssize_t (*)(struct file *, struct kobject *, const struct bin_attribute *, char *, loff_t, size_t)’ {aka ‘long int (*)(struct file *, struct kobject *, const struct bin_attribute *, char *, long long int, long unsigned int)’} from incompatible pointer type ‘ssize_t (*)(struct file *, struct kobject *, struct bin_attribute *, char *, loff_t, size_t)’ {aka ‘long int (*)(struct file *, struct kobject *, struct bin_attribute *, char *, long long int, long unsigned int)’} [-Werror=incompatible-pointer-types] 839 | dev->bindata_attr.read = txx9_sram_read; | ^ arch/mips/txx9/generic/setup.c:840:33: error: assignment to ‘ssize_t (*)(struct file *, struct kobject *, const struct bin_attribute *, char *, loff_t, size_t)’ {aka ‘long int (*)(struct file *, struct kobject *, const struct bin_attribute *, char *, long long int, long unsigned int)’} from incompatible pointer type ‘ssize_t (*)(struct file *, struct kobject *, struct bin_attribute *, char *, loff_t, size_t)’ {aka ‘long int (*)(struct file *, struct kobject *, struct bin_attribute *, char *, long long int, long unsigned int)’} [-Werror=incompatible-pointer-types] 840 | dev->bindata_attr.write = txx9_sram_write; | ^ Fixes: 97d06802d10a2827 ("sysfs: constify bin_attribute argument of bin_attribute::read/write()") Signed-off-by: Geert Uytterhoeven Signed-off-by: Thomas Bogendoerfer commit de94259d064814b7eacd6d1f4b26e934eed02590 Author: Mieczyslaw Nalewaj Date: Wed Jun 18 23:40:26 2025 +0800 MIPS: pci-rt2880: make pcibios_init() static This function is only used in the current source file. Mark it as static to fix the compilation error: arch/mips/pci/pci-rt2880.c:267:12: error: no previous prototype for 'pcibios_init' [-Werror=missing-prototypes] 267 | int __init pcibios_init(void) | ^~~~~~~~~~~~ Signed-off-by: Mieczyslaw Nalewaj Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit f13e645e15f1a4a33f0709844dac1a962b335b16 Author: Mieczyslaw Nalewaj Date: Wed Jun 18 23:40:25 2025 +0800 MIPS: ralink: add missing header include Add the missing header "asm/time.h" which defines the function prototypes of get_c0_perfcount_int() and get_c0_compare_int(). This patch fixes the following build warnings: arch/mips/ralink/irq.c:86:5: error: no previous prototype for 'get_c0_perfcount_int' [-Werror=missing-prototypes] 86 | int get_c0_perfcount_int(void) | ^~~~~~~~~~~~~~~~~~~~ arch/mips/ralink/irq.c:92:14: error: no previous prototype for 'get_c0_compare_int' [-Werror=missing-prototypes] 92 | unsigned int get_c0_compare_int(void) | ^~~~~~~~~~~~~~~~~~ Signed-off-by: Mieczyslaw Nalewaj Signed-off-by: Shiji Yang Signed-off-by: Thomas Bogendoerfer commit e4442636a61ffffc10b21208de6cbf1132ddd769 Author: Chris Packham Date: Thu Jun 19 13:07:54 2025 +1200 mips: dts: realtek: Add gpio block The RTL9300 has a block of GPIOs included in the SoC. Add these to the devicetree. This is taken from openwrt[1] the differences are removing the unnecessary second cell from the interrupt and removing the -controller from the node name to conform to the dtschema. [1] - https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=target/linux/realtek/dts/rtl930x.dtsi Signed-off-by: Chris Packham Signed-off-by: Thomas Bogendoerfer commit 787981d189a04c90b66e2d334bbdf83e9f284340 Author: Chris Packham Date: Thu Jun 19 13:07:53 2025 +1200 mips: dts: realtek: Add watchdog The RTL9300 has an integrated watchdog. Add this to the devicetree. This is taken from openwrt[1] the only difference is removing the unnecessary second cell from the interrupts. [1] - https://git.openwrt.org/?p=openwrt/openwrt.git;a=blob;f=target/linux/realtek/dts/rtl930x.dtsi Signed-off-by: Chris Packham Signed-off-by: Thomas Bogendoerfer commit 1931e4ccb9dcfd1b45508ba59d20fa25175914a0 Author: Chris Packham Date: Thu Jun 19 13:07:52 2025 +1200 mips: dts: realtek: Add switch interrupts Add interrupts for the rtl9301-switch. Signed-off-by: Chris Packham Signed-off-by: Thomas Bogendoerfer commit 971665c0af5d6ec50c1bf9e7927564f180f29c66 Author: Chris Packham Date: Thu Jun 19 13:07:51 2025 +1200 mips: dts: cameo-rtl9302c: Add switch block Add the switch port and phys to the cameo-rtl9302c-2x-rtl8224-2xge board. Signed-off-by: Chris Packham Signed-off-by: Thomas Bogendoerfer commit 1306996722a9b37d3582dc117be64134096b7641 Author: Ezra Buehler Date: Tue Jun 24 13:58:10 2025 +0200 MIPS: dts: ralink: gardena_smart_gateway_mt7688: Fix power LED When starting up, the GARDENA smart Gateway's power LED should be flashing green. It is unclear why it was initially set to "off". The LED frequency cannot be configured in the devicetree. Luckily, the default is 1 Hz, which is what we want. Signed-off-by: Ezra Buehler Reviewed-by: Stefan Roese Reviewed-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 87eaf31f91c9053f21d6a7e6c46cb8cde7df7b27 Author: Ezra Buehler Date: Tue Jun 24 13:58:09 2025 +0200 MIPS: dts: ralink: mt7628a: Update watchdog node according to bindings Most notably, add the mediatek,sysctl phandle and remove the redundant reset/interrupt-related properties from the watchdog node. This is in line with the corresponding devicetree (mt7628an.dtsi) used by the OpenWrt project. This has been tested on the MT7688-based GARDENA smart Gateway. Signed-off-by: Ezra Buehler Reviewed-by: Stefan Roese Reviewed-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 0e029c91a7ec029f859bc878144aa09625415e45 Author: Ezra Buehler Date: Tue Jun 24 13:58:08 2025 +0200 MIPS: dts: ralink: mt7628a: Fix sysc's compatible property for MT7688 Otherwise, the MT7688-based GARDENA smart Gateway will fail to boot printing "Kernel panic - not syncing: unable to get CPU clock, err=-2". Signed-off-by: Ezra Buehler Reviewed-by: Stefan Roese Acked-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 292f0b50d3918220663cf6416ce2fdc2928d2e34 Author: Ezra Buehler Date: Tue Jun 24 13:58:07 2025 +0200 dt-bindings: clock: mediatek,mtmips-sysc: Adapt compatible for MT7688 boards As the MT7628 and MT7688 are identical in most respects, mt7628a.dtsi is used for both SoCs. To prevent "Kernel panic - not syncing: unable to get CPU clock, err=-2" and allow an MT7688-based board to boot, the following must be allowed: compatible = "ralink,mt7628-sysc", "ralink,mt7688-sysc", "syscon"; Signed-off-by: Ezra Buehler Reviewed-by: Krzysztof Kozlowski Acked-by: Sergio Paracuellos Signed-off-by: Thomas Bogendoerfer commit 002d90627cdbf7efd16f0846a814889409e42f07 Author: Andy Shevchenko Date: Thu Jun 26 20:59:26 2025 +0300 firmware/nvram: bcm47xx: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Signed-off-by: Andy Shevchenko Reviewed-by: Florian Fainelli Signed-off-by: Thomas Bogendoerfer commit b4cd18f485687a2061ee7a0ce6833851fc4438da Author: Suraj Kandpal Date: Tue Jul 1 14:20:54 2025 +0530 drm/dp: Add documentation for luminance_set Documentation for luminance_set for struct drm_edp_backlight_info was missed which causes warnings. Fixes: 2af612ad4290 ("drm/dp: Introduce new member in drm_backlight_info") Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250701085054.746408-1-suraj.kandpal@intel.com commit 88e326b3316a8c6d86c528d31a8da31444716d73 Merge: be91bf40a96d56 4f30f946f27b7f Author: Ilpo Järvinen Date: Wed Jul 2 13:21:23 2025 +0300 Merge branch 'fixes' into for-next Merge fixes back into for-next to be able to take dell_rbu change that is build on top of fixes material, and to bring lenovo related changes in sync after the move under lenovo/ subdir in the for-next branch and diverging changes in the fixes branch. commit 34d340d48e595f8dfd4e72fe4100d2579dbe4a1a Author: Prasad Kumpatla Date: Tue Jul 1 15:59:15 2025 +0530 ASoC: qcom: sc8280xp: Add support for QCS8275 Add compatible for sound card on Qualcomm QCS8275 boards. Signed-off-by: Prasad Kumpatla Link: https://patch.msgid.link/20250701102915.4016108-3-quic_pkumpatl@quicinc.com Signed-off-by: Mark Brown commit 3b8dc31715e31ab930d36ef7b98ffc714344e411 Author: Prasad Kumpatla Date: Tue Jul 1 15:59:14 2025 +0530 ASoC: dt-bindings: qcom,sm8250: Add QCS8275 sound card Add bindings for QCS8275 sound card, which looks fully compatible with existing SM8250. Signed-off-by: Prasad Kumpatla Link: https://patch.msgid.link/20250701102915.4016108-2-quic_pkumpatl@quicinc.com Signed-off-by: Mark Brown commit 0c0ef1d90967717b91cded41b00dbae05d8e521c Author: Venkata Prasad Potturu Date: Wed Jul 2 15:14:12 2025 +0530 ASoC: amd: acp: Enable acp7.2 platform based DMIC support in machine driver Enable acp7.2 platform based DMIC support in machine driver. Signed-off-by: Venkata Prasad Potturu Link: https://patch.msgid.link/20250702094425.155185-4-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown commit 3549725e0f7823d085403fc4219fd3df347a1ae4 Author: Venkata Prasad Potturu Date: Wed Jul 2 15:14:11 2025 +0530 ASoC: amd: acp: Enable I2S support for acp7.2 based platforms Enable I2S dai driver support for acp7.2 based platforms. Signed-off-by: Venkata Prasad Potturu Link: https://patch.msgid.link/20250702094425.155185-3-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown commit a3b0e80428c8e2aa50d7e3c75721dd7f5c76c4d9 Author: Venkata Prasad Potturu Date: Wed Jul 2 15:14:10 2025 +0530 ASoC: amd: acp: Add legacy driver support acp7.2 based platforms Add pci revision id 0x72 in pci and platform driver to support acp7.2 based platforms. Signed-off-by: Venkata Prasad Potturu Link: https://patch.msgid.link/20250702094425.155185-2-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown commit c343d58ed8b6b649ae8bf3a1a8dc2fc272ab39b5 Author: Dario Binacchi Date: Fri Jun 20 10:27:13 2025 +0200 ARM: dts: imx6ul: support Engicam MicroGEA GTW board Support Engicam MicroGEA GTW board with: - 256 Mbytes NAND Flash - 512 Mbytes DRAM DDR2 - Buttons - LEDs - Micro SD card connector - USB 2.0 high-speed/full-speed - Ethernet MAC Signed-off-by: Dario Binacchi Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit ffea3cac94ba5f43837acf6c42a4a2215e1e96a6 Author: Dario Binacchi Date: Fri Jun 20 10:27:11 2025 +0200 ARM: dts: imx6ul: support Engicam MicroGEA RMM board Support Engicam MicroGEA RMM board with: - 256 Mbytes NAND Flash - 512 Mbytes DRAM DDR2 - CAN - LEDs - Micro SD card connector - USB 2.0 high-speed/full-speed - Ethernet MAC Signed-off-by: Dario Binacchi Reviewed-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 02e0babff3f785c131f3a79ebf8c9014450335d0 Author: Dario Binacchi Date: Fri Jun 20 10:27:07 2025 +0200 ARM: dts: imx6ul: support Engicam MicroGEA BMM board Support Engicam MicroGEA BMM board with: - 256 Mbytes NAND Flash - 512 Mbytes DRAM DDR2 - CAN - Micro SD card connector - USB 2.0 high-speed/full-speed - Ethernet MAC Signed-off-by: Dario Binacchi Reviewed-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit a8281618e8a50f22082f7159900bc066abe7098c Author: Dario Binacchi Date: Fri Jun 20 10:27:06 2025 +0200 ARM: dts: imx6ul: support Engicam MicroGEA-MX6UL SoM Support Engicam MicroGEA-MX6UL SoM with: - 256 Mbytes NAND Flash - 512 Mbytes DRAM DDR2 - Ethernet MAC Signed-off-by: Dario Binacchi Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit cb35d3b62274ec4a0b9f9d18ef46fcc902784a92 Author: Damien Le Moal Date: Tue Jul 1 21:53:21 2025 +0900 ata: libata_eh: Add debug messages to ata_eh_link_set_lpm() To facilitate field debugging of link power management related issues, add a debug message to ata_eh_link_set_lpm() to easily track LPM policy changes done from EH context, that is, during device scan and revalidation, error handling, and when a policy change is issued through a host sysfs link_power_management_policy attribute. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250701125321.69496-11-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 3b50dd4c064d71f8f50a266b46d93537eeba782e Author: Damien Le Moal Date: Tue Jul 1 21:53:20 2025 +0900 ata: libata-core: Reduce the number of messages signaling broken LPM ata_dev_config_lpm() prints the message "LPM support broken, forcing max_power" for devices that have the ATA_QUIRK_NOLPM quirk flag set. This messages is repeated for every device revalidation, which is not necessary, but also erroneously printed for devices without a broken LPM support when connected to a port that does not support LPM (e.g. because the port is an external one with hotplug capability). Since in all cases the device port target_lpm_policy is set to ATA_LPM_MAX_POWER, avoid the "LPM broken" message repetition and erroneous output by generating it only if the port target_lpm_policy is not already set to ATA_LPM_MAX_POWER. This change will suppress the "LPM broken" message for genuine cases of a device having broken LPM if the initial LPM policy is set to ATA_LPM_MAX_POWER through CONFIG_SATA_MOBILE_LPM_POLICY. This is not a problem as the ATA_LPM_MAX_POWER policy implies that LPM is disabled and unused, which is safe for devices with broken LPM. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250701125321.69496-10-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 65b2c92f69d3df81422d27e5be012e357e733241 Author: Damien Le Moal Date: Tue Jul 1 21:53:19 2025 +0900 ata: ahci: Disallow LPM policy control if not supported Commit fa997b0576c9 ("ata: ahci: Do not enable LPM if no LPM states are supported by the HBA") introduced an early return in ahci_update_initial_lpm_policy() to ensure that the target_lpm_policy of ports belonging to a host that does not support the Partial, Slumber and DevSleep power states is unchanged and remains set to ATA_LPM_UNKNOWN and thus prevents the execution of ata_eh_link_set_lpm(). However, a user or a system daemon (e.g. systemd-udevd) may still attempt changing the LPM policy through the sysfs link_power_management_policy of the host. Improve this to prevent sysfs LPM policy changes by setting the flag ATA_FLAG_NO_LPM for the port of such host, and initialize the port target_lpm_policy to ATA_LPM_MAX_POWER to guarantee that no unsupported low power state is being used on the port and its link. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Niklas Cassel Link: https://lore.kernel.org/r/20250701125321.69496-9-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 4edf1505b76d30e1e1e283d431e4f84ad01ddcef Author: Damien Le Moal Date: Tue Jul 1 21:53:18 2025 +0900 ata: ahci: Disallow LPM policy control for external ports Commit ae1f3db006b7 ("ata: ahci: do not enable LPM on external ports") added an early return in ahci_update_initial_lpm_policy() for all ports flagged as external with the ATA_PFLAG_EXTERNAL port flag (e.g. eSATA ports or hotplug capable ports) so that the target_lpm_policy of these ports is unchanged and set to ATA_LPM_UNKNOWN. thus forcing libata EH to not be called for external port. The goal of this change is to preserve the initial power management policy to not break the hotplug capability of external ports. However, this change is incomplete as users or system daemon (e.g. systemd-udevd) can still apply the system preferred power management policy through sysfs, thus potentially unknowingly breaking the port hotplug capability. Modify ahci_update_initial_lpm_policy() to flag external ports with ATA_FLAG_NO_LPM to prevent changes to the LPM policy by users through the sysfs link_power_management_policy host attribute. Also set the target_lpm_policy of external ports to ATA_LPM_MAX_POWER to ensure that the port is not in a low power state preventing hotplug operations. Since commit 439d47608bb3 ("ata: libata: Print if port is external on boot") introduced an unconditional print on port probe signaling that a port is external, the debug message signaling that fact and that LPM will not be enabled is removed. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Niklas Cassel Link: https://lore.kernel.org/r/20250701125321.69496-8-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit f7870e8d345cdabfb94bcbdcba6a07e050f8705e Author: Damien Le Moal Date: Tue Jul 1 21:53:17 2025 +0900 ata: ahci: Disable DIPM if host lacks support The AHCI specification version 1.3.1 section 8.3.1.4 (Software Requirements and Precedence) states that: If CAP.SSC or CAP.PSC is cleared to ‘0’, software should disable device-initiated power management by issuing the appropriate SET FEATURES command to the device. To satisfy this constraint and force ata_dev_configure to disable the device DIPM feature, modify ahci_update_initial_lpm_policy() to set the ATA_FLAG_NO_DIPM flag on ports that have a host with either the ATA_HOST_NO_PART flag set or the ATA_HOST_NO_SSC flag set. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Hannes Reinecke Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250701125321.69496-7-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 413e800cadbf67550d76c77c230b2ecd96bce83a Author: Damien Le Moal Date: Tue Jul 1 21:53:16 2025 +0900 ata: libata-sata: Disallow changing LPM state if not supported Modify ata_scsi_lpm_store() to return an error if a user attempts to set a link power management policy for a port that does not support LPM, that is, ports flagged with ATA_FLAG_NO_LPM. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250701125321.69496-6-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 4371fe1ba40065c5e1dd6e8317f9df8ba50a3db7 Author: Damien Le Moal Date: Tue Jul 1 21:53:15 2025 +0900 ata: libata-eh: Avoid unnecessary resets when revalidating devices In ata_eh_revalidate_and_attach(), a link LPM policy is always set to ATA_LPM_MAX_POWER before calling ata_dev_revalidate() to ensure that the call to ata_phys_link_offline() does not return true, thus causing an unnecessary device reset. This change was introduced with commit 71d7b6e51ad3 ("ata: libata-eh: avoid needless hard reset when revalidating link"). However, setting the link LPM policy to ATA_LPM_MAX_POWER may be visible only after some time, depending on the power state the link was in. E.g. transitioning out of the Partial state should take no longer than a few microseconds, but transitioning out of the Slumber or DevSleep state may take several milliseconds. So despite the changes introduced with commit 71d7b6e51ad3 ("ata: libata-eh: avoid needless hard reset when revalidating link"), we can still endup with ata_phys_link_offline() seeing a link SCR_STATUS register signaling that the device is present (DET is equal to 1h) but that the link PHY is still in a low power mode (e.g. IPM is 2h, signaling "Interface in Partial power management state"). In such cases, ata_phys_link_offline() returns true, causing an EIO return for ata_eh_revalidate_and_attach() and a device reset. Avoid such unnecessary device resets by introducing a relaxed version of the link offline test implemented by ata_phys_link_offline() with the new helper function ata_eh_link_established(). This functions returns true if for the link SCR_STATUS register we see that: - A device is still present, that is, the DET field is 1h (Device presence detected but Phy communication not established) or 3h (Device presence detected and Phy communication established). - Communication is established, that is, the IPM field is not 0h, indicating that the PHY is online or in a low power state. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250701125321.69496-5-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit b1f5af54f1f5202ba0cd29a94e45ee7ac7517c0f Author: Damien Le Moal Date: Tue Jul 1 21:53:14 2025 +0900 ata: libata-core: Advertize device support for DIPM and HIPM features Modify ata_dev_print_features() to advertize if a device supports the Device Initiated Power Management (DIPM) and Host Initiated Power Management (HIPM) features. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250701125321.69496-4-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit d99a9142e782f34197dd7459a703ebc0971078e8 Author: Damien Le Moal Date: Tue Jul 1 21:53:13 2025 +0900 ata: libata-core: Move device LPM quirk settings to ata_dev_config_lpm() Move the various cases of setting the ATA_QUIRK_NOLPM quirk flag for a device in ata_dev_configure() to the function ata_dev_config_lpm(). This allows having all LPM related settings in one place to facilitate maintenance. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250701125321.69496-3-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit d360121832d8a36871249271df5b9ff05f835f62 Author: Damien Le Moal Date: Tue Jul 1 21:53:12 2025 +0900 ata: libata-core: Introduce ata_dev_config_lpm() If the port of a device does not support Device Initiated Power Management (DIPM), that is, the port is flagged with ATA_FLAG_NO_DIPM, the DIPM feature of a device should not be used. Though DIPM is disabled by default on a device, the "Software Settings Preservation feature" may keep DIPM enabled or DIPM may have been enabled by the system firmware. Introduce the function ata_dev_config_lpm() to always disable DIPM on a device that supports this feature if the port of the device is flagged with ATA_FLAG_NO_DIPM. ata_dev_config_lpm() is called from ata_dev_configure(), ensuring that a device DIPM feature is disabled when it cannot be used. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250701125321.69496-2-dlemoal@kernel.org Signed-off-by: Niklas Cassel commit 69c9acadd4d277c4ad5480f1f8c77c551075e6d3 Author: Dario Binacchi Date: Fri Jun 20 10:27:12 2025 +0200 dt-bindings: arm: fsl: support Engicam MicroGEA GTW board Add devicetree bindings for Engicam MicroGEA GTW board based on the Engicam MicroGEA SoM (System-on-Module). Signed-off-by: Dario Binacchi Acked-by: Conor Dooley Signed-off-by: Shawn Guo commit 73ee9b11878a41f5677054be39ce7f9e8f63fa72 Author: Dario Binacchi Date: Fri Jun 20 10:27:10 2025 +0200 dt-bindings: arm: fsl: support Engicam MicroGEA RMM board Add devicetree bindings for Engicam MicroGEA RMM board based on the Engicam MicroGEA SoM (System-on-Module). Signed-off-by: Dario Binacchi Acked-by: Conor Dooley Signed-off-by: Shawn Guo commit 3d1678688810ddf1fc1746c1b992b72e1c1ec89a Author: Dario Binacchi Date: Fri Jun 20 10:27:05 2025 +0200 dt-bindings: arm: fsl: support Engicam MicroGEA BMM board Add devicetree bindings for Engicam MicroGEA BMM board based on the Engicam MicroGEA SoM (System-on-Module). The use of an enum for a single element is justified by the future addition of other boards based on the same SoM. Signed-off-by: Dario Binacchi Acked-by: Conor Dooley Signed-off-by: Shawn Guo commit 0c7124658677885b603f1748fb997b3bdc87dc69 Author: Dario Binacchi Date: Fri Jun 20 10:27:14 2025 +0200 ARM: imx_v6_v7_defconfig: select CONFIG_USB_HSIC_USB3503 The driver is required by the Engicam MicroGEA GTW board. Signed-off-by: Dario Binacchi Signed-off-by: Shawn Guo commit 128fe144e7b86ee53cccef7021312157fda311f0 Author: Dario Binacchi Date: Fri Jun 20 10:27:09 2025 +0200 ARM: imx_v6_v7_defconfig: select CONFIG_INPUT_PWM_BEEPER The driver is required by the Engicam MicroGEA BMM board. Signed-off-by: Dario Binacchi Signed-off-by: Shawn Guo commit 8adba3555dfdd93b360cbf1cd1f7aa72da5b1c98 Author: Dario Binacchi Date: Fri Jun 20 10:27:08 2025 +0200 ARM: imx_v6_v7_defconfig: cleanup with savedefconfig Generate imx_v6_v7_defconfig by doing: make imx_v6_v7_defconfig make savedefconfig cp defconfig arch/arm/configs/imx_v6_v7_defconfig No functional change. The goal here is to cleanup imx_v6_v7_defconfig file to make easier and cleaner the addition of new entries. Signed-off-by: Dario Binacchi Signed-off-by: Shawn Guo commit a975fea5b9ff96d96c74758cbe17da0451f2de07 Author: Jani Nikula Date: Thu Jun 26 22:26:32 2025 +0300 drm/i915/power: use intel_de_wait_for_clear() instead of wait_for() Prefer the register read specific wait function over i915 wait_for_us(). The existing condition is quite complicated. Simplify by checking for requesters first, and determine timeout based on that. Refresh requesters in case of timeouts, should one have popped up during the wait. The downside is that this does not cut the wait short if requesters show up *during* the wait, but we're talking about 1 ms so shouldn't be an issue. v2: Refresh requesters only if there were none before (Imre) Cc: Imre Deak Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/20250626192632.2330349-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 1db50f7b7a793670adcf062df9ff27798829d963 Author: Thomas Fourier Date: Mon Jun 30 11:23:46 2025 +0200 Fix dma_unmap_sg() nents value The dma_unmap_sg() functions should be called with the same nents as the dma_map_sg(), not the value the map function returned. Fixes: ed10435d3583 ("RDMA/erdma: Implement hierarchical MTT") Signed-off-by: Thomas Fourier Link: https://patch.msgid.link/20250630092346.81017-2-fourier.thomas@gmail.com Signed-off-by: Leon Romanovsky commit 449728196d65fce513dbacf4d3696764be1c6524 Author: Parav Pandit Date: Thu Jun 26 21:58:12 2025 +0300 RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters Currently, the capability check is done in the default init_user_ns user namespace. When a process runs in a non default user namespace, such check fails. Since the RDMA device is a resource within a network namespace, use the network namespace associated with the RDMA device to determine its owning user namespace. Fixes: 1bd8e0a9d0fd ("RDMA/counter: Allow manual mode configuration support") Signed-off-by: Parav Pandit Link: https://patch.msgid.link/68e2064e72e94558a576fdbbb987681a64f6fea8.1750963874.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 28ea058a2979f063d4b756c5d82d885fc16f5ca2 Author: Parav Pandit Date: Thu Jun 26 21:58:11 2025 +0300 RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify Currently, the capability check is done in the default init_user_ns user namespace. When a process runs in a non default user namespace, such check fails. Due to this when a process is running using Podman, it fails to modify the QP. Since the RDMA device is a resource within a network namespace, use the network namespace associated with the RDMA device to determine its owning user namespace. Fixes: 0cadb4db79e1 ("RDMA/uverbs: Restrict usage of privileged QKEYs") Signed-off-by: Parav Pandit Link: https://patch.msgid.link/099eb263622ccdd27014db7e02fec824a3307829.1750963874.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit bd82467f17e0940c6f6a5396278cda586c9cb6fd Author: Parav Pandit Date: Thu Jun 26 21:58:10 2025 +0300 RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create Currently, the capability check is done in the default init_user_ns user namespace. When a process runs in a non default user namespace, such check fails. Due to this when a process is running using Podman, it fails to create the devx object. Since the RDMA device is a resource within a network namespace, use the network namespace associated with the RDMA device to determine its owning user namespace. Fixes: a8b92ca1b0e5 ("IB/mlx5: Introduce DEVX") Signed-off-by: Parav Pandit Link: https://patch.msgid.link/36ee87e92defd81410c6a2b33f9d6c0d6dcfd64c.1750963874.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 4b527c23c92dcc211446a8edb305d9514a8dae05 Author: Parav Pandit Date: Thu Jun 26 21:58:09 2025 +0300 RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create Currently, the capability check is done in the default init_user_ns user namespace. When a process runs in a non default user namespace, such check fails. Due to this when a process is running using Podman, it fails to create the QP. Since the RDMA device is a resource within a network namespace, use the network namespace associated with the RDMA device to determine its owning user namespace. Signed-off-by: Parav Pandit Link: https://patch.msgid.link/3914ef9702b01de8843a391ce397fca67d0fc7af.1750963874.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit b033bc5a9a7d95b8dc206dd7455a033b0670d8e7 Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:35 2025 +0200 gpio: tc3589x: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-12-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit f3c9b6a51cb31a8816feb801c8c8a2265432143e Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:34 2025 +0200 gpio: tangier: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-11-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit c203705c9b46ad0b66ef3bdc93ec9073b00efed1 Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:33 2025 +0200 gpio: syscon: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-10-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit e87dff29ff6b919f64ca25b066c44bbacdc08ac3 Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:32 2025 +0200 gpio: stp-xway: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-9-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit c9148553ac13565ad06d83d7baebef133245ebe6 Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:31 2025 +0200 gpio: stmpe: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-8-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit ae35dd91ad2ea4ae446e74364edd6428a26f5080 Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:30 2025 +0200 gpio: sprd: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Baolin Wang Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-7-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit 70c8f51ff68147176a41d549587a67ea377ed2e2 Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:29 2025 +0200 gpio: spear-spics: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-6-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit e9a5f9ac245fd58b8477f1d2fe5a077803631460 Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:28 2025 +0200 gpio: spear-spics: remove unneeded callbacks GPIO core can handle output-only chips that don't implement the get() and direction_input() callbacks. There's no need to provide dummy implementations in the driver so drop them. Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-5-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit d5297b0f861a124efe7965619212a632d5138281 Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:27 2025 +0200 gpio: siox: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Acked-by: Thorsten Scherer Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-4-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit 883c7eb2c4a9e143b2662ba754f9c16fb31adced Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:26 2025 +0200 gpio: sch: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-3-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit e932e894aec6ee22d7314f74e0a27db244a14fdb Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:25 2025 +0200 gpio: sch311x: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-2-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit df213abe6913cae8d1d69efa66b725831f63e663 Author: Bartosz Golaszewski Date: Wed Jun 25 12:33:24 2025 +0200 gpio: sama5d2-piobu: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250625-gpiochip-set-rv-gpio-round2-v1-1-bc110a3b52ff@linaro.org Signed-off-by: Bartosz Golaszewski commit 34e61ba8193945c90f1bcaa9d595fc05c586663d Author: Bartosz Golaszewski Date: Wed Jun 25 10:12:22 2025 +0200 gpio: pisosr: remove unneeded direction_output() callback GPIO core can handle input-only chips that don't implement the direction_output() callback at all. There's no need for the driver to provide a dummy implementation so drop it. Link: https://lore.kernel.org/r/20250625081222.12744-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit 94f39804d891cffe4ce17737d295f3b195bc7299 Author: Aakash Kumar S Date: Mon Jun 30 18:08:56 2025 +0530 xfrm: Duplicate SPI Handling The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI Netlink message, which triggers the kernel function xfrm_alloc_spi(). This function is expected to ensure uniqueness of the Security Parameter Index (SPI) for inbound Security Associations (SAs). However, it can return success even when the requested SPI is already in use, leading to duplicate SPIs assigned to multiple inbound SAs, differentiated only by their destination addresses. This behavior causes inconsistencies during SPI lookups for inbound packets. Since the lookup may return an arbitrary SA among those with the same SPI, packet processing can fail, resulting in packet drops. According to RFC 4301 section 4.4.2 , for inbound processing a unicast SA is uniquely identified by the SPI and optionally protocol. Reproducing the Issue Reliably: To consistently reproduce the problem, restrict the available SPI range in charon.conf : spi_min = 0x10000000 spi_max = 0x10000002 This limits the system to only 2 usable SPI values. Next, create more than 2 Child SA. each using unique pair of src/dst address. As soon as the 3rd Child SA is initiated, it will be assigned a duplicate SPI, since the SPI pool is already exhausted. With a narrow SPI range, the issue is consistently reproducible. With a broader/default range, it becomes rare and unpredictable. Current implementation: xfrm_spi_hash() lookup function computes hash using daddr, proto, and family. So if two SAs have the same SPI but different destination addresses, then they will: a. Hash into different buckets b. Be stored in different linked lists (byspi + h) c. Not be seen in the same hlist_for_each_entry_rcu() iteration. As a result, the lookup will result in NULL and kernel allows that Duplicate SPI Proposed Change: xfrm_state_lookup_spi_proto() does a truly global search - across all states, regardless of hash bucket and matches SPI and proto. Signed-off-by: Aakash Kumar S Acked-by: Herbert Xu Signed-off-by: Steffen Klassert commit 4a26df233266a628157d7f0285451d8655defdfc Author: Dan Carpenter Date: Tue Jul 1 17:30:01 2025 -0500 cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() The freq_tables[] array has num_possible_cpus() elements so, to avoid an out of bounds access, this loop should be capped at "< nb_cpus" instead of "<= nb_cpus". The freq_tables[] array is allocated in armada_8k_cpufreq_init(). Cc: stable@vger.kernel.org Fixes: f525a670533d ("cpufreq: ap806: add cpufreq driver for Armada 8K") Signed-off-by: Dan Carpenter Signed-off-by: Viresh Kumar commit bf4e6e3331effa91fdf7cac6b5dd7ff4ec18c227 Author: Dmitry Torokhov Date: Wed Feb 19 09:14:23 2025 -0800 Input: remove special handling of id->driver_info when matching evdev has switched to match on EV_SYN instead of relying on non-zero driver_info field to allow matching to all devices. Remove special handling from input core. Signed-off-by: Dmitry Torokhov commit 84060ea3e0b6294abde57b85502ccf9fa65f94de Author: Dmitry Torokhov Date: Tue Feb 18 15:09:21 2025 -0800 Input: evdev - switch matching to EV_SYN Each input device has EV_SYN capability. This is enforced by the input core which sets this capability bit unconditionally in input_register_device(). Switch evdev matching from declaring non-zero id->driver_info to match on EV_SYN so that special handling can be removed from input_match_device() and "driver_info" field can be removed from input_device_id structure. Signed-off-by: Dmitry Torokhov commit e96ee511c906c59b7c4e6efd9d9b33917730e000 Author: Uwe Kleine-König Date: Fri Jun 27 12:22:20 2025 +0200 net: tulip: Rename PCI driver struct to end in _driver This is not only a cosmetic change because the section mismatch checks also depend on the name and for drivers the checks are stricter than for ops. However xircom_driver also passes the stricter checks just fine, so no further changes needed. Signed-off-by: Uwe Kleine-König Link: https://patch.msgid.link/20250627102220.1937649-2-u.kleine-koenig@baylibre.com Signed-off-by: Jakub Kicinski commit 9e0bd6db622c7c19aec5a8b248bb34493c9998e6 Author: Masahiro Yamada Date: Wed Jun 25 00:05:49 2025 +0900 kconfig: gconf: remove GtkHandleBox from glade GtkHandleBox is deprecated with GTK 3.4. [1] [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/3.4.0/gtk/deprecated/gtkhandlebox.c#L426 Signed-off-by: Masahiro Yamada commit c34d632370592cb503991728afdf5287b2d1f7ed Author: Masahiro Yamada Date: Wed Jun 25 00:05:48 2025 +0900 kconfig: gconf: use gtk_dialog_get_content_area() accessor GTK 3 removes many implementation details and struct members from its public headers. Use the gtk_check_menu_item_get_active() accessor. [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/2.24.33/docs/reference/gtk/compiling.sgml#L85 Signed-off-by: Masahiro Yamada commit 07944f94fc8c02344f283e461b1ea817a9108e17 Author: Masahiro Yamada Date: Wed Jun 25 00:05:47 2025 +0900 kconfig: gconf: use gtk_check_menu_item_get_active() accessor GTK 3 removes many implementation details and struct members from its public headers. Use the gtk_check_menu_item_get_active() accessor. [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/2.24.33/docs/reference/gtk/compiling.sgml#L85 Signed-off-by: Masahiro Yamada commit ea1438f720aa2fa287237fbeb7e76a1e83a10af8 Author: Masahiro Yamada Date: Wed Jun 25 00:05:46 2025 +0900 kconfig: gconf: remove unnecessary default message in text view This message looks odd because it is displayed when nothing is selected. Signed-off-by: Masahiro Yamada commit b9ac2ae0008d0bd2dbd72a92e01b0c0e9b4359f5 Author: Uwe Kleine-König Date: Mon Jun 30 18:44:07 2025 +0200 net: atlantic: Rename PCI driver struct to end in _driver This is not only a cosmetic change because the section mismatch checks (implemented in scripts/mod/modpost.c) also depend on the object's name and for drivers the checks are stricter than for ops. However aq_pci_driver also passes the stricter checks just fine, so no further changes needed. The cheating^Wmisleading name was introduced in commit 97bde5c4f909 ("net: ethernet: aquantia: Support for NIC-specific code") Signed-off-by: Uwe Kleine-König Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250630164406.57589-2-u.kleine-koenig@baylibre.com Signed-off-by: Jakub Kicinski commit 6b9c9def95cb402374730d51a1f44927f467b774 Author: Lucien.Jheng Date: Mon Jun 30 23:41:47 2025 +0800 net: phy: air_en8811h: Introduce resume/suspend and clk_restore_context to ensure correct CKO settings after network interface reinitialization. If the user reinitializes the network interface, the PHY will reinitialize, and the CKO settings will revert to their initial configuration(be enabled). To prevent CKO from being re-enabled, en8811h_clk_restore_context and en8811h_resume were added to ensure the CKO settings remain correct. Signed-off-by: Lucien.Jheng Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250630154147.80388-1-lucienzx159@gmail.com Signed-off-by: Jakub Kicinski commit 9d0e47c4c879dfbaa1f407ecbd4176682f711871 Author: Masahiro Yamada Date: Wed Jun 25 00:05:45 2025 +0900 kconfig: gconf: replace "tooltip" property with "tooltip-text" This is no longer available in GTK 3. Use "tooltip-text" instead. Also reword "Goes up of one level" to "Goes up one level" while I am here. Signed-off-by: Masahiro Yamada commit 10c38949e0f5d832b23963e2bbfe398dcad9f52e Author: Christophe JAILLET Date: Sun Jun 29 23:06:38 2025 +0200 net: dsa: hellcreek: Constify struct devlink_region_ops and struct hellcreek_fdb_entry 'struct devlink_region_ops' and 'struct hellcreek_fdb_entry' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 55320 19216 320 74856 12468 drivers/net/dsa/hirschmann/hellcreek.o After: ===== text data bss dec hex filename 55960 18576 320 74856 12468 drivers/net/dsa/hirschmann/hellcreek.o Signed-off-by: Christophe JAILLET Reviewed-by: Kurt Kanzenbach Link: https://patch.msgid.link/2f7e8dc30db18bade94999ac7ce79f333342e979.1751231174.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit 215891acb49fe83fc39a95679132acde5440bdb1 Merge: a63b5a0bb740f6 3bedaff19bd8b3 Author: Jakub Kicinski Date: Tue Jul 1 19:32:46 2025 -0700 Merge branch 'seg6-fix-typos-in-comments-within-the-srv6-subsystem' Andrea Mayer says: ==================== seg6: fix typos in comments within the SRv6 subsystem In this patchset, we correct some typos found both in the SRv6 Endpoints implementation (i.e., seg6local) and in some SRv6 selftests, using codespell. ==================== Link: https://patch.msgid.link/20250629171226.4988-1-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski commit 3bedaff19bd8b3fa8a86191c9979e19c6d061010 Author: Andrea Mayer Date: Sun Jun 29 19:12:26 2025 +0200 selftests: seg6: fix instaces typo in comments Fix a typo: instaces -> instances The typo has been identified using codespell, and the tool does not report any additional issues in the selftests considered. Signed-off-by: Andrea Mayer Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250629171226.4988-3-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski commit db3e2ceab3c78c3b8c2f8e2503417064630fbafb Author: Andrea Mayer Date: Sun Jun 29 19:12:25 2025 +0200 seg6: fix lenghts typo in a comment Fix a typo: lenghts -> length The typo has been identified using codespell, and the tool currently does not report any additional issues in comments. Signed-off-by: Andrea Mayer Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250629171226.4988-2-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski commit a63b5a0bb740f64709a28200bf0788c7112be8fb Author: Christophe JAILLET Date: Sun Jun 29 14:35:50 2025 +0200 net: dsa: mv88e6xxx: Use kcalloc() Use kcalloc() instead of hand writing it. This is less verbose. Also move the initialization of 'count' to save some LoC. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 18652 5920 64 24636 603c drivers/net/dsa/mv88e6xxx/devlink.o After: ===== text data bss dec hex filename 18498 5920 64 24482 5fa2 drivers/net/dsa/mv88e6xxx/devlink.o Signed-off-by: Christophe JAILLET Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/2f4fca4ff84950da71e007c9169f18a0272476f3.1751200453.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit ff2d4cfdaf91891b22117414133736f3e3d2f481 Author: Christophe JAILLET Date: Sun Jun 29 14:35:49 2025 +0200 net: dsa: mv88e6xxx: Constify struct devlink_region_ops and struct mv88e6xxx_region 'struct devlink_region_ops' and 'struct mv88e6xxx_region' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 18076 6496 64 24636 603c drivers/net/dsa/mv88e6xxx/devlink.o After: ===== text data bss dec hex filename 18652 5920 64 24636 603c drivers/net/dsa/mv88e6xxx/devlink.o Signed-off-by: Christophe JAILLET Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/46040062161dda211580002f950a6d60433243dc.1751200453.git.christophe.jaillet@wanadoo.fr Signed-off-by: Jakub Kicinski commit fad9cf216597a71936ac87143d1618fbbcf97cbe Author: Eric Work Date: Sat Jun 28 22:15:28 2025 -0700 net: atlantic: add set_power to fw_ops for atl2 to fix wol Aquantia AQC113(C) using ATL2FW doesn't properly prepare the NIC for enabling wake-on-lan. The FW operation `set_power` was only implemented for `hw_atl` and not `hw_atl2`. Implement the `set_power` functionality for `hw_atl2`. Tested with both AQC113 and AQC113C devices. Confirmed you can shutdown the system and wake from S5 using magic packets. NIC was previously powered off when entering S5. If the NIC was configured for WOL by the Windows driver, loading the atlantic driver would disable WOL. Partially cherry-picks changes from commit, https://github.com/Aquantia/AQtion/commit/37bd5cc Attributing original authors from Marvell for the referenced commit. Closes: https://github.com/Aquantia/AQtion/issues/70 Co-developed-by: Igor Russkikh Co-developed-by: Mark Starovoitov Co-developed-by: Dmitry Bogdanov Co-developed-by: Pavel Belous Co-developed-by: Nikita Danilov Signed-off-by: Eric Work Reviewed-by: Igor Russkikh Link: https://patch.msgid.link/20250629051535.5172-1-work.eric@gmail.com Signed-off-by: Jakub Kicinski commit fbe346ce9d626680a4dd0f079e17c7b5dd32ffad Author: Haiyang Zhang Date: Fri Jun 27 13:26:23 2025 -0700 net: mana: Handle Reset Request from MANA NIC Upon receiving the Reset Request, pause the connection and clean up queues, wait for the specified period, then resume the NIC. In the cleanup phase, the HWC is no longer responding, so set hwc_timeout to zero to skip waiting on the response. Signed-off-by: Haiyang Zhang Link: https://patch.msgid.link/1751055983-29760-1-git-send-email-haiyangz@linux.microsoft.com Signed-off-by: Jakub Kicinski commit f461c7a885d9d625137b897cd63fa236e92e03c4 Author: Oleksij Rempel Date: Fri Jun 27 13:25:39 2025 +0200 phy: micrel: add Signal Quality Indicator (SQI) support for KSZ9477 switch PHYs Add support for the Signal Quality Indicator (SQI) feature on KSZ9477 family switches, providing a relative measure of receive signal quality. The hardware exposes separate SQI readings per channel. For 1000BASE-T, all four channels are read. For 100BASE-TX, only one channel is reported, but which receive pair is active depends on Auto MDI-X negotiation, which is not exposed by the hardware. Therefore, it is not possible to reliably map the measured channel to a specific wire pair. This resolves an earlier discussion about how to handle multi-channel SQI. Originally, the plan was to expose all channels individually. However, since pair mapping is sometimes unavailable, this implementation treats SQI as a per-link metric instead. This fallback avoids ambiguity and ensures consistent behavior. The existing get_sqi() UAPI was designed for single-pair Ethernet (SPE), where per-pair and per-link are effectively equivalent. Restricting its use to per-link metrics does not introduce regressions for existing users. The raw 7-bit SQI value (0–127, lower is better) is converted to the standard 0–7 (high is better) scale. Empirical testing showed that the link becomes unstable around a raw value of 8. The SQI raw value remains zero if no data is received, even if noise is present. This confirms that the measurement reflects the "quality" during active data reception rather than the passive line state. User space must ensure that traffic is present on the link to obtain valid SQI readings. Signed-off-by: Oleksij Rempel Link: https://patch.msgid.link/20250627112539.895255-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit ad452c27aeb80d1c3ee449250c3f790e7bd8ffaa Author: Masahiro Yamada Date: Wed Jun 25 00:05:44 2025 +0900 kconfig: gconf: remove "tooltips" property from glade The tips are still displayed without this. This property does not exist in GtkBuilder with GTK 3. Signed-off-by: Masahiro Yamada commit 7783290143b37c568538d8e699d81d1e6c8af72b Author: Masahiro Yamada Date: Wed Jun 25 00:05:43 2025 +0900 kconfig: gconf: replace GTK_STOCK_{OK,NO,CANCEL} These are deprecated with GTK 3.10. [1] Use "_OK", "_no", "_Cancel". [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/3.10.0/gtk/deprecated/gtkstock.h#L827 Signed-off-by: Masahiro Yamada commit 475c878f971661511fb3911af96c0ee0cb533527 Author: Masahiro Yamada Date: Wed Jun 25 00:05:42 2025 +0900 kconfig: gconf: replace GDK_space with GDK_KEY_space In GTK3, keysyms changed to have a KEY_ prefix. [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/2.24.33/gdk/gdkkeysyms-compat.h#L24 Signed-off-by: Masahiro Yamada commit bf5792da5ac14c5e95f1e8612df70096ee5a44d1 Author: Masahiro Yamada Date: Wed Jun 25 00:05:38 2025 +0900 kconfig: gconf: remove dead code in display_tree_part() This function is no longer called in the FULL_VIEW mode, so remove the dead code. Signed-off-by: Masahiro Yamada commit 063a274a5e297720e18b3a1d7bbfe2d039e12192 Author: Masahiro Yamada Date: Wed Jun 25 00:05:37 2025 +0900 kconfig: gconf: inline display_list() into set_view_mode() This function is now only called by set_view_mode(), so inline it for simplicity. Signed-off-by: Masahiro Yamada commit 035c2f56f57432caa78378e3ab498a5fb9bd276b Author: Masahiro Yamada Date: Wed Jun 25 00:05:36 2025 +0900 kconfig: gconf: do not reconstruct tree store when a symbol is changed There is no need to reconstruct the entire tree store when a symbol's value changes. Simply call gtk_tree_store_set() to update the row data. Introduce update_trees() to factor out the common update logic. Signed-off-by: Masahiro Yamada commit 64285dc5c41fc7a031695c2c286a2bfef9eaf2c6 Author: Masahiro Yamada Date: Wed Jun 25 00:05:35 2025 +0900 kconfig: gconf: inline fill_row() into set_node() The row[] array is used to prepare data passed to set_node(), but this indirection is unnecessary. Squash fill_row() into set_node() and call gtk_tree_store_set() directly. Also, calling gdk_pixbuf_new_from_xpm_data() for every row is inefficient. Call it once and store the resulting pixbuf in a global variable. Signed-off-by: Masahiro Yamada commit ed332436f3ca8a130ee9fc49d0882af5fbc344ef Author: Masahiro Yamada Date: Wed Jun 25 00:05:34 2025 +0900 kconfig: gconf: remove init_tree_model() Move the relevant code into init_left_tree() or init_right_tree(). Signed-off-by: Masahiro Yamada commit b674af6ec8541151750b424520fc1acec32deae9 Author: Masahiro Yamada Date: Wed Jun 25 00:05:33 2025 +0900 kconfig: gconf: remove global 'model1' and 'model2' variables These variables are unnecessary because the current model can be retrieved using gtk_tree_view_get_model(). Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap commit e3795479366833d576f8e096be8ef9f42f9d124e Author: Masahiro Yamada Date: Wed Jun 25 00:05:32 2025 +0900 kconfig: gconf: use GtkTreeModelFilter to control row visibility Currently, update_tree() adds/removes entries to show/hide rows. This approach is extremely complicated. Use the tree model filter to control row visibility instead. Do not toggle the MENU_CHANGED flag, as it is hard to control this correctly. Signed-off-by: Masahiro Yamada commit ab026457d3f8132b62f6855840817467ea92671e Author: Masahiro Yamada Date: Wed Jun 25 00:05:31 2025 +0900 kconfig: gconf: preserve menu selection when switching view mode Preserve the current menu selection when switching to a different view mode, as it improves usability. Signed-off-by: Masahiro Yamada commit ecaa87d4e9c2820a376270955cd166cd77f82891 Author: Masahiro Yamada Date: Wed Jun 25 00:05:30 2025 +0900 kconfig: gconf: merge 'current' and 'browsed' global variables The 'current' (SINGLE view) and 'browsed' (SPLIT_VIEW) variables serve similar purposes and are not needed at the same time. Merge them. Signed-off-by: Masahiro Yamada commit 1bd81df0b1cc8d17b7818889c4c1cdf53415e606 Author: Masahiro Yamada Date: Wed Jun 25 00:05:29 2025 +0900 kconfig: gconf: remove global 'tree' variable Pass the tree store as a function parameter to make it clearer which tree is being updated. Signed-off-by: Masahiro Yamada commit 20f375cbfe4f7e3870226f68877c9285bd8401fe Author: Masahiro Yamada Date: Wed Jun 25 00:05:28 2025 +0900 kconfig: gconf: make introduction, about, license dialogs modal These are modal dialogs in xconfig. Make them modal in gconfig as well. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit b8f660aabcf2dbbd7e8f84c6341e015124bbfc4e Author: Masahiro Yamada Date: Wed Jun 25 00:05:27 2025 +0900 kconfig: gconf: refactor replace_button_icon() The "window" and "style" arguments for replace_button_icon() are now unused. Remove them and refactor the function accordingly. Signed-off-by: Masahiro Yamada commit 9517f47dbf8ab7a7e554e7b34563982cfc63c366 Author: Masahiro Yamada Date: Wed Jun 25 00:05:26 2025 +0900 kconfig: gconf: use GdkPixbuf in replace_button_icon() gdk_pixmap_create_from_xpm_d has been deprecated since version 2.22. Use a GdkPixbuf instead. You can use gdk_pixbuf_new_from_xpm_data() to create it. [1] [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/2.24.33/gdk/gdkpixmap.c#L742 Signed-off-by: Masahiro Yamada commit fd7fd8024c32ae2037f98d53198e42d5c597ca0b Author: Masahiro Yamada Date: Wed Jun 25 00:05:25 2025 +0900 kconfig: gconf: use GtkFileChooser in on_save_as1_activate() gtk_file_selection_new() is deprecated, and gtk_file_chooser_dialog_new() should be used instead. [1] [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/2.24.33/docs/reference/gtk/tmpl/gtkfilesel.sgml?ref_type=tags#L156 Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit 30dda0fdf7a6655bf180b61063087aed28812007 Author: Masahiro Yamada Date: Wed Jun 25 00:05:24 2025 +0900 kconfig: gconf: use GtkFileChooser in on_load1_activate() gtk_file_selection_new() is deprecated, and gtk_file_chooser_dialog_new() should be used instead. [1] [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/2.24.33/docs/reference/gtk/tmpl/gtkfilesel.sgml?ref_type=tags#L156 Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit 4d89059a722d9a562bfe6ee1e3941ccc3c6c70b6 Author: Masahiro Yamada Date: Wed Jun 25 00:05:23 2025 +0900 kconfig: gconf: add on_save_clicked() event handler The "clicked" event handler for GtkToolButton takes the GtkToolButton* as the first parameter. This is different from the existing on_save_activate() handler. Signed-off-by: Masahiro Yamada commit 59adbcd8051a222023f52cfac0143d927735b194 Author: Masahiro Yamada Date: Wed Jun 25 00:05:22 2025 +0900 kconfig: gconf: avoid hardcoding model* in on_treeview*_button_press_event() It is better not to hardcode model1 or model2 for consistency. Signed-off-by: Masahiro Yamada commit e6991e8004bf1ff8fc31b14833c4995672f18b04 Author: Masahiro Yamada Date: Wed Jun 25 00:05:21 2025 +0900 kconfig: gconf: avoid hardcoding model2 in renderer_edited() Although this is only used in the right tree view, it is better not to hardcode model2 for consistency. Signed-off-by: Masahiro Yamada commit cae9cdbcd9af044810bcceeb43a87accca47c71d Author: Masahiro Yamada Date: Wed Jun 25 00:05:20 2025 +0900 kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() The on_treeview2_cursor_changed() handler is connected to both the left and right tree views, but it hardcodes model2 (the GtkTreeModel of the right tree view). This is incorrect. Get the associated model from the view. Signed-off-by: Masahiro Yamada commit 3beae8659513550b6b82a4ccdc4d25be9497f208 Author: Masahiro Yamada Date: Wed Jun 25 00:05:19 2025 +0900 kconfig: gconf: make key_press_event work in left pane too Currently, on_treeview2_key_press_event() returns early for the tree1 widget. We can make it work on the left pane as well by avoiding the hardcoded use of model2. Signed-off-by: Masahiro Yamada commit e06b176bf1b4a779f76b686ab5230dce45a8360e Author: Masahiro Yamada Date: Wed Jun 25 00:05:18 2025 +0900 kconfig: gconf: remove glade_xml_signal_autoconnect() call Now that all signals are connected manually, this is no longer necessary. Signed-off-by: Masahiro Yamada commit 77e8ff988918de554e0176c4ce0064944935efb7 Author: Masahiro Yamada Date: Wed Jun 25 00:05:17 2025 +0900 kconfig: gconf: add static qualifiers to event handlers This fixes several -Wmissing-prototypes warnings. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap commit f0049c937d2f38ae208c06aa5ef114dac226d01c Author: Masahiro Yamada Date: Wed Jun 25 00:05:16 2025 +0900 kconfig: gconf: move button1 and save1 initialization code Move the relevant initialization code closer together. Signed-off-by: Masahiro Yamada commit 3e0fb3ef01584bcace87c42a4f96abacad624386 Author: Masahiro Yamada Date: Wed Jun 25 00:05:15 2025 +0900 kconfig: gconf: move the main window event handlers below This allows removal of the forward delcaration of on_save_activate(). Signed-off-by: Masahiro Yamada commit b22bbaea7f59ea1fa609462bed2eb075eea97586 Author: Masahiro Yamada Date: Wed Jun 25 00:05:14 2025 +0900 kconfig: gconf: grey out button for current view This clarifies which view is currently selected. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit 8d6b5c14ab0bdca5b8a7583ccbec4a092e3458bf Author: Masahiro Yamada Date: Wed Jun 25 00:05:13 2025 +0900 kconfig: gconf: refactor view setting code Factor out common code for setting the view into a new function, set_view_mode(). Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap commit 2867495dea86324e984fbafa09474bf92534b652 Author: Masami Hiramatsu (Google) Date: Tue Apr 1 00:36:29 2025 +0900 tracing: tprobe-events: Register tracepoint when enable tprobe event As same as fprobe, register tracepoint stub function only when enabling tprobe events. The major changes are introducing a list of tracepoint_user and its lock, and tprobe_event_module_nb, which is another module notifier for module loading/unloading. By spliting the lock from event_mutex and a module notifier for trace_fprobe, it solved AB-BA lock dependency issue between event_mutex and tracepoint_module_list_mutex. Link: https://lore.kernel.org/all/174343538901.843280.423773753642677941.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) commit 434f6703ce268470796496e67c703dfd85a3653c Author: Masami Hiramatsu (Google) Date: Tue Apr 1 00:36:20 2025 +0900 selftests: tracing: Enable fprobe events before checking enable_functions Since the fprobe is not registered before enabling the fprobe events, enable_functions is also empty before enabling it. Thus the tests which checking enable_functions must ensure the event is enabled before testing the enable_functions. Link: https://lore.kernel.org/all/174343538009.843280.6583146613234713007.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) commit 2db832ec9090d3b5f726f49ad4d0322d6b68a490 Author: Masami Hiramatsu (Google) Date: Tue Apr 1 00:36:11 2025 +0900 tracing: fprobe-events: Register fprobe-events only when it is enabled Currently fprobe events are registered when it is defined. Thus it will give some overhead even if it is disabled. This changes it to register the fprobe only when it is enabled. Link: https://lore.kernel.org/all/174343537128.843280.16131300052837035043.stgit@devnote2/ Suggested-by: Steven Rostedt Signed-off-by: Masami Hiramatsu (Google) commit e3d6e1b9a34c745b635f122ac471a198867cd0ec Author: Masami Hiramatsu (Google) Date: Tue Apr 1 00:36:02 2025 +0900 tracing: tprobe-events: Support multiple tprobes on the same tracepoint Allow user to set multiple tracepoint-probe events on the same tracepoint. After the last tprobe-event is removed, the tracepoint callback is unregistered. Link: https://lore.kernel.org/all/174343536245.843280.6548776576601537671.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) commit c135ab4a96e3f65abf83621a0efe007e64f224cf Author: Masami Hiramatsu (Google) Date: Tue Apr 1 00:35:53 2025 +0900 tracing: tprobe-events: Remove mod field from tprobe-event Remove unneeded 'mod' struct module pointer field from trace_fprobe because we don't need to save this info. Link: https://lore.kernel.org/all/174343535351.843280.5868426549023332120.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) commit ddb017ec9c3346e511f16dbae784a72eb91994dd Author: Masami Hiramatsu (Google) Date: Sat Mar 29 15:39:59 2025 +0900 tracing: probe-events: Cleanup entry-arg storing code Cleanup __store_entry_arg() so that it is easier to understand. The main complexity may come from combining the loops for finding stored-entry-arg and max-offset and appending new entry. This split those different loops into 3 parts, lookup the same entry-arg, find the max offset and append new entry. Link: https://lore.kernel.org/all/174323039929.348535.4705349977127704120.stgit@devnote2/ Signed-off-by: Masami Hiramatsu (Google) commit be75d319d1b3e9429bbb61681f14f88d59f32eb2 Author: Mina Almasry Date: Fri Jun 27 20:04:52 2025 +0000 selftests: pp-bench: remove page_pool_put_page wrapper Minor cleanup: remove the pointless looking _ wrapper around page_pool_put_page, and just do the call directly. Signed-off-by: Mina Almasry Reviewed-by: Simon Horman Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Ilias Apalodimas Acked-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/20250627200501.1712389-2-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 8d3e0982f7c2548851f27635ff907a8099d63ba9 Author: Mina Almasry Date: Fri Jun 27 20:04:51 2025 +0000 selftests: pp-bench: remove unneeded linux/version.h linux/version.h was used by the out-of-tree version, but not needed in the upstream one anymore. While I'm at it, sort the includes. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506271434.Gk0epC9H-lkp@intel.com/ Signed-off-by: Mina Almasry Reviewed-by: Simon Horman Reviewed-by: Toke Høiland-Jørgensen Reviewed-by: Ilias Apalodimas Acked-by: Jesper Dangaard Brouer Link: https://patch.msgid.link/20250627200501.1712389-1-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 0341e34727367585436715b4a5d107921f8fecf6 Author: Nicolas Dichtel Date: Mon Jun 30 16:54:54 2025 +0200 ip6_tunnel: enable to change proto of fb tunnels This is possible via the ioctl API: > ip -6 tunnel change ip6tnl0 mode any Let's align the netlink API: > ip link set ip6tnl0 type ip6tnl mode any Signed-off-by: Nicolas Dichtel Link: https://patch.msgid.link/20250630145602.1027220-1-nicolas.dichtel@6wind.com Signed-off-by: Jakub Kicinski commit 131e0a1123e709b72a3ce7ce09a30e903e3515f0 Author: Sebastian Andrzej Siewior Date: Mon Jun 30 17:33:41 2025 +0200 selftests/tc-testing: Enable CONFIG_IP_SET The config snippet specifies CONFIG_NET_EMATCH_IPSET. This option depends on CONFIG_IP_SET. Set CONFIG_IP_SET to be enabled at part for tc-testing. Signed-off-by: Sebastian Andrzej Siewior Link: https://patch.msgid.link/20250630153341.Wgh3SzGi@linutronix.de Signed-off-by: Jakub Kicinski commit 69fcb70c433437ae1319da2ceaed147297c7b297 Author: Frank Li Date: Mon Jun 30 12:16:12 2025 -0400 dt-bindings: net: convert nxp,lpc1850-dwmac.txt to yaml format Convert nxp,lpc1850-dwmac.txt to yaml format. Additional changes: - compatible string add fallback as "nxp,lpc1850-dwmac", "snps,dwmac-3.611" "snps,dwmac". - add common interrupts, interrupt-names, clocks, clock-names, resets and reset-names properties. - add ref snps,dwmac.yaml. - add phy-mode in example to avoid dt_binding_check warning. - update examples to align lpc18xx.dtsi. Reviewed-by: Rob Herring (Arm) Signed-off-by: Frank Li Link: https://patch.msgid.link/20250630161613.2838039-1-Frank.Li@nxp.com Signed-off-by: Jakub Kicinski commit 16f87fb24302d782d4a55e6916680bfe3174beac Author: Dave Marquardt Date: Mon Jun 30 11:23:53 2025 -0500 docs: netdevsim: fixe typo in netdevsim documentation Fixed a typographical error in "Rate objects" section Reviewed-by: Joe Damato Reviewed-by: Breno Leitao Signed-off-by: Dave Marquardt Link: https://patch.msgid.link/20250630-netdevsim-typo-fix-v3-1-e1eae3a5f018@linux.ibm.com Signed-off-by: Jakub Kicinski commit 3249eae7e4453909b0e0afb228804e76358be38f Author: Jakub Kicinski Date: Mon Jun 30 08:40:53 2025 -0700 net: ethtool: fix leaking netdev ref if ethnl_default_parse() failed Ido spotted that I made a mistake in commit under Fixes, ethnl_default_parse() may acquire a dev reference even when it returns an error. This may have been driven by the code structure in dumps (which unconditionally release dev before handling errors), but it's too much of a trap. Functions should undo what they did before returning an error, rather than expecting caller to clean up. Rather than fixing ethnl_default_set_doit() directly make ethnl_default_parse() clean up errors. Reported-by: Ido Schimmel Link: https://lore.kernel.org/aGEPszpq9eojNF4Y@shredder Fixes: 963781bdfe20 ("net: ethtool: call .parse_request for SET handlers") Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/20250630154053.1074664-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit d2c0e95525216cdc695d0066ee2f70b8adfbc536 Merge: 244bc18e5f1875 3fcd3d2fe44dc9 Author: Mark Brown Date: Wed Jul 2 01:15:01 2025 +0100 iio: adc: ad7173: add SPI offload support Merge series from David Lechner : Also there is a new dt-binding and driver for a special SPI offload trigger FPGA IP core that is used in this particular setup. commit ca899622c528e33f1906377c7c07645309095c08 Author: Fushuai Wang Date: Sat Jun 28 13:10:33 2025 +0800 sfc: siena: eliminate xdp_rxq_info_valid using XDP base API Commit d48523cb88e0 ("sfc: Copy shared files needed for Siena (part 2)") use xdp_rxq_info_valid to track failures of xdp_rxq_info_reg(). However, this driver-maintained state becomes redundant since the XDP framework already provides xdp_rxq_info_is_reg() for checking registration status. Signed-off-by: Fushuai Wang Acked-by: Edward Cree Reviewed-by: Larysa Zaremba Link: https://patch.msgid.link/20250628051033.51133-1-wangfushuai@baidu.com Signed-off-by: Jakub Kicinski commit 582643672deb828da4751eaddaa1e97b8e3f6bd1 Author: Fushuai Wang Date: Sat Jun 28 13:10:16 2025 +0800 sfc: eliminate xdp_rxq_info_valid using XDP base API Commit eb9a36be7f3e ("sfc: perform XDP processing on received packets") use xdp_rxq_info_valid to track failures of xdp_rxq_info_reg(). However, this driver-maintained state becomes redundant since the XDP framework already provides xdp_rxq_info_is_reg() for checking registration status. Signed-off-by: Fushuai Wang Acked-by: Edward Cree Reviewed-by: Larysa Zaremba Link: https://patch.msgid.link/20250628051016.51022-1-wangfushuai@baidu.com Signed-off-by: Jakub Kicinski commit 34c4ff1cbf7e7b600496c5adb72131ec5510e459 Author: Namhyung Kim Date: Tue Jul 1 13:10:26 2025 -0700 perf test: Add libsubcmd help tests Add a set of tests for subcmd routines. Currently it fails the last one since there's a bug. It'll be fixed by the next commit. $ perf test subcmd 69: libsubcmd help tests : 69.1: Load subcmd names : Ok 69.2: Uniquify subcmd names : Ok 69.3: Exclude duplicate subcmd names : FAILED! Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250701201027.1171561-2-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 139ee54a2b3e9a4042307dd0484f85c0b3b45539 Author: Namhyung Kim Date: Tue Jul 1 13:10:25 2025 -0700 perf test: Check test suite description properly Currently perf test checks the given string with descriptions for both test suites and cases (subtests). But sometimes it's confusing since the subtests don't contain the important keyword. I think it's better to check the suite level and run the whole suite together if it matches description in the suite. Before: $ perf test hwmon (no output) After: $ perf test hwmon 10: Hwmon PMU : 10.1: Basic parsing test : Ok 10.2: Parsing without PMU name : Ok 10.3: Parsing with PMU name : Ok And keep the existing behavior when it only matches test description only. $ perf test "Equal cpu map" 39.5: Equal cpu map : Ok Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250701201027.1171561-1-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 0e22c5ca44e687981f79598e650d26faad101746 Author: Ian Rogers Date: Fri Jun 27 18:23:02 2025 -0700 perf test: Add sched latency and script shell tests Add shell tests covering the `perf sched latency` and `perf sched script` commands. The test creates 2 noploop processes on the same forced CPU, it then checks that the process appears in the `perf sched` output. Reviewed-by: James Clark Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250628012302.1242532-2-irogers@google.com Signed-off-by: Namhyung Kim commit b6cea9b4f892e15d6d0dfabb11f3db299cdb9f01 Author: Ian Rogers Date: Fri Jun 27 18:23:01 2025 -0700 perf test: Name the noploop process Name the noploop process "perf-noploop" so that tests can easily check for its existence. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250628012302.1242532-1-irogers@google.com Signed-off-by: Namhyung Kim commit d1af2889682e83acc791e2a2191687958b548da1 Author: Jonathan Corbet Date: Tue Jul 1 13:02:54 2025 -0600 docs: kdoc: pretty up dump_enum() Add some comments to dump_enum to help the next person who has to figure out what it is actually doing. Signed-off-by: Jonathan Corbet commit a8353b632eb0fa95fe89086e0ac83e550d3c2c42 Author: Dmitry Torokhov Date: Sun Aug 18 21:58:05 2024 -0700 Input: samsung-keypad - use BIT() and GENMASK() where appropriate Instead of using (1 << ) construct use BIT() helper. Convert (1 << ) - 1 to GENMASK(). Link: https://lore.kernel.org/r/20240819045813.2154642-9-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 42121e7828fde8559de76af301770ed2bf3e1527 Author: Dmitry Torokhov Date: Sun Aug 18 21:58:04 2024 -0700 Input: samsung-keypad - use per-chip parameters Instead of doing conditional logic based on the chip type, define per-chip parameter structure, and reference it in the match data (either of_device_id or platform_device_id). Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240819045813.2154642-8-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit f1e5f6827dd36dda9a3745ead9f142f66429f14a Author: Dmitry Torokhov Date: Sun Aug 18 21:58:03 2024 -0700 Input: samsung-keypad - use guard notation to acquire mutex Guard notation is more compact and ensures that the mutex will be released when control leaves the function. Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240819045813.2154642-7-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 5658439a5fc71272be9457b5028bdcd68c559b7a Author: Dmitry Torokhov Date: Wed Jul 24 14:23:16 2024 -0700 Input: samsung-keypad - use devm to disable runtime PM To make sure that runtime PM is disabled at the right time compared to all other devm-managed resources use devm_pm_runtime_enable(). Link: https://lore.kernel.org/r/20240819045813.2154642-6-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 647fc2bfe21e1114b06de8ee2bc1e479072e7509 Author: Dmitry Torokhov Date: Sun Aug 18 21:58:01 2024 -0700 Input: samsung-keypad - use struct_size() helper When allocating memory for the keypad use struct_size() helper to be protected from overflows. Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240819045813.2154642-5-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 706a066328dbdd7a15ac4904905fa7f8bd29cdf0 Author: Dmitry Torokhov Date: Sun Aug 18 21:58:00 2024 -0700 Input: samsung-keypad - do not combine memory allocation checks The driver uses devm API to allocate resources so there's no reason to do allocations first and then check and release everything at once. Check results immediately after doing allocation of each resource. Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240819045813.2154642-4-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 4d4d74c6c9931b3c16ec49f0fb26c547be90f998 Author: Dmitry Torokhov Date: Sun Aug 18 21:57:59 2024 -0700 Input: samsung-keypad - do not set input device's parent explicitly The driver uses devm_input_allocate_device() to allocate instances of input device, which sets the parent appropriately. Remove extraneous assignment. Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20240819045813.2154642-3-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit e65efc62ca352906c880796e9ea2f2d77299de97 Author: Dmitry Torokhov Date: Sun Aug 18 21:57:58 2024 -0700 Input: samsung-keypad - switch to using devm_clk_get_prepared() Switch to using devm_clk_get_prepared() instead of combining devm_clk_get() with clk_prepare(), which simplifies the code and ensures that the clock is unprepared at the right time relative to releasing other managed resources. Link: https://lore.kernel.org/r/20240819045813.2154642-2-dmitry.torokhov@gmail.com Signed-off-by: Dmitry Torokhov commit 3fcd3d2fe44dc9dfca20b6aed117f314a50ba0ff Author: David Lechner Date: Fri Jun 27 18:40:05 2025 -0500 spi: offload trigger: add ADI Util Sigma-Delta SPI driver Add a new driver for the ADI Util Sigma-Delta SPI FPGA IP core. This is used to trigger a SPI offload based on a RDY signal from an ADC while masking out other signals on the same line. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250627-iio-adc-ad7173-add-spi-offload-support-v2-9-f49c55599113@baylibre.com Signed-off-by: Mark Brown commit e47a324d6f07c9ef252cfce1f14cfa5110cbed99 Author: David Lechner Date: Fri Jun 27 18:40:04 2025 -0500 dt-bindings: trigger-source: add ADI Util Sigma-Delta SPI Add new binding for the ADI Util Sigma-Delta SPI FPGA IP Core. This is used to trigger a SPI offload based on a RDY signal from the ADC while masking out other signals on the same line. Reviewed-by: Rob Herring (Arm) Signed-off-by: David Lechner Link: https://patch.msgid.link/20250627-iio-adc-ad7173-add-spi-offload-support-v2-8-f49c55599113@baylibre.com Signed-off-by: Mark Brown commit 2549e03c7b35dca84924a1cc7ae9ca4a22cc8820 Author: Jonathan Corbet Date: Mon Jun 30 17:10:40 2025 -0600 docs: kdoc: Remove a Python 2 comment We no longer support Python 2 in the docs build chain at all, so we certainly do not need to admonish folks to keep this file working with it. Cc: Jani Nikula Signed-off-by: Jonathan Corbet commit 901f506945b8d0a9386c126a2af6bec52354f7b3 Author: Jonathan Corbet Date: Mon Jun 30 11:38:42 2025 -0600 docs: kdoc: some tweaks to process_proto_function() Add a set of comments to process_proto_function and reorganize the logic slightly; no functional change. Signed-off-by: Jonathan Corbet commit 1aeb8099d053af79d50f4ffee740c29cc10d56fc Author: Jonathan Corbet Date: Mon Jun 30 11:08:32 2025 -0600 docs: kdoc: rework type prototype parsing process_proto_type() is using a complex regex and a "while True" loop to split a declaration into chunks and, in the end, count brackets. Switch to using a simpler regex to just do the split directly, and handle each chunk as it comes. The result is, IMO, easier to understand and reason about. The old algorithm would occasionally elide the space between function parameters; see struct rng_alg->generate(), foe example. The only output difference is to not elide that space, which is more correct. Signed-off-by: Jonathan Corbet commit 45ee66c37f9bd8cff7718c70d84e0291d385a093 Author: Nuno Sá Date: Tue Jul 1 15:32:15 2025 +0100 mfd: adp5585: Add support for a reset pin Make sure to perform an Hardware reset during probe if the pin is given in FW. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-20-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit ce262d6d629a926c8c9a2075af3b9a270ab6c641 Author: Nuno Sá Date: Tue Jul 1 15:32:14 2025 +0100 dt-bindings: mfd: adp5585: document reset gpio Add a reset gpio property. Note that for the adp5585-01 models, the reset pin is used as the additional ROW5 which means there's no reset. Acked-by: Krzysztof Kozlowski Reviewed-by: Laurent Pinchart Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-19-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 4bdef655542d8ed4bf3d57ea06ff128176f4927c Author: Nuno Sá Date: Tue Jul 1 15:32:13 2025 +0100 mfd: adp5585: Support getting vdd regulator Make sure we get and enable the VDD supply (if available). Reviewed-by: Lee Jones Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-18-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 3bdbd0858df6574b71cacaac073f117d65a36dc6 Author: Nuno Sá Date: Tue Jul 1 15:32:12 2025 +0100 Input: adp5589: remove the driver The adp5589 support is based on legacy platform data and there's no upstream platform using this device. Moreover, recently, with commit 480a8ad683d7 ("mfd: adp5585: Add Analog Devices ADP5585 core support") we overlapped support for the adp5585 device (gpiochip part of it) but since it actually makes sense for the device to be supported under MFD, we can complement it and add the keymap support for it (properly based on FW properties). And that is what commit 04840c5363a6 ("Input: adp5585: Add Analog Devices ADP5585/89 support") is doing. Reviewed-by: Laurent Pinchart Acked-by: Dmitry Torokhov Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-17-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 19298ac01306e564b48df9aa239731cf967298d2 Author: Nuno Sá Date: Tue Jul 1 15:32:11 2025 +0100 Input: adp5585: Add Analog Devices ADP5585/89 support The ADP5585 is a 10/11 input/output port expander with a built in keypad matrix decoder, programmable logic, reset generator, and PWM generator. This driver supports the keyboard function using the platform device registered by the core MFD driver. The ADP5589 has 19 pins and also features an unlock function. Acked-by: Dmitry Torokhov Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-16-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 988b28a83b658137e58123f4dafc3a1588e1cb2b Author: Nuno Sá Date: Tue Jul 1 15:32:10 2025 +0100 gpio: adp5585: support gpi events Add support for adding GPIs to the event FIFO. This is done by adding irq_chip support. Like this, one can use the input gpio_keys driver as a "frontend" device and input handler. As part of this change, we now implement .request() and .free() as we can't blindly consume all available pins as GPIOs (example: some pins can be used for forming a keymap matrix). Also note that the number of pins can now be obtained from the parent, top level device. Hence the 'max_gpio' variable can be removed. Reviewed-by: Linus Walleij Acked-by: Bartosz Golaszewski Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-15-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit bd113a13e1fa51789f55987369b80e1d8bc19389 Author: Nuno Sá Date: Tue Jul 1 15:32:09 2025 +0100 mfd: adp5585: Add support for input devices The ADP558x family supports a built in keypad matrix decoder which can be added as an Input device. In order to both support the Input and the GPIO device, we need to create a bitmap of the supported pins and track their usage since they can either be used as GPIOs (GPIs) or as part of the keymap. We also need to mark special pins busy in case some features are being used (ex: pwm or reset events). Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-14-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 333812da70d5f71bf5e176f6d55a5f716301b5fc Author: Nuno Sá Date: Tue Jul 1 15:32:08 2025 +0100 mfd: adp5585: Support reset and unlock events The ADP558x family of devices can be programmed to respond to some especial events, In case of the unlock events, one can lock the keypad and use KEYS or GPIs events to unlock it. For the reset events, one can again use a combinations of GPIs/KEYs in order to generate an event that will trigger the device to generate an output reset pulse. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-13-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 47a1f759b776ec9287f675f5d4fbf60b94cc566d Author: Nuno Sá Date: Tue Jul 1 15:32:07 2025 +0100 mfd: adp5585: Add support for event handling These devices are capable of generate FIFO based events based on KEY or GPI presses. Add support for handling these events. This is in preparation of adding full support for keymap and gpis based events. Reviewed-by: Lee Jones Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-12-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit adf4932bc97ec9363dc5c0f8390ee5caccf0f41b Author: Nuno Sá Date: Tue Jul 1 15:32:06 2025 +0100 dt-bindings: mfd: adp5585: add properties for input events Add properties related to input events. These devices can act as keyboards and can support events either via a keymap Matrix or through GPIs. Note that the device needs to be an interrupt controller for GPIs based events. We specifically need a property specifying the pins used by the keymap matrix since these devices have no requirement for rows and columns to be contiguous without holes which is enforced by the standard input properties. Reviewed-by: "Rob Herring (Arm)" Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-11-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 75024f97e82e63d02b0743500efb1e264a1c2dd4 Author: Nuno Sá Date: Tue Jul 1 15:32:05 2025 +0100 pwm: adp5585: add support for adp5589 Add support for the adp5589 I/O expander. From a PWM point of view it is pretty similar to adp5585. Main difference is the address of registers meaningful for configuring the PWM. Acked-by: Uwe Kleine-König Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-10-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 9f425bf713b511b1078e0fea5a88c497e13dbb64 Author: Nuno Sá Date: Tue Jul 1 15:32:04 2025 +0100 gpio: adp5585: add support for the adp5589 expander Support the adp5589 I/O expander which supports up to 19 pins. We need to add a chip_info based struct since accessing register "banks" and "bits" differs between devices. Also some register addresses are different. While at it move ADP558X_GPIO_MAX defines to the main header file and rename them. That information will be needed by the top level device in a following change. Acked-by: Linus Walleij Acked-by: Bartosz Golaszewski Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-9-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 7077fb501b95360c7fe35553f2bdb1ccf34edd16 Author: Nuno Sá Date: Tue Jul 1 15:32:03 2025 +0100 mfd: adp5585: Add a per chip reg struture There are some differences in the register map between the devices. Hence, add a register structure per device. This will be needed in following patches. On top of that adp5585_fill_regmap_config() is renamed and reworked so that the current struct adp5585_info act as template (they indeed contain all the different data between variants) which can then be complemented depending on the device (as identified by the id register). This is done like this since a lot of the data is pretty much the same between variants of the same device. Reviewed-by: Lee Jones Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-8-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 0190a72f28ee0995c546fd4fcf80ed25a0fc4b28 Author: Nuno Sá Date: Tue Jul 1 15:32:02 2025 +0100 mfd: adp5585: Add support for adp5589 The ADP5589 is a 19 I/O port expander with built-in keypad matrix decoder, programmable logic, reset generator, and PWM generator. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-7-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 1a4eabf662543c62ae1e71a26d1c8e6643c66388 Author: Nuno Sá Date: Tue Jul 1 15:32:01 2025 +0100 mfd: adp5585: Refactor how regmap defaults are handled The only thing changing between variants is the regmap default registers. Hence, instead of having a regmap configuration for every variant (duplicating lots of fields), add a chip info type of structure with a regmap ID to identify which defaults to use and populate regmap_config at runtime given a template plus the id. Also note that between variants, the defaults can be the same which means the chip info structure can be used in more than one compatible. This will also make it simpler adding new chips with more variants. Also note that the chip info structures are deliberately not const as they will also contain lots of members that are the same between the different devices variants and so we will fill those at runtime. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-6-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit e65e2b0d0f7e75c40f426e0f3e0a1bb6faff93e6 Author: Nuno Sá Date: Tue Jul 1 15:32:00 2025 +0100 dt-bindings: mfd: adp5585: document adp5589 I/O expander The ADP5589 is a 19 I/O port expander with built-in keypad matrix decoder, programmable logic, reset generator, and PWM generator. We can't really have adp5589 devices fallback to adp5585 (which have less pins) because there are some significant differences in the register map. Reviewed-by: "Rob Herring (Arm)" Reviewed-by: Laurent Pinchart Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-5-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit e6545bdb1b7681da7edb6a34bed4be5e7f41cf52 Author: Nuno Sá Date: Tue Jul 1 15:31:59 2025 +0100 mfd: adp5585: Make use of MFD_CELL_NAME() Use the helper macro. No functional change intended... Whilst we're at it, now seems like a good time to update the Copyright. Reviewed-by: Laurent Pinchart Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-4-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit e551760164a74ac00916fad64ac2d0b1d3d714c5 Author: Nuno Sá Date: Tue Jul 1 15:31:58 2025 +0100 mfd: adp5585: Enable oscillator during probe Make sure to enable the oscillator in the top device. This will allow to not control this in the child PWM device as that would not work with future support for keyboard matrix where the oscillator needs to be always enabled (and so cannot be disabled by disabling PWM). Reviewed-by: Laurent Pinchart Signed-off-by: Nuno Sá Acked-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-3-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 175f199085c1253d2683f583ce32b2e02cd70de1 Author: Nuno Sá Date: Tue Jul 1 15:31:57 2025 +0100 mfd: adp5585: Only add devices given in FW Not all devices (features) of the adp5585 device are mandatory to be used in all platforms. Hence, check what's given in FW and dynamically create the mfd_cell array to be given to devm_mfd_add_devices(). Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-2-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit 09d55a54b466d60a71573c78a99a901410ef73e0 Author: Nuno Sá Date: Tue Jul 1 15:31:56 2025 +0100 dt-bindings: mfd: adp5585: ease on the required properties It is not mandatory to use all the capabilities of the device. One can very well only use it as a gpio controller without the PWM support. This will be even more evident when support for the matrix keymap is added. Hence drop the requirements for PWM and GPIO. Acked-by: "Rob Herring (Arm)" Reviewed-by: Laurent Pinchart Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250701-dev-adp5589-fw-v7-1-b1fcfe9e9826@analog.com Signed-off-by: Lee Jones commit bd14e462bb52f5bbfc56f10f758f617c05dbd63c Author: Andrey Albershteyn Date: Mon Jun 30 18:20:13 2025 +0200 selinux: implement inode_file_[g|s]etattr hooks These hooks are called on inode extended attribute retrieval/change. Cc: selinux@vger.kernel.org Cc: Paul Moore Acked-by: Paul Moore Signed-off-by: Andrey Albershteyn Link: https://lore.kernel.org/20250630-xattrat-syscall-v6-3-c4e3bc35227b@kernel.org Signed-off-by: Christian Brauner commit defdd02d783c6fa22d0005bdc238ccd9174faf20 Author: Andrey Albershteyn Date: Mon Jun 30 18:20:12 2025 +0200 lsm: introduce new hooks for setting/getting inode fsxattr Introduce new hooks for setting and getting filesystem extended attributes on inode (FS_IOC_FSGETXATTR). Cc: selinux@vger.kernel.org Cc: Paul Moore Acked-by: Paul Moore Signed-off-by: Andrey Albershteyn Link: https://lore.kernel.org/20250630-xattrat-syscall-v6-2-c4e3bc35227b@kernel.org Signed-off-by: Christian Brauner commit 2f952c9e8fe13c6ee15c05189f1f87c1a70b866c Author: Andrey Albershteyn Date: Mon Jun 30 18:20:11 2025 +0200 fs: split fileattr related helpers into separate file This patch moves function related to file extended attributes manipulations to separate file. Refactoring only. Signed-off-by: Andrey Albershteyn Link: https://lore.kernel.org/20250630-xattrat-syscall-v6-1-c4e3bc35227b@kernel.org Reviewed-by: Amir Goldstein Reviewed-by: Darrick J. Wong Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 1230be820981a3ef0fb9abc011f1b3d093f3b1e4 Author: Colin Ian King Date: Mon Jun 30 13:55:28 2025 +0100 selftests/bpf: Fix spelling mistake "subtration" -> "subtraction" There are spelling mistakes in description text. Fix these. Signed-off-by: Colin Ian King Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250630125528.563077-1-colin.i.king@gmail.com commit de2942828e7670526289f098df7e50b112e8ff1e Author: Biju Das Date: Tue Jul 1 11:59:21 2025 +0100 irqchip/renesas-rzv2h: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND The interrupt controller found on RZ/G3E doesn't provide any facility to configure the wakeup sources. That's the reason why the driver lacks the irq_set_wake() callback for the interrupt chip. But this prevent to properly enter power management states like "suspend to idle". Enable the flags IRQCHIP_SKIP_SET_WAKE and IRQCHIP_MASK_ON_SUSPEND so the interrupt suspend logic can handle the chip correctly. Signed-off-by: Biju Das Signed-off-by: Thomas Gleixner Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/20250701105923.52151-1-biju.das.jz@bp.renesas.com commit f304c25980ae6d101faa62a9dcc1ddeed260bd38 Author: Petr Tesarik Date: Fri Jun 27 12:10:15 2025 +0200 docs: dma-api: clean up documentation of dma_map_sg() Describe in one sentence what the function does. Do not repeat example situations when the returned number is lower than the number of segments on input. Signed-off-by: Petr Tesarik Reviewed-by: Bagas Sanjaya Tested-by: Randy Dunlap Acked-by: Marek Szyprowski Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627101015.1600042-9-ptesarik@suse.com commit 0ebbc69ebccf7e47eb150e8d1046e62d00ad781a Author: Petr Tesarik Date: Fri Jun 27 12:10:14 2025 +0200 docs: dma-api: update streaming DMA physical address constraints Add an introductory paragraph to Part Id - Streaming DMA mappings and move the explanation of address constraints there, because it applies to all map functions. Clarify that streaming DMA can be used with memory which does not meet the addressing constraints of a device, but it may fail in that case. Make a note about SWIOTLB and link to the detailed description of it. Do not mention platform-dependent allocation flags. The note may mislead device driver authors into thinking that they should poke into and try to second-guess the DMA API implementation. They definitely shouldn't. Remove the claim that platforms with an IOMMU may not require physically contiguous buffers. The current implementation explicitly rejects vmalloc addresses, regardless of IOMMU. Signed-off-by: Petr Tesarik Reviewed-by: Bagas Sanjaya Tested-by: Randy Dunlap Acked-by: Marek Szyprowski Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627101015.1600042-8-ptesarik@suse.com commit faa7c7ebd8ac89faaedbea7dbe4491de14dbcfe1 Author: Petr Tesarik Date: Fri Jun 27 12:10:13 2025 +0200 docs: dma-api: clarify DMA addressing limitations Move the description of DMA mask from the documentation of dma_map_single() to Part Ic - DMA addressing limitations and improve the wording. Explain when a mask setting function may fail, and do not repeat this explanation for each individual function. Clarify which device parameters are updated by each mask setting function. Signed-off-by: Petr Tesarik Reviewed-by: Bagas Sanjaya Tested-by: Randy Dunlap Acked-by: Marek Szyprowski Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627101015.1600042-7-ptesarik@suse.com commit 61043d0995eeb01950ff61555dee07be44c07bbd Author: Petr Tesarik Date: Fri Jun 27 12:10:12 2025 +0200 docs: dma-api: remove duplicate description of the DMA pool API Move the DMA pool API documentation from Memory Management APIs to dma-api.rst, replacing the outdated duplicate description there. Signed-off-by: Petr Tesarik Tested-by: Randy Dunlap Acked-by: Marek Szyprowski Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627101015.1600042-6-ptesarik@suse.com commit fc9a099567813a9fef0da07b94ecb8dee64703c4 Author: Petr Tesarik Date: Fri Jun 27 12:10:11 2025 +0200 docs: dma-api: add a kernel-doc comment for dma_pool_zalloc() Document the dma_pool_zalloc() wrapper. Signed-off-by: Petr Tesarik Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Acked-by: Marek Szyprowski [jc: fixed up dma_pool_alloc() reference in dmapool.h] Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627101015.1600042-5-ptesarik@suse.com commit 970f8a17c9c86eff390252e13bb9a08a3fb5a098 Author: Brahmajit Das Date: Tue Jul 1 02:02:48 2025 +0530 samples/landlock: Fix building on musl libc Building with make allyesconfig on musl results in the following In file included from samples/landlock/sandboxer.c:22: /usr/include/sys/prctl.h:88:8: error: redefinition of 'struct prctl_mm_map' 88 | struct prctl_mm_map { | ^~~~~~~~~~~~ In file included from samples/landlock/sandboxer.c:16: usr/include/linux/prctl.h:134:8: note: originally defined here 134 | struct prctl_mm_map { | ^~~~~~~~~~~~ This is mainly due to difference in the sys/prctl.h between glibc and musl. The struct prctl_mm_map is defined in sys/prctl.h in musl. Signed-off-by: Brahmajit Das [mic: Move down the if/include/endif block] Link: https://lore.kernel.org/r/20250630203248.16273-1-listout@listout.xyz Signed-off-by: Mickaël Salaün commit cce3fee729ee18caa03bade7f4c360343e863bb1 Author: Mykyta Yatsenko Date: Mon Jun 30 14:35:14 2025 +0100 selftests/bpf: Enable dynptr/test_probe_read_user_str_dynptr Enable previously disabled dynptr/test_probe_read_user_str_dynptr test, after the fix it depended on was merged into bpf-next. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20250630133515.1108325-1-mykyta.yatsenko5@gmail.com commit 0df1a55afa832f463f9ad68ddc5de92230f1bc8a Author: Paul Chaignon Date: Tue Jul 1 20:36:15 2025 +0200 bpf: Warn on internal verifier errors This patch is a follow up to commit 1cb0f56d9618 ("bpf: WARN_ONCE on verifier bugs"). It generalizes the use of verifier_error throughout the verifier, in particular for logs previously marked "verifier internal error". As a consequence, all of those verifier bugs will now come with a kernel warning (under CONFIG_DBEUG_KERNEL) detectable by fuzzers. While at it, some error messages that were too generic (ex., "bpf verifier is misconfigured") have been reworded. Signed-off-by: Paul Chaignon Link: https://lore.kernel.org/r/aGQqnzMyeagzgkCK@Tunnel Signed-off-by: Alexei Starovoitov commit 26d0e5324677dc0acce4c0fda52316154a1d689e Merge: c4b1be928ea05a e26d523edf2a62 Author: Alexei Starovoitov Date: Tue Jul 1 12:36:51 2025 -0700 Merge branch 's390-bpf-describe-the-frame-using-a-struct-instead-of-constants' Ilya Leoshkevich says: ==================== s390/bpf: Describe the frame using a struct instead of constants Hi, This series contains two small refactorings without functional changes. The first one removes the code duplication around calculating the distance from %r15 to the stack frame. The second one simplifies how offsets to various values stored inside the frame are calculated. Best regards, Ilya ==================== Link: https://patch.msgid.link/20250624121501.50536-1-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit e26d523edf2a62b142d2dd2dd9b87f61ed92f33a Author: Ilya Leoshkevich Date: Tue Jun 24 14:04:28 2025 +0200 s390/bpf: Describe the frame using a struct instead of constants Currently the caller-allocated portion of the stack frame is described using constants, hardcoded values, and an ASCII drawing, making it harder than necessary to ensure that everything is in sync. Declare a struct and use offsetof() and offsetofend() macros to refer to various values stored within the frame. Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250624121501.50536-3-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit b2268d550d20ff860bddfe3a91b1aec00414689a Author: Ilya Leoshkevich Date: Tue Jun 24 14:04:27 2025 +0200 s390/bpf: Centralize frame offset calculations The calculation of the distance from %r15 to the caller-allocated portion of the stack frame is copy-pasted into multiple places in the JIT code. Move it to bpf_jit_prog() and save the result into bpf_jit::frame_off, so that the other parts of the JIT can use it. Signed-off-by: Ilya Leoshkevich Link: https://lore.kernel.org/r/20250624121501.50536-2-iii@linux.ibm.com Signed-off-by: Alexei Starovoitov commit 6381b9d940a05642977c15cb776ad0569a502bea Author: Petr Tesarik Date: Fri Jun 27 12:10:10 2025 +0200 docs: dma-api: remove remnants of PCI DMA API The wording sometimes suggests there are multiple functions for an operation. This was in fact the case before PCI DMA API was removed, but since there is only one API now, the documentation has become confusing. To improve readability: * Remove implicit references to the PCI DMA API (plurals, use of "both", etc.) * Where possible, refer to an actual function rather than a more generic description of the operation. Signed-off-by: Petr Tesarik Reviewed-by: Bagas Sanjaya Tested-by: Randy Dunlap Acked-by: Marek Szyprowski Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627101015.1600042-4-ptesarik@suse.com commit 4d3c6bc11b057a8cf0e76f49d4f0d7184b0e32b6 Author: Petr Tesarik Date: Fri Jun 27 12:10:09 2025 +0200 docs: dma-api: replace consistent with coherent For consistency, always use the term "coherent" when talking about memory that is not subject to CPU caching effects. The term "consistent" is a relic of a long-removed PCI DMA API (pci_alloc_consistent() and pci_free_consistent() functions). Signed-off-by: Petr Tesarik Tested-by: Randy Dunlap Acked-by: Marek Szyprowski Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627101015.1600042-3-ptesarik@suse.com commit 7362b6ba173a70e23dbf1ffb8cfa8057a63eb65b Author: Petr Tesarik Date: Fri Jun 27 12:10:08 2025 +0200 docs: dma-api: use "DMA API" consistently throughout the document Make sure that all occurrences are spelled "DMA API" (all uppercase, no hyphen, no underscore). Signed-off-by: Petr Tesarik Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Acked-by: Marek Szyprowski Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627101015.1600042-2-ptesarik@suse.com commit 739ca710a77717a52ff6c7f4677000196ba9e96f Author: Xose Vazquez Perez Date: Wed Jun 25 17:02:31 2025 +0200 MAINTAINERS: replace git protocol for github It was removed time ago: https://github.blog/changelog/2022-03-15-removed-unencrypted-git-protocol-and-certain-ssh-keys/ Cc: Jonathan Corbet Cc: Greg Kroah-Hartman Cc: DOC ML Cc: KERNEL ML Signed-off-by: Xose Vazquez Perez Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250625150231.241687-1-xose.vazquez@gmail.com commit 8a5c82429c122161d4955f34eecefe799ede3f47 Author: Alison Schofield Date: Wed Jun 25 19:40:58 2025 -0700 docs: ABI: make the KernelVersion field optional The KernelVersion field has limited practical value. Git history provides more accurate tracking of when features were introduced and target kernel versions often change during development and merge. Label it optional. Signed-off-by: Alison Schofield Acked-by: Dan Williams Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250626024101.792073-1-alison.schofield@intel.com commit 047b05eb7de3c4dd50549b674a2729eb2bfe425e Author: Richard Weinberger Date: Sat Jun 28 10:32:05 2025 +0200 overlayfs.rst: Fix inode table The HTML output seems to be correct, but when reading the raw rst file it's annoying. So use "|" for table the border. Signed-off-by: Richard Weinberger Acked-by: Amir Goldstein Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250628083205.1066472-1-richard@nod.at commit 0cde7924b8de5abec29f03519ce9486b27c809ea Author: Jonathan Corbet Date: Fri Jun 27 12:40:00 2025 -0600 docs: kdoc: split the processing of the two remaining inline states Now that "inline_*" are just ordinary parser states, split them into two separate functions, getting rid of some nested conditional logic. The original process_inline() would simply ignore lines that didn't match any of the regexes (those lacking the initial " * " marker). I have preserved that behavior, but we should perhaps emit a warning instead. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627184000.132291-9-corbet@lwn.net commit 8976f993a3aa8c00699ed5cb1bc939e11c88a713 Author: Jonathan Corbet Date: Fri Jun 27 12:39:59 2025 -0600 docs: kdoc: remove the inline states-within-a-state The processing of inline kerneldoc comments is a state like the rest, but it was implemented as a set of separate substates. Just remove the substate logic and make the inline states normal ones like the rest. INLINE_ERROR was never actually used for anything, so just take it out. No changes to the generated output. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627184000.132291-8-corbet@lwn.net commit 388f4da27c4eaa2813259bcfbfc9b94ac8754902 Author: Jonathan Corbet Date: Fri Jun 27 12:39:58 2025 -0600 docs: kdoc: remove the INLINE_END state It is never used, so just get rid of it. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627184000.132291-7-corbet@lwn.net commit d06c54fd3e84e2e740c0cb2b5613a088e8a42e9a Author: Jonathan Corbet Date: Fri Jun 27 12:39:57 2025 -0600 docs: kdoc: rework process_export() slightly Reorganize process_export() to eliminate duplicated code, don't look for exports in states where we don't expect them, and don't bother with normal state-machine processing if an export declaration has been found. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627184000.132291-6-corbet@lwn.net commit 0aa3675c26b976db2b645385e8a7990270b39db0 Author: Jonathan Corbet Date: Fri Jun 27 12:39:56 2025 -0600 docs: kdoc: remove KernelEntry::function This member is unused, to take it out. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627184000.132291-5-corbet@lwn.net commit 08cd655e5b1ffaaac20724ce56ce543be41f300a Author: Jonathan Corbet Date: Fri Jun 27 12:39:55 2025 -0600 docs: kdoc: remove a bit of dead code The type_param regex matches "@..." just fine, so the special-case branch for that in dump_section() is never executed. Just remove it. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627184000.132291-4-corbet@lwn.net commit 1e2a79ca39ae33f1da347692c8a0573e120da511 Author: Jonathan Corbet Date: Fri Jun 27 12:39:54 2025 -0600 docs: kdoc: Move content handling into KernelEntry Rather than having other code mucking around with this bit of internal state, encapsulate it internally. Accumulate the description as a list of strings, joining them at the end, which is a more efficient way of building the text. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627184000.132291-3-corbet@lwn.net commit 4eaf6120c16a0fdb60177410507de86eefbe8c0f Author: Jonathan Corbet Date: Fri Jun 27 12:39:53 2025 -0600 docs: kdoc: remove KernelEntry::in_doc_sect This field is not used for anything, just get rid of it. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250627184000.132291-2-corbet@lwn.net commit c6f908f88a55be7641d78a99053818147bde93e9 Author: Jens Reidel Date: Thu Mar 13 21:20:17 2025 +0100 Input: edt-ft5x06 - add support for FocalTech FT8716 This driver is compatible with the FocalTech FT8716 touchscreen, which supports up to 10 concurrent touch points. Add a compatible for it. Signed-off-by: Jens Reidel Link: https://lore.kernel.org/r/20250313202017.19621-3-adrian@mainlining.org Signed-off-by: Dmitry Torokhov commit 06226bd497dd99780968600e498f95e8d049d1c2 Author: Jens Reidel Date: Thu Mar 13 21:20:16 2025 +0100 dt-bindings: input: touchscreen: edt-ft5x06: Document FT8716 support Document FocalTech FT8716 support by adding the compatible. Signed-off-by: Jens Reidel Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250313202017.19621-2-adrian@mainlining.org Signed-off-by: Dmitry Torokhov commit 68743c500c6eafcd0b16dc6067fea5bca0795eef Author: Wolfram Sang Date: Tue Jul 1 11:40:06 2025 -0700 Input: edt-ft5x06 - use per-client debugfs directory The I2C core now provides a debugfs entry for each client. Let this driver use it instead of the custom directory in debugfs root. Further improvements by this change: support of multiple instances. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250318091904.22468-1-wsa+renesas@sang-engineering.com Signed-off-by: Dmitry Torokhov commit 6a71a6679fcbe96f894292d6cfc0d58eabf9ac8c Author: Chen Ni Date: Tue Jul 1 11:33:18 2025 -0700 Input: cs40l50 - remove redundant flush_workqueue() calls destroy_workqueue() already drains the queue before destroying it, so there is no need to flush it explicitly. Remove the redundant 'flush_workqueue()' calls. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250312072940.1429931-1-nichen@iscas.ac.cn Signed-off-by: Dmitry Torokhov commit 45601c66b5ddbe665937659b957e71bc8efedd46 Author: Frank Li Date: Thu May 29 15:32:35 2025 -0400 dt-bindings: input: touchscreen: convert tsc2007.txt to yaml format Convert tsc2007.txt to yaml format. Additional changes: - add pendown-gpio property to match existed dts. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250529193241.793678-1-Frank.Li@nxp.com Signed-off-by: Dmitry Torokhov commit b74710eaff314d6afe4fb0bbe9bc7657bf226fd4 Author: John B. Wyatt IV Date: Tue Jun 24 16:41:04 2025 -0400 cpupower: Improve Python binding's Makefile Add a few build variables to make it easier for distributions to package the bindings. Allow current variables to be overwritten by environment variables that are passed to make. CCing Thorsten Leemhuis . https://lore.kernel.org/r/20250624204105.457971-1-jwyatt@redhat.com Signed-off-by: John B. Wyatt IV Signed-off-by: John B. Wyatt IV Signed-off-by: Shuah Khan commit 0a50ed0574ffe853f15c3430794b5439b2e6150a Author: Daniel Wagner Date: Tue Jun 17 15:43:27 2025 +0200 virtio: blk/scsi: use block layer helpers to calculate num of queues The calculation of the upper limit for queues does not depend solely on the number of possible CPUs; for example, the isolcpus kernel command-line option must also be considered. To account for this, the block layer provides a helper function to retrieve the maximum number of queues. Use it to set an appropriate upper queue number limit. Reviewed-by: Christoph Hellwig Acked-by: Michael S. Tsirkin Reviewed-by: Hannes Reinecke Reviewed-by: Ming Lei Signed-off-by: Daniel Wagner Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20250617-isolcpus-queue-counters-v1-5-13923686b54b@kernel.org Signed-off-by: Jens Axboe commit 94970cfb5f10ea381df8c402d36c5023765599da Author: Daniel Wagner Date: Tue Jun 17 15:43:26 2025 +0200 scsi: use block layer helpers to calculate num of queues The calculation of the upper limit for queues does not depend solely on the number of online CPUs; for example, the isolcpus kernel command-line option must also be considered. To account for this, the block layer provides a helper function to retrieve the maximum number of queues. Use it to set an appropriate upper queue number limit. Reviewed-by: Martin K. Petersen Reviewed-by: Hannes Reinecke Reviewed-by: Ming Lei Signed-off-by: Daniel Wagner Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20250617-isolcpus-queue-counters-v1-4-13923686b54b@kernel.org Signed-off-by: Jens Axboe commit 4082c98c1fefd276b34ba411ac59c50b336dfbb1 Author: Daniel Wagner Date: Tue Jun 17 15:43:25 2025 +0200 nvme-pci: use block layer helpers to calculate num of queues The calculation of the upper limit for queues does not depend solely on the number of possible CPUs; for example, the isolcpus kernel command-line option must also be considered. To account for this, the block layer provides a helper function to retrieve the maximum number of queues. Use it to set an appropriate upper queue number limit. Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Signed-off-by: Daniel Wagner Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20250617-isolcpus-queue-counters-v1-3-13923686b54b@kernel.org Signed-off-by: Jens Axboe commit 3f27c1de5df265f9d8edf0cc5d75dc92e328484a Author: Daniel Wagner Date: Tue Jun 17 15:43:24 2025 +0200 blk-mq: add number of queue calc helper Add two variants of helper functions that calculate the correct number of queues to use. Two variants are needed because some drivers base their maximum number of queues on the possible CPU mask, while others use the online CPU mask. Reviewed-by: Christoph Hellwig Reviewed-by: Hannes Reinecke Reviewed-by: Ming Lei Signed-off-by: Daniel Wagner Reviewed-by: Chaitanya Kulkarni Link: https://lore.kernel.org/r/20250617-isolcpus-queue-counters-v1-2-13923686b54b@kernel.org Signed-off-by: Jens Axboe commit b6139a6abf673029008f80d42abd3848d80a9108 Author: Daniel Wagner Date: Tue Jun 17 15:43:23 2025 +0200 lib/group_cpus: Let group_cpu_evenly() return the number of initialized masks group_cpu_evenly() might have allocated less groups then requested: group_cpu_evenly() __group_cpus_evenly() alloc_nodes_groups() # allocated total groups may be less than numgrps when # active total CPU number is less then numgrps In this case, the caller will do an out of bound access because the caller assumes the masks returned has numgrps. Return the number of groups created so the caller can limit the access range accordingly. Acked-by: Thomas Gleixner Reviewed-by: Hannes Reinecke Reviewed-by: Ming Lei Signed-off-by: Daniel Wagner Reviewed-by: Chaitanya Kulkarni Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250617-isolcpus-queue-counters-v1-1-13923686b54b@kernel.org Signed-off-by: Jens Axboe commit 8f4688591d96be9a71c0ddfbf32032d55dd54cfa Author: Chao Yu Date: Tue Jul 1 17:26:10 2025 +0800 f2fs: fix to use f2fs_is_valid_blkaddr_raw() in do_write_page() As syzbot reported as below: F2FS-fs (loop9): inject invalid blkaddr in f2fs_is_valid_blkaddr of do_write_page+0x277/0xb10 fs/f2fs/segment.c:3956 ------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:3957! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 10538 Comm: syz-executor Not tainted 6.16.0-rc3-next-20250627-syzkaller #0 PREEMPT(full) Call Trace: f2fs_outplace_write_data+0x11a/0x220 fs/f2fs/segment.c:4017 f2fs_do_write_data_page+0x12ea/0x1a40 fs/f2fs/data.c:2752 f2fs_write_single_data_page+0xa68/0x1680 fs/f2fs/data.c:2851 f2fs_write_cache_pages fs/f2fs/data.c:3133 [inline] __f2fs_write_data_pages fs/f2fs/data.c:3282 [inline] f2fs_write_data_pages+0x195b/0x3000 fs/f2fs/data.c:3309 do_writepages+0x32b/0x550 mm/page-writeback.c:2636 filemap_fdatawrite_wbc mm/filemap.c:386 [inline] __filemap_fdatawrite_range mm/filemap.c:419 [inline] __filemap_fdatawrite mm/filemap.c:425 [inline] filemap_fdatawrite+0x199/0x240 mm/filemap.c:430 f2fs_sync_dirty_inodes+0x31f/0x830 fs/f2fs/checkpoint.c:1108 block_operations fs/f2fs/checkpoint.c:1247 [inline] f2fs_write_checkpoint+0x95a/0x1df0 fs/f2fs/checkpoint.c:1638 kill_f2fs_super+0x2c3/0x6c0 fs/f2fs/super.c:5081 deactivate_locked_super+0xb9/0x130 fs/super.c:474 cleanup_mnt+0x425/0x4c0 fs/namespace.c:1417 task_work_run+0x1d4/0x260 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:114 exit_to_user_mode_prepare include/linux/entry-common.h:330 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:414 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:449 [inline] do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f If we inject block address fault, it may trigger kernel panic, we need to use f2fs_is_valid_blkaddr_raw() instead of f2fs_is_valid_blkaddr() in do_write_page() to avoid such issue. Fixes: 70b6e8500431 ("f2fs: do sanity check on fio.new_blkaddr in do_write_page()") Reported-by: syzbot+9201a61c060513d4be38@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/68639520.a70a0220.3b7e22.17e6.GAE@google.com Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 185f203a6991f7dd7f8070d6638415215da35d7e Author: Jianan Huang Date: Mon Jun 30 20:57:53 2025 +0800 f2fs: avoid splitting bio when reading multiple pages When fewer pages are read, nr_pages may be smaller than nr_cpages. Due to the nr_vecs limit, the compressed pages will be split into multiple bios and then merged at the block level. In this case, nr_cpages should be used to pre-allocate bvecs. To handle this case, align max_nr_pages to cluster_size, which should be enough for all compressed pages. Signed-off-by: Jianan Huang Signed-off-by: Sheng Yong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit e23ab8028de0d92df5921a570f5212c0370db3b5 Author: Jaegeuk Kim Date: Mon Jun 30 16:06:09 2025 +0000 f2fs: check the generic conditions first Let's return errors caught by the generic checks. This fixes generic/494 where it expects to see EBUSY by setattr_prepare instead of EINVAL by f2fs for active swapfile. Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 9f97e61bde6a91a429f48da1a461488a15b01813 Author: Nathan Chancellor Date: Tue Jul 1 07:33:31 2025 -0700 cxl: Include range.h in cxl.h After commit aefeb286b960 ("libnvdimm: Don't use "proxy" headers"), range.h may not be implicitly included, resulting in a build error: In file included from drivers/cxl/core/features.c:8: drivers/cxl/cxl.h:365:22: error: field 'hpa_range' has incomplete type 365 | struct range hpa_range; | ^~~~~~~~~ drivers/cxl/cxl.h:562:22: error: field 'hpa_range' has incomplete type 562 | struct range hpa_range; | ^~~~~~~~~ drivers/cxl/cxl.h:570:22: error: field 'hpa_range' has incomplete type 570 | struct range hpa_range; | ^~~~~~~~~ drivers/cxl/cxl.h:803:22: error: array type has incomplete element type 'struct range' 803 | struct range dvsec_range[2]; | ^~~~~~~~~~~ Include range.h in cxl.h explicitly to clear up the errors. Fixes: aefeb286b960 ("libnvdimm: Don't use "proxy" headers") Signed-off-by: Nathan Chancellor Reviewed-by: Dave Jiang Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250701-cxl-fix-struct-range-error-v1-1-1f199bddc7c9@kernel.org Signed-off-by: Ira Weiny commit 536f5941adde41c99a18a0ba03b457adc9702ab8 Author: Andy Shevchenko Date: Fri Jun 27 17:19:23 2025 +0300 libnvdimm: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. While doing that, sort headers alphabetically. Reviewed-by: Dave Jiang Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250627142001.994860-1-andriy.shevchenko@linux.intel.com Signed-off-by: Ira Weiny commit a34ba68d0938687e56f442102b5f9e149af7a415 Author: Tvrtko Ursulin Date: Mon Jun 30 13:46:47 2025 +0100 drm/xe: Consolidate LRC offset calculations Attempt to consolidate the LRC offsets calculations by aligning the recently added wa_bb_offset with the naming scheme in the file and also change the size stored in struct xe_lrc to not include the ring buffer. The former makes it somewhat visually easier to follow the layout of the various logical blocks stored in the LRC bo, while the latter reduces the number of sprinkled around calculations. Signed-off-by: Tvrtko Ursulin Cc: Matthew Brost Cc: Matt Roper Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250630124711.8209-2-tvrtko.ursulin@igalia.com Signed-off-by: Lucas De Marchi commit ac0fe6a5731700bcea6fecfd5d0b76c0454b3a20 Author: Greg Kroah-Hartman Date: Tue Jul 1 14:07:39 2025 +0200 cxl: make cxl_bus_type constant Now that the driver core can properly handle constant struct bus_type, move the cxl_bus_type variable to be a constant structure as well, placing it into read-only memory which can not be modified at runtime. Cc: Davidlohr Bueso Cc: Jonathan Cameron Cc: Dave Jiang Cc: Alison Schofield Cc: Vishal Verma Cc: Ira Weiny Cc: Dan Williams Cc: linux-cxl@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Reviewed-by: Greg Kroah-Hartman Link: https://patch.msgid.link/2025070138-vigorous-negative-eae7@gregkh Signed-off-by: Dave Jiang commit 5ac5e191973920488cc9050dd12574d33b97eba4 Author: Maarten Lankhorst Date: Fri Jun 27 09:41:19 2025 +0200 drm/xe: Fix typo in Kconfig doubut -> doubt. Signed-off-by: Maarten Lankhorst Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250627074119.347826-1-dev@lankhorst.se Signed-off-by: Lucas De Marchi commit fefbc58271be1eaaab1b3c8815569109764a32c4 Author: Mayank Rana Date: Mon Jun 16 15:42:57 2025 -0700 PCI: host-generic: Rename and export gen_pci_init() for PCIe controller drivers Rename gen_pci_init() API as pci_host_common_ecam_create() and export it to allow the PCIe controller drivers to create and configure the ECAM region. Note that this API should only used by the drivers managing the drvdata on their own. Rest should continue using pci_host_common_init() API. Signed-off-by: Mayank Rana [mani: commit message rewording] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250616224259.3549811-3-mayank.rana@oss.qualcomm.com commit a60d92f6d941bd77bf3aaec724a7c95857c0165b Author: Mayank Rana Date: Mon Jun 16 15:42:56 2025 -0700 PCI: dwc: Export DWC MSI controller related APIs Export dw_pcie_msi_host_init(), dw_pcie_msi_init(), and dw_pcie_free_msi() APIs to allow them to be reused by the upcoming DWC based ECAM driver implementation. Also, move MSI IRQ related initialization code to dw_pcie_msi_init(), as this code must be executed before dw_pcie_msi_init() API can be used with ECAM driver. Signed-off-by: Mayank Rana [mani: commit message rewording] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250616224259.3549811-2-mayank.rana@oss.qualcomm.com commit 796cba2dd4d9fb72c2de8fceb4e5c67a6f3c3f9a Author: Laurentiu Mihalcea Date: Tue Jun 10 12:01:49 2025 -0400 bus: add driver for IMX AIPSTZ bridge The secure AHB to IP Slave (AIPSTZ) bus bridge provides access control configurations meant to restrict access to certain peripherals. Some of the configurations include: 1) Marking masters as trusted for R/W. Based on this (and the configuration of the accessed peripheral), the bridge may choose to abort the R/W transactions issued by certain masters. 2) Allowing/disallowing write accesses to peripherals. Add driver for this IP. Since there's currently no framework for access controllers (and since there's currently no need for having flexibility w.r.t the configurations) all this driver does is it applies a relaxed, "default" configuration, in which all masters are trusted for R/W. Note that some instances of this IP (e.g: AIPSTZ5 on i.MX8MP) may be tied to a power domain and may lose their configuration when the domain is powered off. This is why the configuration has to be restored when the domain is powered on. Co-developed-by: Daniel Baluta Signed-off-by: Daniel Baluta Signed-off-by: Laurentiu Mihalcea Signed-off-by: Shawn Guo commit dfc46cdc522d55d54a3d1ab4558e1a06896de37e Author: Laurentiu Mihalcea Date: Tue Jun 10 12:01:48 2025 -0400 dt-bindings: dsp: fsl,dsp: document 'access-controllers' property Some DSP instances may have their access to certain peripherals conditioned by a bus access controller such as the one from the AIPSTZ bridge. Add the optional 'access-controllers' property, which may be used in such cases. Signed-off-by: Laurentiu Mihalcea Reviewed-by: Frank Li Acked-by: Rob Herring (Arm) Signed-off-by: Shawn Guo commit fdb5a1cb8b91feea844ef21c8f41a3dab916111e Author: Laurentiu Mihalcea Date: Tue Jun 10 12:01:47 2025 -0400 dt-bindings: bus: document the IMX AIPSTZ bridge Add documentation for IMX AIPSTZ bridge. Co-developed-by: Daniel Baluta Signed-off-by: Daniel Baluta Signed-off-by: Laurentiu Mihalcea Reviewed-by: Rob Herring (Arm) Signed-off-by: Shawn Guo commit fd1e0fd71f6552238573efa92fd3e6c324986ee3 Author: Song Liu Date: Mon Jun 30 10:45:02 2025 -0700 arm64: Implement HAVE_LIVEPATCH Allocate a task flag used to represent the patch pending state for the task. When a livepatch is being loaded or unloaded, the livepatch code uses this flag to select the proper version of a being patched kernel functions to use for current task. In arch/arm64/Kconfig, select HAVE_LIVEPATCH and include proper Kconfig. This is largely based on [1] by Suraj Jitindar Singh. [1] https://lore.kernel.org/all/20210604235930.603-1-surajjs@amazon.com/ Cc: Suraj Jitindar Singh Cc: Torsten Duwe Acked-by: Miroslav Benes Tested-by: Breno Leitao Tested-by: Andrea della Porta Signed-off-by: Song Liu Acked-by: Will Deacon Link: https://lore.kernel.org/r/20250630174502.842486-1-song@kernel.org Signed-off-by: Catalin Marinas commit fc0d2840a00d75931777e6dba55fcce40f34a24a Author: Joy Zou Date: Mon Jun 9 12:52:37 2025 -0400 arm64: dts: imx93-11x11-evk: remove the duplicated pinctrl_lpi2c3 node Remove the duplicated pinctrl_lpi2c3 node. Reviewed-by: Peng Fan Signed-off-by: Joy Zou Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit b6fb05efd90e0f0bfc3e3d2557b6aa1c65fcbfa6 Author: Clark Wang Date: Mon Jun 9 12:52:36 2025 -0400 arm64: dts: imx93-11x11-evk: reduce the driving strength of net RXC/TXC Reduce the driving strength of all Ethernet RGMII R/TXC pads according to hardware signal measurement result. Signed-off-by: Clark Wang Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 5ac97de00c87d6141bc53990995a7a563e395278 Author: Clark Wang Date: Mon Jun 9 12:52:35 2025 -0400 arm64: dts: imx93-11x11-evk: disable all realtek ethernet phy CLKOUT The realtek phy CLKOUT signal is not used. Disable it to save power. Reviewed-by: Peng Fan Signed-off-by: Clark Wang Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 3ee18578689c6d5831d8455e138bd298977698ff Author: Frank Li Date: Mon Jun 9 12:52:34 2025 -0400 arm64: dts: imx93-qsb/evk: add usdhc3 and lpuart5 Add usdhc3 and lpuart5 for imx93-9x9-qsb, imx93-11x11-evk and imx93-14x14-evk, which connect to onboard wifi/bt module. Reviewed-by: Peng Fan Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 31183946847ea992df89c54e9b5c0d36288f75b4 Author: Clark Wang Date: Mon Jun 9 12:52:33 2025 -0400 arm64: dts: imx93: remove eee-broken-1000t for eqos node The "eee-broken-1000t" was added on 8mm for FEC to avoid issue of ptp sync. EQoS haven't such issue. So, remove this for EQoS phys. Reviewed-by: Peng Fan Signed-off-by: Clark Wang Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 81b0d10550ccf6ba4910027d68b173016643a7c7 Author: Haibo Chen Date: Mon Jun 9 12:52:32 2025 -0400 arm64: dts: imx93-9x9-qsb: add IMU sensor support The i.MX93 9x9 qsb has a ST LSM6DSO connected to I2C, which a is 6-axis IMU (inertial measurement unit = accelerometer & gyroscope). So add the missing parts to the DTS file. Reviewed-by: Peng Fan Signed-off-by: Haibo Chen Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit cf16f408364efd8a68f39011a3b073c83a03612d Author: Xinyu Liu Date: Mon Jun 30 10:02:56 2025 +0800 usb: core: config: Prevent OOB read in SS endpoint companion parsing usb_parse_ss_endpoint_companion() checks descriptor type before length, enabling a potentially odd read outside of the buffer size. Fix this up by checking the size first before looking at any of the fields in the descriptor. Signed-off-by: Xinyu Liu Cc: stable Signed-off-by: Greg Kroah-Hartman commit c277a3d535bb75a498dab03b4236b031b6ba587e Author: Stefano Radaelli Date: Mon Jun 9 18:09:48 2025 +0200 arm64: dts: freescale: imx8mp-var-som: Add EQoS support with MaxLinear PHY Enable the EQoS Ethernet controller on the i.MX8MP VAR-SOM with the integrated Maxlinear MXL86110 PHY. The PHY is connected to the EQOS MDIO bus at address 4. This patch adds: - EQOS controller configuration with RGMII interface. - Proper reset timings. - PHY power supply regulators. - RGMII pinmux configuration for all data, control and clock signals. - LED configuration for link status indication via the LED subsystem under /sys/class/leds/, leveraging the support implemented in the. mxl86110 PHY driver (drivers/net/phy/mxl-86110.c). Two LEDs are defined to match the LED configuration on the Variscite VAR-SOM Carrier Boards: * LED@0: Yellow, netdev trigger. * LED@1: Green, netdev trigger. The RGMII TX/RX delays are implemented in SOM via PCB passive delays, so no software delay configuration is required. Signed-off-by: Stefano Radaelli Signed-off-by: Shawn Guo commit 09b0de8d94ff3a793a3cef2d9c166d115ce08c62 Author: Thomas Richard Date: Mon Jun 9 14:02:34 2025 +0200 arm64: dts: imx8qm: add system controller watchdog support Add system controller watchdog support for i.MX8QM. Acked-by: Oliver Graute Reviewed-by: Frank Li Signed-off-by: Thomas Richard Signed-off-by: Shawn Guo commit bad3fa2fb9206f4dcec6ddef094ec2fbf6e8dcb2 Author: Li Chen Date: Fri Jun 20 21:13:08 2025 +0800 ACPI: Suppress misleading SPCR console message when SPCR table is absent The kernel currently alway prints: "Use ACPI SPCR as default console: No/Yes " even on systems that lack an SPCR table. This can mislead users into thinking the SPCR table exists on the machines without SPCR. With this change, the "Yes" is only printed if the SPCR table is present, parsed and !param_acpi_nospcr. This avoids user confusion on SPCR-less systems. Signed-off-by: Li Chen Acked-by: Hanjun Guo Link: https://lore.kernel.org/r/20250620131309.126555-3-me@linux.beauty Signed-off-by: Catalin Marinas commit b9f58d3572a8e1ef707b941eae58ec4014b9269d Author: Li Chen Date: Fri Jun 20 21:13:07 2025 +0800 ACPI: Return -ENODEV from acpi_parse_spcr() when SPCR support is disabled If CONFIG_ACPI_SPCR_TABLE is disabled, acpi_parse_spcr() currently returns 0, which may incorrectly suggest that SPCR parsing was successful. This patch changes the behavior to return -ENODEV to clearly indicate that SPCR support is not available. This prepares the codebase for future changes that depend on acpi_parse_spcr() failure detection, such as suppressing misleading console messages. Signed-off-by: Li Chen Acked-by: Hanjun Guo Link: https://lore.kernel.org/r/20250620131309.126555-2-me@linux.beauty Signed-off-by: Catalin Marinas commit 900dd54b8b6281b65612c2df87ddaf64f7989d4d Author: Wei Fang Date: Fri Jun 6 15:00:44 2025 -0400 arm64: dts: imx95-19x19-evk: add GPIO reset for ethphy0 Add GPIO reset for ethphy0. Signed-off-by: Wei Fang Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 8ac2f2d53856c5844a5cfac255834e94f96ae271 Author: Luke Wang Date: Fri Jun 6 15:00:43 2025 -0400 arm64: dts: imx95-19x19-evk: adjust pinctrl settings for usdhc2 The driver strength is too high for SDR104 mode. Change the driver strength to x3 according to hardware recommendation. Signed-off-by: Luke Wang Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 04c9dd9c7d19c44c2290373129793213a198552c Author: Xu Yang Date: Fri Jun 6 15:00:42 2025 -0400 arm64: dts: imx95-evk: add USB3 PHY tuning properties Add USB3 PHY tuning properties for imx95-15x15-evk and imx95-19x19-evk boards according to signal measurement results. Signed-off-by: Xu Yang Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 02b7adb791e171bf1ad57084d7f0ce034f744e9f Author: Frank Li Date: Fri Jun 6 15:00:41 2025 -0400 arm64: dts: imx95-19x19-evk: add adc0 flexcan[1,2] i2c[2,3] uart5 spi3 and tpm3 Add adc0 flexcan[1,2] i2c[2,3] uart5 spi3 tpm3 netc_timer and related phys regulators pinmux and related child nodes. Signed-off-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 947771d00bdc6ac1bf5411a964d834996e3e762e Author: Stefano Radaelli Date: Thu Jun 5 10:59:04 2025 +0200 arm64: dts: freescale: imx93-var-som: update eqos support for MaxLinear PHY Variscite has updated the Ethernet PHY on the VAR-SOM-MX93 from the ADIN1300BCPZ to the MaxLinear MXL86110, as documented in the August 2023 revision changelog. Link: https://variwiki.com/index.php?title=VAR-SOM-MX93_rev_changelog Update the device tree accordingly: - Drop the regulator node used to power the previously PHY. - Add support for the reset line using GPIO1_IO07 with proper timings. - Configure the PHY LEDs via the LED subsystem under /sys/class/leds/, leveraging the support implemented in the mxl86110 PHY driver (drivers/net/phy/mxl-86110.c). Two LEDs are defined to match the LED configuration on the Variscite VAR-SOM Carrier Boards: * LED@0: Yellow, netdev trigger. * LED@1: Green, netdev trigger. - Adjust the RGMII clock pad control settings to match the updated PHY requirements. These changes ensure proper PHY initialization and LED status indication for the new MaxLinear MXL86110, improving board compatibility with the latest hardware revision. Signed-off-by: Stefano Radaelli Signed-off-by: Shawn Guo commit 437079605c26dc7c98586580a8c01b5f7f746a79 Author: Thomas Weißschuh Date: Wed Jun 11 12:33:59 2025 +0200 selftests: vDSO: vdso_standalone_test_x86: Replace source file with symlink With the switch over to nolibc the source file vdso_standalone_test_x86.c was intended to be replaced with a symlink to vdso_test_gettimeofday.c. This was the patch that was submitted to LKML, but during application the symlink was replaced by a textual copy of the linked-to file. Having two copies introduces the possibility of divergence and increases maintenance burden, switch back to a symlink. Fixes: 8770a9183fe1 ("selftests: vDSO: vdso_standalone_test_x86: Switch to nolibc") Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/lkml/20250226-parse_vdso-nolibc-v2-16-28e14e031ed8@linutronix.de/ Link: https://lore.kernel.org/all/20250611-selftests-vdso-fixes-v3-9-e62e37a6bcf5@linutronix.de commit 1158220b24674edaf885433153deb4f0e5c7d331 Author: Thomas Weißschuh Date: Wed Jun 11 12:33:58 2025 +0200 selftests: vDSO: vdso_test_getrandom: Always print TAP header The TAP specification requires that the output begins with a header line. If vgetrandom_init() fails and skips the test, that header line is missing. Call vgetrandom_init() after ksft_print_header(). Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Reviewed-by: Muhammad Usama Anjum Link: https://lore.kernel.org/all/20250611-selftests-vdso-fixes-v3-8-e62e37a6bcf5@linutronix.de commit 58265d6424c69daf32ed96288709b23f7538c3e2 Author: Thomas Weißschuh Date: Wed Jun 11 12:33:57 2025 +0200 selftests: vDSO: vdso_test_correctness: Fix -Wstrict-prototypes Functions definitions without any argument list produce a warning with -Wstrict-prototypes: vdso_test_correctness.c:111:13: warning: function declaration isn’t a prototype [-Wstrict-prototypes] 111 | static void fill_function_pointers() | ^~~~~~~~~~~~~~~~~~~~~~ Explicitly use an empty argument list. Now that all selftests a free of this warning, enable it in the Makefile. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250611-selftests-vdso-fixes-v3-7-e62e37a6bcf5@linutronix.de commit 8863cd78a0f10b5b81ca91a558b7e70bcb66e859 Author: Thomas Weißschuh Date: Wed Jun 11 12:33:56 2025 +0200 selftests: vDSO: Enable -Wall Protect against common programming errors through compiler warnings. These warnings are also used for the kernel itself. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250611-selftests-vdso-fixes-v3-6-e62e37a6bcf5@linutronix.de commit ecabe99a0354fcfa237b75d72a2707b3ace3d5e9 Author: Thomas Weißschuh Date: Wed Jun 11 12:33:55 2025 +0200 selftests: vDSO: vdso_config: Avoid -Wunused-variables Not all users of this header make use of all its variables. For example vdso_test_correctness.c does not use "versions": In file included from vdso_test_correctness.c:22: vdso_config.h:61:20: warning: ‘versions’ defined but not used [-Wunused-variable] 61 | static const char *versions[7] = { | ^~~~~~~~ Avoid those warnings through attribute((unused)). Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Reviewed-by: Muhammad Usama Anjum Link: https://lore.kernel.org/all/20250611-selftests-vdso-fixes-v3-5-e62e37a6bcf5@linutronix.de commit b8ae430871254f95dd81dcff01828be3f6b24a57 Author: Thomas Weißschuh Date: Wed Jun 11 12:33:54 2025 +0200 selftests: vDSO: vdso_test_getrandom: Avoid -Wunused vgetrandom_put_state() and the variable "ret" in kselftest() are unused. Drop the variable "ret". Suppress the warning for vgetrandom_put_state() as it is meant as an example for libc implementors. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250611-selftests-vdso-fixes-v3-4-e62e37a6bcf5@linutronix.de commit 1c0fe1c7674121bcb233565bba08f7fcc2a8d5a8 Author: Thomas Weißschuh Date: Wed Jun 11 12:33:53 2025 +0200 selftests: vDSO: vdso_test_getrandom: Drop unused include of linux/compiler.h The header is unused. Furthermore this is not a real UAPI header, but only exists in tools/include/. This prevents building the selftest against real UAPI headers. Drop the include. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250611-selftests-vdso-fixes-v3-3-e62e37a6bcf5@linutronix.de commit 82669e157bd8abeb08d19c6d597620585ece576a Author: Thomas Weißschuh Date: Wed Jun 11 12:33:52 2025 +0200 selftests: vDSO: clock_getres: Drop unused include of err.h Nothing from err.h is used. Drop the include. Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Reviewed-by: Muhammad Usama Anjum Link: https://lore.kernel.org/all/20250611-selftests-vdso-fixes-v3-2-e62e37a6bcf5@linutronix.de commit 2c0a4428f5d6005ff0db12057cc35273593fc040 Author: Thomas Weißschuh Date: Wed Jun 11 12:33:51 2025 +0200 selftests: vDSO: chacha: Correctly skip test if necessary According to kselftest.h ksft_exit_skip() is not meant to be called when a plan has already been printed. Use the recommended function ksft_test_result_skip(). This fixes a bug, where the TAP output would be invalid when skipping: TAP version 13 1..1 ok 2 # SKIP Not implemented on architecture The SKIP line should start with "ok 1" as the plan only contains one test. Fixes: 3b5992eaf730 ("selftests: vDSO: unconditionally build chacha test") Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Reviewed-by: Muhammad Usama Anjum Link: https://lore.kernel.org/all/20250611-selftests-vdso-fixes-v3-1-e62e37a6bcf5@linutronix.de commit e78f70bad29c5ae1e1076698b690b15794e9b81e Author: Greg Kroah-Hartman Date: Tue Jul 1 14:32:25 2025 +0200 time/timecounter: Fix the lie that struct cyclecounter is const In both the read callback for struct cyclecounter, and in struct timecounter, struct cyclecounter is declared as a const pointer. Unfortunatly, a number of users of this pointer treat it as a non-const pointer as it is burried in a larger structure that is heavily modified by the callback function when accessed. This lie had been hidden by the fact that container_of() "casts away" a const attribute of a pointer without any compiler warning happening at all. Fix this all up by removing the const attribute in the needed places so that everyone can see that the structure really isn't const, but can, and is, modified by the users of it. Signed-off-by: Greg Kroah-Hartman Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/2025070124-backyard-hurt-783a@gregkh commit 26a6a9cde64a890997708007d9de25809970eac9 Author: Tim Harvey Date: Wed Jun 4 15:51:04 2025 -0700 arm64: dts: imx8mp-venice-gw74xx: update name of M2SKT_WDIS2# gpio The GW74xx D revision has added a M2SKT_WDIS2# GPIO which routes to the W_DISABLE2# pin of the M.2 socket. Update the gpio name for consistency. Fixes: 6a5d95b06d93 ("arm64: dts: imx8mp-venice-gw74xx: add M2SKT_GPIO10 gpio configuration") Signed-off-by: Tim Harvey Signed-off-by: Shawn Guo commit e396254c2794614ed9b742047da153de638dc2c3 Author: Markus Niebel Date: Wed Jun 4 11:31:21 2025 +0200 arm64: dts: freescale: imx93-tqma9352: add memory node Although the bootloader should fixup with real memory size, add memory node here with smallest assembled size for readability. Signed-off-by: Markus Niebel Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit c3c38e80016548685e439b23999b4f0bd0ad7e05 Author: Arnd Bergmann Date: Fri Jun 20 13:43:58 2025 +0200 leds: tps6131x: Add V4L2_FLASH_LED_CLASS dependency This driver can optionally use the v4l2_flash infrastructure, but fails to link built=in if that is in a loadable module: ld.lld-21: error: undefined symbol: v4l2_flash_release >>> referenced by leds-tps6131x.c:792 (drivers/leds/flash/leds-tps6131x.c:792) Add the usual Kconfig dependency for it, still allowing it to be built when CONFIG_V4L2_FLASH_LED_CLASS is disabled. Fixes: b338a2ae9b31 ("leds: tps6131x: Add support for Texas Instruments TPS6131X flash LED driver") Signed-off-by: Arnd Bergmann Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20250620114440.4080938-1-arnd@kernel.org Signed-off-by: Lee Jones commit 8cc9c7592390c258d3da8b621eca05921b481942 Author: Primoz Fiser Date: Mon Jun 2 14:52:07 2025 +0200 arm64: dts: freescale: imx93-phyboard-nash: Move ADC vref to SoM Move configuration for ADC voltage reference from board DTS to a SoM include file. The SoC ADC reference voltage is connected to a "VDDA_1V8" voltage node and supplied by the PMIC's BUCK5 regulator. The reference voltage is thus defined by the SoM and cannot be changed by the carrier board design and as such belongs into the SoM include file. Moreover, with this in place, customers designing own carrier boards can simply include imx93-phycore-som.dtsi and enable adc1 in their own DTS without the need to define dummy ADC vref regulator themselves anymore. Signed-off-by: Primoz Fiser Reviewed-by: Peng Fan Signed-off-by: Shawn Guo commit 244bc18e5f1875401a4af87d2eae3f9376d9d720 Author: Dan Carpenter Date: Mon Jun 30 14:35:25 2025 -0500 spi: stm32: delete stray tabs in stm32h7_spi_data_idleness() These lines were indented one tab more than they should be. Delete the stray tabs. Signed-off-by: Dan Carpenter Acked-by: Alain Volmat Reviewed-by: Clément Le Goffic Link: https://patch.msgid.link/2033b9fa-7b0f-4617-b94e-7b0a51c5c4b1@sabinyo.mountain Signed-off-by: Mark Brown commit c1d10f4c8e2851eaa6e3be8e1cfbe351c39c5d04 Merge: 29ddce17e90977 b9ab3b61824190 Author: Mark Brown Date: Tue Jul 1 14:01:53 2025 +0100 ASoC: Add SDCA IRQ support and some misc fixups Merge series from Charles Keepax : Add a maintainers entry for SDCA, do a couple of small fixups for previous chains, and then adding the beginnings of the SDCA IRQ handling. This is based around a regmap IRQ chip and a few helper functions that can be called from the client drivers to setup the IRQs. commit 95f2dec053cdad2673a960e9481d191a3a84a1af Author: Jani Nikula Date: Thu Jun 26 13:16:36 2025 +0300 drm/i915/display: drop a number of dependencies on i915_drv.h With the switch to an unordered workqueue dedicated to display, we've stopped using struct drm_i915_private in a number of places, and can drop the dependencies on i915_drv.h. Cc: Luca Coelho Reviewed-by: Luca Coelho Signed-off-by: Jani Nikula Link: https://lore.kernel.org/r/20250626101636.1896365-1-jani.nikula@intel.com commit 64806541619eb5450d138445ddf47ce75d735819 Author: Jani Nikula Date: Thu Jun 26 13:17:12 2025 +0300 drm/i915/fb: use struct intel_display for DISPLAY_VER() Convert a leftover struct drm_i915_private use to struct intel_display. Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250626101712.1898434-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 2dedf83d54c6248317ce86d9fc677f89e37ab04c Author: Danilo Krummrich Date: Sat Jun 28 18:49:54 2025 +0200 rust: dma: require mutable reference for as_slice_mut() and write() Given the safety requirements of as_slice_mut() and write() taking an immutable reference is technically not incorrect. However, let's leverage the compiler's capabilities and require a mutable reference to ensure exclusive access. This also fixes a clippy warning introduced with 1.88: warning: mutable borrow from immutable input(s) --> rust/kernel/dma.rs:297:78 | 297 | pub unsafe fn as_slice_mut(&self, offset: usize, count: usize) -> Result<&mut [T]> { | ^^^^^^^^ Fixes: d37a39f607c4 ("rust: dma: add as_slice/write functions for CoherentAllocation") Reviewed-by: Alice Ryhl Reviewed-by: Andreas Hindborg Reviewed-by: Abdiel Janulgue Reviewed-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250628165120.90149-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 4a3def74d9810f4d4148a3aa17b76d2f0c0f6109 Merge: 19272b37aa4f83 9eb22f7fedfc9e Author: Christian Brauner Date: Tue Jul 1 14:00:21 2025 +0200 Merge patch series "add ioctl to query metadata and protection info capabilities" Anuj Gupta says: This patch series adds a new ioctl to query metadata and integrity capability. * patches from https://lore.kernel.org/20250630090548.3317-1-anuj20.g@samsung.com: fs: add ioctl to query metadata and protection info capabilities nvme: set pi_offset only when checksum type is not BLK_INTEGRITY_CSUM_NONE block: introduce pi_tuple_size field in blk_integrity block: rename tuple_size field in blk_integrity to metadata_size Link: https://lore.kernel.org/20250630090548.3317-1-anuj20.g@samsung.com Signed-off-by: Christian Brauner commit 9eb22f7fedfc9eb1b7f431a5359abd4d15b0b0cd Author: Anuj Gupta Date: Mon Jun 30 14:35:48 2025 +0530 fs: add ioctl to query metadata and protection info capabilities Add a new ioctl, FS_IOC_GETLBMD_CAP, to query metadata and protection info (PI) capabilities. This ioctl returns information about the files integrity profile. This is useful for userspace applications to understand a files end-to-end data protection support and configure the I/O accordingly. For now this interface is only supported by block devices. However the design and placement of this ioctl in generic FS ioctl space allows us to extend it to work over files as well. This maybe useful when filesystems start supporting PI-aware layouts. A new structure struct logical_block_metadata_cap is introduced, which contains the following fields: 1. lbmd_flags: bitmask of logical block metadata capability flags 2. lbmd_interval: the amount of data described by each unit of logical block metadata 3. lbmd_size: size in bytes of the logical block metadata associated with each interval 4. lbmd_opaque_size: size in bytes of the opaque block tag associated with each interval 5. lbmd_opaque_offset: offset in bytes of the opaque block tag within the logical block metadata 6. lbmd_pi_size: size in bytes of the T10 PI tuple associated with each interval 7. lbmd_pi_offset: offset in bytes of T10 PI tuple within the logical block metadata 8. lbmd_pi_guard_tag_type: T10 PI guard tag type 9. lbmd_pi_app_tag_size: size in bytes of the T10 PI application tag 10. lbmd_pi_ref_tag_size: size in bytes of the T10 PI reference tag 11. lbmd_pi_storage_tag_size: size in bytes of the T10 PI storage tag The internal logic to fetch the capability is encapsulated in a helper function blk_get_meta_cap(), which uses the blk_integrity profile associated with the device. The ioctl returns -EOPNOTSUPP, if CONFIG_BLK_DEV_INTEGRITY is not enabled. Suggested-by: Martin K. Petersen Signed-off-by: Anuj Gupta Signed-off-by: Kanchan Joshi Link: https://lore.kernel.org/20250630090548.3317-5-anuj20.g@samsung.com Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Signed-off-by: Christian Brauner commit f3ee50659148e4c1b7d1e58cfec897b14d36a00d Author: Anuj Gupta Date: Mon Jun 30 14:35:47 2025 +0530 nvme: set pi_offset only when checksum type is not BLK_INTEGRITY_CSUM_NONE protection information is treated as opaque when checksum type is BLK_INTEGRITY_CSUM_NONE. In order to maintain the right metadata semantics, set pi_offset only in cases where checksum type is not BLK_INTEGRITY_CSUM_NONE. Signed-off-by: Anuj Gupta Link: https://lore.kernel.org/20250630090548.3317-4-anuj20.g@samsung.com Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Christian Brauner commit 76e45252a4cefa205439eb6610a244771e7d88da Author: Anuj Gupta Date: Mon Jun 30 14:35:46 2025 +0530 block: introduce pi_tuple_size field in blk_integrity Introduce a new pi_tuple_size field in struct blk_integrity to explicitly represent the size (in bytes) of the protection information (PI) tuple. This is a prep patch. Add validation in blk_validate_integrity_limits() to ensure that pi size matches the expected size for known checksum types and never exceeds the pi_tuple_size. Suggested-by: Christoph Hellwig Signed-off-by: Anuj Gupta Link: https://lore.kernel.org/20250630090548.3317-3-anuj20.g@samsung.com Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Christian Brauner commit c6603b1d6556cc02d0169f74508ab0e3e3e4bd76 Author: Anuj Gupta Date: Mon Jun 30 14:35:45 2025 +0530 block: rename tuple_size field in blk_integrity to metadata_size The tuple_size field in blk_integrity currently represents the total size of metadata associated with each data interval. To make the meaning more explicit, rename tuple_size to metadata_size. This is a purely mechanical rename with no functional changes. Suggested-by: Martin K. Petersen Signed-off-by: Anuj Gupta Link: https://lore.kernel.org/20250630090548.3317-2-anuj20.g@samsung.com Reviewed-by: Christoph Hellwig Reviewed-by: Martin K. Petersen Signed-off-by: Christian Brauner commit 6853acd39998a8aed9ac1552d0133640c02bfdfe Author: Masahiro Yamada Date: Tue Jun 3 03:09:35 2025 +0900 arm64: pi: use 'targets' instead of extra-y in Makefile %.pi.o files are built as prerequisites of other objects. There is no need to use extra-y, which is planned for deprecation. Signed-off-by: Masahiro Yamada Link: https://lore.kernel.org/r/20250602180937.528459-1-masahiroy@kernel.org Signed-off-by: Catalin Marinas commit 7ef533938e6cd7d0e33e1c24389c34a21221979b Author: Masahiro Yamada Date: Wed Jun 25 00:05:12 2025 +0900 kconfig: gconf: move init_*() functions below This allows removal of the forward declaration of renderer_edited(). Signed-off-by: Masahiro Yamada commit 290fc035dfeb07fcec57b09d888f837531333af7 Author: Masahiro Yamada Date: Wed Jun 25 00:05:11 2025 +0900 kconfig: gconf: add static qualifiers to variables I also removed unnecessary initializers. Signed-off-by: Masahiro Yamada commit b4809e25e2bf05de6398830f0990abe5dff49ac5 Author: Masahiro Yamada Date: Wed Jun 25 00:05:10 2025 +0900 kconfig: gconf: remove unused 'color' variable This is not used at all. Signed-off-by: Masahiro Yamada commit 57b63d17f73e2d5576e57521fb10307b91439b72 Author: Masahiro Yamada Date: Wed Jun 25 00:05:09 2025 +0900 kconfig: gconf: remove unneeded variables in on_treeview*_button_press_event() Not all position parameters are used here. Passing NULL to gtk_tree_view_get_cursor() or gtk_tree_view_get_path_at_pos() is allowed. [1] [2] [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/2.24.33/gtk/gtktreeview.c#L12638 [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/2.24.33/gtk/gtktreeview.c#L12795 Signed-off-by: Masahiro Yamada commit 8e3136eb27211eaf0560543dd0ee4698c6eb751f Author: Masahiro Yamada Date: Wed Jun 25 00:05:08 2025 +0900 kconfig: gconf: remove unneeded variable in on_split_clicked() The height of the window is not used here. Passing NULL to gtk_window_get_default_size() is allowed. [1] [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/2.24.33/gtk/gtkwindow.c#L3974 Signed-off-by: Masahiro Yamada commit 9b8338fd45fc10961130bc2477aa72e4484e2732 Author: Masahiro Yamada Date: Wed Jun 25 00:05:07 2025 +0900 kconfig: gconf: remove unnecessary NULL checks for tree1 and tree2 The tree1 and tree2 variables are initialized earlier in init_tree_model(), so the NULL checks are redundant. Signed-off-by: Masahiro Yamada commit b3841b501c4a58ba20f190afd25aa4b93cd664f9 Author: Masahiro Yamada Date: Wed Jun 25 00:05:06 2025 +0900 kconfig: gconf: remove parents[] array and indent variable The parents[] array is used to store the GtkTreeIter of parent nodes, but this can be simplified: we can pass a GtkTreeIter pointer down when _display_tree() recurses. Signed-off-by: Masahiro Yamada commit a54b0397d36706ce6f60e0e56709ad94791eda45 Author: Masahiro Yamada Date: Wed Jun 25 00:05:05 2025 +0900 kconfig: gconf: remove internal-child="image" nodes from glade These nodes do not appear to serve anything useful. Signed-off-by: Masahiro Yamada commit f931a5d37a17f941492392b13f0ad67b1bac8bef Author: Masahiro Yamada Date: Wed Jun 25 00:05:04 2025 +0900 kconfig: gconf: remove unnecessary gtk_set_locale() call gtk_set_locale() has been deprecated since version 2.24, and setlocale() should be used directly. [1] However, gtk_init() automatically does this, so there is typically no point in calling this function. [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/2.24.33/gtk/gtkmain.c#L1152 Signed-off-by: Masahiro Yamada commit ace8bee8369c209b647600c3dc28b529e4f44966 Author: Masahiro Yamada Date: Wed Jun 25 00:05:03 2025 +0900 kconfig: gconf: remove gtk_tree_view_set_rules_hint() calls The use of the this function is not recommended, and it has been deprecated since GTK 3.14. [1]: https://gitlab.gnome.org/GNOME/gtk/-/blob/3.14.0/gtk/gtktreeview.c#L11891 Signed-off-by: Masahiro Yamada commit dc1de6c03bc67ff918d904c7f239eaebea34b99b Author: Masahiro Yamada Date: Wed Jun 25 00:05:02 2025 +0900 kconfig: gconf: remove gtk_widget_realize() calls This function is primarily used in widget implementations, and isn't very useful otherwise. Signed-off-by: Masahiro Yamada commit ede0a43249d47660ca977c90a279b6cfc9da314a Author: Masahiro Yamada Date: Wed Jun 25 00:05:01 2025 +0900 kconfig: gconf: remove gtk_tree_view_column_set_visible() calls The columns are visible by default. Signed-off-by: Masahiro Yamada commit 08726436886e05c46efcb0655018a74c534ddead Author: Masahiro Yamada Date: Wed Jun 25 00:05:00 2025 +0900 kconfig: gconf: remove unneeded gtk_tree_view_set_headers_visible() calls The headers are visible by default. Signed-off-by: Masahiro Yamada commit 5575df3d3a216860db720ed5d3d1dcef33ab4d6d Author: Masahiro Yamada Date: Wed Jun 25 00:04:59 2025 +0900 kconfig: gconf: remove meaningless code in init_main_window() The 'widget' variable is set, but not used in later code. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap commit ab2924ab5e75380b007fad1fded809b5ba650b76 Author: Masahiro Yamada Date: Wed Jun 25 00:04:58 2025 +0900 kconfig: gconf: remove empty if-block This if-block is empty. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap commit bff576a2a90954c6b242bf02d915c49f52b1e3cb Author: Masahiro Yamada Date: Wed Jun 25 00:04:57 2025 +0900 kconfig: gconf: remove old #ifdef GTK_CHECK_VERSION Remove old code. Signed-off-by: Masahiro Yamada commit 02bb13bd6c55bffb53de8da1eae87533d332235d Author: Masahiro Yamada Date: Wed Jun 25 00:04:56 2025 +0900 kconfig: gconf: always destroy dialog in on_window1_delete_event() When gtk_dialog_run() returns GTK_RESPONSE_YES or GTK_RESPONSE_NO, gtk_widget_destroy() is not called, resulting in a memory leak. It is better to always destroy the dialog, even if the application is about to exit. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap commit 21deb2d966920f0d4dd098ca6c3a55efbc0b2f23 Author: RubenKelevra Date: Thu Jun 26 22:59:07 2025 +0200 net: ieee8021q: fix insufficient table-size assertion _Static_assert(ARRAY_SIZE(map) != IEEE8021Q_TT_MAX - 1) rejects only a length of 7 and allows any other mismatch. Replace it with a strict equality test via a helper macro so that every mapping table must have exactly IEEE8021Q_TT_MAX (8) entries. Signed-off-by: RubenKelevra Link: https://patch.msgid.link/20250626205907.1566384-1-rubenkelevra@gmail.com Signed-off-by: Paolo Abeni commit 8b79380dfe3c3fb143eba69e6cca36a88606a041 Author: Jakub Kicinski Date: Thu Jun 26 12:15:53 2025 -0700 docs: fbnic: explain the ring config fbnic takes 4 parameters to configure the Rx queues. The semantics are similar to other existing NICs but confusing to newcomers. Document it. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250626191554.32343-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit c22f056e49d905d54a0203a32e344dc422766e38 Author: Oleksij Rempel Date: Thu Jun 26 12:37:31 2025 +0200 net: usb: lan78xx: fix possible NULL pointer dereference in lan78xx_phy_init() If no PHY device is found (e.g., for LAN7801 in fixed-link mode), lan78xx_phy_init() may proceed to dereference a NULL phydev pointer, leading to a crash. Update the logic to perform MAC configuration first, then check for the presence of a PHY. For the fixed-link case, set up the fixed link and return early, bypassing any code that assumes a valid phydev pointer. It is safe to move lan78xx_mac_prepare_for_phy() earlier because this function only uses information from dev->interface, which is configured by lan78xx_get_phy() beforehand. The function does not access phydev or any data set up by later steps. Reported-by: Dan Carpenter Signed-off-by: Oleksij Rempel Fixes: e110bc825897 ("net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management") Link: https://patch.msgid.link/20250626103731.3986545-1-o.rempel@pengutronix.de Signed-off-by: Paolo Abeni commit b75e1f0619bd707e027812e262af3fbce445e71a Author: Matti Vaittinen Date: Mon Jun 9 10:26:47 2025 +0300 device property: Use tidy for_each_named_* macros Implementing if-conditions inside for_each_x() macros requires some thinking to avoid side effects in the calling code. Resulting code may look somewhat awkward, and there are couple of different ways it is usually done. Standardizing this to one way can help making it more obvious for a code reader and writer. The newly added for_each_if() is a way to achieve this. Use for_each_if() to make these macros look like many others which should in the long run help reading the code. Signed-off-by: Matti Vaittinen Acked-by: Sakari Ailus Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/c98b39a7195006fdd24590b8d11bb271a72a0c8a.1749453752.git.mazziesaccount@gmail.com Signed-off-by: Greg Kroah-Hartman commit 626e89412dfb88766d90d842af4d9ec432d8526f Author: Zijun Hu Date: Wed Jun 25 21:53:20 2025 +0800 char: misc: Rename a local variable in misc_init() Local variable @ret is not used for return value in misc_init(). Give it a different name @misc_proc_file. Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250625-fix_mischar-v2-1-25a80f41b090@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit bd80e3ccd6e7485218cc47fbee60db43be86977e Author: Bartosz Golaszewski Date: Tue Jun 24 15:31:40 2025 +0200 greybus: gb-beagleplay: remove unneeded calls to devm_gpiod_put() gb_fw_init() is only called in this driver's probe() and we abort the probing if it fails. This means that calling devm_gpiod_put() in error path is not required as devres will already manage the releasing of the resources when the device is detached. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250624133140.77980-1-brgl@bgdev.pl Signed-off-by: Greg Kroah-Hartman commit 12c409aa1ec2592280a2ddcc66ff8f3c7f7bb171 Author: Denis OSTERLAND-HEIM Date: Wed May 28 12:57:50 2025 +0200 pps: fix poll support Because pps_cdev_poll() returns unconditionally EPOLLIN, a user space program that calls select/poll get always an immediate data ready-to-read response. As a result the intended use to wait until next data becomes ready does not work. User space snippet: struct pollfd pollfd = { .fd = open("/dev/pps0", O_RDONLY), .events = POLLIN|POLLERR, .revents = 0 }; while(1) { poll(&pollfd, 1, 2000/*ms*/); // returns immediate, but should wait if(revents & EPOLLIN) { // always true struct pps_fdata fdata; memset(&fdata, 0, sizeof(memdata)); ioctl(PPS_FETCH, &fdata); // currently fetches data at max speed } } Lets remember the last fetch event counter and compare this value in pps_cdev_poll() with most recent event counter and return 0 if they are equal. Signed-off-by: Denis OSTERLAND-HEIM Co-developed-by: Rodolfo Giometti Signed-off-by: Rodolfo Giometti Fixes: eae9d2ba0cfc ("LinuxPPS: core support") Link: https://lore.kernel.org/all/f6bed779-6d59-4f0f-8a59-b6312bd83b4e@enneenne.com/ Acked-by: Rodolfo Giometti Link: https://lore.kernel.org/r/c3c50ad1eb19ef553eca8a57c17f4c006413ab70.camel@gmail.com Signed-off-by: Greg Kroah-Hartman commit 6bca1e955830808dc90e0506b2951b4256b81bbb Author: Eliav Farber Date: Tue May 27 05:33:55 2025 +0000 pps: clients: gpio: fix interrupt handling order in remove path The interrupt handler in pps_gpio_probe() is registered after calling pps_register_source() using devm_request_irq(). However, in the corresponding remove function, pps_unregister_source() is called before the IRQ is freed, since devm-managed resources are released after the remove function completes. This creates a potential race condition where an interrupt may occur after the PPS source is unregistered but before the handler is removed, possibly leading to a kernel panic. To prevent this, switch from devm-managed IRQ registration to manual management by using request_irq() and calling free_irq() explicitly in the remove path before unregistering the PPS source. This ensures the interrupt handler is safely removed before deactivating the PPS source. Signed-off-by: Eliav Farber Link: https://lore.kernel.org/r/20250527053355.37185-1-farbere@amazon.com Signed-off-by: Greg Kroah-Hartman commit 5accfca0e5ba26fd1113ecf461ffff607244e3b7 Author: Richard Weinberger Date: Tue Apr 8 13:58:21 2025 +0200 Docs/ABI: Fix sysfs-kernel-address_bits path It's address_bits, not address_bit. Fixes: 00142bfd5a91 ("kernels/ksysfs.c: export kernel address bits") Signed-off-by: Richard Weinberger Acked-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250408115823.1358597-1-richard@nod.at Signed-off-by: Greg Kroah-Hartman commit bfb4cf9fb97e4063f0aa62e9e398025fb6625031 Author: Lizhi Xu Date: Fri Jun 27 13:52:14 2025 +0800 vmci: Prevent the dispatching of uninitialized payloads The reproducer executes the host's unlocked_ioctl call in two different tasks. When init_context fails, the struct vmci_event_ctx is not fully initialized when executing vmci_datagram_dispatch() to send events to all vm contexts. This affects the datagram taken from the datagram queue of its context by another task, because the datagram payload is not initialized according to the size payload_size, which causes the kernel data to leak to the user space. Before dispatching the datagram, and before setting the payload content, explicitly set the payload content to 0 to avoid data leakage caused by incomplete payload initialization. Fixes: 28d6692cd8fb ("VMCI: context implementation.") Reported-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=9b9124ae9b12d5af5d95 Tested-by: syzbot+9b9124ae9b12d5af5d95@syzkaller.appspotmail.com Signed-off-by: Lizhi Xu Link: https://lore.kernel.org/r/20250627055214.2967129-1-lizhi.xu@windriver.com Signed-off-by: Greg Kroah-Hartman commit a398c4223b019d1698200d79777ea8d9917fe1a9 Author: Krzysztof Kozlowski Date: Fri May 2 08:20:37 2025 +0200 cdx: controller: Drop unneeded driver.pm NULL assignment Struct driver in platform_driver is zero-ed so there is no need to assign its 'pm' member to NULL. Signed-off-by: Krzysztof Kozlowski Acked-by: Nikhil Agarwal Link: https://lore.kernel.org/r/20250502-cdx-clean-v3-5-6aaa5b369fc5@linaro.org Signed-off-by: Greg Kroah-Hartman commit a46da20be76cd25c791e22532d34d9313b422cf1 Author: Krzysztof Kozlowski Date: Fri May 2 08:20:36 2025 +0200 cdx: controller: Do not open-code module_platform_driver() Replace standard platform_driver_register() boilerplate with module_platform_driver() to make code smaller. Signed-off-by: Krzysztof Kozlowski Acked-by: Nikhil Agarwal Link: https://lore.kernel.org/r/20250502-cdx-clean-v3-4-6aaa5b369fc5@linaro.org Signed-off-by: Greg Kroah-Hartman commit cfe78d4aa9b241ee27b032f71f442d1446aee1fe Author: Krzysztof Kozlowski Date: Fri May 2 08:20:35 2025 +0200 cdx: controller: Drop useless probe success message Drivers should be silent on probe success, unless they print some useful information. Printing "hey I probed" is not useful and kernel already gives mechanism to investigate that (e.g. sysfs, tracing, initcall debug). Signed-off-by: Krzysztof Kozlowski Acked-by: Nikhil Agarwal Link: https://lore.kernel.org/r/20250502-cdx-clean-v3-3-6aaa5b369fc5@linaro.org Signed-off-by: Greg Kroah-Hartman commit fd353a0e49ec3eb2b331783469b391177a6f72fc Author: Krzysztof Kozlowski Date: Fri May 2 08:20:34 2025 +0200 cdx: controller: Simplify with dev_err_probe() Simplify printing probe failures and handling deferred probe with dev_err_probe(). Signed-off-by: Krzysztof Kozlowski Acked-by: Nikhil Agarwal Link: https://lore.kernel.org/r/20250502-cdx-clean-v3-2-6aaa5b369fc5@linaro.org Signed-off-by: Greg Kroah-Hartman commit 7f81907b7e3f93dfed2e903af52659baa4944341 Author: Krzysztof Kozlowski Date: Fri May 2 08:20:33 2025 +0200 cdx: Enable compile testing There is no code limited to ARM64 or OF/Devicetree in the CDX bus driver, so CDX_BUS can be compile tested on all platforms. CDX_CONTROLLER on the other hand selects REMOTEPROC which depends on HAS_DMA, so add that dependency for compile testing. Signed-off-by: Krzysztof Kozlowski Acked-by: Nikhil Agarwal Link: https://lore.kernel.org/r/20250502-cdx-clean-v3-1-6aaa5b369fc5@linaro.org Signed-off-by: Greg Kroah-Hartman commit 2fe1b7ffd83589727d1a4bb38179a46093491249 Author: Dario Binacchi Date: Fri Jun 20 10:06:18 2025 +0200 dt-bindings: arm: fsl: add i.MX28 Amarula rmm board The board includes the following resources: - 256 Mbytes NAND Flash - 128 Mbytes DRAM DDR2 - CAN - USB 2.0 high-speed/full-speed - Ethernet MAC Signed-off-by: Dario Binacchi Acked-by: Conor Dooley Signed-off-by: Shawn Guo commit 765081cde522253cf588a46ac2ba0ab8659a85f4 Author: Dario Binacchi Date: Fri Jun 20 10:06:21 2025 +0200 ARM: mxs_defconfig: select new drivers used by imx28-amarula-rmm Select the options required by the imx28-amarula-rmm board. Signed-off-by: Dario Binacchi Signed-off-by: Shawn Guo commit aa67e2bad30b7401fba9646bb7d65917a420baf1 Author: Dario Binacchi Date: Fri Jun 20 10:06:20 2025 +0200 ARM: mxs_defconfig: Cleanup mxs_defconfig Generate mxs_defconfig by doing: make mxs_defconfig make savedefconfig cp defconfig arch/arm/configs/mxs_defconfig No functional change. The goal here is to cleanup mxs_defconfig file to make easier and cleaner the addition of new entries. Signed-off-by: Dario Binacchi Signed-off-by: Shawn Guo commit ad296c411452d1b490bf4742c2eb7e5e4a400561 Author: Dario Binacchi Date: Fri Jun 20 10:06:19 2025 +0200 ARM: dts: mxs: support i.MX28 Amarula rmm board The board includes the following resources: - 256 Mbytes NAND Flash - 128 Mbytes DRAM DDR2 - CAN - USB 2.0 high-speed/full-speed - Ethernet MAC Signed-off-by: Dario Binacchi Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit b63ae4182b6afa89ad0f7cff9c932328d887b936 Author: Dario Binacchi Date: Fri Jun 20 10:06:17 2025 +0200 ARM: dts: imx28: add pwm7 muxing options Add alternative pinmuxing for pwm7. Signed-off-by: Dario Binacchi Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit a6dca091ba7646ff5304af660c94fa51b6696476 Author: Parav Pandit Date: Thu Jun 26 21:58:08 2025 +0300 RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create Currently, the capability check is done in the default init_user_ns user namespace. When a process runs in a non default user namespace, such check fails. Due to this when a process is running using Podman, it fails to create the QP. Since the RDMA device is a resource within a network namespace, use the network namespace associated with the RDMA device to determine its owning user namespace. Fixes: 6d1e7ba241e9 ("IB/uverbs: Introduce create/destroy QP commands over ioctl") Signed-off-by: Parav Pandit Link: https://patch.msgid.link/7b6b87505ccc28a1f7b4255af94d898d2df0fff5.1750963874.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 0498c2d9984ed2ad75b1cd5ba6abfa1226742df5 Author: Parav Pandit Date: Thu Jun 26 21:58:07 2025 +0300 RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create Currently, the capability check is done in the default init_user_ns user namespace. When a process runs in a non default user namespace, such check fails. Due to this when a process is running using Podman, it fails to create the QP. Since the RDMA device is a resource within a network namespace, use the network namespace associated with the RDMA device to determine its owning user namespace. Fixes: 2dee0e545894 ("IB/uverbs: Enable QP creation with a given source QP number") Signed-off-by: Parav Pandit Link: https://patch.msgid.link/0e5920d1dfe836817bb07576b192da41b637130b.1750963874.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 14957e8125e767bfd40a3ac61b1d6b8e62ee0a98 Author: Parav Pandit Date: Thu Jun 26 21:58:06 2025 +0300 RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create Currently, the capability check is done in the default init_user_ns user namespace. When a process runs in a non default user namespace, such check fails. Due to this when a process is running using Podman, it fails to create the anchor. Since the RDMA device is a resource within a network namespace, use the network namespace associated with the RDMA device to determine its owning user namespace. Fixes: 0c6ab0ca9a66 ("RDMA/mlx5: Expose steering anchor to userspace") Signed-off-by: Parav Pandit Link: https://patch.msgid.link/c2376ca75e7658e2cbd1f619cf28fbe98c906419.1750963874.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 95a89ec304c38f7447cdbf271f2d1cbad4c3bf81 Author: Parav Pandit Date: Thu Jun 26 21:58:05 2025 +0300 RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create Currently, the capability check is done in the default init_user_ns user namespace. When a process runs in a non default user namespace, such check fails. Due to this when a process is running using Podman, it fails to create the flow. Since the RDMA device is a resource within a network namespace, use the network namespace associated with the RDMA device to determine its owning user namespace. Fixes: 322694412400 ("IB/mlx5: Introduce driver create and destroy flow methods") Signed-off-by: Parav Pandit Link: https://patch.msgid.link/a4dcd5e3ac6904ef50b19e56942ca6ab0728794c.1750963874.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit f458ccd2aa2c5a6f0129a9b1548f2825071fdc6b Author: Parav Pandit Date: Thu Jun 26 21:58:04 2025 +0300 RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create Currently, the capability check is done in the default init_user_ns user namespace. When a process runs in a non default user namespace, such check fails. Due to this when a process is running using Podman, it fails to create the flow resource. Since the RDMA device is a resource within a network namespace, use the network namespace associated with the RDMA device to determine its owning user namespace. Fixes: 436f2ad05a0b ("IB/core: Export ib_create/destroy_flow through uverbs") Signed-off-by: Parav Pandit Suggested-by: Eric W. Biederman Link: https://patch.msgid.link/6df6f2f24627874c4f6d041c19dc1f6f29f68f84.1750963874.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit b9ff1c2a26fa31216be18e9b14c419ff8fe39e72 Author: Shankari Anand Date: Thu Jun 26 16:15:20 2025 +0530 rust: miscdevice: clarify invariant for `MiscDeviceRegistration` Reword and expand the invariant documentation for `MiscDeviceRegistration` to clarify what it means for the inner device to be "registered". It expands to explain: - `inner` points to a `miscdevice` registered via `misc_register`. - This registration stays valid for the entire lifetime of the object. - Deregistration is guaranteed on `Drop`, via `misc_deregister`. Reported-by: Benno Lossin Closes: https://github.com/Rust-for-Linux/linux/issues/1168 Fixes: f893691e7426 ("rust: miscdevice: add base miscdevice abstraction") Signed-off-by: Shankari Anand Link: https://lore.kernel.org/r/20250626104520.563036-1-shankari.ak0208@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9b5cdd5f40191d11d3b535ab7978751a4a3e4bc5 Author: FUJITA Tomonori Date: Tue Jun 24 07:58:46 2025 +0900 rust: fix typo in #[repr(transparent)] comments Fix a typo in several comments where `#[repr(transparent)]` was mistakenly written as `#[repr(transparent)` (missing closing bracket). Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250623225846.169805-1-fujita.tomonori@gmail.com Signed-off-by: Greg Kroah-Hartman commit 0c8a3a284a4fb56f0540f216f7428b39ba911ac8 Author: Max Shevchenko Date: Tue Jul 1 09:06:55 2025 +0300 dt-bindings: serial: mediatek,uart: add MT6572 Add a compatible string for serial on the MT6572 SoC. Acked-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Max Shevchenko Link: https://lore.kernel.org/r/20250701-mt6572-v3-1-8937cfa33f95@proton.me Signed-off-by: Greg Kroah-Hartman commit 12853b279100adc7074b51db23bf62a41cb84cb8 Author: Philipp Zabel Date: Fri Jun 27 13:45:41 2025 +0200 drm/mipi-dsi: Drop MIPI_DSI_MODE_VSYNC_FLUSH flag Drop the unused MIPI_DSI_MODE_VSYNC_FLUSH flag. Whether or not a display FIFO flush on vsync is required to avoid sending garbage to the panel is not a property of the DSI link, but of the integration between display controller and DSI host bridge. Acked-by: Marek Szyprowski Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/20250627-dsi-vsync-flush-v2-4-4066899a5608@pengutronix.de Signed-off-by: Philipp Zabel commit 5c449ddbaba1c807c4674f92e5ebf6a887edb58c Author: Philipp Zabel Date: Fri Jun 27 13:45:40 2025 +0200 drm/panel: samsung-s6e8aa0: Drop MIPI_DSI_MODE_VSYNC_FLUSH flag Drop the MIPI_DSI_MODE_VSYNC_FLUSH flag from DSI mode_flags. It has no effect anymore. Acked-by: Marek Szyprowski Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/20250627-dsi-vsync-flush-v2-3-4066899a5608@pengutronix.de Signed-off-by: Philipp Zabel commit f488640e51312fbca02f9229d238a2aed7a8aac9 Author: Philipp Zabel Date: Fri Jun 27 13:45:39 2025 +0200 drm/panel: samsung-s6d7aa0: Drop MIPI_DSI_MODE_VSYNC_FLUSH flag Drop the MIPI_DSI_MODE_VSYNC_FLUSH flag from DSI mode_flags. It has no effect anymore. Acked-by: Marek Szyprowski Acked-by: Neil Armstrong Link: https://lore.kernel.org/r/20250627-dsi-vsync-flush-v2-2-4066899a5608@pengutronix.de Signed-off-by: Philipp Zabel commit a36c533ad3e1b8c0326d665d2d02d2ef7aea8f92 Author: Philipp Zabel Date: Fri Jun 27 13:45:38 2025 +0200 drm/bridge: samsung-dsim: Always flush display FIFO on vsync pulse Always flush the display FIFO on vsync pulse, even if not explicitly requested by the panel via MIPI_DSI_MODE_VSYNC_FLUSH mode_flag. The display FIFO should be empty at vsync. Flushing it at vsync pulses helps to remove garbage that may have entered the FIFO during startup (if synchronisation between upstream display controller and Samsung DSIM is lacking) and that may persist in form of last frame's leftovers on subsequent frames. Flushing the display FIFO if it is already empty should have no effect. This will allow to remove the MIPI_DSI_MODE_VSYNC_FLUSH flag, which is only used by the Samsung DSIM bridge driver. Arguably this flag doesn't belong in the panel configuration at all: flushing the display FIFO on vsync is a workaround for issues with the integration between display controller and DSI bridge, not a property of the DSI link between bridge and panel. No panel actually has a requirement to receive garbage or old frame content after vsync. I wonder if host controller FIFO resets are mentioned by the MIPI DSI specification at all. This patch is based on the assumption that the MIPI_DSI_MODE_VSYNC_FLUSH flag only exists because the DSIM_MFLUSH_VS bit happens to be located in the same register as the bits controlling the DSI mode. Acked-by: Marek Szyprowski Link: https://lore.kernel.org/r/20250627-dsi-vsync-flush-v2-1-4066899a5608@pengutronix.de Signed-off-by: Philipp Zabel commit 1d99f92f71b6b4b2eee776562c991428490f71ef Author: Peter Robinson Date: Mon Jun 30 18:52:58 2025 +0100 reset: brcmstb: Enable reset drivers for ARCH_BCM2835 The BRCMSTB and BRCMSTB_RESCAL reset drivers are also used in the BCM2712, AKA the RPi5. The RPi platforms have typically used the ARCH_BCM2835, and the PCIe support for this SoC can use this config which depends on these drivers so enable building them when just that arch option is enabled to ensure the platform works as expected. Signed-off-by: Peter Robinson Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20250630175301.846082-1-pbrobinson@gmail.com Signed-off-by: Philipp Zabel commit 8f240030794ca027fa669b447c0f27ffd8ae72d5 Merge: aed4969f2bdfda c9a7bcd2c016ac Author: Paolo Abeni Date: Tue Jul 1 09:49:21 2025 +0200 Merge branch 'clean-up-usage-of-ffi-types' Tamir Duberstein says: ==================== Clean up usage of ffi types Remove qualification of ffi types which are included in the prelude and change `as` casts to target the proper ffi type alias rather than the underlying primitive. Signed-off-by: Tamir Duberstein ==================== Link: https://patch.msgid.link/20250625-correct-type-cast-v2-0-6f2c29729e69@gmail.com Signed-off-by: Paolo Abeni commit c9a7bcd2c016ac814fd56e5a2b0946fb14960de4 Author: Tamir Duberstein Date: Wed Jun 25 05:25:39 2025 -0700 Cast to the proper type Use the ffi type rather than the resolved underlying type. Acked-by: FUJITA Tomonori Signed-off-by: Tamir Duberstein Link: https://patch.msgid.link/20250625-correct-type-cast-v2-2-6f2c29729e69@gmail.com Signed-off-by: Paolo Abeni commit 22955d942f281e476f1db997c1fd4f24c6e3b693 Author: Tamir Duberstein Date: Wed Jun 25 05:25:38 2025 -0700 Use unqualified references to ffi types Remove unnecessary qualifications; `kernel::ffi::*` is included in `kernel::prelude`. Signed-off-by: Tamir Duberstein Reviewed-by: FUJITA Tomonori Link: https://patch.msgid.link/20250625-correct-type-cast-v2-1-6f2c29729e69@gmail.com Signed-off-by: Paolo Abeni commit 5af89b6309417bdc2ff6835509d33a172c4a3218 Author: Andy Shevchenko Date: Mon Jun 30 13:17:45 2025 +0300 platform/chrome: chromeos_laptop: Replace open coded variant of DEFINE_RES_IRQ() DEFINE_RES_*() are compound literals, and hence no need to do that explicitly. Besides that, we have no IRQ name provided, no need to use _NAMED() variant. Replace open coded variant of DEFINE_RES_IRQ(). No functional changes intended. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250630101745.1855918-1-andriy.shevchenko@linux.intel.com Signed-off-by: Tzung-Bi Shih commit 0c8fe93f4e7767b0e579959de051dcaddd7197fd Author: Andy Shevchenko Date: Mon Jun 30 13:12:25 2025 +0300 platform/chrome: chromeos_laptop: Remove duplicate check fwnode_remove_software_node() is aware of invalid input, no need to perform checks in the caller. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250630101225.1855431-1-andriy.shevchenko@linux.intel.com Signed-off-by: Tzung-Bi Shih commit 857f431824aacb22bd051c0f4c44c708659028b1 Author: Caleb Sander Mateos Date: Fri Jun 20 09:10:08 2025 -0600 ublk: cache-align struct ublk_io struct ublk_io is already 56 bytes on 64-bit architectures, so round it up to a full cache line (typically 64 bytes). This ensures a single ublk_io doesn't span multiple cache lines and prevents false sharing if consecutive ublk_io's are accessed by different daemon tasks. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-15-csander@purestorage.com Signed-off-by: Jens Axboe commit c9d066ebfd2fbd89173716f60578ed6e416712e4 Author: Caleb Sander Mateos Date: Fri Jun 20 09:10:07 2025 -0600 ublk: remove ubq checks from ublk_{get,put}_req_ref() ublk_get_req_ref() and ublk_put_req_ref() currently call ublk_need_req_ref(ubq) to check whether the ublk device features require reference counting of its requests. However, all callers already know that reference counting is required: - __ublk_check_and_get_req() is only called from ublk_check_and_get_req() if user copy is enabled, and from ublk_register_io_buf() if zero copy is enabled - ublk_io_release() is only called for requests registered by ublk_register_io_buf(), which requires zero copy - ublk_ch_read_iter() and ublk_ch_write_iter() only call ublk_put_req_ref() if ublk_check_and_get_req() succeeded, which requires user copy to be enabled So drop the ublk_need_req_ref() check and the ubq argument in ublk_get_req_ref() and ublk_put_req_ref(). Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-14-csander@purestorage.com Signed-off-by: Jens Axboe commit 1ceeedb5974937a6d881fd0d92f143ca16f55577 Author: Caleb Sander Mateos Date: Fri Jun 20 09:10:06 2025 -0600 ublk: optimize UBLK_IO_UNREGISTER_IO_BUF on daemon task ublk_io_release() performs an expensive atomic refcount decrement. This atomic operation is unnecessary in the common case where the request's buffer is registered and unregistered on the daemon task before handling UBLK_IO_COMMIT_AND_FETCH_REQ for the I/O. So if ublk_io_release() is called on the daemon task and task_registered_buffers is positive, just decrement task_registered_buffers (nonatomically). ublk_sub_req_ref() will apply this decrement when it atomically subtracts from io->ref. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-13-csander@purestorage.com Signed-off-by: Jens Axboe commit 8a8fe42d765bb22cc0e91b053bfebf0fbdec3b5a Author: Caleb Sander Mateos Date: Fri Jun 20 09:10:05 2025 -0600 ublk: optimize UBLK_IO_REGISTER_IO_BUF on daemon task ublk_register_io_buf() performs an expensive atomic refcount increment, as well as a lot of pointer chasing to look up the struct request. Create a separate ublk_daemon_register_io_buf() for the daemon task to call. Initialize ublk_io's reference count to a large number, introduce a field task_registered_buffers to count the buffers registered on the daemon task, and atomically subtract the large number minus task_registered_buffers in ublk_commit_and_fetch(). Also obtain the struct request directly from ublk_io's req field instead of looking it up on the tagset. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-12-csander@purestorage.com Signed-off-by: Jens Axboe commit 7ab741081be307e3ec5dc8ed55ed8fc0f5b2a0e3 Author: Caleb Sander Mateos Date: Fri Jun 20 09:10:04 2025 -0600 ublk: return early if blk_should_fake_timeout() Make the unlikely case blk_should_fake_timeout() return early to reduce the indentation of the successful path. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-11-csander@purestorage.com Signed-off-by: Jens Axboe commit 763ff02ce287c2e5c8a012d40bd2f3dab99ae5d5 Author: Caleb Sander Mateos Date: Fri Jun 20 09:10:03 2025 -0600 ublk: allow UBLK_IO_(UN)REGISTER_IO_BUF on any task Currently, UBLK_IO_REGISTER_IO_BUF and UBLK_IO_UNREGISTER_IO_BUF are only permitted on the ublk_io's daemon task. But this restriction is unnecessary. ublk_register_io_buf() calls __ublk_check_and_get_req() to look up the request from the tagset and atomically take a reference on the request without accessing the ublk_io. ublk_unregister_io_buf() doesn't use the q_id or tag at all. So allow these opcodes even on tasks other than io->task. Handle UBLK_IO_UNREGISTER_IO_BUF before obtaining the ubq and io since the buffer index being unregistered is not necessarily related to the specified q_id and tag. Add a feature flag UBLK_F_BUF_REG_OFF_DAEMON that userspace can use to determine whether the kernel supports off-daemon buffer registration. Suggested-by: Ming Lei Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-10-csander@purestorage.com Signed-off-by: Jens Axboe commit 2da1e7bb3f7230b71ce22df05494b6a4453b4e79 Author: Caleb Sander Mateos Date: Fri Jun 20 09:10:02 2025 -0600 ublk: don't take ublk_queue in ublk_unregister_io_buf() UBLK_IO_UNREGISTER_IO_BUF currently requires a valid q_id and tag to be passed in the ublksrv_io_cmd. However, only the addr (registered buffer index) is actually used to unregister the buffer. There is no check that the q_id and tag are for the ublk request whose buffer is registered at the given index. To prepare to allow userspace to omit the q_id and tag, check the UBLK_F_SUPPORT_ZERO_COPY flag on the ublk_device instead of the ublk_queue. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-9-csander@purestorage.com Signed-off-by: Jens Axboe commit aed4969f2bdfda5a2670684a02f483d261152816 Author: Eric Dumazet Date: Fri Jun 27 16:32:42 2025 +0000 net: net->nsid_lock does not need BH safety At the time of commit bc51dddf98c9 ("netns: avoid disabling irq for netns id") peernet2id() was not yet using RCU. Commit 2dce224f469f ("netns: protect netns ID lookups with RCU") changed peernet2id() to no longer acquire net->nsid_lock (potentially from BH context). We do not need to block soft interrupts when acquiring net->nsid_lock anymore. Signed-off-by: Eric Dumazet Cc: Guillaume Nault Cc: Cong Wang Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250627163242.230866-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 7878e21e40d47f3e55968eec8b8c690d6b8f7813 Merge: b7ad21258f9e9a 4c7ef319848faa Author: Jakub Kicinski Date: Mon Jun 30 18:23:57 2025 -0700 Merge branch 'net-enetc-change-some-statistics-to-64-bit' Wei Fang says: ==================== net: enetc: change some statistics to 64-bit The port MAC counters of ENETC are 64-bit registers and the statistics of ethtool are also u64 type, so add enetc_port_rd64() helper function to read 64-bit statistics from these registers, and also change the statistics of ring to unsigned long type to be consistent with the statistics type in struct net_device_stats. v1: https://lore.kernel.org/20250620102140.2020008-1-wei.fang@nxp.com v2: https://lore.kernel.org/20250624101548.2669522-1-wei.fang@nxp.com ==================== Link: https://patch.msgid.link/20250627021108.3359642-1-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 4c7ef319848faac5ac8c4b0b3e31a82fe59502f0 Author: Wei Fang Date: Fri Jun 27 10:11:08 2025 +0800 net: enetc: read 64-bit statistics from port MAC counters The counters of port MAC are all 64-bit registers, and the statistics of ethtool are u64 type, so replace enetc_port_rd() with enetc_port_rd64() to read 64-bit statistics. Signed-off-by: Wei Fang Reviewed-by: Claudiu Manoil Reviewed-by: Frank Li Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250627021108.3359642-4-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit 9fe5f7145ad746e1b8e7522b8a955f642ff1b404 Author: Wei Fang Date: Fri Jun 27 10:11:07 2025 +0800 net: enetc: separate 64-bit counters from enetc_port_counters Some counters in enetc_port_counters are 32-bit registers, and some are 64-bit registers. But in the current driver, they are all read through enetc_port_rd(), which can only read a 32-bit value. Therefore, separate 64-bit counters (enetc_pm_counters) from enetc_port_counters and use enetc_port_rd64() to read the 64-bit statistics. Signed-off-by: Wei Fang Reviewed-by: Claudiu Manoil Reviewed-by: Frank Li Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250627021108.3359642-3-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit f5ed33771bced4a0743ec2cef7b4e220a08db5c9 Author: Wei Fang Date: Fri Jun 27 10:11:06 2025 +0800 net: enetc: change the statistics of ring to unsigned long type The statistics of the ring are all unsigned int type, so the statistics will overflow quickly under heavy traffic. In addition, the statistics of struct net_device_stats are obtained from struct enetc_ring_stats, but the statistics of net_device_stats are unsigned long type. So it is better to keep the statistics types consistent in these two structures. Considering these two factors, and the fact that both LS1028A and i.MX95 are arm64 architecture, the statistics of enetc_ring_stats are changed to unsigned long type. Note that unsigned int and unsigned long are the same thing on some systems, and on such systems there is no overflow advantage of one over the other. Signed-off-by: Wei Fang Reviewed-by: Claudiu Manoil Reviewed-by: Frank Li Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250627021108.3359642-2-wei.fang@nxp.com Signed-off-by: Jakub Kicinski commit b7ad21258f9e9a7f58b19595d5ceed2cde3bed68 Author: Jonas Rebmann Date: Thu Jun 26 15:44:02 2025 +0200 net: fec: allow disable coalescing In the current implementation, IP coalescing is always enabled and cannot be disabled. As setting maximum frames to 0 or 1, or setting delay to zero implies immediate delivery of single packets/IRQs, disable coalescing in hardware in these cases. This also guarantees that coalescing is never enabled with ICFT or ICTT set to zero, a configuration that could lead to unpredictable behaviour according to i.MX8MP reference manual. Signed-off-by: Jonas Rebmann Reviewed-by: Wei Fang Link: https://patch.msgid.link/20250626-fec_deactivate_coalescing-v2-1-0b217f2e80da@pengutronix.de Signed-off-by: Jakub Kicinski commit b28fe7f20a05f824a07aeecccd8bd71c29ff99e4 Merge: af232e7615e45e 171f2ee31a42f1 Author: Jakub Kicinski Date: Mon Jun 30 18:14:25 2025 -0700 Merge branch 'add-support-for-externally-validated-neighbor-entries' Ido Schimmel says: ==================== Add support for externally validated neighbor entries Patch #1 adds a new neighbor flag ("extern_valid") that prevents the kernel from invalidating or removing a neighbor entry, while allowing the kernel to notify user space when the entry becomes reachable. See motivation and implementation details in the commit message. Patch #2 adds a selftest. v1: https://lore.kernel.org/20250611141551.462569-1-idosch@nvidia.com ==================== Link: https://patch.msgid.link/20250626073111.244534-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 171f2ee31a42f1802299862686c2521eda77dc61 Author: Ido Schimmel Date: Thu Jun 26 10:31:11 2025 +0300 selftests: net: Add a selftest for externally validated neighbor entries Add test cases for externally validated neighbor entries, testing both IPv4 and IPv6. Name the file "test_neigh.sh" so that it could be possibly extended in the future with more neighbor test cases. Example output: # ./test_neigh.sh TEST: IPv4 "extern_valid" flag: Add entry [ OK ] TEST: IPv4 "extern_valid" flag: Add with an invalid state [ OK ] TEST: IPv4 "extern_valid" flag: Add with "use" flag [ OK ] TEST: IPv4 "extern_valid" flag: Replace entry [ OK ] TEST: IPv4 "extern_valid" flag: Replace entry with "managed" flag [ OK ] TEST: IPv4 "extern_valid" flag: Replace with an invalid state [ OK ] TEST: IPv4 "extern_valid" flag: Interface down [ OK ] TEST: IPv4 "extern_valid" flag: Carrier down [ OK ] TEST: IPv4 "extern_valid" flag: Transition to "reachable" state [ OK ] TEST: IPv4 "extern_valid" flag: Transition back to "stale" state [ OK ] TEST: IPv4 "extern_valid" flag: Forced garbage collection [ OK ] TEST: IPv4 "extern_valid" flag: Periodic garbage collection [ OK ] TEST: IPv6 "extern_valid" flag: Add entry [ OK ] TEST: IPv6 "extern_valid" flag: Add with an invalid state [ OK ] TEST: IPv6 "extern_valid" flag: Add with "use" flag [ OK ] TEST: IPv6 "extern_valid" flag: Replace entry [ OK ] TEST: IPv6 "extern_valid" flag: Replace entry with "managed" flag [ OK ] TEST: IPv6 "extern_valid" flag: Replace with an invalid state [ OK ] TEST: IPv6 "extern_valid" flag: Interface down [ OK ] TEST: IPv6 "extern_valid" flag: Carrier down [ OK ] TEST: IPv6 "extern_valid" flag: Transition to "reachable" state [ OK ] TEST: IPv6 "extern_valid" flag: Transition back to "stale" state [ OK ] TEST: IPv6 "extern_valid" flag: Forced garbage collection [ OK ] TEST: IPv6 "extern_valid" flag: Periodic garbage collection [ OK ] Signed-off-by: Ido Schimmel Link: https://patch.msgid.link/20250626073111.244534-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 03dc03fa0432a9160c4fcbdb86f274e6b4587972 Author: Ido Schimmel Date: Thu Jun 26 10:31:10 2025 +0300 neighbor: Add NTF_EXT_VALIDATED flag for externally validated entries tl;dr ===== Add a new neighbor flag ("extern_valid") that can be used to indicate to the kernel that a neighbor entry was learned and determined to be valid externally. The kernel will not try to remove or invalidate such an entry, leaving these decisions to the user space control plane. This is needed for EVPN multi-homing where a neighbor entry for a multi-homed host needs to be synced across all the VTEPs among which the host is multi-homed. Background ========== In a typical EVPN multi-homing setup each host is multi-homed using a set of links called ES (Ethernet Segment, i.e., LAG) to multiple leaf switches (VTEPs). VTEPs that are connected to the same ES are called ES peers. When a neighbor entry is learned on a VTEP, it is distributed to both ES peers and remote VTEPs using EVPN MAC/IP advertisement routes. ES peers use the neighbor entry when routing traffic towards the multi-homed host and remote VTEPs use it for ARP/NS suppression. Motivation ========== If the ES link between a host and the VTEP on which the neighbor entry was locally learned goes down, the EVPN MAC/IP advertisement route will be withdrawn and the neighbor entries will be removed from both ES peers and remote VTEPs. Routing towards the multi-homed host and ARP/NS suppression can fail until another ES peer locally learns the neighbor entry and distributes it via an EVPN MAC/IP advertisement route. "draft-rbickhart-evpn-ip-mac-proxy-adv-03" [1] suggests avoiding these intermittent failures by having the ES peers install the neighbor entries as before, but also injecting EVPN MAC/IP advertisement routes with a proxy indication. When the previously mentioned ES link goes down and the original EVPN MAC/IP advertisement route is withdrawn, the ES peers will not withdraw their neighbor entries, but instead start aging timers for the proxy indication. If an ES peer locally learns the neighbor entry (i.e., it becomes "reachable"), it will restart its aging timer for the entry and emit an EVPN MAC/IP advertisement route without a proxy indication. An ES peer will stop its aging timer for the proxy indication if it observes the removal of the proxy indication from at least one of the ES peers advertising the entry. In the event that the aging timer for the proxy indication expired, an ES peer will withdraw its EVPN MAC/IP advertisement route. If the timer expired on all ES peers and they all withdrew their proxy advertisements, the neighbor entry will be completely removed from the EVPN fabric. Implementation ============== In the above scheme, when the control plane (e.g., FRR) advertises a neighbor entry with a proxy indication, it expects the corresponding entry in the data plane (i.e., the kernel) to remain valid and not be removed due to garbage collection or loss of carrier. The control plane also expects the kernel to notify it if the entry was learned locally (i.e., became "reachable") so that it will remove the proxy indication from the EVPN MAC/IP advertisement route. That is why these entries cannot be programmed with dummy states such as "permanent" or "noarp". Instead, add a new neighbor flag ("extern_valid") which indicates that the entry was learned and determined to be valid externally and should not be removed or invalidated by the kernel. The kernel can probe the entry and notify user space when it becomes "reachable" (it is initially installed as "stale"). However, if the kernel does not receive a confirmation, have it return the entry to the "stale" state instead of the "failed" state. In other words, an entry marked with the "extern_valid" flag behaves like any other dynamically learned entry other than the fact that the kernel cannot remove or invalidate it. One can argue that the "extern_valid" flag should not prevent garbage collection and that instead a neighbor entry should be programmed with both the "extern_valid" and "extern_learn" flags. There are two reasons for not doing that: 1. Unclear why a control plane would like to program an entry that the kernel cannot invalidate but can completely remove. 2. The "extern_learn" flag is used by FRR for neighbor entries learned on remote VTEPs (for ARP/NS suppression) whereas here we are concerned with local entries. This distinction is currently irrelevant for the kernel, but might be relevant in the future. Given that the flag only makes sense when the neighbor has a valid state, reject attempts to add a neighbor with an invalid state and with this flag set. For example: # ip neigh add 192.0.2.1 nud none dev br0.10 extern_valid Error: Cannot create externally validated neighbor with an invalid state. # ip neigh add 192.0.2.1 lladdr 00:11:22:33:44:55 nud stale dev br0.10 extern_valid # ip neigh replace 192.0.2.1 nud failed dev br0.10 extern_valid Error: Cannot mark neighbor as externally validated with an invalid state. The above means that a neighbor cannot be created with the "extern_valid" flag and flags such as "use" or "managed" as they result in a neighbor being created with an invalid state ("none") and immediately getting probed: # ip neigh add 192.0.2.1 lladdr 00:11:22:33:44:55 nud stale dev br0.10 extern_valid use Error: Cannot create externally validated neighbor with an invalid state. However, these flags can be used together with "extern_valid" after the neighbor was created with a valid state: # ip neigh add 192.0.2.1 lladdr 00:11:22:33:44:55 nud stale dev br0.10 extern_valid # ip neigh replace 192.0.2.1 lladdr 00:11:22:33:44:55 nud stale dev br0.10 extern_valid use One consequence of preventing the kernel from invalidating a neighbor entry is that by default it will only try to determine reachability using unicast probes. This can be changed using the "mcast_resolicit" sysctl: # sysctl net.ipv4.neigh.br0/10.mcast_resolicit 0 # tcpdump -nn -e -i br0.10 -Q out arp & # ip neigh replace 192.0.2.1 lladdr 00:11:22:33:44:55 nud stale dev br0.10 extern_valid use 62:50:1d:11:93:6f > 00:11:22:33:44:55, ethertype ARP (0x0806), length 42: Request who-has 192.0.2.1 tell 192.0.2.2, length 28 62:50:1d:11:93:6f > 00:11:22:33:44:55, ethertype ARP (0x0806), length 42: Request who-has 192.0.2.1 tell 192.0.2.2, length 28 62:50:1d:11:93:6f > 00:11:22:33:44:55, ethertype ARP (0x0806), length 42: Request who-has 192.0.2.1 tell 192.0.2.2, length 28 # sysctl -wq net.ipv4.neigh.br0/10.mcast_resolicit=3 # ip neigh replace 192.0.2.1 lladdr 00:11:22:33:44:55 nud stale dev br0.10 extern_valid use 62:50:1d:11:93:6f > 00:11:22:33:44:55, ethertype ARP (0x0806), length 42: Request who-has 192.0.2.1 tell 192.0.2.2, length 28 62:50:1d:11:93:6f > 00:11:22:33:44:55, ethertype ARP (0x0806), length 42: Request who-has 192.0.2.1 tell 192.0.2.2, length 28 62:50:1d:11:93:6f > 00:11:22:33:44:55, ethertype ARP (0x0806), length 42: Request who-has 192.0.2.1 tell 192.0.2.2, length 28 62:50:1d:11:93:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.0.2.1 tell 192.0.2.2, length 28 62:50:1d:11:93:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.0.2.1 tell 192.0.2.2, length 28 62:50:1d:11:93:6f > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: Request who-has 192.0.2.1 tell 192.0.2.2, length 28 iproute2 patches can be found here [2]. [1] https://datatracker.ietf.org/doc/html/draft-rbickhart-evpn-ip-mac-proxy-adv-03 [2] https://github.com/idosch/iproute2/tree/submit/extern_valid_v1 Signed-off-by: Ido Schimmel Acked-by: Daniel Borkmann Link: https://patch.msgid.link/20250626073111.244534-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit c3aa8c7278aeffa1cc0fc15d7f7d02746b83c4cd Author: Nuno Sá Date: Mon May 19 16:41:12 2025 +0100 clk: clk-axi-clkgen: fix coding style issues This is just cosmetics and so no functional changes intended. While at it, sort header in alphabetical order. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250519-dev-axi-clkgen-limits-v6-7-bc4b3b61d1d4@analog.com Reviewed-by: David Lechner Signed-off-by: Stephen Boyd commit 34e42e9a92cfc1e394fc6c146b4707e37eeb7166 Author: Nuno Sá Date: Mon May 19 16:41:11 2025 +0100 clk: clk-axi-clkgen move to min/max() Instead of using the type versions of min/max(), use the plain ones as now they are perfectly capable of handling different types like unsigned and non negative integers that are compiletime constant. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250519-dev-axi-clkgen-limits-v6-6-bc4b3b61d1d4@analog.com Reviewed-by: David Lechner Signed-off-by: Stephen Boyd commit af232e7615e45e88c790dbbf4401ff3ffd6b3ad8 Author: Eric Dumazet Date: Fri Jun 27 11:58:21 2025 +0000 ipv6: guard ip6_mr_output() with rcu syzbot found at least one path leads to an ip_mr_output() without RCU being held. Add guard(rcu)() to fix this in a concise way. WARNING: net/ipv6/ip6mr.c:2376 at ip6_mr_output+0xe0b/0x1040 net/ipv6/ip6mr.c:2376, CPU#1: kworker/1:2/121 Call Trace: ip6tunnel_xmit include/net/ip6_tunnel.h:162 [inline] udp_tunnel6_xmit_skb+0x640/0xad0 net/ipv6/ip6_udp_tunnel.c:112 send6+0x5ac/0x8d0 drivers/net/wireguard/socket.c:152 wg_socket_send_skb_to_peer+0x111/0x1d0 drivers/net/wireguard/socket.c:178 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline] wg_packet_tx_worker+0x1c8/0x7c0 drivers/net/wireguard/send.c:276 process_one_work kernel/workqueue.c:3239 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3322 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3403 kthread+0x70e/0x8a0 kernel/kthread.c:464 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Fixes: 96e8f5a9fe2d ("net: ipv6: Add ip6_mr_output()") Reported-by: syzbot+0141c834e47059395621@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/685e86b3.a00a0220.129264.0003.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Roopa Prabhu Cc: Benjamin Poirier Cc: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Reviewed-by: Petr Machata Link: https://patch.msgid.link/20250627115822.3741390-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 236ab6ad215b32210e697039d72c3539286bdc0f Author: Nuno Sá Date: Mon May 19 16:41:10 2025 +0100 clk: clk-axi-clkgen: detect axi_clkgen_limits at runtime This patch adds support for setting the limits in struct axi_clkgen_limits in accordance with fpga speed grade, voltage, technology and family. This new information is extracted from two new registers implemented in the ip core that are only available for core versions higher or equal to 4. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250519-dev-axi-clkgen-limits-v6-5-bc4b3b61d1d4@analog.com Reviewed-by: David Lechner Signed-off-by: Stephen Boyd commit 6fc942f777b1a94fd2dacd4836aaf7e3b440baf8 Author: Nuno Sá Date: Mon May 19 16:41:09 2025 +0100 include: adi-axi-common: add new helper macros Add new helper macros and enums to help identifying the platform and some characteristics of it at runtime. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250519-dev-axi-clkgen-limits-v6-4-bc4b3b61d1d4@analog.com Reviewed-by: David Lechner Signed-off-by: Stephen Boyd commit 2ad26b7bedcd4941e6dafa1851e2054b369b9d25 Author: Nuno Sá Date: Mon May 19 16:41:08 2025 +0100 include: linux: move adi-axi-common.h out of fpga The adi-axi-common.h header has some common defines used in various ADI IPs. However they are not specific for any fpga manager so it's questionable for the header to live under include/linux/fpga. Hence let's just move one directory up and update all users. Suggested-by: Xu Yilun Acked-by: Xu Yilun Acked-by: Jonathan Cameron # for IIO Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250519-dev-axi-clkgen-limits-v6-3-bc4b3b61d1d4@analog.com Acked-by: Mark Brown Acked-by: Uwe Kleine-König Reviewed-by: David Lechner Signed-off-by: Stephen Boyd commit 9933b833d9eef1754d8e95fb0af775b67c673df5 Author: Nuno Sá Date: Mon May 19 16:41:07 2025 +0100 clk: clk-axi-clkgen: make sure to include mod_devicetable.h The mod_devicetable header is the one to be used for struct of_device_id. Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250519-dev-axi-clkgen-limits-v6-2-bc4b3b61d1d4@analog.com Reviewed-by: David Lechner Signed-off-by: Stephen Boyd commit ce8a9096699500e2c5bca09dde27b16edda5f636 Author: Nuno Sá Date: Mon May 19 16:41:06 2025 +0100 clk: clk-axi-clkgen: fix fpfd_max frequency for zynq The fpfd_max frequency should be set to 450 MHz instead of 300 MHz. Well, it actually depends on the platform speed grade but we are being conservative for ultrascale so let's be consistent. In a following change we will set these limits at runtime. Fixes: 0e646c52cf0e ("clk: Add axi-clkgen driver") Signed-off-by: Nuno Sá Link: https://lore.kernel.org/r/20250519-dev-axi-clkgen-limits-v6-1-bc4b3b61d1d4@analog.com Reviewed-by: David Lechner Signed-off-by: Stephen Boyd commit d7b9056c3a6c58d41074b7ba19ab7fd34ce9f63e Author: Alok Tiwari Date: Sun Jun 22 11:39:16 2025 -0700 cxl/edac: Use correct format specifier for u32 val The dev_dbg() message in cxl_set_ecs_threshold() used %d for an unsigned value, which could lead to incorrect logging. Update the format specifier to %u to match variable type. Signed-off-by: Alok Tiwari Reviewed-by: Shiju Jose Reviewed-by: Alison Schofield Reviewed-by: Ira Weiny Link: https://patch.msgid.link/20250622183919.4156343-1-alok.a.tiwari@oracle.com Signed-off-by: Dave Jiang commit 8ad85794be61e046697df8305de34a49791d2ed1 Author: Alok Tiwari Date: Sun Jun 15 23:07:32 2025 -0700 cxl: docs/devices Fix typos and clarify wording in device-types.rst Fix several typos and improve comment clarity in the CXL device types docs: "w/" replaced with "with" "sill" -> "still" "The allows" -> "This allows" "capacity" corrected to "capable" "more devices" corrected to "more upstream devices" in MLD description These changes improve readability and enhance the documentation quality. [ dj: Fix up "one or more hosts" to "one or more upstream devices" from Gregory ] Signed-off-by: Alok Tiwari Reviewed-by: Gregory Price Link: https://patch.msgid.link/20250616060737.1645393-1-alok.a.tiwari@oracle.com Signed-off-by: Dave Jiang commit 7d14230db8a76c776985d510b9f27f66aedc7b14 Author: Nai-Chen Cheng Date: Wed Jun 11 01:31:52 2025 +0800 Documentation: fix typo in CXL driver documentation Fix typo 'enumates' to 'enumerate' in CXL driver operation documentation to improve readability. Signed-off-by: Nai-Chen Cheng Reviewed-by: Jonathan Cameron Reviewed-by: Li Ming Reviewed-by: Dave Jiang Link: https://patch.msgid.link/20250610173152.33566-1-bleach1827@gmail.com Signed-off-by: Dave Jiang commit 5af29a583a17f9699b2a6de5e8148e8349d99a46 Author: Alok Tiwari Date: Mon Jun 9 10:10:48 2025 -0700 Documentation: cxl: fix typos and improve clarity in memory-devices.rst This patch corrects several typographical issues and improves phrasing in memory-devices.rst: - Fixes duplicate word ("1 one") and adjusts phrasing for clarity. - Adds missing hyphen in "on-device". - Corrects "a give memory device" to "a given memory device". - fix singular/plural "decoder resource" -> "decoder resources". - Clarifies "spans to Host Bridges" -> "spans two Host Bridges". - change "at a" -> "a" These changes improve readability and accuracy of the documentation. Signed-off-by: Alok Tiwari Reviewed-by: Randy Dunlap Reviewed-by: Gregory Price Reviewed-by: Jonathan Cameron Link: https://patch.msgid.link/20250609171130.2375901-1-alok.a.tiwari@oracle.com Signed-off-by: Dave Jiang commit 60da1f685a94bc9bd94caf46d953cfa43468c29e Author: Jonathan Cameron Date: Tue May 27 16:34:51 2025 +0100 cxl_test: Limit location for fake CFMWS to mappable range Some architectures (e.g. arm64) only support memory hotplug operations on a restricted set of physical addresses. This applies even when we are faking some CXL fixed memory windows for the purposes of cxl_test. That range can be queried with mhp_get_pluggable_range(true). Use the minimum of that the top of that range and iomem_resource.end to establish the 64GiB region used by cxl_test. From thread #2 which was related to the issue in #1. [ dj: Add CONFIG_MEMORY_HOTPLUG config check, from Alison ] Link: https://lore.kernel.org/linux-cxl/20250522145622.00002633@huawei.com/ #2 Reported-by: Itaru Kitayama Closes: https://github.com/pmem/ndctl/issues/278 #1 Reviewed-by: Dan Williams Tested-by: Itaru Kitayama Tested-by: Marc Herbert Signed-off-by: Jonathan Cameron Link: https://patch.msgid.link/20250527153451.82858-1-Jonathan.Cameron@huawei.com Signed-off-by: Dave Jiang commit 38b502e0a65215ddefaf84b672ec3908af97bacf Author: Alison Schofield Date: Thu May 29 13:51:13 2025 -0700 cxl/pci: Replace mutex_lock_io() w mutex_lock() for mailbox access mutex_lock_io() differs from mutex_lock() in that it may call io_schedule() when a task must sleep waiting for the lock. This distinction only makes sense in block I/O or memory reclaim paths, where giving I/O a chance to make progress is useful. At this call site, cxl_pci_mbox_send(), the mutex protects an MMIO mailbox. The task holding the lock is not blocking I/O progress, so calling io_schedule(), as mutex_lock_io() may do, has no practical effect. Although there is no functional change, using the correct locking primitive, that more accurately reflects the semantics and intended use of the lock, improves code clarity and avoids misleading readers and tools. [ dj: Dropped fixes tag, no need to backport ] Reported-by: Alok Tiwari Closes: https://lore.kernel.org/linux-cxl/0d2af1e8-7f1b-438c-a090-fd366c8c63e0@oracle.com/ Suggested-by: Dan Williams Signed-off-by: Alison Schofield Reviewed-by: Davidlohr Bueso Reviewed-by: Dan Williams Link: https://patch.msgid.link/20250529205117.1990465-1-alison.schofield@intel.com Signed-off-by: Dave Jiang commit 7ac6612d6b7994491ac410401ed2fbac2bdefc18 Author: Dan Williams Date: Tue Jun 3 11:52:54 2025 -0700 Documentation/driver-api/cxl: Introduce conventions.rst There exists shipping platforms that bend, break, or otherwise lean on ambiguities in the CXL specification. Without driver changes to accommodate these deviations, end users are left without CXL subsystem RAS features. Specifically, provisioning, error translation, and other flows require the CXL subsystem to understand the platforms CXL topology beyond undecorated memory address ranges. Those isolated compatibility problems risk growing into deeper upstream maintenance burden if different platform vendors arrive at diverging solutions. For example, there are multiple options for resolving low-memory-mmio intersecting large-interleave-ways CXL windows. Linux should only entertain one solution to that problem. Now, with the ACPI Specification Working Group, situations like this would be resolved with the "Code First ECN" process to codify Linux expectations in a specification. In the absence of such a process for the CXL specification, create a file in Linux documentation to detail the motivations, assumptions, tradeoffs, and proposals for amending specification language. The goal is to capture the issues such that platform vendors arrive at compatible solutions for these problems and serve as a repository for potential specification updates. The expectation is to update conventions.rst along with CXL subsystem code changes to accommodate the platform topology. [ dj: Rebased against v6.16-rc1 ] Signed-off-by: Dan Williams Reviewed-by: Jonathan Cameron Reviewed-by: Dave Jiang Reviewed-by: Robert Richter Link: https://patch.msgid.link/20250603185254.3730099-1-dan.j.williams@intel.com Signed-off-by: Dave Jiang commit 2b53d4e994b934796b7376150130ab2b3577fa1e Author: Caleb Sander Mateos Date: Fri Jun 20 09:10:00 2025 -0600 ublk: consolidate UBLK_IO_FLAG_{ACTIVE,OWNED_BY_SRV} checks UBLK_IO_FLAG_ACTIVE and UBLK_IO_FLAG_OWNED_BY_SRV are mutually exclusive. So just check that UBLK_IO_FLAG_OWNED_BY_SRV is set in __ublk_ch_uring_cmd(); that implies UBLK_IO_FLAG_ACTIVE is unset. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-7-csander@purestorage.com Signed-off-by: Jens Axboe commit be4f1b619f5a7fa1f5641c780bfec1a156c279cb Author: Caleb Sander Mateos Date: Fri Jun 20 09:09:59 2025 -0600 ublk: remove task variable from __ublk_ch_uring_cmd() The variable is computed from a simple expression and used once, so just replace it with the expression. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-6-csander@purestorage.com Signed-off-by: Jens Axboe commit ee97736384beccc1f72116718af23e5f6de75210 Author: Caleb Sander Mateos Date: Fri Jun 20 09:09:58 2025 -0600 ublk: handle UBLK_IO_FETCH_REQ earlier Check for UBLK_IO_FETCH_REQ early in __ublk_ch_uring_cmd() and skip the rest of the checks in this case. This allows removing the checks for NULL io->task and UBLK_IO_FLAG_OWNED_BY_SRV unset in io->flags, which are only allowed for FETCH. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-5-csander@purestorage.com Signed-off-by: Jens Axboe commit 5af8b36f6e4c8b39f6fffc45b066039349a5163a Author: Caleb Sander Mateos Date: Fri Jun 20 09:09:57 2025 -0600 ublk: check cmd_op first In preparation for skipping some of the other checks for certain IO opcodes, move the cmd_op check earlier. Signed-off-by: Caleb Sander Mateos Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-4-csander@purestorage.com Signed-off-by: Jens Axboe commit 7ba962f4d73b2b768c977db2c7cd9551798bba26 Author: Caleb Sander Mateos Date: Fri Jun 20 09:09:56 2025 -0600 ublk: remove struct ublk_rq_data __ublk_check_and_get_req() attempts to atomically look up the struct request for a ublk I/O and take a reference on it. However, the request can be freed between the lookup on the tagset in blk_mq_tag_to_rq() and the increment of its reference count in ublk_get_req_ref(), for example if an elevator switch happens concurrently. Fix the potential use after free by moving the reference count from ublk_rq_data to ublk_io. Move the fields buf_index and buf_ctx_handle too to reduce the number of cache lines touched when dispatching and completing a ublk I/O, allowing ublk_rq_data to be removed entirely. Suggested-by: Ming Lei Signed-off-by: Caleb Sander Mateos Fixes: 62fe99cef94a ("ublk: add read()/write() support for ublk char device") Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-3-csander@purestorage.com Signed-off-by: Jens Axboe commit c2f48453b7806d41f5a3270f206a5cd5640ed207 Author: Caleb Sander Mateos Date: Fri Jun 20 09:09:55 2025 -0600 ublk: use vmalloc for ublk_device's __queues struct ublk_device's __queues points to an allocation with up to UBLK_MAX_NR_QUEUES (4096) queues, each of which have: - struct ublk_queue (48 bytes) - Tail array of up to UBLK_MAX_QUEUE_DEPTH (4096) struct ublk_io's, 32 bytes each This means the full allocation can exceed 512 MB, which may well be impossible to service with contiguous physical pages. Switch to kvcalloc() and kvfree(), since there is no need for physically contiguous memory. Signed-off-by: Caleb Sander Mateos Fixes: 71f28f3136af ("ublk_drv: add io_uring based userspace block driver") Reviewed-by: Ming Lei Link: https://lore.kernel.org/r/20250620151008.3976463-2-csander@purestorage.com Signed-off-by: Jens Axboe commit ba83e321ccf2674269b16531b785515b7071da35 Author: Christoph Hellwig Date: Wed Jun 25 13:35:05 2025 +0200 nvme-pci: rework the build time assert for NVME_MAX_NR_DESCRIPTORS The current use of an always_inline helper is a bit convoluted. Instead use macros that represent the arithmetics used for building up the PRP chain. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Daniel Gomez Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20250625113531.522027-9-hch@lst.de Signed-off-by: Jens Axboe commit 16353f1b0e084083610ef5c535d2ced419cf21b7 Author: Christoph Hellwig Date: Wed Jun 25 13:35:04 2025 +0200 nvme-pci: replace NVME_MAX_KB_SZ with NVME_MAX_BYTE Having a define in kiB units is a bit weird. Also update the comment now that there is not scatterlist limit. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Daniel Gomez Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20250625113531.522027-8-hch@lst.de Signed-off-by: Jens Axboe commit 7ce3c1dd78fca86ea8b9aee370db10c7a8cfc3c2 Author: Christoph Hellwig Date: Wed Jun 25 13:35:03 2025 +0200 nvme-pci: convert the data mapping to blk_rq_dma_map Use the blk_rq_dma_map API to DMA map requests instead of scatterlists. This removes the need to allocate a scatterlist covering every segment, and thus the overall transfer length limit based on the scatterlist allocation. Instead the DMA mapping is done by iterating the bio_vec chain in the request directly. The unmap is handled differently depending on how we mapped: - when using an IOMMU only a single IOVA is used, and it is stored in iova_state - for direct mappings that don't use swiotlb and are cache coherent, unmap is not needed at all - for direct mappings that are not cache coherent or use swiotlb, the physical addresses are rebuild from the PRPs or SGL segments The latter unfortunately adds a fair amount of code to the driver, but it is code not used in the fast path. The conversion only covers the data mapping path, and still uses a scatterlist for the multi-segment metadata case. I plan to convert that as soon as we have good test coverage for the multi-segment metadata path. Thanks to Chaitanya Kulkarni for an initial attempt at a new DMA API conversion for nvme-pci, Kanchan Joshi for bringing back the single segment optimization, Leon Romanovsky for shepherding this through a gazillion rebases and Nitesh Shetty for various improvements. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20250625113531.522027-7-hch@lst.de Signed-off-by: Jens Axboe commit deecd1c49cd36df206a20afb82399cbc9058c16d Author: Christoph Hellwig Date: Wed Jun 25 13:35:02 2025 +0200 nvme-pci: remove superfluous arguments The call chain in the prep_rq and completion paths passes around a lot of nvme_dev, nvme_queue and nvme_command arguments that can be trivially derived from the passed in struct request. Remove them. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20250625113531.522027-6-hch@lst.de Signed-off-by: Jens Axboe commit cd71b52a559d816f5631cf4fdc49ade13cc6ac02 Author: Christoph Hellwig Date: Wed Jun 25 13:35:01 2025 +0200 nvme-pci: merge the simple PRP and SGL setup into a common helper nvme_setup_prp_simple and nvme_setup_sgl_simple share a lot of logic. Merge them into a single helper that makes use of the previously added use_sgl tristate. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Link: https://lore.kernel.org/r/20250625113531.522027-5-hch@lst.de Signed-off-by: Jens Axboe commit de769c846ae42d7af00c081196aeb2ae1dbee13a Author: Christoph Hellwig Date: Wed Jun 25 13:35:00 2025 +0200 nvme-pci: refactor nvme_pci_use_sgls Move the average segment size into a separate helper, and return a tristate to distinguish the case where can use SGL vs where we have to use SGLs. This will allow the simplify the code and make more efficient decisions in follow on changes. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Link: https://lore.kernel.org/r/20250625113531.522027-4-hch@lst.de Signed-off-by: Jens Axboe commit 858299dc61603670823f8c1d62bf3fc7af44b18b Author: Christoph Hellwig Date: Wed Jun 25 13:34:59 2025 +0200 block: add scatterlist-less DMA mapping helpers Add a new blk_rq_dma_map / blk_rq_dma_unmap pair that does away with the wasteful scatterlist structure. Instead it uses the mapping iterator to either add segments to the IOVA for IOMMU operations, or just maps them one by one for the direct mapping. For the IOMMU case instead of a scatterlist with an entry for each segment, only a single [dma_addr,len] pair needs to be stored for processing a request, and for the direct mapping the per-segment allocation shrinks from [page,offset,len,dma_addr,dma_len] to just [dma_addr,len]. One big difference to the scatterlist API, which could be considered downside, is that the IOVA collapsing only works when the driver sets a virt_boundary that matches the IOMMU granule. For NVMe this is done already so it works perfectly. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20250625113531.522027-3-hch@lst.de Signed-off-by: Jens Axboe commit 38446014648c9f7b2843f87517c8f2b73906bb40 Author: Christoph Hellwig Date: Wed Jun 25 13:34:58 2025 +0200 block: don't merge different kinds of P2P transfers in a single bio To get out of the DMA mapping helpers having to check every segment for it's P2P status, ensure that bios either contain P2P transfers or non-P2P transfers, and that a P2P bio only contains ranges from a single device. This means we do the page zone access in the bio add path where it should be still page hot, and will only have do the fairly expensive P2P topology lookup once per bio down in the DMA mapping path, and only for already marked bios. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Logan Gunthorpe Reviewed-by: Leon Romanovsky Link: https://lore.kernel.org/r/20250625113531.522027-2-hch@lst.de Signed-off-by: Jens Axboe commit 409f9287dab3b53bffe8d28d883a529028aa6a42 Author: Damien Le Moal Date: Wed Jun 25 18:33:27 2025 +0900 dm: Check for forbidden splitting of zone write operations DM targets must not split zone append and write operations using dm_accept_partial_bio() as doing so is forbidden for zone append BIOs, breaks zone append emulation using regular write BIOs and potentially creates deadlock situations with queue freeze operations. Modify dm_accept_partial_bio() to add missing BUG_ON() checks for all these cases, that is, check that the BIO is a write or write zeroes operation. This change packs all the zone related checks together under a static_branch_unlikely(&zoned_enabled) and done only if the target is a zoned device. Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Mikulas Patocka Link: https://lore.kernel.org/r/20250625093327.548866-6-dlemoal@kernel.org Signed-off-by: Jens Axboe commit e549663849e5bb3b985dc2d293069f0d9747ae72 Author: Damien Le Moal Date: Wed Jun 25 18:33:26 2025 +0900 dm: dm-crypt: Do not partially accept write BIOs with zoned targets Read and write operations issued to a dm-crypt target may be split according to the dm-crypt internal limits defined by the max_read_size and max_write_size module parameters (default is 128 KB). The intent is to improve processing time of large BIOs by splitting them into smaller operations that can be parallelized on different CPUs. For zoned dm-crypt targets, this BIO splitting is still done but without the parallel execution to ensure that the issuing order of write operations to the underlying devices remains sequential. However, the splitting itself causes other problems: 1) Since dm-crypt relies on the block layer zone write plugging to handle zone append emulation using regular write operations, the reminder of a split write BIO will always be plugged into the target zone write plugged. Once the on-going write BIO finishes, this reminder BIO is unplugged and issued from the zone write plug work. If this reminder BIO itself needs to be split, the reminder will be re-issued and plugged again, but that causes a call to a blk_queue_enter(), which may block if a queue freeze operation was initiated. This results in a deadlock as DM submission still holds BIOs that the queue freeze side is waiting for. 2) dm-crypt relies on the emulation done by the block layer using regular write operations for processing zone append operations. This still requires to properly return the written sector as the BIO sector of the original BIO. However, this can be done correctly only and only if there is a single clone BIO used for processing the original zone append operation issued by the user. If the size of a zone append operation is larger than dm-crypt max_write_size, then the orginal BIO will be split and processed as a chain of regular write operations. Such chaining result in an incorrect written sector being returned to the zone append issuer using the original BIO sector. This in turn results in file system data corruptions using xfs or btrfs. Fix this by modifying get_max_request_size() to always return the size of the BIO to avoid it being split with dm_accpet_partial_bio() in crypt_map(). get_max_request_size() is renamed to get_max_request_sectors() to clarify the unit of the value returned and its interface is changed to take a struct dm_target pointer and a pointer to the struct bio being processed. In addition to this change, to ensure that crypt_alloc_buffer() works correctly, set the dm-crypt device max_hw_sectors limit to be at most BIO_MAX_VECS << PAGE_SECTORS_SHIFT (1 MB with a 4KB page architecture). This forces DM core to split write BIOs before passing them to crypt_map(), and thus guaranteeing that dm-crypt can always accept an entire write BIO without needing to split it. This change does not have any effect on the read path of dm-crypt. Read operations can still be split and the BIO fragments processed in parallel. There is also no impact on the performance of the write path given that all zone write BIOs were already processed inline instead of in parallel. This change also does not affect in any way regular dm-crypt block devices. Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Mikulas Patocka Link: https://lore.kernel.org/r/20250625093327.548866-5-dlemoal@kernel.org Signed-off-by: Jens Axboe commit 2df7168717b7d2d32bcf017c68be16e4aae9dd13 Author: Damien Le Moal Date: Wed Jun 25 18:33:25 2025 +0900 dm: Always split write BIOs to zoned device limits Any zoned DM target that requires zone append emulation will use the block layer zone write plugging. In such case, DM target drivers must not split BIOs using dm_accept_partial_bio() as doing so can potentially lead to deadlocks with queue freeze operations. Regular write operations used to emulate zone append operations also cannot be split by the target driver as that would result in an invalid writen sector value return using the BIO sector. In order for zoned DM target drivers to avoid such incorrect BIO splitting, we must ensure that large BIOs are split before being passed to the map() function of the target, thus guaranteeing that the limits for the mapped device are not exceeded. dm-crypt and dm-flakey are the only target drivers supporting zoned devices and using dm_accept_partial_bio(). In the case of dm-crypt, this function is used to split BIOs to the internal max_write_size limit (which will be suppressed in a different patch). However, since crypt_alloc_buffer() uses a bioset allowing only up to BIO_MAX_VECS (256) vectors in a BIO. The dm-crypt device max_segments limit, which is not set and so default to BLK_MAX_SEGMENTS (128), must thus be respected and write BIOs split accordingly. In the case of dm-flakey, since zone append emulation is not required, the block layer zone write plugging is not used and no splitting of BIOs required. Modify the function dm_zone_bio_needs_split() to use the block layer helper function bio_needs_zone_write_plugging() to force a call to bio_split_to_limits() in dm_split_and_process_bio(). This allows DM target drivers to avoid using dm_accept_partial_bio() for write operations on zoned DM devices. Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Mikulas Patocka Reviewed-by: Johannes Thumshirn Link: https://lore.kernel.org/r/20250625093327.548866-4-dlemoal@kernel.org Signed-off-by: Jens Axboe commit f70291411ba20d50008db90a6f0731efac27872c Author: Damien Le Moal Date: Wed Jun 25 18:33:24 2025 +0900 block: Introduce bio_needs_zone_write_plugging() In preparation for fixing device mapper zone write handling, introduce the inline helper function bio_needs_zone_write_plugging() to test if a BIO requires handling through zone write plugging using the function blk_zone_plug_bio(). This function returns true for any write (op_is_write(bio) == true) operation directed at a zoned block device using zone write plugging, that is, a block device with a disk that has a zone write plug hash table. This helper allows simplifying the check on entry to blk_zone_plug_bio() and used in to protect calls to it for blk-mq devices and DM devices. Fixes: f211268ed1f9 ("dm: Use the block layer zone append emulation") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250625093327.548866-3-dlemoal@kernel.org Signed-off-by: Jens Axboe commit 3f66ccbaaef3a0c5bd844eab04e3207b4061c546 Author: Damien Le Moal Date: Wed Jun 25 18:33:23 2025 +0900 block: Make REQ_OP_ZONE_FINISH a write operation REQ_OP_ZONE_FINISH is defined as "12", which makes op_is_write(REQ_OP_ZONE_FINISH) return false, despite the fact that a zone finish operation is an operation that modifies a zone (transition it to full) and so should be considered as a write operation (albeit one that does not transfer any data to the device). Fix this by redefining REQ_OP_ZONE_FINISH to be an odd number (13), and redefine REQ_OP_ZONE_RESET and REQ_OP_ZONE_RESET_ALL using sequential odd numbers from that new value. Fixes: 6c1b1da58f8c ("block: add zone open, close and finish operations") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Bart Van Assche Reviewed-by: Johannes Thumshirn Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20250625093327.548866-2-dlemoal@kernel.org Signed-off-by: Jens Axboe commit 9b8b84879d4adc506b0d3944e20b28d9f3f6994b Author: Damien Le Moal Date: Wed Jun 18 15:00:45 2025 +0900 block: Increase BLK_DEF_MAX_SECTORS_CAP Back in 2015, commit d2be537c3ba3 ("block: bump BLK_DEF_MAX_SECTORS to 2560") increased the default maximum size of a block device I/O to 2560 sectors (1280 KiB) to "accommodate a 10-data-disk stripe write with chunk size 128k". This choice is rather arbitrary and since then, improvements to the block layer have software RAID drivers correctly advertize their stripe width through chunk_sectors and abuses of BLK_DEF_MAX_SECTORS_CAP by drivers (to set the HW limit rather than the default user controlled maximum I/O size) have been fixed. Since many block devices can benefit from a larger value of BLK_DEF_MAX_SECTORS_CAP, and in particular HDDs, increase this value to be 4MiB, or 8192 sectors. And given that BLK_DEF_MAX_SECTORS_CAP is only used in the block layer and should not be used by drivers directly, move this macro definition to the block layer internal header file block/blk.h. Suggested-by: Martin K . Petersen Signed-off-by: Damien Le Moal Reviewed-by: Martin K. Petersen Reviewed-by: Christoph Hellwig Reviewed-by: John Garry Reviewed-by: Johannes Thumshirn Reviewed-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250618060045.37593-1-dlemoal@kernel.org Signed-off-by: Jens Axboe commit 98f79c729d8c862a04089382a5274f084e576d55 Author: J. Neuschäfer Date: Wed Jun 11 11:42:09 2025 +0200 dt-bindings: interrupt-controller: Convert fsl,mpic-msi to YAML As part of a larger effort to bring various PowerPC-related bindings into the YAML world, this patch converts msi-pic.txt to YAML and moves it into the bindings/interrupt-controller/ directory. The conversion may necessarily be a bit hard to read because the binding is quite verbose. Signed-off-by: J. Neuschäfer Link: https://lore.kernel.org/r/20250611-msipic-yaml-v2-1-f2e174c48802@posteo.net Signed-off-by: Rob Herring (Arm) commit c31f2899eab084b3557e9f9e10fc7898113ef18d Author: Michal Wilczynski Date: Mon Jun 23 20:08:56 2025 +0200 riscv: dts: thead: Add PVT node Add PVT DT node for thermal sensor. Reviewed-by: Drew Fustini Signed-off-by: Michal Wilczynski Signed-off-by: Drew Fustini commit cf5e81da0ed7f548367a9687ad73956a8dfb54d1 Author: Michal Wilczynski Date: Thu Jun 26 11:33:48 2025 +0200 riscv: dts: thead: th1520: Add GPU clkgen reset to AON node Add the "gpu-clkgen" reset property to the AON device tree node. This allows the AON power domain driver to detect the capability to power sequence the GPU and spawn the necessary pwrseq-thead-gpu auxiliary driver for managing the GPU's complex power sequence. This commit also adds the prerequisite dt-bindings/reset/thead,th1520-reset.h include to make the TH1520_RESET_ID_GPU_CLKGEN available. This include was previously dropped during a conflict resolution [1]. Link: https://lore.kernel.org/all/aAvfn2mq0Ksi8DF2@x1/ [1] Reviewed-by: Ulf Hansson Reviewed-by: Bartosz Golaszewski Reviewed-by: Drew Fustini Signed-off-by: Michal Wilczynski Signed-off-by: Drew Fustini commit 0370395d45ca6dd53bb931978f0e91ac8dd6f1c5 Author: Michal Wilczynski Date: Mon Jun 23 20:08:53 2025 +0200 clk: thead: Mark essential bus clocks as CLK_IGNORE_UNUSED Probing peripherals in the AON and PERI domains, such as the PVT thermal sensor and the PWM controller, can lead to boot hangs or unresponsive devices on the LPi4A board. The root cause is that their parent bus clocks ('CLK_CPU2AON_X2H' and the 'CLK_PERISYS_APB' clocks) are automatically gated by the kernel's power-saving mechanisms when the bus is perceived as idle. Alternative solutions were investigated, including modeling the parent bus in the Device Tree with 'simple-pm-bus' or refactoring the clock driver's parentage. The 'simple-pm-bus' approach is not viable due to the lack of defined bus address ranges in the hardware manual and its creation of improper dependencies on the 'pm_runtime' API for consumer drivers. Therefore, applying the'`CLK_IGNORE_UNUSED' flag directly to the essential bus clocks is the most direct and targeted fix. This prevents the kernel from auto-gating these buses and ensures peripherals remain accessible. This change fixes the boot hang associated with the PVT sensor and resolves the functional issues with the PWM controller. Link: https://lore.kernel.org/all/9e8a12db-236d-474c-b110-b3be96edf057@samsung.com/ [1] Reviewed-by: Drew Fustini Acked-by: Stephen Boyd Signed-off-by: Michal Wilczynski Signed-off-by: Drew Fustini commit 1caf3f78c02262953c420f6d11bf6dd8202eae5f Author: Chen Yu Date: Wed Jun 4 10:29:56 2025 +0800 ACPI: pfr_update: Add more debug information when firmware update failed Users reported insufficient error information for debugging during firmware update failures on certain platforms. Add verbose error logs in the error code path to enhance debuggability. Reported-by: "Govindarajulu, Hariganesh" Signed-off-by: Chen Yu Link: https://patch.msgid.link/20250604022956.3723438-1-yu.c.chen@intel.com Signed-off-by: Rafael J. Wysocki commit 54e626d097b05af9421534d211c9f96211d07d66 Author: Uwe Kleine-König Date: Mon Jun 30 12:24:31 2025 -0700 Input: max8997_haptic - optimize PWM configuration Both pwm_config() and pwm_enable() are wrappers around pwm_apply_might_sleep(). Instead of calling this function twice only call it once without an intermediate step. Setup the PWM in max8997_haptic_enable() only where it was enabled historically. max8997_haptic_set_duty_cycle() is renamed accordingly to make it clear this function is only about the internal setup now. pwm_config() was called earlier back then, but that call has no effect on the hardware when the PWM is disabled, so delaying this configuration doesn't make a difference. As pwm_apply_might_sleep() is used now defining the whole state of the PWM, the call to pwm_apply_args() in .probe() can be dropped now, too. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250630093718.2062359-2-u.kleine-koenig@baylibre.com Signed-off-by: Dmitry Torokhov commit 8135422ae047fe0d5b7e8017f3fd43cf4dfa80c4 Author: Vishal Moola (Oracle) Date: Tue Jun 10 17:12:55 2025 -0700 m68k: mm: Convert pointer table macros to use ptdescs Motorola uses its pointer tables for page tables, so its macros should be using struct ptdesc, not struct page. This removes a user of page->lru. Signed-off-by: "Vishal Moola (Oracle)" Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611001255.527952-5-vishal.moola@gmail.com Signed-off-by: Geert Uytterhoeven commit 66aebe56de3380365c005a79cc210e225e65f76a Author: Vishal Moola (Oracle) Date: Tue Jun 10 17:12:54 2025 -0700 m68k: mm: Convert init_pointer_table() to use ptdescs Motorola uses init_pointer_table() for page tables, so it should be using struct ptdesc, not struct page. This helps us prepare to allocate ptdescs as their own memory descriptor, and prepares to remove a user of page->lru. Signed-off-by: "Vishal Moola (Oracle)" Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611001255.527952-4-vishal.moola@gmail.com Signed-off-by: Geert Uytterhoeven commit 5bea64689d9f96eff16438273b8576367aa7ba05 Author: Vishal Moola (Oracle) Date: Tue Jun 10 17:12:53 2025 -0700 m68k: mm: Convert free_pointer_table() to use ptdescs Motorola uses free_pointer_table() for page tables, so it should be using struct ptdesc, not struct page. This helps us prepare to allocate ptdescs as their own memory descriptor, and prepares to remove a user of page->lru. Signed-off-by: "Vishal Moola (Oracle)" Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611001255.527952-3-vishal.moola@gmail.com Signed-off-by: Geert Uytterhoeven commit 72fe6dafaa6163696ab8225f32d0297dcf661bdf Author: Vishal Moola (Oracle) Date: Tue Jun 10 17:12:52 2025 -0700 m68k: mm: Convert get_pointer_table() to use ptdescs Motorola uses get_pointer_table() for page tables, so it should be using struct ptdesc, not struct page. This helps us prepare to allocate ptdescs as their own memory descriptor, and prepares to remove a user of page->lru. Signed-off-by: "Vishal Moola (Oracle)" Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611001255.527952-2-vishal.moola@gmail.com Signed-off-by: Geert Uytterhoeven commit 82a7021f5074ff69478b5104739b91ff2ae3bb4a Author: Qiao Wei Date: Thu Jun 12 15:06:13 2025 +0800 powercap: intel_rapl: Add support for Bartlett Lake platform Add Bartlett Lake to the list of supported processors in the RAPL common driver. Acked-by: Zhang Rui Signed-off-by: Qiao Wei [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit afc6a5b12b62c7743fb96fe27864604d7b33a5d2 Author: Zhang Rui Date: Wed Jun 25 10:05:22 2025 +0800 powercap: intel_rapl_msr: Add PL4 support for Panther Lake Add Panther Lake to the list of processors where PL4 is supported. Signed-off-by: Zhang Rui Link: https://patch.msgid.link/20250625020522.253548-1-rui.zhang@intel.com Signed-off-by: Rafael J. Wysocki commit dccf655f69002d496a527ba441b4f008aa5bebbf Author: Junxiao Chang Date: Fri Apr 25 23:11:07 2025 +0800 drm/i915/gsc: mei interrupt top half should be in irq disabled context MEI GSC interrupt comes from i915. It has top half and bottom half. Top half is called from i915 interrupt handler. It should be in irq disabled context. With RT kernel, by default i915 IRQ handler is in threaded IRQ. MEI GSC top half might be in threaded IRQ context. generic_handle_irq_safe API could be called from either IRQ or process context, it disables local IRQ then calls MEI GSC interrupt top half. This change fixes A380/A770 GPU boot hang issue with RT kernel. Fixes: 1e3dc1d8622b ("drm/i915/gsc: add gsc as a mei auxiliary device") Tested-by: Furong Zhou Suggested-by: Sebastian Andrzej Siewior Acked-by: Sebastian Andrzej Siewior Signed-off-by: Junxiao Chang Link: https://lore.kernel.org/r/20250425151108.643649-1-junxiao.chang@intel.com Reviewed-by: Rodrigo Vivi Signed-off-by: Rodrigo Vivi commit 6d04ead94d49df8d549122d89999f1faf27b5373 Author: Kory Maincent Date: Fri Jun 20 10:15:54 2025 +0200 arm: dts: omap: Add support for BeagleBone Green Eco board SeeedStudio BeagleBone Green Eco (BBGE) is a clone of the BeagleBone Green (BBG). It has minor differences from the BBG, such as a different PMIC, a different Ethernet PHY, and a larger eMMC. Signed-off-by: Kory Maincent Reviewed-by: Andreas Kemnade Tested-by: Judith Mendez Link: https://lore.kernel.org/r/20250620-bbg-v5-3-84f9b9a2e3a8@bootlin.com Signed-off-by: Kevin Hilman commit 23c7d1976f52fd8b8031ac0e5f4f60166cdc32b5 Author: Kory Maincent Date: Fri Jun 20 10:15:53 2025 +0200 dt-bindings: omap: Add Seeed BeagleBone Green Eco Document the seeed,am335x-bone-green-eco compatible string in the appropriate place within the omap family binding file. Acked-by: Conor Dooley Signed-off-by: Kory Maincent Reviewed-by: Andreas Kemnade Tested-by: Judith Mendez Link: https://lore.kernel.org/r/20250620-bbg-v5-2-84f9b9a2e3a8@bootlin.com Signed-off-by: Kevin Hilman commit 297bd457c893966f37fc07b68162862bff3e7c77 Author: Kory Maincent Date: Fri Jun 20 10:15:52 2025 +0200 arm: dts: omap: am335x-bone-common: Rename tps to generic pmic node Rename tps@24 to the generic pmic@24 node name. Signed-off-by: Kory Maincent Reviewed-by: Andreas Kemnade Tested-by: Judith Mendez Link: https://lore.kernel.org/r/20250620-bbg-v5-1-84f9b9a2e3a8@bootlin.com Signed-off-by: Kevin Hilman commit 5173ac2dc8c09361bdb7787c70a25b5b4d61b454 Merge: b6a5a16b8b5947 a70e9f647f501e Author: Thomas Gleixner Date: Mon Jun 30 19:54:19 2025 +0200 Merge tag 'entry-split-for-arm' into core/entry Prerequisite for ARM[64] generic entry conversion Merge it into the entry branch so further changes can be based on it. commit a70e9f647f501e36a6a092888b1ea7386b7c5664 Author: Jinjie Ruan Date: Tue Jun 24 20:35:56 2025 +0200 entry: Split generic entry into generic exception and syscall entry Currently CONFIG_GENERIC_ENTRY enables both the generic exception entry logic and the generic syscall entry logic, which are otherwise loosely coupled. Introduce separate config options for these so that architectures can select the two independently. This will make it easier for architectures to migrate to generic entry code. Suggested-by: Mark Rutland Signed-off-by: Jinjie Ruan Signed-off-by: Linus Walleij Signed-off-by: Thomas Gleixner Acked-by: Linus Walleij Link: https://lore.kernel.org/20250213130007.1418890-2-ruanjinjie@huawei.com Link: https://lore.kernel.org/all/20250624-generic-entry-split-v1-1-53d5ef4f94df@linaro.org [Linus Walleij: rebase onto v6.16-rc1] commit 94b2030968be70b33fed9a5514a5967c7f20aebc Author: Jens Axboe Date: Mon Jun 30 11:36:54 2025 -0600 io_uring: remove errant ';' from IORING_CQE_F_TSTAMP_HW definition An errant ';' slipped into that definition, which will cause some compilers to complain when it's used in an application: timestamp.c:257:45: error: empty expression statement has no effect; remove unnecessary ';' to silence this warning [-Werror,-Wextra-semi-stmt] 257 | hwts = cqe->flags & IORING_CQE_F_TSTAMP_HW; | ^ Fixes: 9e4ed359b8ef ("io_uring/netcmd: add tx timestamping cmd support") Signed-off-by: Jens Axboe commit 505bffe2123323af1e9122583aafeb3a0700bf9c Author: Abdun Nihaal Date: Sun Jun 29 20:10:10 2025 +0530 staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() After commit 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct"), fb_deferred_io_init() allocates memory for info->pagerefs as well as return an error code on failure. However the error code is ignored here and the memory allocated could leak because of not calling fb_deferred_io_cleanup() on the error path. Fix them by adding the cleanup function on the error path, and handling the error code returned by fb_deferred_io_init(). Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") Signed-off-by: Abdun Nihaal Reviewed-by: Dan Carpenter Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/fd2be49cfef72799f17a96d01a4c6b92770cda7d.1751207100.git.abdun.nihaal@gmail.com Signed-off-by: Greg Kroah-Hartman commit 49bba7ef33dca745978bb59c3a06e2da46c362b6 Author: Michael Straube Date: Mon Jun 30 10:30:49 2025 +0200 staging: rtl8723bs: remove redundant static function Both wifi_regd.c and ioctl_cfg80211.c define a static function rtw_ieee80211_channel_to_frequency() with identical functionality. Remove the function from wifi_regd.c and make it non-static in ioctl_cfg80211.c to avoid code duplication. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250630083049.103734-4-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1267d12f5e9a16d33e9bf68c6bf8d7e5b43f45d8 Author: Michael Straube Date: Mon Jun 30 10:30:48 2025 +0200 staging: rtl8723bs: remove unnesessary function parameter The function rtw_ieee80211_channel_to_frequency() in ioctl_cfg80211.c is always called with band = NL80211_BAND_2GHZ. Remove the unnecessary band parameter from the function and adjust its code and calls. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250630083049.103734-3-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 49f9718b1d708e4e86eebbb228d5fddd82e63abe Author: Michael Straube Date: Mon Jun 30 10:30:47 2025 +0200 staging: rtl8723bs: remove unused function parameter The parameter 'band' of rtw_ieee80211_channel_to_frequency() in wifi_regd.c is unused, remove it. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250630083049.103734-2-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit eb2cb7dab60f9be0b435ac4a674255429a36d72c Author: Abdun Nihaal Date: Thu Jun 26 22:54:10 2025 +0530 staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() In the error paths after fb_info structure is successfully allocated, the memory allocated in fb_deferred_io_init() for info->pagerefs is not freed. Fix that by adding the cleanup function on the error path. Fixes: c296d5f9957c ("staging: fbtft: core support") Signed-off-by: Abdun Nihaal Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20250626172412.18355-1-abdun.nihaal@gmail.com Signed-off-by: Greg Kroah-Hartman commit 60212a07cdcdda03490b2a42681f059b8bbb00dd Author: Michael Straube Date: Sat Jun 28 16:23:30 2025 +0200 staging: rtl8723bs: remove empty functions The functions rtw_hal_dm_deinit(), odm_CmnInfoInit_Debug(), and odm_BasicDbgMessage() are empty, hence we can remove them to get rid of some dead code. Signed-off-by: Michael Straube Link: https://lore.kernel.org/r/20250628142330.58045-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 415ca57a1ab1b2dd3180f730b6de5181875ccf00 Author: Bryant Boatright Date: Tue Jun 24 18:51:59 2025 +0000 staging: rtl8723bs: place constant to right of logical test Adhere to Linux kernel coding style. Reported by checkpatch: WARNING: Comparisons should place the constant on the right side of the test Signed-off-by: Bryant Boatright Link: https://lore.kernel.org/r/aFrzy5UdqURaTrlP@ubuntu-desk Signed-off-by: Greg Kroah-Hartman commit a739d3b13bff0dfa1aec679d08c7062131a2a425 Author: Colin Ian King Date: Mon Jun 23 23:09:58 2025 +0100 staging: gpib: fix unset padding field copy back to userspace The introduction of a padding field in the gpib_board_info_ioctl is showing up as initialized data on the stack frame being copyied back to userspace in function board_info_ioctl. The simplest fix is to initialize the entire struct to zero to ensure all unassigned padding fields are zero'd before being copied back to userspace. Signed-off-by: Colin Ian King Fixes: 9dde4559e939 ("staging: gpib: Add GPIB common core driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20250623220958.280424-1-colin.i.king@gmail.com Signed-off-by: Greg Kroah-Hartman commit a87d8d7bcc664fc8302e2ba1cc213addaa87d689 Author: Kisub Choe Date: Sat Jun 21 01:54:32 2025 +0900 staging: sm750fb: remove function pointer proc_setBLANK Call a function based on sm750_dev->revid instead of using this indirection Signed-off-by: Kisub Choe Link: https://lore.kernel.org/r/aFWSSAcboBVi4ROh@zinc Signed-off-by: Greg Kroah-Hartman commit 83bbd6be7d1712471001c421298fb525b7abf69e Author: Mikołaj Lenczewski Date: Wed Jun 25 11:34:35 2025 +0000 arm64/mm: Elide tlbi in contpte_convert() under BBML2 When converting a region via contpte_convert() to use mTHP, we have two different goals. We have to mark each entry as contiguous, and we would like to smear the dirty and young (access) bits across all entries in the contiguous block. Currently, we do this by first accumulating the dirty and young bits in the block, using an atomic __ptep_get_and_clear() and the relevant pte_{dirty,young}() calls, performing a tlbi, and finally smearing the correct bits across the block using __set_ptes(). This approach works fine for BBM level 0, but with support for BBM level 2 we are allowed to reorder the tlbi to after setting the pagetable entries. We expect the time cost of a tlbi to be much greater than the cost of clearing and resetting the PTEs. As such, this reordering of the tlbi outside the window where our PTEs are invalid greatly reduces the duration the PTE are visibly invalid for other threads. This reduces the likelyhood of a concurrent page walk finding an invalid PTE, reducing the likelyhood of a fault in other threads, and improving performance (more so when there are more threads). Because we support via allowlist only bbml2 implementations that never raise conflict aborts and instead invalidate the tlb entries automatically in hardware, we can avoid the final flush altogether. However, avoiding the intermediate tlbi+dsb must be carefully considered to ensure that we remain both correct and performant. We document our reasoning and the expected interactions further in the contpte_convert() source. To do so we rely on the aarch64 spec (DDI 0487L.a D8.7.1.1) requirements RNGLXZ and RJQQTC to provide guarantees that the elision is correct. Signed-off-by: Mikołaj Lenczewski Reviewed-by: Catalin Marinas Reviewed-by: Ryan Roberts Reviewed-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250625113435.26849-5-miko.lenczewski@arm.com Signed-off-by: Catalin Marinas commit 212c439bdd8f99bcbec75adfca3297ae9319c2fb Author: Mikołaj Lenczewski Date: Wed Jun 25 11:34:34 2025 +0000 iommu/arm: Add BBM Level 2 smmu feature For supporting BBM Level 2 for userspace mappings, we want to ensure that the smmu also supports its own version of BBM Level 2. Luckily, the smmu spec (IHI 0070G 3.21.1.3) is stricter than the aarch64 spec (DDI 0487K.a D8.16.2), so already guarantees that no aborts are raised when BBM level 2 is claimed. Add the feature and testing for it under arm_smmu_sva_supported(). Signed-off-by: Mikołaj Lenczewski Reviewed-by: Catalin Marinas Reviewed-by: Robin Murphy Reviewed-by: Ryan Roberts Link: https://lore.kernel.org/r/20250625113435.26849-4-miko.lenczewski@arm.com Signed-off-by: Catalin Marinas commit 5aa4b625762e5a1caf2e43aa52e55b7b507783e2 Author: Mikołaj Lenczewski Date: Wed Jun 25 11:34:33 2025 +0000 arm64: Add BBM Level 2 cpu feature The Break-Before-Make cpu feature supports multiple levels (levels 0-2), and this commit adds a dedicated BBML2 cpufeature to test against support for. To support BBML2 in as wide a range of contexts as we can, we want not only the architectural guarantees that BBML2 makes, but additionally want BBML2 to not create TLB conflict aborts. Not causing aborts avoids us having to prove that no recursive faults can be induced in any path that uses BBML2, allowing its use for arbitrary kernel mappings. This feature builds on the previous ARM64_CPUCAP_EARLY_LOCAL_CPU_FEATURE, as all early cpus must support BBML2 for us to enable it (and any later cpus must also support it to be onlined). Not onlining late cpus that do not support BBML2 is unavoidable, as we might currently be using BBML2 semantics for kernel memory regions. This could cause faults in the late cpus, and would be difficult to unwind, so let us avoid the case altogether. Signed-off-by: Mikołaj Lenczewski Reviewed-by: Catalin Marinas Reviewed-by: Suzuki K Poulose Reviewed-by: Ryan Roberts Link: https://lore.kernel.org/r/20250625113435.26849-3-miko.lenczewski@arm.com Signed-off-by: Catalin Marinas commit d738f708564764ed591cb6ab50d55489f87c726a Author: wangzijie Date: Tue Jun 24 11:59:38 2025 +0800 f2fs: don't allow unaligned truncation to smaller/equal size on pinned file To prevent scattered pin block generation, don't allow non-section aligned truncation to smaller or equal size on pinned file. But for truncation to larger size, after commit 3fdd89b452c2("f2fs: prevent writing without fallocate() for pinned files"), we only support overwrite IO to pinned file, so we don't need to consider attr->ia_size > i_size case. Signed-off-by: wangzijie Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit a919ae794ad2dc6d04b3eea2f9bc86332c1630cc Author: Chao Yu Date: Fri Jun 27 10:38:18 2025 +0800 f2fs: fix to check upper boundary for gc_no_zoned_gc_percent This patch adds missing upper boundary check while setting gc_no_zoned_gc_percent via sysfs. Fixes: 9a481a1c16f4 ("f2fs: create gc_no_zoned_gc_percent and gc_boost_zoned_gc_percent") Cc: Daeho Jeong Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 7a96d1d73ce9de5041e891a623b722f900651561 Author: Chao Yu Date: Fri Jun 27 10:38:17 2025 +0800 f2fs: fix to check upper boundary for gc_valid_thresh_ratio This patch adds missing upper boundary check while setting gc_valid_thresh_ratio via sysfs. Fixes: e791d00bd06c ("f2fs: add valid block ratio not to do excessive GC for one time GC") Cc: Daeho Jeong Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 55fc364b430e3b234ecb9b6e1aa48b242a8663cc Author: Chao Yu Date: Fri Jun 27 10:59:43 2025 +0800 f2fs: account and print more stats during recovery F2FS-fs (vdc): f2fs_recover_fsync_data: recovery fsync data, check_only: 0 F2FS-fs (vdc): do_recover_data: start to recover dnode F2FS-fs (vdc): recover_inode: ino = 5, name = testfile.t2, inline = 21 F2FS-fs (vdc): recover_data: ino = 5, nid = 5 (i_size: recover), range (0, 864), recovered = 1, err = 0 F2FS-fs (vdc): do_recover_data: dnode: (recoverable: 256, fsynced: 256, total: 256), recovered: (inode: 256, dentry: 1, dnode: 256), err: 0 Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 956b81b3d41adacbf4b51289ad49a71f9813c7b8 Author: yohan.joung Date: Wed Jun 25 09:13:35 2025 +0900 f2fs: enable tuning of boost_zoned_gc_percent via sysfs to allow users to dynamically tune the boost_zoned_gc_percent parameter Signed-off-by: yohan.joung Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 10dcaa56ef93f2a45e4c3fec27d8e1594edad110 Author: yohan.joung Date: Wed Jun 25 09:14:07 2025 +0900 f2fs: fix to check upper boundary for value of gc_boost_zoned_gc_percent to check the upper boundary when setting gc_boost_zoned_gc_percent Fixes: 9a481a1c16f4 ("f2fs: create gc_no_zoned_gc_percent and gc_boost_zoned_gc_percent") Signed-off-by: yohan.joung Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 154467f4ad033473e5c903a03e7b9bca7df9a0fa Author: Abinash Singh Date: Wed Jun 25 16:35:37 2025 +0530 f2fs: fix KMSAN uninit-value in extent_info usage KMSAN reported a use of uninitialized value in `__is_extent_mergeable()` and `__is_back_mergeable()` via the read extent tree path. The root cause is that `get_read_extent_info()` only initializes three fields (`fofs`, `blk`, `len`) of `struct extent_info`, leaving the remaining fields uninitialized. This leads to undefined behavior when those fields are accessed later, especially during extent merging. Fix it by zero-initializing the `extent_info` struct before population. Reported-by: syzbot+b8c1d60e95df65e827d4@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b8c1d60e95df65e827d4 Fixes: 94afd6d6e525 ("f2fs: extent cache: support unaligned extent") Reviewed-by: Chao Yu Signed-off-by: Abinash Singh Signed-off-by: Jaegeuk Kim commit 114339ee4d66a328d186264ffa23a766542a9a15 Author: Collin Funk Date: Fri Jun 27 20:41:25 2025 -0700 perf build: Specify shellcheck should use bash When someone has a global shellcheckrc file, for example at ~/.config/shellcheckrc, with the directive 'shell=sh', building perf will fail with many shellcheck errors like: In tests/shell/base_probe/test_adding_kernel.sh line 294: (( TEST_RESULT += $? )) ^---------------------^ SC3006 (warning): In POSIX sh, standalone ((..)) is undefined. For more information: https://www.shellcheck.net/wiki/SC3006 -- In POSIX sh, standalone ((..)) is... make[5]: *** [tests/Build:91: tests/shell/base_probe/test_adding_kernel.sh.shellcheck_log] Error 1 Passing the '-s bash' option ensures that it runs correctly regardless of a developers global configuration. This patch adds '-s bash' and other options to the SHELLCHECK variable in Makefile.perf and makes use of the variable consistently. Signed-off-by: Collin Funk Link: https://lore.kernel.org/r/63491dbc8439edf2e949d80e264b9d22332fea61.1751082075.git.collin.funk1@gmail.com Signed-off-by: Namhyung Kim commit 3eb06f6ce3af65df4e9b3d8fc1d711fbfe7673b3 Author: Catalin Marinas Date: Wed Jun 25 11:34:32 2025 +0000 arm64: cpufeature: Introduce MATCH_ALL_EARLY_CPUS capability type For system-wide capabilities, the kernel has the SCOPE_SYSTEM type. Such capabilities are checked once the SMP boot has completed using the sanitised ID registers. However, there is a need for a new capability type similar in scope to the system one but with checking performed locally on each CPU during boot (e.g. based on MIDR_EL1 which is not a sanitised register). Introduce ARM64_CPUCAP_MATCH_ALL_EARLY_CPUS which, together with ARM64_CPUCAP_SCOPE_LOCAL_CPU, ensures that such capability is enabled only if all early CPUs have it. For ease of use, define ARM64_CPUCAP_EARLY_LOCAL_CPU_FEATURE which combines SCOPE_LOCAL_CPU, PERMITTED_FOR_LATE_CPUS and MATCH_ALL_EARLY_CPUS. Signed-off-by: Mikołaj Lenczewski Reviewed-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250625113435.26849-2-miko.lenczewski@arm.com Signed-off-by: Catalin Marinas commit 9b0236f4efb889869f7d4f3f084f508cc0433ec9 Author: Eric Biggers Date: Thu Jun 19 11:34:14 2025 -0700 lib/crc: crc64: Add include/linux/crc64.h to kernel-api.rst The other CRC functions with kerneldoc are here, so add crc64.h too. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250619183414.100082-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 0b5a58c078167f73d10711734cdc8ea592561ca9 Author: Eric Biggers Date: Thu Jun 19 11:34:13 2025 -0700 lib/crc: crc32: Change crc32() from macro to inline function and remove cast There's no need for crc32() to be a macro. Make it an inline function instead. Also, remove the cast of the data pointer to 'unsigned char const *', which is no longer necessary now that the type used in the function prototype is 'const void *'. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250619183414.100082-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a98e0d69d544ec6b1510940c901867b4ecd8ba1d Author: Eric Biggers Date: Fri Jun 20 13:50:27 2025 -0700 nvmem: layouts: Switch from crc32() to crc32_le() u_boot_env_parse() calls crc32() from within a scope that has a uint32_t variable named crc32. This works only because crc32() is actually a macro that expands to crc32_le(). I'm planning to make it an inline function instead, which will make the usual C scoping rules apply to it. Therefore, update u_boot_env_parse() to be compatible with that. To do so, just call crc32_le() directly instead of using the crc32() alias. (An alternative would be to rename the local variable.) Acked-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250620205027.23403-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 8c7c675155ce3f0f6b12c57a47298a390661652d Author: Eric Biggers Date: Thu Jun 19 11:34:12 2025 -0700 lib/crc: crc32: Document crc32_le(), crc32_be(), and crc32c() Document these widely used functions. Update kernel-api.rst to point to the correct place, instead of to crc32-main.c which no longer contains kerneldoc comments. Simplify the documentation in crc32poly.h to just point to the corresponding functions, now that they are properly documented. Change the value of CRC32C_POLY_LE to lower case, for consistency. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250619183414.100082-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 1a822ea52ad0d844805db32333a51d41ffcdf869 Author: Eric Biggers Date: Thu Jun 12 11:38:52 2025 -0700 lib/crc: Explicitly include Fix build warnings with W=1 that started appearing after commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1"). While at it, sort the include lists alphabetically. Link: https://lore.kernel.org/r/20250612183852.114878-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 61d01fb7afc212358b0213c489192fd04b2566e1 Author: Eric Biggers Date: Sat Jun 7 13:04:54 2025 -0700 lib/crc: Remove ARCH_HAS_* kconfig symbols These symbols are no longer used, so remove them. Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-13-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b10749d89f5405d7c0319b86ad92a47ccc5ce00c Author: Eric Biggers Date: Sat Jun 7 13:04:53 2025 -0700 lib/crc: x86: Migrate optimized CRC code into lib/crc/ Move the x86-optimized CRC code from arch/x86/lib/crc* into its new location in lib/crc/x86/, and wire it up in the new way. This new way of organizing the CRC code eliminates the need to artificially split the code for each CRC variant into separate arch and generic modules, enabling better inlining and dead code elimination. For more details, see "lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/". Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-12-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9b2d720e8ac4b68043ef23820ff9210fa12ea50d Author: Eric Biggers Date: Sat Jun 7 13:04:52 2025 -0700 lib/crc: sparc: Migrate optimized CRC code into lib/crc/ Move the sparc-optimized CRC code from arch/sparc/lib/crc* into its new location in lib/crc/sparc/, and wire it up in the new way. This new way of organizing the CRC code eliminates the need to artificially split the code for each CRC variant into separate arch and generic modules, enabling better inlining and dead code elimination. For more details, see "lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/". Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-11-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2374bf23864932eb32ff209aaf6b82b569d61b2a Author: Eric Biggers Date: Sat Jun 7 13:04:51 2025 -0700 lib/crc: s390: Migrate optimized CRC code into lib/crc/ Move the s390-optimized CRC code from arch/s390/lib/crc* into its new location in lib/crc/s390/, and wire it up in the new way. This new way of organizing the CRC code eliminates the need to artificially split the code for each CRC variant into separate arch and generic modules, enabling better inlining and dead code elimination. For more details, see "lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/". Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b5943815e63b859b5b66710e79c9561112c4d01b Author: Eric Biggers Date: Sat Jun 7 13:04:50 2025 -0700 lib/crc: riscv: Migrate optimized CRC code into lib/crc/ Move the riscv-optimized CRC code from arch/riscv/lib/crc* into its new location in lib/crc/riscv/, and wire it up in the new way. This new way of organizing the CRC code eliminates the need to artificially split the code for each CRC variant into separate arch and generic modules, enabling better inlining and dead code elimination. For more details, see "lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/". Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 190c253d8696b7ba14424c484435ac2d4bcb9ebd Author: Eric Biggers Date: Sat Jun 7 13:04:49 2025 -0700 lib/crc: powerpc: Migrate optimized CRC code into lib/crc/ Move the powerpc-optimized CRC code from arch/powerpc/lib/crc* into its new location in lib/crc/powerpc/, and wire it up in the new way. This new way of organizing the CRC code eliminates the need to artificially split the code for each CRC variant into separate arch and generic modules, enabling better inlining and dead code elimination. For more details, see "lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/". Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit da4fd657730c9510b848ef7a9cc7247bbb6a44c9 Author: Eric Biggers Date: Sat Jun 7 13:04:48 2025 -0700 lib/crc: mips: Migrate optimized CRC code into lib/crc/ Move the mips-optimized CRC code from arch/mips/lib/crc* into its new location in lib/crc/mips/, and wire it up in the new way. This new way of organizing the CRC code eliminates the need to artificially split the code for each CRC variant into separate arch and generic modules, enabling better inlining and dead code elimination. For more details, see "lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/". Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b10d2d20d9786c14133c76cc6aee13e46664dabc Author: Eric Biggers Date: Sat Jun 7 13:04:47 2025 -0700 lib/crc: loongarch: Migrate optimized CRC code into lib/crc/ Move the loongarch-optimized CRC code from arch/loongarch/lib/crc* into its new location in lib/crc/loongarch/, and wire it up in the new way. This new way of organizing the CRC code eliminates the need to artificially split the code for each CRC variant into separate arch and generic modules, enabling better inlining and dead code elimination. For more details, see "lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/". Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2b7531b2a2037959ac81ff2c95e4557b30cfd253 Author: Eric Biggers Date: Sat Jun 7 13:04:46 2025 -0700 lib/crc: arm64: Migrate optimized CRC code into lib/crc/ Move the arm64-optimized CRC code from arch/arm64/lib/crc* into its new location in lib/crc/arm64/, and wire it up in the new way. This new way of organizing the CRC code eliminates the need to artificially split the code for each CRC variant into separate arch and generic modules, enabling better inlining and dead code elimination. For more details, see "lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/". Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 530b304f00f278b3aa31bdfccf09b3ffb457a607 Author: Eric Biggers Date: Sat Jun 7 13:04:45 2025 -0700 lib/crc: arm: Migrate optimized CRC code into lib/crc/ Move the arm-optimized CRC code from arch/arm/lib/crc* into its new location in lib/crc/arm/, and wire it up in the new way. This new way of organizing the CRC code eliminates the need to artificially split the code for each CRC variant into separate arch and generic modules, enabling better inlining and dead code elimination. For more details, see "lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/". Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 0bcfca56406dc6342e30fafe41a2f34cdde029b4 Author: Eric Biggers Date: Sat Jun 7 13:04:44 2025 -0700 lib/crc: Prepare for arch-optimized code in subdirs of lib/crc/ Rework how lib/crc/ supports arch-optimized code. First, instead of the arch-optimized CRC code being in arch/$(SRCARCH)/lib/, it will now be in lib/crc/$(SRCARCH)/. Second, the API functions (e.g. crc32c()), arch-optimized functions (e.g. crc32c_arch()), and generic functions (e.g. crc32c_base()) will now be part of a single module for each CRC type, allowing better inlining and dead code elimination. The second change is made possible by the first. As an example, consider CONFIG_CRC32=m on x86. We'll now have just crc32.ko instead of both crc32-x86.ko and crc32.ko. The two modules were already coupled together and always both got loaded together via direct symbol dependency, so the separation provided no benefit. Note: later I'd like to apply the same design to lib/crypto/ too, where often the API functions are out-of-line so this will work even better. In those cases, for each algorithm we currently have 3 modules all coupled together, e.g. libsha256.ko, libsha256-generic.ko, and sha256-x86.ko. We should have just one, inline things properly, and rely on the compiler's dead code elimination to decide the inclusion of the generic code instead of manually setting it via kconfig. Having arch-specific code outside arch/ was somewhat controversial when Zinc proposed it back in 2018. But I don't think the concerns are warranted. It's better from a technical perspective, as it enables the improvements mentioned above. This model is already successfully used in other places in the kernel such as lib/raid6/. The community of each architecture still remains free to work on the code, even if it's not in arch/. At the time there was also a desire to put the library code in the same files as the old-school crypto API, but that was a mistake; now that the library is separate, that's no longer a constraint either. Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-3-ebiggers@kernel.org Link: https://lore.kernel.org/r/20250612054514.142728-1-ebiggers@kernel.org Link: https://lore.kernel.org/r/20250621012221.4351-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 89a51591405e09a862b9ca1ccfa880986c495c3c Author: Eric Biggers Date: Sat Jun 7 13:04:43 2025 -0700 lib/crc: Move files into lib/crc/ Move all CRC files in lib/ into a subdirectory lib/crc/ to keep them from cluttering up the main lib/ directory. Reviewed-by: "Martin K. Petersen" Acked-by: Ingo Molnar Acked-by: "Jason A. Donenfeld" Link: https://lore.kernel.org/r/20250607200454.73587-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit f2703a104e89077e622e2f34ac686262c5180d71 Author: Eric Biggers Date: Fri Jun 6 20:22:28 2025 -0700 lib/crc32: Remove unused combination support Remove crc32_le_combine() and crc32_le_shift(), since they are no longer used. Although combination is an interesting thing that can be done with CRCs, it turned out that none of the users of it in the kernel were even close to being worthwhile. All were much better off simply chaining the CRCs or processing zeroes. Let's remove the CRC32 combination code for now. It can come back (potentially optimized with carryless multiplication instructions) if there is ever a case where it would actually be worthwhile. Link: https://lore.kernel.org/r/20250607032228.27868-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b0e04dde8e78fd0f08210c594ab29cbbcd841b73 Author: Eric Biggers Date: Fri Jun 13 11:37:53 2025 -0700 crypto/crc32[c]: register only "-lib" drivers For the "crc32" and "crc32c" shash algorithms, instead of registering "*-generic" drivers as well as conditionally registering "*-$(ARCH)" drivers, instead just register "*-lib" drivers. These just use the regular library functions crc32_le() and crc32c(), so they just do the right thing and are fully accelerated when supported by the CPU. This eliminates the need for the CRC library to export crc32_le_base() and crc32c_base(). Separate commits make those static functions. Since this commit removes the "crc32-generic" and "crc32c-generic" driver names which crypto/testmgr.c expects to exist, update testmgr.c accordingly. This does mean that testmgr.c will no longer fuzz-test the "generic" implementation against the "arch" implementation for crc32 and crc32c, but this was redundant with crc_kunit anyway. Besides the above, and btrfs_init_csum_hash() which the previous commit fixed, no code appears to have been relying on the "crc32-generic" or "crc32c-generic" driver names specifically. btrfs does export the checksum name and checksum driver name in /sys/fs/btrfs/$uuid/checksum. This commit makes the driver name portion of that file contain "crc32c-lib" instead of "crc32c-generic" or "crc32c-$(ARCH)". This should be fine, since in practice the purpose of the driver name portion of this file seems to have been just to allow users to manually check whether they needed to enable the optimized CRC32C code. This was needed only because of the bug in old kernels where the optimized CRC32C code defaulted to off and even needed to be explicitly added to the ramdisk to be used. Now that it just works in Linux 6.14 and later, there's no need for users to take any action and the driver name portion of this is basically obsolete. (Also, note that the crc32c driver name already changed in 6.14.) Acked-by: David Sterba Link: https://lore.kernel.org/r/20250613183753.31864-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 2c7528d36ea31a75a2338920d03b4c19e9f1da2f Author: Eric Biggers Date: Fri Jun 13 11:37:52 2025 -0700 btrfs: stop parsing crc32c driver name To determine whether the crc32c implementation is "fast", use crc32_optimizations() instead of parsing the crypto_shash driver name. This keeps the code working as intended after the driver name is changed by the next commit. Acked-by: David Sterba Link: https://lore.kernel.org/r/20250613183753.31864-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 5b019bb25fbfde0b148895a1676f4bfe7a264156 Author: Eric Biggers Date: Sun Jun 1 12:34:41 2025 -0700 crypto: stm32 - remove crc32 and crc32c support Remove the crc32 and crc32c support from the stm32 driver. Since it's not wired up to the CRC library, almost no CRC user in the kernel can actually be taking advantage of it, so it's effectively dead code. Support for this hardware could be migrated to the CRC library, but there doesn't seem to be much point. This CRC engine is present only on a couple older SoCs that lacked CRC instructions. Even for those SoCs, it probably wouldn't be worthwhile. This driver has to deal with things like locking and runtime power management that do not exist in software CRC code and are a source of bugs (as is clear from the commit log) and add significant overhead to the processing of short messages, which are common. The patch that added this driver seemed to justify it based purely on a microbenchmark on Cortex-M7 on long messages, not a real use case. These days, if this driver were to be used at all it would likely be on Cortex-A7 instead. This CRC engine is also not supported by QEMU, making the driver not easily testable. Acked-by: Ard Biesheuvel Acked-by: Arnd Bergmann Cc: Alexandre Torgue Cc: Fabien Dessenne Cc: Lionel Debieve Cc: Maxime Coquelin Cc: linux-stm32@st-md-mailman.stormreply.com Link: https://lore.kernel.org/r/20250601193441.6913-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 4be6cc8222a44e3165cd41731535c8e96b5e8104 Author: Eric Biggers Date: Sat May 31 13:42:44 2025 -0700 crypto: inside-secure - remove crc32 support The crc32 acceleration in the inside-secure driver is accessible only as an asynchronous hash. However, there seems to be no corresponding user of crc32 in the kernel that supports asynchronous hashes. Therefore, this code seems to be unused. The patch that added this code provided no justification for its inclusion. All devicetree bindings for this accelerator are for arm64; arm64 CPUs often have CRC or PMULL instructions, which already accelerate crc32 very well. And these actually work with the crc32 users in the kernel, unlike this driver which doesn't. Remove this unnecessary code. Cc: Antoine Tenart Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250531204244.24648-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 0e238260d3c392de5259f3d796a09f5e46809090 Author: Eric Biggers Date: Sat May 31 13:59:37 2025 -0700 crypto: testmgr - remove crc32c context format test This is no longer needed now that the code that used to directly access the descriptor context of "crc32c" (libcrc32c and ext4) now just calls crc32c(). Keep just the generic hash test. Link: https://lore.kernel.org/r/20250531205937.63008-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit cece5689e1d76b1e45dd281a4d94ed1bcd78511c Author: Eric Biggers Date: Sat May 31 14:13:18 2025 -0700 x86/crc: drop checks of CONFIG_AS_VPCLMULQDQ Now that the minimum binutils version supports VPCLMULQDQ (and the minimum clang version does too), there is no need to check for assembler support before compiling code that uses these instructions. Link: https://lore.kernel.org/r/20250531211318.83677-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 22375adaa0d9fbba9646c8e2b099c6e87c97bfae Author: Eric Biggers Date: Thu Jun 19 15:55:35 2025 -0700 lib/crypto: mips/chacha: Fix clang build and remove unneeded byteswap The MIPS32r2 ChaCha code has never been buildable with the clang assembler. First, clang doesn't support the 'rotl' pseudo-instruction: error: unknown instruction, did you mean: rol, rotr? Second, clang requires that both operands of the 'wsbh' instruction be explicitly given: error: too few operands for instruction To fix this, align the code with the real instruction set by (1) using the real instruction 'rotr' instead of the nonstandard pseudo- instruction 'rotl', and (2) explicitly giving both operands to 'wsbh'. To make removing the use of 'rotl' a bit easier, also remove the unnecessary special-casing for big endian CPUs at .Lchacha_mips_xor_bytes. The tail handling is actually endian-independent since it processes one byte at a time. On big endian CPUs the old code byte-swapped SAVED_X, then iterated through it in reverse order. But the byteswap and reverse iteration canceled out. Tested with chacha20poly1305-selftest in QEMU using "-M malta" with both little endian and big endian mips32r2 kernels. Fixes: 49aa7c00eddf ("crypto: mips/chacha - import 32r2 ChaCha code from Zinc") Cc: stable@vger.kernel.org Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505080409.EujEBwA0-lkp@intel.com/ Link: https://lore.kernel.org/r/20250619225535.679301-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a6d2f48b00f71590e1e4f174a88bd149516e6440 Author: Eric Biggers Date: Thu Jun 19 12:19:08 2025 -0700 MAINTAINERS: Drop arch/*/lib/crypto/ pattern Since all files arch/*/lib/crypto/* have been moved into lib/crypto/, remove the arch/*/lib/crypto/ file pattern from MAINTAINERS. Acked-by: Ard Biesheuvel Reviewed-by: Martin K. Petersen Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/r/20250619191908.134235-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 74750aa78de33794aa9ab55de15da04bd41d1ac8 Author: Eric Biggers Date: Thu Jun 19 12:19:07 2025 -0700 lib/crypto: x86: Move arch/x86/lib/crypto/ into lib/crypto/ Move the contents of arch/x86/lib/crypto/ into lib/crypto/x86/. The new code organization makes a lot more sense for how this code actually works and is developed. In particular, it makes it possible to build each algorithm as a single module, with better inlining and dead code elimination. For a more detailed explanation, see the patchset which did this for the CRC library code: https://lore.kernel.org/r/20250607200454.73587-1-ebiggers@kernel.org/. Also see the patchset which did this for SHA-512: https://lore.kernel.org/linux-crypto/20250616014019.415791-1-ebiggers@kernel.org/ This is just a preparatory commit, which does the move to get the files into their new location but keeps them building the same way as before. Later commits will make the actual improvements to the way the arch-optimized code is integrated for each algorithm. Add a gitignore entry for the removed directory arch/x86/lib/crypto/ so that people don't accidentally commit leftover generated files. Acked-by: Ard Biesheuvel Reviewed-by: Martin K. Petersen Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/r/20250619191908.134235-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit a32e93e10067d19dec302220a9124a21573e7e7e Author: Eric Biggers Date: Thu Jun 19 12:19:06 2025 -0700 lib/crypto: sparc: Move arch/sparc/lib/crypto/ into lib/crypto/ Move the contents of arch/sparc/lib/crypto/ into lib/crypto/sparc/. The new code organization makes a lot more sense for how this code actually works and is developed. In particular, it makes it possible to build each algorithm as a single module, with better inlining and dead code elimination. For a more detailed explanation, see the patchset which did this for the CRC library code: https://lore.kernel.org/r/20250607200454.73587-1-ebiggers@kernel.org/. Also see the patchset which did this for SHA-512: https://lore.kernel.org/linux-crypto/20250616014019.415791-1-ebiggers@kernel.org/ This is just a preparatory commit, which does the move to get the files into their new location but keeps them building the same way as before. Later commits will make the actual improvements to the way the arch-optimized code is integrated for each algorithm. Acked-by: Ard Biesheuvel Reviewed-by: Martin K. Petersen Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/r/20250619191908.134235-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b8456f7aaf35bc5af247bc8f58412c2cffc331c9 Author: Eric Biggers Date: Thu Jun 19 12:19:05 2025 -0700 lib/crypto: s390: Move arch/s390/lib/crypto/ into lib/crypto/ Move the contents of arch/s390/lib/crypto/ into lib/crypto/s390/. The new code organization makes a lot more sense for how this code actually works and is developed. In particular, it makes it possible to build each algorithm as a single module, with better inlining and dead code elimination. For a more detailed explanation, see the patchset which did this for the CRC library code: https://lore.kernel.org/r/20250607200454.73587-1-ebiggers@kernel.org/. Also see the patchset which did this for SHA-512: https://lore.kernel.org/linux-crypto/20250616014019.415791-1-ebiggers@kernel.org/ This is just a preparatory commit, which does the move to get the files into their new location but keeps them building the same way as before. Later commits will make the actual improvements to the way the arch-optimized code is integrated for each algorithm. Acked-by: Ard Biesheuvel Reviewed-by: Martin K. Petersen Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/r/20250619191908.134235-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit daed4fcf04db425e44d377a425424752881a2a68 Author: Eric Biggers Date: Thu Jun 19 12:19:04 2025 -0700 lib/crypto: riscv: Move arch/riscv/lib/crypto/ into lib/crypto/ Move the contents of arch/riscv/lib/crypto/ into lib/crypto/riscv/. The new code organization makes a lot more sense for how this code actually works and is developed. In particular, it makes it possible to build each algorithm as a single module, with better inlining and dead code elimination. For a more detailed explanation, see the patchset which did this for the CRC library code: https://lore.kernel.org/r/20250607200454.73587-1-ebiggers@kernel.org/. Also see the patchset which did this for SHA-512: https://lore.kernel.org/linux-crypto/20250616014019.415791-1-ebiggers@kernel.org/ This is just a preparatory commit, which does the move to get the files into their new location but keeps them building the same way as before. Later commits will make the actual improvements to the way the arch-optimized code is integrated for each algorithm. Acked-by: Ard Biesheuvel Acked-by: Palmer Dabbelt Reviewed-by: Martin K. Petersen Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/r/20250619191908.134235-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 676d45aba8c498dc14ffd27338dba8d4395787e2 Author: Eric Biggers Date: Thu Jun 19 12:19:03 2025 -0700 lib/crypto: powerpc: Move arch/powerpc/lib/crypto/ into lib/crypto/ Move the contents of arch/powerpc/lib/crypto/ into lib/crypto/powerpc/. The new code organization makes a lot more sense for how this code actually works and is developed. In particular, it makes it possible to build each algorithm as a single module, with better inlining and dead code elimination. For a more detailed explanation, see the patchset which did this for the CRC library code: https://lore.kernel.org/r/20250607200454.73587-1-ebiggers@kernel.org/. Also see the patchset which did this for SHA-512: https://lore.kernel.org/linux-crypto/20250616014019.415791-1-ebiggers@kernel.org/ This is just a preparatory commit, which does the move to get the files into their new location but keeps them building the same way as before. Later commits will make the actual improvements to the way the arch-optimized code is integrated for each algorithm. Acked-by: Ard Biesheuvel Reviewed-by: Martin K. Petersen Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/r/20250619191908.134235-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 7e54e993ab8c98d912f54ad6f46bfcc9dcd65368 Author: Eric Biggers Date: Thu Jun 19 12:19:02 2025 -0700 lib/crypto: mips: Move arch/mips/lib/crypto/ into lib/crypto/ Move the contents of arch/mips/lib/crypto/ into lib/crypto/mips/. The new code organization makes a lot more sense for how this code actually works and is developed. In particular, it makes it possible to build each algorithm as a single module, with better inlining and dead code elimination. For a more detailed explanation, see the patchset which did this for the CRC library code: https://lore.kernel.org/r/20250607200454.73587-1-ebiggers@kernel.org/. Also see the patchset which did this for SHA-512: https://lore.kernel.org/linux-crypto/20250616014019.415791-1-ebiggers@kernel.org/ This is just a preparatory commit, which does the move to get the files into their new location but keeps them building the same way as before. Later commits will make the actual improvements to the way the arch-optimized code is integrated for each algorithm. Add a gitignore entry for the removed directory arch/mips/lib/crypto/ so that people don't accidentally commit leftover generated files. Acked-by: Ard Biesheuvel Reviewed-by: Martin K. Petersen Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/r/20250619191908.134235-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 61f86c70cf419c826ee3b9c175d1e355844d8b45 Author: Eric Biggers Date: Thu Jun 19 12:19:01 2025 -0700 lib/crypto: arm64: Move arch/arm64/lib/crypto/ into lib/crypto/ Move the contents of arch/arm64/lib/crypto/ into lib/crypto/arm64/. The new code organization makes a lot more sense for how this code actually works and is developed. In particular, it makes it possible to build each algorithm as a single module, with better inlining and dead code elimination. For a more detailed explanation, see the patchset which did this for the CRC library code: https://lore.kernel.org/r/20250607200454.73587-1-ebiggers@kernel.org/. Also see the patchset which did this for SHA-512: https://lore.kernel.org/linux-crypto/20250616014019.415791-1-ebiggers@kernel.org/ This is just a preparatory commit, which does the move to get the files into their new location but keeps them building the same way as before. Later commits will make the actual improvements to the way the arch-optimized code is integrated for each algorithm. Add a gitignore entry for the removed directory arch/arm64/lib/crypto/ so that people don't accidentally commit leftover generated files. Acked-by: Ard Biesheuvel Reviewed-by: Martin K. Petersen Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/r/20250619191908.134235-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 4a32e5dc1dcfa8f1ed6ca33328e71dcb6196c09e Author: Eric Biggers Date: Thu Jun 19 12:19:00 2025 -0700 lib/crypto: arm: Move arch/arm/lib/crypto/ into lib/crypto/ Move the contents of arch/arm/lib/crypto/ into lib/crypto/arm/. The new code organization makes a lot more sense for how this code actually works and is developed. In particular, it makes it possible to build each algorithm as a single module, with better inlining and dead code elimination. For a more detailed explanation, see the patchset which did this for the CRC library code: https://lore.kernel.org/r/20250607200454.73587-1-ebiggers@kernel.org/. Also see the patchset which did this for SHA-512: https://lore.kernel.org/linux-crypto/20250616014019.415791-1-ebiggers@kernel.org/ This is just a preparatory commit, which does the move to get the files into their new location but keeps them building the same way as before. Later commits will make the actual improvements to the way the arch-optimized code is integrated for each algorithm. Add a gitignore entry for the removed directory arch/arm/lib/crypto/ so that people don't accidentally commit leftover generated files. Acked-by: Ard Biesheuvel Reviewed-by: Martin K. Petersen Reviewed-by: Sohil Mehta Link: https://lore.kernel.org/r/20250619191908.134235-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 9b5c0d82b26d10733f67e10ea1889fc24aa6840a Author: Eric Biggers Date: Mon Jun 30 09:03:20 2025 -0700 crypto: sha512 - Remove sha512_base.h sha512_base.h is no longer used, so remove it. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-17-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 6486f2b0368dca5b7ba003d3904bfc64ff2439d5 Author: Eric Biggers Date: Mon Jun 30 09:03:19 2025 -0700 lib/crypto: x86/sha512: Remove unnecessary checks for nblocks==0 Since sha512_blocks() is called only with nblocks >= 1, remove unnecessary checks for nblocks == 0 from the x86 SHA-512 assembly code. Link: https://lore.kernel.org/r/20250630160320.2888-16-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 484c18119f4fbc6bca7c41e64b6fa84133e1057b Author: Eric Biggers Date: Mon Jun 30 09:03:18 2025 -0700 lib/crypto: x86/sha512: Migrate optimized SHA-512 code to library Instead of exposing the x86-optimized SHA-512 code via x86-specific crypto_shash algorithms, instead just implement the sha512_blocks() library function. This is much simpler, it makes the SHA-512 (and SHA-384) library functions be x86-optimized, and it fixes the longstanding issue where the x86-optimized SHA-512 code was disabled by default. SHA-512 still remains available through crypto_shash, but individual architectures no longer need to handle it. To match sha512_blocks(), change the type of the nblocks parameter of the assembly functions from int to size_t. The assembly functions actually already treated it as size_t. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-15-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 02b35bab7e6c5bb2a843828316d528216b8cedc8 Author: Eric Biggers Date: Mon Jun 30 09:03:17 2025 -0700 lib/crypto: sparc/sha512: Migrate optimized SHA-512 code to library Instead of exposing the sparc-optimized SHA-512 code via sparc-specific crypto_shash algorithms, instead just implement the sha512_blocks() library function. This is much simpler, it makes the SHA-512 (and SHA-384) library functions be sparc-optimized, and it fixes the longstanding issue where the sparc-optimized SHA-512 code was disabled by default. SHA-512 still remains available through crypto_shash, but individual architectures no longer need to handle it. To match sha512_blocks(), change the type of the nblocks parameter of the assembly function from int to size_t. The assembly function actually already treated it as size_t. Note: to see the diff from arch/sparc/crypto/sha512_glue.c to lib/crypto/sparc/sha512.h, view this commit with 'git show -M10'. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-14-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b7b366087e0f1645f867077a14bab617516d0f57 Author: Eric Biggers Date: Mon Jun 30 09:03:16 2025 -0700 lib/crypto: s390/sha512: Migrate optimized SHA-512 code to library Instead of exposing the s390-optimized SHA-512 code via s390-specific crypto_shash algorithms, instead just implement the sha512_blocks() library function. This is much simpler, it makes the SHA-512 (and SHA-384) library functions be s390-optimized, and it fixes the longstanding issue where the s390-optimized SHA-512 code was disabled by default. SHA-512 still remains available through crypto_shash, but individual architectures no longer need to handle it. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-13-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b59059a22c5a717284b05385de5c0cbff2879859 Author: Eric Biggers Date: Mon Jun 30 09:03:15 2025 -0700 lib/crypto: riscv/sha512: Migrate optimized SHA-512 code to library Instead of exposing the riscv-optimized SHA-512 code via riscv-specific crypto_shash algorithms, instead just implement the sha512_blocks() library function. This is much simpler, it makes the SHA-512 (and SHA-384) library functions be riscv-optimized, and it fixes the longstanding issue where the riscv-optimized SHA-512 code was disabled by default. SHA-512 still remains available through crypto_shash, but individual architectures no longer need to handle it. To match sha512_blocks(), change the type of the nblocks parameter of the assembly function from int to size_t. The assembly function actually already treated it as size_t. Note: to see the diff from arch/riscv/crypto/sha512-riscv64-glue.c to lib/crypto/riscv/sha512.h, view this commit with 'git show -M10'. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-12-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 7117739ad2b40298776f428382ebce525adc7f7d Author: Eric Biggers Date: Mon Jun 30 09:03:14 2025 -0700 lib/crypto: mips/sha512: Migrate optimized SHA-512 code to library Instead of exposing the mips-optimized SHA-512 code via mips-specific crypto_shash algorithms, instead just implement the sha512_blocks() library function. This is much simpler, it makes the SHA-512 (and SHA-384) library functions be mips-optimized, and it fixes the longstanding issue where the mips-optimized SHA-512 code was disabled by default. SHA-512 still remains available through crypto_shash, but individual architectures no longer need to handle it. Note: to see the diff from arch/mips/cavium-octeon/crypto/octeon-sha512.c to lib/crypto/mips/sha512.h, view this commit with 'git show -M10'. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-11-ebiggers@kernel.org Signed-off-by: Eric Biggers commit ecac3068ffc28324070e96c46d171b5431215c0d Author: Eric Biggers Date: Mon Jun 30 09:03:13 2025 -0700 mips: cavium-octeon: Move octeon-crypto.h into asm directory Since arch/mips/cavium-octeon/crypto/octeon-crypto.h is now needed outside of its directory, move it to arch/mips/include/asm/octeon/crypto.h so that it can be included as . Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-10-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 60e3f1e9b7a57567c2f3b3ae013e3e292cf6d115 Author: Eric Biggers Date: Mon Jun 30 09:03:12 2025 -0700 lib/crypto: arm64/sha512: Migrate optimized SHA-512 code to library Instead of exposing the arm64-optimized SHA-512 code via arm64-specific crypto_shash algorithms, instead just implement the sha512_blocks() library function. This is much simpler, it makes the SHA-512 (and SHA-384) library functions be arm64-optimized, and it fixes the longstanding issue where the arm64-optimized SHA-512 code was disabled by default. SHA-512 still remains available through crypto_shash, but individual architectures no longer need to handle it. To match sha512_blocks(), change the type of the nblocks parameter of the assembly functions from int or 'unsigned int' to size_t. Update the ARMv8 CE assembly function accordingly. The scalar assembly function actually already treated it as size_t. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-9-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 24c91b62ac50a798ceabb3482efbca3e0e88a2db Author: Eric Biggers Date: Mon Jun 30 09:03:11 2025 -0700 lib/crypto: arm/sha512: Migrate optimized SHA-512 code to library Instead of exposing the arm-optimized SHA-512 code via arm-specific crypto_shash algorithms, instead just implement the sha512_blocks() library function. This is much simpler, it makes the SHA-512 (and SHA-384) library functions be arm-optimized, and it fixes the longstanding issue where the arm-optimized SHA-512 code was disabled by default. SHA-512 still remains available through crypto_shash, but individual architectures no longer need to handle it. To match sha512_blocks(), change the type of the nblocks parameter of the assembly functions from int to size_t. The assembly functions actually already treated it as size_t. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-8-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 4bc7f7b687a2a1506cdc457bc4f6d29a81794a08 Author: Eric Biggers Date: Mon Jun 30 09:03:10 2025 -0700 crypto: sha512 - Use same state format as legacy drivers Make the export and import functions for the sha384, sha512, hmac(sha384), and hmac(sha512) shash algorithms use the same format as the padlock-sha and nx-sha512 drivers, as required by Herbert. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-7-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 469acaa12502e05eefd439693361fe4b851a4fd5 Author: Eric Biggers Date: Mon Jun 30 09:03:09 2025 -0700 crypto: sha512 - Replace sha512_generic with wrapper around SHA-512 library Delete crypto/sha512_generic.c, which provided "generic" SHA-384 and SHA-512 crypto_shash algorithms. Replace it with crypto/sha512.c which provides SHA-384, SHA-512, HMAC-SHA384, and HMAC-SHA512 crypto_shash algorithms using the corresponding library functions. This is a prerequisite for migrating all the arch-optimized SHA-512 code (which is almost 3000 lines) to lib/crypto/ rather than duplicating it. Since the replacement crypto_shash algorithms are implemented using the (potentially arch-optimized) library functions, give them cra_driver_names ending with "-lib" rather than "-generic". Update crypto/testmgr.c and one odd driver to take this change in driver name into account. Besides these cases which are accounted for, there are no known cases where the cra_driver_name was being depended on. This change does mean that the abstract partial block handling code in crypto/shash.c, which got added in 6.16, no longer gets used. But that's fine; the library has to implement the partial block handling anyway, and it's better to do it in the library since the block size and other properties of the algorithm are all fixed at compile time there, resulting in more streamlined code. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-6-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 485deceec03997eabd884d4da89217af73d1ab8d Author: Eric Biggers Date: Mon Jun 30 09:03:08 2025 -0700 crypto: riscv/sha512 - Stop depending on sha512_generic_block_fn sha512_generic_block_fn() will no longer be available when the SHA-512 support in the old-school crypto API is changed to just wrap the SHA-512 library. Replace the use of sha512_generic_block_fn() in sha512-riscv64-glue.c with temporary code that uses the library's __sha512_update(). This is just a temporary workaround to keep the kernel building and functional at each commit; this code gets superseded when the RISC-V optimized SHA-512 is migrated to lib/crypto/ anyway. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-5-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 23e8b4371dbd5907d633262f36903144a378a114 Author: Eric Biggers Date: Mon Jun 30 09:03:07 2025 -0700 lib/crypto: sha512: Add HMAC-SHA384 and HMAC-SHA512 support Since HMAC support is commonly needed and is fairly simple, include it as a first-class citizen of the SHA-512 library. The API supports both incremental and one-shot computation, and either preparing the key ahead of time or just using a raw key. The implementation is much more streamlined than crypto/hmac.c. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-4-ebiggers@kernel.org Signed-off-by: Eric Biggers commit b693c703accb08cbd52f0b94d810d6abbca3bfb9 Author: Eric Biggers Date: Mon Jun 30 09:03:06 2025 -0700 lib/crypto: sha512: Add support for SHA-384 and SHA-512 Add basic support for SHA-384 and SHA-512 to lib/crypto/. Various in-kernel users will be able to use this instead of the old-school crypto API, which is harder to use and has more overhead. The basic support added by this commit consists of the API and its documentation, backed by a C implementation of the algorithms. sha512_block_generic() is derived from crypto/sha512_generic.c. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-3-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e0fca177556c4419819876ac5a947b0844115d56 Author: Eric Biggers Date: Mon Jun 30 09:03:05 2025 -0700 crypto: sha512 - Rename conflicting symbols Rename existing functions and structs in architecture-optimized SHA-512 code that had names conflicting with the upcoming library interface which will be added to : sha384_init, sha512_init, sha512_update, sha384, and sha512. Note: all affected code will be superseded by later commits that migrate the arch-optimized SHA-512 code into the library. This commit simply keeps the kernel building for the initial introduction of the library. Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20250630160320.2888-2-ebiggers@kernel.org Signed-off-by: Eric Biggers commit e49a3eac9207e9575337f70feeb29430f6f16bb7 Author: Eric Biggers Date: Fri Jun 13 11:48:14 2025 -0700 lib/crypto: Explicitly include Fix build warnings with W=1 that started appearing after commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1"). While at it, also sort the include lists alphabetically. (Keep asm/irqflags.h last, as otherwise it doesn't build on alpha.) This handles all of lib/crypto/, but not arch/*/lib/crypto/. The exports in arch/*/lib/crypto/ will go away when the code is properly integrated into lib/crypto/ as planned. Link: https://lore.kernel.org/r/20250613184814.50173-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit 146847932278fef1ce13b5a839077e51ca019395 Author: Ian Rogers Date: Fri Jun 27 18:58:32 2025 -0700 perf test annotate: Use --percent-limit rather than head to reduce output The annotate test was sped up by Thomas Richter in commit 658a8805cb60 ("perf test: Speed up test case 70 annotate basic tests") by reducing the annotate output using head. This causes flakes on hybrid machines where the first event dumped may not have the samples for the test within it. Rather than reduce the output using `head` switch to `--percent-limit 10` which will stop annotate dumping functions that have an overhead of less than 10%, the noploop program should be using more. Add the missing objdump option for the pipe mode version of the objdump with a command test. Signed-off-by: Ian Rogers Tested-by: Thomas Richter Link: https://lore.kernel.org/r/20250628015832.1271229-1-irogers@google.com Signed-off-by: Namhyung Kim commit 5ceedc09f27f87a6adc00d522b06dcce990a1986 Author: Ian Rogers Date: Fri Jun 27 18:55:53 2025 -0700 perf test: Add basic callgraph test to record testing Give some basic perf record callgraph coverage. Signed-off-by: Ian Rogers Reviewed-by: James Clark Tested-by: Thomas Richter Link: https://lore.kernel.org/r/20250628015553.1270748-1-irogers@google.com Signed-off-by: Namhyung Kim commit bb986e4720009da4221aeeeed7dec3f56d96502c Author: Colin Ian King Date: Mon Jun 30 13:51:28 2025 +0100 perf drm_pmu: Fix spelling mistake "bufers" -> "buffers" There are spelling mistakes in some literal strings. Fix these. Fixes: 28917cb17f9d ("perf drm_pmu: Add a tool like PMU to expose DRM information") Signed-off-by: Colin Ian King Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250630125128.562895-1-colin.i.king@gmail.com Signed-off-by: Namhyung Kim commit 2ecdb61f76ebd3b2fd0a7a41421f9c4df206e802 Author: Alex Deucher Date: Mon Jun 23 15:47:45 2025 -0400 drm/amdgpu/sdma6: add more ucode version checks for userq support Fill in the SDMA ucode version checks for more SDMA 6.x parts. v2: squash in fixes (Alex) Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit dc5c742f41c0a1c2b14e4357c752851e015f3bcd Author: Patrick Lerda Date: Sat Jun 28 20:54:23 2025 +0200 drm/radeon: bump version to 2.51.0 The version 2.51.0 adds OpenGL 4.6 compatibility to evergreen and cayman. Signed-off-by: Patrick Lerda Signed-off-by: Alex Deucher commit a6d6a86e94bfdf298662ac4bd9d6c92b77ac9abb Author: YiPeng Chai Date: Fri Jun 27 16:49:24 2025 +0800 drm/amdgpu: Remove useless timeout error message The timeout is only used to interrupt polling and not need to print a error message. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 3b3afba42f9c1b4cbc6cbcfbf722385fe63e96a5 Author: Ce Sun Date: Mon Jun 30 10:29:21 2025 +0800 drm/amdgpu: Fix code style issue cocci warnings: (new ones prefixed by >>) >> drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:6088:8-9: Unneeded variable: "r". Return "0" on line 6141 Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506281925.HHIpXiO7-lkp@intel.com/ Signed-off-by: Ce Sun Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit cfce8f4fa7686657e119392e03964f401efea765 Author: ganglxie Date: Thu Jun 26 17:00:45 2025 +0800 drm/amdgpu: refine ras error injection when eeprom initialization failed when eeprom initialization failed, we still support ras error injection, and reserve bad pages, but do not save bad pages to eeprom Signed-off-by: ganglxie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 0b7f13551e4c87e51a330ce296222780b9512293 Author: Lijo Lazar Date: Sat Jun 28 12:52:01 2025 +0530 drm/amdgpu: Fix error with dev_info_once usage Fixes error with dev_info_once usage in amdgpu_device_asic_has_dc_support. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506281140.mXfWT3EN-lkp@intel.com/ Fixes: a3e510fd69c3 ("drm/amdgpu: Convert from DRM_* to dev_*") Signed-off-by: Alex Deucher commit 4a33ca3f6ee9a013a423a867426704e9c9d785bd Author: Xiang Liu Date: Fri Jun 27 23:14:08 2025 +0800 drm/amdgpu: Use correct severity for BP threshold exceed event The severity of CPER for BP threshold exceed event should be set as CPER_SEV_FATAL to match the OOB implementation. Signed-off-by: Xiang Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit cea3031b4249208b519fb6aa779301cef523c90b Author: Mario Limonciello Date: Fri Jun 27 09:34:32 2025 -0500 drm/amd: Change kv-dpm DRM_*() macros to drm_*() drm_*() macros can show the device a message came from. Reviewed-by: Lijo Lazar Cc: Alexandre Demers Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250627143432.3222843-3-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 7951cc16674fdc26542d3c3f74c0f84841d70319 Author: Mario Limonciello Date: Fri Jun 27 09:34:31 2025 -0500 drm/amd: Change legacy-dpm DRM_*() macros to drm_*() drm_*() macros can show the device a message came from. Reviewed-by: Lijo Lazar Cc: Alexandre Demers Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250627143432.3222843-2-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit de5e9fe092f90b913de881fe05e6aa8e90f97184 Author: Mario Limonciello Date: Fri Jun 27 09:34:30 2025 -0500 drm/amd: Decrease message level for legacy-pm, kv-dpm and si-dpm legacy-pm, kv-dpm and si-dpm have prints while changing power states that don't have a level and thus are printed by default. These are not useful at runtime for most people, so decrease them to debug. Reported-by: Alexandre Demers Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4322 Reviewed-by: Lijo Lazar Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250627143432.3222843-1-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit bfa5bb3d104b0f2ffd25daa3b4900d54fe060285 Author: Jonathan Corbet Date: Mon Jun 30 10:03:28 2025 -0600 docs: kdoc: remove the brcount floor in process_proto_type() Putting the floor under brcount does not change the output in any way, just remove it. Change the termination test from ==0 to <=0 to prevent infinite loops in case somebody does something truly wacko in the code. Signed-off-by: Jonathan Corbet commit e7ac92cb5207da9715f28f91fb61bc1ac63336cf Author: Taimur Hassan Date: Sun Jun 22 17:27:48 2025 -0500 drm/amd/display: Promote DAL to 3.2.340 Summary: * Remove unused tunnel BW validation * Refactor DML21 initialization and configuration * Fix link override sequencing when switching between DIO/HPO * Ensure OLED minimum luminance Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 5e0d1c5d269d39d5f6ec51e31a27bea30f68cb69 Author: Taimur Hassan Date: Sun Jun 22 16:33:48 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.17.0 Summary for changes in firmware: * Add AMD brightness adjustment feature for edp * Fix BL enable * Revise low power init sequence * Fix brightness delta after IPS1 entry * Adjusted DP blanking sequence Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 99e25e4683d7cfdf79dcc328e11bb6c924c77566 Author: Ivan Lipski Date: Thu Jun 19 18:14:52 2025 -0400 drm/amd/display: Add DPP & HUBP reset if power gate enabled on DCN314 [WHY] On DCN314, using full screen application with enabled scaling like 150%, 175%, with overlay cursor, causes a second cursor to appear when changing planes. Dpp cache is used to track the HW cursor enable. Since power gate is disabled for hubp & dpp in DCN314, dpp_reset() zero'ed the dpp struct, while the dpp hardware was not power gated. So, when plane is changed in a full screen app, and the overlay cursor is enabled, the cache is cleared, so the cache does not represent the actual cursor state. [HOW] Added conditionals for dpp & hubp reset and their pg_control functions only if according power_gate flags are enabled. Reviewed-by: Sun peng Li Signed-off-by: Ivan Lipski Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9c6669c2e21a2d9b3f3857883c715a302ae64ac0 Author: Michael Strauss Date: Wed Feb 12 13:52:42 2025 -0500 drm/amd/display: Fix Link Override Sequencing When Switching Between DIO/HPO [WHY] When performing certain link maintenance compliance tests or forcing link settings, changing between 128b/132b and 8b/10b rates no longer works on some ASICs. Some rate divider updates only occur when we set timings or validate state, which is not performed currently when toggling DPMS to change rates. [HOW] Re-calculate dividers and reprogram audio when switching between DIO and HPO through DP compliance/escape code path. Add OTG disable/re-enable so we don't touch the clock while OTG is active. Acquire dcLock before forcing link settings to avoid thread synchronization errors due to added programming in escape code path and potential HPD interrupts. Reviewed-by: George Shen Signed-off-by: Michael Strauss Signed-off-by: Mike Katsnelson Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 844f962ca6bf5b01d0af0bc62a7f06135581fe92 Author: Thomas Richter Date: Mon Jun 30 11:16:13 2025 +0200 perf test: perf header test fails on s390 commit 2d584688643fa ("perf test: Add header shell test") introduced a new test case for perf header. It fails on s390 because call graph option -g is not supported on s390. Also the option --call-graph dwarf is only supported for the event cpu-clock. Remove this option and the test succeeds. Output after: # ./perf test 76 76: perf header tests : Ok Fixes: 2d584688643fa ("perf test: Add header shell test") Signed-off-by: Thomas Richter Reviewed-by: Ian Rogers Acked-by: Sumanth Korikkar Link: https://lore.kernel.org/r/20250630091613.3061664-1-tmricht@linux.ibm.com Signed-off-by: Namhyung Kim commit 51496c7737d06a74b599d0aa7974c3d5a4b1162e Author: Mario Limonciello Date: Thu Jun 19 09:29:13 2025 -0500 drm/amd/display: Don't allow OLED to go down to fully off [Why] OLED panels can be fully off, but this behavior is unexpected. [How] Ensure that minimum luminance is at least 1. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4338 Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit fe7645d22bc0f7c1558296538ec49987bf268ef6 Author: Harold Sun Date: Thu Jun 19 14:52:54 2025 -0400 drm/amd/display: Added case for when RR equals panel's max RR using freesync [WHY] Rounding error sometimes occurs when the refresh rate is equal to a panel's max refresh rate, causing HDMI compliance failures. [HOW] Added a case so that we round up to avoid v_total_min to be below a panel's minimum bound. Reviewed-by: Jun Lei Signed-off-by: Harold Sun Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 660a467a5e7366cd6642de61f1aaeaf0d253ee68 Author: Ilya Bakoulin Date: Wed Jun 18 13:07:14 2025 -0400 drm/amd/display: Separate set_gsl from set_gsl_source_select [Why/How] Separate the checks for set_gsl and set_gsl_source_select, since source_select may not be implemented/necessary. Reviewed-by: Nevenko Stupar Signed-off-by: Ilya Bakoulin Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 86fa0b9830a9b114952d2d8766a3fb7c6c7922be Author: Wenjing Liu Date: Wed Jun 11 17:31:40 2025 -0400 drm/amd/display: Refactor DML21 Initialization and Configuration [Why & How] - Consolidated the initialization of DML21 parameters into a single function `dml21_populate_dml_init_params` to streamline the process and improve code readability. - Updated the function signatures in the header files to reflect changes in parameter passing for DML context. - Removed redundant debug option handling and integrated it into the new configuration population function. - Adjusted the DML21 initialization logic in the wrapper to accommodate the new structure, ensuring compatibility with different DCN versions. - Enhanced the handling of clock parameters and bounding box configurations from various sources, including hardware defaults and software policies. - Improved the clarity of the code by renaming functions and variables for better understanding of their purposes. Reviewed-by: Austin Zheng Signed-off-by: Wenjing Liu Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 8ebfc4d25a62252c009f35979335803ccdeb5eb8 Author: Karthi Kandasamy Date: Thu Jun 5 15:10:44 2025 +0200 drm/amd/display: prepare for new platform [Why & How] Expose some function for new platform use Reviewed-by: Nevenko Stupar Signed-off-by: Karthi Kandasamy Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 156374b2a6ce56ac744c75ce26649d421e48311d Author: Cruise Hung Date: Fri Jun 13 17:41:50 2025 +0800 drm/amd/display: Remove unused tunnel BW validation [Why & How] The tunnel BW validation code has changed to the new one. Remove the unused code. The DP tunneling overhead is not updated in SST. Move updating DP tunneling overhead for both SST and MST. Reviewed-by: Meenakshikumar Somasundaram Signed-off-by: Cruise Hung Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 158b9201c17fc93ed4253c2f03b77fd2671669a1 Author: Peichen Huang Date: Thu Jun 12 16:06:41 2025 +0800 drm/amd/display: add null check [WHY] Prevents null pointer dereferences to enhance function robustness [HOW] Adds early null check and return false if invalid. Reviewed-by: Cruise Hung Signed-off-by: Peichen Huang Signed-off-by: Ray Wu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 38b20968f3d8a603a979ac50ff6cf3553e0b3daf Author: Alex Deucher Date: Mon Jun 16 17:45:05 2025 -0400 drm/amdgpu: move scheduler wqueue handling into callbacks Move the scheduler wqueue stopping and starting into the ring reset callbacks. On some IPs we have to reset an engine which may have multiple queues. Move the wqueue handling into the backend so we can handle them as needed based on the type of reset available. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 43ca5eb94b38c1b3c71bca36025050dfaab1ef33 Author: Alex Deucher Date: Thu Jun 5 23:34:48 2025 -0400 drm/amdgpu: move guilty handling into ring resets Move guilty logic into the ring reset callbacks. This allows each ring reset callback to better handle fence errors and force completions in line with the reset behavior for each IP. It also allows us to remove the ring guilty callback since that logic now lives in the reset callback. Acked-by: Christian König Signed-off-by: Alex Deucher commit 2dee58ca471dae05c473270d0fb74efe01a78ccb Author: Alex Deucher Date: Thu May 29 12:58:53 2025 -0400 drm/amdgpu: move force completion into ring resets Move the force completion handling into each ring reset function so that each engine can determine whether or not it needs to force completion on the jobs in the ring. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 576fca060f16b4becb050b011d61e42b8429afe6 Author: Steven Price Date: Mon Jun 30 15:07:02 2025 +0100 drm/panthor: Wait for _READY register when powering on panthor_gpu_block_power_on() takes a register offset (rdy_reg) for the purpose of waiting for the power transition to complete. However, a copy/paste error converting to use the new 64 register functions switched it to using the pwrtrans_reg register instead. Fix the function to use the correct register. Fixes: 4d230aa209ed ("drm/panthor: Add 64-bit and poll register accessors") Signed-off-by: Steven Price Reviewed-by: Liviu Dudau Reviewed-by: Boris Brezillon Link: https://lore.kernel.org/r/20250630140704.432409-1-steven.price@arm.com commit 821aacb2dcf0d1fbc3c0f7803b6089b01addb8bf Author: Christian König Date: Fri May 2 18:17:16 2025 +0200 drm/amdgpu: rework queue reset scheduler interaction Stopping the scheduler for queue reset is generally a good idea because it prevents any worker from touching the ring buffer. Reviewed-by: Alex Deucher Signed-off-by: Christian König Signed-off-by: Alex Deucher commit 787e2ce10fdce2b95a9ad81cc244ef22b0c200fe Author: Alex Deucher Date: Thu Jun 5 16:12:08 2025 -0400 drm/amdgpu: update ring reset function signature Going forward, we'll need more than just the vmid. Add the guilty amdgpu_fence. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit d0c35c84dcfa66947b66ee7a5d8d2d7f52e9c1f3 Author: Alex Deucher Date: Mon Jun 16 11:56:23 2025 -0400 drm/amdgpu: remove job parameter from amdgpu_fence_emit() What we actually care about is the amdgpu_fence object so pass that in explicitly to avoid possible mistakes in the future. The job_run_counter handling can be safely removed at this point as we no longer support job resubmission. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 1e9d17a5dcf1242e9518e461d8e63ad35240e49e Author: Alex Deucher Date: Wed Jun 25 18:15:37 2025 -0400 drm/amdkfd: add hqd_sdma_get_doorbell callbacks for gfx7/8 These were missed when support was added for other generations. The callbacks are called unconditionally so we need to make sure all generations have them. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4304 Link: https://github.com/ROCm/ROCm/issues/4965 Fixes: bac38ca8c475 ("drm/amdkfd: implement per queue sdma reset for gfx 9.4+") Cc: Jonathan Kim Reported-by: Johl Brown Reviewed-by: Jonathan Kim Signed-off-by: Alex Deucher commit 09b9297478a3da4d940af8ff8c5f8e27be4990e8 Author: Jonathan Corbet Date: Mon Jun 30 09:33:23 2025 -0600 docs: kdoc: micro-optimize KernRe Switch KernRe::add_regex() to a try..except block to avoid looking up each regex twice. Signed-off-by: Jonathan Corbet commit 8cf66089e28108dedd47e6156a48489303cf525c Author: Lin.Cao Date: Tue Jun 24 17:05:34 2025 +0800 drm/amdgpu: Fix memory leak in amdgpu_ctx_mgr_entity_fini patch dd64956685fa ("drm/amdgpu: Remove duplicated "context still alive" check") removed ctx put, which will cause amdgpu_ctx_fini() cannot be called and then cause some finished fence that added by amdgpu_ctx_add_fence() cannot be released and cause memleak. Fixes: dd64956685fa ("drm/amdgpu: Remove duplicated "context still alive" check") Signed-off-by: Lin.Cao Reviewed-by: Tvrtko Ursulin Acked-by: Christian König Signed-off-by: Alex Deucher commit 26143d29927189fbc65434fccd8810c63089f709 Author: Dan Carpenter Date: Wed Jun 25 10:22:27 2025 -0500 drm/amdgpu: indent an if statement The "return true;" line wasn't indented. Also checkpatch likes when we align the && conditions. Signed-off-by: Dan Carpenter Signed-off-by: Alex Deucher commit 515986100d176663d0a03219a3056e4252f729e6 Author: Thomas Zimmermann Date: Wed Jun 25 10:42:18 2025 +0200 drm/amdgpu: Use dma_buf from GEM object instance Avoid dereferencing struct drm_gem_object.import_attach for the imported dma-buf. The dma_buf field in the GEM object instance refers to the same buffer. Prepares to make import_attach an implementation detail of PRIME. Reviewed-by: Christian König Signed-off-by: Thomas Zimmermann Signed-off-by: Alex Deucher commit 4948e6c7fb2a88bbf961e60009f896aaa07fe57f Author: Thomas Zimmermann Date: Wed Jun 25 10:42:17 2025 +0200 drm/amdgpu: Test for imported buffers with drm_gem_is_imported() Instead of testing import_attach for imported GEM buffers, invoke drm_gem_is_imported() to do the test. v2: - keep amdgpu_bo_print_info() as-is (Christian) Reviewed-by: Christian König Signed-off-by: Thomas Zimmermann Signed-off-by: Alex Deucher commit a3e510fd69c315a6b55f7a982caadee4e3ba6301 Author: Lijo Lazar Date: Tue Jun 24 11:20:56 2025 +0530 drm/amdgpu: Convert from DRM_* to dev_* Convert from generic DRM_* to dev_* calls to have device context info. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 1bec2f270766f203b1c9786d6a023fd79704f70e Author: Lijo Lazar Date: Fri Jun 13 18:08:22 2025 +0530 drm/amd/pm: Fetch SMUv13.0.12 xgmi max speed/width On SMU v13.0.12 SOCs, fetch the max values of xgmi speed/width from firmware. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit a29e067bd38946f752b0ef855f3dfff87e77bec7 Author: Philip Yang Date: Fri Jun 20 18:32:32 2025 -0400 drm/amdkfd: Don't call mmput from MMU notifier callback If the process is exiting, the mmput inside mmu notifier callback from compactd or fork or numa balancing could release the last reference of mm struct to call exit_mmap and free_pgtable, this triggers deadlock with below backtrace. The deadlock will leak kfd process as mmu notifier release is not called and cause VRAM leaking. The fix is to take mm reference mmget_non_zero when adding prange to the deferred list to pair with mmput in deferred list work. If prange split and add into pchild list, the pchild work_item.mm is not used, so remove the mm parameter from svm_range_unmap_split and svm_range_add_child. The backtrace of hung task: INFO: task python:348105 blocked for more than 64512 seconds. Call Trace: __schedule+0x1c3/0x550 schedule+0x46/0xb0 rwsem_down_write_slowpath+0x24b/0x4c0 unlink_anon_vmas+0xb1/0x1c0 free_pgtables+0xa9/0x130 exit_mmap+0xbc/0x1a0 mmput+0x5a/0x140 svm_range_cpu_invalidate_pagetables+0x2b/0x40 [amdgpu] mn_itree_invalidate+0x72/0xc0 __mmu_notifier_invalidate_range_start+0x48/0x60 try_to_unmap_one+0x10fa/0x1400 rmap_walk_anon+0x196/0x460 try_to_unmap+0xbb/0x210 migrate_page_unmap+0x54d/0x7e0 migrate_pages_batch+0x1c3/0xae0 migrate_pages_sync+0x98/0x240 migrate_pages+0x25c/0x520 compact_zone+0x29d/0x590 compact_zone_order+0xb6/0xf0 try_to_compact_pages+0xbe/0x220 __alloc_pages_direct_compact+0x96/0x1a0 __alloc_pages_slowpath+0x410/0x930 __alloc_pages_nodemask+0x3a9/0x3e0 do_huge_pmd_anonymous_page+0xd7/0x3e0 __handle_mm_fault+0x5e3/0x5f0 handle_mm_fault+0xf7/0x2e0 hmm_vma_fault.isra.0+0x4d/0xa0 walk_pmd_range.isra.0+0xa8/0x310 walk_pud_range+0x167/0x240 walk_pgd_range+0x55/0x100 __walk_page_range+0x87/0x90 walk_page_range+0xf6/0x160 hmm_range_fault+0x4f/0x90 amdgpu_hmm_range_get_pages+0x123/0x230 [amdgpu] amdgpu_ttm_tt_get_user_pages+0xb1/0x150 [amdgpu] init_user_pages+0xb1/0x2a0 [amdgpu] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x543/0x7d0 [amdgpu] kfd_ioctl_alloc_memory_of_gpu+0x24c/0x4e0 [amdgpu] kfd_ioctl+0x29d/0x500 [amdgpu] Fixes: fa582c6f3684 ("drm/amdkfd: Use mmget_not_zero in MMU notifier") Signed-off-by: Philip Yang Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher commit 51526efe02714339ed6139f7bc348377d363200a Author: Kent Russell Date: Tue Jun 24 11:42:06 2025 -0400 drm/amdgpu: Include sdma_4_4_4.bin This got missed during SDMA 4.4.4 support. Signed-off-by: Kent Russell Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 28472374291c380c22f40deec07a90d09bcbffb6 Author: André Almeida Date: Fri Jun 13 15:26:51 2025 -0300 drm/amd: Include when needed Fix the following compile time warning when building with W=1: warning: EXPORT_SYMBOL() is used, but #include is missing Acked-by: Christian König Signed-off-by: André Almeida Signed-off-by: Alex Deucher commit 6531fd55f3217b3cb8cdc41611e39ca12e095fe5 Author: André Almeida Date: Fri Jun 13 15:26:50 2025 -0300 drm/amd: Do not include when unused Fix the following compile time warning when building with W=1: warning: EXPORT_SYMBOL() is not used, but #include is present Acked-by: Christian König Signed-off-by: André Almeida Signed-off-by: Alex Deucher commit 5d14fdab4778c29cfd39e62c3ce84d232b4a7d8c Author: David Yat Sin Date: Thu Jun 19 17:51:13 2025 +0000 amdkfd: MTYPE_UC for ext-coherent system memory Set memory mtype to UC host memory when ext-coherent flag is set and memory is registered as a SVM allocation. Reviewed-by: Amber Lin Signed-off-by: David Yat Sin Signed-off-by: Alex Deucher commit 61feed0baa1a0d094af0e07e968b1e6e875f07d0 Author: Alex Deucher Date: Mon Jun 16 14:04:54 2025 -0400 drm/amdgpu/sdma5.x: suspend KFD queues in ring reset SDMA 5.x only supports engine soft reset which resets all queues on the engine. As such, we need to suspend KFD queues around resets like we do for SDMA 4.x. Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit c256a94d1b1b15109740306f7f2a7c2173e12072 Author: Kang Yang Date: Mon Jun 23 10:27:31 2025 +0800 wifi: ath10k: shutdown driver when hardware is unreliable In rare cases, ath10k may lose connection with the PCIe bus due to some unknown reasons, which could further lead to system crashes during resuming due to watchdog timeout: ath10k_pci 0000:01:00.0: wmi command 20486 timeout, restarting hardware ath10k_pci 0000:01:00.0: already restarting ath10k_pci 0000:01:00.0: failed to stop WMI vdev 0: -11 ath10k_pci 0000:01:00.0: failed to stop vdev 0: -11 ieee80211 phy0: PM: **** DPM device timeout **** Call Trace: panic+0x125/0x315 dpm_watchdog_set+0x54/0x54 dpm_watchdog_handler+0x57/0x57 call_timer_fn+0x31/0x13c At this point, all WMI commands will timeout and attempt to restart device. So set a threshold for consecutive restart failures. If the threshold is exceeded, consider the hardware is unreliable and all ath10k operations should be skipped to avoid system crash. fail_cont_count and pending_recovery are atomic variables, and do not involve complex conditional logic. Therefore, even if recovery check and reconfig complete are executed concurrently, the recovery mechanism will not be broken. Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1 Signed-off-by: Kang Yang Reviewed-by: Loic Poulain Link: https://patch.msgid.link/20250623022731.509-1-kang.yang@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 7ff495e26a39f3e7a3d4058df59b5b6d6f943cab Author: Sebastian Andrzej Siewior Date: Mon Jun 30 09:51:38 2025 +0200 local_lock: Move this_cpu_ptr() notation from internal to main header local_lock.h is the main header for the local_lock_t type and provides wrappers around internal functions prefixed with __ in local_lock_internal.h. Move the this_cpu_ptr() dereference of the variable from the internal to the main header. Since it is all macro implemented, this_cpu_ptr() will still happen within the preempt/ IRQ disabled section. This frees the internal implementation (__) to be used on local_lock_t types which are local variables and must not be accessed via this_cpu_ptr(). Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Acked-by: Waiman Long Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/all/20250630075138.3448715-2-bigeasy@linutronix.de commit 647496422ba9d2784fb8e15b3fda7fe801b1f2ff Merge: 99e3eb454cc48b 040cef30b5e672 Author: Jakub Kicinski Date: Mon Jun 30 08:41:32 2025 -0700 Merge branch 'net-ethtool-consistently-take-rss_lock-for-all-rxfh-ops' Jakub Kicinski says: ==================== net: ethtool: consistently take rss_lock for all rxfh ops I'd like to bring RXFH and RXFHINDIR ioctls under a single set of Netlink ops. It appears that while core takes the ethtool->rss_lock around some of the RXFHINDIR ops, drivers (sfc) take it internally for the RXFH. Consistently take the lock around all ops and accesses to the XArray within the core. This should hopefully make the rss_lock a lot less confusing. ==================== Link: https://patch.msgid.link/20250626202848.104457-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 040cef30b5e67271e3193e0206f82b206fc97095 Author: Jakub Kicinski Date: Thu Jun 26 13:28:48 2025 -0700 net: ethtool: move get_rxfh callback under the rss_lock We already call get_rxfh under the rss_lock when we read back context state after changes. Let's be consistent and always hold the lock. The existing callers are all under rtnl_lock so this should make no difference in practice, but it makes the locking rules far less confusing IMHO. Any RSS callback and any access to the RSS XArray should hold the lock. Link: https://patch.msgid.link/20250626202848.104457-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 739d18cce105ce3c8437ad56bec3fbe62f0210bb Author: Jakub Kicinski Date: Thu Jun 26 13:28:47 2025 -0700 net: ethtool: move rxfh_fields callbacks under the rss_lock Netlink code will want to perform the RSS_SET operation atomically under the rss_lock. sfc wants to hold the rss_lock in rxfh_fields_get, which makes that difficult. Lets move the locking up to the core so that for all driver-facing callbacks rss_lock is taken consistently by the core. Link: https://patch.msgid.link/20250626202848.104457-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5ec353dbff4fd5fed21fa2104c3e01444cc06c89 Author: Jakub Kicinski Date: Thu Jun 26 13:28:46 2025 -0700 net: ethtool: take rss_lock for all rxfh changes Always take the rss_lock in ethtool_set_rxfh(). We will want to make a similar change in ethtool_set_rxfh_fields() and some drivers lock that callback regardless of rss context ID being set. Having some callbacks locked unconditionally and some only if context ID is set would be very confusing. ethtool handling is under rtnl_lock, so rss_lock is very unlikely to ever be congested. Link: https://patch.msgid.link/20250626202848.104457-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4dfed55bfb4b500bbc45867c1b83789cc4dbd106 Author: Andy Yan Date: Wed Jun 18 16:09:55 2025 +0800 drm/panel: raydium-rm67200: Add missing drm_display_mode flags Add missing drm_display_mode DRM_MODE_FLAG_NVSYNC | DRM_MODE_FLAG_NHSYNC flags. Those are used by various bridges(e.g. dw-mipi-dsi) in the pipeline to correctly configure its sync signals polarity. Tested on rk3568/rk3576/rk3588 EVB. Signed-off-by: Andy Yan Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250618080955.691048-1-andyshrk@163.com commit 691674a282bdbf8f8bce4094369a2d1e4b5645e9 Author: Andy Yan Date: Wed Jun 18 17:15:20 2025 +0800 drm/panel: raydium-rm67200: Move initialization from enable() to prepare stage The DSI host has different modes in prepare() and enable() functions, prepare() is in LP command mode and enable() is in HS video mode. >From our experience, generally the initialization sequence needs to be sent in the LP command mode. Move the setup init function from enable() to prepare() to fix a display shift on rk3568 evb. Tested on rk3568/rk3576/rk3588 EVB. Signed-off-by: Andy Yan Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250618091520.691590-1-andyshrk@163.com commit 941461216c8d96b2c8b91233ba71483e011f78a3 Author: Andy Yan Date: Mon Jun 16 15:05:17 2025 +0800 drivers/panel: raydium-rm67200: Make reset-gpio optional Although the datasheet of the panel module describes that it has a reset pin, in the actual hardware design, we often use an RC circuit to control the reset, and rarely use GPIO to control the reset. This is the way it is done on our numerous development boards (such as RK3568/RK3576 EVB). So make the reset-gpio optional. Signed-off-by: Andy Yan Reviewed-by: Sebastian Reichel Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250616070536.670519-2-andyshrk@163.com commit 7513437b42d3ea682967e8fab113e20e558ecbc8 Author: Andy Yan Date: Mon Jun 16 15:05:16 2025 +0800 dt-bindings: display: panel: Make reset-gpio as optional for Raydium RM67200 Although the datasheet of the panel module describes that it has a reset pin, in the actual hardware design, we often use an RC circuit to control the reset, and rarely use GPIO to control the reset. This is the way it is done on our numerous development boards (such as RK3568, RK3576 EVB). So make the reset-gpio optional. Signed-off-by: Andy Yan Acked-by: Rob Herring (Arm) Reviewed-by: Sebastian Reichel Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250616070536.670519-1-andyshrk@163.com commit df401fa1b80775109e2a52360fcb0b2b2300525a Author: Luca Weiss Date: Wed Jun 11 18:33:17 2025 +0200 drm/panel: Add driver for DJN HX83112B LCD panel Add support for the 2160x1080 LCD panel from DJN (98-03057-6598B-I) bundled with a HX83112B driver IC, as found on the Fairphone 3 smartphone. Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250611-fp3-display-v4-3-ef67701e7687@lucaweiss.eu commit 54bd1390e98450a2c1cad99da3e2594e92c41a4c Author: Luca Weiss Date: Wed Jun 11 18:33:16 2025 +0200 dt-bindings: display: panel: Add Himax HX83112B Himax HX83112B is a display driver IC used to drive LCD DSI panels. Describe it and the Fairphone 3 panel (98-03057-6598B-I) from DJN using it. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250611-fp3-display-v4-2-ef67701e7687@lucaweiss.eu commit 978a84297371ac33a15c56a7d31fd1b125427dac Author: Luca Weiss Date: Wed Jun 11 18:33:15 2025 +0200 dt-bindings: vendor-prefixes: document Shenzhen DJN Optronics Technology Add the vendor prefix for DJN (http://en.djnlcd.com/). Acked-by: Krzysztof Kozlowski Signed-off-by: Luca Weiss Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250611-fp3-display-v4-1-ef67701e7687@lucaweiss.eu commit 8285af82219639e08c655a4c957c50605b8acf85 Author: Philipp Stanner Date: Thu Jun 5 15:41:55 2025 +0200 drm/sched/tests: Make timedout_job callback a better role model Since the drm_mock_scheduler does not have real users in userspace, nor does it have real hardware or firmware rings, it's not necessary to signal timedout fences nor free jobs - from a functional standpoint. Still, the dma_fence framework establishes the hard rule that all fences must always get signaled. The unit tests, moreover, should as much as possible represent the intended usage of the scheduler API. Furthermore, this later enables simplifying the mock scheduler's teardown code path. Make sure timed out hardware fences get signaled with the appropriate error code. Signed-off-by: Philipp Stanner Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250605134154.191764-2-phasta@kernel.org commit 99e3eb454cc48b9f2691256780aeb247bdc0ee3d Author: Jakub Kicinski Date: Thu Jun 26 16:39:26 2025 -0700 net: ethtool: avoid OOB accesses in PAUSE_SET We now reuse .parse_request() from GET on SET, so we need to make sure that the policies for both cover the attributes used for .parse_request(). genetlink will only allocate space in info->attrs for ARRAY_SIZE(policy). Reported-by: syzbot+430f9f76633641a62217@syzkaller.appspotmail.com Fixes: 963781bdfe20 ("net: ethtool: call .parse_request for SET handlers") Reviewed-by: Ido Schimmel Tested-by: Ido Schimmel Link: https://patch.msgid.link/20250626233926.199801-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit bdad4aa48c15cacd63e94242ea99682e1b5be4d0 Author: Suraj Kandpal Date: Fri Jun 20 12:04:45 2025 +0530 drm/i915/backlight: Use drm_edp_backlight_enable Use drm dp helper to enable backlight now that it has been modified to set PANEL_LUMINANCE_CONTROL_ENABLE bit based on if capability supports it and the driver wants it. Remove the dead code. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-14-suraj.kandpal@intel.com commit aede23820254ae2831d37456b4b18c665297e152 Author: Suraj Kandpal Date: Fri Jun 20 12:04:44 2025 +0530 drm/i915/backlight: Use drm helper to set edp backlight Now that the drm helper sets the backlight using luminance too we can use that. Remove the obselete function. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-13-suraj.kandpal@intel.com commit e13af5166a359d9815acf5c9c375cc7ea67f7132 Author: Suraj Kandpal Date: Fri Jun 20 12:04:43 2025 +0530 drm/i915/backlight: Use drm helper to initialize edp backlight Now that drm_edp_backlight init has been modified to take into account the setup of lumininace based brightness manipulation we can just use that. --v2 -Fix commit message [Arun] Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-12-suraj.kandpal@intel.com commit ba02bf8e868a07163cd1518930181f849f37a752 Author: Suraj Kandpal Date: Fri Jun 20 12:04:42 2025 +0530 drm/dp: Enable backlight control using luminance Add flag to enable brightness control via luminance value when enabling edp backlight. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-11-suraj.kandpal@intel.com commit 05a76aef23df031bca3cdc5c46dd67922f3a15f2 Author: Suraj Kandpal Date: Fri Jun 20 12:04:41 2025 +0530 drm/dp: Change argument type of drm_edp_backlight_enable Change the argument type to u32 for the default level being sent since it has to now account for luminance value which has to be set for DP_EDP_PANEL_LUMINANCE_TARGET_VALUE. --v2 -No need to typecast [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-10-suraj.kandpal@intel.com commit f2db78e37fe7f95dde96abe2a2a8412f8f519658 Author: Suraj Kandpal Date: Fri Jun 20 12:04:40 2025 +0530 drm/dp: Modify drm_edp_backlight_set_level Modify drm_edp_backlight_set_level to be able to set the value for register in DP_EDP_PANEL_TARGET_LUMINANCE_VALUE. We multiply the level with 1000 since we get the value in Nits and the register accepts it in milliNits. --v2 -Add comment regarding the unit [Arun] Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-9-suraj.kandpal@intel.com commit 2ff7f0c381c15f457f83439bfdf5823fb33fb436 Author: Suraj Kandpal Date: Fri Jun 20 12:04:39 2025 +0530 drm/dp: Change argument type for drm_edp_backlight_set_level Use u32 for level variable as one may need to pass value for DP_EDP_PANEL_TARGET_LUMINANCE_VALUE. --v2 -Typecase is not needed [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-8-suraj.kandpal@intel.com commit c38da578a86e62b1d585bae107651079cfa457ca Author: Suraj Kandpal Date: Fri Jun 20 12:04:38 2025 +0530 drm/dp: Modify drm_edp_probe_state Modify drm_edp_probe_state to read current level from DP_EDP_PANEL_TARGET_LUMINANCE_VALUE. We divide it by 1000 since the value in this register is in millinits. --v2 -Add comment on the unit sent back [Arun] Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-7-suraj.kandpal@intel.com commit 9274a940f1c90c15fb66a8c5488b1b79e4e8c432 Author: Suraj Kandpal Date: Fri Jun 20 12:04:37 2025 +0530 drm/dp: Change current_level argument type to u32 Change the current_level argument type to u32 from u16 since it can now carry the value which it gets from DP_EDP_PANEL_TARGET_LUMINANCE_VALUE. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-6-suraj.kandpal@intel.com commit 08e81e2ded98d726db0dba39030ef59eb49d762c Author: Suraj Kandpal Date: Fri Jun 20 12:04:36 2025 +0530 drm/dp: Move from u16 to u32 for max in drm_edp_backlight_info Use u32 instead of u16 for max variable in drm_edp_backlight_info since it can now hold max luminance range value which is u32. We will set this max with max_luminance value when luminance_set is true. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-5-suraj.kandpal@intel.com commit 81fd01414f259ff897054c50750a25cbb0255060 Author: Suraj Kandpal Date: Fri Jun 20 12:04:35 2025 +0530 drm/dp: Add argument for max luminance in drm_edp_backlight_init Add new argument to drm_edp_backlight_init which gives the max_luminance which will be needed to set the max values for backlight. --v2 -Use pass only max luminance instead of luminance_range_info struct [Arun] Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-4-suraj.kandpal@intel.com commit c802a6b81b704bd969946f04f206a881f1abe2dd Author: Suraj Kandpal Date: Fri Jun 20 12:04:34 2025 +0530 drm/dp: Add argument in drm_edp_backlight_init Add bool argument in drm_edp_backlight init to provide the drivers option to choose if they want to use luminance values to manipulate brightness. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-3-suraj.kandpal@intel.com commit 2af612ad42903637b11f9ddf4101f231f1ec5d1d Author: Suraj Kandpal Date: Fri Jun 20 12:04:33 2025 +0530 drm/dp: Introduce new member in drm_backlight_info Introduce luminance_set flag which indicates if we can manipulate backlight using luminance value or not which is only possible after eDP v1.5. Signed-off-by: Suraj Kandpal Reviewed-by: Arun R Murthy Link: https://lore.kernel.org/r/20250620063445.3603086-2-suraj.kandpal@intel.com commit b9ab3b61824190b1c6b2c59e7ba4de591f24eb92 Author: Charles Keepax Date: Tue Jun 24 13:28:44 2025 +0100 ASoC: SDCA: Add some initial IRQ handlers Add basic IRQ handlers for the function status and jack detection interrupts. Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250624122844.2761627-8-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit b126394d9ec6f9d8322cf392ba23d4a5f96faf5a Author: Maciej Strozek Date: Tue Jun 24 13:28:43 2025 +0100 ASoC: SDCA: Generic interrupt support Add a library supporting usage of SDCA interrupts, using regmap irq framework. The library adds functions for parsing ACPI for interrupt-related information, configuring irq chip and requesting individual irqs. Calling code (SDCA function code) is expected to also substitute the library's base irq handler for its own, appropriate callback. Signed-off-by: Maciej Strozek Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250624122844.2761627-7-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 775f5729b47d8737f4f98e0141f61b3358245398 Author: Charles Keepax Date: Tue Jun 24 13:28:42 2025 +0100 ASoC: SDCA: Add flag for unused IRQs Zero is a valid SDCA IRQ interrupt position so add a special value to indicate that the IRQ is not used. Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250624122844.2761627-6-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 37d2aa62138daa8ecb6442ae4753704e9c92346f Author: Charles Keepax Date: Tue Jun 24 13:28:41 2025 +0100 ASoC: SDCA: Minor selected/detected mode control fixups Make the names a slightly better match for the specification and add some constants for the values rather than hard coding. Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250624122844.2761627-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit b4515fd87cc9a260ae89fb81ca2aa928d496ac86 Author: Charles Keepax Date: Tue Jun 24 13:28:40 2025 +0100 ASoC: SDCA: Fixup some kernel doc errors Correct some typos and omissions in the kernel doc for the ASoC SDCA code. Fixes: 2c8b3a8e6aa8 ("ASoC: SDCA: Create DAPM widgets and routes from DisCo") Reported-by: Bard Liao Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250624122844.2761627-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 2ed526bf04a6d81592b314f81e7719a14048f732 Author: Charles Keepax Date: Tue Jun 24 13:28:39 2025 +0100 ASoC: SDCA: Add missing default in switch in entity_pde_event() The current code should be safe as the PDE widget only registers for the two events handled in the switch statement. However, it is causing a smatch warning and also is a little fragile to future code changes, add a default case to avoid the warning and make the code more robust. Fixes: 2c8b3a8e6aa8 ("ASoC: SDCA: Create DAPM widgets and routes from DisCo") Reported-by: Dan Carpenter Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250624122844.2761627-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit 0383a710d28dd5dc43d26ccf9fc74e1ba41868fd Author: Charles Keepax Date: Tue Jun 24 13:28:38 2025 +0100 MAINTAINERS: Add SDCA maintainers entry Add a maintainers entry for the new SDCA support code. Reviewed-by: Bard Liao Signed-off-by: Charles Keepax Reviewed-by: Pierre-Louis Bossart Link: https://patch.msgid.link/20250624122844.2761627-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown commit c4f2c05ab02952c9a56067aeb700ded95b183570 Author: Antonio Quartulli Date: Mon Jun 30 10:12:53 2025 +0200 spi: stm32: fix pointer-to-pointer variables usage In stm32_spi_prepare_rx_dma_mdma_chaining() both rx_dma_desc and rx_mdma_desc are passed as pointer-to-pointer arguments. The goal is to pass back to the caller the value returned by dmaengine_prep_slave_sg(), when it is not NULL. However, these variables are wrongly handled as simple pointers during later assignments and checks. Fix this behaviour by introducing two pointer variables which can then be treated accordingly. Fixes: d17dd2f1d8a1 ("spi: stm32: use STM32 DMA with STM32 MDMA to enhance DDR use") Addresses-Coverity-ID: 1644715 ("Null pointer dereferences (REVERSE_INULL)") Signed-off-by: Antonio Quartulli Reviewed-by: Clement LE GOFFIC Link: https://patch.msgid.link/20250630081253.17294-1-antonio@mandelbit.com Signed-off-by: Mark Brown commit f4d8438e6a402ad40cf4ccb6e2d2417d9ed47821 Author: Clément Le Goffic Date: Mon Jun 30 14:59:23 2025 +0200 spi: stm32: fix sram pool free in probe error path Add a test to check whether the sram_pool is NULL before freeing it. Fixes: d17dd2f1d8a1 ("spi: stm32: use STM32 DMA with STM32 MDMA to enhance DDR use") Reported-by: Dan Carpenter Acked-by: Alain Volmat Signed-off-by: Clément Le Goffic Link: https://patch.msgid.link/20250630-spi-fix-v2-1-4680939e2a3e@foss.st.com Signed-off-by: Mark Brown commit 6e11952a6abc4641dc8ae63f01b318b31b44e8db Author: Mikulas Patocka Date: Mon Jun 30 15:24:22 2025 +0200 dm-mpath: don't print the "loaded" message if registering fails If dm_register_path_selector, don't print the "version X loaded" message. Signed-off-by: Mikulas Patocka commit f86272350f38d3fa4049944257a1b4260f3eba2e Author: Mikulas Patocka Date: Mon Jun 30 15:23:03 2025 +0200 dm-mpath: make dm_unregister_path_selector return void dm_unregister_path_selector may only return error if there's a bug in the code - so we make it return void and print a warning if the user abuses this function to unregister a target that was not registered. Signed-off-by: Mikulas Patocka commit 7481a97c5f49f10c7490bb990d0e863f23b9bb71 Author: Jisheng Zhang Date: Sun Jun 29 17:46:55 2025 +0800 usb: dwc2: disable platform lowlevel hw resources during shutdown On some SoC platforms, in shutdown stage, most components' power is cut off, but there's still power supply to the so called always-on domain, so if the dwc2's regulator is from the always-on domain, we need to explicitly disable it to save power. Disable platform lowlevel hw resources such as phy, clock and regulators etc. in device shutdown hook to reduce non-necessary power consumption when the platform enters shutdown stage. Signed-off-by: Jisheng Zhang Acked-by: Minas Harutyunyan Link: https://lore.kernel.org/r/20250629094655.747-1-jszhang@kernel.org Signed-off-by: Greg Kroah-Hartman commit f63f7aec0057fd187a1212a5828560c3d9fcc739 Author: Jens Glathe Date: Sun Jun 29 19:25:23 2025 +0200 usb: misc: onboard_usb_dev: Add Bison Electronics Inc. Integrated Camera The Camera is built into the Thinkbook 16 G7 QOY and directly attached on the usb_2 controller (dwc3 USB2 only). It has a separate power supply that needs to be controlled for PM. Add the support for this device for the power supply. Reviewed-by: Dmitry Baryshkov Signed-off-by: Jens Glathe Link: https://lore.kernel.org/r/20250629-tb16-dt-v7-2-35276341338f@oldschoolsolutions.biz Signed-off-by: Greg Kroah-Hartman commit 0cb39c9738903c2b69bddb5b767f0eae0213c1d5 Author: Heiko Carstens Date: Tue Jun 24 16:34:35 2025 +0200 s390/smp: Remove conditional emergency signal order code usage pcpu_ec_call() uses either the external call or emergency signal order code to signal (aka send an IPI) to a remote CPU. If the remote CPU is not running the emergency signal order is used. Measurements show that always using the external order code is at least as good, and sometimes even better, than the existing code. Therefore remove emergency signal order code usage from pcpu_ec_call(). Suggested-by: Christian Borntraeger Acked-by: Christian Borntraeger Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 66b338d006d75ab52b16bf05a7f4f451043199bf Author: Thorsten Blum Date: Mon Jun 30 13:09:44 2025 +0200 ALSA: dummy: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250630110945.2225-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 24ffcf7f27cf75389ca550a18f9e45a8dad27bd2 Author: Thorsten Blum Date: Mon Jun 30 12:57:22 2025 +0200 ALSA: hrtimer: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250630105723.1703-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 90c8c31e19d4fe659dc38e537f241e79266ff478 Author: Thorsten Blum Date: Mon Jun 30 12:54:18 2025 +0200 ALSA: timer: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250630105420.1448-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 026a60e3c1c55845bd9fdaa202dad81c3f95ae6b Author: Christian König Date: Fri Jun 13 17:29:34 2025 +0200 drm/vmwgfx: drop printing the TTM refcount for debugging That is something TTM internal which is about to get dropped. Signed-off-by: Christian König Reviewed-by: Ian Forbes Link: https://lore.kernel.org/r/20250616130726.22863-1-christian.koenig@amd.com commit cc43422b3cc79eacff4c5a8ba0d224688ca9dd4f Author: Janusz Krzysztofik Date: Wed Jun 11 12:42:13 2025 +0200 drm/i915/gt: Fix timeline left held on VMA alloc error The following error has been reported sporadically by CI when a test unbinds the i915 driver on a ring submission platform: <4> [239.330153] ------------[ cut here ]------------ <4> [239.330166] i915 0000:00:02.0: [drm] drm_WARN_ON(dev_priv->mm.shrink_count) <4> [239.330196] WARNING: CPU: 1 PID: 18570 at drivers/gpu/drm/i915/i915_gem.c:1309 i915_gem_cleanup_early+0x13e/0x150 [i915] ... <4> [239.330640] RIP: 0010:i915_gem_cleanup_early+0x13e/0x150 [i915] ... <4> [239.330942] Call Trace: <4> [239.330944] <4> [239.330949] i915_driver_late_release+0x2b/0xa0 [i915] <4> [239.331202] i915_driver_release+0x86/0xa0 [i915] <4> [239.331482] devm_drm_dev_init_release+0x61/0x90 <4> [239.331494] devm_action_release+0x15/0x30 <4> [239.331504] release_nodes+0x3d/0x120 <4> [239.331517] devres_release_all+0x96/0xd0 <4> [239.331533] device_unbind_cleanup+0x12/0x80 <4> [239.331543] device_release_driver_internal+0x23a/0x280 <4> [239.331550] ? bus_find_device+0xa5/0xe0 <4> [239.331563] device_driver_detach+0x14/0x20 ... <4> [357.719679] ---[ end trace 0000000000000000 ]--- If the test also unloads the i915 module then that's followed with: <3> [357.787478] ============================================================================= <3> [357.788006] BUG i915_vma (Tainted: G U W N ): Objects remaining on __kmem_cache_shutdown() <3> [357.788031] ----------------------------------------------------------------------------- <3> [357.788204] Object 0xffff888109e7f480 @offset=29824 <3> [357.788670] Allocated in i915_vma_instance+0xee/0xc10 [i915] age=292729 cpu=4 pid=2244 <4> [357.788994] i915_vma_instance+0xee/0xc10 [i915] <4> [357.789290] init_status_page+0x7b/0x420 [i915] <4> [357.789532] intel_engines_init+0x1d8/0x980 [i915] <4> [357.789772] intel_gt_init+0x175/0x450 [i915] <4> [357.790014] i915_gem_init+0x113/0x340 [i915] <4> [357.790281] i915_driver_probe+0x847/0xed0 [i915] <4> [357.790504] i915_pci_probe+0xe6/0x220 [i915] ... Closer analysis of CI results history has revealed a dependency of the error on a few IGT tests, namely: - igt@api_intel_allocator@fork-simple-stress-signal, - igt@api_intel_allocator@two-level-inception-interruptible, - igt@gem_linear_blits@interruptible, - igt@prime_mmap_coherency@ioctl-errors, which invisibly trigger the issue, then exhibited with first driver unbind attempt. All of the above tests perform actions which are actively interrupted with signals. Further debugging has allowed to narrow that scope down to DRM_IOCTL_I915_GEM_EXECBUFFER2, and ring_context_alloc(), specific to ring submission, in particular. If successful then that function, or its execlists or GuC submission equivalent, is supposed to be called only once per GEM context engine, followed by raise of a flag that prevents the function from being called again. The function is expected to unwind its internal errors itself, so it may be safely called once more after it returns an error. In case of ring submission, the function first gets a reference to the engine's legacy timeline and then allocates a VMA. If the VMA allocation fails, e.g. when i915_vma_instance() called from inside is interrupted with a signal, then ring_context_alloc() fails, leaving the timeline held referenced. On next I915_GEM_EXECBUFFER2 IOCTL, another reference to the timeline is got, and only that last one is put on successful completion. As a consequence, the legacy timeline, with its underlying engine status page's VMA object, is still held and not released on driver unbind. Get the legacy timeline only after successful allocation of the context engine's VMA. v2: Add a note on other submission methods (Krzysztof Karas): Both execlists and GuC submission use lrc_alloc() which seems free from a similar issue. Fixes: 75d0a7f31eec ("drm/i915: Lift timeline into intel_context") Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/12061 Cc: Chris Wilson Cc: Matthew Auld Cc: Krzysztof Karas Reviewed-by: Sebastian Brzezinka Reviewed-by: Krzysztof Niemiec Signed-off-by: Janusz Krzysztofik Reviewed-by: Nitin Gote Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250611104352.1014011-2-janusz.krzysztofik@linux.intel.com commit d4b29ddf82a458935f1bd4909b8a7a13df9d3bdc Author: FUJITA Tomonori Date: Tue Jun 17 23:41:55 2025 +0900 rust: time: Add wrapper for fsleep() function Add a wrapper for fsleep(), flexible sleep functions in include/linux/delay.h which typically deals with hardware delays. The kernel supports several sleep functions to handle various lengths of delay. This adds fsleep(), automatically chooses the best sleep method based on a duration. fsleep() can only be used in a nonatomic context. This requirement is not checked by these abstractions, but it is intended that klint [1] or a similar tool will be used to check it in the future. Link: https://rust-for-linux.com/klint [1] Reviewed-by: Gary Guo Reviewed-by: Alice Ryhl Reviewed-by: Fiona Behrens Tested-by: Daniel Almeida Reviewed-by: Andreas Hindborg Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250617144155.3903431-3-fujita.tomonori@gmail.com Signed-off-by: Andreas Hindborg commit 7e1c28fbf235791cb5046fafdac5bc16fe8e788d Author: Thangaraj Samynathan Date: Mon Jun 30 13:02:33 2025 +0530 spi: spi-pci1xxxx: enable concurrent DMA read/write across SPI transfers Refactor the pci1xxxx SPI driver to allow overlapping DMA read and write operations across SPI transfers. This improves throughput and reduces idle time between SPI transactions. Transfer sequence: - Start with a DMA read to load TX data from host to device buffer. - After DMA read completes, trigger the SPI transfer. - On SPI completion: - Start DMA write to copy received data from RX buffer to host. - Start the next DMA read to prepare TX data for the following transfer. - Begin the next SPI transfer after both DMA write and read complete. To implement this sequence, the following changes were made: - Added dma_completion_count to track and synchronize DMA completions. - Split DMA setup into separate functions for TX (read) and RX (write). - Introduced separate spinlocks for safe access to RD and WR DMA registers. This new flow enables efficient pipelining by overlapping data preparation and completion stages, leading to better SPI transfer performance and utilization of DMA engines. Signed-off-by: Thangaraj Samynathan Link: https://patch.msgid.link/20250630073233.7356-1-thangaraj.s@microchip.com Signed-off-by: Mark Brown commit 427ceac823e58813b510e585011488f603f0d891 Author: Jisheng Zhang Date: Sun Jun 29 17:51:07 2025 +0800 regulator: tps6286x-regulator: Enable REGCACHE_MAPLE Enable regmap cache to reduce i2c transactions and corresponding interrupts if regulator is accessed frequently. Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20250629095107.804-1-jszhang@kernel.org Signed-off-by: Mark Brown commit b402dfe84057e376b39c8adadeb65ad51aaffeb4 Author: Jisheng Zhang Date: Sun Jun 29 17:58:22 2025 +0800 regulator: tps6287x-regulator: Enable REGCACHE_MAPLE Enable regmap cache to reduce i2c transactions and corresponding interrupts if regulator is accessed frequently. Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20250629095822.868-1-jszhang@kernel.org Signed-off-by: Mark Brown commit bd7c7976f9716da4cc961ab8ff4e17811d522602 Author: Jisheng Zhang Date: Sun Jun 29 17:48:03 2025 +0800 regulator: rt5739: Enable REGCACHE_MAPLE Enable regmap cache to reduce i2c transactions and corresponding interrupts if regulator is accessed frequently. Signed-off-by: Jisheng Zhang Link: https://patch.msgid.link/20250629094803.776-1-jszhang@kernel.org Signed-off-by: Mark Brown commit fc38b7ff879683669bd9ff5dc7e7b6aeeb07bf2a Author: FUJITA Tomonori Date: Wed Jun 18 08:28:06 2025 +0900 rust: time: Seal the HrTimerMode trait Prevent downstream crates or drivers from implementing `HrTimerMode` for arbitrary types, which could otherwise leads to unsupported behavior. Introduce a `private::Sealed` trait and implement it for all types that implement `HrTimerMode`. Signed-off-by: FUJITA Tomonori Reviewed-by: Boqun Feng Link: https://lore.kernel.org/r/20250617232806.3950141-1-fujita.tomonori@gmail.com Signed-off-by: Andreas Hindborg commit be91bf40a96d567973d5c5e870d1464eb51b6c42 Author: Hans de Goede Date: Mon Jun 9 12:46:20 2025 +0200 platform/x86: x86-android-tablets: Add ovc-capacity-table info Add ovc-capacity-table info to the generic battery nodes. The values come from the ug3105 driver which currently hardcodes these values. The ug3105 driver will be modified to stop hardcoding this and instead get the values from device-properties. Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250609104620.25896-2-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit a8fc1224f2318d3e5948671d1cad458e6372d921 Author: Hans de Goede Date: Mon Jun 9 12:46:19 2025 +0200 platform/x86: x86-android-tablets: Add generic_lipo_4v2_battery info Move the asus_tf103c_battery_node to shared-psy-info.c and rename it to generic_lipo_4v2_battery_node. This is a preparation patch for adding ovc-capacity-table info to the battery nodes. Reviewed-by: Andy Shevchenko Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250609104620.25896-1-hansg@kernel.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6e3071f4e03997ca0e4388ca61aa06df2802dcd1 Author: Jonas Karlman Date: Sat Jun 21 16:58:30 2025 +0000 arm64: dts: rockchip: Enable eMMC HS200 mode on Radxa E20C eMMC HS200 mode (1.8V I/O) is supported by the MMC host controller on RK3528 and works with the optional on-board eMMC module on Radxa E20C. Be explicit about HS200 support in the device tree for Radxa E20C. Fixes: 3a01b5f14a8a ("arm64: dts: rockchip: Enable onboard eMMC on Radxa E20C") Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20250621165832.2226160-1-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 84fb79b8acca836898c5ebcfb1603c224a2c0f7b Author: Jianfeng Liu Date: Sat Jun 21 21:53:14 2025 +0800 arm64: dts: rockchip: Add bluetooth support to ArmSoM Sige7 ArmSoM Sige7 has onboard AP6275P Wi-Fi6 (PCIe) and BT5 (UART) module which is similar with Khadas Edge2. This commit enables bluetooth at uart6. Signed-off-by: Jianfeng Liu Link: https://lore.kernel.org/r/20250621135319.61766-1-liujianfeng1994@gmail.com Signed-off-by: Heiko Stuebner commit 29ff4bbff793334d6aff2238fdc3ccf3859d60da Author: Nicolas Frattaroli Date: Sat Jun 21 16:37:55 2025 +0200 arm64: dts: rockchip: enable PCIe on ROCK 4D The RADXA ROCK 4D board has a PCIe controller connected to a flat flex connector, compatible with the one the RPi5 uses. Enable the associated combphy and pcie controller node, as well as add the remaining pinctrl definition for the reset. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250621-rk3576-rock4d-pcie-v1-1-2b33c9f12955@collabora.com Signed-off-by: Heiko Stuebner commit f9f45293f0d8bdc5e2d0d255cafa0acdb2c94616 Author: Valentin Hăloiu Date: Sun Jun 22 19:58:12 2025 +0100 arm64: dts: rockchip: Enable HDMI receiver on CM3588 Enable support for the HDMI input port found on FriendlyElec CM3588 and CM3588 Plus. Signed-off-by: Valentin Hăloiu Link: https://lore.kernel.org/r/20250622185814.35031-1-valentin.haloiu@gmail.com Signed-off-by: Heiko Stuebner commit 4ab8b8ac952fb08d03655e1da0cfee07589e428f Author: Cristian Ciocaltea Date: Thu Jun 12 00:47:49 2025 +0300 arm64: dts: rockchip: Add HDMI PHY PLL clock source to VOP2 on rk3576 Since commit c871a311edf0 ("phy: rockchip: samsung-hdptx: Setup TMDS char rate via phy_configure_opts_hdmi"), the workaround of passing the rate from DW HDMI QP bridge driver via phy_set_bus_width() became partially broken, as it cannot reliably handle mode switches anymore. Attempting to fix this up at PHY level would not only introduce additional hacks, but it would also fail to adequately resolve the display issues that are a consequence of the system CRU limitations. Instead, proceed with the solution already implemented for RK3588: make use of the HDMI PHY PLL as a better suited DCLK source for VOP2. This will not only address the aforementioned problem, but it should also facilitate the proper operation of display modes up to 4K@60Hz. It's worth noting that anything above 4K@30Hz still requires high TMDS clock ratio and scrambling support, which hasn't been mainlined yet. Fixes: d74b842cab08 ("arm64: dts: rockchip: Add vop for rk3576") Cc: stable@vger.kernel.org Signed-off-by: Cristian Ciocaltea Tested-By: Detlev Casanova Tested-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250612-rk3576-hdmitx-fix-v1-3-4b11007d8675@collabora.com Signed-off-by: Heiko Stuebner commit aba7987a536cee67fb0cb724099096fd8f8f5350 Author: Cristian Ciocaltea Date: Thu Jun 12 00:47:48 2025 +0300 arm64: dts: rockchip: Enable HDMI PHY clk provider on rk3576 As with the RK3588 SoC, the HDMI PHY PLL on RK3576 can be used as a more accurate pixel clock source for VOP2, which is actually mandatory to ensure proper support for display modes handling. Add the missing #clock-cells property to allow using the clock provider functionality of HDMI PHY. Fixes: ad0ea230ab2a ("arm64: dts: rockchip: Add hdmi for rk3576") Cc: stable@vger.kernel.org Signed-off-by: Cristian Ciocaltea Tested-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250612-rk3576-hdmitx-fix-v1-2-4b11007d8675@collabora.com Signed-off-by: Heiko Stuebner commit 7012d4f3c7a82008113974108bf0c9c0553b424a Author: Fushuai Wang Date: Thu Jun 26 13:30:03 2025 +0800 net/mlx5e: Fix error handling in RQ memory model registration Currently when xdp_rxq_info_reg_mem_model() fails in the XSK path, the error handling incorrectly jumps to err_destroy_page_pool. While this may not cause errors, we should make it jump to the correct location. Signed-off-by: Fushuai Wang Reviewed-by: Zhu Yanjun Acked-by: Dragos Tatulea Signed-off-by: David S. Miller commit 3832dc42aed9b047ccecebf5917d008bd2dac940 Author: Cristian Ciocaltea Date: Thu Jun 12 00:47:47 2025 +0300 dt-bindings: display: vop2: Add optional PLL clock property for rk3576 As with the RK3588 SoC, RK3576 also allows the use of HDMI PHY PLL as an alternative and more accurate pixel clock source for VOP2. Document the optional PLL clock property. Moreover, given that this is part of a series intended to address some recent display problems, provide the appropriate tags to facilitate backporting. Fixes: c3b7c5a4d7c1 ("dt-bindings: display: vop2: Add rk3576 support") Cc: stable@vger.kernel.org Signed-off-by: Cristian Ciocaltea Reviewed-by: "Rob Herring (Arm)" Tested-by: Nicolas Frattaroli Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250612-rk3576-hdmitx-fix-v1-1-4b11007d8675@collabora.com commit 328d4a7eb07389157fca1c282ecae63406a2c293 Author: Jerome Brunet Date: Mon Jun 23 16:37:00 2025 +0200 clk: amlogic: remove unnecessary headers Some Amlogic clock controller drivers have a dedicated headers file, some do not. Over time, these headers have evolved and now only carry register offset definitions. These offsets are only used by the related controller and are not meant to be shared. These headers are not serving any purpose now. Start enforcing some consistency between the different Amlogic clock drivers and move the register offset definitions to the related driver. Link: https://lore.kernel.org/r/20250623-clk-meson-no-headers-v1-1-468161a7279e@baylibre.com [jbrunet: checkpatch strict: removed extra blank line] Signed-off-by: Jerome Brunet commit edc4a9d1dc1669e42a35b2bd1b711a5da0e83699 Author: Nicolas Frattaroli Date: Thu Jun 26 22:41:18 2025 +0200 arm64: defconfig: enable further Rockchip platform drivers Enable the rockchip-dfi driver as a module, which is used on RK3588 as well as RK3568 and RK3399 to measure memory bandwidth. For this, we also enable PM_DEVFREQ_EVENT, which is a requirement for this driver. Also enable the rockchip-rga driver as a module, which is used on various Rockchip SoCs, including RK3588 and RK3399, to provide 2d accelerated image transformations through a V4L2 interface. Suggested-by: Nícolas F. R. A. Prado Signed-off-by: Nicolas Frattaroli Reviewed-by: Nícolas F. R. A. Prado Link: https://lore.kernel.org/r/20250626-rk3588-defconfig-v2-1-ae6720964b01@collabora.com Signed-off-by: Heiko Stuebner commit d5bafb1c294cf99cc5991f7fdecc79898f9b8d0e Author: Ankit Nautiyal Date: Wed Jun 11 11:00:39 2025 +0530 drm/i915/display: Fix macro HAS_ULTRAJOINER Currently, Ultrajoiner is supported only on Xe2_HPD. Update the HAS_ULTRAJOINER macro to reflect the same. v2: Clarify the commit message to specify platform. (Jani) Bspec: 69556 Signed-off-by: Ankit Nautiyal Reviewed-by: Karthik B S Link: https://lore.kernel.org/r/20250611053039.377695-1-ankit.k.nautiyal@intel.com commit 07d59dec6795428983a840de85aa02febaf7e01b Author: Konrad Dybcio Date: Wed Jun 25 17:55:43 2025 +0200 power: sequencing: qcom-wcn: fix bluetooth-wifi copypasta for WCN6855 Prevent a name conflict (which is surprisingly not caught by the framework). Fixes: bd4c8bafcf50 ("power: sequencing: qcom-wcn: improve support for wcn6855") Signed-off-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250625-topic-wcn6855_pwrseq-v1-1-cfb96d599ff8@oss.qualcomm.com Signed-off-by: Bartosz Golaszewski commit 385b735c90ae44dbde65fab76e356a96ff8f67be Author: Bartosz Golaszewski Date: Tue Jun 24 16:32:22 2025 +0200 power: sequencing: thead-gpu: use new defines for match() return values Replace the magic numbers with proper defines we now have in the header. Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20250624-pwrseq-match-defines-v1-5-a59d90a951f1@linaro.org Signed-off-by: Bartosz Golaszewski commit f698155029efc708349126c8944fa8c95b28098c Author: Bartosz Golaszewski Date: Tue Jun 24 16:32:21 2025 +0200 power: sequencing: qcom-wcn: use new defines for match() return values Replace the magic numbers with proper defines we now have in the header. Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20250624-pwrseq-match-defines-v1-4-a59d90a951f1@linaro.org Signed-off-by: Bartosz Golaszewski commit 62b5848f73dd4f8ae17304dae54562d0c9ecdd3d Author: Bartosz Golaszewski Date: Tue Jun 24 16:32:20 2025 +0200 power: sequencing: add defines for return values of the match() callback Instead of using 0 and 1 as magic numbers, let's add proper defines whose names tell the reader what the meaning behind them is. Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20250624-pwrseq-match-defines-v1-3-a59d90a951f1@linaro.org Signed-off-by: Bartosz Golaszewski commit 1a7312b93ab023f68b48a1550049a4f850c2c808 Author: Bartosz Golaszewski Date: Tue Jun 24 16:32:19 2025 +0200 power: sequencing: extend build coverage with COMPILE_TEST=y Enable building the pwrseq drivers with COMPILE_TEST enabled. This makes it easier to build-test them. Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20250624-pwrseq-match-defines-v1-2-a59d90a951f1@linaro.org Signed-off-by: Bartosz Golaszewski commit 35392e855abf7d02ad3b061cbc75c7c7c37f0577 Author: Laurent Pinchart Date: Thu Jun 19 23:47:12 2025 +0300 media: i2c: max96714: Drop check on number of active routes The subdev core now limits the number of active routes to V4L2_FRAME_DESC_ENTRY_MAX. Drop the duplicated check in the max96714 driver. Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Reviewed-by: Tomi Valkeinen Reviewed-by: Lad Prabhakar Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 137000ce88757781f5604c5dd7076f09e47e9708 Author: Laurent Pinchart Date: Thu Jun 19 23:47:11 2025 +0300 media: i2c: ds90ub960: Drop check on number of active routes The subdev core now limits the number of active routes to V4L2_FRAME_DESC_ENTRY_MAX. Drop the duplicated check in the ds90ub960 driver. Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Reviewed-by: Tomi Valkeinen Reviewed-by: Lad Prabhakar Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit a3e3fcff07c54ee938a98fb7a311bb4eea6ae1c9 Author: Laurent Pinchart Date: Thu Jun 19 23:47:10 2025 +0300 media: i2c: ds90ub953: Drop check on number of active routes The subdev core now limits the number of active routes to V4L2_FRAME_DESC_ENTRY_MAX. Drop the duplicated check in the ds90ub953 driver. Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Reviewed-by: Tomi Valkeinen Reviewed-by: Lad Prabhakar Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 5fe204033d9d7add4fc125c14ae230befcc17dd7 Author: Laurent Pinchart Date: Thu Jun 19 23:47:09 2025 +0300 media: i2c: ds90ub913: Drop check on number of active routes The subdev core now limits the number of active routes to V4L2_FRAME_DESC_ENTRY_MAX. Drop the duplicated check in the ds90ub913 driver. Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Reviewed-by: Tomi Valkeinen Reviewed-by: Lad Prabhakar Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 43f661a77c3ff117530d90e2e714570f3b4ae2b3 Author: Laurent Pinchart Date: Thu Jun 19 23:47:08 2025 +0300 media: v4l2-subdev: Limit the number of active routes to V4L2_FRAME_DESC_ENTRY_MAX Drivers that implement routing need to report a frame descriptor accordingly, with up to one entry per route. The number of frame descriptor entries is fixed to V4L2_FRAME_DESC_ENTRY_MAX, currently equal to 8. Multiple drivers therefore limit the number of routes to V4L2_FRAME_DESC_ENTRY_MAX, with a note indicating that the limit should be lifted when frame descriptor entries will be allocated dynamically. Duplicating the check in multiple drivers isn't ideal. Move it to the VIDIOC_SUBDEV_S_ROUTING handling code in the v4l2-subdev core. Signed-off-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Reviewed-by: Tomi Valkeinen Reviewed-by: Lad Prabhakar Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 3062098a2224a0e90b8a20f7b40063ab7ffd5b19 Author: Benjamin Mugnier Date: Wed Jun 11 10:48:33 2025 +0200 media: i2c: vd55g1: Use first index of mbus codes array as default Factorize code and prevent future errors in case of media bus codes change. Rename VD55G1_DEFAULT_MODE to VD55G1_MODE_DEF to mimic other macros and reduce vd55g1_update_img_pad_format() name to vd55g1_update_pad_fmt() to stay within the 80 characters limit. Signed-off-by: Benjamin Mugnier Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit df2f8fd91bde57d5d5aca6adddf7e988f2e8c60e Author: Benjamin Mugnier Date: Wed Jun 11 10:48:32 2025 +0200 media: i2c: vd55g1: Setup sensor external clock before patching Proper clock configuration is required to advance through FSM states. Prior than this having a different clock value than default sensor's value was used (12 MHz) could prevent the sensor from booting. Signed-off-by: Benjamin Mugnier Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 5931eed35cb632ff8b7e0b0cc91abc6014c64045 Author: Benjamin Mugnier Date: Wed Jun 11 10:48:31 2025 +0200 media: i2c: vd55g1: Fix return code in vd55g1_enable_streams error path Enable stream was returning success even if an error occurred, fix it by modifying the err_rpm_put return value to -EINVAL. Signed-off-by: Benjamin Mugnier Fixes: e56616d7b23c ("media: i2c: Add driver for ST VD55G1 camera sensor") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 5b69a84005b686365e9cacb2ca942271ed74867a Author: Benjamin Mugnier Date: Wed Jun 11 10:48:30 2025 +0200 media: i2c: vd55g1: Fix RATE macros not being expressed in bps As a bit rate is expressed in bps, use MEGA instead of HZ_PER_MHZ. Signed-off-by: Benjamin Mugnier Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 03dca1842421b068d6a65b8ae16e2191882c7753 Author: Matthias Fend Date: Thu Jun 12 08:54:12 2025 +0200 media: dw9714: add support for powerdown pin Add support for the powerdown pin (xSD), which can be used to put the VCM driver into power down mode. This is useful, for example, if the VCM driver's power supply cannot be controlled. The use of the powerdown pin is optional. Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 1eefe42e9de503e422a9c925eebdbd215ee28966 Author: Matthias Fend Date: Thu Jun 12 08:54:11 2025 +0200 media: dw9714: move power sequences to dedicated functions Move the power-up and power-down sequences to their own functions. This is a preparation for the upcoming powerdown pin support. Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit feec4b07c820f322c6b5b6b52b8ef2ca4cc05ad2 Author: Matthias Fend Date: Thu Jun 12 08:54:10 2025 +0200 media: dw9714: coding style fixes Just some minor coding style fixes reported by checkpatch. Signed-off-by: Matthias Fend Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 9316e398e2e93b67f6adc9b0e78771580767bd0c Author: Hans de Goede Date: Mon Jun 23 13:00:35 2025 +0200 media: ipu-bridge: Improve error logging when waiting for IVSC to become ready The ipu-bridge code waits for the IVSC to become ready (on platforms with an IVSC chip). It does this by returning -EPROBE_DEFER, but it does not use dev_err_probe() so no reason for deferring gets registered. After 30 seconds the kernel logs a warning that the probe is still deferred, which looks like this: [ 33.951709] pci 0000:00:14.3: deferred probe pending: (reason unknown) Use dev_err_probe() when returning -EPROBE_DEFER to register the probe deferral reason changing the error to: deferred probe pending: waiting for IVSC to become ready to help with debugging why drivers are not binding if the iVSC does not become ready for some reason. Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit fabb0595b58f8c288017816eee5fe8aed4a4dfef Author: Hans de Goede Date: Mon Jun 23 13:00:34 2025 +0200 media: ov8865: Improve error logging when fwnode is not found The ov8865 driver waits for the endpoint fwnode to show up in case this fwnode is created by a bridge-driver. It does this by returning -EPROBE_DEFER, but it does not use dev_err_probe() so no reason for deferring gets registered. After 30 seconds the kernel logs a warning that the probe is still deferred, which looks like this: [ 33.952061] i2c i2c-INT347A:00: deferred probe pending: (reason unknown) Use dev_err_probe() when returning -EPROBE_DEFER to register the probe deferral reason changing the error to: deferred probe pending: waiting for fwnode graph endpoint Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 826f6fd67691861b3dc2cbbd1ea7c8bbb5bfe1b2 Author: Hans de Goede Date: Mon Jun 23 13:00:33 2025 +0200 media: ov7251: Improve error logging when fwnode is not found The ov7251 driver waits for the endpoint fwnode to show up in case this fwnode is created by a bridge-driver. It does this by returning -EPROBE_DEFER, but it does not use dev_err_probe() so no reason for deferring gets registered. After 30 seconds the kernel logs a warning that the probe is still deferred, which looks like this: [ 33.952052] i2c i2c-INT347E:00: deferred probe pending: (reason unknown) Use dev_err_probe() when returning -EPROBE_DEFER to register the probe deferral reason changing the error to: deferred probe pending: waiting for fwnode graph endpoint Also update the comment to not refer to the no longer existing cio2-bridge code. Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 76f0c8244692b49bf80abe66b678e04f62b9900a Author: Hans de Goede Date: Mon Jun 23 13:00:32 2025 +0200 media: ov5693: Improve error logging when fwnode is not found The ov5693 driver waits for the endpoint fwnode to show up in case this fwnode is created by a bridge-driver. It does this by returning -EPROBE_DEFER, but it does not use dev_err_probe() so no reason for deferring gets registered. After 30 seconds the kernel logs a warning that the probe is still deferred, which looks like this: [ 33.951709] i2c i2c-INT33BE:00: deferred probe pending: (reason unknown) Use dev_err_probe() when returning -EPROBE_DEFER to register the probe deferral reason changing the error to: deferred probe pending: waiting for fwnode graph endpoint Also update the comment to not refer to the no longer existing cio2-bridge code. Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2371517601aa2b7189a10236328dff0993b0294f Author: Hanne-Lotta Mäenpää Date: Thu Jun 12 20:27:03 2025 +0300 media: Documentation: Improve grammar, formatting in Video4Linux Fix typos, punctuation and improve grammar and formatting in documentation for Video4Linux (V4L). Signed-off-by: Hanne-Lotta Mäenpää Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit dd8bb4a2ecd3bb2a5a64cb58a6ff5c4d9c400c46 Author: Hans de Goede Date: Mon Jun 23 13:09:51 2025 +0200 media: ipu-bridge: Add Onsemi MT9M114 HID to list of supported sensors Add INT33F0 ACPI HID for the Onsemi MT9M114 sensor to the list of supported sensors. This sensor is found on the Asus T100TA using this HID. Tested-by: Hans de Goede # Asus T100TA with MT9M114 Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 29d77da94173e7a828caeedecef93c5365c6fddc Author: Hans de Goede Date: Mon Jun 23 13:09:50 2025 +0200 media: ipu-bridge: Add Toshiba T4KA3 HID to list of supported sensor The Xiaomi Mi Pad 2 tablet uses a Toshiba T4KA3 sensor, using a Xiaomi specific Hardware-ID of "XMMC0003" add this to the sensor-list of the ipu-bridge code. Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit ea200a16d6c7dbfd37d5761078d2453c038a37f1 Author: Sakari Ailus Date: Wed Mar 27 13:17:33 2024 +0200 media: ov2740: Remove shorthand variables Remove two variables in ov2740_init_control() that are used as a shorthand for where the information is really located. Make the code more readable by removing them. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Reviewed-by: Jacopo Mondi Signed-off-by: Hans Verkuil commit 5bcfc4ef40dabcd16a0b736fea7f0d00a9efdbfb Author: Bartosz Golaszewski Date: Tue Jun 24 16:32:18 2025 +0200 power: sequencing: thead-gpu: add missing header When using kcalloc(), kfree() etc., we need to include linux/slab.h. While on some architectures it may work fine because the header is pulled in implicitly, on others it triggers the following errors: drivers/power/sequencing/pwrseq-thead-gpu.c: In function ‘pwrseq_thead_gpu_match’: drivers/power/sequencing/pwrseq-thead-gpu.c:147:21: error: implicit declaration of function ‘kcalloc’ [-Wimplicit-function-declaration] 147 | ctx->clks = kcalloc(ctx->num_clks, sizeof(*ctx->clks), GFP_KERNEL); Fixes: d4c2d9b5b7ce ("power: sequencing: Add T-HEAD TH1520 GPU power sequencer driver") Reviewed-by: Ulf Hansson Link: https://lore.kernel.org/r/20250624-pwrseq-match-defines-v1-1-a59d90a951f1@linaro.org Signed-off-by: Bartosz Golaszewski commit 26981e8906bb5c902e2d34874f64ecfa975d28c8 Author: Bartosz Golaszewski Date: Fri Jun 20 14:58:02 2025 +0200 gpio: make gpiod_is_equal() arguments stricter It makes no sense for a GPIO descriptor comparator to return true when the arguments passed to it are NULL or IS_ERR(). Let's validate both and return false unless both are valid GPIO descriptors. Suggested-by: Andy Shevchenko Link: https://lore.kernel.org/all/Z_aFBfjb17JxOwyk@black.fi.intel.com/ Reviewed-by: Linus Walleij Acked-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250620-gpiod-is-equal-improv-v1-2-a75060505d2c@linaro.org Signed-off-by: Bartosz Golaszewski commit 08ad63bbd681ae4eeb50644564435035c38e5795 Author: Bartosz Golaszewski Date: Fri Jun 20 14:58:01 2025 +0200 gpio: constify arguments of gpiod_is_equal() This function is not meant to modify the GPIO descriptors in any way so we can safely constify both arguments. Link: https://lore.kernel.org/r/20250620-gpiod-is-equal-improv-v1-1-a75060505d2c@linaro.org Signed-off-by: Bartosz Golaszewski commit 23983ae6fcb2c8766435a5ce2b5a34624c303fcb Author: Sakari Ailus Date: Mon Jun 23 09:59:48 2025 +0300 media: ivsc: Remove Wentong's e-mail address Remove Wentong's e-mail address from MODULE_AUTHOR() macro as the current e-mail address is no longer valid. Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 0c92c49fc688cfadacc47ae99b06a31237702e9e Author: Hans de Goede Date: Sat Jun 21 16:00:52 2025 +0200 media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE and CSI driver are missing a mei_cldev_disable() call in their remove() function. This causes the mei_cl client to stay part of the mei_device->file_list list even though its memory is freed by mei_cl_bus_dev_release() calling kfree(cldev->cl). This leads to a use-after-free when mei_vsc_remove() runs mei_stop() which first removes all mei bus devices calling mei_ace_remove() and mei_csi_remove() followed by mei_cl_bus_dev_release() and then calls mei_cl_all_disconnect() which walks over mei_device->file_list dereferecing the just freed cldev->cl. And mei_vsc_remove() it self is run at shutdown because of the platform_device_unregister(tp->pdev) in vsc_tp_shutdown() When building a kernel with KASAN this leads to the following KASAN report: [ 106.634504] ================================================================== [ 106.634623] BUG: KASAN: slab-use-after-free in mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634683] Read of size 4 at addr ffff88819cb62018 by task systemd-shutdow/1 [ 106.634729] [ 106.634767] Tainted: [E]=UNSIGNED_MODULE [ 106.634770] Hardware name: Dell Inc. XPS 16 9640/09CK4V, BIOS 1.12.0 02/10/2025 [ 106.634773] Call Trace: [ 106.634777] ... [ 106.634871] kasan_report (mm/kasan/report.c:221 mm/kasan/report.c:636) [ 106.634901] mei_cl_set_disconnected (drivers/misc/mei/client.c:783) mei [ 106.634921] mei_cl_all_disconnect (drivers/misc/mei/client.c:2165 (discriminator 4)) mei [ 106.634941] mei_reset (drivers/misc/mei/init.c:163) mei ... [ 106.635042] mei_stop (drivers/misc/mei/init.c:348) mei [ 106.635062] mei_vsc_remove (drivers/misc/mei/mei_dev.h:784 drivers/misc/mei/platform-vsc.c:393) mei_vsc [ 106.635066] platform_remove (drivers/base/platform.c:1424) Add the missing mei_cldev_disable() calls so that the mei_cl gets removed from mei_device->file_list before it is freed to fix this. Fixes: 78876f71b3e9 ("media: pci: intel: ivsc: Add ACE submodule") Fixes: 29006e196a56 ("media: pci: intel: ivsc: Add CSI submodule") Cc: stable@vger.kernel.org Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 77369edb3c61ecd791d4de1f38ce867400bcfcc1 Author: Olivier Benjamin Date: Fri Jun 20 17:21:33 2025 +0200 dt-bindings: media: imx258: inherit video-interface-devices properties Update the IMX258 binding to inherit properties defined in the video-interface-devices binding. Acked-by: Rob Herring (Arm) Signed-off-by: Olivier Benjamin Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 0d0ccb91c92fb202f0c97ee32b63fc848e659fc8 Author: Olivier Benjamin Date: Fri Jun 20 17:21:32 2025 +0200 dt-bindings: media: ov8858: inherit video-interface-devices properties Update the OV8858 binding to inherit properties defined in the video-interface-devices binding. Acked-by: Rob Herring (Arm) Signed-off-by: Olivier Benjamin Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit bd227d0fc25c46c7fda43fe62cf7b04e9d0f0baa Author: Sakari Ailus Date: Thu Jun 19 12:23:48 2025 +0300 media: Documentation: Document new v4l2_ctrl_handler_free() behaviour v4l2_ctrl_handler_free() no longer resets the handler's error code. Document it. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Reviewed-by: Hans Verkuil Signed-off-by: Hans Verkuil commit 04f541cef2dba78b17c83ad8b5a0742012399530 Author: Sakari Ailus Date: Thu Jun 19 12:21:51 2025 +0300 media: v4l2-ctrls: Return the handler's error in v4l2_ctrl_handler_free() v4l2_ctrl_handler_free() used to return void but changing this to int, returning the handler's error code, enables the drivers to simply return the handler's error in this common error handling pattern: if (handler->error) return v4l2_ctrl_handler_free(handler); Suggested-by: Laurent Pinchart Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Reviewed-by: Hans Verkuil Signed-off-by: Hans Verkuil commit 5a0400aca5fa7c6b8ba456c311a460e733571c88 Author: Sakari Ailus Date: Thu May 8 18:55:38 2025 +0300 media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() It's a common pattern in drivers to free the control handler's resources and then return the handler's error code on drivers' error handling paths. Alas, the v4l2_ctrl_handler_free() function also zeroes the error field, effectively indicating successful return to the caller. There's no apparent need to touch the error field while releasing the control handler's resources and cleaning up stale pointers. Not touching the handler's error field is a more certain way to address this problem than changing all the users, in which case the pattern would be likely to re-emerge in new drivers. Do just that, don't touch the control handler's error field in v4l2_ctrl_handler_free(). Fixes: 0996517cf8ea ("V4L/DVB: v4l2: Add new control handling framework") Cc: stable@vger.kernel.org Signed-off-by: Sakari Ailus Reviewed-by: Hans Verkuil Reviewed-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 784e010ed1e1c5ab7d5344dba6928c8a458f4105 Author: Jason Chen Date: Tue Jun 3 12:39:23 2025 +0800 media: ipu-bridge: Add support for additional link frequencies Support two additional frequencies for the ov08x40 sensor using 2 lanes Signed-off-by: Jason Chen Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit d0016b2a00d448151285da2f9163e0bd41ee350f Author: Laurent Pinchart Date: Thu Jun 5 11:39:45 2025 +0300 media: ipu3-cio2: Use V4L2 subdev active state Replace storage of the active format in the cio2_queue structure with usage of V4L2 subdev active state. This simplifies locking in the driver, and drops usage of the deprecated subdev .open() internal operation. Signed-off-by: Laurent Pinchart [Sakari Ailus: keep fmt_default non-static to keep clang happy.] Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 484f8bec3ddb453321ef0b8621c25de6ce3d0302 Author: Daniel Scally Date: Tue May 20 14:17:46 2025 +0100 media: ipu-bridge: Add _HID for OV5670 The OV5670 is found on Dell 7212 tablets paired with an IPU3 ISP and needs to be connected by the ipu-bridge. Add it to the list of supported devices. Signed-off-by: Daniel Scally Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit bca5cfbb694d66a1c482d0c347eee80f6afbc870 Author: Daniel Scally Date: Tue May 20 14:17:45 2025 +0100 platform/x86: int3472: Add board data for Dell 7212 The Dell 7212 Rugged Extreme Tablet pairs an OV5670 sensor with the Intel IPU3 ISP. The sensor is powered by a TPS68470 PMIC, and so we need some board data to describe how to configure the GPIOs and regulators to run the sensor. Signed-off-by: Daniel Scally Acked-by: Ilpo Järvinen Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 4e89c747358fdc368a2aa0a2cba21100d5f7821e Author: Daniel Scally Date: Tue May 20 14:17:44 2025 +0100 media: i2c: Defer ov5670_probe() if endpoint not found The OV5670 is found on a Dell 7212, coupled to Intel's CIO2 CSI-2 receiver. The ACPI tables don't describe the connection properly and so this is one of the sensors that needs to wait for the ipu-bridge to set up the graph with software nodes. Defer probe if an endpoint isn't found to allow time for that. Signed-off-by: Daniel Scally Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 3c607baf68639d6bfe1a336523c4c9597f4b512a Author: Dongcheng Yan Date: Wed May 21 15:15:19 2025 +0800 media: i2c: set lt6911uxe's reset_gpio to GPIOD_OUT_LOW reset_gpio needs to be an output and set to GPIOD_OUT_LOW, to ensure lt6911uxe is in reset state during probe. This issue was found on the onboard lt6911uxe, where the reset_pin was not reset, causing the lt6911uxe to fail to probe. Fixes: e49563c3be09d4 ("media: i2c: add lt6911uxe hdmi bridge driver") Cc: stable@vger.kernel.org Signed-off-by: Dongcheng Yan Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 298d1471cf83d5a2a05970e41822a2403f451086 Author: Mathis Foerst Date: Thu May 22 16:35:10 2025 +0200 media: mt9m114: Fix deadlock in get_frame_interval/set_frame_interval Getting / Setting the frame interval using the V4L2 subdev pad ops get_frame_interval/set_frame_interval causes a deadlock, as the subdev state is locked in the [1] but also in the driver itself. In [2] it's described that the caller is responsible to acquire and release the lock in this case. Therefore, acquiring the lock in the driver is wrong. Remove the lock acquisitions/releases from mt9m114_ifp_get_frame_interval() and mt9m114_ifp_set_frame_interval(). [1] drivers/media/v4l2-core/v4l2-subdev.c - line 1129 [2] Documentation/driver-api/media/v4l2-subdev.rst Fixes: 24d756e914fc ("media: i2c: Add driver for onsemi MT9M114 camera sensor") Cc: stable@vger.kernel.org Signed-off-by: Mathis Foerst Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 3aa7c3da1f7d23ecc653c29de4cfb5da45efc49d Author: Mathis Foerst Date: Thu May 22 16:35:07 2025 +0200 media: mt9m114: Factor out mt9m114_configure_pa The function mt9m114_configure writes the configuration registers of both, the pixel array (pa) and the image flow processor (ifp). This is undesirable if only the config of the pa should be changed without affecting the ifp. Factor out the function mt9m114_configure_pa() that just writes the pa-configuration. Signed-off-by: Mathis Foerst Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 208119b4a116d2fa708ee4bbe4e12dfd26f03309 Author: Mathis Foerst Date: Thu May 22 16:35:06 2025 +0200 media: mt9m114: Bypass PLL if required The MT9M114 sensor has an internal PLL that generates the required SYSCLK from EXTCLK. It also has the option to bypass the PLL and use EXTCLK directly as SYSCLK. The current driver implementation uses a hardcoded PLL configuration that requires a specific EXTCLK frequency. Depending on the available clocks, it can be desirable to use a different PLL configuration or to bypass it. The link-frequency of the output bus (Parallel or MIPI-CSI) is configured in the device tree. Check if EXTCLK can be used as SYSCLK to achieve this link-frequency. If yes, bypass the PLL. Otherwise, (as before) check if EXTCLK and the default PLL configuration provide the required SYSCLK to achieve the link-frequency. If yes, use the PLL. If no, throw an error. Signed-off-by: Mathis Foerst Reviewed-by: Laurent Pinchart Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 3bd71a34baf620b2a85b5b63255a07a4ab194da0 Author: Mathis Foerst Date: Thu May 22 16:35:05 2025 +0200 media: dt-bindings: mt9m114: Add slew-rate DT-binding The MT9M114 supports the different slew rates (0 to 7) on the output pads. At the moment, this is hardcoded to 7 (the fastest rate). The user might want to change this values due to EMC requirements. Add the 'slew-rate' property to the MT9M114 DT-bindings for selecting the desired slew rate. Signed-off-by: Mathis Foerst Reviewed-by: Krzysztof Kozlowski Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit bbcc96df756a0db077b7d1f4e83922241e24486b Author: Martin Hecht Date: Thu May 15 16:51:50 2025 +0200 MAINTAINERS: Update my email address to gmail.com Replace my corporate email address by @gmail.com. Signed-off-by: Martin Hecht Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 2db8bd2efd97b957d7fca8abe137255068e02fb3 Author: André Apitzsch Date: Sat May 24 11:14:40 2025 +0200 media: i2c: imx214: Remove hard-coded external clock frequency Instead rely on the rate set on the clock (using assigned-clock-rates etc.) Reviewed-by: Laurent Pinchart Signed-off-by: André Apitzsch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 5ecc7b0b48f2dbe0e4d601084e956cddc57acc5a Author: André Apitzsch Date: Sat May 24 11:14:39 2025 +0200 media: dt-bindings: sony,imx214: Deprecate property clock-frequency Deprecate the clock-frequency property in favor of assigned-clock-rates. While at it, re-order properties according to coding style and fix the link-frequency in the example. See commit acc294519f17 ("media: i2c: imx214: Fix link frequency validation"). Reviewed-by: Laurent Pinchart Acked-by: Conor Dooley Signed-off-by: André Apitzsch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit b9b359662952ff29cac0a7a7ffb7ae079dc836ca Author: André Apitzsch Date: Sat May 24 11:14:38 2025 +0200 media: i2c: imx214: Make use of CCS PLL calculator Calculate PLL parameters based on clock frequency and link frequency. Acked-by: Ricardo Ribalda Signed-off-by: André Apitzsch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit a55a5e616b67af845fc62dca997fe16e7b71c1dd Author: André Apitzsch Date: Sat May 24 11:14:37 2025 +0200 media: i2c: imx214: Prepare for variable clock frequency Move clock frequency related parameters out of the constant register sequences, such that the hard coded external clock frequency can be replaced by a variable in the upcoming patches. Acked-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Signed-off-by: André Apitzsch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 4743c1fad068998a3be030310128c744d536599f Author: André Apitzsch Date: Sat May 24 11:14:36 2025 +0200 media: i2c: imx214: Reorder imx214_parse_fwnode call Reorder imx214_parse_fwnode call to reduce goto paths in upcoming patches. No functional change intended. Acked-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Signed-off-by: André Apitzsch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 9fbf2ee81f8c15b67af840bc039170836d4c7961 Author: Matthias Fend Date: Wed May 14 12:51:01 2025 +0200 media: i2c: imx415: Request the sensor clock without a name Request the sensor clock without specifying a name so that the driver behaves as described in the imx415 bindings. Signed-off-by: Matthias Fend Reviewed-by: Jai Luthra Reviewed-by: Michael Riesch Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 72da392727ea9799e3a5aecd8cf7663647bdb7d2 Author: Hans de Goede Date: Wed May 14 18:37:54 2025 +0200 media: ipu-bridge: Add link-frequency to the GC0310 entry Add the missing link-frequency to the ipu_supported_sensors[] array's Galaxy Core GC0310 entry. Signed-off-by: Hans de Goede Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 5a0abb8909b9dcf347fce1d201ac6686ac33fd64 Author: Niklas Söderlund Date: Thu May 8 10:37:45 2025 +0200 media: v4l2-common: Reduce warnings about missing V4L2_CID_LINK_FREQ control When operating a pipeline with a missing V4L2_CID_LINK_FREQ control this two line warning is printed each time the pipeline is started. Reduce this excessive logging by only warning once for the missing control. Signed-off-by: Niklas Söderlund Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit 72aa1c5f1d0feceb9bbdbe59e0c0e412de42408b Author: Sakari Ailus Date: Fri Oct 18 15:20:08 2024 +0300 media: dt-bindings: mipi-ccs: Refer to video-interface-devices.yaml Refer to video-interface-devices.yaml instead of documenting the common properties here. Signed-off-by: Sakari Ailus Acked-by: Rob Herring (Arm) Signed-off-by: Hans Verkuil commit d629ca4f18f89c3c4db3bb589568e8010b34b514 Author: Andy Shevchenko Date: Mon Mar 31 10:01:52 2025 +0300 media: i2c: max96717: Drop unused field assignment The driver is not using gpio_chip::of_xlate() callback and hence the of_gpio_n_cells assignment is unused. Drop it. With that done, remove unneeded OF dependency and extend compile test coverage. Signed-off-by: Andy Shevchenko Reviewed-by: Julien Massot Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil commit b4d72f15c0988702552ee48813dec8af418b71ee Merge: 9adc643d43837a d0b3b7b22dfa1f Author: Greg Kroah-Hartman Date: Mon Jun 30 08:17:34 2025 +0200 Merge 6.16-rc4 into staging-next We need the staging fix in here as well. Signed-off-by: Greg Kroah-Hartman commit 98be2d60fdb70b53e29a04c807ee62e06fb9c08f Author: André Draszik Date: Fri Jun 27 14:29:32 2025 +0100 arm64: dts: exynos: gs101: switch to gs101 specific reboot gs101 (Google Pixel 6 and Pixel 6 Pro) supports cold- and warm-reboot. Cold-reset is useful because it is more secure, e.g. wiping all RAM contents, while the warm-reboot allows RAM contents to be retained across the reboot, e.g. to collect potential crash information. Add the required DT changes to switch to the gs101-specific reboot method, which knows how to issue either reset as requested by the OS. The PMIC plays a role in this as well, so mark it as 'system-power-controller', which in this case ensures that the device will wake up again after a cold-reboot, ensuring the full power-cycle is successful. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250627-gs101-reboot3-v1-3-c3ae49657b1f@linaro.org Signed-off-by: Krzysztof Kozlowski commit cb98b8a8d6e2797f1e4a0e433a20c57492daf783 Author: André Draszik Date: Fri Jun 27 14:29:31 2025 +0100 arm64: dts: exynos: gs101-pixel-common: add main PMIC node On Pixel 6 (and Pro), a Samsung S2MPG10 is used as main PMIC, which contains the following functional blocks: * common / speedy interface * regulators * 3 clock outputs * RTC * power meters * GPIO interfaces This change enables the PMIC itself and the RTC. We're still working on the remaining parts or waiting for bindings to be merged, hence only a small subset of the functional is being enabled. The regulators fall into the same category (still being finalised), but since the binding requires a 'regulators' node, an empty node is being added to avoid validation errors at this stage. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250627-gs101-reboot3-v1-2-c3ae49657b1f@linaro.org Signed-off-by: Krzysztof Kozlowski commit a7d7aebed4005b9c287f9bd9d22c273da63c9028 Author: André Draszik Date: Fri Jun 27 14:29:30 2025 +0100 arm64: defconfig: enable Samsung PMIC over ACPM Enable the Samsung s2mpg1x driver as this is used by the gs101-oriole and gs101-raven (Google Pixel 6 and Pixel 6 Pro) boards. It communicates over ACPM instead of I2C, hence the additional defconfig item. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250627-gs101-reboot3-v1-1-c3ae49657b1f@linaro.org Signed-off-by: Krzysztof Kozlowski commit 4292564c71cffd8094abcc52dd4840870d05cd30 Author: Peter Griffin Date: Fri Mar 14 15:38:02 2025 +0000 arm64: dts: exynos: gs101: ufs: add dma-coherent property ufs-exynos driver configures the sysreg shareability as cacheable for gs101 so we need to set the dma-coherent property so the descriptors are also allocated cacheable. This fixes the UFS stability issues we have seen with the upstream UFS driver on gs101. Fixes: 4c65d7054b4c ("arm64: dts: exynos: gs101: Add ufs and ufs-phy dt nodes") Cc: stable@vger.kernel.org Suggested-by: Will McVicker Signed-off-by: Peter Griffin Tested-by: Will McVicker Tested-by: André Draszik Reviewed-by: André Draszik Link: https://lore.kernel.org/r/20250314-ufs-dma-coherent-v1-1-bdf9f9be2919@linaro.org Signed-off-by: Krzysztof Kozlowski commit 815ac67919148f9d65537af550fd26e2cbbd47bb Merge: acc902de05b2b8 d0b3b7b22dfa1f Author: Greg Kroah-Hartman Date: Mon Jun 30 07:50:04 2025 +0200 Merge 6.16-rc4 into tty-next We need the tty/serial fixes in here as well. Signed-off-by: Greg Kroah-Hartman commit fc75e51e6977f12f76cdcc6f9658a61b04cc4b3e Author: Dr. David Alan Gilbert Date: Sun Jun 29 22:28:20 2025 +0100 Input: pcf50633-input - remove the driver The pcf50633 was used as part of the OpenMoko devices but the support for its main chip was recently removed in: commit 61b7f8920b17 ("ARM: s3c: remove all s3c24xx support") Remove the input driver. This was originally posted as a set of pcf50633 removals in March, and is the only major component that hasn't been picked up. https://lore.kernel.org/all/20250311014959.743322-1-linux@treblig.org/ Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250629212820.319584-1-linux@treblig.org Signed-off-by: Dmitry Torokhov commit f72ed4c6a375e52a3f4b75615e4a89d29d8acea7 Author: Masahiro Yamada Date: Wed Jun 25 00:04:55 2025 +0900 kconfig: gconf: fix potential memory leak in renderer_edited() If gtk_tree_model_get_iter() fails, gtk_tree_path_free() is not called. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap commit 2f2d60f489f0b2410f33103fa42296f7466673e0 Author: Masahiro Yamada Date: Wed Jun 25 00:04:54 2025 +0900 kconfig: gconf: make columns resizable The variable "resizeable" is a typo and always set to FALSE, resulting in dead code in init_right_tree(). It is unclear column resizing should be disabled. Enable it. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit 7d1bfaa457686b1e791de03450a3d49f28bdd022 Author: Masahiro Yamada Date: Wed Jun 25 00:04:53 2025 +0900 kconfig: re-add menu_get_parent_menu() that returns parent menu This helper returns the parent menu, or NULL if there is no parent. The main difference from the previous version is that it always returns the parent menu even when the given argument is itself a menu. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit 3c292cd0047c8758a2db7a44e441314e78b4db00 Author: Masahiro Yamada Date: Wed Jun 25 00:04:52 2025 +0900 kconfig: rename menu_get_parent_menu() to menu_get_menu_or_parent_menu() The current menu_get_parent_menu() does not always return the parent menu; if the given argument is itself a menu, it returns that menu. Rename this function to better reflect this behavior. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit 604f5b2127fb76e15dcc6dabbd73b541817a2fba Author: Masahiro Yamada Date: Wed Jun 25 00:04:51 2025 +0900 kconfig: qconf: show selected choice in the Value column It is useful to display the selected choice's value in the Value column. Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit cd5f1534a37e0b05733a8714195ec90474c20e82 Author: Masahiro Yamada Date: Wed Jun 25 00:04:50 2025 +0900 kconfig: qconf: do not show checkbox icon for choice When you select "Show All Options" or "Show Prompt Options", choice entries display a check box icon, but this has no point because choice is always y since commit fde192511bdb ("kconfig: remove tristate choice support"). Signed-off-by: Masahiro Yamada Acked-by: Randy Dunlap Tested-by: Randy Dunlap commit de8b24abf661b1b423165c383783e57597318f7f Author: Wei Fang Date: Wed May 28 16:34:33 2025 +0800 arm64: dts: imx95: add SMMU support for NETC The i.MX95 NETC supports SMMU, so add SMMU support. Signed-off-by: Wei Fang Signed-off-by: Shawn Guo commit 715dc11c78d8db5648e211e28b2cf5e9a80b90c5 Author: Shengjiu Wang Date: Wed May 28 09:58:37 2025 +0800 arm64: dts: imx943-evk: Add PDM microphone sound card support Add PDM micphone sound card support, configure the pinmux. This sound card supports recording sound from PDM microphone and convert the PDM format data to PCM data. Signed-off-by: Shengjiu Wang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit b4ff842d24c058e9518a188de2f5153956582f52 Author: Shengjiu Wang Date: Wed May 28 09:58:36 2025 +0800 arm64: dts: imx943-evk: add bt-sco sound card support Add bt-sco sound card, which is used by BT HFP case. It supports wb profile as default. Signed-off-by: Shengjiu Wang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit bbe944d729a3d88bd92bf056f36ca42638754f94 Author: Shengjiu Wang Date: Wed May 28 09:58:35 2025 +0800 arm64: dts: imx943-evk: add sound-wm8962 support Add WM8962 codec connected to SAI1 interface. Signed-off-by: Shengjiu Wang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit c757036a66021ca3a259b02b9f6630fc54fc3439 Author: Carlos Song Date: Wed May 28 09:58:34 2025 +0800 arm64: dts: imx943-evk: add i2c io expander support Add i2c io expander support for imx943 evk board. Signed-off-by: Carlos Song Signed-off-by: Shengjiu Wang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 1bb57ed1b450a7c82f36e25dae3d16418c2c5765 Author: Carlos Song Date: Wed May 28 09:58:33 2025 +0800 arm64: dts: imx943-evk: add lpi2c support Add lpi2c and i2c-mux support for imx943 evk board. Signed-off-by: Carlos Song Signed-off-by: Shengjiu Wang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit ac55c194f18c1417188a55e6f17bf6b5596e3933 Author: Shengjiu Wang Date: Wed May 28 09:58:32 2025 +0800 arm64: dts: imx94: Add micfil and mqs device nodes Add micfil and mqs device nodes Signed-off-by: Shengjiu Wang Reviewed-by: Frank Li Signed-off-by: Shawn Guo commit 37ccad07fd050815890ba222892169e7bcda1dec Author: Ciprian Marian Costea Date: Mon May 26 19:32:59 2025 +0300 MAINTAINERS: add NXP S32G RTC driver Add the NXP S32G RTC driver as maintained so further patches on this driver can be reviewed under this architecture. Signed-off-by: Ciprian Marian Costea Signed-off-by: Shawn Guo commit 409fe0cea366ee2e239631ab14337210a5e5f7e4 Author: Joseph Guo Date: Sun Jun 29 17:35:39 2025 -0700 Input: goodix - add support for polling mode There are designs incorporating Goodix touch controller that do not connect interrupt pin, for example Raspberry Pi. To support such systems use polling mode for the input device when I2C client does not have interrupt assigned to it. Signed-off-by: Joseph Guo Reviewed-by: Haibo Chen Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250522020418.1963422-1-qijian.guo@nxp.com Signed-off-by: Dmitry Torokhov commit 0013ddc4cf2047caca31c541b18728d9e2eccba9 Author: Damien Le Moal Date: Wed Jun 18 14:11:24 2025 +0900 ata: libata-eh: Move and rename ata_eh_set_lpm() Move the definition of the function ata_eh_set_lpm() to avoid its unnecessary forward declaration and rename the function to ata_eh_link_set_lpm() to clarify that it acts on a link. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Niklas Cassel commit 3a382b9b13aaa02af0f5b194cce2825fe78f4f51 Author: Damien Le Moal Date: Thu Jun 19 12:59:46 2025 +0900 ata: ahci: Clarify mobile_lpm_policy description Despite its name, the mobile_lpm_policy module parameter defines the default LPM policy to use for an AHCI adapter for all chipsets, including desktop and server chipsets. Clarify this point in the parameter description. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Niklas Cassel commit 2b89eb177c466bb1f84dff8db04d614b33a7ab95 Author: Damien Le Moal Date: Thu Jun 19 18:35:48 2025 +0900 ata: libata: Improve LPM policies description Improve the comment describing enum ata_lpm_policy and add comments within that enum to describe each of the different possible values. The enum values comments match the description given for the CONFIG_SATA_MOBILE_LPM_POLICY config parameter. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Niklas Cassel commit ed62a62a18bc144f73eadf866ae46842e8f6606e Author: Damien Le Moal Date: Wed Jun 18 16:25:19 2025 +0900 ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig Improve the description of the possible default SATA link power management policies and add the missing description for policy 5. No functional changes. Fixes: a5ec5a7bfd1f ("ata: ahci: Support state with min power but Partial low power state") Cc: stable@vger.kernel.org Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Niklas Cassel commit cb45e3ff431f96e905462313cb52c27b7c830709 Author: Damien Le Moal Date: Thu Jun 19 09:57:21 2025 +0900 ata: libata-scsi: Cleanup ata_scsi_offline_dev() Change the function ata_scsi_offline_dev() to return a bool and change this function kdoc comment to have the correct mention of its call site. No functional changes. Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Niklas Cassel commit a0f26fcc383965e0522b81269062a9278bc802fe Author: Damien Le Moal Date: Fri Jun 27 09:42:33 2025 +0900 ata: libata: Remove ATA_DFLAG_ZAC device flag The ATA device flag ATA_DFLAG_ZAC is used to indicate if a devie is a host managed or host aware zoned device. However, this flag is not used in the hot path and only used during device scanning/revalidation and for inquiry and sense SCSI command translation. Save one bit from struct ata_device flags field by replacing this flag with the internal helper function ata_dev_is_zac(). This function returns true if the device class is ATA_DEV_ZAC (host managed ZAC device case) or if its identify data reports it supports the zoned command set (host aware ZAC device case). Signed-off-by: Damien Le Moal Reviewed-by: Hannes Reinecke Reviewed-by: Niklas Cassel commit 316b31dd39bfc4d6099f1ab049c0da53af6acd20 Author: Vignesh Raman Date: Thu Jun 26 15:56:57 2025 +0530 drm/ci: i915: cml: Fix the runner tag The GitLab runner tags are case sensitive, and Flip-hatch's tag was incorrectly lowercase. This prevented jobs from being picked up by the runner. Fix the runner tag for Flip-hatch. Based on https://gitlab.freedesktop.org/mesa/mesa/-/commit/03b480d3 Signed-off-by: Vignesh Raman Signed-off-by: Rob Clark commit a7cce099450f8fc597a6ac215440666610895fb7 Author: Al Viro Date: Wed Jun 25 15:10:52 2025 -0400 statmount_mnt_basic(): simplify the logics for group id We are holding namespace_sem shared and we have not done any group id allocations since we grabbed it. Therefore IS_MNT_SHARED(m) is equivalent to non-zero m->mnt_group_id. Signed-off-by: Al Viro commit f6cc2f4e3d304c93b44c80f50430aa40e080cc3c Author: Al Viro Date: Wed Jun 25 15:02:11 2025 -0400 invent_group_ids(): zero ->mnt_group_id always implies !IS_MNT_SHARED() All places where we call set_mnt_shared() are guaranteed to have non-zero ->mnt_group_id - either by explicit test, or by having done successful invent_group_ids() covering the same mount since we'd grabbed namespace_sem. The opposite combination (non-zero ->mnt_group_id and !IS_MNT_SHARED()) *is* possible - it means that we have allocated group id, but didn't get around to set_mnt_shared() yet; such state is transient - by the time we do namespace_unlock(), we must either do set_mnt_shared() or unroll the group id allocations by cleanup_group_ids(). Signed-off-by: Al Viro commit 725ab435ff6e31faca26b8234f9f04c19f772b18 Author: Al Viro Date: Wed Jun 25 14:48:50 2025 -0400 get rid of CL_SHARE_TO_SLAVE the only difference between it and CL_SLAVE is in this predicate in clone_mnt(): if ((flag & CL_SLAVE) || ((flag & CL_SHARED_TO_SLAVE) && IS_MNT_SHARED(old))) { However, in case of CL_SHARED_TO_SLAVE we have not allocated any mount group ids since the time we'd grabbed namespace_sem, so IS_MNT_SHARED() is equivalent to non-zero ->mnt_group_id. And in case of CL_SLAVE old has come either from the original tree, which had ->mnt_group_id allocated for all nodes or from result of sequence of CL_MAKE_SHARED or CL_MAKE_SHARED|CL_SLAVE copies, ultimately going back to the original tree. In both cases we are guaranteed that old->mnt_group_id will be non-zero. In other words, the predicate is always equal to (flags & (CL_SLAVE | CL_SHARED_TO_SLAVE)) && old->mnt_group_id and with that replacement CL_SLAVE and CL_SHARED_TO_SLAVE have exact same behaviour. Signed-off-by: Al Viro commit aab771f34e63ef89e195b63d121abcb55eebfde6 Author: Al Viro Date: Wed Jun 18 18:23:41 2025 -0400 take freeing of emptied mnt_namespace to namespace_unlock() Freeing of a namespace must be delayed until after we'd dealt with mount notifications (in namespace_unlock()). The reasons are not immediately obvious (they are buried in ->prev_ns handling in mnt_notify()), and having that free_mnt_ns() explicitly called after namespace_unlock() is asking for trouble - it does feel like they should be OK to free as soon as they've been emptied. Make the things more explicit by setting 'emptied_ns' under namespace_sem and having namespace_unlock() free the sucker as soon as it's safe to free. Signed-off-by: Al Viro commit 663206854f020ec6fc6bfd3d52f501a28ede1403 Author: Al Viro Date: Tue Jun 17 21:35:22 2025 -0400 copy_tree(): don't link the mounts via mnt_list The only place that really needs to be adjusted is commit_tree() - there we need to iterate through the copy and we might as well use next_mnt() for that. However, in case when our tree has been slid under something already mounted (propagation to a mountpoint that already has something mounted on it or a 'beneath' move_mount) we need to take care not to walk into the overmounting tree. Signed-off-by: Al Viro commit dd5a4e1d640bf3542c4583491e6b91d25de3b760 Author: Al Viro Date: Tue Jun 24 23:54:41 2025 -0400 change_mnt_propagation(): move ->mnt_master assignment into MS_SLAVE case Signed-off-by: Al Viro commit 8c5a853f58c5b86b033842b78a0ad3d1208672fa Author: Al Viro Date: Tue Jun 24 23:51:31 2025 -0400 mnt_slave_list/mnt_slave: turn into hlist_head/hlist_node Signed-off-by: Al Viro commit 94a8d0027606397ce58b00077bf6146f25923965 Author: Al Viro Date: Tue Jun 24 23:36:43 2025 -0400 turn do_make_slave() into transfer_propagation() Lift calculation of replacement propagation source, removal from peer group and assignment of ->mnt_master from do_make_slave() into change_mnt_propagation() itself. What remains is switching of what used to get propagation *through* mnt to alternative source. Rename to transfer_propagation(), passing it the replacement source as the second argument. Have it return void, while we are at it. Signed-off-by: Al Viro commit 955336e204ab59301ff8b1f75a98a226f5a98782 Author: Al Viro Date: Tue Jun 24 18:12:56 2025 -0400 do_make_slave(): choose new master sanely When mount changes propagation type so that it doesn't propagate events any more (MS_PRIVATE, MS_SLAVE, MS_UNBINDABLE), we need to make sure that event propagation between other mounts is unaffected. We need to make sure that events from peers and master of that mount (if any) still reach everything that used to be on its ->mnt_slave_list. If mount has neither peers nor master, we simply need to dissolve its ->mnt_slave_list and clear ->mnt_master of everything in there. If mount has peers, we transfer everything in ->mnt_slave_list of this mount into that of some of those peers (and adjust ->mnt_master accordingly). If mount has a master but no peers, we transfer everything in ->mnt_slave_list of this mount into that of its master (adjusting ->mnt_master, etc.). There are two problems with the current implementation: * there's a long-obsolete logics in choosing the peer - once upon a time it made sense to prefer the peer that had the same ->mnt_root as our mount, but that had been pointless since 2014 ("smarter propagate_mnt()") * the most common caller of that thing is umount_tree() taking the mounts out of propagation graph. In that case it's possible to have ->mnt_slave_list contents moved many times, since the replacement master is likely to be taken out by the same umount_tree(), etc. Take the choice of replacement master into a separate function (propagation_source()) and teach it to skip the candidates that are going to be taken out. Signed-off-by: Al Viro commit ef86251194de9b31f7efcf70ea480ebe736e9e60 Author: Al Viro Date: Tue Jun 24 23:25:00 2025 -0400 change_mnt_propagation(): do_make_slave() is a no-op unless IS_MNT_SHARED() ... since mnt->mnt_share and mnt->mnt_slave_list are guaranteed to be empty unless IS_MNT_SHARED(mnt). Signed-off-by: Al Viro commit d5f15047f13b86b74d1ac4f39036ccae2078c492 Author: Al Viro Date: Tue Jun 24 23:20:47 2025 -0400 change_mnt_propagation() cleanups, step 1 Lift changing ->mnt_slave from do_make_slave() into the caller. Simplifies the next steps... Signed-off-by: Al Viro commit 0313356520b15deab893cd62da3e2ba9a6e61a1f Author: Al Viro Date: Fri Jun 27 23:39:23 2025 -0400 propagate_mnt(): fix comment and convert to kernel-doc, while we are at it Mountpoint is passed as struct mountpoint *, not struct dentry * (and called dest_mp, not dest_dentry) since 2013. Roots of created copies are linked via mnt_hash, not mnt_list since a bit before the merge into mainline back in 2005. Signed-off-by: Al Viro commit 0a10217e5cf82835b63875752b57f01bba0bf5b6 Author: Al Viro Date: Fri Jun 27 23:27:48 2025 -0400 propagate_mnt(): get rid of last_dest Its only use is choosing the type of copy - CL_MAKE_SHARED if there already is a copy in that peer group, CL_SLAVE or CL_SLAVE | CL_MAKE_SHARED otherwise. But that's easy to keep track of - just set type in the beginning of group and reset to CL_MAKE_SHARED after the first created secondary in it... Signed-off-by: Al Viro commit bc88530a20b1d5c78288ef5383d10b66d3242c48 Author: Al Viro Date: Fri Jun 27 23:21:57 2025 -0400 fs/pnode.c: get rid of globals this stuff can be local in propagate_mnt() now (and in some cases duplicates the existing variables there) Signed-off-by: Al Viro commit 6a2ce2a74bfeee4b66411177125f3b5749003e7f Author: Al Viro Date: Fri Jun 27 23:16:52 2025 -0400 propagate_one(): fold into the sole caller mechanical expansion; will be cleaned up on the next step Signed-off-by: Al Viro commit e0f9396e244c0dcc29921ebc3254cb25d6eb31cf Author: Al Viro Date: Fri Jun 27 23:09:47 2025 -0400 propagate_one(): separate the "what should be the master for this copy" part When we create the first copy for a peer group, it becomes a slave of one of the existing copies; take that logics into a separate helper - find_master(parent, last_copy, original). Signed-off-by: Al Viro commit 15e710b8bbb5c537c39ccaa23963d01c76946834 Author: Al Viro Date: Fri Jun 27 23:04:23 2025 -0400 propagate_one(): separate the "do we need secondary here?" logics take the checks into separate helper - need_secondary(mount, mountpoint). Signed-off-by: Al Viro commit 2b2a34793dc239b0eaebe9559557d051524a7297 Author: Al Viro Date: Fri Jun 27 22:56:43 2025 -0400 propagate_mnt(): handle all peer groups in the same loop the only difference is that for the original group we want to skip the first element; not worth having the logics twice... Signed-off-by: Al Viro commit 25776a09d802f4e4d8c0bd72042934223286c2e3 Author: Al Viro Date: Sat Jun 21 17:41:40 2025 -0400 propagate_one(): get rid of dest_master propagate_mnt() takes the subtree we are about to attach and creates its copies, setting the propagation between those. Each copy is cloned either from the original or from one of the already created copies. The tricky part is choosing the right copy to serve as a master when we are starting a new peer group. The algorithm for doing that selection puts temporary marks on the masters of mountpoints that already got a copy created for them; since the initial peer group might have no master at all, we need to special-case that when looking for the mark. Currently we do that by memorizing the master of original peer group. It works, but we get yet another piece of data to pass from propagate_mnt() to propagate_one(). Alternative is to mark the master of original peer group if not NULL, turning the check into "master is NULL or marked". Less data to pass around and memory safety is more obvious that way... Signed-off-by: Al Viro commit 406fea79992561f47fd3511dd8b7c8abeeff7045 Author: Al Viro Date: Sat Jun 21 18:06:19 2025 -0400 mount: separate the flags accessed only under namespace_sem Several flags are updated and checked only under namespace_sem; we are already making use of that when we are checking them without mount_lock, but we have to hold mount_lock for all updates, which makes things clumsier than they have to be. Take MNT_SHARED, MNT_UNBINDABLE, MNT_MARKED and MNT_UMOUNT_CANDIDATE into a separate field (->mnt_t_flags), renaming them to T_SHARED, etc. to avoid confusion. All accesses must be under namespace_sem. That changes locking requirements for mnt_change_propagation() and set_mnt_shared() - only namespace_sem is needed now. The same goes for SET_MNT_MARKED et.al. There might be more flags moved from ->mnt_flags to that field; this is just the initial set. Signed-off-by: Al Viro commit 493a4bebf5157a5da64e36f8d468ff80a859b563 Author: Al Viro Date: Sun Apr 27 22:53:13 2025 -0400 don't have mounts pin their parents Simplify the rules for mount refcounts. Current rules include: * being a namespace root => +1 * being someone's child => +1 * being someone's child => +1 to parent's refcount, unless you've already been through umount_tree(). The last part is not needed at all. It makes for more places where need to decrement refcounts and it creates an asymmetry between the situations for something that has never been a part of a namespace and something that left one, both for no good reason. If mount's refcount has additions from its children, we know that * it's either someone's child itself (and will remain so until umount_tree(), at which point contributions from children will disappear), or * or is the root of namespace (and will remain such until it either becomes someone's child in another namespace or goes through umount_tree()), or * it is the root of some tree copy, and is currently pinned by the caller of copy_tree() (and remains such until it either gets into namespace, or goes to umount_tree()). In all cases we already have contribution(s) to refcount that will last as long as the contribution from children remains. In other words, the lifetime is not affected by refcount contributions from children. It might be useful for "is it busy" checks, but those are actually no harder to express without it. NB: propagate_mnt_busy() part is an equivalent transformation, ugly as it is; the current logics is actually wrong and may give false negatives, but fixing that is for a separate patch (probably earlier in the queue). Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit d72c773237c0472e214cda92016ad21625b05bba Author: Al Viro Date: Fri Apr 25 20:21:23 2025 -0400 get rid of mountpoint->m_count struct mountpoint has an odd kinda-sorta refcount in it. It's always either equal to or one above the number of mounts attached to that mountpoint. "One above" happens when a function takes a temporary reference to mountpoint. Things get simpler if we express that as inserting a local object into ->m_list and removing it to drop the reference. New calling conventions: 1) lock_mount(), do_lock_mount(), get_mountpoint() and lookup_mountpoint() take an extra struct pinned_mountpoint * argument and returns 0/-E... (or true/false in case of lookup_mountpoint()) instead of returning struct mountpoint pointers. In case of success, the struct mountpoint * we used to get can be found as pinned_mountpoint.mp 2) unlock_mount() (always paired with lock_mount()/do_lock_mount()) takes an address of struct pinned_mountpoint - the same that had been passed to lock_mount()/do_lock_mount(). 3) put_mountpoint() for a temporary reference (paired with get_mountpoint() or lookup_mountpoint()) is replaced with unpin_mountpoint(), which takes the address of pinned_mountpoint we passed to matching {get,lookup}_mountpoint(). 4) all instances of pinned_mountpoint are local variables; they always live on stack. {} is used for initializer, after successful {get,lookup}_mountpoint() we must make sure to call unpin_mountpoint() before leaving the scope and after successful {do_,}lock_mount() we must make sure to call unlock_mount() before leaving the scope. 5) all manipulations of ->m_count are gone, along with ->m_count itself. struct mountpoint lives while its ->m_list is non-empty. Signed-off-by: Al Viro commit 86f63980964b334ad49d5c1f132f3b9491303a15 Author: Al Viro Date: Fri Apr 25 17:24:10 2025 -0400 combine __put_mountpoint() with unhash_mnt() A call of unhash_mnt() is immediately followed by passing its return value to __put_mountpoint(); the shrink list given to __put_mountpoint() will be ex_mountpoints when called from umount_mnt() and list when called from mntput_no_expire(). Replace with __umount_mnt(mount, shrink_list), moving the call of __put_mountpoint() into it (and returning nothing), adjust the callers. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit e30da2a20e31ab958d41e5a2c764968d95f17b61 Author: Al Viro Date: Fri Apr 25 16:53:01 2025 -0400 pivot_root(): reorder tree surgeries, collapse unhash_mnt() and put_mountpoint() attach new_mnt *before* detaching root_mnt; that way we don't need to keep hold on the mountpoint and one more pair of unhash_mnt()/put_mountpoint() gets folded together into umount_mnt(). Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit ec3265a245b22f8b8a0b20e04dd1d3f4f4a9ce09 Author: Al Viro Date: Thu May 1 20:40:57 2025 -0400 take ->mnt_expire handling under mount_lock [read_seqlock_excl] Doesn't take much massage, and we no longer need to make sure that by the time of final mntput() the victim has been removed from the list. Makes life safer for ->d_automount() instances... Rules: * all ->mnt_expire accesses are under mount_lock. * insertion into the list is done by mnt_set_expiry(), and caller (->d_automount() instance) must hold a reference to mount in question. It shouldn't be done more than once for a mount. * if a mount on an expiry list is not yet mounted, it will be ignored by anything that walks that list. * if the final mntput() finds its victim still on an expiry list (in which case it must've never been mounted - umount_tree() would've taken it out), it will remove the victim from the list. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit a8c764e1a580c2128e905ad6e42beef413fb7177 Author: Al Viro Date: Thu May 1 19:59:30 2025 -0400 attach_recursive_mnt(): remove from expiry list on move ... rather than doing that in do_move_mount(). That's the main obstacle to moving the protection of ->mnt_expire from namespace_sem to mount_lock (spinlock-only), which would simplify several failure exits. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit ee1ee33ccc1ba0620a77833b2a3e320588701217 Author: Al Viro Date: Thu May 8 00:09:30 2025 -0400 do_move_mount(): get rid of 'attached' flag 'attached' serves as a proxy for "source is a subtree of our namespace and not the entirety of anon namespace"; finish massaging it away. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 761de25854424aa23fd1d7b2bef5c7d184690926 Author: Al Viro Date: Fri Apr 25 12:55:39 2025 -0400 do_move_mount(): take dropping the old mountpoint into attach_recursive_mnt() ... and fold it with unhash_mnt() there - there's no need to retain a reference to old_mp beyond that point, since by then all mountpoints we were going to add are either explicitly pinned by get_mountpoint() or have stuff already added to them. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 86b1da96c5aeb816e4a1b60aa2b3bdcd87e28522 Author: Al Viro Date: Fri Apr 25 22:54:56 2025 -0400 attach_recursive_mnt(): get rid of flags entirely move vs. attach is trivially detected as mnt_has_parent(source_mnt)... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 18959bf585a85c526c88ae23bd223e1afe997bd7 Author: Al Viro Date: Fri Apr 25 22:49:47 2025 -0400 attach_recursive_mnt(): pass destination mount in all cases ... and 'beneath' is no longer used there Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 96f5d2e051653f2cfe9137c5d3c7794c358ffb03 Author: Al Viro Date: Fri Apr 25 22:40:48 2025 -0400 attach_recursive_mnt(): unify the mnt_change_mountpoint() logics The logics used for tucking under existing mount differs for original and copies; copies do a mount hash lookup to see if mountpoint to be is already overmounted, while the original is told explicitly. But the same logics that is used for copies works for the original, at which point the only place where we get very close to eliminating the need of passing 'beneath' flag to attach_recursive_mnt(). Signed-off-by: Al Viro commit 7c6fb47b2b6c1ffcb1cae9372b9fcf269444487a Author: Al Viro Date: Fri Apr 25 22:34:33 2025 -0400 make commit_tree() usable in same-namespace move case Once attach_recursive_mnt() has created all copies of original subtree, it needs to put them in place(s). Steps needed for those are slightly different: 1) in 'move' case, original copy doesn't need any rbtree manipulations (everything's already in the same namespace where it will be), but it needs to be detached from the current location 2) in 'attach' case, original may be in anon namespace; if it is, all those mounts need to removed from their current namespace before insertion into the target one 3) additional copies have a couple of extra twists - in case of cross-userns propagation we need to lock everything other the root of subtree and in case when we end up inserting under an existing mount, that mount needs to be found (for original copy we have it explicitly passed by the caller). Quite a bit of that can be unified; as the first step, make commit_tree() helper (inserting mounts into namespace, hashing the root of subtree and marking the namespace as updated) usable in all cases; (2) and (3) are already using it and for (1) we only need to make the insertion of mounts into namespace conditional. Signed-off-by: Al Viro commit f0d0ba19985d23a3e83d654318ccb6e9c5f1b095 Author: Al Viro Date: Wed May 14 20:50:06 2025 -0400 Rewrite of propagate_umount() The variant currently in the tree has problems; trying to prove correctness has caught at least one class of bugs (reparenting that ends up moving the visible location of reparented mount, due to not excluding some of the counterparts on propagation that should've been included). I tried to prove that it's the only bug there; I'm still not sure whether it is. If anyone can reconstruct and write down an analysis of the mainline implementation, I'll gladly review it; as it is, I ended up doing a different implementation. Candidate collection phase is similar, but trimming the set down until it satisfies the constraints turned out pretty different. I hoped to do transformation as a massage series, but that turns out to be too convoluted. So it's a single patch replacing propagate_umount() and friends in one go, with notes and analysis in D/f/propagate_umount.txt (in addition to inline comments). As far I can tell, it is provably correct and provably linear by the number of mounts we need to look at in order to decide what should be unmounted. It even builds and seems to survive testing... Another nice thing that fell out of that is that ->mnt_umounting is no longer needed. Compared to the first version: * explicit MNT_UMOUNT_CANDIDATE flag for is_candidate() * trim_ancestors() only clears that flag, leaving the suckers on list * trim_one() and handle_locked() take the stuff with flag cleared off the list. That allows to iterate with list_for_each_entry_safe() when calling trim_one() - it removes at most one element from the list now. * no globals - I didn't bother with any kind of context, not worth it. * Notes updated accordingly; I have not touch the terms yet. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 24368a744bafce7daf1eafd6a163871925ee5892 Author: Al Viro Date: Fri May 2 21:32:01 2025 -0400 sanitize handling of long-term internal mounts Original rationale for those had been the reduced cost of mntput() for the stuff that is mounted somewhere. Mount refcount increments and decrements are frequent; what's worse, they tend to concentrate on the same instances and cacheline pingpong is quite noticable. As the result, mount refcounts are per-cpu; that allows a very cheap increment. Plain decrement would be just as easy, but decrement-and-test is anything but (we need to add the components up, with exclusion against possible increment-from-zero, etc.). Fortunately, there is a very common case where we can tell that decrement won't be the final one - if the thing we are dropping is currently mounted somewhere. We have an RCU delay between the removal from mount tree and dropping the reference that used to pin it there, so we can just take rcu_read_lock() and check if the victim is mounted somewhere. If it is, we can go ahead and decrement without and further checks - the reference we are dropping is not the last one. If it isn't, we get all the fun with locking, carefully adding up components, etc., but the majority of refcount decrements end up taking the fast path. There is a major exception, though - pipes and sockets. Those live on the internal filesystems that are not going to be mounted anywhere. They are not going to be _un_mounted, of course, so having to take the slow path every time a pipe or socket gets closed is really obnoxious. Solution had been to mark them as long-lived ones - essentially faking "they are mounted somewhere" indicator. With minor modification that works even for ones that do eventually get dropped - all it takes is making sure we have an RCU delay between clearing the "mounted somewhere" indicator and dropping the reference. There are some additional twists (if you want to drop a dozen of such internal mounts, you'd be better off with clearing the indicator on all of them, doing an RCU delay once, then dropping the references), but in the basic form it had been * use kern_mount() if you want your internal mount to be a long-term one. * use kern_unmount() to undo that. Unfortunately, the things did rot a bit during the mount API reshuffling. In several cases we have lost the "fake the indicator" part; kern_unmount() on the unmount side remained (it doesn't warn if you use it on a mount without the indicator), but all benefits regaring mntput() cost had been lost. To get rid of that bitrot, let's add a new helper that would work with fs_context-based API: fc_mount_longterm(). It's a counterpart of fc_mount() that does, on success, mark its result as long-term. It must be paired with kern_unmount() or equivalents. Converted: 1) mqueue (it used to use kern_mount_data() and the umount side is still as it used to be) 2) hugetlbfs (used to use kern_mount_data(), internal mount is never unmounted in this one) 3) i915 gemfs (used to be kern_mount() + manual remount to set options, still uses kern_unmount() on umount side) 4) v3d gemfs (copied from i915) Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit c93ff74ff1cbc0ab152cebed3e44223fee3c70a2 Author: Al Viro Date: Sat Apr 26 19:17:28 2025 -0400 do_umount(): simplify the "is it still mounted" checks Calls of do_umount() are always preceded by can_umount(), where we'd done a racy check for mount belonging to our namespace; if it wasn't, can_unmount() would've failed with -EINVAL and we wouldn't have reached do_umount() at all. That check needs to be redone once we have acquired namespace_sem and in do_umount() we do that. However, that's done in a very odd way; we check that mount is still in rbtree of _some_ namespace or its mnt_list is not empty. It is equivalent to check_mnt(mnt) - we know that earlier mnt was mounted in our namespace; if it has stayed there, it's going to remain in rbtree of our namespace. OTOH, if it ever had been removed from out namespace, it would be removed from rbtree and it never would've re-added to a namespace afterwards. As for ->mnt_list, for something that had been mounted in a namespace we'll never observe non-empty ->mnt_list while holding namespace_sem - it does temporarily become non-empty during umount_tree(), but that doesn't outlast the call of umount_tree(), let alone dropping namespace_sem. Things get much easier to follow if we replace that with (equivalent) check_mnt(mnt) there. What's more, currently we treat a failure of that test as "quietly do nothing"; we might as well pretend that we'd lost the race and fail on that the same way can_umount() would have. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 49acacdc7cd3c1dcf5190a80ea9e6ca2ffa06cec Author: Al Viro Date: Wed May 7 14:05:50 2025 -0400 clone_mnt(): simplify the propagation-related logics The underlying rules are simple: * MNT_SHARED should be set iff ->mnt_group_id of new mount ends up non-zero. * mounts should be on the same ->mnt_share cyclic list iff they have the same non-zero ->mnt_group_id value. * CL_PRIVATE is mutually exclusive with MNT_SHARED, MNT_SLAVE, MNT_SHARED_TO_SLAVE and MNT_EXPIRE; the whole point of that thing is to get a clone of old mount that would *not* be on any namespace-related lists. The above allows to make the logics more straightforward; what's more, it makes the proof that invariants are maintained much simpler. The variant in mainline is safe (aside of a very narrow race with unsafe modification of mnt_flags right after we had the mount exposed in superblock's ->s_mounts; theoretically it can race with ro remount of the original, but it's not easy to hit), but proof of its correctness is really unpleasant. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit d08fa7f44ae7f5ad5c842e15f2412790736a6144 Author: Al Viro Date: Tue May 6 18:48:05 2025 -0400 don't set MNT_LOCKED on parentless mounts Originally MNT_LOCKED meant only one thing - "don't let this mount to be peeled off its parent, we don't want to have its mountpoint exposed". Accordingly, it had only been set on mounts that *do* have a parent. Later it got overloaded with another use - setting it on the absolute root had given free protection against umount(2) of absolute root (was possible to trigger, oopsed). Not a bad trick, but it ended up costing more than it bought us. Unfortunately, the cost included both hard-to-reason-about logics and a subtle race between mount -o remount,ro and mount --[r]bind - lockless &= ~MNT_LOCKED in the end of __do_loopback() could race with sb_prepare_remount_readonly() setting and clearing MNT_HOLD_WRITE (under mount_lock, as it should be). The race wouldn't be much of a problem (there are other ways to deal with it), but the subtlety is. Turns out that nobody except umount(2) had ever made use of having MNT_LOCKED set on absolute root. So let's give up on that trick, clever as it had been, add an explicit check in do_umount() and return to using MNT_LOCKED only for mounts that have a parent. It means that * clone_mnt() no longer copies MNT_LOCKED * copy_tree() sets it on submounts if their counterparts had been marked such, and does that right next to attach_mnt() in there, in the same mount_lock scope. * __do_loopback() no longer needs to strip MNT_LOCKED off the root of subtree it's about to return; no store, no race. * init_mount_tree() doesn't bother setting MNT_LOCKED on absolute root. * lock_mnt_tree() does not set MNT_LOCKED on the subtree's root; accordingly, its caller (loop in attach_recursive_mnt()) does not need to bother stripping that MNT_LOCKED on root. Note that lock_mnt_tree() setting MNT_LOCKED on submounts happens in the same mount_lock scope as __attach_mnt() (from commit_tree()) that makes them reachable. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 1a867d729f951f1f0ef73c94d2f739f959cd8699 Author: Al Viro Date: Tue Jun 17 21:10:02 2025 -0400 __attach_mnt(): lose the second argument It's always ->mnt_parent of the first one. What the function does is making a mount (with already set parent and mountpoint) visible - in mount hash and in the parent's list of children. IOW, it takes the existing rootwards linkage and sets the matching crownwards linkage. Renamed to make_visible(), while we are at it. Signed-off-by: Al Viro commit 9ed4b9eaeaa71cb0db4ec8460b5edd390aef58dd Author: Al Viro Date: Sun Jun 8 23:41:23 2025 -0400 dissolve_on_fput(): use anon_ns_root() that's the condition we are actually trying to check there... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 05da054d43770e229dfb0e185c15452eed14364c Author: Al Viro Date: Sun Jun 8 23:25:36 2025 -0400 new predicate: anon_ns_root(mount) checks if mount is the root of an anonymouns namespace. Switch open-coded equivalents to using it. For mounts that belong to anon namespace !mnt_has_parent(mount) is the same as mount == ns->root, and intent is more obvious in the latter form. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit e031251cb249f824ad67cb0b2fc18b68d5792b8d Author: Al Viro Date: Mon Jun 9 22:03:17 2025 -0400 constify is_local_mountpoint() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 9cb79ed60e38a0767b5b94c31bf1abf6518bc6b9 Author: Al Viro Date: Sun Jun 8 23:10:33 2025 -0400 new predicate: mount_is_ancestor() mount_is_ancestor(p1, p2) returns true iff there is a possibly empty ancestry chain from p1 to p2. Convert the open-coded checks. Unlike those open-coded variants it does not depend upon p1 not being root... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 592238c03ef9e44ad6031b671da869ebcbffa8dc Author: Al Viro Date: Thu May 8 17:28:00 2025 -0400 pnode: lift peers() into pnode.h it's going to be useful both in pnode.c and namespace.c Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 0e84653ea596bf9f5bfea58b0a34e0d9f72236c4 Author: Al Viro Date: Mon Apr 28 21:48:45 2025 -0400 constify mnt_has_parent() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit cf53a2d423c11ed70611e7b3f0878d6e419e348a Author: Al Viro Date: Sun Jun 1 00:34:32 2025 -0400 copy_tree(): don't set ->mnt_mountpoint on the root of copy It never made any sense - neither when copy_tree() had been introduced (2.4.11-pre5), nor at any point afterwards. Mountpoint is meaningless without parent mount and the root of copied tree has no parent until we get around to attaching it somewhere. At that time we'll have mountpoint set; before that we have no idea which dentry will be used as mountpoint. IOW, copy_tree() should just leave the default value. Signed-off-by: Al Viro commit ffdc52fbbd5835a936ad683c943d6d103a2d4514 Author: Al Viro Date: Fri Jun 20 22:46:55 2025 -0400 prevent mount hash conflicts Currently it's still possible to run into a pathological situation when two hashed mounts share both parent and mountpoint. That does not work well, for obvious reasons. We are not far from getting rid of that; the only remaining gap is attach_recursive_mnt() not being careful enough when sliding a tree under existing mount (for propagated copies or in 'beneath' case for the original one). To deal with that cleanly we need to be able to find overmounts (i.e. mounts on top of parent's root); we could do hash lookups or scan the list of children but either would be costly. Since one of the results we get from that will be prevention of multiple parallel overmounts, let's just bite the bullet and store a (non-counting) reference to overmount in struct mount. With that done, closing the hole in attach_recursive_mnt() becomes easy - we just need to follow the chain of overmounts before we change the mountpoint of the mount we are sliding things under. Signed-off-by: Al Viro commit 431cc1d8e2dab751b2b8f298a6d9caf83d8b49c3 Author: Al Viro Date: Fri Apr 25 22:18:12 2025 -0400 get rid of mnt_set_mountpoint_beneath() mnt_set_mountpoint_beneath() consists of attaching new mount side-by-side with the one we want to mount beneath (by mnt_set_mountpoint()), followed by mnt_change_mountpoint() shifting the the top mount onto the new one (by mnt_change_mountpoint()). Both callers of mnt_set_mountpoint_beneath (both in attach_recursive_mnt()) have the same form - in 'beneath' case we call mnt_set_mountpoint_beneath(), otherwise - mnt_set_mountpoint(). The thing is, expressing that as unconditional mnt_set_mountpoint(), followed, in 'beneath' case, by mnt_change_mountpoint() is just as easy. And these mnt_change_mountpoint() callers are similar to the ones we do when it comes to attaching propagated copies, which will allow more cleanups in the next commits. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 8c6ce8e86dd75db8e6c6a3e5a870e8d52dbab2d0 Author: Al Viro Date: Fri Apr 25 12:40:28 2025 -0400 attach_mnt(): expand in attach_recursive_mnt(), then lose the flag argument simpler that way - all but one caller pass false as 'beneath' argument, and that one caller is actually happier with the call expanded - the logics with choice of mountpoint is identical for 'moving' and 'attaching' cases, and now that is no longer hidden. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 9386dc09c5040047bee0da3e6f2e78034117dba7 Author: Rob Clark Date: Sun Jun 29 06:29:10 2025 -0700 drm/ci: Remove sdm845/cheza jobs These runners are no more. So remove the jobs. Signed-off-by: Rob Clark Reviewed-by: Dmitry Baryshkov commit 29ddce17e909779633f856ad1c2f111fbf71c0df Author: Weidong Wang Date: Fri Jun 27 19:03:06 2025 +0800 ASoC: codecs: Add calibration function to aw88399 chip Add calibration functionality to the aw88399 chip. When the chip is in calibration condition, calibration can be achieved by configuring the chip's internal DSP and save the calibration values in cali_re. Signed-off-by: Weidong Wang Link: https://patch.msgid.link/20250627110306.23488-1-wangweidong.a@awinic.com Signed-off-by: Mark Brown commit d6763e0abb43d550791eb66d2b91e82cb29807f9 Author: Alice Ryhl Date: Thu Jun 12 11:17:33 2025 +0000 rust: revocable: document why &T is not used in RevocableGuard When a reference appears in a function argument, the reference is assumed to be valid for the entire duration of that function call; this is called a stack protector [1]. Because of that, custom pointer types whose destructor may invalidate the pointee (i.e. they are more similar to Box than &T) cannot internally use a reference, and must instead use a raw pointer. This issue is something that is often missed during unsafe review. For examples, see [2] and [3]. To ensure that people don't try to simplify RevocableGuard by changing the raw pointer to a reference, add a comment to that effect. Link: https://perso.crans.org/vanille/treebor/protectors.html [1] Link: https://users.rust-lang.org/t/unsafe-code-review-semi-owning-weak-rwlock-t-guard/95706 [2] Link: https://lore.kernel.org/all/aEqdur4JTFa1V20U@google.com/ [3] Signed-off-by: Alice Ryhl Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250612-revocable-ptr-comment-v1-1-db36785877f6@google.com [ Adjusted title. - Miguel ] Signed-off-by: Miguel Ojeda commit fbcd4b7bf5c92f7d456eefcecac518023357cea4 Author: Alice Ryhl Date: Mon Jun 16 10:36:21 2025 +0000 rust: rbtree: add RBTree::is_empty In Rust Binder I need to be able to determine whether a red/black tree is empty. Thus, add a method for that operation to replace rbtree.iter().next().is_none() This is terrible, so add a method for this purpose. We do not add a RBTree::len method because computing the number of elements requires iterating the entire tree, but checking whether it is empty can be done cheaply. Signed-off-by: Alice Ryhl Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250616-rbtree-is-empty-v1-1-61f7cfb012e3@google.com [ Adjusted title. - Miguel ] Signed-off-by: Miguel Ojeda commit acc902de05b2b8229dc27820925b7573b6d2d34e Author: Andy Shevchenko Date: Fri Jun 27 21:25:00 2025 +0300 serial: 8250: Move CE4100 quirks to a module under 8250 driver There is inconvenient for maintainers and maintainership to have some quirks under architectural code. Move it to the specific quirk file like other 8250-compatible drivers do. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250627182743.1273326-1-andriy.shevchenko@linux.intel.com Signed-off-by: Greg Kroah-Hartman commit 5e40169f7aa85396448cd79b561cf13f39f8e005 Author: Christophe JAILLET Date: Sat Jun 28 08:35:06 2025 +0200 tty: serial: fsl_lpuart: Constify struct lpuart_soc_data 'struct lpuart_soc_data' are not modified in this driver. Constifying these structures moves some data to a read-only section, so increases overall security. This also makes the code more consistent. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 172668 23470 128 196266 2feaa drivers/tty/serial/fsl_lpuart.o After: ===== text data bss dec hex filename 172924 23214 128 196266 2feaa drivers/tty/serial/fsl_lpuart.o Signed-off-by: Christophe JAILLET Reviewed-by: Sherry Sun Link: https://lore.kernel.org/r/93dc860a06f92236db283c71be0640cc477b7291.1751092467.git.christophe.jaillet@wanadoo.fr Signed-off-by: Greg Kroah-Hartman commit d2db0d78154442fb89165edf8836bf2644c6c58d Author: Frank Li Date: Mon Jun 2 10:27:45 2025 -0400 dt-bindings: serial: 8250: allow clock 'uartclk' and 'reg' for nxp,lpc1850-uart Allow clock 'uartclk' and 'reg' for nxp,lpc1850-uart to align existed driver and dts. It is really old platform. Keep the same restriction for others. Allow dmas and dma-names property, which allow maxItems 4 because very old platform (arch/arm/boot/dts/nxp/lpc/lpc18xx.dtsi) use duplicate "tx", "rx", "tx", "rx" as dma-names. Fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/lpc/lpc4337-ciaa.dtb: serial@40081000 (nxp,lpc1850-uart): clock-names: ['uartclk', 'reg'] is too long Signed-off-by: Frank Li Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250602142745.942568-1-Frank.Li@nxp.com Signed-off-by: Greg Kroah-Hartman commit a3d0b7a13b542ec6514b68ba4769b8e7fadba7c1 Merge: fbb3bdf541e634 82d6229e7e5c5f Author: Alexander Gordeev Date: Sun Jun 29 13:21:16 2025 +0200 Merge branch 'uaccess-key' into features Heiko Carstens says: =================== A rather large series which is supposed to fix the crash below[1], which was seen when running the memop kernel kvm selftest. Problem is that cmpxchg_user_key() is executing code with a non-default key. If a system is IPL'ed with "LOAD NORMAL", and in addition the previous system used storage keys where the fetch-protection bit is set for some pages, and the cmpxchg_user_key() is located within such page a protection exception will happen when executing such code. Idea of this series is to register all code locations running with a non-default key at compile time. All functions, which run with a non-default key, then must explicitly call an init function which initializes the storage key of all pages containing such code locations with default key, which prevents such protection exceptions. Furthermore all functions containing code which may be executed with a non-default access key must be marked with __kprobes to prevent out-of-line execution of any instruction of such functions, which would result in the same problem. By default the kernel will not issue any storage key changing instructions like before, which will preserve the keyless-subset mode optimizations in hosts. Other possible implementations which I discarded: - Moving the code to an own section. This would require an s390 specific change to modpost.c, which complains about section mismatches (EX_TABLE entries in non-default text section). No other architecture has something similar, so let's keep this architecture specific hack local. - Just apply the default storage key to the whole kprobes text section. However this would add special s390 semantics to the kprobes text section, which no other architecture has. History has shown that such hacks fire back sooner or later. Furthermore, and to keep this whole stuff quite simple, this only works for code locations in core kernel code, not within modules. After this series there is no module code left with such code, and as of now I don't see any new kernel code which runs with a non-default access key. Note: the original crash can be reproduced by replacing page_set_storage_key(real, PAGE_DEFAULT_KEY, 1); with page_set_storage_key(real, 8, 1); in arch/s390/kernel/skey.c:__skey_regions_initialize() And then run tools/testing/selftests/kvm/s390/memop from the kernel selftests. [1]: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 000000000000080b Fault in home space mode while using kernel ASCE. AS:0000000002528007 R3:00000001ffffc007 S:00000001ffffb801 P:000000000000013d Oops: 0004 ilc:1 [#1]SMP Modules linked in: CPU: 3 UID: 0 PID: 791 Comm: memop Not tainted 6.16.0-rc1-00006-g3b568201d0a6-dirty #11 NONE Hardware name: IBM 3931 A01 704 (z/VM 7.4.0) Krnl PSW : 0794f00180000000 000003ffe0f4d91e (__cmpxchg_user_key1+0xbe/0x190) R:0 T:1 IO:1 EX:1 Key:9 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 Krnl GPRS: 070003ffdfbf6af0 0000000000070000 0000000095b5a300 0000000000000000 00000000f1000000 0000000000000000 0000000000000090 0000000000000000 0000000000000040 0000000000000018 000003ff9b23d000 0000037fe0ef7bd8 000003ffdfbf7500 00000000962e4000 0000037f00ffffff 0000037fe0ef7aa0 Krnl Code: 000003ffe0f4d912: ad03f0a0 stosm 160(%r15),3 000003ffe0f4d916: a7780000 lhi %r7,0 #000003ffe0f4d91a: b20a6000 spka 0(%r6) >000003ffe0f4d91e: b2790100 sacf 256 000003ffe0f4d922: a56f0080 llill %r6,128 000003ffe0f4d926: 5810a000 l %r1,0(%r10) 000003ffe0f4d92a: 141e nr %r1,%r14 000003ffe0f4d92c: c0e7ffffffff xilf %r14,4294967295 Call Trace: [<000003ffe0f4d91e>] __cmpxchg_user_key1+0xbe/0x190 [<000003ffe0189c6e>] cmpxchg_guest_abs_with_key+0x2fe/0x370 [<000003ffe016d28e>] kvm_s390_vm_mem_op_cmpxchg+0x17e/0x350 [<000003ffe0173284>] kvm_arch_vm_ioctl+0x354/0x6f0 [<000003ffe015fedc>] kvm_vm_ioctl+0x2cc/0x6e0 [<000003ffe05348ae>] vfs_ioctl+0x2e/0x70 [<000003ffe0535e70>] __s390x_sys_ioctl+0xe0/0x100 [<000003ffe0f40f06>] __do_syscall+0x136/0x340 [<000003ffe0f4cb2e>] system_call+0x6e/0x90 Last Breaking-Event-Address: [<000003ffe0f4d896>] __cmpxchg_user_key1+0x36/0x190 =================== Signed-off-by: Alexander Gordeev commit 82d6229e7e5c5f8be09a0b38bbcfeece5d2d28c5 Author: Heiko Carstens Date: Wed Jun 25 13:25:28 2025 +0200 s390/uaccess: Merge cmpxchg_user_key() inline assemblies The inline assemblies for __cmpxchg_user_key1() and __cmpxchg_user_key2() are identical. Get rid of the duplication and provide a common helper function. Suggested-by: Mete Durlu Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit d2b73ce90a7141d5aa34a52de82d69fbb68efc30 Author: Heiko Carstens Date: Mon Jun 16 17:00:32 2025 +0200 s390/uaccess: Prevent kprobes on cmpxchg_user_key() functions Code regions within cmpxchg_user_key() functions may be executed with a non-default access key, which may lead to a protection exception if the corresponding page has the fetch-protection bit enabled. There is code in place which initializes the storage keys of such pages when needed. However there is also the possibility of out-of-line execution of such code in case a kprobe is set within such a region. To avoid this problem prevent that any kprobe can be set within the cmpxchg_user_key() functions. Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit b13c190c6da49043c55708cd62419d762744af18 Author: Heiko Carstens Date: Mon Jun 16 17:00:31 2025 +0200 s390/uaccess: Initialize code pages executed with non-default access key cmpxchg_user_key() may be executed with a non-zero key; if then the storage key of the page which belongs to the cmpxchg_user_key() code contains a key with fetch-protection enabled the result is a protection exception: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000000000000 TEID: 000000000000080b Fault in home space mode while using kernel ASCE. AS:0000000002528007 R3:00000001ffffc007 S:00000001ffffb801 P:000000000000013d Oops: 0004 ilc:1 [#1]SMP Modules linked in: CPU: 3 UID: 0 PID: 791 Comm: memop Not tainted 6.16.0-rc1-00006-g3b568201d0a6-dirty #11 NONE Hardware name: IBM 3931 A01 704 (z/VM 7.4.0) Krnl PSW : 0794f00180000000 000003ffe0f4d91e (__cmpxchg_user_key1+0xbe/0x190) R:0 T:1 IO:1 EX:1 Key:9 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3 Krnl GPRS: 070003ffdfbf6af0 0000000000070000 0000000095b5a300 0000000000000000 00000000f1000000 0000000000000000 0000000000000090 0000000000000000 0000000000000040 0000000000000018 000003ff9b23d000 0000037fe0ef7bd8 000003ffdfbf7500 00000000962e4000 0000037f00ffffff 0000037fe0ef7aa0 Krnl Code: 000003ffe0f4d912: ad03f0a0 stosm 160(%r15),3 000003ffe0f4d916: a7780000 lhi %r7,0 #000003ffe0f4d91a: b20a6000 spka 0(%r6) >000003ffe0f4d91e: b2790100 sacf 256 000003ffe0f4d922: a56f0080 llill %r6,128 000003ffe0f4d926: 5810a000 l %r1,0(%r10) 000003ffe0f4d92a: 141e nr %r1,%r14 000003ffe0f4d92c: c0e7ffffffff xilf %r14,4294967295 Call Trace: [<000003ffe0f4d91e>] __cmpxchg_user_key1+0xbe/0x190 [<000003ffe0189c6e>] cmpxchg_guest_abs_with_key+0x2fe/0x370 [<000003ffe016d28e>] kvm_s390_vm_mem_op_cmpxchg+0x17e/0x350 [<000003ffe0173284>] kvm_arch_vm_ioctl+0x354/0x6f0 [<000003ffe015fedc>] kvm_vm_ioctl+0x2cc/0x6e0 [<000003ffe05348ae>] vfs_ioctl+0x2e/0x70 [<000003ffe0535e70>] __s390x_sys_ioctl+0xe0/0x100 [<000003ffe0f40f06>] __do_syscall+0x136/0x340 [<000003ffe0f4cb2e>] system_call+0x6e/0x90 Last Breaking-Event-Address: [<000003ffe0f4d896>] __cmpxchg_user_key1+0x36/0x190 Fix this by defining all code ranges within cmpxchg_user_key() functions which may be executed with a non-default key and explicitly initialize storage keys by calling skey_regions_initialize(). Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit ee417a84d005f90b6c2e572dbad00a25f9fb7660 Author: Heiko Carstens Date: Mon Jun 16 17:00:30 2025 +0200 s390/skey: Provide infrastructure for executing with non-default access key The current assumption is that kernel code is always executed with access key zero, which means that storage key protection does not apply. However this assumption is not correct: cmpxchg_user_key() may be executed with a non-zero key; if then the storage key of the page which belongs to the cmpxchg_user_key() code contains a key with fetch-protection enabled the result is a protection exception. For several performance optimizations storage keys are not initialized on system boot. To keep these optimizations add infrastructure which allows to define code ranges within functions which are executed with a non-default key. When such code is executed such functions must explicitly call skey_regions_initialize(). This will initialize all storage keys belonging to such code ranges in a way that no protection exceptions happen when the code is executed with a non-default access key. Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 6fe0ea914d73a32b27db9eff5259e59c28633eac Author: Heiko Carstens Date: Mon Jun 16 17:00:29 2025 +0200 s390/uaccess: Make cmpxchg_user_key() library code Move cmpxchg_user_key() handling to uaccess library code. The generated code is large in any case so that there is hardly any benefit if it is inlined. Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit ac5bf0665011db2b4aa167e971195a166e0d8d2f Author: Heiko Carstens Date: Mon Jun 16 17:00:28 2025 +0200 s390/page: Add memory clobber to page_set_storage_key() Add memory clobbers to the page_set_storage_key() inline assemblies. This allows for data dependencies from other code, which is important to prevent the compiler from reordering instructions if required. Note that this doesn't fix a bug in existing code; this is just a prerequisite for upcoming code changes. Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 839d364e41c064cb8bee1c028822f1e97b206ef6 Author: Heiko Carstens Date: Mon Jun 16 17:00:27 2025 +0200 s390/page: Cleanup page_set_storage_key() inline assemblies Add extra lines, indentations, and symbolic names for operands in order to make the two page_set_storage_key() inline assemblies a bit more readable. Reviewed-by: Claudio Imbrenda Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 20a0c20f82acf46d5731a11743e7c7ac4de25db8 Author: Dan Carpenter Date: Wed Jun 25 10:23:05 2025 -0500 octeontx2-af: Fix error code in rvu_mbox_init() The error code was intended to be -EINVAL here, but it was accidentally changed to returning success. Set the error code. Fixes: e53ee4acb220 ("octeontx2-af: CN20k basic mbox operations and structures") Signed-off-by: Dan Carpenter Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 066147e06bb8d0accb0dce25f5f8d4e0f7ed7b33 Author: Vignesh Raman Date: Mon May 5 20:12:43 2025 +0530 drm/ci: uprev mesa and ci-templates The current s3cp stopped working after the migration. Update to the latest mesa and ci-templates to get s3cp working again and adapt to recent changes in mesa-ci. Acked-by: Daniel Stone Acked-by: Helen Koike Signed-off-by: Vignesh Raman Signed-off-by: Rob Clark commit b5301c8ed71e424bafec3ad79fdd838425b9d281 Author: Vignesh Raman Date: Wed Apr 30 07:21:00 2025 +0530 drm/ci: python-artifacts: use shallow clone The python-artifacts job has a timeout of 10 minutes, which causes build failures as it was unable to clone the repository within the specified limits. Set GIT_DEPTH to 10 to speed up cloning and avoid build failures due to timeouts when fetching the full repository. Acked-by: Daniel Stone Acked-by: Helen Koike Signed-off-by: Vignesh Raman Signed-off-by: Rob Clark commit 74f1af95820fc2ee580a775a3a17c416db30b38c Merge: d3deabe4c61987 f41830c57bb8e7 Author: Rob Clark Date: Sat Jun 28 19:54:49 2025 -0700 Merge remote-tracking branch 'drm/drm-next' into msm-next Back-merge drm-next to (indirectly) get arm-smmu updates for making stall-on-fault more reliable. Signed-off-by: Rob Clark commit a6a2a8a42972476ecff61d2ffabaa1e8ae162f34 Author: Thomas Weißschuh Date: Mon Jun 23 23:25:39 2025 +0200 tools/nolibc: MIPS: add support for N64 and N32 ABIs Add support for the MIPS 64bit N64 and ILP32 N32 ABIs. In addition to different byte orders and ABIs there are also different releases of the MIPS architecture. To avoid blowing up the test matrix, only add a subset of all possible test combinations. Signed-off-by: Thomas Weißschuh Tested-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20250623-nolibc-mips-n32-v3-4-6ae2d89f4259@weissschuh.net commit 69891dca804c08c13f9d490f9bea060149aef10e Author: Thomas Weißschuh Date: Mon Jun 23 23:25:38 2025 +0200 tools/nolibc: MIPS: drop noreorder option There are no more statements in the assembly code which would require the usage of ".set noreorder". Remove the option. This also allows removal of the manual "nop" instruction in the delay slot. Suggested-by: Maciej W. Rozycki Link: https://lore.kernel.org/lkml/alpine.DEB.2.21.2502172208570.65342@angie.orcam.me.uk/ Signed-off-by: Thomas Weißschuh Tested-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20250623-nolibc-mips-n32-v3-3-6ae2d89f4259@weissschuh.net commit 36aab1693ade824640318746c2cbf085b687bad4 Author: Thomas Weißschuh Date: Mon Jun 23 23:25:37 2025 +0200 tools/nolibc: MIPS: drop manual stack pointer alignment The stack pointer is already aligned by the kernel to a multiple of 16. All modifications of the register have been removed from the entrypoint, so the manual realignment is unnecessary. Drop the manual alignment. Suggested-by: Maciej W. Rozycki Link: https://lore.kernel.org/lkml/alpine.DEB.2.21.2502161523290.65342@angie.orcam.me.uk/ Signed-off-by: Thomas Weißschuh Tested-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20250623-nolibc-mips-n32-v3-2-6ae2d89f4259@weissschuh.net commit f1e303348d137c710cf3fbf2eadf9d273a204987 Author: Thomas Weißschuh Date: Mon Jun 23 23:25:36 2025 +0200 tools/nolibc: MIPS: drop $gp setup The setup of the global pointer "$gp" register was necessary when the C entrypoint was called through "jal ". However since commit 0daf8c86a451 ("tools/nolibc: mips: load current function to $t9") "jalr" is used instead which does not require "$gp". Remove the unnecessary $gp setup, simplifying the code and opening the road for some other cleanups. Suggested-by: Maciej W. Rozycki Link: https://lore.kernel.org/lkml/alpine.DEB.2.21.2502172208570.65342@angie.orcam.me.uk/ Signed-off-by: Thomas Weißschuh Tested-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/20250623-nolibc-mips-n32-v3-1-6ae2d89f4259@weissschuh.net commit f5d3ef25d238901a76fe0277787afa44f7714739 Author: Danilo Krummrich Date: Thu Jun 26 22:00:41 2025 +0200 rust: devres: get rid of Devres' inner Arc So far Devres uses an inner memory allocation and reference count, i.e. an inner Arc, in order to ensure that the devres callback can't run into a use-after-free in case where the Devres object is dropped while the devres callback runs concurrently. Instead, use a completion in order to avoid a potential UAF: In Devres::drop(), if we detect that we can't remove the devres action anymore, we wait for the completion that is completed from the devres callback. If, in turn, we were able to successfully remove the devres action, we can just go ahead. This, again, allows us to get rid of the internal Arc, and instead let Devres consume an `impl PinInit` in order to return an `impl PinInit, E>`, which enables us to get away with less memory allocations. Additionally, having the resulting explicit synchronization in Devres::drop() prevents potential subtle undesired side effects of the devres callback dropping the final Arc reference asynchronously within the devres callback. Reviewed-by: Benno Lossin Reviewed-by: Boqun Feng Link: https://lore.kernel.org/r/20250626200054.243480-4-dakr@kernel.org [ Move '# Invariants' below '# Examples'. - Danilo ] Signed-off-by: Danilo Krummrich commit 46ae8fd7386abf809355d1857abac5cf2d7c3f62 Author: Danilo Krummrich Date: Thu Jun 26 22:00:40 2025 +0200 rust: devres: replace Devres::new_foreign_owned() Replace Devres::new_foreign_owned() with devres::register(). The current implementation of Devres::new_foreign_owned() creates a full Devres container instance, including the internal Revocable and completion. However, none of that is necessary for the intended use of giving full ownership of an object to devres and getting it dropped once the given device is unbound. Hence, implement devres::register(), which is limited to consume the given data, wrap it in a KBox and drop the KBox once the given device is unbound, without any other synchronization. Cc: Dave Airlie Cc: Simona Vetter Cc: Viresh Kumar Acked-by: Viresh Kumar Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250626200054.243480-3-dakr@kernel.org Signed-off-by: Danilo Krummrich commit ce7c22b2e1fb1db467d33bd050546941ce82f21f Author: Danilo Krummrich Date: Thu Jun 26 22:00:39 2025 +0200 rust: revocable: support fallible PinInit types Currently, Revocable::new() only supports infallible PinInit implementations, i.e. impl PinInit. This has been sufficient so far, since users such as Devres do not support fallibility. Since this is about to change, make Revocable::new() generic over the error type E. Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Acked-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250626200054.243480-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 14648fc30e679b53cff87f20a8ed747bf3db43a3 Merge: 64888dfdfac7f7 e832374ccadf4d Author: Danilo Krummrich Date: Sat Jun 28 17:25:23 2025 +0200 Merge tag 'pin-init-v6.17-result-blanket' of https://github.com/Rust-for-Linux/linux.git pin-init blanket implementation changes for v6.17 Remove the error from the blanket implementations for `[Pin]Init` and add implementations for `Result`. (Subsequent Devres improvements depend on those pin-init features.) commit e35a5d814525006f043b29bffd1bbdcb549b23c5 Author: Dan Carpenter Date: Wed Jun 25 10:21:53 2025 -0500 usb: gadget: u_serial: remove some dead code There is no need to check if "port" is NULL. We already verified that it is non-NULL. It's a stack variable and can't be modified by a different thread. Delete this dead code. Signed-off-by: Dan Carpenter Reviewed-by: Prashanth K Link: https://lore.kernel.org/r/685c1413.050a0220.1a8223.d0b9@mx.google.com Signed-off-by: Greg Kroah-Hartman commit 246fef761a5734285ec2c1e61dd9a3d8943d33a8 Author: Dmitry Baryshkov Date: Sun Jun 8 19:07:31 2025 +0300 dt-bindings: usb: genesys,gl850g: add downstream facing ports In order to describe connections between Genesys GL850G hub and corresponding Type-C connectors, follow example of RTS5411 and describe downstream facing ports. Unline normal case of ports being connected to a USB device, hotplug ports use OF graph representation. Signed-off-by: Dmitry Baryshkov Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250608-genesys-ports-v1-2-09ca19f6838e@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit ed7513dfb3e1a653346a7f8bbee862a4cfc165c4 Author: Dmitry Baryshkov Date: Sun Jun 8 19:07:30 2025 +0300 dt-bindings: usb: genesys,gl850g: use usb-hub.yaml In order to reduce duplication, switch GL850G to use USB hub bindings instead of using simple usb-device.yaml Signed-off-by: Dmitry Baryshkov Reviewed-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250608-genesys-ports-v1-1-09ca19f6838e@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit a559434880b320b83733d739733250815aecf1b0 Author: Harry Austen Date: Fri Jun 27 13:30:35 2025 -0700 drm/xe: Allow dropping kunit dependency as built-in Fix Kconfig symbol dependency on KUNIT, which isn't actually required for XE to be built-in. However, if KUNIT is enabled, it must be built-in too. Fixes: 08987a8b6820 ("drm/xe: Fix build with KUNIT=m") Cc: Lucas De Marchi Cc: Thomas Hellström Cc: Jani Nikula Cc: Maarten Lankhorst Signed-off-by: Harry Austen Reviewed-by: Lucas De Marchi Acked-by: Randy Dunlap Tested-by: Randy Dunlap Link: https://lore.kernel.org/r/20250627-xe-kunit-v2-2-756fe5cd56cf@intel.com Signed-off-by: Lucas De Marchi commit 05f3af5905d5dbb758db9dae0a103b22b441ad67 Author: Lucas De Marchi Date: Fri Jun 27 13:30:34 2025 -0700 drm/xe: Fix conflicting intel_pcode_* symbols If CONFIG_DRM_XE_DISPLAY is set, the xe module can only be built as module to avoid duplicate symbols from i915. The interface for pcode was added without considering that, so the build breaks if both xe and i915 are built-in. Since the intel_pcode_* functions should only be called from the display side (xe side should call the xe interface directly) and there's already a protection in Kconfig to avoid the problematic configuration, ifdef it out in case CONFIG_DRM_XE_DISPLAY is disabled. Closes: https://lore.kernel.org/r/3667a992-a24b-4e49-aab2-5ca73f2c0a56@infradead.org Fixes: d9465cc8ac2d ("drm/xe/pcode: add struct drm_device based interface") Acked-by: Jani Nikula Reviewed-by: Randy Dunlap Tested-by: Randy Dunlap Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250627-xe-kunit-v2-1-756fe5cd56cf@intel.com Signed-off-by: Lucas De Marchi commit 64888dfdfac7f7d2013a9734755c11322ff6eaa5 Author: Christian Schrefl Date: Tue Jun 10 22:27:55 2025 +0200 rust: implement `Wrapper` for `Opaque` Moves the implementation for `pin-init` from an associated function to the trait function of the `Wrapper` trait and extends the implementation to support pin-initializers with error types. Adds a use for the `Wrapper` trait in `revocable.rs`, to use the new `pin-init` function. This is currently the only usage in the kernel. Reviewed-by: Gerald Wisböck Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Acked-by: Miguel Ojeda Signed-off-by: Christian Schrefl Link: https://lore.kernel.org/r/20250610-b4-rust_miscdevice_registrationdata-v6-1-b03f5dfce998@gmail.com Signed-off-by: Danilo Krummrich commit 0dab138d0f4c0b3ce7f835d577e52a2b5ebdd536 Author: Danilo Krummrich Date: Thu Jun 26 15:24:46 2025 +0200 rust: devres: require T: Send for Devres Due to calling Revocable::revoke() from Devres::devres_callback() T may be dropped from Devres::devres_callback() and hence must be Send. Fix this by adding the corresponding bound to Devres and DevresInner. Reported-by: Boqun Feng Closes: https://lore.kernel.org/lkml/aFzI5L__OcB9hqdG@Mac.home/ Fixes: 76c01ded724b ("rust: add devres abstraction") Reviewed-by: Boqun Feng Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250626132544.72866-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit beead7eea896e5bc803027d1f3e0d0f9c3b9d196 Author: Eric Dumazet Date: Fri Jun 27 11:46:41 2025 +0000 net: ipv4: guard ip_mr_output() with rcu syzbot found at least one path leads to an ip_mr_output() without RCU being held. Add guard(rcu)() to fix this in a concise way. WARNING: CPU: 0 PID: 0 at net/ipv4/ipmr.c:2302 ip_mr_output+0xbb1/0xe70 net/ipv4/ipmr.c:2302 Call Trace: igmp_send_report+0x89e/0xdb0 net/ipv4/igmp.c:799 igmp_timer_expire+0x204/0x510 net/ipv4/igmp.c:-1 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x61a/0x860 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x286/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/softirq.c:453 [inline] __irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:680 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1050 Fixes: 35bec72a24ac ("net: ipv4: Add ip_mr_output()") Reported-by: syzbot+f02fb9e43bd85c6c66ae@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/685e841a.a00a0220.129264.0002.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Cc: Petr Machata Cc: Roopa Prabhu Cc: Nikolay Aleksandrov Cc: Benjamin Poirier Cc: Ido Schimmel Reviewed-by: Neal Cardwell Reviewed-by: Nikolay Aleksandrov Reviewed-by: Petr Machata Signed-off-by: David S. Miller commit 8733bf4c46f2546bc9225951ae2fee306bbb8e25 Author: Javier Martinez Canillas Date: Fri Jun 27 13:33:04 2025 +0200 MAINTAINERS: Add missing sysfb files to firmware framebuffers entry The commit d391c5827107 ("drivers/firmware: move x86 Generic System Framebuffers support") moved the sysfb*.c source files from arch/x86 to drivers/firmware, because the logic wasn't x86 specific and could be used by other architectures. But the drivers/firmware path is not listed in MAINTAINERS, which led to the files being orphaned and scripts/get_maintainer.pl not listing a mailing list to Cc anymore. Now that we have an entry for all the firmware-provided framebuffer code, add the missing sysfb files to make sure correct folks and list is Cc'ed. Fixes: d391c5827107 ("drivers/firmware: move x86 Generic System Framebuffers support") Reported-by: Andy Shevchenko Closes: https://lore.kernel.org/lkml/aF53djlieUNF_-aV@smile.fi.intel.com/ Reviewed-by: Andy Shevchenko Reviewed-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250627113328.2703491-1-javierm@redhat.com Signed-off-by: Javier Martinez Canillas commit 1aa93cfb1288a141c64e923dbaaa277616f0f7d5 Author: Jacopo Mondi Date: Mon Feb 26 14:25:43 2024 +0100 drm/fourcc: Add RGB161616 and BGR161616 formats Add FourCC definitions for the 48-bit RGB/BGR formats to the DRM/KMS uapi. The format will be used by the Raspberry Pi PiSP Back End, supported by a V4L2 driver in kernel space and by libcamera in userspace, which uses the DRM FourCC identifiers. Signed-off-by: Jacopo Mondi Reviewed-by: Rob Clark Reviewed-by: Simon Ser Reviewed-by: Naushir Patuck Link: https://lore.kernel.org/r/20240226132544.82817-1-jacopo.mondi@ideasonboard.com Signed-off-by: Javier Martinez Canillas commit c4b1be928ea05add0e0f9334e5bc44932395782e Author: Eduard Zingerman Date: Thu Jun 26 18:55:39 2025 -0700 selftests/bpf: bpf_rdonly_cast u{8,16,32,64} access tests Tests with aligned and misaligned memory access of different sizes via pointer returned by bpf_rdonly_cast(). Suggested-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250627015539.1439656-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit ffaff1804e2ca1e88caa9d2e13ac6b4b7ecf011c Author: Mykyta Yatsenko Date: Fri Jun 27 15:43:42 2025 +0100 selftests/bpf: improve error messages in veristat Return error if preset parsing fails. Avoid proceeding with veristat run if preset does not parse. Before: ``` ./veristat set_global_vars.bpf.o -G "arr[999999999999999999999] = 1" Failed to parse value '999999999999999999999' Processing 'set_global_vars.bpf.o'... File Program Verdict Duration (us) Insns States Program size Jited size --------------------- ---------------- ------- ------------- ----- ------ ------------ ---------- set_global_vars.bpf.o test_set_globals success 27 64 0 82 0 --------------------- ---------------- ------- ------------- ----- ------ ------------ ---------- Done. Processed 1 files, 0 programs. Skipped 1 files, 0 programs. ``` After: ``` ./veristat set_global_vars.bpf.o -G "arr[999999999999999999999] = 1" Failed to parse value '999999999999999999999' Failed to parse global variable presets: arr[999999999999999999999] = 1 ``` Improve error messages: * If preset struct member can't be found. * Array index out of bounds Extract rtrim function. Signed-off-by: Mykyta Yatsenko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250627144342.686896-1-mykyta.yatsenko5@gmail.com Signed-off-by: Alexei Starovoitov commit 43a8440f396951eaae85db478b30a53aea8cda7d Author: Bartosz Golaszewski Date: Tue Jun 10 11:40:00 2025 +0200 Input: adp5589 - use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Acked-by: Michael Hennerich Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-input-v1-3-5875240b48d8@linaro.org Signed-off-by: Dmitry Torokhov commit 687f0d0ee5cf3f9efd69e58da8f22e10590cd76c Author: Bartosz Golaszewski Date: Tue Jun 10 11:39:59 2025 +0200 Input: adp5588 - use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Acked-by: Michael Hennerich Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-input-v1-2-5875240b48d8@linaro.org Signed-off-by: Dmitry Torokhov commit 4aaadf94aab09ccc95f14f75e11e045a1530d364 Author: Bartosz Golaszewski Date: Tue Jun 10 11:39:58 2025 +0200 Input: ad7879 - use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Acked-by: Michael Hennerich Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-input-v1-1-5875240b48d8@linaro.org Signed-off-by: Dmitry Torokhov commit 36b624b992ff692f8a3a1c4c078827c576d72efb Author: Frank Li Date: Wed Jun 25 12:34:28 2025 -0400 dt-bindings: input: touchscreen: convert lpc32xx-tsc.txt to yaml format Convert lpc32xx-tsc.txt to yaml format. Additional changes: - add clocks and put it into required list to match existed lpc32xx.dtsi. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250625163431.2543597-1-Frank.Li@nxp.com Signed-off-by: Dmitry Torokhov commit f22e6fdf7b3395a627a1ad06ab70835015f7ff17 Merge: 4f5710edf17ad5 5f21226b79fd8f Author: Jakub Kicinski Date: Fri Jun 27 16:56:02 2025 -0700 Merge branch 'octeontx2-pf-extend-link-modes-support' Hariprasad Kelam says: ==================== Octeontx2-pf: extend link modes support This series of patches adds multi advertise mode support along with other improvements in link mode management code flow. Patch1: Currently all SGMII modes 10/100/1000baseT are mapped with single firmware mode. This patch updates these link modes with corresponding firmware modes. Patch2: Due to limitation in current kernel <-> firmware communication, link modes are divided into multiple groups, and identified with their group index. Patch3: Adds support for multi advertise mode. ==================== Link: https://patch.msgid.link/20250625092107.9746-1-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit 5f21226b79fd8fd95acc9bfa8eedf8ee6ceb4088 Author: Hariprasad Kelam Date: Wed Jun 25 14:51:07 2025 +0530 Octeontx2-pf: ethtool: support multi advertise mode Current implementation considers only first advertise mode and passes the same to firmware to process. This patch extends code such that user can advertise multiple modes on the given interface. Below are high level changes: 1. Remove unnecessary speed/duplex/autoneg validation as its already verified as part of "set_link_ksettings" 2. Since scratch csr framework designed to support single mode at a time, use "shared firmware data" for multi mode support. Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20250625092107.9746-4-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit ad97e72f1c30c0353aa06e7886182a4a209aba3a Author: Hariprasad Kelam Date: Wed Jun 25 14:51:06 2025 +0530 Octeontx2-af: Introduce mode group index Kernel and firmware communicates via scratch register which is 64 bit in size. [MODE_ID PORT AUTONEG DUPLEX SPEED CMD_ID OWNERSHIP ] 63-22 21-14 13 12 11-8 7-2 1-0 The existing MODE_ID bitmap can only support up to 42 modes. To resolve the issue, the unused port field is modified as below uint64_t reserved2:6; uint64_t mode_group_idx:2; 'mode_group_idx' categorize the mode ID range to accommodate more modes. To specify mode ID range of 0 - 41, this field will be 0. To specify mode ID range of 42 - 83, this field will be 1. mode ID will be still mentioned as 1 << (0 - 41). But the mode_group_idx decides the actual mode range Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20250625092107.9746-3-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit 1df77da01b63a2f9a9c74630581448007a73f3c1 Author: Hariprasad Kelam Date: Wed Jun 25 14:51:05 2025 +0530 Octeontx-pf: Update SGMII mode mapping Current implementation maps ethtool link modes 10baseT/100baseT/1000baseT to single firmware mode SGMII. This create a problem for end users who want to advertise only one speed among them. This patch addresses the issue by mapping each ethtool link mode to a corresponding firmware mode also updates new modes supported by firmware. Signed-off-by: Hariprasad Kelam Link: https://patch.msgid.link/20250625092107.9746-2-hkelam@marvell.com Signed-off-by: Jakub Kicinski commit 4f5710edf17ad5472a0a110b0cf0960e64dc706a Merge: 8c72b2a2edd5cf 5bcea241335b82 Author: Jakub Kicinski Date: Fri Jun 27 16:38:05 2025 -0700 Merge branch 'dpll-add-reference-sync-feature' Arkadiusz Kubalewski says: ==================== dpll: add Reference SYNC feature The device may support the Reference SYNC feature, which allows the combination of two inputs into a input pair. In this configuration, clock signals from both inputs are used to synchronize the DPLL device. The higher frequency signal is utilized for the loop bandwidth of the DPLL, while the lower frequency signal is used to syntonize the output signal of the DPLL device. This feature enables the provision of a high-quality loop bandwidth signal from an external source. A capable input provides a list of inputs that can be bound with to create Reference SYNC. To control this feature, the user must request a desired state for a target pin: use ``DPLL_PIN_STATE_CONNECTED`` to enable or ``DPLL_PIN_STATE_DISCONNECTED`` to disable the feature. An input pin can be bound to only one other pin at any given time. Verify pins bind state/capabilities: $ ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/dpll.yaml \ --do pin-get \ --json '{"id":0}' {'board-label': 'CVL-SDP22', 'id': 0, [...] 'reference-sync': [{'id': 1, 'state': 'disconnected'}], [...]} Bind the pins by setting connected state between them: $ ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/dpll.yaml \ --do pin-set \ --json '{"id":0, "reference-sync":{"id":1, "state":"connected"}}' Verify pins bind state: $ ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/dpll.yaml \ --do pin-get \ --json '{"id":0}' {'board-label': 'CVL-SDP22', 'id': 0, [...] 'reference-sync': [{'id': 1, 'state': 'connected'}], [...]} Unbind the pins by setting disconnected state between them: $ ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/dpll.yaml \ --do pin-set \ --json '{"id":0, "reference-sync":{"id":1, "state":"disconnected"}}' ==================== Link: https://patch.msgid.link/20250626135219.1769350-1-arkadiusz.kubalewski@intel.com Signed-off-by: Jakub Kicinski commit 5bcea241335b82b0c54df65b5829e9b0f37e4237 Author: Arkadiusz Kubalewski Date: Thu Jun 26 15:52:19 2025 +0200 ice: add ref-sync dpll pins Implement reference sync input pin get/set callbacks, allow user space control over dpll pin pairs capable of reference sync support. Reviewed-by: Milena Olech Signed-off-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20250626135219.1769350-4-arkadiusz.kubalewski@intel.com Signed-off-by: Jakub Kicinski commit 58256a26bfb37a94738dd65618b1f31f460f8d91 Author: Arkadiusz Kubalewski Date: Thu Jun 26 15:52:18 2025 +0200 dpll: add reference sync get/set Define function for reference sync pin registration and callback ops to set/get current feature state. Implement netlink handler to fill netlink messages with reference sync pin configuration of capable pins (pin-get). Implement netlink handler to call proper ops and configure reference sync pin state (pin-set). Reviewed-by: Przemek Kitszel Reviewed-by: Milena Olech Reviewed-by: Jiri Pirko Signed-off-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20250626135219.1769350-3-arkadiusz.kubalewski@intel.com Signed-off-by: Jakub Kicinski commit 7f15ee35972dd3dee37704bfd0f136290f6d63d9 Author: Arkadiusz Kubalewski Date: Thu Jun 26 15:52:17 2025 +0200 dpll: add reference-sync netlink attribute Add new netlink attribute to allow user space configuration of reference sync pin pairs, where both pins are used to provide one clock signal consisting of both: base frequency and sync signal. Reviewed-by: Przemek Kitszel Reviewed-by: Milena Olech Reviewed-by: Jiri Pirko Signed-off-by: Arkadiusz Kubalewski Link: https://patch.msgid.link/20250626135219.1769350-2-arkadiusz.kubalewski@intel.com Signed-off-by: Jakub Kicinski commit 8c72b2a2edd5cf0ba95b0ec42a1b031f64d98574 Merge: f7dbedba631242 8b4987543453c6 Author: Jakub Kicinski Date: Fri Jun 27 16:27:08 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== ice: remaining TSPLL cleanups These are the remaining patches from the "ice: Separate TSPLL from PTP and cleanup" series [1] with control flow macros removed. What remains are cleanups and some minor improvements. [1] https://lore.kernel.org/netdev/20250618174231.3100231-1-anthony.l.nguyen@intel.com/ * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: default to TIME_REF instead of TXCO on E825-C ice: move TSPLL init calls to ice_ptp.c ice: fall back to TCXO on TSPLL lock fail ice: wait before enabling TSPLL ice: add multiple TSPLL helpers ice: use bitfields instead of unions for CGU regs ice: read TSPLL registers again before reporting status ice: clear time_sync_en field for E825-C during reprogramming ==================== Link: https://patch.msgid.link/20250626162921.1173068-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit aa497357c125662d7526d6ec8ce1259e72b2c8af Author: Chun-Tse Shao Date: Fri Jun 27 13:16:41 2025 -0700 perf stat: Fix uncore aggregation number Follow up: lore.kernel.org/CAP-5=fVDF4-qYL1Lm7efgiHk7X=_nw_nEFMBZFMcsnOOJgX4Kg@mail.gmail.com/ The patch adds unit aggregation during evsel merge the aggregated uncore counters. Change the name of the column to `ctrs` and `counters` for json mode. Tested on a 2-socket machine with SNC3, uncore_imc_[0-11] and cpumask="0,120" Before: perf stat -e clockticks -I 1000 --per-socket # time socket cpus counts unit events 1.001085024 S0 1 9615386315 clockticks 1.001085024 S1 1 9614287448 clockticks perf stat -e clockticks -I 1000 --per-node # time node cpus counts unit events 1.001029867 N0 1 3205726984 clockticks 1.001029867 N1 1 3205444421 clockticks 1.001029867 N2 1 3205234018 clockticks 1.001029867 N3 1 3205224660 clockticks 1.001029867 N4 1 3205207213 clockticks 1.001029867 N5 1 3205528246 clockticks After: perf stat -e clockticks -I 1000 --per-socket # time socket ctrs counts unit events 1.001026071 S0 12 9619677996 clockticks 1.001026071 S1 12 9618612614 clockticks perf stat -e clockticks -I 1000 --per-node # time node ctrs counts unit events 1.001027449 N0 4 3207251859 clockticks 1.001027449 N1 4 3207315930 clockticks 1.001027449 N2 4 3206981828 clockticks 1.001027449 N3 4 3206566126 clockticks 1.001027449 N4 4 3206032609 clockticks 1.001027449 N5 4 3205651355 clockticks Tested with JSON output linter: perf test "perf stat JSON output linter" 94: perf stat JSON output linter : Ok Suggested-by: Ian Rogers Reviewed-by: Ian Rogers Signed-off-by: Chun-Tse Shao Link: https://lore.kernel.org/r/20250627201818.479421-1-ctshao@google.com Signed-off-by: Namhyung Kim commit f7dbedba63124256feb9d9fcf36e8a2e43858d1e Author: Jakub Kicinski Date: Thu Jun 26 09:54:41 2025 -0700 eth: bnxt: take page size into account for page pool recycling rings The Rx rings are filled with Rx buffers. Which are supposed to fit packet headers (or MTU if HW-GRO is disabled). The aggregation buffers are filled with "device pages". Adjust the sizes of the page pool recycling ring appropriately, based on ratio of the size of the buffer on given ring vs system page size. Otherwise on a system with 64kB pages we end up with >700MB of memory sitting in every single page pool cache. Correct the size calculation for the head_pool. Since the buffers there are always small I'm pretty sure I meant to cap the size at 1k, rather than make it the lowest possible size. With 64k pages 1k cache with a 1k ring is 64x larger than we need. Reviewed-by: Michael Chan Link: https://patch.msgid.link/20250626165441.4125047-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2f5a4117599caa29ea594585a82cef21d7812302 Merge: 680367bc9be929 8cc8d749dc7eac Author: Jakub Kicinski Date: Fri Jun 27 15:35:08 2025 -0700 Merge branch 'tcp-fix-dsack-bug-with-non-contiguous-ranges' Eric Dumazet says: ==================== tcp: fix DSACK bug with non contiguous ranges This series combines a fix from xin.guo and a new packetdrill test. ==================== Link: https://patch.msgid.link/20250626123420.1933835-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8cc8d749dc7eac9ee8355aa91042aac6c7afa639 Author: Eric Dumazet Date: Thu Jun 26 12:34:20 2025 +0000 selftests/net: packetdrill: add tcp_dsack_mult.pkt Test DSACK behavior with non contiguous ranges. Without prior fix (tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range) this would fail with: tcp_dsack_mult.pkt:37: error handling packet: bad value outbound TCP option 5 script packet: 0.100682 . 1:1(0) ack 6001 actual packet: 0.100679 . 1:1(0) ack 6001 win 1097 Signed-off-by: Eric Dumazet Cc: xin.guo Link: https://patch.msgid.link/20250626123420.1933835-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit a041f70e573e185d5d5fdbba53f0db2fbe7257ad Author: xin.guo Date: Thu Jun 26 12:34:19 2025 +0000 tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range If the new coming segment covers more than one skbs in the ofo queue, and which seq is equal to rcv_nxt, then the sequence range that is duplicated will be sent as DUP SACK, the detail as below, in step6, the {501,2001} range is clearly including too much DUP SACK range, in violation of RFC 2883 rules. 1. client > server: Flags [.], seq 501:1001, ack 1325288529, win 20000, length 500 2. server > client: Flags [.], ack 1, [nop,nop,sack 1 {501:1001}], length 0 3. client > server: Flags [.], seq 1501:2001, ack 1325288529, win 20000, length 500 4. server > client: Flags [.], ack 1, [nop,nop,sack 2 {1501:2001} {501:1001}], length 0 5. client > server: Flags [.], seq 1:2001, ack 1325288529, win 20000, length 2000 6. server > client: Flags [.], ack 2001, [nop,nop,sack 1 {501:2001}], length 0 After this fix, the final ACK is as below: 6. server > client: Flags [.], ack 2001, options [nop,nop,sack 1 {501:1001}], length 0 [edumazet] added a new packetdrill test in the following patch. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: xin.guo Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250626123420.1933835-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 680367bc9be929235cb9d972c8614c1fe16fa67a Merge: bf3b1d398566fb cf56a98202970a Author: Jakub Kicinski Date: Fri Jun 27 15:34:20 2025 -0700 Merge branch 'tcp-remove-rtx_syn_ack-and-inet_rtx_syn_ack' Eric Dumazet says: ==================== tcp: remove rtx_syn_ack and inet_rtx_syn_ack() After DCCP removal, we can cleanup SYNACK retransmits a bit. ==================== Link: https://patch.msgid.link/20250626153017.2156274-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit cf56a98202970adf298df5caaa225ed68350e9ab Author: Eric Dumazet Date: Thu Jun 26 15:30:17 2025 +0000 tcp: remove inet_rtx_syn_ack() inet_rtx_syn_ack() is a simple wrapper around tcp_rtx_synack(), if we move req->num_retrans update. Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250626153017.2156274-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 8d68411a128705f86da7f037e1c33d81786fee96 Author: Eric Dumazet Date: Thu Jun 26 15:30:16 2025 +0000 tcp: remove rtx_syn_ack field Now inet_rtx_syn_ack() is only used by TCP, it can directly call tcp_rtx_synack() instead of using an indirect call to req->rsk_ops->rtx_syn_ack(). Signed-off-by: Eric Dumazet Reviewed-by: Neal Cardwell Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250626153017.2156274-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit bf3b1d398566fb6c91382747b3e6c87133fe235c Merge: 0a12c435a1d6ab c9cc6b6a7d23ee Author: Jakub Kicinski Date: Fri Jun 27 15:14:58 2025 -0700 Merge branch 'net-dsa-ks8995-fix-up-bindings' Linus Walleij says: ==================== net: dsa: ks8995: Fix up bindings After looking at the datasheets for KS8995 I realized this is a DSA switch and need to have DT bindings as such and be implemented as such. This series just fixes up the bindings and the offending device tree. The existing kernel driver which is in drivers/net/phy/spi_ks8995.c does not implement DSA. It can be forgiven for this because it was merged in 2011 and the DSA framework was not widely established back then. It continues to probe fine but needs to be rewritten to use the special DSA tag and moved to drivers/net/dsa as time permits. (I hope I can do this.) It's fine for the networking tree to merge both patches, I maintain ixp4xx as well. But I can also carry the second patch through the SoC tree if so desired. v1: https://lore.kernel.org/20250624-ks8995-dsa-bindings-v1-0-71a8b4f63315@linaro.org ==================== Link: https://patch.msgid.link/20250625-ks8995-dsa-bindings-v2-0-ce71dce9be0b@linaro.org Signed-off-by: Jakub Kicinski commit c9cc6b6a7d23eea7ada69a9185a550c4f0b62319 Author: Linus Walleij Date: Wed Jun 25 08:51:25 2025 +0200 ARM: dts: Fix up wrv54g device tree Fix up the KS8995 switch and PHYs the way that is most likely: - Phy 1-4 is certainly the PHYs of the KS8995 (mask 0x1e in the outoftree code masks PHYs 1,2,3,4). - Phy 5 is the MII-P5 separate WAN phy of the KS8995 directly connected to EthC. - The EthB MII is probably connected as CPU interface to the KS8995. Properly integrate the KS8995 switch using the new bindings. Signed-off-by: Linus Walleij Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250625-ks8995-dsa-bindings-v2-2-ce71dce9be0b@linaro.org Signed-off-by: Jakub Kicinski commit a0f29a07b654a50ebc9b070ef6dcb3219c4de867 Author: Linus Walleij Date: Wed Jun 25 08:51:24 2025 +0200 dt-bindings: dsa: Rewrite Micrel KS8995 in schema After studying the datasheets for some of the KS8995 variants it becomes pretty obvious that this is a straight-forward and simple MII DSA switch with one port in (CPU) and four outgoing ports, and it even supports custom tags by setting a bit in a special register, and elaborate VLAN handling as all DSA switches do. What is a bit odd with KS8995 is that it uses an extra MII-P5 port to access one of the PHYs separately, on the side of the switch fabric, such as when using a WAN port separately from a LAN switch in a home router. Rewrite the terse bindings to YAML, and move to the proper subdirectory. Include a verbose example to make things clear. Signed-off-by: Linus Walleij Reviewed-by: Andrew Lunn Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250625-ks8995-dsa-bindings-v2-1-ce71dce9be0b@linaro.org Signed-off-by: Jakub Kicinski commit 0a12c435a1d6ab43986f13d1303fd20c22747d6b Author: Paul Kocialkowski Date: Thu Jun 26 10:09:21 2025 +0200 dt-bindings: net: sun8i-emac: Add A100 EMAC compatible The Allwinner A100/A133 has an Ethernet MAC (EMAC) controller that is compatible with the A64 one. It features the same syscon registers for control of the top-level integration of the unit. Signed-off-by: Paul Kocialkowski Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250626080923.632789-4-paulk@sys-base.io Signed-off-by: Jakub Kicinski commit cedb355f883370208d2f7ed61aa4a05b02098aed Merge: cb70b1bb73e8bc 5d69351820eab6 Author: Jakub Kicinski Date: Fri Jun 27 15:09:04 2025 -0700 Merge branch 'nfc-trf7970a-add-option-to-reduce-antenna-gain' Paul Geurts says: ==================== NFC: trf7970a: Add option to reduce antenna gain The TRF7970a device is sensitive to RF disturbances, which can make it hard to pass some EMC immunity tests. By reducing the RX antenna gain, the device becomes less sensitive to EMC disturbances, as a trade-off against antenna performance. ==================== Link: https://patch.msgid.link/20250626141242.3749958-1-paul.geurts@prodrive-technologies.com Signed-off-by: Jakub Kicinski commit 5d69351820eab6be1d298af21aedd18be5e5a11a Author: Paul Geurts Date: Thu Jun 26 16:12:42 2025 +0200 NFC: trf7970a: Create device-tree parameter for RX gain reduction The TRF7970a device is sensitive to RF disturbances, which can make it hard to pass some EMC immunity tests. By reducing the RX antenna gain, the device becomes less sensitive to EMC disturbances, as a trade-off against antenna performance. Add a device tree option to select RX gain reduction to improve EMC performance. Selecting a communication standard in the ISO control register resets the RX antenna gain settings. Therefore set the RX gain reduction everytime the ISO control register changes, when the option is used. Signed-off-by: Paul Geurts Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250626141242.3749958-3-paul.geurts@prodrive-technologies.com Signed-off-by: Jakub Kicinski commit 2bee162a28fb5f1b7ad1644071b26808fc14f493 Author: Paul Geurts Date: Thu Jun 26 16:12:41 2025 +0200 dt-bindings: net/nfc: ti,trf7970a: Add ti,rx-gain-reduction-db option Add option to reduce the RX antenna gain to be able to reduce the sensitivity. Signed-off-by: Paul Geurts Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250626141242.3749958-2-paul.geurts@prodrive-technologies.com Signed-off-by: Jakub Kicinski commit ec9223b49ab14a39f252d786f055931d403d5491 Author: Matthew Brost Date: Wed Jun 25 07:41:28 2025 -0700 drm/xe: Drop bo->size bo->size is redundant because the base GEM object already has a size field with the same value. Drop bo->size and use the base GEM object’s size instead. While at it, introduce xe_bo_size() to abstract the BO size. v2: - Fix typo in kernel doc (Ashutosh) - Fix kunit (CI) - Fix line wrap (Checkpatch) v3: - Fix sriov build (CI) v4: - Fix display build (CI) Signed-off-by: Matthew Brost Reviewed-by: Ashutosh Dixit Link: https://lore.kernel.org/r/20250625144128.2827577-1-matthew.brost@intel.com commit bacdf5a0e69d343e2a380be768c1f277088e35d8 Author: Song Liu Date: Fri Jun 27 12:12:21 2025 -0700 selftests/bpf: Fix cgroup_xattr/read_cgroupfs_xattr cgroup_xattr/read_cgroupfs_xattr has two issues: 1. cgroup_xattr/read_cgroupfs_xattr messes up lo without creating a netns first. This causes issue with other tests. Fix this by using a different hook (lsm.s/file_open) and not messing with lo. 2. cgroup_xattr/read_cgroupfs_xattr sets up cgroups without proper mount namespaces. Fix this by using the existing cgroup helpers. A new helper set_cgroup_xattr() is added to set xattr on cgroup files. Fixes: f4fba2d6d282 ("selftests/bpf: Add tests for bpf_cgroup_read_xattr") Reported-by: Alexei Starovoitov Closes: https://lore.kernel.org/bpf/CAADnVQ+iqMi2HEj_iH7hsx+XJAsqaMWqSDe4tzcGAnehFWA9Sw@mail.gmail.com/ Signed-off-by: Song Liu Tested-by: Eduard Zingerman Tested-by: Ihor Solodrai Link: https://lore.kernel.org/r/20250627191221.765921-1-song@kernel.org Signed-off-by: Alexei Starovoitov commit 5ac244b9cc8f49c945c5be67ed7d6f8ac6ed9321 Author: Marie Zhussupova Date: Thu Jun 26 17:17:29 2025 +0000 kunit: Make default kunit_test timeout configurable via both a module parameter and a Kconfig option To accommodate varying hardware performance and use cases, the default kunit test case timeout (currently 300 seconds) is now configurable. Users can adjust the timeout by either setting the 'timeout' module parameter or the KUNIT_DEFAULT_TIMEOUT Kconfig option to their desired timeout in seconds. Link: https://lore.kernel.org/r/20250626171730.1765004-1-marievic@google.com Signed-off-by: Marie Zhussupova Reviewed-by: David Gow Signed-off-by: Shuah Khan commit cb70b1bb73e8bca828251a1e442aa944e8da9be6 Author: Frank Li Date: Tue Jun 24 16:20:27 2025 -0400 dt-bindings: net: convert lpc-eth.txt yaml format Convert lpc-eth.txt yaml format. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250624202028.2516257-1-Frank.Li@nxp.com Signed-off-by: Jakub Kicinski commit 6e17bbb5a86e6c68d65e38dfc850699e7a0706cb Author: Aditya Kumar Singh Date: Thu Jun 26 10:49:56 2025 +0530 wifi: ath12k: fix timeout while waiting for regulatory update during interface creation During interface creation, following print is observed on the console - Timeout while waiting for regulatory update This occurs due to commit 906619a00967 ("wifi: ath12k: handle regulatory hints during mac registration"), which introduced a completion mechanism to synchronize the regulatory update process. The intent behind this change is to coordinate the timing between when the firmware sends regulatory data to the driver and when the driver processes that data. However, during interface addition, if the 6 GHz band is active, the driver invokes ath12k_regd_update() to apply the appropriate 6 GHz power mode regulatory settings. At this point, there is no interaction with the firmware, so the completion object is not reinitialized. As a result, wait_for_completion() eventually times out, leading to the observed error log message. Hence to fix this, move all complete() on regd_update_completed to complete_all(). The complete() function signals only once, causing any subsequent waits without reinitialization to timeout. In this scenario, since waiting is unnecessary, complete_all() can be used instead, ensuring that subsequent calls to wait without reinitialization will simply bail out and not actually wait. This approach is ideal because if the firmware is not involved, there is no need to wait for the completion event. However, if the firmware is involved, it is guaranteed that the completion will be reinitialized, and thus, it would wait. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1 Tested-by: Kang Yang Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: 906619a00967 ("wifi: ath12k: handle regulatory hints during mac registration") Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250626-fix_timeout_during_interface_creation-v1-1-90a7fdc222d4@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 5e54510a9389caa922360218a83a58cd30fec686 Author: Gustavo A. R. Silva Date: Fri Jun 27 12:55:19 2025 -0600 acpi: nfit: intel: avoid multiple -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the new TRAILING_OVERLAP() helper to fix a dozen instances of the following type of warning: drivers/acpi/nfit/intel.c:692:35: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Acked-by: Dan Williams Tested-by: Dan Williams Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/aF7pF4kej8VQapyR@kspp Signed-off-by: Kees Cook commit 82b6eef81008164a8e011be56a40972c36075226 Merge: 8efa26fcbf8a7f f4e6aefb9c6d8f Author: Jakub Kicinski Date: Fri Jun 27 13:22:59 2025 -0700 Merge branch 'ref_tracker-fix' Merge a fix from Jeff from a stable commit ID: * ref_tracker: do xarray and workqueue job initializations earlier Signed-off-by: Jakub Kicinski commit f4e6aefb9c6d8f9a5baa2a26bddaff4fbb4d280e Author: Jeff Layton Date: Thu Jun 26 08:52:14 2025 -0400 ref_tracker: do xarray and workqueue job initializations earlier The kernel test robot reported an oops that occurred when attempting to deregister a dentry from the xarray during subsys_initcall(). The ref_tracker xarrays and workqueue job are being initialized in late_initcall() which is too late. Move those to postcore_initcall() instead. Fixes: 65b584f53611 ("ref_tracker: automatically register a file in debugfs for a ref_tracker_dir") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202506251406.c28f2adb-lkp@intel.com Signed-off-by: Jeff Layton Signed-off-by: Jakub Kicinski Link: https://patch.msgid.link/20250626-reftrack-dbgfs-v1-1-812102e2a394@kernel.org commit 362ec251a6aba32c8d950f0278c75aaa8c1b0b10 Author: Jonathan Corbet Date: Fri Jun 27 13:08:20 2025 -0600 docs: kdoc: don't reinvent string.strip() process_proto_type() and process_proto_function() reinventing the strip() string method with a whole series of separate regexes; take all that out and just use strip(). The previous implementation also (in process_proto_type()) removed C++ comments *after* the above dance, leaving trailing whitespace in that case; now we do the stripping afterward. This results in exactly one output change: the removal of a spurious space in the definition of BACKLIGHT_POWER_REDUCED - see https://docs.kernel.org/gpu/backlight.html#c.backlight_properties. I note that we are putting semicolons after #define lines that really shouldn't be there - a task for another day. Signed-off-by: Jonathan Corbet commit a5a7b25d7535ce5d8db0c121ef588bc6ca3a39dc Author: Eduard Zingerman Date: Fri Jun 27 10:53:09 2025 -0700 bpf: guard BTF_ID_FLAGS(bpf_cgroup_read_xattr) with CONFIG_BPF_LSM Function bpf_cgroup_read_xattr is defined in fs/bpf_fs_kfuncs.c, which is compiled only when CONFIG_BPF_LSM is set. Add CONFIG_BPF_LSM check to bpf_cgroup_read_xattr spec in common_btf_ids in kernel/bpf/helpers.c to avoid build failures for configs w/o CONFIG_BPF_LSM. Build failure example: BTF .tmp_vmlinux1.btf.o btf_encoder__tag_kfunc: failed to find kfunc 'bpf_cgroup_read_xattr' in BTF ... WARN: resolve_btfids: unresolved symbol bpf_cgroup_read_xattr make[2]: *** [scripts/Makefile.vmlinux:91: vmlinux.unstripped] Error 255 Fixes: 535b070f4a80 ("bpf: Introduce bpf_cgroup_read_xattr to read xattr of cgroup's node") Reported-by: Jake Hillion Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250627175309.2710973-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit ef0f7c235e5c2195ff61a2c9a5b9efb2375ce433 Author: Namhyung Kim Date: Fri Jun 27 09:38:56 2025 -0700 perf build: Fix a build error on REFCNT_CHECKING=1 Recently it added -fno-strict-aliasing to sync with the kernel behavior. But it caused an error due to potential uninitialized access like below: In file included from util/symbol.c:27: In function ‘dso__set_symbol_names_len’, inlined from ‘dso__sort_by_name’ at util/symbol.c:638:4: util/dso.h:654:46: error: ‘len’ may be used uninitialized [-Werror=maybe-uninitialized] 654 | RC_CHK_ACCESS(dso)->symbol_names_len = len; | ^ util/symbol.c: In function ‘dso__sort_by_name’: util/symbol.c:634:24: note: ‘len’ was declared here 634 | size_t len; | ^~~ Let's just initialize it with 0. Fixes: 55a18d2f3ff79c90 ("perf build: enable -fno-strict-aliasing") Closes: https://lore.kernel.org/r/aF7JC8zkG5-_-nY_@google.com Signed-off-by: Namhyung Kim commit c7eedb09417e4372183bf1843676d2008da340d5 Author: Jonathan Corbet Date: Fri Jun 27 12:23:05 2025 -0600 docs: kdoc: split the processing of the two remaining inline states Now that "inline_*" are just ordinary parser states, split them into two separate functions, getting rid of some nested conditional logic. The original process_inline() would simply ignore lines that didn't match any of the regexes (those lacking the initial " * " marker). I have preserved that behavior, but we should perhaps emit a warning instead. Signed-off-by: Jonathan Corbet commit 7b95663a3d96b39b40f169dba5faef3e20163c5c Author: Thomas Gleixner Date: Wed Jun 25 20:38:49 2025 +0200 timekeeping: Provide interface to control auxiliary clocks Auxiliary clocks are disabled by default and attempts to access them fail. Provide an interface to enable/disable them at run-time. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183758.444626478@linutronix.de commit e6d4c00719a6b1dda3fb358b4c973595f9dfd455 Author: Thomas Gleixner Date: Wed Jun 25 20:38:47 2025 +0200 timekeeping: Provide update for auxiliary timekeepers Update the auxiliary timekeepers periodically. For now this is tied to the system timekeeper update from the tick. This might be revisited and moved out of the tick. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183758.382451331@linutronix.de commit ecf3e70304911be1c14cd21baa0bc611a53ec50b Author: Thomas Gleixner Date: Wed Jun 25 20:38:46 2025 +0200 timekeeping: Provide adjtimex() for auxiliary clocks The behaviour is close to clock_adtime(CLOCK_REALTIME) with the following differences: 1) ADJ_SETOFFSET adjusts the auxiliary clock offset 2) ADJ_TAI is not supported 3) Leap seconds are not supported 4) PPS is not supported Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183758.317946543@linutronix.de commit 4eca49d0b621b314ac7c80f363932ec6f6c8abc8 Author: Thomas Gleixner Date: Wed Jun 25 20:38:45 2025 +0200 timekeeping: Prepare do_adtimex() for auxiliary clocks Exclude ADJ_TAI, leap seconds and PPS functionality as they make no sense in the context of auxiliary clocks and provide a time stamp based on the actual clock. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183758.253203783@linutronix.de commit 775f71ebedd382da390dc16a4c28cffa5b937f79 Author: Thomas Gleixner Date: Wed Jun 25 20:38:43 2025 +0200 timekeeping: Make do_adjtimex() reusable Split out the actual functionality of adjtimex() and make do_adjtimex() a wrapper which feeds the core timekeeper into it and handles the result including audit at the call site. This allows to reuse the actual functionality for auxiliary clocks. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183758.187322876@linutronix.de commit 2c8aea59c206b12b436373861590baeda728be12 Author: Thomas Gleixner Date: Wed Jun 25 20:38:42 2025 +0200 timekeeping: Add auxiliary clock support to __timekeeping_inject_offset() Redirect the relative offset adjustment to the auxiliary clock offset instead of modifying CLOCK_REALTIME, which has no meaning in context of these clocks. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183758.124057787@linutronix.de commit e8db3a55798d70f2c222c6103990776fca6a6ebc Author: Thomas Gleixner Date: Wed Jun 25 20:38:40 2025 +0200 timekeeping: Make timekeeping_inject_offset() reusable Split out the inner workings for auxiliary clock support and feed the core time keeper into it. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183758.059934561@linutronix.de commit 60ecc26ec5af567a55f362ad92c0cac8b894541c Author: Thomas Gleixner Date: Wed Jun 25 20:38:34 2025 +0200 timekeeping: Provide time setter for auxiliary clocks Add clock_settime(2) support for auxiliary clocks. The function affects the AUX offset which is added to the "monotonic" clock readout of these clocks. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183757.995688714@linutronix.de commit 606424bf4ffd9d27865c45b5707c1edac6b187ed Author: Thomas Gleixner Date: Wed Jun 25 20:38:32 2025 +0200 timekeeping: Add minimal posix-timers support for auxiliary clocks Provide clock_getres(2) and clock_gettime(2) for auxiliary clocks. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183757.932220594@linutronix.de commit 05bc6e6290f91d2d40086ab4ef52da21c14ec4b6 Author: Thomas Gleixner Date: Wed Jun 25 20:38:31 2025 +0200 timekeeping: Provide time getters for auxiliary clocks Provide interfaces similar to the ktime_get*() family which provide access to the auxiliary clocks. These interfaces have a boolean return value, which indicates whether the accessed clock is valid or not. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183757.868342628@linutronix.de commit 9f7729480a2c771bbe49b7eab034a8eaa5e27bfb Author: Thomas Gleixner Date: Wed Jun 25 20:38:29 2025 +0200 timekeeping: Update auxiliary timekeepers on clocksource change Propagate a system clocksource change to the auxiliary timekeepers so that they can pick up the new clocksource. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250625183757.803890875@linutronix.de commit 9c7d93a8f1ec0415457037a5748b0ee60e50a095 Author: Daniele Ceraolo Spurio Date: Wed Jun 25 13:54:07 2025 -0700 drm/xe/guc: Enable the Dynamic Inhibit Context Switch optimization The Dynamic Inhibit Context Switch is an optimization aimed at reducing the amount of time the HW is stuck waiting on an unsatisfied semaphore. When this optimization is enabled, the GuC will dynamically modify the CTX_CTRL_INHIBIT_SYN_CTX_SWITCH in the CTX_CONTEXT_CONTROL register of LRCs to enable immediate switching out on an unsatisfied semaphore wait when multiple contexts are competing for time on the same engine. This feature is available on recent HW from GuC 70.40.1 onwards and it is enabled via a per-VF feature opt-in. v2: rebase v3: switch to using guc_buf_cache instead of dedicated alloc v4: add helper to check for feature availability (Michal), don't enable if multi-lrc is possible. Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Cc: Julia Filipchuk Cc: Michal Wajdeczko Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250625205405.1653212-4-daniele.ceraolospurio@intel.com commit a7ffcea8631af91479cab10aa7fbfd0722f01d9a Author: Daniele Ceraolo Spurio Date: Wed Jun 25 13:54:06 2025 -0700 drm/xe/guc: Enable extended CAT error reporting On newer HW (Xe2 onwards + PVC) it is possible to get extra information when a CAT error occurs, specifically a dword reporting the error type. To enable this extra reporting, we need to opt-in with the GuC, which is done via a specific per-VF feature opt-in H2G. On platforms where the HW does not support the extra reporting, the GuC will set the type to 0xdeadbeef, so we can keep the code simple and opt-in to the feature on every platform and then just discard the data if it is invalid. Note that on native/PF we're guaranteed that the opt in is available because we don't support any GuC old enough to not have it, but if we're a VF we might be running on a non-XE PF with an older GuC, so we need to handle that case. We can re-use the invalid type above to handle this scenario the same way as if the feature was not supported in HW. Given that this patch is the first user of the guc_buf_cache on native and VF, it also extends that feature to non-PF use-cases. v2: simpler print for the error type (John), rebase v3: use guc_buf_cache instead of new alloc, simpler doc (Michal) Signed-off-by: Daniele Ceraolo Spurio Cc: Nirmoy Das Cc: John Harrison Cc: Michal Wajdeczko Reviewed-by: Nirmoy Das #v1 Reviewed-by: Michal Wajdeczko Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250625205405.1653212-3-daniele.ceraolospurio@intel.com commit 0044c5fcae3d2e89ee7d4979a52e1014774d4f92 Author: Yi Sun Date: Fri Apr 4 13:36:14 2025 +0800 dmaengine: idxd: Remove __packed from structures The __packed attribute introduces potential unaligned memory accesses and endianness portability issues. Instead of relying on compiler-specific packing, it's much better to explicitly fill structure gaps using padding fields, ensuring natural alignment. Since all previously __packed structures already enforce proper alignment through manual padding, the __packed qualifiers are unnecessary and can be safely removed. Signed-off-by: Yi Sun Reviewed-by: Andy Shevchenko Reviewed-by: Dave Jiang Reviewed-by: Fenghua Yu Link: https://lore.kernel.org/r/20250404053614.3096769-1-yi.sun@intel.com Signed-off-by: Vinod Koul commit 096f73ab01b95aaeaa7f678c56257d2e4c8490d3 Author: Jonathan Corbet Date: Fri Jun 27 11:33:18 2025 -0600 docs: kdoc: remove the inline states-within-a-state The processing of inline kerneldoc comments is a state like the rest, but it was implemented as a set of separate substates. Just remove the substate logic and make the inline states normal ones like the rest. INLINE_ERROR was never actually used for anything, so just take it out. No changes to the generated output. Signed-off-by: Jonathan Corbet commit 8631e01c2c5d1fe6705bcc0d733a0b7a17d3daac Author: Amir Goldstein Date: Fri Jun 27 12:48:35 2025 +0200 fanotify: sanitize handle_type values when reporting fid Unlike file_handle, type and len of struct fanotify_fh are u8. Traditionally, filesystem return handle_type < 0xff, but there is no enforecement for that in vfs. Add a sanity check in fanotify to avoid truncating handle_type if its value is > 0xff. Fixes: 7cdafe6cc4a6 ("exportfs: check for error return value from exportfs_encode_*()") Signed-off-by: Amir Goldstein Signed-off-by: Jan Kara Link: https://patch.msgid.link/20250627104835.184495-1-amir73il@gmail.com commit b04c7e88bcf5ddcd15e2c620b802c28848f437bb Author: Masahiro Yamada Date: Wed Jun 25 00:04:49 2025 +0900 kconfig: set MENU_CHANGED to choice when the selected member is changed In gconf, choice entries display the selected symbol in the 'Value' column, but it is not updated when the selected symbol is changed. Set the MENU_CHANGED flag, so it is updated. Signed-off-by: Masahiro Yamada commit 811fe8ad1db9b5e2fb20c2610f35e3a364bef620 Author: Inochi Amaoto Date: Tue Jun 17 15:01:40 2025 +0800 reset: simple: add support for Sophgo CV1800B Reuse reset-simple driver for the Sophgo CV1800B reset generator. Signed-off-by: Inochi Amaoto Reviewed-by: Alexander Sverdlin Tested-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250617070144.1149926-3-inochiama@gmail.com Signed-off-by: Philipp Zabel commit 5a5c61f7ef967edac4e88a645f08b5889e824cf0 Author: Inochi Amaoto Date: Tue Jun 17 15:01:39 2025 +0800 dt-bindings: reset: sophgo: Add CV1800B support Add bindings for the reset generator on the SOPHGO CV1800B RISC-V SoC. Signed-off-by: Inochi Amaoto Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250617070144.1149926-2-inochiama@gmail.com Signed-off-by: Philipp Zabel commit 9d33595c022763822a01889708d0ed24c59fa144 Author: Jerome Brunet Date: Wed Jun 11 12:06:04 2025 +0200 reset: mpfs: use the auxiliary device creation The auxiliary device creation of this driver is simple enough to use the available auxiliary device creation helper. Use it and remove some boilerplate code. Acked-by: Conor Dooley Reviewed-by: Philipp Zabel Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20250611-rst-mpfs-aux-v1-1-c86534b473c3@baylibre.com Signed-off-by: Philipp Zabel commit fd4a06a2e1661893c5353f8b01bf6ae44cbe094d Author: Lad Prabhakar Date: Wed May 28 14:30:31 2025 +0100 dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/V2N SoC support Document support for the USB2PHY reset controller found on the Renesas RZ/V2N (R9A09G056) SoC. The reset controller IP is functionally identical to that on the RZ/V2H(P) SoC, so no driver changes are needed. The existing `renesas,r9a09g057-usb2phy-reset` compatible will be used as a fallback for the RZ/V2N SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250528133031.167647-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Philipp Zabel commit 25ef956349a5c439f4dec30fb207ed3b7d586e14 Author: Frank Li Date: Mon Jun 2 10:40:45 2025 -0400 dt-bindings: reset: convert nxp,lpc1850-rgu.txt to yaml format Convert nxp,lpc1850-rgu.txt to yaml format. Additional changes: - remove label in example. - remove reset consumer in example. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250602144046.943982-1-Frank.Li@nxp.com Signed-off-by: Philipp Zabel commit e73bfb4ca5229e09b20bd6b4543308b9a71f9426 Author: Drew Fustini Date: Sun Jun 1 11:08:26 2025 -0700 reset: thead: Fix TH1520 typo Fix trivial typo in the Kconfig entry for RESET_TH1520. Fixes: 4a65326311ab ("reset: thead: Add TH1520 reset controller driver") Signed-off-by: Drew Fustini Link: https://lore.kernel.org/r/20250601181000.166088-1-drew@pdp7.com Signed-off-by: Philipp Zabel commit 5272b51367ea001c56a4be32342d1da1a3206fcb Author: Viktor Malik Date: Fri Jun 27 10:20:01 2025 +0200 bpf: Fix string kfuncs names in doc comments Documentation comments for bpf_strnlen and bpf_strcspn contained incorrect function names. Fixes: e91370550f1f ("bpf: Add kfuncs for read-only string operations") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/bpf/20250627174759.3a435f86@canb.auug.org.au/T/#u Signed-off-by: Viktor Malik Link: https://lore.kernel.org/r/20250627082001.237606-1-vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit 360a7a64775944e3a784cb2e3cffb15af5f328e5 Author: Junhui Liu Date: Fri Jun 13 16:49:24 2025 +0800 reset: canaan: add reset driver for Kendryte K230 Add support for the resets on Canaan Kendryte K230 SoC. The driver support CPU0, CPU1, L2 cache flush, hardware auto clear and software clear resets. Tested-by: Chen Wang Reviewed-by: Philipp Zabel Signed-off-by: Junhui Liu Link: https://lore.kernel.org/r/20250613-k230-reset-v4-2-e5266d2be440@pigmoral.tech Signed-off-by: Philipp Zabel commit 3c2968fcd72c4b130894d1a2b835e18474c559e2 Author: Junhui Liu Date: Fri Jun 13 16:49:23 2025 +0800 dt-bindings: reset: add support for canaan,k230-rst Introduces a reset controller driver for the Kendryte K230 SoC, resposible for managing the reset functionality of the CPUs and various sub-modules. Reviewed-by: Conor Dooley Reviewed-by: Chen Wang Signed-off-by: Junhui Liu Link: https://lore.kernel.org/r/20250613-k230-reset-v4-1-e5266d2be440@pigmoral.tech Signed-off-by: Philipp Zabel commit 792ea7b6cafa46f8e6d6f40c557e614358a89520 Author: Jason Gunthorpe Date: Mon Jun 9 17:41:31 2025 -0300 iommu: Remove ops->pgsize_bitmap No driver uses it now, remove the core code. Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Tested-by: Nicolin Chen Link: https://lore.kernel.org/r/7-v2-68a2e1ba507c+1fb-iommu_rm_ops_pgsize_jgg@nvidia.com Signed-off-by: Joerg Roedel commit 53b76df062d84867f7bd6077e3f44727619d0eba Author: Jason Gunthorpe Date: Fri Jun 27 10:02:10 2025 -0300 iommu/msm: Remove ops->pgsize_bitmap This driver just uses a constant, put it in domain_alloc_paging and use the domain's value instead of ops during finalise. Signed-off-by: Jason Gunthorpe Acked-by: Konrad Dybcio Link: https://lore.kernel.org/r/0-v1-662aad101e51+45-iommu_rm_ops_pgsize_msm_jgg@nvidia.com Signed-off-by: Joerg Roedel commit cb6dcabdfd0e3b608969d1cab71d8658495f9c4f Author: Sumanth Gavini Date: Thu May 22 13:56:53 2025 -0700 wifi: ath6kl: Fix spellings Fix misspelling reported by codespell. Signed-off-by: Sumanth Gavini Link: https://patch.msgid.link/20250522205701.393612-1-sumanth.gavini@yahoo.com Signed-off-by: Jeff Johnson commit 20870fb0a3001fa99f2684dafb200c2ae6b8aae7 Author: Sumanth Gavini Date: Tue May 20 22:54:09 2025 -0700 wifi: ath10k: Fix Spelling Fix "trasmitting" to "transmitting" Signed-off-by: Sumanth Gavini Link: https://patch.msgid.link/20250521055411.288724-1-sumanth.gavini@yahoo.com Signed-off-by: Jeff Johnson commit ed259ae54de6d7daa778dcb3471c00367d32c11c Author: Sumanth Gavini Date: Tue May 20 22:33:21 2025 -0700 wifi: wil6210: wmi: Fix spellings reported by codespell Fix "busses" to "buses" Fix "Measurments" to "Measurements" Signed-off-by: Sumanth Gavini Link: https://patch.msgid.link/20250521053323.284845-1-sumanth.gavini@yahoo.com Signed-off-by: Jeff Johnson commit 8ad00a81d769ad81aac0ef65a4adbc2f53169b3c Author: Thomas Zimmermann Date: Wed Jun 25 13:48:22 2025 +0200 drm/format-helper: Split off byte swapping from drm_fb_xrgb8888_to_rgb565() Move big-endian support from drm_fb_xrgb8888_to_rgb565() into the new helper drm_xrgb8888_to_rgb565be(). The functionality is required for displays with big-endian byte order. Update all callers. With the change applied, drm_fb_xrgb8888_to_rgb565() has the same signature as the other conversion functions, which is required for further updates to drm_fb_blit(). Also makes the format-conversion helper available to panic handlers, if necessary. Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250625114911.1121301-1-tzimmermann@suse.de commit 1d7a74dfba583a9e8dde1f0234e91a5b49032863 Author: Johan Adolfsson Date: Tue Jun 17 12:23:55 2025 +0200 dt-bindings: leds: lp50xx: Document child reg, fix example The led child reg node is the index within the bank, document that and update the example accordingly. The reg property in child node is limited to 0-2 since there are 3 leds per bank, previous value in example was speculative. Signed-off-by: Johan Adolfsson Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250617-led-fix-v7-2-cdbe8efc88fa@axis.com Signed-off-by: Lee Jones commit 2e84a5e5374232e6f356ce5c079a5658d7e4af2c Author: Johan Adolfsson Date: Tue Jun 17 12:23:54 2025 +0200 leds: leds-lp50xx: Handle reg to get correct multi_index mc_subled used for multi_index needs well defined array indexes, to guarantee the desired result, use reg for that. If devicetree child nodes is processed in random or reverse order you may end up with multi_index "blue green red" instead of the expected "red green blue". If user space apps uses multi_index to deduce how to control the leds they would most likely be broken without this patch if devicetree processing is reversed (which it appears to be). arch/arm/boot/dts/aspeed/aspeed-bmc-facebook-fuji.dts has reg set but I don't see how it can have worked without this change. If reg is not set, an error is returned, If reg is out of range, an error is returned. reg within led child nodes starts with 0, to map to the iout in each bank. Signed-off-by: Johan Adolfsson Reviewed-by: Jacek Anaszewski Link: https://lore.kernel.org/r/20250617-led-fix-v7-1-cdbe8efc88fa@axis.com Signed-off-by: Lee Jones commit 82458736375a5e7874d623ab3dab196df21b3e3d Author: Ville Syrjälä Date: Tue Jun 24 20:00:48 2025 +0300 drm/i915/flipq: Add intel_flipq_dump() Add a function for dumping the entries of a specific flip queue. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250624170049.27284-9-ville.syrjala@linux.intel.com commit a47828f3e7aaa9339f43c9a919c5b9b12b89d4b4 Author: Ville Syrjälä Date: Tue Jun 24 20:00:46 2025 +0300 drm/i915/flipq: Implement Wa_18034343758 Implement the driver side of Wa_18034343758, which is supposed to prevent the DSB and DMC from accessing registers in parallel, and thus potentially corrupting the registers due to a hardware issue (which should be fixed in PTL-B0). The w/a sequence goes as follows: DMC starts the DSB | \ DMC halts itself | DSB waits a while for DMC to have time to halt . | DSB executes normally . | DSB unhalts the DMC at the very end . / DMC resumes execution v2: PTL-B0+ firmware no longer has the w/a since the hw got fixed v3: Do the w/a on all PTL for now since we only have the A0 firmware binaries which issues the halt instructions unconditionally v4: PTL DMC binaries do in fact have the A0 vs. B0 split, so skip the w/a on PTL-B0+ Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250624170049.27284-7-ville.syrjala@linux.intel.com commit ec3a347beaa21b4a041f636b7081d17677fb3f56 Author: Ville Syrjälä Date: Tue Jun 24 20:00:45 2025 +0300 drm/i915/flipq: Implement flip queue based commit path Support commits via the flip queue (as opposed to DSB or MMIO). As it's somewhat unknown if we can actually use it is currently gated behind the new use_flipq modparam, which defaults to disabled. The implementation has a bunch of limitations that would need real though to solve: - disabled when PSR is used - disabled when VRR is used - color management updates not performed via the flip queue v2: Don't use flip queue if there is no dmc v3: Use intel_flipq_supported() v3: Configure PKG_C_LATENCY appropriately Ignore INT_VECTOR if there is a real PIPEDMC interrupt (nothing in the hw appears to clear INT_VECTOR) v4: Leave added_wake_time=0 when flip queue isn't used, to avoid needleslly increasing pkg_c_latency on lnl/ptl due to Wa_22020432604. This is a bit racy though... Use IS_DISPLAY_VER() Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250624170049.27284-6-ville.syrjala@linux.intel.com commit 470022b5c215351d5e3faf4823a489e589fa2e57 Author: Ville Syrjälä Date: Tue Jun 24 20:00:44 2025 +0300 drm/i915/flipq: Provide the nuts and bolts code for flip queue Provide the lower level code for PIPEDMC based flip queue. We'll use the so called semi-full flip queue mode where the PIPEDMC will start the provided DSB on a scanline a little ahead of the vblank. We need to program the triggering scanline early enough so that the DSB has enough time to complete writing all the double buffered registers before they get latched (at start of vblank). The firmware implements several queues: - 3 "plane queues" which execute a single DSB per entry - 1 "general queue" which can apparently execute 2 DSBs per entry - 1 vestigial "fast queue" that replaced the "simple flip queue" on ADL+, but this isn't supposed to be used due to issues. But we only need a single plane queue really, and we won't actually use it as a real queue because we don't allow queueing multiple commits ahead of time. So the whole thing is perhaps useless. I suppose there migth be some power saving benefits if we would get the flip scheduled by userspace early and then could keep some hardware powered off a bit longer until the DMC kicks off the flipq programming. But that is pure speculation at this time and needs to be proven. The code to hook up the flip queue into the actual atomic commit path will follow later. TODO: need to think how to do the "wait for DMC firmware load" nicely need to think about VRR and PSR etc. v2: Don't write DMC_FQ_W2_PTS_CFG_SEL on pre-lnl Don't oops at flipq init if there is no dmc v3: Adapt to PTL+ flipq changes (different queue entry layout, different trigger event, need VRR TG) Use the actual CDCLK frequency Ask the DSB code how long things are expected to take v3: Adjust the cdclk rounding (docs are 100% vague, Windows rounds like this) Initialize some undocumented magic DMC variables on PTL v4: Use PIPEDMC_FQ_STATUS for busy check (the busy bit in PIPEDMC_FQ_CTRL is apparently gone on LNL+) Based the preempt timeout on the max exec time Preempt before disabling the flip queue Order the PIPEDMC_SCANLINECMP* writes a bit more carefully Fix some typos v5: Try to deal with some clang-20 div-by-zero false positive (Nathan) Add some docs (Jani) Cc: Nathan Chancellor Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä epr Link: https://patchwork.freedesktop.org/patch/msgid/20250624170049.27284-5-ville.syrjala@linux.intel.com commit 141b954cae36d7bcd84df494341b914bb80a299f Author: Ville Syrjälä Date: Tue Jun 24 20:00:43 2025 +0300 drm/i915/dmc: Define flip queue related PIPEDMC registers Add the register definitions for a bunch of flip queue related PIPEDMC registers. v2: The layout of flip queue entries changed on PTL Bump the DMC_FQ_W2_PTS_CFG_SEL bitfields sizes (Uma) Reduce the scanlines to 21 bits for now (Uma) v3: Also define some undocumented DMC variables we need on PTL v3: Drop PIPEDMC_FQ_CTRL_BUSY as it seems to no longer exist on LNL+ Fix up some typos Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250624170049.27284-4-ville.syrjala@linux.intel.com commit 9367e41483125c3e257aa861ea79b119c5bfd2ea Author: Ville Syrjälä Date: Tue Jun 24 20:00:42 2025 +0300 drm/i915: Try to program PKG_C_LATENCY more correctly The current PKG_C_LATENCY stuff looks busted in several ways: - doesn't account for multiple pipes from different commits correctly - WM_LINETIME is in units of 0.125usec, PKG_C_LATENCY wants units on 1 usec - weird VRR state stuff being checked - use of pointless RMW Fix it all up. Note that it's still a bit unclear how all this works, especially how the added_wake_time ties into the flipq triggers in DMC, and how we need to sequence updates to PKG_C_LATENCY when enabling/disabling pipes/etc. We may also need to think what to about the WM1+ disabling and the related PSR chicken bits when we can use PKG_C_LATENCY for early wake... Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250624170049.27284-3-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar commit 4e3f3add4941a5751df05e733ccccf36d05d512c Author: Ville Syrjälä Date: Tue Jun 24 20:00:41 2025 +0300 drm/i915: Set PKG_C_LATENCY.added_wake_time to 0 AFAIK PKG_C_LATENCY.added_wake_time only matters for flip queue. As long as we're not using that there's no point in adding any extra wake time. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250624170049.27284-2-ville.syrjala@linux.intel.com commit a7549636f67f973474ebe1ad262acc2aa4d1327d Author: Gerd Hoffmann Date: Thu Jun 26 13:40:13 2025 +0200 x86/sev: Let sev_es_efi_map_ghcbs() map the CA pages too OVMF EFI firmware needs access to the CA page to do SVSM protocol calls. For example, when the SVSM implements an EFI variable store, such calls will be necessary. So add that to sev_es_efi_map_ghcbs() and also rename the function to reflect the additional job it is doing now. [ bp: Massage. ] Signed-off-by: Gerd Hoffmann Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250626114014.373748-4-kraxel@redhat.com commit 7b22e0432981c2fa230f1b493082b7e67112c4aa Author: Gerd Hoffmann Date: Thu Jun 26 13:40:11 2025 +0200 x86/sev/vc: Fix EFI runtime instruction emulation In case efi_mm is active go use the userspace instruction decoder which supports fetching instructions from active_mm. This is needed to make instruction emulation work for EFI runtime code, so it can use CPUID and RDMSR. EFI runtime code uses the CPUID instruction to gather information about the environment it is running in, such as SEV being enabled or not, and choose (if needed) the SEV code path for ioport access. EFI runtime code uses the RDMSR instruction to get the location of the CAA page (see SVSM spec, section 4.2 - "Post Boot"). The big picture behind this is that the kernel needs to be able to properly handle #VC exceptions that come from EFI runtime services. Since EFI runtime services have a special page table mapping for the EFI virtual address space, the efi_mm context must be used when decoding instructions during #VC handling. [ bp: Massage. ] Signed-off-by: Gerd Hoffmann Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Pankaj Gupta Link: https://lore.kernel.org/20250626114014.373748-2-kraxel@redhat.com commit 0dc6bfb50a5d0759e726cd36a3d3b7529fd2a627 Author: Hans de Goede Date: Thu Jun 26 16:33:17 2025 +0200 drm/i915/dsi: Fix NULL pointer deref in vlv_dphy_param_init() Commit 77ba0b856225 ("drm/i915/dsi: convert vlv_dsi.[ch] to struct intel_display") added a to_intel_display(connector) call to vlv_dphy_param_init() but when vlv_dphy_param_init() gets called the connector object has not been initialized yet, so this leads to a NULL pointer deref: BUG: kernel NULL pointer dereference, address: 000000000000000c ... Hardware name: ASUSTeK COMPUTER INC. T100TA/T100TA, BIOS T100TA.314 08/13/2015 RIP: 0010:vlv_dsi_init+0x4e6/0x1600 [i915] ... Call Trace: ? intel_step_name+0x4be8/0x5c30 [i915] intel_setup_outputs+0x2d6/0xbd0 [i915] intel_display_driver_probe_nogem+0x13f/0x220 [i915] i915_driver_probe+0x3d9/0xaf0 [i915] Use to_intel_display(&intel_dsi->base) instead to fix this. Fixes: 77ba0b856225 ("drm/i915/dsi: convert vlv_dsi.[ch] to struct intel_display") Signed-off-by: Hans de Goede Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250626143317.101706-1-hansg@kernel.org Signed-off-by: Jani Nikula commit ebbd17695e9e1f4c3cdb36149c8b8f38b585e14d Author: Dmitry Antipov Date: Thu Jun 26 19:07:50 2025 +0300 dm: ima: avoid extra calls to strlen() Since 'scnprintf()' returns the number of characters emitted (not including the trailing '\0'), use that return value instead of the subsequent calls to 'strlen()' where appropriate. Compile tested only. Signed-off-by: Dmitry Antipov Signed-off-by: Mikulas Patocka commit 46e001c003e30ed830a69e46c13ea02cd35b6093 Merge: ac4c064f67d3cd 2555691165a028 Author: Mark Brown Date: Fri Jun 27 12:07:07 2025 +0100 Add `devm_dma_request_chan()` to simplify probe Merge series from Bence Csókás : The probe function of the atmel-quadspi driver got quite convoluted, especially since the addition of SAMA7G5 support, that was forward-ported from an older vendor kernel. To alleivate this - and similar problems in the future - an effort was made to migrate as many functions as possible, to their devm_ managed counterparts. Patch 1/2 adds the new `devm_dma_request_chan()` function. Patch 2/2 then uses this APIs to simplify the probe() function. commit b462b0ef4d788d56f0e575406e58450358dcbd96 Author: Philipp Zabel Date: Tue May 27 16:21:48 2025 +0200 drm/bridge: samsung-dsim: Use HZ_PER_MHZ macro from units.h Drop the custom MHZ macro and replace it with HZ_PER_MHZ. Reviewed-by: Alexander Stein Reviewed-by: Frieder Schrempf Link: https://lore.kernel.org/r/20250527-samsung-dsim-v1-2-5be520d84fbb@pengutronix.de Signed-off-by: Philipp Zabel commit bafc628678796e3a05bd54c30280f4ecdaf3ebba Author: Philipp Zabel Date: Tue May 27 16:21:47 2025 +0200 drm/bridge: samsung-dsim: use while loop in samsung_dsim_transfer_start Turn the open-coded goto-again construct into a while loop, to make samsung_dsim_transfer_start() a bit shorter and easier to read. Hold the spinlock when looping back around and avoid the duplicated list_empty() check. Reviewed-by: Alexander Stein Reviewed-by: Frieder Schrempf Link: https://lore.kernel.org/r/20250527-samsung-dsim-v1-1-5be520d84fbb@pengutronix.de Signed-off-by: Philipp Zabel commit 017a6f7e7e25017eef9c30946cb0e7c803cb3f35 Author: Andy Shevchenko Date: Fri Jun 27 13:34:15 2025 +0300 firmware: sysfb: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Reviewed-by: Javier Martinez Canillas Reviewed-by: Thomas Zimmermann Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250627103454.702606-1-andriy.shevchenko@linux.intel.com Signed-off-by: Javier Martinez Canillas commit 548d88f74ed49c3c9dbd68550b7b335c2afa6413 Author: Damien Le Moal Date: Wed Jun 11 10:14:57 2025 +0900 dm: Simplify dm_io_complete() The local variable first_requeue is not needed since it is always equal to dm_io_flagged(io, DM_IO_WAS_SPLIT). Call __dm_io_complete() passing this value directly and remove first_requeue. Also declare dm_io_complete() as inline to make sure it is inlined in its single call site, thus avoiding the cost of a function call. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Mikulas Patocka commit d142643c06bcbc8be173a4d749adf42dd798a617 Author: Damien Le Moal Date: Wed Jun 11 10:14:56 2025 +0900 dm: Remove unnecessary return in dm_zone_endio() The return statement at the end of dm_zone_endio() is not needed. Remove it. Signed-off-by: Damien Le Moal Reviewed-by: Christoph Hellwig Signed-off-by: Mikulas Patocka commit 6b07ea713486587c48e6dd599e6307806fdd794a Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:36 2025 +0200 i2c: mux: pca954x: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) [wsa: proper commit header] Signed-off-by: Wolfram Sang commit 546b632e12292328e0adce0363eb5f05a53166de Author: Andy Shevchenko Date: Mon Jun 23 16:45:21 2025 +0300 i2c: acpi: Replace custom code with device_match_acpi_handle() Since driver core provides a generic device_match_acpi_handle() we may replace the custom code with it. Signed-off-by: Andy Shevchenko Signed-off-by: Wolfram Sang commit 98910fa0a487622d767d0674de3ce8fe02bde0b0 Author: Jocelyn Falempe Date: Tue Jun 24 11:01:20 2025 +0200 drm/i915/psr: Add intel_psr2_panic_force_full_update When the panic handler is called, configure the psr to send the full framebuffer to the monitor, otherwise the panic screen is only partially visible. Signed-off-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250624091501.257661-12-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit 0cc88243aa240e5807515d09b47336370df34de8 Author: Jocelyn Falempe Date: Tue Jun 24 11:01:19 2025 +0200 drm/i915/display: Add drm_panic support for 4-tiling with DPT On Alder Lake and later, it's not possible to disable tiling when DPT is enabled. So this commit implements 4-Tiling support, to still be able to draw the panic screen. Signed-off-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250624091501.257661-11-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit 116d86dd69af8a596e5a894393927627ab709636 Author: Jocelyn Falempe Date: Tue Jun 24 11:01:18 2025 +0200 drm/i915/display: Add drm_panic support for Y-tiling with DPT On Alder Lake and later, it's not possible to disable tiling when DPT is enabled. So this commit implements Y-Tiling support, to still be able to draw the panic screen. Signed-off-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250624091501.257661-10-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit 31d886b674079891fa4ae1843cd300c076b45b6b Author: Jocelyn Falempe Date: Tue Jun 24 11:01:17 2025 +0200 drm/i915/display: Add drm_panic support This adds drm_panic support for a wide range of Intel GPU. I've tested it only on 4 laptops, Haswell (with 128MB of eDRAM), Comet Lake, Raptor Lake, and Lunar Lake. For hardware using DPT, it's not possible to disable tiling, as you will need to reconfigure the way the GPU is accessing the framebuffer, so this will be handled by the following patches. Signed-off-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250624091501.257661-9-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit 75fb60e5ad5f154ca88e8d05e764cceb787fbffb Author: Jocelyn Falempe Date: Tue Jun 24 11:01:16 2025 +0200 drm/i915: Add intel_bo_panic_setup() and intel_bo_panic_finish() Implement both functions for i915 and xe, they prepare the work for drm_panic support. They both use kmap_try_from_panic(), and map one page at a time, to write the panic screen on the framebuffer. Signed-off-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250624091501.257661-8-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit da091afacb29b120929d181d7aea7275848ead81 Author: Jocelyn Falempe Date: Tue Jun 24 11:01:15 2025 +0200 drm/i915: Add intel_bo_alloc_framebuffer() Encapsulate the struct intel_framebuffer into an xe_framebuffer or i915_framebuffer, and allow to add specific fields for each variant for the panic use-case. This is particularly needed to have a struct xe_res_cursor available to support drm panic on discrete GPU. Signed-off-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250624091501.257661-7-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit 718370ff283284f191155a5eb9d4f376aaf93bb8 Author: Jocelyn Falempe Date: Tue Jun 24 11:01:14 2025 +0200 drm/ttm: Add ttm_bo_kmap_try_from_panic() If the ttm bo is backed by pages, then it's possible to safely kmap one page at a time, using kmap_try_from_panic(). Unfortunately there is no way to do the same with ioremap, so it only supports the kmap case. This is needed for proper drm_panic support with xe driver. Signed-off-by: Jocelyn Falempe Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250624091501.257661-6-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit 796f437d7bc9ff0a5099fa2b8018c9736877555b Author: Jocelyn Falempe Date: Tue Jun 24 11:01:13 2025 +0200 drm/i915/display: Add a disable_tiling() for skl planes drm_panic draws in linear framebuffer, so it's easier to re-use the current framebuffer, and disable tiling in the panic handler, to show the panic screen. This assumes that the alignment restriction is always smaller in linear than in tiled. It also assumes that the linear framebuffer size is always smaller than the tiled. Signed-off-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250624091501.257661-5-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit 32e2450a89fd3582614f7a2e2c14660615b603c2 Author: Jocelyn Falempe Date: Tue Jun 24 11:01:12 2025 +0200 drm/i915/display/i9xx: Add a disable_tiling() for i9xx planes drm_panic draws in linear framebuffer, so it's easier to re-use the current framebuffer, and disable tiling in the panic handler, to show the panic screen. This assumes that the alignment restriction is always smaller in linear than in tiled. It also assumes that the linear framebuffer size is always smaller than the tiled. Signed-off-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250624091501.257661-4-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit d2782a0d8ff80f9fea36b7499b04c30f9c92d5a7 Author: Jocelyn Falempe Date: Tue Jun 24 11:01:11 2025 +0200 drm/i915/fbdev: Add intel_fbdev_get_map() The vaddr of the fbdev framebuffer is private to the struct intel_fbdev, so this function is needed to access it for drm_panic. Also the struct i915_vma is different between i915 and xe, so it requires a few functions to access fbdev->vma->iomap. Signed-off-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250624091501.257661-3-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit 3dd922c418903be7dd8df7212f968e94d0fe73c7 Author: Jocelyn Falempe Date: Tue Jun 24 11:01:10 2025 +0200 drm/panic: Add a private field to struct drm_scanout_buffer This allows driver to set some private data in get_scanout_buffer(), and re-use them in set_pixel() callback. Signed-off-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250624091501.257661-2-jfalempe@redhat.com Signed-off-by: Maarten Lankhorst commit 8efa26fcbf8a7f783fd1ce7dd2a409e9b7758df0 Author: Simon Horman Date: Wed Jun 25 13:52:10 2025 +0100 tg3: spelling corrections Correct spelling as flagged by codespell. Signed-off-by: Simon Horman Reviewed-by: Michael Chan Signed-off-by: David S. Miller commit 17a3657e09a326b3417a46ae0044163f2c9c03ed Author: André Draszik Date: Sat May 24 06:21:31 2025 +0100 arm64: dts: exynos: gs101: add dm-verity-device-corrupted syscon-reboot-mode On gs101, the boot mode is stored both in a syscon register, and in nvmem. Add the dm-verity-device-corrupted reboot mode to the syscon-reboot- based boot mode as well, as both (nvmem & syscon) modes should be in sync. Signed-off-by: André Draszik Reviewed-by: Peter Griffin Link: https://lore.kernel.org/r/20250524-b4-max77759-mfd-dts-v2-4-b479542eb97d@linaro.org Signed-off-by: Krzysztof Kozlowski commit 4292d18257c4a296f4b9e56a83ae22fecb63e727 Author: André Draszik Date: Sat May 24 06:21:30 2025 +0100 arm64: dts: exynos: gs101-pixel-common: add nvmem-reboot-mode Add the 'nvmem-reboot-mode' which is used to communicate a requested boot mode to the boot loader. Signed-off-by: André Draszik Reviewed-by: Peter Griffin Link: https://lore.kernel.org/r/20250524-b4-max77759-mfd-dts-v2-3-b479542eb97d@linaro.org Signed-off-by: Krzysztof Kozlowski commit 8deaddf13538d68f4d7bd14a65dcd511ec0aba4e Author: André Draszik Date: Sat May 24 06:21:29 2025 +0100 arm64: dts: exynos: gs101-pixel-common: add Maxim MAX77759 PMIC On Pixel 6 (and Pro), a MAX77759 companion PMIC for USB Type-C applications is used, which contains four functional blocks (at distinct I2C addresses): * top (including GPIO & NVMEM) * charger * fuel gauge * TCPCi This change adds the PMIC and the subnodes for the GPIO expander and NVMEM, and defines the NVMEM layout. The NVMEM layout is declared such that it matches downstream's open-coded configuration [1]. Note: The pinctrl nodes are kept sorted by the 'samsung,pins' property rather than node name, as I think that makes it easier to look at and to add new nodes unambiguously in the future. Its label is prefixed with 'if' (for interface), because there are three PMICs in total in use on Pixel 6 (Pro). Link: https://android.googlesource.com/kernel/google-modules/bms/+/96e729a83817/max77759_maxq.c#67 [1] Signed-off-by: André Draszik Reviewed-by: Peter Griffin Link: https://lore.kernel.org/r/20250524-b4-max77759-mfd-dts-v2-2-b479542eb97d@linaro.org Signed-off-by: Krzysztof Kozlowski commit ffdf3c776914f89dfb452e2a572e5bb7e89ccad8 Author: André Draszik Date: Sat May 24 06:21:28 2025 +0100 arm64: defconfig: enable Maxim max77759 driver Enable the Maxim max77759 as this is used by the gs101-oriole and gs101-raven (Google Pixel 6 and Pixel 6 Pro) boards, The child devices' defaults are based on this MFD driver's state, so this commit enables those implicitly as well. Signed-off-by: André Draszik Reviewed-by: Peter Griffin Link: https://lore.kernel.org/r/20250524-b4-max77759-mfd-dts-v2-1-b479542eb97d@linaro.org Signed-off-by: Krzysztof Kozlowski commit 67e3ba978361cb262f8f8981ab88ccb97f1e2bda Author: Christian Marangi Date: Tue Jun 17 11:16:53 2025 +0200 net: mdio: Add MDIO bus controller for Airoha AN7583 Airoha AN7583 SoC have 2 dedicated MDIO bus controller in the SCU register map. To driver register an MDIO controller based on the DT reg property and access the register by accessing the parent syscon. The MDIO bus logic is similar to the MT7530 internal MDIO bus but deviates of some setting and some HW bug. On Airoha AN7583 the MDIO clock is set to 25MHz by default and needs to be correctly setup to 2.5MHz to correctly work (by setting the divisor to 10x). There seems to be Hardware bug where AN7583_MII_RWDATA is not wiped in the context of unconnected PHY and the previous read value is returned. Example: (only one PHY on the BUS at 0x1f) - read at 0x1f report at 0x2 0x7500 - read at 0x0 report 0x7500 on every address To workaround this, we reset the Mdio BUS at every read to have consistent values on read operation. Signed-off-by: Christian Marangi Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller commit a6ee35bd1fe0ef91135479c18ff63af3ef9fe11d Author: Christian Marangi Date: Tue Jun 17 11:16:52 2025 +0200 dt-bindings: net: Document support for Airoha AN7583 MDIO Controller Airoha AN7583 SoC have 3 different MDIO Controller. One comes from the intergated Switch based on MT7530. The other 2 live under the SCU register and expose 2 dedicated MDIO controller. Document the schema for the 2 dedicated MDIO controller. Each MDIO controller can be independently reset with the SoC reset line. Each MDIO controller have a dedicated clock configured to 2.5MHz by default to follow MDIO bus IEEE 802.3 standard. Signed-off-by: Christian Marangi Signed-off-by: David S. Miller commit e0a69cf2c03e61bd8069becb97f66c173d0d1fa1 Author: Tingmao Wang Date: Sun Jun 15 17:09:36 2025 +0100 landlock: Fix warning from KUnit tests get_id_range() expects a positive value as first argument but get_random_u8() can return 0. Fix this by clamping it. Validated by running the test in a for loop for 1000 times. Note that MAX() is wrong as it is only supposed to be used for constants, but max() is good here. [..] ok 9 test_range2_rand1 [..] ok 10 test_range2_rand2 [..] ok 11 test_range2_rand15 [..] ------------[ cut here ]------------ [..] WARNING: CPU: 6 PID: 104 at security/landlock/id.c:99 test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1)) [..] Modules linked in: [..] CPU: 6 UID: 0 PID: 104 Comm: kunit_try_catch Tainted: G N 6.16.0-rc1-dev-00001-g314a2f98b65f #1 PREEMPT(undef) [..] Tainted: [N]=TEST [..] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [..] RIP: 0010:test_range2_rand16 (security/landlock/id.c:99 (discriminator 1) security/landlock/id.c:234 (discriminator 1)) [..] Code: 49 c7 c0 10 70 30 82 4c 89 ff 48 c7 c6 a0 63 1e 83 49 c7 45 a0 e0 63 1e 83 e8 3f 95 17 00 e9 1f ff ff ff 0f 0b e9 df fd ff ff <0f> 0b ba 01 00 00 00 e9 68 fe ff ff 49 89 45 a8 49 8d 4d a0 45 31 [..] RSP: 0000:ffff888104eb7c78 EFLAGS: 00010246 [..] RAX: 0000000000000000 RBX: 000000000870822c RCX: 0000000000000000 ^^^^^^^^^^^^^^^^ [..] [..] Call Trace: [..] [..] ---[ end trace 0000000000000000 ]--- [..] ok 12 test_range2_rand16 [..] # landlock_id: pass:12 fail:0 skip:0 total:12 [..] # Totals: pass:12 fail:0 skip:0 total:12 [..] ok 1 landlock_id Fixes: d9d2a68ed44b ("landlock: Add unique ID generator") Signed-off-by: Tingmao Wang Link: https://lore.kernel.org/r/73e28efc5b8cc394608b99d5bc2596ca917d7c4a.1750003733.git.m@maowtm.org [mic: Minor cosmetic improvements] Signed-off-by: Mickaël Salaün commit 26d1c1f9e3111cac346346eb38eb2dc6a3c53993 Author: Krzysztof Kozlowski Date: Tue Jun 24 14:22:31 2025 +0200 iommu/omap: Use syscon_regmap_lookup_by_phandle_args Use syscon_regmap_lookup_by_phandle_args() which is a wrapper over syscon_regmap_lookup_by_phandle() combined with getting the syscon argument. Except simpler code this annotates within one line that given phandle has arguments, so grepping for code would be easier. There is also no real benefit in printing errors on missing syscon argument, because this is done just too late: runtime check on static/build-time data. Dtschema and Devicetree bindings offer the static/build-time check for this already. Reviewed-by: Robin Murphy Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250624-syscon-phandle-args-iommu-v3-2-1a36487d69b8@linaro.org Signed-off-by: Joerg Roedel commit 217d30bb8ee84feb0def7d31b93bce7ca52b5793 Author: Krzysztof Kozlowski Date: Tue Jun 24 14:22:30 2025 +0200 iommu/omap: Drop redundant check if ti,syscon-mmuconfig exists The syscon_regmap_lookup_by_phandle() will fail if property does not exist, so doing of_property_read_bool() earlier is redundant. Drop that check and move error message to syscon_regmap_lookup_by_phandle() error case while converting it to dev_err_probe(). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Robin Murphy Link: https://lore.kernel.org/r/20250624-syscon-phandle-args-iommu-v3-1-1a36487d69b8@linaro.org Signed-off-by: Joerg Roedel commit 46a7418a3aa62fde7a5cdf6b6de9a6549daa4aa4 Author: Sven Peter Date: Thu Jun 12 21:11:31 2025 +0000 iommu/apple-dart: Drop default ARCH_APPLE in Kconfig When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Signed-off-by: Sven Peter Acked-by: Robin Murphy Reviewed-by: Janne Grunau Link: https://lore.kernel.org/r/20250612-apple-kconfig-defconfig-v1-7-0e6f9cb512c1@kernel.org Signed-off-by: Joerg Roedel commit db64591de4b2928288fca8b1fbcd5d61c57cbb0a Author: Jason Gunthorpe Date: Mon Jun 9 17:41:30 2025 -0300 iommu/qcom: Remove iommu_ops pgsize_bitmap This driver just uses a constant, put it in domain_alloc_paging and use the domain's value instead of ops during init_domain. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Tested-by: Nicolin Chen Link: https://lore.kernel.org/r/6-v2-68a2e1ba507c+1fb-iommu_rm_ops_pgsize_jgg@nvidia.com Signed-off-by: Joerg Roedel commit b155e26df5da1f066847d35bba482e3f859ecf9e Author: Jason Gunthorpe Date: Mon Jun 9 17:41:29 2025 -0300 iommu/mtk: Remove iommu_ops pgsize_bitmap This driver just uses a constant, put it in domain_alloc_paging and use the domain's value instead of ops during finalise. Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe Reviewed-by: AngeloGioacchino Del Regno Tested-by: Nicolin Chen Link: https://lore.kernel.org/r/5-v2-68a2e1ba507c+1fb-iommu_rm_ops_pgsize_jgg@nvidia.com Signed-off-by: Joerg Roedel commit cf39047e460e86c4bc060e219f7cf4142eadf97e Author: Jason Gunthorpe Date: Mon Jun 9 17:41:28 2025 -0300 iommu: Remove iommu_ops pgsize_bitmap from simple drivers These drivers just have a constant value for their page size, move it into their domain_alloc_paging function before setting up the geometry. Reviewed-by: Kevin Tian Acked-by: Niklas Schnelle # for s390-iommu.c Signed-off-by: Jason Gunthorpe Acked-by: Marek Szyprowski # for exynos-iommu.c Reviewed-by: AngeloGioacchino Del Regno Acked-by: Thierry Reding Acked-by: Chen-Yu Tsai # sun50i-iommu.c Tested-by: Nicolin Chen Link: https://lore.kernel.org/r/4-v2-68a2e1ba507c+1fb-iommu_rm_ops_pgsize_jgg@nvidia.com Signed-off-by: Joerg Roedel commit 8901812485de1356e3757958af40fe0d3a48e986 Author: Jason Gunthorpe Date: Mon Jun 9 17:41:27 2025 -0300 iommu: Remove ops.pgsize_bitmap from drivers that don't use it These drivers all set the domain->pgsize_bitmap in their domain_alloc_paging() functions, so the ops value is never used. Delete it. Reviewed-by: Sven Peter # for Apple DART Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Reviewed-by: Tomasz Jeznach # for RISC-V Signed-off-by: Jason Gunthorpe Tested-by: Nicolin Chen Link: https://lore.kernel.org/r/3-v2-68a2e1ba507c+1fb-iommu_rm_ops_pgsize_jgg@nvidia.com Signed-off-by: Joerg Roedel commit 35145e069e82bd89282318465e3ed521c2c3e5fb Author: Jason Gunthorpe Date: Mon Jun 9 17:41:26 2025 -0300 iommu/arm-smmu: Remove iommu_ops pgsize_bitmap The driver never reads this value, arm_smmu_init_domain_context() always sets domain.pgsize_bitmap to smmu->pgsize_bitmap, the per-instance value. Remove the ops version entirely, the related dead code and make arm_smmu_ops const. Since this driver does not yet finalize the domain under arm_smmu_domain_alloc_paging() add a page size initialization to alloc so the page size is still setup prior to attach. Reviewed-by: Kevin Tian Acked-by: Will Deacon Signed-off-by: Jason Gunthorpe Tested-by: Nicolin Chen Link: https://lore.kernel.org/r/2-v2-68a2e1ba507c+1fb-iommu_rm_ops_pgsize_jgg@nvidia.com Signed-off-by: Joerg Roedel commit b5dac93cb61df67750a5f0667e675877306d7ff3 Author: Jason Gunthorpe Date: Mon Jun 9 17:41:25 2025 -0300 qiommu/arm-smmu-v3: Remove iommu_ops pgsize_bitmap The driver never reads this value, arm_smmu_domain_finalise() always sets domain.pgsize_bitmap to pgtbl_cfg, which comes from the per-smmu calculated value. Remove the ops version entirely, the related dead code and make arm_smmu_ops const. Reviewed-by: Kevin Tian Acked-by: Will Deacon Signed-off-by: Jason Gunthorpe Reviewed-by: Nicolin Chen Tested-by: Nicolin Chen Link: https://lore.kernel.org/r/1-v2-68a2e1ba507c+1fb-iommu_rm_ops_pgsize_jgg@nvidia.com Signed-off-by: Joerg Roedel commit 025d1371cc8c852ae1b3c2916cf7403902346350 Author: Ankit Soni Date: Wed Jun 4 06:13:25 2025 +0000 iommu/amd: Add efr[HATS] max v1 page table level The EFR[HATS] bits indicate maximum host translation level supported by IOMMU. Adding support to set the maximum host page table level as indicated by EFR[HATS]. If the HATS=11b (reserved), the driver will attempt to use guest page table for DMA API. Reviewed-by: Vasant Hegde Reviewed-by: Suravee Suthikulpanit Signed-off-by: Ankit Soni Link: https://lore.kernel.org/r/df0f8562c2a20895cc185c86f1a02c4d826fd597.1749016436.git.Ankit.Soni@amd.com Signed-off-by: Joerg Roedel commit 7e5516e60961248bbde7381038ff74bdbf6c565e Author: Ankit Soni Date: Wed Jun 4 06:13:24 2025 +0000 iommu/amd: Add HATDis feature support Current AMD IOMMU assumes Host Address Translation (HAT) is always supported, and Linux kernel enables this capability by default. However, in case of emulated and virtualized IOMMU, this might not be the case. For example,current QEMU-emulated AMD vIOMMU does not support host translation for VFIO pass-through device, but the interrupt remapping support is required for x2APIC (i.e. kvm-msi-ext-dest-id is also not supported by the guest OS). This would require the guest kernel to boot with guest kernel option iommu=pt to by-pass the initialization of host (v1) table. The AMD I/O Virtualization Technology (IOMMU) Specification Rev 3.10 [1] introduces a new flag 'HATDis' in the IVHD 11h IOMMU attributes to indicate that HAT is not supported on a particular IOMMU instance. Therefore, modifies the AMD IOMMU driver to detect the new HATDis attributes, and disable host translation and switch to use guest translation if it is available. Otherwise, the driver will disable DMA translation. [1] https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/specifications/48882_IOMMU.pdf Reviewed-by: Suravee Suthikulpanit Signed-off-by: Ankit Soni Link: https://lore.kernel.org/r/8109b208f87b80e400c2abd24a2e44fcbc0763a5.1749016436.git.Ankit.Soni@amd.com Signed-off-by: Joerg Roedel commit 4afcdbbd38e27ec04a349f8ba23f64b92b47fa9c Author: Krzysztof Karas Date: Wed Jun 18 13:52:22 2025 +0000 drm/i915: move GEM_QUIRK_PIN_SWIZZLED_PAGES to i915_gem.h Move this macro where other GEM_* definitions live. Reviewed-by: Andi Shyti Signed-off-by: Krzysztof Karas Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/all/ca83a9d8aa86bb92de84c31fd075e92a61f78895.1750251040.git.krzysztof.karas@intel.com commit dcf558293fd8c6408a3acb2a534715af48ee63b3 Author: Krzysztof Karas Date: Wed Jun 18 13:51:30 2025 +0000 drm/i915: Move out engine related macros from i915_drv.h Move macros related to engines out of i915_drv.h header and place them in intel_engine.h. Signed-off-by: Krzysztof Karas Reviewed-by: Andi Shyti Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/9b9ed5bbdb37470fa679c5baf961424c9cfbad11.1750251040.git.krzysztof.karas@intel.com commit 0e3dd41a94b29d5d9973dac356ebd37f87bd8a37 Author: Florian Fainelli Date: Mon Jun 9 14:23:56 2025 -0700 memory: brcmstb_memc: Simplify compatible matching Now that a "brcm,brcmstb-memc-ddr-rev-b.2.x" fallback compatible string has been defined, we can greatly simplify the matching within the driver to only look for that compatible string and nothing else. The fallback "brcm,brcmstb-memc-ddr" is also updated to assume the V21 register layout since that is the most common nowadays. Signed-off-by: Florian Fainelli Link: https://lore.kernel.org/r/20250609212356.2264244-3-florian.fainelli@broadcom.com Signed-off-by: Krzysztof Kozlowski commit 501be7cecec9aaf9cd52e76d0820efd6d0b952e7 Author: Florian Fainelli Date: Mon Jun 9 14:23:55 2025 -0700 dt-bindings: memory-controller: Define fallback compatible All of the DDR controllers beyond revision b.2.1 have had a consistent layout, therefore define a "brcm,brcmstb-memc-ddr-rev-b.2.1" fallback compatible string to match them all rather than having to continuously add to the list. Link: https://lore.kernel.org/all/20241217194439.929040-2-florian.fainelli@broadcom.com/ Signed-off-by: Florian Fainelli Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250609212356.2264244-2-florian.fainelli@broadcom.com Signed-off-by: Krzysztof Kozlowski commit de13141516add30adf581561755f3f45d82b50ba Author: Frank Li Date: Tue Jun 24 18:46:30 2025 -0400 dt-bindings: interrupt-controller: Add arm,armv7m-nvic and fix #interrupt-cells According to existed dts arch/arm/boot/dts/armv7-m.dtsi and driver drivers/irqchip/irq-nvic.c, compatible string should be arm,armv7m-nvic, Fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/vf/vf610m4-cosmic.dtb: /interrupt-controller@e000e100: failed to match any schema with compatible: ['arm,armv7m-nvic'] Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250624224630.2518776-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit 1b22afb15d697f134bc870a04fb5c7c339b013ce Author: Frank Li Date: Mon Jun 23 16:40:46 2025 -0400 dt-bindings: trivial-devices: add compatible string nxp,isp1301 from isp1301.txt Delete isp1301.txt and add compatible string nxp,isp1301 to trivial-devices because this i2c device have only reg propepty. Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250623204048.2493819-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit 48d998af99f9e78ac8a8e405c50a7af64a5325a6 Merge: 6def0822d211df 13b0cce9e294f8 Author: Alexei Starovoitov Date: Thu Jun 26 18:59:07 2025 -0700 Merge branch 'vfs-6.17.bpf' of https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Merge branch 'vfs-6.17.bpf' from vfs tree into bpf-next/master and resolve conflicts. Signed-off-by: Alexei Starovoitov commit 1ea2e106130adc3e3424dd0607b72847313d2367 Merge: b7863babce0a7a b66d28142dc43f Author: Jakub Kicinski Date: Thu Jun 26 17:54:10 2025 -0700 Merge branch 'ptp-belated-spring-cleaning-of-the-chardev-driver' Thomas Gleixner says: ==================== ptp: Belated spring cleaning of the chardev driver When looking into supporting auxiliary clocks in the PTP ioctl, the inpenetrable ptp_ioctl() letter soup bothered me enough to clean it up. The code (~400 lines!) is really hard to follow due to a gazillion of local variables, which are only used in certain case scopes, and a mixture of gotos, breaks and direct error return paths. Clean it up by splitting out the IOCTL functionality into seperate functions, which contain only the required local variables and are trivial to follow. Complete the cleanup by converting the code to lock guards and get rid of all gotos. That reduces the code size by 48 lines and also the binary text size is 80 bytes smaller than the current maze. The series is split up into one patch per IOCTL command group for easy review. v1: https://lore.kernel.org/20250620130144.351492917@linutronix.de ==================== Link: https://patch.msgid.link/20250625114404.102196103@linutronix.de Signed-off-by: Jakub Kicinski commit b66d28142dc43f25555b8c1321353ab4b1eccf8d Author: Thomas Gleixner Date: Wed Jun 25 13:52:39 2025 +0200 ptp: Simplify ptp_read() The mixture of gotos and direct return codes is inconsistent and just makes the code harder to read. Let it consistently return error codes directly and tidy the code flow up accordingly. No functional change intended. Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20250625115133.486953538@linutronix.de Signed-off-by: Jakub Kicinski commit 4838bc9e279c566692ee20d241c71626d71240f9 Author: Thomas Gleixner Date: Wed Jun 25 13:52:38 2025 +0200 ptp: Convert chardev code to lock guards Convert the various spin_lock_irqsave() protected critical regions to scoped guards. Use spinlock_irq instead of spinlock_irqsave as all the functions are invoked in thread context with interrupts enabled. No functional change intended. Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20250625115133.425029269@linutronix.de Signed-off-by: Jakub Kicinski commit 745e3c751c4d339d9e443398ce45fcbd8972ed0e Author: Thomas Gleixner Date: Wed Jun 25 13:52:36 2025 +0200 ptp: Split out PTP_MASK_EN_SINGLE ioctl code Finish the ptp_ioctl() cleanup by splitting out the PTP_MASK_EN_SINGLE ioctl code and removing the remaining local variables and return statements. No functional change intended. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250625115133.364422719@linutronix.de Signed-off-by: Jakub Kicinski commit 6a0f480478a7ef802ad801eb4690b24442618f50 Author: Thomas Gleixner Date: Wed Jun 25 13:52:35 2025 +0200 ptp: Split out PTP_MASK_CLEAR_ALL ioctl code Continue the ptp_ioctl() cleanup by splitting out the PTP_MASK_CLEAR_ALL ioctl code into a helper function. No functional change intended. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250625115133.302755618@linutronix.de Signed-off-by: Jakub Kicinski commit d713f1ff64d16e6f542acdd5a7819eba0d939094 Author: Thomas Gleixner Date: Wed Jun 25 13:52:34 2025 +0200 ptp: Split out PTP_PIN_SETFUNC ioctl code Continue the ptp_ioctl() cleanup by splitting out the PTP_PIN_SETFUNC ioctl code into a helper function. Convert to lock guard while at it and remove the pointless memset of the pd::rsv because nothing uses it. No functional change intended. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250625115133.241503804@linutronix.de Signed-off-by: Jakub Kicinski commit b246e09f5fe189946e50151f5f04cded73593f19 Author: Thomas Gleixner Date: Wed Jun 25 13:52:33 2025 +0200 ptp: Split out PTP_PIN_GETFUNC ioctl code Continue the ptp_ioctl() cleanup by splitting out the PTP_PIN_GETFUNC ioctl code into a helper function. Convert to lock guard while at it and remove the pointless memset of the pd::rsv because nothing uses it. No functional change intended. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250625115133.177265865@linutronix.de Signed-off-by: Jakub Kicinski commit 4b676af26e9b1421016e707012e8a816bc3cdf50 Author: Thomas Gleixner Date: Wed Jun 25 13:52:31 2025 +0200 ptp: Split out PTP_SYS_OFFSET ioctl code Continue the ptp_ioctl() cleanup by splitting out the PTP_SYS_OFFSET ioctl code into a helper function. Convert it to __free() to avoid gotos. No functional change intended. Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20250625115133.113841216@linutronix.de Signed-off-by: Jakub Kicinski commit 37e42f8dd07d651d7dbd545115159fa4bc1baf54 Author: Thomas Gleixner Date: Wed Jun 25 13:52:30 2025 +0200 ptp: Split out PTP_SYS_OFFSET_EXTENDED ioctl code Continue the ptp_ioctl() cleanup by splitting out the PTP_SYS_OFFSET_EXTENDED ioctl code into a helper function. Convert it to __free() to avoid gotos. No functional change intended. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250625115133.050445505@linutronix.de Signed-off-by: Jakub Kicinski commit e4355e314c94b34cb1a90bda0a2932584a0722ab Author: Thomas Gleixner Date: Wed Jun 25 13:52:29 2025 +0200 ptp: Split out PTP_SYS_OFFSET_PRECISE ioctl code Continue the ptp_ioctl() cleanup by splitting out the PTP_SYS_OFFSET_PRECISE ioctl code into a helper function. No functional change intended. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250625115132.986897454@linutronix.de Signed-off-by: Jakub Kicinski commit 47aaa73d25ea58397d003cc5b4b95fdb730f853d Author: Thomas Gleixner Date: Wed Jun 25 13:52:28 2025 +0200 ptp: Split out PTP_ENABLE_PPS ioctl code Continue the ptp_ioctl() cleanup by splitting out the PTP_ENABLE_PPS ioctl code into a helper function. Convert to a lock guard while at it. No functional change intended. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250625115132.923803136@linutronix.de Signed-off-by: Jakub Kicinski commit 3afc2caceaf7076c75011d2584d3186556359cae Author: Thomas Gleixner Date: Wed Jun 25 13:52:27 2025 +0200 ptp: Split out PTP_PEROUT_REQUEST ioctl code Continue the ptp_ioctl() cleanup by splitting out the PTP_PEROUT_REQUEST ioctl code into a helper function. Convert to a lock guard while at it. No functional change intended. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250625115132.860150473@linutronix.de Signed-off-by: Jakub Kicinski commit f6b3e1bc6ed3b1b9e5543c6570ef41b8a1544081 Author: Thomas Gleixner Date: Wed Jun 25 13:52:25 2025 +0200 ptp: Split out PTP_EXTTS_REQUEST ioctl code Continue the ptp_ioctl() cleanup by splitting out the PTP_EXTTS_REQUEST ioctl code into a helper function. Convert to a lock guard while at it. No functional change intended. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250625115132.797588258@linutronix.de Signed-off-by: Jakub Kicinski commit 7ca2ac4953fd191929c5467a2176fcf9e280542f Author: Thomas Gleixner Date: Wed Jun 25 13:52:24 2025 +0200 ptp: Split out PTP_CLOCK_GETCAPS ioctl code ptp_ioctl() is an inpenetrable letter soup with a gazillion of case (scope) specific variables defined at the top of the function and pointless breaks and gotos. Start cleaning it up by splitting out the PTP_CLOCK_GETCAPS ioctl code into a helper function. Use a argument pointer with a single sparse compliant type cast instead of proliferating the type cast all over the place. No functional change intended. Signed-off-by: Thomas Gleixner Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250625115132.733409073@linutronix.de Signed-off-by: Jakub Kicinski commit b7863babce0a7aacb252e50d75b192476aa81ea1 Author: Petr Machata Date: Wed Jun 25 12:41:23 2025 +0200 selftests: forwarding: lib: Split setup_wait() setup_wait() takes an optional argument and then is called from the top level of the test script. That confuses shellcheck, which thinks that maybe the intention is to pass $1 of the script to the function, which is never the case. To avoid having to annotate every single new test with a SC disable, split the function in two: one that takes a mandatory argument, and one that takes no argument at all. Convert the two existing users of that optional argument, both in Spectrum resource selftest, to use the new form. Clean up vxlan_bridge_1q_mc_ul.sh to not pass a now-unused argument. Signed-off-by: Petr Machata Link: https://patch.msgid.link/8e13123236fe3912ae29bc04a1528bdd8551da1f.1750847794.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 040ae95a984f04afa5d300a97d11643a1577aa72 Author: Yue Haibing Date: Wed Jun 25 18:21:55 2025 +0800 net: Remove unused function first_net_device_rcu() This is unused since commit f04565ddf52e ("dev: use name hash for dev_seq_ops") Signed-off-by: Yue Haibing Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250625102155.483570-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 77e12dba07d08080e5124cd9320577f2832a9eab Author: Yue Haibing Date: Wed Jun 25 10:20:59 2025 +0800 ipv4: fib: Remove unnecessary encap_type check lwtunnel_build_state() has check validity of encap_type, so no need to do this before call it. Signed-off-by: Yue Haibing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250625022059.3958215-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 32155c6fd9ec57e10a4d9bb15d52597f94664f7b Merge: 4cd9d227ab838b 16f3c7ad887c1f Author: Jakub Kicinski Date: Thu Jun 26 17:13:16 2025 -0700 Merge tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Daniel Borkmann says: ==================== pull-request: bpf-next 2025-06-27 We've added 6 non-merge commits during the last 8 day(s) which contain a total of 6 files changed, 120 insertions(+), 20 deletions(-). The main changes are: 1) Fix RCU usage in task_cls_state() for BPF programs using helpers like bpf_get_cgroup_classid_curr() outside of networking, from Charalampos Mitrodimas. 2) Fix a sockmap race between map_update and a pending workqueue from an earlier map_delete freeing the old psock where both pointed to the same psock->sk, from Jiayuan Chen. 3) Fix a data corruption issue when using bpf_msg_pop_data() in kTLS which failed to recalculate the ciphertext length, also from Jiayuan Chen. 4) Remove xdp_redirect_map{,_err} trace events since they are unused and also hide XDP trace events under CONFIG_BPF_SYSCALL, from Steven Rostedt. * tag 'for-netdev' of https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: xdp: tracing: Hide some xdp events under CONFIG_BPF_SYSCALL xdp: Remove unused events xdp_redirect_map and xdp_redirect_map_err net, bpf: Fix RCU usage in task_cls_state() for BPF programs selftests/bpf: Add test to cover ktls with bpf_msg_pop_data bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls bpf, sockmap: Fix psock incorrectly pointing to sk ==================== Link: https://patch.msgid.link/20250626230111.24772-1-daniel@iogearbox.net Signed-off-by: Jakub Kicinski commit 304c102cff7382353a28039907a7017bde795db9 Author: Krzysztof Kozlowski Date: Mon Jun 16 08:25:42 2025 +0200 phy: qcom: qmp-combo: Add missing PLL (VCO) configuration on SM8750 Add missing DP PHY status and VCO clock configuration registers to fix configuring the VCO rate on SM8750. Without proper VCO rate setting, it works on after-reset half of rate which is not enough for DP over USB to work as seen on logs: [drm:msm_dp_ctrl_link_train_1_2] *ERROR* max v_level reached [drm:msm_dp_ctrl_link_train_1_2] *ERROR* link training #1 on phy 0 failed. ret=-11 Fixes: c4364048baf4 ("phy: qcom: qmp-combo: Add new PHY sequences for SM8750") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250616062541.7167-2-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit 4cd9d227ab838b3590c4b27e3707b8c3ef14d7e9 Author: Lorenzo Bianconi Date: Wed Jun 25 16:43:15 2025 +0200 net: airoha: Get rid of dma_sync_single_for_device() in airoha_qdma_fill_rx_queue() Since the page_pool for airoha_eth driver is created with PP_FLAG_DMA_SYNC_DEV flag, we do not need to sync_for_device each page received from the pool since it is already done by the page_pool codebase. Signed-off-by: Lorenzo Bianconi Reviewed-by: Alexander Lobakin Link: https://patch.msgid.link/20250625-airoha-sync-for-device-v1-1-923741deaabf@kernel.org Signed-off-by: Jakub Kicinski commit 2bff9083c1744dc8751ddc0844a65e3bee89f519 Author: Johan Hovold Date: Tue Jun 17 10:04:01 2025 +0200 phy: qcom: m31-eusb2: drop registration printk Drivers should generally be quiet on successful probe so drop the registration printk from the recently added M31 EUSB2 driver. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250617080401.11147-1-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 603bd9808f58009e1f230271f94e1b9e13d506ba Author: Johan Hovold Date: Tue Jun 17 10:05:03 2025 +0200 phy: qcom: m31-eusb2: fix match data santity check The device_get_match_data() helper returns NULL if a new entry is ever added without corresponding match data. Fixes: 9c8504861cc4 ("phy: qcom: Add M31 based eUSB2 PHY driver") Cc: Wesley Cheng Cc: Melody Olvera Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250617080503.11262-1-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 11cd0206987205ee05b0abd70a8eafa400ba89e3 Author: Erni Sri Satya Vennela Date: Wed Jun 25 04:35:55 2025 -0700 net: mana: Fix build errors when CONFIG_NET_SHAPER is disabled Fix build errors when CONFIG_NET_SHAPER is disabled, including: drivers/net/ethernet/microsoft/mana/mana_en.c:804:10: error: 'const struct net_device_ops' has no member named 'net_shaper_ops' 804 | .net_shaper_ops = &mana_shaper_ops, drivers/net/ethernet/microsoft/mana/mana_en.c:804:35: error: initialization of 'int (*)(struct net_device *, struct neigh_parms *)' from incompatible pointer type 'const struct net_shaper_ops *' [-Werror=incompatible-pointer-types] 804 | .net_shaper_ops = &mana_shaper_ops, Signed-off-by: Erni Sri Satya Vennela Fixes: 75cabb46935b ("net: mana: Add support for net_shaper_ops") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506230625.bfUlqb8o-lkp@intel.com/ Reviewed-by: Simon Horman Link: https://patch.msgid.link/1750851355-8067-1-git-send-email-ernis@linux.microsoft.com Signed-off-by: Jakub Kicinski commit d53320aeef18ece4999c0cf07cb802d1dd990885 Author: Geert Uytterhoeven Date: Wed Jun 25 10:10:48 2025 +0200 dt-bindings: net: Rename renesas,r9a09g057-gbeth.yaml The DT bindings file "renesas,r9a09g057-gbeth.yaml" applies to a whole family of SoCs, and uses "renesas,rzv2h-gbeth" as a fallback compatible value. Hence rename it to the more generic "renesas,rzv2h-gbeth.yaml". Signed-off-by: Geert Uytterhoeven Reviewed-by: Lad Prabhakar Reviewed-by: Simon Horman Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/721f6e0e09777e0842ecaca4578bc50c953d2428.1750838954.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit f41830c57bb8e70e283b9db251c95f1270a8279d Merge: 36c52fb703e903 d6b93bfa5d1eba Author: Dave Airlie Date: Fri Jun 27 09:57:43 2025 +1000 Merge tag 'drm-misc-next-2025-06-26' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 6.17: UAPI Changes: Cross-subsystem Changes: Core Changes: - ci: Add Device tree validation and kunit - connector: Move HDR sink metadat to drm_display_info Driver Changes: - bochs: drm_panic Support - panfrost: MT8370 Support - bridge: - tc358767: Convert to devm_drm_bridge_alloc() Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250626-sincere-loon-of-effort-6dbdf9@houat commit 03aa45d6c62d6861dcbcff627d88814c0ddecc88 Author: Mrinmay Sarkar Date: Tue Jun 17 17:08:19 2025 +0530 phy: qcom: qmp-pcie: Update PHY settings for QCS8300 & SA8775P Update the PHY settings to align with the latest PCIe PHY Hardware Programming Guide for both PCIe controllers on the SA8775P platform. Add the ln_shrd region for SA8775P, incorporating new register writes as specified in the updated Hardware Programming Guide. Update pcs table for QCS8300, since both QCS8300 and SA8775P are closely related and share same pcs settings. Signed-off-by: Mrinmay Sarkar Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250617-update_phy-v5-1-2df83ed6a373@quicinc.com Signed-off-by: Vinod Koul commit 31bc94de76026c527f82c238f414539a14f0f3e6 Author: Luca Weiss Date: Tue Jun 17 10:26:36 2025 +0200 phy: qualcomm: phy-qcom-eusb2-repeater: Don't zero-out registers Zeroing out registers does not happen in the downstream kernel, and will "tune" the repeater in surely unexpected ways since most registers don't have a reset value of 0x0. Stop doing that and instead just set the registers that are in the init sequence (though long term I don't think there's actually PMIC-specific init sequences, there's board specific tuning, but that's a story for another day). Fixes: 99a517a582fc ("phy: qualcomm: phy-qcom-eusb2-repeater: Zero out untouched tuning regs") Reviewed-by: Konrad Dybcio Reviewed-by: Neil Armstrong Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250617-eusb2-repeater-tuning-v2-2-ed6c484f18ee@fairphone.com Signed-off-by: Vinod Koul commit db9f3e3ff9347a233a17eadefae9c1b29ec8f3ed Author: Luca Weiss Date: Tue Jun 17 10:26:35 2025 +0200 dt-bindings: phy: qcom,snps-eusb2-repeater: Remove default tuning values The reset default tuning value depends on the PMIC, so remove them from the doc since they're not accurate for all PMICs. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250617-eusb2-repeater-tuning-v2-1-ed6c484f18ee@fairphone.com Signed-off-by: Vinod Koul commit d6306fc5d77b7cbdf75a90159f58ebb84ae6f02a Author: AngeloGioacchino Del Regno Date: Mon Jun 23 14:03:15 2025 +0200 phy: mediatek: tphy: Cleanup and document slew calibration While it's true that, generally, the T-PHY V3 does not support the slew calibration process, some minor versions of it actually do, moreover, some SoCs may not support this even though the version of the PHY IP does. The reference clock and rate coefficient parameters are used only for slew calibration: move those to platform data, then document and change the checks in hs_slew_rate_calibrate() to perform the calibration only if: - EYE value was not supplied (pre-calculated calibration); and - Slew reference clock value is present (not zero); and - Slew coefficient is present (not zero). Moreover, change the probe function to always check if both the slew reference clock and coefficient properties are present and, if not, assign the value from platform data (which, as reminder, if not added means that it's zero!), instead of checking the PHY IP version. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250623120315.109881-3-angelogioacchino.delregno@collabora.com Signed-off-by: Vinod Koul commit 9cc82c2498b4fac77fb2438080458e42c1d0d5cb Author: AngeloGioacchino Del Regno Date: Mon Jun 23 14:03:14 2025 +0200 phy: mediatek: tphy: Clarify and add kerneldoc to mtk_phy_pdata As struct mtk_phy_pdata was almost fully documented, transfer the comments into kerneldoc on top. While at it, also rewrite the comments to both improve the writing writing and the actual information in the documentation, and add a description for the `version` member of the structure. Signed-off-by: AngeloGioacchino Del Regno Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250623120315.109881-2-angelogioacchino.delregno@collabora.com Signed-off-by: Vinod Koul commit 05c6f31991300f1c0e5e80eb1f66a580b9b5ca5f Author: Geert Uytterhoeven Date: Tue Jun 24 15:22:29 2025 +0200 dt-bindings: phy: apm,xgene-phy: Remove trailing whitespace Remove trailing whitespace which hurts my eyes. Fixes: 65ad0d068c426c2f ("dt-bindings: phy: Convert apm,xgene-phy to DT schema") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/5b8e9b4f645bcac9d50059e513abba4db7e1aaea.1750771156.git.geert+renesas@glider.be Signed-off-by: Vinod Koul commit ac4c064f67d3cdf9118b9b09c1e3b28b6c10a7ea Author: Frank Li Date: Wed Jun 25 17:52:54 2025 -0400 spi: dt-bindings: add nxp,lpc3220-spi.yaml Add lpc3220 spi controller binding doc to fix below CHECK_DTBS warning: arch/arm/boot/dts/nxp/lpc/lpc3250-ea3250.dtb: /ahb/apb/spi@20088000: failed to match any schema with compatible: ['nxp,lpc3220-spi'] Signed-off-by: Frank Li Link: https://patch.msgid.link/20250625215255.2640538-1-Frank.Li@nxp.com Signed-off-by: Mark Brown commit 2555691165a0285a4617230fed859f20dcc51608 Author: Bence Csókás Date: Tue Jun 10 10:22:54 2025 +0200 spi: atmel-quadspi: Use `devm_dma_request_chan()` Leave releasing of DMA channels up to the devm facilities. This way we can eliminate the rest of the "goto ladder". Signed-off-by: Bence Csókás Link: https://patch.msgid.link/20250610082256.400492-3-csokas.bence@prolan.hu Signed-off-by: Mark Brown commit ce57bc9771411d6d27f2ca7b40396cbd7d684ba9 Author: Andy Shevchenko Date: Thu Jun 26 18:23:07 2025 +0300 regulator: core: Don't use "proxy" headers Update header inclusions to follow IWYU (Include What You Use) principle. Note that kernel.h is discouraged to be included as it's written at the top of that file. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250626152307.322627-1-andriy.shevchenko@linux.intel.com Signed-off-by: Mark Brown commit 81a0286cefe6f81744160d3524d70e67479b314b Author: Maharaja Kennadyrajan Date: Tue Jun 17 10:41:36 2025 +0530 wifi: ath12k: Add support to RTT stats Add support to request RTT stats from firmware through HTT stats type 65 and 66. HTT stats type 65 support RTT response stats, RTT hardware stats, RTT to-be-read self-generated stats and RTT command-result stats and HTT stats type 66 support RTT initiator stats and RTT hardware stats. These stats give information about number of scheduled commands, responder allocation and termination count, initiator termination count, PASN authentication drop and receive counts, etc. Note: WCN firmware version - WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 does not support tags HTT_STATS_PDEV_RTT_RESP_STATS_TAG(194), HTT_STATS_PDEV_RTT_INIT_STATS_TAG(195), HTT_STATS_PDEV_RTT_HW_STATS_TAG(196), HTT_STATS_PDEV_RTT_TBR_SELFGEN_QUEUED_STATS_TAG(197) and HTT_STATS_PDEV_RTT_TBR_CMD_RESULT_STATS_TAG(198), currently. Sample output: echo 65 > /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats_type cat /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats HTT_PDEV_RTT_RESP_STATS_TLV: pdev_id = 0 tx_11mc_ftm_suc = 0 tx_11mc_ftm_suc_retry = 0 tx_11mc_ftm_fail = 0 ..... HTT_STATS_PDEV_RTT_HW_STATS_TAG: ista_ranging_ndpa_cnt = 0 ista_ranging_ndp_cnt = 0 ista_ranging_i2r_lmr_cnt = 0 rtsa_ranging_resp_cnt = 0 ..... HTT_STATS_PDEV_RTT_TBR_SELFGEN_QUEUED_STATS_TAG: SU poll = 0 SU sound = 0 ..... MU poll = 0 MU sound = 0 ..... HTT_STATS_PDEV_RTT_TBR_CMD_RESULT_STATS_TAG: num_sch_cmd_status_0: SU frame_SGEN_TF_POLL = 0 SU frame_SGEN_TF_SOUND = 0 SU frame_SGEN_TBR_NDPA = 0 SU frame_SGEN_TBR_NDP = 0 SU frame_SGEN_TBR_LMR = 0 SU frame_SGEN_TF_REPORT = 0 MU frame_SGEN_TF_POLL = 0 ..... echo 66 > /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats_type cat /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats HTT_PDEV_RTT_INIT_STATS_TLV: pdev_id = 0 tx_11mc_ftmr_cnt = 0 tx_11mc_ftmr_fail = 0 tx_11mc_ftmr_suc_retry = 0 rx_11mc_ftm_cnt = 0 rx_11az_ftm_cnt = 0 ..... HTT_STATS_PDEV_RTT_HW_STATS_TAG: ista_ranging_ndpa_cnt = 0 ista_ranging_ndp_cnt = 0 ista_ranging_i2r_lmr_cnt = 0 rtsa_ranging_resp_cnt = 0 rtsa_ranging_ndp_cnt = 0 rsta_ranging_lmr_cnt = 0 ..... Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Maharaja Kennadyrajan Signed-off-by: Roopni Devanathan Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250617051136.264193-3-quic_rdevanat@quicinc.com [rename enum ath12k_htt_stats_txsend_ftype_t] Signed-off-by: Jeff Johnson commit a7f74e782e274e8255808c165cb2cf63ee0876cc Author: Maharaja Kennadyrajan Date: Tue Jun 17 10:41:35 2025 +0530 wifi: ath12k: Add support to TDMA and MLO stats Add support to request TDMA stats, MLO scheduled stats and MLO IPC stats from firmware through HTT stats type 57, 63 and 64, respectively. These stats give information about TDMA schedules, TDMA slot switches, MLO preferred timeout, delay, MLO IPC ring count, etc. Note: WCN firmware version - WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 does not support tags HTT_STATS_PDEV_TDMA_TAG(187), HTT_STATS_MLO_SCHED_STATS_TAG(190) and HTT_STATS_PDEV_MLO_IPC_STATS_TAG(191), currently. Sample output: echo 57 > /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats_type cat /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats HTT_PDEV_TDMA_STATS_TLV: mac_id = 0 num_tdma_active_schedules = 0 num_tdma_reserved_schedules = 0 num_tdma_restricted_schedules = 0 num_tdma_unconfigured_schedules = 0 num_tdma_slot_switches = 0 num_tdma_edca_switches = 0 echo 63 > /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats_type cat /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats HTT_STATS_MLO_SCHED_STATS: num_sec_link_sched = 0 num_pref_link_timeout = 0 num_pref_link_sch_delay_ipc = 0 num_pref_link_timeout_ipc = 0 echo 64 > /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats_type cat /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats HTT_STATS_MLO_IPC_STATS: src_link: 0 mlo_ipc_ring_full_cnt[0]: 0 mlo_ipc_ring_full_cnt[1]: 0 mlo_ipc_ring_full_cnt[2]: 0 mlo_ipc_ring_full_cnt[3]: 0 mlo_ipc_ring_full_cnt[4]: 0 mlo_ipc_ring_full_cnt[5]: 0 mlo_ipc_ring_full_cnt[6]: 0 src_link: 1 mlo_ipc_ring_full_cnt[0]: 0 mlo_ipc_ring_full_cnt[1]: 0 mlo_ipc_ring_full_cnt[2]: 0 mlo_ipc_ring_full_cnt[3]: 0 mlo_ipc_ring_full_cnt[4]: 0 mlo_ipc_ring_full_cnt[5]: 0 mlo_ipc_ring_full_cnt[6]: 0 ..... Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Maharaja Kennadyrajan Signed-off-by: Roopni Devanathan Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250617051136.264193-2-quic_rdevanat@quicinc.com Signed-off-by: Jeff Johnson commit ffc7adb0a121cd72a02095106bd006f44593ee35 Author: Saleemuddin Shaik Date: Tue Jun 17 16:51:39 2025 +0530 wifi: ath12k: Add support for transmit histogram stats Add support for transmit histogram stats under HTT stats type 9. These stats give information about drop count, MCS drop rate, histogram count, etc. Note: WCN7850 firmware version - WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 does not support tag HTT_STATS_TX_PDEV_HISTOGRAM_STATS_TAG(144), currently. Sample output: echo 9 > /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats_type cat /sys/kernel/debug/ath12k/pci-0000\:58\:00.0/mac0/htt_stats ... low_latency_rate_cnt = 0 su_burst_rate_drop_cnt = 0 su_burst_rate_drop_fail_cnt = 0 rate_retry_mcs_drop_cnt = 0 PER_HISTOGRAM_STATS mcs_drop_rate = 0:0, 1:0, 2:0, 3:0, 4:0, 5:0, 6:0, 7:0, 8:0, 9:0, 10:0, 11:0, 12:0, 13:0, 14:0, 15:0 per_histogram_count = 0:0, 1:0, 2:0, 3:0, 4:0, 5:0, 6:0, 7:0, 8:0, 9:0, 10:0, 11:0, 12:0, 13:0, 14:0, 15:0, 16:0, 17:0, 18:0, 19:0, 20:0, 21:0, 22:0, 23:0, 24:0, 25:0, 26:0, 27:0, 28:0, 29:0, 30:0, 31:0, 32:0, 33:0, 34:0, 35:0, 36:0, 37:0, 38:0, 39:0, 40:0, 41:0, 42:0, 43:0, 44:0, 45:0, 46:0, 47:0, 48:0, 49:0, 50:0, 51:0, 52:0, 53:0, 54:0, 55:0, 56:0, 57:0, 58:0, 59:0, 60:0, 61:0, 62:0, 63:0, 64:0, 65:0, 66:0, 67:0, 68:0, 69:0, 70:0, 71:0, 72:0, 73:0, 74:0, 75:0, 76:0, 77:0, 78:0, 79:0, 80:0, 81:0, 82:0, 83:0, 84:0, 85:0, 86:0, 87:0, 88:0, 89:0, 90:0, 91:0, 92:0, 93:0, 94:0, 95:0, 96:0, 97:0, 98:0, 99:0, 100:0 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Saleemuddin Shaik Signed-off-by: Roopni Devanathan Link: https://patch.msgid.link/20250617112139.865788-1-quic_rdevanat@quicinc.com [add __packed to struct ath12k_htt_tx_histogram_stats_tlv] Signed-off-by: Jeff Johnson commit c27bb624b3d789a337df3bbcc020a575680555cc Author: Thiraviyam Mariyappan Date: Sun Jun 8 20:26:51 2025 +0530 wifi: ath12k: Clear auth flag only for actual association in security mode When setting a new bitrate, WMI peer association command is sent from the host without the peer authentication bit set in peer_flags for security mode, which causes ping failure. The firmware handles peer_flags when the client is associating, as the peer authentication bit in peer_flags is set after the key exchange. When the WMI peer association command is sent from the host to update the new bitrate for an associated STA, the firmware expects the WMI peer authentication bit to be set in peer_flags. Fix this issue by ensuring that the WMI peer auth bit is set in peer_flags in WMI peer association command when updating the new bitrate. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Signed-off-by: Thiraviyam Mariyappan Signed-off-by: Ramasamy Kaliappan Link: https://patch.msgid.link/20250608145651.1735236-1-ramasamy.kaliappan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit ed32169be1ccb9b1a295275ba7746dc6bf103e80 Author: Johan Hovold Date: Tue Jun 17 10:44:02 2025 +0200 wifi: ath12k: fix dest ring-buffer corruption when ring is full Add the missing memory barriers to make sure that destination ring descriptors are read before updating the tail pointer (and passing ownership to the device) to avoid memory corruption on weakly ordered architectures like aarch64 when the ring is full. Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org # 6.3 Signed-off-by: Johan Hovold Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250617084402.14475-5-johan+linaro@kernel.org Signed-off-by: Jeff Johnson commit e834da4cbd6fe1d24f89368bf0c80adcad212726 Author: Johan Hovold Date: Tue Jun 17 10:44:01 2025 +0200 wifi: ath12k: fix source ring-buffer corruption Add the missing memory barrier to make sure that LMAC source ring descriptors are written before updating the head pointer to avoid passing stale data to the firmware on weakly ordered architectures like aarch64. Note that non-LMAC rings use MMIO write accessors which have the required write memory barrier. Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org # 6.3 Signed-off-by: Johan Hovold Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250617084402.14475-4-johan+linaro@kernel.org Signed-off-by: Jeff Johnson commit 79390f613d639f7ef913377719cc5094357e53bc Author: Johan Hovold Date: Tue Jun 17 10:44:00 2025 +0200 wifi: ath12k: use plain access for descriptor length The read memory barrier added by commit 6b67d2cf14ea ("wifi: ath12k: fix ring-buffer corruption") is enough to guarantee ordering also for plain descriptor accesses if the length helper is ever inlined so drop the unnecessary READ_ONCE(). Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: Johan Hovold Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250617084402.14475-3-johan+linaro@kernel.org Signed-off-by: Jeff Johnson commit 8157ce533a60521f21d466eb4de45d9735b19484 Author: Johan Hovold Date: Tue Jun 17 10:43:59 2025 +0200 wifi: ath12k: fix dest ring-buffer corruption Add the missing memory barrier to make sure that destination ring descriptors are read after the head pointers to avoid using stale data on weakly ordered architectures like aarch64. The barrier is added to the ath12k_hal_srng_access_begin() helper for symmetry with follow-on fixes for source ring buffer corruption which will add barriers to ath12k_hal_srng_access_end(). Tested-on: WCN7850 hw2.0 WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: d889913205cf ("wifi: ath12k: driver for Qualcomm Wi-Fi 7 devices") Cc: stable@vger.kernel.org # 6.3 Signed-off-by: Johan Hovold Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250617084402.14475-2-johan+linaro@kernel.org Signed-off-by: Jeff Johnson commit aa6956150f820e6a6deba44be325ddfcb5b10f88 Author: Johan Hovold Date: Wed Jun 4 16:34:57 2025 +0200 wifi: ath11k: fix dest ring-buffer corruption when ring is full Add the missing memory barriers to make sure that destination ring descriptors are read before updating the tail pointer (and passing ownership to the device) to avoid memory corruption on weakly ordered architectures like aarch64 when the ring is full. Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org # 5.6 Signed-off-by: Johan Hovold Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250604143457.26032-6-johan+linaro@kernel.org Signed-off-by: Jeff Johnson commit 6efa0df54022c6c9fd4d294b87622c7fcdc418c8 Author: Johan Hovold Date: Wed Jun 4 16:34:56 2025 +0200 wifi: ath11k: fix source ring-buffer corruption Add the missing memory barrier to make sure that LMAC source ring descriptors are written before updating the head pointer to avoid passing stale data to the firmware on weakly ordered architectures like aarch64. Note that non-LMAC rings use MMIO write accessors which have the required write memory barrier. Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org # 5.6 Signed-off-by: Johan Hovold Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250604143457.26032-5-johan+linaro@kernel.org Signed-off-by: Jeff Johnson commit 4aba95fb1faed7fe7f6e1edfb60c333e0275dfc1 Author: Johan Hovold Date: Wed Jun 4 16:34:55 2025 +0200 wifi: ath11k: use plain accesses for monitor descriptor The read memory barrier added by commit ab52e3e44fe9 ("wifi: ath11k: fix rx completion meta data corruption") is enough to guarantee ordering also for plain descriptor accesses so drop the unnecessary READ_ONCE(). Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Signed-off-by: Johan Hovold Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250604143457.26032-4-johan+linaro@kernel.org Signed-off-by: Jeff Johnson commit 3a690e9091ec07f70cedd9a7dcc074c8554f1bed Author: Johan Hovold Date: Wed Jun 4 16:34:54 2025 +0200 wifi: ath11k: use plain access for descriptor length The read memory barrier added by commit 6d037a372f81 ("wifi: ath11k: fix ring-buffer corruption") is enough to guarantee ordering also for plain descriptor accesses if the length helper is ever inlined so drop the unnecessary READ_ONCE(). Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Signed-off-by: Johan Hovold Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250604143457.26032-3-johan+linaro@kernel.org Signed-off-by: Jeff Johnson commit 8c1ba5091fa9a2d1478da63173b16a701bdf86bb Author: Johan Hovold Date: Wed Jun 4 16:34:53 2025 +0200 wifi: ath11k: fix dest ring-buffer corruption Add the missing memory barrier to make sure that destination ring descriptors are read after the head pointers to avoid using stale data on weakly ordered architectures like aarch64. The barrier is added to the ath11k_hal_srng_access_begin() helper for symmetry with follow-on fixes for source ring buffer corruption which will add barriers to ath11k_hal_srng_access_end(). Tested-on: WCN6855 hw2.1 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") Cc: stable@vger.kernel.org # 5.6 Signed-off-by: Johan Hovold Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250604143457.26032-2-johan+linaro@kernel.org Signed-off-by: Jeff Johnson commit a44958c83e52238996a48e7d604167c9b9d0a529 Author: Hariharan Basuthkar Date: Fri Jun 6 16:53:16 2025 +0530 wifi: ath12k: Send WMI_VDEV_SET_TPC_POWER_CMD for AP vdev The power value is 6 dBm on an AP operating on the 6 GHz channel. This is a very low value. On 6 GHz, the target computes the EIRP based on the power values sent in the WMI_VDEV_SET_TPC_POWER_CMD. Currently, this is being sent only for station interfaces and not for AP interfaces. Therefore, add AP vdev to the condition in ath12k_mac_station_supports_tpc() and rename ath12k_mac_station_supports_tpc() to ath12k_mac_supports_tpc(). For a AP vdev, hardcode ap_power_type as IEEE80211_REG_LPI_AP, which is filled in the WMI_VDEV_SET_TPC_POWER_CMDID sent to the target. Currently, LPI is the only supported AP power mode. Since there is no method currently to set the AP power mode from user-space, the power mode is hard-coded to LPI. Retain the existing logic for populating the power mode for a station vdev. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Hariharan Basuthkar Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250606112316.39316-1-quic_hbasuthk@quicinc.com Signed-off-by: Jeff Johnson commit 9903c0986f782dfc511d7638b6f15fb6e8600cd3 Author: Sarika Sharma Date: Tue Jun 3 12:05:12 2025 +0530 wifi: ath12k: Add memset and update default rate value in wmi tx completion When both AP/STA and monitor interfaces are enabled, ieee80211_tx_status() is invoked from two paths: the TX completion handler for data frames and the WMI TX completion handler for management frames. In the data path, the skb->cb is properly zeroed using memset, but in the WMI path, this step is missing. As a result, mac80211 encountered uninitialized (junk) values in skb->cb when generating the radiotap header for monitor mode, leading to invalid radiotap lengths. Hence, explicitly zero the status field in the skb->cb using memset in WMI TX completion path to ensure consistent and correct behavior during WMI tx completion path. Additionally, set info->status.rates[0].idx = -1 to indicate that no valid rate information is available, avoiding misinterpretation of garbage values. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Sarika Sharma Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250603063512.1887652-1-quic_sarishar@quicinc.com Signed-off-by: Jeff Johnson commit ce7c93d196bfd2190dc4a0b86deee04e82042ed1 Author: Rameshkumar Sundaram Date: Fri May 30 09:26:15 2025 +0530 wifi: ath12k: Fix beacon reception for sta associated to Non-TX AP Currently, when a station is associated with a Non-Transmitting BSS of an MBSSID set, beacons are not frequently received from the firmware. This results in missing events via beacons, such as channel switches, leading to the station not switching to new channel as the AP does, eventually causing a kick out event from the firmware. This issue arises due to missing configuration of Non-Transmitting BSS information in station's vdev up command. Fix this by filling information such as the Transmitting BSSID, profile index and profile count in vdev up command of station. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Signed-off-by: Rameshkumar Sundaram Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250530035615.3178480-3-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 70eeacc1a92a444f4b5777ab19e1c378a5edc8dd Author: Hari Chandrakanthan Date: Fri May 30 09:26:14 2025 +0530 wifi: ath12k: Fix station association with MBSSID Non-TX BSS ath12k station is unable to associate with non-transmitting BSSes in a Multiple BSS set because the user-space does not receive information about the non-transmitting BSSes from mac80211's scan results. The ath12k driver does not advertise its MBSSID capability to mac80211, resulting in wiphy->support_mbssid not being set. Consequently, the information about non-transmitting BSS is not parsed from received Beacon/Probe response frames and is therefore not included in the scan results. Fix this by advertising the MBSSID capability of ath12k driver to mac80211. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Signed-off-by: Hari Chandrakanthan Signed-off-by: Rameshkumar Sundaram Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250530035615.3178480-2-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 662e9032140fd92662142d4bf394916cf48e426f Author: Raj Kumar Bhagat Date: Mon Jun 23 21:19:10 2025 +0530 wifi: ath12k: use real noise floor instead of default value ATH12K_DEFAULT_NOISE_FLOOR represents the approximate noise floor value which is used for RSSI calculation. Commit "wifi: ath12k: handle WMI event for real noise floor calculation" added support to get the real noise floor value from the firmware. Add changes to use the real value now instead of the default one. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Raj Kumar Bhagat Co-developed-by: Aditya Kumar Singh Signed-off-by: Aditya Kumar Singh Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250623-support_real_noise_floor-v2-2-974bbafa317e@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 0314ee81a91d22366e8ec6f5a993d75b246cbea8 Author: Raj Kumar Bhagat Date: Mon Jun 23 21:19:09 2025 +0530 wifi: ath12k: handle WMI event for real noise floor calculation At present, the ATH12K_DEFAULT_NOISE_FLOOR (-95) is used to calculate RSSI value, providing an estimated noise floor value. Consequently, the RSSI value is also approximate. This works but however, using actual noise floor value will enable the reporting of the true RSSI value. The firmware possesses the necessary data to determine the actual noise floor. This data is provided to the host via the WMI event WMI_PDEV_RSSI_DBM_CONVERSION_PARAMS_INFO_EVENTID, which includes the runtime parameters needed for calculating the real noise floor in dBm. This event is triggered by the firmware during channel changes, temperature offset adjustments, and hardware chainmask modifications. The individual TLVs may not always be present in each event. For instance, temperature information might only appear if there is a change in offset due to temperature variation. Add support to handle and parse this WMI event. Use the received values to calculate and store the noise floor value. A subsequent change will use this noise floor value in the actual RSSI calculation. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Raj Kumar Bhagat Co-developed-by: Aditya Kumar Singh Signed-off-by: Aditya Kumar Singh Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250623-support_real_noise_floor-v2-1-974bbafa317e@oss.qualcomm.com Signed-off-by: Jeff Johnson commit d8f07889e920493845fd628407ff0debbe96fa09 Author: Colin Ian King Date: Thu Jun 19 09:20:10 2025 +0100 wifi: ath11k: Make read-only const array svc_id static const Don't populate the read-only array svc_id on the stack at run time, instead make it static const. Signed-off-by: Colin Ian King Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250619082010.1834109-1-colin.i.king@gmail.com Signed-off-by: Jeff Johnson commit 8f9480451514c065dc8296c0db6e26d6c467fafe Author: Johan Hovold Date: Tue Jun 24 10:20:22 2025 +0200 wifi: ath11k: fix suspend use-after-free after probe failure Make sure to deregister the PM notifier to avoid a use-after-free on suspend in case core initialisation fails (e.g. due to missing firmware). Tested-on: WCN6855 hw2.0 WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41 Fixes: 32d93b51bc7e ("wifi: ath11k: choose default PM policy for hibernation") Reported-by: Konrad Dybcio Closes: https://lore.kernel.org/all/d0cd065c-1cd1-4e56-8c57-60777b1f3664@oss.qualcomm.com/ Cc: Baochen Qiang Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20250624082022.15469-1-johan+linaro@kernel.org Signed-off-by: Jeff Johnson commit a5b46aa7cf5f05c213316a018e49a8e086efd98e Author: Sergey Senozhatsky Date: Thu Jun 12 17:45:06 2025 +0900 wifi: ath11k: clear initialized flag for deinit-ed srng lists In a number of cases we see kernel panics on resume due to ath11k kernel page fault, which happens under the following circumstances: 1) First ath11k_hal_dump_srng_stats() call Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 22511ms before ath11k_pci 0000:01:00.0: group_id 1 14440788ms before [..] ath11k_pci 0000:01:00.0: failed to receive control response completion, polling.. ath11k_pci 0000:01:00.0: Service connect timeout ath11k_pci 0000:01:00.0: failed to connect to HTT: -110 ath11k_pci 0000:01:00.0: failed to start core: -110 ath11k_pci 0000:01:00.0: firmware crashed: MHI_CB_EE_RDDM ath11k_pci 0000:01:00.0: already resetting count 2 ath11k_pci 0000:01:00.0: failed to wait wlan mode request (mode 4): -110 ath11k_pci 0000:01:00.0: qmi failed to send wlan mode off: -110 ath11k_pci 0000:01:00.0: failed to reconfigure driver on crash recovery [..] 2) At this point reconfiguration fails (we have 2 resets) and ath11k_core_reconfigure_on_crash() calls ath11k_hal_srng_deinit() which destroys srng lists. However, it does not reset per-list ->initialized flag. 3) Second ath11k_hal_dump_srng_stats() call sees stale ->initialized flag and attempts to dump srng stats: Last interrupt received for each group: ath11k_pci 0000:01:00.0: group_id 0 66785ms before ath11k_pci 0000:01:00.0: group_id 1 14485062ms before ath11k_pci 0000:01:00.0: group_id 2 14485062ms before ath11k_pci 0000:01:00.0: group_id 3 14485062ms before ath11k_pci 0000:01:00.0: group_id 4 14780845ms before ath11k_pci 0000:01:00.0: group_id 5 14780845ms before ath11k_pci 0000:01:00.0: group_id 6 14485062ms before ath11k_pci 0000:01:00.0: group_id 7 66814ms before ath11k_pci 0000:01:00.0: group_id 8 68997ms before ath11k_pci 0000:01:00.0: group_id 9 67588ms before ath11k_pci 0000:01:00.0: group_id 10 69511ms before BUG: unable to handle page fault for address: ffffa007404eb010 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 10022d067 PMD 100b01067 PTE 0 Oops: 0000 [#1] PREEMPT SMP NOPTI RIP: 0010:ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k] Call Trace: ? __die_body+0xae/0xb0 ? page_fault_oops+0x381/0x3e0 ? exc_page_fault+0x69/0xa0 ? asm_exc_page_fault+0x22/0x30 ? ath11k_hal_dump_srng_stats+0x2b4/0x3b0 [ath11k (HASH:6cea 4)] ath11k_qmi_driver_event_work+0xbd/0x1050 [ath11k (HASH:6cea 4)] worker_thread+0x389/0x930 kthread+0x149/0x170 Clear per-list ->initialized flag in ath11k_hal_srng_deinit(). Signed-off-by: Sergey Senozhatsky Reviewed-by: Baochen Qiang Fixes: 5118935b1bc2 ("ath11k: dump SRNG stats during FW assert") Link: https://patch.msgid.link/20250612084551.702803-1-senozhatsky@chromium.org Signed-off-by: Jeff Johnson commit edbbc647c4f36e8a6375d07ecb5aad8e8b90de5e Author: Miaoqing Pan Date: Thu May 22 09:34:44 2025 +0800 wifi: ath11k: support usercase-specific firmware overrides Introduce 'firmware-name' property to allow end-users and/or integrators to decide which usecase-specific firmware to run on the WCN6855. This is necessary due to resource limitations such as memory capacity and CPU capability, or performance and power optimization for different application scenarios. Currently, there are two firmwares, both files can be executed interchangeably. For example: - ath11k/WCN6855/hw2.0/amss.bin, ath11k/WCN6855/hw2.0/m3.bin ath11k/WCN6855/hw2.0/board-2.bin - ath11k/WCN6855/hw2.0/nfa765/amss.bin, ath11k/WCN6855/hw2.0/nfa765/m3.bin ath11k/WCN6855/hw2.0/board-2.bin The former is the default firmware, suitable for most WiFi 6 STA functions. The latter adds support for commercial-quality SAP and optimizes power consumption for IoT applications. And both use the same BDF/regdb data within the main board-2.bin. Tested-on: WCN6855 hw2.1 PCI WLAN.HSP.1.1-04479-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1 Signed-off-by: Miaoqing Pan Reviewed-by: Baochen Qiang Link: https://patch.msgid.link/20250522013444.1301330-3-miaoqing.pan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 02dcb6921b8827782e51e26593d4a2866576ab63 Author: Miaoqing Pan Date: Thu May 22 09:34:43 2025 +0800 dt-bindings: net: wireless: ath11k-pci: describe firmware-name property Introduce 'firmware-name' property to allow end-users and/or integrators to decide which usecase-specific firmware to run on the WCN6855. This is necessary due to resource limitations such as memory capacity and CPU capability, or performance and power optimization for different application scenarios. Two firmwares are supported: 'WCN6855/hw2.0' and 'WCN6855/hw2.0/nfa765'. The former is the default firmware, suitable for most WiFi 6 STA functions. The latter adds support for commercial-quality SAP and optimizes power consumption for IoT applications. Signed-off-by: Miaoqing Pan Acked-by: Conor Dooley Link: https://patch.msgid.link/20250522013444.1301330-2-miaoqing.pan@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 2fa490c0d7591918bed267059700f1c9e505e881 Author: Rosen Penev Date: Sun Jun 8 20:08:50 2025 -0700 wifi: ath9k: ahb: replace id_table with of Since 2b0996c7646 , all of this platform code became no-op with no OF replacement. Not only that, there are no users of AHB here. Add an OF match table that mostly mirrors the original platform device id table. Use a qca prefix as is done for the only other property: qca,no-eeprom. Also used qca prefix for ar9530 as the latter seems to be a mistake. This will be used to add ath9k support for the various ath79 devices here. Signed-off-by: Rosen Penev Reviewed-by: Krzysztof Kozlowski Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250609030851.17739-5-rosenp@gmail.com Signed-off-by: Jeff Johnson commit f902f2c39a807382353b4c6b8d8d4ac1f03aade9 Author: Rosen Penev Date: Sun Jun 8 20:08:49 2025 -0700 dt-bindings: net: wireless: ath9k: add WIFI bindings These are for the wireless chips that come built in with various Atheros/QCA SoCs. dts wise, the difference between pcie and the wmac is AHB > PCIE > WIFI AHB > WIFI Signed-off-by: Rosen Penev Reviewed-by: Krzysztof Kozlowski Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250609030851.17739-4-rosenp@gmail.com Signed-off-by: Jeff Johnson commit c8123302c01936d297e22adbd75cad38c5049f92 Author: Rosen Penev Date: Sun Jun 8 20:08:48 2025 -0700 wifi: ath9k: ahb: reorder includes Alphabetic includes are easier to look at and to make further changes to them. Signed-off-by: Rosen Penev Reviewed-by: Krzysztof Kozlowski Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250609030851.17739-3-rosenp@gmail.com Signed-off-by: Jeff Johnson commit 5cbfef9039f61691c87f522f8761d628033bc392 Author: Rosen Penev Date: Sun Jun 8 20:08:47 2025 -0700 wifi: ath9k: ahb: reorder declarations Easier to look at. Follows netdev style. Also remove ret assignment. Because of all of these devm conversions, ret = 0 is a path that never gets hit. The first time it does it when request_irq fails, but that ends up reassigning it. Signed-off-by: Rosen Penev Reviewed-by: Krzysztof Kozlowski Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250609030851.17739-2-rosenp@gmail.com Signed-off-by: Jeff Johnson commit 720fa0cb59e411eca6b274f78073b6d2fe68eb45 Author: Nitin Rawat Date: Mon Jun 23 19:18:09 2025 +0530 scsi: ufs: qcom : Fix NULL pointer dereference in ufs_qcom_setup_clocks Fix a NULL pointer dereference in ufs_qcom_setup_clocks due to an uninitialized 'host' variable. The variable 'phy' is now assigned after confirming 'host' is not NULL. Call Stack: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 ufs_qcom_setup_clocks+0x28/0x148 ufs_qcom (P) ufshcd_setup_clocks (drivers/ufs/core/ufshcd-priv.h:142) ufshcd_init (drivers/ufs/core/ufshcd.c:9468) ufshcd_pltfrm_init (drivers/ufs/host/ufshcd-pltfrm.c:504) ufs_qcom_probe+0x28/0x68 ufs_qcom platform_probe (drivers/base/platform.c:1404) really_probe (drivers/base/dd.c:579 drivers/base/dd.c:657) __driver_probe_device (drivers/base/dd.c:799) driver_probe_device (drivers/base/dd.c:829) __driver_attach (drivers/base/dd.c:1216) bus_for_each_dev (drivers/base/bus.c:370) driver_attach (drivers/base/dd.c:1234) bus_add_driver (drivers/base/bus.c:678) driver_register (drivers/base/driver.c:249) __platform_driver_register (drivers/base/platform.c:868) ufs_qcom_pltform_init+0x28/0xff8 ufs_qcom do_one_initcall (init/main.c:1274) do_init_module (kernel/module/main.c:3041) load_module (kernel/module/main.c:3511) init_module_from_file (kernel/module/main.c:3704) __arm64_sys_finit_module (kernel/module/main.c:3715. Reviewed-by: Manivannan Sadhasivam Reviewed-by: Neil Armstrong Fixes: 77d2fa54a945 ("scsi: ufs: qcom : Refactor phy_power_on/off calls") Tested-by: Dmitry Baryshkov Tested-by: Naresh Kamboju Tested-by: Neil Armstrong Reported-by: Aishwarya Closes: https://lore.kernel.org/lkml/20250620214408.11028-1-aishwarya.tcv@arm.com/ Reported-by: Naresh Kamboju Closes: https://lore.kernel.org/linux-scsi/CA+G9fYuFQ2dBvYm1iB6rbwT=4b1c8e4NJ3yxqFPGZGUKH3GmMA@mail.gmail.com/T/#t Co-developed-by: Ram Kumar Dwivedi Signed-off-by: Ram Kumar Dwivedi Signed-off-by: Nitin Rawat Reviewed-by: Martin K. Petersen Reported-by: Linux Kernel Functional Testing Tested-by: Linux Kernel Functional Testing Tested-by: Marek Szyprowski Link: https://lore.kernel.org/r/20250623134809.20405-1-quic_nitirawa@quicinc.com Signed-off-by: Vinod Koul commit 06f77ff9d852c9f2764659ea81489364d8a69a9c Author: Rodrigo Gobbi Date: Thu Jun 26 18:33:14 2025 -0300 soundwire: debugfs: move debug statement outside of error handling The start_t and finish_t variables are not properly initialized if errors happens over request_firmware actions. This was also detected by smatch: drivers/soundwire/debugfs.c:301 cmd_go() error: uninitialized symbol 'finish_t'. drivers/soundwire/debugfs.c:301 cmd_go() error: uninitialized symbol 'start_t'. Move the debug statement outside of firmware error handling. Signed-off-by: Rodrigo Gobbi Reported-by: Dan Carpenter Closes: https://lore.kernel.org/linux-sound/0db6d0bf-7bac-43a7-b624-a00d3d2bf829@stanley.mountain/ Fixes: bb5cb09eedce ("soundwire: debugfs: add interface for BPT/BRA transfers") Link: https://lore.kernel.org/r/20250626213628.9575-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Vinod Koul commit 3529cb5ab16b4f1f8bbc31dc39a1076a94bd1e38 Author: Rob Clark Date: Wed Jun 25 10:37:11 2025 -0700 drm/fourcc: Add 32b float formats Add 1, 2, 3, and 4 component 32b float formats, so that buffers with these formats can be imported/exported with fourcc+modifier, and/or created by gbm. These correspond to PIPE_FORMAT_{R32,R32G32,R32G32B32,R32G32B32A32}_FLOAT in mesa. v2: Fix comment describing float32 layout [Sima] Signed-off-by: Rob Clark Acked-by: Simona Vetter Acked-by: Daniel Stone Link: https://lore.kernel.org/r/20250625173712.116446-3-robin.clark@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit e04c3521df073b688b9e9e2213cd3c588e3b6e68 Author: Rob Clark Date: Wed Jun 25 10:37:10 2025 -0700 drm/fourcc: Add missing half-float formats Not something that is likely to be scanned out, but GPUs usually support half-float formats with 1, 2, or possibly 3 components, and it is useful to be able to import/export them with a valid fourcc, and/or use gbm to create them. These correspond to PIPE_FORMAT_{R16,R16G16,R16G16B16}_FLOAT in mesa. Signed-off-by: Rob Clark Acked-by: Simona Vetter Acked-by: Daniel Stone Link: https://lore.kernel.org/r/20250625173712.116446-2-robin.clark@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 9d8511daf1e81a93007b7bb5020d4ce5ce001deb Author: Tianyou Li Date: Thu Jun 26 00:14:01 2025 +0800 tools/perf: Add --exclude-buildids option to perf archive command When make a perf archive, it may contains the binaries that user did not want to ship with, add --exclude-buildids option to specify a file which contains the buildids need to be excluded. The file can be generated from command: perf buildid-list -i perf.data --with-hits | grep -v "^ " > exclude-buildids.txt Then remove the lines from the exclude-buildids.txt for buildids should be included. Signed-off-by: Tianyou Li Reviewed-by: Wangyang Guo Link: https://lore.kernel.org/r/20250625161509.2599646-1-tianyou.li@intel.com Signed-off-by: Namhyung Kim commit ddf16e16346a36ec6616e5282f675f2e3cdc826f Author: Krzysztof Kozlowski Date: Fri Apr 4 14:21:14 2025 +0200 dmaengine: ti: Do not enable by default during compile testing Enabling the compile test should not cause automatic enabling of all drivers. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250404122114.359087-2-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit 587dd30449fb10121fc8a319bb825dc6152b8dd5 Author: Krzysztof Kozlowski Date: Fri Apr 4 14:21:13 2025 +0200 dmaengine: sh: Do not enable SH_DMAE_BASE by default during compile testing Enabling the compile test should not cause automatic enabling of all drivers. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250404122114.359087-1-krzysztof.kozlowski@linaro.org Signed-off-by: Vinod Koul commit 8c2442663f683f4fabadb3c491821169da6c89a8 Author: Anil S Keshavamurthy Date: Wed May 21 19:13:31 2025 -0400 dmaengine: idxd: Fix warning for deadcode.deadstore Deletes the second initialization as the value stored to 'dev' during its initialization (struct device *dev = &idxd->pdev->dev;) is sufficient. ../drivers/dma/idxd/init.c:988:17: warning: Value stored to 'dev' during its initialization is never read [deadcode.DeadStores] 988 | struct device *dev = &idxd->pdev->dev; | ^~~ ~~~~~~~~~~~~~~~~ Signed-off-by: Anil S Keshavamurthy Reviewed-by: Dave Jiang Link: https://lore.kernel.org/r/20250521231331.889204-1-anil.s.keshavamurthy@intel.com Signed-off-by: Vinod Koul commit a0b1589b62e2fcfb112996e0f4d5593bd2edf069 Author: Krzysztof Kozlowski Date: Sun May 25 21:26:05 2025 +0200 dmaengine: mmp: Fix again Wvoid-pointer-to-enum-cast warning This was fixed and re-introduced. 'type' is an enum, thus cast of pointer on 64-bit compile test with W=1 causes: mmp_tdma.c:644:9: error: cast to smaller integer type 'enum mmp_tdma_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast] Fixes: a67ba97dfb30 ("dmaengine: Use device_get_match_data()") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250525-dma-fixes-v1-5-89d06dac9bcb@linaro.org Signed-off-by: Vinod Koul commit 85a4ca2902c1d3b8ccea03837b10e178405192c5 Author: Krzysztof Kozlowski Date: Sun May 25 21:26:04 2025 +0200 dmaengine: fsl-qdma: Add missing fsl_qdma_format kerneldoc Document '__reserved2' and 'cmd' fields of 'struct fsl_qdma_format' to fix W=1 warnings: fsl-qdma.c:169 struct member '__reserved2' not described in 'fsl_qdma_format' fsl-qdma.c:169 struct member 'cmd' not described in 'fsl_qdma_format' Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250525-dma-fixes-v1-4-89d06dac9bcb@linaro.org Signed-off-by: Vinod Koul commit 24c13df655ca1fad5fc6fa4fbacb828f4a6d4f2b Author: Krzysztof Kozlowski Date: Sun May 25 21:26:03 2025 +0200 dmaengine: qcom: gpi: Drop unused gpi_write_reg_field() Static function gpi_write_reg_field() is not used, W=1 build: gpi.c:573:20: error: unused function 'gpi_write_reg_field' [-Werror,-Wunused-function] Fixes: 5d0c3533a19f ("dmaengine: qcom: Add GPI dma driver") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250525-dma-fixes-v1-3-89d06dac9bcb@linaro.org Signed-off-by: Vinod Koul commit f0368c23caba175e07062a3f24e58a2b4ec5bb1c Author: Krzysztof Kozlowski Date: Sun May 25 21:26:02 2025 +0200 dmaengine: fsl-dpaa2-qdma: Drop unused mc_enc() Static function mc_enc() is not used, W=1 build: dpdmai.c:51:19: error: unused function 'mc_enc' [-Werror,-Wunused-function] Fixes: 26a4d2aedac2 ("dmaengine: fsl-dpaa2-qdma: Remove unused function dpdmai_create()") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250525-dma-fixes-v1-2-89d06dac9bcb@linaro.org Signed-off-by: Vinod Koul commit 06b80ad4ffa5e614e89f04dffc44b85377c7ee24 Author: Krzysztof Kozlowski Date: Sun May 25 21:26:01 2025 +0200 dmaengine: dw-edma: Drop unused dchan2dev() and chan2dev() Static functions dchan2dev() and chan2dev() are not used, W=1 build: dw-edma-core.c:27:16: error: unused function 'dchan2dev' [-Werror,-Wunused-function] dw-edma-core.c:33:16: error: unused function 'chan2dev' [-Werror,-Wunused-function] Fixes: e63d79d1ffcd ("dmaengine: Add Synopsys eDMA IP core driver") Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250525-dma-fixes-v1-1-89d06dac9bcb@linaro.org Signed-off-by: Vinod Koul commit 6e6d3c6f0ef235a95c25385b2dad98e8ad6223eb Author: Thomas Weißschuh Date: Wed Jun 18 09:43:34 2025 +0200 dmaengine: stm32: Don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Reviewed-by: Amelie Delaunay Link: https://lore.kernel.org/r/20250618-restricted-pointers-dma-v2-1-bc39dafc201d@linutronix.de Signed-off-by: Vinod Koul commit e19bdbaa31082b43dab1d936e20efcebc30aa73d Author: Amelie Delaunay Date: Tue Jun 24 09:31:37 2025 +0200 dmaengine: stm32-dma: configure next sg only if there are more than 2 sgs DMA operates in Double Buffer Mode (DBM) when the transfer is cyclic and there are at least two periods. When DBM is enabled, the DMA toggles between two memory targets (SxM0AR and SxM1AR), indicated by the SxSCR.CT bit (Current Target). There is no need to update the next memory address if two periods are configured, as SxM0AR and SxM1AR are already properly set up before the transfer begins in the stm32_dma_start_transfer() function. This avoids unnecessary updates to SxM0AR/SxM1AR, thereby preventing potential Transfer Errors. Specifically, when the channel is enabled, SxM0AR and SxM1AR can only be written if SxSCR.CT=1 and SxSCR.CT=0, respectively. Otherwise, a Transfer Error interrupt is triggered, and the stream is automatically disabled. Signed-off-by: Amelie Delaunay Link: https://lore.kernel.org/r/20250624-stm32_dma_dbm_fix-v1-1-337c40d6c93e@foss.st.com Signed-off-by: Vinod Koul commit 0a78bd5ce29bdcb991eab06b5c9282a0adabff33 Merge: 814f047fc96d66 08bf1663c21a3e Author: Vinod Koul Date: Thu Jun 26 15:24:35 2025 -0700 Merge branch 'topic/dmaengine_devm' into next commit 08bf1663c21a3e815eda28fa242d84c945ca3b94 Author: Bence Csókás Date: Tue Jun 10 10:22:53 2025 +0200 dmaengine: Add devm_dma_request_chan() Expand the arsenal of devm functions for DMA devices, this time for requesting channels. Signed-off-by: Bence Csókás Link: https://lore.kernel.org/r/20250610082256.400492-2-csokas.bence@prolan.hu Signed-off-by: Vinod Koul commit e201757f7a0a901e313d638c545ed6cd0dc6870e Author: Namhyung Kim Date: Wed Jun 25 16:03:39 2025 -0700 perf annotate: Fix source code annotate with objdump Recently it uses llvm and capstone to speed up annotation or disassembly of instructions. But they don't support source code view yet. Until it fixed, we can force to use objdump for source code annotation. To prevent performance loss, it's disabled by default and turned it on when user requests it in TUI by pressing 's' key. Acked-by: Ian Rogers Link: https://lore.kernel.org/r/20250625230339.702610-1-namhyung@kernel.org Reported-by: Ingo Molnar Signed-off-by: Namhyung Kim commit 976e0e3103e463725e19a5493d02ce7b7b380663 Author: Yury Norov [NVIDIA] Date: Sun Jun 22 20:00:07 2025 -0400 smp: Use cpumask_any_but() in smp_call_function_many_cond() smp_call_function_many_cond() opencodes cpumask_any_but(). Signed-off-by: Yury Norov [NVIDIA] Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250623000010.10124-3-yury.norov@gmail.com commit 5f295519b42f100c735a1e8e1a70060e26f30c3f Author: Yury Norov [NVIDIA] Date: Sun Jun 22 20:00:06 2025 -0400 smp: Improve locality in smp_call_function_any() smp_call_function_any() tries to make a local call as it's the cheapest option, or switches to a CPU in the same node. If it's not possible, the algorithm gives up and searches for any CPU, in a numerical order. Instead, it can search for the best CPU based on NUMA locality, including the 2nd nearest hop (a set of equidistant nodes), and higher. sched_numa_find_nth_cpu() does exactly that, and also helps to drop most of the housekeeping code. Signed-off-by: Yury Norov [NVIDIA] Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250623000010.10124-2-yury.norov@gmail.com commit 140a9d0437b2a0d82e05b33973d9fc42c1d1c2ea Author: Igor Korotin Date: Fri Jun 20 16:45:52 2025 +0100 samples: rust: add ACPI match table example to platform driver Extend the Rust sample platform driver to probe using device/driver name matching, OF ID table matching, or ACPI ID table matching. Signed-off-by: Igor Korotin Link: https://lore.kernel.org/r/20250620154552.299932-1-igor.korotin.linux@gmail.com [ Use 'LNUXBEEF' as ACPI ID. - Danilo ] Signed-off-by: Danilo Krummrich commit 8411e6f06a022679a642c236724944057b90e60e Author: Igor Korotin Date: Fri Jun 20 16:43:34 2025 +0100 rust: platform: Add ACPI match table support to `Driver` trait Extend the `platform::Driver` trait to support ACPI device matching by adding the `ACPI_ID_TABLE` constant. This allows Rust platform drivers to define ACPI match tables alongside their existing OF match tables. These changes mirror the existing OF support and allow Rust platform drivers to match devices based on ACPI identifiers. Signed-off-by: Igor Korotin Link: https://lore.kernel.org/r/20250620154334.298320-1-igor.korotin.linux@gmail.com [ Use 'LNUXBEEF' as ACPI ID. - Danilo ] Signed-off-by: Danilo Krummrich commit ec3ef2175e16360605c7e1b409ceaa77be6521a8 Author: Igor Korotin Date: Fri Jun 20 16:41:24 2025 +0100 rust: platform: Set `OF_ID_TABLE` default to `None` in `Driver` trait Provide a default value of `None` for `Driver::OF_ID_TABLE` to simplify driver implementations. Drivers that do not require OpenFirmware matching no longer need to import the `of` module or define the constant explicitly. This reduces unnecessary boilerplate and avoids pulling in unused dependencies. Signed-off-by: Igor Korotin Link: https://lore.kernel.org/r/20250620154124.297158-1-igor.korotin.linux@gmail.com Signed-off-by: Danilo Krummrich commit 7a5cb145a9ce844be41ca5ed26e7d8d7c41dec7d Author: Igor Korotin Date: Fri Jun 20 16:39:13 2025 +0100 rust: driver: Add ACPI id table support to Adapter trait Extend the `Adapter` trait to support ACPI device identification. This mirrors the existing Open Firmware (OF) support (`of_id_table`) and enables Rust drivers to match and retrieve ACPI-specific device data when `CONFIG_ACPI` is enabled. To avoid breaking compilation, a stub implementation of `acpi_id_table()` is added to the Platform adapter; the full implementation will be provided in a subsequent patch. Signed-off-by: Igor Korotin Link: https://lore.kernel.org/r/20250620153914.295679-1-igor.korotin.linux@gmail.com [ Fix clippy warning if #[cfg(not(CONFIG_OF))]; fix checkpatch.pl line length warnings. - Danilo ] Signed-off-by: Danilo Krummrich commit 0f549d25858dfef9decd0b99a82ff4bc9095a51f Author: Igor Korotin Date: Fri Jun 20 16:36:56 2025 +0100 rust: driver: Consolidate `Adapter::of_id_info` methods using `#[cfg]` Refactor the `of_id_info` methods in the `Adapter` trait to reduce duplication. Previously, the method had two versions selected via `#[cfg(...)]` and `#[cfg(not(...))]`. This change merges them into a single method by using `#[cfg]` blocks within the method body. Suggested-by: Benno Lossin Signed-off-by: Igor Korotin Link: https://lore.kernel.org/r/20250620153656.294468-1-igor.korotin.linux@gmail.com [ Fix clippy warning if #[cfg(not(CONFIG_OF))]; fix checkpatch.pl line length warnings. - Danilo ] Signed-off-by: Danilo Krummrich commit a74931eb59cf6b914e1b9471d9abd4429176f6af Author: Igor Korotin Date: Fri Jun 20 16:24:25 2025 +0100 rust: acpi: add `acpi::DeviceId` abstraction `acpi::DeviceId` is an abstraction around `struct acpi_device_id`. Enable drivers to build ACPI device ID tables, to be consumed by the corresponding bus abstractions, such as platform or I2C. Signed-off-by: Igor Korotin Acked-by: Rafael J. Wysocki Link: https://lore.kernel.org/r/20250620152425.285683-1-igor.korotin.linux@gmail.com [ Always inline DeviceId::new() and use &'static CStr; slightly reword commit message. - Danilo ] Signed-off-by: Danilo Krummrich commit c038bdba98c9f6a36378044a9d4385531a194d3e Author: Jia Yao Date: Thu Jun 12 22:46:20 2025 +0000 drm/xe: Fix out-of-bounds field write in MI_STORE_DATA_IMM According to Bspec, bits 0~9 of MI_STORE_DATA_IMM must not exceed 0x3FE. The macro MI_SDI_NUM_QW(x) evaluates to 2 * x + 1, which means the condition 2 * x + 1 <= 0x3FE must be satisfied. Therefore, the maximum valid value for x is 0x1FE, not 0x1FF. v2 - Replace 0x1fe with macro MAX_PTE_PER_SDI (Auld, Matthew & Patelczyk, Maciej) v3 - Change macro MAX_PTE_PER_SDI from 0x1fe to 0x1feU (De Marchi, Lucas) Bspec: 60246 Fixes: 9c44fd5f6e8a ("drm/xe: Add migrate layer functions for SVM support") Cc: Matthew Brost Cc: Brian3 Nguyen Cc: Alex Zuo Cc: Matthew Auld Cc: Maciej Patelczyk Cc: Lucas De Marchi Suggested-by: Shuicheng Lin Signed-off-by: Jia Yao Reviewed-by: Matthew Brost Reviewed-by: Lucas De Marchi Reviewed-by: Maciej Patelczyk Link: https://lore.kernel.org/r/20250612224620.161105-1-jia.yao@intel.com Signed-off-by: Lucas De Marchi commit 814f047fc96d6631bb2c76557aad8e4aee8f532b Author: Bence Csókás Date: Wed Jun 25 10:54:50 2025 +0200 dmaengine: sun4i: Simplify error handling in probe() Clean up error handling by using devm functions and dev_err_probe(). This should make it easier to add new code, as we can eliminate the "goto ladder" in sun4i_dma_probe(). Suggested-by: Chen-Yu Tsai Reviewed-by: Jernej Skrabec Acked-by: Chen-Yu Tsai Reviewed-by: Julian Calaby Signed-off-by: Bence Csókás Link: https://lore.kernel.org/r/20250625085450.154280-2-csokas.bence@prolan.hu Signed-off-by: Vinod Koul commit 72bbf6e866a7911aaa0b4d0e9bb03109c7c046f2 Author: Vijendar Mukunda Date: Fri Jun 20 15:55:20 2025 +0530 soundwire: amd: add check for status update registers Add check to proceed handling SoundWire interrupts when valid status is reported in any one of the status registers. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20250620102617.73437-2-Vijendar.Mukunda@amd.com Signed-off-by: Vinod Koul commit 38d0b804b9d79d9fec6ad5c14f407c6477bccd68 Author: Aleksandrs Vinarskis Date: Mon Jun 23 13:36:14 2025 +0200 arm64: dts: qcom: x1-asus-zenbook: support sound Works: * Both speakers * Both MICs * Headphones jack, L/R channels * Headphones jack, MIC Now working/untested: * Sound over DisplayPort * Sound over HDMI Reviewed-by: Konrad Dybcio Signed-off-by: Aleksandrs Vinarskis Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250623113709.21184-3-alex.vinarskis@gmail.com Signed-off-by: Bjorn Andersson commit 49918a1c421c4186ff6f05eb7abf892b4ecfecb2 Author: Aleksandrs Vinarskis Date: Mon Jun 23 13:36:13 2025 +0200 arm64: dts: qcom: x1-asus-zenbook: fixup GPU nodes It appears not the latest version of the patch was merged. Align with latest upstreamed version by correcting GPU enable location and typo in GPU firmware path for x1p42100 variant. Fixes: 6516961352a1 ("arm64: dts: qcom: Add support for X1-based Asus Zenbook A14") Signed-off-by: Aleksandrs Vinarskis Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250623113709.21184-2-alex.vinarskis@gmail.com Signed-off-by: Bjorn Andersson commit 8168dba757c08aed00d0a1a25426c807adbf4491 Author: Naveen Manohar Date: Thu Jun 26 14:09:37 2025 +0800 soundwire: intel_auxdevice: add rt721 codec to wake_capable_list rt721 has wake capability. Add it to the wake_capable_list. Signed-off-by: Naveen Manohar Reviewed-by: Péter Ujfalusi Signed-off-by: Bard Liao Link: https://lore.kernel.org/r/20250626060937.405978-1-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit ae6a0f5b8a5b0ca2e4bf1c0380267ad83aca8401 Author: Charles Keepax Date: Tue Jun 24 13:55:07 2025 +0100 soundwire: Correct some property names The DisCo properties should be mipi-sdw-paging-supported and mipi-sdw-bank-delay-supported, with an 'ed' on the end. Correct the property names used in sdw_slave_read_prop(). The internal flag bank_delay_support is currently unimplemented, so that being read wrong does not currently affect anything. The two existing users for this helper and the paging_support flag rt1320-sdw.c and rt721-sdca-sdw.c both manually set the flag in their slave properties, thus are not affected by this bug either. Fixes: 56d4fe31af77 ("soundwire: Add MIPI DisCo property helpers") Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20250624125507.2866346-1-ckeepax@opensource.cirrus.com Signed-off-by: Vinod Koul commit a6f494becf09c9ebba72ed67d3728f6811daa634 Author: Akshay Jindal Date: Fri Jun 20 00:20:30 2025 +0530 PCI/AER: Add message when AER_MAX_MULTI_ERR_DEVICES limit is hit When a PCIe device detects an error, it logs the error locally and issues an error Message routed to the Root Complex (PCIe r6.0, sec 6.2.5). If the Root Port or RCEC supports AER and Linux has enabled the AER interrupt, aer_isr() traverses the relevant devices and adds those with AER errors logged to the aer_err_info.dev[] array for error logging and recovery. If aer_isr() finds more than AER_MAX_MULTI_ERR_DEVICES devices with AER errors logged, it silently ignores them, and those extra devices are not included in the recovery flow. Emit an error message if we find more than AER_MAX_MULTI_ERR_DEVICES devices with AER errors logged. Testing details at link below. Signed-off-by: Akshay Jindal [bhelgaas: commit log, join error message] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250619185041.73240-1-akshayaj.lkd@gmail.com commit 18635b6328d9edfdfab5366f8465e930226dd3e6 Author: Maarten Lankhorst Date: Thu Jun 19 12:49:10 2025 +0200 drm/xe: Rename xe_uc_init_hw to xe_uc_load_hw It feels to me like load is closer to the intention than init_hw. It makes the init calls slightly less confusing to me. :) Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250619104858.418440-24-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit a42939ee863efb2420cf6c56f9dfb550eb3cd56a Author: Maarten Lankhorst Date: Thu Jun 19 12:49:09 2025 +0200 drm/xe: Remove xe_uc_fini_hw xe_uc_init_hw() is called multiple times from xe_gt.c, and that makes the name xe_uc_fini_hw(), called for a different reason in xe_guc.c confusing. Remove it and inline the xe_uc_sanitize_reset into xe_guc.c directly. Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250619104858.418440-23-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 80fa03eb8a703d03ec30a39c8362ff9b9d96eead Author: Maarten Lankhorst Date: Thu Jun 19 12:49:08 2025 +0200 drm/xe: Remove xe_uc_init_hwconfig() This function is called immediately after xe_uc_init(), so just put it there instead. Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250619104858.418440-22-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 3effd109c6ef1dfc66ef1f09092251bd8c2b35e9 Author: Maarten Lankhorst Date: Thu Jun 19 12:49:07 2025 +0200 drm/xe: Move xe_ttm_sys_mgr_init() downwards. Now that all previous allocations are gone, ensure no new allocations will ever be done before xe_display_init_early(), by moving the call that allows allocations downwards. Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250619104858.418440-21-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 11bf0f0b3a4e6234861617356f04225b1a3272af Author: Maarten Lankhorst Date: Thu Jun 19 12:49:06 2025 +0200 drm/xe: Split init of xe_gt_init_hwconfig to xe_gt_init and *_early Now that we added the separate step of initialising GUC in xe_gt_init_early, it should be ok to initialise the minimum during early init, and the rest after allocations are allowed. Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250619104858.418440-20-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 6386a49951cd2cf3b46f3f214111071174e2f4ad Author: Maarten Lankhorst Date: Thu Jun 19 12:49:05 2025 +0200 drm/xe: Rename gt_init sub-functions s/gt_fw_domain_init/gt_init_with_gt_forcewake()/ s/all_fw_domain_init/gt_init_with_all_forcewake()/ Clarify that the functions are the part of gt_init() that are called with the respective power domains held. all_domain() of course only works after discovering and initialisation of force_wake on all engines, that's why the split is needed in the first place. Suggested-by: Lucas De Marchi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250619104858.418440-19-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 4c5517e9ecd5f13e9981fbf7378e0ce7b0d4af1f Author: Maarten Lankhorst Date: Thu Jun 19 12:49:04 2025 +0200 drm/xe: Only dump PAT when xe_hw_engines_init_early fails After discussion with Lucas De Marchi, it turns out that is the specific caller requiring a dump. This allows us to cleanup gt_init in a bit. Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250619104858.418440-18-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 2e1efcafd4fb61de987482d49a4e7b12395a3f25 Author: Maarten Lankhorst Date: Thu Jun 19 12:49:03 2025 +0200 drm/xe: Make it possible to read instance0 MCR registers after xe_gt_mcr_init_early After mcr_init_early, we need to be able to do VRAM and CCS probing without hwconfig probe. Fortunately the relevant registers are all instance 0, which fortunately means no dependencies on further initialization is required. Reviewed-by: Matt Roper Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250619104858.418440-17-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 396044c9d84d6668d89a5b680688b0d5fcae3aa5 Author: Maarten Lankhorst Date: Thu Jun 19 12:49:02 2025 +0200 drm/xe: Simplify GuC early initialization Add a 2-stage GuC init. An early one for everything that is needed for VF, and a full one that loads GuC and is allowed to do allocations. Link: https://lore.kernel.org/r/20250619104858.418440-16-dev@lankhorst.se Signed-off-by: Maarten Lankhorst Reviewed-by: Lucas De Marchi commit b3412d72331a5f2289f1494c09f9b02a450748e3 Author: Maarten Lankhorst Date: Thu Jun 19 12:49:01 2025 +0200 drm/xe/sriov: Move VF bootstrap and query_config to vf_guc_init We want to split up GUC init to an alloc and noalloc part to keep the init path the same for VF and !VF as much as possible. Everything in vf_guc_init should be done as early as possible, otherwise VRAM probing becomes impossible. Also move xe_gt_mmio_init to the end of xe_gt_init_early(), cleaning up the init in xe_device slightly. Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250619104858.418440-15-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit e6018b194b45b1793d61e28e8793efa21c08bd54 Author: Maarten Lankhorst Date: Thu Jun 19 12:49:00 2025 +0200 drm/xe: Defer memirq init until needed memirqs require allocations into GGTT, which we cannot use until after display is enabled. Now that the initialisation of interrupts is postponed, move memirq init too. Reviewed-by: Lucas De Marchi Reviewed-by: Ilia Levi Link: https://lore.kernel.org/r/20250619104858.418440-14-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit dd49aae52b5e03bc151c65f0e8ee1731fdd73c0a Author: Jonathan Corbet Date: Thu Jun 26 13:38:05 2025 -0600 docs: kdoc: remove the INLINE_END state It is never used, so just get rid of it. Signed-off-by: Jonathan Corbet commit acec3f6aa4f2bd9287a118f97ffa4e57c22f6344 Author: Andy Shevchenko Date: Thu Jun 12 23:11:29 2025 +0300 ACPI: proc: Prefer to use octal permission Octal permissions are preferred over the symbolics ones for readbility. This ceases warning message pointed by checkpatch. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250612201321.3536493-6-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 86dc11cd6f5cb19ea9d33610216acfa786e09b1d Author: Andy Shevchenko Date: Thu Jun 12 23:11:28 2025 +0300 ACPI: proc: Use str_enabled_disabled() helper Replace ternary (condition ? "enabled" : "disabled") with str_enabled_disabled() from string_choices.h to improve readability, maintain uniform string usage, and reduce binary size through linker deduplication. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250612201321.3536493-5-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 934eee0ce35cde5ea8a570de94cf5903cb44518d Author: Andy Shevchenko Date: Thu Jun 12 23:11:27 2025 +0300 ACPI: proc: Remove unused header With `make W=1` build we get a warning: drivers/acpi/proc.c: warning: EXPORT_SYMBOL() is not used, but #include is present Fix it by removing unused inclusion. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250612201321.3536493-4-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit b32a54336595d52408b9f0678b5e308dca2d1f40 Author: Andy Shevchenko Date: Thu Jun 12 23:11:26 2025 +0300 ACPI: proc: Use correct format specifier and drop casting The format string in acpi_system_wakeup_device_seq_show() uses incorrect specifier along with explicit (unneeded) casting. Drop the latter and update the former. Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250612201321.3536493-3-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit bb4049c9fe94f6b257cf4c211b6df398487da6bf Author: Andy Shevchenko Date: Thu Jun 12 23:11:25 2025 +0300 ACPI: wakeup: Drop unneeded casting for sleep_state Back to the original patch [1] sleep_state was defined as a custom acpi_integer type variable. Nowadays it's plain u64. No need to have casting for it anymore. Link: https://bugzilla.kernel.org/show_bug.cgi?id=1415 [1] Signed-off-by: Andy Shevchenko Link: https://patch.msgid.link/20250612201321.3536493-2-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki commit ef4af870be41a2a741109b99bbf780c769dcdc30 Author: Mario Limonciello Date: Sun Jun 8 22:28:34 2025 -0500 ACPICA: Decrease `AcpiExTracePoint` verbosity Early in kernel boot pointers can't be used and so %p shows up incorrectly: ``` extrace-0138 ex_trace_point : Method Begin [0x(____ptrval____):\M460] execution. ``` Later in the boot %p works, but it's not really actually useful when the pathname can resolve properly. Adjust the debug print so that if the Pathname resolves that the pointer isn't also printed: ``` extrace-0138 ex_trace_point : Method Begin [\M460] execution. ``` Link: https://github.com/acpica/acpica/pull/1013 Link: https://github.com/acpica/acpica/commit/bdc2a4e646f097b693aa60f1f2c4228d1e31b0d1 Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20250609032839.525087-1-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit 0fd0541b6770b190afa9534c9208c0aa774d533c Author: Colin Ian King Date: Tue Jun 24 21:29:37 2025 +0100 ACPI: APEI: EINJ: Fix check and iounmap of uninitialized pointer p In the case where a request_mem_region call fails and pointer r is null the error exit path via label 'out' will check for a non-null pointer p and try to iounmap it. However, pointer p has not been assigned a value at this point, so it may potentially contain any garbage value. Fix this by ensuring pointer p is initialized to NULL. Fixes: 1a35c88302a3 ("ACPI: APEI: EINJ: Fix kernel test sparse warnings") Signed-off-by: Colin Ian King Link: https://patch.msgid.link/20250624202937.523013-1-colin.i.king@gmail.com Signed-off-by: Rafael J. Wysocki commit 80e49db50175b935da6026009d6e09e17af044df Author: Jani Nikula Date: Wed Jun 25 15:39:38 2025 +0300 drm/i915/power: convert {SKL, ICL}_PW_CTL_IDX_TO_PG() macros to a function Add pw_ctl_idx_to_pg() helper function to deduplicate the open-coded usage of the {SKL,ICL}_PW_CTL_IDX_TO_PG() macros. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/3aa74825db0b900f93b94aa89d0242a354929b85.1750855148.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit ca09800fbbad463c1ff908928367a40e17e65eab Author: Jani Nikula Date: Wed Jun 25 15:39:37 2025 +0300 drm/i915/power: relocate {SKL,ICL}_PW_CTL_IDX_TO_PG() Move the {SKL,ICL}_PW_CTL_IDX_TO_PG() macros from intel_display_regs.h to intel_display_power_well.c. The mapping from index to PG can be hidden there. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/18e40b77eeb3517a056f1e567672163ec568ec55.1750855148.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit c7cefe479af5d4dcba68ea8f7e25c5a06ebd85b8 Author: Jani Nikula Date: Wed Jun 25 15:39:36 2025 +0300 drm/i915/power: move enum skl_power_gate under display When the display registers were split off from i915_reg.h, enum skl_power_gate was left behind. Move it to intel_display_regs.h. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/495054983b74163ca7dcbf5a1b6a24099047bc64.1750855148.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit c13d38bc9b00eaab19ba4d7608677371d2d2f480 Author: Colin Ian King Date: Tue Jun 24 21:10:32 2025 +0100 ACPI: APEI: EINJ: Fix less than zero comparison on a size_t variable The check for c < 0 is always false because variable c is a size_t which is not a signed type. Fix this by making c a ssize_t. Fixes: 90711f7bdf76 ("ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome") Signed-off-by: Colin Ian King Reviewed-by: Ira Weiny Link: https://patch.msgid.link/20250624201032.522168-1-colin.i.king@gmail.com Signed-off-by: Rafael J. Wysocki commit 80744a3bed8ce65071ca6e970a5f8b7c12213d3d Author: Dan Carpenter Date: Wed Jun 25 13:57:52 2025 -0500 ACPI: APEI: EINJ: prevent memory corruption in error_type_set() The "einj_buf" buffer is 32 chars. If "count" is larger than that it results in memory corruption. Cap it at 31 so that we leave the last character as a NUL terminator. By the way, the highest reasonable value for "count" is 24. Fixes: 0c6176e1e186 ("ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities") Signed-off-by: Dan Carpenter Reviewed-by: Ira Weiny Link: https://patch.msgid.link/ae6286cf-4d73-4b97-8c0f-0782a65b8f51@sabinyo.mountain Signed-off-by: Rafael J. Wysocki commit a4135386fa49c2a170b89296da12c4a3be2089d9 Author: Andy Shevchenko Date: Mon Jun 16 12:03:21 2025 +0300 iio: imu: inv_icm42600: Convert to uXX and sXX integer types The driver code is full of intXX_t and uintXX_t types which is not the pattern we use in the IIO subsystem. Switch the driver to use kernel internal types for that. No functional changes. Signed-off-by: Andy Shevchenko Acked-by: Jean-Baptiste Maneyrol Link: https://patch.msgid.link/20250616090423.575736-1-andriy.shevchenko@linux.intel.com Signed-off-by: Jonathan Cameron commit 8540a6f93a705d76fefa3626de1b182acedf2978 Author: David Lechner Date: Wed Jun 11 17:39:20 2025 -0500 iio: temperature: tmp006: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-28-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 88bcfc9e7b949c7f9abc88182546a33713aa57d1 Author: David Lechner Date: Wed Jun 11 17:39:19 2025 -0500 iio: proximity: irsd200: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-27-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit ca2ec0786009fd92245a4b8ec79b685a3906e774 Author: David Lechner Date: Wed Jun 11 17:39:18 2025 -0500 iio: pressure: zpa2326: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-26-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 73f31d9f8c8195f05830d22f28a4de0e16647d77 Author: David Lechner Date: Wed Jun 11 17:39:17 2025 -0500 iio: pressure: mprls0025pa: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. The initialize of the cmd value is trivial so it can be moved to the array initializer as well. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-25-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit b2dead5962385031b20ab79497a626c4613f4bf4 Author: David Lechner Date: Wed Jun 11 17:39:16 2025 -0500 iio: pressure: mpl3115: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-24-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 9e664cddd12801c1f269460577f46de58a1887d8 Author: David Lechner Date: Wed Jun 11 17:39:15 2025 -0500 iio: pressure: bmp280: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-23-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 174818e102e80c4a29ab837184ac034c6a2bd549 Author: David Lechner Date: Wed Jun 11 17:39:14 2025 -0500 iio: magnetometer: af8133j: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-22-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit f646c99adef6b6df4ee4889d980452afadd4abf8 Author: David Lechner Date: Wed Jun 11 17:39:13 2025 -0500 iio: light: veml6030: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Tested-by: Javier Carrasco Reviewed-by: Javier Carrasco Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-21-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit acddd6098119f62f20a1820acf888cd7608982cf Author: David Lechner Date: Wed Jun 11 17:39:12 2025 -0500 iio: light: opt4060: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-20-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 19ae7344cc179a6968dd81660d456e5181380932 Author: David Lechner Date: Wed Jun 11 17:39:11 2025 -0500 iio: light: ltr501: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-19-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 6ee8e56aedc08baf2ce1b732d5bfe8579aa28fda Author: David Lechner Date: Wed Jun 11 17:39:10 2025 -0500 iio: light: bh1745: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-18-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 3ee3c09d2d76dd30282a07aa1fb6e57c40081fed Author: David Lechner Date: Wed Jun 11 17:39:09 2025 -0500 iio: imu: inv_mpu6050: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-17-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 352112e2d9aab6a156c2803ae14eb89a9fd93b7d Author: David Lechner Date: Wed Jun 11 17:39:08 2025 -0500 iio: imu: inv_icm42600: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-16-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 46868e362f2a48edd44e924c036c52f199b9103c Author: David Lechner Date: Wed Jun 11 17:39:07 2025 -0500 iio: dac: ad3552r: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-15-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit d2614c43af75653ab9d06d800857d3f9662ceb3a Author: David Lechner Date: Wed Jun 11 17:39:06 2025 -0500 iio: chemical: sunrise_co2: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-14-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 5226b48b57e1e0135c2da502b02912e2cd4e0c09 Author: David Lechner Date: Wed Jun 11 17:39:05 2025 -0500 iio: chemical: scd30: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-13-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 27d782612a3364ceb2a21791e15537689236b51c Author: David Lechner Date: Wed Jun 11 17:39:04 2025 -0500 iio: chemical: scd4x: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-12-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 00b1c247670eed1dd173fd728436cf24d36717fa Author: David Lechner Date: Wed Jun 11 17:39:03 2025 -0500 iio: adc: ti-tsc2046: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Oleksij Rempel Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-11-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 4c4ef744d512b6de72b9da2bc1de6b0e1d9de748 Author: David Lechner Date: Wed Jun 11 17:39:02 2025 -0500 iio: adc: ti-lmp92064: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Leonard Göhrs Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-10-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 6c25238a74a3bba2cfc2a289ea96dcf075629833 Author: David Lechner Date: Wed Jun 11 17:39:01 2025 -0500 iio: adc: ti-ads1119: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Francesco Dolcini Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-9-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 6d1db00273d723ec01d8c90e7f8b1ce01d656fa6 Author: David Lechner Date: Wed Jun 11 17:39:00 2025 -0500 iio: adc: ti-ads1015: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-8-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit a3e20daaa2062bb81cedc31a3f76c55e667229c2 Author: David Lechner Date: Wed Jun 11 17:38:59 2025 -0500 iio: adc: stm32-adc: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-7-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 708d98459d0c3e0b3b04051a4185e55675f32d71 Author: David Lechner Date: Wed Jun 11 17:38:58 2025 -0500 iio: adc: rtq6056: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-6-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit dfa806ce04f92aa0834744808817d15a65a49d42 Author: David Lechner Date: Wed Jun 11 17:38:57 2025 -0500 iio: adc: rockchip_saradc: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-5-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit b8f008100a34eb282dc0cf6c13383ff0d177a533 Author: David Lechner Date: Wed Jun 11 17:38:56 2025 -0500 iio: adc: mt6360-adc: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-4-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 3a780d29aece36f584360c1cac5fb50c7bdc0f39 Author: David Lechner Date: Wed Jun 11 17:38:55 2025 -0500 iio: adc: dln2-adc: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-3-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit 08ef45efc23d3d681f53af4b6a7659cd26a9eb3c Author: David Lechner Date: Wed Jun 11 17:38:54 2025 -0500 iio: accel: msa311: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-2-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit f448fb868a273684185a00268a49763ee46bbc01 Author: David Lechner Date: Wed Jun 11 17:38:53 2025 -0500 iio: accel: adxl372: use = { } instead of memset() Use { } instead of memset() to zero-initialize stack memory to simplify the code. Signed-off-by: David Lechner Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-zero-init-stack-with-instead-of-memset-v1-1-ebb2d0a24302@baylibre.com Signed-off-by: Jonathan Cameron commit e564c05401ca59448b7618ab11a86d223bf072d2 Author: Lothar Rubusch Date: Tue Jun 10 21:59:28 2025 +0000 iio: accel: adxl345: replace magic numbers by unit expressions Replace absolute numbers by their expressions from units.h to avoid using magic numbers. Use uniform expressions to clarify their usage. This is a refactoring change and should not impact functionality. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250610215933.84795-7-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit f7f905f7a7eca0586b70dfae1ccf48ebe2f6495e Author: Lothar Rubusch Date: Tue Jun 10 21:59:25 2025 +0000 iio: accel: adxl345: simplify measure enable Simplify the function to enable or disable measurement. Replace the separate decision logic and call to regmap_update_bits() by a single call to regmap_assign_bits() taking a boolean argument directly. This is a refactoring change and should not impact functionality. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250610215933.84795-4-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 5decafde4dee2e725b03bc0cd540af35bf199835 Author: Lothar Rubusch Date: Tue Jun 10 21:59:24 2025 +0000 iio: accel: adxl345: make data struct variable irq function local Remove variable irq from the struct state and make it a function local variable, because it is not necessary to be kept struct-wise. This is a refactoring change and should not impact functionality. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250610215933.84795-3-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 51180f03eb6f5ee82a620af534efff12d272bb86 Author: David Lechner Date: Wed Jun 11 16:33:05 2025 -0500 iio: amplifiers: ada4250: use dev_err_probe() Use dev_err_probe() when returning an error in the probe function. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-amplifiers-ada4250-simplify-data-buffer-in-init-v3-5-bf85ddea79f2@baylibre.com Signed-off-by: Jonathan Cameron commit e905b3dd3a735bda21ac09f24ed542d72aad942e Author: David Lechner Date: Wed Jun 11 16:33:04 2025 -0500 iio: amplifiers: ada4250: move offset_uv in struct Move offset_uv in struct ada4250_state. This keeps things logically grouped and reduces holes in the struct. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-amplifiers-ada4250-simplify-data-buffer-in-init-v3-4-bf85ddea79f2@baylibre.com Signed-off-by: Jonathan Cameron commit 3712f11b4ed78d677f417990d083bab18584c9c3 Author: David Lechner Date: Wed Jun 11 16:33:03 2025 -0500 iio: amplifiers: ada4250: use devm_regulator_get_enable_read_voltage() Use devm_regulator_get_enable_read_voltage() to simplify the code. Replace 1000000 with MICRO while we are touching this for better readability. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-amplifiers-ada4250-simplify-data-buffer-in-init-v3-3-bf85ddea79f2@baylibre.com Signed-off-by: Jonathan Cameron commit f8a7be248f7379bf02b796a9e8e5d68fd134685a Author: David Lechner Date: Wed Jun 11 16:33:02 2025 -0500 iio: amplifiers: ada4250: don't fail on bad chip ID Only print an information message instead of error message and failing to probe the device if the chip ID is not recognized. Experience shows that this can be fragile and some devices may not return the expected chip ID even though the driver is still able to work with them. Suggested-by: Jonathan Cameron Closes: https://lore.kernel.org/linux-iio/20250421122409.79f5580c@jic23-huawei/ Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-amplifiers-ada4250-simplify-data-buffer-in-init-v3-2-bf85ddea79f2@baylibre.com Signed-off-by: Jonathan Cameron commit 788d6060f19b07b007f2e0a46b8e51748b45a669 Author: David Lechner Date: Wed Jun 11 16:33:01 2025 -0500 iio: amplifiers: ada4250: used dev local variable Replace local spi variable with dev in ada4250_init() since spi is not used directly. Signed-off-by: David Lechner Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611-iio-amplifiers-ada4250-simplify-data-buffer-in-init-v3-1-bf85ddea79f2@baylibre.com Signed-off-by: Jonathan Cameron commit a80ad80f1be91e10c52abaf2d5ccc6808c507a36 Author: Andrew Ijano Date: Wed Jun 11 16:39:19 2025 -0300 iio: accel: sca3000: replace error_ret labels by simple returns Replace usage of error_ret labels by returning directly when handling errors. Cases that do a mutex unlock were not changed. Signed-off-by: Andrew Ijano Co-developed-by: Gustavo Bastos Signed-off-by: Gustavo Bastos Suggested-by: Jonathan Cameron Reviewed-by: Nuno Sá Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250611194648.18133-2-andrew.lopes@alumni.usp.br Signed-off-by: Jonathan Cameron commit 6f6bf97823451dceda121e7341b41ce8d0560c14 Author: Nattan Ferreira Date: Wed Jun 11 14:42:53 2025 -0300 iio: light: apds9306: Refactor threshold get/set functions to use helper Refactor the apds9306_event_thresh_get() and apds9306_event_thresh_set() functions to use a helper function (apds9306_get_thresh_reg()) for obtaining the correct register based on the direction of the event. This improves code readability and maintains consistency in accessing threshold registers. Signed-off-by: Nattan Ferreira Co-developed-by: Lucas Antonio Signed-off-by: Lucas Antonio Acked-by: Subhajit Ghosh Link: https://patch.msgid.link/20250611174253.16578-1-nattanferreira58@gmail.com Signed-off-by: Jonathan Cameron commit fb1d3b24ebf5c85f4179cb045ee28715e249e1ca Author: Jonathan Santos Date: Wed Jun 11 08:51:50 2025 -0300 iio: adc: ad7768-1: add filter type and oversampling ratio attributes Separate filter type and decimation rate from the sampling frequency attribute. The new filter type attribute enables sinc3, sinc3+rej60 and wideband filters, which were previously unavailable. Previously, combining decimation and MCLK divider in the sampling frequency obscured performance trade-offs. Lower MCLK divider settings increase power usage, while lower decimation rates reduce precision by decreasing averaging. By creating an oversampling attribute, which controls the decimation, users gain finer control over performance. The addition of those attributes allows a wider range of sampling frequencies and more access to the device features. Sampling frequency table is updated after every digital filter parameter change. Changes in the sampling frequency are not allowed anymore while in buffered mode. Reviewed-by: David Lechner Co-developed-by: Pop Paul Signed-off-by: Pop Paul Signed-off-by: Jonathan Santos Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/cd3b60c44847d5c35cecc4385bbda6533be6825e.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit 74e16c0cd61f9d18c0613c1823ce5874515cf3f0 Author: Jonathan Santos Date: Wed Jun 11 08:51:38 2025 -0300 iio: adc: ad7768-1: replace manual attribute declaration Use read_avail callback from struct iio_info to replace the manual declaration of sampling_frequency_available attribute. Reviewed-by: David Lechner Reviewed-by: Marcelo Schmitt Signed-off-by: Jonathan Santos Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/b2653d270131b2c873373a6f81cde9a5bdf5d1ff.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit 74790e84ffbbb69a271f9344946145457a9acb39 Author: Jonathan Santos Date: Wed Jun 11 08:51:23 2025 -0300 iio: adc: ad7768-1: add support for Synchronization over SPI The synchronization method using GPIO requires the generated pulse to be truly synchronous with the base MCLK signal. When it is not possible to do that in hardware, the datasheet recommends using synchronization over SPI, where the generated pulse is already synchronous with MCLK. This requires the SYNC_OUT pin to be connected to the SYNC_IN pin. Use trigger-sources property to enable device synchronization over SPI and multi-device synchronization while replacing sync-in-gpios property. Reviewed-by: David Lechner Signed-off-by: Jonathan Santos Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/05aea6d1551fce94f290d68f1dba548513e1632f.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit 54da2aeb7160ba11ed74776b3a3a2bd61ac673ce Author: Jonathan Santos Date: Wed Jun 11 08:51:11 2025 -0300 iio: adc: ad7768-1: add multiple scan types to support 16-bits mode When the device is configured to decimation x8, only possible in the sinc5 filter, output data is reduced to 16 bits in order to support 1 MHz of sampling frequency due to clock limitation. Use multiple scan types feature to enable the driver to switch scan type at runtime, making it possible to support both 24-bit and 16-bit resolution. Reviewed-by: Marcelo Schmitt Reviewed-by: David Lechner Signed-off-by: Jonathan Santos Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/08780fd4a59885f1f250759ce655420bd1dbb383.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit d569ae0f052e0e44db0e1d69110eba13f5060223 Author: Sergiu Cuciurean Date: Wed Jun 11 08:50:56 2025 -0300 iio: adc: ad7768-1: Add GPIO controller support The AD7768-1 has the ability to control other local hardware (such as gain stages),to power down other blocks in the signal chain, or read local status signals over the SPI interface. Add direct mode conditional locks in the GPIO callbacks to prevent register access when the device is in buffered mode. This change exports the AD7768-1's four GPIOs and makes them accessible at an upper layer. Reviewed-by: Marcelo Schmitt Acked-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Reviewed-by: Andy Shevchenko Signed-off-by: Sergiu Cuciurean Co-developed-by: Jonathan Santos Signed-off-by: Jonathan Santos Link: https://patch.msgid.link/8abca580f43cb31d7088d07a7414b5f7efe91ead.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit 96b6e814afd2ac475f96e52fcf38673c3631b6df Author: Jonathan Santos Date: Wed Jun 11 08:50:44 2025 -0300 iio: adc: ad7768-1: add regulator to control VCM output The VCM output voltage can be used as a common-mode voltage within the amplifier preconditioning circuits external to the AD7768-1. This change allows the user to configure VCM output using the regulator framework. Acked-by: Marcelo Schmitt Reviewed-by: David Lechner Reviewed-by: Andy Shevchenko Signed-off-by: Jonathan Santos Link: https://patch.msgid.link/1f02312fdc4131168b194d59f4b1688dc68ea36e.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit 1905e6c9ce018bd7eb9a1722ae689e9cebed24ad Author: Jonathan Santos Date: Wed Jun 11 08:50:27 2025 -0300 dt-bindings: iio: adc: ad7768-1: add trigger-sources property In addition to GPIO synchronization, The AD7768-1 also supports synchronization over SPI, which use is recommended when the GPIO cannot provide a pulse synchronous with the base MCLK signal. It consists of looping back the SYNC_OUT to the SYNC_IN pin and send a command via SPI to trigger the synchronization. Introduce the 'trigger-sources' property to enable SPI-based synchronization via SYNC_OUT pin, along with additional optional entries for GPIO3 and DRDY pins. Also create #trigger-source-cells property to differentiate the trigger sources provided by the ADC. To improve readability, create a adi,ad7768-1.h header with the macros for the cell values. While at it, add description to the interrupts property. Acked-by: Conor Dooley Reviewed-by: David Lechner Signed-off-by: Jonathan Santos Link: https://patch.msgid.link/713fd786010c75858700efaec8bb285274e7057e.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit 1c01c449e31ef3aa59ef045986c1abfb33f80204 Author: Jonathan Santos Date: Wed Jun 11 08:50:14 2025 -0300 dt-bindings: iio: adc: ad7768-1: Document GPIO controller The AD7768-1 ADC exports four bidirectional GPIOs accessible via register map. Document GPIO properties necessary to enable GPIO controller for this device. Acked-by: Bartosz Golaszewski Reviewed-by: Linus Walleij Reviewed-by: Rob Herring (Arm) Signed-off-by: Jonathan Santos Link: https://patch.msgid.link/2ac34fc1e0b02886073ae0bb196c7e8d4d442c3f.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit 81d289c21e395fed9baa1238d300bb1448da6a8d Author: Jonathan Santos Date: Wed Jun 11 08:50:01 2025 -0300 dt-bindings: iio: adc: ad7768-1: document regulator provider property The AD7768-1 provides a buffered common-mode voltage output on the VCM pin that can be used to bias analog input signals. Add regulators property to enable the use of the VCM output, referenced here as vcm-output, by any other device. Acked-by: Conor Dooley Signed-off-by: Jonathan Santos Link: https://patch.msgid.link/33c02a1fb9d839f62da5237f9476ccbf14271b6d.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit 0dd88eaa71264a25f950fbf9052ed87bf716fb7c Author: Jonathan Santos Date: Wed Jun 11 08:49:49 2025 -0300 dt-bindings: trigger-source: add generic GPIO trigger source Inspired by pwm-trigger, create a new binding for using a GPIO line as a trigger source. Link: https://lore.kernel.org/linux-iio/20250207-dlech-mainline-spi-engine-offload-2-v8-3-e48a489be48c@baylibre.com/ Acked-by: Conor Dooley Reviewed-by: Linus Walleij Reviewed-by: David Lechner Signed-off-by: Jonathan Santos Link: https://patch.msgid.link/c4a3a7c828c711b439d1893271b8376823176ea6.1749569957.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit a8daa0a8f13d8f2d96f4f06dd5ce5454afc88835 Author: Jiri Slaby (SUSE) Date: Thu Jun 12 10:46:27 2025 +0200 iio: adc: stm32-adc: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) Reviewed-by: David Lechner Link: https://patch.msgid.link/20250612084627.217341-1-jirislaby@kernel.org Signed-off-by: Jonathan Cameron commit 5cc26087667a00b6e64217634aecfe18112225b9 Author: chuguangqing Date: Wed Jun 11 16:58:38 2025 +0800 iio: light: opt4060: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: chuguangqing Link: https://patch.msgid.link/20250611085838.4761-11-chuguangqing@inspur.com Signed-off-by: Jonathan Cameron commit f9428623818ade24293415b515f9fec127bbfce3 Author: chuguangqing Date: Wed Jun 11 16:58:37 2025 +0800 iio: light: ltr501: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: chuguangqing Link: https://patch.msgid.link/20250611085838.4761-10-chuguangqing@inspur.com Signed-off-by: Jonathan Cameron commit 7eab62ecbcbb732ee6a09878e4c05fd4e7a0c6b1 Author: chuguangqing Date: Wed Jun 11 16:58:36 2025 +0800 iio: light: isl29028: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: chuguangqing Link: https://patch.msgid.link/20250611085838.4761-9-chuguangqing@inspur.com Signed-off-by: Jonathan Cameron commit a5afaa5de32d6cf8918b4f7df4491dcf92deca0f Author: chuguangqing Date: Wed Jun 11 16:58:35 2025 +0800 iio: imu: bno055: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: chuguangqing Link: https://patch.msgid.link/20250611085838.4761-8-chuguangqing@inspur.com Signed-off-by: Jonathan Cameron commit 3be2dd51852651d51150f86dd229a184472a44ea Author: chuguangqing Date: Wed Jun 11 16:58:34 2025 +0800 iio: imu: icm42600: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: chuguangqing Acked-by: Jean-Baptiste Maneyrol Link: https://patch.msgid.link/20250611085838.4761-7-chuguangqing@inspur.com Signed-off-by: Jonathan Cameron commit 2619f7b14c403d71acbad578620a17d5c5548d02 Author: chuguangqing Date: Wed Jun 11 16:58:33 2025 +0800 iio: health: afe4404: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: chuguangqing Link: https://patch.msgid.link/20250611085838.4761-6-chuguangqing@inspur.com Signed-off-by: Jonathan Cameron commit bc6c48bfadc22a210dd0386585bb6797138db460 Author: chuguangqing Date: Wed Jun 11 16:58:32 2025 +0800 iio: health: afe4403: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: chuguangqing Link: https://patch.msgid.link/20250611085838.4761-5-chuguangqing@inspur.com Signed-off-by: Jonathan Cameron commit 3547b9ab0434aaa3ade244f2516442652a7ea8cf Author: chuguangqing Date: Wed Jun 11 16:58:31 2025 +0800 iio: dac: bd79703: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: chuguangqing Link: https://patch.msgid.link/20250611085838.4761-4-chuguangqing@inspur.com Signed-off-by: Jonathan Cameron commit cc42e969ebbbd8e9bb511b3880a8e046cf88710f Author: chuguangqing Date: Wed Jun 11 16:58:30 2025 +0800 iio: dac: ad5380: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: chuguangqing Link: https://patch.msgid.link/20250611085838.4761-3-chuguangqing@inspur.com Signed-off-by: Jonathan Cameron commit 5c3f0624831cd2b0817fcb1c3c0f1fde497b444f Author: chuguangqing Date: Wed Jun 11 16:58:29 2025 +0800 iio: chemical: bme680: convert to use maple tree register cache The maple tree register cache is based on a much more modern data structure than the rbtree cache and makes optimisation choices which are probably more appropriate for modern systems than those made by the rbtree cache. Signed-off-by: chuguangqing Link: https://patch.msgid.link/20250611085838.4761-2-chuguangqing@inspur.com Signed-off-by: Jonathan Cameron commit 1763bd3a0c030284083c044900da1b185a91b27c Author: David Lechner Date: Wed Jun 11 09:40:16 2025 -0500 iio: adc: ad7173: check return value of spi_setup() Check the return value of spi_setup() and propagate the error in the ad7173_probe() function. This is unlikely to happen since virtually every SPI controller supports SPI_MODE_3, but still always a good idea to check the return value. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250611-iio-adc-ad7173-check-spi_setup-return-v1-1-4d6f9ef0a2e4@baylibre.com Signed-off-by: Jonathan Cameron commit d657e251d9d48057b27e1aa175d5440653b20c54 Author: Antonio Borneo Date: Tue Jun 10 14:48:54 2025 +0200 iio: trigger: stm32-lptimer: Fix build warnings about export.h After commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") and commit 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") we get the build warning with W=1: drivers/iio/trigger/stm32-lptimer-trigger.c: warning: EXPORT_SYMBOL() is used, but #include is missing Fix it. Signed-off-by: Antonio Borneo Acked-by: Fabrice Gasnier Link: https://patch.msgid.link/20250610124855.269158-5-antonio.borneo@foss.st.com Signed-off-by: Jonathan Cameron commit 2628736bd4880fd29b6ec8f6064a8a8c7ce1fbcf Author: Antonio Borneo Date: Tue Jun 10 14:48:53 2025 +0200 iio: trigger: stm32-timer: Fix build warnings about export.h After commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") and commit 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") we get the build warning with W=1: drivers/iio/trigger/stm32-timer-trigger.c: warning: EXPORT_SYMBOL() is used, but #include is missing Fix it. Signed-off-by: Antonio Borneo Acked-by: Fabrice Gasnier Link: https://patch.msgid.link/20250610124855.269158-4-antonio.borneo@foss.st.com Signed-off-by: Jonathan Cameron commit 86c4903bb219271af46bfc9b7b7146430eeb89a4 Author: Antonio Borneo Date: Tue Jun 10 14:48:52 2025 +0200 iio: adc: stm32-dfsdm: Fix build warnings about export.h After commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") and commit 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") we get the build warnings with W=1: drivers/iio/adc/stm32-dfsdm-adc.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/iio/adc/stm32-dfsdm-core.c: warning: EXPORT_SYMBOL() is used, but #include is missing Fix them. Signed-off-by: Antonio Borneo Acked-by: Fabrice Gasnier Link: https://patch.msgid.link/20250610124855.269158-3-antonio.borneo@foss.st.com Signed-off-by: Jonathan Cameron commit 3ceb7cc34510e3e78f0980756847d9710f591628 Author: Jonathan Cameron Date: Mon Jun 9 08:06:15 2025 +0100 iio: potentiometer: Drop unused export.h includes Resolves: warning: EXPORT_SYMBOL() is not used, but #include is present Reviewed-by: Andy Shevchenko Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250609070616.3923709-2-jic23@kernel.org Signed-off-by: Jonathan Cameron commit 6a533f56b020d3941da8b8d3a521fc800ffc29ea Author: Pop Ioan Daniel Date: Thu Jun 5 18:09:43 2025 +0300 iio: adc: ad7405: add ad7405 driver Add support for the AD7405/ADUM770x, a high performance isolated ADC, 1-channel, 16-bit with a second-order Σ-Δ modulator that converts an analog input signal into a high speed, single-bit data stream. Signed-off-by: Pop Ioan Daniel Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250605150948.3091827-6-pop.ioan-daniel@analog.com Signed-off-by: Jonathan Cameron commit dbcf839432981ab4169eccf008bf189293ab749b Author: Pop Ioan Daniel Date: Thu Jun 5 18:09:42 2025 +0300 dt-bindings: iio: adc: add ad7405 Add devicetree bindings for ad7405/adum770x family. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Pop Ioan Daniel Link: https://patch.msgid.link/20250605150948.3091827-5-pop.ioan-daniel@analog.com Signed-off-by: Jonathan Cameron commit dced5bda1411bdfc291cb3ed0a03c2adfecd9a1d Author: Pop Ioan Daniel Date: Thu Jun 5 18:09:41 2025 +0300 iio: adc: adi-axi-adc: add axi_adc_oversampling_ratio_set Add support for setting decimation rate. Reviewed-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Pop Ioan Daniel Link: https://patch.msgid.link/20250605150948.3091827-4-pop.ioan-daniel@analog.com Signed-off-by: Jonathan Cameron commit 97e6882ed1a16cd22184127abf2bc9b8202f37e0 Author: Pop Ioan Daniel Date: Thu Jun 5 18:09:40 2025 +0300 iio: backend: update iio_backend_oversampling_ratio_set Add chan parameter to iio_backend_oversampling_ratio_set() to allow for contexts where the channel must be specified. Modify all existing users. Reviewed-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Pop Ioan Daniel Link: https://patch.msgid.link/20250605150948.3091827-3-pop.ioan-daniel@analog.com Signed-off-by: Jonathan Cameron commit 56e5ec2d856a311e40f26b9856eee9ec08dd8805 Author: Pop Ioan Daniel Date: Thu Jun 5 18:09:39 2025 +0300 iio: adc: ad4851: ad4851_set_oversampling_ratio parameters update Remove chan parameter from ad4851_set_oversampling_ratio parameters list because the parameter is not used. Reviewed-by: David Lechner Signed-off-by: Pop Ioan Daniel Link: https://patch.msgid.link/20250605150948.3091827-2-pop.ioan-daniel@analog.com Signed-off-by: Jonathan Cameron commit 7b20d517b9e508527f51fdd3be817f4670bf18cc Author: Lothar Rubusch Date: Sun Jun 1 17:21:29 2025 +0000 iio: accel: adxl313: add debug register Add IIO debug register for general sensor debugging. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250601172139.59156-2-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit c430955d0cb87fb7c6b186e457cb3beca4a9c89a Author: Gwendal Grignou Date: Tue Jun 3 22:39:03 2025 -0700 iio: cros_ec_sensors: add cros_ec_activity driver ChromeOS EC can report activity information derived from the accelerometer: - Reports on-body/off-body as a proximity event. - Reports significant motion as an activity event. This new sensor is a virtual sensor, included only when the EC firmware is compiled with the appropriate module. Signed-off-by: Gwendal Grignou Reviewed-by: Tzung-Bi Shih Link: https://patch.msgid.link/20250604053903.1376465-1-gwendal@google.com Signed-off-by: Jonathan Cameron commit f0fdb01df208edb6478ee83b1e4137b2655eaac2 Author: Colin Ian King Date: Tue Jun 3 17:57:06 2025 +0100 iio: adc: ti-ads131e08: Fix spelling mistake "tweek" -> "tweak" There is a spelling mistake in variable tweek_offset and in comment blocks. Fix these. Signed-off-by: Colin Ian King Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250603165706.126031-1-colin.i.king@gmail.com Signed-off-by: Jonathan Cameron commit 8e63fd1e00f59eab01ab43eb094abc380f8d0c28 Author: Yuzhuo Jing Date: Wed Jun 25 13:23:11 2025 -0700 tools: Remove libcrypto dependency Remove all occurrence of libcrypto in the build system. Signed-off-by: Yuzhuo Jing Signed-off-by: Eric Biggers Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250625202311.23244-5-ebiggers@kernel.org Signed-off-by: Namhyung Kim commit e3f612c1d8f3945bb0cc8aad173fc12a3b20dc2a Author: Yuzhuo Jing Date: Wed Jun 25 13:23:10 2025 -0700 perf genelf: Remove libcrypto dependency and use built-in sha1() genelf is the only file in perf that depends on libcrypto (or openssl) which only calculates a Build ID (SHA1, MD5, or URANDOM). SHA1 was expected to be the default option, but MD5 was used by default due to previous issues when linking against Java. This commit switches genelf to use the in-house sha1(), and also removes MD5 and URANDOM options since we have a reliable SHA1 implementation to rely on. It passes the tools/perf/tests/shell/test_java_symbol.sh test. Signed-off-by: Yuzhuo Jing Co-developed-by: Eric Biggers Signed-off-by: Eric Biggers Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250625202311.23244-4-ebiggers@kernel.org Signed-off-by: Namhyung Kim commit 43830468b6436811ff732b062f8d6306c6eddb77 Author: Eric Biggers Date: Wed Jun 25 13:23:09 2025 -0700 perf util: add a basic SHA-1 implementation SHA-1 can be written in fewer than 100 lines of code. Just add a basic SHA-1 implementation so that there's no need to use an external library or try to pull in the kernel's SHA-1 implementation. The kernel's SHA-1 implementation is not really intended to be pulled into userspace programs in the way that it was proposed to do so for perf (https://lore.kernel.org/r/20250521225307.743726-3-yuzhuo@google.com/), and it's also likely to undergo some refactoring in the future. There's no need to tie userspace tools to it. Include a test for sha1() in the util test suite. Signed-off-by: Eric Biggers Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250625202311.23244-3-ebiggers@kernel.org Signed-off-by: Namhyung Kim commit 55a18d2f3ff79c9082225f44e0abbaea6286bf99 Author: Eric Biggers Date: Wed Jun 25 13:23:08 2025 -0700 perf build: enable -fno-strict-aliasing perf pulls in code from kernel headers that assumes it is being built with -fno-strict-aliasing, namely put_unaligned_*() from which write the data using packed structs that lack the may_alias attribute. Enable -fno-strict-aliasing to prevent miscompilations in sha1.c which would otherwise occur due to this issue. Signed-off-by: Eric Biggers Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250625202311.23244-2-ebiggers@kernel.org Signed-off-by: Namhyung Kim commit c72bf82f96019216bb0a291d39c244977603661f Author: Thomas Falcon Date: Thu Jun 12 11:36:59 2025 -0500 perf top: populate PMU capabilities data in perf_env Calling perf top with branch filters enabled on Intel CPU's with branch counters logging (A.K.A LBR event logging [1]) support results in a segfault. $ perf top -e '{cpu_core/cpu-cycles/,cpu_core/event=0xc6,umask=0x3,frontend=0x11,name=frontend_retired_dsb_miss/}' -j any,counter ... Thread 27 "perf" received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x7fffafff76c0 (LWP 949003)] perf_env__find_br_cntr_info (env=0xf66dc0 , nr=0x0, width=0x7fffafff62c0) at util/env.c:653 653 *width = env->cpu_pmu_caps ? env->br_cntr_width : (gdb) bt #0 perf_env__find_br_cntr_info (env=0xf66dc0 , nr=0x0, width=0x7fffafff62c0) at util/env.c:653 #1 0x00000000005b1599 in symbol__account_br_cntr (branch=0x7fffcc3db580, evsel=0xfea2d0, offset=12, br_cntr=8) at util/annotate.c:345 #2 0x00000000005b17fb in symbol__account_cycles (addr=5658172, start=5658160, sym=0x7fffcc0ee420, cycles=539, evsel=0xfea2d0, br_cntr=8) at util/annotate.c:389 #3 0x00000000005b1976 in addr_map_symbol__account_cycles (ams=0x7fffcd7b01d0, start=0x7fffcd7b02b0, cycles=539, evsel=0xfea2d0, br_cntr=8) at util/annotate.c:422 #4 0x000000000068d57f in hist__account_cycles (bs=0x110d288, al=0x7fffafff6540, sample=0x7fffafff6760, nonany_branch_mode=false, total_cycles=0x0, evsel=0xfea2d0) at util/hist.c:2850 #5 0x0000000000446216 in hist_iter__top_callback (iter=0x7fffafff6590, al=0x7fffafff6540, single=true, arg=0x7fffffff9e00) at builtin-top.c:737 #6 0x0000000000689787 in hist_entry_iter__add (iter=0x7fffafff6590, al=0x7fffafff6540, max_stack_depth=127, arg=0x7fffffff9e00) at util/hist.c:1359 #7 0x0000000000446710 in perf_event__process_sample (tool=0x7fffffff9e00, event=0x110d250, evsel=0xfea2d0, sample=0x7fffafff6760, machine=0x108c968) at builtin-top.c:845 #8 0x0000000000447735 in deliver_event (qe=0x7fffffffa120, qevent=0x10fc200) at builtin-top.c:1211 #9 0x000000000064ccae in do_flush (oe=0x7fffffffa120, show_progress=false) at util/ordered-events.c:245 #10 0x000000000064d005 in __ordered_events__flush (oe=0x7fffffffa120, how=OE_FLUSH__TOP, timestamp=0) at util/ordered-events.c:324 #11 0x000000000064d0ef in ordered_events__flush (oe=0x7fffffffa120, how=OE_FLUSH__TOP) at util/ordered-events.c:342 #12 0x00000000004472a9 in process_thread (arg=0x7fffffff9e00) at builtin-top.c:1120 #13 0x00007ffff6e7dba8 in start_thread (arg=) at pthread_create.c:448 #14 0x00007ffff6f01b8c in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78 The cause is that perf_env__find_br_cntr_info tries to access a null pointer pmu_caps in the perf_env struct. A similar issue exists for homogeneous core systems which use the cpu_pmu_caps structure. Fix this by populating cpu_pmu_caps and pmu_caps structures with values from sysfs when calling perf top with branch stack sampling enabled. [1], LBR event logging introduced here: https://lore.kernel.org/all/20231025201626.3000228-5-kan.liang@linux.intel.com/ Reviewed-by: Ian Rogers Signed-off-by: Thomas Falcon Link: https://lore.kernel.org/r/20250612163659.1357950-2-thomas.falcon@intel.com Signed-off-by: Namhyung Kim commit ac871873bac736edd3945ade222d2902c0b10ac2 Author: Thomas Falcon Date: Thu Jun 12 11:36:58 2025 -0500 perf tools: move perf_pmus__find_core_pmu() prototype to pmus.h perf_pmus__find_core_pmu() is implemented in util/pmus.c but its prototpye is in util/pmu.h. Move it to util/pmus.h. Suggested-by: Ian Rogers Signed-off-by: Thomas Falcon Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250612163659.1357950-1-thomas.falcon@intel.com Signed-off-by: Namhyung Kim commit 28aa52b6189f1cc409f96910c63fa1b99370b99e Merge: 5cfb2ac2806c7a e34a79b96ab9d4 Author: Jakub Kicinski Date: Thu Jun 12 10:08:24 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.16-rc4). Conflicts: Documentation/netlink/specs/mptcp_pm.yaml 9e6dd4c256d0 ("netlink: specs: mptcp: replace underscores with dashes in names") ec362192aa9e ("netlink: specs: fix up indentation errors") https://lore.kernel.org/20250626122205.389c2cd4@canb.auug.org.au Adjacent changes: Documentation/netlink/specs/fou.yaml 791a9ed0a40d ("netlink: specs: fou: replace underscores with dashes in names") 880d43ca9aa4 ("netlink: specs: clean up spaces in brackets") Signed-off-by: Jakub Kicinski commit f6109fb6f5d7fb9403cecfc75302bbf47ed83b8d Author: Namhyung Kim Date: Mon Jun 23 15:57:21 2025 -0700 perf trace: Split BPF skel code to util/bpf_trace_augment.c And make builtin-trace.c less conditional. Dummy functions will be called when BUILD_BPF_SKEL=0 is used. This makes the builtin-trace.c slightly smaller and simpler by removing the skeleton and its helpers. The conditional guard of trace__init_syscalls_bpf_prog_array_maps() is changed from the HAVE_BPF_SKEL to HAVE_LIBBPF_SUPPORT as it doesn't have a skeleton in the code directly. And a dummy function is added so that it can be called unconditionally. The function will succeed only if the both conditions are true. Do not include trace_augment.h from the BPF code and move the definition of TRACE_AUG_MAX_BUF to the BPF directly. Reviewed-by: Howard Chu Tested-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250623225721.21553-1-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 2f5d370dec3f800b44bbf7b68875d521e0af43cd Author: James Clark Date: Mon Jun 23 10:00:12 2025 +0100 perf test: Change all remaining #!/bin/sh to #!/bin/bash There are 43 instances of posix shell tests and 35 instances of bash. To give us a single consistent language for testing in, replace all #!/bin/sh to #!/bin/bash. Common sources that are included in both different shells will now work as expected. And we no longer have to fix up bashisms that appear to work when someone's system has sh symlinked to bash, but don't work on other systems that have both shells installed. Although we could have chosen sh, it's not backwards compatible so it wouldn't be possible to bulk convert without re-writing the existing bash tests. Choosing bash also gives us some nicer features including 'local' variable definitions and regexes in if statements that are already widely used in the tests. It's not expected that there are any users with only sh available due to the large number of bash tests that exist. Discussed in relation to running shellcheck here: https://lore.kernel.org/linux-perf-users/e3751a74be34bbf3781c4644f518702a7270220b.1749785642.git.collin.funk1@gmail.com/ Signed-off-by: James Clark Reviewed-by: Collin Funk Acked-by: Arnaldo Carvalho de Melo Link: https://lore.kernel.org/r/20250623-james-perf-bash-tests-v1-1-f572f54d4559@linaro.org Signed-off-by: Namhyung Kim commit 6def0822d211df4bfb3276eac42f541dc9cc9fb8 Merge: 886178a33a30fe 583588594b249e Author: Andrii Nakryiko Date: Thu Jun 26 10:28:51 2025 -0700 Merge branch 'support-array-presets-in-veristat' Mykyta Yatsenko says: ==================== Support array presets in veristat From: Mykyta Yatsenko This patch series implements support for array variable presets in veristat. Currently users can set values to global variables before loading BPF program, but not for arrays. With this change array elements are supported as well, for example: ``` sudo ./veristat set_global_vars.bpf.o -G "arr[0] = 1" ``` v4 -> v5 * Simplify array elements offset calculation using btf__resolve_size * Support white spaces in array indexes, e.g. arr [ 0 ] * Rename btf_find_member into adjust_var_secinfo_member v3 -> v4 * Rework implementation to support multi dimensional arrays * Rework data structures for storing parsed presets v2 -> v3 * Added more negative tests * Fix mem leak * Other small fixes v1 -> v2 * Support enums as indexes * Separating parsing logic from preset processing * Add more tests ==================== Link: https://patch.msgid.link/20250625165904.87820-1-mykyta.yatsenko5@gmail.com Signed-off-by: Andrii Nakryiko commit 583588594b249e0ad3a64c68846d17018295ebe4 Author: Mykyta Yatsenko Date: Wed Jun 25 17:59:04 2025 +0100 selftests/bpf: Test array presets in veristat Modify existing veristat tests to verify that array presets are applied as expected. Introduce few negative tests as well to check that common error modes are handled. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20250625165904.87820-4-mykyta.yatsenko5@gmail.com commit edc99d0b021c1b345af3a27150d5d23799c1bc25 Author: Mykyta Yatsenko Date: Wed Jun 25 17:59:03 2025 +0100 selftests/bpf: Support array presets in veristat Implement support for presetting values for array elements in veristat. For example: ``` sudo ./veristat set_global_vars.bpf.o -G "arr[3] = 1" ``` Arrays of structures and structure of arrays work, but each individual scalar value has to be set separately: `foo[1].bar[2] = value`. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20250625165904.87820-3-mykyta.yatsenko5@gmail.com commit be898cb5cbf4dede2f760303d73f5a427107282a Author: Mykyta Yatsenko Date: Wed Jun 25 17:59:02 2025 +0100 selftests/bpf: Separate var preset parsing in veristat Refactor var preset parsing in veristat to simplify implementation. Prepare parsed variable beforehand so that parsing logic is separated from functionality of calculating offsets and searching fields. Introduce rvalue struct, storing either int or enum (string value), will be reused in the next patch, extract parsing rvalue into a separate function. Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Acked-by: Eduard Zingerman Link: https://lore.kernel.org/bpf/20250625165904.87820-2-mykyta.yatsenko5@gmail.com commit 886178a33a30fe685e926d84f531243982fb3c70 Merge: 5046acc1138256 e34a79b96ab9d4 Author: Alexei Starovoitov Date: Thu Jun 26 09:48:06 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf after rc3 Cross-merge BPF, perf and other fixes after downstream PRs. It restores BPF CI to green after critical fix commit bc4394e5e79c ("perf: Fix the throttle error of some clock events") No conflicts. Signed-off-by: Alexei Starovoitov commit 5046acc11382565c4a46818a5bc43bb65d20ed31 Merge: d83caf7c8dad96 e8763fb66a3868 Author: Alexei Starovoitov Date: Thu Jun 26 09:44:46 2025 -0700 Merge branch 'bpf-add-kfuncs-for-read-only-string-operations' Viktor Malik says: ==================== bpf: Add kfuncs for read-only string operations String operations are commonly used in programming and BPF programs are no exception. Since it is cumbersome to reimplement them over and over, this series introduce kfuncs which provide the most common operations. For now, we only limit ourselves to functions which do not copy memory since these usually introduce undefined behaviour in case the source/destination buffers overlap which would have to be prevented by the verifier. The kernel already contains implementations for all of these, however, it is not possible to use them from BPF context. The main reason is that the verifier is not able to check that it is safe to access the entire string and that the string is null-terminated and the function won't loop forever. Therefore, the operations are open-coded using __get_kernel_nofault instead of plain dereference and bounded to at most XATTR_SIZE_MAX characters to make them safe. That allows to skip all the verfier checks for the passed-in strings as safety is ensured dynamically. All of the proposed functions return integers, even those that normally (in the kernel or libc) return pointers into the strings. The reason is that since the strings are generally treated as unsafe, the pointers couldn't be dereferenced anyways. So, instead, we return an index to the string and let user decide what to do with it. The integer APIs also allow to return various error codes when unexpected situations happen while processing the strings. The series include both positive and negative tests using the kfuncs. Changelog --------- Changes in v8: - Return -ENOENT (instead of -1) when "item not found" for relevant functions (Alexei). - Small adjustments of the string algorithms (Andrii). - Adapt comments to kernel style (Alexei). Changes in v7: - Disable negative tests passing NULL and 0x1 to kfuncs on s390 as they aren't relevant (see comment in string_kfuncs_failure1.c for details). Changes in v6: - Improve the third patch which allows to use macros in __retval in selftests. The previous solution broke several tests. Changes in v5: - Make all kfuncs return integers (Andrii). - Return -ERANGE when passing non-kernel pointers on arches with non-overlapping address spaces (Alexei). - Implement "unbounded" variants using the bounded ones (Andrii). - Add more negative test cases. Changes in v4 (all suggested by Andrii): - Open-code all the kfuncs, not just the unbounded variants. - Introduce `pagefault` lock guard to simplify the implementation - Return appropriate error codes (-E2BIG and -EFAULT) on failures - Const-ify all arguments and return values - Add negative test-cases Changes in v3: - Open-code unbounded variants with __get_kernel_nofault instead of dereference (suggested by Alexei). - Use the __sz suffix for size parameters in bounded variants (suggested by Eduard and Alexei). - Make tests more compact (suggested by Eduard). - Add benchmark. ==================== Link: https://patch.msgid.link/cover.1750917800.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit e8763fb66a386843f091925dab757c4f55633d0b Author: Viktor Malik Date: Thu Jun 26 08:08:31 2025 +0200 selftests/bpf: Add tests for string kfuncs Add both positive and negative tests cases using string kfuncs added in the previous patches. Positive tests check that the functions work as expected. Negative tests pass various incorrect strings to the kfuncs and check for the expected error codes: -E2BIG when passing too long strings -EFAULT when trying to read inaccessible kernel memory -ERANGE when passing userspace pointers on arches with non-overlapping address spaces A majority of the tests use the RUN_TESTS helper which executes BPF programs with BPF_PROG_TEST_RUN and check for the expected return value. An exception to this are tests for long strings as we need to memset the long string from userspace (at least I haven't found an ergonomic way to memset it from a BPF program), which cannot be done using the RUN_TESTS infrastructure. Suggested-by: Eduard Zingerman Signed-off-by: Viktor Malik Link: https://lore.kernel.org/r/090451a2e60c9ae1dceb4d1bfafa3479db5c7481.1750917800.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit a55b7d39328bc6de1131cb5496816129cab2728b Author: Viktor Malik Date: Thu Jun 26 08:08:30 2025 +0200 selftests/bpf: Allow macros in __retval Allow macro expansion for values passed to the `__retval` and `__retval_unpriv` attributes. This is especially useful for testing programs which return various error codes. With this change, the code for parsing special literals can be made simpler, as the literals are defined via macros. The only exception is INT_MIN which expands to (-INT_MAX -1), which is not single number and cannot be parsed by strtol. So, we instead use a prefixed literal _INT_MIN in __retval and handle it separately (assign the expected return to INT_MIN). Also, strtol cannot handle the "ll" suffix so change the value of POINTER_VALUE from 0xcafe4all to 0xbadcafe. Signed-off-by: Viktor Malik Link: https://lore.kernel.org/r/a6c6b551ae0575351faa7b7a1df52f9341a5cbe8.1750917800.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit e91370550f1fe6fa3b02e8bf9762e3dc0a02fcad Author: Viktor Malik Date: Thu Jun 26 08:08:29 2025 +0200 bpf: Add kfuncs for read-only string operations String operations are commonly used so this exposes the most common ones to BPF programs. For now, we limit ourselves to operations which do not copy memory around. Unfortunately, most in-kernel implementations assume that strings are %NUL-terminated, which is not necessarily true, and therefore we cannot use them directly in the BPF context. Instead, we open-code them using __get_kernel_nofault instead of plain dereference to make them safe and limit the strings length to XATTR_SIZE_MAX to make sure the functions terminate. When __get_kernel_nofault fails, functions return -EFAULT. Similarly, when the size bound is reached, the functions return -E2BIG. In addition, we return -ERANGE when the passed strings are outside of the kernel address space. Note that thanks to these dynamic safety checks, no other constraints are put on the kfunc args (they are marked with the "__ign" suffix to skip any verifier checks for them). All of the functions return integers, including functions which normally (in kernel or libc) return pointers to the strings. The reason is that since the strings are generally treated as unsafe, the pointers couldn't be dereferenced anyways. So, instead, we return an index to the string and let user decide what to do with it. This also nicely fits with returning various error codes when necessary (see above). Suggested-by: Alexei Starovoitov Signed-off-by: Viktor Malik Link: https://lore.kernel.org/r/4b008a6212852c1b056a413f86e3efddac73551c.1750917800.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit 3a95a561f2763e3854e207de3ea821e795a1f1e0 Author: Viktor Malik Date: Thu Jun 26 08:08:28 2025 +0200 uaccess: Define pagefault lock guard Define a pagefault lock guard which allows to simplify functions that need to disable page faults. Signed-off-by: Viktor Malik Link: https://lore.kernel.org/r/8a01beb0b671923976f08297d81242bb2129881d.1750917800.git.vmalik@redhat.com Signed-off-by: Alexei Starovoitov commit b5870168783168f670bd55ebb00fd8207cb42479 Author: Thomas Hellström Date: Thu Jun 19 15:40:35 2025 +0200 drm/xe: Implement and use the drm_pagemap populate_mm op Add runtime PM since we might call populate_mm on a foreign device. v3: - Fix a kerneldoc failure (Matt Brost) - Revert the bo type change from device to kernel (Matt Brost) v4: - Add an assert in xe_svm_alloc_vram (Matt Brost) Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250619134035.170086-4-thomas.hellstrom@linux.intel.com commit 2ef19be2a545a63310c5c0fae0e173fc0c33bb6a Author: Thomas Hellström Date: Thu Jun 19 15:40:34 2025 +0200 drm/pagemap: Add a populate_mm op Add an operation to populate a part of a drm_mm with device private memory. Clarify how migration using it is intended to work. v3: - Kerneldoc fixes and updates (Matt Brost). v4: - More kerneldoc fixes. Rebase. Signed-off-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250619134035.170086-3-thomas.hellstrom@linux.intel.com commit f86ad0ed620cb3c91ec7d5468e93ac68d727539d Author: Matthew Brost Date: Thu Jun 19 15:40:33 2025 +0200 drm/gpusvm, drm/pagemap: Move migration functionality to drm_pagemap The migration functionality and track-keeping of per-pagemap VRAM mapped to the CPU mm is not per GPU_vm, but rather per pagemap. This is also reflected by the functions not needing the drm_gpusvm structures. So move to drm_pagemap. With this, drm_gpusvm shouldn't really access the page zone-device-data since its meaning is internal to drm_pagemap. Currently it's used to reject mapping ranges backed by multiple drm_pagemap allocations. For now, make the zone-device-data a void pointer. Alter the interface of drm_gpusvm_migrate_to_devmem() to ensure we don't pass a gpusvm pointer. Rename CONFIG_DRM_XE_DEVMEM_MIRROR to CONFIG_DRM_XE_PAGEMAP. Matt is listed as author of this commit since he wrote most of the code, and it makes sense to retain his git authorship. Thomas mostly moved the code around. v3: - Kerneldoc fixes (CI) - Don't update documentation about how the drm_pagemap migration should be interpreted until upcoming patches where the functionality is implemented. (Matt Brost) v4: - More kerneldoc fixes around timeslice_ms (Himal Ghimiray, Matt Brost) v6: - Fix an uninitialized pagemap pointer (CI) Co-developed-by: Thomas Hellström Signed-off-by: Thomas Hellström Reviewed-by: Himal Prasad Ghimiray Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250619134035.170086-2-thomas.hellstrom@linux.intel.com commit 8b4987543453c6172983f4b0b084c55a18e250ad Author: Jacob Keller Date: Mon Jun 23 17:30:04 2025 -0700 ice: default to TIME_REF instead of TXCO on E825-C The driver currently defaults to the internal oscillator as the clock source for E825-C hardware. While this clock source is labeled TCXO, indicating a temperature compensated oscillator, this is only true for some board designs. Many board designs have a less capable oscillator. The E825-C hardware may also have its clock source set to the TIME_REF pin. This pin is connected to the DPLL and is often a more stable clock source. The choice of the internal oscillator is not suitable for all systems, especially those which want to enable SyncE support. There is currently no interface available for users to configure the clock source. Other variants of the E82x board have the clock source configured in the NVM, but E825-C lacks this capability, so different board designs cannot select a different default clock via firmware. In most setups, the TIME_REF is a suitable default clock source. Additionally, we now fall back to the internal oscillator automatically if the TIME_REF clock source cannot be locked. Change the default clock source for E825-C to TIME_REF. Note that the driver logs a dev_dbg message upon configuring the TSPLL which includes the clock source and frequency. This can be enabled to confirm which clock source is in use. Longterm a proper interface to dynamically introspect and change the clock source will be designed (perhaps some extension of the DPLL subsystem?) Signed-off-by: Jacob Keller Tested-by: Rinitha S Signed-off-by: Tony Nguyen commit e980aa68520963f07364c98eac9f4426f968526c Author: Karol Kolacinski Date: Mon Jun 23 17:30:03 2025 -0700 ice: move TSPLL init calls to ice_ptp.c Initialize TSPLL after initializing PHC in ice_ptp.c instead of calling for each product in PHC init in ice_ptp_hw.c. Reviewed-by: Michal Kubiak Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Tested-by: Rinitha S Signed-off-by: Tony Nguyen commit 84b8694433c8ac0c13acd2b247fde682751e0ff2 Author: Karol Kolacinski Date: Mon Jun 23 17:30:02 2025 -0700 ice: fall back to TCXO on TSPLL lock fail TSPLL can fail when trying to lock to TIME_REF as a clock source, e.g. when the external clock source is not stable or connected to the board. To continue operation after failure, try to lock again to internal TCXO and inform user about this. Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Tested-by: Rinitha S Signed-off-by: Tony Nguyen commit df3f3c5645bec3c7e2595acbf37db34c0a7de58a Author: Karol Kolacinski Date: Mon Jun 23 17:30:01 2025 -0700 ice: wait before enabling TSPLL To ensure proper operation, wait for 10 to 20 microseconds before enabling TSPLL. Adjust wait time after enabling TSPLL from 1-5 ms to 1-2 ms. Those values are empirical and tested on multiple HW configurations. Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Signed-off-by: Tony Nguyen commit 5755b4c023dbfc0856087f005ddf437f341c3c45 Author: Karol Kolacinski Date: Mon Jun 23 17:30:00 2025 -0700 ice: add multiple TSPLL helpers Add helpers for checking TSPLL params, disabling sticky bits, configuring TSPLL and getting default clock frequency to simplify the code flows. Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Signed-off-by: Tony Nguyen commit c6b4486a62013460e1dc78abe936560aad27f977 Author: Karol Kolacinski Date: Mon Jun 23 17:29:59 2025 -0700 ice: use bitfields instead of unions for CGU regs Switch from unions with bitfield structs to definitions with bitfield masks. This is necessary, because some registers have different field definitions or even use a different register for the same fields based on HW type. Remove unused register fields. Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Signed-off-by: Tony Nguyen commit 38f742df9fcfc91a681d650fc5b622276b6c61b5 Author: Jacob Keller Date: Mon Jun 23 17:29:58 2025 -0700 ice: read TSPLL registers again before reporting status After programming the TSPLL, re-read the registers before reporting status. This ensures the debug log message will show what was actually programmed, rather than relying on a cached value. Signed-off-by: Jacob Keller Signed-off-by: Tony Nguyen commit d261d755300eb0644873ebf41d01e1ea9f1ff8d4 Author: Jacob Keller Date: Mon Jun 23 17:29:57 2025 -0700 ice: clear time_sync_en field for E825-C during reprogramming When programming the Clock Generation Unit for E285-C hardware, we need to clear the time_sync_en bit of the DWORD 9 before we set the frequency. Co-developed-by: Karol Kolacinski Signed-off-by: Karol Kolacinski Signed-off-by: Jacob Keller Signed-off-by: Tony Nguyen commit bb8aa27eff6f3376242da37c2d02b9dcc66934b1 Author: Thomas Hellström Date: Mon Jun 23 17:53:13 2025 +0200 drm/ttm, drm_xe, Implement ttm_lru_walk_for_evict() using the guarded LRU iteration To avoid duplicating the tricky bo locking implementation, Implement ttm_lru_walk_for_evict() using the guarded bo LRU iteration. To facilitate this, support ticketlocking from the guarded bo LRU iteration. v2: - Clean up some static function interfaces (Christian König) - Fix Handling -EALREADY from ticketlocking in the loop by skipping to the next item. (Intel CI) Signed-off-by: Thomas Hellström Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250623155313.4901-4-thomas.hellstrom@linux.intel.com commit e1e85eb0a977f1eb1d17d4627aceaa8eeac37159 Author: Thomas Hellström Date: Mon Jun 23 17:53:12 2025 +0200 drm/ttm, drm/xe: Modify the struct ttm_bo_lru_walk_cursor initialization Instead of the struct ttm_operation_ctx, Pass a struct ttm_lru_walk_arg to enable us to easily extend the walk functionality, and to implement ttm_lru_walk_for_evict() using the guarded LRU iteration. Signed-off-by: Thomas Hellström Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250623155313.4901-3-thomas.hellstrom@linux.intel.com commit c8e3d6d77507c42cc1a02783f70e1e4e85e3c80f Author: Thomas Hellström Date: Mon Jun 23 17:53:11 2025 +0200 drm/ttm: Use a struct for the common part of struct ttm_lru_walk and struct ttm_bo_lru_cursor Let the locking functions take the new struct ttm_lru_walk_arg as argument in order for them to be easily used from both types of walk. v2: - Whitespace fix Signed-off-by: Thomas Hellström Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250623155313.4901-2-thomas.hellstrom@linux.intel.com commit 778fa8ad5f0f23397d045c7ebca048ce8def1c43 Author: Dan Carpenter Date: Wed Jun 25 10:21:58 2025 -0500 drm/i915/selftests: Change mock_request() to return error pointers There was an error pointer vs NULL bug in __igt_breadcrumbs_smoketest(). The __mock_request_alloc() function implements the smoketest->request_alloc() function pointer. It was supposed to return error pointers, but it propogates the NULL return from mock_request() so in the event of a failure, it would lead to a NULL pointer dereference. To fix this, change the mock_request() function to return error pointers and update all the callers to expect that. Fixes: 52c0fdb25c7c ("drm/i915: Replace global breadcrumbs with per-context interrupt tracking") Signed-off-by: Dan Carpenter Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/685c1417.050a0220.696f5.5c05@mx.google.com Signed-off-by: Rodrigo Vivi commit 41ffbb1c42d30a173cc43e931bbaf7bf29e92d1f Author: John Madieu Date: Mon Jun 23 10:04:04 2025 +0200 arm64: dts: renesas: r9a09g047: Add GBETH nodes Add GBETH nodes to RZ/G3E (R9A09G047) SoC DTSI. Reviewed-by: Biju Das Tested-by: Biju Das Reviewed-by: Geert Uytterhoeven Signed-off-by: John Madieu Link: https://lore.kernel.org/20250623080405.355083-3-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c0cd5213d409994f65ebd900f7f54d6d7a6435a4 Author: Lad Prabhakar Date: Fri Jun 20 13:10:44 2025 +0100 arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Rename fixed regulator node names Rename "regulator0" to "regulator-0p8v" and "regulator1" to "regulator-3p3v" for consistency as done in the RZ/V2N EVK. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250620121045.56114-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit b7754520a499ca4619e6ce3c9cca354826e77bbf Author: Lad Prabhakar Date: Thu Jun 19 14:55:39 2025 +0100 arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Add RAA215300 PMIC Add support for the Renesas RAA215300 PMIC to the RZ/V2N EVK. The PMIC is connected to I2C8 and uses a 32.768kHz fixed clock source (x6). Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250619135539.207828-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 746fff66d5ef8162ecbb39910bddba5ad42dc0b0 Author: Lad Prabhakar Date: Thu Jun 19 14:55:38 2025 +0100 arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Add RAA215300 PMIC Add support for the Renesas RAA215300 PMIC to the RZ/V2H EVK. The PMIC is connected to I2C8 and uses a 32.768kHz fixed clock source (x6). Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250619135539.207828-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 34a3554a1c7059b861db2aafb052a256f38813d6 Author: Langyan Ye Date: Thu Jun 26 20:28:54 2025 +0800 drm/panel-edp: Add CMN N116BCJ-EAK Add support for the CMN N116BCJ-EAK, pleace the EDID here for subsequent reference. 00 ff ff ff ff ff ff 00 0d ae 63 11 00 00 00 00 19 22 01 04 95 1a 0e 78 02 67 75 98 59 53 90 27 1c 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 da 1d 56 e2 50 00 20 30 30 20 a6 00 00 90 10 00 00 18 00 00 00 fe 00 4e 31 31 36 42 43 4a 2d 45 41 4b 0a 20 00 00 00 fe 00 43 4d 4e 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe 00 4e 31 31 36 42 43 4a 2d 45 41 4b 0a 20 00 80 Signed-off-by: Langyan Ye Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250626122854.193239-1-yelangyan@huaqin.corp-partner.google.com commit bffc0692359f8d06d989657c00b274802a791692 Author: Bartosz Golaszewski Date: Fri Jun 20 09:49:51 2025 +0200 drm/bridge: ti-sn65dsi86: remove unnecessary GPIO line direction check As of commit 92ac7de3175e3 ("gpiolib: don't allow setting values on input lines"), the GPIO core makes sure values cannot be set on input lines. Remove the unnecessary check. Signed-off-by: Bartosz Golaszewski Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250620074951.32758-1-brgl@bgdev.pl commit b7c26cbd5b704a350b3176669f47047153903bc9 Author: Fabrizio Castro Date: Tue Jun 24 20:27:48 2025 +0100 clk: renesas: rzv2h: Add missing include file File `rzv2h-cpg.h' makes use of data types defined in `linux/types.h', but it does not include the latter, which could lead to build errors. Include `linux/types.h' to fix this problem. Signed-off-by: Fabrizio Castro Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250624192748.340196-1-fabrizio.castro.jz@renesas.com Signed-off-by: Geert Uytterhoeven commit 815703e2ecdf091a724c16671aadd8c55de24878 Author: Arnd Bergmann Date: Fri Jun 20 13:41:28 2025 +0200 EDAC/mem_repair: Reduce stack usage in edac_mem_repair_get_desc() Constructing an array on the stack adds complexity and can exceed the warning limit for per-function stack usage: drivers/edac/mem_repair.c:361:5: error: stack frame size (1296) exceeds limit (1280) in 'edac_mem_repair_get_desc' [-Werror,-Wframe-larger-than] Change this to have the actual attribute array allocated statically and then just add the instance number on the per-instance copy. Fixes: 699ea5219c4b ("EDAC: Add a memory repair control feature") Signed-off-by: Arnd Bergmann Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250620114135.4017183-1-arnd@kernel.org commit 128ab2cfd0205fe395196a9f3221bcddd6adf54e Author: Vladimir Kondratiev Date: Thu Jun 12 17:39:09 2025 +0300 irqchip/aslint-sswi: Resolve hart index Resolve hart index according to assignment in the "riscv,hart-indexes" property as defined in the specification [1] Signed-off-by: Vladimir Kondratiev Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250612143911.3224046-6-vladimir.kondratiev@mobileye.com Link: https://github.com/riscvarchive/riscv-aclint [1] commit c8c8443a64a186df0508c709d51fe9c7db0b5d55 Author: Vladimir Kondratiev Date: Thu Jun 12 17:39:10 2025 +0300 irqchip/aclint-sswi: Reduce data scope Move variables to the innermost scope where they are used Signed-off-by: Vladimir Kondratiev Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250612143911.3224046-7-vladimir.kondratiev@mobileye.com commit 93406e374295ad25ab06104f734459cd25ce7134 Author: Vladimir Kondratiev Date: Thu Jun 12 17:39:11 2025 +0300 irqchip/aclint-sswi: Remove unneeded includes None of them are required for building the driver. Signed-off-by: Vladimir Kondratiev Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250612143911.3224046-8-vladimir.kondratiev@mobileye.com commit df0f030ee7e444c55341f4210124115878284125 Author: Vladimir Kondratiev Date: Thu Jun 12 17:39:08 2025 +0300 irqchip/thead-c900-aclint-sswi: Generalize aclint-sswi driver and add MIPS P800 support Refactor the Thead specific implementation of the ACLINT-SSWI irqchip: - Rename the source file and related details to reflect the generic nature of the driver - Factor out the generic code that serves both Thead and MIPS variants. This generic part is compliant with the RISC-V draft spec [1] - Provide generic and Thead specific initialization functions Signed-off-by: Vladimir Kondratiev Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250612143911.3224046-5-vladimir.kondratiev@mobileye.com Link: https://github.com/riscvarchive/riscv-aclint [1] commit ed651979bb780270ae14b35ca6bae68f658eddad Author: Vladimir Kondratiev Date: Thu Jun 12 17:39:07 2025 +0300 dt-bindings: interrupt-controller: Add MIPS P8700 aclint-sswi Add ACLINT-SSWI variant for the MIPS P8700 SoC. This CPU has a SSWI device compliant with the RISC-V draft spec (see [1]). CPU indexes on this platform are not continuous, instead it uses bit-fields to encode hart,core,cluster numbers, thus the DT property "riscv,hart-indexes" is mandatory for it. Signed-off-by: Vladimir Kondratiev Signed-off-by: Thomas Gleixner Acked-by: Conor Dooley Link: https://lore.kernel.org/all/20250612143911.3224046-4-vladimir.kondratiev@mobileye.com Link: https://github.com/riscvarchive/riscv-aclint [1] commit 81f335e10605beda222d51d348a1ac058d4bac61 Author: Vladimir Kondratiev Date: Thu Jun 12 17:39:06 2025 +0300 irqchip/riscv-aplic: Use riscv_get_hart_index() Use the global helper function instead of the local implementation. Signed-off-by: Vladimir Kondratiev Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250612143911.3224046-3-vladimir.kondratiev@mobileye.com commit 5fe331cdcfba5b2c2dd8211127dadefcaaa97dec Author: Vladimir Kondratiev Date: Thu Jun 12 17:39:05 2025 +0300 riscv: Helper to parse hart index RISC-V APLIC specification defines "hart index" in [1]. Similar definitions can be found for ACLINT in [2] Quote from the APLIC specification: Within a given interrupt domain, each of the domain’s harts has a unique index number in the range 0 to 2^14 − 1 (= 16,383). The index number a domain associates with a hart may or may not have any relationship to the unique hart identifier (“hart ID”) that the RISC-V Privileged Architecture assigns to the hart. Two different interrupt domains may employ entirely different index numbers for the same set of harts. Further, it says in "4.5 Memory-mapped control region for an interrupt domain": The array of IDC structures may include some for potential hart index numbers that are not actual hart index numbers in the domain. For example, the first IDC structure is always for hart index 0, but 0 is not necessarily a valid index number for any hart in the domain. Support arbitrary hart indices specified in an optional property "riscv,hart-indexes" which is specified as an array of u32 elements, one per interrupt target, listing hart indexes in the same order as in "interrupts-extended". If this property is not specified, fall back to use logical hart indices within the domain. Signed-off-by: Vladimir Kondratiev Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250612143911.3224046-2-vladimir.kondratiev@mobileye.com Link: https://github.com/riscv/riscv-aia [1] Link: https://github.com/riscvarchive/riscv-aclint [2] commit fbb3bdf541e634ce5395cc99f0d4dba15d182b4e Author: Heiko Carstens Date: Wed Jun 18 17:22:17 2025 +0200 s390/nmi: Print additional information In case of an unrecoverable machine check only the machine check interrupt code is printed to the console before the machine is stopped. This makes root cause analysis sometimes hard. Print additional machine check information to make analysis easier. The output now looks like this: Unrecoverable machine check, code: 00400F5F4C3B0000 6.16.0-rc2-11605-g987a9431e53a-dirty HW: IBM 3931 A01 704 (z/VM 7.4.0) PSW: 0706C00180000000 000003FFE0F0462E PFX: 0000000000070000 LBA: 000003FFE0F0462A EDC: 0000000000000000 FSA: 0000000000000000 CRS: 0080000014966A12 0000000087CB41C7 0000000000BFF140 0000000000000000 000000000000FFFF 0000000000BFF140 0000000071000000 0000000087CB41C7 0000000000008000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00000000024C0007 00000000DB000000 0000000000BFF000 GPRS: FFFFFFFF00000000 000003FFE0F0462E E10EA4F489F897A6 0000000000000000 7FFFFFF2C0413C4C 000003FFE19B7010 0000000000000000 0000000000000000 0000000000000000 00000001F76B3380 000003FFE15D4050 0000000000000005 0000000000000000 0000000000070000 000003FFE0F0586C 0000037FE00B7DA0 System stopped Reviewed-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit e6565e76e977422cb9e51fe872a2bcfdbc321b7b Author: Luca Ceresoli Date: Fri Jun 20 17:59:55 2025 +0200 drm/bridge: add warning for bridges not using devm_drm_bridge_alloc() To the best of my knowledge, all drivers in the mainline kernel adding a DRM bridge are now converted to using devm_drm_bridge_alloc() for allocation and initialization. Among others this ensures initialization of the bridge refcount, allowing dynamic allocation lifetime. devm_drm_bridge_alloc() is now mandatory for all new bridges. Code using the old pattern ([devm_]kzalloc + filling the struct fields + drm_bridge_add) is not allowed anymore. Any drivers that might have been missed during the conversion, patches in flight towards mainline and out-of-tre drivers still using the old pattern will already be caught by a warning looking like: ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 2 PID: 83 at lib/refcount.c:25 refcount_warn_saturate+0x120/0x148 [...] Call trace: refcount_warn_saturate+0x120/0x148 (P) drm_bridge_get.part.0+0x70/0x98 [drm] drm_bridge_add+0x34/0x108 [drm] sn65dsi83_probe+0x200/0x480 [ti_sn65dsi83] [...] This warning comes from the refcount code and happens because drm_bridge_add() is increasing the refcount, which is uninitialized and thus initially zero. Having a warning and the corresponding stack trace is surely useful, but the warning text does not clarify the root problem nor how to fix it. Add a DRM_WARN() just before increasing the refcount, so the log will be much more readable: [drm] DRM bridge corrupted or not allocated by devm_drm_bridge_alloc() ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. [...etc...] A DRM_WARN is used because drm_warn and drm_WARN require a struct drm_device pointer which is not yet available when adding a bridge. Do not print the dev_name() in the warning because struct drm_bridge has no pointer to the struct device. The affected driver should be easy to catch based on the following stack trace however. Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250620-drm-bridge-alloc-getput-drm-bridge-c-v9-3-ca53372c9a84@bootlin.com Signed-off-by: Luca Ceresoli commit 94d50c1a2ca31d80f12d9c2bdbc41437751e320c Author: Luca Ceresoli Date: Fri Jun 20 17:59:54 2025 +0200 drm/bridge: get/put the bridge reference in drm_bridge_attach/detach() drm_bridge_attach() adds the bridge to the encoder chain, so take a reference for that. Vice versa in drm_bridge_detach(). Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250620-drm-bridge-alloc-getput-drm-bridge-c-v9-2-ca53372c9a84@bootlin.com Signed-off-by: Luca Ceresoli commit a7748dd127ea8d9cd2d9d942ef21c85e5569bb73 Author: Luca Ceresoli Date: Fri Jun 20 17:59:53 2025 +0200 drm/bridge: get/put the bridge reference in drm_bridge_add/remove() drm_bridge_add() adds the bridge to the global bridge_list, so take a reference for that. Vice versa in drm_bridge_remove(). Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250620-drm-bridge-alloc-getput-drm-bridge-c-v9-1-ca53372c9a84@bootlin.com Signed-off-by: Luca Ceresoli commit 5cfb2ac2806c7a255df5184d86ffca056cd5cb5c Author: Abdelrahman Fekry Date: Tue Jun 24 18:09:23 2025 +0300 docs: net: sysctl documentation cleanup Add missing default values for networking sysctl parameters and standardize documentation: - Use "0 (disabled)" / "1 (enabled)" format consistently - Fix cipso_rbm_struct_valid -> cipso_rbm_strictvalid typo - Convert fwmark_reflect description to enabled/disabled terminology - Document possible values for tcp_autocorking Also addresses formatting inconsistencies in touched parameters. Signed-off-by: Abdelrahman Fekry Reviewed-by: Bagas Sanjaya Link: https://patch.msgid.link/20250624150923.40590-1-abdelrahmanfekry375@gmail.com Signed-off-by: Paolo Abeni commit 0afcde806414b57884da1caa1d110287bcbfa65e Merge: a8a3bddb3aada1 d42e5248c9fa77 Author: Paolo Abeni Date: Thu Jun 26 14:56:16 2025 +0200 Merge branch 'eth-fbnic-trivial-code-tweaks' Jakub Kicinski says: ==================== eth: fbnic: trivial code tweaks A handful of code cleanups. No functional changes. ==================== Link: https://patch.msgid.link/20250624142834.3275164-1-kuba@kernel.org Signed-off-by: Paolo Abeni commit d42e5248c9fa7796d4e16b92cc084dc52b1d4731 Author: Jakub Kicinski Date: Tue Jun 24 07:28:34 2025 -0700 eth: fbnic: rename fbnic_fw_clear_cmpl to fbnic_mbx_clear_cmpl fbnic_fw_clear_cmpl() does the inverse of fbnic_mbx_set_cmpl(). It removes the completion from the mailbox table. It also calls fbnic_mbx_set_cmpl_slot() internally. It should have fbnic_mbx prefix, not fbnic_fw. I'm not very clear on what the distinction is between the two prefixes but the matching "set" and "clear" functions should use the same prefix. While at it move the "clear" function closer to the "set". Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250624142834.3275164-6-kuba@kernel.org Signed-off-by: Paolo Abeni commit 536bc9b2d8e85a0e8155f0ccfa5dcf6813f1a81d Author: Jakub Kicinski Date: Tue Jun 24 07:28:33 2025 -0700 eth: fbnic: sort includes Make sure includes are in alphabetical order. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250624142834.3275164-5-kuba@kernel.org Signed-off-by: Paolo Abeni commit f7d4c21667cc1a5baffd17d28794e32b352e576a Author: Jakub Kicinski Date: Tue Jun 24 07:28:32 2025 -0700 eth: fbnic: realign whitespace Relign various whitespace things. Some of it is spaces which should be tabs and some is making sure the values are actually correctly aligned to "columns" with 8 space tabs. Whitespace changes only. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250624142834.3275164-4-kuba@kernel.org Signed-off-by: Paolo Abeni commit 461bc4030dc928d7d177a77834e848f77de69258 Author: Jakub Kicinski Date: Tue Jun 24 07:28:31 2025 -0700 eth: fbnic: fix stampinn typo in a comment Fix a typo: stampinn -> stamping Signed-off-by: Jakub Kicinski Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250624142834.3275164-3-kuba@kernel.org Signed-off-by: Paolo Abeni commit f2657cfb45869d26fb341cdea9c4667eb48782cc Author: Jakub Kicinski Date: Tue Jun 24 07:28:30 2025 -0700 eth: fbnic: remove duplicate FBNIC_MAX_.XQS macros Somehow we ended up with two copies of FBNIC_MAX_[TR]XQS in fbnic_txrx.h. Remove the one mixed with the struct declarations. Signed-off-by: Jakub Kicinski Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250624142834.3275164-2-kuba@kernel.org Signed-off-by: Paolo Abeni commit a8a3bddb3aada131a4658cc36c0ea33206f61d94 Merge: a9b24b3583ae1d e02adac7c84bf2 Author: Paolo Abeni Date: Thu Jun 26 14:49:12 2025 +0200 Merge branch 'follow-up-to-rgmii-mode-clarification-am65-cpsw-fix-checkpatch' Matthias Schiffer says: ==================== Follow-up to RGMII mode clarification: am65-cpsw fix + checkpatch Following previous discussion [1] and the documentation update by Andrew [2]: Fix up the mode to account for the fixed TX delay on the AM65 CPSW Ethernet controllers, similar to the way the icssg-prueth does it. For backwards compatibility, the "impossible" modes that claim to have a delay on the PCB are still accepted, but trigger a warning message. As Andrew suggested, I have also added a checkpatch check that requires a comment for any RGMII mode that is not "rgmii-id". No Device Trees are updated to avoid the warning for now, to give other projects syncing the Linux Device Trees some time to fix their drivers as well. I intend to submit an equivalent change for U-Boot's am65-cpsw-nuss driver as soon as the changes are accepted for Linux. [1] https://lore.kernel.org/lkml/d25b1447-c28b-4998-b238-92672434dc28@lunn.ch/ [2] https://lore.kernel.org/all/20250430-v6-15-rc3-net-rgmii-delays-v2-1-099ae651d5e5@lunn.ch/ commit c360eb0c3ccb ("dt-bindings: net: ethernet-controller: Add informative text about RGMII delays") v1: https://lore.kernel.org/all/cover.1744710099.git.matthias.schiffer@ew.tq-group.com/ ==================== Link: https://patch.msgid.link/cover.1750756583.git.matthias.schiffer@ew.tq-group.com Signed-off-by: Paolo Abeni commit e02adac7c84bf2883ce5d5a828a03871c0c1d4f9 Author: Matthias Schiffer Date: Tue Jun 24 12:53:34 2025 +0200 checkpatch: check for comment explaining rgmii(|-rxid|-txid) PHY modes Historically, the RGMII PHY modes specified in Device Trees have been used inconsistently, often referring to the usage of delays on the PHY side rather than describing the board; many drivers still implement this incorrectly. Require a comment in Devices Trees using these modes (usually mentioning that the delay is realized on the PCB), so we can avoid adding more incorrect uses (or will at least notice which drivers still need to be fixed). Suggested-by: Andrew Lunn Signed-off-by: Matthias Schiffer Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/bc112b8aa510cf9df9ab33178d122f234d0aebf7.1750756583.git.matthias.schiffer@ew.tq-group.com Signed-off-by: Paolo Abeni commit ca13b249f291f4920466638d1adbfb3f9c8db6e9 Author: Matthias Schiffer Date: Tue Jun 24 12:53:33 2025 +0200 net: ethernet: ti: am65-cpsw: fixup PHY mode for fixed RGMII TX delay All am65-cpsw controllers have a fixed TX delay, so the PHY interface mode must be fixed up to account for this. Modes that claim to a delay on the PCB can't actually work. Warn people to update their Device Trees if one of the unsupported modes is specified. Signed-off-by: Matthias Schiffer Reviewed-by: Maxime Chevallier Reviewed-by: Andrew Lunn Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/9b3fb1fbf719bef30702192155c6413cd5de5dcf.1750756583.git.matthias.schiffer@ew.tq-group.com Signed-off-by: Paolo Abeni commit 9b357ea52523f935acec153cea20f7a4fe704b48 Author: Matthias Schiffer Date: Tue Jun 24 12:53:32 2025 +0200 dt-bindings: net: ti: k3-am654-cpsw-nuss: update phy-mode in example k3-am65-cpsw-nuss controllers have a fixed internal TX delay, so RXID mode is not actually possible and will result in a warning from the driver going forward. Signed-off-by: Matthias Schiffer Reviewed-by: Maxime Chevallier Reviewed-by: Andrew Lunn Acked-by: Rob Herring (Arm) Reviewed-by: Siddharth Vadapalli Link: https://patch.msgid.link/f9b5e84fcaf565506ed86cf1838444c2bc47334f.1750756583.git.matthias.schiffer@ew.tq-group.com Signed-off-by: Paolo Abeni commit f1208b05574f63c52e88109d8c75afdf4fc6bf42 Author: Mark Bloch Date: Tue Jun 17 11:44:03 2025 +0300 RDMA/ipoib: Use parent rdma device net namespace Use the net namespace of the underlying rdma device. After honoring the rdma device's namespace, the ipoib netdev now also runs in the same net namespace of the rdma device. Add an API to read the net namespace of the rdma device so that ULP such as IPoIB can use it to initialize its netdev. Signed-off-by: Parav Pandit Signed-off-by: Mark Bloch Signed-off-by: Leon Romanovsky commit 611d08207d313500d010d8792424346ce70d0cfb Author: Mark Bloch Date: Tue Jun 17 11:44:02 2025 +0300 RDMA/mlx5: Allocate IB device with net namespace supplied from core dev Use the new ib_alloc_device_with_net() API to allocate the IB device so that it is properly bound to the network namespace obtained via mlx5_core_net(). This change ensures correct namespace association (e.g., for containerized setups). Additionally, expose mlx5_core_net so that RDMA driver can use it. Signed-off-by: Shay Drory Signed-off-by: Mark Bloch Reviewed-by: Parav Pandit Signed-off-by: Leon Romanovsky commit 8cffca866ba86cbf0d097e56521b17d830956d4a Author: Mark Bloch Date: Tue Jun 17 11:44:01 2025 +0300 RDMA/core: Extend RDMA device registration to be net namespace aware Presently, RDMA devices are always registered within the init network namespace, even if the associated devlink device's namespace was changed via a devlink reload. This mismatch leads to discrepancies between the network namespace of the devlink device and that of the RDMA device. Therefore, extend the RDMA device allocation API to optionally take the net namespace. This isn't limited to devices that support devlink but allows all users to provide the network namespace if they need to do so. If a network namespace is provided during device allocation, it's up to the caller to make sure the namespace stays valid until ib_register_device() is called. Signed-off-by: Shay Drory Signed-off-by: Mark Bloch Signed-off-by: Leon Romanovsky commit 98b5dab4d22181c931f2bf63c060416badbb49ab Author: David Kaplan Date: Wed Jun 25 10:58:05 2025 -0500 x86/bugs: Clean up SRSO microcode handling SRSO microcode only exists for Zen3/Zen4 CPUs. For those CPUs, the microcode is required for any mitigation other than Safe-RET to be effective. Safe-RET can still protect user->kernel and guest->host attacks without microcode. Clarify this in the code and ensure that SRSO_MITIGATION_UCODE_NEEDED is selected for any mitigation besides Safe-RET if the required microcode isn't present. Signed-off-by: David Kaplan Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250625155805.600376-4-david.kaplan@amd.com commit a71d3e1beb7a9637eb75929b995f01d20981f013 Author: Harald Freudenberger Date: Tue Jun 17 15:44:40 2025 +0200 crypto: testmgr - Enable phmac selftest Add phmac selftest invocation to the crypto testmanager. Signed-off-by: Harald Freudenberger Acked-by: Holger Dengler Signed-off-by: Herbert Xu commit d48b2f5e82ea3888fb23659675c05f490899a293 Author: Harald Freudenberger Date: Tue Jun 17 15:44:39 2025 +0200 crypto: s390 - Add selftest support for phmac Add key preparation code in case of selftest running to the phmac setkey function: As long as crypto_ahash_tested() returns with false, all setkey() invocations are assumed to carry sheer hmac clear key values and thus need some preparation to work with the phmac implementation. Thus it is possible to use the already available hmac test vectors implemented in the testmanager to test the phmac code. When crypto_ahash_tested() returns true (that is after larval state) the phmac code assumes the key material is a blob digestible by the pkey kernel module which converts the blob into a working key for the phmac code. Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Herbert Xu commit d0da164ba63dd6ff3696c565b118631a277822c3 Author: Harald Freudenberger Date: Tue Jun 17 15:44:38 2025 +0200 crypto: ahash - Add crypto_ahash_tested() helper function Add a little inline helper function crypto_ahash_tested() to the internal/hash.h header file to retrieve the tested status (that is the CRYPTO_ALG_TESTED bit in the cra_flags). Signed-off-by: Harald Freudenberger Suggested-by: Herbert Xu Reviewed-by: Holger Dengler Signed-off-by: Herbert Xu commit cbbc675506cc4cd93e6f895e7c1f693156f9a95c Author: Harald Freudenberger Date: Tue Jun 17 15:44:37 2025 +0200 crypto: s390 - New s390 specific protected key hash phmac Add support for protected key hmac ("phmac") for s390 arch. With the latest machine generation there is now support for protected key (that is a key wrapped by a master key stored in firmware) hmac for sha2 (sha224, sha256, sha384 and sha512) for the s390 specific CPACF instruction kmac. This patch adds support via 4 new ahashes registered as phmac(sha224), phmac(sha256), phmac(sha384) and phmac(sha512). Co-developed-by: Holger Dengler Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Holger Dengler Signed-off-by: Herbert Xu commit 86ca5cb84fc339a08dfd673a50c6f3bea1b2f956 Author: Holger Dengler Date: Tue Jun 17 15:44:36 2025 +0200 s390/crypto: Add protected key hmac subfunctions for KMAC The CPACF KMAC instruction supports new subfunctions for protected key hmac. Add defines for these 4 new subfuctions. Signed-off-by: Holger Dengler Signed-off-by: Harald Freudenberger Reviewed-by: Holger Dengler Signed-off-by: Herbert Xu commit 2f8839e6c5f8e200629fd730aac5dd874c1d2544 Author: Harald Freudenberger Date: Tue Jun 17 15:44:35 2025 +0200 crypto: ahash - make hash walk functions from ahash.c public Make the hash walk functions crypto_hash_walk_done() crypto_hash_walk_first() crypto_hash_walk_last() public again. These functions had been removed from the header file include/crypto/internal/hash.h with commit 7fa481734016 ("crypto: ahash - make hash walk functions private to ahash.c") as there was no crypto algorithm code using them. With the upcoming crypto implementation for s390 phmac these functions will be exploited and thus need to be public within the kernel again. Signed-off-by: Harald Freudenberger Acked-by: Holger Dengler Signed-off-by: Herbert Xu commit 7246e092994556ccfef39f7d3a7cbecdedddc3ad Author: Aradhya Bhatia Date: Wed May 28 17:55:44 2025 +0530 drm/tidss: Add OLDI bridge support The AM62x and AM62Px SoCs feature 2 OLDI TXes each, which makes it possible to connect them in dual-link or cloned single-link OLDI display modes. The current OLDI support in tidss_dispc.c can only support for a single OLDI TX, connected to a VP and doesn't really support configuration of OLDIs in the other modes. The current OLDI support in tidss_dispc.c also works on the principle that the OLDI output can only be served by one, and only one, DSS video-port. This isn't the case in the AM62Px SoC, where there are 2 DSS controllers present that share the OLDI TXes. Having their own devicetree and their own bridge entity will help support the various display modes and sharing possiblilities of the OLDI hardware. For all these reasons, add support for the OLDI TXes as DRM bridges. Signed-off-by: Aradhya Bhatia Signed-off-by: Aradhya Bhatia Tested-by: Michael Walle # on am67a Reviewed-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20250528122544.817829-5-aradhya.bhatia@linux.dev Signed-off-by: Tomi Valkeinen commit d18bf71253c58bd9de8314896e5acf368eba36dc Author: Aradhya Bhatia Date: Wed May 28 17:55:43 2025 +0530 drm/tidss: Mark AM65x OLDI code separately The dss dt schema and the tidss driver have kept the single-link OLDI in AM65x integrated with the parent video-port (VP) from DSS (as the OLDI configuration happens from the source VP only). To help configure the dual-lvds modes that the OLDI has to offer in devices AM62x and later, a new OLDI bridge driver will be introduced. Mark the existing OLDI code separately by renaming all the current OLDI identifiers with the 'AM65X_' prefix in tidss driver, to help distinguish from the upcoming OLDI bridge driver. Reviewed-by: Tomi Valkeinen Signed-off-by: Aradhya Bhatia Link: https://lore.kernel.org/r/20250528122544.817829-4-aradhya.bhatia@linux.dev Signed-off-by: Tomi Valkeinen commit 90090f49f18f2e3884406c1a1390761ec0f27e80 Author: Aradhya Bhatia Date: Wed May 28 17:55:42 2025 +0530 dt-bindings: display: ti: Add schema for AM625 OLDI Transmitter The OLDI transmitters (TXes) do not have registers of their own, and are dependent on the source video-ports (VPs) from the DSS to provide configuration data. This hardware doesn't directly sit on the internal bus of the SoC, but does so via the DSS. Hence, the OLDI TXes are supposed to be child nodes under the DSS, and not independent devices. Two of the OLDI TXes can function in tandem to output dual-link OLDI output, or cloned single-link outputs. In these cases, one OLDI will be the primary OLDI, and the other one, a companion. The following diagram represents such a configuration. +-----+-----+ +-------+ | | | | | | | VP1 +----+--->+ OLDI0 | (Primary - may need companion) | | | | | | | DSS +-----+ | +-------+ | | | | | | VP2 | | +-------+ | | | | | | +-----+-----+ +--->+ OLDI1 | (Companion OLDI) | | +-------+ The DSS in AM625 SoC has a configuration like the one above. The AM625 DSS VP1 (port@0) can connect and control 2 OLDI TXes, to use them in dual-link or cloned single-link OLDI modes. It is only the VP1 that can connect to either OLDI TXes for the AM625 DSS, and not the VP2. Alternatively, on some future TI SoCs, along with the above configuration, the OLDI TX can _also_ connect to separate video sources, making them work entirely independent of each other. In this case, neither of the OLDIs are "companion" or "secondary" OLDIs, and nor do they require one. They both are independent and primary OLDIs. The following diagram represents such a configuration. +-----+-----+ +-------+ | | | | | | | VP1 +--+----------->+ OLDI0 | (Primary - may need companion) | | | | | | | +-----+ | +-------+ | | | | | | VP2 | | | | | | | DSS +-----+ | +---+ +-------+ | | | +-->+ M | | | | | VP3 +----->+ U +--->+ OLDI1 | (Companion or Primary) | | | | X | | | | +-----+ +---+ +-------+ | | | | | VP4 | | | | +-----+-----+ Note that depending on the mux configuration, the OLDIs can either be working together in tandem - sourced by VP1, OR, they could be working independently sourced by VP1 and VP3 respectively. The idea is to support all the configurations with this OLDI TX schema. The OLDI functionality is further supported by a system-control module, which contains a few registers to control OLDI IO power and other electrical characteristics of the IO lanes. Add devicetree binding schema for the OLDI TXes to support various configurations, and extend their support to the AM625 DSS. Signed-off-by: Aradhya Bhatia Signed-off-by: Aradhya Bhatia Reviewed-by: "Rob Herring (Arm)" Reviewed-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20250528122544.817829-3-aradhya.bhatia@linux.dev Signed-off-by: Tomi Valkeinen commit adc8f6ff0e82b04007b275842515f69427bce853 Author: Aradhya Bhatia Date: Wed May 28 17:55:41 2025 +0530 dt-bindings: display: ti,am65x-dss: Re-indent the example Reduce tab size from 8 spaces to 4 spaces to make the bindings consistent, and easy to expand. Acked-by: "Rob Herring (Arm)" Reviewed-by: Laurent Pinchart Reviewed-by: Tomi Valkeinen Signed-off-by: Aradhya Bhatia Signed-off-by: Aradhya Bhatia Link: https://lore.kernel.org/r/20250528122544.817829-2-aradhya.bhatia@linux.dev Signed-off-by: Tomi Valkeinen commit 7c377900772d8f9b47d434e1e4c021fdf8547635 Author: Luca Coelho Date: Fri Jun 20 12:15:30 2025 +0300 drm/i915/display: move unordered works to new private workqueue Create a new unordered workqueue to be used by the display code instead of relying on the i915 one. Then move all the unordered works used in the display code to use this new queue. Since this is an unordered workqueue, by definition there can't be any order dependency with non-display works, so no extra care is needed in regard to that. This is part of the effort to isolate the display code from i915. Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250620091632.1256135-1-luciano.coelho@intel.com Signed-off-by: Luca Coelho commit 19564a8576ac847ec981207292b500efbbbfaf7b Author: Dan Carpenter Date: Wed Jun 25 10:22:23 2025 -0500 RDMA/rxe: Fix a couple IS_ERR() vs NULL bugs The lookup_mr() function returns NULL on error. It never returns error pointers. Fixes: 9284bc34c773 ("RDMA/rxe: Enable asynchronous prefetch for ODP MRs") Fixes: 3576b0df1588 ("RDMA/rxe: Implement synchronous prefetch for ODP MRs") Signed-off-by: Dan Carpenter Link: https://patch.msgid.link/685c1430.050a0220.18b0ef.da83@mx.google.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 12423d8e18f301c5707173c83f8fb8bf33ed7c67 Author: Arnd Bergmann Date: Fri Jun 20 13:43:28 2025 +0200 RDMA/siw: work around clang stack size warning clang inlines a lot of functions into siw_qp_sq_process(), with the aggregate stack frame blowing the warning limit in some configurations: drivers/infiniband/sw/siw/siw_qp_tx.c:1014:5: error: stack frame size (1544) exceeds limit (1280) in 'siw_qp_sq_process' [-Werror,-Wframe-larger-than] The real problem here is the array of kvec structures in siw_tx_hdt that makes up the majority of the consumed stack space. Ideally there would be a way to avoid allocating the array on the stack, but that would require a larger rework. Add a noinline_for_stack annotation to avoid the warning for now, and make clang behave the same way as gcc here. The combined stack usage is still similar, but is spread over multiple functions now. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250620114332.4072051-1-arnd@kernel.org Reviewed-by: Zhu Yanjun Acked-by: Bernard Metzler Signed-off-by: Leon Romanovsky commit b61cc1891c040f72ee3038ef123d76fe874bd93a Author: Yury Norov [NVIDIA] Date: Wed Jun 4 15:39:43 2025 -0400 RDMI: hfi1: drop cpumask_empty() call in hfi1/affinity.c In few places, the driver tests a cpumask for emptiness immediately before calling functions that report emptiness themself. Signed-off-by: Yury Norov [NVIDIA] Link: https://patch.msgid.link/20250604193947.11834-8-yury.norov@gmail.com Signed-off-by: Leon Romanovsky commit 3ad8fb8afd843a4e3380690ed7b9822d9cf26d76 Author: Yury Norov [NVIDIA] Date: Wed Jun 4 15:39:42 2025 -0400 RDMA: hfi1: simplify hfi1_get_proc_affinity() The function protects the for loop with affinity->num_core_siblings > 0 condition, which is redundant because the loop will break immediately in that case. Drop it and save one indentation level. Signed-off-by: Yury Norov [NVIDIA] Link: https://patch.msgid.link/20250604193947.11834-7-yury.norov@gmail.com Signed-off-by: Leon Romanovsky commit 4ea9f618d73466234eeadf78c3a054d086c916af Author: Yury Norov [NVIDIA] Date: Wed Jun 4 15:39:41 2025 -0400 RDMA: hfi1: use rounddown in find_hw_thread_mask() num_cores_per_socket is calculated by dividing by node_affinity.num_online_nodes, but all users of this variable multiply it by node_affinity.num_online_nodes again. This effectively is the same as rounding it down by node_affinity.num_online_nodes. Signed-off-by: Yury Norov [NVIDIA] Link: https://patch.msgid.link/20250604193947.11834-6-yury.norov@gmail.com Signed-off-by: Leon Romanovsky commit 59ae2e3c6ad798072adbe9429534092fd471592c Author: Yury Norov [NVIDIA] Date: Wed Jun 4 15:39:40 2025 -0400 RDMA: hfi1: simplify init_real_cpu_mask() The function opencodes cpumask_nth() and cpumask_clear_cpus(). The dedicated helpers are easier to use and usually much faster than opencoded for-loops. While there, drop useless clear of real_cpu_mask. Signed-off-by: Yury Norov [NVIDIA] Link: https://patch.msgid.link/20250604193947.11834-5-yury.norov@gmail.com Signed-off-by: Leon Romanovsky commit 15b0536313045c3fdd374b99f747b15278ac8895 Author: Yury Norov [NVIDIA] Date: Wed Jun 4 15:39:39 2025 -0400 RDMA: hfi1: simplify find_hw_thread_mask() The function opencodes cpumask_nth() and cpumask_clear_cpus(). The dedicated helpers are easier to use and usually much faster than opencoded for-loops. Signed-off-by: Yury Norov [NVIDIA] Link: https://patch.msgid.link/20250604193947.11834-4-yury.norov@gmail.com Signed-off-by: Leon Romanovsky commit 59f7d2138591ef8f0e4e4ab5f1ab674e8181ad3a Author: Yury Norov [NVIDIA] Date: Wed Jun 4 15:39:38 2025 -0400 RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() The function divides number of online CPUs by num_core_siblings, and later checks the divider by zero. This implies a possibility to get and divide-by-zero runtime error. Fix it by moving the check prior to division. This also helps to save one indentation level. Signed-off-by: Yury Norov [NVIDIA] Link: https://patch.msgid.link/20250604193947.11834-3-yury.norov@gmail.com Signed-off-by: Leon Romanovsky commit 16e2707cf15e09234445d40ddd76f11240be8767 Author: Yury Norov [NVIDIA] Date: Wed Jun 4 15:39:37 2025 -0400 cpumask: add cpumask_clear_cpus() When user wants to clear a range in cpumask, the only option the API provides now is a for-loop, like: for_each_cpu_from(cpu, mask) { if (cpu >= ncpus) break; __cpumask_clear_cpu(cpu, mask); } In the bitmap API we have bitmap_clear() for that, which is significantly faster than a for-loop. Propagate it to cpumasks. Signed-off-by: Yury Norov [NVIDIA] Link: https://patch.msgid.link/20250604193947.11834-2-yury.norov@gmail.com Signed-off-by: Leon Romanovsky commit ff54ae7314962699749869a3475da7a702ae991a Author: David Kaplan Date: Wed Jun 25 10:58:04 2025 -0500 x86/bugs: Use IBPB for retbleed if used by SRSO If spec_rstack_overflow=ibpb then this mitigates retbleed as well. This is relevant for AMD Zen1 and Zen2 CPUs which are vulnerable to both bugs. Signed-off-by: David Kaplan Signed-off-by: Ingo Molnar Reviewed-by: Borislav Petkov (AMD) Cc: H . Peter Anvin Cc: Dave Hansen Cc: Josh Poimboeuf Cc: Pawan Gupta Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250625155805.600376-3-david.kaplan@amd.com commit 1fd5eb02867ac7db9144bd44c8edfad0189c8e57 Author: David Kaplan Date: Wed Jun 25 10:58:03 2025 -0500 x86/bugs: Add SRSO_MITIGATION_NOSMT AMD Zen1 and Zen2 CPUs with SMT disabled are not vulnerable to SRSO. Instead of overloading the X86_FEATURE_SRSO_NO bit to indicate this, define a separate mitigation to make the code cleaner. Signed-off-by: David Kaplan Signed-off-by: Ingo Molnar Reviewed-by: Borislav Petkov (AMD) Cc: H . Peter Anvin Cc: Dave Hansen Cc: Josh Poimboeuf Cc: Pawan Gupta Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250625155805.600376-2-david.kaplan@amd.com commit 9807aba1ea9d02b400b0b88617d6121bfa17a7e0 Author: Jani Nikula Date: Wed Jun 25 13:32:34 2025 +0300 drm/i915/cdclk: make struct intel_cdclk_state opaque With all the code touching struct intel_cdclk_state moved inside intel_cdclk.c, we move the struct definition there too, and make the type opaque. This nicely reduces includes from intel_cdclk.h. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/2b58c52e8cbcb66a48ecd4a1453e49dc7bd66289.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 79be2da5d1af01490f1d9850830e2baba32dfddb Author: Jani Nikula Date: Wed Jun 25 13:32:33 2025 +0300 drm/i915/cdclk: abstract intel_cdclk_actual() and intel_cdclk_actual_voltage_level() Add intel_cdclk_actual() and intel_cdclk_actual_voltage_level() helpers to avoid looking at struct intel_cdclk_state internals outside of intel_cdclk.c. v2: Better location (Imre) Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/241a9b80a8262b82fded54707ca5622af215dd86.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit f0bb81b275f7ce35b4c5d2f847260703255e46ce Author: Jani Nikula Date: Wed Jun 25 13:32:32 2025 +0300 drm/i915/cdclk: abstract intel_cdclk_read_hw() Add intel_cdclk_read_hw() function to avoid looking at struct intel_cdclk_state internals outside of intel_cdclk.c. intel_cdclk_init_hw() would be a better name, but we already have that. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/ef720d37bfeee933d59b64e382dc976f3c9fade1.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 082fe699afbdb1aaf384a2c28710dc7dec69b767 Author: Jani Nikula Date: Wed Jun 25 13:32:31 2025 +0300 drm/i915/cdclk: abstract intel_cdclk_force_min_cdclk() Add intel_cdclk_force_min_cdclk() helper to avoid modifying struct intel_cdclk_state internals outside of intel_cdclk.c. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/0bf8a94a1a7d3ac564406ba427d12c4c8eefb5bb.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit f6d8b2261ad996db784211835a980396664bc9ae Author: Jani Nikula Date: Wed Jun 25 13:32:30 2025 +0300 drm/i915/cdclk: abstract intel_cdclk_pmdemand_needs_update() Add intel_cdclk_pmdemand_needs_update() helper to avoid looking at struct intel_cdclk_state internals outside of intel_cdclk.c. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/d0d4f073707a2badb432187f6e02d6d7f9fe431b.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 3fda3bf0a67f10e5ce8ce406d303f7ee92bed0d1 Author: Jani Nikula Date: Wed Jun 25 13:32:29 2025 +0300 drm/i915/cdclk: abstract intel_cdclk_bw_min_cdclk() Add intel_cdclk_bw_min_cdclk() helper to avoid looking at struct intel_cdclk_state internals outside of intel_cdclk.c. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/d07499174ebe55fa8fb98d4cb5ff541b6f5ec95b.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit d93ea1d8f1b640ef2742134d3bc7a7dd6e46d9e5 Author: Jani Nikula Date: Wed Jun 25 13:32:28 2025 +0300 drm/i915/cdclk: abstract intel_cdclk_min_cdclk() Add intel_cdclk_min_cdclk() helper to avoid looking at struct intel_cdclk_state internals outside of intel_cdclk.c. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/af768e7fc32d8fa8ddcbbe2683266c30ae3b925d.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 59406bdd3f51b0abcafcb894234aac231f42fedb Author: Jani Nikula Date: Wed Jun 25 13:32:27 2025 +0300 drm/i915/cdclk: abstract intel_cdclk_logical() Add intel_cdclk_logical() helper to avoid looking at struct intel_cdclk_state internals outside of intel_cdclk.c. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/e965667550e82307341d6abbeedc67b93cae9fc6.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit d7ecd05da71e2328a93c33fbc1c2611babe83ab1 Author: Jani Nikula Date: Wed Jun 25 13:32:26 2025 +0300 drm/i915/bw: make struct intel_bw_state opaque With all the code touching struct intel_bw_state moved inside intel_bw.c, we move the struct definition there too, and make the type opaque. to_intel_bw_state() needs to be turned into a proper function. All of this nicely reduces includes from intel_bw.h. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/743ba67e4e3c5dac4f5e58ab4d2357edea601d09.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 2e5822368c07316d66fe016c46bbc8e50d7b7203 Author: Jani Nikula Date: Wed Jun 25 13:32:25 2025 +0300 drm/i915/bw: abstract intel_bw_qgv_point_peakbw() Add intel_bw_qgv_point_peakbw() helper to avoid looking at struct intel_bw_state internals outside of intel_bw.c. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/49a723e0f23e06a6045f8f9e0d06648a6bc899c7.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 999058152a14650b9930eccc4ae31a2238195ee8 Author: Jani Nikula Date: Wed Jun 25 13:32:24 2025 +0300 drm/i915: move icl_sagv_{pre, post}_plane_update() to intel_bw.c Prefer only looking at struct intel_bw_state internals inside intel_bw.c. To that effect, move icl_sagv_{pre,post}_plane_update() there. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/dedcbeb3389ecd50195aa37de75e9992fae5d197.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 4822cb81a7e1982dfa5450c304c2d37ab180d5df Author: Jani Nikula Date: Wed Jun 25 13:32:23 2025 +0300 drm/i915/bw: relocate intel_can_enable_sagv() and rename to intel_bw_can_enable_sagv() Prefer only looking at struct intel_bw_state internals inside intel_bw.c. To that effect, move intel_can_enable_sagv() there, and rename to intel_bw_can_enable_sagv() to have consistent naming. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/dd6e3857bd1343c07a36826e99c1c04f7dd5ddb5.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit e17643d07553fabac00c66006a48652172a50b7c Author: Jani Nikula Date: Wed Jun 25 13:32:22 2025 +0300 drm/i915/bw: abstract intel_bw_pmdemand_needs_update() Add intel_bw_pmdemand_needs_update() helper to avoid looking at struct intel_bw_state internals outside of intel_bw.c. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/163fda39da2e1cf0f0c4fcb9c71103c98863179e.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit d1b8a4dc0907e5d78f05783a707da0209f83e3a5 Author: Jani Nikula Date: Wed Jun 25 13:32:21 2025 +0300 drm/i915/wm: make struct intel_dbuf_state opaque type With all the code touching struct intel_dbuf_state moved inside skl_watermark.c, we move the struct definition there too, and make the type opaque. This nicely reduces includes from skl_watermark.h. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/83ae5f022a1d6d83c031e5c079b04dc739102565.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 3a34fd6de47908a9d4e830ec6063397b4bfc1bac Author: Jani Nikula Date: Wed Jun 25 13:32:20 2025 +0300 drm/i915/wm: add more accessors to dbuf state Add intel_dbuf_num_enabled_slices() and intel_dbuf_num_active_pipes() helpers to avoid looking at struct intel_dbuf_state internals outside of skl_watermark.c. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/7d555e7b4e93632b732b8b5a3cd4076baf781bee.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 70349f275f2aecd1a9ff9440182b24defe8a5e77 Author: Jani Nikula Date: Wed Jun 25 13:32:19 2025 +0300 drm/i915/wm: abstract intel_dbuf_pmdemand_needs_update() Add intel_dbuf_pmdemand_needs_update() helper to avoid looking at struct intel_dbuf_state internals outside of skl_watermark.c. With this, we can also move to_intel_dbuf_state(), intel_atomic_get_old_dbuf_state(), and intel_atomic_get_new_dbuf_state() inside skl_watermark.c. Reviewed-by: Imre Deak Link: https://lore.kernel.org/r/b493f259d0d3db047151fee18d7e801ad469fa88.1750847509.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 3315e39e5639ac770782b658e499d45f68ea7d82 Author: Geert Uytterhoeven Date: Wed Jun 25 10:05:47 2025 +0200 gpio: rcar: Use new line value setter callbacks struct gpio_chip now has callbacks for setting line values that return integers, so they can indicate failures. Convert the driver to using them. Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/f09a0481fc0ddafb9aa05d903fbb42ef52332c03.1750838486.git.geert+renesas@glider.be Signed-off-by: Bartosz Golaszewski commit 28a9ab01f6ac87afb78cb18098bc37a74db0d8f0 Author: Geert Uytterhoeven Date: Wed Jun 25 10:05:46 2025 +0200 gpio: rcar: Remove checks for empty bankmasks The GPIO core never passes empty bankmasks to the callbacks for handling multiple signals at once. Remove the superfluous checks, and refactor the code. Signed-off-by: Geert Uytterhoeven Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/29fb200d3f92e79cdd5ce4048d2847c265f337b4.1750838486.git.geert+renesas@glider.be Signed-off-by: Bartosz Golaszewski commit fe43a89b057b259c13e8347016791f2a1802debb Author: Jani Nikula Date: Wed Jun 25 16:21:40 2025 +0300 drm/i915: remove unused DISPLAY_PLANE_FLIP_PENDING() macro DISPLAY_PLANE_FLIP_PENDING() has been unused since commit fd3a40242e87 ("drm/i915: Rip out legacy page_flip completion/irq handling"). Remove. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250625132140.1564473-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit abba0c4845ea110a10b4f0dec5351fef17aaa4be Author: Parth Pancholi Date: Tue May 13 17:21:55 2025 +0200 arm64: dts: ti: k3-j784s4-j742s2-main-common: Add ACSPCIE1 node The ACSPCIE1 module on TI's J784S4 SoC is capable of driving the reference clock required by the PCIe Endpoint device. It is an alternative to on- board and external reference clock generators. Add the device-tree node for the same. Signed-off-by: Parth Pancholi Link: https://lore.kernel.org/r/20250513152155.1590689-1-parth105105@gmail.com Signed-off-by: Vignesh Raghavendra commit 65ba2a6e77e9e5c843a591055789050e77b5c65e Author: Siddharth Vadapalli Date: Mon Jun 23 15:36:57 2025 +0530 arm64: dts: ti: k3-j722s-evm: Fix USB gpio-hog level for Type-C According to the "GPIO Expander Map / Table" section of the J722S EVM Schematic within the Evaluation Module Design Files package [0], the GPIO Pin P05 located on the GPIO Expander 1 (I2C0/0x23) has to be pulled down to select the Type-C interface. Since commit under Fixes claims to enable the Type-C interface, update the property within "p05-hog" from "output-high" to "output-low", thereby switching from the Type-A interface to the Type-C interface. [0]: https://www.ti.com/lit/zip/sprr495 Cc: stable@vger.kernel.org Fixes: 485705df5d5f ("arm64: dts: ti: k3-j722s: Enable PCIe and USB support on J722S-EVM") Signed-off-by: Siddharth Vadapalli Link: https://lore.kernel.org/r/20250623100657.4082031-1-s-vadapalli@ti.com Signed-off-by: Vignesh Raghavendra commit d1b6b7cb65dd7a06f6c9b9115e88bef50e42a3ea Author: Nemesa Garg Date: Wed Jun 25 13:19:11 2025 +0530 drm/i915/display: Implement wa_16011342517 While doing voltage swing for type-c phy for DP 1.62 and HDMI write the LOADGEN_SHARING_PMD_DISABLE bit to 1. -v2: Update commit. Add bspec[Suraj] -v3: Move w/a before DKL_TX_PMD_LANE_SUS. Use DKL_TX_DPCNTL2[Ville] -v4: Use intel_encoder_is_dp and intel_encoder_is_hdmi. [Suraj] Bspec: 55359 Signed-off-by: Nemesa Garg Reviewed-by: Suraj Kandpal Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250625074911.194085-1-nemesa.garg@intel.com commit 41de3cec07883dfd891544ef891d5beb6185e362 Author: Arun R Murthy Date: Tue Jun 24 12:24:58 2025 +0530 drm/i915/panel: register drm_panel and call prepare/unprepare for eDP Allocate and register drm_panel to allow the panel_follower framework to detect the eDP panel and pass drm_connector::kdev device to drm_panel allocation for matching. Call drm_panel_prepare/unprepare in ddi_enable for eDP to allow the followers to get notified of the panel power state changes. Note: This is for eDP with DDI platforms only. v2: remove backlight setup from panel_register (Jani) v3: Updated the commit message (Jani) Signed-off-by: Arun R Murthy Reviewed-by: Jani Nikula Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250624-edp_panel-v3-1-e8197b6d9fde@intel.com commit fa13f1d7c71423a53234c03771fde47f0743a2ef Author: Herbert Xu Date: Mon Jun 23 19:17:27 2025 +0800 crypto: aspeed - Fix hash fallback path typo Fix typo in the fallback code path. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506231830.us4hiwlZ-lkp@intel.com/ Signed-off-by: Herbert Xu commit a9b24b3583ae1da7dbda031f141264f2da260219 Author: Daniel Braunwarth Date: Tue Jun 24 16:17:33 2025 +0200 net: phy: realtek: add error handling to rtl8211f_get_wol We should check if the WOL settings was successfully read from the PHY. In case this fails we cannot just use the error code and proceed. Signed-off-by: Daniel Braunwarth Reported-by: Jon Hunter Closes: https://lore.kernel.org/baaa083b-9a69-460f-ab35-2a7cb3246ffd@nvidia.com Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250624-realtek_fixes-v1-1-02a0b7c369bc@kuka.com Signed-off-by: Jakub Kicinski commit f6fa45d67e0546c114063c8b0acff48a0924738d Author: Yue Haibing Date: Tue Jun 24 22:01:59 2025 +0800 net: Reoder rxq_idx check in __net_mp_open_rxq() array_index_nospec() clamp the rxq_idx within the range of [0, dev->real_num_rx_queues), move the check before it. Signed-off-by: Yue Haibing Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250624140159.3929503-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 3b3ccf9ed05e0650273e7086f4d8f495e4b2c850 Author: Yue Haibing Date: Tue Jun 24 22:00:15 2025 +0800 net: Remove unnecessary NULL check for lwtunnel_fill_encap() lwtunnel_fill_encap() has NULL check and return 0, so no need to check before call it. Signed-off-by: Yue Haibing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250624140015.3929241-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 473734e086ccdd50af9d0abf81c0b70085dcf625 Author: Jonathan Corbet Date: Wed Jun 25 17:19:40 2025 -0600 docs: kdoc: rework process_export() slightly Reorganize process_export() to eliminate duplicated code, don't look for exports in states where we don't expect them, and don't bother with normal state-machine processing if an export declaration has been found. Signed-off-by: Jonathan Corbet commit 1cec9ac2d071cfd2da562241aab0ef701355762a Author: Dave Hansen Date: Tue Jun 24 14:01:48 2025 -0700 x86/fpu: Delay instruction pointer fixup until after warning Right now, if XRSTOR fails a console message like this is be printed: Bad FPU state detected at restore_fpregs_from_fpstate+0x9a/0x170, reinitializing FPU registers. However, the text location (...+0x9a in this case) is the instruction *AFTER* the XRSTOR. The highlighted instruction in the "Code:" dump also points one instruction late. The reason is that the "fixup" moves RIP up to pass the bad XRSTOR and keep on running after returning from the #GP handler. But it does this fixup before warning. The resulting warning output is nonsensical because it looks like the non-FPU-related instruction is #GP'ing. Do not fix up RIP until after printing the warning. Do this by using the more generic and standard ex_handler_default(). Fixes: d5c8028b4788 ("x86/fpu: Reinitialize FPU registers if restoring FPU state fails") Signed-off-by: Dave Hansen Reviewed-by: Chao Gao Acked-by: Alison Schofield Acked-by: Peter Zijlstra (Intel) Cc:stable@vger.kernel.org Link: https://lore.kernel.org/all/20250624210148.97126F9E%40davehans-spike.ostc.intel.com commit 4ecf83741401c70d4420588ee1f3b1ca04ef58d5 Author: Jake Hillion Date: Wed Jun 25 18:05:46 2025 +0100 sched_ext: Drop kfuncs marked for removal in 6.15 sched_ext performed a kfunc renaming pass in 6.13 and kept the old names around for compatibility with old binaries. These were scheduled for cleanup in 6.15 but were missed. Submitting for cleanup in for-next. Removed the kfuncs, their flags, and any references I could find to them in doc comments. Left the entries in include/scx/compat.bpf.h as they're still useful to make new binaries compatible with old kernels. Tested by applying to my kernel. It builds and a modern version of scx_lavd loads fine. Signed-off-by: Jake Hillion Signed-off-by: Tejun Heo commit f61e404f5b6124905025dbda58afa1fd3171100f Author: Jonathan Corbet Date: Wed Jun 25 16:58:55 2025 -0600 docs: kdoc: remove KernelEntry::function This member is unused, to take it out. Signed-off-by: Jonathan Corbet commit 1550a409e778673a63a6957718b802050f98359a Author: Jonathan Corbet Date: Wed Jun 25 15:43:37 2025 -0600 docs: kdoc: remove a bit of dead code The type_param regex matches "@..." just fine, so the special-case branch for that in dump_section() is never executed. Just remove it. Signed-off-by: Jonathan Corbet commit d6699d5f601670176bd03f95d1680914bd65b2a9 Author: Jonathan Corbet Date: Wed Jun 25 14:51:11 2025 -0600 docs: kdoc: Move content handling into KernelEntry Rather than having other code mucking around with this bit of internal state, encapsulate it internally. Accumulate the description as a list of strings, joining them at the end, which is a more efficient way of building the text. Signed-off-by: Jonathan Corbet commit 2855e43c6bb154a9b8e27abda8df364aed574b22 Author: RubenKelevra Date: Tue Jun 24 18:57:11 2025 +0200 uapi: net_dropmon: drop unused is_drop_point_hw macro Commit 4ea7e38696c7 ("dropmon: add ability to detect when hardware drops rx packets") introduced is_drop_point_hw, but the symbol was never referenced anywhere in the kernel tree and is currently not used by dropwatch. I could not find, to the best of my abilities, a current out-of-tree user of this macro. The definition also contains a syntax error in its for-loop, so any project that tried to compile against it would fail. Removing the macro therefore eliminates dead code without breaking existing users. Signed-off-by: RubenKelevra Link: https://patch.msgid.link/20250624165711.1188691-1-rubenkelevra@gmail.com Signed-off-by: Jakub Kicinski commit 8bd0af3154b2206ce19f8b1410339f7a2a56d0c3 Author: Nathan Lynch Date: Tue Jun 24 08:50:44 2025 -0500 lib: packing: Include necessary headers packing.h uses ARRAY_SIZE(), BUILD_BUG_ON_MSG(), min(), max(), and sizeof_field() without including the headers where they are defined, potentially causing build failures. Fix this in packing.h and sort the result. Signed-off-by: Nathan Lynch Reviewed-by: Vladimir Oltean Link: https://patch.msgid.link/20250624-packing-includes-v1-1-c23c81fab508@amd.com Signed-off-by: Jakub Kicinski commit 4b70e2a069d90cdc447c6bf8437c8b99345852e9 Author: Yue Haibing Date: Tue Jun 24 09:43:27 2025 +0800 net/sched: Remove unused functions Since commit c54e1d920f04 ("flow_offload: add ops to tc_action_ops for flow action setup") these are unused. Signed-off-by: Yue Haibing Acked-by: Cong Wang Link: https://patch.msgid.link/20250624014327.3686873-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit 9b19b50c8d65e06d4ff7f230855a2a28ac200f35 Author: Yue Haibing Date: Tue Jun 24 09:42:16 2025 +0800 neighbour: Remove redundant assignment to err 'err' has been checked against 0 in the if statement. Signed-off-by: Yue Haibing Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250624014216.3686659-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit b48d353d24d92dce2ea31aa248e2584980f7c989 Merge: bfb4fb77f9a8ce 4d13c6c449af37 Author: Jakub Kicinski Date: Wed Jun 25 15:24:16 2025 -0700 Merge branch 'net-ethtool-rss-add-notifications' Jakub Kicinski says: ==================== net: ethtool: rss: add notifications Next step on the path to moving RSS config to Netlink. With the refactoring of the driver-facing API for ETHTOOL_GRXFH/ETHTOOL_SRXFH out of the way we can move on to more interesting work. Add Netlink notifications for changes in RSS configuration. As a reminder (part) of rss-get was introduced in previous releases when input-xfrm (symmetric hashing) was added. rss-set isn't implemented, yet, but we can implement rss-ntf and hook it into the changes done via the IOCTL path (same as other ethtool-nl notifications do). Most of the series is concerned with passing arguments to notifications. So far none of the notifications needed to be parametrized, but RSS can have multiple contexts per device, and since GET operates on a single context at a time, the notification needs to also be scoped to a context. Patches 2-5 add support for passing arguments to notifications thru ethtool-nl generic infra. The notification handling itself is pretty trivial, it's mostly hooking in the right entries into the ethool-nl op tables. v1: https://lore.kernel.org/20250621171944.2619249-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250623231720.3124717-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4d13c6c449af374fbcd0580764a216668d970d26 Author: Jakub Kicinski Date: Mon Jun 23 16:17:20 2025 -0700 selftests: drv-net: test RSS Netlink notifications Test that changing the RSS config generates Netlink notifications. # ./tools/testing/selftests/drivers/net/hw/rss_api.py TAP version 13 1..2 ok 1 rss_api.test_rxfh_indir_ntf ok 2 rss_api.test_rxfh_indir_ctx_ntf # Totals: pass:2 fail:0 xfail:0 xpass:0 skip:0 error:0 Link: https://patch.msgid.link/20250623231720.3124717-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 47c3ed01af43784ef8ef4af96d35da464770b3f5 Author: Jakub Kicinski Date: Mon Jun 23 16:17:19 2025 -0700 doc: ethtool: mark ETHTOOL_GRXFHINDIR as reimplemented The ETHTOOL_GRXFHINDIR reimplementation has been completed around a year ago. We have been tweaking it so a bit hard to point to a single commit that completed it, but all the fields available in IOCTL are reported via Netlink. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250623231720.3124717-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 46837be5afc6ea70bc827ca4439410e069e2ee37 Author: Jakub Kicinski Date: Mon Jun 23 16:17:18 2025 -0700 net: ethtool: rss: add notifications In preparation for RSS_SET handling in ethnl introduce Netlink notifications for RSS. Only cover modifications, not creation and not removal of a context, because the latter may deserve a different notification type. We should cross that bridge when we add the support for context add / remove via Netlink. Link: https://patch.msgid.link/20250623231720.3124717-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3073947de382a27d8621be31594cb694b3a83f43 Author: Jakub Kicinski Date: Mon Jun 23 16:17:17 2025 -0700 net: ethtool: copy req_info from SET to NTF Copy information parsed for SET with .req_parse to NTF handling and therefore the GET-equivalent that it ends up executing. This way if the SET was on a sub-object (like RSS context) the notification will also be appropriately scoped. Also copy the phy_index, Maxime suggests this will help PLCA commands generate accurate notifications as well. Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/20250623231720.3124717-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f9dc3e52d821dc1f9afeec43fb1c18ac94bd587a Author: Jakub Kicinski Date: Mon Jun 23 16:17:16 2025 -0700 net: ethtool: remove the data argument from ethtool_notify() ethtool_notify() takes a const void *data argument, which presumably was intended to pass information from the call site to the subcommand handler. This argument currently has no users. Expecting the data to be subcommand-specific has two complications. Complication #1 is that its not plumbed thru any of the standardized callbacks. It gets propagated to ethnl_default_notify() where it remains unused. Coming from the ethnl_default_set_doit() side we pass in NULL, because how could we have a command specific attribute in a generic handler. Complication #2 is that we expect the ethtool_notify() callers to know what attribute type to pass in. Again, the data pointer is untyped. RSS will need to pass the context ID to the notifications. I think it's a better design if the "subcommand" exports its own typed interface and constructs the appropriate argument struct (which will be req_info). Remove the unused data argument from ethtool_notify() but retain it in a new internal helper which subcommands can use to build a typed interface. Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/20250623231720.3124717-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 963781bdfe2007e062e05b6b8a263ae9340bd523 Author: Jakub Kicinski Date: Mon Jun 23 16:17:15 2025 -0700 net: ethtool: call .parse_request for SET handlers In preparation for using req_info to carry parameters between SET and NTF - call .parse_request during ethnl_default_set_doit(). The main question here is whether .parse_request is intended to be GET-specific. Originally the SET handling was delegated to each subcommand directly - ethnl_default_set_doit() and .set callbacks in ethnl_request_ops did not exist. Looking at existing users does not shed much light, all of the following subcommands use .parse_request but have no SET handler (and no NTF): net/ethtool/eeprom.c net/ethtool/rss.c net/ethtool/stats.c net/ethtool/strset.c net/ethtool/tsinfo.c There's only one which does have a SET: net/ethtool/pause.c where .parse_request handling is used to select which statistics to query. Not relevant for SET but also harmless. Going back to RSS (which doesn't have SET today) .parse_request parses the rss_context ID. Using the req_info struct to pass the context ID from SET to NTF will be very useful. Switch to ethnl_default_parse(), effectively adding the .parse_request for SET handlers. Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/20250623231720.3124717-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ceca0769e87ff4e33e8dab9c0277646da6d422fe Author: Jakub Kicinski Date: Mon Jun 23 16:17:14 2025 -0700 net: ethtool: dynamically allocate full req size req In preparation for using req_info to carry parameters between SET and NTF allocate a full request info struct. Since the size depends on the subcommand we need to allocate it on the heap. Reviewed-by: Maxime Chevallier Tested-by: Maxime Chevallier Link: https://patch.msgid.link/20250623231720.3124717-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 826334359eacc1b70e9752ebc4954ed775dd40ca Author: Jakub Kicinski Date: Mon Jun 23 16:17:13 2025 -0700 netlink: specs: add the multicast group name to spec Add the multicast group's name to the YAML spec. Without it YNL doesn't know how to subscribe to notifications. Reviewed-by: Donald Hunter Link: https://patch.msgid.link/20250623231720.3124717-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit bfb4fb77f9a8ce33ce357224569eae5564eec573 Author: Stanislav Fomichev Date: Mon Jun 23 08:31:47 2025 -0700 team: replace team lock with rtnl lock syszbot reports various ordering issues for lower instance locks and team lock. Switch to using rtnl lock for protecting team device, similar to bonding. Based on the patch by Tetsuo Handa. Cc: Jiri Pirko Cc: Tetsuo Handa Reported-by: syzbot+705c61d60b091ef42c04@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=705c61d60b091ef42c04 Reported-by: syzbot+71fd22ae4b81631e22fd@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=71fd22ae4b81631e22fd Fixes: 6b1d3c5f675c ("team: grab team lock during team_change_rx_flags") Link: https://lkml.kernel.org/r/ZoZ2RH9BcahEB9Sb@nanopsycho.orion Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250623153147.3413631-1-sdf@fomichev.me Signed-off-by: Jakub Kicinski commit d83caf7c8dad96051267c18786b7bc446b537f3c Author: Anton Protopopov Date: Wed Jun 25 15:16:21 2025 +0000 bpf: add btf_type_is_i{32,64} helpers There are places in BPF code which check if a BTF type is an integer of particular size. This code can be made simpler by using helpers. Add new btf_type_is_i{32,64} helpers, and simplify code in a few files. (Suggested by Eduard for a patch which copy-pasted such a check [1].) v1 -> v2: * export less generic helpers (Eduard) * make subject less generic than in [v1] (Eduard) [1] https://lore.kernel.org/bpf/7edb47e73baa46705119a23c6bf4af26517a640f.camel@gmail.com/ [v1] https://lore.kernel.org/bpf/20250624193655.733050-1-a.s.protopopov@gmail.com/ Suggested-by: Eduard Zingerman Signed-off-by: Anton Protopopov Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250625151621.1000584-1-a.s.protopopov@gmail.com Signed-off-by: Alexei Starovoitov commit 0ed5f79987ddb608aca374599f531a6bd831ac29 Merge: 0967f5399b64aa 12ed81f82391d0 Author: Alexei Starovoitov Date: Wed Jun 25 15:13:16 2025 -0700 Merge branch 'bpf-allow-void-cast-using-bpf_rdonly_cast' Eduard Zingerman says: ==================== bpf: allow void* cast using bpf_rdonly_cast() Currently, pointers returned by `bpf_rdonly_cast()` have a type of "pointer to btf id", and only casts to structure types are allowed. Access to memory pointed to by these pointers is done through `BPF_PROBE_{MEM,MEMSX}` instructions and does not produce errors on invalid memory access. This patch set extends `bpf_rdonly_cast()` to allow casts to an equivalent of 'void *', effectively replacing `bpf_probe_read_kernel()` calls in situations where access to individual bytes or integers is necessary. The mechanism was suggested and explored by Andrii Nakryiko in [1]. To help with detecting support for this feature, an `enum bpf_features` is added with intended usage as follows: if (bpf_core_enum_value_exists(enum bpf_features, BPF_FEAT_RDONLY_CAST_TO_VOID)) ... [1] https://github.com/anakryiko/linux/tree/bpf-mem-cast Changelog: v2: https://lore.kernel.org/bpf/20250625000520.2700423-1-eddyz87@gmail.com/ v2 -> v3: - dropped direct numbering for __MAX_BPF_FEAT. v1: https://lore.kernel.org/bpf/20250624191009.902874-1-eddyz87@gmail.com/ v1 -> v2: - renamed BPF_FEAT_TOTAL to __MAX_BPF_FEAT and moved patch introducing bpf_features enum to the start of the series (Alexei); - dropped patch #3 allowing optout from CAP_SYS_ADMIN drop in prog_tests/verifier.c, use a separate runner in prog_tests/* instead. ==================== Acked-by: Andrii Nakryiko Link: https://patch.msgid.link/20250625182414.30659-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 12ed81f82391d073982cf0cd0b2d14e374e5112a Author: Eduard Zingerman Date: Wed Jun 25 11:24:14 2025 -0700 selftests/bpf: check operations on untrusted ro pointers to mem The following cases are tested: - it is ok to load memory at any offset from rdonly_untrusted_mem; - rdonly_untrusted_mem offset/bounds are not tracked; - writes into rdonly_untrusted_mem are forbidden; - atomic operations on rdonly_untrusted_mem are forbidden; - rdonly_untrusted_mem can't be passed as a memory argument of a helper of kfunc; - it is ok to use PTR_TO_MEM and PTR_TO_BTF_ID in a same load instruction. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250625182414.30659-4-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit f2362a57aefff5816dc7cc078dab23de0a2918c4 Author: Eduard Zingerman Date: Wed Jun 25 11:24:13 2025 -0700 bpf: allow void* cast using bpf_rdonly_cast() Introduce support for `bpf_rdonly_cast(v, 0)`, which casts the value `v` to an untyped, untrusted pointer, logically similar to a `void *`. The memory pointed to by such a pointer is treated as read-only. As with other untrusted pointers, memory access violations on loads return zero instead of causing a fault. Technically: - The resulting pointer is represented as a register of type `PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED` with size zero. - Offsets within such pointers are not tracked. - Same load instructions are allowed to have both `PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED` and `PTR_TO_BTF_ID` as the base pointer types. In such cases, `bpf_insn_aux_data->ptr_type` is considered the weaker of the two: `PTR_TO_MEM | MEM_RDONLY | PTR_UNTRUSTED`. The following constraints apply to the new pointer type: - can be used as a base for LDX instructions; - can't be used as a base for ST/STX or atomic instructions; - can't be used as parameter for kfuncs or helpers. These constraints are enforced by existing handling of `MEM_RDONLY` flag and `PTR_TO_MEM` of size zero. Suggested-by: Alexei Starovoitov Suggested-by: Andrii Nakryiko Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250625182414.30659-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit b23e97ffc25294025a68924b6feac9cd431c3eb5 Author: Eduard Zingerman Date: Wed Jun 25 11:24:12 2025 -0700 bpf: add bpf_features enum This commit adds a kernel side enum for use in conjucntion with BTF CO-RE bpf_core_enum_value_exists. The goal of the enum is to assist with available BPF features detection. Intended usage looks as follows: if (bpf_core_enum_value_exists(enum bpf_features, BPF_FEAT_)) ... use feature f ... Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250625182414.30659-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 0967f5399b64aafb0bff1e76bca45446a3e1b6af Merge: d69bafe6ee2b5e 2945434e248fc6 Author: Alexei Starovoitov Date: Wed Jun 25 15:12:18 2025 -0700 Merge branch 'range-tracking-for-bpf_neg' Song Liu says: ==================== Add range tracking for BPF_NEG. Please see commit log of 1/2 for more details. --- Changes v3 => v4: 1. Fix selftest verifier_value_ptr_arith.c. (Eduard) v3: https://lore.kernel.org/bpf/20250624233328.313573-1-song@kernel.org/ Changes v2 => v3: 1. Minor changes in the selftests. (Eduard) v2: https://lore.kernel.org/bpf/20250624220038.656646-1-song@kernel.org/ Changes v1 => v2: 1. Split new selftests to a separate patch. (Eduard) 2. Reset reg id on BPF_NEG. (Eduard) 3. Use env->fake_reg instead of a bpf_reg_state on the stack. (Eduard) 4. Add __msg for passing selftests. v1: https://lore.kernel.org/bpf/20250624172320.2923031-1-song@kernel.org/ ==================== Link: https://patch.msgid.link/20250625164025.3310203-1-song@kernel.org Signed-off-by: Alexei Starovoitov commit 2945434e248fc66e0b44b054fa18b16b25c1c1f5 Author: Song Liu Date: Wed Jun 25 09:40:25 2025 -0700 selftests/bpf: Add tests for BPF_NEG range tracking logic BPF_REG now has range tracking logic. Add selftests for BPF_NEG. Specifically, return value of LSM hook lsm.s/socket_connect is used to show that the verifer tracks BPF_NEG(1) falls in the [-4095, 0] range; while BPF_NEG(100000) does not fall in that range. Signed-off-by: Song Liu Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250625164025.3310203-3-song@kernel.org Signed-off-by: Alexei Starovoitov commit aced132599b3c8884c050218d4c48eef203678f6 Author: Song Liu Date: Wed Jun 25 09:40:24 2025 -0700 bpf: Add range tracking for BPF_NEG Add range tracking for instruction BPF_NEG. Without this logic, a trivial program like the following will fail volatile bool found_value_b; SEC("lsm.s/socket_connect") int BPF_PROG(test_socket_connect) { if (!found_value_b) return -1; return 0; } with verifier log: "At program exit the register R0 has smin=0 smax=4294967295 should have been in [-4095, 0]". This is because range information is lost in BPF_NEG: 0: R1=ctx() R10=fp0 ; if (!found_value_b) @ xxxx.c:24 0: (18) r1 = 0xffa00000011e7048 ; R1_w=map_value(...) 2: (71) r0 = *(u8 *)(r1 +0) ; R0_w=scalar(smin32=0,smax=255) 3: (a4) w0 ^= 1 ; R0_w=scalar(smin32=0,smax=255) 4: (84) w0 = -w0 ; R0_w=scalar(range info lost) Note that, the log above is manually modified to highlight relevant bits. Fix this by maintaining proper range information with BPF_NEG, so that the verifier will know: 4: (84) w0 = -w0 ; R0_w=scalar(smin32=-255,smax=0) Also updated selftests based on the expected behavior. Signed-off-by: Song Liu Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250625164025.3310203-2-song@kernel.org Signed-off-by: Alexei Starovoitov commit 910bdb8197f9322790c738bb32feaa11dba26909 Author: Damien Le Moal Date: Tue Jun 24 20:45:44 2025 +0900 PCI: endpoint: Fix configfs group removal on driver teardown An endpoint driver configfs attributes group is added to the epf_group list of struct pci_epf_driver by pci_epf_add_cfs() but an added group is not removed from this list when the attribute group is unregistered with pci_ep_cfs_remove_epf_group(). Add the missing list_del() call in pci_ep_cfs_remove_epf_group() to correctly remove the attribute group from the driver list. With this change, once the loop over all attribute groups in pci_epf_remove_cfs() completes, the driver epf_group list should be empty. Add a WARN_ON() to make sure of that. Fixes: ef1433f717a2 ("PCI: endpoint: Create configfs entry for each pci_epf_device_id table entry") Signed-off-by: Damien Le Moal Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250624114544.342159-3-dlemoal@kernel.org commit d79123d79a8154b4318529b7b2ff7e15806f480b Author: Damien Le Moal Date: Tue Jun 24 20:45:43 2025 +0900 PCI: endpoint: Fix configfs group list head handling Doing a list_del() on the epf_group field of struct pci_epf_driver in pci_epf_remove_cfs() is not correct as this field is a list head, not a list entry. This list_del() call triggers a KASAN warning when an endpoint function driver which has a configfs attribute group is torn down: ================================================================== BUG: KASAN: slab-use-after-free in pci_epf_remove_cfs+0x17c/0x198 Write of size 8 at addr ffff00010f4a0d80 by task rmmod/319 CPU: 3 UID: 0 PID: 319 Comm: rmmod Not tainted 6.16.0-rc2 #1 NONE Hardware name: Radxa ROCK 5B (DT) Call trace: show_stack+0x2c/0x84 (C) dump_stack_lvl+0x70/0x98 print_report+0x17c/0x538 kasan_report+0xb8/0x190 __asan_report_store8_noabort+0x20/0x2c pci_epf_remove_cfs+0x17c/0x198 pci_epf_unregister_driver+0x18/0x30 nvmet_pci_epf_cleanup_module+0x24/0x30 [nvmet_pci_epf] __arm64_sys_delete_module+0x264/0x424 invoke_syscall+0x70/0x260 el0_svc_common.constprop.0+0xac/0x230 do_el0_svc+0x40/0x58 el0_svc+0x48/0xdc el0t_64_sync_handler+0x10c/0x138 el0t_64_sync+0x198/0x19c ... Remove this incorrect list_del() call from pci_epf_remove_cfs(). Fixes: ef1433f717a2 ("PCI: endpoint: Create configfs entry for each pci_epf_device_id table entry") Signed-off-by: Damien Le Moal Signed-off-by: Manivannan Sadhasivam Reviewed-by: Niklas Cassel Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250624114544.342159-2-dlemoal@kernel.org commit 032f05be51ab4a1d67d08a8083ec16dd934d255e Author: Hans Zhang <18255117159@163.com> Date: Fri Jun 13 00:12:26 2025 +0800 PCI: dwc: Simplify the return value of PTM debugfs functions returning bool Replace redundant ternary conditional expressions with direct boolean returns in PTM debugfs functions. Specifically change this pattern: return (condition) ? true : false; to the simpler: return condition; Signed-off-by: Hans Zhang <18255117159@163.com> [mani: subject rewording] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Reviewed-by: Niklas Cassel Link: https://patch.msgid.link/20250612161226.950937-1-18255117159@163.com commit 87d4fbf4a387f207d6906806ef6bf5c8eb289bd7 Author: Shivank Garg Date: Mon Jun 2 17:23:18 2025 +0000 KVM: guest_memfd: Remove redundant kvm_gmem_getattr implementation Remove the redundant kvm_gmem_getattr() implementation that simply calls generic_fillattr() without any special handling. The VFS layer (vfs_getattr_nosec()) will call generic_fillattr() by default when no custom getattr operation is provided in the inode_operations structure. This is a cleanup with no functional change. Signed-off-by: Shivank Garg Reviewed-By: Ackerley Tng Reviewed-by: Pankaj Gupta Link: https://lore.kernel.org/r/20250602172317.10601-1-shivankg@amd.com Signed-off-by: Sean Christopherson commit d982828d08b63c2c56f83c09b33cb71929fd4c22 Author: Jonathan Corbet Date: Wed Jun 25 14:08:40 2025 -0600 docs: kdoc: remove KernelEntry::in_doc_sect This field is not used for anything, just get rid of it. Signed-off-by: Jonathan Corbet commit d69bafe6ee2b5eff6099fa26626ecc2963f0f363 Author: Yonghong Song Date: Tue Jun 24 14:18:02 2025 -0700 selftests/bpf: Fix usdt multispec failure with arm64/clang20 selftest build When building the selftest with arm64/clang20, the following test failed: ... ubtest_multispec_usdt:PASS:usdt_100_called 0 nsec subtest_multispec_usdt:PASS:usdt_100_sum 0 nsec subtest_multispec_usdt:FAIL:usdt_300_bad_attach unexpected pointer: 0xaaaad82a2a80 #471/2 usdt/multispec:FAIL #471 usdt:FAIL But arm64/gcc11 built kernel selftests succeeded. Further debug found arm64/clang generated code has much less argument pattern after dedup, but gcc generated code has a lot more. Check usdt probes with usdt.test.o on arm64 platform: with gcc11 build binary: stapsdt 0x0000002e NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x00000000000054f8, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[sp] stapsdt 0x00000031 NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x0000000000005510, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[sp, 4] ... stapsdt 0x00000032 NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x0000000000005660, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[sp, 60] ... stapsdt 0x00000034 NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x00000000000070e8, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[sp, 1192] stapsdt 0x00000034 NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x0000000000007100, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[sp, 1196] ... stapsdt 0x00000032 NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x0000000000009ec4, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[sp, 60] with clang20 build binary: stapsdt 0x0000002e NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x00000000000009a0, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[x9] stapsdt 0x0000002e NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x00000000000009b8, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[x9] ... stapsdt 0x0000002e NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x0000000000002590, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[x9] stapsdt 0x0000002e NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x00000000000025a8, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[x8] ... stapsdt 0x0000002f NT_STAPSDT (SystemTap probe descriptors) Provider: test Name: usdt_300 Location: 0x0000000000007fdc, Base: 0x0000000000000000, Semaphore: 0x0000000000000008 Arguments: -4@[x10] There are total 300 locations for usdt_300. For gcc11 built binary, there are 300 spec's. But for clang20 built binary, there are 3 spec's. The default BPF_USDT_MAX_SPEC_CNT is 256, so bpf_program__attach_usdt() will fail for gcc but it will succeed with clang. To fix the problem, do not do bpf_program__attach_usdt() for usdt_300 with arm64/clang setup. Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250624211802.2198821-1-yonghong.song@linux.dev commit f0d0f978f3f5830ab06d71d1f37b3b30d47d6219 Author: Ian Rogers Date: Fri Jun 6 23:12:38 2025 -0700 perf header: Don't write empty BPF/BTF info If there are no values in bpf_prog_info or bpf_btf feature don't write the data into the header. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250617223356.2752099-4-irogers@google.com Signed-off-by: Namhyung Kim commit 4d2eefd7fb91482f1327f28f14112201e0b45dff Author: Ian Rogers Date: Fri Jun 6 23:12:37 2025 -0700 perf header: Display message if BPF/BTF info is empty The perf.data file may contain a bpf_prog_info or bpf_btf feature. If the contents of these are empty then nothing is displayed. Rather than display nothing and not account for the file space, display an empty message. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250617223356.2752099-4-irogers@google.com Signed-off-by: Namhyung Kim commit 57cbd56e2efe26483be2d4e7f62a7d9d816b54f1 Author: Ian Rogers Date: Fri Jun 6 23:12:36 2025 -0700 perf header: Allow tracing of attr events In pipe mode attr events capture the perf_event_attr. Allow their dumping as they normally start the file. Before: ``` $ perf record -o - -a sleep 1 | perf script -D -i - . ... raw event: size 272 bytes . 0000: 40 00 00 00 00 00 10 01 00 00 00 00 88 00 00 00 @............... . 0010: 00 00 00 00 00 00 00 00 a0 0f 00 00 00 00 00 00 ................ . 0020: 87 01 01 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ . 0030: 01 84 05 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0090: 91 08 00 00 00 00 00 00 92 08 00 00 00 00 00 00 ................ . 00a0: 93 08 00 00 00 00 00 00 94 08 00 00 00 00 00 00 ................ . 00b0: 95 08 00 00 00 00 00 00 96 08 00 00 00 00 00 00 ................ . 00c0: 97 08 00 00 00 00 00 00 98 08 00 00 00 00 00 00 ................ . 00d0: 99 08 00 00 00 00 00 00 9a 08 00 00 00 00 00 00 ................ . 00e0: 9b 08 00 00 00 00 00 00 9c 08 00 00 00 00 00 00 ................ . 00f0: 9d 08 00 00 00 00 00 00 9e 08 00 00 00 00 00 00 ................ . 0100: 9f 08 00 00 00 00 00 00 a0 08 00 00 00 00 00 00 ................ -1 -1 0 [0x110]: PERF_RECORD_ATTR 0x110@pipe [0x110]: event: 64 ... ``` After: ``` $ perf record -o - -a sleep 1 | perf script -D -i - 0@pipe [0x110]: event: 64 . . ... raw event: size 272 bytes . 0000: 40 00 00 00 00 00 10 01 00 00 00 00 88 00 00 00 @............... . 0010: 00 00 00 00 00 00 00 00 a0 0f 00 00 00 00 00 00 ................ . 0020: 87 01 01 00 00 00 00 00 14 00 00 00 00 00 00 00 ................ . 0030: 01 84 05 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0090: 5c 08 00 00 00 00 00 00 5d 08 00 00 00 00 00 00 \.......]....... . 00a0: 5e 08 00 00 00 00 00 00 5f 08 00 00 00 00 00 00 ^......._....... . 00b0: 60 08 00 00 00 00 00 00 61 08 00 00 00 00 00 00 `.......a....... . 00c0: 62 08 00 00 00 00 00 00 63 08 00 00 00 00 00 00 b.......c....... . 00d0: 64 08 00 00 00 00 00 00 65 08 00 00 00 00 00 00 d.......e....... . 00e0: 66 08 00 00 00 00 00 00 67 08 00 00 00 00 00 00 f.......g....... . 00f0: 68 08 00 00 00 00 00 00 69 08 00 00 00 00 00 00 h.......i....... . 0100: 6a 08 00 00 00 00 00 00 6b 08 00 00 00 00 00 00 j.......k....... -1 -1 0 [0x110]: PERF_RECORD_ATTR, type = 0 (PERF_TYPE_HARDWARE), size = 136, config = 0 (PERF_COUNT_HW_CPU_CYCLES), { sample_period, sample_freq } = 4000, sample_type = IP|TID|TIME|CPU|PERIOD|IDENTIFIER, read_format = ID|LOST, disabled = 1, freq = 1, precise_ip = 3, sample_id_all = 1 0x110@pipe [0x110]: event: 64 ... ``` Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250617223356.2752099-4-irogers@google.com Signed-off-by: Namhyung Kim commit 61051f9a8452d7f0878eaeb30299363310f07fd7 Author: Ian Rogers Date: Fri Jun 6 23:12:35 2025 -0700 perf header: In pipe mode dump features without --header/-I In pipe mode the header features are contained within events. While other events dump details the header features only dump if --header or -I are passed, which doesn't make sense as in pipe mode there is no perf file header. Make the printing of the information conditional on dump_trace as with other events. Before: ``` $ perf record -o - -a sleep 1 | perf script -D -i - ... 0x2c8@pipe [0x54]: event: 80 . . ... raw event: size 84 bytes . 0000: 50 00 00 00 00 00 54 00 05 00 00 00 00 00 00 00 P.....T......... . 0010: 40 00 00 00 36 2e 31 35 2e 72 63 37 2e 67 61 64 @...6.15.rc7.gad . 0020: 32 61 36 39 31 63 39 39 66 62 00 00 00 00 00 00 2a691c99fb...... . 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0050: 00 00 00 00 .... 0 0 0x2c8 [0x54]: PERF_RECORD_FEATURE ``` After: ``` $ perf record -o - -a sleep 1 | perf script -D -i - ... 0x2c8@pipe [0x54]: event: 80 . . ... raw event: size 84 bytes . 0000: 50 00 00 00 00 00 54 00 05 00 00 00 00 00 00 00 P.....T......... . 0010: 40 00 00 00 36 2e 31 35 2e 72 63 37 2e 67 61 64 @...6.15.rc7.gad . 0020: 32 61 36 39 31 63 39 39 66 62 00 00 00 00 00 00 2a691c99fb...... . 0030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ . 0050: 00 00 00 00 .... 0 0 0x2c8 [0x54]: PERF_RECORD_FEATURE, # perf version : 6.15.rc7.gad2a691c99fb ``` Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250617223356.2752099-4-irogers@google.com Signed-off-by: Namhyung Kim commit 08a1ea3fe85f8974c96a690f7f8c83d629d08510 Author: Bartosz Golaszewski Date: Wed Jun 25 17:28:38 2025 +0200 arm64: dts: qcom: sm6115: add debug UART pins We should not rely on the bootloader to set up the pinmux of the debug UART port. Let's add pin definitions for uart4 to tlmm and bind them to the relevant device node. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250625152839.193672-1-brgl@bgdev.pl Signed-off-by: Bjorn Andersson commit 9f35ab0e53ccbea57bb9cbad8065e0406d516195 Author: Dan Carpenter Date: Wed Jun 25 10:22:41 2025 -0500 soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() This function is supposed to return true for valid headers and false for invalid. In a couple places it returns -EINVAL instead which means the invalid headers are counted as true. Change it to return false. Fixes: 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read past the ELF header") Signed-off-by: Dan Carpenter Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/db57c01c-bdcc-4a0f-95db-b0f2784ea91f@sabinyo.mountain Signed-off-by: Bjorn Andersson commit 4fb2210866f7bdace7eadf3a275a72cea2a55f7f Author: Wolfram Sang Date: Sun Jun 8 18:21:09 2025 +0200 dt-bindings: trivial-devices: Add Analog Devices ADT7411 Describe this SPI-/I2C-Compatible, 10-Bit Digital Temperature Sensor and 8-Channel ADC. The driver is in hwmon for ages. Signed-off-by: Wolfram Sang Link: https://lore.kernel.org/r/20250608162240.3023-2-wsa+renesas@sang-engineering.com Signed-off-by: Rob Herring (Arm) commit e3ce7b897388339b407d57969acaa26063e38209 Author: Andrea della Porta Date: Tue Jun 24 17:36:22 2025 +0200 pinctrl: rp1: Implement RaspberryPi RP1 pinmux/pinconf support The current implementation for the pin controller peripheral on the RP1 chipset supports gpio functionality and just the basic configuration of pin hw capabilities. Add support for selecting the pin alternate function (pinmux) and full configuration of the pin (pinconf). Related pins are also gathered into groups. Signed-off-by: Andrea della Porta Acked-by: Linus Walleij Link: https://lore.kernel.org/all/8c282b89b1aa8b9e3c00f6bd3980332c47d82df7.1750778806.git.andrea.porta@suse.com/ Signed-off-by: Florian Fainelli commit bb39dd09fe68dbd4fcf999420a0c8ecf09f029ce Author: Daniel Palmer Date: Tue Jun 10 08:37:38 2025 +0900 doc: Remove misleading reference to brd in dax.rst brd hasn't supported DAX for a long time but dax.rst still suggests it as an example of how to write a DAX supporting block driver. Remove the reference, confuse less people. Fixes: 7a862fbbdec6 ("brd: remove dax support") Signed-off-by: Daniel Palmer Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250610-fixdasrstbrd20250610-v1-1-4abe3b7f381a@sony.com commit fa5a06e94a235253af1a78a0c3ce0c4a995b87b0 Author: Mauro Carvalho Chehab Date: Sun Jun 22 11:39:53 2025 +0200 docs: sphinx: add missing SPDX tags Several Sphinx extensions and tools are missing SPDX tags. Add them. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/1a62226c5fe524eb87bdb80b33bc7ec880a68880.1750585188.git.mchehab+huawei@kernel.org commit e6352bfae9edffb952aac79221bc9cd86abe47dd Merge: 3e36c822506d92 9a944494c299fa Author: Mark Brown Date: Wed Jun 25 19:23:44 2025 +0100 Add few updates to the STM32 SPI driver Merge series from Clément Le Goffic : This series aims to improve the STM32 SPI driver in different areas. It adds SPI_READY mode, fixes an issue raised by a kernel bot, add the ability to use DMA-MDMA chaining for RX and deprecate an ST bindings vendor property. commit 7ea9a550f710675fc79acd4a735ace96905faa54 Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:43 2025 +0200 docs: conf.py: several coding style fixes conf.py is missing a SPDX header and doesn't really have a proper python coding style. It also has an obsolete commented LaTeX syntax that doesn't work anymore. Clean it up a little bit with some help from autolints and manual adjustments. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/063c106d96e86ca30c3266f7819f30b7247881ed.1750571906.git.mchehab+huawei@kernel.org commit 9322af5e6557e547fa2be917e537dc297633ab93 Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:42 2025 +0200 docs: sphinx: add a file with the requirements for lowest version Those days, it is hard to install a virtual env that would build docs with Sphinx 3.4.3, as even python 3.13 is not compatible anymore with it. /usr/bin/python3.9 -m venv sphinx_3.4.3 . sphinx_3.4.3/bin/activate pip install -r Documentation/sphinx/min_requirements.txt Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/e38a44ee64ebfa37eac5f64e47af51c7ac051d5a.1750571906.git.mchehab+huawei@kernel.org commit bb4c5c50aeeca230428e77f57b60f3a9ef85ca9b Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:41 2025 +0200 scripts: test_doc_build.py: regroup and rename arguments The script now have lots or arguments. Better organize and name them, for it to be a little bit more intuitive. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/acf5e1db38ca6a713c44ceca9db5cdd7d3079c92.1750571906.git.mchehab+huawei@kernel.org commit 61aeda1e5c0d6ae128736ec4d6a082ee4dd9f04e Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:40 2025 +0200 scripts: sphinx-pre-install: fix release detection for Fedora Fedora distros are now identified as: Fedora Linux 42 Fix the way script detects it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/c2a34860bd986cc5f81fc25554ed91629736e995.1750571906.git.mchehab+huawei@kernel.org commit c6b5b1559c0c7bcb5fe9b390d1785adf9e3bc83f Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:39 2025 +0200 scripts: sphinx-pre-install: properly handle SPHINXBUILD Currently, the script ignores SPHINXBUILD, making it useless. As we're about to use on another script, fix support for it. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/b0217df871a5e563646d386327bdd7a393c58ac2.1750571906.git.mchehab+huawei@kernel.org commit 791b9b0333742760107e8719416ced49971ec4dd Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:38 2025 +0200 scripts: test_doc_build.py: make the script smarter Most of the time, testing the full range of supported Sphinx version is a waste of time and resources. Instead, the best is to focus at the versions that are actually shipped by major distros. For it to work properly, we need to adjust the requirements for them to start from first patch for each distro after the minimal supported one. The requirements were re-adjusted to avoid build breakages related to version incompatibilities. Such builds were tested with: ./scripts/test_doc_build.py -m -a "SPHINXOPTS=-j8" "SPHINXDIRS=networking netlink/specs" --full Change the logic to pick by default only such versions, adding another parameter to do a comprehensive test. While here, improve the script documentation to make it easier to be used. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/a2b9b7775a185766643ea4b82b558de25b61d6c7.1750571906.git.mchehab+huawei@kernel.org commit 0e93f1244db7000ef752e749d202d016663c3f1c Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:37 2025 +0200 scripts: test_doc_build.py: improve cmd.log logic Simplify the logic which handles with new lines. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/2436f37ab7945673f26bcfc94c10e6e76b93c2d8.1750571906.git.mchehab+huawei@kernel.org commit 792bf0194ce88606bc08243b78ec2dac2ea10ee5 Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:36 2025 +0200 scripts: test_doc_build.py: improve dependency list Change the dependency list to ensure that: - all docutils versions are covered; - provide an explanation about the dependencies; - set a better minimal requirement for 3.4.3. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/433aeefb4ac9edbd62494334ac07bc1307387d40.1750571906.git.mchehab+huawei@kernel.org commit 3fa60d281130064808751f6d48224330f0879ce1 Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:35 2025 +0200 scripts: test_doc_build.py: better adjust to python version Very old versions of Sphinx require older versions of python. The original script assumes that a python3.9 exec exists, but this may not be the case. Relax python requirements. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/32cb41c543293bbbab5fcb15f8a0aefac040e3a9.1750571906.git.mchehab+huawei@kernel.org commit fb1e8d1265a555ddd1cbfd0307477b4c4b048cc9 Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:34 2025 +0200 scripts: test_doc_build.py: better control its output Now that asyncio is supported, allow userspace to adjust verbosity level and direct the script output to a file. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/76c3a64a87a7493ae607d5c7784b3b829affcaf0.1750571906.git.mchehab+huawei@kernel.org commit 7649db7de2932c8e80e4bcf54027b3ad6388d95c Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:33 2025 +0200 scripts: test_doc_build.py: make capture assynchronous Prepare the tool to allow writing the output into log files. For such purpose, receive stdin/stdout messages asynchronously. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/9b0a60b5047137b5ba764701268da992767b128c.1750571906.git.mchehab+huawei@kernel.org commit 54c147f4c76c7891afe99ad2bdeba82143fd4ca6 Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:32 2025 +0200 scripts: scripts/test_doc_build.py: add script to test doc build Testing Sphinx backward-compatibility is hard, as per version minimal Python dependency requirements can be a nightmare. Add a script to help automate such checks. Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/93faf6c35ec865566246ca094868a8e6d85dde39.1750571906.git.mchehab+huawei@kernel.org commit 30c83405e4ecc1ca4bcfefe72f032b712d5f8abe Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:31 2025 +0200 docs: Makefile: disable check rules on make cleandocs It doesn't make sense to check for missing ABI and documents when cleaning the tree. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Breno Leitao Reviewed-by: Donald Hunter Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/8386afcee494c9e81d051c83235150104e3a2949.1750571906.git.mchehab+huawei@kernel.org commit 097fe72746950acbba39a6b6bf8ab26a4ba02e25 Author: Mauro Carvalho Chehab Date: Sun Jun 22 08:02:30 2025 +0200 docs: conf.py: properly handle include and exclude patterns When one does: make SPHINXDIRS="foo" htmldocs All patterns would be relative to Documentation/foo, which causes the include/exclude patterns like: include_patterns = [ ... f'foo/*.{ext}', ] to break. This is not what it is expected. Address it by adding a logic to dynamically adjust the pattern when SPHINXDIRS is used. That allows adding parsers for other file types. It should be noticed that include_patterns was added on Sphinx 5.1: https://www.sphinx-doc.org/en/master/usage/configuration.html#confval-include_patterns So, a backward-compatible code is needed when we start using it for real. Signed-off-by: Mauro Carvalho Chehab Reviewed-by: Donald Hunter Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/429c9c670fe27860f5e4f29aaf72576a4ed52ad1.1750571906.git.mchehab+huawei@kernel.org commit 4092e1b41202ff39aad75a40a03ac1d318443670 Author: Alexandre Courbot Date: Tue Jun 24 21:59:19 2025 +0900 gpu: nova-core: replace `Duration` with `Delta` The kernel's `Delta` type was not available when the `wait_on` function was introduced. Now that it is, switch to it as it is more compact than `Duration` and cannot panic. Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250624-nova-delta-v1-1-b37d75a593ac@nvidia.com Signed-off-by: Danilo Krummrich commit d612799de75b0cddbc00e2261355377493d74d45 Author: Danilo Krummrich Date: Tue Jun 24 19:05:16 2025 +0200 MAINTAINERS: Add Alexandre Courbot as co-maintainer to nova-core Alex has extensive experience with NVIDIA GPU support, is closely involved in nova-core development, and brings valuable Rust expertise. In addition to his technical contributions, Alex is actively engaged with the broader community. He works closely with contributors and stakeholders to identify and solve issues, fosters collaboration, and helps ensure that the Nova driver evolves in alignment with the community. I trust him to take a key role in making the Nova driver a successful upstream solution for NVIDIA GPUs in the Linux kernel. Cc: Alexandre Courbot Acked-by: Alexandre Courbot Acked-by: John Hubbard Link: https://lore.kernel.org/r/20250624170517.105148-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 45cd84bd7afc42c4a2ca630c11f246974fd1e73c Author: Ian Rogers Date: Tue Jun 24 16:18:37 2025 -0700 perf tests: Add a DRM PMU test The test opens any DRM devices so that the shell has fdinfo files containing the DRM data. The test then uses perf stat to make sure the events can be read. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250624231837.179536-4-irogers@google.com Signed-off-by: Namhyung Kim commit 28917cb17f9df9c2fc83449feefa375609b38fa4 Author: Ian Rogers Date: Tue Jun 24 16:18:36 2025 -0700 perf drm_pmu: Add a tool like PMU to expose DRM information DRM clients expose information through usage stats as documented in Documentation/gpu/drm-usage-stats.rst (available online at https://docs.kernel.org/gpu/drm-usage-stats.html). Add a tool like PMU, similar to the hwmon PMU, that exposes DRM information. For example on a tigerlake laptop: ``` $ perf list drm List of pre-defined events (to be used in -e or -M): drm: drm-active-stolen-system0 [Total memory active in one or more engines. Unit: drm_i915] drm-active-system0 [Total memory active in one or more engines. Unit: drm_i915] drm-engine-capacity-video [Engine capacity. Unit: drm_i915] drm-engine-copy [Utilization in ns. Unit: drm_i915] drm-engine-render [Utilization in ns. Unit: drm_i915] drm-engine-video [Utilization in ns. Unit: drm_i915] drm-engine-video-enhance [Utilization in ns. Unit: drm_i915] drm-purgeable-stolen-system0 [Size of resident and purgeable memory bufers. Unit: drm_i915] drm-purgeable-system0 [Size of resident and purgeable memory bufers. Unit: drm_i915] drm-resident-stolen-system0 [Size of resident memory bufers. Unit: drm_i915] drm-resident-system0 [Size of resident memory bufers. Unit: drm_i915] drm-shared-stolen-system0 [Size of shared memory bufers. Unit: drm_i915] drm-shared-system0 [Size of shared memory bufers. Unit: drm_i915] drm-total-stolen-system0 [Size of shared and private memory. Unit: drm_i915] drm-total-system0 [Size of shared and private memory. Unit: drm_i915] ``` System wide data can be gathered: ``` $ perf stat -x, -I 1000 -e drm-active-stolen-system0,drm-active-system0,drm-engine-capacity-video,drm-engine-copy,drm-engine-render,drm-engine-video,drm-engine-video-enhance,drm-purgeable-stolen-system0,drm-purgeable-system0,drm-resident-stolen-system0,drm-resident-system0,drm-shared-stolen-system0,drm-shared-system0,drm-total-stolen-system0,drm-total-system0 1.000904910,0,bytes,drm-active-stolen-system0,1,100.00,, 1.000904910,0,bytes,drm-active-system0,1,100.00,, 1.000904910,36,capacity,drm-engine-capacity-video,1,100.00,, 1.000904910,0,ns,drm-engine-copy,1,100.00,, 1.000904910,1472970566175,ns,drm-engine-render,1,100.00,, 1.000904910,0,ns,drm-engine-video,1,100.00,, 1.000904910,0,ns,drm-engine-video-enhance,1,100.00,, 1.000904910,0,bytes,drm-purgeable-stolen-system0,1,100.00,, 1.000904910,38199296,bytes,drm-purgeable-system0,1,100.00,, 1.000904910,0,bytes,drm-resident-stolen-system0,1,100.00,, 1.000904910,4643196928,bytes,drm-resident-system0,1,100.00,, 1.000904910,0,bytes,drm-shared-stolen-system0,1,100.00,, 1.000904910,1886871552,bytes,drm-shared-system0,1,100.00,, 1.000904910,0,bytes,drm-total-stolen-system0,1,100.00,, 1.000904910,4643196928,bytes,drm-total-system0,1,100.00,, 2.264426839,0,bytes,drm-active-stolen-system0,1,100.00,, ``` Or for a particular process: ``` $ perf stat -x, -I 1000 -e drm-active-stolen-system0,drm-active-system0,drm-engine-capacity-video,drm-engine-copy,drm-engine-render,drm-engine-video,drm-engine-video-enhance,drm-purgeable-stolen-system0,drm-purgeable-system0,drm-resident-stolen-system0,drm-resident-system0,drm-shared-stolen-system0,drm-shared-system0,drm-total-stolen-system0,drm-total-system0 -p 200027 1.001040274,0,bytes,drm-active-stolen-system0,6,100.00,, 1.001040274,0,bytes,drm-active-system0,6,100.00,, 1.001040274,12,capacity,drm-engine-capacity-video,6,100.00,, 1.001040274,0,ns,drm-engine-copy,6,100.00,, 1.001040274,1542300,ns,drm-engine-render,6,100.00,, 1.001040274,0,ns,drm-engine-video,6,100.00,, 1.001040274,0,ns,drm-engine-video-enhance,6,100.00,, 1.001040274,0,bytes,drm-purgeable-stolen-system0,6,100.00,, 1.001040274,13516800,bytes,drm-purgeable-system0,6,100.00,, 1.001040274,0,bytes,drm-resident-stolen-system0,6,100.00,, 1.001040274,27746304,bytes,drm-resident-system0,6,100.00,, 1.001040274,0,bytes,drm-shared-stolen-system0,6,100.00,, 1.001040274,0,bytes,drm-shared-system0,6,100.00,, 1.001040274,0,bytes,drm-total-stolen-system0,6,100.00,, 1.001040274,27746304,bytes,drm-total-system0,6,100.00,, 2.016629075,0,bytes,drm-active-stolen-system0,6,100.00,, ``` As with the hwmon PMU, high numbered PMU types are used to encode multiple possible "DRM" PMUs. The appropriate fdinfo is found by scanning /proc and filtering which fdinfos to read with stat. To avoid some unneeding scanning, events not starting with "drm-" are ignored. The patch builds on commit 57e13264dcea ("perf pmus: Restructure pmu_read_sysfs to scan fewer PMUs") and later so that only if full wild carding is being done, the PMU starts with "drm_" or the event starts with "drm-" will /proc be scanned. That is there should be little to no cost in this PMU unless DRM events are requested. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250624231837.179536-3-irogers@google.com Signed-off-by: Namhyung Kim commit e1ec69ed5ded5351efb04218dcab9d79ab018ac5 Author: Ian Rogers Date: Tue Jun 24 16:18:35 2025 -0700 perf parse-events: Avoid scanning PMUs that can't contain events Add perf_pmus__scan_for_event that only reads sysfs for pmus that could contain a given event. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250624231837.179536-2-irogers@google.com Signed-off-by: Namhyung Kim commit d6b93bfa5d1eba452e494d3a05d6bef65bc569b7 Author: Sakari Ailus Date: Wed Apr 9 13:33:44 2025 +0300 drm/nouveau/disp: Use dev->dev to get the device The local variable dev points to drm->dev already, use dev directly. Link: https://lore.kernel.org/r/20250409103344.3661603-1-sakari.ailus@linux.intel.com Signed-off-by: Sakari Ailus Signed-off-by: Danilo Krummrich commit 9c9f4a27eb1096beb650f312a1ce996a9960b56c Author: Ian Rogers Date: Tue Jun 24 14:05:00 2025 -0700 perf debug: Add function symbols to dump_stack Symbolize stack traces by creating a live machine. Add this functionality to dump_stack and switch dump_stack users to use it. Switch TUI to use it. Add stack traces to the child test function which can be useful to diagnose blocked code. Example output: ``` $ perf test -vv PERF_RECORD_ ... 7: PERF_RECORD_* events & perf_sample fields: 7: PERF_RECORD_* events & perf_sample fields : Running (1 active) ^C Signal (2) while running tests. Terminating tests with the same signal Internal test harness failure. Completing any started tests: : 7: PERF_RECORD_* events & perf_sample fields: ---- unexpected signal (2) ---- #0 0x55788c6210a3 in child_test_sig_handler builtin-test.c:0 #1 0x7fc12fe49df0 in __restore_rt libc_sigaction.c:0 #2 0x7fc12fe99687 in __internal_syscall_cancel cancellation.c:64 #3 0x7fc12fee5f7a in clock_nanosleep@GLIBC_2.2.5 clock_nanosleep.c:72 #4 0x7fc12fef1393 in __nanosleep nanosleep.c:26 #5 0x7fc12ff02d68 in __sleep sleep.c:55 #6 0x55788c63196b in test__PERF_RECORD perf-record.c:0 #7 0x55788c620fb0 in run_test_child builtin-test.c:0 #8 0x55788c5bd18d in start_command run-command.c:127 #9 0x55788c621ef3 in __cmd_test builtin-test.c:0 #10 0x55788c6225bf in cmd_test ??:0 #11 0x55788c5afbd0 in run_builtin perf.c:0 #12 0x55788c5afeeb in handle_internal_command perf.c:0 #13 0x55788c52b383 in main ??:0 #14 0x7fc12fe33ca8 in __libc_start_call_main libc_start_call_main.h:74 #15 0x7fc12fe33d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 #16 0x55788c52b9d1 in _start ??:0 ---- unexpected signal (2) ---- #0 0x55788c6210a3 in child_test_sig_handler builtin-test.c:0 #1 0x7fc12fe49df0 in __restore_rt libc_sigaction.c:0 #2 0x7fc12fea3a14 in pthread_sigmask@GLIBC_2.2.5 pthread_sigmask.c:45 #3 0x7fc12fe49fd9 in __GI___sigprocmask sigprocmask.c:26 #4 0x7fc12ff2601b in __longjmp_chk longjmp.c:36 #5 0x55788c6210c0 in print_test_result.isra.0 builtin-test.c:0 #6 0x7fc12fe49df0 in __restore_rt libc_sigaction.c:0 #7 0x7fc12fe99687 in __internal_syscall_cancel cancellation.c:64 #8 0x7fc12fee5f7a in clock_nanosleep@GLIBC_2.2.5 clock_nanosleep.c:72 #9 0x7fc12fef1393 in __nanosleep nanosleep.c:26 #10 0x7fc12ff02d68 in __sleep sleep.c:55 #11 0x55788c63196b in test__PERF_RECORD perf-record.c:0 #12 0x55788c620fb0 in run_test_child builtin-test.c:0 #13 0x55788c5bd18d in start_command run-command.c:127 #14 0x55788c621ef3 in __cmd_test builtin-test.c:0 #15 0x55788c6225bf in cmd_test ??:0 #16 0x55788c5afbd0 in run_builtin perf.c:0 #17 0x55788c5afeeb in handle_internal_command perf.c:0 #18 0x55788c52b383 in main ??:0 #19 0x7fc12fe33ca8 in __libc_start_call_main libc_start_call_main.h:74 #20 0x7fc12fe33d65 in __libc_start_main@@GLIBC_2.34 libc-start.c:128 #21 0x55788c52b9d1 in _start ??:0 7: PERF_RECORD_* events & perf_sample fields : Skip (permissions) ``` Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250624210500.2121303-1-irogers@google.com Signed-off-by: Namhyung Kim commit 07e04d8e7dceae9822377abcb2dd07aae5747e7d Author: Jonathan Corbet Date: Sat Jun 21 14:35:12 2025 -0600 docs: kdoc: finish disentangling the BODY and SPECIAL_SECTION states Move the last SPECIAL_SECTION special case into the proper handler function, getting rid of more if/then/else logic. The leading-space tracking was tightened up a bit in the move. Add some comments describing what is going on. No changes to the generated output. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250621203512.223189-10-corbet@lwn.net commit ccad65a494657e899f9139174fcc74c64316c10a Author: Jonathan Corbet Date: Sat Jun 21 14:35:11 2025 -0600 docs: kdoc: Add some comments to process_decl() Now that the function can actually fit into a human brain, add a few comments. While I was at it, I switched to the trim_whitespace() helper rather than open-coding it. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250621203512.223189-9-corbet@lwn.net commit 2ad02b94914ab47b3b94274856e1b56cd94d3e31 Author: Jonathan Corbet Date: Sat Jun 21 14:35:10 2025 -0600 docs: kdoc: coalesce the end-of-comment processing Separate out the end-of-comment logic into its own helper and remove the duplicated code introduced earlier. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250621203512.223189-8-corbet@lwn.net commit e65d54e19149601b96a19790ee9ba9ed04c59abe Author: Jonathan Corbet Date: Sat Jun 21 14:35:09 2025 -0600 docs: kdoc: rework the handling of SPECIAL_SECTION Move the recognition of this state to when we enter it, rather than when we exit, eliminating some twisty logic along the way. Some changes in output do result from this shift, generally for kerneldoc comments that do not quite fit the format. See, for example, struct irqdomain. As far as I can tell, the new behavior is more correct in each case. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250621203512.223189-7-corbet@lwn.net commit 99327067e1974e83cd8a60cf8445ce49086de46e Author: Jonathan Corbet Date: Sat Jun 21 14:35:08 2025 -0600 docs: kdoc: coalesce the new-section handling Merge the duplicated code back into a single implementation. Code movement only, no logic changes. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250621203512.223189-6-corbet@lwn.net commit 74cee0dfc2fc50e0d53629c289dc9b2954d31b1c Author: Jonathan Corbet Date: Sat Jun 21 14:35:07 2025 -0600 docs: kdoc: split out the special-section state The state known as BODY_WITH_BLANK_LINE really, in a convoluted way, indicates a "special section" that is terminated by a blank line or the beginning of a new section. That is either "@param: desc" sections, or the weird "context" section that plays by the same rules. Rename the state to SPECIAL_SECTION and split its processing into a separate function; no real changes to the logic yet. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250621203512.223189-5-corbet@lwn.net commit e4153a2255b1a0f3398360895e79e7709a0600b2 Author: Jonathan Corbet Date: Sat Jun 21 14:35:06 2025 -0600 docs: kdoc: separate out the handling of the declaration phase The BODY_MAYBE state really describes the "we are in a declaration" state. Rename it accordingly, and split the handling of this state out from that of the other BODY* states. This change introduces a fair amount of duplicated code that will be coalesced in a later patch. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250621203512.223189-4-corbet@lwn.net commit df2755269456d9ed02ad689aa8eaa50f7ac4217e Author: Jonathan Corbet Date: Sat Jun 21 14:35:05 2025 -0600 docs: kdoc: consolidate the "begin section" logic Pull the repeated "begin a section" logic into a single place and hide it within the KernelEntry class. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250621203512.223189-3-corbet@lwn.net commit 823d6f956605cb2f009f75de138622fcd7e03817 Author: Jonathan Corbet Date: Sat Jun 21 14:35:04 2025 -0600 docs: kdoc: Make body_with_blank_line parsing more flexible The regex in the BODY_WITH_BLANK_LINE case was looking for lines starting with " * ", where exactly one space was allowed before the following text. There are many kerneldoc comments where the authors have put multiple spaces instead, leading to mis-formatting of the documentation. Specifically, in this case, the description portion is associated with the last of the parameters. Allow multiple spaces in this context. See, for example, synchronize_hardirq() and how its documentation is formatted before and after the change. Acked-by: Mauro Carvalho Chehab Tested-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250621203512.223189-2-corbet@lwn.net commit ab4eb6a25de2a20c6d1d7244f8e9ad7a06cde1b0 Merge: 8dacfd92dbefee c73ebc0dbb6ed9 Author: Jakub Kicinski Date: Wed Jun 25 10:28:13 2025 -0700 Merge tag 'wireless-next-2025-06-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next Johannes Berg says: ==================== The usual features/cleanups/etc., notably: - rtw88: IBSS mode for SDIO devices - rtw89: - BT coex for MLO/WiFi7 - work on station + P2P concurrency - ath: fix W=2 export.h warnings - ath12k: fix scan on multi-radio devices - cfg80211/mac80211: MLO statistics - mac80211: S1G aggregation - cfg80211/mac80211: per-radio RTS threshold * tag 'wireless-next-2025-06-25' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next: (171 commits) wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() iwlwifi: Add missing check for alloc_ordered_workqueue wifi: iwlwifi: Fix memory leak in iwl_mvm_init() iwlwifi: api: delete repeated words iwlwifi: remove unused no_sleep_autoadjust declaration iwlwifi: Fix comment typo iwlwifi: use DECLARE_BITMAP macro iwlwifi: fw: simplify the iwl_fw_dbg_collect_trig() wifi: iwlwifi: mld: ftm: fix switch end indentation MAINTAINERS: update iwlwifi git link wifi: iwlwifi: pcie: fix non-MSIX handshake register wifi: iwlwifi: mld: don't exit EMLSR when we shouldn't wifi: iwlwifi: move _iwl_trans_set_bits_mask utilities wifi: iwlwifi: mld: make iwl_mld_add_all_rekeys void wifi: iwlwifi: move iwl_trans_pcie_write_mem to iwl-trans.c wifi: iwlwifi: pcie: move iwl_trans_pcie_dump_regs() to utils.c wifi: iwlwifi: mld: advertise support for TTLM changes wifi: iwlwifi: mld: Block EMLSR when scanning on P2P Device wifi: iwlwifi: mld: use the correct struct size for tracing wifi: iwlwifi: support RZL platform device ID ... ==================== Link: https://patch.msgid.link/20250625120135.41933-55-johannes@sipsolutions.net Signed-off-by: Jakub Kicinski commit 5a2f117a80c207372513ca8964eeb178874f4990 Author: Matthew Brost Date: Tue Jun 24 10:41:03 2025 -0700 drm/xe: Do not wedge device on killed exec queues When a user closes an exec queue or interrupts an app with Ctrl-C, this does not warrant wedging the device in mode 2. Avoid this by skipping the wedge check for killed exec queues in the TDR and LR exec queue cleanup worker. Signed-off-by: Matthew Brost Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250624174103.2707941-1-matthew.brost@intel.com commit bbc13ae593e0ea47357ff6e4740c533c16c2ae1e Author: Sean Christopherson Date: Thu May 22 18:17:56 2025 -0700 VFIO: KVM: x86: Drop kvm_arch_{start,end}_assignment() Drop kvm_arch_{start,end}_assignment() and all associated code now that KVM x86 no longer consumes assigned_device_count. Tracking whether or not a VFIO-assigned device is formally associated with a VM is fundamentally flawed, as such an association is optional for general usage, i.e. is prone to false negatives. E.g. prior to commit 2edd9cb79fb3 ("kvm: detect assigned device via irqbypass manager"), device passthrough via VFIO would fail to enable IRQ bypass if userspace omitted the formal VFIO<=>KVM binding. And device drivers that *need* the VFIO<=>KVM connection, e.g. KVM-GT, shouldn't be relying on generic x86 tracking infrastructure. Cc: Jim Mattson Link: https://lore.kernel.org/r/20250523011756.3243624-6-seanjc@google.com Signed-off-by: Sean Christopherson commit ff845e6a84c8c2c717efa6caf4db2d51a05aa9fd Author: Sean Christopherson Date: Thu May 22 18:17:55 2025 -0700 Revert "kvm: detect assigned device via irqbypass manager" Now that KVM explicitly tracks the number of possible bypass IRQs, and doesn't conflate IRQ bypass with host MMIO access, stop bumping the assigned device count when adding an IRQ bypass producer. This reverts commit 2edd9cb79fb31b0907c6e0cdce2824780cf9b153. Link: https://lore.kernel.org/r/20250523011756.3243624-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 95d9b5d8d6bbaecf4ebd40d8e17f8b2fd3991896 Merge: 7e9b231c402a29 83ebe715748314 Author: Sean Christopherson Date: Wed Jun 25 09:50:58 2025 -0700 Merge branch 'kvm-x86 mmio' Merge the MMIO stale data branch with the device posted IRQs branch to provide a common base for removing KVM's tracking of "assigned" devices. Link: https://lore.kernel.org/all/20250523011756.3243624-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 05186d7a8e5b8a31be93728089c9c3fee4dab0a2 Author: Chao Gao Date: Thu Jun 12 01:19:47 2025 -0700 KVM: SVM: Simplify MSR interception logic for IA32_XSS MSR Use svm_set_intercept_for_msr() directly to configure IA32_XSS MSR interception, ensuring consistency with other cases where MSRs are intercepted depending on guest caps and CPUIDs. No functional change intended. Signed-off-by: Chao Gao Reviewed-by: Dapeng Mi Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250612081947.94081-3-chao.gao@intel.com Signed-off-by: Sean Christopherson commit 086d0960d8b38e15ebc805122440feb1a424b1ab Merge: 51c18d4d8860d2 0f60ecffbfe35e Author: Mark Brown Date: Wed Jun 25 17:23:15 2025 +0100 ASoC: sdw_utils: generate combined spk components Merge series from Bard Liao : The series adds support for combined speaker components with one "spk:" tag in the card->components string. This is a UCM request. commit 7360dab3beadeeea48c2c314d48a290cb7a22398 Author: Dharma Balasubiramani Date: Wed Jun 25 14:38:45 2025 +0530 ARM: dts: microchip: sam9x7: Add LVDS controller Add support for LVDS controller. Signed-off-by: Dharma Balasubiramani Link: https://lore.kernel.org/r/20250625-b4-sam9x7-dts-v1-1-92aaee14ed16@microchip.com Signed-off-by: Claudiu Beznea commit 9da36b9faed26f634c9f04a0f2cf7625c08f5d65 Author: Danilo Krummrich Date: Fri Jun 20 16:21:03 2025 +0100 samples: rust: platform: conditionally call Self::properties_parse() Only call Self::properties_parse() when the FwNode is an OF node. Once we add ACPI support, we don't want the ACPI device to fail probing in Self::properties_parse(). Signed-off-by: Igor Korotin Link: https://lore.kernel.org/r/20250620152103.282763-1-igor.korotin.linux@gmail.com Signed-off-by: Danilo Krummrich commit c69072d3a10976e48da97758a78c35305c24eeba Author: Danilo Krummrich Date: Fri Jun 20 16:18:49 2025 +0100 samples: rust: platform: don't call as_ref() repeatedly In SampleDriver::probe() don't call pdev.as_ref() repeatedly, instead introduce a dedicated &Device. Signed-off-by: Igor Korotin Reviewed-by: Dirk Behme Link: https://lore.kernel.org/r/20250620151849.281238-1-igor.korotin.linux@gmail.com Signed-off-by: Danilo Krummrich commit 56a789f776f24e6b132ec00d4c27672ed4e2ec57 Author: Danilo Krummrich Date: Fri Jun 20 16:15:04 2025 +0100 rust: device: implement FwNode::is_of_node() Implement FwNode::is_of_node() in order to check whether a FwNode instance is embedded in a struct device_node. Reviewed-by: Rob Herring (Arm) Signed-off-by: Igor Korotin Link: https://lore.kernel.org/r/20250620151504.278766-1-igor.korotin.linux@gmail.com Signed-off-by: Danilo Krummrich commit c79cbde9b7bc7a650af96269588518950e3c2441 Author: Remo Senekowitsch Date: Mon Jun 16 17:45:11 2025 +0200 samples: rust: platform: Add property child and reference args examples Add some example usage of the device property methods for reading DT/ACPI/swnode child nodes and reference args. Signed-off-by: Remo Senekowitsch Link: https://lore.kernel.org/r/20250616154511.1862909-4-remo@buenzli.dev [ Convert 'child@{0,1}' to 'child-{0,1}'; skip child nodes without 'compatible' property in of_unittest_platform_populate() as proposed by Rob Herring. - Danilo] Signed-off-by: Danilo Krummrich commit c3e05bd15e0c99f3ff45e0b1f01814778bc1128c Author: Remo Senekowitsch Date: Mon Jun 16 17:45:10 2025 +0200 rust: device: Add property_get_reference_args Allow Rust code to read reference args from device properties. The wrapper type `FwNodeReferenceArgs` allows callers to access the buffer of read args safely. Signed-off-by: Remo Senekowitsch Link: https://lore.kernel.org/r/20250616154511.1862909-3-remo@buenzli.dev [ Move up NArgs; refer to FwNodeReferenceArgs in NArgs doc-comment. - Danilo ] Signed-off-by: Danilo Krummrich commit 83ebe715748314331f9639de2220d02debfe926d Author: Sean Christopherson Date: Thu May 22 18:17:54 2025 -0700 KVM: VMX: Apply MMIO Stale Data mitigation if KVM maps MMIO into the guest Enforce the MMIO State Data mitigation if KVM has ever mapped host MMIO into the VM, not if the VM has an assigned device. VFIO is but one of many ways to map host MMIO into a KVM guest, and even within VFIO, formally attaching a device to a VM via KVM_DEV_VFIO_FILE_ADD is entirely optional. Track whether or not the guest can access host MMIO on a per-MMU basis, i.e. based on whether or not the vCPU has a mapping to host MMIO. For simplicity, track MMIO mappings in "special" rools (those without a kvm_mmu_page) at the VM level, as only Intel CPUs are vulnerable, and so only legacy 32-bit shadow paging is affected, i.e. lack of precise tracking is a complete non-issue. Make the per-MMU and per-VM flags sticky. Detecting when *all* MMIO mappings have been removed would be absurdly complex. And in practice, removing MMIO from a guest will be done by deleting the associated memslot, which by default will force KVM to re-allocate all roots. Special roots will forever be mitigated, but as above, the affected scenarios are not expected to be performance sensitive. Use a VMX_RUN flag to communicate the need for a buffers flush to vmx_vcpu_enter_exit() so that kvm_vcpu_can_access_host_mmio() and all its dependencies don't need to be marked __always_inline, e.g. so that KASAN doesn't trigger a noinstr violation. Cc: Pawan Gupta Cc: Borislav Petkov Fixes: 8cb861e9e3c9 ("x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data") Tested-by: Pawan Gupta Link: https://lore.kernel.org/r/20250523011756.3243624-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 51c18d4d8860d2e87c73423a42daa10add8a682b Merge: b28ecd86069d22 68fbc70ece4013 Author: Mark Brown Date: Wed Jun 25 16:27:47 2025 +0100 ASoC: Standardize ASoC menu Merge series from Kuninori Morimoto : Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu, like below --- ALSA for SoC audio support Analog Devices ---> AMD ---> Apple ---> Atmel ---> Au1x ---- Broadcom ---> Cirrus Logic ---> DesignWare ---> Freescale ---> Google ---> Hisilicon ---> ... One concern is *vender folder* alphabetical order vs *vender name* alphabetical order were different. For example "sunxi" menu is "Allwinner". Link: https://lore.kernel.org/r/8734c8bf3l.wl-kuninori.morimoto.gx@renesas.com commit c942dba38064cd35214c6b3249120f3f2945e810 Author: Remo Senekowitsch Date: Mon Jun 16 17:45:09 2025 +0200 rust: device: Add child accessor and iterator Allow Rust drivers to access children of a fwnode either by name or by iterating over all of them. In C, there is the function `fwnode_get_next_child_node` for iteration and the macro `fwnode_for_each_child_node` that helps with handling the pointers. Instead of a macro, a native iterator is used in Rust such that regular for-loops can be used. Tested-by: Dirk Behme Signed-off-by: Remo Senekowitsch Link: https://lore.kernel.org/r/20250616154511.1862909-2-remo@buenzli.dev Signed-off-by: Danilo Krummrich commit b28ecd86069d22ea44b1e60eb423f9173a50151d Merge: 9d330278c9140c 59566923d955b6 Author: Mark Brown Date: Wed Jun 25 15:36:29 2025 +0100 Add SoundWire machines for ACP7.0/ACP7.1 sof stack Merge series from Vijendar Mukunda : Add SoundWire machines as alternate machines for ACP7.0 & ACP7.1 platforms with the below machine configuration. Link 0: RT722 codec with three endpoints: Headset, Speaker, and DMIC. commit 9d330278c9140cdde26575f3e1ae681d24776df6 Merge: 17cc308b183308 a48352921f0b15 Author: Mark Brown Date: Wed Jun 25 15:36:25 2025 +0100 ASoC: codecs: wcd93xx: Drop enums for chipid values Merge series from Krzysztof Kozlowski : Minor cleanup while preparing for adding WCD9378 support: do not use enum for values which are not an enumeration. commit dfe6c281323fea9f091f0d30a02579c072eb963c Author: Daniele Ceraolo Spurio Date: Tue Jun 24 17:12:03 2025 -0700 Revert "drm/xe/ptl: Apply Wa_16026007364" This reverts commit 3972872e459d812ab5e481a231a6066cf4f4d0f4. There are several things wrong with the way this WA was implemented: - The KLV is only supported on GuC 70.47.0 or newer, so we shouldn't apply it unconditionally. - The KLV requires 2 DWs of data, which are not currently provided. The GuC currently ignores any unknown KLVs, so on versions older that 70.47.0 nothing happens. However, starting on 70.47.0 the GuC attempts to parse the KLV and fails due to the missing data, causing a GuC load abort. Given that 70.47.0 is the first GuC version approved for public release for PTL, let's revert this patch so it doesn't cause the GuC load to fail with that blob. We can then re-apply it properly fixed after the GuC definition is merged, which will also have the added benefit of running the KLV addition through CI with the right GuC version. Fixes: 3972872e459d ("drm/xe/ptl: Apply Wa_16026007364") Signed-off-by: Daniele Ceraolo Spurio Cc: sanirban Cc: Badal Nilawar Cc: Rodrigo Vivi Link: https://lore.kernel.org/r/20250625001202.1616606-2-daniele.ceraolospurio@intel.com Signed-off-by: Rodrigo Vivi commit 2642f55d44ce563f227dd9c620eda0dec8d882be Author: Peter Griffin Date: Thu Jun 19 12:18:16 2025 +0100 pinctrl: samsung: add support for gs101 wakeup mask programming gs101 differs to other currently supported SoCs in that it has 3 wakeup mask registers for the 67 external wakeup interrupt pins in alive and far_alive. EINT_WAKEUP_MASK 0x3A80 EINT[31:0] EINT_WAKEUP_MASK2 0x3A84 EINT[63:32] EINT_WAKEUP_MASK3 0x3A88 EINT[66:64] Add gs101 specific callbacks and a dedicated gs101_wkup_irq_chip struct to handle these differences. The current wakeup mask with upstream is programmed as WAKEUP_MASK0[0x3A80] value[0xFFFFFFFF] WAKEUP_MASK1[0x3A84] value[0xF2FFEFFF] WAKEUP_MASK2[0x3A88] value[0xFFFFFFFF] Which corresponds to the following wakeup sources: gpa7-3 vol down gpa8-1 vol up gpa10-1 power gpa8-2 typec-int Signed-off-by: Peter Griffin Link: https://lore.kernel.org/r/20250619-gs101-eint-mask-v1-2-89438cfd7499@linaro.org Signed-off-by: Krzysztof Kozlowski commit c8edb80494407f65a253ea63ffbae3fb831f397a Author: Peter Griffin Date: Thu Jun 19 12:18:15 2025 +0100 pinctrl: samsung: rename exynosautov920_retention_data to no_retention_data To avoid having an exact copy of this struct for gs101 rename it and use it for both SoCs for eint banks. The purpose of this for exynosautov920 and gs101 is to obtain the PMU syscon for writing the calculated WAKEUP_MASK register(s). Signed-off-by: Peter Griffin Link: https://lore.kernel.org/r/20250619-gs101-eint-mask-v1-1-89438cfd7499@linaro.org Signed-off-by: Krzysztof Kozlowski commit 771f002ef1d6f6c2b9bddf779abd31da6b9ccd25 Author: Shuicheng Lin Date: Sun Jun 8 23:01:33 2025 +0000 drm/xe/uapi: Correct sync type definition in comments Commit 37d078e51b4c ("drm/xe/uapi: Split xe_sync types from flags") renamed some DRM_XE_SYNC_* defines but later commits kept using the old names. Correct them with the new definition. v2: correct fixes tag and update commit message to explain why (Lucas) Fixes: 9329f0667215 ("drm/xe/uapi: Use LR abbrev for long-running vms") Fixes: 4b437893a826 ("drm/xe/uapi: More uAPI documentation additions and cosmetic updates") Reviewed-by: Lucas De Marchi Cc: Rodrigo Vivi Cc: Francois Dugast Cc: Zongyao Bai Signed-off-by: Shuicheng Lin Link: https://lore.kernel.org/r/20250608230133.1250849-1-shuicheng.lin@intel.com Signed-off-by: Rodrigo Vivi commit 0f60ecffbfe35e12eb56c99640ba2360244b5bb3 Author: Bard Liao Date: Wed Jun 25 22:04:29 2025 +0800 ASoC: sdw_utils: generate combined spk components string The suggestion from UCM for 2 speaker components is using 1 "spk" tag with 2 component names. Like "spk:rt722+rt1320". The commit removes the creation of the "spk" components in each rtd_init callback and creat the string in asoc_sdw_rtd_init(). Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Shuming Fan Link: https://patch.msgid.link/20250625140430.311865-3-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit f792733e08d5f5d44ef76d22bcca7ca45a82d0de Author: Bard Liao Date: Wed Jun 25 22:04:28 2025 +0800 ASoC: sdw_utils: add component_name string to dai_info Currently the sdw machine driver uses different way to get the component name from the DAI name for different codecs in the rtd_init callback. It means that we need to rely on the rtd_init callback to get the component name. Add an optional component string to the asoc_sdw_dai_info struct allows the machine driver to get the component name directly. The commit adds the component names for the AMP dais for the preparation to set card->components string for combined speaker configs. Signed-off-by: Bard Liao Reviewed-by: Péter Ujfalusi Reviewed-by: Shuming Fan Link: https://patch.msgid.link/20250625140430.311865-2-yung-chuan.liao@linux.intel.com Signed-off-by: Mark Brown commit 42873b118abf3e297e012e52ddcae2e5b1f42214 Author: Krzysztof Kozlowski Date: Thu Jun 12 11:55:50 2025 +0200 arm64: dts: exynos5433: Align i2c-gpio node names with dtschema New dtschema v2025.6 enforces different naming on I2C nodes thus new dtbs_check warnings appeared for I2C GPIO nodes: exynos5433-tm2.dtb: i2c-gpio-0 (i2c-gpio): $nodename:0: 'i2c-gpio-0' does not match '^i2c(@.+|-[a-z0-9]+)?$' exynos5433-tm2.dtb: i2c-gpio-0 (i2c-gpio): Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'amplifier@31' were unexpected) Rename the nodes to a generic i2c-[0-9]+ style with numbers continuing the SoC I2C controller indexing (3 controllers) for simplicity and obviousness, even if the SoC I2C controller is not enabled on given board. The names anyway would not conflict with SoC ones because of unit addresses. Verified with comparing two fdt (after fdtdump). Reported-by: Wolfram Sang Closes: https://lore.kernel.org/all/aCtD7BH5N_uPGkq7@shikoro/ Link: https://lore.kernel.org/r/20250612095549.77954-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit a24cd2f207efa73d7ce8089ce4848aea99f48f6e Author: Krzysztof Kozlowski Date: Thu Jun 12 11:48:09 2025 +0200 ARM: dts: s5pv210: Align i2c-gpio node names with dtschema New dtschema v2025.6 enforces different naming on I2C nodes thus new dtbs_check warnings appeared for I2C GPIO nodes: s5pv210-fascinate4g.dtb: i2c-gpio-0 (i2c-gpio): $nodename:0: 'i2c-gpio-0' does not match '^i2c(@.+|-[a-z0-9]+)?$' s5pv210-fascinate4g.dtb: i2c-gpio-0 (i2c-gpio): Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'audio-codec@1a' were unexpected) Rename the nodes to a generic i2c-[0-9]+ style with numbers continuing the SoC I2C controller indexing (3 controllers) for simplicity and obviousness, even if the SoC I2C controller is not enabled on given board. The names anyway would not conflict with SoC ones because of unit addresses. Verified with comparing two fdt (after fdtdump). Reported-by: Wolfram Sang Closes: https://lore.kernel.org/all/aCtD7BH5N_uPGkq7@shikoro/ Link: https://lore.kernel.org/r/20250612094807.62532-4-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit a0c7a6b5f42b29dddfc359717d620e5b1badb9a1 Author: Krzysztof Kozlowski Date: Thu Jun 12 11:48:08 2025 +0200 ARM: dts: exynos: Align i2c-gpio node names with dtschema New dtschema v2025.6 enforces different naming on I2C nodes thus new dtbs_check warnings appeared for I2C GPIO nodes: exynos4212-tab3-lte8.dtb: i2c-gpio-3 (i2c-gpio): $nodename:0: 'i2c-gpio-3' does not match '^i2c(@.+|-[a-z0-9]+)?$' exynos4212-tab3-lte8.dtb: i2c-gpio-3 (i2c-gpio): Unevaluated properties are not allowed ('#address-cells', '#size-cells', 'magnetometer@2e' were unexpected) Rename the nodes to a generic i2c-[0-9]+ style with numbers continuing the SoC I2C controller indexing (Exynos3250: 8 controllers, Exynos4: 9 controllers) for simplicity and obviousness, even if the SoC I2C controller is not enabled on given board. The names anyway would not conflict with SoC ones because of unit addresses. Verified with comparing two fdt (after fdtdump). Reported-by: Wolfram Sang Closes: https://lore.kernel.org/all/aCtD7BH5N_uPGkq7@shikoro/ Link: https://lore.kernel.org/r/20250612094807.62532-3-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 331db44e70dacfb6bf1e17d92fae7b1c9517ca6c Author: Jason-JH Lin Date: Tue Jun 24 18:39:03 2025 +0800 soc: mediatek: mtk-mutex: Fix confusing usage of MUTEX_MOD2 The usage of MUTEX_MOD1 and MUTEX_MOD2 for calculating mod settings over 32 has been confusing. To improve consistency and clarity, these defines need to fit into the same MUTEX_MOD define as possible. However, MUTEX_MOD1 cannot be directly used for all SoCs because, for example, the mod1 register (0x34) of MT2712 is not adjacent to its mod0 register (0x2c). To address this, a `mutex_mod1_reg` field is introduced in the mutex driver data structure. This allows all SoCs to use a unified MUTEX_MOD to determine their register offsets. With this change, the separate usage of MUTEX_MOD1 and MUTEX_MOD2 is eliminated, simplifying the logic for obtaining offsets and mod IDs. Signed-off-by: Jason-JH Lin Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250624103928.408194-1-jason-jh.lin@mediatek.com Signed-off-by: AngeloGioacchino Del Regno commit d7467bc72ce4e3f64062017d6c9ae3816e8a7b0e Author: Niklas Cassel Date: Wed Jun 25 12:23:52 2025 +0200 PCI: Move link up wait time and max retries macros to pci.h Move the LINK_WAIT_SLEEP_MS and LINK_WAIT_MAX_RETRIES macros to pci.h. Prefix the macros with PCIE_ in order to avoid redefining these for drivers that already have macros named like this. No functional changes. Suggested-by: Manivannan Sadhasivam Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250625102347.1205584-15-cassel@kernel.org commit 80dc18a0cba8dea42614f021b20a04354b213d86 Author: Niklas Cassel Date: Wed Jun 25 12:23:51 2025 +0200 PCI: dwc: Ensure that dw_pcie_wait_for_link() waits 100 ms after link up As per PCIe r6.0, sec 6.6.1, a Downstream Port that supports Link speeds greater than 5.0 GT/s, software must wait a minimum of 100 ms after Link training completes before sending a Configuration Request. Add this delay in dw_pcie_wait_for_link(), after the link is reported as up. The delay will only be performed in the success case where the link came up. DWC glue drivers that have a link up IRQ (drivers that set use_linkup_irq = true) do not call dw_pcie_wait_for_link(), instead they perform this delay in their threaded link up IRQ handler. Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Reviewed-by: Damien Le Moal Reviewed-by: Wilfred Mallawa Link: https://patch.msgid.link/20250625102347.1205584-14-cassel@kernel.org commit 15b6b243cc2b1017cf89e2477aa0b4e1a306a82a Author: Niklas Cassel Date: Wed Jun 25 12:23:50 2025 +0200 PCI: qcom: Wait PCIE_RESET_CONFIG_WAIT_MS after link-up IRQ Per PCIe r6.0, sec 6.6.1, software must generally wait a minimum of 100ms (PCIE_RESET_CONFIG_WAIT_MS) after Link training completes before sending a Configuration Request. Prior to 36971d6c5a9a ("PCI: qcom: Don't wait for link if we can detect Link Up"), qcom used dw_pcie_wait_for_link(), which waited between 0 and 90ms after the link came up before we enumerate the bus, and this was apparently enough for most devices. After 36971d6c5a9a, qcom_pcie_global_irq_thread() started enumeration immediately when handling the link-up IRQ, and devices (e.g., Laszlo Fiat's PLEXTOR PX-256M8PeGN NVMe SSD) may not be ready to handle config requests yet. Delay PCIE_RESET_CONFIG_WAIT_MS after the link-up IRQ before starting enumeration. Fixes: 82a823833f4e ("PCI: qcom: Add Qualcomm PCIe controller driver") Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Reviewed-by: Damien Le Moal Reviewed-by: Wilfred Mallawa Link: https://patch.msgid.link/20250625102347.1205584-13-cassel@kernel.org commit c7eb9c5e1498882951b7583c56add0b77bfc162e Author: Niklas Cassel Date: Wed Jun 25 12:23:49 2025 +0200 PCI: dw-rockchip: Wait PCIE_RESET_CONFIG_WAIT_MS after link-up IRQ Per PCIe r6.0, sec 6.6.1, software must generally wait a minimum of 100ms (PCIE_RESET_CONFIG_WAIT_MS) after Link training completes before sending a Configuration Request. Prior to ec9fd499b9c6 ("PCI: dw-rockchip: Don't wait for link since we can detect Link Up"), dw-rockchip used dw_pcie_wait_for_link(), which waited between 0 and 90ms after the link came up before we enumerate the bus, and this was apparently enough for most devices. After ec9fd499b9c6, rockchip_pcie_rc_sys_irq_thread() started enumeration immediately when handling the link-up IRQ, and devices (e.g., Laszlo Fiat's PLEXTOR PX-256M8PeGN NVMe SSD) may not be ready to handle config requests yet. Delay PCIE_RESET_CONFIG_WAIT_MS after the link-up IRQ before starting enumeration. Fixes: 0e898eb8df4e ("PCI: rockchip-dwc: Add Rockchip RK356X host controller driver") Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Reviewed-by: Damien Le Moal Reviewed-by: Wilfred Mallawa Cc: Laszlo Fiat Link: https://patch.msgid.link/20250625102347.1205584-12-cassel@kernel.org commit c17b1b6c86059664e91008a23547ef0aadfc2228 Author: Chen-Yu Tsai Date: Fri Jun 20 01:10:25 2025 +0800 clk: sunxi-ng: sun55i-a523-r-ccu: Add missing PPU0 reset There is a PPU0 reset control bit in the same register as the PPU1 reset control. This missing reset control is for the PCK-600 unit in the SoC. Manual tests show that the reset control indeed exists, and if not configured, the system will hang when the PCK-600 registers are accessed. Add a reset entry for it at the end of the existing ones. Fixes: 8cea339cfb81 ("clk: sunxi-ng: add support for the A523/T527 PRCM CCU") Reviewed-by: Andre Przywara Acked-by: Stephen Boyd Link: https://patch.msgid.link/20250619171025.3359384-3-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit 61977ccf6568f9d104462727b49412a80c22c519 Author: Chen-Yu Tsai Date: Fri Jun 20 01:10:24 2025 +0800 dt-bindings: reset: sun55i-a523-r-ccu: Add missing PPU0 reset There is a PPU0 reset control bit in the same register as the PPU1 reset control. This missing reset control is for the PCK-600 unit in the SoC. Manual tests show that the reset control indeed exists, and if not configured, the system will hang when the PCK-600 registers are accessed. Add a reset entry for it at the end of the existing ones. Fixes: 52dbf84857f0 ("dt-bindings: clk: sunxi-ng: document two Allwinner A523 CCUs") Acked-by: Conor Dooley Acked-by: Stephen Boyd Reviewed-by: Andre Przywara Link: https://patch.msgid.link/20250619171025.3359384-2-wens@kernel.org Signed-off-by: Chen-Yu Tsai commit bbc6a829ad3f054181d24a56944f944002e68898 Author: Niklas Cassel Date: Wed Jun 25 12:23:48 2025 +0200 PCI: rockchip-host: Use macro PCIE_RESET_CONFIG_WAIT_MS Macro PCIE_RESET_CONFIG_DEVICE_WAIT_MS was added to pci.h in commit d5ceb9496c56 ("PCI: Add PCIE_RESET_CONFIG_DEVICE_WAIT_MS waiting time value"). Later, in commit 70a7bfb1e515 ("PCI: rockchip-host: Wait 100ms after reset before starting configuration"), PCIE_T_RRS_READY_MS was added to pci.h. These macros are duplicates, and represent the exact same delay in the PCIe specification. Since the comment above PCIE_RESET_CONFIG_WAIT_MS is strictly more correct than the comment above PCIE_T_RRS_READY_MS, change rockchip-host to use PCIE_RESET_CONFIG_WAIT_MS, and remove PCIE_T_RRS_READY_MS, as rockchip-host is the only user of this macro. Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Reviewed-by: Wilfred Mallawa Link: https://patch.msgid.link/20250625102347.1205584-11-cassel@kernel.org commit 817f989700fddefa56e5e443e7d138018ca6709d Author: Niklas Cassel Date: Wed Jun 25 12:23:47 2025 +0200 PCI: Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS Rename PCIE_RESET_CONFIG_DEVICE_WAIT_MS to PCIE_RESET_CONFIG_WAIT_MS. Suggested-by: Bjorn Helgaas Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250625102347.1205584-10-cassel@kernel.org commit 15b8c45f982a7bf6cd3114e905414aabc5508fb6 Merge: 115ed5cb58ee4b ec54c0a20709ed Author: Ulf Hansson Date: Wed Jun 25 14:44:44 2025 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v6.16-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit 1f6da56679d33c733aaee929fd9af962ad66edbd Author: Dragos Tatulea Date: Thu Jun 19 14:37:18 2025 +0300 net/mlx5: Add IFC bits for PCIe Congestion Event object Add definitions for the PCIe Congestion Event object and the relevant FW command structures. Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250619113721.60201-3-mbloch@nvidia.com Signed-off-by: Leon Romanovsky commit ebf8d47121b6ef3f38425a343a72f37c60fd6dbc Author: Dragos Tatulea Date: Thu Jun 19 14:37:17 2025 +0300 net/mlx5: Small refactor for general object capabilities Make enum for capability bits of general object types depend on the type definitions themselves. Make sure that capabilities in the [64,127] bit range are properly calculated (type id - 64). Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250619113721.60201-2-mbloch@nvidia.com Signed-off-by: Leon Romanovsky commit 43163f4c30f94d2103c948a247cdf2cda5068ca7 Author: Arnd Bergmann Date: Fri Jun 20 13:33:26 2025 +0200 RDMA/core: reduce stack using in nldev_stat_get_doit() In the s390 defconfig, gcc-10 and earlier end up inlining three functions into nldev_stat_get_doit(), and each of them uses some 600 bytes of stack. The result is a function with an overly large stack frame and a warning: drivers/infiniband/core/nldev.c:2466:1: error: the frame size of 1720 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] Mark the three functions noinline_for_stack to prevent this, ensuring that only one copy of the nlattr array is on the stack of each function. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250620113335.3776965-1-arnd@kernel.org Signed-off-by: Leon Romanovsky commit 819275e18112f682d9ca9b66190fc714a2910a53 Author: Petr Pavlu Date: Fri Jun 20 17:45:49 2025 +0200 s390/boot: Use -D__DISABLE_EXPORTS Files in the arch/s390/boot directory reuse logic from the rest of the kernel by including certain C and assembly files from the kernel and lib directories. Some of these included files contain EXPORT_SYMBOL directives. For instance, arch/s390/boot/cmdline.c includes lib/cmdline.c, which exports the get_option() function. This inclusion triggers genksyms processing for the files in arch/s390/boot, which is unnecessary and slows down the build. Additionally, when KBUILD_SYMTYPES=1 is set, the generated symtypes data contain exported symbols that are duplicated with the main kernel. This duplication can confuse external kABI tools that process the symtypes data. Address this issue by compiling the files in arch/s390/boot with -D__DISABLE_EXPORTS. Signed-off-by: Petr Pavlu Reviewed-by: Heiko Carstens Link: https://lore.kernel.org/r/20250620154649.116068-1-petr.pavlu@suse.com Signed-off-by: Alexander Gordeev commit da3d0b772f6f04e8460182024efbd4ce15e35c42 Author: Michal Wilczynski Date: Mon Jun 23 13:42:41 2025 +0200 pmdomain: thead: Instantiate GPU power sequencer via auxiliary bus In order to support the complex power sequencing required by the TH1520 GPU, the AON power domain driver must be responsible for initiating the corresponding sequencer driver. This functionality is specific to platforms where the GPU power sequencing hardware is controlled by the AON block. Extend the AON power domain driver to check for the presence of the "gpu-clkgen" reset in its own device tree node. If the property is found, create and register a new auxiliary device. This device acts as a proxy that allows the dedicated `pwrseq-thead-gpu` auxiliary driver to bind and take control of the sequencing logic. Reviewed-by: Ulf Hansson Reviewed-by: Bartosz Golaszewski Signed-off-by: Michal Wilczynski Link: https://lore.kernel.org/r/20250623-apr_14_for_sending-v6-3-6583ce0f6c25@samsung.com Signed-off-by: Ulf Hansson commit c7ba7a92ae72d53f7493d507d9b5db2af0e06ed9 Merge: a73776ca8c7c6a 7226b28ac77690 Author: Ulf Hansson Date: Wed Jun 25 12:08:23 2025 +0200 pmdomain: Merge branch dt into next Merge the immutable branch dt into next, to allow the DT bindings to be tested together with changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit 7226b28ac776909fe744e078624b00fbe830bfd5 Author: Michal Wilczynski Date: Mon Jun 23 13:42:40 2025 +0200 dt-bindings: firmware: thead,th1520: Add resets for GPU clkgen Extend the TH1520 AON to describe the GPU clkgen reset line, required for proper GPU clock and reset sequencing. The T-HEAD TH1520 GPU requires coordinated management of two clocks (core and sys) and two resets (GPU core reset and GPU clkgen reset). Only the clkgen reset is exposed at the AON level, to support SoC specific initialization handled through a dedicated auxiliary power sequencing driver. The GPU core reset remains described in the GPU device node, as from the GPU driver's perspective, there is only a single reset line [1]. This follows upstream maintainers' recommendations [2] to abstract SoC specific details into the PM domain layer rather than exposing them to drivers directly. Link: https://lore.kernel.org/all/816db99d-7088-4c1a-af03-b9a825ac09dc@imgtec.com/ - [1] Link: https://lore.kernel.org/all/38d9650fc11a674c8b689d6bab937acf@kernel.org/ - [2] Reviewed-by: Ulf Hansson Reviewed-by: Drew Fustini Reviewed-by: Bartosz Golaszewski Reviewed-by: Krzysztof Kozlowski Signed-off-by: Michal Wilczynski Link: https://lore.kernel.org/r/20250623-apr_14_for_sending-v6-2-6583ce0f6c25@samsung.com Signed-off-by: Ulf Hansson commit a73776ca8c7c6a62215ecc321407b65f61dd4a27 Author: Ulf Hansson Date: Fri May 23 15:39:58 2025 +0200 pmdomain: core: Use of_fwnode_handle() Let's avoid accessing the np->fwnode directly and use the common helper of_fwnode_handle() instead. Suggested-by: Saravana Kannan Reviewed-by: Dhruva Gole Tested-by: Hiago De Franco # Colibri iMX8X Tested-by: Tomi Valkeinen Signed-off-by: Ulf Hansson Link: https://lore.kernel.org/r/20250523134025.75130-2-ulf.hansson@linaro.org commit c73ebc0dbb6ed968cb58d04d82ede3b5fb95e8bf Merge: 5582cbdf7bb5d0 e3ad987e9dc7d1 Author: Johannes Berg Date: Wed Jun 25 11:22:30 2025 +0200 Merge tag 'iwlwifi-next-2025-06-25' of https://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-next Miri Korenblit says: ==================== iwlwifi-next - iwlwifi features Mostly cleanups. A few fixes and small features. ==================== Signed-off-by: Johannes Berg commit 40852c890119ebf39a741f50db13ae941f230d05 Author: Patrisious Haddad Date: Tue Jun 17 11:19:16 2025 +0300 RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables Support the creation of RDMA TRANSPORT tables over multiple priorities via matcher creation. Signed-off-by: Patrisious Haddad Reviewed-by: Mark Bloch Link: https://patch.msgid.link/bb38e50ae4504e979c6568d41939402a4cf15635.1750148083.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit e3ad987e9dc7d1e12e3f2f1e623f0e174cd0ca78 Author: Rand Deeb Date: Wed Mar 13 13:17:55 2024 +0300 wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() The 'index' variable in the rs_fill_link_cmd() function can reach LINK_QUAL_MAX_RETRY_NUM during the execution of the inner loop. This variable is used as an index for the lq_cmd->rs_table array, which has a size of LINK_QUAL_MAX_RETRY_NUM, without proper validation. Modify the condition of the inner loop to ensure that the 'index' variable does not exceed LINK_QUAL_MAX_RETRY_NUM - 1, thereby preventing any potential overflow issues. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Rand Deeb Link: https://patch.msgid.link/20240313101755.269209-1-rand.sec96@gmail.com Signed-off-by: Miri Korenblit commit 90a0d9f339960448a3acc1437a46730f975efd6a Author: Jiasheng Jiang Date: Tue Jan 10 09:48:48 2023 +0800 iwlwifi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue since it may return NULL pointer. Fixes: b481de9ca074 ("[IWLWIFI]: add iwlwifi wireless drivers") Signed-off-by: Jiasheng Jiang Link: https://patch.msgid.link/20230110014848.28226-1-jiasheng@iscas.ac.cn Signed-off-by: Miri Korenblit commit ed2e916c890944633d6826dce267579334f63ea5 Author: Xiu Jianfeng Date: Wed Nov 9 11:52:13 2022 +0800 wifi: iwlwifi: Fix memory leak in iwl_mvm_init() When iwl_opmode_register() fails, it does not unregster rate control, which will cause a memory leak issue, this patch fixes it. Fixes: 9f66a397c877 ("iwlwifi: mvm: rs: add ops for the new rate scaling in the FW") Signed-off-by: Xiu Jianfeng Link: https://patch.msgid.link/20221109035213.570-1-xiujianfeng@huawei.com Signed-off-by: Miri Korenblit commit a2393f3a6908f23d21c05ba57bc1b2a6b19c06e1 Author: Ruffalo Lavoisier Date: Mon Sep 19 15:40:54 2022 +0900 iwlwifi: api: delete repeated words - Delete the repeated word 'the' in the comment. Signed-off-by: Ruffalo Lavoisier Link: https://patch.msgid.link/20220919064055.17895-1-RuffaloLavoisier@gmail.com Signed-off-by: Miri Korenblit commit b8b3e85ca45e483509e1e93cf8a61c5a41bee6ce Author: Gaosheng Cui Date: Sun Sep 11 17:02:41 2022 +0800 iwlwifi: remove unused no_sleep_autoadjust declaration no_sleep_autoadjust has been removed since commit 84965795b290 ("iwlwifi: remove no_sleep_autoadjust"), so remove it. Signed-off-by: Gaosheng Cui Link: https://patch.msgid.link/20220911090241.3207201-3-cuigaosheng1@huawei.com Signed-off-by: Miri Korenblit commit b382523c840a032ae3a9987da9f2601977965962 Author: Jason Wang Date: Thu Aug 11 20:00:45 2022 +0800 iwlwifi: Fix comment typo The double `only' is duplicated in the comment, remove one. Signed-off-by: Jason Wang Link: https://patch.msgid.link/20220811120045.9422-1-wangborong@cdjrlc.com Signed-off-by: Miri Korenblit commit 436a90d30c0ea84d01be918dc9f2390d335b761c Author: Heiner Kallweit Date: Sun Mar 14 20:40:02 2021 +0100 iwlwifi: use DECLARE_BITMAP macro Use DECLARE_BITMAP macro to simplify the code. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/7dc766a7-7aca-5d24-955a-cf2a12039b31@gmail.com Signed-off-by: Miri Korenblit commit c14bfe8d458175ccb388a2b11cbd3bf676803770 Author: Zheng Yongjun Date: Wed Dec 9 17:37:34 2020 +0800 iwlwifi: fw: simplify the iwl_fw_dbg_collect_trig() Simplify the return expression. Signed-off-by: Zheng Yongjun Link: https://patch.msgid.link/20201209093734.20836-1-zhengyongjun3@huawei.com Signed-off-by: Miri Korenblit commit 8bc63120b08486e9f19e2cdd927de82c801ce273 Author: Johannes Berg Date: Tue Apr 22 16:00:18 2025 +0200 wifi: iwlwifi: mld: ftm: fix switch end indentation The terminating brace for the switch statement is erroneously not indented, fix that. Signed-off-by: Johannes Berg Link: https://patch.msgid.link/20250422160017.6d4cff49cbf4.I8e5570a6fe94faa9f17a89352b7ba645fc875e77@changeid Signed-off-by: Miri Korenblit commit 6ae66c95d996ce32eaf5e94094d392edf0415bc8 Author: Miri Korenblit Date: Wed Apr 30 11:26:07 2025 +0300 MAINTAINERS: update iwlwifi git link The link is wrong, fix it. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250430112552.1eb2dee64e96.Ic462b7be21af71a3c27eddb5b56e1b46f07ac91d@changeid Signed-off-by: Miri Korenblit commit 43049a3c00c8cb4af57b72ca77e3b09ae25b3ab4 Author: Johannes Berg Date: Thu Jun 12 14:48:59 2025 +0300 wifi: iwlwifi: pcie: fix non-MSIX handshake register When reading the interrupt status after a FW reset handshake timeout, read the actual value not the mask for the non-MSIX case. Fixes: ab606dea80c4 ("wifi: iwlwifi: pcie: add support for the reset handshake in MSI") Signed-off-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.83aafead6061.I2f8571aafa55aa3b936a30b938de9d260592a584@changeid commit 0cdb8ff6ebbac55f38933f4621215784887b400e Author: Miri Korenblit Date: Thu Jun 12 14:48:57 2025 +0300 wifi: iwlwifi: mld: don't exit EMLSR when we shouldn't There is a requirement to exit EMLSR if there wasn't enough throughput in the secondary link. This is checked in check_tpt_wk, which runs every 5 seconds in a high throughput scenario (when the throughput blocker isn't set) It can happen that this worker is running immediately after we entered EMLSR, and in that case the secondary link didn't have a chance to have throughput. In that case we will exit EMLSR for no good reason. Fix this by tracking the time we entered EMLSR, and in the worker make sure that 5 seconds passed from when we entered EMLSR. If not, don't check the secondary link throughput. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.c680f8d7dc37.I8a02d1e8d99df3789da8d5714f19b31a865a61ff@changeid commit dc6bc5112166390e0b64ff5f593bb8ff53b9c00e Author: Rotem Kerem Date: Thu Jun 12 14:48:56 2025 +0300 wifi: iwlwifi: move _iwl_trans_set_bits_mask utilities Move set_bits_mask utility functions to utils.h as they are generic utilities and is not hardware-dependent. Signed-off-by: Rotem Kerem Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.4049f1eda9fa.Iddcb6f7437beee2cfe232315384d8517b40c56d1@changeid commit 877924979ef0c696ff3f9eecbb6e79d831f13fdf Author: Miri Korenblit Date: Thu Jun 12 14:48:55 2025 +0300 wifi: iwlwifi: mld: make iwl_mld_add_all_rekeys void No one checks its return value anyway. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.4c38fb4c48f4.Ia62100a54370b6af5e528ba10c8f21e177018096@changeid commit 9feeb4caec93fdf838f23faa6e3f3b9c2f97f99c Author: Rotem Kerem Date: Thu Jun 12 14:48:54 2025 +0300 wifi: iwlwifi: move iwl_trans_pcie_write_mem to iwl-trans.c Move the iwl_trans_pcie_write_mem function to iwl_trans_write_mem in iwl-trans.c as it is not specific to PCIe. Signed-off-by: Rotem Kerem Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.52034d131773.Ie783304faae7ec3a95a510dfee925838fe6466b4@changeid commit e4efdfcaaf49bd3d5c507f694e94320383ab7983 Author: Rotem Kerem Date: Thu Jun 12 14:48:53 2025 +0300 wifi: iwlwifi: pcie: move iwl_trans_pcie_dump_regs() to utils.c Move the iwl_trans_pcie_dump_regs() function to utils.c in the PCIe directory since it operates on PCIe registers and is not hardware-dependent. Refactor the pcie_dbg_dumped_once indicator, previously part of the iwl_trans_pcie struct, into a static variable within the iwl_trans_pcie_dump_regs() function, where it is used. Signed-off-by: Rotem Kerem Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.06950459ce97.I3105158eb9ae698efebe4b9ada1093aeb1f1b869@changeid commit 69749bc08cc037d6dfcaa9955df9857f9172375b Author: Benjamin Berg Date: Thu Jun 12 14:48:52 2025 +0300 wifi: iwlwifi: mld: advertise support for TTLM changes The iwlmld driver is able to handle TTLM changes as long as all TIDs have the same TID to Link Mapping. Add the corresponding code so that mac80211 will accept and trigger the TTLM change. Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.3b0a4fd2c12b.I1fab7840f1cc222bd1e8cb58ac1a4177474fcd56@changeid commit b04e93bb6dd2005192fedf139d651bda94a4e34c Author: Ilan Peer Date: Thu Jun 12 14:48:51 2025 +0300 wifi: iwlwifi: mld: Block EMLSR when scanning on P2P Device Temporarily block EMLSR when scanning on a P2P Device interface, as this is an indication that P2P activity is about to start, e.g., P2P client connection to a P2P GO. Since a P2P scan while a station interface connection is active might be long, increase the EMLSR blocking timeout to 10 seconds. Signed-off-by: Ilan Peer Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.85fb79d537fe.I27523f8d3f00f2b66f5f555f098e323be29465ea@changeid commit b2c1f9b6e3aac9567c84208b73d716cc5d456404 Author: Benjamin Berg Date: Thu Jun 12 14:48:50 2025 +0300 wifi: iwlwifi: mld: use the correct struct size for tracing For the iwlmld driver the RX command is using struct iwl_rx_mpdu_desc and not the much older struct iwl_rx_mpdu_res_start. Adjust the value of rx_mpdu_cmd_hdr_size accordingly so that the trace data is correct. Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.688d95d99ff3.Id3055ca6c19cf8c821cbbd80c09ca2a21d9acec7@changeid commit 6a1b633fdcd904901db9162462b7c0f0897800e3 Author: Miri Korenblit Date: Thu Jun 12 14:48:49 2025 +0300 wifi: iwlwifi: support RZL platform device ID Add support for a new device ID that we will have on RZL. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.0c509d05fc51.I462e2ca5b636b88764177b9e41a63f7717f50793@changeid commit 873cc719523d835e7f85be8fab0a3c78b4c98162 Author: Johannes Berg Date: Thu Jun 12 14:48:48 2025 +0300 wifi: iwlwifi: add HE 1024QAM for <242-tone RU for PE For the new PE RF, this should also be supported. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144708.5716b631c59a.If81456c73a2d5834c29cbf410f7e642184c32b82@changeid commit ad80cb3c72dd85af6ef3c58882280418209eefb4 Author: Johannes Berg Date: Thu Jun 12 14:48:47 2025 +0300 wifi: iwlwifi: make FSEQ version a debug message This means nothing to a normal user and really has no value for most people, print it as a debug message instead. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250612144707.dce85795612b.I24807178fa7ddc7c2edfce3dc30f81bced846b35@changeid commit 12d0026ea3c2277eb054c8ec04f419f327a9da49 Author: Yuesong Li Date: Thu Jun 12 10:24:53 2025 +0800 wifi: iwlwifi: convert to use secs_to_jiffies() Since secs_to_jiffies()(commit:b35108a51cf7) has been introduced, we can use it to avoid scaling the time to msec. Signed-off-by: Yuesong Li Link: https://patch.msgid.link/20250612022501.3492345-1-liyuesong@vivo.com Signed-off-by: Miri Korenblit commit d41e3781c86415f1994ffdd266b28450847b7ddb Author: Johannes Berg Date: Wed Jun 11 22:26:34 2025 +0300 wifi: iwlwifi: fw: make PNVM version a debug message This means nothing to a normal user and really has no value for most people, print it as a debug message instead. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.0f77cb90aa20.I06f2adca38d012a71cde3956e1d2005293f70604@changeid commit 8ddf4e19de1e98091ace48626b9245f9d985a6bd Author: Johannes Berg Date: Wed Jun 11 22:26:33 2025 +0300 wifi: iwlwifi: mld: make PHY config a debug message This means nothing to a normal user and really has no value for most people, print it as a debug message instead. Signed-off-by: Johannes Berg Reviewed-by: Emmanuel Grumbach Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.ee6254c03a33.I2cf4e1e2e604b42b6eb9737c0ef3b75fec69edea@changeid commit 7ca8176b8eef3fda6f78f398c37d45739962c902 Author: Johannes Berg Date: Wed Jun 11 22:26:32 2025 +0300 wifi: iwlwifi: mvm: fix kernel-doc warnings Some kernel-doc warnings remain, fix them. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.f238dd2937ed.I1b42df920b0f057a7d7ac01e61201621229a444c@changeid commit 4f372263ef92ed2af55a8c226750b72021ff8d0f Author: Johannes Berg Date: Wed Jun 11 22:26:31 2025 +0300 wifi: iwlwifi: mei: fix kernel-doc warnings Fix some warnings and fill in some TBDs while at it. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.30bd10804d19.I21e7be2df56f20e1215dc35d94f3225708c5d74f@changeid commit edc34789ca3387062d2d6a0bd06e2cb5cfc9ac4c Author: Johannes Berg Date: Wed Jun 11 22:26:30 2025 +0300 wifi: iwlwifi: pcie: fix kernel-doc warnings Also fix the name of the iwl_prph_scratch_mem_desc_addr_array struct and some related spelling. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.ca2dec14f107.Ia4cfeea63e946f3b54e3e6b7bd6ab81130b0a7e6@changeid commit 51512b654f1ca543cb7fbf24235671581c2180a9 Author: Johannes Berg Date: Wed Jun 11 22:26:29 2025 +0300 wifi: iwlwifi: dvm: fix some kernel-doc issues Fix a couple of kernel-doc warnings in the old DVM code. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.b33528d06431.I948261d6610c47f09133fa73f5e5ea9b9848fd21@changeid commit 9748ad82a9d92b036ff3115207e36e2b9932e354 Author: Johannes Berg Date: Wed Jun 11 22:26:28 2025 +0300 wifi: iwlwifi: defer MLO scan after link activation Doing a scan right after link activation can be less reliable than at other times, as the firmware is still busy trying to catch beacons from the just activated link, etc. In case a new MLO scan request comes in, defer it for a few seconds after a link activation. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.09548e958a9e.I24dbfd425da260f3ae6fa5a48fe25bd4ab6fcf99@changeid commit f26281c1b727b90ec18ae90044d5f429d2250e82 Author: Johannes Berg Date: Wed Jun 11 22:26:27 2025 +0300 wifi: iwlwifi: mld: fix last_mlo_scan_time type This should be u64, otherwise it rolls over quickly on 32-bit systems. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.5381030253cd.I4e3a7bca5b52fc826e26311055286421508c4d1b@changeid commit 1cc04e196a59d27ac2ac19e2e0b4ad041a626a69 Author: Johannes Berg Date: Wed Jun 11 22:26:26 2025 +0300 wifi: iwlwifi: mld: remove special FW error resume handling The (applicable) firmware versions will send an error interrupt as part of the resume process, so there's no need now to check for it explicitly. Simplify the code. This also fixes an issue where any dump taken during the resume isn't able to do the reset handshake as part of the dump (since interrupts are disabled) and then there isn't all the correct data and we get more errors later. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.9e778f1bae0c.I96483b5236ab23141b45079464c73f93e0164e65@changeid commit bc0440eeaf829b2840e9d4f946551c0c6fe9f9e3 Author: Johannes Berg Date: Wed Jun 11 22:26:25 2025 +0300 wifi: iwlwifi: mld: add timer host wakeup debugfs Add a debugfs file to be able to control how long, at most, the device will sleep before waking up the host. This will be useful to test certain "assert during suspend" scenarios for the previous change. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.9f2a39cae1e1.Ie0003f21286fea50b507d0debe06332b030cd4cb@changeid commit 7a7cb2eb54592b8fa8e59740fb61603c9f3f16bf Author: Or Ron Date: Wed Jun 11 22:26:24 2025 +0300 wifi: iwlwifi: phy periph read - flow modification If for some reason the reading of phy prph fails, there is no reason to keep reading them. Check the status abd break early in such case. Signed-off-by: Or Ron Reviewed-by: Eilon Rinat Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.124ce6613edd.Ic1aad57cc6163f0551a3dafae048434f4a2fe7f5@changeid commit cc8d9cbf269dab363c768bfa9312265bc807fca5 Author: Pagadala Yesu Anjaneyulu Date: Wed Jun 11 22:26:23 2025 +0300 wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect Ensure descriptor is freed on error to avoid memory leak. Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.8158d15ec866.Ifa3e422c302397111f20a16da7509e6574bc19e3@changeid commit 8dab046d6e569d60a002d8256be22be2c8b522cf Author: Pagadala Yesu Anjaneyulu Date: Wed Jun 11 22:26:22 2025 +0300 wifi: iwlwifi: mld: Add dump handler to iwl_mld Implement a dump handler in the iwl_mld operation mode to collect firmware dump upon trigger from trans layer. Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.18ebf46690ce.Ia52941f761a446cb3e43cbe49d2b9a49fc15f4a8@changeid commit 5943ce4e37dbae7cc11740609b165d0fb4b7df08 Author: Pagadala Yesu Anjaneyulu Date: Wed Jun 11 22:26:21 2025 +0300 wifi: iwlwifi: add support for the devcoredump This handler will be used by upcoming changes to trigger firmware dumps from devcoredump through trans layer. Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.bb38efe6700d.I9c666440dd1eac13ac52a2c2d533224c36fea2a6@changeid commit 8689bc3fc017d445f48b6b9e80a8c2c0aa3961af Author: Johannes Berg Date: Wed Jun 11 22:26:20 2025 +0300 wifi: iwlwifi: pcie: abort D3 handshake on error The D3 handshake can be interrupted by an error, especially on resume where we no longer want to check explicitly for errors. Expand the sx_complete to sx_state and handle any errors occurring during the handshake. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250611222325.157dca92c573.I6dd3b9d2f435c2c363224aa84e373931e56a545f@changeid commit eda36f5195d6c078e20331f1dfcf688bd6567c2b Author: Johannes Berg Date: Mon Jun 9 21:21:21 2025 +0300 wifi: iwlwifi: pcie: reinit device properly during TOP reset During TOP reset a full _iwl_trans_pcie_start_hw() is needed so the device is properly initialized for operation. Fix that. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.903444f8e8e8.I7f70600339abb9d658f97924aef22faf1af00a3c@changeid commit 6efaf59ffa3712db9562e8243492d69d32765e3a Author: Johannes Berg Date: Mon Jun 9 21:21:20 2025 +0300 wifi: iwlwifi: mld: fix misspelling of 'established' This got pretty mangled, fix the spelling. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.afbb67d4dda9.Id1412d9336740e6101e672b38411641c6e206999@changeid commit 2110d001db47dd5a6b58c399ea3524dc3c572065 Author: Pagadala Yesu Anjaneyulu Date: Mon Jun 9 21:21:19 2025 +0300 wifi: iwlwifi: Remove unused cfg parameter from iwl_nvm_get_regdom_bw_flags Refactor iwl_nvm_get_regdom_bw_flags() by removing the unused cfg parameter to enhance code clarity and maintainability Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.987b1a749b78.I11a67c0737fb39b594831c10f62de1a195ed24e3@changeid commit 40840afa53bed05b990b201d749dfee3bd6e7e42 Author: Benjamin Berg Date: Mon Jun 9 21:21:18 2025 +0300 wifi: iwlwifi: move dBm averaging function into utils The function really is just a simple math helper. Move it into iwl-utils.c so that it can also be used by iwlmld. Signed-off-by: Benjamin Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.8cc965af6990.I09bb2137863e888efe756c92d8eb0271ec95456c@changeid commit 8ecc3928f26a99c4e46d6dfb78c1d229ab8c9578 Author: Johannes Berg Date: Mon Jun 9 21:21:17 2025 +0300 wifi: iwlwifi: pcie: initiate TOP reset if requested At load time, the firmware may request a TOP reset via bit 6 in the IPC status register. Handle that and set TOP reset in that case. Since the init will be retried, there's no need to do anything else. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.0875d5f7e066.I62f14008d89416bc4a3a1056e06762561a7fac57@changeid commit c8a00a6e89ffee419a9190d2af9c75a7afe196d2 Author: Miri Korenblit Date: Mon Jun 9 21:21:16 2025 +0300 wifi: iwlwifi: pcie: move generation specific files to a folder As a new generation of pcie is going to be written, we will need a folder for each generation. Since gen1 and gen2 code is tightly coupled and has with shared logic - it is not really separable. Put the code of both in one folder. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.bb0757c326c5.I66345c2b3fda55dcb8ff779c64de72d5c19f6649@changeid commit 13c258fd60ff1461b963f2f1d27eba4228836749 Author: Itamar Shalev Date: Mon Jun 9 21:21:15 2025 +0300 wifi: iwlwifi: mvm: enable antenna selection for AX210 family Support for the `set antenna` command on AX210 family. Signed-off-by: Itamar Shalev Tested-by: Miriam Rachel Korenblit Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.098c7bc296f6.I1cb4e99aa2f5a3852e24e2d32795bae3a4a73742@changeid commit 14beeed861b9ae3e1db3aad19d2592e496aeae4c Author: Pagadala Yesu Anjaneyulu Date: Mon Jun 9 21:21:14 2025 +0300 wifi: iwlwifi: parse VLP AP not allowed nvm channel flag OEMs need the option to enable/disable VLP AP. Add NVM flag to control VLP AP configuration. Signed-off-by: Pagadala Yesu Anjaneyulu Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.a433cb0ea0f3.Ifc6d7ba96d200dca0e3d38ec8d71625fd81a10ae@changeid commit 34e33e39f405bd85270e9c89d9d547aab5bcc4fb Author: Miri Korenblit Date: Mon Jun 9 21:21:13 2025 +0300 wifi: iwlwifi: bump minimum API version in BZ/SC/DR Stop supporting older FWs. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.aeeef3290d03.I2433bfe9def643b5f4c0e77ff3cf8cd1285f5aad@changeid commit 4aa765af7983d51eafa13d76398045a5e687b73d Merge: b5eeb8365d196c 52931f55159ea5 Author: Leon Romanovsky Date: Wed Jun 25 03:57:23 2025 -0400 Add multiple priorities support to mlx5 RDMA TRANSPORT tables From Patrisious: This short series from Patrisious extends mlx5 flow steering logic to allow creation rule creation with priorities in RDMA TRANSPORT tables. Thanks Link: https://lore.kernel.org/all/cover.1750148083.git.leon@kernel.org Signed-off-by: Leon Romanovsky * mlx5-next: (200 commits) net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain Linux 6.16-rc2 ... commit 52931f55159ea5c27ad4fe66fc0cb8ad75ab795b Author: Patrisious Haddad Date: Tue Jun 17 11:19:15 2025 +0300 net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain RDMA TRANSPORT domains were initially limited to a single priority. This change allows the domains to have multiple priorities, making it possible to add several rules and control the order in which they're evaluated. Signed-off-by: Patrisious Haddad Reviewed-by: Mark Bloch Link: https://patch.msgid.link/b299cbb4c8678a33da6e6b6988b5bf6145c54b88.1750148083.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 23b33cf1244185d0432b25afdc04f2fe47a1cc2e Author: Bartosz Golaszewski Date: Wed Jun 18 09:46:53 2025 +0200 gpio: clps711x: drop unneeded platform_set_drvdata() There's no corresponding platform_get_drvdata() used in this module or the higher-level gpio-mmio. Let's remove the unneeded call to platform_set_drvdata(). Link: https://lore.kernel.org/r/20250618074653.25555-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit b5eeb8365d196c95dbb0fd0a5b5a69a44832f16f Author: Mark Zhang Date: Mon Jun 16 13:42:38 2025 +0300 RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq - pre_destroy_cq: Destroy FW CQ object so that no new CQ event would be generated; - post_destroy_cq: Release all resources. This patch, along with last one, fixes the crash below. Unable to handle kernel paging request at virtual address ffff8000114b1180 Mem abort info: ESR = 0x96000047 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000047 CM = 0, WnR = 1 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000f4582000 [ffff8000114b1180] pgd=00000447fffff003, p4d=00000447fffff003, pud=00000447ffffe003, pmd=00000447ffffb003, pte=0000000000000000 Internal error: Oops: 96000047 [#1] SMP Modules linked in: udp_diag uio_pci_generic uio tcp_diag inet_diag binfmt_misc sn_core_odd(OE) rpcrdma(OE) xprtrdma(OE) ib_isert(OE) ib_iser(OE) ib_srpt(OE) ib_srp(OE) ib_ipoib(OE) kpatch_9658536(OK) kpatch_9322385(OK) kpatch_8843421(OK) kpatch_8636216(OK) vfat fat aes_ce_blk crypto_simd cryptd aes_ce_cipher crct10dif_ce ghash_ce sm4_ce sha2_ce sha256_arm64 sha1_ce sbsa_gwdt sg acpi_ipmi ipmi_si ipmi_msghandler m1_uncore_ddrss_pmu m1_uncore_cmn_pmu team_yosemite9rc6(OE) vnic(OE) ip_tables mlx5_ib(OE) sd_mod ast mlx5_core(OE) i2c_algo_bit drm_vram_helper psample drm_kms_helper mlxdevm(OE) auxiliary(OE) mlxfw(OE) syscopyarea sysfillrect tls sysimgblt fb_sys_fops drm_ttm_helper nvme ttm nvme_core drm t10_pi i2c_designware_platform i2c_designware_core i2c_core ahci libahci libata rdma_ucm(OE) ib_uverbs(OE) rdma_cm(OE) iw_cm(OE) ib_cm(OE) ib_umad(OE) ib_core(OE) ib_ucm(OE) mlx_compat(OE) [last unloaded: ipmi_devintf] CPU: 83 PID: 59375 Comm: kworker/u253:1 Kdump: loaded Tainted: G OE K 5.10.84-004.ali5000.alios7.aarch64 #1 Hardware name: Inspur AliServer-Xuanwu2.0AM-02-2UM1P-5B/AS1221MG1, BIOS 1.2.M1.AL.P.158.00 08/31/2023 Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core] pstate: 82c00089 (Nzcv daIf +PAN +UAO +TCO BTYPE=--) pc : native_queued_spin_lock_slowpath+0x1c4/0x31c lr : mlx5_ib_poll_cq+0x18c/0x2f8 [mlx5_ib] sp : ffff80002be1bc80 x29: ffff80002be1bc80 x28: ffff000810e69000 x27: ffff000810e69000 x26: ffff000810e69200 x25: 0000000000000000 x24: ffff8000117db000 x23: ffff04000156b780 x22: 0000000000000000 x21: ffff04000ce6c160 x20: ffff0008196a4000 x19: 0000000000000010 x18: 0000000000000020 x17: 0000000000000000 x16: 0000000000000000 x15: ffff040055a364e8 x14: ffffffffffffffff x13: ffff80002318bda8 x12: ffff0400358836e8 x11: 0000000000000040 x10: 0000000000000eb0 x9 : 0000000000000000 x8 : 0000000000000000 x7 : ffff04477fa20140 x6 : ffff8000114b1140 x5 : ffff04477fa20140 x4 : ffff8000114b1180 x3 : ffff000810e69200 x2 : ffff8000114b1180 x1 : 0000000001500000 x0 : ffff04477fa20148 Call trace: native_queued_spin_lock_slowpath+0x1c4/0x31c __ib_process_cq+0x74/0x1b8 [ib_core] ib_cq_poll_work+0x34/0xa0 [ib_core] process_one_work+0x1d8/0x4b0 worker_thread+0x180/0x440 kthread+0x114/0x120 Code: 910020e0 8b0400c4 f862d929 aa0403e2 (f8296847) ---[ end trace 387be2290557729c ]--- Kernel panic - not syncing: Oops: Fatal exception SMP: stopping secondary CPUs Kernel Offset: disabled CPU features: 0x9850817,7a60aa38 Memory Limit: none Starting crashdump kernel... Bye! Signed-off-by: Mark Zhang Link: https://patch.msgid.link/aaf0072f350d1c7e8731f43b79e11a560bafb9e0.1750070205.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 5a2a5b65d5d67279be9e1f0e4b9baf39ee594cb1 Author: Mark Zhang Date: Mon Jun 16 11:26:20 2025 +0300 RDMA/core: Add driver APIs pre_destroy_cq() and post_destroy_cq() Currently in ib_free_cq, it disables IRQ or cancel the CQ work before driver destroy_cq. This isn't good as a new IRQ or a CQ work can be submitted immediately after disabling IRQ or canceling CQ work, which may run concurrently with destroy_cq and cause crashes. The right flow should be: 1. Driver disables CQ to make sure no new CQ event will be submitted; 2. Disables IRQ or Cancels CQ work in core layer, to make sure no CQ polling work is running; 3. Free all resources to destroy the CQ. This patch adds 2 driver APIs: - pre_destroy_cq(): Disable a CQ to prevent it from generating any new work completions, but not free any kernel resources; - post_destroy_cq(): Free all kernel resources. In ib_free_cq, the IRQ is disabled or CQ work is canceled after pre_destroy_cq, and before post_destroy_cq. Fixes: 14d3a3b2498e ("IB: add a proper completion queue abstraction") Signed-off-by: Mark Zhang Link: https://patch.msgid.link/b5f7ae3d75f44a3e15ff3f4eb2bbdea13e06b97f.1750062328.git.leon@kernel.org Signed-off-by: Leon Romanovsky commit 5582cbdf7bb5d048414967b902553d70d93694a0 Merge: 7322a7d80c48f8 16d8fd74dbfca0 Author: Johannes Berg Date: Wed Jun 25 08:47:03 2025 +0200 Merge tag 'rtw-next-2025-06-25' of https://github.com/pkshih/rtw Ping-Ke Shih says: ================== rtw-next patches for v6.17 Regular development, refinement and minor fixes. Some notable changes are: rtw88: * enable AP/ad-hoc modes for SDIO devices rtw89: * implement BT-coexistence for WiFi MLO * ongoing to develop STA+P2P MCC ================== Signed-off-by: Johannes Berg commit 103d567f51e0eaee441bb26769e443a719299412 Author: Paul E. McKenney Date: Thu May 15 13:54:56 2025 -0700 torture: Default --no-clocksourcewd on arm64 Because arm64 does not support CONFIG_CLOCKSOURCE_WATCHDOG=n kernels, --do-clocksourcewd gets Kconfig errors. This commit therefore makes --do-no-clocksourcewd be the default on arm64. Note that arm64 users can still specify --do-clocksourcewd in order to override this default. Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit 1524f2032aad74f604a54d5a5cbb8b214f4da41c Author: Paul E. McKenney Date: Thu May 15 13:38:56 2025 -0700 torture: Default --no-rcutasksflavors on arm64 Because arm64 does not support CONFIG_SMP=n kernels, --do-rcutasksflavors gets Kconfig errors when running the TINY01 rcutorture scenario. This commit therefore makes --no-rcutasksflavors be the default on arm64. Once kvm.sh automatically deselects CONFIG_SMP=n rcutorture scenarios on arm64, the two lines marked "FIXME" can be changed back from "${ifnotaarch64}" to "yes". Note that arm64 users can still specify --do-rcutasksflavors in order to override this default. Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit 955a83469cb46a1bc4339425e5c9cb97fc6303a0 Author: Paul E. McKenney Date: Thu May 15 10:20:08 2025 -0700 torture: Make torture.sh KCSAN runs set CONFIG_RCU_TORTURE_TEST_CHK_RDR_STATE=y The RCU_TORTURE_TEST_CHK_RDR_STATE Kconfig option is used for low-level debugging of rcutorture's generation of overlapping and nested RCU readers. It incurs significant overhead, and is thus not to be used lightly. But if it is not tested regularly, it won't be there when it is needed, for example, it would have found an rcutorture bug in the testing of srcu_up_read(). This commit therefore uses CONFIG_RCU_TORTURE_TEST_CHK_RDR_STATE=y when building KCSAN kernels, but only for the --do-rcutorture case. Reported-by: kernel test robot Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit 4176ebdf97d1ad08e205ec97a8f5b66f9efa70bf Author: Paul E. McKenney Date: Thu May 15 15:25:42 2025 -0700 torture: Permit multiple space characters in kvm.sh --kconfig argument The straightforward way of doing bash substitution for optional strings leaves a pair of space characters, which the kvm.sh --kconfig option rejects as ill-formed. This commit therefore changes the corresponding regular expression to accommodate more than one space character between successive Kconfig options. Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit e40e2391388d8db623fd2ac92d7750648155e9d3 Author: Paul E. McKenney Date: Thu May 8 16:44:58 2025 -0700 torture: Suppress torture.sh "Zero time" messages for disabled tests The torture.sh script prints " --- Zero time for locktorture, disabling" when the --duration parameter is too short to allow the test to run even when locktorture has been disabled, for example, via --do-none. The same is true for scftorture and rcutorture. This commit therefore suppresses this message when the corresponding test has been disabled. Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 3b16e77e0706eb6cdfc850956ee1ed5e5c36c6ca Author: Paul E. McKenney Date: Fri Jun 6 06:29:19 2025 -0700 rcutorture: Make BUSTED scenario check and log readers Because the BUSTED scenario intentionally executes too-short readers, this commit enables the RCU_TORTURE_TEST_CHK_RDR_STATE, RCU_TORTURE_TEST_LOG_CPU, and RCU_TORTURE_TEST_LOG_GP Kconfig options to test the resulting reader-segment dump. Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit 8d71351d88e478d3c4e945e3218e97ec677fd807 Author: Zqiang Date: Wed May 7 19:26:03 2025 +0800 rcutorture: Fix rcutorture_one_extend_check() splat in RT kernels For built with CONFIG_PREEMPT_RT=y kernels, running rcutorture tests resulted in the following splat: [ 68.797425] rcutorture_one_extend_check during change: Current 0x1 To add 0x1 To remove 0x0 preempt_count() 0x0 [ 68.797533] WARNING: CPU: 2 PID: 512 at kernel/rcu/rcutorture.c:1993 rcutorture_one_extend_check+0x419/0x560 [rcutorture] [ 68.797601] Call Trace: [ 68.797602] [ 68.797619] ? lockdep_softirqs_off+0xa5/0x160 [ 68.797631] rcutorture_one_extend+0x18e/0xcc0 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797646] ? local_clock+0x19/0x40 [ 68.797659] rcu_torture_one_read+0xf0/0x280 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797678] ? __pfx_rcu_torture_one_read+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797804] ? __pfx_rcu_torture_timer+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797815] rcu-torture: rcu_torture_reader task started [ 68.797824] rcu-torture: Creating rcu_torture_reader task [ 68.797824] rcu_torture_reader+0x238/0x580 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] [ 68.797836] ? kvm_sched_clock_read+0x15/0x30 Disable BH does not change the SOFTIRQ corresponding bits in preempt_count() for RT kernels, this commit therefore use softirq_count() to check the if BH is disabled. Reviewed-by: Paul E. McKenney Signed-off-by: Zqiang Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 5f2417ba05541332f334b557febc3af355317f2b Author: Paul E. McKenney Date: Fri May 16 14:20:46 2025 -0700 rcutorture: Make Trivial RCU ignore onoff_interval and shuffle_interval Trivial RCU is a textbook implementation that is not used in the Linux kernel, but tested to keep textbooks (and presentations) honest. It is so trivial that it cannot deal with either CPU hotplug or external migration from one CPU to another. This commit therefore splats whenever onoff_interval or shuffle_interval are non-zero, and then sets them to zero in order to avoid false-positive failures. Those wishing to set these module parameters in order to force failures in Trivial RCU are free to revert this commit. Just don't expect me to be sympathetic to any resulting bug reports! Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202505131651.af6e81d7-lkp@intel.com Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit f32367d96eba8fc50a0bbd2a792df3199089d13b Author: Paul E. McKenney Date: Wed May 14 21:09:05 2025 -0700 rcutorture: Drop redundant "insoftirq" parameters Given that the rcutorture_one_extend_check() function now uses in_serving_softirq() and in_hardirq(), it is no longer necessary to pass insoftirq flags down the function-call stack. This commit therefore removes those flags, and, while in the area, does a bit of whitespace cleanup. Signed-off-by: Paul E. McKenney Tested-by: kernel test robot Signed-off-by: Neeraj Upadhyay (AMD) commit cacba0bf6d9f7568e115f3ffe32a95c33f5fd885 Author: Paul E. McKenney Date: Wed Apr 16 11:22:49 2025 -0700 rcutorture: Print number of RCU up/down readers and migrations This commit prints the number of RCU up/down readers and the number of such readers that migrated from one CPU to another, along with the rest of the periodic rcu_torture_stats_print() output. These statistics are currently used only by srcu_down_read{,_fast}() and srcu_up_read(,_fast)(). Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit f6c8785f50443db4c70faebfc22e59e8064c35a5 Author: Paul E. McKenney Date: Thu May 8 16:45:00 2025 -0700 rcutorture: Check for no up/down readers at task level The design of testing of up/down readers such as srcu_down_read() and srcu_up_read() assumes that these are tested only by the rcu_torture_updown() kthread, and never by the rcu_torture_reader() kthread. Because we all know which road is paved with good intentions, this commit adds WARN_ON_ONCE() to verify that things are going to plan. Signed-off-by: Paul E. McKenney Signed-off-by: Neeraj Upadhyay (AMD) commit 93856948be8f5d784a28cfb2eb16884a5522faaa Author: Paul E. McKenney Date: Mon Feb 10 09:29:35 2025 -0800 rcutorture: Check for ->up_read() without matching ->down_read() This commit creates counters in the rcu_torture_one_read_state_updown structure that check for a call to ->up_read() that lacks a matching call to ->down_read(). While in the area, add end-of-run cleanup code that prevents calls to rcu_torture_updown_hrt() from happening after the test has moved on. Yes, the srcu_barrier() at the end of the test will wait for them, but this could result in confusing states, statistics, and diagnostic information. So explicitly wait for them before we get to the end-of-test output. [ paulmck: Apply kernel test robot feedback. ] [ joel: Apply Boqun's fix for counter increment ordering. ] Signed-off-by: Paul E. McKenney Tested-by: kernel test robot Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 62d92c9b87db43cc255411fe2827b9de42fa0523 Author: Paul E. McKenney Date: Mon Feb 10 06:59:24 2025 -0800 rcutorture: Complain if an ->up_read() is delayed more than 10 seconds The down/up SRCU reader testing uses an hrtimer handler to exit the SRCU read-side critical section. This might be delayed, and if delayed for too long, it can prevent the rcutorture run from completing. This commit therefore complains if the hrtimer handler is delayed for more than ten seconds. [ paulmck, joel: Apply kernel test robot feedback to avoid false-positive complaint of excessive ->up_read() delays by using HRTIMER_MODE_HARD ] Tested-by: kernel test robot Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 065de24265155fe662aa9f69a49e0697a5b3b4b5 Author: Paul E. McKenney Date: Sun Feb 9 04:58:36 2025 -0800 rcutorture: Pull rcu_torture_updown() loop body into new function This is strictly a code-movement commit, pulling that part of the rcu_torture_updown() function's loop body that processes one rcu_torture_one_read_state_updown structure into a new rcu_torture_updown_one() function. The checks for the end of the torture test and the current structure being in use remain in the rcu_torture_updown() function. Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 1b67e031d478bf386282c7c5ff3f19cd9c1e5a39 Author: Paul E. McKenney Date: Fri Feb 7 11:37:55 2025 -0800 rcutorture: Add tests for SRCU up/down reader primitives This commit adds a new rcutorture.n_up_down kernel boot parameter that specifies the number of outstanding SRCU up/down readers, which begin in kthread context and end in an hrtimer handler. There is a new kthread ("rcu_torture_updown") that scans an per-reader array looking for elements whose readers have ended. This kthread sleeps between one and two milliseconds between consecutive scans. [ paulmck: Apply kernel test robot feedback. ] [ paulmck: Apply Z qiang feedback. ] [ joel: Fix build error: hrtimer_init is replaced by hrtimer_setup. ] [ joel: Apply Boqun bug fix to drop extra up_read() call in rcu_torture_updown()]. Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes Tested-by: kernel test robot Signed-off-by: Neeraj Upadhyay (AMD) commit eec1f94cf77f8a7f7078365f5029a56b0ce16580 Author: Paul E. McKenney Date: Wed Jun 4 12:42:14 2025 -0700 rcutorture: Make rcutorture_one_extend_check() account for hard IRQs This commit retrospectively prepares for testing of RCU readers invoked from hardware interrupt handlers (for example, HRTIMER_MODE_HARD hrtimer handlers) in kernels built with CONFIG_RCU_TORTURE_TEST_CHK_RDR_STATE=y, which is rarely used but sometimes extremely useful. This preparation involves taking early exits if in_hardirq(), and, while we are in the area, a very early exit if in_nmi(). This means that a number of insoftirq parameters are no longer needed, but that is the subject of a later commit. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-lkp/202505140917.8ee62cc6-lkp@intel.com Signed-off-by: Paul E. McKenney Tested-by: kernel test robot Signed-off-by: Neeraj Upadhyay (AMD) commit 635bdb9d22796fc6ba1958ec73ab0a0a693c58d6 Author: Paul E. McKenney Date: Thu May 8 16:45:01 2025 -0700 rcutorture: Start rcu_torture_writer() after rcu_torture_reader() Testing of rcutorture's SRCU-P scenario on a large arm64 system resulted in rcu_torture_writer() forward-progress failures, but these same tests passed on x86. After some off-list discussion of possible memory-ordering causes for these failures, Boqun showed that these were in fact due to reordering, but by the scheduler, not by the memory system. On x86, rcu_torture_writer() would have run quickly enough that by the time the rcu_torture_updown() kthread started, the rcu_torture_current variable would already be initialized, thus avoiding a bug in which a NULL value would cause rcu_torture_updown() to do an extra call to srcu_up_read_fast(). This commit therefore moves creation of the rcu_torture_writer() kthread after that of the rcu_torture_reader() kthreads. This results in deterministic failures on x86. What about the double-srcu_up_read_fast() bug? Boqun has the fix. But let's also fix the test while we are at it! Reported-by: Joel Fernandes Reported-by: Boqun Feng Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 9ea40db969115022335a553b4f6fe731dcd90c2a Author: Paul E. McKenney Date: Thu May 8 16:45:02 2025 -0700 rcutorture: Print only one rtort_pipe_count splat The rcu_torture_writer() function scans the memory blocks after a stutter (or forced idle) interval, complaining about any that have not passed through ten grace periods since the start of the stutter interval. But one splat suffices, so this commit therefore stops at the first splat. Signed-off-by: Paul E. McKenney Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 3dfdfaff2d49aa7895ced8a54e7d61755eac6830 Author: Frederic Weisbecker Date: Tue Apr 29 12:08:40 2025 +0200 rcu: Robustify rcu_is_cpu_rrupt_from_idle() RCU relies on the context tracking nesting counter in order to determine if it is running in extended quiescent state. However the context tracking nesting counter is not completely synchronized with the actual context tracking state: * The nesting counter is set to 1 or incremented further _after_ the actual state is set to RCU watching. * The nesting counter is set to 0 or decremented further _before_ the actual state is set to RCU not watching. Therefore it is safe to assume that if ct_nesting() > 0, RCU is watching. But if ct_nesting() <= 0, RCU is not watching except for tiny windows. This hasn't been a problem so far because rcu_is_cpu_rrupt_from_idle() has only been called from interrupts. However the code is confusing and abuses the role of the context tracking nesting counter while there are more accurate indicators available. Clarify and robustify accordingly. Signed-off-by: Frederic Weisbecker Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit f2e555fc04ba238cd1dd21040325fa0629ee433d Author: Frederic Weisbecker Date: Tue Apr 29 15:43:00 2025 +0200 rcu/exp: Protect against early QS report When a grace period is started, the ->expmask of each node is set up from sync_exp_reset_tree(). Then later on each leaf node also initialize its ->exp_tasks pointer. This means that the initialization of the quiescent state of a node and the initialization of its blocking tasks happen with an unlocked node gap in-between. It happens to be fine because nothing is expected to report an exp quiescent state within this gap, since no IPI have been issued yet and every rdp's ->cpu_no_qs.b.exp should be false. However if it were to happen by accident, the quiescent state could be reported and propagated while ignoring tasks that blocked _before_ the start of the grace period. Prevent such trouble to happen in the future and initialize both the quiescent states mask to report and the blocked tasks head from the same node locked block. If a task blocks within an RCU read side critical section before sync_exp_reset_tree() is called and is then unblocked between sync_exp_reset_tree() and __sync_rcu_exp_select_node_cpus(), the QS won't be reported because no RCU exp IPI had been issued to request it through the setting of srdp->cpu_no_qs.b.exp. Reviewed-by: Paul E. McKenney Signed-off-by: Frederic Weisbecker Signed-off-by: Joel Fernandes Signed-off-by: Neeraj Upadhyay (AMD) commit 63d0a9123120a2e10861ac7f6dc474bee653d3b2 Author: Ujwal Jain Date: Sat Jun 14 16:47:11 2025 +0800 kunit: Adjust kunit_test timeout based on test_{suite,case} speed Currently, the in-kernel kunit test case timeout is 300 seconds. (There is a separate timeout mechanism for the whole test execution in kunit.py, but that's unrelated.) However, tests marked 'slow' or 'very slow' may timeout, particularly on slower machines. Implement a multiplier to the test-case timeout, so that slower tests have longer to complete: - DEFAULT -> 1x default timeout - KUNIT_SPEED_SLOW -> 3x default timeout - KUNIT_SPEED_VERY_SLOW -> 12x default timeout A further change is planned to allow user configuration of the default/base timeout to allow people with faster or slower machines to adjust these to their use-cases. Link: https://lore.kernel.org/r/20250614084711.2654593-2-davidgow@google.com Signed-off-by: Ujwal Jain Co-developed-by: David Gow Signed-off-by: David Gow Reviewed-by: Rae Moar Signed-off-by: Shuah Khan commit 2560014ec150fd41b969ea6bcf8a985ae910eea5 Author: Al Viro Date: Sun Dec 1 19:46:43 2024 -0500 loongarch, um, xtensa: get rid of generated arch/$ARCH/include/asm/param.h For loongarch and xtensa that gets them to do what x86 et.al. are doing - have asm/param.h resolve to uapi variant, which is generated by mandatory-y += param.h and contains exact same include. On um it will resolve to x86 uapi variant instead, which also contains the same include (um doesn't have uapi headers, but it does build the host ones). Reviewed-by: Arnd Bergmann Signed-off-by: Al Viro commit f65bbf05392b44714ccdcc4b5b1bebfd471d2665 Author: Al Viro Date: Sun Dec 1 19:28:34 2024 -0500 alpha: regularize the situation with asm/param.h The only reason why alpha can't do what sparc et.al. are doing is that include/asm-generic/param.h relies upon the value of HZ set for userland header in uapi/asm/param.h being 100. We need that value to define USER_HZ and we need that definition to outlive the redefinition of HZ kernel-side. And alpha needs it to be 1024, not 100 like everybody else. So let's add __USER_HZ to uapi/asm-generic/param.h, defaulting to 100 and used to define HZ. That way include/asm-generic/param.h can use that thing instead of open-coding it - it won't be affected by undefining and redefining HZ. That done, alpha asm/param.h can be removed and uapi/asm/param.h switched to defining __USER_HZ and EXEC_PAGESIZE and then including - asm/param.h will resolve to uapi/asm/param.h, which pulls , which will do the right thing both in the kernel and userland contexts. Reviewed-by: Arnd Bergmann Signed-off-by: Al Viro commit 674e55efe43da34d00d349a2d9a2d2e40b711b48 Author: Al Viro Date: Sun Dec 1 18:48:57 2024 -0500 xtensa: get rid uapi/asm/param.h The only difference between it and generic is the stray (and utterly useless) definition of NGROUPS. It had been removed on all architectures back in 2004; xtensa port began prior to that and hadn't been merged until 2005, so it had missed the purge. Reviewed-by: Arnd Bergmann Signed-off-by: Al Viro commit 3713b584dabb1f34a31f33e6a956df00ad8bcc65 Merge: 3ce7cdde66e65a e1d794541b3f17 Author: Alexei Starovoitov Date: Tue Jun 24 18:37:22 2025 -0700 Merge branch 'bpf-verifier-improve-precision-of-bpf_add-and-bpf_sub' Harishankar Vishwanathan says: ==================== bpf, verifier: Improve precision of BPF_ADD and BPF_SUB This patchset improves the precision of BPF_ADD and BPF_SUB range tracking. It also adds selftests that exercise the cases where precision improvement occurs, and selftests for the cases where precise bounds cannot be computed and the output register state values are set to unbounded. Changelog: v3: * Improve readability in selftests and commit message by using more readable constants (suggested by Eduard Zingerman). * Add four new selftests for the cases where precise output register state bounds cannot be computed in scalar(32)_min_max_add/sub, so the output register state must be set to unbounded, i.e., [0, U64_MAX] or [0, U32_MAX]. * Add suggested-by Eduard tag to commit message for changes to verifier_bounds.c v2: * Add clearer example of precision improvement in the commit message for verifier.c changes. * Add selftests that exercise the precision improvement to verifier_bounds.c (suggested by Eduard Zingerman). v1: https://lore.kernel.org/bpf/20250610221356.2663491-1-harishankar.vishwanathan@gmail.com/ ==================== Link: https://patch.msgid.link/20250623040359.343235-1-harishankar.vishwanathan@gmail.com Signed-off-by: Alexei Starovoitov commit e1d794541b3f17c37f66d4134ee7c044fac4dc87 Author: Harishankar Vishwanathan Date: Mon Jun 23 00:03:57 2025 -0400 selftests/bpf: Add testcases for BPF_ADD and BPF_SUB The previous commit improves the precision in scalar(32)_min_max_add, and scalar(32)_min_max_sub. The improvement in precision occurs in cases when all outcomes overflow or underflow, respectively. This commit adds selftests that exercise those cases. This commit also adds selftests for cases where the output register state bounds for u(32)_min/u(32)_max are conservatively set to unbounded (when there is partial overflow or underflow). Signed-off-by: Harishankar Vishwanathan Co-developed-by: Matan Shachnai Signed-off-by: Matan Shachnai Suggested-by: Eduard Zingerman Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250623040359.343235-3-harishankar.vishwanathan@gmail.com Signed-off-by: Alexei Starovoitov commit 7a998a73162773d5d8dca4c9f46af26a499d8f19 Author: Harishankar Vishwanathan Date: Mon Jun 23 00:03:56 2025 -0400 bpf, verifier: Improve precision for BPF_ADD and BPF_SUB This patch improves the precison of the scalar(32)_min_max_add and scalar(32)_min_max_sub functions, which update the u(32)min/u(32)_max ranges for the BPF_ADD and BPF_SUB instructions. We discovered this more precise operator using a technique we are developing for automatically synthesizing functions for updating tnums and ranges. According to the BPF ISA [1], "Underflow and overflow are allowed during arithmetic operations, meaning the 64-bit or 32-bit value will wrap". Our patch leverages the wrap-around semantics of unsigned overflow and underflow to improve precision. Below is an example of our patch for scalar_min_max_add; the idea is analogous for all four functions. There are three cases to consider when adding two u64 ranges [dst_umin, dst_umax] and [src_umin, src_umax]. Consider a value x in the range [dst_umin, dst_umax] and another value y in the range [src_umin, src_umax]. (a) No overflow: No addition x + y overflows. This occurs when even the largest possible sum, i.e., dst_umax + src_umax <= U64_MAX. (b) Partial overflow: Some additions x + y overflow. This occurs when the largest possible sum overflows (dst_umax + src_umax > U64_MAX), but the smallest possible sum does not overflow (dst_umin + src_umin <= U64_MAX). (c) Full overflow: All additions x + y overflow. This occurs when both the smallest possible sum and the largest possible sum overflow, i.e., both (dst_umin + src_umin) and (dst_umax + src_umax) are > U64_MAX. The current implementation conservatively sets the output bounds to unbounded, i.e, [umin=0, umax=U64_MAX], whenever there is *any* possibility of overflow, i.e, in cases (b) and (c). Otherwise it computes tight bounds as [dst_umin + src_umin, dst_umax + src_umax]: if (check_add_overflow(*dst_umin, src_reg->umin_value, dst_umin) || check_add_overflow(*dst_umax, src_reg->umax_value, dst_umax)) { *dst_umin = 0; *dst_umax = U64_MAX; } Our synthesis-based technique discovered a more precise operator. Particularly, in case (c), all possible additions x + y overflow and wrap around according to eBPF semantics, and the computation of the output range as [dst_umin + src_umin, dst_umax + src_umax] continues to work. Only in case (b), do we need to set the output bounds to unbounded, i.e., [0, U64_MAX]. Case (b) can be checked by seeing if the minimum possible sum does *not* overflow and the maximum possible sum *does* overflow, and when that happens, we set the output to unbounded: min_overflow = check_add_overflow(*dst_umin, src_reg->umin_value, dst_umin); max_overflow = check_add_overflow(*dst_umax, src_reg->umax_value, dst_umax); if (!min_overflow && max_overflow) { *dst_umin = 0; *dst_umax = U64_MAX; } Below is an example eBPF program and the corresponding log from the verifier. The current implementation of scalar_min_max_add() sets r3's bounds to [0, U64_MAX] at instruction 5: (0f) r3 += r3, due to conservative overflow handling. 0: R1=ctx() R10=fp0 0: (b7) r4 = 0 ; R4_w=0 1: (87) r4 = -r4 ; R4_w=scalar() 2: (18) r3 = 0xa000000000000000 ; R3_w=0xa000000000000000 4: (4f) r3 |= r4 ; R3_w=scalar(smin=0xa000000000000000,smax=-1,umin=0xa000000000000000,var_off=(0xa000000000000000; 0x5fffffffffffffff)) R4_w=scalar() 5: (0f) r3 += r3 ; R3_w=scalar() 6: (b7) r0 = 1 ; R0_w=1 7: (95) exit With our patch, r3's bounds after instruction 5 are set to a much more precise [0x4000000000000000,0xfffffffffffffffe]. ... 5: (0f) r3 += r3 ; R3_w=scalar(umin=0x4000000000000000,umax=0xfffffffffffffffe) 6: (b7) r0 = 1 ; R0_w=1 7: (95) exit The logic for scalar32_min_max_add is analogous. For the scalar(32)_min_max_sub functions, the reasoning is similar but applied to detecting underflow instead of overflow. We verified the correctness of the new implementations using Agni [3,4]. We since also discovered that a similar technique has been used to calculate output ranges for unsigned interval addition and subtraction in Hacker's Delight [2]. [1] https://docs.kernel.org/bpf/standardization/instruction-set.html [2] Hacker's Delight Ch.4-2, Propagating Bounds through Add’s and Subtract’s [3] https://github.com/bpfverif/agni [4] https://people.cs.rutgers.edu/~sn349/papers/sas24-preprint.pdf Co-developed-by: Matan Shachnai Signed-off-by: Matan Shachnai Co-developed-by: Srinivas Narayana Signed-off-by: Srinivas Narayana Co-developed-by: Santosh Nagarakatte Signed-off-by: Santosh Nagarakatte Signed-off-by: Harishankar Vishwanathan Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250623040359.343235-2-harishankar.vishwanathan@gmail.com Signed-off-by: Alexei Starovoitov commit 26b971d58ab9f0d5003ac750a97bb88cec7aa2e1 Author: mrigendrachaubey Date: Sun Jun 22 11:27:09 2025 +0530 scsi: scsi_devinfo: Remove redundant 'found' Remove the unnecessary 'found' flag in scsi_devinfo_lookup_by_key(). The loop can return the matching entry directly when found, and fall through to return ERR_PTR(-EINVAL) otherwise. Signed-off-by: mrigendrachaubey Link: https://lore.kernel.org/r/20250622055709.7893-1-mrigendra.chaubey@gmail.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 6243146bb019a200c54a98c96b85f4b9012f2140 Author: Arnd Bergmann Date: Fri Jun 20 19:32:22 2025 +0200 scsi: qla2xxx: Avoid stack frame size warning in qla_dfs The qla2x00_dfs_tgt_port_database_show() function constructs a fake fc_port_t object on the stack, which--depending on the configuration--is large enough to exceed the stack size warning limit: drivers/scsi/qla2xxx/qla_dfs.c:176:1: error: stack frame size (1392) exceeds limit (1280) in 'qla2x00_dfs_tgt_port_database_show' [-Werror,-Wframe-larger-than] Rework this function to no longer need the structure but instead call a custom helper function that just prints the data directly from the port_database_24xx structure. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250620173232.864179-1-arnd@kernel.org Signed-off-by: Martin K. Petersen commit ed575d4bca6ac84129046455803028a91e81cc64 Author: Randy Dunlap Date: Fri Jun 20 09:21:58 2025 -0700 scsi: mpi3mr: Fix kernel-doc issues in mpi3mr_app.c Fix all kernel-doc problems in mpi3mr_app.c: mpi3mr_app.c:809: warning: Excess function parameter 'data' description in 'mpi3mr_set_trigger_data_in_hdb' mpi3mr_app.c:836: warning: Excess function parameter 'data' description in 'mpi3mr_set_trigger_data_in_all_hdb' mpi3mr_app.c:3395: warning: No description found for return value of 'sas_ncq_prio_supported_show' mpi3mr_app.c:3413: warning: No description found for return value of 'sas_ncq_prio_enable_show' Fixes: fc4444941140 ("scsi: mpi3mr: HDB allocation and posting for hardware and firmware buffers") Fixes: d8d08d1638ce ("scsi: mpi3mr: Trigger support") Fixes: 90e6f08915ec ("scsi: mpi3mr: Fix ATA NCQ priority support") Signed-off-by: Randy Dunlap Link: https://lore.kernel.org/r/20250620162158.776795-1-rdunlap@infradead.org Cc: Sathya Prakash Cc: Kashyap Desai Cc: Sumit Saxena Cc: Sreekanth Reddy Cc: Ranjan Kumar Cc: mpi3mr-linuxdrv.pdl@broadcom.com Cc: Damien Le Moal Cc: James E.J. Bottomley Cc: Martin K. Petersen Reviewed-by: Damien Le Moal Signed-off-by: Martin K. Petersen commit 8dacfd92dbefee829ca555a860e86108fdd1d55b Author: Ryan Wanner Date: Mon Jun 23 09:11:08 2025 -0700 dt-bindings: net: cdns,macb: add sama7d65 ethernet interface This patch set adds all the supported FLEXCOMs for the SAMA7D65 SoC. This also adds the GMAC interfaces and enables GMAC0 interface for the SAMA7D65 SoC. With the FLEXCOMs added to the SoC the MCP16502 and the MAC address EEPROM are both added to flexcom10. The dt-binding for USART is here [1]. And the dt-binding for DMA has been applied here [2]. The original thread for this is here [3]. The applied changes have been removed for this resend [1] https://lore.kernel.org/20250306160318.vhPzJLjl19Vq9am9RRbuv5ddmQ6GCEND-YNvPKKtAtU@z [2] https://lore.kernel.org/174065806827.367410.5368210992879330466.b4-ty@kernel.org [3] https://lore.kernel.org/392b078b38d15f6adf88771113043044f31e8cd6.1743523114.git.Ryan.Wanner@microchip.com Signed-off-by: Ryan Wanner Acked-by: Conor Dooley Link: https://patch.msgid.link/35808b7cee5ba5b2ce55d741ae1ada0f1cd2f7cb.1750694691.git.Ryan.Wanner@microchip.com Signed-off-by: Jakub Kicinski commit da7aee71616397234023e4ebd5c848a3c945f877 Author: Jason Xing Date: Mon Jun 23 20:01:59 2025 +0800 net: xsk: dpaa2: avoid repeatedly updating the global consumer This patch avoids another update of the consumer at the end of dpaa2_xsk_tx(). In the zero copy xmit path, two versions (batched and non-batched) regarding how the consumer of tx ring changes are implemented in xsk_tx_peek_release_desc_batch() that eventually updates the local consumer to the global consumer in either of the following call trace: 1) batched mode: xsk_tx_peek_release_desc_batch() __xskq_cons_release() 2) non-batched mode: xsk_tx_peek_release_desc_batch() xsk_tx_peek_release_fallback() xsk_tx_release() As we can see, dpaa2_xsk_tx() doesn't need to call extra release function to handle the sync of consumer itself. Signed-off-by: Jason Xing Acked-by: Maciej Fijalkowski Link: https://patch.msgid.link/20250623120159.68374-1-kerneljasonxing@gmail.com Signed-off-by: Jakub Kicinski commit a19e5812dc96e6ad3ba6740a22d0ae45b4c059d8 Merge: 7eebd219feda99 169d07e7e41cd6 Author: Jakub Kicinski Date: Tue Jun 24 17:09:25 2025 -0700 Merge branch 'there-are-some-cleanup-for-hns3-driver' Jijie Shao says: ==================== There are some cleanup for hns3 driver v3: https://lore.kernel.org/20250621083310.52c8e7ae@kernel.org v2: https://lore.kernel.org/20250617010255.1183069-1-shaojijie@huawei.com v1: https://lore.kernel.org/20250612021317.1487943-1-shaojijie@huawei.com ==================== Link: https://patch.msgid.link/20250623040043.857782-1-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 169d07e7e41cd64208c31b6ead93c8045304f448 Author: Peiyang Wang Date: Mon Jun 23 12:00:43 2025 +0800 net: hns3: clear hns alarm: comparison of integer expressions of different signedness A static alarm exists in the hns and needs to be cleared. The alarm is comparison of integer expressions of different signedness including 's64' and 'long unsigned int', 'int' and 'long unsigned int', 'u32' and 'int', 'int' and 'unsigned int'. Signed-off-by: Peiyang Wang Signed-off-by: Jijie Shao Link: https://patch.msgid.link/20250623040043.857782-8-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 84c0564b1c510eebd86092a1e5e3e70d4ffeea46 Author: Jijie Shao Date: Mon Jun 23 12:00:42 2025 +0800 net: hns3: add complete parentheses for some macros Add complete parentheses for some macros to fix static check warning. Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250623040043.857782-7-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit ad0cf0729f530fad0e6aad7d47b1d280666cd4a7 Author: Yonglong Liu Date: Mon Jun 23 12:00:41 2025 +0800 net: hns3: delete redundant address before the array Address before the array is redundant, this patch delete it. Signed-off-by: Yonglong Liu Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250623040043.857782-6-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit dd9480f6ed2816e8b766c2decf584545e90d9631 Author: Peiyang Wang Date: Mon Jun 23 12:00:40 2025 +0800 net: hns3: add \n at the end when print msg To make the print message more clearly, add \n at the and of message if it is missing currently. Signed-off-by: Peiyang Wang Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250623040043.857782-5-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 5306c10396866b8050d1bb8ca9dddaab607409e5 Author: Jijie Shao Date: Mon Jun 23 12:00:39 2025 +0800 net: hns3: use hns3_get_ops() helper to reduce the unnecessary middle layer conversion There are too many indirection layers in the HNS3 driver code, This issue was previously discussed with the maintainer, who suggested adding a helper function to fix the issue. In fact, the hns3_get_ops() helper is already defined and can fix this issue. This patch uses hns3_get_ops() helper to reduce the unnecessary middle layer conversion. Apply it to the whole HNS3 driver. The former discusstion can be checked from the link. Link: https://patchwork.kernel.org/project/netdevbpf/patch/20230310081404.947-1-lanhao@huawei.com/ Signed-off-by: Jijie Shao Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/20250623040043.857782-4-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit 2031f01394b2cc73538b3eeec191ffb03a1de5a0 Author: Jijie Shao Date: Mon Jun 23 12:00:38 2025 +0800 net: hns3: use hns3_get_ae_dev() helper to reduce the unnecessary middle layer conversion There are too many indirection layers in the HNS3 driver code. This issue was previously discussed with the maintainer, who suggested adding a helper function to fix the issue. In fact, the hns3_get_ae_dev() helper is already defined and can fix this issue. This patch uses hns3_get_ae_dev() helper to reduce the unnecessary middle layer conversion. Apply it to the whole HNS3 driver. The former discusstion can be checked from the link. Link: https://patchwork.kernel.org/project/netdevbpf/patch/20230310081404.947-1-lanhao@huawei.com/ Signed-off-by: Jijie Shao Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/20250623040043.857782-3-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit befd4e971a78f735996737fa213d183b6ac99629 Author: Jijie Shao Date: Mon Jun 23 12:00:37 2025 +0800 net: hns3: fix spelling mistake "reg_um" -> "reg_num" There are spelling mistakes in hclgevf_get_regs. Fix them. Signed-off-by: Jijie Shao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250623040043.857782-2-shaojijie@huawei.com Signed-off-by: Jakub Kicinski commit ee79ba39b3d6fdcfa53de6519d7e259e284e78f7 Author: Al Viro Date: Sun Jun 15 03:01:54 2025 +0100 selinux: don't bother with selinuxfs_info_free() on failures Failures in sel_fill_super() will be followed by sel_kill_sb(), which will call selinuxfs_info_free() anyway. Signed-off-by: Al Viro Reviewed-by: Christian Brauner [PM: subj and description tweaks] Signed-off-by: Paul Moore commit 7eebd219feda99df8292a97faff895a5da8159d6 Author: Qingfang Deng Date: Mon Jun 23 11:34:31 2025 +0800 pppoe: drop PACKET_OTHERHOST before skb_share_check() Align with ip_rcv() by dropping PACKET_OTHERHOST packets before calling skb_share_check(). This avoids unnecessary skb processing for packets that will be discarded anyway. Signed-off-by: Qingfang Deng Acked-by: Guillaume Nault Link: https://patch.msgid.link/20250623033431.408810-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit f3128dd6762d71ec92ae888bf582a5f751c3f2e0 Author: Yue Haibing Date: Tue Jun 24 09:41:08 2025 +0800 security: Remove unused declaration cap_mmap_file() Commit 3f4f1f8a1ab7 ("capabilities: remove cap_mmap_file()") removed the implementation but leave declaration. Signed-off-by: Yue Haibing Reviewed-by: Serge Hallyn Signed-off-by: Paul Moore commit c9e78afa688afec528784b79bb02d513cdcd6527 Author: Paolo Abeni Date: Mon Jun 23 12:53:55 2025 +0200 udp_tunnel: fix deadlock in udp_tunnel_nic_set_port_priv() While configuring a vxlan tunnel in a system with a i40e NIC driver, I observe the following deadlock: WARNING: possible recursive locking detected 6.16.0-rc2.net-next-6.16_92d87230d899+ #13 Tainted: G E -------------------------------------------- kworker/u256:4/1125 is trying to acquire lock: ffff88921ab9c8c8 (&utn->lock){+.+.}-{4:4}, at: i40e_udp_tunnel_set_port (/home/pabeni/net-next/include/net/udp_tunnel.h:343 /home/pabeni/net-next/drivers/net/ethernet/intel/i40e/i40e_main.c:13013) i40e but task is already holding lock: ffff88921ab9c8c8 (&utn->lock){+.+.}-{4:4}, at: udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:739) udp_tunnel other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&utn->lock); lock(&utn->lock); *** DEADLOCK *** May be due to missing lock nesting notation 4 locks held by kworker/u256:4/1125: #0: ffff8892910ca158 ((wq_completion)udp_tunnel_nic){+.+.}-{0:0}, at: process_one_work (/home/pabeni/net-next/kernel/workqueue.c:3213) #1: ffffc900244efd30 ((work_completion)(&utn->work)){+.+.}-{0:0}, at: process_one_work (/home/pabeni/net-next/kernel/workqueue.c:3214) #2: ffffffff9a14e290 (rtnl_mutex){+.+.}-{4:4}, at: udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:737) udp_tunnel #3: ffff88921ab9c8c8 (&utn->lock){+.+.}-{4:4}, at: udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:739) udp_tunnel stack backtrace: Hardware name: Dell Inc. PowerEdge R7525/0YHMCJ, BIOS 2.2.5 04/08/2021 i Call Trace: dump_stack_lvl (/home/pabeni/net-next/lib/dump_stack.c:123) print_deadlock_bug (/home/pabeni/net-next/kernel/locking/lockdep.c:3047) validate_chain (/home/pabeni/net-next/kernel/locking/lockdep.c:3901) __lock_acquire (/home/pabeni/net-next/kernel/locking/lockdep.c:5240) lock_acquire.part.0 (/home/pabeni/net-next/kernel/locking/lockdep.c:473 /home/pabeni/net-next/kernel/locking/lockdep.c:5873) __mutex_lock (/home/pabeni/net-next/kernel/locking/mutex.c:604 /home/pabeni/net-next/kernel/locking/mutex.c:747) i40e_udp_tunnel_set_port (/home/pabeni/net-next/include/net/udp_tunnel.h:343 /home/pabeni/net-next/drivers/net/ethernet/intel/i40e/i40e_main.c:13013) i40e udp_tunnel_nic_device_sync_by_port (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:230 /home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:249) udp_tunnel __udp_tunnel_nic_device_sync.part.0 (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:292) udp_tunnel udp_tunnel_nic_device_sync_work (/home/pabeni/net-next/net/ipv4/udp_tunnel_nic.c:742) udp_tunnel process_one_work (/home/pabeni/net-next/kernel/workqueue.c:3243) worker_thread (/home/pabeni/net-next/kernel/workqueue.c:3315 /home/pabeni/net-next/kernel/workqueue.c:3402) kthread (/home/pabeni/net-next/kernel/kthread.c:464) AFAICS all the existing callsites of udp_tunnel_nic_set_port_priv() are already under the utn lock scope, avoid (re-)acquiring it in such a function. Fixes: 1ead7501094c ("udp_tunnel: remove rtnl_lock dependency") Signed-off-by: Paolo Abeni Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/95a827621ec78c12d1564ec3209e549774f9657d.1750675978.git.pabeni@redhat.com Signed-off-by: Jakub Kicinski commit 43ad65eca2a165dd94faf7761cbcfc4877a31958 Author: Danilo Krummrich Date: Tue Jun 24 15:23:23 2025 +0200 gpu: nova-core: consider `clippy::cast_lossless` Fix all warnings caused by `clippy::cast_lossless`, which is going to be enabled by [1]. Cc: Alexandre Courbot Cc: Miguel Ojeda Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-5-f43b024581e8@gmail.com [1] Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250624132337.2242-2-dakr@kernel.org Signed-off-by: Danilo Krummrich commit 1b8233bb24fc703cf3246da850e8f8e6a1cdc5b9 Author: Danilo Krummrich Date: Tue Jun 24 15:23:22 2025 +0200 gpu: nova-core: impl From for u32 for enums used from register! Implement From for u32 for all enum types used within the register!() macro. This avoids a conflict with [1] as reported in [2]. Cc: Alexandre Courbot Cc: Miguel Ojeda Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-5-f43b024581e8@gmail.com [1] Link: https://lore.kernel.org/all/20250624173114.3be38990@canb.auug.org.au/ [2] Reviewed-by: Alexandre Courbot Tested-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250624132337.2242-1-dakr@kernel.org Signed-off-by: Danilo Krummrich commit cb444006a625c60e6d4dd3753863c3c74f96aac3 Author: David Dai Date: Tue Jun 24 15:49:06 2025 -0700 sched_ext, rcu: Eject BPF scheduler on RCU CPU stall panic For systems using a sched_ext scheduler and has panic_on_rcu_stall enabled, try kicking out the current scheduler before issuing a panic. While there are numerous reasons for RCU CPU stalls that are not directly attributed to the scheduler, deferring the panic gives sched_ext an opportunity to provide additional debug info when ejecting the current scheduler. Also, handling the event more gracefully allows us to potentially recover the system instead of incurring additional down time. Suggested-by: Tejun Heo Reviewed-by: Paul E. McKenney Signed-off-by: David Dai Signed-off-by: Tejun Heo commit 7e611710acf966df1e14bcf4e067385e38e549a1 Author: FUJITA Tomonori Date: Fri Apr 11 07:56:23 2025 +0900 rust: task: Add Rust version of might_sleep() Add a helper function equivalent to the C's might_sleep(), which serves as a debugging aid and a potential scheduling point. Note that this function can only be used in a nonatomic context. This will be used by Rust version of read_poll_timeout(). [boqun: Use file_from_location() to get a C string instead of changing __might_sleep()] Signed-off-by: FUJITA Tomonori Reviewed-by: Alice Ryhl Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250619151007.61767-3-boqun.feng@gmail.com commit 0aa2b78ce5a9eac8f3332192ea77755d63a831cd Author: Boqun Feng Date: Sun Jun 15 15:14:00 2025 -0700 rust: Introduce file_from_location() Most of kernel debugging facilities take a nul-terminated string for file names for a callsite (generated from __FILE__), however the Rust courterpart, Location, would return a Rust string (not nul-terminated) from method .file(). And such a string cannot be passed to C debugging function directly. There is ongoing work to support a Location::file_with_nul() [1], which returns a nul-terminated string from a Location. Since it's still working in progress, and it will take some time before the feature finally gets stabilized and the kernel's minimal rustc version might also take a while to bump to a version that at least has that feature, introduce a file_from_location() function, which returns a warning string if Location::file_with_nul() is not available. This should work in most cases because as for now the known usage of Location::file_with_nul() is only in debugging code (e.g. might_sleep()) and there might be other information reported by the debugging code that could help locate the problematic function, so missing the file name is fine at the moment. Link: https://github.com/rust-lang/rust/issues/141727 [1] Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250619151007.61767-2-boqun.feng@gmail.com commit 3f06b8927afa3cede5c2e70ee76659d4801e4667 Author: Chao Gao Date: Thu Jun 12 01:19:46 2025 -0700 KVM: x86: Deduplicate MSR interception enabling and disabling Extract a common function from MSR interception disabling logic and create disabling and enabling functions based on it. This removes most of the duplicated code for MSR interception disabling/enabling. No functional change intended. Signed-off-by: Chao Gao Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250612081947.94081-2-chao.gao@intel.com [sean: s/enable/set, inline the wrappers] Signed-off-by: Sean Christopherson commit 90c5ce37adf074ed85b26d1cd43074f29c0743ba Author: wangzijie Date: Tue Jun 24 11:59:37 2025 +0800 f2fs: convert F2FS_I_SB to sbi in f2fs_setattr() Introduce sbi in f2fs_setattr() and convert F2FS_I_SB to it. No logic change, just cleanup and prepare to get CAP_BLKS_PER_SEC(sbi). Signed-off-by: wangzijie Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1f136890263c3d34072b8eeea905c1f47e30369a Author: Swarna Prabhu Date: Tue Jun 17 17:40:47 2025 +0000 f2fs: Fix the typos in comments This patch fixes minor typos in comments in f2fs. Signed-off-by: Swarna Prabhu Reviewed-by: Luis Chamberlain Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit c371161086153623796dff9de713e98c47f4c586 Author: Arnd Bergmann Date: Fri Jun 20 13:36:38 2025 +0200 drm/i915: reduce stack usage in igt_vma_pin1() The igt_vma_pin1() function has a rather high stack usage, which gets in the way of reducing the default warning limit: In file included from drivers/gpu/drm/i915/i915_vma.c:2285: drivers/gpu/drm/i915/selftests/i915_vma.c:257:12: error: stack frame size (1288) exceeds limit (1280) in 'igt_vma_pin1' [-Werror,-Wframe-larger-than] There are two things going on here: - The on-stack modes[] array is really large itself and gets constructed for every call, using around 1000 bytes itself depending on the configuration. - The call to i915_vma_pin() gets inlined and adds another 200 bytes for the i915_gem_ww_ctx structure since commit 7d1c2618eac5 ("drm/i915: Take reservation lock around i915_vma_pin.") The second one is easy enough to change, by moving the function into the appropriate .c file. Since it is already large enough to not always be inlined, this seems like a good idea regardless, reducing both the code size and the internal stack usage of each of its 67 callers. Reviewed-by: Rodrigo Vivi Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250620113644.3844552-1-arnd@kernel.org Signed-off-by: Rodrigo Vivi commit ef69f9dd1cd7301cdf04ba326ed28152a3affcf6 Author: Arnd Bergmann Date: Fri Jun 20 13:18:18 2025 +0200 drm/i915: fix build error some more An earlier patch fixed a build failure with clang, but I still see the same problem with some configurations using gcc: drivers/gpu/drm/i915/i915_pmu.c: In function 'config_mask': include/linux/compiler_types.h:568:38: error: call to '__compiletime_assert_462' declared with attribute error: BUILD_BUG_ON failed: bit > BITS_PER_TYPE(typeof_member(struct i915_pmu, enable)) - 1 drivers/gpu/drm/i915/i915_pmu.c:116:3: note: in expansion of macro 'BUILD_BUG_ON' 116 | BUILD_BUG_ON(bit > As I understand it, the problem is that the function is not always fully inlined, but the __builtin_constant_p() can still evaluate the argument as being constant. Marking it as __always_inline so far works for me in all configurations. Fixes: 686d773186bf ("drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled") Fixes: a644fde77ff7 ("drm/i915/pmu: Change bitmask of enabled events to u32") Reviewed-by: Rodrigo Vivi Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250620111824.3395007-1-arnd@kernel.org Signed-off-by: Rodrigo Vivi commit c9c325072b35671f26c92c9c7ba6fe5bb1ab111a Author: Arnd Bergmann Date: Fri Jun 20 13:37:45 2025 +0200 drm/i915/wm: reduce stack usage in skl_print_wm_changes() When KMSAN is enabled, this function causes has a rather excessive stack usage: drivers/gpu/drm/i915/display/skl_watermark.c:2977:1: error: stack frame size (1432) exceeds limit (1408) in 'skl_compute_wm' [-Werror,-Wframe-larger-than] This is apparently all caused by the varargs calls to drm_dbg_kms(). Inlining this into skl_compute_wm() means that any function called by skl_compute_wm() has its own stack on top of that. Move the worst bit into a separate function marked as noinline_for_stack to limit that to the one code path that actually needs it. Reviewed-by: Rodrigo Vivi Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250620113748.3869160-1-arnd@kernel.org Signed-off-by: Rodrigo Vivi commit b85af48de3ece4e5bbdb2248a5360a409991cf67 Author: Jiwei Sun Date: Thu Jan 23 13:51:55 2025 +0800 PCI: Adjust the position of reading the Link Control 2 register In a89c82249c37 ("PCI: Work around PCIe link training failures"), if the speed limit is set to 2.5 GT/s and the retraining is successful, an attempt will be made to lift the speed limit. One condition for lifting the speed limit is to check whether the link speed field of the Link Control 2 register is PCI_EXP_LNKCTL2_TLS_2_5GT. However, since de9a6c8d5dbf ("PCI/bwctrl: Add pcie_set_target_speed() to set PCIe Link Speed"), the `lnkctl2` local variable does not undergo any changes during the speed limit setting and retraining process. As a result, the code intended to lift the speed limit is not executed. To address this issue, adjust the position of the Link Control 2 register read operation in the code and place it before its use. Fixes: de9a6c8d5dbf ("PCI/bwctrl: Add pcie_set_target_speed() to set PCIe Link Speed") Suggested-by: Maciej W. Rozycki Suggested-by: Ilpo Järvinen Signed-off-by: Jiwei Sun Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250123055155.22648-3-sjiwei@163.com commit 9989e0ca7462c62f93dbc62f684448aa2efb9226 Author: Jiwei Sun Date: Thu Jan 23 13:51:54 2025 +0800 PCI: Fix link speed calculation on retrain failure When pcie_failed_link_retrain() fails to retrain, it tries to revert to the previous link speed. However it calculates that speed from the Link Control 2 register without masking out non-speed bits first. PCIE_LNKCTL2_TLS2SPEED() converts such incorrect values to PCI_SPEED_UNKNOWN (0xff), which in turn causes a WARN splat in pcie_set_target_speed(): pci 0000:00:01.1: [1022:14ed] type 01 class 0x060400 PCIe Root Port pci 0000:00:01.1: broken device, retraining non-functional downstream link at 2.5GT/s pci 0000:00:01.1: retraining failed WARNING: CPU: 1 PID: 1 at drivers/pci/pcie/bwctrl.c:168 pcie_set_target_speed RDX: 0000000000000001 RSI: 00000000000000ff RDI: ffff9acd82efa000 pcie_failed_link_retrain pci_device_add pci_scan_single_device Mask out the non-speed bits in PCIE_LNKCTL2_TLS2SPEED() and PCIE_LNKCAP_SLS2SPEED() so they don't incorrectly return PCI_SPEED_UNKNOWN. Fixes: de9a6c8d5dbf ("PCI/bwctrl: Add pcie_set_target_speed() to set PCIe Link Speed") Reported-by: Andrew Closes: https://lore.kernel.org/r/7iNzXbCGpf8yUMJZBQjLdbjPcXrEJqBxy5-bHfppz0ek-h4_-G93b1KUrm106r2VNF2FV_sSq0nENv4RsRIUGnlYZMlQr2ZD2NyB5sdj5aU=@protonmail.com/ Suggested-by: Maciej W. Rozycki Suggested-by: Ilpo Järvinen Signed-off-by: Jiwei Sun [bhelgaas: commit log, add details from https://lore.kernel.org/r/1c92ef6bcb314ee6977839b46b393282e4f52e74.1750684771.git.lukas@wunner.de] Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Cc: stable@vger.kernel.org # v6.13+ Link: https://patch.msgid.link/20250123055155.22648-2-sjiwei@163.com commit 8b05b3c988162ca117b3854ae7d497927b415299 Author: Yang Weijiang Date: Thu May 22 08:10:09 2025 -0700 x86/fpu/xstate: Add CET supervisor xfeature support as a guest-only feature == Background == CET defines two register states: CET user, which includes user-mode control registers, and CET supervisor, which consists of shadow-stack pointers for privilege levels 0-2. Current kernels disable shadow stacks in kernel mode, making the CET supervisor state unused and eliminating the need for context switching. == Problem == To virtualize CET for guests, KVM must accurately emulate hardware behavior. A key challenge arises because there is no CPUID flag to indicate that shadow stack is supported only in user mode. Therefore, KVM cannot assume guests will not enable shadow stacks in kernel mode and must preserve the CET supervisor state of vCPUs. == Solution == An initial proposal to manually save and restore CET supervisor states using raw RDMSR/WRMSR in KVM was rejected due to performance concerns and its impact on KVM's ABI. Instead, leveraging the kernel's FPU infrastructure for context switching was favored [1]. The main question then became whether to enable the CET supervisor state globally for all processes or restrict it to vCPU processes. This decision involves a trade-off between a 24-byte XSTATE buffer waste for all non-vCPU processes and approximately 100 lines of code complexity in the kernel [2]. The agreed approach is to first try this optimal solution [3], i.e., restricting the CET supervisor state to guest FPUs only and eliminating unnecessary space waste. The guest-only xfeature infrastructure has already been added. Now, introduce CET supervisor xstate support as the first guest-only feature to prepare for the upcoming CET virtualization in KVM. Signed-off-by: Yang Weijiang Signed-off-by: Chao Gao Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: Maxim Levitsky Reviewed-by: John Allen Link: https://lore.kernel.org/kvm/ZM1jV3UPL0AMpVDI@google.com/ [1] Link: https://lore.kernel.org/kvm/1c2fd06e-2e97-4724-80ab-8695aa4334e7@intel.com/ [2] Link: https://lore.kernel.org/kvm/2597a87b-1248-b8ce-ce60-94074bc67ea4@intel.com/ [3] Link: https://lore.kernel.org/all/20250522151031.426788-7-chao.gao%40intel.com commit 151bf232494d7537e3d995b400e8233fd682ae1a Author: Yang Weijiang Date: Thu May 22 08:10:08 2025 -0700 x86/fpu/xstate: Introduce "guest-only" supervisor xfeature set In preparation for upcoming CET virtualization support, the CET supervisor state will be added as a "guest-only" feature, since it is required only by KVM (i.e., guest FPUs). Establish the infrastructure for "guest-only" features. Define a new XFEATURE_MASK_GUEST_SUPERVISOR mask to specify features that are enabled by default in guest FPUs but not in host FPUs. Specifically, for any bit in this set, permission is granted and XSAVE space is allocated during vCPU creation. Non-guest FPUs cannot enable guest-only features, even dynamically, and no XSAVE space will be allocated for them. The mask is currently empty, but this will be changed by a subsequent patch. Co-developed-by: Chao Gao Signed-off-by: Chao Gao Signed-off-by: Yang Weijiang Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: John Allen Link: https://lore.kernel.org/all/20250522151031.426788-6-chao.gao%40intel.com commit fafb29e18db2eef75edafd4240fcde8b5da2c948 Author: Chao Gao Date: Thu May 22 08:10:07 2025 -0700 x86/fpu: Remove xfd argument from __fpstate_reset() The initial values for fpstate::xfd differ between guest and host fpstates. Currently, the initial values are passed as an argument to __fpstate_reset(). But, __fpstate_reset() already assigns different default features and sizes based on the type of fpstates (i.e., guest or host). So, handle fpstate::xfd in a similar way to highlight the differences in the initial xfd value between guest and host fpstates Suggested-by: Sean Christopherson Signed-off-by: Chao Gao Signed-off-by: Dave Hansen Reviewed-by: John Allen Link: https://lore.kernel.org/all/aBuf7wiiDT0Wflhk@google.com/ Link: https://lore.kernel.org/all/20250522151031.426788-5-chao.gao%40intel.com commit 509e880b779592aafb41b3b23de3df7e4e2e2fcf Author: Chao Gao Date: Thu May 22 08:10:06 2025 -0700 x86/fpu: Initialize guest fpstate and FPU pseudo container from guest defaults fpu_alloc_guest_fpstate() currently uses host defaults to initialize guest fpstate and pseudo containers. Guest defaults were introduced to differentiate the features and sizes of host and guest FPUs. Switch to using guest defaults instead. Adjust __fpstate_reset() to handle different defaults for host and guest FPUs. And to distinguish between the types of FPUs, move the initialization of indicators (is_guest and is_valloc) before the reset. Suggested-by: Chang S. Bae Signed-off-by: Chao Gao Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: John Allen Link: https://lore.kernel.org/all/20250522151031.426788-4-chao.gao%40intel.com commit 7c2c89364d9219f3a31a9a930476de5c154f13bd Author: Chao Gao Date: Thu May 22 08:10:05 2025 -0700 x86/fpu: Initialize guest FPU permissions from guest defaults Currently, fpu->guest_perm is copied from fpu->perm, which is derived from fpu_kernel_cfg.default_features. Guest defaults were introduced to differentiate the features and sizes of host and guest FPUs. Copying guest FPU permissions from the host will lead to inconsistencies between the guest default features and permissions. Initialize guest FPU permissions from guest defaults instead of host defaults. This ensures that any changes to guest default features are automatically reflected in guest permissions, which in turn guarantees that fpstate_realloc() allocates a correctly sized XSAVE buffer for guest FPUs. Suggested-by: Chang S. Bae Signed-off-by: Chao Gao Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Reviewed-by: John Allen Link: https://lore.kernel.org/all/20250522151031.426788-3-chao.gao%40intel.com commit 7bc4ed75f2d664c5a96d1f0874c41431a84c62b2 Author: Chao Gao Date: Thu May 22 08:10:04 2025 -0700 x86/fpu/xstate: Differentiate default features for host and guest FPUs Currently, guest and host FPUs share the same default features. However, the CET supervisor xstate is the first feature that needs to be enabled exclusively for guest FPUs. Enabling it for host FPUs leads to a waste of 24 bytes in the XSAVE buffer. To support "guest-only" features, add a new structure to hold the default features and sizes for guest FPUs to clearly differentiate them from those for host FPUs. Add two helpers to provide the default feature masks for guest and host FPUs. Default features are derived by applying the masks to the maximum supported features. Note that, 1) for now, guest_default_mask() and host_default_mask() are identical. This will change in a follow-up patch once guest permissions, default xfeatures, and fpstate size are all converted to use the guest defaults. 2) only supervisor features will diverge between guest FPUs and host FPUs, while user features will remain the same [1][2]. So, the new vcpu_fpu_config struct does not include default user features and size for the UABI buffer. An alternative approach is adding a guest_only_xfeatures member to fpu_kernel_cfg and adding two helper functions to calculate the guest default xfeatures and size. However, calculating these defaults at runtime would introduce unnecessary overhead. Suggested-by: Chang S. Bae Suggested-by: Sean Christopherson Signed-off-by: Chao Gao Signed-off-by: Dave Hansen Reviewed-by: John Allen Link: https://lore.kernel.org/kvm/aAwdQ759Y6V7SGhv@google.com/ [1] Link: https://lore.kernel.org/kvm/9ca17e1169805f35168eb722734fbf3579187886.camel@intel.com/ [2] Link: https://lore.kernel.org/all/20250522151031.426788-2-chao.gao%40intel.com commit ffe9d7966d0190a7f6db4dcacda0c8a12084ca09 Author: Sean Christopherson Date: Thu May 22 18:17:53 2025 -0700 KVM: x86/mmu: Locally cache whether a PFN is host MMIO when making a SPTE When making a SPTE, cache whether or not the target PFN is host MMIO in order to avoid multiple rounds of the slow path of kvm_is_mmio_pfn(), e.g. hitting pat_pfn_immune_to_uc_mtrr() in particular can be problematic. KVM currently avoids multiple calls by virtue of the two users being mutually exclusive (.get_mt_mask() is Intel-only, shadow_me_value is AMD-only), but that won't hold true if/when KVM needs to detect host MMIO mappings for other reasons, e.g. for mitigating the MMIO Stale Data vulnerability. No functional change intended. Tested-by: Pawan Gupta Link: https://lore.kernel.org/r/20250523011756.3243624-3-seanjc@google.com Signed-off-by: Sean Christopherson commit c126b46e6fa87eb27e08e2120a732ec988f20eb2 Author: Sean Christopherson Date: Thu May 22 18:17:52 2025 -0700 KVM: x86: Avoid calling kvm_is_mmio_pfn() when kvm_x86_ops.get_mt_mask is NULL Guard the call to kvm_x86_call(get_mt_mask) with an explicit check on kvm_x86_ops.get_mt_mask so as to avoid unnecessarily calling kvm_is_mmio_pfn(), which is moderately expensive for some backing types. E.g. lookup_memtype() conditionally takes a system-wide spinlock if KVM ends up being call pat_pfn_immune_to_uc_mtrr(), e.g. for DAX memory. While the call to kvm_x86_ops.get_mt_mask() itself is elided, the compiler still needs to compute all parameters, as it can't know at build time that the call will be squashed. <+243>: call 0xffffffff812ad880 <+248>: mov %r13,%rsi <+251>: mov %rbx,%rdi <+254>: movzbl %al,%edx <+257>: call 0xffffffff81c26af0 <__SCT__kvm_x86_get_mt_mask> Fixes: 3fee4837ef40 ("KVM: x86: remove shadow_memtype_mask") Tested-by: Pawan Gupta Link: https://lore.kernel.org/r/20250523011756.3243624-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 2ddbb73ec20b98e70a5200cb85deade22ccea2ec Author: Michal Wajdeczko Date: Fri Jun 13 00:09:37 2025 +0200 drm/xe/guc: Explicitly exit CT safe mode on unwind During driver probe we might be briefly using CT safe mode, which is based on a delayed work, but usually we are able to stop this once we have IRQ fully operational. However, if we abort the probe quite early then during unwind we might try to destroy the workqueue while there is still a pending delayed work that attempts to restart itself which triggers a WARN. This was recently observed during unsuccessful VF initialization: [ ] xe 0000:00:02.1: probe with driver xe failed with error -62 [ ] ------------[ cut here ]------------ [ ] workqueue: cannot queue safe_mode_worker_func [xe] on wq xe-g2h-wq [ ] WARNING: CPU: 9 PID: 0 at kernel/workqueue.c:2257 __queue_work+0x287/0x710 [ ] RIP: 0010:__queue_work+0x287/0x710 [ ] Call Trace: [ ] delayed_work_timer_fn+0x19/0x30 [ ] call_timer_fn+0xa1/0x2a0 Exit the CT safe mode on unwind to avoid that warning. Fixes: 09b286950f29 ("drm/xe/guc: Allow CTB G2H processing without G2H IRQ") Signed-off-by: Michal Wajdeczko Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250612220937.857-3-michal.wajdeczko@intel.com commit 89d2835c3680ab1938e22ad81b1c9f8c686bd391 Author: Michal Wajdeczko Date: Fri Jun 13 00:09:36 2025 +0200 drm/xe: Process deferred GGTT node removals on device unwind While we are indirectly draining our dedicated workqueue ggtt->wq that we use to complete asynchronous removal of some GGTT nodes, this happends as part of the managed-drm unwinding (ggtt_fini_early), which could be later then manage-device unwinding, where we could already unmap our MMIO/GMS mapping (mmio_fini). This was recently observed during unsuccessful VF initialization: [ ] xe 0000:00:02.1: probe with driver xe failed with error -62 [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747340 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747540 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747240 __xe_bo_unpin_map_no_vm (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747040 tiles_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746840 mmio_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e747f40 xe_bo_pinned_fini (16 bytes) [ ] xe 0000:00:02.1: DEVRES REL ffff88811e746b40 devm_drm_dev_init_release (16 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] drmres release begin [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef81640 __fini_relay (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80d40 guc_ct_fini (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80040 __drmm_mutex_release (8 bytes) [ ] xe 0000:00:02.1: [drm:drm_managed_release] REL ffff88810ef80140 ggtt_fini_early (8 bytes) and this was leading to: [ ] BUG: unable to handle page fault for address: ffffc900058162a0 [ ] #PF: supervisor write access in kernel mode [ ] #PF: error_code(0x0002) - not-present page [ ] Oops: Oops: 0002 [#1] SMP NOPTI [ ] Tainted: [W]=WARN [ ] Workqueue: xe-ggtt-wq ggtt_node_remove_work_func [xe] [ ] RIP: 0010:xe_ggtt_set_pte+0x6d/0x350 [xe] [ ] Call Trace: [ ] [ ] xe_ggtt_clear+0xb0/0x270 [xe] [ ] ggtt_node_remove+0xbb/0x120 [xe] [ ] ggtt_node_remove_work_func+0x30/0x50 [xe] [ ] process_one_work+0x22b/0x6f0 [ ] worker_thread+0x1e8/0x3d Add managed-device action that will explicitly drain the workqueue with all pending node removals prior to releasing MMIO/GSM mapping. Fixes: 919bb54e989c ("drm/xe: Fix missing runtime outer protection for ggtt_remove_node") Signed-off-by: Michal Wajdeczko Cc: Rodrigo Vivi Cc: Lucas De Marchi Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250612220937.857-2-michal.wajdeczko@intel.com commit 4ab401099d4764d1479914fd4c8b9876d5b3aca1 Author: Linus Walleij Date: Tue Jun 24 20:47:57 2025 +0200 pinctrl: amlogic: Staticize some local structs Sparse complains: sparse warnings: (new ones prefixed by >>) >> drivers/pinctrl/meson/pinctrl-amlogic-a4.c:126:24: sparse: sparse: symbol 'multi_mux_s7' was not declared. Should it be static? >> drivers/pinctrl/meson/pinctrl-amlogic-a4.c:135:28: sparse: sparse: symbol 's7_priv_data' was not declared. Should it be static? >> drivers/pinctrl/meson/pinctrl-amlogic-a4.c:140:24: sparse: sparse: symbol 'multi_mux_s6' was not declared. Should it be static? >> drivers/pinctrl/meson/pinctrl-amlogic-a4.c:154:28: sparse: sparse: symbol 's6_priv_data' was not declared. Should it be static? Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506122145.wWAtKBoy-lkp@intel.com/ Cc: Xianwei Zhao Fixes: 1f8e5dfddaa7 ("pinctrl: meson: support amlogic S6/S7/S7D SoC") Signed-off-by: Linus Walleij Link: https://lore.kernel.org/20250624-amlogic-a4-fix-v1-1-03f0856d10cb@linaro.org commit 9c4fe6d1509b386ab78f27dfaa2d128be77dc2d2 Author: Sean Christopherson Date: Thu May 22 17:11:38 2025 -0700 KVM: x86/mmu: Defer allocation of shadow MMU's hashed page list When the TDP MMU is enabled, i.e. when the shadow MMU isn't used until a nested TDP VM is run, defer allocation of the array of hashed lists used to track shadow MMU pages until the first shadow root is allocated. Setting the list outside of mmu_lock is safe, as concurrent readers must hold mmu_lock in some capacity, shadow pages can only be added (or removed) from the list when mmu_lock is held for write, and tasks that are creating a shadow root are serialized by slots_arch_lock. I.e. it's impossible for the list to become non-empty until all readers go away, and so readers are guaranteed to see an empty list even if they make multiple calls to kvm_get_mmu_page_hash() in a single mmu_lock critical section. Use smp_store_release() and smp_load_acquire() to access the hash table pointer to ensure the stores to zero the lists are retired before readers start to walk the list. E.g. if the compiler hoisted the store before the zeroing of memory, for_each_gfn_valid_sp_with_gptes() could consume stale kernel data. Cc: James Houghton Link: https://lore.kernel.org/r/20250523001138.3182794-5-seanjc@google.com Signed-off-by: Sean Christopherson commit ac777fbf064f81b30e21f6d7023b6d0342a3fe1b Author: Sean Christopherson Date: Thu May 22 17:11:37 2025 -0700 KVM: x86: Use kvzalloc() to allocate VM struct Allocate VM structs via kvzalloc(), i.e. try to use a contiguous physical allocation before falling back to __vmalloc(), to avoid the overhead of establishing the virtual mappings. For non-debug builds, The SVM and VMX (and TDX) structures are now just below 7000 bytes in the worst case scenario (see below), i.e. are order-1 allocations, and will likely remain that way for quite some time. Add compile-time assertions in vendor code to ensure the size of the structures, sans the memslot hash tables, are order-0 allocations, i.e. are less than 4KiB. There's nothing fundamentally wrong with a larger kvm_{svm,vmx,tdx} size, but given that the size of the structure (without the memslots hash tables) is below 2KiB after 18+ years of existence, more than doubling the size would be quite notable. Add sanity checks on the memslot hash table sizes, partly to ensure they aren't resized without accounting for the impact on VM structure size, and partly to document that the majority of the size of VM structures comes from the memslots. Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250523001138.3182794-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 039ef33e2f9346258fe2bd344f212c645942575e Author: Sean Christopherson Date: Thu May 22 17:11:36 2025 -0700 KVM: x86/mmu: Dynamically allocate shadow MMU's hashed page list Dynamically allocate the (massive) array of hashed lists used to track shadow pages, as the array itself is 32KiB, i.e. is an order-3 allocation all on its own, and is *exactly* an order-3 allocation. Dynamically allocating the array will allow allocating "struct kvm" using kvmalloc(), and will also allow deferring allocation of the array until it's actually needed, i.e. until the first shadow root is allocated. Opportunistically use kvmalloc() for the hashed lists, as an order-3 allocation is (stating the obvious) less likely to fail than an order-4 allocation, and the overhead of vmalloc() is undesirable given that the size of the allocation is fixed. Cc: Vipin Sharma Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250523001138.3182794-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 6cb0e9da949aeb022b28a9b698f767c8828e283d Author: Colin Ian King Date: Mon Jun 23 23:20:04 2025 +0100 pinctrl: eswin: Fix unsigned comparison to less than zero issue The u32 variable voltage is being compared to less than zero and this can never be true. Fix this by making voltage an int type which is the same type as the return from the call to regulator_get_voltage. Fixes: 5b797bcc00ef ("pinctrl: eswin: Add EIC7700 pinctrl driver") Signed-off-by: Colin Ian King Link: https://lore.kernel.org/20250623222004.280928-1-colin.i.king@gmail.com Signed-off-by: Linus Walleij commit d94a32ac688f953dc9a9f12b5b4139ecad841bbb Author: Ze Huang Date: Tue Jun 24 00:11:14 2025 +0800 pinctrl: canaan: k230: Fix order of DT parse and pinctrl register Move DT parse before pinctrl register. This ensures that device tree parsing is done before calling devm_pinctrl_register() to prevent using uninitialized pin resources. Fixes: 545887eab6f6 ("pinctrl: canaan: Add support for k230 SoC") Reported-by: Yao Zi Signed-off-by: Ze Huang Link: https://lore.kernel.org/20250624-k230-return-check-v1-2-6b4fc5ba0c41@whut.edu.cn Signed-off-by: Linus Walleij commit 65bd0be486390fc12a84eafaad78758c5e5a55e6 Author: Ze Huang Date: Tue Jun 24 00:11:13 2025 +0800 pinctrl: canaan: k230: add NULL check in DT parse Add a NULL check for the return value of of_get_property() when retrieving the "pinmux" property in the group parser. This avoids a potential NULL pointer dereference if the property is missing from the device tree node. Also fix a typo ("sintenel") in the device ID match table comment, correcting it to "sentinel". Fixes: 545887eab6f6 ("pinctrl: canaan: Add support for k230 SoC") Reported-by: Yao Zi Signed-off-by: Ze Huang Link: https://lore.kernel.org/20250624-k230-return-check-v1-1-6b4fc5ba0c41@whut.edu.cn Signed-off-by: Linus Walleij commit b58ea88d301cd4c0403f298468442dacac4f8c4e Author: Da Xue Date: Wed Jun 18 22:23:37 2025 -0400 pinctrl: meson-g12a: add g12b pwm groups G12B and SM1 have additional PWM pinmuxes for b, c, and d. Signed-off-by: Da Xue Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/20250619022337.43900-1-da@libre.computer Signed-off-by: Linus Walleij commit c0d03cdfaccf3bc41c9531af7c4cabb0b0ce4040 Author: Arnd Bergmann Date: Fri Jun 20 15:07:55 2025 +0200 pinctrl: zynq: add CONFIG_OF dependency The zynq driver can be enabled for compile-testing on builds without CONFIG_OF, leading to a link error: ld.lld-21: error: undefined symbol: pinconf_generic_dt_node_to_map referenced by pinconf-generic.h:231 (/home/arnd/arm-soc/include/linux/pinctrl/pinconf-generic.h:231) drivers/pinctrl/pinctrl-zynq.o:(pinconf_generic_dt_node_to_map_all) in archive vmlinux.a Prevent this with the proper compile time dependency. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506212021.deAhuaWr-lkp@intel.com/ Fixes: 1982621decaf ("pinctrl: Allow compile testing for K210, TB10X and ZYNQ") Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/20250620130814.2580678-1-arnd@kernel.org Signed-off-by: Linus Walleij commit 8f6f303551100291bf2c1e1ccc66b758fffb1168 Author: Yuan Chen Date: Fri Jun 20 09:53:43 2025 +0800 pinctrl: berlin: fix memory leak in berlin_pinctrl_build_state() In the original implementation, krealloc() failure handling incorrectly assigned the original memory pointer to NULL after kfree(), causing a memory leak when reallocation failed. Fixes: de845036f997 ("pinctrl: berlin: fix error return code of berlin_pinctrl_build_state()") Signed-off-by: Yuan Chen Link: https://lore.kernel.org/20250620015343.21494-1-chenyuan_fl@163.com Signed-off-by: Linus Walleij commit e3507c56cbb208d4f160942748c527ef6a528ba1 Author: Yuan Chen Date: Fri Jun 20 09:27:08 2025 +0800 pinctrl: sunxi: Fix memory leak on krealloc failure In sunxi_pctrl_dt_node_to_map(), when krealloc() fails to resize the pinctrl_map array, the function returns -ENOMEM directly without freeing the previously allocated *map buffer. This results in a memory leak of the original kmalloc_array allocation. Fixes: e11dee2e98f8 ("pinctrl: sunxi: Deal with configless pins") Signed-off-by: Yuan Chen Link: https://lore.kernel.org/20250620012708.16709-1-chenyuan_fl@163.com Signed-off-by: Linus Walleij commit b4102e35243338d966f73ade1fec66d88e8f55ac Author: Bartosz Golaszewski Date: Thu Jun 19 19:35:37 2025 +0200 pinctrl: aw9523: fix mutex unlock in error path We must unlock the mutex *after* the `out` label or we'd trigger a deadlock in error path. Fixes: dffe286e2428 ("pinctrl: aw9523: use new GPIO line value setter callbacks") Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202506191952.A03cvn22-lkp@intel.com/ Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250619173537.64298-1-brgl@bgdev.pl Signed-off-by: Linus Walleij commit 4b443bbcd113cad6ec041a4f9f09179e2342ad60 Author: Shiji Yang Date: Wed Jun 18 22:53:28 2025 +0800 pinctrl: falcon: mark pinctrl_falcon_init() as static Fix the following missing-prototypes build warning: drivers/pinctrl/pinctrl-falcon.c:508:12: error: no previous prototype for 'pinctrl_falcon_init' [-Werror=missing-prototypes] 508 | int __init pinctrl_falcon_init(void) | ^~~~~~~~~~~~~~~~~~~ Signed-off-by: Shiji Yang Link: https://lore.kernel.org/OSBPR01MB167014AF54EF9818CB98C83BBC72A@OSBPR01MB1670.jpnprd01.prod.outlook.com Signed-off-by: Linus Walleij commit 51f4c00436b89696773e195c5f2d4a808483ff66 Author: Bhaskar Chowdhury Date: Wed Jun 11 15:29:03 2025 +0530 perf tools: Remove excess variable declarations I thought array declaration might be done in the same line as assigning the value to it. Hence, getting rid of extra steps of reiterating the array name. Signed-off-by: Bhaskar Chowdhury Link: https://lore.kernel.org/r/20250611100256.31089-1-unixbhaskar@gmail.com Signed-off-by: Namhyung Kim commit 614f806a34e134b7a35eb4b29a139b2c8c1b7795 Author: Chun-Tse Shao Date: Fri Jun 20 10:40:09 2025 -0700 perf test: Replace grep perl regexp with awk perl is not universal on all machines and should be replaced with awk, which is much more common. Before: $ perf test "probe libc's inet_pton & backtrace it with ping" -v --- start --- test child forked, pid 145431 grep: Perl matching not supported in a --disable-perl-regexp build FAIL: could not add event ---- end(-1) ---- 121: probe libc's inet_pton & backtrace it with ping : FAILED! After: $ perf test "probe libc's inet_pton & backtrace it with ping" -v 121: probe libc's inet_pton & backtrace it with ping : Ok Suggested-by: Ian Rogers Signed-off-by: Chun-Tse Shao Reviewed-by: James Clark Link: https://lore.kernel.org/r/20250620174034.819894-1-ctshao@google.com [ fold James' suggestion not to escape _ in the event pattern. ] Signed-off-by: Namhyung Kim commit 69f66cf45814f45a161688fd087abe21e6d5afbd Author: FUJITA Tomonori Date: Tue Jun 10 22:28:23 2025 +0900 rust: time: Remove Ktime in hrtimer Remove the use of `Ktime` from the hrtimer code, which was originally introduced as a temporary workaround. The hrtimer has now been fully converted to use the `Instant` and `Delta` types instead. Reviewed-by: Andreas Hindborg Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250610132823.3457263-6-fujita.tomonori@gmail.com Signed-off-by: Andreas Hindborg commit e0c0ab04f6785abaa71b9b8dc252cb1a2072c225 Author: FUJITA Tomonori Date: Tue Jun 10 22:28:22 2025 +0900 rust: time: Make HasHrTimer generic over HrTimerMode Add a `TimerMode` associated type to the `HasHrTimer` trait to represent the operational mode of the timer, such as absolute or relative expiration. This new type must implement the `HrTimerMode` trait, which defines how expiration values are interpreted. Update the `start()` method to accept an `expires` parameter of type `::Expires` instead of the fixed `Ktime`. This enables different timer modes to provide strongly typed expiration values, such as `Instant` or `Delta`. The `impl_has_hr_timer` macro is also extended to allow specifying the `HrTimerMode`. In the following example, it guarantees that the `start()` method for `Foo` only accepts `Instant`. Using a `Delta` or an `Instant` with a different clock source will result in a compile-time error: struct Foo { #[pin] timer: HrTimer, } impl_has_hr_timer! { impl HasHrTimer for Foo { mode : AbsoluteMode, field : self.timer } } This design eliminates runtime mismatches between expires types and clock sources, and enables stronger type-level guarantees throughout hrtimer. Signed-off-by: FUJITA Tomonori Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250610132823.3457263-5-fujita.tomonori@gmail.com [ changed conversion method names to `as_*` - Andreas ] Signed-off-by: Andreas Hindborg commit d9fc00dc73542eef98db74085447c57174ca290d Author: FUJITA Tomonori Date: Tue Jun 10 22:28:21 2025 +0900 rust: time: Add HrTimerExpires trait Introduce the `HrTimerExpires` trait to represent types that can be used as expiration values for high-resolution timers. Define a required method, `into_nanos()`, which returns the expiration time as a raw nanosecond value suitable for use with C's hrtimer APIs. Also extend the `HrTimerMode` to use the `HrTimerExpires` trait. This refactoring is a preparation for enabling hrtimer code to work uniformly with both absolute and relative expiration modes. Reviewed-by: Andreas Hindborg Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250610132823.3457263-4-fujita.tomonori@gmail.com [ changed conversion method names to `as_*` - Andreas ] Signed-off-by: Andreas Hindborg commit 35db1da40c8cfd7511dc42f342a133601eb45449 Author: Matthew Auld Date: Fri Jun 6 11:45:48 2025 +0100 drm/xe: move DPT l2 flush to a more sensible place Only need the flush for DPT host updates here. Normal GGTT updates don't need special flush. Fixes: 01570b446939 ("drm/xe/bmg: implement Wa_16023588340") Signed-off-by: Matthew Auld Cc: Maarten Lankhorst Cc: stable@vger.kernel.org # v6.12+ Reviewed-by: Ville Syrjälä Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250606104546.1996818-4-matthew.auld@intel.com Signed-off-by: Lucas De Marchi commit 0dd2dd0182bc444a62652e89d08c7f0e4fde15ba Author: Maarten Lankhorst Date: Fri Jun 6 11:45:47 2025 +0100 drm/xe: Move DSB l2 flush to a more sensible place Flushing l2 is only needed after all data has been written. Fixes: 01570b446939 ("drm/xe/bmg: implement Wa_16023588340") Signed-off-by: Maarten Lankhorst Cc: Matthew Auld Cc: stable@vger.kernel.org # v6.12+ Reviewed-by: Matthew Auld Signed-off-by: Matthew Auld Reviewed-by: Lucas De Marchi Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/20250606104546.1996818-3-matthew.auld@intel.com Signed-off-by: Lucas De Marchi commit be59dba332e1e8edd3e88d991ba0e4795ae2bcb2 Author: Ian Rogers Date: Tue Jun 17 15:33:56 2025 -0700 libperf evsel: Add missed puts and asserts A missed evsel__close before evsel__delete was the source of leaking perf events due to a hybrid test. Add asserts in debug builds so that this shouldn't happen in the future. Add puts missing on the cpu map and thread maps. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250617223356.2752099-4-irogers@google.com Signed-off-by: Namhyung Kim commit eda9e47fae276d2b7a2b6a826b38259e6481d879 Author: Ian Rogers Date: Tue Jun 17 15:33:55 2025 -0700 perf trace: Add missed freeing of ordered events and thread Caught by leak sanitizer running "perf trace BTF general tests". Make the ordered_events initialization unconditional and early so that trace__exit cleanup is simple - ordered_events__init doesn't allocate and just sets up 4 values and inits 3 list heads. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250617223356.2752099-3-irogers@google.com Signed-off-by: Namhyung Kim commit 9a79c50c2a95887859d5ac133180775b708b850a Author: Tianyou Li Date: Tue Jun 10 12:04:23 2025 +0800 perf script: Add -e option to flamegraph script When processing the perf data file generated with multiple events, the flamegraph script will count all the events regardless of different event names. This patch tries to add a -e option to specify the event name that the flamegraph will be generated accordingly. If the -e option omitted, the behavior remains unchanged. Signed-off-by: Tianyou Li Reviewed-by: Pan Deng Reviewed-by: Zhiguo Zhou Reviewed-by: Wangyang Guo Reviewed-by: Tim Chen Link: https://lore.kernel.org/r/20250610040536.2390060-2-tianyou.li@intel.com Signed-off-by: Namhyung Kim commit df9c299371054cb725eef730fd0f1d0fe2ed6bb0 Author: Tianyou Li Date: Tue Jun 10 12:04:22 2025 +0800 perf script: Handle -i option for perf script flamegraph If specify the perf data file with -i option, the script will try to read the header information regardless of the file name specified, instead it will try to access the perf.data. This simple patch use the file name from -i option for command perf report --header-only to read the header. Signed-off-by: Tianyou Li Reviewed-by: Pan Deng Reviewed-by: Zhiguo Zhou Reviewed-by: Wangyang Guo Reviewed-by: Tim Chen Link: https://lore.kernel.org/r/20250610040536.2390060-1-tianyou.li@intel.com Signed-off-by: Namhyung Kim commit 317fa41b47da63730145e336c9ef47c62b78ee4f Author: Namhyung Kim Date: Fri May 2 13:40:56 2025 -0700 perf trace: Show zero value in STRARRAY The STRARRAY macro is to print values in a pre-defined array. But sometimes it hides the value because it's 0. The value of 0 can have a meaning in this case so set 'show_zero' field. For example, it can show CREATE_MAP cmd in the bpf syscall. Acked-by: Howard Chu Link: https://lore.kernel.org/r/20250502204056.973977-1-namhyung@kernel.org Signed-off-by: Namhyung Kim commit c21986d33d6beb269a35b38dcb8adaa5bd228527 Author: Sergei Trofimovich Date: Mon May 5 18:44:19 2025 +0100 perf unwind-libdw: skip non-regular files Without the change `perf `hangs up on charaster devices. On my system it's enough to run system-wide sampler for a few seconds to get the hangup: $ perf record -a -g --call-graph=dwarf $ perf report # hung `strace` shows that hangup happens on reading on a character device `/dev/dri/renderD128` $ strace -y -f -p 2780484 strace: Process 2780484 attached pread64(101, strace: Process 2780484 detached It's call trace descends into `elfutils`: $ gdb -p 2780484 (gdb) bt #0 0x00007f5e508f04b7 in __libc_pread64 (fd=101, buf=0x7fff9df7edb0, count=0, offset=0) at ../sysdeps/unix/sysv/linux/pread64.c:25 #1 0x00007f5e52b79515 in read_file () from /<>/elfutils-0.192/lib/libelf.so.1 #2 0x00007f5e52b25666 in libdw_open_elf () from /<>/elfutils-0.192/lib/libdw.so.1 #3 0x00007f5e52b25907 in __libdw_open_file () from /<>/elfutils-0.192/lib/libdw.so.1 #4 0x00007f5e52b120a9 in dwfl_report_elf@@ELFUTILS_0.156 () from /<>/elfutils-0.192/lib/libdw.so.1 #5 0x000000000068bf20 in __report_module (al=al@entry=0x7fff9df80010, ip=ip@entry=139803237033216, ui=ui@entry=0x5369b5e0) at util/dso.h:537 #6 0x000000000068c3d1 in report_module (ip=139803237033216, ui=0x5369b5e0) at util/unwind-libdw.c:114 #7 frame_callback (state=0x535aef10, arg=0x5369b5e0) at util/unwind-libdw.c:242 #8 0x00007f5e52b261d3 in dwfl_thread_getframes () from /<>/elfutils-0.192/lib/libdw.so.1 #9 0x00007f5e52b25bdb in get_one_thread_cb () from /<>/elfutils-0.192/lib/libdw.so.1 #10 0x00007f5e52b25faa in dwfl_getthreads () from /<>/elfutils-0.192/lib/libdw.so.1 #11 0x00007f5e52b26514 in dwfl_getthread_frames () from /<>/elfutils-0.192/lib/libdw.so.1 #12 0x000000000068c6ce in unwind__get_entries (cb=cb@entry=0x5d4620 , arg=arg@entry=0x10cd5fa0, thread=thread@entry=0x1076a290, data=data@entry=0x7fff9df80540, max_stack=max_stack@entry=127, best_effort=best_effort@entry=false) at util/thread.h:152 #13 0x00000000005dae95 in thread__resolve_callchain_unwind (evsel=0x106006d0, thread=0x1076a290, cursor=0x10cd5fa0, sample=0x7fff9df80540, max_stack=127, symbols=true) at util/machine.c:2939 #14 thread__resolve_callchain_unwind (thread=0x1076a290, cursor=0x10cd5fa0, evsel=0x106006d0, sample=0x7fff9df80540, max_stack=127, symbols=true) at util/machine.c:2920 #15 __thread__resolve_callchain (thread=0x1076a290, cursor=0x10cd5fa0, evsel=0x106006d0, evsel@entry=0x7fff9df80440, sample=0x7fff9df80540, parent=parent@entry=0x7fff9df804a0, root_al=root_al@entry=0x7fff9df80440, max_stack=127, symbols=true) at util/machine.c:2970 #16 0x00000000005d0cb2 in thread__resolve_callchain (thread=, cursor=, evsel=0x7fff9df80440, sample=, parent=0x7fff9df804a0, root_al=0x7fff9df80440, max_stack=127) at util/machine.h:198 #17 sample__resolve_callchain (sample=, cursor=, parent=parent@entry=0x7fff9df804a0, evsel=evsel@entry=0x106006d0, al=al@entry=0x7fff9df80440, max_stack=max_stack@entry=127) at util/callchain.c:1127 #18 0x0000000000617e08 in hist_entry_iter__add (iter=iter@entry=0x7fff9df80480, al=al@entry=0x7fff9df80440, max_stack_depth=127, arg=arg@entry=0x7fff9df81ae0) at util/hist.c:1255 #19 0x000000000045d2d0 in process_sample_event (tool=0x7fff9df81ae0, event=, sample=0x7fff9df80540, evsel=0x106006d0, machine=) at builtin-report.c:334 #20 0x00000000005e3bb1 in perf_session__deliver_event (session=0x105ff2c0, event=0x7f5c7d735ca0, tool=0x7fff9df81ae0, file_offset=2914716832, file_path=0x105ffbf0 "perf.data") at util/session.c:1367 #21 0x00000000005e8d93 in do_flush (oe=0x105ffa50, show_progress=false) at util/ordered-events.c:245 #22 __ordered_events__flush (oe=0x105ffa50, how=OE_FLUSH__ROUND, timestamp=) at util/ordered-events.c:324 #23 0x00000000005e1f64 in perf_session__process_user_event (session=0x105ff2c0, event=0x7f5c7d752b18, file_offset=2914835224, file_path=0x105ffbf0 "perf.data") at util/session.c:1419 #24 0x00000000005e47c7 in reader__read_event (rd=rd@entry=0x7fff9df81260, session=session@entry=0x105ff2c0, --Type for more, q to quit, c to continue without paging-- quit prog=prog@entry=0x7fff9df81220) at util/session.c:2132 #25 0x00000000005e4b37 in reader__process_events (rd=0x7fff9df81260, session=0x105ff2c0, prog=0x7fff9df81220) at util/session.c:2181 #26 __perf_session__process_events (session=0x105ff2c0) at util/session.c:2226 #27 perf_session__process_events (session=session@entry=0x105ff2c0) at util/session.c:2390 #28 0x0000000000460add in __cmd_report (rep=0x7fff9df81ae0) at builtin-report.c:1076 #29 cmd_report (argc=, argv=) at builtin-report.c:1827 #30 0x00000000004c5a40 in run_builtin (p=p@entry=0xd8f7f8 , argc=argc@entry=1, argv=argv@entry=0x7fff9df844b0) at perf.c:351 #31 0x00000000004c5d63 in handle_internal_command (argc=argc@entry=1, argv=argv@entry=0x7fff9df844b0) at perf.c:404 #32 0x0000000000442de3 in run_argv (argcp=, argv=) at perf.c:448 #33 main (argc=, argv=0x7fff9df844b0) at perf.c:556 The hangup happens because nothing in` perf` or `elfutils` checks if a mapped file is easily readable. The change conservatively skips all non-regular files. Signed-off-by: Sergei Trofimovich Acked-by: Namhyung Kim Link: https://lore.kernel.org/r/20250505174419.2814857-1-slyich@gmail.com Signed-off-by: Namhyung Kim commit 970ae86307718c347aff8fe4bf6e780bcce26c58 Author: Arnaldo Carvalho de Melo Date: Fri Jun 20 18:24:35 2025 -0300 perf build: The bfd features are opt-in, stop testing for them by default These are leftovers noticed while updating a build container. We don't need those so that test-all.c can build and thus speed up the feature detection. Test for those features only if the user asks for BUILD_NONDISTRO=1 to build with libbfd. Signed-off-by: Arnaldo Carvalho de Melo Reviewed-by: James Clark Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250620212435.93846-4-acme@kernel.org Signed-off-by: Namhyung Kim commit 7c750d399b60e17f2a346690e0d34aae9c086eac Author: Arnaldo Carvalho de Melo Date: Fri Jun 20 18:24:34 2025 -0300 perf build: Add the libpfm devel fedora package name to the hint Just to follow the pattern with other devel packages. Signed-off-by: Arnaldo Carvalho de Melo Reviewed-by: James Clark Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250620212435.93846-3-acme@kernel.org Signed-off-by: Namhyung Kim commit c335a4e927537996b425025586d5d8db2763124c Author: Arnaldo Carvalho de Melo Date: Fri Jun 20 18:24:33 2025 -0300 perf build: Suggest java-latest-openjdk-devel instead of old 1.8.0 one Just tidying up the suggestion to pick the latest and not some specific version. Signed-off-by: Arnaldo Carvalho de Melo Reviewed-by: James Clark Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250620212435.93846-2-acme@kernel.org Signed-off-by: Namhyung Kim commit 3317dc9ebda6d585a4e74a8d4a74d0d2dc6b14c6 Author: Ian Rogers Date: Mon Jun 23 09:19:29 2025 -0700 perf srcline: Lower verbosity on addr2line debug messages Lower non-error debug messages to verbose 3 or larger. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250623161930.1421216-2-irogers@google.com Signed-off-by: Namhyung Kim commit 0a41f5af19391ce55cae1f0d7a562e8694bf1fd5 Author: Panagiotis Foliadis Date: Sat Mar 15 12:23:01 2025 +0000 rust: task: Mark Task methods inline When building the kernel using the llvm-18.1.3-rust-1.85.0-x86_64 toolchain provided by kernel.org, the following symbols are generated: $ nm vmlinux | grep ' _R'.*Task | rustfilt ... T ::get_pid_ns ... T ::tgid_nr_ns ... T ::current_pid_ns ... T ::signal_pending ... T ::uid ... T ::euid ... T ::current ... T ::wake_up ... T ::dec_ref ... T ::inc_ref These Rust symbols are trivial wrappers around the C functions. It doesn't make sense to go through a trivial wrapper for these functions, so mark them inline. [boqun: Capitalize the title, reword a bit to avoid listing all the C functions as the code already shows them and remove the addresses of the symbols in the commit log as they are different from build to build.] Link: https://github.com/Rust-for-Linux/linux/issues/1145 Reviewed-by: Benno Lossin Reviewed-by: Christian Schrefl Reviewed-by: Charalampos Mitrodimas Reviewed-by: Alice Ryhl Signed-off-by: Panagiotis Foliadis Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250315-inline-c-wrappers-v3-1-048e43fcef7d@posteo.net commit 11867144ff81ab98f4b11c99716c3e8b714b8755 Author: Kunwu Chan Date: Mon Mar 17 10:52:05 2025 +0800 rust: sync: Mark PollCondVar::drop() inline When building the kernel using the llvm-18.1.3-rust-1.85.0-x86_64 with ARCH=arm64, the following symbols are generated: $nm vmlinux | grep ' _R'.*PollCondVar | rustfilt ... T ::drop ... This Rust symbol is trivial wrappers around the C functions __wake_up_pollfree() and synchronize_rcu(). It doesn't make sense to go through a trivial wrapper for its functions, so mark it inline. [boqun: Reword the commit title and re-format the commit log per tip tree's requirement, remove unnecessary information from "nm vmlinux" result.] Link: https://github.com/Rust-for-Linux/linux/issues/1145 Suggested-by: Alice Ryhl Co-developed-by: Grace Deng Signed-off-by: Grace Deng Signed-off-by: Kunwu Chan Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250317025205.2366518-1-kunwu.chan@linux.dev commit 3f9ebeba9878679bb43ee2db7d50a4691f55e3a5 Author: Kunwu Chan Date: Mon Mar 24 14:18:34 2025 +0800 rust: sync: Mark CondVar::notify_*() inline When build the kernel using the llvm-18.1.3-rust-1.85.0-x86_64 with ARCH=arm64, the following symbols are generated: $nm vmlinux | grep ' _R'.*CondVar | rustfilt ... T ::notify_all ... T ::notify_one ... T ::notify_sync ... These notify_*() symbols are trivial wrappers around the C functions __wake_up() and __wake_up_sync(). It doesn't make sense to go through a trivial wrapper for these functions, so mark them inline. [boqun: Reword the commit title for consistency and reformat the commit log.] Suggested-by: Alice Ryhl Link: https://github.com/Rust-for-Linux/linux/issues/1145 Co-developed-by: Grace Deng Signed-off-by: Grace Deng Signed-off-by: Kunwu Chan Reviewed-by: Benno Lossin Reviewed-by: Alice Ryhl Signed-off-by: Boqun Feng Link: https://lore.kernel.org/r/20250324061835.1693125-1-kunwu.chan@linux.dev commit deea6a7d6d803d6bb874a3e6f1b312e560e6c6df Author: Vinay Belgaumkar Date: Wed Jun 18 11:50:01 2025 -0700 drm/xe/bmg: Update Wa_22019338487 Limit GT max frequency to 2600MHz and wait for frequency to reduce before proceeding with a transient flush. This is really only needed for the transient flush: if L2 flush is needed due to 16023588340 then there's no need to do this additional wait since we are already using the bigger hammer. v2: Use generic names, ensure user set max frequency requests wait for flush to complete (Rodrigo) v3: - User requests wait via wait_var_event_timeout (Lucas) - Close races on flush + user requests (Lucas) - Fix xe_guc_pc_remove_flush_freq_limit() being called on last gt rather than root gt (Lucas) v4: - Only apply the freq reducing part if a TDF is needed: L2 flush trumps the need for waiting a lower frequency Fixes: aaa08078e725 ("drm/xe/bmg: Apply Wa_22019338487") Reviewed-by: Rodrigo Vivi Signed-off-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250618-wa-22019338487-v5-4-b888388477f2@intel.com Signed-off-by: Lucas De Marchi commit 5e300ed8a545bdffc26b579c526b5fef7b2d5365 Author: Lucas De Marchi Date: Wed Jun 18 11:50:00 2025 -0700 drm/xe: Split xe_device_td_flush() xe_device_td_flush() has 2 possible implementations: an entire L2 flush or a transient flush, depending on WA 16023588340. Make this clear by splitting the function so it calls each of them. Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250618-wa-22019338487-v5-3-b888388477f2@intel.com Signed-off-by: Lucas De Marchi commit d878c97daa603573e5af01fd8beec2fffdb42ad1 Author: Lucas De Marchi Date: Wed Jun 18 11:49:59 2025 -0700 drm/xe/xe_guc_pc: Lock once to update stashed frequencies pc_set_mert_freq_cap() currently lock()/unlock() the mutex multiple times to stash the current frequencies. It's not a problem since xe_guc_pc_restore_stashed_freq() is guaranteed to be called only later in the init sequence. However, now that we have _locked() variants for this functions, use them and avoid potential issues when called from other places or using the same pattern. While at it, prefer and early return for the WA check to reduce indentation. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250618-wa-22019338487-v5-2-b888388477f2@intel.com Signed-off-by: Lucas De Marchi commit 1beae9aa2b88d3a02eb666e7b777eb2d7bc645f4 Author: Lucas De Marchi Date: Wed Jun 18 11:49:58 2025 -0700 drm/xe/guc_pc: Add _locked variant for min/max freq There are places in which the getters/setters are called one after the other causing a multiple lock()/unlock(). These are not currently a problem since they are all happening from the same thread, but there's a race possibility as calls are added outside of the early init when the max/min and stashed values need to be correlated. Add the _locked() variants to prepare for that. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250618-wa-22019338487-v5-1-b888388477f2@intel.com Signed-off-by: Lucas De Marchi commit 421d3a860d3d795b816d3efbcc3c2001c1ee1325 Author: Steven Rostedt Date: Thu Jun 12 09:34:08 2025 -0400 binder: Remove unused binder lock events Trace events can take up to 5K each when they are defined, regardless if they are used or not. The binder lock events: binder_lock, binder_locked and binder_unlock are no longer used. Remove them. Fixes: a60b890f607d ("binder: remove global binder lock") Signed-off-by: "Steven Rostedt (Google)" Reviewed-by: Alice Ryhl Acked-by: Carlos Llamas Link: https://lore.kernel.org/r/20250612093408.3b7320fa@batman.local.home Signed-off-by: Greg Kroah-Hartman commit 899385b04bc9d24d47ff5d581ee80f7feb802e38 Author: Carlos Llamas Date: Thu Jun 5 14:19:29 2025 +0000 binder: fix reversed pid/tid in log The "pid:tid" format is used consistently throughout the driver's logs with the exception of this one place where the arguments are reversed. Let's fix that. Also, collapse a multi-line comment into a single line. Cc: Steven Moreland Signed-off-by: Carlos Llamas Reviewed-by: Alice Ryhl Link: https://lore.kernel.org/r/20250605141930.1069438-1-cmllamas@google.com Signed-off-by: Greg Kroah-Hartman commit 0ef1fe4bc38673db72e39b700b29c50dfcc5a415 Author: Zijun Hu Date: Fri Jun 20 22:35:20 2025 +0800 char: misc: Fix improper and inaccurate error code returned by misc_init() misc_init() returns -EIO for __register_chrdev() invocation failure, but: - -EIO is for I/O error normally, but __register_chrdev() does not do I/O. - -EIO can not cover various error codes returned by __register_chrdev(). Fix by returning error code of __register_chrdev(). Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250620-fix_mischar-v1-3-6c2716bbf1fa@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 7aecbbdf86d3288576a84df360f96b93ceec7ee2 Author: Zijun Hu Date: Fri Jun 20 22:35:18 2025 +0800 char: misc: Remove redundant forward declarations Header miscdevice.h includes linux/device.h which has definations for below two forward declarations directly or indirectly: struct device; struct attribute_group; Remove these redundant forward declarations from miscdevice.h Signed-off-by: Zijun Hu Link: https://lore.kernel.org/r/20250620-fix_mischar-v1-1-6c2716bbf1fa@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 74d8361be3441dff0d3bd00840545288451c77a5 Author: Thadeu Lima de Souza Cascardo Date: Thu Jun 12 14:32:20 2025 -0300 char: misc: add test cases Add test cases for static and dynamic minor number allocation and deallocation. While at it, improve description and test suite name. Some of the cases include: - that static and dynamic allocation reserved the expected minors. - that registering duplicate minors or duplicate names will fail. - that failing to create a sysfs file (due to duplicate names) will deallocate the dynamic minor correctly. - that dynamic allocation does not allocate a minor number in the static range. - that there are no collisions when mixing dynamic and static allocations. - that opening devices with various minor device numbers work. - that registering a static number in the dynamic range won't conflict with a dynamic allocation. This last test verifies the bug fixed by commit 6d04d2b554b1 ("misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minors") has not regressed. Signed-off-by: Thadeu Lima de Souza Cascardo Link: https://lore.kernel.org/r/20250612-misc-dynrange-v5-1-6f35048f7273@igalia.com Signed-off-by: Greg Kroah-Hartman commit 81bfbb2d80eec19132bc1d8d0f6d26508363d813 Author: Yumeng Fang Date: Mon Jun 23 20:29:44 2025 +0800 misc: enclosure: Use str_on_off() helper Remove hard-coded strings by using the str_on_off() helper. Signed-off-by: Yumeng Fang Link: https://lore.kernel.org/r/20250623202944425TQzPdeMtYA8qRtlrnwiR8@zte.com.cn Signed-off-by: Greg Kroah-Hartman commit 587d1c3c2550abd5592e1f0dc0030538c9ed9216 Author: Ricky Wu Date: Fri Jun 20 15:13:25 2025 +0800 misc: rtsx: Add support for RTS5264 Version B and optimize init flow This patch adds support for the Realtek RTS5264 Version B card reader controller. To support this chip revision, the driver introduces specific initialization logic to handle the hardware requirements of Version B. The probe flow is updated to detect this version and apply the necessary register configurations. Additionally, the initialization sequence for Version B has been optimized to improve robustness and ensure proper device setup during power-on. These changes ensure correct operation and compatibility with systems using RTS5264 Version B. Signed-off-by: Ricky Wu Link: https://lore.kernel.org/r/20250620071325.1887017-1-ricky_wu@realtek.com Signed-off-by: Greg Kroah-Hartman commit 01c6d1df98cb4313e1a79ef5c064a485d3b271fd Author: Ankit Chauhan Date: Fri Jun 20 08:17:05 2025 +0530 misc: ocxl: Replace scnprintf() with sysfs_emit() in sysfs show functions Replace scnprintf() with sysfs_emit() in sysfs show functions. These helpers are preferred in sysfs callbacks because they automatically handle buffer size and improve safety and readability. Signed-off-by: Ankit Chauhan Acked-by: Andrew Donnellan Link: https://lore.kernel.org/r/20250620024705.11321-1-ankitchauhan2065@gmail.com Signed-off-by: Greg Kroah-Hartman commit ea6895f021c0716a280eff576d3f64f549187faa Author: Dr. David Alan Gilbert Date: Sat Jun 14 02:03:44 2025 +0100 misc: vmw_vmci: Remove unused qpair functions vmci_qpair_dequeue(), vmci_qpair_enqueue() and vmci_qpair_peek() were added in 2013 by commit 06164d2b72aa ("VMCI: queue pairs implementation.") but have remained unused. Remove them. (The iov version of those functions is used) Signed-off-by: "Dr. David Alan Gilbert" Link: https://lore.kernel.org/r/20250614010344.636076-4-linux@treblig.org Signed-off-by: Greg Kroah-Hartman commit 2ce80bc11ff91913bc6eb31a5876621f090cf5cc Author: Dr. David Alan Gilbert Date: Sat Jun 14 02:03:43 2025 +0100 misc: vmw_vmci: Remove unused vmci_doorbell_notify vmci_doorbell_notify() was added in 2013 by commit 83e2ec765be0 ("VMCI: doorbell implementation.") but has remained unused. Remove it. Signed-off-by: "Dr. David Alan Gilbert" Link: https://lore.kernel.org/r/20250614010344.636076-3-linux@treblig.org Signed-off-by: Greg Kroah-Hartman commit 5bce7d47d5b5d53388e31de85adb8a8f578e248f Author: Dr. David Alan Gilbert Date: Sat Jun 14 02:03:42 2025 +0100 misc: vmw_vmci: Remove unused vmci_ctx functions vmci_ctx_dbell_destroy_all() and vmci_ctx_pending_datagrams() were added in 2013 by commit 28d6692cd8fb ("VMCI: context implementation.") but have remained unused. Remove them. Signed-off-by: "Dr. David Alan Gilbert" Link: https://lore.kernel.org/r/20250614010344.636076-2-linux@treblig.org Signed-off-by: Greg Kroah-Hartman commit a02fd05661d73a8507dd70dd820e9b984490c545 Author: Huacai Chen Date: Tue Jun 24 14:29:27 2025 +0800 PCI: Extend isolated function probing to LoongArch Like s390 and the jailhouse hypervisor, LoongArch's PCI architecture allows passing isolated PCI functions to a guest OS instance. So it is possible that there is a multi-function device without function 0 for the host or guest. Allow probing such functions by adding a IS_ENABLED(CONFIG_LOONGARCH) case in the hypervisor_isolated_pci_functions() helper. This is similar to commit 189c6c33ff42 ("PCI: Extend isolated function probing to s390"). Signed-off-by: Huacai Chen Signed-off-by: Bjorn Helgaas Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20250624062927.4037734-1-chenhuacai@loongson.cn commit 17481c41f56088c4e2c1ff2921d4d2670ab4243d Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:42 2025 +0200 misc: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Arnd Bergmann Link: https://lore.kernel.org/r/20250611104348.192092-14-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit bf7b4a0e25569ce39c6749afe363aefe5723d326 Author: Greg Kroah-Hartman Date: Wed May 21 16:16:26 2025 +0200 drivers: misc: sram: fix up some const issues with recent attribute changes The binary attribute const changes recently for the sram driver were made in a way that hid the fact that we would be casting a const pointer to a non-const one. So explicitly make the cast so that it is obvious and preserve the const pointer in the sram_reserve_cmp() function. Cc: Arnd Bergmann Cc: Thomas Weißschuh Fixes: c3b8c358c4f3 ("misc: sram: constify 'struct bin_attribute'") Link: https://lore.kernel.org/r/2025052125-squid-sandstorm-a418@gregkh Signed-off-by: Greg Kroah-Hartman commit 8070aa7be066fe2e7708b69412f0a8e0d9322c69 Author: Johannes Berg Date: Fri Jun 6 09:12:56 2025 +0200 drivers: char: SONYPI depends on HAS_IOPORT It already depends on X86_32, but that's also set for ARCH=um. Recent changes made UML no longer have IO port access since it's not needed, but this driver uses it. Build it only for HAS_IOPORT. This is pretty much the same as depending on X86, but on the off-chance that HAS_IOPORT will ever be optional on x86 HAS_IOPORT is the real prerequisite. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506060742.XR3HcxWA-lkp@intel.com/ Signed-off-by: Johannes Berg Acked-by: Randy Dunlap Tested-by: Randy Dunlap Acked-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250606071255.7722-2-johannes@sipsolutions.net Signed-off-by: Greg Kroah-Hartman commit 9a944494c299fabf3cc781798eb7c02a0bece364 Author: Clément Le Goffic Date: Mon Jun 16 11:21:07 2025 +0200 spi: dt-bindings: stm32: deprecate `st,spi-midi-ns` property The vendor `st,spi-midi-ns` property is no longer needed and has been deprecated in favor of a generic solution. Signed-off-by: Clément Le Goffic Link: https://patch.msgid.link/20250616-spi-upstream-v1-6-7e8593f3f75d@foss.st.com Signed-off-by: Mark Brown commit bd60f94a3eb4f80cb66c9687d640554fd0c579d0 Author: Clément Le Goffic Date: Mon Jun 16 11:21:04 2025 +0200 spi: dt-bindings: stm32: update bindings with SPI Rx DMA-MDMA chaining Add MDMA channel, and new sram property which are mandatory to enable SPI Rx DMA-MDMA chaining. Signed-off-by: Clément Le Goffic Link: https://patch.msgid.link/20250616-spi-upstream-v1-3-7e8593f3f75d@foss.st.com Signed-off-by: Mark Brown commit 4956bf44524394211ca80aa04d0c9e1e9bb0219d Author: Clément Le Goffic Date: Mon Jun 16 11:21:06 2025 +0200 spi: stm32: deprecate `st,spi-midi-ns` property The `st,spi-midi-ns` property, which was used to set a nanosecond delay between transferred words, is now deprecated. This functionality is now supported by the SPI framework through the `spi_transfer` struct's `word_delay` variable. Therefore, the private `st,spi-midi-ns` property is no longer needed and has been deprecated in favor of the generic solution. Signed-off-by: Clément Le Goffic Link: https://patch.msgid.link/20250616-spi-upstream-v1-5-7e8593f3f75d@foss.st.com Signed-off-by: Mark Brown commit d17dd2f1d8a1d919e39c6302b024f135a2f90773 Author: Clément Le Goffic Date: Mon Jun 16 11:21:05 2025 +0200 spi: stm32: use STM32 DMA with STM32 MDMA to enhance DDR use The STM32 DMA doesn't have the ability to generate convenient burst transfer on the DDR, ensuring the best load of the AXI & DDR. To avoid this bad load of the AXI & DDR, STM32 MDMA can be used to transfer data to the DDR, being triggered by STM32 DMA channel transfer completion. An SRAM buffer is used between DMA and MDMA. So the MDMA always does MEM_TO_MEM transfers (from/to SRAM to/from DDR), and the DMA uses SRAM instead of DDR with DEV_TO_MEM transfers. SPI RX DMA (DEV_TO_MEM) becomes: SPI RX FIFO ==DMA==> SRAM ==MDMA==> DDR In RX (DEV_TO_MEM), EOT interrupt is used to pause the DMA channel (which will raise a transfer complete) to trigger the MDMA to flush the SRAM (when transfer length is not aligned on SRAM period). TX remains on the former implementation. Signed-off-by: Clément Le Goffic Link: https://patch.msgid.link/20250616-spi-upstream-v1-4-7e8593f3f75d@foss.st.com Signed-off-by: Mark Brown commit 21f1c800f6620e43f31dfd76709dbac8ebaa5a16 Author: Clément Le Goffic Date: Mon Jun 16 11:21:03 2025 +0200 spi: stm32: Check for cfg availability in stm32_spi_probe The stm32_spi_probe function now includes a check to ensure that the pointer returned by of_device_get_match_data is not NULL before accessing its members. This resolves a warning where a potential NULL pointer dereference could occur when accessing cfg->has_device_mode. Before accessing the 'has_device_mode' member, we verify that 'cfg' is not NULL. If 'cfg' is NULL, an error message is logged. This change ensures that the driver does not attempt to access configuration data if it is not available, thus preventing a potential system crash due to a NULL pointer dereference. Signed-off-by: Clément Le Goffic Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202310191831.MLwx1c6x-lkp@intel.com/ Fixes: fee681646fc8 ("spi: stm32: disable device mode with st,stm32f4-spi compatible") Link: https://patch.msgid.link/20250616-spi-upstream-v1-2-7e8593f3f75d@foss.st.com Signed-off-by: Mark Brown commit e4feefa5c71912ebfcb97a3dbe2b021fd1cea9d1 Author: Clément Le Goffic Date: Mon Jun 16 11:21:02 2025 +0200 spi: stm32: Add SPI_READY mode to spi controller The spi ready functionality is supported by our peripheral in host and target modes on STM32MP2x SoCs. Update our spi controller driver to allow devices to use this functionality. Signed-off-by: Clément Le Goffic Link: https://patch.msgid.link/20250616-spi-upstream-v1-1-7e8593f3f75d@foss.st.com Signed-off-by: Mark Brown commit 7322a7d80c48f81888414f347e88ebd4e49f7f56 Merge: a50522962453b7 05062834350f0b Author: Johannes Berg Date: Tue Jun 24 17:39:15 2025 +0200 Merge tag 'ath-next-20250624' of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v6.17 All ath drivers: Add "#include " to all files that use EXPORT_SYMBOL() to fix a newly introduced 'make W=1' check. Note that check has subsequently been changed to only test when W=2, but keep the fixes to suppress the warning for 'make W=2'. ath12k: Properly handle scan requests on multi-radio wiphy devices. Perform the usual set of bug fixes and cleanups. ================== Signed-off-by: Johannes Berg commit 35e8a426b16adbecae7a4e0e3c00fc8d0273db53 Author: Hans de Goede Date: Mon Jun 23 10:50:52 2025 +0200 mei: bus: Check for still connected devices in mei_cl_bus_dev_release() mei_cl_bus_dev_release() also frees the mei-client (struct mei_cl) belonging to the device being released. If there are bugs like the just fixed bug in the ACE/CSI2 mei drivers, the mei-client being freed might still be part of the mei_device's file_list and iterating over this list after the freeing will then trigger a use-afer-free bug. Add a check to mei_cl_bus_dev_release() to make sure that the to-be-freed mei-client is not on the mei_device's file_list. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250623085052.12347-11-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit cee3dba7b7416c02ff3cd27489f82859cc852532 Author: Hans de Goede Date: Mon Jun 23 10:50:51 2025 +0200 mei: vsc: Fix "BUG: Invalid wait context" lockdep error Kernels build with CONFIG_PROVE_RAW_LOCK_NESTING report the following tp-vsc lockdep error: ============================= [ BUG: Invalid wait context ] ... swapper/10/0 is trying to lock: ffff88819c271888 (&tp->xfer_wait){....}-{3:3}, at: __wake_up (kernel/sched/wait.c:106 kernel/sched/wait.c:127) ... Call Trace: ... __raw_spin_lock_irqsave (./include/linux/spinlock_api_smp.h:111) __wake_up (kernel/sched/wait.c:106 kernel/sched/wait.c:127) vsc_tp_isr (drivers/misc/mei/vsc-tp.c:110) mei_vsc_hw __handle_irq_event_percpu (kernel/irq/handle.c:158) handle_irq_event (kernel/irq/handle.c:195 kernel/irq/handle.c:210) handle_edge_irq (kernel/irq/chip.c:833) ... The root-cause of this is the IRQF_NO_THREAD flag used by the intel-pinctrl code. Setting IRQF_NO_THREAD requires all interrupt handlers for GPIO ISRs to use raw-spinlocks only since normal spinlocks can sleep in PREEMPT-RT kernels and with IRQF_NO_THREAD the interrupt handlers will always run in an atomic context [1]. vsc_tp_isr() calls wake_up(&tp->xfer_wait), which uses a regular spinlock, breaking the raw-spinlocks only rule for Intel GPIO ISRs. Make vsc_tp_isr() run as threaded ISR instead of as hard ISR to fix this. Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device") Link: https://lore.kernel.org/linux-gpio/18ab52bd-9171-4667-a600-0f52ab7017ac@kernel.org/ [1] Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250623085052.12347-10-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit de88b02c94db7f3c115eb5bfdc1ec444934f277a Author: Hans de Goede Date: Mon Jun 23 10:50:50 2025 +0200 mei: vsc: Run event callback from a workqueue The event_notify callback in some cases calls vsc_tp_xfer(), which checks tp->assert_cnt and waits for it through the tp->xfer_wait wait-queue. And tp->assert_cnt is increased and the tp->xfer_wait queue is woken o from the interrupt handler. So the interrupt handler which is running the event callback is waiting for itself to signal that it can continue. This happens to work because the event callback runs from the threaded ISR handler and while that is running the hard ISR handler will still get called a second / third time for further interrupts and it is the hard ISR handler which does the atomic_inc() and wake_up() calls. But having the threaded ISR handler wait for its own interrupt to trigger again is not how a threaded ISR handler is supposed to be used. Move the running of the event callback from a threaded interrupt handler to a workqueue since a threaded ISR should not wait for events from its own interrupt. This is a preparation patch for moving the atomic_inc() and wake_up() calls to the threaded ISR handler, which is necessary to fix a locking issue. Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250623085052.12347-9-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6175c6974095f8ca7e5f8d593171512f3e5bd453 Author: Hans de Goede Date: Mon Jun 23 10:50:49 2025 +0200 mei: vsc: Unset the event callback on remove and probe errors Make mei_vsc_remove() properly unset the callback to avoid a dead callback sticking around after probe errors or unbinding of the platform driver. Fixes: 386a766c4169 ("mei: Add MEI hardware support for IVSC device") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250623085052.12347-8-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit 18f14b2e7f73c7ec272d833d570b632286467c7d Author: Hans de Goede Date: Mon Jun 23 10:50:48 2025 +0200 mei: vsc: Event notifier fixes vsc_tp_register_event_cb() can race with vsc_tp_thread_isr(), add a mutex to protect against this. Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250623085052.12347-7-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit 35b7f3525fe0a7283de7116e3c75ee3ccb3b14c9 Author: Hans de Goede Date: Mon Jun 23 10:50:47 2025 +0200 mei: vsc: Destroy mutex after freeing the IRQ The event_notify callback which runs from vsc_tp_thread_isr may call vsc_tp_xfer() which locks the mutex. So the ISR depends on the mutex. Move the mutex_destroy() call to after free_irq() to ensure that the ISR is not running while the mutex is destroyed. Fixes: 566f5ca97680 ("mei: Add transport driver for IVSC device") Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250623085052.12347-6-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit 78ab08efa3f8502677b3fa5afb66f73b526a6d90 Author: Hans de Goede Date: Mon Jun 23 10:50:46 2025 +0200 mei: vsc: Use vsc_tp_remove() as shutdown handler After removing the vsc_tp_reset() call from vsc_tp_shutdown() it is now identical to vsc_tp_remove(). Use vsc_tp_remove() as shutdown handler and remove vsc_tp_shutdown(). Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250623085052.12347-5-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0b504fdb85fe400d3dd3c0e707af21aae2aeca8f Author: Hans de Goede Date: Mon Jun 23 10:50:45 2025 +0200 mei: vsc: Don't call vsc_tp_reset() a second time on shutdown Now that mei_vsc_hw_reset() no longer re-inits the VSC when called from mei_stop(), vsc_tp_shutdown() unregistering the platform-device, which runs mei_stop() is sufficient to put the VSC in a clean state. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250623085052.12347-4-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit 880af854d6343b796f05b9a8b52b68a88535625b Author: Hans de Goede Date: Mon Jun 23 10:50:44 2025 +0200 mei: vsc: Don't re-init VSC from mei_vsc_hw_reset() on stop mei_vsc_hw_reset() gets called from mei_start() and mei_stop() in the latter case we do not need to re-init the VSC by calling vsc_tp_init(). mei_stop() only happens on shutdown and driver unbind. On shutdown we don't need to load + boot the firmware and if the driver later is bound to the device again then mei_start() will do another reset. The intr_enable flag is true when called from mei_start() and false on mei_stop(). Skip vsc_tp_init() when intr_enable is false. This avoids unnecessarily uploading the firmware, which takes 11 seconds. This change reduces the poweroff/reboot time by 11 seconds. Fixes: 386a766c4169 ("mei: Add MEI hardware support for IVSC device") Signed-off-by: Hans de Goede Reviewed-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250623085052.12347-3-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit a49159aa80207d49569b7453b4838f2f9501a17c Author: Hans de Goede Date: Mon Jun 23 10:50:43 2025 +0200 mei: vsc: Drop unused vsc_tp_request_irq() and vsc_tp_free_irq() Drop the unused vsc_tp_request_irq() and vsc_tp_free_irq() functions. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250623085052.12347-2-hansg@kernel.org Signed-off-by: Greg Kroah-Hartman commit 217592d08bc61bee770b3935dc499a14cfa3e35f Author: Moon Hee Lee Date: Fri Jun 20 11:11:44 2025 -0700 mei: bus: replace sprintf/scnprintf with sysfs_emit in show functions Update all device attribute show callbacks in the MEI bus driver to use sysfs_emit(), as recommended by Documentation/filesystems/sysfs.rst. This improves consistency and aligns with current sysfs guidelines, even though the existing use of sprintf/scnprintf is functionally safe. Signed-off-by: Moon Hee Lee Acked-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250620181144.10750-1-moonhee.lee.ca@gmail.com Signed-off-by: Greg Kroah-Hartman commit 867673063e1da91cf960133f25d87e38fc790d7b Merge: f077638b5f1908 914e6b1e85c571 Author: Christian Brauner Date: Tue Jun 24 13:00:16 2025 +0200 Merge patch series "fhandle, pidfs: allow open_by_handle_at() purely based on file handle" Christian Brauner says: Various filesystems such as pidfs and drm support opening file handles without having to require a file descriptor to identify the filesystem. The filesystem are global single instances and can be trivially identified solely on the information encoded in the file handle. This makes it possible to not have to keep or acquire a sentinal file descriptor just to pass it to open_by_handle_at() to identify the filesystem. That's especially useful when such sentinel file descriptor cannot or should not be acquired. For pidfs this means a file handle can function as full replacement for storing a pid in a file. Instead a file handle can be stored and reopened purely based on the file handle. Such autonomous file handles can be opened with or without specifying a a file descriptor. If no proper file descriptor is used the FD_PIDFS_ROOT sentinel must be passed. This allows us to define further special negative fd sentinels in the future. Userspace can trivially test for support by trying to open the file handle with an invalid file descriptor. * patches from https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-0-d02a04858fe3@kernel.org: selftests/pidfd: decode pidfd file handles withou having to specify an fd fhandle, pidfs: support open_by_handle_at() purely based on file handle uapi/fcntl: add FD_PIDFS_ROOT uapi/fcntl: add FD_INVALID uapi/fcntl: mark range as reserved fhandle: reflow get_path_anchor() pidfs: add pidfs_root_path() helper fhandle: rename to get_path_anchor() fhandle: hoist copy_from_user() above get_path_from_fd() fhandle: raise FILEID_IS_DIR in handle_type Link: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-0-d02a04858fe3@kernel.org Signed-off-by: Christian Brauner commit 914e6b1e85c5715ca2e7ec6293c05c71e9a98e86 Author: Christian Brauner Date: Tue Jun 24 10:29:14 2025 +0200 selftests/pidfd: decode pidfd file handles withou having to specify an fd Link: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-11-d02a04858fe3@kernel.org Reviewed-by: Jan Kara Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit b95361481b1e5bd3627835b7e4b921d5a09e68a4 Author: Christian Brauner Date: Tue Jun 24 10:29:13 2025 +0200 fhandle, pidfs: support open_by_handle_at() purely based on file handle Various filesystems such as pidfs (and likely drm in the future) have a use-case to support opening files purely based on the handle without having to require a file descriptor to another object. That's especially the case for filesystems that don't do any lookup whatsoever and there's zero relationship between the objects. Such filesystems are also singletons that stay around for the lifetime of the system meaning that they can be uniquely identified and accessed purely based on the file handle type. Enable that so that userspace doesn't have to allocate an object needlessly especially if they can't do that for whatever reason. Link: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-10-d02a04858fe3@kernel.org Reviewed-by: Jan Kara Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 3941e37f62fe2c3c8b8675c12183185f20450539 Author: Christian Brauner Date: Tue Jun 24 16:57:51 2025 +0200 uapi/fcntl: add FD_PIDFS_ROOT Add a special file descriptor indicating the root of the pidfs filesystem. Signed-off-by: Christian Brauner commit eb90d36bfa0674ac2f1713a3376abacc5539ecd0 Author: Dmitry Baryshkov Date: Sat Jun 21 21:13:03 2025 +0300 usb: typec: ucsi: yoga-c630: register DRM HPD bridge On Qualcomm platforms DisplayPort driver expects to have a drm bridge in the final device on the USB-C chain. Register the DRM HPD bridge in order to fulfill this requirement and to send HPD events to the DRM driver. Signed-off-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250621-c630-ucsi-v1-8-a86de5e11361@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 49bf6ee89ebadc98bac9628b03b81073ab5eb57a Author: Dmitry Baryshkov Date: Sat Jun 21 21:13:02 2025 +0300 usb: typec: ucsi: yoga-c630: handle USB / HPD messages to set port orientation Parse USB / HPD messages from EC in order to set the orientation of the corresponding Type-C port, letting connected USB 3 devices to enjoy SuperSpeed connection rather than beign limited to HighSpeed only (if the orientation didn't match). Signed-off-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250621-c630-ucsi-v1-7-a86de5e11361@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit e943c93333e305d1c02f946473227de06caed702 Author: Dmitry Baryshkov Date: Sat Jun 21 21:13:01 2025 +0300 usb: typec: ucsi: yoga-c630: correct response for GET_CURRENT_CAM On Lenovo Yoga C630 the EC handles GET_CURRENT_CAM command, but it returns 1 if DisplayPort is active and 0 otherwise. However in order to let UCSI drivers handle AltModes correctly, it should return 0 / 0xff. Correct returned value. Signed-off-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250621-c630-ucsi-v1-6-a86de5e11361@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 442392f98d20c501764dca35ddbd40e86786ea9b Author: Dmitry Baryshkov Date: Sat Jun 21 21:13:00 2025 +0300 usb: typec: ucsi: yoga-c630: fake AltModes for port 0 EC firmware provides information about partner AltModes and handles the DisplayPort AltMode internally, however it doesn't report AltModes of the port to the host. Fake the DP AltMode for port0 in order to let Linux bind displayport AltMode driver. Signed-off-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250621-c630-ucsi-v1-5-a86de5e11361@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit eebd39f8a8998582dc177ea04172b01290e4ecce Author: Dmitry Baryshkov Date: Sat Jun 21 21:12:59 2025 +0300 usb: typec: ucsi: yoga-c630: remove extra AltModes for port 1 On Lenovo Yoga C630 the EC firmware is buggy and it cat return altmodes for a device pushed into the port 0 (right) when the driver asks for altmodes for port 1 (left). Since the left Type-C port doesn't support DP anyway, ignore all UCSI_GET_ALTERNATE_MODES commands destined to the port 1. Signed-off-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250621-c630-ucsi-v1-4-a86de5e11361@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit e0c48e42d818aba4ffadf4735352844fd7e0ec9e Author: Dmitry Baryshkov Date: Sat Jun 21 21:12:58 2025 +0300 usb: typec: ucsi: yoga-c630: remove duplicate AltModes On Lenovo Yoga C630 the EC firmware is buggy and it returns duplicate AltModes over and over again instead of returning an empty one, as demanded by the spec. Ignore extra altmodes by zeroing them in the update_altmodes() callback. It is not possible to shortcut that in the sync_control() callback since we need to know if the AltMode matches the first reported AltMode or not. Signed-off-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250621-c630-ucsi-v1-3-a86de5e11361@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit a669133d971fddbdf4b3bf1be9e0069f650717e7 Author: Dmitry Baryshkov Date: Sat Jun 21 21:12:57 2025 +0300 usb: typec: ucsi: add recipient arg to update_altmodes() callback The update_altmodes() is executed only for connetor's AltModes, because that's what required on the CCG platforms. Other platforms (like Lenovo Yoga C630) requires similar fix for partner's AltModes. Extend update_altmodes() callback to accept the recipient as an argument and move corresponding check to the CCG UCSI driver. Signed-off-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250621-c630-ucsi-v1-2-a86de5e11361@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 168c3896f32e78e7b87f6aa9e85af36e47a9f96c Author: Dmitry Baryshkov Date: Sat Jun 21 21:12:56 2025 +0300 usb: typec: ucsi: yoga-c630: fix error and remove paths Fix memory leak and call ucsi_destroy() from the driver's remove function and probe's error path in order to remove debugfs files and free the memory. Also call yoga_c630_ec_unregister_notify() in the probe's error path. Fixes: 2ea6d07efe53 ("usb: typec: ucsi: add Lenovo Yoga C630 glue driver") Signed-off-by: Dmitry Baryshkov Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250621-c630-ucsi-v1-1-a86de5e11361@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 860295a6bbbb9a9fd7e03dea7790cbcdad31da0c Author: Inochi Amaoto Date: Wed Jun 18 11:11:30 2025 +0800 usb: dwc2: follow compatible string change for Sophgo CV18XX/SG200X series SoC As the wildcard name is dropped and favor new compatible string which match a real SoC, and it is not used for any board at now. Rename it to sophgo,cv1800b-usb to match the binding change. Signed-off-by: Inochi Amaoto Acked-by: Minas Harutyunyan Link: https://lore.kernel.org/r/20250618031132.373216-3-inochiama@gmail.com Signed-off-by: Greg Kroah-Hartman commit 671e50c6b5333bcd464bf74e6193ed49686f049a Author: Inochi Amaoto Date: Wed Jun 18 11:11:29 2025 +0800 dt-bindings: usb: dwc2: rename sophgo usb compatible string The support for Sophgo CV1800 series SoC introduces a wildcard compatible string "sophgo,cv1800-usb", rename it to sophgo,cv1800b-usb to match a real world SoC. As the compatible string is not used in any board dts. It is safe to rename it. Signed-off-by: Inochi Amaoto Link: https://lore.kernel.org/r/20250618031132.373216-2-inochiama@gmail.com Signed-off-by: Greg Kroah-Hartman commit ba9591f39d530eb7cab122d312d471985733767a Author: Prashanth K Date: Thu Jun 19 17:33:39 2025 +0530 usb: dwc3: gadget: Remove duplicate check while setting xfer resource Remove the duplicate check for DWC3_EP_RESOURCE_ALLOCATED flag, as its already checked inside dwc3_gadget_set_xfer_resource() Signed-off-by: Prashanth K Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/20250619120339.847708-1-prashanth.k@oss.qualcomm.com Signed-off-by: Greg Kroah-Hartman commit 4f4b2f13044d55190ac7963dc8ef563a39844548 Author: Hendrik Hamerlinck Date: Mon Jun 23 16:09:50 2025 +0200 usb: ehci: replace scnprintf() with sysfs_emit() Per Documentation/filesystems/sysfs.rst, show() methods should only use sysfs_emit() or sysfs_emit_at() when formatting values to be returned to userspace. Convert the uses of scnprintf() in sysfs show() methods to sysfs_emit() and sysfs_emit_at() for better safety and consistency. Signed-off-by: Hendrik Hamerlinck Link: https://lore.kernel.org/r/20250623140950.61568-1-hendrik.hamerlinck@hammernet.be Signed-off-by: Greg Kroah-Hartman commit 711d41ab4a0e4230e394fd5da5b85604ddb9fc51 Author: Hanne-Lotta Mäenpää Date: Sat Jun 21 19:40:05 2025 +0300 usb: core: Use sysfs_emit_at() when showing dynamic IDs When formatting the dynamic USB device IDs to show to the user space, instead of scnprintf() function use sysfs_emit_at(). The functions are equivalent, but using the latter is recommended as it ensures that no buffer overruns occur. Testing the change can be done by assigning new IDs to the USB driver's sysfs attribute new_id, and then checking that the same values are returned. For example: echo 4533 7515 > /sys/bus/usb/drivers/usbfs/new_id cat /sys/bus/usb/drivers/usbfs/new_id The output should match the assigned IDs (4533 7515). Signed-off-by: Hanne-Lotta Mäenpää Link: https://lore.kernel.org/r/20250621164005.4004-1-hannelotta@gmail.com Signed-off-by: Greg Kroah-Hartman commit 8b4f6fafed6cd9a36716dd4846f27cc543f52303 Author: RD Babiera Date: Mon Jun 23 20:49:45 2025 +0000 usb: typec: altmodes/displayport: add irq_hpd to sysfs Add irq_hpd sysfs node to displayport driver. This allows the userspace to subscribe to irq events similar to how it can subscribe to changes in hpd. irq_hpd is read only and returns the number of irq events generated since driver probe. pending_irq_hpd is added so that a sysfs_emit can be generated if the HPD high event belonging to the same status message is delayed until a successful configuration. Signed-off-by: RD Babiera Reviewed-by: Badhri Jagan Sridharan Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250623204947.732915-2-rdbabiera@google.com Signed-off-by: Greg Kroah-Hartman commit 6241b49540a65a6d5274fa938fd3eb4cbfe2e076 Author: Jiri Slaby (SUSE) Date: Tue Jun 24 10:06:41 2025 +0200 tty: fix tty_port_tty_*hangup() kernel-doc The commit below added a new helper, but omitted to move (and add) the corressponding kernel-doc. Do it now. Signed-off-by: "Jiri Slaby (SUSE)" Fixes: 2b5eac0f8c6e ("tty: introduce and use tty_port_tty_vhangup() helper") Link: https://lore.kernel.org/all/b23d566c-09dc-7374-cc87-0ad4660e8b2e@linux.intel.com/ Reported-by: Ilpo Järvinen Cc: Jonathan Corbet Cc: linux-doc@vger.kernel.org Link: https://lore.kernel.org/r/20250624080641.509959-6-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 543a5af343402d007689f2ec8cfc11670b368b8c Author: Jiri Slaby (SUSE) Date: Tue Jun 24 10:06:40 2025 +0200 serial: 8250: document doubled "type == PORT_8250_CIR" check The check for "port.type == PORT_8250_CIR" is present twice in serial8250_register_8250_port(). The latter was already tried to be dropped by 1104321a7b3b ("serial: Delete dead code for CIR serial ports") and then reverted by 9527b82ae3af ("Revert "serial: Delete dead code for CIR serial ports""). Document this weirdness with a reason. Signed-off-by: "Jiri Slaby (SUSE)" Suggested-by: Andy Shevchenko Acked-by: Andy Shevchenko Cc: "Maciej S. Szmigiero" Link: https://lore.kernel.org/all/aFcDOx1bdB34I5hS@surfacebook.localdomain/ Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250624080641.509959-5-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2721fc7adc923fb8d6ff55028e3e460ed93c1cb5 Author: Jiri Slaby (SUSE) Date: Tue Jun 24 10:06:39 2025 +0200 serial: 8250: rename lsr_TEMT, iir_NOINT to lowercase There are already variables like 'iir_noint1' and 'iir_noint2'. Follow the preexisting lowercase naming of variables. So s/lsr_TEMT/lsr_temt/ and 'iir_NOINT' likewise. Signed-off-by: "Jiri Slaby (SUSE)" Suggested-by: Ilpo Järvinen Reviewed-by: Ilpo Järvinen Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250624080641.509959-4-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit ff446fb8c5983b7518a53dbbea90264501a576ec Author: Jiri Slaby (SUSE) Date: Tue Jun 24 10:06:38 2025 +0200 serial: 8250: extract serial8250_iir_txen_test() After commit 795158691cc0 ("serial: 8250: extract serial8250_initialize()"), split serial8250_initialize() even more -- the TX enable test part of this code can be separated into serial8250_iir_txen_test(). Signed-off-by: "Jiri Slaby (SUSE)" Suggested-by: Ilpo Järvinen Reviewed-by: Ilpo Järvinen Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250624080641.509959-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 7bdf59c79cf3757fc25c00800f73093cdd6323d4 Author: Jiri Slaby (SUSE) Date: Tue Jun 24 10:06:37 2025 +0200 serial: 8250: extract serial8250_init_mctrl() After commit 795158691cc0 ("serial: 8250: extract serial8250_initialize()"), split serial8250_initialize() even more -- the mctrl part of this code can be separated into serial8250_init_mctrl() -- done now. Signed-off-by: "Jiri Slaby (SUSE)" Suggested-by: Ilpo Järvinen Cc: Andy Shevchenko Reviewed-by: Ilpo Järvinen Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250624080641.509959-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit d22cf1381416fd02b6db4263694e6c478f205384 Author: Jiri Slaby (SUSE) Date: Mon Jun 23 12:12:46 2025 +0200 serial: ce4100: clean up serial_in/out() hooks ce4100_mem_serial_in() unnecessarily contains 4 nested 'if's. That makes the code hard to follow. Invert the conditions and return early if the particular conditions do not hold. And use "<<=" for shifting the offset in both of the hooks. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: x86@kernel.org Cc: "H. Peter Anvin" Link: https://lore.kernel.org/r/20250623101246.486866-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit f5655940771fbc75efadfe91ca081525732bed3f Author: Jiri Slaby (SUSE) Date: Mon Jun 23 12:12:45 2025 +0200 serial: ce4100: fix build after serial_in/out() changes This x86_32 driver remain unnoticed, so after the commit below, the compilation now fails with: arch/x86/platform/ce4100/ce4100.c:107:16: error: incompatible function pointer types assigning to '...' from '...' To fix the error, convert also ce4100 to the new uart_port::serial_{in,out}() types. Signed-off-by: "Jiri Slaby (SUSE)" Fixes: fc9ceb501e38 ("serial: 8250: sanitize uart_port::serial_{in,out}() types") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506190552.TqNasrC3-lkp@intel.com/ Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: Dave Hansen Cc: x86@kernel.org Cc: "H. Peter Anvin" Link: https://lore.kernel.org/r/20250623101246.486866-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 648d3f4d209725d51900d6a3ed46b7b600140cdf Author: Takashi Iwai Date: Mon Jun 16 18:08:41 2025 +0200 drm/amd/display: Add sanity checks for drm_edid_raw() When EDID is retrieved via drm_edid_raw(), it doesn't guarantee to return proper EDID bytes the caller wants: it may be either NULL (that leads to an Oops) or with too long bytes over the fixed size raw_edid array (that may lead to memory corruption). The latter was reported actually when connected with a bad adapter. Add sanity checks for drm_edid_raw() to address the above corner cases, and return EDID_BAD_INPUT accordingly. Fixes: 48edb2a4256e ("drm/amd/display: switch amdgpu_dm_connector to use struct drm_edid") Link: https://bugzilla.suse.com/show_bug.cgi?id=1236415 Signed-off-by: Takashi Iwai Signed-off-by: Alex Deucher commit 1b92cb40b4a080dd84aad4ebd06528d69f7a705e Author: Kenneth Feng Date: Mon Jun 23 17:02:51 2025 +0800 drm/amd/pm: revise the pcie dpm parameters revise the pcie dpm parameters Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 009bfc5ec5c953534d0f528d1c1e4f60668b7371 Author: Mario Limonciello Date: Mon Jun 23 12:11:14 2025 -0500 drm/amd/display: Add a trace event for brightness programming [Why] Brightness programming may involve a conversion of a user requested brightness against what was in a custom brightness curve. The values might not match what a user programmed. [How] Add a new trace event to show specific converted brightness values. Reviewed-by: Alex Hung Link: https://lore.kernel.org/r/20250623171114.1156451-2-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 5b852044eb0d3e1f1c946d32e05fcb068e0a20a0 Author: Mario Limonciello Date: Mon Jun 23 12:11:13 2025 -0500 drm/amd/display: Fix AMDGPU_MAX_BL_LEVEL value [Why] commit 16dc8bc27c2a ("drm/amd/display: Export full brightness range to userspace") adjusted the brightness range to scale to larger values, but missed updating AMDGPU_MAX_BL_LEVEL which is needed to make sure that scaling works properly with custom brightness curves. [How] As the change for max brightness of 0xFFFF only applies to devices supporting DC, use existing DC define MAX_BACKLIGHT_LEVEL. Fixes: 16dc8bc27c2a ("drm/amd/display: Export full brightness range to userspace") Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250623171114.1156451-1-mario.limonciello@amd.com Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 518f13f8e354285f6faaa81e68e5b6c7d22ffe26 Author: Colin Ian King Date: Mon Jun 23 09:41:08 2025 +0100 drm/amd: Fix spelling mistake "correctalbe" -> "correctable" There is a spelling mistake in a pr_info message. Fix it. Signed-off-by: Colin Ian King Signed-off-by: Alex Deucher commit 8c011408ed842dfccdd50a90a9cf6bccdb85cc0e Author: Alex Deucher Date: Fri Jun 20 11:39:22 2025 -0400 drm/amdgpu/sdma7: add ucode version checks for userq support SDMA 7.0.0/1: 7836028 Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit e8cca30d8b34f1c4101c237914c53068d4a55e73 Author: Alex Deucher Date: Thu Jun 19 17:56:29 2025 -0400 drm/amdgpu/sdma6: add ucode version checks for userq support SDMA 6.0.0 version 24 SDMA 6.0.2 version 21 SDMA 6.0.3 version 25 Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit 8345a71fc54b28e4d13a759c45ce2664d8540d28 Author: Lijo Lazar Date: Mon Jun 2 12:55:14 2025 +0530 drm/amdgpu: Add more checks to PSP mailbox Instead of checking the response flag, use status mask also to check against any unexpected failures like a device drop. Also, log error if waiting on a psp response fails/times out. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 5562b669928af29d44cc0471632641f7b88c6c88 Author: Hawking Zhang Date: Sat Jun 21 21:27:22 2025 +0800 drm/amdgpu: Convert init_mem_ranges into common helpers They can be shared across multiple products Signed-off-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit b9c58f4e325c01ec8838da2e86befe4b1b91c2cc Author: Hawking Zhang Date: Mon Jun 16 17:17:30 2025 +0800 drm/amdgpu: Generalize is_multi_chiplet with a common helper v2 It is not necessary to be ip generation specific v2: rename the helper to is_multi_aid (Lijo) Signed-off-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit c9df2dcf9054273c7f493b7912744de6eefd2aea Author: Hawking Zhang Date: Sat Jun 21 21:11:30 2025 +0800 drm/amdgpu: Convert query_memory_partition into common helpers The query_memory_partition does not need to remain as soc specific callbacks. They can be shared across multiple products Signed-off-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 97c894758b9f1d7a01794d85b95a7b2854d85009 Author: Hawking Zhang Date: Fri Jun 13 19:58:49 2025 +0800 drm/amdgpu: Move MAX_MEM_RANGES to amdgpu_gmc.h This relocation allows MAX_MEM_RANGES to be shared across multiple products Signed-off-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit f268cef77e867f6cc4a80fc72bf7476d36325a3e Author: Hawking Zhang Date: Thu Jun 5 16:39:24 2025 +0800 drm/amdgpu: Convert pre|post_partition_switch into common helpers So they can be reused for future products Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit e0f14a2abf16d0e1c195ad946fe015545125e7f7 Author: Hawking Zhang Date: Thu Jun 5 15:36:17 2025 +0800 drm/amdgpu: Convert update_supported_modes into a common helper So it can be used for future products Signed-off-by: Hawking Zhang Reviewed-by: Likun Gao Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 4dbc17b45532968c1baa5c5af4625eea5ee55150 Author: Hawking Zhang Date: Mon Jun 16 17:07:26 2025 +0800 drm/amdgpu: Convert update_partition_sched_list into a common helper v3 The update_partition_sched_list function does not need to remain as a soc specific callback. It can be reused for future products. v2: bypass the function if xcp_mgr is not available (Likun) v3: Let caller check the availability of xcp_mgr (Lijo) Signed-off-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit bf587417ffb5ed86b07b65ca9f928915477273c0 Author: Hawking Zhang Date: Mon Jun 16 17:05:05 2025 +0800 drm/amdgpu: Convert select_sched into a common helper v3 The xcp select_sched function does not need to remain as a soc specific callback. It can be reused for future products v2: bypass the function if xcp_mgr is not available (Likun) v3: Let caller check the availability of xcp mgr (Lijo) Signed-off-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 37b791d667bed3a43cbbcc5b7e7b69813e4c528f Author: Likun Gao Date: Fri Mar 21 14:14:06 2025 +0800 drm/amdgpu: use common function to map ip for aqua_vanjaram Transfer to use function amdgpu_ip_map_init to map ip instance for aqua_vanjaram instead of operation on different ASIC. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 20905edb2461d8dac1c03f28f6ad06e957f3b45c Author: Likun Gao Date: Fri Jun 13 22:30:34 2025 +0800 drm/amdgpu: make ip map init to common function IP instance map init function can be an common function instead of operation on different ASIC. V2: Create amdgpu_ip.[ch] file for ip related functions. Signed-off-by: Likun Gao Reviewed-by: Hawking Zhang Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit e140281a62706b9e5a7977b04fe073309e8595d1 Author: Patrick Lerda Date: Tue Jun 10 21:12:23 2025 +0200 drm/radeon/evergreen_cs: lower evergreen_surface_check_linear_aligned restriction This change removes the restriction when palign=64 and nbx=32. This makes two piglit tests working. This is discussed on the thread linked below. Link: https://gitlab.freedesktop.org/mesa/mesa/-/issues/9056 Signed-off-by: Patrick Lerda Signed-off-by: Alex Deucher commit 6a117dc39a7421697bea9a8e94a06fbcf937d489 Author: Patrick Lerda Date: Tue Jun 10 21:12:22 2025 +0200 drm/radeon/evergreen_cs: implement cond_exec and cond_write This change implements the support of PACKET3_COND_EXEC and PACKET3_COND_WRITE which are required to implement ARB_indirect_parameters. ARB_indirect_parameters is part of OpenGL 4.6. Link: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/34726 Signed-off-by: Patrick Lerda Signed-off-by: Alex Deucher commit f0ebe9e5782e59b72ab1e72c3f55ba0f64bb5450 Author: Pratap Nirujogi Date: Tue Jun 10 16:08:15 2025 -0400 drm/amd/amdgpu: Refine isp_v4_1_1 logging Replace DRM_ERROR with drm_err function and update log messages to drop __func__ and print return value. Reviewed-by: Mario Limonciello Signed-off-by: Pratap Nirujogi Signed-off-by: Alex Deucher commit fd14786071021bb63b0ab32b95257a594e46f8d4 Author: Pratap Nirujogi Date: Thu May 29 15:21:48 2025 -0400 drm/amd/amdgpu: Add ISP Generic PM Domain (genpd) support AMDISP I2C device requires to power on ISP HW to probe the sensor device. Instead of using the exported symbols from ISP driver to control the power and clocks remotely,added Generic PM Domain (genpd) support in amdgpu_isp device for its child devices (amd_isp_capture, amd_isp_i2c_designware) to set power and clocks using PM methods. Co-developed-by: Bin Du Signed-off-by: Bin Du Reviewed-by: Mario Limonciello Signed-off-by: Pratap Nirujogi Signed-off-by: Alex Deucher commit 9bed716f8722999a2b15a2e5df4dfca48e4c06c9 Author: Pratap Nirujogi Date: Mon Jun 16 14:16:43 2025 -0400 drm/amd/pm: Add support to set min ISP clocks Add support to set ISP clocks for SMU v14.0.0. ISP driver uses amdgpu_dpm_set_soft_freq_range() API to set clocks via SMU interface than communicating with PMFW directly. amdgpu_dpm_set_soft_freq_range() is updated to take in any pp_clock_type than limiting to support only PP_SCLK to allow ISP and other driver modules to set the min/max clocks. Any clock specific restrictions are expected to be taken care in SOC specific SMU implementations instead of generic amdgpu_dpm and amdgpu_smu interfaces. Reviewed-by: Xiaojian Du Reviewed-by: Lijo Lazar Reviewed-by: Mario Limonciello Signed-off-by: Pratap Nirujogi Signed-off-by: Alex Deucher commit fba8d147472ef23fbf2e173f5421cdb3873c4f33 Author: Pratap Nirujogi Date: Mon Jun 16 15:07:57 2025 -0400 drm/amd/pm: Add support to set ISP Power Add support to set ISP power for SMU v14.0.0. ISP driver uses amdgpu_dpm_set_powergating_by_smu() API to enable / disable power via SMU interface than communicating with PMFW directly. Reviewed-by: Lijo Lazar Reviewed-by: Mario Limonciello Signed-off-by: Pratap Nirujogi Signed-off-by: Alex Deucher commit 5fb90421fa0fbe0a968274912101fe917bf1c47b Author: Vitaly Prosyak Date: Wed Jun 18 19:35:21 2025 -0400 drm/amdgpu: fix slab-use-after-free in amdgpu_userq_mgr_fini+0x70c The issue was reproduced on NV10 using IGT pci_unplug test. It is expected that `amdgpu_driver_postclose_kms()` is called prior to `amdgpu_drm_release()`. However, the bug is that `amdgpu_fpriv` was freed in `amdgpu_driver_postclose_kms()`, and then later accessed in `amdgpu_drm_release()` via a call to `amdgpu_userq_mgr_fini()`. As a result, KASAN detected a use-after-free condition, as shown in the log below. The proposed fix is to move the calls to `amdgpu_eviction_fence_destroy()` and `amdgpu_userq_mgr_fini()` into `amdgpu_driver_postclose_kms()`, so they are invoked before `amdgpu_fpriv` is freed. This also ensures symmetry with the initialization path in `amdgpu_driver_open_kms()`, where the following components are initialized: - `amdgpu_userq_mgr_init()` - `amdgpu_eviction_fence_init()` - `amdgpu_ctx_mgr_init()` Correspondingly, in `amdgpu_driver_postclose_kms()` we should clean up using: - `amdgpu_userq_mgr_fini()` - `amdgpu_eviction_fence_destroy()` - `amdgpu_ctx_mgr_fini()` This change eliminates the use-after-free and improves consistency in resource management between open and close paths. [ +0.094367] ================================================================== [ +0.000026] BUG: KASAN: slab-use-after-free in amdgpu_userq_mgr_fini+0x70c/0x730 [amdgpu] [ +0.000866] Write of size 8 at addr ffff88811c068c60 by task amd_pci_unplug/1737 [ +0.000026] CPU: 3 UID: 0 PID: 1737 Comm: amd_pci_unplug Not tainted 6.14.0+ #2 [ +0.000008] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020 [ +0.000004] Call Trace: [ +0.000004] [ +0.000003] dump_stack_lvl+0x76/0xa0 [ +0.000010] print_report+0xce/0x600 [ +0.000009] ? amdgpu_userq_mgr_fini+0x70c/0x730 [amdgpu] [ +0.000790] ? srso_return_thunk+0x5/0x5f [ +0.000007] ? kasan_complete_mode_report_info+0x76/0x200 [ +0.000008] ? amdgpu_userq_mgr_fini+0x70c/0x730 [amdgpu] [ +0.000684] kasan_report+0xbe/0x110 [ +0.000007] ? amdgpu_userq_mgr_fini+0x70c/0x730 [amdgpu] [ +0.000601] __asan_report_store8_noabort+0x17/0x30 [ +0.000007] amdgpu_userq_mgr_fini+0x70c/0x730 [amdgpu] [ +0.000801] ? __pfx_amdgpu_userq_mgr_fini+0x10/0x10 [amdgpu] [ +0.000819] ? srso_return_thunk+0x5/0x5f [ +0.000008] amdgpu_drm_release+0xa3/0xe0 [amdgpu] [ +0.000604] __fput+0x354/0xa90 [ +0.000010] __fput_sync+0x59/0x80 [ +0.000005] __x64_sys_close+0x7d/0xe0 [ +0.000006] x64_sys_call+0x2505/0x26f0 [ +0.000006] do_syscall_64+0x7c/0x170 [ +0.000004] ? kasan_record_aux_stack+0xae/0xd0 [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? kmem_cache_free+0x398/0x580 [ +0.000006] ? __fput+0x543/0xa90 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __fput+0x543/0xa90 [ +0.000004] ? __kasan_check_read+0x11/0x20 [ +0.000007] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? __kasan_check_read+0x11/0x20 [ +0.000003] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? fpregs_assert_state_consistent+0x21/0xb0 [ +0.000006] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? syscall_exit_to_user_mode+0x4e/0x240 [ +0.000005] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? do_syscall_64+0x88/0x170 [ +0.000003] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? do_syscall_64+0x88/0x170 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? irqentry_exit+0x43/0x50 [ +0.000004] ? srso_return_thunk+0x5/0x5f [ +0.000004] ? exc_page_fault+0x7c/0x110 [ +0.000006] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000005] RIP: 0033:0x7ffff7b14f67 [ +0.000005] Code: ff e8 0d 16 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 73 ba f7 ff [ +0.000004] RSP: 002b:00007fffffffe358 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ +0.000006] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffff7b14f67 [ +0.000003] RDX: 0000000000000000 RSI: 00007ffff7f5755a RDI: 0000000000000003 [ +0.000003] RBP: 00007fffffffe380 R08: 0000555555568170 R09: 0000000000000000 [ +0.000003] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5c8 [ +0.000003] R13: 00005555555552a9 R14: 0000555555557d48 R15: 00007ffff7ffd040 [ +0.000007] [ +0.000286] Allocated by task 425 on cpu 11 at 29.751192s: [ +0.000013] kasan_save_stack+0x28/0x60 [ +0.000008] kasan_save_track+0x18/0x70 [ +0.000006] kasan_save_alloc_info+0x38/0x60 [ +0.000006] __kasan_kmalloc+0xc1/0xd0 [ +0.000005] __kmalloc_cache_noprof+0x1bd/0x430 [ +0.000006] amdgpu_driver_open_kms+0x172/0x760 [amdgpu] [ +0.000521] drm_file_alloc+0x569/0x9a0 [ +0.000008] drm_client_init+0x1b7/0x410 [ +0.000007] drm_fbdev_client_setup+0x174/0x470 [ +0.000007] drm_client_setup+0x8a/0xf0 [ +0.000006] amdgpu_pci_probe+0x50b/0x10d0 [amdgpu] [ +0.000482] local_pci_probe+0xe7/0x1b0 [ +0.000008] pci_device_probe+0x5bf/0x890 [ +0.000005] really_probe+0x1fd/0x950 [ +0.000007] __driver_probe_device+0x307/0x410 [ +0.000005] driver_probe_device+0x4e/0x150 [ +0.000006] __driver_attach+0x223/0x510 [ +0.000005] bus_for_each_dev+0x102/0x1a0 [ +0.000006] driver_attach+0x3d/0x60 [ +0.000005] bus_add_driver+0x309/0x650 [ +0.000005] driver_register+0x13d/0x490 [ +0.000006] __pci_register_driver+0x1ee/0x2b0 [ +0.000006] xfrm_ealg_get_byidx+0x43/0x50 [xfrm_algo] [ +0.000008] do_one_initcall+0x9c/0x3e0 [ +0.000007] do_init_module+0x29e/0x7f0 [ +0.000006] load_module+0x5c75/0x7c80 [ +0.000006] init_module_from_file+0x106/0x180 [ +0.000007] idempotent_init_module+0x377/0x740 [ +0.000006] __x64_sys_finit_module+0xd7/0x180 [ +0.000006] x64_sys_call+0x1f0b/0x26f0 [ +0.000006] do_syscall_64+0x7c/0x170 [ +0.000005] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000013] Freed by task 1737 on cpu 9 at 76.455063s: [ +0.000010] kasan_save_stack+0x28/0x60 [ +0.000006] kasan_save_track+0x18/0x70 [ +0.000005] kasan_save_free_info+0x3b/0x60 [ +0.000006] __kasan_slab_free+0x54/0x80 [ +0.000005] kfree+0x127/0x470 [ +0.000006] amdgpu_driver_postclose_kms+0x455/0x760 [amdgpu] [ +0.000485] drm_file_free.part.0+0x5b1/0xba0 [ +0.000007] drm_file_free+0x13/0x30 [ +0.000006] drm_client_release+0x1c4/0x2b0 [ +0.000006] drm_fbdev_ttm_fb_destroy+0xd2/0x120 [drm_ttm_helper] [ +0.000007] put_fb_info+0x97/0xe0 [ +0.000006] unregister_framebuffer+0x197/0x380 [ +0.000005] drm_fb_helper_unregister_info+0x94/0x100 [ +0.000005] drm_fbdev_client_unregister+0x3c/0x80 [ +0.000007] drm_client_dev_unregister+0x144/0x330 [ +0.000006] drm_dev_unregister+0x49/0x1b0 [ +0.000006] drm_dev_unplug+0x4c/0xd0 [ +0.000006] amdgpu_pci_remove+0x58/0x130 [amdgpu] [ +0.000482] pci_device_remove+0xae/0x1e0 [ +0.000006] device_remove+0xc7/0x180 [ +0.000006] device_release_driver_internal+0x3d4/0x5a0 [ +0.000007] device_release_driver+0x12/0x20 [ +0.000006] pci_stop_bus_device+0x104/0x150 [ +0.000006] pci_stop_and_remove_bus_device_locked+0x1b/0x40 [ +0.000005] remove_store+0xd7/0xf0 [ +0.000007] dev_attr_store+0x3f/0x80 [ +0.000006] sysfs_kf_write+0x125/0x1d0 [ +0.000005] kernfs_fop_write_iter+0x2ea/0x490 [ +0.000007] vfs_write+0x90d/0xe70 [ +0.000006] ksys_write+0x119/0x220 [ +0.000006] __x64_sys_write+0x72/0xc0 [ +0.000006] x64_sys_call+0x18ab/0x26f0 [ +0.000005] do_syscall_64+0x7c/0x170 [ +0.000005] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ +0.000013] The buggy address belongs to the object at ffff88811c068000 which belongs to the cache kmalloc-rnd-01-4k of size 4096 [ +0.000016] The buggy address is located 3168 bytes inside of freed 4096-byte region [ffff88811c068000, ffff88811c069000) [ +0.000022] The buggy address belongs to the physical page: [ +0.000010] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88811c06e000 pfn:0x11c068 [ +0.000006] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ +0.000006] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) [ +0.000007] page_type: f5(slab) [ +0.000007] raw: 0017ffffc0000040 ffff88810004c140 dead000000000122 0000000000000000 [ +0.000005] raw: ffff88811c06e000 0000000080040002 00000000f5000000 0000000000000000 [ +0.000006] head: 0017ffffc0000040 ffff88810004c140 dead000000000122 0000000000000000 [ +0.000005] head: ffff88811c06e000 0000000080040002 00000000f5000000 0000000000000000 [ +0.000006] head: 0017ffffc0000003 ffffea0004701a01 ffffffffffffffff 0000000000000000 [ +0.000005] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ +0.000004] page dumped because: kasan: bad access detected [ +0.000011] Memory state around the buggy address: [ +0.000009] ffff88811c068b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000012] ffff88811c068b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] >ffff88811c068c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] ^ [ +0.000010] ffff88811c068c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] ffff88811c068d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ +0.000011] ================================================================== Cc: Alex Deucher Cc: Christian König Cc: Lijo Lazar Cc: Jesse Zhang Cc: Arvind Yadav v2: drop amdgpu_drm_release() and assign drm_release() as the callback directly.(Alex) Fixes: adba0929736a ("drm/amdgpu: Fix Illegal opcode in command stream Error") Reviewed-by: Alex Deucher Signed-off-by: Vitaly Prosyak Signed-off-by: Alex Deucher commit bb233caa85d5f51916244574f735b22af46c89f0 Author: Mario Limonciello Date: Thu Jun 19 23:14:20 2025 -0500 drm/amd: Add missing kdoc for amd_ip_funcs `complete` callback The `complete` callback should be described in kernel doc. Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20250619205931.41cf9332@canb.auug.org.au/ Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250620041420.3585005-1-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 684385273de5de3c979843a7804a57361cc60753 Author: Alex Deucher Date: Mon Jun 16 14:28:32 2025 -0400 drm/amdgpu: remove fence slab Just use kmalloc for the fences in the rare case we need an independent fence. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 49f1f9f6c3c9febf8ba93f94a8d9c8d03e1ea0a1 Author: Mario Limonciello Date: Tue Jun 17 13:30:52 2025 -0500 drm/amd: Adjust output for discovery error handling commit 017fbb6690c2 ("drm/amdgpu/discovery: check ip_discovery fw file available") added support for reading an amdgpu IP discovery bin file for some specific products. If it's not found then it will fallback to hardcoded values. However if it's not found there is also a lot of noise about missing files and errors. Adjust the error handling to decrease most messages to DEBUG and to show users less about missing files. Reviewed-by: Lijo Lazar Reported-by: Marcus Seyfarth Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4312 Tested-by: Marcus Seyfarth Fixes: 017fbb6690c2 ("drm/amdgpu/discovery: check ip_discovery fw file available") Acked-by: Alex Deucher Link: https://lore.kernel.org/r/20250617183052.1692059-1-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 389153ef119dc116da909aaa8ae261494093f24a Author: Taimur Hassan Date: Sun Jun 15 21:38:55 2025 -0500 drm/amd/display: Promote DAL to 3.2.339 Summary: * Improve USB4 bandwidth validation * dml clock calcuation with EQU Prefetch included * Tweaking udelay time to fix "failed to blank crtc!" error * Add LSDMA support to DMUB * Fix Coverity issue Reviewed-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 623ea7019fdeff56f07d4ca39a28b37ed8198556 Author: Taimur Hassan Date: Sun Jun 15 11:36:32 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.16.0 Summary for changes in firmware: * Add DMCUB IPS commands and command parser support * use OTG count to disable interrupts * Fix dmub_cmd header data boundary issue * remove the HW register override Reviewed-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c44120dffe01958be37b4e843177d4a38a3e7c35 Author: Ovidiu Bunea Date: Fri Jun 6 15:49:22 2025 -0400 drm/amd/display: Add DMUB IPS command support for IPS residency tools [why & how] Add DMUB IPS CMD interface for driver and DMU to communicate for IPS residency tools. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Ovidiu Bunea Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c233ec1902430f7791d1e0deff6b480b084b2f0e Author: Ilya Bakoulin Date: Thu Jun 5 11:48:23 2025 -0400 drm/amd/display: Add num_slices_h to set_dto_dscclk signature Add the number of horizontal slices argument to allow configuring clock based on slice number. Reviewed-by: Nevenko Stupar Signed-off-by: Ilya Bakoulin Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit def3f83e51590fcc9fdaef3f6ea9f75cd604a2d2 Author: Austin Zheng Date: Wed Jun 11 10:09:51 2025 -0400 drm/amd/display: DML21 Reintegration Update logging macros for detailed debugging Update structs to contain more detailed information Add HDMI 16 and 20 Gbps rates Reviewed-by: Alvin Lee Signed-off-by: Austin Zheng Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f8fa4dfbd7a2b2026035791709068ef83f695ac6 Author: Fangzhi Zuo Date: Thu Jun 12 11:25:03 2025 -0400 drm/amd/display: Rewording Mode Validation Result It is normal to prune resolutions that exceed hw or bw limitation. Use error oriented wordings could cause misunderstanding. Reviewed-by: Aurabindo Pillai Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 00c9c4236d042927f1ff7dfb3805f1644cc359e2 Author: Ostrowski Rafal Date: Thu Jun 12 09:08:51 2025 +0200 drm/amd/display: LSDMA support [Why] Driver should be able to send LSDMA commands to DMCUB [How] Driver can now send LSDMA commands to DMCUB. DMCUB should process them and send to LSDMA controller. Reviewed-by: Alvin Lee Signed-off-by: Ostrowski Rafal Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 69541034001b69378f48a6c4f91ef637674ce616 Author: Weiguang Li Date: Thu Jun 12 11:10:12 2025 +0800 drm/amd/display: Remove redundant macro of refresh rate [Why&How] Found that we add redundant macro on refresh rate when calculating vtotal, so we remove it. Reviewed-by: Robin Chen Signed-off-by: Weiguang Li Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 01f60348d8fb6b3fbcdfc7bdde5d669f95b009a4 Author: Wen Chen Date: Mon Jun 2 16:37:08 2025 -0400 drm/amd/display: Fix 'failed to blank crtc!' [why] DCN35 is having “DC: failed to blank crtc!” when running HPO test cases. It's caused by not having sufficient udelay time. [how] Replace the old wait_for_blank_complete function with fsleep function to sleep just until the next frame should come up. This way it doesn't poll in case the pixel clock or other clock was bugged or until vactive and the vblank are hit again. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Wen Chen Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 592ddac93f8c02e13f19175745465f8c4d0f56cd Author: Alex Hung Date: Tue Jun 10 15:40:18 2025 -0600 drm/amd/display: Initialize mode_select to 0 [WHAT] mode_select was supposed to be initialized in mpc_read_gamut_remap but is not set in default case. This can cause indeterminate behaviors. This is reported as an UNINIT error by Coverity. Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 7beee6e91c20f297d2eba90397fe44938138f3b8 Author: Cruise Hung Date: Tue Jun 3 14:30:59 2025 +0800 drm/amd/display: Add new DP tunnel bandwidth validation [Why & How] Add new function for DP tunnel bandwidth validation. It uses the estimated BW and allocated BW to validate the timings. Reviewed-by: PeiChen Huang Reviewed-by: Meenakshikumar Somasundaram Signed-off-by: Cruise Hung Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 0c5f7371dd3a7a50a185d647f970f412ff6f2483 Author: Alvin Lee Date: Wed May 14 17:16:50 2025 -0400 drm/amd/display: Removed unnecessary comment Reviewed-by: Sridevi Arvindekar Signed-off-by: Alvin Lee Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 90adb32480fce1ccda76ed5ebd58c4463ead3fd6 Author: Austin Zheng Date: Thu Jun 5 16:37:36 2025 -0400 drm/amd/display: Include EQU Prefetch Bandwidth For Bandwidth Calculations [Why] Pixel data bandwidth required in mode programming (MP) ends up being higher than what was calculated in mode support (MS) even though the prefetch bandwidths calculated in MP are lower than the MS ones. MP used a different equ prefetch schedule than MS which lead a slight difference in parameters. This resulted in the pixel data bandwidth in MP to be higher than MS. [How] Rename the RequiredPrefetchBWOTO term so it can be applied generically. Update the value with the EQU bandwidth if the EQU schedule is used. Get the max prefetch bandwidth that MS calculated and use it as part of the calculations for required bandwidth. Reviewed-by: Dillon Varone Signed-off-by: Austin Zheng Signed-off-by: Fangzhi Zuo Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit e01bf2704224b10e9eabd48d168abb8b9edaaad0 Author: Lijo Lazar Date: Fri Jun 13 18:04:51 2025 +0530 drm/amd/pm: Fetch SMUv13.0.6 xgmi max speed/width On SMUv13.0.6 SOCs, fetch the max values of xgmi speed/width from firmware. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit d4c2d9b5b7ceed14a3a835fd969bb0699b9608d3 Author: Michal Wilczynski Date: Mon Jun 23 13:42:39 2025 +0200 power: sequencing: Add T-HEAD TH1520 GPU power sequencer driver Introduce the pwrseq-thead-gpu driver, a power sequencer provider for the Imagination BXM-4-64 GPU on the T-HEAD TH1520 SoC. This driver controls an auxiliary device instantiated by the AON power domain. The TH1520 GPU requires a specific sequence to correctly initialize and power down its resources: - Enable GPU clocks (core and sys). - De-assert the GPU clock generator reset (clkgen_reset). - Introduce a short hardware-required delay. - De-assert the GPU core reset. The power-down sequence performs these steps in reverse. Implement this sequence via the pwrseq_power_on and pwrseq_power_off callbacks. Crucially, the driver's match function is called when a consumer (the Imagination GPU driver) requests the "gpu-power" target. During this match, the sequencer uses clk_bulk_get() and reset_control_get_exclusive() on the consumer's device to obtain handles to the GPU's "core" and "sys" clocks, and the GPU core reset. These, along with clkgen_reset obtained from parent aon node, allow it to perform the complete sequence. Reviewed-by: Ulf Hansson Signed-off-by: Michal Wilczynski Link: https://lore.kernel.org/r/20250623-apr_14_for_sending-v6-1-6583ce0f6c25@samsung.com [Bartosz: use a ternary operator instead of implicitly casting the result of a boolean expression to int] Signed-off-by: Bartosz Golaszewski commit 0180e0a5dd5c6ff118043ee42dbbbddaf881f283 Author: Alex Deucher Date: Tue May 20 10:02:14 2025 -0400 drm/amdgpu/mes: add compatibility checks for set_hw_resource_1 Seems some older MES firmware versions do not properly support this packet. Add back some the compatibility checks. v2: switch to fw version check (Shaoyun) Fixes: f81cd793119e ("drm/amd/amdgpu: Fix MES init sequence") Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4295 Cc: Shaoyun Liu Reviewed-by: shaoyun.liu Signed-off-by: Alex Deucher commit 99808926d0ea6234a89e35240a7cb088368de9e1 Author: Srinivasan Shanmugam Date: Thu Jun 12 20:11:14 2025 +0530 drm/amdgpu/gfx9: Add Cleaner Shader Support for GFX9.x GPUs Enable the cleaner shader for other GFX9.x series of GPUs to provide data isolation between GPU workloads. The cleaner shader is responsible for clearing the Local Data Store (LDS), Vector General Purpose Registers (VGPRs), and Scalar General Purpose Registers (SGPRs), which helps prevent data leakage and ensures accurate computation results. This update extends cleaner shader support to GFX9.x GPUs, previously available for GFX9.4.2. It enhances security by clearing GPU memory between processes and maintains a consistent GPU state across KGD and KFD workloads. Cc: Manu Rastogi Cc: Christian König Cc: Alex Deucher Signed-off-by: Srinivasan Shanmugam Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit b39f7d75dc41b5f5d028192cd5d66cff71179f35 Author: Matthew Wilcox (Oracle) Date: Tue Jun 24 14:21:27 2025 +0100 fs: Remove three arguments from block_write_end() block_write_end() looks like it can be used as a ->write_end() implementation. However, it can't as it does not unlock nor put the folio. Since it does not use the 'file', 'mapping' nor 'fsdata' arguments, remove them. Signed-off-by: "Matthew Wilcox (Oracle)" Link: https://lore.kernel.org/20250624132130.1590285-1-willy@infradead.org Signed-off-by: Christian Brauner commit cd5d2006327b6d8488612cb8c03ad7304417c8f2 Author: Christian Brauner Date: Tue Jun 24 10:29:10 2025 +0200 uapi/fcntl: add FD_INVALID Add a marker for an invalid file descriptor. Link: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-7-d02a04858fe3@kernel.org Reviewed-by: Jan Kara Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 67fcec2919e4ed31ab845eb456ad7d6f1e85505c Author: Christian Brauner Date: Tue Jun 24 15:48:49 2025 +0200 fcntl/pidfd: redefine PIDFD_SELF_THREAD_GROUP Don't jump somewhere into the middle of the reserved range. We're still able to change that value it won't be that widely used yet. If not, we can revert. Signed-off-by: Christian Brauner commit a4c746f06853f91d3759ae8aca514d135b6aa56d Author: Christian Brauner Date: Tue Jun 24 15:48:42 2025 +0200 uapi/fcntl: mark range as reserved Mark the range from -10000 to -40000 as a range reserved for special in-kernel values. Move the PIDFD_SELF_*/PIDFD_THREAD_* sentinels over so all the special values are in one place. Link: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-6-d02a04858fe3@kernel.org Reviewed-by: Jan Kara Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 1c5484395f9f8b7bf0702f34aa3406353e45d7ec Author: Christian Brauner Date: Tue Jun 24 10:29:08 2025 +0200 fhandle: reflow get_path_anchor() Switch to a more common coding style. Link: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-5-d02a04858fe3@kernel.org Reviewed-by: Jan Kara Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit a50522962453b75eb34de581c604850fab7bedac Author: Lachlan Hodges Date: Tue Jun 17 18:06:10 2025 +1000 wifi: mac80211: add support for S1G aggregation Allow an S1G station to use aggregation. Signed-off-by: Sophronia Koilpillai Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250617080610.756048-5-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 037dc18ac3fb8f46c72057411d7011a5baaab559 Author: Lachlan Hodges Date: Tue Jun 17 18:06:09 2025 +1000 wifi: mac80211: add support for storing station S1G capabilities When a station configuration is updated, update the stations S1G capabilities. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250617080610.756048-4-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 2a8a6b7c4cb03808a707ae19b2f0c5eb9b631e9e Author: Lachlan Hodges Date: Tue Jun 17 18:06:08 2025 +1000 wifi: mac80211: handle station association response with S1G Add support for updating the stations S1G capabilities when an S1G association occurs. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250617080610.756048-3-lachlan.hodges@morsemicro.com [remove unused S1G_CAP3_MAX_MPDU_LEN_3895/_7791] Signed-off-by: Johannes Berg commit 5ea255673cdb4a9bf99dd3e4fc9ca1089f5692a3 Author: Lachlan Hodges Date: Tue Jun 17 18:06:07 2025 +1000 wifi: cfg80211: support configuration of S1G station capabilities Currently there is no support for initialising a peers S1G capabilities, this patch adds support for configuring an S1G station. Signed-off-by: Lachlan Hodges Link: https://patch.msgid.link/20250617080610.756048-2-lachlan.hodges@morsemicro.com Signed-off-by: Johannes Berg commit 407bc77b7083f155325c1c571c0c608312839330 Author: Roopni Devanathan Date: Sun Jun 15 13:53:12 2025 +0530 wifi: mac80211: Set RTS threshold on per-radio basis Add support to get the radio for which RTS threshold needs to be changed from userspace. Pass on this radio index to underlying drivers as an additional argument. A value of -1 indicates radio index is not mentioned and that the configuration applies to all radio(s) of the wiphy. Signed-off-by: Roopni Devanathan Link: https://patch.msgid.link/20250615082312.619639-5-quic_rdevanat@quicinc.com Signed-off-by: Johannes Berg commit 89595190058c6e9ca4a8ca7d49be3fc8d2395e79 Author: Roopni Devanathan Date: Sun Jun 15 13:53:11 2025 +0530 wifi: cfg80211: Report per-radio RTS threshold to userspace In case of multi-radio wiphys, with per-radio RTS threshold brought into use, RTS threshold for each radio in a wiphy can be recorded in wiphy parameter - wiphy_radio_cfg, as an array. Add a new attribute - NL80211_WIPHY_RADIO_ATTR_RTS_THRESHOLD in nested parameter - NL80211_ATTR_WIPHY_RADIOS. When a request for getting RTS threshold for a particular radio is received, parse the radio id and get the required data. Add this data to the newly added nested attribute NL80211_WIPHY_RADIO_ATTR_RTS_THRESHOLD. Add support to report this data to userspace. Signed-off-by: Roopni Devanathan Link: https://patch.msgid.link/20250615082312.619639-4-quic_rdevanat@quicinc.com Signed-off-by: Johannes Berg commit 264637941cf45cd3ffe070e25853d7e1a29f2004 Author: Roopni Devanathan Date: Sun Jun 15 13:53:10 2025 +0530 wifi: cfg80211: Add Support to Set RTS Threshold for each Radio Currently, setting RTS threshold is based on per-phy basis, i.e., all the radios present in a wiphy will take RTS threshold value to be the one sent from userspace. But each radio in a multi-radio wiphy can have different RTS threshold requirements. To extend support to set RTS threshold for each radio, get the radio for which RTS threshold needs to be changed from the user. Use the attribute in NL - NL80211_ATTR_WIPHY_RADIO_INDEX, to identify the radio of interest. Create a new structure - wiphy_radio_cfg and add rts_threshold in it as a u32 value to store RTS threshold of each radio in a wiphy and allocate memory for it during wiphy register based on the wiphy.n_radio updated by drivers. Pass radio id received from the user to mac80211 drivers along with its corresponding RTS threshold. Signed-off-by: Roopni Devanathan Link: https://patch.msgid.link/20250615082312.619639-3-quic_rdevanat@quicinc.com Signed-off-by: Johannes Berg commit b74947b4f6ff7c122a1bb6eb38bb7ecfbb1d3820 Author: Roopni Devanathan Date: Sun Jun 15 13:53:09 2025 +0530 wifi: cfg80211/mac80211: Add support to get radio index Currently, per-radio attributes are set on per-phy basis, i.e., all the radios present in a wiphy will take attributes values sent from user. But each radio in a wiphy can get different values from userspace based on its requirement. To extend support to set per-radio attributes, add support to get radio index from userspace. Add an NL attribute - NL80211_ATTR_WIPHY_RADIO_INDEX, to get user specified radio index for which attributes should be changed. Pass this to individual drivers, so that the drivers can use this radio index to change per-radio attributes when necessary. Currently, per-radio attributes identified are: NL80211_ATTR_WIPHY_TX_POWER_LEVEL NL80211_ATTR_WIPHY_ANTENNA_TX NL80211_ATTR_WIPHY_ANTENNA_RX NL80211_ATTR_WIPHY_RETRY_SHORT NL80211_ATTR_WIPHY_RETRY_LONG NL80211_ATTR_WIPHY_FRAG_THRESHOLD NL80211_ATTR_WIPHY_RTS_THRESHOLD NL80211_ATTR_WIPHY_COVERAGE_CLASS NL80211_ATTR_TXQ_LIMIT NL80211_ATTR_TXQ_MEMORY_LIMIT NL80211_ATTR_TXQ_QUANTUM By default, the radio index is set to -1. This means the attribute should be treated as a global configuration. If the user has not specified any index, then the radio index passed to individual drivers would be -1. This would indicate that the attribute applies to all radios in that wiphy. Signed-off-by: Roopni Devanathan Link: https://patch.msgid.link/20250615082312.619639-2-quic_rdevanat@quicinc.com Signed-off-by: Johannes Berg commit 4cb1ce7e254adeeeec7ccbb45125307aec4d0f0b Author: Sarika Sharma Date: Wed May 28 11:14:20 2025 +0530 wifi: mac80211: add link_sta_statistics ops to fill link station statistics Currently, link station statistics for MLO are filled by mac80211. But there are some statistics that kept by mac80211 might not be accurate, so let the driver pre-fill the link statistics. The driver can fill the values (indicating which field is filled, by setting the filled bitmapin in link_station structure). Statistics that driver don't fill are filled by mac80211. Hence, add link_sta_statistics callback to fill link station statistics for MLO in sta_set_link_sinfo() by drivers. Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250528054420.3050133-11-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit 5e9129f574d98ca1b8ed51d5d5d433344b180bd8 Author: Sarika Sharma Date: Wed May 28 11:14:19 2025 +0530 wifi: mac80211: correct RX stats packet increment for multi-link Currently, RX stats packets are incremented for deflink member for non-ML and multi-link(ML) station case. However, for ML station, packets should be incremented based on the specific link. Therefore, if a valid link_id is present, fetch the corresponding link station information and increment the RX packets for that link. For non-MLO stations, the deflink will still be used. Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250528054420.3050133-10-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit 505991fba9ec112770c79a0fea56b4c49a5ad2fa Author: Sarika Sharma Date: Wed May 28 11:14:18 2025 +0530 wifi: mac80211: extend support to fill link level sinfo structure Currently, sinfo structure is supported to fill information at deflink( or one of the links) level for station. This has problems when applied to fetch multi-link(ML) station information. Hence, if valid_links are present, support filling link_station structure for each link. This will be helpful to check the link related statistics during MLO. Additionally, TXQ stats for pertid are applicable at station level not at link level. Therefore check link_id is less then 0, before filling TXQ stats in pertid stats. Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250528054420.3050133-9-quic_sarishar@quicinc.com [fix some indentation] Signed-off-by: Johannes Berg commit 8af903e4543e68800ebd9291ff86ed0dfbcfed1d Author: Sarika Sharma Date: Wed May 28 11:14:17 2025 +0530 wifi: cfg80211: clear sinfo->filled for MLO station statistics Currently, sinfo->filled is for set in sta_set_sinfo() after filling the corresponding fields in station_info structure for station statistics. For non-ML stations, the fields are correctly filled from sta->deflink and corresponding sinfo->filled bit are set, but for MLO any one of link's data is filled and corresponding sinfo->filled bit is set. For MLO before embed NL message, fields of sinfo structure like bytes, packets, signal are updated with accumulated, best, least of all links data. But some of fields like rssi, pertid don't make much sense at MLO level. Hence, to prevent misinterpretation, clear sinfo->filled for fields which don't make much sense at MLO level. This will prevent filling misleading values in NL message. Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250528054420.3050133-8-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit 80b2fa46791742cf8723813bcc93cf39f107c034 Author: Sarika Sharma Date: Wed May 28 11:14:16 2025 +0530 wifi: mac80211: add support to accumulate removed link statistics Currently, if a link gets removed in between for a station then directly accumulated data will fall down to sum of other active links. This will bring inconsistency in station dump statistics. For instance, let's take Tx packets - at t=0-> link-0:2 link-1:3 Tx packets => accumulated = 5 - at t=1-> link-0:4 link-1:6 Tx packets => accumulated = 10 let say at t=2, link-0 went down => link-0:0 link-1:7 => accumulated = 7 Here, suddenly accumulated Tx packets will come down to 7 from 10. This is showing inconsistency. Therefore, store link-0 data when it went down and add to accumulated Tx packet = 11. Hence, store the removed link statistics data in sta structure and add it in accumulated statistics for consistency. Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250528054420.3050133-7-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit 49e47223ecc4af0bd15b5267184d46b3654d520b Author: Sarika Sharma Date: Wed May 28 11:14:15 2025 +0530 wifi: cfg80211: allocate memory for link_station info structure Currently, station_info structure is passed to fill station statistics from mac80211/drivers. After NL message send to user space for requested station statistics, memory for station statistics is freed in cfg80211. Therefore, memory allocation/free for link station statistics should also happen in cfg80211 only. Hence, allocate the memory for link_station structure for all possible links and free in cfg80211_sinfo_release_content(). Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250528054420.3050133-6-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit 2d226d41db4bf6f1c244bae70ecd5554a504b2d1 Author: Sarika Sharma Date: Wed May 28 11:14:14 2025 +0530 wifi: cfg80211: add statistics for providing overview for MLO station Currently statistics are handled at link level for multi-link operation(MLO). There is no provision to check accumulated statistics for a multi-link(ML) station. Other statistics, such as signal, rates, are also managed at the link level only. Statistics such as packets, bytes, signal, rates, etc are useful to provide overall overview for the ML stations. Statistics such as packets, bytes are accumulated statistics at MLO level. However, MLO statistics for rates and signal can not be accumulated since it won't make much sense. Hence, handle other statistics such as signal, rates, etc bit differently at MLO level. The signal could be the best of all links- e.g. if Link 1 has a signal strength of -70 dBm and Link 2 has -65 dBm, the signal for MLO will be -65 dBm. The rate could be determined based on the most recently updated link- e.g. if link 1 has a rate of 300 Mbps and link 2 has a rate of 450 Mbps, the MLO rate can be calculated based on the inactivity of each link. If the inactive time for link 1 is 20 seconds and for link 2 is 10 seconds, the MLO rate will be the most recently updated rate, which is link 2's rate of 450 Mbps. The inactive time, dtim_period and beacon_interval can be taken as the least value of field from link level. Similarly, other MLO level applicable fields are handled and the fields which don't make much sense at MLO level, a subsequent change will handle to embed NL message. Hence, add accumulated and other statistics for MLO station if valid links are present to represent comprehensive overview for the ML stations. Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250528054420.3050133-5-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit 82d7f841d9bd11cda0cdddf21c70498836b82699 Author: Sarika Sharma Date: Wed May 28 11:14:13 2025 +0530 wifi: cfg80211: extend to embed link level statistics in NL message Currently, statistics is supported at deflink( or one of the links) level for station. This has problems when applied to multi-link(ML) connections. Hence, add changes to support link level statistics to embed NL message with link related information if valid links are present. This will be helpful to check the link related statistics during MLO. The statistics will be embedded into NL message as below: For non-ML: cmd-> NL80211_ATTR_IFINDEX NL80211_ATTR_MAC NL80211_ATTR_GENERATION ....etc NL80211_ATTR_STA_INFO | nested NL80211_STA_INFO_CONNECTED_TIME, NL80211_STA_INFO_STA_FLAGS, NL80211_STA_INFO_RX_BYTES, NL80211_STA_INFO_TX_BYTES, .........etc For MLO: cmd -> NL80211_ATTR_IFINDEX NL80211_ATTR_MAC NL80211_ATTR_GENERATION .......etc NL80211_ATTR_STA_INFO | nested NL80211_STA_INFO_CONNECTED_TIME, NL80211_STA_INFO_STA_FLAGS, ........etc NL80211_ATTR_MLO_LINK_ID, NL80211_ATTR_MLD_ADDR, NL80211_ATTR_MLO_LINKS | nested link_id-1 | nested NL80211_ATTR_MLO_LINK_ID, NL80211_ATTR_MAC, NL80211_ATTR_STA_INFO | nested NL80211_STA_INFO_RX_BYTES, NL80211_STA_INFO_TX_BYTES, NL80211_STA_INFO_CONNECTED_TIME, ..........etc. link_id-2 | nested NL80211_ATTR_MLO_LINK_ID, NL80211_ATTR_MAC, NL80211_ATTR_STA_INFO | nested NL80211_STA_INFO_RX_BYTES, NL80211_STA_INFO_TX_BYTES, NL80211_STA_INFO_CONNECTED_TIME, .........etc Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250528054420.3050133-4-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit d2329fff7e527e8b350086be2e7cbf0d190177a3 Author: Sarika Sharma Date: Wed May 28 11:14:12 2025 +0530 wifi: cfg80211: add link_station_info structure to support MLO statistics Current implementation of NL80211_GET_STATION does not work for multi-link operation(MLO) since in case of MLO only deflink (or one of the links) is considered and not all links. Therefore to support for MLO, add link_station_info structure to account link level statistics for station. Additionally, add valid_links in station_info structure to indicate bitmap of valid links for MLO. This will be helpful to check the link related statistics during MLO. Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250528054420.3050133-3-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit e581b7fe62218d390520287e0095bfd6fe0454f8 Author: Sarika Sharma Date: Wed May 28 11:14:11 2025 +0530 wifi: mac80211: add support towards MLO handling of station statistics Currently, in supporting API's to fill sinfo structure from sta structure, is mapped to fill the fields from sta->deflink. However, for multi-link (ML) station, sinfo structure should be filled from corresponding link_id. Therefore, add link_id as an additional argument in supporting API's for filling sinfo structure correctly. Link_id is set to -1 for non-ML station and corresponding link_id for ML stations. In supporting API's for filling sinfo structure, check for link_id, if link_id < 0, fill the sinfo structure from sta->deflink, otherwise fill from sta->link[link_id]. Current, changes are done at the deflink level i.e, pass -1 as link_id. Actual link_id will be added in subsequent patches to support station statistics for MLO. Signed-off-by: Sarika Sharma Link: https://patch.msgid.link/20250528054420.3050133-2-quic_sarishar@quicinc.com Signed-off-by: Johannes Berg commit ced9ccd21fbc8ca941e6a0c2820c2df89239ccb9 Author: FUJITA Tomonori Date: Tue Jun 10 22:28:20 2025 +0900 rust: time: Replace HrTimerMode enum with trait-based mode types Replace the `HrTimerMode` enum with a trait-based approach that uses zero-sized types to represent each mode of operation. Each mode now implements the `HrTimerMode` trait. This refactoring is a preparation for replacing raw `Ktime` in HrTimer with the `Instant` and `Delta` types, and for making `HrTimer` generic over a `ClockSource`. Reviewed-by: Andreas Hindborg Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250610132823.3457263-3-fujita.tomonori@gmail.com Signed-off-by: Andreas Hindborg commit 5c23ce0cb897b491a12667e3c15288eb03f8928d Author: Paul E. McKenney Date: Tue May 6 11:43:32 2025 -0700 lib: Add stress test for ratelimit Add a simple stress test for lib/ratelimit.c To run on x86: ./tools/testing/kunit/kunit.py run --arch x86_64 --kconfig_add CONFIG_RATELIMIT_KUNIT_TEST=y --kconfig_add CONFIG_SMP=y --qemu_args "-smp 4" lib_ratelimit On a 16-CPU system, the "4" in "-smp 4" can be varied between 1 and 8. Larger numbers have higher probabilities of introducing delays that break the smoke test. In the extreme case, increasing the number to larger than the number of CPUs in the underlying system is an excellent way to get a test failure. Link: https://lore.kernel.org/all/fbe93a52-365e-47fe-93a4-44a44547d601@paulmck-laptop/ Link: https://lore.kernel.org/all/20250423115409.3425-1-spasswolf@web.de/ Signed-off-by: Paul E. McKenney Cc: Petr Mladek Cc: Andrew Morton Cc: Kuniyuki Iwashima Cc: Mateusz Guzik Cc: Steven Rostedt Cc: John Ogness Cc: Sergey Senozhatsky Cc: Jon Pan-Doh Cc: Bjorn Helgaas Cc: Karolina Stolarek commit 5a5c5a3de1c7af579a9670b7d4b0169120ec92a7 Author: Petr Mladek Date: Mon May 12 16:38:02 2025 +0200 lib: Make the ratelimit test more reliable The selftest fails most of the times when running in qemu with a kernel configured with CONFIG_HZ = 250: > test_ratelimit_smoke: 1 callbacks suppressed > # test_ratelimit_smoke: ASSERTION FAILED at lib/tests/test_ratelimit.c:28 > Expected ___ratelimit(&testrl, "test_ratelimit_smoke") == (false), but > ___ratelimit(&testrl, "test_ratelimit_smoke") == 1 (0x1) > (false) == 0 (0x0) Try to make the test slightly more reliable by calling the problematic ratelimit in the middle of the interval. Signed-off-by: Petr Mladek Signed-off-by: Paul E. McKenney commit d19e9fa61f609978af9b03f1d20fa59dd8c9997d Author: Paul E. McKenney Date: Thu Apr 3 09:31:02 2025 -0700 lib: Add trivial kunit test for ratelimit Add a simple single-threaded smoke test for lib/ratelimit.c To run on x86: make ARCH=x86_64 mrproper ./tools/testing/kunit/kunit.py run --arch x86_64 --kconfig_add CONFIG_RATELIMIT_KUNIT_TEST=y --kconfig_add CONFIG_SMP=y lib_ratelimit This will fail on old ___ratelimit(), and subsequent patches provide the fixes that are required. [ paulmck: Apply timeout and kunit feedback from Petr Mladek. ] Link: https://lore.kernel.org/all/fbe93a52-365e-47fe-93a4-44a44547d601@paulmck-laptop/ Link: https://lore.kernel.org/all/20250423115409.3425-1-spasswolf@web.de/ Signed-off-by: Paul E. McKenney Reviewed-by: Petr Mladek Cc: Andrew Morton Cc: Kuniyuki Iwashima Cc: Mateusz Guzik Cc: Steven Rostedt Cc: John Ogness Cc: Sergey Senozhatsky Cc: Jon Pan-Doh Cc: Bjorn Helgaas Cc: Karolina Stolarek commit 115ed5cb58ee4bab72a3d25dff9a98ff441b684a Merge: 7531f570418113 dcc3bcfc5b50c6 Author: Ulf Hansson Date: Tue Jun 24 14:18:33 2025 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v6.16-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit 3e36c822506d924894ff7de549b9377d3114c2d7 Author: Thangaraj Samynathan Date: Tue Jun 24 09:00:28 2025 +0530 spi: spi-pci1xxxx: Add support for per-instance DMA interrupt vectors Add support for dedicated DMA interrupt vectors for each SPI hardware instance in the pci1xxxx driver. This improves scalability and interrupt handling for systems using multiple SPI instances with DMA. Introduce a constant `NUM_VEC_PER_INST` to define the number of IRQ vectors per instance (main, DMA write, DMA read). Update the `pci1xxxx_spi_internal` structure to use an IRQ array. Refactor IRQ allocation and DMA initialization logic: - Assign separate IRQ vectors for DMA read and write interrupts. - Split the original DMA ISR into two handlers: `pci1xxxx_spi_isr_dma_rd` and `pci1xxxx_spi_isr_dma_wr`. - Configure IMWR registers per instance using cached MSI data. - Move DMA register configuration into a new helper function, `pci1xxxx_spi_dma_config()`. Invoke the DMA initialization after all instances are configured to ensure correct IRQ vector mapping. Signed-off-by: Thangaraj Samynathan Link: https://patch.msgid.link/20250624033028.74389-1-thangaraj.s@microchip.com Signed-off-by: Mark Brown commit ab9f2388e0b99cd164ddbd74a6133d3070e2788d Author: Pawan Gupta Date: Wed Jun 11 10:30:33 2025 -0700 x86/bugs: Allow ITS stuffing in eIBRS+retpoline mode also After a recent restructuring of the ITS mitigation, RSB stuffing can no longer be enabled in eIBRS+Retpoline mode. Before ITS, retbleed mitigation only allowed stuffing when eIBRS was not enabled. This was perfectly fine since eIBRS mitigates retbleed. However, RSB stuffing mitigation for ITS is still needed with eIBRS. The restructuring solely relies on retbleed to deploy stuffing, and does not allow it when eIBRS is enabled. This behavior is different from what was before the restructuring. Fix it by allowing stuffing in eIBRS+retpoline mode also. Fixes: 61ab72c2c6bf ("x86/bugs: Restructure ITS mitigation") Closes: https://lore.kernel.org/lkml/20250519235101.2vm6sc5txyoykb2r@desk/ Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250611-eibrs-fix-v4-7-5ff86cac6c61@linux.intel.com commit 7934a8dd8692b56714ce9b36421e316445d94a77 Author: Masahiro Yamada Date: Fri Jun 6 13:10:23 2025 +0900 module: remove meaningless 'name' parameter from __MODULE_INFO() The symbol names in the .modinfo section are never used and already randomized by the __UNIQUE_ID() macro. Therefore, the second parameter of __MODULE_INFO() is meaningless and can be removed to simplify the code. With this change, the symbol names in the .modinfo section will be prefixed with __UNIQUE_ID_modinfo, making it clearer that they originate from MODULE_INFO(). [Before] $ objcopy -j .modinfo vmlinux.o modinfo.o $ nm -n modinfo.o | head -n10 0000000000000000 r __UNIQUE_ID_license560 0000000000000011 r __UNIQUE_ID_file559 0000000000000030 r __UNIQUE_ID_description558 0000000000000074 r __UNIQUE_ID_license580 000000000000008e r __UNIQUE_ID_file579 00000000000000bd r __UNIQUE_ID_description578 00000000000000e6 r __UNIQUE_ID_license581 00000000000000ff r __UNIQUE_ID_file580 0000000000000134 r __UNIQUE_ID_description579 0000000000000179 r __UNIQUE_ID_uncore_no_discover578 [After] $ objcopy -j .modinfo vmlinux.o modinfo.o $ nm -n modinfo.o | head -n10 0000000000000000 r __UNIQUE_ID_modinfo560 0000000000000011 r __UNIQUE_ID_modinfo559 0000000000000030 r __UNIQUE_ID_modinfo558 0000000000000074 r __UNIQUE_ID_modinfo580 000000000000008e r __UNIQUE_ID_modinfo579 00000000000000bd r __UNIQUE_ID_modinfo578 00000000000000e6 r __UNIQUE_ID_modinfo581 00000000000000ff r __UNIQUE_ID_modinfo580 0000000000000134 r __UNIQUE_ID_modinfo579 0000000000000179 r __UNIQUE_ID_modinfo578 Signed-off-by: Masahiro Yamada Reviewed-by: Petr Pavlu commit f4363dfc900a7ffda96587d38982a1f3ea3d10bd Author: Masahiro Yamada Date: Mon Jun 9 01:59:57 2025 +0900 kheaders: double-quote variables to satisfy shellcheck Fix the following: In kernel/gen_kheaders.sh line 48: -I $XZ -cf $tarfile -C "${tmpdir}/" . > /dev/null ^-^ SC2086 (info): Double quote to prevent globbing and word splitting. ^------^ SC2086 (info): Double quote to prevent globbing and word splitting. Signed-off-by: Masahiro Yamada commit 1a0faff2833b59a74c8389bcdc390af99dc9d2cf Author: Masahiro Yamada Date: Mon Jun 9 01:59:56 2025 +0900 kheaders: rebuild kheaders_data.tar.xz when KBUILD_BUILD_TIMESTAMP is changed This problem is similar to commit 7f8256ae0efb ("initramfs: Encode dependency on KBUILD_BUILD_TIMESTAMP"): kernel/gen_kheaders.sh has an internal dependency on KBUILD_BUILD_TIMESTAMP that is not exposed to make, so changing KBUILD_BUILD_TIMESTAMP will not trigger a rebuild of the archive. Move $(KBUILD_BUILD_TIMESTAMP) to the Makefile so that is is recorded in the *.cmd file. Signed-off-by: Masahiro Yamada commit 626c54af35764b0b8a4ed5c446458ba6ddfe9cc8 Author: Masahiro Yamada Date: Mon Jun 9 01:59:55 2025 +0900 kheaders: rebuild kheaders_data.tar.xz when a file is modified within a minute When a header file is changed, kernel/gen_kheaders.sh may fail to update kernel/kheaders_data.tar.xz. [steps to reproduce] [1] Build kernel/kheaders_data.tar.xz $ make -j$(nproc) kernel/kheaders.o DESCEND objtool INSTALL libsubcmd_headers CALL scripts/checksyscalls.sh CHK kernel/kheaders_data.tar.xz GEN kernel/kheaders_data.tar.xz CC kernel/kheaders.o [2] Modify a header without changing the file size $ sed -i s/0xdeadbeef/0xfeedbeef/ include/linux/elfnote.h [3] Rebuild kernel/kheaders_data.tar.xz $ make -j$(nproc) kernel/kheaders.o DESCEND objtool INSTALL libsubcmd_headers CALL scripts/checksyscalls.sh CHK kernel/kheaders_data.tar.xz kernel/kheaders_data.tar.xz is not updated if steps [1] - [3] are run within the same minute. The headers_md5 variable stores the MD5 hash of the 'ls -l' output for all header files. This hash value is used to determine whether kheaders_data.tar.xz needs to be rebuilt. However, 'ls -l' prints the modification times with minute-level granularity. If a file is modified within the same minute and its size remains the same, the MD5 hash does not change. To reliably detect file modifications, this commit rewrites kernel/gen_kheaders.sh to output header dependencies to kernel/.kheaders_data.tar.xz.cmd. Then, Make compares the timestamps and reruns kernel/gen_kheaders.sh when necessary. This is the standard mechanism used by Make and Kbuild. Signed-off-by: Masahiro Yamada commit 694174f94ebeeb5ec5cc0e9de9b40c82057e1d95 Author: Yann E. MORIN Date: Thu Nov 14 00:53:32 2013 +0100 kconfig: lxdialog: fix 'space' to (de)select options In case a menu has comment without letters/numbers (eg. characters matching the regexp '^[^[:alpha:][:digit:]]+$', for example - or *), hitting space will cycle through those comments, rather than selecting/deselecting the currently-highlighted option. This is the behaviour of hitting any letter/digit: jump to the next option which prompt starts with that letter. The only letters that do not behave as such are 'y' 'm' and 'n'. Prompts that start with one of those three letters are instead matched on the first letter that is not 'y', 'm' or 'n'. Fix that by treating 'space' as we treat y/m/n, ie. as an action key, not as shortcut to jump to prompt. Signed-off-by: Yann E. MORIN Signed-off-by: Peter Korsgaard Signed-off-by: Cherniaev Andrei [masahiro: took from Buildroot, adjusted the commit subject] Signed-off-by: Masahiro Yamada commit e326371f3002dbf54befd8ada9570fa489a46991 Author: Alejandro Enrique Date: Fri May 23 13:19:52 2025 +0200 dt-bindings: gnss: u-blox: add u-blox,neo-9m compatible Add compatible for u-blox NEO-9M GPS module. Signed-off-by: Alejandro Enrique Acked-by: Rob Herring (Arm) Signed-off-by: Johan Hovold commit a0d8051cfd8145eb49dbd0c0c2f174d09da77796 Author: Christian Brauner Date: Tue Jun 24 10:29:07 2025 +0200 pidfs: add pidfs_root_path() helper Allow to return the root of the global pidfs filesystem. Link: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-4-d02a04858fe3@kernel.org Reviewed-by: Jan Kara Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit f7be8a333253cc319f5c6456b5cdab2a57b7351b Author: Christian Brauner Date: Tue Jun 24 10:29:06 2025 +0200 fhandle: rename to get_path_anchor() Rename as we're going to expand the function in the next step. The path just serves as the anchor tying the decoding to the filesystem. Link: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-3-d02a04858fe3@kernel.org Reviewed-by: Jan Kara Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit 774adcb55f159167fe0dfd343174fdedba3ae2f4 Author: Christian Brauner Date: Tue Jun 24 10:29:05 2025 +0200 fhandle: hoist copy_from_user() above get_path_from_fd() In follow-up patches we need access to @file_handle->handle_type before we start caring about get_path_from_fd(). Link: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-2-d02a04858fe3@kernel.org Reviewed-by: Jan Kara Reviewed-by: Amir Goldstein Signed-off-by: Christian Brauner commit cc678bf7aa9e2e6c2356fd7f955513c1bd7d4c97 Author: Christian Brauner Date: Tue Jun 24 10:29:04 2025 +0200 fhandle: raise FILEID_IS_DIR in handle_type Currently FILEID_IS_DIR is raised in fh_flags which is wrong. Raise it in handle->handle_type were it's supposed to be. Link: https://lore.kernel.org/20250624-work-pidfs-fhandle-v2-1-d02a04858fe3@kernel.org Fixes: c374196b2b9f ("fs: name_to_handle_at() support for "explicit connectable" file handles") Reviewed-by: Jan Kara Reviewed-by: Amir Goldstein Cc: stable@kernel.org Signed-off-by: Christian Brauner commit 7531f57041811347a59d740adca5fb49cadda287 Merge: 120ffe250dd95b 49b14db0351353 Author: Ulf Hansson Date: Tue Jun 24 12:43:55 2025 +0200 mmc: Merge branch fixes into next Merge the mmc fixes for v6.16-rc[n] into the next branch, to allow them to get tested together with the new mmc changes that are targeted for v6.17. Signed-off-by: Ulf Hansson commit 120ffe250dd95b5089d032f582c5be9e3a04b94b Author: Benoît Monin Date: Tue Jun 17 15:25:52 2025 +0200 mmc: sdhci-cadence: add Mobileye eyeQ support The MMC/SDHCI controller implemented by Mobileye needs the preset value quirks to configure the clock properly at speed slower than HS200. It otherwise works as a standard sd4hc controller. Signed-off-by: Benoît Monin Link: https://lore.kernel.org/r/e97f409650495791e07484589e1666ead570fa12.1750156323.git.benoit.monin@bootlin.com Signed-off-by: Ulf Hansson commit 0ae210564bc514d025893425fa4cdc8ba5ff5417 Author: Benoît Monin Date: Tue Jun 17 15:25:51 2025 +0200 dt-bindings: mmc: cdns: add Mobileye EyeQ MMC/SDHCI controller The MMC/SD controller from Mobileye is compatible with cdns,sd4hc, but will need the preset broken value quirk for speed slower than HS200. Signed-off-by: Benoît Monin Link: https://lore.kernel.org/r/9b34b471d1e71cf47c503aed7145fab896767ba7.1750156323.git.benoit.monin@bootlin.com Signed-off-by: Ulf Hansson commit 3ab659eb696f0aa0373469c1abb9e242a74d3796 Author: Nathan Chancellor Date: Fri Jun 20 11:25:22 2025 -0700 mmc: rtsx_usb_sdmmc: Fix clang -Wimplicit-fallthrough in sd_set_power_mode() Clang warns (or errors with CONFIG_WERROR=y): drivers/mmc/host/rtsx_usb_sdmmc.c:1042:2: error: unannotated fall-through between switch labels [-Werror,-Wimplicit-fallthrough] 1042 | case MMC_POWER_UNDEFINED: | ^ drivers/mmc/host/rtsx_usb_sdmmc.c:1042:2: note: insert 'break;' to avoid fall-through 1042 | case MMC_POWER_UNDEFINED: | ^ | break; Clang is a little more pedantic than GCC, which does not warn when falling through to a case that is just break or return. Clang's version is more in line with the kernel's own stance in deprecated.rst, which states that all switch/case blocks must end in either break, fallthrough, continue, goto, or return. Add the missing break to silence the warning. Fixes: 2c3809bd6f65 ("mmc: rtsx_usb_sdmmc: Add 74 clocks in poweron flow") Signed-off-by: Nathan Chancellor Link: https://lore.kernel.org/r/20250620-mmc-rtsx-usb-sdmmc-fix-clang-implicit-fallthrough-v1-1-4031d11159c0@kernel.org Signed-off-by: Ulf Hansson commit d783ce4fe274709b95f184ff7790041e903abd4a Author: Li Dong Date: Wed Jun 18 19:59:54 2025 +0800 mmc: cb710-mmc: Convert ternary operator to str_plural() helper Replace direct ternary condition check with existing helper function str_plural() to improve code readability and maintain consistency. Signed-off-by: Li Dong Link: https://lore.kernel.org/r/20250618115954.10260-1-lidong@vivo.com Signed-off-by: Ulf Hansson commit 9939ac6ca0f5d573e3975f7f85a9fd348077719a Author: Ricky Wu Date: Mon Jun 16 14:49:56 2025 +0800 mmc: rtsx_usb_sdmmc: Add 74 clocks in poweron flow To conform with SD spec definition, that the host must provide at least 74 clocks before issuing first command, let's add these clock cycles at MMC_POWER_UP. Signed-off-by: Ricky Wu Link: https://lore.kernel.org/r/20250616064956.1846258-1-ricky_wu@realtek.com Signed-off-by: Ulf Hansson commit f9a1a9448f5c12a24c3724a4899e34a22b90e7f1 Author: Ulf Hansson Date: Tue Jun 10 13:16:26 2025 +0200 mmc: rtsx_usb_sdmmc: Re-work the code in sd_set_power_mode() It's only at MMC_POWER_OFF and at MMC_POWER_UP when some operations must be carried out in sd_set_power_mode(). The code is a bit obfuscated in this regards. Let's convert it into a switch-case-clause to make this clear. Reviewed-by: Avri Altman Signed-off-by: Ulf Hansson Acked-by: Ricky Wu Link: https://lore.kernel.org/r/20250610111633.504366-5-ulf.hansson@linaro.org commit 55131d685ebee43d7f7260f34459201734ee6a44 Author: Ulf Hansson Date: Tue Jun 10 13:16:25 2025 +0200 mmc: rtsx_usb_sdmmc: Convert sd_set_power_mode() into void The sdmmc_set_ios() is the only caller of sd_set_power_mode() and it ignores the return code. Let's therefore convert sd_set_power_mode() into a void function instead. Reviewed-by: Avri Altman Signed-off-by: Ulf Hansson Acked-by: Ricky Wu Link: https://lore.kernel.org/r/20250610111633.504366-4-ulf.hansson@linaro.org commit f12b55b9782017edb0533463be6215e23f4b4f8f Author: Ulf Hansson Date: Tue Jun 10 13:16:24 2025 +0200 mmc: rtsx_usb_sdmmc: Print debug-messages at power-on/off errors It should be useful to know when we fail to power-on/off a card. Let's therefore print debug-messages when this happens. Reviewed-by: Avri Altman Signed-off-by: Ulf Hansson Acked-by: Ricky Wu Link: https://lore.kernel.org/r/20250610111633.504366-3-ulf.hansson@linaro.org commit 47a255f7d2eabee06cfbf5b1c2379749442fd01d Author: Ulf Hansson Date: Tue Jun 10 13:16:23 2025 +0200 mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() In the error path of sd_set_power_mode() we don't update host->power_mode, which could lead to an imbalance of the runtime PM usage count. Fix this by always updating host->power_mode. Reviewed-by: Avri Altman Signed-off-by: Ulf Hansson Acked-by: Ricky Wu Link: https://lore.kernel.org/r/20250610111633.504366-2-ulf.hansson@linaro.org commit 30fa7d53afd405fdac68b629f4ed8d14fe37b550 Author: Yoshihiro Shimoda Date: Tue Jun 10 16:25:45 2025 +0900 mmc: host: renesas_sdhi: Fix incorrect auto retuning for an SDIO card This host controller is possible to change incorrect tap if an SDIO card is used because DAT1 is used for interrupt signal on SDIO standard but the controller doesn't take care of it. So, in the worst case, this behavior causes a CRC error. To resolve the issue, this driver uses manual correction mode instead of auto correction if an SDIO card is used. Also, even if DAT1 is mismatched on an SDIO card, this driver will not change the TAP. Signed-off-by: Yoshihiro Shimoda Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Link: https://lore.kernel.org/r/20250610072545.2001435-3-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Ulf Hansson commit a749174004786b2f14cf3e627ece7584b8884753 Author: Yoshihiro Shimoda Date: Tue Jun 10 16:25:44 2025 +0900 mmc: host: tmio: Add .sdio_irq() Renesas SDHI controller requires vender specific handling when an SDIO irq occurs. So, add .sdio_irq() to the tmio core. Signed-off-by: Yoshihiro Shimoda Reviewed-by: Wolfram Sang Tested-by: Wolfram Sang Link: https://lore.kernel.org/r/20250610072545.2001435-2-yoshihiro.shimoda.uh@renesas.com Signed-off-by: Ulf Hansson commit 08305a6d23735f9b46eba34a8584651233b27be8 Author: Frank Li Date: Tue Jun 3 11:22:45 2025 -0400 dt-bindings: mmc: mxs-mmc: change ref to mmc-controller-common.yaml from mmc-controller.yaml Change ref to mmc-controller-common.yaml from mmc-controller.yaml because imx23/imx28 use dual mode controller (spi and mmc). So default dts node name use spi instead of mmc. The legacy reason, it use difference compatible string to distringuish work mode (spi / mmc). Fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/mxs/imx23-olinuxino.dtb: spi@80010000 (fsl,imx23-mmc): $nodename:0: 'spi@80010000' does not match '^mmc(@.*)?$' Additional add clocks property. Signed-off-by: Frank Li Reviewed-by: Stefan Wahren Link: https://lore.kernel.org/r/20250603152245.1068740-1-Frank.Li@nxp.com Signed-off-by: Ulf Hansson commit 1f129bc3ebe54a1616a1adf33fef61fb5ec0d26d Author: Binbin Zhou Date: Sat Jun 7 15:53:41 2025 +0800 mmc: sdhci: Drop sdhci_free_host()/sdhci_pltfm_free() interface >From now on, all calls to sdhci_free_host()/sdhci_pltfm_free() have been cleaned up, so we can just delete them. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/8adcfef00fd4bc40f33f5fd42d2e5e73d72e68e4.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 10e70d56a119e369cd7418a9e39a3d89dd90009a Author: Binbin Zhou Date: Sat Jun 7 15:53:18 2025 +0800 mmc: sdhci_f_sdh30: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/c216c46cb5aebe8e4598215428ace4440974c188.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit c246e780250f61b1a8d207ff354878a9a1883c4c Author: Binbin Zhou Date: Sat Jun 7 15:52:58 2025 +0800 mmc: sdhci_am654: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/a456963bae14b0c6dade02f388f815f1ffcaa98a.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit f9a06dfdfd5d1cd50e93e4970a3cc1cbc9d1e405 Author: Binbin Zhou Date: Sat Jun 7 15:52:39 2025 +0800 mmc: sdhci-xenon: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Hu Ziji Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/e7c52155f04fc270400985b70514800c23fd5565.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 7361fb3e8c38a3868cec9118337590e3788bb175 Author: Binbin Zhou Date: Sat Jun 7 15:52:16 2025 +0800 mmc: sdhci-tegra: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Thierry Reding Cc: Jonathan Hunter Cc: linux-tegra@vger.kernel.org Signed-off-by: Binbin Zhou Acked-by: Thierry Reding Link: https://lore.kernel.org/r/cee82eaad0392838fbe1fab8e2301e680d34c0c5.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 79856047b9d68716cecaf2b853e99fee423d5795 Author: Binbin Zhou Date: Sat Jun 7 15:51:48 2025 +0800 mmc: sdhci-st: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Patrice Chotard Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/5fdb2403bf553ad43e2336d072007dd7ea2b4143.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 426b463f65c97df8a5ae59b6e0c7d3e57c919550 Author: Binbin Zhou Date: Sat Jun 7 15:51:23 2025 +0800 mmc: sdhci-sprd: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Orson Zhai Cc: Baolin Wang Reviewed-by: Chunyan Zhang Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/88a24d5f60bc916712cca813e24ae49b7e691eb2.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 7e1ff21d27cf6541604c1bcd1ef27e7078884a90 Author: Binbin Zhou Date: Sat Jun 7 15:51:05 2025 +0800 mmc: sdhci-pxav3: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/7b489e7326349c3709caa33efb0e995b5667fb27.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 072f5e2c34a95bc669839ff76f1dbb67ff9a05e7 Author: Binbin Zhou Date: Sat Jun 7 15:50:46 2025 +0800 mmc: sdhci-pxav2: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/b4f833b5f4816cfe5b9e502d55aad6a970042aad.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 3a55e989bb08c31d2554bac22f4e247432b0a27d Author: Binbin Zhou Date: Sat Jun 7 15:50:28 2025 +0800 mmc: sdhci-pic32: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/e6f16e97f8b82ffa71b8ad34e32e42ab240734e5.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 18cd5e59c031259c3406b179c1be32f882293c0e Author: Binbin Zhou Date: Sat Jun 7 15:49:55 2025 +0800 mmc: sdhci-omap: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Vignesh Raghavendra Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/c45dd3f283de7e259cc2fa01ee8d1e34d18829d3.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit ccade5236b0386330a60cc5f5b62bba3a6a5704e Author: Binbin Zhou Date: Sat Jun 7 15:49:32 2025 +0800 mmc: sdhci-of-sparx5: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Steen Hegelund Cc: Daniel Machon Signed-off-by: Binbin Zhou Acked-by: Daniel Machon Link: https://lore.kernel.org/r/67b5e9076056da66d9fc8951fafd4f48ddd3ca25.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 01bc623f9a5c232c968ffd99d12f6a3bed21f443 Author: Binbin Zhou Date: Sat Jun 7 15:48:35 2025 +0800 mmc: sdhci-of-ma35d1: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Jacky Huang Cc: Shan-Chun Hung Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/67a2a3b35e2d46aab06657e88566c14a7f2d7947.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit da94d533ec9a62adbfe9c03cb931e251a7234d41 Author: Binbin Zhou Date: Sat Jun 7 15:39:03 2025 +0800 mmc: sdhci-of-k1: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Yixun Lan Cc: linux-riscv@lists.infradead.org Cc: spacemit@lists.linux.dev Reviewed-by: Yixun Lan Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/e98c6383c82a0af2dce6d07645c9fecd53de8767.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit a1402b12dc09853e264fae1414ac502a97915333 Author: Binbin Zhou Date: Sat Jun 7 15:39:02 2025 +0800 mmc: sdhci-of-esdhc: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/03a03a94c933694c8e4f6f4b7b05bc69932dc7f8.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 91a001a1a0749e5d24606d46ac5dfd4433c00956 Author: Binbin Zhou Date: Sat Jun 7 15:39:01 2025 +0800 mmc: sdhci-of-dwcmshc: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/01b6797d55562e124599663e859dd9b7d4e4d8e0.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 6cb3aeccf6435cc8444e3c5f9beabe251fcf2b20 Author: Binbin Zhou Date: Sat Jun 7 15:38:13 2025 +0800 mmc: sdhci-of-at91: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Aubin Constans Cc: Eugen Hristev Cc: Nicolas Ferre Cc: Alexandre Belloni Cc: Claudiu Beznea Signed-off-by: Binbin Zhou Acked-by: Aubin Constans Link: https://lore.kernel.org/r/d64ed0f849277760d5b9ce04cfff1cd02ad43d19.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit aa8eeffc0f1516f9ce9acfa2d5769dc252aa26bd Author: Binbin Zhou Date: Sat Jun 7 15:38:12 2025 +0800 mmc: sdhci-of-aspeed: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Andrew Jeffery Cc: Joel Stanley Cc: linux-aspeed@lists.ozlabs.org Cc: openbmc@lists.ozlabs.org Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/117c13ffd2d67a4c7cad980634591c4851f560b5.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 62a8554fce5d9cfc18db5a2c710ec0b330f07a93 Author: Binbin Zhou Date: Sat Jun 7 15:37:41 2025 +0800 mmc: sdhci-of-arasan: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Michal Simek Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/ff7094276568354687a691f7f2789048c1706476.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit bb9c8ae108e30017eefc973cb6b547d8f327f5b8 Author: Binbin Zhou Date: Sat Jun 7 15:37:40 2025 +0800 mmc: sdhci-npcm: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Avi Fishman Cc: Tomer Maimon Cc: Tali Perry Cc: Patrick Venture Cc: Nancy Yuen Cc: Benjamin Fair Cc: openbmc@lists.ozlabs.org Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/08f9a1f6c2a1ad908baaf01623cd9670bf540aa3.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit ba7f99c514df2d0493f0bd123f3c1b773cd3b5db Author: Binbin Zhou Date: Sat Jun 7 15:37:39 2025 +0800 mmc: sdhci-msm: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/3476546610d5518cc4e4490c4e26a71933615aa6.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 4340922f5cdee69d368a3f2b7ce26672076261c0 Author: Binbin Zhou Date: Sat Jun 7 15:37:38 2025 +0800 mmc: sdhci-iproc: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Ray Jui Cc: Scott Branden Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/c6496a92e47bfc70550759db5f6eba5564bb4a7d.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit eb270f417ce66baf465b4381bce63fdd06d9120c Author: Binbin Zhou Date: Sat Jun 7 15:36:46 2025 +0800 mmc: sdhci-esdhc-mcf: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Acked-by: Angelo Dureghello Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/3843af6a7726d8879e5cba02e0321e08c8908328.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 06d7faf7b4ff773bff29bf70d8c2fb81217780f0 Author: Binbin Zhou Date: Sat Jun 7 15:36:45 2025 +0800 mmc: sdhci-esdhc-imx: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Haibo Chen Cc: Shawn Guo Cc: Sascha Hauer Cc: Fabio Estevam Cc: imx@lists.linux.dev Signed-off-by: Binbin Zhou Reviewed-by: Haibo Chen Link: https://lore.kernel.org/r/9b9014749a9870a9cb3c2818fe9b38c013cb46ca.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 9a334ff0ac7e8cc2dc348ef30dcc7143c264862f Author: Binbin Zhou Date: Sat Jun 7 15:36:44 2025 +0800 mmc: sdhci-dove: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/54f34c130c0906700b45c749eb24682651c7ab06.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 8407238837e50f619cbcf845a158437e75fa3571 Author: Binbin Zhou Date: Sat Jun 7 15:36:43 2025 +0800 mmc: sdhci-cadence: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/6269e0a4fac68f34a063391a4b53bf5ddee98d98.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 04609d34672bbb39bfcc8c50759c26e527933c54 Author: Binbin Zhou Date: Sat Jun 7 15:35:45 2025 +0800 mmc: sdhci-brcmstb: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Kamal Dasu Cc: Al Cooper Cc: Florian Fainelli Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/e9a76f0ecb07832acefadb209cf50171df6bb180.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 8f993834353a41abccc8ee2c73e227ba2e35e4fa Author: Binbin Zhou Date: Sat Jun 7 15:35:44 2025 +0800 mmc: sdhci-bcm-kona: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. Cc: Florian Fainelli Cc: Ray Jui Cc: Scott Branden Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/8edf02e2711b36d1acf63708b1921b690742072e.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit f192b9b667ff49de5ac663f0d4bcc13a622e02c0 Author: Binbin Zhou Date: Sat Jun 7 15:35:43 2025 +0800 mmc: sdhci-pltfm: Drop the use of sdhci_pltfm_free() Since the devm_mmc_alloc_host() helper is already in use, sdhci_pltfm_free() is no longer needed. To avoid causing drivers that still use sdhci_pltfm_free() to fail to compile, it has been temporarily set to empty. And it will be removed when there are no longer any callers. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/67e8881bc46f12aadbe82c655ce373b9c6907182.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit e0df12ac3d323054aba8e2f41e8b0a9ab4742231 Author: Binbin Zhou Date: Sat Jun 7 15:35:42 2025 +0800 mmc: sdhci-spear: Drop the use of sdhci_free_host() Since the devm_mmc_alloc_host() helper is already in use, sdhci_free_host() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/fde959d1021c165ede971644f3db7e06ce7c6180.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 41c1abd729bf3ce5e892f2ad86566848b81c55cc Author: Binbin Zhou Date: Sat Jun 7 15:35:09 2025 +0800 mmc: sdhci-s3c: Drop the use of sdhci_free_host() Since the devm_mmc_alloc_host() helper is already in use, sdhci_free_host() is no longer needed. Cc: Ben Dooks Cc: Jaehoon Chung Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/f22a17de11dc03c5bdeb4ebbdc6aec8429c1c20f.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 5590376d7bbe68b5e4ab8d2d59e1c4900554e554 Author: Binbin Zhou Date: Sat Jun 7 15:35:08 2025 +0800 mmc: sdhci-pci: Drop the use of sdhci_free_host() Since the devm_mmc_alloc_host() helper is already in use, sdhci_free_host() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/48c54b92b6c4151db0bfee1a74645225878be1ff.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit dbbbdeabf6e610803965042b9264aca5039ba743 Author: Binbin Zhou Date: Sat Jun 7 15:35:07 2025 +0800 mmc: sdhci-milbeaut: Drop the use of sdhci_free_host() Since the devm_mmc_alloc_host() helper is already in use, sdhci_free_host() is no longer needed. Cc: Taichi Sugaya Cc: Takao Orito Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/6d6ac2f5eb1962b96d63de70e6f52ad8fc785974.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit cb815f9a2d5c1eefd8137972e5b3c3407a2e0d8e Author: Binbin Zhou Date: Sat Jun 7 15:35:06 2025 +0800 mmc: sdhci-acpi: Drop the use of sdhci_free_host() Since the devm_mmc_alloc_host() helper is already in use, sdhci_free_host() is no longer needed. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/fb7b0f915136b5e9f47ab2e72156fd96ae0d32bf.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit f6fce1182bb095ed5f9d60d39d05435e19aa19f2 Author: Binbin Zhou Date: Sat Jun 7 15:33:34 2025 +0800 mmc: sdhci: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Although sdhci_free_host() is no longer needed, to avoid drivers that still use this function from failing to compile, sdhci_free_host() is temporarily set to empty. Finally, it will be removed when there are no more callers. Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/dcfce3ddf980563c590f82c1b4e8840c29497887.1749127796.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 71f118b427bbfe8a60e7f7c3550314ef2801bcc7 Author: Binbin Zhou Date: Tue Jun 3 20:28:21 2025 +0800 mmc: mmc_spi: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/3f1127f02ffd7f1cc09122fd0d3c71473a030a53.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 5a8af27596118f3e6a121059ac7ac8c299bee164 Author: Binbin Zhou Date: Tue Jun 3 20:28:20 2025 +0800 mmc: sunxi: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Chen-Yu Tsai Cc: Jernej Skrabec Cc: Samuel Holland Cc: linux-sunxi@lists.linux.dev Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/ee7726b1ea37084258a5d8cec67cad12473152c2.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 4c2fc69f28f3ad251b9bf76aae5380d6e3c8b86f Author: Binbin Zhou Date: Tue Jun 3 20:28:05 2025 +0800 mmc: tmio: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Wolfram Sang Cc: Kunihiko Hayashi Cc: Masami Hiramatsu Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/d7d9120fc1ca2eb014cda4e481af5add05be0bf6.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 99e85793aa6aca758233298307cfaff84bbe357b Author: Binbin Zhou Date: Tue Jun 3 20:28:04 2025 +0800 mmc: wmt-sdmmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Alexey Charkov Acked-by: Alexey Charkov Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/81a288603ffc77b39678ef9f5bea7284670e6b60.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 51b8ca24f82be059c2641384d55f1062e913057c Author: Binbin Zhou Date: Tue Jun 3 20:28:03 2025 +0800 mmc: wbsd: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Pierre Ossman Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/1d1d31ac2d6aff5325748693cb1551d7ae21de30.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit dcfdd698dc521c6046e9b80c16281575efb25d23 Author: Binbin Zhou Date: Tue Jun 3 20:28:02 2025 +0800 mmc: vub300: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/f023d2caa02fab405f089c5170b686529857fb70.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 93f0d3ecae691cd0af99f5bcb108bd682def09b1 Author: Binbin Zhou Date: Tue Jun 3 20:27:53 2025 +0800 mmc: via-sdmmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/32781a61d729cefcaf15e62df809ce924c504390.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 155391da150d937008c8bdc9f8ad91af12454cf6 Author: Binbin Zhou Date: Tue Jun 3 20:27:52 2025 +0800 mmc: ushc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/dde4d49481fe0cc6bd3289e9bd4b33433eb27cea.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 1fdbbdb4f4734a00be3d67ab169aa6921aeb2d16 Author: Binbin Zhou Date: Tue Jun 3 20:27:37 2025 +0800 mmc: usdhi6ro10: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Jesper Nilsson Cc: Lars Persson Reviewed-by: Huacai Chen Acked-by: Jesper Nilsson Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/e236d2ee9cd6bb9450e3500577eda17c8fb53c1c.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit c92d54a47ac13c78aa17bb3f57438b9bf38c9e14 Author: Binbin Zhou Date: Tue Jun 3 20:27:36 2025 +0800 mmc: toshsd: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/23c80160c93c868353d2444100a592e8ba5d2f90.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit dfab551e7494d6a87b5a261a050bc567df1d5ef7 Author: Binbin Zhou Date: Tue Jun 3 20:27:35 2025 +0800 mmc: tifm_sd: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Alex Dubov Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/84a31172bb4c26e3ef41f99ebb4c37fa101bfaac.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit e048939d6d92f5124e40c895f3ab482d8ebfcccc Author: Binbin Zhou Date: Tue Jun 3 20:27:34 2025 +0800 mmc: sh_mmicf: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/af6b34130eb98cb60aa7c5f289e2392089faae66.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 2db145dff506dec3793c513d06983698ad604164 Author: Binbin Zhou Date: Tue Jun 3 20:27:20 2025 +0800 mmc: sdricoh_cs: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/ce16815710f97e853586a0496c315729bd11fb3f.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit ee4337092eb42d4f7acf68219061d5f41508aba4 Author: Binbin Zhou Date: Tue Jun 3 20:27:19 2025 +0800 mmc: rtsx_usb_sdmmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/c7a39ca44f3b07acdfe8cd7e5250c1cbed8e37ca.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit ffcf51d60ab274e2ebaccd1ac8e33ff4eaa2db95 Author: Binbin Zhou Date: Tue Jun 3 20:27:18 2025 +0800 mmc: rtsx_pci: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/f18424d5bf8b3055de7d8bcf3918868707086e85.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 58c40f3faf742c11070d38571dfe4de33b914246 Author: Binbin Zhou Date: Tue Jun 3 20:27:17 2025 +0800 mmc: pxamci: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/3d8a815f898b977f76c7ed07f56185990a34abac.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit fb2f73107fdc0e1138a84034dd207556579e7537 Author: Binbin Zhou Date: Tue Jun 3 20:27:06 2025 +0800 mmc: owl-mmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Andreas Färber Cc: Manivannan Sadhasivam Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/1b1b9e17c8512d4bdda584e577a69cd6caf2632a.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit ecb4728dd7ea68d5ba042a36cb2deaa6c9e8e9a0 Author: Binbin Zhou Date: Tue Jun 3 20:27:05 2025 +0800 mmc: omap_hsmmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/bd5dd68556d8530295bb61dc44ac68b619130d1f.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 98d21565756928f87ebc46bbeebac1d6a175c800 Author: Binbin Zhou Date: Tue Jun 3 20:26:33 2025 +0800 mmc: omap: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Aaro Koskinen Cc: Allen Pais Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/f172097638a161d622dcbfbc1ede6d4bb8aeea0c.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit c53700e7459baee4bde82e0d20a327134ab4faca Author: Binbin Zhou Date: Tue Jun 3 20:26:32 2025 +0800 mmc: mxs-mmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Shawn Guo Cc: Sascha Hauer Cc: Fabio Estevam Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/8ace670e06536fb5c9e28003d487cde870ee8c47.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit c6aa07ac9fbd4017f848862ae3fa1621c1abe144 Author: Binbin Zhou Date: Tue Jun 3 20:26:31 2025 +0800 mmc: mxcmmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Shawn Guo Cc: Sascha Hauer Cc: Fabio Estevam Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/eb21038ebc81bd0ba9dab4843dce57e4f431fac0.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 2a52d0c772bc288be1a2f63d69345adcabc4d5c3 Author: Binbin Zhou Date: Tue Jun 3 20:26:30 2025 +0800 mmc: mvsdio: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Nicolas Pitre Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/ec8a37f8007391fb0835ab239f838517632611ad.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 973aa22b9f1ad71c2ee8bfb7561ba0c2aaf252dd Author: Binbin Zhou Date: Tue Jun 3 20:26:14 2025 +0800 mmc: moxart-mmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/c2bdcea3720b81660b3226180640e32fffefc464.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit c799f3a1f099fce4f938eea528f0d551f5a3a84b Author: Binbin Zhou Date: Tue Jun 3 20:26:13 2025 +0800 mmc: mmci: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Russell King Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/f2da882c5c41c25372d82b769506a7dd60fd0d4d.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 8f4ab5abbbb62079226daf66dc5286b67db59a39 Author: Binbin Zhou Date: Tue Jun 3 20:26:12 2025 +0800 mmc: meson-mx-sdhc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Neil Armstrong Cc: Kevin Hilman Cc: Jerome Brunet Cc: Martin Blumenstingl Cc: linux-amlogic@lists.infradead.org Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Reviewed-by: Martin Blumenstingl Link: https://lore.kernel.org/r/592c6674a83a80558e55b143c483e29dcbfef1fd.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit c8e5ba21da311c9cae690ea6766de1153a1ef358 Author: Binbin Zhou Date: Tue Jun 3 20:26:11 2025 +0800 mmc: litex_mmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Karol Gugala Cc: Mateusz Holenko Cc: Gabriel Somlo Cc: Joel Stanley Reviewed-by: Huacai Chen Acked-by: Gabriel Somlo Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/8eea32bf0fb1ac95497355ccd5ea732ce619238c.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 535ee4b4a10080672d2c62453911911dfac2e248 Author: Binbin Zhou Date: Tue Jun 3 20:25:55 2025 +0800 mmc: jz4740: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Paul Cercueil Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/243cf4d1515028725f08401a55d2a02c15d6c662.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 17a71a3f90984307f0059ebe51f175dc5a5d5942 Author: Binbin Zhou Date: Tue Jun 3 20:25:54 2025 +0800 mmc: dw_mmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Jaehoon Chung Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/5179b0e39cf2cabbb41ed2de51190913628a7da0.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 8bc8c97bac8fcefe177dfa2ab56fd196f7439dbe Author: Binbin Zhou Date: Tue Jun 3 20:25:36 2025 +0800 mmc: davinci_mmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Bastien Curutchet Cc: Bartosz Golaszewski Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/bbdbdbe746fd227384d562e78bde98fba13f43e7.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 1f150edbea35a18622a560e236aa1ab8262fbf1c Author: Binbin Zhou Date: Tue Jun 3 20:25:35 2025 +0800 mmc: cb710: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Michał Mirosław Acked-by: Michał Mirosław Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/4ef97a91053fe8819c651f7968fb56209faa36d8.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit f32b90e6887fc321dd10762d5e4e1d580c20908d Author: Binbin Zhou Date: Tue Jun 3 20:25:34 2025 +0800 mmc: cavium: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Robert Richter Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/9a7715ac3045d925cf2e88e23dca7acb17376468.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 5f0aa2f7251916cc4a3bc723b701ff1a5e134aa2 Author: Binbin Zhou Date: Tue Jun 3 20:25:33 2025 +0800 mmc: bcm2835: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Florian Fainelli Cc: Ray Jui Cc: Scott Branden Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/37a95baec1889f906134deb2dc761a98e950dcd1.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 16ca54d05207f0255dcee0b7c3eee949758f39a6 Author: Binbin Zhou Date: Tue Jun 3 20:25:15 2025 +0800 mmc: au1xmmc: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Manuel Lauss Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/7da94643484f7184be40fa517a8a74ce3cdefe19.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 56637056f945d478cff6e7b89750961e6329387d Author: Binbin Zhou Date: Tue Jun 3 20:25:14 2025 +0800 mmc: atmel: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Aubin Constans Cc: Nicolas Ferre Cc: Alexandre Belloni Cc: Claudiu Beznea Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Acked-by: Aubin Constans Link: https://lore.kernel.org/r/0688b77b93d27bd2f2e155fca6f53a1766fc3a80.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 2cf4083d39850029b9541577658d20ec8620b226 Author: Binbin Zhou Date: Tue Jun 3 20:25:13 2025 +0800 mmc: alcor: Use devm_mmc_alloc_host() helper Use new function devm_mmc_alloc_host() to simplify the code. Cc: Feng Wei Cc: Shao Mingyin Reviewed-by: Huacai Chen Signed-off-by: Binbin Zhou Link: https://lore.kernel.org/r/fcb69bf45d8ad4c2653c9e5e912ea8aed77fc3a2.1748933789.git.zhoubinbin@loongson.cn Signed-off-by: Ulf Hansson commit 7dc0cee13dbd539e34de090a45618f30b3cbcb0a Author: Adrian Hunter Date: Fri May 30 19:56:43 2025 +0300 mmc: sdhci: Return void from sdhci_runtime_suspend|resume_host() It does not seem like these functions will ever need the return value, which is presently always zero. Simplify the usage by making the return type 'void' instead. Signed-off-by: Adrian Hunter Link: https://lore.kernel.org/r/20250530165643.141295-1-adrian.hunter@intel.com Signed-off-by: Ulf Hansson commit 7613b9b1084c8fb5739ec9136529aec0e138ca85 Author: Yixun Lan Date: Fri May 23 22:46:32 2025 +0800 mmc: sdhci-of-k1: disable HW busy detection It doesn't make sense to enable HW busy detection in pre_select_hs400(), while disable it later in post_select_hs400(). And the reason behind this isn't clear. Therefore, let's disable it for now. Signed-off-by: Yixun Lan Link: https://lore.kernel.org/r/20250523-21-k1-sdhci-v1-2-9f293116a7e7@gentoo.org Signed-off-by: Ulf Hansson commit eed50f48d791d1e7dfeb209e4c5afaf13b418dd0 Author: Yixun Lan Date: Fri May 23 22:46:31 2025 +0800 mmc: sdhci-of-k1: make register definition vendor specific Making register definition less generic which will potentially have less collision with other files. Add SpacemiT vendor prefix to K1 SoC SDHC register definitions, also improve the BIT definitions to reflect them more SDHC specific. Note, there should be no functional changes introduced in this commit. Signed-off-by: Yixun Lan Link: https://lore.kernel.org/r/20250523-21-k1-sdhci-v1-1-9f293116a7e7@gentoo.org Signed-off-by: Ulf Hansson commit f1dd21863dd241cc1fd9064840684fa3d7bd3cca Author: Luke Wang Date: Wed May 21 10:55:02 2025 +0800 mmc: sdhci-esdhc-imx: optimize clock loopback selection with dummy pad support For legacy platforms without dummy pad: When clock <= 100MHz: Set ESDHC_MIX_CTRL_FBCLK_SEL to 0 (external clock pad loopback) for better bus clock proximity. When clock > 100MHz: Set ESDHC_MIX_CTRL_FBCLK_SEL to 1 (internal clock loopback) to avoid signal reflection noise at high frequency. For i.MX94/95 with dummy pad support: Keep ESDHC_MIX_CTRL_FBCLK_SEL at 0 for all speed mode. Hardware automatically substitutes clock pad loopback with dummy pad loopback when available, eliminating signal reflections while preserving better bus clock proximity. Signed-off-by: Luke Wang Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250521025502.112030-2-ziniu.wang_1@nxp.com Signed-off-by: Ulf Hansson commit 45310531a3e0f5e7467691c5800918068f337775 Author: Luke Wang Date: Wed May 21 10:55:01 2025 +0800 mmc: sdhci-esdhc-imx: refactor clock loopback selection logic i.MX reference manual specifies that internal clock loopback should be used for SDR104/HS200/HS400 modes. Move ESDHC_MIX_CTRL_FBCLK_SEL configuration into the timing selection function to: 1. Explicitly set internal loopback path for SDR104/HS200/HS400 modes 2. Avoid redundant bit manipulation across multiple functions Preserve ESDHC_MIX_CTRL_FBCLK_SEL during system resume for SDIO devices with MMC_PM_KEEP_POWER and MMC_PM_WAKE_SDIO_IRQ flag, as the controller might lose register state during suspend while skipping card re-initialization. Signed-off-by: Luke Wang Acked-by: Adrian Hunter Link: https://lore.kernel.org/r/20250521025502.112030-1-ziniu.wang_1@nxp.com Signed-off-by: Ulf Hansson commit 031d9e30d569ca15ca32f64357c83eee6488e09d Author: Haibo Chen Date: Wed May 21 11:31:34 2025 +0800 mmc: sdhci-esdhc-imx: Don't change pinctrl in suspend if wakeup source The pinctrl sleep state may config the pin mux to certain function to save power in system suspend. Unfortunately this doesn't work if usdhc is used as a wakeup source, like waking up on SDIO irqs or card-detect irqs. In these cases, we need pin mux to be configured to usdhc function pad. The issue is found on imx93-11x11-evk board, where WiFI over SDIO with in-band irqs fails to wakeup the system, because the DATA[1] pin has been set to GPIO function. To fix the problem, don't change the pinctrl state in suspend if there is a system wakeup enabled. Signed-off-by: Haibo Chen Signed-off-by: Luke Wang Link: https://lore.kernel.org/r/20250521033134.112671-1-ziniu.wang_1@nxp.com Signed-off-by: Ulf Hansson commit 140c6a61d83cbd85adba769b5ef8d61acfa5b392 Author: Ramya Gnanasekar Date: Sun Jun 8 19:33:24 2025 +0530 wifi: mac80211: update radar_required in channel context after channel switch Currently, when a non-DFS channel is brought up and the bandwidth is expanded from 80 MHz to 160 MHz, where the primary 80 MHz is non-DFS and the secondary 80 MHz consists of DFS channels, radar detection fails if radar occurs in the secondary 80 MHz. When the channel is switched from 80 MHz to 160 MHz, with the primary 80 MHz being non-DFS and the secondary 80 MHz consisting of DFS channels, the radar required flag in the channel switch parameters is set to true. However, when using a reserved channel context, it is not updated in sdata, which disables radar detection in the secondary 80 MHz DFS channels. Update the radar required flag in sdata to fix this issue when using a reserved channel context. Signed-off-by: Ramya Gnanasekar Signed-off-by: Ramasamy Kaliappan Link: https://patch.msgid.link/20250608140324.1687117-1-ramasamy.kaliappan@oss.qualcomm.com Signed-off-by: Johannes Berg commit df56e58104b650bd5d87a93a38d1de9a36593c63 Author: Ting-Ying Li Date: Fri Jun 6 04:34:44 2025 -0500 wifi: brcmfmac: don't allow arp/nd offload to be enabled if ap mode exists Add a check to determine whether arp/nd offload enabling request is allowed. If there is any interface acts as ap mode and is operating, reject the request of arp offload enabling from cfg80211. Signed-off-by: Ting-Ying Li Signed-off-by: Ian Lin Acked-by: Arend van Spriel Link: https://patch.msgid.link/20250606093444.15753-1-ian.lin@infineon.com Signed-off-by: Johannes Berg commit ee1a0c653f9cad7e2634a39f6c530e12edddf0fc Merge: a6a4db166c6565 dad51ea09040f9 Author: Paolo Abeni Date: Tue Jun 24 10:57:45 2025 +0200 Merge branch 'pse-improve-documentation-clarity' Kory Maincent says: ==================== PSE: Improve documentation clarity Thanks to new PSE driver being proposed on the mailinglist figured out there was some unclear documentation, which lead the developer on the wrong path. Clarify these documentation. The changes focus on clarifying the setup_pi_matrix callback behavior and improving device tree binding descriptions, particularly around channel-to-PI mapping relationships that are critical for proper PSE controller integration. Signed-off-by: Kory Maincent ==================== Link: https://patch.msgid.link/20250620-poe_doc_improve-v1-0-96357bb95d52@bootlin.com Signed-off-by: Paolo Abeni commit dad51ea09040f9ac2ea2a0f694e5e3ed5cf167b9 Author: Kory Maincent Date: Fri Jun 20 12:02:40 2025 +0200 net: pse-pd: tps23881: Clarify setup_pi_matrix callback documentation Improve the setup_pi_matrix callback documentation to clarify its purpose and usage. The enhanced description explains that PSE PI devicetree nodes are pre-parsed before this callback is invoked, and drivers should utilize pcdev->pi[x]->pairset[y].np to map PSE controller hardware ports to their corresponding Power Interfaces. This clarification helps driver implementers understand the callback's role in establishing the hardware-to-PI relationship mapping. Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20250620-poe_doc_improve-v1-2-96357bb95d52@bootlin.com Signed-off-by: Paolo Abeni commit 42fa8f17e453ca142d3ed1b2a7b264bf52e8599e Author: Kory Maincent Date: Fri Jun 20 12:02:39 2025 +0200 dt-bindings: pse: tps23881: Clarify channels property description Improve the channels property description to better explain the relationship between physical delivery channels and PSE PI pairsets. The previous description was unclear about how channels are referenced and used in the port matrix mapping. Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20250620-poe_doc_improve-v1-1-96357bb95d52@bootlin.com Signed-off-by: Paolo Abeni commit bdf2ab177e2fca85394fce86629f5e35aa7fa33a Author: Bartosz Golaszewski Date: Thu Jun 19 11:02:41 2025 +0200 USB: serial: cp210x: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Signed-off-by: Johan Hovold commit 83e927b50591cd8ae6f70c8e7401c9a64b3a8484 Author: Bartosz Golaszewski Date: Thu Jun 19 11:02:40 2025 +0200 USB: serial: ftdi_sio: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Signed-off-by: Johan Hovold commit 37c78e3a456fc754e6b9aa7d94365017a33de8f8 Author: Geert Uytterhoeven Date: Thu Jun 12 17:17:35 2025 +0200 dt-bindings: soc: renesas: Document RZ/T2H Evaluation Board part number Signed-off-by: Geert Uytterhoeven Reviewed-by: Lad Prabhakar Link: https://lore.kernel.org/0703ecbc355164e35b90a9fe088438c821f13cd3.1749741263.git.geert+renesas@glider.be commit 338b505d564c1ea04d5ad0495dd25098a475f168 Author: Raag Jadav Date: Tue Jun 10 12:58:09 2025 +0530 clk: renesas: rzv2h: Use devm_kmemdup_array() Convert to use devm_kmemdup_array() which is more robust. Signed-off-by: Raag Jadav Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250610072809.1808464-1-raag.jadav@intel.com Signed-off-by: Geert Uytterhoeven commit 01e8a6d0c39ca0da2b7c80466f55e2959faf1522 Author: Thomas Weißschuh Date: Mon Jun 23 23:48:34 2025 +0200 tools/nolibc: use arm64 name over aarch64 Nolibc generally uses the kernel's architecture names. aarch64 is the only exception. Remove the special case. Nothing changes for the users. Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250623-nolibc-aarch64-arm64-v1-1-a2892f1c1b27@weissschuh.net Signed-off-by: Thomas Weißschuh commit f7c8bb6c3c152495e37288ae4e42f02c231f30f6 Author: Thomas Weißschuh Date: Mon Jun 23 23:29:34 2025 +0200 tools/nolibc: hide headers_check command by default If V=1 is not specified the executed commands should not be printed. Hide the commands by default. Fixes: a6a054c8ad32 ("tools/nolibc: add target to check header usability") Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250623-nolibc-headers-silent-v1-1-f568facf014c@weissschuh.net Signed-off-by: Thomas Weißschuh commit a6a4db166c6565d8143f5b59b9c2c05472bb1726 Merge: cccfe0982208c7 eb4c27edb4d8db Author: Paolo Abeni Date: Tue Jun 24 09:31:48 2025 +0200 Merge branch 'add-support-for-25g-50g-and-100g-to-fbnic' Alexander Duyck says: ==================== Add support for 25G, 50G, and 100G to fbnic The fbnic driver up till now had avoided actually reporting link as the phylink setup only supported up to 40G configurations. This changeset is meant to start addressing that by adding support for 50G and 100G interface types. With that basic support added fbnic can then set those types based on the EEPROM configuration provided by the firmware and then report those speeds out using the information provided via the phylink call for getting the link ksettings. This provides the basic MAC support and enables supporting the speeds as well as configuring flow control. After this I plan to add support for a PHY that will represent the SerDes PHY being used to manage the link as we need a way to indicate link training into phylink to prevent link flaps on the PCS while the SerDes is in training, and then after that I will look at rolling support for our PCS/PMA into the XPCS driver. ==================== Link: https://patch.msgid.link/175028434031.625704.17964815932031774402.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit eb4c27edb4d8dbfbdcc7bc03e0394a0fab8af7d5 Author: Alexander Duyck Date: Wed Jun 18 15:08:09 2025 -0700 fbnic: Add support for setting/getting pause configuration Phylink already handles most of the pieces necessary for configuring autonegotation. With that being the case we can add support for getting/setting pause now by just passing through the ethtool call to the phylink code. Signed-off-by: Alexander Duyck Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/175028448974.625704.14427543910503058114.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit fb9a3bb7f7f23b86d05e94f85e523d7d3f5fa57d Author: Alexander Duyck Date: Wed Jun 18 15:08:02 2025 -0700 fbnic: Add support for reporting link config This change adds some basic support for reporting the current link config to the user via ethtool. Currently the main components reported are the carrier status, link speed, and FEC. For now we are handling the FEC directly as phylink doesn't have support for it. The plan is to work on incorporating FEC support into phylink and eventually adding the ability for us to set the FEC configuration through phylink itself. In addition as we don't yet have SFP or PHY support the listed modes supported are including ones not supported by the media we are attached to. That will hopefully be addressed once we can get the QSFP modules supported. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/175028448275.625704.60592644122010798.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 22780f69fb45d546d2ae32479317049de3621729 Author: Alexander Duyck Date: Wed Jun 18 15:07:55 2025 -0700 fbnic: Set correct supported modes and speeds based on FW setting The fbnic driver was using the XLGMII link mode to enable phylink, however that mode wasn't the correct one to use as the NIC doesn't actually use XLGMII, it is using a combinations of 25G, 50G, and 100G interface modes and configuring those via pins exposed on the PCS, MAC, and PHY interfaces. To more accurately reflect that we should drop the uxe of XGMII and XLGMII and instead use the correct interface types. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/175028447568.625704.17971496887030109107.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 0853d8521bc1ef71bbedab4aadd3b833287fd521 Author: Alexander Duyck Date: Wed Jun 18 15:07:48 2025 -0700 fbnic: Update FW link mode values to represent actual link modes Make it so that the enum we use for the FW values represents actual link modes that will be normally advertised by a link partner. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/175028446893.625704.10103673858068429312.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 16d8fd74dbfca0ea58645cd2fca13be10cae3cdd Author: Daniil Dulov Date: Tue Jun 17 16:56:34 2025 +0300 wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from using already freed skb due to anchor was not killed before freeing such skb. BUG: kernel NULL pointer dereference, address: 0000000000000080 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: Oops: 0000 [#1] SMP NOPTI CPU: 7 UID: 0 PID: 0 Comm: swapper/7 Not tainted 6.15.0 #8 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 RIP: 0010:ieee80211_tx_status_irqsafe+0x21/0xc0 [mac80211] Call Trace: rtl8187_tx_cb+0x116/0x150 [rtl8187] __usb_hcd_giveback_urb+0x9d/0x120 usb_giveback_urb_bh+0xbb/0x140 process_one_work+0x19b/0x3c0 bh_worker+0x1a7/0x210 tasklet_action+0x10/0x30 handle_softirqs+0xf0/0x340 __irq_exit_rcu+0xcd/0xf0 common_interrupt+0x85/0xa0 Tested on RTL8187BvE device. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: c1db52b9d27e ("rtl8187: Use usb anchor facilities to manage urbs") Signed-off-by: Daniil Dulov Reviewed-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250617135634.21760-1-d.dulov@aladdin.ru commit f663a1abf39a16bdd8c5a3eb2d79b27c7d5c211b Author: Alexander Duyck Date: Wed Jun 18 15:07:42 2025 -0700 fbnic: Replace link_mode with AUI The way we were using "link_mode" was really more to describe the interface between the attachment unit interface(s) we were using on the device. Specifically the AUI is describing the modulation and the number of lanes we are using. So we can simplify this by replacing link_mode with aui. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/175028446219.625704.8050098629750896117.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit a6bbbc5bc4c671f6cd791a65743f0c6c83d69edd Author: Alexander Duyck Date: Wed Jun 18 15:07:35 2025 -0700 fbnic: Retire "AUTO" flags and cleanup handling of FW link settings There were several issues in the way we were handling the link info coming from firmware. First is the fact that we were carrying around "AUTO" flags to indicate that we needed to populate the values. We can just drop this and assume that we will always be populating the settings from firmware. With this we can also clean up the masking as the "AUTO" flags were just there to be stripped anyway. Second since we are getting rid of the "AUTO" setting we still need a way to report that the link is not configured. We convert the link_mode "AUTO" to "UNKNOWN" to do this. With this we can avoid reporting link up in the phylink_pcs_get_state call as we will just set link to 0 and return without updating the link speed. This is preferred versus the driver just forcing 50G which makes it harder to recover when the FW does start providing valid settings. With this the plan is to eventually replace the link_mode we use with the interface_mode from phylink for all intents and purposes and have the two be interchangeable. At that point we can convert the FW provided settings over to something closer to link partner settings and give phylink greater control of the interface allowing for user override of the settings and an asynchronous setup of the link versus having to pull early settings from firmware. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/175028445548.625704.1367708155813490215.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 3b180b227eb19fb37714293d601ad49dcc7cf08f Author: Alexander Duyck Date: Wed Jun 18 15:07:28 2025 -0700 fbnic: Do not consider mailbox "initialized" until we have verified fw version In order for us to make use of the information in the PHY we need to verify that the FW capabilities message has been processed. To do so we should poll until the FW version in the capabilities message is at least at the minimum level needed to verify that the FW can support the basic PHY config messages. As such this change adds logic so that we will poll the mailbox until such time as the FW version can be populated with an acceptable value. If it doesn't reach a sufficicient value the mailbox will be considered to have timed out. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/175028444873.625704.10269838393153693403.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit bbb7d478d91ac4d5c288e226cc8744daf3820798 Author: Alexander Duyck Date: Wed Jun 18 15:07:22 2025 -0700 net: phy: Add interface types for 50G and 100G Add support for 802.3cd based interface types 50GBASE-R and 100GBASE-P. This choice in naming is based on section 135 of the 802.3-2022 IEEE Standard. In addition it is adding support for what I am referring to as LAUI which is based on annex 135C of the IEEE Standard, and shares many similarities with the 25/50G consortium. The main difference between the two is that IEEE spec refers to LAUI as the AUI before the RS(544/514) FEC, whereas the 25/50G use this lane and frequency combination after going through RS(528/514), Base-R or no FEC at all. Signed-off-by: Alexander Duyck Link: https://patch.msgid.link/175028444205.625704.4191700324472974116.stgit@ahduyck-xeon-server.home.arpa Signed-off-by: Paolo Abeni commit 1265168759f3b5298a21d2172b017d9e90de647a Author: Dr. David Alan Gilbert Date: Mon Jun 23 00:26:38 2025 +0100 wifi: wlcore: Remove unused wl12xx_cmd_start_fwlog wl12xx_cmd_start_fwlog() was added in 2011 by commit 95dac04f8813 ("wl12xx: Support routing FW logs to the host") but has remained unused. Remove it. (I can see the 'stop' is used, and the 'config' is used, so I assume the 'start' isn't normally needed). Signed-off-by: Dr. David Alan Gilbert Link: https://patch.msgid.link/20250622232638.166283-1-linux@treblig.org Signed-off-by: Johannes Berg commit 6f3ec1828502ec8f9bc6cffc4c50927fe24cbdad Author: Dr. David Alan Gilbert Date: Sun Jun 22 18:28:04 2025 +0100 wl1251: Remove unused wl1251_cmd_* wl1251_cmd_read_memory() and wl1251_cmd_test() last use was removed in 2009 by commit f298c282a523 ("wl1251: remove accidentally added wl1251_netlink.c") Remove them. Signed-off-by: Dr. David Alan Gilbert Link: https://patch.msgid.link/20250622172804.116396-3-linux@treblig.org Signed-off-by: Johannes Berg commit 3c2dd2473d452afd8cd26cbb44e7eb64f8687765 Author: Dr. David Alan Gilbert Date: Sun Jun 22 18:28:03 2025 +0100 wl1251: Remove unused wl1251_acx_rate_policies wl1251_acx_rate_policies() was added in 2009 by commit 0e71bb084adc ("wl1251: remove wl1251_ops") but hasn't been used. Remove it. Signed-off-by: Dr. David Alan Gilbert Link: https://patch.msgid.link/20250622172804.116396-2-linux@treblig.org Signed-off-by: Johannes Berg commit 44c0e191004f0e3aa1bdee3be248be14dbe5b020 Author: Thomas Fourier Date: Mon Jun 16 12:56:30 2025 +0200 wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. The function `_rtl_pci_init_one_rxdesc()` can fail even when the new `skb` is passed because of a DMA mapping error. If it fails, the `skb` is not saved in the rx ringbuffer and thus lost. Compile tested only Signed-off-by: Thomas Fourier Acked-by: Ping-Ke Shih Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616105631.444309-4-fourier.thomas@gmail.com commit 5b4522098bdb22aaa60710e9eba44967d028fe15 Author: Manikandan Muralidharan Date: Wed May 21 11:13:09 2025 +0530 ARM: dts: microchip: sama5d2_icp: rename spi-cs-setup-ns property to spi-cs-setup-delay-ns The naming scheme for delay properties includes "delay" in the name, so renaming spi-cs-setup-ns property to spi-cs-setup-delay-ns. Fixes: 46a8a137d8f6 ("ARM: dts: at91: sama5d2_icp: Set sst26vf064b SPI NOR flash at its maximum frequency") Signed-off-by: Manikandan Muralidharan Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20250521054309.361894-4-manikandan.m@microchip.com Signed-off-by: Claudiu Beznea commit fa664ff76e79cf72d33c62343f6597c796273ba6 Author: Manikandan Muralidharan Date: Wed May 21 11:13:08 2025 +0530 ARM: dts: microchip: sama5d27_wlsom1: rename spi-cs-setup-ns property to spi-cs-setup-delay-ns The naming scheme for delay properties includes "delay" in the name, so renaming spi-cs-setup-ns property to spi-cs-setup-delay-ns. Fixes: 417e58ea41ab ("ARM: dts: at91-sama5d27_wlsom1: Set sst26vf064b SPI NOR flash at its maximum frequency") Signed-off-by: Manikandan Muralidharan Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20250521054309.361894-3-manikandan.m@microchip.com Signed-off-by: Claudiu Beznea commit 71c6dc93e96af8a6a755dc6c0f393fbbf07e7a54 Author: Manikandan Muralidharan Date: Wed May 21 11:13:07 2025 +0530 ARM: dts: microchip: sama5d27_som1: rename spi-cs-setup-ns property to spi-cs-setup-delay-ns The naming scheme for delay properties includes "delay" in the name, so renaming spi-cs-setup-ns property to spi-cs-setup-delay-ns. Fixes: 09ce8651229b ("ARM: dts: at91-sama5d27_som1: Set sst26vf064b SPI NOR flash at its maximum frequency") Signed-off-by: Manikandan Muralidharan Reviewed-by: Alexander Dahl Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20250521054309.361894-2-manikandan.m@microchip.com Signed-off-by: Claudiu Beznea commit 55fae6f3e5723557ade88d8d19f9244cf65bcabf Author: Manikandan Muralidharan Date: Wed May 21 11:13:06 2025 +0530 ARM: dts: microchip: sam9x60ek: rename spi-cs-setup-ns property to spi-cs-setup-delay-ns The naming scheme for delay properties includes "delay" in the name, so renaming spi-cs-setup-ns property to spi-cs-setup-delay-ns. Fixes: 2c0a1faa4da5 ("ARM: dts: at91: sam9x60ek: Set sst26vf064b SPI NOR flash at its maximum frequency") Signed-off-by: Manikandan Muralidharan Reviewed-by: Alexander Dahl Link: https://lore.kernel.org/r/20250521054309.361894-1-manikandan.m@microchip.com Signed-off-by: Claudiu Beznea commit fac62e76b870292648c62522efd1cfb72aefc079 Author: Fabio Estevam Date: Tue Jun 17 11:05:02 2025 -0300 ARM: configs: sama5_defconfig: Select CONFIG_WILC1000_SDIO The at91-sama5d27_wlsom1 SoM has a WILC3000 Wifi chip populated, so select the CONFIG_WILC1000_SDIO by default. Signed-off-by: Fabio Estevam Link: https://lore.kernel.org/r/20250617140502.1042812-2-festevam@gmail.com Signed-off-by: Claudiu Beznea commit c2852b5a0575b0f9de7e6359b9725a5b074778f8 Author: Zong-Zhe Yang Date: Wed Jun 18 20:46:48 2025 +0800 wifi: rtw89: report boottime of receiving beacon and probe response Userspace tools will parse NL80211_BSS_LAST_SEEN_BOOTTIME (if any) for a more accurate timing when a BSS was seen. For example, iw, wpa_supplicant. For beacon and probe response, fill RX boottime_ns in ieee80211_rx_status. And for certain, it shouldn't count the waiting time for the PPDU status, i.e. the possible buffering time of a frame in driver. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250618124649.11436-6-pkshih@realtek.com commit 7e04f01bb94fe61c73cc59f0495c3b6c16a83231 Author: Zong-Zhe Yang Date: Wed Jun 18 20:46:47 2025 +0800 wifi: rtw89: avoid NULL dereference when RX problematic packet on unsupported 6 GHz band With a quite rare chance, RX report might be problematic to make SW think a packet is received on 6 GHz band even if the chip does not support 6 GHz band actually. Since SW won't initialize stuffs for unsupported bands, NULL dereference will happen then in the sequence, rtw89_vif_rx_stats_iter() -> rtw89_core_cancel_6ghz_probe_tx(). So, add a check to avoid it. The following is a crash log for this case. BUG: kernel NULL pointer dereference, address: 0000000000000032 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1907 Comm: irq/131-rtw89_p Tainted: G U 6.6.56-05896-g89f5fb0eb30b #1 (HASH:1400 4) Hardware name: Google Telith/Telith, BIOS Google_Telith.15217.747.0 11/12/2024 RIP: 0010:rtw89_vif_rx_stats_iter+0xd2/0x310 [rtw89_core] Code: 4c 89 7d c8 48 89 55 c0 49 8d 44 24 02 48 89 45 b8 45 31 ff eb 11 41 c6 45 3a 01 41 b7 01 4d 8b 6d 00 4d 39 f5 74 42 8b 43 10 <41> 33 45 32 0f b7 4b 14 66 41 33 4d 36 0f b7 c9 09 c1 74 d8 4d 85 RSP: 0018:ffff9f3080138ca0 EFLAGS: 00010246 RAX: 00000000b8bf5770 RBX: ffff91b5e8c639c0 RCX: 0000000000000011 RDX: ffff91b582de1be8 RSI: 0000000000000000 RDI: ffff91b5e8c639e6 RBP: ffff9f3080138d00 R08: 0000000000000000 R09: 0000000000000000 R10: ffff91b59de70000 R11: ffffffffc069be50 R12: ffff91b5e8c639e4 R13: 0000000000000000 R14: ffff91b5828020b8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff91b8efa40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000032 CR3: 00000002bf838000 CR4: 0000000000750ee0 PKRU: 55555554 Call Trace: ? __die_body+0x68/0xb0 ? page_fault_oops+0x379/0x3e0 ? exc_page_fault+0x4f/0xa0 ? asm_exc_page_fault+0x22/0x30 ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ? rtw89_vif_rx_stats_iter+0xd2/0x310 [rtw89_core (HASH:1400 5)] __iterate_interfaces+0x59/0x110 [mac80211 (HASH:1400 6)] ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ? __pfx_rtw89_vif_rx_stats_iter+0x10/0x10 [rtw89_core (HASH:1400 5)] ieee80211_iterate_active_interfaces_atomic+0x36/0x50 [mac80211 (HASH:1400 6)] rtw89_core_rx_to_mac80211+0xfd/0x1b0 [rtw89_core (HASH:1400 5)] rtw89_core_rx+0x43a/0x980 [rtw89_core (HASH:1400 5)] Fixes: c6aa9a9c4725 ("wifi: rtw89: add RNR support for 6 GHz scan") Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250618124649.11436-5-pkshih@realtek.com commit 640c27b2e0c504e5021b6b7635e3626781a45dba Author: Eric Huang Date: Wed Jun 18 20:46:46 2025 +0800 wifi: rtw89: correct length for IE18/19 PHY report and IE parser Correct the length when parsing with 2nd IE header and the length of IE18/19 PHY status report. These two IE contain PHY OFDM signal information and can be used for debug. Signed-off-by: Eric Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250618124649.11436-4-pkshih@realtek.com commit 8408366f61a7dddc1262ac74662b6238a22c447f Author: Eric Huang Date: Wed Jun 18 20:46:45 2025 +0800 wifi: rtw89: update EDCCA report for subband 40M/80M/sub-20M EDCCA report is obtained from the hardware to display OBSS interference and their respective power levels for each subband. Modify the query settings to improve resolution for debugging purposes. Signed-off-by: Eric Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250618124649.11436-3-pkshih@realtek.com commit 9c5c5a920a7926791c2c44f374c4354b4eda85d3 Author: Kuan-Chung Chen Date: Wed Jun 18 20:46:44 2025 +0800 wifi: rtw89: mac: differentiate mem_page_size by chip generation When debugging or recovering system error recovery (SER), it's necessary to dump internal memory to perform status inspection. Since the memory page size differs between WiFi 6 and 7 chips, define them accordingly. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250618124649.11436-2-pkshih@realtek.com commit c5ef95e29166ac868a96ae6e2c5b6357e3495f10 Author: Ching-Te Ku Date: Mon Jun 16 17:02:52 2025 +0800 wifi: rtw89: coex: Update Wi-Fi/Bluetooth coexistence version to 9.0.0 The version 9 support the WiFi7 related functions. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-12-pkshih@realtek.com commit 206a8f999fcb3ca6cf3c1bf8bd287698ba9692b2 Author: Ching-Te Ku Date: Mon Jun 16 17:02:51 2025 +0800 wifi: rtw89: coex: RTL8852B coexistence Wi-Fi firmware support for v0.29.122.0 Add format version of Wi-Fi firmware commands/events for firmware version v0.29.122.0. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-11-pkshih@realtek.com commit 8ef99ee5d278eed066daeb5d30f06a9872508c13 Author: Ching-Te Ku Date: Mon Jun 16 17:02:50 2025 +0800 wifi: rtw89: coex: Update Bluetooth slot length when Wi-Fi is scanning If Wi-Fi isn't connected to AP, the firmware scan will not switch to operation channel. Bluetooth may not have enough time to TX data. This patch extend the slot to let Bluetooth can TX more to avoid audio lag. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-10-pkshih@realtek.com commit a7feafea4ce80d5fa5284d05d54b4f108d2ab575 Author: Ching-Te Ku Date: Mon Jun 16 17:02:49 2025 +0800 wifi: rtw89: coex: Not to set slot duration to zero to avoid firmware issue If the duration set to zero, Wi-Fi firmware will trigger some unexpected issue when firmware try to enable timer. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-9-pkshih@realtek.com commit d997fb2f8c49feef1a72a7d52d6031a6b847603d Author: Ching-Te Ku Date: Mon Jun 16 17:02:48 2025 +0800 wifi: rtw89: coex: Assign priority table before entering power save When Wi-Fi firmware scan, it will update the priority tables, and if stay at these priority tables then enter power saving will trigger Bluetooth issues. So update the priority before entering power saving. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-8-pkshih@realtek.com commit 3ba79eaee051373234c7e75153a29509fff37ccb Author: Ching-Te Ku Date: Mon Jun 16 17:02:47 2025 +0800 wifi: rtw89: coex: Update scoreboard to avoid Bluetooth re-link fail When platform resume, there will have fail rate when Bluetooth try to re-link. And when Bluetooth is booting up, it will run the ROM code first, then load the firmware code from file. Catch this change and set the mechanism for Bluetooth re-link. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-7-pkshih@realtek.com commit fc9b3028aae826a95376d571917212431b685f66 Author: Ching-Te Ku Date: Mon Jun 16 17:02:46 2025 +0800 wifi: rtw89: coex: Get Bluetooth desired version by WiFi firmware version Because when Wi-Fi/Bluetooth want to communicate with each other, their contact window are their firmware. So the desired version code is more reasonable to change with firmware version. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-6-pkshih@realtek.com commit 43be50111483cf0a6d966194ee8f1127a7168ed1 Author: Ching-Te Ku Date: Mon Jun 16 17:02:45 2025 +0800 wifi: rtw89: coex: RTL8922A add Wi-Fi firmware support for v0.35.71.0 The latest Wi-Fi firmware no feature update with Wi-Fi/Bluetooth coexistence. The patch describe the features support version. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-5-pkshih@realtek.com commit 10a39b9fd7a11591371bc352c16524f1a4d76396 Author: Ching-Te Ku Date: Mon Jun 16 17:02:44 2025 +0800 wifi: rtw89: coex: Query Bluetooth TX power when firmware support Add firmware report to monitor Bluetooth TX power/gain settings, so that we can check it works as expected or not. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-4-pkshih@realtek.com commit 39251e189e4144c935adc8f2c08d7d703c3b8537 Author: Ching-Te Ku Date: Mon Jun 16 17:02:43 2025 +0800 wifi: rtw89: coex: Enable outsource info H2C command The before several patches collect driver information, then this patch packet these information as outsource info and update to firmware by H2C command. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-3-pkshih@realtek.com commit d8643e681825cc5ac233f7a782c8b9406d016166 Author: Ching-Te Ku Date: Mon Jun 16 17:02:42 2025 +0800 wifi: rtw89: coex: Add v1 Bluetooth AFH handshake for WiFi 7 WiFi 7 generation has dual MAC, Coexistence need to find out the 2GHz WiFi connection in the connected links. And assign its channel to Bluetooth to make Bluetooth not to hop into WiFi channel. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250616090252.51098-2-pkshih@realtek.com commit c4c1a9153079242465ce9a3d9753db8324c4b2bb Author: Suraj Kandpal Date: Thu Jun 19 17:03:40 2025 +0530 drm/i915/hdcp: Use HDCP2_STREAM_STATUS instead of HDCP2_AUTH_STREAM From PTL we need to move to using HDCP2_STREAM_STATUS as a WARN_ON to see if written content type info is not the same since HDCP2_AUTH_STREAM is inaccessible to us now. --v2 -Fix commit message [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250619113340.3379200-3-suraj.kandpal@intel.com commit b8c01389b80fafd8ef50287e0820f4c761ffdeb8 Author: Suraj Kandpal Date: Thu Jun 19 17:03:39 2025 +0530 drm/i915/hdcp: Do not use inline intel_de_read Do not use intel_de_read() inline in the WARN_ON functions. While we are at it make the comparision for stream_type u8 to u8. --v2 -Use REG_GENMASK() [Jani] -USe REG_FIELD_GET() [Jani] -Fix the WARN_ON() condition [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250619113340.3379200-2-suraj.kandpal@intel.com commit 981d7f91aeda17424b29f033249f4fa7cd2a7556 Author: Gwendal Grignou Date: Mon Jun 23 14:05:18 2025 -0700 platform/chrome: cros_ec_sensorhub: Retries when a sensor is not ready When the EC/ISH starts, it can take a while for all the sensors to be up and running or declared broken. If the sensor stack return -EBUSY when checking for sensor information, retry up to 50 times. It has been observed 100ms wait time is enough to have valid sensors ready. It can take more time in case a sensor is really broken and is not coming up. Signed-off-by: Gwendal Grignou Link: https://lore.kernel.org/r/20250623210518.306740-1-gwendal@google.com Signed-off-by: Tzung-Bi Shih commit cccfe0982208c72e116462e5431919c88505e890 Author: Jesper Dangaard Brouer Date: Thu Jun 19 18:15:18 2025 +0000 page_pool: import Jesper's page_pool benchmark We frequently consult with Jesper's out-of-tree page_pool benchmark to evaluate page_pool changes. Import the benchmark into the upstream linux kernel tree so that (a) we're all running the same version, (b) pave the way for shared improvements, and (c) maybe one day integrate it with nipa, if possible. Import bench_page_pool_simple from commit 35b1716d0c30 ("Add page_bench06_walk_all"), from this repository: https://github.com/netoptimizer/prototype-kernel.git Changes done during upstreaming: - Fix checkpatch issues. - Remove the tasklet logic not needed. - Move under tools/testing - Create ksft for the benchmark. - Changed slightly how the benchmark gets build. Out of tree, time_bench is built as an independent .ko. Here it is included in bench_page_pool.ko Steps to run: ``` mkdir -p /tmp/run-pp-bench make -C ./tools/testing/selftests/net/bench make -C ./tools/testing/selftests/net/bench install INSTALL_PATH=/tmp/run-pp-bench rsync --delete -avz --progress /tmp/run-pp-bench mina@$SERVER:~/ ssh mina@$SERVER << EOF cd ~/run-pp-bench && sudo ./test_bench_page_pool.sh EOF ``` Note that by default, the Makefile will build the benchmark for the currently installed kernel in /lib/modules/$(shell uname -r)/build. To build against the current tree, do: make KDIR=$(pwd) -C ./tools/testing/selftests/net/bench Output (from Jesper): ``` sudo ./test_bench_page_pool.sh (benchmark dmesg logs snipped) Fast path results: no-softirq-page_pool01 Per elem: 23 cycles(tsc) 6.571 ns ptr_ring results: no-softirq-page_pool02 Per elem: 60 cycles(tsc) 16.862 ns slow path results: no-softirq-page_pool03 Per elem: 265 cycles(tsc) 73.739 ns ``` Output (from me): ``` sudo ./test_bench_page_pool.sh (benchmark dmesg logs snipped) Fast path results: no-softirq-page_pool01 Per elem: 11 cycles(tsc) 4.177 ns ptr_ring results: no-softirq-page_pool02 Per elem: 51 cycles(tsc) 19.117 ns slow path results: no-softirq-page_pool03 Per elem: 168 cycles(tsc) 62.469 ns ``` Results of course will vary based on hardware/kernel/configs, and some variance may be there from run to run due to some noise. Signed-off-by: Mina Almasry Acked-by: Ilias Apalodimas Signed-off-by: Jesper Dangaard Brouer Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250619181519.3102426-1-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 0b20433d8285ca33f5fcdfd04e626ef1227d8a45 Merge: b7ac47616fae71 070e98dd4e2627 Author: Jakub Kicinski Date: Mon Jun 23 18:14:03 2025 -0700 Merge branch 'rework-irq-handling-in-mtk_eth_soc' Frank Wunderlich says: ==================== rework IRQ handling in mtk_eth_soc From: Frank Wunderlich This series introduces named IRQs while keeping the index based way for older dts. Further it makes some cleanup like adding consts for index access and avoids loading first IRQ which was not used on non SHARED_INT SoCs. ==================== Link: https://patch.msgid.link/20250619132125.78368-1-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 070e98dd4e26279280e15db8f37077a001ca1b4c Author: Frank Wunderlich Date: Thu Jun 19 15:21:24 2025 +0200 net: ethernet: mtk_eth_soc: only use legacy mode on missing IRQ name If platform_get_irq_byname returns -ENXIO fall back to legacy (index based) mode, but on other errors function should return this error. Suggested-by: Daniel Golle Signed-off-by: Frank Wunderlich Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250619132125.78368-5-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 9c0feca0a68b33cf012dd835edc6067407597a59 Author: Frank Wunderlich Date: Thu Jun 19 15:21:23 2025 +0200 net: ethernet: mtk_eth_soc: skip first IRQ if not used On SoCs with dedicated RX and TX interrupts (all except MT7621 and MT7628) platform_get_irq() is called for the first IRQ (eth->irq[0]) but it is never used. Skip the first IRQ and reduce the IRQ-count to 2. Signed-off-by: Frank Wunderlich Reviewed-by: Daniel Golle Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250619132125.78368-4-linux@fw-web.de Signed-off-by: Jakub Kicinski commit 4981901009923c8889a635a928d55b8f7f8b31ec Author: Frank Wunderlich Date: Thu Jun 19 15:21:22 2025 +0200 net: ethernet: mtk_eth_soc: add consts for irq index Use consts instead of fixed integers for accessing IRQ array. Signed-off-by: Frank Wunderlich Reviewed-by: Simon Horman Reviewed-by: Daniel Golle Link: https://patch.msgid.link/20250619132125.78368-3-linux@fw-web.de Signed-off-by: Jakub Kicinski commit ee85b483fefbbebe1e6e61c53169f864bbdd8f13 Author: Frank Wunderlich Date: Thu Jun 19 15:21:21 2025 +0200 net: ethernet: mtk_eth_soc: support named IRQs Add named interrupts and keep index based fallback for existing devicetrees. Currently only rx and tx IRQs are defined to be used with mt7988, but later extended with RSS/LRO support. Signed-off-by: Frank Wunderlich Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250619132125.78368-2-linux@fw-web.de Signed-off-by: Jakub Kicinski commit b7ac47616fae7151377cbabb71a286dca71f7a13 Merge: 2f70ba1c0bf043 2baa45432d9a84 Author: Jakub Kicinski Date: Mon Jun 23 17:06:29 2025 -0700 Merge branch 'selftests-drv-net-stats-use-skip-instead-of-xfail' Jakub Kicinski says: ==================== selftests: drv-net: stats: use skip instead of xfail Alex posted support for configuring pause frames in fbnic. This flipped the pause stats test from xfail to fail. Because CI considered xfail as pass it now flags the test as failing. This shouldn't happen. Also we currently report pause and FEC tests as passing on virtio which doesn't make sense. ==================== Link: https://patch.msgid.link/20250620161109.2146242-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2baa45432d9a84d69f6ae247f5d6eb6525572bbe Author: Jakub Kicinski Date: Fri Jun 20 09:11:09 2025 -0700 selftests: drv-net: stats: use skip instead of xfail for unsupported features XFAIL is considered a form of a pass by our CI. For HW devices returning XFAIL for unsupported features is counter-productive because our CI knows not to expect any HW test to pass until it sees 10 passes in a row. If we return xfail the test shows up as pass even if the device doesn't support the feature. netdevsim supports all features necessary for the stats test so there is no concern about running the test in SW mode. Make the test skip rather than xfail if driver doesn't support FEC or pause. Link: https://patch.msgid.link/20250620161109.2146242-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ca6a3faee66e6dc84f3d24fa1b1fa8b0628871e9 Author: Jakub Kicinski Date: Fri Jun 20 09:11:08 2025 -0700 selftests: drv-net: stats: fix pylint issues Small adjustments to make pylint happy. One warning about unused argument remains because the test uses global variables rather than attaching netlink sockets to cfg. Fixing this would be too much of a change for a linter fix commit like this one. Link: https://patch.msgid.link/20250620161109.2146242-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2f70ba1c0bf04349182ae209c8c69e1b71d4c0a8 Merge: 0fd9e5958ebb41 935b67675a9f23 Author: Jakub Kicinski Date: Mon Jun 23 17:05:14 2025 -0700 Merge branch 'net-lockless-sk_sndtimeo-and-sk_rcvtimeo' Eric Dumazet says: ==================== net: lockless sk_sndtimeo and sk_rcvtimeo This series completes the task of making sk->sk_sndtimeo and sk->sk_rcvtimeo lockless. ==================== Link: https://patch.msgid.link/20250620155536.335520-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 935b67675a9f233aa4ac4ae6452b2cc45418d839 Author: Eric Dumazet Date: Fri Jun 20 15:55:36 2025 +0000 net: make sk->sk_rcvtimeo lockless Followup of commit 285975dd6742 ("net: annotate data-races around sk->sk_{rcv|snd}timeo"). Remove lock_sock()/release_sock() from ksmbd_tcp_rcv_timeout() and add READ_ONCE()/WRITE_ONCE() where it is needed. Also SO_RCVTIMEO_OLD and SO_RCVTIMEO_NEW can call sock_set_timeout() without holding the socket lock. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250620155536.335520-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit 3169e36ae14802b01abe4bfa7ec593b0a1af5cc7 Author: Eric Dumazet Date: Fri Jun 20 15:55:35 2025 +0000 net: make sk->sk_sndtimeo lockless Followup of commit 285975dd6742 ("net: annotate data-races around sk->sk_{rcv|snd}timeo"). Remove lock_sock()/release_sock() from sock_set_sndtimeo(), and add READ_ONCE()/WRITE_ONCE() where it is needed. Also SO_SNDTIMEO_OLD and SO_SNDTIMEO_NEW can call sock_set_timeout() without holding the socket lock. Signed-off-by: Eric Dumazet Link: https://patch.msgid.link/20250620155536.335520-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 0fd9e5958ebb41188700b566467a1d9a3ebcdece Merge: b630c781bcf6ff c51da3f7a161c6 Author: Jakub Kicinski Date: Mon Jun 23 17:04:06 2025 -0700 Merge branch 'net-replace-sock_i_uid-with-sk_uid' Eric Dumazet says: ==================== net: replace sock_i_uid() with sk_uid() First patch annotates sk->sk_uid accesses and adds sk_uid() helper. Second patch removes sock_i_uid() in favor of the new helper. ==================== Link: https://patch.msgid.link/20250620133001.4090592-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit c51da3f7a161c6822232be832abdffe47eb55b4c Author: Eric Dumazet Date: Fri Jun 20 13:30:01 2025 +0000 net: remove sock_i_uid() Difference between sock_i_uid() and sk_uid() is that after sock_orphan(), sock_i_uid() returns GLOBAL_ROOT_UID while sk_uid() returns the last cached sk->sk_uid value. None of sock_i_uid() callers care about this. Use sk_uid() which is much faster and inlined. Note that diag/dump users are calling sock_i_ino() and can not see the full benefit yet. Signed-off-by: Eric Dumazet Cc: Lorenzo Colitti Reviewed-by: Maciej Żenczykowski Link: https://patch.msgid.link/20250620133001.4090592-3-edumazet@google.com Signed-off-by: Jakub Kicinski commit e84a4927a404f369c842c19de93b216627fcc690 Author: Eric Dumazet Date: Fri Jun 20 13:30:00 2025 +0000 net: annotate races around sk->sk_uid sk->sk_uid can be read while another thread changes its value in sockfs_setattr(). Add sk_uid(const struct sock *sk) helper to factorize the needed READ_ONCE() annotations, and add corresponding WRITE_ONCE() where needed. Fixes: 86741ec25462 ("net: core: Add a UID field to struct sock.") Signed-off-by: Eric Dumazet Cc: Lorenzo Colitti Reviewed-by: Maciej Żenczykowski Link: https://patch.msgid.link/20250620133001.4090592-2-edumazet@google.com Signed-off-by: Jakub Kicinski commit 68fbc70ece40139380380dce74059afa592846b3 Author: Kuninori Morimoto Date: Thu Jun 12 01:45:03 2025 +0000 ASoC: hisilicon: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ldpxybq9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit ac131c4148bcfa682104628d2174e8e38e03fd25 Author: Kuninori Morimoto Date: Thu Jun 12 01:44:57 2025 +0000 ASoC: uniphier: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Reviewed-by: Masami Hiramatsu (Google) Link: https://patch.msgid.link/87msadybqf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit acc317e5254a739eedf60b53aaf31f69f55e3dc8 Author: Kuninori Morimoto Date: Thu Jun 12 01:44:51 2025 +0000 ASoC: starfive: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87o6utybqk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit cae3cc435db56f2896be1d114952b4da0ac2eda8 Author: Kuninori Morimoto Date: Thu Jun 12 01:44:46 2025 +0000 ASoC: rockchip: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87plf9ybqp.wl-kuninori.morimoto.gx@renesas.com Reviewed-by: Heiko Stuebner Signed-off-by: Mark Brown commit 05016f7e481e3d8d9ea539c05a0e8aba2c4f22ee Author: Kuninori Morimoto Date: Thu Jun 12 01:44:41 2025 +0000 ASoC: mediatek: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Reviewed-by: Matthias Brugger Link: https://patch.msgid.link/87qzzpybqu.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 9c0169922db5cec50a9f470df098dd835477c388 Author: Kuninori Morimoto Date: Thu Jun 12 01:44:35 2025 +0000 ASoC: loongson: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87sek5ybr0.wl-kuninori.morimoto.gx@renesas.com Reviewed-by: Binbin Zhou Signed-off-by: Mark Brown commit 9fad9eb0371b11af1cea3e32cb423913cd10582a Author: Kuninori Morimoto Date: Thu Jun 12 01:44:29 2025 +0000 ASoC: kirkwood: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87tt4lybr6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 0fa7adb638f6c4e8e458056adbcfc028a8085cf8 Author: Kuninori Morimoto Date: Thu Jun 12 01:44:25 2025 +0000 ASoC: samsung: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87v7p1ybrb.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit acc84d15e45393fbbe87758c5fed25d01c83ef92 Author: Kuninori Morimoto Date: Thu Jun 12 01:44:20 2025 +0000 ASoC: generic: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87wm9hybrf.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit a549459a05c0a46aaf6fdf0d21a42ff09cbac91a Author: Kuninori Morimoto Date: Thu Jun 12 01:44:15 2025 +0000 ASoC: renesas: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87y0txybrk.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 41d88bb7546e445806febf45c971b854ba4bc3d7 Author: Kuninori Morimoto Date: Thu Jun 12 01:44:10 2025 +0000 ASoC: xtensa: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87zfedybrp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 69fa5909b3dc8b7968192d110e0d7ec8ef8dfd45 Author: Kuninori Morimoto Date: Thu Jun 12 01:44:05 2025 +0000 ASoC: xilinx: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/871prpzqca.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 099ae845c6b23ea2865a3912be3f51408f62f334 Author: Kuninori Morimoto Date: Thu Jun 12 01:44:00 2025 +0000 ASoC: jz4740: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/8734c5zqcg.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c6ddacab374702ed187359f103a95ad187d16d94 Author: Kuninori Morimoto Date: Thu Jun 12 01:43:55 2025 +0000 ASoC: google: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/874iwlzqck.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8a40e95a1328b8045094b1037c457358c56700cb Author: Kuninori Morimoto Date: Thu Jun 12 01:43:51 2025 +0000 ASoC: cirrus: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Reviewed-by: Alexander Sverdlin Link: https://patch.msgid.link/875xh1zqcp.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 5b8b93e695bb8b5aa0d6432f397e8126faf56f5f Author: Kuninori Morimoto Date: Thu Jun 12 01:43:45 2025 +0000 ASoC: ux500: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/877c1hzqcv.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 41b94a6f2debeb0483d8cda0558df860c0a26969 Author: Kuninori Morimoto Date: Thu Jun 12 01:43:40 2025 +0000 ASoC: tegra: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Reviewed-by: Jon Hunter Link: https://patch.msgid.link/878qlxzqd0.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c0262c187a0b8473169156f4cf3aad0f41b08d00 Author: Kuninori Morimoto Date: Thu Jun 12 01:43:35 2025 +0000 ASoC: sunxi: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Acked-by: Chen-Yu Tsai Link: https://patch.msgid.link/87a56dzqd4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 7798775a033e7d19270e20bcd105c29e373b8bad Author: Kuninori Morimoto Date: Thu Jun 12 01:43:30 2025 +0000 ASoC: spear: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87bjqtzqd9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit c153c508e5b41405db3ac9ce32169af6961aa878 Author: Kuninori Morimoto Date: Thu Jun 12 01:43:26 2025 +0000 ASoC: intel: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87cyb9zqde.wl-kuninori.morimoto.gx@renesas.com Acked-by: Peter Ujfalusi Signed-off-by: Mark Brown commit 4f30f84feb7757f09aeecba120a05e1145b8f264 Author: Kuninori Morimoto Date: Thu Jun 12 01:43:21 2025 +0000 ASoC: atmel: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ecvpzqdi.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 68a8fd461a564f8b5957944f4b056f44de5dfabc Author: Kuninori Morimoto Date: Thu Jun 12 01:43:16 2025 +0000 ASoC: apple: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87frg5zqdo.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 58e490935f20e38a4de156f705e89f7f13838aad Author: Kuninori Morimoto Date: Thu Jun 12 01:43:11 2025 +0000 ASoC: meson: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87h60lzqds.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8ada023e996ca7131d9a42b2dd915e1966870d4a Author: Kuninori Morimoto Date: Thu Jun 12 01:43:07 2025 +0000 ASoC: qcom: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ikl1zqdx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 1d9ac30a8df639169ab97576cb5b1d48bb403e8b Author: Kuninori Morimoto Date: Thu Jun 12 01:43:02 2025 +0000 ASoC: sprd: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87jz5hzqe1.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 36e6420440db119943b28b84523b8e0e77cae08b Author: Kuninori Morimoto Date: Thu Jun 12 01:42:58 2025 +0000 ASoC: sdca: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87ldpxzqe5.wl-kuninori.morimoto.gx@renesas.com Reviewed-by: Charles Keepax Signed-off-by: Mark Brown commit 335c898312f3b2366123c10b7bca56ca8cea1781 Author: Kuninori Morimoto Date: Thu Jun 12 01:42:53 2025 +0000 ASoC: au1x: Standardize ASoC menu use "ASoC support for xxxx" menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87msadzqea.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 3b2a8a3c5769e2e02bf6f2cd7444847056087984 Author: Kuninori Morimoto Date: Thu Jun 12 01:42:49 2025 +0000 ASoC: sof: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87o6utzqef.wl-kuninori.morimoto.gx@renesas.com Acked-by: Peter Ujfalusi Signed-off-by: Mark Brown commit 53696514d72fab66025afca531a1668bee635abf Author: Kuninori Morimoto Date: Thu Jun 12 01:42:43 2025 +0000 ASoC: stm: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87plf9zqek.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit afd1bff53b48d1431fefe57887017207c3df6bf5 Author: Kuninori Morimoto Date: Thu Jun 12 01:42:38 2025 +0000 ASoC: sti: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87qzzpzqep.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit bcd02da3721967c006c90b1b58536d34765283a5 Author: Kuninori Morimoto Date: Thu Jun 12 01:42:33 2025 +0000 ASoC: pxa: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87sek5zqeu.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 01f7d179a7348c252c5f26e1521bc1df81fadcd2 Author: Kuninori Morimoto Date: Thu Jun 12 01:42:28 2025 +0000 ASoC: mxs: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87tt4lzqez.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit b13f7eef9ff82e0163c6af8ac262fc2607161390 Author: Kuninori Morimoto Date: Thu Jun 12 01:42:23 2025 +0000 ASoC: img: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87v7p1zqf4.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 71951375b0ea03671a1752991cbeab0b9bc3f365 Author: Kuninori Morimoto Date: Thu Jun 12 01:42:18 2025 +0000 ASoC: fsl: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87wm9hzqf9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit bb0b8820527eb32b5f9cc1405e855a33eca2d83b Author: Kuninori Morimoto Date: Thu Jun 12 01:42:13 2025 +0000 ASoC: dwc: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87y0txzqfe.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit da65de541568cb9beb0feaa302a91d6af2f0258a Author: Kuninori Morimoto Date: Thu Jun 12 01:42:08 2025 +0000 ASoC: bcm: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87zfedzqfj.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6895deb5f25f92a9a8f7cf52977b0e8ef18baebb Author: Kuninori Morimoto Date: Thu Jun 12 01:42:00 2025 +0000 ASoC: amd: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Reviewed-by: Vijendar Mukunda Link: https://patch.msgid.link/871prp20t3.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 652dd81c7a66843db0afbe0866537492c965a3cc Author: Kuninori Morimoto Date: Thu Jun 12 01:41:54 2025 +0000 ASoC: adi: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/8734c520t9.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6469fb5c8b2dc88c3840eced9ccdd3ddc97213b2 Author: Kuninori Morimoto Date: Thu Jun 12 01:41:46 2025 +0000 ASoC: ti: Standardize ASoC menu Current Kconfig menu at [ALSA for SoC audio support] has no rules. So, some venders are using menu style, some venders are listed each drivers on top page, etc. It is difficult to find target vender and/or drivers because it is very random. Let's standardize ASoC menu Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/874iwl20th.wl-kuninori.morimoto.gx@renesas.com Acked-by: Peter Ujfalusi Signed-off-by: Mark Brown commit b630c781bcf6ff87657146661816d0d30a902139 Author: Arnd Bergmann Date: Fri Jun 20 13:22:39 2025 +0200 caif: reduce stack size, again I tried to fix the stack usage in this function a couple of years ago, but there is still a problem with the latest gcc versions in some configurations: net/caif/cfctrl.c:553:1: error: the frame size of 1296 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] Reduce this once again, with a separate cfctrl_link_setup() function that holds the bulk of all the local variables. It also turns out that the param[] array that takes up a large portion of the stack is write-only and can be left out here. Fixes: ce6289661b14 ("caif: reduce stack size with KASAN") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250620112244.3425554-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit 7df6c0245595871500758c4cfa6052081e6687c9 Author: Arnd Bergmann Date: Fri Jun 20 13:19:04 2025 +0200 lib: test_objagg: split test_hints_case() into two functions With sanitizers enabled, this function uses a lot of stack, causing a harmless warning: lib/test_objagg.c: In function 'test_hints_case.constprop': lib/test_objagg.c:994:1: error: the frame size of 1440 bytes is larger than 1408 bytes [-Werror=frame-larger-than=] Most of this is from the two 'struct world' structures. Since most of the work in this function is duplicated for the two, split it up into separate functions that each use one of them. The combined stack usage is still the same here, but there is no warning any more, and the code is still safe because of the known call chain. Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250620111907.3395296-1-arnd@kernel.org Signed-off-by: Jakub Kicinski commit b04202d6065cba5dfd51fb9866400b25573eac67 Author: Pranav Tyagi Date: Fri Jun 20 16:06:53 2025 +0530 net/sched: replace strncpy with strscpy Replace the deprecated strncpy() with the two-argument version of strscpy() as the destination is an array and buffer should be NUL-terminated. Signed-off-by: Pranav Tyagi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250620103653.6957-1-pranav.tyagi03@gmail.com Signed-off-by: Jakub Kicinski commit ae2402bf882b40fb9cf3b6a5c9ff0e6c7a9ef842 Author: Pranav Tyagi Date: Fri Jun 20 15:55:59 2025 +0530 net/smc: replace strncpy with strscpy Replace the deprecated strncpy() with two-argument version of strscpy() as the destination is an array and should be NUL-terminated. Signed-off-by: Pranav Tyagi Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250620102559.6365-1-pranav.tyagi03@gmail.com Signed-off-by: Jakub Kicinski commit bf92ffb0d332f7b91e689cb24b0840607802329d Author: Frank Li Date: Wed Jun 18 14:44:16 2025 -0400 dt-bindings: net: convert qca,qca7000.txt yaml format Convert qca,qca7000.txt yaml format. Additional changes: - add refs: spi-peripheral-props.yaml, serial-peripheral-props.yaml and ethernet-controller.yaml. - simple spi and uart node name. - use low case for mac address in examples. - add check reg choose spi-peripheral-props.yaml or spi-peripheral-props.yaml. Reviewed-by: Jacob Keller Reviewed-by: Krzysztof Kozlowski Signed-off-by: Frank Li Link: https://patch.msgid.link/20250618184417.2169745-1-Frank.Li@nxp.com Signed-off-by: Jakub Kicinski commit 8eb22dcfe50e130158c088b16948660edc256e7a Author: Frank Li Date: Fri Apr 11 11:34:54 2025 -0400 Revert "ARM: dts: Update pcie ranges for dra7" This reverts commit c761028ef5e27f477fe14d2b134164c584fc21ee. The commit being reverted updated the "ranges" property for the sake of readability. However, this change is no longer appropriate due to the following reasons: - On many SoCs, the PCIe parent bus translates CPU addresses to different values before passing them to the PCIe controller. - The reverted commit introduced a fake address translation, which violates the fundamental DTS principle: the device tree should reflect actual hardware behavior. Reverting this change prepares for the cleanup of the driver's cpu_addr_fixup() hook. Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250411153454.3258098-1-Frank.Li@nxp.com Signed-off-by: Kevin Hilman commit dccb920a08382a0ee8c9d6f0062da2a726a10e9f Author: Krzysztof Kozlowski Date: Wed May 14 14:51:59 2025 +0200 ARM: dts: omap: am335x: Use non-deprecated rts-gpios The 'rts-gpio' (without trailing 's') is deprecated in favor of 'rts-gpios'. Kernel supports both variants, so switch the DTS to preferred one. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250514125158.56285-2-krzysztof.kozlowski@linaro.org Signed-off-by: Kevin Hilman commit 0303584766b7bdb6564c7e8f13e0b59b6ef44984 Author: Sai Vishnu M Date: Mon Jun 2 22:19:24 2025 +0530 rust: io: avoid mentioning private fields in `IoMem` Removed reference to internal variables in the comment of `IoMem` This avoids using private variable names in public documentation. Suggested-by: Miguel Ojeda Link: https://github.com/Rust-for-Linux/linux/issues/1167 Signed-off-by: Sai Vishnu M Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250602164923.48893-2-saivishnu725@gmail.com [ Reworded title and adjusted tags. - Miguel ] Signed-off-by: Miguel Ojeda commit b6985083be1deb1f5fa14d160265f57d9ccb42a1 Author: Viresh Kumar Date: Tue Jun 10 14:33:00 2025 +0530 rust: Use consistent "# Examples" heading style in rustdoc Use a consistent `# Examples` heading in rustdoc across the codebase. Some modules previously used `## Examples` (even when they should be available as top-level headers), while others used `# Example`, which deviates from the preferred `# Examples` style. Suggested-by: Miguel Ojeda Signed-off-by: Viresh Kumar Acked-by: Benno Lossin Link: https://lore.kernel.org/r/ddd5ce0ac20c99a72a4f1e4322d3de3911056922.1749545815.git.viresh.kumar@linaro.org Signed-off-by: Miguel Ojeda commit bfb9e46b5bff33ebaac49cceb27256caceddeee5 Author: Guilherme Giacomo Simoes Date: Mon Jun 9 09:22:00 2025 -0300 rust: macros: remove `module!`'s deprecated `author` key Commit 38559da6afb2 ("rust: module: introduce `authors` key") introduced a new `authors` key to support multiple module authors, while keeping the old `author` key for backward compatibility. Now that most in-tree modules have migrated to `authors`, remove: 1. The deprecated `author` key support from the module macro 2. Legacy `author` entries from remaining modules Signed-off-by: Guilherme Giacomo Simoes Acked-by: Andreas Hindborg Reviewed-by: Benno Lossin Acked-by: Danilo Krummrich Acked-by: Viresh Kumar Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250609122200.179307-1-trintaeoitogc@gmail.com [ Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit b61b0092eaf22ef34936516d2e7181bb9cee25ac Author: Albin Babu Varghese Date: Tue May 27 16:49:28 2025 -0400 rust: list: replace unwrap() with ? in doctest examples Using `unwrap()` in kernel doctests can cause panics on error and may give newcomers the mistaken impression that panicking is acceptable in kernel code. Replace all `.unwrap()` calls in `kernel::list` examples with `.ok_or(EINVAL)?` so that errors are properly propagated. Suggested-by: Miguel Ojeda Link: https://github.com/Rust-for-Linux/linux/issues/1164 Reviewed-by: Benno Lossin Signed-off-by: Albin Babu Varghese Reviewed-by: Alice Ryhl Reviewed-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250527204928.5117-1-albinbabuvarghese20@gmail.com [ Reworded slightly. - Miguel ] Signed-off-by: Miguel Ojeda commit 5d4ffc531a642177362571ef946d950d37ff1259 Author: Jesung Yang Date: Wed May 28 17:49:55 2025 +0000 rust: kunit: use crate-level mapping for `c_void` Remove `use core::ffi::c_void`, which shadows `kernel::ffi::c_void` brought in via `use crate::prelude::*`, to maintain consistency and centralize the abstraction. Since `kernel::ffi::c_void` is a straightforward re-export of `core::ffi::c_void`, both are functionally equivalent. However, using `kernel::ffi::c_void` improves consistency across the kernel's Rust code and provides a unified reference point in case the definition ever needs to change, even if such a change is unlikely. Reviewed-by: Benno Lossin Link: https://rust-for-linux.zulipchat.com/#narrow/channel/288089/topic/x/near/520452733 Signed-off-by: Jesung Yang Link: https://lore.kernel.org/r/20250528174953.2948570-1-y.j3ms.n@gmail.com Signed-off-by: Miguel Ojeda commit 1256eb42db5d1635f4c6da5b1b58db0b53320883 Merge: 5fc2c383125c2b 8f9cf02c885283 Author: Mark Brown Date: Mon Jun 23 23:30:49 2025 +0100 spi: microchip-core-qspi: Add regular transfers Merge series from Conor Dooley : This is a v2 of a patchset I sent about this time last year, adding the regular transfer_one_message op to the microchip-core-qspi driver. In that v1 Mark expressed his dislike for that op, so v2 is using prepare/unprepare/transfer_one instead. The unprepare implementation still contains the 750 us delay that the driver had back in v1. I've heard a suggestion internally as to why this is needed, but it was unsubstantiated, so I still have no justification for it. I held off on sending a v2 because of a lack of explanation for the delay, but I don't wanna hold off forever for something I might never understand. commit 39868685c2a94a70762bc6d77dc81d781d05bff5 Author: Zhiguo Niu Date: Fri Jun 13 09:50:45 2025 +0800 f2fs: compress: fix UAF of f2fs_inode_info in f2fs_free_dic The decompress_io_ctx may be released asynchronously after I/O completion. If this file is deleted immediately after read, and the kworker of processing post_read_wq has not been executed yet due to high workloads, It is possible that the inode(f2fs_inode_info) is evicted and freed before it is used f2fs_free_dic. The UAF case as below: Thread A Thread B - f2fs_decompress_end_io - f2fs_put_dic - queue_work add free_dic work to post_read_wq - do_unlink - iput - evict - call_rcu This file is deleted after read. Thread C kworker to process post_read_wq - rcu_do_batch - f2fs_free_inode - kmem_cache_free inode is freed by rcu - process_scheduled_works - f2fs_late_free_dic - f2fs_free_dic - f2fs_release_decomp_mem read (dic->inode)->i_compress_algorithm This patch store compress_algorithm and sbi in dic to avoid inode UAF. In addition, the previous solution is deprecated in [1] may cause system hang. [1] https://lore.kernel.org/all/c36ab955-c8db-4a8b-a9d0-f07b5f426c3f@kernel.org Cc: Daeho Jeong Fixes: bff139b49d9f ("f2fs: handle decompress only post processing in softirq") Signed-off-by: Zhiguo Niu Signed-off-by: Baocong Liu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8e2a9b656474d67c55010f2c003ea2cf889a19ff Author: Zhiguo Niu Date: Fri Jun 13 09:50:44 2025 +0800 f2fs: compress: change the first parameter of page_array_{alloc,free} to sbi No logic changes, just cleanup and prepare for fixing the UAF issue in f2fs_free_dic. Signed-off-by: Zhiguo Niu Signed-off-by: Baocong Liu Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 59c1c89e9ba8cefff05aa982dd9e6719f25e8ec5 Author: Chao Yu Date: Fri Jun 13 13:51:09 2025 +0800 f2fs: introduce reserved_pin_section sysfs entry This patch introduces /sys/fs/f2fs//reserved_pin_section for tuning @needed parameter of has_not_enough_free_secs(), if we configure it w/ zero, it can avoid f2fs_gc() as much as possible while fallocating on pinned file. Signed-off-by: Chao Yu Reviewed-by: wangzijie Signed-off-by: Jaegeuk Kim commit 90d5c9ba3ed91950f1546bf123a7a57cd958b452 Author: Chao Yu Date: Wed Jun 11 16:42:18 2025 +0800 f2fs: fix to avoid invalid wait context issue ============================= [ BUG: Invalid wait context ] 6.13.0-rc1 #84 Tainted: G O ----------------------------- cat/56160 is trying to lock: ffff888105c86648 (&cprc->stat_lock){+.+.}-{3:3}, at: update_general_status+0x32a/0x8c0 [f2fs] other info that might help us debug this: context-{5:5} 2 locks held by cat/56160: #0: ffff88810a002a98 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0x56/0x4c0 #1: ffffffffa0462638 (f2fs_stat_lock){....}-{2:2}, at: stat_show+0x29/0x1020 [f2fs] stack backtrace: CPU: 0 UID: 0 PID: 56160 Comm: cat Tainted: G O 6.13.0-rc1 #84 Tainted: [O]=OOT_MODULE Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006 Call Trace: dump_stack_lvl+0x88/0xd0 dump_stack+0x14/0x20 __lock_acquire+0x8d4/0xbb0 lock_acquire+0xd6/0x300 _raw_spin_lock+0x38/0x50 update_general_status+0x32a/0x8c0 [f2fs] stat_show+0x50/0x1020 [f2fs] seq_read_iter+0x116/0x4c0 seq_read+0xfa/0x130 full_proxy_read+0x66/0x90 vfs_read+0xc4/0x350 ksys_read+0x74/0xf0 __x64_sys_read+0x1d/0x20 x64_sys_call+0x17d9/0x1b80 do_syscall_64+0x68/0x130 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x7f2ca53147e2 - seq_read - stat_show - raw_spin_lock_irqsave(&f2fs_stat_lock, flags) : f2fs_stat_lock is raw_spinlock_t type variable - update_general_status - spin_lock(&sbi->cprc_info.stat_lock); : stat_lock is spinlock_t type variable The root cause is the lock order is incorrect [1], we should not acquire spinlock_t lock after raw_spinlock_t lock, as if CONFIG_PREEMPT_LOCK is on, spinlock_t is implemented based on rtmutex, which can sleep after holding the lock. To fix this issue, let's use change f2fs_stat_lock lock type from raw_spinlock_t to spinlock_t, it's safe due to: - we don't need to use raw version of spinlock as the path is not performance sensitive. - we don't need to use irqsave version of spinlock as it won't be used in irq context. Quoted from [1]: "Extend lockdep to validate lock wait-type context. The current wait-types are: LD_WAIT_FREE, /* wait free, rcu etc.. */ LD_WAIT_SPIN, /* spin loops, raw_spinlock_t etc.. */ LD_WAIT_CONFIG, /* CONFIG_PREEMPT_LOCK, spinlock_t etc.. */ LD_WAIT_SLEEP, /* sleeping locks, mutex_t etc.. */ Where lockdep validates that the current lock (the one being acquired) fits in the current wait-context (as generated by the held stack). This ensures that there is no attempt to acquire mutexes while holding spinlocks, to acquire spinlocks while holding raw_spinlocks and so on. In other words, its a more fancy might_sleep()." [1] https://lore.kernel.org/all/20200321113242.427089655@linutronix.de Fixes: 98237fcda4a2 ("f2fs: use spin_lock to avoid hang") Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 554d9b7242a73d701ce121ac81bb578a3fca538e Author: Sheng Yong Date: Sat Jun 7 14:41:16 2025 +0800 f2fs: fix bio memleak when committing super block When committing new super block, bio is allocated but not freed, and kmemleak complains: unreferenced object 0xffff88801d185600 (size 192): comm "kworker/3:2", pid 128, jiffies 4298624992 hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 80 67 c3 00 81 88 ff ff .........g...... 01 08 06 00 00 00 00 00 00 00 00 00 01 00 00 00 ................ backtrace (crc 650ecdb1): kmem_cache_alloc_noprof+0x3a9/0x460 mempool_alloc_noprof+0x12f/0x310 bio_alloc_bioset+0x1e2/0x7e0 __f2fs_commit_super+0xe0/0x370 f2fs_commit_super+0x4ed/0x8c0 f2fs_record_error_work+0xc7/0x190 process_one_work+0x7db/0x1970 worker_thread+0x518/0xea0 kthread+0x359/0x690 ret_from_fork+0x34/0x70 ret_from_fork_asm+0x1a/0x30 The issue can be reproduced by: mount /dev/vda /mnt i=0 while :; do echo '[h]abc' > /sys/fs/f2fs/vda/extension_list echo '[h]!abc' > /sys/fs/f2fs/vda/extension_list echo scan > /sys/kernel/debug/kmemleak dmesg | grep "new suspected memory leaks" [ $? -eq 0 ] && break i=$((i + 1)) echo "$i" done umount /mnt Fixes: 5bcde4557862 ("f2fs: get rid of buffer_head use") Signed-off-by: Sheng Yong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 70b6e8500431ca8bd8d1471ae721d61fc2acc844 Author: Chao Yu Date: Tue Jun 10 11:13:15 2025 +0800 f2fs: do sanity check on fio.new_blkaddr in do_write_page() F2FS-fs (dm-55): access invalid blkaddr:972878540 Call trace: dump_backtrace+0xec/0x128 show_stack+0x18/0x28 dump_stack_lvl+0x40/0x88 dump_stack+0x18/0x24 __f2fs_is_valid_blkaddr+0x360/0x3b4 f2fs_is_valid_blkaddr+0x10/0x20 f2fs_get_node_info+0x21c/0x60c __write_node_page+0x15c/0x734 f2fs_sync_node_pages+0x4f8/0x700 f2fs_write_checkpoint+0x4a8/0x99c __checkpoint_and_complete_reqs+0x7c/0x20c issue_checkpoint_thread+0x4c/0xd8 kthread+0x11c/0x1b0 ret_from_fork+0x10/0x20 If f2fs_allocate_data_block() fails, we may update nat.blkaddr w/ uninitialized fio.new_blkaddr. - __write_node_folio - f2fs_do_write_node_page - do_write_page - f2fs_allocate_data_block : once it fails, it may not allocate new blkaddr - set_node_addr : update w/ uninitialized fio.new_blkaddr variable I've checked all error paths in f2fs_allocate_data_block(), it should be tagged w/ CP_ERROR_FLAG. In addition, f2fs_allocate_data_block() succeeds, fio.new_blkaddr should be valid. Let's add f2fs_bug_on() to check above two conditions to detect any potential bugs. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 1773f63d108b1b9b9d053d8c95f8300c556f93b8 Author: Chao Yu Date: Mon Jun 9 15:27:12 2025 +0800 f2fs: handle nat.blkaddr corruption in f2fs_get_node_info() F2FS-fs (dm-55): access invalid blkaddr:972878540 Call trace: dump_backtrace+0xec/0x128 show_stack+0x18/0x28 dump_stack_lvl+0x40/0x88 dump_stack+0x18/0x24 __f2fs_is_valid_blkaddr+0x360/0x3b4 f2fs_is_valid_blkaddr+0x10/0x20 f2fs_get_node_info+0x21c/0x60c __write_node_page+0x15c/0x734 f2fs_sync_node_pages+0x4f8/0x700 f2fs_write_checkpoint+0x4a8/0x99c __checkpoint_and_complete_reqs+0x7c/0x20c issue_checkpoint_thread+0x4c/0xd8 kthread+0x11c/0x1b0 ret_from_fork+0x10/0x20 If nat.blkaddr is corrupted, during checkpoint, f2fs_sync_node_pages() will loop to flush node page w/ corrupted nat.blkaddr. Although, it tags SBI_NEED_FSCK, checkpoint can not persist it due to deadloop. Let's call f2fs_handle_error(, ERROR_INCONSISTENT_NAT) to record such error into superblock, it expects fsck can detect the error and repair inconsistent nat.blkaddr after device reboot. Note that, let's add sanity check in f2fs_get_node_info() to detect in-memory nat.blkaddr inconsistency, but only if CONFIG_F2FS_CHECK_FS is enabled. Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 8142daf8a53806689186ee255cc02f89af7f8890 Author: Daeho Jeong Date: Fri Jun 6 11:49:04 2025 -0700 f2fs: turn off one_time when forcibly set to foreground GC one_time mode is only for background GC. So, we need to set it back to false when foreground GC is enforced. Fixes: 9748c2ddea4a ("f2fs: do FG_GC when GC boosting is required for zoned devices") Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit 24bf3ee37fb8ed736094247133d00cb2c3bab3ce Author: Daeho Jeong Date: Thu May 29 15:25:32 2025 -0700 f2fs: make sure zoned device GC to use FG_GC in shortage of free section We already use FG_GC when we have free sections under gc_boost_zoned_gc_percent. So, let's make it consistent. Signed-off-by: Daeho Jeong Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim commit fb1cacdbacd905d2099656458082482c6d1bc0c0 Author: Thomas Weißschuh Date: Mon Jun 23 23:34:32 2025 +0200 selftests/nolibc: avoid GCC 15 -Wunterminated-string-initialization On GCC 15 the following warnings is emitted: nolibc-test.c: In function ‘run_stdlib’: nolibc-test.c:1416:32: warning: initializer-string for array of ‘char’ truncates NUL terminator but destination lacks ‘nonstring’ attribute (11 chars into 10 available) [-Wunterminated-string-initialization] 1416 | char buf[10] = "test123456"; | ^~~~~~~~~~~~ Increase the size of buf to avoid the warning. It would also be possible to use __attribute__((nonstring)) but that would require some ifdeffery to work with older compilers. Fixes: 1063649cf531 ("selftests/nolibc: Add tests for strlcat() and strlcpy()") Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250623-nolibc-nonstring-v1-1-11282204766a@weissschuh.net Signed-off-by: Thomas Weißschuh commit eb135311083100b6590a7545618cd9760d896a86 Author: Thomas Weißschuh Date: Fri Jun 20 23:39:33 2025 +0200 selftests/nolibc: integrate with kselftests Hook up nolibc-test with the kselftests framework. This enables CI systems and developers to easily execute the tests. While nolibc-test does not emit KTAP output itself that is not a problem, as the kselftest executor will wrap the output in KTAP. Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250620-nolibc-selftests-v1-4-f6b2ce7c5071@weissschuh.net Signed-off-by: Thomas Weißschuh commit 3adf4f90c9bda3d875ce05721ee4bb91c552faa5 Author: Thomas Weißschuh Date: Fri Jun 20 23:39:32 2025 +0200 selftests/nolibc: rename Makefile The nolibc tests are not real kselftests, they work differently and provide a different interface. Users trying to use them like real selftests may be confused and the tests are not executed by CI systems. To make space for an integration with the kselftest framework, move the custom tests out of the way. The custom tests are still useful to keep as they provide functionality not provided by kselftests. Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250620-nolibc-selftests-v1-3-f6b2ce7c5071@weissschuh.net Signed-off-by: Thomas Weißschuh commit a09db6afe292cba6ccb0966d4266b78b1a8a8055 Author: Thomas Weißschuh Date: Fri Jun 20 23:39:31 2025 +0200 selftests/nolibc: split out CFLAGS logic Some upcoming changes will reuse the CFLAGS. Split the computation into a reusable Makefile. Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250620-nolibc-selftests-v1-2-f6b2ce7c5071@weissschuh.net Signed-off-by: Thomas Weißschuh commit 54c18a8f07aa9dbb66b8b194dd38d2bc55121bfe Author: Thomas Weißschuh Date: Fri Jun 20 23:39:30 2025 +0200 selftests/nolibc: drop implicit defconfig executions Commit d7d271ec30dd ("selftests/nolibc: execute defconfig before other targets") accidentally introduced implicit executions of the defconfig target. These executions were unintentional and come from a misunderstanding of ordering dependencies. Drop the dependencies again. Reported-by: Mark Brown Closes: https://lore.kernel.org/all/3d5128b9-b4b6-4a8e-94ce-ea5ff4ea655b@sirena.org.uk/ Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250620-nolibc-selftests-v1-1-f6b2ce7c5071@weissschuh.net Signed-off-by: Thomas Weißschuh commit 8f9cf02c8852837923f1cdacfcc92e138513325c Author: Cyril Jean Date: Fri Jun 20 14:28:26 2025 +0100 spi: microchip-core-qspi: Add regular transfers The driver for CoreQSPI only supports memory operations at present, so add support for regular transfers so that the SD card slot and ADC on the BeagleV Fire can be used. Signed-off-by: Cyril Jean Co-developed-by: Conor Dooley Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20250620-splice-shelter-310771564886@spud Signed-off-by: Mark Brown commit 75ca45c472dac206df2ebbc1c0f1f9c3bbdace50 Author: Conor Dooley Date: Fri Jun 20 14:28:25 2025 +0100 spi: microchip-core-qspi: remove unused param from mchp_coreqspi_write_op() "word" is unused in mchp_coreqspi_write_op(), so delete it. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20250620-starry-excusably-25e6be957d9d@spud Signed-off-by: Mark Brown commit 76f03ce1c6f22805ecf689b1f3ecfb56582eddd5 Author: Conor Dooley Date: Fri Jun 20 14:28:24 2025 +0100 spi: microchip-core-qspi: set min_speed_hz during probe The controller's minimum possible bus clock is 1/30 the rate of the input clock. Naively set the minimum bus clock speed the controller is capable of during probe, assuming that the rate will never reduce further. Signed-off-by: Conor Dooley Link: https://patch.msgid.link/20250620-drained-widen-ac311bd5f172@spud Signed-off-by: Mark Brown commit d375b70a0f47a032813be33493c97133cc080f74 Author: Lukas Bulwahn Date: Mon Jun 23 10:12:40 2025 +0200 MAINTAINERS: rectify file entry in QUALCOMM SMB CHARGER DRIVER Commit 4deeea4b0741 ("MAINTAINERS: add myself as smbx charger driver maintainer") adds the section QUALCOMM SMB CHARGER DRIVER in MAINTAINERS, including a file entry pointing to qcom_smbx_charger.c. Within the same patch series, the commit 5ec53bcc7fce ("power: supply: pmi8998_charger: rename to qcom_smbx") renames qcom_pmi8998_charger.c to qcom_smbx.c and not to qcom_smbx_charger.c, though. Note that the commit message clearly indicates the intentional removal of the "_charger" suffix. Refer to the intended file. Signed-off-by: Lukas Bulwahn Acked-by: Casey Connolly Link: https://lore.kernel.org/r/20250623081240.149446-1-lukas.bulwahn@redhat.com Signed-off-by: Sebastian Reichel commit 96c16c59b705d02c29f6bef54858b5da78c3fb13 Author: Kory Maincent Date: Thu Jun 19 18:25:47 2025 +0200 ethtool: pse-pd: Add missing linux/export.h include Fix missing linux/export.h header include in net/ethtool/pse-pd.c to resolve build warning reported by the kernel test robot. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506200024.T3O0FWeR-lkp@intel.com/ Signed-off-by: Kory Maincent Link: https://patch.msgid.link/20250619162547.1989468-1-kory.maincent@bootlin.com Signed-off-by: Jakub Kicinski commit 3606620b316c29e3de8ff87b40828c722086a9c9 Author: Alexandre Courbot Date: Thu Jun 19 22:24:08 2025 +0900 gpu: nova-core: update and annotate TODO list A few new dependencies are required to remove some of the TODO items: - A way to safely convert from byte slices to types implementing `FromBytes`, - A way to obtain slices and write into a `CoherentAllocation`, - Several improvements to the `register!()` macro, - Alignment operations to powers of two, and an equivalent to the C `fls`, - Support for `xa_alloc` in the XAlloc bindings. Some items have also become obsolete: - The auxiliary bus abstractions have been implemented and are in use, - The ELF utilities are not considered for being part of the core kernel bindings anymore. - VBIOS, falcon and GPU timer have been completed. We now have quite a few TODO entries in the code, so annotate them with a 4 letter code representing the corresponding task in `todo.rst`. This allows to easily find which part of the code corresponds to a given entry (and conversely). Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-24-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 859aa3d940585db3f3513964020c2a42614804dc Author: Alexandre Courbot Date: Thu Jun 19 22:24:07 2025 +0900 gpu: nova-core: load and run FWSEC-FRTS With all the required pieces in place, load FWSEC-FRTS onto the GSP falcon, run it, and check that it successfully carved out the WPR2 region out of framebuffer memory. Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-23-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 31f0feefb49a219687a1233e68146db834417d75 Author: Alexandre Courbot Date: Thu Jun 19 22:24:06 2025 +0900 gpu: nova-core: extract FWSEC from BIOS and patch it to run FWSEC-FRTS The FWSEC firmware needs to be extracted from the VBIOS and patched with the desired command, as well as the right signature. Do this so we are ready to load and run this firmware into the GSP falcon and create the FRTS region. [joelagnelf@nvidia.com: give better names to FalconAppifHdrV1's fields] Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-22-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 436884511d54b8a090fe2886d48f72143ce95b67 Author: Alexandre Courbot Date: Thu Jun 19 22:24:05 2025 +0900 gpu: nova-core: add types for patching firmware binaries Some of the firmwares need to be patched at load-time with a signature. Add a couple of types and traits that sub-modules can use to implement this behavior, while ensuring that the correct kind of signature is applied to the firmware. Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-21-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 80213934d00fe09d9dcef3d6f17250be131435aa Author: Alexandre Courbot Date: Thu Jun 19 22:24:04 2025 +0900 gpu: nova-core: compute layout of the FRTS region FWSEC-FRTS is run with the desired address of the FRTS region as parameter, which we need to compute depending on some hardware parameters. Do this in a `FbLayout` structure, that will be later extended to describe more memory regions used to boot the GSP. Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-20-ecf41ef99252@nvidia.com [ In doc-comment of FbLayout s/bootup process/boot process/ - Danilo ] Signed-off-by: Danilo Krummrich commit bfb4a6c721517a11b277e8841f8a7a64b1b14b72 Author: Jakub Kicinski Date: Sat Jun 21 10:19:43 2025 -0700 selftests: drv-net: import things in lib one by one pylint doesn't understand our path hacks, and it generates a lot of warnings for driver tests. Import what we use one by one, this is hopefully not too tedious and it makes pylint happy. Link: https://patch.msgid.link/20250621171944.2619249-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 47c4846e4319503e9cd0bd0922facd0fb1e383d0 Author: Joel Fernandes Date: Thu Jun 19 22:24:03 2025 +0900 gpu: nova-core: vbios: Add support for FWSEC ucode extraction Using the support for navigating the VBIOS, add support to extract vBIOS ucode data required for GSP to boot. The main data extracted from the vBIOS is the FWSEC-FRTS firmware which runs on the GSP processor. This firmware runs in high secure mode, and sets up the WPR2 (Write protected region) before the Booter runs on the SEC2 processor. Tested on my Ampere GA102 and boot is successful. Cc: Alexandre Courbot Cc: John Hubbard Cc: Shirish Baskaran Cc: Alistair Popple Cc: Timur Tabi Cc: Ben Skeggs Signed-off-by: Joel Fernandes [ acourbot@nvidia.com: remove now-unneeded Devres acquisition ] Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-19-ecf41ef99252@nvidia.com [ Re-format and use markdown in comments. - Danilo ] Signed-off-by: Danilo Krummrich commit 9f22c3ddb8cf0e49e9b1ad539d7f3bcb59381fad Author: Russell King (Oracle) Date: Thu Jun 19 10:47:26 2025 +0100 net: stmmac: lpc18xx: use plat_dat->phy_interface lpc18xx uses plat_dat->mac_interface, despite wanting to validate the PHY interface. Checking the DT files (arch/arm/boot/dts/nxp/lpc/), none of them specify mac-mode which means mac_interface and phy_interface will be identical. mac_interface is only used when there is some kind of MII converter between the DesignWare MAC and PHY, and describes the interface mode that the DW MAC needs to use, whereas phy_interface describes the interface mode that the PHY uses. Noting that lpc18xx only supports MII and RMII interface modes, switch this glue driver to use plat_dat->phy_interface, and to mark that the mac_interface is not used, explicitly set it to PHY_INTERFACE_MODE_NA. The latter is safe as the only user of mac_interface for this platform would be in stmmac_check_pcs_mode(), which only checks for RGMII or SGMII. Signed-off-by: Russell King (Oracle) Reviewed-by: Yanteng Si Link: https://patch.msgid.link/E1uSBri-004fL5-FI@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 54fd8f38d804fa1353cf3c12113f0a98a4d41adf Author: Jani Nikula Date: Mon Jun 23 14:43:49 2025 +0300 drm/xe/compat: remove old pcode compat interface With display code using the struct drm_device based pcode interface, we can drop the old pcode compat interface. We can also drop the __compat_uncore_to_tile() helper from intel_uncore.h compat header. Turns out a couple of headers depended on the intel_uncore.h include via intel_pcode.h. Fix them. Cc: Lucas De Marchi Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/948016a031dcb2acef0c97071aac09fa49613e07.1750678991.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 2a9b1baa27751c73f96ef6077888c7688195b55e Author: Jani Nikula Date: Mon Jun 23 14:43:48 2025 +0300 drm/i915/dram: switch to struct drm_device based pcode interface With the struct drm_device based pcode interface in place in both i915 and xe, we can switch dram code to use that. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/e0d74a3317cc61d1cbb096b962cfbd7c60f038d4.1750678991.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 9a86f345f6341ed274df4ceb011ac0612c91cb9b Author: Jani Nikula Date: Mon Jun 23 14:43:47 2025 +0300 drm/i915/display: switch to struct drm_device based pcode interface With the struct drm_device based pcode interface in place in both i915 and xe, we can switch display code to use that, and ditch a number of struct drm_i915_private uses. Also drop the dependency on i915_drv.h from a couple of files. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/f948fad1b8208522e15140692c17cf493ef305d9.1750678991.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit d9465cc8ac2dd36264c274d4e6c99437276c64c8 Author: Jani Nikula Date: Mon Jun 23 14:43:46 2025 +0300 drm/xe/pcode: add struct drm_device based interface In preparation for dropping the dependency on struct intel_uncore or struct xe_tile from display code, add a struct drm_device based interface to pcode. Cc: Lucas De Marchi Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/eeaa9cc8438caab2e22f9cb2142fbc18cc0fd861.1750678991.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 747b57e7b6925e0515af6706ac9d3d2bada57432 Author: Jani Nikula Date: Mon Jun 23 14:43:45 2025 +0300 drm/i915/pcode: add struct drm_device based interface In preparation for dropping the dependency on struct intel_uncore from display code, add a struct drm_device based interface to pcode. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/e4ee176ca5454cfc636cbe71feb9f55d9e91f4ea.1750678991.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit ab3ef56f58c21220dd131195385de212861a3f53 Author: Jani Nikula Date: Mon Jun 23 14:43:44 2025 +0300 drm/i915/pcode: drop fast wait from snb_pcode_write_timeout() Only use the ms granularity wait in snb_pcode_write_timeout(), primarily to better align with the xe driver, which also only has the millisecond wait. Use an arbitrary 250 us fast wait before the specified ms wait, and have snb_pcode_write() default to 1 ms. This means snb_pcode_write() and snb_pcode_write_timeout() will always be sleeping functions. There should not be any atomic users for pcode writes though, and any display code using pcode via xe has already been non-atomic. The uncore wait will do a might_sleep() annotation that should catch any problems. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/ba86280f53cea2d020308db35f1ecbd615d07d8a.1750678991.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 1174bf15bd601f17556f721798cd9183e169549a Author: Jani Nikula Date: Mon May 19 14:29:00 2025 +0300 drm/connector: move HDR sink metadata to display info Information parsed from the display EDID should be stored in display info. Move HDR sink metadata there. Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250519112900.1383997-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit dc70c6ae2441c8ab5438331b2430ec098fdd94bb Author: Joel Fernandes Date: Thu Jun 19 22:24:02 2025 +0900 gpu: nova-core: vbios: Add support to look up PMU table in FWSEC The PMU table in the FWSEC image has to be located to locate the start of the Falcon ucode in the same or another FWSEC image. Add support for the same. Signed-off-by: Joel Fernandes Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-18-ecf41ef99252@nvidia.com [ Re-format and use markdown in comments. - Danilo ] Signed-off-by: Danilo Krummrich commit 6fda04e7f0cd57989066fa3b7975af08d779c8fd Author: Joel Fernandes Date: Thu Jun 19 22:24:01 2025 +0900 gpu: nova-core: vbios: Add base support for VBIOS construction and iteration Add support for navigating the VBIOS images required for extracting ucode data for GSP to boot. Later patches will build on this. Debug log messages will show the BIOS images: [102141.013287] NovaCore: Found BIOS image at offset 0x0, size: 0xfe00, type: PciAt [102141.080692] NovaCore: Found BIOS image at offset 0xfe00, size: 0x14800, type: Efi [102141.098443] NovaCore: Found BIOS image at offset 0x24600, size: 0x5600, type: FwSec [102141.415095] NovaCore: Found BIOS image at offset 0x29c00, size: 0x60800, type: FwSec Cc: Alexandre Courbot Cc: John Hubbard Cc: Shirish Baskaran Cc: Alistair Popple Cc: Timur Tabi Cc: Ben Skeggs [ acourbot@nvidia.com: fix clippy warnings, read_more() function ] Signed-off-by: Alexandre Courbot Signed-off-by: Joel Fernandes Link: https://lore.kernel.org/r/20250619-nova-frts-v6-17-ecf41ef99252@nvidia.com [ Replace extend_with() and copy_from_slice() with extend_from_slice(); re-format and use markdown in comments. - Danilo ] Signed-off-by: Danilo Krummrich commit d3b2afa987b5ffb4352a32e5063e5932e00c9872 Merge: 27390db9592d82 d46502279a11b4 Author: Jakub Kicinski Date: Mon Jun 23 11:14:07 2025 -0700 Merge branch 'add-support-for-the-ipq5018-internal-ge-phy' George Moussalem says: ==================== Add support for the IPQ5018 Internal GE PHY The IPQ5018 SoC contains an internal Gigabit Ethernet PHY with its output pins that provide an MDI interface to either an external switch in a PHY to PHY link architecture or directly to an attached RJ45 connector. The PHY supports 10BASE-T/100BASE-TX/1000BASE-T link modes in SGMII interface mode, CDT, auto-negotiation and 802.3az EEE. The LDO controller found in the IPQ5018 SoC needs to be enabled to drive power to the CMN Ethernet Block (CMN BLK) which the GE PHY depends on. The LDO must be enabled in TCSR by writing to a specific register. In a phy to phy architecture, DAC values need to be set to accommodate for the short cable length. ==================== Link: https://patch.msgid.link/20250613-ipq5018-ge-phy-v5-0-9af06e34ea6b@outlook.com Signed-off-by: Jakub Kicinski commit d46502279a11b48ede1d8bf65a229c8231bf0602 Author: George Moussalem Date: Fri Jun 13 05:55:08 2025 +0400 net: phy: qcom: at803x: Add Qualcomm IPQ5018 Internal PHY support The IPQ5018 SoC contains a single internal Gigabit Ethernet PHY which provides an MDI interface directly to an RJ45 connector or an external switch over a PHY to PHY link. The PHY supports 10BASE-T/100BASE-TX/1000BASE-T link modes in SGMII interface mode, CDT, auto-negotiation and 802.3az EEE. Let's add support for this PHY in the at803x driver as it falls within the Qualcomm Atheros OUI. Reviewed-by: Andrew Lunn Signed-off-by: George Moussalem Link: https://patch.msgid.link/20250613-ipq5018-ge-phy-v5-2-9af06e34ea6b@outlook.com Signed-off-by: Jakub Kicinski commit 82eaf94d69fce20f8859a2b8dae8e7064d9343da Author: George Moussalem Date: Fri Jun 13 05:55:07 2025 +0400 dt-bindings: net: qca,ar803x: Add IPQ5018 Internal GE PHY support Document the IPQ5018 Internal Gigabit Ethernet PHY found in the IPQ5018 SoC. Its output pins provide an MDI interface to either an external switch in a PHY to PHY link scenario or is directly attached to an RJ45 connector. The PHY supports 10/100/1000 mbps link modes, CDT, auto-negotiation and 802.3az EEE. For operation, the LDO controller found in the IPQ5018 SoC for which there is provision in the mdio-4019 driver. Two common archictures across IPQ5018 boards are: 1. IPQ5018 PHY --> MDI --> RJ45 connector 2. IPQ5018 PHY --> MDI --> External PHY In a phy to phy architecture, the DAC needs to be configured to accommodate for the short cable length. As such, add an optional boolean property so the driver sets preset DAC register values accordingly. Signed-off-by: George Moussalem Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250613-ipq5018-ge-phy-v5-1-9af06e34ea6b@outlook.com Signed-off-by: Jakub Kicinski commit e2a37c277c64078d5439693963fb9813fa1e6e9c Author: Ke Ma Date: Thu Jun 19 23:11:28 2025 +0200 kernel/sched/ext.c: fix typo "occured" -> "occurred" in comments Fixes a minor spelling mistake in two comment lines Signed-off-by: Ke Ma Signed-off-by: Tejun Heo commit 3aa54d162490f14d1f1fdf3b3d1170b2ea50276b Author: Bartosz Golaszewski Date: Wed Jun 18 11:11:29 2025 +0200 PCI/pwrctrl: Fix the kerneldoc tag for private fields The correct tag for marking private fields in kerneldoc is "private:", not capitalized "Private:". Fix the pwrctl struct to silence the following warnings: Warning: include/linux/pci-pwrctrl.h:45 struct member 'nb' not described in 'pci_pwrctrl' Warning: include/linux/pci-pwrctrl.h:45 struct member 'link' not described in 'pci_pwrctrl' Warning: include/linux/pci-pwrctrl.h:45 struct member 'work' not described in 'pci_pwrctrl' Fixes: 4565d2652a37 ("PCI/pwrctl: Add PCI power control core code") Reported-by: Bjorn Helgaas Closes: https://lore.kernel.org/all/20250617233539.GA1177120@bhelgaas/ Signed-off-by: Bartosz Golaszewski Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250618091129.44810-1-brgl@bgdev.pl commit fc2898ea793a48bc4b74b61cde2d8656f20efdf4 Author: Dr. David Alan Gilbert Date: Mon Jun 23 01:30:49 2025 +0100 workqueue: Remove unused work_on_cpu_safe The last use of the work_on_cpu_safe() macro was removed recently by commit 9cda46babdfe ("crypto: n2 - remove Niagara2 SPU driver") Remove it, and the work_on_cpu_safe_key() function it calls. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Tejun Heo commit d0c167eb0afaed24e320e2b461ffae21fe48df7c Author: Alexandre Courbot Date: Thu Jun 19 22:24:00 2025 +0900 gpu: nova-core: firmware: add ucode descriptor used by FWSEC-FRTS FWSEC-FRTS is the first firmware we need to run on the GSP falcon in order to initiate the GSP boot process. Introduce the structure that describes it. Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-16-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 69f5cd67ce41ba128d3df18137c7a93a1faa84da Author: Alexandre Courbot Date: Thu Jun 19 22:23:59 2025 +0900 gpu: nova-core: add falcon register definitions and base code Booting the GSP on Ampere requires an intricate dance between the GSP and SEC2 falcons, where the GSP starts by running the FWSEC firmware to create the WPR2 region , and then SEC2 loads the actual RISC-V firmware into the GSP. Add the common Falcon code and HAL for Ampere GPUs, and instantiate the GSP and SEC2 Falcons that will be required to perform that dance and boot the GSP. Thanks to Ben Skeggs for pointing out an important bug in the memory scrubbing code that could lead to a race condition and ultimately a failure to boot the GSP! Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-15-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 6554ad65b5891e52689061606e277a69e44462c4 Author: Alexandre Courbot Date: Thu Jun 19 22:23:58 2025 +0900 gpu: nova-core: register sysmem flush page Reserve a page of system memory so sysmembar can perform a read on it if a system write occurred since the last flush. Do this early as it can be required to e.g. reset the GPU falcons. Chipsets capabilities differ in that respect, so this commit also introduces the FB HAL. Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-14-ecf41ef99252@nvidia.com [ * Use kernel::page::PAGE_SIZE instead of kernel::bindings::PAGE_SIZE. * Get rid of the Option for SysmemFlush. * Slightly reword SysmemFlush doc-comments. - Danilo ] Signed-off-by: Danilo Krummrich commit d99208b91933fd2a58ed9ed321af07dacd06ddc3 Author: Edward Adam Davis Date: Wed Jun 18 15:31:57 2025 +0800 fs/ntfs3: cancle set bad inode after removing name fails The reproducer uses a file0 on a ntfs3 file system with a corrupted i_link. When renaming, the file0's inode is marked as a bad inode because the file name cannot be deleted. The underlying bug is that make_bad_inode() is called on a live inode. In some cases it's "icache lookup finds a normal inode, d_splice_alias() is called to attach it to dentry, while another thread decides to call make_bad_inode() on it - that would evict it from icache, but we'd already found it there earlier". In some it's outright "we have an inode attached to dentry - that's how we got it in the first place; let's call make_bad_inode() on it just for shits and giggles". Fixes: 78ab59fee07f ("fs/ntfs3: Rework file operations") Reported-by: syzbot+1aa90f0eb1fc3e77d969@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=1aa90f0eb1fc3e77d969 Signed-off-by: Edward Adam Davis Signed-off-by: Konstantin Komarov commit e841ecb139339602bc1853f5f09daa5d1ea920a2 Author: Lizhi Xu Date: Fri Jun 6 13:16:16 2025 +0800 fs/ntfs3: Add sanity check for file name The length of the file name should be smaller than the directory entry size. Reported-by: syzbot+598057afa0f49e62bd23@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=598057afa0f49e62bd23 Signed-off-by: Lizhi Xu Signed-off-by: Konstantin Komarov commit b1e9d89408f402858c00103f9831b25ffa0994d3 Author: Rong Zhang Date: Wed May 7 15:35:34 2025 +0800 fs/ntfs3: correctly create symlink for relative path After applying this patch, could correctly create symlink: ln -s "relative/path/to/file" symlink Signed-off-by: Rong Zhang [almaz.alexandrovich@paragon-software.com: added cpu_to_le32 macro to rs->Flags assignment] Signed-off-by: Konstantin Komarov commit 8df35e16a92c002f046bc410998b89b07cfcd639 Author: Rong Zhang Date: Wed May 7 15:34:38 2025 +0800 fs/ntfs3: fix symlinks cannot be handled correctly The symlinks created in windows will be broken in linux by ntfs3, the patch fixes it. Signed-off-by: Rong Zhang Signed-off-by: Konstantin Komarov commit c7ee6c8f2f1e3d4b8efa6ac957289676a3f5cd51 Author: Salomon Dushimirimana Date: Mon Jun 16 19:00:18 2025 +0000 scsi: pm80xx: Add controller SCSI host fatal error uevents Add pm80xx_fatal_error_uevent_emit() which is called when the pm80xx driver encouters a fatal error. The uevent has the following additional custom key/value pair sets: - DRIVER: driver name, pm80xx in this case - HBA_NUM: the scsi host id of the device - EVENT_TYPE: to indicate a fatal error - REPORTED_BY: either driver or firmware The uevent is anchored to the kernel object that represents the SCSI controller, which includes other useful core variables, such as, ACTION, DEVPATH, SUBSYSTEM, and more. The fatal_error_uevent_emit() function is called when the controller fatal error state changes. Since this doesn't happen often for a specific SCSI host, there is no worries of a uevent storm. Signed-off-by: Salomon Dushimirimana Link: https://lore.kernel.org/r/20250616190018.2136260-1-salomondush@google.com Signed-off-by: Martin K. Petersen commit 9bcc046a929f73358bf23678306b31d927a7e088 Author: Alexandre Courbot Date: Thu Jun 19 22:23:57 2025 +0900 gpu: nova-core: add DMA object struct Since we will need to allocate lots of distinct memory chunks to be shared between GPU and CPU, introduce a type dedicated to that. It is a light wrapper around CoherentAllocation. Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-13-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit bbe5db761086e870678697f8920db518a6297a18 Author: Alexandre Courbot Date: Thu Jun 19 22:23:56 2025 +0900 gpu: nova-core: wait for GFW_BOOT completion Upon reset, the GPU executes the GFW (GPU Firmware) in order to initialize its base parameters such as clocks. The driver must ensure that this step is completed before using the hardware. Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-12-ecf41ef99252@nvidia.com [ Slightly adjust comments in wait_gfw_boot_completion(). - Danilo ] Signed-off-by: Danilo Krummrich commit a1c940cbf505e2342ebb5ea996f0acf205d6af7b Author: Reuven Abliyev Date: Tue Jun 17 17:51:58 2025 +0300 drm/xe/nvm: add support for non-posted erase Erase command is slow on discrete graphics storage and may overshot PCI completion timeout. BMG introduces the ability to have non-posted erase. Add driver support for non-posted erase with polling for erase completion. Reviewed-by: Rodrigo Vivi Acked-by: Rodrigo Vivi Signed-off-by: Reuven Abliyev Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250617145159.3803852-9-alexander.usyskin@intel.com Signed-off-by: Rodrigo Vivi commit 87e1ebbafbea1e5e8de1f2beaf01b378149262f2 Author: Alexander Usyskin Date: Tue Jun 17 17:51:57 2025 +0300 drm/xe/nvm: add support for access mode Check NVM access mode from GSC FW status registers and overwrite access status read from SPI descriptor, if needed. Reviewed-by: Rodrigo Vivi Acked-by: Rodrigo Vivi Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250617145159.3803852-8-alexander.usyskin@intel.com Signed-off-by: Rodrigo Vivi commit c28bfb107daca4e9ba2e567a412e885933057282 Author: Alexander Usyskin Date: Tue Jun 17 17:51:56 2025 +0300 drm/xe/nvm: add on-die non-volatile memory device Enable access to internal non-volatile memory on DGFX with GSC/CSC devices via a child device. The nvm child device is exposed via auxiliary bus. Reviewed-by: Rodrigo Vivi Acked-by: Rodrigo Vivi Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250617145159.3803852-7-alexander.usyskin@intel.com Signed-off-by: Rodrigo Vivi commit 4b93f5fc3bdff9e89beb7aa7f39ca8c7e4d02924 Author: Alexander Usyskin Date: Tue Jun 17 17:51:55 2025 +0300 mtd: intel-dg: align 64bit read and write GSC NVM controller HW errors on quad access overlapping 1K border. Align 64bit read and write to avoid readq/writeq over 1K border. Reviewed-by: Raag Jadav Acked-by: Miquel Raynal Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250617145159.3803852-6-alexander.usyskin@intel.com Signed-off-by: Rodrigo Vivi commit 044c8be05a39d79821251d8e49fe90531e6c7108 Author: Alexander Usyskin Date: Tue Jun 17 17:51:54 2025 +0300 mtd: intel-dg: register with mtd Register the on-die nvm device with the mtd subsystem. Refcount nvm object on _get and _put mtd callbacks. For erase operation address and size should be 4K aligned. For write operation address and size has to be 4bytes aligned. CC: Rodrigo Vivi CC: Lucas De Marchi Reviewed-by: Raag Jadav Acked-by: Miquel Raynal Co-developed-by: Tomas Winkler Signed-off-by: Tomas Winkler Co-developed-by: Vitaly Lubart Signed-off-by: Vitaly Lubart Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250617145159.3803852-5-alexander.usyskin@intel.com Signed-off-by: Rodrigo Vivi commit 9fe53abfac0b158e2db7c516264bf11b64489384 Author: Alexander Usyskin Date: Tue Jun 17 17:51:53 2025 +0300 mtd: intel-dg: implement access functions Implement read(), erase() and write() functions. CC: Lucas De Marchi CC: Rodrigo Vivi Reviewed-by: Raag Jadav Acked-by: Miquel Raynal Co-developed-by: Tomas Winkler Signed-off-by: Tomas Winkler Co-developed-by: Vitaly Lubart Signed-off-by: Vitaly Lubart Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250617145159.3803852-4-alexander.usyskin@intel.com Signed-off-by: Rodrigo Vivi commit 7234b321dd991926c4598a3eab8df0ab839cb3a6 Author: Alexander Usyskin Date: Tue Jun 17 17:51:52 2025 +0300 mtd: intel-dg: implement region enumeration In intel-dg, there is no access to the spi controller, the information is extracted from the descriptor region. CC: Lucas De Marchi Reviewed-by: Raag Jadav Reviewed-by: Rodrigo Vivi Acked-by: Miquel Raynal Co-developed-by: Tomas Winkler Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250617145159.3803852-3-alexander.usyskin@intel.com Signed-off-by: Rodrigo Vivi commit ceb5ab3cb64637952657be23d347e1c79dd02212 Author: Alexander Usyskin Date: Tue Jun 17 17:51:51 2025 +0300 mtd: add driver for intel graphics non-volatile memory device Add auxiliary driver for intel discrete graphics non-volatile memory device. CC: Lucas De Marchi Reviewed-by: Raag Jadav Reviewed-by: Rodrigo Vivi Acked-by: Miquel Raynal Co-developed-by: Tomas Winkler Signed-off-by: Tomas Winkler Signed-off-by: Alexander Usyskin Link: https://lore.kernel.org/r/20250617145159.3803852-2-alexander.usyskin@intel.com Signed-off-by: Rodrigo Vivi commit 0089d6ee3bb6d961f6e193d9384705ed41496adf Merge: 3972872e459d81 36c52fb703e903 Author: Rodrigo Vivi Date: Mon Jun 23 13:14:13 2025 -0400 Merge drm/drm-next into drm-xe-next Catch up on i915 changes to be able to include mtd driver for both xe and i915. Signed-off-by: Rodrigo Vivi commit 94bb40796face4327a5227d8763fd1cf2cbfc6f5 Merge: 15592a11d5a5c8 f14371aceef9eb Author: Martin K. Petersen Date: Mon Jun 23 13:12:16 2025 -0400 Merge patch series "Update lpfc to revision 14.4.0.10" Justin Tee says: Update lpfc to revision 14.4.0.10 This patch set contains bug fixes related to diagnostic log messaging, driver initialization and removal, updates to mailbox command handling, and string modifications for obsolete adapter model descriptions. The patches were cut against Martin's 6.17/scsi-queue tree. Link: https://lore.kernel.org/r/20250618192138.124116-1-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit f14371aceef9eb57bd5c8107b436b97350cee454 Author: Justin Tee Date: Wed Jun 18 12:21:38 2025 -0700 scsi: lpfc: Copyright updates for 14.4.0.10 patches Update copyrights to 2025 for files modified in the 14.4.0.10 patch set. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-14-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 81f2d701670f75c09dca8de4e26ddf77bf32d0f9 Author: Justin Tee Date: Wed Jun 18 12:21:37 2025 -0700 scsi: lpfc: Update lpfc version to 14.4.0.10 Update lpfc version to 14.4.0.10 Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-13-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit e03bc287623f024ebff5ceb6ae65e4884fba5df4 Author: Justin Tee Date: Wed Jun 18 12:21:36 2025 -0700 scsi: lpfc: Modify end-of-life adapters' model descriptions Obsolete adapters' model description strings are updated to indicate that they are no longer supported. End-of-life adapters will still remain probed by the lpfc driver based on PCI id. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-12-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 5d655969100dd87e59c22d892985545a7f2c1a70 Author: Justin Tee Date: Wed Jun 18 12:21:35 2025 -0700 scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions The CQ_CREATE_SET mailbox command's bitfields are updated. Rename the cqe_cnt and separate high/low bitfield names to help resolve confusion between two similar bitfield definitions. Corresponding usages of the newly defined bitfields are updated as well. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-11-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit a28d10a15600e3eae19035774cabad06008a8a59 Author: Justin Tee Date: Wed Jun 18 12:21:34 2025 -0700 scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset Move clearing of HBA_SETUP flag out of lpfc_sli_brdrestart_s4 and before lpfc_sli4_queue_unset. lpfc_sli4_queue_unset kfrees phba queues, so clear the HBA_SETUP atomic flag to signal that the phba struct is no longer initialized. Also, add a check for the HBA_SETUP flag in the lpfc_sli4_io_xri_aborted routine before dereferencing the ELS WQ. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-10-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 1cced5779e7a3ff7ec025fc47c76a7bd3bb38877 Author: Justin Tee Date: Wed Jun 18 12:21:33 2025 -0700 scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk For SLI3, the HBA_SETUP flag is never set so the lpfc_dev_loss_tmo_callbk always early returns. Add a phba->sli_rev check for SLI4 mode so that the SLI3 path can flow through the original dev_loss_tmo worker thread design to lpfc_dev_loss_tmo_handler instead of early return. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-9-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 320c3a12b40c94326f401705cdf224e8a661f1a2 Author: Justin Tee Date: Wed Jun 18 12:21:32 2025 -0700 scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr Port wide initialization flags FLOGI_ISSUED and RHBA_CMPL make more sense to be cleared upon a link down event rather than waiting for a link up event. By moving clearing of these initializatin flags to a link down handler, future confusion on the state of initialization is avoided. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-8-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 5a00dfc58bfe5fcff079bf90d1cc0254cab8e33e Author: Justin Tee Date: Wed Jun 18 12:21:31 2025 -0700 scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd There are unnecessary checks on an HBA's interface type and family before erroring out a failed lpfc_get_sli4_parameters mailbox command. Simplify the error handling by logging a message and proceeding to memory free labels. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-7-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 6b61ec3dd472f8fd367f116e61771030f4d410db Author: Justin Tee Date: Wed Jun 18 12:21:30 2025 -0700 scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses If an FDMI request completes with local reject status and the request is not retryable, there's no need to parse an FDMI response payload. Insert an early return statement for such cases. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-6-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 37c893e36b1b538aea15bcef6330e1d4a7b77583 Author: Justin Tee Date: Wed Jun 18 12:21:29 2025 -0700 scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set During rmmod, all ndlp objects are cleaned up and marked with the NLP_DROPPED flag indicating that an ndlp object is currently being released. Thus, if an RSCN is received during driver unload, then walking the fc_nodes list to process the RSCN is unnecessary because the ndlp objects are very shortly going to be released. In the lpfc_rscn_recovery_check routine, early return if the driver is in the middle of unloading by checking for the FC_UNLOADING flag. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-5-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 6698796282e828733cde3329c887b4ae9e5545e9 Author: Justin Tee Date: Wed Jun 18 12:21:28 2025 -0700 scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure If a call to lpfc_sli4_read_rev() from lpfc_sli4_hba_setup() fails, the resultant cleanup routine lpfc_sli4_vport_delete_fcp_xri_aborted() may occur before sli4_hba.hdwqs are allocated. This may result in a null pointer dereference when attempting to take the abts_io_buf_list_lock for the first hardware queue. Fix by adding a null ptr check on phba->sli4_hba.hdwq and early return because this situation means there must have been an error during port initialization. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-4-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit 5459bd49f05f7f0f420cb8564ea58cc12afc360e Author: Justin Tee Date: Wed Jun 18 12:21:27 2025 -0700 scsi: lpfc: Update debugfs trace ring initialization messages Initialization parameters for trace rings used in debugfs are sometimes automatically adjusted. This patch corrects and updates the corresponding log messages. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-3-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit e6d4486edd4a840e0ec9de4a35dee3448ca5a940 Author: Justin Tee Date: Wed Jun 18 12:21:26 2025 -0700 scsi: lpfc: Revise logging format for failed CT MIB requests Unsupported and rejected CT MIB request log messages are changed to KERN_WARNING level. Also, remove extra space in log message. Signed-off-by: Justin Tee Link: https://lore.kernel.org/r/20250618192138.124116-2-justintee8345@gmail.com Signed-off-by: Martin K. Petersen commit a03c9bd953c2482aec8013c9c857b4d53031b54d Author: Alexandre Courbot Date: Thu Jun 19 22:23:55 2025 +0900 gpu: nova-core: add helper function to wait on condition While programming the hardware, we frequently need to busy-wait until a condition (like a given bit of a register to switch value) happens. Add a basic `wait_on` helper function to wait on such conditions expressed as a closure, with a timeout argument. This is temporary as we will switch to `read_poll_timeout` [1] once it is available. Link: https://lore.kernel.org/lkml/20250220070611.214262-8-fujita.tomonori@gmail.com/ [1] Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-11-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 53e1d4a8a20f5e14b3196d183a023687806f8070 Merge: 19cbc930c209d5 024f39fff6d222 Author: Mark Brown Date: Mon Jun 23 17:56:32 2025 +0100 regulator: dvfsrc: Add support for MT8196 and Merge series from AngeloGioacchino Del Regno : This series adds support for the DVFSRC regulators found on the MediaTek MT8196 Chromebook SoC and the (unrelated) MT6893 Dimensity 1200. commit 7e9b231c402a297251b3e6e0f5cc16cef7dd3ce5 Author: Sean Christopherson Date: Thu May 22 16:52:23 2025 -0700 KVM: selftests: Add a KVM_IRQFD test to verify uniqueness requirements Add a selftest to verify that eventfd+irqfd bindings are globally unique, i.e. that KVM doesn't allow multiple irqfds to bind to a single eventfd, even across VMs. Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-14-seanjc@google.com Signed-off-by: Sean Christopherson commit 74e5e3fb0dd71790a1974d63420d43bc5743a56b Author: Sean Christopherson Date: Thu May 22 16:52:22 2025 -0700 KVM: selftests: Add utilities to create eventfds and do KVM_IRQFD Add helpers to create eventfds and to (de)assign eventfds via KVM_IRQFD. Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 033b76bc7f066b3e2e024e5ced0de0768d7d57b5 Author: Sean Christopherson Date: Thu May 22 16:52:21 2025 -0700 KVM: selftests: Assert that eventfd() succeeds in Xen shinfo test Assert that eventfd() succeeds in the Xen shinfo test instead of skipping the associated testcase. While eventfd() is outside the scope of KVM, KVM unconditionally selects EVENTFD, i.e. the syscall should always succeed. Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-12-seanjc@google.com Signed-off-by: Sean Christopherson commit b599d44a71f1aa1acff54b05e4c0e60ea82ed90c Author: Sean Christopherson Date: Thu May 22 16:52:20 2025 -0700 KVM: Drop sanity check that per-VM list of irqfds is unique Now that the eventfd's waitqueue ensures it has at most one priority waiter, i.e. prevents KVM from binding multiple irqfds to one eventfd, drop KVM's sanity check that eventfds are unique for a single VM. Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-11-seanjc@google.com Signed-off-by: Sean Christopherson commit 2cdd64cbf9906f9d2d52ef96e1471992ff6c27ec Author: Sean Christopherson Date: Thu May 22 16:52:19 2025 -0700 KVM: Disallow binding multiple irqfds to an eventfd with a priority waiter Disallow binding an irqfd to an eventfd that already has a priority waiter, i.e. to an eventfd that already has an attached irqfd. KVM always operates in exclusive mode for EPOLL_IN (unconditionally returns '1'), i.e. only the first waiter will be notified. KVM already disallows binding multiple irqfds to an eventfd in a single VM, but doesn't guard against multiple VMs binding to an eventfd. Adding the extra protection reduces the pain of a userspace VMM bug, e.g. if userspace fails to de-assign before re-assigning when transferring state for intra-host migration, then the migration will explicitly fail as opposed to dropping IRQs on the destination VM. Temporarily keep KVM's manual check on irqfds.items, but add a WARN, e.g. to allow sanity checking the waitqueue enforcement. Cc: Oliver Upton Cc: David Matlack Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-10-seanjc@google.com Signed-off-by: Sean Christopherson commit 0d09582b3a607436fd91d6ce813048a048ecbf10 Author: Sean Christopherson Date: Thu May 22 16:52:18 2025 -0700 sched/wait: Add a waitqueue helper for fully exclusive priority waiters Add a waitqueue helper to add a priority waiter that requires exclusive wakeups, i.e. that requires that it be the _only_ priority waiter. The API will be used by KVM to ensure that at most one of KVM's irqfds is bound to a single eventfd (across the entire kernel). Open code the helper instead of using __add_wait_queue() so that the common path doesn't need to "handle" impossible failures. Cc: K Prateek Nayak Reviewed-by: K Prateek Nayak Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-9-seanjc@google.com Signed-off-by: Sean Christopherson commit a52664134a24f3b0c425781082ce993617fc2797 Author: Sean Christopherson Date: Thu May 22 16:52:17 2025 -0700 xen: privcmd: Don't mark eventfd waiter as EXCLUSIVE Don't set WQ_FLAG_EXCLUSIVE when adding an irqfd to a wait queue, as irqfd_wakeup() unconditionally returns '0', i.e. doesn't actually operate in exclusive mode. Note, the use of WQ_FLAG_PRIORITY is also dubious, but that's a problem for another day. Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 867347bb21e18551b48eb147c0b2d8635909c8b5 Author: Sean Christopherson Date: Thu May 22 16:52:16 2025 -0700 sched/wait: Drop WQ_FLAG_EXCLUSIVE from add_wait_queue_priority() Drop the setting of WQ_FLAG_EXCLUSIVE from add_wait_queue_priority() and instead have callers manually add the flag prior to adding their structure to the queue. Blindly setting WQ_FLAG_EXCLUSIVE is flawed, as the nature of exclusive, priority waiters means that only the first waiter added will ever receive notifications. Pushing the flawed behavior to callers will allow fixing the problem one hypervisor at a time (KVM added the flawed API, and then KVM's code was copy+pasted nearly verbatim by Xen and Hyper-V), and will also allow for adding an API that provides true exclusivity, i.e. that guarantees at most one priority waiter is in the queue. Opportunistically add a comment in Hyper-V to call out the mess. Xen privcmd's irqfd_wakefup() doesn't actually operate in exclusive mode, i.e. can be "fixed" simply by dropping WQ_FLAG_EXCLUSIVE. And KVM is primed to switch to the aforementioned fully exclusive API, i.e. won't be carrying the flawed code for long. No functional change intended. Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 86e00cd162a727c0b847def89bbd787c20eb8f5d Author: Sean Christopherson Date: Thu May 22 16:52:15 2025 -0700 KVM: Add irqfd to eventfd's waitqueue while holding irqfds.lock Add an irqfd to its target eventfd's waitqueue while holding irqfds.lock, which is mildly terrifying but functionally safe. irqfds.lock is taken inside the waitqueue's lock, but if and only if the eventfd is being released, i.e. that path is mutually exclusive with registration as KVM holds a reference to the eventfd (and obviously must do so to avoid UAF). This will allow using the eventfd's waitqueue to enforce KVM's requirement that eventfd is assigned to at most one irqfd, without introducing races. Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 5f8ca05ea99183ab2b69c7fd9617961211d194e7 Author: Sean Christopherson Date: Thu May 22 16:52:14 2025 -0700 KVM: Add irqfd to KVM's list via the vfs_poll() callback Add the irqfd structure to KVM's list of irqfds in kvm_irqfd_register(), i.e. via the vfs_poll() callback. This will allow taking irqfds.lock across the entire registration sequence (add to waitqueue, add to list), and more importantly will allow inserting into KVM's list if and only if adding to the waitqueue succeeds (spoiler alert), without needing to juggle return codes in weird ways. Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-5-seanjc@google.com Signed-off-by: Sean Christopherson commit b5c543518ae9df8e99c63cd08a8b573f0141b31a Author: Sean Christopherson Date: Thu May 22 16:52:13 2025 -0700 KVM: Initialize irqfd waitqueue callback when adding to the queue Initialize the irqfd waitqueue callback immediately prior to inserting the irqfd into the eventfd's waitqueue. Pre-initializing the state in a completely different context is all kinds of confusing, and incorrectly suggests that the waitqueue function needs to be initialize prior to vfs_poll(). Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 140768a7bf03df2a746cdbd4b6dc938d80caad8d Author: Sean Christopherson Date: Thu May 22 16:52:12 2025 -0700 KVM: Acquire SCRU lock outside of irqfds.lock during assignment Acquire SRCU outside of irqfds.lock so that the locking is symmetrical, and add a comment explaining why on earth KVM holds SRCU for so long. Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 283ed5001d6852f85c09ed2522331b2b197ba937 Author: Sean Christopherson Date: Thu May 22 16:52:11 2025 -0700 KVM: Use a local struct to do the initial vfs_poll() on an irqfd Use a function-local struct for the poll_table passed to vfs_poll(), as nothing in the vfs_poll() callchain grabs a long-term reference to the structure, i.e. its lifetime doesn't need to be tied to the irqfd. Using a local structure will also allow propagating failures out of the polling callback without further polluting kvm_kernel_irqfd. Opportunstically rename irqfd_ptable_queue_proc() to kvm_irqfd_register() to capture what it actually does. Tested-by: K Prateek Nayak Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250522235223.3178519-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 6f343724837b9a7d70ba8c83dcdc37f4768d4e55 Author: Sean Christopherson Date: Wed Jun 11 15:46:05 2025 -0700 KVM: x86: Rename kvm_set_msi_irq() => kvm_msi_to_lapic_irq() Rename kvm_set_msi_irq() to kvm_msi_to_lapic_irq() to better capture what it actually does, e.g. it's _really_ easy to conflate kvm_set_msi_irq() with kvm_set_msi(). Opportunistically delete the public declaration and export, as they are no longer used/needed. No functional change intended. Link: https://lore.kernel.org/r/20250611224604.313496-64-seanjc@google.com Signed-off-by: Sean Christopherson commit b03500f03ea09f5fa31a408135c95c665542ff15 Author: Sean Christopherson Date: Wed Jun 11 15:46:04 2025 -0700 KVM: SVM: Generate GA log IRQs only if the associated vCPUs is blocking Configure IRTEs to GA log interrupts for device posted IRQs that hit non-running vCPUs if and only if the target vCPU is blocking, i.e. actually needs a wake event. If the vCPU has exited to userspace or was preempted, generating GA log entries and interrupts is wasteful and unnecessary, as the vCPU will be re-loaded and/or scheduled back in irrespective of the GA log notification (avic_ga_log_notifier() is just a fancy wrapper for kvm_vcpu_wake_up()). Use a should-be-zero bit in the vCPU's Physical APIC ID Table Entry to track whether or not the vCPU's associated IRTEs are configured to generate GA logs, but only set the synthetic bit in KVM's "cache", i.e. never set the should-be-zero bit in tables that are used by hardware. Use a synthetic bit instead of a dedicated boolean to minimize the odds of messing up the locking, i.e. so that all the existing rules that apply to avic_physical_id_entry for IS_RUNNING are reused verbatim for GA_LOG_INTR. Note, because KVM (by design) "puts" AVIC state in a "pre-blocking" phase, using kvm_vcpu_is_blocking() to track the need for notifications isn't a viable option. Link: https://lore.kernel.org/r/20250611224604.313496-63-seanjc@google.com Signed-off-by: Sean Christopherson commit b9e53f9ff4a88f01b22524878c9a381a6c5f65ff Author: Sean Christopherson Date: Wed Jun 11 15:46:03 2025 -0700 iommu/amd: KVM: SVM: Allow KVM to control need for GA log interrupts Add plumbing to the AMD IOMMU driver to allow KVM to control whether or not an IRTE is configured to generate GA log interrupts. KVM only needs a notification if the target vCPU is blocking, so the vCPU can be awakened. If a vCPU is preempted or exits to userspace, KVM clears is_run, but will set the vCPU back to running when userspace does KVM_RUN and/or the vCPU task is scheduled back in, i.e. KVM doesn't need a notification. Unconditionally pass "true" in all KVM paths to isolate the IOMMU changes from the KVM changes insofar as possible. Opportunistically swap the ordering of parameters for amd_iommu_update_ga() so that the match amd_iommu_activate_guest_mode(). Note, as of this writing, the AMD IOMMU manual doesn't list GALogIntr as a non-cached field, but per AMD hardware architects, it's not cached and can be safely updated without an invalidation. Link: https://lore.kernel.org/all/b29b8c22-2fd4-4b5e-b755-9198874157c7@amd.com Cc: Vasant Hegde Cc: Joao Martins Link: https://lore.kernel.org/r/20250611224604.313496-62-seanjc@google.com Signed-off-by: Sean Christopherson commit 5f3d06b1648e0878f04e3d4819f2ef16c1b40bbf Author: Sean Christopherson Date: Wed Jun 11 15:46:02 2025 -0700 KVM: SVM: Consolidate IRTE update when toggling AVIC on/off Fold the IRTE modification logic in avic_refresh_apicv_exec_ctrl() into __avic_vcpu_{load,put}(), and add a param to the helpers to communicate whether or not AVIC is being toggled, i.e. if IRTE needs a "full" update, or just a quick update to set the CPU and IsRun. Link: https://lore.kernel.org/r/20250611224604.313496-61-seanjc@google.com Signed-off-by: Sean Christopherson commit 6eab2340f339cabb63079c94e5dbaea4d90007df Author: Sean Christopherson Date: Wed Jun 11 15:46:01 2025 -0700 KVM: SVM: Don't check vCPU's blocking status when toggling AVIC on/off Don't query a vCPU's blocking status when toggling AVIC on/off; barring KVM bugs, the vCPU can't be blocking when refreshing AVIC controls. And if there are KVM bugs, ensuring the vCPU and its associated IRTEs are in the correct state is desirable, i.e. well worth any overhead in a buggy scenario. Isolating the "real" load/put flows will allow moving the IOMMU IRTE (de)activation logic from avic_refresh_apicv_exec_ctrl() to avic_update_iommu_vcpu_affinity(), i.e. will allow updating the vCPU's physical ID entry and its IRTEs in a common path, under a single critical section of ir_list_lock. Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-60-seanjc@google.com Signed-off-by: Sean Christopherson commit f2bc961d383bbc26c72f77e3f452da2f9f44dc0d Author: Sean Christopherson Date: Wed Jun 11 15:46:00 2025 -0700 KVM: SVM: Fold avic_set_pi_irte_mode() into its sole caller Fold avic_set_pi_irte_mode() into avic_refresh_apicv_exec_ctrl() in anticipation of moving the __avic_vcpu_{load,put}() calls into the critical section, and because having a one-off helper with a name that's easily confused with avic_pi_update_irte() is unnecessary. No functional change intended. Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-59-seanjc@google.com Signed-off-by: Sean Christopherson commit a23480fe21de60b3e191faa5b0a5ddd24c5e38d6 Author: Sean Christopherson Date: Wed Jun 11 15:45:59 2025 -0700 iommu/amd: WARN if KVM calls GA IRTE helpers without virtual APIC support WARN if KVM attempts to update IRTE entries when virtual APIC isn't fully supported, as KVM should guard all such calls on IRQ posting being enabled. Link: https://lore.kernel.org/r/20250611224604.313496-58-seanjc@google.com Signed-off-by: Sean Christopherson commit 11a60455d4c9d50f07a36efefd5e487989b99b8b Author: Sean Christopherson Date: Wed Jun 11 15:45:58 2025 -0700 KVM: SVM: Use vcpu_idx, not vcpu_id, for GA log tag/metadata Use a vCPU's index, not its ID, for the GA log tag/metadata that's used to find and kick vCPUs when a device posted interrupt serves as a wake event. Lookups on a vCPU index are O(fast) (not sure what xa_load() actually provides), whereas a vCPU ID lookup is O(n) if a vCPU's ID doesn't match its index. Unlike the Physical APIC Table, which is accessed by hardware when virtualizing IPIs, hardware doesn't consume the GA tag, i.e. KVM _must_ use APIC IDs to fill the Physical APIC Table, but KVM has free rein over the format/meaning of the GA tag. Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-57-seanjc@google.com Signed-off-by: Sean Christopherson commit ce9d54f41be03555f1b57cf9dc2a50c45f9f712e Author: Sean Christopherson Date: Wed Jun 11 15:45:57 2025 -0700 KVM: VMX: WARN if VT-d Posted IRQs aren't possible when starting IRQ bypass WARN if KVM attempts to "start" IRQ bypass when VT-d Posted IRQs are disabled, to make it obvious that the logic is a sanity check, and so that a bug related to nr_possible_bypass_irqs is more like to cause noisy failures, e.g. so that KVM doesn't silently fail to wake blocking vCPUs. Link: https://lore.kernel.org/r/20250611224604.313496-56-seanjc@google.com Signed-off-by: Sean Christopherson commit 77e1b8332d1d7aa786f7515e9bd4055def6a1e06 Author: Sean Christopherson Date: Wed Jun 11 15:45:56 2025 -0700 KVM: x86: Decouple device assignment from IRQ bypass Use a dedicated counter to track the number of IRQs that can utilize IRQ bypass instead of piggybacking the assigned device count. As evidenced by commit 2edd9cb79fb3 ("kvm: detect assigned device via irqbypass manager"), it's possible for a device to be able to post IRQs to a vCPU without said device being assigned to a VM. Leave the calls to kvm_arch_{start,end}_assignment() alone for the moment to avoid regressing the MMIO stale data mitigation. KVM is abusing the assigned device count when applying mmio_stale_data_clear, and it's not at all clear if vDPA devices rely on this behavior. This will hopefully be cleaned up in the future, as the number of assigned devices is a terrible heuristic for detecting if a VM has access to host MMIO. Link: https://lore.kernel.org/r/20250611224604.313496-55-seanjc@google.com Signed-off-by: Sean Christopherson commit 99836eb9c5dcae1f0e64da2cb6f7e0bb9151f95d Author: Sean Christopherson Date: Wed Jun 11 15:45:55 2025 -0700 KVM: SVM: WARN if ir_list is non-empty at vCPU free Now that AVIC IRTE tracking is in a mostly sane state, WARN if a vCPU is freed with ir_list entries, i.e. if KVM leaves a dangling IRTE. Initialize the per-vCPU interrupt remapping list and its lock even if AVIC is disabled so that the WARN doesn't hit false positives (and so that KVM doesn't need to call into AVIC code for a simple sanity check). Link: https://lore.kernel.org/r/20250611224604.313496-54-seanjc@google.com Signed-off-by: Sean Christopherson commit 25ef059e8bc51219f18fb7444aff1907960a3a53 Author: Sean Christopherson Date: Wed Jun 11 15:45:54 2025 -0700 KVM: x86: WARN if IRQ bypass routing is updated without in-kernel local APIC Yell if kvm_pi_update_irte() is reached without an in-kernel local APIC, as kvm_arch_irqfd_allowed() should prevent attaching an irqfd and thus any and all postable IRQs to an APIC-less VM. Link: https://lore.kernel.org/r/20250611224604.313496-53-seanjc@google.com Signed-off-by: Sean Christopherson commit d1bccaa1793d8f823983824635933e4bdc752b64 Author: Sean Christopherson Date: Wed Jun 11 15:45:53 2025 -0700 KVM: x86: WARN if IRQ bypass isn't supported in kvm_pi_update_irte() WARN if kvm_pi_update_irte() is reached without IRQ bypass support, as the code is only reachable if the VM already has an IRQ bypass producer (see kvm_irq_routing_update()), or from kvm_arch_irq_bypass_{add,del}_producer(), which, stating the obvious, are called if and only if KVM enables its IRQ bypass hooks. Cc: David Matlack Link: https://lore.kernel.org/r/20250611224604.313496-52-seanjc@google.com Signed-off-by: Sean Christopherson commit 04c4ca0ae47989d8f1263ffa6b77ab05d6160854 Author: Sean Christopherson Date: Wed Jun 11 15:45:52 2025 -0700 KVM: x86: Drop superfluous "has assigned device" check in kvm_pi_update_irte() Don't bother checking if the VM has an assigned device when updating IRTE entries. kvm_arch_irq_bypass_add_producer() explicitly increments the assigned device count, kvm_arch_irq_bypass_del_producer() explicitly decrements the count before invoking kvm_pi_update_irte(), and kvm_irq_routing_update() only updates IRTE entries if there's an active IRQ bypass producer. Link: https://lore.kernel.org/r/20250611224604.313496-51-seanjc@google.com Signed-off-by: Sean Christopherson commit cd86240fea2645abd3cdd4d87f27f3a4a0595da7 Author: Sean Christopherson Date: Wed Jun 11 15:45:51 2025 -0700 KVM: SVM: WARN if updating IRTE GA fields in IOMMU fails WARN if updating GA information for an IRTE entry fails as modifying an IRTE should only fail if KVM is buggy, e.g. has stale metadata, and because returning an error that is always ignored is pointless. Link: https://lore.kernel.org/r/20250611224604.313496-50-seanjc@google.com Signed-off-by: Sean Christopherson commit 48f79c6c86b38f9b6506eeef0d9ca2e03b6be6fe Author: Sean Christopherson Date: Wed Jun 11 15:45:50 2025 -0700 KVM: SVM: Process all IRTEs on affinity change even if one update fails When updating IRTE GA fields, keep processing all other IRTEs if an update fails, as not updating later entries risks making a bad situation worse. Link: https://lore.kernel.org/r/20250611224604.313496-49-seanjc@google.com Signed-off-by: Sean Christopherson commit 16562766f171199acf0ee5d6e6bbe4b4586293ce Author: Sean Christopherson Date: Wed Jun 11 15:45:49 2025 -0700 KVM: SVM: WARN if (de)activating guest mode in IOMMU fails WARN if (de)activating "guest mode" for an IRTE entry fails as modifying an IRTE should only fail if KVM is buggy, e.g. has stale metadata. Link: https://lore.kernel.org/r/20250611224604.313496-48-seanjc@google.com Signed-off-by: Sean Christopherson commit fe0213923dd991cbe6a1e84b9bf600aaf172b530 Author: Sean Christopherson Date: Wed Jun 11 15:45:48 2025 -0700 KVM: SVM: Don't check for assigned device(s) when activating AVIC Don't short-circuit IRTE updating when (de)activating AVIC based on the VM having assigned devices, as nothing prevents AVIC (de)activation from racing with device (de)assignment. And from a performance perspective, bailing early when there is no assigned device doesn't add much, as ir_list_lock will never be contended if there's no assigned device. Link: https://lore.kernel.org/r/20250611224604.313496-47-seanjc@google.com Signed-off-by: Sean Christopherson commit f5998661ff73b5e76974fd7913c1ccc3ff0a07a0 Author: Sean Christopherson Date: Wed Jun 11 15:45:47 2025 -0700 KVM: SVM: Don't check for assigned device(s) when updating affinity Don't bother checking if a VM has an assigned device when updating AVIC vCPU affinity, querying ir_list is just as cheap and nothing prevents racing with changes in device assignment. Link: https://lore.kernel.org/r/20250611224604.313496-46-seanjc@google.com Signed-off-by: Sean Christopherson commit 6df262f915abc0ec988b203c696845b76a7bc7b4 Author: Sean Christopherson Date: Wed Jun 11 15:45:46 2025 -0700 iommu/amd: KVM: SVM: Add IRTE metadata to affined vCPU's list if AVIC is inhibited If an IRQ can be posted to a vCPU, but AVIC is currently inhibited on the vCPU, go through the dance of "affining" the IRTE to the vCPU, but leave the actual IRTE in remapped mode. KVM already handles the case where AVIC is inhibited => uninhibited with posted IRQs (see avic_set_pi_irte_mode()), but doesn't handle the scenario where a postable IRQ comes along while AVIC is inhibited. Link: https://lore.kernel.org/r/20250611224604.313496-45-seanjc@google.com Signed-off-by: Sean Christopherson commit f965255dc5033387ac7858787c6c792fd789ac34 Author: Sean Christopherson Date: Wed Jun 11 15:45:45 2025 -0700 iommu/amd: KVM: SVM: Set pCPU info in IRTE when setting vCPU affinity Now that setting vCPU affinity is guarded with ir_list_lock, i.e. now that avic_physical_id_entry can be safely accessed, set the pCPU info straight-away when setting vCPU affinity. Putting the IRTE into posted mode, and then immediately updating the IRTE a second time if the target vCPU is running is wasteful and confusing. This also fixes a flaw where a posted IRQ that arrives between putting the IRTE into guest_mode and setting the correct destination could cause the IOMMU to ring the doorbell on the wrong pCPU. Link: https://lore.kernel.org/r/20250611224604.313496-44-seanjc@google.com Signed-off-by: Sean Christopherson commit 0b2b541fa3cd85bb06fdd9353764673aa2bfd54a Author: Sean Christopherson Date: Wed Jun 11 15:45:44 2025 -0700 iommu/amd: Factor out helper for manipulating IRTE GA/CPU info Split the guts of amd_iommu_update_ga() to a dedicated helper so that the logic can be shared with flows that put the IRTE into posted mode. Opportunistically move amd_iommu_update_ga() and its new helper above amd_iommu_activate_guest_mode() so that it's all co-located. Link: https://lore.kernel.org/r/20250611224604.313496-43-seanjc@google.com Signed-off-by: Sean Christopherson commit 08d9ccdd1a5c75d7aca7ac3af56f723d780dd6ac Author: Sean Christopherson Date: Wed Jun 11 15:45:43 2025 -0700 iommu/amd: KVM: SVM: Infer IsRun from validity of pCPU destination Infer whether or not a vCPU should be marked running from the validity of the pCPU on which it is running. amd_iommu_update_ga() already skips the IRTE update if the pCPU is invalid, i.e. passing %true for is_run with an invalid pCPU would be a blatant and egregrious KVM bug. Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-42-seanjc@google.com Signed-off-by: Sean Christopherson commit 3be405e89f3daea23ddfcf6b6526ae44ce38dd9a Author: Sean Christopherson Date: Wed Jun 11 15:45:42 2025 -0700 iommu/amd: Document which IRTE fields amd_iommu_update_ga() can modify Add a comment to amd_iommu_update_ga() to document what fields it can safely modify without issuing an invalidation of the IRTE, and to explain its role in keeping GA IRTEs up-to-date. Per page 93 of the IOMMU spec dated Feb 2025: When virtual interrupts are enabled by setting MMIO Offset 0018h[GAEn] and IRTE[GuestMode=1], IRTE[IsRun], IRTE[Destination], and if present IRTE[GATag], are not cached by the IOMMU. Modifications to these fields do not require an invalidation of the Interrupt Remapping Table. Link: https://lore.kernel.org/all/9b7ceea3-8c47-4383-ad9c-1a9bbdc9044a@oracle.com Cc: Joao Martins Link: https://lore.kernel.org/r/20250611224604.313496-41-seanjc@google.com Signed-off-by: Sean Christopherson commit c3d591c91f9c99a35f8cf80d28ea689214a1acf3 Author: Sean Christopherson Date: Wed Jun 11 15:45:41 2025 -0700 KVM: SVM: Take and hold ir_list_lock across IRTE updates in IOMMU Now that svm_ir_list_add() isn't overloaded with all manner of weird things, fold it into avic_pi_update_irte(), and more importantly take ir_list_lock across the irq_set_vcpu_affinity() calls to ensure the info that's shoved into the IRTE is fresh. While preemption (and IRQs) is disabled on the task performing the IRTE update, thanks to irqfds.lock, that task doesn't hold the vCPU's mutex, i.e. preemption being disabled is irrelevant. Link: https://lore.kernel.org/r/20250611224604.313496-40-seanjc@google.com Signed-off-by: Sean Christopherson commit 71d6b3b8e69d8a212c53df1150e559b101d6768b Author: Sean Christopherson Date: Wed Jun 11 15:45:40 2025 -0700 KVM: SVM: Revert IRTE to legacy mode if IOMMU doesn't provide IR metadata Revert the IRTE back to remapping mode if the AMD IOMMU driver mucks up and doesn't provide the necessary metadata. Returning an error up the stack without actually handling the error is useless and confusing. Link: https://lore.kernel.org/r/20250611224604.313496-39-seanjc@google.com Signed-off-by: Sean Christopherson commit cc8b13105eac969bb721c52cf95fd35818b5c54c Author: Sean Christopherson Date: Wed Jun 11 15:45:39 2025 -0700 KVM: x86: Don't update IRTE entries when old and new routes were !MSI Skip the entirety of IRTE updates on a GSI routing change if neither the old nor the new routing is for an MSI, i.e. if the neither routing setup allows for posting to a vCPU. If the IRTE isn't already host controlled, KVM has bigger problems. Link: https://lore.kernel.org/r/20250611224604.313496-38-seanjc@google.com Signed-off-by: Sean Christopherson commit dc6adb13046abe199194f788e5d0dc41c67db5bc Author: Sean Christopherson Date: Wed Jun 11 15:45:38 2025 -0700 KVM: x86: Skip IOMMU IRTE updates if there's no old or new vCPU being targeted Don't "reconfigure" an IRTE into host controlled mode when it's already in the state, i.e. if KVM's GSI routing changes but the IRQ wasn't and still isn't being posted to a vCPU. Link: https://lore.kernel.org/r/20250611224604.313496-37-seanjc@google.com Signed-off-by: Sean Christopherson commit 511754bc548b59e136fcf433da23ba39c74684cf Author: Sean Christopherson Date: Wed Jun 11 15:45:37 2025 -0700 KVM: x86: Track irq_bypass_vcpu in common x86 code Track the vCPU that is being targeted for IRQ bypass, a.k.a. for a posted IRQ, in common x86 code. This will allow for additional consolidation of the SVM and VMX code. Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-36-seanjc@google.com Signed-off-by: Sean Christopherson commit 77bb184ab880171a1cedfbed9ab05977e6ae2258 Author: Sean Christopherson Date: Wed Jun 11 15:45:36 2025 -0700 KVM: Fold kvm_arch_irqfd_route_changed() into kvm_arch_update_irqfd_routing() Fold kvm_arch_irqfd_route_changed() into kvm_arch_update_irqfd_routing(). Calling arch code to know whether or not to call arch code is absurd. Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20250611224604.313496-35-seanjc@google.com Signed-off-by: Sean Christopherson commit b33252b9d17238a4a9fa5a29af6e6a2922a6c2b0 Author: Sean Christopherson Date: Wed Jun 11 15:45:35 2025 -0700 KVM: Don't WARN if updating IRQ bypass route fails Don't bother WARNing if updating an IRTE route fails now that vendor code provides much more precise WARNs. The generic WARN doesn't provide enough information to actually debug the problem, and has obviously done nothing to surface the myriad bugs in KVM x86's implementation. Drop all of the associated return code plumbing that existed just so that common KVM could WARN. Link: https://lore.kernel.org/r/20250611224604.313496-34-seanjc@google.com Signed-off-by: Sean Christopherson commit 53527ea1b70224d16d29edbd5c850456469f00ec Author: Sean Christopherson Date: Wed Jun 11 15:45:34 2025 -0700 iommu: KVM: Split "struct vcpu_data" into separate AMD vs. Intel structs Split the vcpu_data structure that serves as a handoff from KVM to IOMMU drivers into vendor specific structures. Overloading a single structure makes the code hard to read and maintain, is *very* misleading as it suggests that mixing vendors is actually supported, and bastardizing Intel's posted interrupt descriptor address when AMD's IOMMU already has its own structure is quite unnecessary. Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-33-seanjc@google.com Signed-off-by: Sean Christopherson commit 803928483669b41e84c27086ffcf28438c1a8cca Author: Sean Christopherson Date: Wed Jun 11 15:45:33 2025 -0700 KVM: SVM: Clean up return handling in avic_pi_update_irte() Clean up the return paths for avic_pi_update_irte() now that the refactoring dust has settled. Opportunistically drop the pr_err() on IRTE update failures. Logging that a failure occurred without _any_ context is quite useless. Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-32-seanjc@google.com Signed-off-by: Sean Christopherson commit c5af31698d719acf35ec3e3a3610a7c92dac0e6e Author: Sean Christopherson Date: Wed Jun 11 15:45:32 2025 -0700 KVM: x86: Move posted interrupt tracepoint to common code Move the pi_irte_update tracepoint to common x86, and call it whenever the IRTE is modified. Tracing only the modifications that result in an IRQ being posted to a vCPU makes the tracepoint useless for debugging. Drop the vendor specific address; plumbing that into common code isn't worth the trouble, as the address is meaningless without a whole pile of other information that isn't provided in any tracepoint. Link: https://lore.kernel.org/r/20250611224604.313496-31-seanjc@google.com Signed-off-by: Sean Christopherson commit cf04ec393ed08b3d0566f0735675639732dca23a Author: Sean Christopherson Date: Wed Jun 11 15:45:31 2025 -0700 KVM: x86: Dedup AVIC vs. PI code for identifying target vCPU Hoist the logic for identifying the target vCPU for a posted interrupt into common x86. The code is functionally identical between Intel and AMD. Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-30-seanjc@google.com Signed-off-by: Sean Christopherson commit 9517aedecd0e73716b766f5c603518fd6e383454 Author: Sean Christopherson Date: Wed Jun 11 15:45:30 2025 -0700 KVM: x86: Nullify irqfd->producer after updating IRTEs Nullify irqfd->producer (when it's going away) _after_ updating IRTEs so that the producer can be queried during the update. Link: https://lore.kernel.org/r/20250611224604.313496-29-seanjc@google.com Signed-off-by: Sean Christopherson commit f5369619f7f8add44fc5e3d05364d2ed293995fa Author: Sean Christopherson Date: Wed Jun 11 15:45:29 2025 -0700 KVM: x86: Move IRQ routing/delivery APIs from x86.c => irq.c Move a bunch of IRQ routing and delivery APIs from x86.c to irq.c. x86.c has grown quite fat, and irq.c is the perfect landing spot. Opportunistically rewrite kvm_arch_irq_bypass_del_producer()'s comment, as the existing comment has several typos and is rather confusing. Suggested-by: Paolo Bonzini Link: https://lore.kernel.org/r/20250611224604.313496-28-seanjc@google.com Signed-off-by: Sean Christopherson commit 0a64c447f6f81f79b69294c16b28680be59a3649 Author: Sean Christopherson Date: Wed Jun 11 15:45:28 2025 -0700 KVM: SVM: Extract SVM specific code out of get_pi_vcpu_info() Genericize SVM's get_pi_vcpu_info() so that it can be shared with VMX. The only SVM specific information it provides is the AVIC back page, and that can be trivially retrieved by its sole caller. No functional change intended. Cc: Francesco Lavra Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-27-seanjc@google.com Signed-off-by: Sean Christopherson commit 23ca102e6fb284f3c1d08d8bbbddceff2353427f Author: Sean Christopherson Date: Wed Jun 11 15:45:27 2025 -0700 KVM: VMX: Stop walking list of routing table entries when updating IRTE Now that KVM provides the to-be-updated routing entry, stop walking the routing table to find that entry. KVM, via setup_routing_entry() and sanity checked by kvm_get_msi_route(), disallows having a GSI configured to trigger multiple MSIs, i.e. the for-loop can only process one entry. Link: https://lore.kernel.org/r/20250611224604.313496-26-seanjc@google.com Signed-off-by: Sean Christopherson commit 1e663ed239923447a0217d78a96bcdc8729022e0 Author: Sean Christopherson Date: Wed Jun 11 15:45:26 2025 -0700 KVM: SVM: Stop walking list of routing table entries when updating IRTE Now that KVM explicitly passes the new/current GSI routing to pi_update_irte(), simply use the provided routing entry and stop walking the routing table to find that entry. KVM, via setup_routing_entry() and sanity checked by kvm_get_msi_route(), disallows having a GSI configured to trigger multiple MSIs. I.e. this is subtly a glorified nop, as KVM allows at most one MSI per GSI, the for-loop can only ever process one entry, and that entry is the new/current entry (see the WARN_ON_ONCE() added by "KVM: x86: Pass new routing entries and irqfd when updating IRTEs" to ensure @new matches the entry found in the routing table). Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-25-seanjc@google.com Signed-off-by: Sean Christopherson commit 95d50ebe6df80b791d599b1f7434f3a8cac8a84f Author: Sean Christopherson Date: Wed Jun 11 15:45:25 2025 -0700 iommu/amd: KVM: SVM: Pass NULL @vcpu_info to indicate "not guest mode" Pass NULL to amd_ir_set_vcpu_affinity() to communicate "don't post to a vCPU" now that there's no need to communicate information back to KVM about the previous vCPU (KVM does its own tracking). Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-24-seanjc@google.com Signed-off-by: Sean Christopherson commit c4cdbaf9d81c8387da8b9b91567d4b0eb1b8a549 Author: Sean Christopherson Date: Wed Jun 11 15:45:24 2025 -0700 iommu/amd: KVM: SVM: Use pi_desc_addr to derive ga_root_ptr Use vcpu_data.pi_desc_addr instead of amd_iommu_pi_data.base to get the GA root pointer. KVM is the only source of amd_iommu_pi_data.base, and KVM's one and only path for writing amd_iommu_pi_data.base computes the exact same value for vcpu_data.pi_desc_addr and amd_iommu_pi_data.base, and fills amd_iommu_pi_data.base if and only if vcpu_data.pi_desc_addr is valid, i.e. amd_iommu_pi_data.base is fully redundant. Cc: Maxim Levitsky Reviewed-by: Joao Martins Reviewed-by: Vasant Hegde Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-23-seanjc@google.com Signed-off-by: Sean Christopherson commit 52d826c9e54cc6b4f0107720dd1f254944f6e727 Author: Sean Christopherson Date: Wed Jun 11 15:45:23 2025 -0700 KVM: SVM: Add a comment to explain why avic_vcpu_blocking() ignores IRQ blocking Add a comment to explain why KVM clears IsRunning when putting a vCPU, even though leaving IsRunning=1 would be ok from a functional perspective. Per Maxim's experiments, a misbehaving VM could spam the AVIC doorbell so fast as to induce a 50%+ loss in performance. Link: https://lore.kernel.org/all/8d7e0d0391df4efc7cb28557297eb2ec9904f1e5.camel@redhat.com Cc: Maxim Levitsky Acked-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250611224604.313496-22-seanjc@google.com Signed-off-by: Sean Christopherson commit 3ce7cdde66e65a400b2d1b2a7f72c499e1db26b6 Author: Luis Gerhorst Date: Thu Jun 19 16:08:53 2025 +0200 selftests/bpf: Support ppc64el in vmtest With a rootfs built using libbpf's BPF CI [1], we can run specific tests as follows: $ ../libbpf-ci/rootfs/mkrootfs_debian.sh --arch ppc64el --distro noble $ PLATFORM=ppc64el CROSS_COMPILE=powerpc64le-linux-gnu- \ tools/testing/selftests/bpf/vmtest.sh \ -l libbpf-vmtest-rootfs-*-noble-ppc64el.tar.zst \ -- ./test_progs -t verifier_array_access Does not include a DENYLIST or support for KVM for now. [1] https://github.com/libbpf/ci Signed-off-by: Luis Gerhorst Link: https://lore.kernel.org/r/20250619140854.2135283-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit c11f34e30088b25b7e240e12566fcf28f7ad07cc Author: Menglong Dong Date: Sat Jun 21 12:55:01 2025 +0800 bpf: Make update_prog_stats() always_inline The function update_prog_stats() will be called in the bpf trampoline. In most cases, it will be optimized by the compiler by making it inline. However, we can't rely on the compiler all the time, and just make it __always_inline to reduce the possible overhead. Signed-off-by: Menglong Dong Link: https://lore.kernel.org/r/20250621045501.101187-1-dongml2@chinatelecom.cn Signed-off-by: Alexei Starovoitov commit 17cc308b183308bf5ada36e164284fff7eb064ba Author: Shengjiu Wang Date: Fri Jun 20 10:14:03 2025 +0800 ASoC: wm8524: enable constraints when sysclk is configured. In some cases, the sysclk won't be configured on init, and sysclk can be changed in hw_params() according to different sample rate, for example, for 44kHz sample rate, the sysclk is 11.2896MHz, for 48kHz sample rate, the sysclk is 12.288MHz. In order to support the above case, only enable constraints when sysclk is configured, and check the rate in hw_params. So overall there are three cases that need to be considered: - call set_sysclk() on init, then constraints will be initialized. - don't call set_sysclk() on init, but call it after startup(), then constraints will be configured, the constraints can be cleared with call set_sysclk() again in shutdown(). - don't call set_sysclk() in the whole flow, then there are no any constraints. The clocks depend on cpu dai. Enlarge the WM8524_NUM_RATES to 12, as the supported rate range is 8kHz to 192kHz. Signed-off-by: Shengjiu Wang Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20250620021403.624303-1-shengjiu.wang@nxp.com Signed-off-by: Mark Brown commit 94a08721435cc9a8de9f9ce83e9fe13d38d24771 Author: Alexandre Courbot Date: Thu Jun 19 22:23:54 2025 +0900 gpu: nova-core: increase BAR0 size to 16MB The Turing+ register address space spans over that range, so increase it as future patches will access more registers. Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-10-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit e66aaaffe017bffedc98abfcc12afed6214173bc Author: Alexandre Courbot Date: Thu Jun 19 22:23:53 2025 +0900 gpu: nova-core: allow register aliases Some registers (notably scratch registers) don't have a definitive purpose, but need to be interpreted differently depending on context. Expand the register!() macro to support a syntax indicating that a register type should be at the same offset as another one, but under a different name, and with different fields and documentation. Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-9-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit cdfe233ee6cde6b82f0527fe7e0e599d4118b336 Author: Alexandre Courbot Date: Thu Jun 19 22:23:52 2025 +0900 gpu: nova-core: expose the offset of each register as a type constant Although we want to access registers using the provided methods, it is sometimes needed to use their raw offset, for instance when working with a register array. Expose the offset of each register using a type constant to avoid resorting to hardcoded values. Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-8-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 8dd1433d905051f2d2e5ad8864da2de915a2f11f Author: Alexandre Courbot Date: Thu Jun 19 22:23:51 2025 +0900 gpu: nova-core: add delimiter for helper rules in register!() macro This macro is pretty complex, and most rules are just helper, so add a delimiter to indicate when users only interested in using it can stop reading. Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-7-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 8d5fbb8d027d67b015d5fc8e2ca9ef131959dd12 Author: Alexandre Courbot Date: Thu Jun 19 22:23:50 2025 +0900 gpu: nova-core: use absolute paths in register!() macro Fix the paths that were not absolute to prevent a potential local module from being picked up. Reviewed-by: Lyude Paul Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-6-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 06a93197e29d45596d0eba40e7e7b2e6848d31ff Author: Alexandre Courbot Date: Thu Jun 19 22:23:49 2025 +0900 rust: sizes: add constants up to SZ_2G nova-core will need to use SZ_1M, so make the remaining constants available. Reviewed-by: Boqun Feng Signed-off-by: Alexandre Courbot Acked-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250619-nova-frts-v6-5-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit 69ba00fed95769e904e4000ad92ec586e5f49ad6 Author: Alexandre Courbot Date: Thu Jun 19 22:23:48 2025 +0900 rust: make ETIMEDOUT error available We will use this error in the nova-core driver. Reviewed-by: Benno Lossin Signed-off-by: Alexandre Courbot Acked-by: Miguel Ojeda Link: https://lore.kernel.org/r/20250619-nova-frts-v6-4-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit a002488de6e046666b80d928945da037b1da4f64 Merge: e04c78d86a9699 26af856539842a Author: Danilo Krummrich Date: Mon Jun 23 17:53:17 2025 +0200 Merge tag 'topic/dma-features-2025-06-23' of https://github.com/Rust-for-Linux/linux.git DMA features for v6.17 - Clarify wording and be consistent in 'coherent' nomenclature. - Convert the read!() / write!() macros to return a Result. - Add as_slice() / write() methods in CoherentAllocation. - Fix doc-comment of dma_handle(). - Expose count() and size() in CoherentAllocation and add the corresponding type invariants. - Implement CoherentAllocation::dma_handle_with_offset(). commit 6737557442e5d21fef5c613c3079d26a4a4b0744 Author: Sean Christopherson Date: Wed Jun 11 15:45:22 2025 -0700 KVM: VMX: Suppress PI notifications whenever the vCPU is put Suppress posted interrupt notifications (set PID.SN=1) whenever the vCPU is put, i.e. unloaded, not just when the vCPU is preempted, as KVM doesn't do anything in response to a notification IRQ that arrives in the host, nor does KVM rely on the Outstanding Notification (PID.ON) flag when the vCPU is unloaded. And, the cost of scanning the PIR to manually set PID.ON when loading the vCPU is quite small, especially relative to the cost of loading (and unloading) a vCPU. On the flip side, leaving SN clear means a notification for the vCPU will result in a spurious IRQ for the pCPU, even if vCPU task is scheduled out, running in userspace, etc. Even worse, if the pCPU is running a different vCPU, the spurious IRQ could trigger posted interrupt processing for the wrong vCPU, which is technically a violation of the architecture, as setting bits in PIR aren't supposed to be propagated to the vIRR until a notification IRQ is received. The saving grace of the current behavior is that hardware sends notification interrupts if and only if PID.ON=0, i.e. only the first posted interrupt for a vCPU will trigger a spurious IRQ (for each window where the vCPU is unloaded). Ideally, KVM would suppress notifications before enabling IRQs in the VM-Exit, but KVM relies on PID.ON as an indicator that there is a posted interrupt pending in PIR, e.g. in vmx_sync_pir_to_irr(), and sadly there is no way to ask hardware to set PID.ON, but not generate an interrupt. That could be solved by using pi_has_pending_interrupt() instead of checking only PID.ON, but it's not at all clear that would be a performance win, as KVM would end up scanning the entire PIR whenever an interrupt isn't pending. And long term, the spurious IRQ window, i.e. where a vCPU is loaded with IRQs enabled, can effectively be made smaller for hot paths by moving performance critical VM-Exit handlers into the fastpath, i.e. by never enabling IRQs for hot path VM-Exits. Link: https://lore.kernel.org/r/20250611224604.313496-21-seanjc@google.com Signed-off-by: Sean Christopherson commit 8de4a1c8164e5b2e40d1df764840a31de983f40b Author: Maxim Levitsky Date: Wed Jun 11 15:45:21 2025 -0700 KVM: SVM: Disable (x2)AVIC IPI virtualization if CPU has erratum #1235 Disable IPI virtualization on AMD Family 17h CPUs (Zen2 and Zen1), as hardware doesn't reliably detect changes to the 'IsRunning' bit during ICR write emulation, and might fail to VM-Exit on the sending vCPU, if IsRunning was recently cleared. The absence of the VM-Exit leads to KVM not waking (or triggering nested VM-Exit of) the target vCPU(s) of the IPI, which can lead to hung vCPUs, unbounded delays in L2 execution, etc. To workaround the erratum, simply disable IPI virtualization, which prevents KVM from setting IsRunning and thus eliminates the race where hardware sees a stale IsRunning=1. As a result, all ICR writes (except when "Self" shorthand is used) will VM-Exit and therefore be correctly emulated by KVM. Disabling IPI virtualization does carry a performance penalty, but benchmarkng shows that enabling AVIC without IPI virtualization is still much better than not using AVIC at all, because AVIC still accelerates posted interrupts and the receiving end of the IPIs. Note, when virtualizing Self-IPIs, the CPU skips reading the physical ID table and updates the vIRR directly (because the vCPU is by definition actively running), i.e. Self-IPI isn't susceptible to the erratum *and* is still accelerated by hardware. Signed-off-by: Maxim Levitsky [sean: rebase, massage changelog, disallow user override] Acked-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250611224604.313496-20-seanjc@google.com Signed-off-by: Sean Christopherson commit c7e03c5cf06a90ff234ae3c628c6b74e5cba7426 Merge: f86c0036c7de5f 26af856539842a Author: Danilo Krummrich Date: Mon Jun 23 17:38:52 2025 +0200 Merge tag 'topic/dma-features-2025-06-23' into alloc-next DMA features for v6.17 - Clarify wording and be consistent in 'coherent' nomenclature. - Convert the read!() / write!() macros to return a Result. - Add as_slice() / write() methods in CoherentAllocation. - Fix doc-comment of dma_handle(). - Expose count() and size() in CoherentAllocation and add the corresponding type invariants. - Implement CoherentAllocation::dma_handle_with_offset(). commit 337490f0007f910968f828e46501db3091b1a4f8 Author: Eric W. Biederman Date: Tue May 20 17:13:03 2025 -0500 exec: Correct the permission check for unsafe exec Max Kellerman recently experienced a problem[1] when calling exec with differing uid and euid's and he triggered the logic that is supposed to only handle setuid executables. When exec isn't changing anything in struct cred it doesn't make sense to go into the code that is there to handle the case when the credentials change. When looking into the history of the code I discovered that this issue was not present in Linux-2.4.0-test12 and was introduced in Linux-2.4.0-prerelease when the logic for handling this case was moved from prepare_binprm to compute_creds in fs/exec.c. The bug introdused was to comparing euid in the new credentials with uid instead of euid in the old credentials, when testing if setuid had changed the euid. Since triggering the keep ptrace limping along case for setuid executables makes no sense when it was not a setuid exec revert back to the logic present in Linux-2.4.0-test12. This removes the confusingly named and subtlety incorrect helpers is_setuid and is_setgid, that helped this bug to persist. The varaiable is_setid is renamed to id_changed (it's Linux-2.4.0-test12) as the old name describes what matters rather than it's cause. The code removed in Linux-2.4.0-prerelease was: - /* Set-uid? */ - if (mode & S_ISUID) { - bprm->e_uid = inode->i_uid; - if (bprm->e_uid != current->euid) - id_change = 1; - } - - /* Set-gid? */ - /* - * If setgid is set but no group execute bit then this - * is a candidate for mandatory locking, not a setgid - * executable. - */ - if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) { - bprm->e_gid = inode->i_gid; - if (!in_group_p(bprm->e_gid)) - id_change = 1; Linux-2.4.0-prerelease added the current logic as: + if (bprm->e_uid != current->uid || bprm->e_gid != current->gid || + !cap_issubset(new_permitted, current->cap_permitted)) { + current->dumpable = 0; + + lock_kernel(); + if (must_not_trace_exec(current) + || atomic_read(¤t->fs->count) > 1 + || atomic_read(¤t->files->count) > 1 + || atomic_read(¤t->sig->count) > 1) { + if(!capable(CAP_SETUID)) { + bprm->e_uid = current->uid; + bprm->e_gid = current->gid; + } + if(!capable(CAP_SETPCAP)) { + new_permitted = cap_intersect(new_permitted, + current->cap_permitted); + } + } + do_unlock = 1; + } I have condenced the logic from Linux-2.4.0-test12 to just: id_changed = !uid_eq(new->euid, old->euid) || !in_group_p(new->egid); This change is userspace visible, but I don't expect anyone to care. For the bug that is being fixed to trigger bprm->unsafe has to be set. The variable bprm->unsafe is set when ptracing an executable, when sharing a working directory, or when no_new_privs is set. Properly testing for cases that are safe even in those conditions and doing nothing special should not affect anyone. Especially if they were previously ok with their credentials getting munged To minimize behavioural changes the code continues to set secureexec when euid != uid or when egid != gid. [1] https://lkml.kernel.org/r/20250306082615.174777-1-max.kellermann@ionos.com Reported-by: Max Kellermann Fixes: 64444d3d0d7f ("Linux version 2.4.0-prerelease") v1: https://lkml.kernel.org/r/878qmxsuy8.fsf@email.froward.int.ebiederm.org Reviewed-by: Serge Hallyn Signed-off-by: Eric W. Biederman Reviewed-by: Jann Horn Acked-by: Kees Cook commit 5f7e54b23e4d253eff3b10b12d6fa92d28d7dddc Author: Takashi Iwai Date: Mon Jun 23 15:14:32 2025 +0200 ALSA: hda: Handle the jack polling always via a work We used to call directly hda_jackpoll_work() from a couple of places for updating the jack and notify to user-space, but this makes rather the code flow fragile. Namely, because of those direct calls, hda_jackpoll_work() uses snd_hda_power_up_pm() and *_down_pm() calls instead of the standard snd_hda_power_up() and *_down() calls. The latter pair assures the runtime PM resume sync, so it can avoid the race against the PM callbacks gracefully, while the former pair may continue if called concurrently, hence it may race (by design). In this patch, we change the call pattern of hda_jackpoll_work(); now all callers are replaced with the standard snd_hda_jack_report_sync() and the additional schedule_delayed_work(). Since hda_jackpoll_work() is called only from the associated work, it's always outside the PM code path, and we can safely use snd_hda_power_up() and *_down() there instead. This allows us to remove the racy check of power-state in hda_jackpoll_work(), as well as the tricky cancel_delayed_work() and rescheduling at hda_codec_runtime_suspend(). Reported-by: Joakim Zhang Closes: https://lore.kernel.org/20250619020844.2974160-1-joakim.zhang@cixtech.com Tested-by: Joakim Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250623131437.10670-4-tiwai@suse.de commit 507cd1216a6d70da6b230c806862c065632c713f Author: Takashi Iwai Date: Mon Jun 23 15:14:31 2025 +0200 ALSA: hda: Disable codec runtime PM when jack polling is enabled When the jack polling is triggered quite frequently, it makes little sense to perform the runtime PM at each time; since we do almost full configuration at each runtime resume for HD-audio, the merit by power saving would be lost. Hence, it'd be more reasonable to disable the runtime PM when the jack polling is enabled. This patch introduces the runtime PM idle callback and disables the runtime PM when the jack polling is enabled. This also serves as the preliminary change for the further jack poll cleanup. The exception is the case where codec->bus->jackpoll_in_suspend flag is set by the driver (currently set by HD-audio Tegra driver). This flag indicates that the polling is infrequent, hence there is still benefit to perform the runtime PM. The idle callback checks this flag and allows the runtime PM when set. Link: https://lore.kernel.org/20250619020844.2974160-1-joakim.zhang@cixtech.com Tested-by: Joakim Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250623131437.10670-3-tiwai@suse.de commit 1adcbdf54f76e1004bdf71df4eb1888c26e7ad06 Author: Takashi Iwai Date: Mon Jun 23 15:14:30 2025 +0200 ALSA: hda: Disable jack polling at shutdown Although the jack polling is canceled at shutdown in snd_hda_codec_shutdown(), it might be still re-triggered when the work is being processed at cancel_delayed_work_sync() call. This may result in the unexpected hardware access that should have been already disabled. For assuring to stop the jack polling, clear codec->jackpoll_interval at shutdown. Reported-by: Joakim Zhang Closes: https://lore.kernel.org/20250619020844.2974160-4-joakim.zhang@cixtech.com Tested-by: Joakim Zhang Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250623131437.10670-2-tiwai@suse.de commit 26af856539842a4107c821e133fdda896022737f Author: Alexandre Courbot Date: Thu Jun 19 22:23:47 2025 +0900 rust: dma: add dma_handle_with_offset method to CoherentAllocation Sometimes one may want to obtain a DMA handle starting at a given offset. This can be done by adding said offset to the result of `dma_handle()`, but doing so on the client side carries the risk that the operation will go outside the bounds of the allocation. Thus, add a `dma_handle_with_offset` method that adds the desired offset after checking that it is still valid. Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-3-ecf41ef99252@nvidia.com Signed-off-by: Danilo Krummrich commit c0a3065d5def59a894afc8cf5e988396cd0c2f5e Author: Alexandre Courbot Date: Thu Jun 19 22:23:46 2025 +0900 rust: dma: expose the count and size of CoherentAllocation These properties are very useful to have (and to be used by nova-core) and should be accessible, hence add them. Additionally, add type invariants for the size of an allocation. Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-2-ecf41ef99252@nvidia.com [ Slightly extend the commit message. - Danilo ] Signed-off-by: Danilo Krummrich commit 14371e58cb2705b9ddc00efc3b94fb32612a753e Author: Alexandre Courbot Date: Thu Jun 19 22:23:45 2025 +0900 rust: dma: fix doc-comment of dma_handle() A word was apparently missing in this sentence, hence fix it. Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250619-nova-frts-v6-1-ecf41ef99252@nvidia.com Fixes: ad2907b4e308 ("rust: add dma coherent allocator abstraction") [ Slightly expand commit subject and add 'Fixes:' tag. - Danilo ] Signed-off-by: Danilo Krummrich commit d5363522042bca867f45174b4d5a8b5a39eae989 Author: Thorsten Blum Date: Mon Jun 23 13:38:54 2025 +0200 ALSA: mixer_oss: Remove deprecated strcpy() function calls Remove the deprecated strcpy() function calls and assign the strings directly to a 'char *' instead. Use 'if/else if' instead of two separate if statements. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250623113855.37031-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 9e4ed359b8efad0e8ad4510d8ad22bf0b060526a Author: Pavel Begunkov Date: Mon Jun 16 10:46:29 2025 +0100 io_uring/netcmd: add tx timestamping cmd support Add a new socket command which returns tx time stamps to the user. It provide an alternative to the existing error queue recvmsg interface. The command works in a polled multishot mode, which means io_uring will poll the socket and keep posting timestamps until the request is cancelled or fails in any other way (e.g. with no space in the CQ). It reuses the net infra and grabs timestamps from the socket's error queue. The command requires IORING_SETUP_CQE32. All non-final CQEs (marked with IORING_CQE_F_MORE) have cqe->res set to the tskey, and the upper 16 bits of cqe->flags keep tstype (i.e. offset by IORING_CQE_BUFFER_SHIFT). The timevalue is store in the upper part of the extended CQE. The final completion won't have IORING_CQE_F_MORE and will have cqe->res storing 0/error. Suggested-by: Vadim Fedorenko Acked-by: Willem de Bruijn Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/92ee66e6b33b8de062a977843d825f58f21ecd37.1750065793.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit ac479eac22e81c0ff56c6bdb93fad787015149cc Author: Pavel Begunkov Date: Mon Jun 16 10:46:28 2025 +0100 io_uring: add mshot helper for posting CQE32 Add a helper for posting 32 byte CQEs in a multishot mode and add a cmd helper on top. As it specifically works with requests, the helper ignore the passed in cqe->user_data and sets it to the one stored in the request. The command helper is only valid with multishot requests. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/c29d7720c16e1f981cfaa903df187138baa3946b.1750065793.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit b95575495948a81ac9b0110aa721ea061dd850d9 Author: Pavel Begunkov Date: Mon Jun 16 10:46:27 2025 +0100 io_uring/cmd: allow multishot polled commands Some commands like timestamping in the next patch can make use of multishot polling, i.e. REQ_F_APOLL_MULTISHOT. Add support for that, which is condensed in a single helper called io_cmd_poll_multishot(). The user who wants to continue with a request in a multishot mode must call the function, and only if it returns 0 the user is free to proceed. Apart from normal terminal errors, it can also end up with -EIOCBQUEUED, in which case the user must forward it to the core io_uring. It's forbidden to use task work while the request is executing in a multishot mode. The API is not foolproof, hence it's not exported to modules nor exposed in public headers. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/bcf97c31659662c72b69fc8fcdf2a88cfc16e430.1750065793.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 162151889267089bb920609830c35f9272087c3f Author: Pavel Begunkov Date: Mon Jun 16 10:46:26 2025 +0100 io_uring/poll: introduce io_arm_apoll() In preparation to allowing commands to do file polling, add a helper that takes the desired poll event mask and arms it for polling. We won't be able to use io_arm_poll_handler() with IORING_OP_URING_CMD as it tries to infer the mask from the opcode data, and we can't unify it across all commands. Signed-off-by: Pavel Begunkov Link: https://lore.kernel.org/r/7ee5633f2dc45fd15243f1a60965f7e30e1c48e8.1750065793.git.asml.silence@gmail.com Signed-off-by: Jens Axboe commit 5be5726e1a237cb3c2dfa39cb3edcaa4512664df Merge: cb9ccfb404e700 2410251cde0bac Author: Jens Axboe Date: Mon Jun 23 08:59:38 2025 -0600 Merge branch 'timestamp-for-jens' of https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next into for-6.17/io_uring Pull networking side timestamp prep patch from Jakub. * 'timestamp-for-jens' of https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: net: timestamp: add helper returning skb's tx tstamp commit cb9ccfb404e700dc0db59d68242d79fe386bb3f0 Author: Jens Axboe Date: Fri Jun 13 17:05:19 2025 -0600 io_uring/nop: add IORING_NOP_TW completion flag To test and profile the overhead of io_uring task_work and the various types of it, add IORING_NOP_TW which tells nop to signal completions through task_work rather than complete them inline. Signed-off-by: Jens Axboe commit ecf47d452ced9be162831192fcfb3e9f5cdcde7f Author: Jens Axboe Date: Thu Jun 5 11:39:17 2025 -0600 io_uring/uring_cmd: implement ->sqe_copy() to avoid unnecessary copies uring_cmd currently copies the full SQE at prep time, just in case it needs it to be stable. However, for inline completions or requests that get queued up on the device side, there's no need to ever copy the SQE. This is particularly important, as various use cases of uring_cmd will be using 128b sized SQEs. Opt in to using ->sqe_copy() to let the core of io_uring decide when to copy SQEs. This callback will only be called if it is safe to do so. Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit ead21053bf34941c7c7bf680d29b8d15af5406de Author: Jens Axboe Date: Tue Jun 3 14:00:27 2025 -0600 io_uring/uring_cmd: get rid of io_uring_cmd_prep_setup() It's a pretty pointless helper, just allocates and copies data. Fold it into io_uring_cmd_prep(). Reviewed-by: Caleb Sander Mateos Reviewed-by: Anuj Gupta Signed-off-by: Jens Axboe commit af19388a973877b2349df46c4487a789cd3148ed Author: Jens Axboe Date: Thu Jun 5 11:33:52 2025 -0600 io_uring: add struct io_cold_def->sqe_copy() method Will be called by the core of io_uring, if inline issue is not going to be tried for a request. Opcodes can define this handler to defer copying of SQE data that should remain stable. Only called if IO_URING_F_INLINE is set. If it isn't set, then there's a bug in the core handling of this, and -EFAULT will be returned instead to terminate the request. This will trigger a WARN_ON_ONCE(). Don't expect this to ever trigger, and down the line this can be removed. Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit 4d811e395bbe54ba2febb3940d4b6c4741f360a6 Author: Jens Axboe Date: Thu Jun 5 11:48:33 2025 -0600 io_uring: add IO_URING_F_INLINE issue flag Set when the execution of the request is done inline from the system call itself. Any deferred issue will never have this flag set. Reviewed-by: Caleb Sander Mateos Signed-off-by: Jens Axboe commit cf899c0777b8d780dd6f82317bbe561deb6c7d1c Author: Ville Syrjälä Date: Tue Jun 17 20:07:59 2025 +0300 drm/i915/dmc: Do not enable the pipe DMC on TGL when PSR is possible On TGL/derivatives the pipe DMC state is lost when PG1 is disabled, and the main DMC does not restore any of it. This means the state will also be lost during PSR+DC5/6. It seems safest to not even enable the pipe DMC in that case (the main DMC does restore the pipe DMC enable bit in PIPEDMC_CONTROL_A for some reason). Since pipe DMC is only needed for "fast LACE" on these platforms we aren't actually losing anything here. In the future if we do want to enable "fast LACE" we'll just have to remember that it won't be compatible with PSR. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250617170759.19552-10-ville.syrjala@linux.intel.com commit 7a8ccadb5425bc42468d2866c1a5ad273cb2c2c3 Author: Ville Syrjälä Date: Tue Jun 17 20:07:58 2025 +0300 drm/i915/dmc: Pass crtc_state to intel_dmc_{enable,disable}_pipe() I'll need to examine the crtc state during intel_dmc_enable_pipe(). To that end pass the whole crtc into intel_dmc_{enable,disable}_pipe(). Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250617170759.19552-9-ville.syrjala@linux.intel.com commit 43175c92d403828563e3e4d74f94f13a07dca657 Author: Ville Syrjälä Date: Tue Jun 17 20:07:57 2025 +0300 drm/i915/dmc: Assert DMC is loaded harder Currently we have some asserts to make sure the main DMC has been loaded. Add similar asserts for the pipe DMCs. And we might as well just check all the mmio registers the firmware has asked us to initialize. That also covers the hardcoded SSP/HTP registers we were checking for the main DMC. TODO: Maybe always configure DMC_EVT_CTL_ENABLE the way the firmware has it set so that we wouldn't need to special case in the assert? v2: Also assert in intel_dmc_load_program() Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250617170759.19552-8-ville.syrjala@linux.intel.com commit 7184a994cf7629dfb0440cdf05dc9407964d9eb5 Author: Ville Syrjälä Date: Tue Jun 17 20:07:56 2025 +0300 drm/i915/dmc: Reload pipe DMC MMIO registers for pipe C/D on various platforms On ADL/MTL pipe DMC MMIO state evidently lives in PG0. The main DMC saves/restores it for pipes A/B, but for pipes C/D we have to do it in the driver. On PTL the situation is mostly the same, except the main DMC firmware doesn't seem to have the PG0 save/restore code anymore, and instead the hardware (or maybe Punit?) seems to take care of this job now. Pipes C/D still need a manual restore by the driver. On LNL I've been unable to lose any pipe DMC state, despite the main DMC firmware still implementing the PG0 save/restore for pipes A/B. Not sure what's going on here. On DG2 I've also not been able to lose the pipe DMC state. DG2 doesn't support DC6, so that might explain part of it. But even DC9 doesn't make a difference here. Perhaps PG0 is just always on for DG2? BMG I've not tested at all. The main DMC firmware does appaer to implement the PG0 pipe A/B save/restore logic. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250617170759.19552-7-ville.syrjala@linux.intel.com Reviewed-by: Uma Shankar commit 761748679e80cc429f035bcb64662becf0ecf4f6 Author: Ville Syrjälä Date: Tue Jun 17 20:07:55 2025 +0300 drm/i915/dmc: Reload pipe DMC state on TGL when enabling pipe A On TGL/derivatives the entire pipe DMC state (program + MMIO) is lost when PG1 is disabled, and the main DMC does not restore any of it. Reload the state when enabling a pipe. The other option would be to not load the pipe DMC at all since it's only needed for "fast LACE" (which we don't use) on these platforms. But let's keep it around just in case we ever decide that "fast LACE" is something we want. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250617170759.19552-6-ville.syrjala@linux.intel.com commit c541ad77a394e186a34e6af5e1b6057827c42659 Author: Ville Syrjälä Date: Tue Jun 17 20:07:54 2025 +0300 drm/i915/dmc: Extract dmc_load_program() We'll be needing to reload the program for individual DMCs. To make that possible pull the code to load the program for a single DMC into a new function. This does change the order of things during init/resume a bit; previously we loaded the program RAM for all DMCs first, and then loaded the MMIO registers for all DMCs. Now those operations will be interleaved between different DMCs. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250617170759.19552-5-ville.syrjala@linux.intel.com commit f9875cc9e2a5edc1fbc30bd90f5f845018be877d Author: Ville Syrjälä Date: Tue Jun 17 20:07:53 2025 +0300 drm/i915/dmc: Shuffle code around Shuffle the DMC_EVT_CTL related stuff around once more. We'll need this stuff during intel_dmc_enable_pipe(), and this lets us avoid forward declarations. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250617170759.19552-4-ville.syrjala@linux.intel.com commit eddc8a0572b951af5a9da464d763bf2f81bad1c1 Author: Ville Syrjälä Date: Tue Jun 17 20:07:52 2025 +0300 drm/i915/dmc: Parametrize MTL_PIPEDMC_GATING_DIS The MTL+ pipe DMC clock gating bits can be parametrized. Make it so. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250617170759.19552-3-ville.syrjala@linux.intel.com commit 42a7bf8aa730606ae89b60c1058c50866f240e5d Author: Ville Syrjälä Date: Tue Jun 17 20:07:51 2025 +0300 drm/i915/dmc: Limit pipe DMC clock gating w/a to just ADL/DG2/MTL Supposedly nothing post-MTL (even BMG) needs the pipe DMC clock gating w/a (Wa_16015201720), so don't apply it. TODO: check if the ADL/DG2 "clock gating needed during DMC loading" part is actually needed, not seeing anything in the docs about it... Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250617170759.19552-2-ville.syrjala@linux.intel.com commit 05062834350f0bf7ad1abcebc2807220e90220eb Author: Tamizh Chelvam Raja Date: Fri Jun 6 10:19:36 2025 +0530 wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type() In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could become NULL and that would trigger kernel panic. Since the caller ath12k_dp_tx() already has a valid ab pointer, pass it directly to avoid panic and unnecessary dereferencing. PC points to "ath12k_dp_tx+0x228/0x988 [ath12k]" LR points to "ath12k_dp_tx+0xc8/0x988 [ath12k]". The Backtrace obtained is as follows: ath12k_dp_tx+0x228/0x988 [ath12k] ath12k_mac_tx_check_max_limit+0x608/0x920 [ath12k] ieee80211_process_measurement_req+0x320/0x348 [mac80211] ieee80211_tx_dequeue+0x9ac/0x1518 [mac80211] ieee80211_tx_dequeue+0xb14/0x1518 [mac80211] ieee80211_tx_prepare_skb+0x224/0x254 [mac80211] ieee80211_xmit+0xec/0x100 [mac80211] __ieee80211_subif_start_xmit+0xc50/0xf40 [mac80211] ieee80211_subif_start_xmit+0x2e8/0x308 [mac80211] netdev_start_xmit+0x150/0x18c dev_hard_start_xmit+0x74/0xc0 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Fixes: e93bbd65547e ("wifi: ath12k: fix packets are sent in native wifi mode while we set raw mode") Signed-off-by: Tamizh Chelvam Raja Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250606044936.3989400-1-tamizh.raja@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 54c350055b1da2767f18a49c11e4fcc42cf33ff8 Author: P Praneesh Date: Tue Jun 3 16:05:42 2025 +0530 wifi: ath12k: Fix double budget decrement while reaping monitor ring Currently, the budget for monitor ring is reduced during each ring entry reaping and again when the end reason is HAL_MON_END_OF_PPDU, leading to inefficient budget use. The below mentioned commit intended to decrement the budget only for HAL_MON_END_OF_PPDU but did not remove the other decrement. Fix this by eliminating the budget decrement for each ring entry reaping, ensuring the driver always reaps one full PPDU worth of entries from the monitor destination ring. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: 394a3fa7c538 ("wifi: ath12k: Optimize NAPI budget by adjusting PPDU processing") Signed-off-by: P Praneesh Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250603103542.1164713-1-praneesh.p@oss.qualcomm.com Signed-off-by: Jeff Johnson commit b79742b84e16e41c4a09f3126436f39f36e75c06 Author: Raj Kumar Bhagat Date: Mon Jun 9 08:48:50 2025 +0530 wifi: ath12k: Enable REO queue lookup table feature on QCN9274 hw2.0 The commit 89ac53e96217 ("wifi: ath12k: Enable REO queue lookup table feature on QCN9274") originally intended to enable the reoq_lut_support hardware parameter flag for both QCN9274 hw1.0 and hw2.0. However, it enabled it only for QCN9274 hw1.0. Hence, enable REO queue lookup table feature on QCN9274 hw2.0. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Raj Kumar Bhagat Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250609-qcn9274-reoq-v1-1-a92c91abc9b9@quicinc.com Signed-off-by: Jeff Johnson commit c19c24c3b9e2c4d656472738f67ffc68a9b85cb0 Author: Jeff Johnson Date: Wed Jun 11 09:13:58 2025 -0700 wifi: ath12k: Add missing include of export.h Commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") introduced a new check that is producing the following warning: drivers/net/wireless/ath/ath12k/core.c: warning: EXPORT_SYMBOL() is used, but #include is missing Add the missing #include to satisfy the check. Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250611-ath-unused-export-v1-5-c36819df7e7b@oss.qualcomm.com Signed-off-by: Jeff Johnson commit f204e0377efeb5f42c7c518febf82f4af32567f0 Author: Jeff Johnson Date: Wed Jun 11 09:13:57 2025 -0700 wifi: ath11k: Add missing include of export.h Commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") introduced a new check that is producing the following warnings: drivers/net/wireless/ath/ath11k/ce.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath11k/core.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath11k/coredump.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath11k/debug.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath11k/debugfs.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath11k/dp.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath11k/fw.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath11k/hal.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath11k/pcic.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath11k/qmi.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath11k/trace.c: warning: EXPORT_SYMBOL() is used, but #include is missing Add the missing #include to satisfy the check. Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250611-ath-unused-export-v1-4-c36819df7e7b@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 32c3a0f8894311c743b2a6a15b50b13d01411ce1 Author: Jeff Johnson Date: Wed Jun 11 09:13:56 2025 -0700 wifi: ath10k: Add missing include of export.h Commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") introduced a new check that is producing the following warnings: drivers/net/wireless/ath/ath10k/bmi.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath10k/ce.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath10k/core.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath10k/coredump.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath10k/debug.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath10k/htc.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath10k/htt_rx.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath10k/htt_tx.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath10k/mac.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath10k/trace.c: warning: EXPORT_SYMBOL() is used, but #include is missing Add the missing #include to satisfy the check. Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250611-ath-unused-export-v1-3-c36819df7e7b@oss.qualcomm.com Signed-off-by: Jeff Johnson commit e435827f6d0c4ace62cc9dfed5e337fa4549994a Author: Jeff Johnson Date: Wed Jun 11 09:13:55 2025 -0700 wifi: ath9k: Add missing include of export.h Commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") introduced a new check that is producing the following warnings: drivers/net/wireless/ath/ath9k/common-beacon.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath9k/common-debug.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath9k/common-init.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath9k/common-spectral.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath9k/common.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath9k/dynack.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/net/wireless/ath/ath9k/hw.c: warning: EXPORT_SYMBOL() is used, but #include is missing Add the missing #include to satisfy the check. Acked-by: Toke Høiland-Jørgensen Link: https://patch.msgid.link/20250611-ath-unused-export-v1-2-c36819df7e7b@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 3abe2740e50f86401aa3518e9b69c6abefaa020a Author: Jeff Johnson Date: Wed Jun 11 09:13:54 2025 -0700 wifi: ath: Add missing include of export.h Commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") introduced a new check that is producing the following warning: drivers/net/wireless/ath/main.c: warning: EXPORT_SYMBOL() is used, but #include is missing Add the missing #include to satisfy the check. Link: https://patch.msgid.link/20250611-ath-unused-export-v1-1-c36819df7e7b@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 7c0884fcd2ddde0544d2e77f297ae461e1f53f58 Author: Karthikeyan Kathirvel Date: Mon May 26 09:17:13 2025 +0530 wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to out-of-bounds access in peer->rx_tid[]. Hence, add a decrement operation for TID, before peer cleanup to ensures proper cleanup and prevents out-of-bounds access issues when the RX peer frag setup fails. Found during code review. Compile tested only. Signed-off-by: Karthikeyan Kathirvel Signed-off-by: Sarika Sharma Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250526034713.712592-1-quic_sarishar@quicinc.com Signed-off-by: Jeff Johnson commit 359d69285adc4f4a6a4bdafac30f3bd917873bbc Author: P Praneesh Date: Thu Jun 5 11:14:38 2025 +0530 wifi: ath12k: remove monitor handling from ath12k_dp_rx_deliver_msdu() ath12k_dp_rx_deliver_msdu() currently includes logic related to monitor mode handling. This code was inherited from the ath11k driver, where a single rx handler was used for both regular and monitor mode packets. In ath12k, however, monitor mode packets are handled separately via ath12k_dp_mon_rx_deliver_msdu(), which contains all the necessary monitor-specific logic. Therefore, monitor-related checks and operations in ath12k_dp_rx_deliver_msdu() are no longer needed. Remove this dead code to simplify the rx path and avoid unnecessary per-packet checks. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Signed-off-by: P Praneesh Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250605054438.1855365-1-praneesh.p@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 66e865f9dc78d00e6d1c8c6624cb0c9004e5aafb Author: Baochen Qiang Date: Fri May 23 11:49:02 2025 +0800 wifi: ath12k: install pairwise key first As station, WCN7850 firmware requires pairwise key to be installed before group key. Currently host does not care about this, so it is up to kernel or userspace to decide which one will be installed first. In case above requirement is not met, WCN7850 firmware's EAPOL station machine is messed up, and finally connection fails [1]. Reorder key install for station interface in that case: this is done by caching group key first; Later when pairwise key arrives, both can be installed in required order. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00217-QCAHKSWPL_SILICONZ-1 Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218733 Link: https://lore.kernel.org/all/AS8P190MB12051DDBD84CD88E71C40AD7873F2@AS8P190MB1205.EURP190.PROD.OUTLOOK.COM # [1] Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250523-ath12k-unicast-key-first-v1-2-f53c3880e6d8@quicinc.com Signed-off-by: Jeff Johnson commit 49375e11819b0d0f59ba59726d8e0b47656f5406 Author: Baochen Qiang Date: Fri May 23 11:49:01 2025 +0800 wifi: ath12k: avoid bit operation on key flags WMI_KEY_PAIRWISE and WMI_KEY_GROUP are not bit fields, change bit operation to direct assignment to avoid confusion. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00217-QCAHKSWPL_SILICONZ-1 Signed-off-by: Baochen Qiang Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250523-ath12k-unicast-key-first-v1-1-f53c3880e6d8@quicinc.com Signed-off-by: Jeff Johnson commit 906619a0096747adbce9415e10b639cfd2c5e714 Author: Aditya Kumar Singh Date: Tue Jun 17 09:05:59 2025 +0530 wifi: ath12k: handle regulatory hints during mac registration If a regulatory notification is there in the system while the hardware is being registered, it attempts to set the new regulatory country. However, ath12k currently boots with a default country derived from the BDF. If this default country differs from the one provided in the notification, a race condition can occur while updating the regulatory information back to userspace. This potentially leads to driver having the incorrect regulatory applied. For example, suppose the regulatory domain for France (FR) is already applied, and then the driver is loaded with a BDF that has the United States (US) country programmed. When the driver finishes loading, the regulatory domain shown in phyX still reflects the US regulatory settings. This is incorrect, as the driver had already received a notification for FR during hardware registration, but failed to process it properly due to the race condition. The race condition exists during driver initialization and hardware registration: - On driver load, the firmware sends BDF-based country regulatory rules, which are stored in default_regd via ath12k_reg_handle_chan_list(). - During hardware registration, a regulatory notification is triggered through: ath12k_mac_hw_register() -> ieee80211_register_hw() -> wiphy_register() -> wiphy_regulatory_register() -> reg_call_notifier() This sends a country code to the firmware, which responds with updated regulatory rules. - After registration, ath12k_mac_hw_register() calls ath12k_regd_update(), which copies default_regd and passes it to the upper layers. The race occurs between the firmware's response and the execution of ath12k_regd_update(). If the firmware's new rules are processed before the update call, the correct values are used. Otherwise, outdated boot-time country settings are exposed to userspace. To resolve this issue, introduce a completion mechanism within the hardware group (ah). Trigger this completion whenever a regulatory change is requested from the firmware. Then, in ath12k_regd_update(), wait for the firmware to complete its regulatory processing before proceeding with the update. This ensures that during driver load, the default country is processed first. However, before ath12k_regd_update() is called, the new regulatory notification will have already been received by the driver. As a result, it will wait for the firmware's regulatory processing to complete, and only the final, correct regulatory domain will be updated to userspace. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Aditya Kumar Singh Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250617-handle_user_regd_update_hints_during_insmod-v2-1-10a6a48efe81@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 437c7a2db6a34db2a9048920694a2bf9b0169726 Author: Kang Yang Date: Thu Jun 5 16:25:28 2025 +0800 wifi: ath12k: update channel list in worker when wait flag is set With previous patch [1], ath12k_reg_update_chan_list() will be called during reg_process_self_managed_hint(). reg_process_self_managed_hint() will hold rtnl_lock all the time. But ath12k_reg_update_chan_list() may increase the occupation time of rtnl_lock, because when wait flag is set, wait_for_completion_timeout() will be called during 11d/hw scan. Should minimize the occupation time of rtnl_lock as much as possible to avoid interfering with rest of the system. So move the update channel list operation to a new worker, so that wait_for_completion_timeout() won't be called with the rtnl_lock held. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0.c5-00481-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: f335295aa29c ("wifi: ath12k: avoid deadlock during regulatory update in ath12k_regd_update()") #[1] Signed-off-by: Kang Yang Reviewed-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250605082528.701-1-kang.yang@oss.qualcomm.com Signed-off-by: Jeff Johnson commit acc152f9be205d76771f8156002d55c3fcd21252 Author: Rameshkumar Sundaram Date: Thu May 22 16:45:14 2025 +0530 wifi: ath12k: combine channel list for split-phy devices in single-wiphy When two split-phy devices that support overlapping frequency ranges within the same band are grouped into an ath12k hardware (HW) setup, they share a common wiphy instance. Consequently, the channel list (wiphy->bands[]) becomes unified across all associated radios (ar). For reference, the devices are: 2.4 GHz + 5 GHz Low Band 5 GHz High Band + 6 GHz The first radio probed within the 5 GHz range (say 5 GHz Low Band) updates its sband reference (&ar->mac.sbands[NL80211_BAND_5GHZ]) within wiphy->bands[]. However, when the second 5 GHz radio (5 GHz High Band) is probed, it replaces the existing wiphy->bands[] entry with its own sub-band reference. As a result, wiphy->bands[] always reflects the channel list from the most recently probed radio in that band, restricting supported channels to those within its specific range for upper-layer. Fix this by updating the wiphy->bands[] to just enable the channels of current radio when there exist a radio which already has set it. This will make sure wiphy->bands[] holds reference of first radio which got probed in 5 GHz band and subsequent radio just updates the channel list in the same address space. Since same sband memory space is shared between radios of a band, while determining the allowed frequency range of radio, its frequency limits (ar->freq_range.start_freq, end_freq) should be used. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1 Signed-off-by: Rameshkumar Sundaram Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250522111514.3735107-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson commit feed05f1526e81677f508b026fd2d66d178f65f8 Author: Rameshkumar Sundaram Date: Thu May 8 01:18:32 2025 +0530 wifi: ath12k: Split scan request for split band device When two split-phy devices having supported frequency range in same band (as mentioned below) are combined into an ath12k HW group, they will be part of same wiphy and hence the channel list (wiphy->bands[]) will be common for all of the radios (ar). 1 - 2.4 GHz + 5 GHz Low band 2 - 5 GHz High band + 6 GHz When a scan is triggered with frequency list containing frequencies of both 5 GHz low and 5 GHz high, mac80211 generates a single scan request to driver with both the frequencies. This is because mac80211 splits the scan request based on band. ath12k checks the first frequency in the requested scan frequency list and initiates scan to corresponding radio's(ar) firmware with all the frequencies. Firmware rejects this scan as some frequencies in the scan request are not supported, resulting is scan failure. Fix this by splitting the scan request into multiples scans in driver based on the supported frequency range of different radios in a band and schedule scans in parallel to them. Finally send scan completion/abort notification to mac80211 after all the radios complete their scheduled scan. Also, last_scan_link is not needed anymore as ath12k internally schedules multiple scans, remove the same and use ahvif->links_map to identify scan links when scan is cancelled. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Co-developed-by: Vignesh C Signed-off-by: Vignesh C Signed-off-by: Rameshkumar Sundaram Reviewed-by: Mahendran P Link: https://patch.msgid.link/20250507194832.2501668-3-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 14c7d7eac1bfc29917acedb894e09dae6c00a014 Author: Rameshkumar Sundaram Date: Thu May 8 01:18:31 2025 +0530 wifi: ath12k: Prepare ahvif scan link for parallel scan When two split-phy devices that support overlapping frequency ranges within the same band(say 5 GHz low and 5 GHz high) are grouped into an ath12k hardware (HW) setup, they share a common wiphy instance. Consequently, the channel list (wiphy->bands[]) becomes unified across all associated radios (ar). When a scan is triggered with frequency list containing frequencies of both 5 GHz low and 5 GHz high, mac80211 generates a single scan request to driver with all the frequencies. This is because mac80211 splits the scan request based on band. ath12k checks the first frequency in the requested scan frequency list and initiates scan to corresponding radio's(ar) firmware with all the frequencies. Firmware rejects this scan since some of the frequencies in the scan request are not supported, resulting in a scan failure. To fix this ath12k driver should split the scan request into multiple scans based on requested frequencies and schedule them to corresponding underlying radio(s) in parallel. Currently, ath12k driver assigns the scan link (link 15) in ahvif->links[] for scan vdev creation. However, with parallel scan support being introduced in the following patch, multiple radios (e.g., 5 GHz low and 5 GHz high) in the same HW group may attempt to use the same scan link concurrently, causing conflicts where the vdev created by one radio could be deleted and re-initialized by another. To address this, reserve space for additional scan links for each radio in a MLO group and allow subsequent radios to use different available scan links (ahvif->link[15..MAX_SCAN_LINKS]) when scan link (15) is pre-occupied. While at it, rename ATH12K_DEFAULT_SCAN_LINK as ATH12K_FIRST_SCAN_LINK as there is no longer only one scan link. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Signed-off-by: Rameshkumar Sundaram Reviewed-by: Mahendran P Link: https://patch.msgid.link/20250507194832.2501668-2-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 0f9842b0b0e58173ae0d4f9838e4d9375b29a38b Author: Karthik M Date: Tue May 6 14:49:30 2025 -0700 wifi: ath12k: disable pdev for non supported country In MLO configuration, ath12k_mac_radio_start() iterates through all the radios and makes the ar state 'ON'. Even though some bands are not supported in certain countries, ath12k_reg_update_chan_list() tries to update the channel list for all the active pdevs and ends up in the warn_on for non-supported band. To prevent this, disable the pdev when the number of channels across all bands supported by the pdev is zero for a particular country. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.3.1-00173-QCAHKSWPL_SILICONZ-1 Signed-off-by: Karthik M Signed-off-by: Muna Sinada Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250506214930.3561348-1-muna.sinada@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 36670b67de18f1e5d34900c5d2ac60a8970c293c Author: Rameshkumar Sundaram Date: Thu Jun 19 00:26:35 2025 +0530 wifi: ath12k: Avoid accessing uninitialized arvif->ar during beacon miss During beacon miss handling, ath12k driver iterates over active virtual interfaces (vifs) and attempts to access the radio object (ar) via arvif->deflink->ar. However, after commit aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO"), arvif is linked to a radio only after vdev creation, typically when a channel is assigned or a scan is requested. For P2P capable devices, a default P2P interface is created by wpa_supplicant along with regular station interfaces, these serve as dummy interfaces for P2P-capable stations, lack an associated netdev and initiate frequent scans to discover neighbor p2p devices. When a scan is initiated on such P2P vifs, driver selects destination radio (ar) based on scan frequency, creates a scan vdev, and attaches arvif to the radio. Once the scan completes or is aborted, the scan vdev is deleted, detaching arvif from the radio and leaving arvif->ar uninitialized. While handling beacon miss for station interfaces, P2P interface is also encountered in the vif iteration and ath12k_mac_handle_beacon_miss_iter() tries to dereference the uninitialized arvif->deflink->ar. Fix this by verifying that vdev is created for the arvif before accessing its ar during beacon miss handling and similar vif iterator callbacks. ========================================================================== wlp6s0: detected beacon loss from AP (missed 7 beacons) - probing KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 5 UID: 0 PID: 0 Comm: swapper/5 Not tainted 6.16.0-rc1-wt-ath+ #2 PREEMPT(full) RIP: 0010:ath12k_mac_handle_beacon_miss_iter+0xb5/0x1a0 [ath12k] Call Trace: __iterate_interfaces+0x11a/0x410 [mac80211] ieee80211_iterate_active_interfaces_atomic+0x61/0x140 [mac80211] ath12k_mac_handle_beacon_miss+0xa1/0xf0 [ath12k] ath12k_roam_event+0x393/0x560 [ath12k] ath12k_wmi_op_rx+0x1486/0x28c0 [ath12k] ath12k_htc_process_trailer.isra.0+0x2fb/0x620 [ath12k] ath12k_htc_rx_completion_handler+0x448/0x830 [ath12k] ath12k_ce_recv_process_cb+0x549/0x9e0 [ath12k] ath12k_ce_per_engine_service+0xbe/0xf0 [ath12k] ath12k_pci_ce_workqueue+0x69/0x120 [ath12k] process_one_work+0xe3a/0x1430 Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.4.1-00199-QCAHKSWPL_SILICONZ-1 Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00284.1-QCAHMTSWPL_V1.0_V2.0_SILICONZ-3 Fixes: aa80f12f3bed ("wifi: ath12k: defer vdev creation for MLO") Signed-off-by: Rameshkumar Sundaram Reviewed-by: Vasanthakumar Thiagarajan Link: https://patch.msgid.link/20250618185635.750470-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Jeff Johnson commit 82a4277fa5e027028b955982ea876e24f660f808 Author: Tanmay Shah Date: Wed Jun 18 11:19:33 2025 -0700 remoteproc: xlnx: Allow single core use in split mode When operating in split mode, it is a valid usecase to have only one core enabled in the cluster. Remove exact core count expecatation from the driver. Signed-off-by: Tanmay Shah Link: https://lore.kernel.org/r/20250618181933.1253033-1-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier commit d37a39f607c4a479d59781639b9c2a05448568a3 Author: Abdiel Janulgue Date: Mon Jun 2 11:53:13 2025 +0300 rust: dma: add as_slice/write functions for CoherentAllocation Add unsafe accessors for the region for reading or writing large blocks of data. Reviewed-by: Andreas Hindborg Signed-off-by: Abdiel Janulgue Reviewed-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250602085444.1925053-4-abdiel.janulgue@gmail.com [ Fix line length and slightly reword safety comment in doc-test of CoherentAllocation::write(); fix formatting issue. - Danilo ] Signed-off-by: Danilo Krummrich commit ad28fc31dd702871764e9294d4f2314ad78d24a9 Author: Sibi Sankar Date: Thu May 15 03:17:19 2025 +0530 firmware: arm_scmi: Fix up turbo frequencies selection Sustained frequency when greater than or equal to 4Ghz on 64-bit devices currently result in marking all frequencies as turbo. Address the turbo frequency selection bug by fixing the truncation. Fixes: a897575e79d7 ("firmware: arm_scmi: Add support for marking certain frequencies as turbo") Signed-off-by: Sibi Sankar Message-Id: <20250514214719.203607-1-quic_sibis@quicinc.com> Signed-off-by: Sudeep Holla commit fe58465905550576cc47cf93efeaaa6990e6c3b3 Author: Abdiel Janulgue Date: Mon Jun 2 11:53:12 2025 +0300 rust: dma: convert the read/write macros to return Result We could do better here by having the macros return `Result`, so that we don't have to wrap these calls in a closure for validation which is confusing. Co-developed-by: Andreas Hindborg Signed-off-by: Andreas Hindborg Link: https://lore.kernel.org/rust-for-linux/87h63qhz4q.fsf@kernel.org/ Reviewed-by: Andreas Hindborg Signed-off-by: Abdiel Janulgue Link: https://lore.kernel.org/r/20250602085444.1925053-3-abdiel.janulgue@gmail.com [ Fix line length in dma_read!(). - Danilo ] Signed-off-by: Danilo Krummrich commit 9863f7743339ae53a0cf80e5f229cf6d2a42a6e6 Author: Abdiel Janulgue Date: Mon Jun 2 11:53:11 2025 +0300 rust: dma: clarify wording and be consistent in `coherent` nomenclature In the kernel, `consistent` and `coherent` are used interchangeably for the region described in this api. Stick with `coherent` nomenclature to show that dma_alloc_coherent() is being used, in addition to improving the clarity in the DMA mapping attributes documentation. Reviewed-by: Benno Lossin Signed-off-by: Abdiel Janulgue Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250602085444.1925053-2-abdiel.janulgue@gmail.com Signed-off-by: Danilo Krummrich commit f077638b5f19080b877fd4cd15fc00558669aa6d Author: Christian Brauner Date: Mon Jun 23 14:50:30 2025 +0200 pidfs: fix pidfs_free_pid() Ensure that we handle the case where task creation fails and pid->attr was never accessed at all. Signed-off-by: Christian Brauner commit 27390db9592d828b6d3c2764305a5037a9aa969d Author: Miroslav Lichvar Date: Thu Jun 19 15:53:42 2025 +0200 testptp: add option to enable external timestamping edges Some drivers (e.g. ice) don't enable any edges by default when external timestamping is requested by the PTP_EXTTS_REQUEST ioctl, which makes testptp -e unusable for testing hardware supported by these drivers. Add -E option to specify if the rising, falling, or both edges should be enabled by the ioctl. Signed-off-by: Miroslav Lichvar Cc: Richard Cochran Cc: Jacob Keller Reviewed-by: Vadim Fedorenko Signed-off-by: David S. Miller commit 06a705356d7543b4eb2f41bef1ee0d5951700f7a Author: Ankit Chauhan Date: Thu Jun 19 08:45:36 2025 +0530 fs/ecryptfs: replace snprintf with sysfs_emit in show function Use sysfs_emit() instead of snprintf() in version_show() function to follow the preferred kernel API. Signed-off-by: Ankit Chauhan Link: https://lore.kernel.org/20250619031536.19352-1-ankitchauhan2065@gmail.com Signed-off-by: Christian Brauner commit 024f39fff6d222cedde361f7fe34d9ba4e6afb92 Author: AngeloGioacchino Del Regno Date: Mon Jun 23 14:01:44 2025 +0200 regulator: mtk-dvfsrc: Add support for MediaTek MT8196 DVFSRC The MediaTek MT8196 Chromebook SoC features one DVFSRC regulator with 6 voltage steps. Signed-off-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250623120144.109359-5-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown commit ae77b8e8b0326818bd170818b37d055aa57a1569 Author: AngeloGioacchino Del Regno Date: Mon Jun 23 14:01:43 2025 +0200 dt-bindings: regulator: mediatek-dvfsrc: Add MT8196 support Add a compatible for the MediaTek MT8196 Chromebook SoC's regulators over DVFSRC. This SoC has only one regulator "dvfsrc-vcore" and different values for vsel compared to the others. Signed-off-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250623120144.109359-4-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown commit 7aafbb463be85472dc6db194ab9df45fd497c998 Author: AngeloGioacchino Del Regno Date: Mon Jun 23 14:01:42 2025 +0200 regulator: mtk-dvfsrc: Add support for Dimensity 1200 MT6893 The MediaTek Dimensity 1200 (MT6893) features the same DVFSRC regulators as the other currently supported SoCs, but with a different select value: add an array describing the possible voltages for the VCORE and VSCP regulators, and assign it to a new compatible for this SoC. Signed-off-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250623120144.109359-3-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown commit a6c05c2e6871c94b349703c1ec8584763797fd8e Author: AngeloGioacchino Del Regno Date: Mon Jun 23 14:01:41 2025 +0200 dt-bindings: regulator: mediatek-dvfsrc: Add MT6893 support Add a compatible for the MediaTek Dimensity 1200 (MT6893) SoC's regulators over DVFSRC. This SoC uses different values for the vsel, hence it is not compatible with the currently supported ones. Signed-off-by: AngeloGioacchino Del Regno Acked-by: "Rob Herring (Arm)" Link: https://patch.msgid.link/20250623120144.109359-2-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown commit 59566923d955b69bfb1e1163f07dff437dde8c9c Author: Vijendar Mukunda Date: Fri Jun 20 17:38:43 2025 +0530 ASoC: SOF: amd: add alternate machines for ACP7.0 and ACP7.1 platforms Add SoundWire machines as alternate machines for ACP7.0 and ACP7.1 platforms. Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20250620120942.1168827-3-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit 8b04b766714e93ca5a8021ff3408c9ef89d9eb85 Author: Vijendar Mukunda Date: Fri Jun 20 17:38:42 2025 +0530 ASoC: amd: acp: add soundwire machine for ACP7.0 and ACP7.1 sof stack Add SoundWire machine with RT722 multi functional codec support for ACP7.0 and ACP7.1 platforms at sdw link0 for sof stack. Signed-off-by: Vijendar Mukunda Link: https://patch.msgid.link/20250620120942.1168827-2-Vijendar.Mukunda@amd.com Signed-off-by: Mark Brown commit a079d83c4afd4896f7f29bd9e807cb382043b360 Author: Jerome Brunet Date: Tue Jun 3 19:03:39 2025 +0200 PCI: endpoint: pci-epf-vntb: Align MW naming with config names The config file related to the memory windows start the numbering of the MW from 1. The other NTB function does the same, yet the enumeration defining the BARs of the vNTB function starts numbering the MW from 0. Both numbering should be fine, but mixing the two is a bit confusing. The configfs file being the interface with userspace, keep that stable and consistently start the numbering of the MW from 1. Signed-off-by: Jerome Brunet [mani: commit message rewording] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Link: https://patch.msgid.link/20250603-pci-vntb-bar-mapping-v2-2-fc685a22ad28@baylibre.com commit 7ea488cce73263231662e426639dd3e836537068 Author: Jerome Brunet Date: Tue Jun 3 19:03:38 2025 +0200 PCI: endpoint: pci-epf-vntb: Return -ENOENT if pci_epc_get_next_free_bar() fails According the function documentation of epf_ntb_init_epc_bar(), the function should return an error code on error. However, it returns -1 when no BAR is available i.e., when pci_epc_get_next_free_bar() fails. Return -ENOENT instead. Fixes: e35f56bb0330 ("PCI: endpoint: Support NTB transfer between RC and EP") Signed-off-by: Jerome Brunet [mani: changed err code to -ENOENT] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Frank Li Link: https://patch.msgid.link/20250603-pci-vntb-bar-mapping-v2-1-fc685a22ad28@baylibre.com commit a364d10ffe361fb34c3838d33604da493045de1e Author: Jim Quinlan Date: Fri May 30 18:40:33 2025 -0400 PCI: brcmstb: Set MLW based on "num-lanes" DT property if present By default, the driver relies on the default hardware defined value for the Max Link Width (MLW) capability. But if the "num-lanes" DT property is present, assume that the chip's default capability information is incorrect or undesired, and use the specified value instead. Signed-off-by: Jim Quinlan [mani: reworded the description and comments] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250530224035.41886-3-james.quinlan@broadcom.com commit dbb1258daf75f2b98e465ba5a0e26073eda6e539 Author: Jim Quinlan Date: Fri May 30 18:40:32 2025 -0400 dt-bindings: PCI: brcm,stb-pcie: Add num-lanes property Add optional num-lanes property Broadcom STB PCIe host controllers. Signed-off-by: Jim Quinlan Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250530224035.41886-2-james.quinlan@broadcom.com commit 255c891533d89f5d7339076468a98afc947c4a73 Author: George D Sworo Date: Fri Jun 6 14:02:30 2025 -0700 PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U Add VMD Device ID Support for PTL-H/P/U processors. Signed-off-by: George D Sworo [mani: expanded PTL] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250606210230.340803-2-george.d.sworo@intel.com commit e1cb67ab82aab44cda410616498d4749399da217 Author: Konrad Dybcio Date: Wed May 21 15:38:11 2025 +0200 dt-bindings: PCI: qcom,pcie-sm8150: Drop unrelated clocks from PCIe hosts The TBU clock belongs to the Translation Buffer Unit, part of the SMMU. The ref clock is already being driven upstream through some of the branches. Signed-off-by: Konrad Dybcio Signed-off-by: Manivannan Sadhasivam Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250521-topic-8150_pcie_drop_clocks-v1-2-3d42e84f6453@oss.qualcomm.com commit 26daa18e35ebc4e192ff55d021f1cd7e69d55487 Author: Konrad Dybcio Date: Wed May 21 15:38:10 2025 +0200 dt-bindings: PCI: qcom,pcie-sc8180x: Drop unrelated clocks from PCIe hosts The TBU clock belongs to the Translation Buffer Unit, part of the SMMU. The ref clock is already being driven upstream through some of the branches. Signed-off-by: Konrad Dybcio Signed-off-by: Manivannan Sadhasivam Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250521-topic-8150_pcie_drop_clocks-v1-1-3d42e84f6453@oss.qualcomm.com commit 13b0cce9e294f8ddf228b9db3e01d76ac29872f2 Merge: 19272b37aa4f83 f4fba2d6d2822e Author: Christian Brauner Date: Mon Jun 23 13:01:26 2025 +0200 Merge patch series "Introduce bpf_cgroup_read_xattr" Song Liu says: Introduce a new kfunc bpf_cgroup_read_xattr, which can read xattr from cgroupfs nodes. The primary users are LSMs, cgroup programs, and sched_ext. * patches from https://lore.kernel.org/20250623063854.1896364-1-song@kernel.org: selftests/bpf: Add tests for bpf_cgroup_read_xattr bpf: Mark cgroup_subsys_state->cgroup RCU safe bpf: Introduce bpf_cgroup_read_xattr to read xattr of cgroup's node kernfs: remove iattr_mutex Link: https://lore.kernel.org/20250623063854.1896364-1-song@kernel.org Signed-off-by: Christian Brauner commit f4fba2d6d2822efd2733949c0831435dcd96cbd3 Author: Song Liu Date: Sun Jun 22 23:38:54 2025 -0700 selftests/bpf: Add tests for bpf_cgroup_read_xattr Add tests for different scenarios with bpf_cgroup_read_xattr: 1. Read cgroup xattr from bpf_cgroup_from_id; 2. Read cgroup xattr from bpf_cgroup_ancestor; 3. Read cgroup xattr from css_iter; 4. Use bpf_cgroup_read_xattr in LSM hook security_socket_connect. 5. Use bpf_cgroup_read_xattr in cgroup program. Signed-off-by: Song Liu Link: https://lore.kernel.org/20250623063854.1896364-5-song@kernel.org Signed-off-by: Christian Brauner commit 1504d8c7c702cc3697ad1a690c2d6bb4c8687927 Author: Song Liu Date: Sun Jun 22 23:38:53 2025 -0700 bpf: Mark cgroup_subsys_state->cgroup RCU safe Mark struct cgroup_subsys_state->cgroup as safe under RCU read lock. This will enable accessing css->cgroup from a bpf css iterator. Signed-off-by: Song Liu Link: https://lore.kernel.org/20250623063854.1896364-4-song@kernel.org Acked-by: Tejun Heo Signed-off-by: Christian Brauner commit 535b070f4a807bbd26a30994aba8dfb4011fd447 Author: Song Liu Date: Sun Jun 22 23:38:52 2025 -0700 bpf: Introduce bpf_cgroup_read_xattr to read xattr of cgroup's node BPF programs, such as LSM and sched_ext, would benefit from tags on cgroups. One common practice to apply such tags is to set xattrs on cgroupfs folders. Introduce kfunc bpf_cgroup_read_xattr, which allows reading cgroup's xattr. Note that, we already have bpf_get_[file|dentry]_xattr. However, these two APIs are not ideal for reading cgroupfs xattrs, because: 1) These two APIs only works in sleepable contexts; 2) There is no kfunc that matches current cgroup to cgroupfs dentry. bpf_cgroup_read_xattr is generic and can be useful for many program types. It is also safe, because it requires trusted or rcu protected argument (KF_RCU). Therefore, we make it available to all program types. Signed-off-by: Song Liu Link: https://lore.kernel.org/20250623063854.1896364-3-song@kernel.org Acked-by: Tejun Heo Signed-off-by: Christian Brauner commit d1f4e9026007d50e6b28cf8f57a38f03fc3b0ce6 Author: Christian Brauner Date: Sun Jun 22 23:38:51 2025 -0700 kernfs: remove iattr_mutex All allocations of struct kernfs_iattrs are serialized through a global mutex. Simply do a racy allocation and let the first one win. I bet most callers are under inode->i_rwsem anyway and it wouldn't be needed but let's not require that. Acked-by: Greg Kroah-Hartman Acked-by: Tejun Heo Signed-off-by: Song Liu Link: https://lore.kernel.org/20250623063854.1896364-2-song@kernel.org Signed-off-by: Christian Brauner commit 10fa9a4e4dc332e0ff18150c82ba87311deb82bc Author: Qiuxu Zhuo Date: Thu Jun 19 00:23:07 2025 +0800 EDAC/igen6: Reduce log level to debug for absent memory controllers The current KERN_WARNING level message for detecting absent memory controllers is overly dramatic. The BIOS likely had valid reasons to disable the memory controller (e.g. it isn't connected to any DIMM slots on the motherboard for this system). So there's nothing actually wrong that needs to be fixed. Reduce the log level to KERN_DEBUG to eliminate the false warning. Suggested-by: Tony Luck Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20250618162307.1523736-2-qiuxu.zhuo@intel.com commit 1de70efcc8920020cdbc94dedb432a6204ae3319 Author: George Gaidarov Date: Thu May 29 16:29:33 2025 +0000 EDAC/ie31200: Document which CPUs correspond to each Raptor Lake-S device ID Based on table 103 ("Host Device ID (DID0)") in [1], document which CPUs correspond to each Raptor Lake-S device ID for better readability. [1] https://www.intel.com/content/www/us/en/content-details/743844/13th-generation-intel-core-intel-core-14th-generation-intel-core-processor-series-1-and-series-2-and-intel-xeon-e-2400-processor-datasheet-volume-1-of-2.html Signed-off-by: George Gaidarov Reviewed-by: Qiuxu Zhuo Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20250529162933.1228735-2-gdgaidarov+lkml@gmail.com commit 493f9c930e5ff72b3508755b45488d1ae2c9650e Author: George Gaidarov Date: Thu May 29 16:29:32 2025 +0000 EDAC/ie31200: Enable support for Core i5-14600 and i7-14700 Device ID '0xa740' is shared by i7-14700, i7-14700K, and i7-14700T. Device ID '0xa704' is shared by i5-14600, i5-14600K, and i5-14600T. Tested locally on my i7-14700K. Signed-off-by: George Gaidarov Reviewed-by: Qiuxu Zhuo Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20250529162933.1228735-1-gdgaidarov+lkml@gmail.com commit 021681830e41e9f9393d44b8779a6767a3df34bf Author: Qiuxu Zhuo Date: Fri May 2 09:39:00 2025 +0800 ie31200/EDAC: Add Intel Bartlett Lake-S SoCs support Bartlett Lake-S is a derivative of Raptor Lake-S and is optimized for IoT/Edge applications. It shares the same memory controller registers as Raptor Lake-S. Add compute die IDs of Bartlett Lake-S and reuse the configuration data of Raptor Lake-S for Bartlett Lake-S EDAC support. Signed-off-by: Qiuxu Zhuo Signed-off-by: Tony Luck Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/r/20250502013900.343430-1-qiuxu.zhuo@intel.com commit 4f984fe7b4d9aea332c7ff59827a4e168f0e4e1b Merge: e04c78d86a9699 f4265b8d32c49f Author: Christian Brauner Date: Mon Jun 23 12:45:32 2025 +0200 Merge patch series "fallocate: introduce FALLOC_FL_WRITE_ZEROES flag" Zhang Yi says: Currently, we can use the fallocate command to quickly create a pre-allocated file. However, on most filesystems, such as ext4 and XFS, fallocate create pre-allocation blocks in an unwritten state, and the FALLOC_FL_ZERO_RANGE flag also behaves similarly. The extent state must be converted to a written state when the user writes data into this range later, which can trigger numerous metadata changes and consequent journal I/O. This may leads to significant write amplification and performance degradation in synchronous write mode. Therefore, we need a method to create a pre-allocated file with written extents that can be used for pure overwriting. At the monent, the only method available is to create an empty file and write zero data into it (for example, using 'dd' with a large block size). However, this method is slow and consumes a considerable amount of disk bandwidth, we must pre-allocate files in advance but cannot add pre-allocated files while user business services are running. Fortunately, with the development and more and more widely used of flash-based storage devices, we can efficiently write zeros to SSDs using the unmap write zeroes command if the devices do not write physical zeroes to the media. For example, if SCSI SSDs support the UMMAP bit or NVMe SSDs support the DEAC bit[1], the write zeroes command does not write actual data to the device, instead, NVMe converts the zeroed range to a deallocated state, which works fast and consumes almost no disk write bandwidth. Consequently, this feature can provide us with a faster method for creating pre-allocated files with written extents and zeroed data. However, please note that this may be a best-effort optimization rather than a mandatory requirement, some devices may partially fall back to writing physical zeroes due to factors such as receiving unaligned commands. This series aims to implement this by: 1. Introduce a new feature BLK_FEAT_WRITE_ZEROES_UNMAP to the block device queue limit features, which indicates whether the storage is device explicitly supports the unmapped write zeroes command. This flag should be set to 1 by the driver if the attached disk supports this command. 2. Introduce a queue limit flag, BLK_FLAG_WRITE_ZEROES_UNMAP_DISABLED, along with a corresponding sysfs entry. Users can query the support status of the unmap write zeroes operation and disable this operation if the write zeroes operation is very slow. /sys/block//queue/write_zeroes_unmap 3. Introduce a new flag, FALLOC_FL_WRITE_ZEROES, into the fallocate. Filesystems that support this operation should allocate written extents and issue zeroes to the specified range of the device. For local block device filesystems, this operation should depend on the write_zeroes_unmap operaion of the underlying block device. It should return -EOPNOTSUPP if the device doesn't enable unmap write zeroes operaion. This series implements the BLK_FEAT_WRITE_ZEROES_UNMAP feature and BLK_FLAG_WRITE_ZEROES_UNMAP_DISABLED flag for SCSI, NVMe and device-mapper drivers, and add the FALLOC_FL_WRITE_ZEROES and STATX_ATTR_WRITE_ZEROES_UNMAP support for ext4 and raw bdev devices. Any comments are welcome. I've tested performance with this series on ext4 filesystem on my machine with an Intel Xeon Gold 6248R CPU, a 7TB KCD61LUL7T68 NVMe SSD which supports unmap write zeroes command with the Deallocated state and the DEAC bit. Feel free to give it a try. 0. Ensure the NVMe device supports WRITE_ZERO command. $ cat /sys/block/nvme5n1/queue/write_zeroes_max_bytes 8388608 $ nvme id-ns -H /dev/nvme5n1 | grep -i -A 3 "dlfeat" dlfeat : 25 [4:4] : 0x1 Guard Field of Deallocated Logical Blocks is set to CRC of The Value Read [3:3] : 0x1 Deallocate Bit in the Write Zeroes Command is Supported [2:0] : 0x1 Bytes Read From a Deallocated Logical Block and its Metadata are 0x00 1. Compare 'dd' and fallocate with unmap write zeroes, the later one is significantly faster than 'dd'. Create a 1GB and 10GB zeroed file. $dd if=/dev/zero of=foo bs=2M count=$count oflag=direct $time fallocate -w -l $size bar #1G dd: 0.5s FALLOC_FL_WRITE_ZEROES: 0.17s #10G dd: 5.0s FALLOC_FL_WRITE_ZEROES: 1.7s 2. Run fio overwrite and fallocate with unmap write zeroes simultaneously, fallocate has little impact on write bandwidth and only slightly affects write latency. a) Test bandwidth costs. $ fio -directory=/test -direct=1 -iodepth=10 -fsync=0 -rw=write \ -numjobs=10 -bs=2M -ioengine=libaio -size=20G -runtime=20 \ -fallocate=none -overwrite=1 -group_reportin -name=bw_test Without background zero range: bw (MiB/s): min= 2068, max= 2280, per=100.00%, avg=2186.40 With background zero range: bw (MiB/s): min= 2056, max= 2308, per=100.00%, avg=2186.20 b) Test write latency costs. $ fio -filename=/test/foo -direct=1 -iodepth=1 -fsync=0 -rw=write \ -numjobs=1 -bs=4k -ioengine=psync -size=5G -runtime=20 \ -fallocate=none -overwrite=1 -group_reportin -name=lat_test Without background zero range: lat (nsec): min=9269, max=71635, avg=9840.65 With a background zero range: lat (usec): min=9, max=982, avg=11.03 3. Compare overwriting in a pre-allocated unwritten file and a written file in O_DSYNC mode. Write to a file with written extents is much faster. # First mkfs and create a test file according to below three cases, # and then run fio. $ fio -filename=/test/foo -direct=1 -iodepth=1 -fdatasync=1 \ -rw=write -numjobs=1 -bs=4k -ioengine=psync -size=5G \ -runtime=20 -fallocate=none -group_reportin -name=test unwritten file: IOPS=20.1k, BW=78.7MiB/s unwritten file + fast_commit: IOPS=42.9k, BW=167MiB/s written file: IOPS=98.8k, BW=386MiB/s * patches from https://lore.kernel.org/20250619111806.3546162-1-yi.zhang@huaweicloud.com: ext4: add FALLOC_FL_WRITE_ZEROES support block: add FALLOC_FL_WRITE_ZEROES support block: factor out common part in blkdev_fallocate() fs: introduce FALLOC_FL_WRITE_ZEROES to fallocate dm: clear unmap write zeroes limits when disabling write zeroes scsi: sd: set max_hw_wzeroes_unmap_sectors if device supports SD_ZERO_*_UNMAP nvmet: set WZDS and DRB if device enables unmap write zeroes operation nvme: set max_hw_wzeroes_unmap_sectors if device supports DEAC bit block: introduce max_{hw|user}_wzeroes_unmap_sectors to queue limits Link: https://lore.kernel.org/20250619111806.3546162-1-yi.zhang@huaweicloud.com Signed-off-by: Christian Brauner commit f4265b8d32c49ff95711e6fef7d05245a2905b30 Author: Zhang Yi Date: Thu Jun 19 19:18:06 2025 +0800 ext4: add FALLOC_FL_WRITE_ZEROES support Add support for FALLOC_FL_WRITE_ZEROES if the underlying device enable the unmap write zeroes operation. This first allocates blocks as unwritten, then issues a zero command outside of the running journal handle, and finally converts them to a written state. Signed-off-by: Zhang Yi Link: https://lore.kernel.org/20250619111806.3546162-10-yi.zhang@huaweicloud.com Reviewed-by: "Martin K. Petersen" Signed-off-by: Christian Brauner commit 912b6038fe5c985fac06285f8019fd74cab67e81 Author: Zhang Yi Date: Thu Jun 19 19:18:05 2025 +0800 block: add FALLOC_FL_WRITE_ZEROES support Add support for FALLOC_FL_WRITE_ZEROES, if the block device enables the unmap write zeroes operation, it will issue a write zeroes command. Signed-off-by: Zhang Yi Link: https://lore.kernel.org/20250619111806.3546162-9-yi.zhang@huaweicloud.com Reviewed-by: Christoph Hellwig Reviewed-by: "Martin K. Petersen" Signed-off-by: Christian Brauner commit 562108d56bd9b93bec64fe9333a805b129c13001 Author: Zhang Yi Date: Thu Jun 19 19:18:04 2025 +0800 block: factor out common part in blkdev_fallocate() Only the flags passed to blkdev_issue_zeroout() differ among the two zeroing branches in blkdev_fallocate(). Therefore, do cleanup by factoring them out. Signed-off-by: Zhang Yi Link: https://lore.kernel.org/20250619111806.3546162-8-yi.zhang@huaweicloud.com Reviewed-by: Christoph Hellwig Reviewed-by: "Martin K. Petersen" Signed-off-by: Christian Brauner commit 7bd43cc79cab3850f34da0a31d5b042b701590ef Author: Zhang Yi Date: Thu Jun 19 19:18:03 2025 +0800 fs: introduce FALLOC_FL_WRITE_ZEROES to fallocate With the development of flash-based storage devices, we can quickly write zeros to SSDs using the WRITE_ZERO command if the devices do not actually write physical zeroes to the media. Therefore, we can use this command to quickly preallocate a real all-zero file with written extents. This approach should be beneficial for subsequent pure overwriting within this file, as it can save on block allocation and, consequently, significant metadata changes, which should greatly improve overwrite performance on certain filesystems. Therefore, introduce a new operation FALLOC_FL_WRITE_ZEROES to fallocate. This flag is used to convert a specified range of a file to zeros by issuing a zeroing operation. Blocks should be allocated for the regions that span holes in the file, and the entire range is converted to written extents. If the underlying device supports the actual offload write zeroes command, the process of zeroing out operation can be accelerated. If it does not, we currently don't prevent the file system from writing actual zeros to the device. This provides users with a new method to quickly generate a zeroed file, users no longer need to write zero data to create a file with written extents. Users can determine whether a disk supports the unmap write zeroes feature through querying this sysfs interface: /sys/block//queue/write_zeroes_unmap_max_hw_bytes Users can also enable or disable the unmap write zeroes operation through this sysfs interface: /sys/block//queue/write_zeroes_unmap_max_bytes Finally, this flag cannot be specified in conjunction with the FALLOC_FL_KEEP_SIZE since allocating written extents beyond file EOF is not permitted. In addition, filesystems that always require out-of-place writes should not support this flag since they still need to allocated new blocks during subsequent overwrites. Signed-off-by: Zhang Yi Link: https://lore.kernel.org/20250619111806.3546162-7-yi.zhang@huaweicloud.com Reviewed-by: Christoph Hellwig Reviewed-by: "Martin K. Petersen" Signed-off-by: Christian Brauner commit 2c46eab8da6ade4ef2ac62b045b2203f18b0d745 Author: Zhang Yi Date: Thu Jun 19 19:18:02 2025 +0800 dm: clear unmap write zeroes limits when disabling write zeroes The unmap write zeroes limits have been set to the stacking queue limits by default in blk_set_stacking_limits() and blk_stack_limits(), but it should be cleared if any underlying device does not support it. Signed-off-by: Zhang Yi Link: https://lore.kernel.org/20250619111806.3546162-6-yi.zhang@huaweicloud.com Reviewed-by: "Martin K. Petersen" Signed-off-by: Christian Brauner commit 6dffe079fe363ca976d26fe7e8f0b3e84b4c796f Author: Zhang Yi Date: Thu Jun 19 19:18:01 2025 +0800 scsi: sd: set max_hw_wzeroes_unmap_sectors if device supports SD_ZERO_*_UNMAP When the device supports the Write Zeroes command and the zeroing mode is set to SD_ZERO_WS16_UNMAP or SD_ZERO_WS10_UNMAP, this means that the device supports unmap Write Zeroes, so set the corresponding max_hw_write_zeroes_unmap_sectors to max_write_zeroes_sectors on the device's queue limit. Signed-off-by: Zhang Yi Link: https://lore.kernel.org/20250619111806.3546162-5-yi.zhang@huaweicloud.com Reviewed-by: "Martin K. Petersen" Signed-off-by: Christian Brauner commit 50634366de8629fdb96c5dd7ea595f9b61835dfc Author: Zhang Yi Date: Thu Jun 19 19:18:00 2025 +0800 nvmet: set WZDS and DRB if device enables unmap write zeroes operation Set the WZDS and DRB bits to the namespace dlfeat if the underlying block device enables the unmap write zeroes operation, make the nvme target device supports the unmap write zeroes command. Signed-off-by: Zhang Yi Link: https://lore.kernel.org/20250619111806.3546162-4-yi.zhang@huaweicloud.com Reviewed-by: Christoph Hellwig Reviewed-by: "Martin K. Petersen" Signed-off-by: Christian Brauner commit 545fb46e5bc6ffaa303181bd3878db506a0f0fa6 Author: Zhang Yi Date: Thu Jun 19 19:17:59 2025 +0800 nvme: set max_hw_wzeroes_unmap_sectors if device supports DEAC bit When the device supports the Write Zeroes command and the DEAC bit, it indicates that the deallocate bit in the Write Zeroes command is supported, and the bytes read from a deallocated logical block are zeroes. This means the device supports unmap Write Zeroes operation, so set the max_hw_wzeroes_unmap_sectors to max_write_zeroes_sectors on the device's queue limit. Signed-off-by: Zhang Yi Link: https://lore.kernel.org/20250619111806.3546162-3-yi.zhang@huaweicloud.com Reviewed-by: Christoph Hellwig Reviewed-by: "Martin K. Petersen" Signed-off-by: Christian Brauner commit 0c40d7cb5ef3af260e8c7f88e0e5d7ae15d6ce57 Author: Zhang Yi Date: Thu Jun 19 19:17:58 2025 +0800 block: introduce max_{hw|user}_wzeroes_unmap_sectors to queue limits Currently, disks primarily implement the write zeroes command (aka REQ_OP_WRITE_ZEROES) through two mechanisms: the first involves physically writing zeros to the disk media (e.g., HDDs), while the second performs an unmap operation on the logical blocks, effectively putting them into a deallocated state (e.g., SSDs). The first method is generally slow, while the second method is typically very fast. For example, on certain NVMe SSDs that support NVME_NS_DEAC, submitting REQ_OP_WRITE_ZEROES requests with the NVME_WZ_DEAC bit can accelerate the write zeros operation by placing disk blocks into a deallocated state, which opportunistically avoids writing zeroes to media while still guaranteeing that subsequent reads from the specified block range will return zeroed data. This is a best-effort optimization, not a mandatory requirement, some devices may partially fall back to writing physical zeroes due to factors such as misalignment or being asked to clear a block range smaller than the device's internal allocation unit. Therefore, the speed of this operation is not guaranteed. It is difficult to determine whether the storage device supports unmap write zeroes operation. We cannot determine this by only querying bdev_limits(bdev)->max_write_zeroes_sectors. Therefore, first, add a new hardware queue limit parameters, max_hw_wzeroes_unmap_sectors, to indicate whether a device supports this unmap write zeroes operation. Then, add two new counterpart software queue limits, max_wzeroes_unmap_sectors and max_user_wzeroes_unmap_sectors, which allow users to disable this operation if the speed is very slow on some sepcial devices. Finally, for the stacked devices cases, initialize these two parameters to UINT_MAX. This operation should be enabled by both the stacking driver and all underlying devices. Thanks to Martin K. Petersen for optimizing the documentation of the write_zeroes_unmap sysfs interface. Signed-off-by: Zhang Yi Link: https://lore.kernel.org/20250619111806.3546162-2-yi.zhang@huaweicloud.com Reviewed-by: Christoph Hellwig Reviewed-by: "Martin K. Petersen" Signed-off-by: Christian Brauner commit 2b7c9664c3ce9d8da1113a1ca2546046de8eb93e Author: Dmitry Antipov Date: Fri Jun 20 09:30:59 2025 +0300 fs: annotate suspected data race between poll_schedule_timeout() and pollwake() When running almost any select()/poll() workload intense enough, KCSAN is likely to report data races around using 'triggered' flag of 'struct poll_wqueues'. For example, running 'find /' on a tty console may trigger the following: BUG: KCSAN: data-race in poll_schedule_timeout / pollwake write to 0xffffc900030cfb90 of 4 bytes by task 97 on cpu 5: pollwake+0xd1/0x130 __wake_up_common_lock+0x7f/0xd0 n_tty_receive_buf_common+0x776/0xc30 n_tty_receive_buf2+0x3d/0x60 tty_ldisc_receive_buf+0x6b/0x100 tty_port_default_receive_buf+0x63/0xa0 flush_to_ldisc+0x169/0x3c0 process_scheduled_works+0x6fe/0xf40 worker_thread+0x53b/0x7b0 kthread+0x4f8/0x590 ret_from_fork+0x28c/0x450 ret_from_fork_asm+0x1a/0x30 read to 0xffffc900030cfb90 of 4 bytes by task 5802 on cpu 4: poll_schedule_timeout+0x96/0x160 do_sys_poll+0x966/0xb30 __se_sys_ppoll+0x1c3/0x210 __x64_sys_ppoll+0x71/0x90 x64_sys_call+0x3079/0x32b0 do_syscall_64+0xfa/0x3b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f According to Jan, "there's no practical issue here because it is hard to imagine how the compiler could compile the above code using some intermediate values stored into 'triggered' or multiple fetches from 'triggered'". Nevertheless, silence KCSAN by using WRITE_ONCE() in __pollwake() and READ_ONCE() in poll_schedule_timeout(), respectively. Link: https://lore.kernel.org/linux-fsdevel/bwx72orsztfjx6aoftzzkl7wle3hi4syvusuwc7x36nw6t235e@bjwrosehblty Signed-off-by: Dmitry Antipov Link: https://lore.kernel.org/20250620063059.1800689-1-dmantipov@yandex.ru Acked-by: Marco Elver Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 9de4a3967caf1865a95aebdd63fccf213d174ede Author: Heinz Mauelshagen Date: Mon Jun 16 16:50:05 2025 +0200 dm raid: add support for resync w/o metadata devices Target does not honour the "sync" argument when activated w/o metadata devices, e.g. with table line: "0 $(blockdev --getsz $data1) raid raid1 2 0 sync 2 - $data1 - $data2". Fix this to support temporary, transient raid devices useful for data duplication. Signed-off-by: Heinz Mauelshagen Signed-off-by: Mikulas Patocka commit e2a9c03192f54bb53a5422bf5106bdc4d04a7426 Author: Pawan Gupta Date: Wed Jun 11 10:30:18 2025 -0700 x86/bugs: Remove its=stuff dependency on retbleed Allow ITS to enable stuffing independent of retbleed. The dependency is only on retpoline. It is a valid case for retbleed to be mitigated by eIBRS while ITS deploys stuffing at the same time. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250611-eibrs-fix-v4-6-5ff86cac6c61@linux.intel.com commit 8374a2719df2a00781e6821e373d7de71390d1b4 Author: Pawan Gupta Date: Wed Jun 11 10:30:03 2025 -0700 x86/bugs: Introduce cdt_possible() In preparation to allow ITS to also enable stuffing aka Call Depth Tracking (CDT) independently of retbleed, introduce a helper cdt_possible(). Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250611-eibrs-fix-v4-5-5ff86cac6c61@linux.intel.com commit 7e44909e0ea8346ba08b244ecc275fc3394e2b8e Author: Pawan Gupta Date: Wed Jun 11 10:29:47 2025 -0700 x86/bugs: Use switch/case in its_apply_mitigation() Prepare to apply stuffing mitigation in its_apply_mitigation(). This is currently only done via retbleed mitigation. Also using switch/case makes it evident that mitigation mode like VMEXIT_ONLY doesn't need any special handling. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nikolay Borisov Link: https://lore.kernel.org/20250611-eibrs-fix-v4-4-5ff86cac6c61@linux.intel.com commit 4e3d1e6e1b2d9df9650be14380c534b3c5081ddd Merge: 19272b37aa4f83 f9fac1f48c20a2 Author: Christian Brauner Date: Thu Jun 19 14:28:31 2025 +0200 Merge patch series "pidfs: persistent info & xattrs" Christian Brauner says: Persist exit and coredump information independent of whether anyone currently holds a pidfd for the struct pid. The current scheme allocated pidfs dentries on-demand repeatedly. This scheme is reaching it's limits as it makes it impossible to pin information that needs to be available after the task has exited or coredumped and that should not be lost simply because the pidfd got closed temporarily. The next opener should still see the stashed information. This is also a prerequisite for supporting extended attributes on pidfds to allow attaching meta information to them. If someone opens a pidfd for a struct pid a pidfs dentry is allocated and stashed in pid->stashed. Once the last pidfd for the struct pid is closed the pidfs dentry is released and removed from pid->stashed. So if 10 callers create a pidfs dentry for the same struct pid sequentially, i.e., each closing the pidfd before the other creates a new one then a new pidfs dentry is allocated every time. Because multiple tasks acquiring and releasing a pidfd for the same struct pid can race with each another a task may still find a valid pidfs entry from the previous task in pid->stashed and reuse it. Or it might find a dead dentry in there and fail to reuse it and so stashes a new pidfs dentry. Multiple tasks may race to stash a new pidfs dentry but only one will succeed, the other ones will put their dentry. The current scheme aims to ensure that a pidfs dentry for a struct pid can only be created if the task is still alive or if a pidfs dentry already existed before the task was reaped and so exit information has been was stashed in the pidfs inode. That's great except that it's buggy. If a pidfs dentry is stashed in pid->stashed after pidfs_exit() but before __unhash_process() is called we will return a pidfd for a reaped task without exit information being available. The pidfds_pid_valid() check does not guard against this race as it doens't sync at all with pidfs_exit(). The pid_has_task() check might be successful simply because we're before __unhash_process() but after pidfs_exit(). Introduce a new scheme where the lifetime of information associated with a pidfs entry (coredump and exit information) isn't bound to the lifetime of the pidfs inode but the struct pid itself. The first time a pidfs dentry is allocated for a struct pid a struct pidfs_attr will be allocated which will be used to store exit and coredump information. If all pidfs for the pidfs dentry are closed the dentry and inode can be cleaned up but the struct pidfs_attr will stick until the struct pid itself is freed. This will ensure minimal memory usage while persisting relevant information. The new scheme has various advantages. First, it allows to close the race where we end up handing out a pidfd for a reaped task for which no exit information is available. Second, it minimizes memory usage. Third, it allows to remove complex lifetime tracking via dentries when registering a struct pid with pidfs. There's no need to get or put a reference. Instead, the lifetime of exit and coredump information associated with a struct pid is bound to the lifetime of struct pid itself. Now that we have a way to persist information for pidfs dentries we can start supporting extended attributes on pidfds. This will allow userspace to attach meta information to tasks. One natural extension would be to introduce a custom pidfs.* extended attribute space and allow for the inheritance of extended attributes across fork() and exec(). The first simple scheme will allow privileged userspace to set trusted extended attributes on pidfs inodes. * patches from https://lore.kernel.org/20250618-work-pidfs-persistent-v2-0-98f3456fd552@kernel.org: pidfs: add some CONFIG_DEBUG_VFS asserts selftests/pidfd: test setattr support selftests/pidfd: test extended attribute support selftests/pidfd: test extended attribute support pidfs: support xattrs on pidfds pidfs: make inodes mutable libfs: prepare to allow for non-immutable pidfd inodes pidfs: remove pidfs_pid_valid() pidfs: remove pidfs_{get,put}_pid() pidfs: remove custom inode allocation pidfs: remove unused members from struct pidfs_inode pidfs: persist information pidfs: move to anonymous struct libfs: massage path_from_stashed() libfs: massage path_from_stashed() to allow custom stashing behavior pidfs: raise SB_I_NODEV and SB_I_NOEXEC Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-0-98f3456fd552@kernel.org Signed-off-by: Christian Brauner commit f9fac1f48c20a29f2c39c9a9b96d539ad1636824 Author: Christian Brauner Date: Wed Jun 18 22:53:50 2025 +0200 pidfs: add some CONFIG_DEBUG_VFS asserts Allow to catch some obvious bugs. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-16-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 8c2ab04135682d0f5b1eb1c74ac5f328b65015ea Author: Christian Brauner Date: Wed Jun 18 22:53:49 2025 +0200 selftests/pidfd: test setattr support Verify that ->setattr() on a pidfd doens't work. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-15-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 7442d093dfae0c9482eeeb8bebfd682459244be0 Author: Christian Brauner Date: Wed Jun 18 22:53:48 2025 +0200 selftests/pidfd: test extended attribute support Test that extended attributes are permanent. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-14-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 49fba3725910c54878212ca08b968b9e1285866c Author: Christian Brauner Date: Wed Jun 18 22:53:47 2025 +0200 selftests/pidfd: test extended attribute support Add tests for extended attribute support on pidfds. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-13-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 91d837cae3c7856cdca23dc6e8ec8954d887e970 Author: Christian Brauner Date: Wed Jun 18 22:53:46 2025 +0200 pidfs: support xattrs on pidfds Now that we have a way to persist information for pidfs dentries we can start supporting extended attributes on pidfds. This will allow userspace to attach meta information to tasks. One natural extension would be to introduce a custom pidfs.* extended attribute space and allow for the inheritance of extended attributes across fork() and exec(). The first simple scheme will allow privileged userspace to set trusted extended attributes on pidfs inodes. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-12-98f3456fd552@kernel.org Signed-off-by: Christian Brauner commit 9f85fdb9fc5a1bd308a10a0a7d7e34f2712ba58b Author: Pawan Gupta Date: Wed Jun 11 10:29:31 2025 -0700 x86/bugs: Avoid warning when overriding return thunk The purpose of the warning is to prevent an unexpected change to the return thunk mitigation. However, there are legitimate cases where the return thunk is intentionally set more than once. For example, ITS and SRSO both can set the return thunk after retbleed has set it. In both the cases retbleed is still mitigated. Replace the warning with an info about the active return thunk. Suggested-by: Borislav Petkov Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250611-eibrs-fix-v4-3-5ff86cac6c61@linux.intel.com commit 2773d282cd56464f62e9b4703c41d2f733a67842 Author: Junxuan Liao Date: Sun Jun 22 23:01:32 2025 -0500 docs/vfs: update references to i_mutex to i_rwsem VFS has switched to i_rwsem for ten years now (9902af79c01a: parallel lookups actual switch to rwsem), but the VFS documentation and comments still has references to i_mutex. Signed-off-by: Junxuan Liao Link: https://lore.kernel.org/72223729-5471-474a-af3c-f366691fba82@cs.wisc.edu Signed-off-by: Christian Brauner commit 530e80648bff083e1d19ad7248c0540812a9a35f Author: Pawan Gupta Date: Wed Jun 11 10:29:15 2025 -0700 x86/bugs: Simplify the retbleed=stuff checks Simplify the nested checks, remove redundant print and comment. Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Nikolay Borisov Acked-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250611-eibrs-fix-v4-2-5ff86cac6c61@linux.intel.com commit 98ff5c071d1cde9426b0bfa449c43d49ec58f1c4 Author: Pawan Gupta Date: Wed Jun 11 10:29:00 2025 -0700 x86/bugs: Avoid AUTO after the select step in the retbleed mitigation The retbleed select function leaves the mitigation to AUTO in some cases. Moreover, the update function can also set the mitigation to AUTO. This is inconsistent with other mitigations and requires explicit handling of AUTO at the end of update step. Make sure a mitigation gets selected in the select step, and do not change it to AUTO in the update step. When no mitigation can be selected leave it to NONE, which is what AUTO was getting changed to in the end. Suggested-by: Borislav Petkov Signed-off-by: Pawan Gupta Signed-off-by: Borislav Petkov (AMD) Acked-by: Borislav Petkov (AMD) Link: https://lore.kernel.org/20250611-eibrs-fix-v4-1-5ff86cac6c61@linux.intel.com commit c0b1da281d84d33281fc49289f0c7f8aada450ff Author: Cosmin Tanislav Date: Fri Jun 13 14:21:53 2025 +0300 media: rc: ir-spi: avoid overflow in multiplication Switch to u64 arithmetic and use DIV_ROUND_CLOSEST_ULL() to avoid the overflow. buffer[i] is unsigned int and is limited by the lirc core to IR_MAX_DURATION, which is 500000. idata->freq is u32, which has a max value of 0xFFFFFFFF. In the case where buffer[i] is 500000, idata->freq overflows the u32 multiplication for any values >= 8590. 0xFFFFFFFF / 500000 ~= 8589 By casting buffer[i] to u64, idata->freq can be any u32 value without overflowing the multiplication. 0xFFFFFFFFFFFFFFFF / 500000 ~= 36893488147419 (> 4294967295) The result of the final operation will fit back into the unsigned int limits without any issues. 500000 * 0xFFFFFFFF / 1000000 = 0x80000000 (< 0xFFFFFFFF) Signed-off-by: Cosmin Tanislav Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit 032a68ccb7834b28d51c11bbfe1c2db02e65ad28 Author: Cosmin Tanislav Date: Fri Jun 13 14:21:52 2025 +0300 media: rc: ir-spi: constrain carrier frequency Carrier frequency is currently unconstrained, allowing the SPI transfer to be allocated and filled only for it to be later rejected by the SPI controller since the frequency is too large. Add a check to constrain the carrier frequency inside ir_spi_set_tx_carrier(). Also, move the number of bits per pulse to a macro since it is not used in multiple places. Signed-off-by: Cosmin Tanislav Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit c898efdd6ecc4a9f9f4d4114370e6ed477f66b8a Author: Cosmin Tanislav Date: Fri Jun 13 14:21:51 2025 +0300 media: rc: ir-spi: allocate buffer dynamically Replace the static transmit buffer with a dynamically allocated one, removing the limit imposed on the number of pulses to transmit. Calculate the number of pulses for each duration in the received buffer ahead of time, while also adding up the total pulses, to be able to allocate a buffer that perfectly fits the total number of pulses, then populate it. Signed-off-by: Cosmin Tanislav Signed-off-by: Sean Young Signed-off-by: Hans Verkuil commit d7f8ffd0db905cdb1e8182023ac9578c5551815f Author: Xose Vazquez Perez Date: Mon Jun 16 18:32:47 2025 +0200 s390/boot: Use the full title of the manual for facility bits Also indicate the name of the section where facility bits are listed, because the manual has a length of 2124 pages. The current version is Fourteenth Edition (May, 2022) SA22-7832-13 Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Alexander Gordeev Cc: Christian Borntraeger Cc: Sven Schnelle Cc: S390 ML Signed-off-by: Xose Vazquez Perez Acked-by: Heiko Carstens Link: https://lore.kernel.org/r/20250616163248.77951-1-xose.vazquez@gmail.com Signed-off-by: Alexander Gordeev commit 75227ed6812cb869380c8fb6d41a845ae571781e Author: Kent Overstreet Date: Wed Jun 11 15:12:20 2025 -0400 dm-flakey: Fix corrupt_bio_byte setup checks Fix the error_reads mode - it's incompatible with corrupt_bio_byte, but that's only enabled if corrupt_bio_byte is nonzero. Cc: Benjamin Marzinski Cc: Mikulas Patocka Cc: Mike Snitzer Cc: dm-devel@lists.linux.dev Signed-off-by: Kent Overstreet Reviewed-by: Benjamin Marzinski Fixes: 19da6b2c9e8e ("dm-flakey: Clean up parsing messages") Signed-off-by: Mikulas Patocka commit 8ca719b81987be690f197e82fdb030580c0a07f3 Author: Benjamin Marzinski Date: Fri Jun 13 19:08:52 2025 -0400 dm-table: fix checking for rq stackable devices Due to the semantics of iterate_devices(), the current code allows a request-based dm table as long as it includes one request-stackable device. It is supposed to only allow tables where there are no non-request-stackable devices. Signed-off-by: Benjamin Marzinski Reviewed-by: Mike Snitzer Signed-off-by: Mikulas Patocka commit 2d1beba54fdaac0d624b016025d4ec5856713fb1 Author: Alok Tiwari Date: Sun Jun 22 10:17:03 2025 -0700 thunderbolt: Fix typos in documentation comments Fixes two minor typos in Thunderbolt driver comments: Correct "passwd" -> "passed" in nvm.c. Correct "boths" -> "both" in switch.c. Signed-off-by: Alok Tiwari Signed-off-by: Mika Westerberg commit 786bd08c0055a133cbafa5f2c044433849906c1d Author: Vignesh Raman Date: Mon Jun 23 14:20:28 2025 +0530 drm/ci: Add jobs to run KUnit tests Add jobs to run KUnit tests using tools/testing/kunit/kunit.py tool. Signed-off-by: Vignesh Raman Acked-by: Helen Koike Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250623085033.39680-3-vignesh.raman@collabora.com Signed-off-by: Maxime Ripard commit deac70abb12a4a613bbc3ba69aa7377c16cda3d0 Author: Vignesh Raman Date: Mon Jun 23 14:20:27 2025 +0530 drm/ci: Add jobs to validate devicetrees Add jobs to run dt_binding_check and dtbs_check. If warnings are seen, exit with a non-zero error code while configuring them as warning in the GitLab CI pipeline. Signed-off-by: Vignesh Raman Acked-by: Helen Koike Reviewed-by: Maxime Ripard Acked-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250623085033.39680-2-vignesh.raman@collabora.com Signed-off-by: Maxime Ripard commit a629feabb53b8d714caa8fb9f307517218a5fbcd Author: Ryosuke Yasuoka Date: Fri Jun 13 22:20:14 2025 +0900 drm/bochs: Add support for drm_panic Add drm_panic module for bochs drm so that panic screen can be displayed on panic. Signed-off-by: Ryosuke Yasuoka Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250613132023.106946-1-ryasuoka@redhat.com Signed-off-by: Jocelyn Falempe commit 301b96e0668a6a0770a334b7243858b4f2d05091 Author: Jerome Brunet Date: Wed Jun 11 14:53:59 2025 +0200 clk: amlogic: axg-audio: use the auxiliary reset driver Remove the implementation of the reset driver in axg audio clock driver and migrate to the one provided by reset framework on the auxiliary bus. Link: https://lore.kernel.org/r/20250611-clk-aux-v1-4-fb6575ed86a7@baylibre.com Signed-off-by: Jerome Brunet commit 2566de3e06a35b6517bcab11fd25b65ef90fd180 Author: Zenghui Yu Date: Wed Jun 18 18:00:26 2025 +0800 crypto: hisilicon - Use fine grained DMA mapping direction The following splat was triggered when booting the kernel built with arm64's defconfig + CRYPTO_SELFTESTS + DMA_API_DEBUG. ------------[ cut here ]------------ DMA-API: hisi_sec2 0000:75:00.0: cacheline tracking EEXIST, overlapping mappings aren't supported WARNING: CPU: 24 PID: 1273 at kernel/dma/debug.c:596 add_dma_entry+0x248/0x308 Call trace: add_dma_entry+0x248/0x308 (P) debug_dma_map_sg+0x208/0x3e4 __dma_map_sg_attrs+0xbc/0x118 dma_map_sg_attrs+0x10/0x24 hisi_acc_sg_buf_map_to_hw_sgl+0x80/0x218 [hisi_qm] sec_cipher_map+0xc4/0x338 [hisi_sec2] sec_aead_sgl_map+0x18/0x24 [hisi_sec2] sec_process+0xb8/0x36c [hisi_sec2] sec_aead_crypto+0xe4/0x264 [hisi_sec2] sec_aead_encrypt+0x14/0x20 [hisi_sec2] crypto_aead_encrypt+0x24/0x38 test_aead_vec_cfg+0x480/0x7e4 test_aead_vec+0x84/0x1b8 alg_test_aead+0xc0/0x498 alg_test.part.0+0x518/0x524 alg_test+0x20/0x64 cryptomgr_test+0x24/0x44 kthread+0x130/0x1fc ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- DMA-API: Mapped at: debug_dma_map_sg+0x234/0x3e4 __dma_map_sg_attrs+0xbc/0x118 dma_map_sg_attrs+0x10/0x24 hisi_acc_sg_buf_map_to_hw_sgl+0x80/0x218 [hisi_qm] sec_cipher_map+0xc4/0x338 [hisi_sec2] This occurs in selftests where the input and the output scatterlist point to the same underlying memory (e.g., when tested with INPLACE_TWO_SGLISTS mode). The problem is that the hisi_sec2 driver maps these two different scatterlists using the DMA_BIDIRECTIONAL flag which leads to overlapped write mappings which are not supported by the DMA layer. Fix it by using the fine grained and correct DMA mapping directions. While at it, switch the DMA directions used by the hisi_zip driver too. Signed-off-by: Zenghui Yu Reviewed-by: Longfang Liu Signed-off-by: Herbert Xu commit c71187c17f0b9fa7a567f09fc079369ae3970e85 Author: Thomas Weißschuh Date: Wed Jun 18 09:10:18 2025 +0200 crypto: ccree - Don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Signed-off-by: Herbert Xu commit e109b8ee1a3d5665f2f60612a60ad6c95339f5d3 Author: Jeff Barnes Date: Tue Jun 17 15:30:05 2025 -0400 crypto: testmgr - Restore sha384 and hmac_sha384 drbgs in FIPS mode Set .fips_allowed in the following drbg alg_test_desc structs. drbg_nopr_hmac_sha384 drbg_nopr_sha384 drbg_pr_hmac_sha384 drbg_pr_sha384 The sha384 and hmac_sha384 DRBGs with and without prediction resistance were disallowed in an early version of the FIPS 140-3 Implementation Guidance document. Hence, the fips_allowed flag in struct alg_test_desc pertaining to the affected DRBGs was unset. The IG has been withdrawn and they are allowed again. Furthermore, when the DRBGs are configured, /proc/crypto shows that drbg_*pr_sha384 and drbg_*pr_hmac_sha384 are fips-approved ("fips: yes") but because their self-tests are not run (a consequence of unsetting the fips_allowed flag), the drbgs won't load successfully with the seeming contradictory "fips: yes" in /proc/crypto. This series contains a single patch that sets the fips_allowed flag in the sha384-impacted DRBGs, which restores the ability to load them in FIPS mode. Link: https://lore.kernel.org/linux-crypto/979f4f6f-bb74-4b93-8cbf-6ed653604f0e@jvdsn.com/ Link: https://csrc.nist.gov/CSRC/media/Projects/cryptographic-module-validation-program/documents/fips%20140-3/FIPS%20140-3%20IG.pdf To: Herbert Xu To: David S. Miller Cc: linux-crypto@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Jeff Barnes Signed-off-by: Herbert Xu commit 4e55a929ff4d973206879a997a47a188353b3cd6 Author: Suman Kumar Chakraborty Date: Tue Jun 17 12:27:12 2025 +0100 crypto: qat - restore ASYM service support for GEN6 devices Support for asymmetric crypto services was not included in the qat_6xxx by explicitly setting the asymmetric capabilities to 0 to allow for additional testing. Enable asymmetric crypto services on QAT GEN6 devices by setting the appropriate capability flags. Fixes: 17fd7514ae68 ("crypto: qat - add qat_6xxx driver") Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 7ae637a269cdc41cdebf86341a5cf3f2281e805c Author: Suman Kumar Chakraborty Date: Tue Jun 17 11:52:32 2025 +0100 crypto: qat - remove duplicate masking for GEN6 devices The ICP_ACCEL_CAPABILITIES_CIPHER capability is masked out redundantly for QAT GEN6 devices. Remove it to avoid code duplication. This does not introduce any functional change. Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit ab8b9fd39c45b7760093528cbef93e7353359d82 Author: Ashish Kalra Date: Mon Jun 16 21:50:27 2025 +0000 crypto: ccp - Fix SNP panic notifier unregistration Panic notifiers are invoked with RCU read lock held and when the SNP panic notifier tries to unregister itself from the panic notifier callback itself it causes a deadlock as notifier unregistration does RCU synchronization. Code flow for SNP panic notifier: snp_shutdown_on_panic() -> __sev_firmware_shutdown() -> __sev_snp_shutdown_locked() -> atomic_notifier_chain_unregister(.., &snp_panic_notifier) Fix SNP panic notifier to unregister itself during SNP shutdown only if panic is not in progress. Reviewed-by: Tom Lendacky Cc: stable@vger.kernel.org Fixes: 19860c3274fb ("crypto: ccp - Register SNP panic notifier only if SNP is enabled") Signed-off-by: Ashish Kalra Signed-off-by: Herbert Xu commit f5ad93ffb54119a8dc5e18f070624d4ead586969 Author: Suman Kumar Chakraborty Date: Mon Jun 16 04:19:44 2025 +0100 crypto: zstd - convert to acomp Convert the implementation to a native acomp interface using zstd streaming APIs, eliminating the need for buffer linearization. This includes: - Removal of the scomp interface in favor of acomp - Refactoring of stream allocation, initialization, and handling for both compression and decompression using Zstandard streaming APIs - Replacement of crypto_register_scomp() with crypto_register_acomp() for module registration Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 1adaaeeb90c341a7e577b11d57354b22ea307003 Author: Dr. David Alan Gilbert Date: Sat Jun 14 01:05:05 2025 +0100 crypto: virtio - Remove unused virtcrypto functions virtcrypto_devmgr_get_first() and virtcrypto_dev_in_use() were added in 2016 by commit dbaf0624ffa5 ("crypto: add virtio-crypto driver") but have remained unused. Remove them. Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Zenghui Yu Signed-off-by: Herbert Xu commit 8024774190a5ef2af2c5846f60a50b23e0980a32 Author: Giovanni Cabiddu Date: Fri Jun 13 11:32:27 2025 +0100 crypto: qat - lower priority for skcipher and aead algorithms Most kernel applications utilizing the crypto API operate synchronously and on small buffer sizes, therefore do not benefit from QAT acceleration. Reduce the priority of QAT implementations for both skcipher and aead algorithms, allowing more suitable alternatives to be selected by default. Signed-off-by: Giovanni Cabiddu Link: https://lore.kernel.org/all/20250613012357.GA3603104@google.com/ Cc: stable@vger.kernel.org Acked-by: Eric Biggers Signed-off-by: Herbert Xu commit 1e2b7fcd3f075ff8c5b0e4474fe145d1c685f54f Author: Herbert Xu Date: Fri Jun 13 16:51:38 2025 +0800 crypto: ahash - Stop legacy tfms from using the set_virt fallback path Ensure that drivers that have not been converted to the ahash API do not use the ahash_request_set_virt fallback path as they cannot use the software fallback. Reported-by: Eric Biggers Fixes: 9d7a0ab1c753 ("crypto: ahash - Handle partial blocks in API") Signed-off-by: Herbert Xu commit 8c8dea2664fcfe861f10980059a116dfe61f536b Author: Rob Herring (Arm) Date: Wed Jun 11 18:10:56 2025 -0500 dt-bindings: crypto: Convert ti,omap4-des to DT schema Convert the TI OMAP DES binding to DT schema format. Drop "ti,hwmods" as it is not actually used for this binding. Only OMAP2 platforms are using it. Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit d0544657a28aade89e981bebdc116c628d750332 Author: Rob Herring (Arm) Date: Wed Jun 11 18:10:45 2025 -0500 dt-bindings: crypto: Convert ti,omap2-aes to DT schema Convert the TI OMAP AES binding to DT schema format. It's a straight forward conversion. Make "ti,hwmods" not required as it is deprecated and only used on OMAP2. Signed-off-by: Rob Herring (Arm) Reviewed-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit 3c6e41aa617e988c52937ce241d0d7afc9691b3a Author: Ryan Wanner Date: Wed Jun 11 12:47:29 2025 -0700 crypto: atmel - add support for AES and SHA IPs available on sama7d65 SoC This patch adds support for hardware version of AES and SHA IPs available on SAMA7D65 SoC. Signed-off-by: Ryan Wanner Signed-off-by: Herbert Xu commit b32ab5f768f1c2412978b8eedecb284e4a8654b5 Author: Ryan Wanner Date: Wed Jun 11 12:47:28 2025 -0700 dt-bindings: rng: atmel,at91-trng: add sama7d65 TRNG Add compatible for Microchip SAMA7D65 SoC TRNG. Signed-off-by: Ryan Wanner Reviewed-by: Claudiu Beznea Acked-by: Rob Herring (Arm) Signed-off-by: Herbert Xu commit eafca096a368dda134ed0cda20fc98d314329169 Author: Ryan Wanner Date: Wed Jun 11 12:47:27 2025 -0700 dt-bindings: crypto: add sama7d65 in Atmel TDES Add DT bindings for SAMA7D65 SoC Atmel TDES. The SAMA7D65 SoC has the same capability as the SAM9x75 SoC. Signed-off-by: Ryan Wanner Acked-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit 62a5462a24a32844c269eff50f17412982b118e9 Author: Ryan Wanner Date: Wed Jun 11 12:47:26 2025 -0700 dt-bindings: crypto: add sama7d65 in Atmel SHA Add DT bindings for SAMA7D65 SoC Atmel SHA. The SAMA7D65 similar to the SAM9x75 SoC supports SHA1/224/256/384/512 and supports HMAC for the same hashes. They both also support automatic padding as well as double buffering. Signed-off-by: Ryan Wanner Acked-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit fe14fa50581752b41ae5e97887a97c957df56de6 Author: Ryan Wanner Date: Wed Jun 11 12:47:25 2025 -0700 dt-bindings: crypto: add sama7d65 in Atmel AES Add DT bindings for SAMA7D65 SoC in atmel AES. The SAMA7D65 similar to the SAM9x75 SoC supports HMAC, dual buffer, and GCM. And similar all 3 it supports CBC, CFB, CTR, ECB, and XTS. Signed-off-by: Ryan Wanner Acked-by: Krzysztof Kozlowski Signed-off-by: Herbert Xu commit 2df6ee328c548a804bd0ecac8b0ee254bf79db23 Author: John Ernberg Date: Wed Jun 11 11:38:09 2025 +0000 dt-bindings: crypto: fsl,sec-v4.0: Add power domains for iMX8QM and iMX8QXP NXP SoCs like the iMX8QM, iMX8QXP or iMX8DXP use power domains for resource management. Add compatible strings for these SoCs (QXP and DXP gets to share as their only difference is a core-count, Q=Quad core and D=Dual core), and allow power-domains for them only. Keep the old restriction for others. Signed-off-by: John Ernberg Reviewed-by: Rob Herring (Arm) Signed-off-by: Herbert Xu commit ac8aff0035fa58e53b39bd565ad6422a90ccdc87 Author: John Ernberg Date: Wed Jun 11 11:38:08 2025 +0000 crypto: caam - Support iMX8QXP and variants thereof The iMX8QXP (and variants such as the QX, DX, DXP) all identify as iMX8QXP. They have the exact same restrictions as the supported iMX8QM introduced at commit 61bb8db6f682 ("crypto: caam - Add support for i.MX8QM") Loosen the check a little bit with a wildcard to also match the iMX8QXP and its variants. Signed-off-by: John Ernberg Reviewed-by: Frank Li Reviewed-by: Peng Fan Signed-off-by: Herbert Xu commit 5ffc47feddcf8eb4d8ac7b42111a02c8e8146512 Author: John Ernberg Date: Wed Jun 11 11:38:08 2025 +0000 crypto: caam - Prevent crash on suspend with iMX8QM / iMX8ULP Since the CAAM on these SoCs is managed by another ARM core, called the SECO (Security Controller) on iMX8QM and Secure Enclave on iMX8ULP, which also reserves access to register page 0 suspend operations cannot touch this page. This is similar to when running OPTEE, where OPTEE will reserve page 0. Track this situation using a new state variable no_page0, reflecting if page 0 is reserved elsewhere, either by other management cores in SoC or by OPTEE. Replace the optee_en check in suspend/resume with the new check. optee_en cannot go away as it's needed elsewhere to gate OPTEE specific situations. Fixes the following splat at suspend: Internal error: synchronous external abort: 0000000096000010 [#1] SMP Hardware name: Freescale i.MX8QXP ACU6C (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : readl+0x0/0x18 lr : rd_reg32+0x18/0x3c sp : ffffffc08192ba20 x29: ffffffc08192ba20 x28: ffffff8025190000 x27: 0000000000000000 x26: ffffffc0808ae808 x25: ffffffc080922338 x24: ffffff8020e89090 x23: 0000000000000000 x22: ffffffc080922000 x21: ffffff8020e89010 x20: ffffffc080387ef8 x19: ffffff8020e89010 x18: 000000005d8000d5 x17: 0000000030f35963 x16: 000000008f785f3f x15: 000000003b8ef57c x14: 00000000c418aef8 x13: 00000000f5fea526 x12: 0000000000000001 x11: 0000000000000002 x10: 0000000000000001 x9 : 0000000000000000 x8 : ffffff8025190870 x7 : ffffff8021726880 x6 : 0000000000000002 x5 : ffffff80217268f0 x4 : ffffff8021726880 x3 : ffffffc081200000 x2 : 0000000000000001 x1 : ffffff8020e89010 x0 : ffffffc081200004 Call trace: readl+0x0/0x18 caam_ctrl_suspend+0x30/0xdc dpm_run_callback.constprop.0+0x24/0x5c device_suspend+0x170/0x2e8 dpm_suspend+0xa0/0x104 dpm_suspend_start+0x48/0x50 suspend_devices_and_enter+0x7c/0x45c pm_suspend+0x148/0x160 state_store+0xb4/0xf8 kobj_attr_store+0x14/0x24 sysfs_kf_write+0x38/0x48 kernfs_fop_write_iter+0xb4/0x178 vfs_write+0x118/0x178 ksys_write+0x6c/0xd0 __arm64_sys_write+0x14/0x1c invoke_syscall.constprop.0+0x64/0xb0 do_el0_svc+0x90/0xb0 el0_svc+0x18/0x44 el0t_64_sync_handler+0x88/0x124 el0t_64_sync+0x150/0x154 Code: 88dffc21 88dffc21 5ac00800 d65f03c0 (b9400000) Fixes: d2835701d93c ("crypto: caam - i.MX8ULP donot have CAAM page0 access") Cc: stable@kernel.org # v6.10+ Signed-off-by: John Ernberg Reviewed-by: Peng Fan Reviewed-by: Frank Li Signed-off-by: Herbert Xu commit d2b23a8dd88768cdfda504ca17a4984c5ae00693 Author: ChengZhenghan Date: Wed Jun 11 10:51:31 2025 +0800 crypto: x86 - Fix build warnings about export.h I got some build warnings with W=1: arch/x86/coco/sev/core.c: arch/x86/crypto/aria_aesni_avx2_glue.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/x86/crypto/aria_aesni_avx_glue.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/x86/crypto/camellia_aesni_avx_glue.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/x86/crypto/camellia_glue.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/x86/crypto/curve25519-x86_64.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/x86/crypto/serpent_avx_glue.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/x86/crypto/sm4_aesni_avx_glue.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/x86/crypto/twofish_glue.c: warning: EXPORT_SYMBOL() is used, but #include is missing arch/x86/crypto/twofish_glue_3way.c: warning: EXPORT_SYMBOL() is used, but #include is missing so I fixed these build warnings for x86_64. Signed-off-by: ChengZhenghan Signed-off-by: Herbert Xu commit d5fa96dc5590915f060fee3209143313e4f5b03b Author: Arnd Bergmann Date: Tue Jun 10 11:32:52 2025 +0200 crypto: arm/aes-neonbs - work around gcc-15 warning I get a very rare -Wstringop-overread warning with gcc-15 for one function in aesbs_ctr_encrypt(): arch/arm/crypto/aes-neonbs-glue.c: In function 'ctr_encrypt': arch/arm/crypto/aes-neonbs-glue.c:212:1446: error: '__builtin_memcpy' offset [17, 2147483647] is out of the bounds [0, 16] of object 'buf' with type 'u8[16]' {aka 'unsigned char[16]'} [-Werror=array-bounds=] 212 | src = dst = memcpy(buf + sizeof(buf) - bytes, arch/arm/crypto/aes-neonbs-glue.c: In function 'ctr_encrypt': arch/arm/crypto/aes-neonbs-glue.c:218:17: error: 'aesbs_ctr_encrypt' reading 1 byte from a region of size 0 [-Werror=stringop-overread] 218 | aesbs_ctr_encrypt(dst, src, ctx->rk, ctx->rounds, bytes, walk.iv); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm/crypto/aes-neonbs-glue.c:218:17: note: referencing argument 2 of type 'const u8[0]' {aka 'const unsigned char[]'} arch/arm/crypto/aes-neonbs-glue.c:218:17: note: referencing argument 3 of type 'const u8[0]' {aka 'const unsigned char[]'} arch/arm/crypto/aes-neonbs-glue.c:218:17: note: referencing argument 6 of type 'u8[0]' {aka 'unsigned char[]'} arch/arm/crypto/aes-neonbs-glue.c:36:17: note: in a call to function 'aesbs_ctr_encrypt' 36 | asmlinkage void aesbs_ctr_encrypt(u8 out[], u8 const in[], u8 const rk[], This could happen in theory if walk.nbytes is larger than INT_MAX and gets converted to a negative local variable. Keep the type unsigned like the orignal nbytes to be sure there is no integer overflow. Fixes: c8bf850e991a ("crypto: arm/aes-neonbs-ctr - deal with non-multiples of AES block size") Signed-off-by: Arnd Bergmann Acked-by: Ard Biesheuvel Signed-off-by: Herbert Xu commit 266907bb491f2bdd731139792b5a5056b6d0a482 Author: Jani Nikula Date: Thu Jun 12 15:46:17 2025 +0300 drm/i915/panel: make panel funcs static The drm panel funcs should be static, fix it. Fixes: 3fdd5bfbd638 ("drm/i915/panel: register drm_panel and call prepare/unprepare for ICL+ DSI") Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250612124617.626958-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 400ade1638fb27ece197f5498ecef4fd0892d472 Merge: 07faff368d7fa8 36c52fb703e903 Author: Jani Nikula Date: Mon Jun 23 10:57:13 2025 +0300 Merge drm/drm-next into drm-intel-next Sync with drm_panel changes from drm-misc-next, and xe driver changes from drm-xe-next. Signed-off-by: Jani Nikula commit cb908f3699fb137e28017a8fdf506c35762b3eb6 Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:25 2025 +0200 gpio: sa1100: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-12-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit d68ddf651dd2faea5cdc6f6656148b739c38645b Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:24 2025 +0200 gpio: rtd: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-11-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit 6731ad96e8770595d4a6ceb07e587b07d22da110 Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:23 2025 +0200 gpio: rockchip: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-10-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit 76033f1f927cd93907c1e9eb3f86e54015e4366d Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:21 2025 +0200 gpio: rdc321x: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-8-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit 309ea5811136a06f572c7abbeae2dcf773629a5e Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:20 2025 +0200 gpio: rc5t583: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-7-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit f1ff31c8ef80f4720ebf7854e6af6204dddd9ce3 Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:19 2025 +0200 gpio: pxa: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-6-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit fecdef830c442e4375a3bbdde26af385583fb05c Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:18 2025 +0200 gpio: pmic-eic-sprd: drop unneeded .set() callback The lines on this chip are input-only. GPIO core can handle the missing .set() callback so there's no need to implement a dummy here. Drop it. Reviewed-by: Baolin Wang Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-5-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit 201e0f24a5b73fa73606ae2261d155f00cb6d577 Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:17 2025 +0200 gpio: pl061: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-4-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit 74260fb09cc6f6e7bb6741bedca4463079800ead Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:16 2025 +0200 gpio: pch: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-3-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit 4027438be823abdcfb50ee2abed06fa4e6af4b7c Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:15 2025 +0200 gpio: pcf857x: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-2-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit 40b71f1171da13664e9677fbd993d9098315d71e Author: Bartosz Golaszewski Date: Thu Jun 19 10:33:14 2025 +0200 gpio: pca9570: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250619-gpiochip-set-rv-gpio-v2-1-74abf689fbd8@linaro.org Signed-off-by: Bartosz Golaszewski commit a0cfbc67d71c763357a8847305e3d5254028c0da Author: Daniel Sullivan Date: Sat Jun 21 17:12:33 2025 -0700 gpio: ts5500: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Daniel Sullivan Link: https://lore.kernel.org/r/aFdKce3Go9iF4A6m@danv-Standard-PC-Q35-ICH9-2009 Signed-off-by: Bartosz Golaszewski commit e6bb78570f7d531622ec572ef9ddbe6e66ff16ce Author: Antonio Quartulli Date: Mon Jun 23 00:02:21 2025 +0200 gpio: sysfs: fix use-after-free in error path When invoking device_create_with_groups(), its return value is stored in `data->cdev_base`. However, in case of faiure, `data` is first freed and then derefernced in order to return `data->cdev_base`. Fix the use-after-free by extracting the error code before free'ing `data`. Fixes: fd19792851db ("gpio: sysfs: remove the mockdev pointer from struct gpio_device") Addresses-Coverity-ID: 1644512 ("Memory - illegal accesses (USE_AFTER_FREE)") Signed-off-by: Antonio Quartulli Link: https://lore.kernel.org/r/20250622220221.28025-1-antonio@mandelbit.com [Bartosz: added Fixes: tag, tweaked commit message] Signed-off-by: Bartosz Golaszewski commit b20d6576cdb3530d4a2d81611a8b8eb99780ce3e Author: Jiri Slaby (SUSE) Date: Mon Jun 23 08:10:35 2025 +0200 serial: 8250: export RSA functions The RSA functions moved by the below commit to 8250_rsa.c are used in 8250_base.c. Since that can be a module (when CONFIG_SERIAL_8250=m), this causes build failures: ERROR: modpost: "rsa_autoconfig" [drivers/tty/serial/8250/8250_base.ko] undefined! ERROR: modpost: "rsa_reset" [drivers/tty/serial/8250/8250_base.ko] undefined! ERROR: modpost: "rsa_disable" [drivers/tty/serial/8250/8250_base.ko] undefined! ERROR: modpost: "rsa_enable" [drivers/tty/serial/8250/8250_base.ko] undefined! Fix them by exporting the functions. But only to the base module using EXPORT_SYMBOL_GPL_FOR_MODULES(). (And not to the whole world.) Signed-off-by: "Jiri Slaby (SUSE)" Reported-by: Stephen Rothwell Link: https://lore.kernel.org/all/20250619165607.33403e19@canb.auug.org.au/ Fixes: 5a128fb475fb ("serial: 8250: move RSA functions to 8250_rsa.c") Link: https://lore.kernel.org/r/20250623061035.436414-1-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 07faff368d7fa85715564b0974caf16899f3b5f9 Author: Chaitanya Kumar Borah Date: Thu Jun 19 09:56:29 2025 +0530 drm/xe/display: read PCON capability only when present Avoid reading the PCON capabilities redundantly on non-branch devices. v2: - Make commit description more accurate. (Imre) - Clear intel_dp->pcon_dsc_dpcd irrespective of presense of PCON. (Imre) Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Imre Deak Signed-off-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250619042629.3980244-1-chaitanya.kumar.borah@intel.com commit 63dafeb392139b893a73b6331f347613f0929702 Merge: b29929b819f355 86731a2a651e58 Author: Greg Kroah-Hartman Date: Mon Jun 23 07:53:36 2025 +0200 Merge 6.16-rc3 into driver-core-next We need the driver-core fixes that are in 6.16-rc3 into here as well to build on top of. Signed-off-by: Greg Kroah-Hartman commit b1b41bc072baf7301b1ae95fe417de09a5ad47e2 Author: Arnd Bergmann Date: Fri Jun 20 13:14:53 2025 +0200 cpufreq: armada-8k: make both cpu masks static An earlier patch marked one of the two CPU masks as 'static' to reduce stack usage, but if CONFIG_NR_CPUS is large enough, the function still produces a warning for compile testing: drivers/cpufreq/armada-8k-cpufreq.c: In function 'armada_8k_cpufreq_init': drivers/cpufreq/armada-8k-cpufreq.c:203:1: error: the frame size of 1416 bytes is larger than 1408 bytes [-Werror=frame-larger-than=] Normally this should be done using alloc_cpumask_var(), but since the driver already has a static mask and the probe function is not called concurrently, use the same trick for both. Fixes: 1ffec650d07f ("cpufreq: armada-8k: Avoid excessive stack usage") Signed-off-by: Arnd Bergmann Signed-off-by: Viresh Kumar commit c833e8cc4dca7e3c0a9d0b9047a1b4822b229262 Merge: edf2cadf01e8f2 86731a2a651e58 Author: Namhyung Kim Date: Sun Jun 22 21:54:03 2025 -0700 Merge tag 'v6.16-rc3' into perf-tools-next To get the fixes in libbpf and perf tools. Signed-off-by: Namhyung Kim commit cf183c1730f2634245da35e9b5d53381b787d112 Author: Thomas Fourier Date: Fri Jun 20 09:55:55 2025 +0200 powerpc: floppy: Add missing checks after DMA map The DMA map functions can fail and should be tested for errors. Signed-off-by: Thomas Fourier Reviewed-by: Christophe Leroy Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250620075602.12575-1-fourier.thomas@gmail.com commit f5164797284da220c79d08d780c723f36e412e79 Author: Donet Tom Date: Sun Jun 22 07:01:25 2025 -0500 book3s64/radix : Optimize vmemmap start alignment If we always align the vmemmap start to PAGE_SIZE, there is a chance that we may end up allocating page-sized vmemmap backing pages in RAM in the altmap not present case, because a PAGE_SIZE aligned address is not PMD_SIZE-aligned. In this patch, we are aligning the vmemmap start address to PMD_SIZE if altmap is not present. This ensures that a PMD_SIZE page is always allocated for the vmemmap mapping if altmap is not present. If altmap is present, Make sure we align the start vmemmap addr to PAGE_SIZE so that we calculate the correct start_pfn in altmap boundary check to decide whether we should use altmap or RAM based backing memory allocation. Also the address need to be aligned for set_pte operation. If the start addr is already PMD_SIZE aligned and with in the altmap boundary then we will try to use a pmd size altmap mapping else we go for page size mapping. So if altmap is present, we try to use the maximum number of altmap pages; otherwise, we allocate a PMD_SIZE RAM page. Signed-off-by: Donet Tom Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/895c4afd912c85d344a2065e348fac90529ed48f.1750593372.git.donettom@linux.ibm.com commit 58450938f771a2cd6eda614e666526556a158801 Author: Donet Tom Date: Sun Jun 22 07:01:24 2025 -0500 book3s64/radix : Handle error conditions properly in radix_vmemmap_populate Error conditions are not handled properly if altmap is not present and PMD_SIZE vmemmap_alloc_block_buf fails. In this patch, if vmemmap_alloc_block_buf fails in the non-altmap case, we will fall back to the base mapping. Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Donet Tom Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/7f95fe91c827a2fb76367a58dbea724e811fb152.1750593372.git.donettom@linux.ibm.com commit 41a1452759a8b1121df9cf7310acf31d766ba70b Author: Haren Myneni Date: Sat May 31 16:50:02 2025 -0700 powerpc/pseries/dlpar: Search DRC index from ibm,drc-indexes for IO add IO hotplug add event is handled in the user space with drmgr tool. After the device is enabled, the user space uses /sys/kernel/dlpar interface with “dt add index ” to update the device tree. The kernel interface (dlpar_hp_dt_add()) finds the parent node for the specified ‘drc_index’ from ibm,drc-info property. The recent FW provides this property from 2017 onwards. But KVM guest code in some releases is still using the older SLOF firmware which has ibm,drc-indexes property instead of ibm,drc-info. If the ibm,drc-info is not available, this patch adds changes to search ‘drc_index’ from the indexes array in ibm,drc-indexes property to support old FW. Fixes: 02b98ff44a57 ("powerpc/pseries/dlpar: Add device tree nodes for DLPAR IO add") Reported-by: Kowshik Jois Signed-off-by: Haren Myneni Tested-by: Amit Machhiwal Reviewed-by: Tyrel Datwyler Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250531235002.239213-1-haren@linux.ibm.com commit c8346079cd962b61026ed620ea46830a58ca6707 Author: Gautam Menghani Date: Fri May 16 17:42:24 2025 +0530 KVM: PPC: Book3S HV: Add H_VIRT mapping for tracing exits The macro kvm_trace_symbol_exit is used for providing the mappings for the trap vectors and their names. Add mapping for H_VIRT so that trap reason is displayed as string instead of a vector number when using the kvm_guest_exit tracepoint. Signed-off-by: Gautam Menghani Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250516121225.276466-1-gautam@linux.ibm.com commit 52d4639d689059857b3d0494928dd5878cbdc395 Author: Shrikanth Hegde Date: Mon May 5 13:23:33 2025 +0530 powerpc: sysdev: use lock guard for mutex use guard(mutex) for scope based resource management of mutex This would make the code simpler and easier to maintain. More details on lock guards can be found at https://lore.kernel.org/all/20230612093537.614161713@infradead.org/T/#u Reviewed-by: Srikar Dronamraju Signed-off-by: Shrikanth Hegde Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250505075333.184463-7-sshegde@linux.ibm.com commit 8ea7819f6ec5782918e4d15906fa259a371e6bdd Author: Shrikanth Hegde Date: Mon May 5 13:23:32 2025 +0530 powerpc: powernv: ocxl: use lock guard for mutex use guard(mutex) for scope based resource management of mutex. This would make the code simpler and easier to maintain. More details on lock guards can be found at https://lore.kernel.org/all/20230612093537.614161713@infradead.org/T/#u Reviewed-by: Srikar Dronamraju Acked-by: Andrew Donnellan Signed-off-by: Shrikanth Hegde Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250505075333.184463-6-sshegde@linux.ibm.com commit 37989b532bc2cb1912fdcfe6d381a10c8452068a Author: Shrikanth Hegde Date: Mon May 5 13:23:31 2025 +0530 powerpc: book3s: vas: use lock guard for mutex use lock guards for scope based resource management of mutex. This would make the code simpler and easier to maintain. More details on lock guards can be found at https://lore.kernel.org/all/20230612093537.614161713@infradead.org/T/#u This shows the use of both guard and scoped_guard Reviewed-by: Srikar Dronamraju Signed-off-by: Shrikanth Hegde Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250505075333.184463-5-sshegde@linux.ibm.com commit 56534636c3c376a6868764eefd2a44b25f64fc0b Author: Shrikanth Hegde Date: Mon May 5 13:23:30 2025 +0530 powerpc: fadump: use lock guard for mutex use scoped_guard for scope based resource management of mutex. This would make the code simpler and easier to maintain. More details on lock guards can be found at https://lore.kernel.org/all/20230612093537.614161713@infradead.org/T/#u Reviewed-by: Srikar Dronamraju Signed-off-by: Shrikanth Hegde Tested-by: Venkat Rao Bagalkote Reviewed-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250505075333.184463-4-sshegde@linux.ibm.com commit 6a21d3c5b3ba7e515c92193d5ccda55c9c0f43f4 Author: Shrikanth Hegde Date: Mon May 5 13:23:29 2025 +0530 powerpc: rtas: use lock guard for mutex use guard(mutex) for scope based resource management of mutex. This would make the code simpler and easier to maintain. More details on lock guards can be found at https://lore.kernel.org/all/20230612093537.614161713@infradead.org/T/#u Reviewed-by: Srikar Dronamraju Signed-off-by: Shrikanth Hegde Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250505075333.184463-3-sshegde@linux.ibm.com commit 77ad7ef4a29b2635a3f387950f5f45f2c1a67d02 Author: Shrikanth Hegde Date: Mon May 5 13:23:28 2025 +0530 powerpc: eeh: use lock guard for mutex use guard(mutex) for scope based resource management of mutex. This would make the code simpler and easier to maintain. More details on lock guards can be found at https://lore.kernel.org/all/20230612093537.614161713@infradead.org/T/#u Reviewed-by: Srikar Dronamraju Signed-off-by: Shrikanth Hegde Tested-by: Venkat Rao Bagalkote Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250505075333.184463-2-sshegde@linux.ibm.com commit 7b7b08b508bdbc1c601fd60dd90ca6087609c253 Author: Paul Mackerras Date: Sat May 10 11:35:36 2025 +1000 powerpc/microwatt: Correct ISA version number in device tree The kernel uses 3100 to indicate ISA version 3.1, not 3010, so fix the Microwatt device tree to use 3100. Signed-off-by: Paul Mackerras Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/aB6taMDWvJwOl9xj@bruin commit a206d233401208e1c36cf7c66f23a36f91d33de3 Author: Madadi Vineeth Reddy Date: Sun Mar 30 13:17:34 2025 +0530 powerpc/defconfigs: Set HZ=1000 on ppc64 and powernv defconfigs Commit 030bdc3fd080 ("powerpc/defconfigs: Set HZ=100 on pseries and ppc64 defconfigs") lowered CONFIG_HZ from 250 to 100, citing reduced need for a higher tick rate due to high-resolution timers and concerns about timer interrupt overhead and cascading effects in the timer wheel. However, improvements have been made to the timer wheel algorithm since then, particularly in eliminating cascading effects at the cost of minor timekeeping inaccuracies. More details are available here https://lwn.net/Articles/646950/. This removes the original concern about cascading, and the reliance on high-resolution timers is not applicable to the scheduler, which still depends on periodic ticks set by CONFIG_HZ. With the introduction of the EEVDF scheduler, users can specify custom slices for workloads. The default base_slice is 3ms, but with CONFIG_HZ=100 (10ms tick interval), base_slice is ineffective. Workloads like stress-ng that do not voluntarily yield the CPU run for ~10ms before switching out. Additionally, setting a custom slice below 3ms (e.g., 2ms) should lower task latency, but this effect is lost due to the coarse 10ms tick. By increasing CONFIG_HZ to 1000 (1ms tick), base_slice is properly honored, and user-defined slices work as expected. Benchmark results support this change: Latency improvements in schbench with EEVDF under stress-ng-induced noise: Scheduler CONFIG_HZ Custom Slice 99th Percentile Latency (µs) -------------------------------------------------------------------- EEVDF 1000 No 0.30x EEVDF 1000 2 ms 0.29x EEVDF (default) 100 No 1.00x Switching to HZ=1000 reduces the 99th percentile latency in schbench by ~70%. This improvement occurs because, with HZ=1000, stress-ng tasks run for ~3ms before yielding, compared to ~10ms with HZ=100. As a result, schbench gets CPU time sooner, reducing its latency. Daytrader Performance: Daytrader results show minor variation within standard deviation, indicating no significant regression. Workload (Users/Instances) Throughput 1000HZ vs 100HZ (Std Dev%) -------------------------------------------------------------------------- 30 u, 1 i +3.01% (1.62%) 60 u, 1 i +1.46% (2.69%) 90 u, 1 i –1.33% (3.09%) 30 u, 2 i -1.20% (1.71%) 30 u, 3 i –0.07% (1.33%) Avg. Response Time: No Change (=) pgbench select queries: Metric 1000HZ vs 100HZ (Std Dev%) ------------------------------------------------------------------ Average TPS Change +2.16% (1.27%) Average Latency Change –2.21% (1.21%) Average TPS: Higher the better Average Latency: Lower the better pgbench shows both throughput and latency improvements beyond standard deviation. Given these results and the improvements in timer wheel implementation, increasing CONFIG_HZ to 1000 ensures that powerpc benefits from EEVDF’s base_slice and allows fine-tuned scheduling for latency-sensitive workloads. Signed-off-by: Madadi Vineeth Reddy Reviewed-by: Srikar Dronamraju Reviewed-by: Mukesh Kumar Chaurasiya Reviewed-by: Shrikanth Hegde Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250330074734.16679-1-vineethr@linux.ibm.com commit f9a1871e51449176a428685812f2bb1f5d617704 Author: Madhavan Srinivasan Date: Thu Jan 16 13:04:19 2025 +0530 powerpc/configs/64s: Enable CONFIG_KALLSYMS_ALL This adds all symbols required for use case like livepatching. Distros already enable this config and enabling this increases build time by 3% (in a power9 128 cpu setup) and almost no size changes for vmlinux. Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20250116073419.344453-1-maddy@linux.ibm.com commit 22679d807dea5c065d8019acfce48f20e87ba5ca Author: Abhinav Ananthu Date: Fri Jun 20 15:29:21 2025 +0530 rust: opp: use c_* types via kernel prelude Update OPP FFI callback signatures to use `c_int` from the `kernel::prelude`, instead of accessing it via `kernel::ffi::c_int`. Although these types are defined in a crate named `ffi`, they are re-exported via the `kernel::prelude` and should be used from there. This aligns with the Rust-for-Linux coding guidelines and ensures ABI correctness when interfacing with C code. Suggested-by: Viresh Kumar Signed-off-by: Abhinav Ananthu Signed-off-by: Viresh Kumar commit b0a86fb0b27f1ae944a6b0a1a9187c332bb2773e Author: Abhinav Ananthu Date: Fri Jun 20 14:22:30 2025 +0530 rust: cpufreq: use c_ types from kernel prelude Update cpufreq FFI callback signatures to use `c_int` from the `kernel::prelude`, rather than accessing it explicitly through `kernel::ffi::c_int`. Although these types are defined in the `ffi` crate, they are re-exported via `kernel::prelude`. This aligns with the Rust-for-Linux coding guidelines and ensures proper C ABI compatibility across platforms. Signed-off-by: Abhinav Ananthu Suggested-by: Viresh Kumar Reviewed-by: Alice Ryhl [ Viresh: Fixed rustfmtcheck errors ] Signed-off-by: Viresh Kumar commit 545daf90910ec83e167cf3fbcc31fcf5467432b8 Author: Naoya Tezuka Date: Fri Jun 20 15:28:22 2025 +0900 platform/chrome: chromeos_pstore: Add ecc_size module parameter On ChromiumOS devices, the `ecc_size` is set to 0 (check dmesg | grep ecc  to see `ecc: 0`): this disables ECC for ramoops region, even when  `ramoops.ecc=1` is given to kernel command line parameter. Introduce `ecc_size` module parameter to provide a method to turn on ECC for ramoops and set different values of ecc_size per devices. A large `ecc_size` value can cause a kernel panic due to a constraint in Reed-Solomon code library. The validation for this constraint should belong to the common pstore RAM layer, not in each individual driver. So this check is handled by a separate patch [1]. [1] https://lore.kernel.org/lkml/20250620054757.1006729-1-naoyatezuka@chromium.org Signed-off-by: Naoya Tezuka Link: https://lore.kernel.org/r/20250620062822.1018798-1-naoyatezuka@chromium.org Signed-off-by: Tzung-Bi Shih commit 36c52fb703e90388285963fc8f03cf60f76cbe4c Merge: 9356b50af547e8 b2f7e30d2e4a34 Author: Dave Airlie Date: Mon Jun 23 10:49:25 2025 +1000 Merge tag 'drm-intel-next-2025-06-18' of https://gitlab.freedesktop.org/drm/i915/kernel into drm-next drm/i915 feature pull for v6.17: Features and functionality: - Add support for DSC fractional link bpp on DP MST (Imre) - Add support for simultaneous Panel Replay and Adaptive Sync (Jouni) - Add support for PTL+ double buffered LUT registers (Chaitanya, Ville) - Add PIPEDMC event handling in preparation for flip queue (Ville) Refactoring and cleanups: - Rename lots of DPLL interfaces to unify them (Suraj) - Allocate struct intel_display dynamically (Jani) - Abstract VLV IOSF sideband better (Jani) - Use str_true_false() helper (Yumeng Fang) - Refactor DSB code in preparation for flip queue (Ville) - Use drm_modeset_lock_assert_held() instead of open coding (Luca) - Remove unused arg from skl_scaler_get_filter_select() (Luca) - Split out a separate display register header (Jani) - Abstract DRAM detection better (Jani) - Convert LPT/WPT SBI sideband to struct intel_display (Jani) Fixes: - Fix DSI HS command dispatch with forced pipeline flush (Gareth Yu) - Fix BMG and LNL+ DP adaptive sync SDP programming (Ankit) - Fix error path for xe display workqueue allocation (Haoxiang Li) - Disable DP AUX access probe where not required (Imre) - Fix DKL PHY access if the port is invalid (Luca) - Fix PSR2_SU_STATUS access on ADL+ (Jouni) - Add sanity checks for porch and sync on BXT/GLK DSI (Ville) DRM core changes: - Change AUX DPCD access probe address (Imre) - Refactor EDID quirks, amd make them available to drivers (Imre) - Add quirk for DPCD access probe (Imre) - Add DPCD definitions for Panel Replay capabilities (Jouni) Merges: - Backmerges to sync with v6.15-rcs and v6.16-rc1 (Jani) Signed-off-by: Dave Airlie From: Jani Nikula Link: https://lore.kernel.org/r/fff9f231850ed410bd81b53de43eff0b98240d31@intel.com commit 19cbc930c209d59a2c9828de4c7b767e9f14667e Author: Primoz Fiser Date: Wed Jun 18 08:33:39 2025 +0200 regulator: pca9450: Support PWM mode also for pca9451a Previous commit 548d770c330c ("regulator: pca9450: Add support for mode operations") added support for setting forced PWM mode on the buck regulators for pca9450a and pca9450bc parts. However part pca9451a also supports this feature, thus add support for it. Fixes: 548d770c330c ("regulator: pca9450: Add support for mode operations") Signed-off-by: Primoz Fiser Link: https://patch.msgid.link/20250618063339.2508893-1-primoz.fiser@norik.com Signed-off-by: Mark Brown commit c4ca928a6db1593802cd945f075a7e21dd0430c1 Author: Mark Brown Date: Fri Jun 13 17:41:04 2025 +0100 ASoC: hdac_hdmi: Rate limit logging on connection and disconnection We currently log parse failures for ELD data and some disconnection events as errors without rate limiting. These log messages can be triggered very frequently in some situations, especially ELD parsing when there is nothing connected to a HDMI port which will generate: hdmi-audio-codec hdmi-audio-codec.1.auto: HDMI: Unknown ELD version 0 While there's doubtless work that could be done on reducing the number of connection notification callbacks it's possible these may be legitimately generated by poor quality physical connections so let's use rate limiting to mitigate the log spam for the parse errors and lower the severity for disconnect logging to debug level. Signed-off-by: Mark Brown Link: https://patch.msgid.link/20250613-asoc-hdmi-eld-logging-v1-1-76d64154d969@kernel.org Signed-off-by: Mark Brown commit ac558015dfd803626622bd0ba9645d58a3ed16b1 Author: Shuming Fan Date: Mon Jun 16 19:49:29 2025 +0800 ASoC: SDCA: add a HID device for HIDE entity This patch supports to add a HID device for SDCA HIDE entity. The codec driver could call 'hid_input_report' to report events. Signed-off-by: Shuming Fan Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20250616114929.855496-1-shumingf@realtek.com Signed-off-by: Mark Brown commit a48352921f0b15b1f7eff83f5b5613d6ae2350d3 Author: Krzysztof Kozlowski Date: Mon Jun 16 13:54:11 2025 +0200 ASoC: codecs: wcd939x: Add defines for major/minor version decoding Replace hard-coded register values with defines for checking major and minor versions of device. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250616-asoc-wcd93xx-enum-v1-4-a20a1b538509@linaro.org Signed-off-by: Mark Brown commit 5d3ccd356e2ce510bdbd4b0c389f2fe3deb41a45 Author: Krzysztof Kozlowski Date: Mon Jun 16 13:54:10 2025 +0200 ASoC: codecs: wcd939x: Use simple defines for chipid register value The value used to identify chip variant is not an enumeration, but raw value used to compare registers with. The 'enum' is not used in the code at all, so simplify and make it a raw hex value define, so intention will be explicit. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250616-asoc-wcd93xx-enum-v1-3-a20a1b538509@linaro.org Signed-off-by: Mark Brown commit 100877df34b00257c9ed6d279b06b3ed1da5e2c1 Author: Krzysztof Kozlowski Date: Mon Jun 16 13:54:09 2025 +0200 ASoC: codecs: wcd938x: Use simple defines for chipid register value The value used to identify chip variant is not an enumeration, but raw value used to compare registers with. The 'enum' is not used in the code at all, so simplify and make it a raw hex value define, so intention will be explicit. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250616-asoc-wcd93xx-enum-v1-2-a20a1b538509@linaro.org Signed-off-by: Mark Brown commit 2f6ff1e615cd4f8a86c9d0e4e778db9ae44d5481 Author: Krzysztof Kozlowski Date: Mon Jun 16 13:54:08 2025 +0200 ASoC: codecs: wcd937x: Use simple defines for chipid register value The value used to identify chip variant is not an enumeration, but raw value used to compare registers with. The 'enum' is not used in the code at all, so simplify and make it a raw hex value define, so intention will be explicit. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250616-asoc-wcd93xx-enum-v1-1-a20a1b538509@linaro.org Signed-off-by: Mark Brown commit 58ae036172b5f051a19a32eba94a3e5eb37bf47e Author: Thomas Antoine Date: Fri May 23 14:51:44 2025 +0200 power: supply: max1720x correct capacity computation From the datasheet of the MAX17201/17205, the LSB should be "5.0μVh/RSENSE". The current computation sets it at 0.5mAh=5.0μVh/10mOhm, which does not take into account the value of rsense (which is in 10µV steps) which can be different from 10mOhm. Change the computation to fit the specs. Fixes: 479b6d04964b ("power: supply: add support for MAX1720x standalone fuel gauge") Signed-off-by: Thomas Antoine Link: https://lore.kernel.org/r/20250523-b4-gs101_max77759_fg-v4-1-b49904e35a34@uclouvain.be Signed-off-by: Sebastian Reichel commit dc35ddcf97e99b18559d0855071030e664aae44d Author: Tamir Duberstein Date: Sun Jun 15 16:55:10 2025 -0400 rust: enable `clippy::ref_as_ptr` lint In Rust 1.78.0, Clippy introduced the `ref_as_ptr` lint [1]: > Using `as` casts may result in silently changing mutability or type. While this doesn't eliminate unchecked `as` conversions, it makes such conversions easier to scrutinize. It also has the slight benefit of removing a degree of freedom on which to bikeshed. Thus apply the changes and enable the lint -- no functional change intended. Link: https://rust-lang.github.io/rust-clippy/master/index.html#ref_as_ptr [1] Suggested-by: Benno Lossin Link: https://lore.kernel.org/all/D8PGG7NTWB6U.3SS3A5LN4XWMN@proton.me/ Reviewed-by: Benno Lossin Reviewed-by: Boqun Feng Signed-off-by: Tamir Duberstein Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-6-f43b024581e8@gmail.com Signed-off-by: Miguel Ojeda commit b7c8d7a8d251ab63fba3cc964f1928a216c28081 Author: Tamir Duberstein Date: Sun Jun 15 16:55:09 2025 -0400 rust: enable `clippy::cast_lossless` lint Before Rust 1.29.0, Clippy introduced the `cast_lossless` lint [1]: > Rust’s `as` keyword will perform many kinds of conversions, including > silently lossy conversions. Conversion functions such as `i32::from` > will only perform lossless conversions. Using the conversion functions > prevents conversions from becoming silently lossy if the input types > ever change, and makes it clear for people reading the code that the > conversion is lossless. While this doesn't eliminate unchecked `as` conversions, it makes such conversions easier to scrutinize. It also has the slight benefit of removing a degree of freedom on which to bikeshed. Thus apply the changes and enable the lint -- no functional change intended. Link: https://rust-lang.github.io/rust-clippy/master/index.html#cast_lossless [1] Suggested-by: Benno Lossin Link: https://lore.kernel.org/all/D8ORTXSUTKGL.1KOJAGBM8F8TN@proton.me/ Reviewed-by: Benno Lossin Reviewed-by: Boqun Feng Signed-off-by: Tamir Duberstein Acked-by: FUJITA Tomonori Acked-by: Jocelyn Falempe Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-5-f43b024581e8@gmail.com Signed-off-by: Miguel Ojeda commit 5e30550558b1eace5fa4af4e2257216fa8a7c90f Author: Tamir Duberstein Date: Sun Jun 15 16:55:08 2025 -0400 rust: enable `clippy::as_underscore` lint In Rust 1.63.0, Clippy introduced the `as_underscore` lint [1]: > The conversion might include lossy conversion or a dangerous cast that > might go undetected due to the type being inferred. > > The lint is allowed by default as using `_` is less wordy than always > specifying the type. Always specifying the type is especially helpful in function call contexts where the inferred type may change at a distance. Specifying the type also allows Clippy to spot more cases of `useless_conversion`. The primary downside is the need to specify the type in trivial getters. There are 4 such functions: 3 have become slightly less ergonomic, 1 was revealed to be a `useless_conversion`. While this doesn't eliminate unchecked `as` conversions, it makes such conversions easier to scrutinize. It also has the slight benefit of removing a degree of freedom on which to bikeshed. Thus apply the changes and enable the lint -- no functional change intended. Link: https://rust-lang.github.io/rust-clippy/master/index.html#as_underscore [1] Reviewed-by: Benno Lossin Reviewed-by: Boqun Feng Signed-off-by: Tamir Duberstein Acked-by: Greg Kroah-Hartman Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-4-f43b024581e8@gmail.com [ Changed `isize` to `c_long`. - Miguel ] Signed-off-by: Miguel Ojeda commit 23773bd8da719b83013e66795e990036c4bfe014 Author: Tamir Duberstein Date: Sun Jun 15 16:55:07 2025 -0400 rust: enable `clippy::as_ptr_cast_mut` lint In Rust 1.66.0, Clippy introduced the `as_ptr_cast_mut` lint [1]: > Since `as_ptr` takes a `&self`, the pointer won’t have write > permissions unless interior mutability is used, making it unlikely > that having it as a mutable pointer is correct. There is only one affected callsite, and the change amounts to replacing `as _` with `.cast_mut().cast()`. This doesn't change the semantics, but is more descriptive of what's going on. Apply this change and enable the lint -- no functional change intended. Link: https://rust-lang.github.io/rust-clippy/master/index.html#as_ptr_cast_mut [1] Reviewed-by: Benno Lossin Reviewed-by: Boqun Feng Signed-off-by: Tamir Duberstein Acked-by: Greg Kroah-Hartman Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-3-f43b024581e8@gmail.com Signed-off-by: Miguel Ojeda commit d8c9e735f1f3e729268222a550de7a7f594c4210 Author: Tamir Duberstein Date: Sun Jun 15 16:55:06 2025 -0400 rust: enable `clippy::ptr_cast_constness` lint In Rust 1.72.0, Clippy introduced the `ptr_cast_constness` lint [1]: > Though `as` casts between raw pointers are not terrible, > `pointer::cast_mut` and `pointer::cast_const` are safer because they > cannot accidentally cast the pointer to another type. There are only 3 affected sites: - `*mut T as *const U as *mut U` becomes `(*mut T).cast()`. - `&self as *const Self as *mut Self` becomes `core::ptr::from_ref(self).cast_mut()`. - `*const T as *mut _` becommes `(*const T).cast_mut()`. Apply these changes and enable the lint -- no functional change intended. Link: https://rust-lang.github.io/rust-clippy/master/index.html#ptr_cast_constness [1] Reviewed-by: Benno Lossin Reviewed-by: Boqun Feng Signed-off-by: Tamir Duberstein Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-2-f43b024581e8@gmail.com Signed-off-by: Miguel Ojeda commit fcad9bbf9e1a7de6c53908954ba1b1a1ab11ef1e Author: Tamir Duberstein Date: Sun Jun 15 16:55:05 2025 -0400 rust: enable `clippy::ptr_as_ptr` lint In Rust 1.51.0, Clippy introduced the `ptr_as_ptr` lint [1]: > Though `as` casts between raw pointers are not terrible, > `pointer::cast` is safer because it cannot accidentally change the > pointer's mutability, nor cast the pointer to other types like `usize`. There are a few classes of changes required: - Modules generated by bindgen are marked `#[allow(clippy::ptr_as_ptr)]`. - Inferred casts (` as _`) are replaced with `.cast()`. - Ascribed casts (` as *... T`) are replaced with `.cast::()`. - Multistep casts from references (` as *const _ as *const T`) are replaced with `core::ptr::from_ref(&x).cast()` with or without `::` according to the previous rules. The `core::ptr::from_ref` call is required because `(x as *const _).cast::()` results in inference failure. - Native literal C strings are replaced with `c_str!().as_char_ptr()`. - `*mut *mut T as _` is replaced with `let *mut *const T = (*mut *mut T)`.cast();` since pointer to pointer can be confusing. Apply these changes and enable the lint -- no functional change intended. Link: https://rust-lang.github.io/rust-clippy/master/index.html#ptr_as_ptr [1] Reviewed-by: Benno Lossin Reviewed-by: Boqun Feng Signed-off-by: Tamir Duberstein Acked-by: Viresh Kumar Acked-by: Greg Kroah-Hartman Acked-by: Tejun Heo Acked-by: Danilo Krummrich Link: https://lore.kernel.org/r/20250615-ptr-as-ptr-v12-1-f43b024581e8@gmail.com [ Added `.cast()` for `opp`. - Miguel ] Signed-off-by: Miguel Ojeda commit 4deeea4b07414e7dd766005d8e28b1ef878cd417 Author: Casey Connolly Date: Thu Jun 19 16:55:18 2025 +0200 MAINTAINERS: add myself as smbx charger driver maintainer Missed when this originally went upstream, add myself to the MAINTAINERS file for this driver. Signed-off-by: Casey Connolly Link: https://lore.kernel.org/r/20250619-smb2-smb5-support-v1-10-ac5dec51b6e1@linaro.org Signed-off-by: Sebastian Reichel commit 5ec53bcc7fce6801977a0c125fb726d7b0e9102c Author: Casey Connolly Date: Thu Jun 19 16:55:12 2025 +0200 power: supply: pmi8998_charger: rename to qcom_smbx Prepare to add smb5 support by making variables and the file name more generic. Also take the opportunity to remove the "_charger" suffix since smb2 always refers to a charger. Signed-off-by: Casey Connolly Link: https://lore.kernel.org/r/20250619-smb2-smb5-support-v1-4-ac5dec51b6e1@linaro.org Signed-off-by: Sebastian Reichel commit 6c5393771c50fac30f08dfb6d2f65f4f2cfeb8c7 Author: Casey Connolly Date: Thu Jun 19 16:55:11 2025 +0200 power: supply: qcom_pmi8998_charger: fix wakeirq Unloading and reloading the driver (e.g. when built as a module) currently leads to errors trying to enable wake IRQ since it's already enabled. Use devm to manage this for us so it correctly gets disabled when removing the driver. Additionally, call device_init_wakeup() so that charger attach/remove will trigger a wakeup by default. Fixes: 8648aeb5d7b7 ("power: supply: add Qualcomm PMI8998 SMB2 Charger driver") Signed-off-by: Casey Connolly Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250619-smb2-smb5-support-v1-3-ac5dec51b6e1@linaro.org Signed-off-by: Sebastian Reichel commit 5e95c0a3a55aea490420bd6994805edb050cc86b Author: Jakub Kicinski Date: Fri Jun 20 10:40:07 2025 -0700 netdevsim: fix UaF when counting Tx stats skb may be freed as soon as we put it on the rx queue. Use the len variable like the code did prior to the conversion. Fixes: f9e2511d80c2 ("netdevsim: migrate to dstats stats collection") Signed-off-by: Jakub Kicinski Acked-by: David S. Miller Reviewed-by: Breno Leitao Signed-off-by: David S. Miller commit 2937f5d2e24eefef8cb126244caec7fe3307f724 Author: Charles Han Date: Mon May 19 14:16:01 2025 +0800 power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set When the kernel is not configured CONFIG_OF, the max14577_charger_dt_init function returns NULL. Fix the max14577_charger_probe functionby returning -ENODATA instead of potentially passing a NULL pointer to PTR_ERR. This fixes the below smatch warning: max14577_charger_probe() warn: passing zero to 'PTR_ERR' Fixes: e30110e9c96f ("charger: max14577: Configure battery-dependent settings from DTS and sysfs") Signed-off-by: Charles Han Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250519061601.8755-1-hanchunchao@inspur.com Signed-off-by: Sebastian Reichel commit a9aece5d7e8fa8bc74f1827d2cf1b189ffe7e8c8 Author: Yuanjun Gong Date: Tue May 13 20:37:32 2025 +0800 power: return the correct error code In POWER_SUPPLY_PROP_MODEL_NAME branch of max1720x_battery_get_property(), program would return -ENODEV out of FIELD_GET error, but it's better also considering the error code returned by regmap_read() in case it fails. Signed-off-by: Yuanjun Gong Link: https://lore.kernel.org/r/20250513123732.3041577-1-ruc_gongyuanjun@163.com Signed-off-by: Sebastian Reichel commit 22e4d29f081df8a10f1c062d3d952bb876eb9bdc Author: Geert Uytterhoeven Date: Tue May 6 15:01:27 2025 +0200 power: reset: POWER_RESET_TORADEX_EC should depend on ARCH_MXC The Toradex Embedded Controller is currently only present on Toradex SMARC iMX8MP and iMX95 SoMs. Hence add a dependency on ARCH_MXC, to prevent asking the user about this driver when configuring a kernel without NXP i.MX SoC family support. Fixes: 18672fe12367ed44 ("power: reset: add Toradex Embedded Controller") Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/1ef0beb1e09bf914650f9f9885a33af06772540d.1746536287.git.geert+renesas@glider.be Signed-off-by: Sebastian Reichel commit d9fa3aae08f99493e67fb79413c0e95d30fca5e9 Author: Charles Han Date: Mon May 19 10:47:41 2025 +0800 power: supply: cpcap-charger: Fix null check for power_supply_get_by_name In the cpcap_usb_detect() function, the power_supply_get_by_name() function may return `NULL` instead of an error pointer. To prevent potential null pointer dereferences, Added a null check. Fixes: eab4e6d953c1 ("power: supply: cpcap-charger: get the battery inserted infomation from cpcap-battery") Signed-off-by: Charles Han Link: https://lore.kernel.org/r/20250519024741.5846-1-hanchunchao@inspur.com Signed-off-by: Sebastian Reichel commit 7cf88213b95e9491572c4af39c7ba2829f9b2637 Author: Krzysztof Kozlowski Date: Wed May 28 21:44:41 2025 +0200 power: supply: bq25980_charger: Constify reg_default array Static 'struct reg_default' array is not modified so can be changed to const for more safety. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250528194439.567263-4-krzysztof.kozlowski@linaro.org Signed-off-by: Sebastian Reichel commit 188014b4256fd7b625c79a45d61209da5ca4c92c Author: Krzysztof Kozlowski Date: Wed May 28 21:44:40 2025 +0200 power: supply: bq256xx_charger: Constify reg_default array Static 'struct reg_default' array is not modified so can be changed to const for more safety. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250528194439.567263-3-krzysztof.kozlowski@linaro.org Signed-off-by: Sebastian Reichel commit 14966a8df77e2dffdf765b56abe194aa6b0da325 Author: Yuyang Huang Date: Thu Jun 19 12:51:16 2025 +0900 selftest: add selftest for anycast notifications This commit adds a new kernel selftest to verify RTNLGRP_IPV6_ACADDR notifications. The test works by adding/removing a dummy interface, enabling packet forwarding, and then confirming that user space can correctly receive anycast notifications. The test relies on the iproute2 version to be 6.13+. Tested by the following command: $ vng -v --user root --cpus 16 -- \ make -C tools/testing/selftests TARGETS=net TEST_PROGS=rtnetlink_notification.sh \ TEST_GEN_PROGS="" run_tests Cc: Maciej Żenczykowski Cc: Lorenzo Colitti Signed-off-by: Yuyang Huang Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit 51860eebc98fc7fbd110c781ca33898f7a305627 Author: Fabio Estevam Date: Tue Jun 17 11:05:01 2025 -0300 ARM: dts: at91-sama5d27_wlsom1: Improve the Wifi compatible The at91-sama5d27_wlsom1 SoM has a WIL3000 Wifi SDIO device populated. Improve the description of the Wifi compatible string by passing the more specific "microchip,wilc3000" string. Signed-off-by: Fabio Estevam Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20250617140502.1042812-1-festevam@gmail.com Signed-off-by: Claudiu Beznea commit 7c0650f1f95fa0b72d47214458f68d26732128aa Author: Ezra Buehler Date: Thu Jun 12 09:47:37 2025 +0200 ARM: dts: microchip: gardena-smart-gateway: Fix power LED When starting up, the GARDENA smart Gateway's power LED should be flashing green. It is unclear why this has not been done earlier. The LED frequency cannot be configured in the devicetree. Luckily, the default is 1 Hz, which is what we want. Signed-off-by: Ezra Buehler Link: https://lore.kernel.org/r/20250612074737.311346-1-ezra@easyb.ch Signed-off-by: Claudiu Beznea commit 2e24723492b28ffdccb0e3e68725673e299e3823 Author: Ryan Wanner Date: Tue Jun 17 09:08:42 2025 -0700 ARM: dts: microchip: sam9x7: Add clock name property Add clock-output-names to the xtal nodes, so the driver can correctly register the main and slow xtal. This fixes the issue of the SoC clock driver not being able to find the main xtal and slow xtal correctly causing a bad clock tree. Fixes: 41af45af8bc3 ("ARM: dts: at91: sam9x7: add device tree for SoC") Signed-off-by: Ryan Wanner Link: https://lore.kernel.org/r/036518968ac657b93e315bb550b822b59ae6f17c.1750175453.git.Ryan.Wanner@microchip.com Signed-off-by: Claudiu Beznea commit 0029468132ba2e00a3010865038783d9b2e6cc07 Author: Ryan Wanner Date: Tue Jun 17 09:08:41 2025 -0700 ARM: dts: microchip: sama7d65: Add clock name property Add clock-output-names to the xtal nodes, so the driver can correctly register the main and slow xtal. This fixes the issue of the SoC clock driver not being able to find the main xtal and slow xtal correctly causing a bad clock tree. Fixes: 261dcfad1b59 ("ARM: dts: microchip: add sama7d65 SoC DT") Signed-off-by: Ryan Wanner Link: https://lore.kernel.org/r/3878ae6d0016d46f0c91bd379146d575d5d336aa.1750175453.git.Ryan.Wanner@microchip.com Signed-off-by: Claudiu Beznea commit 47b77557d3beb748c505ffd4cc378725f7c495c5 Author: Ryan Wanner Date: Tue Jun 17 09:08:40 2025 -0700 ARM: dts: microchip: sama7g5: Adjust clock xtal phandle Adjust clock xtal phandles to match the new xtal phandle formatting. Signed-off-by: Ryan Wanner Link: https://lore.kernel.org/r/8a9ece664958d07b1be73b4b6676a2a2ee397a94.1750175453.git.Ryan.Wanner@microchip.com Signed-off-by: Claudiu Beznea commit 11b83df6bb920123409dfbb8d2e824fddb279186 Author: Dharma Balasubiramani Date: Wed Jun 11 14:47:59 2025 +0530 ARM: dts: microchip: sam9x7: Add HLCD controller Add support for HLCD controller. Signed-off-by: Dharma Balasubiramani Link: https://lore.kernel.org/r/20250611-sam9x7-dts-v1-1-7f52fcb488ad@microchip.com [claudiu.beznea: keep reg the 1st property on port@0 to comply with dts coding style] Signed-off-by: Claudiu Beznea commit 198b54b0a6870d83576115deaecb5523ab6e56b9 Author: Ryan Wanner Date: Wed Jun 11 12:47:34 2025 -0700 ARM: dts: microchip: sama7d65: Enable CAN bus Enable CAN bus for SAMA7D65 curiosity board. Signed-off-by: Ryan Wanner Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/ab719861de53432bdf19593fa4eee40adf57aed9.1749666053.git.Ryan.Wanner@microchip.com Signed-off-by: Claudiu Beznea commit 5a4aad596e0d930c8fa189764ad4b06835843a13 Author: Ryan Wanner Date: Wed Jun 11 12:47:33 2025 -0700 ARM: dts: microchip: sama7d65: Clean up extra space Remove the extra space that causes formatting issues. Signed-off-by: Ryan Wanner Link: https://lore.kernel.org/r/ac1decc35e2b4f706cf6ab9378f2c88e5295dde4.1749666053.git.Ryan.Wanner@microchip.com Signed-off-by: Claudiu Beznea commit ec9a309d0c7e26efd7705600e15ff0909434e67a Author: Ryan Wanner Date: Wed Jun 11 12:47:32 2025 -0700 ARM: dts: microchip: sama7d65: Add CAN bus support Add support for CAN bus to the SAMA7D65 SoC. Signed-off-by: Ryan Wanner Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/f80a4206c05ed5d80a9527476963a18070ca42b6.1749666053.git.Ryan.Wanner@microchip.com Signed-off-by: Claudiu Beznea commit a9ea0d5f70ab63370159b3b07d2ebbf9de12532b Author: Ryan Wanner Date: Wed Jun 11 12:47:31 2025 -0700 ARM: dts: microchip: sama7d65: Add PWM support Add support for PWMs to the SAMA7D65 SoC. Signed-off-by: Ryan Wanner Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/195c69a19be1ff14736db402e0f1ee64438b4b20.1749666053.git.Ryan.Wanner@microchip.com Signed-off-by: Claudiu Beznea commit 71b39aeaaff152a4899f7fbee5a7f5fa8b335b85 Author: Ryan Wanner Date: Wed Jun 11 12:47:30 2025 -0700 ARM: dts: microchip: sama7d65: Add crypto support Add and enable SHA, AES, TDES, and TRNG for SAMA7D65 SoC. Signed-off-by: Ryan Wanner Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/fc791949c97f368f32a710e64d8db4018e45e70f.1749666053.git.Ryan.Wanner@microchip.com Signed-off-by: Claudiu Beznea commit 9c2026fe46dfed1d5c48390c841ff26dc9c6b0b6 Author: Wolfram Sang Date: Mon May 19 13:21:05 2025 +0200 ARM: dts: microchip: use recent scl/sda gpio bindings We have dedictaded bindings for scl/sda nowadays. Switch away from the deprecated plain 'gpios' property. Signed-off-by: Wolfram Sang Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20250519112107.2980-4-wsa+renesas@sang-engineering.com Signed-off-by: Claudiu Beznea commit 87aafc8580acf87fcaf1a7e30ed858d8c8d37d81 Author: Alok Tiwari Date: Sat Jun 21 11:52:24 2025 -0700 ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 code mistakenly used a hardcoded index (codec[1]) instead of iterating, over the codec array using the loop variable i. Use codec[i] instead of codec[1] to match the loop iteration. Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250621185233.4081094-1-alok.a.tiwari@oracle.com Signed-off-by: Takashi Iwai commit cc6dc5fbecfdf2de3ec02c15754d3fd4879e32ff Author: Willy Tarreau Date: Wed Jun 18 20:30:30 2025 +0200 tools/nolibc: merge i386 and x86_64 into a single x86 arch This remained the only exception to the kernel's architectures organization and it's always a bit cumbersome to deal with. Let's merge i386 and x86_64 into x86. This will result in a single arch-x86.h file by default, and we'll no longer need to merge the two manually during installation. Requesting either i386 or x86_64 will also result in installing x86. Acked-by: Thomas Weißschuh Signed-off-by: Willy Tarreau commit a477629baa2a0e9991f640af418e8c973a1c08e3 Author: Willy Tarreau Date: Thu Jun 19 11:30:51 2025 +0200 tools/nolibc: fix spelling of FD_SETBITMASK in FD_* macros While nolibc-test does test syscalls, it doesn't test as much the rest of the macros, and a wrong spelling of FD_SETBITMASK in commit feaf75658783a broke programs using either FD_SET() or FD_CLR() without being noticed. Let's fix these macros. Fixes: feaf75658783a ("nolibc: fix fd_set type") Cc: stable@vger.kernel.org # v6.2+ Acked-by: Thomas Weißschuh Signed-off-by: Willy Tarreau commit 6af8ffab2db3199f22298641880dd111f3a630e2 Author: Mihai Sain Date: Tue Jun 10 15:45:47 2025 +0300 power: reset: at91-sama5d2_shdwc: Refactor wake-up source logging to use dev_info Use dev_info() instead of pr_info() for more consistent logging in the driver. [root@sam9x75eb ~]$ dmesg | grep power [ 1.678542] at91-shdwc fffffe10.poweroff: Wake-Up source: WKUP pin Signed-off-by: Mihai Sain Link: https://lore.kernel.org/r/20250610124545.175492-3-mihai.sain@microchip.com Signed-off-by: Sebastian Reichel commit e4ab1bfc3fe92ef5f8cebcc17963a08955963995 Author: Taeyoung Kwon Date: Wed May 21 13:09:52 2025 +0000 power: reset: qcom-pon: Rename variables to use generic naming The qcom-pon driver was originally implemented for the PM8916 PMIC, and as a result, several internal variable names still refer to 'pm8916'. However, the driver has since been extended to support other PMICs as well. This patch renames those variables to use more generic and consistent names, improving clarity and reducing confusion for non-PM8916 devices. Signed-off-by: Taeyoung Kwon Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250521131116.2664-1-Taeyoung.Kwon@telit.com Signed-off-by: Sebastian Reichel commit 202ac22b8e2e015e6c196fd8113f3d2a62dd1afc Author: Abel Vesa Date: Fri May 23 13:14:22 2025 +0300 power: supply: qcom_battmgr: Add lithium-polymer entry On some Dell XPS 13 (9345) variants, the battery used is lithium-polymer based. Currently, this is reported as unknown technology due to the entry missing. [ 4083.135325] Unknown battery technology 'LIP' Add another check for lithium-polymer in the technology parsing callback and return that instead of unknown. Signed-off-by: Abel Vesa Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250523-psy-qcom-battmgr-add-lipo-entry-v1-1-938c20a43a25@linaro.org Signed-off-by: Sebastian Reichel commit 3f87baacea4d185071655f9b0baf07abb6237fcd Author: Kornel Dulęba Date: Wed May 28 11:23:29 2025 +0000 power: supply: qcom_battmgr: Report battery capacity Battery charge can be reported in several different ways. One of them is is charge percentage referred to as POWER_SUPPLY_PROP_CAPACITY in the power supply API. Currently the driver reports the capacity in this way on SM8350, but not on the newer variants referred to as SC8280XP in the driver. Although this is not a bug in itself, not reporting the percentage can confuse some userspace consumers. Mimic what is done in the ACPI driver (drivers/acpi/battery.c) and calculate the percentage capacity by dividing the current charge value by the full charge. Signed-off-by: Kornel Dulęba Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250528112328.1640743-2-korneld@google.com Signed-off-by: Sebastian Reichel commit 6aa1c3a72b99abeb7ddc649047073d701ede2c91 Author: Hans de Goede Date: Sun Jun 8 22:40:10 2025 +0200 power: supply: bq24190: Free battery_info Call power_supply_put_battery_info() when bq24190_get_config() is done with it. The "struct power_supply_battery_info *info" pointer runs out of scope at the end of bq24190_get_config() so there is no need to keep it around after this. Note technically this is not a memleak fix, since all battery_info data is devm_alloc()-ed so it would still be free-ed when the driver is unbound. This just frees it as soon as the driver is done with it. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250608204010.37482-11-hansg@kernel.org Signed-off-by: Sebastian Reichel commit 2986e5b213cd84ac290ae68e73b7629ec8f184a6 Author: Hans de Goede Date: Sun Jun 8 22:40:09 2025 +0200 power: supply: ug3105_battery: Switch to power_supply_batinfo_ocv2cap() Replace the hardcoded ocv -> capacity table and the ug3105_get_capacity() helper with using the generic power_supply_batinfo_ocv2cap() function. Note this relies on the battery fwnode providing at least 1 "ocv-capacity-table", if that is missing probe() will now fail with EINVAL. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250608204010.37482-10-hansg@kernel.org Signed-off-by: Sebastian Reichel commit 8842bd00a74bf758fb1abf572ec1c7d70c09dedb Author: Hans de Goede Date: Sun Jun 8 22:40:08 2025 +0200 power: supply: ug3105_battery: Use psy->battery_info For POWER_SUPPLY_TYPE_BATTERY power-supplies the core already calls power_supply_get_battery_info() and stores the result in psy->battery_info. Use psy->battery_info instead of having the driver call power_supply_get_battery_info() itself. Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20250608204010.37482-9-hansg@kernel.org Signed-off-by: Sebastian Reichel commit 370643f45aad93476b6489238ccb45a77b94da3f Author: Sebastian Reichel Date: Sun Jun 8 22:40:07 2025 +0200 power: supply: core: rename power_supply_get_by_phandle to power_supply_get_by_reference (devm_)power_supply_get_by_phandle now internally uses fwnode and are no longer DT specific. Thus drop the ifdef check for CONFIG_OF and rename to (devm_)power_supply_get_by_reference to avoid the DT terminology. Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250430-psy-core-convert-to-fwnode-v2-5-f9643b958677@collabora.com Signed-off-by: Sebastian Reichel commit f368f87b22dab8e97c5f447b00a0cae79fefbdcb Author: Sebastian Reichel Date: Sun Jun 8 22:40:06 2025 +0200 power: supply: core: convert to fwnnode Replace any DT specific code with fwnode in the power-supply core. Reviewed-by: AngeloGioacchino Del Regno Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250430-psy-core-convert-to-fwnode-v2-4-f9643b958677@collabora.com Signed-off-by: Sebastian Reichel commit 570ba047a6548df24f5c9aaaf9a81173577ca789 Author: Sebastian Reichel Date: Sun Jun 8 22:40:03 2025 +0200 power: supply: core: battery-info: fully switch to fwnode Also use fwnode based parsing for "ocv-capacity-celsius" and "resistance-temp-table", so that any DT specific bits are removed from the power-supply core. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250430-psy-core-convert-to-fwnode-v2-3-f9643b958677@collabora.com Co-developed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 520c790c83e9e4c915a8e3fc9f2152ece39b6511 Author: Sebastian Reichel Date: Sun Jun 8 22:40:02 2025 +0200 power: supply: core: remove of_node from power_supply_config All drivers have been migrated from .of_node to .fwnode, so let's kill the former. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Sebastian Reichel Link: https://lore.kernel.org/r/20250430-psy-core-convert-to-fwnode-v2-2-f9643b958677@collabora.com Reviewed-by: Hans de Goede Signed-off-by: Hans de Goede Signed-off-by: Sebastian Reichel commit 0bbdb13a171449d947e7f93b6453ebb7e27767fe Merge: da32b6d7bcdd7a ceed13630489fb Author: Sebastian Reichel Date: Sun Jun 22 01:46:32 2025 +0200 Merge tag 'ib-regulator-psy-for-v6.17-signed' into psy-next Merge immutable branch between power-supply and regulator subsystem, which updates the remaining user of power_supply_config.of_node to use .fwnode instead, so that the any code related to .of_node can be removed. Signed-off-by: Sebastian Reichel commit da32b6d7bcdd7a7cfd5f77418a1c026bc3374113 Author: Krzysztof Kozlowski Date: Wed Jun 4 10:18:26 2025 +0200 dt-bindings: power: supply: Drop redundant monitored-battery ref Bindings reference the common power supply schema, which already defines the type (ref) for "monitored-battery" property. Drop the redundant ref from individual device schemas along with obvious description also duplicating what is in power-supply.yaml. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250604-dt-bindings-psy-monitored-battery-v1-6-7f755ff75218@linaro.org Signed-off-by: Sebastian Reichel commit 128c0704821e7101257951c1d32459e2fc3e591b Author: Krzysztof Kozlowski Date: Wed Jun 4 10:18:25 2025 +0200 dt-bindings: power: supply: summit,smb347: Add missing power-supply ref Reference the common power supply schema to bring the definition of monitored-battery property. Drop also the obvious description because it is duplicating what is in power-supply.yaml. Signed-off-by: Krzysztof Kozlowski Reviewed-by: David Heidelberg Link: https://lore.kernel.org/r/20250604-dt-bindings-psy-monitored-battery-v1-5-7f755ff75218@linaro.org Signed-off-by: Sebastian Reichel commit 221e08ebf6271eb80c6cb77df9ad3586229920e9 Author: Krzysztof Kozlowski Date: Wed Jun 4 10:18:24 2025 +0200 dt-bindings: power: supply: richtek,rt5033: Add missing power-supply ref Reference the common power supply schema to bring the definition of monitored-battery property. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250604-dt-bindings-psy-monitored-battery-v1-4-7f755ff75218@linaro.org Signed-off-by: Sebastian Reichel commit 860cb8df5a622f2044a65f98c4158a7ff9c5b07c Author: Krzysztof Kozlowski Date: Wed Jun 4 10:18:23 2025 +0200 dt-bindings: power: supply: qcom,pmi8998: Add missing power-supply ref Reference the common power supply schema to bring the definition of monitored-battery property. Drop also the obvious description because it is duplicating what is in power-supply.yaml. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250604-dt-bindings-psy-monitored-battery-v1-3-7f755ff75218@linaro.org Signed-off-by: Sebastian Reichel commit 0835608458bc4bd1afb15d108c6d8a3b8b3d5767 Author: Krzysztof Kozlowski Date: Wed Jun 4 10:18:22 2025 +0200 dt-bindings: power: supply: bq256xx: Add missing power-supply ref Reference the common power supply schema to bring the definition of monitored-battery property. Drop also the obvious description because it is duplicating what is in power-supply.yaml. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250604-dt-bindings-psy-monitored-battery-v1-2-7f755ff75218@linaro.org Signed-off-by: Sebastian Reichel commit 0dc41c6b18b8fdd959c56f2d5b61a2d0960e3d91 Author: Krzysztof Kozlowski Date: Wed Jun 4 10:18:21 2025 +0200 dt-bindings: power: supply: bq2515x: Add missing power-supply ref Reference the common power supply schema to bring the definition of monitored-battery property. Drop also the obvious description because it is duplicating what is in power-supply.yaml. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250604-dt-bindings-psy-monitored-battery-v1-1-7f755ff75218@linaro.org Signed-off-by: Sebastian Reichel commit ceed13630489fb9afbaa1326d2adc793d91fa48b Author: Sebastian Reichel Date: Sun Jun 8 22:40:01 2025 +0200 regulator: act8865-regulator: switch psy_cfg from of_node to fwnode In order to remove .of_node from the power_supply_config struct, use .fwnode instead. Link: https://lore.kernel.org/r/20250430-psy-core-convert-to-fwnode-v2-1-f9643b958677@collabora.com Reviewed-by: Hans de Goede Signed-off-by: Sebastian Reichel commit af9019b5f1500222e878d5b7b5c924795b5f41fb Author: Rohit Visavalia Date: Mon Feb 10 03:36:14 2025 -0800 clk: xilinx: vcu: Update vcu init/reset sequence Updated vcu init/reset sequence as per design changes. If VCU reset GPIO is available then do assert and de-assert it before enabling/disabling gasket isolation. This GPIO is added because gasket isolation will be removed during startup that requires access to SLCR register space. Post startup, the ownership of the register interface lies with logiCORE IP. Signed-off-by: Rohit Visavalia Link: https://lore.kernel.org/r/20250210113614.4149050-3-rohit.visavalia@amd.com Signed-off-by: Stephen Boyd commit 3b0abc443ac22f7d4f61ddbbbbc5dbb06c87139d Author: Rohit Visavalia Date: Mon Feb 10 03:36:13 2025 -0800 clk: xilinx: vcu: unregister pll_post only if registered correctly If registration of pll_post is failed, it will be set to NULL or ERR, unregistering same will fail with following call trace: Unable to handle kernel NULL pointer dereference at virtual address 008 pc : clk_hw_unregister+0xc/0x20 lr : clk_hw_unregister_fixed_factor+0x18/0x30 sp : ffff800011923850 ... Call trace: clk_hw_unregister+0xc/0x20 clk_hw_unregister_fixed_factor+0x18/0x30 xvcu_unregister_clock_provider+0xcc/0xf4 [xlnx_vcu] xvcu_probe+0x2bc/0x53c [xlnx_vcu] Fixes: 4472e1849db7 ("soc: xilinx: vcu: make pll post divider explicit") Signed-off-by: Rohit Visavalia Link: https://lore.kernel.org/r/20250210113614.4149050-2-rohit.visavalia@amd.com Signed-off-by: Stephen Boyd commit f5976286daa78b4981e0d37aaf30f358ec1d8791 Author: Rob Herring (Arm) Date: Wed Mar 12 11:33:30 2025 -0500 clk: ti: Simplify ti_find_clock_provider() Remove using for_each_of_allnodes_from() which is not safe to use without holding the DT spinlock. In reality that probably doesn't matter here. This is the only user in the whole tree, so it can be made private once removed here. The "from" argument is always NULL, so it can be dropped as well. There's a slight change in behavior in matching the "clock-output-names" value as the prior code would match if the node name matched the beginning of the value and the comparision was case insensitive. Now it must be an exact match. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250312163330.865573-2-robh@kernel.org Signed-off-by: Stephen Boyd commit 5194439d70bac001200709bf15e3bd2b96bf9efb Author: Bagas Sanjaya Date: Wed Jun 11 13:52:55 2025 +0700 Documentation: treewide: Replace remaining spinics links with lore Long before introduction of lore.kernel.org, people would link to LKML threads on third-party archives (here spinics.net), which in some cases can be unreliable (as these were outside of kernel.org control). Replace links to them with lore counterparts (if any). Signed-off-by: Bagas Sanjaya Reviewed-by: Simon Horman Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250611065254.36608-2-bagasdotme@gmail.com commit 0400a541baa038c5cfcc70b2c71efdcd86ed502b Author: Salvatore Bonaccorso Date: Thu Jun 12 08:02:04 2025 +0200 Documentation/sysctl: coredump: add %F for pidfd number In commit b5325b2a270f ("coredump: hand a pidfd to the usermode coredump helper") a new core_pattern specifier, %F, was added to provide a pidfs to the usermode helper process referring to the crashed process. Update the documentation to include the new core_pattern specifier. Signed-off-by: Salvatore Bonaccorso Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250612060204.1159734-1-carnil@debian.org commit e5880f95a97928308845dc97fdd239605e06e501 Author: Jakub Kicinski Date: Sat Jun 14 13:42:57 2025 -0700 docs: process: discourage pointless boilerplate kdoc It appears that folks "less versed in kernel coding" think that its good style to document every function, even if they have no useful information to pass to the future readers of the code. This used to be just a waste of space, but with increased kdoc format linting it's also a burden when refactoring the code. Signed-off-by: Jakub Kicinski Reviewed-by: Joe Damato Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250614204258.61449-1-kuba@kernel.org commit 0242b8b0cc89599b3e4162add672179ce2dd4131 Author: Yuanye Ma Date: Thu Jun 19 06:55:46 2025 +0800 docs: f2fs: fix typos in f2fs.rst This patch fixes two minor typos in Documentation/filesystems/f2fs.rst: - "ramdom" → "random" - "reenable" → "re-enable" The changes improve spelling and consistency in the documentation. These issues were identified using the 'codespell' tool with the following command: $ find Documentation/ -path Documentation/translations -prune -o \ -name '*.rst' -print | xargs codespell Signed-off-by: Yuanye Ma Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250618225546.104949-1-yuanye.ma20@gmail.com commit 4613bf5fd0453a184a8cbdd776fedc934613d6aa Author: Shouye Liu Date: Fri Jun 20 10:16:58 2025 +0800 Documentation: amd-pstate:fix minimum performance state label error In the AMD P-States Performance Scale diagram, the labels for "Max Perf" and "Lowest Perf" were incorrectly used to define the range for "Desired Perf".The "Desired performance target" should be bounded by the "Maximum requested performance" and the "Minimum requested performance", which corresponds to "Max Perf" and "Min Perf", respectively. Signed-off-by: Shouye Liu Reviewed-by: Mario Limonciello Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250620021658.92161-1-shouyeliu@gmail.com commit 4a1dd6643d8ef2c1655f308532fb7d605afa8be4 Author: Jonathan Corbet Date: Thu Jun 19 15:17:39 2025 -0600 docs: sphinx: avoid using the deprecated node.set_class() Docutils emits a deprecation warning when the set_class() element method is used; that warning disappears into the ether, but it also causes a crash with docutils 0.19. Avoid the deprecated function and just append directly to the "classes" attribute like the documentation says instead. Reported-by: Akira Yokosawa Tested-by: Akira Yokosawa Closes: https://lore.kernel.org/de7bae91-3200-481f-9db2-c0dc382c91dd@gmail.com/ Fixes: d6d1df92c25f ("docs: automarkup: Mark up undocumented entities too") Signed-off-by: Jonathan Corbet commit 7f9509791507bd2aa89281d999cf0c8ad659f93d Author: Hsun Lai Date: Mon Jun 9 19:30:44 2025 +0800 arm64: dts: rockchip: add DTs for Firefly ROC-RK3588S-PC The Firefly ROC-RK3588S-PC is a SBC based on the Rockchip RK3588s SoC. Link: https://wiki.t-firefly.com/en/Station-M3/index.html The device contains the following hardware that is tested/working: - 32 or 64GB eMMC - SDMMC card slot - Realtek USB WiFi 5/BT - NVME 2242 socket - 4 or 8GB of RAM - RTL8211 GbE - USB 3.0 port - USB 2.0 port - HDMI port Signed-off-by: Hsun Lai Link: https://lore.kernel.org/r/20250609113044.8846-3-i@chainsx.cn Signed-off-by: Heiko Stuebner commit 0e561752ec819d54b7f56cd7e0b0fae1217db72c Author: Hsun Lai Date: Mon Jun 9 19:30:43 2025 +0800 dt-bindings: arm: rockchip: Add Firefly ROC-RK3588S-PC This documents Firefly ROC-RK3588S-PC which is a SBC based on RK3588S SoC. Link: https://wiki.t-firefly.com/en/Station-M3/index.html Signed-off-by: Hsun Lai Reviewed-by: Quentin Schulz Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250609113044.8846-2-i@chainsx.cn Signed-off-by: Heiko Stuebner commit f4db84780427270dd20ec0e7079b0ae26dc88dd3 Author: Jonas Karlman Date: Sun May 18 22:54:13 2025 +0000 arm64: dts: rockchip: Enable GPU on Radxa E20C Enable the Mali-450 MP2 GPU on the Radxa E20C. Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20250518225418.682182-4-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 06601cc45b5ba0c3bcd371b9c499d9fe5dabd11d Author: Jonas Karlman Date: Sun May 18 22:54:12 2025 +0000 arm64: dts: rockchip: Add GPU node for RK3528 Add a GPU node and a opp-table for the Mali-450 MP2 in the RK3528 SoC. Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20250518225418.682182-3-jonas@kwiboo.se Signed-off-by: Heiko Stuebner commit 65f55a30176662ee37fe18b47430ee30b57bfc98 Author: Borislav Petkov (AMD) Date: Wed May 28 23:31:05 2025 +0200 x86/CPU/AMD: Add CPUID faulting support Add CPUID faulting support on AMD using the same user interface. Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Thomas Gleixner Link: https://lore.kernel.org/20250528213105.1149-1-bp@kernel.org commit 26bc2019542fe262b799546c5211cc4b88b3f5ea Author: Hrushikesh Salunke Date: Tue Jun 10 11:19:20 2025 +0530 arm64: dts: ti: k3-am642-evm-pcie0-ep: Add boot phase tag to "pcie0_ep" AM64X SoC has one instance of PCIe which is PCIe0. To support PCIe boot on AM64X SoC, PCIe0 needs to be in endpoint mode and it needs to be functional at all stages of PCIe boot process. Thus add the "bootph-all" boot phase tag to "pcie0_ep" device tree node. Signed-off-by: Hrushikesh Salunke Reviewed-by: Siddharth Vadapalli Link: https://lore.kernel.org/r/20250610054920.2395509-1-h-salunke@ti.com Signed-off-by: Vignesh Raghavendra commit a947e57796894f5557183dc1c106804239e30212 Author: Michael Walle Date: Wed Jun 18 11:07:24 2025 +0200 arm64: dts: ti: k3-j722s-main: Add audio-refclk0 node Add the node for the AUDIO_EXT_REFCLK0 clock output. Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20250618090724.1917731-1-mwalle@kernel.org Signed-off-by: Vignesh Raghavendra commit fdc8ad019ab9a2308b8cef54fbc366f482fb746f Author: Michael Walle Date: Wed Jun 18 08:52:39 2025 +0200 arm64: dts: ti: k3-am62p-j722s: fix pinctrl-single size Pinmux registers ends at 0x000f42ac (including). Thus, the size argument of the pinctrl-single node has to be 0x2b0. Fix it. This will fix the following error: pinctrl-single f4000.pinctrl: mux offset out of range: 0x2ac (0x2ac) Fixes: 29075cc09f43 ("arm64: dts: ti: Introduce AM62P5 family of SoCs") Signed-off-by: Michael Walle Link: https://lore.kernel.org/r/20250618065239.1904953-1-mwalle@kernel.org Signed-off-by: Vignesh Raghavendra commit 9c1185a99811a173e3c126d664982f6744f80997 Author: Miquel Raynal Date: Fri Jun 13 20:23:56 2025 +0200 arm64: dts: ti: k3-am62a7-sk: Describe the SPI NAND Describe the octal SPI NAND available on the low-power starter kit. The pinctrl configuration comes from TI fork. With the current mainline tree, we currently get the following performances: eraseblock write speed is 7507 KiB/s eraseblock read speed is 15802 KiB/s page write speed is 7551 KiB/s page read speed is 15609 KiB/s 2 page write speed is 7551 KiB/s 2 page read speed is 15609 KiB/s erase speed is 284444 KiB/s 2x multi-block erase speed is 512000 KiB/s Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/r/20250613182356.1272642-1-miquel.raynal@bootlin.com Signed-off-by: Vignesh Raghavendra commit 56bf596ff9026b616137968102884233c86055d4 Author: Jayesh Choudhary Date: Wed Jun 4 16:16:54 2025 +0530 arm64: dts: ti: k3-j721s2-main: Add McASP nodes Add McASP 0-4 instances and keep them disabled because several required properties are missing as they are board specific. Signed-off-by: Jayesh Choudhary Link: https://lore.kernel.org/r/20250604104656.38752-2-j-choudhary@ti.com Signed-off-by: Vignesh Raghavendra commit cb2d9c00770e2e6c51864704b5d98c9a0ddccaf9 Author: Emanuele Ghidoli Date: Thu May 29 12:25:54 2025 +0200 arm64: dts: ti: k3-am62p-verdin: Enable pull-ups on I2C_3_HDMI Enable internal bias pull-ups on the SoC-side I2C_3_HDMI that do not have external pull resistors populated on the SoM. This ensures proper default line levels. Fixes: 87f95ea316ac ("arm64: dts: ti: Add Toradex Verdin AM62P") Signed-off-by: Emanuele Ghidoli Reviewed-by: Francesco Dolcini Link: https://lore.kernel.org/r/20250529102601.452859-1-ghidoliemanuele@gmail.com Signed-off-by: Vignesh Raghavendra commit bdf4252f736cc1d2a8e3e633c70fe6c728f0756e Author: Emanuele Ghidoli Date: Wed May 28 13:07:37 2025 +0200 arm64: dts: ti: k3-am62-verdin: Enable pull-ups on I2C buses Enable internal bias pull-ups on the SoC-side I2C buses that do not have external pull resistors populated on the SoM. This ensures proper default line levels. Cc: stable@vger.kernel.org Fixes: 316b80246b16 ("arm64: dts: ti: add verdin am62") Signed-off-by: Emanuele Ghidoli Reviewed-by: Francesco Dolcini Link: https://lore.kernel.org/r/20250528110741.262336-1-ghidoliemanuele@gmail.com Signed-off-by: Vignesh Raghavendra commit 945e48a39c957924bc84d1a6c137da039e13855b Author: Wadim Egorov Date: Wed May 21 07:33:39 2025 +0200 arm64: dts: ti: k3-am642-phyboard-electra: Fix PRU-ICSSG Ethernet ports For the ICSSG PHYs to operate correctly, a 25 MHz reference clock must be supplied on CLKOUT0. Previously, our bootloader configured this clock, which is why the PRU Ethernet ports appeared to work, but the change never made it into the device tree. Add clock properties to make EXT_REFCLK1.CLKOUT0 output a 25MHz clock. Signed-off-by: Wadim Egorov Fixes: 87adfd1ab03a ("arm64: dts: ti: am642-phyboard-electra: Add PRU-ICSSG nodes") Link: https://lore.kernel.org/r/20250521053339.1751844-1-w.egorov@phytec.de Signed-off-by: Vignesh Raghavendra commit 2250db8628a0d8293ad2e0671138b848a185fba1 Author: Markus Stockhausen Date: Sat Jun 21 01:49:51 2025 -0400 irqchip/mips-gic: Allow forced affinity Devices of the Realtek MIPS Otto platform use the official rtl-otto-timer as clock event generator and CPU clocksource. It is registered for each CPU startup via cpuhp_setup_state() and forces the affinity of the clockevent interrupts to the appropriate CPU via irq_force_affinity(). On the "smaller" devices with a vendor specific interrupt controller (supported by irq-realtek-rtl) the registration works fine. The "larger" RTL931x series is based on a MIPS interAptiv dual core with a MIPS GIC controller. Interrupt routing setup is cancelled because gic_set_affinity() does not accept the current (not yet online) CPU as a target. Relax the checks by evaluating the force parameter that is provided for exactly this purpose like in other drivers. With this the affinity can be set as follows: - force = false: allow to set affinity to any online cpu - force = true: allow to set affinity to any cpu Co-developed-by: Sebastian Gottschall Signed-off-by: Sebastian Gottschall Signed-off-by: Markus Stockhausen Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250621054952.380374-1-markus.stockhausen@gmx.de commit 631ce8f743a5c85bd7f0a5e7dcca70566d88f43f Author: Guillaume La Roque Date: Mon May 19 10:20:56 2025 +0200 arm64: Kconfig.platforms: remove useless select for ARCH_K3 After patch done on TI_MESSAGE_MANAGER[1] and TI_SCI_PROTOCOL[2] driver select on ARCH_K3 are not needed anymore. Select MAILBOX by default is not needed anymore[3], PM_GENERIC_DOMAIN if PM was enabled by default so not needed. Remove it and give possibility to enable this driver in modules. [1] https://lore.kernel.org/all/20180828005311.8529-1-nm@ti.com/ [2] https://lore.kernel.org/all/20250220-ti-firmware-v2-1-ff26883c6ce9@baylibre.com/ [3] https://lore.kernel.org/all/20250507135213.g6li6ufp3cosxoys@stinging/ Signed-off-by: Guillaume La Roque Link: https://lore.kernel.org/r/20250519-kconfig-v2-1-56c1a0137a0f@baylibre.com Signed-off-by: Vignesh Raghavendra commit 091d019adce033118776ef93b50a268f715ae8f6 Author: Wang Liang Date: Thu Jun 19 11:08:54 2025 +0800 net/smc: remove unused function smc_lo_supports_v2 The smcd_ops->supports_v2 is only called in smcd_register_dev(), which calls function smcd_supports_v2 for ism. For loopback-ism, function smc_lo_supports_v2 is unused, remove it. Signed-off-by: Wang Liang Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250619030854.1536676-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit 0685ca51b0c9bf6ee7e13327fbcb32b24d9b3536 Merge: 99aa0bbb082e7c 0dffcea4121a54 Author: Jakub Kicinski Date: Sat Jun 21 08:16:06 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== ice: Separate TSPLL from PTP and clean up [part] Jake Keller says: Separate TSPLL related functions and definitions from all PTP-related files and clean up the code by implementing multiple helpers. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ice: add TSPLL log config helper ice: use designated initializers for TSPLL consts ice: remove ice_tspll_params_e825 definitions ice: fix E825-C TSPLL register definitions ice: rename TSPLL and CGU functions and definitions ice: move TSPLL functions to a separate file ==================== Link: https://patch.msgid.link/20250618174231.3100231-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 99aa0bbb082e7c0660751832acca897493c3082c Author: Kory Maincent Date: Fri Jun 20 11:16:41 2025 +0200 net: pse-pd: Fix ethnl_pse_send_ntf() stub parameter type The ethnl_pse_send_ntf() stub function has incorrect parameter type when CONFIG_ETHTOOL_NETLINK is disabled. The function should take a net_device pointer instead of phy_device pointer to match the actual implementation. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506200355.TqFiYUbN-lkp@intel.com/ Fixes: fc0e6db30941 ("net: pse-pd: Add support for reporting events") Signed-off-by: Kory Maincent Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250620091641.2098028-1-kory.maincent@bootlin.com Signed-off-by: Jakub Kicinski commit 14e1e7aa7d8ccb1d58e19c8dc2f4ed72e8186d18 Merge: 4922ca773d9d84 72792461c8e8d1 Author: Jakub Kicinski Date: Sat Jun 21 07:55:00 2025 -0700 Merge branch 'eth-finish-migration-to-the-new-rxfh-callbacks' Jakub Kicinski says: ==================== eth: finish migration to the new RXFH callbacks Finish drivers conversions to callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Remove the conditional calling in the core, rxnfc callbacks are no longer used for RXFH. ==================== Link: https://patch.msgid.link/20250618203823.1336156-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 72792461c8e8d19b3fe8d62a1b3ea6a2e3135182 Author: Jakub Kicinski Date: Wed Jun 18 13:38:23 2025 -0700 net: ethtool: don't mux RXFH via rxnfc callbacks All drivers have been converted. Stop using the rxnfc fallbacks for Rx Flow Hashing configuration. Joe pointed out in earlier review that in ethtool_set_rxfh() we need both .get_rxnfc and .get_rxfh_fields, because we need both the ring count and flow hashing (because we call ethtool_check_flow_types()). IOW the existing check added for transitioning drivers was buggy. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618203823.1336156-11-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 188793f082a522a5413155d16f74924e3e551d93 Author: Jakub Kicinski Date: Wed Jun 18 13:38:22 2025 -0700 eth: hns3: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Reviewed-by: Jijie Shao Link: https://patch.msgid.link/20250618203823.1336156-10-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 943c0ce308843a616466ae83aac90b451ea12f4c Author: Jakub Kicinski Date: Wed Jun 18 13:38:21 2025 -0700 eth: hinic: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Zeroing data on SET is not necessary, the argument is not copied back to user space. The driver has no other RXNFC functionality so the SET callback can be now removed. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618203823.1336156-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6bfd8cf33859ae23ec9e07a5bdbb55315305962a Author: Jakub Kicinski Date: Wed Jun 18 13:38:20 2025 -0700 eth: nfp: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Acked-by: Louis Peens Link: https://patch.msgid.link/20250618203823.1336156-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 18f4e3898ac3f17982f711d4cdcbcdca50ff922a Author: Jakub Kicinski Date: Wed Jun 18 13:38:19 2025 -0700 eth: mlx5: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Reviewed-by: Dragos Tatulea Link: https://patch.msgid.link/20250618203823.1336156-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 06bb89e00f22307317b97e9c24d06bdd42f0b166 Author: Jakub Kicinski Date: Wed Jun 18 13:38:18 2025 -0700 eth: qede: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618203823.1336156-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 92a95652650f9eb8556ba9a0513adf16d43f639c Author: Jakub Kicinski Date: Wed Jun 18 13:38:17 2025 -0700 eth: benet: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). The driver has no other RXNFC functionality so the SET callback can be now removed. Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618203823.1336156-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 861b948ac18c3f5d999a42ea64e7ff20f163fb74 Author: Jakub Kicinski Date: Wed Jun 18 13:38:16 2025 -0700 eth: sfc: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). This driver's RXFH config is read only / fixed so the conversion is purely factoring out the handling into a helper. One thing of note that this is one of the two drivers which pays attention to rss_context. Reviewed-by: Edward Cree Link: https://patch.msgid.link/20250618203823.1336156-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c58b9d1829d45cdbdf5e7977c94c26bc53d0f748 Author: Jakub Kicinski Date: Wed Jun 18 13:38:15 2025 -0700 eth: sfc: siena: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). This driver's RXFH config is read only / fixed so the conversion is purely factoring out the handling into a helper. Reviewed-by: Edward Cree Link: https://patch.msgid.link/20250618203823.1336156-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 80ec96cb245b64b2866c2474c9d692201748c30e Author: Jakub Kicinski Date: Wed Jun 18 13:38:14 2025 -0700 eth: sfc: falcon: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). This driver's RXFH config is read only / fixed so the conversion is purely factoring out the handling into a helper. Reviewed-by: Edward Cree Link: https://patch.msgid.link/20250618203823.1336156-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 4922ca773d9d84cc4ad4e38ab10a92ddc6b3205f Author: Taehee Yoo Date: Thu Jun 19 14:40:58 2025 +0000 eth: bnxt: add netmem TX support Use netmem_dma_*() helpers and declare netmem_tx to support netmem TX. By this change, all bnxt devices will support the netmem TX. Unreadable skbs are not going to be handled by the TX push logic. So, it checks whether a skb is readable or not before the TX push logic. netmem TX can be tested with ncdevmem.c Acked-by: Mina Almasry Acked-by: Stanislav Fomichev Signed-off-by: Taehee Yoo Reviewed-by: Michael Chan Link: https://patch.msgid.link/20250619144058.147051-1-ap420073@gmail.com Signed-off-by: Jakub Kicinski commit ab2aa5453bb83d05e764a1207a61109c6fd4fe4c Author: Geert Uytterhoeven Date: Thu Jun 19 12:13:17 2025 +0200 can: rcar_canfd: Describe channel-specific FD registers using C struct The rcar_canfd_f_*() inline functions to obtain channel-specific CAN-FD register offsets really describe a memory layout. Hence replace them by a C structure, to simplify the code, and reduce kernel size. This also gets rid of warnings about unused rcar_canfd_f_*() inline functions, which are reported by recent versions of clang. Suggested-by: Vincent Mailhol Reported-by: Jakub Kicinski Closes: https://lore.kernel.org/20250618183827.5bebca8f@kernel.org Signed-off-by: Geert Uytterhoeven Acked-by: Vincent Mailhol Link: https://patch.msgid.link/292b75b3bc8dd95f805f0223f606737071c8cf86.1750327217.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit 1ed3ced30a7e1a8cf22b918665b3f813a69b1015 Merge: 4672aec56d2e8e 433dce0692a01b Author: Jakub Kicinski Date: Sat Jun 21 07:35:42 2025 -0700 Merge branch 'rds-minor-updates-for-spelling-and-endian' Simon Horman says: ==================== rds: Minor updates for spelling and endian This short series addressses some cosmetic issues in rds. 1. Some spelling errors, as flagged by spellcheck 2. Some endianness annotation errors, which are not bugs, flagged by Sparse ==================== Link: https://patch.msgid.link/20250619-rds-minor-v1-0-86d2ee3a98b9@kernel.org Signed-off-by: Jakub Kicinski commit 433dce0692a01b00a36fde4044bff641c9bff608 Author: Simon Horman Date: Thu Jun 19 14:58:33 2025 +0100 rds: Correct spelling Correct spelling as flagged by codespell. With these changes in place codespell only flags false positives in net/rds. Signed-off-by: Simon Horman Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250619-rds-minor-v1-2-86d2ee3a98b9@kernel.org Signed-off-by: Jakub Kicinski commit 6e307a873d30ce027ff08ea6bb42a0fe6dda125d Author: Simon Horman Date: Thu Jun 19 14:58:32 2025 +0100 rds: Correct endian annotation of port and addr assignments Correct the endianness annotation of port assignments: A host byte order value (RDS_TCP_PORT) is correctly converted to network byte order (big endian) using htons. But it is then cast back to host byte order before assigning to a variable that expects a big endian value. Address this by dropping the cast. This is not a bug because, while the endian annotation is changed by this patch, the assigned value is unchanged. Also correct the endianness of address assignment. A host byte order value (INADDR_ANY) is incorrectly assigned as-is to a variable that expects a big endian value. Address this by converting the value to network byte order (big endian). This is not a bug because INADDR_ANY is 0, which is isomorphic with regards to endian conversions. IOW, while the endian annotation is changed by this patch, the assigned value is unchanged. Incorrect endian annotations appear to date back to IPv4-only code added by commit 70041088e3b9 ("RDS: Add TCP transport to RDS"). Flagged by Sparse. Signed-off-by: Simon Horman Reviewed-by: Allison Henderson Link: https://patch.msgid.link/20250619-rds-minor-v1-1-86d2ee3a98b9@kernel.org Signed-off-by: Jakub Kicinski commit 4672aec56d2e8edabcb74c3e2320301d106a377e Author: Mina Almasry Date: Thu Jun 19 17:52:38 2025 +0000 netmem: fix skb_frag_address_safe with unreadable skbs skb_frag_address_safe() needs a check that the skb_frag_page exists check similar to skb_frag_address(). Cc: ap420073@gmail.com Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250619175239.3039329-1-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 46d1816f1bda7eb6362ade75c45874202a4bb468 Merge: 0289c51f889e43 d8a8ca14c93739 Author: David S. Miller Date: Sat Jun 21 14:26:25 2025 +0100 Merge branch 'gve-xdp-tx-redirect' into main Joshua Washington says: ==================== gve: XDP TX and redirect support for DQ RDA A previous patch series[1] introduced the ability to process XDP buffers to the DQ RDA queue format. This is a follow-up patch series to introduce XDP_TX and XDP_REDIRECT support and expose XDP support to the kernel. Link: https://git.kernel.org/netdev/net-next/c/e2ac75a8a967 [1] ==================== Signed-off-by: David S. Miller commit d8a8ca14c93739250bc770f9aa33eb38e23b1f37 Author: Joshua Washington Date: Wed Jun 18 20:56:13 2025 +0000 gve: add XDP_TX and XDP_REDIRECT support for DQ RDA This patch adds support for XDP_TX and XDP_REDIRECT for the DQ RDA queue format. To appropriately support transmission of XDP frames, a new pending packet type GVE_TX_PENDING_PACKET_DQO_XDP_FRAME is introduced for completion handling, as there was a previous assumption that completed packets would be SKBs. XDP_TX handling completes the basic XDP actions, so the feature is recorded accordingly. This patch also enables the ndo_xdp_xmit callback allowing DQ to handle XDP_REDIRECT packets originating from another interface. The XDP spinlock is moved to common TX ring fields so that it can be used in both GQ and DQ. Originally, it was in a section which was mutually exclusive for GQ and DQ. In summary, 3 XDP features are exposed for the DQ RDA queue format: 1) NETDEV_XDP_ACT_BASIC 2) NETDEV_XDP_ACT_NDO_XMIT 3) NETDEV_XDP_ACT_REDIRECT Note that XDP and header-data split are mutually exclusive for the time being due to lack of multi-buffer XDP support. This patch does not add support for the DQ QPL format. That is to come in a future patch series. Reviewed-by: Willem de Bruijn Signed-off-by: Praveen Kaligineedi Signed-off-by: Joshua Washington Signed-off-by: Harshitha Ramamurthy Signed-off-by: David S. Miller commit cb711b3d197aaf7c86d8f70163cd09c5fe768796 Author: Joshua Washington Date: Wed Jun 18 20:56:12 2025 +0000 gve: refactor DQO TX methods to be more generic for XDP This patch performs various minor DQO TX datapath refactors in preparation for adding XDP_TX and XDP_REDIRECT support. The following refactors are performed: 1) gve_tx_fill_pkt_desc_dqo() relies on a SKB pointer to get whether checksum offloading should be enabled. This won't work for the XDP case, which does not have a SKB. This patch updates the method to use a boolean representing whether checksum offloading should be enabled directly. 2) gve_maybe_stop_dqo() contains some synchronization between the true TX head and the cached value, a synchronization which is common for XDP queues and normal netdev queues. However, that method is reserved for netdev TX queues. To avoid duplicate code, this logic is factored out into a new method, gve_has_tx_slots_available(). 3) gve_tx_update_tail() is added to update the TX tail, a functionality that will be common between normal TX and XDP TX codepaths. Reviewed-by: Willem de Bruijn Signed-off-by: Joshua Washington Signed-off-by: Praveen Kaligineedi Signed-off-by: Harshitha Ramamurthy Signed-off-by: David S. Miller commit d05ebf7cc3c5ee78ff8567a22148ab0d82a5d1c4 Author: Joshua Washington Date: Wed Jun 18 20:56:11 2025 +0000 gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi In preparation for XDP DQ support, the gve_xdp_xmit callback needs to be generalized for all queue formats. This patch renames the GQ-specific function to gve_xdp_xmit_gqi, and introduces a new gve_xdp_xmit callback which branches on queue format. Reviewed-by: Willem de Bruijn Signed-off-by: Joshua Washington Signed-off-by: Harshitha Ramamurthy Signed-off-by: David S. Miller commit 61b57d35396a4b4bcca9944644b24fc6015976b5 Author: Vitaly Kuznetsov Date: Tue Jun 3 11:19:51 2025 +0200 x86/efi: Implement support for embedding SBAT data for x86 Similar to zboot architectures, implement support for embedding SBAT data for x86. Put '.sbat' section in between '.data' and '.text' as the former also covers '.bss' and '.pgtable' and thus must be the last one in the file. Signed-off-by: Vitaly Kuznetsov Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Ard Biesheuvel Link: https://lore.kernel.org/20250603091951.57775-1-vkuznets@redhat.com commit 0289c51f889e435a7626931688023a80090d9c5e Author: Subbaraya Sundeep Date: Wed Jun 18 19:27:16 2025 +0530 octeontx2-af: Fix rvu_mbox_init return path rvu_mbox_init function makes use of error path for freeing memory which are local to the function in both success and failure conditions. This is unusual hence fix it by returning zero on success. With new cn20k code this is freeing valid memory in success case also. Fixes: e53ee4acb220 ("octeontx2-af: CN20k basic mbox operations and structures") Signed-off-by: Subbaraya Sundeep Reviewed-by: Simon Horman Signed-off-by: David S. Miller commit ddceadce63d9cb752c2472e220ded05cabaf7971 Author: Tejun Heo Date: Fri Jun 13 15:34:22 2025 -1000 sched_ext: Add support for cgroup bandwidth control interface From 077814f57f8acce13f91dc34bbd2b7e4911fbf25 Mon Sep 17 00:00:00 2001 From: Tejun Heo Date: Fri, 13 Jun 2025 15:06:47 -1000 - Add CONFIG_GROUP_SCHED_BANDWIDTH which is selected by both CONFIG_CFS_BANDWIDTH and EXT_GROUP_SCHED. - Put bandwidth control interface files for both cgroup v1 and v2 under CONFIG_GROUP_SCHED_BANDWIDTH. - Update tg_bandwidth() to fetch configuration parameters from fair if CONFIG_CFS_BANDWIDTH, SCX otherwise. - Update tg_set_bandwidth() to update the parameters for both fair and SCX. - Add bandwidth control parameters to struct scx_cgroup_init_args. - Add sched_ext_ops.cgroup_set_bandwidth() which is invoked on bandwidth control parameter updates. - Update scx_qmap and maximal selftest to test the new feature. Signed-off-by: Tejun Heo commit 6e6558a6bc418f1478c5dc8609d03805364e0cb9 Author: Tejun Heo Date: Fri Jun 13 15:33:10 2025 -1000 sched_ext, sched/core: Factor out struct scx_task_group More sched_ext fields will be added to struct task_group. In preparation, factor out sched_ext fields into struct scx_task_group to reduce clutter in the common header. No functional changes. Signed-off-by: Tejun Heo commit e4e149dd2f80b3f61d738f0b7d9cc9772c1353a4 Merge: e4ee150fea818c 33796b91871ad4 Author: Tejun Heo Date: Fri Jun 20 17:01:21 2025 -1000 sched_ext: Merge branch 'for-6.16-fixes' into for-6.17 Pull sched_ext/for-6.16-fixes to receive: c50784e99f0e ("sched_ext: Make scx_group_set_weight() always update tg->scx.weight") 33796b91871a ("sched_ext, sched/core: Don't call scx_group_set_weight() prematurely from sched_create_group()") which are needed to implement CPU bandwidth control interface support. Signed-off-by: Tejun Heo commit e4ee150fea818c8519a0921d53794b763af1a006 Merge: f479fee3827aa8 5bc34be478d09c Author: Tejun Heo Date: Fri Jun 20 16:55:34 2025 -1000 sched_ext: Merge branch 'sched/core' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into for-6.17 Pull tip/sched/core to receive the following commits: d403a3689af5 ("sched/fair: Move max_cfs_quota_period decl and default_cfs_period() def from fair.c to sched.h") de4c80c6963e ("sched/core: Relocate tg_get_cfs_*() and cpu_cfs_*_read_*()") 43e33f53e256 ("sched/core: Reorganize cgroup bandwidth control interface file reads") 5bc34be478d0 ("sched/core: Reorganize cgroup bandwidth control interface file writes") These will be used to implement CPU bandwidth interface support in sched_ext. Signed-off-by: Tejun Heo commit edf2cadf01e8f2620af25b337d15ebc584911b46 Author: Blake Jones Date: Thu Jun 12 12:49:39 2025 -0700 perf test: add test for BPF metadata collection This is an end-to-end test for the PERF_RECORD_BPF_METADATA support. It adds a new "bpf_metadata_perf_version" variable to perf's BPF programs, so that when they are loaded, there will be at least one BPF program with some metadata to parse. The test invokes "perf record" in a way that loads one of those BPF programs, and then sifts through the output to find its BPF metadata. Signed-off-by: Blake Jones Link: https://lore.kernel.org/r/20250612194939.162730-6-blakejones@google.com Signed-off-by: Namhyung Kim commit f19860ea9477f5ac33775cc0a602c7d54188c00a Author: Blake Jones Date: Thu Jun 12 12:49:38 2025 -0700 perf tools: display the new PERF_RECORD_BPF_METADATA event Here's some example "perf script -D" output for the new event type. The ": unhandled!" message is from tool.c, analogous to other behavior there. I've elided some rows with all NUL characters for brevity, and I wrapped one of the >75-column lines to fit in the commit guidelines. 0x50fc8@perf.data [0x260]: event: 84 . . ... raw event: size 608 bytes . 0000: 54 00 00 00 00 00 60 02 62 70 66 5f 70 72 6f 67 T.....`.bpf_prog . 0010: 5f 31 65 30 61 32 65 33 36 36 65 35 36 66 31 61 _1e0a2e366e56f1a . 0020: 32 5f 70 65 72 66 5f 73 61 6d 70 6c 65 5f 66 69 2_perf_sample_fi . 0030: 6c 74 65 72 00 00 00 00 00 00 00 00 00 00 00 00 lter............ . 0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [...] . 0110: 74 65 73 74 5f 76 61 6c 75 65 00 00 00 00 00 00 test_value...... . 0120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [...] . 0150: 34 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 42.............. . 0160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ [...] 0 0x50fc8 [0x260]: PERF_RECORD_BPF_METADATA \ prog bpf_prog_1e0a2e366e56f1a2_perf_sample_filter entry 0: test_value = 42 : unhandled! Signed-off-by: Blake Jones Link: https://lore.kernel.org/r/20250612194939.162730-5-blakejones@google.com Signed-off-by: Namhyung Kim commit fdc3441f2d317b40ace0936ee040a6c895d60014 Author: Blake Jones Date: Thu Jun 12 12:49:37 2025 -0700 perf record: collect BPF metadata from new programs This collects metadata for any BPF programs that were loaded during a "perf record" run, and emits it at the end of the run. Signed-off-by: Blake Jones Link: https://lore.kernel.org/r/20250612194939.162730-4-blakejones@google.com Signed-off-by: Namhyung Kim commit ab38e84ba9a80581e055408e0f8c0158998fa4b9 Author: Blake Jones Date: Thu Jun 12 12:49:36 2025 -0700 perf record: collect BPF metadata from existing BPF programs Look for .rodata maps, find ones with 'bpf_metadata_' variables, extract their values as strings, and create a new PERF_RECORD_BPF_METADATA synthetic event using that data. The code gets invoked from the existing routine perf_event__synthesize_one_bpf_prog(). For example, a BPF program with the following variables: const char bpf_metadata_version[] SEC(".rodata") = "3.14159"; int bpf_metadata_value[] SEC(".rodata") = 42; would generate a PERF_RECORD_BPF_METADATA record with: .prog_name = .nr_entries = 2 .entries[0].key = "version" .entries[0].value = "3.14159" .entries[1].key = "value" .entries[1].value = "42" Each of the BPF programs and subprograms that share those variables would get a distinct PERF_RECORD_BPF_METADATA record, with the ".prog_name" showing the name of each program or subprogram. The prog_name is deliberately the same as the ".name" field in the corresponding PERF_RECORD_KSYMBOL record. This code only gets invoked if support for displaying BTF char arrays as strings is detected. Signed-off-by: Blake Jones Link: https://lore.kernel.org/r/20250612194939.162730-3-blakejones@google.com Signed-off-by: Namhyung Kim commit 1d0654b7fdc5431b85035f6e76b4bc57679575d8 Author: Blake Jones Date: Thu Jun 12 12:49:35 2025 -0700 perf build: detect support for libbpf's emit_strings option This creates a config option that detects libbpf's ability to display character arrays as strings, which was just added to the BPF tree (https://git.kernel.org/bpf/bpf-next/c/87c9c79a02b4). To test this change, I built perf (from later in this patch set) with: - static libbpf (default, using source from kernel tree) - dynamic libbpf (LIBBPF_DYNAMIC=1 LIBBPF_INCLUDE=/usr/local/include) For both the static and dynamic versions, I used headers with and without the ".emit_strings" option. I verified that of the four resulting binaries, the two with ".emit_strings" would successfully record BPF_METADATA events, and the two without wouldn't. All four binaries would successfully display BPF_METADATA events, because the relevant bit of libbpf code is only used during "perf record". Signed-off-by: Blake Jones Link: https://lore.kernel.org/r/20250612194939.162730-2-blakejones@google.com Signed-off-by: Namhyung Kim commit c6a14b32c9ba041fbe043aa30ebd5c6b467d6518 Author: Eric Biggers Date: Sat Jun 14 15:13:01 2025 -0700 fscrypt: Explicitly include Fix build warnings with W=1 that started appearing after commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1"). While at it, also sort the include lists alphabetically. Link: https://lore.kernel.org/r/20250614221301.100803-1-ebiggers@kernel.org Signed-off-by: Eric Biggers commit aa006b2e515959e3575acebca6292f060da94c12 Author: Liam Merwick Date: Mon Jun 9 09:11:21 2025 +0000 KVM: fix typo in kvm_vm_set_mem_attributes() comment It should be 'has' in the sentence and not 'as'. Signed-off-by: Liam Merwick Reviewed-by: Pankaj Gupta Link: https://lore.kernel.org/r/20250609091121.2497429-4-liam.merwick@oracle.com Signed-off-by: Sean Christopherson commit 741e595f02fe4386914b7ef656a06f7209480ca9 Author: Liam Merwick Date: Mon Jun 9 09:11:20 2025 +0000 KVM: Add trace_kvm_vm_set_mem_attributes() Add a tracing function that, for a guest memory range, displays the start and end addresses plus the per-page attributes being set. Signed-off-by: Liam Merwick Reviewed-by: Pankaj Gupta Link: https://lore.kernel.org/r/20250609091121.2497429-3-liam.merwick@oracle.com Signed-off-by: Sean Christopherson commit d921665e01ba86212bdace238bdff123bceffd46 Author: Maxim Levitsky Date: Wed Jun 11 15:45:20 2025 -0700 KVM: SVM: Add enable_ipiv param, never set IsRunning if disabled Let userspace "disable" IPI virtualization for AVIC via the enable_ipiv module param, by never setting IsRunning. SVM doesn't provide a way to disable IPI virtualization in hardware, but by ensuring CPUs never see IsRunning=1, every IPI in the guest (except for self-IPIs) will generate a VM-Exit. To avoid setting the real IsRunning bit, while still allowing KVM to use each vCPU's entry to update GA log entries, simply maintain a shadow of the entry, without propagating IsRunning updates to the real table when IPI virtualization is disabled. Providing a way to effectively disable IPI virtualization will allow KVM to safely enable AVIC on hardware that is susceptible to erratum #1235, which causes hardware to sometimes fail to detect that the IsRunning bit has been cleared by software. Note, the table _must_ be fully populated, as broadcast IPIs skip invalid entries, i.e. won't generate VM-Exit if every entry is invalid, and so simply pointing the VMCB at a common dummy table won't work. Alternatively, KVM could allocate a shadow of the entire table, but that'd be a waste of 4KiB since the per-vCPU entry doesn't actually consume an additional 8 bytes of memory (vCPU structures are large enough that they are backed by order-N pages). Signed-off-by: Maxim Levitsky [sean: keep "entry" variables, reuse enable_ipiv, split from erratum] Link: https://lore.kernel.org/r/20250611224604.313496-19-seanjc@google.com Signed-off-by: Sean Christopherson commit bafddc70001d1834b2f2e490e108bbb8812b4bed Author: Sean Christopherson Date: Wed Jun 11 15:45:19 2025 -0700 KVM: VMX: Move enable_ipiv knob to common x86 Move enable_ipiv to common x86 so that it can be reused by SVM to control IPI virtualization when AVIC is enabled. SVM doesn't actually provide a way to truly disable IPI virtualization, but KVM can get close enough by skipping the necessary table programming. Link: https://lore.kernel.org/r/20250611224604.313496-18-seanjc@google.com Signed-off-by: Sean Christopherson commit d29433336a7b4783546cdca3096c3aee36610e70 Author: Sean Christopherson Date: Wed Jun 11 15:45:18 2025 -0700 KVM: SVM: Drop superfluous "cache" of AVIC Physical ID entry pointer Drop the vCPU's pointer to its AVIC Physical ID entry, and simply index the table directly. Caching a pointer address is completely unnecessary for performance, and while the field technically caches the result of the pointer calculation, it's all too easy to misinterpret the name and think that the field somehow caches the _data_ in the table. No functional change intended. Suggested-by: Maxim Levitsky Tested-by: Sairaj Kodilkar Reviewed-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250611224604.313496-17-seanjc@google.com Signed-off-by: Sean Christopherson commit 26baab4eea4c135c2a2d2b5529a7a0467fba5bef Author: Sean Christopherson Date: Wed Jun 11 15:45:17 2025 -0700 KVM: SVM: Track AVIC tables as natively sized pointers, not "struct pages" Allocate and track AVIC's logical and physical tables as u32 and u64 pointers respectively, as managing the pages as "struct page" pointers adds an almost absurd amount of boilerplate and complexity. E.g. with page_address() out of the way, svm->avic_physical_id_cache becomes completely superfluous, and will be removed in a future cleanup. No functional change intended. Tested-by: Sairaj Kodilkar Acked-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250611224604.313496-16-seanjc@google.com Signed-off-by: Sean Christopherson commit c24ed209c474eae6a0a74beb63faa4184ada64ee Author: Sean Christopherson Date: Wed Jun 11 15:45:16 2025 -0700 KVM: SVM: Drop redundant check in AVIC code on ID during vCPU creation Drop avic_get_physical_id_entry()'s compatibility check on the incoming ID, as its sole caller, avic_init_backing_page(), performs the exact same check. Drop avic_get_physical_id_entry() entirely as the only remaining functionality is getting the address of the Physical ID table, and accessing the array without an immediate bounds check is kludgy. Opportunistically add a compile-time assertion to ensure the vcpu_id can't result in a bounds overflow, e.g. if KVM (really) messed up a maximum physical ID #define, as well as run-time assertions so that a NULL pointer dereference is morphed into a safer WARN(). No functional change intended. Tested-by: Sairaj Kodilkar Reviewed-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250611224604.313496-15-seanjc@google.com Signed-off-by: Sean Christopherson commit 1aa6e256e46f0b72be6d6e0f890c11e0a1805f53 Author: Sean Christopherson Date: Wed Jun 11 15:45:15 2025 -0700 KVM: SVM: Inhibit AVIC if ID is too big instead of rejecting vCPU creation Inhibit AVIC with a new "ID too big" flag if userspace creates a vCPU with an ID that is too big, but otherwise allow vCPU creation to succeed. Rejecting KVM_CREATE_VCPU with EINVAL violates KVM's ABI as KVM advertises that the max vCPU ID is 4095, but disallows creating vCPUs with IDs bigger than 254 (AVIC) or 511 (x2AVIC). Alternatively, KVM could advertise an accurate value depending on which AVIC mode is in use, but that wouldn't really solve the underlying problem, e.g. would be a breaking change if KVM were to ever try and enable AVIC or x2AVIC by default. Cc: Maxim Levitsky Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-14-seanjc@google.com Signed-off-by: Sean Christopherson commit d8527f133c0a810b2e803a03aa186cfef721fbf8 Author: Sean Christopherson Date: Wed Jun 11 15:45:14 2025 -0700 KVM: SVM: Drop vcpu_svm's pointless avic_backing_page field Drop vcpu_svm's avic_backing_page pointer and instead grab the physical address of KVM's vAPIC page directly from the source. Getting a physical address from a kernel virtual address is not an expensive operation, and getting the physical address from a struct page is *more* expensive for CONFIG_SPARSEMEM=y kernels. Regardless, none of the paths that consume the address are hot paths, i.e. shaving cycles is not a priority. Eliminating the "cache" means KVM doesn't have to worry about the cache being invalid, which will simplify a future fix when dealing with vCPU IDs that are too big. WARN if KVM attempts to allocate a vCPU's AVIC backing page without an in-kernel local APIC. avic_init_vcpu() bails early if the APIC is not in-kernel, and KVM disallows enabling an in-kernel APIC after vCPUs have been created, i.e. it should be impossible to reach avic_init_backing_page() without the vAPIC being allocated. Tested-by: Sairaj Kodilkar Reviewed-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250611224604.313496-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 3338c639da15a87cf57edc79de8409c98b704d87 Author: Sean Christopherson Date: Wed Jun 11 15:45:13 2025 -0700 KVM: SVM: Add helper to deduplicate code for getting AVIC backing page Add a helper to get the physical address of the AVIC backing page, both to deduplicate code and to prepare for getting the address directly from apic->regs, at which point it won't be all that obvious that the address in question is what SVM calls the AVIC backing page. No functional change intended. Reviewed-by: Maxim Levitsky Tested-by: Sairaj Kodilkar Reviewed-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250611224604.313496-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 2e002ddc896684f668427113ec027f3025fe6c41 Author: Sean Christopherson Date: Wed Jun 11 15:45:12 2025 -0700 KVM: SVM: Drop pointless masking of kernel page pa's with AVIC HPA masks Drop AVIC_HPA_MASK and all its users, the mask is just the 4KiB-aligned maximum theoretical physical address for x86-64 CPUs, as x86-64 is currently defined (going beyond PA52 would require an entirely new paging mode, which would arguably create a new, different architecture). All usage in KVM masks the result of page_to_phys(), which on x86-64 is guaranteed to be 4KiB aligned and a legal physical address; if either of those requirements doesn't hold true, KVM has far bigger problems. Drop masking the avic_backing_page with AVIC_PHYSICAL_ID_ENTRY_BACKING_PAGE_MASK for all the same reasons, but keep the macro even though it's unused in functional code. It's a distinct architectural define, and having the definition in software helps visualize the layout of an entry. And to be hyper-paranoid about MAXPA going beyond 52, add a compile-time assert to ensure the kernel's maximum supported physical address stays in bounds. The unnecessary masking in avic_init_vmcb() also incorrectly assumes that SME's C-bit resides between bits 51:11; that holds true for current CPUs, but isn't required by AMD's architecture: In some implementations, the bit used may be a physical address bit Key word being "may". Opportunistically use the GENMASK_ULL() version for AVIC_PHYSICAL_ID_ENTRY_BACKING_PAGE_MASK, which is far more readable than a set of repeating Fs. Tested-by: Sairaj Kodilkar Reviewed-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250611224604.313496-11-seanjc@google.com Signed-off-by: Sean Christopherson commit 430579577892f56d25d4bc97f34212acc00e55fa Author: Sean Christopherson Date: Wed Jun 11 15:45:11 2025 -0700 KVM: SVM: Drop pointless masking of default APIC base when setting V_APIC_BAR Drop VMCB_AVIC_APIC_BAR_MASK, it's just a regurgitation of the maximum theoretical 4KiB-aligned physical address, i.e. is not novel in any way, and its only usage is to mask the default APIC base, which is 4KiB aligned and (obviously) a legal physical address. No functional change intended. Tested-by: Sairaj Kodilkar Reviewed-by: Naveen N Rao (AMD) Link: https://lore.kernel.org/r/20250611224604.313496-10-seanjc@google.com Signed-off-by: Sean Christopherson commit a0ca34bb1aad0c72e3fe7b9377c7ac87fa3b7098 Author: Sean Christopherson Date: Wed Jun 11 15:45:10 2025 -0700 KVM: SVM: Delete IRTE link from previous vCPU irrespective of new routing Delete the IRTE link from the previous vCPU irrespective of the new routing state, i.e. even if the IRTE won't be configured to post IRQs to a vCPU. Whether or not the new route is postable as no bearing on the *old* route. Failure to delete the link can result in KVM incorrectly updating the IRTE, e.g. if the "old" vCPU is scheduled in/out. Fixes: 411b44ba80ab ("svm: Implements update_pi_irte hook to setup posted interrupt") Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 1da19c5ce0533796179d9e1b55e64bf78478c4c1 Author: Sean Christopherson Date: Wed Jun 11 15:45:09 2025 -0700 iommu/amd: KVM: SVM: Delete now-unused cached/previous GA tag fields Delete the amd_ir_data.prev_ga_tag field now that all usage is superfluous. Reviewed-by: Vasant Hegde Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 0a917e9d4b7070fafcbf7a8ec32d2aa444b4e757 Author: Sean Christopherson Date: Wed Jun 11 15:45:08 2025 -0700 KVM: SVM: Delete IRTE link from previous vCPU before setting new IRTE Delete the previous per-vCPU IRTE link prior to modifying the IRTE. If forcing the IRTE back to remapped mode fails, the IRQ is already broken; keeping stale metadata won't change that, and the IOMMU should be sufficiently paranoid to sanitize the IRTE when the IRQ is freed and reallocated. This will allow hoisting the vCPU tracking to common x86, which in turn will allow most of the IRTE update code to be deduplicated. Tested-by: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 05c5e23657e1d61c271c2f4a3a21d4d630b18a9b Author: Sean Christopherson Date: Wed Jun 11 15:45:07 2025 -0700 KVM: SVM: Track per-vCPU IRTEs using kvm_kernel_irqfd structure Track the IRTEs that are posting to an SVM vCPU via the associated irqfd structure and GSI routing instead of dynamically allocating a separate data structure. In addition to eliminating an atomic allocation, this will allow hoisting much of the IRTE update logic to common x86. Cc: Sairaj Kodilkar Link: https://lore.kernel.org/r/20250611224604.313496-6-seanjc@google.com Signed-off-by: Sean Christopherson commit cb210737675ef4c1ad88721e84558eeb2f199312 Author: Sean Christopherson Date: Wed Jun 11 15:45:06 2025 -0700 KVM: Pass new routing entries and irqfd when updating IRTEs When updating IRTEs in response to a GSI routing or IRQ bypass change, pass the new/current routing information along with the associated irqfd. This will allow KVM x86 to harden, simplify, and deduplicate its code. Since adding/removing a bypass producer is now conveniently protected with irqfds.lock, i.e. can't run concurrently with kvm_irq_routing_update(), use the routing information cached in the irqfd instead of looking up the information in the current GSI routing tables. Opportunistically convert an existing printk() to pr_info() and put its string onto a single line (old code that strictly adhered to 80 chars). Link: https://lore.kernel.org/r/20250611224604.313496-5-seanjc@google.com Signed-off-by: Sean Christopherson commit e76c274513f24d92074e36e40f799b44aeb7a0fb Author: Sean Christopherson Date: Wed Jun 11 14:35:57 2025 -0700 KVM: x86: Fold irq_comm.c into irq.c Drop irq_comm.c, a.k.a. common IRQ APIs, as there has been no non-x86 user since commit 003f7de62589 ("KVM: ia64: remove") (at the time, irq_comm.c lived in virt/kvm, not arch/x86/kvm). Suggested-by: Paolo Bonzini Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-19-seanjc@google.com Signed-off-by: Sean Christopherson commit 37b1761fe89529a1531b971d4d869b4e6d345704 Author: Sean Christopherson Date: Wed Jun 11 14:35:56 2025 -0700 KVM: x86: Move IRQ mask notifier infrastructure to I/O APIC emulation Move the IRQ mask logic to ioapic.c as KVM's only user is its in-kernel I/O APIC emulation. In addition to encapsulating more I/O APIC specific code, trimming down irq_comm.c helps pave the way for removing it entirely. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-18-seanjc@google.com Signed-off-by: Sean Christopherson commit 8fd2a6d43a10184f8edcc7adc0547e1871df6705 Author: Sean Christopherson Date: Wed Jun 11 14:35:55 2025 -0700 KVM: selftests: Fall back to split IRQ chip if full in-kernel chip is unsupported Now that KVM x86 allows compiling out support for in-kernel I/O APIC (and PIC and PIT) emulation, i.e. allows disabling KVM_CREATE_IRQCHIP for all intents and purposes, fall back to a split IRQ chip for x86 if creating the full in-kernel version fails with ENOTTY. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-17-seanjc@google.com Signed-off-by: Sean Christopherson commit 141db6cd79e2d71fce3049347177f98a233d8eb2 Author: Sean Christopherson Date: Wed Jun 11 14:35:54 2025 -0700 KVM: Squash two CONFIG_HAVE_KVM_IRQCHIP #ifdefs into one Squash two #idef CONFIG_HAVE_KVM_IRQCHIP regions in KVM's trace events, as the only code outside of the #idefs depends on CONFIG_KVM_IOAPIC, and that Kconfig only exists for x86, which unconditionally selects HAVE_KVM_IRQCHIP. No functional change intended. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-16-seanjc@google.com Signed-off-by: Sean Christopherson commit 628a27731e3f36de7ddce226f7e09ee70e40ed66 Author: Sean Christopherson Date: Wed Jun 11 14:35:53 2025 -0700 KVM: x86: Add CONFIG_KVM_IOAPIC to allow disabling in-kernel I/O APIC Add a Kconfig to allow building KVM without support for emulating a I/O APIC, PIC, and PIT, which is desirable for deployments that effectively don't support a fully in-kernel IRQ chip, i.e. never expect any VMM to create an in-kernel I/O APIC. E.g. compiling out support eliminates a few thousand lines of guest-facing code and gives security folks warm fuzzies. As a bonus, wrapping relevant paths with CONFIG_KVM_IOAPIC #ifdefs makes it much easier for readers to understand which bits and pieces exist specifically for fully in-kernel IRQ chips. Opportunistically convert all two in-kernel uses of __KVM_HAVE_IOAPIC to CONFIG_KVM_IOAPIC, e.g. rather than add a second #ifdef to generate a stub for kvm_arch_post_irq_routing_update(). Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-15-seanjc@google.com Signed-off-by: Sean Christopherson commit 2c938850d9d18cbd6484a66588fac95d74d951fd Author: Sean Christopherson Date: Wed Jun 11 14:35:52 2025 -0700 KVM: Move x86-only tracepoints to x86's trace.h Move the I/O APIC tracepoints and trace_kvm_msi_set_irq() to x86, as __KVM_HAVE_IOAPIC is just code for "x86", and trace_kvm_msi_set_irq() isn't unique to I/O APIC emulation. Opportunistically clean up the absurdly messy #includes in ioapic.c. No functional change intended. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-14-seanjc@google.com Signed-off-by: Sean Christopherson commit cd9140ad8312234ec296d566a9d9d0b2b437ee7c Author: Sean Christopherson Date: Wed Jun 11 14:35:51 2025 -0700 KVM: x86: Explicitly check for in-kernel PIC when getting ExtINT Explicitly check for an in-kernel PIC when checking for a pending ExtINT in the PIC. Effectively swapping the split vs. full irqchip logic will allow guarding the in-kernel I/O APIC (and PIC) emulation with a Kconfig, and also makes it more obvious that kvm_pic_read_irq() won't result in a NULL pointer dereference. Opportunistically add WARNs in the fallthrough path, mostly to document that the userspace ExtINT logic is only relevant to split IRQ chips. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-13-seanjc@google.com Signed-off-by: Sean Christopherson commit 2c31aa747d789dc895a62efeea13452519184487 Author: Sean Christopherson Date: Wed Jun 11 14:35:50 2025 -0700 KVM: x86: Don't clear PIT's IRQ line status when destroying PIT Don't bother clearing the PIT's IRQ line status when destroying the PIT, as userspace can't possibly rely on KVM to lower the IRQ line in any sane use case, and it's not at all obvious that clearing the PIT's IRQ line is correct/desirable in kvm_create_pit()'s error path. When called from kvm_arch_pre_destroy_vm(), the entire VM is being torn down and thus {kvm_pic,kvm_ioapic}.irq_states are unreachable. As for the error path in kvm_create_pit(), the only way the PIT's bit in irq_states can be set is if userspace raises the associated IRQ before KVM_CREATE_PIT{2} completes. Forcefully clearing the bit would clobber userspace's input, nonsensical though that input may be. Not to mention that no known VMM will continue on if PIT creation fails. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 61423c413a746fd5fe5b0d865ea722e11b01105e Author: Sean Christopherson Date: Wed Jun 11 14:35:49 2025 -0700 KVM: x86: Hardcode the PIT IRQ source ID to '2' Hardcode the PIT's source IRQ ID to '2' instead of "finding" that bit 2 is always the first available bit in irq_sources_bitmap. Bits 0 and 1 are set/reserved by kvm_arch_init_vm(), i.e. long before kvm_create_pit() can be invoked, and KVM allows at most one in-kernel PIT instance, i.e. it's impossible for the PIT to find a different free bit (there are no other users of kvm_request_irq_source_id(). Delete the now-defunct irq_sources_bitmap and all its associated code. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-11-seanjc@google.com Signed-off-by: Sean Christopherson commit 77a74b8ff41ae620f5a5d727d596b670b7b9994e Author: Sean Christopherson Date: Wed Jun 11 14:35:48 2025 -0700 KVM: x86: Move kvm_{request,free}_irq_source_id() to i8254.c (PIT) Move kvm_{request,free}_irq_source_id() to i8254.c, i.e. the dedicated PIT emulation file, in anticipation of removing them entirely in favor of hardcoding the PIT's "requested" source ID (the source ID can only ever be '2', and the request can never fail). No functional change intended. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-10-seanjc@google.com Signed-off-by: Sean Christopherson commit df35135680fae0b13f843b6f4c6c310c567d7900 Author: Sean Christopherson Date: Wed Jun 11 14:35:47 2025 -0700 KVM: x86: Move kvm_setup_default_irq_routing() into irq.c Move the default IRQ routing table used for in-kernel I/O APIC and PIC routing to irq.c, and tweak the name to make it explicitly clear what routing is being initialized. In addition to making it more obvious that the so called "default" routing only applies to an in-kernel I/O APIC, getting it out of irq_comm.c will allow removing irq_comm.c entirely. And placing the function alongside other I/O APIC and PIC code will allow for guarding KVM's in-kernel I/O APIC and PIC emulation with a Kconfig with minimal #ifdefs. No functional change intended. Cc: Kai Huang Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-9-seanjc@google.com Signed-off-by: Sean Christopherson commit c5a701955e2de084fdd0ad5edfed578389eae5ac Author: Sean Christopherson Date: Wed Jun 11 14:35:46 2025 -0700 KVM: x86: Rename irqchip_kernel() to irqchip_full() Rename irqchip_kernel() to irqchip_full(), as "kernel" is very ambiguous due to the existence of split IRQ chip support, where only some of the "irqchip" is in emulated by the kernel/KVM. E.g. irqchip_kernel() often gets confused with irqchip_in_kernel(). Opportunistically hoist the definition up in irq.h so that it's co-located with other "full" irqchip code in anticipation of wrapping it all with a Kconfig/#ifdef. No functional change intended. Suggested-by: Paolo Bonzini Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-8-seanjc@google.com Signed-off-by: Sean Christopherson commit b771b1616ff89d7441e5889b84e444c48a7676f0 Author: Sean Christopherson Date: Wed Jun 11 14:35:45 2025 -0700 KVM: x86: Move KVM_{GET,SET}_IRQCHIP ioctl helpers to irq.c Move the ioctl helpers for getting/setting fully in-kernel IRQ chip state to irq.c, partly to trim down x86.c, but mostly in preparation for adding a Kconfig to control support for in-kernel I/O APIC, PIC, and PIT emulation. No functional change intended. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 00b5ebf8db7c382c7ea0074fdd79bdb9c65db236 Author: Sean Christopherson Date: Wed Jun 11 14:35:44 2025 -0700 KVM: x86: Move PIT ioctl helpers to i8254.c Move the PIT ioctl helpers to i8254.c, i.e. to the file that implements PIT emulation. Eliminating PIT code in x86.c will allow adding a Kconfig to control support for in-kernel I/O APIC, PIC, and PIT emulation with minimal #ifdefs. Opportunistically make kvm_pit_set_reinject() and kvm_pit_load_count() local to i8254.c as they were only publicly visible to make them available to the ioctl helpers. No functional change intended. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 20218e69e85b0418f444227488c732e2c0b753b2 Author: Sean Christopherson Date: Wed Jun 11 14:35:43 2025 -0700 KVM: x86: Drop superfluous kvm_hv_set_sint() => kvm_hv_synic_set_irq() wrapper Drop the superfluous kvm_hv_set_sint() and instead wire up ->set() directly to its final destination, kvm_hv_synic_set_irq(). Keep hv_synic_set_irq() instead of kvm_hv_set_sint() to provide some amount of consistency in the ->set() helpers, e.g. to match kvm_pic_set_irq() and kvm_ioapic_set_irq(). kvm_set_msi() is arguably the oddball, e.g. kvm_set_msi_irq() should be something like kvm_msi_to_lapic_irq() so that kvm_set_msi() can instead be kvm_set_msi_irq(), but that's a future problem to solve. No functional change intended. Cc: Vitaly Kuznetsov Cc: Kai Huang Reviewed-by: Vitaly Kuznetsov Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 05dc9eab3f005a5af5ad03138f81b7541c5db85b Author: Sean Christopherson Date: Wed Jun 11 14:35:42 2025 -0700 KVM: x86: Drop superfluous kvm_set_ioapic_irq() => kvm_ioapic_set_irq() wrapper Drop the superfluous and confusing kvm_set_ioapic_irq() and instead wire up ->set() directly to its final destination. No functional change intended. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 8a33b1f246ceeffe5f74b10078a04696060ac537 Author: Sean Christopherson Date: Wed Jun 11 14:35:41 2025 -0700 KVM: x86: Drop superfluous kvm_set_pic_irq() => kvm_pic_set_irq() wrapper Drop the superfluous and confusing kvm_set_pic_irq() => kvm_pic_set_irq() wrapper, and instead wire up ->set() directly to its final destination. Opportunistically move the declaration kvm_pic_set_irq() to irq.h to start gathering more of the in-kernel APIC/IO-APIC logic in irq.{c,h}. No functional change intended. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-3-seanjc@google.com Signed-off-by: Sean Christopherson commit e295d2e7fbe69ddec772c951c466dfbfc1c96818 Author: Sean Christopherson Date: Wed Jun 11 14:35:40 2025 -0700 KVM: x86: Trigger I/O APIC route rescan in kvm_arch_irq_routing_update() Trigger the I/O APIC route rescan that's performed for a split IRQ chip after userspace updates IRQ routes in kvm_arch_irq_routing_update(), i.e. before dropping kvm->irq_lock. Calling kvm_make_all_cpus_request() under a mutex is perfectly safe, and the smp_wmb()+smp_mb__after_atomic() pair in __kvm_make_request()+kvm_check_request() ensures the new routing is visible to vCPUs prior to the request being visible to vCPUs. In all likelihood, commit b053b2aef25d ("KVM: x86: Add EOI exit bitmap inference") somewhat arbitrarily made the request outside of irq_lock to avoid holding irq_lock any longer than is strictly necessary. And then commit abdb080f7ac8 ("kvm/irqchip: kvm_arch_irq_routing_update renaming split") took the easy route of adding another arch hook instead of risking a functional change. Note, the call to synchronize_srcu_expedited() does NOT provide ordering guarantees with respect to vCPUs scanning the new routing; as above, the request infrastructure provides the necessary ordering. I.e. there's no need to wait for kvm_scan_ioapic_routes() to complete if it's actively running, because regardless of whether it grabs the old or new table, the vCPU will have another KVM_REQ_SCAN_IOAPIC pending, i.e. will rescan again and see the new mappings. Acked-by: Kai Huang Link: https://lore.kernel.org/r/20250611213557.294358-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 23b54381cee2928e8b5622e654ca4516f30d2f1a Author: Sean Christopherson Date: Fri May 16 16:07:34 2025 -0700 irqbypass: Require producers to pass in Linux IRQ number during registration Pass in the Linux IRQ associated with an IRQ bypass producer instead of relying on the caller to set the field prior to registration, as there's no benefit to relying on callers to do the right thing. Take care to set producer->irq before __connect(), as KVM expects the IRQ to be valid as soon as a connection is possible. Reviewed-by: Kevin Tian Reviewed-by: Alex Williamson Acked-by: Michael S. Tsirkin Link: https://lore.kernel.org/r/20250516230734.2564775-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 8394b32faecd9c63b3c436e78e62519e9548e530 Author: Sean Christopherson Date: Fri May 16 16:07:33 2025 -0700 irqbypass: Use xarray to track producers and consumers Track IRQ bypass producers and consumers using an xarray to avoid the O(2n) insertion time associated with walking a list to check for duplicate entries, and to search for an partner. At low (tens or few hundreds) total producer/consumer counts, using a list is faster due to the need to allocate backing storage for xarray. But as count creeps into the thousands, xarray wins easily, and can provide several orders of magnitude better latency at high counts. E.g. hundreds of nanoseconds vs. hundreds of milliseconds. Cc: Oliver Upton Cc: David Matlack Cc: Like Xu Cc: Binbin Wu Reported-by: Yong He Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217379 Link: https://lore.kernel.org/all/20230801115646.33990-1-likexu@tencent.com Reviewed-by: Kevin Tian Acked-by: Michael S. Tsirkin Reviewed-by: Alex Williamson Link: https://lore.kernel.org/r/20250516230734.2564775-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 46a4bfd0ae480cabbacc56fe0d8f91cbe229c7ce Author: Sean Christopherson Date: Fri May 16 16:07:32 2025 -0700 irqbypass: Use guard(mutex) in lieu of manual lock+unlock Use guard(mutex) to clean up irqbypass's error handling. Reviewed-by: Kevin Tian Acked-by: Michael S. Tsirkin Reviewed-by: Alex Williamson Link: https://lore.kernel.org/r/20250516230734.2564775-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 5d7dbdce388b43cf3a9bc50c4132493de26aeba4 Author: Sean Christopherson Date: Fri May 16 16:07:31 2025 -0700 irqbypass: Use paired consumer/producer to disconnect during unregister Use the paired consumer/producer information to disconnect IRQ bypass producers/consumers in O(1) time (ignoring the cost of __disconnect()). Reviewed-by: Kevin Tian Acked-by: Michael S. Tsirkin Reviewed-by: Alex Williamson Link: https://lore.kernel.org/r/20250516230734.2564775-6-seanjc@google.com Signed-off-by: Sean Christopherson commit add57f493e0893ac0fb4acbdc441918d3e800f10 Author: Sean Christopherson Date: Fri May 16 16:07:30 2025 -0700 irqbypass: Explicitly track producer and consumer bindings Explicitly track IRQ bypass producer:consumer bindings. This will allow making removal an O(1) operation; searching through the list to find information that is trivially tracked (and useful for debug) is wasteful. Reviewed-by: Kevin Tian Acked-by: Michael S. Tsirkin Reviewed-by: Alex Williamson Link: https://lore.kernel.org/r/20250516230734.2564775-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 2b521d86ee80a436a92445b8206d38d75aeb39ea Author: Sean Christopherson Date: Fri May 16 16:07:29 2025 -0700 irqbypass: Take ownership of producer/consumer token tracking Move ownership of IRQ bypass token tracking into irqbypass.ko, and explicitly require callers to pass an eventfd_ctx structure instead of a completely opaque token. Relying on producers and consumers to set the token appropriately is error prone, and hiding the fact that the token must be an eventfd_ctx pointer (for all intents and purposes) unnecessarily obfuscates the code and makes it more brittle. Reviewed-by: Kevin Tian Acked-by: Michael S. Tsirkin Reviewed-by: Alex Williamson Link: https://lore.kernel.org/r/20250516230734.2564775-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 07fbc83c01520c62c89f6495f2f0bea2f4ac6684 Author: Sean Christopherson Date: Fri May 16 16:07:28 2025 -0700 irqbypass: Drop superfluous might_sleep() annotations Drop superfluous might_sleep() annotations from irqbypass, mutex_lock() provides all of the necessary tracking. Reviewed-by: Kevin Tian Acked-by: Michael S. Tsirkin Reviewed-by: Alex Williamson Link: https://lore.kernel.org/r/20250516230734.2564775-3-seanjc@google.com Signed-off-by: Sean Christopherson commit fa079a0616edbcdad538128306abbc19b68a9863 Author: Sean Christopherson Date: Fri May 16 16:07:27 2025 -0700 irqbypass: Drop pointless and misleading THIS_MODULE get/put Drop irqbypass.ko's superfluous and misleading get/put calls on THIS_MODULE. A module taking a reference to itself is useless; no amount of checks will prevent doom and destruction if the caller hasn't already guaranteed the liveliness of the module (this goes for any module). E.g. if try_module_get() fails because irqbypass.ko is being unloaded, then the kernel has already hit a use-after-free by virtue of executing code whose lifecycle is tied to irqbypass.ko. Reviewed-by: Kevin Tian Acked-by: Michael S. Tsirkin Reviewed-by: Alex Williamson Link: https://lore.kernel.org/r/20250516230734.2564775-2-seanjc@google.com Signed-off-by: Sean Christopherson commit cd4178d19420359554e3da6fd77ecfd0f58067ce Author: Sean Christopherson Date: Thu Jun 12 16:51:47 2025 -0700 KVM: arm64: WARN if unmapping a vLPI fails in any path When unmapping a vLPI, WARN if nullifying vCPU affinity fails, not just if failure occurs when freeing an ITE. If undoing vCPU affinity fails, then odds are very good that vLPI state tracking has has gotten out of whack, i.e. that KVM and the GIC disagree on the state of an IRQ/vLPI. At best, inconsistent state means there is a lurking bug/flaw somewhere. At worst, the inconsistency could eventually be fatal to the host, e.g. if an ITS command fails because KVM's view of things doesn't match reality/hardware. Note, only the call from kvm_arch_irq_bypass_del_producer() by way of kvm_vgic_v4_unset_forwarding() doesn't already WARN. Common KVM's kvm_irq_routing_update() WARNs if kvm_arch_update_irqfd_routing() fails. For that path, if its_unmap_vlpi() fails in kvm_vgic_v4_unset_forwarding(), the only possible causes are that the GIC doesn't have a v4 ITS (from its_irq_set_vcpu_affinity()): /* Need a v4 ITS */ if (!is_v4(its_dev->its)) return -EINVAL; guard(raw_spinlock)(&its_dev->event_map.vlpi_lock); /* Unmap request? */ if (!info) return its_vlpi_unmap(d); or that KVM has gotten out of sync with the GIC/ITS (from its_vlpi_unmap()): if (!its_dev->event_map.vm || !irqd_is_forwarded_to_vcpu(d)) return -EINVAL; All of the above failure scenarios are warnable offences, as they should never occur absent a kernel/KVM bug. Acked-by: Oliver Upton Link: https://lore.kernel.org/all/aFWY2LTVIxz5rfhh@google.com Signed-off-by: Sean Christopherson commit 13b38e6b8059de096ebddb5d770c2419943949b7 Author: Anubhav Shelat Date: Wed Jun 18 10:29:22 2025 -0400 perf header: remove unecessary core id test It is possible for systems to have a greater socket id number than the number of cpus present on a machine, so this test is obselete and should be removed. Signed-off-by: Anubhav Shelat Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250618142921.4053400-2-ashelat@redhat.com Signed-off-by: Namhyung Kim commit 614fb9d1479b1d90721ca70da8b7c55f69fe9ad2 Author: Sean Christopherson Date: Fri May 16 14:35:40 2025 -0700 KVM: Assert that slots_lock is held when resetting per-vCPU dirty rings Assert that slots_lock is held in kvm_dirty_ring_reset() and add a comment to explain _why_ slots needs to be held for the duration of the reset. Link: https://lore.kernel.org/all/aCSns6Q5oTkdXUEe@google.com Suggested-by: James Houghton Reviewed-by: Yan Zhao Reviewed-by: Peter Xu Link: https://lore.kernel.org/r/20250516213540.2546077-7-seanjc@google.com Signed-off-by: Sean Christopherson commit e46ad851150f1dd14b8542b6fb7a51f695a99eb1 Author: Sean Christopherson Date: Fri May 16 14:35:39 2025 -0700 KVM: Use mask of harvested dirty ring entries to coalesce dirty ring resets Use "mask" instead of a dedicated boolean to track whether or not there is at least one to-be-reset entry for the current slot+offset. In the body of the loop, mask is zero only on the first iteration, i.e. !mask is equivalent to first_round. Opportunistically combine the adjacent "if (mask)" statements into a single if-statement. No functional change intended. Cc: Peter Xu Cc: Yan Zhao Cc: Maxim Levitsky Reviewed-by: Pankaj Gupta Reviewed-by: James Houghton Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Reviewed-by: Peter Xu Link: https://lore.kernel.org/r/20250516213540.2546077-6-seanjc@google.com Signed-off-by: Sean Christopherson commit ee188dea1677a0d9b3a8097e71b803896b8aaed7 Author: Sean Christopherson Date: Fri May 16 14:35:38 2025 -0700 KVM: Check for empty mask of harvested dirty ring entries in caller When resetting a dirty ring, explicitly check that there is work to be done before calling kvm_reset_dirty_gfn(), e.g. if no harvested entries are found and/or on the loop's first iteration, and delete the extremely misleading comment "This is only needed to make compilers happy". KVM absolutely relies on mask to be zero-initialized, i.e. the comment is an outright lie. Furthermore, the compiler is right to complain that KVM is calling a function with uninitialized data, as there are no guarantees the implementation details of kvm_reset_dirty_gfn() will be visible to kvm_dirty_ring_reset(). While the flaw could be fixed by simply deleting (or rewording) the comment, and duplicating the check is unfortunate, checking mask in the caller will allow for additional cleanups. Opportunistically drop the zero-initialization of cur_slot and cur_offset. If a bug were introduced where either the slot or offset was consumed before mask is set to a non-zero value, then it is highly desirable for the compiler (or some other sanitizer) to yell. Cc: Peter Xu Cc: Yan Zhao Cc: Maxim Levitsky Cc: Binbin Wu Reviewed-by: Pankaj Gupta Reviewed-by: James Houghton Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Reviewed-by: Peter Xu Link: https://lore.kernel.org/r/20250516213540.2546077-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 1333c35c4eea6533874564899371501ee80b9583 Author: Sean Christopherson Date: Fri May 16 14:35:37 2025 -0700 KVM: Conditionally reschedule when resetting the dirty ring When resetting a dirty ring, conditionally reschedule on each iteration after the first. The recently introduced hard limit mitigates the issue of an endless reset, but isn't sufficient to completely prevent RCU stalls, soft lockups, etc., nor is the hard limit intended to guard against such badness. Note! Take care to check for reschedule even in the "continue" paths, as a pathological scenario (or malicious userspace) could dirty the same gfn over and over, i.e. always hit the continue path. rcu: INFO: rcu_sched self-detected stall on CPU rcu: 4-....: (5249 ticks this GP) idle=51e4/1/0x4000000000000000 softirq=309/309 fqs=2563 rcu: (t=5250 jiffies g=-319 q=608 ncpus=24) CPU: 4 UID: 1000 PID: 1067 Comm: dirty_log_test Tainted: G L 6.13.0-rc3-17fa7a24ea1e-HEAD-vm #814 Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_arch_mmu_enable_log_dirty_pt_masked+0x26/0x200 [kvm] Call Trace: kvm_reset_dirty_gfn.part.0+0xb4/0xe0 [kvm] kvm_dirty_ring_reset+0x58/0x220 [kvm] kvm_vm_ioctl+0x10eb/0x15d0 [kvm] __x64_sys_ioctl+0x8b/0xb0 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_arch_mmu_enable_log_dirty_pt_masked+0x17/0x200 [kvm] Call Trace: kvm_reset_dirty_gfn.part.0+0xb4/0xe0 [kvm] kvm_dirty_ring_reset+0x58/0x220 [kvm] kvm_vm_ioctl+0x10eb/0x15d0 [kvm] __x64_sys_ioctl+0x8b/0xb0 do_syscall_64+0x5b/0x160 entry_SYSCALL_64_after_hwframe+0x4b/0x53 Fixes: fb04a1eddb1a ("KVM: X86: Implement ring-based dirty memory tracking") Reviewed-by: James Houghton Reviewed-by: Yan Zhao Reviewed-by: Peter Xu Link: https://lore.kernel.org/r/20250516213540.2546077-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 49005a2a3d2a2974db486e330dfb7c8bc85df17f Author: Sean Christopherson Date: Fri May 16 14:35:36 2025 -0700 KVM: Bail from the dirty ring reset flow if a signal is pending Abort a dirty ring reset if the current task has a pending signal, as the hard limit of INT_MAX entries doesn't ensure KVM will respond to a signal in a timely fashion. Fixes: fb04a1eddb1a ("KVM: X86: Implement ring-based dirty memory tracking") Reviewed-by: James Houghton Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Reviewed-by: Peter Xu Link: https://lore.kernel.org/r/20250516213540.2546077-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 530a8ba71b4c3b7fcee323dd997f4bab1be1a6ba Author: Sean Christopherson Date: Fri May 16 14:35:35 2025 -0700 KVM: Bound the number of dirty ring entries in a single reset at INT_MAX Cap the number of ring entries that are reset in a single ioctl to INT_MAX to ensure userspace isn't confused by a wrap into negative space, and so that, in a truly pathological scenario, KVM doesn't miss a TLB flush due to the count wrapping to zero. While the size of the ring is fixed at 0x10000 entries and KVM (currently) supports at most 4096, userspace is allowed to harvest entries from the ring while the reset is in-progress, i.e. it's possible for the ring to always have harvested entries. Opportunistically return an actual error code from the helper so that a future fix to handle pending signals can gracefully return -EINTR. Drop the function comment now that the return code is a stanard 0/-errno (and because a future commit will add a proper lockdep assertion). Opportunistically drop a similarly stale comment for kvm_dirty_ring_push(). Cc: Peter Xu Cc: Yan Zhao Cc: Maxim Levitsky Cc: Binbin Wu Fixes: fb04a1eddb1a ("KVM: X86: Implement ring-based dirty memory tracking") Reviewed-by: James Houghton Reviewed-by: Binbin Wu Reviewed-by: Yan Zhao Reviewed-by: Peter Xu Link: https://lore.kernel.org/r/20250516213540.2546077-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 71443210e26de3b35aea8dced894ad3c420d55d5 Author: Sean Christopherson Date: Fri May 16 14:59:09 2025 -0700 KVM: selftests: Print a more helpful message for EACCESS in access tracking test Use open_path_or_exit() helper to probe /sys/kernel/mm/page_idle/bitmap in the access tracking perf test so that a helpful/pertinent SKIP message is printed if the file exists but is inaccessible, e.g. because the file has the kernel's default 0600 permissions. Cc: James Houghton Link: https://lore.kernel.org/r/20250516215909.2551628-5-seanjc@google.com Signed-off-by: Sean Christopherson commit ba300a728f6f764828d735f01f314900fb6a8315 Author: Sean Christopherson Date: Fri May 16 14:59:08 2025 -0700 KVM: selftests: Play nice with EACCES errors in open_path_or_exit() Expand the SKIP conditions of the open_path_or_exit() helper to skip on EACCES as well as ENOENT. Most often, lack of permissions to a file needed by a KVM selftests is due to a file being root-only by default, not because of any bug/misconfiguration that warrants failing a test. Link: https://lore.kernel.org/r/20250516215909.2551628-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 6e1cce7cda1b69e455f89dbc0eeec128506fe969 Author: Sean Christopherson Date: Fri May 16 14:59:07 2025 -0700 KVM: selftests: Add __open_path_or_exit() variant to provide extra help info Add an inner __open_path_or_exit() API to let the caller provide additional information on ENOENT to try and help the user figure out why the test is being skipped, e.g. for files like the page_idle bitmap needed by the access tracking perf, which is dependent on a Kconfig. Immediately convert /dev/kvm to the new API, both as an example and because users might not know that some architectures/setups require loading KVM. Link: https://lore.kernel.org/r/20250516215909.2551628-3-seanjc@google.com Signed-off-by: Sean Christopherson commit fcab107abe1ab5be9dbe874baa722372da8f4f73 Author: Sean Christopherson Date: Fri May 16 14:59:06 2025 -0700 KVM: selftests: Verify KVM is loaded when getting a KVM module param Probe /dev/kvm when getting a KVM module param so that attempting to load a module param super early in a selftest generates a SKIP message about KVM not being loaded/enabled, versus some random parameter not existing. E.g. KVM x86's unconditional retrieval of force_emulation_prefix during kvm_selftest_arch_init() generates a rather confusing error message that takes far too much triage to understand. Link: https://lore.kernel.org/r/20250516215909.2551628-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 2d584688643fac90428ab12513e05d6deff7c606 Author: Ian Rogers Date: Wed Jun 18 17:25:55 2025 -0700 perf test: Add header shell test Add a shell test that sanity checks perf data and pipe mode produce expected header fields. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250619002555.100896-1-irogers@google.com Signed-off-by: Namhyung Kim commit 30142a93b1641b19bf4ba2cd6beb5814adc5b746 Author: Rahul Kumar Date: Fri May 23 23:43:52 2025 +0530 KVM: selftests: Fix spelling of 'occurrences' in sparsebit.c comments Correct two instances of the misspelled word 'occurences' to 'occurrences' in comments explaining node invariants in sparsebit.c. Signed-off-by: Rahul Kumar Link: https://lore.kernel.org/r/20250523181606.568320-1-rk0006818@gmail.com [sean: massage changelog] Signed-off-by: Sean Christopherson commit 24be2b7956a545945fcb560d42e3ea86406dba09 Author: Tom Lendacky Date: Thu May 29 16:18:00 2025 -0500 KVM: SVM: Allow SNP guest policy to specify SINGLE_SOCKET KVM currently returns -EINVAL when it attempts to create an SNP guest if the SINGLE_SOCKET guest policy bit is set. The reason for this action is that KVM would need specific support (SNP_ACTIVATE_EX command support) to achieve this when running on a system with more than one socket. However, the SEV firmware will make the proper check and return POLICY_FAILURE during SNP_ACTIVATE if the single socket guest policy bit is set and the system has more than one socket: - System with one socket - Guest policy SINGLE_SOCKET == 0 ==> SNP_ACTIVATE succeeds - Guest policy SINGLE_SOCKET == 1 ==> SNP_ACTIVATE succeeds - System with more than one socket - Guest policy SINGLE_SOCKET == 0 ==> SNP_ACTIVATE succeeds - Guest policy SINGLE_SOCKET == 1 ==> SNP_ACTIVATE fails with POLICY_FAILURE Remove the check for the SINGLE_SOCKET policy bit from snp_launch_start() and allow the firmware to perform the proper checking. This does have the effect of allowing an SNP guest with the SINGLE_SOCKET policy bit set to run on a single socket system, but fail when run on a system with more than one socket. However, this should not affect existing SNP guests as setting the SINGLE_SOCKET policy bit is not allowed today. Signed-off-by: Tom Lendacky Link: https://lore.kernel.org/r/4c51018dd3e4f2c543935134d2c4f47076f109f6.1748553480.git.thomas.lendacky@amd.com Signed-off-by: Sean Christopherson commit 9f4701e05faeec20350d9fc550e37ae8d2e08c88 Author: Tom Lendacky Date: Thu May 29 16:17:59 2025 -0500 KVM: SVM: Allow SNP guest policy disallow running with SMT enabled KVM currently returns -EINVAL when it attempts to create an SNP guest if the SMT guest policy bit is not set. However, there is no reason to check this, as there is no specific support in KVM that is required to support this. The SEV firmware will determine if SMT has been enabled or disabled in the BIOS and process the policy in the proper way: - SMT enabled in BIOS - Guest policy SMT == 0 ==> SNP_LAUNCH_START fails with POLICY_FAILURE - Guest policy SMT == 1 ==> SNP_LAUNCH_START succeeds - SMT disabled in BIOS - Guest policy SMT == 0 ==> SNP_LAUNCH_START succeeds - Guest policy SMT == 1 ==> SNP_LAUNCH_START succeeds Remove the check for the SMT policy bit from snp_launch_start() and allow the firmware to perform the proper checking. Signed-off-by: Tom Lendacky Link: https://lore.kernel.org/r/71043abdd9ef23b6f98fffa9c5c6045ac3a50187.1748553480.git.thomas.lendacky@amd.com Signed-off-by: Sean Christopherson commit dcbe6e51a0bb80a40f9a8c87750c291c2364573d Author: Namhyung Kim Date: Fri Jun 6 15:54:31 2025 -0700 perf parse-events: Set default GH modifier properly Commit 7b100989b4f6bce7 ("perf evlist: Remove __evlist__add_default") changed to use "cycles:P" as a default event. But the problem is it cannot set other default modifiers correctly. perf kvm needs to set attr.exclude_host by default but it didn't work because of the logic in the parse_events__modifier_list(). Also the exclude_GH_default was applied only if ":u" modifier was specified - which is strange. Move it out after handling the ":GH" and check perf_host and perf_guest properly. Before: $ ./perf kvm record -vv true |& grep exclude (nothing) But specifying an event (without a modifier) works: $ ./perf kvm record -vv -e cycles true |& grep exclude exclude_host 1 After: It now works for the both cases: $ ./perf kvm record -vv true |& grep exclude exclude_host 1 $ ./perf kvm record -vv -e cycles true |& grep exclude exclude_host 1 Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250606225431.2109754-1-namhyung@kernel.org Fixes: 35c8d21371e9b342 ("perf tools: Don't set attr.exclude_guest by default") Signed-off-by: Namhyung Kim commit 588d22b40480bca9efdb6e24d253baaa5165884c Author: Ian Rogers Date: Fri Jun 13 17:45:28 2025 -0700 perf test: Expand user space event reading (rdpmc) tests Test that disabling rdpmc support via /sys/bus/event_source/cpu*/rdpmc disables reading in the mmap (libperf read support will fallback to using a system call). Test all hybrid PMUs support rdpmc. Ensure hybrid PMUs use the correct CPU to rdpmc the correct event. Previously the test would open cycles or instructions with no extended type then rdpmc it on whatever CPU. This could fail/skip due to which CPU the test was scheduled upon. Signed-off-by: Ian Rogers Reviewed-by: Kan Liang Link: https://lore.kernel.org/r/20250614004528.1652860-1-irogers@google.com Signed-off-by: Namhyung Kim commit 1f287a4e7b90595718167f93f850f0a08484ec81 Author: Sean Christopherson Date: Thu May 22 17:11:35 2025 -0700 KVM: TDX: Move TDX hardware setup from main.c to tdx.c Move TDX hardware setup to tdx.c, as the code is obviously TDX specific, co-locating the setup with tdx_bringup() makes it easier to see and document the success_disable_tdx "error" path, and configuring the TDX specific hooks in tdx.c reduces the number of globally visible TDX symbols. Reviewed-by: Kai Huang Reviewed-by: Xiaoyao Li Link: https://lore.kernel.org/r/20250523001138.3182794-2-seanjc@google.com Signed-off-by: Sean Christopherson commit ffced89220502faab44ca61e23e6196d09f5f2d4 Author: Sean Christopherson Date: Mon Jun 2 16:48:51 2025 -0700 KVM: x86/mmu: Exempt nested EPT page tables from !USER, CR0.WP=0 logic Exempt nested EPT shadow pages tables from the CR0.WP=0 handling of supervisor writes, as EPT doesn't have a U/S bit and isn't affected by CR0.WP (or CR4.SMEP in the exception to the exception). Opportunistically refresh the comment to explain what KVM is doing, as the only record of why KVM shoves in WRITE and drops USER is buried in years-old changelogs. Cc: Jon Kohler Cc: Sergey Dyasli Reviewed-by: Jon Kohler Reviewed-by: Sergey Dyasli Link: https://lore.kernel.org/r/20250602234851.54573-1-seanjc@google.com Signed-off-by: Sean Christopherson commit 58c81bc1e71de7d02848a1c1579256f5ebd38e07 Author: Sean Christopherson Date: Thu Jun 5 12:50:18 2025 -0700 KVM: x86: Refactor handling of SIPI_RECEIVED when setting MP_STATE Convert the incoming mp_state to INIT_RECIEVED instead of manually calling kvm_set_mp_state() to make it more obvious that the SIPI_RECEIVED logic is translating the incoming state to KVM's internal tracking, as opposed to being some entirely unique flow. Opportunistically add a comment to explain what the code is doing. No functional change intended. Link: https://lore.kernel.org/r/20250605195018.539901-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 0fe3e8d804fdcc09ef44fbffcad8c39261a03470 Author: Sean Christopherson Date: Thu Jun 5 12:50:17 2025 -0700 KVM: x86: Move INIT_RECEIVED vs. INIT/SIPI blocked check to KVM_RUN Check for the should-be-impossible scenario of a vCPU being in Wait-For-SIPI with INIT/SIPI blocked during KVM_RUN instead of trying to detect and prevent illegal combinations in every ioctl that sets relevant state. Attempting to handle every possible "set" path is a losing game of whack-a-mole, and risks breaking userspace. E.g. INIT/SIPI are blocked on Intel if the vCPU is in VMX Root mode (post-VMXON), and on AMD if GIF=0. Handling those scenarios would require potentially breaking changes to {vmx,svm}_set_nested_state(). Moving the check to KVM_RUN fixes a syzkaller-induced splat due to the aforementioned VMXON case, and in theory should close the hole once and for all. Note, kvm_x86_vcpu_pre_run() already handles SIPI_RECEIVED, only the WFS case needs additional attention. Reported-by: syzbot+c1cbaedc2613058d5194@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?id=490ae63d8d89cb82c5d462d16962cf371df0e476 Link: https://lore.kernel.org/r/20250605195018.539901-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 16777ebded414bbf5c351343e25b98da74bb48c2 Author: Sean Christopherson Date: Thu Jun 5 12:50:16 2025 -0700 KVM: x86: WARN and reject KVM_RUN if vCPU's MP_STATE is SIPI_RECEIVED WARN if KVM_RUN is reached with a vCPU's mp_state set to SIPI_RECEIVED, as KVM no longer uses SIPI_RECEIVED internally, and should morph SIPI_RECEIVED into INIT_RECEIVED with a pending SIPI if userspace forces SIPI_RECEIVED. See commit 66450a21f996 ("KVM: x86: Rework INIT and SIPI handling") for more history and details. Link: https://lore.kernel.org/r/20250605195018.539901-3-seanjc@google.com Signed-off-by: Sean Christopherson commit c4a37acc5193bff436a3161f2defefb0da1db011 Author: Sean Christopherson Date: Thu Jun 5 12:50:15 2025 -0700 KVM: x86: Drop pending_smi vs. INIT_RECEIVED check when setting MP_STATE Allow userspace to set a vCPU's mp_state to INIT_RECEIVED in conjunction with a pending SMI, as rejecting that combination could result in KVM disallowing reflecting the output from KVM_GET_VCPU_EVENTS back into KVM via KVM_SET_VCPU_EVENTS. At the time the check was added, smi_pending could only be set in the context of KVM_RUN, with the vCPU in the RUNNABLE state. I.e. it was impossible for KVM to save vCPU state such that userspace could see a pending SMI for a vCPU in WFS. That no longer holds true now that KVM processes requested SMIs during KVM_GET_VCPU_EVENTS, e.g. if a vCPU receives an SMI while in WFS, and then userspace saves vCPU state. Note, this may partially re-open the user-triggerable WARN that was mostly closed by commit 28bf28887976 ("KVM: x86: fix user triggerable warning in kvm_apic_accept_events()"), but that WARN can already be triggered in several other ways, e.g. if userspace stuffs VMXON=1 after putting the vCPU into WFS. That issue will be addressed in an upcoming commit, in a more robust fashion (hopefully). Fixes: 1f7becf1b7e2 ("KVM: x86: get smi pending status correctly") Link: https://lore.kernel.org/r/20250605195018.539901-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 0792c71c1c94964952339f3251818b6dcf66c19b Author: Sean Christopherson Date: Tue Jun 10 15:57:37 2025 -0700 KVM: selftests: Verify KVM disable interception (for userspace) on filter change Re-read MSR_{FS,GS}_BASE after restoring the "allow everything" userspace MSR filter to verify that KVM stops forwarding exits to userspace. This can also be used in conjunction with manual verification (e.g. printk) to ensure KVM is correctly updating the MSR bitmaps consumed by hardware. Tested-by: Dapeng Mi Tested-by: Manali Shukla Link: https://lore.kernel.org/r/20250610225737.156318-33-seanjc@google.com Signed-off-by: Sean Christopherson commit bea44d1992401b5e1a0d213cba85f9c53f492e8a Author: Sean Christopherson Date: Tue Jun 10 15:57:36 2025 -0700 KVM: x86: Simplify userspace filter logic when disabling MSR interception Refactor {svm,vmx}_disable_intercept_for_msr() to simplify the handling of userspace filters that disallow access to an MSR. The more complicated logic is no longer needed or justified now that KVM recalculates all MSR intercepts on a userspace MSR filter change, i.e. now that KVM doesn't need to also update shadow bitmaps. No functional change intended. Suggested-by: Dapeng Mi Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250610225737.156318-32-seanjc@google.com Signed-off-by: Sean Christopherson commit 73be81b3bb7cd7951046eedee6efb00e4afc5e02 Author: Sean Christopherson Date: Tue Jun 10 15:57:35 2025 -0700 KVM: SVM: Add a helper to allocate and initialize permissions bitmaps Add a helper to allocate and initialize an MSR or I/O permissions map, as the logic is identical between the two map types, the only difference is the size of the bitmap. Opportunistically add a comment to explain why the bitmaps are initialized with 0xff, e.g. instead of the more common zero-initialized behavior, which is the main motivation for deduplicating the code. No functional change intended. Link: https://lore.kernel.org/r/20250610225737.156318-31-seanjc@google.com Signed-off-by: Sean Christopherson commit 54f1c770611b9f8d7e8f8a50a60384291f143689 Author: Sean Christopherson Date: Tue Jun 10 15:57:34 2025 -0700 KVM: nSVM: Merge MSRPM in 64-bit chunks on 64-bit kernels When merging L0 and L1 MSRPMs as part of nested VMRUN emulation, access the bitmaps using "unsigned long" chunks, i.e. use 8-byte access for 64-bit kernels instead of arbitrarily working on 4-byte chunks. Opportunistically rename local variables in nested_svm_merge_msrpm() to more precisely/accurately reflect their purpose ("offset" in particular is extremely ambiguous). Link: https://lore.kernel.org/r/20250610225737.156318-30-seanjc@google.com Signed-off-by: Sean Christopherson commit 5904ba5172464cdf688567a06346351ab3a61fd3 Author: Sean Christopherson Date: Tue Jun 10 15:57:33 2025 -0700 KVM: SVM: Return -EINVAL instead of MSR_INVALID to signal out-of-range MSR Return -EINVAL instead of MSR_INVALID from svm_msrpm_bit_nr() to indicate that the MSR isn't covered by one of the (currently) three MSRPM ranges, and delete the MSR_INVALID macro now that all users are gone. Link: https://lore.kernel.org/r/20250610225737.156318-29-seanjc@google.com Signed-off-by: Sean Christopherson commit 52f82177429e0631afebb676e57d05e621153b0d Author: Sean Christopherson Date: Tue Jun 10 15:57:32 2025 -0700 KVM: nSVM: Access MSRPM in 4-byte chunks only for merging L0 and L1 bitmaps Access the MSRPM using u32/4-byte chunks (and appropriately adjusted offsets) only when merging L0 and L1 bitmaps as part of emulating VMRUN. The only reason to batch accesses to MSRPMs is to avoid the overhead of uaccess operations (e.g. STAC/CLAC and bounds checks) when reading L1's bitmap pointed at by vmcb12. For all other uses, either per-bit accesses are more than fast enough (no uaccess), or KVM is only accessing a single bit (nested_svm_exit_handled_msr()) and so there's nothing to batch. In addition to (hopefully) documenting the uniqueness of the merging code, restricting chunked access to _just_ the merging code will allow for increasing the chunk size (to unsigned long) with minimal risk. Link: https://lore.kernel.org/r/20250610225737.156318-28-seanjc@google.com Signed-off-by: Sean Christopherson commit 7fe0578041188d63207f17335e8c0d10e19c7515 Author: Sean Christopherson Date: Tue Jun 10 15:57:31 2025 -0700 KVM: SVM: Store MSRPM pointer as "void *" instead of "u32 *" Store KVM's MSRPM pointers as "void *" instead of "u32 *" to guard against directly accessing the bitmaps outside of code that is explicitly written to access the bitmaps with a specific type. Opportunistically use svm_vcpu_free_msrpm() in svm_vcpu_free() instead of open coding an equivalent. Link: https://lore.kernel.org/r/20250610225737.156318-27-seanjc@google.com Signed-off-by: Sean Christopherson commit 5c9c084763637460acaeb3e22508c692a70b6905 Author: Sean Christopherson Date: Tue Jun 10 15:57:30 2025 -0700 KVM: SVM: Move svm_msrpm_offset() to nested.c Move svm_msrpm_offset() from svm.c to nested.c now that all usage of the u32-index offsets is nested virtualization specific. No functional change intended. Link: https://lore.kernel.org/r/20250610225737.156318-26-seanjc@google.com Signed-off-by: Sean Christopherson commit 2f89888434bce68123b3c980bf1f2e04ecee57e1 Author: Sean Christopherson Date: Tue Jun 10 15:57:29 2025 -0700 KVM: SVM: Drop explicit check on MSRPM offset when emulating SEV-ES accesses Now that msr_write_intercepted() defaults to true, i.e. accurately reflects hardware behavior for out-of-range MSRs, and doesn't WARN (or BUG) on an out-of-range MSR, drop sev_es_prevent_msr_access()'s svm_msrpm_offset() check that guarded against calling msr_write_intercepted() with a "bad" index. Opportunistically clean up the helper's formatting. Link: https://lore.kernel.org/r/20250610225737.156318-25-seanjc@google.com Signed-off-by: Sean Christopherson commit 4880919aaf8d4beda81746909559578544387728 Author: Sean Christopherson Date: Tue Jun 10 15:57:28 2025 -0700 KVM: SVM: Merge "after set CPUID" intercept recalc helpers Merge svm_recalc_intercepts_after_set_cpuid() and svm_recalc_instruction_intercepts() such that the "after set CPUID" helper simply invokes the type-specific helpers (MSRs vs. instructions), i.e. make svm_recalc_intercepts_after_set_cpuid() a single entry point for all intercept updates that need to be performed after a CPUID change. No functional change intended. Link: https://lore.kernel.org/r/20250610225737.156318-24-seanjc@google.com Signed-off-by: Sean Christopherson commit 40ba80e4b04364bc5ee7991d6a41475ef8c4e8a1 Author: Sean Christopherson Date: Tue Jun 10 15:57:27 2025 -0700 KVM: SVM: Fold svm_vcpu_init_msrpm() into its sole caller Fold svm_vcpu_init_msrpm() into svm_recalc_msr_intercepts() now that there is only the one caller (and because the "init" misnomer is even more misleading than it was in the past). No functional change intended. Link: https://lore.kernel.org/r/20250610225737.156318-23-seanjc@google.com Signed-off-by: Sean Christopherson commit 049dff172b6dde91649d65dbdad62e62f4855a97 Author: Sean Christopherson Date: Tue Jun 10 15:57:26 2025 -0700 KVM: SVM: Rename init_vmcb_after_set_cpuid() to make it intercepts specific Rename init_vmcb_after_set_cpuid() to svm_recalc_intercepts_after_set_cpuid() to more precisely describe its role. Strictly speaking, the name isn't perfect as toggling virtual VM{LOAD,SAVE} is arguably not recalculating an intercept, but practically speaking it's close enough. No functional change intended. Link: https://lore.kernel.org/r/20250610225737.156318-22-seanjc@google.com Signed-off-by: Sean Christopherson commit 4ceca57e3f2025936644abac6afafa59d3cc15be Author: Sean Christopherson Date: Tue Jun 10 15:57:25 2025 -0700 KVM: x86: Rename msr_filter_changed() => recalc_msr_intercepts() Rename msr_filter_changed() to recalc_msr_intercepts() and drop the trampoline wrapper now that both SVM and VMX use a filter-agnostic recalc helper to react to the new userspace filter. No functional change intended. Reviewed-by: Xin Li (Intel) Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250610225737.156318-21-seanjc@google.com Signed-off-by: Sean Christopherson commit 160f143cc1317a599ef44c8d35a1328f2dd7a14d Author: Sean Christopherson Date: Tue Jun 10 15:57:24 2025 -0700 KVM: SVM: Manually recalc all MSR intercepts on userspace MSR filter change On a userspace MSR filter change, recalculate all MSR intercepts using the filter-agnostic logic instead of maintaining a "shadow copy" of KVM's desired intercepts. The shadow bitmaps add yet another point of failure, are confusing (e.g. what does "handled specially" mean!?!?), an eyesore, and a maintenance burden. Given that KVM *must* be able to recalculate the correct intercepts at any given time, and that MSR filter updates are not hot paths, there is zero benefit to maintaining the shadow bitmaps. Opportunistically switch from boot_cpu_has() to cpu_feature_enabled() as appropriate. Link: https://lore.kernel.org/all/aCdPbZiYmtni4Bjs@google.com Link: https://lore.kernel.org/all/20241126180253.GAZ0YNTdXH1UGeqsu6@fat_crate.local Cc: Francesco Lavra Link: https://lore.kernel.org/r/20250610225737.156318-20-seanjc@google.com Signed-off-by: Sean Christopherson commit 8a056ece45d2e626c4726ce0da3585c94e199da8 Author: Sean Christopherson Date: Tue Jun 10 15:57:23 2025 -0700 KVM: VMX: Manually recalc all MSR intercepts on userspace MSR filter change On a userspace MSR filter change, recalculate all MSR intercepts using the filter-agnostic logic instead of maintaining a "shadow copy" of KVM's desired intercepts. The shadow bitmaps add yet another point of failure, are confusing (e.g. what does "handled specially" mean!?!?), an eyesore, and a maintenance burden. Given that KVM *must* be able to recalculate the correct intercepts at any given time, and that MSR filter updates are not hot paths, there is zero benefit to maintaining the shadow bitmaps. Opportunistically switch from boot_cpu_has() to cpu_feature_enabled() as appropriate. Link: https://lore.kernel.org/all/aCdPbZiYmtni4Bjs@google.com Link: https://lore.kernel.org/all/20241126180253.GAZ0YNTdXH1UGeqsu6@fat_crate.local Cc: Borislav Petkov Reviewed-by: Chao Gao Reviewed-by: Xin Li (Intel) Reviewed-by: Dapeng Mi Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250610225737.156318-19-seanjc@google.com Signed-off-by: Sean Christopherson commit 405a63d4d3865eeff1d7f4811686ad4ac7593638 Author: Sean Christopherson Date: Tue Jun 10 15:57:22 2025 -0700 KVM: x86: Move definition of X2APIC_MSR() to lapic.h Dedup the definition of X2APIC_MSR and put it in the local APIC code where it belongs. No functional change intended. Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250610225737.156318-18-seanjc@google.com Signed-off-by: Sean Christopherson commit cb53d079484c989c7fde2413e6181b704cf13f89 Author: Sean Christopherson Date: Tue Jun 10 15:57:21 2025 -0700 KVM: SVM: Drop "always" flag from list of possible passthrough MSRs Drop the "always" flag from the array of possible passthrough MSRs, and instead manually initialize the permissions for the handful of MSRs that KVM passes through by default. In addition to cutting down on boilerplate copy+paste code and eliminating a misleading flag (the MSRs aren't always passed through, e.g. thanks to MSR filters), this will allow for removing the direct_access_msrs array entirely. Link: https://lore.kernel.org/r/20250610225737.156318-17-seanjc@google.com Signed-off-by: Sean Christopherson commit 3a0f09b361e1c6245c544f9ea9e14ab651979a4f Author: Sean Christopherson Date: Tue Jun 10 15:57:20 2025 -0700 KVM: SVM: Pass through GHCB MSR if and only if VM is an SEV-ES guest Disable interception of the GHCB MSR if and only if the VM is an SEV-ES guest. While the exact behavior is completely undocumented in the APM, common sense and testing on SEV-ES capable CPUs says that accesses to the GHCB from non-SEV-ES guests will #GP. I.e. from the guest's perspective, no functional change intended. Fixes: 376c6d285017 ("KVM: SVM: Provide support for SEV-ES vCPU creation/loading") Link: https://lore.kernel.org/r/20250610225737.156318-16-seanjc@google.com Signed-off-by: Sean Christopherson commit 6b7315fe54ce24e65ba2c7b13ae22c6ab6caac5a Author: Sean Christopherson Date: Tue Jun 10 15:57:19 2025 -0700 KVM: SVM: Implement and adopt VMX style MSR intercepts APIs Add and use SVM MSR interception APIs (in most paths) to match VMX's APIs and nomenclature. Specifically, add SVM variants of: vmx_disable_intercept_for_msr(vcpu, msr, type) vmx_enable_intercept_for_msr(vcpu, msr, type) vmx_set_intercept_for_msr(vcpu, msr, type, intercept) to eventually replace SVM's single helper: set_msr_interception(vcpu, msrpm, msr, allow_read, allow_write) which is awkward to use (in all cases, KVM either applies the same logic for both reads and writes, or intercepts one of read or write), and is unintuitive due to using '0' to indicate interception should be *set*. Keep the guts of the old API for the moment to avoid churning the MSR filter code, as that mess will be overhauled in the near future. Leave behind a temporary comment to call out that the shadow bitmaps have inverted polarity relative to the bitmaps consumed by hardware. No functional change intended. Reviewed-by: Chao Gao Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250610225737.156318-15-seanjc@google.com Signed-off-by: Sean Christopherson commit c38595ad69cef0898f31421e115e5176d29c14be Author: Sean Christopherson Date: Tue Jun 10 15:57:18 2025 -0700 KVM: SVM: Add helpers for accessing MSR bitmap that don't rely on offsets Add macro-built helpers for testing, setting, and clearing MSRPM entries without relying on precomputed offsets. This sets the stage for eventually removing general KVM use of precomputed offsets, which are quite confusing and rather inefficient for the vast majority of KVM's usage. Outside of merging L0 and L1 bitmaps for nested SVM, using u32-indexed offsets and accesses is at best unnecessary, and at worst introduces extra operations to retrieve the individual bit from within the offset u32 value. And simply calling them "offsets" is very confusing, as the "unit" of the offset isn't immediately obvious. Use the new helpers in set_msr_interception_bitmap() and msr_write_intercepted() to verify the math and operations, but keep the existing offset-based logic in set_msr_interception_bitmap() to sanity check the "clear" and "set" operations. Manipulating MSR interceptions isn't a hot path and no kernel release is ever expected to contain this specific version of set_msr_interception_bitmap() (it will be removed entirely in the near future). Link: https://lore.kernel.org/r/20250610225737.156318-14-seanjc@google.com Signed-off-by: Sean Christopherson commit 4879dc9469e6d54d1199b3c53f7c16c891d9004f Author: Sean Christopherson Date: Tue Jun 10 15:57:17 2025 -0700 KVM: nSVM: Don't initialize vmcb02 MSRPM with vmcb01's "always passthrough" Don't initialize vmcb02's MSRPM with KVM's set of "always passthrough" MSRs, as KVM always needs to consult L1's intercepts, i.e. needs to merge vmcb01 with vmcb12 and write the result to vmcb02. This will eventually allow for the removal of svm_vcpu_init_msrpm(). Note, the bitmaps are truly initialized by svm_vcpu_alloc_msrpm() (default to intercepting all MSRs), e.g. if there is a bug lurking elsewhere, the worst case scenario from dropping the call to svm_vcpu_init_msrpm() should be that KVM would fail to passthrough MSRs to L2. Link: https://lore.kernel.org/r/20250610225737.156318-13-seanjc@google.com Signed-off-by: Sean Christopherson commit f21ff2c8c997e5f209e7165456f447293907a9a8 Author: Sean Christopherson Date: Tue Jun 10 15:57:16 2025 -0700 KVM: nSVM: Omit SEV-ES specific passthrough MSRs from L0+L1 bitmap merge Don't merge bitmaps on nested VMRUN for MSRs that KVM passes through only for SEV-ES guests. KVM doesn't support nested virtualization for SEV-ES, and likely never will. Link: https://lore.kernel.org/r/20250610225737.156318-12-seanjc@google.com Signed-off-by: Sean Christopherson commit 9b72c3d59f4245dd2d3fa19025e2789e85ce0f47 Author: Sean Christopherson Date: Tue Jun 10 15:57:15 2025 -0700 KVM: nSVM: Use dedicated array of MSRPM offsets to merge L0 and L1 bitmaps Use a dedicated array of MSRPM offsets to merge L0 and L1 bitmaps, i.e. to merge KVM's vmcb01 bitmap with L1's vmcb12 bitmap. This will eventually allow for the removal of direct_access_msrs, as the only path where tracking the offsets is truly justified is the merge for nested SVM, where merging in chunks is an easy way to batch uaccess reads/writes. Opportunistically omit the x2APIC MSRs from the merge-specific array instead of filtering them out at runtime. Note, disabling interception of DEBUGCTL, XSS, EFER, PAT, GHCB, and TSC_AUX is mutually exclusive with nested virtualization, as KVM passes through those MSRs only for SEV-ES guests, and KVM doesn't support nested virtualization for SEV+ guests. Defer removing those MSRs to a future cleanup in order to make this refactoring as benign as possible. Link: https://lore.kernel.org/r/20250610225737.156318-11-seanjc@google.com Signed-off-by: Sean Christopherson commit 16e9584cc0a8cfca1f36e6c2bead842105fcb125 Author: Sean Christopherson Date: Tue Jun 10 15:57:14 2025 -0700 KVM: SVM: Clean up macros related to architectural MSRPM definitions Move SVM's MSR Permissions Map macros to svm.h in anticipation of adding helpers that are available to SVM code, and opportunistically replace a variety of open-coded literals with (hopefully) informative macros. Opportunistically open code ARRAY_SIZE(msrpm_ranges) instead of wrapping it as NUM_MSR_MAPS, which is an ambiguous name even if it were qualified with "SVM_MSRPM". Deliberately leave the ranges as open coded literals, as using macros to define the ranges actually introduces more potential failure points, since both the definitions and the usage have to be careful to use the correct index. The lack of clear intent behind the ranges will be addressed in future patches. No functional change intended. Link: https://lore.kernel.org/r/20250610225737.156318-10-seanjc@google.com Signed-off-by: Sean Christopherson commit 925149b6d054046cc0b61e89596245f58e884575 Author: Sean Christopherson Date: Tue Jun 10 15:57:13 2025 -0700 KVM: SVM: Massage name and param of helper that merges vmcb01 and vmcb12 MSRPMs Rename nested_svm_vmrun_msrpm() to nested_svm_merge_msrpm() to better capture its role, and opportunistically feed it @vcpu instead of @svm, as grabbing "svm" only to turn around and grab svm->vcpu is rather silly. No functional change intended. Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250610225737.156318-9-seanjc@google.com Signed-off-by: Sean Christopherson commit b1bccf78839080a93898342cf1a613c38e871f75 Author: Sean Christopherson Date: Tue Jun 10 15:57:12 2025 -0700 KVM: x86: Use non-atomic bit ops to manipulate "shadow" MSR intercepts Manipulate the MSR bitmaps using non-atomic bit ops APIs (two underscores), as the bitmaps are per-vCPU and are only ever accessed while vcpu->mutex is held. Reviewed-by: Binbin Wu Link: https://lore.kernel.org/r/20250610225737.156318-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 6353cd685c69f2b3e9a2833f6ff03a8f94c14c0a Author: Sean Christopherson Date: Tue Jun 10 15:57:11 2025 -0700 KVM: SVM: Kill the VM instead of the host if MSR interception is buggy WARN and kill the VM instead of panicking the host if KVM attempts to set or query MSR interception for an unsupported MSR. Accessing the MSR interception bitmaps only meaningfully affects post-VMRUN behavior, and KVM_BUG_ON() is guaranteed to prevent the current vCPU from doing VMRUN, i.e. there is no need to panic the entire host. Opportunistically move the sanity checks about their use to index into the MSRPM, e.g. so that bugs only WARN and terminate the VM, as opposed to doing that _and_ generating an out-of-bounds load. Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250610225737.156318-7-seanjc@google.com Signed-off-by: Sean Christopherson commit b241c50c4e30877a7b9dcf2517762748d86e5d47 Author: Sean Christopherson Date: Tue Jun 10 15:57:10 2025 -0700 KVM: SVM: Use ARRAY_SIZE() to iterate over direct_access_msrs Drop the unnecessary and dangerous value-terminated behavior of direct_access_msrs, and simply iterate over the actual size of the array. The use in svm_set_x2apic_msr_interception() is especially sketchy, as it relies on unused capacity being zero-initialized, and '0' being outside the range of x2APIC MSRs. To ensure the array and shadow_msr_intercept stay synchronized, simply assert that their sizes are identical (note the six 64-bit-only MSRs). Note, direct_access_msrs will soon be removed entirely; keeping the assert synchronized with the array isn't expected to be along-term maintenance burden. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250610225737.156318-6-seanjc@google.com Signed-off-by: Sean Christopherson commit f886515f9ba23a4cc65e1bc7afeb5177e92c8936 Author: Sean Christopherson Date: Tue Jun 10 15:57:09 2025 -0700 KVM: SVM: Tag MSR bitmap initialization helpers with __init Tag init_msrpm_offsets() and add_msr_offset() with __init, as they're used only during hardware setup to map potential passthrough MSRs to offsets in the bitmap. Reviewed-by: Chao Gao Link: https://lore.kernel.org/r/20250610225737.156318-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 5ebd73730832d56dac9355707cab6f4cc5601396 Author: Sean Christopherson Date: Tue Jun 10 15:57:08 2025 -0700 KVM: SVM: Don't BUG if setting up the MSR intercept bitmaps fails WARN and reject module loading if there is a problem with KVM's MSR interception bitmaps. Panicking the host in this situation is inexcusable since it is trivially easy to propagate the error up the stack. Link: https://lore.kernel.org/r/20250610225737.156318-4-seanjc@google.com Signed-off-by: Sean Christopherson commit fb96d5cf0fdaacd2165797982502d5b157f8bcf5 Author: Sean Christopherson Date: Tue Jun 10 15:57:07 2025 -0700 KVM: SVM: Allocate IOPM pages after initial setup in svm_hardware_setup() Allocate pages for the IOPM after initial setup has been completed in svm_hardware_setup(), so that sanity checks can be added in the setup flow without needing to free the IOPM pages. The IOPM is only referenced (via iopm_base) in init_vmcb() and svm_hardware_unsetup(), so there's no need to allocate it early on. No functional change intended (beyond the obvious ordering differences, e.g. if the allocation fails). Link: https://lore.kernel.org/r/20250610225737.156318-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 674ffc65035119be0ea2664684d1e8d004409ae1 Author: Sean Christopherson Date: Tue Jun 10 15:57:06 2025 -0700 KVM: SVM: Disable interception of SPEC_CTRL iff the MSR exists for the guest Disable interception of SPEC_CTRL when the CPU virtualizes (i.e. context switches) SPEC_CTRL if and only if the MSR exists according to the vCPU's CPUID model. Letting the guest access SPEC_CTRL is generally benign, but the guest would see inconsistent behavior if KVM happened to emulate an access to the MSR. Fixes: d00b99c514b3 ("KVM: SVM: Add support for Virtual SPEC_CTRL") Reported-by: Chao Gao Link: https://lore.kernel.org/r/20250610225737.156318-2-seanjc@google.com Signed-off-by: Sean Christopherson commit 6b1dd26544d045f6a79e8c73572c0c0db3ef3c1a Author: Maxim Levitsky Date: Tue Jun 10 16:20:10 2025 -0700 KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest Set/clear DEBUGCTLMSR_FREEZE_IN_SMM in GUEST_IA32_DEBUGCTL based on the host's pre-VM-Enter value, i.e. preserve the host's FREEZE_IN_SMM setting while running the guest. When running with the "default treatment of SMIs" in effect (the only mode KVM supports), SMIs do not generate a VM-Exit that is visible to host (non-SMM) software, and instead transitions directly from VMX non-root to SMM. And critically, DEBUGCTL isn't context switched by hardware on SMI or RSM, i.e. SMM will run with whatever value was resident in hardware at the time of the SMI. Failure to preserve FREEZE_IN_SMM results in the PMU unexpectedly counting events while the CPU is executing in SMM, which can pollute profiling and potentially leak information into the guest. Check for changes in FREEZE_IN_SMM prior to every entry into KVM's inner run loop, as the bit can be toggled in IRQ context via IPI callback (SMP function call), by way of /sys/devices/cpu/freeze_on_smi. Add a field in kvm_x86_ops to communicate which DEBUGCTL bits need to be preserved, as FREEZE_IN_SMM is only supported and defined for Intel CPUs, i.e. explicitly checking FREEZE_IN_SMM in common x86 is at best weird, and at worst could lead to undesirable behavior in the future if AMD CPUs ever happened to pick up a collision with the bit. Exempt TDX vCPUs, i.e. protected guests, from the check, as the TDX Module owns and controls GUEST_IA32_DEBUGCTL. WARN in SVM if KVM_RUN_LOAD_DEBUGCTL is set, mostly to document that the lack of handling isn't a KVM bug (TDX already WARNs on any run_flag). Lastly, explicitly reload GUEST_IA32_DEBUGCTL on a VM-Fail that is missed by KVM but detected by hardware, i.e. in nested_vmx_restore_host_state(). Doing so avoids the need to track host_debugctl on a per-VMCS basis, as GUEST_IA32_DEBUGCTL is unconditionally written by prepare_vmcs02() and load_vmcs12_host_state(). For the VM-Fail case, even though KVM won't have actually entered the guest, vcpu_enter_guest() will have run with vmcs02 active and thus could result in vmcs01 being run with a stale value. Cc: stable@vger.kernel.org Signed-off-by: Maxim Levitsky Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250610232010.162191-9-seanjc@google.com Signed-off-by: Sean Christopherson commit 7d0cce6cbe71af6e9c1831bff101a2b9c249c4a2 Author: Maxim Levitsky Date: Tue Jun 10 16:20:09 2025 -0700 KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs Introduce vmx_guest_debugctl_{read,write}() to handle all accesses to vmcs.GUEST_IA32_DEBUGCTL. This will allow stuffing FREEZE_IN_SMM into GUEST_IA32_DEBUGCTL based on the host setting without bleeding the state into the guest, and without needing to copy+paste the FREEZE_IN_SMM logic into every patch that accesses GUEST_IA32_DEBUGCTL. No functional change intended. Cc: stable@vger.kernel.org Signed-off-by: Maxim Levitsky [sean: massage changelog, make inline, use in all prepare_vmcs02() cases] Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250610232010.162191-8-seanjc@google.com Signed-off-by: Sean Christopherson commit 095686e6fcb4150f0a55b1a25987fad3d8af58d6 Author: Maxim Levitsky Date: Tue Jun 10 16:20:08 2025 -0700 KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter Add a consistency check for L2's guest_ia32_debugctl, as KVM only supports a subset of hardware functionality, i.e. KVM can't rely on hardware to detect illegal/unsupported values. Failure to check the vmcs12 value would allow the guest to load any harware-supported value while running L2. Take care to exempt BTF and LBR from the validity check in order to match KVM's behavior for writes via WRMSR, but without clobbering vmcs12. Even if VM_EXIT_SAVE_DEBUG_CONTROLS is set in vmcs12, L1 can reasonably expect that vmcs12->guest_ia32_debugctl will not be modified if writes to the MSR are being intercepted. Arguably, KVM _should_ update vmcs12 if VM_EXIT_SAVE_DEBUG_CONTROLS is set *and* writes to MSR_IA32_DEBUGCTLMSR are not being intercepted by L1, but that would incur non-trivial complexity and wouldn't change the fact that KVM's handling of DEBUGCTL is blatantly broken. I.e. the extra complexity is not worth carrying. Cc: stable@vger.kernel.org Signed-off-by: Maxim Levitsky Co-developed-by: Sean Christopherson Link: https://lore.kernel.org/r/20250610232010.162191-7-seanjc@google.com Signed-off-by: Sean Christopherson commit 8a4351ac302cd8c19729ba2636acfd0467c22ae8 Author: Sean Christopherson Date: Tue Jun 10 16:20:07 2025 -0700 KVM: VMX: Extract checking of guest's DEBUGCTL into helper Move VMX's logic to check DEBUGCTL values into a standalone helper so that the code can be used by nested VM-Enter to apply the same logic to the value being loaded from vmcs12. KVM needs to explicitly check vmcs12->guest_ia32_debugctl on nested VM-Enter, as hardware may support features that KVM does not, i.e. relying on hardware to detect invalid guest state will result in false negatives. Unfortunately, that means applying KVM's funky suppression of BTF and LBR to vmcs12 so as not to break existing guests. No functional change intended. Reviewed-by: Dapeng Mi Link: https://lore.kernel.org/r/20250610232010.162191-6-seanjc@google.com Signed-off-by: Sean Christopherson commit 17ec2f965344ee3fd6620bef7ef68792f4ac3af0 Author: Sean Christopherson Date: Tue Jun 10 16:20:06 2025 -0700 KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported Let the guest set DEBUGCTL.RTM_DEBUG if RTM is supported according to the guest CPUID model, as debug support is supposed to be available if RTM is supported, and there are no known downsides to letting the guest debug RTM aborts. Note, there are no known bug reports related to RTM_DEBUG, the primary motivation is to reduce the probability of breaking existing guests when a future change adds a missing consistency check on vmcs12.GUEST_DEBUGCTL (KVM currently lets L2 run with whatever hardware supports; whoops). Note #2, KVM already emulates DR6.RTM, and doesn't restrict access to DR7.RTM. Fixes: 83c529151ab0 ("KVM: x86: expose Intel cpu new features (HLE, RTM) to guest") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250610232010.162191-5-seanjc@google.com Signed-off-by: Sean Christopherson commit 80c64c7afea1da6a93ebe88d3d29d8a60377ef80 Author: Sean Christopherson Date: Tue Jun 10 16:20:05 2025 -0700 KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag Instruct vendor code to load the guest's DR6 into hardware via a new KVM_RUN flag, and remove kvm_x86_ops.set_dr6(), whose sole purpose was to load vcpu->arch.dr6 into hardware when DR6 can be read/written directly by the guest. Note, TDX already WARNs on any run_flag being set, i.e. will yell if KVM thinks DR6 needs to be reloaded. TDX vCPUs force KVM_DEBUGREG_AUTO_SWITCH and never clear the flag, i.e. should never observe KVM_RUN_LOAD_GUEST_DR6. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250610232010.162191-4-seanjc@google.com Signed-off-by: Sean Christopherson commit 2478b1b220c49d25cb1c3f061ec4f9b351d9a131 Author: Sean Christopherson Date: Tue Jun 10 16:20:04 2025 -0700 KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap Convert kvm_x86_ops.vcpu_run()'s "force_immediate_exit" boolean parameter into an a generic bitmap so that similar "take action" information can be passed to vendor code without creating a pile of boolean parameters. This will allow dropping kvm_x86_ops.set_dr6() in favor of a new flag, and will also allow for adding similar functionality for re-loading debugctl in the active VMCS. Opportunistically massage the TDX WARN and comment to prepare for adding more run_flags, all of which are expected to be mutually exclusive with TDX, i.e. should be WARNed on. No functional change intended. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250610232010.162191-3-seanjc@google.com Signed-off-by: Sean Christopherson commit 7d390a9da8233fd32ccdf132726712a72a990b26 Author: Sean Christopherson Date: Tue Jun 10 16:20:03 2025 -0700 KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL Use the kvm_arch_vcpu.host_debugctl snapshot to restore DEBUGCTL after running a TD vCPU. The final TDX series rebase was mishandled, likely due to commit fb71c7959356 ("KVM: x86: Snapshot the host's DEBUGCTL in common x86") deleting the same line of code from vmx.h, i.e. creating a semantic conflict of sorts, but no syntactic conflict. Using the version in kvm_vcpu_arch picks up the ulong => u64 fix (which isn't relevant to TDX) as well as the IRQ fix from commit 189ecdb3e112 ("KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs"). Link: https://lore.kernel.org/all/20250307212053.2948340-10-pbonzini@redhat.com Cc: Adrian Hunter Fixes: 8af099037527 ("KVM: TDX: Save and restore IA32_DEBUGCTL") Reviewed-by: Adrian Hunter Link: https://lore.kernel.org/r/20250610232010.162191-2-seanjc@google.com Signed-off-by: Sean Christopherson commit ce3d5af2a92bd6cd775ce819f5e83857e8a277fb Author: Kotaro, Tokai Date: Wed Jun 18 15:35:42 2025 +0900 perf vendor events arm64: Update FUJITSU-MONAKA pmu event Update pmu events for FUJITSU-MONAKA. And, also updated common-and-microarch.json. FUJITSU-MONAKA PMU Events Specification v1.1 and Errata v1.0 URL: https://github.com/fujitsu/FUJITSU-MONAKA Arm Architecture Reference Version L.b URL: https://developer.arm.com/documentation/ddi0487/lb/?lang=en Signed-off-by: Kotaro, Tokai Reviewed-by: James Clark Link: https://lore.kernel.org/r/20250618063618.1244363-1-fj0635gf@aa.jp.fujitsu.com Signed-off-by: Namhyung Kim commit 3972872e459d812ab5e481a231a6066cf4f4d0f4 Author: sanirban Date: Thu Jun 19 19:04:14 2025 +0530 drm/xe/ptl: Apply Wa_16026007364 As part of this WA GuC will save and restore value of two XE3_Media control registers that were not included in the HW power context. v2: - Update klv name (Badal) Signed-off-by: sanirban Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250619133413.107423-2-sk.anirban@intel.com Signed-off-by: Rodrigo Vivi commit 99fe8af069a9fa5b09140518b1364e35713a642e Author: Yuan Chen Date: Fri Jun 20 09:21:33 2025 +0800 bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure In function dump_xx_nlmsg(), when realloc() fails to allocate memory, the original pointer to the buffer is overwritten with NULL. This causes a memory leak because the previously allocated buffer becomes unreachable without being freed. Fixes: 7900efc19214 ("tools/bpf: bpftool: improve output format for bpftool net") Signed-off-by: Yuan Chen Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/r/20250620012133.14819-1-chenyuan_fl@163.com Signed-off-by: Alexei Starovoitov commit f8b19aeca1652fcadefce8529cd85e5fd475dd69 Author: Slava Imameev Date: Sat Jun 21 01:18:12 2025 +1000 selftests/bpf: Add test for bpftool access to read-only protected maps Add selftest cases that validate bpftool's expected behavior when accessing maps protected from modification via security_bpf_map. The test includes a BPF program attached to security_bpf_map with two maps: - A protected map that only allows read-only access - An unprotected map that allows full access The test script attaches the BPF program to security_bpf_map and verifies that for the bpftool map command: - Read access works on both maps - Write access fails on the protected map - Write access succeeds on the unprotected map - These behaviors remain consistent when the maps are pinned Signed-off-by: Slava Imameev Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/r/20250620151812.13952-2-slava.imameev@crowdstrike.com Signed-off-by: Alexei Starovoitov commit d32179e8c2583f1613f7bc9710612091c3c038d8 Author: Slava Imameev Date: Sat Jun 21 01:18:11 2025 +1000 bpftool: Use appropriate permissions for map access Modify several functions in tools/bpf/bpftool/common.c to allow specification of requested access for file descriptors, such as read-only access. Update bpftool to request only read access for maps when write access is not required. This fixes errors when reading from maps that are protected from modification via security_bpf_map. Signed-off-by: Slava Imameev Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/r/20250620151812.13952-1-slava.imameev@crowdstrike.com Signed-off-by: Alexei Starovoitov commit ce2c403c26c1ed0e28fc541ab30fe13ff50236be Author: Alexander Shishkin Date: Fri Jun 20 16:53:12 2025 +0300 x86/efi: Move runtime service initialization to arch/x86 The EFI call in start_kernel() is guarded by #ifdef CONFIG_X86. Move the thing to the arch_cpu_finalize_init() path on x86 and get rid of the #ifdef in start_kernel(). No functional change intended. Suggested-by: Kirill A. Shutemov Signed-off-by: Alexander Shishkin Signed-off-by: Kirill A. Shutemov Signed-off-by: Dave Hansen Reviewed-by: Sohil Mehta Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/all/20250620135325.3300848-5-kirill.shutemov%40linux.intel.com commit 3828a643e808b8f2a90f8ba08f68ad3138b1026e Author: Louis-Alexis Eyraud Date: Fri May 9 12:12:51 2025 +0200 arm64: dts: mediatek: mt8370: Enable gpu support Add a new gpu node in mt8370.dtsi to enable support for the ARM Mali G57 MC2 GPU (Valhall-JM) found on the MT8370 SoC, using the Panfrost driver. On a Mediatek Genio 510 EVK board, the panfrost driver probed with the following message: ``` panfrost 13000000.gpu: clock rate = 390000000 panfrost 13000000.gpu: mali-g57 id 0x9093 major 0x0 minor 0x0 status 0x0 panfrost 13000000.gpu: features: 00000000,000019f7, issues: 00000003, 80000400 panfrost 13000000.gpu: Features: L2:0x08130206 Shader:0x00000000 Tiler:0x00000809 Mem:0x1 MMU:0x00002830 AS:0xff JS:0x7 panfrost 13000000.gpu: shader_present=0x5 l2_present=0x1 [drm] Initialized panfrost 1.3.0 for 13000000.gpu on minor 0 ``` Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Louis-Alexis Eyraud Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250509-mt8370-enable-gpu-v6-5-2833888cb1d3@collabora.com commit 81645377c231803389ab0f2d09df6622e32dd327 Author: Louis-Alexis Eyraud Date: Fri May 9 12:12:50 2025 +0200 drm/panfrost: Add support for Mali on the MT8370 SoC Add a compatible for the MediaTek MT8370 SoC, with an integrated ARM Mali G57 MC2 GPU (Valhall-JM, dual core), with new platform data for its support in the panfrost driver. It uses the same data as MT8186 for the power management features to describe power supplies, pm_domains and enablement (one regulator, two power domains) but also sets the FORCE_AARCH64_PGTABLE flag in the GPU configuration quirks bitfield to enable AARCH64 4K page table format mode. As MT8186 and MT8370 SoC have different GPU architecture (Mali G52 2EE MC2 for MT8186), making them not compatible, and this mode is only enabled for Mediatek SoC that are Mali G57 based (compatible with mediatek,mali-mt8188 or mediatek,mali-8192), having specific platform data allows to set this flag for MT8370 without modifying MT8186 configuration and behaviour. Reviewed-by: Steven Price Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Louis-Alexis Eyraud Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250509-mt8370-enable-gpu-v6-4-2833888cb1d3@collabora.com commit bd77b870eb190c9cf5d9b7208625513e99e5be2d Author: Louis-Alexis Eyraud Date: Fri May 9 12:12:49 2025 +0200 drm/panfrost: Commonize Mediatek power domain array definitions In the panfrost driver, the platform data of several Mediatek SoC declares and uses several different power domains arrays according to GPU core number present in the SoC: - mediatek_mt8186_pm_domains (2 cores) - mediatek_mt8183_pm_domains (3 cores) - mediatek_mt8192_pm_domains (5 cores) As they all are fixed arrays, starting with the same entries and the platform data also has a power domains array length field (num_pm_domains), they can be replaced by a single array, containing all entries, if the num_pm_domains field of the platform data is also set to the matching core number. So, create a generic power domain array (mediatek_pm_domains) and use it in the mt8183(b), mt8186, mt8188 and mt8192 platform data instead. Signed-off-by: Louis-Alexis Eyraud Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250509-mt8370-enable-gpu-v6-3-2833888cb1d3@collabora.com commit 6905b0d9813176087fc0f28bc5e4ee2b86e6ce13 Author: Louis-Alexis Eyraud Date: Fri May 9 12:12:48 2025 +0200 drm/panfrost: Drop duplicated Mediatek supplies arrays In the panfrost driver, the platform data of several Mediatek SoC declares and uses custom supplies array definitions (mediatek_mt8192_supplies, mediatek_mt8183_b_supplies), that are the same as default_supplies (used by default platform data). So drop these duplicated definitions and use default_supplies instead. Also, rename mediatek_mt8183_supplies to a more generic name too (legacy_supplies). Signed-off-by: Louis-Alexis Eyraud Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250509-mt8370-enable-gpu-v6-2-2833888cb1d3@collabora.com commit ea024e6e7a64f7f9a12bfaace61105006ba863e5 Author: Louis-Alexis Eyraud Date: Fri May 9 12:12:47 2025 +0200 dt-bindings: gpu: mali-bifrost: Add compatible for MT8370 SoC Add a compatible for the MediaTek MT8370 SoC, with an integrated ARM Mali G57 MC2 GPU (Valhall-JM, dual core). None of the already existing SoC specific compatibles is usable as fallback, as those either do not match the number of cores (and number of power domains), or are for a different GPU architecture. Reviewed-by: AngeloGioacchino Del Regno Acked-by: Conor Dooley Signed-off-by: Louis-Alexis Eyraud Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250509-mt8370-enable-gpu-v6-1-2833888cb1d3@collabora.com commit 4051ead99888f101be92c7ce90d2de09aac6fd1c Author: Li Chen Date: Fri Jun 20 20:02:31 2025 +0800 HID: rate-limit hid_warn to prevent log flooding Syzkaller can create many uhid devices that trigger repeated warnings like: "hid-generic xxxx: unknown main item tag 0x0" These messages can flood the system log, especially if a crash occurs (e.g., with a slow UART console, leading to soft lockups). To mitigate this, convert `hid_warn()` to use `dev_warn_ratelimited()`. This helps reduce log noise and improves system stability under fuzzing or faulty device scenarios. Signed-off-by: Li Chen Signed-off-by: Jiri Kosina commit 805f13e403cd43bb88790642feef507108af6fc7 Author: Song Liu Date: Wed May 21 12:10:00 2025 +0100 arm64: stacktrace: Implement arch_stack_walk_reliable() Add arch_stack_walk_reliable(), which will be used during kernel live patching to detect when threads have completed executing old versions of functions. Note that arch_stack_walk_reliable() only needs to guarantee that it returns an error code when it cannot provide a reliable stacktrace. It is not required to provide a reliable stacktrace in all scenarios so long as it returns said error code. At present we can only reliably unwind up to an exception boundary. In future we should be able to improve this with additional data from the compiler (e.g. sframe). Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20250320171559.3423224-2-song@kernel.org [ Mark: Simplify logic, clarify commit message ] Signed-off-by: Mark Rutland Cc: Andrea della Porta Cc: Breno Leitao Cc: Josh Poimboeuf Cc: Miroslav Benes Cc: Petr Mladek Cc: Song Liu Cc: Will Deacon Link: https://lore.kernel.org/r/20250521111000.2237470-3-mark.rutland@arm.com Signed-off-by: Catalin Marinas commit beecfd6a88a675e20987e70ec532ba734b230fa4 Author: Mark Rutland Date: Wed May 21 12:09:59 2025 +0100 arm64: stacktrace: Check kretprobe_find_ret_addr() return value If kretprobe_find_ret_addr() fails to find the original return address, it returns 0. Check for this case so that a reliable stacktrace won't silently ignore it. Signed-off-by: Mark Rutland Cc: Andrea della Porta Cc: Breno Leitao Cc: Josh Poimboeuf Cc: Miroslav Benes Cc: Petr Mladek Cc: Song Liu Cc: Will Deacon Reviewed-and-tested-by: Song Liu Link: https://lore.kernel.org/r/20250521111000.2237470-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas commit 91b89a634487d5614e51ee773a889ed57f5551ca Author: Dylan Hatch Date: Tue Jun 3 22:34:17 2025 +0000 arm64/module: Use text-poke API for late relocations. To enable late module patching, livepatch modules need to be able to apply some of their relocations well after being loaded. In this scenario however, the livepatch module text and data is already RX-only, so special treatment is needed to make the late relocations possible. To do this, use the text-poking API for these late relocations. This patch is partially based off commit 88fc078a7a8f6 ("x86/module: Use text_poke() for late relocations"). Signed-off-by: Dylan Hatch Acked-by: Song Liu Acked-by: Will Deacon Link: https://lore.kernel.org/r/20250603223417.3700218-1-dylanbhatch@google.com Signed-off-by: Catalin Marinas commit 803b9eabc649c778986449eb0596e5ffeb7a8aed Author: James Cowgill Date: Wed Jun 4 14:38:48 2025 +0000 media: v4l2-ctrls: Fix H264 SEPARATE_COLOUR_PLANE check The `separate_colour_plane_flag` element is only present in the SPS if `chroma_format_idc == 3`, so the corresponding flag should be disabled whenever that is not the case and not just on profiles where `chroma_format_idc` is not present. Fixes: b32e48503df0 ("media: controls: Validate H264 stateless controls") Signed-off-by: James Cowgill Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 401fb1955f915694808e77471cd1014d4fa2683e Author: Frank Li Date: Wed May 21 13:34:03 2025 -0400 media: dt-bindings: nxp,imx8-jpeg: Add compatible strings for IMX95 JPEG Add compatible strings "nxp,imx95-jpgdec" and "nxp,imx95-jpgenc", which are backward compatible with "nxp,imx8qxp-jpgdec" and "nxp,imx8qxp-jpegenc". i.MX95 just need one power domain which combine wrap and all slots together. Reduce minItems of power-domains to 1 for i.MX95 and keep the same restriction for others. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Frank Li Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 70c37d403e7eba64d3eaadb8549d8f483912b6d1 Author: Christophe JAILLET Date: Sun May 25 10:11:44 2025 +0200 media: verisilicon: Use __set_bit() with local bitmaps The 'used' and 'new' bitmaps are local to this function, so there is no need to use atomic access because concurrency can not happen. Use the non-atomic __set_bit() to save a few cycles. Signed-off-by: Christophe JAILLET Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit fc5f8aec77704373ee804b5dba0e0e5029c0f180 Author: Haoxiang Li Date: Thu Feb 27 15:44:51 2025 +0800 media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() Add video_device_release() in label 'err_m2m' to release the memory allocated by video_device_alloc() and prevent potential memory leaks. Remove the reduntant code in label 'err_m2m'. Fixes: a8ef0488cc59 ("media: imx: add csc/scaler mem2mem device") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Dan Carpenter Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit ff8c5622f9f7c644e995d013af320b59e4d61b93 Author: Nicolas Dufresne Date: Thu May 8 17:00:15 2025 -0400 media: rkvdec: Restore iommu addresses on errors On errors, the rkvdec chip self resets. This can clear the addresses programmed in the iommu. This case is signaled by the RKVDEC_SOFTRESET_RDY status bit. Since the iommu framework does not have a restore functionality, and as recommended by the iommu subsystem maintainers, this patch restores the iommu programming by attaching and detaching an empty domain, which will clear and restore the default domain. Suggested-by: Detlev Casanova Tested-by: Detlev Casanova Reviewed-by: Detlev Casanova Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 01350185fe02ae3ea2c12d578e06af0d5186f33e Author: Nicolas Dufresne Date: Mon Feb 17 16:46:54 2025 -0500 media: verisilicon: Fix AV1 decoder clock frequency The desired clock frequency was correctly set to 400MHz in the device tree but was lowered by the driver to 300MHz breaking 4K 60Hz content playback. Fix the issue by removing the driver call to clk_set_rate(), which reduce the amount of board specific code. Fixes: 003afda97c65 ("media: verisilicon: Enable AV1 decoder on rk3588") Cc: stable@vger.kernel.org Reviewed-by: Benjamin Gaignard Reviewed-by: Philipp Zabel Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 193cd0fd5a6055b88a3b2860c43a647362f9e7c4 Author: Jernej Skrabec Date: Fri May 23 17:43:59 2025 +0200 media: cedrus: Add support for additional output formats If VPU supports untiled output, it actually supports several different YUV 4:2:0 layouts, namely NV12, NV21, YUV420 and YVU420. Add support for all of them. Signed-off-by: Jernej Skrabec Reviewed-by: Paul Kocialkowski Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil [hverkuil: add 'default' case to switch to fix warning with old compiler] commit 3421d46440ebe0865bec71dbd2330b4e17a425ab Author: Charles Keepax Date: Mon Jun 16 19:49:07 2025 +0800 HID: core: Add bus define for SoundWire bus SDCA (SoundWire Device Class for Audio) uses HID to convey input events from peripheral devices. Add a bus define for the SoundWire bus to prepare support for this. Signed-off-by: Charles Keepax Signed-off-by: Shuming Fan Acked-by: Jiri Kosina Link: https://patch.msgid.link/20250616114907.855452-1-shumingf@realtek.com Signed-off-by: Mark Brown commit 13ef21dffe7691a32c83a83d697d119c045536eb Author: Shuming Fan Date: Mon Jun 16 19:48:20 2025 +0800 ASoC: SDCA: add support for HIDE entity properties and HID descriptor/report Add support for parsing the HIDE entity descriptor and HID descriptor/report Signed-off-by: Shuming Fan Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20250616114820.855401-1-shumingf@realtek.com Signed-off-by: Mark Brown commit b245bd0eb43f8f12353d9a61228eb4a61eff267b Author: Frank Li Date: Fri Apr 11 17:36:00 2025 -0400 dt-bindings: media: convert fsl-vdoa.txt to yaml format Convert fsl-vdoa.txt to yaml format. Additional changes: - Add irq.h and imx6qdl-clock.h in example. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 51ad3b570ea7b1916ff4db993f1aa22bb48fdac6 Author: Ming Qian Date: Wed May 21 09:54:07 2025 +0800 media: imx-jpeg: Account for data_offset when getting image address Applications may set data_offset when it refers to an output queue. So driver need to account for it when getting the start address of input image in the plane. Meanwhile the mxc-jpeg codec requires the address (plane address + data_offset) to be 16-aligned. Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder") Signed-off-by: Ming Qian Reviewed-by: Frank Li Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit ba4452b0c0a3191617764d3453f45ea48ed544c9 Author: Ming Qian Date: Mon May 12 10:01:36 2025 +0800 media: amphion: Add H264 and HEVC profile and level control For format H264 and HEVC, the firmware can report the parsed profile idc and level idc to driver, these information may be useful. Implement the H264 and HEVC profile and level control to report them. Signed-off-by: Ming Qian Signed-off-by: Nicolas Dufresne Signed-off-by: Hans Verkuil commit 99680fd394b912bf133b5b1e45aced1b7aea1d2e Author: Quentin Schulz Date: Tue Jun 10 18:22:18 2025 +0200 arm64: dts: rockchip: support camera module on Haikou Video Demo on PX30 Ringneck The Haikou Video Demo adapter has a proprietary connector for a camera module which has an OV5675 camera sensor and a companion DW9714 focus lens driver. This adds support for the camera module on PX30 Ringneck module fitted on a Haikou devkit with the Haikou Video Demo adapter. Signed-off-by: Quentin Schulz Link: https://lore.kernel.org/r/20250610-ringneck-haikou-video-demo-cam-v2-3-de1bf87e0732@cherry.de Signed-off-by: Heiko Stuebner commit 9ad8e83d8abd083c701e75d7fe664c706daf6d56 Author: Quentin Schulz Date: Tue Jun 10 18:22:17 2025 +0200 arm64: dts: rockchip: add label to first port of ISP on px30 This will make it slightly easier for Device Trees (and Overlays) to link the ISP controller to a video input such as a CSI camera while also bringing it closer to what's been done already for the DSI controller. Suggested-by: Heiko Stuebner Signed-off-by: Quentin Schulz Link: https://lore.kernel.org/r/20250610-ringneck-haikou-video-demo-cam-v2-2-de1bf87e0732@cherry.de Signed-off-by: Heiko Stuebner commit 5ddb2d46852997a28f8d77153e225611a8268b74 Author: Quentin Schulz Date: Tue Jun 10 18:22:16 2025 +0200 arm64: dts: rockchip: fix endpoint dtc warning for PX30 ISP dtc complains with the following message for DTSes which use the ISP: arch/arm64/boot/dts/rockchip/px30.dtsi:1272.19-1276.6: Warning (graph_child_address): /isp@ff4a0000/ports/port@0: graph node has single child node 'endpoint@0', #address-cells/#size-cells are not necessary Typically, it is expected from the device DTS(I) to update the SoC DTSI nodes if they have more than one endpoint, so let's assume there's only one endpoint in port@0 by default, instead of forcing board DTS(I)s to /delete-property/ address-cells and size-cells to make dtc happy. Because PX30 PP1516/EVB's endpoint@0 is the only endpoint and considering its parent node now has no address-cells property, dtc complains (same messages for PX30 EVB): arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi:447.29-451.6: Warning (avoid_default_addr_size): /isp@ff4a0000/ports/port@0/endpoint@0: Relying on default #address-cells value arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi:447.29-451.6: Warning (avoid_default_addr_size): /isp@ff4a0000/ports/port@0/endpoint@0: Relying on default #size-cells value arch/arm64/boot/dts/rockchip/px30-pp1516-ltk050h3146w-a2.dtb: Warning (avoid_unnecessary_addr_size): Failed prerequisite 'avoid_default_addr_size' arch/arm64/boot/dts/rockchip/px30-pp1516-ltk050h3146w-a2.dtb: Warning (unique_unit_address_if_enabled): Failed prerequisite 'avoid_default_addr_size' arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi:447.29-451.6: Warning (graph_endpoint): /isp@ff4a0000/ports/port@0/endpoint@0: graph node '#address-cells' is -1, must be 1 arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi:447.29-451.6: Warning (graph_endpoint): /isp@ff4a0000/ports/port@0/endpoint@0: graph node '#size-cells' is -1, must be 0 arch/arm64/boot/dts/rockchip/px30-pp1516-ltk050h3146w-a2.dtb: Warning (graph_child_address): Failed prerequisite 'graph_endpoint' so we fix that by removing the reg property. dtc still complains (same messages for PX30 EVB): arch/arm64/boot/dts/rockchip/px30-pp1516.dtsi:447.29-450.6: Warning (unit_address_vs_reg): /isp@ff4a0000/ports/port@0/endpoint@0: node has a unit name, but no reg or ranges property so we also remove the @0 suffix off the node name. Fixes: 8df7b4537dfb ("arm64: dts: rockchip: add isp node for px30") Fixes: 474a77395be2 ("arm64: dts: rockchip: hook up camera on px30-evb") Fixes: 56198acdbf0d ("arm64: dts: rockchip: add px30-pp1516 base dtsi and board variants") Signed-off-by: Quentin Schulz Link: https://lore.kernel.org/r/20250610-ringneck-haikou-video-demo-cam-v2-1-de1bf87e0732@cherry.de Signed-off-by: Heiko Stuebner commit f186a1a985d349f59ab67af36dfacd2f28d2540a Merge: 07651feeeefbc6 2756b7f08ff6ca Author: Mark Brown Date: Fri Jun 20 11:33:05 2025 +0100 ASoC: SOF: ipc4-pcm: Harmonize set pipeline state dbg Merge series from Peter Ujfalusi : The series harmonizes the debug prints for pipeline state changes. Currently we only print readable state change for single pipeline changes but when multiple pipeline's state is changed, it is omitted. Use human readable information in both cases in a harmonized way to aid debugging. commit 07651feeeefbc65e6dae4fbb6fc8d8c785bea574 Merge: 820e04cb8cae49 ace9b3daf2b477 Author: Mark Brown Date: Fri Jun 20 11:33:01 2025 +0100 ASoC: SOF: ipc4/Intel: Support for partial context Merge series from Peter Ujfalusi : The firmware will be able to only save and restore the context related to library management. This means that even without a full context save, the libraries do not need to be re-loaded to the firmware after second or consecutive boots. This is reported via the FW_READY notification, where BIT(15) indicates: 0 - the library restore is not done 1 - library restore is done This bit is only valid if full context save is not enabled, full context save is by definition saves and restores the library related book-keeping as well. Add a new flag to tell the platform code if the libraries have been restored, no need to reload them after boot. commit 820e04cb8cae4904d670b5eca7feaeb07020debe Merge: a1d203d390e047 bb48117b79ebc3 Author: Mark Brown Date: Fri Jun 20 11:32:57 2025 +0100 ASoC: core/topology/Intel: Merge series from Peter Ujfalusi : There are devices where the iDisp HDA codec for HDMI is disconnected and it is not present on the HDA bus. This usually happens on systems with dGPU, but not limited to them. How SOF tried to deal with this is to drop in a dummy codec in place of the iDisp to allow the topology to be loaded, but these PCM devices are unusable, they fail when user tries to use them. PA/PW is probing the PCM devices on probe and that causes the kernel log to fill up with errors, which is harmless but disturbing. This series will use the filter function to prevent the creation of the HDMI PCM devices in the first place (like HDA legacy stack will not present HDMI devices if the codec is not visible). The topology still loads, we still use dummy codec to satisfy it, but there will be no dummy PCM devices created. The first two patch handles the same issue that was discovered by the ignored link: a NULL dereference. I'm not sure if both is needed, but I felt that fixing it in one place and leaving the other open might not be future proof. If I would to pick one, I would likely go with the patch for the soc-core. commit 757259db79fc6054780e07bb284f768b01cf8fa9 Author: Bartosz Golaszewski Date: Tue Jun 10 14:39:42 2025 +0200 ssb: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20250610-gpiochip-set-rv-ssb-v1-1-0bee5b45b411@linaro.org Signed-off-by: Johannes Berg commit 9410e28990e1b0d1df58ab4a03e08e77be163c1d Author: Colin Ian King Date: Thu Jun 19 09:25:54 2025 +0100 wifi: brcmfmac: Make read-only array cfg_offset static const Don't populate the read-only array cfg_offset on the stack at run time, instead make it static const. Signed-off-by: Colin Ian King Acked-by: Arend van Spriel Link: https://patch.msgid.link/20250619082554.1834654-1-colin.i.king@gmail.com Signed-off-by: Johannes Berg commit d39d462a397a2ae051cfb0f23380e1d1e001f17b Author: Yuesong Li Date: Fri Jun 13 18:26:24 2025 +0800 wifi: ipw2x00: convert to use secs_to_jiffies Since secs_to_jiffies()(commit:b35108a51cf7) has been introduced, we can use it to avoid scaling the time to msec. Signed-off-by: Yuesong Li Link: https://patch.msgid.link/20250613102624.3077418-1-liyuesong@vivo.com Signed-off-by: Johannes Berg commit 84ff903bcb7bb19e9ddfe04f1b5b9e42cfb17e45 Author: Yuesong Li Date: Thu Jun 12 10:14:44 2025 +0800 wifi: iwlegacy: convert to use secs_to_jiffies() Since secs_to_jiffies()(commit:b35108a51cf7) has been introduced, we can use it to avoid scaling the time to msec. Signed-off-by: Yuesong Li Acked-by: Stanislaw Gruszka Link: https://patch.msgid.link/20250612021446.3465972-1-liyuesong@vivo.com Signed-off-by: Johannes Berg commit 7c598c653ad465138ecc2fe64492633c541effef Author: Kavita Kavita Date: Wed Jun 4 16:27:57 2025 +0530 wifi: cfg80211: Add support for link reconfiguration negotiation offload to driver In the case of SME-in-driver, the driver can internally choose to update the links based on the AP MLD recommendation and do link reconfiguration negotiation with AP MLD. (e.g., After the driver processing the BSS Transition Management request frame received from the AP MLD with Neighbor Report containing Multi-Link element with recommended links information chooses to do link reconfiguration negotiation with AP MLD). To support this, extend cfg80211_mlo_reconf_add_done() and NL80211_CMD_ASSOC_MLO_RECONF to indicate added links information for driver-initiated link reconfiguration requests. For removed links, the driver indicates links information using the NL80211_CMD_LINKS_REMOVED event for driver-initiated cases, the same as supplicant initiated cases. For the driver-initiated case, cfg80211 will receive link reconfiguration result asynchronously from driver so holding BSSes of the accepted add links is needed in the event path. Also, no need of unhold call for the rejected add link BSSes since there was no hold call happened previously. Once the supplicant receives the NL80211_CMD_ASSOC_MLO_RECONF event, it needs to process the information about newly added links and install per-link group keys (e.g., GTK/IGTK/BIGTK etc.). In case of the SME-in-driver, using a vendor interface etc. to notify the supplicant to initiate a link reconfiguration request and then supplicant sending command to the cfg80211 can lead to race conditions. The correct design to avoid this is that the driver indicates the cfg80211 directly with the results of the link reconfiguration negotiation. Signed-off-by: Kavita Kavita Link: https://patch.msgid.link/20250604105757.2542-3-quic_kkavita@quicinc.com Signed-off-by: Johannes Berg commit 5ae1fc4069578f50798f3372f36a3c13ee565b66 Author: Kavita Kavita Date: Wed Jun 4 16:27:56 2025 +0530 wifi: cfg80211: Improve the documentation for NL80211_CMD_ASSOC_MLO_RECONF The existing documentation for the NL80211_CMD_ASSOC_MLO_RECONF does not clearly explain handling of link reconfiguration request results from the driver. Add documentation to explain that the command is used as an event to notify userspace about added links information, and that the existing NL80211_CMD_LINKS_REMOVED command is used to notify userspace about removed links information. Signed-off-by: Kavita Kavita Link: https://patch.msgid.link/20250604105757.2542-2-quic_kkavita@quicinc.com Signed-off-by: Johannes Berg commit 659e43fd37e8b00bd6c372e7c2a4e84ecf5ba174 Author: Rafael Beims Date: Fri May 30 06:47:04 2025 -0300 wifi: mwifiex: enable host mlme on sdio W8997 chipsets Enable the host MLME flag to allow supported W8997 chipsets to use WPA3. This feature requires firmware support (V2 API key), which the driver validates before activation. Tested using sdsd8997_combo_v4.bin from commit 211fbc287a0b ("linux-firmware: Update FW files for MRVL SD8997 chips") [ 5.956510] mwifiex_sdio mmc2:0001:1: info: FW download over, size 623352 bytes ... [ 6.825456] mwifiex_sdio mmc2:0001:1: WLAN FW is active ... [ 12.171950] mwifiex_sdio mmc2:0001:1: host_mlme: enable, key_api: 2 [ 12.226206] mwifiex_sdio mmc2:0001:1: info: MWIFIEX VERSION: mwifiex 1.0 (16.68.1.p197) root@verdin-imx8mm-14700070:~# strings /lib/firmware/mrvl/sdsd8997_combo_v4.bin |grep 16 $Id: w8997o-V4, RF878X, FP68_LINUX, 16.68.1.p197.1 $ Signed-off-by: Rafael Beims Reviewed-by: Francesco Dolcini Acked-by: Brian Norris Link: https://patch.msgid.link/20250530094711.915574-1-rafael@beims.me Signed-off-by: Johannes Berg commit 2eb7c1baf46aea134e908cd6d37907d92f823251 Author: Rameshkumar Sundaram Date: Fri May 30 09:39:40 2025 +0530 wifi: mac80211: Fix bssid_indicator for MBSSID in AP mode Currently, in ieee80211_assign_beacon() mbssid count is updated as link's bssid_indicator. mbssid count is the total number of MBSSID elements in the beacon instead of Max BSSID indicator of the Multiple BSS set. This will result in drivers obtaining an invalid bssid_indicator for BSSes in a Multiple BSS set. Fix this by updating link's bssid_indicator from MBSSID element for Transmitting BSS and update the same for all of its Non-Transmitting BSSes. Fixes: dde78aa52015 ("mac80211: update bssid_indicator in ieee80211_assign_beacon") Signed-off-by: Rameshkumar Sundaram Link: https://patch.msgid.link/20250530040940.3188537-1-rameshkumar.sundaram@oss.qualcomm.com Signed-off-by: Johannes Berg commit c9172fae4b844adf66d60768652c5d22e10f5de6 Author: Raj Kumar Bhagat Date: Tue May 27 14:11:45 2025 +0530 wifi: mac80211: Allow scan on a radio while operating on DFS on another radio Currently, in multi-radio wiphy cases, if one radio is operating on a DFS channel, -EBUSY is returned even when a scan is requested on a different radio. Because of this, an MLD AP with one radio (link) on a DFS channel and Automatic Channel Selection (ACS) on another radio (link) cannot be brought up. In multi-radio wiphy cases, multiple radios are grouped under a single wiphy. Hence, if a radio is operating on a DFS channel and a scan is requested on a different radio of the same wiphy, the scan can be allowed simultaneously without impacting the DFS operations. Add logic to check the underlying radio used for the requested scan. If the radio on which DFS is already running is not being used, allow the scan operation; otherwise, return -EBUSY. Signed-off-by: Raj Kumar Bhagat Link: https://patch.msgid.link/20250527-mlo-dfs-acs-v2-3-92c2f37c81d9@quicinc.com Signed-off-by: Johannes Berg commit fe8582dbb4f5eb6073177782242ce91da8377534 Author: Aditya Kumar Singh Date: Tue May 27 14:11:44 2025 +0530 wifi: mac80211: Allow DFS/CSA on a radio if scan is ongoing on another radio Currently, in multi-radio wiphy cases, if a scan is ongoing on one radio, -EBUSY is returned when DFS or a channel switch is initiated on another radio. Because of this, an MLD AP with one radio (link) in an ongoing scan cannot initiate DFS or a channel switch on another radio (link). In multi-radio wiphy cases, multiple radios are grouped under a single wiphy. Hence, if a scan is ongoing on one underlying radio and DFS or a channel switch is requested on a different underlying radio of the same wiphy, these operations can be allowed simultaneously. Add logic to check the underlying radio used for the ongoing scan. If the radio on which DFS or a channel switch is requested is not being used for the scan, allow the operation; otherwise, return -EBUSY. Signed-off-by: Aditya Kumar Singh Co-developed-by: Raj Kumar Bhagat Signed-off-by: Raj Kumar Bhagat Link: https://patch.msgid.link/20250527-mlo-dfs-acs-v2-2-92c2f37c81d9@quicinc.com Signed-off-by: Johannes Berg commit df42bfc96e0ad90d243c0ee6b783a33bdb72a184 Author: Vasanthakumar Thiagarajan Date: Tue May 27 14:11:43 2025 +0530 wifi: cfg80211: Add utility API to get radio index from channel Add utility API cfg80211_get_radio_idx_by_chan() to retrieve the radio index corresponding to a given channel in a multi-radio wiphy. This utility function can be used when we want to check the radio-specific data for a channel in a multi-radio wiphy. For example, it can help determine the radio index required to handle a scan request. This index can then be used to decide whether the scan can proceed without interfering with ongoing DFS operations on another radio. Signed-off-by: Vasanthakumar Thiagarajan Co-developed-by: Raj Kumar Bhagat Signed-off-by: Raj Kumar Bhagat Link: https://patch.msgid.link/20250527-mlo-dfs-acs-v2-1-92c2f37c81d9@quicinc.com Signed-off-by: Johannes Berg commit aa34ecc42a2138af76642b68b53a5a07cb12fe43 Author: Aditya Kumar Singh Date: Wed May 28 09:09:47 2025 +0530 wifi: ieee80211: add Radio Measurement action fields Drivers that support Tx power insertion could examine the outgoing Radio measurement packet and depending on the packet type, the driver can insert specific data fields in it. These action field values will help drivers classify the action code within the Radio Measurement action packet. These action fields are defined in IEEE 802.11-2024 - Table 9-470, Radio Measurement Action field values. Signed-off-by: Aditya Kumar Singh Link: https://patch.msgid.link/20250528-add_rrm_action_code-v1-1-6b7c78b5bbaf@oss.qualcomm.com Signed-off-by: Johannes Berg commit 0de19d5ae0b2c5b18b88c5c7f0442f707a207409 Author: Stanislaw Gruszka Date: Sun May 25 16:45:24 2025 +0200 wifi: iwlegacy: Check rate_idx range after addition Limit rate_idx to IL_LAST_OFDM_RATE for 5GHz band for thinkable case the index is incorrect. Reported-by: Fedor Pchelkin Reported-by: Alexei Safin Signed-off-by: Stanislaw Gruszka Reviewed-by: Fedor Pchelkin Link: https://patch.msgid.link/20250525144524.GA172583@wp.pl Signed-off-by: Johannes Berg commit b05d42eefac737ce3cd80114d3579111023941b8 Author: Jianbo Liu Date: Thu Jun 19 12:48:51 2025 +0300 xfrm: hold device only for the asynchronous decryption The dev_hold() on skb->dev during packet reception was originally added to prevent the device from being released prematurely during asynchronous decryption operations. As current hardware can offload decryption, this asynchronous path is not always utilized. This often results in a pattern of dev_hold() immediately followed by dev_put() for each packet, creating unnecessary reference counting overhead detrimental to performance. This patch optimizes this by skipping the dev_hold() and subsequent dev_put() when asynchronous decryption is not being performed. Signed-off-by: Jianbo Liu Reviewed-by: Cosmin Ratiu Signed-off-by: Steffen Klassert commit 962297a7cd9e2302c2a10291ff551ebe7f19213d Author: Thorsten Blum Date: Thu Jun 19 00:38:43 2025 +0200 ALSA: aloop: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250618223844.1458-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit bec7ac4700305020bfb2dd4d0bfc9e60dc908c5c Author: Thorsten Blum Date: Thu Jun 19 19:40:48 2025 +0200 ALSA: emu10k1: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250619174057.175676-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit bb0d147c9cf4a11cdc34321e276eb914648b0326 Author: wangdicheng Date: Thu Jun 19 15:17:45 2025 +0800 ALSA: hda/realtek: Fixup ft alc257 rename alc3328 Audio ALC3328 recognized as ALC257, updated PCI ID 0x10EC12F0 to rename it to 3328. Signed-off-by: wangdicheng Link: https://patch.msgid.link/20250619071745.149299-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit fd19792851db77e74cff4e2dc772d25a83cdc34d Author: Bartosz Golaszewski Date: Tue Jun 10 16:38:21 2025 +0200 gpio: sysfs: remove the mockdev pointer from struct gpio_device The usage of the mockdev pointer in struct gpio_device is limited to the GPIO sysfs code. There's no reason to keep it in this top-level structure. Create a separate structure containing the reference to the GPIO device and the dummy class device that will be passed to device_create_with_groups(). The !gdev->mockdev checks can be removed as long as we make sure that all operations on the GPIO class are protected with the sysfs lock. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250610-gpio-sysfs-chip-export-v1-6-a8c7aa4478b1@linaro.org Signed-off-by: Bartosz Golaszewski commit 982ec96c3876349e65e60c7b4fd91d767099837e Author: Bartosz Golaszewski Date: Tue Jun 10 16:38:20 2025 +0200 gpio: sysfs: remove unneeded headers No symbols from the linux/idr.h or linux/spinlock.h headers are used in this file so remove them. We also don't technically need linux/list.h currently but one of the follow-up commits will start using it so let's leave it. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250610-gpio-sysfs-chip-export-v1-5-a8c7aa4478b1@linaro.org Signed-off-by: Bartosz Golaszewski commit dc665b5248f90aa2dc74ecc1f2ebb731a6f5afd6 Author: Bartosz Golaszewski Date: Tue Jun 10 16:38:19 2025 +0200 gpio: sysfs: refactor the coding style Update the code to be more consistent with the rest of the codebase. Mostly correctly align line-breaks, remove unneeded tabs, stray newlines & spaces and tweak the comment style. No functional change. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250610-gpio-sysfs-chip-export-v1-4-a8c7aa4478b1@linaro.org Signed-off-by: Bartosz Golaszewski commit e1f02b40a741aac47016765c21b61e91d19aa1ec Author: Bartosz Golaszewski Date: Tue Jun 10 16:38:18 2025 +0200 gpio: sysfs: call mutex_destroy() in gpiod_unexport() While not critical, it's useful to have the corresponding call to mutex_destroy() whenever we use mutex_init(). Add the call right before kfreeing the GPIO data. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250610-gpio-sysfs-chip-export-v1-3-a8c7aa4478b1@linaro.org Signed-off-by: Bartosz Golaszewski commit 1ae86030745013d9d54fc287c1ce875f7ddd99e6 Author: Bartosz Golaszewski Date: Tue Jun 10 16:38:17 2025 +0200 Documentation: gpio: document the active_low field in the sysfs ABI Exported GPIO lines also have the active_low attribute which is not documented. Add a short mention for it. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250610-gpio-sysfs-chip-export-v1-2-a8c7aa4478b1@linaro.org Signed-off-by: Bartosz Golaszewski commit 5ed0d32805c19cfa5f03a25ec7e041dc845d3062 Author: Bartosz Golaszewski Date: Tue Jun 10 16:38:16 2025 +0200 Documentation: gpio: undocument removed behavior Since commit 700cdf7ed00f ("gpio: sysfs: make the sysfs export behavior consistent"), named GPIO lines are no longer exported in sysfs as links named after the them. Drop the misleading bit from the ABI docs. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250610-gpio-sysfs-chip-export-v1-1-a8c7aa4478b1@linaro.org Signed-off-by: Bartosz Golaszewski commit fd127374fcbbd5e5889e604a3c7f6220688ce6b7 Author: Krzysztof Kozlowski Date: Wed May 28 21:44:54 2025 +0200 clk: versaclock7: Constify regmap_range_cfg array Static 'struct regmap_range_cfg' array is not modified so can be changed to const for more safety. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250528194453.567324-2-krzysztof.kozlowski@linaro.org Signed-off-by: Stephen Boyd commit 742014ae01001ebec2496370a36646ef1c870b62 Author: Krzysztof Kozlowski Date: Fri Apr 4 13:56:59 2025 +0200 clk: stm32: Do not enable by default during compile testing Enabling the compile test should not cause automatic enabling of all drivers. Restrict the default to ARCH also for individual driver, even though its choice is not visible without selecting parent Kconfig symbol, because otherwise selecting parent would select the child during compile testing. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250404-kconfig-defaults-clk-v1-3-4d2df5603332@linaro.org Signed-off-by: Stephen Boyd commit e813fc758c842d65cac348a6b62cfc389a6ec0ea Author: Krzysztof Kozlowski Date: Fri Apr 4 13:56:58 2025 +0200 clk: nuvoton: Do not enable by default during compile testing Enabling the compile test should not cause automatic enabling of all drivers. Restrict the default to ARCH also for individual driver, even though its choice is not visible without selecting parent Kconfig symbol, because otherwise selecting parent would select the child during compile testing. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250404-kconfig-defaults-clk-v1-2-4d2df5603332@linaro.org Signed-off-by: Stephen Boyd commit ac32d031f508e46c19ab38d6ba8b53fc28df9945 Author: Jerome Brunet Date: Thu Apr 17 15:44:23 2025 +0200 clk: tests: add clk_hw_get_dev() and clk_hw_get_of_node() tests Add kunit test suites clk_hw_get_dev() and clk_hw_get_of_node() for clocks registered with clk_hw_register() and of_clk_hw_register() Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20250417-clk-hw-get-helpers-v1-2-7743e509612a@baylibre.com Reviewed-by: Brian Masney [sboyd@kernel.org: Drop genparams, rename tests, drop inits, combine suites, add test for non-DT platform device] Signed-off-by: Stephen Boyd commit b06ba1c353b80367804b9ca7d7dbb9b6ea3aec33 Author: Jerome Brunet Date: Thu Jun 19 23:46:03 2025 -0700 clk: tests: Make clk_register_clk_parent_data_device_driver() common Rename clk_register_clk_parent_data_device_driver() to kunit_of_platform_driver_dev() and have it return a struct device pointer while accepting a match table. This will be useful to find the device associated with an OF node for more tests than only the clk_parent_data tests. Signed-off-by: Jerome Brunet [sboyd@kernel.org: Split out from next patch, carry SoB and authorship, rename API, return device pointer] Signed-off-by: Stephen Boyd commit 37a9acb971c2f338e7a1b602b0ee40ad70668e81 Author: Chelsy Ratnawat Date: Thu Jun 19 08:46:27 2025 -0700 HID: replace scnprintf() with sysfs_emit() Documentation/filesystems/sysfs.rst mentions that show() should only use sysfs_emit() or sysfs_emit_at() when formating the value to be returned to user space. So replace scnprintf() with sysfs_emit(). Signed-off-by: Chelsy Ratnawat Signed-off-by: Jiri Kosina commit c8be000387e47624d14b328daca260f897756402 Author: Colin Ian King Date: Thu Jun 19 09:34:56 2025 +0100 HID: uclogic: make read-only array reconnect_event static const Don't populate the read-only array reconnect_event on the stack at run time, instead make it static const. Signed-off-by: Colin Ian King Signed-off-by: Jiri Kosina commit a5db1591d0829bda219d6967e5860764c648edbd Author: Yu Jiaoliang Date: Thu Jun 19 10:47:41 2025 +0800 HID: mcp-2221: Replace manual comparison with min() macro This improves code readability by using the standard kernel macro for minimal value selection while maintaining identical functionality. Signed-off-by: Yu Jiaoliang Signed-off-by: Jiri Kosina commit 7852beb143509d407cb8370604bb7bc97955ec84 Author: Bagas Sanjaya Date: Fri Jun 13 08:43:27 2025 +0700 HID: intel-thc-hid: Separate max input size control conditional list Stephen Rothwell reports htmldocs warning: Documentation/hid/intel-thc-hid.rst:200: ERROR: Unexpected indentation. [docutils] Separate conditional list for max input size control by a blank line to fix the warning. Fixes: 45e92a093099 ("HID: Intel-thc-hid: Intel-thc: Introduce max input size control") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/linux-next/20250611142409.7d4683b0@canb.auug.org.au/ Signed-off-by: Bagas Sanjaya Reviewed-by: Even Xu Signed-off-by: Jiri Kosina commit 0d6b550dce55f2bd47579a92ffc000cb0186e4c4 Author: Heiko Schocher Date: Sun Jun 8 18:33:15 2025 +0200 HID: mcp2221: set gpio pin mode in case we have GPIOLIB enabled the gpio pins are used from the current driver as gpio pins. But may the gpio functions of this pins are not enabled in the flash of the chip and so gpio access fails. In case CONFIG_IIO is not enabled we can prevent this issue of the driver simply by enabling the gpio mode for all pins. Signed-off-by: Heiko Schocher Signed-off-by: Jiri Kosina commit e54dd5059d46e44606395cb6ab15f022dc5a5902 Author: Pengyu Luo Date: Tue Jun 17 17:00:31 2025 +0800 dt-bindings: dma: qcom,gpi: Document the sc8280xp GPI DMA engine Document the GPI DMA engine on the sc8280xp platform. Signed-off-by: Pengyu Luo Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250617090032.1487382-2-mitltlatltl@gmail.com Signed-off-by: Vinod Koul commit 15592a11d5a5c8411ac8494ec49736b658f6fbff Author: Damien Le Moal Date: Fri Jun 6 14:27:47 2025 +0900 scsi: mpt3sas: Correctly handle ATA device errors With the ATA error model, an NCQ command failure always triggers an abort (termination) of all NCQ commands queued on the device. In such case, the SAT or the host must handle the failed command according to the command sense data and immediately retry all other NCQ commands that were aborted due to the failed NCQ command. For SAS HBAs controlled by the mpt3sas driver, NCQ command aborts are not handled by the HBA SAT and sent back to the host, with an ioc log information equal to 0x31080000 (IOC_LOGINFO_PREFIX_PL with the PL code PL_LOGINFO_CODE_SATA_NCQ_FAIL_ALL_CMDS_AFTR_ERR). The function _scsih_io_done() always forces a retry of commands terminated with the status MPI2_IOCSTATUS_SCSI_IOC_TERMINATED using the SCSI result DID_SOFT_ERROR, regardless of the log_info for the command. This correctly forces the retry of collateral NCQ abort commands, but with the retry counter for the command being incremented. If a command to an ATA device is subject to too many retries due to other NCQ commands failing (e.g. read commands trying to access unreadable sectors), the collateral NCQ abort commands may be terminated with an error as they run out of retries. This violates the SAT specification and causes hard-to-debug command errors. Solve this issue by modifying the handling of the MPI2_IOCSTATUS_SCSI_IOC_TERMINATED status to check if a command is for an ATA device and if the command loginfo indicates an NCQ collateral abort. If that is the case, force the command retry using the SCSI result DID_IMM_RETRY to avoid incrementing the command retry count. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20250606052747.742998-3-dlemoal@kernel.org Tested-by: Yafang Shao Signed-off-by: Martin K. Petersen commit 04caad5a7ba86e830d04750417a15bad8ac2613c Author: Damien Le Moal Date: Fri Jun 6 14:27:46 2025 +0900 scsi: mpi3mr: Correctly handle ATA device errors With the ATA error model, an NCQ command failure always triggers an abort (termination) of all NCQ commands queued on the device. In such case, the SAT or the host must handle the failed command according to the command sense data and immediately retry all other NCQ commands that were aborted due to the failed NCQ command. For SAS HBAs controlled by the mpi3mr driver, NCQ command aborts are not handled by the HBA SAT and sent back to the host, with an ioc log information equal to 0x31080000 (IOC_LOGINFO_PREFIX_PL with the PL code PL_LOGINFO_CODE_SATA_NCQ_FAIL_ALL_CMDS_AFTR_ERR). The function mpi3mr_process_op_reply_desc() always forces a retry of commands terminated with the status MPI3_IOCSTATUS_SCSI_IOC_TERMINATED using the SCSI result DID_SOFT_ERROR, regardless of the ioc_loginfo for the command. This correctly forces the retry of collateral NCQ abort commands, but with the retry counter for the command being incremented. If a command to an ATA device is subject to too many retries due to other NCQ commands failing (e.g. read commands trying to access unreadable sectors), the collateral NCQ abort commands may be terminated with an error as they run out of retries. This violates the SAT specification and causes hard-to-debug command errors. Solve this issue by modifying the handling of the MPI3_IOCSTATUS_SCSI_IOC_TERMINATED status to check if a command is for an ATA device and if the command ioc_loginfo indicates an NCQ collateral abort. If that is the case, force the command retry using the SCSI result DID_IMM_RETRY to avoid incrementing the command retry count. Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20250606052747.742998-2-dlemoal@kernel.org Tested-by: Yafang Shao Signed-off-by: Martin K. Petersen commit 258a0a19621793b811356fc9d1849f950629d669 Author: Francisco Gutierrez Date: Tue Jun 17 21:04:43 2025 +0000 scsi: pm80xx: Free allocated tags after failure This change frees resources after an error is detected. Signed-off-by: Francisco Gutierrez Link: https://lore.kernel.org/r/20250617210443.989058-1-frankramirez@google.com Acked-by: Jack Wang Signed-off-by: Martin K. Petersen commit d56d980d9b2829572e634b9ab60dfa0239b1c6a7 Author: Avri Altman Date: Tue Jun 17 12:56:10 2025 +0300 scsi: ufs: Clear ucd_rsp_ptr for UPIU requests once Previously, the response buffer (ucd_rsp_ptr) was cleared in multiple UPIU preparation functions. Do it once. Signed-off-by: Avri Altman Link: https://lore.kernel.org/r/20250617095611.89229-2-avri.altman@sandisk.com Reviewed-by: Bart Van Assche Signed-off-by: Martin K. Petersen commit 9356b50af547e872d9191754c72c83ff6be3b97c Merge: 377b2f15c032e1 1a45ef022f0364 Author: Dave Airlie Date: Fri Jun 20 11:33:41 2025 +1000 Merge tag 'drm-misc-next-2025-06-19' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 6.17: UAPI Changes: - Add Task Information for the wedge API Cross-subsystem Changes: Core Changes: - Fix warnings related to export.h - fbdev: Make CONFIG_FIRMWARE_EDID available on all architectures - fence: Fix UAF issues - format-helper: Improve tests Driver Changes: - ivpu: Add turbo flag, Add Wildcat Lake Support - rz-du: Improve MIPI-DSI Support - vmwgfx: fence improvement Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250619-perfect-industrious-whippet-8ed3db@houat commit d57d72fd0a52354729d6a6f7f3fd34cdf696908b Author: Ciprian Marian Costea Date: Mon May 26 19:21:40 2025 +0300 arm64: dts: s32g: add RTC node The RTC module on S32G2/S32G3 based SoCs is used as a wakeup source from system suspend. Signed-off-by: Ciprian Marian Costea Reviewed-by: Matthias Brugger Signed-off-by: Shawn Guo commit 06ee2f0e2180328ce436c09f41132c46350aad16 Author: Larisa Grigore Date: Thu May 22 15:51:43 2025 +0100 arm64: dts: Add DSPI entries for S32G platforms S32G3 and S32G2 have the same 6 SPI devices, add the DT entries. Devices are all the same except spi0 has 8 chip selects instead of 5. Clock settings for the chip rely on ATF Firmware [1]. [1]: https://github.com/nxp-auto-linux/arm-trusted-firmware Co-developed-by: Radu Pirea (NXP OSS) Signed-off-by: Radu Pirea (NXP OSS) Signed-off-by: Larisa Grigore Signed-off-by: James Clark Signed-off-by: Shawn Guo commit 05bb0921b473d599171207bbcb364ff37343bd1f Author: Primoz Fiser Date: Thu May 22 10:39:09 2025 +0200 arm64: dts: freescale: imx93-phyboard-segin: Set ethernet1 alias Set ethernet1 alias to EQOS interface on phyBOARD-Segin-i.MX93 marking it the secondary networking interface. The primary ethernet0 interface is already set by the SoM include file (imx93-phycore-som.dtsi). Signed-off-by: Primoz Fiser Signed-off-by: Shawn Guo commit cd23badae54b90e56ca33bd954dbe68761a404a8 Author: Primoz Fiser Date: Thu May 22 10:39:08 2025 +0200 arm64: dts: freescale: imx93-phycore-som: Move ethernet0 alias to SoM Move alias for ethernet0 interface to the phyCORE-i.MX93 SoM include file. The reason behind it is that the physical location of the PHY chip connected to FEC interface is on the SoM itself and alias thus belongs into the SoM device-tree. Consequently, it can be used by all boards based on the phyCORE-i.MX93 SoM (phyBOARD-Segin and phyBOARD-Nash). This also enables us to mark FEC interface as the primary / first for networking in the bootloader and systemd (predictable interface names). Signed-off-by: Primoz Fiser Signed-off-by: Shawn Guo commit bbdf793028001e26c057e67ea4884404528c61f3 Author: Alexander Stein Date: Tue May 20 14:08:19 2025 +0200 arm64: dts: tqma8mpql: Add EASRC support Enable EASRC support in tlv320aic32x4 sound card. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit 449d38f551f244bc58828a6fc25ae5f0b8ec1061 Author: Alexander Stein Date: Tue May 20 14:08:18 2025 +0200 arm64: dts: tqma8mnql: Add EASRC support Enable EASRC support in tlv320aic32x4 sound card. Signed-off-by: Alexander Stein Signed-off-by: Shawn Guo commit abe127c46704d3619ef8b1280b81965c8ddc0cca Author: Maud Spierings Date: Tue May 20 08:34:57 2025 +0200 arm64: dts: freescale: Add the BOE av123z7m-n17 variant of the Moduline Display Add the BOE av123z7m-n17 variant of the Moduline Display, this variant comes with a 12.3" 1920x720 display. Reviewed-by: Frank Li Signed-off-by: Maud Spierings Signed-off-by: Shawn Guo commit 6121e3a4d24738d36e1fee897d5e47e0bce9cebf Author: Maud Spierings Date: Tue May 20 08:34:56 2025 +0200 arm64: dts: freescale: Add the BOE av101hdt-a10 variant of the Moduline Display Add the BOE av101hdt-a10 variant of the Moduline Display, this variant comes with a 10.1 1280x720 display with a touchscreen (not working in mainline). Reviewed-by: Frank Li Signed-off-by: Maud Spierings Signed-off-by: Shawn Guo commit 03f07be54cdc5c3dd86bd538d3cc69a5639ff2b8 Author: Maud Spierings Date: Tue May 20 08:34:55 2025 +0200 arm64: dts: freescale: Add the GOcontroll Moduline Display baseboard The Moduline Display platform is a part of the wider GOcontroll Moduline ecosystem. These are embedded controllers that focus on modularity with their swappable IO modules. The base Moduline Display board includes a board-to-board connector with various busses to enable adding new display types required by the application. It includes 2 Moduline IO module slots, a simple mono codec/amplifier, a four channel adc, 2 CAN busses, an RTC and optional wifi/bluetooth. busses to the display adapter include: - 4 lane LVDS - 4 lane MIPI-DSI - 4 lane MIPI-CSI - HDMI 2.0a - USB 2.0 - I2S - I2C - SPI Also a couple of GPIO and PWM pins for controlling various ICs on the display adapter board. Signed-off-by: Maud Spierings Signed-off-by: Shawn Guo commit bac63d7c5f461f0efc7af7072d686ea495880ddd Author: Maud Spierings Date: Tue May 20 08:34:54 2025 +0200 arm64: dts: freescale: add Ka-Ro Electronics tx8p-ml81 COM The Ka-Ro Electronics tx8p-ml81 is a COM based on the imx8mp SOC. It has 2 GB of ram and 8 GB of eMMC storage on board. Add it to enable boards based on this Module Signed-off-by: Maud Spierings Signed-off-by: Shawn Guo commit 31ff1060175c45844960e6006b28242cad0267cd Author: Maud Spierings Date: Tue May 20 08:34:51 2025 +0200 arm64: dts: imx8mp: Add pinctrl config definitions Currently to configure each IOMUXC_SW_PAD_CTL_PAD the raw value of this register is written in the dts, these values are not obvious. Add defines which describe the fields of this register which can be or-ed together to produce readable settings. Reviewed-by: Frank Li Acked-by: Rob Herring (Arm) Signed-off-by: Maud Spierings Signed-off-by: Shawn Guo commit 5f4081d6fafec6c9dca9e7990e783b70db854a5c Author: Jerome Brunet Date: Thu Apr 17 15:44:22 2025 +0200 clk: add a clk_hw helpers to get the clock device or device_node Add helpers to get the device or device_node associated with clk_hw. This can be used by clock drivers to access various device related functionality such as devres, dev_ prints, etc ... Signed-off-by: Jerome Brunet Link: https://lore.kernel.org/r/20250417-clk-hw-get-helpers-v1-1-7743e509612a@baylibre.com Reviewed-by: Brian Masney Signed-off-by: Stephen Boyd commit 4f4040ea5d3e4bebebbef9379f88085c8b99221c Author: Himanshu Mittal Date: Wed Jun 18 23:25:36 2025 +0530 net: ti: icssg-prueth: Add prp offload support to ICSSG driver Add support for ICSSG PRP mode which supports offloading of: - Packet duplication and PRP trailer insertion - Packet duplicate discard and PRP trailer removal Signed-off-by: Himanshu Mittal Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618175536.430568-1-h-mittal1@ti.com Signed-off-by: David S. Miller Signed-off-by: Jakub Kicinski commit f5f792f07bd23f26fcc98a0fca596a2101a6f640 Author: Uwe Kleine-König Date: Wed Apr 30 11:57:49 2025 +0200 clk: pwm: Make use of non-sleeping PWMs For some PWMs applying a configuration doesn't sleep. For these enabling and disabling can be done in the clk callbacks .enable() and .disable() instead of .prepare() and .unprepare(). Do that to possibly reduce the time the PWM is enabled and so save some energy. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/d2f748101194409fb410711380ea52ed33260644.1746006578.git.ukleinek@baylibre.com Signed-off-by: Stephen Boyd commit 91d10161226c1edfb1354441ad78b9ae679a6108 Author: Uwe Kleine-König Date: Wed Apr 30 11:57:48 2025 +0200 clk: pwm: Don't reconfigure running PWM at probe time If the PWM is enabled already when .probe() is entered, period and duty_cycle are updated which essentially corresponds to a clock frequency change. This is unusual and surprising. So update the settings only when the clock gets prepared. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/a974f1147e1a080bf5ad7f1752c92b24516df284.1746006578.git.ukleinek@baylibre.com Signed-off-by: Stephen Boyd commit 574c79582963319c39b0d9cfd231367fb96ec907 Author: Uwe Kleine-König Date: Wed Apr 30 11:57:47 2025 +0200 clk: pwm: Convert to use pwm_apply_might_sleep() pwm_config() is an old function that I'd like to remove. So convert this driver to use pwm_apply_might_sleep(). There is a minor change in behaviour as the explicitly calculated duty_cycle used an uprounding division while pwm_set_relative_duty_cycle() rounds down. I don't expect that difference to matter in practice though. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/f194fad5ee8bdd3fda6159324524979729683653.1746006578.git.ukleinek@baylibre.com Signed-off-by: Stephen Boyd commit 6ae97be59c7bce32c83d4cdb39902d64831dc714 Author: Uwe Kleine-König Date: Wed Apr 30 11:57:46 2025 +0200 clk: pwm: Let .get_duty_cycle() return the real duty cycle pwm_get_state() returns the last requested pwm_state which might differ from what the lowlevel PWM driver actually implemented. For the purpose of .get_duty_cycle() the latter is the more interesting info, so use that to determine the output parameter. Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/3db08ded39c09aaa5004b3b8b1238111f199e819.1746006578.git.ukleinek@baylibre.com Signed-off-by: Stephen Boyd commit 77f08133bcec8c0d2777d3dca1c6308bc545636c Merge: 4c6d203b40e01d 707bd05be75f65 Author: Jakub Kicinski Date: Thu Jun 19 17:02:06 2025 -0700 Merge branch 'ref_tracker-add-ability-to-register-a-debugfs-file-for-a-ref_tracker_dir' Jeff Layton says: ==================== ref_tracker: add ability to register a debugfs file for a ref_tracker_dir For those just joining in, this series adds a new top-level "ref_tracker" debugfs directory, and has each ref_tracker_dir register a file in there as part of its initialization. It also adds the ability to register a symlink with a more human-usable name that points to the file, and does some general cleanup of how the ref_tracker object names are handled. v14: https://lore.kernel.org/20250610-reftrack-dbgfs-v14-0-efb532861428@kernel.org v13: https://lore.kernel.org/20250603-reftrack-dbgfs-v13-0-7b2a425019d8@kernel.org v12: https://lore.kernel.org/20250529-reftrack-dbgfs-v12-0-11b93c0c0b6e@kernel.org v11: https://lore.kernel.org/20250528-reftrack-dbgfs-v11-0-94ae0b165841@kernel.org v10: https://lore.kernel.org/20250527-reftrack-dbgfs-v10-0-dc55f7705691@kernel.org v9: https://lore.kernel.org/20250509-reftrack-dbgfs-v9-0-8ab888a4524d@kernel.org v8: https://lore.kernel.org/20250507-reftrack-dbgfs-v8-0-607717d3bb98@kernel.org v7: https://lore.kernel.org/20250505-reftrack-dbgfs-v7-0-f78c5d97bcca@kernel.org v6: https://lore.kernel.org/20250430-reftrack-dbgfs-v6-0-867c29aff03a@kernel.org v5: https://lore.kernel.org/20250428-reftrack-dbgfs-v5-0-1cbbdf2038bd@kernel.org v4: https://lore.kernel.org/20250418-reftrack-dbgfs-v4-0-5ca5c7899544@kernel.org v3: https://lore.kernel.org/20250417-reftrack-dbgfs-v3-0-c3159428c8fb@kernel.org v2: https://lore.kernel.org/20250415-reftrack-dbgfs-v2-0-b18c4abd122f@kernel.org v1: https://lore.kernel.org/20250414-reftrack-dbgfs-v1-0-f03585832203@kernel.org ==================== Link: https://patch.msgid.link/20250618-reftrack-dbgfs-v15-0-24fc37ead144@kernel.org Signed-off-by: Jakub Kicinski commit 707bd05be75f65749c3f1695f4e362a89b3fcc7b Author: Jeff Layton Date: Wed Jun 18 10:24:22 2025 -0400 ref_tracker: eliminate the ref_tracker_dir name field Now that we have dentries and the ability to create meaningful symlinks to them, don't keep a name string in each tracker. Switch the output format to print "class@address", and drop the name field. Also, add a kerneldoc header for ref_tracker_dir_init(). Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20250618-reftrack-dbgfs-v15-9-24fc37ead144@kernel.org Signed-off-by: Jakub Kicinski commit 8f2079f8da5b6d4373d125a05cb076b0d6dc646b Author: Jeff Layton Date: Wed Jun 18 10:24:21 2025 -0400 net: add symlinks to ref_tracker_dir for netns After assigning the inode number to the namespace, use it to create a unique name for each netns refcount tracker with the ns.inum and net_cookie values in it, and register a symlink to the debugfs file for it. init_net is registered before the ref_tracker dir is created, so add a late_initcall() to register its files and symlinks. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20250618-reftrack-dbgfs-v15-8-24fc37ead144@kernel.org Signed-off-by: Jakub Kicinski commit d04992dc86a6c77b7d39a1ee10013aed7111e855 Author: Jeff Layton Date: Wed Jun 18 10:24:20 2025 -0400 ref_tracker: add a way to create a symlink to the ref_tracker_dir debugfs file Add the ability for a subsystem to add a user-friendly symlink that points to a ref_tracker_dir's debugfs file. Add a separate debugfs_symlinks xarray and use that to track symlinks. The reaper workqueue job will remove symlinks before their corresponding dentries. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20250618-reftrack-dbgfs-v15-7-24fc37ead144@kernel.org Signed-off-by: Jakub Kicinski commit 65b584f5361163ba539d2c7122ca792c3cc87997 Author: Jeff Layton Date: Wed Jun 18 10:24:19 2025 -0400 ref_tracker: automatically register a file in debugfs for a ref_tracker_dir Currently, there is no convenient way to see the info that the ref_tracking infrastructure collects. Attempt to create a file in debugfs when called from ref_tracker_dir_init(). The file is given the name "class@%px", as having the unmodified address is helpful for debugging. This should be safe since this directory is only accessible by root While ref_tracker_dir_init() is generally called from a context where sleeping is OK, ref_tracker_dir_exit() can be called from anywhere. Thus, dentry cleanup must be handled asynchronously. Add a new global xarray that has entries with the ref_tracker_dir pointer as the index and the corresponding debugfs dentry pointer as the value. Instead of removing the debugfs dentry, have ref_tracker_dir_exit() set a mark on the xarray entry and schedule a workqueue job. The workqueue job then walks the xarray looking for marked entries, and removes their xarray entries and the debugfs dentries. Because of this, the debugfs dentry can outlive the corresponding ref_tracker_dir. Have ref_tracker_debugfs_show() take extra care to ensure that it's safe to dereference the dir pointer before using it. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20250618-reftrack-dbgfs-v15-6-24fc37ead144@kernel.org Signed-off-by: Jakub Kicinski commit f6dbe294a11028db540e2dedf1929e25b1093e9b Author: Jeff Layton Date: Wed Jun 18 10:24:18 2025 -0400 ref_tracker: allow pr_ostream() to print directly to a seq_file Allow pr_ostream to also output directly to a seq_file without an intermediate buffer. The first caller of +ref_tracker_dir_seq_print() will come in a later patch, so mark that __maybe_unused for now. That designation will be removed once it is used. Reviewed-by: Andrew Lunn Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20250618-reftrack-dbgfs-v15-5-24fc37ead144@kernel.org Signed-off-by: Jakub Kicinski commit aa7d26c3c3497258b712fb97221e775733a710b7 Author: Jeff Layton Date: Wed Jun 18 10:24:17 2025 -0400 ref_tracker: add a static classname string to each ref_tracker_dir A later patch in the series will be adding debugfs files for each ref_tracker that get created in ref_tracker_dir_init(). The format will be "class@%px". The current "name" string can vary between ref_tracker_dir objects of the same type, so it's not suitable for this purpose. Add a new "class" string to the ref_tracker dir that describes the the type of object (sans any individual info for that object). Also, in the i915 driver, gate the creation of debugfs files on whether the dentry pointer is still set to NULL. CI has shown that the ref_tracker_dir can be initialized more than once. Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20250618-reftrack-dbgfs-v15-4-24fc37ead144@kernel.org Signed-off-by: Jakub Kicinski commit 49c94af071fc6c9f5e1db52b3031dec28daa90c3 Author: Jeff Layton Date: Wed Jun 18 10:24:16 2025 -0400 ref_tracker: have callers pass output function to pr_ostream() In a later patch, we'll be adding a 3rd mechanism for outputting ref_tracker info via seq_file. Instead of a conditional, have the caller set a pointer to an output function in struct ostream. As part of this, the log prefix must be explicitly passed in, as it's too late for the pr_fmt macro. Reviewed-by: Andrew Lunn Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20250618-reftrack-dbgfs-v15-3-24fc37ead144@kernel.org Signed-off-by: Jakub Kicinski commit e209f9193a4724c1d4bc0b155c7beb78aa5d2928 Author: Jeff Layton Date: Wed Jun 18 10:24:15 2025 -0400 ref_tracker: add a top level debugfs directory for ref_tracker Add a new "ref_tracker" directory in debugfs. Each individual refcount tracker can register files under there to display info about currently-held references. Reviewed-by: Andrew Lunn Reviewed-by: Krzysztof Karas Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20250618-reftrack-dbgfs-v15-2-24fc37ead144@kernel.org Signed-off-by: Jakub Kicinski commit 7d02ba96635d184dfc292ecc7308ced1fceaba8d Author: Jeff Layton Date: Wed Jun 18 10:24:14 2025 -0400 ref_tracker: don't use %pK in pr_ostream() output As Thomas Weißschuh points out [1], it is now preferable to use %p instead of hashed pointers with printk(), since raw pointers should no longer be leaked into the kernel log. Change the ref_tracker infrastructure to use %p instead of %pK in its formats. [1]: https://lore.kernel.org/netdev/20250414-restricted-pointers-net-v1-0-12af0ce46cdd@linutronix.de/ Reviewed-by: Thomas Weißschuh Reviewed-by: Krzysztof Karas Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20250618-reftrack-dbgfs-v15-1-24fc37ead144@kernel.org Signed-off-by: Jakub Kicinski commit 2f80dfab862847b762206c6596e1d7ea281830d8 Author: Pei Xiao Date: Mon Apr 7 11:21:46 2025 +0800 clk: sophgo: Use div64* for 64-by-32 division to simplify Fixes Coccinelle/coccicheck warnings reported by do_div.cocci. cocci warnings: drivers/clk/sophgo/clk-sg2042-pll.c:217:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_ul instead. drivers/clk/sophgo/clk-sg2042-pll.c:160:1-7: WARNING: do_div() does a 64-by-32 division, please consider using div64_u64 instead. replace do_div() with div64_*() which doesn't implicitly cast the divisor. Signed-off-by: Pei Xiao Link: https://lore.kernel.org/r/tencent_D5D35C992B70843CF70F5533E49717D24906@qq.com Reviewed-by: Inochi Amaoto Reviewed-by: Chen Wang Signed-off-by: Stephen Boyd commit 13de464f445d42738fe18c9a28bab056ba3a290a Author: Henry Martin Date: Tue Apr 1 21:13:41 2025 +0800 clk: davinci: Add NULL check in davinci_lpsc_clk_register() devm_kasprintf() returns NULL when memory allocation fails. Currently, davinci_lpsc_clk_register() does not check for this case, which results in a NULL pointer dereference. Add NULL check after devm_kasprintf() to prevent this issue and ensuring no resources are left allocated. Fixes: c6ed4d734bc7 ("clk: davinci: New driver for davinci PSC clocks") Signed-off-by: Henry Martin Link: https://lore.kernel.org/r/20250401131341.26800-1-bsdhenrymartin@gmail.com Reviewed-by: David Lechner Signed-off-by: Stephen Boyd commit a1d203d390e04798ccc1c3c06019cd4411885d6d Author: Peter Ujfalusi Date: Thu Jun 19 13:28:48 2025 +0300 ASoC: SOF: ipc4-pcm: Enable delay reporting for ChainDMA streams All streams (currently) which is configured to use ChainDMA can only work on Link/host DMA pairs where the link side position can be access via host registers (like HDA on CAVS 2.5 platforms). Since the firmware does not provide time_info for ChainDMA, unlike for HDA stream, the kernel should calculate the start and end offsets that is needed for the delay calculation. With this small change we can report accurate delays when the stream is configured to use ChainDMA. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20250619102848.12389-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit ce4b269c26ac3216da44ef7699ee61791e6fcbc7 Author: Peter Ujfalusi Date: Thu Jun 19 13:25:48 2025 +0300 ASoC: SOF: Intel: hda: Do not probe Soundwire in nocodec mode Soundwire is not needed for nocodec mode, skip probing it. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Guennadi Liakhovetski Reviewed-by: Ranjani Sridharan Reviewed-by: Liam Girdwood Link: https://patch.msgid.link/20250619102548.11928-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit f9c7c093797fc00c7ce3042387994cf9d6c6d4ce Author: Seppo Ingalsuo Date: Thu Jun 19 13:47:35 2025 +0300 ASoC: SOF: ipc4-topology: Add load of ASRC component This patch adds to IPC4 topology parsing the support for the asynchronous sample rate converter (ASRC) SOF component. It is applied for the DAPM widget type SND_SOC_TPLG_DAPM_ASRC. The parsed SOF tokens for ASRC are SOF_TKN_ASRC_RATE_OUT and SOF_TKN_ASRC_OPERATION_MODE. Signed-off-by: Seppo Ingalsuo Reviewed-by: Liam Girdwood Reviewed-by: Péter Ujfalusi Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20250619104735.26161-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 3d77763c9a6d94ebc258183583891fdf23599a18 Author: Peter Ujfalusi Date: Thu Jun 19 13:45:51 2025 +0300 ASoC: SOF: pcm: Reverse check for prepared stream in sof_pcm_hw_params() Reduce the number of checks needed with the simple and most common audio sequence when the stream is started then stopped. If the stream has not been prepared there is no need to check if we have pcm_ops and pcm_ops->hw_free() callback as it does not matter. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20250619104551.25912-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 6b3cb7f4341cbf62d41ccf6ea906dbe66be8aa3d Author: Peter Ujfalusi Date: Thu Jun 19 13:26:40 2025 +0300 ASoC: SOF: topology: Parse the dapm_widget_tokens in case of DSPless mode Parsing the dapm_widget_tokens is also needed for DSPless mode as it is setting the snd_soc_dapm_widget.no_wname_in_kcontrol_name flag for the kcontrol creation from DAPM widgets. Without that flag set, the following warnings might appear because of long control names: ALSA: Control name 'eqiir.2.1 Post Mixer Analog Playback IIR Eq bytes' truncated to 'eqiir.2.1 Post Mixer Analog Playback IIR Eq' ALSA: Control name 'eqfir.2.1 Post Mixer Analog Playback FIR Eq bytes' truncated to 'eqfir.2.1 Post Mixer Analog Playback FIR Eq' ALSA: Control name 'drc.2.1 Post Mixer Analog Playback DRC bytes' truncated to 'drc.2.1 Post Mixer Analog Playback DRC byte' ALSA: Control name 'drc.2.1 Post Mixer Analog Playback DRC switch' truncated to 'drc.2.1 Post Mixer Analog Playback DRC swit' ALSA: Control name 'gain.15.1 Pre Mixer Deepbuffer HDA Analog Volume' truncated to 'gain.15.1 Pre Mixer Deepbuffer HDA Analog V' Signed-off-by: Peter Ujfalusi Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20250619102640.12068-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 2710204bf1005ee5ca94d07fe740111a9677b919 Author: Peter Ujfalusi Date: Thu Jun 19 13:46:08 2025 +0300 ASoC: SOF: pcm: Remove local create_page_table() wrapper function The create_page_table() can be dropped and replaced with a direct call to snd_sof_create_page_table(). Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20250619104608.25947-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 8a07944a77e962b625c582696497964c393a3489 Author: Peter Ujfalusi Date: Thu Jun 19 13:26:57 2025 +0300 ASoC: SOF: ipc4-pcm: Look for best matching hw_config for SSP Instead of just looking for a hw_config with matching rate only it sounds better to try to find the best matching configuration. If we have multiple hw_configurations with the same rate, but each with different format for example then we have been picking the first config with the matching rate, which can be a problem and it wil depend on how the configs are ordered. Instead we should be trying to find the best match out of the configs 1. rate + format + channels are matching 2. rate + format are matching 3. rate matching Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Link: https://patch.msgid.link/20250619102657.12109-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 4c6d203b40e01d9a5211fe3e2f91df97d5b51441 Merge: 8a97590279d137 6ad7969a361cbe Author: Jakub Kicinski Date: Thu Jun 19 16:02:47 2025 -0700 Merge branch 'netpoll-code-organization-improvements' Breno Leitao says: ==================== netpoll: Code organization improvements The netpoll_setup() function has grown complex over time, mixing different error handling and concerns like carrier waiting, IPv4 address retrieval, and IPv6 address retrieval all within a single function, which is huge (127 LoC). This patch series refactors the netpoll_setup() function to improve code organization and readability by extracting logical blocks into dedicated helper functions. netpoll_setup() length is reduced to 72 LoC. This series breaks down these responsibilities into focused helper functions. The changes are purely structural with no functional modifications. This changes were tested with the netconsole tests and the netpoll selftest (WIP)[1] Link: https://lore.kernel.org/20250612-netpoll_test-v1-1-4774fd95933f@debian.org [1] ==================== Link: https://patch.msgid.link/20250618-netpoll_ip_ref-v1-0-c2ac00fe558f@debian.org Signed-off-by: Jakub Kicinski commit 8a97590279d13796a4b27168ed21b2080a14977c Merge: c3ee72ded0d2fc 2a68a22304f90e Author: Jakub Kicinski Date: Thu Jun 19 15:59:00 2025 -0700 Merge branch 'netdevsim-implement-rx-statistics-using-netdev_pcpu_stat_dstats' Breno Leitao says: ==================== netdevsim: implement RX statistics using NETDEV_PCPU_STAT_DSTATS The netdevsim driver previously lacked RX statistics support, which prevented its use with the GenerateTraffic() test framework, as this framework verifies traffic flow by checking RX byte counts. This patch migrates netdevsim from its custom statistics collection to the NETDEV_PCPU_STAT_DSTATS framework, as suggested by Jakub. This change not only standardizes the statistics handling but also adds the necessary RX statistics support required by the test framework. v3: https://lore.kernel.org/20250617-netdevsim_stat-v3-0-afe4bdcbf237@debian.org v2: https://lore.kernel.org/20250613-netdevsim_stat-v2-0-98fa38836c48@debian.org v1: https://lore.kernel.org/20250611-netdevsim_stat-v1-0-c11b657d96bf@debian.org ==================== Link: https://patch.msgid.link/20250618-netdevsim_stat-v4-0-19fe0d35e28e@debian.org Signed-off-by: Jakub Kicinski commit 6ad7969a361cbec5822285fb39203678ff462b64 Author: Breno Leitao Date: Wed Jun 18 02:32:47 2025 -0700 netpoll: Extract IPv6 address retrieval function Extract the IPv6 address retrieval logic from netpoll_setup() into a dedicated helper function netpoll_take_ipv6() to improve code organization and readability. The function handles obtaining the local IPv6 address from the network device, including proper address type matching between local and remote addresses (link-local vs global), and includes appropriate error handling when IPv6 is not supported or no suitable address is available. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618-netpoll_ip_ref-v1-3-c2ac00fe558f@debian.org Signed-off-by: Jakub Kicinski commit 3699f992e8c22d3ce54d2c1a5774e2c49028f99c Author: Breno Leitao Date: Wed Jun 18 02:32:46 2025 -0700 netpoll: extract IPv4 address retrieval into helper function Move the IPv4 address retrieval logic from netpoll_setup() into a separate netpoll_take_ipv4() function to improve code organization and readability. This change consolidates the IPv4-specific logic and error handling into a dedicated function while maintaining the same functionality. No functional changes. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618-netpoll_ip_ref-v1-2-c2ac00fe558f@debian.org Signed-off-by: Jakub Kicinski commit 76d30b51e818064e02917ce6328fb2c8adce5c87 Author: Breno Leitao Date: Wed Jun 18 02:32:45 2025 -0700 netpoll: Extract carrier wait function Extract the carrier waiting logic into a dedicated helper function netpoll_wait_carrier() to improve code readability and reduce duplication in netpoll_setup(). Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618-netpoll_ip_ref-v1-1-c2ac00fe558f@debian.org Signed-off-by: Jakub Kicinski commit c3ee72ded0d2fc6433a009291d7825b28426e4c0 Author: Wang Liang Date: Wed Jun 18 18:33:42 2025 +0800 net/smc: remove unused input parameters in smc_buf_get_slot The input parameter "compressed_bufsize" of smc_buf_get_slot is unused, remove it. Signed-off-by: Wang Liang Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618103342.1423913-1-wangliang74@huawei.com Signed-off-by: Jakub Kicinski commit 2a68a22304f90e5ee960cccd86895a50cf154723 Author: Breno Leitao Date: Wed Jun 18 01:32:45 2025 -0700 netdevsim: account dropped packet length in stats on queue free Add a call to dev_dstats_rx_dropped_add() in nsim_queue_free() to account for the number of packets dropped when purging the skb queue. This improves the accuracy of RX drop statistics reported by netdevsim. local_bh_{disable, enable}() protection is used to disable preemption, which is necessary given that dev_dstats_rx_dropped_add() access this_cpu_ptr(). See discussion in [1]. Link: https://lore.kernel.org/all/20250617055934.3fd9d322@kernel.org/ [1] Suggested-by: Jakub Kicinski Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250618-netdevsim_stat-v4-4-19fe0d35e28e@debian.org Signed-off-by: Jakub Kicinski commit f64bd2045d6202c0dfff043c1168d5247acdf777 Author: Eric Dumazet Date: Wed Jun 18 09:12:46 2025 +0000 tcp: tcp_time_to_recover() cleanup tcp_time_to_recover() does not need the @flag argument. Its first parameter can be marked const, and of tcp_sock type. Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250618091246.1260322-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 27480a7c8f0274f8f2fc6c40e4522f38e52bd05f Author: Breno Leitao Date: Wed Jun 18 01:32:44 2025 -0700 net: add dev_dstats_rx_dropped_add() helper Introduce the dev_dstats_rx_dropped_add() helper to allow incrementing the rx_drops per-CPU statistic by an arbitrary value, rather than just one. This is useful for drivers or code paths that need to account for multiple dropped packets at once, such as when dropping entire queues. Reviewed-by: Joe Damato Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250618-netdevsim_stat-v4-3-19fe0d35e28e@debian.org Signed-off-by: Jakub Kicinski commit c7d78566bbd30544a0618a6ffbc97bc0ddac7035 Author: Nicolas Escande Date: Tue Jun 17 16:13:34 2025 +0200 neighbour: add support for NUD_PERMANENT proxy entries As discussesd before in [0] proxy entries (which are more configuration than runtime data) should stay when the link (carrier) goes does down. This is what happens for regular neighbour entries. So lets fix this by: - storing in proxy entries the fact that it was added as NUD_PERMANENT - not removing NUD_PERMANENT proxy entries when the carrier goes down (same as how it's done in neigh_flush_dev() for regular neigh entries) [0]: https://lore.kernel.org/netdev/c584ef7e-6897-01f3-5b80-12b53f7b4bf4@kernel.org/ Signed-off-by: Nicolas Escande Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250617141334.3724863-1-nico.escande@gmail.com Signed-off-by: Jakub Kicinski commit 788eb4de608bbebad237674e1057305340d653ba Author: Breno Leitao Date: Wed Jun 18 01:32:43 2025 -0700 netdevsim: collect statistics at RX side When the RX side of netdevsim was added, the RX statistics were missing, making the driver unusable for GenerateTraffic() test framework. This patch adds proper statistics tracking on RX side, complementing the TX path. Reviewed-by: Joe Damato Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250618-netdevsim_stat-v4-2-19fe0d35e28e@debian.org Signed-off-by: Jakub Kicinski commit f9e2511d80c2eaeb940c5f8280d7eea9d7946ece Author: Breno Leitao Date: Wed Jun 18 01:32:42 2025 -0700 netdevsim: migrate to dstats stats collection Replace custom statistics tracking with the kernel's dstats infrastructure to simplify code and improve consistency with other network drivers. This change: - Sets dev->pcpu_stat_type = NETDEV_PCPU_STAT_DSTATS for automatic automatic allocation and deallocation. - Removes manual stats fields and their update - Replaces custom nsim_get_stats64() with dev_get_stats() - Uses dev_dstats_tx_add() and dev_dstats_tx_dropped() helpers - Eliminates the need for manual synchronization primitives The dstats framework provides the same functionality with less code. Suggested-by: Jakub Kicinski Reviewed-by: Joe Damato Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250618-netdevsim_stat-v4-1-19fe0d35e28e@debian.org Signed-off-by: Jakub Kicinski commit 377b2f15c032e1a015d664955cb05d46f3b3a9b0 Merge: 45215c589e7f22 8aa7306631f088 Author: Dave Airlie Date: Fri Jun 20 09:07:49 2025 +1000 Merge tag 'drm-xe-next-2025-06-18' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-next UAPI Changes: - Expose media OA units (Ashutosh) Merge: - Restore GuC submit UAF fix around queue destruction accidentally removed in a drm-xe-fixes merge (Auld) Core Changes: - drm/gpusvm: Introduce devmem_only flag for allocation (Himal) - drm/gpusvm: Add timeslicing support to GPU SVM (Brost) Driver Changes: - Make gem shrinker drm managed (Thomas) - SRIOV VF Post-migration recovery of GGTT nodes and CTB (Tomasz) - Some W/A additions and updates (Aradhya, Shekhar, Vinay, Daniele) - Prefetch Support for svm ranges (Himal, Brost) - Don't allocate managed BO for each policy change (Michal) - Simplify and fix diff calculation in GuC submit (Lucas) - Track FAST_REQ GuC H2Gs to report where errors came from (John) - SRIOV PF: Don't allow LMEM provisioning if LMTT isn't available (Piotr) - Check if all domains awake for MOCS dump (Tejas) - Make creation of SLPC debugfs files conditional (Aradhya) - Default auto_link_downgrade status to false (Aradhya) - Use xe_mmio_read32() to read mtcfg register (Shuicheng) - Updates in PCI ID tables (Atwood, Shekhar) - SRIOV VF: Fail migration recovery if fixups needed but not supported (Tomasz) - Add missing documentation around freq and RPa (Rodrigo) - Some other SVM related fixes (Himal, Auld, Brost, Maarten) - Allow to trigger GT resets using debugfs writes (Michal) - Optimise CCS case for WB pages (Auld) - Create LRC BO without VM (Niranjana) - Initialize MOCS index early (Bala) - HWMON fixes for BMG (Karthik, Lucas) - Drop redundant conversion to bool (Raag) - Rework eviction rejection of bound external bos (Thomas) - Stop re-submitting signalled jobs (Auld) - Small fixes and cleanups for PXP (Daniele) - Convert some print messages to GT-oriented ones (Michal) - Resend potentially lost GuC H2G MMIO request (Michal) - Add configfs to load with fewer engines (Lucas) - Remove unmatched xe_vm_unlock from __xe_exec_queue_init (Maciej) - SRIOV VF: Small updates around GGTT handling (Michal) - Make VMA tile_present, tile_invalidated access rules clear (Brost) - Xe3 Tuning: Disable NULL query for Anyhit Shader (Nitin) - Fixes for VF GuC version (Daniele) - Don't store the xe device pointer inside xe_ttm_tt (Dave) - Small improvements in topology code (Michal) - Stop relying on GGTT internals (Maarten) - GSM size should be constant on most platforms (Roper) - Reorder 'Get pages failed' message (Brost) - WA BB related fixes and improvements (Lucas, Brost) - Fix early wedge on GuC load failure (Daniele) - Add helper function to inject fault into ct_dead_capture (Satyanarayana) - Determine ATS / PTA programming during early sw init (Roper) - Consolidate PAT programming logic for pre-Xe2 and post-Xe2 (Roper) - Fix kconfig prompt (Lucas) - Convert xe_pci tests to parametrized tests (Michal) - Do not kill VM in PT code on -ENODATA (Brost) - Move LRC_ENGINE_ID_PPHWSP_OFFSET outside of parallel offset (Brost) - Enable media OA (Ashutosh) - GuC log level tuning (Lucas) - Add xe_vm_has_valid_gpu_mapping helper (Brost) - Opportunistically skip TLB invalidaion on unbind (Brost) Signed-off-by: Dave Airlie From: Rodrigo Vivi Link: https://lore.kernel.org/r/aFMb_NVF_oCW7UVl@intel.com commit 7399ef9840220ba59a884ad70f7db4e5e2d06c42 Author: Shradha Gupta Date: Tue Jun 17 04:33:41 2025 -0700 net: mana: Set tx_packets to post gso processing packet count Allow tx_packets and tx_bytes counter in the driver to represent the packets transmitted post GSO processing. Currently they are populated as bigger pre-GSO packets and bytes Signed-off-by: Shradha Gupta Reviewed-by: Haiyang Zhang Signed-off-by: David S. Miller commit dfec1c14aecee6813f9bafc7b560cc3a31d24079 Author: Chris Morgan Date: Tue Jun 17 13:03:24 2025 -0500 net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick Add quirk for Potron SFP+ XGSPON ONU Stick (YV SFP+ONT-XGSPON). This device uses pins 2 and 7 for UART communication, so disable TX_FAULT and LOS. Additionally as it is an embedded system in an SFP+ form factor provide it enough time to fully boot before we attempt to use it. https://www.potrontec.com/index/index/list/cat_id/2.html#11-83 https://pon.wiki/xgs-pon/ont/potron-technology/x-onu-sfpp/ Signed-off-by: Chris Morgan Link: https://patch.msgid.link/20250617180324.229487-1-macroalpha82@gmail.com Signed-off-by: Jakub Kicinski commit 2c04d279e857e6c441593c282f978cebc5583fd9 Author: Jun Miao Date: Wed Jun 18 13:39:23 2025 -0400 net: usb: Convert tasklet API to new bottom half workqueue mechanism Migrate tasklet APIs to the new bottom half workqueue mechanism. It replaces all occurrences of tasklet usage with the appropriate workqueue APIs throughout the usbnet driver. This transition ensures compatibility with the latest design and enhances performance. Signed-off-by: Jun Miao Link: https://patch.msgid.link/20250618173923.950510-1-jun.miao@intel.com Signed-off-by: Jakub Kicinski commit deb21a6e5b4a53fdf109e70f88aff534ff858931 Author: Colin Ian King Date: Wed Jun 18 14:54:08 2025 +0100 igc: Make the const read-only array supported_sizes static Don't populate the const read-only array supported_sizes on the stack at run time, instead make it static. Signed-off-by: Colin Ian King Reviewed-by: Alexander Lobakin Reviewed-by: Vitaly Lifshits > Link: https://patch.msgid.link/20250618135408.1784120-1-colin.i.king@gmail.com Signed-off-by: Jakub Kicinski commit ba28ef3ccfa909b6f24b7402a50f10653f5d1163 Merge: 64f37cd57d7a32 6a37750910daaa Author: Jakub Kicinski Date: Thu Jun 19 15:37:08 2025 -0700 Merge branch 'convert-lan78xx-driver-to-the-phylink' Oleksij Rempel says: ==================== convert lan78xx driver to the PHYLINK This series converts the lan78xx driver to use the PHYLINK framework, which enhances PHY and MAC management. The changes also streamline the driver by removing unused elements and improving link status reporting. This is the final part of the previously split conversion series: https://lore.kernel.org/all/20250428130542.3879769-1-o.rempel@pengutronix.de/ Tested on EVB_LAN7850. ==================== Link: https://patch.msgid.link/20250618122602.3156678-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 6a37750910daaa3f0fd465bd25a9ad2e1967cf49 Author: Oleksij Rempel Date: Wed Jun 18 14:26:02 2025 +0200 net: usb: lan78xx: remove unused struct members Remove unused members from struct lan78xx_net, including: driver_priv suspend_count mdix_ctrl These fields are no longer used in the driver and can be safely removed as part of a cleanup. Signed-off-by: Oleksij Rempel Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250618122602.3156678-7-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 673d455bbb1db1b242c502ef551d4cc8f45b00ce Author: Oleksij Rempel Date: Wed Jun 18 14:26:01 2025 +0200 net: usb: lan78xx: Integrate EEE support with phylink LPI API Refactor Energy-Efficient Ethernet (EEE) support in the LAN78xx driver to fully integrate with the phylink Low Power Idle (LPI) API. This includes: - Replacing direct calls to `phy_ethtool_get_eee` and `phy_ethtool_set_eee` with `phylink_ethtool_get_eee` and `phylink_ethtool_set_eee`. - Implementing `.mac_enable_tx_lpi` and `.mac_disable_tx_lpi` to control LPI transitions via phylink. - Configuring `lpi_timer_default` to align with recommended values from LAN7800 documentation. - ensure EEE is disabled on controller reset Signed-off-by: Oleksij Rempel Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250618122602.3156678-6-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 297080cf87a9a09b978a46045fc8d36202afcf56 Author: Oleksij Rempel Date: Wed Jun 18 14:26:00 2025 +0200 net: usb: lan78xx: port link settings to phylink API Refactor lan78xx_get_link_ksettings and lan78xx_set_link_ksettings to use the phylink API (phylink_ethtool_ksettings_get and phylink_ethtool_ksettings_set) instead of directly interfacing with the PHY. This change simplifies the code and ensures better integration with the phylink framework for link management. Additionally, the explicit calls to usb_autopm_get_interface() and usb_autopm_put_interface() have been removed. These were originally needed to manage USB power management during register accesses. However, lan78xx_mdiobus_read() and lan78xx_mdiobus_write() already handle USB auto power management internally, ensuring that the interface remains active when necessary. Since there are no other direct register accesses in these functions that require explicit power management handling, the extra calls have become redundant and are no longer needed. Signed-off-by: Oleksij Rempel Reviewed-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250618122602.3156678-5-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 69909c56504bab938b77ccac279d242911a3c829 Author: Oleksij Rempel Date: Wed Jun 18 14:25:59 2025 +0200 net: usb: lan78xx: Use ethtool_op_get_link to reflect current link status Replace the custom lan78xx_get_link implementation with the standard ethtool_op_get_link helper, which uses netif_carrier_ok to reflect the current link status accurately. Signed-off-by: Oleksij Rempel Reviewed-by: Maxime Chevallier Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250618122602.3156678-4-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 2c7fad8a9c66d890b1b3ff88075745b72e9d63e6 Author: Oleksij Rempel Date: Wed Jun 18 14:25:58 2025 +0200 net: usb: lan78xx: Rename EVENT_LINK_RESET to EVENT_PHY_INT_ACK The EVENT_LINK_RESET macro currently triggers deferred work after a PHY interrupt. Prior to PHYLINK conversion, this work included reconfiguring the MAC and PHY, effectively performing a 'link reset'. However, after porting the driver to the PHYLINK framework, the logic associated with this event now solely handles the acknowledgment of the PHY interrupt. The MAC and PHY reconfiguration is now managed by PHYLINK's dedicated callbacks. To accurately reflect its current, narrowed functionality, rename EVENT_LINK_RESET to EVENT_PHY_INT_ACK. Signed-off-by: Oleksij Rempel Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250618122602.3156678-3-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit e110bc82589752909e283ba5cbc160e0ab56c085 Author: Oleksij Rempel Date: Wed Jun 18 14:25:57 2025 +0200 net: usb: lan78xx: Convert to PHYLINK for improved PHY and MAC management Convert the LAN78xx USB Ethernet driver to use the PHYLINK framework for managing PHY and MAC interactions. This improves consistency with other network drivers, simplifies pause frame handling, and enables cleaner suspend/resume support. Key changes: - Replace all PHYLIB-based logic with PHYLINK equivalents: - Replace phy_connect()/phy_disconnect() with phylink_connect_phy() - Replace phy_start()/phy_stop() with phylink_start()/phylink_stop() - Replace pauseparam handling with phylink_ethtool_get/set_pauseparam() - Introduce lan78xx_phylink_setup() to configure PHYLINK - Add phylink MAC operations: - lan78xx_mac_config() - lan78xx_mac_link_up() - lan78xx_mac_link_down() - Remove legacy link state handling: - lan78xx_link_status_change() - lan78xx_link_reset() - Handle fixed-link fallback for LAN7801 using phylink_set_fixed_link() - Replace deprecated flow control handling with phylink-managed logic Power management: - Switch suspend/resume paths to use phylink_suspend()/phylink_resume() - Ensure proper use of rtnl_lock() where required - Note: full runtime testing of power management is currently limited due to hardware setup constraints Note: Conversion of EEE (Energy Efficient Ethernet) handling to the PHYLINK-managed API will be done in a follow-up patch. For now, the legacy EEE enable logic is preserved in mac_link_up(). Signed-off-by: Oleksij Rempel Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/20250618122602.3156678-2-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 64f37cd57d7a32e3a768870d12bec81bec426419 Author: Matti Vaittinen Date: Wed Jun 18 15:22:02 2025 +0300 net: gianfar: Use device_get_named_child_node_count() We can avoid open-coding the loop construct which counts firmware child nodes with a specific name by using the newly added device_get_named_child_node_count(). The gianfar driver has such open-coded loop. Replace it with the device_get_child_node_count_named(). Suggested-by: Andy Shevchenko Signed-off-by: Matti Vaittinen Reviewed-by: Andy Shevchenko Reviewed-by: Simon Horman Link: https://patch.msgid.link/3a33988fc042588cb00a0bfc5ad64e749cb0eb1f.1750248902.git.mazziesaccount@gmail.com Signed-off-by: Jakub Kicinski commit 39983de5d43f9851982293f7c2731ccaf6c46e9b Merge: 9ce3f34c433707 0593f8df66e563 Author: Jakub Kicinski Date: Thu Jun 19 15:27:56 2025 -0700 Merge branch 'net-fec-general-vlan-cleanups' Marc Kleine-Budde says: ==================== net: fec: general + VLAN cleanups This series first cleans up the fec driver a bit (typos, obsolete comments, add missing header files, rename struct, replace magic number by defines). The last 5 patches clean up the fec_enet_rx_queue() function, including VLAN handling. v3: https://patch.msgid.link/20250617-fec-cleanups-v3-0-a57bfb38993f@pengutronix.de v2: https://patch.msgid.link/20250612-fec-cleanups-v2-0-ae7c36df185e@pengutronix.de v1: https://patch.msgid.link/20241016-fec-cleanups-v1-0-de783bd15e6a@pengutronix.de ==================== Link: https://patch.msgid.link/20250618-fec-cleanups-v4-0-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit 0593f8df66e563c5b4790f8f09c64d69b413bc84 Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:11 2025 +0200 net: fec: fec_enet_rx_queue(): factor out VLAN handling into separate function fec_enet_rx_vlan() In order to clean up of the VLAN handling, factor out the VLAN handling into separate function fec_enet_rx_vlan(). Reviewed-by: Frank Li Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250618-fec-cleanups-v4-11-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit 4dffaf379104342a85d9cf7b84d68457c7bfdc6a Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:10 2025 +0200 net: fec: fec_enet_rx_queue(): move_call to _vlan_hwaccel_put_tag() Move __vlan_hwaccel_put_tag() into the if statement that sets vlan_packet_rcvd = true. This change eliminates the unnecessary vlan_packet_rcvd variable, simplifying the code and improving clarity. Reviewed-by: Frank Li Reviewed-by: Wei Fang Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250618-fec-cleanups-v4-10-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit 33b9f31893bdb68ed901885b6e4c2d3233a92a48 Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:09 2025 +0200 net: fec: fec_enet_rx_queue(): reduce scope of data In order to clean up of the VLAN handling, reduce the scope of data. Reviewed-by: Frank Li Reviewed-by: Wei Fang Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250618-fec-cleanups-v4-9-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit e4a3659a986e06c9e93f4167caa2907443f67063 Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:08 2025 +0200 net: fec: fec_enet_rx_queue(): replace manual VLAN header calculation with skb_vlan_eth_hdr() For better readability and maintainability, use the provided helper function skb_vlan_eth_hdr() to replace manual the VLAN header calculation, and change the type of vlan_header to struct vlan_ethhdr to take into account that the Ethernet header plus VLAN header is returned. Reviewed-by: Frank Li Reviewed-by: Wei Fang Reviewed-by: Andrew Lunn Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250618-fec-cleanups-v4-8-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit e222c08f9669d7318a4c466c7ccc09c71f3b5a9a Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:07 2025 +0200 net: fec: fec_enet_rx_queue(): use same signature as fec_enet_tx_queue() There are the functions fec_enet_rx_queue() and fec_enet_tx_queue(), one for handling the RX queue the other one handles the TX queue. However they don't have the same signature. Align fec_enet_rx_queue() argument order with fec_enet_tx_queue() to make code more readable. Reviewed-by: Wei Fang Reviewed-by: Andrew Lunn Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250618-fec-cleanups-v4-7-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit a4addc337745b427947b141f428c6d3655fd4ee9 Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:06 2025 +0200 net: fec: fec_restart(): introduce a define for FEC_ECR_SPEED Replace "1 << 5" for configuring 1000 MBit/s with a defined constant to improve code readability and maintainability. Reviewed-by: Wei Fang Reviewed-by: Frank Li Reviewed-by: Andrew Lunn Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250618-fec-cleanups-v4-6-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit 4e8594a88656fa86a9d2b1e72770432470b6dc0c Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:05 2025 +0200 net: fec: rename struct fec_devinfo fec_imx6x_info -> fec_imx6sx_info In da722186f654 ("net: fec: set GPR bit on suspend by DT configuration.") the platform_device_id fec_devtype::driver_data was converted from holding the quirks to a pointing to struct fec_devinfo. The struct fec_devinfo holding the information for the i.MX6SX was named fec_imx6x_info. Rename fec_imx6x_info to fec_imx6sx_info to align with the SoC's name. Reviewed-by: Wei Fang Reviewed-by: Frank Li Reviewed-by: Andrew Lunn Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250618-fec-cleanups-v4-5-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit 658e25f770de166bb356a12bff2c2c7f0b09ff9a Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:04 2025 +0200 net: fec: sort the includes by alphabetic order This is a preparation patch to make addition of new includes easier without breaking the alphabetic order. Suggested-by: Alexander Lobakin Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250618-fec-cleanups-v4-4-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit 99d171ae9595ecec9b99240d9268467afcc258e7 Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:03 2025 +0200 net: fec: switch from asm/cacheflush.h to linux/cacheflush.h To fix the checkpatch warning, use linux/cacheflush.h instead of asm/cacheflush.h. Signed-off-by: Marc Kleine-Budde Reviewed-by: Wei Fang Link: https://patch.msgid.link/20250618-fec-cleanups-v4-3-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit 3e03dad543fd3e626571322efad3b0603155deae Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:02 2025 +0200 net: fec: struct fec_enet_private: remove obsolete comment In commit 4d494cdc92b3 ("net: fec: change data structure to support multiqueue") the data structures were changed, so that the comment about the sent-in-place skb doesn't apply any more. Remove it. Reviewed-by: Wei Fang Reviewed-by: Frank Li Reviewed-by: Andrew Lunn Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250618-fec-cleanups-v4-2-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit a822bdb23b3b65630f61f975c5092aec426d99a0 Author: Marc Kleine-Budde Date: Wed Jun 18 14:00:01 2025 +0200 net: fec: fix typos found by codespell codespell has found some typos in the comments, fix them. Reviewed-by: Wei Fang Reviewed-by: Frank Li Reviewed-by: Csókás, Bence Reviewed-by: Andrew Lunn Signed-off-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250618-fec-cleanups-v4-1-c16f9a1af124@pengutronix.de Signed-off-by: Jakub Kicinski commit 9ce3f34c433707f26ec422bba8bb60921450875f Merge: c8e32755ba2b99 e3527bf4dc338e Author: Jakub Kicinski Date: Thu Jun 19 15:25:26 2025 -0700 Merge branch 'net-stmmac-loongson1-cleanups' Russell King says: ==================== net: stmmac: loongson1: cleanups A couple of patches to cleanup loongson1. First, introducing a match data struct to allow the per-match data to be extended beyond the init function pointer, and then adding a setup method to allow the resource base address to be translated to the MAC index at probe time rather than repeatedly in the setup function. ==================== Link: https://patch.msgid.link/aFKXzlno7HkG-cNh@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e3527bf4dc338ebf12488fdec3e7a952bf3db5dd Author: Russell King (Oracle) Date: Wed Jun 18 11:41:14 2025 +0100 net: stmmac: loongson1: get ls1b resource only once ls1b_dwmac_syscon_init() was getting the stmmac iomem resource to detect which GMAC block is being used. Move this to a separate setup() function that only runs at probe time, so it can sensibly behave with an unrecognised resource adress. Use this to set a MAC index (id) which is then used in place of testing the base address. Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Reviewed-by: Keguang Zhang Tested-by: Keguang Zhang # on LS1B & LS1C Link: https://patch.msgid.link/E1uRqEE-004c7M-Go@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b1cffac4792b007866f57bd77b4486ad738855da Author: Russell King (Oracle) Date: Wed Jun 18 11:41:09 2025 +0100 net: stmmac: loongson1: provide match data struct Provide a structure for match data rather than using the function pointer as match data. This allows stronger type-checking for the function itself, and allows extensions to the match data. Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Reviewed-by: Andrew Lunn Reviewed-by: Keguang Zhang Tested-by: Keguang Zhang # on LS1B & LS1C Link: https://patch.msgid.link/E1uRqE9-004c7G-CB@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c8e32755ba2b99efa38c8fdfa74522ca796139b5 Author: Russell King (Oracle) Date: Wed Jun 18 12:05:12 2025 +0100 net: stmmac: replace ioaddr with stmmac_priv for pcs_set_ane() method Pass the stmmac_priv structure into the pcs_set_ane() MAC method rather than having callers dereferencing this structure for the IO address. Tested-by: Bartosz Golaszewski # sa8775p-ride-r3 Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Link: https://patch.msgid.link/E1uRqbQ-004djP-1l@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 654df8e74dbc19ba0625051079e6889e6999d16e Author: Jonas Karlman Date: Sun May 18 22:06:51 2025 +0000 arm64: dts: rockchip: Add power controller for RK3528 Add power-domain nodes for the power controller on RK3528. Only PD_GPU can fully be powered down. PD_RKVDEC, PD_RKVENC, PD_VO and PD_VPU are idle only power domains used by miscellaneous devices. Because multiple of the miscellaneous device types currently complain about the use of a power-domains prop, only PD_GPU is enabled. Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20250518220707.669515-5-jonas@kwiboo.se [changed to using numeric values, until the next merge-window] Signed-off-by: Heiko Stuebner commit 64df8e2e207a2152201ef3515baacd8816c13282 Author: Nicolas Frattaroli Date: Thu Jun 19 20:36:37 2025 +0200 arm64: dts: rockchip: enable USB on Sige5 The ArmSoM Sige5 has several USB ports: a Type-A USB 3 port (USB2 lines going through a hub), a Type-A USB 2.0 port (also going through a hub), a Type-C DC input port that has absolutely no USB data connection and a Type-C port with USB3.2 Gen1x1 that's also the maskrom programming port. Enable these ports, and set the device role to be host for the host ports. The data capable Type-C USB port uses a fusb302 for data role switching. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250619-rk3576-sige5-usb-v5-2-9069a7e750e1@collabora.com Signed-off-by: Heiko Stuebner commit 9ab71d9204c32a9814d38528d066fdf6fa128604 Author: Paul Moore Date: Wed Jun 18 12:17:33 2025 -0400 selinux: add __GFP_NOWARN to hashtab_init() allocations As reported by syzbot, hashtab_init() can be affected by abnormally large policy loads which would cause the kernel's allocator to emit a warning in some configurations. Since the SELinux hashtab_init() code handles the case where the allocation fails, due to a large request or some other reason, we can safely add the __GFP_NOWARN flag to squelch these abnormally large allocation warnings. Reported-by: syzbot+bc2c99c2929c3d219fb3@syzkaller.appspotmail.com Tested-by: syzbot+bc2c99c2929c3d219fb3@syzkaller.appspotmail.com Signed-off-by: Paul Moore commit 951b2de06a0bd64930949c7d3bd5a113cdf24189 Author: Stephen Smalley Date: Wed May 21 10:41:25 2025 -0400 selinux: optimize selinux_inode_getattr/permission() based on neveraudit|permissive Extend the task avdcache to also cache whether the task SID is both permissive and neveraudit, and return immediately if so in both selinux_inode_getattr() and selinux_inode_permission(). The same approach could be applied to many of the hook functions although the avdcache would need to be updated for more than directory search checks in order for this optimization to be beneficial for checks on objects other than directories. To test, apply https://github.com/SELinuxProject/selinux/pull/473 to your selinux userspace, build and install libsepol, and use the following CIL policy module: $ cat neverauditpermissive.cil (typeneveraudit unconfined_t) (typepermissive unconfined_t) Without this module inserted, running the following commands: perf record make -jN # on an already built allmodconfig tree perf report --sort=symbol,dso yields the following percentages (only showing __d_lookup_rcu for reference and only showing relevant SELinux functions): 1.65% [k] __d_lookup_rcu 0.53% [k] selinux_inode_permission 0.40% [k] selinux_inode_getattr 0.15% [k] avc_lookup 0.05% [k] avc_has_perm 0.05% [k] avc_has_perm_noaudit 0.02% [k] avc_policy_seqno 0.02% [k] selinux_file_permission 0.01% [k] selinux_inode_alloc_security 0.01% [k] selinux_file_alloc_security for a total of 1.24% for SELinux compared to 1.65% for __d_lookup_rcu(). After running the following command to insert this module: semodule -i neverauditpermissive.cil and then re-running the same perf commands from above yields the following non-zero percentages: 1.74% [k] __d_lookup_rcu 0.31% [k] selinux_inode_permission 0.03% [k] selinux_inode_getattr 0.03% [k] avc_policy_seqno 0.01% [k] avc_lookup 0.01% [k] selinux_file_permission 0.01% [k] selinux_file_open for a total of 0.40% for SELinux compared to 1.74% for __d_lookup_rcu(). Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit 1106896146d8711fdc899e6fc792e1d01f9b9f15 Author: Stephen Smalley Date: Wed May 21 10:41:23 2025 -0400 selinux: introduce neveraudit types Introduce neveraudit types i.e. types that should never trigger audit messages. This allows the AVC to skip all audit-related processing for such types. Note that neveraudit differs from dontaudit not only wrt being applied for all checks with a given source type but also in that it disables all auditing, not just permission denials. When a type is both a permissive type and a neveraudit type, the security server can short-circuit the security_compute_av() logic, allowing all permissions and not auditing any permissions. This change just introduces the basic support but does not yet further optimize the AVC or hook function logic when a type is both a permissive type and a dontaudit type. Suggested-by: Paul Moore Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore commit a8cdcbe6a9f64f56ee24c9e8325fb89cf41a5d63 Author: Alexey Charkov Date: Sat Jun 14 22:14:36 2025 +0400 arm64: dts: rockchip: add overlay for the WiFi/BT module on Sige5 v1.2 Add support for the Broadcom based WiFi/Bluetooth module (BW3752-50B1) found in ArmSoM Sige5 boards version 1.2. This includes SDIO connected WiFi with OOB interrupt support, as well as UART connected Bluetooth with its respective interrupts. PCM support for Bluetooth SCO audio is left out for now. It is connected to SAI2 in M0 pin mode in case someone needs to enable it. Note that v1.1 boards used a Realtek based module which is incompatible with these DT nodes, so v1.1 would need a different overlay. Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250614-sige5-updates-v2-4-3bb31b02623c@gmail.com Signed-off-by: Heiko Stuebner commit 358ccc1d8b242b8c659e5e177caef174624e8cb6 Author: Alexey Charkov Date: Sat Jun 14 22:14:35 2025 +0400 arm64: dts: rockchip: add version-independent WiFi/BT nodes on Sige5 ArmSoM Sige5 uses a soldered-on WiFi/BT module with WiFi on SDIO and BT on UART. However, board v1.1 uses a Realtek based BL-M8852BS2, while v1.2 uses a Broadcom based BW3752-50B1. They use the same pins and controllers, but require different DT properties to enable. Thankfully, the WiFi part at least works without explicitly listing it in the device tree, albeit without OOB interrupt functionality. Add required device tree nodes that do not depend on the board version so that at least the WiFi module can appear on the SDIO bus. WiFi OOB interrupt and Bluetooth function support are not enabled here, as they require module specific properties. Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250614-sige5-updates-v2-3-3bb31b02623c@gmail.com Signed-off-by: Heiko Stuebner commit e490f854b46369b096f3d09c0c6a00f340425136 Author: Alexey Charkov Date: Sat Jun 14 22:14:34 2025 +0400 arm64: dts: rockchip: add SDIO controller on RK3576 RK3576 has one more SD/MMC controller than are currently listed in its .dtsi, with the missing one intended as an SDIO controller. Add the missing node (tested with the onboard WiFi module on ArmSoM Sige5 v1.2) Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250614-sige5-updates-v2-2-3bb31b02623c@gmail.com Signed-off-by: Heiko Stuebner commit 974baaa147022a6230768ad73313154ce0a77c0a Author: Andy Yan Date: Wed Jun 18 14:36:01 2025 +0800 arm64: dts: rockchip: Enable gpu on rk3576-evb1-v10 Enable gpu for rk3576 evb. Signed-off-by: Andy Yan Link: https://lore.kernel.org/r/20250618063609.690332-1-andyshrk@163.com Signed-off-by: Heiko Stuebner commit 4c55936671db32dc72ab0ceb2b8aeee0184ef38c Author: Frank Li Date: Mon Jun 2 10:19:36 2025 -0400 dt-bindings: clock: convert lpc1850-ccu.txt to yaml format Convert lpc1850-ccu.txt to yaml format. Additional changes: - remove label in examples. - remove clock consumer in examples. Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250602141937.942091-1-Frank.Li@nxp.com Reviewed-by: Rob Herring (Arm) Signed-off-by: Stephen Boyd commit 987087864c88ec8617c311c39390ce578ae15195 Author: Olivier Benjamin Date: Thu Jun 19 15:41:24 2025 +0200 arm64: dts: rockchip: Update the PinePhone Pro panel description Fix a few issues in the panel section of the PinePhone Pro DTS: - add the second part of the Himax HX8394 LCD panel controller compatible - as proposed by Diederik de Haas, reuse the mipi_out and ports definitions from rk3399-base.dtsi instead of redefining them - add a pinctrl for the LCD_RST signal for LCD1, derived from LCD1_RST, which is on GPIO4_D1, as documented on pages 11 and 16 of the PinePhone Pro schematic Signed-off-by: Olivier Benjamin Reviewed-by: Diederik de Haas Link: https://lore.kernel.org/r/20250619-dtb_fixes-v3-1-9cb02ddd8ce4@bootlin.com Signed-off-by: Heiko Stuebner commit 62deb67fc519ee3b394f094982851d1ff3992731 Merge: afc783fa0aab9c 5c8013ae2e86ec Author: Jakub Kicinski Date: Thu Jun 12 10:08:24 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.16-rc3). No conflicts or adjacent changes. Signed-off-by: Jakub Kicinski commit 2c9891e958add528c934fb4a197b390d8a0303f8 Author: Sven Peter Date: Thu Jun 12 21:11:27 2025 +0000 clk: apple-nco: Drop default ARCH_APPLE in Kconfig When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Signed-off-by: Sven Peter Link: https://lore.kernel.org/r/20250612-apple-kconfig-defconfig-v1-3-0e6f9cb512c1@kernel.org Signed-off-by: Stephen Boyd commit 2a7b4b228cbcebe273d9f4206ed8ee9cbba70ab0 Author: Onur Özkan Date: Wed Jun 18 12:28:10 2025 +0300 rust: replace literals with constants in `clk::Hertz` Replaces repeated numeric literals in `Hertz` conversions with named constants. Signed-off-by: Onur Özkan Link: https://lore.kernel.org/r/20250618092810.29370-1-work@onurozkan.dev Acked-by: Viresh Kumar Reviewed-by: Alexandre Courbot Signed-off-by: Stephen Boyd commit b112dfc74b2040721959935b317d784455c5f635 Author: Onur Özkan Date: Wed Jun 18 12:35:08 2025 +0300 rust: shorten `con_id`s in `get` methods in clk module Converts `if-else` blocks into one line code using `map_or` for simplicity. Signed-off-by: Onur Özkan Link: https://lore.kernel.org/r/20250618093508.16343-1-work@onurozkan.dev Acked-by: Viresh Kumar Reviewed-by: Alexandre Courbot Signed-off-by: Stephen Boyd commit bbbaea850e52c408654a586e0c4fbff8c1efc6f1 Author: Onur Özkan Date: Wed Jun 18 12:14:42 2025 +0300 rust: make `clk::Hertz` methods const Marks `Hertz` methods as `const` to make them available for `const` contexts. This can be useful when defining static/compile-time frequency parameters in drivers/subsystems. Signed-off-by: Onur Özkan Link: https://lore.kernel.org/r/20250618091442.29104-1-work@onurozkan.dev Reviewed-by: Alice Ryhl Acked-by: Viresh Kumar Reviewed-by: Alexandre Courbot Signed-off-by: Stephen Boyd commit 3e2a9811f6a9cefd310cc33cab73d5435b4a4caa Author: Nicolin Chen Date: Fri Jun 13 23:35:26 2025 -0700 iommufd: Apply the new iommufd_object_alloc_ucmd helper Now the new ucmd-based object allocator eases the finalize/abort routine, apply this to all existing allocators that aren't protected by any lock. Upgrade the for-driver vIOMMU alloctor too, and pass down to all existing viommu_alloc op accordingly. Note that __iommufd_object_alloc_ucmd() builds in some static tests that cover both static_asserts in the iommufd_viommu_alloc(). Thus drop them. Link: https://patch.msgid.link/r/107b24a3b791091bb09c92ffb0081c56c413b26d.1749882255.git.nicolinc@nvidia.com Suggested-by: Jason Gunthorpe Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe commit c0d498a1b99d5417f19c35ecd98ac0ff73c351a4 Author: Nicolin Chen Date: Fri Jun 13 23:35:25 2025 -0700 iommufd: Introduce iommufd_object_alloc_ucmd helper An object allocator needs to call either iommufd_object_finalize() upon a success or iommufd_object_abort_and_destroy() upon an error code. To reduce duplication, store a new_obj in the struct iommufd_ucmd and call iommufd_object_finalize/iommufd_object_abort_and_destroy() accordingly in the main function. Similar to iommufd_object_alloc() and __iommufd_object_alloc(), add a pair of helpers: __iommufd_object_alloc_ucmd() and iommufd_object_alloc_ucmd(). Link: https://patch.msgid.link/r/e7206d4227844887cc8dbf0cc7b0242580fafd9d.1749882255.git.nicolinc@nvidia.com Suggested-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Acked-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe commit 17a93473a552fc0ffdfb04e69a26946afd4a046a Author: Nicolin Chen Date: Fri Jun 13 23:35:24 2025 -0700 iommufd: Move _iommufd_object_alloc out of driver.c Now, all driver structures will be allocated by the core, i.e. no longer a need of driver calling _iommufd_object_alloc. Thus, move it back. Before: text data bss dec hex filename 3024 180 0 3204 c84 drivers/iommu/iommufd/driver.o 9074 610 64 9748 2614 drivers/iommu/iommufd/main.o After: text data bss dec hex filename 2665 164 0 2829 b0d drivers/iommu/iommufd/driver.o 9410 618 64 10092 276c drivers/iommu/iommufd/main.o Link: https://patch.msgid.link/r/79e630c7b911930cf36e3c8a775a04e66c528d65.1749882255.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe commit f842ea208e43066c43e5e91e20fe8ce600df7055 Author: Nicolin Chen Date: Fri Jun 13 23:35:23 2025 -0700 iommu: Deprecate viommu_alloc op To ease the for-driver iommufd APIs, get_viommu_size and viommu_init ops are introduced. Now, those existing vIOMMU supported drivers implemented these two ops, replacing the viommu_alloc one. So, there is no use of it. Remove it from the headers and the viommu core. Link: https://patch.msgid.link/r/5b32d4499d7ed02a63e57a293c11b642d226ef8d.1749882255.git.nicolinc@nvidia.com Suggested-by: Jason Gunthorpe Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Reviewed-by: Pranjal Shrivastava Reviewed-by: Jason Gunthorpe Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe commit 3961f2f5daccf4b54d499d7e155a1b46d17d385a Author: Nicolin Chen Date: Fri Jun 13 23:35:22 2025 -0700 iommu/arm-smmu-v3: Replace arm_vsmmu_alloc with arm_vsmmu_init To ease the for-driver iommufd APIs, get_viommu_size and viommu_init ops are introduced. Sanitize the inputs and report the size of struct arm_vsmmu on success, in arm_smmu_get_viommu_size(). Place the type sanity at the last, becase there will be soon an impl level get_viommu_size op, which will require the same sanity tests prior. It can simply insert a piece of code in front of the IOMMU_VIOMMU_TYPE_ARM_SMMUV3 sanity. The core will ensure the viommu_type is set to the core vIOMMU object, and pass in the same dev pointer, so arm_vsmmu_init() won't need to repeat the same sanity tests but to simply init the arm_vsmmu struct. Remove the arm_vsmmu_alloc, completing the replacement. Link: https://patch.msgid.link/r/64e4b4c33acd26e1bd676e077be80e00fb63f17c.1749882255.git.nicolinc@nvidia.com Signed-off-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Reviewed-by: Pranjal Shrivastava Acked-by: Will Deacon Signed-off-by: Jason Gunthorpe commit 683cff7c3bf4495c2378ede5a3601271958c08fe Author: Nicolin Chen Date: Fri Jun 13 23:35:21 2025 -0700 iommufd/selftest: Replace mock_viommu_alloc with mock_viommu_init To ease the for-driver iommufd APIs, get_viommu_size and viommu_init ops are introduced. Sanitize the inputs and report the size of struct mock_viommu on success, in mock_get_viommu_size(). The core will ensure the viommu_type is set to the core vIOMMU object, so simply init the driver part in mock_viommu_init(). Remove the mock_viommu_alloc, completing the replacement. Link: https://patch.msgid.link/r/993beabbb0bc9705d979a92801ea5ed5996a34eb.1749882255.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Signed-off-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe commit 5983d1e7d7586c32605fdffc68e5ff61bf917022 Author: Nicolin Chen Date: Fri Jun 13 23:35:20 2025 -0700 iommufd/selftest: Drop parent domain from mock_iommu_domain_nested There is no use of this parent domain. Delete the dead code. Note that the s2_parent in struct mock_viommu will be a deadcode too. Yet, keep it because it will be soon used by HW queue objects, i.e. no point in adding it back and forth in such a short window. Besides, keeping it could cover the majority of vIOMMU use cases where a driver-level structure will be larger in size than the core structure. Link: https://patch.msgid.link/r/0f155a7cd71034a498448fe4828fb4aaacdabf95.1749882255.git.nicolinc@nvidia.com Signed-off-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Signed-off-by: Jason Gunthorpe commit 63141fa741da27ffe3220a2395229098e7184c98 Author: Nicolin Chen Date: Fri Jun 13 23:35:19 2025 -0700 iommufd/viommu: Support get_viommu_size and viommu_init ops To ease the for-driver iommufd APIs, get_viommu_size and viommu_init ops are introduced to replace the viommu_init op. Let the new viommu_init pathway coexist with the old viommu_alloc one. Since the viommu_alloc op and its pathway will be soon deprecated, try to minimize the code difference between them by adding a tentative jump tag. Note that this fails a !viommu->ops case from now on with a WARN_ON_ONCE since a vIOMMU is expected to support an alloc_domain_nested op for now, or some sort of a viommu op in the foreseeable future. This WARN_ON_ONCE can be lifted, if some day there is a use case wanting !viommu->ops. Link: https://patch.msgid.link/r/35c5fa5926be45bda82f5fc87545cd3180ad4c9c.1749882255.git.nicolinc@nvidia.com Suggested-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Reviewed-by: Kevin Tian Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe commit 187f146d5de65d50d90a4f49157d381d8ae32939 Author: Nicolin Chen Date: Fri Jun 13 23:35:18 2025 -0700 iommu: Introduce get_viommu_size and viommu_init ops So far, a vIOMMU object has been allocated by IOMMU driver and initialized with the driver-level structure, before it returns to the iommufd core for core-level structure initialization. It has been requiring iommufd core to expose some core structure/helpers in its driver.c file, which result in a size increase of this driver module. Meanwhile, IOMMU drivers are now requiring more vIOMMU-base structures for some advanced feature, such as the existing vDEVICE and a future HW_QUEUE. Initializing a core-structure later than driver-structure gives for-driver helpers some trouble, when they are used by IOMMU driver assuming that the new structure (including core) are fully initialized, for example: core: viommu = ops->viommu_alloc(); driver: // my_viommu is successfully allocated driver: my_viommu = iommufd_viommu_alloc(...); driver: // This may crash if it reads viommu->ictx driver: new = iommufd_new_viommu_helper(my_viommu->core ...); core: viommu->ictx = ucmd->ictx; core: ... To ease such a condition, allow the IOMMU driver to report the size of its vIOMMU structure, let the core allocate a vIOMMU object and initialize the core-level structure first, and then hand it over the driver to initialize its driver-level structure. Thus, this requires two new iommu ops, get_viommu_size and viommu_init, so iommufd core can communicate with drivers to replace the viommu_alloc op: core: viommu = ops->get_viommu_size(); driver: return VIOMMU_STRUCT_SIZE(); core: viommu->ictx = ucmd->ictx; // and others core: rc = ops->viommu_init(); driver: // This is safe now as viommu->ictx is inited driver: new = iommufd_new_viommu_helper(my_viommu->core ...); core: ... This also adds a VIOMMU_STRUCT_SIZE macro, for drivers to use, which would statically sanitize the driver structure. Link: https://patch.msgid.link/r/3ab52c5b622dad476c43b1b1f1636c8b902f1692.1749882255.git.nicolinc@nvidia.com Suggested-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Reviewed-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Kevin Tian Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe commit 0c6e0ae7a7e49fb0e781d3fbf24004e1b6b586d1 Author: Nicolin Chen Date: Fri Jun 13 23:35:17 2025 -0700 iommufd: Return EOPNOTSUPP for failures due to driver bugs It's more accurate to report EOPNOTSUPP when an ioctl failed due to driver bug, since there is nothing wrong with the user space side. Link: https://patch.msgid.link/r/623bb6f0e8fdd7b9c5745a2f99f280163f9f1f5a.1749882255.git.nicolinc@nvidia.com Signed-off-by: Nicolin Chen Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Reviewed-by: Lu Baolu Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe commit 62b62a55bd30164f8d256b22a60181085238859d Author: Nicolin Chen Date: Fri Jun 13 23:35:16 2025 -0700 iommufd: Use enum iommu_veventq_type for type in struct iommufd_veventq Replace unsigned int, to make it clear. No functional changes. Link: https://patch.msgid.link/r/208a260c100a00667d3799feaad1260745f96c6b.1749882255.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Reviewed-by: Pranjal Shrivastava Signed-off-by: Jason Gunthorpe commit fc9c40e3a4faa09dbd643ae1bdaf8ad006c3bc28 Author: Nicolin Chen Date: Fri Jun 13 23:35:15 2025 -0700 iommufd: Use enum iommu_viommu_type for type in struct iommufd_viommu Replace unsigned int, to make it clear. No functional changes. The viommu_alloc iommu op will be deprecated, so don't change that. Link: https://patch.msgid.link/r/6c6ba5c0cd381594f17ae74355872d78d7a022c0.1749882255.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Reviewed-by: Pranjal Shrivastava Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe commit 6e235a77219934d24cc356336a811ed19e439765 Author: Nicolin Chen Date: Fri Jun 13 23:35:14 2025 -0700 iommufd: Drop unused ictx in struct iommufd_vdevice The core code can always get the ictx pointer via vdev->viommu->ictx, thus drop this unused one. Link: https://patch.msgid.link/r/6cbb65e8df433de45b6c3a4bb2c5df09faca8a7c.1749882255.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe commit ea92128fe7f6eef6ee5fcaaed521b1b2b5ab7c9a Author: Nicolin Chen Date: Fri Jun 13 23:35:13 2025 -0700 iommufd: Apply obvious cosmetic fixes Run clang-format but exclude those not so obvious ones, which leaves us: - Align indentations - Add missing spaces - Remove unnecessary spaces - Remove unnecessary line wrappings Link: https://patch.msgid.link/r/9132e1ab45690ab1959c66bbb51ac5536a635388.1749882255.git.nicolinc@nvidia.com Reviewed-by: Kevin Tian Reviewed-by: Jason Gunthorpe Signed-off-by: Nicolin Chen Reviewed-by: Lu Baolu Signed-off-by: Jason Gunthorpe commit 8b8ca279752e0c9ae242a110ecb513dd85e5844f Author: Lad Prabhakar Date: Tue Jun 17 16:57:57 2025 +0100 clk: renesas: Add CPG/MSSR support to RZ/N2H SoC Add clock driver support for the Renesas RZ/N2H (R9A09G087) SoC by reusing the existing RZ/T2H (R9A09G077) CPG/MSSR implementation, as both SoCs share the same clock and reset architecture. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250617155757.149597-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 5701451e849bd3fe60d071fa80d39697c6f39a48 Merge: 275e2b544d6666 292bf6c5b8100b Author: Geert Uytterhoeven Date: Thu Jun 19 20:19:13 2025 +0200 Merge tag 'renesas-r9a09g087-dt-binding-defs-tag1' into renesas-clk-for-v6.17 Renesas RZ/N2H DT Binding Definitions DT bindings and binding definitions for the Renesas RZ/N2H (R9A09G087) SoC, shared by driver and DT source files. commit 275e2b544d6666bc79db7f677a658034437e7828 Author: Lad Prabhakar Date: Tue Jun 17 16:57:56 2025 +0100 clk: renesas: r9a09g077: Add PCLKL core clock Add the Peripheral Module Clock L (PCLKL) for the RZ/T2H (R9A09G077) SoC. PCLKL is sourced from PLL1 and runs at 62.5MHz. It is used by various low-speed peripherals such as IIC and WDT. Also update LAST_DT_CORE_CLK to reflect the addition of PCLKL, ensuring correct enumeration of core clocks exposed to DT. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250617155757.149597-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a9f57b8d5f0546bbc49448370995696ec9dcb83e Merge: c939b63f44e50c 62ab7ac5be9039 Author: Geert Uytterhoeven Date: Thu Jun 19 20:11:28 2025 +0200 Merge tag 'renesas-r9a09g077-dt-binding-defs-tag2' into renesas-clk-for-v6.17 Renesas RZ/T2H PCLKL Clock DT Binding Definition Peripheral Module Clock L (PCLKL) DT binding definition for the Renesas RZ/T2H (R9A09G077) SoC, shared by driver and DT source files. commit 292bf6c5b8100ba4e16cd194bdc89785f6fb6f7a Author: Lad Prabhakar Date: Mon Jun 9 21:36:51 2025 +0100 dt-bindings: clock: renesas,cpg-mssr: Document RZ/N2H support Document support for Module Standby and Software Reset found on the Renesas RZ/N2H (R9A09G087) SoC. The Module Standby and Software Reset IP is similar to that found on the RZ/T2H SoC. Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250609203656.333138-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit b59b3f68822eb52d1864d1bde92a932ff9bdf295 Author: Paul Barker Date: Mon Jun 9 21:36:49 2025 +0100 dt-bindings: soc: renesas: Document RZ/N2H (R9A09G087) SoC Add RZ/N2H (R9A09G087), its variants, and the rzn2h-evk evaluation board in documentation. Signed-off-by: Paul Barker Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250609203656.333138-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 62ab7ac5be90392a9ac0955febab778ebf51bc0a Author: Lad Prabhakar Date: Tue Jun 17 16:57:55 2025 +0100 dt-bindings: clock: renesas,r9a09g077: Add PCLKL core clock ID Add the Peripheral Module Clock L (PCLKL) core clock ID for the RZ/T2H (R9A09G077) SoC. This clock is used by peripherals such as IIC, WDT, and others. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250617155757.149597-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c939b63f44e50c3d2bd3790cddf07c3ef805ca5f Author: Tommaso Merciai Date: Wed Jun 11 11:39:26 2025 +0200 clk: renesas: r9a09g047: Add I3C0 clocks and resets Add I3C0 clock and reset support to the Renesas RZ/G3E R9A09G047 CPG driver. Signed-off-by: Tommaso Merciai Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611093934.4208-3-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven commit d2d0b64f57341391b77b2f727af9db64df80549d Author: Marek Vasut Date: Sun Jun 8 23:51:20 2025 +0200 arm64: dts: renesas: rcar-gen3: Add bootph-all to sysinfo EEPROMs Add bootph-all property to sysinfo EEPROM on Renesas R-Car Gen3 Salvator-X(S), ULCB, Condor, Ebisu, Draak boards. The sysinfo EEPROM is used by U-Boot early on, mark it using the bootph-all property. No functional change for the Linux kernel, this only reduces the divergence of DTs between U-Boot and Linux. Signed-off-by: Marek Vasut Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250608215212.1619182-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 20b02acbd89e4fc883670a7f7f517fc0a11bb5f7 Author: Marek Vasut Date: Sat Jun 7 21:44:39 2025 +0200 arm64: dts: renesas: sparrow-hawk: Describe split PCIe clock The Sparrow Hawk board supplies the PCIe controller input clock and PCIe bus clock from separate outputs of the Renesas 9FGV0441 clock generator. Describe this split bus configuration in the board DT. The topology looks as follows: ____________ _____________ | R-Car PCIe | | PCIe device | | | | | | PCIe RX<|==================|>PCIe TX | | PCIe TX<|==================|>PCIe RX | | | | | | PCIe CLK<|======.. ..======|>PCIe CLK | '------------' || || '-------------' || || ____________ || || | 9FGV0441 | || || | | || || | CLK DIF0<|======'' || | CLK DIF1<|=========='' | CLK DIF2<| | CLK DIF3<| '------------' Acked-by: Manivannan Sadhasivam Reviewed-by: Geert Uytterhoeven Signed-off-by: Marek Vasut Link: https://lore.kernel.org/20250607194541.79176-3-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 714dd09f0ec7d58eebe62c5bdb45ca8809e020f3 Author: Marek Vasut Date: Sat Jun 7 21:44:38 2025 +0200 arm64: dts: renesas: r8a779g0: Describe PCIe root ports Add nodes which describe the root ports in the PCIe controller DT nodes. This can be used together with the pwrctrl driver to control clock and power supply to a PCIe slot. For example usage, refer to the Sparrow Hawk board. Acked-by: Manivannan Sadhasivam Reviewed-by: Geert Uytterhoeven Signed-off-by: Marek Vasut Link: https://lore.kernel.org/20250607194541.79176-2-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 0c8bf42e50ccc14039adf1dc580ccb31d5e3c6ab Merge: c607aad8b15eaf 66db1d3cbdb0e8 Author: Geert Uytterhoeven Date: Thu Jun 19 19:36:55 2025 +0200 Merge branch 'pwrctrl' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci into renesas-dts-for-v6.17 Merge slot clock support for PCI slots, which is a depdendency for replacing the ad-hoc description of the split PCIe clock on Sparrow Hawk by a proper hardware description. commit c607aad8b15eafb3c0f179482805803e97b2af18 Author: Geert Uytterhoeven Date: Wed Jun 4 16:47:32 2025 +0200 arm64: dts: renesas: ebisu: Add CAN0 support On R-Car E3, Classical CAN0/1 and CAN-FD share the same sets of pins, so only one of them can be used at the same time. Add support for using CAN0 instead of CAN-FD channel 0 on Ebisu. By default, only CAN-FD channel 0 is enabled, as before. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/612b999870dd64789041e4b0e9c568389b3fb95e.1749048320.git.geert+renesas@glider.be commit 52c34f57fc81f2317a60ed55e2b6ca6ecdb1efdc Author: Wolfram Sang Date: Wed Jun 4 10:40:11 2025 +0200 ARM: dts: renesas: r9a06g032: Add second clock input to RTC The external RTC clock is populated on the RZ/N1D module, so describe it and add a reference to the RTC node. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250604084211.28090-2-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven commit 4f6780c14fea09bc56c4991d6bf8f2a594bfb51f Author: Lad Prabhakar Date: Wed May 28 15:04:53 2025 +0100 arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable USB2.0 support Enable USB2.0 support on the RZ/V2N EVK board, CN2 connector on the EVK supports host/function operation. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250528140453.181851-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit f46bcf3a9ae8f1c1cc865d1302c46dfceb7a2b59 Author: Lad Prabhakar Date: Wed May 28 15:04:52 2025 +0100 arm64: dts: renesas: r9a09g056: Add USB2.0 support The Renesas RZ/V2N (R9A09G056) SoC features a single-channel USB2.0 interface with host and peripheral (function) support. Add the ECHI, OHCI, USB2.0 PHY and reset control nodes for USB2.0 channel in R9A09G056 SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250528140453.181851-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit e3bbdeeefeec60dc9ec409083d988bc3b9e845ec Author: Marek Vasut Date: Sun May 25 18:02:43 2025 +0200 arm64: dts: renesas: r8a779g3-sparrow-hawk: Sort DTS Sort DTS alphabetically. Fix up the placement of &rcar_sound {}. No functional change. Signed-off-by: Marek Vasut Acked-by: Kuninori Morimoto Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250525160336.82960-1-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven commit 3113bb8a1106d4385f9eaad45136c4257bf3cd88 Author: Wolfram Sang Date: Thu May 22 09:58:29 2025 +0200 ARM: dts: renesas: r9a06g032-rzn1d400-db: Describe debug LEDs Enable the debug LEDs connected via the I2C GPIO extender. Signed-off-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250522080112.26050-2-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven commit 46d5ca6521dee03cf66b2ed54709112053e94c35 Author: Lad Prabhakar Date: Thu May 15 19:31:04 2025 +0100 arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable USB2.0 support Enable USB2.0 support on the RZ/V2H EVK board, CN3 supports host only operation and CN2 supports host/function operation. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250515183104.330964-3-prabhakar.mahadev-lad.rj@bp.renesas.com Link: https://lore.kernel.org/20250613152216.201957-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 52161035571cd62be9865039b4be65615860dce0 Author: Lad Prabhakar Date: Mon Jun 16 14:27:50 2025 +0100 pinctrl: renesas: rzg2l: Validate pins before setting mux function Ensure only valid pins are configured by validating pin mappings before setting the mux function. Rename rzg2l_validate_gpio_pin() to rzg2l_validate_pin() to reflect its broader purpose validating both GPIO pins and muxed pins. This helps avoid invalid configurations. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250616132750.216368-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 910aa7765a7a12a5b485547de924fa97a21eb779 Author: Geert Uytterhoeven Date: Mon Jun 16 13:47:18 2025 +0200 ARM: shmobile: defconfig: Refresh for v6.16-rc2 Refresh the defconfig for Renesas ARM systems: - Disable CONFIG_DWMAC_RENESAS_GBETH, which defaults to yes since commit 461f6529e5946d98 ("net: stmmac: Add DWMAC glue layer for Renesas GBETH"), but is only used on Renesas ARM64 SoCs. Signed-off-by: Geert Uytterhoeven Link: https://lore.kernel.org/f04a2b0e2c9128b4fa644850270b55493358be39.1750074375.git.geert+renesas@glider.be commit 41cffe6d234617f9637b68209a4ee42e0457f2a3 Author: Lad Prabhakar Date: Tue May 13 13:58:58 2025 +0100 arm64: defconfig: Enable RZ/V2H(P) USB2 PHY controller reset driver Enable the `CONFIG_RESET_RZV2H_USB2PHY` option in the arm64 defconfig to support the USB2 PHY controller reset driver on the Renesas RZ/V2H(P) SoC, as used on the RZ/V2H EVK board. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250513125858.251064-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 9358bdb9f9f54d94ceafc650deffefd737d19fdd Author: Ivan Stepchenko Date: Thu Jun 19 17:53:13 2025 +0300 mtd: fix possible integer overflow in erase_xfer() The expression '1 << EraseUnitSize' is evaluated in int, which causes a negative result when shifting by 31 - the upper bound of the valid range [10, 31], enforced by scan_header(). This leads to incorrect extension when storing the result in 'erase->len' (uint64_t), producing a large unexpected value. Found by Linux Verification Center (linuxtesting.org) with Svace. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ivan Stepchenko Signed-off-by: Miquel Raynal commit e30329b8a6476eed87460e73a29ecd718ec981e1 Author: Luis Gerhorst Date: Thu Jun 19 16:26:47 2025 +0200 powerpc/bpf: Fix warning for unused ori31_emitted Without this, the compiler (clang21) might emit a warning under W=1 because the variable ori31_emitted is set but never used if CONFIG_PPC_BOOK3S_64=n. Without this patch: $ make -j $(nproc) W=1 ARCH=powerpc SHELL=/bin/bash arch/powerpc/net [...] CC arch/powerpc/net/bpf_jit_comp.o CC arch/powerpc/net/bpf_jit_comp64.o ../arch/powerpc/net/bpf_jit_comp64.c: In function 'bpf_jit_build_body': ../arch/powerpc/net/bpf_jit_comp64.c:417:28: warning: variable 'ori31_emitted' set but not used [-Wunused-but-set-variable] 417 | bool sync_emitted, ori31_emitted; | ^~~~~~~~~~~~~ AR arch/powerpc/net/built-in.a With this patch: [...] CC arch/powerpc/net/bpf_jit_comp.o CC arch/powerpc/net/bpf_jit_comp64.o AR arch/powerpc/net/built-in.a Fixes: dff883d9e93a ("bpf, arm64, powerpc: Change nospec to include v1 barrier") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506180402.uUXwVoSH-lkp@intel.com/ Signed-off-by: Luis Gerhorst Reviewed-by: Christophe Leroy Link: https://lore.kernel.org/r/20250619142647.2157017-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit c0b93754547dde16c8370b8fdad5f396e7786647 Author: Wilfred Mallawa Date: Fri Jun 13 12:19:09 2025 +0200 PCI: dw-rockchip: Delay link training after hot reset in EP mode RK3588 TRM, section "11.6.1.3.3 Hot Reset and Link-Down Reset" states that: If you want to delay link re-establishment (after reset) so that you can reprogram some registers through DBI, you must set app_ltssm_enable =0 immediately after core_rst_n as shown in above. This can be achieved by enable the app_dly2_en, and end-up the delay by assert app_dly2_done. I.e. setting app_dly2_en will automatically deassert app_ltssm_enable on a hot reset, and setting app_dly2_done will re-assert app_ltssm_enable, re-enabling link training. When receiving a hot reset/link-down IRQ when running in EP mode, we will call dw_pcie_ep_linkdown(), which may update registers through DBI. Unless link training is inhibited, these register updates race with the link training. To avoid the race, set PCIE_LTSSM_APP_DLY2_EN so the controller never automatically trains the link after a link-down or hot reset interrupt. That way any DBI updates done in the dw_pcie_ep_linkdown() path will happen while the link is still down. Then allow link training by setting PCIE_LTSSM_APP_DLY2_DONE Co-developed-by: Niklas Cassel Signed-off-by: Wilfred Mallawa Signed-off-by: Niklas Cassel Signed-off-by: Manivannan Sadhasivam [bhelgaas: commit log] Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250613101908.2182053-2-cassel@kernel.org commit 9adc643d43837a4af996af5511dab5a7b5a64315 Author: Yuesong Li Date: Thu Jun 19 16:07:51 2025 +0800 staging: gpib: hp_82341: Replace manual comparison with min/max macro This improves code readability by using the standard kernel macro for min/max value selection while maintaining identical functionality. Signed-off-by: Yuesong Li Link: https://lore.kernel.org/r/20250619080822.677662-1-liyuesong@vivo.com Signed-off-by: Greg Kroah-Hartman commit 52bacd2766a3426d21aa5396772ac653b7dbd822 Author: Kisub Choe Date: Wed Jun 18 23:33:42 2025 +0900 staging: sm750fb: rename 'hwCursor' Rename 'hwCursor' to 'hw_cursor' to conform with kernel style guidelines as reported by checkpatch.pl CHECK: Avoid CamelCase: Signed-off-by: Kisub Choe Link: https://lore.kernel.org/r/20250618143342.6517-1-kisub.choe.0x1@gmail.com Signed-off-by: Greg Kroah-Hartman commit 349f6bef120529df638190a06bdf30e9b3aadf58 Author: Michael Straube Date: Sun Jun 15 14:38:59 2025 +0200 staging: rtl8723bs: remove some 5 GHz code Chips that use this driver are 2.4 GHz only. Remove some code that is executed only for 5 GHz (channel > 14) . This addresses the following TODO item: - find and remove any code for other chips that is left over Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250615123859.41922-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 9279204d37cce549f40cdc677b86405e8628212c Author: Michael Straube Date: Sun Jun 15 14:37:58 2025 +0200 staging: rtl8723bs: remove return from void function Remove exit label and return statement from a void function. After the exit label no cleanup is done, so it is safe to remove it and return early in the only place where the label is used. This simplifies the code and clears a checkpatch warning. WARNING: void function return statements are not generally useful Signed-off-by: Michael Straube Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250615123758.41869-1-straube.linux@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1b30f644f7e2b8d4352b7a796496c41f81aa72ed Author: Bartosz Golaszewski Date: Tue Jun 10 17:20:36 2025 +0200 staging: greybus: remove unnecessary GPIO line direction check As of commit 92ac7de3175e3 ("gpiolib: don't allow setting values on input lines"), the GPIO core makes sure values cannot be set on input lines. Remove the unnecessary check. Signed-off-by: Bartosz Golaszewski Reviewed-by: Rui Miguel Silva Link: https://lore.kernel.org/r/20250610152036.86099-1-brgl@bgdev.pl Signed-off-by: Greg Kroah-Hartman commit b8394732ff0cc81551b0e3b442994622ebf389a7 Author: Dave Penkler Date: Tue Jun 3 20:43:20 2025 +0200 staging: gpib: Add bit and byte padding to ioctl structs Ensure that all structs have a size that is an integral mutliple of 32 bits. Change trailing single bit field to __u32 in gpib_open_dev_ioctl Add byte padding to gpib_serial_poll_ioctl and gpib_request_service2 Add bit padding to gpib_board_info_ioctl and gpib_ppoll_config_ioctl Signed-off-by: Dave Penkler Link: https://lore.kernel.org/r/20250603184320.30594-5-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit eaad2a4263c986c0adc2f81ab6e6199391ecc435 Author: Dave Penkler Date: Tue Jun 3 20:43:19 2025 +0200 staging: gpib: Use standard size basic uapi types Change unsigned int to __u32, int to __s32 and short to __s16 Signed-off-by: Dave Penkler Link: https://lore.kernel.org/r/20250603184320.30594-4-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit 781c58ecfe2479cddc1b383cc8b3c0133608be47 Author: Dave Penkler Date: Tue Jun 3 20:43:18 2025 +0200 staging: gpib: Add local include file for commands Add the functions and enums needed only by the kernel drivers that were removed from the uapi/gpib.h include file to a separate local include file. Include this new file in the gpibP.h local include file. Signed-off-by: Dave Penkler Link: https://lore.kernel.org/r/20250603184320.30594-3-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit 3fb68dd90d160a543d82d6c356d00891bfb9be99 Author: Dave Penkler Date: Tue Jun 3 20:43:17 2025 +0200 staging: gpib: Remove unneeded enums and functions Remove enums and functions that do not need to be shared with user space. Remove enums and functions that are not needed in the kernel drivers. Signed-off-by: Dave Penkler Link: https://lore.kernel.org/r/20250603184320.30594-2-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit b940fd6ce31e038628cd115ac1c8906b93e096d5 Author: Dave Penkler Date: Wed May 21 18:08:30 2025 +0200 staging: gpib: Update TODO As we no longer have any drivers depending on BROKEN in Kconfig remove the fix broken driver line. Add a list of checkpatch checks/warning that should be ignored. Signed-off-by: Dave Penkler Link: https://lore.kernel.org/r/20250521160830.30454-1-dpenkler@gmail.com Signed-off-by: Greg Kroah-Hartman commit 1a44c265c90cf0fb51694b90c8b48a83c69479ed Author: Greg Kroah-Hartman Date: Wed May 21 16:53:33 2025 +0200 staging: vme: vme_user: fix up const issue in vme_bus_match() vme_bus_match takes a const pointer and casts it away with container_of() which is generally not a good idea. Fix this up by properly marking the output as const. Link: https://lore.kernel.org/r/2025052132-giddiness-slain-5ba1@gregkh Signed-off-by: Greg Kroah-Hartman commit f8b067f8776f59e2321e3721c190977fef607d2a Author: Milos Puric Date: Wed May 21 14:25:12 2025 +0100 staging: rtl8723bs: Align next line to open parentheses in core/rtw_xmit.c Adhere to Linux kernel coding style. Reported by checkpatch: CHECK: Alignment should match open parentheses Signed-off-by: Milos Puric Link: https://lore.kernel.org/r/aC3UOPYv8HmzRvij@milos-ThinkPad-T14-Gen-3 Signed-off-by: Greg Kroah-Hartman commit afc783fa0aab9cc093fbb04871bfda406480cf8d Merge: 68d019aa14d97f 1fee0c61317272 Author: Jakub Kicinski Date: Thu Jun 19 07:22:54 2025 -0700 Merge tag 'linux-can-next-for-6.17-20250618' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-06-18 All 10 patches are by Geert Uytterhoeven, target the rcar_canfd driver, first cleanup/refactor the driver and then add support for Transceiver Delay Compensation. * tag 'linux-can-next-for-6.17-20250618' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: can: rcar_canfd: Add support for Transceiver Delay Compensation can: rcar_canfd: Return early in rcar_canfd_set_bittiming() when not FD can: rcar_canfd: Share config code in rcar_canfd_set_bittiming() can: rcar_canfd: Rename rcar_canfd_setrnc() to rcar_canfd_set_rnc() can: rcar_canfd: Repurpose f_dcfg base for other registers can: rcar_canfd: Simplify data access in rcar_canfd_{ge,pu}t_data() can: rcar_canfd: Add helper variable dev to rcar_canfd_reset_controller() can: rcar_canfd: Add helper variable ndev to rcar_canfd_rx_pkt() can: rcar_canfd: Remove bittiming debug prints can: rcar_canfd: Consistently use ndev for net_device pointers ==================== Link: https://patch.msgid.link/20250618092336.2175168-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit 68d019aa14d97f8d57b0f8d203fd3b44db2ba0c7 Merge: cf11cf12a1e223 948670361c0c18 Author: Paolo Abeni Date: Thu Jun 19 15:24:10 2025 +0200 Merge branch 'selftests-net-use-slowwait-to-make-sure-setup-finished' Hangbin Liu says: ==================== selftests: net: use slowwait to make sure setup finished The two updated tests sometimes failed because the network setup hadn't completed. Used slowwait to ensure the setup finished and the tests always passed. I ran both tests 50 times, and all of them passed. ==================== Link: https://patch.msgid.link/20250617105101.433718-1-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit 948670361c0c189556f3d97c5b2e6ed7ae198da9 Author: Hangbin Liu Date: Tue Jun 17 10:51:00 2025 +0000 selftests: net: use slowwait to make sure IPv6 setup finished Sometimes the vxlan vnifiltering test failed on slow machines due to network setup not finished. e.g. TEST: VM connectivity over vnifiltering vxlan (ipv4 default rdst) [ OK ] TEST: VM connectivity over vnifiltering vxlan (ipv6 default rdst) [FAIL] Let's use slowwait to make sure the connection is finished. Signed-off-by: Hangbin Liu Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250617105101.433718-3-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit d83a5806759278c4898cd7c2116432e5b08df1df Author: Hangbin Liu Date: Tue Jun 17 10:50:59 2025 +0000 selftests: net: use slowwait to stabilize vrf_route_leaking test The vrf_route_leaking test occasionally fails due to connectivity issues in our testing environment. A sample failure message shows that the ping check fails intermittently PING 2001:db8:16:2::2 (2001:db8:16:2::2) 56 data bytes --- 2001:db8:16:2::2 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms TEST: Basic IPv6 connectivity [FAIL] This is likely due to insufficient wait time on slower machines. To address this, switch to using slowwait, which provides a longer and more reliable wait for setup completion. Before this change, the test failed 3 out of 10 times. After applying this fix, the test was run 30 times without any failure. Signed-off-by: Hangbin Liu Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250617105101.433718-2-liuhangbin@gmail.com Signed-off-by: Paolo Abeni commit cf11cf12a1e22364c4c63ed603606876c1845cb9 Merge: d3623dd5bd4e1f ca8ac489ca33c9 Author: Paolo Abeni Date: Thu Jun 19 15:13:51 2025 +0200 Merge branch 'support-bandwidth-clamping-in-mana-using-net-shapers' Erni Sri Satya Vennela says: ==================== Support bandwidth clamping in mana using net shapers This patchset introduces hardware-backed bandwidth rate limiting for MANA NICs via the net_shaper_ops interface, enabling efficient and fine-grained traffic shaping directly on the device. Previously, MANA lacked a mechanism for user-configurable bandwidth control. With this addition, users can now configure shaping parameters, allowing better traffic management and performance isolation. The implementation includes the net_shaper_ops callbacks in the MANA driver and supports one shaper per vport. Add shaping support via mana_set_bw_clamp(), allowing the configuration of bandwidth rates in 100 Mbps increments (minimum 100 Mbps). The driver validates input and rejects unsupported values. On failure, it restores the previous configuration which is queried using mana_query_link_cfg() or retains the current state. To prevent potential deadlocks introduced by net_shaper_ops, switch to _locked variants of NAPI APIs when netdevops_lock is held during VF setup and teardown. Also, Add support for ethtool get_link_ksettings to report the maximum link speed supported by the SKU in mbps. These APIs when invoked on hardware that are older or that do not support these APIs, the speed would be reported as UNKNOWN and the net-shaper calls to set speed would fail. ==================== Link: https://patch.msgid.link/1750144656-2021-1-git-send-email-ernis@linux.microsoft.com Signed-off-by: Paolo Abeni commit ca8ac489ca33c986ff02ee14c3e1c10b86355428 Author: Erni Sri Satya Vennela Date: Tue Jun 17 00:17:36 2025 -0700 net: mana: Handle unsupported HWC commands If any of the HWC commands are not recognized by the underlying hardware, the hardware returns the response header status of -1. Log the information using netdev_info_once to avoid multiple error logs in dmesg. Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Haiyang Zhang Reviewed-by: Shradha Gupta Reviewed-by: Saurabh Singh Sengar Reviewed-by: Dipayaan Roy Link: https://patch.msgid.link/1750144656-2021-5-git-send-email-ernis@linux.microsoft.com Signed-off-by: Paolo Abeni commit a6d5edf11e0cf5a4650f1d353d20ec29de093813 Author: Erni Sri Satya Vennela Date: Tue Jun 17 00:17:35 2025 -0700 net: mana: Add speed support in mana_get_link_ksettings Allow mana ethtool get_link_ksettings operation to report the maximum speed supported by the SKU in mbps. The driver retrieves this information by issuing a HWC command to the hardware via mana_query_link_cfg(), which retrieves the SKU's maximum supported speed. These APIs when invoked on hardware that are older/do not support these APIs, the speed would be reported as UNKNOWN. Before: $ethtool enP30832s1 > Settings for enP30832s1: Supported ports: [ ] Supported link modes: Not reported Supported pause frame use: No Supports auto-negotiation: No Supported FEC modes: Not reported Advertised link modes: Not reported Advertised pause frame use: No Advertised auto-negotiation: No Advertised FEC modes: Not reported Speed: Unknown! Duplex: Full Auto-negotiation: off Port: Other PHYAD: 0 Transceiver: internal Link detected: yes After: $ethtool enP30832s1 > Settings for enP30832s1: Supported ports: [ ] Supported link modes: Not reported Supported pause frame use: No Supports auto-negotiation: No Supported FEC modes: Not reported Advertised link modes: Not reported Advertised pause frame use: No Advertised auto-negotiation: No Advertised FEC modes: Not reported Speed: 16000Mb/s Duplex: Full Auto-negotiation: off Port: Other PHYAD: 0 Transceiver: internal Link detected: yes Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Haiyang Zhang Reviewed-by: Shradha Gupta Reviewed-by: Saurabh Singh Sengar Reviewed-by: Long Li Link: https://patch.msgid.link/1750144656-2021-4-git-send-email-ernis@linux.microsoft.com Signed-off-by: Paolo Abeni commit 75cabb46935b6de8e2bdfde563e460ac41cfff12 Author: Erni Sri Satya Vennela Date: Tue Jun 17 00:17:34 2025 -0700 net: mana: Add support for net_shaper_ops Introduce support for net_shaper_ops in the MANA driver, enabling configuration of rate limiting on the MANA NIC. To apply rate limiting, the driver issues a HWC command via mana_set_bw_clamp() and updates the corresponding shaper object in the net_shaper cache. If an error occurs during this process, the driver restores the previous speed by querying the current link configuration using mana_query_link_cfg(). The minimum supported bandwidth is 100 Mbps, and only values that are exact multiples of 100 Mbps are allowed. Any other values are rejected. To remove a shaper, the driver resets the bandwidth to the maximum supported by the SKU using mana_set_bw_clamp() and clears the associated cache entry. If an error occurs during this process, the shaper details are retained. On the hardware that does not support these APIs, the net-shaper calls to set speed would fail. Set the speed: ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/net_shaper.yaml \ --do set --json '{"ifindex":'$IFINDEX', "handle":{"scope": "netdev", "id":'$ID' }, "bw-max": 200000000 }' Get the shaper details: ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/net_shaper.yaml \ --do get --json '{"ifindex":'$IFINDEX', "handle":{"scope": "netdev", "id":'$ID' }}' > {'bw-max': 200000000, > 'handle': {'scope': 'netdev'}, > 'ifindex': $IFINDEX, > 'metric': 'bps'} Delete the shaper object: ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/net_shaper.yaml \ --do delete --json '{"ifindex":'$IFINDEX', "handle":{"scope": "netdev","id":'$ID' }}' Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Haiyang Zhang Reviewed-by: Shradha Gupta Reviewed-by: Saurabh Singh Sengar Reviewed-by: Long Li Link: https://patch.msgid.link/1750144656-2021-3-git-send-email-ernis@linux.microsoft.com Signed-off-by: Paolo Abeni commit d5c8f0e4e0cb0ac2a4a4e015f2f5b1ba39e5e583 Author: Erni Sri Satya Vennela Date: Tue Jun 17 00:17:33 2025 -0700 net: mana: Fix potential deadlocks in mana napi ops When net_shaper_ops are enabled for MANA, netdev_ops_lock becomes active. MANA VF setup/teardown by netvsc follows this call chain: netvsc_vf_setup() dev_change_flags() ... __dev_open() OR __dev_close() dev_change_flags() holds the netdev mutex via netdev_lock_ops. Meanwhile, mana_create_txq() and mana_create_rxq() in mana_open() path call NAPI APIs (netif_napi_add_tx(), netif_napi_add_weight(), napi_enable()), which also try to acquire the same lock, risking deadlock. Similarly in the teardown path (mana_close()), netif_napi_disable() and netif_napi_del(), contend for the same lock. Switch to the _locked variants of these APIs to avoid deadlocks when the netdev_ops_lock is held. Fixes: d4c22ec680c8 ("net: hold netdev instance lock during ndo_open/ndo_stop") Signed-off-by: Erni Sri Satya Vennela Reviewed-by: Haiyang Zhang Reviewed-by: Shradha Gupta Reviewed-by: Saurabh Singh Sengar Reviewed-by: Long Li Link: https://patch.msgid.link/1750144656-2021-2-git-send-email-ernis@linux.microsoft.com Signed-off-by: Paolo Abeni commit a59a271769149f0b8258507276f3d2a24370cbdb Author: Luca Ceresoli Date: Wed May 28 11:29:36 2025 +0200 drm/bridge: tc358767: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Converting this driver is a bit complex because the drm_bridge funcs pointer differs based on the bridge mode. So the current code does: * tc_probe() * devm_kzalloc() private struct embedding drm_bridge * call tc_probe_bridge_endpoint() which * parses DT description into struct fields * computes the mode * calls different bridge init functions based on the mode * each sets a different bridge.funcs pointer The new API expects the funcs pointer to be known at alloc time, which does not fit in the current code structure. Solve this by splitting tc_probe_bridge_endpoint() in two functions: * tc_probe_get_mode(), computing the mode without needing the private driver structure * tc_probe_bridge_endpoint(), only initializing the endpoints So now the mode is known before allocation and so is the funcs pointer, while all other operations are still happening after allocation, directly into the private struct data, as they used to. The new code flow is: * tc_probe() * tc_probe_get_mode() * parses DT description * computes and returns the mode * based onf the mode, pick the funcs pointer * devm_drm_bridfge_alloc(..., funcs) * call tc_probe_bridge_endpoint() which * calls different bridge init functions based on the mode * these don't set the funcs pointer, it was done by _alloc This solution is chosen to minimize the changes in the driver logical code flow. The drawback is we now iterate twice over the endpoints during probe. Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250528-drm-bridge-convert-to-alloc-api-v4-1-f04e698c9a77@bootlin.com Signed-off-by: Luca Ceresoli commit 1a69c63fdf1c9095e132096081e27ac85a4d48a5 Author: Hans Zhang <18255117159@163.com> Date: Sat Jun 7 23:49:13 2025 +0800 PCI: rockchip: Remove redundant PCIe message routing definitions The Rockchip driver contains duplicated message routing and INTx code definitions (e.g., ROCKCHIP_PCIE_MSG_ROUTING_TO_RC, ROCKCHIP_PCIE_MSG_CODE_ASSERT_INTA). These are already provided by the PCI core in drivers/pci/pci.h as PCIE_MSG_TYPE_R_RC and PCIE_MSG_CODE_ASSERT_INTA, respectively. Remove the driver-specific definitions in favor of the core definitions instead. This aligns the driver with the PCIe specification and reduces maintenance overhead. Signed-off-by: Hans Zhang <18255117159@163.com> [mani: commit message rewording] Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250607154913.805027-3-18255117159@163.com commit f28413fe0899591492d8ca3cdf5fd35558d9c05d Author: Hans Zhang <18255117159@163.com> Date: Sat Jun 7 23:49:12 2025 +0800 PCI: cadence: Replace private message routing enums with PCI core definitions The Cadence driver previously defined its own message routing enums (e.g., MSG_ROUTING_LOCAL) and message codes, which duplicated existing PCI core macros (PCIE_MSG_TYPE_R_LOCAL, PCIE_MSG_CODE_ASSERT_INTA, etc.) in drivers/pci/pci.h. These core definitions align with the PCIe r6.0 spec. Remove the driver-specific enums and switch to the centralized PCI core macros. This eliminates redundancy, ensures consistency, and simplifies future updates. No functional changes are introduced. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250607154913.805027-2-18255117159@163.com commit f769b3db24fa9ef48abcb515c50de1abeeaa0281 Author: Christian Brauner Date: Wed Jun 18 22:53:45 2025 +0200 pidfs: make inodes mutable Prepare for allowing extended attributes to be set on pidfd inodes by allowing them to be mutable. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-11-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit c007d95221397eda24e7d6b4ac5a5d699ea2f1ca Author: Christian Brauner Date: Wed Jun 18 22:53:44 2025 +0200 libfs: prepare to allow for non-immutable pidfd inodes Allow for S_IMMUTABLE to be stripped so that we can support xattrs. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-10-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit d718249bbac664c24a34ed472d627381d4505e00 Author: Christian Brauner Date: Wed Jun 18 22:53:43 2025 +0200 pidfs: remove pidfs_pid_valid() The validation is now completely handled in path_from_stashed(). Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-9-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 180d8b4ce91fe0cf7a9cb236bb01f14587ba4bf0 Author: Thomas Gleixner Date: Mon May 19 10:33:32 2025 +0200 timekeeping: Add AUX offset to struct timekeeper This offset will be used in the time getters of auxiliary clocks. It is added to the "monotonic" clock readout. As auxiliary clocks do not utilize the offset fields of the core time keeper, this is just an alias for offs_tai, so that the cache line layout stays the same. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083026.533486349@linutronix.de commit 804d6794497e6f3992d156e07d01e22b037ce09e Author: Christian Brauner Date: Wed Jun 18 22:53:42 2025 +0200 pidfs: remove pidfs_{get,put}_pid() Now that we stash persistent information in struct pid there's no need to play volatile games with pinning struct pid via dentries in pidfs. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-8-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit c85f5ab60820bde1510110e403d17456fbb8c266 Author: Thomas Gleixner Date: Mon May 19 10:33:31 2025 +0200 ntp: Use ktime_get_ntp_seconds() Use ktime_get_ntp_seconds() to prepare for auxiliary clocks so that the readout becomes per timekeeper. Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250519083026.472512636@linutronix.de commit 0f93d71b9d17a8b3fcb38b5e66ac5bd94f56a8de Author: Christian Brauner Date: Wed Jun 18 22:53:41 2025 +0200 pidfs: remove custom inode allocation We don't need it anymore as persistent information is allocated lazily and stashed in struct pid. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-7-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 5ee83f8d1af4d069475eabd9a5ed551b3d2cf9a8 Author: Christian Brauner Date: Wed Jun 18 22:53:40 2025 +0200 pidfs: remove unused members from struct pidfs_inode We've moved persistent information to struct pid. So there's no need for these anymore. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-6-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 8ec7c826d97b390879df2a03dfb035c70af86779 Author: Christian Brauner Date: Wed Jun 18 22:53:39 2025 +0200 pidfs: persist information Persist exit and coredump information independent of whether anyone currently holds a pidfd for the struct pid. The current scheme allocated pidfs dentries on-demand repeatedly. This scheme is reaching it's limits as it makes it impossible to pin information that needs to be available after the task has exited or coredumped and that should not be lost simply because the pidfd got closed temporarily. The next opener should still see the stashed information. This is also a prerequisite for supporting extended attributes on pidfds to allow attaching meta information to them. If someone opens a pidfd for a struct pid a pidfs dentry is allocated and stashed in pid->stashed. Once the last pidfd for the struct pid is closed the pidfs dentry is released and removed from pid->stashed. So if 10 callers create a pidfs dentry for the same struct pid sequentially, i.e., each closing the pidfd before the other creates a new one then a new pidfs dentry is allocated every time. Because multiple tasks acquiring and releasing a pidfd for the same struct pid can race with each another a task may still find a valid pidfs entry from the previous task in pid->stashed and reuse it. Or it might find a dead dentry in there and fail to reuse it and so stashes a new pidfs dentry. Multiple tasks may race to stash a new pidfs dentry but only one will succeed, the other ones will put their dentry. The current scheme aims to ensure that a pidfs dentry for a struct pid can only be created if the task is still alive or if a pidfs dentry already existed before the task was reaped and so exit information has been was stashed in the pidfs inode. That's great except that it's buggy. If a pidfs dentry is stashed in pid->stashed after pidfs_exit() but before __unhash_process() is called we will return a pidfd for a reaped task without exit information being available. The pidfds_pid_valid() check does not guard against this race as it doens't sync at all with pidfs_exit(). The pid_has_task() check might be successful simply because we're before __unhash_process() but after pidfs_exit(). Introduce a new scheme where the lifetime of information associated with a pidfs entry (coredump and exit information) isn't bound to the lifetime of the pidfs inode but the struct pid itself. The first time a pidfs dentry is allocated for a struct pid a struct pidfs_attr will be allocated which will be used to store exit and coredump information. If all pidfs for the pidfs dentry are closed the dentry and inode can be cleaned up but the struct pidfs_attr will stick until the struct pid itself is freed. This will ensure minimal memory usage while persisting relevant information. The new scheme has various advantages. First, it allows to close the race where we end up handing out a pidfd for a reaped task for which no exit information is available. Second, it minimizes memory usage. Third, it allows to remove complex lifetime tracking via dentries when registering a struct pid with pidfs. There's no need to get or put a reference. Instead, the lifetime of exit and coredump information associated with a struct pid is bound to the lifetime of struct pid itself. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-5-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 75215c972581d3934e76a57690cf838d7ceab399 Author: Christian Brauner Date: Wed Jun 18 22:53:38 2025 +0200 pidfs: move to anonymous struct Move the pidfs entries to an anonymous struct. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-4-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 23cdee615c4fdad1a8ec6f317b3c294cb37d662d Author: Christian Brauner Date: Wed Jun 18 22:53:37 2025 +0200 libfs: massage path_from_stashed() Make it a littler easier to follow. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-3-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit bda3f1608d993419fa247dc11263fc931ceca58a Author: Christian Brauner Date: Wed Jun 18 22:53:36 2025 +0200 libfs: massage path_from_stashed() to allow custom stashing behavior * Add a callback to struct stashed_operations so it's possible to implement custom behavior for pidfs and allow for it to return errors. * Teach stashed_dentry_get() to handle error pointers. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-2-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit ffa0519baaed48ca953bd201e1b17f15dae21b2d Author: Thomas Gleixner Date: Mon May 19 10:33:30 2025 +0200 timekeeping: Provide ktime_get_ntp_seconds() ntp_adjtimex() requires access to the actual time keeper per timekeeper ID. Provide an interface. Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250519083026.411809421@linutronix.de commit 1a1ad73aa1a66787f05f7f10f686b74bab77be72 Author: Christian Brauner Date: Wed Jun 18 22:53:35 2025 +0200 pidfs: raise SB_I_NODEV and SB_I_NOEXEC Similar to commit 1ed95281c0c7 ("anon_inode: raise SB_I_NODEV and SB_I_NOEXEC"): it shouldn't be possible to execute pidfds via execveat(fd_anon_inode, "", NULL, NULL, AT_EMPTY_PATH) so raise SB_I_NOEXEC so that no one gets any creative ideas. Also raise SB_I_NODEV as we don't expect or support any devices on pidfs. Link: https://lore.kernel.org/20250618-work-pidfs-persistent-v2-1-98f3456fd552@kernel.org Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 22c62b9a84b8f16ca0277e133a0cd62a259fee7c Author: Anna-Maria Behnsen Date: Mon May 19 10:33:28 2025 +0200 timekeeping: Introduce auxiliary timekeepers Provide timekeepers for auxiliary clocks and initialize them during boot. Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083026.350061049@linutronix.de commit 6168024604236cb2bb1004ea8459c8ece2c4ef5f Author: Thomas Gleixner Date: Mon May 19 10:33:27 2025 +0200 timekeeping: Add clock_valid flag to timekeeper In preparation for supporting independent auxiliary timekeepers, add a clock valid field and set it to true for the system timekeeper. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083026.287145536@linutronix.de commit 8c782acd3f47e21f9b03fd3720172d1f8e4fb796 Author: Thomas Gleixner Date: Mon May 19 10:33:26 2025 +0200 timekeeping: Prepare timekeeping_update_from_shadow() Don't invoke the VDSO and paravirt updates when utilized for auxiliary clocks. This is a temporary workaround until the VDSO and paravirt interfaces have been worked out. Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250519083026.223876435@linutronix.de commit 926ad475169f5b24868438e4bff61ec6a73efd19 Author: Anna-Maria Behnsen Date: Mon May 19 10:33:25 2025 +0200 timekeeping: Make __timekeeping_advance() reusable In __timekeeping_advance() the pointer to struct tk_data is hardcoded by the use of &tk_core. As long as there is only a single timekeeper (tk_core), this is not a problem. But when __timekeeping_advance() will be reused for per auxiliary timekeepers, __timekeeping_advance() needs to be generalized. Add a pointer to struct tk_data as function argument of __timekeeping_advance() and adapt all call sites. Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083026.160967312@linutronix.de commit c7ebfbc440151ae4a66a03b0f879cbece45174c8 Author: Thomas Gleixner Date: Mon May 19 10:33:23 2025 +0200 ntp: Rename __do_adjtimex() to ntp_adjtimex() Clean up the name space. No functional change. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083026.095637820@linutronix.de commit 5ffa25f573cf524ff53660c5ff7a158ee10f23c7 Author: Thomas Gleixner Date: Mon May 19 10:33:22 2025 +0200 ntp: Add timekeeper ID arguments to public functions In preparation for supporting auxiliary POSIX clocks, add a timekeeper ID to the relevant functions. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083026.032425931@linutronix.de commit 8515714b0f88a698a4c26f0f0ce7d43ad14dce16 Author: Thomas Gleixner Date: Mon May 19 10:33:21 2025 +0200 ntp: Add support for auxiliary timekeepers If auxiliary clocks are enabled, provide an array of NTP data so that the auxiliary timekeepers can be steered independently of the core timekeeper. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083025.969000914@linutronix.de commit 9094c72c3d81bf2416b7c79d12c8494ab8fbac20 Author: Anna-Maria Behnsen Date: Mon May 19 10:33:20 2025 +0200 time: Introduce auxiliary POSIX clocks To support auxiliary timekeeping and the related user space interfaces, it's required to define a clock ID range for them. Reserve 8 auxiliary clock IDs after the regular timekeeping clock ID space. This is the maximum number of auxiliary clocks the kernel can support. The actual number of supported clocks depends obviously on the presence of related devices and might be constraint by the available VDSO space. Add the corresponding timekeeper IDs as well. Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083025.905800695@linutronix.de commit f12b45862c4dcb9c2937b83ed730e473b9a76cbf Author: Anna-Maria Behnsen Date: Mon May 19 10:33:19 2025 +0200 timekeeping: Introduce timekeeper ID As long as there is only a single timekeeper, there is no need to clarify which timekeeper is used. But with the upcoming reusage of the timekeeper infrastructure for auxiliary clock timekeepers, an ID is required to differentiate. Introduce an enum for timekeeper IDs, introduce a field in struct tk_data to store this timekeeper id and add also initialization. The id struct field is added at the end of the second cachline, as there is a 4 byte hole anyway. Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083025.842476378@linutronix.de commit 7e55b6ba1fe6987638160e5f8216288f38043759 Author: Thomas Gleixner Date: Mon May 19 10:33:17 2025 +0200 timekeeping: Avoid double notification in do_adjtimex() Consolidate do_adjtimex() so that it does not notify about clock changes twice. Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250519083025.779267274@linutronix.de commit 506a54a0316ee4854b0ed113a8001477f5211d50 Author: Thomas Gleixner Date: Mon May 19 10:33:16 2025 +0200 timekeeping: Cleanup kernel doc of __ktime_get_real_seconds() Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083025.715836017@linutronix.de commit 990518eb3a71c357ca4ff1ad3e747fb844d8094c Author: Thomas Gleixner Date: Mon May 19 10:33:15 2025 +0200 timekeeping: Remove hardcoded access to tk_core This was overlooked in the initial conversion. Use the provided pointer to access the shadow timekeeper. Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250519083025.652611452@linutronix.de commit 2756b7f08ff6ca7c68c8c7dd61c8dc6895c9de34 Author: Jyri Sarha Date: Thu Jun 19 15:11:21 2025 +0300 ASoC: SOF: ipc4-pcm: Harmonize sof_ipc4_set_pipeline_state() dbg print Harmonize sof_ipc4_set_pipeline_state() dbg print with the new print in sof_ipc4_set_multi_pipeline_state(). Signed-off-by: Jyri Sarha Reviewed-by: Péter Ujfalusi Reviewed-by: Guennadi Liakhovetski Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20250619121121.25241-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 0e57fa20678d2d2dc0f047f052bb509c8f3ebc3b Author: Jyri Sarha Date: Thu Jun 19 15:11:20 2025 +0300 ASoC: SOF: ipc4-pcm: Pipe instances to dev_dbg in multi_pipeline_state() Add a dev_dbg to sof_ipc4_set_multi_pipeline_state(). The debug print lists the pipeline instance numbers that are included in the SOF_IPC4_GLB_SET_PIPELINE_STATE message. Without this log its very hard to tell what pipelines are affected. This print is very helpful when analyzing SOF logs automatically. Signed-off-by: Jyri Sarha Reviewed-by: Péter Ujfalusi Reviewed-by: Guennadi Liakhovetski Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20250619121121.25241-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit ecd41e0e2581d60f5268ad662065d17e0f049539 Author: Jyri Sarha Date: Thu Jun 19 15:11:19 2025 +0300 ASoC: SOF: ipc4: Add sof_ipc4_pipeline_state_str() for debugging Add sof_ipc4_pipeline_state_str() to translate enum sof_ipc4_pipeline_state into human readable form. Signed-off-by: Jyri Sarha Reviewed-by: Péter Ujfalusi Reviewed-by: Guennadi Liakhovetski Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Signed-off-by: Peter Ujfalusi Link: https://patch.msgid.link/20250619121121.25241-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit ace9b3daf2b4778358573d3698e34cb1c0fa7e14 Author: Peter Ujfalusi Date: Thu Jun 19 13:56:23 2025 +0300 ASoC: SOF: ipc4/Intel: Add support for library restore firmware functionality The firmware will be able to only save and restore the context related to library management. This means that even without a full context save, the libraries do not need to be re-loaded to the firmware after second or consecutive boots. This is reported via the FW_READY notification, where BIT(15) indicates: 0 - the library restore is not done 1 - library restore is done This bit is only valid if full context save is not enabled, full context save is by definition saves and restores the library related book-keeping as well. Add a new flag to tell the platform code if the libraries have been restored, no need to reload them after boot. Signed-off-by: Peter Ujfalusi Reviewed-by: Guennadi Liakhovetski Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Kai Vehmanen Link: https://patch.msgid.link/20250619105623.4546-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit cec49fa47bccadb288fd984ef2a5c45e8a2e2099 Author: Peter Ujfalusi Date: Thu Jun 19 13:56:22 2025 +0300 ASoC: SOF: ipc4-priv: Add kernel doc for fw_context_save of sof_ipc4_fw_data The kernel documentation is missing entry for the fw_context_save. Signed-off-by: Peter Ujfalusi Reviewed-by: Guennadi Liakhovetski Reviewed-by: Liam Girdwood Reviewed-by: Ranjani Sridharan Reviewed-by: Bard Liao Reviewed-by: Kai Vehmanen Link: https://patch.msgid.link/20250619105623.4546-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit bb48117b79ebc39485f7306d09dc602981fe540f Author: Peter Ujfalusi Date: Thu Jun 19 11:42:22 2025 +0300 ASoC: Intel: sof_sdw: Implement add_dai_link to filter HDMI PCMs If the system does not have iDisp codec then mark the HDMI PCM link as ignore. This ensures that HDMI PCMs will not be created when there is no iDisp codec available. When iDisp codec is not present and the HDMI PCMs were created they were not operational, all operations would fail on them. With this patch it is possible to load the topology with HDMI links, but gives the ability to ignore them and thus prevent the creation of the nonworking PCM devices. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Liam Girdwood Reviewed-by: Kai Vehmanen Link: https://patch.msgid.link/20250619084222.559-5-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 86591907527effbfd99c038ffc06ca30bb4f6b64 Author: Peter Ujfalusi Date: Thu Jun 19 11:42:21 2025 +0300 ASoC: Intel: skl_hda_dsp_generic: Implement add_dai_link to filter HDMI PCMs If the system does not have iDisp codec then mark the HDMI PCM link as ignore. This ensures that HDMI PCMs will not be created when there is no iDisp codec available. When iDisp codec is not present and the HDMI PCMs were created they were not operational, all operations would fail on them. With this patch it is possible to load the topology with HDMI links, but gives the ability to ignore them and thus prevent the creation of the nonworking PCM devices. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Liam Girdwood Reviewed-by: Kai Vehmanen Link: https://patch.msgid.link/20250619084222.559-4-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 2d91cb261cac6d885954b8f5da28b5c176c18131 Author: Peter Ujfalusi Date: Thu Jun 19 11:42:20 2025 +0300 ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Liam Girdwood Reviewed-by: Kai Vehmanen Link: https://patch.msgid.link/20250619084222.559-3-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit cbf4e0fac347b78f1bcd29350b78184665ad487d Author: Peter Ujfalusi Date: Thu Jun 19 11:42:19 2025 +0300 ASoC: topology: Do not call snd_soc_remove_pcm_runtime() for ignored links If a link has been ignored then it is not even added. The snd_soc_get_pcm_runtime() will return NULL as the runtime will does not exist. We can just skip this step to avoid performing a lookup to do nothing. Signed-off-by: Peter Ujfalusi Reviewed-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Liam Girdwood Reviewed-by: Kai Vehmanen Link: https://patch.msgid.link/20250619084222.559-2-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown commit 738a6cf8fc51c3b7186c2fc9b2478fa4796ece52 Merge: e04c78d86a9699 2e3b37a7e48f8a Author: Christian Brauner Date: Tue Jun 17 13:35:29 2025 +0200 Merge patch series "convert the majority of file systems to mmap_prepare" Lorenzo Stoakes says: In commit c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"), a new hook for mmap was introduced - f_op->mmap_prepare(). This is preferred to the existing f_op->mmap() hook as it does require a VMA to be established yet, thus allowing the mmap logic to invoke this hook far, far earlier, prior to inserting a VMA into the virtual address space, or performing any other heavy handed operations. This allows for much simpler unwinding on error, and for there to be a single attempt at merging a VMA rather than having to possibly reattempt a merge based on potentially altered VMA state. Far more importantly, it prevents inappropriate manipulation of incompletely initialised VMA state, which is something that has been the cause of bugs and complexity in the past. The intent is to gradually deprecate f_op->mmap, and in that vein this series coverts the majority of file systems to using f_op->mmap_prepare. Prerequisite steps are taken - firstly ensuring all checks for mmap capabilities use the file_has_valid_mmap_hooks() helper rather than directly checking for f_op->mmap (which is now not a valid check) and secondly updating daxdev_mapping_supported() to not require a VMA parameter to allow ext4 and xfs to be converted. Commit bb666b7c2707 ("mm: add mmap_prepare() compatibility layer for nested file systems") handles the nasty edge-case of nested file systems like overlayfs, which introduces a compatibility shim to allow f_op->mmap_prepare() to be invoked from an f_op->mmap() callback. This allows for nested filesystems to continue to function correctly with all file systems regardless of which callback is used. Once we finally convert all file systems, this shim can be removed. As a result, ecryptfs, fuse, and overlayfs remain unaltered so they can nest all other file systems. We additionally do not update resctl - as this requires an update to remap_pfn_range() (or an alternative to it) which we defer to a later series, equally we do not update cramfs which needs a mixed mapping insertion with the same issue, nor do we update procfs, hugetlbfs, syfs or kernfs all of which require VMAs for internal state and hooks. We shall return to all of these later. * patches from https://lore.kernel.org/cover.1750099179.git.lorenzo.stoakes@oracle.com: fs: replace mmap hook with .mmap_prepare for simple mappings fs: convert most other generic_file_*mmap() users to .mmap_prepare() fs: convert simple use of generic_file_*_mmap() to .mmap_prepare() mm/filemap: introduce generic_file_*_mmap_prepare() helpers fs/xfs: transition from deprecated .mmap hook to .mmap_prepare fs/ext4: transition from deprecated .mmap hook to .mmap_prepare fs/dax: make it possible to check dev dax support without a VMA fs: consistently use file_has_valid_mmap_hooks() helper mm/nommu: use file_has_valid_mmap_hooks() helper mm: rename call_mmap/mmap_prepare to vfs_mmap/mmap_prepare Link: https://lore.kernel.org/cover.1750099179.git.lorenzo.stoakes@oracle.com Signed-off-by: Christian Brauner commit 2e3b37a7e48f8a52fb708cdbeec9d8af0a5af0c1 Author: Lorenzo Stoakes Date: Mon Jun 16 20:33:29 2025 +0100 fs: replace mmap hook with .mmap_prepare for simple mappings Since commit c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"), the f_op->mmap() hook has been deprecated in favour of f_op->mmap_prepare(). This callback is invoked in the mmap() logic far earlier, so error handling can be performed more safely without complicated and bug-prone state unwinding required should an error arise. This hook also avoids passing a pointer to a not-yet-correctly-established VMA avoiding any issues with referencing this data structure. It rather provides a pointer to the new struct vm_area_desc descriptor type which contains all required state and allows easy setting of required parameters without any consideration needing to be paid to locking or reference counts. Note that nested filesystems like overlayfs are compatible with an .mmap_prepare() callback since commit bb666b7c2707 ("mm: add mmap_prepare() compatibility layer for nested file systems"). In this patch we apply this change to file systems with relatively simple mmap() hook logic - exfat, ceph, f2fs, bcachefs, zonefs, btrfs, ocfs2, orangefs, nilfs2, romfs, ramfs and aio. Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/f528ac4f35b9378931bd800920fee53fc0c5c74d.1750099179.git.lorenzo.stoakes@oracle.com Acked-by: Damien Le Moal Reviewed-by: Jan Kara Reviewed-by: Viacheslav Dubeyko Signed-off-by: Christian Brauner commit 9d5403b1036cdcd4be0f9f5568612c0e60e73d79 Author: Lorenzo Stoakes Date: Mon Jun 16 20:33:28 2025 +0100 fs: convert most other generic_file_*mmap() users to .mmap_prepare() Update nearly all generic_file_mmap() and generic_file_readonly_mmap() callers to use generic_file_mmap_prepare() and generic_file_readonly_mmap_prepare() respectively. We update blkdev, 9p, afs, erofs, ext2, nfs, ntfs3, smb, ubifs and vboxsf file systems this way. Remaining users we cannot yet update are ecryptfs, fuse and cramfs. The former two are nested file systems that must support any underlying file ssytem, and cramfs inserts a mixed mapping which currently requires a VMA. Once all file systems have been converted to mmap_prepare(), we can then update nested file systems. Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/08db85970d89b17a995d2cffae96fb4cc462377f.1750099179.git.lorenzo.stoakes@oracle.com Signed-off-by: Christian Brauner commit dae01387e6a9bbce31f6c62839733ab8b63e16f3 Author: Mickaël Salaün Date: Fri Jun 6 13:08:09 2025 +0200 selftests/landlock: Add test to check rule tied to covered mount point This test checks that a rule on a directory used as a mount point does not grant access to the mount covering it. It is a generalization of the bind mount case in layout3_fs.hostfs.release_inodes [1] that tests hidden mount points. Cc: Günther Noack Cc: Song Liu Cc: Tingmao Wang Link: https://lore.kernel.org/r/20250606.zo5aekae6Da6@digikod.net [1] Link: https://lore.kernel.org/r/20250606110811.211297-1-mic@digikod.net Signed-off-by: Mickaël Salaün commit dc58130bc38f09b162aa3b216f8b8f1e0a56127b Author: Song Liu Date: Thu Jun 5 14:44:16 2025 -0700 selftests/landlock: Fix build of audit_test We are hitting build error on CentOS 9: audit_test.c:232:40: error: ‘O_CLOEXEC’ undeclared (...) Fix this by including fcntl.h. Signed-off-by: Song Liu Link: https://lore.kernel.org/r/20250605214416.1885878-1-song@kernel.org Fixes: 6b4566400a29 ("selftests/landlock: Add PID tests for audit records") Signed-off-by: Mickaël Salaün commit 94a7ce26428d3a7ceb46c503ed726160578b9fcc Author: Mickaël Salaün Date: Wed May 28 16:44:25 2025 +0200 selftests/landlock: Fix readlink check The audit_init_filter_exe() helper incorrectly checks the readlink(2) error because an unsigned integer is used to store the result. Use a signed integer for this check. Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/aDbFwyZ_fM-IO7sC@stanley.mountain Fixes: 6a500b22971c ("selftests/landlock: Add tests for audit flags and domain IDs") Reviewed-by: Günther Noack Link: https://lore.kernel.org/r/20250528144426.1709063-1-mic@digikod.net Signed-off-by: Mickaël Salaün commit 7dfd023dc7a9050554b28a16a31b8b06f76bb862 Author: Lad Prabhakar Date: Mon Jun 9 20:23:44 2025 +0100 dt-bindings: serial: renesas,rsci: Document RZ/N2H support Add documentation for the serial communication interface (RSCI) found on the Renesas RZ/N2H (R9A09G087) SoC. The RSCI IP on this SoC is identical to that on the RZ/T2H (R9A09G077) SoC. Therefore, "renesas,r9a09g077-rsci" is used as a fallback compatible string for RZ/N2H. Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250609192344.293317-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 33a2515abd45c64911955ff1da179589db54f99f Author: Joseph Tilahun Date: Mon Jun 9 23:56:53 2025 -0700 tty: serial: fix print format specifiers The serial info sometimes produces negative TX/RX counts. E.g.: 3: uart:FSL_LPUART mmio:0x02970000 irq:46 tx:-1595870545 rx:339619 RTS|CTS|DTR|DSR|CD It appears that the print format specifiers don't match with the types of the respective variables. E.g.: All of the fields in struct uart_icount are u32, but the format specifier used is %d, even though u32 is unsigned and %d is for signed integers. Update drivers/tty/serial/serial_core.c to use the proper format specifiers. Reference https://docs.kernel.org/core-api/printk-formats.html as the documentation for what format specifiers are the proper ones to use for a given C type. Signed-off-by: Joseph Tilahun Link: https://lore.kernel.org/r/20250610065653.3750067-1-jtilahun@astranis.com Signed-off-by: Greg Kroah-Hartman commit d574c5dc8cfe1fd1ddda6edb435f3b3f39155c52 Author: Dr. David Alan Gilbert Date: Sun Jun 8 16:46:54 2025 +0100 serial: Remove unused uart_get_console uart_get_console() has been unused since 2019's commit bd0d9d159988 ("serial: remove ks8695 driver") Remove it, and it's associated docs. Signed-off-by: "Dr. David Alan Gilbert" Acked-by: Randy Dunlap Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20250608154654.73994-1-linux@treblig.org Signed-off-by: Greg Kroah-Hartman commit 4fcc287f3c692450ffd91c72a19c58740494491a Author: Anup Kulkarni Date: Tue Jun 3 16:31:45 2025 +0530 serial: qcom-geni: Enable support for half-duplex mode Enable the use of the RTS pin for direction control in half-duplex modes to prevent data collisions. Utilize the rs485 structure and callbacks in the serial core framework to support half-duplex modes. Implement support for the TIOCSRS485 IOCTL value and the struct serial_rs485. Signed-off-by: Anup Kulkarni Link: https://lore.kernel.org/r/20250603110145.3835111-1-quic_anupkulk@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 341a22fa056ddc01341b5e2a1ca0dbe61fbdb1ea Author: Jyothi Kumar Seerapu Date: Fri May 23 16:07:21 2025 +0530 serial: qcom-geni: Add support for 8 Mbps baud rate Current GENI UART driver supports Max Baud rate up to 4 Mbps. Add support to increase maximum baud rate to 8 Mbps. Signed-off-by: Jyothi Kumar Seerapu Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250523103721.5042-1-quic_jseerapu@quicinc.com Signed-off-by: Greg Kroah-Hartman commit 9962d0433a86c7d1222206dff1f8eafaab6faafa Author: Xu Rao Date: Thu May 29 17:23:14 2025 +0800 usb: core: modify comments xhci_hc_driver has HCD_MEMORY just like ehci ohci xhci_hc_driver has HCD_MEMORY attributes,need to modify the comment Signed-off-by: Xu Rao Link: https://lore.kernel.org/r/20250529092314.135457-1-raoxu@uniontech.com Signed-off-by: Greg Kroah-Hartman commit 48ea23115887c12e53335ca2eddc0d0e3d99e5d9 Author: RubenKelevra Date: Wed Jun 18 18:47:43 2025 +0200 include: fsl_devices.h: drop unused, misspelled FLS_USB2_WORKAROUND_ENGCM09152 The macro was introduced in commit 69cb1ec4ce4d ("mxc_udc: add workaround for ENGcm09152 for i.MX35") on 2010-10-15, but its prefix was misspelled as **FLS_** instead of the usual **FSL_**. Its last in-tree user disappeared with commit a390bef7db1f ("usb: gadget: fsl_mxc_udc: Remove the driver") on 2020-12-10, so the macro has been completely unused since then. Remove the dead and wrongly named definition. Signed-off-by: RubenKelevra Link: https://lore.kernel.org/r/20250618164743.1916838-1-rubenkelevra@gmail.com Signed-off-by: Greg Kroah-Hartman commit 11992b41008328af0e6a01e13d08b48d6233624e Author: Xu Yang Date: Sat Jun 14 20:56:45 2025 +0800 usb: chipidea: imx: implement workaround for ERR051725 ERR051725: USB: With the USB controller configured as device mode, Clearing the RS bit of USBCMD register fails to cause USB device to be detached Description 1. USB controller working as high speed device mode with USB gadget function enabled 2. Cable plugged into USB host 3. Use case is software-controlled detach from USB device side The expected result is device side terminations removed, increase in USB signal amplitude, USB host detect device is detached. But the issue is that the clear RS bit of USBCMD register cannot cause device detach event. Workaround - Use the below steps to detach from the host: write USBCMD.RS = 0b write CTRL2[7:6] = 01b write CTRL2[8] = 1b - As CTRL2[8] is set at detach case, so attach the steps should add clear CTRL2[8]: write USBCMD.RS = 1b write CTRL2[8] = 0b Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250614125645.207732-4-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 1a76b634da5e2b9ff240a0639f4af4fd075c9093 Author: Xu Yang Date: Sat Jun 14 20:56:44 2025 +0800 usb: chipidea: imx: add imx_usbmisc_pullup() hook It's used to do other pullup related operations if needs. Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250614125645.207732-3-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit 78c76554c6b94dfa5e101b870f0c57b6c230503e Author: Xu Yang Date: Sat Jun 14 20:56:43 2025 +0800 usb: chipidea: udc: add CI_HDRC_CONTROLLER_PULLUP_EVENT event The device controller will send CI_HDRC_CONTROLLER_PULLUP_EVENT event when it's going to pullup or pulldown data line. Signed-off-by: Xu Yang Acked-by: Peter Chen Link: https://lore.kernel.org/r/20250614125645.207732-2-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman commit df9a825f330e76c72d1985bc9bdc4b8981e3d15f Author: Tomasz Michalec Date: Tue Jun 10 17:40:58 2025 +0200 usb: typec: intel_pmc_mux: Defer probe if SCU IPC isn't present If pmc_usb_probe is called before SCU IPC is registered, pmc_usb_probe will fail. Return -EPROBE_DEFER when pmc_usb_probe doesn't get SCU IPC device, so the probe function can be called again after SCU IPC is initialized. Signed-off-by: Tomasz Michalec Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250610154058.1859812-1-tmichalec@google.com Signed-off-by: Greg Kroah-Hartman commit 503bbde34cc3dd2acd231f277ba70c3f9ed22e59 Author: Oliver Neukum Date: Thu Jun 12 14:20:25 2025 +0200 usb: core: usb_submit_urb: downgrade type check Checking for the endpoint type is no reason for a WARN, as that can cause a reboot. A driver not checking the endpoint type must not cause a reboot, as there is just no point in this. We cannot prevent a device from doing something incorrect as a reaction to a transfer. Hence warning for a mere assumption being wrong is not sensible. Signed-off-by: Oliver Neukum Acked-by: Alan Stern Link: https://lore.kernel.org/r/20250612122149.2559724-1-oneukum@suse.com Signed-off-by: Greg Kroah-Hartman commit 7bf742b071c7ad8cdaae74a79c6af63f6447dada Author: Yuesong Li Date: Mon Jun 16 14:25:06 2025 +0800 usb: storage: reltek_cr: convert to use secs_to_jiffies Since commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()") has been introduced, we can use it to avoid scaling the time to msec Signed-off-by: Yuesong Li Link: https://lore.kernel.org/r/20250616062506.1074376-1-liyuesong@vivo.com Signed-off-by: Greg Kroah-Hartman commit c6445598d402ffb8d263913c9afd67a44ee3762d Author: Mihai Sain Date: Mon Jun 16 09:18:00 2025 +0300 usb: ohci-at91: Use dynamic device name for OHCI HCD creation Use the dynamic device name instead of the hardcoded string "at91" when creating the OHCI host controller driver. This ensures that the device name is more flexible and correctly reflects the actual device in the system. This will be in sync with ehci at91 driver. Before this patch: [root@sam9x75eb ~]$ dmesg | grep usb [ 1.464487] usb usb1: Manufacturer: Linux 6.16.0-rc2 ehci_hcd [ 1.470210] usb usb1: SerialNumber: 700000.usb-ehci [ 1.595683] usb usb2: Manufacturer: Linux 6.16.0-rc2 ohci_hcd [ 1.601406] usb usb2: SerialNumber: at91 After this patch: [root@sam9x75eb ~]$ dmesg | grep usb [ 1.464487] usb usb1: Manufacturer: Linux 6.16.0-rc2 ehci_hcd [ 1.470210] usb usb1: SerialNumber: 700000.usb-ehci [ 1.595683] usb usb2: Manufacturer: Linux 6.16.0-rc2 ohci_hcd [ 1.601406] usb usb2: SerialNumber: 600000.usb-ohci Signed-off-by: Mihai Sain Acked-by: Alan Stern Link: https://lore.kernel.org/r/20250616061759.3384-2-mihai.sain@microchip.com Signed-off-by: Greg Kroah-Hartman commit b86c175689afb611f305367864c0e782d50c79f2 Author: Chen Ni Date: Tue Jun 17 12:19:17 2025 +0800 usb: fsl-mph-dr-of: Remove unnecessary NULL check before clk_disable_unprepare() clk_disable_unprepare() already checks NULL by using IS_ERR_OR_NULL. Remove unneeded NULL check for clk here. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250617041917.1930885-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit a891b9aebcc7406fe2f439d184bac3948fb08645 Author: Chen Ni Date: Tue Jun 17 12:20:50 2025 +0800 usb: ohci-spear: Remove unnecessary NULL check before clk_disable_unprepare() clk_disable_unprepare() already checks NULL by using IS_ERR_OR_NULL. Remove unneeded NULL check for clk here. Signed-off-by: Chen Ni Acked-by: Alan Stern Link: https://lore.kernel.org/r/20250617042050.1930940-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 8fa23514f2d73193d2418f1913028c54adaf3cd5 Author: Dr. David Alan Gilbert Date: Mon Jun 9 01:43:19 2025 +0100 usb: typec: Remove unused ucsi_cci_str ucsi_cci_str() last use was removed in 2019 by commit 2ede55468ca8 ("usb: typec: ucsi: Remove the old API") Remove it. Signed-off-by: "Dr. David Alan Gilbert" Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250609004319.209143-1-linux@treblig.org Signed-off-by: Greg Kroah-Hartman commit 47c83f95f3e293a9e924a1ba41d782bb059bb954 Author: Dr. David Alan Gilbert Date: Mon Jun 9 00:56:17 2025 +0100 usb: core: Remove unused usb_unlink_anchored_urbs usb_unlink_anchored_urbs() has been unused since it's last use was removed in 2009 by commit 9b9c5aaeedfd ("ar9170: xmit code revamp") Remove it. Signed-off-by: "Dr. David Alan Gilbert" Acked-by: Randy Dunlap Link: https://lore.kernel.org/r/20250608235617.200731-1-linux@treblig.org Signed-off-by: Greg Kroah-Hartman commit 227280ad66ac50287a3ea8b8fd43b7c7a6eb09ac Author: Dr. David Alan Gilbert Date: Mon Jun 9 00:33:38 2025 +0100 usb: gadget: Remove unused usb_remove_config usb_remove_config() was added in 2012's commit Fixes: 51cce6fc155c ("usb: gadget: composite: Add usb_remove_config") but has remained unused. I see there was a use in drivers/staging/cch that was removed by commit 515e6dd20b3f ("Staging: ccg: delete it from the tree") but it had it's own copy of usb_remove_config() Remove it. Signed-off-by: "Dr. David Alan Gilbert" Link: https://lore.kernel.org/r/20250608233338.179894-3-linux@treblig.org Signed-off-by: Greg Kroah-Hartman commit efec475e5e20c594e10d42f73cf6803805ae14c9 Author: Dr. David Alan Gilbert Date: Mon Jun 9 00:33:37 2025 +0100 usb: gadget: config: Remove unused usb_gadget_config_buf usb_gadget_config_buf() has been unused since 2012's commit fa06920a3ece ("usb: gadget: Remove File-backed Storage Gadget (g_file_storage).") Remove it. Signed-off-by: "Dr. David Alan Gilbert" Link: https://lore.kernel.org/r/20250608233338.179894-2-linux@treblig.org Signed-off-by: Greg Kroah-Hartman commit bc9a0c68f2583e42ace81a9c229c158b7cdcb45b Author: Dr. David Alan Gilbert Date: Tue Jun 3 21:39:05 2025 +0100 usb: phy: tegra: Remove unused functions tegra_ehci_phy_restore_start() and tegra_ehci_phy_restore_end() last use was removed in 2013 by commit a4faa54e3aa2 ("USB: EHCI: tegra: remove all power management") tegra_usb_phy_preresume() and tegra_usb_phy_postresume() last use was removed in 2020 by commit c3590c7656fb ("usb: host: ehci-tegra: Remove the driver") (Although that one makes me wonder how much of the rest of the file is actually used) Remove both sets. Signed-off-by: "Dr. David Alan Gilbert" Link: https://lore.kernel.org/r/20250603203905.279307-1-linux@treblig.org Signed-off-by: Greg Kroah-Hartman commit b26fa800c53765ac2afd295e7652f584c794e21e Author: Wolfram Sang Date: Tue Jun 3 19:58:54 2025 +0200 usb: renesas_usbhs: use proper DMAENGINE API for termination dmaengine_terminate_all() is deprecated in favor of explicitly saying if it should be sync or async. Here, we want dmaengine_terminate_sync() because there is no other synchronization code in the driver to handle an async case. Signed-off-by: Wolfram Sang Cc: Yoshihiro Shimoda Link: https://lore.kernel.org/r/20250603180131.14579-4-wsa+renesas@sang-engineering.com Signed-off-by: Greg Kroah-Hartman commit 1c2d81bded1993bb2c7125a911db63612cdc8d40 Author: Yongbo Zhang Date: Mon May 26 12:34:33 2025 +0800 usb: typec: fusb302: fix scheduling while atomic when using virtio-gpio When the gpio irqchip connected to a slow bus(e.g., i2c bus or virtio bus), calling disable_irq_nosync() in top-half ISR handler will trigger the following kernel BUG: BUG: scheduling while atomic: RenderEngine/253/0x00010002 ... Call trace: dump_backtrace+0x0/0x1c8 show_stack+0x1c/0x2c dump_stack_lvl+0xdc/0x12c dump_stack+0x1c/0x64 __schedule_bug+0x64/0x80 schedule_debug+0x98/0x118 __schedule+0x68/0x704 schedule+0xa0/0xe8 schedule_timeout+0x38/0x124 wait_for_common+0xa4/0x134 wait_for_completion+0x1c/0x2c _virtio_gpio_req+0xf8/0x198 virtio_gpio_irq_bus_sync_unlock+0x94/0xf0 __irq_put_desc_unlock+0x50/0x54 disable_irq_nosync+0x64/0x94 fusb302_irq_intn+0x24/0x84 __handle_irq_event_percpu+0x84/0x278 handle_irq_event+0x64/0x14c handle_level_irq+0x134/0x1d4 generic_handle_domain_irq+0x40/0x68 virtio_gpio_event_vq+0xb0/0x130 vring_interrupt+0x7c/0x90 vm_interrupt+0x88/0xd8 __handle_irq_event_percpu+0x84/0x278 handle_irq_event+0x64/0x14c handle_fasteoi_irq+0x110/0x210 __handle_domain_irq+0x80/0xd0 gic_handle_irq+0x78/0x154 el0_irq_naked+0x60/0x6c This patch replaces request_irq() with devm_request_threaded_irq() to avoid the use of disable_irq_nosync(). Signed-off-by: Yongbo Zhang Reviewed-by: Heikki Krogerus Link: https://lore.kernel.org/r/20250526043433.673097-1-giraffesnn123@gmail.com Signed-off-by: Greg Kroah-Hartman commit 47c428fce0b41b15ab321d8ede871f780ccd038f Author: Jiayi Li Date: Tue Jun 3 15:10:45 2025 +0800 usb: core: Add 0x prefix to quirks debug output Use "0x%x" format for quirks debug print to clarify it's a hexadecimal value. Improves readability and consistency with other hex outputs. Signed-off-by: Jiayi Li Link: https://lore.kernel.org/r/20250603071045.3243699-1-lijiayi@kylinos.cn Signed-off-by: Greg Kroah-Hartman commit 43007b89fb2de746443fbbb84aedd1089afdf582 Author: Charalampos Mitrodimas Date: Mon Jun 2 18:26:17 2025 +0000 usb: misc: apple-mfi-fastcharge: Make power supply names unique When multiple Apple devices are connected concurrently, the apple-mfi-fastcharge driver fails to probe the subsequent devices with the following error: sysfs: cannot create duplicate filename '/class/power_supply/apple_mfi_fastcharge' apple-mfi-fastcharge 5-2.4.3.3: probe of 5-2.4.3.3 failed with error -17 This happens because the driver uses a fixed power supply name ("apple_mfi_fastcharge") for all devices, causing a sysfs name conflict when a second device is connected. Fix this by generating unique names using the USB bus and device number (e.g., "apple_mfi_fastcharge_5-12"). This ensures each connected device gets a unique power supply entry in sysfs. The change requires storing a copy of the power_supply_desc structure in the per-device mfi_device struct, since the name pointer needs to remain valid for the lifetime of the power supply registration. Fixes: 249fa8217b84 ("USB: Add driver to control USB fast charge for iOS devices") Signed-off-by: Charalampos Mitrodimas Link: https://lore.kernel.org/r/20250602-apple-mfi-fastcharge-duplicate-sysfs-v1-1-5d84de34fac6@posteo.net Signed-off-by: Greg Kroah-Hartman commit 1f25307c90dcadde6fa9d6f1faf23731f6931fd5 Author: Radhey Shyam Pandey Date: Wed Jun 4 00:23:38 2025 +0530 usb: dwc3: xilinx: set coherency mode for AMD versal adaptive platform If device is coherent or if DMA (direct memory access) is translated by an IOMMU then program USB2.0 IP to route transactions through the CCI for coherency even if the target of transaction is in low power domain (LPD). Signed-off-by: Radhey Shyam Pandey Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/1748976818-710088-1-git-send-email-radhey.shyam.pandey@amd.com Signed-off-by: Greg Kroah-Hartman commit 70627bf82e36e61c40c3315e1206e4ea4c02e668 Author: Radhey Shyam Pandey Date: Wed Jun 4 00:39:31 2025 +0530 usb: dwc3: xilinx: add shutdown callback Adds a shutdown callback to ensure that the XHCI stack is properly shutdown in reboot/shutdown path. In kexec flow, kernel_restart_prepare() performs actions necessary to prepare the system for a restart and invokes device_shutdown. To ensure proper shutdown attach the dwc3 shutdown implementation which mirrors the remove method. $ kexec -e xhci-hcd xhci-hcd.0.auto: remove, state 1 usb usb1: USB disconnect, device number 1 usb 1-1: USB disconnect, device number 6 xhci-hcd xhci-hcd.0.auto: USB bus 1 deregistered kexec_core: Starting new kernel Signed-off-by: Radhey Shyam Pandey Acked-by: Thinh Nguyen Link: https://lore.kernel.org/r/1748977771-714153-1-git-send-email-radhey.shyam.pandey@amd.com Signed-off-by: Greg Kroah-Hartman commit 58992bf32830220576a2419f911d62c578702458 Author: Bagas Sanjaya Date: Tue Jun 10 10:17:06 2025 +0700 Documentation: usb: gadget: Wrap remaining usage snippets in literal code block Several configfs usage snippets forget to be formatted as literal code blocks. These were outputted in htmldocs output as normal paragraph instead. In particular, snippet for custom string descriptors as added in 15a7cf8caabee4 ("usb: gadget: configfs: Support arbitrary string descriptors") is shown as single combined paragraph, rather than two command lines. Wrap them like the rest of snippets. Fixes: 5e654a4655c3 ("Documentation/usb: gadget_configfs") Fixes: d80b5005c5dd ("docs: usb: convert documents to ReST") Fixes: 15a7cf8caabe ("usb: gadget: configfs: Support arbitrary string descriptors") Signed-off-by: Bagas Sanjaya Acked-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250610031705.32774-2-bagasdotme@gmail.com Signed-off-by: Greg Kroah-Hartman commit 41edd08b669c842186fac81cb2357c94bc1e465a Author: Uwe Kleine-König Date: Sun Jun 8 00:47:46 2025 +0200 docs: usb: gadget: Reindent numbered list Paragraphs that are part of a numbered list must be indented to render correctly in html. Do that right here. There are only whitespace changes in this patch. Signed-off-by: Uwe Kleine-König Reviewed-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20250607224747.3653041-2-u.kleine-koenig@baylibre.com Signed-off-by: Greg Kroah-Hartman commit 783e15ddb54072bb9af89bffac9fba40a6ada72c Author: Chen Ni Date: Wed Jun 18 14:57:50 2025 +0800 usb: gadget: dummy_hcd: Use USB API functions rather than constants Use the function usb_endpoint_num() rather than constants. The Coccinelle semantic patch is as follows: @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bEndpointAddress & \(USB_ENDPOINT_NUMBER_MASK\|0x0f\)) + usb_endpoint_num(epd) Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250618065750.816965-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 1857571e4f50323da9f24f63b8095286d83d490c Author: Lad Prabhakar Date: Wed May 28 14:34:40 2025 +0100 dt-bindings: usb: renesas,usbhs: Add RZ/V2N SoC support Document the Renesas USBHS controller found on the Renesas RZ/V2N (R9A09G056) SoC. The USBHS block on RZ/V2N is functionally identical to the one on the RZ/G2L family, so no driver changes are needed. The existing "renesas,rzg2l-usbhs" fallback compatible will continue to be used for handling this IP. Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250528133440.168133-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Greg Kroah-Hartman commit 24214604d25beedf2a089bdd7bee8bb801880bcb Author: Chen Ni Date: Wed Jun 18 11:55:40 2025 +0800 usb: gadget: composite: Use USB API functions rather than constants Use the function usb_endpoint_num() rather than constants. The Coccinelle semantic patch is as follows: @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bEndpointAddress & \(USB_ENDPOINT_NUMBER_MASK\|0x0f\)) + usb_endpoint_num(epd) Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250618035540.290411-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit 100a9aa232fe634bdcca380f9d8aca9c64e66c40 Author: Chen Ni Date: Wed Jun 18 12:02:04 2025 +0800 usb: gadget: net2280: Use USB API functions rather than constants Use the function usb_endpoint_num() and usb_endpoint_type() rather than constants. The Coccinelle semantic patch is as follows: @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bEndpointAddress & \(USB_ENDPOINT_NUMBER_MASK\|0x0f\)) + usb_endpoint_num(epd) @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bmAttributes & \(USB_ENDPOINT_XFERTYPE_MASK\|3\)) + usb_endpoint_type(epd) Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250618040204.363383-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit d61b9060f9907e8f4bcb0577126f2523d10e6e66 Author: Chen Ni Date: Wed Jun 18 12:09:08 2025 +0800 usb: gadget: pch_udc: Use USB API functions rather than constants Use the function usb_endpoint_type() rather than constants. The Coccinelle semantic patch is as follows: @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bmAttributes & \(USB_ENDPOINT_XFERTYPE_MASK\|3\)) + usb_endpoint_type(epd) Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250618040908.408309-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit fd2f928a5f7bc2f95887478c25b817f6e2215f3d Author: Chen Ni Date: Wed Jun 18 12:12:22 2025 +0800 usb: gadget: udc-xilinx: Use USB API functions rather than constants Use the function usb_endpoint_num() and usb_endpoint_type() rather than constants. The Coccinelle semantic patch is as follows: @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bEndpointAddress & \(USB_ENDPOINT_NUMBER_MASK\|0x0f\)) + usb_endpoint_num(epd) @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bmAttributes & \(USB_ENDPOINT_XFERTYPE_MASK\|3\)) + usb_endpoint_type(epd) Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250618041222.408372-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit b0ef41f1640e618aa37aa08ca4cd2a32e63b3dcb Author: Chen Ni Date: Wed Jun 18 15:02:16 2025 +0800 usb: gadget: f_fs: Use USB API functions rather than constants Use the function usb_endpoint_num() rather than constants. The Coccinelle semantic patch is as follows: @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bEndpointAddress & \(USB_ENDPOINT_NUMBER_MASK\|0x0f\)) + usb_endpoint_num(epd) Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250618070216.817034-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit a4e668fd49997a1bee92af413f2f19b1471ef623 Author: Chen Ni Date: Wed Jun 18 15:07:14 2025 +0800 usb: gadget: m66592-udc: Use USB API functions rather than constants Use the function usb_endpoint_num() and usb_endpoint_type() rather than constants. The Coccinelle semantic patch is as follows: @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bEndpointAddress & \(USB_ENDPOINT_NUMBER_MASK\|0x0f\)) + usb_endpoint_num(epd) @@ struct usb_endpoint_descriptor *epd; @@ - (epd->bmAttributes & \(USB_ENDPOINT_XFERTYPE_MASK\|3\)) + usb_endpoint_type(epd) Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250618070714.817146-1-nichen@iscas.ac.cn Signed-off-by: Greg Kroah-Hartman commit d3623dd5bd4e1fc9acfc08dd0064658bbbf1e8de Author: Guillaume Nault Date: Mon Jun 16 13:58:29 2025 +0200 ipv6: Simplify link-local address generation for IPv6 GRE. Since commit 3e6a0243ff00 ("gre: Fix again IPv6 link-local address generation."), addrconf_gre_config() has stopped handling IP6GRE devices specially and just calls the regular addrconf_addr_gen() function to create their link-local IPv6 addresses. We can thus avoid using addrconf_gre_config() for IP6GRE devices and use the normal IPv6 initialisation path instead (that is, jump directly to addrconf_dev_config() in addrconf_init_auto_addrs()). See commit 3e6a0243ff00 ("gre: Fix again IPv6 link-local address generation.") for a deeper explanation on how and why GRE devices started handling their IPv6 link-local address generation specially, why it was a problem, and why this is not even necessary in most cases (especially for GRE over IPv6). Signed-off-by: Guillaume Nault Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/a9144be9c7ec3cf09f25becae5e8fdf141fde9f6.1750075076.git.gnault@redhat.com Signed-off-by: Paolo Abeni commit 6ae58121126dcf8efcc2611f216a36a5e50b8ad9 Author: Pankaj Raghav Date: Wed Jun 18 09:58:21 2025 +0200 fs/buffer: remove comment about hard sectorsize Commit e1defc4ff0cf ("block: Do away with the notion of hardsect_size") changed hardsect_size to logical block size. The comment on top still says hardsect_size. Remove the comment as the code is pretty clear. While we are at it, format the relevant code. Reviewed-by: "Martin K. Petersen" Signed-off-by: Pankaj Raghav Link: https://lore.kernel.org/20250618075821.111459-1-p.raghav@samsung.com Reviewed-by: Daniel Gomez Signed-off-by: Christian Brauner commit f6be1f290c65cf99c703c4e2e4c951aee4af6de0 Author: Andrey Vatoropin Date: Mon Jun 16 04:50:44 2025 +0000 net/mlx4_en: Remove the redundant NULL check for the 'my_ets' object Static analysis shows that pointer "my_ets" cannot be NULL because it points to the object "struct ieee_ets". Remove the extra NULL check. It is meaningless and harms the readability of the code. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Andrey Vatoropin Reviewed-by: Tariq Toukan Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250616045034.26000-1-a.vatoropin@crpt.ru Signed-off-by: Paolo Abeni commit 4f9c81d64f030c1f3d96c5fd356cfb6e68ef9fc2 Author: Ankit Nautiyal Date: Wed Jun 18 18:39:51 2025 +0530 drm/i915/snps_hdmi_pll: Use clamp() instead of max(min()) The values of ana_cp_int, and ana_cp_prop are clamped between 1 and 127. Use the more intuitive and readable clamp() macro instead of using nested max(min(...)). Reviewed-by: Jani Nikula Signed-off-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250618130951.1596587-3-ankit.k.nautiyal@intel.com commit b300a175a11e6a934d728317dc39787723cc7917 Author: Ankit Nautiyal Date: Wed Jun 18 18:39:50 2025 +0530 drm/i915/snps_hdmi_pll: Fix 64-bit divisor truncation by using div64_u64 DIV_ROUND_CLOSEST_ULL uses do_div(), which expects a 32-bit divisor. When passing a 64-bit constant like CURVE2_MULTIPLIER, the value is silently truncated to u32, potentially leading to incorrect results on large divisors. Replace DIV_ROUND_CLOSEST_ULL with DIV64_U64_ROUND_CLOSEST which correctly handles full 64-bit division. v2: Use DIV64_U64_ROUND_CLOSEST instead of div64_u64 macro. (Jani) Fixes: 5947642004bf ("drm/i915/display: Add support for SNPS PHY HDMI PLL algorithm for DG2") Reported-by: Vas Novikov Closes: https://lore.kernel.org/all/8d7c7958-9558-4c8a-a81a-e9310f2d8852@gmail.com/ Cc: Ankit Nautiyal Cc: Suraj Kandpal Cc: Jani Nikula Cc: Vas Novikov Cc: stable@vger.kernel.org # v6.15+ Reviewed-by: Jani Nikula Signed-off-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250618130951.1596587-2-ankit.k.nautiyal@intel.com commit 6012ce6b30567aa8ec8dc5b648b7841f9f74ca7c Author: Richard Leitner Date: Tue Jun 17 09:31:37 2025 +0200 leds: led-class-flash:: Fix flash_timeout comment The comment for the flash_timeout setter mentioned it is the "flash duration". Fix this by changing it to "flash timeout". Signed-off-by: Richard Leitner Link: https://lore.kernel.org/r/20250617-ov9282-flash-strobe-v5-3-9762da74d065@linux.dev Signed-off-by: Lee Jones commit be8f5f88ef34123a73f6dc7eb931a2b587434d29 Author: Jani Nikula Date: Tue Jun 17 11:13:40 2025 +0300 drm/i915/plane: rename intel_atomic_add_affected_planes() to intel_plane_add_affected() Rename to follow filename based naming. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/c37bc557f831090c934b76d03485823bd45ebba8.1750147992.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit b603034fb1662fdcdf0bc3105d3e18e55c70e043 Author: Jani Nikula Date: Tue Jun 17 11:13:39 2025 +0300 drm/i915/plane: rename intel_atomic_check_planes() to intel_plane_atomic_check() Align with all the other atomic check functions. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/57c59e33e31fbea564f61c2ffaa81e979e33f106.1750147992.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 51c2590d2b2bfce2c8dd1acb81ff10b70da41ad2 Author: Jani Nikula Date: Tue Jun 17 11:13:38 2025 +0300 drm/i915/plane: make intel_plane_atomic_check() static and rename intel_plane_atomic_check() isn't used outside of intel_plane.c. Make it static. While at it, rename to vacate the name for subsequent changes. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/9da965c23c1485625d8713152751470ee758d540.1750147992.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 15af755f6e5c87706f8b3111c8a2a21cbb2b34b5 Author: Jani Nikula Date: Tue Jun 17 11:13:37 2025 +0300 drm/i915/plane: drop atomic from intel_atomic_plane_check_clipping() Align with intel_plane_check_src_coordinates(). The "atomic" is superfluous. Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/0bebd67e583b6ca56f788bd795ffe77db342e809.1750147992.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a649c2abfae0c68d07f127ff4e570c44636afe7e Author: Jani Nikula Date: Tue Jun 17 11:13:36 2025 +0300 drm/i915/plane: rename intel_atomic_plane.[ch] to intel_plane.[ch] It's all atomic, no need to emphasize this. v2: Also update Documentation/gpu/i915.rst (Gustavo) Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/ba5f304e9fe71723191d872e6828d461e1a572bd.1750147992.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit d9e496a9fb4021a9e6b11e7ba221a41a2597ac27 Author: Seungjin Bae Date: Thu Jun 19 01:57:47 2025 -0400 usb: host: xhci-plat: fix incorrect type for of_match variable in xhci_plat_probe() The variable `of_match` was incorrectly declared as a `bool`. It is assigned the return value of of_match_device(), which is a pointer of type `const struct of_device_id *`. Fixes: 16b7e0cccb243 ("USB: xhci-plat: fix legacy PHY double init") Signed-off-by: Seungjin Bae Link: https://lore.kernel.org/r/20250619055746.176112-2-eeodqql09@gmail.com Signed-off-by: Greg Kroah-Hartman commit 880e07d53849d4385ca952bc52075a98e675bc96 Author: Jani Nikula Date: Wed Jun 18 18:51:37 2025 +0300 drm/i915/vrr: fix register file style Fix indents, use of spaces vs. tabs, grouping, remove superfluous comments, remove some line continuations, wrap macro arguments in parens, rename dev_priv to display. This is the way. Cc: Ankit Nautiyal Cc: Mitul Golani Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250618155137.1651865-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 322892937b33b5942c5c276c6efb7a22dec27a03 Author: Ciprian Marian Costea Date: Mon May 26 19:50:41 2025 +0300 arm64: defconfig: add S32G RTC module support The RTC hardware module present on S32G based SoCs tracks clock time during system suspend and it is used as a wakeup source on S32G2/S32G3 architecture. Signed-off-by: Ciprian Marian Costea Signed-off-by: Shawn Guo commit 10bb7f09e346f152d2627e0b3619c402d64a50e9 Author: Abhinav Ananthu Date: Fri Jun 13 15:48:16 2025 +0530 rust: cpufreq: Ensure C ABI compatibility in all unsafe Update all `unsafe extern "C"` callback functions in the cpufreq module to use `kernel::ffi` types (`c_int`, `c_uint`, etc.) instead of Rust-native types like `i32`, `u32`, or `usize`. This change ensures that all Rust callbacks have signatures that are ABI-compatible with their corresponding C counterparts, which is critical for FFI correctness and safety. Suggested-by: Miguel Ojeda Link: https://github.com/Rust-for-Linux/linux/issues/1170 Signed-off-by: Abhinav Ananthu Signed-off-by: Viresh Kumar commit f431ab650c97350cccc57ac805eb51b593106d44 Author: Frank Li Date: Fri May 23 12:17:25 2025 -0400 ARM: dts: vf: vf610-zii-cfu1: rename node name *-gpio to *-gpios Rename node name *-gpio to *-gpios to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/vf/vf610-zii-cfu1.dtb: sfp (sff,sff): 'los-gpio', 'tx-disable-gpio' do not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 83b77c4a8989e6f1cfed5b8979f77e21e43e7c3c Author: Frank Li Date: Fri May 23 12:17:24 2025 -0400 ARM: dts: vf: vf-colibri-eval-v3: add power-supply for edt,et057090dhu Add power-supply for edt,et057090dhu to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/vf/vf610-colibri-eval-v3.dtb: panel (edt,et057090dhu): 'power-supply' is a required property Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 6a439583c776c82e388b205aae80d7c4aca05977 Author: Frank Li Date: Fri May 23 12:17:23 2025 -0400 ARM: dts: vf: rename io-expander@20 to pinctrl@20 Rename io-expander@20 to pinctrl@20 to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/vf/vf610-zii-dev-rev-c.dtb: sx1503@20 (semtech,sx1503q): $nodename:0: 'sx1503@20' does not match '^(pinctrl|pinmux)(@[0-9a-f]+)?$ Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit e7c6ed2f08e64f6bfbcff34db2aaff19f76a87ee Author: Frank Li Date: Fri May 23 12:17:22 2025 -0400 ARM: dts: vf: remove redundant layer under iomux Remove redundant layer under iomux and add grp surfix for pinmux node name to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/vf/vf610-colibri-eval-v3.dtb: pinctrl@40048000 (fsl,vf610-iomuxc): Unevaluated properties are not allowed ('vf610-colibri' was unexpected) Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit 08a7729d8d9bb40240689bf270452145cd996977 Author: Frank Li Date: Fri May 23 12:17:21 2025 -0400 ARM: dts: vf: remove redundant pinctrl-names Remove redundant pinctrl-names because no pinctrl-0 node to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/vf/vf610-zii-scu4-aib.dtb: i2c-mux@71 (nxp,pca9548): 'pinctrl-0' is a dependency of 'pinctrl-names Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit dd7ee6dbfb5f212171d50f47ba63f30409a2d1af Author: Frank Li Date: Fri May 23 12:17:20 2025 -0400 ARM: dts: vf: remove reg property for arm pmu Remove reg property for arm pmu to align binding doc and move it under root node to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/vf/vf610-zii-ssmb-dtu.dtb: pmu@40089000 (arm,cortex-a5-pmu): 'reg' does not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Frank Li Signed-off-by: Shawn Guo commit f3440dcf8b994197c968fbafe047ce27eed226e8 Author: Krzysztof Kozlowski Date: Fri May 23 09:19:22 2025 +0200 ARM: dts: vfxxx: Correctly use two tuples for timer address Address and size-cells are 1 and the ftm timer node takes two address spaces in "reg" property, so this should be in two <> tuples. Change has no functional impact, but original code is confusing/less readable. Fixes: 07513e1330a9 ("ARM: dts: vf610: Add Freescale FlexTimer Module timer node.") Signed-off-by: Krzysztof Kozlowski Signed-off-by: Shawn Guo commit 62be3d6e481122f02364993fee8322a681072918 Merge: 9a40347181c203 deefc7083414de Author: Linus Walleij Date: Thu Jun 19 09:17:10 2025 +0200 Merge tag 'gpio-mmio-bgpiof-no-input-flag-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into devel Immutable tag for the pinctrl tree to pull from Add the BGPIOF_NO_INPUT to the gpio-mmio API. Signed-off-by: Linus Walleij commit 9da895e97057ad946b2e727694af3fa5ee51d527 Author: Bartosz Golaszewski Date: Tue Jun 10 11:43:58 2025 +0200 platform: cznic: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Marek Behún Reviewed-by: Linus Walleij Acked-by: Marek Behún Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-platform-cznic-v1-1-30afd2444756@linaro.org Signed-off-by: Bartosz Golaszewski commit cbb887a76b788d8e9646fdd785f43745a3a662bb Author: Bartosz Golaszewski Date: Wed Jun 18 15:02:07 2025 +0200 gpio: mmio: don't use legacy GPIO chip setters We've converted this driver to using the new GPIO line value setters but missed the instances where the legacy callback is accessed directly using the function pointer. This will lead to a NULL-pointer dereference as this pointer is no longer populated. The issue needs fixing locally as well as in the already converted previously users of gpio-mmio. Fixes: b908d35d0003 ("gpio: mmio: use new GPIO line value setter callbacks") Reported-by: Klara Modin Closes: https://lore.kernel.org/all/2rw2sncevdiyirpdovotztlg77apcq2btzytuv5jnm55aqhlne@swtts3hl53tw/ Tested-by: Klara Modin Tested-by: Marek Szyprowski Tested-by: Mark Brown Link: https://lore.kernel.org/r/20250618-gpio-mmio-fix-setter-v1-2-2578ffb77019@linaro.org Signed-off-by: Bartosz Golaszewski commit 1fd7d210952938e8ef6d87287e056e25a2fc0547 Author: Bartosz Golaszewski Date: Wed Jun 18 15:02:06 2025 +0200 gpio: npcm-sgpio: don't use legacy GPIO chip setters We've converted this driver to using the new GPIO line value setters but missed the instance where the legacy callback is accessed directly using the function pointer. This will lead to a NULL-pointer dereference as this pointer is no longer populated. Fix it. Fixes: 0e1a8930c941 ("gpio: npcm-sgpio: use new GPIO line value setter callbacks") Link: https://lore.kernel.org/r/20250618-gpio-mmio-fix-setter-v1-1-2578ffb77019@linaro.org Signed-off-by: Bartosz Golaszewski commit 0a005148817cedf8181a0a1699d399d47358596a Merge: 7b20980ffc1151 deefc7083414de Author: Bartosz Golaszewski Date: Thu Jun 19 09:10:20 2025 +0200 Merge tag 'gpio-mmio-bgpiof-no-input-flag-for-v6.17' into gpio/for-next Immutable tag for the pinctrl tree to pull from Add the BGPIOF_NO_INPUT to the gpio-mmio API. commit 43ab245a9ec3837a0ca75c3ed9ba887d8e8b022e Author: Krzysztof Kozlowski Date: Fri Jun 13 09:16:44 2025 +0200 cpufreq: brcmstb-avs: Fully open-code compatible for grepping It is very useful to find driver implementing compatibles with `git grep compatible`, so driver should not use defines for that string, even if this means string will be effectively duplicated. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Florian Fainelli Signed-off-by: Viresh Kumar commit deefc7083414de81aad102b60f0390f600d7eb79 Author: Clément Le Goffic Date: Fri Jun 13 12:14:12 2025 +0200 gpio: mmio: add BGPIOF_NO_INPUT flag for GPO gpiochip When using bgpio_init with a gpiochip acting as a GPO (output only), the gpiochip ops `direction_input` was set to `bgpio_simple_dir_in` by default but we have no input ability. Adding this flag allows to set a valid ops for the `direction_output` ops without setting a valid ops for `direction_input` by default. Reviewed-by: Linus Walleij Signed-off-by: Clément Le Goffic Link: https://lore.kernel.org/r/20250613-hdp-upstream-v5-1-6fd6f0dc527c@foss.st.com Signed-off-by: Bartosz Golaszewski commit 897c0958808ac6b11a9715adef38682d7fa66229 Author: Sven Peter Date: Thu Jun 12 21:11:30 2025 +0000 cpufreq: apple: drop default ARCH_APPLE in Kconfig When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Signed-off-by: Sven Peter Signed-off-by: Viresh Kumar commit 0e18b1b106a29472ad7dab8eb97f4f24da870507 Author: Lukas Bulwahn Date: Mon Jun 16 16:01:08 2025 +0200 MAINTAINERS: adjust file entry in CPU HOTPLUG Commit c7f005f70d22 ("rust: cpu: Add CpuId::current() to retrieve current CPU ID") adds the file rust/helpers/cpu.c, and intends to add a file entry for that file in the MAINTAINERS section CPU HOTPLUG. However, the added file entry is rust/helper/cpu.c; note the subtle difference between the two file names. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Adjust the file entry to the intended file. Fixes: c7f005f70d22 ("rust: cpu: Add CpuId::current() to retrieve current CPU ID") Signed-off-by: Lukas Bulwahn Reviewed-by: Boqun Feng Signed-off-by: Viresh Kumar commit 24e67d28ef9590ea00a258e29a5107b11ce905a8 Author: Maud Spierings Date: Tue May 20 08:34:50 2025 +0200 dt-bindings: arm: fsl: Add GOcontroll Moduline Display Document the compatible strings for the Moduline Display controller. Acked-by: Rob Herring (Arm) Signed-off-by: Maud Spierings Signed-off-by: Shawn Guo commit 40567fa4ef149838378497bbcc30cb2a83776460 Author: Haibo Chen Date: Tue May 20 11:46:14 2025 +0800 arm64: dts: add ngpios for vf610 compatible gpio controllers After commit da5dd31efd24 ("gpio: vf610: Switch to gpio-mmio"), the vf610 GPIO driver no longer uses the static number 32 for gc->ngpio. This allows users to configure the number of GPIOs per port. And some gpio controllers did have less pads. So add 'ngpios' here, this can save some memory when request bitmap, and also show user more accurate information when use gpio tools. Besides, some gpio controllers have hole in the gpio ranges, so use 'gpio-reserved-ranges' to cover that, then the gpioinfo tool show the correct result. Reviewed-by: Frank Li Signed-off-by: Haibo Chen Reviewed-by: Stefan Wahren Reviewed-by: Linus Walleij Signed-off-by: Shawn Guo commit 276c1170eb2c0fc3f7cdd2305a96ade97889646c Author: Haibo Chen Date: Tue May 20 11:46:13 2025 +0800 ARM: dts: add ngpios for vf610 compatible gpio controllers After commit da5dd31efd24 ("gpio: vf610: Switch to gpio-mmio"), the vf610 GPIO driver no longer uses the static number 32 for gc->ngpio. This allows users to configure the number of GPIOs per port. And some gpio controllers did have less pads. So add 'ngpios' here, this can save some memory when request bitmap, and also show user more accurate information when use gpio tools. Reviewed-by: Frank Li Signed-off-by: Haibo Chen Reviewed-by: Linus Walleij Signed-off-by: Shawn Guo commit 757639ac608e026995635740fbbb45873c4f4a18 Merge: a5b4e4f4d8394f 82566eb4ea5188 Author: Jakub Kicinski Date: Wed Jun 18 19:03:02 2025 -0700 Merge branch 'add-support-for-pse-budget-evaluation-strategy' Kory Maincent says: ==================== Add support for PSE budget evaluation strategy This series brings support for budget evaluation strategy in the PSE subsystem. PSE controllers can set priorities to decide which ports should be turned off in case of special events like over-current. This patch series adds support for two budget evaluation strategy. 1. Static Method: This method involves distributing power based on PD classification. It’s straightforward and stable, the PSE core keeping track of the budget and subtracting the power requested by each PD’s class. Advantages: Every PD gets its promised power at any time, which guarantees reliability. Disadvantages: PD classification steps are large, meaning devices request much more power than they actually need. As a result, the power supply may only operate at, say, 50% capacity, which is inefficient and wastes money. 2. Dynamic Method: To address the inefficiencies of the static method, vendors like Microchip have introduced dynamic power budgeting, as seen in the PD692x0 firmware. This method monitors the current consumption per port and subtracts it from the available power budget. When the budget is exceeded, lower-priority ports are shut down. Advantages: This method optimizes resource utilization, saving costs. Disadvantages: Low-priority devices may experience instability. The UAPI allows adding support for software port priority mode managed from userspace later if needed. Patches 1-2: Add support for interrupt event report in PSE core, ethtool and ethtool specs. Patch 3: Adds support for interrupt and event report in TPS23881 driver. Patches 4,5: Add support for PSE power domain in PSE core and ethtool. Patches 6-8: Add support for budget evaluation strategy in PSE core, ethtool and ethtool specs. Patches 9-11: Add support for port priority and power supplies in PD692x0 drivers. Patches 12,13: Add support for port priority in TPS23881 drivers. ==================== Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-0-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit 82566eb4ea518812f9ad51588b9c0af8a144f76c Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:12 2025 +0200 dt-bindings: net: pse-pd: ti,tps23881: Add interrupt description Add an interrupt property to the device tree bindings for the TI TPS23881 PSE controller. The interrupt is primarily used to detect classification and disconnection events, which are essential for managing the PSE controller in compliance with the PoE standard. Interrupt support is essential for the proper functioning of the TPS23881 controller. Without it, after a power-on (PWON), the controller will no longer perform detection and classification. This could lead to potential hazards, such as connecting a non-PoE device after a PoE device, which might result in magic smoke. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-13-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit 56cfc97635e9164395c9242f72746454347155ab Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:11 2025 +0200 net: pse-pd: tps23881: Add support for static port priority feature This patch enhances PSE callbacks by introducing support for the static port priority feature. It extends interrupt management to handle and report detection, classification, and disconnection events. Additionally, it introduces the pi_get_pw_req() callback, which provides information about the power requested by the Powered Devices. Interrupt support is essential for the proper functioning of the TPS23881 controller. Without it, after a power-on (PWON), the controller will no longer perform detection and classification. This could lead to potential hazards, such as connecting a non-PoE device after a PoE device, which might result in magic smoke. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-12-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit 2903001ee3b4be2e98d4da7f96f9edc4115cf2d3 Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:10 2025 +0200 dt-bindings: net: pse-pd: microchip,pd692x0: Add manager regulator supply Adds the regulator supply parameter of the managers. Update also the example as the regulator supply of the PSE PIs should be the managers itself and not an external regulator. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-11-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit 24a4e3a05dd0eadd0c9585c411880e5dcb6be97f Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:09 2025 +0200 net: pse-pd: pd692x0: Add support for controller and manager power supplies Add support for managing the VDD and VDDA power supplies for the PD692x0 PSE controller, as well as the VAUX5 and VAUX3P3 power supplies for the PD6920x PSE managers. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-10-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit 359754013e6a7fc81af6735ebbfedd4a01999f68 Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:08 2025 +0200 net: pse-pd: pd692x0: Add support for PSE PI priority feature This patch extends the PSE callbacks by adding support for the newly introduced pi_set_prio() callback, enabling the configuration of PSE PI priorities. The current port priority is now also included in the status information returned to users. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-9-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit eeb0c8f72f49a21984981188404cfd3700edbaff Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:07 2025 +0200 net: ethtool: Add PSE port priority support feature This patch expands the status information provided by ethtool for PSE c33 with current port priority and max port priority. It also adds a call to pse_ethtool_set_prio() to configure the PSE port priority. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-8-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit ffef61d6d27374542f1bce4452200d9bdd2e1edd Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:06 2025 +0200 net: pse-pd: Add support for budget evaluation strategies This patch introduces the ability to configure the PSE PI budget evaluation strategies. Budget evaluation strategies is utilized by PSE controllers to determine which ports to turn off first in scenarios such as power budget exceedance. The pis_prio_max value is used to define the maximum priority level supported by the controller. Both the current priority and the maximum priority are exposed to the user through the pse_ethtool_get_status call. This patch add support for two mode of budget evaluation strategies. 1. Static Method: This method involves distributing power based on PD classification. It’s straightforward and stable, the PSE core keeping track of the budget and subtracting the power requested by each PD’s class. Advantages: Every PD gets its promised power at any time, which guarantees reliability. Disadvantages: PD classification steps are large, meaning devices request much more power than they actually need. As a result, the power supply may only operate at, say, 50% capacity, which is inefficient and wastes money. Priority max value is matching the number of PSE PIs within the PSE. 2. Dynamic Method: To address the inefficiencies of the static method, vendors like Microchip have introduced dynamic power budgeting, as seen in the PD692x0 firmware. This method monitors the current consumption per port and subtracts it from the available power budget. When the budget is exceeded, lower-priority ports are shut down. Advantages: This method optimizes resource utilization, saving costs. Disadvantages: Low-priority devices may experience instability. Priority max value is set by the PSE controller driver. For now, budget evaluation methods are not configurable and cannot be mixed. They are hardcoded in the PSE driver itself, as no current PSE controller supports both methods. Signed-off-by: Kory Maincent (Dent Project) Acked-by: Oleksij Rempel Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-7-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit c394e757dedd9cf947f9ac470d615d28fd2b07d1 Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:05 2025 +0200 net: pse-pd: Add helper to report hardware enable status of the PI Refactor code by introducing a helper function to retrieve the hardware enabled state of the PI, avoiding redundant implementations in the future. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-6-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit 1176978ed851952652ddea3685e2f71a0e5d61ff Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:04 2025 +0200 net: ethtool: Add support for new power domains index description Report the index of the newly introduced PSE power domain to the user, enabling improved management of the power budget for PSE devices. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-5-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit 50f8b341d26826aa5fdccb8f497fbff2500934b3 Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:03 2025 +0200 net: pse-pd: Add support for PSE power domains Introduce PSE power domain support as groundwork for upcoming port priority features. Multiple PSE PIs can now be grouped under a single PSE power domain, enabling future enhancements like defining available power budgets, port priority modes, and disconnection policies. This setup will allow the system to assess whether activating a port would exceed the available power budget, preventing over-budget states proactively. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-4-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit f5e7aecaa4efcd4c85477b6a62f94fea668031db Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:02 2025 +0200 net: pse-pd: tps23881: Add support for PSE events and interrupts Add support for PSE event reporting through interrupts. Set up the newly introduced devm_pse_irq_helper helper to register the interrupt. Events are reported for over-current and over-temperature conditions. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-3-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit fc0e6db30941a66e284b8516b82356f97f31061d Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:01 2025 +0200 net: pse-pd: Add support for reporting events Add support for devm_pse_irq_helper() to register PSE interrupts and report events such as over-current or over-temperature conditions. This follows a similar approach to the regulator API but also sends notifications using a dedicated PSE ethtool netlink socket. Signed-off-by: Kory Maincent (Dent Project) Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-2-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit fa2f0454174c2f33005f5a6e6f70c7160a15b2a1 Author: Kory Maincent (Dent Project) Date: Tue Jun 17 14:12:00 2025 +0200 net: pse-pd: Introduce attached_phydev to pse control In preparation for reporting PSE events via ethtool notifications, introduce an attached_phydev field in the pse_control structure. This field stores the phy_device associated with the PSE PI, ensuring that notifications are sent to the correct network interface. The attached_phydev pointer is directly tied to the PHY lifecycle. It is set when the PHY is registered and cleared when the PHY is removed. There is no need to use a refcount, as doing so could interfere with the PHY removal process. Signed-off-by: Kory Maincent (Dent Project) Reviewed-by: Oleksij Rempel Link: https://patch.msgid.link/20250617-feature_poe_port_prio-v14-1-78a1a645e2ee@bootlin.com Signed-off-by: Jakub Kicinski commit a5b4e4f4d8394f2f6625732bd8f7cd8b425bdc21 Merge: 253833da4e5619 c9223021433d9b Author: Jakub Kicinski Date: Wed Jun 18 18:57:32 2025 -0700 Merge branch 'phc-support-in-ena-driver' David Arinzon says: ==================== PHC support in ENA driver This patchset adds the support for PHC (PTP Hardware Clock) in the ENA driver. The documentation part of the patchset includes additional information, including statistics, utilization and invocation examples through the testptp utility. ==================== Link: https://patch.msgid.link/20250617110545.5659-1-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit c9223021433d9b2d4ca32cf9e582e6908f08c3cb Author: David Arinzon Date: Tue Jun 17 14:05:45 2025 +0300 net: ena: Add PHC documentation Provide the relevant information and guidelines about the feature support in the ENA driver. Signed-off-by: Amit Bernstein Signed-off-by: David Arinzon Link: https://patch.msgid.link/20250617110545.5659-10-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit e14521e97b8341852d70ddb23e7cd94d04302d09 Author: David Arinzon Date: Tue Jun 17 14:05:44 2025 +0300 net: ena: View PHC stats using debugfs Add an entry named `phc_stats` to view the PHC statistics. If PHC is enabled, the stats are printed, as below: phc_cnt: 0 phc_exp: 0 phc_skp: 0 phc_err_dv: 0 phc_err_ts: 0 If PHC is disabled, no statistics will be displayed. Signed-off-by: David Arinzon Link: https://patch.msgid.link/20250617110545.5659-9-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit 60e28350b1ca127fe22dd99d5ff2a1922450e912 Author: David Arinzon Date: Tue Jun 17 14:05:43 2025 +0300 net: ena: Add debugfs support to the ENA driver Adding the base directory of debugfs to the driver. In order for the folder to be unique per driver instantiation, the chosen name is the device name. This commit contains the initialization and the base folder. The creation of the base folder may fail, but is considered non-fatal. Signed-off-by: David Arinzon Link: https://patch.msgid.link/20250617110545.5659-8-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit 816b52624cf6a03ea541956b448025d844a8287d Author: David Arinzon Date: Tue Jun 17 14:05:42 2025 +0300 net: ena: Control PHC enable through devlink Add the capability to set parameters through the devlink framework. The parameter used for controlling PHC (enable/disable) details are as follows: - Name: enable_phc - Type: Boolean (true - enable/false - disable) - Mode: DEVLINK_PARAM_CMODE_DRIVERINIT - Effect: Changes take place during driver initialization, any changes require a devlink reload to take effect. Signed-off-by: David Arinzon Link: https://patch.msgid.link/20250617110545.5659-7-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit cea465a96a294e7bc2537f27a737cfa7c6234b3d Author: David Arinzon Date: Tue Jun 17 14:05:41 2025 +0300 devlink: Add new "enable_phc" generic device param Add a new device generic parameter to enable/disable the PHC (PTP Hardware Clock) functionality in the device associated with the devlink instance. Signed-off-by: David Arinzon Reviewed-by: Jiri Pirko Link: https://patch.msgid.link/20250617110545.5659-6-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit 9d67d534e4e0db2cc8b6aeb450edbc997e2594d4 Author: David Arinzon Date: Tue Jun 17 14:05:40 2025 +0300 net: ena: Add devlink port support Add the basic functionality to support devlink port for devlink model completeness purposes. Current support is for registration/un-registration. Signed-off-by: David Arinzon Link: https://patch.msgid.link/20250617110545.5659-5-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit 15115b1a255404795158fa92a1cba87a9acff15d Author: David Arinzon Date: Tue Jun 17 14:05:39 2025 +0300 net: ena: Add device reload capability through devlink Adding basic devlink capability support of reloading the driver. This capability is required to support driver init type devlink params (DEVLINK_PARAM_CMODE_DRIVERINIT). Such params require reloading of the driver (destroy/restore sequence). The reloading is done by the devlink framework using the hooks provided by the driver. Signed-off-by: David Arinzon Link: https://patch.msgid.link/20250617110545.5659-4-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit 51d58804a53b341b785f9856d9ffec45e72108a3 Author: David Arinzon Date: Tue Jun 17 14:05:38 2025 +0300 net: ena: PHC silent reset Each PHC device kernel registration receives a unique kernel index, which is associated with a new PHC device file located at "/dev/ptp". This device file serves as an interface for obtaining PHC timestamps. Examples of tools that use "/dev/ptp" include testptp [1] and chrony [2]. A reset flow may occur in the ENA driver while PHC is active. During a reset, the driver will unregister and then re-register the PHC device with the kernel. Under race conditions, particularly during heavy PHC loads, the driver’s reset flow might complete faster than the kernel’s PHC unregister/register process. This can result in the PHC index being different from what it was prior to the reset, as the PHC index is selected using kernel ID allocation [3]. While driver rmmod/insmod are done by the user, a reset may occur at anytime, without the user awareness, consequently, the driver might receive a new PHC index after the reset, potentially compromising the user experience. To prevent this issue, the PHC flow will detect the reset during PHC destruction and will skip the PHC unregister/register calls to preserve the kernel PHC index. During the reset flow, any attempt to get a PHC timestamp will fail as expected, but the kernel PHC index will remain unchanged. [1]: https://github.com/torvalds/linux/blob/v6.1/tools/testing/selftests/ptp/testptp.c [2]: https://github.com/mlichvar/chrony [3]: https://www.kernel.org/doc/html/latest/core-api/idr.html Signed-off-by: Amit Bernstein Signed-off-by: David Arinzon Link: https://patch.msgid.link/20250617110545.5659-3-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit e0ea34158ee8c4f7536cd781010339ff28c0d24c Author: David Arinzon Date: Tue Jun 17 14:05:37 2025 +0300 net: ena: Add PHC support in the ENA driver The ENA driver will be extended to support the new PHC feature using ptp_clock interface [1]. this will provide timestamp reference for user space to allow measuring time offset between the PHC and the system clock in order to achieve nanosecond accuracy. [1] - https://www.kernel.org/doc/html/latest/driver-api/ptp.html Signed-off-by: Amit Bernstein Signed-off-by: David Arinzon Link: https://patch.msgid.link/20250617110545.5659-2-darinzon@amazon.com Signed-off-by: Jakub Kicinski commit 253833da4e5619afef6a5918ed63405b9fec9874 Merge: a33556940b5727 850d9248d2eac6 Author: Jakub Kicinski Date: Wed Jun 18 18:53:53 2025 -0700 Merge branch 'udp_tunnel-remove-rtnl_lock-dependency' Stanislav Fomichev says: ==================== udp_tunnel: remove rtnl_lock dependency Recently bnxt had to grow back a bunch of rtnl dependencies because of udp_tunnel's infra. Add separate (global) mutext to protect udp_tunnel state. ==================== Link: https://patch.msgid.link/20250616162117.287806-1-stfomichev@gmail.com Signed-off-by: Jakub Kicinski commit 850d9248d2eac662f869c766a598c877690c74e5 Author: Stanislav Fomichev Date: Mon Jun 16 09:21:17 2025 -0700 Revert "bnxt_en: bring back rtnl_lock() in the bnxt_open() path" This reverts commit 325eb217e41fa14f307c7cc702bd18d0bb38fe84. udp_tunnel infra doesn't need RTNL, should be safe to get back to only netdev instance lock. Cc: Michael Chan Reviewed-by: Aleksandr Loktionov Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250616162117.287806-7-stfomichev@gmail.com Signed-off-by: Jakub Kicinski commit e054c8ba3bce6b65aa81a894ad70a68fa34636a5 Author: Stanislav Fomichev Date: Mon Jun 16 09:21:16 2025 -0700 netdevsim: remove udp_ports_sleep Now that there is only one path in udp_tunnel, there is no need to have udp_ports_sleep knob. Remove it and adjust the test. Cc: Michael Chan Reviewed-by: Aleksandr Loktionov Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250616162117.287806-6-stfomichev@gmail.com Signed-off-by: Jakub Kicinski commit 3a321b6b1f76a46102ae9a3977f7fdb8bc7c6e22 Author: Stanislav Fomichev Date: Mon Jun 16 09:21:15 2025 -0700 net: remove redundant ASSERT_RTNL() in queue setup functions The existing netdev_ops_assert_locked() already asserts that either the RTNL lock or the per-device lock is held, making the explicit ASSERT_RTNL() redundant. Cc: Michael Chan Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250616162117.287806-5-stfomichev@gmail.com Signed-off-by: Jakub Kicinski commit 1ead7501094c6a61461c0c98dde9ec5660fa1e24 Author: Stanislav Fomichev Date: Mon Jun 16 09:21:14 2025 -0700 udp_tunnel: remove rtnl_lock dependency Drivers that are using ops lock and don't depend on RTNL lock still need to manage it because udp_tunnel's RTNL dependency. Introduce new udp_tunnel_nic_lock and use it instead of rtnl_lock. Drop non-UDP_TUNNEL_NIC_INFO_MAY_SLEEP mode from udp_tunnel infra (udp_tunnel_nic_device_sync_work needs to grab udp_tunnel_nic_lock mutex and might sleep). Cover more places in v4: - netlink - udp_tunnel_notify_add_rx_port (ndo_open) - triggers udp_tunnel_nic_device_sync_work - udp_tunnel_notify_del_rx_port (ndo_stop) - triggers udp_tunnel_nic_device_sync_work - udp_tunnel_get_rx_info (__netdev_update_features) - triggers NETDEV_UDP_TUNNEL_PUSH_INFO - udp_tunnel_drop_rx_info (__netdev_update_features) - triggers NETDEV_UDP_TUNNEL_DROP_INFO - udp_tunnel_nic_reset_ntf (ndo_open) - notifiers - udp_tunnel_nic_netdevice_event, depending on the event: - triggers NETDEV_UDP_TUNNEL_PUSH_INFO - triggers NETDEV_UDP_TUNNEL_DROP_INFO - ethnl_tunnel_info_reply_size - udp_tunnel_nic_set_port_priv (two intel drivers) Cc: Michael Chan Suggested-by: Jakub Kicinski Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20250616162117.287806-4-stfomichev@gmail.com Signed-off-by: Jakub Kicinski commit df5425b3bd8586c8c8de84ac3a5a874eb5fd4b33 Author: Stanislav Fomichev Date: Mon Jun 16 09:21:13 2025 -0700 vxlan: drop sock_lock We won't be able to sleep soon in vxlan_offload_rx_ports and won't be able to grab sock_lock. Instead of having separate spinlock to manage sockets, rely on rtnl lock. This is similar to how geneve manages its sockets. Signed-off-by: Stanislav Fomichev Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250616162117.287806-3-stfomichev@gmail.com Signed-off-by: Jakub Kicinski commit 3e14960f3bd2a9c7d631f2517f0f249d74bfa892 Author: Stanislav Fomichev Date: Mon Jun 16 09:21:12 2025 -0700 geneve: rely on rtnl lock in geneve_offload_rx_ports udp_tunnel_push_rx_port will grab mutex in the next patch so we can't use rcu. geneve_offload_rx_ports is called from geneve_netdevice_event for NETDEV_UDP_TUNNEL_PUSH_INFO and NETDEV_UDP_TUNNEL_DROP_INFO which both have ASSERT_RTNL. Entries are added to and removed from the sock_list under rtnl lock as well (when adding or removing a tunneling device). Signed-off-by: Stanislav Fomichev Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/20250616162117.287806-2-stfomichev@gmail.com Signed-off-by: Jakub Kicinski commit 2e090ae61fec0e7a8bfa447ee833ae4aa264ac17 Author: Rob Herring (Arm) Date: Tue May 20 19:47:11 2025 -0500 dt-bindings: clock: Convert alphascale,asm9260-clock-controller to DT schema Convert the Alphascale Clock Controller binding to DT schema format. Add the undocumented 'clocks' property which is used in DTS. Drop the clock defines and consumer examples from the old binding. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521004712.1793193-1-robh@kernel.org Reviewed-by: Oleksij Rempel Signed-off-by: Stephen Boyd commit cc33289129d4265c894b22f2cfefe0e66d24de80 Author: Rob Herring (Arm) Date: Wed May 21 16:18:39 2025 -0500 dt-bindings: clock: Convert marvell,armada-370-corediv-clock to DT schema Convert the Marvell Armada 3xx Core Divider clock binding to DT schema format. Add the missing "marvell,armada-390-corediv-clock" compatible and "clock-output-names" property. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521211840.77487-1-robh@kernel.org Signed-off-by: Stephen Boyd commit ed4ce1d92403191dc5edf7e117ffb8b89e0ec32c Author: Rob Herring (Arm) Date: Wed May 21 16:18:25 2025 -0500 dt-bindings: clock: Convert marvell,armada-3700-periph-clock to DT schema Convert the Marvell Armada 3700 peripheral clock binding to DT schema format. The north bridge is also a "syscon", so add the compatible to it. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521211826.77098-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 7cbc8535b2403ca554d1d0ee6fd2ea3aa33055c9 Author: Rob Herring (Arm) Date: Wed May 21 16:08:43 2025 -0500 dt-bindings: clock: Convert marvell,mvebu-core-clock to DT schema Convert the Marvell SoC core clock binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521210844.62613-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 75cc48275fbb90e9b51e8c56339f985a689b9485 Author: Rob Herring (Arm) Date: Wed May 21 16:08:37 2025 -0500 dt-bindings: clock: Convert marvell,berlin2-clk to DT schema Convert the Marvell Berlin2 clock binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521210839.62409-1-robh@kernel.org Signed-off-by: Stephen Boyd commit e3fcba910a05350fc292d1ba209cb4d5f1f0be87 Author: Rob Herring (Arm) Date: Wed May 21 16:08:31 2025 -0500 dt-bindings: clock: Convert marvell,dove-divider-clock to DT schema Convert the Marvell Dove PLL divider clock binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521210832.62177-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 9919d2a81ba6ed3e835bf7d2761b648e0b47707c Author: Rob Herring (Arm) Date: Wed May 21 16:08:25 2025 -0500 dt-bindings: clock: Convert marvell,armada-3700-tbg-clock to DT schema Convert the Marvell Armada 3700 TBG clock binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521210826.61957-1-robh@kernel.org Signed-off-by: Stephen Boyd commit e9a17eaaf18d9721b311675df00eaf142df3c726 Author: Rob Herring (Arm) Date: Wed May 21 16:08:11 2025 -0500 dt-bindings: clock: Convert marvell-armada-370-gating-clock to DT schema Convert the Marvell gating clock binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521210813.61484-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 12fa3aaf8b6ad1038a0a3c6a2e75316b531185c5 Author: Rob Herring (Arm) Date: Wed May 21 16:08:05 2025 -0500 dt-bindings: clock: Convert marvell,armada-xp-cpu-clock to DT schema Convert the Marvell Armada XP CPU clock binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521210806.61286-1-robh@kernel.org Signed-off-by: Stephen Boyd commit f139defc6b487c5d2f83d7a8938f476c762210fa Author: Rob Herring (Arm) Date: Wed May 21 16:07:49 2025 -0500 dt-bindings: clock: Convert TI-NSPIRE clocks to DT schema Convert the TI-NSPIRE clock bindings to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521210750.60759-1-robh@kernel.org Signed-off-by: Stephen Boyd commit bb21488670d77ee928f3760f2ea84e3df015df33 Author: Rob Herring (Arm) Date: Wed May 21 16:07:40 2025 -0500 dt-bindings: clock: Convert lsi,axm5516-clks to DT schema Convert the Intel/LSI AXM5516 clock binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521210741.60467-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 46dba2e6a3eeac025d7331f4a6f85d6a04b62185 Author: Rob Herring (Arm) Date: Wed May 21 16:07:11 2025 -0500 dt-bindings: clock: Convert img,pistachio-clk to DT schema Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521210712.59742-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 100026f4b50718d4a730672a5b5eba48a72d0405 Author: Rob Herring (Arm) Date: Tue May 20 19:46:24 2025 -0500 dt-bindings: clock: Convert brcm,bcm2835-cprman to DT schema Convert the Broadcom BCM2835 CPRMAN clock binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521004625.1791913-1-robh@kernel.org Reviewed-by: Stefan Wahren [sboyd@kernel.org: Add list to maintainers] Signed-off-by: Stephen Boyd commit add0c5621c83b4f87f9336ebd4baecc347cc6052 Author: Rob Herring (Arm) Date: Tue May 20 19:49:22 2025 -0500 dt-bindings: clock: Convert cirrus,ep7209-clk to DT schema Convert the Cirrus EP7xxx (aka CLPS711x) binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521004923.1795927-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 094e11183d1837734b3c76dbea5baf33269445b9 Author: Rob Herring (Arm) Date: Tue May 20 19:46:54 2025 -0500 dt-bindings: clock: Convert APM XGene clocks to DT schema Convert the APM XGene clocks to DT schema. The device clock binding is a bit different from the others, so put it in its own schema file. Drop the examples. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521004655.1792703-1-robh@kernel.org Signed-off-by: Stephen Boyd commit bd6ada566efcc047f3126ee6ac039225a0533964 Author: Rob Herring (Arm) Date: Tue May 20 19:46:46 2025 -0500 dt-bindings: clock: Convert axis,artpec6-clkctrl to DT schema Convert the Axis ARTPEC-6 clock controller to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521004647.1792464-1-robh@kernel.org Signed-off-by: Stephen Boyd commit a33556940b5727191613104bced53c93f4a7a3aa Author: Yue Haibing Date: Tue Jun 17 21:06:13 2025 +0800 tcp: Remove inet_hashinfo2_free_mod() DCCP was removed, inet_hashinfo2_free_mod() is unused now. Signed-off-by: Yue Haibing Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20250617130613.498659-1-yuehaibing@huawei.com Signed-off-by: Jakub Kicinski commit d8155c1df5c8b717052567b188455d41fa7a8908 Author: Heiner Kallweit Date: Mon Jun 16 23:24:05 2025 +0200 dpaa_eth: don't use fixed_phy_change_carrier This effectively reverts 6e8b0ff1ba4c ("dpaa_eth: Add change_carrier() for Fixed PHYs"). Usage of fixed_phy_change_carrier() requires that fixed_phy_register() has been called before, directly or indirectly. And that's not the case in this driver. Signed-off-by: Heiner Kallweit Reviewed-by: Jacob Keller Link: https://patch.msgid.link/7eb189b3-d5fd-4be6-8517-a66671a4e4e3@gmail.com Signed-off-by: Jakub Kicinski commit 4a7d79c8b001cf802af50a261cc3ef716faa9cf2 Author: Rob Herring (Arm) Date: Tue May 20 19:46:15 2025 -0500 dt-bindings: clock: Convert brcm,bcm53573-ilp to DT schema Convert the Broadcom BCM53573 ILP clock binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521004618.1791669-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 3c0f211bc8fc0d0a0b4c29c471b57ffff48eec60 Author: Matt Roper Date: Sat Jun 14 01:01:43 2025 +0530 drm/xe: Add Wildcat Lake device IDs to PTL list Introduce wildcat lake device Id. Wildcat Lake uses slightly different graphics and media IP versions than Panther Lake, but can still be treated as PTL for general driver flows. Bspec: 73951 Signed-off-by: Matt Roper Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Tejas Upadhyay Link: https://lore.kernel.org/r/20250613193146.3549862-7-dnyaneshwar.bhadane@intel.com commit c96e0df4e9f5f0d6690994bb01bcfbd01af0e1f7 Author: Matt Roper Date: Sat Jun 14 01:01:40 2025 +0530 drm/xe/xe3: Add support for media IP version 30.02 Media version 30.02 should be treated the same as other Xe3 IP, but will have a slightly different set of workarounds. -v2: Extend the range in existing WA entry (Bala) -v3: Revert v2, Do not extend the range for the time being(Matt) Signed-off-by: Matt Roper Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Balasubramani Vivekanandan Link: https://lore.kernel.org/r/20250613193146.3549862-4-dnyaneshwar.bhadane@intel.com commit b1c37a0030b27a4b5d159d87461f6a7d453fd067 Author: Matt Roper Date: Sat Jun 14 01:01:39 2025 +0530 drm/xe/xe3: Add support for graphics IP version 30.03 Graphics version 30.03 should be treated the same as other Xe3 IP, but will have a slightly different set of workarounds. -v2: Merge and extend the WA onto existing entry (Bala) -v3: Revert v2's feedback changes and keep entry saparate (Matt). Signed-off-by: Matt Roper Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Balasubramani Vivekanandan Link: https://lore.kernel.org/r/20250613193146.3549862-3-dnyaneshwar.bhadane@intel.com commit f8e1c3e07db1805b585df65bd747fd98edbf4ca3 Author: Matt Roper Date: Sat Jun 14 01:01:38 2025 +0530 drm/i915/xe3lpd: Add support for display version 30.02 Display version 30.02 should be treated the same as other Xe3 IP, but will have a slightly different set of workarounds. Signed-off-by: Matt Roper Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250613193146.3549862-2-dnyaneshwar.bhadane@intel.com commit 14a3318b4ac8ae0ca2e1132a89de167e1030fbdb Author: Gautham R. Shenoy Date: Thu Jun 12 17:53:55 2025 +0530 pm: cpupower: Fix printing of CORE, CPU fields in cpupower-monitor After the commit 0014f65e3df0 ("pm: cpupower: remove hard-coded topology depth values"), "cpupower monitor" output ceased to print the CORE and the CPU fields on a multi-socket platform. The reason for this is that the patch changed the behaviour to break out of the switch-case after printing the PKG details, while prior to the patch, the CORE and the CPU details would also get printed since the "if" condition check would pass for any level whose topology depth was lesser than that of a package. Fix this ensuring all the details below a desired topology depth are printed in the cpupower monitor output. Link: https://lore.kernel.org/r/20250612122355.19629-3-gautham.shenoy@amd.com Fixes: 0014f65e3df0 ("pm: cpupower: remove hard-coded topology depth values") Signed-off-by: Gautham R. Shenoy Signed-off-by: Shuah Khan commit cda7ac8ce7de84cf32a3871ba5f318aa3b79381e Author: Gautham R. Shenoy Date: Thu Jun 12 17:53:54 2025 +0530 pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() In the function mperf_start(), mperf_monitor snapshots the time, tsc and finally the aperf,mperf MSRs. However, this order of snapshotting in is reversed in mperf_stop(). As a result, the C0 residency (which is computed as delta_mperf * 100 / delta_tsc) is under-reported on CPUs that is 100% busy. Fix this by snapshotting time, tsc and then aperf,mperf in mperf_stop() in the same order as in mperf_start(). Link: https://lore.kernel.org/r/20250612122355.19629-2-gautham.shenoy@amd.com Signed-off-by: Gautham R. Shenoy Signed-off-by: Shuah Khan commit a2afa4c33f0a7f7f70d54a1bc5110e326753f982 Author: Luo Jie Date: Tue Jun 10 18:35:19 2025 +0800 clk: qcom: cmnpll: Add IPQ5424 SoC support The CMN PLL in IPQ5424 SoC supplies the fixed clock to NSS at 300 MHZ and to PPE at 375 MHZ. Other output clocks from CMN PLL on this SoC, and their rates are same as IPQ9574. Acked-by: Stephen Boyd Signed-off-by: Luo Jie Link: https://lore.kernel.org/r/20250610-qcom_ipq5424_cmnpll-v3-2-ceada8165645@quicinc.com Signed-off-by: Bjorn Andersson commit c1e21ccfe45d20b814acaf6e5e5b9c4ba210a188 Merge: 691f3413baa4bc 0c25ae62f5dc6a Author: Bjorn Andersson Date: Wed Jun 18 17:16:38 2025 -0500 Merge branch '20250610-qcom_ipq5424_cmnpll-v3-1-ceada8165645@quicinc.com' into clk-for-6.17 Merge the IPQ5424 CMN PLL binding through a topic branch, to allow the newly introduced clock constants to be made available to the DeviceTree branch as well. commit 0c25ae62f5dc6a438b563536b5fe7fb6da3612b8 Author: Luo Jie Date: Tue Jun 10 18:35:18 2025 +0800 dt-bindings: clock: qcom: Add CMN PLL support for IPQ5424 SoC The CMN PLL block in the IPQ5424 SoC takes 48 MHZ as the reference input clock. The output clocks are the same as IPQ9574 SoC, except for the clock rate of output clocks to PPE and NSS. Also, add the new header file to export the CMN PLL output clock specifiers for IPQ5424 SoC. Acked-by: Rob Herring (Arm) Signed-off-by: Luo Jie Link: https://lore.kernel.org/r/20250610-qcom_ipq5424_cmnpll-v3-1-ceada8165645@quicinc.com Signed-off-by: Bjorn Andersson commit 8383bdca54792fdae8221a92e6ac0b1f26712e39 Author: Dnyaneshwar Bhadane Date: Sat Jun 14 01:01:46 2025 +0530 drm/i915/xe3lpd: Extend WA 16023981245 for display 30.02 wa_16023981245 need to be extended for display version 30.02 Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Sai Teja Pottumuttu Signed-off-by: Matt Roper Link: https://lore.kernel.org/r/20250613193146.3549862-10-dnyaneshwar.bhadane@intel.com commit 9d10de78a37f4f397de7662faa0c8ab54b6171c9 Author: Dnyaneshwar Bhadane Date: Sat Jun 14 01:01:45 2025 +0530 drm/i915/wcl: C10 phy connected to port A and B WCL added a c10 phy connected to port B. PTL code is currently restricting c10 to phy_a only. PTL doesn't have a PHY connected to PORT B; as such,there will never be a case where PTL uses PHY B. WCL uses PORT A and B with the C10 PHY.Reusing the condition for WCL and extending it for PORT B should not cause any issues for PTL. -v2: Reuse and extend PTL condition for WCL (Matt) Bspec: 73944 Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Suraj Kandpal Signed-off-by: Matt Roper Link: https://lore.kernel.org/r/20250613193146.3549862-9-dnyaneshwar.bhadane@intel.com commit 3d77a3280da9ef96e2f8281e43b2cec18f142160 Author: Dnyaneshwar Bhadane Date: Sat Jun 14 01:01:44 2025 +0530 drm/i915/xe3lpd: Extend DMC load path for display Display version 30.02 should be treated the same as other Xe3 IP. So exteding DMC load path the condition for it. Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Sai Teja Pottumuttu Signed-off-by: Matt Roper Link: https://lore.kernel.org/r/20250613193146.3549862-8-dnyaneshwar.bhadane@intel.com commit 0085d49d30124a3b0cfd04357d22588815c5563b Author: Matt Atwood Date: Sat Jun 14 01:01:42 2025 +0530 drm/i915: Set max cdclk for display 30.02 Display version 30.02 has a lower max cdclk rate than 30.00. Bspec: 68861 Signed-off-by: Matt Atwood Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://lore.kernel.org/r/20250613193146.3549862-6-dnyaneshwar.bhadane@intel.com commit bd031cd19f5c5597716ccaa7e6e70e65721e5ff3 Author: Matt Atwood Date: Sat Jun 14 01:01:41 2025 +0530 drm/i915/xe3lpd: Update bandwidth parameters for display version 30.02 Bandwidth parameters for WCL have been updated with respect to previous display releases. Encode them into xe3lpd_3002_sa_info and use that new struct. -v2: Resolve conflict to apply patch. Bspec: 68859 Signed-off-by: Matt Atwood Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://lore.kernel.org/r/20250613193146.3549862-5-dnyaneshwar.bhadane@intel.com commit 29bb79e9dbf1ba100125e39deb7147acd490903f Author: Gustavo A. R. Silva Date: Tue Jun 17 13:05:36 2025 -0600 stddef: Introduce TRAILING_OVERLAP() helper macro Add new TRAILING_OVERLAP() helper macro to create a union between a flexible-array member (FAM) and a set of members that would otherwise follow it. This overlays the trailing members onto the FAM while preserving the original memory layout. Co-developed-by: Kees Cook Signed-off-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/aFG8gEwKXAWWIvX0@kspp Signed-off-by: Kees Cook commit 56cf5ad39a55892a3b362c7d6c2997155be7538e Author: Neil Armstrong Date: Fri Jun 13 10:41:06 2025 +0200 arm64: dts: qcom: sm8650: add iris DT node Add DT entries for the sm8650 iris decoder. Since the firmware is required to be signed, only enable on Qualcomm development boards where the firmware is available. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250613-topic-sm8x50-upstream-iris-8650-dt-v4-1-35ea7952f2d2@linaro.org Signed-off-by: Bjorn Andersson commit 4bfbc2691de8c869339090e851703209b17ba378 Author: Thorsten Blum Date: Tue Jun 10 12:40:59 2025 +0200 mux: Convert mux_control_ops to a flex array member in mux_chip Convert mux_control_ops to a flexible array member at the end of the mux_chip struct and add the __counted_by() compiler attribute to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Use struct_size() to calculate the number of bytes to allocate for a new mux chip and to remove the following Coccinelle/coccicheck warning: WARNING: Use struct_size Use size_add() to safely add any extra bytes. No functional changes intended. Link: https://github.com/KSPP/linux/issues/83 Signed-off-by: Thorsten Blum Link: https://lore.kernel.org/r/20250610104106.1948-2-thorsten.blum@linux.dev Signed-off-by: Kees Cook commit e0e3265acf5aa2c028980d3f271398723a87dc5a Author: Mark Zhang Date: Tue Jun 17 11:06:30 2025 +0300 net/mlx4e: Don't redefine IB_MTU_XXX enum Rely on existing IB_MTU_XXX definitions which exist in ib_verbs.h. Reviewed-by: Patrisious Haddad Signed-off-by: Mark Zhang Signed-off-by: Leon Romanovsky Reviewed-by: Simon Horman Link: https://patch.msgid.link/382c91ee506e7f1f3c1801957df6b28963484b7d.1750147222.git.leon@kernel.org Signed-off-by: Jakub Kicinski commit a9874d961e8c670244d5659d60b9e96701d44f16 Author: Simon Horman Date: Tue Jun 17 09:45:39 2025 +0100 nfc: Remove checks for nla_data returning NULL The implementation of nla_data is as follows: static inline void *nla_data(const struct nlattr *nla) { return (char *) nla + NLA_HDRLEN; } Excluding the case where nla is exactly -NLA_HDRLEN, it will not return NULL. And it seems misleading to assume that it can, other than in this corner case. So drop checks for this condition. Flagged by Smatch. Compile tested only. Signed-off-by: Simon Horman Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250617-nfc-null-data-v1-1-c7525ead2e95@kernel.org Signed-off-by: Jakub Kicinski commit f86c0036c7de5fc379115809c653dfd57c453330 Author: Alexandre Courbot Date: Mon Jun 16 12:34:07 2025 +0900 rust: alloc: implement `Borrow` and `BorrowMut` for `KBox` Implement `Borrow` and `BorrowMut` for `KBox`. This allows `KBox` to be used in generic APIs asking for types implementing those traits. `T` and `&mut T` also implement those traits allowing users to use either owned, borrowed and heap-owned values. Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250616-borrow_impls-v4-3-36f9beb3fe6a@nvidia.com Signed-off-by: Danilo Krummrich commit c09a8ac1cd560c8f944611045841fed99790116b Author: Alexandre Courbot Date: Mon Jun 16 12:34:05 2025 +0900 rust: alloc: implement `Borrow` and `BorrowMut` for `Vec` Implement `Borrow<[T]>` and `BorrowMut<[T]>` for `Vec`. This allows `Vec` to be used in generic APIs asking for types implementing those traits. `[T; N]` and `&mut [T]` also implement those traits allowing users to use either owned, borrowed and heap-owned values. The implementation leverages `as_slice` and `as_mut_slice`. Reviewed-by: Alice Ryhl Reviewed-by: Benno Lossin Signed-off-by: Alexandre Courbot Link: https://lore.kernel.org/r/20250616-borrow_impls-v4-1-36f9beb3fe6a@nvidia.com Signed-off-by: Danilo Krummrich commit 040ed574ee823a2ce5da36a8d385d3133787c9c5 Author: Alexey Kardashevskiy Date: Wed Jun 11 14:08:42 2025 +1000 x86/sev: Drop unnecessary parameter in snp_issue_guest_request() Commit 3e385c0d6ce8 ("virt: sev-guest: Move SNP Guest Request data pages handling under snp_cmd_mutex") moved @input from snp_msg_desc to snp_guest_req which is passed to snp_issue_guest_request(). Drop the extra parameter. No functional change intended. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Reviewed-by: Dionna Glaze Link: https://lore.kernel.org/20250611040842.2667262-5-aik@amd.com commit 7ffeb2fc26707f613685ce7711c26a9de5890ab1 Author: Alexey Kardashevskiy Date: Wed Jun 11 14:08:41 2025 +1000 x86/sev: Document requirement for linear mapping of guest request buffers The Guest Request supports 3 types of messages now, the largest is the extended variant of MSG_REPORT_REQ: sizeof(snp_ext_report_req)==112. These used to be allocated on stack and then moved to the SNP guest platform device (snp_guest_dev) for the reason explained in db10cb9b5746 ("virt: sevguest: Fix passing a stack buffer as a scatterlist target"): aesgcm_encrypt() and aesgcm_decrypt() are used for guest messages and might potentially use a crypto accelerator which requires DMA buffers to be in the linear mapping. Add a comment, warn and return an error when the buffers are not in linear mapping. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Reviewed-by: Dionna Glaze Link: https://lore.kernel.org/20250611040842.2667262-4-aik@amd.com commit d100016eac21636c8c0507a83bc32d9eb8cd56ab Author: Alexey Kardashevskiy Date: Wed Jun 11 14:08:40 2025 +1000 x86/sev: Allocate request in TSC_INFO_REQ on stack Allocate a 88 byte request structure on stack and skip needless kzalloc/kfree. While at this, correct indent. No functional change intended. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Reviewed-by: Dionna Glaze Link: https://lore.kernel.org/20250611040842.2667262-3-aik@amd.com commit 3f83ab6f9f1db9e8f0141c0c6b974f40b4aa0dcf Author: Alexey Kardashevskiy Date: Wed Jun 11 14:08:39 2025 +1000 virt: sev-guest: Contain snp_guest_request_ioctl in sev-guest SNP Guest Request uses only exitinfo2 which is a return value from GHCB, has meaning beyond ioctl and therefore belongs to struct snp_guest_req. Move exitinfo2 there and remove snp_guest_request_ioctl from the SEV platform code. No functional change intended. Signed-off-by: Alexey Kardashevskiy Signed-off-by: Borislav Petkov (AMD) Reviewed-by: Tom Lendacky Reviewed-by: Dionna Glaze Link: https://lore.kernel.org/20250611040842.2667262-2-aik@amd.com commit 79b896e7da7e2743fc930d260bcecd1e84a003c4 Author: André Apitzsch Date: Sun Jun 15 22:35:06 2025 +0200 arm64: dts: qcom: msm8976-longcheer-l9360: Add initial device tree This dts adds support for BQ Aquaris X5 Plus (Longcheer L9360) released in 2016. Add a device tree with initial support for: - GPIO keys - NFC - SDHCI - Status LED - Touchscreen Signed-off-by: André Apitzsch Link: https://lore.kernel.org/r/20250615-bqx5plus-v2-4-72b45c84237d@apitzsch.eu Signed-off-by: Bjorn Andersson commit cf3dcd80dbe45f1915bd9630f3e20bcdbf6360ac Author: André Apitzsch Date: Sun Jun 15 22:35:05 2025 +0200 arm64: dts: qcom: msm8976: Add sdc2 GPIOs Downstream vendor code for reference: https://git.codelinaro.org/clo/la/kernel/msm-3.10/-/blob/LA.BR.1.3.7.c26/arch/arm/boot/dts/qcom/msm8976-pinctrl.dtsi#L223-263 Signed-off-by: André Apitzsch Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250615-bqx5plus-v2-3-72b45c84237d@apitzsch.eu Signed-off-by: Bjorn Andersson commit 3440c6d1f81dc6fa6356b0f9adbf1dc785ceb426 Author: André Apitzsch Date: Sun Jun 15 22:35:04 2025 +0200 dt-bindings: arm: qcom: Add MSM8976 BQ Aquaris X5 Plus BQ Aquaris X5 Plus (Longcheer L9360) is a smartphone based on MSM8976 SoC. Signed-off-by: André Apitzsch Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250615-bqx5plus-v2-2-72b45c84237d@apitzsch.eu Signed-off-by: Bjorn Andersson commit 76270a18dbdf0bb50615f1b29d2cae8d683da01e Author: André Apitzsch Date: Sun Jun 15 22:35:03 2025 +0200 arm64: dts: qcom: msm8976: Make blsp_dma controlled-remotely The blsp_dma controller is shared between the different subsystems, which is why it is already initialized by the firmware. We should not reinitialize it from Linux to avoid potential other users of the DMA engine to misbehave. In mainline this can be described using the "qcom,controlled-remotely" property. In the downstream/vendor kernel from Qualcomm there is an opposite "qcom,managed-locally" property. This property is *not* set for the qcom,sps-dma@7884000 and qcom,sps-dma@7ac4000 [1] so adding "qcom,controlled-remotely" upstream matches the behavior of the downstream/vendor kernel. Adding this fixes booting Longcheer L9360. [1]: https://git.codelinaro.org/clo/la/kernel/msm-3.10/-/blob/LA.BR.1.3.7.c26/arch/arm/boot/dts/qcom/msm8976.dtsi#L1149-1163 Fixes: 0484d3ce0902 ("arm64: dts: qcom: Add DTS for MSM8976 and MSM8956 SoCs") Reviewed-by: Konrad Dybcio Signed-off-by: André Apitzsch Link: https://lore.kernel.org/r/20250615-bqx5plus-v2-1-72b45c84237d@apitzsch.eu Signed-off-by: Bjorn Andersson commit e72fe8cbd8a0c111542ccaae932ad323c7edaeb3 Author: Ankit Chauhan Date: Thu May 1 11:33:29 2025 +0530 selftests/ptrace: Fix spelling mistake "multible" -> "multiple" Fix the spelling error from "multible" to "multiple". Link: https://lore.kernel.org/r/20250501060329.126117-1-ankitchauhan2065@gmail.com Signed-off-by: Ankit Chauhan Reviewed-by: Brigham Campbell Signed-off-by: Shuah Khan commit 4f451b977e6f8f461adc329642a0c979cd0fec46 Merge: 2fca0d12771e0d c2cd2f6125bde9 Author: Jakub Kicinski Date: Wed Jun 18 13:19:08 2025 -0700 Merge branch 'eth-migrate-more-drivers-to-new-rxfh-callbacks' Jakub Kicinski says: ==================== eth: migrate more drivers to new RXFH callbacks Migrate a batch of drivers to the recently added dedicated .get_rxfh_fields and .set_rxfh_fields ethtool callbacks. ==================== Link: https://patch.msgid.link/20250617014848.436741-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c2cd2f6125bde9db82be1d5e42f64bd1d43d1783 Author: Jakub Kicinski Date: Mon Jun 16 18:48:48 2025 -0700 eth: sxgbe: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). RXFH is all this driver supports in RXNFC so old callbacks are completely removed. Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250617014848.436741-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 20ffe3bbc2ceedc49d3b97ec9d6e212a4fe38af6 Author: Jakub Kicinski Date: Mon Jun 16 18:48:47 2025 -0700 eth: dpaa2: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250617014848.436741-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 17da66f140c28f800d6fe4293072de58a939bbf8 Author: Jakub Kicinski Date: Mon Jun 16 18:48:46 2025 -0700 eth: dpaa: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). RXFH is all this driver supports in RXNFC so old callbacks are completely removed. Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250617014848.436741-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b6f7e4fafe77cbe0f0e4909633bea888a39092c8 Author: Jakub Kicinski Date: Mon Jun 16 18:48:45 2025 -0700 eth: mvpp2: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250617014848.436741-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b82d92dd71cb3a7aca0f772d1fd5882725a6ab85 Author: Jakub Kicinski Date: Mon Jun 16 18:48:44 2025 -0700 eth: niu: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250617014848.436741-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2fca0d12771e0de27dd916fa7403350d8ae0de64 Merge: fc4842cd0f1170 f99ff3c2a3285b Author: Jakub Kicinski Date: Wed Jun 18 13:17:52 2025 -0700 Merge branch 'eth-migrate-some-drivers-to-new-rxfh-callbacks' Jakub Kicinski says: ==================== eth: migrate some drivers to new RXFH callbacks Migrate a batch of drivers to the recently added dedicated .get_rxfh_fields and .set_rxfh_fields ethtool callbacks. ==================== Link: https://patch.msgid.link/20250617014555.434790-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f99ff3c2a3285b525f58b57c683c28fb6c365a64 Author: Jakub Kicinski Date: Mon Jun 16 18:45:55 2025 -0700 eth: otx2: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Link: https://patch.msgid.link/20250617014555.434790-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e8b87384391b12f1ff2b0bef5de057a0f2ac0548 Author: Jakub Kicinski Date: Mon Jun 16 18:45:54 2025 -0700 eth: thunder: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). The driver has no other RXNFC functionality so the SET callback can be now removed. Link: https://patch.msgid.link/20250617014555.434790-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit e7860a6e1826e5b0030ff70632c9d3ced8bdea0e Author: Jakub Kicinski Date: Mon Jun 16 18:45:53 2025 -0700 eth: ena: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). The driver has no other RXNFC functionality so the SET callback can be now removed. Reviewed-by: David Arinzon Link: https://patch.msgid.link/20250617014555.434790-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 82113468a0883b6ccc716e91ec89fb8bcf0d45ed Author: Jakub Kicinski Date: Mon Jun 16 18:45:52 2025 -0700 eth: bnxt: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Reviewed-by: Michael Chan Link: https://patch.msgid.link/20250617014555.434790-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f1a6fcc454ddcfbb741805bb789af6428b5b4bff Author: Jakub Kicinski Date: Mon Jun 16 18:45:51 2025 -0700 eth: bnx2x: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). The driver has no other RXNFC functionality so the SET callback can be now removed. Reviewed-by: Subbaraya Sundeep Link: https://patch.msgid.link/20250617014555.434790-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit cd4da713f99651e99fbce8ed6b6ec8f686c029a8 Author: Sakari Ailus Date: Mon Jun 16 09:12:12 2025 +0300 Documentation: PM: *_autosuspend() functions update last busy time Document that the *_autosuspend() variants of the Runtime PM functions update the last busy timestamp. Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20250616061212.2286741-7-sakari.ailus@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 18c1fe53d186867243f4cf17f4eef60737a16c4c Author: Sakari Ailus Date: Mon Jun 16 09:12:11 2025 +0300 PM: runtime: Mark last busy stamp in pm_request_autosuspend() Set device's last busy timestamp to current time in pm_request_autosuspend(). Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20250616061212.2286741-6-sakari.ailus@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 08071e64cb642ae19ebd6ffeb13b4f3d130b5860 Author: Sakari Ailus Date: Mon Jun 16 09:12:10 2025 +0300 PM: runtime: Mark last busy stamp in pm_runtime_autosuspend() Set device's last busy timestamp to current time in pm_runtime_autosuspend(). Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20250616061212.2286741-5-sakari.ailus@linux.intel.com Signed-off-by: Rafael J. Wysocki commit e24e0630b5ba13e83f65905becde9945518efa0b Author: Sakari Ailus Date: Mon Jun 16 09:12:09 2025 +0300 PM: runtime: Mark last busy stamp in pm_runtime_put_sync_autosuspend() Set device's last busy timestamp to current time in pm_runtime_put_sync_autosuspend(). Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20250616061212.2286741-4-sakari.ailus@linux.intel.com Signed-off-by: Rafael J. Wysocki commit b3db492e8335417dfd66c1fa2ea08e1d2f7b6736 Author: Sakari Ailus Date: Mon Jun 16 09:12:08 2025 +0300 PM: runtime: Mark last busy stamp in pm_runtime_put_autosuspend() Set device's last busy timestamp to current time in pm_runtime_put_autosuspend(). Callers wishing not to do that will need to use __pm_runtime_put_autosuspend(). Signed-off-by: Sakari Ailus Reviewed-by: Laurent Pinchart Link: https://patch.msgid.link/20250616061212.2286741-3-sakari.ailus@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 271ff96d6066347cd267ac3bcd6021bd4d38913d Author: Sakari Ailus Date: Mon Jun 16 09:12:07 2025 +0300 PM: runtime: Document return values of suspend-related API functions Document return values for device suspend and idle related API functions. Signed-off-by: Sakari Ailus Link: https://patch.msgid.link/20250616061212.2286741-2-sakari.ailus@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 221504a63419bc3ef6e72deb42f9f8476eb83538 Author: Shashank Balaji Date: Tue May 27 21:59:10 2025 +0900 cpufreq: docs: userspace: Explain HW coordination influence Extend the "scaling_setspeed" sysfs attribute description in the userspace governor documentation to cover possible differences between the requested and actual CPU frequency. Signed-off-by: Shashank Balaji Link: https://patch.msgid.link/20250527-userspace-governor-doc-v2-2-0e22c69920f2@sony.com [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit 2e1185c9d7b4f890614e891ae1414653b35b88e3 Author: Shashank Balaji Date: Tue May 27 21:59:09 2025 +0900 cpufreq: userspace: set CPUFREQ_GOV_STRICT_TARGET flag When the userspace governor is used, the user intends to set a fixed CPU frequency for a policy, for whatever reason. The CPUFREQ_GOV_STRICT_TARGET flag is the required behaviour. Without this flag, the intel_pstate driver, with HWP enabled, will set HWP_MIN_PERF to the target frequency and HWP_MAX_PERF to the policy maximum, when configuring the HWP_REQUEST MSR. This lets the hardware choose any frequency between the target frequency and the policy maximum, which is not the intended behaviour. To fix this, `cat scaling_setspeed > scaling_max_freq` had to be done. With this patch, that is no longer necessary. Setting scaling_setspeed is sufficient, as expected. Signed-off-by: Shashank Balaji Link: https://patch.msgid.link/20250527-userspace-governor-doc-v2-1-0e22c69920f2@sony.com Signed-off-by: Rafael J. Wysocki commit b65b8ed7e80dd7e1c944a9fa75c47c030612f5a6 Author: Srinivas Pandruvada Date: Tue Jun 17 16:19:40 2025 -0700 thermal: int340x: processor_thermal: Add Wildcat Lake PCI ID Add Wildcat Lake PCI ID for processor thermal device. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250617231940.3314546-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 17bd3c01667aafaa267e64be70f9627e287ec210 Author: Stephen Smalley Date: Tue Jun 17 10:39:07 2025 -0400 documentation: add links to SELinux resources Add links to the SELinux kernel subsystem README.md file, the SELinux kernel wiki, and the SELinux userspace wiki to the SELinux guide. Signed-off-by: Stephen Smalley [PM: spacing and style corrections, subject tweak] Signed-off-by: Paul Moore commit 814eca1085ef26dae928372be374fd27690d24ab Author: Mario Limonciello Date: Sun Jun 8 22:07:05 2025 -0500 ACPI: Enable CONFIG_ACPI_DEBUG by default CONFIG_ACPI_DEBUG can be helpful for getting debug messages on OEM systems to identify a BIOS bug. It's a relatively small size increase to turn it on by default (50kb) and that saves asking people to enable it when an issue comes up because it wasn't in defconfig. Enable it by default. Signed-off-by: Mario Limonciello Link: https://patch.msgid.link/20250609030706.465202-1-superm1@kernel.org Signed-off-by: Rafael J. Wysocki commit c83a92df2fc60bf0b3130cdf0bc2104d61750317 Author: Lifeng Zheng Date: Mon May 26 19:30:57 2025 +0800 cpufreq: CPPC: Remove forward declaration of cppc_cpufreq_register_em() cppc_cpufreq_register_em() is only used in populate_efficiency_class(). A forward declaration of it is not necessary. Move cppc_cpufreq_register_em() in front of populate_efficiency_class() and remove the forward declaration of cppc_cpufreq_register_em(). No functional change. Signed-off-by: Lifeng Zheng Link: https://patch.msgid.link/20250526113057.3086513-4-zhenglifeng1@huawei.com [ rjw: Changelog edits ] Signed-off-by: Rafael J. Wysocki commit 3d5978ea6cbc4df192d0ea1800ef5d55b28b965e Author: Lifeng Zheng Date: Mon May 26 19:30:56 2025 +0800 cpufreq: CPPC: Do not return a value from populate_efficiency_class() The return value of populate_efficiency_class() is never needed and the result of it doesn't affect the initialization of cppc_cpufreq. It makes more sense to change it into a void function. Signed-off-by: Lifeng Zheng Link: https://patch.msgid.link/20250526113057.3086513-3-zhenglifeng1@huawei.com [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki commit d80a75624051b817043431f847470fb4680f2582 Author: Lifeng Zheng Date: Mon May 26 19:30:55 2025 +0800 cpufreq: CPPC: Remove cpu_data_list After commit a28b2bfc099c ("cppc_cpufreq: replace per-cpu data array with a list"), cpu_data can be got from policy->driver_data, so cpu_data_list is not actually needed and can be removed. Signed-off-by: Lifeng Zheng Link: https://patch.msgid.link/20250526113057.3086513-2-zhenglifeng1@huawei.com Signed-off-by: Rafael J. Wysocki commit e42ad39318dffbe46b05337759654c6436f723e8 Author: Tzung-Bi Shih Date: Thu Jun 12 08:48:34 2025 +0000 kunit: Add test for static stub __kunit_activate_static_stub() works effectively as kunit_deactivate_static_stub() if `replacement_addr` is NULL. Add a test case to catch the issue discovered in commit 772e50a76ee6 ("kunit: Fix wrong parameter to kunit_deactivate_static_stub()"). For running the test: $ ./tools/testing/kunit/kunit.py run \ --arch=x86_64 \ kunit_stub Fixed change log: Shuah Khan Link: https://lore.kernel.org/r/20250612084834.587576-1-tzungbi@kernel.org Signed-off-by: Tzung-Bi Shih Signed-off-by: Shuah Khan commit 9cf45756a4b9a7341333dfa8119b823ba66cd17e Author: Srinivas Pandruvada Date: Tue Jun 17 16:18:24 2025 -0700 ACPI: DPTF: Support for Wildcat Lake Add Wildcat Lake ACPI IDs for DPTF. Signed-off-by: Srinivas Pandruvada Link: https://patch.msgid.link/20250617231824.3314507-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 4a089c0b3f55b400689a5c35f7dfa0a74c363dae Author: Chris Li Date: Tue Jun 17 16:57:30 2025 -0700 PCI/MSI: Remove duplicated to_pci_dev() conversion In pci_msi_update_mask(), "lock = &to_pci_dev()" does the to_pci_dev() lookup, and there's another one buried inside msi_desc_to_pci_dev(). Introduce a local variable to remove that duplication. Signed-off-by: Chris Li Signed-off-by: Thomas Gleixner Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/all/20250617-pci-msi-avoid-dup-pcidev-v1-1-ed75b0419023@kernel.org commit 8b148a97931db247771c43a0b5abdc31936c35f0 Author: Zaid Alali Date: Tue Jun 17 12:30:26 2025 -0700 ACPI: APEI: EINJ: Update the documentation for EINJv2 support Add documentation based on implementation of EINJv2 as described in ACPI 6.5.A specification. [Tony: New user interface for device id and syndrome] Link: https://uefi.org/specs/ACPI/6.5_A/18_Platform_Error_Interfaces.html#error-injection Co-developed-by: Tony Luck Signed-off-by: Tony Luck Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-8-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki commit b47610296d17f90ccb24085dcd75fd083acc736d Author: Zaid Alali Date: Tue Jun 17 12:30:25 2025 -0700 ACPI: APEI: EINJ: Enable EINJv2 error injections Enable injection using EINJv2 mode of operation. [Tony: Mostly Zaid's original code. I just changed how the error ID and syndrome bits are implemented. Also swapped out some camelcase variable names] Co-developed-by: Tony Luck Signed-off-by: Tony Luck Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-7-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki commit 90711f7bdf76faa9ed766236bc1f1fbd4364b5e7 Author: Tony Luck Date: Tue Jun 17 12:30:24 2025 -0700 ACPI: APEI: EINJ: Create debugfs files to enter device id and syndrome EINJv2 allows users to inject multiple errors at the same time by specifying the device id and syndrome bits for each error in a flex array. Create files in the einj debugfs directory to enter data for each device id and syndrome value. Note that the specification says these are 128-bit little-endian values. Linux doesn't have a handy helper to manage objects of this type. Signed-off-by: Tony Luck Reviewed-by: Ira Weiny Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-6-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki commit 691a0f0a557b19316ef533f9ca34c72ab6c7ae56 Author: Zaid Alali Date: Tue Jun 17 12:30:23 2025 -0700 ACPI: APEI: EINJ: Discover EINJv2 parameters The EINJv2 set_error_type_with_address structure has a flex array to hold the component IDs and syndrome values used when injecting multiple errors at once. Discover the size of this array by taking the address from the ACPI_EINJ_SET_ERROR_TYPE_WITH_ADDRESS entry in the EINJ table and reading the BIOS copy of the structure. Derive the maximum number of components from the length field in the einjv2_extension_struct at the end of the BIOS copy. Map the whole of the structure into kernel memory (and unmap on module unload). [Tony: Code unchanged from Zaid's original. New commit message] Reviewed-by: Tony Luck Reviewed-by: Ira Weiny Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-5-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki commit 21cd921b1a5a4c8d0097343bda7e6e78d21e9773 Author: Zaid Alali Date: Tue Jun 17 12:30:22 2025 -0700 ACPI: APEI: EINJ: Add einjv2 extension struct Add einjv2 extension struct and EINJv2 error types to prepare the driver for EINJv2 support. ACPI specifications[1] enables EINJv2 by extending set_error_type_with_address struct. Link: https://uefi.org/specs/ACPI/6.6/18_Platform_Error_Interfaces.html#einjv2-extension-structure [1] Reviewed-by: Jonathan Cameron Reviewed-by: Tony Luck Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-4-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki commit 0c6176e1e1862fd09484c50de17c04b3ca388c22 Author: Zaid Alali Date: Tue Jun 17 12:30:21 2025 -0700 ACPI: APEI: EINJ: Enable the discovery of EINJv2 capabilities Enable the driver to show all supported error injections for EINJ and EINJv2 at the same time. EINJv2 capabilities can be discovered by checking the return value of get_error_type, where bit 30 set indicates EINJv2 support. Reviewed-by: Jonathan Cameron Reviewed-by: Tony Luck Reviewed-by: Ira Weiny Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-3-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki commit 1a35c88302a3b2827ec47f0b2d0530b543938fb3 Author: Zaid Alali Date: Tue Jun 17 12:30:20 2025 -0700 ACPI: APEI: EINJ: Fix kernel test sparse warnings This patch fixes the kernel test robot warning reported here: Link: https://lore.kernel.org/all/202410241620.oApALow5-lkp@intel.com/ Use pointers annotated with the __iomem marker for all iomem map calls, and creates a local copy of the mapped IO memory for future access in the code. memcpy_fromio() and memcpy_toio() are used to read/write data from/to mapped IO memory. Reviewed-by: Ira Weiny Reviewed-by: Jonathan Cameron Reviewed-by: Tony Luck Signed-off-by: Zaid Alali Link: https://patch.msgid.link/20250617193026.637510-2-zaidal@os.amperecomputing.com Signed-off-by: Rafael J. Wysocki commit 8aa7306631f088881759398972d503757cf0c901 Author: Karthik Poosa Date: Tue Jun 17 17:30:30 2025 +0530 drm/xe/hwmon: Fix xe_hwmon_power_max_write Prevent other bits of mailbox power limit from being overwritten with 0. This issue was due to a missing read and modify of current power limit, before setting a requested mailbox power limit, which is added in this patch. v2: - Improve commit message. (Anshuman) v3: - Rebase. - Rephrase commit message. (Riana) - Add read-modify-write variant of xe_hwmon_pcode_write_power_limit() i.e. xe_hwmon_pcode_rmw_power_limit(). (Badal) - Use xe_hwmon_pcode_rmw_power_limit() to set mailbox power limits. - Remove xe_hwmon_pcode_write_power_limit() as all mailbox power limits writes use xe_hwmon_pcode_rmw_power_limit() only. v4: - Use PWR_LIM in place of (PWR_LIM_EN | PWR_LIM_VAL) wherever applicable. (Riana) Fixes: 7596d839f6228 ("drm/xe/hwmon: Add support to manage power limits though mailbox") Reviewed-by: Riana Tauro Signed-off-by: Karthik Poosa Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250617120030.612819-1-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi commit 5fc2c383125c2b4b6037e02ad8796b776b25e6d0 Author: Shiji Yang Date: Wed Jun 18 22:53:29 2025 +0800 spi: falcon: mark falcon_sflash_xfer() as static Fix the following missing-prototypes build warning: drivers/spi/spi-falcon.c:97:5: error: no previous prototype for 'falcon_sflash_xfer' [-Werror=missing-prototypes] 97 | int falcon_sflash_xfer(struct spi_device *spi, struct spi_transfer *t, | ^~~~~~~~~~~~~~~~~~ Signed-off-by: Shiji Yang Link: https://patch.msgid.link/OSBPR01MB16705BE87E549B6210CD6BCABC72A@OSBPR01MB1670.jpnprd01.prod.outlook.com Signed-off-by: Mark Brown commit 7f8924e8785b68c998bc1906e049bf5595865e60 Author: Laurentiu Mihalcea Date: Tue Jun 17 10:46:19 2025 -0400 ASoC: dt-bindings: cirrus,cs42xx8: add 'port' property The cs42xx8 codecs may be used with audio graph card and thus may require an additional property: 'port'. Add it. Signed-off-by: Laurentiu Mihalcea Reviewed-by: Charles Keepax Link: https://patch.msgid.link/20250617144619.1130857-1-laurentiumihalcea111@gmail.com Signed-off-by: Mark Brown commit ea685ff30a51a25dd9be90786933ada49a088f65 Author: Alex Deucher Date: Mon Jun 16 15:47:13 2025 -0400 drm/amdgpu/sdma5.2: init engine reset mutex Missing the mutex init. Fixes: 47454f2dc0bf ("drm/amdgpu: Register the new sdma function pointers for sdma_v5_2") Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit b98370220eb3110e82248e3354e16a489a492cfb Author: Jay Cornwall Date: Wed Jun 11 09:52:14 2025 -0500 drm/amdkfd: Fix race in GWS queue scheduling q->gws is not updated atomically with qpd->mapped_gws_queue. If a runlist is created between pqm_set_gws and update_queue it will contain a queue which uses GWS in a process with no GWS allocated. This will result in a scheduler hang. Use q->properties.is_gws which is changed while holding the DQM lock. Signed-off-by: Jay Cornwall Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit 3f4caf092f02f0de169c6122639af481c7edc8f9 Author: Alex Deucher Date: Mon Jun 16 15:43:55 2025 -0400 drm/amdgpu/sdma5: init engine reset mutex Missing the mutex init. Fixes: e56d4bf57fab ("drm/amdgpu/: drm/amdgpu: Register the new sdma function pointers for sdma_v5_0") Reviewed-by: Jesse Zhang Reviewed-by: Christian König Signed-off-by: Alex Deucher commit bf1cd14f9e2e1fdf981eed273ddd595863f5288c Author: Alex Deucher Date: Mon Jun 2 11:31:52 2025 -0400 drm/amdgpu: switch job hw_fence to amdgpu_fence Use the amdgpu fence container so we can store additional data in the fence. This also fixes the start_time handling for MCBP since we were casting the fence to an amdgpu_fence and it wasn't. Fixes: 3f4c175d62d8 ("drm/amdgpu: MCBP based on DRM scheduler (v9)") Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 9750ad5aee4cf24b03dbd3baf475a0840bc0bcea Author: Lijo Lazar Date: Fri Jun 13 18:01:29 2025 +0530 drm/amdgpu: Add xgmi API to set max speed/width Add an API to set the max possible xgmi speed/width. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 8c9eb6ce5021adab44b4a365f2ba9bbbfd65f5b5 Author: Lijo Lazar Date: Fri Jun 13 12:33:20 2025 +0530 drm/amdgpu: Deprecate xgmi_link_speed enum xgmi doesn't have discrete max speeds defined. Speed numbers can be arbitrary based on SOC. Deprecate the enum. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 04141c05f36afe6d053a964fd2c609d4744d19e5 Author: Lijo Lazar Date: Fri Jun 13 16:30:30 2025 +0530 drm/amdgpu: Extend bus status check to more cases In case of unexpected errors, check if device is alive on the bus. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 167049012e693ddffb888b61905962a45b75ca95 Author: Lijo Lazar Date: Fri Jun 13 14:56:18 2025 +0530 drm/amd/pm: Report pldm version and board voltage Add support to report PLDM firmware version and board voltage on SMU v13.0.12 SOCs. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit f6b7ce39090ced13007814fc3ac6543bf75136f2 Author: Lijo Lazar Date: Fri Jun 13 13:20:01 2025 +0530 drm/amd/pm: Update SMU v13.0.12 pmfw header Update PMFW metrics table definition to version 0x13 Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit a3b7f9c306e19a5b618483c11e8af6404ff69408 Author: Frank Min Date: Wed May 21 16:46:27 2025 +0800 drm/amdgpu: reclaim psp fw reservation memory region PSP v14 fw update introduced changes on memory reservation region, according to the change driver reclaim some non-reserved region. 1. introduce 2 new psp commands to query fw reservation regions 2. add a new reservation region for psp 3. reclaim psp non-used region Signed-off-by: Frank Min Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit e2d1e96c536d48b88bfaac4d6b1512be42c2b9f6 Author: ganglxie Date: Thu Jun 12 16:13:08 2025 +0800 drm/amdgpu: refine usage of amdgpu_bad_page_threshold when amdgpu_bad_page_threshold == -1 or -2, driver will issue a warning message when threshold is reached and continue runtime services. Signed-off-by: ganglxie Reviewed-by: Hawking Zhang Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 375bf564654e85a7b1b0657b191645b3edca1bda Author: Jesse Zhang Date: Mon Jun 16 19:21:41 2025 +0800 drm/amdgpu: Fix SDMA UTC_L1 handling during start/stop sequences This commit makes two key fixes to SDMA v4.4.2 handling: 1. disable UTC_L1 in sdma_cntl register when stopping SDMA engines by reading the current value before modifying UTC_L1_ENABLE bit. 2. Ensure UTC_L1_ENABLE is consistently managed by: - Adding the missing register write when enabling UTC_L1 during start - Keeping UTC_L1 enabled by default as per hardware requirements v2: Correct SDMA_CNTL setting (Philip) Suggested-by: Jonathan Kim Signed-off-by: Jesse Zhang Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 1ab11a82681eb33a66f423216cb063e7f40c6f85 Author: Lijo Lazar Date: Fri Jun 6 10:29:28 2025 +0530 drm/amdgpu: Release reset locks during failures Make sure to release reset domain lock in case of failures. Signed-off-by: Lijo Lazar Signed-off-by: Ce Sun Reviewed-by: Hawking Zhang Fixes: 11bb33766f66 ("drm/amdgpu: refactor amdgpu_device_gpu_recover") Signed-off-by: Alex Deucher commit 25b35ad296218e97920807075a4aa4ea72229c06 Author: Kenneth Feng Date: Fri Jun 13 22:39:44 2025 +0800 drm/amd/pm: set pcie default dpm table when updating pcie dpm parameters set pcie default dpm table when updating pcie dpm parameters Signed-off-by: Kenneth Feng Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 9dd1f152368244babc49c41ff65a86fe48f4534a Author: Kenneth Feng Date: Fri Jun 13 20:55:03 2025 +0800 drm/amd/pm: move the dpm table setting back after featureenablement move the dpm table setting back after featureenablemend due to dependancy. For SMUv13.0.6, there is no pptable. Those frequency tables are available through FW metrics and it needs DPM to be enabled. Signed-off-by: Kenneth Feng Acked-by: Alex Deucher Signed-off-by: Alex Deucher commit 9a9e87d15297ce72507178e93cbb773510c061cd Author: Alex Deucher Date: Mon Jun 9 12:13:04 2025 -0400 drm/amdgpu/sdma: handle paging queues in amdgpu_sdma_reset_engine() Need to properly start and stop paging queues if they are present. This is not an issue today since we don't support a paging queue on any chips with queue reset. Fixes: b22659d5d352 ("drm/amdgpu: switch amdgpu_sdma_reset_engine to use the new sdma function pointers") Reviewed-by: Jesse Zhang Signed-off-by: Alex Deucher commit 4cede0ef2e8c8449d47b13e364e596d2382a69cb Author: Taimur Hassan Date: Sun Jun 8 22:37:43 2025 -0500 drm/amd/display: Promote DC to 3.2.338 DC v3.2.338 summary: * DML bug fixes * Add pwait to DMCUB hang reporting * New definitions / changes to prep for new platforms. * Misc cleanups Signed-off-by: Taimur Hassan Signed-off-by: Aurabindo Pillai Reviewed-by: Leo Li Signed-off-by: Alex Deucher commit 4b3f92128da602a5516a99decc929e6f56d9b411 Author: Ryan Seto Date: Fri Jun 6 14:57:07 2025 -0400 drm/amd/display: Removing Unused DPP Functions [Why & How] The functions in this commit are defined for dpp401 but never used. Removing them as they are not necessary. Reviewed-by: Alvin Lee Signed-off-by: Ryan Seto Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit f59e7ad57ba40a26cd670a5292344f95174525b4 Author: Charlene Liu Date: Wed Jun 4 21:04:24 2025 -0400 drm/amd/display: add APG struct to stream_enc for future use some new asics will have an APG instance taking over certain functions. Reviewed-by: Dmytro Laktyushkin Signed-off-by: Charlene Liu Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 52f84591e439b9985945929322dff0dddd5d0831 Author: Karthi Kandasamy Date: Thu May 22 16:44:03 2025 +0200 drm/amd/display: prepare for new platform Expose some functions for new platform use Reviewed-by: Nevenko Stupar Signed-off-by: Karthi Kandasamy Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit d1085d1305359943cdc82bc7b3bd106d67f35b43 Author: Nicholas Kazlauskas Date: Wed May 14 16:28:06 2025 -0400 drm/amd/display: Add pwait status to DMCUB diagnostics [Why] To know if the firmware is idle when logging. [How] Add the pwait status to the DMCUB diagnostics. Reviewed-by: Ovidiu Bunea Signed-off-by: Nicholas Kazlauskas Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 79db43611ff61280b6de58ce1305e0b2ecf675ad Author: Alex Hung Date: Tue Jun 3 18:30:55 2025 -0600 drm/amd/display: Check dce_hwseq before dereferencing it [WHAT] hws was checked for null earlier in dce110_blank_stream, indicating hws can be null, and should be checked whenever it is used. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Hung Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 7948afb46af925830e1541ec33644ba8eecb15ed Author: Mario Limonciello Date: Mon Jun 2 23:50:31 2025 -0500 drm/amd/display: Disable common modes for eDP [Why] Common modes are added to eDP for compatibility in clone mode, but not all panels support them. Non-native modes were disabled in the past but this caused problems because compositors didn't use scaling for non native modes. Now non-native modes on eDP will enable the scaler by default. [How] Check the connector type. If the connector is eDP avoid adding common modes. Reviewed-by: Roman Li Signed-off-by: Mario Limonciello Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 978fa2f6d0b12bb563c643884ab4047987548868 Author: Mario Limonciello Date: Mon Jun 2 23:14:51 2025 -0500 drm/amd/display: Use scaling for non-native resolutions on eDP [Why] Common resolutions are added to supported modes to enable compatibility scenarios that compositors may use to do things like clone displays. There is no guarantee however that the panel will natively support these modes. [How] If the compositor hasn't enabled scaling but a non-native resolution has been picked for an eDP panel turn the scaler on anyway. This will ensure compatibility. Reviewed-by: Roman Li Signed-off-by: Mario Limonciello Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 9a1550b6f3430e6cdfb8aed14d218c481e33086f Author: Yan Li Date: Thu May 29 12:30:55 2025 -0400 drm/amd/display: remove use_native_pstate_optimization [Why] In DML2 (not DML2.1), DCN35 and DCN351 have the default value for use_native_pstate_optimization set to true. The code path where this bit is false is not used. [How] Remove the bit and the corresponding code path when it is set to false. Reviewed-by: Nicholas Kazlauskas Reviewed-by: Aric Cyr Signed-off-by: Yan Li Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit b02b0fc488ba6efc29884a517ab38c2efeaf9e34 Author: Yan Li Date: Wed May 21 16:02:55 2025 -0400 drm/amd/display: apply two different methods to validate modes [Why] In DML2, the current method to determine a mode is supported involves checking the voltage levels sequentially from the lowest, until one is found that can support the mode. It causes cursor lag due to low performance. [How] We apply two methods for mode validation. 1) DC_VALIDATE_MODE_ONLY: only the maximum voltage level is checked to determine whether the mode is supported, which improves performance and eliminate cursor lag. 2) DC_VALIDATE_MODE_AND_STATE_INDEX: when the optimal voltage level is required, check the voltage level from the lowest until a suitable one is found found and returns its index. Reviewed-by: Nicholas Kazlauskas Reviewed-by: Aric Cyr Signed-off-by: Yan Li Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit 54f7a24e1437d66c9ff36d727a9dff1beeeab429 Author: Emily Deng Date: Tue May 27 11:42:11 2025 +0800 drm/amdkfd: Move the process suspend and resume out of full access For the suspend and resume process, exclusive access is not required. Therefore, it can be moved out of the full access section to reduce the duration of exclusive access. v3: Move suspend processes before hardware fini. Remove twice call for bare metal. v4: Refine code Signed-off-by: Emily Deng Acked-by: Lijo Lazar Signed-off-by: Alex Deucher commit b49e3d7ca71aaf1e3412d41522a11a56563799b5 Author: Lijo Lazar Date: Thu Jun 12 17:43:58 2025 +0530 drm/amd/pm: Use pointer type for typecheck() typecheck creates local variables based on the type passed. That could result in stack frame size warnings like below in certain configs: drivers/gpu/drm/amd/amdgpu/../pm/swsmu/smu13/smu_v13_0_6_ppt.c:2885:1: error: the frame size of 8304 bytes is larger than 2048 bytes [-Werror=frame-larger-than=] Checking against the pointer type is sufficient for the purpose of getting a diagnostic message during build time. Signed-off-by: Lijo Lazar Reviewed-by: Palmer Dabbelt Tested-by: Palmer Dabbelt Link: https://lore.kernel.org/r/20250610212141.19445-1-palmer@dabbelt.com Signed-off-by: Alex Deucher commit 594a774dc2f28eccfcdaf6f0e372bc7f4500ffa6 Author: Mario Limonciello Date: Sun Jun 8 22:12:27 2025 -0500 drm/amd: Allow printing Renoir OD SCLK levels without setting dpm to manual Several other ASICs allow printing OD SCLK levels without setting DPM control to manual. When OD is disabled it will show the range the hardware supports. When OD is enabled it will show what values have been programmed. Adjust Renoir to work the same. Reviewed-by: Alex Deucher Reported-by: Vicki Pfau Link: https://lore.kernel.org/r/20250609031227.479079-2-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit c29521b529fa5e225feaf709d863a636ca0cbbfa Author: Sonny Jiang Date: Thu Jun 12 11:01:08 2025 -0400 drm/amdgpu: VCN v5_0_1 to prevent FW checking RB during DPG pause Add a protection to ensure programming are all complete prior VCPU starting. This is a WA for an unintended VCPU running. Signed-off-by: Sonny Jiang Acked-by: Leo Liu Reviewed-by: Ruijing Dong Signed-off-by: Alex Deucher commit 2d1ec1e955414e8e8358178011c35afca1a1c0b1 Author: Mario Limonciello Date: Sun Jun 8 22:12:26 2025 -0500 drm/amd: Allow printing VanGogh OD SCLK levels without setting dpm to manual Several other ASICs allow printing OD SCLK levels without setting DPM control to manual. When OD is disabled it will show the range the hardware supports. When OD is enabled it will show what values have been programmed. Adjust VanGogh to work the same. Cc: Pierre-Loup A. Griffais Reported-by: Vicki Pfau Reviewed-by: Alex Deucher Link: https://lore.kernel.org/r/20250609031227.479079-1-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit d2f9002426a7bb53964526d55b0d505937a548a1 Author: Srinivasan Shanmugam Date: Thu Jun 12 20:32:30 2025 +0530 drm/amd/display: Fix annotations for dc state functions This patch addresses inconsistencies in the annotations for the following functions: - **dc_get_power_profile_for_dc_state**: Standardized parameter and return value annotations. - **dc_get_det_buffer_size_from_state**: Clarified parameter documentation for better understanding. - **dc_get_host_router_index**: Corrected parameter descriptions to follow documentation conventions. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/dc/core/dc.c:6386: warning: Cannot understand *************** Cc: Tom Chung Cc: Roman Li Cc: Alex Hung Cc: Aurabindo Pillai Cc: Harry Wentland Signed-off-by: Srinivasan Shanmugam Reviewed-by: Aurabindo Pillai Signed-off-by: Alex Deucher commit eeb760c34afa034d1e879aa2394ae659a95e8f0b Author: Kenneth Feng Date: Thu Jun 12 15:57:40 2025 +0800 drm/amd/pm: update pcie dpm parameters before smu feature enablement update pcie dpm parameters before smu feature enablement Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 1a18607c07bb68661a6373b4027c26ea8eab4b40 Author: Kenneth Feng Date: Thu Jun 12 15:56:11 2025 +0800 drm/amd/pm: override pcie dpm parameters only if it is necessary override pcie dpm parameters only if it is necessary Signed-off-by: Kenneth Feng Reviewed-by: Yang Wang Signed-off-by: Alex Deucher commit 0c3f972394bb91faf3fb86b76327ed4aefa68c0c Author: Jesse Zhang Date: Wed Jun 11 17:23:26 2025 +0800 drm/amdgpu: Add soft reset callback to SDMA v4.4.x Implement soft reset engine callback for SDMA 4.4.x IPs. This avoids IP version check in generic implementation. V2: Correct physical instance ID calculation in soft_reset_engine (Jesse) Signed-off-by: Lijo Lazar Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 3bab282dfe25dff7a55add432f56898505a6cc6c Author: Jesse Zhang Date: Wed Jun 11 15:07:11 2025 +0800 drm/amdgpu: Use logical instance ID for SDMA v4_4_2 queue operations Simplify SDMA v4_4_2 queue reset and stop operations by: 1. Removing GET_INST(SDMA0) conversion for ring->me 2. Using the logical instance ID (ring->me) directly 3. Maintaining consistent behavior with other SDMA queue operations This change aligns with the existing queue handling logic where ring->me already represents the correct instance identifier. Signed-off-by: Lijo Lazar Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 5efa6217c239ed1ceec0f0414f9b6f6927387dfc Author: Jesse Zhang Date: Wed Jun 11 15:02:09 2025 +0800 drm/amdgpu: Fix SDMA engine reset with logical instance ID This commit makes the following improvements to SDMA engine reset handling: 1. Clarifies in the function documentation that instance_id refers to a logical ID 2. Adds conversion from logical to physical instance ID before performing reset using GET_INST(SDMA0, instance_id) macro 3. Improves error messaging to indicate when a logical instance reset fails 4. Adds better code organization with blank lines for readability The change ensures proper SDMA engine reset by using the correct physical instance ID while maintaining the logical ID interface for callers. V2: Remove harvest_config check and convert directly to physical instance (Lijo) Suggested-by: Jonathan Kim Signed-off-by: Jesse Zhang Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher commit 3f1e81ecb61923934bd11c3f5c1e10893574e607 Author: Lijo Lazar Date: Tue Jun 3 11:43:36 2025 +0530 drm/amdgpu: Suspend IH during mode-2 reset On multi-aid SOCs, there could be a continuous stream of interrupts from GC after poison consumption. Suspend IH to disable them before doing mode-2 reset. This avoids conflicts in hardware accesses during interrupt handlers while a reset is ongoing. Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit 45cc102f8e6520ac07637c7e09f61dcc3772e125 Author: Mario Limonciello Date: Sun Jun 1 20:44:32 2025 -0500 drm/amd/display: Destroy cached state in complete() callback [Why] When the suspend sequence has been aborted after prepare() but before suspend() the resume() callback never gets called. The PM core will call complete() when this happens. As the state has been cached in prepare() it needs to be destroyed in complete() if it's still around. [How] Create a helper for destroying cached state and call it both in resume() and complete() callbacks. If resume has been called the state will be destroyed and it's a no-op for complete(). If resume hasn't been called (such as an aborted suspend) then destroy the state in complete(). Fixes: 50e0bae34fa6 ("drm/amd/display: Add and use new dm_prepare_suspend() callback") Reviewed-by: Alex Hung Link: https://lore.kernel.org/r/20250602014432.3538345-4-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 709a37ab9c63297da2194dc36f604537f9d2d417 Author: Mario Limonciello Date: Sun Jun 1 20:44:31 2025 -0500 drm/amd/display: Stop storing failures into adev->dm.cached_state If drm_atomic_helper_suspend() has failed for any reason, it's stored in adev->dm.cached_state. This isn't expected because the resume (or complete()) sequence will attempt to use the stored state to resume. Reviewed-by: Alex Hung Link: https://lore.kernel.org/r/20250602014432.3538345-3-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit 64c3e4a868f1ddde8eee2bb038a2ed0e8f06a247 Author: Mario Limonciello Date: Sun Jun 1 20:44:30 2025 -0500 drm/amd: Add support for a complete pmops action complete() callbacks are supposed to handle reversing anything that occurred during prepare() callbacks. They'll be called on every power state transition, and will also be called if the sequence is failed (such as an aborted suspend). Add support for IP blocks to support this action. Reviewed-by: Alex Hung Link: https://lore.kernel.org/r/20250602014432.3538345-2-superm1@kernel.org Signed-off-by: Mario Limonciello Signed-off-by: Alex Deucher commit dd3999b658e4c15dea5feda5bf3f8ff6b1a31d2f Author: Lijo Lazar Date: Fri Jun 6 12:18:57 2025 +0530 drm/amd/pm: Show default gfx clock levels For SMU v13.0.6 SOCs, always show default clock levels for gfx in pp_dpm_sclk. Any custom min/max levels set by user will be available in pp_od_clk_voltage Signed-off-by: Lijo Lazar Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit f43411978d1367af6e983ae09ab4c2f7a811574a Author: Xiang Liu Date: Fri Jun 6 11:10:40 2025 +0800 drm/amdgpu: Add debug mask to disable CE logs Add debug mask to disable kernel logs of RAS correctable errors, including both ACA and CE error counter kernel messages. Signed-off-by: Xiang Liu Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit fb5ec2174d70a8989bc207d257db90ffeca3b163 Author: Frank Min Date: Wed Jun 4 21:17:05 2025 +0800 drm/amdgpu: add kicker fws loading for gfx11/smu13/psp13 1. Add kicker firmwares loading for gfx11/smu13/psp13 2. Register additional MODULE_FIRMWARE entries for kicker fws - gc_11_0_0_rlc_kicker.bin - gc_11_0_0_imu_kicker.bin - psp_13_0_0_sos_kicker.bin - psp_13_0_0_ta_kicker.bin - smu_13_0_0_kicker.bin Signed-off-by: Frank Min Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 09aa2b408f4ab689c3541d22b0968de0392ee406 Author: Frank Min Date: Wed Jun 4 21:00:44 2025 +0800 drm/amdgpu: Add kicker device detection 1. add kicker device list 2. add kicker device checking helper function Signed-off-by: Frank Min Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 3bdf8dd84e55e9ea0806eb62bd4437c8c7746521 Author: Lijo Lazar Date: Wed Jun 4 09:36:09 2025 +0530 drm/amdgpu: Clear reset flags from ras context Once RAS errors are cleared with appropriate recovery mechanism, clear reset flags also from RAS context. Otherwise, stale flag values could affect the subsequent RAS reset handling on the device. Signed-off-by: Lijo Lazar Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit 87fbe3a5480044c403b149d9c8e7d72b504ebcf8 Author: Alex Deucher Date: Tue May 27 23:14:32 2025 -0400 drm/amdgpu/gfx9: drop reset_kgq It doesn't work reliably and we have soft recover and full adapter reset so drop this. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit fda02c911ac61b3e338ccf4bb0aabd3cd1b084ac Author: Alex Deucher Date: Tue May 27 23:10:48 2025 -0400 drm/amdgpu/gfx8: drop reset_kgq It doesn't work reliably and we have soft recover and full adapter reset so drop this. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 18d321c1dcb7df4cdbb8debf579b646736061529 Author: Alex Deucher Date: Tue May 27 23:08:20 2025 -0400 drm/amdgpu/gfx7: drop reset_kgq It doesn't work reliably and we have soft recover and full adapter reset so drop this. Reviewed-by: Christian König Signed-off-by: Alex Deucher commit 96f75f9594466f92b10873cc3a49267cfe15ee49 Author: Jonathan Kim Date: Wed May 14 17:00:46 2025 -0400 drm/amdkfd: allow compute partition mode switch with cgroup exclusions The KFD currently bars a compute partition mode switch while a KFD process exists. Since cgroup excluded devices remain excluded for the lifetime of a KFD process and user space is able to mode switch single devices, allow users to mode switch a device with any running process that has been cgroup excluded from this device. Signed-off-by: Jonathan Kim Reviewed-by: Harish Kasiviswanathan Signed-off-by: Alex Deucher commit dc8ffb28790eeab7e0f92d041e88c82c1f3667c5 Author: Taimur Hassan Date: Mon Jun 2 09:11:31 2025 -0500 drm/amd/display: Promote DC to 3.2.337 This version brings along following fixes: - Fix kernel docs for new struct members - Export full brightness range to userspace - Only read ACPI backlight caps once - Fix RMCM programming seq errors - Add RMCM debug logging - DML2.1 changes - Fix mpv playback corruption on weston - Adjust dto fix coverage - Add option to disable PHY SSC reduction on transmitter enable - Don't disable dtb as dto src during dpms off - Add custom segmentation support - Deprecate Loading Bounding Box From DMUB On DCN4 - Update tmz_surface type to match register - Clear DPP 3DLUT Cap - Add more checks for DSC / HUBP ONO guarantees - Refactor DML2 DC power instance - Remove dml/dcn401 files and references - Get LTTPR IEEE OUI/Device ID From Closest LTTPR To Host - Add HW change required mpc gamut remap - Add DPIA debug option for zero allocation patch - Add dc cap for dp tunneling - Remove dpia debug bits Acked-by: Aurabindo Pillai Signed-off-by: Taimur Hassan Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 87d6d42295a8d9d511ba53a6717a1989f6fa523c Author: Alex Hung Date: Tue Jun 3 13:19:57 2025 -0600 drm/amd/display: Fix kernel docs for new struct members [WHAT & HOW] Add kernel-doc for new struct members for lut3d_caps and mpc_funcs. This fixes the follow warnings from "make htmldocs". ./drivers/gpu/drm/amd/display/dc/inc/hw/mpc.h:1106: warning: Function parameter or struct member 'mcm' not described in 'mpc_funcs' ./drivers/gpu/drm/amd/display/dc/inc/hw/mpc.h:1106: warning: Function parameter or struct member 'rmcm' not described in 'mpc_funcs' ./drivers/gpu/drm/amd/display/dc/dc.h:249: warning: Function parameter or struct member 'mcm_3d_lut_caps' not described in 'mpc_color_caps' ./drivers/gpu/drm/amd/display/dc/dc.h:249: warning: Function parameter or struct member 'rmcm_3d_lut_caps' not described in 'mpc_color_caps' ./drivers/gpu/drm/amd/display/dc/dc.h:249: warning: Function parameter or struct member 'preblend' not described in 'mpc_color_caps' Reviewed-by: Aurabindo Pillai Acked-by: Aurabindo Pillai Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 8dbd72cb790058ce52279af38a43c2b302fdd3e5 Author: Mario Limonciello Date: Thu May 29 09:46:32 2025 -0500 drm/amd/display: Export full brightness range to userspace [WHY] Userspace currently is offered a range from 0-0xFF but the PWM is programmed from 0-0xFFFF. This can be limiting to some software that wants to apply greater granularity. [HOW] Convert internally to firmware values only when mapping custom brightness curves because these are in 0-0xFF range. Advertise full PWM range to userspace. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Roman Li Signed-off-by: Mario Limonciello Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 148144f6d2f14b02eaaa39b86bbe023cbff350bd Author: Mario Limonciello Date: Thu May 29 11:33:44 2025 -0500 drm/amd/display: Only read ACPI backlight caps once [WHY] Backlight caps are read already in amdgpu_dm_update_backlight_caps(). They may be updated by update_connector_ext_caps(). Reading again when registering backlight device may cause wrong values to be used. [HOW] Use backlight caps already registered to the dm. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Roman Li Signed-off-by: Mario Limonciello Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 11baa4975025033547f45f5894087a0dda6efbb8 Author: Yihan Zhu Date: Tue May 27 16:47:40 2025 -0400 drm/amd/display: Fix RMCM programming seq errors [WHY & HOW] Fix RMCM programming sequence errors and mapping issues to pass the RMCM test. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Dmytro Laktyushkin Signed-off-by: Yihan Zhu Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 0ae0b670124bbd6d84b83ac3e50f46c45ebdcc46 Author: Yihan Zhu Date: Tue May 27 15:28:03 2025 -0400 drm/amd/display: Add RMCM debug logging [WHY & HOW] Add new FL feature debug logging into the existing DTN logging. Reviewed-by: Dmytro Laktyushkin Reviewed-by: Charlene Liu Signed-off-by: Yihan Zhu Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 708d45eb1aa34634df04fa39a2c15d8a062ac070 Author: Aurabindo Pillai Date: Tue May 20 16:58:30 2025 -0400 drm/amd/display: DML2.1 changes * Add a missing compilation unit * Missing CFLAGS for certain units Reviewed-by: Roman Li Signed-off-by: Aurabindo Pillai Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d023de809f85307ca819a9dbbceee6ae1f50e2ad Author: Alex Hung Date: Thu May 29 10:59:19 2025 -0600 drm/amd/display: Fix mpv playback corruption on weston [WHAT] Severe video playback corruption is observed in the following setup: weston 14.0.90 (built from source) + mpv v0.40.0 with command: mpv bbb_sunflower_1080p_60fps_normal.mp4 --vo=gpu [HOW] ABGR16161616 needs to be included in dml2/2.1 translation. Cc: Mario Limonciello Cc: Alex Deucher Acked-by: Aurabindo Pillai Reviewed-by: Harry Wentland Reviewed-by: Austin Zheng Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f6d7238c924b63303a77a93d7fa9fd4f307d9bca Author: Ausef Yousof Date: Thu May 29 18:22:21 2025 -0400 drm/amd/display: Adjust dto fix coverage [WHY & HOW] Unnecessary to affect legacy APU's dto src sel during dpms behaviour Reviewed-by: Charlene Liu Signed-off-by: Ausef Yousof Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 5fa62c87cffdfe18e0f7c35c2ee3f18c8d2f7408 Author: Muhammad Ahmed Date: Tue May 27 12:01:41 2025 -0400 drm/amd/display: Add option to disable PHY SSC reduction on transmitter enable [WHY] On some 8k display models flickering or black screens may occur at reduced PHY SSC. [HOW] Add an option to set a workaround bit for these displays to keep the old SSC value. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Muhammad Ahmed Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 90bc60cef2a3ca0a4ea98d9e6cb7129d64373dab Author: Ausef Yousof Date: Wed May 28 18:16:05 2025 -0400 drm/amd/display: Don't disable dtb as dto src during dpms off [WHY & HOW] Adjusting otg dto programming in this path is unsafe otg may be en at this time, swapping its src sel for example was discovered to cause visual artifacts and was moved to dcn31_program_pix_clk (where otg is guaranteed off) but dto functional clk enable bit is not cleared. dcn31_program_pix_clk is called during dpms on, so until that point we will have a otg with functional src sel set (Sel DTBclk) and that functional clk dto en is unset (i.e DTB DTO EN), which is invalid and tg will not function and system will hang on something such as flip incoming from OS during dpms off. will scope out dcn315 as it was affecting diags tests on certain CI machines (not crbs) Reviewed-by: Leo Chen Signed-off-by: Ausef Yousof Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 428ac7ce7f82d11f072cba6000987826746a017b Author: Brendan Steve Leder Date: Fri Mar 14 14:32:31 2025 -0400 drm/amd/display: Add custom segmentation support [WHY] Add support for uneven segmentation size [HOW] Currently width + x_start is automatically calculated using slice index + dividing stream into equally sized segments. Add override variables for dst_rect width and x Reviewed-by: Samson Tam Signed-off-by: Brendan Steve Leder Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit f94877038770073b465eece8636e221653d2beae Author: Austin Zheng Date: Tue May 6 10:35:49 2025 -0400 drm/amd/display: Deprecate Loading Bounding Box From DMUB On DCN4 [WHY] dml2_soc_bb struct can continuously receive updates for future ASICs. Alignment issues may arise since VBIOS DMCUB contains an older version of the SOC BB. Populating the bounding box with values from DMCUB is no longer necessary since values such as UCLK will be overridden by values acquired by PMFW anyways. [HOW] Use bb_from_dmub to store DCN specific bounding box parameters in DMCUB. Add helpers to translate DCN specific struct to the corresponding dml2_soc_bb field. To avoid alignment issues: Deprecate applying DMCUB SoC BB for DCN4 For future projects: Create a flattened struct containing all sensitive parameters in the bounding box. New parameters can be added to the bottom of the new struct as needed. Reviewed-by: Dillon Varone Signed-off-by: Austin Zheng Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 9fe914b090486783ae4e28bc557cdd420e90fdae Author: Dmytro Laktyushkin Date: Thu Apr 17 14:15:40 2025 -0400 drm/amd/display: Update tmz_surface type to match register [WHAT] Update tmz_surface's type to match register size Reviewed-by: Charlene Liu Signed-off-by: Dmytro Laktyushkin Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 39923050615cd04231ea664c4cc5dbc8560b8b42 Author: Ryan Seto Date: Tue May 27 14:51:10 2025 -0400 drm/amd/display: Clear DPP 3DLUT Cap [WHY & HOW] Clear DPP 3DLUT Cap flag on ASICs that do not use it Reviewed-by: Alvin Lee Signed-off-by: Ryan Seto Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit da63df07112e5a9857a8d2aaa04255c4206754ec Author: Nicholas Kazlauskas Date: Wed May 21 16:40:25 2025 -0400 drm/amd/display: Add more checks for DSC / HUBP ONO guarantees [WHY] For non-zero DSC instances it's possible that the HUBP domain required to drive it for sequential ONO ASICs isn't met, potentially causing the logic to the tile to enter an undefined state leading to a system hang. [HOW] Add more checks to ensure that the HUBP domain matching the DSC instance is appropriately powered. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Duncan Ma Signed-off-by: Nicholas Kazlauskas Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit bf6003f2052fe633f5fddeaa6923f13bc46d0e2b Author: Dillon Varone Date: Tue May 27 17:19:24 2025 -0400 drm/amd/display: Refactor DML2 DC power instance [WHY & HOW] Use a dedicated DC power option and instance pair. Reviewed-by: Alvin Lee Signed-off-by: Dillon Varone Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 2d2e5472af6ecf79c30b40187e6bdf7a34578855 Author: Dillon Varone Date: Tue May 27 15:47:00 2025 -0400 drm/amd/display: Remove dml/dcn401 files and references [WHY & HOW] DCN401 is only supported using DML2.1, so remove unused code and files. Reviewed-by: Alvin Lee Signed-off-by: Dillon Varone Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 791897f5c77a2a65d0e500be4743af2ddf6eb061 Author: Michael Strauss Date: Wed Feb 26 10:03:48 2025 -0500 drm/amd/display: Get LTTPR IEEE OUI/Device ID From Closest LTTPR To Host [WHY] These fields are read for the explicit purpose of detecting embedded LTTPRs (i.e. between host ASIC and the user-facing port), and thus need to calculate the correct DPCD address offset based on LTTPR count to target the appropriate LTTPR's DPCD register space with these queries. [HOW] Cascaded LTTPRs in a link each snoop and increment LTTPR count when queried via DPCD read, so an LTTPR embedded in a source device (e.g. USB4 port on a laptop) will always be addressible using the max LTTPR count seen by the host. Therefore we simply need to use a recently added helper function to calculate the correct DPCD address to target potentially embedded LTTPRs based on the received LTTPR count. Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Wenjing Liu Signed-off-by: Michael Strauss Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit c6618fa8b926fadf356612f5242057c2d761b1ab Author: Charlene Liu Date: Tue May 20 12:03:44 2025 -0400 drm/amd/display: Add HW change required mpc gamut remap [WHAT] Add HW change to required mpc gamut remap Reviewed-by: Dmytro Laktyushkin Signed-off-by: Charlene Liu Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 8d0d293c91904d4547befae99f9f02243d64debb Author: Cruise Hung Date: Mon May 26 15:07:59 2025 +0800 drm/amd/display: Add DPIA debug option for zero allocation patch [WHY & HOW] The BW zero allocation patch is no longer required. Add a debug option to enable it in case we encounter an issue. Reviewed-by: Wenjing Liu Signed-off-by: Cruise Hung Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 29e178d13979cf6fdb42c5fe2dfec2da2306c4ad Author: Peichen Huang Date: Mon May 26 16:04:10 2025 +0800 drm/amd/display: Add dc cap for dp tunneling [WHAT] 1. add dc cap for dp tunneling 2. add function to get index of host router Cc: Mario Limonciello Cc: Alex Deucher Reviewed-by: Cruise Hung Signed-off-by: Peichen Huang Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit a88e727bdbbc199258ac7eefd56ba1375ea90db1 Author: Peichen Huang Date: Wed May 21 13:05:06 2025 +0800 drm/amd/display: Remove dpia debug bits [WHY] Remove some unused dpia debug bits. [HOW] Remove them from dpia_debug_options. Reviewed-by: Cruise Hung Reviewed-by: Robin Chen Signed-off-by: Peichen Huang Signed-off-by: Alex Hung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d0cc8d2b7df1848f98f0fea8135ba706814b1d13 Author: ganglxie Date: Thu Jun 5 14:00:28 2025 +0800 drm/amdgpu: clear pa and mca record counter when resetting eeprom clear pa and mca record counter when resetting eeprom, so that ras_num_bad_pages can be calculated correctly Signed-off-by: ganglxie Reviewed-by: Tao Zhou Signed-off-by: Alex Deucher commit 4108c2be12ebe78accb40d43f4713a7cc481b18a Author: Samuel Zhang Date: Thu May 8 14:36:35 2025 +0800 drm/amdgpu: fix fence fallback timer expired error IH is not working after switching a new gpu index for the first time. During VM resume, QEMU programming of VF MSIX table (register GFXMSIX_VECT0_ADDR_LO) may not work.The access could be blocked by nBIF protection as VF isn't in exclusive access mode. Exclusive access is enabled now, disable/enable MSIX so that QEMU reprograms MSIX table. call amdgpu_restore_msix on resume to restore msix table. Signed-off-by: Samuel Zhang Acked-by: Lijo Lazar Signed-off-by: Alex Deucher commit 2f405eb45c5523aadf6faea1ca465cf3e6ad7866 Author: Samuel Zhang Date: Fri Apr 11 16:19:09 2025 +0800 drm/amdgpu: enable pdb0 for hibernation on SRIOV When switching to new GPU index after hibernation and then resume, VRAM offset of each VRAM BO will be changed, and the cached gpu addresses needed to updated. This is to enable pdb0 and switch to use pdb0-based virtual gpu address by default in amdgpu_bo_create_reserved(). since the virtual addresses do not change, this can avoid the need to update all cached gpu addresses all over the codebase. Signed-off-by: Emily Deng Signed-off-by: Samuel Zhang Acked-by: Christian König Signed-off-by: Alex Deucher commit 18b66a6c2a3f661d8ce29c61cf79c4c1a0a96839 Author: Samuel Zhang Date: Fri Apr 11 16:10:20 2025 +0800 drm/amdgpu: update GPU addresses for SMU and PSP add amdgpu_bo_fb_aper_addr() and update the cached GPU addresses to use the FB aperture address for SMU and PSP. 2 reasons for this change: 1. when pdb0 is enabled, gpu addr from amdgpu_bo_create_kernel() is GART aperture address, it is not compatible with SMU and PSP, it need to be updated to use FB aperture address. 2. Since FB aperture address will change after switching to new GPU index after hibernation, it need to be updated on resume. Signed-off-by: Jiang Liu Signed-off-by: Samuel Zhang Acked-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 0f566f0e9c614aa3d95082246f5b8c9e8a09c8b3 Author: Lijo Lazar Date: Thu May 29 13:29:11 2025 +0530 drm/amdgpu: Remove nbiov7.9 replay count reporting Direct pcie replay count reporting is not available on nbio v7.9. Reporting is done through firmware. Signed-off-by: Lijo Lazar Acked-by: Mangesh Gadre Reviewed-by: Asad Kamal Fixes: 50709d18f4a6 ("drm/amdgpu: Add pci replay count to nbio v7.9") Signed-off-by: Alex Deucher commit 196aefea44aa3f7f2dc93df637bc319139eea713 Author: Lijo Lazar Date: Thu May 29 12:49:30 2025 +0530 drm/amdgpu: Check pcie replays reporting support Check if pcie replay count reporting is supported before creating sysfs attribute. Signed-off-by: Lijo Lazar Acked-by: Mangesh Gadre Reviewed-by: Asad Kamal Signed-off-by: Alex Deucher commit c09910b511de0d8bcdaf91ef804531ab44409336 Author: Shiwu Zhang Date: Wed May 28 20:51:11 2025 +0800 drm/amdgpu: Enable IFWI update support for PSPv14.0.2 and v14.0.3 Make the psp_vbflash and psp_vbflash_status available in sysfs. v2: make it available for v14.0.2 as well (hawking) Signed-off-by: Shiwu Zhang Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher commit e17df7b086cf908cedd919f448da9e00028419bb Author: Jesse.Zhang Date: Thu May 29 11:27:37 2025 +0800 drm/amdkfd: move SDMA queue reset capability check to node_show Relocate the per-SDMA queue reset capability check from kfd_topology_set_capabilities() to node_show() to ensure we read the latest value of sdma.supported_reset after all IP blocks are initialized. Fixes: ceb7114c961b ("drm/amdkfd: flag per-sdma queue reset supported to user space") Reviewed-by: Jonathan Kim Signed-off-by: Jesse Zhang Signed-off-by: Alex Deucher commit 855a2a029a2eda88317cdccde9b3a3168ad193dc Author: Samuel Zhang Date: Fri Apr 11 15:59:34 2025 +0800 drm/amdgpu: update xgmi info and vram_base_offset on resume For SRIOV VM env with XGMI enabled systems, XGMI physical node id may change when hibernate and resume with different VF. Update XGMI info and vram_base_offset on resume for gfx444 SRIOV env. Add amdgpu_virt_xgmi_migrate_enabled() as the feature flag. Signed-off-by: Jiang Liu Signed-off-by: Samuel Zhang Reviewed-by: Christian König Reviewed-by: Lijo Lazar Signed-off-by: Alex Deucher commit 0dffcea4121a5424d8ec4b8aef32feb9106726f1 Author: Karol Kolacinski Date: Thu May 1 15:54:17 2025 -0700 ice: add TSPLL log config helper Add a helper function to print new/current TSPLL config. This helps avoid unnecessary casts from u8 to enums. Reviewed-by: Michal Kubiak Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit b3b26c983a55d8309c8acea192ab54ed5af96c78 Author: Karol Kolacinski Date: Thu May 1 15:54:16 2025 -0700 ice: use designated initializers for TSPLL consts Instead of multiple comments, use designated initializers for TSPLL consts. Adjust ice_tspll_params_e82x fields sizes. Reviewed-by: Michal Kubiak Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit b14b2d076ce833ff5e55352f13b9e6213867f38b Author: Karol Kolacinski Date: Thu May 1 15:54:15 2025 -0700 ice: remove ice_tspll_params_e825 definitions Remove ice_tspll_params_e825 definitions as according to EDS (Electrical Design Specification) doc, E825 devices support only 156.25 MHz TSPLL frequency for both TCXO and TIME_REF clock source. Signed-off-by: Karol Kolacinski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit bf12bc439407e27f4dcfbbb40edec6278e1ad13a Author: Jacob Keller Date: Thu May 1 15:54:14 2025 -0700 ice: fix E825-C TSPLL register definitions The E825-C hardware has a slightly different register layout for register 19 of the Clock Generation Unit and TSPLL. The fbdiv_intgr value can be 10 bits wide. Additionally, most of the fields that were in register 24 are made available in register 23 instead. The programming logic already has a corrected definition for register 23, but it incorrectly still used the 8-bit definition of fbdiv_intgr. This results in truncating some of the values of fbdiv_intgr, including the value used for the 156.25MHz signal. The driver only used register 24 to obtain the enable status, which we should read from register 23. This results in an incorrect output for the log messages, but does not change any functionality besides disabled-by-default dynamic debug messages. Fix the register definitions, and adjust the code to properly reflect the enable/disable status in the log messages. Co-developed-by: Karol Kolacinski Signed-off-by: Karol Kolacinski Signed-off-by: Jacob Keller Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 1ff7a6c5d3f5d84a5036ef98bf8790de2ebd9360 Author: Karol Kolacinski Date: Thu May 1 15:54:13 2025 -0700 ice: rename TSPLL and CGU functions and definitions Rename TSPLL and CGU functions, definitions etc. to match the file name and have consistent naming scheme. Reviewed-by: Michal Kubiak Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit be7f0c1f47c75315f4b0f16432104cdb7ba0773c Author: Karol Kolacinski Date: Thu May 1 15:54:12 2025 -0700 ice: move TSPLL functions to a separate file Collect TSPLL related functions and definitions and move them to a separate file to have all TSPLL functionality in one place. Move CGU related functions and definitions to ice_common.* Reviewed-by: Michal Kubiak Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 7bd7209e9cb11c8864e601d915008da088476f0c Author: Lijuan Gao Date: Thu Jun 12 10:39:33 2025 +0800 arm64: dts: qcom: sa8775p: Correct the interrupt for remoteproc Fix the incorrect IRQ numbers for ready and handover on sa8775p. The correct values are as follows: Fatal interrupt - 0 Ready interrupt - 1 Handover interrupt - 2 Stop acknowledge interrupt - 3 Fixes: df54dcb34ff2e ("arm64: dts: qcom: sa8775p: add ADSP, CDSP and GPDSP nodes") Signed-off-by: Lijuan Gao Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250612-correct_interrupt_for_remoteproc-v1-2-490ee6d92a1b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit cd7312a78f36e981939abe1cd1f21d355e083dfe Author: Eduard Zingerman Date: Wed Jun 18 02:31:34 2025 -0700 selftests/bpf: include limits.h needed for PATH_MAX directly Constant PATH_MAX is used in function unpriv_helpers.c:open_config(). This constant is provided by include file . The dependency was added by commit [1], which does not include directly, relying instead on being included from zlib.h -> zconf.h. As it turns out, this is not the case for all systems, e.g. on Fedora 41 zlib 1.3.1 is used, and there is not included from zconf.h. Hence, there is a compilation error on Fedora 41. [1] commit fc2915bb8bfc ("selftests/bpf: More precise cpu_mitigations state detection") Fixes: fc2915bb8bfc ("selftests/bpf: More precise cpu_mitigations state detection") Signed-off-by: Eduard Zingerman Acked-by: Viktor Malik Link: https://lore.kernel.org/r/20250618093134.3078870-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 152d59f1ae404fed3e5f26a2d0505a2b9e168cba Author: Lukas Bulwahn Date: Fri Jun 6 11:08:02 2025 +0200 pmdomain: arm: scmi_pm_domain: remove code clutter There is no need to introduce the boolean power_on to select the constant value for state. Simply pass the value for state as argument. Just remove this code clutter. No functional change. Signed-off-by: Lukas Bulwahn Reviewed-by: Javier Martinez Canillas Reviewed-by: Sudeep Holla Link: https://lore.kernel.org/r/20250606090802.597504-1-lukas.bulwahn@redhat.com Signed-off-by: Ulf Hansson commit 7920de375d173809cbeb460a643c9ae2ff32909e Author: Sven Peter Date: Thu Jun 12 21:11:25 2025 +0000 pmdomain: apple: Drop default ARCH_APPLE in Kconfig When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Signed-off-by: Sven Peter Reviewed-by: Janne Grunau Link: https://lore.kernel.org/r/20250612-apple-kconfig-defconfig-v1-1-0e6f9cb512c1@kernel.org Signed-off-by: Ulf Hansson commit c01fba0b4869cada5403fffff416cd1675dba078 Author: Krzysztof Hałasa Date: Fri May 9 11:26:55 2025 +0200 imx8m-blk-ctrl: set ISI panic write hurry level Apparently, ISI needs cache settings similar to LCDIF. Otherwise we get artefacts in the image. Tested on i.MX8MP. Signed-off-by: Krzysztof Hałasa Link: https://lore.kernel.org/r/m3ldr69lsw.fsf@t19.piap.pl Signed-off-by: Ulf Hansson commit 3068b386232f0a7d84da6d1366dbd0b7926c5652 Author: Jonas Karlman Date: Sun May 18 22:06:49 2025 +0000 pmdomain: rockchip: Add support for RK3528 Add configuration and power domains for RK3528 SoC. Only PD_GPU can fully be powered down. PD_RKVDEC, PD_RKVENC, PD_VO and PD_VPU are used by miscellaneous devices in RK3528. Signed-off-by: Jonas Karlman Link: https://lore.kernel.org/r/20250518220707.669515-3-jonas@kwiboo.se Signed-off-by: Ulf Hansson commit 233eda069994182f10eb4013f8006705b22ca6b4 Author: Jonas Karlman Date: Sun May 18 22:06:50 2025 +0000 dt-bindings: rockchip: pmu: Add compatible for RK3528 Add the compatible for the pmu mfd on RK3528 SoC. Signed-off-by: Jonas Karlman Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250518220707.669515-4-jonas@kwiboo.se Signed-off-by: Ulf Hansson commit 8358102806c619d8d6c814010173617fb374b77e Author: Jonas Karlman Date: Sun May 18 22:06:48 2025 +0000 dt-bindings: power: rockchip: Add support for RK3528 Add the compatible string and power domains for RK3528 SoC. Signed-off-by: Jonas Karlman Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250518220707.669515-2-jonas@kwiboo.se Signed-off-by: Ulf Hansson commit 9a40347181c20313bee2fb7e10dd0865368b9e53 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:25 2025 +0200 pinctrl: amdisp: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-16-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit b8cd87c0e999b4689b1cab8906790ece5d00ab75 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:24 2025 +0200 pinctrl: as3722: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-15-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit 5956a3a9733703e8784daf6a1a3fb431724abf11 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:23 2025 +0200 pinctrl: sunxi: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-14-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit 84b91ca38f891cc149e1bbadb3bede206fbd4063 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:22 2025 +0200 pinctrl: keembay: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-13-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit d9727b48515b656e641173fb07462a5d93d493da Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:21 2025 +0200 pinctrl: spear: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-12-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit dfdbce964904daa4b6e874d11cf2e95f5f76213d Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:20 2025 +0200 pinctrl: pic32: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-11-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit 72c236f78edae3b500af3efa44b1504a3a9b6b60 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:19 2025 +0200 pinctrl: apple: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Janne Grunau Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-10-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit 66a07081110adc575b8d6cfc4cf618ce85d2f32e Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:18 2025 +0200 pinctrl: digicolor: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-9-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit 0f7ccc85d8e3559c91bd219a027b75d2d6c44305 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:17 2025 +0200 pinctrl: xway: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-8-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit e62acaef5d3b67648a7161b329ae8a5afce8c682 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:16 2025 +0200 pinctrl: xway: statify xway_pinconf_group_set() This function is not exported and is only used locally. Make it static. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-7-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit dffe286e2428a32bf5a70648d22a678b83080414 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:15 2025 +0200 pinctrl: aw9523: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-6-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit a23b8eab75a74ffcfb79676bb61ef557e1a4fb8d Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:14 2025 +0200 pinctrl: wmt: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-5-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit 8766f8e7f1ee2d5c8697ddcdc7b94e096982b433 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:13 2025 +0200 pinctrl: mcp23s08: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-4-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit 1a0a2c079b98d8b4c092ec97970bf12c9d94ba42 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:12 2025 +0200 pinctrl: da9062: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-3-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit fd81c42a830f5a82fc08403aa69909c532af33e5 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:11 2025 +0200 pinctrl: st: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-2-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit 1ae8c585f7051aecf1ed208a02a0298eaf999066 Author: Bartosz Golaszewski Date: Thu Jun 12 15:15:10 2025 +0200 pinctrl: sppctl: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-remaining-v1-1-556b0a530cd4@linaro.org Signed-off-by: Linus Walleij commit 17037b6f76e2019d554ebbe2591a107166d54f2b Author: Bartosz Golaszewski Date: Thu Jun 12 14:24:31 2025 +0200 pinctrl: starfive: jh7110: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Hal Feng Reviewed-by: Emil Renner Berthing Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-starfive-v1-2-8507b46516f5@linaro.org Signed-off-by: Linus Walleij commit 48773aa04b49ade6435c5f571501f7f2882b15fb Author: Bartosz Golaszewski Date: Thu Jun 12 14:24:30 2025 +0200 pinctrl: starfive: jh7100: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Hal Feng Reviewed-by: Emil Renner Berthing Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-starfive-v1-1-8507b46516f5@linaro.org Signed-off-by: Linus Walleij commit e52c741907fb9a3ca9433775d4d7c70e6c3a8078 Author: Bartosz Golaszewski Date: Thu Jun 12 14:19:54 2025 +0200 pinctrl: cirrus: cs42l43: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Charles Keepax Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-cirrus-v1-2-2d45c1f92557@linaro.org Signed-off-by: Linus Walleij commit 76ba1bb25cbbf836961839fee28554b84949462f Author: Bartosz Golaszewski Date: Thu Jun 12 14:19:53 2025 +0200 pinctrl: cirrus: lochnagar: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Charles Keepax Link: https://lore.kernel.org/20250612-gpiochip-set-rv-pinctrl-cirrus-v1-1-2d45c1f92557@linaro.org Signed-off-by: Linus Walleij commit 5b797bcc00ef6ac2d274406db7f6959c25af15e8 Author: Yulin Lu Date: Thu Jun 12 18:51:59 2025 +0800 pinctrl: eswin: Add EIC7700 pinctrl driver Add support for the pin controller in ESWIN's EIC7700 SoC, which supports pin multiplexing, pin configuration, and rgmii voltage control. Co-developed-by: Samuel Holland Signed-off-by: Samuel Holland Signed-off-by: Yulin Lu Link: https://lore.kernel.org/20250612105159.1241-1-luyulin@eswincomputing.com Signed-off-by: Linus Walleij commit 0a11110bfc5a95ee0416f76500ba0655f62d2baa Author: Yulin Lu Date: Thu Jun 12 18:48:11 2025 +0800 dt-bindings: pinctrl: eswin: Document for EIC7700 SoC Add EIC7700 pinctrl device for all configurable pins. For the EIC7700 pinctrl registers, each register (32 bits) controls the characteristics of a single pin. It supports setting function multiplexing, Schmitt trigger, drive strength, pull-up/pull-down, and input enable. Co-developed-by: Samuel Holland Signed-off-by: Samuel Holland Signed-off-by: Yulin Lu Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250612104811.1206-1-luyulin@eswincomputing.com Signed-off-by: Linus Walleij commit 5bc34be478d09c4d16009e665e020ad0fcd0deea Author: Tejun Heo Date: Fri Jun 13 15:23:30 2025 -1000 sched/core: Reorganize cgroup bandwidth control interface file writes - Move input parameter validation from tg_set_cfs_bandwidth() to the new outer function tg_set_bandwidth(). The outer function handles parameters in usecs, validates them and calls tg_set_cfs_bandwidth() which converts them into nsecs. This matches tg_bandwidth() on the read side. - max/min_cfs_* consts are now used by tg_set_bandwidth(). Relocate, convert into usecs and drop "cfs" from the names. - Reimplement cpu_cfs_{period|quote|burst}_write_*() using tg_bandwidth() and tg_set_bandwidth() and replace "cfs" in the names with "bw". - Update cpu_max_write() to use tg_set_bandiwdth(). cpu_period_quota_parse() is updated to drop nsec conversion accordingly. This aligns the behavior with cfs_period_quota_print(). - Drop now unused tg_set_cfs_{period|quota|burst}(). - While at it, for consistency, rename default_cfs_period() to default_bw_period_us() and make it return usecs. This is to prepare for adding bandwidth control support to sched_ext. tg_set_bandwidth() will be used as the muxing point. No functional changes intended. Signed-off-by: Tejun Heo Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250614012346.2358261-5-tj@kernel.org commit 43e33f53e25687ca870248d1939cfade0164426c Author: Tejun Heo Date: Fri Jun 13 15:23:29 2025 -1000 sched/core: Reorganize cgroup bandwidth control interface file reads - Update tg_get_cfs_*() to return u64 values. These are now used as the low level accessors to the fair's bandwidth configuration parameters. Translation to usecs takes place in these functions. - Add tg_bandwidth() which reads all three bandwidth parameters using tg_get_cfs_*(). - Reimplement cgroup interface read functions using tg_bandwidth(). Drop cfs from the function names. This is to prepare for adding bandwidth control support to sched_ext. tg_bandwidth() will be used as the muxing point similar to tg_weight(). No functional changes. Signed-off-by: Tejun Heo Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250614012346.2358261-4-tj@kernel.org commit de4c80c6963e130707ead16a544a387f811dbd87 Author: Tejun Heo Date: Fri Jun 13 15:23:28 2025 -1000 sched/core: Relocate tg_get_cfs_*() and cpu_cfs_*_read_*() Collect the getters, relocate the trivial interface file wrappers, and put all of them in period, quota, burst order to prepare for future changes. Pure reordering. No functional changes. Signed-off-by: Tejun Heo Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250614012346.2358261-3-tj@kernel.org commit d403a3689af5c3a3e3ac6e282958d0eaa69ca47f Author: Tejun Heo Date: Fri Jun 13 15:23:27 2025 -1000 sched/fair: Move max_cfs_quota_period decl and default_cfs_period() def from fair.c to sched.h max_cfs_quota_period is defined in core.c but has a declaration in fair.c. Move the declaration to kernel/sched/sched.h. Also, move default_cfs_period() from fair.c to sched.h. No functional changes. Signed-off-by: Tejun Heo Signed-off-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20250614012346.2358261-2-tj@kernel.org commit 9576e8d3c46cd7e14ce07981180520275c7152e6 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:45 2025 +0200 pinctrl: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) Acked-by: Chen-Yu Tsai Link: https://lore.kernel.org/20250611104348.192092-17-jirislaby@kernel.org Signed-off-by: Linus Walleij commit 5409d619f127cf121e572046aa6e2ed81c98d9bb Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:49 2025 +0200 rtc: stm32: Constify static 'pinctrl_desc' The local static 'struct pinctrl_desc' is not modified, so can be made const for code safety. Signed-off-by: Krzysztof Kozlowski Acked-by: Alexandre Belloni Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-17-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit 490bfd1ca55640e5f36e5e30245b4ab0f4a05118 Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:48 2025 +0200 pinctrl: Constify static 'pinctrl_desc' The local static 'struct pinctrl_desc' is not modified, so can be made const for code safety. Acked-by: Lorenzo Bianconi Acked-by: Jesper Nilsson Reviewed-by: Charles Keepax Signed-off-by: Krzysztof Kozlowski Reviewed-by: Hal Feng Acked-by: Emil Renner Berthing Acked-by: Vladimir Zapolskiy Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-16-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit c98ee6f300d213c1c5f9d39f5af4f944007a7aed Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:47 2025 +0200 pinctrl: pistachio: Constify static 'pinctrl_desc' The local static 'struct pinctrl_desc' is not modified, so can be made const for code safety after moving .pins and .npins assignment to definition. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-15-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit 10d038214b1b5b351e716e720fa1b4c07d24def8 Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:46 2025 +0200 pinctrl: renesas: Move fixed assignments to 'pinctrl_desc' definition Assign 'struct pinctrl_desc' .pins and .npins members in definition to make clear that number of pins is fixed and have less code in the probe. Reviewed-by: Geert Uytterhoeven Acked-by: Geert Uytterhoeven Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-14-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit d9ef8eec634c06c50bc96ac8eb556257a34ff13f Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:45 2025 +0200 pinctrl: palmas: Move fixed assignments to 'pinctrl_desc' definition Assign 'struct pinctrl_desc' .pins and .npins members in definition to make clear that number of pins is fixed and have less code in the probe. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-13-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit ed32213ffc1fae738f3d67c4be70ae14391fe347 Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:44 2025 +0200 pinctrl: max77620: Move fixed assignments to 'pinctrl_desc' definition Assign 'struct pinctrl_desc' .pins, .npins and other members in definition to make clear that number of pins is fixed and have less code in the probe. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-12-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit 1bd634e535db29055c106b5f0ce6f1569958ac5b Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:43 2025 +0200 pinctrl: as3722: Move fixed assignments to 'pinctrl_desc' definition Assign 'struct pinctrl_desc' .pins and .npins members in definition to make clear that number of pins is fixed and have less code in the probe. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-11-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit dd12fca44967ce66bf052644e47f99221715204f Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:42 2025 +0200 pinctrl: bcm: cygnus-nsp: Move fixed assignments to 'pinctrl_desc' definition Assign 'struct pinctrl_desc' .npins member in definition to make clear that number of pins is fixed and have less code in the probe. Reviewed-by: Florian Fainelli Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-10-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit 9b2ae7ca1ac9cf5b6b5ff934bfba900e59477ba3 Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:41 2025 +0200 pinctrl: bcm: cygnus-ns2: Move fixed assignments to 'pinctrl_desc' definition Assign 'struct pinctrl_desc' .npins member in definition to make clear that number of pins is fixed and have less code in the probe. Reviewed-by: Florian Fainelli Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-9-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit fa856a2c3fcd0f3e2e65360c3fb2045be5f36f3a Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:40 2025 +0200 pinctrl: bcm: cygnus-mux: Move fixed assignments to 'pinctrl_desc' definition Assign 'struct pinctrl_desc' .npins member in definition to make clear that number of pins is fixed and have less code in the probe. Reviewed-by: Florian Fainelli Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-8-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit 3cbbb91f11a15e88447e6ae78a6d4031ce502b27 Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:39 2025 +0200 pinctrl: bcm: Constify static 'pinctrl_desc' The local static 'struct pinctrl_desc' is not modified, so can be made const for code safety. Reviewed-by: Florian Fainelli Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-7-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit 25b306c484947b5f4baebb97e34163d9984dc480 Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:38 2025 +0200 pinctrl: nuvoton: Constify static 'pinctrl_desc' The local static 'struct pinctrl_desc' is not modified, so can be made const for code safety. Signed-off-by: Krzysztof Kozlowski Reviewed-by: J. Neuschäfer Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-6-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit e3d0571befa61a2692f6efb5f2c33926e99aea84 Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:37 2025 +0200 pinctrl: aspeed: Constify static 'pinctrl_desc' The local static 'struct pinctrl_desc' is not modified, so can be made const for code safety. Reviewed-by: Andrew Jeffery Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-5-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit 9724e6f1953644cc9a5d102605d624bc79609038 Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:36 2025 +0200 pinctrl: Constify pointers to 'pinctrl_desc' Pin controller core code only stores the pointer to 'struct pinctrl_desc' and does not modify it anywhere. The pointer can be changed to pointer to const which makes the code safer, explicit and later allows constifying 'pinctrl_desc' allocations in individual drivers. Reviewed-by: Geert Uytterhoeven Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-4-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit 91ed43b045119fe47b256af83eb7ad35eb0ba356 Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:35 2025 +0200 pinctrl: amd: Constify pointers to 'pinctrl_desc' Internal functions obtaining pointers to 'struct pinctrl_desc' do not modify the contents so they can be made pointers to const. This makes code safer, explicit and later allows constifying 'pinctrl_desc' in pinctrl core code. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-3-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit 1982621decaf788d0611fc291fe89b297b6e5510 Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:34 2025 +0200 pinctrl: Allow compile testing for K210, TB10X and ZYNQ Pinctrl drivers for K210, TB10X and ZYNQ do not reference any machine headers, thus can be compile tested for increased build coverage. Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-2-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit 9b369669452f500fc7334aad62bd8c96a075245f Author: Krzysztof Kozlowski Date: Wed Jun 11 08:13:33 2025 +0200 pinctrl: starfive: Allow compile testing on other platforms Always descent to drivers/pinctrl/starfive/ because limiting it with SOC_STARFIVE is redundant since its Makefile doesn't build anything if no Starfive-specific pin control Kconfig options are enabled. This allows compile testing on other architectures with allyesconfig. Reviewed-by: Geert Uytterhoeven Signed-off-by: Krzysztof Kozlowski Reviewed-by: Emil Renner Berthing Acked-by: Hal Feng Link: https://lore.kernel.org/20250611-pinctrl-const-desc-v2-1-b11c1d650384@linaro.org Signed-off-by: Linus Walleij commit a39a6acc375de395aba66664ea36df312ab57501 Author: Matthew Wilcox (Oracle) Date: Wed Jun 11 16:59:10 2025 +0100 vmcoreinfo: Remove documentation of PG_slab and PG_hugetlb The changes to kernel/vmcore_info.c were sadly not reflected in the documentation. Rectify that for both these flags as well as adding PAGE_UNACCEPTED_MAPCOUNT_VALUE. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Harry Yoo Link: https://patch.msgid.link/20250611155916.2579160-8-willy@infradead.org Signed-off-by: Vlastimil Babka commit 18085170994c9bd0970e25331dab758789918286 Author: Matthew Wilcox (Oracle) Date: Wed Jun 11 16:59:09 2025 +0100 doc: Add slab internal kernel-doc We don't have much real internal documentation to extract yet, but let's make sure that what we do have is available. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Harry Yoo Link: https://patch.msgid.link/20250611155916.2579160-7-willy@infradead.org Signed-off-by: Vlastimil Babka commit e8a45f198e3ae2434108f815bc28f37f6fe6742b Author: Jonathan Corbet Date: Wed Jun 11 16:59:08 2025 +0100 slub: Fix a documentation build error for krealloc() The kerneldoc comment for krealloc() contains an unmarked literal block, leading to these warnings in the docs build: ./mm/slub.c:4936: WARNING: Block quote ends without a blank line; unexpected unindent. [docutils] ./mm/slub.c:4936: ERROR: Undefined substitution referenced: "--------". [docutils] Mark up and indent the block properly to bring a bit of peace to our build logs. Fixes: 489a744e5fb1 (mm: krealloc: clarify valid usage of __GFP_ZERO) Signed-off-by: Jonathan Corbet Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20250611155916.2579160-6-willy@infradead.org Signed-off-by: Vlastimil Babka commit 3df29914d9fd1a28ff0630ad5aa8a92abb97543d Author: Matthew Wilcox (Oracle) Date: Wed Jun 11 16:59:07 2025 +0100 slab: Add SL_pfmemalloc flag Give slab its own name for this flag. Move the implementation from slab.h to slub.c since it's only used inside slub.c. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Harry Yoo Link: https://patch.msgid.link/20250611155916.2579160-5-willy@infradead.org Signed-off-by: Vlastimil Babka commit c5c44900f4739b14af71875bbd407c81bf576d04 Author: Matthew Wilcox (Oracle) Date: Wed Jun 11 16:59:06 2025 +0100 slab: Add SL_partial flag Give slab its own name for this flag. Keep the PG_workingset alias information in one place. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Harry Yoo Link: https://patch.msgid.link/20250611155916.2579160-4-willy@infradead.org Signed-off-by: Vlastimil Babka commit 30908096dd8d79b66d987782df04d14e1c907c25 Author: Matthew Wilcox (Oracle) Date: Wed Jun 11 16:59:05 2025 +0100 slab: Rename slab->__page_flags to slab->flags Slab has its own reasons for using flag bits; they aren't just the page bits. Maybe this won't be the ultimate solution, but we should be clear that these bits are in use. Signed-off-by: Matthew Wilcox (Oracle) Link: https://patch.msgid.link/20250611155916.2579160-3-willy@infradead.org Signed-off-by: Vlastimil Babka commit 262e086f93026a6633da034f270c4baae47c4706 Author: Matthew Wilcox (Oracle) Date: Wed Jun 11 16:59:04 2025 +0100 doc: Move SLUB documentation to the admin guide This section is supposed to be for internal documentation, while the document is advice for sysadmins. Move it to the appropriate place. Signed-off-by: Matthew Wilcox (Oracle) Acked-by: Harry Yoo Link: https://patch.msgid.link/20250611155916.2579160-2-willy@infradead.org Signed-off-by: Vlastimil Babka commit b649082312dd1a4c3989bbdb7c25eb711e9b1d94 Author: Will Deacon Date: Wed Jun 11 10:34:25 2025 +0100 arm64: dts: exynos: gs101: Add 'local-timer-stop' to cpuidle nodes In preparation for switching to the architected timer as the primary clockevents device, mark the cpuidle nodes with the 'local-timer-stop' property to indicate that an alternative clockevents device must be used for waking up from the "c2" idle state. Signed-off-by: Will Deacon [Original commit from https://android.googlesource.com/kernel/gs/+/a896fd98638047989513d05556faebd28a62b27c] Signed-off-by: Will McVicker Reviewed-by: Youngmin Nam Tested-by: Youngmin Nam Fixes: ea89fdf24fd9 ("arm64: dts: exynos: google: Add initial Google gs101 SoC support") Signed-off-by: Peter Griffin Reviewed-by: Peter Griffin Tested-by: Peter Griffin Link: https://lore.kernel.org/r/20250611-gs101-cpuidle-v2-1-4fa811ec404d@linaro.org Signed-off-by: Krzysztof Kozlowski commit 7b20980ffc11514d8849811857d915001236bcfa Author: Rob Herring (Arm) Date: Mon Jun 9 17:08:59 2025 -0500 dt-bindings: gpio: arm,pl061: Drop interrupt properties as required It is possible that the PL061 doesn't have any interrupt connected and can't be an interrupt provider, so drop the interrupt properties as required. The LG LG131x SoCs are one example of this. Signed-off-by: Rob Herring (Arm) Acked-by: Linus Walleij Link: https://lore.kernel.org/r/20250609220900.3035642-1-robh@kernel.org [Bartosz: g/pl011/pl061/] Signed-off-by: Bartosz Golaszewski commit fc4842cd0f117042a648cf565da4db0c04a604be Merge: ec315832f6f98f 8c587aa3fa5400 Author: David S. Miller Date: Wed Jun 18 10:46:31 2025 +0100 Merge branch 'netconsole-msgid' into main Gustavo Luiz Duarte says: ==================== netconsole: Add support for msgid in sysdata This patch series introduces a new feature to netconsole which allows appending a message ID to the userdata dictionary. If the msgid feature is enabled, the message ID is built from a per-target 32 bit counter that is incremented and appended to every message sent to the target. Example:: echo 1 > "/sys/kernel/config/netconsole/cmdline0/userdata/msgid_enabled" echo "This is message #1" > /dev/kmsg echo "This is message #2" > /dev/kmsg 13,434,54928466,-;This is message #1 msgid=1 13,435,54934019,-;This is message #2 msgid=2 This feature can be used by the target to detect if messages were dropped or reordered before reaching the target. This allows system administrators to assess the reliability of their netconsole pipeline and detect loss of messages due to network contention or temporary unavailability. --- Changes in v3: - Add kdoc documentation for msgcounter. - Link to v2: https://lore.kernel.org/r/20250612-netconsole-msgid-v2-0-d4c1abc84bac@gmail.com Changes in v2: - Use wrapping_assign_add() to avoid warnings in UBSAN and friends. - Improve documentation to clarify wrapping and distinguish msgid from sequnum. - Rebase and fix conflict in prepare_extradata(). - Link to v1: https://lore.kernel.org/r/20250611-netconsole-msgid-v1-0-1784a51feb1e@gmail.com ==================== Suggested-by: Breno Leitao Signed-off-by: Gustavo Luiz Duarte Signed-off-by: David S. Miller commit 82a0302e7167d0b7c6cde56613db3748f8dd806d Author: Herbert Xu Date: Mon Jun 16 16:38:49 2025 +0800 padata: Remove comment for reorder_work Remove comment for reorder_work which no longer exists. Reported-by: Stephen Rothwell Fixes: 71203f68c774 ("padata: Fix pd UAF once and for all") Signed-off-by: Herbert Xu commit 8c587aa3fa5400467063f88a3a48f8e9480b2e33 Author: Gustavo Luiz Duarte Date: Mon Jun 16 10:08:39 2025 -0700 docs: netconsole: document msgid feature Add documentation explaining the msgid feature in netconsole. This feature appends unique id to the userdata dictionary. The message ID is populated from a per-target 32 bit counter which is incremented for each message sent to the target. This allows a target to detect if messages are dropped before reaching the target. Signed-off-by: Gustavo Luiz Duarte Signed-off-by: David S. Miller commit 68707c079e584f11b3f768f6ac1066a501c650b4 Author: Gustavo Luiz Duarte Date: Mon Jun 16 10:08:38 2025 -0700 selftests: netconsole: Add tests for 'msgid' feature in sysdata Extend the self-tests to cover the 'msgid' feature in sysdata. Verify that msgid is appended to the message when the feature is enabled and that it is not appended when the feature is disabled. Signed-off-by: Gustavo Luiz Duarte Reviewed-by: Breno Leitao Signed-off-by: David S. Miller commit c5efaabd45ad1c93679c2529f778569cb2b828c6 Author: Gustavo Luiz Duarte Date: Mon Jun 16 10:08:37 2025 -0700 netconsole: append msgid to sysdata Add msgcounter to the netconsole_target struct to generate message IDs. If the msgid_enabled attribute is true, increment msgcounter and append msgid= to sysdata buffer before sending the message. Signed-off-by: Gustavo Luiz Duarte Reviewed-by: Breno Leitao Signed-off-by: David S. Miller commit 53def0c4c857d18b553c68b30df13d9229726809 Author: Gustavo Luiz Duarte Date: Mon Jun 16 10:08:36 2025 -0700 netconsole: implement configfs for msgid_enabled Implement the _show and _store functions for the msgid_enabled configfs attribute under userdata. Set the sysdata_fields bit accordingly. Reviewed-by: Breno Leitao Signed-off-by: Gustavo Luiz Duarte Signed-off-by: David S. Miller commit 15b3c930a29fe00971b52af8b87b1a1d67305190 Author: Gustavo Luiz Duarte Date: Mon Jun 16 10:08:35 2025 -0700 netconsole: introduce 'msgid' as a new sysdata field This adds a new sysdata field to enable assigning a per-target unique id to each message sent to that target. This id can later be appended as part of sysdata, allowing targets to detect dropped netconsole messages. Update count_extradata_entries() to take the new field into account. Reviewed-by: Breno Leitao Signed-off-by: Gustavo Luiz Duarte Signed-off-by: David S. Miller commit 134442a04bb9a6981923cbb24f041b5f5690bda6 Author: Faraz Ata Date: Fri Jun 13 11:52:08 2025 +0530 arm64: dts: exynosautov920: Add DT node for all SPI ports Universal Serial Interface (USI) supports three serial protocol like uart, i2c and spi. ExynosAutov920 has 18 instances of USI. Add spi nodes for all the instances. Signed-off-by: Faraz Ata Link: https://lore.kernel.org/r/20250613062208.978641-1-faraz.ata@samsung.com Signed-off-by: Krzysztof Kozlowski commit 4cdf874f67adfdec4f0a288c76f9aba05f9babe2 Author: Fabien Dessenne Date: Tue Jun 10 17:23:06 2025 +0200 dt-bindings: pinctrl: stm32: Add RSVD mux function Document the RSVD (Reserved) mux function, used to reserve pins for a coprocessor not running Linux. Signed-off-by: Fabien Dessenne Signed-off-by: Antonio Borneo Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250610152309.299438-3-antonio.borneo@foss.st.com Signed-off-by: Linus Walleij commit a88ca6deca4f19c95811433aa23bab7b74d182bb Author: Fabien Dessenne Date: Tue Jun 10 17:23:05 2025 +0200 pinctrl: stm32: Handle RSVD pin configuration When a pin is assigned to a coprocessor not running Linux, the pin should be flagged in the DT as reserved and not usable by Linux. Add pin configuration RSVD (Reserved) and instrument the driver to not update the mux setting. Signed-off-by: Fabien Dessenne Signed-off-by: Antonio Borneo Link: https://lore.kernel.org/20250610152309.299438-2-antonio.borneo@foss.st.com Signed-off-by: Linus Walleij commit ffaf1bf3737f706e4e9be876de4bc3c8fc578091 Author: RubenKelevra Date: Wed Jun 18 01:09:27 2025 +0200 fs_context: fix parameter name in infofc() macro The macro takes a parameter called "p" but references "fc" internally. This happens to compile as long as callers pass a variable named fc, but breaks otherwise. Rename the first parameter to “fc” to match the usage and to be consistent with warnfc() / errorfc(). Fixes: a3ff937b33d9 ("prefix-handling analogues of errorf() and friends") Signed-off-by: RubenKelevra Link: https://lore.kernel.org/20250617230927.1790401-1-rubenkelevra@gmail.com Signed-off-by: Christian Brauner commit da5b24fbf4b8aac24c20bb948e51850ae9426c87 Author: Antonio Borneo Date: Tue Jun 10 16:30:42 2025 +0200 MAINTAINERS: Add entry for STM32 pinctrl drivers and documentation Add an entry to make myself a maintainer of STM32 pinctrl drivers and documentation. Exclude the HDP driver, already covered by another maintainer. Signed-off-by: Antonio Borneo Link: https://lore.kernel.org/20250610143042.295376-6-antonio.borneo@foss.st.com Signed-off-by: Linus Walleij commit dba0aff2b89bd106601ed88dfda44fdd3218eb53 Author: Stephane Danieau Date: Tue Jun 10 16:30:41 2025 +0200 pinctrl: stm32: Allow compile as module for stm32mp257 Add ability to build pinctrl for stm32mp257 as a kernel module. Add kernel-doc to the exported symbols. Signed-off-by: Stephane Danieau Signed-off-by: Antonio Borneo Link: https://lore.kernel.org/20250610143042.295376-5-antonio.borneo@foss.st.com Signed-off-by: Linus Walleij commit d6c8fceb33d9cc983a5d050f9c3714fe15a51279 Author: Antonio Borneo Date: Tue Jun 10 16:30:40 2025 +0200 pinctrl: stm32: Add RIF support for stm32mp257 On SoC stm32mp257, GPIO supports security and isolation compliant with the Resource Isolation Framework (RIF). Each GPIO line can be assigned to different security and compartment domains. Add the generic code to handle the RIF configuration set by the secure world and initialize the GPIO valid mask accordingly. Enable the RIF support for stm32mp257. Co-developed-by: Gatien Chevallier Signed-off-by: Gatien Chevallier Signed-off-by: Antonio Borneo Link: https://lore.kernel.org/20250610143042.295376-4-antonio.borneo@foss.st.com Signed-off-by: Linus Walleij commit 4c5cc2f65386e22166ce006efe515c667aa075e4 Author: Cheick Traore Date: Tue Jun 10 16:30:39 2025 +0200 pinctrl: stm32: Manage irq affinity settings Trying to set the affinity of the interrupts associated to stm32 pinctrl results in a write error. Fill struct irq_chip::irq_set_affinity to use the default helper function. Signed-off-by: Cheick Traore Signed-off-by: Antonio Borneo Link: https://lore.kernel.org/20250610143042.295376-3-antonio.borneo@foss.st.com Signed-off-by: Linus Walleij commit 9b71efc450fdd2f70d59917025da34f8b0e81135 Author: Antonio Borneo Date: Tue Jun 10 16:30:38 2025 +0200 pinctrl: stm32: Declare stm32_pmx_get_mode() as static The commit acaa037970f6 ("pinctrl: stm32: Implement .get_direction gpio_chip callback") exported the function stm32_pmx_get_mode() and the struct stm32_gpio_bank, but these were never used outside the file that defines them. Declare the function as static, drop it from the include file and drop also the struct, not anymore visible outside the file. Signed-off-by: Antonio Borneo Link: https://lore.kernel.org/20250610143042.295376-2-antonio.borneo@foss.st.com Signed-off-by: Linus Walleij commit d22d5f47ecb2c4e140c0ee52204f4dd8fd0e85eb Author: Arnd Bergmann Date: Tue Jun 10 11:25:22 2025 +0200 mtd: nftl: reduce stack usage in NFTL_movebuf() The code in the ntfl write function is rather complex, and it contains a 512 byte on-stack buffer. The combination of these two leads to using more than the per-function stack warning limit in some configurations, especially with KASAN enabled: drivers/mtd/nftlcore.c:673:12: error: stack frame size (1328) exceeds limit (1280) in 'nftl_writeblock' [-Werror,-Wframe-larger-than] Avoid this warning by moving the on-stack buffer into a separate function that only copies one part of the device to another. This does not really help with the total maximum stack usage in the (non-KASAN) normal case, but it does two things: - no single function has more than the warning limit - the complexity goes down, so the parent function ends up spilling few local variables, and the total actually goes down slightly. Signed-off-by: Arnd Bergmann Signed-off-by: Miquel Raynal commit 27b045eb3e30ce9a436b8ee5bcb4869f7e3522a6 Author: Frank Li Date: Mon Jun 2 10:09:45 2025 -0400 dt-bindings: mtd: convert nxp-spifi.txt to yaml format Convert nxp-spifi.txt to yaml format. Additional changes: - ref /schemas/spi/spi-controller.yaml. - remove label in example. - change node name to spi in example. - remove child node in example. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal commit 1a45ef022f0364186d4fb2f4e5255dcae1ff638a Author: Thomas Zimmermann Date: Mon Jun 16 10:37:06 2025 +0200 drm/format-helper: Move drm_fb_build_fourcc_list() to sysfb helpers Only sysfb drivers use drm_fb_build_fourcc_list(). Move the function to sysfb helpers and rename it accordingly. Update drivers and tests. v3: - update naming in tests v2: - select DRM_SYSFB_HELPER (kernel test robot) Signed-off-by: Thomas Zimmermann Reviewed-by: José Expósito Acked-by: Maxime Ripard Acked-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250616083846.221396-4-tzimmermann@suse.de commit 4f522a44d9e4f630cca73b88fe59d5f7975c8379 Author: Thomas Zimmermann Date: Mon Jun 16 10:37:05 2025 +0200 drm/tests: Test drm_fb_build_fourcc_list() in separate test suite Only sysfb drivers use drm_fb_build_fourcc_list(). The helper will be moved from format helpers to sysfb helpers. Moving the related tests to their own test suite. v3: - rename tests according to filename (José) v2: - rename filename to match tested code (Maxime) Signed-off-by: Thomas Zimmermann Reviewed-by: José Expósito Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250616083846.221396-3-tzimmermann@suse.de commit 5a4856e0e38109ba994f369962f054ecb445c098 Author: Thomas Zimmermann Date: Mon Jun 16 10:37:04 2025 +0200 drm/tests: Do not use drm_fb_blit() in format-helper tests Export additional helpers from the format-helper library and open-code drm_fb_blit() in tests. Prepares for the removal of drm_fb_blit(). Only sysfb drivers use drm_fb_blit(). The function will soon be removed from format helpers and be refactored within sysfb helpers. Signed-off-by: Thomas Zimmermann Reviewed-by: José Expósito Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250616083846.221396-2-tzimmermann@suse.de commit 7f4c540e0859e2025675d2c5c5c6ab88eaf817e2 Author: wangdicheng Date: Mon Jun 16 15:43:31 2025 +0800 ALSA: hda/conexant: Renaming the codec with device ID 0x1f86 and 0x1f87 Due to changes in the manufacturer's plan, all 0x14f11f86 will be named CX11880, and 0x14f11f87 will be named SN6140 Signed-off-by: wangdicheng Link: https://patch.msgid.link/20250616074331.581309-1-wangdich9700@163.com Signed-off-by: Takashi Iwai commit 642b70d526ab8daa8f256dfc1eb6bf27c3290cc6 Author: Frank Li Date: Thu May 22 13:56:48 2025 -0400 media: imx8mq-mipi-csi2: Add support for i.MX8QXP Add support for i.MX8QXP, which has a dedicated control and status register (CSR) space. Enable obtaining the second register space and initializing PHY and link settings accordingly. Reviewed-by: Laurent Pinchart Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-10-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 382d53e9cefb3ca3fd0330ea609b94cb544e86b5 Author: Guoniu.zhou Date: Thu May 22 13:56:47 2025 -0400 media: imx8mq-mipi-csi2: Add imx8mq_plat_data for different compatible strings Introduce `imx8mq_plat_data` along with enable/disable callback operations to facilitate support for new chips. No functional changes. Signed-off-by: Guoniu.zhou Reviewed-by: Laurent Pinchart Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-9-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 1d2d96f5998a8a489919ff9504547b5f5845b967 Author: Robert Chiras Date: Thu May 22 13:56:46 2025 -0400 media: dt-bindings: nxp,imx8mq-mipi-csi2: Add i.MX8QM(QXP) compatible strings Add compatible strings for i.MX8QM/i.MX8QXP platform. Remove fsl,mipi-phy-gpr from required properties and add new reg space, since i.MX8QM and i.MX8QXP use dedicate control and status register(csr) space. Keep the same restriction for other compatible strings. Signed-off-by: Robert Chiras Reviewed-by: Laurent Pinchart Reviewed-by: Rob Herring (Arm) Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-8-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 859278460faa4e52e4b01c8b997bab57af460067 Author: Robert Chiras Date: Thu May 22 13:56:45 2025 -0400 media: imx8-isi: Add support for i.MX8QM and i.MX8QXP Add compatibles and platform data for i.MX8QM and i.MX8QXP platforms. i.MX8QM's IER register layout is difference with i.MX8QXP. Signed-off-by: Robert Chiras Reviewed-by: Laurent Pinchart Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-7-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit dee8521f698742732507520cfb122de6df447e72 Author: Frank Li Date: Thu May 22 13:56:44 2025 -0400 media: nxp: imx8-isi: Use dev_err_probe() to simplify code Use dev_err_probe() simplify code. No functional changes intended. Reviewed-by: Laurent Pinchart Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-6-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 73a40554f979eb0e441dbc9df4b84effdedb1e87 Author: Frank Li Date: Thu May 22 13:56:43 2025 -0400 media: nxp: imx8-isi: Remove redundant check for dma_set_mask_and_coherent() dma_set_mask_and_coherent() never return failure when mask bigger than 32bit. See commit f7ae20f2fc4e ("docs: dma: correct dma_set_mask() sample code") So remove return value check for dma_set_mask_and_coherent(). Reviewed-by: Laurent Pinchart Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-5-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 60b8de2b9b4be249c47e100e692d240d661e056b Author: Frank Li Date: Thu May 22 13:56:42 2025 -0400 media: nxp: imx8-isi: Use devm_clk_bulk_get_all() to fetch clocks Use devm_clk_bulk_get_all() helper to simplify clock handle code. No functional changes intended. Signed-off-by: Frank Li Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-4-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 66ede6d71d4e8782754b1dffd587877715015b5e Author: Frank Li Date: Thu May 22 13:56:41 2025 -0400 media: nxp: imx8-isi: Remove unused offset in mxc_isi_reg and use BIT() macro for mask Preserve clarity by removing the unused 'offset' field in struct mxc_isi_reg, as it duplicates information already indicated by the mask and remains unused. Improve readability by replacing hex value masks with the BIT() macro. No functional change. Reviewed-by: Laurent Pinchart Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-3-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 2021b8d51cdb514da22f2c9bc05e123d19277d1d Author: Frank Li Date: Thu May 22 13:56:40 2025 -0400 media: nxp: imx8-isi: Allow num_sources to be greater than num_sink Allow num_sources (drvdata: num_channels) to be greater than num_sink (drvdata: num_ports + 1). ISI support stream multiplexing, such as differentiates multiple cameras from a single 2-lane MIPI input, or duplicates input stream into multiple outputs. So num_channels may be greater than num_ports at some platform. Reviewed-by: Laurent Pinchart Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-2-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit c4891010d8194bda9c268cc9330ba9e342d7c4b6 Author: Frank Li Date: Thu May 22 13:56:39 2025 -0400 media: dt-bindings: Add binding doc for i.MX8QXP and i.MX8QM ISI Add binding documentation for i.MX8QXP and i.MX8QM ISI. The clock-names, power-domains, and ports differ significantly from the existing nxp,imx8-isi.yaml. Create a new file to avoid complex if-else branches. Add new file to MAINTAINERS. Reviewed-by: Rob Herring (Arm) Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250522-8qxp_camera-v5-1-d4be869fdb7e@nxp.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 038d27acf987c52879a08d7e8160907372cbeb35 Author: Laurent Pinchart Date: Fri Jun 6 12:05:33 2025 +0300 media: imx-mipi-csis: Use CSI-2 data type macros from mipi-csi2.h The imx-mipi-csis defines custom macros for the CSI-2 data types, duplicating the centralized macros defines in mipi-csi2.h. Replace them with the latter. Reviewed-by: Rui Miguel Silva Reviewed-by: Stefan Klug Reviewed-by: Frank Li Link: https://lore.kernel.org/r/20250606090533.10711-1-laurent.pinchart@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit cd403e8aed6caad87967d2c135b57d92ba8e5544 Author: Jai Luthra Date: Tue Jun 10 17:55:27 2025 +0530 media: rockchip: rkisp1: Add support for Wide Dynamic Range RKISP supports a basic Wide Dynamic Range (WDR) module since the first iteration (v1.0) of the ISP. Add support for enabling and configuring it using extensible parameters. Also, to ease programming, switch to using macro variables for defining the tonemapping curve register addresses. Reviewed-by: Stefan Klug Tested-by: Stefan Klug Reviewed-by: Paul Elder Reviewed-by: Laurent Pinchart Signed-off-by: Jai Luthra Link: https://lore.kernel.org/r/20250610-wdr-latest-v4-1-b69d0ac17ce9@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 7c8c957ef12c41968adb66d785ce1dd5fb2f96e7 Author: Stefan Klug Date: Fri May 23 17:14:31 2025 +0200 media: rkisp1: Add RKISP1_CID_SUPPORTED_PARAMS_BLOCKS control Add a RKISP1_CID_SUPPORTED_PARAMS_BLOCKS V4L2 control to be able to query the parameters blocks supported by the current kernel on the current hardware from user space. Signed-off-by: Stefan Klug Reviewed-by: Paul Elder Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250523-supported-params-and-wdr-v3-2-7283b8536694@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 4d78051cd6a7ce8e88d4e6dfed8ee0e133116287 Author: Stefan Klug Date: Fri May 23 17:14:30 2025 +0200 media: rkisp1: Properly handle result of rkisp1_params_init_vb2_queue() Properly handle the return of rkisp1_params_init_vb2_queue(). It is very unlikely that this ever fails without code changes but should be handled anyways. While at it rename the error label for easier extension in the upcoming patch. Signed-off-by: Stefan Klug Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250523-supported-params-and-wdr-v3-1-7283b8536694@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit f3bc718228d0a2d102a1b20ef63b0cadbf6219f0 Author: Krzysztof Hałasa Date: Fri May 9 09:58:09 2025 +0200 media: nxp: imx8-isi: Simplify a couple of error messages The error messages in the mxc_isi_crossbar_enable_streams() and mxc_isi_crossbar_disable_streams() functions are similar, with a single word difference between them. The word is moved out of the format string to a separate dev_err() argument to try and save memory through string de-duplication. The total savings are however small, as the .data size reduction is partly offset by a .text size increase, with a total saving of 8 bytes in total on an ARM64 platforms. They also come at the cost of making the error message difficult to grep, which outweights the gains. Simplify the error messages to make them grep-able. Signed-off-by: Krzysztof Hałasa Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/m3plgi9pwu.fsf@t19.piap.pl Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit d06c1a9f348d22478c6bc5684f9c990e15ada1e9 Author: Jacopo Mondi Date: Tue Jun 17 09:23:28 2025 +0200 media: vsp1: Add VSPX support Add support for VSPX, a specialized version of the VSP2 that transfers data to the ISP. The VSPX is composed of two RPF units to read data from external memory and an IIF instance that performs transfer towards the ISP. The VSPX is supported through a newly introduced vsp1_vspx.c file that exposes two interfaces: vsp1_vspx interface, declared in vsp1_vspx.h for the vsp1 core to initialize and cleanup the VSPX, and a vsp1_isp interface, declared in include/media/vsp1.h for the ISP driver to control the VSPX operations. Tested-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Signed-off-by: Jacopo Mondi Link: https://lore.kernel.org/r/20250617-b4-vspx-v13-1-9f4054c1c9af@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit fe2a3493c597869322c2e68ada77c44a84a42e81 Author: Jacopo Mondi Date: Mon Jun 16 18:30:38 2025 +0200 media: vsp1: vsp1_dl: Count display lists To detect leaks of display lists, store in the display list manager the number of allocated display lists when the manager is created and verify that when the display manager is reset the same number of lists is available in the free list. Signed-off-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250616-vsp1_dl_list_count-v2-2-7d3f43fb1306@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 30e77ed16bdc79f55b06192a1f5445bd0515fb54 Author: Jacopo Mondi Date: Mon Jun 16 18:30:37 2025 +0200 media: vsp1: vsp1_dl: Detect double list release In order to detect invalid usage pattern such as double list_put() calls, add an 'allocated' flag to each display list. Set the flag whenever a list is get() and clear it when the list is put(). Warn if a list not marked as allocated is returned to the pool of available display lists. Signed-off-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250616-vsp1_dl_list_count-v2-1-7d3f43fb1306@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 9b7e558c5c72b67ae884709088026efc6b3b5b4a Author: Koji Matsuoka Date: Mon Jun 16 14:14:25 2025 +0200 media: vsp1: Reset FCP after VSPD According to the R-Car Gen3 H/W manual v2.40, and R-Car Gen4 H/W manual v1.20, the FCP must be reset after resetting the VSPD, except for the VSPDL. Do so. Signed-off-by: Koji Matsuoka Signed-off-by: LUU HOAI Signed-off-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250616-vspx-reset-v2-2-6cc12ed7e9bb@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 6c1dedf805ecd304236a83a2057ed803fb6b32f6 Author: Jacopo Mondi Date: Mon Jun 16 14:14:24 2025 +0200 media: rcar-fcp: Add rcar_fcp_soft_reset() Add a function to perform soft reset of the FCP. It is intended to support the correct stop procedure of the VSPX-FCPVX and VSPD-FCPD pairs according to section "62.3.7.3 Reset Operation" of the R-Car Hardware Manual at revision 1.20. Signed-off-by: Jacopo Mondi Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250616-vspx-reset-v2-1-6cc12ed7e9bb@ideasonboard.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit d883f2e7f47a39873c957175c9e1cc7df093447f Author: Niklas Söderlund Date: Mon Jun 16 20:57:22 2025 +0200 media: rcar-vin: Generate FRAME_SYNC events Enable the VSYNC Rising Edge Detection interrupt and generate a FRAME_SYNC event form it. The interrupt is available on all supported models of the VIN (Gen2, Gen3 and Gen4). Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250616185722.980722-4-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 82bdeae10e3e0e88770f34813c7a0c67b1737d5e Author: Niklas Söderlund Date: Mon Jun 16 20:57:21 2025 +0200 media: rcar-vin: Check for correct capture interrupt event Depending on if the capture session deals with fields or whole frames interrupts can be generated at an end of field, or end of frame event. The interrupt mask is setup to generate an interrupt on one of the two events depending on what is needed when the VIN is started. The end of field bit is set in both cases so controlling the mask that generates an interrupt have been enough to control the two use-cases. Before extending the interrupt handler to deal with other types of interrupt events it is needs to extended to "capture complete" check for correct the use-case in operation. Without this the simplification in the handler can result in corrupted frames when the mask on what type of events can generate an interrupt generated can no longer be assumed to only be an "capture complete" event. Which bit is checked matches which bit is enabled at configuration time as which event can generate an interrupt for "capture complete". There is no functional change. While at it switch to use the BIT() macro to describe the bit positions for the interrupt functions. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250616185722.980722-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 8e5e3da9c63295e5a21ba70e63f17f2a790529c6 Author: Niklas Söderlund Date: Mon Jun 16 20:57:20 2025 +0200 media: rcar-vin: Fold interrupt helpers into only callers The call sites using the interrupt helper functions have all been reworked to only one for each. Fold each of them into the only call sites left. This fixes a possible interrupt loss in case an interrupt occurs between reading VNINTS_REG in rvin_get_interrupt_status() and reading it again in rvin_ack_interrupt(). While at it rename the variable holding the current interrupt status to make the code easier to read. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250616185722.980722-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit c5aeb681fcdd23d042d780f89ddcf908a13baee2 Author: Wenmeng Liu Date: Thu Jun 12 16:01:26 2025 +0800 arm64: dts: qcom: sm8550: Add support for camss Add support for the camera subsystem on the SM8550 Qualcomm SoC. This includes bringing up the CSIPHY, CSID, VFE/RDI interfaces. SM8550 provides - 3 x VFE, 3 RDI per VFE - 2 x VFE Lite, 4 RDI per VFE - 3 x CSID - 2 x CSID Lite - 8 x CSI PHY Co-developed-by: Depeng Shao Signed-off-by: Depeng Shao Signed-off-by: Wenmeng Liu Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Reviewed-by: Vladimir Zapolskiy Link: https://lore.kernel.org/r/20250612-sm8550-camss-v2-1-ed370124075e@quicinc.com Signed-off-by: Bjorn Andersson commit 1b7fc8a281cae9e3176584558a4ac551ce0f777d Author: Jie Gan Date: Wed Jun 11 11:00:03 2025 +0800 arm64: dts: qcom: qcs615: disable the CTI device of the camera block Disable the CTI device of the camera block to prevent potential NoC errors during AMBA bus device matching. The clocks for the Qualcomm Debug Subsystem (QDSS) are managed by aoss_qmp through a mailbox. However, the camera block resides outside the AP domain, meaning its QDSS clock cannot be controlled via aoss_qmp. Fixes: bf469630552a ("arm64: dts: qcom: qcs615: Add coresight nodes") Signed-off-by: Jie Gan Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250611030003.3801-1-jie.gan@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 47d59463bd885f9c8cb6f2ded8be67fa89d98726 Author: Lijuan Gao Date: Mon May 26 13:21:52 2025 +0800 arm64: dts: qcom: qcs615-ride: enable remoteprocs Enable all remoteproc nodes on the qcs615-ride board and point to the appropriate firmware files to allow proper functioning of the remote processors. Reviewed-by: Konrad Dybcio Signed-off-by: Lijuan Gao Link: https://lore.kernel.org/r/20250526-add_qcs615_remoteproc_support-v4-6-06a7d8bed0b5@quicinc.com Signed-off-by: Bjorn Andersson commit 18b011d4569da5f39d5003ab23bda0e7e23af6bf Author: Lijuan Gao Date: Mon May 26 13:21:51 2025 +0800 arm64: dts: qcom: qcs615: add ADSP and CDSP nodes Add nodes for remoteprocs: ADSP and CDSP for QCS615 SoC to enable proper remoteproc functionality. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Lijuan Gao Link: https://lore.kernel.org/r/20250526-add_qcs615_remoteproc_support-v4-5-06a7d8bed0b5@quicinc.com Signed-off-by: Bjorn Andersson commit a129ca1a9413d5ad605a7bbcdc50e01a3e772580 Author: Lijuan Gao Date: Mon May 26 13:21:50 2025 +0800 arm64: dts: qcom: qcs615: Add IMEM and PIL info region Add a simple-mfd representing IMEM on QCS615 and define the PIL relocation info region as its child. The PIL region in IMEM is used to communicate load addresses of remoteproc to post mortem debug tools, so that these tools can collect ramdumps. Reviewed-by: Konrad Dybcio Signed-off-by: Lijuan Gao Link: https://lore.kernel.org/r/20250526-add_qcs615_remoteproc_support-v4-4-06a7d8bed0b5@quicinc.com Signed-off-by: Bjorn Andersson commit bf2a6a7765412dbf487eb478b00783868c32a348 Author: Kyle Deng Date: Mon May 26 13:21:49 2025 +0800 arm64: dts: qcom: qcs615: Add mproc node for SEMP2P The Shared Memory Point to Point (SMP2P) protocol facilitates communication of a single 32-bit value between two processors. Add these two nodes for remoteproc enablement on QCS615 SoC. Signed-off-by: Kyle Deng Reviewed-by: Konrad Dybcio Signed-off-by: Lijuan Gao Link: https://lore.kernel.org/r/20250526-add_qcs615_remoteproc_support-v4-3-06a7d8bed0b5@quicinc.com Signed-off-by: Bjorn Andersson commit 6516961352a1ef39184a34690ff3cc06953f6fea Author: Aleksandrs Vinarskis Date: Fri May 23 15:15:08 2025 +0200 arm64: dts: qcom: Add support for X1-based Asus Zenbook A14 Initial support for Asus Zenbook A14. Particular moddel exists in X1-26-100, X1P-42-100 (UX3407QA) and X1E-78-100 (UX3407RA). Mostly similar to other X1-based laptops. Notable differences are: * Wifi/Bluetooth combo being Qualcomm FastConnect 6900 on UX3407QA and Qualcomm FastConnect 7800 on UX3407RA * USB Type-C retimers are Parade PS8833, appear to behave identical to Parade PS8830 * gpio90 is TZ protected Working: * Keyboard * Touchpad * NVME * Lid switch * Camera LED * eDP (FHD OLED, SDC420D) with brightness control * Bluetooth, WiFi (WCN6855) * USB Type-A port * USB Type-C ports in USB2/USB3/DP (both orientations) * aDSP/cDPS firmware loading, battery info * Sleep/suspend, nothing visibly broken on resume Out of scope of this series: * Audio (Speakers/microphones/headphone jack) * Camera (OmniVision OV02C10) * HDMI (Parade PS185HDM) * EC Add dtsi and create two configurations for UX3407QA, UX3407RA. Tested on UX3407QA with X1-26-100. Reviewed-by: Konrad Dybcio Signed-off-by: Aleksandrs Vinarskis Link: https://lore.kernel.org/r/20250523131605.6624-2-alex.vinarskis@gmail.com Signed-off-by: Bjorn Andersson commit 965e28cad4739b11f1bc58c0a9935e025938bb1f Author: Konrad Dybcio Date: Fri May 23 01:18:18 2025 +0200 arm64: dts: qcom: sc7180: Expand IMEM region We need more than what is currently described, expand the region to its actual boundaries. Fixes: ede638c42c82 ("arm64: dts: qcom: sc7180: Add IMEM and pil info regions") Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250523-topic-ipa_mem_dts-v1-3-f7aa94fac1ab@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 81a4a7de3d4031e77b5796479ef21aefb0862807 Author: Konrad Dybcio Date: Fri May 23 01:18:17 2025 +0200 arm64: dts: qcom: sdm845: Expand IMEM region We need more than what is currently described, expand the region to its actual boundaries. Signed-off-by: Konrad Dybcio Fixes: 948f6161c6ab ("arm64: dts: qcom: sdm845: Add IMEM and PIL info region") Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250523-topic-ipa_mem_dts-v1-2-f7aa94fac1ab@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9cea10a4f5a39fde32bf7b8addfa5f9175174e0e Author: Konrad Dybcio Date: Fri May 23 01:18:16 2025 +0200 dt-bindings: sram: qcom,imem: Add a number of missing compatibles Currently described or not, IMEM is present on *all* Qualcomm SoCs. Preemptively add a number of compatibles to ease integration. Signed-off-by: Konrad Dybcio Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250523-topic-ipa_mem_dts-v1-1-f7aa94fac1ab@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit bd4f35786d5f0798cc1f8c187a81a7c998e6c58f Author: Jie Gan Date: Thu May 22 08:50:16 2025 +0800 arm64: dts: qcom: qcs615: fix a crash issue caused by infinite loop for Coresight An infinite loop has been created by the Coresight devices. When only a source device is enabled, the coresight_find_activated_sysfs_sink function is recursively invoked in an attempt to locate an active sink device, ultimately leading to a stack overflow and system crash. Therefore, disable the replicator1 to break the infinite loop and prevent a potential stack overflow. replicator1_out -> funnel_swao_in6 -> tmc_etf_swao_in -> tmc_etf_swao_out | | replicator1_in replicator_swao_in | | replicator0_out1 replicator_swao_out0 | | replicator0_in funnel_in1_in3 | | tmc_etf_out <- tmc_etf_in <- funnel_merg_out <- funnel_merg_in1 <- funnel_in1_out [call trace] dump_backtrace+0x9c/0x128 show_stack+0x20/0x38 dump_stack_lvl+0x48/0x60 dump_stack+0x18/0x28 panic+0x340/0x3b0 nmi_panic+0x94/0xa0 panic_bad_stack+0x114/0x138 handle_bad_stack+0x34/0xb8 __bad_stack+0x78/0x80 coresight_find_activated_sysfs_sink+0x28/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] ... coresight_find_activated_sysfs_sink+0x5c/0xa0 [coresight] coresight_enable_sysfs+0x80/0x2a0 [coresight] side effect after the change: Only trace data originating from AOSS can reach the ETF_SWAO and EUD sinks. Fixes: bf469630552a ("arm64: dts: qcom: qcs615: Add coresight nodes") Signed-off-by: Jie Gan Acked-by: Suzuki K Poulose Link: https://lore.kernel.org/r/20250522005016.2148-1-jie.gan@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a014ad1ae4ea1ec8c3ea3a66f09217f1bff937a8 Author: Luca Weiss Date: Fri Mar 21 09:12:57 2025 +0100 arm64: dts: qcom: sm6350: add APR and some audio-related services Add the APR node and its associated services required for audio on the SM6350 SoC. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250321-sm6350-apr-v1-1-7805ce7b4dcf@fairphone.com Signed-off-by: Bjorn Andersson commit 2b3aef30dd9dfd6cd2de3026126413a30028b850 Author: Loic Poulain Date: Wed Apr 23 09:20:44 2025 +0200 arm64: dts: qcom: qcm2290: Add CAMSS node Add node for the QCM2290 camera subsystem. Signed-off-by: Loic Poulain Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250423072044.234024-7-loic.poulain@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d33ad6600453fbcf6a9275864ad120079bd540da Author: Vikash Garodia Date: Mon Apr 21 20:16:57 2025 +0530 arm64: dts: qcom: sa8775p-ride: enable video Enable video nodes on the sa8775p-ride board and point to the appropriate firmware files. Reviewed-by: Dmitry Baryshkov Signed-off-by: Vikash Garodia Link: https://lore.kernel.org/r/20250421-dtbinding-v5-3-363c1c05bc80@quicinc.com Signed-off-by: Bjorn Andersson commit 7bc95052c64f45c24affbb7636489dc9a1c2a982 Author: Vikash Garodia Date: Mon Apr 21 20:16:56 2025 +0530 arm64: dts: qcom: sa8775p: add support for video node Video node enables video on Qualcomm SA8775P platform. Reviewed-by: Bryan O'Donoghue Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Vikash Garodia Link: https://lore.kernel.org/r/20250421-dtbinding-v5-2-363c1c05bc80@quicinc.com Signed-off-by: Bjorn Andersson commit 985237d49c4cf0254810b4b8078d240ba9bfc2ec Author: Jagadeesh Kona Date: Tue Apr 15 09:53:43 2025 +0000 arm64: dts: qcom: sa8775p: Add CPU OPP tables to scale DDR/L3 Add OPP tables required to scale DDR and L3 per freq-domain on SA8775P platform. If a single OPP table is used for both CPU domains, then _allocate_opp_table() won't be invoked for CPU4 but instead CPU4 will be added as device under the CPU0 OPP table. Due to this, dev_pm_opp_of_find_icc_paths() won't be invoked for CPU4 device and hence CPU4 won't be able to independently scale it's interconnects. Both CPU0 and CPU4 devices will scale the same ICC path which can lead to one device overwriting the BW vote placed by other device. Hence CPU0 and CPU4 require separate OPP tables to allow independent scaling of DDR and L3 frequencies for each CPU domain, with the final DDR and L3 frequencies being an aggregate of both. Co-developed-by: Shivnandan Kumar Signed-off-by: Shivnandan Kumar Signed-off-by: Raviteja Laggyshetty Signed-off-by: Jagadeesh Kona Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250415095343.32125-8-quic_rlaggysh@quicinc.com Signed-off-by: Bjorn Andersson commit 6531b4b095dacc3067c91a802e1518f3faad72b4 Author: Raviteja Laggyshetty Date: Tue Apr 15 09:53:42 2025 +0000 arm64: dts: qcom: sa8775p: add EPSS l3 interconnect provider Add Epoch Subsystem (EPSS) L3 interconnect provider node on SA8775P SoCs. L3 instances on this SoC are same as SM8250 and SC7280 SoCs. These SoCs use EPSS_L3_PERF register instead of REG_L3_VOTE register for programming the perf level. This is taken care in the data associated with the target specific compatible. Since, the HW is same in the all SoCs with EPSS support, using the same generic compatible for all. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Raviteja Laggyshetty Link: https://lore.kernel.org/r/20250415095343.32125-7-quic_rlaggysh@quicinc.com Signed-off-by: Bjorn Andersson commit 7872997c048e989c7689c2995d230fdca7798000 Author: Ian Forbes Date: Tue Apr 29 15:34:27 2025 -0500 drm/vmwgfx: Fix Host-Backed userspace on Guest-Backed kernel Running 3D applications with SVGA_FORCE_HOST_BACKED=1 or using an ancient version of mesa was broken because the buffer was pinned in VMW_BO_DOMAIN_SYS and could not be moved to VMW_BO_DOMAIN_MOB during validation. The compat_shader buffer should not pinned. Fixes: 668b206601c5 ("drm/vmwgfx: Stop using raw ttm_buffer_object's") Signed-off-by: Ian Forbes Reviewed-by: Maaz Mombasawala Signed-off-by: Zack Rusin Link: https://lore.kernel.org/r/20250429203427.1742331-1-ian.forbes@broadcom.com commit 66bf410e72348691cfbc222afae4414ed1cc657c Author: Nitin Rawat Date: Thu Mar 27 13:54:31 2025 -0700 arm64: dts: qcom: sm8750: Add UFS nodes for SM8750 QRD board Add UFS host controller and PHY nodes for SM8750 QRD board. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Reviewed-by: Manivannan Sadhasivam Co-developed-by: Manish Pandey Signed-off-by: Manish Pandey Signed-off-by: Nitin Rawat Signed-off-by: Melody Olvera Link: https://lore.kernel.org/r/20250327-sm8750_ufs_master-v3-4-bad1f5398d0a@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit a95d8e3f40756d87c35b1c5b4318297005ddc7ce Author: Nitin Rawat Date: Thu Mar 27 13:54:30 2025 -0700 arm64: dts: qcom: sm8750: Add UFS nodes for SM8750 MTP Add UFS host controller and PHY nodes for SM8750 MTP board. Reviewed-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Reviewed-by: Manivannan Sadhasivam Co-developed-by: Manish Pandey Signed-off-by: Manish Pandey Signed-off-by: Nitin Rawat Signed-off-by: Melody Olvera Link: https://lore.kernel.org/r/20250327-sm8750_ufs_master-v3-3-bad1f5398d0a@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d288abc3a70efd23a3882de9d2a5effb890f8e40 Author: Nitin Rawat Date: Thu Mar 27 13:54:29 2025 -0700 arm64: dts: qcom: sm8750: Add UFS nodes for SM8750 SoC Add UFS host controller and PHY nodes for SM8750 SoC. Co-developed-by: Manish Pandey Signed-off-by: Manish Pandey Signed-off-by: Nitin Rawat Signed-off-by: Melody Olvera Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250327-sm8750_ufs_master-v3-2-bad1f5398d0a@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit db6a94b263541af5678e520fb3959b03ec88ad2b Author: Ian Forbes Date: Fri May 30 13:35:09 2025 -0500 drm/vmwgfx: Implement dma_fence_ops properly vmwgfx's fencing predates dma_fence and as a result dma_fence_ops was never properly implemented, especially with respect to enabling signaling. Because of this dma_fence callbacks don't work properly. This change implements enable_signaling properly so that dma_fence callbacks now work as expected. It also removes vmwgfx's custom implementation of fence callbacks and removes vmwgfx's custom dma_fence_ops::wait function which is no longer necessary now that enable_signaling works. Signed-off-by: Ian Forbes Signed-off-by: Zack Rusin Link: https://lore.kernel.org/r/20250530183510.733175-2-ian.forbes@broadcom.com commit c82f55f4aa57bf5ba412d55856fe50514b47b971 Author: Ian Forbes Date: Fri May 30 13:35:08 2025 -0500 drm/vmwgfx: Update last_read_seqno under the fence lock There was a possible race in vmw_update_seqno. Because of this race it was possible for last_read_seqno to go backwards. Remove this function and replace it with vmw_update_fences which now sets and returns the last_read_seqno while holding the fence lock. This serialization via the fence lock ensures that last_read_seqno is monotonic again. Signed-off-by: Ian Forbes Signed-off-by: Zack Rusin Link: https://lore.kernel.org/r/20250530183510.733175-1-ian.forbes@broadcom.com commit 3a931f4aa3982f77f32050b4869afa76a711e5c7 Author: Stephan Gerhold Date: Tue Apr 8 13:38:42 2025 +0200 arm64: dts: qcom: apq8016-sbc-d3-camera: Convert to DT overlay Follow the example of the recently added apq8016-sbc-usb-host.dtso and convert apq8016-sbc-d3-camera-mezzanine.dts to a DT overlay that can be applied on top of the apq8016-sbc.dtb. This makes it more clear that this is not a special type of DB410c but just an addon board that can be added on top. Functionally there should not be any difference since apq8016-sbc-d3-camera-mezzanine.dtb is still generated as before (but now by applying the overlay on top of apq8016-sbc.dtb). Since dtc does not know that there are default #address/size-cells in msm8916.dtsi, repeat those in the overlay to avoid dtc warnings because it expects the wrong amount of address/size-cells. It would be nice to have a generic overlay for the D3 camera mezzanine (that can be applied to all 96Boards) but that's much more complicated than providing a board-specific DT overlay as intermediate step. Reviewed-by: Bryan O'Donoghue Signed-off-by: Stephan Gerhold Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250408-apq8016-sbc-camera-dtso-v1-1-cdf1cd41bda6@linaro.org Signed-off-by: Bjorn Andersson commit 642b55ce06c923a52cf52f94a2508c7a20b02536 Author: Aleksandrs Vinarskis Date: Mon Mar 31 21:43:44 2025 +0100 arm64: dts: qcom: x1e80100-dell-xps-9345: Add WiFi/BT pwrseq Add the WiFi/BT nodes for XPS and describe the regulators for the WCN7850 combo chip using the new power sequencing bindings. All voltages are derived from chained fixed regulators controlled using a single GPIO. Based on the commit d09ab685a8f5 ("arm64: dts: qcom: x1e80100-qcp: Add WiFi/BT pwrseq"). Reviewed-by: Bryan O'Donoghue Reviewed-by: Dmitry Baryshkov Signed-off-by: Aleksandrs Vinarskis Tested-by: Laurentiu Tudor Link: https://lore.kernel.org/r/20250331204610.526672-2-alex.vinarskis@gmail.com Signed-off-by: Bjorn Andersson commit 37e00703228ab44d0aacc32a97809a4f6f58df1b Author: Marek Szyprowski Date: Mon Jun 16 14:09:32 2025 +0200 zynq_fpga: use sgtable-based scatterlist wrappers Use common wrappers operating directly on the struct sg_table objects to fix incorrect use of statterlists related calls. dma_unmap_sg() function has to be called with the number of elements originally passed to the dma_map_sg() function, not the one returned in sgtable's nents. CC: stable@vger.kernel.org Fixes: 425902f5c8e3 ("fpga zynq: Use the scatterlist interface") Signed-off-by: Marek Szyprowski Reviewed-by: Jason Gunthorpe Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20250616120932.1090614-1-m.szyprowski@samsung.com Signed-off-by: Xu Yilun commit ec315832f6f98f0fa5719b8b5dd2214ca44ef3f1 Author: Simon Horman Date: Mon Jun 16 13:58:35 2025 +0100 dpll: remove documentation of rclk_dev_name Remove documentation of rclk_dev_name member of dpll_device which doesn't exist. Flagged by ./scripts/kernel-doc -none Introduced by commit 9431063ad323 ("dpll: core: Add DPLL framework base functions") Signed-off-by: Simon Horman Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20250616-dpll-member-v1-1-8c9e6b8e1fd4@kernel.org Signed-off-by: Jakub Kicinski commit 189bd9c873f0e49f3fb20372407ccda64114d68a Merge: 8152c4028cb8b6 80bae9df2108cb Author: Jakub Kicinski Date: Tue Jun 17 18:50:57 2025 -0700 Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== libeth: add libeth_xdp helper lib Alexander Lobakin says: Time to add XDP helpers infra to libeth to greatly simplify adding XDP to idpf and iavf, as well as improve and extend XDP in ice and i40e. Any vendor is free to reuse helpers. If this happens, I'm fine with moving the folder of out intel/. The helpers greatly simplify building xdp_buff, running a prog, handling the verdict, implement XDP_TX, .ndo_xdp_xmit, XDP buffer completion. Same applies to XSk (with XSk xmit instead of .ndo_xdp_xmit, plus stuff like XSk wakeup). They are entirely generic with no HW definitions or assumptions. HW-specific stuff like parsing Rx desc / filling Tx desc is passed from the driver as inline callbacks. For now, key assumptions that optimize performance / avoid code bloat, but might not fit every driver in driver/net/: * netmem holding the buffers are always order-0; * driver has separate XDP Tx queues, doesn't use stack queues for that. For best efficiency, you may want to have nr_cpu_ids XDP queues, but less (queue sharing) is also supported; * XDP Tx queues are interrupt-less and use "lazy" cleaning only when there are less than 1/4 free Tx descriptors of the queue size; * main target platforms are 64-bit, although 32-bit is also fully supported, but the code might be not as optimized for them. Library code already supports multi-buffer for all kinds of Tx and both header split and no split for Rx and Tx. Frags can come from devmem/io_uring etc., direct `struct page *` is used only for header buffers for which it's always true. Drivers are free to pass their own Rx hints and XSK xmit hints ops. XDP_TX and ndo_xdp_xmit use onstack bulk for the frames to be sent and send them by batches of 16 buffers. This eats ~280 bytes on the stack, but gives good boosts and allow to greatly optimize the main sending function leaving it without any error/exception paths. XSk xmit fills Tx descriptors in the loop unrolled by 8. This was proven to improve perf on ice and i40e. XDP_TX and ndo_xdp_xmit doesn't use unrolling as I wasn't able to get any improvements in those scenenarios from this, while +1 Kb for their sending functions for nothing doesn't sound reasonable. XSk wakeup, instead of traditionally used "SW interrupts" provided by NICs, uses IPI to schedule NAPI on the CPU corresponding to the given queue pair. It gives better control over CPU distribution and in general performs way better than "SW interrupts", plus allows us to not pass any HW-specific callbacks there. The code is built the way that all callbacks passed from drivers get inlined; in general, most of hotpath gets inlined. Everything slow/exception lands to .c files in the libeth folder, doesn't create copies in the drivers themselves and doesn't overloat hotpath. Sure, inlining means that hotpath will be compiled into every driver that uses the lib, but the core code is written in one place, so no copying of bugs happens. Fixed once -- works everywhere. The last commit might look like sorta hack, but it gives really good boosts and decreases object code size, plus there are checks that all those wider accesses are fully safe, so I don't feel anything bad about it. An example of using libeth_xdp can be found either on my GitHub or on the mailing lists here ("XDP for idpf"). Macros for building driver XDP functions lead to that some implementations (XDP_TX, ndo_xdp_xmit etc.) consist of really only a few lines. * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: libeth: xdp, xsk: access adjacent u32s as u64 where applicable libeth: xsk: add XSkFQ refill and XSk wakeup helpers libeth: xsk: add XSk Rx processing support libeth: xsk: add XSk xmit functions libeth: xsk: add XSk XDP_TX sending helpers libeth: xdp: add RSS hash hint and XDP features setup helpers libeth: xdp: add templates for building driver-side callbacks libeth: xdp: add XDP prog run and verdict result handling libeth: xdp: add helpers for preparing/processing &libeth_xdp_buff libeth: xdp: add XDPSQ cleanup timers libeth: xdp: add XDPSQ locking helpers libeth: xdp: add XDPSQE completion helpers libeth: xdp: add .ndo_xdp_xmit() helpers libeth: xdp: add XDP_TX buffers sending libeth: support native XDP and register memory model libeth: convert to netmem libeth, libie: clean symbol exports up a little ==================== Link: https://patch.msgid.link/20250616201639.710420-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 8152c4028cb8b69933ebb93e7b0cc58bc47dfb2e Merge: fd0406e5ca53b8 5a842c288cfa3b Author: Jakub Kicinski Date: Tue Jun 17 18:34:15 2025 -0700 Merge branch 'net-mlx5e-add-support-for-devmem-and-io_uring-tcp-zero-copy' Mark Bloch says: ==================== net/mlx5e: Add support for devmem and io_uring TCP zero-copy This series adds support for zerocopy rx TCP with devmem and io_uring for ConnectX7 NICs and above. For performance reasons and simplicity HW-GRO will also be turned on when header-data split mode is on. Performance =========== Test setup: * CPU: Intel(R) Xeon(R) Platinum 8380 CPU @ 2.30GHz (single NUMA) * NIC: ConnectX7 * Benchmarking tool: kperf [0] * Single TCP flow * Test duration: 60s With application thread and interrupts pinned to the *same* core: |------+-----------+----------| | MTU | epoll | io_uring | |------+-----------+----------| | 1500 | 61.6 Gbps | 114 Gbps | | 4096 | 69.3 Gbps | 151 Gbps | | 9000 | 67.8 Gbps | 187 Gbps | |------+-----------+----------| The CPU usage for io_uring is 95%. Reproduction steps for io_uring: server --no-daemon -a 2001:db8::1 --no-memcmp --iou --iou_sendzc \ --iou_zcrx --iou_dev_name eth2 --iou_zcrx_queue_id 2 server --no-daemon -a 2001:db8::2 --no-memcmp --iou --iou_sendzc client --src 2001:db8::2 --dst 2001:db8::1 \ --msg-zerocopy -t 60 --cpu-min=2 --cpu-max=2 Patch overview: ================ First, a netmem API for skb_can_coalesce is added to the core to be able to do skb fragment coalescing on netmems. The next patches introduce some cleanups in the internal SHAMPO code and improvements to hw gro capability checks in FW. A separate page_pool is introduced for headers, to be used only when the rxq has a memory provider. Then the driver is converted to use the netmem API and to allow support for unreadable netmem page pool. The queue management ops are implemented. Finally, the tcp-data-split ring parameter is exposed. References ========== [0] kperf: git://git.kernel.dk/kperf.git v1: https://lore.kernel.org/20250116215530.158886-1-saeed@kernel.org v2: https://lore.kernel.org/1747950086-1246773-1-git-send-email-tariqt@nvidia.com v3: https://lore.kernel.org/20250609145833.990793-1-mbloch@nvidia.com v4: https://lore.kernel.org/20250610150950.1094376-1-mbloch@nvidia.com v5: https://lore.kernel.org/20250612154648.1161201-1-mbloch@nvidia.com ==================== Link: https://patch.msgid.link/20250616141441.1243044-1-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 5a842c288cfa3b0fc38412fefbc4c3285908c3c7 Author: Dragos Tatulea Date: Mon Jun 16 17:14:41 2025 +0300 net/mlx5e: Add TX support for netmems Declare netmem TX support in netdev. As required, use the netmem aware dma unmapping APIs for unmapping netmems in tx completion path. Signed-off-by: Dragos Tatulea Reviewed-by: Tariq Toukan Reviewed-by: Mina Almasry Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-13-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 46bcce5dfd330c233e59cd5efd7eb43f049b0a82 Author: Saeed Mahameed Date: Mon Jun 16 17:14:40 2025 +0300 net/mlx5e: Support ethtool tcp-data-split settings In mlx5, tcp header-data split requires HW GRO to be on. Enabling it fails when HW GRO is off. mlx5e_fix_features now keeps HW GRO on when tcp data split is enabled. Finally, when tcp data split is disabled, features are updated to maybe remove the forced HW GRO. Signed-off-by: Saeed Mahameed Signed-off-by: Cosmin Ratiu Reviewed-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-12-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit b2588ea40ec9472688289c1a644627c0f4a1f33f Author: Saeed Mahameed Date: Mon Jun 16 17:14:39 2025 +0300 net/mlx5e: Implement queue mgmt ops and single channel swap The bulk of the work is done in mlx5e_queue_mem_alloc, where we allocate and create the new channel resources, similar to mlx5e_safe_switch_params, but here we do it for a single channel using existing params, sort of a clone channel. To swap the old channel with the new one, we deactivate and close the old channel then replace it with the new one, since the swap procedure doesn't fail in mlx5, we do it all in one place (mlx5e_queue_start). Signed-off-by: Saeed Mahameed Reviewed-by: Dragos Tatulea Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Acked-by: Mina Almasry Link: https://patch.msgid.link/20250616141441.1243044-11-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit db3010bb5a0134644c45dc0df89e76e02553478c Author: Saeed Mahameed Date: Mon Jun 16 17:14:38 2025 +0300 net/mlx5e: Add support for UNREADABLE netmem page pools On netdev_rx_queue_restart, a special type of page pool maybe expected. In this patch declare support for UNREADABLE netmem iov pages in the pool params only when header data split shampo RQ mode is enabled, also set the queue index in the page pool params struct. Shampo mode requirement: Without header split rx needs to peek at the data, we can't do UNREADABLE_NETMEM. The patch also enables the use of a separate page pool for headers when a memory provider is installed for the queue, otherwise the same common page pool continues to be used. Signed-off-by: Saeed Mahameed Reviewed-by: Dragos Tatulea Reviewed-by: Tariq Toukan Reviewed-by: Mina Almasry Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-10-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit d1668f119943aec7c10244e5481964fad24b7ba2 Author: Saeed Mahameed Date: Mon Jun 16 17:14:37 2025 +0300 net/mlx5e: Convert over to netmem mlx5e_page_frag holds the physical page itself, to naturally support zc page pools, remove physical page reference from mlx5 and replace it with netmem_ref, to avoid internal handling in mlx5 for net_iov backed pages. SHAMPO can issue packets that are not split into header and data. These packets will be dropped if the data part resides in a net_iov as the driver can't read into this area. No performance degradation observed. Signed-off-by: Saeed Mahameed Signed-off-by: Dragos Tatulea Reviewed-by: Dragos Tatulea Reviewed-by: Tariq Toukan Reviewed-by: Mina Almasry Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-9-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit e225d9bd93ed0bb84014f5f8e241e8e456533e30 Author: Saeed Mahameed Date: Mon Jun 16 17:14:36 2025 +0300 net/mlx5e: SHAMPO: Separate pool for headers Allow allocating a separate page pool for headers when SHAMPO is on. This will be useful for adding support to zc page pool, which has to be different from the headers page pool. For now, the pools are the same. Signed-off-by: Saeed Mahameed Reviewed-by: Dragos Tatulea Signed-off-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-8-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit d2760abdedde635b055a214b3a45dce3e4ecbfce Author: Saeed Mahameed Date: Mon Jun 16 17:14:35 2025 +0300 net/mlx5e: SHAMPO: Improve hw gro capability checking Add missing HW capabilities, declare the feature in netdev->vlan_features, similar to other features in mlx5e_build_nic_netdev. No functional change here as all by default disabled features are explicitly disabled at the bottom of the function. Signed-off-by: Saeed Mahameed Reviewed-by: Dragos Tatulea Signed-off-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-7-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 16142defd304d5a8e591781efe24da498ccfa51f Author: Saeed Mahameed Date: Mon Jun 16 17:14:34 2025 +0300 net/mlx5e: SHAMPO: Remove redundant params Two SHAMPO params are static and always the same, remove them from the global mlx5e_params struct. Signed-off-by: Saeed Mahameed Reviewed-by: Dragos Tatulea Signed-off-by: Cosmin Ratiu Signed-off-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-6-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit af4312c4c9c11da84b13b3aa8f472ab287cf1f0b Author: Saeed Mahameed Date: Mon Jun 16 17:14:33 2025 +0300 net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc Drop redundant SHAMPO structure alloc/free functions. Gather together function calls pertaining to header split info, pass header per WQE (hd_per_wqe) as parameter to those function to avoid use before initialization future mistakes. Allocate HW GRO related info outside of the header related info scope. Signed-off-by: Saeed Mahameed Reviewed-by: Dragos Tatulea Signed-off-by: Cosmin Ratiu Reviewed-by: Tariq Toukan Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-5-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit a202f24b08587021a39eade5aa5444d5714689fb Author: Dragos Tatulea Date: Mon Jun 16 17:14:32 2025 +0300 page_pool: Add page_pool_dev_alloc_netmems helper This is the netmem counterpart of page_pool_dev_alloc_pages() which uses the default GFP flags for RX. Signed-off-by: Dragos Tatulea Reviewed-by: Mina Almasry Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-4-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit 1cbb49f85b4095af798f1a421db2e08894d0606c Author: Dragos Tatulea Date: Mon Jun 16 17:14:31 2025 +0300 net: Add skb_can_coalesce for netmem Allow drivers that have moved over to netmem to do fragment coalescing. Signed-off-by: Dragos Tatulea Signed-off-by: Cosmin Ratiu Reviewed-by: Tariq Toukan Reviewed-by: Mina Almasry Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-3-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit c9e1225352d48b184991a4edc77b897cac66991e Author: Dragos Tatulea Date: Mon Jun 16 17:14:30 2025 +0300 net: Allow const args for of page_to_netmem() This allows calling page_to_netmem() with a const page * argument. Signed-off-by: Dragos Tatulea Reviewed-by: Mina Almasry Reviewed-by: Cosmin Ratiu Signed-off-by: Mark Bloch Link: https://patch.msgid.link/20250616141441.1243044-2-mbloch@nvidia.com Signed-off-by: Jakub Kicinski commit fd0406e5ca53b804353d4b1b60a980c13cbfbea3 Author: Tejun Heo Date: Mon Jun 16 08:10:47 2025 -1000 net: tcp: tsq: Convert from tasklet to BH workqueue The only generic interface to execute asynchronously in the BH context is tasklet; however, it's marked deprecated and has some design flaws. To replace tasklets, BH workqueue support was recently added. A BH workqueue behaves similarly to regular workqueues except that the queued work items are executed in the BH context. This patch converts TCP Small Queues implementation from tasklet to BH workqueue. Semantically, this is an equivalent conversion and there shouldn't be any user-visible behavior changes. While workqueue's queueing and execution paths are a bit heavier than tasklet's, unless the work item is being queued every packet, the difference hopefully shouldn't matter. My experience with the networking stack is very limited and this patch definitely needs attention from someone who actually understands networking. Signed-off-by: Tejun Heo Reviewed-by: Jason Xing Reviewed-by: Eric Dumazet Cc: David Ahern Link: https://patch.msgid.link/aFBeJ38AS1ZF3Dq5@slm.duckdns.org Signed-off-by: Jakub Kicinski commit e15962ae74d9d093ecf3cf7f60dc145801d9273e Merge: ccde40812ad052 e3180379e2df53 Author: Jakub Kicinski Date: Tue Jun 17 18:18:48 2025 -0700 Merge branch 'ipmr-ip6mr-allow-mc-routing-locally-generated-mc-packets' Petr Machata says: ==================== ipmr, ip6mr: Allow MC-routing locally-generated MC packets Multicast routing is today handled in the input path. Locally generated MC packets don't hit the IPMR code. Thus if a VXLAN remote address is multicast, the driver needs to set an OIF during route lookup. In practice that means that MC routing configuration needs to be kept in sync with the VXLAN FDB and MDB. Ideally, the VXLAN packets would be routed by the MC routing code instead. To that end, this patchset adds support to route locally generated multicast packets. However, an installation that uses a VXLAN underlay netdevice for which it also has matching MC routes, would get a different routing with this patch. Previously, the MC packets would be delivered directly to the underlay port, whereas now they would be MC-routed. In order to avoid this change in behavior, introduce an IPCB/IP6CB flag. Unless the flag is set, the new MC-routing code is skipped. All this is keyed to a new VXLAN attribute, IFLA_VXLAN_MC_ROUTE. Only when it is set does any of the above engage. In addition to that, and as is the case today with MC forwarding, IPV4_DEVCONF_MC_FORWARDING must be enabled for the netdevice that acts as a source of MC traffic (i.e. the VXLAN PHYS_DEV), so an MC daemon must be attached to the netdevice. When a VXLAN netdevice with a MC remote is brought up, the physical netdevice joins the indicated MC group. This is important for local delivery of MC packets, so it is still necessary to configure a physical netdevice -- the parameter cannot go away. The netdevice would however typically not be a front panel port, but a dummy. An MC daemon would then sit on top of that netdevice as well as any front panel ports that it needs to service, and have routes set up between the two. A way to configure the VXLAN netdevice to take advantage of the new MC routing would be: # ip link add name d up type dummy # ip link add name vx10 up type vxlan id 1000 dstport 4789 \ local 192.0.2.1 group 225.0.0.1 ttl 16 dev d mrcoute # ip link set dev vx10 master br # plus vlans etc. With the following MC routes: (192.0.2.1, 225.0.0.1) iif=d oil=swp1,swp2 # TX route (*, 225.0.0.1) iif=swp1 oil=d,swp2 # RX route (*, 225.0.0.1) iif=swp2 oil=d,swp1 # RX route The RX path has not changed, with the exception of an extra MC hop. Packets are delivered to the front panel port and MC-forwarded to the VXLAN physical port, here "d". Since the port has joined the multicast group, the packets are locally delivered, and end up being processed by the VXLAN netdevice. This patchset is based on earlier patches from Nikolay Aleksandrov and Roopa Prabhu, though it underwent significant changes. Roopa broadly presented the topic on LPC 2019 [0]. Patchset progression: - Patches #1 to #4 add ip_mr_output() - Patches #5 to #10 add ip6_mr_output() - Patch #11 adds the VXLAN bits to enable MR engagement - Patches #12 to #14 prepare selftest libraries - Patch #15 includes a new test suite [0] https://www.youtube.com/watch?v=xlReECfi-uo ==================== Link: https://patch.msgid.link/cover.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit e3180379e2df535ac492c24ecc9719bf83b7a0f9 Author: Petr Machata Date: Tue Jun 17 00:44:23 2025 +0200 selftests: forwarding: Add a test for verifying VXLAN MC underlay Add tests for MC-routing underlay VXLAN traffic. Signed-off-by: Petr Machata Link: https://patch.msgid.link/eecd2c0fefc754182e74be8e8e65751bf5749c21.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 237f84a6d24a413b3a0795079afeb903ab1dec8a Author: Petr Machata Date: Tue Jun 17 00:44:22 2025 +0200 selftests: forwarding: adf_mcd_start(): Allow configuring custom interfaces Tests may wish to add other interfaces to listen on. Notably locally generated traffic uses dummy interfaces. The multicast daemon needs to know about these so that it allows forming rules that involve these interfaces, and so that net.ipv4.conf.X.mc_forwarding is set for the interfaces. To that end, allow passing in a list of interfaces to configure in addition to all the physical ones. Signed-off-by: Petr Machata Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/2e8d83297985933be4850f2b9f296b3c27110388.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 4baa1d3a5080c18a079d3688fa9726973959ee20 Author: Petr Machata Date: Tue Jun 17 00:44:21 2025 +0200 selftests: net: lib: Add ip_link_has_flag() Add a helper to determine whether a given netdevice has a given flag. Rewrite ip_link_is_up() in terms of the new helper. Signed-off-by: Petr Machata Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/e1eb174a411f9d24735d095984c731d1d4a5a592.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 2a719b7bacc74be9f04147be01262b6289ad8dc5 Author: Petr Machata Date: Tue Jun 17 00:44:20 2025 +0200 selftests: forwarding: lib: Move smcrouted helpers here router_multicast.sh has several helpers for work with smcrouted. Extract them to lib.sh so that other selftests can use them as well. Convert the helpers to defer in the process, because that simplifies the interface quite a bit. Therefore have router_multicast.sh invoke defer_scopes_cleanup() in its cleanup() function. Signed-off-by: Petr Machata Link: https://patch.msgid.link/410411c1a81225ce6e44542289b9c3ec21e5786c.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit f8337efa4ff5a27e6c1d4e384166413eecd21a65 Author: Petr Machata Date: Tue Jun 17 00:44:19 2025 +0200 vxlan: Support MC routing in the underlay Locally-generated MC packets have so far not been subject to MC routing. Instead an MC-enabled installation would maintain the MC routing tables, and separately from that the list of interfaces to send packets to as part of the VXLAN FDB and MDB. In a previous patch, a ip_mr_output() and ip6_mr_output() routines were added for IPv4 and IPv6. All locally generated MC traffic is now passed through these functions. For reasons of backward compatibility, an SKB (IPCB / IP6CB) flag guards the actual MC routing. This patch adds logic to set the flag, and the UAPI to enable the behavior. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/d899655bb7e9b2521ee8c793e67056b9fd02ba12.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 96e8f5a9fe2d91b9f9eb8b45cc13ce1ca6a8af82 Author: Petr Machata Date: Tue Jun 17 00:44:18 2025 +0200 net: ipv6: Add ip6_mr_output() Multicast routing is today handled in the input path. Locally generated MC packets don't hit the IPMR code today. Thus if a VXLAN remote address is multicast, the driver needs to set an OIF during route lookup. Thus MC routing configuration needs to be kept in sync with the VXLAN FDB and MDB. Ideally, the VXLAN packets would be routed by the MC routing code instead. To that end, this patch adds support to route locally generated multicast packets. The newly-added routines do largely what ip6_mr_input() and ip6_mr_forward() do: make an MR cache lookup to find where to send the packets, and use ip6_output() to send each of them. When no cache entry is found, the packet is punted to the daemon for resolution. Similarly to the IPv4 case in a previous patch, the new logic is contingent on a newly-added IP6CB flag being set. Signed-off-by: Petr Machata Link: https://patch.msgid.link/3bcc034a3ab4d3c291072fff38f78d7fbbeef4e6.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 1b02f4475d29c6e2c4b7f1bae74149b9c1369791 Author: Petr Machata Date: Tue Jun 17 00:44:17 2025 +0200 net: ipv6: ip6mr: Split ip6mr_forward2() in two Some of the work of ip6mr_forward2() is specific to IPMR forwarding, and should not take place on the output path. In order to allow reuse of the common parts, extract out of the function a helper, ip6mr_prepare_forward(). Signed-off-by: Petr Machata Link: https://patch.msgid.link/8932bd5c0fbe3f662b158803b8509604fa7bc113.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 094f39d5e84d6c48bb38ded6b30f68b12cb8145b Author: Petr Machata Date: Tue Jun 17 00:44:16 2025 +0200 net: ipv6: ip6mr: Make ip6mr_forward2() void Nobody uses the return value, so convert the function to void. Signed-off-by: Petr Machata Link: https://patch.msgid.link/e0bee259da0da58da96647ea9e21e6360c8f7e11.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 3365afd3abda5f6a54f4a822dad5c9314e94c3fc Author: Petr Machata Date: Tue Jun 17 00:44:15 2025 +0200 net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain The netfilter hook is invoked with skb->dev for input netdevice, and vif_dev for output netdevice. However at the point of invocation, skb->dev is already set to vif_dev, and MR-forwarded packets are reported with in=out: # ip6tables -A FORWARD -j LOG --log-prefix '[forw]' # cd tools/testing/selftests/net/forwarding # ./router_multicast.sh # dmesg | fgrep '[forw]' [ 1670.248245] [forw]IN=v5 OUT=v5 [...] For reference, IPv4 MR code shows in and out as appropriate. Fix by caching skb->dev and using the updated value for output netdev. Fixes: 7bc570c8b4f7 ("[IPV6] MROUTE: Support multicast forwarding.") Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/3141ae8386fbe13fef4b793faa75e6bae58d798a.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit f78c75d84fe83898f0a00658f593d4f17b38cbc6 Author: Petr Machata Date: Tue Jun 17 00:44:14 2025 +0200 net: ipv6: Add a flags argument to ip6tunnel_xmit(), udp_tunnel6_xmit_skb() ip6tunnel_xmit() erases the contents of the SKB control block. In order to be able to set particular IP6CB flags on the SKB, add a corresponding parameter, and propagate it to udp_tunnel6_xmit_skb() as well. In one of the following patches, VXLAN driver will use this facility to mark packets as subject to IPv6 multicast routing. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/acb4f9f3e40c3a931236c3af08a720b017fbfbfb.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 6a7d88ca15f73c5c570c372238f71d63da1fda55 Author: Petr Machata Date: Tue Jun 17 00:44:13 2025 +0200 net: ipv6: Make udp_tunnel6_xmit_skb() void The function always returns zero, thus the return value does not carry any signal. Just make it void. Most callers already ignore the return value. However: - Refold arguments of the call from sctp_v6_xmit() so that they fit into the 80-column limit. - tipc_udp_xmit() initializes err from the return value, but that should already be always zero at that point. So there's no practical change, but elision of the assignment prompts a couple more tweaks to clean up the function. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/7facacf9d8ca3ca9391a4aee88160913671b868d.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 35bec72a24ace52a7f57642ff2813f22733b08fd Author: Petr Machata Date: Tue Jun 17 00:44:12 2025 +0200 net: ipv4: Add ip_mr_output() Multicast routing is today handled in the input path. Locally generated MC packets don't hit the IPMR code today. Thus if a VXLAN remote address is multicast, the driver needs to set an OIF during route lookup. Thus MC routing configuration needs to be kept in sync with the VXLAN FDB and MDB. Ideally, the VXLAN packets would be routed by the MC routing code instead. To that end, this patch adds support to route locally generated multicast packets. The newly-added routines do largely what ip_mr_input() and ip_mr_forward() do: make an MR cache lookup to find where to send the packets, and use ip_mc_output() to send each of them. When no cache entry is found, the packet is punted to the daemon for resolution. However, an installation that uses a VXLAN underlay netdevice for which it also has matching MC routes, would get a different routing with this patch. Previously, the MC packets would be delivered directly to the underlay port, whereas now they would be MC-routed. In order to avoid this change in behavior, introduce an IPCB flag. Only if the flag is set will ip_mr_output() actually engage, otherwise it reverts to ip_mc_output(). This code is based on work by Roopa Prabhu and Nikolay Aleksandrov. Signed-off-by: Roopa Prabhu Signed-off-by: Nikolay Aleksandrov Signed-off-by: Benjamin Poirier Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Link: https://patch.msgid.link/0aadbd49330471c0f758d54afb05eb3b6e3a6b65.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit b2e653bcff0f3eb43183393548f7142c176faa6d Author: Petr Machata Date: Tue Jun 17 00:44:11 2025 +0200 net: ipv4: ipmr: Split ipmr_queue_xmit() in two Some of the work of ipmr_queue_xmit() is specific to IPMR forwarding, and should not take place on the output path. In order to allow reuse of the common parts, split the function into two: the ipmr_prepare_xmit() helper that takes care of the common bits, and the ipmr_queue_fwd_xmit(), which invokes the former and encapsulates the whole forwarding algorithm. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/4e8db165572a4f8bd29a723a801e854e9d20df4d.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit 3b7bc938e0ada6a791103faae261dd2a770df86d Author: Petr Machata Date: Tue Jun 17 00:44:10 2025 +0200 net: ipv4: ipmr: ipmr_queue_xmit(): Drop local variable `dev' The variable is used for caching of rt->dst.dev. The netdevice referenced therein does not change during the scope of validity of that local. At the same time, the local is only used twice, and each of these uses will end up in a different function in the following patches, further eliminating any use the local could have had. Drop the local altogether and inline the uses. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Link: https://patch.msgid.link/c80600a4b51679fe78f429ccb6d60892c2f9e4de.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit e3411e326fa48c9be09ba449330352ba698db698 Author: Petr Machata Date: Tue Jun 17 00:44:09 2025 +0200 net: ipv4: Add a flags argument to iptunnel_xmit(), udp_tunnel_xmit_skb() iptunnel_xmit() erases the contents of the SKB control block. In order to be able to set particular IPCB flags on the SKB, add a corresponding parameter, and propagate it to udp_tunnel_xmit_skb() as well. In one of the following patches, VXLAN driver will use this facility to mark packets as subject to IP multicast routing. Signed-off-by: Petr Machata Reviewed-by: Ido Schimmel Reviewed-by: Nikolay Aleksandrov Acked-by: Antonio Quartulli Link: https://patch.msgid.link/89c9daf9f2dc088b6b92ccebcc929f51742de91f.1750113335.git.petrm@nvidia.com Signed-off-by: Jakub Kicinski commit bd07bd12f2c17d3e13d58c09f5eac5d021ec14ea Author: James Bottomley Date: Tue Jun 17 10:57:36 2025 -0400 bpf: Fix key serial argument of bpf_lookup_user_key() The underlying lookup_user_key() function uses a signed 32 bit integer for key serial numbers because legitimate serial numbers are positive (and > 3) and keyrings are negative. Using a u32 for the keyring in the bpf function doesn't currently cause any conversion problems but will start to trip the signed to unsigned conversion warnings when the kernel enables them, so convert the argument to signed (and update the tests accordingly) before it acquires more users. Signed-off-by: James Bottomley Reviewed-by: Roberto Sassu Link: https://lore.kernel.org/r/84cdb0775254d297d75e21f577089f64abdfbd28.camel@HansenPartnership.com Signed-off-by: Alexei Starovoitov commit 0a1eab129fedb4281e65c845b04be02b53c99f9c Author: Thomas Meyer Date: Tue Sep 24 20:47:22 2024 +0200 kconfig: use memcmp instead of deprecated bcmp bcmp() was removed in POSIX.1-2008. This commit replaces bcmp() with memcmp(). This allows Kconfig to link with C libraries that do not provide bcmp(), such as Android bionic libc. Signed-off-by: Thomas Meyer Reviewed-by: Miguel Ojeda Reported-by: Abhigyan Ghosh [masahiro: update commit description] Signed-off-by: Masahiro Yamada commit ccde40812ad0525143e333fbf8ff1bba53f782f2 Merge: 6786dd7a25972c 9c5f5a5bf0da5c Author: Jakub Kicinski Date: Tue Jun 17 18:06:42 2025 -0700 Merge branch 'misc-vlan-cleanups' Gal Pressman says: ==================== Misc vlan cleanups This patch series addresses compilation issues with objtool when VLAN support is disabled (CONFIG_VLAN_8021Q=n) and makes related improvements to the VLAN infrastructure. When CONFIG_VLAN_8021Q=n, CONFIG_OBJTOOL=y, and CONFIG_OBJTOOL_WERROR=y, the following compilation error occurs: drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.o: error: objtool: parse_mirred.isra.0+0x370: mlx5e_tc_act_vlan_add_push_action() missing __noreturn in .c/.h or NORETURN() in noreturns.h The error occurs because objtool cannot determine that unreachable BUG() calls in VLAN code paths are actually dead code when VLAN support is disabled. First patch makes is_vlan_dev() a stub when VLAN is not configured, allows compile-out of VLAN-dependent dead code paths and resolves the objtool compilation error. Second patch replaces BUG() calls with WARN_ON_ONCE(), as the usage of BUG() should be avoided. Third patch uses the "kernel" way of testing whether an option is configured as builtin/module, instead of open-coding it. v2: https://lore.kernel.org/20250610072611.1647593-1-gal@nvidia.com/ ==================== Link: https://patch.msgid.link/20250616132626.1749331-1-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 9c5f5a5bf0da5cee2044b93907ac6d8d9af0492b Author: Gal Pressman Date: Mon Jun 16 16:26:26 2025 +0300 net: vlan: Use IS_ENABLED() helper for CONFIG_VLAN_8021Q guard The header currently tests the VLAN core with an explicit pair of 'if defined' checks: #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE) Instead, use IS_ENABLED() which is the kernel way to test whether an option is configured as builtin/module. This is purely cosmetic – no functional changes. Reviewed-by: Alex Lazar Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20250616132626.1749331-4-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 60a8b1a5d0824afda869f18dc0ecfe72f8dfda42 Author: Gal Pressman Date: Mon Jun 16 16:26:25 2025 +0300 net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs When CONFIG_VLAN_8021Q=n, a set of stub helpers are used, three of these helpers use BUG() unconditionally. This code should not be reached, as callers of these functions should always check for is_vlan_dev() first, but the usage of BUG() is not recommended, replace it with WARN_ON() instead. Reviewed-by: Alex Lazar Reviewed-by: Dragos Tatulea Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20250616132626.1749331-3-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 2de1ba0887e5d3bf02d7c212f380039b34e10aa3 Author: Gal Pressman Date: Mon Jun 16 16:26:24 2025 +0300 net: vlan: Make is_vlan_dev() a stub when VLAN is not configured Add a stub implementation of is_vlan_dev() that returns false when VLAN support is not compiled in (CONFIG_VLAN_8021Q=n). This allows us to compile-out VLAN-dependent dead code when it is not needed. This also resolves the following compilation error when: * CONFIG_VLAN_8021Q=n * CONFIG_OBJTOOL=y * CONFIG_OBJTOOL_WERROR=y drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.o: error: objtool: parse_mirred.isra.0+0x370: mlx5e_tc_act_vlan_add_push_action() missing __noreturn in .c/.h or NORETURN() in noreturns.h The error occurs because objtool cannot determine that unreachable BUG() (which doesn't return) calls in VLAN code paths are actually dead code when VLAN support is disabled. Signed-off-by: Gal Pressman Link: https://patch.msgid.link/20250616132626.1749331-2-gal@nvidia.com Signed-off-by: Jakub Kicinski commit 6786dd7a25972cd0d234004f340feea7c09cc00a Merge: b11344f63fdd9e dea3be40464a1a Author: Jakub Kicinski Date: Tue Jun 17 18:04:13 2025 -0700 Merge branch 'net-use-new-gpio-line-value-setter-callbacks' Bartosz Golaszewski says: ==================== net: use new GPIO line value setter callbacks Commit 98ce1eb1fd87e ("gpiolib: introduce gpio_chip setters that return values") added new line setter callbacks to struct gpio_chip. They allow to indicate failures to callers. We're in the process of converting all GPIO controllers to using them before removing the old ones. This series converts all GPIO chips implemented under drivers/net/. v1: https://lore.kernel.org/20250610-gpiochip-set-rv-net-v1-0-35668dd1c76f@linaro.org ==================== Link: https://patch.msgid.link/20250616-gpiochip-set-rv-net-v2-0-cae0b182a552@linaro.org Signed-off-by: Jakub Kicinski commit dea3be40464a1af2f7eca83ee2408b7d3fd21c23 Author: Bartosz Golaszewski Date: Mon Jun 16 09:24:08 2025 +0200 net: phy: qca807x: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250616-gpiochip-set-rv-net-v2-5-cae0b182a552@linaro.org Signed-off-by: Jakub Kicinski commit 5d31311715b558ab211e8fa2fcff348cd65d288f Author: Bartosz Golaszewski Date: Mon Jun 16 09:24:07 2025 +0200 net: can: mcp251x: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Vincent Mailhol Reviewed-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250616-gpiochip-set-rv-net-v2-4-cae0b182a552@linaro.org Signed-off-by: Jakub Kicinski commit b9e3c7af9e4d0a72641edc331706ad7c456f6103 Author: Bartosz Golaszewski Date: Mon Jun 16 09:24:06 2025 +0200 net: can: mcp251x: propagate the return value of mcp251x_spi_write() Add an integer return value to mcp251x_write_bits() and use it to propagate the one returned by mcp251x_spi_write(). Return that value on error in the request() GPIO callback. Signed-off-by: Bartosz Golaszewski Reviewed-by: Vincent Mailhol Reviewed-by: Marc Kleine-Budde Link: https://patch.msgid.link/20250616-gpiochip-set-rv-net-v2-3-cae0b182a552@linaro.org Signed-off-by: Jakub Kicinski commit 4a03562794a32f7e7cf548323481273633c20573 Author: Bartosz Golaszewski Date: Mon Jun 16 09:24:05 2025 +0200 net: dsa: mt7530: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20250616-gpiochip-set-rv-net-v2-2-cae0b182a552@linaro.org Signed-off-by: Jakub Kicinski commit c73832445bf22bb9185506dd7f1cbe9edc0216a1 Author: Bartosz Golaszewski Date: Mon Jun 16 09:24:04 2025 +0200 net: dsa: vsc73xx: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Link: https://patch.msgid.link/20250616-gpiochip-set-rv-net-v2-1-cae0b182a552@linaro.org Signed-off-by: Jakub Kicinski commit b11344f63fdd9e8c5121148a6965b41079071dd2 Author: Alok Tiwari Date: Sun Jun 15 22:45:01 2025 -0700 gve: Return error for unknown admin queue command In gve_adminq_issue_cmd(), return -EINVAL instead of 0 when an unknown admin queue command opcode is encountered. This prevents the function from silently succeeding on invalid input and prevents undefined behavior by ensuring the function fails gracefully when an unrecognized opcode is provided. These changes improve error handling. Signed-off-by: Alok Tiwari Link: https://patch.msgid.link/20250616054504.1644770-2-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit b52a93bbaa51a3f03561fd37221af29655db5c2a Author: Alok Tiwari Date: Sun Jun 15 22:45:00 2025 -0700 gve: Fix various typos and improve code comments - Correct spelling and improves the clarity of comments "confiugration" -> "configuration" "spilt" -> "split" "It if is 0" -> "If it is 0" "DQ" -> "DQO" (correct abbreviation) - Clarify BIT(0) flag usage in gve_get_priv_flags() - Replaced hardcoded array size with GVE_NUM_PTYPES for clarity and maintainability. These changes are purely cosmetic and do not affect functionality. Signed-off-by: Alok Tiwari Reviewed-by: Joe Damato Reviewed-by: Mina Almasry Link: https://patch.msgid.link/20250616054504.1644770-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit fb7612b6c44b12d46d56eab92f5c9ceb7057dc40 Author: Mina Almasry Date: Sun Jun 15 20:35:11 2025 +0000 selftests: devmem: add ipv4 support to chunks test Add ipv4 support to the recently added chunks tests, which was added as ipv6 only. Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250615203511.591438-3-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 46cbaef5d8162de8b0b8faf562b69313de6638ef Author: Mina Almasry Date: Sun Jun 15 20:35:10 2025 +0000 selftests: devmem: remove unused variable Trivial fix to unused variable. Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250615203511.591438-2-almasrymina@google.com Signed-off-by: Jakub Kicinski commit 0f66b616b87cb4a57d22f6f0e0e1698a70d8ad21 Author: Mina Almasry Date: Sun Jun 15 20:35:09 2025 +0000 netmem: fix netmem comments Trivial fix to a couple of outdated netmem comments. No code changes, just more accurately describing current code. Signed-off-by: Mina Almasry Acked-by: Stanislav Fomichev Link: https://patch.msgid.link/20250615203511.591438-1-almasrymina@google.com Signed-off-by: Jakub Kicinski commit e74058f5619f17a4ee2ffa2b426d989a9b9c6293 Author: Yuyang Huang Date: Sat Jun 14 14:35:22 2025 +0900 selftest: Add selftest for multicast address notifications This commit adds a new kernel selftest to verify RTNLGRP_IPV4_MCADDR and RTNLGRP_IPV6_MCADDR notifications. The test works by adding and removing a dummy interface and then confirming that the system correctly receives join and removal notifications for the 224.0.0.1 and ff02::1 multicast addresses. The test relies on the iproute2 version to be 6.13+. Tested by the following command: $ vng -v --user root --cpus 16 -- \ make -C tools/testing/selftests TARGETS=net TEST_PROGS=rtnetlink_notification.sh \ TEST_GEN_PROGS="" run_tests Cc: Maciej Żenczykowski Cc: Lorenzo Colitti Signed-off-by: Yuyang Huang Link: https://patch.msgid.link/20250614053522.623820-1-yuyanghuang@google.com Signed-off-by: Jakub Kicinski commit 67f2efc47850e1e8e3a74203459dc218a27d21f9 Merge: 62889b6ad05c54 966a83df36c6f2 Author: Jakub Kicinski Date: Tue Jun 17 17:52:32 2025 -0700 Merge branch 'net-dsa-b53-fix-bcm5325-support' Álvaro Fernández Rojas says: ==================== net: dsa: b53: fix BCM5325 support These patches get the BCM5325 switch working with b53. The existing brcm legacy tag only works with BCM63xx switches. We need to add a new legacy tag for BCM5325 and BCM5365 switches, which require including the FCS and length. I'm not really sure that everything here is correct since I don't work for Broadcom and all this is based on the public datasheet available for the BCM5325 and my own experiments with a Huawei HG556a (BCM6358). Both sets of patches have been merged due to the change requested by Jonas about BRCM_HDR register access depending on legacy tags. ==================== Link: https://patch.msgid.link/20250614080000.1884236-1-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 966a83df36c6f27476ac3501771422e7852098bc Author: Álvaro Fernández Rojas Date: Sat Jun 14 10:00:00 2025 +0200 net: dsa: b53: ensure BCM5325 PHYs are enabled According to the datasheet, BCM5325 uses B53_PD_MODE_CTRL_25 register to disable clocking to individual PHYs. Only ports 1-4 can be enabled or disabled and the datasheet is explicit about not toggling BIT(0) since it disables the PLL power and the switch. Signed-off-by: Álvaro Fernández Rojas Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250614080000.1884236-15-noltari@gmail.com Signed-off-by: Jakub Kicinski commit c00df1018791185ea398f78af415a2a0aaa0c79c Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:59 2025 +0200 net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 CPU port should be B53_CPU_PORT instead of B53_CPU_PORT_25 for B53_PVLAN_PORT_MASK register. Reviewed-by: Florian Fainelli Signed-off-by: Álvaro Fernández Rojas Link: https://patch.msgid.link/20250614080000.1884236-14-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 651c9e71ffe44e99b5a9b011271c2117f0353b32 Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:58 2025 +0200 net: dsa: b53: fix unicast/multicast flooding on BCM5325 BCM5325 doesn't implement UC_FLOOD_MASK, MC_FLOOD_MASK and IPMC_FLOOD_MASK registers. This has to be handled differently with other pages and registers. Signed-off-by: Álvaro Fernández Rojas Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250614080000.1884236-13-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 37883bbc45a8555d6eca88d3a9730504d2dac86c Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:57 2025 +0200 net: dsa: b53: prevent GMII_PORT_OVERRIDE_CTRL access on BCM5325 BCM5325 doesn't implement GMII_PORT_OVERRIDE_CTRL register so we should avoid reading or writing it. PORT_OVERRIDE_RX_FLOW and PORT_OVERRIDE_TX_FLOW aren't defined on BCM5325 and we should use PORT_OVERRIDE_LP_FLOW_25 instead. Reviewed-by: Florian Fainelli Signed-off-by: Álvaro Fernández Rojas Link: https://patch.msgid.link/20250614080000.1884236-12-noltari@gmail.com Signed-off-by: Jakub Kicinski commit e17813968b08b1b09bf80699223dea48851cbd07 Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:56 2025 +0200 net: dsa: b53: prevent BRCM_HDR access on older devices Older switches don't implement BRCM_HDR register so we should avoid reading or writing it. Reviewed-by: Florian Fainelli Signed-off-by: Álvaro Fernández Rojas Link: https://patch.msgid.link/20250614080000.1884236-11-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 800728abd9f83bda4de62a30ce62a8b41c242020 Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:55 2025 +0200 net: dsa: b53: prevent DIS_LEARNING access on BCM5325 BCM5325 doesn't implement DIS_LEARNING register so we should avoid reading or writing it. Reviewed-by: Florian Fainelli Signed-off-by: Álvaro Fernández Rojas Link: https://patch.msgid.link/20250614080000.1884236-10-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 044d5ce2788b165798bfd173548e61bf7b6baf4d Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:54 2025 +0200 net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 BCM5325 doesn't implement B53_UC_FWD_EN, B53_MC_FWD_EN or B53_IPMC_FWD_EN. Reviewed-by: Florian Fainelli Signed-off-by: Álvaro Fernández Rojas Link: https://patch.msgid.link/20250614080000.1884236-9-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 22ccaaca43440e90a3b68d2183045b42247dc4be Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:53 2025 +0200 net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 BCM5325 doesn't implement SWITCH_CTRL register so we should avoid reading or writing it. Reviewed-by: Florian Fainelli Signed-off-by: Álvaro Fernández Rojas Link: https://patch.msgid.link/20250614080000.1884236-8-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 9b6c767c312b4709e9aeb2314a6b47863e7fb72d Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:52 2025 +0200 net: dsa: b53: prevent FAST_AGE access on BCM5325 BCM5325 doesn't implement FAST_AGE registers so we should avoid reading or writing them. Signed-off-by: Álvaro Fernández Rojas Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250614080000.1884236-7-noltari@gmail.com Signed-off-by: Jakub Kicinski commit c45655386e532c85ff1d679fc2aa40b3aaff9916 Author: Florian Fainelli Date: Sat Jun 14 09:59:51 2025 +0200 net: dsa: b53: add support for FDB operations on 5325/5365 BCM5325 and BCM5365 are part of a much older generation of switches which, due to their limited number of ports and VLAN entries (up to 256) allowed a single 64-bit register to hold a full ARL entry. This requires a little bit of massaging when reading, writing and converting ARL entries in both directions. Signed-off-by: Florian Fainelli Signed-off-by: Álvaro Fernández Rojas Link: https://patch.msgid.link/20250614080000.1884236-6-noltari@gmail.com Signed-off-by: Jakub Kicinski commit 0cbec9aef5a86194117a956546dc1aec95031f37 Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:50 2025 +0200 net: dsa: b53: detect BCM5325 variants We need to be able to differentiate the BCM5325 variants because: - BCM5325M switches lack the ARLIO_PAGE->VLAN_ID_IDX register. - BCM5325E have less 512 ARL buckets instead of 1024. Signed-off-by: Álvaro Fernández Rojas Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250614080000.1884236-5-noltari@gmail.com Signed-off-by: Jakub Kicinski commit c3cf059a4d419b9c888ce7e9952fa13ba7569b61 Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:49 2025 +0200 net: dsa: b53: support legacy FCS tags Commit 46c5176c586c ("net: dsa: b53: support legacy tags") introduced support for legacy tags, but it turns out that BCM5325 and BCM5365 switches require the original FCS value and length, so they have to be treated differently. Reviewed-by: Florian Fainelli Signed-off-by: Álvaro Fernández Rojas Link: https://patch.msgid.link/20250614080000.1884236-4-noltari@gmail.com Signed-off-by: Jakub Kicinski commit ef07df397a621707903ef0d294a7df11f80cf206 Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:48 2025 +0200 net: dsa: tag_brcm: add support for legacy FCS tags Add support for legacy Broadcom FCS tags, which are similar to DSA_TAG_PROTO_BRCM_LEGACY. BCM5325 and BCM5365 switches require including the original FCS value and length, as opposed to BCM63xx switches. Adding the original FCS value and length to DSA_TAG_PROTO_BRCM_LEGACY would impact performance of BCM63xx switches, so it's better to create a new tag. Signed-off-by: Álvaro Fernández Rojas Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250614080000.1884236-3-noltari@gmail.com Signed-off-by: Jakub Kicinski commit a4daaf063f8269a5881154c5b77c5ef6639d65d3 Author: Álvaro Fernández Rojas Date: Sat Jun 14 09:59:47 2025 +0200 net: dsa: tag_brcm: legacy: reorganize functions Move brcm_leg_tag_rcv() definition to top. This function is going to be shared between two different tags. Reviewed-by: Florian Fainelli Signed-off-by: Álvaro Fernández Rojas Link: https://patch.msgid.link/20250614080000.1884236-2-noltari@gmail.com Signed-off-by: Jakub Kicinski commit f5527f0171f049e73c0aed21507662abd78821b8 Author: Al Viro Date: Sun Jun 15 01:47:19 2025 +0100 bpf: Get rid of redundant 3rd argument of prepare_seq_file() Remove 3rd argument in prepare_seq_file() to clean up the code a bit. Signed-off-by: Al Viro Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250615004719.GE3011112@ZenIV Signed-off-by: Alexei Starovoitov commit 62889b6ad05c54fc154a2e503023d1d1924e05f8 Merge: 01c559c8b99c07 d54d42a41b65d7 Author: Jakub Kicinski Date: Tue Jun 17 16:25:27 2025 -0700 Merge branch 'nte-stmmac-visconti-cleanups' Russell King says: ==================== net: stmmac: visconti: cleanups A short series of cleanups to the visconti dwmac glue. ==================== Link: https://patch.msgid.link/aFCHJWXSLbUoogi6@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d54d42a41b65d79ac4aacfbe1b3374eec217ceb4 Author: Russell King (Oracle) Date: Mon Jun 16 22:06:32 2025 +0100 net: stmmac: visconti: make phy_intf_sel local There is little need to have phy_intf_sel as a member of struct visconti_eth when we have the PHY interface mode available from phylink in visconti_eth_set_clk_tx_rate(). Without multiple interface support, phylink is fixed to supporting only plat->phy_interface, so we can be sure that "interface" passed into this function is the same as plat->phy_interface. Make phy_intf_sel local to visconti_eth_init_hw() and clean up. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uRH2G-004UyY-GD@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1a3a638d2d23467cd9db06eb2bfdf4c185a8e9db Author: Russell King (Oracle) Date: Mon Jun 16 22:06:27 2025 +0100 net: stmmac: visconti: clean up code formatting Ensure that code is wrapped prior to column 80, and shorten the needlessly long "clk_sel_val" to just "clk_sel". Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uRH2B-004UyS-Ch@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1923c6c3a8b7fb7d8f35f558f1744667fae51207 Author: Russell King (Oracle) Date: Mon Jun 16 22:06:22 2025 +0100 net: stmmac: visconti: reorganise visconti_eth_set_clk_tx_rate() Rather than testing dwmac->phy_intf_sel several times for the same values in this function, group the code together. The only part which was common was stopping the internal clock before programming the clock setting. This further improves the readability of this function. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uRH26-004UyM-9G@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 7d7525876b5a7fe8d3229e8e04e78b166e5e8d75 Author: Russell King (Oracle) Date: Mon Jun 16 22:06:17 2025 +0100 net: stmmac: visconti: re-arrange speed decode Re-arrange the speed decode in visconti_eth_set_clk_tx_rate() to be more readable by first checking to see if we're using RGMII or RMII and then decoding the speed, rather than decoding the speed and then testing the interface mode. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uRH21-004UyG-50@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 01c559c8b99c0784e37e907a16cfb30cf2f357a8 Merge: 416b6030e39e29 8d672a3e51addb Author: Jakub Kicinski Date: Tue Jun 17 16:24:13 2025 -0700 Merge branch 'link-napi-instances-to-queues-and-irqs' Justin Lai says: ==================== Link NAPI instances to queues and IRQs This patch series introduces netdev-genl support to rtase, enabling user-space applications to query the relationships between IRQs, queues, and NAPI instances. ==================== Link: https://patch.msgid.link/20250616032226.7318-1-justinlai0215@realtek.com Signed-off-by: Jakub Kicinski commit 8d672a3e51addb4544a355239fe6ba30c16b3ff0 Author: Justin Lai Date: Mon Jun 16 11:22:26 2025 +0800 rtase: Link queues to NAPI instances Link queues to NAPI instances with netif_queue_set_napi. This information can be queried with the netdev-genl API. Signed-off-by: Justin Lai Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250616032226.7318-3-justinlai0215@realtek.com Signed-off-by: Jakub Kicinski commit 9f611bfd1011797df2ad3461060203a10826e7a4 Author: Justin Lai Date: Mon Jun 16 11:22:25 2025 +0800 rtase: Link IRQs to NAPI instances Link IRQs to NAPI instances with netif_napi_set_irq. This information can be queried with the netdev-genl API. Also add support for persistent NAPI configuration using netif_napi_add_config(). Signed-off-by: Justin Lai Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250616032226.7318-2-justinlai0215@realtek.com Signed-off-by: Jakub Kicinski commit 416b6030e39e29f82e1a39fd9f321e5b69d935c1 Author: Alok Tiwari Date: Sun Jun 15 01:48:12 2025 -0700 selftests: nettest: Fix typo in log and error messages for clarity This patch corrects several logging and error message in nettest.c: - Corrects function name in log messages "setsockopt" -> "getsockopt". - Closes missing parentheses in "setsockopt(IPV6_FREEBIND)". - Replaces misleading error text ("Invalid port") with the correct description ("Invalid prefix length"). - remove Redundant wording like "status from status" and clarifies context in IPC error messages. These changes improve readability and aid in debugging test output. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250615084822.1344759-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 4b7da7341bea62d24fe2f06320f39368dec9603d Merge: 90b4e1cf6de079 db16319efcc717 Author: Jakub Kicinski Date: Tue Jun 17 16:19:04 2025 -0700 Merge branch 'tcp-remove-obsolete-rfc3517-rfc6675-code' Neal Cardwell says: ==================== tcp: remove obsolete RFC3517/RFC6675 code RACK-TLP loss detection has been enabled as the default loss detection algorithm for Linux TCP since 2018, in: commit b38a51fec1c1 ("tcp: disable RFC6675 loss detection") In case users ran into unexpected bugs or performance regressions, that commit allowed Linux system administrators to revert to using RFC3517/RFC6675 loss recovery by setting net.ipv4.tcp_recovery to 0. In the seven years since 2018, our team has not heard reports of anyone reverting Linux TCP to use RFC3517/RFC6675 loss recovery, and we can't find any record in web searches of such a revert. RACK-TLP was published as a standards-track RFC, RFC8985, in February 2021. Several other major TCP implementations have default-enabled RACK-TLP at this point as well. RACK-TLP offers several significant performance advantages over RFC3517/RFC6675 loss recovery, including much better performance in the common cases of tail drops, lost retransmissions, and reordering. It is now time to remove the obsolete and unused RFC3517/RFC6675 loss recovery code. This will allow a substantial simplification of the Linux TCP code base, and removes 12 bytes of state in every tcp_sock for 64-bit machines (8 bytes on 32-bit machines). To arrange the commits in reasonable sizes, this patch series is split into 3 commits: (1) Removes the core RFC3517/RFC6675 logic. (2) Removes the RFC3517/RFC6675 hint state and the first layer of logic that updates that state. (3) Removes the emptied-out tcp_clear_retrans_hints_partial() helper function and all of its call sites. ==================== Link: https://patch.msgid.link/20250615001435.2390793-1-ncardwell.sw@gmail.com Signed-off-by: Jakub Kicinski commit db16319efcc717a31dcb9c8f038acb6e4111c12e Author: Neal Cardwell Date: Sat Jun 14 20:14:35 2025 -0400 tcp: remove RFC3517/RFC6675 tcp_clear_retrans_hints_partial() Now that we have removed the RFC3517/RFC6675 hints, tcp_clear_retrans_hints_partial() is empty, and can be removed. Suggested-by: Yuchung Cheng Signed-off-by: Neal Cardwell Reviewed-by: Yuchung Cheng Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250615001435.2390793-4-ncardwell.sw@gmail.com Signed-off-by: Jakub Kicinski commit ba4618885b23372c45bb1566ed8e3f1c191ff22d Author: Neal Cardwell Date: Sat Jun 14 20:14:34 2025 -0400 tcp: remove RFC3517/RFC6675 hint state: lost_skb_hint, lost_cnt_hint Now that obsolete RFC3517/RFC6675 TCP loss detection has been removed, we can remove the somewhat complex and intrusive code to maintain its hint state: lost_skb_hint and lost_cnt_hint. This commit makes tcp_clear_retrans_hints_partial() empty. We will remove tcp_clear_retrans_hints_partial() and its call sites in the next commit. Suggested-by: Yuchung Cheng Signed-off-by: Neal Cardwell Reviewed-by: Yuchung Cheng Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250615001435.2390793-3-ncardwell.sw@gmail.com Signed-off-by: Jakub Kicinski commit 1c120191dcec510cc17d587ece48a7ae875a90c5 Author: Neal Cardwell Date: Sat Jun 14 20:14:33 2025 -0400 tcp: remove obsolete and unused RFC3517/RFC6675 loss recovery code RACK-TLP loss detection has been enabled as the default loss detection algorithm for Linux TCP since 2018, in: commit b38a51fec1c1 ("tcp: disable RFC6675 loss detection") In case users ran into unexpected bugs or performance regressions, that commit allowed Linux system administrators to revert to using RFC3517/RFC6675 loss recovery by setting net.ipv4.tcp_recovery to 0. In the seven years since 2018, our team has not heard reports of anyone reverting Linux TCP to use RFC3517/RFC6675 loss recovery, and we can't find any record in web searches of such a revert. RACK-TLP was published as a standards-track RFC, RFC8985, in February 2021. Several other major TCP implementations have default-enabled RACK-TLP at this point as well. RACK-TLP offers several significant performance advantages over RFC3517/RFC6675 loss recovery, including much better performance in the common cases of tail drops, lost retransmissions, and reordering. It is now time to remove the obsolete and unused RFC3517/RFC6675 loss recovery code. This will allow a substantial simplification of the Linux TCP code base, and removes 12 bytes of state in every tcp_sock for 64-bit machines (8 bytes on 32-bit machines). To arrange the commits in reasonable sizes, this patch series is split into 3 commits. The following 2 commits remove bookkeeping state and code that is no longer needed after this removal of RFC3517/RFC6675 loss recovery. Suggested-by: Yuchung Cheng Signed-off-by: Neal Cardwell Reviewed-by: Yuchung Cheng Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20250615001435.2390793-2-ncardwell.sw@gmail.com Signed-off-by: Jakub Kicinski commit 90b4e1cf6de0793138b0f23ca5f9c52baad74bc9 Author: Doug Berger Date: Fri Jun 13 19:58:16 2025 -0700 net: bcmgenet: update PHY power down The disable sequence in bcmgenet_phy_power_set() is updated to match the inverse sequence and timing (and spacing) of the enable sequence. This ensures that LEDs driven by the GENET IP are disabled when the GPHY is powered down. Signed-off-by: Doug Berger Signed-off-by: Florian Fainelli Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250614025817.3808354-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit 10f3829a1309e6f6892811643e172633a6adf40a Author: Alok Tiwari Date: Sun Jun 15 08:40:40 2025 -0700 bnxt_en: Improve comment wording and error return code Improved wording and grammar in several comments for clarity. "the must belongs" -> "it must belong" "mininum" -> "minimum" "fileds" -> "fields" Replaced return -1 with -EINVAL in hwrm_ring_alloc_send_msg() to return a proper error code. These changes enhance code readability and consistent error handling. Signed-off-by: Alok Tiwari Reviewed-by: Michael Chan Link: https://patch.msgid.link/20250615154051.1365631-1-alok.a.tiwari@oracle.com Signed-off-by: Jakub Kicinski commit 5216b3b250181c3fcae9c36b6b9110765948717f Author: Dr. David Alan Gilbert Date: Sun Jun 15 00:49:41 2025 +0100 net: liquidio: Remove unused validate_cn23xx_pf_config_info() [Note, I'm wondering if actually this is a case of a missing call; the other similar function is called in __verify_octeon_config_info(), but I don't have or know the hardware.] validate_cn23xx_pf_config_info() was added in 2016 by commit 72c0091293c0 ("liquidio: CN23XX device init and sriov config") Remove it. Signed-off-by: Dr. David Alan Gilbert Reviewed-by: Michal Swiatkowski Link: https://patch.msgid.link/20250614234941.61769-1-linux@treblig.org Signed-off-by: Jakub Kicinski commit bcc287203ca777721fecfe47f3f9fa9aa7d5993d Author: Matthew Brost Date: Sun Jun 15 23:30:24 2025 -0700 drm/xe: Opportunistically skip TLB invalidaion on unbind If a range or VMA is invalidated and scratch page is disabled, there is no reason to issue a TLB invalidation on unbind, skip TLB innvalidation is this condition is true. This is an opportunistic check as it is done without the notifier lock, thus it possible for the range to be invalidated after this check is performed. This should improve performance of the SVM garbage collector, for example, xe_exec_system_allocator --r many-stride-new-prefetch, went ~20s to ~9.5s on a BMG. v2: - Use helper for valid check (Thomas) v3: - Avoid skipping TLB invalidation if PTEs are removed at a higher level than the range - Never skip TLB invalidations for VMA - Drop Himal's RB Signed-off-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20250616063024.2059829-3-matthew.brost@intel.com commit fab76ce56538fdeb9baaf1bfc06f34532e04f9d7 Author: Matthew Brost Date: Sun Jun 15 23:30:23 2025 -0700 drm/xe: Add xe_vm_has_valid_gpu_mapping helper Rather than having multiple READ_ONCE of the tile_* fields and comments in code, use helper with kernel doc for single access point and clear rules. v3: - s/xe_vm_has_valid_gpu_pages/xe_vm_has_valid_gpu_mapping Suggested-by: Thomas Hellström Signed-off-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20250616063024.2059829-2-matthew.brost@intel.com commit 9890dd3fb7f93546b4cd760e8371e63a94b05cd5 Author: Hans Zhang Date: Sat May 17 00:52:23 2025 +0800 PCI/AER: Use bool for AER disable state tracking Change pcie_aer_disable variable to bool and update pci_no_aer() to set it to true. Improves code readability and aligns with modern kernel practices. Signed-off-by: Hans Zhang Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250516165223.125083-3-18255117159@163.com commit 64fd90ef25206b1b9f232fb192ceadb814e991a4 Author: Hans Zhang <18255117159@163.com> Date: Fri May 23 00:15:33 2025 +0800 PCI/ASPM: Consolidate variable declaration and initialization Merge the declaration and initialization of 'val' into a single statement for clarity. This eliminates a redundant assignment operation and improves code readability while maintaining the same functionality. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250522161533.394689-1-18255117159@163.com commit c1842b98c9f1ac1aac468253febc437f880bb8b5 Author: Hans Zhang <18255117159@163.com> Date: Sat May 17 23:49:39 2025 +0800 PCI/ASPM: Use boolean type for aspm_disabled and aspm_force The aspm_disabled and aspm_force variables are used as boolean flags. Change their type from int to bool and update assignments to use true/false instead of 1/0. This improves code clarity. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Signed-off-by: Bjorn Helgaas Reviewed-by: Ilpo Järvinen Link: https://patch.msgid.link/20250517154939.139237-1-18255117159@163.com commit 227e17a605f248a9f9f127c44ea9ce015741c857 Merge: b9ebe0cd5d5385 cf283fd6b8bea0 Author: Jakub Kicinski Date: Tue Jun 17 15:30:15 2025 -0700 Merge branch 'net-stmmac-rk-more-cleanups' Russell King says: ==================== net: stmmac: rk: more cleanups Another couple of cleanups removing pointless code. ==================== Link: https://patch.msgid.link/aE_u8mCkUXEWTzJe@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit cf283fd6b8bea0b5b599a67c9d3b3d34d6b4b84b Author: Russell King (Oracle) Date: Mon Jun 16 11:16:01 2025 +0100 net: stmmac: rk: remove unnecessary clk_mac The stmmac platform code already gets the "stmmaceth" clock, so there is no need for drivers to get it. Use the stored pointer in struct plat_stmmacenet_data instead of getting and storing our own pointer. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uR6sj-004Ku5-HR@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 8f6503993911f09b55ea8f4c6f55d6c555629cdf Author: Russell King (Oracle) Date: Mon Jun 16 11:15:56 2025 +0100 net: stmmac: rk: use device rather than platform device in rk_priv_data All the code in dwmac-rk uses &bsp_priv->pdev->dev, nothing uses bsp_priv->pdev directly. Store the struct device rather than the struct platform_device in struct rk_priv_data, and simplifying the code. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uR6se-004Ktz-Dx@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit a44769c97e9aa8e4d7783bcaf76f71c717b57381 Author: Russell King (Oracle) Date: Mon Jun 16 11:15:51 2025 +0100 net: stmmac: rk: fix code formmating issue Fix a code formatting issue introduced in the previous series, no space after , before "int". Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uR6sZ-004Ktt-9y@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b9ebe0cd5d53852e2edd7c7ffb0879712a9f8cdf Merge: d74520f39cdbb2 2410251cde0bac Author: Jakub Kicinski Date: Tue Jun 17 15:24:29 2025 -0700 Merge branch 'io_uring-cmd-for-tx-timestamps' Pavel Begunkov says: ==================== io_uring cmd for tx timestamps (part) Apply the networking helpers for the io_uring timestamp API. ==================== Link: https://patch.msgid.link/cover.1750065793.git.asml.silence@gmail.com Signed-off-by: Jakub Kicinski commit 2410251cde0bac9f660f276307d6c967466eef0c Author: Pavel Begunkov Date: Mon Jun 16 10:46:25 2025 +0100 net: timestamp: add helper returning skb's tx tstamp Add a helper function skb_get_tx_timestamp() that returns a tx timestamp associated with an error queue skb. Signed-off-by: Pavel Begunkov Acked-by: Willem de Bruijn Link: https://patch.msgid.link/702357dd8936ef4c0d3864441e853bfe3224a677.1750065793.git.asml.silence@gmail.com Signed-off-by: Jakub Kicinski commit f42b8d78dee77107245ec5beee3eb01915bcae7f Author: Al Viro Date: Wed Jun 11 19:40:04 2025 -0400 tpm: don't bother with removal of files in directory we'll be removing FWIW, there is a reliable indication of removal - ->i_nlink going to 0 ;-) Signed-off-by: Al Viro commit 5be998a218f7db74bcb26accdfcb9fe2d0c18b75 Author: Al Viro Date: Wed Jun 11 19:08:12 2025 -0400 ipe: don't bother with removal of files in directory we'll be removing ... and use securityfs_remove() instead of securityfs_recursive_remove() Acked-by: Fan Wu Signed-off-by: Al Viro commit e25fc5540cdbca3eded4db4bb43709a6ecce3c7d Author: Al Viro Date: Mon May 13 23:44:12 2024 -0600 evm_secfs: clear securityfs interactions 1) creation never returns NULL; error is reported as ERR_PTR() 2) no need to remove file before removing its parent Acked-by: Mimi Zohar Signed-off-by: Al Viro commit d15ffbbf4d32a9007c4a339a9fecac90ce30432a Author: Al Viro Date: Mon Mar 10 12:30:20 2025 -0400 ima_fs: get rid of lookup-by-dentry stuff lookup_template_data_hash_algo() machinery is used to locate the matching ima_algo_array[] element at read time; securityfs allows to stash that into inode->i_private at object creation time, so there's no need to bother Acked-by: Mimi Zohar Signed-off-by: Al Viro commit 22260a99d791163f7697a240dfc48e4e5a91ecfe Author: Al Viro Date: Mon May 13 23:41:51 2024 -0600 ima_fs: don't bother with removal of files in directory we'll be removing removal of parent takes all children out Acked-by: Mimi Zohar Signed-off-by: Al Viro commit 45215c589e7f22641e2fc6f518bcbead71d90f9c Merge: e04c78d86a9699 c5b4393c549255 Author: Dave Airlie Date: Wed Jun 18 08:09:27 2025 +1000 Merge tag 'drm-misc-next-2025-06-12' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-next drm-misc-next for 6.17: UAPI Changes: Cross-subsystem Changes: Core Changes: - atomic-helpers: Tune the enable / disable sequence - bridge: Add destroy hook - color management: Add helpers for hardware gamma LUT handling - HDMI: Add CEC handling, YUV420 output support - sched: tracing improvements Driver Changes: - hyperv: Move out of simple-kms, drm_panic support - i915: drm_panel_follower support - imx: Add IMX8qxq Display Controller Support - lima: Add Rockchip RK3528 GPU Support - nouveau: fence handling cleanup - panfrost: Add BO labeling, 64-bit registers access - qaic: Add RAS Support - rz-du: Add RZ/V2H(P) Support, MIPI-DSI DCS Support - sun4i: Add H616 Support - tidss: Add TI AM62L Support - vkms: YUV and R* formats support - bridges: - Switched to reference counted drm_bridge allocations - panels: - Switched to reference counted drm_panel allocations - Add support for fwnode-based panel lookup - himax-hx8394: Support for Huiling hl055fhv028c - ilitek-ili9881c: Support for 7" Raspberry Pi 720x1280 - panel-edp: Support for KDC KD116N3730A05, N160JCE-ELL CMN, - panel-simple: Support for AUO P238HAN01 - st7701: Support for Winstar wf40eswaa6mnn0 - visionox-rm69299: Support for rm69299-shift - New panels: Renesas R61307, Renesas R69328 Signed-off-by: Dave Airlie From: Maxime Ripard Link: https://lore.kernel.org/r/20250612-coucal-of-impossible-cleaning-a5eecf@houat commit 5a6acd563af4a0789e4a93afb28d71c177e71b8b Author: Al Viro Date: Thu May 4 17:42:24 2023 -0400 binder_ioctl_write_read(): simplify control flow a bit Acked-by: Greg Kroah-Hartman Signed-off-by: Al Viro commit 1812de14f04848daa354f99e9240e0f7c643718c Author: Al Viro Date: Wed May 3 16:50:18 2023 -0400 secretmem: move setting O_LARGEFILE and bumping users' count to the place where we create the file Acked-by: Andrew Morton Acked-by: Mike Rapoport (Microsoft) Signed-off-by: Al Viro commit 273a291dd7e62c42ee315777477dade0ede6636e Author: Al Viro Date: Tue May 27 23:03:43 2025 -0400 apparmor: file never has NULL f_path.mnt Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit d1832e648d2be564e4b5e357f94d0f33156590dc Author: Al Viro Date: Tue May 27 22:39:51 2025 -0400 landlock: opened file never has a negative dentry Reviewed-by: Christian Brauner Acked-by: Mickaël Salaün Signed-off-by: Al Viro commit 0d2da2561bdeb459b6c540c2417a15c1f8732e6a Author: Al Viro Date: Fri Feb 14 23:37:58 2025 -0500 ceph: fix a race with rename() in ceph_mdsc_build_path() Lift copying the name into callers of ceph_encode_encrypted_dname() that do not have it already copied; ceph_encode_encrypted_fname() disappears. That fixes a UAF in ceph_mdsc_build_path() - while the initial copy of plaintext into buf is done under ->d_lock, we access the original name again in ceph_encode_encrypted_fname() and that is done without any locking. With ceph_encode_encrypted_dname() using the stable copy the problem goes away. Tested-by: Viacheslav Dubeyko Reviewed-by: Viacheslav Dubeyko Signed-off-by: Al Viro commit 28032ef879b6ab073bb8c85f2044edaf6b80c929 Author: Al Viro Date: Fri Feb 14 23:27:45 2025 -0500 prep for ceph_encode_encrypted_fname() fixes ceph_encode_encrypted_dname() would be better off with plaintext name already copied into buffer; we'll lift that into the callers on the next step, which will allow to fix UAF on races with rename; for now copy it in the very beginning of ceph_encode_encrypted_dname(). That has a pleasant side benefit - we don't need to mess with tmp_buf anymore (i.e. that's 256 bytes off the stack footprint). Tested-by: Viacheslav Dubeyko Reviewed-by: Viacheslav Dubeyko Signed-off-by: Al Viro commit 101841c38346f4ca41dc1802c867da990ffb32eb Author: Al Viro Date: Tue Feb 18 17:57:17 2025 -0500 [ceph] parse_longname(): strrchr() expects NUL-terminated string ... and parse_longname() is not guaranteed that. That's the reason why it uses kmemdup_nul() to build the argument for kstrtou64(); the problem is, kstrtou64() is not the only thing that need it. Just get a NUL-terminated copy of the entire thing and be done with that... Fixes: dd66df0053ef "ceph: add support for encrypted snapshot names" Tested-by: Viacheslav Dubeyko Reviewed-by: Viacheslav Dubeyko Signed-off-by: Al Viro commit d74520f39cdbb24bd626410fd06f6c37d9a94fc9 Merge: 0f0decc777d7ed 0cb6db139f39c3 Author: Jakub Kicinski Date: Tue Jun 17 14:50:37 2025 -0700 Merge branch 'vsock-test-improve-transport_uaf-test' Michal Luczaj says: ==================== vsock/test: Improve transport_uaf test Increase the coverage of a test implemented in commit 301a62dfb0d0 ("vsock/test: Add test for UAF due to socket unbinding"). Take this opportunity to factor out some utility code, drop a redundant sync between client and server, and introduce a /proc/kallsyms harvesting logic for auto-detecting registered vsock transports. v2: https://lore.kernel.org/20250528-vsock-test-inc-cov-v2-0-8f655b40d57c@rbox.co v1: https://lore.kernel.org/20250523-vsock-test-inc-cov-v1-1-fa3507941bbd@rbox.co ==================== Link: https://patch.msgid.link/20250611-vsock-test-inc-cov-v3-0-5834060d9c20@rbox.co Signed-off-by: Jakub Kicinski commit 0cb6db139f39c300ea2c45647dbd4796335e78ec Author: Michal Luczaj Date: Wed Jun 11 21:56:52 2025 +0200 vsock/test: Cover more CIDs in transport_uaf test Increase the coverage of test for UAF due to socket unbinding, and losing transport in general. It's a follow up to commit 301a62dfb0d0 ("vsock/test: Add test for UAF due to socket unbinding") and discussion in [1]. The idea remains the same: take an unconnected stream socket with a transport assigned and then attempt to switch the transport by trying (and failing) to connect to some other CID. Now do this iterating over all the well known CIDs (plus one). While at it, drop the redundant synchronization between client and server. Some single-transport setups can't be tested effectively; a warning is issued. Depending on transports available, a variety of splats are possible on unpatched machines. After reverting commit 78dafe1cf3af ("vsock: Orphan socket after transport release") and commit fcdd2242c023 ("vsock: Keep the binding until socket destruction"): BUG: KASAN: slab-use-after-free in __vsock_bind+0x61f/0x720 Read of size 4 at addr ffff88811ff46b54 by task vsock_test/1475 Call Trace: dump_stack_lvl+0x68/0x90 print_report+0x170/0x53d kasan_report+0xc2/0x180 __vsock_bind+0x61f/0x720 vsock_connect+0x727/0xc40 __sys_connect+0xe8/0x100 __x64_sys_connect+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 WARNING: CPU: 0 PID: 1475 at net/vmw_vsock/virtio_transport_common.c:37 virtio_transport_send_pkt_info+0xb2b/0x1160 Call Trace: virtio_transport_connect+0x90/0xb0 vsock_connect+0x782/0xc40 __sys_connect+0xe8/0x100 __x64_sys_connect+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] RIP: 0010:sock_has_perm+0xa7/0x2a0 Call Trace: selinux_socket_connect_helper.isra.0+0xbc/0x450 selinux_socket_connect+0x3b/0x70 security_socket_connect+0x31/0xd0 __sys_connect_file+0x79/0x1f0 __sys_connect+0xe8/0x100 __x64_sys_connect+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 refcount_t: addition on 0; use-after-free. WARNING: CPU: 7 PID: 1518 at lib/refcount.c:25 refcount_warn_saturate+0xdd/0x140 RIP: 0010:refcount_warn_saturate+0xdd/0x140 Call Trace: __vsock_bind+0x65e/0x720 vsock_connect+0x727/0xc40 __sys_connect+0xe8/0x100 __x64_sys_connect+0x6e/0xc0 do_syscall_64+0x92/0x1c0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 refcount_t: underflow; use-after-free. WARNING: CPU: 0 PID: 1475 at lib/refcount.c:28 refcount_warn_saturate+0x12b/0x140 RIP: 0010:refcount_warn_saturate+0x12b/0x140 Call Trace: vsock_remove_bound+0x18f/0x280 __vsock_release+0x371/0x480 vsock_release+0x88/0x120 __sock_release+0xaa/0x260 sock_close+0x14/0x20 __fput+0x35a/0xaa0 task_work_run+0xff/0x1c0 do_exit+0x849/0x24c0 make_task_dead+0xf3/0x110 rewind_stack_and_make_dead+0x16/0x20 [1]: https://lore.kernel.org/netdev/CAGxU2F5zhfWymY8u0hrKksW8PumXAYz-9_qRmW==92oAx1BX3g@mail.gmail.com/ Suggested-by: Stefano Garzarella Signed-off-by: Michal Luczaj Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250611-vsock-test-inc-cov-v3-3-5834060d9c20@rbox.co Signed-off-by: Jakub Kicinski commit 3070c05b7afdf3da2d88d255a421fffca86f1f63 Author: Michal Luczaj Date: Wed Jun 11 21:56:51 2025 +0200 vsock/test: Introduce get_transports() Return a bitmap of registered vsock transports. As guesstimated by grepping /proc/kallsyms (CONFIG_KALLSYMS=y) for known symbols of type `struct vsock_transport`, or `struct virtio_transport` in case the vsock_transport is embedded within. Note that the way `enum transport` and `transport_ksyms[]` are defined triggers checkpatch.pl: util.h:11: ERROR: Macros with complex values should be enclosed in parentheses util.h:20: ERROR: Macros with complex values should be enclosed in parentheses util.h:20: WARNING: Argument 'symbol' is not used in function-like macro util.h:28: WARNING: Argument 'name' is not used in function-like macro While commit 15d4734c7a58 ("checkpatch: qualify do-while-0 advice") suggests it is known that the ERRORs heuristics are insufficient, I can not find many other places where preprocessor is used in this checkpatch-unhappy fashion. Notable exception being bcachefs, e.g. fs/bcachefs/alloc_background_format.h. WARNINGs regarding unused macro arguments seem more common, e.g. __ASM_SEL in arch/x86/include/asm/asm.h. In other words, this might be unnecessarily complex. The same can be achieved by just telling human to keep the order: enum transport { TRANSPORT_LOOPBACK = BIT(0), TRANSPORT_VIRTIO = BIT(1), TRANSPORT_VHOST = BIT(2), TRANSPORT_VMCI = BIT(3), TRANSPORT_HYPERV = BIT(4), TRANSPORT_NUM = 5, }; #define KSYM_ENTRY(sym) "d " sym "_transport" /* Keep `enum transport` order */ static const char * const transport_ksyms[] = { KSYM_ENTRY("loopback"), KSYM_ENTRY("virtio"), KSYM_ENTRY("vhost"), KSYM_ENTRY("vmci"), KSYM_ENTRY("vhs"), }; Suggested-by: Stefano Garzarella Signed-off-by: Michal Luczaj Tested-by: Luigi Leonardi Reviewed-by: Luigi Leonardi Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250611-vsock-test-inc-cov-v3-2-5834060d9c20@rbox.co Signed-off-by: Jakub Kicinski commit d56a8dbff8fea1c644183e52a39b165757f7b151 Author: Michal Luczaj Date: Wed Jun 11 21:56:50 2025 +0200 vsock/test: Introduce vsock_bind_try() helper Create a socket and bind() it. If binding failed, gracefully return an error code while preserving `errno`. Base vsock_bind() on top of it. Suggested-by: Stefano Garzarella Reviewed-by: Stefano Garzarella Signed-off-by: Michal Luczaj Reviewed-by: Luigi Leonardi Link: https://patch.msgid.link/20250611-vsock-test-inc-cov-v3-1-5834060d9c20@rbox.co Signed-off-by: Jakub Kicinski commit 0f0decc777d7ed4d7ba316a5f92495e38c6fc6b1 Merge: 170e4e3944aa39 755391121038c0 Author: Jakub Kicinski Date: Tue Jun 17 14:43:58 2025 -0700 Merge branch 'shradha_v6.16-rc1' of https://github.com/shradhagupta6/linux Shradha Gupta says: ==================== Allow dyn MSI-X vector allocation of MANA In this patchset we want to enable the MANA driver to be able to allocate MSI-X vectors in PCI dynamically. The first patch exports pci_msix_prepare_desc() in PCI to be able to correctly prepare descriptors for dynamically added MSI-X vectors. The second patch adds the support of dynamic vector allocation in pci-hyperv PCI controller by enabling the MSI_FLAG_PCI_MSIX_ALLOC_DYN flag and using the pci_msix_prepare_desc() exported in first patch. The third patch adds a detailed description of the irq_setup(), to help understand the function design better. The fourth patch is a preparation patch for mana changes to support dynamic IRQ allocation. It contains changes in irq_setup() to allow skipping first sibling CPU sets, in case certain IRQs are already affinitized to them. The fifth patch has the changes in MANA driver to be able to allocate MSI-X vectors dynamically. If the support does not exist it defaults to older behavior. * 'shradha_v6.16-rc1' of https://github.com/shradhagupta6/linux: net: mana: Allocate MSI-X vectors dynamically net: mana: Allow irq_setup() to skip cpus for affinity net: mana: explain irq_setup() algorithm PCI: hv: Allow dynamic MSI-X vector allocation PCI/MSI: Export pci_msix_prepare_desc() for dynamic MSI-X allocations ==================== Link: https://patch.msgid.link/1749650984-9193-1-git-send-email-shradhagupta@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 1a5ce0c5b95b0624ebd44f574b98003a466973be Author: Daniele Ceraolo Spurio Date: Fri Jun 13 16:11:29 2025 -0700 drm/xe: Extend WA 14018094691 to BMG This WA is applicable to BMG as well. Note that this is a GSC WA and we don't load the GSC on BMG, so extending the WA to BMG won't do anything right now. However, it helps future-proof the driver so that if we ever turn the GSC on we won't have to remember to extend this WA. v2: don't use VERSION_RANGE from 2001 to 2004 (Matt) Signed-off-by: Daniele Ceraolo Spurio Cc: Matt Roper Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250613231128.1261815-2-daniele.ceraolospurio@intel.com commit 7b768d1235dbd98ef7268596995d86df31afce21 Author: Danila Tikhonov Date: Tue Apr 22 23:17:02 2025 +0300 dt-bindings: arm: cpus: Add Kryo 470 CPUs Document Kryo 470 CPUs found in Qualcomm Snapdragon 730/730G/732G (SM7150). Signed-off-by: Danila Tikhonov Link: https://lore.kernel.org/r/20250422-sm7150-upstream-v1-1-bf9a9081631d@jiaxyga.com Signed-off-by: Bjorn Andersson commit ee4eba06d617e2be45e54a9fa2be070bb36d9e10 Author: Danila Tikhonov Date: Tue Apr 22 23:17:06 2025 +0300 dt-bindings: sram: qcom,imem: Add the SM7150 compatible Add compatible for SM7150 SoC IMEM. Signed-off-by: Danila Tikhonov Link: https://lore.kernel.org/r/20250422-sm7150-upstream-v1-5-bf9a9081631d@jiaxyga.com Signed-off-by: Bjorn Andersson commit 23b0f375b542d6aea4e4d7529abb142a791023e5 Author: David Wronek Date: Tue Apr 22 23:17:07 2025 +0300 dt-bindings: soc: qcom: aoss-qmp: Add the SM7150 compatible Document the AOSS QMP compatible for SM7150. Signed-off-by: David Wronek Signed-off-by: Danila Tikhonov Link: https://lore.kernel.org/r/20250422-sm7150-upstream-v1-6-bf9a9081631d@jiaxyga.com Signed-off-by: Bjorn Andersson commit 71da9389a51c257ed1177bd33bb641e9a21c6a5f Author: Danila Tikhonov Date: Tue Apr 22 23:17:13 2025 +0300 dt-bindings: soc: qcom,dcc: Add the SM7150 compatible Document DDC compatible for SM7150. Signed-off-by: Danila Tikhonov Link: https://lore.kernel.org/r/20250422-sm7150-upstream-v1-12-bf9a9081631d@jiaxyga.com Signed-off-by: Bjorn Andersson commit 64a026dd896e423a177fe87e11aa69bf5348c27b Author: Kathiravan Thirumoorthy Date: Mon May 19 19:14:01 2025 +0530 soc: qcom: socinfo: Add support to retrieve TME build details Add support to retrieve Trust Management Engine (TME) image details from SMEM, which is present in the IPQ5424 SoC. Signed-off-by: Kathiravan Thirumoorthy Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250519-tme-crm-version-v1-1-a6dceadc10aa@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 07a4688833b237331e5045f90fc546c085b28c86 Author: Alexander Wilhelm Date: Thu May 22 16:35:30 2025 +0200 soc: qcom: fix endianness for QMI header The members of QMI header have to be swapped on big endian platforms. Use __le16 types instead of u16 ones. Signed-off-by: Alexander Wilhelm Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder") Fixes: 3830d0771ef6 ("soc: qcom: Introduce QMI helpers") Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250522143530.3623809-3-alexander.wilhelm@westermo.com Signed-off-by: Bjorn Andersson commit 3ced38da5f7de4c260f9eaa86fc805827953243a Author: Alexander Wilhelm Date: Thu May 22 16:35:29 2025 +0200 soc: qcom: QMI encoding/decoding for big endian The QMI_DATA_LEN type may have different sizes. Taking the element's address of that type and interpret it as a smaller sized ones works fine for little endian platforms but not for big endian ones. Instead use temporary variables of smaller sized types and cast them correctly to support big endian platforms. Signed-off-by: Alexander Wilhelm Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder") Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250522143530.3623809-2-alexander.wilhelm@westermo.com Signed-off-by: Bjorn Andersson commit b0123a8aa9dda9c89f0fe7d30a87c03fcddfc505 Author: Lijuan Gao Date: Mon May 26 13:21:48 2025 +0800 dt-bindings: soc: qcom: add qcom,qcs615-imem compatible Document qcom,qcs615-imem compatible. It has a child node for debugging purposes. Acked-by: Krzysztof Kozlowski Signed-off-by: Lijuan Gao Link: https://lore.kernel.org/r/20250526-add_qcs615_remoteproc_support-v4-2-06a7d8bed0b5@quicinc.com Signed-off-by: Bjorn Andersson commit da9ba4132057cc31ac2ab9dfa9c98b7baaac3ca8 Author: Nick Huang Date: Sat May 31 15:01:40 2025 +0800 selftests: ipc: Replace fail print statements with ksft_test_result_fail Use the standard kselftest failure report function to ensure consistent test output formatting. This improves readability and integration with automated test frameworks. Link: https://lore.kernel.org/r/20250531070140.24287-1-sef1548@gmail.com Signed-off-by: Nick Huang Signed-off-by: Shuah Khan commit 85cd83fed8267cde0dd1cea719808aad95ae4de7 Author: Yuan Chen Date: Tue Jun 17 09:24:42 2025 -0400 bpftool: Fix JSON writer resource leak in version command When using `bpftool --version -j/-p`, the JSON writer object created in do_version() was not properly destroyed after use. This caused a memory leak each time the version command was executed with JSON output. Fix: 004b45c0e51a (tools: bpftool: provide JSON output for all possible commands) Suggested-by: Quentin Monnet Signed-off-by: Yuan Chen Signed-off-by: Andrii Nakryiko Reviewed-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20250617132442.9998-1-chenyuan_fl@163.com commit 66ab68c9de89672366fdc474f4f185bb58cecf2d Author: Mykyta Yatsenko Date: Tue Jun 17 13:15:36 2025 +0100 selftests/bpf: Fix unintentional switch case fall through Break from switch expression after parsing -n CLI argument in veristat, instead of falling through and enabling comparison mode. Fixes: a5c57f81eb2b ("veristat: add ability to set BPF_F_TEST_SANITY_STRICT flag with -r flag") Signed-off-by: Mykyta Yatsenko Signed-off-by: Andrii Nakryiko Acked-by: Yonghong Song Link: https://lore.kernel.org/bpf/20250617121536.1320074-1-mykyta.yatsenko5@gmail.com commit fc2915bb8bfcfdc6e5ea2cfc8d13fbaefe77c2c8 Author: Eduard Zingerman Date: Mon Jun 16 17:57:10 2025 -0700 selftests/bpf: More precise cpu_mitigations state detection test_progs and test_verifier binaries execute unpriv tests under the following conditions: - unpriv BPF is enabled; - CPU mitigations are enabled (see [1] for details). The detection of the "mitigations enabled" state is performed by unpriv_helpers.c:get_mitigations_off() via inspecting kernel boot command line, looking for a parameter "mitigations=off". Such detection scheme won't work for certain configurations, e.g. when CONFIG_CPU_MITIGATIONS is disabled and boot parameter is not supplied. Miss-detection leads to test_progs executing tests meant to be run only with mitigations enabled, e.g. verifier_and.c:known_subreg_with_unknown_reg(), and reporting false failures. Internally, verifier sets bpf_verifier_env->bypass_spec_{v1,v4} basing on the value returned by kernel/cpu.c:cpu_mitigations_off(). This function is backed by a variable kernel/cpu.c:cpu_mitigations. This state is not fully introspect-able via sysfs. The closest proxy is /sys/devices/system/cpu/vulnerabilities/spectre_v1, but it reports "vulnerable" state only if mitigations are disabled *and* current cpu is vulnerable, while verifier does not check cpu state. There are only two ways the kernel/cpu.c:cpu_mitigations can be set: - via boot parameter; - via CONFIG_CPU_MITIGATIONS option. This commit updates unpriv_helpers.c:get_mitigations_off() to scan /boot/config-$(uname -r) and /proc/config.gz for CONFIG_CPU_MITIGATIONS value in addition to boot command line check. Tested using the following configurations: - mitigations enabled (unpriv tests are enabled) - mitigations disabled via boot cmdline (unpriv tests skipped) - mitigations disabled via CONFIG_CPU_MITIGATIONS (unpriv tests skipped) [1] https://lore.kernel.org/bpf/20231025031144.5508-1-laoar.shao@gmail.com/ Reported-by: Mykyta Yatsenko Signed-off-by: Eduard Zingerman Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250617005710.1066165-2-eddyz87@gmail.com commit cd9f02adca658f74cd7b28334ce163170bd3c19c Author: Tianyi Cui <1997cui@gmail.com> Date: Tue Jun 10 15:12:07 2025 -0700 selftests: Add version file to kselftest installation dir As titled, adding version file to kselftest installation dir, so the user of the tarball can know which kernel version the tarball belongs to. Link: https://lore.kernel.org/r/20250610221248.819519-1-1997cui@gmail.com Signed-off-by: Tianyi Cui <1997cui@gmail.com> Signed-off-by: Shuah Khan commit 21cf47d89fba353b2d5915ba4718040c4cb955d3 Author: Lucas De Marchi Date: Thu Jun 12 15:14:12 2025 -0700 drm/xe: Fix memset on iomem It should rather use xe_map_memset() as the BO is created with XE_BO_FLAG_VRAM_IF_DGFX in xe_guc_pc_init(). Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Cc: stable@vger.kernel.org Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250612-vmap-vaddr-v1-1-26238ed443eb@intel.com Signed-off-by: Lucas De Marchi commit 44c71c16f37d5c40418801e7868b62acdcc6b701 Author: Jihed Chaibi Date: Fri May 23 22:22:39 2025 +0200 selftests/cpu-hotplug: fix typo in hotplaggable_offline_cpus function name Fix spelling error replacing "hotplaggable" by "hotpluggable" Fixed change log: Shuah Khan Link: https://lore.kernel.org/r/20250523202239.276760-1-jihed.chaibi.dev@gmail.com Signed-off-by: Jihed Chaibi Signed-off-by: Shuah Khan commit 633e6bad31249fe53721030bfb9e1f4d1f0007fe Merge: 8dcb0ed834a3ec c853d18706de8c Author: Tejun Heo Date: Tue Jun 17 10:08:45 2025 -1000 Merge branch 'for-6.16-fixes' into for-6.17 Pull cgroup/for-6.16-fixes to receive c853d18706de ("cgroup: adjust criteria for rstat subsystem cpu lock access") which conflicts with the NMI-safe css_rstat_updated() changes in for-6.17. As the latter removes the affected CPU locks, resolve the conflicts by taking for-6.17 sides. Signed-off-by: Tejun Heo commit 8dcb0ed834a3ec037c153c7757240ede9a8c9808 Author: Shakeel Butt Date: Tue Jun 17 12:57:25 2025 -0700 memcg: cgroup: call css_rstat_updated irrespective of in_nmi() css_rstat_updated() is nmi safe, so there is no need to avoid it in in_nmi(), so remove the check. Signed-off-by: Shakeel Butt Tested-by: JP Kobryn Signed-off-by: Tejun Heo commit 6af89c6ca71742e9227e6f8172a86ce1ee16aa85 Author: Shakeel Butt Date: Tue Jun 17 12:57:24 2025 -0700 cgroup: remove per-cpu per-subsystem locks The rstat update side used to insert the cgroup whose stats are updated in the update tree and the read side flush the update tree to get the latest uptodate stats. The per-cpu per-subsystem locks were used to synchronize the update and flush side. However now the update side does not access update tree but uses per-cpu lockless lists. So there is no need for locks to synchronize update and flush side. Let's remove them. Suggested-by: JP Kobryn Signed-off-by: Shakeel Butt Tested-by: JP Kobryn Signed-off-by: Tejun Heo commit 36df6e3dbd7e7b074e55fec080012184e2fa3a46 Author: Shakeel Butt Date: Tue Jun 17 12:57:23 2025 -0700 cgroup: make css_rstat_updated nmi safe To make css_rstat_updated() able to safely run in nmi context, let's move the rstat update tree creation at the flush side and use per-cpu lockless lists in struct cgroup_subsys to track the css whose stats are updated on that cpu. The struct cgroup_subsys_state now has per-cpu lnode which needs to be inserted into the corresponding per-cpu lhead of struct cgroup_subsys. Since we want the insertion to be nmi safe, there can be multiple inserters on the same cpu for the same lnode. Here multiple inserters are from stacked contexts like softirq, hardirq and nmi. The current llist does not provide function to protect against the scenario where multiple inserters can use the same lnode. So, using llist_node() out of the box is not safe for this scenario. However we can protect against multiple inserters using the same lnode by using the fact llist node points to itself when not on the llist and atomically reset it and select the winner as the single inserter. Signed-off-by: Shakeel Butt Tested-by: JP Kobryn Signed-off-by: Tejun Heo commit 1257b8786ac689a2ce5fe3e1741c65038035adc6 Author: Shakeel Butt Date: Tue Jun 17 12:57:22 2025 -0700 cgroup: support to enable nmi-safe css_rstat_updated Add necessary infrastructure to enable the nmi-safe execution of css_rstat_updated(). Currently css_rstat_updated() takes a per-cpu per-css raw spinlock to add the given css in the per-cpu per-css update tree. However the kernel can not spin in nmi context, so we need to remove the spinning on the raw spinlock in css_rstat_updated(). To support lockless css_rstat_updated(), let's add necessary data structures in the css and ss structures. Signed-off-by: Shakeel Butt Tested-by: JP Kobryn Signed-off-by: Tejun Heo commit 61a5a3f182cc3f8e141045509c8eeb104f7be632 Author: Lucas De Marchi Date: Fri Jun 13 13:00:38 2025 -0700 drm/xe: Annotate default for guc_log_level param Reword the parameter description so it's clear what's the default and what are the verbose levels. Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250613-guc-log-level-v2-2-cb84a63e49fe@intel.com Signed-off-by: Lucas De Marchi commit a37128ba613ad6a5f81f382fa3cfe5c4a6527310 Author: Lucas De Marchi Date: Fri Jun 13 13:00:37 2025 -0700 drm/xe/guc: Default log level to non-verbose Currently xe sets the guc log level to a verbose level since it's useful to debug hangs and general development. However the verbose level may already be too much and affect performance. Michal Mrozek did some tests with the L0 compute stack for submission latency with ULLS disabled. Below are the normalized numbers with log level 3 (the current default) as baseline for each test: Test \ Log Level 3 0 1 2 ----------------------------------------------------------- ------ ------ ------ ------ BestWalkerNthCommandListSubmission(CmdListCount=2) 1.00 0.63 0.63 0.96 BestWalkerNthSubmission(KernelCount=2) 1.00 0.62 0.63 0.96 BestWalkerNthSubmissionImmediate(KernelCount=2) 1.00 0.58 0.58 0.85 BestWalkerSubmission 1.00 0.62 0.62 0.96 BestWalkerSubmissionImmediate 1.00 0.63 0.62 0.96 BestWalkerSubmissionImmediateMultiCmdlists(cmdlistCount=2) 1.00 0.58 0.58 0.86 BestWalkerSubmissionImmediateMultiCmdlists(cmdlistCount=4) 1.00 0.70 0.70 0.83 BestWalkerSubmissionImmediateMultiCmdlists(cmdlistCount=8) 1.00 0.53 0.52 0.78 Log level 2 is the first "verbose level" for GuC, where the biggest difference happens. Keep log level 3 for CONFIG_DRM_XE_DEBUG, but switch to 1, i.e. GUC_LOG_LEVEL_NON_VERBOSE, for "normal" builds. Cc: Michal Mrozek Cc: John Harrison Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250613-guc-log-level-v2-1-cb84a63e49fe@intel.com Signed-off-by: Lucas De Marchi commit f11113d01306b2d9cec0934f606d1b81b94260c5 Merge: fda6add9243867 930c2ea566aff5 Author: Tejun Heo Date: Tue Jun 17 08:52:50 2025 -1000 Merge branch 'WQ_PERCPU' into for-6.17 commit 930c2ea566aff59e962c50b2421d5fcc3b98b8be Author: Marco Crivellari Date: Sat Jun 14 15:35:30 2025 +0200 workqueue: Add new WQ_PERCPU flag Currently if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. This patch adds a new WQ_PERCPU flag to explicitly request the use of the per-CPU behavior. Both flags coexist for one release cycle to allow callers to transition their calls. Once migration is complete, WQ_UNBOUND can be removed and unbound will become the implicit default. tj: Merged doc patch. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Tejun Heo commit 128ea9f6ccfb6960293ae4212f4f97165e42222d Author: Marco Crivellari Date: Sat Jun 14 15:35:29 2025 +0200 workqueue: Add system_percpu_wq and system_dfl_wq Currently, if a user enqueue a work item using schedule_delayed_work() the used wq is "system_wq" (per-cpu wq) while queue_delayed_work() use WORK_CPU_UNBOUND (used when a cpu is not specified). The same applies to schedule_work() that is using system_wq and queue_work(), that makes use again of WORK_CPU_UNBOUND. This lack of consistentcy cannot be addressed without refactoring the API. system_wq is a per-CPU worqueue, yet nothing in its name tells about that CPU affinity constraint, which is very often not required by users. Make it clear by adding a system_percpu_wq. system_unbound_wq should be the default workqueue so as not to enforce locality constraints for random work whenever it's not required. Adding system_dfl_wq to encourage its use when unbound work should be used. Suggested-by: Tejun Heo Signed-off-by: Marco Crivellari Signed-off-by: Tejun Heo commit 82a4be88c89ae3f117b8b53d0a7c080eb68ab9f1 Author: Ashutosh Dixit Date: Fri Jun 6 12:26:17 2025 -0700 drm/xe/oa: Enable OAM latency measurement Enable OAM latency measurement for Xe3+ platforms. Bspec: 58840 v2: Introduce DRM_XE_OA_UNIT_TYPE_OAM_SAG v3: Also add LNCF_MISC_CONFIG_REGISTER0 needed by MDAPI Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250606192618.4133817-6-ashutosh.dixit@intel.com commit 10d42ef34bce5a3b60be6a492fc079f6ace871ce Author: Ashutosh Dixit Date: Fri Jun 6 12:26:16 2025 -0700 drm/xe/oa: Assign hwe for OAM_SAG Because OAM_SAG doesn't have an attached hwe, assign another hwe belonging to the same gt (and different OAM unit) to OAM_SAG. A hwe is needed for batch submissions to program OA HW. v2: Assign an engine with a valid OA unit for OAM_SAG (Umesh) Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250606192618.4133817-5-ashutosh.dixit@intel.com commit 2d1fcec0229c3180fc32fe11babfc428fc69b97d Author: Ashutosh Dixit Date: Fri Jun 6 12:26:15 2025 -0700 drm/xe/oa: Introduce stream->oa_unit Previously, the oa_unit associated with an OA stream was derived from hwe associated with the stream (stream->hwe->oa_unit). This breaks with OAM_SAG since OAM_SAG does not have any attached hardware engines. Resolve this by introducing stream->oa_unit and stop depending on stream->hwe. Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250606192618.4133817-4-ashutosh.dixit@intel.com commit f3a3fd2c6f87f0e7d225019d7ed34c6bddf573f9 Author: Ashutosh Dixit Date: Fri Jun 6 12:26:14 2025 -0700 drm/xe/oa: Print hwe to OA unit mapping Print hwe to OA unit mapping to dmesg, to help debug for current and new platforms. v2: Separate out xe_oa_print_gt_oa_units() (Umesh) Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250606192618.4133817-3-ashutosh.dixit@intel.com commit e04dac12cec853347908432b663a3f78e26d3b8d Author: Ashutosh Dixit Date: Fri Jun 6 12:26:13 2025 -0700 drm/xe/oa/uapi: Expose media OA units On Xe2+ platforms, media engines are attached to "SCMI" OA media (OAM) units. One or more SCMI OAM units might be present on a platform. In addition there is another OAM unit for global events, called OAM-SAG. Performance metrics for media workloads can be obtained from these OAM units, similar to OAG. Expose these OAM units for userspace to use. OAM-SAG is exposed as an OA unit without any attached engines. Bspec: 70819, 67103, 63844, 72572, 74476, 61284 v2: Fix xe_gt_WARN_ON in __hwe_oam_unit for < 12.7 platforms v3: Return XE_OA_UNIT_INVALID for < 12.7 to indicate no OAM units v4: Move xe_oa_print_oa_units() to separate patch v5: Introduce DRM_XE_OA_UNIT_TYPE_OAM_SAG v6: Introduce DRM_XE_OA_CAPS_OAM Signed-off-by: Ashutosh Dixit Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250606192618.4133817-2-ashutosh.dixit@intel.com commit 5da4f9db980cc475bb6f027153cce75eaa3026ec Author: Michal Koutný Date: Tue Jun 17 15:36:56 2025 +0200 selftests: cgroup: Fix compilation on pre-cgroupns kernels The test would be skipped because of nsdelegate, so the defined value is not used (0 is always acceptable). Signed-off-by: Michal Koutný Signed-off-by: Tejun Heo commit d74cd7864ffa6913f1d70f80858bd3fd19101cdf Author: Michal Koutný Date: Tue Jun 17 15:36:55 2025 +0200 selftests: cgroup: Optionally set up v1 environment Use the missing mount of the unifier hierarchy as a hint of legacy system and prepare our own named v1 hierarchy for tests. The code is only in test_core.c and not cgroup_util.c because other selftests are related to controllers which will be exposed on v2 hierarchy but named hierarchies are only v1 thing. Signed-off-by: Michal Koutný Signed-off-by: Tejun Heo commit dd7588e455f847d3b0108d9981b1fcff4441f77b Author: Michal Koutný Date: Tue Jun 17 15:36:54 2025 +0200 selftests: cgroup: Add support for named v1 hierarchies in test_core This comes useful when using selftests from mainline on older kernels/setups that still rely on cgroup v1. The core tests that rely on v2 specific features are skipped, the remaining ones are adjusted to work with a v1 hierarchy. The expected output on v1 system: ok 1 # SKIP test_cgcore_internal_process_constraint ok 2 # SKIP test_cgcore_top_down_constraint_enable ok 3 # SKIP test_cgcore_top_down_constraint_disable ok 4 # SKIP test_cgcore_no_internal_process_constraint_on_threads ok 5 # SKIP test_cgcore_parent_becomes_threaded ok 6 # SKIP test_cgcore_invalid_domain ok 7 # SKIP test_cgcore_populated ok 8 test_cgcore_proc_migration ok 9 test_cgcore_thread_migration ok 10 test_cgcore_destroy ok 11 test_cgcore_lesser_euid_open ok 12 # SKIP test_cgcore_lesser_ns_open Signed-off-by: Michal Koutný Signed-off-by: Tejun Heo commit 0925275a173d07786bfddf453f629f78d7fc4278 Author: Michal Koutný Date: Tue Jun 17 15:36:53 2025 +0200 selftests: cgroup_util: Add helpers for testing named v1 hierarchies Non-functional change, the control variable will be wired in a separate commit. Signed-off-by: Michal Koutný Signed-off-by: Tejun Heo commit a633dab4b4d2f06c0fcb3caa6f110efabdf889f9 Author: Yonghong Song Date: Mon Jun 16 21:49:56 2025 -0700 selftests/bpf: Fix RELEASE build failure with gcc14 With gcc14, when building with RELEASE=1, I hit four below compilation failure: Error 1: In file included from test_loader.c:6: test_loader.c: In function ‘run_subtest’: test_progs.h:194:17: error: ‘retval’ may be used uninitialized in this function [-Werror=maybe-uninitialized] 194 | fprintf(stdout, ##format); \ | ^~~~~~~ test_loader.c:958:13: note: ‘retval’ was declared here 958 | int retval, err, i; | ^~~~~~ The uninitialized var 'retval' actually could cause incorrect result. Error 2: In function ‘test_fd_array_cnt’: prog_tests/fd_array.c:71:14: error: ‘btf_id’ may be used uninitialized in this function [-Werror=maybe-uninitialized] 71 | fd = bpf_btf_get_fd_by_id(id); | ^~~~~~~~~~~~~~~~~~~~~~~~ prog_tests/fd_array.c:302:15: note: ‘btf_id’ was declared here 302 | __u32 btf_id; | ^~~~~~ Changing ASSERT_GE to ASSERT_EQ can fix the compilation error. Otherwise, there is no functionality change. Error 3: prog_tests/tailcalls.c: In function ‘test_tailcall_hierarchy_count’: prog_tests/tailcalls.c:1402:23: error: ‘fentry_data_fd’ may be used uninitialized in this function [-Werror=maybe-uninitialized] 1402 | err = bpf_map_lookup_elem(fentry_data_fd, &i, &val); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The code is correct. The change intends to silence gcc errors. Error 4: (this error only happens on arm64) In file included from prog_tests/log_buf.c:4: prog_tests/log_buf.c: In function ‘bpf_prog_load_log_buf’: ./test_progs.h:390:22: error: ‘log_buf’ may be used uninitialized [-Werror=maybe-uninitialized] 390 | int ___err = libbpf_get_error(___res); \ | ^~~~~~~~~~~~~~~~~~~~~~~~ prog_tests/log_buf.c:158:14: note: in expansion of macro ‘ASSERT_OK_PTR’ 158 | if (!ASSERT_OK_PTR(log_buf, "log_buf_alloc")) | ^~~~~~~~~~~~~ In file included from selftests/bpf/tools/include/bpf/bpf.h:32, from ./test_progs.h:36: selftests/bpf/tools/include/bpf/libbpf_legacy.h:113:17: note: by argument 1 of type ‘const void *’ to ‘libbpf_get_error’ declared here 113 | LIBBPF_API long libbpf_get_error(const void *ptr); | ^~~~~~~~~~~~~~~~ Adding a pragma to disable maybe-uninitialized fixed the issue. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250617044956.2686668-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit c036993721a3773f918d9a34bd706f72dc1628bf Author: Dennis Dalessandro Date: Tue May 27 11:46:12 2025 -0400 Maintainers: Remove QIB qib driver has been removed. Take entry out of MAINTAINERS file. Link: https://patch.msgid.link/r/174836077280.2436819.8306178407677103841.stgit@awdrv-04.cornelisnetworks.com Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 24baad32b7100448fc4c3b13eceb0a222b25b12c Author: Dennis Dalessandro Date: Tue May 27 11:46:07 2025 -0400 RDMA/qib: Remove outdated driver The qib Infiniband device has long been decommissioned from distros and unsupported by the company. We have kept it going in a compile only mode for a while now and it's time to remove the driver. It has a number of issues that are never going to be addressed and is a hindrance to improving hfi1 and rdmavt. Link: https://patch.msgid.link/r/174836076755.2436819.5981097575800950899.stgit@awdrv-04.cornelisnetworks.com Signed-off-by: Dennis Dalessandro Signed-off-by: Jason Gunthorpe commit 35636068ce18b8506a7c6cb475395707b6ef3989 Author: Hans Zhang <18255117159@163.com> Date: Thu May 29 10:10:25 2025 +0800 dt-bindings: PCI: pci-ep: Extend max-link-speed to PCIe Gen5/Gen6 Update the PCI Endpoint (EP) device tree binding documentation to include PCIe Gen5 and Gen6 support for the `max-link-speed` property. Similar to the Host Controller binding, the original EP binding limited this value to 1~4 (Gen1~Gen4). With current SoCs requiring Gen5/Gen6 support (e.g., Synopsys/Cadence IP), this change aligns the EP binding with the kernel's PCIe 6.0 capabilities. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250529021026.475861-3-18255117159@163.com commit be84da3e19666da5c43c5c4ad86eff456510bd77 Author: Ziyue Zhang Date: Thu May 29 11:56:31 2025 +0800 dt-bindings: PCI: qcom,pcie-sa8775p: Document QCS8300 QCS8300 is derived from SA8775p. Hence, add the callback with SA8775p as the fallback. Signed-off-by: Ziyue Zhang Signed-off-by: Manivannan Sadhasivam Reviewed-by: Manivannan Sadhasivam Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250529035635.4162149-3-quic_ziyuzhan@quicinc.com commit 46d221ed970a46dc2089b6747efe7a69239558f4 Author: Ziyue Zhang Date: Tue May 27 15:20:34 2025 +0800 dt-bindings: PCI: qcom,pcie-sm8150: Document QCS615 QCS615 is derived from SM8150. Hence, add the callback with SM8150 as the fallback. Signed-off-by: Ziyue Zhang [mani: commit message rewording] Signed-off-by: Manivannan Sadhasivam Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250527072036.3599076-3-quic_ziyuzhan@quicinc.com commit 7ecc69488329671617c1f1c6c30f2ebcd81f915e Author: Heiko Carstens Date: Thu Jun 12 15:43:08 2025 +0200 s390/drivers: Remove unnecessary include Remove include from all files which do not contain an EXPORT_SYMBOL(). See commit 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") for more details. Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 8a56977051f2d5d91c455847bb3456d97b5d7977 Author: Heiko Carstens Date: Thu Jun 12 14:36:59 2025 +0200 s390/drivers: Explicitly include Explicitly include in files which contain an EXPORT_SYMBOL(). See commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") for more details. Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 0f3760d43da56736dcfc91c04c05fdf2936a158e Author: Heiko Carstens Date: Thu Jun 12 14:02:59 2025 +0200 s390: Remove unnecessary include Remove include from all files which do not contain an EXPORT_SYMBOL(). See commit 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") for more details. Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit 65c9a9f92502442157f7eb98e8cd8ad255676330 Author: Heiko Carstens Date: Thu Jun 12 13:47:38 2025 +0200 s390: Explicitly include Explicitly include in files which contain an EXPORT_SYMBOL(). See commit a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") for more details. Acked-by: Alexander Gordeev Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev commit b2f7e30d2e4a34fcee8111d713bef4f29dc23c77 Author: Ville Syrjälä Date: Thu Jun 12 17:50:18 2025 +0300 drm/i915/dsb: Disable the GOSUB interrupt Current DSB hardware is apparently a bit borked and likes to signal spurious GOSUB errors. We already have most for the workarounds for this in place, but the last part is simply not enabling the corresponding interrupt. While at it polish up the w/a comments with the w/a number, and consistently take the short blurp from the w/a page. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250612145018.8735-7-ville.syrjala@linux.intel.com commit 7c50c6a8173137519c84574bd348abe6703989be Author: Ville Syrjälä Date: Thu Jun 12 17:50:17 2025 +0300 drm/i915/dsb: Move the DSB_PMCTRL* reset out of intel_dsb_finish() When using the flip queue, due to the DMC vs. DSB register corruption problem, we must not issue any register writes from the DSB after unhalting the DMC. Currently we are doing just that by trying to restore DSB_PMCTRL* back to a sane state from intel_dsb_finish(). Since the only place left that pokes at DSB_PMCTRL* is intel_dsb_chain() we can just do DSB_PMCTRL_2/DSB_FORCE_DEWAKE reset in the same place. The DSB_PMCTRL reset is trickier since we'd have to do it from the chained DSB itself. But based on my earlier testing DSB_PMCTRL/DSB_ENABLE_DEWAKE doesn't actually do anything if the DSB isn't actually enabled, so we can omit the reset to keep things a bit simpler. We do need to reset DSB_PMCTRL/DSB_ENABLE_DEWAKE before tarting the DSB however, in case it was left enabled from a previous use. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250612145018.8735-6-ville.syrjala@linux.intel.com commit 00863f06fd8bcb075bb95655bbdcdb562d81bb03 Author: Ville Syrjälä Date: Thu Jun 12 17:50:16 2025 +0300 drm/i915/dsb: Garbage collect the MMIO DEwake stuff Since the introduction of DSB chaining we no longer need the DEwake tricks in intel_dsb_commit(). I also need to relocate the DSB_PMCTRL* writes out of intel_dsb_finish() (due to the flip queue DMC vs. DSB register corruption issues), and it'll be a bit more straightforward if I don't have to worry about the non-chained DSB path anymore. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250612145018.8735-5-ville.syrjala@linux.intel.com commit ee14e265e10d00dd2b738cda1e3e0dbf5ffcc69a Author: Ville Syrjälä Date: Thu Jun 12 17:50:15 2025 +0300 drm/i915/dsb: Introduce intel_dsb_exec_time_us() Pull the magic 20 usec DSB execution deadline into intel_dsb_arm_exec_time_us(), and also add its counterpart for the non-arming register write section. For the non-arming part we'll just throw in a random 80 usec for now so the total is 100usec. The total exec time will be needed by the upcoming flip queue code. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250612145018.8735-4-ville.syrjala@linux.intel.com commit 7e151f53fd6aec9fa04cec6a23a54cd415650330 Author: Ville Syrjälä Date: Thu Jun 12 17:50:14 2025 +0300 drm/i915/dsb: Provide intel_dsb_head() and intel_dsb_size() The upcoming flip queue implementation will need to know the DSB buffer head and size. Expose those outside intel_dsb.c. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250612145018.8735-3-ville.syrjala@linux.intel.com commit ed9434c6b4f3d9aa89c9ba6853849b9751a2b1f3 Author: Ville Syrjälä Date: Thu Jun 12 17:50:13 2025 +0300 drm/i915/dsb: Use intel_dsb_ins_align() in intel_dsb_align_tail() If the free_post is not QW aligned we don't have to memset the extra DW needed to make it so, as the only way that can happen is via intel_dsb_reg_write_indexed() which already makes sure the next DW is zeroed. Not a big deal, but this is more consistent how all the other stuff operates that puts instructions into the DSB buffer, and we'll get a few more of those soon. Reviewed-by: Uma Shankar Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250612145018.8735-2-ville.syrjala@linux.intel.com commit 2e273e4f8555615df70d9a9652a0fd39e7187b69 Author: Matthew Brost Date: Thu Jun 12 10:28:50 2025 -0700 drm/xe: Move LRC_ENGINE_ID_PPHWSP_OFFSET outside of parallel offset The parallel scratch layout spans 2k and LRC_ENGINE_ID_PPHWSP_OFFSET lands within than space. This happens to be ok as the offset lands in reserved part of guc_sched_wq_desc, but for future safety move LRC_ENGINE_ID_PPHWSP_OFFSET to the unused offset of 1024 below parallel scratch layout. Signed-off-by: Matthew Brost Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250612172850.4170428-1-matthew.brost@intel.com commit badf45650bbd14e17ae3d8088a6be672c96a7665 Author: Matthew Brost Date: Fri Jun 13 16:18:08 2025 -0700 drm/xe: Do not kill VM in PT code on -ENODATA No need kill on -ENODATA as is this non-fatal error can occur when MMU notifiers race with prefetches. Fixes: 09ba0a8f06cd ("drm/xe/svm: Implement prefetch support for SVM ranges") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray > Link: https://lore.kernel.org/r/20250613231808.752616-1-matthew.brost@intel.com commit 76ee96d3d7f1476e9a78a87b536b8c58a81c3552 Author: Brian Norris Date: Mon Jun 16 14:16:33 2025 -0700 Documentation: kunit: Correct MODULE_IMPORT_NS() syntax The argument should be the string "EXPORTED_FOR_KUNIT_TESTING", not a bare identifier. Link: https://lore.kernel.org/r/20250616211637.111358-1-briannorris@chromium.org Signed-off-by: Brian Norris Reviewed-by: David Gow Signed-off-by: Shuah Khan commit a72002cb181f350734108228b24c5d10d358f95a Author: André Almeida Date: Tue Jun 17 09:49:49 2025 -0300 drm/amdgpu: Make use of drm_wedge_task_info To notify userspace about which task (if any) made the device get in a wedge state, make use of drm_wedge_task_info parameter, filling it with the task PID and name. Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250617124949.2151549-7-andrealmeid@igalia.com Signed-off-by: André Almeida commit 35dc4ce200623fec8f8eda256cd8abb5befbfae2 Author: André Almeida Date: Tue Jun 17 09:49:48 2025 -0300 drm: amdgpu: Use struct drm_wedge_task_info inside of struct amdgpu_task_info To avoid a cast when calling drm_dev_wedged_event(), replace pid and task name inside of struct amdgpu_task_info with struct drm_wedge_task_info. Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250617124949.2151549-6-andrealmeid@igalia.com Signed-off-by: André Almeida commit cd37124b40934377d7ccdcc1bb22c8a880b516db Author: André Almeida Date: Tue Jun 17 09:49:47 2025 -0300 drm/doc: Add a section about "Task information" for the wedge API Add a section about "Task information" for the wedge API. Reviewed-by: Krzysztof Karas Reviewed-by: Raag Jadav Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250617124949.2151549-5-andrealmeid@igalia.com Signed-off-by: André Almeida commit 183bccafa176f4519a15ec5c35a47495cbea658c Author: André Almeida Date: Tue Jun 17 09:49:46 2025 -0300 drm: Create a task info option for wedge events When a device get wedged, it might be caused by a guilty application. For userspace, knowing which task was involved can be useful for some situations, like for implementing a policy, logs or for giving a chance for the compositor to let the user know what task was involved in the problem. This is an optional argument, when the task info is not available, the PID and TASK string won't appear in the event string. Sometimes just the PID isn't enough giving that the task might be already dead by the time userspace will try to check what was this PID's name, so to make the life easier also notify what's the task's name in the user event. Acked-by: Rodrigo Vivi Reviewed-by: Krzysztof Karas Reviewed-by: Raag Jadav Acked-by: Christian König Link: https://lore.kernel.org/r/20250617124949.2151549-4-andrealmeid@igalia.com Signed-off-by: André Almeida commit 3bfd1af74a7fc239ab05bc780e2f455c37fe6219 Author: André Almeida Date: Tue Jun 17 09:49:45 2025 -0300 drm: amdgpu: Create amdgpu_vm_print_task_info() To avoid repetitive code in amdgpu, create a function that prints the content of struct amdgpu_task_info. Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250617124949.2151549-3-andrealmeid@igalia.com Signed-off-by: André Almeida commit 2a4f069d0f25e3c3beab98a6eca27f07aa85e135 Author: André Almeida Date: Tue Jun 17 09:49:44 2025 -0300 drm: amdgpu: Allow NULL pointers at amdgpu_vm_put_task_info() Allow NULL pointers at amdgpu_vm_put_task_info() as it common practice for "put" or "free" functions. This avoid an extra check for NULL for callers. Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250617124949.2151549-2-andrealmeid@igalia.com Signed-off-by: André Almeida commit 49b1c8df672a2a6229798e4f4088ce90ed44a103 Author: Maulik Shah Date: Wed Jun 11 11:33:47 2025 +0530 arm64: dts: qcom: Add QMP handle for qcom_stats Add QMP handle which is used to send QMP command to always on processor to populate DDR stats. Add QMP handle for SM8450/SM8550/SM8650/SM8750. Reviewed-by: Dmitry Baryshkov Signed-off-by: Maulik Shah Link: https://lore.kernel.org/r/20250611-ddr_stats_-v5-3-24b16dd67c9c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit e265de1f4815c05803e02fed20a093114e418c46 Author: Maulik Shah Date: Wed Jun 11 11:33:46 2025 +0530 soc: qcom: qcom_stats: Add QMP support for syncing ddr stats Recent SoCs (SM8450 onwards) require QMP command to be sent before reading ddr stats. The duration field of ddr stats will get populated only if QMP command is sent. Add support to send ddr stats freqsync QMP command. Signed-off-by: Maulik Shah Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250611-ddr_stats_-v5-2-24b16dd67c9c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 33301e5b2aeccb1208ddb2d1cc93c9c6c520a0b6 Author: Maulik Shah Date: Wed Jun 11 11:33:45 2025 +0530 soc: qcom: qcom_stats: Add support to read DDR statistic DDR statistic provide different DDR LPM and DDR frequency statistic. Add support to read from MSGRAM and display via debugfs. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Maulik Shah Link: https://lore.kernel.org/r/20250611-ddr_stats_-v5-1-24b16dd67c9c@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit d5a6183a918cb1f2e442ab9fe68e9fbe0bd2ba3a Author: Vladimir Zapolskiy Date: Fri May 23 12:23:13 2025 +0300 arm64: dts: qcom: qrb5165-rb5-vision-mezzanine: remove camcc status property After a change enabling camera clock controller for all Qualcomm SM8250 boards the explicit control of the clock controller status can be removed from the RB5 vision mezzanine dts overlay file. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250523092313.2625421-2-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit 40afa658914eaf7042ce275269336d9d698a739b Author: Vladimir Zapolskiy Date: Fri May 23 12:23:12 2025 +0300 arm64: dts: qcom: sm8250: enable camcc clock controller by default Enable camera clock controller on all Qualcomm SM8250 derived boards by default due to the established agreement of having all clock controllers enabled. Signed-off-by: Vladimir Zapolskiy Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250523092313.2625421-1-vladimir.zapolskiy@linaro.org Signed-off-by: Bjorn Andersson commit 170e4e3944aa39accf64d869b27c187f8c08abc7 Author: Yajun Deng Date: Fri Jun 13 21:19:03 2025 +0800 net: phy: Add c45_phy_ids sysfs directory entry The phy_id field only shows the PHY ID of the C22 device, and the C45 device did not store its PHY ID in this field. Add a new phy_mmd_group, and export the mmd_device_id for the C45 device. These files are invisible to the C22 device. Signed-off-by: Yajun Deng Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250613131903.2961-1-yajun.deng@linux.dev Signed-off-by: Paolo Abeni commit 9149a6328897acf718e68684ff432f03b40ba61a Merge: dd4a5780f7d959 a7d45bcfde3ce8 Author: Paolo Abeni Date: Tue Jun 17 14:58:47 2025 +0200 Merge branch 'intel-next-queue-1GbE' Tony Nguyen says: ==================== Faizal Rahim says: MAC Merge support for frame preemption was previously added for igc: https://lore.kernel.org/netdev/20250418163822.3519810-1-anthony.l.nguyen@intel.com/ This series builds on that work and adds support for: - Harmonizing taprio and mqprio queue priority behavior, based on past discussions and suggestions: https://lore.kernel.org/all/20250214102206.25dqgut5tbak2rkz@skbuf/ - Enabling preemptible queue support for both taprio and mqprio, with priority harmonization as a prerequisite. Patch organization: - Patches 1-3: Preparation work for patches 6 and 7 - Patches 4-5: Queue priority harmonization - Patches 6-7: Add preemptible queue support ==================== Link: https://patch.msgid.link/20250611180314.2059166-1-anthony.l.nguyen@intel.com Signed-off-by: Paolo Abeni commit f6588dea0ab2873760b87b3ffbd02316e7826ee0 Author: Lijuan Gao Date: Thu Jun 12 10:39:32 2025 +0800 dt-bindings: remoteproc: qcom,sa8775p-pas: Correct the interrupt number Correct the interrupt number of ready and handover in the DTS example. Fixes: af5da7b0944c ("dt-bindings: remoteproc: qcom,sa8775p-pas: Document the SA8775p ADSP, CDSP and GPDSP") Signed-off-by: Lijuan Gao Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250612-correct_interrupt_for_remoteproc-v1-1-490ee6d92a1b@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit b0dc512ab7ba177442cfec4a65b2681355d7cb64 Author: Thomas Weißschuh Date: Wed Jun 11 12:03:06 2025 +0200 remoteproc: Don't use %pK through printk In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. There are still a few users of %pK left, but these use it through seq_file, for which its usage is safe. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250611-restricted-pointers-remoteproc-v1-1-f059097ba663@linutronix.de Signed-off-by: Bjorn Andersson commit 3e1c01d06e1f52f78fe00ef26a9cf80dbb0a3115 Author: Dave Stevenson Date: Mon Jun 16 17:40:07 2025 +0200 regulator: rpi-panel-v2: Add shutdown hook Add shutdown hook so that the panel gets powered off with the system. Signed-off-by: Dave Stevenson Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20250616154018.430004-1-marek.vasut+renesas@mailbox.org Signed-off-by: Mark Brown commit d9f38d9824bfb1b046d2e720349d2f45959ab184 Author: Chen Ni Date: Tue Jun 17 11:21:03 2025 +0800 ASoC: tegra: AHUB: Remove unneeded semicolon Remove unnecessary semicolons reported by Coccinelle/coccicheck and the semantic patch at scripts/coccinelle/misc/semicolon.cocci. Signed-off-by: Chen Ni Link: https://patch.msgid.link/20250617032103.1725040-1-nichen@iscas.ac.cn Signed-off-by: Mark Brown commit 951ea2f4844c22833f8c3201103c7ed817e7e377 Author: Lorenzo Stoakes Date: Mon Jun 16 20:33:27 2025 +0100 fs: convert simple use of generic_file_*_mmap() to .mmap_prepare() Since commit c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"), the f_op->mmap() hook has been deprecated in favour of f_op->mmap_prepare(). We have provided generic .mmap_prepare() equivalents, so update all file systems that specify these directly in their file_operations structures. This updates 9p, adfs, affs, bfs, fat, hfs, hfsplus, hostfs, hpfs, jffs2, jfs, minix, omfs, ramfs and ufs file systems directly. It updates generic_ro_fops which impacts qnx4, cramfs, befs, squashfs, frebxfs, qnx6, efs, romfs, erofs and isofs file systems. There are remaining file systems which use generic hooks in a less direct way which we address in a subsequent commit. Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/c7dc90e44a9e75e750939ea369290d6e441a18e6.1750099179.git.lorenzo.stoakes@oracle.com Reviewed-by: Jan Kara Reviewed-by: Viacheslav Dubeyko Signed-off-by: Christian Brauner commit 5b44297bcfa49ee197cdb8ca6164bef120c4e73c Author: Lorenzo Stoakes Date: Mon Jun 16 20:33:26 2025 +0100 mm/filemap: introduce generic_file_*_mmap_prepare() helpers Since commit c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"), the f_op->mmap() hook has been deprecated in favour of f_op->mmap_prepare(). The generic mmap handlers are very simple, so we can very easily convert these in advance of converting file systems which use them. This patch does so. Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/30622c1f0b98c66840bc8c02668bda276a810b70.1750099179.git.lorenzo.stoakes@oracle.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 6528d29b46d8835f0e7b8b66d052ffbaaf7d5d2d Author: Lorenzo Stoakes Date: Mon Jun 16 20:33:25 2025 +0100 fs/xfs: transition from deprecated .mmap hook to .mmap_prepare Since commit c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"), the f_op->mmap() hook has been deprecated in favour of f_op->mmap_prepare(). This callback is invoked in the mmap() logic far earlier, so error handling can be performed more safely without complicated and bug-prone state unwinding required should an error arise. This hook also avoids passing a pointer to a not-yet-correctly-established VMA avoiding any issues with referencing this data structure. It rather provides a pointer to the new struct vm_area_desc descriptor type which contains all required state and allows easy setting of required parameters without any consideration needing to be paid to locking or reference counts. Note that nested filesystems like overlayfs are compatible with an .mmap_prepare() callback since commit bb666b7c2707 ("mm: add mmap_prepare() compatibility layer for nested file systems"). Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/cba8b29ba5f225df8f63f50182d5f6e0fcf94456.1750099179.git.lorenzo.stoakes@oracle.com Signed-off-by: Christian Brauner commit 8c90ae8fe5e34a27c500abdff76111c24c321871 Author: Lorenzo Stoakes Date: Mon Jun 16 20:33:24 2025 +0100 fs/ext4: transition from deprecated .mmap hook to .mmap_prepare Since commit c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"), the f_op->mmap() hook has been deprecated in favour of f_op->mmap_prepare(). This callback is invoked in the mmap() logic far earlier, so error handling can be performed more safely without complicated and bug-prone state unwinding required should an error arise. This hook also avoids passing a pointer to a not-yet-correctly-established VMA avoiding any issues with referencing this data structure. It rather provides a pointer to the new struct vm_area_desc descriptor type which contains all required state and allows easy setting of required parameters without any consideration needing to be paid to locking or reference counts. Note that nested filesystems like overlayfs are compatible with an .mmap_prepare() callback since commit bb666b7c2707 ("mm: add mmap_prepare() compatibility layer for nested file systems"). Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/5abfe526032a6698fd1bcd074a74165cda7ea57c.1750099179.git.lorenzo.stoakes@oracle.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 0335f6afd3488d1101f3b15014095fa51b978253 Author: Lorenzo Stoakes Date: Mon Jun 16 20:33:23 2025 +0100 fs/dax: make it possible to check dev dax support without a VMA This is a prerequisite for adapting those filesystems to use the .mmap_prepare() hook for mmap()'ing which invoke this check as this hook does not have access to a VMA pointer. To effect this, change the signature of daxdev_mapping_supported() and update its callers (ext4 and xfs mmap()'ing hook code). Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/b09de1e8544384074165d92d048e80058d971286.1750099179.git.lorenzo.stoakes@oracle.com Signed-off-by: Christian Brauner commit b013ed403197f3f8c30ddb3ce66fe05a632b3493 Author: Lorenzo Stoakes Date: Mon Jun 16 20:33:22 2025 +0100 fs: consistently use can_mmap_file() helper Since commit c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"), the f_op->mmap() hook has been deprecated in favour of f_op->mmap_prepare(). Additionally, commit bb666b7c2707 ("mm: add mmap_prepare() compatibility layer for nested file systems") permits the use of the .mmap_prepare() hook even in nested filesystems like overlayfs. There are a number of places where we check only for f_op->mmap - this is incorrect now mmap_prepare exists, so update all of these to use the general helper can_mmap_file(). Most notably, this updates the elf logic to allow for the ability to execute binaries on filesystems which have the .mmap_prepare hook, but additionally we update nested filesystems. Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/b68145b609532e62bab603dd9686faa6562046ec.1750099179.git.lorenzo.stoakes@oracle.com Acked-by: Kees Cook Signed-off-by: Christian Brauner commit 20ca8be9ad2e05015833b07f4325a398e614cf15 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:19 2025 +0200 serial: 8250_omap: use uart_port pointer when available There are unnecessary "up->port." accesses on many places in 8250_omap. "port" is avalable on most places, so instead simply use "port->". And make port available in omap8250_restore_regs() too. It's used on many places in there. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250611100319.186924-34-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0a6fb2dc930ab396ece99ef5add46b4d75df4dbf Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:18 2025 +0200 serial: 8250: use hashtable Instead of open-coding the hash table, use the one provided by hashtable.h. The semantics is the same, except the code needs not to compute the hash bucket on its own. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250611100319.186924-33-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 6529c88f6bfedaa5bc2354eb448771d884798877 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:17 2025 +0200 serial: 8250: invert condition to avoid a goto label Use of "goto" in this code is frowned upon: +------- |if (port->type == PORT_UNKNOWN) | goto out_unlock; |CODE; |out_unlock: +------- Instead, simply do: +------- |if (port->type != PORT_UNKNOWN) | CODE; +------- Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250611100319.186924-32-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 05b537a175442c530593013ea31b3f48d5624916 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:16 2025 +0200 serial: 8250: invert serial8250_register_8250_port() CIR condition There is no point in a long 'if' in serial8250_register_8250_port() to just return ENOSPC for PORT_8250_CIR ports. Invert the condition and return immediately. 'gpios' variable was moved to its set location. And return ENODEV instead of ENOSPC. The latter is a leftover from the previous find-uart 'if'. The former makes a lot more sense in this case. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-31-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 15c9dc7353efd86346c692d049e4ca3b228358b8 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:15 2025 +0200 serial: 8250: drop DEBUG_AUTOCONF() macro DEBUG_AUTOCONF() is always disabled (by "#if 0"), so one would need to recompile the kernel to use it. And even if they did, they would find out it is broken anyway: error: variable 'scratch' is used uninitialized whenever 'if' condition is false Drop it. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-30-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8a48517be155e9d75877043f3669dd8d3c051a07 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:14 2025 +0200 serial: 8250: remove debug prints from ISR These are useless, we have tracing nowadays. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-29-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 99fc860fae83156f5687770149435c84ac1deeab Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:13 2025 +0200 serial: 8250: extract serial_get_or_create_irq_info() This find-or-create-irq part of the serial_link_irq_chain()'s code is logically bounded and self-standing. For easier-to-follow code flow, extract the code to a separate function: serial_get_or_create_irq_info(). This allows for an easier found-an-irq handling -- simple jump to the 'unlock' label and return. That results in one less 'if' levels. Note when using guard()s in the upcoming patchset, the label can dropped altogether. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-28-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 465fd2fc9494836f0e0df1f07d69ab0047b780cb Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:12 2025 +0200 serial: 8250: drop unused frac from serial8250_do_get_divisor() 'frac' is not used in the generic implementation of get_divisor. Drop it from there. (Only some port->get_divisor() compute that and receive it then to port->set_divisor()). Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-27-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 590559339ff8c39fda8bf6931db73b21ca44e309 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:11 2025 +0200 serial: 8250: lcr compute cleanup * use 'lcr' as variable containing the "computed value" (and not 'cval') * use 'u8' for the type (and not 'unsigned char') * drop useless comment Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-26-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit cdc4a3e0b23589f55b4caf7c42102c2a2b18545b Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:10 2025 +0200 serial: 8250: extract serial8250_set_fcr() serial8250_do_set_termios() consists of many registers and up flags settings. Extract all these into separate functions. This time, setting of FCR. serial8250_do_set_termios() looks sane at this point. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-25-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit c5d43d65522fa15db7790c62a5a739470068e92f Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:09 2025 +0200 serial: 8250: extract serial8250_set_efr() serial8250_do_set_termios() consists of many registers and up flags settings. Extract all these into separate functions. This time, setting of EFR for UART_CAP_EFR ports. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250611100319.186924-24-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit b3be870161d6b1b621770aebf7b412b6aab00d6f Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:08 2025 +0200 serial: 8250: extract serial8250_set_ier() serial8250_do_set_termios() consists of many registers and up flags settings. Extract all these into separate functions. This time, setting of IER. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-23-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 555ce50f8f75e7861de293ce9a78106311ddaed3 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:07 2025 +0200 serial: 8250: extract serial8250_set_errors_and_ignores serial8250_do_set_termios() consists of many registers and up flags settings. Extract all these into separate functions. This time, setting of ignore_status_mask and read_status_mask. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250611100319.186924-22-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 3b3d253b656c1e8173f497a3d0bc08a70d6a8813 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:06 2025 +0200 serial: 8250: extract serial8250_set_afe() serial8250_do_set_termios() consists of many registers and up flags settings. Extract all these into separate functions. This time, setting of MCR for UART_CAP_AFE ports. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-21-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit cc7c9cbef4e6e7e366c30898384e5fb3e52f0722 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:05 2025 +0200 serial: 8250: extract serial8250_set_trigger_for_slow_speed() serial8250_do_set_termios() consists of many registers and up flags settings. Extract all these into separate functions. This time, setting of trigger level for slow speeds. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-20-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 0fa5aa0b59b3f1825e3e66de9c8e87f6214a93a8 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:04 2025 +0200 serial: 8250: extract serial8250_set_mini() serial8250_do_set_termios() consists of many registers and up flags settings. Extract all these into separate functions. This time, setting of CSIZE for UART_CAP_MINI ports. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-19-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit aa05931abcfbce651eac6fe68d39c3c60a4da3a4 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:03 2025 +0200 serial: 8250: extract serial8250_clear_interrupts() On three places in 8250_port.c, the interrupts are cleared by reading 4 registers. Extract this to a separate function: serial8250_clear_interrupts(). And call it from all the places. Note autoconfig_irq() now uses serial_port_in() instead of serial_in(). But they are the same, in fact (modulo parameter). Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-18-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 795158691cc02488264a59398fc6d8ce930d60ac Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:02 2025 +0200 serial: 8250: extract serial8250_initialize() serial8250_do_startup() initializes the ports in the middle of the function. This code can be separated to serial8250_initialize(), so that serial8250_do_startup() can be readable again. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250611100319.186924-17-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit a194597c0cd35a7e8fc6386a717b56a653e3e0a0 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:01 2025 +0200 serial: 8250: extract serial8250_THRE_test() serial8250_do_startup() contains a stand-alone code for probing THRE. Furthermore, the code block is conditional (port->irq and test for UPF_NO_THRE_TEST). Move this code to a separate function. The conditional can be evaluated easier there -- by a simple return in the beginning. So the indentation level lowers and the code is overall more readable now. Signed-off-by: "Jiri Slaby (SUSE)" Link: https://lore.kernel.org/r/20250611100319.186924-16-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit cc852682f255664ff526630c438d929adc929543 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:03:00 2025 +0200 serial: 8250: extract serial8250_set_TRG_levels() serial8250_do_startup() contains peculiar trigger levels setup for special ports (16850, ALTR_16550_*). Move this away to a separate function: serial8250_set_TRG_levels(). And use switch-case instead of 'if's. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-15-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 75f8abe8bee53a271dd4a93079bd8a9d90912253 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:59 2025 +0200 serial: 8250: extract serial8250_startup_special() Let the serial8250_do_startup() code handle the special ports (16C950, DA830, RSA) startup in a separate function: serial8250_startup_special(). And instead of multiple if-else-if, use switch-case. So that it can be easily checked for PORT_RSA now too. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-14-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 5a128fb475fbc9cd4e4d0267eed363c100024e2c Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:58 2025 +0200 serial: 8250: move RSA functions to 8250_rsa.c They are RSA-specific, so should live in a preexisting 8250_rsa.c. Move them there. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-13-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8725679fc4f146ca4eae3f00afcb839ad17bde95 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:57 2025 +0200 serial: 8250: put RSA functions to their namespace Prefix the functions with rsa_, not suffix. This is a preparation for moving them out to 8250_rsa.c in the next patch. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-12-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit a1efa7f624e6f119aea83dd3b249041c13087d51 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:56 2025 +0200 serial: 8250: invert conditions in RSA functions The code can short-return in case something does not hold. So invert the conditions and return in those cases immediately. This makes the code flow more natural and less nested. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-11-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 33d9ca5daa70b7f3d1f2f731ce56768bc07abf24 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:55 2025 +0200 serial: 8250: remove CONFIG_SERIAL_8250_RSA inline macros from code All these: #ifdef CONFIG_SERIAL_8250_RSA ... #endif in the 8250 generic code distract the reader. Introduce empty inlines to handle the !CONFIG_SERIAL_8250_RSA case and handle the '#if's around the RSA functions definitions. This means rsa_autoconfig() and rsa_reset() functions were introduced to contain the particular code. Signed-off-by: "Jiri Slaby (SUSE)" Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-10-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit fc9ceb501e38cc21066c1638993500b30eda8bdb Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:54 2025 +0200 serial: 8250: sanitize uart_port::serial_{in,out}() types uart_port::{serial_in,serial_out} (and plat_serial8250_port::* likewise) historically use: * 'unsigned int' for 32-bit register values in reads and writes, and * 'int' for offsets. Make them sane such that: * 'u32' is used for register values, and * 'unsigned int' is used for offsets. While at it, name hooks' parameters, so it is clear what is what. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: Ilpo Järvinen Cc: Andy Shevchenko Cc: Paul Cercueil Cc: Vladimir Zapolskiy Cc: Kunihiko Hayashi Cc: Masami Hiramatsu Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250611100319.186924-9-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit f1180ca37abe3d117e4a19be12142fe722612a7c Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:53 2025 +0200 tty: vt: use _IO() to define ioctl numbers _IO*() is the proper way of defining ioctl numbers. All these vt numbers were synthetically built up the same way the _IO() macro does. So instead of implicit hex numbers, use _IO() properly. To not change the pre-existing numbers, use only _IO() (and not _IOR() or _IOW()). The latter would change the numbers indeed. Objdump of vt_ioctl.o reveals no difference with this patch. Again, VT_GETCONSIZECSRPOS already uses _IOR(), so everything is paved for this patch. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Nicolas Pitre Reviewed-by: Nicolas Pitre Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-8-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 866380bcf10c810c1c7097641170d53bbe5239ce Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:52 2025 +0200 tty: vt: use sane types for userspace API As discussed earlier (see the Link below), use the preferred ioctl types in vt.h (__u8, __u16, ...). These types are already used for the new VT_GETCONSIZECSRPOS. Therefore, the necessary includes are already present. Since now, the types are used for every structure defined in the header now. Note the kernel is built with -funsigned-char, therefore 'char' becomes '__u8' in here. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Nicolas Pitre Link: https://lore.kernel.org/all/p7p83sq1-4ro2-o924-s9o2-30spr74n076o@syhkavp.arg/ Reviewed-by: Nicolas Pitre Link: https://lore.kernel.org/r/20250611100319.186924-7-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 8d4207f4129395f8e1f13cd8671eec0900274640 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:51 2025 +0200 powerpc/powermac: remove unneeded tty includes All these includes must have been cut & pasted. The code does not use any tty or vt functionality at all. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: linuxppc-dev@lists.ozlabs.org Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-6-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 158647d94c3de50415c611927724912efb17a277 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:50 2025 +0200 m68k: remove unneeded tty includes All these includes must have been cut & pasted. The code does not use any tty or vt functionality at all. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Geert Uytterhoeven Cc: Joshua Thompson Cc: linux-m68k@lists.linux-m68k.org Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-5-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 33bc4874e97d219c0305ff54c8026b0859a0fe0e Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:49 2025 +0200 powerpc/legacy_serial: use %pa for phys_addr_t prints It makes the code easier to read as casts are not needed. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Link: https://lore.kernel.org/r/20250611100319.186924-4-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2c35a83b11123591fecd792744834082d037bd4f Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:48 2025 +0200 powerpc/legacy_serial: cache serial port and info in add_legacy_port() Caching the port and info in local variables makes the code more compact and easier to understand. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Madhavan Srinivasan Cc: Michael Ellerman Cc: Nicholas Piggin Cc: Christophe Leroy Cc: linuxppc-dev@lists.ozlabs.org Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-3-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit 2b5eac0f8c6e79bc152c8804f9f88d16717013ab Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:02:47 2025 +0200 tty: introduce and use tty_port_tty_vhangup() helper This code (tty_get -> vhangup -> tty_put) is repeated on few places. Introduce a helper similar to tty_port_tty_hangup() (asynchronous) to handle even vhangup (synchronous). And use it on those places. In fact, reuse the tty_port_tty_hangup()'s code and call tty_vhangup() depending on a new bool parameter. Signed-off-by: "Jiri Slaby (SUSE)" Cc: Karsten Keil Cc: David Lin Cc: Johan Hovold Cc: Alex Elder Cc: Oliver Neukum Cc: Marcel Holtmann Cc: Johan Hedberg Cc: Luiz Augusto von Dentz Reviewed-by: Ilpo Järvinen Link: https://lore.kernel.org/r/20250611100319.186924-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman commit c6900f227f892b36f9c820e60953fe01a4c1b6fa Author: Lorenzo Stoakes Date: Mon Jun 16 20:33:21 2025 +0100 mm/nommu: use file_has_valid_mmap_hooks() helper Since commit c84bf6dd2b83 ("mm: introduce new .mmap_prepare() file callback"), the f_op->mmap() hook has been deprecated in favour of f_op->mmap_prepare(). Therefore, update the check for file operations supporting mmap() by using the file_has_valid_mmap_hooks() helper function, which checks for either f_op->mmap or f_op->mmap_prepare rather than checking only for f_op->mmap directly. Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/5f120b644b5890d1b50202d0f0d4c9f0d6b62873.1750099179.git.lorenzo.stoakes@oracle.com Reviewed-by: Jan Kara Signed-off-by: Christian Brauner commit 20ca475d9860e14cf389f5a7d5ba9c6437d74613 Author: Lorenzo Stoakes Date: Mon Jun 16 20:33:20 2025 +0100 mm: rename call_mmap/mmap_prepare to vfs_mmap/mmap_prepare The call_mmap() function violates the existing convention in include/linux/fs.h whereby invocations of virtual file system hooks is performed by functions prefixed with vfs_xxx(). Correct this by renaming call_mmap() to vfs_mmap(). This also avoids confusion as to the fact that f_op->mmap_prepare may be invoked here. Also rename __call_mmap_prepare() function to vfs_mmap_prepare() and adjust to accept a file parameter, this is useful later for nested file systems. Finally, fix up the VMA userland tests and ensure the mmap_prepare -> mmap shim is implemented there. Signed-off-by: Lorenzo Stoakes Link: https://lore.kernel.org/8d389f4994fa736aa8f9172bef8533c10a9e9011.1750099179.git.lorenzo.stoakes@oracle.com Signed-off-by: Christian Brauner commit dd4a5780f7d95989eaef3486162c1acb4d03d868 Author: Wei Fang Date: Fri Jun 13 17:36:05 2025 +0800 net: enetc: replace PCVLANR1/2 with SICVLANR1/2 and remove dead branch Both PF and VF have rx-vlan-offload enabled, however, the PCVLANR1/2 registers are resources controlled by PF, so VF cannot access these two registers. Fortunately, the hardware provides SICVLANR1/2 registers for each SI to reflect the value of PCVLANR1/2 registers. Therefore, use SICVLANR1/2 instead of PCVLANR1/2. Note that this is not an issue in actual use, because the current driver does not support custom TPID, the driver will not access these two registers in actual use, so this modification is just an optimization. In addition, since ENETC_RXBD_FLAG_TPID is defined as GENMASK(1, 0), the possible values are only 0, 1, 2, 3, so the default branch will never be true, so remove the default branch. Signed-off-by: Wei Fang Link: https://patch.msgid.link/20250613093605.39277-1-wei.fang@nxp.com Signed-off-by: Paolo Abeni commit 571c1ea91a73db56bd94054fabecd0f070dc90db Author: John Ogness Date: Fri Jun 6 21:01:49 2025 +0206 printk: nbcon: Allow reacquire during panic If a console printer is interrupted during panic, it will never be able to reacquire ownership in order to perform and cleanup. That in itself is not a problem, since the non-panic CPU will simply quiesce in an endless loop within nbcon_reacquire_nobuf(). However, in this state, platforms that do not support a true NMI to interrupt the quiesced CPU will not be able to shutdown that CPU from within panic(). This then causes problems for such as being unable to load and run a kdump kernel. Fix this by allowing non-panic CPUs to reacquire ownership using a direct acquire. Then the non-panic CPUs can successfullyl exit the nbcon_reacquire_nobuf() loop and the console driver can perform any necessary cleanup. But more importantly, the CPU is no longer quiesced and is free to process any interrupts necessary for panic() to shutdown the CPU. All other forms of acquire are still not allowed for non-panic CPUs since it is safer to have them avoid gaining console ownership that is not strictly necessary. Reported-by: Michael Kelley Closes: https://lore.kernel.org/r/SN6PR02MB4157A4C5E8CB219A75263A17D46DA@SN6PR02MB4157.namprd02.prod.outlook.com Signed-off-by: John Ogness Reviewed-by: Petr Mladek Tested-by: Michael Kelley Link: https://patch.msgid.link/20250606185549.900611-1-john.ogness@linutronix.de Signed-off-by: Petr Mladek commit 5660ee54e7982f9097ddc684e90f15bdcc7fef4b Author: Vlastimil Babka Date: Mon Jun 2 13:02:13 2025 +0200 mm, slab: use frozen pages for large kmalloc Since slab pages are now frozen, it makes sense to have large kmalloc() objects behave same as small kmalloc(), as the choice between the two is an implementation detail depending on allocation size. Notably, increasing refcount on a slab page containing kmalloc() object is not possible anymore, so it should be consistent for large kmalloc pages. Therefore, change large kmalloc to use the frozen pages API. Because of some unexpected fallout in the slab pages case (see commit b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page"), implement the same kind of checks and warnings as part of this change. Notably, networking code using sendpage_ok() to determine whether the page refcount can be manipulated in the network stack should continue behaving correctly. Before this change, the function returns true for large kmalloc pages and page refcount can be manipulated. After this change, the function will return false. Acked-by: Roman Gushchin Acked-by: Harry Yoo Signed-off-by: Vlastimil Babka commit e2d18cbf178775ad377ad88ee55e6e183c38d262 Author: Vlastimil Babka Date: Mon Jun 2 13:02:12 2025 +0200 mm, slab: restore NUMA policy support for large kmalloc The slab allocator observes the task's NUMA policy in various places such as allocating slab pages. Large kmalloc() allocations used to do that too, until an unintended change by c4cab557521a ("mm/slab_common: cleanup kmalloc_large()") resulted in ignoring mempolicy and just preferring the local node. Restore the NUMA policy support. Fixes: c4cab557521a ("mm/slab_common: cleanup kmalloc_large()") Cc: Acked-by: Christoph Lameter (Ampere) Acked-by: Roman Gushchin Reviewed-by: Harry Yoo Signed-off-by: Vlastimil Babka commit f3763403a6bbc3a18379fe4c415bda899a111d55 Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:22 2025 +0200 gpio: palmas: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-12-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit 57065d62e672bce193f186c7b759f928b9a90ca0 Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:21 2025 +0200 gpio: omap: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-11-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit f02614561493da22f24b0e2ec1c2ae0d5b41c68b Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:20 2025 +0200 gpio: octeon: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-10-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit 0e1a8930c941e3a7bea25928b254ece8caa5135d Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:19 2025 +0200 gpio: npcm-sgpio: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-9-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit aaec273c7b511a7826df09123a1fd6e4896c1bfd Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:18 2025 +0200 gpio: nomadik: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-8-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit 88a775454a0fe923f3d34d8f30cd1d6b75be0859 Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:17 2025 +0200 gpio: msc313: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Daniel Palmer Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-7-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit e63d9fbe9f148b44f2fdc211941f2d4485022549 Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:16 2025 +0200 gpio: mpsse: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-6-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit 3aa3628f8168df9fe154b09b1710d3314b9fa4b7 Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:15 2025 +0200 gpio: mpfs: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-5-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit 80d42372d9d87626b55516779e935c012cecdae7 Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:14 2025 +0200 gpio: mpc5200: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-4-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit b454580cf11b45a9da22821543f1455a6a31c5ee Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:13 2025 +0200 gpio: moxtet: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Marek Behún Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-3-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit d27746181905c256eced857f4b2c051ac44b0b45 Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:12 2025 +0200 gpio: mm-lantiq: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-2-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit b908d35d0003cc75d4ebf7c24a61b07d34e7f5dc Author: Bartosz Golaszewski Date: Tue Jun 10 14:33:11 2025 +0200 gpio: mmio: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpio-v1-1-3a9a3c1472ff@linaro.org Signed-off-by: Bartosz Golaszewski commit d03b53c9139352b744ed007bf562bd35517bacff Author: Michal Simek Date: Mon Jun 16 09:43:18 2025 +0200 dt-bindings: gpio: gpio-xilinx: Mark clocks as required property On Microblaze platforms there is no need to handle clocks because the system is starting with clocks enabled (can be described via fixed clock node or clock-frequency property or not described at all). With using soft IPs with SOC platforms there is mandatory to handle clocks as is explained in commit 60dbdc6e08d6 ("dt-bindings: net: emaclite: Add clock support"). That's why make clock as required in dt binding because it is present in both configurations and should be described even there is no way how to handle it on Microblaze systems. There is also need to describe missing axi gpio clock in fpga-region.yaml not to introduce new error when make dt_binding_check runs. Signed-off-by: Michal Simek Reviewed-by: Xu Yilun # fpga Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/94151cfbcff5e4ae05894981c7e398b605d4b00a.1750059796.git.michal.simek@amd.com Signed-off-by: Bartosz Golaszewski commit b29929b819f35503024c6a7e6ad442f6e36c68a0 Author: Rafael J. Wysocki Date: Mon Jun 16 20:16:21 2025 +0200 driver core: Add device_link_test() for testing device link flags To avoid coding mistakes like the one fixed by commit 3860cbe23963 ("PM: sleep: Fix bit masking operation"), introduce device_link_test() for testing device link flags and use it where applicable. No intentional functional impact. Signed-off-by: "Rafael J. Wysocki" Link: https://lore.kernel.org/r/2793309.mvXUDI8C0e@rjwysocki.net Signed-off-by: Greg Kroah-Hartman commit 118f2834b27ffe06a1badcd74fa35bb14cf1d339 Author: Kuan-Wei Chiu Date: Thu May 15 16:11:09 2025 +0800 media: saa7115: Replace open-coded parity calculation with parity8() Refactor parity calculations to use the standard parity8() helper. This change eliminates redundant implementations. Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Signed-off-by: Kuan-Wei Chiu Reviewed-by: Hans Verkuil Signed-off-by: Hans Verkuil commit df698f3d10871a6ca8446d8edb87a89433e4029e Author: Kuan-Wei Chiu Date: Thu May 15 16:09:33 2025 +0800 media: pci: cx18-av-vbi: Replace open-coded parity calculation with parity8() Refactor parity calculations to use the standard parity8() helper. This change eliminates redundant implementations. Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Signed-off-by: Kuan-Wei Chiu Reviewed-by: Hans Verkuil Signed-off-by: Hans Verkuil commit 47e0452b40af6bf821a96e34d95fd5915fe4c7a6 Author: Kuan-Wei Chiu Date: Thu May 15 16:07:48 2025 +0800 media: media/test_drivers: Replace open-coded parity calculation with parity8() Refactor parity calculations to use the standard parity8() helper. This change eliminates redundant implementations. Co-developed-by: Yu-Chun Lin Signed-off-by: Yu-Chun Lin Signed-off-by: Kuan-Wei Chiu Reviewed-by: Hans Verkuil Signed-off-by: Hans Verkuil commit 57b5a302b5d529db96ddc52fbccec005092ebb3d Author: Tomi Valkeinen Date: Tue Oct 29 14:47:05 2024 +0200 media: raspberrypi: cfe: Fix min_reqbufs_allocation The driver checks if "vq->max_num_buffers + *nbuffers < 3", but vq->max_num_buffers is (by default) 32, so the check is never true. Nor does the check make sense. The original code in the BSP kernel was "vq->num_buffers + *nbuffers < 3", but got mangled along the way to upstream. The intention was to make sure that at least 3 buffers are allocated. Fix this by removing the bad lines and setting q->min_reqbufs_allocation to three. Signed-off-by: Tomi Valkeinen Reviewed-by: Hans Verkuil Signed-off-by: Hans Verkuil commit 5211354f2cc081c236dc0c21d04d09c1ccb48b88 Author: Jinjie Ruan Date: Fri Aug 23 17:02:17 2024 +0800 media: xilinx-vipp: Use for_each_child_of_node_scoped() Avoids the need for manual cleanup of_node_put() in early exits from the loop. Signed-off-by: Jinjie Ruan Signed-off-by: Hans Verkuil commit a7569179d3b9b341db28dc6b82f9d6507c66ec2d Author: Jinjie Ruan Date: Fri Aug 23 17:02:16 2024 +0800 media: c8sectpfe: Use for_each_child_of_node_scoped() Avoids the need for manual cleanup of_node_put() in early exits from the loop. Signed-off-by: Jinjie Ruan Signed-off-by: Hans Verkuil commit d2c063388df512b42fd8578768adb1846905e064 Author: Jinjie Ruan Date: Fri Aug 23 17:02:15 2024 +0800 media: samsung: exynos4-is: Use for_each_available_child_of_node_scoped() Avoids the need for manual cleanup of_node_put() in early exits from the loop. Signed-off-by: Jinjie Ruan Signed-off-by: Hans Verkuil commit 377cc006a364dfdab2f3f221cfad63a9265200b8 Author: Dave Stevenson Date: Wed Jun 11 19:37:16 2025 +0100 media: tc358743: Return an appropriate colorspace from tc358743_set_fmt When calling tc358743_set_fmt, the code was calling tc358743_get_fmt to choose a valid format. However that sets the colorspace based on information read back from the chip, not the colour format requested. The result was that if you called try or set format for UYVY when the current format was RGB3 then you would get told SRGB, and try RGB3 when current was UYVY and you would get told SMPTE170M. The value programmed in the VI_REP register for the colorspace is always set by this driver, therefore there is no need to read back the value, and never set to REC709. Return the colorspace based on the format set/tried instead. Signed-off-by: Dave Stevenson Signed-off-by: Hans Verkuil commit 303d81635e1d9c949b370215cc94526ed81f2e3d Author: Dave Stevenson Date: Wed Jun 11 19:37:15 2025 +0100 media: tc358743: Check I2C succeeded during probe The probe for the TC358743 reads the CHIPID register from the device and compares it to the expected value of 0. If the I2C request fails then that also returns 0, so the driver loads thinking that the device is there. Generally I2C communications are reliable so there is limited need to check the return value on every transfer, therefore only amend the one read during probe to check for I2C errors. Signed-off-by: Dave Stevenson Signed-off-by: Hans Verkuil commit 86addd25314a1e77dbdcfddfeed0bab2f27da0e2 Author: Dave Stevenson Date: Wed Jun 11 19:37:14 2025 +0100 media: tc358743: Increase FIFO trigger level to 374 The existing fixed value of 16 worked for UYVY 720P60 over 2 lanes at 594MHz, or UYVY 1080P60 over 4 lanes. (RGB888 1080P60 needs 6 lanes at 594MHz). It doesn't allow for lower resolutions to work as the FIFO underflows. 374 is required for 1080P24 or 1080P30 UYVY over 2 lanes @ 972Mbit/s, but >374 means that the FIFO underflows on 1080P50 UYVY over 2 lanes @ 972Mbit/s. Whilst it would be nice to compute it, the required information isn't published by Toshiba. Signed-off-by: Dave Stevenson Signed-off-by: Hans Verkuil commit d8192cc01a11e40fa18da44c00c25df5c7beac53 Author: Dave Stevenson Date: Wed Jun 11 19:37:13 2025 +0100 media: tc358743: Add support for 972Mbit/s link freq Adds register setups for running the CSI lanes at 972Mbit/s, which allows 1080P50 UYVY down 2 lanes. Signed-off-by: Dave Stevenson Signed-off-by: Hans Verkuil commit fb506e31b3d52f7faaec00352c2732ce31c1f930 Author: Thomas Weißschuh Date: Fri May 30 05:54:38 2025 +0200 sysfs: treewide: switch back to attribute_group::bin_attrs The normal bin_attrs field can now handle const pointers. This makes the _new variant unnecessary. Switch all users back. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250530-sysfs-const-bin_attr-final-v3-4-724bfcf05b99@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit 2fbe82037ab2513275b9d97fe4fd9947df26e960 Author: Thomas Weißschuh Date: Fri May 30 05:54:37 2025 +0200 sysfs: treewide: switch back to bin_attribute::read()/write() The bin_attribute argument of bin_attribute::read() is now const. This makes the _new() callbacks unnecessary. Switch all users back. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250530-sysfs-const-bin_attr-final-v3-3-724bfcf05b99@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit 340d8e66c43f16a51f8fbdb1762e5b40c4e29f8e Author: Thomas Weißschuh Date: Fri May 30 05:54:36 2025 +0200 sysfs: constify internal references to 'struct bin_attribute' The sysfs core handles 'const struct bin_attribute *'. Adapt the internal references. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250530-sysfs-const-bin_attr-final-v3-2-724bfcf05b99@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit 2841ef8d9630fb9735bd219f15f33cd1c70cb0d1 Author: Thomas Weißschuh Date: Fri May 30 05:54:35 2025 +0200 const_structs.checkpatch: add bin_attribute Now that the sysfs core can handle "const struct bin_attribute", make sure that new usages of the struct already enter the tree as const. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250530-sysfs-const-bin_attr-final-v3-1-724bfcf05b99@weissschuh.net Signed-off-by: Greg Kroah-Hartman commit c3021d6a80ff05034dfee494115ec71f1954e311 Author: Dr. David Alan Gilbert Date: Mon Jun 16 01:23:59 2025 +0100 media: v4l2-jpeg: Remove unused v4l2_jpeg_parse_* wrappers The functions: v4l2_jpeg_parse_huffman_tables() v4l2_jpeg_parse_quantization_tables() v4l2_jpeg_parse_scan_header() and v4l2_jpeg_parse_frame_header() were added in 2020 by commit 50733b5b9102 ("media: add v4l2 JPEG helpers") but have remained unused. Remove them. They're all just wrappers around an underlying set of helpers, which are all still called via v4l2_jpeg_parse_header(). Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Hans Verkuil commit 9314891df119442a6ec1518b3d872c330e2bf1a1 Author: Dr. David Alan Gilbert Date: Mon Jun 16 00:58:01 2025 +0100 media: platform: ti: Remove unused vpdma_update_dma_addr vpdma_update_dma_addr() was added in 2016 as part of commit 2f88703a0bfd ("[media] media: ti-vpe: vpdma: Add multi-instance and multi-client support") but has remained unused. Remove it. I did see that there was a VIP driver submitted in 2020 that doesn't seem to have got merged which did use this (and a bunch of other unused functions). Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Hans Verkuil commit 487b12d6d0fc335d6fc4cb71f2358bb0eb0c1271 Author: Dr. David Alan Gilbert Date: Sat Jun 14 21:37:23 2025 +0100 media: amphion: Remove unused functions The functions: vpu_color_get_default() vpu_color_check_full_range() vpu_color_check_primaries() vpu_color_check_transfers() vpu_color_check_matrix() have been unused since 2022's commit 1925665ef403 ("media: amphion: remove redundant check of colorspace in venc_s_fmt") The (empty) function vpu_mbox_enable_rx() has been unused since it was added in 2022 by the commit 61cbf1c1fa6d ("media: amphion: implement vpu core communication based on mailbox") Remove them. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Hans Verkuil commit aa17c036a01654bb863f2f7793d01046ce9eef91 Author: Krzysztof Kozlowski Date: Fri Jun 13 09:15:57 2025 +0200 media: exynos4-is: fimc-is: Fully open-code compatible for grepping It is very useful to find driver implementing compatibles with `git grep compatible`, so driver should not use defines for that string, even if this means string will be effectively duplicated. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Hans Verkuil commit a4950419459ad5acfc4816d8c28fccf62830028c Author: Hans de Goede Date: Mon Jun 9 16:35:57 2025 +0200 MAINTAINERS: .mailmap: Update Hans de Goede's email address I'm moving all my kernel work over to using my kernel.org email address. Update .mailmap and MAINTAINER entries still using hdegoede@redhat.com. Signed-off-by: Hans de Goede Signed-off-by: Hans Verkuil commit 7af160aea26c7dc9e6734d19306128cce156ec40 Author: Gui-Dong Han Date: Fri Jun 6 03:04:59 2025 +0000 media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() In the interrupt handler rain_interrupt(), the buffer full check on rain->buf_len is performed before acquiring rain->buf_lock. This creates a Time-of-Check to Time-of-Use (TOCTOU) race condition, as rain->buf_len is concurrently accessed and modified in the work handler rain_irq_work_handler() under the same lock. Multiple interrupt invocations can race, with each reading buf_len before it becomes full and then proceeding. This can lead to both interrupts attempting to write to the buffer, incrementing buf_len beyond its capacity (DATA_SIZE) and causing a buffer overflow. Fix this bug by moving the spin_lock() to before the buffer full check. This ensures that the check and the subsequent buffer modification are performed atomically, preventing the race condition. An corresponding spin_unlock() is added to the overflow path to correctly release the lock. This possible bug was found by an experimental static analysis tool developed by our team. Fixes: 0f314f6c2e77 ("[media] rainshadow-cec: new RainShadow Tech HDMI CEC driver") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Signed-off-by: Hans Verkuil commit 42a5c1dfaaab6e48b867aa41d9d4d0a5b09b2a70 Author: Martin Tůma Date: Mon Jun 2 11:27:51 2025 +0200 media: mgb4: Enumerate only the available timings Enumerate only the available (as given by the sysfs setup - our "EDID replacement") timings, not all theoretically possible. This is the video outputs part of the previous inputs patch that somehow got "lost in translation". Signed-off-by: Martin Tůma Signed-off-by: Hans Verkuil commit aef89c0b2417da79cb2062a95476288f9f203ab0 Author: Dan Carpenter Date: Wed May 28 23:22:14 2025 +0300 media: gspca: Add bounds checking to firmware parser This sd_init() function reads the firmware. The firmware data holds a series of records and the function reads each record and sends the data to the device. The request_ihex_firmware() function calls ihex_validate_fw() which ensures that the total length of all the records won't read out of bounds of the fw->data[]. However, a potential issue is if there is a single very large record (larger than PAGE_SIZE) and that would result in memory corruption. Generally we trust the firmware, but it's always better to double check. Fixes: 49b61ec9b5af ("[media] gspca: Add new vicam subdriver") Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Signed-off-by: Hans Verkuil commit d8fbfcab95ffab466aba475127ae677a4c7160fb Author: Andy Shevchenko Date: Wed May 28 14:32:04 2025 +0300 media: cx18: Replace custom implementation of list_entry_is_head() Besides list_entry_is_past_end() is the same as list_entry_is_head(), it's implemented in the list namespace. Fix both of the issue by replacing the custom version with list_entry_is_head() calls. Signed-off-by: Andy Shevchenko Signed-off-by: Hans Verkuil commit 1cb109d8863da75c22458b90c43b4e61b994e332 Author: Wolfram Sang Date: Thu May 22 10:09:55 2025 +0200 media: usb: hdpvr: use I2C core to handle only supported messages The HW can only do write-then-read transactions. This is a common limitation, so we can add an adapter quirk flag to let the I2C core enforce the checks instead of open coding them. Signed-off-by: Wolfram Sang Signed-off-by: Hans Verkuil commit b5ae5a79825ba8037b0be3ef677a24de8c063abf Author: Wolfram Sang Date: Thu May 22 10:09:54 2025 +0200 media: usb: hdpvr: disable zero-length read messages This driver passes the length of an i2c_msg directly to usb_control_msg(). If the message is now a read and of length 0, it violates the USB protocol and a warning will be printed. Enable the I2C_AQ_NO_ZERO_LEN_READ quirk for this adapter thus forbidding 0-length read messages altogether. Signed-off-by: Wolfram Sang Signed-off-by: Hans Verkuil commit 75f278ab52c6748d5ea14a0dca46bd007a8b0871 Author: Dr. David Alan Gilbert Date: Fri May 9 02:17:50 2025 +0100 media: saa7164: Remove unused functions saa7164_cmd_signal() last use was removed in 2009 by commit 39e469ab6dee ("V4L/DVB (12940): SAA7164: IRQ / message timeout related change") saa7164_buffer_display() was added in 2010 by commit add3f580a434 ("[media] saa7164: convert buffering structs to be more generic") but is unused. Remove them. Signed-off-by: Dr. David Alan Gilbert Signed-off-by: Hans Verkuil commit 7e40e0bb778907b2441bff68d73c3eb6b6cd319f Author: Ludwig Disterhof Date: Mon Apr 28 20:16:50 2025 +0200 media: usbtv: Lock resolution while streaming When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory. Changing from NTSC to PAL increases the resolution in the usbtv struct, but the video plane buffer isn't adjusted, so it overflows. Fixes: 0e0fe3958fdd13d ("[media] usbtv: Add support for PAL video source") Cc: stable@vger.kernel.org Signed-off-by: Ludwig Disterhof Signed-off-by: Hans Verkuil [hverkuil: call vb2_is_busy instead of vb2_is_streaming] commit 065eb4d262473037ef6f7a409ed8da489bc64c4e Author: Christophe JAILLET Date: Sat Mar 29 15:26:42 2025 +0100 media: flexcop-i2c: Constify struct i2c_algorithm 'struct i2c_algorithm' is not modified in this driver. Constifying this structure moves some data to a read-only section, so increase overall security, especially when the structure holds some function pointers. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 6645 216 16 6877 1add drivers/media/common/b2c2/flexcop-i2c.o After: ===== text data bss dec hex filename 6721 160 16 6897 1af1 drivers/media/common/b2c2/flexcop-i2c.o Signed-off-by: Christophe JAILLET Signed-off-by: Hans Verkuil commit ad7fbb1624e8d1ef7e219cb76ce9d7edcabc68ee Author: Andy Shevchenko Date: Thu Mar 13 13:30:34 2025 +0200 media: v4l2-core: Replace the check for firmware registered I2C devices Replace the check for firmware registered I²C devices as the firmware node independently on type should be retrieved via dev_fwnode(). Signed-off-by: Andy Shevchenko Signed-off-by: Hans Verkuil commit 9e2c1e8cfb8e83f891cdc16220adf162a3d93066 Author: Bartosz Golaszewski Date: Mon Jun 16 09:18:56 2025 +0200 media: i2c: max9286: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Signed-off-by: Hans Verkuil commit 7019a876aeaeffe3853d6d379215c3cc92839f5f Author: Bartosz Golaszewski Date: Mon Jun 16 09:18:55 2025 +0200 media: i2c: max96717: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Signed-off-by: Hans Verkuil commit 94a45a567a2237239f07dc81d03f840e3a6d5d30 Author: Bartosz Golaszewski Date: Mon Jun 16 09:18:54 2025 +0200 media: i2c: ds90ub913: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Signed-off-by: Hans Verkuil commit c4406dc9bc8ccab8c3dd9790fe27b525ab79ae3c Author: Bartosz Golaszewski Date: Mon Jun 16 09:18:53 2025 +0200 media: i2c: ds90ub953: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Signed-off-by: Hans Verkuil commit bb4954b4abf61ae9d0ff230e035f95ea8fb22457 Author: Bartosz Golaszewski Date: Mon Jun 16 09:18:52 2025 +0200 media: solo6x10: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Signed-off-by: Hans Verkuil commit 94bf84c7fe2e6fa17a50c1296551a53fd2a29e37 Author: Bartosz Golaszewski Date: Mon Jun 16 09:18:51 2025 +0200 media: solo6x10: remove unneeded GPIO direction setters GPIO core already handles missing direction_input/output() callbacks. The ones in this driver also effectively return magic numbers which is not optimal either (the number accidentally corresponds with -EPERM which is different from the number GPIOLIB returns and so inconsistent). Just remove them. Signed-off-by: Bartosz Golaszewski Signed-off-by: Hans Verkuil commit 13518ae3203fdbb86d05b9e9916d4907cea518a4 Author: Bartosz Golaszewski Date: Mon Jun 16 09:18:50 2025 +0200 media: dvb-frontends/cxd2820r: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Signed-off-by: Hans Verkuil commit 701aa9ad1e7bfc4c509deeed6557c023c4b875ea Author: Manivannan Sadhasivam Date: Tue Jun 17 12:13:45 2025 +0530 bus: mhi: host: Make local functions static These functions were not used outside of the file defining them. So make them static as they should be. Signed-off-by: Manivannan Sadhasivam Link: https://patch.msgid.link/20250617064906.14079-1-mani@kernel.org commit 755391121038c06cb653241aa94dcabd87179f62 Author: Shradha Gupta Date: Wed Jun 11 07:11:13 2025 -0700 net: mana: Allocate MSI-X vectors dynamically Currently, the MANA driver allocates MSI-X vectors statically based on MANA_MAX_NUM_QUEUES and num_online_cpus() values and in some cases ends up allocating more vectors than it needs. This is because, by this time we do not have a HW channel and do not know how many IRQs should be allocated. To avoid this, we allocate 1 MSI-X vector during the creation of HWC and after getting the value supported by hardware, dynamically add the remaining MSI-X vectors. Signed-off-by: Shradha Gupta Reviewed-by: Haiyang Zhang commit 845c62c543d6bd5d8b80f53835997789e4bb8e29 Author: Shradha Gupta Date: Wed Jun 11 07:10:42 2025 -0700 net: mana: Allow irq_setup() to skip cpus for affinity In order to prepare the MANA driver to allocate the MSI-X IRQs dynamically, we need to enhance irq_setup() to allow skipping affinitizing IRQs to the first CPU sibling group. This would be for cases when the number of IRQs is less than or equal to the number of online CPUs. In such cases for dynamically added IRQs the first CPU sibling group would already be affinitized with HWC IRQ. Signed-off-by: Shradha Gupta Reviewed-by: Haiyang Zhang Reviewed-by: Yury Norov [NVIDIA] commit 4607617af1b4747df0284ea8c1ddcecb21cae528 Author: Yury Norov Date: Wed Jun 11 07:10:29 2025 -0700 net: mana: explain irq_setup() algorithm Commit 91bfe210e196 ("net: mana: add a function to spread IRQs per CPUs") added the irq_setup() function that distributes IRQs on CPUs according to a tricky heuristic. The corresponding commit message explains the heuristic. Duplicate it in the source code to make available for readers without digging git in history. Also, add more detailed explanation about how the heuristics is implemented. Signed-off-by: Yury Norov Signed-off-by: Shradha Gupta commit ad518f2557b971976fc9d99a6a8cd2b453742bf9 Author: Shradha Gupta Date: Wed Jun 11 07:10:15 2025 -0700 PCI: hv: Allow dynamic MSI-X vector allocation Allow dynamic MSI-X vector allocation for pci_hyperv PCI controller by adding support for the flag MSI_FLAG_PCI_MSIX_ALLOC_DYN and using pci_msix_prepare_desc() to prepare the MSI-X descriptors. Feature support added for both x86 and ARM64 Signed-off-by: Shradha Gupta Reviewed-by: Haiyang Zhang Reviewed-by: Saurabh Sengar Acked-by: Bjorn Helgaas commit 5da8a8b8090b5f79a816ba016af3a70a9d7287bf Author: Shradha Gupta Date: Wed Jun 11 07:10:01 2025 -0700 PCI/MSI: Export pci_msix_prepare_desc() for dynamic MSI-X allocations For supporting dynamic MSI-X vector allocation by PCI controllers, enabling the flag MSI_FLAG_PCI_MSIX_ALLOC_DYN is not enough, msix_prepare_msi_desc() to prepare the MSI descriptor is also needed. Export pci_msix_prepare_desc() to allow PCI controllers to support dynamic MSI-X vector allocation. Signed-off-by: Shradha Gupta Reviewed-by: Haiyang Zhang Reviewed-by: Thomas Gleixner Reviewed-by: Saurabh Sengar Acked-by: Bjorn Helgaas commit de266931dd996fc2cb8ee8b5d12e39ea463e3f36 Author: Sven Peter Date: Thu Jun 12 21:11:33 2025 +0000 dmaengine: apple-admac: Drop default ARCH_APPLE in Kconfig When the first driver for Apple Silicon was upstreamed we accidentally included `default ARCH_APPLE` in its Kconfig which then spread to almost every subsequent driver. As soon as ARCH_APPLE is set to y this will pull in many drivers as built-ins which is not what we want. Thus, drop `default ARCH_APPLE` from Kconfig. Signed-off-by: Sven Peter Reviewed-by: Janne Grunau Link: https://lore.kernel.org/r/20250612-apple-kconfig-defconfig-v1-9-0e6f9cb512c1@kernel.org Signed-off-by: Vinod Koul commit db7d07b5add4d839df74adab9940cf9da488313f Author: Inochi Amaoto Date: Wed Jun 11 16:09:59 2025 +0800 dmaengine: add driver for Sophgo CV18XX/SG200X dmamux Sophgo CV18XX/SG200X use DW AXI CORE with a multiplexer for remapping its request lines. The multiplexer supports at most 8 request lines. Add driver for Sophgo CV18XX/SG200X DMA multiplexer. Signed-off-by: Inochi Amaoto Tested-by: Alexander Sverdlin Link: https://lore.kernel.org/r/20250611081000.1187374-3-inochiama@gmail.com Signed-off-by: Vinod Koul commit 994b5709f9f83c48f607e9a52912c912b8149421 Author: Inochi Amaoto Date: Wed Jun 11 16:09:58 2025 +0800 dt-bindings: dmaengine: Add dma multiplexer for CV18XX/SG200X series SoC The DMA IP of Sophgo CV18XX/SG200X is based on a DW AXI CORE, with an additional channel remap register located in the top system control area. The DMA channel is exclusive to each core. In addition, the DMA multiplexer is a subdevice of system controller, so this binding only contains necessary properties for the multiplexer itself. Add the dmamux binding for CV18XX/SG200X series SoC. Signed-off-by: Inochi Amaoto Reviewed-by: Conor Dooley Link: https://lore.kernel.org/r/20250611081000.1187374-2-inochiama@gmail.com Signed-off-by: Vinod Koul commit f0185cd5942569ea9872bf85dce621d0a7fa401e Author: Randy Dunlap Date: Mon Jun 16 20:42:49 2025 -0700 phy: qcom: add linux/bitfield.h header to fix a build error Add the header to prevent a build error: drivers/phy/qualcomm/phy-qcom-m31-eusb2.c: In function 'm31eusb2_phy_init': drivers/phy/qualcomm/phy-qcom-m31-eusb2.c:210:37: error: implicit declaration of function 'FIELD_PREP' [-Wimplicit-function-declaration] 210 | FIELD_PREP(FSEL, data->fsel)); Fixes: 9c8504861cc4 ("phy: qcom: Add M31 based eUSB2 PHY driver") Signed-off-by: Randy Dunlap Cc: Wesley Cheng Cc: Melody Olvera Cc: Vinod Koul Cc: Kishon Vijay Abraham I Cc: linux-phy@lists.infradead.org Cc: linux-arm-msm@vger.kernel.org Link: https://lore.kernel.org/r/20250617034249.2067135-1-rdunlap@infradead.org Signed-off-by: Vinod Koul commit e252e3f3488a49267e08ea7d972ac5ba3f2f1763 Author: Lizhi Hou Date: Mon Jun 16 02:14:16 2025 -0700 accel/amdxdna: Revise device bo creation and free The device bo is allocated from the device heap memory. (a trunk of memory dedicated to device) Rename amdxdna_gem_insert_node_locked to amdxdna_gem_heap_alloc and move related sanity checks into it. Add amdxdna_gem_dev_obj_free and move device bo free code into it. Calculate the kernel virtual address of device bo by the device heap memory address and offset. Reviewed-by: Jacek Lawrynowicz Signed-off-by: Lizhi Hou Link: https://lore.kernel.org/r/20250616091418.2605476-1-lizhi.hou@amd.com commit 47e339cac89143709e84a3b71ba8bd9b2fdd2368 Author: Bjorn Andersson Date: Tue Jun 10 21:58:30 2025 -0500 soc: qcom: mdt_loader: Actually use the e_phoff Rather than relying/assuming that the tools generating the firmware places the program headers immediately following the ELF header, use e_phoff as intended to find the program headers. Reviewed-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250610-mdt-loader-validation-and-fixes-v2-3-f7073e9ab899@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit cd840362b0a7b3da59740c1380b18ce0ccf8c264 Author: Bjorn Andersson Date: Tue Jun 10 21:58:29 2025 -0500 soc: qcom: mdt_loader: Rename mdt_phdr_valid() The function checks if a program header refers to a PT_LOAD segment, that isn't a hash segment (which should be PT_LOAD in the first place), andwith non-zero size. That's not the definition of "valid", but rather if it's "loadable". Rename the function to reflect what it does. Reviewed-by: Dmitry Baryshkov Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250610-mdt-loader-validation-and-fixes-v2-2-f7073e9ab899@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 9f9967fed9d066ed3dae9372b45ffa4f6fccfeef Author: Bjorn Andersson Date: Tue Jun 10 21:58:28 2025 -0500 soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid. Fixes: 2aad40d911ee ("remoteproc: Move qcom_mdt_loader into drivers/soc/qcom") Cc: stable@vger.kernel.org Reported-by: Doug Anderson Signed-off-by: Bjorn Andersson Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250610-mdt-loader-validation-and-fixes-v2-1-f7073e9ab899@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 3b5b1c428260152e47c9584bc176f358b87ca82d Author: Jakub Kicinski Date: Fri Jun 13 10:27:51 2025 -0700 eth: gianfar: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Uniquely, this driver supports only the SET operation. It does not support GET at all. The SET callback also always returns 0, even tho it checks a bunch of conditions, and if my quick reading is right, expects the user to insert filtering rules for given flow type first? Long story short it seems too convoluted to easily add the GET as part of the conversion. Link: https://patch.msgid.link/20250613172751.3754732-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 3bfec3827b045766258927c252bc0c53baefad78 Merge: c1864b2eb202c7 42ed7f7e94da01 Author: Jakub Kicinski Date: Mon Jun 16 18:15:19 2025 -0700 Merge branch 'net-phy-remove-phy_driver_is_genphy-and-phy_driver_is_genphy_10g' Heiner Kallweit says: ==================== net: phy: remove phy_driver_is_genphy and phy_driver_is_genphy_10g Replace phy_driver_is_genphy() and phy_driver_is_genphy_10g() with a new flag in struct phy_device. ==================== Link: https://patch.msgid.link/5778e86e-dd54-4388-b824-6132729ad481@gmail.com Signed-off-by: Jakub Kicinski commit 42ed7f7e94da01391d3519ffb5747698d2be0a67 Author: Heiner Kallweit Date: Sat Jun 14 22:32:47 2025 +0200 net: phy: remove phy_driver_is_genphy_10g Remove now unused function phy_driver_is_genphy_10g(). Signed-off-by: Heiner Kallweit Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/49b0589a-9604-4ee9-add5-28fbbbe2c2f3@gmail.com Signed-off-by: Jakub Kicinski commit 59e74c92e67e2951d829f9b0d78c5dc1df7c4c88 Author: Heiner Kallweit Date: Sat Jun 14 22:31:57 2025 +0200 net: phy: improve phy_driver_is_genphy Use new flag phydev->is_genphy_driven to simplify this function. Note that this includes a minor functional change: Now this function returns true if ANY of the genphy drivers is bound to the PHY device. We have only one user in DSA driver mt7530, and there the functional change doesn't matter. Signed-off-by: Heiner Kallweit Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/c9ac3a7d-262a-425d-9153-97fe3ca6280a@gmail.com Signed-off-by: Jakub Kicinski commit 2796ff1e3dcae7a3568f8e428ec9d32a8ee2fb36 Author: Heiner Kallweit Date: Sat Jun 14 22:30:43 2025 +0200 net: phy: add flag is_genphy_driven to struct phy_device In order to get rid of phy_driver_is_genphy() and phy_driver_is_genphy_10g(), as first step add and use a flag phydev->is_genphy_driven. Signed-off-by: Heiner Kallweit Reviewed-by: Russell King (Oracle) Link: https://patch.msgid.link/3f3ad6dc-402e-4915-8d5a-2306b6d5562b@gmail.com Signed-off-by: Jakub Kicinski commit c1864b2eb202c7bddfb381f4bb3547627967f4f4 Merge: dd610e706f2f08 2c5f2ad1d91943 Author: Jakub Kicinski Date: Mon Jun 16 18:14:54 2025 -0700 Merge branch 'eth-intel-migrate-to-new-rxfh-callbacks' Jakub Kicinski says: ==================== eth: intel: migrate to new RXFH callbacks Migrate Intel drivers to the recently added dedicated .get_rxfh_fields and .set_rxfh_fields ethtool callbacks. Note that I'm deleting all the boilerplate kdoc from the affected functions in the more recent drivers. If the maintainers feel strongly I can respin and add it back, but it really feels useless and undue burden for refactoring. No other vendor does this. v1: https://lore.kernel.org/20250613010111.3548291-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250614180907.4167714-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2c5f2ad1d91943f352f1d48e0709ede52e8bec67 Author: Jakub Kicinski Date: Sat Jun 14 11:09:07 2025 -0700 eth: iavf: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). I'm deleting all the boilerplate kdoc from the affected functions. It is somewhere between pointless and incorrect, just a burden for people refactoring the code. Reviewed-by: Aleksandr Loktionov Reviewed-by: Joe Damato Reviewed-by: Tony Nguyen Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250614180907.4167714-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 1899fce53a78c0a0c7073da4368ad69d9fe76274 Author: Jakub Kicinski Date: Sat Jun 14 11:09:06 2025 -0700 eth: ice: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). I'm deleting all the boilerplate kdoc from the affected functions. It is somewhere between pointless and incorrect, just a burden for people refactoring the code. Reviewed-by: Aleksandr Loktionov Reviewed-by: Joe Damato Reviewed-by: Tony Nguyen Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250614180907.4167714-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5a28983710b739685bc5b72ea05b5843a4a32cc7 Author: Jakub Kicinski Date: Sat Jun 14 11:09:05 2025 -0700 eth: i40e: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). I'm deleting all the boilerplate kdoc from the affected functions. It is somewhere between pointless and incorrect, just a burden for people refactoring the code. Reviewed-by: Aleksandr Loktionov Reviewed-by: Joe Damato Reviewed-by: Tony Nguyen Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250614180907.4167714-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 5bd68c191a828b5653b4be7ec728200215681b31 Author: Jakub Kicinski Date: Sat Jun 14 11:09:04 2025 -0700 eth: fm10k: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). .get callback moves out of the switch and set_rxnfc disappears as ETHTOOL_SRXFH as the only functionality. Reviewed-by: Aleksandr Loktionov Reviewed-by: Joe Damato Reviewed-by: Tony Nguyen Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250614180907.4167714-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit ecb86e1ff4a300db9e23c4a7487fad857cd00606 Author: Jakub Kicinski Date: Sat Jun 14 11:09:03 2025 -0700 eth: ixgbe: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Reviewed-by: Aleksandr Loktionov Reviewed-by: Joe Damato Reviewed-by: Tony Nguyen Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250614180907.4167714-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 575d1b28d2047434469f391195eb10273482740c Author: Jakub Kicinski Date: Sat Jun 14 11:09:02 2025 -0700 eth: igc: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Reviewed-by: Aleksandr Loktionov Reviewed-by: Joe Damato Reviewed-by: Tony Nguyen Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250614180907.4167714-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f148250e357b59398e1033014909a2707b5c3663 Author: Jakub Kicinski Date: Sat Jun 14 11:09:01 2025 -0700 eth: igb: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). Reviewed-by: Aleksandr Loktionov Reviewed-by: Joe Damato Reviewed-by: Tony Nguyen Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20250614180907.4167714-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit dd610e706f2f08e8e2cf59597eda045f3cd1979a Merge: 023ed57ef39b24 9a9f7ce8cb775a Author: Jakub Kicinski Date: Mon Jun 16 18:14:28 2025 -0700 Merge branch 'eth-migrate-to-new-rxfh-callbacks-get-only-drivers' Jakub Kicinski says: ==================== eth: migrate to new RXFH callbacks (get-only drivers) Migrate the drivers which only implement ETHTOOL_GRXFH to the recently added dedicated .get_rxfh_fields ethtool callback. v1: https://lore.kernel.org/20250613005409.3544529-1-kuba@kernel.org ==================== Link: https://patch.msgid.link/20250614180638.4166766-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9a9f7ce8cb775a705e3cbe4fd645374846145499 Author: Jakub Kicinski Date: Sat Jun 14 11:06:38 2025 -0700 eth: enetc: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). This driver's RXFH config is read only / fixed so the conversion is trivial. Reviewed-by: Joe Damato Reviewed-by: Wei Fang Link: https://patch.msgid.link/20250614180638.4166766-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b8379a59b282ed6cc7acf654454e086f49679fea Author: Jakub Kicinski Date: Sat Jun 14 11:06:37 2025 -0700 eth: e1000e: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). This driver's RXFH config is read only / fixed and it's the only get_rxnfc sub-command the driver supports. So convert the get_rxnfc handler into a get_rxfh_fields handler. Reviewed-by: Joe Damato Reviewed-by: Tony Nguyen Link: https://patch.msgid.link/20250614180638.4166766-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit a689e2300e17f1ef6a31ed2f249cb794beee343a Author: Jakub Kicinski Date: Sat Jun 14 11:06:36 2025 -0700 eth: lan743x: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). This driver's RXFH config is read only / fixed so the conversion is purely factoring out the handling into a helper. Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250614180638.4166766-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 8d90593fd53914151b9589c48ff925f246bfe81f Author: Jakub Kicinski Date: Sat Jun 14 11:06:35 2025 -0700 eth: cxgb4: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). This driver's RXFH config is read only / fixed so the conversion is purely factoring out the handling into a helper. Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250614180638.4166766-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit b4512e36ec9e9f66a357eb78a661c1550d14f818 Author: Jakub Kicinski Date: Sat Jun 14 11:06:34 2025 -0700 eth: cisco: migrate to new RXFH callbacks Migrate to new callbacks added by commit 9bb00786fc61 ("net: ethtool: add dedicated callbacks for getting and setting rxfh fields"). This driver's RXFH config is read only / fixed so the conversion is trivial. Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250614180638.4166766-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 81456710391d3e55e623b387f01830a50747fd75 Author: Takashi Sakamoto Date: Tue Jun 17 09:43:20 2025 +0900 firewire: core: minor code refactoring to localize table of gap count The table for gap count is accessed by a single function. In this case, it can be localized to the function. Link: https://lore.kernel.org/r/20250617004320.477421-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 023ed57ef39b24c67ab8bbb5e0e52754e7794552 Merge: b34441e356252d 70f8986ecef136 Author: Jakub Kicinski Date: Mon Jun 16 17:37:54 2025 -0700 Merge branch 'cn20k-silicon-with-mbox-support' Subbaraya Sundeep says: ==================== CN20K silicon with mbox support CN20K is the next generation silicon in the Octeon series with various improvements and new features. Along with other changes the mailbox communication mechanism between RVU (Resource virtualization Unit) SRIOV PFs/VFs with Admin function (AF) has also gone through some changes. Some of those changes are - Separate IRQs for mbox request and response/ack. - Configurable mbox size, default being 64KB. - Ability for VFs to communicate with RVU AF instead of going through parent SRIOV PF. Due to more memory requirement due to configurable mbox size, mbox memory will now have to be allocated by - AF (PF0) for communicating with other PFs and all VFs in the system. - PF for communicating with it's child VFs. On previous silicons mbox memory was reserved and configured by firmware. This patch series add basic mbox support for AF (PF0) <=> PFs and PF <=> VFs. AF <=> VFs communication and variable mbox size support will come in later. Patch #1 Supported co-existance of bit encoding PFs and VFs in 16-bit hardware pcifunc format between CN20K silicon and older octeon series. Also exported PF,VF masks and shifts present in mailbox module to all other modules. Patch #2 Added basic mbox operation APIs and structures to support both CN20K and previous version of silicons. Patch #3 This patch adds support for basic mbox infrastructure implementation for CN20K silicon in AF perspective. There are few updates w.r.t MBOX ACK interrupt and offsets in CN20k. Patch #4 Added mbox implementation between NIC PF and AF for CN20K. Patch #5 Added mbox communication support between AF and AF's VFs. Patch #6 This patch adds support for MBOX communication between NIC PF and its VFs. ==================== Link: https://patch.msgid.link/1749639716-13868-1-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit 70f8986ecef13608a9663318484753a1a138dd4c Author: Sai Krishna Date: Wed Jun 11 16:31:56 2025 +0530 octeontx2-pf: CN20K mbox implementation between PF-VF This patch implements the CN20k MBOX communication between PF and it's VFs. CN20K silicon got extra interrupt of MBOX response for trigger interrupt. Also few of the CSR offsets got changed in CN20K against prior series of silicons. Signed-off-by: Sai Krishna Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Subbaraya Sundeep Link: https://patch.msgid.link/1749639716-13868-7-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit f8909d3dd55440e63a9795d16662e9df9dd77c2d Author: Sai Krishna Date: Wed Jun 11 16:31:55 2025 +0530 octeontx2-af: CN20K mbox implementation for AF's VF This patch implements the CN20k MBOX communication between AF and AF's VFs. This implementation uses separate trigger interrupts for request, response messages against using trigger message data in CN10K. Signed-off-by: Sai Krishna Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Subbaraya Sundeep Link: https://patch.msgid.link/1749639716-13868-6-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit 370c2374bfa985fb8786aa16496b722b654a1198 Author: Sai Krishna Date: Wed Jun 11 16:31:54 2025 +0530 octeontx2-pf: CN20K mbox REQ/ACK implementation for NIC PF This implementation uses separate trigger interrupts for request, response messages against using trigger message data in CN10K. This patch adds support for basic mbox implementation for CN20K from NIC PF side. Signed-off-by: Sai Krishna Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Subbaraya Sundeep Link: https://patch.msgid.link/1749639716-13868-5-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit f326d5d86e94d78db0f50045d4c65fa99c5790d9 Author: Sai Krishna Date: Wed Jun 11 16:31:53 2025 +0530 octeontx2-af: CN20k mbox to support AF REQ/ACK functionality This implementation uses separate trigger interrupts for request, response MBOX messages against using trigger message data in CN10K. This patch adds support for basic mbox implementation for CN20K from AF side. Signed-off-by: Sai Krishna Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Subbaraya Sundeep Link: https://patch.msgid.link/1749639716-13868-4-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit e53ee4acb220acab6832669334279367b0206af6 Author: Sai Krishna Date: Wed Jun 11 16:31:52 2025 +0530 octeontx2-af: CN20k basic mbox operations and structures This patch adds basic mbox operation APIs and structures to add support for mbox module on CN20k silicon. There are few CSR offsets, interrupts changed between CN20k and prior Octeon series of devices. Signed-off-by: Sai Krishna Signed-off-by: Sunil Kovvuri Goutham Signed-off-by: Subbaraya Sundeep Link: https://patch.msgid.link/1749639716-13868-3-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit 25d51ebf0f54f9c2424f28bb29125cf24f120df0 Author: Subbaraya Sundeep Date: Wed Jun 11 16:31:51 2025 +0530 octeontx2: Set appropriate PF, VF masks and shifts based on silicon Number of RVU PFs on CN20K silicon have increased to 96 from maximum of 32 that were supported on earlier silicons. Every RVU PF and VF is identified by HW using a 16bit PF_FUNC value. Due to the change in Max number of PFs in CN20K, the bit encoding of this PF_FUNC has changed. This patch handles the change by using helper functions(using silicon check) to use PF,VF masks and shifts to support both new silicon CN20K, OcteonTx series. These helper functions are used in different modules. Also moved the NIX AF register offset macros to other files which will be posted in coming patches. Signed-off-by: Subbaraya Sundeep Signed-off-by: Sai Krishna Signed-off-by: Sunil Kovvuri Goutham Link: https://patch.msgid.link/1749639716-13868-2-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit 98df1626ae036c1ba8c844c9fd995ab8f23bbe37 Author: Bartosz Golaszewski Date: Tue Jun 10 14:34:46 2025 +0200 drm/bridge: ti-sn65dsi86: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-gpu-v1-1-ac0a21e74b71@linaro.org commit 6526b02e10209608464f2645af59b2cc955b5a19 Author: Jerome Brunet Date: Tue Feb 18 20:29:48 2025 +0100 drm/bridge: ti-sn65dsi86: use the auxiliary device The auxiliary device creation of this driver is simple enough to use the available auxiliary device creation helper. Use it and remove some boilerplate code. Signed-off-by: Jerome Brunet Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250218-aux-device-create-helper-v4-3-c3d7dfdea2e6@baylibre.com commit 8a71d8fa55760eb7f6b1c8a96e771e2678625b9c Author: Paul Moore Date: Thu May 1 15:18:56 2025 -0400 selinux: add a 5 second sleep to /sys/fs/selinux/user Commit d7b6918e22c7 ("selinux: Deprecate /sys/fs/selinux/user") started the deprecation process for /sys/fs/selinux/user: The selinuxfs "user" node allows userspace to request a list of security contexts that can be reached for a given SELinux user from a given starting context. This was used by libselinux when various login-style programs requested contexts for users, but libselinux stopped using it in 2020. Kernel support will be removed no sooner than Dec 2025. A pr_warn() message has been in place since Linux v6.13, this patch adds a five second sleep to /sys/fs/selinux/user to help make the deprecation and upcoming removal more noticeable. Signed-off-by: Paul Moore commit 9fc86a85f36c51dd9e628c82091326151c8ff638 Author: Kalevi Kolttonen Date: Thu May 15 23:23:40 2025 +0300 lsm: trivial comment fix Fix a typo in the security_inode_mkdir() comment block. Signed-off-by: Kalevi Kolttonen [PM: subject tweak, add description] Signed-off-by: Paul Moore commit b34441e356252d96eda22f175b4a0256a14baf69 Merge: 0550890b2f8069 04d752d60c190e Author: Jakub Kicinski Date: Mon Jun 16 15:31:19 2025 -0700 Merge branch 'seg6-allow-end-x-behavior-to-accept-an-oif' Ido Schimmel says: ==================== seg6: Allow End.X behavior to accept an oif Patches #1-#3 gradually extend the End.X behavior to accept an output interface as an optional argument. This is needed for cases where user space wishes to specify an IPv6 link-local address as the nexthop address. Patch #4 adds test cases to the existing End.X selftest to cover the new functionality. ==================== Link: https://patch.msgid.link/20250612122323.584113-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 04d752d60c190e754cfe4f95a7451afeb752adbd Author: Ido Schimmel Date: Thu Jun 12 15:23:23 2025 +0300 selftests: seg6: Add test cases for End.X with link-local nexthop In the current test topology, all the routers are connected to each other via dedicated links with addresses of the form fcf0:0:x:y::/64. The test configures rt-3 with an adjacency with rt-4 and rt-4 with an adjacency with rt-1: # ip -n rt_3-IgWSBJ -6 route show tab 90 fcbb:0:300::/48 fcbb:0:300::/48 encap seg6local action End.X nh6 fcf0:0:3:4::4 flavors next-csid lblen 32 nflen 16 dev dum0 metric 1024 pref medium # ip -n rt_4-JdCunK -6 route show tab 90 fcbb:0:400::/48 fcbb:0:400::/48 encap seg6local action End.X nh6 fcf0:0:1:4::1 flavors next-csid lblen 32 nflen 16 dev dum0 metric 1024 pref medium The routes are used when pinging hs-2 from hs-1 and vice-versa. Extend the test to also cover End.X behavior with an IPv6 link-local nexthop address and an output interface. Configure every router interface with an IPv6 link-local address of the form fe80::x:y/64 and before re-running the ping tests, replace the previous End.X routes with routes that use the new IPv6 link-local addresses: # ip -n rt_3-IgWSBJ -6 route show tab 90 fcbb:0:300::/48 fcbb:0:300::/48 encap seg6local action End.X nh6 fe80::4:3 oif veth-rt-3-4 flavors next-csid lblen 32 nflen 16 dev dum0 metric 1024 pref medium # ip -n rt_4-JdCunK -6 route show tab 90 fcbb:0:400::/48 fcbb:0:400::/48 encap seg6local action End.X nh6 fe80::1:4 oif veth-rt-4-1 flavors next-csid lblen 32 nflen 16 dev dum0 metric 1024 pref medium The new test cases fail without the previous patch ("seg6: Allow End.X behavior to accept an oif"): # ./srv6_end_x_next_csid_l3vpn_test.sh [...] ################################################################################ TEST SECTION: SRv6 VPN connectivity test hosts (h1 <-> h2, IPv6), link-local ################################################################################ TEST: IPv6 Hosts connectivity: hs-1 -> hs-2 [FAIL] TEST: IPv6 Hosts connectivity: hs-2 -> hs-1 [FAIL] ################################################################################ TEST SECTION: SRv6 VPN connectivity test hosts (h1 <-> h2, IPv4), link-local ################################################################################ TEST: IPv4 Hosts connectivity: hs-1 -> hs-2 [FAIL] TEST: IPv4 Hosts connectivity: hs-2 -> hs-1 [FAIL] Tests passed: 40 Tests failed: 4 And pass with it: # ./srv6_end_x_next_csid_l3vpn_test.sh [...] ################################################################################ TEST SECTION: SRv6 VPN connectivity test hosts (h1 <-> h2, IPv6), link-local ################################################################################ TEST: IPv6 Hosts connectivity: hs-1 -> hs-2 [ OK ] TEST: IPv6 Hosts connectivity: hs-2 -> hs-1 [ OK ] ################################################################################ TEST SECTION: SRv6 VPN connectivity test hosts (h1 <-> h2, IPv4), link-local ################################################################################ TEST: IPv4 Hosts connectivity: hs-1 -> hs-2 [ OK ] TEST: IPv4 Hosts connectivity: hs-2 -> hs-1 [ OK ] Tests passed: 44 Tests failed: 0 Without the previous patch, rt-3 and rt-4 resolve the wrong routes for the link-local nexthops, with the output interface being the input interface: # perf script [...] ping 1067 [001] 37.554486: fib6:fib6_table_lookup: table 254 oif 0 iif 11 proto 41 cafe::254/0 -> fe80::4:3/0 flowlabel 0xb7973 tos 0 scope 0 flags 2 ==> dev veth-rt-3-1 gw :: err 0 [...] ping 1069 [002] 41.573360: fib6:fib6_table_lookup: table 254 oif 0 iif 12 proto 41 cafe::254/0 -> fe80::1:4/0 flowlabel 0xb7973 tos 0 scope 0 flags 2 ==> dev veth-rt-4-2 gw :: err 0 But the correct routes are resolved with the patch: # perf script [...] ping 1066 [006] 30.672355: fib6:fib6_table_lookup: table 254 oif 13 iif 1 proto 41 cafe::254/0 -> fe80::4:3/0 flowlabel 0x85941 tos 0 scope 0 flags 6 ==> dev veth-rt-3-4 gw :: err 0 [...] ping 1066 [006] 30.672411: fib6:fib6_table_lookup: table 254 oif 11 iif 1 proto 41 cafe::254/0 -> fe80::1:4/0 flowlabel 0x91de0 tos 0 scope 0 flags 6 ==> dev veth-rt-4-1 gw :: err 0 Reviewed-by: Petr Machata Signed-off-by: Ido Schimmel Reviewed-by: Andrea Mayer Link: https://patch.msgid.link/20250612122323.584113-5-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit a2840d4e25270cabff92ba10146cda00d5b92ec0 Author: Ido Schimmel Date: Thu Jun 12 15:23:22 2025 +0300 seg6: Allow End.X behavior to accept an oif Extend the End.X behavior to accept an output interface as an optional attribute and make use of it when resolving a route. This is needed when user space wants to use a link-local address as the nexthop address. Before: # ip route add 2001:db8:1::/64 encap seg6local action End.X nh6 fe80::1 oif eth0 dev sr6 # ip route add 2001:db8:2::/64 encap seg6local action End.X nh6 2001:db8:10::1 dev sr6 $ ip -6 route show 2001:db8:1::/64 encap seg6local action End.X nh6 fe80::1 dev sr6 metric 1024 pref medium 2001:db8:2::/64 encap seg6local action End.X nh6 2001:db8:10::1 dev sr6 metric 1024 pref medium After: # ip route add 2001:db8:1::/64 encap seg6local action End.X nh6 fe80::1 oif eth0 dev sr6 # ip route add 2001:db8:2::/64 encap seg6local action End.X nh6 2001:db8:10::1 dev sr6 $ ip -6 route show 2001:db8:1::/64 encap seg6local action End.X nh6 fe80::1 oif eth0 dev sr6 metric 1024 pref medium 2001:db8:2::/64 encap seg6local action End.X nh6 2001:db8:10::1 dev sr6 metric 1024 pref medium Note that the oif attribute is not dumped to user space when it was not specified (as an oif of 0) since each entry keeps track of the optional attributes that it parsed during configuration (see struct seg6_local_lwt::parsed_optattrs). Signed-off-by: Ido Schimmel Reviewed-by: Andrea Mayer Link: https://patch.msgid.link/20250612122323.584113-4-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 3159671855d4e169d24d2cc2a083bf657f9d9bc2 Author: Ido Schimmel Date: Thu Jun 12 15:23:21 2025 +0300 seg6: Call seg6_lookup_any_nexthop() from End.X behavior seg6_lookup_nexthop() is a wrapper around seg6_lookup_any_nexthop(). Change End.X behavior to invoke seg6_lookup_any_nexthop() directly so that we would not need to expose the new output interface argument outside of the seg6local module. No functional changes intended. Signed-off-by: Ido Schimmel Reviewed-by: Andrea Mayer Link: https://patch.msgid.link/20250612122323.584113-3-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 01c411238c06e07ea5fa038f0ba9eaca8a53c419 Author: Ido Schimmel Date: Thu Jun 12 15:23:20 2025 +0300 seg6: Extend seg6_lookup_any_nexthop() with an oif argument seg6_lookup_any_nexthop() is called by the different endpoint behaviors (e.g., End, End.X) to resolve an IPv6 route. Extend the function with an output interface argument so that it could be used to resolve a route with a certain output interface. This will be used by subsequent patches that will extend the End.X behavior with an output interface as an optional argument. ip6_route_input_lookup() cannot be used when an output interface is specified as it ignores this parameter. Similarly, calling ip6_pol_route() when a table ID was not specified (e.g., End.X behavior) is wrong. Therefore, when an output interface is specified without a table ID, resolve the route using ip6_route_output() which will take the output interface into account. Note that no endpoint behavior currently passes both a table ID and an output interface, so the oif argument passed to ip6_pol_route() is always zero and there are no functional changes in this regard. Signed-off-by: Ido Schimmel Reviewed-by: Andrea Mayer Link: https://patch.msgid.link/20250612122323.584113-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski commit 0550890b2f80697e7ebf1e4916373e884a921492 Merge: 7768c5f417336f a471e7f87e08d9 Author: Jakub Kicinski Date: Mon Jun 16 15:27:27 2025 -0700 Merge branch 'gve-add-rx-hw-timestamping-support' Ziwei Xiao says: ==================== gve: Add Rx HW timestamping support This patch series add the support of Rx HW timestamping, which sends adminq commands periodically to the device for clock synchronization with the NIC. The ability to read the PHC from user space will be added in the future patch series when adding the actual PTP support. For this patch series, it's adding the initial ptp to utilize the ptp_schedule_worker to schedule the work of syncing the NIC clock. ==================== Link: https://patch.msgid.link/20250614000754.164827-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit a471e7f87e08d94bcdb013482551abfc455340e7 Author: John Fraker Date: Sat Jun 14 00:07:54 2025 +0000 gve: Advertise support for rx hardware timestamping Expand the get_ts_info ethtool handler with the new gve_get_ts_info which advertises support for rx hardware timestamping. With this patch, the driver now fully supports rx hardware timestamping. Signed-off-by: John Fraker Signed-off-by: Ziwei Xiao Reviewed-by: Willem de Bruijn Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20250614000754.164827-9-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit b2c7aeb4905648f0a36d27a008a6dfea37782a31 Author: John Fraker Date: Sat Jun 14 00:07:53 2025 +0000 gve: Implement ndo_hwtstamp_get/set for RX timestamping Implement ndo_hwtstamp_get/set to enable hardware RX timestamping, providing support for SIOC[SG]HWTSTAMP IOCTLs. Included with this support is the small change necessary to read the rx timestamp out of the rx descriptor, now that timestamps start being enabled. The gve clock is only used for hardware timestamps, so started when timestamps are requested and stopped when not needed. This version only supports RX hardware timestamping with the rx filter HWTSTAMP_FILTER_ALL. If the user attempts to configure a more restrictive filter, the filter will be set to HWTSTAMP_FILTER_ALL in the returned structure. Signed-off-by: John Fraker Signed-off-by: Ziwei Xiao Reviewed-by: Willem de Bruijn Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20250614000754.164827-8-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit 3bf5431fef750d5081731b53f2a5c324bcff6c3a Author: John Fraker Date: Sat Jun 14 00:07:52 2025 +0000 gve: Add rx hardware timestamp expansion Allow the rx path to recover the high 32 bits of the full 64 bit rx timestamp. Use the low 32 bits of the last synced nic time and the 32 bits of the timestamp provided in the rx descriptor to generate a difference, which is then applied to the last synced nic time to reconstruct the complete 64-bit timestamp. This scheme remains accurate as long as no more than ~2 seconds have passed between the last read of the nic clock and the timestamping application of the received packet. Signed-off-by: John Fraker Signed-off-by: Ziwei Xiao Reviewed-by: Willem de Bruijn Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20250614000754.164827-7-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit c51b7bf84091cc7fe4e51411caa9b886956081b0 Author: Kevin Yang Date: Sat Jun 14 00:07:51 2025 +0000 gve: Add support to query the nic clock Query the nic clock and store the results. The timestamp delivered in descriptors has a wraparound time of ~4 seconds so 250ms is chosen as the sync cadence to provide a balance between performance, and drift potential when we do start associating host time and nic time. Leverage PTP's aux_work to query the nic clock periodically. Signed-off-by: Kevin Yang Signed-off-by: John Fraker Signed-off-by: Tim Hostetler Signed-off-by: Ziwei Xiao Reviewed-by: Willem de Bruijn Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20250614000754.164827-6-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit 21235ad935e907008481ea7fdf8837c5eddbd80e Author: Ziwei Xiao Date: Sat Jun 14 00:07:50 2025 +0000 gve: Add adminq lock for queues creation and destruction Adminq commands for queues creation and destruction were not consistently protected by the driver's adminq_lock. This was previously benign as these operations were always initiated from contexts holding kernel-level locks (e.g., rtnl_lock, netdev_lock), which provided serialization. Upcoming PTP aux_work will issue adminq commands directly from the driver to read the NIC clock, without such kernel lock protection. To prevent race conditions with this new PTP work, this patch ensures the adminq_lock is held during queues creation and destruction. Signed-off-by: Ziwei Xiao Reviewed-by: Willem de Bruijn Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20250614000754.164827-5-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit acd16380523b400400523fe54c7499320e558e80 Author: Harshitha Ramamurthy Date: Sat Jun 14 00:07:49 2025 +0000 gve: Add initial PTP device support If the device supports reading of the nic clock, add support to initialize and register the PTP clock. Signed-off-by: Ziwei Xiao Reviewed-by: Willem de Bruijn Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20250614000754.164827-4-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit e0c9d5682cd568fc4aedf3b0375a5d48aad4d2a0 Author: John Fraker Date: Sat Jun 14 00:07:48 2025 +0000 gve: Add adminq command to report nic timestamp Add an adminq command to read NIC's hardware clock. The driver allocates dma memory and passes that dma memory address to the device. The device then writes the clock to the given address. Signed-off-by: Jeff Rogers Signed-off-by: John Fraker Signed-off-by: Ziwei Xiao Reviewed-by: Willem de Bruijn Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20250614000754.164827-3-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit db576b61e6949b7528496d1145b7dc35b87e0d49 Author: John Fraker Date: Sat Jun 14 00:07:47 2025 +0000 gve: Add device option for nic clock synchronization Add the device option and negotiation with the device for clock synchronization with the nic. This option is necessary before the driver will advertise support for hardware timestamping or other related features. Signed-off-by: Jeff Rogers Signed-off-by: John Fraker Signed-off-by: Ziwei Xiao Reviewed-by: Willem de Bruijn Signed-off-by: Harshitha Ramamurthy Link: https://patch.msgid.link/20250614000754.164827-2-hramamurthy@google.com Signed-off-by: Jakub Kicinski commit 7768c5f417336fa58dbfef9bb7ecd7eeec6d8886 Author: Haiyang Zhang Date: Fri Jun 13 10:00:34 2025 -0700 net: mana: Add handler for hardware servicing events To collaborate with hardware servicing events, upon receiving the special EQE notification from the HW channel, remove the devices on this bus. Then, after a waiting period based on the device specs, rescan the parent bus to recover the devices. Signed-off-by: Haiyang Zhang Reviewed-by: Shradha Gupta Reviewed-by: Simon Horman Link: https://patch.msgid.link/1749834034-18498-1-git-send-email-haiyangz@linux.microsoft.com Signed-off-by: Jakub Kicinski commit 7aa3f9915613221648bc1e0c5a1cc1dd1e323ed5 Merge: e9a7795e75b78b 69d094ef69b954 Author: Jakub Kicinski Date: Mon Jun 16 15:18:35 2025 -0700 Merge branch 'netpoll-untangle-netconsole-and-netpoll' Breno Leitao says: ==================== netpoll: Untangle netconsole and netpoll Initially netpoll and netconsole were created together, and some functions are in the wrong file. Seperate netconsole-only functions in netconsole, avoiding exports. 1. Expose netpoll logging macros in the public header to enable consistent log formatting across netpoll consumers. 2. Relocate netconsole-specific functions from netpoll to the netconsole module where they are actually used, reducing unnecessary coupling. 3. Remove unnecessary function exports 4. Rename netpoll parsing functions in netconsole to better reflect their specific usage. 5. Create a test to check that cmdline works fine. This was in my todo list since [1], this was a good time to add it here to make sure this patchset doesn't regress. PS: The code was split in a way that it is easy to review. When copying the functions from netpoll to netconsole, I do not change than other than adding `static`. This will make checkpatch unhappy, but, further patches will address the issues. It is done this way to make it easy for reviewers. Link: https://lore.kernel.org/netdev/Z36TlACdNMwFD7wv@dev-ushankar.dev.purestorage.com/ [1] v2: https://lore.kernel.org/20250611-rework-v2-0-ab1d92b458ca@debian.org v1: https://lore.kernel.org/20250610-rework-v1-0-7cfde283f246@debian.org ==================== Link: https://patch.msgid.link/20250613-rework-v3-0-0752bf2e6912@debian.org Signed-off-by: Jakub Kicinski commit 69d094ef69b9548c89b8e32d24e3d9fc19731a26 Author: Breno Leitao Date: Fri Jun 13 04:31:37 2025 -0700 selftests: net: add netconsole test for cmdline configuration Add a new selftest to verify netconsole module loading with command line arguments. This test exercises the init_netconsole() path and validates proper parsing of the netconsole= parameter format. The test: - Loads netconsole module with cmdline configuration instead of dynamic reconfiguration - Validates message transmission through the configured target - Adds helper functions for cmdline string generation and module validation This complements existing netconsole selftests by covering the module initialization code path that processes boot-time parameters. This test is useful to test issues like the one described in [1]. Link: https://lore.kernel.org/netdev/Z36TlACdNMwFD7wv@dev-ushankar.dev.purestorage.com/ [1] Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250613-rework-v3-8-0752bf2e6912@debian.org Signed-off-by: Jakub Kicinski commit bed365ca56cadeabb4f0484dc9e12b3c78ac0ab7 Author: Breno Leitao Date: Fri Jun 13 04:31:36 2025 -0700 selftests: net: Refactor cleanup logic in lib_netcons.sh Extract the network device and namespace cleanup logic from the cleanup() function into a new do_cleanup() helper in lib_netcons.sh. The do_cleanup() function only unconfigure the network and printk, while cleanup() cleans the netconsole targets plus the network and printk. This refactoring let this code to be reused in cases netconsole dynamic is not being used, as in the upcoming patch. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250613-rework-v3-7-0752bf2e6912@debian.org Signed-off-by: Jakub Kicinski commit d79206451f4f99a03907ab9390361ab83b607a6a Author: Breno Leitao Date: Fri Jun 13 04:31:35 2025 -0700 netconsole: improve code style in parser function Split assignment from conditional checks and use preferred null pointer check style (!delim instead of == NULL) in netconsole_parser_cmdline(). This improves code readability and follows kernel coding style conventions. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250613-rework-v3-6-0752bf2e6912@debian.org Signed-off-by: Jakub Kicinski commit abebef96aab12da245e2a4fc4c3e6715a6239156 Author: Breno Leitao Date: Fri Jun 13 04:31:34 2025 -0700 netconsole: rename functions to better reflect their purpose Rename netpoll_parse_options() to netconsole_parser_cmdline() and netpoll_print_options() to netconsole_print_banner() to better describe what these functions actually do within the netconsole context. Also fix minor code style issues including variable declaration ordering and spacing. These functions are specific to netconsole functionality rather than general netpoll operations, so the new names better reflect their actual purpose. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250613-rework-v3-5-0752bf2e6912@debian.org Signed-off-by: Jakub Kicinski commit ccc7edf0ada83d395b634506eff9616360a99b5a Author: Breno Leitao Date: Fri Jun 13 04:31:33 2025 -0700 netpoll: move netpoll_print_options to netconsole Move netpoll_print_options() from net/core/netpoll.c to drivers/net/netconsole.c and make it static. This function is only used by netconsole, so there's no need to export it or keep it in the public netpoll API. This reduces the netpoll API surface and improves code locality by keeping netconsole-specific functionality within the netconsole driver. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250613-rework-v3-4-0752bf2e6912@debian.org Signed-off-by: Jakub Kicinski commit 5a34c9a8536511b6bd43d85bb0211077226c6fdb Author: Breno Leitao Date: Fri Jun 13 04:31:32 2025 -0700 netpoll: relocate netconsole-specific functions to netconsole module Move netpoll_parse_ip_addr() and netpoll_parse_options() from the generic netpoll module to the netconsole module where they are actually used. These functions were originally placed in netpoll but are only consumed by netconsole. This refactoring improves code organization by: - Removing unnecessary exported symbols from netpoll - Making netpoll_parse_options() static (no longer needs global visibility) - Reducing coupling between netpoll and netconsole modules The functions remain functionally identical - this is purely a code reorganization to better reflect their actual usage patterns. Here are the changes: 1) Move both functions from netpoll to netconsole 2) Add static to netpoll_parse_options() 3) Removed the EXPORT_SYMBOL() PS: This diff does not change the function format, so, it is easy to review, but, checkpatch will not be happy. A follow-up patch will address the current issues reported by checkpatch. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250613-rework-v3-3-0752bf2e6912@debian.org Signed-off-by: Jakub Kicinski commit afb023329c07af7a9144901a1dad3a80d9e177b1 Author: Breno Leitao Date: Fri Jun 13 04:31:31 2025 -0700 netpoll: expose netpoll logging macros in public header Move np_info(), np_err(), and np_notice() macros from internal implementation to the public netpoll header file to make them available for use by netpoll consumers. These logging macros provide consistent formatting for netpoll-related messages by automatically prefixing log output with the netpoll instance name. The goal is to use the exact same format that is being displayed today, instead of creating something netconsole-specific. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250613-rework-v3-2-0752bf2e6912@debian.org Signed-off-by: Jakub Kicinski commit 260948993a9f99428f801dcb40654205e74aaa47 Author: Breno Leitao Date: Fri Jun 13 04:31:30 2025 -0700 netpoll: remove __netpoll_cleanup from exported API Since commit 97714695ef90 ("net: netconsole: Defer netpoll cleanup to avoid lock release during list traversal"), netconsole no longer uses __netpoll_cleanup(). With no remaining users, remove this function from the exported netpoll API. The function remains available internally within netpoll for use by netpoll_cleanup(). Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250613-rework-v3-1-0752bf2e6912@debian.org Signed-off-by: Jakub Kicinski commit e9a7795e75b78b56997fb0070c18d6e1057b6462 Author: Breno Leitao Date: Fri Jun 13 10:15:46 2025 -0700 ptp: Use ratelimite for freerun error message Replace pr_err() with pr_err_ratelimited() in ptp_clock_settime() to prevent log flooding when the physical clock is free running, which happens on some of my hosts. This ensures error messages are rate-limited and improves kernel log readability. Signed-off-by: Breno Leitao Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250613-ptp-v1-1-ee44260ce9e2@debian.org Signed-off-by: Jakub Kicinski commit de74998c3008a2e0af97a918dfbb7560ecb79ee4 Author: Eric Dumazet Date: Fri Jun 13 06:41:36 2025 +0000 selftests/tc-testing: sfq: check perturb timer values Add one test to check that the kernel rejects a negative perturb timer. Add a second test checking that the kernel rejects a too big perturb timer. All test results: 1..2 ok 1 cdc1 - Check that a negative perturb timer is rejected ok 2 a9f0 - Check that a too big perturb timer is rejected Signed-off-by: Eric Dumazet Reviewed-by: Simon Horman Reviewed-by: Cong Wang Link: https://patch.msgid.link/20250613064136.3911944-1-edumazet@google.com Signed-off-by: Jakub Kicinski commit 6f10624d954f7194d7d91bc92ab5340ed1be3f9b Merge: 883af78926c140 7d57386905d4ab Author: Jakub Kicinski Date: Mon Jun 16 14:59:32 2025 -0700 Merge branch 'net-phy-make-phy_package-a-separate-module' Heiner Kallweit says: ==================== net: phy: make phy_package a separate module Only a handful of PHY drivers needs the PHY package functionality, therefore make it a separate module which is built only if needed. ==================== Link: https://patch.msgid.link/eec346a4-e903-48af-8150-0191932a7a0b@gmail.com Signed-off-by: Jakub Kicinski commit 7d57386905d4abfe2f13b1bba0ce8e23872de5fe Author: Heiner Kallweit Date: Thu Jun 12 23:28:18 2025 +0200 net: phy: add Kconfig symbol PHY_PACKAGE Only a handful of PHY drivers needs the PHY package functionality, therefore build the module only if needed. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/42c05496-61b2-4b09-b853-3d99b3dfe95c@gmail.com Signed-off-by: Jakub Kicinski commit a1acde1e1bcf18efc0549d7d317daed54138014e Author: Heiner Kallweit Date: Thu Jun 12 23:26:52 2025 +0200 net: phy: make phy_package a separate module Make phy_package a separate module, so that this code is only loaded if needed. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/66bb4cce-b6a3-421e-9a7b-5d4a0c75290e@gmail.com Signed-off-by: Jakub Kicinski commit cbd1ab0ce8f6511f653e80cee0c32a8d56371223 Author: Heiner Kallweit Date: Thu Jun 12 23:26:04 2025 +0200 net: phy: move __phy_package_[read|write]_mmd to phy_package.c Move both functions to phy_package.c, so that phy_core.c no longer has a dependency on phy_package.c (phy_package_address). Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/8956fa53-3eda-4079-8203-a8fddcc17bf3@gmail.com Signed-off-by: Jakub Kicinski commit 883af78926c140c3dc66d4e550835ae95bd19920 Author: Russell King (Oracle) Date: Thu Jun 12 17:16:35 2025 +0100 net: stmmac: remove pcs_get_adv_lp() support It appears that the GMAC_ANE_ADV and GMAC_ANE_LPA registers are only available for TBI and RTBI PHY interfaces. In commit 482b3c3ba757 ("net: stmmac: Drop TBI/RTBI PCS flags") support for these was dropped, and thus it no longer makes sense to access these registers. Remove the *_get_adv_lp() functions, and the now redundant struct rgmii_adv and STMMAC_PCS_* definitions. Signed-off-by: Russell King (Oracle) Reviewed-by: Jacob Keller Link: https://patch.msgid.link/E1uPkbT-004EyG-OQ@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3cfbde048b1c0606d0e02ecb0319c8748421bc7c Author: Steven Rostedt Date: Thu Jun 12 09:46:16 2025 -0400 net/tcp_ao: tracing: Hide tcp_ao events under CONFIG_TCP_AO Several of the tcp_ao events are only called when CONFIG_TCP_AO is defined. As each event can take up to 5K regardless if they are used or not, it's best not to define them when they are not used. Add #ifdef around these events when they are not used. Signed-off-by: Steven Rostedt (Google) Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250612094616.4222daf0@batman.local.home Signed-off-by: Jakub Kicinski commit ae1ae11fb277f1335d6bcd4935ba0ea985af3c32 Author: Richard Guy Briggs Date: Fri Jun 13 15:58:00 2025 -0400 audit,module: restore audit logging in load failure case The move of the module sanity check to earlier skipped the audit logging call in the case of failure and to a place where the previously used context is unavailable. Add an audit logging call for the module loading failure case and get the module name when possible. Link: https://issues.redhat.com/browse/RHEL-52839 Fixes: 02da2cbab452 ("module: move check_modinfo() early to early_mod_check()") Signed-off-by: Richard Guy Briggs Reviewed-by: Petr Pavlu Signed-off-by: Paul Moore commit 33c77e00f2ee74406474c2b6e2adab45f25e4bf2 Author: Michal Wajdeczko Date: Sat Jun 14 20:24:46 2025 +0200 drm/xe/tests: Convert xe_pci tests to parametrized tests Instead of looping over known IP descriptors within single test case, without any diagnostics which IP descriptor is eventually broken, define kunit parameter generators with IP descriptors, and make existing xe_pci tests fully parametrized: [ ] =================== xe_pci (2 subtests) ==================== [ ] ==================== check_graphics_ip ==================== [ ] [PASSED] 12.70 Xe_LPG [ ] [PASSED] 12.71 Xe_LPG [ ] [PASSED] 12.74 Xe_LPG+ [ ] [PASSED] 20.01 Xe2_HPG [ ] [PASSED] 20.04 Xe2_LPG [ ] [PASSED] 30.00 Xe3_LPG [ ] [PASSED] 30.01 Xe3_LPG [ ] ================ [PASSED] check_graphics_ip ================ [ ] ===================== check_media_ip ====================== [ ] [PASSED] 13.00 Xe_LPM+ [ ] [PASSED] 13.01 Xe2_HPM [ ] [PASSED] 20.00 Xe2_LPM [ ] [PASSED] 30.00 Xe3_LPM [ ] ================= [PASSED] check_media_ip ================== [ ] ===================== [PASSED] xe_pci ====================== Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Matt Roper Reviewed-by: Lucas De Marchi Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250614182446.2024-1-michal.wajdeczko@intel.com Signed-off-by: Matt Roper commit 48f2f7a9fe202ad441b9c23093d60b7b429494e2 Author: Michal Wajdeczko Date: Fri Jun 13 21:19:37 2025 +0200 drm/xe/tests: Drop unused xe_device_fn typedef We missed to drop it in commit 50680d1698f4 ("drm/xe/tests: remove unused leftover xe_call_for_each_device()") so drop it now. Signed-off-by: Michal Wajdeczko Cc: Jani Nikula Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250613191938.1980-2-michal.wajdeczko@intel.com Signed-off-by: Matt Roper commit 1488a3089de3d0bcdc9532da7ce04cf0af9d7dd0 Author: Lucas De Marchi Date: Wed Jun 11 12:38:37 2025 -0700 drm/xe: Fix kconfig prompt The xe driver is the official driver for Intel Xe2 and later, while maintaining experimental support for earlier GPUs. Reword the help message accordingly. Reviewed-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250611-xe-kconfig-help-v1-1-8bcc6b47d11a@intel.com Signed-off-by: Lucas De Marchi commit 61c5d53e815784708c45dac086c50a12ed1db694 Author: Al Viro Date: Thu Mar 6 18:28:56 2025 -0500 simple_recursive_removal(): saner interaction with fsnotify Make it match the real unlink(2)/rmdir(2) - notify *after* the operation. And use fsnotify_delete() instead of messing with fsnotify_unlink()/fsnotify_rmdir(). Currently the only caller that cares is the one in debugfs, and there the order matching the normal syscalls makes more sense; it'll get more serious for users introduced later in the series. Reviewed-by: Amir Goldstein Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 49d63971f96349cdcff89d21786e3c804e7cd4c0 Author: Andrea della Porta Date: Thu May 29 15:50:44 2025 +0200 misc: rp1: RaspberryPi RP1 misc driver The RaspberryPi RP1 is a PCI multi function device containing peripherals ranging from Ethernet to USB controller, I2C, SPI and others. Implement a bare minimum driver to operate the RP1, leveraging actual OF based driver implementations for the on-board peripherals by loading a devicetree overlay during driver probe if the RP1 node is not already present in the DT. The peripherals are accessed by mapping MMIO registers starting from PCI BAR1 region. With the overlay approach we can achieve more generic and agnostic approach to managing this chipset, being that it is a PCI endpoint and could possibly be reused in other hw implementations. The presented approach is also used by Bootlin's Microchip LAN966x patchset (see link) as well, for a similar chipset. In this case, the inclusion tree for the DT overlay is as follow (the arrow points to the includer): rp1-pci.dtso <---- rp1-common.dtsi On the other hand, to ensure compatibility with downstream, this driver can also work with a DT already comprising the RP1 node, so the dynamically loaded overlay will not be used if the DT is already fully defined. The reason why this driver is contained in drivers/misc has been paved by Bootlin's LAN966X driver, which first used the overlay approach to implement non discoverable peripherals behind a PCI bus. For RP1, the same arguments apply: it's not used as an SoC since the driver code is not running on-chip and is not like an MFD since it does not really need all the MFD infrastructure (shared regs, etc.). So, for this particular use, misc has been proposed and deemed as a good choice. For further details about that please check the links. This driver is heavily based on downstream code from RaspberryPi Foundation, and the original author is Phil Elwell. Link: https://datasheets.raspberrypi.com/rp1/rp1-peripherals.pdf Link: https://lore.kernel.org/all/20240612140208.GC1504919@google.com/ Link: https://lore.kernel.org/all/83f7fa09-d0e6-4f36-a27d-cee08979be2a@app.fastmail.com/ Link: https://lore.kernel.org/all/2024081356-mutable-everyday-6f9d@gregkh/ Link: https://lore.kernel.org/all/20240808154658.247873-1-herve.codina@bootlin.com/ Signed-off-by: Andrea della Porta Acked-by: Bjorn Helgaas # quirks.c, pci_ids.h Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20250529135052.28398-7-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 4732f079cd19f313516047726d934fabc58e9119 Author: Andrea della Porta Date: Thu May 29 15:50:42 2025 +0200 pinctrl: rp1: Implement RaspberryPi RP1 gpio support The RP1 is an MFD supporting a gpio controller and /pinmux/pinctrl. Add minimum support for the gpio only portion. The driver is in pinctrl folder since upcoming patches will add the pinmux/pinctrl support where the gpio part can be seen as an addition. Signed-off-by: Andrea della Porta Reviewed-by: Linus Walleij Reviewed-by: Stefan Wahren Link: https://lore.kernel.org/r/20250529135052.28398-5-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 6486341721a2cd1cbc9c08a9bc90235c0b42f25b Author: Andrea della Porta Date: Thu May 29 15:50:41 2025 +0200 clk: rp1: Add support for clocks provided by RP1 RaspberryPi RP1 is an MFD providing, among other peripherals, several clock generators and PLLs that drives the sub-peripherals. Add the driver to support the clock providers. Signed-off-by: Andrea della Porta Tested-by: Randy Dunlap # build-tested Link: https://lore.kernel.org/r/20250529135052.28398-4-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit acc379c63ade8e247fb792ccdd4ae9a208530c1a Author: Andrea della Porta Date: Thu May 29 15:50:38 2025 +0200 dt-bindings: clock: Add RaspberryPi RP1 clock bindings Add device tree bindings for the clock generator found in RP1 multi function device, and relative entries in MAINTAINERS file. Signed-off-by: Andrea della Porta Reviewed-by: Krzysztof Kozlowski Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250529135052.28398-1-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 80bae9df2108cb72a060ee5235614d7c072af1de Author: Alexander Lobakin Date: Thu Jun 12 18:02:34 2025 +0200 libeth: xdp, xsk: access adjacent u32s as u64 where applicable On 64-bit systems, writing/reading one u64 is faster than two u32s even when they're are adjacent in a struct. The compilers won't guarantee they will combine those; I observed both successful and unsuccessful attempts with both GCC and Clang, and it's not easy to say what it depends on. There's a few places in libeth_xdp winning up to several percent from combined access (both performance and object code size, especially when unrolling). Add __LIBETH_WORD_ACCESS and use it there on LE. Drivers are free to optimize HW-specific callbacks under the same definition. Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 3ced71a8b39e84f91a4fa9d42e85815515f9b1bc Author: Alexander Lobakin Date: Thu Jun 12 18:02:33 2025 +0200 libeth: xsk: add XSkFQ refill and XSk wakeup helpers XSkFQ refill is pretty generic across the drivers minus FQ descriptor filling and can easily be unified with one inline callback. XSk wakeup is usually not, but here, instead of commonly used "SW interrupts", I picked firing an IPI. In most tests, it showed better performance; it also provides better control for userspace on which CPU will handle the xmit, as SW interrupts honor IRQ affinity no matter which core produces XSk xmit descs (while XDPSQs are associated 1:1 with cores having the same ID). Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 5495c58c65aa3d650cccaa19dc59115b9a0069a5 Author: Alexander Lobakin Date: Thu Jun 12 18:02:32 2025 +0200 libeth: xsk: add XSk Rx processing support Add XSk counterparts for preparing XSk &libeth_xdp_buff (adding head and frags), running the program, and handling the verdict, inc. XDP_PASS. Shortcuts in comparison with regular Rx: frags and all verdicts except XDP_REDIRECT are under unlikely() and out of line; no checks for XDP program presence as it's always true for XSk. Suggested-by: Maciej Fijalkowski # optimizations Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 40e846d122df9b299e700ec86d01ef647fc0b09f Author: Alexander Lobakin Date: Thu Jun 12 18:02:31 2025 +0200 libeth: xsk: add XSk xmit functions Reuse core sending functions to send XSk xmit frames. Both metadata and no metadata pools/driver are supported. libeth_xdp also provides generic XSk metadata ops, currently with the checksum offload only and for cases when HW doesn't require supplying L3/L4 checksum offsets. Drivers are free to pass their own ops. &libeth_xdp_tx_bulk is not used here as it would be redundant; pool->tx_descs are accessed directly. Fake "libeth_xsktmo" is needed to hide implementation details from the drivers when they want to use the generic ops: the original struct is defined in the same file where dev->xsk_tx_metadata_ops gets set to avoid duplication of slowpath; at the same time; XSk xmit functions use local "fast" copy to inline XMO callbacks. Tx descriptor filling loop is unrolled by 8. Suggested-by: Maciej Fijalkowski # optimizations Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit b3ad8450b4dc46c4ab0641f665068fd2a4d1adba Author: Alexander Lobakin Date: Thu Jun 12 18:02:30 2025 +0200 libeth: xsk: add XSk XDP_TX sending helpers Add Xsk counterparts for XDP_TX buffer sending and completion. The same base structures and functions used from the libeth_xdp core, with adjustments to that XSk Rx always operates on &xdp_buff_xsk for both head and frags. And unlike regular Rx, here unlikely() are used for frags, as the header split gives no benefits for XSk Rx, at least for now. Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 576cc5c13d9ba53a1a24d9b34af2f939a87b7ce8 Author: Alexander Lobakin Date: Thu Jun 12 18:02:29 2025 +0200 libeth: xdp: add RSS hash hint and XDP features setup helpers End the XDP section by adding helpers to setup XDP features, flipping .ndo_xdp_xmit() support at runtime (in case when it's not always on), and calculating the queue clean/refill threshold. Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 1bb635d3748b7158c6a19e6fca4fb85e6f96fd9a Author: Alexander Lobakin Date: Thu Jun 12 18:02:28 2025 +0200 libeth: xdp: add templates for building driver-side callbacks Defining driver-specific functions to pass to libeth_xdp functions can induce boilerplates and/or look a bit cryptic with all those layers of indirection. On the other hand, this indirection is needed to allow compilers to uninline big functions even when passed to __always_inline helpers (too much inlining also hurts performance in some cases), plus to reuse some XDP helpers in XSk code. Add macros to quickly build them, with the detailed kdoc. They take names of the actual callbacks for filling a Tx descriptor and other purely HW-specific things and wrap them appropriately. LIBETH_XDP_DEFINE_{BEGIN,END}() is needed for GCC 8+ unfortunately to let the drivers control which functions will be static and which global without hitting `-Wold-style-declaration`. Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 4c805f7ae1ce61a90121378a5ee1f47b3b870c73 Author: Alexander Lobakin Date: Thu Jun 12 18:02:27 2025 +0200 libeth: xdp: add XDP prog run and verdict result handling Running a prog and handling the verdicts, up to napi_gro_receive() is also pretty generic code not really differing between vendors (except for Tx descriptor filling and Rx descriptor parsing). Define a couple inlines to do that. The inline callbacks a driver needs to pass is mentioned above: Tx descriptor filling for XDP_TX, populating skb with the descriptor data for XDP_PASS, finalizing XDPSQs after the polling loop for XDP_TX (kicking the HW to start sending). The populate callback passes only &libeth_xdp_buff assuming buff::desc pointer is enough, plus you can always get the corresponding Rx queue structure via container_of(buff::rxq). If not, a driver can extend the buff with more fields directly on the stack without touching libeth_xdp definitions. Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 3ef2b0192e8ba133f597919632bd9cf196076f0b Author: Alexander Lobakin Date: Thu Jun 12 18:02:26 2025 +0200 libeth: xdp: add helpers for preparing/processing &libeth_xdp_buff Add convenience helpers to build an &xdp_buff. This means: general initialization before the NAPI loop, adding head, adding frags etc. libeth_xdp_process_buff() is the same what everybody have in their drivers: dma_sync_for_cpu(); if (!frag) { add_head(); prefetch(); } else { add_frag(); } Note that I don't use net_prefetch(), sticking to the original prefetch(). In none of my tests prefetching 128 bytes yielded better perf than 64 bytes. That might differ if the headers are huge enough, but then additional tunneling etc. overhead takes place, you either way won't win a lot. &libeth_xdp_stash is for cases when you exit the polling loop without finishing building the buff. If that happens, you need to store the buffer in the queue structure until the next loop and then restore it. It makes no sense to place a whole full &xdp_buff there. Define a minimal structure, which would store only the fields essential to restore it. I was able to pack it into 16 bytes, which is only 8 bytes bigger than `struct sk_buff *skb` on x64. Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 819bbaefeded93df36d71d58d9963d706e6e99e1 Author: Alexander Lobakin Date: Thu Jun 12 18:02:25 2025 +0200 libeth: xdp: add XDPSQ cleanup timers When XDP Tx queues are not interrupt-driven but use lazy cleaning, i.e. only when there are less than `threshold` free descriptors left, we also need cleanup timers to avoid &xdp_buff and &xdp_frame stall for too long, especially with Page Pool (it warns every about inflight pages every 60 second). Let's say we sent 256 frames and don't need to send more, but we clean only when the number of pending items >= 384. In that case, those 256 will stall until 128 more are sent. For this, add simple helpers to run a timer which will clean the queue regardless, after 1 second of the last send. The timer is triggered when finalizing the queue. As long as there is regular active traffic, the timer doesn't fire. Signed-off-by: Alexander Lobakin Reviewed-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen commit c4ba6a9b9d460c6fd742e118022f2808ec3c4223 Author: Alexander Lobakin Date: Thu Jun 12 18:02:24 2025 +0200 libeth: xdp: add XDPSQ locking helpers Unfortunately, it's not always possible to allocate max(num_rxqs, nr_cpu_ids) even on hi-end NICs. To mitigate this, add simple locking helpers to libeth_xdp. As long as XDPSQs are not shared, the whole functionality is gated behind a static lock. Otherwise, each bulk flush locks the queue for the time of cleaning and filling the descriptors. As long as this particular queue is not used by more than 1 CPU, the impact is minimal (runtime check for boolean twice per 16+ descriptors). Suggested-by: Maciej Fijalkowski # static key Signed-off-by: Alexander Lobakin Reviewed-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen commit 26ce8eb0bb7d47c5fb36f7c12f34e4a320f14cac Author: Alexander Lobakin Date: Thu Jun 12 18:02:23 2025 +0200 libeth: xdp: add XDPSQE completion helpers Similarly to libeth_tx_complete(), add libeth_xdp_complete_tx() to handle XDP_TX and xmit buffers. Both use bulk return under the hood. Also add out of line libeth_tx_complete_any() which handles both regular and XDP frames (if libeth_xdp is loaded), for example, to call on queue destroy, where we don't need inlining but convenience. Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 084ceda7decdbeff2bafbe2d28f57aed50b3bc46 Author: Alexander Lobakin Date: Thu Jun 12 18:02:22 2025 +0200 libeth: xdp: add .ndo_xdp_xmit() helpers Add helpers for implementing .ndo_xdp_xmit(). Same as for XDP_TX, accumulate up to 16 DMA-mapped frames on the stack, then flush. If DMA mapping is failed for some reason, don't try mapping further frames, but still flush what was already prepared. DMA address of a head frame is stored in its headroom, assuming it has enough of it for an 8 (or 4) byte value. In addition to @prep and @xmit driver callbacks in XDP_TX, xmit also needs @finalize to kick the XDPSQ after filling. Signed-off-by: Alexander Lobakin Reviewed-by: Maciej Fijalkowski Signed-off-by: Tony Nguyen commit 8591c3afe8882a00d9070daf78c384b003b596f3 Author: Alexander Lobakin Date: Thu Jun 12 18:02:21 2025 +0200 libeth: xdp: add XDP_TX buffers sending Start adding XDP-specific code to libeth, namely handling XDP_TX buffers (only sending). The idea is that we accumulate up to 16 buffers on the stack, then, if either the limit is reached or the polling is finished, flush them at once with only one XDPSQ cleaning (if needed). The main sending function will be aware of the sending budget and already have all the info to send the buffers, so it can't fail. Drivers need to provide 2 inline callbacks to the main sending function: for cleaning an XDPSQ and for filling descriptors; the library code takes care of the rest. Note that unlike the generic code, multi-buffer support is not wrapped here with unlikely() to not hurt header split setups. &libeth_xdp_buff is a simple extension over &xdp_buff which has a direct pointer to the corresponding Rx descriptor (and, luckily, precisely 1 CL size and 16-byte alignment on x86_64). Suggested-by: Maciej Fijalkowski # xmit logic Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 35c64b6500ef7308155bf0dc556c646e4d7b0fd3 Author: Alexander Lobakin Date: Thu Jun 12 18:02:20 2025 +0200 libeth: support native XDP and register memory model Expand libeth's Page Pool functionality by adding native XDP support. This means picking the appropriate headroom and DMA direction. Also, register all the created &page_pools as XDP memory models. A driver then can call xdp_rxq_info_attach_page_pool() when registering its RxQ info. Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 6ad5ff6e7282d1252364cc08af88260ef0ec4cda Author: Alexander Lobakin Date: Thu Jun 12 18:02:19 2025 +0200 libeth: convert to netmem Back when the libeth Rx core was initially written, devmem was a draft and netmem_ref didn't exist in the mainline. Now that it's here, make libeth MP-agnostic before introducing any new code or any new library users. When it's known that the created PP/FQ is for header buffers, use faster "unsafe" underscored netmem <--> virt accessors as netmem_is_net_iov() is always false in that case, but consumes some cycles (bit test + true branch). Reviewed-by: Mina Almasry Signed-off-by: Alexander Lobakin Signed-off-by: Tony Nguyen commit 359bcf15ec1d6738ede721db628594ecf05fd998 Author: Alexander Lobakin Date: Thu Jun 12 18:02:18 2025 +0200 libeth, libie: clean symbol exports up a little Change EXPORT_SYMBOL_NS_GPL(x, "LIBETH") to EXPORT_SYMBOL_GPL(x) + DEFAULT_SYMBOL_NAMESPACE "LIBETH" to make the code more compact. Also, explicitly include to satisfy new requirements from scripts/misc-check. Signed-off-by: Alexander Lobakin Reviewed-by: Aleksandr Loktionov Signed-off-by: Tony Nguyen commit 76549adb4260e5966db533c73fbf5a4648038c1d Author: Thomas Weißschuh Date: Wed Jun 11 11:58:06 2025 +0200 scsi: Don't use %pK through printk() In the past %pK was preferable to %p as it would not leak raw pointer values into the kernel log. Since commit ad67b74d2469 ("printk: hash addresses printed with %p") the regular %p has been improved to avoid this issue. Furthermore, restricted pointers ("%pK") were never meant to be used through printk(). They can still unintentionally leak raw pointers or acquire sleeping locks in atomic contexts. Switch to the regular pointer formatting which is safer and easier to reason about. Signed-off-by: Thomas Weißschuh Link: https://lore.kernel.org/r/20250611-restricted-pointers-scsi-v1-1-fe31bfbc4910@linutronix.de Signed-off-by: Martin K. Petersen commit b1ba03c49a711c30e24735733dfd68f2422fa150 Author: Damien Le Moal Date: Wed Jun 11 18:34:21 2025 +0900 scsi: core: Remember if a device is an ATA device scsi_add_lun() tests the device vendor string of SCSI devices to detect if a SCSI device is in fact an ATA device, in order to correctly handle SATL power management. The function scsi_cdl_enable() also requires knowing if a SCSI device is an ATA device to control the state of the device CDL feature but this function does that by testing for the presence of the VPD page 89h (ATA INFORMATION page). sd_read_write_same() also has a similar test. Simplify these different methods by adding the is_ata field to struct scsi_device to remember that a SCSI device is in fact an ATA one based on the device vendor name test. This field can also allow low level SCSI host adapter drivers to take special actions for ATA devices (e.g. to better handle ATA NCQ errors). With this, simplify scsi_cdl_enable() and sd_read_write_same(). Signed-off-by: Damien Le Moal Link: https://lore.kernel.org/r/20250611093421.2901633-1-dlemoal@kernel.org Reviewed-by: Igor Pylypiv Signed-off-by: Martin K. Petersen commit 0ec996edf4fdb727340ec9f50e2795042c23cd86 Author: André Draszik Date: Fri Jun 6 16:29:43 2025 +0100 scsi: mpt3sas: Drop unused variable in mpt3sas_send_mctp_passthru_req() With W=1, gcc complains correctly: mpt3sas_ctl.c: In function ‘mpt3sas_send_mctp_passthru_req’: mpt3sas_ctl.c:2917:29: error: variable ‘mpi_reply’ set but not used [-Werror=unused-but-set-variable] 2917 | MPI2DefaultReply_t *mpi_reply; | ^~~~~~~~~ Drop the unused assignment and variable. Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250606-mpt3sas-v1-1-906ffe49fb6b@linaro.org Signed-off-by: Martin K. Petersen commit fda6add9243867486f8cd456d7b05395d2132e0a Author: Kent Overstreet Date: Mon Jun 16 13:59:20 2025 -0400 workqueue: Basic memory allocation profiling support Hook alloc_workqueue and alloc_workqueue_attrs() so that they're accounted to the callsite. Since we're doing allocations on behalf of another subsystem, this helps when using memory allocation profiling to check for leaks. Cc: Tejun Heo Cc: Lai Jiangshan Signed-off-by: Kent Overstreet Signed-off-by: Tejun Heo commit f479fee3827aa8a532b62b41025075b25259117e Author: Cheng-Yang Chou Date: Mon Jun 16 04:04:14 2025 +0800 sched_ext: Return NULL in llc_span Use NULL instead of 0 to signal no LLC domain, matching numa_span() and the function comment. No functional change. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 95463cbb4fe6489921fb8c72890113dca54ce83f Author: Johan Hovold Date: Fri May 23 10:51:12 2025 +0200 phy: drop probe registration printks Drivers should generally be quiet on successful probe, but this is not followed by some PHY drivers, for example: snps-eusb2-hsphy 88e1000.phy: Registered Snps-eUSB2 phy qcom-eusb2-repeater c432000.spmi:pmic@7:phy@fd00: Registered Qcom-eUSB2 repeater qcom-eusb2-repeater c432000.spmi:pmic@a:phy@fd00: Registered Qcom-eUSB2 repeater qcom-eusb2-repeater c432000.spmi:pmic@b:phy@fd00: Registered Qcom-eUSB2 repeater snps-eusb2-hsphy fd3000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy fd9000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy fde000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy 88e0000.phy: Registered Snps-eUSB2 phy snps-eusb2-hsphy 88e2000.phy: Registered Snps-eUSB2 phy Drop (or demote to debug level) unnecessary registration info messages to make boot logs a little less noisy. Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20250523085112.11287-1-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 351e07e6b2ecc16ef8669713b14b6f67518c945d Author: Swapnil Jakhade Date: Mon Jun 16 12:17:05 2025 +0530 phy: cadence-torrent: Add PCIe multilink + USB with same SSC register config for 100 MHz refclk Add register sequences and support for PCIe multilink + USB configuration for 100MHz reference clock. The same SSC is used for both PCIe and USB. Signed-off-by: Swapnil Jakhade Co-developed-by: Siddharth Vadapalli Signed-off-by: Siddharth Vadapalli Reviewed-by: Roger Quadros Link: https://lore.kernel.org/r/20250616064705.3225758-3-s-vadapalli@ti.com Signed-off-by: Vinod Koul commit 240ef19ad78b12e40ec8808694a0b81e6a3a2c2d Author: Swapnil Jakhade Date: Mon Jun 16 12:17:04 2025 +0530 phy: cadence-torrent: Add PCIe multilink configuration for 100 MHz refclk Add register sequences to support PCIe multilink configuration for 100MHz reference clock. Maximum two PCIe links are supported. Signed-off-by: Swapnil Jakhade Signed-off-by: Siddharth Vadapalli Reviewed-by: Roger Quadros Link: https://lore.kernel.org/r/20250616064705.3225758-2-s-vadapalli@ti.com Signed-off-by: Vinod Koul commit 3091bd44cdf3bfd506a25d8bdba5a2bd1d59574b Author: Matt Roper Date: Fri Jun 13 14:47:53 2025 -0700 drm/xe/pat: Consolidate PAT programming logic for pre-Xe2 and post-Xe2 Now that the PAT settings for the new special entries introduced by Xe2 are decided during early software init and left NULL on platforms they don't apply to, there's no need to keep separate programming functions for pre-Xe2 and post-Xe2 platforms. Consolidate down to a single pair of programming functions (mcr and non-mcr) that can be used on any platform. Reviewed-by: Tejas Upadhyay Link: https://lore.kernel.org/r/20250613214751.792066-4-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 564e1a82fb3722ca27a821fd39b4479595a7b1fb Author: Matt Roper Date: Fri Jun 13 14:47:52 2025 -0700 drm/xe/pat: Determine ATS / PTA programming during early sw init Decide whether programming of the special ATS and PTA PAT entries is necessary (and which entries should be programmed) during early software initialization rather than hardcoding this into the 'program' functions. Future platforms may want to re-use the same functions but utilize different special entry values. Consolidating all of the decisions into one place keeps things simple. Reviewed-by: Tejas Upadhyay Link: https://lore.kernel.org/r/20250613214751.792066-3-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit 4f599219f71399ac2092d2e06b2cc38e50c45c53 Author: Christian Brauner Date: Thu Jun 12 15:25:26 2025 +0200 coredump: move core_pipe_count to global variable The pipe coredump counter is a static local variable instead of a global variable like all of the rest. Move it to a global variable so it's all consistent. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-12-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit a961c737cda8f172e108da881691cadafb9a061e Author: Christian Brauner Date: Thu Jun 12 15:25:25 2025 +0200 coredump: prepare to simplify exit paths The exit path is currently entangled with core pipe limit accounting which is really unpleasant. Use a local variable in struct core_name that remembers whether the count was incremented and if so to clean decrement in once the coredump is done. Assert that this only happens for pipes. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-11-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 7bbb05dbea38e56d9f6ac7ac1040f93b0808cbce Author: Christian Brauner Date: Thu Jun 12 15:25:24 2025 +0200 coredump: split file coredumping into coredump_file() * Move that whole mess into a separate helper instead of having all that hanging around in vfs_coredump() directly. * Stop using that need_suid_safe variable and add an inline helper that clearly communicates what's going on everywhere consistently. The mm flag snapshot is stable and can't change so nothing's gained with that boolean. * Only setup cprm->file once everything else succeeded, using RAII for the coredump file before. That allows to don't care to what goto label we jump in vfs_coredump(). Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-10-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 70e3ee31282d293c794fb5bbec8efe495c32044b Author: Christian Brauner Date: Thu Jun 12 15:25:23 2025 +0200 coredump: rename do_coredump() to vfs_coredump() Align the naming with the rest of our helpers exposed outside of core vfs. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-9-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 8a25350fa430a28d0595a6d14af661d4f151b123 Author: Christian Brauner Date: Thu Jun 12 15:25:22 2025 +0200 selftests/coredump: make sure invalid paths are rejected Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-8-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 6dfc06d328b70af22c577bb908c97f8841b9f4fc Author: Christian Brauner Date: Thu Jun 12 15:25:21 2025 +0200 coredump: validate socket path in coredump_parse() properly again. Someone might have modified the buffer concurrently. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-7-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit edfe3bdbbb52339cd8c2366402f2702c5ebc15c7 Author: Christian Brauner Date: Thu Jun 12 15:25:20 2025 +0200 coredump: don't allow ".." in coredump socket path There's no point in allowing to walk upwards for the coredump socket. We already force userspace to give use a sane path, no symlinks, no magiclinks, and also block "..". Use an absolute path without any shenanigans. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-6-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 0da3e3822cfabf062945e449f91ea3ca529eeaa4 Author: Christian Brauner Date: Thu Jun 12 15:25:19 2025 +0200 fs: move name_contains_dotdot() to header Move the helper from the firmware specific code to a header so we can reuse it for coredump sockets. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-5-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 3a2c977c463c68bf6fcd0138d15efa5f3adc743c Author: Christian Brauner Date: Thu Jun 12 15:25:18 2025 +0200 coredump: validate that path doesn't exceed UNIX_PATH_MAX so we don't pointlessly accepts things that go over the limit. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-4-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit 67c3a0b0ad1a78d7ee9c3aadaed22561f7f85466 Author: Christian Brauner Date: Thu Jun 12 15:25:17 2025 +0200 coredump: fix socket path validation Make sure that we keep it extensible and well-formed. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-3-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit a5715af549b2ee0139ff965d337cfd1a5f7ee615 Author: Christian Brauner Date: Thu Jun 12 15:25:16 2025 +0200 coredump: make coredump_parse() return bool There's no point in returning negative error values. They will never be seen by anyone. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-2-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit fb4366ba8f1c86a72ffcb2b6f349e05cf77897d0 Author: Christian Brauner Date: Thu Jun 12 15:25:15 2025 +0200 coredump: rename format_corename() It's not really about the name anymore. It parses very distinct information. Reflect that in the name. Link: https://lore.kernel.org/20250612-work-coredump-massage-v1-1-315c0c34ba94@kernel.org Signed-off-by: Christian Brauner commit bc9241367aac08de44633fd957b2452a6da8e6d4 Author: NeilBrown Date: Fri Jun 13 09:28:10 2025 +1000 VFS: change old_dir and new_dir in struct renamedata to dentrys all users of 'struct renamedata' have the dentry for the old and new directories, and often have no use for the inode except to store it in the renamedata. This patch changes struct renamedata to hold the dentry, rather than the inode, for the old and new directories, and changes callers to match. The names are also changed from a _dir suffix to _parent. This is consistent with other usage in namei.c and elsewhere. This results in the removal of several local variables and several dereferences of ->d_inode at the cost of adding ->d_inode dereferences to vfs_rename(). Acked-by: Miklos Szeredi Reviewed-by: Chuck Lever Reviewed-by: Namjae Jeon Signed-off-by: NeilBrown Link: https://lore.kernel.org/174977089072.608730.4244531834577097454@noble.neil.brown.name Signed-off-by: Christian Brauner commit 42398caf16c955251a2dab86f797b76adeb99899 Author: Thomas Huth Date: Wed Jun 11 16:00:46 2025 +0200 s390: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembler code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This is bad since macros starting with two underscores are names that are reserved by the C language. It can also be very confusing for the developers when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's now standardize on the __ASSEMBLER__ macro that is provided by the compilers. This is a completely mechanical patch (done with a simple "sed -i" statement), with some manual fixups done later while rebasing the patch. Signed-off-by: Thomas Huth Acked-by: Heiko Carstens Link: https://lore.kernel.org/r/20250611140046.137739-3-thuth@redhat.com Signed-off-by: Alexander Gordeev commit 9b27182c553542118c5bbfdd89bab28e460ffdc8 Author: Thomas Huth Date: Wed Jun 11 16:00:45 2025 +0200 s390: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembler code. Signed-off-by: Thomas Huth Acked-by: Heiko Carstens Link: https://lore.kernel.org/r/20250611140046.137739-2-thuth@redhat.com Signed-off-by: Alexander Gordeev commit b5ba648a7dd2b42725ae2d07335f0551111437a2 Author: Al Viro Date: Sun Jun 15 01:33:21 2025 +0100 proc_fd_getattr(): don't bother with S_ISDIR() check that thing is callable only as ->i_op->getattr() instance and only for directory inodes (/proc/*/fd and /proc/*/task/*/fd) Signed-off-by: Al Viro Link: https://lore.kernel.org/20250615003321.GC3011112@ZenIV Reviewed-by: Christian Brauner Signed-off-by: Christian Brauner commit 88b1de54979c7ac8b1faec646c600ce66f0da24e Author: Al Viro Date: Sun Jun 15 01:32:16 2025 +0100 don't duplicate vfs_open() in kernel_file_open() Signed-off-by: Al Viro Link: https://lore.kernel.org/20250615003216.GB3011112@ZenIV Reviewed-by: Christian Brauner Signed-off-by: Christian Brauner commit aa9bb1b32594cd67cafd29b330b158128b503882 Author: Baoquan He Date: Sat Jun 14 10:23:42 2025 +0800 ima: add a knob ima= to allow disabling IMA in kdump kernel Kdump kernel doesn't need IMA functionality, and enabling IMA will cost extra memory. It would be very helpful to allow IMA to be disabled for kdump kernel. Hence add a knob ima=on|off here to allow turning IMA off in kdump kernel if needed. Note that this IMA disabling is limited to kdump kernel, please don't abuse it in other kernel and thus serious consequences are caused. Signed-off-by: Baoquan He Signed-off-by: Mimi Zohar commit cc6d1098b4cca6ec8e659de8361457c59a90b583 Author: FUJITA Tomonori Date: Tue Jun 10 18:32:56 2025 +0900 rust: time: Add ktime_get() to ClockSource trait Introduce the ktime_get() associated function to the ClockSource trait, allowing each clock source to specify how it retrieves the current time. This enables Instant::now() to be implemented generically using the type-level ClockSource abstraction. This change enhances the type safety and extensibility of timekeeping by statically associating time retrieval mechanisms with their respective clock types. It also reduces the reliance on hardcoded clock logic within Instant. Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250610093258.3435874-4-fujita.tomonori@gmail.com Signed-off-by: Andreas Hindborg commit 768dfbfc98e26cfad45f7165a1801d188f3cbd81 Author: FUJITA Tomonori Date: Tue Jun 10 18:32:55 2025 +0900 rust: time: Make Instant generic over ClockSource Refactor the Instant type to be generic over a ClockSource type parameter, enabling static enforcement of clock correctness across APIs that deal with time. Previously, the clock source was implicitly fixed (typically CLOCK_MONOTONIC), and developers had to ensure compatibility manually. This design eliminates runtime mismatches between clock sources, and enables stronger type-level guarantees throughout the timer subsystem. Reviewed-by: Andreas Hindborg Reviewed-by: Boqun Feng Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250610093258.3435874-3-fujita.tomonori@gmail.com Signed-off-by: Andreas Hindborg commit 1664a671be46a0b0daf5250eb124d94a5501a64c Author: FUJITA Tomonori Date: Tue Jun 10 18:32:54 2025 +0900 rust: time: Replace ClockId enum with ClockSource trait Replace the ClockId enum with a trait-based abstraction called ClockSource. This change enables expressing clock sources as types and leveraging the Rust type system to enforce clock correctness at compile time. This also sets the stage for future generic abstractions over Instant types such as Instant. Reviewed-by: Andreas Hindborg Reviewed-by: Boqun Feng Signed-off-by: FUJITA Tomonori Link: https://lore.kernel.org/r/20250610093258.3435874-2-fujita.tomonori@gmail.com Signed-off-by: Andreas Hindborg commit 1b7bbd5975279a1cf8d907fbc719f350031194c2 Author: FUJITA Tomonori Date: Fri May 2 09:45:24 2025 +0900 rust: time: Avoid 64-bit integer division on 32-bit architectures Avoid 64-bit integer division that 32-bit architectures don't implement generally. This uses ktime_to_us() and ktime_to_ms() instead. The time abstraction needs i64 / u32 division so C's div_s64() can be used but ktime_to_us() and ktime_to_ms() provide a simpler solution for this time abstraction problem on 32-bit architectures. 32-bit ARM is the only 32-bit architecture currently supported by Rust. Using the cfg attribute, only 32-bit architectures will call ktime_to_us() and ktime_to_ms(), while the other 64-bit architectures will continue to use the current code as-is to avoid the overhead. One downside of calling the C's functions is that the as_micros/millis methods can no longer be const fn. We stick with the simpler approach unless there's a compelling need for a const fn. Suggested-by: Arnd Bergmann Suggested-by: Boqun Feng Signed-off-by: FUJITA Tomonori Reviewed-by: Andreas Hindborg Link: https://lore.kernel.org/r/20250502004524.230553-1-fujita.tomonori@gmail.com Signed-off-by: Andreas Hindborg commit dce4bc30f42d313b4dc5832316196411b7f07ad0 Author: Lukas Bulwahn Date: Mon Jun 16 11:19:55 2025 +0200 spi: spi-fsl-dspi: Revert unintended dependency change in config SPI_FSL_DSPI Commit 9a30e332c36c ("spi: spi-fsl-dspi: Enable support for S32G platforms") reworks the dependencies of config SPI_FSL_DSPI, but introduces a typo changing the dependency to M5441x to a dependency on a non-existing config M54541x. Revert the unintended change to depend on the config M5441x. Fixes: 9a30e332c36c ("spi: spi-fsl-dspi: Enable support for S32G platforms") Signed-off-by: Lukas Bulwahn Reviewed-by: James Clark Link: https://patch.msgid.link/20250616091955.20547-1-lukas.bulwahn@redhat.com Signed-off-by: Mark Brown commit 47972c1c3315672352f25c68f91dd88543541947 Author: Sachin Mokashi Date: Fri Jun 13 12:35:30 2025 -0400 ASoC: Intel: Replace deprecated strcpy() with strscpy() strcpy() is deprecated, use strscpy() instead. As strcpy() performs no bounds checking on the destination buffer. This could result in buffer overflow. The safe replacement is strscpy(). Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Sachin Mokashi Link: https://patch.msgid.link/20250613163530.1165690-1-sachin.mokashi@intel.com Signed-off-by: Mark Brown commit e7af416aebb36e6681b9c6950d0f6352aee7c084 Author: Richard Fitzgerald Date: Mon Jun 16 11:30:52 2025 +0100 firmware: cs_dsp: Remove unused struct list_head from cs_dsp_coeff_ctl Remove two unused pointers from struct cs_dsp_coeff_ctl by taking the struct list_head out of struct cs_dsp_alg_region. On a x86_64 build this saves 16 bytes per control. Each cs_dsp_coeff_ctl instance needs to keep information about the algorithm region it refers to. This is done by embedding an instance of struct cs_dsp_alg_region. But cs_dsp_alg_region was also used to store entries in a list of algorithm regions, and so had a struct list_head object for that purpose. This list_head object is not used with the embedded object in struct cs_dsp_alg_region so was just wasted bytes. A new struct cs_dsp_alg_region_list_item has been defined for creating the list of algorithm regions. It contains a struct cs_dsp_alg_region and a struct list_head. Signed-off-by: Richard Fitzgerald Link: https://patch.msgid.link/20250616103052.66537-1-rf@opensource.cirrus.com Signed-off-by: Mark Brown commit ea78eed7a451375fc8d604bbe3db55be5779eb7d Author: Srinivas Pandruvada Date: Fri Jun 13 14:49:23 2025 -0700 thermal: intel: int340x: Allow temperature override Add debugfs interface to override hardware provide temperature. This interface can be used primarily for debug. Alternatively this can be also used to use hardware control loops to manage temperature for virtual sensors. Virtual sensors are soft sensors created by kernel/ user space aggregating other sensors. There are three attributes to override the maximum three instances of platform temperature control. /sys/kernel/debug/platform_temperature_control/ ├── temperature_0 ├── temperature_1 └── temperature_2 These are write only attributes requires admin privilege. Any value greater than 0, will override the temperature. A value of 0 will stop overriding the temperature. Signed-off-by: Srinivas Pandruvada Reviewed-by: Zhang Rui Link: https://patch.msgid.link/20250613214923.2910397-2-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 7954001a769a174f70d770c360fbff0d99dc51d4 Author: Srinivas Pandruvada Date: Fri Jun 13 14:49:22 2025 -0700 thermal: intel: int340x: Add throttling control interface to PTC Firmware-based thermal temperature control loops may aggressively throttle performance to prevent temperature overshoots relative to the defined target temperature. This can negatively impact performance. User space may prefer to prioritize performance, even if it results in temperature overshoots with in acceptable range. For example, user space might tolerate temperature overshoots when the device is placed on a desk, as opposed to when it's on a lap. To accommodate such scenarios, an optional attribute is provided to specify a tolerance level for temperature overshoots while maintaining acceptable performance. Attribute: thermal_tolerance: This attribute ranges from 0 to 7, where 0 represents the most aggressive control to avoid any temperature overshoots, and 7 represents a more graceful approach, favoring performance even at the expense of temperature overshoots. Note: This level may not scale linearly. For example, a value of 3 does not necessarily imply a 50% improvement in performance compared to a value of 0. Signed-off-by: Srinivas Pandruvada Reviewed-by: Zhang Rui Link: https://patch.msgid.link/20250613214923.2910397-1-srinivas.pandruvada@linux.intel.com Signed-off-by: Rafael J. Wysocki commit 5e861a695a39263123cdc086934b7336dbe6946d Author: Andrzej Kacprowski Date: Thu Jun 5 18:20:01 2025 +0200 accel/ivpu: Add turbo flag to the DRM_IVPU_CMDQ_CREATE ioctl Introduce a new parameter to the DRM_IVPU_CMDQ_CREATE ioctl, enabling turbo mode for jobs submitted via the command queue. Turbo mode allows jobs to run at higher frequencies, potentially improving performance for demanding workloads. Also adds the IVPU_TEST_MODE_TURBO_DISABLE flag to allow test mode to explicitly disable turbo mode requested by the application. The IVPU_TEST_MODE_TURBO mode has been renamed to IVPU_TEST_MODE_TURBO_ENABLE for clarity and consistency. Signed-off-by: Andrzej Kacprowski Signed-off-by: Maciej Falkowski Reviewed-by: Jeff Hugo Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250605162001.1237789-1-maciej.falkowski@linux.intel.com commit 83464405063b256bc73c15a1d1d8dc902163600f Author: Maciej Falkowski Date: Thu Jun 5 18:19:47 2025 +0200 accel/ivpu: Add initial Wildcat Lake support Add support for Wildcat Lake (WCL) CPUs. Wildcat Lake contains NPU5 just like Panther Lake hence the initial support is very simple and adds only PCI IDs. Signed-off-by: Maciej Falkowski Reviewed-by: Jeff Hugo Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250605161947.1237727-1-maciej.falkowski@linux.intel.com commit ce5cac69b2edac3e3246fee03e8f4c2a1075238b Author: Alex Guo Date: Sun Jun 15 21:32:31 2025 -0400 media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() In dib7090p_rw_on_apb, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar issue occurs when access msg[1].buf[0] and msg[1].buf[1]. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Alex Guo Link: https://lore.kernel.org/r/20250616013231.730221-1-alexguo1023@gmail.com Signed-off-by: Mauro Carvalho Chehab commit ed0234c8458b3149f15e496b48a1c9874dd24a1b Author: Alex Guo Date: Sun Jun 15 21:33:53 2025 -0400 media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar In w7090p_tuner_write_serpar, msg is controlled by user. When msg[0].buf is null and msg[0].len is zero, former checks on msg[0].buf would be passed. If accessing msg[0].buf[2] without sanity check, null pointer deref would happen. We add check on msg[0].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Signed-off-by: Alex Guo Link: https://lore.kernel.org/r/20250616013353.738790-1-alexguo1023@gmail.com Signed-off-by: Mauro Carvalho Chehab commit a8365bfb249907069fb584a535d03c291157ddbb Author: Krzysztof Kozlowski Date: Thu Jun 12 15:44:23 2025 +0200 arm64: defconfig: Drop unneeded unselectable sound drivers SND_SOC_ES8328 is selected by SND_SOC_ES8328_I2C. SND_SOC_WCD939X is selected by SND_SOC_WCD939X. None of these are user-visible options so their presence in defconfig is redundant. Link: https://lore.kernel.org/r/20250612134421.95782-4-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 927f1259c517ec0dc589f5014c4edbdc87591cd8 Author: Krzysztof Kozlowski Date: Thu Jun 12 15:44:22 2025 +0200 arm64: defconfig: Switch SOUND to module Sound drivers are not essential to boot boards or mount rootfs, therefore in effort to reduce the size of kernel image (and boot images) switch the ASoC drivers to modules to decrease the size: vmlinux: 154528 kB -> 152864 kB Image: 39391 kB -> 39067 kB No difference in resulting include/generated/autoconf.h, except making modules: SND_SOC_SAMSUNG, SND_SOC_SDCA_OPTIONAL, SND_SOC_APPLE_MCA, SND_TIMER, SND_COMPRESS_OFFLOAD, SND_PCM, SND_SOC_SOF_OF and SND_DMAENGINE_PCM. Suggested-by: Geert Uytterhoeven Acked-by: Arnd Bergmann Acked-by: Sven Peter Link: https://lore.kernel.org/r/20250612134421.95782-3-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 33b4e4fcd2980ee5fd754731ca9b0325f0344f04 Author: Thomas Zimmermann Date: Mon Jun 2 09:51:44 2025 +0200 video: Make global edid_info depend on CONFIG_FIRMWARE_EDID Protect global edid_info behind CONFIG_FIRMWARE_EDID and remove the config tests for CONFIG_X86. Makes edid_info available iff its option has been enabled. Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Link: https://lore.kernel.org/r/20250602075537.137759-3-tzimmermann@suse.de commit 7e35fc7ab433683f95cd1e7e397772db995bebf8 Author: Thomas Zimmermann Date: Mon Jun 2 09:51:43 2025 +0200 video: Make CONFIG_FIRMWARE_EDID generally available DRM drivers such as efidrm and vesadrm can export firmware EDID data to userspace. Make the related option CONFIG_FIRMWARE_EDID available without CONFIG_FB. Make it depend on X86, which is currently the only architecture providing EDID information. Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Link: https://lore.kernel.org/r/20250602075537.137759-2-tzimmermann@suse.de commit 367864935785382bab95f5e5a691535d28f5a21b Author: Stefan Wahren Date: Sat Jun 14 13:12:16 2025 +0200 gpio: raspberrypi-exp: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Stefan Wahren Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250614111216.93677-1-wahrenst@gmx.net Signed-off-by: Bartosz Golaszewski commit bddfad9f7ef3fc73f0a6fb05996719adcb5082fc Author: Krzysztof Kozlowski Date: Fri Jun 13 09:16:28 2025 +0200 gpio: sloppy-logic-analyzer: Fully open-code compatible for grepping It is very useful to find driver implementing compatibles with `git grep compatible`, so driver should not use defines for that string, even if this means string will be effectively duplicated. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Wolfram Sang Link: https://lore.kernel.org/r/20250613071627.46687-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bartosz Golaszewski commit 7b2c2f1eb3914f5214a5b2ae966d7d7bb0057582 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:34 2025 +0200 gpio: Use dev_fwnode() where applicable across drivers irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper where applicable. Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20250611104348.192092-6-jirislaby@kernel.org [Bartosz: tweaked the commit message] Signed-off-by: Bartosz Golaszewski commit 0a99f2d8ff5b31c3aaa70b23bde58692d1300bdc Author: David Lechner Date: Wed Jun 11 13:50:26 2025 -0500 gpio: virtuser: use gpiod_multi_set_value_cansleep() Reduce verbosity by using gpiod_multi_set_value_cansleep() instead of gpiod_set_array_value_cansleep(). Signed-off-by: David Lechner Link: https://lore.kernel.org/r/20250611-gpio-virtuser-use-gpiod_multi_set_value_cansleep-v1-1-43b4adf6c807@baylibre.com Signed-off-by: Bartosz Golaszewski commit 629c1a9c2df9df3a71e91e253e29c4e420898733 Author: Thomas Zimmermann Date: Thu Jun 12 10:16:37 2025 +0200 fbdev/viafb: Do not include Fix the compile-time warning drivers/video/fbdev/via/via-gpio.c: warning: EXPORT_SYMBOL() is not used, but #include is present Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-15-tzimmermann@suse.de commit b6c6264adb3379a8aecc59699596cd19b1d1fc3f Author: Thomas Zimmermann Date: Thu Jun 12 10:16:36 2025 +0200 fbdev/viafb: Include Fix the compile-time warnings drivers/video/fbdev/via/via-core.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/via/via_i2c.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-14-tzimmermann@suse.de commit c8f796f6e6e97168ffa49deab0dd32a127994f74 Author: Thomas Zimmermann Date: Thu Jun 12 10:16:35 2025 +0200 fbdev/sisfb: Unexport symbols Fix the compile-time warning drivers/video/fbdev/sis/sis_main.c: warning: EXPORT_SYMBOL() is used, but #include is missing The affected symbols are not used outside of their module. Some of the symbols are not used anywhere, so remove the functions entirely. Also remove the related, but unused, define SISFB_HAVE_MALLOC_NEW. v2: - remove unused functions (Helge) Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-13-tzimmermann@suse.de commit 9bf9f98d00df53b32b83e03c0e7f06e8a0fdaf0b Author: Thomas Zimmermann Date: Thu Jun 12 10:16:34 2025 +0200 fbdev/pxafb: Unexport symbol Fix the compile-time warning drivers/video/fbdev/pxafb.c: warning: EXPORT_SYMBOL() is used, but #include is missing The affected symbol is not used anywhere, so remove the function entirely. v2: - remove unused functions (Helge) Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-12-tzimmermann@suse.de commit a27886399d8f55130935e1a1ab21ff47656f458e Author: Thomas Zimmermann Date: Thu Jun 12 10:16:33 2025 +0200 fbdev/mb862xx: Do not include Fix the compile-time warning drivers/video/fbdev/mb862xx/mb862xx-i2c.c: warning: EXPORT_SYMBOL() is not used, but #include is present Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-11-tzimmermann@suse.de commit 660c06ed2fad50d5d03438be2e3a2a688c127c7e Author: Thomas Zimmermann Date: Thu Jun 12 10:16:32 2025 +0200 fbdev/omap2: Do not include Fix the compile-time warnings drivers/video/fbdev/omap2/omapfb/dss/dpi.c: warning: EXPORT_SYMBOL() is not used, but #include is present drivers/video/fbdev/omap2/omapfb/dss/sdi.c: warning: EXPORT_SYMBOL() is not used, but #include is present drivers/video/fbdev/omap2/omapfb/omapfb-ioctl.c: warning: EXPORT_SYMBOL() is not used, but #include is present Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-10-tzimmermann@suse.de commit c5bdc45251eefda90752851b434f96e3582d24d7 Author: Thomas Zimmermann Date: Thu Jun 12 10:16:31 2025 +0200 fbdev/omap2: Include Fix the compile-time warnings drivers/video/fbdev/omap2/omapfb/dss/apply.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap2/omapfb/dss/core.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap2/omapfb/dss/dispc-compat.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap2/omapfb/dss/display.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap2/omapfb/dss/dss-of.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap2/omapfb/dss/dss_features.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap2/omapfb/dss/manager.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap2/omapfb/dss/output.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap2/omapfb/dss/overlay.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap2/omapfb/dss/venc.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap2/omapfb/vrfb.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-9-tzimmermann@suse.de commit 7300225bb39ab2272200cce47f4ac061025a029b Author: Thomas Zimmermann Date: Thu Jun 12 10:16:30 2025 +0200 fbdev/omap: Include Fix the compile-time warnings drivers/video/fbdev/omap/lcd_dma.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap/lcdc.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/omap/omapfb_main.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-8-tzimmermann@suse.de commit a93f45d2553d05277627ecb5f13162520bce28e2 Author: Thomas Zimmermann Date: Thu Jun 12 10:16:29 2025 +0200 fbdev/matroxfb: Include Fix the compile-time warnings drivers/video/fbdev/matrox/g450_pll.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/matrox/matroxfb_DAC1064.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/matrox/matroxfb_Ti3026.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/matrox/matroxfb_accel.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/matrox/matroxfb_base.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/matrox/matroxfb_g450.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/matrox/matroxfb_misc.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-7-tzimmermann@suse.de commit c70993bcd5b252802e8b0d5b7cd091d5763656f9 Author: Thomas Zimmermann Date: Thu Jun 12 10:16:28 2025 +0200 fbdev/matroxfb: Remove trailing whitespaces Fix coding style. Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Link: https://lore.kernel.org/r/20250612081738.197826-6-tzimmermann@suse.de commit 3bb0aeb60aa5c62870b51dcf9cf705b8339be24d Author: Thomas Zimmermann Date: Thu Jun 12 10:16:27 2025 +0200 fbdev/cyber2000fb: Unexport symbols Fix the compile-time warning drivers/video/fbdev/cyber2000fb.c: warning: EXPORT_SYMBOL() is used, but #include is missing The affected symbols are not used anywhere, so remove the functions entirely. v2: - remove unused functions (Helge) Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-5-tzimmermann@suse.de commit 5f13d0ff490d6ab3e81f7baf03753e61d552f383 Author: Thomas Zimmermann Date: Thu Jun 12 10:16:26 2025 +0200 fbdev/c2p: Include Fix the compile-time warnings drivers/video/fbdev/c2p_iplan2.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/c2p_planar.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-4-tzimmermann@suse.de commit 2b043314013a7ba0a80d6fa0e75ac79529598615 Author: Thomas Zimmermann Date: Thu Jun 12 10:16:25 2025 +0200 fbdev: Include Fix the compile-time warnings drivers/video/fbdev/core/cfbcopyarea.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/cfbfillrect.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/cfbimgblt.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/fb_ddc.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/fb_defio.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/fb_io_fops.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/fb_sys_fops.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/fbcmap.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/fbcon.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/fbmon.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/modedb.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/svgalib.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/syscopyarea.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/sysfillrect.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/core/sysimgblt.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/macmodes.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/sbuslib.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/video/fbdev/wmt_ge_rops.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612081738.197826-3-tzimmermann@suse.de commit 7a1e3093c49b977d8f0cf95d08a9da532e7db587 Author: Thomas Zimmermann Date: Thu Jun 12 10:16:24 2025 +0200 fbdev: Remove trailing whitespaces Fix coding style. Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Link: https://lore.kernel.org/r/20250612081738.197826-2-tzimmermann@suse.de commit af5ea7d8a30512de2836175bd7aa9ae0bba94bad Author: Thomas Zimmermann Date: Thu Jun 12 14:10:03 2025 +0200 drm/ttm: Include Fix the compile-time warnings drivers/gpu/drm/ttm/tests/ttm_kunit_helpers.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/tests/ttm_mock_manager.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_agp_backend.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_backup.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_bo.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_bo_util.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_bo_vm.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_device.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_execbuf_util.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_pool.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_range_manager.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_resource.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/ttm/ttm_tt.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Reviewed-by: André Almeida Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612121633.229222-10-tzimmermann@suse.de commit 815e1af00e302efca4b2d31736dca7034ebe435a Author: Thomas Zimmermann Date: Thu Jun 12 14:10:02 2025 +0200 drm/scheduler: Include Fix the compile-time warnings drivers/gpu/drm/scheduler/sched_entity.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/scheduler/sched_fence.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/scheduler/sched_main.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Reviewed-by: André Almeida Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612121633.229222-9-tzimmermann@suse.de commit 9bd66ab7a6a51d87242efb4f4c3fc2879a08f503 Author: Thomas Zimmermann Date: Thu Jun 12 14:10:01 2025 +0200 drm/panel: Include Fix the compile-time warnings drivers/gpu/drm/drm_panel.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_panel_backlight_quirks.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_panel_orientation_quirks.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/panel/panel-samsung-s6e63m0.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Reviewed-by: André Almeida Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612121633.229222-8-tzimmermann@suse.de commit 714b79f7f416eae2b6d7d3b747deb7a498b4b87f Author: Thomas Zimmermann Date: Thu Jun 12 14:10:00 2025 +0200 drm/gem: Include Fix the compile-time warnings drivers/gpu/drm/drm_gem.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_gem_atomic_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_gem_framebuffer_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_gem_ttm_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_gem_vram_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Reviewed-by: André Almeida Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612121633.229222-7-tzimmermann@suse.de commit 8f194494fd84a205eee9d1d86f1ea2c9ba2f20b9 Author: Thomas Zimmermann Date: Thu Jun 12 14:09:59 2025 +0200 drm/display: Include Fix the compile-time warnings drivers/gpu/drm/display/drm_bridge_connector.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_dp_aux_bus.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_dp_cec.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_dp_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_dp_mst_topology.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_dp_tunnel.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_dsc_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_hdmi_audio_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_hdmi_cec_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_hdmi_cec_notifier_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_hdmi_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_hdmi_state_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/display/drm_scdc_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Reviewed-by: André Almeida Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612121633.229222-6-tzimmermann@suse.de commit 8b7a4b100c783218378a67a4113939f92b455104 Author: Thomas Zimmermann Date: Thu Jun 12 14:09:58 2025 +0200 drm/client: Include Fixes the compile-time warnings drivers/gpu/drm/clients/drm_client_setup.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_client.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_client_event.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_client_modeset.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_fb_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_fbdev_dma.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_fbdev_shmem.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_fbdev_ttm.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Reviewed-by: André Almeida Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612121633.229222-5-tzimmermann@suse.de commit 8c7c767a5efb69f26f62a728eadec3fee4fa372e Author: Thomas Zimmermann Date: Thu Jun 12 14:09:57 2025 +0200 drm/bridge: Include Fix compile-time warnings drivers/gpu/drm/bridge/analogix/analogix-i2c-dptx.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/bridge/analogix/analogix_dp_core.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/bridge/aux-bridge.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/bridge/aux-hpd-bridge.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/bridge/imx/imx-legacy-bridge.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/bridge/panel.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/bridge/samsung-dsim.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/bridge/synopsys/dw-hdmi-qp.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/bridge/synopsys/dw-hdmi.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi2.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_bridge.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_bridge_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Reviewed-by: André Almeida Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612121633.229222-4-tzimmermann@suse.de commit 09cba36cc840f39fb1d712193593083edd7a46e1 Author: Thomas Zimmermann Date: Thu Jun 12 14:09:56 2025 +0200 drm: Include Fix the compile-time warnings drivers/gpu/drm/drm_atomic.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_atomic_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_atomic_state_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_atomic_uapi.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_auth.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_buddy.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_color_mgmt.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_connector.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_damage_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_debugfs_crc.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_drv.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_edid.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_exec.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_fb_dma_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_file.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_flip_work.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_format_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_gpusvm.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_gpuvm.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_managed.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_mipi_dbi.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_mipi_dsi.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_mode_config.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_modeset_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_modeset_lock.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_panic.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_plane.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_plane_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_print.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_privacy_screen.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_self_refresh_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_simple_kms_helper.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_suballoc.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_syncobj.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_vblank_work.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_vma_manager.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/drm_writeback.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/lib/drm_random.c: warning: EXPORT_SYMBOL() is used, but #include is missing drivers/gpu/drm/tests/drm_kunit_helpers.c: warning: EXPORT_SYMBOL() is used, but #include is missing Signed-off-by: Thomas Zimmermann Fixes: a934a57a42f6 ("scripts/misc-check: check missing #include when W=1") Reviewed-by: André Almeida Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612121633.229222-3-tzimmermann@suse.de commit 22e28f06df3bf63004e1579f5b1601069182fdde Author: Thomas Zimmermann Date: Thu Jun 12 14:09:55 2025 +0200 drm: Do not include Fix the compile-time error drivers/gpu/drm/drm_pci.c: warning: EXPORT_SYMBOL() is not used, but #include is present Signed-off-by: Thomas Zimmermann Fixes: 7d95680d64ac ("scripts/misc-check: check unnecessary #include when W=1") Reviewed-by: André Almeida Cc: Masahiro Yamada Cc: Nathan Chancellor Link: https://lore.kernel.org/r/20250612121633.229222-2-tzimmermann@suse.de commit 4d2c3d70799f5eb210003613766bbd113bbebc1a Author: Niklas Söderlund Date: Fri Jun 13 17:34:34 2025 +0200 media: rcar-vin: Fold event notifier into only user With Gen2 converted to use the common media device there is only one caller left for the helper to notify a video device of an event, fold it in. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-14-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 6d2efcb0979ae50176ad8340e27b930ccddfe9b5 Author: Niklas Söderlund Date: Fri Jun 13 17:34:33 2025 +0200 media: rcar-vin: Enable media-graph on Gen2 Complete the conversion from soc_camera to a full fledge media controller enabled devices for all supported generations of the device. All work is already done as this is already supported on Gen3, and later. All that is missing is removing all special cases for the non media-graph call paths and use the common ones in their place. The one change that stands out is dropping the doubling of the height in the Gen2 scaler setup, rvin_scaler_gen2(). In the Gen2 non-MC world the VIN size was set to match the video source subdevices, and if that was a TOP/BOTTOM video source it needed to be doubled for the scaler to function properly. In the MC world this is now handled by user-space configuration of the pipeline and the adjustment is not needed. Mark the completion of converting from soc_camera by injecting an attribution of myself in the header. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-13-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit f9e4d4b1ce389b44942a59bf0878921922d8604d Author: Niklas Söderlund Date: Fri Jun 13 17:34:32 2025 +0200 media: rcar-vin: Only expose VIN controls Before moving Gen2 to media controller simplify the creation of controls by not exposing the sub-device controls on the video device. This could be done while enabling media controller but doing it separately reduces the changes needed to do so. The rework also allows the cleanup and remove paths to be simplified by folding all special cases into the only remaining call site. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-12-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit a4b278e92de02ef63874e98719c25912546518a3 Author: Niklas Söderlund Date: Fri Jun 13 17:34:31 2025 +0200 media: rcar-vin: Remove NTSC workaround On Gen2 where sub-devices where not exposed to user-space the field TB/BT ordering was controlled by a hack in the VIN driver. Before converting it to media device model where the subdevice is exposed remove that hack. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-11-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 257d994a6f81630b56f6393ed9ad8dbfbe10ff20 Author: Niklas Söderlund Date: Fri Jun 13 17:34:30 2025 +0200 media: rcar-vin: Always create a media pad Prepare for Gen2 media graph support by always initializing a media pad for the VIN device. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-10-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 856b49c71ae58adeb0836c30a22c830593583141 Author: Niklas Söderlund Date: Fri Jun 13 17:34:29 2025 +0200 media: rcar-vin: Merge all notifiers The VIN usage of v4l-async is complex and stems from organic growth of the driver of supporting both private local subdevices (Gen2, Gen3) and subdevices shared between all VIN instances (Gen3 and Gen4). The driver used a separate notifier for each VIN for the private local ones, and a shared group notifier for the shared ones. This was complex and lead to subtle bugs when unbinding and later rebinding subdevices in one of the notifiers having to handle different edge cases depending on if it also had subdevices in the other notifiers etc. To simplify this have the Gen2 devices allocate and form a VIN group too. This way all subdevices on all models can be collect in a single group notifier. Then there is only a single complete callback for all where the video devices and subdevice nodes can be registered etc. Signed-off-by: Niklas Söderlund Tested-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-9-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 11e14a525765db6a71c5c9291140a28682ff3b1b Author: Niklas Söderlund Date: Fri Jun 13 17:34:28 2025 +0200 media: rcar-vin: Improve error paths for parallel devices Use the __free(fwnode_handle) hooks to free the endpoints when the function exits to simplify the error paths and make the intent more clear. While at it correct the error message when failing to parse an endpoint to report the correct node. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-8-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit a3e4aad92429f8b66ef6492d4e5caff9d11a94ee Author: Niklas Söderlund Date: Fri Jun 13 17:34:27 2025 +0200 media: rcar-vin: Prepare for unifying all v4l-async notifiers The R-Car VIN driver is needlessly complex and uses more then one v4l-async notifier to attach to all its subdevices. Prepare for unifying them by moving rvin_parallel_parse_of() to where it needs to be when they are unified. The function is moved verbatim and there is no change in behavior. Signed-off-by: Niklas Söderlund Tested-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-7-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit d568581b07f4ace5916e9b8b85fa2100f5716952 Author: Niklas Söderlund Date: Fri Jun 13 17:34:26 2025 +0200 media: rcar-vin: Generate a VIN group ID for Gen2 Prepare to move Gen2 and earlier models to media controller by generating a unique VIN group id for each VIN instance. On Gen3 and Gen4 it is important to have a specific id in the group as media graph routes depend on this. On Gen2 and earlier models all that will matter is to have a unique id in the range. Break out the id generation to a own function keeping the logic for Gen3 and Gen4 while generating a sequential id for Gen2 models. Signed-off-by: Niklas Söderlund Tested-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-6-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit b38ba9b160e0605cb500059e48ba3d1fc92fef19 Author: Niklas Söderlund Date: Fri Jun 13 17:34:25 2025 +0200 media: rcar-vin: Use error labels in probe Prepare for more failed probe conditions that needs cleanup by converting the error path to use labels. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-5-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit bad694f877954a0daa9eda02b935c983725d5f6c Author: Niklas Söderlund Date: Fri Jun 13 17:34:24 2025 +0200 media: rcar-vin: Change link setup argument The link setup callback once acted on each VIN instance, and expected to be called once for each VIN instance. This have changed as the driver grew support for later hardware generations and the callback is now expected to setup links for all VIN in the group. The argument to the callback has however remained a pointer to a single VIN instance. This pointer was then used to get the group structure. Fix this and pass the group as the single argument to the link setup callback making the expectation of the function clear. There is no intentional change in behavior. Signed-off-by: Niklas Söderlund Tested-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-4-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit df45bd925efe8b7708cbc549cffa81fcb0e9586e Author: Niklas Söderlund Date: Fri Jun 13 17:34:23 2025 +0200 media: rcar-vin: Store platform info with group structure When the transition of Gen2 to use groups are complete the platform specific information can be retrieved from the group instead of being duplicated in each VIN's private data structure. Prepare for this by already adding the information to the group structure so it can be used without first having to find the group from a VIN instances private data. Signed-off-by: Niklas Söderlund Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 1b83fa6eb9706be4023bce88e952902acf8646ba Author: Niklas Söderlund Date: Fri Jun 13 17:34:22 2025 +0200 media: rcar-vin: Use correct count of remote subdevices When extending the driver with Gen4 support the iteration of over possible remote subdevices changed from being R-Car CSI-2 Rx only to also cover R-Car CSISP instances. In two loops updating the bounds variable was missed. This had no ill effect as the count the two values have always been the same in the past. Fix it by looking at the array size. Signed-off-by: Niklas Söderlund Tested-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250613153434.2001800-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 40823233ca30b89af8e5ccd58effddb997c98fb5 Author: Niklas Söderlund Date: Thu Jun 12 19:59:04 2025 +0200 media: rcar-csi2: Add D-PHY support for V4H Add D-PHY support for V4H in addition to the already supported C-PHY. The common start-up procedure for C-PHY and D-PHY is shared, only PHY setup differ. Extend the V4H setup with D-PHY support as documented in the datasheet (Rev.1.21). Most of the start-up procedure is only documented as magic values in tables, there is little documentation to make the settings more clear. Wherever possible formulas or lookup tables are used as they are documented in the datasheet. Signed-off-by: Niklas Söderlund Tested-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250612175904.1126717-5-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 6f9126b24b0a01219f706be7e3c6cd12dd2ce2cc Author: Niklas Söderlund Date: Thu Jun 12 19:59:03 2025 +0200 media: rcar-csi2: Update start procedure for V4H Prepare for adding D-PHY support to the driver by first updating the generic startup procedure that covers both C-PHY and D-PHY operations. The starting procedure where updated in later versions of the datasheet. Most of the configuration is only documented as tables of magic values in the documentation. Each step is however marked with a T marker, inject these markers in the comments to make it easier to map driver to documentation. Signed-off-by: Niklas Söderlund Tested-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250612175904.1126717-4-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit c927b7b5acfa48471959fb3da9bcc37a11202406 Author: Niklas Söderlund Date: Thu Jun 12 19:59:02 2025 +0200 media: rcar-csi2: Rework macros to access AFE lanes Each AFE lane has a set of control and offset registers. The registers themself are undocumented but later datasheets program more of them with magic values. Before exploding the driver with more defines to name them all rework the AFE ones to be able to address all controls and offsets. Also move a stray define that is out of sequence. There is no functional change. Signed-off-by: Niklas Söderlund Tested-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250612175904.1126717-3-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 797567e81d201ee478f8efa5004804374fc2cbaf Author: Niklas Söderlund Date: Thu Jun 12 19:59:01 2025 +0200 media: rcar-csi2: Clarify usage of mbps and msps The helper function to deal with calculating the link speed is designed in such a way that it returns the correct type bps (bits per second) for D-PHY and sps (symbols per second) for C-PHY. And for historical reasons the function kept the name mbps. This is confusing, fix it by having the function only deal with bps values as this is the most common use-case and convert bps to sps in the only function where it is needed to configure the C-PHY. Signed-off-by: Niklas Söderlund Tested-by: Tomi Valkeinen Reviewed-by: Tomi Valkeinen Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250612175904.1126717-2-niklas.soderlund+renesas@ragnatech.se Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 2632f288ab1180c42c9379893357b8b7744fbf92 Author: Lad Prabhakar Date: Fri May 30 16:41:48 2025 +0100 media: dt-bindings: media: renesas,vsp1: Document RZ/V2N SoC The VSPD block on the RZ/V2N SoC is identical to the one found on the RZ/G2L SoC. No driver changes are required, as `renesas,r9a07g044-vsp2` will be used as a fallback compatible string on the RZ/V2N SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Kieran Bingham Reviewed-by: Laurent Pinchart Acked-by: Rob Herring (Arm) Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250530154148.374663-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit f42eddf44fbfc8c00b2ffb7779a8c11cf92d2b29 Author: Lad Prabhakar Date: Fri May 30 16:41:47 2025 +0100 media: dt-bindings: media: renesas,fcp: Document RZ/V2N SoC The FCPVD block on the RZ/V2N SoC is identical to the one found on the RZ/G2L SoC. No driver changes are required, as `renesas,fcpv` will be used as a fallback compatible string on the RZ/V2N SoC. Signed-off-by: Lad Prabhakar Acked-by: Rob Herring (Arm) Reviewed-by: Kieran Bingham Reviewed-by: Laurent Pinchart Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250530154148.374663-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 782b6a718651eda3478b1824b37a8b3185d2740c Author: Youngjun Lee Date: Tue Jun 10 21:41:07 2025 +0900 media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format(). Signed-off-by: Youngjun Lee Reviewed-by: Laurent Pinchart Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") Cc: stable@vger.kernel.org Reviewed-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250610124107.37360-1-yjjuny.lee@samsung.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 53b0b80e5240fec7c5a420bffb310edc83faf4fd Author: Ricardo Ribalda Date: Mon Jun 2 18:21:57 2025 +0000 media: uvcvideo: Add quirk for HP Webcam HD 2300 HP Webcam HD 2300 does not seem to flip the FID bit according to spec. Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 239 Miscellaneous Device bDeviceSubClass 2 [unknown] bDeviceProtocol 1 Interface Association bMaxPacketSize0 64 idVendor 0x03f0 HP, Inc idProduct 0xe207 HP Webcam HD 2300 bcdDevice 10.20 iManufacturer 3 Hewlett Packard iProduct 1 HP Webcam HD 2300 iSerial 0 bNumConfigurations 1 Reported-by: Michaël Melchiore Closes: https://lore.kernel.org/linux-media/CA+q66aRvTigH15cUyfvzPJ2mfsDFMt=CjuYNwvAZb29w8b1KDA@mail.gmail.com Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250602-uvc-hp-quirk-v1-1-7047d94d679f@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 7651fab885ff8af11833671626722053dacb489a Author: Ricardo Ribalda Date: Fri May 9 18:24:15 2025 +0000 media: uvcvideo: Refactor uvc_v4l2_compat_ioctl32 Declaring a variable for doing automatic cleanup is not a very common pattern. Replace the cleanup macro with manual cleanup to make the code simpler. Suggested-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250509-uvc-followup-v1-3-73bcde30d2b5@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 7e666b1aaccadf7ba3ba8c0d0eed5bf876b14d8e Author: Ricardo Ribalda Date: Fri May 9 18:24:14 2025 +0000 media: uvcvideo: Refactor uvc_queue_streamon Do uvc_pm_get before we call uvc_queue_streamon. Although the current code is correct, uvc_ioctl_streamon is allways called after uvc_pm_get, this change makes the code more resiliant to future changes. Suggested-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250509-uvc-followup-v1-2-73bcde30d2b5@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 0aa112e4a880ff809ecd3426d9c7c9e1f4ad3826 Author: Ricardo Ribalda Date: Fri May 9 18:24:13 2025 +0000 media: uvcvideo: Refactor uvc_ctrl_set_handle() Today uvc_ctrl_set_handle() covers two use-uses: setting the handle and clearing the handle. The only common code between the two cases is the lockdep_assert_held. The code looks cleaner if we split these two usecases in two functions. We also take this opportunity to use pending_async_ctrls from ctrl where possible. Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250509-uvc-followup-v1-1-73bcde30d2b5@chromium.org Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit cdf8f4c78ab0c2dc98dd5b017b0a31590c3e046d Author: Ricardo Ribalda Date: Fri May 23 14:28:41 2025 +0000 media: uvcvideo: Populate all errors in uvc_probe() Now we are replacing most of the error codes with -ENODEV. Instead, Populate the error code from the functions called by uvc_probe(). Take this opportunity to replace a generic error code from uvc_scan_device() into something more meaningful. Suggested-by: Laurent Pinchart Signed-off-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250523-uvc-followup-v2-1-487541656e83@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 649c033711d7fd6e1d5d69e4cfc3fceca7de2867 Author: Ricardo Ribalda Date: Fri May 2 07:48:28 2025 +0000 media: uvcvideo: Set V4L2_CTRL_FLAG_DISABLED during queryctrl errors To implement VIDIOC_QUERYCTRL, we need to know the minimum, maximum, step and flags of the control. For some of the controls, this involves querying the actual hardware. Some non-compliant cameras produce errors when we query them. These error can be triggered every time, sometimes, or when other controls do not have the "right value". Right now, we populate that error to userspace. When an error happens, the v4l2 framework does not copy the v4l2_queryctrl struct to userspace. Also, userspace apps are not ready to handle any other error than -EINVAL. One of the main usecases of VIDIOC_QUERYCTRL is enumerating the controls of a device. This is done using the V4L2_CTRL_FLAG_NEXT_CTRL flag. In that usecase, a non-compliant control will make it almost impossible to enumerate all controls of the device. A control with an invalid max/min/step/flags is better than non being able to enumerate the rest of the controls. This patch: - Retries for an extra attempt to read the control, to avoid spurious errors. More attempts do not seem to produce better results in the tested hardware. - Makes VIDIOC_QUERYCTRL return 0 for -EIO errors. - Introduces a warning in dmesg so we can have a trace of what has happened and sets the V4L2_CTRL_FLAG_DISABLED. - Makes sure we keep returning V4L2_CTRL_FLAG_DISABLED for all the next attempts to query that control (other operations have the same functionality as now). Reviewed-by: Hans de Goede Signed-off-by: Ricardo Ribalda Link: https://lore.kernel.org/r/20250502-uvc-eaccess-v8-1-0b8b58ac1142@chromium.org Signed-off-by: Hans de Goede Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit 9764401bf6f8a20eb11c2e78470f20fee91a9ea7 Author: chenchangcheng Date: Sat May 10 14:18:03 2025 +0800 media: uvcvideo: Fix bandwidth issue for Alcor camera Some broken device return wrong dwMaxPayloadTransferSize fields as follows: [ 218.632537] uvcvideo: Device requested 2752512 B/frame bandwidth. [ 218.632598] uvcvideo: No fast enough alt setting for requested bandwidth. When dwMaxPayloadTransferSize is greater than maxpsize, it will prevent the camera from starting. So use the bandwidth of maxpsize. Signed-off-by: chenchangcheng Reviewed-by: Ricardo Ribalda Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250510061803.811433-1-ccc194101@163.com Signed-off-by: Laurent Pinchart Signed-off-by: Hans Verkuil commit b2904df0a347f206900681f566bb53fc42bd8ba7 Author: Baojun Xu Date: Mon Jun 16 11:56:07 2025 +0800 ALSA: hda/tas2781: Add compatible for hardware id TIAS2781 and TXNW2781 TIAS2781 is unofficial hardware id in ACPI for tas2781 in HDA, has been used for several projects. TXNW is the official hardware id for TI, will be used in new projects, including device on SPI bus, which was enumerated by drivers/acpi/scan.c, and probed by smi_probe() in drivers/platform/x86/serial-multi-instantiate.c. This patch will support both TIAS2781 and TXNW2781 in ACPI with tas2781 under HDA. As our I2C driver will handle all of slaver devices, so we probe first device only: "TXNW2781:00-tas2781-hda.0" Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20250616035607.2569-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit 8629eea901b8a672dd096ca783ece8322701ca5a Author: Christophe Leroy Date: Sat Jun 14 08:43:17 2025 +0200 ALSA: pcm: Convert snd_pcm_sync_ptr() to user_access_begin/user_access_end() Now that snd_pcm_sync_ptr_get_user() and snd_pcm_sync_ptr_put_user() are converted to user_access_begin/user_access_end(), snd_pcm_sync_ptr_get_user() is more efficient than a raw get_user() followed by a copy_from_user(). And because copy_{to/from}_user() are generic functions focussed on transfer of big data blocks to/from user, snd_pcm_sync_ptr_put_user() is also more efficient for small amont of data. So use snd_pcm_sync_ptr_get_user() and snd_pcm_sync_ptr_put_user() in snd_pcm_sync_ptr() too. snd_pcm_ioctl_sync_ptr_buggy() is left as it is because the conversion wouldn't be straigh-forward due to the workaround it provides. Signed-off-by: Christophe Leroy Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/6ce6bc4da498ea7ea2be5f279b374370b1613b13.1749883041.git.christophe.leroy@csgroup.eu commit c72fad73ba497c237fcc0d771d87a2f8447599bb Author: Christophe Leroy Date: Sat Jun 14 08:43:16 2025 +0200 ALSA: pcm: Replace [audio_]tstamp_[n]sec by struct __snd_timespec in struct snd_pcm_mmap_status32 To match struct __snd_pcm_mmap_status and enable reuse of snd_pcm_sync_ptr_get_user() and snd_pcm_sync_ptr_put_user() by snd_pcm_sync_ptr() replace tstamp_sec and tstamp_nsec fields by a struct __snd_timespec in struct snd_pcm_mmap_status32. Do the same with audio_tstamp_sec and audio_tstamp_nsec. This is possible because struct snd_pcm_mmap_status32 is packed and __SND_STRUCT_TIME64 is always defined for kernel which means struct __snd_timespec is always defined as: struct __snd_timespec { __s32 tv_sec; __s32 tv_nsec; }; Signed-off-by: Christophe Leroy Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/df8ea1a9aff61c3e358759b1f495bdb9fb8a3e6a.1749883041.git.christophe.leroy@csgroup.eu commit 0bc2aef36949ea49285370ceab1da5b011bfd478 Author: Ching-Te Ku Date: Wed Jun 11 11:55:23 2025 +0800 wifi: rtw89: coex: Add PTA grant signal setting offload to firmware feature In the before experience there are many issue occurred because of the grant control signal can not be set in time especially WiFi power save enter/leave. To control the signal more accuracy, offload the control to firmware. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611035523.36432-11-pkshih@realtek.com commit 7d1b3c22fe0f9881ffe6a196dcd5f42b3724483b Author: Ching-Te Ku Date: Wed Jun 11 11:55:22 2025 +0800 wifi: rtw89: coex: Update hardware PTA resource binding logic WiFi 7 generation has 2 MAC, the PTA should bind the input/output to correct MAC to do the packet arbitration as expected. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611035523.36432-10-pkshih@realtek.com commit 4cb9092289ec4fc34d0756362876c79784801638 Author: Ching-Te Ku Date: Wed Jun 11 11:55:21 2025 +0800 wifi: rtw89: coex: Update BTG control for WiFi 7 BTG means a path work for Bluetooth & Wi-Fi 2.4GHz. To earn a better coexistence performance, need to do some RF setting for BTG path. WiFi 7 generation offload the feature to firmware, to get a more accuracy control. And decrease driver I/O. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611035523.36432-9-pkshih@realtek.com commit 1683ae3e0069678815c9444fc395958bf5dc53cb Author: Ching-Te Ku Date: Wed Jun 11 11:55:20 2025 +0800 wifi: rtw89: coex: Update Pre-AGC logic for WiFi 7 Pre-AGC is Wi-Fi auto Rx gain control. The mechanism need to switching very fast, especially while Wi-Fi is under 2GHz/5GHz multi-port scenario. To earn a more accuracy & sensitive gain control, in the WiFi 7 later firmware, Pre-AGC mechanism has offloaded to firmware. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611035523.36432-8-pkshih@realtek.com commit 825f5514127ad52a4f5c9abf1d56cf301890bed7 Author: Ching-Te Ku Date: Wed Jun 11 11:55:19 2025 +0800 wifi: rtw89: coex: Add H2C command to collect driver outsource information to firmware In order to reduce driver I/O & some detail instant hardware control, some of the necessary API offload to Wi-Fi firmware. Collect the reference parameters to let firmware do decisions. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611035523.36432-7-pkshih@realtek.com commit fac16e4147a20e8488304b2630471eec6555b0d1 Author: Ching-Te Ku Date: Wed Jun 11 11:55:18 2025 +0800 wifi: rtw89: coex: refine debug log with format version and readable string Fix unexpected line warp. Collect firmware report format version and driver support report format version code to check unexpected C2H report exception. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611035523.36432-6-pkshih@realtek.com commit 26c62dca8243f6f6be6251336db6a24dba34daab Author: Ching-Te Ku Date: Wed Jun 11 11:55:17 2025 +0800 wifi: rtw89: coex: Update Wi-Fi status logic for WiFi 7 Because WiFi 7 generation has dual MAC, logic need to assign & save the information to correct index. Update the related logic. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611035523.36432-5-pkshih@realtek.com commit ccd57356f311013b77e4e377dd8aded93646f40e Author: Ching-Te Ku Date: Wed Jun 11 11:55:16 2025 +0800 wifi: rtw89: coex: Implement Wi-Fi MLO related logic To make the logic can work well with WiFi 7 & before generations, extend & add logic for WiFi 7. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611035523.36432-4-pkshih@realtek.com commit 1625d70f523bd8d647f22bf7c406f7e925094fab Author: Ching-Te Ku Date: Wed Jun 11 11:55:15 2025 +0800 wifi: rtw89: coex: RTL8922A add Wi-Fi firmware support for v0.35.63.0 There were some driver API offloaded to firmware, and to recognize the feature add a version tag for it. Signed-off-by: Ching-Te Ku Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611035523.36432-3-pkshih@realtek.com commit cbaf1110af41994776909dee9e4490edfb80014e Author: Zong-Zhe Yang Date: Wed Jun 11 11:55:14 2025 +0800 wifi: rtw89: introduce rtw89_query_mr_chanctx_info() for multi-role chanctx info Add Wi-Fi 7 MLO related multi-role (MR) chanctx descriptors and query function. They are designed for other components, e.g. coex, which are interested in the following info. * whether a MLD exists and how many active link * the number of AP mode and station mode respectively * how many chanctx and the number of 2/5/6 GHz respectively Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611035523.36432-2-pkshih@realtek.com commit 3db8563bac6c34018cbb96b14549a95c368b0304 Author: Chih-Kang Chang Date: Tue Jun 10 21:00:34 2025 +0800 wifi: rtw89: scan abort when assign/unassign_vif If scan happen during start_ap, the register which control TX might be turned off during scan. Additionally, if set_channel occurs during scan will backup this register and set to firmware after set_channel done. When scan complete, firmware will also set TX by this register, causing TX to be disabled and beacon can't be TX. Therefore, in assign/unassign_vif call scan abort before set_channel to avoid scan racing with set_channel. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-13-pkshih@realtek.com commit b470b8951983cf726844c2287947ff2550fd4f67 Author: Chih-Kang Chang Date: Tue Jun 10 21:00:33 2025 +0800 wifi: rtw89: mcc: enlarge TX retry count when GC auth The auth retry only continue 40ms, but the GO might switch to STA role 50ms when MCC. Therefore, enlarge the TX retry count from 32 to 60 to let GC TX time overlapping with GO timeslot. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-12-pkshih@realtek.com commit b3cf6f392dc9c5a836d06854b0282f4dfa918e61 Author: Chih-Kang Chang Date: Tue Jun 10 21:00:32 2025 +0800 wifi: rtw89: mcc: use anchor pattern when bcn offset less than min of tob When the beacon offset is less than minimum of auxiliary tob (aux->duration - aux->limit.max_toa), the upper bound of the reference toa might be negative and lower than the lower bound, which causes the auxiliary result to exceed the NoA limit. Therefore, in this case, the anchor pattern is used for calculation. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-11-pkshih@realtek.com commit 12af7fcea83729425e50f0598b04b2c1fe7dccb5 Author: Chih-Kang Chang Date: Tue Jun 10 21:00:31 2025 +0800 wifi: rtw89: mcc: clear normal flow NoA when MCC start Clear NoA setting before MCC starts. Otherwise, nulldata will be blocked to TX because firmware use the normal flow NoA to calculate timing. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-10-pkshih@realtek.com commit 8bb1c30769b26843715ba84539b4592721f0add1 Author: Chih-Kang Chang Date: Tue Jun 10 21:00:30 2025 +0800 wifi: rtw89: mcc: enlarge scan time of GC when GO in MCC In original scan, the scan time only 45ms. The GO in MCC mode only stay 50ms and switch to STA role 50ms, which might cause GC can't scan GO. Therefore, enlarge scan time to 105ms to ensure GC have time overlapping with GO. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-9-pkshih@realtek.com commit 62784eae87849282e7e3aa40a044b947bfff2377 Author: Chih-Kang Chang Date: Tue Jun 10 21:00:29 2025 +0800 wifi: rtw89: mcc: adjust TX nulldata early time from 3ms to 7ms Adjust TX nulldata early time to let nulldata have more contention time to TX. Otherwise, AP is hard to receive nulldata 1, which causes the throughput test failed due to packet drops. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-8-pkshih@realtek.com commit 47a498b84f0108669622940f7910e941cd6db856 Author: Chih-Kang Chang Date: Tue Jun 10 21:00:28 2025 +0800 wifi: rtw89: TX nulldata 0 after scan complete HW scan leak to TX nulldata 0 to AP after scan completed, which allowed AP start to TX packet to us. Therefore, driver TX nulldata 0 after scan completed. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-7-pkshih@realtek.com commit 182c7ff8b87e4edbb2227ede39ae0952da7a0f4a Author: Chih-Kang Chang Date: Tue Jun 10 21:00:27 2025 +0800 wifi: rtw89: mcc: stop TX during MCC prepare Stop TX during the MCC configuration period to prevent packet leakage. The stop time is defined as 'start_tsf - tsf', which means the duration from when MCC configuration begins until MCC starts. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-6-pkshih@realtek.com commit 95ee7464d374343115b5e7ec226f2bab2e4012f2 Author: Chih-Kang Chang Date: Tue Jun 10 21:00:26 2025 +0800 wifi: rtw89: mcc: adjust beacon filter when MCC and detect connection MCC needs to wait at most 300ms to start. Additionally, if scanning happens before MCC starts, it will miss some beacons, which might cause beacon loss. Therefore, we reset beacon filter when MCC start to let hardware reset beacon loss counter. Additionally, GO is forbid to enter courtesy mode might cause STA beacon loss. Therefore, disable beacon filter when GO+STA. However, In WiFi 7 chip, even when GC+STA enable courtesy mode, the beacon might loss because switching to courtesy timeslot will disable TX/RX. If the TOB(time offset behind) or TOA(time offset ahead) is too close to the edge of timeslot, the beacon might not be received. Therefore, disable beacon filter when GC+STA in WiFi 7 chip. Because disabling the beacon filter might prevent disconnection when the AP power-off without sending a deauth. Therefore, driver TX QOS nulldata periodically to detect the AP status, and the connection is terminated if no ACK is received for 6 seconds. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-5-pkshih@realtek.com commit f70fe6eab088bb431d75cc411e7ac0f98c2bd734 Author: Chih-Kang Chang Date: Tue Jun 10 21:00:25 2025 +0800 wifi: rtw89: mcc: correct frequency when MCC The frequency get from PPDU status set as center channel during MCC, but we need to report to mac80211 as primary channel. Therefore, we use the chanctx information in software to instead it. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-4-pkshih@realtek.com commit 519defe4e8c83a418649c367158f6f8c38439d0a Author: Chih-Kang Chang Date: Tue Jun 10 21:00:24 2025 +0800 wifi: rtw89: mcc: update format of RF notify MCC H2C command The RF notify MCC H2C command format of 8852C different from other chip, therefore add v0 format to update it. Signed-off-by: Chih-Kang Chang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-3-pkshih@realtek.com commit dbaf5c3aa952ad0dcf5c21431bd534cff1cfad1f Author: Zong-Zhe Yang Date: Tue Jun 10 21:00:23 2025 +0800 wifi: rtw89: extend HW scan of WiFi 6 chips for extra OP chan when concurrency HW scan flow has considered the timing when to get back op for the scanning interface. But, when concurrency, there are two interfaces with connection. The OP channel of another one was not back originally. It then easily lead to connection loss when scanning during concurrency. So, HW scan flow is extended to deal with second OP channel. And, H2C command is also extended to fill second MAC ID. The changes mentioned above are done for WiFi 6 chips first. HW scan has different handling architectures including FW and driver on WiFi 7 chips. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610130034.14692-2-pkshih@realtek.com commit 76b3e5078d76f0eeadb7aacf9845399f8473da0d Author: Thomas Fourier Date: Fri Jun 13 09:38:36 2025 +0200 wifi: rtlwifi: fix possible skb memory leak in _rtl_pci_init_one_rxdesc() When `dma_mapping_error()` is true, if a new `skb` has been allocated, then it must be de-allocated. Compile tested only Signed-off-by: Thomas Fourier Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250613074014.69856-2-fourier.thomas@gmail.com commit 9b550b98f0da3ba80e63c431e0cf4d7ae32c865b Author: Colin Ian King Date: Wed Jun 11 14:55:21 2025 +0100 wifi: rtlwifi: rtl8821ae: make the read-only array params static const Don't populate the read-only array params on the stack at run time, instead make it static const. Signed-off-by: Colin Ian King Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250611135521.172521-1-colin.i.king@gmail.com commit 2baacfe833460fee2f54b2c7270d632c98052cdc Author: Arnd Bergmann Date: Tue Jun 10 11:22:23 2025 +0200 wifi: rtlwifi: avoid stack size warning for _read_eeprom_info txpower_info_{2g,5g} are too big to fit on the stack, but in most of the rtlwifi variants this stays below the warning limit for stack frames. In rtl8192ee and a few others, I see a case where clang decides to fully inline this into rtl92ee_read_eeprom_info, triggering this warning: drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c:2178:6: error: stack frame size (1312) exceeds limit (1280) in 'rtl92ee_read_eeprom_info' [-Werror,-Wframe-larger-than] Mark _rtl92ee_read_txpower_info_from_hwpg() as noinline_for_stack to and mark _rtl92ee_get_chnl_group() as __always_inline to make clang behave the same way as gcc. Inlining _rtl92ee_get_chnl_group helps let the compiler see that the index is always in range. The same change appears to be necessary in all rtlwifi variants. A more thorough approach would be to avoid the use of the two structures on the stack entirely and combine them with the struct rtl_efuse data that is dynamically allocated and holds the same information. Signed-off-by: Arnd Bergmann Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250610092240.2639751-1-arnd@kernel.org commit 47311eaa0a3be575f7835d99e3767f5ee5940b45 Author: Johan Hovold Date: Fri May 23 10:48:39 2025 +0200 phy: phy-snps-eusb2: clean up id table sentinel Use a more common format for the id table sentinel for consistency and symmetry. Signed-off-by: Johan Hovold Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250523084839.11015-8-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit d2d0ae723ba3fca2c54dfbc758b368d3009e79a7 Author: Johan Hovold Date: Fri May 23 10:48:38 2025 +0200 phy: phy-snps-eusb2: drop unnecessary loop index declarations There is already a loop index variable declared at function scope so drop the unnecessary overloaded loop declarations. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250523084839.11015-7-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit f21b9bea6bc29de88b885cecd5e4f0ada60d4700 Author: Johan Hovold Date: Fri May 23 10:48:37 2025 +0200 phy: phy-snps-eusb2: fix optional phy lookup parameter The devm_of_phy_optional_get() takes an optional name argument as its third parameter and not an index like the recently replaced devm_of_phy_get_by_index(). Replace 0 with an explicit NULL for consistency and readability. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250523084839.11015-6-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit b7996f8e9473cf8a594af1fa1bb799f8f28c0670 Author: Johan Hovold Date: Fri May 23 10:48:36 2025 +0200 phy: phy-snps-eusb2: clean up error messages Clean up the error messages by using a consistent format with a colon followed by a space and an errno (or unsupported frequency). Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250523084839.11015-5-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 4f333990841e06059c3cd7251791017d4c9e9028 Author: Johan Hovold Date: Fri May 23 10:48:35 2025 +0200 phy: phy-snps-eusb2: rename phy_init() clock error label Rename the clock error label which is now used to disable all clocks and not just the ref clock on phy_init() errors. Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250523084839.11015-4-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 3232a6b0d834569f71aa898401288af6b4ab781d Author: Johan Hovold Date: Fri May 23 10:48:34 2025 +0200 phy: phy-snps-eusb2: fix repeater imbalance on phy_init() failure Make sure to disable the repeater PHY also on phy_init() failure. Fixes: 3584f6392f09 ("phy: qcom: phy-qcom-snps-eusb2: Add support for eUSB2 repeater") Cc: Abel Vesa Cc: Neil Armstrong Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250523084839.11015-3-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 641fa5b515a6900b1452cc92d30d1ab391e04414 Author: Johan Hovold Date: Fri May 23 10:48:33 2025 +0200 phy: phy-snps-eusb2: fix clock imbalance on phy_exit() Make sure to disable all clocks enabled at phy_init() also on phy_exit(). Fixes: c4098f3e6134 ("phy: phy-snps-eusb2: add support for exynos2200") Cc: Ivaylo Ivanov Signed-off-by: Johan Hovold Reviewed-by: Neil Armstrong Acked-by: Ivaylo Ivanov Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250523084839.11015-2-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 9c8504861cc4102463f31fe1f5e120a6deb15c15 Author: Wesley Cheng Date: Tue May 27 14:04:42 2025 -0700 phy: qcom: Add M31 based eUSB2 PHY driver SM8750 utilizes an eUSB2 PHY from M31. Add the initialization sequences to bring it out of reset and into an operational state. This differs to the M31 USB driver, in that the M31 eUSB2 driver will require a connection to an eUSB2 repeater. This PHY driver will handle the initialization of the associated eUSB2 repeater when required. Reviewed-by: Dmitry Baryshkov Signed-off-by: Wesley Cheng Signed-off-by: Melody Olvera Link: https://lore.kernel.org/r/20250527-sm8750_usb_master-v6-6-d58de3b41d34@oss.qualcomm.com Signed-off-by: Vinod Koul commit b0d8d731b4b0fc83bb4826a2c805f4c877c98cc1 Author: Wesley Cheng Date: Tue May 27 14:04:41 2025 -0700 phy: qcom: Update description for QCOM based eUSB2 repeater The eUSB2 repeater that exists in the QCOM PMICs are utilized for several different eUSB2 PHY vendors, such as M31 or Synopsys. Hence, the wording needs to be updated to remove associations to a specific vendor. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Wesley Cheng Signed-off-by: Melody Olvera Link: https://lore.kernel.org/r/20250527-sm8750_usb_master-v6-5-d58de3b41d34@oss.qualcomm.com Signed-off-by: Vinod Koul commit c4364048baf4878c270e94aa224bb114b445704d Author: Wesley Cheng Date: Tue May 27 14:04:40 2025 -0700 phy: qcom: qmp-combo: Add new PHY sequences for SM8750 Add new register offsets and PHY values for SM8750. Some of the previous definitions can be leveraged from older PHY versions as offsets within registers have not changed. This also adds the required PHY sequence that is recommended after running hardware characterization. Signed-off-by: Wesley Cheng Signed-off-by: Melody Olvera Reviewed-by: Dmitry Baryshkov Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250527-sm8750_usb_master-v6-4-d58de3b41d34@oss.qualcomm.com Signed-off-by: Vinod Koul commit 1166a2ca0900beafbe5b6d1bb357bc26a87490f1 Author: Wesley Cheng Date: Tue May 27 14:04:38 2025 -0700 dt-bindings: phy: Add the M31 based eUSB2 PHY bindings On SM8750, the M31 eUSB2 PHY is being used to support USB2. Add the binding definition for the PHY driver. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Wesley Cheng Signed-off-by: Melody Olvera Link: https://lore.kernel.org/r/20250527-sm8750_usb_master-v6-2-d58de3b41d34@oss.qualcomm.com Signed-off-by: Vinod Koul commit 439cdb309c3cf630b11661872ace09e1a7c5d630 Author: Wesley Cheng Date: Tue May 27 14:04:37 2025 -0700 dt-bindings: phy: qcom,sc8280xp-qmp-usb43dp-phy: Add SM8750 to QMP PHY Add an entry to the compatible field for SM8750 for the QMP combo PHY. This handles the USB3 path for SM8750. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Wesley Cheng Signed-off-by: Melody Olvera Link: https://lore.kernel.org/r/20250527-sm8750_usb_master-v6-1-d58de3b41d34@oss.qualcomm.com Signed-off-by: Vinod Koul commit 00399bbe02d2bb6fd8d6eb90573ec305616449f4 Author: Lad Prabhakar Date: Wed May 28 14:38:58 2025 +0100 dt-bindings: phy: renesas,usb2-phy: Document RZ/V2N SoC support Document support for the USB2.0 phy found on the Renesas RZ/V2N (R9A09G056) SoC. The USB2.0 phy is functionally identical to that on the RZ/V2H(P) SoC, so no driver changes are needed. The existing `renesas,usb2-phy-r9a09g057` compatible will be used as a fallback for the RZ/V2N SoC. Signed-off-by: Lad Prabhakar Acked-by: Conor Dooley Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20250528133858.168582-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Vinod Koul commit 4dcf1632d617262f16608f3bd0f6dc00eede8d4e Author: Rob Herring (Arm) Date: Sat Jun 7 16:26:07 2025 -0500 dt-bindings: phy: Convert Marvell MVEBU PHYs to DT schema Convert the Marvell Armada-375 USB and MVEBU SATA PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20250607212609.743346-1-robh@kernel.org Signed-off-by: Vinod Koul commit a5aa04619e715adda36ca5a97cae4c48bad8d65b Author: Rob Herring (Arm) Date: Sat Jun 7 16:25:40 2025 -0500 dt-bindings: phy: Convert marvell,armada-380-comphy to DT schema Convert the Marvell Armada 38x combo PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20250607212541.742427-1-robh@kernel.org Signed-off-by: Vinod Koul commit 222bb02ee691237f1e9393d31226faa35097e9ab Author: Rob Herring (Arm) Date: Sat Jun 7 16:26:40 2025 -0500 dt-bindings: phy: Convert ti,keystone-usbphy to DT schema Convert the TI Keystone USB PHY binding to DT schema format. Drop the "#address-cells" and "#size-cells" properties which don't make sense without any child nodes. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212641.744683-1-robh@kernel.org Signed-off-by: Vinod Koul commit 35b629b28afd72a14ed573f1b180dc4ab1bf7e19 Author: Rob Herring (Arm) Date: Sat Jun 7 16:26:33 2025 -0500 dt-bindings: phy: Convert ti,dm816x-usb-phy to DT schema Convert the TI DM816x USB PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212634.744373-1-robh@kernel.org Signed-off-by: Vinod Koul commit ea54c9d157c705df5e9399ba50fa38edcabd37b1 Author: Rob Herring (Arm) Date: Sat Jun 7 16:26:28 2025 -0500 dt-bindings: phy: Convert st,spear1310-miphy to DT schema Convert the ST SPEAr MIPHY PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212629.744191-1-robh@kernel.org Signed-off-by: Vinod Koul commit 3ed7be12756d0ad8ebe34b2cfcfd8f84cfbb2678 Author: Rob Herring (Arm) Date: Sat Jun 7 16:26:23 2025 -0500 dt-bindings: phy: Convert qca,ar7100-usb-phy to DT schema Convert the Qualcomm-Atheros AR7100 USB PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212625.744008-1-robh@kernel.org Signed-off-by: Vinod Koul commit 90647aa7e6babffb42e8dac5394991498c46def8 Author: Rob Herring (Arm) Date: Sat Jun 7 16:26:20 2025 -0500 dt-bindings: phy: Convert motorola,mapphone-mdm6600 to DT schema Convert the Motorola Mapphone MDM6600 USB PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212621.743859-1-robh@kernel.org Signed-off-by: Vinod Koul commit 351d6b70c1c98c560c614b85c24e68cdb1ec8b1e Author: Rob Herring (Arm) Date: Sat Jun 7 16:26:15 2025 -0500 dt-bindings: phy: Convert motorola,cpcap-usb-phy to DT schema Convert the Motorola CPCAP PMIC USB PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212616.743674-1-robh@kernel.org Signed-off-by: Vinod Koul commit fbcc4937636385208561c60a9a51ecb550528cc8 Author: Rob Herring (Arm) Date: Sat Jun 7 16:26:11 2025 -0500 dt-bindings: phy: Convert marvell,mmp2-usb-phy to DT schema Convert the Marvell MMP2 USB PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212613.743515-1-robh@kernel.org Signed-off-by: Vinod Koul commit 50355ac70d4f104e2f82bfbd0658c129027ebb37 Author: Rob Herring (Arm) Date: Sat Jun 7 16:26:03 2025 -0500 dt-bindings: phy: Convert marvell,comphy-cp110 to DT schema Convert the Marvell CP110 combo PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212605.743176-1-robh@kernel.org Signed-off-by: Vinod Koul commit 08a9bc357aa06ae7ca286eef698ba02c2396c5c9 Author: Rob Herring (Arm) Date: Sat Jun 7 16:25:53 2025 -0500 dt-bindings: phy: Convert marvell,berlin2-usb-phy to DT schema Convert the Marvell Berlin2 USB PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212554.742884-1-robh@kernel.org Signed-off-by: Vinod Koul commit f4b522ce6ac602bb584c721724b626e64e0abcc1 Author: Rob Herring (Arm) Date: Sat Jun 7 16:25:44 2025 -0500 dt-bindings: phy: Convert marvell,berlin2-sata-phy to DT schema Convert the Marvell Berlin2 SATA PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212545.742617-1-robh@kernel.org Signed-off-by: Vinod Koul commit 85d6af3b73d4741b2a0d101e6bfac4bfd529e5b5 Author: Rob Herring (Arm) Date: Sat Jun 7 16:25:36 2025 -0500 dt-bindings: phy: Convert lantiq,ase-usb2-phy to DT schema Convert the Lantiq XWAY USB PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212537.742287-1-robh@kernel.org Signed-off-by: Vinod Koul commit 66acaf8f6b0bcc273f8356b2a77baa90b177014c Author: Rob Herring (Arm) Date: Sat Jun 7 16:25:30 2025 -0500 dt-bindings: phy: Convert img,pistachio-usb-phy to DT schema Convert the Imagination Pistachio USB PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212531.742082-1-robh@kernel.org Signed-off-by: Vinod Koul commit 7cc5efcd948f3ea768facd7f8472d302466422e8 Author: Rob Herring (Arm) Date: Sat Jun 7 16:25:26 2025 -0500 dt-bindings: phy: Convert hisilicon,inno-usb2-phy to DT schema Convert the HiSilicon INNO USB2 PHY binding to DT schema format. It's a straight forward conversion. Add the undocumented "hisilicon,hi3798mv100-usb2-phy" compatible. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212527.741915-1-robh@kernel.org Signed-off-by: Vinod Koul commit 40f1d8214257c4a2eaa07ed4fd3217c5c3cbfc70 Author: Rob Herring (Arm) Date: Sat Jun 7 16:25:23 2025 -0500 dt-bindings: phy: Convert hisilicon,hi6220-usb-phy to DT schema Convert the HiSilicon HI6220 USB PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212524.741770-1-robh@kernel.org Signed-off-by: Vinod Koul commit 1fac100a4dec0fd96dc404561d1418aa20de441f Author: Rob Herring (Arm) Date: Sat Jun 7 16:25:18 2025 -0500 dt-bindings: phy: Convert hisilicon,hix5hd2-sata-phy to DT schema Convert the HiSilicon HIX5HD2 SATA PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212520.741588-1-robh@kernel.org Signed-off-by: Vinod Koul commit 6725c334e94a16ac141f23a3aa59cab7eb52cb6b Author: Rob Herring (Arm) Date: Sat Jun 7 16:25:07 2025 -0500 dt-bindings: phy: Convert brcm,sr-pcie-phy to DT schema Convert the Broadcom Stingray PCIe PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212508.741193-1-robh@kernel.org Signed-off-by: Vinod Koul commit f151f3a6ebe184b5f8c9abe58fe2d63f9950139b Author: Rob Herring (Arm) Date: Sat Jun 7 16:24:48 2025 -0500 dt-bindings: phy: Convert brcm,ns2-drd-phy to DT schema Convert the Broadcom NS2 USB2 PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212456.740697-1-robh@kernel.org Signed-off-by: Vinod Koul commit 65ad0d068c426c2f3477b1241f34ad82d1197e80 Author: Rob Herring (Arm) Date: Sat Jun 7 16:24:23 2025 -0500 dt-bindings: phy: Convert apm,xgene-phy to DT schema Convert the APM X-Gene PHY binding to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250607212424.739972-1-robh@kernel.org Signed-off-by: Vinod Koul commit 77d2fa54a94574f767d5fb296b6b8e011eba0c8e Author: Nitin Rawat Date: Mon May 26 21:08:21 2025 +0530 scsi: ufs: qcom : Refactor phy_power_on/off calls Commit 3f6d1767b1a0 ("phy: ufs-qcom: Refactor all init steps into phy_poweron") moved the phy_power_on/off from ufs_qcom_setup_clocks to suspend/resume func. To have a better power saving, remove the phy_power_on/off calls from resume/suspend path and put them back to ufs_qcom_setup_clocks, so that PHY regulators & clks can be turned on/off along with UFS's clocks. Since phy phy_power_on is separated out from phy calibrate, make separate calls to phy_power_on calls from ufs qcom driver. Co-developed-by: Can Guo Signed-off-by: Can Guo Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250526153821.7918-11-quic_nitirawa@quicinc.com Signed-off-by: Vinod Koul commit a079b2d715340482e425ff136b55810ab8279800 Author: Nitin Rawat Date: Mon May 26 21:08:20 2025 +0530 phy: qcom-qmp-ufs: refactor qmp_ufs_power_off In qmp_ufs_power_off, the PHY is already powered down by asserting QPHY_PCS_POWER_DOWN_CONTROL. Therefore, additional phy_reset and stopping SerDes are unnecessary. Also this approach does not align with the phy HW programming guide. Thus, refactor qmp_ufs_power_off to remove the phy_reset and stop SerDes calls to simplify the code and ensure alignment with the PHY HW programming guide. Signed-off-by: Nitin Rawat Reviewed-by: Dmitry Baryshkov Reviewed-by: Manivannan Sadhasivam Link: https://lore.kernel.org/r/20250526153821.7918-10-quic_nitirawa@quicinc.com Signed-off-by: Vinod Koul commit 7f600f0e193a6638135026c3718ac296ed3f5044 Author: Nitin Rawat Date: Mon May 26 21:08:19 2025 +0530 phy: qcom-qmp-ufs: Remove qmp_ufs_exit() and Inline qmp_ufs_com_exit() qmp_ufs_exit() is a wrapper function. It only calls qmp_ufs_com_exit(). Remove it to simplify the ufs phy driver. Additonally partial Inline(dropping the reset assert) qmp_ufs_com_exit into qmp_ufs_power_off function to avoid unnecessary function call and to align with the Phy programming guide. Reviewed-by: Dmitry Baryshkov Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250526153821.7918-9-quic_nitirawa@quicinc.com Signed-off-by: Vinod Koul commit acc6b0d73d902d3296d8c77878a9b508c2c6a5bf Author: Nitin Rawat Date: Mon May 26 21:08:18 2025 +0530 phy: qcom-qmp-ufs: Rename qmp_ufs_power_off Rename qmp_ufs_disable to qmp_ufs_power_off to better represent its functionality. Additionally, inline qmp_ufs_exit into qmp_ufs_power_off function to preserve the functionality of .power_off. There is no functional change. Reviewed-by: Neil Armstrong Reviewed-by: Dmitry Baryshkov Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250526153821.7918-8-quic_nitirawa@quicinc.com Signed-off-by: Vinod Koul commit 7bcf4936aac6ec8d6fafbfd6f4f62302e5296a0d Author: Nitin Rawat Date: Mon May 26 21:08:17 2025 +0530 phy: qcom-qmp-ufs: Remove qmp_ufs_com_init() The qmp_ufs_power_on() function acts as a wrapper, solely invoking qmp_ufs_com_init(). Additionally, the code within qmp_ufs_com_init() does not correspond well with its name. Therefore, to enhance the readability and eliminate unnecessary function call inline qmp_ufs_com_init() into qmp_ufs_power_on(). There is no change to the functionality. Reviewed-by: Dmitry Baryshkov Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250526153821.7918-7-quic_nitirawa@quicinc.com Signed-off-by: Vinod Koul commit d58b9ff47775042acc501d0a892af8bd08128a65 Author: Nitin Rawat Date: Mon May 26 21:08:16 2025 +0530 phy: qcom-qmp-ufs: Refactor UFS PHY reset Refactor the UFS PHY reset handling to parse the reset logic only once during initialization, instead of every resume. As part of this change, move the UFS PHY reset parsing logic from qmp_phy_power_on to the new qmp_ufs_phy_init function introduced as part of phy_ops::init callback. Co-developed-by: Ram Kumar Dwivedi Signed-off-by: Ram Kumar Dwivedi Signed-off-by: Nitin Rawat Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250526153821.7918-6-quic_nitirawa@quicinc.com Signed-off-by: Vinod Koul commit cbfd6c124f27ad2b4c0f617dc40ad8a08a063463 Author: Nitin Rawat Date: Mon May 26 21:08:15 2025 +0530 phy: qcom-qmp-ufs: Refactor phy_power_on and phy_calibrate callbacks Commit 052553af6a31 ("ufs/phy: qcom: Refactor to use phy_init call") puts enabling regulators & clks, calibrating UFS PHY, starting serdes and polling PCS ready status into phy_power_on. In Current code regulators enable, clks enable, calibrating UFS PHY, start_serdes and polling PCS_ready_status are part of phy_power_on. UFS PHY registers are retained after power collapse, meaning calibrating UFS PHY, start_serdes and polling PCS_ready_status can be done only when hba is powered_on, and not needed every time when phy_power_on is called during resume. Hence keep the code which enables PHY's regulators & clks in phy_power_on and move the rest steps into phy_calibrate function. Refactor the code to retain PHY regulators & clks in phy_power_on and move out rest of the code to new phy_calibrate function. Also move reset_control_assert to qmp_ufs_phy_calibrate to align with Hardware programming guide. Reviewed-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Co-developed-by: Can Guo Signed-off-by: Can Guo Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250526153821.7918-5-quic_nitirawa@quicinc.com Signed-off-by: Vinod Koul commit dbd20821946a74e803208a25dddfafe1ae2e34e6 Author: Nitin Rawat Date: Mon May 26 21:08:14 2025 +0530 phy: qcom-qmp-ufs: Rename qmp_ufs_enable and qmp_ufs_power_on Rename qmp_ufs_enable to qmp_ufs_power_on and qmp_ufs_power_on to qmp_ufs_phy_calibrate to better reflect their functionality. Also update function calls and structure assignments accordingly. Reviewed-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Co-developed-by: Ram Kumar Dwivedi Signed-off-by: Ram Kumar Dwivedi Signed-off-by: Nitin Rawat Link: https://lore.kernel.org/r/20250526153821.7918-4-quic_nitirawa@quicinc.com Signed-off-by: Vinod Koul commit 399c75b6a9ed2fd609f9ad4c22cdd6364bc9d441 Author: Nitin Rawat Date: Mon May 26 21:08:13 2025 +0530 scsi: ufs: qcom: add a new phy calibrate API call Introduce a new phy calibrate API call in the UFS Qualcomm driver to separate phy calibration from phy power-on. This change is a precursor to the successive commits in this series, which requires these two operations to be distinct. Reviewed-by: Dmitry Baryshkov Reviewed-by: Manivannan Sadhasivam Signed-off-by: Nitin Rawat Acked-by: Martin K. Petersen Link: https://lore.kernel.org/r/20250526153821.7918-3-quic_nitirawa@quicinc.com Signed-off-by: Vinod Koul commit 6767df73f2d36e7d1cf0eb3c4d9469c7e9fe9824 Author: Swapnil Jakhade Date: Tue Jun 10 18:31:33 2025 +0530 phy: cadence: Sierra: Add PCIe + USB PHY multilink configuration Add register sequences for PCIe + USB multilink configuration for Sierra PHY. Signed-off-by: Swapnil Jakhade Signed-off-by: Siddharth Vadapalli Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250610130133.2102196-1-s-vadapalli@ti.com Signed-off-by: Vinod Koul commit 543f5e314282c4c2e5114f88ddecc9aeaf0985e2 Author: Kaustabh Chakraborty Date: Thu Jun 12 20:39:30 2025 +0530 phy: exynos-mipi-video: introduce support for exynos7870 Add support for Exynos7870 in the existing MIPI CSIS/DSIM driver. The SoC has one DSIM phy and three CSIS phys. Signed-off-by: Kaustabh Chakraborty Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250612-exynos7870-mipi-phy-v1-2-3fff0b62d9d3@disroot.org Signed-off-by: Vinod Koul commit 2ac5840594b2cc2b41116f708241a2a61d9108bd Author: Kaustabh Chakraborty Date: Thu Jun 12 20:39:29 2025 +0530 dt-bindings: phy: samsung,mipi-video-phy: document exynos7870 MIPI phy The Exynos7870 MIPI PHY device contains one DSIM PHY block and three CSIS PHY blocks. It also requires two sysregs, one for display, and the other for cameras. Document this device. Signed-off-by: Kaustabh Chakraborty Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250612-exynos7870-mipi-phy-v1-1-3fff0b62d9d3@disroot.org Signed-off-by: Vinod Koul commit aef6bcc0f278eba408751f8b3e0beae992e9faec Author: Takashi Sakamoto Date: Sun Jun 15 22:32:53 2025 +0900 firewire: ohci: use workqueue to handle events of AT request/response contexts This commit adds a work item to handle events of 1394 OHCI AT request/response contexts, and queues the item to the specific workqueue. The call of struct fw_packet.callbaqck() is done in the workqueue when receiving acknowledgement to the asynchronous packet transferred to remote node. Link: https://lore.kernel.org/r/20250615133253.433057-4-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 57e6d9f85fff3a71e667628474063c1bbb2fad20 Author: Takashi Sakamoto Date: Sun Jun 15 22:32:52 2025 +0900 firewire: ohci: use workqueue to handle events of AR request/response contexts This commit adds a work item to handle events of 1394 OHCI AR request/response contexts, and queues the item to the specific workqueue. The call of struct fw_address_handler.address_callback() is done in the workqueue when receiving any requests from the remove nodes. Additionally, the call of struct fw_packet.callback() is done in the workqueue too when receiving acknowledge to the asynchronous packet for the response subaction of split transaction to the remote nodes. Link: https://lore.kernel.org/r/20250615133253.433057-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 72bf1441231ab421a380771e37a5c595493db178 Author: Takashi Sakamoto Date: Sun Jun 15 22:32:51 2025 +0900 firewire: core: allocate workqueue for AR/AT request/response contexts Some tasklets (softIRQs) are still used as bottom-halves to handle events for 1394 OHCI AR/AT contexts. However, using softIRQs for IRQ bottom halves is generally discouraged today. This commit adds a per-fw_card workqueue to accommodate the behaviour specified by the 1394 OHCI specification. According to the 1394 OHCI specification, system memory pages are reserved for each asynchronous DMA context. This allows concurrent operation across contexts. In the 1394 OHCI PCI driver implementation, the hardware generates IRQs either upon receiving asynchronous packets from other nodes (incoming) or after completing transmission to them (outgoing). These independent events can occur in the same transmission cycle, therefore the max_active parameter for the workqueue is set to the total number of AR/AT contexts (=4). The WQ_UNBOUND flag is used to allow the work to be scheduled on any available core, since there is little CPU cache affinity benefit for the data. Each DMA context uses a circular descriptor list in system memory, allowing deferred data processing in software as long as buffer overrun are avoided. Since the overall operation is sleepable except for small atomic regions, WQ_BH is not used. As the descriptors contain timestamps, WQ_HIGHPRI is specified to support semi-real-time processing. The asynchronous context is also used by the SCSI over IEEE 1394 protocol implementation (sbp2), which can be part of memory reclaim paths. Therefore, WQ_MEM_RECLAIM is required. To allow uses to adjust CPU affinity according to workload, WQ_SYSFS is specified so that workqueue attributes are exposed to user space. Link: https://lore.kernel.org/r/20250615133253.433057-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 8909f5f4ecd551c2299b28e05254b77424c8c7dc Author: Russell King (Oracle) Date: Thu Jun 12 17:16:30 2025 +0100 net: stmmac: qcom-ethqos: add ethqos_pcs_set_inband() Add ethqos_pcs_set_inband() to improve readability, and to allow future changes when phylink PCS support is properly merged. Reviewed-by: Andrew Halaney Tested-by: Bartosz Golaszewski # sa8775p-ride-r3 Signed-off-by: Russell King (Oracle) Reviewed-by: Simon Horman Link: https://patch.msgid.link/E1uPkbO-004EyA-EU@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0c17270f9b920e4e1777488f1911bbfdaf2af3be Author: Yajun Deng Date: Thu Jun 12 14:27:07 2025 +0000 net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id) phys_port_id_show, phys_port_name_show and phys_switch_id_show would return -EOPNOTSUPP if the netdev didn't implement the corresponding method. There is no point in creating these files if they are unsupported. Put these attributes in netdev_phys_group and implement the is_visible method. make phys_(port_id, port_name, switch_id) invisible if the netdev dosen't implement the corresponding method. Signed-off-by: Yajun Deng Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250612142707.4644-1-yajun.deng@linux.dev Signed-off-by: Jakub Kicinski commit bfa788dc2ddaea7d7930f63a5c7c8f3668a3f2c5 Author: Yury Norov [NVIDIA] Date: Sat Jun 14 11:50:30 2025 -0400 clocksource: Use cpumask_next_wrap() in clocksource_watchdog() cpumask_next_wrap() is more verbose and efficient comparing to cpumask_next() followed by cpumask_first(). Signed-off-by: Yury Norov [NVIDIA] Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250614155031.340988-3-yury.norov@gmail.com commit 4fa7d61d5a02ad57a05c69365db293afddf678fc Author: Yury Norov [NVIDIA] Date: Sat Jun 14 11:50:29 2025 -0400 clocksource: Use cpumask_any_but() in clocksource_verify_choose_cpus() cpumask_any_but() is more verbose than cpumask_first() followed by cpumask_next(). Use it in clocksource_verify_choose_cpus(). Signed-off-by: Yury Norov [NVIDIA] Signed-off-by: Thomas Gleixner Acked-by: John Stultz Link: https://lore.kernel.org/all/20250614155031.340988-2-yury.norov@gmail.com commit ffe8a49091767f71802a3c601c121aa0ab84ac5f Author: MD Danish Anwar Date: Fri Jun 13 12:15:47 2025 +0530 net: ti: icssg-prueth: Read firmware-names from device tree Refactor the way firmware names are handled for the ICSSG PRUETH driver. Instead of using hardcoded firmware name arrays for different modes (EMAC, SWITCH, HSR), the driver now reads the firmware names from the device tree property "firmware-name". Only the EMAC firmware names are specified in the device tree property. The firmware names for all other supported modes are generated dynamically based on the EMAC firmware names by replacing substrings (e.g., "eth" with "sw" or "hsr") as appropriate. Example: Below are the firmwares used currently for PRU0 core EMAC: ti-pruss/am65x-sr2-pru0-prueth-fw.elf SW : ti-pruss/am65x-sr2-pru0-prusw-fw.elf HSR : ti-pruss/am65x-sr2-pru0-pruhsr-fw.elf All three firmware names are same except for the operating mode. In general for PRU0 core, firmware name is, ti-pruss/am65x-sr2-pru0-pru-fw.elf Since the EMAC firmware names are defined in DT, driver will read those directly and for other modes swap the mode name. i.e. eth -> sw or eth -> hsr. This preserves backwards compatibility as ICSSG driver is supported only by AM65x and AM64x. Both of these have "firmware-name" property populated in their device tree. Signed-off-by: MD Danish Anwar Reviewed-by: Simon Horman Link: https://patch.msgid.link/20250613064547.44394-1-danishanwar@ti.com Signed-off-by: Jakub Kicinski commit c969149bafbeb8ae113747e00ae3ef97461f2cd4 Author: Yuesong Li Date: Fri Jun 13 18:20:12 2025 +0800 net: amt: convert to use secs_to_jiffies Since secs_to_jiffies()(commit:b35108a51cf7) has been introduced, we can use it to avoid scaling the time to msec. Signed-off-by: Yuesong Li Reviewed-by: Joe Damato Reviewed-by: Taehee Yoo Link: https://patch.msgid.link/20250613102014.3070898-1-liyuesong@vivo.com Signed-off-by: Jakub Kicinski commit 385a766bed48c5bcf620061f24e864dafeca671a Author: Igor Belwon Date: Thu May 15 16:43:02 2025 +0200 phy: exynos5-usbdrd: Add support for the Exynos990 usbdrd phy The Exynos990 usbdrd PHY is a combo PHY which supports USB SS, HS and DisplayPort outputs. This commit adds support only for UTMI+ (USB HS). Reviewed-by: Krzysztof Kozlowski Signed-off-by: Igor Belwon Reviewed-by: Neil Armstrong Link: https://lore.kernel.org/r/20250515-usb-resends-may-15-v3-2-ad33a85b6cee@mentallysanemainliners.org Signed-off-by: Vinod Koul commit 9f77d234c1f41e78a99f124bf6fee59dc2e3d46f Author: Igor Belwon Date: Thu May 15 16:43:01 2025 +0200 dt-bindings: phy: samsung,usb3-drd-phy: Add exynos990 compatible Add a compatible for the exynos990-usbdrd-phy. The PHY is compatible with the older exynos5420 design (two clocks) when running in highspeed mode. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Igor Belwon Link: https://lore.kernel.org/r/20250515-usb-resends-may-15-v3-1-ad33a85b6cee@mentallysanemainliners.org Signed-off-by: Vinod Koul commit a9b49bf8ad5905ebd999da345dcff3b9fad43877 Author: Christophe Leroy Date: Sat Jun 14 08:43:15 2025 +0200 ALSA: pcm: Convert SNDRV_PCM_IOCTL_SYNC_PTR to user_access_begin/user_access_end() With user access protection (Called SMAP on x86 or KUAP on powerpc) each and every call to get_user() or put_user() performs heavy operations to unlock and lock kernel access to userspace. SNDRV_PCM_IOCTL_SYNC_PTR is a hot path which is called really often and needs to run as fast as possible. To improve performance, perform user accesses by blocks using user_access_begin/user_access_end() and unsafe_get_user()/ unsafe_put_user(). Before the patch the 9 calls to put_user() at the end of snd_pcm_ioctl_sync_ptr_compat() imply the following set of instructions about 9 times (access_ok - enable user - write - disable user): 0.00 : c057f858: 3d 20 7f ff lis r9,32767 0.29 : c057f85c: 39 5e 00 14 addi r10,r30,20 0.77 : c057f860: 61 29 ff fc ori r9,r9,65532 0.32 : c057f864: 7c 0a 48 40 cmplw r10,r9 0.36 : c057f868: 41 a1 fb 58 bgt c057f3c0 0.30 : c057f86c: 3d 20 dc 00 lis r9,-9216 1.95 : c057f870: 7d 3a c3 a6 mtspr 794,r9 0.33 : c057f874: 92 8a 00 00 stw r20,0(r10) 0.27 : c057f878: 3d 20 de 00 lis r9,-8704 0.28 : c057f87c: 7d 3a c3 a6 mtspr 794,r9 ... A perf profile shows that in total the 9 put_user() represent 36% of the time spent in snd_pcm_ioctl() and about 80 instructions. With this patch everything is done in 13 instructions and represent only 15% of the time spent in snd_pcm_ioctl(): 0.57 : c057f5dc: 3d 20 dc 00 lis r9,-9216 0.98 : c057f5e0: 7d 3a c3 a6 mtspr 794,r9 0.16 : c057f5e4: 92 7f 00 04 stw r19,4(r31) 0.63 : c057f5e8: 93 df 00 0c stw r30,12(r31) 0.16 : c057f5ec: 93 9f 00 10 stw r28,16(r31) 4.95 : c057f5f0: 92 9f 00 14 stw r20,20(r31) 0.19 : c057f5f4: 92 5f 00 18 stw r18,24(r31) 0.49 : c057f5f8: 92 bf 00 1c stw r21,28(r31) 0.27 : c057f5fc: 93 7f 00 20 stw r27,32(r31) 5.88 : c057f600: 93 36 00 00 stw r25,0(r22) 0.11 : c057f604: 93 17 00 00 stw r24,0(r23) 0.00 : c057f608: 3d 20 de 00 lis r9,-8704 0.79 : c057f60c: 7d 3a c3 a6 mtspr 794,r9 Note that here the access_ok() in user_write_access_begin() is skipped because the exact same verification has already been performed at the beginning of the fonction with the call to user_read_access_begin(). Signed-off-by: Christophe Leroy Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/eccd047f2dfeb550129a1d60035e2233c4401d0c.1749883041.git.christophe.leroy@csgroup.eu commit 2acd83beb4d3fdff1e74f56d2f16f7e70f1faa6d Author: Christophe Leroy Date: Sat Jun 14 08:43:14 2025 +0200 ALSA: pcm: refactor copy from/to user in SNDRV_PCM_IOCTL_SYNC_PTR In an effort of optimising SNDRV_PCM_IOCTL_SYNC_PTR ioctl which is a hot path, lets first refactor the copy from and to user with macros. This is done with macros and not static inline fonctions because types differs between the different versions of snd_pcm_sync_ptr() like functions. First step is to refactor only snd_pcm_ioctl_sync_ptr_compat() and snd_pcm_ioctl_sync_ptr_x32() as it would be a performance regression for snd_pcm_sync_ptr() and snd_pcm_ioctl_sync_ptr_buggy() for now. They may be refactored after next patch. Signed-off-by: Christophe Leroy Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/f8b77932bb9ce96148ae5c3953e7ee44fa2359f8.1749883041.git.christophe.leroy@csgroup.eu commit 762ccc195bfe399199f9da89aade8177826451a4 Author: Ville Syrjälä Date: Fri Mar 14 17:01:36 2025 +0200 drm/i915/dsi: Assert that vfp+vsync+vbp == vtotal on BXT/GLK Windows code seems to do some dodgy looking +/-1 adjustments to some of the vertical timings. Not sure if that's correct or not, but let's at least cross check some of the values we got from the hardware to double check whether the GOP did the same or not. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250314150136.22564-3-ville.syrjala@linux.intel.com Acked-by: Jani Nikula commit 7b3685c9b38c3097f465efec8b24dbed63258cf6 Author: Ville Syrjälä Date: Fri Mar 14 17:01:34 2025 +0200 drm/i915/dsi: Fix off by one in BXT_MIPI_TRANS_VTOTAL BXT_MIPI_TRANS_VTOTAL must be programmed with vtotal-1 instead of vtotal. Make it so. Cc: stable@vger.kernel.org Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250314150136.22564-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit f7a57c9cc5af3cc273c74f3755a1ed2e71990910 Author: Qiu Yutan Date: Sat Jun 14 14:45:28 2025 +0800 Docs/zh_CN: Translate vxlan.rst to Simplified Chinese Update to commit 33a1aaf82bcf("docs: vxlan: add info about device features") Signed-off-by: Qiu Yutan Signed-off-by: Fan Yu Signed-off-by: Jiang Kun Signed-off-by: xu xin Reviewed-by: Dongliang Mu Signed-off-by: Alex Shi commit 93abd332c10159c024cabe01366eba42f1a30ad9 Author: Wang Yaxin Date: Tue May 20 20:59:28 2025 +0800 Docs/zh_CN: Translate napi.rst to Simplified Chinese translate the "napi.rst" into Simplified Chinese. Update to commit bf1b8e0abc39("documentation: networking: Add NAPI config") Signed-off-by: Wang Yaxin Signed-off-by: Jiang Kun Signed-off-by: xu xin Reviewed-by: Yanteng Si Signed-off-by: Alex Shi commit f40627350c1014a2e1ba38d04a363e59bf257a7e Merge: d4d4126fc5d23e 0f3a079786bade Author: Jakub Kicinski Date: Fri Jun 13 18:23:01 2025 -0700 Merge branch 'net-stmmac-rk-much-needed-cleanups' Russell King says: ==================== net: stmmac: rk: much needed cleanups This series starts attacking the reams of fairly identical duplicated code in dwmac-rk. Every new SoC that comes along seems to need more code added to this file because e.g. the way the clock is controlled is different in every SoC. The first thing to realise is that the driver only supports RMII and RGMII interface modes. So, the first patch adds a .get_interfaces() implementation which reports this for phylink's usage, thus ensuring that we error out during initialisation should something that isn't supported be specified. Note that there is one case where there are a pair of interfaces, one supports only RMII the other supports RMII and RGMII, but we report both anyway - something that the existing driver allows. A future patch may attempt to fix this. Rather than writing code, let's realise that there are two major implementations here: 1. a struct clk that needs to be set. 2. writing a register with settings for RGMII and RMII speeds. Provide implementations for these, Also realise that as a result of doing this, we can kill off the .set_rgmii_speed() and .set_rmii_speed() methods by combining them together - indeed, this is what later SoCs already do by pointing both these methods at the same function. Overall, this patch series shrinks the file LOC by almost 8.7% by removing 175 lines from over 2000 lines. Apart from the error reporting changing and restricting interface modes to those that the driver supports, no functional change is anticipated with this patch. However, I have no hardware to test this. ==================== Link: https://patch.msgid.link/aEr1BhIoC6-UM2XV@shell.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 0f3a079786bade0bdadd4c9db6d63459827a3717 Author: Russell King (Oracle) Date: Thu Jun 12 16:41:22 2025 +0100 net: stmmac: rk: remove obsolete .set_*_speed() methods Now that no SoC implements the .set_*_speed() methods, we can get rid of these methods and the now unused code in rk_set_clk_tx_rate(). Arrange for the function to return an error when the .set_speed() method is not implemented. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uPk3O-004CFx-Ir@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 9165487d21a47be6bf0c87a85c68373ca2ad170a Author: Russell King (Oracle) Date: Thu Jun 12 16:41:17 2025 +0100 net: stmmac: rk: convert px30_set_rmii_speed() to .set_speed() Convert px30_set_rmii_speed() to use the common .set_speed() method, which eliminates another user of the older .set_*_speed() methods. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uPk3J-004CFr-FE@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit c5cddcdbd2af9c3622820e31a250d7a656e2588e Author: Russell King (Oracle) Date: Thu Jun 12 16:41:12 2025 +0100 net: stmmac: rk: simplify px30_set_rmii_speed() px30_set_rmii_speed() doesn't need to be as verbose as it is - it merely needs the values for the register and clock rate which depend on the speed, and then call the appropriate functions. Rewrite the function to make it so. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uPk3E-004CFl-BZ@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3930c2cca657bfd03c229a272f21f9b0f2685fad Author: Russell King (Oracle) Date: Thu Jun 12 16:41:07 2025 +0100 net: stmmac: rk: combine .set_*_speed() methods As a result of the previous patches, many of the .set_rgmii_speed() and .set_rmii_speed() implementations are identical apart from the interface mode. Add a new .set_speed() function which takes the interface mode in addition to the speed, and use it to combine the separate implementations, calling the common rk_set_reg_speed() function. Also convert rk_set_clk_mac_speed() to be called by this new method pointer, rather than having these implementations called from both .set_*_speed() methods. Remove all the error messages from the .set_speed() methods, as these return an error code which is propagated up to stmmac_mac_link_up() which will print the error. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uPk39-004CFf-7a@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d8d6096f816117a5732ff96550b59be7ea9f4683 Author: Russell King (Oracle) Date: Thu Jun 12 16:41:02 2025 +0100 net: stmmac: rk: combine clk_mac_speed rate setting functions rk3568_set_gmac_speed() and rv1126_set_clk_mac_speed() are now identical. Combine these so we have a single copy of this code. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uPk34-004CFZ-3y@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 29f0aca1391498c73cd8bedc28c6e7e40f204995 Author: Russell King (Oracle) Date: Thu Jun 12 16:40:57 2025 +0100 net: stmmac: rk: combine rv1126 set_*_speed() methods Just like rk3568, there is no need to have separate RGMII and RMII methods to set clk_mac_speed() as rgmii_clock() can be used to return the clock rate for both RGMII and RMII interface modes. Combine these two methods. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uPk2z-004CFT-0e@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 3de607d13b6bd7fd85759d085b6996112bf6cfe2 Author: Russell King (Oracle) Date: Thu Jun 12 16:40:51 2025 +0100 net: stmmac: rk: add struct for programming register based speeds There is a common pattern in the driver where many SoCs need to write a single register with a value dependent on the interface mode and speed. Rather than having a lot of repeated code, add some common functions and a struct to contain the values to be written to a register to select the RGMII and RMII speeds. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uPk2t-004CFN-Td@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit e6e9e837d312ee872892d9207c58763f0838a36c Author: Russell King (Oracle) Date: Thu Jun 12 16:40:46 2025 +0100 net: stmmac: rk: simplify set_*_speed() Rather than having lots of regmap_write()s to the same register but with different values depending on the speed, reorganise the functions to use a local variable for the value, and then have one regmap_write() call to write it to the register. This reduces the amount of code and is a step towards further reducing the code size. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uPk2o-004CFH-Q4@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 1f59e30403a747eb3a4e2d504018b3c4bcc3e54a Author: Russell King (Oracle) Date: Thu Jun 12 16:40:41 2025 +0100 net: stmmac: rk: add get_interfaces() implementation RK platforms support RGMII and/or RMII depending on the SoC. Detect whether support for a SoC exists by whether the interface specific set_to functions have been populated, and set the appropriate bits in phylink's bitmap of interfaces. This assumes all dwmac interfaces on a SoC have identical support, but it should be noted that this is not true for RK3528 which only supports RGMII on GMAC1. However, the existing code structure permits RGMII to be configured on GMAC0 without complaint, so preserve this behaviour even though it is incorrect to avoid functional change. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uPk2j-004CF6-Mf@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit d4d4126fc5d23e45e6eb3b47663f1df5a5f486b8 Merge: bd1d76a6f18f22 863c7e5059363a Author: Jakub Kicinski Date: Fri Jun 13 18:21:59 2025 -0700 Merge branch 'dpll-add-all-inputs-phase-offset-monitor' Arkadiusz Kubalewski says: ==================== dpll: add all inputs phase offset monitor Add dpll device level feature: phase offset monitor. Phase offset measurement is typically performed against the current active source. However, some DPLL (Digital Phase-Locked Loop) devices may offer the capability to monitor phase offsets across all available inputs. The attribute and current feature state shall be included in the response message of the ``DPLL_CMD_DEVICE_GET`` command for supported DPLL devices. In such cases, users can also control the feature using the ``DPLL_CMD_DEVICE_SET`` command by setting the ``enum dpll_feature_state`` values for the attribute. Once enabled the phase offset measurements for the input shall be returned in the ``DPLL_A_PIN_PHASE_OFFSET`` attribute. Implement feature support in ice driver for dpll-enabled devices. Verify capability: $ ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/dpll.yaml \ --dump device-get [{'clock-id': 4658613174691613800, 'id': 0, 'lock-status': 'locked-ho-acq', 'mode': 'automatic', 'mode-supported': ['automatic'], 'module-name': 'ice', 'type': 'eec'}, {'clock-id': 4658613174691613800, 'id': 1, 'lock-status': 'locked-ho-acq', 'mode': 'automatic', 'mode-supported': ['automatic'], 'module-name': 'ice', 'phase-offset-monitor': 'disable', 'type': 'pps'}] Enable the feature: $ ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/dpll.yaml \ --do device-set --json '{"id":1, "phase-offset-monitor":"enable"}' Verify feature is enabled: $ ./tools/net/ynl/pyynl/cli.py \ --spec Documentation/netlink/specs/dpll.yaml \ --dump device-get [ [...] {'capabilities': {'all-inputs-phase-offset-monitor'}, 'clock-id': 4658613174691613800, 'id': 1, [...] 'phase-offset-monitor': 'enable', [...]] v6: - rebase. ==================== Link: https://patch.msgid.link/20250612152835.1703397-1-arkadiusz.kubalewski@intel.com Signed-off-by: Jakub Kicinski commit 863c7e5059363a37dba19df78a37fb0960b331fa Author: Arkadiusz Kubalewski Date: Thu Jun 12 17:28:35 2025 +0200 ice: add phase offset monitor for all PPS dpll inputs Implement a new admin command and helper function to handle and obtain CGU measurements for input pins. Add new callback operations to control the dpll device-level feature "phase offset monitor," allowing it to be enabled or disabled. If the feature is enabled, provide users with measured phase offsets and notifications. Initialize PPS DPLL with new callback operations if the feature is supported by the firmware. Reviewed-by: Milena Olech Signed-off-by: Arkadiusz Kubalewski Acked-by: Vadim Fedorenko Link: https://patch.msgid.link/20250612152835.1703397-4-arkadiusz.kubalewski@intel.com Signed-off-by: Jakub Kicinski commit 2952daf44a84670a6aa9e13edbc105bdab83ccba Author: Arkadiusz Kubalewski Date: Thu Jun 12 17:28:34 2025 +0200 dpll: add phase_offset_monitor_get/set callback ops Add new callback operations for a dpll device: - phase_offset_monitor_get(..) - to obtain current state of phase offset monitor feature from dpll device, - phase_offset_monitor_set(..) - to allow feature configuration. Obtain the feature state value using the get callback and provide it to the user if the device driver implements callbacks. Execute the set callback upon user requests. Reviewed-by: Milena Olech Reviewed-by: Jiri Pirko Signed-off-by: Arkadiusz Kubalewski Acked-by: Vadim Fedorenko Link: https://patch.msgid.link/20250612152835.1703397-3-arkadiusz.kubalewski@intel.com Signed-off-by: Jakub Kicinski commit c035e736038045b411cb368e63f07bc2f5dbc0e1 Author: Arkadiusz Kubalewski Date: Thu Jun 12 17:28:33 2025 +0200 dpll: add phase-offset-monitor feature to netlink spec Add enum dpll_feature_state for control over features. Add dpll device level attribute: DPLL_A_PHASE_OFFSET_MONITOR - to allow control over a phase offset monitor feature. Attribute is present and shall return current state of a feature (enum dpll_feature_state), if the device driver provides such capability, otherwie attribute shall not be present. Reviewed-by: Aleksandr Loktionov Reviewed-by: Milena Olech Reviewed-by: Jiri Pirko Signed-off-by: Arkadiusz Kubalewski Acked-by: Vadim Fedorenko Link: https://patch.msgid.link/20250612152835.1703397-2-arkadiusz.kubalewski@intel.com Signed-off-by: Jakub Kicinski commit bd1d76a6f18f2222dc08c5aa9ebcd0445111a27d Author: Russell King (Oracle) Date: Thu Jun 12 16:21:17 2025 +0100 net: stmmac: improve .set_clk_tx_rate() method error message Improve the .set_clk_tx_rate() method error message to include the PHY interface mode along with the speed, which will be helpful to the RK implementations. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Reviewed-by: Jacob Keller Link: https://patch.msgid.link/E1uPjjx-0049r5-NN@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 91695b8592638c85dc78a15d59250c62b9c68891 Author: Russell King (Oracle) Date: Thu Jun 12 16:21:04 2025 +0100 net: phy: improve rgmii_clock() documentation Improve the rgmii_clock() documentation to indicate that it can also be used for MII, GMII and RMII modes as well as RGMII as the required clock rates are identical, but note that it won't error out for 1G speeds for MII and RMII. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/E1uPjjk-0049pI-MD@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit b776999bf25ddca9880bc3c9c30b8f84a748504b Author: RubenKelevra Date: Thu Jun 12 16:50:12 2025 +0200 net: pfcp: fix typo in message_priority field name The field is spelled "message_priprity" in the big-endian bit-field definition. Nothing in-tree currently references the member, so the typo does not break kernel builds, but it is clearly incorrect. Signed-off-by: RubenKelevra Link: https://patch.msgid.link/20250612145012.185321-1-rubenkelevra@gmail.com Signed-off-by: Jakub Kicinski commit f5e72579fe34a81c00c53fd3b1d76c16aa4a2a58 Merge: 0051ea4aca6714 cc8aeb0f535f32 Author: Jakub Kicinski Date: Fri Jun 13 18:09:48 2025 -0700 Merge branch 'dp83tg720-reduce-link-recovery' Oleksij Rempel says: ==================== dp83tg720: Reduce link recovery This patch series improves the link recovery behavior of the TI DP83TG720 PHY driver. Previously, we introduced randomized reset delay logic to avoid reset collisions in multi-PHY setups. While this approach was functional, it had notable drawbacks: unpredictable behavior, longer and more variable link recovery times, and overall higher complexity in link handling. With this new approach, we replace the randomized delay with deterministic, role-specific delays in the PHY reset logic. This enables us to: - Remove the redundant empirical 600 ms delay in read_status() - Drop the random polling interval logic - Introduce a clean, adaptive polling strategy with consistent behavior and improved responsiveness As a result, the PHY is now able to recover link reliably in under 1000_ms ==================== Link: https://patch.msgid.link/20250612104157.2262058-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit cc8aeb0f535f3214c2aad13a384e93a55db15569 Author: David Jander Date: Thu Jun 12 12:41:57 2025 +0200 net: phy: dp83tg720: switch to adaptive polling and remove random delays Now that the PHY reset logic includes a role-specific asymmetric delay to avoid synchronized reset deadlocks, the previously used randomized polling intervals are no longer necessary. This patch removes the get_random_u32_below()-based logic and introduces an adaptive polling strategy: - Fast polling for a short time after link-down - Slow polling if the link remains down - Slower polling when the link is up This balances CPU usage and responsiveness while avoiding reset collisions. Additionally, the driver still relies on polling for all link state changes, as interrupt support is not implemented, and link-up events are not reliably signaled by the PHY. The polling parameters are now documented in the updated top-of-file comment. Co-developed-by: Oleksij Rempel Signed-off-by: David Jander Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250612104157.2262058-4-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 491e991f781611c7977a69a1e243fc56cef61e3c Author: David Jander Date: Thu Jun 12 12:41:56 2025 +0200 net: phy: dp83tg720: remove redundant 600ms post-reset delay Now that dp83tg720_soft_reset() introduces role-specific delays to avoid reset synchronization deadlocks, the fixed 600ms post-reset delay in dp83tg720_read_status() is no longer needed. The new logic provides both the required MDC timing and link stabilization, making the old empirical delay redundant and unnecessarily long. Co-developed-by: Oleksij Rempel Signed-off-by: David Jander Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250612104157.2262058-3-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 5f6ec55777d5a1253615851fa50fd405a0db8eb9 Author: David Jander Date: Thu Jun 12 12:41:55 2025 +0200 net: phy: dp83tg720: implement soft reset with asymmetric delay Add a .soft_reset callback for the DP83TG720 PHY that issues a hardware reset followed by an asymmetric post-reset delay. The delay differs based on the PHY's master/slave role to avoid synchronized reset deadlocks, which are known to occur when both link partners use identical reset intervals. The delay includes: - a fixed 1ms wait to satisfy MDC access timing per datasheet, and - an empirically chosen extra delay (97ms for master, 149ms for slave). Co-developed-by: Oleksij Rempel Signed-off-by: David Jander Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250612104157.2262058-2-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 545b343015ed1d34ee3e38dc48c6405097b5ac8d Author: Cheng-Yang Chou Date: Wed Jun 11 21:54:04 2025 +0800 sched_ext: Always use SMP versions in kernel/sched/ext_idle.h Simplify the scheduler by making formerly SMP-only primitives and data structures unconditional. tj: Updated subject for clarity. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 8834ace4a86db0a85cb003c2efd98e6a4389243c Author: Cheng-Yang Chou Date: Wed Jun 11 21:54:03 2025 +0800 sched_ext: Always use SMP versions in kernel/sched/ext_idle.c Simplify the scheduler by making formerly SMP-only primitives and data structures unconditional. tj: Updated subject for clarity. Fixed stray #else block which wasn't removed causing build failure. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 6a1cda143c239475018e7f72f4359ed3c265653c Author: Cheng-Yang Chou Date: Wed Jun 11 21:54:02 2025 +0800 sched_ext: Always use SMP versions in kernel/sched/ext.h Simplify the scheduler by making formerly SMP-only primitives and data structures unconditional. tj: Updated subject for clarity. Replace #if defined() with #ifdef. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 0051ea4aca6714965ea1e5ce78bde329eb37b138 Author: Qiu Yutan Date: Thu Jun 12 11:02:59 2025 +0800 net: arp: use kfree_skb_reason() in arp_rcv() Replace kfree_skb() with kfree_skb_reason() in arp_rcv(). Signed-off-by: Qiu Yutan Signed-off-by: Jiang Kun Link: https://patch.msgid.link/20250612110259698Q2KNNOPQhnIApRskKN3Hi@zte.com.cn Signed-off-by: Jakub Kicinski commit 165af415168568f386709cf8cbc542036cb57fdd Author: Cheng-Yang Chou Date: Wed Jun 11 21:54:01 2025 +0800 sched_ext: Always use SMP versions in kernel/sched/ext.c Simplify the scheduler by making formerly SMP-only primitives and data structures unconditional. tj: Updated subject for clarity. Signed-off-by: Cheng-Yang Chou Signed-off-by: Tejun Heo commit 9ec5e0be0e4969b3f4dcdb6290c2d729e6687475 Merge: 9465f44d2df21b dabe1be4e84c05 Author: Tejun Heo Date: Fri Jun 13 14:21:47 2025 -1000 Merge branch 'sched/core' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into for-6.17 commit 8ffcb7560b4a15faf821df95e3ab532b2b020f8c Author: Corey Minyard Date: Fri Jun 13 19:06:26 2025 -0500 ipmi: Fix strcpy source and destination the same The source and destination of some strcpy operations was the same. Split out the part of the operations that needed to be done for those particular calls so the unnecessary copy wasn't done. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506140756.EFXXvIP4-lkp@intel.com/ Signed-off-by: Corey Minyard commit a7075659f7392454d352870d146ae94b6661aec7 Merge: 08207f42d3ffee f59fdcef3a5878 Author: Jakub Kicinski Date: Fri Jun 13 16:37:28 2025 -0700 Merge branch 'net-phy-improve-mdio-boardinfo-handling' Heiner Kallweit says: ==================== net: phy: improve mdio-boardinfo handling This series includes smaller improvements to mdio-boardinfo handling. ==================== Link: https://patch.msgid.link/6ae7bda0-c093-468a-8ac0-50a2afa73c45@gmail.com Signed-off-by: Jakub Kicinski commit f59fdcef3a58785f3eae34820f7230b17de0f2ec Author: Heiner Kallweit Date: Wed Jun 11 22:13:02 2025 +0200 net: phy: directly copy struct mdio_board_info in mdiobus_register_board_info Using a direct assignment instead of memcpy reduces the text segment size from 0x273 bytes to 0x19b bytes in my case. Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/af371f2a-42f3-4d94-80b9-3420380a3f6f@gmail.com Signed-off-by: Jakub Kicinski commit 11d40db27155690d8de0be4c86c7638b64586c7e Author: Heiner Kallweit Date: Wed Jun 11 22:11:21 2025 +0200 net: phy: improve mdio-boardinfo.h There's no need to include phy.h and mutex.h in mdio-boardinfo.h. However mdio-boardinfo.c included phy.h indirectly this way so far, include it explicitly instead. Whilst at it, sort the included headers properly. Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/86b7a1d6-9f9c-4d22-b3d8-5abdef0bb39a@gmail.com Signed-off-by: Jakub Kicinski commit db4920604a3f2ec40a743c7632d452549736efa2 Author: Heiner Kallweit Date: Wed Jun 11 22:10:27 2025 +0200 net: phy: move definition of struct mdio_board_entry to mdio-boardinfo.c Struct mdio_board_entry isn't used outside mdio-boardinfo.c, so remove the definition from the header file. Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/0afe52d0-6fe6-434a-9881-3979661ff7b0@gmail.com Signed-off-by: Jakub Kicinski commit 0893bf6bb414084bfad2c8fd494fb22545165289 Author: Heiner Kallweit Date: Wed Jun 11 22:09:36 2025 +0200 net: phy: simplify mdiobus_setup_mdiodev_from_board_info - Move declaration of variable bi into list_for_each_entry_safe() - The return value of cb() effectively isn't used, this allows to simplify the code. Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/f6bbe242-b43d-4c2b-8c51-2cb2cefbaf59@gmail.com Signed-off-by: Jakub Kicinski commit 66db1d3cbdb0e89f8a3b5d06a8defb25d1c3f836 Author: Marek Vasut Date: Fri Jun 13 16:46:44 2025 -0500 PCI/pwrctrl: Add optional slot clock for PCI slots Add the ability to enable optional slot clock into the pwrctrl driver. This is used to enable slot clock in split-clock topologies, where the PCIe host/controller supply and PCIe slot supply are not provided by the same clock. The PCIe host/controller clock should be described in the controller node as the controller clock, while the slot clock should be described in controller bridge/slot subnode. Example DT snippet: &pcicontroller { clocks = <&clk_dif 0>; /* PCIe controller clock */ pci@0,0 { #address-cells = <3>; #size-cells = <2>; reg = <0x0 0x0 0x0 0x0 0x0>; compatible = "pciclass,0604"; device_type = "pci"; clocks = <&clk_dif 1>; /* PCIe slot clock */ vpcie3v3-supply = <®_3p3v>; ranges; }; }; Example clock topology: ____________ ____________ | PCIe host | | PCIe slot | | | | | | PCIe RX<|==================|>PCIe TX | | PCIe TX<|==================|>PCIe RX | | | | | | PCIe CLK<|======.. ..======|>PCIe CLK | '------------' || || '------------' || || ____________ || || | 9FGV0441 | || || | | || || | CLK DIF0<|======'' || | CLK DIF1<|=========='' | CLK DIF2<| | CLK DIF3<| '------------' Immutable commit for Geert Uytterhoeven Signed-off-by: Marek Vasut Signed-off-by: Bjorn Helgaas Reviewed-by: Anand Moon Reviewed-by: Manivannan Sadhasivam Reviewed-by: Geert Uytterhoeven Acked-by: Bartosz Golaszewski commit f66b4aaff2548bed5eedded0f47ae3a9ac933cec Author: Luis Gerhorst Date: Fri Jun 13 11:01:58 2025 +0200 bpf: Remove redundant free_verifier_state()/pop_stack() This patch removes duplicated code. Eduard points out [1]: Same cleanup cycles are done in push_stack() and push_async_cb(), both functions are only reachable from do_check_common() via do_check() -> do_check_insn(). Hence, I think that cur state should not be freed in push_*() functions and pop_stack() loop there is not needed. This would also fix the 'symptom' for [2], but the issue also has a simpler fix which was sent separately. This fix also makes sure the push_*() callers always return an error for which error_recoverable_with_nospec(err) is false. This is required because otherwise we try to recover and access the stale `state`. Moving free_verifier_state() and pop_stack(..., pop_log=false) to happen after the bpf_vlog_reset() call in do_check_common() is fine because the pop_stack() call that is moved does not call bpf_vlog_reset() with the pop_log=false parameter. [1] https://lore.kernel.org/all/b6931bd0dd72327c55287862f821ca6c4c3eb69a.camel@gmail.com/ [2] https://lore.kernel.org/all/68497853.050a0220.33aa0e.036a.GAE@google.com/ Reported-by: Eduard Zingerman Link: https://lore.kernel.org/all/b6931bd0dd72327c55287862f821ca6c4c3eb69a.camel@gmail.com/ Acked-by: Eduard Zingerman Signed-off-by: Luis Gerhorst Link: https://lore.kernel.org/r/20250613090157.568349-2-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 4a4b84ba9e453295c746d81cb245c0c5d80050f0 Author: Eduard Zingerman Date: Fri Jun 13 10:53:31 2025 -0700 selftests/bpf: verify jset handling in CFG computation A test case to check if both branches of jset are explored when computing program CFG. At 'if r1 & 0x7 ...': - register 'r2' is computed alive only if jump branch of jset instruction is followed; - register 'r0' is computed alive only if fallthrough branch of jset instruction is followed. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250613175331.3238739-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 3157f7e2999616ac91f4d559a8566214f74000a5 Author: Eduard Zingerman Date: Fri Jun 13 10:53:30 2025 -0700 bpf: handle jset (if a & b ...) as a jump in CFG computation BPF_JSET is a conditional jump and currently verifier.c:can_jump() does not know about that. This can lead to incorrect live registers and SCC computation. E.g. in the following example: 1: r0 = 1; 2: r2 = 2; 3: if r1 & 0x7 goto +1; 4: exit; 5: r0 = r2; 6: exit; W/o this fix insn_successors(3) will return only (4), a jump to (5) would be missed and r2 won't be marked as alive at (3). Fixes: 14c8552db644 ("bpf: simple DFA-based live registers analysis") Reported-by: syzbot+a36aac327960ff474804@syzkaller.appspotmail.com Suggested-by: Alexei Starovoitov Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250613175331.3238739-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit e4c8f96adeb29a98f7848ee793085765cdede64c Merge: ccefa19335a0b8 67cdcc405b46c1 Author: Andrii Nakryiko Date: Fri Jun 13 10:29:46 2025 -0700 Merge branch 'veristat-memory-accounting-for-bpf-programs' Eduard Zingerman says: ==================== veristat: memory accounting for bpf programs When working on the verifier, it is sometimes interesting to know how a particular change affects memory consumption. This patch-set modifies veristat to provide such information. As a collateral, kernel needs an update to make allocations reachable from BPF program load accountable in memcg statistics. Here is a sample output: Program Peak states Peak memory (MiB) --------------- ----------- ----------------- lavd_select_cpu 2153 43 lavd_enqueue 1982 41 lavd_dispatch 3480 28 Technically, this is implemented by creating and entering a new cgroup at the start of veristat execution. The difference between values from cgroup "memory.peak" file before and after bpf_object__load() is used as a metric. To minimize measurements jitter data is collected in megabytes. Changelog: v2: https://lore.kernel.org/bpf/20250612130835.2478649-1-eddyz87@gmail.com/ v2 -> v3: - bpf_verifier_state->jmp_history and bpf_verifier_env->explored_states allocations are switched from GFP_USER to GFP_KERNEL_ACCOUNT (Andrii, Alexei); - veristat.c:STR macro removed, PATH_MAX-1 == 4095 is hard-coded in scanf format strings (Andrii); - env->{orig,stat}_cgroup size changed to PATH_MAX (Andrii); - snprintf_trunc() is removed, flag -Wno-format-truncation is added to CFLAGS for veristat.o when compiled with gcc; v1: https://lore.kernel.org/bpf/20250605230609.1444980-1-eddyz87@gmail.com/ v1 -> v2: - a single cgroup, created at the beginning of execution, is now used for measurements (Andrii, Mykyta); - cgroup namespace is not created, as it turned out to be useless (Andrii); - veristat no longer mounts cgroup fs or changes subtree_control, instead it looks for an existing mount point and reports an error if memory.peak file can't be opened (Andrii, Alexei); - if 'mem_peak' statistics is not enabled, veristat skips cgroup setup; - code sharing with cgroup_helpers.c was considered but was decided against to simplify veristat github sync. ==================== Link: https://patch.msgid.link/20250613072147.3938139-1-eddyz87@gmail.com Signed-off-by: Andrii Nakryiko commit 67cdcc405b46c13446d6d220a108daa2f8de3436 Author: Eduard Zingerman Date: Fri Jun 13 00:21:47 2025 -0700 veristat: Memory accounting for bpf programs This commit adds a new field mem_peak / "Peak memory (MiB)" field to a set of gathered statistics. The field is intended as an estimate for peak verifier memory consumption for processing of a given program. Mechanically stat is collected as follows: - At the beginning of handle_verif_mode() a new cgroup is created and veristat process is moved into this cgroup. - At each program load: - bpf_object__load() is split into bpf_object__prepare() and bpf_object__load() to avoid accounting for memory allocated for maps; - before bpf_object__load(): - a write to "memory.peak" file of the new cgroup is used to reset cgroup statistics; - updated value is read from "memory.peak" file and stashed; - after bpf_object__load() "memory.peak" is read again and difference between new and stashed values is used as a metric. If any of the above steps fails veristat proceeds w/o collecting mem_peak information for a program, reporting mem_peak as -1. While memcg provides data in bytes (converted from pages), veristat converts it to megabytes to avoid jitter when comparing results of different executions. The change has no measurable impact on veristat running time. A correlation between "Peak states" and "Peak memory" fields provides a sanity check for gathered statistics, e.g. a sample of data for sched_ext programs: Program Peak states Peak memory (MiB) ------------------------ ----------- ----------------- lavd_select_cpu 2153 44 lavd_enqueue 1982 41 lavd_dispatch 3480 28 layered_dispatch 1417 17 layered_enqueue 760 11 lavd_cpu_offline 349 6 lavd_cpu_online 349 6 lavd_init 394 6 rusty_init 350 5 layered_select_cpu 391 4 ... rusty_stopping 134 1 arena_topology_node_init 170 0 Signed-off-by: Eduard Zingerman Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250613072147.3938139-3-eddyz87@gmail.com commit 43736ec3e02789795d4e7b9cb49a005fa56c0171 Author: Eduard Zingerman Date: Fri Jun 13 00:21:46 2025 -0700 bpf: Include verifier memory allocations in memcg statistics This commit adds __GFP_ACCOUNT flag to verifier induced memory allocations. The intent is to account for all allocations reachable from BPF_PROG_LOAD command, which is needed to track verifier memory consumption in veristat. This includes allocations done in verifier.c, and some allocations in btf.c, functions in log.c do not allocate. There is also a utility function bpf_memcg_flags() which selectively adds GFP_ACCOUNT flag depending on the `cgroup.memory=nobpf` option. As far as I understand [1], the idea is to remove bpf_prog instances and maps from memcg accounting as these objects do not strictly belong to cgroup, hence it should not apply here. (btf_parse_fields() is reachable from both program load and map creation, but allocated record is not persistent as is freed as soon as map_check_btf() exits). [1] https://lore.kernel.org/all/20230210154734.4416-1-laoar.shao@gmail.com/ Signed-off-by: Eduard Zingerman Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250613072147.3938139-2-eddyz87@gmail.com commit 60ba94338047bb5410a3626ced3380afe9285ed8 Author: Maíra Canal Date: Wed Jun 11 17:56:49 2025 -0300 drm/vkms: Compile all tests with CONFIG_DRM_VKMS_KUNIT_TEST The Kconfig option `CONFIG_DRM_VKMS_KUNIT_TESTS` does not exist. However, the VKMS format tests use such an option for compilation, meaning that they are not compiled at all. Use the Kconfig option `CONFIG_DRM_VKMS_KUNIT_TEST` to compile all VKMS KUnit tests. Fixes: 3e897853debd ("drm/vkms: Create KUnit tests for YUV conversions") Signed-off-by: Maíra Canal Reviewed-by: José Expósito Link: https://lore.kernel.org/r/20250611205704.334527-1-mcanal@igalia.com Signed-off-by: Louis Chauvet commit ccefa19335a0b81f11b0856e951ca909445b3783 Author: Song Liu Date: Thu Jun 12 22:00:01 2025 -0700 bpf/veristat: Fix veristat for map type BPF_MAP_TYPE_CGRP_STORAGE BPF_MAP_TYPE_CGRP_STORAGE doesn't allow non-zero max_entries. So veristat should not set it to 1. Signed-off-by: Song Liu Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250613050001.1058733-1-song@kernel.org commit 000d8b9420c09a42271310c9785e42a229cb069a Merge: 5eb8a0d7733d4c bb8d8ba4715cb8 Author: Mark Brown Date: Fri Jun 13 17:52:51 2025 +0100 ASoC: mediatek: use reserved memory or enable Merge series from Chen-Yu Tsai : Angelo requested that these platforms use reserved memory regions if possible, and fall back to pre-allocated buffers only if that fails, to align with other MediaTek SoCs / platforms that already use reserved memory. The series covers MediaTek's MT8173, MT8183, MT8186, and MT8192 SoCs. There are three parts to the series: - Part one (patches 1 through 5) update the DT bindings to allow having a memory region. The text binding for the MT8173 was converted to YAML and also aligned with current usage by addition of a power domain. Note that the MT8183 text binding was _not_ converted. It is drastically different from what was landed in the device trees. Some time is needed to work out the differences. I might try to recombine the audio clocks (which are actually part of the same hardware block) as well. - Part two (patches 6 through 9) update the audio frontend drivers for the various platforms covered in this series. - Patch 6 is the evolution of version 1, now defaulting to reserved memory if possible. - Patch 7 adds support for >32 bit DMA addresses to the MT8183 driver. This was missing, and prevents the memory regions, which are allocated from the top end of main memory by default, from working. - Patch 8 and 9 are just some minor cleanups to reduce the number of "&pdev->dev" style dereferences. They are placed after the other changes to make it easier for the fixes to be backported. - Part three (patches 10 through 13) add a reserved memory region for the audio frontend on the various platforms. (This part is queued up and therefore not included in v3.) For the MT8173, the change covers the whole platform. In practice there are only ChromeOS devices. For the other platforms, only the ChromeOS devices are covered. These are what I have available for testing. Please have a look. I assume the DT binding and driver changes will go through the ASoC tree, while the device tree changes will go through the MediaTek tree. commit b6a5a16b8b59476156dc6d6f73bffaf3a1707adb Author: Dmitry Vyukov Date: Wed May 21 17:04:30 2025 +0200 selftests: Add tests for PR_SYS_DISPATCH_INCLUSIVE_ON Add tests for PR_SYS_DISPATCH_INCLUSIVE_ON correct/incorrect args, and a test that ensures that the specified range is respected by both PR_SYS_DISPATCH_EXCLUSIVE_ON and PR_SYS_DISPATCH_INCLUSIVE_ON. Signed-off-by: Dmitry Vyukov Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/8df4b50b176b073550bab5b3f3faff752c5f8e17.1747839857.git.dvyukov@google.com commit a2fc422ed75748eef2985454e97847fb22f873c2 Author: Dmitry Vyukov Date: Wed May 21 17:04:29 2025 +0200 syscall_user_dispatch: Add PR_SYS_DISPATCH_INCLUSIVE_ON There are two possible scenarios for syscall filtering: - having a trusted/allowed range of PCs, and intercepting everything else - or the opposite: a single untrusted/intercepted range and allowing everything else (this is relevant for any kind of sandboxing scenario, or monitoring behavior of a single library) The current API only allows the former use case due to allowed range wrap-around check. Add PR_SYS_DISPATCH_INCLUSIVE_ON that enables the second use case. Add PR_SYS_DISPATCH_EXCLUSIVE_ON alias for PR_SYS_DISPATCH_ON to make it clear how it's different from the new PR_SYS_DISPATCH_INCLUSIVE_ON. Signed-off-by: Dmitry Vyukov Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/97947cc8e205ff49675826d7b0327ef2e2c66eea.1747839857.git.dvyukov@google.com commit b89732c8c8357487185f260a723a060b3476144e Author: Dmitry Vyukov Date: Wed May 21 17:04:28 2025 +0200 selftests: Fix errno checking in syscall_user_dispatch test Successful syscalls don't change errno, so checking errno is wrong to ensure that a syscall has failed. For example for the following sequence: prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0xff, 0); EXPECT_EQ(EINVAL, errno); prctl(PR_SET_SYSCALL_USER_DISPATCH, op, 0x0, 0x0, &sel); EXPECT_EQ(EINVAL, errno); only the first syscall may fail and set errno, but the second may succeed and keep errno intact, and the check will falsely pass. Or if errno happened to be EINVAL before, even the first check may falsely pass. Also use EXPECT/ASSERT consistently. Currently there is an inconsistent mix without obvious reasons for usage of one or another. Fixes: 179ef035992e ("selftests: Add kselftest for syscall user dispatch") Signed-off-by: Dmitry Vyukov Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/af6a04dbfef9af8570f5bab43e3ef1416b62699a.1747839857.git.dvyukov@google.com commit 3bc1740d3157c9a9d30614371400f490dbbffd62 Author: Lukas Bulwahn Date: Tue May 27 08:54:34 2025 +0200 MAINTAINERS: Adjust file entry in TPS6131X FLASH LED DRIVER Commit 0d12bb1a7fb6 ("dt-bindings: leds: Add Texas Instruments TPS6131x flash LED driver") adds the device-tree binding file ti,tps61310.yaml, whereas the commit b338a2ae9b31 ("leds: tps6131x: Add support for Texas Instruments TPS6131X flash LED driver") from the same patch series adds the section TEXAS INSTRUMENTS TPS6131X FLASH LED DRIVER in MAINTAINERS, referring to the file ti,tps6131x.yaml. Note the subtle difference between the two file names. Hence, ./scripts/get_maintainer.pl --self-test=patterns complains about a broken reference. Adjust the file reference to the intended file. Fixes: b338a2ae9b31 ("leds: tps6131x: Add support for Texas Instruments TPS6131X flash LED driver") Signed-off-by: Lukas Bulwahn Reviewed-by: Matthias Fend Link: https://lore.kernel.org/r/20250527065434.202622-1-lukas.bulwahn@redhat.com Signed-off-by: Lee Jones commit b83e8fe4fae981d35a362109053b7447ebd037d4 Author: Christian König Date: Fri Jun 13 15:50:41 2025 +0200 Revert "drm/prime: remove drm_prime_lookup_buf_by_handle" This reverts commit c2aa5603af309968a10f8e0d929ec7662ada5f78. Signed-off-by: Christian König Acked-by: Simona Vetter Link: https://lore.kernel.org/r/aEwls5hPP9p-DPtt@phenom.ffwll.local commit fab15f57360b1e6620a1d0d6b0fbee896e6c1f07 Author: Krzysztof Kozlowski Date: Thu May 29 08:33:36 2025 +0200 leds: flash: leds-qcom-flash: Fix registry access after re-bind Driver in probe() updates each of 'reg_field' with 'reg_base': for (i = 0; i < REG_MAX_COUNT; i++) regs[i].reg += reg_base; 'reg_field' array (under variable 'regs' above) is statically allocated, thus each re-bind would add another 'reg_base' leading to bogus register addresses. Constify the local 'reg_field' array and duplicate it in probe to solve this. Fixes: 96a2e242a5dc ("leds: flash: Add driver to support flash LED module in QCOM PMICs") Cc: stable@vger.kernel.org Signed-off-by: Krzysztof Kozlowski Reviewed-by: Fenglin Wu Link: https://lore.kernel.org/r/20250529063335.8785-2-krzysztof.kozlowski@linaro.org Signed-off-by: Lee Jones commit b04e69b2636b19f6ad8803a1873a565c7c419ac6 Author: Thomas Zimmermann Date: Fri Jun 13 13:16:46 2025 +0200 drm/format-helper: Update tests after BT.601 changes Commit a979a54165c2 ("drm/format-helper: Normalize BT.601 factors to 256") improved rounding precision of the BT.601 calculation, which impacts the results of soem of the format-helper tests. Adapt the test to the new results. v2: - fix spelling in commit description Signed-off-by: Thomas Zimmermann Fixes: a979a54165c2 ("drm/format-helper: Normalize BT.601 factors to 256") Cc: Thomas Zimmermann Cc: Javier Martinez Canillas Cc: Maarten Lankhorst Cc: Maxime Ripard Acked-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250613111711.136993-1-tzimmermann@suse.de commit 66067c3c8a1ee097e9c30e8bbd643b12ba54a6b0 Author: Brian Norris Date: Thu May 22 14:08:01 2025 -0700 genirq: Add kunit tests for depth counts There have been a few bugs and/or misunderstandings about the reference counting, and startup/shutdown behaviors in the IRQ core and related CPU hotplug code. These 4 test cases try to capture a few interesting cases. * irq_disable_depth_test: basic request/disable/enable sequence * irq_free_disabled_test: request/disable/free/re-request sequence - this catches errors on previous revisions of my work * irq_cpuhotplug_test: exercises managed-affinity IRQ + CPU hotplug. This captures a problematic test case which was fixed recently. This test requires CONFIG_SMP and a hotpluggable CPU#1. * irq_shutdown_depth_test: exercises similar behavior from irq_cpuhotplug_test, but directly using irq_*() APIs instead of going through CPU hotplug. This still requires CONFIG_SMP, because managed-affinity is stubbed out (and not all APIs are even present) without it. Note the use of 'imply SMP': ARCH=um doesn't support SMP, and kunit is often exercised there. Thus, 'imply' will force SMP on where possible (such as ARCH=x86_64), but leave it off where it's not. Behavior on various SMP and ARCH configurations: $ tools/testing/kunit/kunit.py run 'irq_test_cases*' --arch x86_64 --qemu_args '-smp 2' [...] [11:12:24] Testing complete. Ran 4 tests: passed: 4 $ tools/testing/kunit/kunit.py run 'irq_test_cases*' --arch x86_64 [...] [11:13:27] [SKIPPED] irq_cpuhotplug_test [11:13:27] ================= [PASSED] irq_test_cases ================== [11:13:27] ============================================================ [11:13:27] Testing complete. Ran 4 tests: passed: 3, skipped: 1 # default: ARCH=um $ tools/testing/kunit/kunit.py run 'irq_test_cases*' [11:14:26] [SKIPPED] irq_shutdown_depth_test [11:14:26] [SKIPPED] irq_cpuhotplug_test [11:14:26] ================= [PASSED] irq_test_cases ================== [11:14:26] ============================================================ [11:14:26] Testing complete. Ran 4 tests: passed: 2, skipped: 2 Without commit 788019eb559f ("genirq: Retain disable depth for managed interrupts across CPU hotplug"), this fails as follows: [11:18:55] =============== irq_test_cases (4 subtests) ================ [11:18:55] [PASSED] irq_disable_depth_test [11:18:55] [PASSED] irq_free_disabled_test [11:18:55] # irq_shutdown_depth_test: EXPECTATION FAILED at kernel/irq/irq_test.c:147 [11:18:55] Expected desc->depth == 1, but [11:18:55] desc->depth == 0 (0x0) [11:18:55] ------------[ cut here ]------------ [11:18:55] Unbalanced enable for IRQ 26 [11:18:55] WARNING: CPU: 1 PID: 36 at kernel/irq/manage.c:792 __enable_irq+0x36/0x60 ... [11:18:55] [FAILED] irq_shutdown_depth_test [11:18:55] #1 [11:18:55] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:202 [11:18:55] Expected irqd_is_activated(data) to be false, but is true [11:18:55] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:203 [11:18:55] Expected irqd_is_started(data) to be false, but is true [11:18:55] # irq_cpuhotplug_test: EXPECTATION FAILED at kernel/irq/irq_test.c:204 [11:18:55] Expected desc->depth == 1, but [11:18:55] desc->depth == 0 (0x0) [11:18:55] ------------[ cut here ]------------ [11:18:55] Unbalanced enable for IRQ 27 [11:18:55] WARNING: CPU: 0 PID: 38 at kernel/irq/manage.c:792 __enable_irq+0x36/0x60 ... [11:18:55] [FAILED] irq_cpuhotplug_test [11:18:55] # module: irq_test [11:18:55] # irq_test_cases: pass:2 fail:2 skip:0 total:4 [11:18:55] # Totals: pass:2 fail:2 skip:0 total:4 [11:18:55] ================= [FAILED] irq_test_cases ================== [11:18:55] ============================================================ [11:18:55] Testing complete. Ran 4 tests: passed: 2, failed: 2 Signed-off-by: Brian Norris Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250522210837.4135244-1-briannorris@chromium.org commit 09735f0624b494c0959f3327af009283567af320 Author: Viresh Kumar Date: Tue Jun 10 13:27:13 2025 +0530 smp: Fix typo in comment for raw_smp_processor_id() The comment in `smp.h` incorrectly refers to `raw_processor_id()` instead of the correct function name `raw_smp_processor_id()`. Suggested-by: Boqun Feng Signed-off-by: Viresh Kumar Signed-off-by: Thomas Gleixner Reviewed-by: Boqun Feng Link: https://lore.kernel.org/all/d096779819962c305b85cd12bda41b593e0981aa.1749536622.git.viresh.kumar@linaro.org commit 5eb8a0d7733d4cd32a776acf1d1aa1c7c01c8a14 Author: Terry Cheong Date: Fri Jun 13 16:51:27 2025 +0800 ASoC: hdmi-codec: use SND_JACK_AVOUT as jack status Use SND_JACK_AVOUT as the mask to align with hdac_hdmi driver so that we can determine HDMI/DP devices from event type. Most drivers that uses hdmi-codec driver will not be affected since they are creating jacks with SND_JACK_LINEOUT mask. They will still report SND_JACK_LINEOUT when the jack status is updated with snd_soc_jack_report. Signed-off-by: Terry Cheong Link: https://patch.msgid.link/20250613-hdmi-v1-1-665ba7ecd5e7@chromium.org Signed-off-by: Mark Brown commit dae29b678bb74aa2995c1d2b0fa6b1b91f5d8986 Author: Kuninori Morimoto Date: Fri Jun 13 06:00:20 2025 +0000 ASoC: soc-ops-test: dynamically allocate struct snd_ctl_elem_value This structure is really too larget to be allocated on the stack: linux/sound/soc/soc-ops-test.c:520:1: error: the frame size of\ 1304 bytes is larger than 1280 bytes [-Werror=frame-larger-than=] Change the function to dynamically allocate it instead. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87sek489l8.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 22a645672724e4efb55851843882b759c257a099 Merge: 6cafcc53eb5fff 83f066fac3c231 Author: Mark Brown Date: Fri Jun 13 12:13:16 2025 +0100 spi: Merge up fixes Needed for new development of the pci1xxxx driver. commit d0630a0b80c08530857146e3bf183a7d6b743847 Author: Takashi Iwai Date: Fri Jun 13 10:15:30 2025 +0200 ALSA: usb-audio: Fix build with CONFIG_INPUT=n The recent addition of DualSense mixer quirk relies on the input device handle, and the build can fail if CONFIG_INPUT isn't set. Put (rather ugly) workarounds to wrap with IS_REACHABLE() for avoiding the build error. Fixes: 79d561c4ec04 ("ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506130733.gnPKw2l3-lkp@intel.com/ Reviewed-by: Cristian Ciocaltea Link: https://patch.msgid.link/20250613081543.7404-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit a099b09a3342a0b28ea330e405501b5b4d0424b4 Author: Wei Gao Date: Fri Jun 13 11:18:38 2025 -0400 ext2: Handle fiemap on empty files to prevent EINVAL Previously, ext2_fiemap would unconditionally apply "len = min_t(u64, len, i_size_read(inode));", When inode->i_size was 0 (for an empty file), this would reduce the requested len to 0. Passing len = 0 to iomap_fiemap could then result in an -EINVAL error, even for valid queries on empty files. Link: https://github.com/linux-test-project/ltp/issues/1246 Signed-off-by: Wei Gao Signed-off-by: Jan Kara Link: https://patch.msgid.link/20250613152402.3432135-1-wegao@suse.com commit 73f0f2b52c5ea67b3140b23f58d8079d158839c8 Author: Armin Wolf Date: Tue Jun 10 07:55:26 2025 +0200 platform/x86: wmi: Fix WMI device naming issue When multiple WMI devices with the same GUID are present inside a given system, the WMI driver core might fail to register all of them. Consider the following scenario: WMI devices ([-]): 05901221-D566-11D1-B2F0-00A0C9062910 (on PNP0C14:00) 05901221-D566-11D1-B2F0-00A0C9062910-1 (on PNP0C14:01) If the WMI core driver somehow unbinds from PNP0C14:00, the following will happen upon rebinding: 1. The WMI driver core counts all registered WMI devices with a GUID of 05901221-D566-11D1-B2F0-00A0C9062910 (count: 1). 2. The new WMI device will be named "05901221-D566-11D1-B2F0-00A0C9062910-1" because another device with the same GUID is already registered (on PNP0C14:01). 3. The new WMI device cannot be registered due to a name conflict. Use a IDA when building the WMI device name to avoid such name collisions by ensuring that a given WMI device ID is not reused. Userspace applications using udev for WMI device detection are not impacted by this change. Additionally userspace applications that do fully support the existing naming scheme are also not impacted. Only userspace applications using hardcoded sysfs paths will break. Introduce a kconfig option for restoring the old naming scheme to give developers time to fix any compatibility issues. Tested on a Asus Prime B650-Plus. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250610055526.23688-2-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit c9de2e5c15cba9e9be7fd124a74b9067560d4746 Author: Armin Wolf Date: Tue Jun 10 07:55:25 2025 +0200 Documentation: ABI: Update WMI device paths in ABI docs The WMI driver core might append an ID to the WMI device name to avoid name collisions in case multiple WMI devices with the same GUID are present. Update all sysfs path referring to WMI devices to inform users about this important detail. Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20250610055526.23688-1-W_Armin@gmx.de Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d2b16853ad704ac7e1550d6faacdc53925494ebf Author: Jerome Brunet Date: Tue Jun 10 10:41:07 2025 +0200 platform: arm64: lenovo-yoga-c630: use the auxiliary device creation helper The auxiliary device creation of this driver is simple enough to use the available auxiliary device creation helper. Use it and remove some boilerplate code. Signed-off-by: Jerome Brunet Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250610-yoga-aux-v1-1-d6115aa1683c@baylibre.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit dce77641056ea4fb2efab0a66d6929a5008d7235 Author: Jelle van der Waa Date: Mon Jun 9 12:21:14 2025 +0200 platform/x86: fujitsu: clamp charge_control_end_threshold values to 50 Follow the sysfs ABI documentation that drivers should round written values to the nearest supported value instead of returning an error. Tested on a Fujitsu Lifebook U7720. Signed-off-by: Jelle van der Waa Reviewed-by: Hans de Goede Acked-by: Jonathan Woithe Link: https://lore.kernel.org/r/20250609102115.36936-3-jvanderwaa@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit d9926f09edabd81db86768fd87eff3e163f109e2 Author: Jelle van der Waa Date: Mon Jun 9 12:21:13 2025 +0200 platform/x86: fujitsu: use unsigned int for kstrtounit The charge control threshold value ranges from 0-100. Signed-off-by: Jelle van der Waa Reviewed-by: Hans de Goede Acked-by: Jonathan Woithe Link: https://lore.kernel.org/r/20250609102115.36936-2-jvanderwaa@redhat.com [ij: use reverse xmas-tree order] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 5a7c909a53875e9c0c64cdf8e52b5716d8a74523 Author: Bartosz Golaszewski Date: Thu Jun 12 09:48:35 2025 +0200 platform/x86: silicom: remove unnecessary GPIO line direction check As of commit 92ac7de3175e3 ("gpiolib: don't allow setting values on input lines"), the GPIO core makes sure values cannot be set on input lines. Remove the unnecessary check. Signed-off-by: Bartosz Golaszewski Link: https://lore.kernel.org/r/20250612074835.13800-1-brgl@bgdev.pl Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 05651018f04ab00a84da8a47feb3a605ec1c7e41 Author: Thomas Richard Date: Mon Jun 9 14:34:49 2025 +0200 platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: Use devm_pinctrl_register_mappings() Use devm_pinctrl_register_mappings(), so the core automatically unregisters the pinctrl mappings. It makes the code easier to read. Signed-off-by: Thomas Richard Reviewed-by: Hans de Goede Link: https://lore.kernel.org/r/20250609-lenovo-yoga-tab2-pro-1380-fastcharger-devm-pinctrl-register-mappings-v1-1-fb601f2b80f6@bootlin.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 6418a8504187dc7f5b6f9d0649c03e362cb0664b Author: Kees Cook Date: Thu May 29 11:18:37 2025 -0700 platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches When KCOV is enabled all functions get instrumented, unless the __no_sanitize_coverage attribute is used. To prepare for __no_sanitize_coverage being applied to __init functions[1], we have to handle differences in how GCC's inline optimizations get resolved. For thinkpad_acpi routines, this means forcing two functions to be inline with __always_inline. Link: https://lore.kernel.org/lkml/20250523043935.2009972-11-kees@kernel.org/ [1] Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20250529181831.work.439-kees@kernel.org Signed-off-by: Ilpo Järvinen commit 08207f42d3ffee43c97f16baf03d7426a3c353ca Merge: 6d4e01d29d8735 52fdba899e6ffa Author: David S. Miller Date: Fri Jun 13 10:31:07 2025 +0100 Merge branch 'ionic-cleanups' into main Shannon Nelson says: ==================== ionic: three little changes These are three little changes for the code from inspection and testing. ==================== Signed-off-by: David S. Miller commit 52fdba899e6ffaaa1e74d4b4877125191a9e8e68 Author: Shannon Nelson Date: Mon Jun 9 14:46:44 2025 -0700 ionic: cancel delayed work earlier in remove Cancel any entries on the delayed work queue before starting to tear down the lif to be sure there is no race with any other events. Signed-off-by: Shannon Nelson Reviewed-by: Simon Horman Reviewed-by: Joe Damato Signed-off-by: David S. Miller commit c9080abea1e69b8b1408ec7dec0acdfdc577a3e2 Author: Shannon Nelson Date: Mon Jun 9 14:46:43 2025 -0700 ionic: clean dbpage in de-init Since the kern_dbpage gets set up in ionic_lif_init() and that function's error path will clean it if needed, the kern_dbpage on teardown should be cleaned in ionic_lif_deinit(), not in ionic_lif_free(). As it is currently we get a double call to iounmap() on kern_dbpage if the PCI ionic fails setting up the lif. One example of this is when firmware isn't responding to AdminQ requests and ionic's first AdminQ call fails to setup the NotifyQ. Signed-off-by: Shannon Nelson Reviewed-by: Simon Horman Reviewed-by: Joe Damato Signed-off-by: David S. Miller commit 696158ff4dcdd600559273a45fad166744dc73fc Author: Shannon Nelson Date: Mon Jun 9 14:46:42 2025 -0700 ionic: print firmware heartbeat as unsigned The firmware heartbeat value is an unsigned number, and seeing a negative number when it gets big is a little disconcerting. Example: ionic 0000:24:00.0: FW heartbeat stalled at -1342169688 Print using the unsigned flag. Signed-off-by: Shannon Nelson Reviewed-by: Simon Horman Reviewed-by: Joe Damato Signed-off-by: David S. Miller commit 1029436218e50168812dbc44b16bca6d35721b0b Author: Suman Kumar Chakraborty Date: Thu Jun 5 12:25:27 2025 +0100 Documentation: qat: update sysfs-driver-qat for GEN6 devices Reorganize and expand documentation for service configurations. This reworks the `cfg_services` section by removing explicit service combinations (e.g., asym;sym, sym;asym) and clarifying that multiple services can be configured in any order. Update the documentation to reflect that the attribute previously limited to qat_4xxx devices is also applicable to qat_6xxx devices. Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Reviewed-by: Fiona Trahe Signed-off-by: Herbert Xu commit 8f2e1a3cd78852f3a5ceef3367a0ce942928cee7 Author: Suman Kumar Chakraborty Date: Thu Jun 5 12:25:26 2025 +0100 crypto: qat - add support for decompression service to GEN6 devices Add support to configure decompression as a separate service for QAT GEN6 devices. A new arbiter configuration has been added to map the hardware decompression threads to all ring pairs. The decompression service is enabled via sysfs by writing "decomp" to "/sys/bus/pci/devices//qat/cfg_services". The decompression service is not supported on QAT GEN2 and GEN4 devices, and attempting it results in an invalid write error. The existing compression service for QAT GEN2 and GEN4 devices remains unchanged and supports both compression and decompression operations on the same ring pair. Co-developed-by: Karthikeyan Gopal Signed-off-by: Karthikeyan Gopal Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 758f5bdf1bef2c3820de38283bc35cf668b85f9c Author: Yury Norov Date: Wed Jun 4 19:58:01 2025 -0400 padata: use cpumask_nth() padata_do_parallel() and padata_index_to_cpu() duplicate cpumask_nth(). Fix both and use the generic helper. Signed-off-by: Yury Norov Signed-off-by: Herbert Xu commit 4b7ed1ce411e5049b3c842009981c9c5191fea49 Author: Yury Norov [NVIDIA] Date: Wed Jun 4 16:47:41 2025 -0400 crypto: caam - Fix opencoded cpumask_next_wrap() in caam_drv_ctx_init() The dedicated cpumask_next_wrap() is more verbose and better optimized comparing to cpumask_next() followed by cpumask_first(). Signed-off-by: Yury Norov [NVIDIA] Signed-off-by: Herbert Xu commit ea87e6c40a79de84cc2c6186eafb476be79916e0 Author: Yury Norov [NVIDIA] Date: Wed Jun 4 16:47:40 2025 -0400 crypto: pcrypt - Optimize pcrypt_aead_init_tfm() The function opencodes cpumask_nth(). The dedicated helper is faster than an open for-loop. Signed-off-by: Yury Norov [NVIDIA] Signed-off-by: Herbert Xu commit 254923ca8715f623704378266815b6d14eb26194 Author: Svyatoslav Pankratov Date: Wed Jun 4 16:59:56 2025 +0100 crypto: qat - fix state restore for banks with exceptions Change the logic in the restore function to properly handle bank exceptions. The check for exceptions in the saved state should be performed before conducting any other ringstat register checks. If a bank was saved with an exception, the ringstat will have the appropriate rp_halt/rp_exception bits set, causing the driver to exit the restore process with an error. Instead, the restore routine should first check the ringexpstat register, and if any exception was raised, it should stop further checks and return without any error. In other words, if a ring pair is in an exception state at the source, it should be restored the same way at the destination but without raising an error. Even though this approach might lead to losing the exception state during migration, the driver will log the exception from the saved state during the restore process. Signed-off-by: Svyatoslav Pankratov Fixes: bbfdde7d195f ("crypto: qat - add bank save and restore flows") Signed-off-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 53669ff591d4deb2d80eed4c07593ad0c0b45899 Author: Ahsan Atta Date: Wed Jun 4 09:23:43 2025 +0100 crypto: qat - allow enabling VFs in the absence of IOMMU The commit ca88a2bdd4dd ("crypto: qat - allow disabling SR-IOV VFs") introduced an unnecessary change that prevented enabling SR-IOV when IOMMU is disabled. In certain scenarios, it is desirable to enable SR-IOV even in the absence of IOMMU. Thus, restoring the previous functionality to allow VFs to be enumerated in the absence of IOMMU. Fixes: ca88a2bdd4dd ("crypto: qat - allow disabling SR-IOV VFs") Signed-off-by: Ahsan Atta Reviewed-by: Giovanni Cabiddu Reviewed-by: Michal Witwicki Signed-off-by: Herbert Xu commit 0fa766726c091ff0ec7d26874f6e4724d23ecb0e Author: Ashish Kalra Date: Wed May 28 20:20:18 2025 +0000 crypto: ccp - Fix dereferencing uninitialized error pointer Fix below smatch warnings: drivers/crypto/ccp/sev-dev.c:1312 __sev_platform_init_locked() error: we previously assumed 'error' could be null Fixes: 9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown") Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202505071746.eWOx5QgC-lkp@intel.com/ Signed-off-by: Ashish Kalra Reviewed-by: Tom Lendacky Signed-off-by: Herbert Xu commit 1b9209d57ac3c3e779d68da907505175b6b058b0 Author: Amit Singh Tomar Date: Wed May 28 20:29:41 2025 +0530 crypto: octeontx2 - get engine group number for asymmetric engine Cryptographic Accelerator Unit (CPT) support different engine groups, one for asymmetric algorithms (only AE engines in this group), one for the most common symmetric algorithms (all SE and all IE engines in this group), and one for other symmetric algorithms (only SE engines in this group). For symmetric engine (SE), we obtain the group number using "MBOX_MSG_GET_ENG_GRP_NUM" mailbox. Let's follow a similar approach to determine the group number for asymmetric engine (AE). Signed-off-by: Amit Singh Tomar Signed-off-by: Herbert Xu commit fbfe4f47d931dc36fccec66546599663e08f4943 Author: Amit Singh Tomar Date: Wed May 28 20:29:40 2025 +0530 crypto: octeontx2 - Rework how engine group number is obtained By default, otx2_cpt_get_kcrypto_eng_grp_num() returns the engine group number of SE engine type. Add an engine type parameter to support retrieving the engine group number for different engine types. Since otx2_cpt_get_kcrypto_eng_grp_num() always returns the kernel crypto engine group number, rename it to otx2_cpt_get_eng_grp_num(). Signed-off-by: Amit Singh Tomar Signed-off-by: Herbert Xu commit 71203f68c7749609d7fc8ae6ad054bdedeb24f91 Author: Herbert Xu Date: Sat May 24 20:32:20 2025 +0800 padata: Fix pd UAF once and for all There is a race condition/UAF in padata_reorder that goes back to the initial commit. A reference count is taken at the start of the process in padata_do_parallel, and released at the end in padata_serial_worker. This reference count is (and only is) required for padata_replace to function correctly. If padata_replace is never called then there is no issue. In the function padata_reorder which serves as the core of padata, as soon as padata is added to queue->serial.list, and the associated spin lock released, that padata may be processed and the reference count on pd would go away. Fix this by getting the next padata before the squeue->serial lock is released. In order to make this possible, simplify padata_reorder by only calling it once the next padata arrives. Fixes: 16295bec6398 ("padata: Generic parallelization/serialization interface") Signed-off-by: Herbert Xu commit 73c2437109c3eab274258a6430ae5dafac1ef43e Author: Herbert Xu Date: Fri May 23 20:28:56 2025 +0800 crypto: s390/sha3 - Use cpu byte-order when exporting The sha3 partial hash on s390 is in little-endian just like the final hash. However the generic implementation produces native or big-endian partial hashes. Make s390 sha3 conform to that by doing the byte-swap on export and import. Reported-by: Ingo Franzki Fixes: 6f90ba706551 ("crypto: s390/sha3 - Use API partial block handling") Signed-off-by: Herbert Xu commit 1b39bc4a703a63a22c08232015540adfb31f22ba Author: Herbert Xu Date: Fri May 23 19:24:34 2025 +0800 crypto: s390/hmac - Fix counter in export state The hmac export state needs to be one block-size bigger to account for the ipad. Reported-by: Ingo Franzki Fixes: 08811169ac01 ("crypto: s390/hmac - Use API partial block handling") Signed-off-by: Herbert Xu commit 442134ab30e75b7229c4bfc1ac5641d245cffe27 Author: Herbert Xu Date: Thu May 22 20:41:28 2025 +0800 crypto: marvell/cesa - Fix engine load inaccuracy If an error occurs during queueing the engine load will never be decremented. Fix this by moving the engine load adjustment into the cleanup function. Fixes: bf8f91e71192 ("crypto: marvell - Add load balancing between engines") Signed-off-by: Herbert Xu commit a091a58b8a1eba2f243b0c05bcc82bdc2a4a338d Author: Bharat Bhushan Date: Thu May 22 15:36:27 2025 +0530 crypto: octeontx2 - Fix address alignment on CN10KB and CN10KA-B0 octeontx2 crypto driver allocates memory using kmalloc/kzalloc, and uses this memory for dma (does dma_map_single()). It assumes that kmalloc/kzalloc will return 128-byte aligned address. But kmalloc/kzalloc returns 8-byte aligned address after below changes: "9382bc44b5f5 arm64: allow kmalloc() caches aligned to the smaller cache_line_size() Memory allocated are used for following purpose: - Input data or scatter list address - 8-Byte alignment - Output data or gather list address - 8-Byte alignment - Completion address - 32-Byte alignment. This patch ensures all addresses are aligned as mentioned above. Signed-off-by: Bharat Bhushan Cc: # v6.8+ Signed-off-by: Herbert Xu commit 2e13163b43e6bb861182ea999a80dd1d893c0cbf Author: Bharat Bhushan Date: Thu May 22 15:36:26 2025 +0530 crypto: octeontx2 - Fix address alignment on CN10K A0/A1 and OcteonTX2 octeontx2 crypto driver allocates memory using kmalloc/kzalloc, and uses this memory for dma (does dma_map_single()). It assumes that kmalloc/kzalloc will return 128-byte aligned address. But kmalloc/kzalloc returns 8-byte aligned address after below changes: "9382bc44b5f5 arm64: allow kmalloc() caches aligned to the smaller cache_line_size() Memory allocated are used for following purpose: - Input data or scatter list address - 8-Byte alignment - Output data or gather list address - 8-Byte alignment - Completion address - 32-Byte alignment. This patch ensures all addresses are aligned as mentioned above. Signed-off-by: Bharat Bhushan Cc: # v6.5+ Signed-off-by: Herbert Xu commit b7b88b4939e71ef2aed8238976a2bbabcb63a790 Author: Bharat Bhushan Date: Thu May 22 15:36:25 2025 +0530 crypto: octeontx2 - Fix address alignment issue on ucode loading octeontx2 crypto driver allocates memory using kmalloc/kzalloc, and uses this memory for dma (does dma_map_single()). It assumes that kmalloc/kzalloc will return 128-byte aligned address. But kmalloc/kzalloc returns 8-byte aligned address after below changes: "9382bc44b5f5 arm64: allow kmalloc() caches aligned to the smaller cache_line_size()" Completion address should be 32-Byte alignment when loading microcode. Signed-off-by: Bharat Bhushan Cc: # v6.5+ Signed-off-by: Herbert Xu commit 2157e50f65d2030f07ea27ef7ac4cfba772e98ac Author: Bharat Bhushan Date: Thu May 22 15:36:24 2025 +0530 crypto: octeontx2 - add timeout for load_fvc completion poll Adds timeout to exit from possible infinite loop, which polls on CPT instruction(load_fvc) completion. Signed-off-by: Srujana Challa Signed-off-by: Bharat Bhushan Signed-off-by: Herbert Xu commit 0e801fe7d8103049fb2da1646ccc47e8c6d32596 Author: Herbert Xu Date: Thu May 22 17:32:47 2025 +0800 crypto: marvell/cesa - Remove unnecessary state setting on final There is no point in setting the hash state after finalisation since the hash state must never be used again. Remove that code. Signed-off-by: Herbert Xu commit 4cc871ad0173e8bc22f80e3609e34d546d30ef1a Author: Suman Kumar Chakraborty Date: Thu May 22 09:21:41 2025 +0100 crypto: qat - use unmanaged allocation for dc_data The dc_data structure holds data required for handling compression operations, such as overflow buffers. In this context, the use of managed memory allocation APIs (devm_kzalloc() and devm_kfree()) is not necessary, as these data structures are freed and re-allocated when a device is restarted in adf_dev_down() and adf_dev_up(). Additionally, managed APIs automatically handle memory cleanup when the device is detached, which can lead to conflicts with manual cleanup processes. Specifically, if a device driver invokes the adf_dev_down() function as part of the cleanup registered with devm_add_action_or_reset(), it may attempt to free memory that is also managed by the device's resource management system, potentially leading to a double-free. This might result in a warning similar to the following when unloading the device specific driver, for example qat_6xxx.ko: qat_free_dc_data+0x4f/0x60 [intel_qat] qat_compression_event_handler+0x3d/0x1d0 [intel_qat] adf_dev_shutdown+0x6d/0x1a0 [intel_qat] adf_dev_down+0x32/0x50 [intel_qat] devres_release_all+0xb8/0x110 device_unbind_cleanup+0xe/0x70 device_release_driver_internal+0x1c1/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x74/0xf0 pci_unregister_driver+0x2e/0xb0 Use unmanaged memory allocation APIs (kzalloc_node() and kfree()) for the dc_data structure. This ensures that memory is explicitly allocated and freed under the control of the driver code, preventing manual deallocation from interfering with automatic cleanup. Fixes: 1198ae56c9a5 ("crypto: qat - expose deflate through acomp api for QAT GEN2") Signed-off-by: Suman Kumar Chakraborty Reviewed-by: Giovanni Cabiddu Signed-off-by: Herbert Xu commit 9d50a25eeb05c45fef46120f4527885a14c84fb2 Author: Vegard Nossum Date: Wed May 21 14:55:19 2025 +0200 crypto: testmgr - desupport SHA-1 for FIPS 140 The sunset period of SHA-1 is approaching [1] and FIPS 140 certificates have a validity of 5 years. Any distros starting FIPS certification for their kernels now would therefore most likely end up on the NIST Cryptographic Module Validation Program "historical" list before their certification expires. While SHA-1 is technically still allowed until Dec. 31, 2030, it is heavily discouraged by NIST and it makes sense to set .fips_allowed to 0 now for any crypto algorithms that reference it in order to avoid any costly surprises down the line. [1]: https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm Acked-by: Stephan Mueller Cc: Marcus Meissner Cc: Jarod Wilson Cc: Neil Horman Cc: John Haxby Signed-off-by: Vegard Nossum Signed-off-by: Herbert Xu commit aaeff14688d0254b39731d9bb303c79bfd610f7d Author: Mario Limonciello Date: Mon May 19 10:21:01 2025 -0500 crypto: ccp - Add missing bootloader info reg for pspv6 The bootloader info reg for pspv6 is the same as pspv4 and pspv5. Suggested-by: Tom Lendacky Signed-off-by: Mario Limonciello Signed-off-by: Herbert Xu commit 003bb3745920cfa754d69a6c32d2c06b561af75b Author: Ovidiu Panait Date: Mon May 19 18:13:50 2025 +0300 crypto: sun8i-ce - use helpers to get hash block and digest sizes Use crypto_ahash_blocksize() and crypto_ahash_digestsize() helpers instead of directly accessing 'struct ahash_alg' members. Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit 67a4ad04e3d530f50497205ada07c78a89f90de7 Author: Ovidiu Panait Date: Mon May 19 18:13:49 2025 +0300 crypto: sun8i-ce - remove ivlen field of sun8i_cipher_req_ctx Remove `ivlen` field of `sun8i_cipher_req_ctx`, as it is not really useful. The iv length returned by crypto_skcipher_ivsize() is already available everywhere and can be used instead. Signed-off-by: Ovidiu Panait Signed-off-by: Herbert Xu commit b6cd3cfb5afe49952f8f6be947aeeca9ba0faebb Author: Ovidiu Panait Date: Mon May 19 18:13:48 2025 +0300 crypto: sun8i-ce - fix nents passed to dma_unmap_sg() In sun8i_ce_cipher_unprepare(), dma_unmap_sg() is incorrectly called with the number of entries returned by dma_map_sg(), rather than using the original number of entries passed when mapping the scatterlist. To fix this, stash the original number of entries passed to dma_map_sg() in the request context. Fixes: 0605fa0f7826 ("crypto: sun8i-ce - split into prepare/run/unprepare") Signed-off-by: Ovidiu Panait Acked-by: Corentin LABBE Tested-by: Corentin LABBE Signed-off-by: Herbert Xu commit 8c8f269a58f8aa245c39e732a35560b5884c3461 Author: Herbert Xu Date: Tue May 13 14:04:11 2025 +0800 crypto: aspeed/hash - Fix potential overflow in dma_prepare_sg The mapped SG lists are written to hash_engine->ahash_src_addr which has the size ASPEED_HASH_SRC_DMA_BUF_LEN. Since scatterlists are not bound in size, make sure that size is not exceeded. If the mapped SG list is larger than the buffer, simply iterate over it as is done in the dma_prepare case. Signed-off-by: Herbert Xu commit 0602f0ef9308fe8a27c2e3325f8281432a5e0a71 Author: Herbert Xu Date: Tue May 13 14:04:08 2025 +0800 crypto: aspeed/hash - Iterate on large hashes in dma_prepare Rather than failing a hash larger than ASPEED_CRYPTO_SRC_DMA_BUF_LEN, just hash them over and over again until it's done. Signed-off-by: Herbert Xu commit 508712228696eaddc4efc706e6a8dd679654f339 Author: Herbert Xu Date: Tue May 13 14:04:06 2025 +0800 crypto: aspeed/hash - Add fallback If a hash request fails due to a DMA mapping error, or if it is too large to fit in the the driver buffer, use a fallback to do the hash rather than failing. Signed-off-by: Herbert Xu commit 5f38ebefc3703477a87c128d1a251ab6c9f4fbf8 Author: Herbert Xu Date: Tue May 13 14:04:04 2025 +0800 crypto: aspeed/hash - Use API partial block handling Use the Crypto API partial block handling. Also switch to the generic export format. Remove final function that is no longer used by the Crypto API. Move final padding into aspeed_ahash_dma_prepare_sg. Signed-off-by: Herbert Xu commit 72c50eb4f54c2b1412e2a79ec273fa28a449dc8f Author: Herbert Xu Date: Tue May 13 14:04:01 2025 +0800 crypto: aspeed/hash - Remove sha_iv Removed unused sha_iv field from request context. Signed-off-by: Herbert Xu commit 278d737cc2e0044a93d1dabbdcf293a8e65d981d Author: Herbert Xu Date: Tue May 13 14:03:59 2025 +0800 crypto: aspeed/hash - Move final padding into dma_prepare Rather than processing a final as two separate updates, combine them into one for the linear dma_prepare case. This means that the total hash size is slightly reduced, but that will be fixed up later by repeating the hash if necessary. Signed-off-by: Herbert Xu commit 879203defb9216dd4343c3bf995c34321232a5cd Author: Herbert Xu Date: Tue May 13 14:03:57 2025 +0800 crypto: aspeed/hash - Move sham_final call into sham_update The only time when sham_final needs to be called in sham_finup is when the finup request fits into the partial block. Move this special handling into sham_update. The comment about releaseing resources is non-sense. The Crypto API does not mandate the use of final so the user could always go away after an update and never come back. Therefore the driver must not hold any resources after an update call. Signed-off-by: Herbert Xu commit 43ddeca4ff5418f858ea7457bcb75274d6711870 Author: Herbert Xu Date: Tue May 13 14:03:54 2025 +0800 crypto: aspeed/hash - Provide rctx->buffer as argument to fill padding Instead of always writing the padding to rctx->buffer, make it an argument. Signed-off-by: Herbert Xu commit f91fd0d97990b22c5cebe9443ee04286ee44c205 Author: Herbert Xu Date: Tue May 13 14:03:52 2025 +0800 crypto: aspeed/hash - Use init_tfm instead of cra_init Use the init_tfm interface instead of cra_init. Also get rid of the dynamic reqsize. Signed-off-by: Herbert Xu commit 7938eb10436c792bfb2d80433015347b571446d6 Author: Herbert Xu Date: Tue May 13 14:03:50 2025 +0800 crypto: aspeed/hash - Reorganise struct aspeed_sham_reqctx Move the from-device DMA buffer to the front of the structure. Sort the rest by size and alignment. Keep the partial block buffer at the end. Signed-off-by: Herbert Xu commit f6192d0d641f42f3f5b8efeb6e7f5f8bdbedf7bf Author: Herbert Xu Date: Tue May 13 14:03:48 2025 +0800 crypto: aspeed/hash - Remove purely software hmac implementation The hmac implementation in aspeed simply duplicates what the new ahash hmac template already does, namely construct ipad and opad by hand and then adding them to the hash before feeding it to the engine. Remove them and just use the generic ahash hmac template. Signed-off-by: Herbert Xu commit d2fb02624020767f1ee53be0f0f30ef964dbd845 Author: Bartosz Golaszewski Date: Wed Jun 11 09:27:56 2025 +0200 pinctrl: renesas: rza2: Use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611-gpiochip-set-rv-pinctrl-renesas-v1-5-ad169a794ef0@linaro.org Signed-off-by: Geert Uytterhoeven commit acffb7ccd238cd533f15029b5b6d067300903644 Author: Bartosz Golaszewski Date: Wed Jun 11 09:27:55 2025 +0200 pinctrl: renesas: rzv2m: Use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611-gpiochip-set-rv-pinctrl-renesas-v1-4-ad169a794ef0@linaro.org Signed-off-by: Geert Uytterhoeven commit c5eab2dfdb671383f685627fac156c1a245e5474 Author: Bartosz Golaszewski Date: Wed Jun 11 09:27:54 2025 +0200 pinctrl: renesas: rza1: Use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611-gpiochip-set-rv-pinctrl-renesas-v1-3-ad169a794ef0@linaro.org Signed-off-by: Geert Uytterhoeven commit 146ea9380f0bba7ff453317c25cdcb0f2a1ce1e9 Author: Bartosz Golaszewski Date: Wed Jun 11 09:27:53 2025 +0200 pinctrl: renesas: rzg2l: Use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611-gpiochip-set-rv-pinctrl-renesas-v1-2-ad169a794ef0@linaro.org Signed-off-by: Geert Uytterhoeven commit 2c75dc82ed96852138ba09908d5f82cadb8ecfff Author: Bartosz Golaszewski Date: Wed Jun 11 09:27:52 2025 +0200 pinctrl: renesas: gpio: Use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Wolfram Sang Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250611-gpiochip-set-rv-pinctrl-renesas-v1-1-ad169a794ef0@linaro.org Signed-off-by: Geert Uytterhoeven commit 715676d8418062f54d746451294ccce9786c1734 Author: Lad Prabhakar Date: Mon Jun 9 15:03:41 2025 +0100 clk: renesas: rzv2h: Fix missing CLK_SET_RATE_PARENT flag for ddiv clocks Commit bc4d25fdfadf ("clk: renesas: rzv2h: Add support for dynamic switching divider clocks") missed setting the `CLK_SET_RATE_PARENT` flag when registering ddiv clocks. Without this flag, rate changes to the divider clock do not propagate to its parent, potentially resulting in incorrect clock configurations. Fix this by setting `CLK_SET_RATE_PARENT` in the clock init data. Fixes: bc4d25fdfadfa ("clk: renesas: rzv2h: Add support for dynamic switching divider clocks") Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250609140341.235919-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 1cf74da68cffc91b00de7a188aca091f1b956a1f Author: Bartosz Golaszewski Date: Tue Jun 10 14:38:51 2025 +0200 soc: renesas: pwc-rzv2m: Use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250610-gpiochip-set-rv-soc-v1-2-1a0c36c9deed@linaro.org Signed-off-by: Geert Uytterhoeven commit c7968f5e7c7c7b46cad1e92294c211417a7ba90f Author: Lad Prabhakar Date: Mon Jun 9 21:36:50 2025 +0100 soc: renesas: Add RZ/N2H (R9A09G087) config option Add a new Kconfig option, ARCH_R9A09G087, to enable ARM64 platform support for the Renesas RZ/N2H SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250609203656.333138-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 84fc8896f0d9d1c075e0e08a416faedbd73907fa Author: Stefan Binding Date: Thu Jun 12 17:00:23 2025 +0100 ALSA: hda/realtek: Add support for ASUS NUC using CS35L41 HDA Add support for ASUS NUC14LNS. This NUC uses a single CS35L41 Amp in using Internal Boost with SPI. To support the Single Amp, a new quirk is required. Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20250612160029.848104-3-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit dfce24f0032439113848939816ef78b6e83f4086 Author: Stefan Binding Date: Thu Jun 12 17:00:22 2025 +0100 ALSA: hda: cs35l41: Add support for center channel in CS35L41 HDA Currently only left and right channels are supported for each amp. Support is needed for a center channel, using both left and right channel audio. Signed-off-by: Stefan Binding Link: https://patch.msgid.link/20250612160029.848104-2-sbinding@opensource.cirrus.com Signed-off-by: Takashi Iwai commit 00c7a872026f9e74055ba5c71cba03c665e8b03e Author: Ingo Molnar Date: Thu May 15 15:27:07 2025 +0200 x86/kconfig/64: Refresh defconfig Refresh the x86-64 defconfig to pick up changes in the general Kconfig environment: removed options, different defaults, renames, etc. No changes to the actual result of 'make ARCH=x86 defconfig'. Signed-off-by: Ingo Molnar Cc: Ard Biesheuvel Cc: Arnd Bergmann Cc: David Woodhouse Cc: H. Peter Anvin Cc: Jürgen Groß Cc: Linus Torvalds Cc: Masahiro Yamada Cc: Michal Marek Cc: Peter Zijlstra Cc: Vitaly Kuznetsov Link: https://lore.kernel.org/r/20250515132719.31868-2-mingo@kernel.org commit 1fee0c61317272dd6807fb38a28ee85d00cd1cb4 Merge: 6d4e01d29d8735 586d5eecdf1479 Author: Marc Kleine-Budde Date: Fri Jun 13 09:34:11 2025 +0200 Merge patch series "can: rcar_canfd: Add support for Transceiver Delay Compensation" Geert Uytterhoeven says: This patch series adds CAN-FD Transceiver Delay Compensation support to the R-Car CAN-FD driver, after the customary cleanups and refactorings. Changes compared to v1 [1]: - Dropped patch "can: rcar_canfd: Use ndev parameter in rcar_canfd_set_bittiming()", - New patch "[PATCH v2 02/10] can: rcar_canfd: Remove bittiming debug prints", - New patch "[PATCH v2 07/10] can: rcar_canfd: Rename rcar_canfd_setrnc() to rcar_canfd_set_rnc()", - Add Reviewed-by, - Replace function-like RCANFD_F_*() macros by rcar_canfd_f_*() inline functions, - Replace function-like macro RCANFD_FDSTS_TDCR() by bitmask RCANFD_FDSTS_TDCR and helper function rcar_canfd_get_tdcr(), - Replace function-like macro RCANFD_FDSTS_TDCVF() by two bit definitions, - Drop debug print of tdc mode and tdco value. This has been tested on R-Car V4H (White Hawk), V4M (Gray Hawk Single), and E3 (Ebisu-4D[2]), using various data bit rates. Without proper TDC configuration, transmitting at 8 Mbps makes the CAN-FD controller enter BUS-OFF state. The TDCV value as measured by the CAN-FD controller is 4 on all boards tested (base clock 40 MHz, i.e. 25 ns period), and ca. 90 ns as measured by a logic analyzer on Gray Hawk Single. Note that the BSP (predating upstream TDC support), uses a much simpler method: for transfer rates >= 5 Mbps on R-Car Gen4, it enables TDC with a hardcoded (hardware) TDCO value of 2 (i.e. actual 3), which matches the behavior of this series at 8 Mbps. [1] "[PATCH 0/9] can: rcar_canfd: Add support for Transceiver Delay Compensation" https://lore.kernel.org/cover.1748863848.git.geert+renesas@glider.be [2] r8a77990.dtsi configures the CANFD core clock to 40 MHz, limiting transfer rates to 4 Mbps. Enable support for 8 Mbps by adding to ebisu.dtsi: &canfd { assigned-clock-rates = <80000000>; } I plan to send patches to update this on all R-Car Gen3 and RZ/G2 SoCs once this series has reached upstream. Link: https://patch.msgid.link/cover.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 586d5eecdf1479b9ab861ab16438ba236fb2f383 Author: Geert Uytterhoeven Date: Wed Jun 11 17:37:39 2025 +0200 can: rcar_canfd: Add support for Transceiver Delay Compensation The Renesas CAN-FD hardware block supports configuring Transceiver Delay Compensation, and reading back the Transceiver Delay Compensation Result, which is needed to support high transfer rates like 8 Mbps. The Secondary Sample Point is either the measured delay plus the configured offset, or just the configured offset. Fix the existing RCANFD_FDCFG_TDCO() macro for the intended use case (writing instead of reading the field). Add register definition bits for the Channel n CAN-FD Status Register. Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/69db727d5f728d679ba691d20854e7d963d0f323.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 0acd46190ea2157a175b4b2b8e764843e2c93b66 Author: Geert Uytterhoeven Date: Wed Jun 11 17:37:38 2025 +0200 can: rcar_canfd: Return early in rcar_canfd_set_bittiming() when not FD Return early after completing all setup for non-FD mode in rcar_canfd_set_bittiming(), to prepare for the advent of more FD-only setup. Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/35fcdcad026cfdd0fd361637f065842d99a6c19d.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 0a0c94c682fd2606b65a512ba24478a3b5e73d7d Author: Geert Uytterhoeven Date: Wed Jun 11 17:37:37 2025 +0200 can: rcar_canfd: Share config code in rcar_canfd_set_bittiming() The configuration register format for nominal bit timings in CAN-FD mode and the format for bit timings in CAN mode on CAN-FD controllers with shared Classical CAN registers are the same. Restructure the code to make this clear, also reducing kernel size by 80 bytes. Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/b7643a3c49777989d02145a85b85cf773ec2123f.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 1b76dca8fd892a8ced41d980e123b4701ad3cf10 Author: Geert Uytterhoeven Date: Wed Jun 11 17:37:36 2025 +0200 can: rcar_canfd: Rename rcar_canfd_setrnc() to rcar_canfd_set_rnc() Insert an underscore in the function's name, for consistency with other getter and setter helper functions. Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/9fdc2584ce27b2784ecea76390d2a81eab289d0d.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit e4d8eb97a469d2397d3ab23f3b32f26e7e6853f2 Author: Geert Uytterhoeven Date: Wed Jun 11 17:37:35 2025 +0200 can: rcar_canfd: Repurpose f_dcfg base for other registers Reuse the existing Channel Data Bitrate Configuration Register offset member in the register configuration as the base offset for all related channel-specific registers. Rename the member and update the (incorrect) comment to reflect this. Replace the function-like channel-specific register offset macros by inline functions. This fixes the offsets of all other (currently unused) channel-specific registers on R-Car Gen4 and RZ/G3E, and allows us to replace RCANFD_GEN4_FDCFG() by the more generic rcar_canfd_f_cfdcfg(). Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/75c8197c849fc9e360a75d4fa55bc01c1d850433.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit f5e3150b1a0f0f80b162c1ac6178344959a2506d Author: Geert Uytterhoeven Date: Wed Jun 11 17:37:34 2025 +0200 can: rcar_canfd: Simplify data access in rcar_canfd_{ge,pu}t_data() Replace the repeated casts, pointer additions, and pointer dereferences by array accesses to improve readability. Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/4f43f44dcfda13d48a2c502648833934a51d9d6c.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 1f9b5003d4baf72055371fcdb15dda5759a8e908 Author: Geert Uytterhoeven Date: Wed Jun 11 17:37:33 2025 +0200 can: rcar_canfd: Add helper variable dev to rcar_canfd_reset_controller() rcar_canfd_reset_controller() has many users of "pdev->dev". Introduce a shorthand to simplify the code. Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/21e64816808eb3eba722f4c547f4f5112d5d62a6.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 4e5974f5515bf631f4f39c3f53f5bdb8ba7746a3 Author: Geert Uytterhoeven Date: Wed Jun 11 17:37:32 2025 +0200 can: rcar_canfd: Add helper variable ndev to rcar_canfd_rx_pkt() rcar_canfd_rx_pkt() has many users of "priv->ndev". Introduce a shorthand to simplify the code. Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/22afe32a65f7c3e64ce3917aec943ac24d6e185a.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit a627813431600c5582e59022659f11790f94a25c Author: Geert Uytterhoeven Date: Wed Jun 11 17:37:31 2025 +0200 can: rcar_canfd: Remove bittiming debug prints There is no need to have debug code to print the bittiming values, as the user can get all values through the netlink interface. Suggested-by: Vincent Mailhol Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/a8b9f2c8938dc5e63b8faf1d0cdc91dadc12117e.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit df6b192e25df2c2460d27f04d4a43fce87c8bf14 Author: Geert Uytterhoeven Date: Wed Jun 11 17:37:30 2025 +0200 can: rcar_canfd: Consistently use ndev for net_device pointers Most net_device pointers are named "ndev", but some are called "dev". Increase uniformity by always using "ndev". Signed-off-by: Geert Uytterhoeven Reviewed-by: Vincent Mailhol Link: https://patch.msgid.link/7593bdd484a35999030865f90e4c9063b22d2a54.1749655315.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 6bd90e700b4285e6a7541e00f969cab0d696adde Author: Tvrtko Ursulin Date: Tue Jun 10 17:42:26 2025 +0100 drm/xe: Make dma-fences compliant with the safe access rules Xe can free some of the data pointed to by the dma-fences it exports. Most notably the timeline name can get freed if userspace closes the associated submit queue. At the same time the fence could have been exported to a third party (for example a sync_fence fd) which will then cause an use- after-free on subsequent access. To make this safe we need to make the driver compliant with the newly documented dma-fence rules. Driver has to ensure a RCU grace period between signalling a fence and freeing any data pointed to by said fence. For the timeline name we simply make the queue be freed via kfree_rcu and for the shared lock associated with multiple queues we add a RCU grace period before freeing the per GT structure holding the lock. Signed-off-by: Tvrtko Ursulin Reviewed-by: Matthew Brost Acked-by: Lucas De Marchi Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250610164226.10817-5-tvrtko.ursulin@igalia.com commit 506aa8b02a8d6898c64cc095d233fbae1cef8b8a Author: Tvrtko Ursulin Date: Tue Jun 10 17:42:25 2025 +0100 dma-fence: Add safe access helpers and document the rules Dma-fence objects currently suffer from a potential use after free problem where fences exported to userspace and other drivers can outlive the exporting driver, or the associated data structures. The discussion on how to address this concluded that adding reference counting to all the involved objects is not desirable, since it would need to be very wide reaching and could cause unloadable drivers if another entity would be holding onto a signaled fence reference potentially indefinitely. This patch enables the safe access by introducing and documenting a contract between fence exporters and users. It documents a set of contraints and adds helpers which a) drivers with potential to suffer from the use after free must use and b) users of the dma-fence API must use as well. Premise of the design has multiple sides: 1. Drivers (fence exporters) MUST ensure a RCU grace period between signalling a fence and freeing the driver private data associated with it. The grace period does not have to follow the signalling immediately but HAS to happen before data is freed. 2. Users of the dma-fence API marked with such requirement MUST contain the complete access to the data within a single code block guarded by rcu_read_lock() and rcu_read_unlock(). The combination of the two ensures that whoever sees the DMA_FENCE_FLAG_SIGNALED_BIT not set is guaranteed to have access to a valid fence->lock and valid data potentially accessed by the fence->ops virtual functions, until the call to rcu_read_unlock(). 3. Module unload (fence->ops) disappearing is for now explicitly not handled. That would required a more complex protection, possibly needing SRCU instead of RCU to handle callers such as dma_fence_release() and dma_fence_wait_timeout(), where race between dma_fence_enable_sw_signaling, signalling, and dereference of fence->ops->wait() would need a sleeping SRCU context. Signed-off-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250610164226.10817-4-tvrtko.ursulin@igalia.com commit 4d2f8bc628cefae7f397cfd19342fed67e0ae833 Author: Tvrtko Ursulin Date: Tue Jun 10 17:42:24 2025 +0100 drm/i915: Protect access to driver and timeline name Protect the access to driver and timeline name which otherwise could be freed as dma-fence exported is signalling fences. This prepares the code for incoming dma-fence API changes which will start asserting these accesses are done from a RCU locked section. Now that the safe access is handled in the dma-fence API, the external callers such as sync_file, and our internal code paths, we can drop the similar protection from i915_fence_get_timeline_name(). This prepares the code for incoming dma-fence API changes which will start asserting these accesses are done from a RCU locked section. Signed-off-by: Tvrtko Ursulin Reviewed-by: Andi Shyti # v1 Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250610164226.10817-3-tvrtko.ursulin@igalia.com commit ad10976d6cf092a3ea5128d0bc5ab9318f71875f Author: Tvrtko Ursulin Date: Tue Jun 10 17:42:23 2025 +0100 sync_file: Protect access to driver and timeline name Protect the access to driver and timeline name which otherwise could be freed as dma-fence exported is signalling fences. This prepares the code for incoming dma-fence API changes which will start asserting these accesses are done from a RCU locked section. Signed-off-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250610164226.10817-2-tvrtko.ursulin@igalia.com commit 3ee9f2058ab202fd29d6a4adbf520d8878530520 Author: Himal Prasad Ghimiray Date: Mon Jun 9 09:46:16 2025 +0530 drm/xe/vm: Add a helper xe_vm_range_tilemask_tlb_invalidation() Introduce xe_vm_range_tilemask_tlb_invalidation(), which issues a TLB invalidation for a specified address range across GTs indicated by a tilemask. v2 (Matthew Brost) - Move WARN_ON_ONCE to svm caller - Remove xe_gt_tlb_invalidation_vma - s/XE_WARN_ON/WARN_ON_ONCE v3 - Rebase Suggested-by: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250609041616.1723636-1-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit a979a54165c224f3a469b59dcbd2e9754e7e0f41 Author: Thomas Zimmermann Date: Tue Jun 3 18:11:50 2025 +0200 drm/format-helper: Normalize BT.601 factors to 256 BT.601 weights RGB components by certain factors to convert the color to grayscale. Normalize the constants to 256 instead of 10. Allows for slightly more precise rounding. The division by 256 can be compiled as an 8-bit shift, which might be faster on some hardware. Signed-off-by: Thomas Zimmermann Acked-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250603161158.423962-1-tzimmermann@suse.de commit 6982100bb8297c46122cac4f684dcf44cb7d0d8c Author: Johannes Thumshirn Date: Tue Apr 29 15:42:53 2025 +0200 zonefs: use ZONEFS_SUPER_SIZE instead of PAGE_SIZE Use ZONEFS_SUPER_SIZE constant instead of PAGE_SIZE allocating memory for reading the super block in zonefs_read_super(). While PAGE_SIZE technically isn't incorrect as Linux doesn't support pages smaller than 4k ZONEFS_SUPER_SIZE is semantically more correct. Signed-off-by: Johannes Thumshirn Reviewed-by: "Darrick J. Wong" Signed-off-by: Damien Le Moal commit dabe1be4e84c05db9341eb8c6c410e18a5ffeaa5 Author: Ingo Molnar Date: Wed May 28 10:09:24 2025 +0200 sched/smp: Use the SMP version of double_rq_clock_clear_update() Simplify the scheduler by making CONFIG_SMP=y code in double_rq_clock_clear_update() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-44-mingo@kernel.org commit fc75ac3c918d512952f7c132ef635cedfc4900a6 Author: Ingo Molnar Date: Wed May 28 10:09:23 2025 +0200 sched/smp: Use the SMP version of add_nr_running() Simplify the scheduler by making CONFIG_SMP=y code in add_nr_running() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-43-mingo@kernel.org commit 241c307b05b00478bbb65bf440ece464aeac9208 Author: Ingo Molnar Date: Wed May 28 10:09:22 2025 +0200 sched/smp: Use the SMP version of ENQUEUE_MIGRATED Simplify the scheduler by making the CONFIG_SMP-only ENQUEUE_MIGRATED flag unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-42-mingo@kernel.org commit 0203244600b2f48c7074a9d439789d8d1152d3e1 Author: Ingo Molnar Date: Wed May 28 10:09:21 2025 +0200 sched/smp: Use the SMP version of WF_ and SD_ flag sanity checks Simplify the scheduler by making CONFIG_SMP=y asserts related to WF_ and SD_ flags unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-41-mingo@kernel.org commit ea100b31eed459ea32d6df4489cf70219fd83a07 Author: Ingo Molnar Date: Wed May 28 10:09:20 2025 +0200 sched/smp: Use the SMP version of task_on_cpu() Simplify the scheduler by making CONFIG_SMP=y code in task_on_cpu() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-40-mingo@kernel.org commit 703b8e8545c7ca88002164d6c119c49e8ee9b137 Author: Ingo Molnar Date: Wed May 28 10:09:19 2025 +0200 sched/smp: Use the SMP version of rq_pin_lock() Simplify the scheduler by making a CONFIG_SMP-only warning in rq_pin_lock() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-39-mingo@kernel.org commit 9fd5da7989ba6175fe71439738ddcf4c030d3d51 Author: Ingo Molnar Date: Wed May 28 10:09:18 2025 +0200 sched/smp: Use the SMP version of is_migration_disabled() Simplify the scheduler by making the CONFIG_SMP-only code in is_migration_disabled() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-38-mingo@kernel.org commit 172408811961d7facbd1ec9af66893b058d5d542 Author: Ingo Molnar Date: Wed May 28 10:09:17 2025 +0200 sched/smp: Use the SMP version of cpu_of() Simplify the scheduler by making CONFIG_SMP=y code in cpu_of() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-37-mingo@kernel.org commit caf5bde9c542f0cbdf2c91db7ea9743e33941d91 Author: Ingo Molnar Date: Wed May 28 10:09:16 2025 +0200 sched/smp: Use the SMP version of the stop-CPU scheduling class Simplify the scheduler by making CONFIG_SMP=y code in the stop-CPU scheduling class unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-36-mingo@kernel.org commit 482c4dae75cbe3a3bc7109d6c2346e400facbea8 Author: Ingo Molnar Date: Wed May 28 10:09:15 2025 +0200 sched/smp: Use the SMP version of the idle scheduling class Simplify the scheduler by making CONFIG_SMP=y code in the idle scheduling classunconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-35-mingo@kernel.org commit 6c8d251621c131274fa05b46fc138f296b00f6e4 Author: Ingo Molnar Date: Wed May 28 10:09:14 2025 +0200 sched/smp: Use the SMP version of sched_update_asym_prefer_cpu() Simplify the scheduler by making CONFIG_SMP=y code in sched_update_asym_prefer_cpu() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-34-mingo@kernel.org commit 8a9246ddc16c0feaa3b09ca9d2e30fbfa88d09de Author: Ingo Molnar Date: Wed May 28 10:09:13 2025 +0200 sched/smp: Use the SMP version of the scheduler syscalls Simplify the scheduler by making CONFIG_SMP=y code in idle_cpu(), __sched_setscheduler() and sched_setaffinity() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-33-mingo@kernel.org commit 9d9af2372f2a46242fd5e827973235f40f31a706 Author: Ingo Molnar Date: Wed May 28 10:09:12 2025 +0200 sched/smp: Use the SMP version of schedstats Simplify the scheduler by making CONFIG_SMP=y schedstats debugging output unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-32-mingo@kernel.org commit 02fb885ebdc4ad029aabff4b85dcbc540d7cdb32 Author: Ingo Molnar Date: Wed May 28 10:09:11 2025 +0200 sched/smp: Use the SMP version of scheduler debugging data Simplify the scheduler by making CONFIG_SMP=y debug output unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-31-mingo@kernel.org commit 6324dce8f6262ec2049494af311e5418bc733341 Author: Ingo Molnar Date: Wed May 28 10:09:10 2025 +0200 sched/smp: Use the SMP version of the deadline scheduling class Simplify the scheduler by making CONFIG_SMP=y code in prio_changed_dl() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-30-mingo@kernel.org commit 15125a229abc2404a264ce493e64a9ffa7850f6e Author: Ingo Molnar Date: Wed May 28 10:09:09 2025 +0200 sched/smp: Use the SMP version of the RT scheduling class Simplify the scheduler by making CONFIG_SMP=y primitives and data structures unconditional in the RT policies scheduler. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-29-mingo@kernel.org commit 74063c1755ca990440a9c61c91bb7a873a40deeb Author: Ingo Molnar Date: Wed May 28 10:09:08 2025 +0200 sched/smp: Use the SMP version of idle_thread_set_boot_cpu() Simplify the scheduler by making the CONFIG_SMP=y version of idle_thread_set_boot_cpu() unconditional. Note that idle_thread_set_boot_cpu() is already conditional on CONFIG_GENERIC_SMP_IDLE_THREAD, which most architectures select unconditionally on both UP and SMP kernels. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-28-mingo@kernel.org commit 1f25730e5a780b33f78e3ea23e64d3f75e0b2042 Author: Ingo Molnar Date: Wed May 28 10:09:07 2025 +0200 sched/smp: Use the SMP version of sched_exec() Simplify the scheduler making CONFIG_SMP=y sched_exec() code unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-27-mingo@kernel.org commit 588467616c88b12657f6ebe7306d830c272fe054 Author: Ingo Molnar Date: Wed May 28 10:09:06 2025 +0200 sched/smp: Use the SMP version of wake_up_new_task() Simplify the scheduler by making CONFIG_SMP=y code in wake_up_new_task() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-26-mingo@kernel.org commit 8039addbe5a56e4108b1bea57aa5b3f70750fed9 Author: Ingo Molnar Date: Wed May 28 10:09:05 2025 +0200 sched/smp: Use the SMP version of __task_needs_rq_lock() Simplify the scheduler by making CONFIG_SMP=y code in __task_needs_rq_lock() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-25-mingo@kernel.org commit d0a0a055a58617ac8dd9418f08346e94310f1096 Author: Ingo Molnar Date: Wed May 28 10:09:04 2025 +0200 sched/smp: Use the SMP version of try_to_wake_up() Simplify the scheduler by making CONFIG_SMP=y logic within try_to_wake_up() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-24-mingo@kernel.org commit a1416303d108befb4e2b62c863ae1defe4eb1ba3 Author: Ingo Molnar Date: Wed May 28 10:09:03 2025 +0200 sched/smp: Always define rq->hrtick_csd Simplify the scheduler by making CONFIG_SMP=y data structure of rq->hrtick_csd unconditional. Adjust hrtick_start() accordingly, which was split due to the ::hrtick_csd asymmetry and use the SMP version there too. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-23-mingo@kernel.org commit 06ddd17521bf11a3e7f59dafdf5c148f29467d2c Author: Ingo Molnar Date: Wed May 28 10:09:02 2025 +0200 sched/smp: Always define is_percpu_thread() and scheduler_ipi() Simplify the scheduler by making the CONFIG_SMP=y primitives of is_percpu_thread() and scheduler_ipi() unconditional. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-22-mingo@kernel.org commit cac5cefbade90ff0bb0b393d301fa3b5234cf056 Author: Ingo Molnar Date: Wed May 28 10:09:01 2025 +0200 sched/smp: Make SMP unconditional Simplify the scheduler by making CONFIG_SMP=y primitives and data structures unconditional. Introduce transitory wrappers for functionality not yet converted to SMP. Note that this patch is pretty large, because there's no clear separation between various aspects of the SMP scheduler, it's basically a huge block of #ifdef CONFIG_SMP. A fair amount of it has to be switched on for it to boot and work on UP systems. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-21-mingo@kernel.org commit 5202c25dd17c54cd4c21f266d9a51b644d7cd682 Author: Ingo Molnar Date: Wed May 28 10:09:00 2025 +0200 sched/smp: Always define sched_domains_mutex_lock()/unlock(), def_root_domain and sched_domains_mutex Simplify the scheduler by making CONFIG_SMP=y primitives and data structures unconditional. Unconditionally build kernel/sched/topology.c and the main sched-domains locking primitives. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-20-mingo@kernel.org commit f1c6b957f7f4091d822b93ca2833e83bf728e001 Author: Ingo Molnar Date: Wed May 28 10:08:59 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/topology.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Fix whitespace noise and other inconsistencies. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-19-mingo@kernel.org commit 23d27e2cfbee69d85b867a427c3021234bcf09ab Author: Ingo Molnar Date: Wed May 28 10:08:58 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/syscalls.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-18-mingo@kernel.org commit 91433cd6e46828044a64520dd1dce817be41940e Author: Ingo Molnar Date: Wed May 28 10:08:57 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/stats.[ch] - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-17-mingo@kernel.org commit fdccd0c79280da0a332f1370d2ad17192d563c95 Author: Ingo Molnar Date: Wed May 28 10:08:56 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/sched.h - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Fix whitespace noise and other inconsistencies. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-16-mingo@kernel.org commit 3eca109a7885903f1bf07099ae89025069017cc0 Author: Ingo Molnar Date: Wed May 28 10:08:55 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/rt.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Fix whitespace noise and other inconsistencies. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-15-mingo@kernel.org commit fd3db705f7496c5d6b56ce8d78570dd1da11cd30 Author: Ingo Molnar Date: Wed May 28 10:08:54 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/psi.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-14-mingo@kernel.org commit 311bb3f7b78e944e831ffb07cb58455b47bf2269 Author: Ingo Molnar Date: Wed May 28 10:08:53 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/pelt.[ch] - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Fix whitespace noise and other inconsistencies. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-13-mingo@kernel.org commit c215dff7f80caab4a25160f0ded369eba5cb9190 Author: Ingo Molnar Date: Wed May 28 10:08:52 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/loadavg.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Fix whitespace noise and other inconsistencies. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-12-mingo@kernel.org commit 833840a94f4dfd86ed32f1b6222fe8d9ba1790a9 Author: Ingo Molnar Date: Wed May 28 10:08:51 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/idle.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Fix whitespace noise and other inconsistencies. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-11-mingo@kernel.org commit 416d5f78e4d3b010734248cb0aad9dc54b7589fa Author: Ingo Molnar Date: Wed May 28 10:08:50 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/fair.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Fix whitespace noise and other inconsistencies. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-10-mingo@kernel.org commit 29dd6f8cd285360cc5a3e1dc696a960541020705 Author: Ingo Molnar Date: Wed May 28 10:08:49 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/debug.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Fix whitespace noise and other inconsistencies. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-9-mingo@kernel.org commit c503c3dc2d49dbca2cec531ca8f1b8e9143c5087 Author: Ingo Molnar Date: Wed May 28 10:08:48 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/deadline.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Fix whitespace noise and other inconsistencies. Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-8-mingo@kernel.org commit 4aec8669ff3c7ea7ab62c10bb6442c70c0d1b1eb Author: Ingo Molnar Date: Wed May 28 10:08:47 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/cputime.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-7-mingo@kernel.org commit 79af17344c2728c58e254219ff47840c67211cd9 Author: Ingo Molnar Date: Wed May 28 10:08:46 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/cpupri.h - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-6-mingo@kernel.org commit 8bb9b0c5aeb9594bc1039e38d15b14d2a055cf3a Author: Ingo Molnar Date: Wed May 28 10:08:45 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/cpufreq_schedutil.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-5-mingo@kernel.org commit b7ebb758568b60ae816b0c21df70a67eecb84a71 Author: Ingo Molnar Date: Wed May 28 10:08:44 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/core.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ - Apply this simplification: -#if defined(CONFIG_FOO) +#ifdef CONFIG_FOO - Fix whitespace noise. - Use vertical alignment to better visualize nested #ifdef blocks, where appropriate: #ifdef CONFIG_FOO # ifdef CONFIG_BAR ... # endif #endif Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-4-mingo@kernel.org commit bbb1b274e85b739ade5f9bc060a8c4fa00388e29 Author: Ingo Molnar Date: Wed May 28 10:08:43 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/clock.c - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-3-mingo@kernel.org commit 69ab14ee525649a875ca187cad2f05a2bec1ac3c Author: Ingo Molnar Date: Wed May 28 10:08:42 2025 +0200 sched: Clean up and standardize #if/#else/#endif markers in sched/autogroup.[ch] - Use the standard #ifdef marker format for larger blocks, where appropriate: #if CONFIG_FOO ... #else /* !CONFIG_FOO: */ ... #endif /* !CONFIG_FOO */ Signed-off-by: Ingo Molnar Acked-by: Peter Zijlstra Cc: Dietmar Eggemann Cc: Juri Lelli Cc: Linus Torvalds Cc: Mel Gorman Cc: Sebastian Andrzej Siewior Cc: Shrikanth Hegde Cc: Steven Rostedt Cc: Valentin Schneider Cc: Vincent Guittot Link: https://lore.kernel.org/r/20250528080924.2273858-2-mingo@kernel.org commit bdde16c9ac5cb56ad2ee19792222fa1853577af7 Author: Vinay Belgaumkar Date: Thu Jun 12 00:09:02 2025 -0700 drm/xe/bmg: Update Wa_14022085890 Set GT min frequency to 1200Mhz once driver load is complete. v2: Review comments (Rodrigo) v3: Apply Wa earlier so user_req_min is not clobbered. v4: Apply to all GTs (Lucas) Cc: Matt Roper Cc: Rodrigo Vivi Signed-off-by: Vinay Belgaumkar Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250612-wa-14022085890-v4-3-94ba5dcc1e30@intel.com Signed-off-by: Lucas De Marchi commit 6ab42fa03d4c88a0ddf5e56e62794853b198e7bf Author: Vinay Belgaumkar Date: Thu Jun 12 00:09:01 2025 -0700 drm/xe/bmg: Update Wa_16023588340 This allows for additional L2 caching modes. Fixes: 01570b446939 ("drm/xe/bmg: implement Wa_16023588340") Cc: Matthew Auld Reviewed-by: Matthew Auld Signed-off-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250612-wa-14022085890-v4-2-94ba5dcc1e30@intel.com Signed-off-by: Lucas De Marchi commit fa424387379650cdc0ce42c2f6e76e020b4c04d1 Author: Vinay Belgaumkar Date: Thu Jun 12 00:09:00 2025 -0700 drm/xe/guc: Ignore GuC CT errors when wedged Messaging to GuC may get canceled when device is wedged. Don't flag this as an error in xe_guc_pc code. Cc: Daniele Ceraolo Spurio Signed-off-by: Vinay Belgaumkar Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250612-wa-14022085890-v4-1-94ba5dcc1e30@intel.com Signed-off-by: Lucas De Marchi commit a202f09e3e30622fdcae7d740dbf87fb0f032dd5 Author: Inochi Amaoto Date: Sun May 4 08:44:18 2025 +0800 dt-bindings: pci: Add Sophgo SG2044 PCIe host The PCIe controller on the SG2044 is Designware based with custom app registers. Add binding document for SG2044 PCIe host controller. Signed-off-by: Inochi Amaoto Signed-off-by: Manivannan Sadhasivam Reviewed-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250504004420.202685-2-inochiama@gmail.com commit 16f3c7ad887c1f8fd698ab568b5851cadb65b5a8 Author: Steven Rostedt Date: Thu Jun 12 18:20:23 2025 -0400 xdp: tracing: Hide some xdp events under CONFIG_BPF_SYSCALL The events xdp_cpumap_kthread, xdp_cpumap_enqueue and xdp_devmap_xmit are only called when CONFIG_BPF_SYSCALL is defined. As each event can take up to 5K regardless if they are used or not, it's best not to define them when they are not used. Add #ifdef around these events when they are not used. Acked-by: Jesper Dangaard Brouer Signed-off-by: Steven Rostedt (Google) Link: https://lore.kernel.org/r/20250612182023.78397b76@batman.local.home Signed-off-by: Alexei Starovoitov commit a9a5f41b04dd137a353d4d1d6fc7d6e80aaad193 Author: Steven Rostedt Date: Wed Jun 11 15:56:15 2025 -0400 xdp: Remove unused events xdp_redirect_map and xdp_redirect_map_err Each TRACE_EVENT() defined can take up around 5K of text and meta data regardless if they are used or not. New code is being developed that will warn when a tracepoint is defined but not used. The trace events xdp_redirect_map and xdp_redirect_map_err are defined but not used, but there's also a comment that states these are kept around for backward compatibility. Which is interesting because since they are not used, any old BPF program that expects them to exist will get incorrect data (no data) when they use them. It's worse than not working, it's silently failing. Remove them as they will soon cause warnings, or if they really need to stick around, then code needs to be added to use them. Signed-off-by: Steven Rostedt (Google) Reviewed-by: Toke Høiland-Jørgensen Acked-by: Jesper Dangaard Brouer Link: https://lore.kernel.org/r/20250611155615.0c2cf61c@batman.local.home Signed-off-by: Alexei Starovoitov commit af91af33c16853c569ca814124781b849886f007 Author: Ruslan Semchenko Date: Thu Jun 12 16:18:16 2025 +0300 tools/bpf_jit_disasm: Fix potential negative tpath index in get_exec_path() If readlink() fails, len will be -1, which can cause negative indexing and undefined behavior. This patch ensures that len is set to 0 on readlink failure, preventing such issues. Signed-off-by: Ruslan Semchenko Acked-by: Daniel Borkmann Link: https://lore.kernel.org/r/20250612131816.1870-1-uncleruc2075@gmail.com Signed-off-by: Alexei Starovoitov commit 0e93df45c7b45e0dd35668019ceb32cd25371715 Merge: fa6932577c0734 44df9e0d4eec45 Author: Alexei Starovoitov Date: Thu Jun 12 19:07:51 2025 -0700 Merge branch 'bpf-fix-a-few-test-failures-with-64k-page-size' Yonghong Song says: ==================== bpf: Fix a few test failures with 64K page size Changelog: v2 -> v3: - v2: https://lore.kernel.org/bpf/20250611171519.2033193-1-yonghong.song@linux.dev/ - Add additional comments for xdp_adjust_tail test. - Use actual kernel page size to set new_len for Patch 2 tests. v1 -> v2: - v1: https://lore.kernel.org/bpf/20250608165534.1019914-1-yonghong.song@linux.dev/ - For xdp_adjust_tail, let kernel test_run can handle various page sizes for xdp progs. - For two change_tail tests, make code easier to understand. - Resolved a new test failure (xdp_do_redirect). ==================== Link: https://patch.msgid.link/20250612035027.2207299-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 44df9e0d4eec45060ccee72217f56fe3178074a5 Author: Yonghong Song Date: Wed Jun 11 20:50:42 2025 -0700 selftests/bpf: Fix xdp_do_redirect failure with 64KB page size On arm64 with 64KB page size, the selftest xdp_do_redirect failed like below: ... test_xdp_do_redirect:PASS:pkt_count_tc 0 nsec test_max_pkt_size:PASS:prog_run_max_size 0 nsec test_max_pkt_size:FAIL:prog_run_too_big unexpected prog_run_too_big: actual -28 != expected -22 With 64KB page size, the xdp frame size will be much bigger so the existing test will fail. Adjust various parameters so the test can also work on 64K page size. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250612035042.2208630-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 96fcf7e7a71c2b21c002e9ba9362d88f8beac09a Author: Yonghong Song Date: Wed Jun 11 20:50:37 2025 -0700 selftests/bpf: Fix two net related test failures with 64K page size When running BPF selftests on arm64 with a 64K page size, I encountered the following two test failures: sockmap_basic/sockmap skb_verdict change tail:FAIL tc_change_tail:FAIL With further debugging, I identified the root cause in the following kernel code within __bpf_skb_change_tail(): u32 max_len = BPF_SKB_MAX_LEN; u32 min_len = __bpf_skb_min_len(skb); int ret; if (unlikely(flags || new_len > max_len || new_len < min_len)) return -EINVAL; With a 4K page size, new_len = 65535 and max_len = 16064, the function returns -EINVAL. However, With a 64K page size, max_len increases to 261824, allowing execution to proceed further in the function. This is because BPF_SKB_MAX_LEN scales with the page size and larger page sizes result in higher max_len values. Updating the new_len parameter in both tests based on actual kernel page size resolved both failures. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250612035037.2207911-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 4fc012daf9c074772421c904357abf586336b1ca Author: Yonghong Song Date: Wed Jun 11 20:50:32 2025 -0700 bpf: Fix an issue in bpf_prog_test_run_xdp when page size greater than 4K The bpf selftest xdp_adjust_tail/xdp_adjust_frags_tail_grow failed on arm64 with 64KB page: xdp_adjust_tail/xdp_adjust_frags_tail_grow:FAIL In bpf_prog_test_run_xdp(), the xdp->frame_sz is set to 4K, but later on when constructing frags, with 64K page size, the frag data_len could be more than 4K. This will cause problems in bpf_xdp_frags_increase_tail(). To fix the failure, the xdp->frame_sz is set to be PAGE_SIZE so kernel can test different page size properly. With the kernel change, the user space and bpf prog needs adjustment. Currently, the MAX_SKB_FRAGS default value is 17, so for 4K page, the maximum packet size will be less than 68K. To test 64K page, a bigger maximum packet size than 68K is desired. So two different functions are implemented for subtest xdp_adjust_frags_tail_grow. Depending on different page size, different data input/output sizes are used to adapt with different page size. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250612035032.2207498-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit dea4914e48aef3c2a25d24d77009427b876c7a63 Author: Alexander Stein Date: Wed May 14 11:41:28 2025 +0200 arm64: dts: freescale: imx93-tqma9352: Remove unneeded GPIO hog Starting with commit e6ef4f8ede09f ("gpio: vf610: make irq_chip immutable") gpio-vf610 supports locking GPIO being used for IRQ. This already prevents configuring the GPIO as output, so there is no need for a GPIO hog. Signed-off-by: Alexander Stein Acked-by: Peng Fan Signed-off-by: Shawn Guo commit 696a4c325fad8af95da6a9d797766d1613831622 Author: Alexander Stein Date: Wed May 14 11:41:27 2025 +0200 arm64: dts: freescale: imx93-tqma9352: Limit BUCK2 to 600mV TQMa9352 is only using LPDDR4X, so the BUCK2 regulator should be fixed at 600MV. Fixes: d2858e6bd36c ("arm64: dts: freescale: imx93-tqma9352: Add PMIC node") Signed-off-by: Alexander Stein Acked-by: Peng Fan Signed-off-by: Shawn Guo commit 6d4e01d29d87356924f1521ca6df7a364e948f13 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:43 2025 +0200 net: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20250611104348.192092-15-jirislaby@kernel.org Signed-off-by: Jakub Kicinski commit 31b928210df1097eaa5e8cb51e2ff79989ebe57e Author: John Madieu Date: Wed Jun 11 08:12:04 2025 +0200 dt-bindings: net: renesas-gbeth: Add support for RZ/G3E (R9A09G047) SoC Document support for the GBETH IP found on the Renesas RZ/G3E (R9A09G047) SoC. The GBETH block on RZ/G3E is equivalent in functionality to the GBETH found on RZ/V2H(P) (R9A09G057). Reviewed-by: Geert Uytterhoeven Reviewed-by: Lad Prabhakar Signed-off-by: John Madieu Acked-by: Conor Dooley Link: https://patch.msgid.link/20250611061204.15393-1-john.madieu.xa@bp.renesas.com Signed-off-by: Jakub Kicinski commit fcd657cc7492ba7a580d2201be0c88c3e2b53449 Author: Fabio Estevam Date: Tue May 13 11:23:20 2025 -0300 ARM: imx_v6_v7_defconfig: Select BT_HCIUART_BCM Select BT_HCIUART_BCM so that Bluetooth can work by default on a imx7s-warp board with a BCM43455 Wifi/Bluetooth chip. Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit 55b8480a5e0a82351862981ea3b7f296cff4ec04 Author: Fabio Estevam Date: Tue May 13 11:23:19 2025 -0300 ARM: dts: imx7s-warp: Improve the Wifi description GPIO5_10 is connected to the BCM43455 WL_REG_ON pin and it is better descrbed via mmc-pwrseq-simple.yaml. Also improve the Wifi devicetree description by passing a compatible string that describes the BCM43455 presence as per brcm,bcm4329-fmac.yaml. Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit 32eaa78aeb1e187cf0c8e9f760405ce4068f1e8c Author: Fabio Estevam Date: Tue May 13 11:23:18 2025 -0300 ARM: dts: imx7s-warp: Improve the Bluetooth description GPIO5_17 is connected to the BCM43455 BT_REG_ON pin. Improve the Bluetooth devicetree description by using a more accurate description of the hardware as per brcm,bluetooth.yaml. Signed-off-by: Fabio Estevam Signed-off-by: Shawn Guo commit ed2cfae6b84531fd9d2a7b1aeed426d0e5854d17 Author: David Lechner Date: Wed Jun 11 13:11:36 2025 -0500 net: mdio: mux-gpio: use gpiod_multi_set_value_cansleep Reduce verbosity by using gpiod_multi_set_value_cansleep() instead of gpiod_set_array_value_cansleep(). Reviewed-by: Linus Walleij Signed-off-by: David Lechner Link: https://patch.msgid.link/20250611-net-mdio-mux-gpio-use-gpiod_multi_set_value_cansleep-v1-1-6eb5281f1b41@baylibre.com Signed-off-by: Jakub Kicinski commit b549faa950e6bde8563be17165cea5d799def8d3 Merge: 3afc253357668c b0f5b16829577d Author: Jakub Kicinski Date: Thu Jun 12 18:26:23 2025 -0700 Merge branch 'net-bcmasp-add-support-for-gro' Florian Fainelli says: ==================== net: bcmasp: add support for GRO These two patches add support for GRO software interrupt coalescing, kudos to Zak for doing this on bcmgenet first. before: 00:03:31 CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle 00:03:32 all 0.00 0.00 1.51 0.00 0.50 7.29 0.00 0.00 90.70 after: 00:02:35 CPU %usr %nice %sys %iowait %irq %soft %steal %guest %idle 00:02:36 all 0.25 0.00 1.26 0.00 0.50 7.29 0.00 0.00 90.70 ==================== Link: https://patch.msgid.link/20250611212730.252342-1-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit b0f5b16829577db56a64b61c6ef11a975df919e8 Author: Florian Fainelli Date: Wed Jun 11 14:27:30 2025 -0700 net: bcmasp: enable GRO software interrupt coalescing by default Utilize netdev_sw_irq_coalesce_default_on() to provide conservative default settings for GRO software interrupt coalescing. Signed-off-by: Florian Fainelli Reviewed-by: Justin Chen Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250611212730.252342-3-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit 391859cb17f5356337593c59cea04b14f3405a3d Author: Florian Fainelli Date: Wed Jun 11 14:27:29 2025 -0700 net: bcmasp: Utilize napi_complete_done() return value Make use of the return value from napi_complete_done(). This allows users to use the gro_flush_timeout and napi_defer_hard_irqs sysfs attributes for configuring software interrupt coalescing. Signed-off-by: Florian Fainelli Reviewed-by: Justin Chen Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250611212730.252342-2-florian.fainelli@broadcom.com Signed-off-by: Jakub Kicinski commit 3afc253357668c9f677c2e4c7adda7641773b5e8 Author: Geert Uytterhoeven Date: Wed Jun 11 17:53:59 2025 +0200 net: hns3: Demote load and progress messages to debug level No driver should spam the kernel log when merely being loaded. The message in hclge_init() is clearly a debug message. Signed-off-by: Geert Uytterhoeven Reviewed-by: Andrew Lunn Reviewed-by: Jijie Shao Link: https://patch.msgid.link/c2ac6f20f85056e7b35bd56d424040f996d32109.1749657070.git.geert+renesas@glider.be Signed-off-by: Jakub Kicinski commit c4688ff47fd719e2371b984d59759f9fa09dd6a2 Author: Russell King (Oracle) Date: Wed Jun 11 14:56:19 2025 +0100 net: phy: simplify phy_get_internal_delay() Simplify the arguments passed to phy_get_internal_delay() - the "dev" argument is always &phydev->mdio.dev, and as the phydev is passed in, there's no need to also pass in the struct device, especially when this function is the only reason for the caller to have a local "dev" variable. Remove the redundant "dev" argument, and update the callers. Signed-off-by: Russell King (Oracle) Reviewed-by: Andrew Lunn Reviewed-by: Jacob Keller Link: https://patch.msgid.link/E1uPLwB-003VzR-4C@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski commit 00ee2537255e25a14360288dbd94ff62c0db497d Author: Heiner Kallweit Date: Tue Jun 10 23:34:53 2025 +0200 net: phy: move definition of genphy_c45_driver to phy_device.c genphy_c45_read_status() is exported, so we can move definition of genphy_c45_driver to phy_device.c and make it static. This helps to clean up phy.h a little. Signed-off-by: Heiner Kallweit Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/ead3ab17-22d0-4cd3-901c-3d493ab851e6@gmail.com Signed-off-by: Jakub Kicinski commit 94a8e4a8185f5f216e5b8ad3323cd190b73dccf2 Author: Nikunj Kela Date: Tue Jun 10 13:04:11 2025 -0700 net: stmmac: extend use of snps,multicast-filter-bins property to xgmac Hash based multicast filtering is an optional feature. Currently, driver overrides the value of multicast_filter_bins based on the hash table size. If the feature is not supported, hash table size reads 0 however the value of multicast_filter_bins remains set to default HASH_TABLE_SIZE which is incorrect. Let's extend the use of the property snps,multicast-filter-bins to xgmac so it can be set to 0 via devicetree to indicate multicast filtering is not supported. Signed-off-by: Nikunj Kela Reviewed-by: Yanteng Si Link: https://patch.msgid.link/20250610200411.3751943-1-nikunj.kela@sima.ai Signed-off-by: Jakub Kicinski commit 8e16170ae972c7fed132bc928914a2ffb94690fc Author: Hari Kalavakunta Date: Tue Jun 10 12:33:38 2025 -0700 net: ncsi: Fix buffer overflow in fetching version id In NC-SI spec v1.2 section 8.4.44.2, the firmware name doesn't need to be null terminated while its size occupies the full size of the field. Fix the buffer overflow issue by adding one additional byte for null terminator. Signed-off-by: Hari Kalavakunta Reviewed-by: Paul Fertser Link: https://patch.msgid.link/20250610193338.1368-1-kalavakunta.hari.prasad@gmail.com Signed-off-by: Jakub Kicinski commit 221dfdb2df90b0e4df12371e6b549ca8ebba719d Author: Ankit Chauhan Date: Tue Jun 10 12:49:03 2025 +0530 selftests: tcp_ao: fix spelling in seq-ext.c comment Spelling fix: conneciton --> connection This is a non-functional change aimed at improving code clarity. Signed-off-by: Ankit Chauhan Link: https://patch.msgid.link/20250610071903.67180-1-ankitchauhan2065@gmail.com Signed-off-by: Jakub Kicinski commit b1b36680107ede3a4ec7fa41d052971606d6b325 Author: Heiner Kallweit Date: Tue Jun 10 08:03:43 2025 +0200 net: phy: assign default match function for non-PHY MDIO devices Make mdio_device_bus_match() the default match function for non-PHY MDIO devices. Benefit is that we don't have to export this function any longer. As long as mdiodev->modalias isn't set, there's no change in behavior. mdiobus_create_device() is the only place where mdiodev->modalias gets set, but this function sets mdio_device_bus_match() as match function anyway. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/6c94e3d3-bfb0-4ddc-a518-6fddbc64e1d0@gmail.com Signed-off-by: Jakub Kicinski commit 8f9fee2595c6f4220d6b628b69f82acf67447400 Merge: 535de528015b56 6867fbe3a9f4d3 Author: Jakub Kicinski Date: Thu Jun 12 17:16:23 2025 -0700 Merge branch 'net-ethtool-add-dedicated-rxfh-driver-callbacks' Jakub Kicinski says: ==================== net: ethtool: add dedicated RXFH driver callbacks Andrew asked me to plumb the RXFH header fields configuration thru to netlink. Before we do that we need to clean up the driver facing API a little bit. Right now RXFH configuration shares the callbacks with n-tuple filters. The future of n-tuple filters is uncertain within netlink. Separate the two for clarity both of the core code and the driver facing API. This series adds the new callbacks and converts the initial handful of drivers. There is 31 more driver patches to come, then we can stop calling rxnfc in the core for rxfh. ==================== Link: https://patch.msgid.link/20250611145949.2674086-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 6867fbe3a9f4d313e08fa1f9412060dfbf23c848 Author: Jakub Kicinski Date: Wed Jun 11 07:59:49 2025 -0700 net: drv: hyperv: migrate to new RXFH callbacks Add support for the new rxfh_fields callbacks, instead of de-muxing the rxnfc calls. This driver does not support flow filtering so the set_rxnfc callback is completely removed. Link: https://patch.msgid.link/20250611145949.2674086-10-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 63d474cfb596da6f22312d91c7ee4fca6ec3bd67 Author: Jakub Kicinski Date: Wed Jun 11 07:59:48 2025 -0700 net: drv: virtio: migrate to new RXFH callbacks Add support for the new rxfh_fields callbacks, instead of de-muxing the rxnfc calls. This driver does not support flow filtering so the set_rxnfc callback is completely removed. Acked-by: Jason Wang Link: https://patch.msgid.link/20250611145949.2674086-9-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2f14765d6397c5be867664be3871de4fc4727ad5 Author: Jakub Kicinski Date: Wed Jun 11 07:59:47 2025 -0700 net: drv: vmxnet3: migrate to new RXFH callbacks Add support for the new rxfh_fields callbacks, instead of de-muxing the rxnfc calls. This driver does not support flow filtering so the set_rxnfc callback is completely removed. Link: https://patch.msgid.link/20250611145949.2674086-8-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2a34007ba9773ee73dc04a3fc58e335656bd28b0 Author: Jakub Kicinski Date: Wed Jun 11 07:59:46 2025 -0700 eth: fbnic: migrate to new RXFH callbacks Add support for the new rxfh_fields callbacks, instead of de-muxing the rxnfc calls. The code is moved as we try to declare the functions in the order ing which they appear in the ops struct. Link: https://patch.msgid.link/20250611145949.2674086-7-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 86b2315e704197b43524c820b46e6fd0e29f3b87 Author: Jakub Kicinski Date: Wed Jun 11 07:59:45 2025 -0700 eth: remove empty RXFH handling from drivers We're migrating RXFH config to new callbacks. Remove RXFH handling from drivers where it does nothing. Reviewed-by: Ziwei Xiao Link: https://patch.msgid.link/20250611145949.2674086-6-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 9bb00786fc61e865e121aa20dd12aa4d1311a990 Author: Jakub Kicinski Date: Wed Jun 11 07:59:44 2025 -0700 net: ethtool: add dedicated callbacks for getting and setting rxfh fields We mux multiple calls to the drivers via the .get_nfc and .set_nfc callbacks. This is slightly inconvenient to the drivers as they have to de-mux them back. It will also be awkward for netlink code to construct struct ethtool_rxnfc when it wants to get info about RX Flow Hash, from the RSS module. Add dedicated driver callbacks. Create struct ethtool_rxfh_fields which contains only data relevant to RXFH. Maintain the names of the fields to avoid having to heavily modify the drivers. For now support both callbacks, once all drivers are converted ethtool_*et_rxfh_fields() will stop using the rxnfc callbacks. Link: https://patch.msgid.link/20250611145949.2674086-5-kuba@kernel.org Signed-off-by: Jakub Kicinski commit fac4b41741b5cd0826cf0fa5b14e177f70a6b509 Author: Jakub Kicinski Date: Wed Jun 11 07:59:43 2025 -0700 net: ethtool: require drivers to opt into the per-RSS ctx RXFH RX Flow Hashing supports using different configuration for different RSS contexts. Only two drivers seem to support it. Make sure we uniformly error out for drivers which don't. Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250611145949.2674086-4-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 2a644c5cecc028c4fcd6545dd736b4dee949b090 Author: Jakub Kicinski Date: Wed Jun 11 07:59:42 2025 -0700 net: ethtool: remove the duplicated handling from rxfh and rxnfc Now that the handles have been separated - remove the RX Flow Hash handling from rxnfc functions and vice versa. Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250611145949.2674086-3-kuba@kernel.org Signed-off-by: Jakub Kicinski commit f4f126535546e275ffd89cdb9cc2fd581ebf3670 Author: Jakub Kicinski Date: Wed Jun 11 07:59:41 2025 -0700 net: ethtool: copy the rxfh flow handling RX Flow Hash configuration uses the same argument structure as flow filters. This is probably why ethtool IOCTL handles them together. The more checks we add the more convoluted this code is getting (as some of the checks apply only to flow filters and others only to the hashing). Copy the code to separate the handling. This is an exact copy, the next change will remove unnecessary handling. Reviewed-by: Joe Damato Link: https://patch.msgid.link/20250611145949.2674086-2-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 87c648c31322459ed1284ee18ab9c256cb076fd0 Author: Satyanarayana K V P Date: Thu Jun 12 13:34:02 2025 +0530 drm/xe: Add helper function to inject fault into ct_dead_capture() When injecting fault to xe_guc_ct_send_recv() & xe_guc_mmio_send_recv() functions, the CI test systems are going out of space and crashing. To avoid this issue, a new helper function is created and when fault is injected into this xe_is_injection_active() helper function, ct dead capture is avoided which suppresses ct dumps in the log. Signed-off-by: Satyanarayana K V P Suggested-by: John Harrison Reviewed-by: John Harrison Cc: Michal Wajdeczko Cc: Jani Nikula Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250612080402.22011-1-satyanarayana.k.v.p@intel.com commit fa6932577c073497379a1f5901ea5b208a38da10 Author: Song Liu Date: Thu Jun 12 15:11:00 2025 -0700 bpf: Initialize used but uninit variable in propagate_liveness() With input changed == NULL, a local variable is used for "changed". Initialize tmp properly, so that it can be used in the following: *changed |= err > 0; Otherwise, UBSAN will complain: UBSAN: invalid-load in kernel/bpf/verifier.c:18924:4 load of value is not a valid value for type '_Bool' Fixes: dfb2d4c64b82 ("bpf: set 'changed' status if propagate_liveness() did any updates") Signed-off-by: Song Liu Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250612221100.2153401-1-song@kernel.org Signed-off-by: Alexei Starovoitov commit 50034d93628143c747e90418b5bf7df6851ac612 Author: Yonghong Song Date: Wed Jun 11 21:30:49 2025 -0700 docs/bpf: Default cpu version changed from v1 to v3 in llvm 20 The default cpu version is changed from v1 to v3 in llvm version 20. See [1] for more detailed reasoning. Update bpf_devel_QA.rst so developers can find such information easily. [1] https://github.com/llvm/llvm-project/pull/107008 Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250612043049.2411989-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 6a4bd31f680a1d1cf06492fe6dc4f08da09769e6 Author: Fushuai Wang Date: Thu Jun 12 16:42:08 2025 +0800 selftests/bpf: fix signedness bug in redir_partial() When xsend() returns -1 (error), the check 'n < sizeof(buf)' incorrectly treats it as success due to unsigned promotion. Explicitly check for -1 first. Fixes: a4b7193d8efd ("selftests/bpf: Add sockmap test for redirecting partial skb data") Signed-off-by: Fushuai Wang Link: https://lore.kernel.org/r/20250612084208.27722-1-wangfushuai@baidu.com Signed-off-by: Alexei Starovoitov commit 3d71b8b9abae68f6dfc434f779e1139370fbe891 Author: Luis Gerhorst Date: Wed Jun 11 23:07:28 2025 +0200 bpf: Fix state use-after-free on push_stack() err Without this, `state->speculative` is used after the cleanup cycles in push_stack() or push_async_cb() freed `env->cur_state` (i.e., `state`). Avoid this by relying on the short-circuit logic to only access `state` if the error is recoverable (and make sure it never is after push_*() failed). push_*() callers must always return an error for which error_recoverable_with_nospec(err) is false if push_*() returns NULL, otherwise we try to recover and access the stale `state`. This is only violated by sanitize_ptr_alu(), thus also fix this case to return -ENOMEM. state->speculative does not make sense if the error path of push_*() ran. In that case, `state->speculative && error_recoverable_with_nospec(err)` as a whole should already never evaluate to true (because all cases where push_stack() fails must return -ENOMEM/-EFAULT). As mentioned, this is only violated by the push_stack() call in sanitize_speculative_path() which returns -EACCES without [1] (through REASON_STACK in sanitize_err() after sanitize_ptr_alu()). To fix this, return -ENOMEM for REASON_STACK (which is also the behavior we will have after [1]). Checked that it fixes the syzbot reproducer as expected. [1] https://lore.kernel.org/all/20250603213232.339242-1-luis.gerhorst@fau.de/ Fixes: d6f1c85f2253 ("bpf: Fall back to nospec for Spectre v1") Reported-by: syzbot+b5eb72a560b8149a1885@syzkaller.appspotmail.com Reported-by: Eduard Zingerman Link: https://lore.kernel.org/all/38862a832b91382cddb083dddd92643bed0723b8.camel@gmail.com/ Signed-off-by: Luis Gerhorst Acked-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611210728.266563-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit e3f6660b78b07a6662f65e44414d7d554e04801f Merge: 517b088a846b3c 5159482fdb2b4c Author: Alexei Starovoitov Date: Wed Jun 11 13:55:39 2025 -0700 Merge branch 'bpf-propagate-read-precision-marks-over-state-graph-backedges' Eduard Zingerman says: ==================== bpf: propagate read/precision marks over state graph backedges Current loop_entry-based states comparison logic does not handle the following case: .-> A --. Assume the states are visited in the order A, B, C. | | | Assume that state B reaches a state equivalent to state A. | v v At this point, state C is not processed yet, so state A '-- B C has not received any read or precision marks from C. As a result, these marks won't be propagated to B. If B has incomplete marks, it is unsafe to use it in states_equal() checks. This issue was first reported in [1]. This patch-set -------------- Here is the gist of the algorithm implemented by this patch-set: - Compute strongly connected components (SCCs) in the program CFG. - When a verifier state enters an SCC, that state is recorded as the SCC's entry point. - When a verifier state is found to be equivalent to another (e.g., B to A in the example above), it is recorded as a states-graph backedge. - Backedges are accumulated per SCC (*). - When an SCC entry state reaches `branches == 0`, propagate read and precision marks through the backedges until a fixed point is reached (e.g., from A to B, from C to A, and then again from A to B). (*) This is an oversimplification, see patch #8 for details. Unfortunately, this means that commit [2] needs to be reverted, as precision propagation requires access to jump history, and backedges represent history not belonging to `env->cur_state`. Details are provided in patch #8; a comment in `is_state_visited()` explains most of the mechanics. Patch #2 adds a `compute_scc()` function, which computes SCCs in the program CFG. This function was tested using property-based testing in [3], but it is not included in selftests. Previous attempt ---------------- A previous attempt to fix this is described in [4]: 1. Within the states loop, `states_equal(... RANGE_WITHIN)` ignores read and precision marks. 2. For states outside the loop, all registers for states within the loop are marked as read and precise. This approach led to an 86x regression on the `cond_break1` selftest. In that test, one loop was followed by another, and a certain variable was incremented in the second loop. This variable was marked as precise due to rule (2), which hindered convergence in the first loop. After some off-list discussion, it was decided that this might be a typical case and such regressions are undesirable. This patch-set avoids such eager precision markings. Alternatives ------------ Another option is to associate a mask of read/written/precise stack slots with each instruction. This mask can be populated during verifier states exploration. Upon reaching an `EXIT` instruction or an equivalent state, the accumulated masks can be used to propagate read/written/precise bits across the program's control flow graph using an analysis similar to use-def. Unfortunately, a naive implementation of this approach [5] results in a 10x regression in `veristat` for some `sched_ext` programs due to the inability to express the must-write property. This issue requires further investigation. Changes in verification performance ----------------------------------- There are some veristat regressions when comparing with master using selftests and sched_ext BPF binaries. The comparison is done using master from [6] and this patch-set from [7] where memory accounting logic is added to veristat. ========= selftests: master vs patch-set ========= File Program Insns Peak memory (KiB) --------------------- ----------------------------------- ----- ----- ---------------- ---- ----- ---------------- bpf_qdisc_fq.bpf.o bpf_fq_dequeue 1187 1645 +458 (+38.58%) 768 1240 +472 (+61.46%) dynptr_success.bpf.o test_copy_from_user_str_dynptr 208 279 +71 (+34.13%) 512 1024 +512 (+100.00%) dynptr_success.bpf.o test_copy_from_user_task_str_dynptr 205 263 +58 (+28.29%) 512 1024 +512 (+100.00%) dynptr_success.bpf.o test_probe_read_kernel_str_dynptr 686 857 +171 (+24.93%) 992 1724 +732 (+73.79%) dynptr_success.bpf.o test_probe_read_user_str_dynptr 689 860 +171 (+24.82%) 1016 1744 +728 (+71.65%) iters.bpf.o checkpoint_states_deletion 1211 1216 +5 (+0.41%) 512 1280 +768 (+150.00%) pyperf600_iter.bpf.o on_event 2591 5929 +3338 (+128.83%) 4744 11176 +6432 (+135.58%) verifier_gotol.bpf.o gotol_large_imm 40004 40004 +0 (+0.00%) 1024 1536 +512 (+50.00%) Total progs: 3725 Old success: 2157 New success: 2157 total_insns diff min: 0.00% total_insns diff max: 128.83% 0 -> value: 0 value -> 0: 0 total_insns abs max old: 837,487 total_insns abs max new: 837,487 0 .. 5 %: 3710 5 .. 15 %: 6 20 .. 30 %: 6 30 .. 40 %: 2 125 .. 130 %: 1 mem_peak diff min: -27.78% mem_peak diff max: 198.44% mem_peak abs max old: 269,312 KiB mem_peak abs max new: 269,312 KiB -30 .. -20 %: 1 -5 .. 0 %: 18 0 .. 5 %: 3568 5 .. 15 %: 4 15 .. 25 %: 3 45 .. 55 %: 4 60 .. 70 %: 1 70 .. 80 %: 2 100 .. 110 %: 3 135 .. 145 %: 1 150 .. 160 %: 1 195 .. 200 %: 1 ========= scx: master vs patch-set ========= Program Insns Peak memory (KiB) ------------------------ ----- ----- --------------- ----- ----- ----------------- arena_topology_node_init 2133 2395 +262 (+12.28%) 768 768 +0 (+0.00%) chaos_dispatch 2835 2868 +33 (+1.16%) 1972 1720 -252 (-12.78%) chaos_init 4324 5210 +886 (+20.49%) 2528 3028 +500 (+19.78%) lavd_cpu_offline 5107 5726 +619 (+12.12%) 4188 6304 +2116 (+50.53%) lavd_cpu_online 5107 5726 +619 (+12.12%) 4188 6304 +2116 (+50.53%) lavd_dispatch 41775 47601 +5826 (+13.95%) 6196 29192 +22996 (+371.14%) lavd_enqueue 20238 24188 +3950 (+19.52%) 22084 42156 +20072 (+90.89%) lavd_init 6974 7685 +711 (+10.20%) 5428 6928 +1500 (+27.63%) lavd_select_cpu 22138 26088 +3950 (+17.84%) 24448 43688 +19240 (+78.70%) layered_dispatch 17847 26581 +8734 (+48.94%) 11728 28740 +17012 (+145.05%) layered_dump 1891 2098 +207 (+10.95%) 2036 3048 +1012 (+49.71%) layered_runnable 2606 2634 +28 (+1.07%) 748 1240 +492 (+65.78%) p2dq_init 3691 4554 +863 (+23.38%) 2016 2528 +512 (+25.40%) rusty_enqueue 28853 28853 +0 (+0.00%) 2072 1824 -248 (-11.97%) rusty_init_task 31128 31128 +0 (+0.00%) 2176 2560 +384 (+17.65%) Total progs: 148 Old success: 135 New success: 135 total_insns diff min: 0.00% total_insns diff max: 48.94% 0 -> value: 0 value -> 0: 0 total_insns abs max old: 41,775 total_insns abs max new: 47,601 0 .. 5 %: 133 5 .. 15 %: 7 15 .. 25 %: 4 35 .. 45 %: 3 45 .. 50 %: 1 mem_peak diff min: -12.78% mem_peak diff max: 371.14% mem_peak abs max old: 24,448 KiB mem_peak abs max new: 43,688 KiB -15 .. -5 %: 2 -5 .. 0 %: 2 0 .. 5 %: 129 5 .. 15 %: 1 15 .. 25 %: 2 25 .. 35 %: 2 45 .. 55 %: 3 65 .. 75 %: 1 75 .. 85 %: 1 90 .. 100 %: 1 145 .. 155 %: 1 195 .. 205 %: 1 370 .. 375 %: 1 Changelog --------- v1: https://lore.kernel.org/bpf/20250524191932.389444-1-eddyz87@gmail.com/ v1 -> v2: - Rebase - added mem_peak statistics (Alexei) - selftests: fixed comments and removed useless r7 assignments (Yonghong) v2: https://lore.kernel.org/bpf/20250606210352.1692944-1-eddyz87@gmail.com/ v2 -> v3: - Rebase Links ----- [1] https://lore.kernel.org/bpf/20250312031344.3735498-1-eddyz87@gmail.com/ [2] commit 96a30e469ca1 ("bpf: use common instruction history across all states") [3] https://github.com/eddyz87/scc-test [4] https://lore.kernel.org/bpf/20250426104634.744077-1-eddyz87@gmail.com/ [5] https://github.com/eddyz87/bpf/tree/propagate-read-and-precision-in-cfg [6] https://github.com/eddyz87/bpf/tree/veristat-memory-accounting [7] https://github.com/eddyz87/bpf/tree/scc-accumulate-backedges ==================== Link: https://patch.msgid.link/20250611200546.4120963-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 5159482fdb2b4c15cb0a087e41d8bc5d730bb697 Author: Eduard Zingerman Date: Wed Jun 11 13:08:36 2025 -0700 selftests/bpf: tests with a loop state missing read/precision mark The test case absent_mark_in_the_middle_state is equivalent of the following C program: 1: r8 = bpf_get_prandom_u32(); 2: r6 = -32; 3: bpf_iter_num_new(&fp[-8], 0, 10); 4: if (unlikely(bpf_get_prandom_u32())) 5: r6 = -31; 6: for (;;) { 7: if (!bpf_iter_num_next(&fp[-8])) 8: break; 9: if (unlikely(bpf_get_prandom_u32())) 10: *(u64 *)(fp + r6) = 7; 11: } 12: bpf_iter_num_destroy(&fp[-8]); 13: return 0; W/o a fix that instructs verifier to ignore branches count for loop entries verification proceeds as follows: - 1-4, state is {r6=-32,fp-8=active}; - 6, checkpoint A is created with {r6=-32,fp-8=active}; - 7, checkpoint B is created with {r6=-32,fp-8=active}, push state {r6=-32,fp-8=active} from 7 to 9; - 8,12,13, {r6=-32,fp-8=drained}, exit; - pop state with {r6=-32,fp-8=active} from 7 to 9; - 9, push state {r6=-32,fp-8=active} from 9 to 10; - 6, checkpoint C is created with {r6=-32,fp-8=active}; - 7, checkpoint A is hit, no precision propagated for r6 to C; - pop state {r6=-32,fp-8=active} from 9 to 10; - 10, state is {r6=-31,fp-8=active}, r6 is marked as read and precise, these marks are propagated to checkpoints A and B (but not C, as it is not the parent of current state; - 6, {r6=-31,fp-8=active} checkpoint C is hit, because r6 is not marked precise for this checkpoint; - the program is accepted, despite a possibility of unaligned u64 stack access at offset -31. The test case absent_mark_in_the_middle_state2 is similar except the following change: r8 = bpf_get_prandom_u32(); r6 = -32; bpf_iter_num_new(&fp[-8], 0, 10); if (unlikely(bpf_get_prandom_u32())) { r6 = -31; + jump_into_loop: + goto +0; + goto loop; + } + if (unlikely(bpf_get_prandom_u32())) + goto jump_into_loop; + loop: for (;;) { if (!bpf_iter_num_next(&fp[-8])) break; if (unlikely(bpf_get_prandom_u32())) *(u64 *)(fp + r6) = 7; } bpf_iter_num_destroy(&fp[-8]) return 0 The goal is to check that read/precision marks are propagated to checkpoint created at 'goto +0' that resides outside of the loop. The test case absent_mark_in_the_middle_state3 is a bit different and is equivalent to the C program below: int absent_mark_in_the_middle_state3(void) { bpf_iter_num_new(&fp[-8], 0, 10) loop1(-32, &fp[-8]) loop1_wrapper(&fp[-8]) bpf_iter_num_destroy(&fp[-8]) } int loop1(num, iter) { while (bpf_iter_num_next(iter)) { if (unlikely(bpf_get_prandom_u32())) *(fp + num) = 7; } return 0 } int loop1_wrapper(iter) { r6 = -32; if (unlikely(bpf_get_prandom_u32())) r6 = -31; loop1(r6, iter); return 0; } The unsafe state is reached in a similar manner, but the loop is located inside a subprogram that is called from two locations in the main subprogram. This detail is important for exercising bpf_scc_visit->backedges memory management. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-11-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 0f54ff54700315caa8ed3bea36fa0ff3ebc53f56 Author: Eduard Zingerman Date: Wed Jun 11 13:08:35 2025 -0700 bpf: include backedges in peak_states stat Count states accumulated in bpf_scc_visit->backedges in env->peak_states. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-10-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 0e0da5f901f582b97bfeefbf1f36a27e9d427ff4 Author: Eduard Zingerman Date: Wed Jun 11 13:08:34 2025 -0700 bpf: remove {update,get}_loop_entry functions The previous patch switched read and precision tracking for iterator-based loops from state-graph-based loop tracking to control-flow-graph-based loop tracking. This patch removes the now-unused `update_loop_entry()` and `get_loop_entry()` functions, which were part of the state-graph-based logic. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-9-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit c9e31900b54cadf5398dfb838c0a63effa1defec Author: Eduard Zingerman Date: Wed Jun 11 13:08:33 2025 -0700 bpf: propagate read/precision marks over state graph backedges Current loop_entry-based exact states comparison logic does not handle the following case: .-> A --. Assume the states are visited in the order A, B, C. | | | Assume that state B reaches a state equivalent to state A. | v v At this point, state C is not processed yet, so state A '-- B C has not received any read or precision marks from C. As a result, these marks won't be propagated to B. If B has incomplete marks, it is unsafe to use it in states_equal() checks. This commit replaces the existing logic with the following: - Strongly connected components (SCCs) are computed over the program's control flow graph (intraprocedurally). - When a verifier state enters an SCC, that state is recorded as the SCC entry point. - When a verifier state is found equivalent to another (e.g., B to A in the example), it is recorded as a states graph backedge. Backedges are accumulated per SCC. - When an SCC entry state reaches `branches == 0`, read and precision marks are propagated through the backedges (e.g., from A to B, from C to A, and then again from A to B). To support nested subprogram calls, the entry state and backedge list are associated not with the SCC itself but with an object called `bpf_scc_callchain`. A callchain is a tuple `(callsite*, scc_id)`, where `callsite` is the index of a call instruction for each frame except the last. See the comments added in `is_state_visited()` and `compute_scc_callchain()` for more details. Fixes: 2a0992829ea3 ("bpf: correct loop detection for iterators convergence") Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-8-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit b5c677d8d9e58b9f6c6478ba0850580883588d3c Author: Eduard Zingerman Date: Wed Jun 11 13:08:32 2025 -0700 bpf: move REG_LIVE_DONE check to clean_live_states() The next patch would add some relatively heavy-weight operation to clean_live_states(), this operation can be skipped if REG_LIVE_DONE is set. Move the check from clean_verifier_state() to clean_verifier_state() as a small refactoring commit. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-7-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit dfb2d4c64b82ac1e7a03e0b28b4326458705d26f Author: Eduard Zingerman Date: Wed Jun 11 13:08:31 2025 -0700 bpf: set 'changed' status if propagate_liveness() did any updates Add an out parameter to `propagate_liveness()` to record whether any new liveness bits were set during its execution. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-6-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 23b37d616565c89dd202febc68d926345727d092 Author: Eduard Zingerman Date: Wed Jun 11 13:08:30 2025 -0700 bpf: set 'changed' status if propagate_precision() did any updates Add an out parameter to `propagate_precision()` to record whether any new precision bits were set during its execution. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-5-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 9a2a0d79244d27fae6b5174e199b34fe17db0316 Author: Eduard Zingerman Date: Wed Jun 11 13:08:29 2025 -0700 bpf: starting_state parameter for __mark_chain_precision() Allow `mark_chain_precision()` to run from an arbitrary starting state by replacing direct references to `env->cur_state` with a parameter. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-4-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 13f843c0177eeb367ac63467c538046b90785583 Author: Eduard Zingerman Date: Wed Jun 11 13:08:28 2025 -0700 bpf: frame_insn_idx() utility function A function to return IP for a given frame in a call stack of a state. Will be used by a next patch. The `state->insn_idx = env->insn_idx;` assignment in the do_check() allows to use frame_insn_idx with env->cur_state. At the moment bpf_verifier_state->insn_idx is set when new cached state is added in is_state_visited() and accessed only in the contexts when the state is already in the cache. Hence this assignment does not change verifier behaviour. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-3-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 96c6aa4c63af0bb0675c41b3e61a2fc7f6fed998 Author: Eduard Zingerman Date: Wed Jun 11 13:08:27 2025 -0700 bpf: compute SCCs in program control flow graph Compute strongly connected components in the program CFG. Assign an SCC number to each instruction, recorded in env->insn_aux[*].scc. Use Tarjan's algorithm for SCC computation adapted to run non-recursively. For debug purposes print out computed SCCs as a part of full program dump in compute_live_registers() at log level 2, e.g.: func#0 @0 Live regs before insn: 0: .......... (b4) w6 = 10 2 1: ......6... (18) r1 = 0xffff88810bbb5565 2 3: .1....6... (b4) w2 = 2 2 4: .12...6... (85) call bpf_trace_printk#6 2 5: ......6... (04) w6 += -1 2 6: ......6... (56) if w6 != 0x0 goto pc-6 7: .......... (b4) w6 = 5 1 8: ......6... (18) r1 = 0xffff88810bbb5567 1 10: .1....6... (b4) w2 = 2 1 11: .12...6... (85) call bpf_trace_printk#6 1 12: ......6... (04) w6 += -1 1 13: ......6... (56) if w6 != 0x0 goto pc-6 14: .......... (b4) w0 = 0 15: 0......... (95) exit ^^^ SCC number for the instruction Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-2-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit baaebe0928bf321a1cd980d569e308dec66be94c Author: Eduard Zingerman Date: Wed Jun 11 13:08:26 2025 -0700 Revert "bpf: use common instruction history across all states" This reverts commit 96a30e469ca1d2b8cc7811b40911f8614b558241. Next patches in the series modify propagate_precision() to allow arbitrary starting state. Precision propagation requires access to jump history, and arbitrary states represent history not belonging to `env->cur_state`. Signed-off-by: Eduard Zingerman Link: https://lore.kernel.org/r/20250611200836.4135542-1-eddyz87@gmail.com Signed-off-by: Alexei Starovoitov commit 2a1ea59de83bf367215e2a4dd9bf8bbd061349b3 Author: Remo Senekowitsch Date: Wed Jun 11 12:29:08 2025 +0200 samples: rust: platform: Add property read examples Add some example usage of the device property read methods for DT/ACPI/swnode properties. Tested-by: Dirk Behme Co-developed-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) Signed-off-by: Remo Senekowitsch Link: https://lore.kernel.org/r/20250611102908.212514-10-remo@buenzli.dev Signed-off-by: Danilo Krummrich commit 2db611374cef12bd793b72d5728f0ecd1affeb17 Author: Remo Senekowitsch Date: Wed Jun 11 12:29:05 2025 +0200 rust: device: Implement accessors for firmware properties Add methods to FwNode for reading several firmware property types like strings, integers and arrays. Most types are read with the generic `property_read` method. There are two exceptions: * `property_read_bool` cannot fail, so the fallible function signature of `property_read` would not make sense for reading booleans. * `property_read_array_vec` can fail because of a dynamic memory allocation. This error must be handled separately, leading to a different function signature than `property_read`. The traits `Property` and `PropertyInt` drive the generic behavior of `property_read`. `PropertyInt` is necessary to associate specific integer types with the C functions to read them. While there is a C function to read integers of generic sizes called `fwnode_property_read_int_array`, it was preferred not to make this public. Tested-by: Dirk Behme Co-developed-by: Rob Herring (Arm) Signed-off-by: Rob Herring (Arm) Signed-off-by: Remo Senekowitsch Link: https://lore.kernel.org/r/20250611102908.212514-7-remo@buenzli.dev [ Properly include kernel::device::private::Sealed; add explicit type annotations for core::mem::transmute(). - Danilo ] Signed-off-by: Danilo Krummrich commit 9bd791d9413b4b65e203c4ff84c8b8b2c8c3b770 Author: Remo Senekowitsch Date: Wed Jun 11 12:29:04 2025 +0200 rust: device: Introduce PropertyGuard This abstraction is a way to force users to specify whether a property is supposed to be required or not. This allows us to move error logging of missing required properties into core, preventing a lot of boilerplate in drivers. It will be used by upcoming methods for reading device properties. Tested-by: Dirk Behme Signed-off-by: Remo Senekowitsch Link: https://lore.kernel.org/r/20250611102908.212514-6-remo@buenzli.dev [ Use prelude::* to avoid build failure; move PropertyGuard below Display impl of FwNode. - Danilo ] Signed-off-by: Danilo Krummrich commit ecea2459818383c2886ec1cff81cce7e70d99893 Author: Remo Senekowitsch Date: Wed Jun 11 12:29:03 2025 +0200 rust: device: Enable printing fwnode name and path Add two new public methods `display_name` and `display_path` to `FwNode`. They can be used by driver authors for logging purposes. In addition, they will be used by core property abstractions for automatic logging, for example when a driver attempts to read a required but missing property. Tested-by: Dirk Behme Signed-off-by: Remo Senekowitsch Link: https://lore.kernel.org/r/20250611102908.212514-5-remo@buenzli.dev [ Remove #[expect(dead_code)] from FwNode::from_raw(). - Danilo ] Signed-off-by: Danilo Krummrich commit d3393e845038f5fd32c24b841bb4b6026aa1cf4b Author: Remo Senekowitsch Date: Wed Jun 11 12:29:02 2025 +0200 rust: device: Move property_present() to FwNode The new FwNode abstraction will be used for accessing all device properties. It would be possible to duplicate the methods on the device itself, but since some of the methods on Device would have different type sigatures as the ones on FwNode, this would only lead to inconsistency and confusion. For this reason, property_present is removed from Device and existing users are updated. Acked-by: Viresh Kumar Signed-off-by: Remo Senekowitsch Link: https://lore.kernel.org/r/20250611102908.212514-4-remo@buenzli.dev Signed-off-by: Danilo Krummrich commit 658f23b59251e15cc9263cfe5157d5757a293017 Author: Remo Senekowitsch Date: Wed Jun 11 12:29:01 2025 +0200 rust: device: Enable accessing the FwNode of a Device Subsequent patches will add methods for reading properties to FwNode. The first step to accessing these methods will be to access the "root" FwNode of a Device. Add the method `fwnode` to `Device`. Tested-by: Dirk Behme Signed-off-by: Remo Senekowitsch Link: https://lore.kernel.org/r/20250611102908.212514-3-remo@buenzli.dev Signed-off-by: Danilo Krummrich commit 0b93b7dcd9eb888a6ac7546560877705d4ad61bf Author: Daniele Ceraolo Spurio Date: Wed Jun 11 14:44:54 2025 -0700 drm/xe: Fix early wedge on GuC load failure When the GuC fails to load we declare the device wedged. However, the very first GuC load attempt on GT0 (from xe_gt_init_hwconfig) is done before the GT1 GuC objects are initialized, so things go bad when the wedge code attempts to cleanup GT1. To fix this, check the initialization status in the functions called during wedge. Fixes: 7dbe8af13c18 ("drm/xe: Wedge the entire device") Signed-off-by: Daniele Ceraolo Spurio Cc: Rodrigo Vivi Cc: Matthew Brost Cc: Jonathan Cavitt Cc: Lucas De Marchi Cc: Zhanjun Dong Cc: stable@vger.kernel.org # v6.12+: 1e1981b16bb1: drm/xe: Fix taking invalid lock on wedge Cc: stable@vger.kernel.org # v6.12+ Reviewed-by: Jonathan Cavitt Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250611214453.1159846-2-daniele.ceraolospurio@intel.com Signed-off-by: Lucas De Marchi commit a2801affa7103862d549050401a9f53b3365fca4 Author: Remo Senekowitsch Date: Wed Jun 11 12:29:00 2025 +0200 rust: device: Create FwNode abstraction for accessing device properties Accessing device properties is currently done via methods on `Device` itself, using bindings to device_property_* functions. This is sufficient for the existing method property_present. However, it's not sufficient for other device properties we want to access. For example, iterating over child nodes of a device will yield a fwnode_handle. That's not a device, so it wouldn't be possible to read the properties of that child node. Thus, we need an abstraction over fwnode_handle and methods for reading its properties. Add a struct FwNode which abstracts over the C struct fwnode_handle. Implement its reference counting analogous to other Rust abstractions over reference-counted C structs. Subsequent patches will add functionality to access FwNode and read properties with it. Tested-by: Dirk Behme Signed-off-by: Remo Senekowitsch Link: https://lore.kernel.org/r/20250611102908.212514-2-remo@buenzli.dev [ Add temporary #[expect(dead_code)] to avoid a warning. - Danilo ] Signed-off-by: Danilo Krummrich commit ff56a3e2a8613e8524f40ef2efa2c0169659e99e Author: Petr Tesarik Date: Fri Jun 6 14:48:18 2025 +0200 timers/migration: Clean up the loop in tmigr_quick_check() Make the logic easier to follow: - Remove the final return statement, which is never reached, and move the actual walk-terminating return statement out of the do-while loop. - Remove the else-clause to reduce indentation. If a non-lonely group is encountered during the walk, the loop is immediately terminated with a return statement anyway; no need for an else. Signed-off-by: Petr Tesarik Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/all/20250606124818.455560-1-ptesarik@suse.com commit e2944dc6587f39c3eefb15ee607e700314230a0b Author: Lad Prabhakar Date: Mon Jun 9 23:56:30 2025 +0100 drm: renesas: rz-du: mipi_dsi: Add function pointers for configuring VCLK and mode validation Introduce `dphy_conf_clks` and `dphy_mode_clk_check` callbacks in `rzg2l_mipi_dsi_hw_info` to configure the VCLK and validate supported display modes. On the RZ/V2H(P) SoC, the DSI PLL dividers need to be as accurate as possible. To ensure compatibility with both RZ/G2L and RZ/V2H(P) SoCs, function pointers are introduced. Modify `rzg2l_mipi_dsi_startup()` to use `dphy_conf_clks` for clock configuration and `rzg2l_mipi_dsi_bridge_mode_valid()` to invoke `dphy_mode_clk_check` for mode validation. This change ensures proper operation across different SoC variants by allowing fine-grained control over clock configuration and mode validation. Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250609225630.502888-10-prabhakar.mahadev-lad.rj@bp.renesas.com commit 7c1e102ccf1d276bbaee2ddb601b0bdeb6eeaf5c Author: Lad Prabhakar Date: Mon Jun 9 23:56:29 2025 +0100 drm: renesas: rz-du: mipi_dsi: Add dphy_late_init() callback for RZ/V2H(P) Introduce the `dphy_late_init` callback in `rzg2l_mipi_dsi_hw_info` to allow additional D-PHY register configurations after enabling data and clock lanes. This is required for the RZ/V2H(P) SoC but not for the RZ/G2L SoC. Modify `rzg2l_mipi_dsi_startup()` to invoke `dphy_late_init` if defined, ensuring SoC-specific initialization is performed only when necessary. This change prepares for RZ/V2H(P) SoC support while maintaining compatibility with existing platforms. Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Reviewed-by: Laurent Pinchart Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250609225630.502888-9-prabhakar.mahadev-lad.rj@bp.renesas.com commit a56a6b81d80fdf876a5ee6e441a6c8a0052f6f37 Author: Lad Prabhakar Date: Mon Jun 9 23:56:28 2025 +0100 drm: renesas: rz-du: mipi_dsi: Add feature flag for 16BPP support Introduce the `RZ_MIPI_DSI_FEATURE_16BPP` flag in `rzg2l_mipi_dsi_hw_info` to indicate support for 16BPP pixel formats. The RZ/V2H(P) SoC supports 16BPP, whereas this feature is missing on the RZ/G2L SoC. Update the `mipi_dsi_host_attach()` function to check this flag before allowing 16BPP formats. If the SoC does not support 16BPP, return an error to prevent incorrect format selection. This change enables finer-grained format support control for different SoC variants. Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Reviewed-by: Laurent Pinchart Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250609225630.502888-8-prabhakar.mahadev-lad.rj@bp.renesas.com commit 7c3fecdd12d6487e1229f00bfeffccabd1f011f8 Author: Lad Prabhakar Date: Mon Jun 9 23:56:27 2025 +0100 drm: renesas: rz-du: mipi_dsi: Use mHz for D-PHY frequency calculations Pass the HSFREQ in milli-Hz to the `dphy_init()` callback to improve precision, especially for the RZ/V2H(P) SoC, where PLL dividers require high accuracy. These changes prepare the driver for upcoming RZ/V2H(P) SoC support. Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250609225630.502888-7-prabhakar.mahadev-lad.rj@bp.renesas.com commit e96bec001af60857ece60b5fd10caa9886bbf12d Author: Lad Prabhakar Date: Mon Jun 9 23:56:26 2025 +0100 drm: renesas: rz-du: mipi_dsi: Make "rst" reset control optional for RZ/V2H(P) In preparation for adding support for the Renesas RZ/V2H(P) SoC, make the "rst" reset control optional in the MIPI DSI driver. The RZ/V2H(P) SoC does not provide this reset line, and attempting to acquire it using the mandatory API causes probe failure. Switching to devm_reset_control_get_optional_exclusive() ensures compatibility with both SoCs that provide this reset line and those that do not, such as RZ/V2H(P). Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Reviewed-by: Laurent Pinchart Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250609225630.502888-6-prabhakar.mahadev-lad.rj@bp.renesas.com commit 2991c3f0ca8632264569f7c045f37ecdb71a05da Author: Lad Prabhakar Date: Mon Jun 9 23:56:25 2025 +0100 drm: renesas: rz-du: mipi_dsi: Add OF data support n preparation for adding support for the Renesas RZ/V2H(P) SoC, this patch introduces a mechanism to pass SoC-specific information via OF data in the DSI driver. This enables the driver to adapt dynamically to various SoC-specific requirements without hardcoding configurations. The MIPI DSI interface on the RZ/V2H(P) SoC is nearly identical to the one on the RZ/G2L SoC. While the LINK registers are shared between the two SoCs, the D-PHY registers differ. Also the VCLK range differs on both these SoCs. To accommodate these differences `struct rzg2l_mipi_dsi_hw_info` is introduced and as now passed as OF data. These changes lay the groundwork for the upcoming RZ/V2H(P) SoC support by allowing SoC-specific data to be passed through OF. Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Reviewed-by: Laurent Pinchart Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250609225630.502888-5-prabhakar.mahadev-lad.rj@bp.renesas.com commit 3c55c4f05c7ac4fd741cbe92574598324f843d94 Author: Lad Prabhakar Date: Mon Jun 9 23:56:24 2025 +0100 drm: renesas: rz-du: mipi_dsi: Use VCLK for HSFREQ calculation Update the RZ/G2L MIPI DSI driver to calculate HSFREQ using the actual VCLK rate instead of the mode clock. The relationship between HSCLK and VCLK is: vclk * bpp <= hsclk * 8 * lanes Retrieve the VCLK rate using `clk_get_rate(dsi->vclk)`, ensuring that HSFREQ accurately reflects the clock rate set in hardware, leading to better precision in data transmission. Additionally, use `DIV_ROUND_CLOSEST_ULL` for a more precise division when computing `hsfreq`. Also, update unit conversions to use correct scaling factors for better clarity and correctness. Since `clk_get_rate()` returns the clock rate in Hz, update the HSFREQ threshold comparisons to use Hz instead of kHz to ensure correct behavior. Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Reviewed-by: Laurent Pinchart Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250609225630.502888-4-prabhakar.mahadev-lad.rj@bp.renesas.com commit 0425a20f8a49722d0508e917b4aef767bbc06ec8 Author: Lad Prabhakar Date: Mon Jun 9 23:56:23 2025 +0100 drm: renesas: rz-du: mipi_dsi: Simplify HSFREQ calculation Simplify the high-speed clock frequency (HSFREQ) calculation by removing the redundant multiplication and division by 8. The updated equation: hsfreq = mode->clock * bpp / dsi->lanes; produces the same result while improving readability and clarity. Additionally, update the comment to clarify the relationship between HS clock bit frequency, HS byte clock frequency, and HSFREQ. Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Reviewed-by: Laurent Pinchart Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250609225630.502888-3-prabhakar.mahadev-lad.rj@bp.renesas.com commit e37a95d01d5acce211da8446fefbd8684c67f516 Author: Lad Prabhakar Date: Mon Jun 9 23:56:22 2025 +0100 drm: renesas: rz-du: mipi_dsi: Add min check for VCLK range The VCLK range for Renesas RZ/G2L SoC is 5.803 MHz to 148.5 MHz. Add a minimum clock check in the mode_valid callback to ensure that the clock value does not fall below the valid range. Co-developed-by: Fabrizio Castro Signed-off-by: Fabrizio Castro Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Reviewed-by: Laurent Pinchart Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250609225630.502888-2-prabhakar.mahadev-lad.rj@bp.renesas.com commit 660942f2441df622d527f216009f332151843ce8 Author: Arnd Bergmann Date: Tue Jun 10 11:27:33 2025 +0200 drm: omapdrm: reduce clang stack usage The thread sanitizer makes the stack usage explode from extra variable spills in dispc_runtime_resume: drivers/gpu/drm/omapdrm/dss/dispc.c:4735:27: error: stack frame size (1824) exceeds limit (1280) in 'dispc_runtime_resume' [-Werror,-Wframe-larger-than] I could not figure out what exactly is going on here, but I see that whenever dispc_restore_context() is not inlined, that function and its caller shrink below 900 bytes combined of stack usage. Signed-off-by: Arnd Bergmann Link: https://lore.kernel.org/r/20250610092737.2641862-1-arnd@kernel.org Signed-off-by: Tomi Valkeinen commit 3a1edef8f4b58b0ba826bc68bf4bce4bdf59ecf3 Author: Matthew Brost Date: Wed Jun 11 20:19:25 2025 -0700 drm/xe: Make WA BB part of LRC BO No idea why, but without this GuC context switches randomly fail when running IGTs in a loop. Need to follow up why this fixes the aforementioned issue but can live with a stable driver for now. Fixes: 617d824c5323 ("drm/xe: Add WA BB to capture active context utilization") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Lucas De Marchi Tested-by: Shuicheng Lin Link: https://lore.kernel.org/r/20250612031925.4009701-1-matthew.brost@intel.com commit ed3648b9ec4c040d5eebc9e4b8b9083a68628022 Author: Imre Deak Date: Mon Jun 9 15:55:56 2025 +0300 drm/i915/dp: Disable the AUX DPCD probe quirk if it's not required Reading DPCD registers has side-effects and some of these can cause a problem for instance during link training. Based on this it's better to avoid the probing quirk done before each DPCD register read, limiting this to the monitor which requires it. The only known problematic monitor is an external SST sink, so keep the quirk disabled always for eDP and MST sinks. Reenable the quirk after a hotplug event and after resuming from a power state without hotplug support, until the subsequent EDID based detection. v2: Add a helper for determining the need/setting the probing. (Jani) Cc: Ville Syrjälä Cc: Jani Nikula Reviewed-by: Mika Kahola Acked-by: Jani Nikula Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250609125556.109538-2-imre.deak@intel.com commit b87ed522b3643f096ef183ed0ccf2d2b90ddd513 Author: Imre Deak Date: Mon Jun 9 15:55:55 2025 +0300 drm/dp: Add an EDID quirk for the DPCD register access probe Reading DPCD registers has side-effects and some of these can cause a problem for instance during link training. Based on this it's better to avoid the probing quirk done before each DPCD register read, limiting this to the monitor which requires it. Add an EDID quirk for this. Leave the quirk enabled by default, allowing it to be disabled after the monitor is detected. v2: Fix lockdep wrt. drm_dp_aux::hw_mutex when calling drm_dp_dpcd_set_probe_quirk() with a dependent lock already held. v3: Add a helper for determining if DPCD probing is needed. (Jani) v4: - s/drm_dp_dpcd_set_probe_quirk/drm_dp_dpcd_set_probe (Jani) - Fix documentation of drm_dp_dpcd_set_probe(). - Add comment at the end of internal quirk entries. Cc: Ville Syrjälä Cc: Jani Nikula Reviewed-by: Jani Nikula Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250609125556.109538-1-imre.deak@intel.com commit 0fccfb635ec35850e6c0c9335a7a7fd8a4440e61 Author: Matthew Brost Date: Wed Jun 4 16:47:12 2025 -0700 drm/xe: Use WRITE_ONCE for range->tile_invalidated update Updating range->tile_invalidated should be done with WRITE_ONCE to pair with READ_ONCE in opportunistic checks. Signed-off-by: Matthew Brost Reviewed-by: Maarten Lankhrost Link: https://lore.kernel.org/r/20250604234712.2441130-1-matthew.brost@intel.com commit 265fa0692b902f82fb103722797a4a90f65d1508 Author: Matthew Brost Date: Tue Jun 3 10:40:12 2025 -0700 drm/xe: Don't use drm exec locking in SVM pagefaults Only the VM dma-resv lock is needed in SVM pagefaults so xe_vm_lock/unlock can be used instead of drm exec. Micro optimization but should save some CPU cycles in a critical path. Signed-off-by: Matthew Brost Reviewed-by: Maarten Lankhorst Reviewed-by: Stuart Summers Link: https://lore.kernel.org/r/20250603174012.2195759-1-matthew.brost@intel.com commit 0b4aa85e8981198e23a68d50ee3c490ccd7f8311 Author: Imre Deak Date: Thu Jun 5 11:28:48 2025 +0300 drm/edid: Add support for quirks visible to DRM core and drivers Add support for EDID based quirks which can be queried outside of the EDID parser iteself by DRM core and drivers. There are at least two such quirks applicable to all drivers: the DPCD register access probe quirk and the 128b/132b DPRX Lane Count Conversion quirk (see 3.5.2.16.3 in the v2.1a DP Standard). The latter quirk applies to panels with specific EDID panel names, support for defining a quirk this way will be added as a follow-up. v2: Reset global_quirks in drm_reset_display_info(). v3: (Jani) - Use one list for both the global and internal quirks. - Drop change for panel name specific quirks. - Add comment about the way quirks should be queried. Cc: Ville Syrjälä Cc: Jani Nikula Reviewed-by: Jani Nikula Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250605082850.65136-4-imre.deak@intel.com commit 5281cbe0b55a1ff9c6c29361540016873bdc506e Author: Imre Deak Date: Thu Jun 5 11:28:47 2025 +0300 drm/edid: Define the quirks in an enum list An enum list is better suited to define a quirk list, do that. This makes looking up a quirk more robust and also allows for separating quirks internal to the EDID parser and global quirks which can be queried outside of the EDID parser (added as a follow-up). Suggested-by: Jani Nikula Reviewed-by: Jani Nikula Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250605082850.65136-3-imre.deak@intel.com commit a40c5d727b8111b5db424a1e43e14a1dcce1e77f Author: Imre Deak Date: Thu Jun 5 11:28:46 2025 +0300 drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS Reading DPCD registers has side-effects in general. In particular accessing registers outside of the link training register range (0x102-0x106, 0x202-0x207, 0x200c-0x200f, 0x2216) is explicitly forbidden by the DP v2.1 Standard, see 3.6.5.1 DPTX AUX Transaction Handling Mandates 3.6.7.4 128b/132b DP Link Layer LTTPR Link Training Mandates Based on my tests, accessing the DPCD_REV register during the link training of an UHBR TBT DP tunnel sink leads to link training failures. Solve the above by using the DP_LANE0_1_STATUS (0x202) register for the DPCD register access quirk. Cc: Cc: Ville Syrjälä Cc: Jani Nikula Acked-by: Jani Nikula Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250605082850.65136-2-imre.deak@intel.com commit 535de528015b56e34a40a8e1eb1629fadf809a84 Merge: 5d6d67c4cb10a4 27605c8c0f69e3 Author: Jakub Kicinski Date: Thu Jun 12 10:08:24 2025 -0700 Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Cross-merge networking fixes after downstream PR (net-6.16-rc2). No conflicts or adjacent changes. Signed-off-by: Jakub Kicinski commit e2016763590f571cdc3912d6a7ec848d2b61e6c2 Author: Raghav Sharma Date: Thu May 29 16:56:40 2025 +0530 arm64: dts: exynosautov920: add CMU_HSI2 clock DT nodes Add required dt node for CMU_HSI2 block, which provides clocks to ufs and ethernet IPs Signed-off-by: Raghav Sharma Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20250529112640.1646740-5-raghav.s@samsung.com Signed-off-by: Krzysztof Kozlowski commit 2d539f31ab0eb3eb3bd9491b7dcd52dec7967e15 Author: Raghav Sharma Date: Thu May 29 16:56:39 2025 +0530 clk: samsung: exynosautov920: add block hsi2 clock support Register compatible and cmu_info data to support clocks. CMU_HSI2, this provides clocks for HSI2 block Signed-off-by: Raghav Sharma Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20250529112640.1646740-4-raghav.s@samsung.com Signed-off-by: Krzysztof Kozlowski commit 5324ed663da85e312bb628afcfba1a30e343fb73 Merge: 320e7efce30e26 da5cb65d25f747 Author: Krzysztof Kozlowski Date: Thu Jun 12 17:28:04 2025 +0200 Merge branch 'for-v6.17/clk-dt-bindings-headers' into next/clk commit da5cb65d25f747236a003b82525eb6de5d49a2e6 Author: Raghav Sharma Date: Thu May 29 16:56:38 2025 +0530 dt-bindings: clock: exynosautov920: add hsi2 clock definitions Add device tree clock binding definitions for CMU_HSI2 Signed-off-by: Raghav Sharma Reviewed-by: Alim Akhtar Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250529112640.1646740-3-raghav.s@samsung.com Signed-off-by: Krzysztof Kozlowski commit 3d6470990bfc8600609177962a53201cb0640daa Author: Raghav Sharma Date: Thu May 29 16:56:37 2025 +0530 dt-bindings: clock: exynosautov920: sort clock definitions Sort all the clock compatible strings in alphabetical order Signed-off-by: Raghav Sharma Reviewed-by: Alim Akhtar Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250529112640.1646740-2-raghav.s@samsung.com Signed-off-by: Krzysztof Kozlowski commit 6cd594ed969d5cfc7f97029f8ca0d240637ebb8d Author: Alexey Charkov Date: Thu May 15 22:38:44 2025 +0300 ARM: dts: vt8500: Add L2 cache controller on WM8850/WM8950 WonderMedia WM8850/WM8950 uses an ARM PL310 cache controller for its L2 cache, add it. The parameters have been deduced from vendor's U-boot environment variables, which the downstream code uses to initialize the controller. They set the following register values: aux = 0x3e440000 prefetch_ctrl = 0x70000007 Their initialization code also unconditionally sets the flags L2X0_DYNAMIC_CLK_GATING_EN | L2X0_STNDBY_MODE_EN, so encode those too Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250515-wmt-dts-updates-v2-5-246937484cc8@gmail.com Signed-off-by: Krzysztof Kozlowski commit 1918e51321c0c34341397644512568ac3451e416 Author: Alexey Charkov Date: Thu May 15 22:38:43 2025 +0300 ARM: dts: vt8500: Fix the unit address of the VT8500 LCD controller Set correct unit address of d800e400 for the via,vt8500-fb node in vt8500.dtsi. Note that the reg property contained a correct address, so it must have been a copy and paste error earlier. While here, also update its node name to a generic one. Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250515-wmt-dts-updates-v2-4-246937484cc8@gmail.com Signed-off-by: Krzysztof Kozlowski commit 8b37e3c425c3fa8439ec2e100521cb1e9651741e Author: Alexey Charkov Date: Thu May 15 22:38:42 2025 +0300 ARM: dts: vt8500: Use generic node name for the SD/MMC controller Current guidelines recommend mmc@ node names, so use that instead. Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250515-wmt-dts-updates-v2-3-246937484cc8@gmail.com Signed-off-by: Krzysztof Kozlowski commit ab46710603aba03ec6881152219ee7de27d20eff Author: Alexey Charkov Date: Thu May 15 22:38:41 2025 +0300 ARM: dts: vt8500: Move memory nodes to board dts and fix addr/size VIA/WonderMedia SoCs don't have on-chip memory, so their memory nodes are better placed in per-board dts rather than per-SoC dtsi. Move them accordingly, and also add correct node addresses and sizes for each of the boards. Some boards were also available with more memory than included in this commit - those would need a separate DT or an appropriate kernel cmdline argument to reflect it, as the bootloader on these devices doesn't handle DT at all nor does it any runtime discovery of available memory size. Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250515-wmt-dts-updates-v2-2-246937484cc8@gmail.com Signed-off-by: Krzysztof Kozlowski commit 4ce310e733d8e520e52772099ebeb980fd491cec Author: Alexey Charkov Date: Thu May 15 22:38:40 2025 +0300 ARM: dts: vt8500: Add node address and reg in CPU nodes Adjust CPU nodes according to current guidelines, including address and reg. Set #address-cells accordingly. Signed-off-by: Alexey Charkov Link: https://lore.kernel.org/r/20250515-wmt-dts-updates-v2-1-246937484cc8@gmail.com Signed-off-by: Krzysztof Kozlowski commit 75e72234c84822832ebb8c5835f913dd310cb797 Author: Dongliang Mu Date: Wed Jun 11 12:36:13 2025 +0800 docs/zh_CN: improve formatting and content clarity This patch fixes some issues in the how-to.rst: 1. Add spaces between Chinese and English or numbers; 2. Fold some long sentences or commands; 3. Revise a few improper description and add some important tips; Signed-off-by: Dongliang Mu Acked-by: Yanteng Si Signed-off-by: Alex Shi commit 5df4948065034671406614e74c9dc07bbdafc781 Author: Dongliang Mu Date: Tue Jun 10 20:30:30 2025 +0800 docs/zh_CN: update the translation of process/5.Posting.rst Update to commit 4e6b7141d169 ("docs: clarify rules wrt tagging other people") scripts/checktransupdate.py reports: Documentation/translations/zh_CN/process/5.Posting.rst commit 4e6b7141d169 ("docs: clarify rules wrt tagging other people") commit 9734b3e753ad ("docs: 5.Posting: mentioned Suggested-by: tag") 2 commits needs resolving in total Signed-off-by: Dongliang Mu Signed-off-by: Alex Shi commit eabcd4d38a01952028d90595fd736adb93f1217e Author: Dongliang Mu Date: Tue Jun 10 20:30:29 2025 +0800 docs/zh_CN: update the translation of process/2.Process.rst Update to commit 413e775efaec ("Documentation: fix links to mailing list services") scripts/checktransupdate.py reports: Documentation/translations/zh_CN/process/2.Process.rst commit 413e775efaec ("Documentation: fix links to mailing list services") 1 commits needs resolving in total Signed-off-by: Dongliang Mu Signed-off-by: Alex Shi commit 42f3bf6916a04a7a65495640c37c9214abb79abd Author: Dongliang Mu Date: Tue Jun 10 20:30:28 2025 +0800 docs/zh_CN: update the translation of process/7.AdvancedTopics.rst Update to the commit 6e55b1cbf05d ("docs: try to encourage (netdev?) reviewers") scripts/checktransupdate.py reports: Documentation/translations/zh_CN/process/7.AdvancedTopics.rst commit 6e55b1cbf05d ("docs: try to encourage (netdev?) reviewers") 1 commits needs resolving in total Signed-off-by: Dongliang Mu Signed-off-by: Alex Shi commit c4ab0c02a5cc5db31595a1c3b305d1fb9fc5ba46 Author: Dongliang Mu Date: Tue Jun 10 20:30:27 2025 +0800 docs/zh_CN: update the translation of process/6.Followthrough.rst Update to the commit b45d8f387157 ("docs: remove the tips on how to submit patches from MAINTAINERS") scripts/checktransupdate.py reports: Documentation/translations/zh_CN/process/6.Followthrough.rst commit b45d8f387157 ("docs: remove the tips on how to submit patches from MAINTAINERS") 1 commits needs resolving in total Signed-off-by: Dongliang Mu Signed-off-by: Alex Shi commit 095fde67b94fc1037b5aa79427ae566b7b0e61be Author: Dongliang Mu Date: Tue Jun 10 20:30:26 2025 +0800 docs/zh_CN: update the translation of process/1.Intro.rst Update to commit 43e9076a00b1 ("docs: Fix conflicting contributor identity info") scripts/checktransupdate.py reports: Documentation/translations/zh_CN/process/1.Intro.rst commit 43e9076a00b1 ("docs: Fix conflicting contributor identity info") 1 commits needs resolving in total Signed-off-by: Dongliang Mu Signed-off-by: Alex Shi commit f98eec1fffc539616cb54aa3c464017f5cb789ab Author: Cui Wei Date: Sun Jun 8 00:38:13 2025 +0800 Docs/zh_CN: Translate speculation.rst to Simplified Chinese translate the "speculation.rst" into Simplified Chinese and adjust zh_CN/staging/index.rst. Update the translation through commit 6382f4e4e7bd ("Documentation: fix speculation.rst chapter") Signed-off-by: Cui Wei Reviewed-by: Dongliang Mu Signed-off-by: Alex Shi commit c2aa5603af309968a10f8e0d929ec7662ada5f78 Author: Christian König Date: Wed Jun 4 13:00:38 2025 +0200 drm/prime: remove drm_prime_lookup_buf_by_handle This was added by Sima +10 years ago as a solution to avoid exporting multiple dma-bufs for the same GEM object. I tried to remove it before, but wasn't 100% sure about all the side effects. Now Thomas recent modified drm_gem_prime_handle_to_dmabuf() which makes it obvious that this is a superflous step. We try to look up the DMA-buf by handle handle and if that fails for some reason (must likely because the handle is a duplicate) the code just use the DMA-buf from the GEM object. Just using the DMA-buf from the GEM object in the first place has the same effect as far as I can see. Some more history from Sima: In d0b2c5334f41 ("drm/prime: Always add exported buffers to the handle cache") I added this additional lookup. It wasn't part of the bugfix, but back then the handle list was just a linked list and you could do lookups in either direction. And I guess I felt like doing a quick lookup before we grab the next lock makes sense. Premature optimization, I'm confessing to the crime guilty as charged :-/ Then Chris Wilson in 077675c1e8a1 ("drm: Convert prime dma-buf <-> handle to rbtree") and added 2 rb trees to support both directions. At that point that handle2buf lookup really didn't make much sense anymore, but we just kept it and it's been in the tree confusing people ever since. Signed-off-by: Christian König Reviewed-by: Simona Vetter Link: https://lore.kernel.org/r/20250604113234.2520-1-christian.koenig@amd.com commit 1fdb13f92388dfc936624b0a0d6abae362b0ace3 Author: Hans Zhang <18255117159@163.com> Date: Sun Jun 8 00:02:01 2025 +0800 PCI: rockchip-host: Remove unused header includes Clean up the driver by removing unnecessary header includes that are no longer referenced after the recent refactoring. Signed-off-by: Hans Zhang <18255117159@163.com> [mani: commit message rewording] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Manivannan Sadhasivam Acked-by: Shawn Lin Link: https://patch.msgid.link/20250607160201.807043-4-18255117159@163.com commit 917600e630218ce61aa0551079592cb541391668 Author: Hans Zhang <18255117159@163.com> Date: Sun Jun 8 00:02:00 2025 +0800 PCI: rockchip-host: Correct non-fatal error log message Correct the debug message for PCIE_CLIENT_INT_NFATAL_ERR from "no fatal error" to "non fatal error interrupt received" to match the actual interrupt semantics. This avoids confusion in log interpretation. Signed-off-by: Hans Zhang <18255117159@163.com> Signed-off-by: Manivannan Sadhasivam Reviewed-by: Manivannan Sadhasivam Acked-by: Shawn Lin Link: https://patch.msgid.link/20250607160201.807043-3-18255117159@163.com commit fcc5f586c4edbcc10de23fb9b8c0972a84e945cd Author: Hans Zhang <18255117159@163.com> Date: Sun Jun 8 00:01:59 2025 +0800 PCI: rockchip-host: Fix "Unexpected Completion" log message Fix the debug message for the PCIE_CORE_INT_UCR interrupt to clearly indicate "Unexpected Completion" instead of a duplicate "malformed TLP" message. Fixes: e77f847df54c ("PCI: rockchip: Add Rockchip PCIe controller support") Signed-off-by: Hans Zhang <18255117159@163.com> [mani: added fixes tag] Signed-off-by: Manivannan Sadhasivam Reviewed-by: Manivannan Sadhasivam Acked-by: Shawn Lin Link: https://patch.msgid.link/20250607160201.807043-2-18255117159@163.com commit 93174c05dd2e9b02eb6b5c93dd9109087ae4ffcf Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:38 2025 +0200 irqchip: Use dev_fwnode() irq_domain_create_simple() takes a fwnode as the first argument. It can be extracted from struct device using the dev_fwnode() helper instead of using of_node with of_fwnode_handle(). So use the dev_fwnode() helper. Signed-off-by: Jiri Slaby (SUSE) Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/20250611104348.192092-10-jirislaby@kernel.org commit 6c1497a4bd72438360d977f37837d9638b702f33 Author: Ivaylo Ivanov Date: Sun May 4 17:59:07 2025 +0300 MAINTAINERS: add entry for Samsung Exynos2200 SoC Add maintainers entry for the Samsung Exynos2200 SoC based platforms. Signed-off-by: Ivaylo Ivanov Link: https://lore.kernel.org/r/20250504145907.1728721-5-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Krzysztof Kozlowski commit 5430fd9e0794a21b08ccdc01ddc942b09830c1be Author: Ivaylo Ivanov Date: Sun May 4 17:59:06 2025 +0300 arm64: dts: exynos: add initial support for Samsung Galaxy S22+ Samsung Galaxy S22+ (SM-S906B), codenamed g0s, is a mobile phone from 2022. It features 8GB RAM, 128/256GB UFS 3.1, Exynos 2200 SoC and a 1080x2340 Dynamic AMOLED display. This device has an issue where cpu2 and cpu3 fail to come up consistently, which leads to a hang later in the boot process. Disable them until the problem is figured out. This initial device tree configures simple-framebuffer, volume-up key and usb. Signed-off-by: Ivaylo Ivanov Link: https://lore.kernel.org/r/20250504145907.1728721-4-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Krzysztof Kozlowski commit 11715fcf1ccab759d43ee1ad3b1b5bedd7559b48 Author: Ivaylo Ivanov Date: Sun May 4 17:59:05 2025 +0300 arm64: dts: exynos: add initial support for exynos2200 SoC Exynos 2200 SoC is an ARMv8 mobile SoC found in the Samsung Galaxy S22 (r0s), S22+ (g0s), S22 Ultra (b0s) Add minimal support for that SoC, including psci, pmu, chipid, architecture timer and mct, pinctrl, clocks and usb. The devices using this SoC suffer from an issue caused by the stock Samsung bootloader, as it doesn't configure CNTFRQ_EL0. Hence it's needed to hardcode the adequate frequency in the timer node, otherwise the kernel panics. Further platform support will be added over time. Signed-off-by: Ivaylo Ivanov Link: https://lore.kernel.org/r/20250504145907.1728721-3-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Krzysztof Kozlowski commit a67a28f59fbaeebbc37186d60a6c56e16b99829c Author: Ivaylo Ivanov Date: Sun May 4 17:59:04 2025 +0300 dt-bindings: arm: samsung: document g0s board binding Add binding for the Samsung Galaxy S22+ (SM-S906B) board, codenamed G0S, which is based on the Samsung Exynos2200 SoC. Signed-off-by: Ivaylo Ivanov Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250504145907.1728721-2-ivo.ivanov.ivanov1@gmail.com Signed-off-by: Krzysztof Kozlowski commit bb8d8ba4715cb8f997d63d90ba935f6073595df5 Author: Chen-Yu Tsai Date: Thu Jun 12 15:49:00 2025 +0800 ASoC: mediatek: mt8183-afe-pcm: use local `dev` pointer in driver callbacks The probe and remove functions in the mt8183-afe-pcm driver repeatedly uses `&pdev->dev` for |struct device *|, but then assigns this value to `afe->dev` and uses that in other places in the same function. Store `&pdev->dev` in a local pointer and use that exclusively to avoid the numerous dereferences and to make the code more consistent. Lines are reflowed where it makes sense. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250612074901.4023253-10-wenst@chromium.org Signed-off-by: Mark Brown commit b2c090c9f6aa9d19f4c966233d7fcb872255f83b Author: Chen-Yu Tsai Date: Thu Jun 12 15:48:59 2025 +0800 ASoC: mediatek: mt8173-afe-pcm: use local `dev` pointer in driver callbacks The probe and remove functions in the mt8183-afe-pcm driver repeatedly uses `&pdev->dev` for |struct device *|, but then assigns this value to `afe->dev` and uses that in other places in the same function. Store `&pdev->dev` in a local pointer and use that exclusively to avoid the numerous dereferences and to make the code more consistent. Lines are reflowed where it makes sense. Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250612074901.4023253-9-wenst@chromium.org Signed-off-by: Mark Brown commit 9e7bc5cb8d089d9799e17a9ac99c5da9b13b02e3 Author: Chen-Yu Tsai Date: Thu Jun 12 15:48:58 2025 +0800 ASoC: mediatek: mt8183-afe-pcm: Support >32 bit DMA addresses The AFE DMA hardware supports up to 34 bits for DMA addresses. This is missing from the driver and prevents reserved memory regions from working properly when the allocated region is above the 4GB line. Fill in the related register offsets for each DAI, and also set the DMA mask. Also fill in the LSB end register offsets for completeness. Fixes: a94aec035a12 ("ASoC: mediatek: mt8183: add platform driver") Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250612074901.4023253-8-wenst@chromium.org Signed-off-by: Mark Brown commit ec4a10ca4a68ec97f12f4d17d7abb74db34987db Author: Chen-Yu Tsai Date: Thu Jun 12 15:48:57 2025 +0800 ASoC: mediatek: use reserved memory or enable buffer pre-allocation In commit 32c9c06adb5b ("ASoC: mediatek: disable buffer pre-allocation") buffer pre-allocation was disabled to accommodate newer platforms that have a limited reserved memory region for the audio frontend. Turns out disabling pre-allocation across the board impacts platforms that don't have this reserved memory region. Buffer allocation failures have been observed on MT8173 and MT8183 based Chromebooks under low memory conditions, which results in no audio playback for the user. Since some MediaTek platforms already have dedicated reserved memory pools for the audio frontend, the plan is to enable this for all of them. This requires device tree changes. As a fallback, reinstate the original policy of pre-allocating audio buffers at probe time of the reserved memory pool cannot be found or used. This patch covers the MT8173, MT8183, MT8186 and MT8192 platforms for now, the reason being that existing MediaTek platform drivers that supported reserved memory were all platforms that mainly supported ChromeOS, and is also the set of devices that I can verify. Fixes: 32c9c06adb5b ("ASoC: mediatek: disable buffer pre-allocation") Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250612074901.4023253-7-wenst@chromium.org Signed-off-by: Mark Brown commit cd12d3a5ed10e3e3b323f2b2c652de1c8e17a750 Author: Chen-Yu Tsai Date: Thu Jun 12 15:48:56 2025 +0800 ASoC: dt-bindings: mt8192-afe-pcm: Allow specifying reserved memory region It is desirable to reserve memory for the audio frontend. Allow the "memory-region" property, to be used to point to a reserved memory region. Acked-by: "Rob Herring (Arm)" Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250612074901.4023253-6-wenst@chromium.org Signed-off-by: Mark Brown commit 81c73294a4eb2df31e974db2fc4397f5e0ecae09 Author: Chen-Yu Tsai Date: Thu Jun 12 15:48:55 2025 +0800 ASoC: dt-bindings: mt8186-afe-pcm: Allow specifying reserved memory region It is desirable to reserve memory for the audio frontend. Allow the "memory-region" property, to be used to point to a reserved memory region. Acked-by: "Rob Herring (Arm)" Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250612074901.4023253-5-wenst@chromium.org Signed-off-by: Mark Brown commit 473ee884263f2127ea4e46a74ba15d07446ceabb Author: Chen-Yu Tsai Date: Thu Jun 12 15:48:54 2025 +0800 ASoC: dt-bindings: mt8173-afe-pcm: Allow specifying reserved memory region It is desirable to reserve memory for the audio frontend. Allow the "memory-region" property, to be used to point to a reserved memory region. Acked-by: "Rob Herring (Arm)" Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250612074901.4023253-4-wenst@chromium.org Signed-off-by: Mark Brown commit 2fd902152c15a8cacab91e4a660413d189411561 Author: Chen-Yu Tsai Date: Thu Jun 12 15:48:53 2025 +0800 ASoC: dt-bindings: mt8173-afe-pcm: Add power domain The audio subsystem sits under a controllable power domain. Add it to the binding. Acked-by: "Rob Herring (Arm)" Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250612074901.4023253-3-wenst@chromium.org Signed-off-by: Mark Brown commit bb90e0c91d375ec5db8a4f8cd2555900aea0725f Author: Chen-Yu Tsai Date: Thu Jun 12 15:48:52 2025 +0800 ASoC: dt-bindings: Convert MT8173 AFE binding to dt-schema Convert the MT8173 AFE (audio frontend) binding from text to dt-schema in YAML. "clocks" is added to the list of required properties to match "clock-names". And the example was slightly fixed up in style. Otherwise everything is as before. A contributer and maintainer for a recently added MediaTek audio binding was chosen instead of the original submitter. Cc: Trevor Wu Reviewed-by: Krzysztof Kozlowski Reviewed-by: AngeloGioacchino Del Regno Signed-off-by: Chen-Yu Tsai Link: https://patch.msgid.link/20250612074901.4023253-2-wenst@chromium.org Signed-off-by: Mark Brown commit c5b4393c5492555e35c08677a326c9c53b275abd Author: Sunil Khatri Date: Fri May 30 11:59:29 2025 +0530 drm/file: add client id to drm_file_error Add client id to the drm_file_error api, client id is a unique id for each drm fd and is quite useful for debugging. v2: Swapped client id and client name order [Chrisitan] Signed-off-by: Sunil Khatri Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250530062929.1954784-1-sunil.khatri@amd.com Signed-off-by: Christian König commit 8a5a5cecb79058b608e5562d8998123a3adb313c Author: Shenghao Ding Date: Thu Jun 12 12:42:52 2025 +0800 ASoC: tas2781: Move the "include linux/debugfs.h" into tas2781.h Move the include linux/debugfs.h into tas2781.h for code clean. Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20250612044252.1025-1-shenghao-ding@ti.com Signed-off-by: Mark Brown commit 3b4408038da935be7b1efb7589cc1badb6d10a67 Author: Andy Shevchenko Date: Wed Jun 11 21:09:56 2025 +0300 pinctrl: intel: fix build warnings about export.h After commit a934a57a42f64a4 ("scripts/misc-check: check missing #include when W=1") and 7d95680d64ac8e836c ("scripts/misc-check: check unnecessary #include when W=1"), we get some build warnings with W=1: pinctrl-intel.c: warning: EXPORT_SYMBOL() is used, but #include is missing So fix these build warnings for the driver code. Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit e04f97c8be29523bae2576fceee84a4b030406fb Author: Christian Brauner Date: Thu Jun 5 11:53:15 2025 +0200 coredump: cleanup coredump socket functions We currently use multiple CONFIG_UNIX guards. This looks messy and makes the code harder to follow and maintain. Use a helper function coredump_sock_connect() that handles the connect portion. This allows us to remove the CONFIG_UNIX guard in the main do_coredump() function. Link: https://lore.kernel.org/20250605-schlamm-touren-720ba2b60a85@brauner Signed-off-by: Christian Brauner commit c8e7ce2aa11c1beb06ba7ccceb31396fd8d7464f Merge: 19272b37aa4f83 59cd658eaf404e Author: Christian Brauner Date: Wed Jun 4 09:32:15 2025 +0200 Merge patch series "coredump: allow for flexible coredump handling" Christian Brauner says: In addition to the extensive selftests I've already written a (non-production ready) simple Rust coredump server for this in userspace: https://github.com/brauner/dumdum.git Extend the coredump socket to allow the coredump server to tell the kernel how to process individual coredumps. This allows for fine-grained coredump management. Userspace can decide to just let the kernel write out the coredump, or generate the coredump itself, or just reject it. When the crashing task connects to the coredump socket the kernel will send a struct coredump_req to the coredump server. The kernel will set the size member of struct coredump_req allowing the coredump server how much data can be read. The coredump server uses MSG_PEEK to peek the size of struct coredump_req. If the kernel uses a newer struct coredump_req the coredump server just reads the size it knows and discard any remaining bytes in the buffer. If the kernel uses an older struct coredump_req the coredump server just reads the size the kernel knows. The returned struct coredump_req will inform the coredump server what features the kernel supports. The coredump_req->mask member is set to the currently know features. The coredump server may only use features whose bits were raised by the kernel in coredump_req->mask. In response to a coredump_req from the kernel the coredump server sends a struct coredump_ack to the kernel. The kernel informs the coredump server what version of struct coredump_ack it supports by setting struct coredump_req->size_ack to the size it knows about. The coredump server may only send as many bytes as coredump_req->size_ack indicates (a smaller size is fine of course). The coredump server must set coredump_ack->size accordingly. The coredump server sets the features it wants to use in struct coredump_ack->mask. Only bits returned in struct coredump_req->mask may be used. In case an invalid struct coredump_ack is sent to the kernel a non-zero u32 integer is sent indicating the reason for the failure. If it was successful a zero u32 integer is sent. In the initial version the following features are supported in coredump_{req,ack}->mask: * COREDUMP_KERNEL The kernel will write the coredump data to the socket. * COREDUMP_USERSPACE The kernel will not write coredump data but will indicate to the parent that a coredump has been generated. This is used when userspace generates its own coredumps. * COREDUMP_REJECT The kernel will skip generating a coredump for this task. * COREDUMP_WAIT The kernel will prevent the task from exiting until the coredump server has shutdown the socket connection. The flexible coredump socket can be enabled by using the "@@" prefix instead of the single "@" prefix for the regular coredump socket: @@/run/systemd/coredump.socket will enable flexible coredump handling. Current kernels already enforce that "@" must be followed by "/" and will reject anything else. So extending this is backward and forward compatible. Link: https://lore.kernel.org/20250603-work-coredump-socket-protocol-v2-0-05a5f0c18ecc@kernel.org * patches from https://lore.kernel.org/20250603-work-coredump-socket-protocol-v2-0-05a5f0c18ecc@kernel.org: selftests/coredump: add coredump server selftests tools: add coredump.h header selftests/coredump: cleanup coredump tests selftests/coredump: fix build coredump: allow for flexible coredump handling Signed-off-by: Christian Brauner commit 59cd658eaf404e3634624b25afc3233066bea34c Author: Christian Brauner Date: Tue Jun 3 15:31:59 2025 +0200 selftests/coredump: add coredump server selftests This adds extensive tests for the coredump server. Link: https://lore.kernel.org/20250603-work-coredump-socket-protocol-v2-5-05a5f0c18ecc@kernel.org Acked-by: Lennart Poettering Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit be227ba8215f08aaeb9bfc3ce5f1db8763e7b490 Author: Christian Brauner Date: Tue Jun 3 15:31:58 2025 +0200 tools: add coredump.h header Copy the coredump header so we can rely on it in the selftests. Link: https://lore.kernel.org/20250603-work-coredump-socket-protocol-v2-4-05a5f0c18ecc@kernel.org Acked-by: Lennart Poettering Reviewed-by: Alexander Mikhalitsyn Signed-off-by: Christian Brauner commit 474dd09d22df1d3bae9211078185aab9b6f1635e Author: Christian Brauner Date: Tue Jun 3 15:31:57 2025 +0200 selftests/coredump: cleanup coredump tests Make the selftests we added this cycle easier to read. Link: https://lore.kernel.org/20250603-work-coredump-socket-protocol-v2-3-05a5f0c18ecc@kernel.org Acked-by: Lennart Poettering Reviewed-by: Alexander Mikhalitsyn Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit 994dc26302ed744960ad74932eb206b49c0ebb44 Author: Christian Brauner Date: Tue Jun 3 15:31:56 2025 +0200 selftests/coredump: fix build Fix various warnings in the selftest build. Link: https://lore.kernel.org/20250603-work-coredump-socket-protocol-v2-2-05a5f0c18ecc@kernel.org Acked-by: Lennart Poettering Reviewed-by: Alexander Mikhalitsyn Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit 12b5b138d111db0588492002fdd8089af61b80e5 Author: Christian Brauner Date: Tue Jun 3 15:31:55 2025 +0200 coredump: allow for flexible coredump handling Extend the coredump socket to allow the coredump server to tell the kernel how to process individual coredumps. When the crashing task connects to the coredump socket the kernel will send a struct coredump_req to the coredump server. The kernel will set the size member of struct coredump_req allowing the coredump server how much data can be read. The coredump server uses MSG_PEEK to peek the size of struct coredump_req. If the kernel uses a newer struct coredump_req the coredump server just reads the size it knows and discard any remaining bytes in the buffer. If the kernel uses an older struct coredump_req the coredump server just reads the size the kernel knows. The returned struct coredump_req will inform the coredump server what features the kernel supports. The coredump_req->mask member is set to the currently know features. The coredump server may only use features whose bits were raised by the kernel in coredump_req->mask. In response to a coredump_req from the kernel the coredump server sends a struct coredump_ack to the kernel. The kernel informs the coredump server what version of struct coredump_ack it supports by setting struct coredump_req->size_ack to the size it knows about. The coredump server may only send as many bytes as coredump_req->size_ack indicates (a smaller size is fine of course). The coredump server must set coredump_ack->size accordingly. The coredump server sets the features it wants to use in struct coredump_ack->mask. Only bits returned in struct coredump_req->mask may be used. In case an invalid struct coredump_ack is sent to the kernel a non-zero u32 integer is sent indicating the reason for the failure. If it was successful a zero u32 integer is sent. In the initial version the following features are supported in coredump_{req,ack}->mask: * COREDUMP_KERNEL The kernel will write the coredump data to the socket. * COREDUMP_USERSPACE The kernel will not write coredump data but will indicate to the parent that a coredump has been generated. This is used when userspace generates its own coredumps. * COREDUMP_REJECT The kernel will skip generating a coredump for this task. * COREDUMP_WAIT The kernel will prevent the task from exiting until the coredump server has shutdown the socket connection. The flexible coredump socket can be enabled by using the "@@" prefix instead of the single "@" prefix for the regular coredump socket: @@/run/systemd/coredump.socket will enable flexible coredump handling. Current kernels already enforce that "@" must be followed by "/" and will reject anything else. So extending this is backward and forward compatible. Link: https://lore.kernel.org/20250603-work-coredump-socket-protocol-v2-1-05a5f0c18ecc@kernel.org Acked-by: Lennart Poettering Reviewed-by: Alexander Mikhalitsyn Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit a0be20055d41028a121a5acc140e17c73d7541c5 Author: Jiri Slaby (SUSE) Date: Wed Jun 11 12:43:40 2025 +0200 memory: omap-gpmx: Use dev_fwnode() irq_domain_create_simple() takes fwnode as the first argument. It can be extracted from the struct device using dev_fwnode() helper instead of using of_node with of_fwnode_handle(). Signed-off-by: Jiri Slaby (SUSE) Link: https://lore.kernel.org/r/20250611104348.192092-12-jirislaby@kernel.org [krzk: Dropped redundant parts of commit msg] Signed-off-by: Krzysztof Kozlowski commit c81fef22020c7467c08929330009c7c613e5ff5c Author: Daisuke Matsuda Date: Wed Jun 11 16:27:58 2025 +0000 RDMA/rxe: Remove redundant page presence check hmm_pfn_to_page() does not return NULL. ib_umem_odp_map_dma_and_lock() should return an error in case the target pages cannot be mapped until timeout, so these checks can safely be removed. Reviewed-by: Zhu Yanjun Signed-off-by: Daisuke Matsuda Link: https://patch.msgid.link/20250611162758.10000-1-dskmtsd@gmail.com Signed-off-by: Leon Romanovsky commit 686d773186bf72b739bab7e12eb8665d914676ee Author: Tzung-Bi Shih Date: Thu Jun 12 08:30:23 2025 +0000 drm/i915/pmu: Fix build error with GCOV and AutoFDO enabled i915_pmu.c may fail to build with GCOV and AutoFDO enabled. ../drivers/gpu/drm/i915/i915_pmu.c:116:3: error: call to '__compiletime_assert_487' declared with 'error' attribute: BUILD_BUG_ON failed: bit > BITS_PER_TYPE(typeof_member(struct i915_pmu, enable)) - 1 116 | BUILD_BUG_ON(bit > | ^ Here is a way to reproduce the issue: $ git checkout v6.15 $ mkdir build $ ./scripts/kconfig/merge_config.sh -O build -n -m <(cat < Signed-off-by: Tzung-Bi Shih Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250612083023.562585-1-tzungbi@kernel.org commit baa640d924e55eee9210164ac068ad32dbd69c20 Author: Shiraz Saleem Date: Tue Jun 10 05:48:37 2025 -0700 RDMA/mana_ib: Add device statistics support Add support for mana device level statistics. Co-developed-by: Solom Tamawy Signed-off-by: Solom Tamawy Signed-off-by: Shiraz Saleem Signed-off-by: Konstantin Taranov Link: https://patch.msgid.link/1749559717-3424-1-git-send-email-kotaranov@linux.microsoft.com Reviewed-by: Long Li Signed-off-by: Leon Romanovsky commit fd383bf8b6954d3ce46c27a1ed55fea226369b86 Author: Markus Elfring Date: Tue Jun 10 14:14:09 2025 +0200 RDMA/cxgb4: Delete an unnecessary check before kfree() in c4iw_rdev_open() It can be known that the function “kfree” performs a null pointer check for its input parameter. It is therefore not needed to repeat such a check before its call. Thus remove a redundant pointer check. The source code was transformed by using the Coccinelle software. Signed-off-by: Markus Elfring Link: https://patch.msgid.link/cdc577a5-cebd-404a-b762-cc6fee0870dc@web.de Signed-off-by: Leon Romanovsky commit 682641135d44e856f0e8b72edb75804b3e00e1e5 Author: Li Jun Date: Wed Jun 4 18:20:49 2025 +0800 IB/iser: Remove unnecessary local variable The 'error' variable is no longer needed,as iscsi_iser_mtask_xmit can return the result of iser_send_control(conn,task) directly. Signed-off-by: Li Jun Link: https://patch.msgid.link/20250604102049.130039-1-lijun01@kylinos.cn Reviewed-by: Sagi Grimberg Acked-by: Max Gurtovoy Signed-off-by: Leon Romanovsky commit 8f077ba91b593f90a43c052f113705ec80f7b89d Author: Junxian Huang Date: Thu Jun 5 10:49:17 2025 +0800 RDMA/hns: Remove MW support MW is no longer supported in hns. Delete relevant codes. Signed-off-by: Junxian Huang Link: https://patch.msgid.link/20250605024917.1132393-1-huangjunxian6@hisilicon.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 1f505a4a4250798eceb6a8568988deb545587128 Author: luoqing Date: Thu Jun 5 11:49:18 2025 +0800 RDMA/hns: ZERO_OR_NULL_PTR macro overdetection sizeof(xx) these variable values' return values cannot be 0. For memory allocation requests of non-zero length, there is no need to check other return values; it is sufficient to only verify that it is not null. Signed-off-by: luoqing Link: https://patch.msgid.link/20250605034918.242682-1-l1138897701@163.com Reviewed-by: Junxian Huang Signed-off-by: Leon Romanovsky commit 9284bc34c77399a12db1a191f35129882d067c90 Author: Daisuke Matsuda Date: Thu May 22 11:19:55 2025 +0000 RDMA/rxe: Enable asynchronous prefetch for ODP MRs Calling ibv_advise_mr(3) with flags other than IBV_ADVISE_MR_FLAG_FLUSH invokes an asynchronous request. It is best-effort, and thus can safely be deferred to the system-wide workqueue. The reference counter in rxe_mr is used to ensure that the MRs persist and that rxe is not terminated until the queued work is done. Signed-off-by: Daisuke Matsuda Link: https://patch.msgid.link/20250522111955.3227-3-dskmtsd@gmail.com Signed-off-by: Leon Romanovsky commit 3576b0df1588a0fd0249c29975d9dc92ffd6f3c0 Author: Daisuke Matsuda Date: Thu May 22 11:19:54 2025 +0000 RDMA/rxe: Implement synchronous prefetch for ODP MRs Minimal implementation of ibv_advise_mr(3) requires synchronous calls being successful with the IBV_ADVISE_MR_FLAG_FLUSH flag. Asynchronous requests, which are best-effort, will be supported subsequently. Signed-off-by: Daisuke Matsuda Link: https://patch.msgid.link/20250522111955.3227-2-dskmtsd@gmail.com Reviewed-by: Zhu Yanjun Signed-off-by: Leon Romanovsky commit 30f85eddbdebba7665f9b7b772821e588547ca9e Author: Takashi Iwai Date: Thu Jun 12 08:48:01 2025 +0200 ALSA: hda/ca0132: Use const char * for strings Some static strings have been stored in fixed char arrays although they could be gracefully "const char *" instead. Also, a few other definitions use the raw "char *" without const. Converting those to "const char *" will save some memory and give more safety, in addition to a side-effect to address the bogus compiler warning with snprintf(). Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506121025.G9uunMlx-lkp@intel.com/ Link: https://patch.msgid.link/20250612064802.1170-1-tiwai@suse.de Signed-off-by: Takashi Iwai commit 9ca30a1b007d5fefb5752428f852a2d8d7219c1c Author: Chen Ni Date: Thu Jun 12 14:02:28 2025 +0800 ALSA: usb-audio: Convert comma to semicolon Replace comma between expressions with semicolons. Using a ',' in place of a ';' can have unintended side effects. Although that is not the case here, it is seems best to use ';' unless ',' is intended. Found by inspection. No functional change intended. Compile tested only. Fixes: 79d561c4ec04 ("ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5") Signed-off-by: Chen Ni Reviewed-by: Cristian Ciocaltea Link: https://patch.msgid.link/20250612060228.1518028-1-nichen@iscas.ac.cn Signed-off-by: Takashi Iwai commit fb84f0ec527c50c54ab662d45c441f6789ec3550 Author: Luca Weiss Date: Tue Jun 10 19:03:51 2025 +0200 ARM: dts: qcom: msm8974-sony-xperia-rhine: Add alias for mmc0 & mmc1 Add an alias for the internal storage so it always becomes mmcblk0 and SD card becomes mmcblk1. This avoids issues with internal storage becoming mmcblk1 unexpectedly and aligns this board with other boards that use MMC storage. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250610-msm8974-mmc-alias-v2-3-1d8808478fba@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 9dd98b0f7a646c08f357189e9d5e733df08f0430 Author: Luca Weiss Date: Tue Jun 10 19:03:50 2025 +0200 ARM: dts: qcom: msm8974-hammerhead: Add alias for mmc0 Add an alias for the internal storage so it always becomes mmcblk0. This avoids issues with internal storage becoming mmcblk1 unexpectedly and aligns this board with other boards that use MMC storage. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250610-msm8974-mmc-alias-v2-2-1d8808478fba@lucaweiss.eu Signed-off-by: Bjorn Andersson commit d9abbfd3212b5873e827e3760cc698686d7a8c3b Author: Luca Weiss Date: Tue Jun 10 19:03:49 2025 +0200 ARM: dts: qcom: msm8974-oneplus-bacon: Add alias for mmc0 Add an alias for the internal storage so it always becomes mmcblk0. This avoids issues with internal storage becoming mmcblk1 unexpectedly and aligns this board with other boards that use MMC storage. Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250610-msm8974-mmc-alias-v2-1-1d8808478fba@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 3d8663cb9e21912ad9554701bfb3a8254cf0a4ef Author: Kevin Widjaja Date: Tue Jun 10 20:34:55 2025 +0200 ARM: dts: qcom: Add initial support for Sony Xperia Z Ultra (togari) Add the dts for the Z Ultra. This is currently almost the same as Z1 Compact (amami) and Z1 (honami) as they share almost the same hardware. Only USB Networking and volume button are confirmed working. Signed-off-by: Kevin Widjaja Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250610-togari-v2-4-10e7b53b87c1@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 700a4c3f95a3cea340bf8c2371cf2bfd99da15ca Author: Kevin Widjaja Date: Tue Jun 10 20:34:54 2025 +0200 dt-bindings: arm: qcom: Add Sony Xperia Z Ultra (togari) Based on the msm8974. Signed-off-by: Kevin Widjaja Acked-by: Rob Herring (Arm) Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250610-togari-v2-3-10e7b53b87c1@lucaweiss.eu Signed-off-by: Bjorn Andersson commit edae4a6260d387e1e40dcf3acbbeb4c86bfd2ecb Author: Kevin Widjaja Date: Tue Jun 10 20:34:53 2025 +0200 ARM: dts: qcom: msm8974-sony-xperia-rhine: Move camera buttons to amami & honami An upcoming board in the sony-xperia-rhine family (sony-togari) does not have dedicated camera buttons, so move those from common rhine dtsi to amami and honami dts files. Signed-off-by: Kevin Widjaja Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250610-togari-v2-2-10e7b53b87c1@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 702639bc50515c973cf92191d689623fa7d6c32e Author: Kevin Widjaja Date: Tue Jun 10 20:34:52 2025 +0200 ARM: dts: qcom: msm8974-sony-xperia-rhine: Enable USB charging Set usb-charge-current-limit to enable charging over USB for all sony-rhine devices. Signed-off-by: Kevin Widjaja Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250610-togari-v2-1-10e7b53b87c1@lucaweiss.eu Signed-off-by: Bjorn Andersson commit 5d6d67c4cb10a4b4d3ae35758d5eeed6239afdc8 Merge: 5e84d5b36b5b0e 078bb22cfc652a Author: Jakub Kicinski Date: Wed Jun 11 17:41:43 2025 -0700 Merge branch 'net-bcmgenet-add-support-for-gro-software-interrupt-coalescing' Zak Kemble says: ==================== net: bcmgenet: add support for GRO software interrupt coalescing Enable support for software IRQ coalescing and GRO aggregation and apply conservative defaults which can help improve system and network performance by reducing the number of hardware interrupts and improving GRO aggregation ratio. v1: https://lore.kernel.org/20250531224853.1339-1-zakkemble@gmail.com ==================== Link: https://patch.msgid.link/20250610220403.935-1-zakkemble@gmail.com Signed-off-by: Jakub Kicinski commit 078bb22cfc652aa206c89e16d25ab3ffffc7427c Author: Zak Kemble Date: Tue Jun 10 23:04:03 2025 +0100 net: bcmgenet: enable GRO software interrupt coalescing by default Apply conservative defaults. Signed-off-by: Zak Kemble Tested-by: Florian Fainelli Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250610220403.935-3-zakkemble@gmail.com Signed-off-by: Jakub Kicinski commit 28ed9bed5fb24e4235b8d6cffb5a5c68de710a25 Author: Zak Kemble Date: Tue Jun 10 23:04:02 2025 +0100 net: bcmgenet: use napi_complete_done return value Make use of the return value from napi_complete_done(). This allows users to use the gro_flush_timeout and napi_defer_hard_irqs sysfs attributes for configuring software interrupt coalescing. Signed-off-by: Zak Kemble Tested-by: Florian Fainelli Reviewed-by: Florian Fainelli Link: https://patch.msgid.link/20250610220403.935-2-zakkemble@gmail.com Signed-off-by: Jakub Kicinski commit 5e84d5b36b5b0e8552fbbdfbfd9c81bb79ab0947 Author: Abin Joseph Date: Tue Jun 10 17:11:11 2025 +0530 net: macb: Add shutdown operation support Implement the shutdown hook to ensure clean and complete deactivation of MACB controller. The shutdown sequence is protected with 'rtnl_lock()' to serialize access and prevent race conditions while detaching and closing the network device. This ensure a safe transition when the Kexec utility calls the shutdown hook, facilitating seamless loading and booting of a new kernel from the currently running one. Signed-off-by: Abin Joseph Link: https://patch.msgid.link/20250610114111.1708614-1-abin.joseph@amd.com Signed-off-by: Jakub Kicinski commit 48c15e974c7d85a772792e56daf46c2b28190ec7 Merge: 8f344fe5a1e024 b2f96c3c96314f Author: Jakub Kicinski Date: Wed Jun 11 17:37:51 2025 -0700 Merge branch 'net-phy-micrel-add-extended-phy-support-for-ksz9477-class-devices' Oleksij Rempel says: ==================== net: phy: micrel: add extended PHY support for KSZ9477-class devices This patch series extends the PHY driver support for the Microchip KSZ9477-class switch-integrated PHYs. These changes enhance ethtool functionality and diagnostic capabilities by implementing the following features: - MDI/MDI-X configuration support All crossover modes (auto, MDI, MDI-X) are now configurable. - RX error counter reporting The RXER counter (reg 0x15) is now accumulated and exported via ethtool stats. - Cable test support Reuses the KSZ9131 implementation to enable open/short fault detection and approximate fault length reporting. ==================== Link: https://patch.msgid.link/20250610091354.4060454-1-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit b2f96c3c96314ff3888ebb7d3126cf5f5e7c278b Author: Oleksij Rempel Date: Tue Jun 10 11:13:54 2025 +0200 net: phy: micrel: add cable test support for KSZ9477-class PHYs Enable cable test support for KSZ9477-class PHYs by reusing the existing KSZ9131 implementation. This also adds support for 100Mbit-only PHYs like KSZ8563, which are identified as KSZ9477. For these PHYs, only two wire pairs (A and B) are active, so the cable test logic limits the pair_mask accordingly. Support for KSZ8563 is untested but added based on its register compatibility and PHY ID match. Tested on KSZ9893 (Gigabit): open and short conditions were correctly detected on all four pairs. Fault length reporting is functional and varies by pair. For example: - 2m cable: open faults reported ~1.2m (pairs B–D), 0.0m (pair A) - No cable: all pairs report 0.0m fault length Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250610091354.4060454-4-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 597ebdf37222ba7deb2ed24aa4de777d7edf22f7 Author: Oleksij Rempel Date: Tue Jun 10 11:13:53 2025 +0200 net: phy: micrel: Add RX error counter support for KSZ9477 switch-integrated PHYs Add support for tracking receive error statistics from PHYs integrated into the KSZ9477 family of Ethernet switches. The integrated PHYs expose a receive error (RXER) counter in register 0x15. This counter increments when the PHY detects one or more symbol errors on a received frame. The register is cleared upon reading. Changes include: - `kszphy_update_stats()` to accumulate the RX error count. - `kszphy_get_phy_stats()` to expose this count via ethtool PHY stats. - Addition of a private `rx_err_pkt_cnt` field in the driver. - Registration of `.update_stats` and `.get_phy_stats` callbacks in the KSZ9477 PHY driver structure. The functionality of this counter was confirmed by physically disturbing the signal lines - specifically by wiggling exposed twisted pair wires and intentionally shorting between pairs. These actions triggered RXER increments, validating the counter's behavior. This RXER counter is confirmed for KSZ9477 and likely applicable to other related PHYs like those in KSZ9313. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250610091354.4060454-3-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit ee868127170c1211c528f0629277d8b44a0e1852 Author: Oleksij Rempel Date: Tue Jun 10 11:13:52 2025 +0200 net: phy: micrel: add MDI/MDI-X control support for KSZ9477 switch-integrated PHYs Add MDI/MDI-X configuration support for PHYs integrated in the KSZ9477 family of Ethernet switches. All MDI/MDI-X configuration modes are supported: - Automatic MDI/MDI-X (ETH_TP_MDI_AUTO) - Forced MDI (ETH_TP_MDI) - Forced MDI-X (ETH_TP_MDI_X) However, when operating in automatic mode, the PHY does not expose the resolved crossover status (i.e., whether MDI or MDI-X is active). Therefore, in auto mode, the driver reports ETH_TP_MDI_INVALID as the current status. Signed-off-by: Oleksij Rempel Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250610091354.4060454-2-o.rempel@pengutronix.de Signed-off-by: Jakub Kicinski commit 8f344fe5a1e0241e3f4f343e1a5a3ead843952b0 Merge: 7781c4f7030521 6913e873e7b2e4 Author: Jakub Kicinski Date: Wed Jun 11 16:41:54 2025 -0700 Merge branch 'fbnic-expand-mac-stats-coverage' Mohsin Bashir says: ==================== fbnic: Expand mac stats coverage This patch series expand the coverage of mac stats for fbnic. The first patch increment the ETHTOOL_RMON_HIST_MAX by 1 to provide necessary support for all the ranges of rmon histogram supported by fbnic. The second patch add support for rmon and eth_ctrl stats. ==================== Link: https://patch.msgid.link/20250610171109.1481229-1-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit 6913e873e7b2e403b2b5a28337a02cee1ef0c5e6 Author: Mohsin Bashir Date: Tue Jun 10 10:11:09 2025 -0700 eth: fbnic: Expand coverage of mac stats Expand coverage of MAC stats via ethtool by adding rmon and eth-ctrl stats. ethtool -S eth0 --groups eth-ctrl Standard stats for eth0: eth-ctrl-MACControlFramesTransmitted: 0 eth-ctrl-MACControlFramesReceived: 0 ethtool -S eth0 --groups rmon Standard stats for eth0: rmon-etherStatsUndersizePkts: 0 rmon-etherStatsOversizePkts: 0 rmon-etherStatsFragments: 0 rmon-etherStatsJabbers: 0 rx-rmon-etherStatsPkts64Octets: 32807689 rx-rmon-etherStatsPkts65to127Octets: 567512968 rx-rmon-etherStatsPkts128to255Octets: 64730266 rx-rmon-etherStatsPkts256to511Octets: 20136039 rx-rmon-etherStatsPkts512to1023Octets: 28476870 rx-rmon-etherStatsPkts1024to1518Octets: 6958335 rx-rmon-etherStatsPkts1519to2047Octets: 164 rx-rmon-etherStatsPkts2048to4095Octets: 3844 rx-rmon-etherStatsPkts4096to8191Octets: 21814 rx-rmon-etherStatsPkts8192to9216Octets: 6540818 rx-rmon-etherStatsPkts9217to9742Octets: 4180897 tx-rmon-etherStatsPkts64Octets: 8786 tx-rmon-etherStatsPkts65to127Octets: 31475804 tx-rmon-etherStatsPkts128to255Octets: 3581331 tx-rmon-etherStatsPkts256to511Octets: 2483038 tx-rmon-etherStatsPkts512to1023Octets: 4500916 tx-rmon-etherStatsPkts1024to1518Octets: 38741270 tx-rmon-etherStatsPkts1519to2047Octets: 15521 tx-rmon-etherStatsPkts2048to4095Octets: 4109 tx-rmon-etherStatsPkts4096to8191Octets: 20817 tx-rmon-etherStatsPkts8192to9216Octets: 6904055 tx-rmon-etherStatsPkts9217to9742Octets: 6757746 Signed-off-by: Mohsin Bashir Reviewed-by: Jacob Keller Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250610171109.1481229-3-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit e1f4b1f167581a4932dd4f017c80a6e46d28761a Author: Mohsin Bashir Date: Tue Jun 10 10:11:08 2025 -0700 eth: Update rmon hist range The fbnic driver reports up-to 11 ranges resulting in the drop of the last range. This patch increment the value of ETHTOOL_RMON_HIST_MAX to address this limitation. Signed-off-by: Mohsin Bashir Reviewed-by: Jacob Keller Reviewed-by: Andrew Lunn Link: https://patch.msgid.link/20250610171109.1481229-2-mohsin.bashr@gmail.com Signed-off-by: Jakub Kicinski commit a98ce0275b4b3fd5e0622da8aabbccc9a39670e0 Author: Al Viro Date: Tue May 14 08:53:07 2024 -0600 efi_secret: clean securityfs use up securityfs_remove() does take care of entire subtree now; no need to mess with them individually. NB: ->i_op replacement in there is still buggy. One shouldn't ever modify ->i_op of live accessible inode. Signed-off-by: Al Viro commit 29d673b1508fcaa14be32e92679874f10a099bc8 Author: Al Viro Date: Mon May 13 23:36:53 2024 -0600 make securityfs_remove() remove the entire subtree ... and fix the mount leak when anything's mounted there. securityfs_recursive_remove becomes an alias for securityfs_remove - we'll probably need to remove it in a cycle or two. Signed-off-by: Al Viro commit 0ed4b3c21c5013842b7e661dd1c4aa5b75c9c5db Author: Lucas De Marchi Date: Wed Jun 4 08:03:06 2025 -0700 drm/xe/lrc: Prepare WA BB setup for more users The post context restore (WA BB) is a mechanism in HW that may be used for things other than the utilization setup. Create a new function called setup_wa_bb() that wraps any function writing useful commands in the buffer. Reviewed-by: Umesh Nerlige Ramappa Reviewed-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250604-wa-bb-fix-v1-2-0dfc5dafcef0@intel.com Signed-off-by: Lucas De Marchi commit ef48715b2d3df17c060e23b9aa636af3d95652f8 Author: Lucas De Marchi Date: Wed Jun 4 08:03:05 2025 -0700 drm/xe/lrc: Use a temporary buffer for WA BB In case the BO is in iomem, we can't simply take the vaddr and write to it. Instead, prepare a separate buffer that is later copied into io memory. Right now it's just a few words that could be using xe_map_write32(), but the intention is to grow the WA BB for other uses. Fixes: 82b98cadb01f ("drm/xe: Add WA BB to capture active context utilization") Cc: Umesh Nerlige Ramappa Cc: Tvrtko Ursulin Reviewed-by: Matthew Brost Reviewed-by: Umesh Nerlige Ramappa Link: https://lore.kernel.org/r/20250604-wa-bb-fix-v1-1-0dfc5dafcef0@intel.com Signed-off-by: Lucas De Marchi commit 2c58d42de71f9c73e40afacc9d062892d2cc8862 Author: Al Viro Date: Tue May 14 08:48:58 2024 -0600 fix locking in efi_secret_unlink() We used to need securityfs_remove() to undo simple_pin_fs() done when the file had been created and to drop the second extra reference taken at the same time. Now that neither is needed (or done by securityfs_remove()), we can simply call simple_unlink() and be done with that - the broken games with locking had been there only for the sake of securityfs_remove(). Signed-off-by: Al Viro commit e4de72650202e3da56b107f8e537d2b4a0341e40 Author: Al Viro Date: Tue May 14 08:46:00 2024 -0600 securityfs: pin filesystem only for objects directly in root Nothing on securityfs ever changes parents, so we don't need to pin the internal mount if it's already pinned for parent. Signed-off-by: Al Viro commit 7781c4f703052130867bc051cb0b33fa471807be Author: Alexander Stein Date: Tue Jun 10 13:40:56 2025 +0200 net: fman_memac: Don't use of_property_read_bool on non-boolean property managed 'managed' is a non-boolean property specified in ethernet-controller.yaml. Since commit c141ecc3cecd7 ("of: Warn when of_property_read_bool() is used on non-boolean properties") this raises a warning. Use the replacement of_property_present() instead. Signed-off-by: Alexander Stein Reviewed-by: Sean Anderson Link: https://patch.msgid.link/20250610114057.414791-1-alexander.stein@ew.tq-group.com Signed-off-by: Jakub Kicinski commit ae4e3334dd057943b3d6922861a9117af88dc266 Author: Heiner Kallweit Date: Tue Jun 10 22:58:15 2025 +0200 net: usb: lan78xx: make struct fphy_status static const Constify variable fphy_status and make it static. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/0890f92e-a03d-4aa7-8bc8-94123d253f22@gmail.com Signed-off-by: Jakub Kicinski commit 1a3e9b7a6b09e8ab3d2af019e4a392622685855e Author: Qingfang Deng Date: Tue Jun 10 16:32:10 2025 +0800 ppp: convert to percpu netstats Convert to percpu netstats to avoid lock contention when reading them. Signed-off-by: Qingfang Deng Link: https://patch.msgid.link/20250610083211.909015-1-dqfext@gmail.com Signed-off-by: Jakub Kicinski commit f6a0bc5650287dde9c49273063c8baa02db7d857 Author: Heiner Kallweit Date: Tue Jun 10 07:46:02 2025 +0200 r8169: remove redundant pci_tbl entry This entry is covered by the entry in the next line already. Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/2d81fe20-f71d-4483-817d-d46f9ec88cce@gmail.com Signed-off-by: Jakub Kicinski commit 5089cdc1540c9336bcccaaf3b036695c879fcadb Author: Heiner Kallweit Date: Tue Jun 10 07:43:38 2025 +0200 r8169: enable EEE at 5Gbps on RTL8126 According to Realtek [0] it's safe to enable EEE at 5Gbps on RTL8126. [0] https://www.spinics.net/lists/netdev/msg1091873.html Signed-off-by: Heiner Kallweit Link: https://patch.msgid.link/18ce0996-0182-4a11-a93a-df14b0e6876c@gmail.com Signed-off-by: Jakub Kicinski commit 18667214b955ef89f208d451820c39a5dfd77f27 Author: Jiri Pirko Date: Tue Jun 10 04:51:28 2025 +0200 net/mlx5: Expose serial numbers in devlink info Devlink info allows to expose serial number and board serial number Get the values from PCI VPD and expose it. $ devlink dev info pci/0000:08:00.0: driver mlx5_core serial_number e4397f872caeed218000846daa7d2f49 board.serial_number MT2314XZ00YA versions: fixed: fw.psid MT_0000000894 running: fw.version 28.41.1000 fw 28.41.1000 stored: fw.version 28.41.1000 fw 28.41.1000 auxiliary/mlx5_core.eth.0: driver mlx5_core.eth pci/0000:08:00.1: driver mlx5_core serial_number e4397f872caeed218000846daa7d2f49 board.serial_number MT2314XZ00YA versions: fixed: fw.psid MT_0000000894 running: fw.version 28.41.1000 fw 28.41.1000 stored: fw.version 28.41.1000 fw 28.41.1000 auxiliary/mlx5_core.eth.1: driver mlx5_core.eth Signed-off-by: Jiri Pirko Reviewed-by: Parav Pandit Reviewed-by: Simon Horman Reviewed-by: Kalesh AP Acked-by: Tariq Toukan Link: https://patch.msgid.link/20250610025128.109232-1-jiri@resnulli.us Signed-off-by: Jakub Kicinski commit a184bb1e71a0e45201316a39fb564688d11d2d52 Merge: a4a65c6fe08bcf 97c6383113b540 Author: Jakub Kicinski Date: Wed Jun 11 14:01:21 2025 -0700 Merge branch 'netlink-specs-fix-all-the-yamllint-errors' Donald Hunter says: ==================== netlink: specs: fix all the yamllint errors yamllint reported ~500 errors and warnings in the netlink specs. Fix all the reported issues. Link: https://lore.kernel.org/netdev/m2tt4tt3wv.fsf@gmail.com/ ==================== Link: https://patch.msgid.link/20250610125944.85265-1-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 97c6383113b540305ec6250abcd3b7b30aba1343 Author: Donald Hunter Date: Tue Jun 10 13:59:44 2025 +0100 netlink: specs: fix a couple of yamllint warnings Clean up the remaining yamllint warnings in the netlink specs: [warning] comment not indented like content (comments-indentation) [error] too many spaces after colon (colons) Signed-off-by: Donald Hunter Reviewed-by: Chuck Lever Reviewed-by: Matthieu Baerts (NGI0) # mptcp_pm.yaml Link: https://patch.msgid.link/20250610125944.85265-8-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit d26552d38c82ee42711f1587e82361e23e80c30f Author: Donald Hunter Date: Tue Jun 10 13:59:43 2025 +0100 netlink: specs: wrap long doc lines (>80 chars) Clean up all line too long errors reported by yamllint in the netlink specs, e.g. error line too long (97 > 80 characters) (line-length) Signed-off-by: Donald Hunter Reviewed-by: Chuck Lever Reviewed-by: Matthieu Baerts (NGI0) # mptcp_pm.yaml Link: https://patch.msgid.link/20250610125944.85265-7-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit ec362192aa9e07580442a663c702ff2a253a7370 Author: Donald Hunter Date: Tue Jun 10 13:59:42 2025 +0100 netlink: specs: fix up indentation errors Clean up all indentation related errors reported by yamllint in the netlink specs, e.g. error wrong indentation: expected 6 but found 5 (indentation) Signed-off-by: Donald Hunter Reviewed-by: Chuck Lever Reviewed-by: Matthieu Baerts (NGI0) # mptcp_pm.yaml Link: https://patch.msgid.link/20250610125944.85265-6-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 3c90fd2baaa041dc1df37b40f4e41a6cacfe1abf Author: Donald Hunter Date: Tue Jun 10 13:59:41 2025 +0100 netlink: specs: fix up truthy values Clean up all truthy value warnings reported by yamllint in the netlink specs: warning truthy value should be one of [false, true] (truthy) Signed-off-by: Donald Hunter Reviewed-by: Chuck Lever Reviewed-by: Matthieu Baerts (NGI0) # mptcp_pm.yaml Link: https://patch.msgid.link/20250610125944.85265-5-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 2338bab56951aff748132fd94a0d65e35b5aa927 Author: Donald Hunter Date: Tue Jun 10 13:59:40 2025 +0100 netlink: specs: fix up spaces before comments Clean up all comments warnings reported by yamllint in the netlink specs: warning too few spaces before comment: expected 2 (comments) Signed-off-by: Donald Hunter Reviewed-by: Chuck Lever Reviewed-by: Matthieu Baerts (NGI0) # mptcp_pm.yaml Link: https://patch.msgid.link/20250610125944.85265-4-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 880d43ca9aa4fd9efee05de2927c48c77bf8ccdb Author: Donald Hunter Date: Tue Jun 10 13:59:39 2025 +0100 netlink: specs: clean up spaces in brackets Clean up all space inside brackets errors reported by yamllint in the netlink specs: error too many spaces inside brackets (brackets) Signed-off-by: Donald Hunter Reviewed-by: Chuck Lever Reviewed-by: Matthieu Baerts (NGI0) # mptcp_pm.yaml Link: https://patch.msgid.link/20250610125944.85265-3-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit ce6bd277e1f77e86a604eb2c3e569c87b0cdd584 Author: Donald Hunter Date: Tue Jun 10 13:59:38 2025 +0100 netlink: specs: add doc start markers to yaml Clean up all document-start warnings reported by yamllint in the netlink specs: warning missing document start "---" (document-start) Signed-off-by: Donald Hunter Reviewed-by: Chuck Lever Reviewed-by: Matthieu Baerts (NGI0) # mptcp_pm.yaml Link: https://patch.msgid.link/20250610125944.85265-2-donald.hunter@gmail.com Signed-off-by: Jakub Kicinski commit 38815c43786b899a62bf655d58a58f6d95d04bbf Author: Guilherme Giacomo Simoes Date: Tue Jun 10 23:21:23 2025 -0300 PCI: hotplug: Remove TODO about unused .get_power(), .hardware_test() Remove TODO note resolved by 8ff4574cf73d ("PCI: cpcihp: Remove unused .get_power() and .set_power()") and 5b036cada481 ("PCI: cpcihp: Remove unused struct cpci_hp_controller_ops.hardware_test"). Signed-off-by: Guilherme Giacomo Simoes Signed-off-by: Bjorn Helgaas Link: https://patch.msgid.link/20250611022123.201839-1-trintaeoitogc@gmail.com commit ae0756933e879a703e1a5deb701d9ec88b032ba3 Author: Ian Rogers Date: Thu May 29 12:22:06 2025 -0700 perf thread: Ensure comm_lock held for comm_list Add thread safety annotations for comm_list and add locking for two instances where the list is accessed without the lock held (in contradiction to ____thread__set_comm()). Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250529192206.971199-1-irogers@google.com Signed-off-by: Namhyung Kim commit a4a65c6fe08bcf48ce404037a9e20a2d14b16855 Author: Bobby Eshleman Date: Mon Jun 9 09:39:24 2025 -0700 selftests/vsock: add initial vmtest.sh for vsock This commit introduces a new vmtest.sh runner for vsock. It uses virtme-ng/qemu to run tests in a VM. The tests validate G2H, H2G, and loopback. The testing tools from tools/testing/vsock/ are reused. Currently, only vsock_test is used. VMCI and hyperv support is included in the config file to be built with the -b option, though not used in the tests. Only tested on x86. To run: $ make -C tools/testing/selftests TARGETS=vsock $ tools/testing/selftests/vsock/vmtest.sh or $ make -C tools/testing/selftests TARGETS=vsock run_tests Example runs (after make -C tools/testing/selftests TARGETS=vsock): $ ./tools/testing/selftests/vsock/vmtest.sh 1..3 ok 0 vm_server_host_client ok 1 vm_client_host_server ok 2 vm_loopback SUMMARY: PASS=3 SKIP=0 FAIL=0 Log: /tmp/vsock_vmtest_m7DI.log $ ./tools/testing/selftests/vsock/vmtest.sh vm_loopback 1..1 ok 0 vm_loopback SUMMARY: PASS=1 SKIP=0 FAIL=0 Log: /tmp/vsock_vmtest_a1IO.log $ mkdir -p ~/scratch $ make -C tools/testing/selftests install TARGETS=vsock INSTALL_PATH=~/scratch [... omitted ...] $ cd ~/scratch $ ./run_kselftest.sh TAP version 13 1..1 # timeout set to 300 # selftests: vsock: vmtest.sh # 1..3 # ok 0 vm_server_host_client # ok 1 vm_client_host_server # ok 2 vm_loopback # SUMMARY: PASS=3 SKIP=0 FAIL=0 # Log: /tmp/vsock_vmtest_svEl.log ok 1 selftests: vsock: vmtest.sh Future work can include vsock_diag_test. Because vsock requires a VM to test anything other than loopback, this patch adds vmtest.sh as a kselftest itself. This is different than other systems that have a "vmtest.sh", where it is used as a utility script to spin up a VM to run the selftests as a guest (but isn't hooked into kselftest). Signed-off-by: Bobby Eshleman Reviewed-by: Stefano Garzarella Link: https://patch.msgid.link/20250609-vsock-vmtest-v10-1-7f37198e1cd4@gmail.com Signed-off-by: Jakub Kicinski commit 517b088a846b3ce56b3ff07cdf24cd68c89b3a9e Author: Yonghong Song Date: Wed Jun 11 09:21:03 2025 -0700 selftests/bpf: Fix cgroup_mprog_ordering failure due to uninitialized variable On arm64, the cgroup_mprog_ordering selftest failed with test_progs run when building with clang compiler. The reason is due to socklen_t optlen not initialized. In kernel function do_ip_getsockopt(), we have if (copy_from_sockptr(&len, optlen, sizeof(int))) return -EFAULT; if (len < 0) return -EINVAL; The above 'len' variable is a negative value and hence the test failed. But the test is okay on x86_64. I checked the x86_64 asm code and I didn't see explicit initialization of 'optlen' but its value is 0 so kernel didn't return error. This should be a pure luck. Fix the bug by initializing 'oplen' var properly. Fixes: e422d5f118e4 ("selftests/bpf: Add two selftests for mprog API based cgroup progs") Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250611162103.1623692-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit c9b03a11005f6c1b8945a69f456653e8cdb70fdb Author: Eslam Khafagy Date: Sun Jun 8 01:24:25 2025 +0300 bpf, doc: Improve wording of docs The phrase "dividing -1" is one I find confusing. E.g., "INT_MIN dividing -1" sounds like "-1 / INT_MIN" rather than the inverse. "divided by" instead of "dividing" assuming the inverse is meant. Signed-off-by: Eslam Khafagy Acked-by: Yonghong Song Link: https://lore.kernel.org/r/20250607222434.227890-1-eslam.medhat1993@gmail.com Signed-off-by: Alexei Starovoitov commit 7f12c33850482521c961c5c15a50ebe9b9a88d1e Author: Charalampos Mitrodimas Date: Wed Jun 11 17:20:43 2025 +0000 net, bpf: Fix RCU usage in task_cls_state() for BPF programs The commit ee971630f20f ("bpf: Allow some trace helpers for all prog types") made bpf_get_cgroup_classid_curr helper available to all BPF program types, not just networking programs. This helper calls __task_get_classid() which internally calls task_cls_state() requiring rcu_read_lock_bh_held(). This works in networking/tc context where RCU BH is held, but triggers an RCU warning when called from other contexts like BPF syscall programs that run under rcu_read_lock_trace(): WARNING: suspicious RCU usage 6.15.0-rc4-syzkaller-g079e5c56a5c4 #0 Not tainted ----------------------------- net/core/netclassid_cgroup.c:24 suspicious rcu_dereference_check() usage! Fix this by also accepting rcu_read_lock_held() and rcu_read_lock_trace_held() as valid RCU contexts in the task_cls_state() function. This ensures the helper works correctly in all needed RCU contexts where it might be called, regular RCU, RCU BH (for networking), and RCU trace (for BPF syscall programs). Fixes: ee971630f20f ("bpf: Allow some trace helpers for all prog types") Reported-by: syzbot+b4169a1cfb945d2ed0ec@syzkaller.appspotmail.com Signed-off-by: Charalampos Mitrodimas Signed-off-by: Daniel Borkmann Acked-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20250611-rcu-fix-task_cls_state-v3-1-3d30e1de753f@posteo.net Closes: https://syzkaller.appspot.com/bug?extid=b4169a1cfb945d2ed0ec commit fc3870dc5cadb701b4122e4a8daa85f9fa2f57b9 Author: Benno Lossin Date: Thu Jun 5 17:52:54 2025 +0200 rust: pin-init: examples, tests: use `ignore` instead of conditionally compiling tests Change `#[cfg(cond)]` to `#[cfg_attr(not(cond), ignore)]` on tests. Ignoring tests instead of disabling them still makes them appear in the test list, but with `ignored`. It also still compiles the code in those cases. Some tests still need to be ignore, because they use types that are not present when the condition is false. For example the condition is `feature = std` and then it uses `std::thread::Thread`. Suggested-by: Alice Ryhl Link: https://lore.kernel.org/all/aDC9y829vZZBzZ2p@google.com Link: https://github.com/Rust-for-Linux/pin-init/pull/58/commits/b004dd8e64d4cbe219a4eff0d25f0a5f5bc750ca Reviewed-by: Christian Schrefl Link: https://lore.kernel.org/all/20250605155258.573391-1-lossin@kernel.org Signed-off-by: Benno Lossin commit f744a5b68eead2cc73691e91182522c7d800245e Author: Miguel Ojeda Date: Mon May 26 17:29:14 2025 +0200 rust: init: remove doctest's `Error::from_errno` workaround Since commit 5ed147473458 ("rust: error: make conversion functions public"), `Error::from_errno` is public. Thus remove the workaround added in commit a30e94c29673 ("rust: init: make doctests compilable/testable"). Suggested-by: Benno Lossin Signed-off-by: Miguel Ojeda Link: https://lore.kernel.org/all/20250526152914.2453949-2-ojeda@kernel.org Signed-off-by: Benno Lossin commit d2b7313fa21bbe7ce3c4147d84c1ccbc6d69b9db Author: Miguel Ojeda Date: Mon May 26 17:29:13 2025 +0200 rust: init: re-enable doctests Commit a30e94c29673 ("rust: init: make doctests compilable/testable") made these tests buildable among others, but eventually the pin-init crate was made into its own crate [1] and the tests were marked as `ignore` in commit 206dea39e559 ("rust: init: disable doctests"). A few other bits got changed in that reorganization, e.g. the `clippy::missing_safety_doc` was removed and the `expect` use. Since there is no reason not to build/test them, re-enable them. In order to do so, tweak a few bits to keep the build clean, and also use again `expect` since this is one of those places where we can actually do so. Link: https://lore.kernel.org/all/20250308110339.2997091-1-benno.lossin@proton.me/ [1] Signed-off-by: Miguel Ojeda Link: https://lore.kernel.org/all/20250526152914.2453949-1-ojeda@kernel.org Signed-off-by: Benno Lossin commit ec87ec35ca8bd61bfc1200224d332b4573b9dafa Author: Benno Lossin Date: Fri May 23 16:51:02 2025 +0200 rust: pin-init: implement `ZeroableOption` for function pointers with up to 20 arguments `Option<[unsafe] [extern "abi"] fn(...args...) -> ret>` is documented [1] to also have the `None` variant equal all zeroes. Link: https://doc.rust-lang.org/stable/std/option/index.html#representation [1] Link: https://github.com/Rust-for-Linux/pin-init/pull/56/commits/b6c1ab4fb3699765f81ae512ecac5a2f032d8d51 Link: https://lore.kernel.org/all/20250523145125.523275-7-lossin@kernel.org Signed-off-by: Benno Lossin commit e832374ccadf4d1ce7bd40a85b9320bd7fbb3628 Author: Benno Lossin Date: Thu May 29 10:10:24 2025 +0200 rust: pin-init: change blanket impls for `[Pin]Init` and add one for `Result` Remove the error from the blanket implementations `impl Init for T` (and also for `PinInit`). Add implementations for `Result`. This allows one to easily construct (un)conditional failing initializers. It also improves the compatibility with APIs that do not use pin-init, because users can supply a `Result` to a function taking an `impl PinInit`. Suggested-by: Alice Ryhl Link: https://github.com/Rust-for-Linux/pin-init/pull/62/commits/58612514b256c6f4a4a0718be25298410e67387a [ Also fix a compile error in block. - Benno ] Reviewed-by: Boqun Feng Link: https://lore.kernel.org/all/20250529081027.297648-2-lossin@kernel.org [ Add title prefix `rust: pin-init`. - Benno ] Signed-off-by: Benno Lossin commit 9f473538706b9fb5e82c9864b04089d35e4f93d5 Author: Benno Lossin Date: Fri May 23 16:51:01 2025 +0200 rust: pin-init: change `impl Zeroable for Option>` to `ZeroableOption for NonNull` This brings it in line with references. It too is listed in [1]. Link: https://doc.rust-lang.org/stable/std/option/index.html#representation Link: https://github.com/Rust-for-Linux/pin-init/pull/56/commits/8e52bf56ddc2190ce901d2f7c008ab8a64f653a9 Link: https://lore.kernel.org/all/20250523145125.523275-6-lossin@kernel.org Signed-off-by: Benno Lossin commit 8b3d955f72f999ccce26aabdeb09939964d05a61 Author: Benno Lossin Date: Thu May 29 10:10:23 2025 +0200 rust: pin-init: improve safety documentation for `impl [Pin]Init for T` The inner SAFETY comments were missing since commit 5cfe7bef6751 ("rust: enable `clippy::undocumented_unsafe_blocks` lint"). Also rework the implementation of `__pinned_init` to better justify the SAFETY comment. Link: https://github.com/Rust-for-Linux/pin-init/pull/62/commits/df925b2e27d499b7144df7e62b01acb00d4b94b8 Reviewed-by: Boqun Feng Link: https://lore.kernel.org/all/20250529081027.297648-1-lossin@kernel.org Signed-off-by: Benno Lossin commit e93a238605348bc40fed77ba5582e311376d113b Author: Benno Lossin Date: Fri May 23 16:51:00 2025 +0200 rust: pin-init: implement `ZeroableOption` for `&T` and `&mut T` `Option<&T>` and `Option<&mut T>` are documented [1] to have the `None` variant be all zeroes. Link: https://doc.rust-lang.org/stable/std/option/index.html#representation [1] Link: https://github.com/Rust-for-Linux/pin-init/pull/56/commits/5ef1638c79e019d3dc0c62db5905601644c2e60a Link: https://lore.kernel.org/all/20250523145125.523275-5-lossin@kernel.org Signed-off-by: Benno Lossin commit d67b37012080cf1978b5fd36f040a53f92152243 Author: Benno Lossin Date: Fri May 23 16:50:59 2025 +0200 rust: pin-init: add `zeroed()` & `Zeroable::zeroed()` functions `zeroed()` returns a zeroed out value of a sized type implementing `Zeroable`. The function is added as a free standing function, in addition to an associated function on `Zeroable`, because then it can be marked `const` (functions in traits can't be const at the moment). Link: https://github.com/Rust-for-Linux/pin-init/pull/56/commits/809e4ec160579c1601dce5d78b432a5b6c8e4e40 Link: https://lore.kernel.org/all/20250523145125.523275-4-lossin@kernel.org Signed-off-by: Benno Lossin commit c47024ba198b01cab6bb6e3e5a69b73ed2f2aa16 Author: Benno Lossin Date: Fri May 23 16:50:58 2025 +0200 rust: pin-init: add `Zeroable::init_zeroed` The trait function delegates to the already existing `init_zeroed` function that returns a zeroing initializer for `Self`. The syntax `..Zeroable::init_zeroed()` is already used by the initialization macros to initialize all fields that are not mentioned in the initializer with zero. Therefore it is expected that the function also exists on the trait. Link: https://github.com/Rust-for-Linux/pin-init/pull/56/commits/a424a6c9af5a4418a8e5e986a3db26a4432e2f1a Link: https://lore.kernel.org/all/20250523145125.523275-3-lossin@kernel.org Signed-off-by: Benno Lossin commit 101b7cf006d4b4b98652bd15dc36e63ede8f8ad8 Author: Benno Lossin Date: Fri May 23 16:50:57 2025 +0200 rust: pin-init: rename `zeroed` to `init_zeroed` The name `zeroed` is a much better fit for a function that returns the type by-value. Link: https://github.com/Rust-for-Linux/pin-init/pull/56/commits/7dbe38682c9725405bab91dcabe9c4d8893d2f5e [ also rename uses in `rust/kernel/init.rs` - Benno] Link: https://lore.kernel.org/all/20250523145125.523275-2-lossin@kernel.org [ Fix wrong replacement of `mem::zeroed` in the definition of `trait Zeroable`. - Benno ] [ Also change occurrences of `zeroed` in `configfs.rs` - Benno ] Acked-by: Andreas Hindborg Signed-off-by: Benno Lossin commit b3b4f760ccf2d08ff3db0f094c32ce70bba2eb15 Author: Benno Lossin Date: Mon Jun 9 16:17:35 2025 +0200 rust: pin-init: feature-gate the `stack_init_reuse` test on the `std` feature When trying to run `cargo check --all-targets --no-default-features`, an error is reported by the test, as it cannot find the `std` crate. This is to be expected, since the `--no-default-features` flag enables the `no-std` behavior of the crate. Thus exclude the test in that scenario. Link: https://github.com/Rust-for-Linux/pin-init/pull/50/commits/2813729ccacdedee9dbfcab1ed285b8721a0391b Link: https://lore.kernel.org/all/20250523125424.192843-4-lossin@kernel.org [ Changed my author email address to @kernel.org. - Benno ] Signed-off-by: Benno Lossin commit 2408678d700c4db6c54749a272d42a964f5f3418 Author: Benno Lossin Date: Fri May 23 14:54:12 2025 +0200 rust: pin-init: examples: pthread_mutex: disable the main test for miri `miri` takes a long time to execute the test, so disable it. Link: https://github.com/Rust-for-Linux/pin-init/pull/50/commits/e717a9eec85024c11e79e8bd9dcb664ad0de8f94 Link: https://lore.kernel.org/all/20250523125424.192843-3-lossin@kernel.org Signed-off-by: Benno Lossin commit 58cebd68882edd407c7f65ebb4a42034bc1ffc6d Author: Benno Lossin Date: Fri May 23 14:54:11 2025 +0200 rust: pin-init: examples, tests: add conditional compilation in order to compile under any feature combination In the CI, all examples & tests should be run under all feature combinations. Currently several examples & tests use `std` without conditionally enabling it. Thus make them all compile under any feature combination by conditionally disabling the code that uses e.g. `std`. Link: https://github.com/Rust-for-Linux/pin-init/pull/50/commits/fdfb70efddbc711b4543c850ee38a2f5a8d17cb6 Link: https://lore.kernel.org/all/20250523125424.192843-2-lossin@kernel.org Signed-off-by: Benno Lossin commit 27cd1bf1240d482e4f02ca4f9812e748f3106e4f Author: Al Viro Date: Thu May 8 23:38:01 2025 -0400 securityfs: don't pin dentries twice, once is enough... incidentally, securityfs_recursive_remove() is broken without that - it leaks dentries, since simple_recursive_removal() does not expect anything of that sort. It could be worked around by dput() in remove_one() callback, but it's easier to just drop that double-get stuff. Signed-off-by: Al Viro commit 63350a07966f61183462c200361a8c8cc275d560 Author: Konrad Dybcio Date: Tue May 20 22:14:46 2025 +0200 arm64: dts: qcom: x1p42100: Fix thermal sensor configuration The 8-core SKUs of the X1 family have a different sensor configuration. Override it to expose what the sensors really measure. Fixes: f08edb529916 ("arm64: dts: qcom: Add X1P42100 SoC and CRD") Tested-by: Jens Glathe Signed-off-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250520-topic-x1p4_tsens-v2-1-9687b789a4fb@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 779d1edd42e487fd85659983a7d2f98cd68096b3 Author: Pengyu Luo Date: Sun May 25 23:23:17 2025 +0800 arm64: dts: qcom: sm8650: remove unused reg <0 0x17a30000 0 0x10000> is unused for apps_rsc. Signed-off-by: Pengyu Luo Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250525152317.1378105-1-mitltlatltl@gmail.com Signed-off-by: Bjorn Andersson commit 6f018e1881fb3460870c7e50152886fc4b076495 Author: Krzysztof Kozlowski Date: Mon May 26 13:46:34 2025 +0200 arm64: dts: qcom: sm8750-qrd: Add sound (speakers, headset codec, dmics) Add device nodes for most of the sound support - WSA884x smart speakers, WCD9395 audio codec (headset) and sound card - which allows sound playback via speakers and recording via AMIC microphones. Changes bring necessary foundation for headset playback/recording via USB, but that part is not yet ready. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250526-sm8750-audio-part-2-v3-3-74429c686bb1@linaro.org Signed-off-by: Bjorn Andersson commit bd227f88faeb4cd9efc76f26c9ed91c058e6158a Author: Krzysztof Kozlowski Date: Mon May 26 13:46:33 2025 +0200 arm64: dts: qcom: sm8750-mtp: Add sound (speakers, headset codec, dmics) Add device nodes for most of the sound support - WSA883x smart speakers, WCD9395 audio codec (headset) and sound card - which allows sound playback via speakers and recording via DMIC microphones. Changes bring necessary foundation for headset playback/recording via USB, but that part is not yet ready. Reviewed-by: Konrad Dybcio Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250526-sm8750-audio-part-2-v3-2-74429c686bb1@linaro.org Signed-off-by: Bjorn Andersson commit 5b87cad934105e87f43de305122965444a36aecb Author: Krzysztof Kozlowski Date: Mon May 26 13:46:32 2025 +0200 arm64: dts: qcom: sm8750: Add Soundwire nodes Add Soundwire controllers on SM8750, fully compatible with earlier SM8650 generation. Reviewed-by: Konrad Dybcio Signed-off-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250526-sm8750-audio-part-2-v3-1-74429c686bb1@linaro.org Signed-off-by: Bjorn Andersson commit 0bc88e66b3a1e9086f786f1033a03867777a1104 Author: Jens Glathe Date: Tue Jun 10 19:25:41 2025 +0200 arm64: dts: qcom: x1e80100-hp-x14: amend order of nodes amend the order of pmk8550_* nodes afte pmc8380_* Signed-off-by: Jens Glathe Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250610-hp-x14-v3-3-35d5b50efae0@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit 8766cead89ff362fa19fa5fd93f6752bdf68c2c4 Author: Jens Glathe Date: Tue Jun 10 19:25:40 2025 +0200 arm64: dts: qcom: x1e80100-hp-x14: remove unused i2c buses At least from Linux, these buses are not in use. Remove them from the dt. Signed-off-by: Jens Glathe Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250610-hp-x14-v3-2-35d5b50efae0@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit b9137c58c737c928d71c3dd2bb3abc47abdd05b6 Author: Jens Glathe Date: Tue Jun 10 19:25:39 2025 +0200 arm64: dts: qcom: x1e80100-hp-x14: add usb-1-ss1-sbu-mux The usb_1_1 port doesn't have the PS8830 repeater, but apparently some MUX for DP altmode control. After a suggestion from sgerhold on '#aarch64-laptops' I added gpio-sbu-mux nodes from the x1e80100-QCP tree, and this appears to work well. It is still guesswork, but working guesswork. Added and rewired for usb_1_1 Signed-off-by: Jens Glathe Link: https://lore.kernel.org/r/20250610-hp-x14-v3-1-35d5b50efae0@oldschoolsolutions.biz Signed-off-by: Bjorn Andersson commit a509e7cf622bc7ce3f45b1c7047fc2a5e9bea869 Author: Al Viro Date: Sun Feb 23 22:21:55 2025 -0500 configfs: use DCACHE_DONTCACHE Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 82a3c881cde5af76ad700e744dac9ab3ba942d18 Author: Al Viro Date: Sun Feb 23 22:21:14 2025 -0500 debugfs: use DCACHE_DONTCACHE Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 38109b6554276a907ef8a047ff4d69eaadc31355 Author: Al Viro Date: Sun Feb 23 22:20:30 2025 -0500 efivarfs: use DCACHE_DONTCACHE instead of always_delete_dentry() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 61a4fa39a3326f37ce160dd2d77e1032f0caa8eb Author: Al Viro Date: Sun Feb 23 22:19:07 2025 -0500 9p: don't bother with always_delete_dentry just set DCACHE_DONTCACHE for "don't cache" mounts... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 3333ed35b83dc69aa678943da97b3dcc84d75aab Author: Al Viro Date: Sun Feb 23 22:14:47 2025 -0500 ramfs, hugetlbfs, mqueue: set DCACHE_DONTCACHE makes simple_lookup() slightly cheaper there - no need for simple_lookup() to set the flag and we want it on everything on those anyway. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 0b136e7d18fa8bb1251ab06f4f30e883da780245 Author: Al Viro Date: Sun Feb 23 20:59:01 2025 -0500 kill simple_dentry_operations No users left and anything that wants it would be better off just setting DCACHE_DONTCACHE in their ->s_d_flags. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit fe3c5120d6e32f73b5a4be2d14cb4839ce4116e0 Author: Al Viro Date: Sun Feb 23 20:55:05 2025 -0500 devpts, sunrpc, hostfs: don't bother with ->d_op Default ->d_op being simple_dentry_operations is equivalent to leaving it NULL and putting DCACHE_DONTCACHE into ->s_d_flags. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 3542920b91831974e3b9b3ce4bc083657a4f43d6 Author: Al Viro Date: Sun Feb 23 20:50:42 2025 -0500 shmem: no dentry retention past the refcount reaching zero Just set DCACHE_DONTCACHE in ->s_d_flags and be done with that. Dentries there live for as long as they are pinned; once the refcount hits zero, that's it. The same, of course, goes for other tree-in-dcache filesystems - more in the next commits... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit e95db51c81f54dd12ea465b5127e4786f62a1095 Author: Al Viro Date: Mon Feb 24 10:36:46 2025 -0500 d_alloc_parallel(): set DCACHE_PAR_LOOKUP earlier Do that before new dentry is visible anywhere. It does create a new possible state for dentries present in ->d_children/->d_sib - DCACHE_PAR_LOOKUP present, negative, unhashed, not in in-lookup hash chains, refcount positive. Those are going to be skipped by all tree-walkers (both d_walk() callbacks in fs/dcache.c and explicit loops over children/sibling lists elsewhere) and dput() is fine with those. NOTE: dropping the final reference to a "normal" in-lookup dentry (in in-lookup hash) is a bug - somebody must've forgotten to call d_lookup_done() on it and bad things will happen. With those it's OK; if/when we get around to making __dentry_kill() complain about such breakage, remember that predicate to check should *not* be just d_in_lookup(victim) but rather a combination of that with !hlist_bl_unhashed(&victim->d_u.d_in_lookup_hash). Might be worth considering later... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 691fb82ca6ccdcdb9e60e754b55659271d5280e7 Author: Al Viro Date: Sun Feb 23 20:18:15 2025 -0500 make d_set_d_op() static Convert the last user (d_alloc_pseudo()) and be done with that. Any out-of-tree filesystem using it should switch to d_splice_alias_ops() or, better yet, check whether it really needs to have ->d_op vary among its dentries. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit a97dc087da06b69ae976765d59810ca705e8dae1 Author: Al Viro Date: Sun Feb 23 20:04:30 2025 -0500 simple_lookup(): just set DCACHE_DONTCACHE No need to mess with ->d_op at all. Note that ->d_delete that always returns 1 is equivalent to having DCACHE_DONTCACHE in ->d_flags. Later the same thing will be placed into ->s_d_flags of the filesystems where we want that behaviour for all dentries; then the check in simple_lookup() will at least get unlikely() slapped on it. NOTE: there are only two filesystems where * simple_lookup() might be called * default ->d_op is non-NULL * its ->d_delete() doesn't always return 1 If not for those, we could have simple_lookup() just set DCACHE_DONTCACHE without even looking at ->d_op. Filesystems in question are btrfs and tracefs; both have ->d_delete() returning 1 on anything fed to simple_lookup(), so both would be fine with simple_lookup() setting DCACHE_DONTCACHE regardless of ->d_op. IOW, we might want to drop the check for ->d_op in simple_lookup(); it's definitely a separate story, though. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit d9b13cdad80dc11d74408cf201939a946e9303a6 Author: Steven Rostedt Date: Wed Jun 11 12:18:15 2025 -0400 tracefs: Add d_delete to remove negative dentries If a lookup in tracefs is done on a file that does not exist, it leaves a dentry hanging around until memory pressure removes it. But eventfs dentries should hang around as when their ref count goes to zero, it requires more work to recreate it. For the rest of the tracefs dentries, they hang around as their dentry is used as a descriptor for the tracing system. But if a file lookup happens for a file in tracefs that does not exist, it should be deleted. Add a .d_delete callback that checks if dentry->fsdata is set or not. Only eventfs dentries set fsdata so if it has content it should not be deleted and should hang around in the cache. Reported-by: Al Viro Signed-off-by: Steven Rostedt (Google) Signed-off-by: Al Viro commit 2fa8bf42c50582c7302918474aae8c52b59e7910 Author: Al Viro Date: Sun Feb 23 19:53:00 2025 -0500 set_default_d_op(): calculate the matching value for ->d_flags ... and store it in ->s_d_flags, to be used by __d_alloc() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit a3e65fa2e31ec529febce0c9c4946d4fcbd416bf Author: Al Viro Date: Sun Feb 23 15:39:26 2025 -0500 correct the set of flags forbidden at d_set_d_op() time DCACHE_OP_PRUNE in ->d_flags at the time of d_set_d_op() should've been treated the same as any other DCACHE_OP_... - we forgot to adjust that WARN_ON() when DCACHE_OP_PRUNE had been introduced... Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit a7d45bcfde3ce8aba7e1bd8b745a0eac68585b84 Author: Faizal Rahim Date: Mon May 19 03:19:11 2025 -0400 igc: add preemptible queue support in mqprio igc already supports enabling MAC Merge for FPE. This patch adds support for preemptible queues in mqprio. Tested preemption with mqprio by: 1. Enable FPE: ethtool --set-mm enp1s0 pmac-enabled on tx-enabled on verify-enabled on 2. Enable preemptible queue in mqprio: mqprio num_tc 4 map 0 1 2 3 0 0 0 0 0 0 0 0 0 0 0 0 \ queues 1@0 1@1 1@2 1@3 \ fp P P P E Signed-off-by: Faizal Rahim Reviewed-by: Simon Horman Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit 17643482e9ff7bd192cce5c46bbbf607f5b64573 Author: Faizal Rahim Date: Mon May 19 03:19:10 2025 -0400 igc: add preemptible queue support in taprio Changes: 1. Introduce tx_enabled flag to control preemptible queue. tx_enabled is set via mmsv module based on multiple factors, including link up/down status, to determine if FPE is active or inactive. 2. Add priority field to TXDCTL for express queue to improve data fetch performance. 3. Block preemptible queue setup in taprio unless reverse-tsn-txq-prio private flag is set. Encourages adoption of standard queue priority scheme for new features. 4. Hardware-padded frames from preemptible queues result in incorrect mCRC values, as padding bytes are excluded from the computation. Pad frames to at least 60 bytes using skb_padto() before transmission to ensure the hardware includes padding in the mCRC calculation. Tested preemption with taprio by: 1. Enable FPE: ethtool --set-mm enp1s0 pmac-enabled on tx-enabled on verify-enabled on 2. Enable private flag to reverse TX queue priority: ethtool --set-priv-flags enp1s0 reverse-txq-prio on 3. Enable preemptible queue in taprio: taprio num_tc 4 map 0 1 2 3 0 0 0 0 0 0 0 0 0 0 0 0 \ queues 1@0 1@1 1@2 1@3 \ fp P P P E Reviewed-by: Aleksandr Loktionov Co-developed-by: Chwee-Lin Choong Signed-off-by: Chwee-Lin Choong Signed-off-by: Faizal Rahim Reviewed-by: Simon Horman Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit e395f6a690d8e490049e87a777c7fd5e7f6f8c0e Author: Faizal Rahim Date: Mon May 19 03:19:09 2025 -0400 igc: add private flag to reverse TX queue priority in TSN mode By default, igc assigns TX hw queue 0 the highest priority and queue 3 the lowest. This is opposite of most NICs, where TX hw queue 3 has the highest priority and queue 0 the lowest. mqprio in igc already uses TX arbitration unconditionally to reverse TX queue priority when mqprio is enabled. The TX arbitration logic does not require a private flag, because mqprio was added recently and no known users depend on the default queue ordering, which differs from the typical convention. taprio does not use TX arbitration, so it inherits the default igc TX queue priority order. This causes tc command inconsistencies when configuring frame preemption with taprio compared to mqprio in igc. Other tc command inconsistencies and configuration issues already exist when using taprio on igc compared to other network controllers. These issues are described in a later section. To harmonize TX queue priority behavior between taprio and mqprio, and to fix these issues without breaking long-standing taprio use cases, this patch adds a new private flag, called reverse-tsn-txq-prio, to reverse the TX queue priority. It makes queue 3 the highest and queue 0 the lowest, reusing the TX arbitration logic already used by mqprio. Users must set the private flag when enabling frame preemption with taprio to follow the standard convention. Doing so promotes adoption of the correct priority model for new features while preserving compatibility with legacy configurations. This new private flag addresses: 1. Non-standard socket -> tc -> TX hw queue mapping for taprio in igc Without the private flag: - taprio maps (socket -> tc -> TX hardware queue) differently on igc compared to other network controllers - On igc, mqprio maps tc differently from taprio, since mqprio already uses TX arbitration The following examples compare taprio configuration on igc and other network controllers: a) On other NICs (TX hw queue 3 is highest priority): taprio num_tc 4 map 0 1 2 3 .... \ queues 1@0 1@1 1@2 1@3 Mapping translates to: socket 0 -> tc 0 -> queue 0 socket 3 -> tc 3 -> queue 3 This is the normal mapping that respects the standard convention: higher socket number -> higher tc -> higher priority TX hw queue b) On igc (TX hw queue 0 is highest priority by default): taprio num_tc 4 map 3 2 1 0 .... \ queues 1@0 1@1 1@2 1@3 Mapping translates to: socket 0 -> tc 3 -> queue 3 socket 3 -> tc 0 -> queue 0 This igc tc mapping example is based on Intel's TSN validation test case, where a higher socket priority maps to a higher priority queue. It respects the mapping: higher socket number -> higher priority TX hw queue but breaks the expected ordering: higher tc -> higher priority TX hw queue as defined in [Ref1]. This custom mapping complicates common taprio setup across NICs. 2. Non-standard frame preemption mapping for taprio in igc Without the private flag: - Compared to other network controllers, taprio on igc must flip the expected fp sequence, since express traffic is expected to map to the highest priority queue and preemptible traffic to lower ones - On igc, frame preemption configuration for mqprio differs from taprio, since mqprio already uses TX arbitration The following examples compare taprio frame preemption configuration on igc and other network controllers: a) On other NICs (TX hw queue 3 is highest priority): taprio num_tc 4 map ..... \ queues 1@0 1@1 1@2 1@3 \ fp P P P E Mapping translates to: tc0, tc1, tc2 -> preemptible -> queue 0, 1, 2 tc3 -> express -> queue 3 This is the normal mapping that respects the standard convention: higher tc -> express traffic -> higher priority TX hw queue lower tc -> preemptible traffic -> lower priority TX hw queue b) On igc (TX hw queue 0 is highest priority by default): taprio num_tc 4 map ...... \ queues 1@0 1@1 1@2 1@3 \ fp E P P P Mapping translates to: tc0 -> express -> queue 0 tc1, tc2, tc3 -> preemptible -> queue 1, 2, 3 This inversion respects the mapping of: express traffic -> higher priority TX hw queue but breaks the expected ordering: higher tc -> express traffic as defined in [Ref1] where higher tc indicates higher priority. In this case, the lower tc0 is assigned to express traffic. This custom mapping further complicates common preemption setup across NICs. Tests were performed on taprio with the following combinations, where two apps send traffic simultaneously on different queues: Private Flag Traffic Sent By Traffic Sent By ---------------------------------------------------------------- enabled iperf3 (queue 3) iperf3 (queue 0) disabled iperf3 (queue 0) iperf3 (queue 3) enabled iperf3 (queue 3) real-time app (queue 0) disabled iperf3 (queue 0) real-time app (queue 3) enabled real-time app (queue 3) iperf3 (queue 0) disabled real-time app (queue 0) iperf3 (queue 3) enabled real-time app (queue 3) real-time app (queue 0) disabled real-time app (queue 0) real-time app (queue 3) Private flag is controlled with: ethtool --set-priv-flags enp1s0 reverse-tsn-txq-prio [Ref1] IEEE 802.1Q clause 8.6.8 Transmission selection: "For a given Port and traffic class, frames are selected from the corresponding queue for transmission if and only if: ... b) For each queue corresponding to a numerically higher value of traffic class supported by the Port, the operation of the transmission selection algorithm supported by that queue determines that there is no frame available for transmission." Reviewed-by: Simon Horman Signed-off-by: Faizal Rahim Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit 650a2fe79538bd61d294b7041ed700316f025a32 Author: Faizal Rahim Date: Mon May 19 03:19:08 2025 -0400 igc: assign highest TX queue number as highest priority in mqprio Previously, TX arbitration prioritized queues based on the TC they were mapped to. A queue mapped to TC 3 had higher priority than one mapped to TC 0. To improve code reuse for upcoming patches and align with typical NIC behavior, this patch updates the logic to prioritize higher queue numbers when mqprio is used. As a result, queue 0 becomes the lowest priority and queue 3 becomes the highest. This patch also introduces igc_tsn_is_tc_to_queue_priority_ordered() to preserve the original TC-based priority rule and reject configurations where a higher TC maps to a lower queue offset. Reviewed-by: Simon Horman Signed-off-by: Faizal Rahim Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit 554ec5b1bd22058a3041b5173e3a123a0b959701 Author: Rob Herring (Arm) Date: Tue May 20 19:46:08 2025 -0500 dt-bindings: clock: Convert brcm,bcm63xx-clocks to DT schema Convert the Broadcom BCM63xx clock bindings to DT schema format. It's a straight forward conversion. Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250521004610.1791426-1-robh@kernel.org Signed-off-by: Stephen Boyd commit 358df002da77a431239582fa8741f594baaa83f1 Author: Sukrut Bellary Date: Fri May 16 01:16:12 2025 -0700 dt-bindings: clock: ti: add ti,autoidle.yaml reference ti,divider-clock uses properties from ti,autoidle. As we are converting autoidle binding to ti,autoidle.yaml, fix the reference here. Signed-off-by: Sukrut Bellary Link: https://lore.kernel.org/r/20250516081612.767559-4-sbellary@baylibre.com Reviewed-by: Rob Herring (Arm) Signed-off-by: Stephen Boyd commit a7953b62de55db784fd570931adf65ef834e1f39 Author: Sukrut Bellary Date: Fri May 16 01:16:11 2025 -0700 dt-bindings: clock: ti: Convert fixed-factor-clock to yaml This uses the ti,autoidle.yaml for clock autoidle support. Clean up the example to meet the current standards. Add the creator of the original binding as a maintainer. Signed-off-by: Sukrut Bellary Link: https://lore.kernel.org/r/20250516081612.767559-3-sbellary@baylibre.com Reviewed-by: Rob Herring (Arm) Signed-off-by: Stephen Boyd commit 5ffe2d2f53eb5c891a74c351346ff19726a4c4f8 Author: Sukrut Bellary Date: Fri May 16 01:16:10 2025 -0700 dt-bindings: clock: ti: Convert autoidle binding to yaml Autoidle clock is not an individual clock; it is always a derivate of some basic clock like a gate, divider, or fixed-factor. This binding will be referred in ti,divider-clock.yaml, and ti,fixed-factor-clock.yaml. As all clocks don't support the autoidle feature e.g., in DRA77xx/AM57xx[1], dpll_abe_x2* and dpll_per_x2 don't have autoidle, remove required properties from the binding. Add the creator of the original binding as a maintainer. [1] https://www.ti.com/lit/ug/spruhz6l/spruhz6l.pdf Signed-off-by: Sukrut Bellary Link: https://lore.kernel.org/r/20250516081612.767559-2-sbellary@baylibre.com Reviewed-by: Rob Herring (Arm) Signed-off-by: Stephen Boyd commit e35ba6d3c6c3464cf12da6fd0b6380c90af81d27 Author: Faizal Rahim Date: Mon May 19 03:19:07 2025 -0400 igc: refactor TXDCTL macros to use FIELD_PREP and GEN_MASK Refactor TXDCTL macro handling to use FIELD_PREP and GENMASK macros. This prepares the code for adding a new TXDCTL priority field in an upcoming patch. Verified that the macro values remain unchanged before and after refactoring. Reviewed-by: Simon Horman Signed-off-by: Faizal Rahim Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit 4cdb4ef8a9ff10b5ee829549561296b117a72bb1 Author: Faizal Rahim Date: Mon May 19 03:19:06 2025 -0400 igc: add DCTL prefix to related macros Rename macros to use the DCTL prefix for consistency with existing macros that reference the same register. This prepares for an upcoming patch that adds new fields to TXDCTL. Reviewed-by: Simon Horman Signed-off-by: Faizal Rahim Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit fe4d9e8394ff04af47cc3d040e03496d94916504 Author: Faizal Rahim Date: Mon May 19 03:19:05 2025 -0400 igc: move TXDCTL and RXDCTL related macros Move and consolidate TXDCTL and RXDCTL macros in preparation for upcoming TXDCTL changes. This improves organization and readability. Reviewed-by: Simon Horman Signed-off-by: Faizal Rahim Tested-by: Mor Bar-Gabay Signed-off-by: Tony Nguyen commit c5d02bbaa217b2454ba1ce7528113aa2ecf14f3c Author: Krzysztof Kozlowski Date: Thu Jun 5 19:36:09 2025 +0200 arm64: defconfig: Enable camcc and videocc on Qualcomm SM8450+ Enable the drivers for camera clock controllers on Qualcomm SM8550 and SM8650 SoC (enabled in all DTS files like SM8550-HDK or SM8650-HDK) and video clock controllers on Qualcomm SM8450 SoC (enabled in SM8450-HDK DTS). Signed-off-by: Krzysztof Kozlowski Reviewed-by: Neil Armstrong Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250605173608.217495-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit da7811bb0edbea0208800cfa16516a47b8d45747 Author: Max Shevchenko Date: Fri Jun 6 14:03:51 2025 +0300 ARM: dts: qcom: msm8960: use macros for interrupts Replace the raw values with macros. No changes to the output Tested-by: Rudraksha Gupta Signed-off-by: Max Shevchenko Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250606-msm8960-irq-macros-v1-1-03e573ba26d6@proton.me Signed-off-by: Bjorn Andersson commit c5ae936db72d0f45f1a85caa30780b716ac1b608 Author: Jeff Hugo Date: Tue Jun 10 11:59:12 2025 -0600 accel/qaic: Use dev_printk() in RAS pci_printk() was removed with commit 1c8a0ed2043c ("PCI: Remove unused pci_printk()") so change to using dev_printk(). Fixes: c11a50b170e7 ("accel/qaic: Add Reliability, Accessibility, Serviceability (RAS)") Reported-by: Stephen Rothwell Closes: https://lore.kernel.org/all/20250610124809.1e1ff0cd@canb.auug.org.au/ Signed-off-by: Jeff Hugo Reviewed-by: Troy Hanson Link: https://lore.kernel.org/r/20250610175912.2086773-1-jeff.hugo@oss.qualcomm.com commit f1c025773f257b534f6fa77dca29b0967dfed459 Author: Jiayuan Chen Date: Mon Jun 9 10:08:53 2025 +0800 selftests/bpf: Add test to cover ktls with bpf_msg_pop_data The selftest can reproduce an issue where using bpf_msg_pop_data() in ktls causes errors on the receiving end. Signed-off-by: Jiayuan Chen Signed-off-by: Daniel Borkmann Reviewed-by: John Fastabend Link: https://lore.kernel.org/bpf/20250609020910.397930-3-jiayuan.chen@linux.dev commit 178f6a5c8cb3b6be1602de0964cd440243f493c9 Author: Jiayuan Chen Date: Mon Jun 9 10:08:52 2025 +0800 bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls When sending plaintext data, we initially calculated the corresponding ciphertext length. However, if we later reduced the plaintext data length via socket policy, we failed to recalculate the ciphertext length. This results in transmitting buffers containing uninitialized data during ciphertext transmission. This causes uninitialized bytes to be appended after a complete "Application Data" packet, leading to errors on the receiving end when parsing TLS record. Fixes: d3b18ad31f93 ("tls: add bpf support to sk_msg handling") Reported-by: Cong Wang Signed-off-by: Jiayuan Chen Signed-off-by: Daniel Borkmann Reviewed-by: John Fastabend Acked-by: Jakub Kicinski Link: https://lore.kernel.org/bpf/20250609020910.397930-2-jiayuan.chen@linux.dev commit 47d8101924b58e03bfd065c972172e6b69331397 Author: Alice Ryhl Date: Tue Jun 10 10:31:56 2025 +0000 rust: vec: impl Default for Vec with any allocator The implementation of Default is restricted to only work with kmalloc vectors for no good reason. This means I have to use mem::replace(&mut my_vec, KVVec::new()) in Rust Binder instead of `mem::take(&mut my_vec)`. Thus, expand the impl of Default to work with any allocator including kvmalloc. Signed-off-by: Alice Ryhl Reviewed-by: Benno Lossin Link: https://lore.kernel.org/r/20250610-vec-default-v1-1-7bb2c97d75a0@google.com Signed-off-by: Danilo Krummrich commit 26ff87d2e776e10eb720138c5b5d334bceffc99f Author: Shekhar Chauhan Date: Fri Jun 6 00:38:04 2025 +0530 drm/xe/xe2_hpg: Define additional Xe2_HPG GMD_ID Add another GMD_ID for Xe2_HPG Signed-off-by: Shekhar Chauhan Signed-off-by: James Ausmus Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Tejas Upadhyay Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://lore.kernel.org/r/20250605190804.1287289-4-dnyaneshwar.bhadane@intel.com commit a5d221924e13a22c83b682410dcf72422d1c68db Author: Shekhar Chauhan Date: Fri Jun 6 00:38:03 2025 +0530 drm/xe/xe2_hpg: Add set of workarounds Add set of workarounds for xe2_hpg. -v2: Fix xe2_hpg GMD version for some workarounds. -v3: Removed extra Workaround (Matt Roper) Signed-off-by: Shekhar Chauhan Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://lore.kernel.org/r/20250605190804.1287289-3-dnyaneshwar.bhadane@intel.com commit 9b779ff0e1d1fa8a4e7d90405bcb902a1d5f4fe6 Author: Shekhar Chauhan Date: Fri Jun 6 00:38:02 2025 +0530 drm/xe/xe2_hpg: Add PCI IDs for xe2_hpg As per updated Bspec, Sync PCI IDs for BMG. Bspec: 68090 Signed-off-by: Shekhar Chauhan Signed-off-by: Dnyaneshwar Bhadane Reviewed-by: Tejas Upadhyay Reviewed-by: Matt Roper Signed-off-by: Matt Roper Link: https://lore.kernel.org/r/20250605190804.1287289-2-dnyaneshwar.bhadane@intel.com commit 1733432638f323d80ec3d6ba411794cc20e2465f Author: Anirudh Rayabharam (Microsoft) Date: Wed May 21 09:40:48 2025 +0000 firmware: smccc: Support both smc and hvc conduits for getting hyp UUID When Linux is running as the root partition under Microsoft Hypervisor (MSHV) a.k.a Hyper-V, smc is used as the conduit for smc calls. Extend arm_smccc_hypervisor_has_uuid() to support this usecase. Use arm_smccc_1_1_invoke to retrieve and use the appropriate conduit instead of supporting only hvc. Boot tested on MSHV guest, MSHV root & KVM guest. Signed-off-by: Anirudh Rayabharam (Microsoft) Reviewed-by: Sudeep Holla Tested-by: Roman Kisel Reviewed-by: Roman Kisel Message-Id: <20250521094049.960056-1-anirudh@anirudhrb.com> Signed-off-by: Sudeep Holla commit 6cafcc53eb5fffd9b9bdfde700bb9bad21e98ed3 Author: AngeloGioacchino Del Regno Date: Wed Jun 11 13:07:47 2025 +0200 spi: spi-mt65xx: Add support for MT6991 Dimensity 9400 SPI IPM Add support for the SPI IPM controller found in the MediaTek Dimensity 9400 (MT6991) SoC. As a note, this is the same SPI IPM Controller IP found on the MT8196 Kompanio counterpart. Signed-off-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250611110747.458090-2-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown commit 414145b4cf6c64831aa497f0ec6cc1ca2d76c1d2 Author: AngeloGioacchino Del Regno Date: Wed Jun 11 13:07:46 2025 +0200 spi: dt-bindings: mediatek,spi-mt65xx: Add support for MT6991/MT8196 SPI Add support for the SPI IPM controller found on MediaTek's MT6991 (Dimensity) and MT8196 (Kompanio) SoCs, with both having the same controller IP, hence being fully compatible with each other. Signed-off-by: AngeloGioacchino Del Regno Link: https://patch.msgid.link/20250611110747.458090-1-angelogioacchino.delregno@collabora.com Signed-off-by: Mark Brown commit a4eb71ff98c4792f441f108910bd829da7a04092 Author: Marek Vasut Date: Tue Jun 10 00:30:00 2025 +0200 regulator: rpi-panel-v2: Fix missing OF dependency Add missing OF dependency and drop of_match_ptr() use. This fixes the following LKP report: " >> drivers/regulator/rpi-panel-v2-regulator.c:95:34: warning: 'rpi_panel_v2_dt_ids' defined but not used [-Wunused-const-variable=] static const struct of_device_id rpi_panel_v2_dt_ids[] = { ^~~~~~~~~~~~~~~~~~~ " Fixes: d49305862fdc ("regulator: rpi-panel-v2: Add regulator for 7" Raspberry Pi 720x1280") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506100440.fyTGO7CG-lkp@intel.com/ Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20250609223012.87764-1-marek.vasut+renesas@mailbox.org Signed-off-by: Mark Brown commit 55d9fd9819de09e70401b3b5262ff46d5de951b7 Author: Matti Vaittinen Date: Tue Jun 10 08:32:06 2025 +0300 regulator: bd718x7: Clarify comment by moving it The BD718x7 needs to disable voltage monitoring for a duration of certain voltage changes. The comment explaining use of msleep(1) instead of a more accurate delay(), was placed to a function which disabled the protection. The actual sleeping is done in a different place of the code, after the voltage has been changed. Browsing through the comment and code after the years made me to scratch my head for a second. I may have figured why me and so many fellow developers are slowly getting bald. Clarify things a bit and move the comment about required delay directly above the sleep. Leave only a small comment explaining why the protection is disabled to the spot where the logic for disabling is. Signed-off-by: Matti Vaittinen Link: https://patch.msgid.link/a90cb77e66a253f4055bbb99672dc81c7457de66.1749533040.git.mazziesaccount@gmail.com Signed-off-by: Mark Brown commit d4db71038ff592aa4bc954d6bbd10be23954bb98 Merge: 19272b37aa4f83 ce3490038971a2 Author: Christian Brauner Date: Wed Jun 11 13:44:21 2025 +0200 Merge patch series "Minor cleanup preparation for some dir-locking API changes" NeilBrown says: The following 4 patches provide further cleanup that serves as preparation for some dir-locking API changes that I want to make. * patches from https://lore.kernel.org/20250608230952.20539-1-neil@brown.name: exportfs: use lookup_one_unlocked() coda: use iterate_dir() in coda_readdir() VFS: Minor fixes for porting.rst VFS: merge lookup_one_qstr_excl_raw() back into lookup_one_qstr_excl() Link: https://lore.kernel.org/20250608230952.20539-1-neil@brown.name Signed-off-by: Christian Brauner commit ce3490038971a205ca12ecadf0d67ef045fad508 Author: NeilBrown Date: Mon Jun 9 09:09:36 2025 +1000 exportfs: use lookup_one_unlocked() rather than locking the directory and using lookup_one(), just use lookup_one_unlocked(). This keeps locking code centralised. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250608230952.20539-5-neil@brown.name Reviewed-by: Chuck Lever Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit 8668a0df07a39b5d78076c4220ca8bedc23464e5 Author: NeilBrown Date: Mon Jun 9 09:09:35 2025 +1000 coda: use iterate_dir() in coda_readdir() The code in coda_readdir() is nearly identical to iterate_dir(). Differences are: - iterate_dir() is killable - iterate_dir() adds permission checking and accessing notifications I believe these are not harmful for coda so it is best to use iterate_dir() directly. This will allow locking changes without touching the code in coda. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250608230952.20539-4-neil@brown.name Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit e2a9a3d74a7633598357419257edf77c1fab3e4c Author: NeilBrown Date: Mon Jun 9 09:09:34 2025 +1000 VFS: Minor fixes for porting.rst This paragraph was relevant for an earlier version of the code which passed the qstr as a struct instead of a point. The version that landed passed the pointer in all cases so this para is now pointless. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250608230952.20539-3-neil@brown.name Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit 2b07a5af22b6e1e9d5b15ffedc1ed8d4b4ee4198 Author: NeilBrown Date: Mon Jun 9 09:09:33 2025 +1000 VFS: merge lookup_one_qstr_excl_raw() back into lookup_one_qstr_excl() The effect of lookup_one_qstr_excl_raw() can be achieved by passing LOOKUP_CREATE() to lookup_one_qstr_excl() - we don't need a separate function. Signed-off-by: NeilBrown Link: https://lore.kernel.org/20250608230952.20539-2-neil@brown.name Reviewed-by: Jeff Layton Signed-off-by: Christian Brauner commit 4e16a9a00239db5d819197b9a00f70665951bf50 Author: Emily Deng Date: Tue Jun 3 17:11:54 2025 +0800 drm/ttm: Should to return the evict error For the evict fail case, the evict error should be returned. v2: Consider ENOENT case. v3: Abort directly when the eviction failed for some reason (except for -ENOENT) and not wait for the move to finish Signed-off-by: Emily Deng Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/20250603091154.3472646-1-Emily.Deng@amd.com commit 9d4e26042c6094d4f1abc7a4e7f55e426641312b Author: Jani Nikula Date: Mon Jun 9 14:53:37 2025 +0300 drm/i915/display: drop i915_reg.h include where possible A number of files have unnecessary i915_reg.h includes. Drop them. Reviewed-by: Michał Grzelak Link: https://lore.kernel.org/r/7c4002322f4d8132fd2eaa1a4d688539cdd043c3.1749469962.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit fd585ee82c45ff90a962e678906787a7d2577c5a Author: Jani Nikula Date: Mon Jun 9 14:53:36 2025 +0300 drm/i915/display: include intel_display_reg_defs.h from display regs files Some display register files include i915_reg_defs.h, some don't include anything. Prefer intel_display_reg_defs.h in display. Reviewed-by: Michał Grzelak Link: https://lore.kernel.org/r/06c24e1f6a7a2f6b4801b0a079eec3cc924402a7.1749469962.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 9acb4d06fcb56edfb9bac0de705b4f295a18e932 Author: Louis-Alexis Eyraud Date: Mon May 26 12:45:27 2025 +0200 arm64: dts: mediatek: mt8395-genio-1200-evk: Enable Audio DSP and sound card Add in the mt8395-genio-1200-evk devicetree the memory regions for the Audio DSP (ADSP) and Audio Front-End (AFE), and a sound card node configured to use the ADSP. This enables audio output through the 3.5mm headphone jacks (speaker or earphone), available on the board. Signed-off-by: Louis-Alexis Eyraud Link: https://lore.kernel.org/r/20250526-mt8395-genio-1200-evk-sound-v1-1-142fb15292c5@collabora.com Signed-off-by: AngeloGioacchino Del Regno commit 5f105b2e49f71a98bf1d5b426ddc6f525a942b6b Author: Vivek Kasireddy Date: Wed Jun 4 22:42:47 2025 -0700 Revert "drm/xe/display: use xe->display to decide whether to do anything" This reverts commit 5a9f299f956ef9764f56044cfca7aafa23cea1d1. The following crash/regression was seen with the reverted commit on a specific BMG SKU with no display capabilities: [ 115.582833] BUG: kernel NULL pointer dereference, address: 00000000000005d0 [ 115.589775] #PF: supervisor write access in kernel mode [ 115.594976] #PF: error_code(0x0002) - not-present page [ 115.600088] PGD 0 P4D 0 [ 115.602617] Oops: Oops: 0002 [#1] SMP [ 115.606267] CPU: 14 UID: 0 PID: 1547 Comm: kworker/14:3 Tainted: G U E 6.15.0-local+ #62 PREEMPT(voluntary) [ 115.617332] Tainted: [U]=USER, [E]=UNSIGNED_MODULE [ 115.622100] Hardware name: Intel Corporation Meteor Lake Client Platform/MTL-P DDR5 SODIMM SBS RVP, BIOS MTLPEMI1.R00.3471.D49.2401260852 01/26/2024 [ 115.635314] Workqueue: pm pm_runtime_work [ 115.639309] RIP: 0010:_raw_spin_lock+0x17/0x30 [ 115.662382] RSP: 0018:ffffd13f82e7bc30 EFLAGS: 00010246 [ 115.667581] RAX: 0000000000000000 RBX: ffff8be919076000 RCX: 0000000000000002 [ 115.674675] RDX: 0000000000000001 RSI: 000000000000004b RDI: 00000000000005d0 [ 115.681775] RBP: ffffd13f82e7bc60 R08: ffffd13f82e7bb00 R09: ffff8beb0c1b06c0 [ 115.688869] R10: ffff8be7c034f4c0 R11: fefefefefefefeff R12: fffffffffffffff0 [ 115.695965] R13: ffff8be9190762e8 R14: ffff8be919077798 R15: 00000000000005d0 [ 115.703062] FS: 0000000000000000(0000) GS:ffff8beb552b6000(0000) knlGS:0000000000000000 [ 115.711106] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 115.716826] CR2: 00000000000005d0 CR3: 000000024c68d002 CR4: 0000000000f72ef0 [ 115.723921] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 115.731015] DR3: 0000000000000000 DR6: 00000000ffff07f0 DR7: 0000000000000400 [ 115.738113] PKRU: 55555554 [ 115.740816] Call Trace: [ 115.743258] [ 115.745363] ? xe_display_flush_cleanup_work+0x92/0x120 [xe] [ 115.751102] xe_display_pm_runtime_suspend+0x42/0x80 [xe] [ 115.756542] xe_pm_runtime_suspend+0x11b/0x1b0 [xe] [ 115.761463] xe_pci_runtime_suspend+0x23/0xd0 [xe] [ 115.766291] pci_pm_runtime_suspend+0x6b/0x1a0 [ 115.770717] ? pci_pm_thaw_noirq+0xa0/0xa0 [ 115.774797] __rpm_callback+0x48/0x1e0 [ 115.778531] ? pci_pm_thaw_noirq+0xa0/0xa0 [ 115.782614] rpm_callback+0x66/0x70 [ 115.786090] ? pci_pm_thaw_noirq+0xa0/0xa0 [ 115.790173] rpm_suspend+0xe1/0x5e0 [ 115.793647] ? psi_task_switch+0xb8/0x200 [ 115.797643] ? finish_task_switch.isra.0+0x8d/0x270 [ 115.802502] pm_runtime_work+0xa6/0xc0 [ 115.806238] process_one_work+0x186/0x350 [ 115.810234] worker_thread+0x33a/0x480 [ 115.813968] ? process_one_work+0x350/0x350 [ 115.818132] kthread+0x10c/0x220 [ 115.821350] ? kthreads_online_cpu+0x120/0x120 [ 115.825774] ret_from_fork+0x3a/0x60 [ 115.829339] ? kthreads_online_cpu+0x120/0x120 [ 115.833768] ret_from_fork_asm+0x11/0x20 [ 115.829339] ? kthreads_online_cpu+0x120/0x120 [ 115.833768] ret_from_fork_asm+0x11/0x20 [ 115.837680] [ 115.839907] acpi_tad(E) drm(E) [ 115.931629] CR2: 00000000000005d0 [ 115.934935] ---[ end trace 0000000000000000 ]--- [ 115.939531] RIP: 0010:_raw_spin_lock+0x17/0x30 We cannot yet use xe->display to determine whether display hardware has been successfully probed/initialized or not. This is because xe->display would not be set to NULL even with GPUs with no display capabilities (e.g, GMD_ID_DISPLAY = 0). However, this might change in the future as Xe and i915 code is unified to deal with no display cases. Therefore, for now we have to continue to rely on xe->info.probe_display (which would be set to false with display-less GPUs) to decide whether to invoke any display related functions or not. Cc: Jani Nikula Cc: Matt Roper Cc: Lucas De Marchi Signed-off-by: Vivek Kasireddy Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250605054247.386633-1-vivek.kasireddy@intel.com Signed-off-by: Jani Nikula commit 9066d0b017a276f1edd5f3972885ebb95ac661ad Author: Chen-Yu Tsai Date: Thu Apr 24 18:25:07 2025 +0800 arm64: dts: mediatek: mt8192-asurada: Reserve memory for audio frontend Some MediaTek platforms already reserve a small block of memory for the audio frontend. These platforms reserve it at a fixed address, though it is unclear if that is due to hardware access restrictions or simply compacting the reserved memory blocks together. Reserve the same size of memory on the MT8192 Asurada family as well, to align with the other MediaTek-based ChromeOS platforms. Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250424102509.1083185-14-wenst@chromium.org Signed-off-by: AngeloGioacchino Del Regno commit 4f7de95eeebe2e1c68c9b92c7d50e88928976092 Author: Chen-Yu Tsai Date: Thu Apr 24 18:25:06 2025 +0800 arm64: dts: mediatek: mt8186-corsola: Reserve memory for audio frontend Some MediaTek platforms already reserve a small block of memory for the audio frontend. These platforms reserve it at a fixed address, though it is unclear if that is due to hardware access restrictions or simply compacting the reserved memory blocks together. Reserve the same size of memory on the MT8186 Corsola family as well, to align with the other MediaTek-based ChromeOS platforms. This also helps with memory starvation as these devices sometimes end up in low memory conditions. Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250424102509.1083185-13-wenst@chromium.org Signed-off-by: AngeloGioacchino Del Regno commit 938dfa850d9a88d74cc45a01639085ca748b303b Author: Chen-Yu Tsai Date: Thu Apr 24 18:25:05 2025 +0800 arm64: dts: mediatek: mt8183-kukui: Reserve memory for audio frontend Some MediaTek platforms already reserve a small block of memory for the audio frontend. These platforms reserve it at a fixed address, though it is unclear if that is due to hardware access restrictions or simply compacting the reserved memory blocks together. Reserve the same size of memory on the MT8183 Kukui & Jacuzzi families as well, to align with the other MediaTek-based ChromeOS platforms. This also helps with memory starvation as these devices commonly end up in low memory conditions. Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250424102509.1083185-12-wenst@chromium.org Signed-off-by: AngeloGioacchino Del Regno commit 94351a2d993e333855b1c5102d4c4d8a19c172bb Author: Chen-Yu Tsai Date: Thu Apr 24 18:25:04 2025 +0800 arm64: dts: mediatek: mt8173: Reserve memory for audio frontend Some MediaTek platforms already reserve a small block of memory for the audio frontend. These platforms reserve it at a fixed address, though it is unclear if that is due to hardware access restrictions or simply compacting the reserved memory blocks together. Reserve the same size of memory on the MT8173 as well, to align with the other platforms. This also helps with memory starvation as these devices commonly end up in low memory conditions. Signed-off-by: Chen-Yu Tsai Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250424102509.1083185-11-wenst@chromium.org Signed-off-by: AngeloGioacchino Del Regno commit cd267cdef5fe98006a6b989c5cda035032bb839f Merge: 19272b37aa4f83 7f4f229195b736 Author: Christian Brauner Date: Wed Jun 11 11:59:13 2025 +0200 Merge patch series "nsfs: expose the stable inode numbers in a public header" Christian Brauner says: Userspace heavily relies on the root inode numbers for namespaces to identify the initial namespaces. That's already a hard dependency. So we cannot change that anymore. Move the initial inode numbers to a public header and align the only two namespaces that currently don't do that with all the other namespaces. * patches from https://lore.kernel.org/20250606-work-nsfs-v1-0-b8749c9a8844@kernel.org: mntns: use stable inode number for initial mount ns netns: use stable inode number for initial mount ns nsfs: move root inode number to uapi Link: https://lore.kernel.org/20250606-work-nsfs-v1-0-b8749c9a8844@kernel.org Signed-off-by: Christian Brauner commit 7f4f229195b73606ded77e56943f463b78adf635 Author: Christian Brauner Date: Fri Jun 6 11:45:09 2025 +0200 mntns: use stable inode number for initial mount ns Apart from the network and mount namespace all other namespaces expose a stable inode number and userspace has been relying on that for a very long time now. It's very much heavily used API. Align the mount namespace and use a stable inode number from the reserved procfs inode number space so this is consistent across all namespaces. Link: https://lore.kernel.org/20250606-work-nsfs-v1-3-b8749c9a8844@kernel.org Signed-off-by: Christian Brauner commit 9b0240b3ccc325c7a96cf362877180bc9e10d546 Author: Christian Brauner Date: Fri Jun 6 11:45:08 2025 +0200 netns: use stable inode number for initial mount ns Apart from the network and mount namespace all other namespaces expose a stable inode number and userspace has been relying on that for a very long time now. It's very much heavily used API. Align the network namespace and use a stable inode number from the reserved procfs inode number space so this is consistent across all namespaces. Link: https://lore.kernel.org/20250606-work-nsfs-v1-2-b8749c9a8844@kernel.org Reviewed-by: Jakub Kicinski Signed-off-by: Christian Brauner commit 6a9e2fb1bab53b54d02714a2ee3c6612d19629ce Author: Christian Brauner Date: Fri Jun 6 11:45:07 2025 +0200 nsfs: move root inode number to uapi Userspace relies on the root inode numbers to identify the initial namespaces. That's already a hard dependency. So we cannot change that anymore. Move the initial inode numbers to a public header. Link: https://github.com/systemd/systemd/commit/d293fade24b34ccc2f5716b0ff5513e9533cf0c4 Link: https://lore.kernel.org/20250606-work-nsfs-v1-1-b8749c9a8844@kernel.org Signed-off-by: Christian Brauner commit 2c31ec923c323229566d799267000f8123af4449 Author: Kerem Karabay Date: Tue May 27 22:13:17 2025 +0530 HID: multitouch: add device ID for Apple Touch Bar This patch adds the device ID of Apple Touch Bar found on x86 MacBook Pros to the hid-multitouch driver. Note that this is device ID is for T2 Macs. Testing on T1 Macs would be appreciated. Signed-off-by: Kerem Karabay Co-developed-by: Aditya Garg Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 45ca23c5ee8b2b3074377fecc92fa72aa595f7c9 Author: Kerem Karabay Date: Tue May 27 22:13:16 2025 +0530 HID: multitouch: specify that Apple Touch Bar is direct Currently the driver determines the device type based on the application, but this value is not reliable on Apple Touch Bar, where the application is HID_DG_TOUCHPAD even though this device is direct, so add a quirk for the same. Acked-by: Benjamin Tissoires Signed-off-by: Kerem Karabay Co-developed-by: Aditya Garg Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 7dfe48bdc9d38db46283f2e0281bc1626277b8bf Author: Kerem Karabay Date: Tue May 27 22:13:15 2025 +0530 HID: multitouch: take cls->maxcontacts into account for Apple Touch Bar even without a HID_DG_CONTACTMAX field In Apple Touch Bar, the HID_DG_CONTACTMAX is not present, but the maximum contact count is still greater than the default. Add quirks for the same. Acked-by: Benjamin Tissoires Signed-off-by: Kerem Karabay Co-developed-by: Aditya Garg Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit e0976a61a543b5e03bc0d08030a0ea036ee3751d Author: Kerem Karabay Date: Tue May 27 22:13:14 2025 +0530 HID: multitouch: support getting the tip state from HID_DG_TOUCH fields in Apple Touch Bar In Apple Touch Bar, the tip state is contained in fields with the HID_DG_TOUCH usage. This feature is gated by a quirk in order to prevent breaking other devices, see commit c2ef8f21ea8f ("HID: multitouch: add support for trackpads"). Acked-by: Benjamin Tissoires Signed-off-by: Kerem Karabay Co-developed-by: Aditya Garg Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit f41d736acc039d86512951f4e874b0f5e666babf Author: Kerem Karabay Date: Tue May 27 22:13:13 2025 +0530 HID: multitouch: Get the contact ID from HID_DG_TRANSDUCER_INDEX fields in case of Apple Touch Bar In Apple Touch Bar, the contact ID is contained in fields with the HID_DG_TRANSDUCER_INDEX usage rather than HID_DG_CONTACTID, thus differing from the HID spec. Add a quirk for the same. Acked-by: Benjamin Tissoires Signed-off-by: Kerem Karabay Co-developed-by: Aditya Garg Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit b01f2d9597250e9c4011cb78d8d46287deaa6a69 Author: wang wei Date: Thu Jun 5 23:29:31 2025 +0800 sched/eevdf: Correct the comment in place_entity Correct "l" to "vl_i". Signed-off-by: wang wei Signed-off-by: Peter Zijlstra (Intel) Link: https://lkml.kernel.org/r/20250605152931.22804-1-a929244872@163.com commit 3d7e10188ae0b68dadd60f611ca81ecf9d991f77 Author: Peter Zijlstra Date: Fri May 23 18:26:21 2025 +0200 sched: Make clangd usable Due to the weird Makefile setup of sched the various files do not compile as stand alone units. The new generation of editors are trying to do just this -- mostly to offer fancy things like completions but also better syntax highlighting and code navigation. Specifically, I've been playing around with neovim and clangd. Setting up clangd on the kernel source is a giant pain in the arse (this really should be improved), but once you do manage, you run into dumb stuff like the above. Fix up the scheduler files to at least pretend to work. Signed-off-by: Peter Zijlstra (Intel) Acked-by: Ingo Molnar Tested-by: Juri Lelli Link: https://lkml.kernel.org/r/20250523164348.GN39944@noisy.programming.kicks-ass.net commit 1a2ad59da68dd294f994efbf68c5d671f6b42fad Author: Martin Kepplinger-Novaković Date: Thu May 8 10:18:02 2025 +0000 arm64: dts: imx8mp: Enable gpu passive throttling Hook up the gpu as a passive cooling device to the thermal zones' alert trip point just like the cpu. The gpu here consists of 3D GPU, 2D GPU and NPU. One way to test would be to set one "alert" trip point low enough and watch the cooling device state increase: echo 10000 > /sys/class/thermal/thermal_zone0/trip_point_0_temp watch cat /sys/class/thermal/cooling_device*/cur_state And of course set the trip point back to its original value and watch the cooling device states jump to 0 again. Signed-off-by: Martin Kepplinger-Novaković Signed-off-by: Shawn Guo commit 6e3a1433fa41e9b321ff66253501ba22aad26c0f Author: Jani Nikula Date: Fri Jun 6 12:05:12 2025 +0300 drm/i915/panel: sync panel prepared state at register If the panel is enabled at probe, and we take over the hardware state, the drm_panel prepared state will be out of sync. We'll need to notify drm_panel framework about the state at probe, so it can in turn notify the panel followers. Cc: Lee Shawn C Tested-by: Lee Shawn C Reviewed-by: Arun R Murthy Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/a33e4fe5e9970aed9c4aef8c426c00a189149c32.1749199013.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 3fdd5bfbd6381e4acf86ee1d00a87d49fd39fdc6 Author: Jani Nikula Date: Fri Jun 6 12:05:11 2025 +0300 drm/i915/panel: register drm_panel and call prepare/unprepare for ICL+ DSI Allocate and register a drm_panel so that drm_panel_followers can find the panel. Pass the drm_connector::kdev device to drm_panel allocation for matching. That's only available after drm_sysfs_connector_add(), so we need to postpone the drm_panel allocation until .late_register() hook. The drm_panel framework is moving towards devm_drm_panel_alloc(). It requires a wrapper struct, and struct intel_panel would be the natural candidate. However, we can't postpone its allocation until .late_register(), so we have to use __devm_drm_panel_alloc() directly for now. Call the drm_panel_prepare() and drm_panel_unprepare() functions for ICL+ DSI, so that followers get notified of the panel power state changes. This can later be expanded to VLV+ DSI and eDP. Cc: Maxime Ripard Cc: Heikki Krogerus Cc: Lee Shawn C Tested-by: Lee Shawn C Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/13d15c1414e65ffb21944d66e2820befdab54e98.1749199013.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 421ae44b53913510acc3cc023f06fbb7d0f4e8ef Author: Jani Nikula Date: Fri Jun 6 12:05:10 2025 +0300 drm/i915/panel: add panel register/unregister Add panel register/unregister functions, and handle backlight register/unregister from there. This is in preparation for adding more panel specific register/unregister functionality. Cc: Lee Shawn C Tested-by: Lee Shawn C Reviewed-by: Arun R Murthy Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/b737d4bc8b91df630cd4db4648f3a3571989cfd8.1749199013.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit da8f2708f9b69707f4efeb432a18395e46b4666f Author: Jelle van der Waa Date: Wed May 14 22:10:52 2025 +0200 platform/x86: ideapad: Expose charge_types Some Ideapad models support a battery conservation mode which limits the battery charge threshold for longer battery longevity. This is currently exposed via a custom conservation_mode attribute in sysfs. The newly introduced charge_types sysfs attribute is a standardized replacement for laptops with a fixed end charge threshold. Setting it to `Long Life` would enable battery conservation mode. The standardized user space API would allow applications such as UPower to detect laptops which support this battery longevity mode and set it. Tested on an Lenovo ideapad U330p. Signed-off-by: Jelle van der Waa Suggested-By: Hans de Goede Reviewed-by: Thomas Weißschuh Reviewed-by: Armin Wolf Link: https://lore.kernel.org/r/20250514201054.381320-1-jvanderwaa@redhat.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 42e4327e3d126266424a4fde60f80897bd7605ae Merge: 19272b37aa4f83 20e62271fbc802 Author: Andy Shevchenko Date: Wed Jun 11 11:27:32 2025 +0300 Merge patch series "pinctrl: intel: use new GPIO line value setter callbacks" Bartosz Golaszewski says: Commit 98ce1eb1fd87e ("gpiolib: introduce gpio_chip setters that return values") added new line setter callbacks to struct gpio_chip. They allow to indicate failures to callers. We're in the process of converting all GPIO controllers to using them before removing the old ones. This series converts all GPIO chips in intel pin control drivers. Link: https://lore.kernel.org/r/20250610-gpiochip-set-rv-pinctrl-intel-v1-0-d7a773ff864e@linaro.org Signed-off-by: Andy Shevchenko commit 20e62271fbc80290f543579f3ba8149805d8e06c Author: Bartosz Golaszewski Date: Tue Jun 10 14:58:50 2025 +0200 pinctrl: lynxpoint: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 241d79f02538fa19ad3441d27c0ee9e18aa9fd3b Author: Bartosz Golaszewski Date: Tue Jun 10 14:58:49 2025 +0200 pinctrl: intel: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 83ab731cb26b5ec3a37be6a672e0b3bdc0ae84c7 Author: Bartosz Golaszewski Date: Tue Jun 10 14:58:48 2025 +0200 pinctrl: cherryview: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 4863d750fdc0d29b68530355b216dfc6d7b52c9a Author: Bartosz Golaszewski Date: Tue Jun 10 14:58:47 2025 +0200 pinctrl: baytrail: use new GPIO line value setter callbacks struct gpio_chip now has callbacks for setting line values that return an integer, allowing to indicate failures. Convert the driver to using them. Signed-off-by: Bartosz Golaszewski Acked-by: Mika Westerberg Signed-off-by: Andy Shevchenko commit 2a6885e1867242ae112c2b68231c78ce9f62e6f0 Author: Carlos Song Date: Sun Apr 27 16:32:30 2025 +0800 arm64: dts: imx95: correct i3c node in imx95 I.MX95 I3C only need two clocks so add clock fix. Add "nxp,imx95-i3c" compatible string for all imx95 i3c nodes. Signed-off-by: Carlos Song Signed-off-by: Shawn Guo commit 946540a02e903e3b749f535c86d59ac4640faa20 Author: Jani Nikula Date: Tue Jun 10 12:41:32 2025 +0300 drm/panel: use fwnode based lookups for panel followers Use firmware node based lookups for panel followers, to make the code independent of OF and device tree, and make it work also for ACPI with an appropriate _DSD. ASL example: Package (0x02) { "panel", \_SB.PCI0.GFX0.LCD0 } v2: - Update comments (Doug, Arun) - s/IS_ERR_OR_NULL/IS_ERR/ (Doug) Suggested-by: Heikki Krogerus Cc: Neil Armstrong Cc: Jessica Zhang Cc: Maxime Ripard Cc: Doug Anderson Cc: Lee Shawn C Tested-by: Lee Shawn C Reviewed-by: Douglas Anderson Tested-by: Douglas Anderson Reviewed-by: Arun R Murthy Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250610094132.3240567-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 651b57dd40871d4d0d61fb291e7f26e2b8bd69b1 Author: Mark Pearson Date: Tue Jun 10 15:28:25 2025 -0400 platform/x86: Move Lenovo files into lenovo subdir Create lenovo subdirectory for holding Lenovo specific drivers. Signed-off-by: Mark Pearson Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250610192830.1731454-2-mpearson-lenovo@squebb.ca [ij: put depends on DMI back, fix trailing empty lines.] Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit fe6859aa646b9463379985165f602a44cf25c8ad Author: Mark Pearson Date: Tue Jun 10 15:28:24 2025 -0400 platform/x86: thinklmi: improved DMI handling Fix issues reported by kernel test robot. - Require DMI for think-lmi. - Check return from getting serial string Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506062319.F0IpDxF6-lkp@intel.com/ Signed-off-by: Mark Pearson Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20250610192830.1731454-1-mpearson-lenovo@squebb.ca Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 097cd6d6c90cc90410ab03b287166838ea71d41e Author: Dr. David Alan Gilbert Date: Sun Jun 8 02:25:12 2025 +0100 platform/x86: intel_telemetry: Remove unused telemetry_raw_read_events() telemetry_raw_read_events() was added by the commit 378f956e3f93 ("platform/x86: Add Intel Telemetry Core Driver") in 2016 but has remained unused. Remove it. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250608012512.377134-4-linux@treblig.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit b35b9fb28c85ccee43c34768c5e2d9a5c510e660 Author: Dr. David Alan Gilbert Date: Sun Jun 8 02:25:11 2025 +0100 platform/x86: intel_telemetry: Remove unused telemetry_[gs]et_sampling_period() The functions: - telemetry_get_sampling_period() - telemetry_set_sampling_period() were both added by the commit 378f956e3f93 ("platform/x86: Add Intel Telemetry Core Driver") in 2016 but have remained unused. They're each a tiny wrapper that is the only caller through a similarly named function pointer, and for each function pointer there's a 'def' empty implementation and a plt implementation. Remove all of those components for each function. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250608012512.377134-3-linux@treblig.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 3dd1e9c2a279cbc9c6a7f1e7961df08c76ecb464 Author: Dr. David Alan Gilbert Date: Sun Jun 8 02:25:10 2025 +0100 platform/x86: intel_telemetry: Remove unused telemetry_*_events() The functions: - telemetry_add_events() - telemetry_update_events() - telemetry_reset_events() - telemetry_get_eventconfig() were all added by the commit 378f956e3f93 ("platform/x86: Add Intel Telemetry Core Driver") in 2016 but have remained unused. They're each a tiny wrapper that is the only caller through a similarly named function pointer, and for each function pointer there's a 'def' empty implementation and a plt implementation. Remove all of those components for each function. Signed-off-by: Dr. David Alan Gilbert Link: https://lore.kernel.org/r/20250608012512.377134-2-linux@treblig.org Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit edcc9d24fb8ece4e704f352f53733ea44986732b Author: Thomas Zimmermann Date: Tue Jun 10 09:28:55 2025 +0200 drm/arm/hdlcd: Replace struct simplefb_format with custom type Map DRM FourCC codes to pixel descriptions with an internal struct type. Avoid simplefb's struct simplefb_format, which is for parsing "simple-framebuffer" DT nodes. Drop the unsupported formats with alpha channel from the list. The HDLCD drivers uses struct simplefb_format and its default initializer SIMPLEFB_FORMATS to map DRM_FORMAT_ constants to pixel descriptions. The simplefb helpers are for parsing "simple-framebuffer" DT nodes and should be avoided in other context. Therefore replace it in hdlcd with a custom struct type and pixel descriptions from PIXEL_FORMAT_ constants. This change also removes including , which includes several unrelated headers, such as . v2: - drop unsupported alpha formats (Liviu) - keep original sorting of formats (Javier) - use anonymous type for supported_formats Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Reviewed-by: Liviu Dudau Link: https://lore.kernel.org/r/20250610073027.322944-1-tzimmermann@suse.de commit c598d5eb9fb331ba17bc9ad67ae9a2231ca5aca5 Merge: 29a9b3a504c0d1 19272b37aa4f83 Author: Thomas Zimmermann Date: Wed Jun 11 09:01:34 2025 +0200 Merge drm/drm-next into drm-misc-next Backmerging to forward to v6.16-rc1 Signed-off-by: Thomas Zimmermann commit 90e9de1d0921083a5f0be8bd748a796204fcacaa Author: Willie Thai Date: Tue Apr 1 15:39:55 2025 +0000 ARM: dts: aspeed: Add device tree for Nvidia's GB200NVL BMC The GB200NVL BMC is an Aspeed Ast2600 based BMC [1] for Nvidia Blackwell GB200NVL platform [2]. Co-developed-by: Mars Yang Signed-off-by: Mars Yang Reviewed-by: Andrew Lunn Cc: Krzysztof Kozlowski Cc: Rob Herring Cc: Paul Menzel Cc: Andrew Jeffery Link: https://www.aspeedtech.com/server_ast2600/ [1] Link: https://nvdam.widen.net/s/wwnsxrhm2w/blackwell-datasheet-3384703 [2] Signed-off-by: Willie Thai Link: https://patch.msgid.link/20250401153955.314860-3-wthai@nvidia.com [arj: tidy commit message] Signed-off-by: Andrew Jeffery commit 2f0f9cc149f557c06baeb66a87fa5ed11bf04cde Author: Willie Thai Date: Tue Apr 1 15:39:54 2025 +0000 dt-bindings: arm: aspeed: add Nvidia's GB200NVL BMC Add Nvidia's GB200NVL BMC board compatible. Co-developed-by: Mars Yang Signed-off-by: Mars Yang Signed-off-by: Willie Thai Acked-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250401153955.314860-2-wthai@nvidia.com Signed-off-by: Andrew Jeffery commit 373d9b5989e0e47f3d2d6136b579be4ac787a083 Author: Potin Lai Date: Fri Mar 21 15:26:11 2025 +0800 ARM: dts: aspeed: catalina: Enable MCTP support for NIC management Add the `mctp-controller` property and MCTP nodes to enable support for backend NIC management via PLDM over MCTP. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250321-potin-catalina-dts-update-20250102-v6-10-4bd85efeb9b4@gmail.com Signed-off-by: Andrew Jeffery commit aadc4c3ddd1e4b27c66b49296da706ab77b4ab8d Author: Potin Lai Date: Fri Mar 21 15:26:10 2025 +0800 ARM: dts: aspeed: catalina: Update CBC FRU EEPROM I2C bus and address Revise the I2C bus and address for the Cable Backplane Cartridge (CBC) FRU EEPROM in the Catalina device tree. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250321-potin-catalina-dts-update-20250102-v6-9-4bd85efeb9b4@gmail.com Signed-off-by: Andrew Jeffery commit df89538262c5af1ee86619a4200533c238ffbd73 Author: Potin Lai Date: Fri Mar 21 15:26:09 2025 +0800 ARM: dts: aspeed: catalina: Enable multi-master on additional I2C buses Update the device tree to enable `multi-master` mode on I2C buses shared between the host BMC and the NV module with HMC. This ensures proper bus arbitration and coordination in multi-master environments, preventing communication conflicts and improving reliability. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250321-potin-catalina-dts-update-20250102-v6-8-4bd85efeb9b4@gmail.com Signed-off-by: Andrew Jeffery commit 8f58b439c4514aa9735a9becdff52f13c172194f Author: Potin Lai Date: Fri Mar 21 15:26:08 2025 +0800 ARM: dts: aspeed: catalina: Remove INA238 and INA230 nodes Remove INA238 and INA230 power sensor nodes from the device tree (DTS) due to incompatibility with the second-source ISL28022, which shares the same I2C address. Move the driver probe to userspace to handle sensor dynamically. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250321-potin-catalina-dts-update-20250102-v6-7-4bd85efeb9b4@gmail.com Signed-off-by: Andrew Jeffery commit f2919835b87e4d972f34451cef365c5e335542a4 Author: Potin Lai Date: Fri Mar 21 15:26:07 2025 +0800 ARM: dts: aspeed: catalina: Add second source HSC node support Add device tree nodes for the XDP710 Hot-Swap Controller (HSC) to support the Power Distribution Board (PDB) with a second-source configuration. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250321-potin-catalina-dts-update-20250102-v6-6-4bd85efeb9b4@gmail.com Signed-off-by: Andrew Jeffery commit 8c2d9fc0329368817264d8aa65670c1941d39ec9 Author: Potin Lai Date: Fri Mar 21 15:26:06 2025 +0800 ARM: dts: aspeed: catalina: Add second source fan controller support Add device tree nodes for the NCT7363 fan controllers on the second-source Power Distribution Board (PDB). Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250321-potin-catalina-dts-update-20250102-v6-5-4bd85efeb9b4@gmail.com Signed-off-by: Andrew Jeffery commit ebd7b3c42ffadaa5c34774a6dfac80476ad115e9 Author: Potin Lai Date: Fri Mar 21 15:26:05 2025 +0800 ARM: dts: aspeed: catalina: Add fan controller support Add device tree nodes for the MAX31790 fan controllers on the Power Distribution Board (PDB). These nodes enable fan speed control and monitoring, improving thermal management and system reliability. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250321-potin-catalina-dts-update-20250102-v6-4-4bd85efeb9b4@gmail.com Signed-off-by: Andrew Jeffery commit d276bb9fb5b60e029a7c54b1701cf238acd7c5c3 Author: Potin Lai Date: Fri Mar 21 15:26:04 2025 +0800 ARM: dts: aspeed: catalina: Add MP5990 power sensor node Add a device tree node for the MP5990 power sensor to enable monitoring of the P12V supplying power to the fans. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250321-potin-catalina-dts-update-20250102-v6-3-4bd85efeb9b4@gmail.com Signed-off-by: Andrew Jeffery commit a2c2d4c41785fb363428156b935190dccb1b3f49 Author: Potin Lai Date: Fri Mar 21 15:26:03 2025 +0800 ARM: dts: aspeed: catalina: Add Front IO board remote thermal sensor Add a remote thermal sensor node for the Front IO board in the Catalina platform device tree. This sensor enables monitoring of the inlet temperature. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250321-potin-catalina-dts-update-20250102-v6-2-4bd85efeb9b4@gmail.com Signed-off-by: Andrew Jeffery commit 6e8b400dddd16ff8f9e5f710c30f8c5e4adc62c2 Author: Potin Lai Date: Fri Mar 21 15:26:02 2025 +0800 ARM: dts: aspeed: catalina: Add IO Mezz board thermal sensor nodes Add thermal sensor nodes for the IO Mezzanine (IO Mezz) board in the Catalina platform device tree. These nodes enable temperature monitoring for the backend NIC, improving thermal management and monitoring capabilities. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250321-potin-catalina-dts-update-20250102-v6-1-4bd85efeb9b4@gmail.com Signed-off-by: Andrew Jeffery commit 4de4329d8a766d8b1206e1afebf1ed4ba7546c1a Author: Ninad Palsule Date: Tue Feb 4 13:41:12 2025 -0600 ARM: dts: aspeed: system1: Disable gpio pull down Disable internal pull down for the following GPIO lines. - GPIOL4 - Reset PCH registers in the rtc. - GPIOL5 - Reset portition of Intel ME - GPIOL6 - FM smi active - GPIOL7 - psu all dc power good. Reviewed-by: Eddie James Signed-off-by: Ninad Palsule Link: https://patch.msgid.link/20250204194115.3899174-10-ninad@linux.ibm.com Signed-off-by: Andrew Jeffery commit c8c33f37a6a685ab81436644bce9567e483f8d71 Author: Ninad Palsule Date: Tue Feb 4 13:41:11 2025 -0600 ARM: dts: aspeed: system1: Mark GPIO line high/low - Mark following GPIO lines as input high: - GPIOL4 (reset PCH registers) - GPIOL5 (reset portition of intel ME) - Mark isolate errors from cpu1 gpio (GPIOO6) as active low output. - The fan controller reset line should be active high. Reviewed-by: Eddie James Signed-off-by: Ninad Palsule Link: https://patch.msgid.link/20250204194115.3899174-9-ninad@linux.ibm.com Signed-off-by: Andrew Jeffery commit 322dbe88fe88d657cd00df2df4e6f50143263c93 Author: Ninad Palsule Date: Tue Feb 4 13:41:10 2025 -0600 ARM: dts: aspeed: system1: Remove VRs max8952 Removing voltage regulators max8952 from device tree. Those are fully controlled by hardware and firmware should not touch them. Reviewed-by: Eddie James Signed-off-by: Ninad Palsule Link: https://patch.msgid.link/20250204194115.3899174-8-ninad@linux.ibm.com Signed-off-by: Andrew Jeffery commit 3969aadf4be93153f9aafe59458c1fc3322ab378 Author: Ninad Palsule Date: Tue Feb 4 13:41:09 2025 -0600 ARM: dts: aspeed: system1: Update LED gpio name Rename LEDs with meaningful names for easier identification. Reviewed-by: Eddie James Signed-off-by: Ninad Palsule Link: https://patch.msgid.link/20250204194115.3899174-7-ninad@linux.ibm.com Signed-off-by: Andrew Jeffery commit 24c5110ce86626995e38a4664641af68e581c916 Author: Ninad Palsule Date: Tue Feb 4 13:41:08 2025 -0600 ARM: dts: aspeed: system1: Reduce sgpio speed Reduce sgpio speed to improve stability with the current PCB layout. Reviewed-by: Eddie James Signed-off-by: Ninad Palsule Link: https://patch.msgid.link/20250204194115.3899174-6-ninad@linux.ibm.com Signed-off-by: Andrew Jeffery commit 05a8cfc12f1c5a015f07c6e5a06671c0384b0ce2 Author: Ninad Palsule Date: Tue Feb 4 13:41:07 2025 -0600 ARM: dts: aspeed: system1: Add GPIO line name Add following GPIO line name so that userspace can control them - Flash write override - pch-reset Reviewed-by: Eddie James Signed-off-by: Ninad Palsule Link: https://patch.msgid.link/20250204194115.3899174-5-ninad@linux.ibm.com Signed-off-by: Andrew Jeffery commit f06ff444bf79288f918c0c47b655022915a4d06d Author: Ninad Palsule Date: Tue Feb 4 13:41:06 2025 -0600 ARM: dts: aspeed: system1: Add IPMB device Add IPMB device sitting behind PCH module Reviewed-by: Eddie James Signed-off-by: Ninad Palsule Link: https://patch.msgid.link/20250204194115.3899174-4-ninad@linux.ibm.com Signed-off-by: Andrew Jeffery commit 6b357c149ec51d02391017cc6cf3112936a816b6 Author: Ninad Palsule Date: Tue Feb 4 13:41:04 2025 -0600 dt-bindings: ipmi: Add binding for IPMB device Add device tree binding document for the IPMB device interface. This device is already in use in both driver and .dts files. Reviewed-by: Rob Herring (Arm) Signed-off-by: Ninad Palsule Acked-by: Corey Minyard Link: https://patch.msgid.link/20250204194115.3899174-2-ninad@linux.ibm.com Signed-off-by: Andrew Jeffery commit 94706cdd3ead493909307b8a6cafb03cfcacd296 Author: Potin Lai Date: Thu Feb 13 15:12:58 2025 +0800 ARM: dts: aspeed: bletchley: remove unused ethernet-phy node Remove the unused `ethernet-phy` node and the `phy-handle` property from the Bletchley device tree. This fixes warnings reported by the kernel DTB checks. Signed-off-by: Potin Lai Link: https://patch.msgid.link/20250213-bletchley-dts-fix-v1-1-c953315eb894@gmail.com Signed-off-by: Andrew Jeffery commit 94776ee4e1ec02567dd5dfd379f35f02981aeb27 Author: Krzysztof Kozlowski Date: Thu Jan 16 10:00:09 2025 +0100 ARM: dts: aspeed: Align GPIO hog name with bindings Bindings expect GPIO hog names to end with 'hog' suffix, so correct it to fix dtbs_check warnings like: aspeed-bmc-lenovo-hr630.dtb: pin_gpio_b5: $nodename:0: 'pin_gpio_b5' does not match '^.+-hog(-[0-9]+)?$' Signed-off-by: Krzysztof Kozlowski Reviewed-by: Ninad Palsule Link: https://patch.msgid.link/20250116090009.87338-1-krzysztof.kozlowski@linaro.org Signed-off-by: Andrew Jeffery commit a7d6d2d622d7af7127051d7dd985fb1ffba16239 Author: Joel Stanley Date: Wed Jan 15 21:52:38 2025 +1030 ARM: dts: aspeed: Remove swift machine This machine is no longer in use, and support was deleted from openbmc in March 2022. Signed-off-by: Joel Stanley Link: https://patch.msgid.link/20250115112239.430636-1-joel@jms.id.au Signed-off-by: Andrew Jeffery commit f9262233b7710fae246784e2be7fa0a1275fe445 Author: Lijuan Gao Date: Mon May 26 13:21:47 2025 +0800 dt-bindings: remoteproc: qcom,sm8150-pas: Document QCS615 remoteproc Document the components used to boot the ADSP and CDSP on the Qualcomm QCS615 SoC. Use fallback to indicate the compatibility of the remoteproc on the QCS615 with that on the SM8150. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Lijuan Gao Link: https://lore.kernel.org/r/20250526-add_qcs615_remoteproc_support-v4-1-06a7d8bed0b5@quicinc.com Signed-off-by: Bjorn Andersson commit ff71bc9d0f6a5e8af353fc0588cf3b1a59815761 Author: Miri Korenblit Date: Mon Jun 9 21:21:11 2025 +0300 wifi: iwlwifi: move iwl-context-info header files context info is PCIE specific, so it should be located in pcie directory. The c files are already there, move also the header files. Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.606f48f72bcd.I4b89d373d961146e5369d1aed9f625150de7bf7d@changeid commit 3b05871a22dbfccaf2bd8d979e06076c81508b2c Author: Johannes Berg Date: Mon Jun 9 21:21:10 2025 +0300 wifi: iwlwifi: pcie: add missing TOP reset code The TOP reset requires code to handle the interrupt, which had been in my patch at some point, but clearly got lost. As the test had been running on the wrong hardware and failing due to that, we missed this. Add the missing code. Signed-off-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.3f84eb03cc00.If138ceeb8bb178b3931d96b537f746346227e681@changeid commit aab09bf1222566b230db263a075aaad5cc813d50 Author: Itamar Shalev Date: Mon Jun 9 21:21:09 2025 +0300 wifi: iwlwifi: mld: respect AUTO_EML_ENABLE in iwl_mld_int_mlo_scan() Respect this flag and don't scan for another link if it is set. Signed-off-by: Itamar Shalev Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.9ecb5c5301d4.I88b37e93d9ba66d4381f4976541b4aca2a20e36e@changeid commit 21f7fe24d2efa996a36895d3098d0fbb52c62bbd Author: Daniel Gabay Date: Mon Jun 9 21:21:08 2025 +0300 wifi: iwlwifi: mld: respect AUTO_EML_ENABLE in iwl_mld_retry_emlsr() Respect this flag before initiating MLO scan. Signed-off-by: Daniel Gabay Reviewed-by: Emmanuel Grumbach Reviewed-by: Johannes Berg Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.b5c7fbdcb15c.Iaa176c49142b46b0b896728005357faec6a55fa6@changeid commit 5c14bff6929c3373b04598c12264d8d7894f86e2 Author: Miri Korenblit Date: Mon Jun 9 21:21:07 2025 +0300 wifi: iwlwifi: mld: remove unneeded compilations Those are internal files so they should not be compiled. Signed-off-by: Miri Korenblit Link: https://patch.msgid.link/20250609211928.3bfe5222fe79.I1ebd746b0c513e278d231b5c48f5438ca9b9231f@changeid commit 277d48b2ab1e1150993ccb233156d0916b0cebd3 Author: Satya Priya Kakitapalli Date: Mon May 12 10:34:39 2025 +0530 arm64: dts: qcom: Add camera clock controller for sc8180x Add device node for camera clock controller on Qualcomm SC8180X platform. Reviewed-by: Konrad Dybcio Signed-off-by: Satya Priya Kakitapalli Link: https://lore.kernel.org/r/20250512-sc8180x-camcc-support-v4-4-8fb1d3265f52@quicinc.com Signed-off-by: Bjorn Andersson commit 7d895e3ef09d3656e25d08547b4f226a805f90bf Merge: 67081281bb0dff b5975ce4615fc0 Author: Bjorn Andersson Date: Tue Jun 10 22:16:03 2025 -0500 Merge branch '20250512-sc8180x-camcc-support-v4-2-8fb1d3265f52@quicinc.com' into arm64-for-6.17 Merge the topic branch containing SC8180X GCC and camera clock controller additions to gain access to the constants defined in the binding. commit 691f3413baa4bcaedbb40cd64be0f5e676423830 Author: Satya Priya Kakitapalli Date: Mon May 12 10:34:38 2025 +0530 clk: qcom: camcc-sc8180x: Add SC8180X camera clock controller driver Add support for the camera clock controller for camera clients to be able to request for camcc clocks on SC8180X platform. Reviewed-by: Vladimir Zapolskiy Reviewed-by: Dmitry Baryshkov Signed-off-by: Satya Priya Kakitapalli Link: https://lore.kernel.org/r/20250512-sc8180x-camcc-support-v4-3-8fb1d3265f52@quicinc.com Signed-off-by: Bjorn Andersson commit 910ad0190cb7cd7bc040031a505adb9404a1ac9e Merge: 0acf9e65a47d1e b5975ce4615fc0 Author: Bjorn Andersson Date: Tue Jun 10 22:14:41 2025 -0500 Merge branch '20250512-sc8180x-camcc-support-v4-2-8fb1d3265f52@quicinc.com' into clk-for-6.17 Merge topic branch with missing GCC clocks and the camera clock controller for SC8180X through a topic branch, to make it available for DeviceTree inclusion as well. commit b5975ce4615fc075b4a135b867988f654370a268 Author: Satya Priya Kakitapalli Date: Mon May 12 10:34:37 2025 +0530 dt-bindings: clock: Add Qualcomm SC8180X Camera clock controller Add device tree bindings for the camera clock controller on Qualcomm SC8180X platform. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Satya Priya Kakitapalli Link: https://lore.kernel.org/r/20250512-sc8180x-camcc-support-v4-2-8fb1d3265f52@quicinc.com Signed-off-by: Bjorn Andersson commit 19ac3579af14e17c56c5b8a10979c6ca4aee6e38 Author: Satya Priya Kakitapalli Date: Mon May 12 10:34:36 2025 +0530 dt-bindings: clock: qcom: Add missing bindings on gcc-sc8180x The multi-media AHB clocks are needed to create HW dependency in the multimedia CC dt blocks and avoid any issues. They were not defined in the initial bindings. Add all the missing clock bindings for gcc-sc8180x. Signed-off-by: Satya Priya Kakitapalli Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250512-sc8180x-camcc-support-v4-1-8fb1d3265f52@quicinc.com Signed-off-by: Bjorn Andersson commit 0acf9e65a47d1e489c8b24c45a64436e30bcccf4 Author: Krzysztof Kozlowski Date: Tue May 20 11:07:42 2025 +0200 clk: qcom: dispcc-sm8750: Fix setting rate byte and pixel clocks On SM8750 the setting rate of pixel and byte clocks, while the parent DSI PHY PLL, fails with: disp_cc_mdss_byte0_clk_src: rcg didn't update its configuration. DSI PHY PLL has to be unprepared and its "PLL Power Down" bits in CMN_CTRL_0 asserted. Mark these clocks with CLK_OPS_PARENT_ENABLE to ensure the parent is enabled during rate changes. Cc: stable@vger.kernel.org Fixes: f1080d8dab0f ("clk: qcom: dispcc-sm8750: Add SM8750 Display clock controller") Signed-off-by: Krzysztof Kozlowski Reviewed-by: Abhinav Kumar Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250520090741.45820-2-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit 077ec7bcec9a8987d2a133afb7e13011878c7576 Author: Christian Marangi Date: Thu May 22 22:25:55 2025 +0200 clk: qcom: gcc-ipq8074: fix broken freq table for nss_port6_tx_clk_src With the conversion done by commit e88f03230dc0 ("clk: qcom: gcc-ipq8074: rework nss_port5/6 clock to multiple conf") a Copy-Paste error was made for the nss_port6_tx_clk_src frequency table. This was caused by the wrong setting of the parent in ftbl_nss_port6_tx_clk_src that was wrongly set to P_UNIPHY1_RX instead of P_UNIPHY2_TX. This cause the UNIPHY2 port to malfunction when it needs to be scaled to higher clock. The malfunction was observed with the example scenario with an Aquantia 10G PHY connected and a speed higher than 1G (example 2.5G) Fix the broken frequency table to restore original functionality. Cc: stable@vger.kernel.org Fixes: e88f03230dc0 ("clk: qcom: gcc-ipq8074: rework nss_port5/6 clock to multiple conf") Signed-off-by: Christian Marangi Tested-by: Robert Marko Link: https://lore.kernel.org/r/20250522202600.4028-1-ansuelsmth@gmail.com Signed-off-by: Bjorn Andersson commit 9ed3eccdfd1fb4c8f164aab3cdfc749ccaf58aed Author: Taniya Das Date: Fri May 30 16:01:59 2025 +0530 clk: qcom: videocc: Use HW_CTRL_TRIGGER flag for video GDSC's The video driver will be using the newly introduced dev_pm_genpd_set_hwmode() API to switch the video GDSC to HW and SW control modes at runtime. Hence use HW_CTRL_TRIGGER flag instead of HW_CTRL for video GDSC's for Qualcomm SoC SC7180, SDM845, SM7150, SM8150 and SM8450. Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Reviewed-by: Vikash Garodia Reviewed-by: Bryan O'Donoghue Signed-off-by: Renjiang Han Link: https://lore.kernel.org/r/20250530-switch_gdsc_mode-v5-1-657c56313351@quicinc.com Signed-off-by: Bjorn Andersson commit 4ccd065a69df163cd9fe0dd8e0f609f1eeb4723d Author: Herbert Xu Date: Wed Jun 4 17:54:41 2025 +0800 crypto: ahash - Add support for drivers with no fallback Some drivers cannot have a fallback, e.g., because the key is held in hardware. Allow these to be used with ahash by adding the bit CRYPTO_ALG_NO_FALLBACK. Signed-off-by: Herbert Xu Tested-by: Harald Freudenberger commit 2c0c883f895f16fd9d367ec2e64bccab907d8d87 Author: Bjorn Andersson Date: Thu Jun 5 17:17:47 2025 -0500 remoteproc: qcom: pas: Conclude the rename from adsp The change that renamed the driver from "adsp" to "pas" didn't change any of the implementation. The result is an aesthetic eyesore, and confusing to many. Conclude the rename of the driver, by updating function, structures and variable names to match what the driver actually is. The "Hexagon v5" is also dropped from the name and Kconfig, as this isn't correct either. No functional change. Fixes: 9e004f97161d ("remoteproc: qcom: Rename Hexagon v5 PAS driver") Signed-off-by: Bjorn Andersson Reviewed-by: Wasim Nazir Link: https://lore.kernel.org/r/20250605-pas-rename-v2-1-f1c89e49e691@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit fcb1e72060391bde188f243b9c3115c78cbffa73 Author: Al Viro Date: Sun Feb 23 15:39:26 2025 -0500 split d_flags calculation out of d_set_d_op() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 05fb0e666495cda068c068a681ecbbf8e57324d0 Author: Al Viro Date: Sun Feb 23 19:39:47 2025 -0500 new helper: set_default_d_op() ... to be used instead of manually assigning to ->s_d_op. All in-tree filesystem converted (and field itself is renamed, so any out-of-tree ones in need of conversion will be caught by compiler). Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 4bd9f3fd87e252303e8fef6105b704f05d3f2678 Author: Al Viro Date: Sun Feb 23 17:54:57 2025 -0500 fuse: no need for special dentry_operations for root dentry ->d_revalidate() is never called for root anyway... Reviewed-by: Christian Brauner Acked-by: Miklos Szeredi Signed-off-by: Al Viro commit ec169ef86ba45389b353189cf1fc06461163f667 Author: Al Viro Date: Mon Feb 24 13:08:52 2025 -0500 switch procfs from d_set_d_op() to d_splice_alias_ops() Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 8866f4e557eba43e991f99711515217a95f62d2e Author: Tomasz Michalec Date: Tue Jun 10 17:37:47 2025 +0200 platform/chrome: cros_ec_typec: Defer probe on missing EC parent If cros_typec_probe is called before EC device is registered, cros_typec_probe will fail. It may happen when cros-ec-typec.ko is loaded before EC bus layer module (e.g. cros_ec_lpcs.ko, cros_ec_spi.ko). Return -EPROBE_DEFER when cros_typec_probe doesn't get EC device, so the probe function can be called again after EC device is registered. Signed-off-by: Tomasz Michalec Reviewed-by: Abhishek Pandit-Subedi Link: https://lore.kernel.org/r/20250610153748.1858519-1-tmichalec@google.com Signed-off-by: Tzung-Bi Shih commit 790fa81b8c43cda9fe25c1b564d0afe3ddeeb370 Author: Al Viro Date: Mon Feb 24 12:46:49 2025 -0500 new helper: d_splice_alias_ops() Uses of d_set_d_op() on live dentry can be very dangerous; it is going to be withdrawn and replaced with saner things. The best way for a filesystem is to have the default dentry_operations set at mount time and be done with that - __d_alloc() will use that. Currently there are two cases when d_set_d_op() is used on a live dentry - one is procfs, which has several genuinely different dentry_operations instances (different ->d_revalidate(), etc.) and another is simple_lookup(), where we would be better off without overriding ->d_op. For procfs we have d_set_d_op() calls followed by d_splice_alias(); provide a new helper (d_splice_alias_ops(inode, dentry, d_ops)) that would combine those two, and do the d_set_d_op() part while under ->d_lock. That eliminates one of the places where ->d_flags had been modified without holding ->d_lock; current behaviour is not racy, but the reasons for that are far too brittle. Better move to uniform locking rules and simpler proof of correctness... The next commit will convert procfs to use of that helper; it is not exported and won't be until somebody comes up with convincing modular user for it. Again, the best approach is to have default ->d_op and let __d_alloc() do the right thing; filesystem _may_ need non-uniform ->d_op (procfs does), but there'd better be good reasons for that. Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 5943c611c47c9444e834555c867dec744158b7ad Author: Al Viro Date: Sat Feb 22 16:04:47 2025 -0500 procfs: kill ->proc_dops It has two possible values - one for "forced lookup" entries, another for the normal ones. We'd be better off with that as an explicit flag anyway and in addition to that it opens some fun possibilities with ->d_op and ->d_flags handling. [moved PROC_ENTRY_FORCE_LOOKUP to include/linux/proc_fs.h, switched it to an unused bit - there was a conflict] Reviewed-by: Christian Brauner Signed-off-by: Al Viro commit 0097c4195b1d0ca57d15979626c769c74747b5a0 Author: Lorenzo Bianconi Date: Mon Jun 9 22:28:40 2025 +0200 net: airoha: Add PPPoE offload support Introduce flowtable hw acceleration for PPPoE traffic. Signed-off-by: Lorenzo Bianconi Link: https://patch.msgid.link/20250609-b4-airoha-flowtable-pppoe-v1-1-1520fa7711b4@kernel.org Signed-off-by: Jakub Kicinski commit 265c6ff0f8c2feef5981e9a1aedf6b5b476d7492 Author: Jakub Kicinski Date: Mon Jun 9 17:00:01 2025 -0700 selftests/net: packetdrill: more xfail changes Most of the packetdrill tests have not flaked once last week. Add the few which did to the XFAIL list. Acked-by: Matthieu Baerts (NGI0) Reviewed-by: Willem de Bruijn Link: https://patch.msgid.link/20250610000001.1970934-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit 689883de94dd8a43a0ea77311327effab240afda Author: Samiullah Khawaja Date: Mon Jun 9 17:30:15 2025 +0000 net: stop napi kthreads when THREADED napi is disabled Once the THREADED napi is disabled, the napi kthread should also be stopped. Keeping the kthread intact after disabling THREADED napi makes the PID of this kthread show up in the output of netlink 'napi-get' and ps -ef output. The is discussed in the patch below: https://lore.kernel.org/all/20250502191548.559cc416@kernel.org NAPI kthread should stop only if, - There are no pending napi poll scheduled for this thread. - There are no new napi poll scheduled for this thread while it has stopped. - The ____napi_schedule can correctly fallback to the softirq for napi polling. Since napi_schedule_prep provides mutual exclusion over STATE_SCHED bit, it is safe to unset the STATE_THREADED when SCHED_THREADED is set or the SCHED bit is not set. SCHED_THREADED being set means that SCHED is already set and the kthread owns this napi. To disable threaded napi, unset STATE_THREADED bit safely if SCHED_THREADED is set or SCHED is unset. Once STATE_THREADED is unset safely then wait for the kthread to unset the SCHED_THREADED bit so it safe to stop the kthread. Add a new test in nl_netdev to verify this behaviour. Tested: ./tools/testing/selftests/net/nl_netdev.py TAP version 13 1..6 ok 1 nl_netdev.empty_check ok 2 nl_netdev.lo_check ok 3 nl_netdev.page_pool_check ok 4 nl_netdev.napi_list_check ok 5 nl_netdev.dev_set_threaded ok 6 nl_netdev.nsim_rxq_reset_down # Totals: pass:6 fail:0 xfail:0 xpass:0 skip:0 error:0 Ran neper for 300 seconds and did enable/disable of thread napi in a loop continuously. Signed-off-by: Samiullah Khawaja Link: https://patch.msgid.link/20250609173015.3851695-1-skhawaja@google.com Signed-off-by: Jakub Kicinski commit 7fc18f9476256c03755d93b1cec0d42cf64d850a Author: Moon Yeounsu Date: Tue Jun 10 09:01:30 2025 +0900 net: dlink: enable RMON MMIO access on supported devices Enable memory-mapped I/O access to RMON statistics registers for devices known to work correctly. Currently, only the D-Link DGE-550T (`0x4000`) with PCI revision A3 (`0x0c`) is allowed. To avoid issues on other hardware, a runtime check was added to restrict MMIO usage. The `MEM_MAPPING` macro was removed in favor of runtime detection. To access RMON registers, the code `dw32(RmonStatMask, 0x0007ffff);` must also be skipped, so this patch conditionally disables it as well. Tested-on: D-Link DGE-550T Rev-A3 Signed-off-by: Moon Yeounsu Link: https://patch.msgid.link/20250610000130.49065-2-yyyynoom@gmail.com Signed-off-by: Jakub Kicinski commit 34355b6712bf9c8b803b4616ed3c66a96ccbdfa4 Merge: c4246f4cce05f1 af42404179c0e7 Author: Jakub Kicinski Date: Tue Jun 10 15:44:47 2025 -0700 Merge tag 'linux-can-next-for-6.17-20250610' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next Marc Kleine-Budde says: ==================== pull-request: can-next 2025-06-10 The first 4 patches are by Vincent Mailhol and prepare the CAN netlink interface for the introduction of CAN XL configuration. Geert Uytterhoeven's patch updates the CAN networking documentation. The last 2 patched are by Davide Caratti and introduce skb drop reasons in the receive path of several CAN protocols. * tag 'linux-can-next-for-6.17-20250610' of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can-next: can: add drop reasons in CAN protocols receive path can: add drop reasons in the receive path of AF_CAN documentation: networking: can: Document alloc_candev_mqs() can: netlink: can_changelink(): rename tdc_mask into fd_tdc_flag_provided can: bittiming: rename can_tdc_is_enabled() into can_fd_tdc_is_enabled() can: bittiming: rename CAN_CTRLMODE_TDC_MASK into CAN_CTRLMODE_FD_TDC_MASK can: netlink: replace tabulation by space in assignment ==================== Link: https://patch.msgid.link/20250610094933.1593081-1-mkl@pengutronix.de Signed-off-by: Jakub Kicinski commit c4246f4cce05f1134fb9ea82460b5690ab6710a5 Author: Subbaraya Sundeep Date: Mon Jun 9 21:23:41 2025 +0530 octeontx2-pf: Avoid typecasts by simplifying otx2_atomic64_add macro Just because otx2_atomic64_add is using u64 pointer as argument all callers has to typecast __iomem void pointers which inturn causing sparse warnings. Fix those by changing otx2_atomic64_add argument to void pointer. Signed-off-by: Subbaraya Sundeep Link: https://patch.msgid.link/1749484421-3607-1-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit d0976b43956ee8c8bd093223df9115bfcf63dfe5 Author: Subbaraya Sundeep Date: Mon Jun 9 21:21:49 2025 +0530 octeontx2: Annotate mmio regions as __iomem This patch removes unnecessary typecasts by marking the mbox_regions array as __iomem since it is used to store pointers to memory-mapped I/O (MMIO) regions. Also simplified the call to readq() in PF driver by removing redundant type casts. Signed-off-by: Subbaraya Sundeep Link: https://patch.msgid.link/1749484309-3434-1-git-send-email-sbhatta@marvell.com Signed-off-by: Jakub Kicinski commit e83b64a6376a87119b2fac244b4a71ac3441e7c9 Merge: 7ab23f70999047 48b9ce0a7c721c Author: Jakub Kicinski Date: Tue Jun 10 15:27:22 2025 -0700 Merge branch 'hinic3-queue_api-related-fixes' Gur Stavi says: ==================== hinic3: queue_api related fixes This patch series contains improvement to queue_api and 2 queue_api related patches to the hinic3 driver. v1: https://lore.kernel.org/cover.1747824040.git.gur.stavi@huawei.com v2: https://lore.kernel.org/cover.1747896423.git.gur.stavi@huawei.com ==================== Link: https://patch.msgid.link/cover.1749038081.git.gur.stavi@huawei.com Signed-off-by: Jakub Kicinski commit 48b9ce0a7c721c4c65697de8396468fae67631de Author: Gur Stavi Date: Mon Jun 9 18:07:54 2025 +0300 hinic3: remove tx_q name collision hack A local variable of tx_q worked around name collision with internal txq variable in netif_subqueue macros. This workaround is no longer needed. Signed-off-by: Gur Stavi Link: https://patch.msgid.link/6376db2a39b8d3bf2fa893f58f56246bed128d5d.1749038081.git.gur.stavi@huawei.com Signed-off-by: Jakub Kicinski commit eb89bc3744f35383b34b9df055622831ce24dc40 Author: Gur Stavi Date: Mon Jun 9 18:07:53 2025 +0300 hinic3: use netif_subqueue_sent api Improve consistency of code by using only netif_subqueue variant apis Signed-off-by: Gur Stavi Link: https://patch.msgid.link/5fd897b75729cf078385aacd9ed40091314ea63d.1749038081.git.gur.stavi@huawei.com Signed-off-by: Jakub Kicinski commit 2bc64b89c4c4073ee8f9543373c64da9b6bbe5e0 Author: Gur Stavi Date: Mon Jun 9 18:07:52 2025 +0300 queue_api: add subqueue variant netif_subqueue_sent Add a new function, netif_subqueue_sent, which is a wrapper for netdev_tx_sent_queue. Drivers that use the subqueue variant macros, netif_subqueue_xxx, identify queue by index and are not required to obtain struct netdev_queue explicitly. Such drivers still need to call netdev_tx_sent_queue which is a counterpart of netif_subqueue_completed_wake. Allowing drivers to use a subqueue variant for this purpose improves their code consistency by always referring to queue by its index. Signed-off-by: Gur Stavi Link: https://patch.msgid.link/909a5c92db49cad39f0954d6cb86775e6480ef4c.1749038081.git.gur.stavi@huawei.com Signed-off-by: Jakub Kicinski commit 7ab23f70999047bd258831a08a3b2fdfd905e86e Merge: 561939ed44932d 670678399edccd Author: Jakub Kicinski Date: Tue Jun 10 14:54:08 2025 -0700 Merge branch '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue Tony Nguyen says: ==================== Intel Wired LAN Driver Updates 2025-06-09 (ice, i40e, ixgbe, iavf) Jake moves from individual virtchnl RSS configuration values, for ice, i40e, and iavf, to a common libie location and values. Martyna and Dawid add counters for link_down_events to ice, i40e, and ixgbe drivers. The counter increments only on actual physical link-down events visible to the PHY. It does not increment when the user performs a software-only interface down/up (e.g. ip link set dev down). The counter does increment in cases where the interface is reinitialized in a way that causes a real link drop - such as eg. when attaching an XDP program, reconfiguring channels, or toggling certain priv-flags. For ice: Arkadiusz and Karol separate PTP and DPLL functionality to their respective APIs. Michal adds a separate handler for Flow Director command processing. For iavf: Ahmed converts driver to utilize core's IRQ affinity API. For ixgbe: Alok Tiwari fixes issues with some comments; typos, copy/paste errors, etc. * '100GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixgbe: Fix typos and clarify comments in X550 driver code iavf: convert to NAPI IRQ affinity API ice: add a separate Rx handler for flow director commands ice: add ice driver PTP pin documentation ice: change SMA pins to SDP in PTP API ice: redesign dpll sma/u.fl pins control ixgbe: add link_down_events statistic i40e: add link_down_events statistic ice: add link_down_events statistic net: intel: move RSS packet classifier types to libie net: intel: rename 'hena' to 'hashcfg' for clarity ==================== Link: https://patch.msgid.link/20250609212652.1138933-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski commit 561939ed44932da639ba703ffcd4d4d5ff2c7569 Author: Willem de Bruijn Date: Mon Jun 9 11:32:35 2025 -0400 net: remove unused sock_enable_timestamps This function was introduced in commit 783da70e8396 ("net: add sock_enable_timestamps"), with one caller in rxrpc. That only caller was removed in commit 7903d4438b3f ("rxrpc: Don't use received skbuff timestamps"). Signed-off-by: Willem de Bruijn Reviewed-by: Jason Xing Link: https://patch.msgid.link/20250609153254.3504909-1-willemdebruijn.kernel@gmail.com Signed-off-by: Jakub Kicinski commit 1f07789152b8d1e646d6bfecd96a2cf7bd2b9a05 Author: Dr. David Alan Gilbert Date: Mon Jun 9 16:23:30 2025 +0100 cxgb3/l2t: Remove unused t3_l2t_send_event The last use of t3_l2t_send_event() was removed in 2019 by commit 30e0f6cf5acb ("RDMA/iw_cxgb3: Remove the iw_cxgb3 module from kernel") Remove it. Signed-off-by: Dr. David Alan Gilbert Link: https://patch.msgid.link/20250609152330.24027-1-linux@treblig.org Signed-off-by: Jakub Kicinski commit 31557b3487b349464daf42bc4366153743c1e727 Author: Jakub Kicinski Date: Mon Jun 9 07:39:33 2025 -0700 uapi: in6: restore visibility of most IPv6 socket options A decade ago commit 6d08acd2d32e ("in6: fix conflict with glibc") hid the definitions of IPV6 options, because GCC was complaining about duplicates. The commit did not list the warnings seen, but trying to recreate them now I think they are (building iproute2): In file included from ./include/uapi/rdma/rdma_user_cm.h:39, from rdma.h:16, from res.h:9, from res-ctx.c:7: ../include/uapi/linux/in6.h:171:9: warning: ‘IPV6_ADD_MEMBERSHIP’ redefined 171 | #define IPV6_ADD_MEMBERSHIP 20 | ^~~~~~~~~~~~~~~~~~~ In file included from /usr/include/netinet/in.h:37, from rdma.h:13: /usr/include/bits/in.h:233:10: note: this is the location of the previous definition 233 | # define IPV6_ADD_MEMBERSHIP IPV6_JOIN_GROUP | ^~~~~~~~~~~~~~~~~~~ ../include/uapi/linux/in6.h:172:9: warning: ‘IPV6_DROP_MEMBERSHIP’ redefined 172 | #define IPV6_DROP_MEMBERSHIP 21 | ^~~~~~~~~~~~~~~~~~~~ /usr/include/bits/in.h:234:10: note: this is the location of the previous definition 234 | # define IPV6_DROP_MEMBERSHIP IPV6_LEAVE_GROUP | ^~~~~~~~~~~~~~~~~~~~ Compilers don't complain about redefinition if the defines are identical, but here we have the kernel using the literal value, and glibc using an indirection (defining to a name of another define, with the same numerical value). Problem is, the commit in question hid all the IPV6 socket options, and glibc has a pretty sparse list. For instance it lacks Flow Label related options. Willem called this out in commit 3fb321fde22d ("selftests/net: ipv6 flowlabel"): /* uapi/glibc weirdness may leave this undefined */ #ifndef IPV6_FLOWINFO #define IPV6_FLOWINFO 11 #endif More interestingly some applications (socat) use a #ifdef IPV6_FLOWINFO to gate compilation of thier rudimentary flow label support. (For added confusion socat misspells it as IPV4_FLOWINFO in some places.) Hide only the two defines we know glibc has a problem with. If we discover more warnings we can hide more but we should avoid covering the entire block of defines for "IPV6 socket options". Link: https://patch.msgid.link/20250609143933.1654417-1-kuba@kernel.org Signed-off-by: Jakub Kicinski commit c09ef59e17c6921c577d54bc8da4331b955d01a7 Author: Dipayaan Roy Date: Mon Jun 9 03:01:03 2025 -0700 net: mana: Expose additional hardware counters for drop and TC via ethtool. Add support for reporting additional hardware counters for drop and TC using the ethtool -S interface. These counters include: - Aggregate Rx/Tx drop counters - Per-TC Rx/Tx packet counters - Per-TC Rx/Tx byte counters - Per-TC Rx/Tx pause frame counters The counters are exposed using ethtool_ops->get_ethtool_stats and ethtool_ops->get_strings. This feature/counters are not available to all versions of hardware. Signed-off-by: Dipayaan Roy Reviewed-by: Subbaraya Sundeep Reviewed-by: Haiyang Zhang Link: https://patch.msgid.link/20250609100103.GA7102@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net Signed-off-by: Jakub Kicinski commit a63bea11d45523c7ed9f7b927532c810ad52db36 Merge: 2c7e4a2663a1ab 224a6e602fb371 Author: Jakub Kicinski Date: Tue Jun 10 14:22:17 2025 -0700 Merge branch 'netconsole-optimize-console-registration-and-improve-testing' Breno Leitao says: ==================== netconsole: Optimize console registration and improve testing During performance analysis of console subsystem latency, I discovered that netconsole registers console handlers even when no active targets exist. These orphaned console handlers are invoked on every printk() call, get the lock, iterate through empty target lists, and consume CPU cycles without performing any useful work. This patch series addresses the inefficiency by: 1. Implementing dynamic console registration/unregistration based on target availability, ensuring console handlers are only active when needed 2. Adding automatic cleanup of unused console registrations when targets are disabled or removed 3. Extending the selftest suite to cover non-extended console format, which was previously untested The optimization reduces printk() overhead by eliminating unnecessary function calls and list traversals when netconsole targets are not configured, improving overall system performance during heavy logging scenarios. v2: https://lore.kernel.org/20250602-netcons_ext-v2-0-ef88d999326d@debian.org v1: https://lore.kernel.org/20250528-netcons_ext-v1-1-69f71e404e00@debian.org ==================== Link: https://patch.msgid.link/20250609-netcons_ext-v3-0-5336fa670326@debian.org Signed-off-by: Jakub Kicinski commit 224a6e602fb371b42ba5f854f32191d23b7e140a Author: Breno Leitao Date: Mon Jun 9 02:46:29 2025 -0700 selftests: netconsole: Add support for basic netconsole target format Extend the netconsole selftest to validate both basic and extended target formats. The basic format is a simpler variant that doesn't support userdata or release functionality. The test now validates that netconsole works correctly in both configurations, improving test coverage for different netconsole deployment scenarios. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250609-netcons_ext-v3-4-5336fa670326@debian.org Signed-off-by: Jakub Kicinski commit 69b25dd20c8368750d1e8b12cfe31387c545bdd1 Author: Breno Leitao Date: Mon Jun 9 02:46:28 2025 -0700 selftests: netconsole: Do not exit from inside the validation function Remove the exit call from validate_result() function and move the test exit logic to the main script. This allows the function to be reused in scenarios where the test needs to continue execution after validation, rather than terminating immediately. The validate_result() function should focus on validation logic only, while the calling script maintains control over program flow and exit conditions. This change improves code modularity and prepares for potential future enhancements where multiple validations might be needed in a single test run. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250609-netcons_ext-v3-3-5336fa670326@debian.org Signed-off-by: Jakub Kicinski commit e99d938f867173937373b1bb08cbc2d102a07d0c Author: Breno Leitao Date: Mon Jun 9 02:46:27 2025 -0700 netconsole: Add automatic console unregistration on target removal Add unregister_netcons_consoles() function to automatically unregister console handlers when no targets of the corresponding type remain active. The function iterates through the target list to determine which console types (basic vs extended) are still needed, and unregisters any console handlers that are no longer required. This prevents having registered console handlers without corresponding active targets. The function is called when a target is disabled and moved to the cleanup list, ensuring proper cleanup of unused console registrations. Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250609-netcons_ext-v3-2-5336fa670326@debian.org Signed-off-by: Jakub Kicinski commit bc0cb64db1c765a81f69997d5a28f539e1731bc0 Author: Breno Leitao Date: Mon Jun 9 02:46:26 2025 -0700 netconsole: Only register console drivers when targets are configured The netconsole driver currently registers the basic console driver unconditionally during initialization, even when only extended targets are configured. This results in unnecessary console registration and performance overhead, as the write_msg() callback is invoked for every log message only to return early when no matching targets are found. Optimize the driver by conditionally registering console drivers based on the actual target configuration. The basic console driver is now registered only when non-extended targets exist, same as the extended console. The implementation also handles dynamic target creation through the configfs interface. This change eliminates unnecessary console driver registrations, redundant write_msg() callbacks for unused console types, and associated lock contention and target list iterations. The optimization is particularly beneficial for systems using only the most common extended console type. Fixes: e2f15f9a79201 ("netconsole: implement extended console support") Signed-off-by: Breno Leitao Link: https://patch.msgid.link/20250609-netcons_ext-v3-1-5336fa670326@debian.org Signed-off-by: Jakub Kicinski commit 67081281bb0dffd09e5f11c991088e6ac546a4ae Author: Luca Weiss Date: Mon Mar 24 09:41:04 2025 +0100 arm64: dts: qcom: sm6350: Add video clock controller Add a node for the videocc found on the SM6350 SoC. Signed-off-by: Luca Weiss Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250324-sm6350-videocc-v2-4-cc22386433f4@fairphone.com Signed-off-by: Bjorn Andersson commit 720b1e8f20047e072b98a0931fc3e9a545fda18f Author: Konrad Dybcio Date: Mon Mar 24 09:41:03 2025 +0100 clk: qcom: Add video clock controller driver for SM6350 Add support for the video clock controller found on SM6350 based devices. Reviewed-by: Dmitry Baryshkov Signed-off-by: Konrad Dybcio Co-developed-by: Luca Weiss Signed-off-by: Luca Weiss Link: https://lore.kernel.org/r/20250324-sm6350-videocc-v2-3-cc22386433f4@fairphone.com Signed-off-by: Bjorn Andersson commit f981efd411d260794f3d24bdc7f26cb6200e21f3 Author: Vikash Garodia Date: Thu May 1 02:16:51 2025 +0530 arm64: dts: qcom: qcs8300-ride: enable video Enable video nodes on the qcs8300-ride board. Reviewed-by: Bryan O'Donoghue Signed-off-by: Vikash Garodia Link: https://lore.kernel.org/r/20250501-qcs8300_iris-v7-5-b229d5347990@quicinc.com Signed-off-by: Bjorn Andersson commit bf6ec39c3f36d5f65335e68f756b639e872869ce Author: Vikash Garodia Date: Thu May 1 02:16:50 2025 +0530 arm64: dts: qcom: qcs8300: add video node Add the IRIS video-codec node on QCS8300 platform to support video functionality. Reviewed-by: Bryan O'Donoghue Signed-off-by: Vikash Garodia Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250501-qcs8300_iris-v7-4-b229d5347990@quicinc.com Signed-off-by: Bjorn Andersson commit d3db1ce9bf8f4a8e03d3bd19000b32290bca7d74 Author: Zihuan Zhang Date: Fri May 9 10:25:54 2025 +0800 HID: debug: Use the __set_current_state() When detecting an invalid list->hdev, the process needs to manually set its state to TASK_RUNNING and exit. In the original code, set_current_state() (which includes a memory barrier) is used here, but it is immediately followed by a mutex_unlock() call. Since mutex_unlock() internally includes a memory barrier, this ensures that all modifications within the critical section (including the process state) are visible to other CPUs. Therefore, replacing it with __set_current_state() (without an implicit barrier) avoids redundant memory barriers. Signed-off-by: Zihuan Zhang Signed-off-by: Jiri Kosina commit 703e55aacbf73da570cc276e69ec6cbe16198376 Author: Tomasz Pakuła Date: Sat May 24 19:47:24 2025 +0200 HID: pidff: Move else if statements to follow closing braces Fixes checkpatch.pl errors Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 61ea33ded9327a07d9ef85a6933cb6316e2f185f Author: Tomasz Pakuła Date: Sat May 24 19:47:23 2025 +0200 HID: pidff: Add missing spaces Fixes checkpatch.pl errors Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 3f7fd8cb8f408095ff97276d4e30ff87c112018e Author: Tomasz Pakuła Date: Sat May 24 19:47:22 2025 +0200 HID: pidff: Move trailing statements in pidff_rescale_signed() Adds newline before trailing if statements. Fixes checkpatch.pl errors Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 9c2f3ecd37ddcd714e4a476a5469d9b6663992ab Author: Tomasz Pakuła Date: Sat May 24 19:47:21 2025 +0200 HID: pidff: Remove unneeded else in pidff_find_special_field() Fixes checkpatch.pl warning Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 3ab6f57dbebb007c177168be0011238fe8fddcee Author: Tomasz Pakuła Date: Sat May 24 19:47:20 2025 +0200 HID: pidff: Use __func__ in debugs Fixes checkpatch.pl warnings Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit bed72bd240ce77623845853397b89a08f6dc5770 Author: Tomasz Pakuła Date: Sat May 24 19:47:19 2025 +0200 HID: pidff: Rework pidff_set_time() to fix warnings Fixes blank line warning from checkpatch.pl script Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit a0ea54654dd7b53df85d81f5201a78f842ea713f Author: Tomasz Pakuła Date: Sat May 24 19:47:18 2025 +0200 HID: pidff: Remove unneeded debug from pidff_clamp() Fixes chechpatch.pl warning about missing blank line Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 42a2bd61650f13605f9283b5a9e6b1a26b7d4ec2 Author: Tomasz Pakuła Date: Sat May 24 19:47:17 2025 +0200 HID: pidff: Fix missing blank lines after declarations Fixes chackpatch.pl warnings Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 18243efd7134ff461a4b1a795fbdef1d9b336b62 Author: Tomasz Pakuła Date: Sat May 24 19:47:16 2025 +0200 HID: hid-pidff.h: Fix comment styling Fixes checkpatch.pl warnings Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit b913c5c2b4f9f57913f25b439361c4ff2d7a27ed Author: Tomasz Pakuła Date: Sat May 24 19:47:15 2025 +0200 HID: hid-ids.h: Fix LITE_STAR_GT987 device id define The name was missing "ID" part Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit 9256c4bed64fe29198a922ac2d94cdf27506d47b Author: Tomasz Pakuła Date: Sat May 24 19:47:14 2025 +0200 HID: universal-pidff: Fix missing blank lines Fixes errors from checkpatch script Signed-off-by: Tomasz Pakuła Signed-off-by: Jiri Kosina commit f181c1a4b0e8b7e76590e4e9e9ef2fc6f3e042f2 Author: Jiri Kosina Date: Tue Jun 10 21:25:00 2025 +0200 HID: intel-thc: make ptl_ddata static ptl_ddata is local to pci-quicki2c.c, so it'd better be static. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505171535.Yrj5T8jh-lkp@intel.com/ Signed-off-by: Jiri Kosina commit a71338bb8bb1bbaa43e682137d8dc484a1391ea6 Author: Aditya Garg Date: Mon May 19 17:46:23 2025 +0530 HID: apple: Add necessary IDs and support for replacement trackpad on MacBookPro15,1 Some third party trackpad replacements like that of HAWSON may have a different PID than the stock trackpad. This commit adds one such trackpad to hid-apple, available for MacBookPro15,1 Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit c5f3a74310fa807d0383c109799100217f739563 Author: Aditya Garg Date: Mon May 19 17:46:22 2025 +0530 HID: quirks: remove T2 devices from hid_mouse_ignore_list While the T2 devices have been added to hid_mouse_ignore_list, no driver exists outside the HID subsystem for their trackpads. So, remove them and let the trackpad be at least used without the gestures. This patch will also enable using hid-magicmouse for these trackpads later, which is currently wip downstream. Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit a23ff6080e7197922e3a9fd8856e142b612eb50a Author: Aditya Garg Date: Mon May 19 17:46:21 2025 +0530 HID: apple: add fnmode=4 to disable translation of fkeys and make it default on Macs with Touch Bar The kernel now has a dedicated driver for Touch Bar on Macs. Since function keys can now be accessed via the Touch Bar, emulating them using non standard ways like Fn+1=F1 should be avoided. This patch adds an fnmode=4 which ignores only the Function key translation, and is enabled by default on MacBook Pros with a Touch Bar. Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 4604baafaaeeb131dfb8d9325b1e8e90f364c468 Author: Aditya Garg Date: Mon May 19 17:46:20 2025 +0530 HID: apple: Add Apple Magic Keyboard A3119 USB-C support Add Apple Magic Keyboard 2024 with Touch ID and Numeric Keypad device ID (05ac:0322) to those recognized by the hid-apple driver. Keyboard is otherwise compatible with the existing implementation for its earlier 2021 model. Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit e77bdf51de070610328255d011c439634a9ea932 Author: Grigorii Sokolik Date: Mon May 19 17:46:19 2025 +0530 HID: apple: Add Apple Magic Keyboard A3118 USB-C support Add Apple Magic Keyboard 2024 with Touch ID device ID (05ac:0321) to those recognized by the hid-apple driver. Keyboard is otherwise compatible with the existing implementation for its earlier 2021 model. Signed-off-by: Grigorii Sokolik Co-developed-by: Aditya Garg Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 46d74dd9b45f84bf8e900447c5b4b69d58733f42 Author: Aditya Garg Date: Mon May 19 17:46:18 2025 +0530 HID: apple: remove unused APPLE_IGNORE_MOUSE quirk The APPLE_IGNORE_MOUSE quirk was not used anywhere in this driver, so can be removed. Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit b45944946a19636f7bbded0763b536ce007c3c9b Author: Aditya Garg Date: Mon May 19 17:46:17 2025 +0530 HID: apple: use switch case to set fn translation table There has been a continuous increase in the number of devices requiring hid-apple driver during the last few years. Moreover, unlike previous releases, the PIDs of the newer devices released cannot be combined in a specific range, thus filling up the if else if statements with individual device IDs. For such large table, its now more suitable to use switch case instead of if else if for improved readability. Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 4e960bb550962fe5bfbcbb34ed59c1af9daff9fa Author: Aditya Garg Date: Mon May 19 17:46:16 2025 +0530 HID: apple: move backlight report structs to other backlight structs The apple_backlight_config_report and apple_backlight_set_report structs were incorrectly placed between the translation tables. Fix this. Signed-off-by: Aditya Garg Signed-off-by: Jiri Kosina commit 3fdfa1e1fae3ea111f8912d028a38543059a2d7f Author: Even Xu Date: Wed May 14 14:37:35 2025 +0800 HID: Intel-thc-hid: Intel-quicki2c: Enable Wake-on-Touch feature This patch call THC helper functions to enable Wake-on-Touch (WoT) during driver initialization and disable it when driver is removed. Signed-off-by: Even Xu Tested-by: Chong Han Signed-off-by: Jiri Kosina commit 60c9fca90e3338d7d7a76e5db92071f07a164d55 Author: Even Xu Date: Wed May 14 14:37:34 2025 +0800 HID: Intel-thc-hid: Intel-quickspi: Enable Wake-on-Touch feature This patch call THC helper functions to enable Wake-on-Touch (WoT) during driver initialization and disable it when driver is removed. Signed-off-by: Even Xu Tested-by: Chong Han Signed-off-by: Jiri Kosina commit dcb2ccb93095fcaa2969370dcbbe82fc83d42229 Author: Even Xu Date: Wed May 14 14:37:33 2025 +0800 HID: Intel-thc-hid: Intel-thc: Add Wake-on-Touch support Wake-on-Touch (WoT) feature gives system the capability to wake from sleep state by user touch event, it requires platform providing wake GPIO through ACPI resource. Intel UEFI provides a user setting to enable or disable THC device WoT feature. If it's enabled, UEFI assigns an additional wake GPIO resource to THC device ACPI configuration, facilitating system wakeup. This patch provides helper APIs for THC device driver to query wake GPIO resource, enable WoT feature and unconfigure WoT. APIs added: - thc_wot_config(): Query and configure wake-on-touch feature. - thc_wot_unconfig(): Unconfig wake-on-touch feature. Signed-off-by: Even Xu Tested-by: Chong Han Signed-off-by: Jiri Kosina commit 2c7c9c5db3bc418fc52b222651524470eeaf6f36 Author: Even Xu Date: Wed May 14 14:19:44 2025 +0800 HID: Intel-thc-hid: Intel-quicki2c: Add two new features to PTL On Panther Lake platform (PTL), THC hardware introduces two new features for I2C subsystem: - Input max input size control - Input interrupt delay This patch adds above new advanced features into QuickI2C driver, and enables max input size control feature on PTL to improve QuickI2C driver compatibility. Signed-off-by: Even Xu Tested-by: Chong Han Signed-off-by: Jiri Kosina commit 48f151a537542f232b328d20c27e46405a408a5a Author: Even Xu Date: Wed May 14 14:19:43 2025 +0800 HID: Intel-thc-hid: Intel-quicki2c: Add driver data support This patch defines driver data structure and adds it into QuickI2C device structure. Changes PCI ID table to use PCI_DEVICE_DATA() to pass platform specific driver data into driver, let driver has capability to enable different hardware features according to different platform driver data. Signed-off-by: Even Xu Signed-off-by: Jiri Kosina commit bccbe21e766f9bd1721905ece30adeac6a61b4f6 Author: Even Xu Date: Wed May 14 14:19:42 2025 +0800 HID: Intel-thc-hid: Intel-quicki2c: Refine code comments Align capitalization of the first characters for all code comments and refine some descriptions. Signed-off-by: Even Xu Reviewed-by: Andy Shevchenko Signed-off-by: Jiri Kosina commit 22da60f0304b6bfd2c7cba8ee88086f344ef5206 Author: Even Xu Date: Wed May 14 14:19:41 2025 +0800 HID: Intel-thc-hid: Intel-thc: Introduce interrupt delay control This patch adds support for a new feature, named "Interrupt Delay", allowing driver to set a specific delay time for next interrupt detection. It gives driver a capability to control THC waiting time for the next interrupt, to reduce the likelihood of spurious readings. APIs added: - thc_i2c_set_rx_int_delay(): Set I2C Rx input interrupt delay value - thc_i2c_rx_int_delay_enable(): Enable or disable I2C Rx interrupt delay As this interrupt delay feature is only applicable to RxDMA and must remain disabled during SWDMA operations, it also involves a change in SWDMA code to record the max input size control feature state before SWDMA and restore the state after SWDMA. Signed-off-by: Even Xu Tested-by: Chong Han Reviewed-by: Andy Shevchenko Signed-off-by: Jiri Kosina commit 45e92a093099eaf71ff2915a5f6ab5c04c8385e6 Author: Even Xu Date: Wed May 14 14:19:40 2025 +0800 HID: Intel-thc-hid: Intel-thc: Introduce max input size control This patch adds support for a new feature, named "Max Input Size Control", allowing driver to set a maximum input size for RxDMA. This enhancement aims to prevent RxDMA buffer overruns caused by data corruption on the I2C bus, thereby improving overall system stability. APIs added: - thc_i2c_set_rx_max_size(): Set the maximum input size for I2C RxDMA. - thc_i2c_rx_max_size_enable(): Enable or disable the max input size control. As this max input size control feature is only applicable to RxDMA and must remain disabled during SWDMA operations, it also involves a change in SWDMA code to record the max input size control feature state before SWDMA and restore the state after SWDMA. Signed-off-by: Even Xu Tested-by: Chong Han Reviewed-by: Andy Shevchenko Signed-off-by: Jiri Kosina commit 13dd60947f439bc2e7a37ed14fbec6b6ff591572 Author: Even Xu Date: Wed May 14 14:19:39 2025 +0800 HID: Intel-thc-hid: Intel-thc: Refine code comments Align capitalization of the first characters for THC structure definition comments in header files. Signed-off-by: Even Xu Signed-off-by: Jiri Kosina commit fccef49540a97a3152502bc591858f441a4c7b11 Author: Even Xu Date: Wed May 14 14:19:38 2025 +0800 HID: Intel-thc-hid: Intel-thc: Add thc_dma_content into kernel doc Convert thc_dma_content structure comments format into kernel doc format, let it can be included into kernel doc. Signed-off-by: Even Xu Signed-off-by: Jiri Kosina commit a409c60111e6bb98fcabab2aeaa069daa9434ca0 Author: Lucy Thrun Date: Tue Jun 10 19:50:12 2025 +0200 ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control The 'sprintf' call in 'add_tuning_control' may exceed the 44-byte buffer if either string argument is too long. This triggers a compiler warning. Replaced 'sprintf' with 'snprintf' to limit string lengths to prevent overflow. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506100642.95jpuMY1-lkp@intel.com/ Signed-off-by: Lucy Thrun Link: https://patch.msgid.link/20250610175012.918-3-lucy.thrun@digital-rabbithole.de Signed-off-by: Takashi Iwai commit 165bb5b154de4c39c3aa9962f0dd69836d030c19 Author: Lucy Thrun Date: Tue Jun 10 19:50:11 2025 +0200 ALSA: hda/ca0132: Fix using plain integer as NULL pointer in add_tuning_control The 'add_tuning_control' function initializes two pointers using the integer 0 instead of the NULL pointer, triggering sparse warnings. Replaced both instaces of '0' with 'NULL' to resolve the type mismatch and suppress the sparse warnings. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506100842.d8lwwdwU-lkp@intel.com/ Signed-off-by: Lucy Thrun Link: https://patch.msgid.link/20250610175012.918-2-lucy.thrun@digital-rabbithole.de Signed-off-by: Takashi Iwai commit d7eddaf0ed07e79ffdfd20acb2f6f2ca53e7851b Author: Jagadeesh Kona Date: Fri May 30 18:50:57 2025 +0530 clk: qcom: camcc-x1e80100: Move PLL & clk configuration to really probe Camera PLLs on X1E80100 require both MMCX and MXC rails to be kept ON to configure the PLLs properly. Hence move runtime power management, PLL configuration and enabling critical clocks to qcom_cc_really_probe() which ensures all required power domains are in enabled state before configuring the PLLs or enabling the clocks. Reviewed-by: Bryan O'Donoghue Tested-by: Bryan O'Donoghue # Dell Inspiron Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Jagadeesh Kona Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-12-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit 3f8dd231e60b706fc9395edbf0186b7a0756f45d Author: Jagadeesh Kona Date: Fri May 30 18:50:56 2025 +0530 clk: qcom: camcc-sm8650: Move PLL & clk configuration to really probe Camera PLLs on SM8650 require both MMCX and MXC rails to be kept ON to configure the PLLs properly. Hence move runtime power management, PLL configuration and enabling critical clocks to qcom_cc_really_probe() which ensures all required power domains are in enabled state before configuring the PLLs or enabling the clocks. Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Signed-off-by: Jagadeesh Kona Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-11-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit adb50c762f3a513a363d91722dbd8d1b4afc5f10 Author: Jagadeesh Kona Date: Fri May 30 18:50:55 2025 +0530 clk: qcom: camcc-sm8550: Move PLL & clk configuration to really probe Camera PLLs on SM8550 require both MMCX and MXC rails to be kept ON to configure the PLLs properly. Hence move runtime power management, PLL configuration and enabling critical clocks to qcom_cc_really_probe() which ensures all required power domains are in enabled state before configuring the PLLs or enabling the clocks. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Jagadeesh Kona Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-10-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit eb65d754eb5eaeab7db87ce7e64dab27b7d156d8 Author: Jagadeesh Kona Date: Fri May 30 18:50:54 2025 +0530 clk: qcom: camcc-sm8450: Move PLL & clk configuration to really probe Camera PLLs on SM8450/SM8475 require both MMCX and MXC rails to be kept ON to configure the PLLs properly. Hence move runtime power management, PLL configuration and enable critical clocks to qcom_cc_really_probe() which ensures all required power domains are in enabled state before configuring the PLLs or enabling the clocks. This change also removes the modelling for cam_cc_gdsc_clk and keeps it always ON from probe since using CLK_IS_CRITICAL will prevent the clock controller associated power domains from collapsing due to clock framework invoking clk_pm_runtime_get() during prepare. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Jagadeesh Kona Reviewed-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-9-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit a9dc2cc7279a1967f37192a2f954e7111bfa61b7 Author: Jagadeesh Kona Date: Fri May 30 18:50:53 2025 +0530 clk: qcom: videocc-sm8550: Move PLL & clk configuration to really probe Video PLLs on SM8550/SM8650 require both MMCX and MXC rails to be kept ON to configure the PLLs properly. Hence move runtime power management, PLL configuration and enable critical clocks to qcom_cc_really_probe() which ensures all required power domains are in enabled state before configuring the PLLs or enabling the clocks. Reviewed-by: Dmitry Baryshkov Signed-off-by: Jagadeesh Kona Reviewed-by: Bryan O'Donoghue Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-8-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit 512af5bf312efe09698de0870e99c0cec4d13e21 Author: Jagadeesh Kona Date: Fri May 30 18:50:52 2025 +0530 clk: qcom: videocc-sm8450: Move PLL & clk configuration to really probe Video PLLs on SM8450/SM8475 require both MMCX and MXC rails to be kept ON to configure the PLLs properly. Hence move runtime power management, PLL configuration and enable critical clocks to qcom_cc_really_probe() which ensures all required power domains are in enabled state before configuring the PLLs or enabling the clocks. Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Signed-off-by: Jagadeesh Kona Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-7-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit 452ae64997dd1db1fe9bec2e7bd65b33338e7a6b Author: Jagadeesh Kona Date: Fri May 30 18:50:51 2025 +0530 clk: qcom: common: Add support to configure clk regs in qcom_cc_really_probe Add support to configure PLLS and clk registers in qcom_cc_really_probe(). This ensures all required power domains are enabled and kept ON by runtime PM code in qcom_cc_really_probe() before configuring the PLLS or clock registers. Add support for qcom_cc_driver_data struct to maintain the clock controllers PLLs and CBCRs data, and a pointer of it can be stored in clock descriptor structure. If any clock controller driver requires to program some additional misc register settings, it can register the clk_regs_configure() callback in the driver data. Reviewed-by: Bryan O'Donoghue Reviewed-by: Dmitry Baryshkov Signed-off-by: Jagadeesh Kona Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-6-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit c0b6627369bcfec151ccbd091f9ff1cadb1d40c1 Author: Jagadeesh Kona Date: Fri May 30 18:50:50 2025 +0530 clk: qcom: common: Handle runtime power management in qcom_cc_really_probe Add support for runtime power management in qcom_cc_really_probe() to commonize it across all the clock controllers. The runtime power management is not required for all clock controllers, hence handle the rpm based on use_rpm flag in clock controller descriptor. Reviewed-by: Dmitry Baryshkov Reviewed-by: Bryan O'Donoghue Signed-off-by: Jagadeesh Kona Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-5-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit 0f698c16358ef300ed28a608368b89a4f6a8623a Author: Taniya Das Date: Fri May 30 18:50:49 2025 +0530 clk: qcom: clk-alpha-pll: Add support for common PLL configuration function To properly configure the PLLs on recent chipsets, it often requires more than one power domain to be kept ON. The support to enable multiple power domains is being added in qcom_cc_really_probe() and PLLs should be configured post all the required power domains are enabled. Hence integrate PLL configuration into clk_alpha_pll structure and add support for qcom_clk_alpha_pll_configure() function which can be called from qcom_cc_really_probe() to configure the clock controller PLLs after all required power domains are enabled. Signed-off-by: Taniya Das Reviewed-by: Dmitry Baryshkov Signed-off-by: Jagadeesh Kona Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-4-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit 842fa748291553d2f56410034991d0eb36b70900 Author: Jagadeesh Kona Date: Fri May 30 18:50:48 2025 +0530 dt-bindings: clock: qcom,sm8450-camcc: Move sc8280xp camcc to sa8775p camcc SC8280XP camcc only requires the MMCX power domain, unlike SM8450 camcc which now supports both MMCX and MXC power domains. Hence move SC8280XP camcc from SM8450 to SA8775P camcc, to have single power domain support. SA8775P camcc doesn't support required-opps property currently but SC8280XP camcc need that property, so add required-opps based on SC8280XP camcc conditional check in SA8775P camcc bindings. Reviewed-by: Bryan O'Donoghue Reviewed-by: Dmitry Baryshkov Signed-off-by: Jagadeesh Kona Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-3-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit a02a8f8cb7f6f54b077a6f9eb74ccd840b472416 Author: Vladimir Zapolskiy Date: Fri May 30 18:50:47 2025 +0530 dt-bindings: clock: qcom,sm8450-camcc: Allow to specify two power domains To configure the camera PLLs and enable the camera GDSCs on SM8450, SM8475, SM8550 and SM8650 platforms, the MXC rail must be ON along with MMCX. Therefore, update the camcc bindings to include the MXC power domain on these platforms. Fixes: 9cbc64745fc6 ("dt-bindings: clock: qcom: Add SM8550 camera clock controller") Signed-off-by: Vladimir Zapolskiy Reviewed-by: Krzysztof Kozlowski Reviewed-by: Bryan O'Donoghue Signed-off-by: Jagadeesh Kona Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-2-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit 1a42f4d4bb92ea961c58599bac837fb8b377a296 Author: Jagadeesh Kona Date: Fri May 30 18:50:46 2025 +0530 dt-bindings: clock: qcom,sm8450-videocc: Add MXC power domain To configure the video PLLs and enable the video GDSCs on SM8450, SM8475, SM8550 and SM8650 platforms, the MXC rail must be ON along with MMCX. Therefore, update the videocc bindings to include the MXC power domain on these platforms. Fixes: 1e910b2ba0ed ("dt-bindings: clock: qcom: Add SM8450 video clock controller") Signed-off-by: Jagadeesh Kona Reviewed-by: Bryan O'Donoghue Acked-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250530-videocc-pll-multi-pd-voting-v5-1-02303b3a582d@quicinc.com Signed-off-by: Bjorn Andersson commit ec04e5b4a1887d7c5d29f4efae4e54576c407605 Author: Ayushi Makhija Date: Wed Jun 4 12:48:51 2025 +0530 arm64: dts: qcom: sa8775p-ride: add anx7625 DSI to DP bridge nodes Add anx7625 DSI to DP bridge device nodes. Signed-off-by: Ayushi Makhija Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250604071851.1438612-3-quic_amakhija@quicinc.com Signed-off-by: Bjorn Andersson commit 73db32b01c9f89daf84613cc9c62ce5fe93745aa Author: Ayushi Makhija Date: Wed Jun 4 12:48:50 2025 +0530 arm64: dts: qcom: sa8775p: add Display Serial Interface device nodes Add device tree nodes for the DSI0 and DSI1 controllers with their corresponding PHYs found on Qualcomm SA8775P SoC. Signed-off-by: Ayushi Makhija Reviewed-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250604071851.1438612-2-quic_amakhija@quicinc.com Signed-off-by: Bjorn Andersson commit 657e413c277898f0ff91922475c67d82faaeeef7 Author: Rob Herring (Arm) Date: Mon Jun 9 15:37:04 2025 -0500 arm64: dts: broadcom: northstar2: Drop GIC V2M "interrupt-parent" The default interrupt parent is a parent node containing "#interrupt-cells", so an explicit "interrupt-parent" is not necessary. Fixes these dtschema warnings: (arm,gic-400): v2m@70000: 'interrupt-parent' does not match any of the regexes: '^pinctrl-[0-9]+$' (arm,gic-400): v2m@60000: 'interrupt-parent' does not match any of the regexes: '^pinctrl-[0-9]+$' (arm,gic-400): v2m@50000: 'interrupt-parent' does not match any of the regexes: '^pinctrl-[0-9]+$' (arm,gic-400): v2m@40000: 'interrupt-parent' does not match any of the regexes: '^pinctrl-[0-9]+$' (arm,gic-400): v2m@30000: 'interrupt-parent' does not match any of the regexes: '^pinctrl-[0-9]+$' (arm,gic-400): v2m@20000: 'interrupt-parent' does not match any of the regexes: '^pinctrl-[0-9]+$' (arm,gic-400): v2m@10000: 'interrupt-parent' does not match any of the regexes: '^pinctrl-[0-9]+$' (arm,gic-400): v2m@0: 'interrupt-parent' does not match any of the regexes: '^pinctrl-[0-9]+$' Signed-off-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250609203705.2852500-1-robh@kernel.org Signed-off-by: Florian Fainelli commit 4ba960e75bab4a4e5f328d22a7a9b253abd3c214 Author: Manivannan Sadhasivam Date: Thu Feb 27 19:11:05 2025 +0530 arm64: dts: qcom: x1e80100: Add missing 'global' PCIe interrupt 'global' interrupt is used to receive PCIe controller and link specific events. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-23-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit 34d10f33472347dec0c4a078e9cd77aa92be2776 Author: Manivannan Sadhasivam Date: Thu Feb 27 19:11:04 2025 +0530 arm64: dts: qcom: sar2130p: Add 'global' PCIe interrupt 'global' interrupt is used to receive PCIe controller and link specific events. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-22-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit 9c786d24f1da819186b420dcd8a7ca096832ea9c Author: Manivannan Sadhasivam Date: Thu Feb 27 19:11:03 2025 +0530 arm64: dts: qcom: sc8180x: Add 'global' PCIe interrupt 'global' interrupt is used to receive PCIe controller and link specific events. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-21-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit b1830bdc0fe67754e0f9103b8dfc16d847632498 Author: Manivannan Sadhasivam Date: Thu Feb 27 19:11:01 2025 +0530 arm64: dts: qcom: ipq6018: Add missing MSI and 'global' IRQs IPQ6018 has 8 MSI SPI interrupts and one 'global' interrupt. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Reviewed-by: Kathiravan Thirumoorthy Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-19-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit b6b20109ccb5dba2331b12ca7748dda4041191e7 Author: Manivannan Sadhasivam Date: Thu Feb 27 19:10:59 2025 +0530 arm64: dts: qcom: ipq8074: Add missing MSI and 'global' IRQs IPQ8074 has 8 MSI SPI interrupts and one 'global' interrupt. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Reviewed-by: Kathiravan Thirumoorthy Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-17-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit c2c4c10a00b7eafde1198dcdba9a97aa06af5177 Author: Manivannan Sadhasivam Date: Thu Feb 27 19:10:57 2025 +0530 arm64: dts: qcom: msm8998: Add missing MSI and 'global' IRQs MSM8998 has 8 MSI SPI interrupts and one 'global' interrupt. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-15-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit 7256eee44e63adc8875e12dea64d0f7ca595d257 Author: Manivannan Sadhasivam Date: Thu Feb 27 19:10:55 2025 +0530 arm64: dts: qcom: msm8996: Add missing MSI SPI interrupts MSM8996 has 8 MSI SPI interrupts per controller instance. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Konrad Dybcio Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-13-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit 469cda30e4c29a1dc2fd855200baa0f1bec31eb9 Author: Manivannan Sadhasivam Date: Thu Feb 27 19:10:54 2025 +0530 arm64: dts: qcom: sdm845: Add missing MSI and 'global' IRQs SDM845 has 8 MSI SPI interrupts and one 'global' interrupt per controller. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-12-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit 423704cc7fdfcc4b013c9f46596cf54b9b7acff2 Author: Manivannan Sadhasivam Date: Thu Feb 27 19:10:52 2025 +0530 arm64: dts: qcom: sc7280: Add 'global' PCIe interrupt 'global' interrupt is used to receive PCIe controller and link specific events. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-10-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit b83843df74f22f5b3c1ea315bf58bccca768c0ce Author: Manivannan Sadhasivam Date: Thu Feb 27 19:10:50 2025 +0530 arm64: dts: qcom: sa8775p: Add 'global' PCIe interrupt 'global' interrupt is used to receive PCIe controller and link specific events. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-8-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit 28b49abaaa003a5dee499cb60cc2021e967ca0fd Author: Manivannan Sadhasivam Date: Thu Feb 27 19:10:48 2025 +0530 arm64: dts: qcom: sm8350: Add 'global' PCIe interrupt 'global' interrupt is used to receive PCIe controller and link specific events. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-6-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit 0ea9df0b968832674c3728459ae4f5699ef3cea5 Author: Manivannan Sadhasivam Date: Thu Feb 27 19:10:46 2025 +0530 arm64: dts: qcom: sm8250: Add 'global' PCIe interrupt 'global' interrupt is used to receive PCIe controller and link specific events. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-4-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit b151de3b3543b2f6cef9cfd5e54775a846c6b48b Author: Manivannan Sadhasivam Date: Thu Feb 27 19:10:44 2025 +0530 arm64: dts: qcom: sm8150: Add 'global' PCIe interrupt 'global' interrupt is used to receive PCIe controller and link specific events. Signed-off-by: Manivannan Sadhasivam Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250227-pcie-global-irq-v1-2-2b70a7819d1e@linaro.org Signed-off-by: Bjorn Andersson commit 76be5fae32febb1fdb848ba09f78c4b2c76cb337 Author: Jiayuan Chen Date: Mon Jun 9 10:59:08 2025 +0800 bpf, sockmap: Fix psock incorrectly pointing to sk We observed an issue from the latest selftest: sockmap_redir where sk_psock(psock->sk) != psock in the backlog. The root cause is the special behavior in sockmap_redir - it frequently performs map_update() and map_delete() on the same socket. During map_update(), we create a new psock and during map_delete(), we eventually free the psock via rcu_work in sk_psock_drop(). However, pending workqueues might still exist and not be processed yet. If users immediately perform another map_update(), a new psock will be allocated for the same sk, resulting in two psocks pointing to the same sk. When the pending workqueue is later triggered, it uses the old psock to access sk for I/O operations, which is incorrect. Timing Diagram: cpu0 cpu1 map_update(sk): sk->psock = psock1 psock1->sk = sk map_delete(sk): rcu_work_free(psock1) map_update(sk): sk->psock = psock2 psock2->sk = sk workqueue: wakeup with psock1, but the sk of psock1 doesn't belong to psock1 rcu_handler: clean psock1 free(psock1) Previously, we used reference counting to address the concurrency issue between backlog and sock_map_close(). This logic remains necessary as it prevents the sk from being freed while processing the backlog. But this patch prevents pending backlogs from using a psock after it has been stopped. Note: We cannot call cancel_delayed_work_sync() in map_delete() since this might be invoked in BPF context by BPF helper, and the function may sleep. Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") Signed-off-by: Jiayuan Chen Signed-off-by: Daniel Borkmann Reviewed-by: John Fastabend Link: https://lore.kernel.org/bpf/20250609025908.79331-1-jiayuan.chen@linux.dev commit b2c765778a2ea953a448816ba7c034f02a2fd6c6 Author: Thomas Weißschuh Date: Mon Jun 9 09:39:16 2025 +0200 selftests/nolibc: make stackprotector probing more robust nolibc only supports symbol-based stackprotectors, based on the global variable __stack_chk_guard. Support for this differs between architectures and toolchains. Some use the symbol mode by default, some require a flag to enable it and some don't support it at all. Before the nolibc test Makefile required the availability of "-mstack-protector-guard=global" to enable stackprotectors. While this flag makes sure that the correct mode is available it doesn't work where the correct mode is the only supported one and therefore the flag is not implemented. Switch to a more dynamic probing mechanism. This correctly enables stack protectors for mips, loongarch and m68k. Acked-by: Willy Tarreau Link: https://lore.kernel.org/r/20250609-nolibc-stackprotector-robust-v1-1-a1cfc92a568a@weissschuh.net Signed-off-by: Thomas Weißschuh commit 25dcfe4042aaa96b3792ffaa933314a4bbebab98 Author: Krzysztof Kozlowski Date: Thu Apr 24 10:47:13 2025 +0200 ARM: dts: qcom: Align wifi node name with bindings Since commit 3c3606793f7e ("dt-bindings: wireless: bcm4329-fmac: Use wireless-controller.yaml schema"), bindings expect 'wifi' as node name: qcom-msm8974-lge-nexus5-hammerhead.dtb: bcrmf@1: $nodename:0: 'bcrmf@1' does not match '^wifi(@.*)?$' Signed-off-by: Krzysztof Kozlowski Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250424084713.105080-1-krzysztof.kozlowski@linaro.org Signed-off-by: Bjorn Andersson commit d6e2c062e5f154d1c54022b8defb91c21648562d Author: Thorsten Blum Date: Tue Jun 10 14:18:33 2025 +0200 ALSA: mips/sgio2audio: Replace deprecated strcpy() with strscpy() strcpy() is deprecated; use strscpy() instead. No functional changes intended. Link: https://github.com/KSPP/linux/issues/88 Signed-off-by: Thorsten Blum Link: https://patch.msgid.link/20250610121835.2908-2-thorsten.blum@linux.dev Signed-off-by: Takashi Iwai commit 2d72dd14d77f31a7caa619fe0b889304844e612e Author: Tobias Klauser Date: Tue Jun 10 16:07:56 2025 +0200 bpf: adjust path to trace_output sample eBPF program The sample file was renamed from trace_output_kern.c to trace_output.bpf.c in commit d4fffba4d04b ("samples/bpf: Change _kern suffix to .bpf with syscall tracing program"). Adjust the path in the documentation comment for bpf_perf_event_output. Signed-off-by: Tobias Klauser Link: https://lore.kernel.org/r/20250610140756.16332-1-tklauser@distanz.ch Signed-off-by: Alexei Starovoitov commit 10201c7de5de946497160eb298ea60d54d849fe1 Author: Matthew Brost Date: Mon Jun 9 21:56:49 2025 -0700 drm/xe: Reorder 'Get pages failed' message Print the error from get pages failing, not the cast to -ENODATA. Signed-off-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray > Link: https://lore.kernel.org/r/20250610045649.3149801-1-matthew.brost@intel.com commit 90256033c11028a57437b145449c0dab196183b9 Author: Thomas Richard Date: Mon Jun 9 13:51:15 2025 +0200 pinctrl: cirrus: madera-core: Use devm_pinctrl_register_mappings() Use devm_pinctrl_register_mappings(), so the mappings are automatically unregistered by the core. If pinctrl_enable() failed during the probe, pinctrl_mappings were not freed. Now it is done by the core. Fixes: 218d72a77b0b ("pinctrl: madera: Add driver for Cirrus Logic Madera codecs") Signed-off-by: Thomas Richard Reviewed-by: Richard Fitzgerald Link: https://lore.kernel.org/20250609-pinctrl-madera-devm-pinctrl-register-mappings-v1-1-ba2c2822cf6c@bootlin.com Signed-off-by: Linus Walleij commit 86491c2b99e5adbb56d76286d6668effb36d3c90 Author: Nicolas Frattaroli Date: Mon Jun 2 18:19:12 2025 +0200 dt-bindings: pinctrl: rockchip: increase max amount of device functions With the introduction of the RK3576, the maximum device function ID used increased to 14, as anyone can easily verify for themselves with: rg -g '*-pinctrl.dtsi' '<\d+\s+RK_P..\s+(?\d+)\s.*>;$' --trim \ -NI -r '$func' arch/arm64/boot/dts/rockchip/ | sort -g | uniq Unfortunately, this wasn't caught by dt-validate as those pins are omit-if-no-ref and we had no reference to them in any tree so far. Once again kick the can down the road by increasing the limit to 14. Acked-by: Conor Dooley Signed-off-by: Nicolas Frattaroli Reviewed-by: Linus Walleij Reviewed-by: Heiko Stuebner Link: https://lore.kernel.org/20250602-rk3576-pwm-v2-1-a6434b0ce60c@collabora.com Signed-off-by: Linus Walleij commit 1f8e5dfddaa794c97a80b2a9952be368d8fdee6e Author: Xianwei Zhao Date: Tue May 27 13:23:30 2025 +0800 pinctrl: meson: support amlogic S6/S7/S7D SoC In some Amlogic SoCs, to save register space or due to some abnormal arrangements, two sets of pins share one mux register. A group starting from pin0 is the main pin group, which acquires the register address through DTS and has management permissions, but the register bit offset is undetermined. Another GPIO group as a subordinate group. Some pins mux use share register and bit offset from bit0 . But this group do not have register management permissions. This submission implements this situation. Signed-off-by: Xianwei Zhao Link: https://lore.kernel.org/20250527-s6-s7-pinctrl-v3-3-44f6a0451519@amlogic.com Signed-off-by: Linus Walleij commit cfdedf7392e16f7c077b02ec13961a1b28e4f0a7 Author: Xianwei Zhao Date: Tue May 27 13:23:29 2025 +0800 pinctrl: meson: a4: remove special data processing According to the data specifications of Amlogic's existing SoCs, the function register offset and the bit offset are the same value among various chips. Therefore, general processing can be carried out without the need for private data modification. Drop special data processing. Signed-off-by: Xianwei Zhao Link: https://lore.kernel.org/20250527-s6-s7-pinctrl-v3-2-44f6a0451519@amlogic.com Signed-off-by: Linus Walleij commit 29a9b3a504c0d18bcc7f0547371409e9dcbc045e Author: Marek Vasut Date: Sun Jun 8 16:28:18 2025 +0200 drm/panel: ilitek-ili9881c: Add configuration for 7" Raspberry Pi 720x1280 Add configuration for the 7" Raspberry Pi 720x1280 DSI panel based on ili9881. Signed-off-by: Marek Vasut Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250608142908.54121-3-marek.vasut+renesas@mailbox.org commit 2f7e4a6997362a929419fc352ad8f424143ae482 Author: Marek Vasut Date: Sun Jun 8 16:28:17 2025 +0200 drm/panel: ilitek-ili9881c: Allow configuration of the number of lanes Not all panels use all 4 data lanes, so allow configuration based on the compatible string. Signed-off-by: Marek Vasut Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250608142908.54121-2-marek.vasut+renesas@mailbox.org commit 808d26afdcbf1abe5176261afbf945825652b748 Author: Marek Vasut Date: Sun Jun 8 16:28:16 2025 +0200 dt-bindings: ili9881c: Document 7" Raspberry Pi 720x1280 Document the 7" Raspberry Pi 720x1280 DSI panel based on ili9881. Signed-off-by: Marek Vasut Acked-by: Conor Dooley Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250608142908.54121-1-marek.vasut+renesas@mailbox.org commit 317eb8b3d7b87c583867f752c72913e06c53c2e1 Author: Xianwei Zhao Date: Tue May 27 13:23:28 2025 +0800 dt-bindings: pinctl: amlogic,pinctrl-a4: Add compatible string for S7/S7D/S6 Update dt-binding document for pinctrl of Amlogic S7/S7D/S6. Signed-off-by: Xianwei Zhao Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/20250527-s6-s7-pinctrl-v3-1-44f6a0451519@amlogic.com Signed-off-by: Linus Walleij commit f79692d0c386bf8b815c92fc0f832d1a0af03628 Author: Stefan Eichenberger Date: Fri Jun 6 13:45:51 2025 +0200 dt-bindings: display: st7701: Add Winstar wf40eswaa6mnn0 panel The Winstar wf40eswaa6mnn0 panel is a square 4.0" TFT LCD with a resolution of 480x480 pixels. Signed-off-by: Stefan Eichenberger Acked-by: Conor Dooley Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250606114644.105371-3-eichest@gmail.com commit d04f6367d39918461d0335d30b860d38668d4b54 Author: Stefan Eichenberger Date: Fri Jun 6 13:45:50 2025 +0200 drm/panel: st7701: Add Winstar wf40eswaa6mnn0 panel support The Winstar wf40eswaa6mnn0 panel is a square 4.0" TFT LCD with a resolution of 480x480 pixels. This panel is driven by the Sitronix ST7701 controller and uses a MIPI DSI interface. The settings are based on the panel's datasheet and the init sequence provided by Winstar. It was tested on a Verdin iMX8MP from Toradex with a Carrier Board providing a MIPI DSI interface. Signed-off-by: Stefan Eichenberger Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250606114644.105371-2-eichest@gmail.com commit 783334f366b1825d8ca22e3b8fac6dd7a662e5fd Author: Casey Connolly Date: Fri May 9 10:59:44 2025 +0200 drm/panel: visionox-rm69299: support the variant found in the SHIFT6mq Add support for another variant of the rm69299 panel. This panel is 1080x2160 and is found in the shift-axolotl (SHIFT6mq). Signed-off-by: Caleb Connolly [narmstrong: moved to panel_desc] Reviewed-by: Jessica Zhang Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250509-topic-misc-shift6-panel-v2-6-c2c2d52abd51@linaro.org commit 88e6e4dd5012c81e491e6702321cbbab8083a04b Author: Neil Armstrong Date: Fri May 9 10:59:42 2025 +0200 drm/panel: visionox-rm69299: switch to devm_regulator_bulk_get_const() Switch to devm_regulator_bulk_get_const() to move the supply data to const. Reviewed-by: Jessica Zhang Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250509-topic-misc-shift6-panel-v2-4-c2c2d52abd51@linaro.org commit c161a2b79a5cdcd7eae5f544bb9ec8a82d76d1de Author: Neil Armstrong Date: Fri May 9 10:59:41 2025 +0200 drm/panel: visionox-rm69299: switch to _multi variants Switch to the DSI _multi variants to simplify error handling. Reviewed-by: Jessica Zhang Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250509-topic-misc-shift6-panel-v2-3-c2c2d52abd51@linaro.org commit 01a2c6756bcae987472228c41319fc6ab2cc89c8 Author: Neil Armstrong Date: Fri May 9 10:59:40 2025 +0200 drm/panel: visionox-rm69299: add plumbing to support panel variants In order to support a panel variant, add plumbing code to pass init sequence and mode as compatible data. Reviewed-by: Jessica Zhang Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250509-topic-misc-shift6-panel-v2-2-c2c2d52abd51@linaro.org commit 9c59059fcf27ccd93d7dddc99727fd2c9deca309 Author: Casey Connolly Date: Fri May 9 10:59:39 2025 +0200 dt-bindings: display: visionox-rm69299: document new compatible string Document a new compatible string for the second panel variant. Signed-off-by: Caleb Connolly Acked-by: Rob Herring Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250509-topic-misc-shift6-panel-v2-1-c2c2d52abd51@linaro.org commit 7e10d7242ea8a5947878880b912ffa5806520705 Author: Arnd Bergmann Date: Tue Jun 10 11:30:53 2025 +0200 ASoC: ops: dynamically allocate struct snd_ctl_elem_value This structure is really too larget to be allocated on the stack: sound/soc/soc-ops.c:435:5: error: stack frame size (1296) exceeds limit (1280) in 'snd_soc_limit_volume' [-Werror,-Wframe-larger-than] Change the function to dynamically allocate it instead. There is probably a better way to do it since only two integer fields inside of that structure are actually used, but this is the simplest rework for the moment. Fixes: 783db6851c18 ("ASoC: ops: Enforce platform maximum on initial value") Signed-off-by: Arnd Bergmann Link: https://patch.msgid.link/20250610093057.2643233-1-arnd@kernel.org Signed-off-by: Mark Brown commit d209f6e122950d9b6f329f3538b785dd709001e5 Author: Jeff Layton Date: Mon Jun 2 07:58:54 2025 -0400 filelock: add new locks_wake_up_waiter() helper Currently the function that does this takes a struct file_lock, but __locks_wake_up_blocks() deals with both locks and leases. Currently this works because both file_lock and file_lease have the file_lock_core at the beginning of the struct, but it's fragile to rely on that. Add a new locks_wake_up_waiter() function and call that from __locks_wake_up_blocks(). Signed-off-by: Jeff Layton Link: https://lore.kernel.org/20250602-filelock-6-16-v1-1-7da5b2c930fd@kernel.org Signed-off-by: Christian Brauner commit dd765ba8723958514eab2fc742bef69019a21069 Author: Jens Axboe Date: Fri May 30 05:25:35 2025 -0600 fs/pipe: set FMODE_NOWAIT in create_pipe_files() Rather than have the caller set the FMODE_NOWAIT flags for both output files, move it to create_pipe_files() where other f_mode flags are set anyway with stream_open(). With that, both __do_pipe_flags() and io_pipe() can remove the manual setting of the NOWAIT flags. No intended functional changes, just a code cleanup. Signed-off-by: Jens Axboe Link: https://lore.kernel.org/1f0473f8-69f3-4eb1-aa77-3334c6a71d24@kernel.dk Signed-off-by: Christian Brauner commit cd95e366c9e380ca4fbe91cb38756f06d2ad869f Author: Andy Shevchenko Date: Fri May 30 20:32:04 2025 +0300 fs/read_write: Fix spelling typo 'implemenation' --> 'implementation'. Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/20250530173204.3611576-1-andriy.shevchenko@linux.intel.com Signed-off-by: Christian Brauner commit bafe200f8e5423b71c593cde169501c7902d28a2 Author: Heiko Stuebner Date: Sat May 10 18:15:31 2025 +0200 arm64: dts: rockchip: convert rk3562 to their dt-binding constants Now that the binding head has been merged, convert the power-domain ids back to these constants for easier handling. Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250510161531.2086706-1-heiko@sntech.de Signed-off-by: Heiko Stuebner commit d7ad90d22abed02bcffd292e3de5c5f9daf6ed25 Author: John Clark Date: Thu May 15 20:27:13 2025 -0400 arm64: dts: rockchip: Add Luckfox Omni3576 Board support Add device tree for the Luckfox Omni3576 Carrier Board with Core3576 Module, powered by the Rockchip RK3576 SoC with four Cortex-A72 cores, four Cortex-A53 cores, and a Mali-G52 MC3 GPU. This initial implementation enables essential functionality for booting Linux and basic connectivity. Supported and tested features: - UART for serial console - SD card for storage - PCIe with NVMe SSD (detected, mounted, and fully functional) - USB 2.0 host ports - RK806 PMIC for power management - RTC with timekeeping and wake-up - GPIO-controlled LED with heartbeat trigger - eMMC (enabled, not populated on tested board) The device tree provides a foundation for further peripheral support, such as WiFi, MIPI-DSI, HDMI, and Ethernet, in future updates. Tested on Linux 6.15-rc4 Based on the Luckfox SDK, which derives from Rockchip’s SDK examples, with relevant changes to align with upstream Linux. Signed-off-by: John Clark Link: https://lore.kernel.org/r/20250516002713.145026-4-inindev@gmail.com Signed-off-by: Heiko Stuebner commit 76595004b6d32545eea87e61246f909d532aae04 Author: John Clark Date: Thu May 15 20:27:12 2025 -0400 dt-bindings: arm: rockchip: Add Luckfox Omni3576 and Core3576 bindings Add device tree binding for Luckfox Core3576 Module based boards, specifically the Luckfox Omni3576, with compatibility for the Rockchip RK3576 SoC. Signed-off-by: John Clark Reviewed-by: Quentin Schulz Acked-by: "Rob Herring (Arm)" Link: https://lore.kernel.org/r/20250516002713.145026-3-inindev@gmail.com Signed-off-by: Heiko Stuebner commit 7f66bfe017dd8b3782d11dbd8bae512df2facf21 Author: John Clark Date: Thu May 15 20:27:11 2025 -0400 dt-bindings: vendor-prefixes: Add luckfox prefix Add vendor prefix for Shenzhen Luckfox Technology Co., Ltd., which produces development boards like the Luckfox Omni3576. Signed-off-by: John Clark Acked-by: Conor Dooley Acked-by: Krzysztof Kozlowski Reviewed-by: Quentin Schulz Link: https://lore.kernel.org/r/20250516002713.145026-2-inindev@gmail.com Signed-off-by: Heiko Stuebner commit de5b39d16318f9345f1ba7c1b684ba0c1cb6fdad Author: Sam Edwards Date: Sun Jun 8 11:48:55 2025 -0700 arm64: dts: rockchip: Remove workaround that prevented Turing RK1 GPU power regulator control The RK3588 GPU power domain cannot be activated unless the external power regulator is already on. When GPU support was added to this DT, we had no way to represent this requirement, so `regulator-always-on` was added to the `vdd_gpu_s0` regulator in order to ensure stability. A later patch series (see "Fixes:" commit) resolved this shortcoming, but that commit left the workaround -- and rendered the comment above it no longer correct. Remove the workaround to allow the GPU power regulator to power off, now that the DT includes the necessary information to power it back on correctly. Fixes: f94500eb7328b ("arm64: dts: rockchip: Add GPU power domain regulator dependency for RK3588") Signed-off-by: Sam Edwards Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250608184855.130206-1-CFSworks@gmail.com Signed-off-by: Heiko Stuebner commit e14491aaa6ff598bbe9d462e44c01ac65754f445 Author: Peter Robinson Date: Sun May 18 22:59:34 2025 +0100 arm64: dts: rockchip: add overlay for RockPro64 screen The Pine64 touch panel is a panel consisting of the Feiyang fy07024di26a30d panel with a Goodix gt911 touch screen. Add a device tree overlay to allow the display to be easily used on the device. This was previously included in the main device tree but left disabled by default which still required rebuilding the DT to use the device, now overlays can go upstream the overlay is the best way to handle the add on devices. Signed-off-by: Peter Robinson [added the missing v2 to dtb-$(CONFIG_ARCH_ROCKCHIP) += rk3399-rockpro64-v2-screen.dtb ^^ rk3399-rockpro64-v2-screen-dtbs := rk3399-rockpro64-v2.dtb \ rk3399-rockpro64-screen.dtbo dropped address-cells/size-cells from panel node to fix warning about rk3399-rockpro64-screen.dtso:69.22-84.4: Warning (avoid_unnecessary_addr_size) /fragment@2/__overlay__/panel@0: unnecessary #address-cells/#size-cells without "ranges", "dma-ranges" or child "reg" property] Link: https://lore.kernel.org/r/20250518215944.178582-2-pbrobinson@gmail.com Signed-off-by: Heiko Stuebner commit af42404179c0e7b590ddfe56c4a753ace39cc1a4 Merge: 9e97db3c075a77 81807451c2a6af Author: Marc Kleine-Budde Date: Tue Jun 10 10:24:30 2025 +0200 Merge patch series "can: add drop reasons in the receive path" Davide Caratti says: drop reasons have been recently introduced to improve debuggability of networking stack. This series introduces drop reasons in the RX path of the CAN protocol stack. Link: https://patch.msgid.link/20250604160605.1005704-1-dcaratti@redhat.com Signed-off-by: Marc Kleine-Budde commit 97a7ea2b8f4a9aec1f43435658343e046c2a4983 Author: Bartosz Golaszewski Date: Tue May 27 13:13:53 2025 +0200 gpio: TODO: add a task for removing MMIO-specific fields from gpio_chip Currently for CONFIG_GPIO_GENERIC=y each struct gpio_chip object contains the fields relevant only for gpio-mmio users. It's not an insignificant number either as it's several pointers and integers. It makes sense to remove these fields from struct gpio_chip into a dedicated structure but this is not trivial due to how the bgpio_init() function is implemented. Add a task for tracking this rework. Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250527111353.71540-1-brgl@bgdev.pl Signed-off-by: Bartosz Golaszewski commit b263e653c3722349a6efbb42d9e683d8ed1c24bf Author: Geert Uytterhoeven Date: Thu Jun 5 12:28:03 2025 +0200 clk: renesas: rzg2l: Rename mstp_clock to mod_clock The mstp_clock structure really represents a module clock (cfr. the various rzg2l_mod_clock_*() functions and the to_mod_clock() helper), and is not directly related to the "Module stop state". Rename it to "mod_clock", and replace "mstp_clock" by "mod_clock". to avoid confusion with the mstop registers. Signed-off-by: Geert Uytterhoeven Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/53b3a730a784650762cdb27fdbde7a45b0c20db8.1749119264.git.geert+renesas@glider.be commit e6b6e3e08f012f967bb0babf4b0da4535d7f617b Author: Lad Prabhakar Date: Wed May 28 14:25:58 2025 +0100 clk: renesas: r9a09g056: Add clock and reset entries for USB2.0 Add clock and reset entries for USB2.0. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250528132558.167178-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 705d9f8f180851c60e6a344881661c3d44b92313 Author: Claudiu Beznea Date: Tue May 27 14:24:03 2025 +0300 Revert "dt-bindings: clock: renesas,rzg2l-cpg: Update #power-domain-cells = <1> for RZ/G3S" This reverts commit f33dca9ed6f41c8acf2c17c402738deddb7d7c28. Since the configuration order between the individual MSTOP and CLKON bits cannot be preserved with the power domain abstraction, drop the power domain IDs. Currently, there are no device tree users for #power-domain-cell = <1>. Reviewed-by: Geert Uytterhoeven Acked-by: "Rob Herring (Arm)" Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/20250527112403.1254122-9-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 4a59e02a5aa178f80d065ad0368d29f25620c334 Author: Claudiu Beznea Date: Tue May 27 14:24:02 2025 +0300 dt-bindings: clock: rzg2l: Drop power domain IDs Since the configuration order between the individual MSTOP and CLKON bits cannot be preserved with the power domain abstraction, drop the power domain IDs. The corresponding code has also been removed. Currently, there are no device tree users for these IDs. Acked-by: "Rob Herring (Arm)" Reviewed-by: Geert Uytterhoeven Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/20250527112403.1254122-8-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 26a301a244dd011f4b928cbe2b6f4b4b666ba2cb Author: Claudiu Beznea Date: Tue May 27 14:24:01 2025 +0300 clk: renesas: rzg2l: Drop MSTOP based power domain support Since the configuration order between the individual MSTOP and CLKON bits cannot be preserved with the power domain abstraction, drop the power domain core code. Reviewed-by: Geert Uytterhoeven Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/20250527112403.1254122-7-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c4969595274609055c71cbe831c2989361730876 Author: Claudiu Beznea Date: Tue May 27 14:24:00 2025 +0300 clk: renesas: r9a08g045: Drop power domain instantiation Since the configuration order between the individual MSTOP and CLKON bits cannot be preserved with the power domain abstraction, drop the power domain instantiations. Reviewed-by: Geert Uytterhoeven Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/20250527112403.1254122-6-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 5cd33db5695693c3b4b9d5fc5e2be70c3efa99dd Author: Claudiu Beznea Date: Tue May 27 14:23:59 2025 +0300 clk: renesas: rzg2l: Add support for MSTOP in clock enable/disable API The RZ/{G2L,V2L,G3S} CPG versions support a feature called MSTOP. Each module has one or more MSTOP bits associated with it, and these bits need to be configured along with the module clocks. Setting the MSTOP bits switches the module between normal and standby states. Previously, MSTOP support was abstracted through power domains (struct generic_pm_domain::{power_on, power_off} APIs). With this abstraction, the order of setting the MSTOP and CLKON bits was as follows: Previous Order: A/ Switching to Normal State (e.g., during probe): 1/ Clear module MSTOP bit 2/ Set module CLKON bit B/ Switching to Standby State (e.g., during remove): 1/ Clear CLKON bit 2/ Set MSTOP bit However, in some cases (when the clock is disabled through devres), the order may have been (due to the issue described in link section): 1/ Set MSTOP bit 2/ Clear CLKON bit Recently, the hardware team has suggested that the correct order to set the MSTOP and CLKON bits is: Updated Order: A/ Switching to Normal State (e.g., during probe): 1/ Set CLKON bit 2/ Clear MSTOP bit B/ Switching to Standby State (e.g., during remove): 1/ Set MSTOP bit 2/ Clear CLKON bit To prevent future issues due to incorrect ordering, the MSTOP setup has now been implemented in rzg2l_mod_clock_endisable(), ensuring compliance with the sequence suggested in Figure 41.5: Module Standby Mode Procedure from the RZ/G3S HW manual, Rev1.10. Additionally, since multiple clocks of a single module may be mapped to a single MSTOP bit, MSTOP setup is reference-counted. Furthermore, as all modules start in the normal state after reset, if the module clocks are disabled, the module state is switched to standby. This prevents keeping the module in an invalid state, as recommended by the hardware team. Link: https://lore.kernel.org/all/20250215130849.227812-1-claudiu.beznea.uj@bp.renesas.com/ Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250527112403.1254122-5-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 3fd4a8bb4b63b886a7a11444f85000ea90d2617f Author: Claudiu Beznea Date: Tue May 27 14:23:58 2025 +0300 clk: renesas: rzg2l: Add macro to loop through module clocks Add a macro to iterate over the module clocks array. This will be useful in the upcoming commits that move MSTOP support into the clock enable/disable APIs. Reviewed-by: Geert Uytterhoeven Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/20250527112403.1254122-4-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 065fe720eec6e627afa24da387ff970afd9a8dcb Author: Thierry Bultel Date: Thu May 15 16:18:20 2025 +0200 clk: renesas: Add support for R9A09G077 SoC RZ/T2H has 2 register blocks at different addresses. The clock tree has configurable dividers and mux selectors. Add these new clock types, new register layout type, and registration code for mux and div in registration callback. Signed-off-by: Thierry Bultel Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250515141828.43444-6-thierry.bultel.yh@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit e5e8a9cce55300c607ff5af3c2d05e910fa15a43 Merge: 3d37ca1482c369 4e591b890afa0c Author: Geert Uytterhoeven Date: Tue Jun 10 10:23:58 2025 +0200 Merge tag 'renesas-r9a09g077-dt-binding-defs-tag' into renesas-clk-for-v6.17 Renesas RZ/T2H DT Binding Definitions DT bindings and binding definitions for the Renesas RZ/T2H (R9A09G077) SoC, shared by driver and DT source files. commit 81807451c2a6af59bbc58adfd0da69870c30d4ab Author: Davide Caratti Date: Wed Jun 4 18:06:05 2025 +0200 can: add drop reasons in CAN protocols receive path sock_queue_rcv_skb() can fail because of lack of memory resources: use drop reasons and pass the receiving socket to the tracepoint, so that it's possible to better locate/debug such events. Tested with: | # modprobe vcan echo=1 | # ip link add name vcan2 type vcan | # ip link set dev vcan2 up | # ./netlayer/tst-proc 1 & | # bg | # while true ; do perf record -e skb:kfree_skb -aR -- \ | > ./raw/tst-raw-sendto vcan2 ; perf script ; done | [...] | tst-raw-sendto 10942 [000] 506428.431856: skb:kfree_skb: skbaddr=0xffff97cec38b4200 rx_sk=0xffff97cf0f75a800 protocol=12 location=raw_rcv+0x20e reason: SOCKET_RCVBUF Signed-off-by: Davide Caratti Link: https://patch.msgid.link/20250604160605.1005704-3-dcaratti@redhat.com Signed-off-by: Marc Kleine-Budde commit 127c49624a0980ee7b8a5ba9094d6942332a48da Author: Davide Caratti Date: Wed Jun 4 18:06:04 2025 +0200 can: add drop reasons in the receive path of AF_CAN Besides the existing pr_warn_once(), use skb drop reasons in case AF_CAN layer drops non-conformant CAN{,FD,XL} frames, or conformant frames received by "wrong" devices, so that it's possible to debug (and count) such events using existing tracepoints: | # perf record -e skb:kfree_skb -aR -- ./drv/canfdtest -v -g -l 1 vcan0 | # perf script | [...] | canfdtest 1123 [000] 3893.271264: skb:kfree_skb: skbaddr=0xffff975703c9f700 rx_sk=(nil) protocol=12 location=can_rcv+0x4b reason: CAN_RX_INVALID_FRAME Signed-off-by: Davide Caratti Link: https://patch.msgid.link/20250604160605.1005704-2-dcaratti@redhat.com Signed-off-by: Marc Kleine-Budde commit 320e7efce30e2613c2c7877acc46a8e71192cdcd Author: André Draszik Date: Tue Jun 3 16:43:21 2025 +0100 clk: samsung: exynos850: fix a comment The code below the updated comment is for CMU_CPUCL1, not CMU_CPUCL0. Fixes: dedf87341ad6 ("clk: samsung: exynos850: Add CMU_CPUCL0 and CMU_CPUCL1") Cc: stable@vger.kernel.org Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250603-samsung-clk-fixes-v1-3-49daf1ff4592@linaro.org Signed-off-by: Krzysztof Kozlowski commit ca243e653f71d8c4724a68c9033923f945b1084d Author: André Draszik Date: Tue Jun 3 16:43:20 2025 +0100 clk: samsung: gs101: fix alternate mout_hsi0_usb20_ref parent clock The alternate parent clock for this mux is mout_pll_usb, not the pll itself. Fixes: 1891e4d48755 ("clk: samsung: gs101: add support for cmu_hsi0") Cc: stable@vger.kernel.org Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250603-samsung-clk-fixes-v1-2-49daf1ff4592@linaro.org Signed-off-by: Krzysztof Kozlowski commit 29a9361f0b50be2b16d308695e30ee030fedea2c Author: André Draszik Date: Tue Jun 3 16:43:19 2025 +0100 clk: samsung: gs101: fix CLK_DOUT_CMU_G3D_BUSD Use the correct Linux clock ID when instantiating the G3D_BUSD div_clock. Fixes: 2c597bb7d66a ("clk: samsung: clk-gs101: Add cmu_top, cmu_misc and cmu_apm support") Cc: stable@vger.kernel.org Signed-off-by: André Draszik Link: https://lore.kernel.org/r/20250603-samsung-clk-fixes-v1-1-49daf1ff4592@linaro.org Signed-off-by: Krzysztof Kozlowski commit 3d37ca1482c36975255f29911a529f84f1bc34a9 Author: Thierry Bultel Date: Thu May 15 16:18:19 2025 +0200 clk: renesas: Pass sub struct of cpg_mssr_priv to cpg_clk_register In a subsequent patch, the registration callback will need more parameters from cpg_mssr_priv (like another base address with clock controllers with double register block, and also, notifiers and rmw_lock). Instead of adding more parameters, move the needed parameters to a public sub-struct. Instead moving clks to this structure, which would have implied to add an allocation (and cleanup) for it, keep the way the allocation is done and just have a copy of the pointer in the public structure. Reviewed-by: Geert Uytterhoeven Signed-off-by: Thierry Bultel Link: https://lore.kernel.org/20250515141828.43444-5-thierry.bultel.yh@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit a68ea80f85bbf7b69f69ef9e17e3e1be14d948c8 Author: Claudiu Beznea Date: Wed May 14 12:04:09 2025 +0300 clk: renesas: rzg2l: Move pointers after hw member Reorder the pointer members in struct mstp_clock so they appear immediately after the hw member. This helps avoid potential padding and eliminates the need for any calculations in the to_mod_clock() macro. As struct clk_hw currently contains only pointers, placing it first also avoids padding. Reviewed-by: Geert Uytterhoeven Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/20250514090415.4098534-3-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 2f96afdffad4ef74e3c511207058c41c54a2d014 Author: Claudiu Beznea Date: Wed May 14 12:04:08 2025 +0300 clk: renesas: rzg2l: Postpone updating priv->clks[] Since the sibling data is filled after the priv->clks[] array entry is populated, the first clock that is probed and has a sibling will temporarily behave as its own sibling until its actual sibling is populated. To avoid any issues, postpone updating priv->clks[] until after the sibling is populated. Signed-off-by: Claudiu Beznea Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514090415.4098534-2-claudiu.beznea.uj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 1bf4adbbf624247928774402f51a64ee4ceb445e Author: Lad Prabhakar Date: Tue May 13 16:46:35 2025 +0100 clk: renesas: r9a09g056: Add clocks and resets for Mali-G31 GPU Add clock and reset support for the Mali-G31 GPU on the Renesas RZ/V2N (R9A09G056) SoC. This includes adding clock sources required for the module clocks. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250513154635.273664-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit e018f9f8973760faacbdf9bf678fdb46c1f591c8 Author: Lad Prabhakar Date: Tue May 13 16:46:34 2025 +0100 clk: renesas: r9a09g056: Add clock and reset entries for WDT controllers Add module clock and reset definitions for WDT0-3, which are available on the RZ/V2N (R9A09G056) SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250513154635.273664-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit d3c25dd1612da7ddf5857190e92b0c36d803c4d9 Author: Lad Prabhakar Date: Tue May 13 16:46:33 2025 +0100 clk: renesas: r9a09g056: Add clock and reset entries for RIIC controllers Add module clock and reset definitions for RIIC controllers 0-8, which are available on the RZ/V2N (R9A09G056) SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250513154635.273664-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 82a0bc727cc2abd5fa6c4e63f0c303a9244a8ca0 Author: Lad Prabhakar Date: Tue May 13 16:46:32 2025 +0100 clk: renesas: r9a09g056-cpg: Add clock and reset entries for OSTM instances Introduce a new fixed divider .pllcln_div16 which is sourced from PLLCLN and add PCLK module clocks gtm_0_pclk through gtm_7_pclk for OSTM0-7. Add corresponding reset lines GTM_0_PRESETZ through GTM_7_PRESETZ to control the OSTM instances. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250513154635.273664-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit bfb0bc6bdfdaa58abeec4c99e9b2cd25e550306d Author: Lad Prabhakar Date: Tue May 13 16:46:31 2025 +0100 clk: renesas: r9a09g056-cpg: Add clock and reset entries for GBETH0/1 Add clock and reset entries for GBETH instances. Include core clocks for PTP, sourced from PLLETH, and add PLLs, dividers, and static mux clocks used as clock sources for the GBETH IP. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250513154635.273664-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 598b2a06702c12916d97640dbfb09bfdbf002c5c Author: Lad Prabhakar Date: Fri May 9 17:01:21 2025 +0100 clk: renesas: r9a09g057: Add clock and reset entries for GBETH0/1 Add clock and reset entries for GBETH instances. Include core clocks for PTP, sourced from PLLETH, and add PLLs, dividers, and static mux clocks used as clock sources for the GBETH IP. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250509160121.331073-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 899e7ede4c19c6778873ddeca312509fa5778f2c Author: Lad Prabhakar Date: Fri May 9 17:01:20 2025 +0100 clk: renesas: rzv2h: Skip monitor checks for external clocks For module clocks whose parent mux may select an external source, bypass the normal monitor (CLK_MON) register check when the external clock is active. Introduce a new `ext_clk_mux_index` in `struct rzv2h_mod_clk` and `struct mod_clock`, and detect the current mux index in `rzv2h_mod_clock_is_enabled()` to disable monitoring if it matches the external source index. Provide the `DEF_MOD_MUX_EXTERNAL()` macro for declaring external-source module clocks, and populate the `ext_clk_mux_index` field in `rzv2h_cpg_register_mod_clk()`. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250509160121.331073-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 9e97db3c075a77d15a6be26541e7dad22dbfc793 Author: Geert Uytterhoeven Date: Mon Jun 2 13:59:52 2025 +0200 documentation: networking: can: Document alloc_candev_mqs() Since the introduction of alloc_candev_mqs() and friends, there is no longer a need to allocate a generic network device and perform explicit CAN-specific setup. Remove the code showing this setup, and document alloc_candev_mqs() instead. Fixes: 39549eef3587f1c1 ("can: CAN Network device driver and Netlink interface") Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/c0f9a706ba31f1a49eb72e58526cd294d97a1ce9.1748865431.git.geert+renesas@glider.be Signed-off-by: Marc Kleine-Budde commit 3064247120238f384ea53c70caad6c7c49d6c465 Merge: 2c7e4a2663a1ab 527b99f44def0d Author: Marc Kleine-Budde Date: Tue Jun 10 10:18:48 2025 +0200 Merge patch series "can: netlink: preparation before introduction of CAN XL" Vincent Mailhol says: An RFC was sent last weekend to kick-off the discussion of the introduction of CAN XL [1]. While the series received some positive feedback, it is far from completion. Some work is still needed to: - adjust the nesting of the IFLA_CAN_XL_DATA_BITTIMING_CONST in the netlink interface - add the CAN XL PWM configuration and this TODO list may grow if more feedback is received. Regardless of this, the RFC started with a tree wide refactor followed by a set of trivial patches to do some clean-up and some renaming in preparation of the introduction of CAN XL. This series just contains those preparation patch which were cherry picked from the RFC and rebased on of top of linux-can-next/main: - the first patch is purely cosmetic and fixes a trivial tabulation mistake. - the last three patches do some renaming: both the CAN FD and the CAN XL have databittiming parameters. In order not to get confused once CAN XL will be introduced, many symbols are modified to explicitly add CAN FD in their names. The goal is to have those merged first to remove some overhead from the netlink CAN XL main series before tacking care of the other comments. [1] [RFC] can: netlink: add CAN XL Link: https://lore.kernel.org/linux-can/20241110155902.72807-16-mailhol.vincent@wanadoo.fr Link: https://patch.msgid.link/20241112165118.586613-7-mailhol.vincent@wanadoo.fr [mkl: adjusted commit message, as patch 1 of the original series is already mainline] Signed-off-by: Marc Kleine-Budde commit e18c3f5cbd0243c60777f7a3a02e4506f5196c31 Author: Friday Yang Date: Wed May 21 17:16:16 2025 +0800 memory: mtk-smi: Add ostd setting for mt8186 Add initial ostd setting for mt8186. All the settings come from DE. These settings help adjust Multimedia HW's bandwidth limits to achieve a balanced bandwidth requirement. Without this, the VENC HW works abnormal while stress testing. Fixes: 86a010bfc739 ("memory: mtk-smi: mt8186: Add smi support") Signed-off-by: Friday Yang Reviewed-by: AngeloGioacchino Del Regno Link: https://lore.kernel.org/r/20250521091626.4283-1-friday.yang@mediatek.com Signed-off-by: Krzysztof Kozlowski commit 04de50163466a0d11b24f6bb418889f3cc219dda Author: Frank Li Date: Mon Jun 2 10:12:45 2025 -0400 dt-bindings: memory-controllers: convert arm,pl172.txt to yaml format Convert arm,pl172.txt to yaml format. Additional changes: - add mpmc,read-enable-delay property. - allow gpio@addr and sram@addr as child node to match existed dts. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250602141246.941448-1-Frank.Li@nxp.com Signed-off-by: Krzysztof Kozlowski commit 952a81b137473cf679c229e7e7e175dce715cd2f Author: Krzysztof Kozlowski Date: Sun May 25 21:06:31 2025 +0200 dt-bindings: soc: samsung: exynos-pmu: Constrain google,pmu-intr-gen-syscon PMU interrupt generation block is not present in older Samsung Exynos SoCs, so restrict the property to Google GS101 only. Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250525190630.41858-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 6d8b18ae647bb456d2a2dac9771d007f243537cf Author: Krzysztof Kozlowski Date: Sun May 25 21:13:00 2025 +0200 memory: stm32_omm: Use syscon_regmap_lookup_by_phandle_args Use syscon_regmap_lookup_by_phandle_args() which is a wrapper over syscon_regmap_lookup_by_phandle() combined with getting the syscon argument. Except simpler code this annotates within one line that given phandle has arguments, so grepping for code would be easier. Reviewed-by: Patrice Chotard Link: https://lore.kernel.org/r/20250525191300.50873-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit 114ab5afdf6640d40c8982170ea78c127c983dad Author: Frank Li Date: Mon Jun 2 10:42:58 2025 -0400 dt-bindings: gpio: convert nxp,lpc1850-gpio.txt to yaml format Convert nxp,lpc1850-gpio.txt to yaml format. Additional changes: - remove interrupt-controller and #interupt-cells from required list to match existed dts files. - remove gpio consumer in examples. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250602144259.944257-1-Frank.Li@nxp.com Signed-off-by: Bartosz Golaszewski commit 6595ea2761df191c2ec500d5f54b57592b969f5c Author: Andy Shevchenko Date: Sat May 31 22:55:44 2025 +0300 gpiolib: Move GPIO_DYNAMIC_* constants to its only user There is no need to export GPIO_DYNAMIC_* constants, especially via legacy header which is subject to remove. Move the mentioned constants to its only user, i.e. gpiolib.c. Signed-off-by: Andy Shevchenko Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250531195801.3632110-3-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski commit 9b4d4c952e28f97c5e653c8b9453690f7e63cc5a Author: Andy Shevchenko Date: Sat May 31 22:55:43 2025 +0300 gpio: Remove unused 'struct gpio' definition There is no user for the legacy 'struct gpio', remove it for good. Signed-off-by: Andy Shevchenko Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250531195801.3632110-2-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski commit 0e3b7b8759a7f3597e64fc12a8a017111edbf777 Author: Frank Li Date: Wed Jun 4 10:46:30 2025 -0400 dt-bindings: gpio: convert gpio-74xx-mmio.txt to yaml format Convert gpio-74xx-mmio.txt to yaml format. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250604144631.1141430-1-Frank.Li@nxp.com Signed-off-by: Bartosz Golaszewski commit a5589313383074c48a1b3751d592a6e084ae0573 Author: Andy Shevchenko Date: Sun Jun 1 00:21:39 2025 +0300 gpiolib: Remove unused devm_gpio_request() Remove devm_gpio_request() due to lack of users. Signed-off-by: Andy Shevchenko Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250531212331.3635269-3-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski commit 32f6d31dc0401e6af7c48e5e2381997b6d957d85 Author: Andy Shevchenko Date: Sun Jun 1 00:21:38 2025 +0300 usb: gadget: pxa25x_udc: Switch to use devm_gpio_request_one() devm_gpio_request() is going to be removed. This driver is only user of that API. Convert it to use different API. Signed-off-by: Andy Shevchenko Acked-by: Greg Kroah-Hartman Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250531212331.3635269-2-andriy.shevchenko@linux.intel.com Signed-off-by: Bartosz Golaszewski commit 08894232efa4b53e7cd064450a6d444b92ab24ae Author: Frank Li Date: Thu May 22 18:37:41 2025 -0400 dt-bindings: gpio: convert gpio-pisosr.txt to yaml format Covert gpio-pisosr.txt to yaml format. Additional changes: - Add ref to spi-peripheral-props.yaml. - Set ngpios max value to 32. Signed-off-by: Frank Li Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250522223742.516254-1-Frank.Li@nxp.com Signed-off-by: Bartosz Golaszewski commit 3cbd627482eabf185893c265dc9ae7c0a1ef24e5 Author: Lad Prabhakar Date: Thu May 15 19:31:03 2025 +0100 arm64: dts: renesas: r9a09g057: Add USB2.0 support The Renesas RZ/V2H(P) ("R9A09G057") SoC supports 1x channel with OTG/DRD and 1x channel with host interface. Add the ECHI, OHCI, USB2.0 PHY and reset control nodes for USB2.0 channels in R9A09G057 SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250515183104.330964-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 6aca83a0a80195005057b56b9f1d9ae6c41620b9 Author: Tommaso Merciai Date: Wed May 14 18:24:20 2025 +0200 arm64: dts: renesas: r9a09g047e57-smarc: Enable CRU, CSI support Enable CRU, I2C0 and CSI on RZ/G3E SMARC EVK and tie the CSI to the OV5645 sensor using Device Tree overlay. RZ/G3E SMARK EVK is a RZ/G2L alike EVK hence reuse rz-smarc-cru-csi-ov5645.dtsi. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514162422.910114-5-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 0acdad4097dbd166d5b12a94e2b58bf4cd5e9ac2 Author: Tommaso Merciai Date: Wed May 14 18:24:19 2025 +0200 arm64: dts: renesas: renesas-smarc2: Enable I2C0 node Enable device I2C0 node for the RZ SMARC Carrier-II Board and set clock frequency to 400kHz. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514162422.910114-4-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit bf3409a6612cb94b03c708350d56a4755e65970d Author: Tommaso Merciai Date: Wed May 14 18:24:18 2025 +0200 arm64: dts: renesas: r9a09g047e57-smarc: Add I2C0 pincontrol Add device node for I2C0 pincontrol. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514162422.910114-3-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c3303e7162184551d82b88311922b7026dfdfdde Author: Tommaso Merciai Date: Wed May 14 18:24:17 2025 +0200 arm64: dts: renesas: r9a09g047: Add CRU, CSI2 nodes Add CRU, CSI2 nodes to RZ/RZG3E SoC DTSI. Signed-off-by: Tommaso Merciai Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514162422.910114-2-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit e3b7980d39116082106a8b3cd067dd8258c94e74 Author: Lad Prabhakar Date: Wed May 14 11:15:28 2025 +0100 arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable Mali-G31 GPU Enable the Mali-G31 GPU on the RZ/V2N EVK. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514101528.41663-11-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 3407963b237da9532d17c421c972ad5f5ec2a536 Author: Lad Prabhakar Date: Wed May 14 11:15:27 2025 +0100 arm64: dts: renesas: r9a09g056: Add Mali-G31 GPU node Add the device tree node for the ARM Mali-G31 GPU found on selected variants of the Renesas RZ/V2N (R9A09G056) SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514101528.41663-10-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit f3e57b92340400e99d0b6341c40692c5cb5ab774 Author: Lad Prabhakar Date: Wed May 14 11:15:26 2025 +0100 arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable WDT1 Enable WDT1 hardware block on the RZ/V2N EVK. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514101528.41663-9-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 7db958983c8dd14d65efdf64dd9cdcd9ce2ad2c6 Author: Lad Prabhakar Date: Wed May 14 11:15:25 2025 +0100 arm64: dts: renesas: r9a09g056: Add WDT0-WDT3 nodes Add WDT0-WDT3 nodes to RZ/V2N ("R9A09G056") SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514101528.41663-8-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit f631c8392c9830f354b8b069f87e5ee19303b5b1 Author: Lad Prabhakar Date: Wed May 14 11:15:24 2025 +0100 arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable RIIC controllers Enable the RIIC controllers 0, 1, 2, 3, 6, 7, and 8 which are populated on the RZ/V2N EVK. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514101528.41663-7-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit ece22fc24b0b23e123fde849340f1344f08fe151 Author: Lad Prabhakar Date: Wed May 14 11:15:23 2025 +0100 arm64: dts: renesas: r9a09g056: Add RIIC controllers Add the nine RIIC controllers present on the Renesas RZ/V2N (R9A09G056) SoC to its DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514101528.41663-6-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 20e32ba344aae133ca3c9dd57287293dd036a881 Author: Lad Prabhakar Date: Wed May 14 11:15:22 2025 +0100 arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable OSTM timers on RZ/V2N EVK Enable OSTM0-OSTM7 instances in the RZ/V2N EVK device tree so that all eight OSTM general timers are active and available. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514101528.41663-5-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 03625d9b7e8545f0699134caf9cba384c1b11bd8 Author: Lad Prabhakar Date: Wed May 14 11:15:21 2025 +0100 arm64: dts: renesas: r9a09g056: Add OSTM0-OSTM7 nodes Add OSTM0-OSTM7 nodes to RZ/V2N ("R9A09G056") SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514101528.41663-4-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit f111192baa80bb33b67270bb987c1be639843c82 Author: Lad Prabhakar Date: Wed May 14 11:15:20 2025 +0100 arm64: dts: renesas: r9a09g056n48-rzv2n-evk: Enable GBETH Enable GBETH nodes on RZ/V2N EVK. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514101528.41663-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit c8c8a57c5b4071a7c7d75ff3af3de7326e120bce Author: Lad Prabhakar Date: Wed May 14 11:15:19 2025 +0100 arm64: dts: renesas: r9a09g056: Add GBETH nodes Renesas RZ/V2N SoC is equipped with 2x Synopsys DesignWare Ethernet Quality-of-Service IP block version 5.20. Add GBETH nodes to R9A09G056 RZ/V2N SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250514101528.41663-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 802292ee27a7bb0b685c00c22cc3ce7ae4ff280e Author: Lad Prabhakar Date: Tue May 13 14:14:12 2025 +0100 arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable GBETH Enable the GBETH nodes on the RZ/V2H Evaluation Kit. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250513131412.253091-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 050ee38d00025771d22348bbf1e9922f8fe8d502 Author: Lad Prabhakar Date: Tue May 13 14:14:11 2025 +0100 arm64: dts: renesas: r9a09g057: Add GBETH nodes Renesas RZ/V2H(P) SoC is equipped with 2x Synopsys DesignWare Ethernet Quality-of-Service IP block version 5.20. Add GBETH nodes to R9A09G057 RZ/V2H(P) SoC DTSI. Signed-off-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250513131412.253091-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 0712fcaebd76a74a022e5ce105ebe96fa8627961 Author: Biju Das Date: Thu May 8 19:31:04 2025 +0100 arm64: dts: renesas: rzg3e-smarc-som: Enable serial NOR FLASH Enable Renesas AT25QL128A FLASH connected to XSPI. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250508183109.137721-3-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 348da7b1cf0c5a7f2081ff42e969baf0c84da4e7 Author: Biju Das Date: Thu May 8 19:31:03 2025 +0100 arm64: dts: renesas: r9a09g047: Add XSPI node Add XSPI node to RZ/G3E ("R9A09G047") SoC DTSI. Signed-off-by: Biju Das Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250508183109.137721-2-biju.das.jz@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit ac02e070627af24a7674334450bfd8e75488c6d2 Author: Geert Uytterhoeven Date: Wed May 14 13:42:50 2025 +0200 dt-bindings: soc: renesas: Document RZ/V2H EVK board part number Signed-off-by: Geert Uytterhoeven Reviewed-by: Chris Paterson Link: https://lore.kernel.org/0a264c102c615e0a1bec2e45cba180298643520c.1747222771.git.geert+renesas@glider.be commit 43f9c5c213074428ce0149f9525b98730422990e Author: Krzysztof Kozlowski Date: Sun May 25 17:34:36 2025 +0200 memory: emif: Add missing kerneldoc for lpmode Add kerneldoc for 'lpmode' struct member to fix W=1 warnings: drivers/memory/emif.c:67 struct member 'lpmode' not described in 'emif_data' Link: https://lore.kernel.org/r/20250525153435.15768-2-krzysztof.kozlowski@linaro.org Signed-off-by: Krzysztof Kozlowski commit b19376dee3da29fe4ea1027ed2061b67efa15112 Author: Thierry Bultel Date: Thu May 15 16:18:18 2025 +0200 soc: renesas: Add RZ/T2H (R9A09G077) config option Add a configuration option for the RZ/T2H SoC. Reviewed-by: Geert Uytterhoeven Signed-off-by: Thierry Bultel Link: https://lore.kernel.org/20250515141828.43444-4-thierry.bultel.yh@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit 527b99f44def0decc39cef434fd26cdaef74d31c Author: Vincent Mailhol Date: Wed Nov 13 01:50:20 2024 +0900 can: netlink: can_changelink(): rename tdc_mask into fd_tdc_flag_provided The only purpose of the tdc_mask variable is to check whether or not any tdc flags (CAN_CTRLMODE_TDC_{AUTO,MANUAL}) were provided. At this point, the actual value of the flags do no matter any more because these can be deduced from some other information. Rename the tdc_mask variable into fd_tdc_flag_provided to make this more explicit. Note that the fd_ prefix is added in preparation of the introduction of CAN XL. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20241112165118.586613-12-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 23c0dc95bfa86503eed9fa99423fa0bb39a3bcb0 Author: Vincent Mailhol Date: Wed Nov 13 01:50:19 2024 +0900 can: bittiming: rename can_tdc_is_enabled() into can_fd_tdc_is_enabled() With the introduction of CAN XL, a new can_xl_tdc_is_enabled() helper function will be introduced later on. Rename can_tdc_is_enabled() into can_fd_tdc_is_enabled() to make it more explicit that this helper is meant for CAN FD. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20241112165118.586613-11-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit bee7e3322a2859a80a67077591128323bbc4052f Author: Vincent Mailhol Date: Wed Nov 13 01:50:18 2024 +0900 can: bittiming: rename CAN_CTRLMODE_TDC_MASK into CAN_CTRLMODE_FD_TDC_MASK With the introduction of CAN XL, a new CAN_CTRLMODE_XL_TDC_MASK will be introduced later on. Because CAN_CTRLMODE_TDC_MASK is not part of the uapi, rename it to CAN_CTRLMODE_FD_TDC_MASK to make it more explicit that this mask is meant for CAN FD. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20241112165118.586613-10-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit d08ad6c8613ba14ce5d0c42b841d754690548fda Author: Vincent Mailhol Date: Wed Nov 13 01:50:17 2024 +0900 can: netlink: replace tabulation by space in assignment commit cfd98c838cbe ("can: netlink: move '=' operators back to previous line (checkpatch fix)") inadvertently introduced a tabulation between the IFLA_CAN_DATA_BITTIMING_CONST array index and the equal sign. Remove it. Signed-off-by: Vincent Mailhol Link: https://patch.msgid.link/20241112165118.586613-9-mailhol.vincent@wanadoo.fr Signed-off-by: Marc Kleine-Budde commit 5fcf896efe28ca11212fdb6594cd709abb7c1735 Merge: 2bc0575fec3647 4a8765d9a5278a Author: Alexei Starovoitov Date: Mon Jun 9 20:11:10 2025 -0700 Merge branch 'bpf-mitigate-spectre-v1-using-barriers' Luis Gerhorst says: ==================== This improves the expressiveness of unprivileged BPF by inserting speculation barriers instead of rejecting the programs. The approach was previously presented at LPC'24 [1] and RAID'24 [2]. To mitigate the Spectre v1 (PHT) vulnerability, the kernel rejects potentially-dangerous unprivileged BPF programs as of commit 9183671af6db ("bpf: Fix leakage under speculation on mispredicted branches"). In [2], we have analyzed 364 object files from open source projects (Linux Samples and Selftests, BCC, Loxilb, Cilium, libbpf Examples, Parca, and Prevail) and found that this affects 31% to 54% of programs. To resolve this in the majority of cases this patchset adds a fall-back for mitigating Spectre v1 using speculation barriers. The kernel still optimistically attempts to verify all speculative paths but uses speculation barriers against v1 when unsafe behavior is detected. This allows for more programs to be accepted without disabling the BPF Spectre mitigations (e.g., by setting cpu_mitigations_off()). For this, it relies on the fact that speculation barriers generally prevent all later instructions from executing if the speculation was not correct (not only loads). See patch 7 ("bpf: Fall back to nospec for Spectre v1") for a detailed description and references to the relevant vendor documentation (AMD and Intel x86-64, ARM64, and PowerPC). In [1] we have measured the overhead of this approach relative to having mitigations off and including the upstream Spectre v4 mitigations. For event tracing and stack-sampling profilers, we found that mitigations increase BPF program execution time by 0% to 62%. For the Loxilb network load balancer, we have measured a 14% slowdown in SCTP performance but no significant slowdown for TCP. This overhead only applies to programs that were previously rejected. I reran the expressiveness-evaluation with v6.14 and made sure the main results still match those from [1] and [2] (which used v6.5). Main design decisions are: * Do not use separate bytecode insns for v1 and v4 barriers (inspired by Daniel Borkmann's question at LPC). This simplifies the verifier significantly and has the only downside that performance on PowerPC is not as high as it could be. * Allow archs to still disable v1/v4 mitigations separately by setting bpf_jit_bypass_spec_v1/v4(). This has the benefit that archs can benefit from improved BPF expressiveness / performance if they are not vulnerable (e.g., ARM64 for v4 in the kernel). * Do not remove the empty BPF_NOSPEC implementation for backends for which it is unknown whether they are vulnerable to Spectre v1. [1] https://lpc.events/event/18/contributions/1954/ ("Mitigating Spectre-PHT using Speculation Barriers in Linux eBPF") [2] https://arxiv.org/pdf/2405.00078 ("VeriFence: Lightweight and Precise Spectre Defenses for Untrusted Linux Kernel Extensions") Changes: * v3 -> v4: - Remove insn parameter from do_check_insn() and extract process_bpf_exit_full as a function as requested by Eduard - Investigate apparent sanitize_check_bounds() bug reported by Kartikeya (does appear to not be a bug but only confusing code), sent separate patch to document it and add an assert - Remove already-merged commit 1 ("selftests/bpf: Fix caps for __xlated/jited_unpriv") - Drop former commit 10 ("bpf: Allow nospec-protected var-offset stack access") as it did not include a test and there are other places where var-off is rejected. Also, none of the tested real-world programs used var-off in the paper. Therefore keep the old behavior for now and potentially prepare a patch that converts all cases later if required. - Add link to AMD lfence and PowerPC speculation barrier (ori 31,31,0) documentation - Move detailed barrier documentation to commit 7 ("bpf: Fall back to nospec for Spectre v1") - Link to v3: https://lore.kernel.org/all/20250501073603.1402960-1-luis.gerhorst@fau.de/ * v2 -> v3: - Fix https://lore.kernel.org/oe-kbuild-all/202504212030.IF1SLhz6-lkp@intel.com/ and similar by moving the bpf_jit_bypass_spec_v1/v4() prototypes out of the #ifdef CONFIG_BPF_SYSCALL. Decided not to move them to filter.h (where similar bpf_jit_*() prototypes live) as they would still have to be duplicated in bpf.h to be usable to bpf_bypass_spec_v1/v4() (unless including filter.h in bpf.h is an option). - Fix https://lore.kernel.org/oe-kbuild-all/202504220035.SoGveGpj-lkp@intel.com/ by moving the variable declarations out of the switch-case. - Build touched C files with W=2 and bpf config on x86 to check that there are no other warnings introduced. - Found 3 more checkpatch warnings that can be fixed without degrading readability. - Rebase to bpf-next 2025-05-01 - Link to v2: https://lore.kernel.org/bpf/20250421091802.3234859-1-luis.gerhorst@fau.de/ * v1 -> v2: - Drop former commits 9 ("bpf: Return PTR_ERR from push_stack()") and 11 ("bpf: Fall back to nospec for spec path verification") as suggested by Alexei. This series therefore no longer changes push_stack() to return PTR_ERR. - Add detailed explanation of how lfence works internally and how it affects the algorithm. - Add tests checking that nospec instructions are inserted in expected locations using __xlated_unpriv as suggested by Eduard (also, include a fix for __xlated_unpriv) - Add a test for the mitigations from the description of commit 9183671af6db ("bpf: Fix leakage under speculation on mispredicted branches") - Remove unused variables from do_check[_insn]() as suggested by Eduard. - Remove INSN_IDX_MODIFIED to improve readability as suggested by Eduard. This also causes the nospec_result-check to run (and fail) for jumping-ops. Add a warning to assert that this check must never succeed in that case. - Add details on the safety of patch 10 ("bpf: Allow nospec-protected var-offset stack access") based on the feedback on v1. - Rebase to bpf-next-250420 - Link to v1: https://lore.kernel.org/all/20250313172127.1098195-1-luis.gerhorst@fau.de/ * RFC -> v1: - rebase to bpf-next-250313 - tests: mark expected successes/new errors - add bpt_jit_bypass_spec_v1/v4() to avoid #ifdef in bpf_bypass_spec_v1/v4() - ensure that nospec with v1-support is implemented for archs for which GCC supports speculation barriers, except for MIPS - arm64: emit speculation barrier - powerpc: change nospec to include v1 barrier - discuss potential security (archs that do not impl. BPF nospec) and performance (only PowerPC) regressions - Link to RFC: https://lore.kernel.org/bpf/20250224203619.594724-1-luis.gerhorst@fau.de/ ==================== Acked-by: Kumar Kartikeya Dwivedi Link: https://patch.msgid.link/20250603205800.334980-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 1190410772090a68995a758c979ba44b986e2df2 Author: Yuzhuo Jing Date: Wed Jun 4 10:36:32 2025 -0700 perf: Fix libjvmti.c sign compare error Fix the compile errors when compiling with -Werror=sign-compare. This is a follow-up patch to a previous patch series for a separate issue. Link: https://lore.kernel.org/lkml/aC9lXhPFcs5fkHWH@x1/ Signed-off-by: Yuzhuo Jing Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250604173632.2362759-1-yuzhuo@google.com Signed-off-by: Namhyung Kim commit ea04fe1b90cbb42966b471a4982bc52215b62857 Author: Aditya Bodkhe Date: Tue Apr 29 12:21:32 2025 +0530 perf script: perf script tests fails with segfault pert script tests fails with segmentation fault as below: 92: perf script tests: --- start --- test child forked, pid 103769 DB test [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.012 MB /tmp/perf-test-script.7rbftEpOzX/perf.data (9 samples) ] /usr/libexec/perf-core/tests/shell/script.sh: line 35: 103780 Segmentation fault (core dumped) perf script -i "${perfdatafile}" -s "${db_test}" --- Cleaning up --- ---- end(-1) ---- 92: perf script tests : FAILED! Backtrace pointed to : #0 0x0000000010247dd0 in maps.machine () #1 0x00000000101d178c in db_export.sample () #2 0x00000000103412c8 in python_process_event () #3 0x000000001004eb28 in process_sample_event () #4 0x000000001024fcd0 in machines.deliver_event () #5 0x000000001025005c in perf_session.deliver_event () #6 0x00000000102568b0 in __ordered_events__flush.part.0 () #7 0x0000000010251618 in perf_session.process_events () #8 0x0000000010053620 in cmd_script () #9 0x00000000100b5a28 in run_builtin () #10 0x00000000100b5f94 in handle_internal_command () #11 0x0000000010011114 in main () Further investigation reveals that this occurs in the `perf script tests`, because it uses `db_test.py` script. This script sets `perf_db_export_mode = True`. With `perf_db_export_mode` enabled, if a sample originates from a hypervisor, perf doesn't set maps for "[H]" sample in the code. Consequently, `al->maps` remains NULL when `maps__machine(al->maps)` is called from `db_export__sample`. As al->maps can be NULL in case of Hypervisor samples , use thread->maps because even for Hypervisor sample, machine should exist. If we don't have machine for some reason, return -1 to avoid segmentation fault. Reported-by: Disha Goel Signed-off-by: Aditya Bodkhe Reviewed-by: Adrian Hunter Tested-by: Disha Goel Link: https://lore.kernel.org/r/20250429065132.36839-1-adityab1@linux.ibm.com Suggested-by: Adrian Hunter Signed-off-by: Namhyung Kim commit 5d939fbdd480cdf276eccc01eda3ed41e37d3f8a Author: Len Brown Date: Mon Jun 9 23:34:04 2025 -0400 tools/power turbostat: regression fix: --show C1E% The new default idle counter groupings broke "--show C1E%" (or any other C-state %) Also delete a stray debug printf from the same offending commit. Reported-by: Zhang Rui Fixes: ec4acd3166d8 ("tools/power turbostat: disable "cpuidle" invocation counters, by default") Signed-off-by: Len Brown commit 4a8765d9a5278a9ff9341678ae60eb4f8d0f5d8c Author: Luis Gerhorst Date: Tue Jun 3 23:28:14 2025 +0200 selftests/bpf: Add test for Spectre v1 mitigation This is based on the gadget from the description of commit 9183671af6db ("bpf: Fix leakage under speculation on mispredicted branches"). Signed-off-by: Luis Gerhorst Acked-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/r/20250603212814.338867-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit d6f1c85f22534d2d9fea9b32645da19c91ebe7d2 Author: Luis Gerhorst Date: Tue Jun 3 23:24:28 2025 +0200 bpf: Fall back to nospec for Spectre v1 This implements the core of the series and causes the verifier to fall back to mitigating Spectre v1 using speculation barriers. The approach was presented at LPC'24 [1] and RAID'24 [2]. If we find any forbidden behavior on a speculative path, we insert a nospec (e.g., lfence speculation barrier on x86) before the instruction and stop verifying the path. While verifying a speculative path, we can furthermore stop verification of that path whenever we encounter a nospec instruction. A minimal example program would look as follows: A = true B = true if A goto e f() if B goto e unsafe() e: exit There are the following speculative and non-speculative paths (`cur->speculative` and `speculative` referring to the value of the push_stack() parameters): - A = true - B = true - if A goto e - A && !cur->speculative && !speculative - exit - !A && !cur->speculative && speculative - f() - if B goto e - B && cur->speculative && !speculative - exit - !B && cur->speculative && speculative - unsafe() If f() contains any unsafe behavior under Spectre v1 and the unsafe behavior matches `state->speculative && error_recoverable_with_nospec(err)`, do_check() will now add a nospec before f() instead of rejecting the program: A = true B = true if A goto e nospec f() if B goto e unsafe() e: exit Alternatively, the algorithm also takes advantage of nospec instructions inserted for other reasons (e.g., Spectre v4). Taking the program above as an example, speculative path exploration can stop before f() if a nospec was inserted there because of Spectre v4 sanitization. In this example, all instructions after the nospec are dead code (and with the nospec they are also dead code speculatively). For this, it relies on the fact that speculation barriers generally prevent all later instructions from executing if the speculation was not correct: * On Intel x86_64, lfence acts as full speculation barrier, not only as a load fence [3]: An LFENCE instruction or a serializing instruction will ensure that no later instructions execute, even speculatively, until all prior instructions complete locally. [...] Inserting an LFENCE instruction after a bounds check prevents later operations from executing before the bound check completes. This was experimentally confirmed in [4]. * On AMD x86_64, lfence is dispatch-serializing [5] (requires MSR C001_1029[1] to be set if the MSR is supported, this happens in init_amd()). AMD further specifies "A dispatch serializing instruction forces the processor to retire the serializing instruction and all previous instructions before the next instruction is executed" [8]. As dispatch is not specific to memory loads or branches, lfence therefore also affects all instructions there. Also, if retiring a branch means it's PC change becomes architectural (should be), this means any "wrong" speculation is aborted as required for this series. * ARM's SB speculation barrier instruction also affects "any instruction that appears later in the program order than the barrier" [6]. * PowerPC's barrier also affects all subsequent instructions [7]: [...] executing an ori R31,R31,0 instruction ensures that all instructions preceding the ori R31,R31,0 instruction have completed before the ori R31,R31,0 instruction completes, and that no subsequent instructions are initiated, even out-of-order, until after the ori R31,R31,0 instruction completes. The ori R31,R31,0 instruction may complete before storage accesses associated with instructions preceding the ori R31,R31,0 instruction have been performed Regarding the example, this implies that `if B goto e` will not execute before `if A goto e` completes. Once `if A goto e` completes, the CPU should find that the speculation was wrong and continue with `exit`. If there is any other path that leads to `if B goto e` (and therefore `unsafe()`) without going through `if A goto e`, then a nospec will still be needed there. However, this patch assumes this other path will be explored separately and therefore be discovered by the verifier even if the exploration discussed here stops at the nospec. This patch furthermore has the unfortunate consequence that Spectre v1 mitigations now only support architectures which implement BPF_NOSPEC. Before this commit, Spectre v1 mitigations prevented exploits by rejecting the programs on all architectures. Because some JITs do not implement BPF_NOSPEC, this patch therefore may regress unpriv BPF's security to a limited extent: * The regression is limited to systems vulnerable to Spectre v1, have unprivileged BPF enabled, and do NOT emit insns for BPF_NOSPEC. The latter is not the case for x86 64- and 32-bit, arm64, and powerpc 64-bit and they are therefore not affected by the regression. According to commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode"), LoongArch is not vulnerable to Spectre v1 and therefore also not affected by the regression. * To the best of my knowledge this regression may therefore only affect MIPS. This is deemed acceptable because unpriv BPF is still disabled there by default. As stated in a previous commit, BPF_NOSPEC could be implemented for MIPS based on GCC's speculation_barrier implementation. * It is unclear which other architectures (besides x86 64- and 32-bit, ARM64, PowerPC 64-bit, LoongArch, and MIPS) supported by the kernel are vulnerable to Spectre v1. Also, it is not clear if barriers are available on these architectures. Implementing BPF_NOSPEC on these architectures therefore is non-trivial. Searching GCC and the kernel for speculation barrier implementations for these architectures yielded no result. * If any of those regressed systems is also vulnerable to Spectre v4, the system was already vulnerable to Spectre v4 attacks based on unpriv BPF before this patch and the impact is therefore further limited. As an alternative to regressing security, one could still reject programs if the architecture does not emit BPF_NOSPEC (e.g., by removing the empty BPF_NOSPEC-case from all JITs except for LoongArch where it appears justified). However, this will cause rejections on these archs that are likely unfounded in the vast majority of cases. In the tests, some are now successful where we previously had a false-positive (i.e., rejection). Change them to reflect where the nospec should be inserted (using __xlated_unpriv) and modify the error message if the nospec is able to mitigate a problem that previously shadowed another problem (in that case __xlated_unpriv does not work, therefore just add a comment). Define SPEC_V1 to avoid duplicating this ifdef whenever we check for nospec insns using __xlated_unpriv, define it here once. This also improves readability. PowerPC can probably also be added here. However, omit it for now because the BPF CI currently does not include a test. Limit it to EPERM, EACCES, and EINVAL (and not everything except for EFAULT and ENOMEM) as it already has the desired effect for most real-world programs. Briefly went through all the occurrences of EPERM, EINVAL, and EACCESS in verifier.c to validate that catching them like this makes sense. Thanks to Dustin for their help in checking the vendor documentation. [1] https://lpc.events/event/18/contributions/1954/ ("Mitigating Spectre-PHT using Speculation Barriers in Linux eBPF") [2] https://arxiv.org/pdf/2405.00078 ("VeriFence: Lightweight and Precise Spectre Defenses for Untrusted Linux Kernel Extensions") [3] https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/technical-documentation/runtime-speculative-side-channel-mitigations.html ("Managed Runtime Speculative Execution Side Channel Mitigations") [4] https://dl.acm.org/doi/pdf/10.1145/3359789.3359837 ("Speculator: a tool to analyze speculative execution attacks and mitigations" - Section 4.6 "Stopping Speculative Execution") [5] https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/software-techniques-for-managing-speculation.pdf ("White Paper - SOFTWARE TECHNIQUES FOR MANAGING SPECULATION ON AMD PROCESSORS - REVISION 5.09.23") [6] https://developer.arm.com/documentation/ddi0597/2020-12/Base-Instructions/SB--Speculation-Barrier- ("SB - Speculation Barrier - Arm Armv8-A A32/T32 Instruction Set Architecture (2020-12)") [7] https://wiki.raptorcs.com/w/images/5/5f/OPF_PowerISA_v3.1C.pdf ("Power ISA™ - Version 3.1C - May 26, 2024 - Section 9.2.1 of Book III") [8] https://www.amd.com/content/dam/amd/en/documents/processor-tech-docs/programmer-references/40332.pdf ("AMD64 Architecture Programmer’s Manual Volumes 1–5 - Revision 4.08 - April 2024 - 7.6.4 Serializing Instructions") Signed-off-by: Luis Gerhorst Acked-by: Kumar Kartikeya Dwivedi Acked-by: Henriette Herzog Cc: Dustin Nguyen Cc: Maximilian Ott Cc: Milan Stephan Link: https://lore.kernel.org/r/20250603212428.338473-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 9124a4508007f146206a279f0c5e81dde314bda1 Author: Luis Gerhorst Date: Tue Jun 3 23:20:24 2025 +0200 bpf: Rename sanitize_stack_spill to nospec_result This is made to clarify that this flag will cause a nospec to be added after this insn and can therefore be relied upon to reduce speculative path analysis. Signed-off-by: Luis Gerhorst Acked-by: Kumar Kartikeya Dwivedi Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan Link: https://lore.kernel.org/r/20250603212024.338154-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit dff883d9e93a7f2f2fa4e38a9444b2c79d6da91a Author: Luis Gerhorst Date: Tue Jun 3 23:17:03 2025 +0200 bpf, arm64, powerpc: Change nospec to include v1 barrier This changes the semantics of BPF_NOSPEC (previously a v4-only barrier) to always emit a speculation barrier that works against both Spectre v1 AND v4. If mitigation is not needed on an architecture, the backend should set bpf_jit_bypass_spec_v4/v1(). As of now, this commit only has the user-visible implication that unpriv BPF's performance on PowerPC is reduced. This is the case because we have to emit additional v1 barrier instructions for BPF_NOSPEC now. This commit is required for a future commit to allow us to rely on BPF_NOSPEC for Spectre v1 mitigation. As of this commit, the feature that nospec acts as a v1 barrier is unused. Commit f5e81d111750 ("bpf: Introduce BPF nospec instruction for mitigating Spectre v4") noted that mitigation instructions for v1 and v4 might be different on some archs. While this would potentially offer improved performance on PowerPC, it was dismissed after the following considerations: * Only having one barrier simplifies the verifier and allows us to easily rely on v4-induced barriers for reducing the complexity of v1-induced speculative path verification. * For the architectures that implemented BPF_NOSPEC, only PowerPC has distinct instructions for v1 and v4. Even there, some insns may be shared between the barriers for v1 and v4 (e.g., 'ori 31,31,0' and 'sync'). If this is still found to impact performance in an unacceptable way, BPF_NOSPEC can be split into BPF_NOSPEC_V1 and BPF_NOSPEC_V4 later. As an optimization, we can already skip v1/v4 insns from being emitted for PowerPC with this setup if bypass_spec_v1/v4 is set. Vulnerability-status for BPF_NOSPEC-based Spectre mitigations (v4 as of this commit, v1 in the future) is therefore: * x86 (32-bit and 64-bit), ARM64, and PowerPC (64-bit): Mitigated - This patch implements BPF_NOSPEC for these architectures. The previous v4-only version was supported since commit f5e81d111750 ("bpf: Introduce BPF nospec instruction for mitigating Spectre v4") and commit b7540d625094 ("powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC"). * LoongArch: Not Vulnerable - Commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode") is the only other past commit related to BPF_NOSPEC and indicates that the insn is not required there. * MIPS: Vulnerable (if unprivileged BPF is enabled) - Commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode") indicates that it is not vulnerable, but this contradicts the kernel and Debian documentation. Therefore, I assume that there exist vulnerable MIPS CPUs (but maybe not from Loongson?). In the future, BPF_NOSPEC could be implemented for MIPS based on the GCC speculation_barrier [1]. For now, we rely on unprivileged BPF being disabled by default. * Other: Unknown - To the best of my knowledge there is no definitive information available that indicates that any other arch is vulnerable. They are therefore left untouched (BPF_NOSPEC is not implemented, but bypass_spec_v1/v4 is also not set). I did the following testing to ensure the insn encoding is correct: * ARM64: * 'dsb nsh; isb' was successfully tested with the BPF CI in [2] * 'sb' locally using QEMU v7.2.15 -cpu max (emitted sb insn is executed for example with './test_progs -t verifier_array_access') * PowerPC: The following configs were tested locally with ppc64le QEMU v8.2 '-machine pseries -cpu POWER9': * STF_BARRIER_EIEIO + CONFIG_PPC_BOOK32_64 * STF_BARRIER_SYNC_ORI (forced on) + CONFIG_PPC_BOOK32_64 * STF_BARRIER_FALLBACK (forced on) + CONFIG_PPC_BOOK32_64 * CONFIG_PPC_E500 (forced on) + STF_BARRIER_EIEIO * CONFIG_PPC_E500 (forced on) + STF_BARRIER_SYNC_ORI (forced on) * CONFIG_PPC_E500 (forced on) + STF_BARRIER_FALLBACK (forced on) * CONFIG_PPC_E500 (forced on) + STF_BARRIER_NONE (forced on) Most of those cobinations should not occur in practice, but I was not able to get an PPC e6500 rootfs (for testing PPC_E500 without forcing it on). In any case, this should ensure that there are no unexpected conflicts between the insns when combined like this. Individual v1/v4 barriers were already emitted elsewhere. Hari's ack is for the PowerPC changes only. [1] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=29b74545531f6afbee9fc38c267524326dbfbedf ("MIPS: Add speculation_barrier support") [2] https://github.com/kernel-patches/bpf/pull/8576 Signed-off-by: Luis Gerhorst Acked-by: Hari Bathini Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan Link: https://lore.kernel.org/r/20250603211703.337860-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 03c68a0f8c68936a0bb915b030693923784724cb Author: Luis Gerhorst Date: Tue Jun 3 23:13:18 2025 +0200 bpf, arm64, powerpc: Add bpf_jit_bypass_spec_v1/v4() JITs can set bpf_jit_bypass_spec_v1/v4() if they want the verifier to skip analysis/patching for the respective vulnerability. For v4, this will reduce the number of barriers the verifier inserts. For v1, it allows more programs to be accepted. The primary motivation for this is to not regress unpriv BPF's performance on ARM64 in a future commit where BPF_NOSPEC is also used against Spectre v1. This has the user-visible change that v1-induced rejections on non-vulnerable PowerPC CPUs are avoided. For now, this does not change the semantics of BPF_NOSPEC. It is still a v4-only barrier and must not be implemented if bypass_spec_v4 is always true for the arch. Changing it to a v1 AND v4-barrier is done in a future commit. As an alternative to bypass_spec_v1/v4, one could introduce NOSPEC_V1 AND NOSPEC_V4 instructions and allow backends to skip their lowering as suggested by commit f5e81d111750 ("bpf: Introduce BPF nospec instruction for mitigating Spectre v4"). Adding bpf_jit_bypass_spec_v1/v4() was found to be preferable for the following reason: * bypass_spec_v1/v4 benefits non-vulnerable CPUs: Always performing the same analysis (not taking into account whether the current CPU is vulnerable), needlessly restricts users of CPUs that are not vulnerable. The only use case for this would be portability-testing, but this can later be added easily when needed by allowing users to force bypass_spec_v1/v4 to false. * Portability is still acceptable: Directly disabling the analysis instead of skipping the lowering of BPF_NOSPEC(_V1/V4) might allow programs on non-vulnerable CPUs to be accepted while the program will be rejected on vulnerable CPUs. With the fallback to speculation barriers for Spectre v1 implemented in a future commit, this will only affect programs that do variable stack-accesses or are very complex. For PowerPC, the SEC_FTR checking in bpf_jit_bypass_spec_v4() is based on the check that was previously located in the BPF_NOSPEC case. For LoongArch, it would likely be safe to set both bpf_jit_bypass_spec_v1() and _v4() according to commit a6f6a95f2580 ("LoongArch, bpf: Fix jit to skip speculation barrier opcode"). This is omitted here as I am unable to do any testing for LoongArch. Hari's ack concerns the PowerPC part only. Signed-off-by: Luis Gerhorst Acked-by: Hari Bathini Cc: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan Link: https://lore.kernel.org/r/20250603211318.337474-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 6b84d7895d78079c76c5c7de052d8db3ec6680c9 Author: Luis Gerhorst Date: Tue Jun 3 22:57:54 2025 +0200 bpf: Return -EFAULT on internal errors This prevents us from trying to recover from these on speculative paths in the future. Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan Link: https://lore.kernel.org/r/20250603205800.334980-4-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit fd508bde5d646fe8b8e664ae7c523d2d467d6c76 Author: Luis Gerhorst Date: Tue Jun 3 22:57:53 2025 +0200 bpf: Return -EFAULT on misconfigurations Mark these cases as non-recoverable to later prevent them from being caught when they occur during speculative path verification. Eduard writes [1]: The only pace I'm aware of that might act upon specific error code from verifier syscall is libbpf. Looking through libbpf code, it seems that this change does not interfere with libbpf. [1] https://lore.kernel.org/all/785b4531ce3b44a84059a4feb4ba458c68fce719.camel@gmail.com/ Signed-off-by: Luis Gerhorst Reviewed-by: Eduard Zingerman Acked-by: Kumar Kartikeya Dwivedi Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan Link: https://lore.kernel.org/r/20250603205800.334980-3-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 8b7df50fd40d7ab3b467c9739965b0e5a02e6113 Author: Luis Gerhorst Date: Tue Jun 3 22:57:52 2025 +0200 bpf: Move insn if/else into do_check_insn() This is required to catch the errors later and fall back to a nospec if on a speculative path. Eliminate the regs variable as it is only used once and insn_idx is not modified in-between the definition and usage. Do not pass insn but compute it in the function itself. As Eduard points out [1], insn is assumed to correspond to env->insn_idx in many places (e.g, __check_reg_arg()). Move code into do_check_insn(), replace * "continue" with "return 0" after modifying insn_idx * "goto process_bpf_exit" with "return PROCESS_BPF_EXIT" * "goto process_bpf_exit_full" with "return process_bpf_exit_full()" * "do_print_state = " with "*do_print_state = " [1] https://lore.kernel.org/all/293dbe3950a782b8eb3b87b71d7a967e120191fd.camel@gmail.com/ Signed-off-by: Luis Gerhorst Acked-by: Kumar Kartikeya Dwivedi Acked-by: Henriette Herzog Cc: Maximilian Ott Cc: Milan Stephan Link: https://lore.kernel.org/r/20250603205800.334980-2-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 34b959213896f208b74ec0e670b3f926dc3acb20 Author: Dmitry Baryshkov Date: Sun Jun 8 19:02:39 2025 +0300 arm64: dts: qcom: sdm850-lenovo-yoga-c630: enable sensors DSP Enable SLPI, Sensors DSP on the Lenovo Yoga C630. The DSP boots the firmware and provides QMI services, however it is of limited functionality due to the missing fastrpc_shell_1 binary. Signed-off-by: Dmitry Baryshkov Reviewed-by: Konrad Dybcio Link: https://lore.kernel.org/r/20250608-c630-slpi-v1-1-72210249e37e@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 793905c70a56255b04e7cff82b01a300fff822be Author: Bitterblue Smith Date: Sat Jun 7 21:01:38 2025 +0300 wifi: rtw88: Enable AP and adhoc modes for SDIO again AP mode can be enabled again for SDIO now that the problem was fixed in commit b2effcdc2379 ("wifi: rtw88: sdio: map mgmt frames to queue TX_DESC_QSEL_MGMT") and commit fc5f5a0ec463 ("wifi: rtw88: sdio: call rtw_sdio_indicate_tx_status unconditionally"). Signed-off-by: Bitterblue Smith Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/5ac60c1c-9cc8-41b8-871c-a067e74f70ea@gmail.com commit 57d6be36cf422e259955d72d994fd1fb668104f8 Author: Bitterblue Smith Date: Sat Jun 7 20:59:53 2025 +0300 wifi: rtw88: Rename the RTW_WCPU_11{AC,N} enums The RTW_WCPU_11AC and RTW_WCPU_11N enums are used to identify two types of microcontrollers used in Realtek chips, but these names are misleading. The "11AC" type was also used in 11n devices (e.g. RTL8733BU, not supported by rtw88), and the "11N" type was also used in 11ac devices (RTL8821AU, RTL8812AU). Rename RTW_WCPU_11AC to RTW_WCPU_3081 and RTW_WCPU_11N to RTW_WCPU_8051. (8051 is well known. It's less clear what 3081 is, but the out of tree drivers use this name.) Signed-off-by: Bitterblue Smith Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/bfb1099c-db52-4b25-b111-17ab712e9404@gmail.com commit 8a2bd44062347f56ee09a645eb24b47c45457909 Author: Bjorn Andersson Date: Thu Jun 5 18:39:15 2025 -0500 arm64: dts: qcom: x1e80100-dell-xps13-9345: Enable fingerprint sensor The fingerprint sensor, hidden in the power button, is connected to one of the USB multiport ports; while the other port is unused. Describe the USB controller, the four phys and the repeater involved to make the fingerprint sensor operational. Tested-by: Stefan Schmidt Reviewed-by: Bryan O'Donoghue Tested-by: Aleksandrs Vinarskis Reviewed-by: Konrad Dybcio Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20250605-xps13-fingerprint-v2-1-eebf84c172f2@oss.qualcomm.com Signed-off-by: Bjorn Andersson commit 389e578dd2803099f78d2ec1fe680d0fb0f3f66c Author: Kuan-Chung Chen Date: Fri Jun 6 10:04:37 2025 +0800 wifi: rtw89: 8922a: pass channel information when enter LPS Newer firmware requires the driver to pass channel information when switching from normal mode to low power mode; otherwise it will result in poor RX beacon performance. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250606020437.17160-1-pkshih@realtek.com commit d310eaf4ad51ad738c31848483abb2f45834819a Author: Kuan-Chung Chen Date: Fri Jun 6 10:04:08 2025 +0800 wifi: rtw89: add chip_ops::chan_to_rf18_val to get code of RF register value The RF 0x18 register stores radio frequency domain parameters, including band, center channel and bandwidth. This information is used in RF domain. Add a chip_ops to retrieve the RF 0x18 value, which allows driver to query for a specific channel. No logic is changed. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250606020408.17035-1-pkshih@realtek.com commit b0efb82651afce32999ebeba1f48ad2c5f53a356 Author: Ping-Ke Shih Date: Fri Jun 6 10:03:00 2025 +0800 wifi: rtw89: mac: add dummy handler of MAC C2H event class 27 The newer firmware add new C2H event class 27, which is to report WiFi role status. Since rtw89 doesn't use the status yet, add a dummy handler to avoid warning: rtw89_8922ae 0000:03:00.0: MAC c2h class 27 func 0 not support Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250606020302.16873-5-pkshih@realtek.com commit b9b8828fdf8c5871ee2e7e701c907547285ff311 Author: Ping-Ke Shih Date: Fri Jun 6 10:02:59 2025 +0800 wifi: rtw89: rfk: support IQK firmware command v1 Add new IQK firmware command format v1 (with suffix), and rename original command format to v0 for older firmware. Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250606020302.16873-4-pkshih@realtek.com commit 29dc4c560219ef0b2fa667d5f1f1e8df11e38f5a Author: Zong-Zhe Yang Date: Fri Jun 6 10:02:58 2025 +0800 wifi: rtw89: fw: add RFE type to RF TSSI H2C command Append a new field for RFE (RF Front End) type to RF TSSI H2C command. FW has forward compatibility when handling this H2C command, so just need to consider backward cases in FW point of view. | old FW | new FW ------------------------------ old driver | O | X ------------------------------ new driver | O | O Currently only RTL8922A uses this RF TSSI H2C command. Increase its FW format max and will let new FW binary align with it. Then, old driver won't load new FW. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250606020302.16873-3-pkshih@realtek.com commit 4bcef86b13316511bb336a26140fc4130c3a65a2 Author: Kuan-Chung Chen Date: Fri Jun 6 10:02:57 2025 +0800 wifi: rtw89: 8852c: increase beacon loss to 6 seconds Intermittent beacon loss from a specific AP causes the connection to be lost. Increasing the beacon loss count can make the connection more stable. Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250606020302.16873-2-pkshih@realtek.com commit 9d2c232d575a8c8dfa66276ed7edccfac482a4df Author: Kassey Li Date: Wed May 21 09:17:11 2025 +0800 scsi: trace: Show rtn in string for scsi_dispatch_cmd_error() By default the scsi_dispatch_cmd_error() return value is displayed in decimal: kworker/3:1H-183 [003] .... 51.035474: scsi_dispatch_cmd_error: host_no=0 channel=0 id=0 lun=4 data_sgl=1 prot_sgl=0 prot_op=SCSI_PROT_NORMAL cmnd=(READ_10 lba=3907214 txlen=1 protect=0 raw=28 00 00 3b 9e 8e 00 00 01 00) rtn=4181 However, these numbers are not particularly helpful wrt. debugging errors. Especially since the kernel code consistently uses the following defines in hexadecimal: SCSI_MLQUEUE_HOST_BUSY 0x1055 SCSI_MLQUEUE_DEVICE_BUSY 0x1056 SCSI_MLQUEUE_EH_RETRY 0x1057 SCSI_MLQUEUE_TARGET_BUSY 0x1058 Switch to using the string form of these values in the trace output: dd-1059 [007] ..... 31.689529: scsi_dispatch_cmd_error: host_no=0 channel=0 id=0 lun=4 data_sgl=65 prot_sgl=0 prot_op=SCSI_PROT_NORMAL driver_tag=23 scheduler_tag=117 cmnd=(READ_10 lba=0 txlen=128 protect=0 raw=28 00 00 00 00 00 00 00 80 00) rtn=SCSI_MLQUEUE_DEVICE_BUSY Signed-off-by: Kassey Li Link: https://lore.kernel.org/r/20250521011711.1983625-1-quic_yingangl@quicinc.com Signed-off-by: Martin K. Petersen commit ae7795a8c2582b5fb7971132753810a3f158e7b2 Author: Huan Tang Date: Fri May 23 14:46:04 2025 +0800 scsi: ufs: core: Add HID support Follow JESD220G, support HID(Host Initiated Defragmentation) through sysfs, the relevant sysfs nodes are as follows: 1. analysis_trigger 2. defrag_trigger 3. fragmented_size 4. defrag_size 5. progress_ratio 6. state The detailed definition of the six nodes can be found in the sysfs documentation. HID's execution policy is given to user-space. Signed-off-by: Huan Tang Signed-off-by: Wenxing Cheng Link: https://lore.kernel.org/r/20250523064604.800-1-tanghuan@vivo.com Suggested-by: Bart Van Assche Reviewed-by: Peter Wang Reviewed-by: Bean Huo Reviewed-by: Bart Van Assche Reviewed-by: Yangtao Li Signed-off-by: Martin K. Petersen commit c6503be73fa37034fac87c1ffed9f2a82adb5441 Author: Alok Tiwari Date: Sat Jun 7 09:22:56 2025 -0700 scsi: fc_transport: docs: Add documentation for FC Remote Ports This patch updates the scsi_fc_transport.rst documentation by replacing the outdated << To Be Supplied >> placeholder under the "FC Remote Ports (rports)" section with a detailed explanation of remote port functionality in the Fibre Channel (FC) transport class. The new documentation covers: - What rports are and their role in FC-based SCSI communication - Their representation in sysfs (/sys/class/fc_remote_ports/) - Common sysfs attributes such as (port_id, port_name, node_name, and port_state). - Their typical lifecycle (creation and removal) - Guidance for driver developers on using fc_remote_port_add() and fc_remote_port_delete() This change improves the completeness and usefulness of the FC transport documentation for developers and users interacting with Fibre Channel drivers in the Linux SCSI subsystem Signed-off-by: Alok Tiwari Link: https://lore.kernel.org/r/20250607162304.1765430-1-alok.a.tiwari@oracle.com Signed-off-by: Martin K. Petersen commit fe30a8ae853bade282fce63e740b5f34bdc55f6e Author: Kuan-Chung Chen Date: Thu Jun 5 19:42:07 2025 +0800 wifi: rtw89: fix EHT 20MHz TX rate for non-AP STA The 4-octet EHT MCS/NSS subfield is only used for 20 MHz-only non-AP STA. Correct the interpretation of this subfield to prevent improper rate limitations. Fixes: f1dfcee2eae9 ("wifi: rtw89: Correct EHT TX rate on 20MHz connection") Signed-off-by: Kuan-Chung Chen Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250605114207.12381-6-pkshih@realtek.com commit 28bb3d842e8f1ef0fb83257334e9d5cb1cff3d70 Author: Eric Huang Date: Thu Jun 5 19:42:06 2025 +0800 wifi: rtw89: add EHT physts and adjust init flow accordingly Adding EHT physts and adjust IE bitmap initialization. This setting is for PHY statistic gathering, won't effect functionality. Signed-off-by: Eric Huang Signed-off-by: Po-Hao Huang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250605114207.12381-5-pkshih@realtek.com commit edba3f107844bbf91b7b89272d3d26c5c0d19a37 Author: Zong-Zhe Yang Date: Thu Jun 5 19:42:05 2025 +0800 wifi: rtw89: implement channel switch support To support channel switch on STA mode, declare IEEE80211_HW_CHANCTX_STA_CSA and implement ieee80211_ops::switch_vif_chanctx. Handling of CSA procedure still relies on mac80211 SW flow, since FW doesn't support chanctx offload. To support channel switch on AP mode, declare WIPHY_FLAG_HAS_CHANNEL_SWITCH and implement ieee80211_ops::channel_switch_beacon additionally. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250605114207.12381-4-pkshih@realtek.com commit 6c661eec292cd62a7c7abced8e91fc1b6ebf7f3a Author: Zong-Zhe Yang Date: Thu Jun 5 19:42:04 2025 +0800 wifi: rtw89: chan: re-config default chandef only when none is registered Previously, default chandef is configured if no chanctx is active, i.e. no chanctx is assigned to some vif. For normal cases, it's fine. However, for impending CSA support, need to consider that one chanctx may be added, or called registered, ahead without being assigned immediately. Then, it will keep inactive, and might be covered by the default one when re-calculating chanctxs happens in certain sequences. So now, don't re-config the default chandef unless no chanctx is registered. Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250605114207.12381-3-pkshih@realtek.com commit 6cd93f85af7a1573c2fdb1da8977cd200a1c157e Author: Zong-Zhe Yang Date: Thu Jun 5 19:42:03 2025 +0800 wifi: rtw89: chan: concentrate the logic of setting/clearing chanctx bitmap Originally, the logic for setting bits was wrapped inside the configuring function. However, raw clearing bits, clear_bit, was called directly. To be more paired and more understandable. Concentrate the logic of them into the same function. (don't change logic at all) Signed-off-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250605114207.12381-2-pkshih@realtek.com commit dad7aafa5216e307b357b801668451a3b8945810 Author: Fedor Pchelkin Date: Wed Jun 4 19:13:33 2025 +0300 wifi: rtw89: sar: do not assert wiphy lock held until probing is done rtw89_sar_set_src() may be called at driver early init phase when applying SAR configuration via ACPI. wiphy lock is not held there. Since the assertion was initially added for rtw89_apply_sar_common() call path and may be helpful for other places in future changes, keep it but move it under RTW89_FLAG_PROBE_DONE test. Found by Linux Verification Center (linuxtesting.org). Fixes: 88ca3107d2ce ("wifi: rtw89: sar: add skeleton for SAR configuration via ACPI") Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250604161339.119954-2-pchelkin@ispras.ru commit 6fe21445f7e801de5527d420f8e25e97b0cdd7e2 Author: Fedor Pchelkin Date: Wed Jun 4 19:13:32 2025 +0300 wifi: rtw89: sar: drop lockdep assertion in rtw89_set_sar_from_acpi The following assertion is triggered on the rtw89 driver startup. It looks meaningless to hold wiphy lock on the early init stage so drop the assertion. WARNING: CPU: 7 PID: 629 at drivers/net/wireless/realtek/rtw89/sar.c:502 rtw89_set_sar_from_acpi+0x365/0x4d0 [rtw89_core] CPU: 7 UID: 0 PID: 629 Comm: (udev-worker) Not tainted 6.15.0+ #29 PREEMPT(lazy) Hardware name: LENOVO 21D0/LNVNB161216, BIOS J6CN50WW 09/27/2024 RIP: 0010:rtw89_set_sar_from_acpi+0x365/0x4d0 [rtw89_core] Call Trace: rtw89_sar_init+0x68/0x2c0 [rtw89_core] rtw89_core_init+0x188e/0x1e50 [rtw89_core] rtw89_pci_probe+0x530/0xb50 [rtw89_pci] local_pci_probe+0xd9/0x190 pci_call_probe+0x183/0x540 pci_device_probe+0x171/0x2c0 really_probe+0x1e1/0x890 __driver_probe_device+0x18c/0x390 driver_probe_device+0x4a/0x120 __driver_attach+0x1a0/0x530 bus_for_each_dev+0x10b/0x190 bus_add_driver+0x2eb/0x540 driver_register+0x1a3/0x3a0 do_one_initcall+0xd5/0x450 do_init_module+0x2cc/0x8f0 init_module_from_file+0xe1/0x150 idempotent_init_module+0x226/0x760 __x64_sys_finit_module+0xcd/0x150 do_syscall_64+0x94/0x380 entry_SYSCALL_64_after_hwframe+0x76/0x7e Found by Linux Verification Center (linuxtesting.org). Fixes: 88ca3107d2ce ("wifi: rtw89: sar: add skeleton for SAR configuration via ACPI") Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250604161339.119954-1-pchelkin@ispras.ru commit 74f3516f94f404d2c91ec886fbb35cc6eddaa055 Author: Fedor Pchelkin Date: Tue Jun 3 18:31:23 2025 +0300 wifi: rtw89: fix spelling mistake of RTW89_FLAG_FORBIDDEN_TRACK_WORK Rename RTW89_FLAG_FORBIDDEN_TRACK_WROK -> RTW89_FLAG_FORBIDDEN_TRACK_WORK. Found by Linux Verification Center (linuxtesting.org). Signed-off-by: Fedor Pchelkin Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250603153124.188755-1-pchelkin@ispras.ru commit 53cf488927a0f79968f9c03c4d1e00d2a79731c3 Author: Dan Carpenter Date: Wed May 28 11:11:02 2025 +0300 wifi: rtw89: mcc: prevent shift wrapping in rtw89_core_mlsr_switch() The "link_id" value comes from the user via debugfs. If it's larger than BITS_PER_LONG then that would result in shift wrapping and potentially an out of bounds access later. In fact, we can limit it to IEEE80211_MLD_MAX_NUM_LINKS (15). Fortunately, only root can write to debugfs files so the security impact is minimal. Fixes: 9dd85e739ce0 ("wifi: rtw89: debug: add mlo_mode dbgfs") Signed-off-by: Dan Carpenter Reviewed-by: Zong-Zhe Yang Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/aDbFFkX09K7FrL9h@stanley.mountain commit 8b0b14614c1566de7857d6ee29e27ec9ac740578 Author: Hannes Reinecke Date: Thu Jun 5 08:20:14 2025 +0200 scsi: fcoe: Remove fcoe_select_cpu() The function fcoe_select_cpu() is just used to distribute incoming skbs which start a new FC command sequence. But the network stack already received (and processed) that skb, and there is a _really_ good chance that all subsequent skbs for this sequence will be handled with the same CPU. So we should just use the CPU on which this skb was allocated on and save ourselves some overhead due to pointless scheduling. Signed-off-by: Hannes Reinecke Link: https://lore.kernel.org/r/20250605062014.105302-1-hare@kernel.org Signed-off-by: Martin K. Petersen commit 16e3d93c6183649a3b210f82b83c1cb12aa5e8a3 Author: Chin-Yen Lee Date: Fri May 23 14:27:11 2025 +0800 wifi: rtw89: pci: add PCI Express error handling Sometimes PCIe Advanced Error Reporting(AER), like bad TLP or Data link protocol error, happens due to unstable pci signal or no response from PCI host. pcieport 0000:00:1c.0: AER: Uncorrected (Non-Fatal) error message received from 0000:01:00.0 rtw89_8852be 0000:01:00.0: PCIe Bus Error: severity=Uncorrected (Non-Fatal), type=Transaction Layer, (Requester ID) rtw89_8852be 0000:01:00.0: device [10ec:b852] error status/mask=00004000/00400000 rtw89_8852be 0000:01:00.0: [14] CmpltTO (First) rtw89_8852be 0000:01:00.0: SER catches error: 0x4000 pcieport 0000:00:1c.0: AER: device recovery successful rtw89_8852be 0000:01:00.0: FW backtrace invalid key: 0xbb6c3214 ieee80211 phy0: Hardware restart was requested Setup callback function to call SER function to reset driver to recover from these states. Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250523062711.27213-3-pkshih@realtek.com commit cdb82c80b9349ed1d9ce6b49856128e04f4effc9 Author: Chin-Yen Lee Date: Fri May 23 14:27:10 2025 +0800 wifi: rtw88: pci: add PCI Express error handling Sometimes PCIe Advanced Error Reporting(AER), like bad TLP or Data link protocol error, happens due to unstable pci signal or no response from PCI host. pcieport 0000:00:00.0: AER: Multiple Corrected error message received from 0000:00:00.0 pcieport 0000:00:00.0: AER: PCIe Bus Error: severity=Corrected, type=Physical Layer, (Receiver ID) pcieport 0000:00:00.0: AER: device [14c3:6786] error status/mask=000000c1/00006000 pcieport 0000:00:00.0: AER: [ 0] RxErr (First) pcieport 0000:00:00.0: AER: [ 6] BadTLP pcieport 0000:00:00.0: AER: [ 7] BadDLLP pcieport 0000:00:00.0: AER: Corrected error message received from 0000:00:00.0 pcieport 0000:00:00.0: AER: found no error details for 0000:00:00.0 pcieport 0000:00:00.0: AER: Multiple Corrected error message received from 0000:00:00.0 pcieport 0000:00:00.0: AER: found no error details for 0000:00:00.0 pcieport 0000:00:00.0: AER: Multiple Corrected error message received from 0000:00:00.0 pcieport 0000:00:00.0: AER: found no error details for 0000:00:00.0 Setup callback function to call SER function to reset driver to recover from these states Signed-off-by: Chin-Yen Lee Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/20250523062711.27213-2-pkshih@realtek.com commit 4c95423b6f01a50505308d2eaec2da2a2bcd3139 Author: Christophe JAILLET Date: Sat May 17 18:46:14 2025 +0200 wifi: rtlwifi: Constify struct rtl_hal_ops and rtl_hal_cfg 'struct rtl_hal_ops' and 'struct rtl_hal_cfg' are not modified in these drivers. Constifying this structure moves some data to a read-only section, so increase overall security, especially when the structure holds some function pointers. Constification of rtl_hal_cfg is only needed in rtl8192cu/sw.c On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 10167 5512 128 15807 3dbf drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.o After: ===== text data bss dec hex filename 10743 4936 128 15807 3dbf drivers/net/wireless/realtek/rtlwifi/rtl8188ee/sw.o Signed-off-by: Christophe JAILLET Signed-off-by: Ping-Ke Shih Link: https://patch.msgid.link/2c3f3d8d8b2f7dcb8cc64cebe89e55720d1d733d.1747500351.git.christophe.jaillet@wanadoo.fr commit 2bc0575fec3647b204ad3a438661605117a60146 Author: Tao Chen Date: Sat Jun 7 00:58:18 2025 +0800 bpf: Add cookie in fdinfo for raw_tp Add cookie in fdinfo for raw_tp, the info as follows: link_type: raw_tracepoint link_id: 31 prog_tag: 9dfdf8ef453843bf prog_id: 32 tp_name: sys_enter cookie: 23925373020405760 Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606165818.3394397-5-chen.dylane@linux.dev commit 380cb6dfa2bffea6fc14291e8f789b46dfb6a713 Author: Tao Chen Date: Sat Jun 7 00:58:17 2025 +0800 bpf: Add cookie in fdinfo for tracing Add cookie in fdinfo for tracing, the info as follows: link_type: tracing link_id: 6 prog_tag: 9dfdf8ef453843bf prog_id: 35 attach_type: 25 target_obj_id: 1 target_btf_id: 60355 cookie: 9007199254740992 Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606165818.3394397-4-chen.dylane@linux.dev commit ad954cbe084935b42e50d665fcbf2f8ac1df8c7e Author: Tao Chen Date: Sat Jun 7 00:58:16 2025 +0800 bpftool: Display cookie for tracing link probe Display cookie for tracing link probe, in plain mode: #bpftool link 5: tracing prog 34 prog_type tracing attach_type trace_fentry target_obj_id 1 target_btf_id 60355 cookie 4503599627370496 pids test_progs(176) And in json mode: #bpftool link -j | jq { "id": 5, "type": "tracing", "prog_id": 34, "prog_type": "tracing", "attach_type": "trace_fentry", "target_obj_id": 1, "target_btf_id": 60355, "cookie": 4503599627370496, "pids": [ { "pid": 176, "comm": "test_progs" } ] } Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606165818.3394397-3-chen.dylane@linux.dev commit d77efc0ef5b0adb0de3c15f5c9d33ea6d60bd449 Author: Tao Chen Date: Sat Jun 7 00:58:15 2025 +0800 selftests/bpf: Add cookies check for tracing fill_link_info test Adding tests for getting cookie with fill_link_info for tracing. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606165818.3394397-2-chen.dylane@linux.dev commit c7beb48344d2ea0f3f1869b078309dbeb2ed4c96 Author: Tao Chen Date: Sat Jun 7 00:58:14 2025 +0800 bpf: Add cookie to tracing bpf_link_info bpf_tramp_link includes cookie info, we can add it in bpf_link_info. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606165818.3394397-1-chen.dylane@linux.dev commit f3effef2e8976c6b0edfd849129417ad3b5eab00 Merge: 97ebac58865dec 260b8629189611 Author: Andrii Nakryiko Date: Mon Jun 9 16:42:05 2025 -0700 Merge branch 'bpf-make-reg_not_null-true-for-const_ptr_to_map' Ihor Solodrai says: ==================== bpf: make reg_not_null() true for CONST_PTR_TO_MAP Handle CONST_PTR_TO_MAP null checks in the BPF verifier. Add appropriate test cases. v3->v4: more test cases v2->v3: change constant in unpriv test v1->v2: add a test case with ringbufs v3: https://lore.kernel.org/bpf/20250604222729.3351946-1-isolodrai@meta.com/ v2: https://lore.kernel.org/bpf/20250604003759.1020745-1-isolodrai@meta.com/ v1: https://lore.kernel.org/bpf/20250523232503.1086319-1-isolodrai@meta.com/ ==================== Link: https://patch.msgid.link/20250609183024.359974-1-isolodrai@meta.com Signed-off-by: Andrii Nakryiko commit 260b8629189611ab5c4894205955b371bed9b75d Author: Ihor Solodrai Date: Mon Jun 9 11:30:24 2025 -0700 selftests/bpf: Add test cases with CONST_PTR_TO_MAP null checks A test requires the following to happen: * CONST_PTR_TO_MAP value is checked for null * the code in the null branch fails verification Add test cases: * direct global map_ptr comparison to null * lookup inner map, then two checks (the first transforms map_value_or_null into map_ptr) * lookup inner map, spill-fill it, then check for null * use an array of ringbufs to recreate a common coding pattern [1] [1] https://lore.kernel.org/bpf/CAEf4BzZNU0gX_sQ8k8JaLe1e+Veth3Rk=4x7MDhv=hQxvO8EDw@mail.gmail.com/ Suggested-by: Andrii Nakryiko Signed-off-by: Ihor Solodrai Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250609183024.359974-4-isolodrai@meta.com commit eb6c99278490a9045662cbc2df9e2a99489df37a Author: Ihor Solodrai Date: Mon Jun 9 11:30:23 2025 -0700 selftests/bpf: Add cmp_map_pointer_with_const test Add a test for CONST_PTR_TO_MAP comparison with a non-0 constant. A BPF program with this code must not pass verification in unpriv. Signed-off-by: Ihor Solodrai Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250609183024.359974-3-isolodrai@meta.com commit 5534e58f2e9bd72b253d033ee0af6e68eb8ac96b Author: Ihor Solodrai Date: Mon Jun 9 11:30:22 2025 -0700 bpf: Make reg_not_null() true for CONST_PTR_TO_MAP When reg->type is CONST_PTR_TO_MAP, it can not be null. However the verifier explores the branches under rX == 0 in check_cond_jmp_op() even if reg->type is CONST_PTR_TO_MAP, because it was not checked for in reg_not_null(). Fix this by adding CONST_PTR_TO_MAP to the set of types that are considered non nullable in reg_not_null(). An old "unpriv: cmp map pointer with zero" selftest fails with this change, because now early out correctly triggers in check_cond_jmp_op(), making the verification to pass. In practice verifier may allow pointer to null comparison in unpriv, since in many cases the relevant branch and comparison op are removed as dead code. So change the expected test result to __success_unpriv. Signed-off-by: Ihor Solodrai Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250609183024.359974-2-isolodrai@meta.com commit 97ebac58865dec1bca31140252386daefef1654f Author: Tao Chen Date: Fri Jun 6 23:02:58 2025 +0800 bpf: Add show_fdinfo for perf_event After commit 1b715e1b0ec5 ("bpf: Support ->fill_link_info for perf_event") add perf_event info, we can also show the info with the method of cat /proc/[fd]/fdinfo. kprobe fdinfo: link_type: perf link_id: 10 prog_tag: bcf7977d3b93787c prog_id: 20 name: bpf_fentry_test1 offset: 0x0 missed: 0 addr: 0xffffffffa28a2904 event_type: kprobe cookie: 3735928559 uprobe fdinfo: link_type: perf link_id: 13 prog_tag: bcf7977d3b93787c prog_id: 21 name: /proc/self/exe offset: 0x63dce4 ref_ctr_offset: 0x33eee2a event_type: uprobe cookie: 3735928559 tracepoint fdinfo: link_type: perf link_id: 11 prog_tag: bcf7977d3b93787c prog_id: 22 tp_name: sched_switch event_type: tracepoint cookie: 3735928559 perf_event fdinfo: link_type: perf link_id: 12 prog_tag: bcf7977d3b93787c prog_id: 23 type: 1 config: 2 event_type: event cookie: 3735928559 Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606150258.3385166-1-chen.dylane@linux.dev commit 4d2815a1cc3dffde425acc448247d74ccdc94bc9 Merge: e41079f53e8792 e422d5f118e4da Author: Andrii Nakryiko Date: Mon Jun 9 16:17:12 2025 -0700 Merge branch 'bpf-implement-mprog-api-on-top-of-existing-cgroup-progs' Yonghong Song says: ==================== bpf: Implement mprog API on top of existing cgroup progs Current cgroup prog ordering is appending at attachment time. This is not ideal. In some cases, users want specific ordering at a particular cgroup level. For example, in Meta, we have a case where three different applications all have cgroup/setsockopt progs and they require specific ordering. Current approach is to use a bpfchainer where one bpf prog contains multiple global functions and each global function can be freplaced by a prog for a specific application. The ordering of global functions decides the ordering of those application specific bpf progs. Using bpfchainer is a centralized approach and is not desirable as one of applications acts as a daemon. The decentralized attachment approach is more favorable for those applications. To address this, the existing mprog API ([2]) seems an ideal solution with supporting BPF_F_BEFORE and BPF_F_AFTER flags on top of existing cgroup bpf implementation. More specifically, the support is added for prog/link attachment with BPF_F_BEFORE and BPF_F_AFTER. The kernel mprog interface ([2]) is not used and the implementation is directly done in cgroup bpf code base. The mprog 'revision' is also implemented in attach/detach/replace, so users can query revision number to check the change of cgroup prog list. The patch set contains 5 patches. Patch 1 adds revision support for cgroup bpf progs. Patch 2 implements mprog API implementation for prog/link attach and revision update. Patch 3 adds a new libbpf API to do cgroup link attach with flags like BPF_F_BEFORE/BPF_F_AFTER. Patches 4 and 5 add two tests to validate the implementation. [1] https://lore.kernel.org/r/20250224230116.283071-1-yonghong.song@linux.dev [2] https://lore.kernel.org/r/20230719140858.13224-2-daniel@iogearbox.net Changelogs: v4 -> v5: - v4: https://lore.kernel.org/bpf/20250530173812.1823479-1-yonghong.song@linux.dev/ - Remove early prog/link checking based flags and id_or_fd as later code will do checking as well. - Do proper cgroup flag checking for bpf_prog_attach(). v3 -> v4: - v3: https://lore.kernel.org/bpf/20250517162720.4077882-1-yonghong.song@linux.dev/ - Refactor some to make BPF_F_BEFORE/BPF_F_AFTER handling easier to understand. - Perviously, I degraded 'link' to 'prog' for later mprog handling. This is not correct. Similar to mprog.c, we should be check 'link' instead link->prog since it is possible two different links may have the same underlying prog and we do not want to miss supporting such use case. v2 -> v3: - v2: https://lore.kernel.org/bpf/20250508223524.487875-1-yonghong.song@linux.dev/ - Big change to replace get_anchor_prog() to get_prog_list() so the 'struct bpf_prog_list *' is returned directly. - Support 'BPF_F_BEFORE | BPF_F_AFTER' attachment if the prog list is empty and flags do not have 'BPF_F_LINK | BPF_F_ID' and id_or_fd is 0. - Add BPF_F_LINK support. - Patch 4 is added to reuse id_from_prog_fd() and id_from_link_fd(). v1 -> v2: - v1: https://lore.kernel.org/bpf/20250411011523.1838771-1-yonghong.song@linux.dev/ - Change cgroup_bpf.revisions from atomic64_t to u64. - Added missing bpf_prog_put in various places. - Rename get_cmp_prog() to get_anchor_prog(). The implementation tries to find the anchor prog regardless of whether id_or_fd is non-NULL or not. - Rename bpf_cgroup_prog_attached() to is_cgroup_prog_type() and handle BPF_PROG_TYPE_LSM properly (with BPF_LSM_CGROUP attach type). - I kept 'id || id_or_fd' condition as the condition 'id' is also used in mprog.c so I assume it is okay in cgroup.c as well. ==================== Link: https://patch.msgid.link/20250606163131.2428225-1-yonghong.song@linux.dev Signed-off-by: Andrii Nakryiko commit e422d5f118e4da5d15b57c5721ee68ae39b512ec Author: Yonghong Song Date: Fri Jun 6 09:31:56 2025 -0700 selftests/bpf: Add two selftests for mprog API based cgroup progs Two tests are added: - cgroup_mprog_opts, which mimics tc_opts.c ([1]). Both prog and link attach are tested. Some negative tests are also included. - cgroup_mprog_ordering, which actually runs the program with some mprog API flags. [1] https://github.com/torvalds/linux/blob/master/tools/testing/selftests/bpf/prog_tests/tc_opts.c Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606163156.2429955-1-yonghong.song@linux.dev commit c1bb68656bc18fd59bbd630fd1b5a86875b464b3 Author: Yonghong Song Date: Fri Jun 6 09:31:51 2025 -0700 selftests/bpf: Move some tc_helpers.h functions to test_progs.h Move static inline functions id_from_prog_fd() and id_from_link_fd() from prog_tests/tc_helpers.h to test_progs.h so these two functions can be reused for later cgroup mprog selftests. Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606163151.2429325-1-yonghong.song@linux.dev commit 1d6711667cb358fd2971c760a67b4fe843179d15 Author: Yonghong Song Date: Fri Jun 6 09:31:46 2025 -0700 libbpf: Support link-based cgroup attach with options Currently libbpf supports bpf_program__attach_cgroup() with signature: LIBBPF_API struct bpf_link * bpf_program__attach_cgroup(const struct bpf_program *prog, int cgroup_fd); To support mprog style attachment, additionsl fields like flags, relative_{fd,id} and expected_revision are needed. Add a new API: LIBBPF_API struct bpf_link * bpf_program__attach_cgroup_opts(const struct bpf_program *prog, int cgroup_fd, const struct bpf_cgroup_opts *opts); where bpf_cgroup_opts contains all above needed fields. Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606163146.2429212-1-yonghong.song@linux.dev commit 1209339844601ec1766f4ff430673fbcfe42bb51 Author: Yonghong Song Date: Fri Jun 6 09:31:41 2025 -0700 bpf: Implement mprog API on top of existing cgroup progs Current cgroup prog ordering is appending at attachment time. This is not ideal. In some cases, users want specific ordering at a particular cgroup level. To address this, the existing mprog API seems an ideal solution with supporting BPF_F_BEFORE and BPF_F_AFTER flags. But there are a few obstacles to directly use kernel mprog interface. Currently cgroup bpf progs already support prog attach/detach/replace and link-based attach/detach/replace. For example, in struct bpf_prog_array_item, the cgroup_storage field needs to be together with bpf prog. But the mprog API struct bpf_mprog_fp only has bpf_prog as the member, which makes it difficult to use kernel mprog interface. In another case, the current cgroup prog detach tries to use the same flag as in attach. This is different from mprog kernel interface which uses flags passed from user space. So to avoid modifying existing behavior, I made the following changes to support mprog API for cgroup progs: - The support is for prog list at cgroup level. Cross-level prog list (a.k.a. effective prog list) is not supported. - Previously, BPF_F_PREORDER is supported only for prog attach, now BPF_F_PREORDER is also supported by link-based attach. - For attach, BPF_F_BEFORE/BPF_F_AFTER/BPF_F_ID/BPF_F_LINK is supported similar to kernel mprog but with different implementation. - For detach and replace, use the existing implementation. - For attach, detach and replace, the revision for a particular prog list, associated with a particular attach type, will be updated by increasing count by 1. Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606163141.2428937-1-yonghong.song@linux.dev commit 9b8367b604c739947ec308874f087fe0eb80f412 Author: Yonghong Song Date: Fri Jun 6 09:31:36 2025 -0700 cgroup: Add bpf prog revisions to struct cgroup_bpf One of key items in mprog API is revision for prog list. The revision number will be increased if the prog list changed, e.g., attach, detach or replace. Add 'revisions' field to struct cgroup_bpf, representing revisions for all cgroup related attachment types. The initial revision value is set to 1, the same as kernel mprog implementations. Signed-off-by: Yonghong Song Signed-off-by: Andrii Nakryiko Acked-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250606163136.2428732-1-yonghong.song@linux.dev commit d3f825032091fc14c7d5e34bcd54317ae4246903 Author: Swapnil Sapkal Date: Wed Apr 30 06:25:59 2025 +0000 docs/sched: Make the sched-stats documentation consistent pull_task(), the original function to move the task from src_rq to the dst_rq during load balancing was renamed to move_tasks() in commit ddcdf6e7d991 ("sched: Rename load-balancing fields") As a part of commit 163122b7fcfa ("sched/fair: Remove double_lock_balance() from load_balance()"), move_task() was broken down into detach_tasks() and attach_tasks() pair to avoid holding locks of both src_rq and dst_rq at the same time during load balancing. Despite the evolution of pull_task() over the years, the sched-stats documentation remained unchanged. Update the documentation to refer to detach_task() instead of pull_task() which is responsible for removing the task from the src_rq during load balancing. commit 1c055a0f5d3b ("sched: Move sched domain name out of CONFIG_SCHED_DEBUG") moves sched domain name out of CONFIG_SCHED_DEBUG. Update the documentation related to that. Reviewed-by: K Prateek Nayak Suggested-by: Shrikanth Hegde Signed-off-by: Swapnil Sapkal Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250430062559.1188661-1-swapnil.sapkal@amd.com commit 112fe8c2f8daa7b4a691d5f8a64923ccc9093ce8 Author: Hanne-Lotta Mäenpää Date: Thu May 22 14:52:55 2025 +0300 docs: Fix typos, improve grammar in Userspace API Fix a typo and improve wording and punctuation in the documentation for Userspace API. Reviewed-by: Mark Pearson Signed-off-by: Hanne-Lotta Mäenpää Link: https://lore.kernel.org/r/20250522115255.137450-4-hannelotta@gmail.com Signed-off-by: Jonathan Corbet commit b7833731d13eb6c10a546dbd7befbc28a3586faa Author: Hanne-Lotta Mäenpää Date: Thu May 22 14:52:54 2025 +0300 docs: Improve grammar in Userspace API/fwctl Fix typos and improve grammar in the documentation for fwctl subsystem. Use the word user space consistently, instead of having two variants (user space vs. userspace). Change wording of denied behaviour to be disallowed behaviour when describing the interface. Reviewed-by: Dave Jiang Signed-off-by: Hanne-Lotta Mäenpää Link: https://lore.kernel.org/r/20250522115255.137450-3-hannelotta@gmail.com Signed-off-by: Jonathan Corbet commit 0116765035eb3de7a6e7656c6c5ae48e68cfdfe4 Author: Shashank Balaji Date: Tue May 27 23:55:58 2025 +0900 sched_deadline, docs: add affinity setting with cgroup2 cpuset controller Setting the cpu affinity mask of a SCHED_DEADLINE process using the cgroup v1 cpuset controller is already detailed. Add similar information for cgroup v2's cpuset controller. Signed-off-by: Shashank Balaji Reviewed-by: Juri Lelli Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250527-sched-deadline-cpu-affinity-v2-2-b8b40a4feefa@sony.com commit ab8531cdb1182ab38bc962a2abd06155404a269e Author: Shashank Balaji Date: Tue May 27 23:55:57 2025 +0900 sched_deadline, docs: replace rt-app examples with chrt or use config.json rt-app no longer accepts command-line arguments. So, replace rt-app example with chrt and use the JSON format in the other example instead of command- line arguments. Signed-off-by: Shashank Balaji Reviewed-by: Juri Lelli Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250527-sched-deadline-cpu-affinity-v2-1-b8b40a4feefa@sony.com commit c361f76da69624ed83d208fbb704d54ae491c52e Author: Brigham Campbell Date: Tue May 27 23:41:47 2025 -0600 docs: powerpc: Add htm.rst to table of contents Fix the following documentation build error, which was introduced when Documentation/arch/powerpc/htm.rst was added to the repository without any reference to the document. Documentation/arch/powerpc/htm.rst: WARNING: document isn't included in any toctree [toc.not_included] Fixes: ab1456c5aa7a ("powerpc/pseries/htmdump: Add documentation for H_HTM debugfs interface") Acked-by: Randy Dunlap Tested-by: Randy Dunlap Signed-off-by: Brigham Campbell Tested-by: Athira Rajeev Fixes: ab1456c5aa7a63d5 ("powerpc/pseries/htmdump: Add documentation for H_HTM debugfs interface") Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250528054146.2658537-2-me@brighamcampbell.com commit fc6edeea53f46fc6a903bb8adf1776345c8eb6e2 Author: Collin Funk Date: Sat Jun 7 20:12:40 2025 -0700 docs: Remove reiserfsprogs from dependencies. The reiserfsprogs package is no longer needed since ReiserFS was removed in Linux 6.13. Furthermore, the package is no longer maintained. Signed-off-by: Collin Funk Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/2d6b194b33e8aacd12999b6ddfe21b5753c1171c.1749352106.git.collin.funk1@gmail.com commit b143745249c00fc1807a35bdac4a7cfe01d3e351 Author: Collin Funk Date: Sat Jun 7 20:12:39 2025 -0700 ver_linux: Remove checks for reiserfsprogs. The reiserfsprogs package is no longer needed since ReiserFS was removed in Linux 6.13. Signed-off-by: Collin Funk Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/4d9808b5e3a87eab41d5d0417d453800faad98b1.1749352106.git.collin.funk1@gmail.com commit 2af88a039f224ebc838169d1ae5ac34fa12fd686 Author: Jonathan Corbet Date: Wed Jun 4 08:18:40 2025 -0600 docs: CSS: make cross-reference links more evident The Sphinx Alabaster theme uses border-bottom to mark reference links; the result does not render correctly (the underline is missing) in some browser configurations. Switch to using the standard text-underline property, and use text-underline-offset to place that underline below any underscores in the underlined text. Suggested-by: Nícolas F. R. A. Prado Tested-by: Nícolas F. R. A. Prado Reviewed-by: Nícolas F. R. A. Prado Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit d6d1df92c25fd51ab9062db28ef17b2baf72d241 Author: Jonathan Corbet Date: Wed Jun 4 08:18:04 2025 -0600 docs: automarkup: Mark up undocumented entities too The automarkup code generates markup and a cross-reference link for functions, structs, etc. for which it finds kerneldoc documentation. Undocumented entities are left untouched; that creates an inconsistent reading experience and has caused some writers to go to extra measures to cause the markup to happen. Mark up detected C entities regardless of whether they are documented. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit 2bf83bdbb2b7852614e9d67d695e8cdfb842d6e2 Author: Jonathan Corbet Date: Tue Jun 3 09:53:22 2025 -0600 docs: automarkup: Remove some Sphinx 2 holdovers Remove a few declarations that are no longer doing anything now that we have left Sphinx 2 behind. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet commit 8666a352dc1738f6302382d9d64611a44978d369 Author: Jonathan Corbet Date: Fri Jun 6 10:34:38 2025 -0600 docs: kdoc: some final touches for process_name() Add some comments to process_name() to cover its broad phases of operation, and slightly restructure the if/then/else structure to remove some early returns. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250606163438.229916-10-corbet@lwn.net commit 0682bde2c7f44320c621b765f31a0cf24e01b23f Author: Jonathan Corbet Date: Fri Jun 6 10:34:37 2025 -0600 docs: kdoc: move the declaration regexes out of process_name() Move two complex regexes up with the other patterns, decluttering this function and allowing the compilation to be done once rather than for every kerneldoc comment. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250606163438.229916-9-corbet@lwn.net commit b23c71080b6cb0c12d4962321e5266814f980da1 Author: Jonathan Corbet Date: Fri Jun 6 10:34:36 2025 -0600 docs: kdoc: remove some ineffective code The code testing for a pointer declaration in process_name() has no actual effect on subsequent actions; remove it. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250606163438.229916-8-corbet@lwn.net commit f9b4cf2e8518387d4c512d934137dc6968759ec4 Author: Jonathan Corbet Date: Fri Jun 6 10:34:35 2025 -0600 docs: kdoc: remove the KernelEntry::descr pseudo member The entry.descr value used in process_name() is not actually a member of the KernelEntry class; it is a bit of local state. So just manage it locally. A trim_whitespace() helper was added to clean up the code slightly. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250606163438.229916-7-corbet@lwn.net commit 8f4650fe1a74e68f5c6715413a5a26aa1564780d Author: Jonathan Corbet Date: Fri Jun 6 10:34:34 2025 -0600 docs: kdoc: remove the KernelEntry::is_kernel_comment member entry::is_kernel_comment never had anything to do with the entry itself; it is a bit of local state in one branch of process_name(). It can, in fact, be removed entirely; rework the code slightly so that it is no longer needed. No change in the rendered output. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250606163438.229916-6-corbet@lwn.net commit e76a1d2b2623e9f10e2ffd295ae2615bf3228561 Author: Jonathan Corbet Date: Fri Jun 6 10:34:33 2025 -0600 docs: kdoc: simplify the kerneldoc recognition code process_name() looks for the first line of a kerneldoc comment. It contains two nearly identical regular expressions, the second of which only catches six cases in the kernel, all of the form: define SOME_MACRO_NAME - description Simply put the "define" into the regex and discard it, eliminating the loop and the code to remove it specially. Note that this still treats these defines as if they were functions, but that's a separate issue. There is no change in the generated output. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250606163438.229916-5-corbet@lwn.net commit 42592bd46dded5fab5af1d5e04c9b17cbb4bca6d Author: Jonathan Corbet Date: Fri Jun 6 10:34:32 2025 -0600 docs: kdoc: remove the section_intro variable It is only used in one place, so just put the constant string "Introduction" there so people don't have to go looking for it. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250606163438.229916-4-corbet@lwn.net commit cef8c781ca71ddd0777d639775e66f8630359342 Author: Jonathan Corbet Date: Fri Jun 6 10:34:31 2025 -0600 docs: kdoc: move the core dispatch into a state table Since all of the handlers already nicely have the same prototype, put them into a table and call them from there and take out the extended if-then-else series. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250606163438.229916-3-corbet@lwn.net commit e8f0303e8b8dce911536963c89eaf0a5ccb62d6a Author: Jonathan Corbet Date: Fri Jun 6 10:34:30 2025 -0600 docs: kdoc: simplify the PROTO continuation logic Remove the unneeded "cont" variable and tighten up the code slightly. Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250606163438.229916-2-corbet@lwn.net commit ea08e53d4d94738f0dfc9e8571d9696cb392600e Author: Runji Liu Date: Mon May 26 21:40:46 2025 +0800 docs: trace: boottime-trace.rst: fix typo Replace misspelled "eariler" with "earlier" and drop the stray period after "example". Signed-off-by: Runji Liu Acked-by: Steven Rostedt (Google) Acked-by: Masami Hiramatsu (Google) Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250526134046.1042-1-runjiliu.tech@gmail.com commit 1598878875645e2546d1343977a8305eb58bfb23 Author: Matthew Wilcox (Oracle) Date: Wed Jun 4 20:57:51 2025 +0100 doc: Include scatterlist APIs in htmldocs We have all this fine kernel-doc written, and it's not published anywhere. Expose it to public view. Signed-off-by: Matthew Wilcox (Oracle) Tested-by: Randy Dunlap Acked-by: Randy Dunlap Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250604195753.823742-1-willy@infradead.org commit d6fa0ca959db8efd4462d7beef4bdc5568640fd0 Author: Marek Vasut Date: Mon Jun 9 22:02:06 2025 +0200 regulator: rpi-panel-v2: Add missing GPIOLIB dependency Add missing GPIOLIB dependency reported by the LKP test robot. This fixes the following report: " kismet warnings: (new ones prefixed by >>) >> kismet: WARNING: unmet direct dependencies detected for GPIO_REGMAP when selected by REGULATOR_RASPBERRYPI_TOUCHSCREEN_V2 WARNING: unmet direct dependencies detected for GPIO_REGMAP Depends on [n]: GPIOLIB [=n] Selected by [y]: - REGULATOR_RASPBERRYPI_TOUCHSCREEN_V2 [=y] && REGULATOR [=y] && I2C [=y] " Fixes: d49305862fdc ("regulator: rpi-panel-v2: Add regulator for 7" Raspberry Pi 720x1280") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202506092341.enbNKMOR-lkp@intel.com/ Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20250609200242.31271-1-marek.vasut+renesas@mailbox.org Signed-off-by: Mark Brown commit 27ad33b6b349c8c76fdef3bf0f707158ce7c275e Author: Matthew Wilcox (Oracle) Date: Fri Jun 6 15:15:42 2025 +0100 kernel-doc: Fix symbol matching for dropped suffixes The support for dropping "_noprof" missed dropping the suffix from exported symbols. That meant that using the :export: feature would look for kernel-doc for (eg) krealloc_noprof() and not find the kernel-doc for krealloc(). Fixes: 51a7bf0238c2 (scripts/kernel-doc: drop "_noprof" on function prototypes) Signed-off-by: Matthew Wilcox (Oracle) Reviewed-by: Mauro Carvalho Chehab Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/20250606141543.1285671-1-willy@infradead.org commit 97d91036a4ccbfd402bc8420d970cea250b2bb3c Author: Collin Funk Date: Sun Jun 8 19:13:30 2025 -0700 docs: packing: Fix a typo in example code. Fix misspelling of "typedef". Signed-off-by: Collin Funk Signed-off-by: Jonathan Corbet Link: https://lore.kernel.org/r/e532b992a79999d3405a363db4b2bd4504fed592.1749434907.git.collin.funk1@gmail.com commit 0998f0ac308c14f7a0750e9c24fe2083a817d8fb Author: Yury Norov [NVIDIA] Date: Wed Jun 4 20:21:37 2025 -0400 workqueue: fix opencoded cpumask_next_and_wrap() in wq_select_unbound_cpu() The dedicated helper is more verbose and effective comparing to cpumask_first() followed by cpumask_next(). Signed-off-by: Yury Norov [NVIDIA] Signed-off-by: Tejun Heo commit 63e37590cd73b0aaf0dbee3c8bdb00c3ff77c8da Author: Howard Chu Date: Wed May 28 12:11:48 2025 -0700 perf test trace: Change the regex pattern in the struct test Ian mentioned a reliably occurred failure in the trace_btf_general test where he obtained trace output of: sleep/279619 clock_nanosleep(0, 0, {1,1,}, 0x7ffcd47b6450) = 0 But the regex pattern used for verification is "^sleep/[0-9]+ clock_nanosleep\(0, 0, \{1,\}, ..." This lead to a mismatch. The reason is, different sleep commands use different timespec data to call clock_nanosleep, on my machine, the value of tv_nsec is 0. ~~~ $ sudo /tmp/perf/perf trace -e clock_nanosleep -- sleep 1 0.000 (1000.196 ms): sleep/54261 clock_nanosleep(rqtp: { .tv_sec: 1, .tv_nsec: 0 }, rmtp: 0x7ffe13529550) = 0 ~~~ While Ian had this trace log: ~~~ $ sudo /tmp/perf/perf trace -e clock_nanosleep -- sleep 1 0.000 (1000.208 ms): sleep/1710732 clock_nanosleep(rqtp: { .tv_sec: 1, .tv_nsec: 1 }, rmtp: 0x7ffc091f4090) = 0 ~~~ Because sleep's behavior of setting 'tv_nsec' is not certain, and tv_sec is most definitely 1, this patch relaxes the key regex pattern to '\{1,.*\}' for a better chance of matching. Signed-off-by: Howard Chu Tested-by: Namhyung Kim Link: https://lore.kernel.org/r/20250528191148.89118-7-howardchu95@gmail.com Reported-by: Ian Rogers Signed-off-by: Namhyung Kim commit 77e11efedba606af21224ee5ed5305aebbd029da Author: Howard Chu Date: Wed May 28 12:11:47 2025 -0700 perf test trace: Use --sort-events in BTF general tests Without the '--sort-events' flag, perf trace doesn't receive and process events based on their arrival time, thus PERF_RECORD_COMM event that assigns the correct comm to a PID, may be delivered and processed after regular samples, causing trace outputs not having a 'comm', e.g. 'mv', instead, having the default PID placeholder, e.g. ':14514'. Hopefully this answers Namhyung's question in [1]. You can simply justify the statement with this diff: [2]. Now, simply run this command multiple times: $ touch /tmp/file1 && sudo /tmp/perf trace -e renameat* -- mv /tmp/file1 /tmp/file2 && rm -f /tmp/file2 And you should see two types of results: $ touch /tmp/file1 && sudo /tmp/perf trace -e renameat* -- mv /tmp/file1 /tmp/file2 && rm -f /tmp/file2 [debug] deliver [debug] machine__process_comm_event [OVERRIDE] old :1221169 new mv str mv [debug] deliver [debug] deliver [debug] deliver [debug] deliver [debug] deliver [debug] deliver [debug] deliver [debug] deliver [debug] deliver [debug] deliver 0.000 ( 0.013 ms): mv/1221169 renameat2(olddfd: CWD, oldname: "/tmp/file1", newdfd: CWD, newname: "/tmp/file2", flags: NOREPLACE) = 0 [debug] deliver $ touch /tmp/file1 && sudo /tmp/perf trace -e renameat* -- mv /tmp/file1 /tmp/file2 && rm -f /tmp/file2 [debug] deliver [debug] deliver [debug] deliver [debug] deliver [debug] deliver [debug] deliver [debug] deliver 0.000 ( 0.014 ms): :1221398/1221398 renameat2(olddfd: CWD, oldname: "/tmp/file1", newdfd: CWD, newname: "/tmp/file2", flags: NOREPLACE) = 0 [debug] deliver [debug] deliver [debug] machine__process_comm_event [OVERRIDE] old :1221398 new mv str mv [debug] deliver [debug] deliver [debug] deliver Anyway, use --sort-events in BTF general tests to avoid :PID, a comm is preferred. [1]: https://lore.kernel.org/linux-perf-users/Z_AeswETE5xLcPT8@google.com/ [2]: https://gist.githubusercontent.com/Sberm/6b72b2a1cf1c62244f1f996481769baf/raw/529667bd74a2e7e1953bbd4be545bf875da8a3e7/unsorted.patch Signed-off-by: Howard Chu Tested-by: Namhyung Kim Link: https://lore.kernel.org/r/20250528191148.89118-6-howardchu95@gmail.com Signed-off-by: Namhyung Kim commit d796c51ee52a10413435816ebdae8a0aa8df8f93 Author: Howard Chu Date: Wed May 28 12:11:46 2025 -0700 perf test trace: Remove set -e for BTF general tests Remove set -e and print error messages in BTF general tests. Before: $ sudo /tmp/perf test btf -vv 108: perf trace BTF general tests: 108: perf trace BTF general tests : Running --- start --- test child forked, pid 889299 Checking if vmlinux BTF exists Testing perf trace's string augmentation String augmentation test failed ---- end(-1) ---- 108: perf trace BTF general tests : FAILED! After: $ sudo /tmp/perf test btf -vv 108: perf trace BTF general tests: 108: perf trace BTF general tests : Running --- start --- test child forked, pid 886551 Checking if vmlinux BTF exists Testing perf trace's string augmentation String augmentation test failed, output: :886566/886566 renameat2(CWD, "/tmp/file1_RcMa", CWD, "/tmp/file2_RcMa", NOREPLACE) = 0---- end(-1) ---- 108: perf trace BTF general tests : FAILED! Signed-off-by: Howard Chu Tested-by: Namhyung Kim Link: https://lore.kernel.org/r/20250528191148.89118-5-howardchu95@gmail.com Signed-off-by: Namhyung Kim commit fc4a0ae7e19ed1d921202414b525aa275e831b64 Author: Howard Chu Date: Wed May 28 12:11:45 2025 -0700 perf test trace: Stop tracing hrtimer_setup event in trace enum test The event 'timer:hrtimer_setup' is relatively new, for older kernels, perf trace enum tests won't run as the event 'timer:hrtimer_setup' cannot be found. It was originally called 'timer:hrtimer_init', before being renamed in: commit 244132c4e577 ("tracing/timers: Rename the hrtimer_init event to hrtimer_setup") Using timer:hrtimer_start should be enough for current testing, and hopefully 'start' won't be renamed in the future. Before: $ sudo /tmp/perf test enum -vv 107: perf trace enum augmentation tests: 107: perf trace enum augmentation tests : Running --- start --- test child forked, pid 786187 Checking if vmlinux exists Tracing syscall landlock_add_rule Tracing non-syscall tracepoint timer:hrtimer_setup,timer:hrtimer_start [tracepoint failure] Failed to trace timer:hrtimer_setup,timer:hrtimer_start tracepoint, output: event syntax error: 'timer:hrtimer_setup,timer:hrtimer_start' \___ unknown tracepoint Error: File /sys/kernel/tracing//events/timer/hrtimer_setup not found. Hint: Perhaps this kernel misses some CONFIG_ setting to enable this feature?. Run 'perf list' for a list of valid events Usage: perf trace [] [] or: perf trace [] -- [] or: perf trace record [] [] or: perf trace record [] -- [] -e, --event event/syscall selector. use 'perf list' to list available events ---- end(-1) ---- 107: perf trace enum augmentation tests : FAILED! After: $ sudo /tmp/perf test enum -vv 107: perf trace enum augmentation tests: 107: perf trace enum augmentation tests : Running --- start --- test child forked, pid 808547 Checking if vmlinux exists Tracing syscall landlock_add_rule Tracing non-syscall tracepoint timer:hrtimer_start ---- end(0) ---- 107: perf trace enum augmentation tests : Ok Signed-off-by: Howard Chu Tested-by: Namhyung Kim Link: https://lore.kernel.org/r/20250528191148.89118-4-howardchu95@gmail.com Signed-off-by: Namhyung Kim commit 78fc8bfe44bf4326fd295572ca2a6b01489459e6 Author: Howard Chu Date: Wed May 28 12:11:44 2025 -0700 perf test trace: Remove set -e and print trace test's error messages Currently perf test utilizes the set -e option in shell that exit immediately if a command exits with a non-zero status, this prevents further error handling and introduces ambiguity. This patch removes set -e and prints the error message after invoking perf trace during perf tests. In my case, the command that exits with a non-zero status is perf trace instead of grep, because it can't find the 'timer:hrtimer_setup' tracepoint, see below. Before: $ sudo /tmp/perf test enum -vv 107: perf trace enum augmentation tests: 107: perf trace enum augmentation tests : Running --- start --- test child forked, pid 783533 Checking if vmlinux exists Tracing syscall landlock_add_rule Tracing non-syscall tracepoint syscall ---- end(-1) ---- 107: perf trace enum augmentation tests : FAILED! After: $ sudo /tmp/perf test enum -vv 107: perf trace enum augmentation tests: 107: perf trace enum augmentation tests : Running --- start --- test child forked, pid 851658 Checking if vmlinux exists Tracing syscall landlock_add_rule Tracing non-syscall tracepoint timer:hrtimer_setup,timer:hrtimer_start [tracepoint failure] Failed to trace tracepoint timer:hrtimer_setup,timer:hrtimer_start, output: event syntax error: 'timer:hrtimer_setup,timer:hrtimer_start' \___ unknown tracepoint Error: File /sys/kernel/tracing//events/timer/hrtimer_setup not found. Hint: Perhaps this kernel misses some CONFIG_ setting to enable this feature?. Run 'perf list' for a list of valid events Usage: perf trace [] [] or: perf trace [] -- [] or: perf trace record [] [] or: perf trace record [] -- [] -e, --event event/syscall selector. use 'perf list' to list available events---- end(-1) ---- 107: perf trace enum augmentation tests : FAILED! Signed-off-by: Howard Chu Tested-by: Namhyung Kim Link: https://lore.kernel.org/r/20250528191148.89118-3-howardchu95@gmail.com Signed-off-by: Namhyung Kim commit 6612d4d4910d45b15dee4a989b1aa2ddce8cc617 Author: Howard Chu Date: Wed May 28 12:11:43 2025 -0700 perf test trace: Use shell's -f flag to check if vmlinux exists To match the style of the existing codebase, no functional changes were applied. Signed-off-by: Howard Chu Tested-by: Namhyung Kim Link: https://lore.kernel.org/r/20250528191148.89118-2-howardchu95@gmail.com Signed-off-by: Namhyung Kim commit 46e34646ae3e0e38da2454e2205ab49c6f97c578 Author: Howard Chu Date: Sun Jun 1 10:32:52 2025 -0700 perf trace: Remove --map-dump documentation The --map-dump option was removed in 5e6da6be3082 ("perf trace: Migrate BPF augmentation to use a skeleton"), this patch removes its remaining documentation. Fixes: 5e6da6be3082 ("perf trace: Migrate BPF augmentation to use a skeleton") Signed-off-by: Howard Chu Link: https://lore.kernel.org/r/20250601173252.717780-1-howardchu95@gmail.com Signed-off-by: Namhyung Kim commit 5ae6a303c22a07234108430b5fba869d5d1697e3 Author: Ian Rogers Date: Tue Jun 3 15:13:58 2025 -0700 tools/build: Remove some unused libbpf pre-1.0 feature test logic Commit 76a97cf2e169 ("perf build: Remove libbpf pre-1.0 feature tests") removed the libbpf feature test logic used by perf in favor of using LIBBPF_MAJOR_VERSION. Remove some build targets that should have been removed as part of that clean up. Fixes: 76a97cf2e169 ("perf build: Remove libbpf pre-1.0 feature tests") Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250603221358.2562167-1-irogers@google.com Signed-off-by: Namhyung Kim commit 5128492b2b6bb3a2881e135da54fd8e224a5f610 Author: Ian Rogers Date: Wed Jun 4 10:45:44 2025 -0700 perf thread_map: Remove uid options Now the target doesn't have a uid, it is handled through BPF filters, remove the uid options to thread_map creation. Tidy up the functions used in tests to avoid passing unused arguments. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174545.2853620-11-irogers@google.com Signed-off-by: Namhyung Kim commit b4c658d4d63d6149f4ba57c9c5c84b8a61aafa6f Author: Ian Rogers Date: Wed Jun 4 10:45:43 2025 -0700 perf target: Remove uid from target Gathering threads with a uid by scanning /proc is inherently racy leading to perf_event_open failures that quit perf. All users of the functionality now use BPF filters, so remove uid and uid_str from target. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174545.2853620-10-irogers@google.com Signed-off-by: Namhyung Kim commit 278538ddf1af9f7a7fc0a983a23771083feda7f9 Author: Ian Rogers Date: Wed Jun 4 10:45:42 2025 -0700 perf bench evlist-open-close: Switch user option to use BPF filter Finding user processes by scanning /proc is inherently racy and results in perf_event_open failures. Use a BPF filter to drop samples where the uid doesn't match. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174545.2853620-9-irogers@google.com Signed-off-by: Namhyung Kim commit bf1976dd28b4ec611d4f0bf5b0de40b1dd21b253 Author: Ian Rogers Date: Wed Jun 4 10:45:41 2025 -0700 perf trace: Switch user option to use BPF filter Finding user processes by scanning /proc is inherently racy and results in perf_event_open failures. Use a BPF filter to drop samples where the uid doesn't match. Ensure adding the BPF filter forces system-wide. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174545.2853620-8-irogers@google.com Signed-off-by: Namhyung Kim commit 38f83cc9ab8f74732de66044d1a126ca46347eea Author: Ian Rogers Date: Wed Jun 4 10:45:40 2025 -0700 perf top: Switch user option to use BPF filter Finding user processes by scanning /proc is inherently racy and results in perf_event_open failures. Use a BPF filter to drop samples where the uid doesn't match. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174545.2853620-7-irogers@google.com Signed-off-by: Namhyung Kim commit c54e2f82721aadd59d2a354ae2b5cc32d32047d9 Author: Ian Rogers Date: Wed Jun 4 10:45:39 2025 -0700 perf tests record: Add basic uid filtering test Based on the system-wide test with changes around how failure is handled as BPF permissions are a bigger issue than perf event paranoia. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174545.2853620-6-irogers@google.com Signed-off-by: Namhyung Kim commit 1151208e702267ad1ce2f24aa9d21deb47fa17f9 Author: Ian Rogers Date: Wed Jun 4 10:45:38 2025 -0700 perf record: Switch user option to use BPF filter Finding user processes by scanning /proc is inherently racy and results in perf_event_open failures. Use a BPF filter to drop samples where the uid doesn't match. Ensure adding the BPF filter forces system-wide. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174545.2853620-5-irogers@google.com Signed-off-by: Namhyung Kim commit 466db4275edd35b7a9af7c82575bcb3289f2c9c0 Author: Ian Rogers Date: Wed Jun 4 10:45:37 2025 -0700 perf parse-events: Add parse_uid_filter helper Add parse_uid_filter filter as a helper to parse_filter, that constructs a uid filter string. As uid filters don't work with tracepoint filters, add a is_possible_tp_filter function so the tracepoint filter isn't attempted for tracepoint evsels. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174545.2853620-4-irogers@google.com Signed-off-by: Namhyung Kim commit 5ddf4c3a17dc499fcbaf35692bc894340062dee8 Author: Ian Rogers Date: Wed Jun 4 10:45:36 2025 -0700 perf target: Separate parse_uid into its own function Allow parse_uid to be called without a struct target. Rather than have two errors, remove TARGET_ERRNO__USER_NOT_FOUND and use TARGET_ERRNO__INVALID_UID as the handling is identical. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174545.2853620-3-irogers@google.com Signed-off-by: Namhyung Kim commit 8b99e2f7a95297da80b0b7167a8c8327b65c019e Author: Ian Rogers Date: Wed Jun 4 10:45:35 2025 -0700 perf parse-events filter: Use evsel__find_pmu Rather than manually scanning PMUs, use evsel__find_pmu that can use the PMU set during event parsing. Signed-off-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174545.2853620-2-irogers@google.com Signed-off-by: Namhyung Kim commit 189a977e4dc011b05aa1fee044d1a98cf904341b Author: Namhyung Kim Date: Wed Jun 4 10:48:35 2025 -0700 perf bpf-filter: Improve error messages The BPF filter needs libbpf/BPF-skeleton support and root privilege. Add error messages to help users understand the problem easily. When it's not build with BPF support (make BUILD_BPF_SKEL=0). $ sudo perf record -e cycles --filter "pid != 0" true Error: BPF filter is requested but perf is not built with BPF. Please make sure to build with libbpf and BPF skeleton. Usage: perf record [] [] or: perf record [] -- [] --filter event filter When it supports BPF but runs without root or CAP_BPF. Note that it also checks pinned BPF filters. $ perf record -e cycles --filter "pid != 0" -o /dev/null true Error: BPF filter only works for users with the CAP_BPF capability! Please run 'perf record --setup-filter pin' as root first. Usage: perf record [] [] or: perf record [] -- [] --filter event filter Reviewed-by: Ian Rogers Link: https://lore.kernel.org/r/20250604174835.1852481-1-namhyung@kernel.org Signed-off-by: Namhyung Kim commit 34116ec67cc12bc0501ce2912372d167d597e4dd Author: Gustavo A. R. Silva Date: Sat Apr 5 12:07:26 2025 -0600 wifi: iwlwifi: mvm: d3: Avoid -Wflex-array-member-not-at-end warnings -Wflex-array-member-not-at-end was introduced in GCC-14, and we are getting ready to enable it, globally. Use the `DEFINE_RAW_FLEX()` helper for on-stack definitions of a flexible structure where the size of the flexible-array member is known at compile-time, and refactor the rest of the code, accordingly. So, with these changes, fix the following warnings: drivers/net/wireless/intel/iwlwifi/mvm/d3.c:124:52: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2067:51: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2162:43: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] drivers/net/wireless/intel/iwlwifi/mvm/d3.c:2225:43: warning: structure containing a flexible array member is not at the end of another structure [-Wflex-array-member-not-at-end] Signed-off-by: Gustavo A. R. Silva Reviewed-by: Kees Cook Acked-by: Miri Korenblit Link: https://patch.msgid.link/Z_FxXjiMvG5u73fi@kspp Signed-off-by: Miri Korenblit commit 38b9342ee62e9a1a868654ba6619de9da251bd57 Author: Vishal Chourasia Date: Fri Jun 6 09:40:05 2025 +0530 Documentation: cgroup: add section explaining controller availability Add "Availability" section to Control Group v2 docs. It describes the meaning of a controller being available in a cgroup, complementing the existing "Enabling and Disabling" section. This update improves the clarity of cgroup controller management by explicitly distinguishing between: 1. Availability – when a controller is supported by the kernel and listed in "cgroup.controllers", making its interface files accessible in the cgroup's directory. 2. Enabling – when a controller is enabled via explicitly writing the name of the controller to "cgroup.subtree_control" to control distribution of resource across the cgroup's immediate children. As an example, consider /sys/fs/cgroup # cat cgroup.controllers cpuset cpu io memory hugetlb pids misc /sys/fs/cgroup # cat cgroup.subtree_control # No controllers enabled by default /sys/fs/cgroup # echo +cpu +memory > cgroup.subtree_control # enabling "cpu" and "memory" /sys/fs/cgroup # cat cgroup.subtree_control cpu memory # cpu and memory enabled in /sys/fs/cgroup /sys/fs/cgroup # mkdir foo_cgrp /sys/fs/cgroup # cd foo_cgrp/ /sys/fs/cgroup/foo_cgrp # cat cgroup.controllers cpu memory # cpu and memory available in 'foo_cgrp' /sys/fs/cgroup/foo_cgrp # cat cgroup.subtree_control # empty by default /sys/fs/cgroup/foo_cgrp # ls cgroup.controllers cpu.max.burst memory.numa_stat cgroup.events cpu.pressure memory.oom.group cgroup.freeze cpu.stat memory.peak cgroup.kill cpu.stat.local memory.pressure cgroup.max.depth cpu.weight memory.reclaim cgroup.max.descendants cpu.weight.nice memory.stat cgroup.pressure io.pressure memory.swap.current cgroup.procs memory.current memory.swap.events cgroup.stat memory.events memory.swap.high cgroup.subtree_control memory.events.local memory.swap.max cgroup.threads memory.high memory.swap.peak cgroup.type memory.low memory.zswap.current cpu.idle memory.max memory.zswap.max cpu.max memory.min memory.zswap.writeback In this example, "cpu" and "memory" are enabled in the root cgroup, making them available in "foo_cgrp". This exposes the corresponding interface files in "foo_cgrp/", allowing resource control of processes in that cgroup. However, these controllers are not yet enabled in "foo_cgrp" itself. Once a controller is available in a cgroup it can be used to resource control processes of the cgroup. Acked-by: Michal Koutný Reviewed-by: Bagas Sanjaya Signed-off-by: Vishal Chourasia Signed-off-by: Tejun Heo commit 3d594a648b33663fe3bb5588b1359ee0c5dd5e4d Merge: c459262159f39e 9a30e332c36c52 Author: Mark Brown Date: Mon Jun 9 18:17:44 2025 +0100 spi: spi-fsl-dspi: DSPI support for NXP S32G Merge series from James Clark : DT and driver changes for DSPI on S32G platforms. First 3 commits are fixes for various edge cases which also apply to other platforms. Remaining commits add new S32G registers and device settings, some S32G specific fixes and then finally add the DT compatibles and binding docs. Tested in both host and target mode on S32G-VNP-RDB3 by transferring to an external device over spi1 using spidev_test.c commit 4a525d5d3150a3e387cb841f927f07eb4a98c368 Author: Andrea della Porta Date: Thu May 29 15:50:50 2025 +0200 MAINTAINERS: add Raspberry Pi RP1 section Raspberry Pi RP1 is a southbridge PCIe device which embeds several peripherals. Add a new section to cover the main RP1 driver, DTS and specific subperipherals (such as clock and pinconf/pinmux/gpio controller). Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/20250529135052.28398-13-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 8df00d6bdb0ab976637ba15829be5771dad2073f Author: Uwe Kleine-König Date: Tue May 27 20:13:18 2025 +0200 ARM: dts: bcm958625-meraki-mx6x: Use #pwm-cells = <3> bcm-nsp.dtsi has #pwm-cells = <3> as is specified in the binding. So to also use that correct value for bcm958625-meraki-mx6x the property overriding that value just has to be dropped. This fixes a few warnings like: arch/arm/boot/dts/broadcom/bcm958625-meraki-mx65.dtb: pwm@31000: #pwm-cells: 3 was expected from schema $id: http://devicetree.org/schemas/pwm/brcm,iproc-pwm.yaml# Signed-off-by: Uwe Kleine-König Link: https://lore.kernel.org/r/20250527181320.373572-2-u.kleine-koenig@baylibre.com Signed-off-by: Florian Fainelli commit 81f83a36b27f512053addba6aa9af978a7e1665b Author: Linus Walleij Date: Mon May 12 14:05:54 2025 +0200 ARM: dts: bcm63178: Add BCMBCA peripherals All the BCMBCA SoCs share a set of peripherals at 0xff800000, albeit at slightly varying memory locations on the bus and with varying IRQ assignments. Add the watchdog, GPIO, RNG, LED and DMA blocks for the BCM63178 based on the vendor files 63178_map_part.h and 63178_intr.h from the "bcmopen-consumer" code drop. This SoC has up to 256 possible GPIOs due to having 8 registers with 32 GPIOs in each available. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-8-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit ec8ed34726bd7b9071ac5bf49b550d34717ff9e6 Author: Linus Walleij Date: Mon May 12 14:05:53 2025 +0200 ARM: dts: bcm63148: Add BCMBCA peripherals All the BCMBCA SoCs share a set of peripherals at 0xff800000, albeit at slightly varying memory locations on the bus and with varying IRQ assignments. Add the GPIO, RNG and LED and DMA blocks for the BCM63148 based on the vendor files 63148_map_part.h and 63148_intr.h from the "bcmopen-consumer" code drop. This SoC has up to 160 possible GPIOs due to having 5 registers with 32 GPIOs in each available. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-7-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit b7907e00f012e78fec86e39f926af845ef610348 Author: Linus Walleij Date: Mon May 12 14:05:52 2025 +0200 ARM: dts: bcm63138: Add BCMBCA peripherals All the BCMBCA SoCs share a set of peripherals at 0xff800000, albeit at slightly varying memory locations on the bus and with varying IRQ assignments. Extend the peripheral interrupt window to 0x10000 as it need to fit the DMA block. Add the GPIO, RNG and LED and DMA blocks for the BCM63138 based on the vendor files 63138_map_part.h and 63138_intr.h from the "bcmopen-consumer" code drop. This SoC has up to 160 possible GPIOs due to having 5 registers with 32 GPIOs in each available. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-6-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit b7f8a3a5713289b5100a29f3b25c458b407a3b31 Author: Linus Walleij Date: Mon May 12 14:05:51 2025 +0200 ARM: dts: bcm6878: Add BCMBCA peripherals All the BCMBCA SoCs share a set of peripherals at 0xff800000, albeit at slightly varying memory locations on the bus and with varying IRQ assignments. Add the first and second watchdog, GPIO, RNG, LED and DMA blocks for the BCM6878 based on the vendor files 6878_map_part.h and 6878_intr.h from the "bcmopen-consumer" code drop. This SoC has up to 256 possible GPIOs due to having 8 registers with 32 GPIOs in each available. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-5-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit e8a74a2aa0f9832a4547c8d110b8391d01d5d87d Author: Linus Walleij Date: Mon May 12 14:05:50 2025 +0200 ARM: dts: bcm6855: Add BCMBCA peripherals All the BCMBCA SoCs share a set of peripherals at 0xff800000, albeit at slightly varying memory locations on the bus and with varying IRQ assignments. Add the first and second watchdog, GPIO, RNG, LED, DMA and second PL011 UART blocks for the BCM6855 based on the vendor files 6855_map_part.h and 6855_intr.h from the "bcmopen-consumer" code drop. This SoC has up to 256 possible GPIOs due to having 8 registers with 32 GPIOs in each available. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-4-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit 8397603dc86e2dcf244184f389e07f2c84dfec8b Author: Linus Walleij Date: Mon May 12 14:05:49 2025 +0200 ARM: dts: bcm6846: Add interrupt to RNG The r200 RNG has an interrupt so let's add it. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-3-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit ca801d3f2dfad05e59fe1493cdf0b73eac4df04b Author: Linus Walleij Date: Mon May 12 14:05:48 2025 +0200 dt-bindings: rng: r200: Add interrupt property This IP block has an interrupt. Add it and add it to the example as well. Acked-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-2-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit 654481395ffba18d41189bb1c88753f65bd63276 Author: Linus Walleij Date: Mon May 12 14:05:47 2025 +0200 ARM: dts: bcm6878: Correct UART0 IRQ number According to the vendor file 6878_intr.h the UART0 has IRQ 92, not 32. Assuming this is a copy-and-paste error. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-1-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit fbf4ca37cdfc7962732bd4d48c05fca56244f8e2 Author: Andrea della Porta Date: Thu May 29 15:50:47 2025 +0200 arm64: dts: broadcom: Add overlay for RP1 device Define the RP1 node in an overlay. The inclusion tree is as follow (the arrow points to the includer): rp1.dtso ^ | rp1-common.dtsi ----> rp1-nexus.dtsi Signed-off-by: Andrea della Porta Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250529135052.28398-10-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit d4c6c8f8adca26cefa771ef06427d042bddef9e5 Author: Andrea della Porta Date: Thu May 29 15:50:46 2025 +0200 arm64: dts: broadcom: Add board DTS for Rpi5 which includes RP1 node Add the fully populated DTS for RaspberryPi 5 which includes the RP1 node definition. The inclusion tree is as follow (the arrow points to the includer): rp1-common.dtsi ----> rp1-nexus.dtsi ----> bcm2712-rpi-5-b.dts ^ | bcm2712-rpi-5-b-ovl-rp1.dts This is designed to maximize the compatibility with downstream DT while ensuring that a fully defined DT (one which includes the RP1 node as opposed to load it from overlay at runtime) is present since early boot stage. Since the preferred board DT is the fully populated one, name it bcm2712-rpi-5-b.dts and move the previous one into bcm2712-rpi-5-b-ovl-rp1.dts. Signed-off-by: Andrea della Porta Link: https://lore.kernel.org/r/20250529135052.28398-9-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 9bb1f64be41a01ed369f3c730bcccf6e780f23cf Author: Andrea della Porta Date: Thu May 29 15:50:45 2025 +0200 arm64: dts: bcm2712: Add external clock for RP1 chipset on Rpi5 The RP1 found on Raspberry Pi 5 board needs an external crystal at 50MHz. Add clk_rp1_xosc node to provide that. Signed-off-by: Andrea della Porta Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250529135052.28398-8-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit eed7414420283d830ab576f32a5e3e5792c6fd77 Author: Andrea della Porta Date: Thu May 29 15:50:43 2025 +0200 arm64: dts: rp1: Add support for RaspberryPi's RP1 device RaspberryPi RP1 is a multi function PCI endpoint device that exposes several subperipherals via PCI BAR. Add a dtb overlay that will be compiled into a binary blob and linked in the RP1 driver. This overlay offers just minimal support to represent the RP1 device itself, the sub-peripherals will be added by future patches. Signed-off-by: Andrea della Porta Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250529135052.28398-6-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 1b2fae5b3e31d7cfcb5c1aec40948f2ca92c23f8 Author: Andrea della Porta Date: Thu May 29 15:50:40 2025 +0200 dt-bindings: misc: Add device specific bindings for RaspberryPi RP1 The RP1 is a MFD that exposes its peripherals through PCI BARs. This schema is intended as minimal support for the clock generator and gpio controller peripherals which are accessible through BAR1. Signed-off-by: Andrea della Porta Reviewed-by: Rob Herring (Arm) Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250529135052.28398-3-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit c1a9d356f241f42f2e886f38250be926407069de Author: Andrea della Porta Date: Thu May 29 15:50:39 2025 +0200 dt-bindings: pinctrl: Add RaspberryPi RP1 gpio/pinctrl/pinmux bindings Add device tree bindings for the gpio/pin/mux controller that is part of the RP1 multi function device, and relative entries in MAINTAINERS file. Signed-off-by: Andrea della Porta Reviewed-by: Krzysztof Kozlowski Reviewed-by: Linus Walleij Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250529135052.28398-2-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 7b746d584ab97c66a0aa8ef15da1e2aa8152e3fa Author: Andrea della Porta Date: Thu May 29 15:50:38 2025 +0200 dt-bindings: clock: Add RaspberryPi RP1 clock bindings Add device tree bindings for the clock generator found in RP1 multi function device, and relative entries in MAINTAINERS file. Signed-off-by: Andrea della Porta Reviewed-by: Krzysztof Kozlowski Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250529135052.28398-1-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 16d27d638f3bb389f243fa469db9dd2a0aa72d83 Author: Linus Walleij Date: Mon May 12 14:05:58 2025 +0200 ARM64: dts: bcm63158: Add BCMBCA peripherals All the BCMBCA SoCs share a set of peripherals at 0xff800000, albeit at slightly varying memory locations on the bus and with varying IRQ assignments. Add the watchdog, GPIO blocks, RNG, LED, second UART and DMA blocks for the BCM63158 based on the vendor files 63158_map_part.h and 63158_intr.h from the "bcmopen-consumer" code drop. The DTSI file has clearly been authored for the B0 revision of the SoC: there is an earlier A0 version, but this has the UARTs in the legacy PERF memory space, while the B0 has opened a new peripheral window at 0xff812000 for the three UARTs. It also has a designated AHB peripheral area at 0xff810000 where the DMA resides, the peripheral range window fits these two peripheral groups. This SoC has up to 256 possible GPIOs due to having 8 registers with 32 GPIOs in each available. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-12-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit d84e3949940baa3105098f74449ff3c97b2d85e1 Author: Linus Walleij Date: Mon May 12 14:05:57 2025 +0200 ARM64: dts: bcm6858: Add BCMBCA peripherals All the BCMBCA SoCs share a set of peripherals at 0xff800000, albeit at slightly varying memory locations on the bus and with varying IRQ assignments. ARM64 SoCs have additional peripherals at 0xff858000. Extend the peripheral window range to 0x400000 and add the DMA controller at offset 0x59000. Add the watchdog, GPIO blocks, RNG, LED, second UART and DMA blocks for the BCM6858 based on the vendor files 6858_map_part.h and 6858_intr.h from the "bcmopen-consumer" code drop. This SoC has up to 256 possible GPIOs due to having 8 registers with 32 GPIOs in each available. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-11-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit c0126c440963a5b47a5376a8a0a9f4a270cbf82f Author: Linus Walleij Date: Mon May 12 14:05:56 2025 +0200 ARM64: dts: bcm6856: Add BCMBCA peripherals All the BCMBCA SoCs share a set of peripherals at 0xff800000, albeit at slightly varying memory locations on the bus and with varying IRQ assignments. ARM64 SoCs have additional peripherals at 0xff858000. Extend the BCM6856 the PERF window to 0x400000 and add the DMA block at offset 0x59000. Add the watchdog, GPIO blocks, RNG, LED, second UART and DMA blocks for the BCM6856 based on the vendor files 6856_map_part.h and 6856_intr.h from the "bcmopen-consumer" code drop. This SoC has up to 256 possible GPIOs due to having 8 registers with 32 GPIOs in each available. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-10-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit bbdccf0f4e8f3ab1f9939d7d1bea18647f9a6d9b Author: Linus Walleij Date: Mon May 12 14:05:55 2025 +0200 ARM64: dts: bcm4908: Add BCMBCA peripherals All the BCMBCA SoCs share a set of peripherals at 0xff800000, albeit at slightly varying memory locations on the bus and with varying IRQ assignments. ARM64 SoCs have additional peripherals at 0xff858000, we extend the peripheral bus range to 0x400000 to cover this area. Add the watchdog, remaining GPIO blocks, RNG, and DMA blocks for the BCM4908 based on the vendor files 4908_map_part.h and 4908_intr.h from the "bcmopen-consumer" code drop. This SoC has up to 320 possible GPIOs due to having 10 registers with 32 GPIOs in each available. Signed-off-by: Linus Walleij Reviewed-by: William Zhang Link: https://lore.kernel.org/r/20250512-bcmbca-peripherals-arm-v3-9-86f97ab4326f@linaro.org Signed-off-by: Florian Fainelli commit 44bba869d25985eb2212beaa4e353f6aa476dbf0 Author: Andrea della Porta Date: Thu May 29 15:50:49 2025 +0200 arm64: defconfig: Enable OF_OVERLAY option The RP1 driver uses the infrastructure enabled by OF_OVERLAY config option. Enable that option in defconfig in order to produce a kernel usable on RaspberryPi5 avoiding to enable it separately. Signed-off-by: Andrea della Porta Reviewed-by: Stefan Wahren Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250529135052.28398-12-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 67cb34423ab829266e22d29175b1226524463740 Author: Andrea della Porta Date: Thu May 29 15:50:48 2025 +0200 arm64: defconfig: Enable RP1 misc/clock/gpio drivers Select the RP1 drivers needed to operate the PCI endpoint containing several peripherals such as Ethernet and USB Controller. This chip is present on RaspberryPi 5. Signed-off-by: Andrea della Porta Reviewed-by: Stefan Wahren Reviewed-by: Florian Fainelli Link: https://lore.kernel.org/r/20250529135052.28398-11-andrea.porta@suse.com Signed-off-by: Florian Fainelli commit 670678399edccd2b671f73ded2275b6c76c94efc Author: Alok Tiwari Date: Thu May 22 00:47:26 2025 -0700 ixgbe: Fix typos and clarify comments in X550 driver code Corrected spelling errors such as "simular" -> "similar", "excepted" -> "accepted", and "Determime" -> "Determine". Fixed including incorrect word usage ("to MAC" -> "two MAC") and improved awkward phrasing. Aligned function header descriptions with their actual functionality (e.g., "Writes a value" -> "Reads a value"). Corrected typo in error code from -ENIVAL to -EINVAL. Improved overall clarity and consistency in comment across various functions. These changes improve maintainability and readability of the code without affecting functionality. Signed-off-by: Alok Tiwari Reviewed-by: Simon Horman Reviewed-by: Jacob Keller Signed-off-by: Tony Nguyen commit b0ca7dc0e70e31d0ecf66b508b96a7026b769ceb Author: Ahmed Zaki Date: Fri May 16 16:19:09 2025 -0600 iavf: convert to NAPI IRQ affinity API Commit bd7c00605ee0 ("net: move aRFS rmap management and CPU affinity to core") allows the drivers to delegate the IRQ affinity to the NAPI instance. However, the driver needs to use a persistent NAPI config and explicitly set/unset the NAPI<->IRQ association. Convert to the new IRQ affinity API. Reviewed-by: Jacob Keller Signed-off-by: Ahmed Zaki Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit dc5e7a3513efcbf886c53dc5401b524aa3dea92a Author: Michal Kubiak Date: Wed May 14 14:37:24 2025 +0200 ice: add a separate Rx handler for flow director commands The "ice" driver implementation uses the control VSI to handle the flow director configuration for PFs and VFs. Unfortunately, although a separate VSI type was created to handle flow director queues, the Rx queue handler was shared between the flow director and a standard NAPI Rx handler. Such a design approach was not very flexible. First, it mixed hotpath and slowpath code, blocking their further optimization. It also created a huge overkill for the flow director command processing, which is descriptor-based only, so there is no need to allocate Rx data buffers. For the above reasons, implement a separate Rx handler for the control VSI. Also, remove from the NAPI handler the code dedicated to configuring the flow director rules on VFs. Do not allocate Rx data buffers to the flow director queues because their processing is descriptor-based only. Finally, allow Rx data queues to be allocated only for VSIs that have netdev assigned to them. This handler splitting approach is the first step in converting the driver to use the Page Pool (which can only be used for data queues). Test hints: 1. Create a VF for any PF managed by the ice driver. 2. In a loop, add and delete flow director rules for the VF, e.g.: for i in {1..128}; do q=$(( i % 16 )) ethtool -N ens802f0v0 flow-type tcp4 dst-port "$i" action "$q" done for i in {0..127}; do ethtool -N ens802f0v0 delete "$i" done Suggested-by: Maciej Fijalkowski Suggested-by: Michal Swiatkowski Acked-by: Maciej Fijalkowski Reviewed-by: Jacob Keller Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Signed-off-by: Michal Kubiak Tested-by: Rafal Romanowski Signed-off-by: Tony Nguyen commit cb9e0de77761309f1b30a6800a16f4bedc17e512 Author: Karol Kolacinski Date: Tue Apr 22 18:01:49 2025 +0200 ice: add ice driver PTP pin documentation Add a description of PTP pins support by the adapters to ice driver documentation. Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Signed-off-by: Arkadiusz Kubalewski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit a33a302b505bfbb9614aa308391a45cf55827496 Author: Karol Kolacinski Date: Tue Apr 22 18:01:48 2025 +0200 ice: change SMA pins to SDP in PTP API This change aligns E810 PTP pin control to all other products. Currently, SMA/U.FL port expanders are controlled together with SDP pins connected to 1588 clock. To align this, separate this control by exposing only SDP20..23 pins in PTP API on adapters with DPLL. Clear error for all E810 on absent NVM pin section or other errors to allow proper initialization on SMA E810 with NVM section. Use ARRAY_SIZE for pin array instead of internal definition. Reviewed-by: Milena Olech Signed-off-by: Karol Kolacinski Signed-off-by: Arkadiusz Kubalewski Reviewed-by: Aleksandr Loktionov Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 2dd5d03c77e215b3adc09639ee324159e76a7782 Author: Arkadiusz Kubalewski Date: Tue Apr 22 18:01:47 2025 +0200 ice: redesign dpll sma/u.fl pins control DPLL-enabled E810 NIC driver provides user with list of input and output pins. Hardware internal design impacts user control over SMA and U.FL pins. Currently end-user view on those dpll pins doesn't provide any layer of abstraction. On the hardware level SMA and U.FL pins are tied together due to existence of direction control logic for each pair: - SMA1 (bi-directional) and U.FL1 (only output) - SMA2 (bi-directional) and U.FL2 (only input) The user activity on each pin of the pair may impact the state of the other. Previously all the pins were provided to the user as is, without the control over SMA pins direction. Introduce a software controlled layer of abstraction over external board pins, instead of providing the user with access to raw pins connected to the dpll: - new software controlled SMA and U.FL pins, - callback operations directing user requests to corresponding hardware pins according to the runtime configuration, - ability to control SMA pins direction. Reviewed-by: Przemek Kitszel Signed-off-by: Arkadiusz Kubalewski Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 9acae9e2e2893427ff1325ae5c5a880ac37315cb Author: Martyna Szapar-Mudlaw Date: Thu May 15 12:50:10 2025 +0200 ixgbe: add link_down_events statistic Introduce a link_down_events counter to the ixgbe driver, incremented each time the link transitions from up to down. This counter can help diagnose issues related to link stability, such as port flapping or unexpected link drops. The value is exposed via ethtool's get_link_ext_stats() interface. Reviewed-by: Kory Maincent Reviewed-by: Aleksandr Loktionov Signed-off-by: Martyna Szapar-Mudlaw Tested-by: Rinitha S (A Contingent worker at Intel) Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit f0768aec37c06cbe4802a55ebc368f8030bc1787 Author: Dawid Osuchowski Date: Wed May 21 16:23:32 2025 +0200 i40e: add link_down_events statistic Introduce a link_down_events counter to the i40e driver, incremented each time the link transitions from up to down. This counter can help diagnose issues related to link stability, such as port flapping or unexpected link drops. The value is exposed via ethtool's get_link_ext_stats() interface. Co-developed-by: Martyna Szapar-Mudlaw Signed-off-by: Martyna Szapar-Mudlaw Reviewed-by: Michal Swiatkowski Signed-off-by: Dawid Osuchowski Reviewed-by: Simon Horman Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit e7aee24a89c863f2cab0d367df3265a66ad428d7 Author: Martyna Szapar-Mudlaw Date: Thu May 15 12:50:09 2025 +0200 ice: add link_down_events statistic Introduce a link_down_events counter to the ice driver, incremented each time the link transitions from up to down. This counter can help diagnose issues related to link stability, such as port flapping or unexpected link drops. The value is exposed via ethtool's get_link_ext_stats() interface. Reviewed-by: Kory Maincent Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Martyna Szapar-Mudlaw Reviewed-by: Simon Horman Signed-off-by: Tony Nguyen commit 141d0c9037ca57dac2d2c4e5d3c21521aa70ff12 Author: Jacob Keller Date: Mon May 5 13:14:23 2025 -0700 net: intel: move RSS packet classifier types to libie The Intel i40e, iavf, and ice drivers all include a definition of the packet classifier filter types used to program RSS hash enable bits. For i40e, these bits are used for both the PF and VF to configure the PFQF_HENA and VFQF_HENA registers. For ice and iAVF, these bits are used to communicate the desired hash enable filter over virtchnl via its struct virtchnl_rss_hashena. The virtchnl.h header makes no mention of where the bit definitions reside. Maintaining a separate copy of these bits across three drivers is cumbersome. Move the definition to libie as a new pctype.h header file. Each driver can include this, and drop its own definition. The ice implementation also defined a ICE_AVF_FLOW_FIELD_INVALID, intending to use this to indicate when there were no hash enable bits set. This is confusing, since the enumeration is using bit positions. A value of 0 *should* indicate the first bit. Instead, rewrite the code that uses ICE_AVF_FLOW_FIELD_INVALID to just check if the avf_hash is zero. From context this should be clear that we're checking if none of the bits are set. The values are kept as bit positions instead of encoding the BIT_ULL directly into their value. While most users will simply use BIT_ULL immediately, i40e uses the macros both with BIT_ULL and test_bit/set_bit calls. Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Reviewed-by: Aleksandr Loktionov Signed-off-by: Jacob Keller Tested-by: Rafal Romanowski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 78b2d9908b42ea70e42f00af5db08ad514727a45 Author: Jacob Keller Date: Mon May 5 13:14:22 2025 -0700 net: intel: rename 'hena' to 'hashcfg' for clarity i40e, ice, and iAVF all use 'hena' as a shorthand for the "hash enable" configuration. This comes originally from the X710 datasheet 'xxQF_HENA' registers. In the context of the registers the meaning is fairly clear. However, on its own, hena is a weird name that can be more difficult to understand. This is especially true in ice. The E810 hardware doesn't even have registers with HENA in the name. Replace the shorthand 'hena' with 'hashcfg'. This makes it clear the variables deal with the Hash configuration, not just a single boolean on/off for all hashing. Do not update the register names. These come directly from the datasheet for X710 and X722, and it is more important that the names can be searched. Suggested-by: Przemek Kitszel Reviewed-by: Aleksandr Loktionov Reviewed-by: Przemek Kitszel Reviewed-by: Simon Horman Signed-off-by: Jacob Keller Tested-by: Rafal Romanowski Tested-by: Rinitha S (A Contingent worker at Intel) Signed-off-by: Tony Nguyen commit 86e2d052c2320bf12571a5d96b16c2745e1cfc5e Merge: b5735e5e710268 19272b37aa4f83 Author: Thomas Hellström Date: Mon Jun 9 18:26:55 2025 +0200 Merge drm/drm-next into drm-xe-next Backmerging to bring in 6.16 Signed-off-by: Thomas Hellström commit 37df56ac500222384d6a6a13c69c489e01fb686c Author: Yixun Lan Date: Fri May 23 21:21:04 2025 +0800 riscv: dts: spacemit: enable eMMC for K1 SoC Enable eMMC support for SpacemiT K1 SoC, successfully tested on Bananapi-F3 board which shipped with a 16GB eMMC chip - KLMAG1JETD-B041. Link: https://lore.kernel.org/r/20250523-22-k1-sdhci-v1-1-6e0adddf7494@gentoo.org Signed-off-by: Yixun Lan commit 2ccb77082853f6f034e2388228a3767049dab9cb Merge: d1f2fa7ca1d644 ece5d881004f04 Author: Mark Brown Date: Mon Jun 9 16:45:26 2025 +0100 ASoC: codecs: More const and unused member cleanups Merge series from Krzysztof Kozlowski : Make static data const for code safety and drop some unused fields in structs. commit 9465f44d2df21b43f062de303e59e2b391eeab16 Author: Andrea Righi Date: Mon Jun 9 18:23:42 2025 +0200 sched_ext: Documentation: Clarify time slice handling in task lifecycle It is not always obvious how a task's time slice can be refilled, either explicitly from ops.dispatch() or automatically by the sched_ext core, to skip subsequent ops.enqueue() and ops.dispatch() calls. This typically happens when the task is the only one running on a CPU. To make this behavior easier to understand, update the task lifecycle diagram to explicitly document how time slice handling works in such cases. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 086ed90a6453873d4c5d51a18c26b3548af4fa24 Author: Andrea Righi Date: Thu Jun 5 11:30:26 2025 +0200 sched_ext: Make scx_locked_rq() inline scx_locked_rq() is used both from ext.c and ext_idle.c, move it to ext.h as a static inline function. No functional changes. v2: Rename locked_rq to scx_locked_rq_state, expose it and make scx_locked_rq() inline, as suggested by Tejun. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit e212743bd727c3fcffcd73b6c1d906546ee83805 Author: Andrea Righi Date: Wed Jun 4 16:33:13 2025 +0200 sched_ext: Make scx_rq_bypassing() inline scx_rq_bypassing() is used both from ext.c and ext_idle.c, move it to ext.h as a static inline function. No functional changes. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 353656eb84fef8ffece3b1be4345cbacbbb5267f Author: Andrea Righi Date: Wed Jun 4 16:33:12 2025 +0200 sched_ext: idle: Make local functions static in ext_idle.c Functions that are only used within ext_idle.c can be marked as static to limit their scope. No functional changes. Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit c68ea8243c5cc901cea62f695504bec73195d906 Author: Andrea Righi Date: Wed Jun 4 16:33:11 2025 +0200 sched_ext: idle: Remove unnecessary ifdef in scx_bpf_cpu_node() There's no need to make scx_bpf_cpu_node() dependent on CONFIG_NUMA, since cpu_to_node() can be used also in systems with CONFIG_NUMA disabled. This also allows to always validate the @cpu argument regardless of the CONFIG_NUMA settings. Fixes: 01059219b0cfd ("sched_ext: idle: Introduce node-aware idle cpu kfunc helpers") Signed-off-by: Andrea Righi Signed-off-by: Tejun Heo commit 393350c1691f1cbf3a0436f2a12c2b4347c4e953 Author: Bard Liao Date: Tue Apr 29 20:23:37 2025 +0800 soundwire: update Intel BPT message length limitation The limitation of "must be multiples of 32 bytes" does not fit the requirement of current Intel platforms. Update it to meet the requirement. Signed-off-by: Bard Liao Reviewed-by: Ranjani Sridharan Reviewed-by: Péter Ujfalusi Link: https://lore.kernel.org/r/20250429122337.142551-1-yung-chuan.liao@linux.intel.com Signed-off-by: Vinod Koul commit fdf5596103455c62ab84293ddd95d9bf16f6519a Author: Yumeng Fang Date: Fri May 23 14:19:10 2025 +0800 soundwire: intel_ace2.x: Use str_read_write() helper Remove hard-coded strings by using the str_read_write() helper. Signed-off-by: Yumeng Fang Signed-off-by: Yunjian Long Reviewed-by: Bard Liao Link: https://lore.kernel.org/r/20250523141910793yUFpjomfu0byK_yFddHQu@zte.com.cn Signed-off-by: Vinod Koul commit f93b697ed98e3c85d1973ea170d4f4e7a6b2b45d Author: Vijendar Mukunda Date: Fri May 30 11:13:41 2025 +0530 soundwire: amd: cancel pending slave status handling workqueue during remove sequence During remove sequence, cancel the pending slave status update workqueue. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20250530054447.1645807-4-Vijendar.Mukunda@amd.com Signed-off-by: Vinod Koul commit 03837341790039d6f1cbf7a1ae7dfa2cb77ef0a4 Author: Vijendar Mukunda Date: Fri May 30 11:13:40 2025 +0530 soundwire: amd: serialize amd manager resume sequence during pm_prepare During pm_prepare callback, pm_request_resume() delays SoundWire manager D0 entry sequence. Synchronize runtime resume sequence for amd_manager instance prior to invoking child devices resume sequence for both the amd power modes(ClockStop Mode and Power off mode). Change the power_mode_mask check and use pm_runtime_resume() in amd_pm_prepare() callback. Signed-off-by: Vijendar Mukunda Link: https://lore.kernel.org/r/20250530054447.1645807-3-Vijendar.Mukunda@amd.com Signed-off-by: Vinod Koul commit 5b8c1f39b5e46505cf9cf7775759a9e9c2bfc2d9 Author: Johan Hovold Date: Fri May 23 10:53:17 2025 +0200 soundwire: qcom: demote probe registration printk Driver should generally by quiet on successful probe. Demote the Qualcomm controller registration info message to debug level to make boot logs a little less noisy: qcom-soundwire 6ab0000.soundwire: Qualcomm Soundwire controller v2.0.0 Registered qcom-soundwire 6ad0000.soundwire: Qualcomm Soundwire controller v2.0.0 Registered qcom-soundwire 6b10000.soundwire: Qualcomm Soundwire controller v2.0.0 Registered qcom-soundwire 6d30000.soundwire: Qualcomm Soundwire controller v2.0.0 Registered Signed-off-by: Johan Hovold Reviewed-by: Dmitry Baryshkov Acked-by: Srinivas Kandagatla Link: https://lore.kernel.org/r/20250523085317.11439-1-johan+linaro@kernel.org Signed-off-by: Vinod Koul commit 0cbce868fffaf115a26d6cb45516627cf13cc3d2 Author: Charles Keepax Date: Mon Jun 9 15:30:41 2025 +0100 ASoC: cs42l43: Remove unnecessary work functions Now the SoundWire IRQ lock has been changed in the core, it is no longer necessary to use a bunch of work functions to dodge mutex inversions. Signed-off-by: Charles Keepax Acked-by: Mark Brown Link: https://lore.kernel.org/r/20250609143041.495049-4-ckeepax@opensource.cirrus.com Signed-off-by: Vinod Koul commit ccb7bb13c00bcc3178d270da052635c56148bc16 Author: Charles Keepax Date: Mon Jun 9 15:30:40 2025 +0100 soundwire: Move handle_nested_irq outside of sdw_dev_lock The sdw_dev_lock protects the SoundWire driver callbacks against the probed flag, which is used to skip the callbacks if the driver gets removed. For more information see commit bd29c00edd0a ("soundwire: revisit driver bind/unbind and callbacks"). However, this lock is a frequent source of mutex inversions. Many audio operations eventually hit the hardware resulting in a SoundWire callback, this means that typically the driver has the locking order ALSA/ASoC locks -> sdw_dev_lock. Conversely, the IRQ comes in directly from the SoundWire hardware, but then will often want to access ALSA/ASoC, such as updating something in DAPM or an ALSA control. This gives the other lock order sdw_dev_lock -> ALSA/ASoC locks. When the IRQ handling was initially added to SoundWire this was through a callback mechanism. As such it required being covered by the lock because the callbacks are part of the sdw_driver structure and are thus present regardless of if the driver is currently probed. Since then a newer mechanism using the IRQ framework has been added, which is currently covered by the same lock but this isn't actually required. Handlers for the IRQ framework are registered in probe and should by released during remove, thus the IRQ framework will have already unbound the IRQ before the slave driver is removed. Avoid the aforementioned mutex inversion by moving the handle_nested_irq call outside of the sdw_dev_lock. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20250609143041.495049-3-ckeepax@opensource.cirrus.com Signed-off-by: Vinod Koul commit 99d4a6e5c24fc05fc56a33d9d24e89720bfd5665 Author: Charles Keepax Date: Mon Jun 9 15:30:39 2025 +0100 MAINTAINERS: Remove Sanyog Kale as reviewer on SoundWire The given email address for Sanyog is no longer valid and bounces, so remove as a reviewer for now and he can add back with a new email if needed. Signed-off-by: Charles Keepax Link: https://lore.kernel.org/r/20250609143041.495049-2-ckeepax@opensource.cirrus.com Signed-off-by: Vinod Koul commit b5735e5e7102683038a1c18d7c8d982c2aef4f8d Author: Matt Roper Date: Thu Jun 5 15:53:53 2025 -0700 drm/xe: GSM size should be constant on most platforms On old Intel platforms, the size of the GSM (i.e., the stolen memory that holds the GGTT page table entries) could vary, so the driver needed to read the actual size from the PCI config space. However from Xe_HP onward, the GSM is now always guaranteed to be exactly 8MB (which translates to a 4GB GGTT address space); this is always true regardless of what the platform's much larger PPGTT address space is. The bspec doesn't document the PCI config space as being a valid way to query the size of the GSM after Xe_LP platforms, although so far it still seems to be giving us proper values for Xe_HP, Xe2, and Xe3. However we suspect that the config space will stop providing correct values on some upcoming platforms, so we should stop relying on it. Instead just use the hardcoded 8MB value as documented elsewhere in the bspec. Bspec: 49636, 67090, 50589 Reviewed-by: Gustavo Sousa Link: https://lore.kernel.org/r/20250605225352.2333981-2-matthew.d.roper@intel.com Signed-off-by: Matt Roper commit d205b07e7e8501fd2a50976ad4b54eed31c556b2 Author: Frank Li Date: Mon Jun 2 11:28:13 2025 -0400 dt-bindings: display: convert himax,hx8357d.txt to yaml format Convert himax,hx8357d.txt to yaml format. Additional changes: - add spi parent node in examples. - ref to spi-peripheral-props.yaml. - change himax,hx8357a to himax,hx8357 to align driver and existed dts. - add himax,hx8369a and fallback to himax,hx8369. - allow spi-cpha and spi-cpol to align existed dts. - add im-gpios for interface selections. - add reset-gpios. Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250602152814.949671-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit f2d26960e0db8f99708960d86cedb9f1f2e822f7 Author: Frank Li Date: Mon Jun 2 10:49:06 2025 -0400 dt-bindings: display: arm,pl11x: Allow resets property Allow resets property to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/lpc/lpc4337-ciaa.dtb: lcd-controller@40008000 (arm,pl111): 'resets' does not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250602144906.944866-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit 5e61d44d0f4637b7d47dbaa40dd95e1388e3eb18 Author: David Lechner Date: Fri May 30 18:05:42 2025 -0500 dt-bindings: display: convert sitronix,st7586 to YAML Convert the sitronix,st7586 binding documentation from .txt to .yaml. Also added a link to the datasheet while we are touching this. Signed-off-by: David Lechner Link: https://lore.kernel.org/r/20250530-devicetree-convert-sitronix-st7586-to-yaml-v1-1-c132b512ec57@baylibre.com Signed-off-by: Rob Herring (Arm) commit 1c69ba9bf0f3032428e6820bada0bb50016a5db6 Author: Frank Li Date: Thu May 29 16:05:19 2025 -0400 dt-bindings: lcdif: add lcd panel related property for imx28 Allow lcd panel related property for imx28 and keep the same restriction for other platform. It is legancy platform and set these property to deprecated. Fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/mxs/imx28-apx4devkit.dtb: lcdif@80030000 (fsl,imx28-lcdif): 'display', 'display0' do not match any of the regexes: 'pinctrl-[0-9]+' Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250529200520.798117-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit 28ddb755949b996637eb457759edff5de77a474d Author: Frank Li Date: Wed May 28 14:35:48 2025 -0400 dt-bindings: soc: Add fsl,imx23-digctl.yaml for i.MX23 and i.MX28 Add fsl,imx23-digctl.yaml for i.MX23 and i.MX28 to fix below CHECK_DTB warning: arch/arm/boot/dts/nxp/mxs/imx23-sansa.dtb: /apb@80000000/apbh-bus@80000000/digctl@8001c000: failed to match any schema with compatible: ['fsl,imx23-digctl'] Signed-off-by: Frank Li Link: https://lore.kernel.org/r/20250528183549.694434-1-Frank.Li@nxp.com Signed-off-by: Rob Herring (Arm) commit d1f2fa7ca1d644ff9ab1d9fdeb3417d44ba66921 Merge: 5f4f86d5e0c61b e6e8897995a9e6 Author: Mark Brown Date: Mon Jun 9 16:44:33 2025 +0100 Add DisplayPort sound support for Fairphone 5 Merge series from Luca Weiss : Add the necessary sound card bits and some dts additions to enable sound over DisplayPort-over-USB-C, e.g. to a connected TV or monitor. The UCM files can be found here: https://gitlab.postmarketos.org/postmarketOS/pmaports/-/tree/master/device/testing/device-fairphone-fp5/ucm This series - in spirit - depends on the series enabling DisplayPort in the first place, but can land pretty independently, especially the ASoC bits: https://lore.kernel.org/linux-arm-msm/20250312-fp5-pmic-glink-dp-v2-0-a55927749d77@fairphone.com/ commit 5f4f86d5e0c61b2b2687c2d39c77860548a5f439 Merge: 28d3d1830dc108 1f5cdb6ab45e1c Author: Mark Brown Date: Mon Jun 9 16:44:29 2025 +0100 ASoC: Add Richtek RTQ9124 support Merge series from cy_huang@richtek.com: This patch series adds Richtek RTQ9124 1x30W audio amplifier support. commit 28d3d1830dc108a8ff6a243f743fafda56315050 Merge: d3de84858811ea 03b778d1994827 Author: Mark Brown Date: Mon Jun 9 16:44:25 2025 +0100 Cleanup in rockchip_sai.c Merge series from Pei Xiao : 1.Simplify the condition logic in 2.Use helper function devm_clk_get_enabled() commit d3de84858811ea2c501cb45f0aafcae5beba20b6 Merge: 23d3f6ecafbbc7 267be32b0a7b70 Author: Mark Brown Date: Mon Jun 9 16:44:21 2025 +0100 ASoC: remove component->id Merge series from Kuninori Morimoto : snd_soc_component has "id", but no one is using it except Qcom. It is initialized at snd_soc_component_initialize(), but Qcom overwrites it. According to Srinivas, unfortunately, current Qcom lpass is broken. But we can update it and then, avoid to use component->id. Let's do it, and remove it. commit 23d3f6ecafbbc7cd98925a87a4f59794928348b9 Merge: d0bdcfcab39029 f6f914893d478b Author: Mark Brown Date: Mon Jun 9 16:44:17 2025 +0100 ASoC: tas571x: add support for tas5753 Merge series from Bram Vlerick : Add support for the ti,tas5753 to tas571x driver. commit d0bdcfcab39029c52c81d4126b1e1e1e91be93a9 Merge: 4388f5d214cb56 111a2c8ab462d7 Author: Mark Brown Date: Mon Jun 9 16:44:13 2025 +0100 Use helper function for_each_child_of_node_scoped() Merge series from Ai Chao : This patch series introduces wrapper functions for_each_child_of_node_scoped(). The for_each_child_of_node_scoped() helper provides a scope-based clean-up functionality to put the device_node automatically, and as such, there is no need to call of_node_put() directly. commit 4388f5d214cb56833907c0b1f3ddf56ecd3c6d4e Merge: 65613ac1b4b583 c95e925daa434e Author: Mark Brown Date: Mon Jun 9 16:44:08 2025 +0100 ASoC: Intel: avs: Add rt5640 board support Merge series from Cezary Rojewski : Small set of patches intoducing two low-impact improvements to rt5640 codec driver and then avs_rt5640 machine board driver. The board behavior is based on existing boards such as avs_rt274. In regard to the retry-device-verification change, there is number of similar "fixes" found in the Realtek code in sound/soc/codecs. What I provide here is verified with tests, the delay is not mentioned in the spec I have access to. commit 65613ac1b4b5835efc7681d40d0381b0efbffb07 Merge: 6ba68e5aa9d5d1 b9ecde0bcf6a99 Author: Mark Brown Date: Mon Jun 9 16:44:04 2025 +0100 ASoC: codecs: wcd93xx: Few simplifications of code and Merge series from Krzysztof Kozlowski : Make the WCD93xx codec drivers simpler using devm_regulator_bulk_get_enable() and obtain missing VDD_PX supply on wcd939x. Context depends on fixes: https://lore.kernel.org/r/20250526-b4-b4-asoc-wcd9395-vdd-px-fixes-v1-0-0b8a2993b7d3@linaro.org commit cf5543870186d6f99b631faaeca27beaa996d52f Author: Petr Mladek Date: Wed Jun 4 16:20:45 2025 +0200 printk: Allow to use the printk kthread immediately even for 1st nbcon The kthreads for nbcon consoles are created by nbcon_alloc() at the beginning of the console registration. But it currently works only for the 2nd or later nbcon console because the code checks @printk_kthreads_running. The kthread for the 1st registered nbcon console is created at the very end of register_console() by printk_kthreads_check_locked(). As a result, the entire log is replayed synchronously when the "enabled" message gets printed. It might block the boot for a long time with a slow serial console. Prevent the synchronous flush by creating the kthread even for the 1st nbcon console when it is safe (kthreads ready and no boot consoles). Also inform printk() to use the kthread by setting @printk_kthreads_running. Note that the kthreads already must be running when it is safe and this is not the 1st nbcon console. Symmetrically, clear @printk_kthreads_running when the last nbcon console was unregistered by nbcon_free(). This requires updating @have_nbcon_console before nbcon_free() gets called. Note that there is _no_ problem when the 1st nbcon console replaces boot consoles. In this case, the kthread will be started at the end of registration after the boot consoles are removed. But the console does not reply the entire log buffer in this case. Note that the flag CON_PRINTBUFFER is always cleared when the boot consoles are removed and vice versa. Closes: https://lore.kernel.org/r/20250514173514.2117832-1-mcobb@thegoodpenguin.co.uk Tested-by: Michael Cobb Reviewed-by: John Ogness Link: https://patch.msgid.link/20250604142045.253301-1-pmladek@suse.com Signed-off-by: Petr Mladek commit de1c831a7898f164c1c2703c6b2b9e4fb4bebefc Author: Kees Cook Date: Tue Apr 15 10:02:33 2025 -0700 slab: Decouple slab_debug and no_hash_pointers Some system owners use slab_debug=FPZ (or similar) as a hardening option, but do not want to be forced into having kernel addresses exposed due to the implicit "no_hash_pointers" boot param setting.[1] Introduce the "hash_pointers" boot param, which defaults to "auto" (the current behavior), but also includes "always" (forcing on hashing even when "slab_debug=..." is defined), and "never". The existing "no_hash_pointers" boot param becomes an alias for "hash_pointers=never". This makes it possible to boot with "slab_debug=FPZ hash_pointers=always". Link: https://github.com/KSPP/linux/issues/368 [1] Fixes: 792702911f58 ("slub: force on no_hash_pointers when slub_debug is enabled") Co-developed-by: Sergio Perez Gonzalez Signed-off-by: Sergio Perez Gonzalez Acked-by: Vlastimil Babka Acked-by: David Rientjes Reviewed-by: Bagas Sanjaya Signed-off-by: Kees Cook Reviewed-by: Harry Yoo Acked-by: Rafael Aquini Tested-by: Petr Mladek Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20250415170232.it.467-kees@kernel.org [kees@kernel.org: Add note about hash_pointers into slab_debug kernel parameter documentation.] Signed-off-by: Petr Mladek commit 227c394d13bca9249033505f0f65be6bad21ba16 Author: Michal Wajdeczko Date: Fri Jun 6 22:43:11 2025 +0200 drm/xe/uc: Use GT-oriented firmware messages We are already prepared to define firmwares per-GT type, so we should also prepare our messages to be GT-oriented. Signed-off-by: Michal Wajdeczko Cc: Daniele Ceraolo Spurio Cc: Lucas De Marchi Cc: John Harrison Reviewed-by: Jonathan Cavitt Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250606204311.813-1-michal.wajdeczko@intel.com commit 6ba68e5aa9d5d15c8877a655db279fcfc0b38b04 Author: Geert Uytterhoeven Date: Fri May 16 15:32:25 2025 +0200 ASoC: renesas: msiof: Convert to Convert the MSIOF I2S driver to reuse the MSIOF register and register bit definitions in the header file shared by the MSIOF SPI driver. Signed-off-by: Geert Uytterhoeven Tested-by: Kuninori Morimoto Link: https://patch.msgid.link/754ed54057e54effd06143e71d6cd305c3334eca.1747401908.git.geert+renesas@glider.be Signed-off-by: Mark Brown commit 0779c0ad2a7cc0ae1865860c9bc8732613cc56b1 Author: Venkata Prasad Potturu Date: Mon Jun 9 17:42:32 2025 +0530 ASoC: amd: acp: Fix pointer assignments for snd_soc_acpi_mach structures This patch modifies the assignment of machine structure pointers in the acp_pci_probe function. Previously, the machine pointers were assigned using the address-of operator (&), which caused incompatibility issues in type assignments. Additionally, the declarations of the machine arrays in amd.h have been updated to reflect that they are indeed arrays (`[]`). The code is further cleaned up by declaring the codec structures in amd-acpi-mach.c as static, reflecting their intended usage. error: symbol 'amp_rt1019' was not declared. Should it be static? error: symbol 'amp_max' was not declared. Should it be static? error: symbol 'snd_soc_acpi_amd_acp_machines' was not declared. Should it be static? error: symbol 'snd_soc_acpi_amd_rmb_acp_machines' was not declared. Should it be static? error: symbol 'snd_soc_acpi_amd_acp63_acp_machines' was not declared. Should it be static? error: symbol 'snd_soc_acpi_amd_acp70_acp_machines' was not declared. Should it be static? Fixes: 9c2c0ef64009 ("ASoC: amd: acp: Fix snd_soc_acpi_mach id's duplicate symbol error") Link: https://github.com/thesofproject/linux/issues/5438 Signed-off-by: Venkata Prasad Potturu Link: https://patch.msgid.link/20250609121251.639080-1-venkataprasad.potturu@amd.com Signed-off-by: Mark Brown commit d49305862fdc4d9ff1b1093b4ed7d8e0cb9971b4 Author: Dave Stevenson Date: Mon Jun 9 02:06:42 2025 +0200 regulator: rpi-panel-v2: Add regulator for 7" Raspberry Pi 720x1280 Add regulator for the 7" Raspberry Pi 720x1280 DSI panel based on ili9881. This is the Raspberry Pi DSI Panel V2. The newer Raspberry Pi 5" and 7" panels have a slightly different register map to the original one. Add a new driver for this "regulator" chip, this time by exposing two GPIOs and one PWM controller, both of which can be consumed by panel driver and pwm-backlight respectively. Signed-off-by: Dave Stevenson Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20250609000748.1665219-2-marek.vasut+renesas@mailbox.org Signed-off-by: Mark Brown commit 6d09c6e474bd27a86352deaf73d02c8c21eeec7c Author: Marek Vasut Date: Mon Jun 9 02:06:41 2025 +0200 regulator: dt-bindings: rpi-panel: Add regulator for 7" Raspberry Pi 720x1280 Document regulator compatible string for the 7" Raspberry Pi 720x1280 DSI panel based on ili9881. This is the Raspberry Pi DSI Panel V2. The newer Raspberry Pi 5" and 7" panels have a slightly different register map to the original one and offers PWM backlight control. Signed-off-by: Marek Vasut Link: https://patch.msgid.link/20250609000748.1665219-1-marek.vasut+renesas@mailbox.org Signed-off-by: Mark Brown commit 1f5cdb6ab45e1c06ae0953609acbb52f8946b3e8 Author: ChiYuan Huang Date: Mon Jun 9 15:47:28 2025 +0800 ASoC: codecs: Add support for Richtek RTQ9124 Add codecs driver for Richtek RTQ9124. Signed-off-by: ChiYuan Huang Link: https://patch.msgid.link/aca49d1912bfd1b90e82146df6393760a731810c.1749454717.git.cy_huang@richtek.com Signed-off-by: Mark Brown commit 5c694e3a83d089df6b00747cf4627735ea14014e Author: ChiYuan Huang Date: Mon Jun 9 15:47:27 2025 +0800 ASoC: dt-bindings: rt9123: Append RTQ9124 description Document the ASoC Richtek RTQ9124 in existed RT9123 file. Signed-off-by: ChiYuan Huang Link: https://patch.msgid.link/9921d64ce4d63c24499f92ef33a4ce7cb018c60b.1749454717.git.cy_huang@richtek.com Signed-off-by: Mark Brown commit 188bdfb77615ab14da49bf1438ab3a1413da9898 Author: Jani Nikula Date: Fri Jun 6 13:22:56 2025 +0300 drm/i915: split out display register macros to a separate file This is a scripted split of the display related register macros from i915_reg.h to display/intel_display_regs.h. As a starting point, move all the macros that are only used in display code (or GVT). If there are users in core i915 code or soc/, or no users anywhere, keep the macros in i915_reg.h. This is done in groups of macros separated by blank lines, moving the comments along with the groups. Some manually picked macro groups are kept/moved regardless of the heuristics above. This is obviously a very crude approach. It's not perfect. But there are 4.2k lines in i915_reg.h, and its refactoring has ground to a halt. This is the big hammer that splits the file to two, and enables further cleanup. Cc: Suraj Kandpal Cc: Ville Syrjälä Cc: Lucas De Marchi Reviewed-by: Suraj Kandpal # v2 Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250606102256.2080073-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit d69cb63780943fc1b0765bb9b46f627573cc97d1 Author: Peter Robinson Date: Sun May 18 22:59:33 2025 +0100 arm64: dts: rockchip: drop touch panel display from rockpro64 The touch panel display is an optional add on for the RockPro64 so this should be an DT overlay, drop the panel options in preparation to add this as an overlay. This effectively reverts commit b65155c786c4 so as to add an overlay for it. Signed-off-by: Peter Robinson Link: https://lore.kernel.org/r/20250518215944.178582-1-pbrobinson@gmail.com Signed-off-by: Heiko Stuebner commit 34c55367af96f62e89221444f04487440ebc6487 Merge: 7247efca0dcbc8 19272b37aa4f83 Author: Jani Nikula Date: Mon Jun 9 12:40:46 2025 +0300 Merge drm/drm-next into drm-intel-next Sync to v6.16-rc1, among other things to get the fixed size GENMASK_U*() and BIT_U*() macros. Signed-off-by: Jani Nikula commit e7c1a9e8d33ceb44ef088de7a9112a1db94d13a4 Author: Suma Hegde Date: Tue Jun 3 05:58:07 2025 +0000 platform/x86/amd/hsmp: Use IS_ENABLED() instead of IS_REACHABLE() IS_REACHABLE() was required when CONFIG_HWMON was set to m and HSMP to y. However, commit 69157b00b526 ("platform/x86/amd/hsmp: fix building with CONFIG_HWMON=m") added a HWMON dependency for HSMP in Kconfig. With this change, using IS_ENABLED() is sufficient. Add the missing header file as well. Signed-off-by: Suma Hegde Link: https://lore.kernel.org/r/20250603055807.2503028-1-suma.hegde@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 844d8e4c7f9a3eeb681493f12c55de0392510fe3 Author: Kurt Borja Date: Wed May 28 07:47:22 2025 -0300 platform/x86: alienware-wmi-wmax: Add appropriate labels to fans Add known fan type IDs and match them to an appropriate label in awcc_hwmon_read_string(). Additionally, add the AWCC_TEMP_SENSOR_FRONT type, which was inferred from it's related fan type in supported systems. Signed-off-by: Kurt Borja Reviewed-by: Armin Wolf Link: https://lore.kernel.org/r/20250528-awcc-labels-v1-1-6aa39d8e4c3d@gmail.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen commit 63136c6fecf44b4f2cb458b01cfdbc2cb0ddd29c Author: John Clark Date: Mon May 19 20:33:32 2025 -0400 arm64: dts: rockchip: Use standard PHY reset properties for RK3576 ArmSoM Sige5 Replace deprecated snps,reset-gpio, snps,reset-active-low, and snps,reset-delays-us in gmac0 and gmac1 nodes with standard reset-gpios, reset-assert-us, and reset-deassert-us in rgmii_phy0 and rgmii_phy1 nodes. Add pinctrl properties to PHY nodes and define gmac0_rst and gmac1_rst in pinctrl node. Reorder phy-handle for consistency. Signed-off-by: John Clark Link: https://lore.kernel.org/r/20250520003332.163124-2-inindev@gmail.com Signed-off-by: Heiko Stuebner commit 0ea651de9b79a17cbe410a69399877805c136b76 Author: Nicolas Frattaroli Date: Tue May 20 20:50:11 2025 +0200 arm64: dts: rockchip: add ROCK 5T device tree The RADXA ROCK 5T is a single board computer quite similar to the ROCK 5B+, except it has one more PCIe-to-Ethernet controller (at the expense of a USB3 port) and a barrel jack for power input instead. Some pins are shuffled around as well. Add a device tree for it. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250520-add-rock5t-v2-4-1f1971850a20@collabora.com Signed-off-by: Heiko Stuebner commit 988035f152709549a095b12fcdcb3cf26cbad63f Author: Nicolas Frattaroli Date: Tue May 20 20:50:10 2025 +0200 arm64: dts: rockchip: move common ROCK 5B/+ nodes into own tree A few device tree nodes are shared between ROCK 5B and ROCK 5B+ that are not shared with ROCK 5T. Move them into their own device tree include. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250520-add-rock5t-v2-3-1f1971850a20@collabora.com Signed-off-by: Heiko Stuebner commit 8b76abf78321ea3361c01e849c8dc3a6793c05d6 Author: Nicolas Frattaroli Date: Tue May 20 20:50:09 2025 +0200 arm64: dts: rockchip: rename rk3588-rock-5b.dtsi As subsequent patches will add ROCK 5T support, rename the .dtsi file to reflect that it's shared between ROCK 5B, ROCK 5B+ and ROCK 5T. This is done separately from moving the 5B and 5B+ only nodes to a common tree so that the history stays bisectable and the diff easily reviewable. Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250520-add-rock5t-v2-2-1f1971850a20@collabora.com Signed-off-by: Heiko Stuebner commit ecf7114f818148df10f4e13b5e1087de2f5d687e Author: Nicolas Frattaroli Date: Tue May 20 20:50:08 2025 +0200 dt-bindings: arm: rockchip: add RADXA ROCK 5T The RADXA ROCK 5T is a single board computer aimed at industrial use. Its design is similar to the ROCK 5B+, but it does away with one of the USB-C PD inputs, and uses one combination USB3/SATA/PCIe PHY for an additional second 2.5G PCIe network card instead of USB3. Link: https://radxa.com/products/rock5/5t/ Acked-by: Krzysztof Kozlowski Signed-off-by: Nicolas Frattaroli Link: https://lore.kernel.org/r/20250520-add-rock5t-v2-1-1f1971850a20@collabora.com Signed-off-by: Heiko Stuebner commit 2783335329e5762deb0dc5b6d634225d8613af16 Author: Chukun Pan Date: Tue May 20 18:01:02 2025 +0800 arm64: dts: rockchip: Add spi nodes for RK3528 There are 2 SPI controllers on the RK3528 SoC, describe it. Signed-off-by: Chukun Pan Link: https://lore.kernel.org/r/20250520100102.1226725-3-amadeus@jmu.edu.cn Signed-off-by: Heiko Stuebner commit 79f2a17024412fd6f62208ab3fd6814e52588a31 Author: Hsun Lai Date: Wed May 21 21:11:08 2025 +0800 arm64: dts: rockchip: add DTs for Sakura Pi RK3308B The Sakura Pi RK3308B is a SBC based on the Rockchip RK3308 SoC. Link: https://github.com/Sakura-Pi Link: https://docs.sakurapi.org/article/sakurapi-rk3308b/introduce The device contains the following hardware that is tested/working: - 4 or 8GB eMMC - SDMMC card slot - Realtek SDIO WiFi 5/BT - 256 or 512MB of RAM - USB 2.0 port - OTG port Signed-off-by: Hsun Lai Link: https://lore.kernel.org/r/20250521131108.5710-4-i@chainsx.cn Signed-off-by: Heiko Stuebner commit bc099a4f5b7d08d97684648abe58d236cb7afa4f Author: Hsun Lai Date: Wed May 21 21:11:07 2025 +0800 dt-bindings: arm: rockchip: Add Sakura Pi RK3308B This patch adds device tree binding support for Sakura Pi RK3308B, with compatibility for the Rockchip RK3308 SoC. Link: https://docs.sakurapi.org/article/sakurapi-rk3308b/introduce Signed-off-by: Hsun Lai Acked-by: Conor Dooley Link: https://lore.kernel.org/r/20250521131108.5710-3-i@chainsx.cn Signed-off-by: Heiko Stuebner commit 281bf6e619fc637282288a3a087e2b2ed3150cd5 Author: Hsun Lai Date: Wed May 21 21:11:06 2025 +0800 dt-bindings: vendor-prefixes: Add SakuraPi prefix Add vendor prefix for SakuraPi.org, which produces development boards like the SakuraPi-RK3308B. Link: https://docs.sakurapi.org Signed-off-by: Hsun Lai Acked-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250521131108.5710-2-i@chainsx.cn Signed-off-by: Heiko Stuebner commit 3f391123e2bc88c570f148cc01e923e4740c5173 Author: Diederik de Haas Date: Mon May 26 18:14:47 2025 +0200 arm64: dts: rockchip: Fix cover detection on PineNote The SW_MACHINE_COVER switch event was added to input event codes to detect the removal of the back cover of the N900. But on the PineNote its purpose is to detect when the front cover gets closed, just like when a laptop lid is closed. Therefore SW_LID is the appropriate linux code and not SW_MACHINE_COVER. Reported-by: hrdl Helped-by: phantomas Link: https://lore.kernel.org/r/270f27c9-afd6-171d-7dce-fe1d71dd8f9a@wizzup.org/ Signed-off-by: Diederik de Haas Link: https://lore.kernel.org/r/20250526161506.139028-1-didi.debian@cknow.org Signed-off-by: Heiko Stuebner commit e0d47ff478fa549aeb168d921b66011f0397007d Author: Chris Morgan Date: Tue Jun 3 21:41:19 2025 -0500 arm64: dts: rockchip: Document unused device on i2c1 Update the i2c1 bus noting that the unknown/unused device at 0x3c is an iSmartWare SW2001 "encryption IC". Based on the documentation I was able to find, this IC appears to be used to authenticate a device for certain programs to ensure they only run on authorized devices as a form of digital rights management. Signed-off-by: Chris Morgan Link: https://lore.kernel.org/r/20250604024119.381337-1-macroalpha82@gmail.com Signed-off-by: Heiko Stuebner commit 8674f059750571f168db9f43d3c02f1975debcc9 Author: Quentin Schulz Date: Wed Jun 4 18:18:08 2025 +0200 arm64: dts: rockchip: support Ethernet Switch adapter for RK3588 Jaguar This adds support for the Ethernet Switch adapter connected to the mezzanine connector on RK3588 Jaguar. This adapter has a KSZ9896 Ethernet Switch with 4 1GbE Ethernet connectors, two user controllable LEDs, and an M12 12-pin connector which exposes the following signals: - RS232/RS485 (max 250Kbps/500Kbps, RX pin1, TX pin2) - two digital inputs (pin4 routed to GPIO3_C5 on SoC, pin5 to GPIO4_B4) - two digital outputs (pin7 routed to GPIO3_D3 on SoC, pin8 to GPIO3_D1) - two analog inputs (pin10 to channel1 of ADS1015, pin11 to channel2) Signed-off-by: Quentin Schulz [Andrew's review for gmac1 and switch@5f parts] Reviewed-by: Andrew Lunn Link: https://lore.kernel.org/r/20250604-jaguar-mezz-eth-switch-v3-1-c68123240f9e@cherry.de Signed-off-by: Heiko Stuebner commit 6b28769116971a4427ea09ed2cb1cf1afa79ab82 Author: Chris Morgan Date: Tue Jun 3 14:39:30 2025 -0500 arm64: dts: rockchip: Add DSI panel support for gameforce-ace Enable the DSI controller, DSI DCPHY, and Huiling hl055fhav028c 1080x1920 panel for the Gameforce Ace. Signed-off-by: Chris Morgan Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250603193930.323607-5-macroalpha82@gmail.com [moved lcd_rst pin into a lcd pinctrl group with lcd_bl_en] Signed-off-by: Heiko Stuebner commit b2d6fd7ac598880f29989ebd763957dcedd66d40 Author: Maarten Lankhorst Date: Mon May 5 14:19:23 2025 +0200 drm/xe: Do not rely on GGTT internals in xe_guc_buf kunit tests Add a function to init ggtt for kunit, and use the GGTT function for initialising the GGTT node without populating it. This prevents the test from ever knowing about struct xe_ggtt. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250505121924.921544-11-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit e0096fdcf88ce5e64a4c2e62d3198f05a70052d8 Author: Maarten Lankhorst Date: Mon May 5 14:19:22 2025 +0200 drm/xe: Implement a helper for reading out a GGTT PTE at a specified offset Split the GGTT PTE readout to a separate function, this is useful for adding testcases in the next commit, and also cleaner than manually reading out GGTT. Reviewed-by: Juha-Pekka Heikkila Link: https://lore.kernel.org/r/20250505121924.921544-10-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 0c52d722524a2ac3aefdbbc4cbc33658b08b9f79 Author: Maarten Lankhorst Date: Mon May 5 14:19:21 2025 +0200 drm/xe: Remove pte_encode_bo callback The users inside display have been converted to use thepte_encode_flags callback, we can now remove the pte_encode_bo cb. Reviewed-by: Juha-Pekka Heikkila Link: https://lore.kernel.org/r/20250505121924.921544-9-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 34eca621335819bee9954064cab976e58af2ff8b Author: Maarten Lankhorst Date: Mon May 5 14:19:20 2025 +0200 drm/xe/display: Convert GGTT mapping to use pte_encode_flags Another small step in removing pte_encode_bo callback. Reviewed-by: Juha-Pekka Heikkila Link: https://lore.kernel.org/r/20250505121924.921544-8-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 8ce1c8cc68208bf5a3f4dfddbdb6579ae6f75be5 Author: Maarten Lankhorst Date: Mon May 5 14:19:19 2025 +0200 drm/xe/display: Dont poke into GGTT internals to fill a DPT For DPT, it is sufficient to get the GGTT encode flags to fill the DPT. Create a function to return the encode flags, and then encode using the BO address. Reviewed-by: Juha-Pekka Heikkila Link: https://lore.kernel.org/r/20250505121924.921544-7-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 57f6af194fcd4d9901d0060b996dfb0d5543c4b7 Author: Maarten Lankhorst Date: Mon May 5 14:19:18 2025 +0200 drm/xe/ggtt: Seperate flags and address in PTE encoding Pinning large linear display framebuffers is becoming a bottleneck. My plan of attack is doing a custom walk over the BO, this allows for easier optimization of consecutive entries. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250505121924.921544-6-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit ea54d492853275b92a2407825d61bd8df8760cfd Author: Maarten Lankhorst Date: Mon May 5 14:19:17 2025 +0200 drm/xe/display: Remove dereferences of ggtt for tile id Obtain the id from the root tile. Likely this can be hardcoded to 0, but use the clean solution of obtaining root id and doing that. to_xe_device(ggtt->tile) can also be easily replaced with xe. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250505121924.921544-5-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit e0ee402750e12e35a14e8abe794544972eba8c92 Author: Maarten Lankhorst Date: Mon May 5 14:19:16 2025 +0200 drm/xe: Add xe_ggtt_alloc Instead of allocating inside xe_tile, create a new function that returns an allocated struct xe_ggtt from xe_ggtt.c Signed-off-by: Maarten Lankhorst Reviewed-by: Matthew Brost Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250505121924.921544-4-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit b5fe33dcb8d4b6cf4d4664eaf2432617a7843bf9 Author: Maarten Lankhorst Date: Mon May 5 14:19:15 2025 +0200 drm/xe: Add xe_ggtt_might_lock Another requirement of hiding more of struct xe_ggtt. Signed-off-by: Maarten Lankhorst Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250505121924.921544-3-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 3975d356839e2c1ec53392fb21a0bbac56c2ca3f Author: Maarten Lankhorst Date: Mon May 5 14:19:14 2025 +0200 drm/xe: Use xe_ggtt_map_bo_unlocked for resume This is the first step to hide the details of struct xe_ggtt. Signed-off-by: Maarten Lankhorst Reviewed-by: Matthew Brost Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250505121924.921544-2-dev@lankhorst.se Signed-off-by: Maarten Lankhorst commit 9a2d22a46b385eb297aba88180ce358977d7fd88 Author: Maarten Lankhorst Date: Thu Jun 5 09:46:44 2025 +0200 drm/xe: Remove IOSF_MBI select. IOSF_MBI was only useful for some gen8 platforms, which were never supported by Xe. Presumably needed for display at one point, but display is fixed to put stubs in compat-i915-headers/vlv_sideband.h. (in drm-intel-next: vlv_iosf_sb.h) Link: https://lore.kernel.org/r/20250605074644.71036-1-dev@lankhorst.se Reviewed-by: Lucas De Marchi Signed-off-by: Maarten Lankhorst commit 92f59aeb13252265c20e7aef1379a8080c57e0a2 Author: Christophe Leroy Date: Fri Jun 6 11:44:02 2025 +0200 ALSA: pcm: Rewrite recalculate_boundary() to avoid costly loop At the time being recalculate_boundary() is implemented with a loop which shows up as costly in a perf profile, as depicted by the annotate below: 0.00 : c057e934: 3d 40 7f ff lis r10,32767 0.03 : c057e938: 61 4a ff ff ori r10,r10,65535 0.21 : c057e93c: 7d 49 50 50 subf r10,r9,r10 5.39 : c057e940: 7d 3c 4b 78 mr r28,r9 2.11 : c057e944: 55 29 08 3c slwi r9,r9,1 3.04 : c057e948: 7c 09 50 40 cmplw r9,r10 2.47 : c057e94c: 40 81 ff f4 ble c057e940 Total: 13.2% on that simple loop. But what the loop does is to multiply the boundary by 2 until it is over the wanted border. This can be avoided by using fls() to get the boundary value order and shift it by the appropriate number of bits at once. This change provides the following profile: 0.04 : c057f6e8: 3d 20 7f ff lis r9,32767 0.02 : c057f6ec: 61 29 ff ff ori r9,r9,65535 0.34 : c057f6f0: 7d 5a 48 50 subf r10,r26,r9 0.23 : c057f6f4: 7c 1a 50 40 cmplw r26,r10 0.02 : c057f6f8: 41 81 00 20 bgt c057f718 0.26 : c057f6fc: 7f 47 00 34 cntlzw r7,r26 0.09 : c057f700: 7d 48 00 34 cntlzw r8,r10 0.22 : c057f704: 7d 08 38 50 subf r8,r8,r7 0.04 : c057f708: 7f 5a 40 30 slw r26,r26,r8 0.35 : c057f70c: 7c 0a d0 40 cmplw r10,r26 0.13 : c057f710: 40 80 05 f8 bge c057fd08 0.00 : c057f714: 57 5a f8 7e srwi r26,r26,1 Total: 1.7% with that loopless alternative. Signed-off-by: Christophe Leroy Link: https://patch.msgid.link/4836e2cde653eebaf2709ebe30eec736bb8c67fd.1749202237.git.christophe.leroy@csgroup.eu Signed-off-by: Takashi Iwai commit ed57a3d5a3118b9681de607692608fe573c5959d Author: Lucy Thrun Date: Tue Jun 3 14:53:04 2025 +0200 ALSA: hda/ca0132: Enable hardware band EQ for Sound Blaster Core3D This patch enables the Hardware DSP-based 10-band hardware equalizer on Sound Blaster Core3D (CA0132) based cards for example the soundblaster z and soundblaster x-ae5, allowing fine-grained audio tuning via hardware registers. Tested on Sound Blaster X-AE5. No regressions observed. Signed-off-by: Lucy Thrun Link: https://patch.msgid.link/20250603125304.507-1-lucy.thrun@digital-rabbithole.de Signed-off-by: Takashi Iwai commit 9955ea2e3698411fc798b2056facdf3f6e56aa61 Author: Baojun Xu Date: Mon Jun 2 09:58:09 2025 +0800 ALSA: hda/tas2781: Add missed brace and hardware id re-order This patch is do code clean and prepare for next patch, which is relative with hardware id. Signed-off-by: Baojun Xu Link: https://patch.msgid.link/20250602015809.20344-1-baojun.xu@ti.com Signed-off-by: Takashi Iwai commit 79d561c4ec0497669f19a9550cfb74812f60938b Author: Cristian Ciocaltea Date: Mon May 26 17:07:48 2025 +0300 ALSA: usb-audio: Add mixer quirk for Sony DualSense PS5 The Sony DualSense wireless controller (PS5) features an internal mono speaker, but it also provides a 3.5mm jack socket for headphone output and headset microphone input. Since this is a UAC1 device, it doesn't advertise any jack detection capability. However, the controller is able to report HP & MIC insert events via HID, i.e. through a dedicated input device managed by the hid-playstation driver. Add a quirk to create the jack controls for headphone and headset mic, respectively, and setup an input handler for each of them in order to intercept the related hotplug events. Signed-off-by: Cristian Ciocaltea Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-9-1a821463b632@collabora.com commit 9cea7425595697802e8d55a322a251999554b8b1 Author: Cristian Ciocaltea Date: Mon May 26 17:07:47 2025 +0300 ALSA: usb-audio: Remove unneeded wmb() in mixer_quirks Adding a memory barrier before wake_up() in snd_usb_soundblaster_remote_complete() is supposed to ensure the write to mixer->rc_code is visible in wait_event_interruptible() from snd_usb_sbrc_hwdep_read(). However, this is not really necessary, since wake_up() is just a wrapper over __wake_up() which already executes a full memory barrier before accessing the state of the task to be waken up. Drop the redundant call to wmb() and implicitly fix the checkpatch complaint: WARNING: memory barrier without comment Signed-off-by: Cristian Ciocaltea Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-8-1a821463b632@collabora.com commit f2d6d660e8fd5f4467e80743f82119201e67fa9c Author: Cristian Ciocaltea Date: Mon May 26 17:07:46 2025 +0300 ALSA: usb-audio: Simplify NULL comparison in mixer_quirks Handle report from checkpatch.pl: CHECK: Comparison to NULL could be written "t->name" Signed-off-by: Cristian Ciocaltea Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-7-1a821463b632@collabora.com commit 03ddd3bdb94df3edb1f2408b57cfb00b3d92a208 Author: Cristian Ciocaltea Date: Mon May 26 17:07:45 2025 +0300 ALSA: usb-audio: Avoid multiple assignments in mixer_quirks Handle report from checkpatch.pl: CHECK: multiple assignments should be avoided Signed-off-by: Cristian Ciocaltea Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-6-1a821463b632@collabora.com commit c0495cef8b43ad61efbd4019e3573742e0e63c67 Author: Cristian Ciocaltea Date: Mon May 26 17:07:44 2025 +0300 ALSA: usb-audio: Drop unnecessary parentheses in mixer_quirks Fix multiple 'CHECK: Unnecessary parentheses around ...' reports from checkpatch.pl. Signed-off-by: Cristian Ciocaltea Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-5-1a821463b632@collabora.com commit 231225d8a20f8668b4fd6601d54a2fac0e0ab7a5 Author: Cristian Ciocaltea Date: Mon May 26 17:07:43 2025 +0300 ALSA: usb-audio: Fix block comments in mixer_quirks Address a couple of comment formatting issues indicated by checkpatch.pl: WARNING: Block comments use a trailing */ on a separate line Signed-off-by: Cristian Ciocaltea Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-4-1a821463b632@collabora.com commit fd3ab72e42e9871a9902b945a2bf8bb87b49c718 Author: Cristian Ciocaltea Date: Mon May 26 17:07:42 2025 +0300 ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros Fix all macro related issues identified by checkpatch.pl: CHECK: Macro argument 'x' may be better as '(x)' to avoid precedence issues Signed-off-by: Cristian Ciocaltea Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-3-1a821463b632@collabora.com commit df6b4dcf2e2c3b4e34c3213a575c92d0c9415d0d Author: Cristian Ciocaltea Date: Mon May 26 17:07:41 2025 +0300 ALSA: usb-audio: Fix whitespace & blank line issues in mixer_quirks Address all whitespace & blank line(s) related issues reported by checkpatch.pl: ERROR: trailing whitespace ERROR: space required after that ',' (ctx:VxV) WARNING: Missing a blank line after declarations CHECK: Please use a blank line after function/struct/union/enum declarations CHECK: Please don't use multiple blank lines Signed-off-by: Cristian Ciocaltea Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-2-1a821463b632@collabora.com commit bca638aa737d13749a871d1a0d2ed276501ffc54 Author: Cristian Ciocaltea Date: Mon May 26 17:07:40 2025 +0300 ALSA: usb-audio: Fix code alignment in mixer_quirks Format code to fix all alignment issues reported by checkpatch.pl: CHECK: Alignment should match open parenthesis Signed-off-by: Cristian Ciocaltea Signed-off-by: Takashi Iwai Link: https://patch.msgid.link/20250526-dualsense-alsa-jack-v1-1-1a821463b632@collabora.com commit 126cbd0deb9b88754f5f67cbd4c3399c74688bdc Author: Angelo Dureghello Date: Fri Jun 6 16:19:22 2025 +0200 iio: adc: ad7606: add gain calibration support Add gain calibration support, using resistor values set on devicetree, values to be set accordingly with ADC external RFilter, as explained in the ad7606c-16 datasheet, rev0, page 37. Usage example in the fdt yaml documentation. Signed-off-by: Angelo Dureghello Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250606-wip-bl-ad7606-calibration-v9-7-6e014a1f92a2@baylibre.com Signed-off-by: Jonathan Cameron commit cc2eca43091eaeaf3875ce3e8d95de763c78eccb Author: Angelo Dureghello Date: Fri Jun 6 16:19:21 2025 +0200 iio: adc: ad7606: rename chan_scale to a more generic chan_info Non functional, renaming chan-related chan_scale structure to a more generic chan_info, to host other chan specific settings, not just scale-related. Signed-off-by: Angelo Dureghello Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250606-wip-bl-ad7606-calibration-v9-6-6e014a1f92a2@baylibre.com Signed-off-by: Jonathan Cameron commit 9dc4ef3a5b9f6b28f27aa29977049c84cdec4755 Author: Angelo Dureghello Date: Fri Jun 6 16:19:20 2025 +0200 iio: adc: ad7606: exit for invalid fdt dt_schema properties Fix ad7606_get_chan_config() fdt parsing function to exit for error in case of invalid dt_schema values. Idea is to not proceed when there are values that are not allowed under the dt_schema. Signed-off-by: Angelo Dureghello Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250606-wip-bl-ad7606-calibration-v9-5-6e014a1f92a2@baylibre.com Signed-off-by: Jonathan Cameron commit e986466a92da6a0e8acf118facfb05a6d6d4dbcf Author: Angelo Dureghello Date: Fri Jun 6 16:19:19 2025 +0200 dt-bindings: iio: adc: adi,ad7606: add gain calibration support Add gain calibration support by a per-channel resistor value. Acked-by: Conor Dooley Signed-off-by: Angelo Dureghello Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250606-wip-bl-ad7606-calibration-v9-4-6e014a1f92a2@baylibre.com Signed-off-by: Jonathan Cameron commit 48d487dc64455641eafc6dcebeba8741999dd58d Author: Angelo Dureghello Date: Fri Jun 6 16:19:18 2025 +0200 iio: adc: ad7606: add offset and phase calibration support Add support for offset and phase calibration, only for devices that support software mode, that are: ad7606b ad7606c-16 ad7606c-18 Tested-by: David Lechner Reviewed-by: Nuno Sá Signed-off-by: Angelo Dureghello Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250606-wip-bl-ad7606-calibration-v9-3-6e014a1f92a2@baylibre.com Signed-off-by: Jonathan Cameron commit 342c52dde2f031add61ddeaced9c100f88e04d09 Author: Angelo Dureghello Date: Fri Jun 6 16:19:17 2025 +0200 iio: core: add ADC delay calibration definition ADCs as ad7606 implement a phase calibration as a delay. Add such definition, needed for ad7606. Signed-off-by: Angelo Dureghello Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250606-wip-bl-ad7606-calibration-v9-2-6e014a1f92a2@baylibre.com Signed-off-by: Jonathan Cameron commit c86b60189f35be0657166381a6d269990cd7190a Author: Angelo Dureghello Date: Fri Jun 6 16:19:16 2025 +0200 Documentation: ABI: IIO: add new convdelay documentation Add new IIO "convdelay" documentation. The ad7606 implements a phase calibation feature, in nanoseconds. Being this a time delay, using the convdelay suffix. Signed-off-by: Angelo Dureghello Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/20250606-wip-bl-ad7606-calibration-v9-1-6e014a1f92a2@baylibre.com Signed-off-by: Jonathan Cameron commit 7e54d932873d91a55d1b89b7389876d78aeeab32 Author: Jonathan Santos Date: Wed Jun 4 16:35:21 2025 -0300 iio: adc: ad7768-1: Ensure SYNC_IN pulse minimum timing requirement The SYNC_IN pulse width must be at least 1.5 x Tmclk, corresponding to ~2.5 µs at the lowest supported MCLK frequency. Add a 3 µs delay to ensure reliable synchronization timing even for the worst-case scenario. Signed-off-by: Jonathan Santos Reviewed-by: David Lechner Reviewed-by: Andy Shevchenko Link: https://patch.msgid.link/d3ee92a533cd1207cf5c5cc4d7bdbb5c6c267f68.1749063024.git.Jonathan.Santos@analog.com Signed-off-by: Jonathan Cameron commit a238572b90876c9030655b7fb062b79b5972034f Author: Rodrigo Gobbi Date: Tue May 27 17:55:28 2025 -0300 dt-bindings: iio: gyroscope: invensense,itg3200: add binding There is no txt file for it, add yaml for invensense,itg3200 gyroscope given existing driver and use in DTS. Signed-off-by: Rodrigo Gobbi Reviewed-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250527210308.4693-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Jonathan Cameron commit 60295feef9cf0ca880142a93634fca945809a638 Author: Denis Benato Date: Sun May 25 16:25:30 2025 +0200 iio: bmi160: suspend and resume triggering on relevant pm operations Prevent triggers from stop working after the device has entered sleep: use iio_device_suspend_triggering and iio_device_resume_triggering helpers. Closes: https://lore.kernel.org/all/31d7f7aa-e834-4fd0-a66a-e0ff528425dc@gmail.com Signed-off-by: Denis Benato Link: https://patch.msgid.link/20250525142530.71955-3-benato.denis96@gmail.com Signed-off-by: Jonathan Cameron commit cfcb44872aad550c48874bf38db34ba02e4dd029 Author: Denis Benato Date: Sun May 25 16:25:29 2025 +0200 iio: bmi270: suspend and resume triggering on relevant pm operations Prevent triggers from stop working after the device has entered sleep: use iio_device_suspend_triggering and iio_device_resume_triggering helpers. Closes: https://lore.kernel.org/all/31d7f7aa-e834-4fd0-a66a-e0ff528425dc@gmail.com Signed-off-by: Denis Benato Tested-by: Justin Weiss Link: https://patch.msgid.link/20250525142530.71955-2-benato.denis96@gmail.com Signed-off-by: Jonathan Cameron commit 3125a5ca45f4502a230d72876257751d9124e5e6 Author: Angelo Dureghello Date: Fri May 30 16:27:57 2025 +0200 iio: adc: ad7606: add enabling of optional Vrefin voltage Add optional refin voltage enabling. The property "refin-supply" is already available and optional in the current fdt dt_schema. Note that the driver does not need to take any actions if the supply is not present because a pin strap is used to change the behavior of the device if an external reference is connected. Signed-off-by: Angelo Dureghello Link: https://patch.msgid.link/20250530-wip-bl-ad7606-reference-voltages-v2-2-d5e1ad7e6f14@baylibre.com Signed-off-by: Jonathan Cameron commit 82f4ed3a01b25ee6fc2a8a0a57b3509163c8bc57 Author: Angelo Dureghello Date: Fri May 30 16:27:56 2025 +0200 iio: adc: ad7606: enable Vdrive power supply Enable Vdrive power supply. The "vdrive-supply" property is mandatory, already declared in fdt dt_schema. Signed-off-by: Angelo Dureghello Link: https://patch.msgid.link/20250530-wip-bl-ad7606-reference-voltages-v2-1-d5e1ad7e6f14@baylibre.com Signed-off-by: Jonathan Cameron commit dc0756de69dc398faa4472eafb72563672cc5981 Author: Rodrigo Gobbi Date: Thu May 22 17:37:16 2025 -0300 dt-bindings: iio: adc: st,spear600-adc: txt to yaml format conversion. Straight forward conversion from spear-adc.txt into yaml format. Signed-off-by: Rodrigo Gobbi Reviewed-by: Conor Dooley Link: https://patch.msgid.link/20250522204130.21604-1-rodrigo.gobbi.7@gmail.com Signed-off-by: Jonathan Cameron commit c49e99fafee183d3155410353104360e0c512802 Author: Matti Vaittinen Date: Fri May 30 07:40:08 2025 +0300 iio: adc: ad7476: Support ROHM BU79100G ROHM BU79100G is a 12-bit, single channel ADC. From the software point of view it is identical to the TI's ADS7866. Support reading ADC measurements using the ad7476.c Signed-off-by: Matti Vaittinen Link: https://patch.msgid.link/aDk2qNE9LTVnfAFM@mva-rohm Signed-off-by: Jonathan Cameron commit c14896534432e70b2fef20966607dd935d3a2b6e Author: Waqar Hameed Date: Tue May 27 16:45:42 2025 +0200 iio: Remove unused macro definition for driver and IRQ name These macro definitions are completely unused. Remove them. Signed-off-by: Waqar Hameed Link: https://patch.msgid.link/0dec4fe7b2bdc90d06163ac75a53b97d4ae31c21.1748356671.git.waqar.hameed@axis.com Signed-off-by: Jonathan Cameron commit 851b85447c7edc3d94bf530f1744066ad5247fc0 Author: Waqar Hameed Date: Tue May 27 16:45:42 2025 +0200 iio: Remove single use of macro definition for regmap name There is really no reason for having the `regmap` name as a macro definition if it is only used once directly in `struct regmap_config`. It is also more readable this way. Remove these macro definitions and instead use the string literal directly. Signed-off-by: Waqar Hameed Link: https://patch.msgid.link/3a8572de8316c7d2746c2ccea8c478f594221319.1748356671.git.waqar.hameed@axis.com Signed-off-by: Jonathan Cameron commit a8c1039c0620de36d55bdc86447d1597c1d03c5c Author: Waqar Hameed Date: Tue May 27 16:45:42 2025 +0200 iio: Remove single use of macro definition for IRQ name There is really no reason for having the IRQ name as a macro definition if it is only used once (often in functions requesting the IRQ). It is also more readable this way. Remove these macro definitions and instead use the string literal directly. Signed-off-by: Waqar Hameed Link: https://patch.msgid.link/3dc06cb2a83d292c50d9758643aad37ca5c6d95c.1748356671.git.waqar.hameed@axis.com Signed-off-by: Jonathan Cameron commit 178e4bc1e4398e9b051acd2ace7118427136bee9 Author: Waqar Hameed Date: Tue May 27 16:45:41 2025 +0200 iio: Remove single use of macro definition for driver name There is really no reason for having the driver name as a macro definition if it is only used once (often as `.name` in `struct device_driver`). It is also more readable this way. Remove these macro definitions and instead use the string literal directly. Signed-off-by: Waqar Hameed Link: https://patch.msgid.link/4840779a167e027b8be77c82f7a4f27210ef084a.1748356671.git.waqar.hameed@axis.com Signed-off-by: Jonathan Cameron commit fe03825b1a6c5cb6a31a21fca8d8cbe075991ad3 Author: Isabella Caselli Date: Wed May 7 15:39:39 2025 -0300 iio: imu: inv_mpu6050: refactor aux read/write to use shared xfer logic Refactors inv_mpu_aux_read() and inv_mpu_aux_write() to extract the common I2C transfer sequence into inv_mpu_i2c_master_xfer(), which now handles starting and stopping the I2C master, waiting for completion, disabling SLV0, and checking for NACK errors. This refactoring removes code duplication and improves maintainability. No functional changes are intended. Signed-off-by: Isabella Caselli Co-developed-by: Rodrigo Michelassi Signed-off-by: Rodrigo Michelassi Acked-by: Jean-Baptiste Maneyrol Link: https://patch.msgid.link/20250507184539.54658-1-bellacaselli20@gmail.com Signed-off-by: Jonathan Cameron commit 1a862799dc12f82d912320757624e3474a71de67 Author: Gyeyoung Baek Date: Mon May 19 23:25:53 2025 +0900 iio: buffer: Fix checkpatch.pl warning Remove the following trivial warning: "WARNING: Block comments should align the * on each line" Signed-off-by: Gyeyoung Baek Link: https://patch.msgid.link/20250519-timestamp-v1-1-fcb4f6c2721c@gmail.com Signed-off-by: Jonathan Cameron commit c5858465a695c88fd427d1930c868750321b0409 Author: David Lechner Date: Fri Apr 18 13:16:13 2025 -0500 iio: amplifiers: ada4250: use DMA-safe memory for regmap_bulk_read() Use DMA-safe memory instead of stack-allocated memory for the call to regmap_bulk_read() in the ada4250_init() function as this could be used directly by a SPI controller. Also remove unnecessary use of get_unaligned_le16() and explicitly include linux/types.h e.g. for __le16 while we are fixing this up. Note this is DMA issue does not appear to be an actual bug due to internals of the regmap SPI implementation. However, for IIO we are following guidance that we should not make that assumption. Signed-off-by: David Lechner Link: https://patch.msgid.link/20250418-iio-amplifiers-ada4250-simplify-data-buffer-in-init-v1-1-7e7bd6dad423@baylibre.com Signed-off-by: Jonathan Cameron commit b99dbe3a0f00953349dbf03e5d4af9233acb916e Author: Lothar Rubusch Date: Sat May 10 22:44:00 2025 +0000 iio: accel: adxl345: add g-range configuration Introduce a mechanism to be able to configure and work with the available g-ranges keeping the precision of 13 digits. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250510224405.17910-3-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 93ddd064922546dc336c2a0a32e998179ef5aaa4 Author: Lothar Rubusch Date: Sat May 10 22:43:59 2025 +0000 iio: accel: adxl345: extend sample frequency adjustments Introduce enums and functions to work with the sample frequency adjustments. Let the sample frequency adjust via IIO and configure a reasonable default. Replace the old static sample frequency handling. During adjustment of bw registers, measuring is disabled and afterwards enabled again. Signed-off-by: Lothar Rubusch Link: https://patch.msgid.link/20250510224405.17910-2-l.rubusch@gmail.com Signed-off-by: Jonathan Cameron commit 9182f3b4c370b7e779dca569c672b9ad22fd23d6 Author: Angelo Dureghello Date: Fri May 23 11:00:52 2025 +0200 iio: dac: adi-axi-dac: use unique bus free check Use a unique function for the bus free check by polling, to reduce duplicated code. An error is always thrown in case of timeout. Signed-off-by: Angelo Dureghello Reviewed-by: Nuno Sá Link: https://patch.msgid.link/20250523-ad3552r-fix-bus-read-v3-2-310e726dd964@baylibre.com Signed-off-by: Jonathan Cameron commit 1543572fffb3131c003f23be8b65083d6e2f611c Author: Antoniu Miclaus Date: Fri May 16 11:26:30 2025 +0300 Documentation: ABI: add sinc1 and sinc5+pf1 filter Add sinc1 and sinc5+pf1 filter types used for ad4080 device. Include these two options into the filter_type available attribute. Add also the option for filter disabled. Signed-off-by: Antoniu Miclaus Link: https://patch.msgid.link/20250516082630.8236-11-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit 6b31ba1811b6873c5ab899f3732304607753fe98 Author: Antoniu Miclaus Date: Fri May 16 11:26:29 2025 +0300 iio: adc: ad4080: add driver support Add support for AD4080 high-speed, low noise, low distortion, 20-bit, Easy Drive, successive approximation register (SAR) analog-to-digital converter (ADC). Signed-off-by: Antoniu Miclaus Link: https://patch.msgid.link/20250516082630.8236-10-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit 232fb5c86f1e684d67ddc14a501d8d2ea9e78e17 Author: Antoniu Miclaus Date: Fri May 16 11:26:28 2025 +0300 dt-bindings: iio: adc: add ad4080 Add devicetree bindings for ad4080 family. Reviewed-by: Rob Herring (Arm) Signed-off-by: Antoniu Miclaus Link: https://patch.msgid.link/20250516082630.8236-9-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit 569ddc41165ecc30f3376d3508d865a23e25fc99 Author: Antoniu Miclaus Date: Fri May 16 11:26:27 2025 +0300 iio: adc: adi-axi-adc: add num lanes support Add support for setting the number of lanes enabled. Reviewed-by: Nuno Sá Signed-off-by: Antoniu Miclaus Link: https://patch.msgid.link/20250516082630.8236-8-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit d2ca659c3d1573e04a1304ecd2c8f2d485a708df Author: Antoniu Miclaus Date: Fri May 16 11:26:26 2025 +0300 iio: adc: adi-axi-adc: add data align process Add support for starting the sync process used for data capture alignment. Reviewed-by: Nuno Sá Signed-off-by: Antoniu Miclaus Link: https://patch.msgid.link/20250516082630.8236-7-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit 8ee8009420e7b94d2335c03528f5084f41b25511 Author: Antoniu Miclaus Date: Fri May 16 11:26:25 2025 +0300 iio: adc: adi-axi-adc: add filter type config Add support for enabling/disabling filter based on the filter type provided. This feature is specific to the axi ad408x IP core, therefore add new compatible string and corresponding iio_backend_ops. Reviewed-by: Nuno Sá Signed-off-by: Antoniu Miclaus Link: https://patch.msgid.link/20250516082630.8236-6-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit b81c5c258285d9fe7a397c76c0b1d33132cbb941 Author: Antoniu Miclaus Date: Fri May 16 11:26:24 2025 +0300 dt-bindings: iio: adc: add ad408x axi variant Add a new compatible and related bindings for the fpga-based AD408x AXI IP core, a variant of the generic AXI ADC IP. The AXI AD408x IP is a very similar HDL (fpga) variant of the generic AXI ADC IP, intended to control ad408x familiy. Although there are some particularities added for extended control of the ad408x devices such as the filter configuration. Wildcard naming is used to match the naming of the published firmware. Reviewed-by: Rob Herring (Arm) Signed-off-by: Antoniu Miclaus Acked-by: Rob Herring (Arm) Link: https://patch.msgid.link/20250516082630.8236-5-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit 5ef4cc6d2414d115cf09a6a33c3155f12e58a27d Author: Antoniu Miclaus Date: Fri May 16 11:26:23 2025 +0300 iio: backend: add support for number of lanes Add iio backend support for number of lanes to be enabled. Reviewed-by: Nuno Sá Signed-off-by: Antoniu Miclaus Link: https://patch.msgid.link/20250516082630.8236-4-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit 995fd6e002b0d1ac435faed68005585906467e92 Author: Antoniu Miclaus Date: Fri May 16 11:26:22 2025 +0300 iio: backend: add support for data alignment Add backend support for staring the capture synchronization. When activated, it initates a proccess that aligns the sample's most significant bit (MSB) based solely on the captured data, without considering any other external signals. Reviewed-by: Nuno Sá Signed-off-by: Antoniu Miclaus Link: https://patch.msgid.link/20250516082630.8236-3-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit dc38441890ec0c54d032395ea9c365a4307185fa Author: Antoniu Miclaus Date: Fri May 16 11:26:21 2025 +0300 iio: backend: add support for filter config Add backend support for digital filter type selection. This setting can be adjusted within the IP cores interfacing devices. The IP core can be configured based on the state of the actual digital filter configuration of the part. Reviewed-by: Nuno Sá Signed-off-by: Antoniu Miclaus Link: https://patch.msgid.link/20250516082630.8236-2-antoniu.miclaus@analog.com Signed-off-by: Jonathan Cameron commit af82280ee7646f102f01b297ac70b011c97ba512 Author: Waqar Hameed Date: Fri May 16 19:18:56 2025 +0200 iio: irsd200: Remove print of error code from dev_err_probe Since `dev_err_probe()` already prints the error code, there is no need to additionally print it in the error message. Therefore, just remove them. Signed-off-by: Waqar Hameed Link: https://patch.msgid.link/83c5ed21654b1b98437247d0fef823237af641b4.1747415559.git.waqar.hameed@axis.com Signed-off-by: Jonathan Cameron commit 6f392f37165008cfb3f89d723aa019e372ee79b9 Author: Hugo Villeneuve Date: Wed Jun 4 10:53:06 2025 -0400 drm: renesas: rz-du: Implement MIPI DSI host transfers Add support for sending MIPI DSI command packets from the host to a peripheral. This is required for panels that need configuration before they accept video data. Also for long reads to work properly, set DCS maximum return packet size to the value of the DMA buffer size. Based on Renesas Linux kernel v5.10 repos [1]. Link: https://github.com/renesas-rz/rz_linux-cip.git Signed-off-by: Hugo Villeneuve Tested-by: Chris Brandt Reviewed-by: Biju Das Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250604145306.1170676-2-hugo@hugovil.com commit f657a680f84e29ed7c17edf3b14d637e0527270c Author: Takashi Sakamoto Date: Mon Jun 9 08:38:08 2025 +0900 firewire: core: use from_work() macro to expand parent structure of work_struct A commit 60b2ebf48526 ("workqueue: Introduce from_work() helper for cleaner callback declarations") introduces a new macro to retrieve a poiner for the parent structure of the work item. It is convenient to reduce input text. This commit uses the macro in core functionalities. Link: https://lore.kernel.org/r/20250608233808.202355-3-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 8ffef793bb6d62046472033d6fb1dfb435681a83 Author: Takashi Sakamoto Date: Mon Jun 9 08:38:07 2025 +0900 firewire: ohci: use from_work() macro to expand parent structure of work_struct A commit 60b2ebf48526 ("workqueue: Introduce from_work() helper for cleaner callback declarations") introduces a new macro to retrieve a poiner for the parent structure of the work item. It is convenient to reduce input text. This commit uses the macro in PCI driver for 1394 OHCI. Link: https://lore.kernel.org/r/20250608233808.202355-2-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 088eb0f161c58969bc7544e5d6c1451ed18d2ddb Author: Takashi Sakamoto Date: Mon Jun 9 08:38:06 2025 +0900 firewire: ohci: correct code comments about bus_reset tasklet The tasklet for bus reset event has been replaced with work item, while some code comments still address to the tasklet. This commit corrects them. Fixes: 2d7a36e23300 ("firewire: ohci: Move code from the bus reset tasklet into a workqueue") Link: https://lore.kernel.org/r/20250608233808.202355-1-o-takashi@sakamocchi.jp Signed-off-by: Takashi Sakamoto commit 5f9ec130f1b92347cd6efeea5d9c2d2fb93cd59a Author: Eugen Hristev Date: Thu Jun 5 18:10:39 2025 +0300 arm64: dts: qcom: sm8750: Trivial stray lines removal Remove stray lines Signed-off-by: Eugen Hristev Link: https://lore.kernel.org/r/20250605151040.56942-1-eugen.hristev@linaro.org Signed-off-by: Bjorn Andersson commit c459262159f39e6e6336797feb975799344b749b Author: Thangaraj Samynathan Date: Mon May 26 16:19:08 2025 +0530 spi: spi-pci1xxxx: Add support for 25MHz Clock frequency in C0 Adds support for 25MHz clock frequency. Support for this frequency is added in C0. Signed-off-by: Thangaraj Samynathan Link: https://patch.msgid.link/20250526104908.404564-1-thangaraj.s@microchip.com Signed-off-by: Mark Brown commit 6b500757aef0b5b639253508cf93eb8134a2d340 Author: Frank Li Date: Wed May 28 18:28:20 2025 -0400 spi: dt-bindings: mxs-spi: allow clocks properpty Allow clocks property to fix below CHECK_DTB warnings: arch/arm/boot/dts/nxp/mxs/imx28-btt3-0.dtb: spi@80014000 (fsl,imx28-spi): Unevaluated properties are not allowed ('clocks' was unexpected) Signed-off-by: Frank Li Link: https://patch.msgid.link/20250528222821.728544-1-Frank.Li@nxp.com Signed-off-by: Mark Brown commit f73dc37ebf45573349aee0aae168e8dc3d13ecee Author: Gabor Juhos Date: Thu May 29 19:35:44 2025 +0200 spi: spi-qpic-snand: remove 'qpic_snand_op' structure The 'qpic_snand_op' structure is used only in the qcom_spi_send_cmdaddr() function as a type of a local variable. Additionally, the sole purpose of that variable is to keep some interim values before those gets passed as arguments for cpu_to_le32() calls. In order to simplify the code, remove the definition of the structure along with the local variable, and use the corresponding values directly as parameters for cpu_to_le32() calls. No functional changes intended. Signed-off-by: Gabor Juhos Link: https://patch.msgid.link/20250529-qpic-snand-remove-qpic_snand_op-v1-1-6e42b772d748@gmail.com Signed-off-by: Mark Brown commit 6c1ca9928ed48499f75101057079b92072077d44 Author: Gabor Juhos Date: Sun May 25 16:15:25 2025 +0200 spi: spi-qpic-snand: use NANDC_STEP_SIZE consistently Change the qcom_spi_read_page_ecc() function to use NANDC_STEP_SIZE instead of a magic number while calculating the data size to keep it consistent with other functions like qcom_spi_program_{raw,ecc,oob} and qcom_spi_read_cw_{raw,page_oob}. No functional changes. Signed-off-by: Gabor Juhos Reviewed-by: Md Sadre Alam Link: https://patch.msgid.link/20250525-qpic-snand-nandc_step_size-v1-1-6039e9bfe1c6@gmail.com Signed-off-by: Mark Brown commit 9a30e332c36c52e92e5316b4a012d45284dedeb5 Author: Ciprian Marian Costea Date: Thu May 22 15:51:42 2025 +0100 spi: spi-fsl-dspi: Enable support for S32G platforms Add compatible for S32G platforms, allowing DSPI to be used. Add a depends for ARCH_NXP which can replace LAYERSCAPE and also includes the new ARCH_S32 for S32G. Similarly, ARCH_MXC can replace SOC_VF610 || SOC_LS1021A which should avoid updating this for every new sub-platform in the future. Signed-off-by: Ciprian Marian Costea Signed-off-by: Stoica Cosmin-Stefan Signed-off-by: Dan Nica Signed-off-by: Larisa Grigore Signed-off-by: Stefan-Gabriel Mirea Signed-off-by: James Clark Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-13-bea884630cfb@linaro.org Signed-off-by: Mark Brown commit be47ecfecf5a6f16d028fd572410251b502692bf Author: Ciprian Marian Costea Date: Thu May 22 15:51:41 2025 +0100 dt-bindings: spi: dspi: Add S32G support Document S32G compatible strings. 's32g2' and 's32g3' use the same driver so 's32g2' must follow 's32g3'. The SPI controller supports target mode when the "spi-slave" flag is used so add an example. Reviewed-by: Krzysztof Kozlowski Signed-off-by: Ciprian Marian Costea Signed-off-by: Larisa Grigore Signed-off-by: James Clark Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-12-bea884630cfb@linaro.org Signed-off-by: Mark Brown commit 0cb9ca1187b311db21288a79ec7b98121f730354 Author: Andra-Teodora Ilie Date: Thu May 22 15:51:40 2025 +0100 spi: spi-fsl-dspi: Enable modified transfer protocol on S32G S32G supports modified transfer protocol where both host and target devices sample later in the SCK period than in Classic SPI mode to allow the logic to tolerate more delays in device pads and board traces. Set MTFE bit in MCR register for frequencies higher than 25MHz. Signed-off-by: Andra-Teodora Ilie Signed-off-by: Bogdan-Gabriel Roman Signed-off-by: Larisa Grigore Signed-off-by: James Clark Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-11-bea884630cfb@linaro.org Signed-off-by: Mark Brown commit c5412ec5f687732f9722bd0f94f9632ad78f4c52 Author: Larisa Grigore Date: Thu May 22 15:51:39 2025 +0100 spi: spi-fsl-dspi: Reinitialize DSPI regs after resuming for S32G After resuming, DSPI registers (MCR and SR) need to be reinitialized for S32G platforms. Signed-off-by: Larisa Grigore Signed-off-by: James Clark Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-10-bea884630cfb@linaro.org Signed-off-by: Mark Brown commit 870d6fda18d590df88beac9b0504f810807a5ed6 Author: Larisa Grigore Date: Thu May 22 15:51:38 2025 +0100 spi: spi-fsl-dspi: Use DMA for S32G controller in target mode Switch to DMA for target mode otherwise the controller is too slow to feed TX FIFO and UNDERFLOW occurs frequently. DMA can work only with 8 and 16 bits per word. 32bits per word is not supported, this is a hardware limitation, so we keep the controller mode in TCFQ mode. Signed-off-by: Larisa Grigore Signed-off-by: Ciprian Marian Costea Signed-off-by: James Clark Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-9-bea884630cfb@linaro.org Signed-off-by: Mark Brown commit cac7e5054115fcc41b1cb050af8e8971f7c9b22b Author: Larisa Grigore Date: Thu May 22 15:51:37 2025 +0100 spi: spi-fsl-dspi: Avoid setup_accel logic for DMA transfers Repacking multiple smaller words into larger ones to make use of the full FIFO doesn't save anything in DMA mode, so don't bother doing it. Signed-off-by: Larisa Grigore Signed-off-by: James Clark Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-8-bea884630cfb@linaro.org Signed-off-by: Mark Brown commit e7397e4d3b161ed8a57648a9ac03df7902958682 Author: Marius Trifu Date: Thu May 22 15:51:36 2025 +0100 spi: spi-fsl-dspi: Use spi_alloc_target for target spi_alloc_target should be used for target devices. This also sets ctlr->target automatically so delete that line. Signed-off-by: Marius Trifu Signed-off-by: Larisa Grigore Signed-off-by: James Clark Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-7-bea884630cfb@linaro.org Signed-off-by: Mark Brown commit 70c0b17ee344b0c14b88e6b5b1db6abe2fa84218 Author: Larisa Grigore Date: Thu May 22 15:51:35 2025 +0100 spi: spi-fsl-dspi: Add config and regmaps for S32G platforms S32G adds SPI_{T,R}XFR4 and extends SPI_CTAR registers to 5. Add the new regmaps, configs and bits. dspi_volatile_ranges gets SPI_{T,R}XFR4 added which affects all platforms, however they are further limited by dspi_yes_ranges. Signed-off-by: Larisa Grigore Signed-off-by: James Clark Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-6-bea884630cfb@linaro.org Signed-off-by: Mark Brown commit 1672b0653212cecf11be9ef55bc2a2fabe0fa2ca Author: James Clark Date: Thu May 22 15:51:34 2025 +0100 spi: spi-fsl-dspi: Define regmaps per device Refactor the regmaps so they can be defined per device rather than programmatically. This will allow us to add two new regmaps for S32G in a later commit. No functional changes. Reviewed-by: Vladimir Oltean Signed-off-by: James Clark Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-5-bea884630cfb@linaro.org Signed-off-by: Mark Brown commit 87a14a96bc323aff824fad8cdbe61b78eff22255 Author: James Clark Date: Thu May 22 15:51:33 2025 +0100 spi: spi-fsl-dspi: Re-use one volatile regmap for both device types max_register overrides anything in the volatile ranges, so we can get away with sharing the same one for both types. In a later commit we'll add more devices so this avoids adding even more duplication. Also replace the max_register magic numbers with their register definitions so it's clearer what's going on. No functional changes. Reviewed-by: Vladimir Oltean Signed-off-by: James Clark Link: https://patch.msgid.link/20250522-james-nxp-spi-v2-4-bea884630cfb@linaro.org Signed-off-by: Mark Brown commit 548d770c330cd1027549947a6ea899c56b5bc4e4 Author: Martijn de Gouw Date: Sun May 25 09:18:21 2025 +0200 regulator: pca9450: Add support for mode operations Make the PWM mode on the buck controllers configurable from devicetree. Some boards require forced PWM mode to keep the supply ripple within acceptable limits under light load conditions. Signed-off-by: Martijn de Gouw Link: https://patch.msgid.link/20250525071823.819342-2-martijn.de.gouw@prodrive-technologies.com Signed-off-by: Mark Brown commit d7181a2d43cffb19f1e5c19f6d2328f190c87d70 Author: Martijn de Gouw Date: Sun May 25 09:18:20 2025 +0200 dt-bindings: regulator: add pca9450: Add regulator-allowed-modes Make the PWM mode on the buck controllers configurable from devicetree. Some boards require forced PWM mode to keep the supply ripple within acceptable limits under light load conditions. Signed-off-by: Martijn de Gouw Acked-by: Conor Dooley Link: https://patch.msgid.link/20250525071823.819342-1-martijn.de.gouw@prodrive-technologies.com Signed-off-by: Mark Brown commit 9bb3c7df546aac38ea64c736a839ef2c75297631 Author: Christophe JAILLET Date: Sat May 24 18:10:39 2025 +0200 regulator: tps6594-regulator: Remove a useless static qualifier There is no point in having 'npname' a static variable. So remove the static qualifier. This is cleaner and saves a few bytes. On a x86_64, with allmodconfig: Before: ====== text data bss dec hex filename 27949 12176 64 40189 9cfd drivers/regulator/tps6594-regulator.o After: ===== text data bss dec hex filename 27947 12112 0 40059 9c7b drivers/regulator/tps6594-regulator.o Signed-off-by: Christophe JAILLET Link: https://patch.msgid.link/ebc53d4049ec19796ef07e1bb734de19a2814727.1748103005.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit c266209eaef4fef863363557817f7d6a68314321 Author: Christophe JAILLET Date: Sat May 24 18:10:38 2025 +0200 regulator: tps6594-regulator: Constify struct tps6594_regulator_irq_type 'struct tps6594_regulator_irq_type' are not modified in this driver. Constifying this structure moves some data to a read-only section, so increases overall security. On a x86_64, with allmodconfig, as an example: Before: ====== text data bss dec hex filename 25645 14480 64 40189 9cfd drivers/regulator/tps6594-regulator.o After: ===== text data bss dec hex filename 27949 12176 64 40189 9cfd drivers/regulator/tps6594-regulator.o Signed-off-by: Christophe JAILLET Link: https://patch.msgid.link/1446fb1938f3f38115be3e53f5dda3c8bb0ba5a1.1748103005.git.christophe.jaillet@wanadoo.fr Signed-off-by: Mark Brown commit c8c4694ede7ed42d8d4db0e8927dea9839a3e248 Author: Krzysztof Kozlowski Date: Wed May 28 21:45:02 2025 +0200 regmap: kunit: Constify regmap_range_cfg array Static 'struct regmap_range_cfg' array is not modified so can be changed to const for more safety. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250528194501.567366-2-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit ac209bde018fd320b79976657a44c23113181af6 Author: Shenghao Ding Date: Fri May 23 21:11:11 2025 +0800 ASoC: tas2781: Drop the unnecessary symbol imply The unnecessary symbols for imply are SND_SOC_TAS2781_COMLIB, SND_SOC_TAS2781_COMLIB_I2C, and SND_SOC_TAS2781_FMWLIB. They all used for library compiling. All the symbols in the imply are used for codec driver compiling. Signed-off-by: Shenghao Ding Link: https://patch.msgid.link/20250523131111.1884-1-shenghao-ding@ti.com Signed-off-by: Mark Brown commit db1a7a6f28b84c5ccd84a800cd4827b5599c95b9 Author: Frank Li Date: Wed May 28 12:57:54 2025 -0400 ASoC: dt-bindings: covert mxs-audio-sgtl5000.txt to yaml format Convert mxs-audio-sgtl5000.txt to yaml format. Additional changes: - Add compatible string: bluegiga,apx4devkit-sgtl5000 denx,m28evk-sgtl5000 fsl,imx28-mbmx28lc-sgtl500 - Remove audio-routing from required list. Signed-off-by: Frank Li Reviewed-by: "Rob Herring (Arm)" Link: https://patch.msgid.link/20250528165755.692264-1-Frank.Li@nxp.com Signed-off-by: Mark Brown commit f4c77d5af0a9cd0ee22617baa8b49d0e151fbda7 Author: Kuninori Morimoto Date: Fri Jun 6 01:59:15 2025 +0000 ASoC: soc-dai: tidyup return value of snd_soc_xlate_tdm_slot_mask() commit 7f1186a8d738661 ("ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()") checks return value of xlate_tdm_slot_mask() (A1)(A2). /* * ... (Y) * TDM mode can be disabled by passing 0 for @slots. In this case @tx_mask, * @rx_mask and @slot_width will be ignored. * ... */ int snd_soc_dai_set_tdm_slot(...) { ... if (...) (A1) ret = dai->driver->ops->xlate_tdm_slot_mask(...); else (A2) ret = snd_soc_xlate_tdm_slot_mask(...); if (ret) goto err; ... } snd_soc_xlate_tdm_slot_mask() (A2) will return -EINVAL if slots was 0 (X), but snd_soc_dai_set_tdm_slot() allow to use it (Y). (A) static int snd_soc_xlate_tdm_slot_mask(...) { ... if (!slots) (X) return -EINVAL; ... } Call xlate_tdm_slot_mask() only if slots was non zero. Reported-by: Giedrius Trainavičius Closes: https://lore.kernel.org/r/CAMONXLtSL7iKyvH6w=CzPTxQdBECf++hn8RKL6Y4=M_ou2YHow@mail.gmail.com Fixes: 7f1186a8d738661 ("ASoC: soc-dai: check return value at snd_soc_dai_set_tdm_slot()") Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/8734cdfx59.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 039de8f598dd7f060c8fde2498a7163315466f6d Author: Kuninori Morimoto Date: Thu Jun 5 01:43:37 2025 +0000 ASoC: hdac_hdmi: remove hdac_hdmi_jack[_port]_init() No one is using hdac_hdmi_jack[_port]_init(). Remove it and its related functions. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87o6v3j73q.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit bb4a0f497bc19558ba7fe9feac814286fc7ebe85 Author: Krzysztof Kozlowski Date: Fri May 23 14:18:12 2025 +0200 ASoC: codecs: lpass: Drop unused AIF_INVALID first DAI identifier All four Qualcomm SoC macro codecs define DAI IDs in an enum starting with AIF_INVALID=0, which is nowhere used in the code thus actual DAI IDs start from 1. Drivers do not have their own of_xlate_dai_name(), thus snd_soc_get_dlc() expects the DTS to start numbering DAIs from 0, which creates confusing debugging scenario, e.g. DTS should use <&lpass_wsamacro 2> for WSA_MACRO_AIF_VI with dai->id=3. This also wastes some space, because drivers allocate few arrays for all DAIs and basically the [0] is never used. Drop the confusing first AIF_INVALID DAI identifier so the enum with DAI IDs will start from 0. This has little functional impact and does not affect the ABI, except saving a few bytes of memory per driver. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250523121811.380045-2-krzysztof.kozlowski@linaro.org Signed-off-by: Mark Brown commit c95e925daa434ee1a40a86aec6476ce588e4bd77 Author: Cezary Rojewski Date: Fri May 30 16:21:20 2025 +0200 ASoC: Intel: avs: Add rt5640 machine board To support connection between Intel AudioDSP and Realek 5640 codec implement avs_rt5640 machine board driver. The codec chip is located on I2C bus and the streaming occurs over I2S interface. A number of such devices can be connected simultaneously to the platform. Majority of the board's behavior is inherited from existing representatives such as avs_rt274. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530142120.2944095-4-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 19f971057b2d7b99c80530ec1052b45de236a8da Author: Xinxin Wan Date: Fri May 30 16:21:19 2025 +0200 ASoC: codecs: rt5640: Retry DEVICE_ID verification To be more resilient to codec-detection failures when the hardware powers on slowly, add retry mechanism to the device verification check. Similar pattern is found throughout a number of Realtek codecs. Our tests show that 60ms delay is sufficient to address readiness issues on rt5640 chip. Reviewed-by: Amadeusz Sławiński Reviewed-by: Cezary Rojewski Signed-off-by: Xinxin Wan Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530142120.2944095-3-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit cecec195b2930fc45d71e29f66a66f0c83e41468 Author: Cezary Rojewski Date: Fri May 30 16:21:18 2025 +0200 ASoC: codecs: rt5640: Drop dummy register names Registers 0xfa and 0xfb represent "General Control 1" and "General Control 2" respectively. Reviewed-by: Amadeusz Sławiński Signed-off-by: Cezary Rojewski Link: https://patch.msgid.link/20250530142120.2944095-2-cezary.rojewski@intel.com Signed-off-by: Mark Brown commit 03b778d1994827ea5cc971dbdfbb457bbb7bfa5d Author: Pei Xiao Date: Fri Jun 6 17:18:22 2025 +0800 ASOC: rockchip: Use helper function devm_clk_get_enabled() Since commit 7ef9651e9792 ("clk: Provide new devm_clk helpers for prepared and enabled clocks"), devm_clk_get() and clk_prepare_enable() can now be replaced by devm_clk_get_enabled() when driver enables the clocks for the whole lifetime of the device. Moreover, it is no longer necessary to unprepare and disable the clocks explicitly. Signed-off-by: Pei Xiao Acked-by: Nicolas Frattaroli Tested-by: Nicolas Frattaroli Link: https://patch.msgid.link/84bc40641d05596f1edf4f01d1e6aea16bdbeeb5.1749201126.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit 5dc302d00807b8916992dd25a7a22b78d07dcd03 Author: Pei Xiao Date: Fri Jun 6 17:18:21 2025 +0800 ASOC: rockchip: fix capture stream handling in rockchip_sai_xfer_stop Correcting the capture stream handling which was incorrectly setting playback=true for capture streams. The original code mistakenly set playback=true for capture streams, causing incorrect behavior. Fixes: cc78d1eaabad ("ASoC: rockchip: add Serial Audio Interface (SAI) driver") Signed-off-by: Pei Xiao Tested-by: Nicolas Frattaroli Acked-by: Nicolas Frattaroli Link: https://patch.msgid.link/c374aae92c177aaf42c0f1371eccdbc7e9615786.1749201126.git.xiaopei01@kylinos.cn Signed-off-by: Mark Brown commit f6f914893d478b7ba08e5c375de1ced16deb5e92 Author: Bram Vlerick Date: Wed May 28 14:10:09 2025 +0200 ASoC: dt-bindings: tas57xx: add tas5753 compatibility Add tas5753 to ti,tas57xx devicetree bindings. Signed-off-by: Bram Vlerick Link: https://patch.msgid.link/20250528-asoc-tas5753-support-v1-2-a50c3f6734ee@openpixelsystems.org Reviewed-by: Krzysztof Kozlowski Signed-off-by: Mark Brown commit c2bde4666d229d155de5f9b0aa0676804b32fa7a Author: Bram Vlerick Date: Wed May 28 14:10:08 2025 +0200 ASoC: tas571x: add support for tas5753 Add support for tas5753, device is similar to tas5733 but with added headphone / line driver. Signed-off-by: Bram Vlerick Link: https://patch.msgid.link/20250528-asoc-tas5753-support-v1-1-a50c3f6734ee@openpixelsystems.org Reviewed-by: Krzysztof Kozlowski Acked-by: Peter Korsgaard Signed-off-by: Mark Brown commit b9ecde0bcf6a99a3ff08496d4ba90a385ebbfd68 Author: Krzysztof Kozlowski Date: Mon May 26 12:49:55 2025 +0200 ASoC: codecs: wcd939x: Add VDD_PX supply Device has also VDD_PX supply, which should be acquired by the driver. Regulator framework will provide a dummy supply, thus the change is compatible with older DTS. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250526-b4-asoc-wcd9395-vdd-px-v1-6-64d3cb60313b@linaro.org Reviewed-by: Srinivas Kandagatla Signed-off-by: Mark Brown commit 7d648206bae8e7fd3d67481751a76dcb0a299eb8 Author: Krzysztof Kozlowski Date: Mon May 26 12:49:54 2025 +0200 ASoC: dt-bindings: qcom,wcd939x: Document missing VDD_PX supply Document VDD_PX supply on WCD9390 and WCD9395 audio codecs, which was missed in original posting. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250526-b4-asoc-wcd9395-vdd-px-v1-5-64d3cb60313b@linaro.org Acked-by: "Rob Herring (Arm)" Reviewed-by: Srinivas Kandagatla Signed-off-by: Mark Brown commit 1a134881a8f861bfc996d77d3eee9017a95eb5d7 Author: Krzysztof Kozlowski Date: Mon May 26 12:49:53 2025 +0200 ASoC: codecs: wcd939x: Simplify return from devm_gpiod_get() error No need to store devm_gpiod_get() error code in temporary variable. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250526-b4-asoc-wcd9395-vdd-px-v1-4-64d3cb60313b@linaro.org Reviewed-by: Srinivas Kandagatla Signed-off-by: Mark Brown commit cc50d176d0d8b38df2ae119310970f793cb5e756 Author: Krzysztof Kozlowski Date: Mon May 26 12:49:52 2025 +0200 ASoC: codecs: wcd939x: Simplify with devm_regulator_bulk_get_enable() Drop separate regulator get and enable in probe() path with devm_regulator_bulk_get_enable(), which simplifies cleanup paths and device remove(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250526-b4-asoc-wcd9395-vdd-px-v1-3-64d3cb60313b@linaro.org Reviewed-by: Srinivas Kandagatla Signed-off-by: Mark Brown commit a7ee107c2dc382d28794d7b254d0b4de2a75dff2 Author: Krzysztof Kozlowski Date: Mon May 26 12:49:51 2025 +0200 ASoC: codecs: wcd938x: Simplify with devm_regulator_bulk_get_enable() Drop separate regulator get and enable in probe() path with devm_regulator_bulk_get_enable(), which simplifies cleanup paths and device remove(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250526-b4-asoc-wcd9395-vdd-px-v1-2-64d3cb60313b@linaro.org Reviewed-by: Srinivas Kandagatla Signed-off-by: Mark Brown commit 10cf8f6be63f2acfd3d366d917f1af6625cd9124 Author: Krzysztof Kozlowski Date: Mon May 26 12:49:50 2025 +0200 ASoC: codecs: wcd937x: Simplify with devm_regulator_bulk_get_enable() Drop separate regulator get and enable in probe() path with devm_regulator_bulk_get_enable(), which simplifies cleanup paths and device remove(). Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250526-b4-asoc-wcd9395-vdd-px-v1-1-64d3cb60313b@linaro.org Reviewed-by: Srinivas Kandagatla Signed-off-by: Mark Brown commit 267be32b0a7b70cc777f8a46f0904c92c0521d89 Author: Kuninori Morimoto Date: Wed Jun 4 02:07:22 2025 +0000 ASoC: remove component->id No one is using component->id. One idea is we can re-use it as serial number for component. But we have no usage, so far. Let's just remove it for now. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/877c1suuna.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 6ada7351af0c4e295739adfa2c4b780c037b3d27 Author: Kuninori Morimoto Date: Wed Jun 4 02:06:57 2025 +0000 ASoC: soc-core: save ID if param was set in fmt_single_name() fmt_single_name() requests "ind *id" and not allow NULL for it. But sometimes we don't need it. Allow NULL. Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/878qm8uunz.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 8167f4f42572818fa8153be2b03e4c2120846603 Author: Srinivas Kandagatla Date: Wed Jun 4 02:06:48 2025 +0000 ASoC: qcom: use drvdata instead of component to keep id Qcom lpass is using component->id to keep DAI ID (A). (S) static int lpass_platform_pcmops_open( sruct snd_soc_component *component, struct snd_pcm_substream *substream) { ^^^^^^^^^(B0) ... (B1) struct snd_soc_pcm_runtime *soc_runtime = snd_soc_substream_to_rtd(substream); (B2) struct snd_soc_dai *cpu_dai = snd_soc_rtd_to_cpu(soc_runtime, 0); ... (B3) unsigned int dai_id = cpu_dai->driver->id; (A) component->id = dai_id; ... } This driver can get dai_id from substream (B0 - B3). In this driver, below functions get dai_id from component->id (A). (X) lpass_platform_pcmops_suspend() (Y) lpass_platform_pcmops_resume() (Z) lpass_platform_copy() Here, (Z) can get it from substream (B0 - B3), don't need to use component->id (A). On suspend/resume (X)(Y), dai_id can only be obtained from component->id (A), because there is no substream (B0) in function parameter. But, component->id (A) itself should not be used for such purpose. It is intilialized at snd_soc_component_initialize(), and parsed its ID (= component->id) from device name (a). int snd_soc_component_initialize(...) { ... if (!component->name) { (a) component->name = fmt_single_name(dev, &component->id); ... ^^^^^^^^^^^^^ } ... } Unfortunately, current code is broken to start with. There are many regmaps that the driver cares about, however its only managing one (either dp or i2s) in component suspend/resume path. I2S regmap is mandatory however other regmaps are setup based on flags like "hdmi_port_enable" and "codec_dma_enable". Correct thing for suspend/resume path to handle is by checking these flags, instead of using component->id. Signed-off-by: Srinivas Kandagatla Suggested-by: Kuninori Morimoto Signed-off-by: Kuninori Morimoto Link: https://patch.msgid.link/87a56ouuob.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown commit 111a2c8ab462d77d1519b71b46f13ae1b46920b4 Author: Ai Chao Date: Tue Jun 3 13:51:09 2025 +0800 ASoC: imx-card: Use helper function for_each_child_of_node_scoped() The for_each_child_of_node_scoped() helper provides a scope-based clean-up functionality to put the device_node automatically, and as such, there is no need to call of_node_put() directly. Signed-off-by: Ai Chao Link: https://patch.msgid.link/20250603055109.3154061-5-aichao@kylinos.cn Signed-off-by: Mark Brown commit 618abc785e0cbe9993f7217c9f8ecb1cd2478e4f Author: Ai Chao Date: Tue Jun 3 13:51:08 2025 +0800 ASoC: meson: Use helper function for_each_child_of_node_scoped() The for_each_child_of_node_scoped() helper provides a scope-based clean-up functionality to put the device_node automatically, and as such, there is no need to call of_node_put() directly. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505210557.EpJig9BQ-lkp@intel.com/ Signed-off-by: Ai Chao Link: https://patch.msgid.link/20250603055109.3154061-4-aichao@kylinos.cn Signed-off-by: Mark Brown commit 077caf1d1763e069239101b4a72351fb38d37f13 Author: Ai Chao Date: Tue Jun 3 13:51:07 2025 +0800 ASoC: renesas: Use helper function for_each_child_of_node_scoped() The for_each_child_of_node_scoped() helper provides a scope-based clean-up functionality to put the device_node automatically, and as such, there is no need to call of_node_put() directly. Acked-by: Kuninori Morimoto Signed-off-by: Ai Chao Link: https://patch.msgid.link/20250603055109.3154061-3-aichao@kylinos.cn Signed-off-by: Mark Brown commit ece5d881004f041c2e1493436409dbcbea3ad5f8 Author: Krzysztof Kozlowski Date: Wed May 28 22:00:02 2025 +0200 ASoC: codecs: wcd939x: Drop unused 'struct wcd939x_priv' fields 'wcd_regmap_irq_chip' and 'jack' in 'struct wcd939x_priv' are not used at all. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250528-asoc-const-unused-v1-8-19a5d07b9d5c@linaro.org Signed-off-by: Mark Brown commit ff228b6b9ed8f5d7ef418b6cbece772c6617d789 Author: Krzysztof Kozlowski Date: Wed May 28 22:00:01 2025 +0200 ASoC: codecs: wcd938x: Drop unused variant field Member wcd938x_priv.variant is assigned in probe() function and used immediately thereafter, thus it can be just a local variable for less variables stored in 'struct wcd938x_priv' device-wide state. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250528-asoc-const-unused-v1-7-19a5d07b9d5c@linaro.org Signed-off-by: Mark Brown commit fd32bd4467c13254cb52188034fce242f0f6340d Author: Krzysztof Kozlowski Date: Wed May 28 22:00:00 2025 +0200 ASoC: codecs: wcd938x: Drop unused 'struct wcd938x_priv' fields 'wcd_regmap_irq_chip' and 'jack' in 'struct wcd938x_priv' are not used at all. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250528-asoc-const-unused-v1-6-19a5d07b9d5c@linaro.org Signed-off-by: Mark Brown commit 87a2270fd1f560dbfc1b26391ff3b37f56d2a1a3 Author: Krzysztof Kozlowski Date: Wed May 28 21:59:59 2025 +0200 ASoC: codecs: wcd937x: Drop unused 'struct wcd937x_priv' fields 'wcd_regmap_irq_chip' and 'jack' in 'struct wcd937x_priv' are not used at all. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250528-asoc-const-unused-v1-5-19a5d07b9d5c@linaro.org Signed-off-by: Mark Brown commit 9afc53569d800f5e3caf9401d49ad2d89f340a54 Author: Krzysztof Kozlowski Date: Wed May 28 21:59:58 2025 +0200 ASoC: codecs: wcd934x: Drop unused num_rx_port/num_tx_port fields Members wcd934x_codec.num_rx_port and num_tx_port are not read anywhere after assignment, so they can be safely dropped. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250528-asoc-const-unused-v1-4-19a5d07b9d5c@linaro.org Signed-off-by: Mark Brown commit 620d9687004ce877b340041b8213da166f329367 Author: Krzysztof Kozlowski Date: Wed May 28 21:59:57 2025 +0200 ASoC: codecs: wcd9335: Drop unused sido_input_src field Member wcd9335_codec.sido_input_src is not read anywhere after assignment, so it can be safely dropped. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250528-asoc-const-unused-v1-3-19a5d07b9d5c@linaro.org Signed-off-by: Mark Brown commit 239dab898b739f49b1bda8d65163fe4f5c773468 Author: Krzysztof Kozlowski Date: Wed May 28 21:59:56 2025 +0200 ASoC: fsl: Constify reg_default array Static 'struct reg_default' array is not modified so can be changed to const for more safety. Signed-off-by: Krzysztof Kozlowski Link: https://patch.msgid.link/20250528-asoc-const-unused-v1-2-19a5d07b9d5c@linaro.org Signed-off-by: Mark Brown commit 0045b902ad27f2676c2a5b6444494a8287b80072 Author: Krzysztof Kozlowski Date: Wed May 28 21:59:55 2025 +0200 ASoC: codecs: Constify regmap configuration static variables Static arrays/structs for regmap configuration like 'struct reg_default', 'struct reg_sequence' and others are not modified so can be changed to const for more safety. Signed-off-by: Krzysztof Kozlowski Reviewed-by: Charles Keepax Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250528-asoc-const-unused-v1-1-19a5d07b9d5c@linaro.org Signed-off-by: Mark Brown commit e6e8897995a9e6028563ce36c27877e5478c8571 Author: Luca Weiss Date: Wed May 7 10:01:40 2025 +0200 ASoC: qcom: sm8250: Add Fairphone 5 soundcard compatible Add a compatible for the QCM6490-based Fairphone 5 which can use this machine driver. As a note, QCM6490 RB3 board is using audioreach architecture while Fairphone 5 uses pre-audioreach. Reviewed-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Luca Weiss Link: https://patch.msgid.link/20250507-fp5-dp-sound-v4-4-4098e918a29e@fairphone.com Signed-off-by: Mark Brown commit ed82808c6a0f333e51fee4e97cbe8e0189b7f354 Author: Luca Weiss Date: Wed May 7 10:01:39 2025 +0200 ASoC: qcom: sm8250: add DisplayPort Jack support Add support for DisplayPort Jack events, so that user space can configure the audio routing correctly. Reviewed-by: Dmitry Baryshkov Signed-off-by: Luca Weiss Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250507-fp5-dp-sound-v4-3-4098e918a29e@fairphone.com Signed-off-by: Mark Brown commit c4b79a2fbfb28308e958e4ffdd988f3cf678fe2a Author: Luca Weiss Date: Wed May 7 10:01:38 2025 +0200 ASoC: qcom: sm8250: set card driver name from match data Sound machine drivers for Qualcomm SoCs can be reused across multiple SoCs. But user space ALSA UCM files depend on the card driver name which should be set per board/SoC. Allow such customization by using driver match data as sound card driver name. The QRB4210 RB2 gets its name set to "sm4250" as requested by Srinivas Kandagatla, and since no (known) UCM has been written yet this should not break anything. Also while we're already touching these lines, sort the compatibles alphabetically. Reviewed-by: Dmitry Baryshkov Reviewed-by: Neil Armstrong Signed-off-by: Luca Weiss Reviewed-by: Srinivas Kandagatla Link: https://patch.msgid.link/20250507-fp5-dp-sound-v4-2-4098e918a29e@fairphone.com Signed-off-by: Mark Brown commit 5e317d23f6c6c4b59d84e228a2271228e81cc797 Author: Al Viro Date: Tue Feb 25 13:21:14 2025 -0500 d_set_mounted(): we don't need to bump seqcount component of rename_lock IOW, read_seqlock_excl() is sufficient there; no need to bother with write_seqlock() (forcing all rename_lock readers into retry). That leaves rename_lock taken for write only when we want to change someone's parent or name. Signed-off-by: Al Viro commit f0eedcf22581ca1cc438fb38a479ff41ab882d51 Author: Thomas Huth Date: Fri Mar 14 08:09:54 2025 +0100 openrisc: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Jonas Bonn Cc: Stefan Kristiansson Cc: Stafford Horne Cc: linux-openrisc@vger.kernel.org Signed-off-by: Thomas Huth Signed-off-by: Stafford Horne commit c403db6f00de4ecbde869ca79dd53513e9f7af0f Author: Thomas Huth Date: Fri Mar 14 08:09:53 2025 +0100 openrisc: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembly code. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Jonas Bonn Cc: Stefan Kristiansson Cc: Stafford Horne Cc: linux-openrisc@vger.kernel.org Signed-off-by: Thomas Huth Signed-off-by: Stafford Horne commit e41079f53e8792c99cc8888f545c31bc341ea9ac Author: Eslam Khafagy Date: Fri Jun 6 13:05:11 2025 +0300 Documentation: Fix spelling mistake. Fix typo "desination => destination" in file Documentation/bpf/standardization/instruction-set.rst Signed-off-by: Eslam Khafagy Acked-by: Dave Thaler Acked-by: David Vernet Link: https://lore.kernel.org/r/20250606100511.368450-1-eslam.medhat1993@gmail.com Signed-off-by: Alexei Starovoitov commit d365993c2daac9068443e39e52e57d20cbccf49a Merge: 64a064ce33b193 bbc7bd658ddc66 Author: Alexei Starovoitov Date: Fri Jun 6 19:21:43 2025 -0700 Merge branch 'selftests-bpf-fix-a-few-test-failures-with-arm64-64kb-page' Yonghong Song says: ==================== selftests/bpf: Fix a few test failures with arm64 64KB page My local arm64 host has 64KB page size and the VM to run test_progs also has 64KB page size. There are a few self tests assuming 4KB page and failed in my environment. Patch 1 reduced long assert logs so if the test fails, developers can check logs easily. Patches 2-4 fixed three selftest failures. Changelogs: v3 -> v4: - v3: https://lore.kernel.org/bpf/20250606213048.340421-1-yonghong.song@linux.dev/ - In v3, I tried to use __kconfig with CONFIG_ARM64_64K_PAGES to decide to have 4K or 64K aligned. But CI seems unhappy about this. Most likely the reason is due to lskel. So in v4, simply adjust/increase numbers to 64K aligned for test_ringbuf_write test. v2 -> v3: - v2: https://lore.kernel.org/bpf/20250606174139.3036576-1-yonghong.song@linux.dev/ - Fix veristat failure with bpf object file test_ringbuf_write.bpf.o. v1 -> v2: - v1: https://lore.kernel.org/bpf/20250606032309.444401-1-yonghong.song@linux.dev/ - Fix a problem with selftest release build, basically from BUILD_BUG_ON to ASSERT_LT. ==================== Link: https://patch.msgid.link/20250607013605.1550284-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit bbc7bd658ddc662083639b9e9a280b90225ecd9a Author: Yonghong Song Date: Fri Jun 6 18:36:26 2025 -0700 selftests/bpf: Fix a user_ringbuf failure with arm64 64KB page size The ringbuf max_entries must be PAGE_ALIGNED. See kernel function ringbuf_map_alloc(). So for arm64 64KB page size, adjust max_entries properly. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250607013626.1553001-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 8c8c5e3c854a2593ec90dacd868f3066b67de1c4 Author: Yonghong Song Date: Fri Jun 6 18:36:21 2025 -0700 selftests/bpf: Fix ringbuf/ringbuf_write test failure with arm64 64KB page size The ringbuf max_entries must be PAGE_ALIGNED. See kernel function ringbuf_map_alloc(). So for arm64 64KB page size, adjust max_entries and other related metrics properly. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250607013621.1552332-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit 377d3715900c1f465a5ea8a6a11bcbdc42b18668 Author: Yonghong Song Date: Fri Jun 6 18:36:15 2025 -0700 selftests/bpf: Fix bpf_mod_race test failure with arm64 64KB page size Currently, uffd_register.range.len is set to 4096 for command 'ioctl(uffd, UFFDIO_REGISTER, &uffd_register)'. For arm64 64KB page size, the len must be 64KB size aligned as page size alignment is required. See fs/userfaultfd.c:validate_unaligned_range(). Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250607013615.1551783-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit ae8824037a0ac550745b223aa3680819ed65e8db Author: Yonghong Song Date: Fri Jun 6 18:36:10 2025 -0700 selftests/bpf: Reduce test_xdp_adjust_frags_tail_grow logs For selftest xdp_adjust_tail/xdp_adjust_frags_tail_grow, if tested failure, I see a long list of log output like ... test_xdp_adjust_frags_tail_grow:PASS:9Kb+10b-untouched 0 nsec test_xdp_adjust_frags_tail_grow:PASS:9Kb+10b-untouched 0 nsec test_xdp_adjust_frags_tail_grow:PASS:9Kb+10b-untouched 0 nsec test_xdp_adjust_frags_tail_grow:PASS:9Kb+10b-untouched 0 nsec ... There are total 7374 lines of the above which is too much. Let us only issue such logs when it is an assert failure. Signed-off-by: Yonghong Song Link: https://lore.kernel.org/r/20250607013610.1551399-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov commit bfb114751af9f44bc0fdd595bc09b085c81cc61f Author: Michal Wajdeczko Date: Wed Jun 4 22:29:08 2025 +0200 drm/xe/topology: Stop trying to fix programming mistakes We shouldn't ever pass more DSS registers than our hardcoded limit, it should be sufficient to just assert that instead of trying to fix it, as this will never happen in the production driver. Signed-off-by: Michal Wajdeczko Cc: Matt Roper Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250604202908.769-4-michal.wajdeczko@intel.com Signed-off-by: Matt Roper commit 113c3f596807b7b593b389d923091821d1d46e1b Author: Michal Wajdeczko Date: Wed Jun 4 22:29:07 2025 +0200 drm/xe/topology: Use register array size instead magic number Since we keep registers in the array we can simply count them and stop relying on magic number when checking if didn't make mistake. Also we can switch to use xe_gt_assert() since it could be just our programming mistake during platform bringup, no need to keep drm_WARN() in the production driver. Signed-off-by: Michal Wajdeczko Cc: Matt Roper Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250604202908.769-3-michal.wajdeczko@intel.com Signed-off-by: Matt Roper commit f574855a4c57dbabbfa7675e0516203c51ed833b Author: Michal Wajdeczko Date: Wed Jun 4 22:29:06 2025 +0200 drm/xe/topology: Simplify code for loading DSS mask Instead of passing registers using va_list we can keep them in the static array and pass as such and also lower driver footprint: add/remove: 2/0 grow/shrink: 0/2 up/down: 24/-175 (-151) Function old new delta geometry_regs - 12 +12 compute_regs - 12 +12 xe_gt_topology_init 550 527 -23 load_dss_mask 449 297 -152 Signed-off-by: Michal Wajdeczko Cc: Matt Roper Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250604202908.769-2-michal.wajdeczko@intel.com Signed-off-by: Matt Roper commit 678bb4d6254895fbb1cb30d62871cb58c92dd95b Author: Dave Airlie Date: Thu Jun 5 16:21:02 2025 +1000 drm/xe: don't store the xe device pointer inside xe_ttm_tt This device pointer is nearly always available without storing an extra copy for each tt in the system. Just noticed this while reading over the xe shrinker code. Signed-off-by: Dave Airlie Reviewed-by: Matthew Brost Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250605062103.1234620-1-airlied@gmail.com commit 93614c2ab39a9d6641b3e0fba73feea1f6120817 Author: Simona Vetter Date: Wed May 28 11:13:02 2025 +0200 accel/qaic: delete qaic_bo.handle Handles are per-file, not global, so this makes no sense. Plus it's set only after calling drm_gem_handle_create(), and drivers are not allowed to further initialize a bo after that function has published it already. It is also entirely unused, which helps enormously with removing it :-) Since we're still holding a reference to the bo nothing bad can happen, hence not cc: stable material. Cc: Jeff Hugo Cc: Carl Vanderlip Cc: linux-arm-msm@vger.kernel.org Signed-off-by: Simona Vetter Signed-off-by: Simona Vetter Reviewed-by: Jeff Hugo Signed-off-by: Jeff Hugo Link: https://lore.kernel.org/r/20250528091307.1894940-5-simona.vetter@ffwll.ch commit ade147391433f516532d0a6ba7e49a775cb3694f Author: Daniele Ceraolo Spurio Date: Tue Jun 3 16:54:37 2025 -0700 drm/xe/vf: Store the GuC FW info in guc->fw The GuC compatibility version that we read from the CSS header in native/PF and the GuC VF version that we get when a VF handshakes with the GuC are the same version number, so we should store it into the same structure. This makes all the checks based on the compatibility version automatically work for VFs without having to copy the value over. For completion, also copy the wanted version and set the path to a known string to indicate that the FW is PF-loaded. This way all the info will be coherent when dumped from debugfs. v2: several code cleanups and style changes (Michal), rebase on bootstrap changes. v3: s/min/wanted/, clarify that handshake must happen before we can get the VF versions (Michal) Signed-off-by: Daniele Ceraolo Spurio Cc: Michal Wajdeczko Cc: Lukasz Laguna Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250603235432.720833-10-daniele.ceraolospurio@intel.com commit 3ef462f0031f745ce5a98394b7134499c37ef11d Author: Daniele Ceraolo Spurio Date: Tue Jun 3 16:54:36 2025 -0700 drm/xe/vf: Use uc_fw_version to store the negotiated GuC ABI Instead of using a VF-specific type, we can use the common uc_fw_version structure. This also means that we can use the available macros to compare ABI versions. While at it, exit early from the bootstrap if this is not the first time we're doing it and the version hasn't changed, so we don't end up logging it multiple times. Signed-off-by: Daniele Ceraolo Spurio Cc: Michal Wajdeczko Cc: Lukasz Laguna Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250603235432.720833-9-daniele.ceraolospurio@intel.com commit 90f4d3f7562a3ce5a5706a4753a0b7b292dc7ec3 Author: Daniele Ceraolo Spurio Date: Tue Jun 3 16:54:35 2025 -0700 drm/xe/vf: Boostrap all GTs immediately after MMIO init Currently we perform the bootstrap for the primary GT early on during device init, while the media GT bootstrap happens when we try and fetch the hwconfig table. For consistency, move the bootstrap of the media GT happen at the same time as the primary GT, so that all the subsequent code can rely on both GTs being in the same state. v2: Also drop config query from min_guc_load since we now do it early (Michal) Signed-off-by: Daniele Ceraolo Spurio Cc: Michal Wajdeczko Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250603235432.720833-8-daniele.ceraolospurio@intel.com commit 10a2bc580796c0b3162e9be1445c03c3ce49a2d1 Author: Daniele Ceraolo Spurio Date: Tue Jun 3 16:54:34 2025 -0700 drm/xe/uc: Prepare uc_fw_version for storing the VF ABI version The VF ABI version has a branch field, so to store it inside the uc_fw_version we need to add a new branch variable to the latter. Existing code needs to be updated to handle the fact that we have the new field. v2: split out to its own patch (Michal) Signed-off-by: Daniele Ceraolo Spurio Cc: Michal Wajdeczko Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250603235432.720833-7-daniele.ceraolospurio@intel.com commit d3b88721fa24ab0a5a72c2d53989dab784794056 Author: Luca Ceresoli Date: Fri Jun 6 10:41:21 2025 +0200 drm/tests: bridge: add KUnit tests for devm_drm_bridge_alloc() Add KUnit tests for the newly introduced devm_drm_bridge_alloc(). Signed-off-by: Luca Ceresoli Link: https://lore.kernel.org/r/20250606-drm-bridge-alloc-doc-test-v9-3-b5bf7b43ed92@bootlin.com Signed-off-by: Maxime Ripard commit 85ad3e84105d44d0c67e3139c939e0c1047436aa Author: Luca Ceresoli Date: Fri Jun 6 10:41:20 2025 +0200 drm/bridge: add a .destroy func Some users of DRM bridges may need to execute specific code just before deallocation. As of now the only known user would be KUnit tests. Suggested-by: Maxime Ripard Acked-by: Maxime Ripard Signed-off-by: Luca Ceresoli Link: https://lore.kernel.org/r/20250606-drm-bridge-alloc-doc-test-v9-2-b5bf7b43ed92@bootlin.com Signed-off-by: Maxime Ripard commit 1ee7e69292a6f296b2d78393ab409a5bdd65d4e0 Author: Luca Ceresoli Date: Fri Jun 6 10:41:19 2025 +0200 drm/tests: bridge: convert to devm_drm_bridge_alloc() API Use the new DRM bridge allocation API, which is the only supported now, for the kunit tests. This change is more massive than for the typical DRM bridge driver because struct drm_bridge_init_priv currently embeds a struct drm_bridge, which is not supported anymore. We now have to use devm_drm_bridge_alloc() to dynamically allocate a "private driver struct", which is a bit awkward here because there is no real bridge driver. Thus let's add a "dummy" DRM bridge struct to represent it. As a nice cleanup we can now move the enable_count and disable_count members, which are counting bridge-specific events, into the new "private driver struct" (and avoid adding new unnecessary indirections). Also add a trivial bridge_to_dummy_bridge() function just like many drivers do. Signed-off-by: Luca Ceresoli Link: https://lore.kernel.org/r/20250606-drm-bridge-alloc-doc-test-v9-1-b5bf7b43ed92@bootlin.com Signed-off-by: Maxime Ripard commit 3e4e1f2543c060cd8cf8ededc68ea50c49b4b28a Author: Aradhya Bhatia Date: Thu Jun 5 22:45:24 2025 +0530 drm/bridge: cdns-dsi: Use pre_enable/post_disable to enable/disable The cdns-dsi controller requires that it be turned on completely before the input DPI's source has begun streaming[0]. Not having that, allows for a small window before cdns-dsi enable and after cdns-dsi disable where the previous entity (in this case tidss's videoport) to continue streaming DPI video signals. This small window where cdns-dsi is disabled but is still receiving signals causes the input FIFO of cdns-dsi to get corrupted. This causes the colors to shift on the output display. The colors can either shift by one color component (R->G, G->B, B->R), or by two color components (R->B, G->R, B->G). Since tidss's videoport starts streaming via crtc enable hooks, we need cdns-dsi to be up and running before that. Now that the bridges are pre_enabled before crtc is enabled, and post_disabled after crtc is disabled, use the pre_enable and post_disable hooks to get cdns-dsi ready and running before the tidss videoport to get pass the color shift issues. [0]: See section 12.6.5.7.3 "Start-up Procedure" in J721E SoC TRM TRM Link: http://www.ti.com/lit/pdf/spruil1 Reviewed-by: Tomi Valkeinen Tested-by: Tomi Valkeinen Signed-off-by: Aradhya Bhatia Signed-off-by: Aradhya Bhatia Tested-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250605171524.27222-5-aradhya.bhatia@linux.dev Signed-off-by: Maxime Ripard commit c9b1150a68d9362a0827609fc0dc1664c0d8bfe1 Author: Aradhya Bhatia Date: Thu Jun 5 22:45:23 2025 +0530 drm/atomic-helper: Re-order bridge chain pre-enable and post-disable Move the bridge pre_enable call before crtc enable, and the bridge post_disable call after the crtc disable. The sequence of enable after this patch will look like: bridge[n]_pre_enable ... bridge[1]_pre_enable crtc_enable encoder_enable bridge[1]_enable ... bridge[n]_enable And, the disable sequence for the display pipeline will look like: bridge[n]_disable ... bridge[1]_disable encoder_disable crtc_disable bridge[1]_post_disable ... bridge[n]_post_disable The definition of bridge pre_enable hook says that, "The display pipe (i.e. clocks and timing signals) feeding this bridge will not yet be running when this callback is called". Since CRTC is also a source feeding the bridge, it should not be enabled before the bridges in the pipeline are pre_enabled. Fix that by re-ordering the sequence of bridge pre_enable and bridge post_disable. While at it, update the drm bridge API documentation as well. Acked-by: Dmitry Baryshkov Reviewed-by: Tomi Valkeinen Reviewed-by: Thomas Zimmermann Tested-by: Tomi Valkeinen Tested-by: Alexander Sverdlin Signed-off-by: Aradhya Bhatia Signed-off-by: Aradhya Bhatia Tested-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250605171524.27222-4-aradhya.bhatia@linux.dev Signed-off-by: Maxime Ripard commit d5bef6430c85ffa4c92e8723974e012695409a10 Author: Aradhya Bhatia Date: Thu Jun 5 22:45:22 2025 +0530 drm/atomic-helper: Separate out bridge pre_enable/post_disable from enable/disable The encoder-bridge ops occur by looping over the new connector states of the display pipelines. The enable sequence runs as follows - - pre_enable(bridge), - enable(encoder), - enable(bridge), while the disable sequnce runs as follows - - disable(bridge), - disable(encoder), - post_disable(bridge). Separate out the pre_enable(bridge), and the post_disable(bridge) operations into separate functions each. This patch keeps the sequence same for any singular disaplay pipe, but changes the sequence across multiple display pipelines. This patch is meant to be an interim patch, to cleanly pave the way for the sequence re-ordering patch, and maintain bisectability in the process. Reviewed-by: Dmitry Baryshkov Reviewed-by: Jayesh Choudhary Reviewed-by: Tomi Valkeinen Reviewed-by: Thomas Zimmermann Tested-by: Tomi Valkeinen Tested-by: Alexander Sverdlin Signed-off-by: Aradhya Bhatia Tested-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250605171524.27222-3-aradhya.bhatia@linux.dev Signed-off-by: Maxime Ripard commit f6ee26f5887089bb2ea9032d2d169e5b2cb14e95 Author: Aradhya Bhatia Date: Thu Jun 5 22:45:21 2025 +0530 drm/atomic-helper: Refactor crtc & encoder-bridge op loops into separate functions The way any singular display pipeline, in need of a modeset, gets enabled is as follows - crtc enable (all) bridge pre-enable encoder enable (all) bridge enable - and the disable sequence is exactly the reverse of this. The crtc operations occur by looping over the old and new crtc states, while the encoder and bridge operations occur together, by looping over the connector states of the display pipelines. Refactor these operations - crtc enable/disable, and encoder & bridge (pre/post) enable/disable - into separate functions each, to make way for the re-ordering of the enable/disable sequences. This patch doesn't alter the sequence of crtc/encoder/bridge operations in any way, but helps to cleanly pave the way for the next two patches, by maintaining logical bisectability. Reviewed-by: Tomi Valkeinen Reviewed-by: Dmitry Baryshkov Reviewed-by: Thomas Zimmermann Tested-by: Tomi Valkeinen Tested-by: Alexander Sverdlin Signed-off-by: Aradhya Bhatia Signed-off-by: Aradhya Bhatia Tested-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250605171524.27222-2-aradhya.bhatia@linux.dev Signed-off-by: Maxime Ripard commit 1273d22b532657e6379f3eb4f6860bf871d65eb5 Author: Karunika Choo Date: Fri Jun 6 12:18:35 2025 +0200 drm/panthor: Clean up 64-bit register definitions With the introduction of 64-bit register accessors, the separate *_HI definitions are no longer necessary. This change removes them and renames the corresponding *_LO entries for cleaner and more consistent register definitions. Reviewed-by: Liviu Dudau Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Suggested-by: Boris Brezillon Signed-off-by: Karunika Choo Link: https://lore.kernel.org/r/20250606101835.41840-3-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon commit 4d230aa209edabfbd474259858ad90f33c88a0b8 Author: Karunika Choo Date: Fri Jun 6 12:18:34 2025 +0200 drm/panthor: Add 64-bit and poll register accessors This patch adds 64-bit register accessors to simplify register access in Panthor. It also adds 32-bit and 64-bit variants for read_poll_timeout. This patch also updates Panthor to use the new 64-bit accessors and poll functions. Reviewed-by: Liviu Dudau Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Signed-off-by: Karunika Choo Link: https://lore.kernel.org/r/20250606101835.41840-2-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon commit 94ac529a9932654c0b8cbff29745c8417978a7d0 Author: Boris Brezillon Date: Fri Jun 6 10:09:32 2025 +0200 drm/panthor: Fix the user MMIO offset logic for emulators Currently, we pick the MMIO offset based on the size of the pgoff_t type seen by the process that manipulates the FD, such that a 32-bit process can always map the user MMIO ranges. But this approach doesn't work well for emulators like FEX, where the emulator is a 64-bit binary which might be executing 32-bit code. In that case, the kernel thinks it's the 64-bit process and assumes DRM_PANTHOR_USER_MMIO_OFFSET_64BIT is in use, but the UMD library expects DRM_PANTHOR_USER_MMIO_OFFSET_32BIT, because it can't mmap() anything above the pgoff_t size. In order to solve that, we need a way to explicitly set the user MMIO offset from the UMD, such that the kernel doesn't have to guess it from the TIF_32BIT flag set on user thread. We keep the old behavior if DRM_PANTHOR_SET_USER_MMIO_OFFSET is never called. Changes in v2: - Drop the lock/immutable fields and allow SET_USER_MMIO_OFFSET requests to race with mmap() requests - Don't do the is_user_mmio_offset test twice in panthor_mmap() - Improve the uAPI docs Changes in v3: - Bump to version 1.5 instead of 1.4 after rebasing - Add R-bs - Fix/rephrase comment as suggested by Liviu Reviewed-by: Adrián Larumbe Reviewed-by: Steven Price Reviewed-by: Liviu Dudau Link: https://lore.kernel.org/r/20250606080932.4140010-3-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon commit 95cbab48782bf62e4093837dc15ac6133902c12f Author: Boris Brezillon Date: Fri Jun 6 10:09:31 2025 +0200 drm/panthor: Add missing explicit padding in drm_panthor_gpu_info drm_panthor_gpu_info::shader_present is currently automatically offset by 4 byte to meet Arm's 32-bit/64-bit field alignment rules, but those constraints don't stand on 32-bit x86 and cause a mismatch when running an x86 binary in a user emulated environment like FEX. It's also generally agreed that uAPIs should explicitly pad their struct fields, which we originally intended to do, but a mistake slipped through during the submission process, leading drm_panthor_gpu_info::shader_present to be misaligned. This uAPI change doesn't break any of the existing users of panthor which are either arm32 or arm64 where the 64-bit alignment of u64 fields is already enforced a the compiler level. Changes in v2: - Rename the garbage field into pad0 and adjust the comment accordingly - Add Liviu's A-b Changes in v3: - Add R-bs Fixes: 0f25e493a246 ("drm/panthor: Add uAPI") Acked-by: Liviu Dudau Reviewed-by: Adrián Larumbe Reviewed-by: Steven Price Link: https://lore.kernel.org/r/20250606080932.4140010-2-boris.brezillon@collabora.com Signed-off-by: Boris Brezillon commit 44a4ef59d5506c6dc7599d876a3a1014697ec480 Author: Thomas Huth Date: Fri Mar 14 08:10:10 2025 +0100 xtensa: Replace __ASSEMBLY__ with __ASSEMBLER__ in non-uapi headers While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize on the __ASSEMBLER__ macro that is provided by the compilers now. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Chris Zankel Cc: Max Filippov Signed-off-by: Thomas Huth Message-Id: <20250314071013.1575167-40-thuth@redhat.com> Signed-off-by: Max Filippov commit da7870162f176ea38bff7380d67222e0430b0e35 Author: Thomas Huth Date: Fri Mar 14 08:10:09 2025 +0100 xtensa: Replace __ASSEMBLY__ with __ASSEMBLER__ in uapi headers __ASSEMBLY__ is only defined by the Makefile of the kernel, so this is not really useful for uapi headers (unless the userspace Makefile defines it, too). Let's switch to __ASSEMBLER__ which gets set automatically by the compiler when compiling assembly code. This is a completely mechanical patch (done with a simple "sed -i" statement). Cc: Chris Zankel Cc: Max Filippov Signed-off-by: Thomas Huth Message-Id: <20250314071013.1575167-39-thuth@redhat.com> Signed-off-by: Max Filippov commit 8d8431298f698c43405ed48867a22d8a4b96d4bf Author: Nitin Gote Date: Thu Jun 5 15:38:12 2025 +0530 drm/xe/xe3: Disable null query for anyhit shader Set DIS_NULL_QUERY bit of RT_CTRL register to disable null query for anyhit shader for Xe3 IP. Reviewed-by: Gustavo Sousa Reviewed-by: Tejas Upadhyay Reviewed-by: Matt Roper Signed-off-by: Nitin Gote Link: https://lore.kernel.org/r/20250605100812.2547808-1-nitin.r.gote@intel.com Signed-off-by: Matt Roper commit 64a064ce33b193a681f1eb52ac1ad09aadda9944 Author: Rong Tao Date: Thu Jun 5 16:45:14 2025 +0800 selftests/bpf: rbtree: Fix incorrect global variable usage Within __add_three() function, should use function parameters instead of global variables. So that the variables groot_nested.inner.root and groot_nested.inner.glock in rbtree_add_nodes_nested() are tested correctly. Signed-off-by: Rong Tao Link: https://lore.kernel.org/r/tencent_3DD7405C0839EBE2724AC5FA357B5402B105@qq.com Signed-off-by: Alexei Starovoitov commit a570f386f3d19aa64fb3764504ac80cddb42e579 Author: Blake Jones Date: Tue Jun 3 13:37:01 2025 -0700 Tests for the ".emit_strings" functionality in the BTF dumper. When this mode is turned on, "emit_zeroes" and "compact" have no effect, and embedded NUL characters always terminate printing of an array. Signed-off-by: Blake Jones Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250603203701.520541-2-blakejones@google.com commit 87c9c79a02b45068de10ba4786a29db3cddd53ad Author: Blake Jones Date: Tue Jun 3 13:37:00 2025 -0700 libbpf: Add support for printing BTF character arrays as strings The BTF dumper code currently displays arrays of characters as just that - arrays, with each character formatted individually. Sometimes this is what makes sense, but it's nice to be able to treat that array as a string. This change adds a special case to the btf_dump functionality to allow 0-terminated arrays of single-byte integer values to be printed as character strings. Characters for which isprint() returns false are printed as hex-escaped values. This is enabled when the new ".emit_strings" is set to 1 in the btf_dump_type_data_opts structure. As an example, here's what it looks like to dump the string "hello" using a few different field values for btf_dump_type_data_opts (.compact = 1): - .emit_strings = 0, .skip_names = 0: (char[6])['h','e','l','l','o',] - .emit_strings = 0, .skip_names = 1: ['h','e','l','l','o',] - .emit_strings = 1, .skip_names = 0: (char[6])"hello" - .emit_strings = 1, .skip_names = 1: "hello" Here's the string "h\xff", dumped with .compact = 1 and .skip_names = 1: - .emit_strings = 0: ['h',-1,] - .emit_strings = 1: "h\xff" Signed-off-by: Blake Jones Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250603203701.520541-1-blakejones@google.com commit 97744b4971d81bf7336dfd782a08188c9e09f4ee Author: Luis Gerhorst Date: Tue Jun 3 22:45:57 2025 +0200 bpf: Clarify sanitize_check_bounds() As is, it appears as if pointer arithmetic is allowed for everything except PTR_TO_{STACK,MAP_VALUE} if one only looks at sanitize_check_bounds(). However, this is misleading as the function only works together with retrieve_ptr_limit() and the two must be kept in sync. This patch documents the interdependency and adds a check to ensure they stay in sync. adjust_ptr_min_max_vals(): Because the preceding switch returns -EACCES for every opcode except for ADD/SUB, the sanitize_needed() following the sanitize_check_bounds() call is always true if reached. This means, unless sanitize_check_bounds() detected that the pointer goes OOB because of the ADD/SUB and returns -EACCES, sanitize_ptr_alu() always executes after sanitize_check_bounds(). The following shows that this also implies that retrieve_ptr_limit() runs in all relevant cases. Note that there are two calls to sanitize_ptr_alu(), these are simply needed to easily calculate the correct alu_limit as explained in commit 7fedb63a8307 ("bpf: Tighten speculative pointer arithmetic mask"). The truncation-simulation is already performed on the first call. In the second sanitize_ptr_alu(commit_window = true), we always run retrieve_ptr_limit(), unless: * can_skip_alu_sanititation() is true, notably `BPF_SRC(insn->code) == BPF_K`. BPF_K is fine because it means that there is no scalar register (which could be subject to speculative scalar confusion due to Spectre v4) that goes into the ALU operation. The pointer register can not be subject to v4-based value confusion due to the nospec added. Thus, in this case it would have been fine to also skip sanitize_check_bounds(). * If we are on a speculative path (`vstate->speculative`) and in the second "commit" phase, sanitize_ptr_alu() always just returns 0. This makes sense because there are no ALU sanitization limits to be learned from speculative paths. Furthermore, because the sanitization will ensure that pointer arithmetic stays in (architectural) bounds, the sanitize_check_bounds() on the speculative path could also be skipped. The second case needs more attention: Assume we have some ALU operation that is used with scalars architecturally, but with a non-PTR_TO_{STACK,MAP_VALUE} pointer (e.g., PTR_TO_PACKET) speculatively. It might appear as if this would allow an unsanitized pointer ALU operations, but this can not happen because one of the following two always holds: * The type mismatch stems from Spectre v4, then it is prevented by a nospec after the possibly-bypassed store involving the pointer. There is no speculative path simulated for this case thus it never happens. * The type mismatch stems from a Spectre v1 gadget like the following: r1 = slow(0) r4 = fast(0) r3 = SCALAR // Spectre v4 scalar confusion if (r1) { r2 = PTR_TO_PACKET } else { r2 = 42 } if (r4) { r2 += r3 *r2 } If `r2 = PTR_TO_PACKET` is indeed dead code, it will be sanitized to `goto -1` (as is the case for the r4-if block). If it is not (e.g., if `r1 = r4 = 1` is possible), it will also be explored on an architectural path and retrieve_ptr_limit() will reject it. To summarize, the exception for `vstate->speculative` is safe. Back to retrieve_ptr_limit(): It only allows the ALU operation if the involved pointer register (can be either source or destination for ADD) is PTR_TO_STACK or PTR_TO_MAP_VALUE. Otherwise, it returns -EOPNOTSUPP. Therefore, sanitize_check_bounds() returning 0 for non-PTR_TO_{STACK,MAP_VALUE} is fine because retrieve_ptr_limit() also runs for all relevant cases and prevents unsafe operations. To summarize, we allow unsanitized pointer arithmetic with 64-bit ADD/SUB for the following instructions if the requirements from retrieve_ptr_limit() AND sanitize_check_bounds() hold: * ptr -=/+= imm32 (i.e. `BPF_SRC(insn->code) == BPF_K`) * PTR_TO_{STACK,MAP_VALUE} -= scalar * PTR_TO_{STACK,MAP_VALUE} += scalar * scalar += PTR_TO_{STACK,MAP_VALUE} To document the interdependency between sanitize_check_bounds() and retrieve_ptr_limit(), add a verifier_bug_if() to make sure they stay in sync. Signed-off-by: Luis Gerhorst Reported-by: Kumar Kartikeya Dwivedi Link: https://lore.kernel.org/bpf/CAP01T76HZ+s5h+_REqRFkRjjoKwnZZn9YswpSVinGicah1pGJw@mail.gmail.com/ Link: https://lore.kernel.org/bpf/CAP01T75oU0zfZCiymEcH3r-GQ5A6GOc6GmYzJEnMa3=53XuUQQ@mail.gmail.com/ Link: https://lore.kernel.org/r/20250603204557.332447-1-luis.gerhorst@fau.de Signed-off-by: Alexei Starovoitov commit 919319b4edfa2c7f82f98cac570354075ad79196 Author: Jiawei Zhao Date: Sat May 31 17:51:11 2025 +0800 libbpf: Correct some typos and syntax issues in usdt doc Fix some incorrect words, such as "and" -> "an", "it's" -> "its". Fix some grammar issues, such as removing redundant "will", "would complicated" -> "would complicate". Signed-off-by: Jiawei Zhao Signed-off-by: Andrii Nakryiko Link: https://lore.kernel.org/bpf/20250531095111.57824-1-Phoenix500526@163.com commit 9c8827d773bf49e173d15ec131ba576204e16104 Author: Tao Chen Date: Tue Jun 3 23:43:09 2025 +0800 bpftool: Display cookie for raw_tp link probe Display cookie for raw_tp link probe, in plain mode: #bpftool link 22: raw_tracepoint prog 14 tp 'sys_enter' cookie 23925373020405760 pids test_progs(176) And in json mode: #bpftool link -j | jq [ { "id": 47, "type": "raw_tracepoint", "prog_id": 79, "tp_name": "sys_enter", "cookie": 23925373020405760, "pids": [ { "pid": 274, "comm": "test_progs" } ] } ] Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Acked-by: Quentin Monnet Link: https://lore.kernel.org/bpf/20250603154309.3063644-3-chen.dylane@linux.dev commit 25a0d04d3883888ccd59918aede44b109abdb099 Author: Tao Chen Date: Tue Jun 3 23:43:08 2025 +0800 selftests/bpf: Add cookies check for raw_tp fill_link_info test Adding tests for getting cookie with fill_link_info for raw_tp. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20250603154309.3063644-2-chen.dylane@linux.dev commit 2fe1c59347369fa856ae259e2fac3c8c8dd9d335 Author: Tao Chen Date: Tue Jun 3 23:43:07 2025 +0800 bpf: Add cookie to raw_tp bpf_link_info After commit 68ca5d4eebb8 ("bpf: support BPF cookie in raw tracepoint (raw_tp, tp_btf) programs"), we can show the cookie in bpf_link_info like kprobe etc. Signed-off-by: Tao Chen Signed-off-by: Andrii Nakryiko Acked-by: Jiri Olsa Link: https://lore.kernel.org/bpf/20250603154309.3063644-1-chen.dylane@linux.dev commit 7247efca0dcbc8ac6147db9200ed1549c0662465 Author: Luca Coelho Date: Tue May 20 12:53:53 2025 +0300 drm/i915: use drm_modeset_lock_assert_held() in intel_connector_get_pipe() In the intel_connector_get_pipe() function, we check if connection_mutex is held and generate our own WARN_ON if that's the case. Instead of generating a non-standard warning for a mutex issue, we should use the standard lockdep framework. Change the function to use drm_modeset_lock_assert_held() instead. Signed-off-by: Luca Coelho Reviewed-by: Jani Nikula Signed-off-by: Mika Kahola Link: https://lore.kernel.org/r/20250520095408.1310440-1-luciano.coelho@intel.com commit 3671f37777589194c44bb9351568c13eee43da3c Author: Ryosuke Yasuoka Date: Mon May 26 18:01:05 2025 +0900 drm/hyperv: Add support for drm_panic Add drm_panic module for hyperv drm so that panic screen can be displayed on panic. Signed-off-by: Ryosuke Yasuoka Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250526090117.80593-2-ryasuoka@redhat.com Signed-off-by: Jocelyn Falempe commit babe098c5fb4e401127cb1e18256aa4db0f89571 Author: Luca Coelho Date: Tue May 20 11:26:59 2025 +0300 drm/i915: remove unused arg in skl_scaler_get_filter_select() We always pass 0 in the set argument of skl_scaler_get_filter_select() calls, so the argument is unnecessary. Remove it. Signed-off-by: Luca Coelho Reviewed-by: Gustavo Sousa Signed-off-by: Mika Kahola Link: https://lore.kernel.org/r/20250520082917.1302665-3-luciano.coelho@intel.com commit c206a27eb72f13d345d51818152e8707d4563b51 Author: Luca Coelho Date: Tue May 20 11:26:58 2025 +0300 drm/i915/dkl: return if tc_port is invalid in dkl_phy_set_hip_idx() In dkl_phy_set_hip_idx(), we may try to shift a value negatively, whose behavior is undefined. This can happen because we define TC_PORT_NONE to -1, so theoretically tc_port could be -1. We will then use tc_port to shift to the correct address of the specified port, but if it's negative, anything can happen. If this happens or tc_port exceeds I915_MAX_TC_PORTS, it's safer to return with a warning than risk an invalid write. Signed-off-by: Luca Coelho Reviewed-by: Mika Kahola Signed-off-by: Mika Kahola Link: https://lore.kernel.org/r/20250520082917.1302665-2-luciano.coelho@intel.com commit 9d9fca62dc49d96f97045b6d8e7402a95f8cf92a Author: Matthew Auld Date: Tue Jun 3 18:42:14 2025 +0100 drm/xe/guc_submit: add back fix Daniele noticed that the fix in commit 2d2be279f1ca ("drm/xe: fix UAF around queue destruction") looks to have been unintentionally removed as part of handling a conflict in some past merge commit. Add it back. Fixes: ac44ff7cec33 ("Merge tag 'drm-xe-fixes-2024-10-10' of https://gitlab.freedesktop.org/drm/xe/kernel into drm-fixes") Reported-by: Daniele Ceraolo Spurio Signed-off-by: Matthew Auld Cc: Matthew Brost Cc: # v6.12+ Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250603174213.1543579-2-matthew.auld@intel.com commit 0b3d99425891e3c4a87259afb88fbd1168dc7707 Author: Douglas Anderson Date: Wed May 21 17:32:05 2025 -0700 drm/panel-edp: Clarify the `prepare_to_enable` description in comments It's unclear why I originally wrote in the description of `prepare_to_enable` that "This is not specified in a standard way on eDP timing diagrams" and then also wrote "It is effectively the time from HPD going high till you can turn on the backlight." It seems pretty clear that it's (T4+T5+T6+T8)-min. Either I was confused when I wrote this or I was looking at some strange panel datasheet that I can no longer find. Update the description of the field so it's easier for people to fill this in. Couch the description with "usually" in case there really was some weird datasheet where things were specified in a different way. Signed-off-by: Douglas Anderson Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250521173204.1.Ic0375a9360698592f27afbf1f60f4996d504ed4f@changeid commit b837937c0237ea4f17493bc17f8ccd4a5e29b2c5 Author: Chris Morgan Date: Tue Jun 3 14:39:29 2025 -0500 drm/panel: himax-hx8394: Add Support for Huiling hl055fhav028c Add support for the Huiling hl055fhav028c panel as used on the Gameforce Ace handheld gaming console. This panel uses a Himax HX8399C display controller and requires a sparsely documented vendor provided init sequence. The display resolution is 1080x1920 and is 70mm by 127mm as stated in the manufacturer's documentation. Signed-off-by: Chris Morgan Reviewed-by: Jessica Zhang Reviewed-by: Javier Martinez Canillas Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250603193930.323607-2-macroalpha82@gmail.com commit ab9be0b75af59876727b8a88dfc28d6b59a70446 Author: Chris Morgan Date: Tue Jun 3 14:39:28 2025 -0500 dt-bindings: display: himax-hx8394: Add Huiling hl055fhav028c Add compatible string for the Huiling hl055fhav028c. This panel is based on the Himax HX8399C display controller which is extremely similar to the existing HX8394. Add a new constant for himax,hx8399c for this new display controller as well. Signed-off-by: Chris Morgan Reviewed-by: Javier Martinez Canillas Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250603193930.323607-3-macroalpha82@gmail.com commit 4d20c1b073e6b501ec82db2d409f27a8eccb2b5e Author: Chris Morgan Date: Tue Jun 3 14:39:27 2025 -0500 dt-bindings: vendor-prefixes: Add prefix for Huiling Shenzhen Huiling Information Technology Co. Ltd. specializes in the research and manufacturing of display and touch screens for industrial usage. https://en.szhuiling.com/ Signed-off-by: Chris Morgan Acked-by: Krzysztof Kozlowski Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250603193930.323607-2-macroalpha82@gmail.com commit 8a45632ed3179995b2956cfbf140655701301471 Author: Michael Walle Date: Tue May 20 09:44:39 2025 +0200 drm/panel-simple: add AUO P238HAN01 panel entry Timings taken from the datasheet and the display is working in DE mode, thus the datasheet only specifies the blanking period. sync, back porch and front porch are arbitrarily chosen. The datasheet can be found at [1] but for reference these are the relevant timings: sym | | min | typ | max | unit | ------|--------------+------+------+------+------+ Tv | V period | 1094 | 1130 | 1836 | Th | | V active | 1080 | 1080 | 1080 | Th | | V blanking | 14 | 50 | 756 | Th | Fv | V frequency | 49 | 60 | 76 | Hz | Th | H period | 1000 | 1050 | 1678 | Tclk | | H active | 960 | 960 | 960 | Tclk | | H blanking | 40 | 90 | 718 | Tclk | Fh | H frequency | 53.7 | 67.8 | 90.0 | kHz | Tclk | LVDS clock | 53.7 | 71.2 | 90.0 | MHz | Keep in mind that this is a dual link LVDS panel and the horizontal timings are only for one half of the panel. [1] https://www.fortec-integrated.de/fileadmin/pdf/produkte/TFT-Displays/AUO/P238HAN01.0_Datasheet.pdf Signed-off-by: Michael Walle Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250520074439.655749-2-mwalle@kernel.org commit a3bc2ee00b488bb7a90770447a886c678d64756a Author: Michael Walle Date: Tue May 20 09:44:38 2025 +0200 dt-bindings: display: simple: add AUO P238HAN01 panel Add AUO P238HAN01 23.8" 1920x1080 LVDS panel compatible string. Signed-off-by: Michael Walle Acked-by: Conor Dooley Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250520074439.655749-1-mwalle@kernel.org commit 0f9c561a7a63ec0a7d69c227b090ee6defa45d35 Author: Andy Shevchenko Date: Mon May 19 16:33:45 2025 +0300 drm/panel: ili9341: Remove unused member from struct ili9341 struct device *dev from struct ili9341 is not used anywhere, remove it. Signed-off-by: Andy Shevchenko Reviewed-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250519133345.257138-1-andriy.shevchenko@linux.intel.com commit 48d39ed4586b35d37d7c7439588bdbc1d9fa5674 Author: Jessica Zhang Date: Tue Jun 3 18:18:35 2025 -0700 MAINTAINERS: Update my email address for DRM Panel reviews Update my email with *.qualcomm.com address Signed-off-by: Jessica Zhang Acked-by: Neil Armstrong Signed-off-by: Neil Armstrong Link: https://lore.kernel.org/r/20250603-panel-maintainer-update-v1-1-224aaa222d99@oss.qualcomm.com commit c87a3f4fac5b6fee3b3e6a82a12147da5b5df507 Author: Dave Airlie Date: Wed Jun 4 08:09:01 2025 +1000 drm/ttm: handle undefined printf arg evaluation order in debugfs When you read this debugfs file it's isn't guaranteed the count will happen before the scan, but I think the intent is that it does. printf argument evaluation order is undefined. Cc: Christian Koenig Reviewed-by: Christian König Signed-off-by: Dave Airlie Link: https://lore.kernel.org/r/20250603220901.1217161-1-airlied@gmail.com commit e117100acb6d2dd90da01a88616a3b9261b0e99a Author: Jani Nikula Date: Tue May 27 12:25:26 2025 +0300 drm/i915/dram: allocate struct dram_info dynamically Allocate struct drm_info dynamically, and convert the struct drm_i915_private and struct xe_device dram_info member into a const pointer. Move the struct definition to intel_dram.h, and keep it opaque to everyone not needing it. This also removes the duplication of the struct definition. Reviewed-by: Vinod Govindapillai Link: https://lore.kernel.org/r/73625095157346ea0e8614108c9b369208e5df66.1748337870.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 836864ac60c53be427caad83ae78ef56aab8b815 Author: Jani Nikula Date: Tue May 27 12:25:25 2025 +0300 drm/i915/dram: add return value and handling to intel_dram_detect() We'll want to start returning errors from intel_dram_detect(). As the first step, add the return value and error handling, even if we still only return 0. Do no functional changes, but leave a comment about whether we should bail out on dram detection failures. Reviewed-by: Vinod Govindapillai Link: https://lore.kernel.org/r/be2c31c459fb95d8161b719d499403eea5ec17b7.1748337870.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit bd0cffe9ebcb6874ab56eced77e604057a70850d Author: Jani Nikula Date: Tue May 27 12:25:24 2025 +0300 drm/i915/dram: pass struct dram_info pointer around Figure out the struct dram_info pointer in one place, and pass that around to be filled in, instead of all places poking at i915->dram_info directly. Reviewed-by: Vinod Govindapillai Link: https://lore.kernel.org/r/8ac6b308b210cf4a429d5abfb9bf32737dcab51f.1748337870.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit ca37e99ec96dd344c3c2e8b06a33fbcd2b47f4bb Author: Jani Nikula Date: Tue May 27 12:25:23 2025 +0300 drm/i915/wm: DG2 doesn't have dram info to look up wm_lv_0_adjust_needed There's no dram info on DG2 that we could use. The struct dram_info is all zero on it, but be explicit about this. Reviewed-by: Vinod Govindapillai Link: https://lore.kernel.org/r/a866641bff364dcfcaaabaa1d53c4a8cfa94ff3f.1748337870.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 612abe44f70f17dfad6830acd987f9696689869b Author: Jani Nikula Date: Tue May 27 12:25:22 2025 +0300 drm/i915/dram: add accessor for struct dram_info and use it Add a function to get the (const) pointer to struct dram_info, and use that to obtain the pointer instead of poking at i915->dram_info directly. Clean up a couple of local variables while at it. Reviewed-by: Vinod Govindapillai Link: https://lore.kernel.org/r/4174edf649e2f6805dab6fd6ce2ec10f4e5f2498.1748337870.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 9ab671afacc14449500d9da1633a8389a2a18b83 Author: Jani Nikula Date: Tue May 27 12:25:21 2025 +0300 drm/i915/bw: pass struct dram_info pointer around Have just one place to figure out the pointer to struct dram_info, and pass that around. This simplifies future changes. Reviewed-by: Vinod Govindapillai Link: https://lore.kernel.org/r/1752b4987ff39a685c28cebae1be4ce326b67c7b.1748337870.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 99e80508980583b1c0150b953b64a629211c4e23 Author: Matthew Brost Date: Mon Jun 2 09:44:12 2025 -0700 drm/xe: Make VMA tile_present, tile_invalidated access rules clear Document VMA tile_invalidated access rules, use READ_ONCE / WRITE_ONCE for opportunistic checks of tile_present and tile_invalidated, move tile_invalidated state change from page fault handler to PT code under the correct locks, and add lockdep asserts to TLB invalidation paths. v2: - Assert VM dma-resv lock rather than BO in zap PTEs v3: - Back to BO's dma-resv lock, adjust documentation v4: - Add WRITE_ONCE in xe_vm_invalidate_vma (Thomas) - Change lockdep assert for userptr in xe_vm_invalidate_vma (CI) - Take userptr notifier lock in read mode in xe_vm_userptr_pin before calling xe_vm_invalidate_vma (CI) v5: - Fix typos (Thomas) Signed-off-by: Matthew Brost Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20250602164412.1912293-1-matthew.brost@intel.com commit e583c27a8f595b23b0ec3eda22c522590f809ff2 Author: Jani Nikula Date: Tue May 27 13:59:14 2025 +0300 drm/i915/sbi: clean up SBI register macro definitions and usage Use REG_BIT() and friends for defining the register macros. Switch GVT to use the same macros, and drop its own copies. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/e148e8621c6055d0441fdf6d651d4ad24be53d09.1748343520.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 0b6d7dbf1813447e64a09ef3a831fa71bff43669 Author: Jani Nikula Date: Tue May 27 13:59:13 2025 +0300 drm/i915/sbi: split out intel_sbi_regs.h Split out display/intel_sbi_regs.h from i915_reg.h. Include both the SBI interface MMIO as well as the known sideband offsets. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/c96197159e05ebcb63fcc05f0f0801624cd4fdeb.1748343520.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit ad3cfb65aceb2732ca4f87e410fa59957f6c1adf Author: Jani Nikula Date: Tue May 27 13:59:12 2025 +0300 drm/i915/sbi: convert to intel_de_*() Convert SBI to use the intel_de_*() interface. This allows us to drop the dependency in i915_drv.h while at it. The fast timeout for the status wait drops from 100 us to 2 us on i915, but that should be of no consequence. The slow timeout remains the same. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/146f9027f565feb827861f06c1ae218b378edd95.1748343520.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit ac3bff5d63a502380370cd894d837187b1c120a0 Author: Jani Nikula Date: Tue May 27 13:59:11 2025 +0300 drm/i915: add out_value to intel_wait_for_register_fw() and intel_de_wait_fw() Future users of intel_de_wait_fw() need the final value. Just return it for everyone using intel_wait_for_register_fw() and intel_de_wait_fw() to avoid adding or using another set of specialized functions. There aren't that many users for these anyway. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/f804b2fe85ad63389e74d82e4c97220e9275f170.1748343520.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 07a86ee12e5a5eb4933c8cd8e450f54a0f359f61 Author: Jani Nikula Date: Tue May 27 13:59:10 2025 +0300 drm/i915/de: rename timeout parameters timeout_ms to highlight unit The timeout parameters are in ms. Rename the parameters to highlight the unit. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/cd4c775ad323a577f612e6a942f83b22641fb798.1748343520.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 9ab17ede10184041f9754296ab0801e9e1a064a1 Author: Jani Nikula Date: Tue May 27 13:59:09 2025 +0300 drm/i915/sbi: move sbi_lock under struct intel_display With SBI under display, also move sbi_lock to display->sbi.lock. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/838fa712fc8a691a3f9427e5f4ed551bd1c62c49.1748343520.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a737ab4a87cb4a58b564a97bf313c8dfc15c7c53 Author: Jani Nikula Date: Tue May 27 13:59:08 2025 +0300 drm/i915/sbi: convert intel_sbi.[ch] to struct intel_display Convert intel_sbi.[ch] to struct intel_display, as much as possible anyway, and as a consequence drop the dependency on i915_drv.h from intel_pch_refclk.c. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/9fa9f9a828a7e0e93208111566478b16838abe0d.1748343520.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 7fb3a1f7a48d9512f092d2b18bd4b9361ff88e51 Author: Jani Nikula Date: Tue May 27 13:59:07 2025 +0300 drm/i915/sbi: move intel_sbi.[ch] under display/ The LPT/WPT SBI is arguably part of south display, and it's only used by intel_pch_refclk.c anyway. Move it under display/. Reviewed-by: Luca Coelho Link: https://lore.kernel.org/r/341268d633e9705bc582f1cc985dc4554e39d87d.1748343520.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 531bef26d189b28bf0d694878c0e064b30990b6c Author: Maarten Lankhorst Date: Wed May 21 11:01:02 2025 +0200 drm/xe/svm: Fix regression disallowing 64K SVM migration When changing the condition from >= SZ_64K, it was changed to <= SZ_64K. This disallows migration of 64K, which is the exact minimum allowed. Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/5057 Fixes: a9ac0fa455b0 ("drm/xe: Strict migration policy for atomic SVM faults") Cc: stable@vger.kernel.org Cc: Matthew Brost Cc: Himal Prasad Ghimiray Reviewed-by: Himal Prasad Ghimiray Signed-off-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250521090102.2965100-1-dev@lankhorst.se commit 685c407f168cb49a12cc703230d1e2d62767bfd2 Author: Lucas De Marchi Date: Tue Jun 3 11:47:51 2025 -0700 drm/ttm: Fix build with CONFIG_DEBUG_FS=n Move the define outside the ifdef for CONFIG_DEBUG_FS to fix the build. This currently breaks drm kunit tests: $ ./tools/testing/kunit/kunit.py run --kunitconfig drivers/gpu/drm/ttm/tests/.kunitconfig ERROR:root:../drivers/gpu/drm/ttm/ttm_pool.c: In function ‘ttm_pool_mgr_init’: ../drivers/gpu/drm/ttm/ttm_pool.c:1335:30: error: ‘TTM_SHRINKER_BATCH’ undeclared (first use in this function) 1335 | mm_shrinker->batch = TTM_SHRINKER_BATCH; Fixes: 22b929b25293 ("drm/ttm: Increase pool shrinker batch target") Cc: Tvrtko Ursulin Cc: Christian König Reviewed-by: Tvrtko Ursulin Signed-off-by: Lucas De Marchi Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250603184750.3304647-2-lucas.demarchi@intel.com commit 0f6afbb2ae6c9bd2acd5acf75762fec68bc6fab0 Author: Dave Airlie Date: Tue Jun 3 06:40:10 2025 +1000 ttm/pool: allow debugfs dumps for numa pools. Currently you can't see per-device numa aware pools properly. Cc: Christian König Reviewed-by: Christian König Signed-off-by: Dave Airlie Link: https://lore.kernel.org/r/20250602204013.1104258-1-airlied@gmail.com commit 78d7032b08385a6bf64915b3fc11e9a4d1803302 Author: Taimur Hassan Date: Mon May 26 14:47:08 2025 -0500 drm/amd/display: Promote DAL to 3.2.336 This version brings along following fixes: - Fix brightness relevant settings - Fix calling blanking stream twice - Extend dc mode validation types to support more scenarios - Update DMCUB loading sequence for DCN3.5 Acked-by: ChiaHsuan Chung Signed-off-by: Taimur Hassan Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 269c1d1443d6686595ac187c247973014a1ee709 Author: Yan Li Date: Wed May 14 11:54:49 2025 -0400 drm/amd/display: replace fast_validate with enum dc_validate_mode [Why] The boolean fast_validate is used as an input parameter in multiple functions. To support more scenarios, we are replacing it with enum dc_validate_mode. [How] The enum dc_validate_mode introduces three possible values: 1) DC_VALIDATE_MODE_AND_PROGRAMMING: Apply the mode to hardware 2) DC_VALIDATE_MODE_ONLY: Check whether the mode can be supported 3) DC_VALIDATE_MODE_AND_STATE_INDEX: Check if the mode can be supported, and determine the optimal voltage level needed to support it. Reviewed-by: Nicholas Kazlauskas Signed-off-by: Yan Li Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit d42b2331e158fa6bcdc89e4c8c470dc5da20be1f Author: Nicholas Kazlauskas Date: Fri May 9 11:18:26 2025 -0400 drm/amd/display: Update DMCUB loading sequence for DCN3.5 [Why] New sequence from HW for reset and firmware reloading has been provided that aims to stabilize the reload sequence in the case the firmware is hung or has outstanding requests. [How] Update the sequence to remove the DMUIF reset and the redundant writes in the release. Reviewed-by: Ovidiu Bunea Signed-off-by: Nicholas Kazlauskas Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit aca63ca8b84919e8cf69747aa91593655bd1f731 Author: Taimur Hassan Date: Sun May 18 12:37:53 2025 -0500 drm/amd/display: Promote DAL to 3.2.335 This version brings along following fixes: - Fixes for DML21 - Support OLED SDR with AMD ABC - Indirect buffer transport for FAMS2 commands - Correct non-OLED pre_T11_delay - Optime boot-up consuming time - Add support for 2nd sharpening range - Fix on chroma planes scaling Acked-by: ChiaHsuan Chung Signed-off-by: Taimur Hassan Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 960d8c0fa3b55ab58caa5c135940054b4fcc26b1 Author: Taimur Hassan Date: Sun May 18 11:28:38 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.12.0 Add dmub command to support LSDMA Acked-by: ChiaHsuan Chung Signed-off-by: Taimur Hassan Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 56f618407d7b952970648bcc5535a8cfa0e93c3a Author: Ray Wu Date: Thu May 8 17:51:11 2025 +0800 drm/amd/display: Move vmalloc include to header file [Why & How] Move vmalloc.h include code to header file. Reviewed-by: ChiaHsuan Chung Signed-off-by: Ray Wu Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit dbb767be864a667ac33c283c7ec9c26245b44d24 Author: Samson Tam Date: Fri May 9 11:19:28 2025 -0400 drm/amd/display: Add support for 2nd sharpening range [Why & How] Add support for 2nd sharpening range for cases where we want override existing DCN sharpening range Reviewed-by: Ilya Bakoulin Signed-off-by: Samson Tam Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit a4d04bc90d2d539cf27f72128a0301a261e1249d Author: Navid Assadian Date: Wed Apr 30 15:38:20 2025 -0400 drm/amd/display: Do not bypass chroma scaling in 1:1 case [Why] When doing 2:1 downscaling on a YUV sub-sampled format, the chroma scaling ratio is 1:1. Since chroma has cositing, it is needed to do scaling on the chroma plane(s) and not to bypass chroma scaling. [How] Do not set the chroma taps to one when the chroma ratio is identity and the input format is a sub-sampled YUV format. Reviewed-by: Samson Tam Signed-off-by: Navid Assadian Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit ed8045a731107e96b1fda80879a85b5de7658941 Author: Oleh Kuzhylnyi Date: Wed May 14 14:21:15 2025 +0200 drm/amd/display: Add DML path for FAMS methods [Why] DML needs a path for FAMS methods. [How] Apply instance of fams2_stream_sub_params_v2 structure with a FAMS placeholder for DML. Reviewed-by: Alvin Lee Signed-off-by: Oleh Kuzhylnyi Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 35b74eccf8289e4a458133be9f9795d152b6f11e Author: Jingwen Zhu Date: Thu May 8 11:19:49 2025 +0800 drm/amd/display: Add disconnect case on dongle check [why] In the case of an external monitor disconnection, the kernel mode will attempt to post new timing validation with two path counts (eDP + external monitor removed to virtual). [how] Skip validating color depth and pixel encoding in the scenario involving a DP to HDMI active converter dongle. Reviewed-by: Wenjing Liu Signed-off-by: Jingwen Zhu Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit deb24e64c8881c462b29e2c69afd9e6669058be5 Author: Wayne Lin Date: Tue May 13 16:06:50 2025 +0800 drm/amd/display: Avoid trying AUX transactions on disconnected ports [Why & How] Observe that we try to access DPCD 0x600h of disconnected DP ports. In order not to wasting time on retrying these ports, call dpcd_write_rx_power_ctrl() after checking its connection status. Reviewed-by: Aurabindo Pillai Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 8ade4736075a83d92e6cb87dc89c114760460994 Author: Mario Limonciello Date: Fri May 2 10:40:50 2025 -0500 drm/amd/display: Drop unnecessary `amdgpu` prefix [Why] The `drm_*()` print macros will handle including the driver in the print already. The extra print of the word `amdgpu` is unnecessary. [How] Modify all prints to drop `amdgpu: `. Reviewed-by: Alex Hung Signed-off-by: Mario Limonciello Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit db122ece325a3a19eeabf98e61db70fe890b4b5a Author: Oleh Kuzhylnyi Date: Thu Apr 24 14:40:09 2025 +0200 drm/amd/display: Indirect buffer transport for FAMS2 commands [Why] The quantity and duration of FAMS2 commands are set to increase in future products. This necessitates the implementation of a new mechanism for chaining commands together, allowing all commands to be processed within a single transaction. [How] The indirect buffer acts as a shared buffer on the driver side, mapped to DMUB's internal CW7 address. Its source address and size are sent through mailbox command to DMUB, triggering the transaction. Reviewed-by: Alvin Lee Signed-off-by: Oleh Kuzhylnyi Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 71e17aedb465a8b2b7b6260d9fc85dddec04b341 Author: Yihan Zhu Date: Wed May 7 14:25:07 2025 -0400 drm/amd/display: move RMCM programming [WHY & HOW] Move only RMCM programming outside of dcn401. Extended HW definition in dc for memory layout to extend support. Reviewed-by: Jun Lei Signed-off-by: Yihan Zhu Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 0a91b4f300de870746a21730135376611aa85479 Author: Camille Cho Date: Wed May 7 19:00:54 2025 +0800 drm/amd/display: Support OLED SDR with AMD ABC [Why] Nits programming for SDR panel is only supported by VESA ABC. [How] 1. Loose nits programming for OLED SDR panel with AMD ABC. 2. We support two ABC methods. Disable one before we program the other in case panel freaks out. 3. Update HDR judgement in setBR with a solider condition. Reviewed-by: Krunoslav Kovac Signed-off-by: Camille Cho Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit b6943f4adc957840242dcaa5919c38fd5c70ccf9 Author: Austin Zheng Date: Mon Apr 14 16:49:13 2025 -0400 drm/amd/display: DML21 Fixes - Store state related info inside mode_lib. - Fix bad DCFCLK deep sleep - Update FAMS structure in DMUB header Reviewed-by: Alvin Lee Signed-off-by: Austin Zheng Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 6123117005d9e6368a625a7164acebd65a304f41 Author: Alvin Lee Date: Tue May 13 15:00:47 2025 -0400 drm/amd/display: Re-order FAMS2 sub commands [Why & How] New enums need to be added to the end to avoid back compat issues. Reviewed-by: Dillon Varone Signed-off-by: Alvin Lee Signed-off-by: Wayne Lin Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit 04e32c392acea62cda89dd2c848e76295b0024bc Author: Taimur Hassan Date: Sun May 11 20:18:48 2025 -0400 drm/amd/display: [FW Promotion] Release 0.1.11.0 Refactoring some DMUB related structs and enum. Acked-by: Wayne Lin Signed-off-by: Taimur Hassan Signed-off-by: Tom Chung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher commit edfc4c8a1edffa6849e19ffade1be8dd824989d0 Author: Michal Koutný Date: Tue Jun 3 17:45:27 2025 +0200 cgroup: Drop sock_cgroup_classid() dummy implementation The semantic of returning 0 is unclear when !CONFIG_CGROUP_NET_CLASSID. Since there are no callers of sock_cgroup_classid() with that config anymore we can undefine the helper at all and enforce all (future) callers to handle cases when !CONFIG_CGROUP_NET_CLASSID. Signed-off-by: Michal Koutný Link: https://lore.kernel.org/r/Z_52r_v9-3JUzDT7@calendula/ Acked-by: Tejun Heo Reviewed-by: Waiman Long Signed-off-by: Tejun Heo commit 5cc809d62b8cca99f832912d8f283a8027386c02 Author: Tvrtko Ursulin Date: Thu May 15 10:50:00 2025 +0100 drm/i915: Use dma-fence driver and timeline name helpers Access the dma-fence internals via the previously added helpers. Signed-off-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250515095004.28318-6-tvrtko.ursulin@igalia.com commit 68ff0e07f9b3f0e376bb8b95a0c3e6205695362a Author: Tvrtko Ursulin Date: Thu May 15 10:49:59 2025 +0100 sync_file: Use dma-fence driver and timeline name helpers Access the dma-fence internals via the previously added helpers. Signed-off-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250515095004.28318-5-tvrtko.ursulin@igalia.com commit ecec875a6c3379017af57e3c7ba51de0501fe750 Author: Tvrtko Ursulin Date: Thu May 15 10:49:58 2025 +0100 dma-fence: Add helpers for accessing driver and timeline name Add some helpers in order to enable preventing dma-fence users accessing the implementation details directly and make the implementation itself use them. This will also enable later adding some asserts to a consolidated location. Signed-off-by: Tvrtko Ursulin Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250515095004.28318-4-tvrtko.ursulin@igalia.com commit bf33a0003d9e3b0546f2d7e91bebfd67af59f275 Author: Tvrtko Ursulin Date: Thu May 15 10:49:57 2025 +0100 dma-fence: Use a flag for 64-bit seqnos With the goal of reducing the need for drivers to touch (and dereference) fence->ops, we move the 64-bit seqnos flag from struct dma_fence_ops to the fence->flags. Drivers which were setting this flag are changed to use new dma_fence_init64() instead of dma_fence_init(). v2: * Streamlined init and added kerneldoc. * Rebase for amdgpu userq which landed since. Signed-off-by: Tvrtko Ursulin Reviewed-by: Christian König # v1 Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250515095004.28318-3-tvrtko.ursulin@igalia.com commit 22b929b25293208d9d34ff6fa783c6788e0b791c Author: Tvrtko Ursulin Date: Tue Jun 3 12:27:50 2025 +0100 drm/ttm: Increase pool shrinker batch target The default core shrink target of 128 pages (SHRINK_BATCH) is quite low relative to how cheap TTM pool shrinking is, and how the free pages are distributed in page order pools. We can make the target a bit more aggressive by making it roughly the average number of pages across all pools, freeing more of the cached pages every time shrinker core invokes our callback. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Thomas Hellström Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250603112750.34997-3-tvrtko.ursulin@igalia.com commit eac21f8ebeb4f84d703cf41dc3f81d16fa9dc00a Author: Tvrtko Ursulin Date: Tue Jun 3 12:27:49 2025 +0100 drm/ttm: Respect the shrinker core free target Currently the TTM shrinker aborts shrinking as soon as it frees pages from any of the page order pools and by doing so it can fail to respect the freeing target which was configured by the shrinker core. We use the wording "can fail" because the number of freed pages will depend on the presence of pages in the pools and the order of the pools on the LRU list. For example if there are no free pages in the high order pools the shrinker core may require multiple passes over the TTM shrinker before it will free the default target of 128 pages (assuming there are free pages in the low order pools). This inefficiency can be compounded by the pool LRU where multiple further calls into the TTM shrinker are required to end up looking at the pool with pages. Improve this by never freeing less than the shrinker core has requested. At the same time we start reporting the number of scanned pages (freed in this case), which prevents the core shrinker from giving up on the TTM shrinker too soon and moving on. v2: * Simplify loop logic. (Christian) * Improve commit message. Signed-off-by: Tvrtko Ursulin Cc: Christian König Cc: Thomas Hellström Reviewed-by: Christian König Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250603112750.34997-2-tvrtko.ursulin@igalia.com commit 7b1166dee847d5018c1f3cc781218e806078f752 Merge: b6cbfa872045d7 f8bb3ed3197966 Author: Maxime Ripard Date: Tue Jun 3 15:07:39 2025 +0200 Merge drm-next-2025-05-28 into drm-misc-next Christian needs a recent drm-next branch to merge fence patches. Signed-off-by: Maxime Ripard commit ce924116e43ffbfa544d82976c4b9d11bcde9334 Author: Dibin Moolakadan Subrahmanian Date: Wed May 28 12:15:56 2025 +0530 drm/i915/display: Fix u32 overflow in SNPS PHY HDMI PLL setup When configuring the HDMI PLL, calculations use DIV_ROUND_UP_ULL and DIV_ROUND_DOWN_ULL macros, which internally rely on do_div. However, do_div expects a 32-bit (u32) divisor, and at higher data rates, the divisor can exceed this limit. This leads to incorrect division results and ultimately misconfigured PLL values. This fix replaces do_div calls with div64_base64 calls where diviser can exceed u32 limit. Fixes: 5947642004bf ("drm/i915/display: Add support for SNPS PHY HDMI PLL algorithm for DG2") Cc: Ankit Nautiyal Cc: Suraj Kandpal Cc: Jani Nikula Signed-off-by: Dibin Moolakadan Subrahmanian Reviewed-by: Ankit Nautiyal Signed-off-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250528064557.4172149-1-dibin.moolakadan.subrahmanian@intel.com commit c12c729e97508f4cd073a7cd5150d7512fa84f34 Author: Michal Wajdeczko Date: Mon Jun 2 12:33:25 2025 +0200 drm/xe/vf: Add sanity check for GGTT configuration The VF GGTT configuration was prepared by the PF, which should be trusted, was obtained from the GuC, which likely already did some sanity checks too, but since it's a received data, we should have our own sanity checks to detect early any misconfiguration. Signed-off-by: Michal Wajdeczko Cc: Satyanarayana K V P Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250602103325.549-4-michal.wajdeczko@intel.com commit eb9b34734c41a08166e41836bb6a47bc117c77a1 Author: Michal Wajdeczko Date: Mon Jun 2 12:33:24 2025 +0200 drm/xe/vf: Move tile-related VF functions to separate file Some of our VF functions, even if they take a GT pointer, work only on primary GT and really are tile-related and would be better to keep them separate from the rest of true GT-oriented functions. Move them to a file and update to take a tile pointer instead. Signed-off-by: Michal Wajdeczko Cc: Tomasz Lis Reviewed-by: Tomasz Lis Link: https://lore.kernel.org/r/20250602103325.549-3-michal.wajdeczko@intel.com commit ce2ae1b97ac399805d0904d894b8c3a104d93271 Author: Michal Wajdeczko Date: Mon Jun 2 12:33:23 2025 +0200 drm/xe/vf: Introduce helpers to access GGTT configuration In upcoming patch we want to separate tile-oriented VF functions from GT-oriented functions and to allow the former access a GGTT configuration stored at GT level we need to provide some helpers. Signed-off-by: Michal Wajdeczko Cc: Tomasz Lis Reviewed-by: Tomasz Lis Link: https://lore.kernel.org/r/20250602103325.549-2-michal.wajdeczko@intel.com commit b6cbfa872045d7ed307c55aa1cdb0d5125d84282 Author: Shixiong Ou Date: Thu May 22 15:07:14 2025 +0800 drm/udl: use DRM_GEM_SHMEM_DRIVER_OPS_NO_MAP_SGT Import dmabuf without mapping its sg_table to avoid issues likes: udl 2-1.4:1.0: swiotlb buffer is full (sz: 2097152 bytes), total 65536 (slots), used 1 (slots) Signed-off-by: Shixiong Ou Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250522070714.439824-3-oushixiong1025@163.com commit ca43d3a2cfd697be508aa8e2c5c530844630de4f Author: Shixiong Ou Date: Thu May 22 15:07:13 2025 +0800 drm/ast: use DRM_GEM_SHMEM_DRIVER_OPS_NO_MAP_SGT Import dmabuf without mapping its sg_table to avoid issues likes: ast 0000:07:00.0: swiotlb buffer is full (sz: 3145728 bytes), total 32768 (slots), used 0 (slots) Signed-off-by: Shixiong Ou Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250522070714.439824-2-oushixiong1025@163.com commit 660cd44659a05c5fbfce6d2bb1ce448aa0f35594 Author: Shixiong Ou Date: Thu May 22 15:07:12 2025 +0800 drm/shmem-helper: Import dmabuf without mapping its sg_table [WHY] 1. Drivers using DRM_GEM_SHADOW_PLANE_HELPER_FUNCS and DRM_GEM_SHMEM_DRIVER_OPS (e.g., udl, ast) do not require sg_table import. They only need dma_buf_vmap() to access the shared buffer's kernel virtual address. 2. On certain Aspeed-based boards, a dma_mask of 0xffff_ffff may trigger SWIOTLB during dmabuf import. However, IO_TLB_SEGSIZE restricts the maximum DMA streaming mapping memory, resulting in errors like: ast 0000:07:00.0: swiotlb buffer is full (sz: 3145728 bytes), total 32768 (slots), used 0 (slots) [HOW] Provide a gem_prime_import implementation without sg_table mapping to avoid issues (e.g., "swiotlb buffer is full"). Drivers that do not require sg_table can adopt this. Signed-off-by: Shixiong Ou Acked-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250522070714.439824-1-oushixiong1025@163.com commit 28b996ce73982a44fa86736ca0e3684cb1ae8b24 Author: Maciej Patelczyk Date: Fri May 30 15:56:27 2025 +0200 drm/xe: remove unmatched xe_vm_unlock() from __xe_exec_queue_init() There is unmatched xe_vm_unlock() in the __xe_exec_queue_init(). Leftover from commit fbeaad071a98 ("drm/xe: Create LRC BO without VM") Fixes: fbeaad071a98 ("drm/xe: Create LRC BO without VM") Signed-off-by: Maciej Patelczyk Reviewed-by: Jonathan Cavitt Reviewed-by: Matthew Brost Signed-off-by: Niranjana Vishwanathapura Link: https://lore.kernel.org/r/20250530135627.2821612-1-maciej.patelczyk@intel.com commit 399c5f54090c1c7d8f9eae7897940e8a11604884 Author: Lucas De Marchi Date: Wed May 28 14:54:08 2025 -0700 drm/xe/configfs: Add internal API to documentation Add the internal configfs API like is done with other parts of the driver. Also ensure the correct number of '=' chars are used for the header. Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250528-engine-mask-v4-5-f4636d2a890a@intel.com Signed-off-by: Lucas De Marchi commit d09bc3edfe5c702463e2640314b7db2219242446 Author: Lucas De Marchi Date: Wed May 28 14:54:07 2025 -0700 drm/xe/configfs: Add attribute to disable engines Add the userspace interface to load the driver with fewer engines. The syntax is to just echo the engine names to a file in configfs, like below: echo 'rcs0,bcs0' > /sys/kernel/config/xe//engine_allowed With that engines other than rcs0 and bcs0 will not be enabled. To enable all instances from a class, a '*' can be used. Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250528-engine-mask-v4-4-f4636d2a890a@intel.com Signed-off-by: Lucas De Marchi commit 58b51df807d7394a09ddb95b47099d59465e3777 Author: Lucas De Marchi Date: Wed May 28 14:54:06 2025 -0700 drm/xe: Allow to disable engines Sometimes it's useful to load the driver with a smaller set of engines to allow more targeted debugging, particularly on early enabling. Besides checking what is fused off in hardware, add similar logic to disable engines in software. This will use configfs to allow users to set what engine to disable, so already add prepare for that. The exact configfs interface will be added later. Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250528-engine-mask-v4-3-f4636d2a890a@intel.com Signed-off-by: Lucas De Marchi commit 2b0ef1f7a2980bf0c5589ff42806eee2d55ea8e6 Author: Lucas De Marchi Date: Wed May 28 14:54:05 2025 -0700 drm/xe: Convert "fused off" messages to be gt-based It's useful to see in the log message what GT was being checked for disabled/fused-off engines. Especially on multi-tile platforms the different tiles may be fused differently making it harder to parse the information. Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250528-engine-mask-v4-2-f4636d2a890a@intel.com Signed-off-by: Lucas De Marchi commit d8636cce7a1c81b67ee1fcfd03fe8397e0101a32 Author: Lucas De Marchi Date: Wed May 28 14:54:04 2025 -0700 drm/xe/configfs: Drop trailing semicolons Drop the semicolons from the dummy implementation: they shouldn't be there. Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250528-engine-mask-v4-1-f4636d2a890a@intel.com Signed-off-by: Lucas De Marchi commit d65650a9d153c91f0cde0f5026268812e0b697f3 Author: Michal Wajdeczko Date: Wed May 28 11:00:21 2025 +0200 drm/xe/guc: Resend potentially lost H2G MMIO request There could be a scenario where the VF driver is resuming faster than the driver PF is able to complete the VF FLR sequence which includes reset of the VF scratch registers. This may result in deletion of the ongoing HXG message (it could be either a host request or a GuC response). When we detect that HXG message was likey lost (scratch register with HXG header was zeroed) try to send this request once more before giving up. Signed-off-by: Michal Wajdeczko Cc: Satyanarayana K V P Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250528090021.329-1-michal.wajdeczko@intel.com commit eae784475896cbd3faa2063cb2bed6cd8e085abf Author: Michal Wajdeczko Date: Fri May 30 23:05:24 2025 +0200 drm/xe: Use GT-oriented printer to dump topology on init During the probe we dump the discovered GT topology, but instead of a generic printer we can use our own GT-oriented printer which contains information about the source GT. Signed-off-by: Michal Wajdeczko Cc: Matt Roper Reviewed-by: Matt Roper Reviewed-by: Jonathan Cavitt Link: https://lore.kernel.org/r/20250530210524.505-1-michal.wajdeczko@intel.com commit 8d425229acb24354d3add6f67bc1b0188f16adea Author: Michal Wajdeczko Date: Fri May 30 18:48:35 2025 +0200 drm/xe: Convert page fault messages to be GT-oriented We are processing here G2H messages, so we should use GT oriented messages to retain information about the origin GT. While at it, print error codes in a user-friendly way. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Matthew Brost Reviewed-by: Matt Roper Link: https://lore.kernel.org/r/20250530164835.461-1-michal.wajdeczko@intel.com commit dea7a2b4f60e04b80f43e3281cdbb29a2aa29152 Author: Lucas De Marchi Date: Fri May 30 15:31:57 2025 -0700 drm/xe/hwmon: Simplify and fix 32b wrap Like done in commit eaa287069a70 ("drm/xe/guc_submit: Simplify and fix diff calculation"), just use u32 for wrapping the value, which is simpler and more correct: when wrapping on 32b, the accumulated value was off by one. Also, do not mix the u64 value from pmt with the u32 value used for the calculation. Cc: Badal Nilawar Cc: Raag Jadav Reviewed-by: Raag Jadav Link: https://lore.kernel.org/r/20250530-xe-hwmon-wrap-v2-1-ce653db7fe4a@intel.com Signed-off-by: Lucas De Marchi commit ccd3c6820a9024bcb68c249b644b5e42f0f7b9d2 Author: Daniele Ceraolo Spurio Date: Thu May 22 15:54:05 2025 -0700 drm/xe/pxp: Decouple queue addition from PXP start Starting PXP and adding a queue to the PXP queue list are separate actions. Given that a queue can only be added to the list if PXP is active, the 2 actions were bundled together to avoid having to re-lock and re-check the status to perform the queue addition after having done so during the PXP start. However, we don't save a lot of complexity by doing so and we lose in clarity of code, so overall it's cleaner to just keep the 2 actions separate. v2: remove leftover rpm_get (John), fix rpm_put in error case Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250522225401.3953243-8-daniele.ceraolospurio@intel.com commit 21784ca96025b62d95b670b7639ad70ddafa69b8 Author: Daniele Ceraolo Spurio Date: Thu May 22 15:54:04 2025 -0700 drm/xe/pxp: Clarify PXP queue creation behavior if PXP is not ready The expected flow of operations when using PXP is to query the PXP status and wait for it to transition to "ready" before attempting to create an exec_queue. This flow is followed by the Mesa driver, but there is no guarantee that an incorrectly coded (or malicious) app will not attempt to create the queue first without querying the status. Therefore, we need to clarify what the expected behavior of the queue creation ioctl is in this scenario. Currently, the ioctl always fails with an -EBUSY code no matter the error, but for consistency it is better to distinguish between "failed to init" (-EIO) and "not ready" (-EBUSY), the same way the query ioctl does. Note that, while this is a change in the return code of an ioctl, the behavior of the ioctl in this particular corner case was not clearly spec'd, so no one should have been relying on it (and we know that Mesa, which is the only known userspace for this, didn't). v2: Minor rework of the doc (Rodrigo) Fixes: 72d479601d67 ("drm/xe/pxp/uapi: Add userspace and LRC support for PXP-using queues") Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Cc: José Roberto de Souza Reviewed-by: José Roberto de Souza Reviewed-by: John Harrison Acked-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250522225401.3953243-7-daniele.ceraolospurio@intel.com commit 1d891ee820fd0fbb4101eacb0d922b5050a24933 Author: Daniele Ceraolo Spurio Date: Thu May 22 15:54:03 2025 -0700 drm/xe/pxp: Use the correct define in the set_property_funcs array The define of the extension type was accidentally used instead of the one of the property itself. They're both zero, so no functional issue, but we should use the correct define for code correctness. Fixes: 41a97c4a1294 ("drm/xe/pxp/uapi: Add API to mark a BO as using PXP") Signed-off-by: Daniele Ceraolo Spurio Cc: John Harrison Reviewed-by: John Harrison Link: https://lore.kernel.org/r/20250522225401.3953243-6-daniele.ceraolospurio@intel.com commit 6048f5587614bb4919c54966913452c1a0a43138 Author: Adrián Larumbe Date: Tue May 20 18:44:02 2025 +0100 drm/panfrost: Fix panfrost device variable name in devfreq Commit 64111a0e22a9 ("drm/panfrost: Fix incorrect updating of current device frequency") was a Panfrost port of a similar fix in Panthor. Fix the Panfrost device pointer variable name so that it follows Panfrost naming conventions. Signed-off-by: Adrián Larumbe Fixes: 64111a0e22a9 ("drm/panfrost: Fix incorrect updating of current device frequency") Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250520174634.353267-6-adrian.larumbe@collabora.com commit e48ade5e23ba1f4ecdb0b1ce0f5a14e0b9af37a2 Author: Adrián Larumbe Date: Tue May 20 18:44:01 2025 +0100 drm/panfrost: show device-wide list of DRM GEM objects over DebugFS This change is essentially a Panfrost port of commit a3707f53eb3f ("drm/panthor: show device-wide list of DRM GEM objects over DebugFS"). The DebugFS file is almost the same as in Panthor, minus the GEM object usage flags, since Panfrost has no kernel-only BO's. Two additional GEM state flags which are displayed but aren't relevant to Panthor are 'Purged' and 'Purgeable', since Panfrost implements an explicit shrinker and a madvise ioctl to flag objects as reclaimable. Signed-off-by: Adrián Larumbe Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250520174634.353267-5-adrian.larumbe@collabora.com commit 2f684bbbcb27048e6b16732b440dbadc0e342363 Author: Adrián Larumbe Date: Tue May 20 18:44:00 2025 +0100 drm/panfrost: Add driver IOCTL for setting BO labels Allow UM to label a BO for which it possesses a DRM handle. Signed-off-by: Adrián Larumbe Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250520174634.353267-4-adrian.larumbe@collabora.com commit ca8b3216dcea9b3601c925a4942a054e92b0d528 Author: Adrián Larumbe Date: Tue May 20 18:43:59 2025 +0100 drm/panfrost: Internally label some BOs Perfcnt samples buffer is not exposed to UM, but we would like to keep a tag on it as a potential debug aid. PRIME imported GEM buffers are UM exposed, but since the usual Panfrost UM driver code path is not followed in their creation, they might remain unlabelled for their entire lifetime, so a generic tag was deemed preferable. The tag is assigned before a UM handle is created so it doesn't contradict the logic about labelling internal BOs. Signed-off-by: Adrián Larumbe Reviewed-by: Boris Brezillon Reviewed-by: Steven Price Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250520174634.353267-3-adrian.larumbe@collabora.com commit e0e33f9bbbd635e18003cf8590c978beb9ce9045 Author: Adrián Larumbe Date: Tue May 20 18:43:58 2025 +0100 drm/panfrost: Add BO labelling to Panfrost Functions for labelling UM-exposed an internal BOs are provided. An example of the latter would be the Perfcnt sample buffer. This commit is done in preparation of a following one that will allow UM to set BO labels through a new ioctl(). Signed-off-by: Adrián Larumbe Reviewed-by: Steven Price Reviewed-by: Boris Brezillon Signed-off-by: Steven Price Link: https://lore.kernel.org/r/20250520174634.353267-2-adrian.larumbe@collabora.com commit 8395204aeb84ef6eacbebf2c94be0ce9381d7981 Author: Karol Wachowski Date: Thu May 15 11:31:28 2025 +0200 accel/ivpu: Add inference_timeout_ms module parameter Add new inference_timeout_ms parameter that allows specifying maximum allowed duration in milliseconds that inference can take before triggering a recovery. Calculate maximum number of heartbeat retries based on ratio between inference timeout and tdr timeout. Signed-off-by: Karol Wachowski Reviewed-by: Jeff Hugo Signed-off-by: Jacek Lawrynowicz Link: https://lore.kernel.org/r/20250515093128.252041-1-jacek.lawrynowicz@linux.intel.com commit db5f4ec4aa14c8051fcc4af65534f4e47a58f436 Author: Herbert Xu Date: Fri May 30 16:40:05 2025 +0800 dma-buf: Add forward declaration of struct seq_file in dma-fence.h Add forward declaration of struct seq_file before using it in function prototype. Signed-off-by: Herbert Xu Reviewed-by: Christian König Signed-off-by: Christian König Link: https://lore.kernel.org/r/aDlu5TGyA1WuMsvw@gondor.apana.org.au commit 80f3c51b2f98295af22678d5d81ebbcb39e968b1 Author: Philipp Stanner Date: Tue May 27 12:10:30 2025 +0200 drm/sched/tests: Use one lock for fence context There is no need for separate locks for single jobs and the entire scheduler. The dma_fence context can be protected by the scheduler lock, allowing for removing the jobs' locks. This simplifies things and reduces the likelyhood of deadlocks etc. Replace the jobs' locks with the mock scheduler lock. Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250527101029.56491-2-phasta@kernel.org commit 38fafa9f392f3110d2de431432d43f4eef99cd1b Author: Matthew Auld Date: Wed May 28 12:33:29 2025 +0100 drm/xe/sched: stop re-submitting signalled jobs Customer is reporting a really subtle issue where we get random DMAR faults, hangs and other nasties for kernel migration jobs when stressing stuff like s2idle/s3/s4. The explosions seems to happen somewhere after resuming the system with splats looking something like: PM: suspend exit rfkill: input handler disabled xe 0000:00:02.0: [drm] GT0: Engine reset: engine_class=bcs, logical_mask: 0x2, guc_id=0 xe 0000:00:02.0: [drm] GT0: Timedout job: seqno=24496, lrc_seqno=24496, guc_id=0, flags=0x13 in no process [-1] xe 0000:00:02.0: [drm] GT0: Kernel-submitted job timed out The likely cause appears to be a race between suspend cancelling the worker that processes the free_job()'s, such that we still have pending jobs to be freed after the cancel. Following from this, on resume the pending_list will now contain at least one already complete job, but it looks like we call drm_sched_resubmit_jobs(), which will then call run_job() on everything still on the pending_list. But if the job was already complete, then all the resources tied to the job, like the bb itself, any memory that is being accessed, the iommu mappings etc. might be long gone since those are usually tied to the fence signalling. This scenario can be seen in ftrace when running a slightly modified xe_pm IGT (kernel was only modified to inject artificial latency into free_job to make the race easier to hit): xe_sched_job_run: dev=0000:00:02.0, fence=0xffff888276cc8540, seqno=0, lrc_seqno=0, gt=0, guc_id=0, batch_addr=0x000000146910 ... xe_exec_queue_stop: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=0, guc_state=0x0, flags=0x13 xe_exec_queue_stop: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=1, guc_state=0x0, flags=0x4 xe_exec_queue_stop: dev=0000:00:02.0, 4:0x1, gt=1, width=1, guc_id=0, guc_state=0x0, flags=0x3 xe_exec_queue_stop: dev=0000:00:02.0, 1:0x1, gt=1, width=1, guc_id=1, guc_state=0x0, flags=0x3 xe_exec_queue_stop: dev=0000:00:02.0, 4:0x1, gt=1, width=1, guc_id=2, guc_state=0x0, flags=0x3 xe_exec_queue_resubmit: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=0, guc_state=0x0, flags=0x13 xe_sched_job_run: dev=0000:00:02.0, fence=0xffff888276cc8540, seqno=0, lrc_seqno=0, gt=0, guc_id=0, batch_addr=0x000000146910 ... ..... xe_exec_queue_memory_cat_error: dev=0000:00:02.0, 3:0x2, gt=0, width=1, guc_id=0, guc_state=0x3, flags=0x13 So the job_run() is clearly triggered twice for the same job, even though the first must have already signalled to completion during suspend. We can also see a CAT error after the re-submit. To prevent this only resubmit jobs on the pending_list that have not yet signalled. v2: - Make sure to re-arm the fence callbacks with sched_start(). v3 (Matt B): - Stop using drm_sched_resubmit_jobs(), which appears to be deprecated and just open-code a simple loop such that we skip calling run_job() on anything already signalled. Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4856 Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Auld Cc: Thomas Hellström Cc: Matthew Brost Cc: William Tseng Cc: # v6.8+ Reviewed-by: Matthew Brost Reviewed-by: Tejas Upadhyay Link: https://lore.kernel.org/r/20250528113328.289392-2-matthew.auld@intel.com commit 9d5558649f68e2e84a87a909631b30e15ca0f8ec Author: Thomas Hellström Date: Wed May 28 18:41:05 2025 +0200 drm/xe: Rework eviction rejection of bound external bos For preempt_fence mode VM's we're rejecting eviction of shared bos during VM_BIND. However, since we do this in the move() callback, we're getting an eviction failure warning from TTM. The TTM callback intended for these things is eviction_valuable(). However, the latter doesn't pass in the struct ttm_operation_ctx needed to determine whether the caller needs this. Instead, attach the needed information to the vm under the vm->resv, until we've been able to update TTM to provide the needed information. And add sufficient lockdep checks to prevent misuse and races. v2: - Fix a copy-paste error in xe_vm_clear_validating() v3: - Fix kerneldoc errors. Signed-off-by: Thomas Hellström Fixes: 0af944f0e308 ("drm/xe: Reject BO eviction if BO is bound to current VM") Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250528164105.234718-1-thomas.hellstrom@linux.intel.com commit e42a3c203c95cc6362d78aaff3c478695e6719aa Author: Cristian Ciocaltea Date: Tue May 27 15:11:27 2025 +0300 drm/tests: hdmi: Add test for unsuccessful fallback to YUV420 Provide test to verify a mandatory fallback to YUV420 output cannot succeed when driver doesn't advertise YUV420 support. Acked-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-19-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit e271ecaaa570d4c956ba079b0724aa5194c0b617 Author: Cristian Ciocaltea Date: Tue May 27 15:11:26 2025 +0300 drm/tests: hdmi: Add max TMDS rate fallback tests for YUV420 mode Provide tests to verify drm_atomic_helper_connector_hdmi_check() helper fallback behavior when using YUV420 output format. Acked-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-18-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 54a5f1c4d5f84af18a971c665df751ee3f0423dc Author: Cristian Ciocaltea Date: Tue May 27 15:11:25 2025 +0300 drm/tests: hdmi: Provide EDID supporting 4K@30Hz with RGB/YUV Create a test EDID advertising the following capabilities: Max resolution: 3840x2160@30Hz with RGB, YUV444, YUV422, YUV420 Max BPC: 16 for all modes Max TMDS clock: 340 MHz Acked-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-17-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit a3d1bfc174dc304d2166a3cca069882faa370658 Author: Cristian Ciocaltea Date: Tue May 27 15:11:24 2025 +0300 drm/tests: hdmi: Rename max TMDS rate fallback tests In preparation to extend the max TMDS rate fallback tests for covering YUV420 output, update the rather generic function names drm_test_check_max_tmds_rate_{bpc|format}_fallback() to properly indicate the intended test cases. Acked-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-16-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 8138078dc048c5160d59b55a33f618688b5fe74b Author: Cristian Ciocaltea Date: Tue May 27 15:11:23 2025 +0300 drm/tests: hdmi: Add limited range tests for YUV420 mode Provide tests to verify that drm_atomic_helper_connector_hdmi_check() helper behaviour when using YUV420 output format is to always set the limited RGB quantization range to 'limited', no matter what the value of Broadcast RGB property is. Acked-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-15-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 58fe1d78605e78e94341b89b98a47f1aca944441 Author: Cristian Ciocaltea Date: Tue May 27 15:11:22 2025 +0300 drm/tests: hdmi: Provide EDID supporting 4K@30Hz with YUV420 only Create a test EDID advertising the following capabilities: Max resolution: - 1920x1080@60Hz with RGB, YUV444, YUV422 - 3840x2160@30Hz with YUV420 only Max BPC: 16 for all modes Max TMDS clock: 200 MHz Acked-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-14-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 723d5a70d1de14b34fabcd98ba697de17fa251c4 Author: Cristian Ciocaltea Date: Tue May 27 15:11:21 2025 +0300 drm/tests: hdmi: Switch to drm_atomic_get_new_connector_state() where possible Replace the calls to drm_atomic_get_connector_state() with drm_atomic_get_new_connector_state() for cases which do not require allocating the connector state, e.g. after drm_atomic_check_only() when the intent is to only read the new connector state. The rational is to avoid the need to handle the potential EDEADLK error returned by the former helper, which would require restarting the entire atomic sequence. Acked-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-13-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 8deb5bd34858b0ac165d6a56e65a64bc5367e361 Author: Cristian Ciocaltea Date: Tue May 27 15:11:20 2025 +0300 drm/tests: hdmi: Setup ycbcr_420_allowed before initializing connector Initializing HDMI connector via drmm_connector_hdmi_init() requires its ->ycbcr_420_allowed flag to be adjusted according to the supported formats passed as function argument, prior to the actual invocation. In order to allow providing test coverage for YUV420 modes, ensure the flag is properly setup. Reviewed-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-12-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 95f0f68fc13d03a6b8c0ca09ca9fe4122e6e51ed Author: Cristian Ciocaltea Date: Tue May 27 15:11:19 2025 +0300 drm/tests: hdmi: Drop unused drm_kunit_helper_connector_hdmi_init_funcs() After updating the code to make use of the new EDID setup helper, drm_kunit_helper_connector_hdmi_init_funcs() became unused, hence drop it. Acked-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-11-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 74e98941b926a3ecc29d3098475a5a0940f2ada2 Author: Cristian Ciocaltea Date: Tue May 27 15:11:18 2025 +0300 drm/tests: hdmi: Replace open coded EDID setup Make use of the recently introduced macros to reduce boilerplate code around EDID setup. This also helps dropping the redundant calls to set_connector_edid(). No functional changes intended. Acked-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-10-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit a08fd207d60ecff74a5a4d09d1b1acda1f863a49 Author: Cristian Ciocaltea Date: Tue May 27 15:11:17 2025 +0300 drm/tests: hdmi: Add macro to simplify EDID setup Factor out the HDMI connector initialization from drm_kunit_helper_connector_hdmi_init_funcs() into a common __connector_hdmi_init() function, while extending its functionality to allow setting custom (i.e. non-default) EDID data. Introduce a macro as a wrapper over the new helper to allow dropping the open coded EDID setup from all test cases. The actual conversion will be handled separately; for now just apply it to drm_kunit_helper_connector_hdmi_init() helper. Reviewed-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-9-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 7ca78aa0d5411d62b672ef4f5266e9913ee07920 Author: Cristian Ciocaltea Date: Tue May 27 15:11:16 2025 +0300 drm/tests: hdmi: Switch to 'void *' type for EDID data Replace 'const char *' with 'const void *' type for current_edid member in struct drm_atomic_helper_connector_hdmi_priv, as well as for the edid parameter of set_connector_edid() function. Suggested-by: Jani Nikula Signed-off-by: Cristian Ciocaltea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-8-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 90642d9de4776ebb0403ef7d8e621def70ade1f2 Author: Cristian Ciocaltea Date: Tue May 27 15:11:15 2025 +0300 drm/tests: hdmi: Replace '[_]MHz' with 'mhz' Improve consistency throughout drm_hdmi_state_helper_test.c by replacing the two occurrences of '[_]MHz' substring with 'mhz'. As a bonus, this also helps getting rid of checkpatch.pl complaint: CHECK: Avoid CamelCase: Reviewed-by: Dmitry Baryshkov Signed-off-by: Cristian Ciocaltea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-7-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 04561845fcec5df1e03ed3525c0bd8cb896635f4 Author: Cristian Ciocaltea Date: Tue May 27 15:11:14 2025 +0300 drm/connector: hdmi: Use YUV420 output format as an RGB fallback Try to make use of YUV420 when computing the best output format and RGB cannot be supported for any of the available color depths. Signed-off-by: Cristian Ciocaltea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-6-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 4809299addb8c7d82a1d0917f0472c60ca07926a Author: Cristian Ciocaltea Date: Tue May 27 15:11:13 2025 +0300 drm/connector: hdmi: Factor out bpc and format computation logic In preparation to support fallback to an alternative output format, e.g. YUV420, when RGB cannot be used for any of the available color depths, move the bpc try loop out of hdmi_compute_config() and, instead, make it part of hdmi_compute_format(), while adding a new parameter to the latter holding the output format to be checked and eventually set. Since this helper now also changes hdmi.output_bpc in addition to hdmi.output_format, highlight the extended functionality by renaming it to hdmi_compute_format_bpc(). This improves code reusability and further extensibility, without introducing any functional changes. Reviewed-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-5-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit b01ea9acde62e405692270387dcaa4d5f1b30db0 Author: Cristian Ciocaltea Date: Tue May 27 15:11:12 2025 +0300 drm/connector: hdmi: Add missing bpc debug info to hdmi_try_format_bpc() The very first debug message in hdmi_try_format_bpc() is incomplete, as it doesn't provide the given bpc in addition to the tried format. Add the missing debug information and drop the now redundant message from hdmi_compute_config(). Reviewed-by: Dmitry Baryshkov Signed-off-by: Cristian Ciocaltea Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-4-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit a191077792773556671b14f88154636c2b28ee5f Author: Cristian Ciocaltea Date: Tue May 27 15:11:11 2025 +0300 drm/connector: hdmi: Improve debug message for supported format Add the missing 'bpc' string to the debug message indicating the supported format identified within hdmi_try_format_bpc() helper. Reviewed-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-3-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 85b0db87417eb66c41fd7c74979312fde9383315 Author: Cristian Ciocaltea Date: Tue May 27 15:11:10 2025 +0300 drm/connector: hdmi: Add support for YUV420 format verification Provide the necessary constraints verification in sink_supports_format_bpc() in order to support handling of YUV420 output format. Reviewed-by: Maxime Ripard Signed-off-by: Cristian Ciocaltea Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-2-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 21f627139652dd8329a88e281df6600f3866d238 Author: Cristian Ciocaltea Date: Tue May 27 15:11:09 2025 +0300 drm/connector: hdmi: Evaluate limited range after computing format Evaluating the requirement to use a limited RGB quantization range involves a verification of the output format, among others, but this is currently performed before actually computing the format, hence relying on the old connector state. Move the call to hdmi_is_limited_range() after hdmi_compute_config() to ensure the verification is done on the updated output format. Fixes: 027d43590649 ("drm/connector: hdmi: Add RGB Quantization Range to the connector state") Reviewed-by: Dmitry Baryshkov Signed-off-by: Cristian Ciocaltea Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250527-hdmi-conn-yuv-v5-1-74c9c4a8ac0c@collabora.com Signed-off-by: Maxime Ripard commit 54bd08e15b74c251f4b151987890a808cf54143d Author: Jernej Skrabec Date: Wed May 28 21:22:13 2025 +1200 drm: sun4i: de33: mixer: add mixer configuration for the H616 The H616 (and related SoC packages sharing the same die) carry the new DE33 display engine. Add the mixer configuration and a compatible string for the H616 to the mixer. Signed-off-by: Jernej Skrabec Signed-off-by: Ryan Walklin Acked-by: Maxime Ripard Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250528092431.28825-9-ryan@testtoast.com Signed-off-by: Maxime Ripard commit 9e623068f177187091ded170713f8dee3dcc1019 Author: Jernej Skrabec Date: Wed May 28 21:22:12 2025 +1200 drm: sun4i: de33: vi_scaler: add Display Engine 3.3 (DE33) support The vi_scaler appears to be used in preference to the ui_scaler module for hardware video scaling in the DE33. Enable support for this scaler. Signed-off-by: Jernej Skrabec Signed-off-by: Ryan Walklin Acked-by: Maxime Ripard Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250528092431.28825-8-ryan@testtoast.com Signed-off-by: Maxime Ripard commit 5b9cfdbfc328317ab11bf522ecea875606f22732 Author: Jernej Skrabec Date: Wed May 28 21:22:11 2025 +1200 drm: sun4i: de33: mixer: add Display Engine 3.3 (DE33) support The DE33 is a newer version of the Allwinner Display Engine IP block, found in the H616, H618, H700 and T507 SoCs. DE2 and DE3 are already supported by the mainline driver. Notable features (from the H616 datasheet and implemented): - 4096 x 2048 (4K) output support Other features (implemented but not in this patchset): - AFBC ARM Frame Buffer Compression support - YUV pipeline support The DE2 and DE3 engines have a blender register range within the mixer engine register map, whereas the DE33 separates this out into a separate display group, and adds a top register map. The DE33 also appears to remove the global double buffer control register, present in the DE2 and DE3. Extend the mixer to support the DE33. Signed-off-by: Jernej Skrabec Signed-off-by: Ryan Walklin Signed-off-by: Chris Morgan Acked-by: Maxime Ripard Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250528092431.28825-7-ryan@testtoast.com Signed-off-by: Maxime Ripard commit 18c4be55e2aa95f0de0ed79723de2c282e2a2924 Author: Ryan Walklin Date: Wed May 28 21:22:10 2025 +1200 dt-bindings: allwinner: add H616 DE33 mixer binding The Allwinner H616 and variants have a new display engine revision (DE33). The mixer configuration registers are significantly different to the DE3 and DE2 revisions, being split into separate top and display blocks, therefore a fallback for the mixer compatible is not provided. Note that the DE33 mixer requires 3 register blocks instead of 1. To keep things simple the maxItems value for registers is conditionally removed for the H616 and replaced with the block names from the vendor BSP kernel. Add a display engine mixer binding for the DE33. Signed-off-by: Ryan Walklin Acked-by: Conor Dooley Reviewed-by: Chen-Yu Tsai Signed-off-by: Chris Morgan Link: https://lore.kernel.org/r/20250528092431.28825-6-ryan@testtoast.com Signed-off-by: Maxime Ripard commit 5419143dd071daed58de0d349e8a0eac99fa0c29 Author: Jernej Skrabec Date: Wed May 28 21:22:09 2025 +1200 drm: sun4i: de2/de3: use generic register reference function for layer configuration Use the new blender register lookup function where required in the layer commit and update code. Signed-off-by: Jernej Skrabec Signed-off-by: Ryan Walklin Acked-by: Maxime Ripard Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250528092431.28825-5-ryan@testtoast.com Signed-off-by: Maxime Ripard commit ef54f1dc246b72bac4dd222bd57054ba740fa207 Author: Jernej Skrabec Date: Wed May 28 21:22:08 2025 +1200 drm: sun4i: de2/de3: add generic blender register reference function The DE2 and DE3 engines have a blender register range within the mixer engine register map, whereas the DE33 separates this out into a separate display group. Prepare for this by adding a function to look the blender reference up, with a subsequent patch to add a conditional based on the DE type. Signed-off-by: Jernej Skrabec Signed-off-by: Ryan Walklin Acked-by: Maxime Ripard Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250528092431.28825-4-ryan@testtoast.com Signed-off-by: Maxime Ripard commit a2817589441574e5f5e64b9b18776d84ccf16d08 Author: Jernej Skrabec Date: Wed May 28 21:22:07 2025 +1200 drm: sun4i: de2/de3: refactor mixer initialisation Now that the DE variant can be selected by enum, take the oppportunity to factor out some common initialisation code to a separate function. Signed-off-by: Jernej Skrabec Signed-off-by: Ryan Walklin Reviewed-by: Andre Przywara Acked-by: Maxime Ripard Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250528092431.28825-3-ryan@testtoast.com Signed-off-by: Maxime Ripard commit 81cf7c68794c4733fd9f8f2889c7596aa813e55d Author: Jernej Skrabec Date: Wed May 28 21:22:06 2025 +1200 drm: sun4i: de2/de3: add mixer version enum The Allwinner DE2 and DE3 display engine mixers are currently identified by a simple boolean flag. This will not scale to support additional DE variants. Convert the boolean flag to an enum. Signed-off-by: Jernej Skrabec Signed-off-by: Ryan Walklin Reviewed-by: Andre Przywara Acked-by: Maxime Ripard Reviewed-by: Chen-Yu Tsai Link: https://lore.kernel.org/r/20250528092431.28825-2-ryan@testtoast.com Signed-off-by: Maxime Ripard commit 6a509853fe9d58274cbad3f6ff103742352a4193 Author: Anusha Srivatsa Date: Thu May 29 21:46:48 2025 -0500 panel/lg-lb035q02: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-46-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit f27a5e66fbf22f0722a04c83f04a70a5fd3eac90 Author: Anusha Srivatsa Date: Thu May 29 21:46:47 2025 -0500 panel/panel-lvds: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-45-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 09d05ec42b9bc3c551cd159bd7f6047c5b60ce23 Author: Anusha Srivatsa Date: Thu May 29 21:46:46 2025 -0500 panel/nec-nl8048hl11: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-44-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 5220cbe3c8bf4ff44564ad057f4a262f5bc93cf4 Author: Anusha Srivatsa Date: Thu May 29 21:46:45 2025 -0500 panel/s6e88a0-ams452ef01: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-43-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit dcb5b3b776a900bc941c11898adc15f6e651a1b9 Author: Anusha Srivatsa Date: Thu May 29 21:46:44 2025 -0500 panel/xinpeng-xpp055c272: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-42-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 6f9bc3d071aa8c636c76d394135c0a14eddb61ca Author: Anusha Srivatsa Date: Thu May 29 21:46:43 2025 -0500 panel/widechips-ws2401: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-41-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 9d104921f6d004b9e5be00b7ef26b0d4bb2cd6c5 Author: Anusha Srivatsa Date: Thu May 29 21:46:42 2025 -0500 panel/visionox-vtdr6130: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-40-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 5eebde53123bd117d748f20703474ae057b26825 Author: Anusha Srivatsa Date: Thu May 29 21:46:41 2025 -0500 panel/visionox-rm692e5.c: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-39-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit b9c81ac16faced9c3d37dd775cb205b123a275ce Author: Anusha Srivatsa Date: Thu May 29 21:46:40 2025 -0500 panel/visionox-rm69299: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-38-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit bc946267c8055e571033051c4b11bf048abafe3a Author: Anusha Srivatsa Date: Thu May 29 21:46:39 2025 -0500 panel/visionox-r66451: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-37-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 84c9532ae2ad7aad4dbe612c002268ed81ca3701 Author: Anusha Srivatsa Date: Thu May 29 21:46:38 2025 -0500 panel/tpo-tpg110: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-36-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit e15e4ff477b6843650a0576e9159267bb20edd62 Author: Anusha Srivatsa Date: Thu May 29 21:46:37 2025 -0500 panel/tpo-td043mtea1: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-35-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit f6cefd33dafbe9c34e0c962aa4932385eb886a78 Author: Anusha Srivatsa Date: Thu May 29 21:46:36 2025 -0500 panel/tpo-td028ttec1: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-34-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 827337818c94c51c1d9966f33f460cd92c17dc2a Author: Anusha Srivatsa Date: Thu May 29 21:46:35 2025 -0500 panel/synaptics-r63353: allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-33-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 7bd1d88ca009cbd86f60a874323edd0a9de33e48 Author: Anusha Srivatsa Date: Thu May 29 21:46:34 2025 -0500 panel/panel-summit: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-32-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 064864d375693d6ef72942d4044c61284c5c0916 Author: Anusha Srivatsa Date: Thu May 29 21:46:33 2025 -0500 panel/truly-nt35521: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-31-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit d7c962373ebf46dacb992808b6a65904a397010a Author: Anusha Srivatsa Date: Thu May 29 21:46:32 2025 -0500 panel/sony-td4353-jdi: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-30-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit cd268f8fedb2a289463db75dfe73cbf2c0155b25 Author: Anusha Srivatsa Date: Thu May 29 21:46:31 2025 -0500 panel/sony-acx565akm: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-29-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 9176f33f174fb4e9ef8198e6989c8124a10c3ca3 Author: Anusha Srivatsa Date: Thu May 29 21:46:30 2025 -0500 panel/sitronix-st7789v: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-28-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 51562aa44cdfa974d336e1fe422abacbb2fb1855 Author: Anusha Srivatsa Date: Thu May 29 21:46:29 2025 -0500 panel/sitronix-st7703: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-27-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit e646a5d1f6d00012667dc8a55a3501010ff131dd Author: Anusha Srivatsa Date: Thu May 29 21:46:28 2025 -0500 panel/sitronix-st7701: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-26-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 066e3df8c818fe7c45267db2b2b790f67aaf2071 Author: Anusha Srivatsa Date: Thu May 29 21:46:27 2025 -0500 panel/sharp-ls060t1sx01: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-25-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit c32cd7f798af99415120b263154bb34d93df3432 Author: Anusha Srivatsa Date: Thu May 29 21:46:26 2025 -0500 panel/sharp-ls037v7dw01: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-24-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 18cb30e24b6c871f6ff56e62b78c7c6a2e35596b Author: Anusha Srivatsa Date: Thu May 29 21:46:25 2025 -0500 panel/seiko-43wvf1g: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-23-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 6196835a5460945027a5b03377e4be27ab1d8e3b Author: Anusha Srivatsa Date: Thu May 29 21:46:24 2025 -0500 panel/samsung-sofef00: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-22-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 904ec442116aa8dd0a0ec4e31079dfe04a09bd8c Author: Anusha Srivatsa Date: Thu May 29 21:46:23 2025 -0500 panel/samsung-s6e8aa0: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-21-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 3a21fd4c9065c3cb6f37f1419e36ea490aafd233 Author: Anusha Srivatsa Date: Thu May 29 21:46:22 2025 -0500 panel/s6e88a0-ams427ap24: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-20-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 5fafbb72ad2d93e6aad73f8b7fc86945db56bb68 Author: Anusha Srivatsa Date: Thu May 29 21:46:21 2025 -0500 panel/samsung-s6e63j0x03: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-19-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit a354881f858af09970199518450e0c2de14f8e50 Author: Anusha Srivatsa Date: Thu May 29 21:46:20 2025 -0500 panel/samsung-s6e3ha8: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-18-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit b4ef743b238e8a804b8678fd0d88f600e40d18b8 Author: Anusha Srivatsa Date: Thu May 29 21:46:19 2025 -0500 panel/samsung-s6e3ha2: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-17-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit ae83372bc79969c0dc14849145d3cb5acbcaaf74 Author: Anusha Srivatsa Date: Thu May 29 21:46:18 2025 -0500 panel/samsung-s6e3fa7: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-16-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit e741c9ffa22a60fa14d53b039d165a016fe43e43 Author: Anusha Srivatsa Date: Thu May 29 21:46:17 2025 -0500 panel/samsung-s6d7aa0: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-15-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 532d4c33db05ece6bbdd81f1b9c916114e41448a Author: Anusha Srivatsa Date: Thu May 29 21:46:16 2025 -0500 panel/samsung-s6d27a1: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-14-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit f76893223caf34dce753ec3d733ca25353aea9e8 Author: Anusha Srivatsa Date: Thu May 29 21:46:15 2025 -0500 panel/samsung-s6d16d0: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-13-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit bbd69884220cc427f462465dbe25d4ce394f7cbf Author: Anusha Srivatsa Date: Thu May 29 21:46:14 2025 -0500 panel/samsung-ld9040: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-12-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit f43a0ed02725d9ae233104b67271d5b53c29e381 Author: Anusha Srivatsa Date: Thu May 29 21:46:13 2025 -0500 panel/samsung-db7430: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-11-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit f2519a26cc9b5ce3ed81e382a324a98d36c6c05f Author: Anusha Srivatsa Date: Thu May 29 21:46:12 2025 -0500 panel/samsung-atna33xc20: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-10-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit cd8fc7e9292b41d162832cbcfe568cd9dd04ecd9 Author: Anusha Srivatsa Date: Thu May 29 21:46:11 2025 -0500 panel/samsung-ams639rq08: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-9-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 8ee4cf7378de569bb5c0b983d36e647df3a05daa Author: Anusha Srivatsa Date: Thu May 29 21:46:10 2025 -0500 panel/samsung-ams581vf01: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-8-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 11d53df468e41ad63953460c27c070ad482c794e Author: Anusha Srivatsa Date: Thu May 29 21:46:09 2025 -0500 panel/ronbo-rb070d30: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-7-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 065a75a40ba5bd268f82837f2b1199cc28984154 Author: Anusha Srivatsa Date: Thu May 29 21:46:08 2025 -0500 panel/raydium-rm69380: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-6-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 7a0c1de1f6122de5fec62183e7a26d2fe247f14e Author: Anusha Srivatsa Date: Thu May 29 21:46:07 2025 -0500 panel/raydium-rm692e5: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-5-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 20291d8faf9776ac43e7c253dc474530fe714394 Author: Anusha Srivatsa Date: Thu May 29 21:46:06 2025 -0500 panel/raydium-rm68200: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-4-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 8720c9b5ca94487781a0d9a7601dedd8d8d6ce27 Author: Anusha Srivatsa Date: Thu May 29 21:46:05 2025 -0500 panel/raydium-rm67200: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-3-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit a9f0786961e80462cc35c0d40a3c813b12accc54 Author: Anusha Srivatsa Date: Thu May 29 21:46:04 2025 -0500 panel/raydium-rm67191: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-2-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit a97dfd6543afa3b5a8dc3cd2c2165674b7149f81 Author: Anusha Srivatsa Date: Thu May 29 21:46:03 2025 -0500 panel/orisetech-otm8009a: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250529-b4-drm_panel_mass_driver_convert_part3-v2-1-5d75a3711e40@redhat.com Signed-off-by: Maxime Ripard commit 7dc284702bcd065a822a4c0bdbca09a08de5a654 Author: Matthias Schiffer Date: Mon May 19 22:46:28 2025 +0200 batman-adv: store hard_iface as iflink private data By passing the hard_iface to netdev_master_upper_dev_link() as private data, we can iterate over hardifs of a mesh interface more efficiently using netdev_for_each_lower_private*() (instead of iterating over the global hardif list). In addition, this will enable resolving a hardif from its netdev using netdev_lower_dev_get_private() and getting rid of the global list altogether in the following patches. A similar approach can be seen in the bonding driver. Signed-off-by: Matthias Schiffer Signed-off-by: Sven Eckelmann Signed-off-by: Simon Wunderlich commit 2b05db6b8a10df423d5478b20cadb1e190fa136f Author: Simon Wunderlich Date: Sat May 31 10:37:44 2025 +0200 batman-adv: Start new development cycle This version will contain all the (major or even only minor) changes for Linux 6.17. The version number isn't a semantic version number with major and minor information. It is just encoding the year of the expected publishing as Linux -rc1 and the number of published versions this year (starting at 0). Signed-off-by: Simon Wunderlich commit e4931f8be347ec5f19df4d6d33aea37145378c42 Author: Arnd Bergmann Date: Thu May 29 10:23:56 2025 -0700 drm/xe/vsec: fix CONFIG_INTEL_VSEC dependency The XE driver can be built with or without VSEC support, but fails to link as built-in if vsec is in a loadable module: x86_64-linux-ld: vmlinux.o: in function `xe_vsec_init': (.text+0x1e83e16): undefined reference to `intel_vsec_register' The normal fix for this is to add a 'depends on INTEL_VSEC || !INTEL_VSEC', forcing XE to be a loadable module as well, but that causes a circular dependency: symbol DRM_XE depends on INTEL_VSEC symbol INTEL_VSEC depends on X86_PLATFORM_DEVICES symbol X86_PLATFORM_DEVICES is selected by DRM_XE The problem here is selecting a symbol from another subsystem, so change that as well and rephrase the 'select' into the corresponding dependency. Since X86_PLATFORM_DEVICES is 'default y', there is no change to defconfig builds here. Fixes: 0c45e76fcc62 ("drm/xe/vsec: Support BMG devices") Signed-off-by: Arnd Bergmann Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250529172355.2395634-2-lucas.demarchi@intel.com Signed-off-by: Lucas De Marchi commit 61761a6b57f2818983466d24aab60baab471ba21 Author: Raag Jadav Date: Thu May 29 21:39:37 2025 +0530 drm/xe: drop redundant conversion to bool The result of integer comparison already evaluates to bool. No need for explicit conversion. No functional impact. Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202505292205.MoljmkjQ-lkp@intel.com/ Signed-off-by: Raag Jadav Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250529160937.490147-1-raag.jadav@intel.com Signed-off-by: Rodrigo Vivi commit 48a1126836cc3b7e63c31730dcd34df0d82176cd Author: Karthik Poosa Date: Thu May 29 22:04:58 2025 +0530 drm/xe/hwmon: Expose power sysfs entries based on firmware support Enable hwmon sysfs entries (power_xxx) only when GPU firmware supports it. Previously, these entries were created if the MMIO register was present. Now, we enable based on the data in the register. v2: Remove a unnecessary comment. (Rodrigo) Signed-off-by: Karthik Poosa Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250529163458.2354509-7-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi commit 0c5405d3aa4ad871837bb1261f4128de09680c83 Author: Karthik Poosa Date: Thu May 29 22:04:57 2025 +0530 drm/xe/hwmon: Read energy status from PMT Read card and package energy status using pmt apis instead of xe_mmio for supported platforms. Enable Battlemage to read energy from PMT. v2: - Remove unused has_pmt_energy field. (Badal) - Use GENMASK to extract energy data. (Badal) v3: - Move PMT energy register offset and GENMASK to xe_pmt.h - Address review comments. (Jani) v4: - Remove unnecessary debug print. (Badal) v5: - Resolve an unused variable warning. - Add a return value check. Signed-off-by: Karthik Poosa Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250529163458.2354509-6-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi commit 719d8a59595287557352893478f0c4e0df32b107 Author: Karthik Poosa Date: Thu May 29 22:04:56 2025 +0530 drm/xe/hwmon: Expose powerX_cap_interval Expose powerX_cap_interval to manage burst power limit time window. Signed-off-by: Karthik Poosa Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250529163458.2354509-5-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi commit c713b9a23c73f6ce9c0197369668f216ed0e04c9 Author: Karthik Poosa Date: Thu May 29 22:04:55 2025 +0530 drm/xe/hwmon: Add support to manage PL2 though mailbox Add support to manage power limit PL2 (burst limit) through pcode mailbox commands. v2: - Update power1_cap definition in hwmon documentation. (Badal) - Clamp PL2 power limit to GPU firmware default value. v3: - Activate the power label when either the PL1 or PL2 power limit is enabled. v4: - Update description of pl2_on_boot variable to fix kernel-doc error. v5: - Remove unnecessary drm_warn. - Rectify powerX_label permission to read-only on platforms without mailbox power limits support. - Expose powerX_cap entries only on platforms with mailbox support. v6: - Improve commit message, refer to BIOS as GPU firmware. - Refer to card firmware as GPU firmware in code. - Remove unnecessary drm_dbg. - Print supported and unsupported power limits. (Rodrigo) - Enable powerN_cap/max_xxx entries only when power limits supported in GPU firmware. Signed-off-by: Karthik Poosa Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250529163458.2354509-4-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi commit 25e963a09e059ffdb15c09cc79cfded855b43668 Author: Karthik Poosa Date: Thu May 29 22:04:54 2025 +0530 drm/xe/hwmon: Move card reactive critical power under channel card Move power2/curr2_crit to channel 1 i.e power1/curr1_crit as this represents the entire card critical power/current. v2: Update the date of curr1_crit also in hwmon documentation. Signed-off-by: Karthik Poosa Fixes: 345dadc4f68b ("drm/xe/hwmon: Add infra to support card power and energy attributes") Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250529163458.2354509-3-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi commit 7596d839f6228757fe17a810da2d1c5f3305078c Author: Karthik Poosa Date: Thu May 29 22:04:53 2025 +0530 drm/xe/hwmon: Add support to manage power limits though mailbox Add support to manage power limits using pcode mailbox commands for supported platforms. v2: - Address review comments. (Badal) - Use mailbox commands instead of registers to manage power limits for BMG. - Clamp the maximum power limit to GPU firmware default value. v3: - Clamp power limit in write also for platforms with mailbox support. v4: - Remove unnecessary debug prints. (Badal) v5: - Update description of variable pl1_on_boot to fix kernel-doc error. v6: - Improve commit message, refer to BIOS as GPU firmware. - Change macro READ_PL_FROM_BIOS to READ_PL_FROM_FW. - Rectify drm_warn to drm_info. Signed-off-by: Karthik Poosa Fixes: e90f7a58e659 ("drm/xe/hwmon: Add HWMON support for BMG") Reviewed-by: Badal Nilawar Link: https://lore.kernel.org/r/20250529163458.2354509-2-karthik.poosa@intel.com Signed-off-by: Rodrigo Vivi commit c11a50b170e725b1465bcc0c5645d49d44e146d4 Author: Jeff Hugo Date: Fri May 16 10:06:34 2025 -0600 accel/qaic: Add Reliability, Accessibility, Serviceability (RAS) AIC100 devices generates Reliability, Availability, Serviceability events via MHI QAIC_STATUS channel. Support such events and print a structured log with details of the events, and if the event describes an uncorrected error, reset the device to put it back into service. As these events may not all be reported via other mechanisms like AER, maintain counts of the number of errors observed for each type. Signed-off-by: Jeff Hugo Reviewed-by: Jacek Lawrynowicz Reviewed-by: Troy Hanson Reviewed-by: Maciej Falkowski Link: https://lore.kernel.org/r/20250516160634.1408309-1-jeff.hugo@oss.qualcomm.com commit d201a9797b39e580842613238c620a2a1694ceef Author: Jani Nikula Date: Tue May 27 14:48:54 2025 +0300 drm/i915: drop intel_dpio_phy.h include from VLV IOSF SB vlv_iosf_sb.c no longer depends on enum dpio_phy from intel_dpio_phy.h. Drop the include. Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250527114854.3687469-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit df1c3093aee3daee4d56a5cb8cdba75c1ef6962f Author: Thomas Zimmermann Date: Mon May 26 15:25:20 2025 +0200 drm/gem: Inline drm_gem_pin() into PRIME helpers Inline drm_gem_pin() into its only caller drm_gem_map_attach() and update the documentation in the callback's purpose. Do the equivalent for drm_gem_unpin(). Also add stricter error checking on the involved locking. The pin operation in the GEM object functions is a helper for PRIME-exported buffer objects. Having drm_gem_pin() gives the impression of a general-purpose interface, which is not the case. Removing it makes the pin callback a bit harder to misuse. v2: - clarify comment on pin callback (Dmitry) Signed-off-by: Thomas Zimmermann Reviewed-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20250526132634.531789-5-tzimmermann@suse.de commit 3c89f2d85c39506772c65f44b3013b111d23dafc Author: Thomas Zimmermann Date: Mon May 26 15:25:19 2025 +0200 drm/gem-vram: Un-export pin helpers There are no external callers of the gem-vram pin helpers. Hence unexport them. Signed-off-by: Thomas Zimmermann Reviewed-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20250526132634.531789-4-tzimmermann@suse.de commit fe19655b72f3494ff7c4083c1217bef528d424a5 Author: Thomas Zimmermann Date: Mon May 26 15:25:18 2025 +0200 drm/gem-vram: Do not set pin and unpin callbacks Gem-vram helpers do not support PRIME dma-buf sharing. So nothing will ever call pin/unpin on its buffer objects. Do not set these callbacks in struct drm_gem_object_funcs. v2: - fix typo in commit description Signed-off-by: Thomas Zimmermann Reviewed-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20250526132634.531789-3-tzimmermann@suse.de commit 62e1e11a4916cb7d6e6b5e18347e8cfae5e06e57 Author: Thomas Zimmermann Date: Mon May 26 15:25:17 2025 +0200 drm/client: Do not pin in drm_client_buffer_vmap() Pin and vmap are two distict operations. Do not mix them. The helper drm_client_buffer_vmap() maps the pages for fbdev-dma and fbdev-shmem. In both cases, the vmap operation ensures that the pages are available until the vunmap happens. And as the pages in DMA or SHMEM areas cannot be moved, there is no reason to call pin. Hence remove the pin call. Update drm_client_buffer_vunmap() accordingly. v2: - call 'locked' variants of GEM helpers (Dmitry) Signed-off-by: Thomas Zimmermann Reviewed-by: Boris Brezillon Reviewed-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20250526132634.531789-2-tzimmermann@suse.de commit 1a524e8b488eabd3cb3f32bc0e124f702c3a57ef Author: Matthew Brost Date: Thu May 29 09:43:38 2025 -0700 drm/xe: Do not warn on SVM migration failing because of 64k requirements On platforms which only support 64k VRAM pages, it is expected that 4k faults will not migrate. Do not warn on this, rather print a debug message. Signed-off-by: Matthew Brost Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250529164338.1745515-1-matthew.brost@intel.com commit f36a75aba1c3176d177964bca76f86a075d2943a Author: Jesus Narvaez Date: Wed May 28 16:05:51 2025 -0700 drm/i915/guc: Handle race condition where wakeref count drops below 0 There is a rare race condition when preparing for a reset where guc_lrc_desc_unpin() could be in the process of deregistering a context while a different thread is scrubbing outstanding contexts and it alters the context state and does a wakeref put. Then, if there is a failure with deregister_context(), a second wakeref put could occur. As a result the wakeref count could drop below 0 and fail an INTEL_WAKEREF_BUG_ON() check. Therefore if there is a failure with deregister_context(), undo the context state changes and do a wakeref put only if the context was set to be destroyed earlier. v2: Expand comment to better explain change. (Daniele) v3: Removed addition to the original comment. (Daniele) Fixes: 2f2cc53b5fe7 ("drm/i915/guc: Close deregister-context race against CT-loss") Signed-off-by: Jesus Narvaez Cc: Daniele Ceraolo Spurio Cc: Alan Previn Cc: Anshuman Gupta Cc: Mousumi Jana Cc: Rodrigo Vivi Cc: Matt Roper Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250528230551.1855177-1-jesus.narvaez@intel.com commit 241cc827c0987d7173714fc5a95a7c8fc9bf15c0 Author: Balasubramani Vivekanandan Date: Tue May 20 19:54:45 2025 +0530 drm/xe/mocs: Initialize MOCS index early MOCS uc_index is used even before it is initialized in the following callstack guc_prepare_xfer() __xe_guc_upload() xe_guc_min_load_for_hwconfig() xe_uc_init_hwconfig() xe_gt_init_hwconfig() Do MOCS index initialization earlier in the device probe. Signed-off-by: Balasubramani Vivekanandan Reviewed-by: Ravi Kumar Vodapalli Link: https://lore.kernel.org/r/20250520142445.2792824-1-balasubramani.vivekanandan@intel.com Signed-off-by: Matt Roper commit fbeaad071a98fef87deccee81d564de1c8e8e16d Author: Niranjana Vishwanathapura Date: Wed May 28 22:20:32 2025 -0700 drm/xe: Create LRC BO without VM Specifying VM during lrc->bo creation requires VM's reference to be held for the lifetime of lrc->bo as it will use VM's dma reservation object. Using VM's dma reservation object for lrc->bo doesn't provide any advantage. Hence do not pass VM while creating lrc->bo. v2: Use xe_bo_unpin_map_no_vm (Matthew Brost) Fixes: 264eecdba211 ("drm/xe: Decouple xe_exec_queue and xe_lrc") Signed-off-by: Niranjana Vishwanathapura Reviewed-by: Matthew Brost Reviewed-by: Maarten Lankhorst Signed-off-by: Matthew Brost Link: https://lore.kernel.org/r/20250529052031.2429120-2-niranjana.vishwanathapura@intel.com commit 2271e0a20ef795838527815e057f5af206b69c87 Author: Robert Mader Date: Fri May 9 15:35:35 2025 +0200 drm: drm_fourcc: add 10/12/16bit software decoder YCbCr formats This adds FOURCCs for 3-plane 10/12/16bit YCbCr formats used by software decoders like ffmpeg, dav1d and libvpx. The intended use-case is buffer sharing between decoders and GPUs by allocating buffers with e.g. udmabuf or dma-heaps, avoiding unnecessary copies and format conversions in various scenarios. Unlike formats typically used by hardware decoders the 10/12bit formats use a LSB alignment. In order to allow fast implementations in GL and Vulkan the padding must contain only zeros, so the float representation can be calculated by multiplying with 2^6=64 or 2^4=16 respectively. MRs or branches for Mesa, Vulkan, Gstreamer, Weston and Mutter can be found at: - https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/34303 - https://github.com/rmader/Vulkan-Docs/commits/ycbcr-16bit-lsb-formats/ - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8540 - https://gitlab.freedesktop.org/wayland/weston/-/merge_requests/1753 - https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/4348 The naming scheme follows the 'P' and 'Q' formats. The 'S' stands for 'software' and was selected in order to make remembering easy. The 'Sx16' formats could as well be 'Qx16'. We stick with 'S' as 16bit software decoders are likely much more common than hardware ones for the foreseeable future. Note that these formats already have Vulkan equivalents: - VK_FORMAT_G16_B16_R16_3PLANE_420_UNORM - VK_FORMAT_G16_B16_R16_3PLANE_422_UNORM - VK_FORMAT_G16_B16_R16_3PLANE_444_UNORM Signed-off-by: Robert Mader Reviewed-by: Daniel Stone Link: https://lore.kernel.org/r/20250509133535.60330-1-robert.mader@collabora.com Signed-off-by: Daniel Stone commit 4f296d77cf49fcb5f90b4674123ad7f3a0676165 Author: Matthew Auld Date: Wed May 14 16:24:26 2025 +0100 drm/xe/vm: move xe_svm_init() earlier In xe_vm_close_and_put() we need to be able to call xe_svm_fini(), however during vm creation we can call this on the error path, before having actually initialised the svm state, leading to various splats followed by a fatal NPD. Fixes: 6fd979c2f331 ("drm/xe: Add SVM init / close / fini to faulting VMs") Link: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4967 Signed-off-by: Matthew Auld Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250514152424.149591-4-matthew.auld@intel.com commit 96af397aa1a2d1032a6e28ff3f4bc0ab4be40e1d Author: Matthew Auld Date: Wed May 14 16:24:25 2025 +0100 drm/xe/vm: move rebind_work init earlier In xe_vm_close_and_put() we need to be able to call flush_work(rebind_work), however during vm creation we can call this on the error path, before having actually set up the worker, leading to a splat from flush_work(). It looks like we can simply move the worker init step earlier to fix this. Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Signed-off-by: Matthew Auld Cc: Matthew Brost Cc: # v6.8+ Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250514152424.149591-3-matthew.auld@intel.com commit 338ec84deefdaf8e479455ee7d55434571799cf0 Author: Matthew Auld Date: Fri May 16 16:38:11 2025 +0100 drm/xe/bo: optimise CCS case for WB pages Dealing with CCS state is significant on LNL+, where we end up clearing the compression state on every page alloc using the blitter for user buffers, including also saving and restoring it when moving between domains, plus we need to alloc extra pages to hold the raw CCS state for the save step. However all compression PAT modes, on platforms like LNL, also require coh_none, meaning that only WC memory can use compression in the first place. With this we can be sneaky and completely ignore CCS for WB buffers, which is likely the common case anyway. This would then skip all blitter moves/clears between sys <-> tt and then also means we can drop the extra CCS pages. This should be safe since there is no way to interact with the compression state (potentially uncleared) without using a PAT enabled index (which is rejected at bind), including if trying to be malicious and copy the raw CCS state from userpace, which should give back all zeroes if the src surface (indirect) is lacking compressed PAT index. Signed-off-by: Matthew Auld Cc: Satyanarayana K V P Cc: Thomas Hellström Cc: Matthew Brost Reviewed-by: José Roberto de Souza Reviewed-by: Satyanarayana K V P Link: https://lore.kernel.org/r/20250516153810.223530-2-matthew.auld@intel.com commit 9856a688e4bcb753f89479642a5ea57ccc64a8ff Author: Jouni Högander Date: Mon May 26 15:05:12 2025 +0300 drm/i915/psr: Do not disable Panel Replay in case VRR is enabled Allow Panel Replay with VRR. All VRR modes are supposed to work with Panel Replay. Bspec: 68920, 68925 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-13-jouni.hogander@intel.com commit 8097128a40ff378761034ec72cdbf6f46e466dc0 Author: Jouni Högander Date: Mon May 26 15:05:11 2025 +0300 drm/i915/psr: Fix using wrong mask in REG_FIELD_PREP Wrong mask is used in PORT_ALPM_LFPS_CTL_FIRST_LFPS_HALF_CYCLE_DURATION and PORT_ALPM_LFPS_CTL_LAST_LFPS_HALF_CYCLE_DURATION. Fixes: 295099580f04 ("drm/i915/psr: Add missing ALPM AUX-Less register definitions") Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-12-jouni.hogander@intel.com commit 9dc619680de4ae04930e8a0df8b5c37d280a1b25 Author: Jouni Högander Date: Mon May 26 15:05:10 2025 +0300 drm/i915/display: Add function to configure LFPS sending Add function to configre LFPS sending for Panel Replay according to link training sequence in HAS document. This assumes we are using AUX Less always if it's supported by the sink and the source. v2: - drop HAS reference - replay kerneldoc comment with a generic comment - check display version in intel_lnl_mac_transmit_lfps Bspec: 68849 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-11-jouni.hogander@intel.com commit 7acc76a37e5d5743102784be82e6ae6dd784043c Author: Jouni Högander Date: Mon May 26 15:05:09 2025 +0300 drm/i915/display: Add PHY_CMN1_CONTROL register definitions Add PHY_CMN1_CONTROL register and its definitions to configure port LFPS sending. Bspec: 68962 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-10-jouni.hogander@intel.com commit 6ecb8e586f8339657211e12fcba7f77bae297fdd Author: Jouni Högander Date: Mon May 26 15:05:08 2025 +0300 drm/i915/alpm: Move port alpm configuration It is specified in Bspec where port alpm configuration is supposed to be performed. Change accordingly. v2: - drop HAS reference - ensure PORT_ALPM registers are not writen on older platform Bspec: 68849 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-9-jouni.hogander@intel.com commit 5d9d4feb33b7d509f8e6f5558381e1e8a3304134 Author: Jouni Högander Date: Mon May 26 15:05:07 2025 +0300 drm/i915/alpm: Add new interface to check if AUXLess ALPM is used we need to know if AUXLess ALPM is used when preparing for link training. Add new interface for this and use it in existing code where possible. v2: remove kerneldoc comment Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-8-jouni.hogander@intel.com commit e6503d10cab72ffc4419af76ad96aa10fbea08cb Author: Jouni Högander Date: Mon May 26 15:05:06 2025 +0300 drm/i915/psr: Add interface to check if AUXLess ALPM is needed by PSR Currently we spread ugly PSR details into ALPM code to check if AUXLess ALPM is needed. Prepare to hide these details to PSR code by adding new interface for checking if AUXLess ALPM is needed. v2: remove kerneldoc comment Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-7-jouni.hogander@intel.com commit d6a8336c5f06b4fc065963cfcf1ff4fe52640979 Author: Jouni Högander Date: Mon May 26 15:05:05 2025 +0300 drm/i915/alpm: Write PR_ALPM_CTL register PR_ALPM_CTL register contains configurations related to Adaptive sync sdp. Configure these if Adaptive Sync SDP is supported. v2: avoid using hardcoded indices Bspec: 71014 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-6-jouni.hogander@intel.com commit 91a2cd6236f394a1abf566db6fdee2e6884b2182 Author: Jouni Högander Date: Mon May 26 15:05:04 2025 +0300 drm/i915/alpm: Add PR_ALPM_CTL register definitions Add PR_ALPM_CTL register definition and bits for it. Bspec: 71014 Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-5-jouni.hogander@intel.com commit deb8d0fe88a71c53b2f3db3a17bd459ff436bbb0 Author: Jouni Högander Date: Mon May 26 15:05:03 2025 +0300 drm/i915/psr: Read all Panel Replay capability registers from DPCD There are several Panel Replay capability register in DPCD. Read them all for later use. v2: - avoid using hardcoded indices - read all Panel Replay capability registers Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Link: https://lore.kernel.org/r/20250526120512.1702815-4-jouni.hogander@intel.com commit 3e61b092e61d8f7f0b882f07ede9a0a553197e21 Author: Jouni Högander Date: Mon May 26 15:05:02 2025 +0300 drm/dp: Add Panel Replay capability bits from DP2.1 specification Add PANEL REPLAY CAPABILITY register (0xb1) bits. v3: - added DP_DSC_DECODE_CAPABILITY definitions - use defined shift instead of hardcoded value v2: comment about DP2.1 changed as DP2.1a Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Acked-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250526120512.1702815-3-jouni.hogander@intel.com commit 07cc32ecc6f393f416589f90f30542bfa7a9891d Author: Jouni Högander Date: Mon May 26 15:05:01 2025 +0300 drm/panelreplay: Panel Replay capability DPCD register definitions Add new definition for size of Panel Replay DPCD capability registers area. Rename existing definitions to group capability registers together. Signed-off-by: Jouni Högander Reviewed-by: Ankit Nautiyal Acked-by: Maarten Lankhorst Link: https://lore.kernel.org/r/20250526120512.1702815-2-jouni.hogander@intel.com commit 33a46dab18c92da612778b115a600578fa4d42e1 Author: Lucas De Marchi Date: Wed May 28 14:42:22 2025 -0700 drm/xe: Fix NPD when saving default context xef is only valid if it's a job from userspace. For in-kernel jobs it causes a NPD like below: <4> [] RIP: 0010:xe_sched_job_create+0xbd/0x390 [xe] ... <4> [] Call Trace: <4> [] <4> [] __xe_bb_create_job+0xa2/0x240 [xe] <4> [] ? find_held_lock+0x31/0x90 <4> [] ? xa_find_after+0x12c/0x250 <4> [] xe_bb_create_job+0x6e/0x380 [xe] <4> [] ? xa_find_after+0x136/0x250 <4> [] ? __drm_dev_dbg+0x7d/0xb0 <4> [] xe_gt_record_default_lrcs+0x542/0xb00 [xe] Since drm_file starts with 1 for the unique id, just use 0 for the in-kernel jobs. Fixes: 2956554823ce ("drm/sched: Store the drm client_id in drm_sched_fence") Cc: Christian König Cc: Pierre-Eric Pelloux-Prayer Cc: Philipp Stanner Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250528-fix-sched-v1-1-c042ef23ff8b@intel.com Signed-off-by: Lucas De Marchi commit a6a26786f22a4ab0227bcf610510c4c9c2df0808 Author: Jesus Narvaez Date: Wed May 14 15:52:24 2025 -0700 drm/i915/guc: Check if expecting reply before decrementing outstanding_submission_g2h When sending a H2G message where a reply is expected in guc_submission_send_busy_loop(), outstanding_submission_g2h is incremented before the send. However, if there is an error sending the message, outstanding_submission_g2h is decremented without checking if a reply is expected. Therefore, check if reply is expected when there is a failure before decrementing outstanding_submission_g2h. Fixes: 2f2cc53b5fe7 ("drm/i915/guc: Close deregister-context race against CT-loss") Signed-off-by: Jesus Narvaez Cc: Daniele Ceraolo Spurio Cc: Alan Previn Cc: Anshuman Gupta Cc: Mousumi Jana Cc: Rodrigo Vivi Cc: Matt Roper Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: John Harrison Link: https://lore.kernel.org/r/20250514225224.4142684-1-jesus.narvaez@intel.com commit 2cb38bb0add9b81f89ccdb2db88af89e99925880 Author: Michal Wajdeczko Date: Mon May 19 22:09:14 2025 +0200 drm/xe: Allow to trigger GT resets using debugfs writes Today we allow to trigger GT resest by reading dedicated debugfs files "force_reset" and "force_reset_sync" that we are exposing using drm_info_list[] and drm_debugfs_create_files(). To avoid triggering potentially disruptive actions during otherwise "safe" read operations, expose those two attributes using debugfs function where we can specify file permissions and provide custom "write" handler to trigger the GT resets also from there. This step would allow us to drop triggering GT resets during read operations, which we leave just to give users more time to switch. Signed-off-by: Michal Wajdeczko Cc: Lucas De Marchi Cc: Rodrigo Vivi Reviewed-by: Rodrigo Vivi Link: https://lore.kernel.org/r/20250519200914.216-1-michal.wajdeczko@intel.com commit ef818481d9fbaf3483dde0d1faa565a016810de3 Author: Louis Chauvet Date: Tue Apr 15 15:55:39 2025 +0200 drm/vkms: Add support for DRM_FORMAT_R* This add the support for: - R1/R2/R4/R8 R1 format was tested with [1] and [2]. [1]: https://lore.kernel.org/r/20240313-new_rotation-v2-0-6230fd5cae59@bootlin.com [2]: https://lore.kernel.org/igt-dev/20240306-b4-kms_tests-v1-0-8fe451efd2ac@bootlin.com/ Reviewed-by: Pekka Paalanen Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250415-yuv-v18-8-f2918f71ec4b@bootlin.com Signed-off-by: Louis Chauvet commit c59176cbca1188b906a36f06004a98a6264a8008 Author: Arthur Grillo Date: Tue Apr 15 15:55:38 2025 +0200 drm/vkms: Add how to run the Kunit tests Now that we have KUnit tests, add instructions on how to run them. Signed-off-by: Arthur Grillo Reviewed-by: José Expósito Acked-by: Pekka Paalanen Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250415-yuv-v18-7-f2918f71ec4b@bootlin.com Signed-off-by: Louis Chauvet commit 3e897853debde269ab01f0d3d28c3e7b37bf2c39 Author: Arthur Grillo Date: Tue Apr 15 15:55:37 2025 +0200 drm/vkms: Create KUnit tests for YUV conversions Create KUnit tests to test the conversion between YUV and RGB. Test each conversion and range combination with some common colors. The code used to compute the expected result can be found in comment. [Louis Chauvet: - fix minor formating issues (whitespace, double line) - change expected alpha from 0x0000 to 0xffff - adapt to the new get_conversion_matrix usage - apply the changes from Arthur - move struct pixel_yuv_u8 to the test itself] Signed-off-by: Arthur Grillo Acked-by: Pekka Paalanen Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250415-yuv-v18-6-f2918f71ec4b@bootlin.com Signed-off-by: Louis Chauvet commit 11d435b81e5dd2cc48daa2d3d71a19bcbc46e807 Author: Louis Chauvet Date: Tue Apr 15 15:55:36 2025 +0200 drm: Export symbols to use in tests The functions drm_get_color_encoding_name and drm_get_color_range_name are useful for clarifying test results. Therefore, export them so they can be used in tests built as modules. Reviewed-by: José Expósito Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250415-yuv-v18-5-f2918f71ec4b@bootlin.com Signed-off-by: Louis Chauvet commit f776e5cef757927b038a9c07c0c68f34d35f7787 Author: Arthur Grillo Date: Tue Apr 15 15:55:35 2025 +0200 drm/vkms: Drop YUV formats TODO VKMS has support for YUV formats now. Remove the task from the TODO list. Signed-off-by: Arthur Grillo Acked-by: Pekka Paalanen Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250415-yuv-v18-4-f2918f71ec4b@bootlin.com Signed-off-by: Louis Chauvet commit 81dbec07197678fc2d86f1494dfaf44023864842 Author: Arthur Grillo Date: Tue Apr 15 15:55:34 2025 +0200 drm/vkms: Add range and encoding properties to the plane Now that the driver internally handles these quantization ranges and YUV encoding matrices, expose the UAPI for setting them. Signed-off-by: Arthur Grillo [Louis Chauvet: retained only relevant parts, updated the commit message] Acked-by: Pekka Paalanen Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250415-yuv-v18-3-f2918f71ec4b@bootlin.com Signed-off-by: Louis Chauvet commit fe22d21e93426294eb0ebdb0bf5f6d6b77481ecc Author: Arthur Grillo Date: Tue Apr 15 15:55:33 2025 +0200 drm/vkms: Add YUV support Add support to the YUV formats bellow: - NV12/NV16/NV24 - NV21/NV61/NV42 - YUV420/YUV422/YUV444 - YVU420/YVU422/YVU444 The conversion from yuv to rgb is done with fixed-point arithmetic, using 32.32 fixed-point numbers and the drm_fixed helpers. To do the conversion, a specific matrix must be used for each color range (DRM_COLOR_*_RANGE) and encoding (DRM_COLOR_*). This matrix is stored in the `conversion_matrix` struct, along with the specific y_offset needed. This matrix is queried only once, in `vkms_plane_atomic_update` and stored in a `vkms_plane_state`. Those conversion matrices of each encoding and range were obtained by rounding the values of the original conversion matrices multiplied by 2^32. This is done to avoid the use of floating point operations. The same reading function is used for YUV and YVU formats. As the only difference between those two category of formats is the order of field, a simple swap in conversion matrix columns allows using the same function. [Louis Chauvet: - Adapted Arthur's work - Implemented the read_line_t callbacks for yuv - add struct conversion_matrix - store the whole conversion_matrix in the plane state - remove struct pixel_yuv_u8 - update the commit message - Merge the modifications from Arthur] Signed-off-by: Arthur Grillo Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250415-yuv-v18-2-f2918f71ec4b@bootlin.com Signed-off-by: Louis Chauvet commit c76e2c78bc2a35ca04eead275f14b6d23ae9a89f Author: Louis Chauvet Date: Tue Apr 15 15:55:32 2025 +0200 drm/vkms: Document pixel_argb_u16 The meaning of each member of the structure was not specified. To clarify the format used and the reason behind those choices, add some documentation. Reviewed-by: Pekka Paalanen Link: https://lore.kernel.org/r/20250415-yuv-v18-1-f2918f71ec4b@bootlin.com Signed-off-by: Louis Chauvet commit 6c8e8a1c4371ef680b4b55e32854a322ca9ef216 Author: Pierre-Eric Pelloux-Prayer Date: Mon May 26 14:54:52 2025 +0200 drm/amdgpu: update trace format to match gpu_scheduler_trace Log fences using the same format for coherency. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Reviewed-by: Arvind Yadav Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250526125505.2360-11-pierre-eric.pelloux-prayer@amd.com commit 1780e94a0c4289bdeaf7880500149484f4187d37 Author: Pierre-Eric Pelloux-Prayer Date: Mon May 26 14:54:51 2025 +0200 drm/doc: Document some tracepoints as uAPI This commit adds a document section in drm-uapi.rst about tracepoints, and mark the events gpu_scheduler_trace.h as stable uAPI. The goal is to explicitly state that tools can rely on the fields, formats and semantics of these events. Acked-by: Lucas Stach Acked-by: Maíra Canal Reviewed-by: Christian König Signed-off-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250526125505.2360-10-pierre-eric.pelloux-prayer@amd.com commit 4f7fa5fa414cc2990afbdffc0333f7c7ba3756b1 Author: Pierre-Eric Pelloux-Prayer Date: Mon May 26 14:54:50 2025 +0200 drm: Get rid of drm_sched_job.id Its only purpose was for trace events, but jobs can already be uniquely identified using their fence. The downside of using the fence is that it's only available after 'drm_sched_job_arm' was called which is true for all trace events that used job.id so they can safely switch to using it. Suggested-by: Tvrtko Ursulin Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Christian König Reviewed-by: Arvind Yadav Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250526125505.2360-9-pierre-eric.pelloux-prayer@amd.com commit f6743e6a00fda5d7238fb73807a7aa325a5c2d2c Author: Pierre-Eric Pelloux-Prayer Date: Mon May 26 14:54:49 2025 +0200 drm/sched: Cleanup event names All events now start with the same prefix (drm_sched_job_). drm_sched_job_wait_dep was misleading because it wasn't waiting at all. It's now replaced by trace_drm_sched_job_unschedulable, which is only traced if the job cannot be scheduled. For moot dependencies, nothing is traced. Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250526125505.2360-8-pierre-eric.pelloux-prayer@amd.com commit fbf11ce526266f8cdd2afe1f94229049d17927dc Author: Pierre-Eric Pelloux-Prayer Date: Mon May 26 14:54:48 2025 +0200 drm/sched: Add the drm_client_id to the drm_sched_run/exec_job events For processes with multiple drm_file instances, the drm_client_id is the only way to map jobs back to their unique owner. It's even more useful if drm client_name is set, because now a tool can map jobs to the client name instead of only having access to the process name. Reviewed-by: Christian König Acked-by: Philipp Stanner Signed-off-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250526125505.2360-7-pierre-eric.pelloux-prayer@amd.com commit 76d97c870f291e690037c3e82ab67d343702b14c Author: Pierre-Eric Pelloux-Prayer Date: Mon May 26 14:54:47 2025 +0200 drm/sched: Trace dependencies for GPU jobs We can't trace dependencies from drm_sched_job_add_dependency because when it's called the job's fence is not available yet. So instead each dependency is traced individually when drm_sched_entity_push_job is used. Tracing the dependencies allows tools to analyze the dependencies between the jobs (previously it was only possible for fences traced by drm_sched_job_wait_dep). Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250526125505.2360-6-pierre-eric.pelloux-prayer@amd.com commit 8a98df70062bd66b76a5620fbe59437622e284ea Author: Pierre-Eric Pelloux-Prayer Date: Mon May 26 14:54:46 2025 +0200 drm/sched: Cleanup gpu_scheduler trace events A fence uniquely identify a job, so this commits updates the places where a kernel pointer was used as an identifier by: "fence=%llu:%llu" Signed-off-by: Pierre-Eric Pelloux-Prayer Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250526125505.2360-5-pierre-eric.pelloux-prayer@amd.com commit d6b7b46232b78510a12e351b738f493021edf8c3 Author: Pierre-Eric Pelloux-Prayer Date: Mon May 26 14:54:45 2025 +0200 drm/sched: Add device name to the drm_sched_process_job event Since switching the scheduler from using kthreads to workqueues in commit a6149f039369 ("drm/sched: Convert drm scheduler to use a work queue rather than kthread") userspace applications cannot determine the device from the PID of the threads sending the trace events anymore. Each queue had its own kthread which had a given PID for the whole time. So, at least for amdgpu, it was possible to associate a PID to the hardware queues of each GPU in the system. Then, when a drm_run_job trace event was received by userspace, the source PID allowed to associate it back to the correct GPU. With workqueues this is not possible anymore, so the event needs to contain the dev_name() to identify the device. Reviewed-by: Christian König Signed-off-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250526125505.2360-4-pierre-eric.pelloux-prayer@amd.com commit 2956554823cedb390b7ec4534afa898176317638 Author: Pierre-Eric Pelloux-Prayer Date: Mon May 26 14:54:44 2025 +0200 drm/sched: Store the drm client_id in drm_sched_fence This will be used in a later commit to trace the drm client_id in some of the gpu_scheduler trace events. This requires changing all the users of drm_sched_job_init to add an extra parameter. The newly added drm_client_id field in the drm_sched_fence is a bit of a duplicate of the owner one. One suggestion I received was to merge those 2 fields - this can't be done right now as amdgpu uses some special values (AMDGPU_FENCE_OWNER_*) that can't really be translated into a client id. Christian is working on getting rid of those; when it's done we should be able to squash owner/drm_client_id together. Reviewed-by: Christian König Signed-off-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250526125505.2360-3-pierre-eric.pelloux-prayer@amd.com commit 18c44fb647beb53d5c9dcd926d733bf931fbfca8 Author: Pierre-Eric Pelloux-Prayer Date: Mon May 26 14:54:43 2025 +0200 drm/debugfs: Output client_id in in drm_clients_info client_id is a unique id used by fdinfo. Having it listed in 'clients' output means a userspace application can correlate the fields, eg: given a fdinfo id get the fdinfo name. Geiven that client_id is a uint64_t, we use a %20llu printf format to keep the output aligned (20 = digit count of the biggest uint64_t). Reviewed-by: Christian König Signed-off-by: Pierre-Eric Pelloux-Prayer Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250526125505.2360-2-pierre-eric.pelloux-prayer@amd.com commit 6e76b312a681224881c05835ed5a26e012ce80ea Author: Tommaso Merciai Date: Wed May 28 09:04:38 2025 +0200 drm/bridge: adv7511: Rename adv7511_dsi_config_timing_gen() into adv7533_dsi_config_timing_gen() To preserve the drivers naming convention rename adv7511_dsi_config_timing_gen() into adv7533_dsi_config_timing_gen() Signed-off-by: Tommaso Merciai Reviewed-by: Biju Das Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250528070452.901183-3-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Dmitry Baryshkov commit 1f5090c4ae71d070aa9dac49b8ef3efe0da0fb36 Author: Tommaso Merciai Date: Wed May 28 09:04:37 2025 +0200 drm/bridge: adv7511: Move adv711_dsi_config_timing_gen() into adv7511_mode_set() adv7511_mode_set() currently updates only the sync registers of the ADV bridge. At the end, drm_mode_copy() updates the current mode, but the horizontal and vertical porch registers of the ADV bridge still retain values from the old mode. Move adv7511_dsi_config_timing_gen() into adv7511_mode_set() to ensure the horizontal and vertical porch registers are correctly updated. Fixes: ae01d3183d2763ed ("drm/bridge: adv7511: switch to the HDMI connector helpers") Reported-by: Biju Das Closes: https://lore.kernel.org/all/aDB8bD6cF7qiSpKd@tom-desktop/ Signed-off-by: Tommaso Merciai Reviewed-by: Biju Das Tested-by: Biju Das Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250528070452.901183-2-tommaso.merciai.xr@bp.renesas.com Signed-off-by: Dmitry Baryshkov commit 7ce53db1ff02062ba2b5808f41fa61ef2706f83b Author: Ville Syrjälä Date: Tue May 13 12:28:20 2025 +0300 drm/i915: Indicate which pipe lied about its interrupts Indicate which pipe signalled the spurious DE PIPE interrupt. Might help with debugging a bit if we know where the interrupt is supposedly coming from. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250513092820.18715-1-ville.syrjala@linux.intel.com Reviewed-by: Jani Nikula commit 22eba3be8e1dc27de4aec3374bc9018dc8713670 Author: Himal Prasad Ghimiray Date: Mon May 26 22:09:07 2025 +0530 drm/xe/svm: Avoid duplicate eviction on get_pages() failure xe_svm_range_get_pages() already calls drm_gpusvm_range_evict() internally when it fails with -EOPNOTSUPP. Remove the eviction call in the caller to prevent duplicate handling. Fixes: e0ff0d7cf928 ("drm/xe/svm: Refactor usage of drm_gpusvm* function in xe_svm") Cc: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250526163907.1011529-1-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit bbfd5594756011167b8f8de9a00e0c946afda1e6 Merge: d2dc30e0aa2528 f8bb3ed3197966 Author: Joonas Lahtinen Date: Wed May 28 10:20:17 2025 +0300 Merge drm/drm-next into drm-intel-gt-next Need to pull in a67221b5eb8d ("drm/i915/dp: Return min bpc supported by source instead of 0") in order to fix build breakage on GCC 9.4.0 (from Ubuntu 20.04). Signed-off-by: Joonas Lahtinen commit 39578fa40420fb11dbe4f42225a347e945d8fd0e Author: Rodrigo Vivi Date: Wed May 21 12:51:48 2025 -0400 drm/xe: Add missing documentation of rpa_freq While at it, already adjust the rpe_freq frequency, to highlight that both are calculated by PCODE at runtime. Fixes: c6aac2fa77a3 ("drm/xe: Introduce the RPa information") Cc: Vinay Belgaumkar Cc: Lucas De Marchi Reviewed-by: Lucas De Marchi Reviewed-by: Vinay Belgaumkar Link: https://lore.kernel.org/r/20250521165146.39616-4-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi commit af53f0fd99c3bbb3afd29f1612c9e88c5a92cc01 Author: Rodrigo Vivi Date: Wed May 21 12:51:47 2025 -0400 drm/xe: Make xe_gt_freq part of the Documentation The documentation was created with the creation of the component, however it has never been actually shown in the actual Documentation. While doing this, fixes the identation style, to avoid new warnings while building htmldocs. Fixes: bef52b5c7a19 ("drm/xe: Create a xe_gt_freq component for raw management and sysfs") Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250521165146.39616-3-rodrigo.vivi@intel.com Signed-off-by: Rodrigo Vivi commit 126bf397bf58485cdd631824190cdcfeb86f5d9b Author: Jens Glathe Date: Sat May 24 13:48:37 2025 +0200 drm/panel-edp: add N160JCE-ELL CMN panel for Lenovo Thinkbook 16 Panel is widely used in 16" laptops, and also in my Thinkbook 16 G7 QOY. CMN N160JCE-ELL EDID edid-decode (hex): 00 ff ff ff ff ff ff 00 0d ae 2b 16 00 00 00 00 20 20 01 04 a5 22 16 78 03 28 65 97 59 54 8e 27 1e 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 42 3c 80 a0 70 b0 24 40 30 20 a6 00 58 d7 10 00 00 18 35 30 80 a0 70 b0 24 40 30 20 a6 00 58 d7 10 00 00 18 00 00 00 fd 00 28 3c 4b 4b 10 01 0a 20 20 20 20 20 20 00 00 00 fe 00 4e 31 36 30 4a 43 45 2d 45 4c 4c 0a 20 00 95 Signed-off-by: Jens Glathe Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250524-tb16-dt-v4-2-2c1e6018d3f0@oldschoolsolutions.biz commit d2dc30e0aa252830f908c8e793d3139d51321370 Author: Joonas Lahtinen Date: Thu May 22 09:41:27 2025 +0300 Revert "drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1" This reverts commit d6e020819612a4a06207af858e0978be4d3e3140. The IS_DGFX check was put in place because error capture of buffer objects is expected to be broken on devices with VRAM. Userspace fix[1] to the impacted media driver has been submitted, merged and a new driver release is out as 25.2.3 where the capture flag is dropped on DG1 thus unblocking the usage of media driver on DG1. [1] https://github.com/intel/media-driver/commit/93c07d9b4b96a78bab21f6acd4eb863f4313ea4a Cc: stable@vger.kernel.org # v6.0+ Cc: Ville Syrjälä Cc: Andi Shyti Cc: Matthew Auld Cc: Thomas Hellström Cc: Tvrtko Ursulin Acked-by: Tvrtko Ursulin Reviewed-by: Andi Shyti Link: https://lore.kernel.org/r/20250522064127.24293-1-joonas.lahtinen@linux.intel.com [Joonas: Update message to point out the merged userspace fix] Signed-off-by: Joonas Lahtinen commit 99764593528f9e0ee9509f9e4a4eb21db99d0681 Author: Luca Ceresoli Date: Fri May 9 15:53:44 2025 +0200 drm/bridge: imx8qxp-pixel-combiner: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. This driver embeds an array of channels in the main struct, and each channel embeds a drm_bridge. This prevents dynamic, refcount-based deallocation of the bridges. To make the new, dynamic bridge allocation possible: * change the array of channels into an array of channel pointers * allocate each channel using devm_drm_bridge_alloc() * adapt the code wherever using the channels * remove the is_available flag, now "ch != NULL" is equivalent Reviewed-by: Liu Ying Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-18-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit e6ba431676d522ddc5f4301c0b5fb9f4741433c2 Author: Jani Nikula Date: Thu May 22 12:48:44 2025 +0300 drm/xe: stop including intel_display_{core, device}.h from xe_device_types.h Make xe->display pointer opaque to most of core xe driver. A few places now need explicit include of intel_display_core.h. With this dependency broken, changes in display should cause radically less recompilation of xe. Acked-by: Lucas De Marchi Reviewed-by: Chaitanya Kumar Borah Link: https://lore.kernel.org/r/a12918f4d404e2d6d4e963126ce96df01d5064f3.1747907216.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 62384da2a04d7a61d840ad099fc9d0d065b31208 Author: Jani Nikula Date: Thu May 22 12:48:43 2025 +0300 drm/i915: stop including display/intel_display_{core, limits}.h from i915_drv.h Make i915->display pointer opaque to most of core i915 driver. Lots of places now need explicit include of intel_display_core.h, or a more specific header. With this dependency broken, changes in display should cause radically less recompilation of i915. Reviewed-by: Chaitanya Kumar Borah Link: https://lore.kernel.org/r/b381b59acb7e4f600e0282935a68aedf77768109.1747907216.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6f142c52d3ce6eca626b1444a0694d27de6be993 Author: Jani Nikula Date: Thu May 22 12:48:42 2025 +0300 drm/i915/display: allocate struct intel_display dynamically Allocate struct intel_display dynamically in intel_display_device_probe() and free in intel_display_device_remove(). v2: Remove duplicate intel_display_device_remove() on error path (Lucas) Reviewed-by: Rodrigo Vivi Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/8cd526a177061cddf71db59bd0901bd1a24e77be.1747907216.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a3f7d26dfce9e2d547a58f4941881843a391a6cc Author: Geert Uytterhoeven Date: Tue May 20 16:33:59 2025 +0200 drm/sitronix: Remove broken backwards-compatibility layer When moving the Sitronix DRM drivers and renaming their Kconfig symbols, the old symbols were kept, aiming to provide a seamless migration path when running "make olddefconfig" or "make oldconfig". However, the old compatibility symbols are not visible. Hence unless they are selected by another symbol (which they are not), they can never be enabled, and no backwards compatibility is provided. Drop the broken mechanism and the old symbols. Fixes: 9b8f32002cddf792 ("drm/sitronix: move tiny Sitronix drivers to their own subdir") Signed-off-by: Geert Uytterhoeven Acked-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20395b14effe5e2e05a4f0856fdcda51c410329d.1747751592.git.geert+renesas@glider.be Signed-off-by: Javier Martinez Canillas commit 9ec1ac835e489b9ab2776c0cbbb1b1ca813923a2 Author: Christian König Date: Tue Jul 16 14:28:40 2024 +0200 drm/ttm: make ttm_bo_get internal Prevent drivers from using this directly. Signed-off-by: Christian König Reviewed-by: Matthew Brost Reviewed-by: Simona Vetter Link: https://lore.kernel.org/r/20240723121750.2086-8-christian.koenig@amd.com commit eb314613cd7c5fa5a26a2293d6ea935cf6cfaac0 Author: Christian König Date: Fri Jul 12 09:43:24 2024 +0200 drm/ttm: revert "Export ttm_bo_get_unless_zero()" This reverts commit 24dc64c1ba5c3ef0463d59fef6df09336754188d. Shouldn't be needed by drivers any more. Signed-off-by: Christian König Reviewed-by: Matthew Brost Reviewed-by: Danilo Krummrich Reviewed-by: Simona Vetter Link: https://lore.kernel.org/r/20240723121750.2086-6-christian.koenig@amd.com commit 4e591b890afa0cbc3479f3b88fa7dc1d28972761 Author: Thierry Bultel Date: Thu May 15 16:18:17 2025 +0200 dt-bindings: clock: renesas,cpg-mssr: Document RZ/T2H support Document RZ/T2H (a.k.a. r9a09g077) cpg-mssr (Clock Pulse Generator) binding. Reviewed-by: "Rob Herring (Arm)" Signed-off-by: Thierry Bultel Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/20250515141828.43444-3-thierry.bultel.yh@bp.renesas.com Signed-off-by: Geert Uytterhoeven commit dc0698d1b30c053d48dbe49cedb037633fa8a391 Author: Chaitanya Kumar Borah Date: Fri May 23 11:50:41 2025 +0530 drm/i915: Disable updating of LUT values during vblank Do not schedule vblank worker for LUT update if the registers are double buffered v2: Do not schedule the worker at all (Ville) Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-12-chaitanya.kumar.borah@intel.com commit 88d7e284b24ee3e16b97630536c6aa06e58941db Author: Chaitanya Kumar Borah Date: Fri May 23 11:50:40 2025 +0530 drm/i915/color: Do not pre-load LUTs with DB registers Since Double Buffered LUT registers can be written in active region no need to preload them. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-11-chaitanya.kumar.borah@intel.com commit d94a92b7d0a4424936b6a5aa25038a769cdd4ba8 Author: Chaitanya Kumar Borah Date: Fri May 23 11:50:39 2025 +0530 drm/i915: Program DB LUT registers before vblank Double Buffered LUT registers can be programmed in the active region. This patch implements the MMIO path for it. Program the registers after evading vblank. The HW latches on to the registers after delayed vblank. It takes around 1024 cdclk cycles(~one scanline) for this. Following assumptions have been made while making this change - Current vblank evasion time is sufficient for programming the LUT registers. - Current guardband calculation would be sufficient for the HW to latch on to the new values v2: move loading LUTs to commit_pipe_post_planes() since a vblank evasion failure for this is probably less drastic than for plane programming. (Ville) Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-10-chaitanya.kumar.borah@intel.com commit b0e0369bca338bb6a07466838cef6c6e5a1a55b9 Author: Chaitanya Kumar Borah Date: Fri May 23 11:50:38 2025 +0530 drm/i915/display: use GOSUB to program double buffered LUT registers With addition of double buffered GAMMA registers in PTL, we can now program them in the active region. Use GOSUB instruction of DSB to program them. It is done in the following steps: 1. intel_color_prepare_commit() - If the platform supports, prepare a dsb instance (dsb_color) hooked to DSB0. - Add all the register write instructions to dsb_color through the load_lut() hook - Do not add the vrr_send_push() logic to the buffer as it should be taken care by dsb_commit instance of DSB0 - Finish preparation of the buffer by aligning it to 64 bit 2. intel_atomic_dsb_finish() - Add the gosub instruction into the dsb_commit instance of DSB0 using intel_dsb_gosub() - If needed, add the vrr_send_push() logic to dsb_commit after it v2: Refactor code to simplify commit completion flow. Add some helpers along the way (Ville) v3: s/doubled/double and add display to commit message prefix (Uma) Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-9-chaitanya.kumar.borah@intel.com commit 9dae0b6e9c8c05931c1708fa9e0f4d69166a61c0 Author: Chaitanya Kumar Borah Date: Fri May 23 11:50:37 2025 +0530 drm/i915: s/dsb_color_vblank/dsb_color With double buffer gamma registers in the mix, we need not wait for vblank to execute gamma writes through dsb. Before we implement that s/dsb_color_vblank/dsb_color. Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Ville Syrjälä Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-8-chaitanya.kumar.borah@intel.com commit 78f237a6a61b102e0b4cd0ea842861e82ec323dd Author: Chaitanya Kumar Borah Date: Fri May 23 11:50:36 2025 +0530 drm/i915/dsb: Add support for GOSUB interrupt DSB raises an interrupt when there is a nested GOSUB command or illegal Head/Tail. Add support to log such errors in the DSB interrupt handler. v2: Enable support only in platforms that support this (Ville) Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-7-chaitanya.kumar.borah@intel.com commit 796b6df0f8f57c40e95bd49294cf5f869eab3e9b Author: Chaitanya Kumar Borah Date: Fri May 23 11:50:35 2025 +0530 drm/i915/dsb: add intel_dsb_gosub_finish() A DSB buffer which will be used for GOSUB execution does not need the DEWAKE mechanism but still need to be 64 bit aligned. Add helper to finish preparation of a dsb buffer to be executed with GOSUB instruction. v2: Add a cacheline of noops at the end of GOSUB buffer (Ville) Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-6-chaitanya.kumar.borah@intel.com commit 2c41d62f6fb16d591df17b29edaa81ea56569bb3 Author: Ville Syrjälä Date: Fri May 23 11:50:34 2025 +0530 drm/i915/dsb: Implement intel_dsb_gosub() Add support for the new GOSUB DSB instruction (available on ptl+), which instructs the DSB to jump to a different buffer, execute the commands there, and then return execution to the next instruction in the original buffer. There are a few alignment related workarounds that need to be dealt with when emitting GOSUB instruction. v2: Right shift head and tail pointer passed to gosub command (chaitanya) v3: Add macro for right shifting head/tail pointers (Animesh) v4: Fix typo in commit message (Uma) Add comments explaining why right shifting htp is needed (Animesh) Signed-off-by: Ville Syrjälä Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Uma Shankar Reviewed-by: Animesh Manna Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-5-chaitanya.kumar.borah@intel.com commit bb3de17e2b5eb3cdc26e71b257e6c7989fce71ab Author: Ville Syrjälä Date: Fri May 23 11:50:33 2025 +0530 drm/i915/dsb: Extract intel_dsb_{head,tail}() Extract the code that calculates the DSB_HEAD/TAIL register values into small helpers. We already have two copies of this, and soon there will be a third. Signed-off-by: Ville Syrjälä Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Animesh Manna Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-4-chaitanya.kumar.borah@intel.com commit d535ae997ddd6b5c0c591c7d4440d3e389618da6 Author: Ville Syrjälä Date: Fri May 23 11:50:32 2025 +0530 drm/i915/dsb: Extract assert_dsb_tail_is_aligned() Extract the DSB tail alignment checks into helper. We already have two uses of this, and soon we'll get a third. v2: s/soo/soon in commit message (Animesh) Signed-off-by: Ville Syrjälä Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Animesh Manna Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-3-chaitanya.kumar.borah@intel.com commit 55f233aaadabfad883aa442c202d91617008dff8 Author: Ville Syrjälä Date: Fri May 23 11:50:31 2025 +0530 drm/i915/dsb: Extract intel_dsb_ins_align() Extract the code that alings the next instruction to the next QW boundary into a small helper. I'll have some more uses for this later. Also explain why we don't have to zero out the extra DW. Signed-off-by: Ville Syrjälä Signed-off-by: Chaitanya Kumar Borah Reviewed-by: Animesh Manna Signed-off-by: Animesh Manna Link: https://lore.kernel.org/r/20250523062041.166468-2-chaitanya.kumar.borah@intel.com commit c06cb85ad1412c6ff34792b028b2f89495761398 Author: Thomas Zimmermann Date: Tue May 20 11:40:07 2025 +0200 drm/vesadrm: Use helpers for programming gamma ramps Replace vesadrm's code for programming the hardware gamma LUT with DRM helpers. Either load a provided gamma ramp or program a default. Set the individual entries with a callback. Each gamma value is given as 3 individual 16-bit values for red, green and blue. The driver reduces them to 8 bit to make them fit into hardware registers. Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250520094203.30545-6-tzimmermann@suse.de commit a4871e6201c46c8e1d04308265b4b4c5753c8209 Author: Thomas Zimmermann Date: Tue May 20 11:40:06 2025 +0200 drm/ofdrm: Use helpers for programming gamma ramps Replace ofdrm's code for programming the hardware gamma LUT with DRM helpers. Either load a provided gamma ramp or program a default. Set the individual entries with a callback. Each gamma value is given as 3 individual 16-bit values for red, green and blue. The driver reduces them to 8 bit to make them fit into hardware registers. v2: - fix coding style Signed-off-by: Thomas Zimmermann Reviewed-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250520094203.30545-5-tzimmermann@suse.de commit 1bdb883d6574408e81caac6a09f86955687680a2 Author: Thomas Zimmermann Date: Tue May 20 11:40:05 2025 +0200 drm/mgag200: Use helpers for programming gamma ramps Replace mgag200's code for programming the hardware gamma LUT with DRM helpers. Either load a provided gamma ramp or program a default. Set the individual entries with a callback. Each gamma value is given as 3 individual 16-bit values for red, green and blue. The driver reduces them to 8 bit to make them fit into hardware registers. v2: - fix coding style Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250520094203.30545-4-tzimmermann@suse.de commit 067ae3a7056c6288940da52ad32b6d96bfeebf07 Author: Thomas Zimmermann Date: Tue May 20 11:40:04 2025 +0200 drm/ast: Use helpers for programming gamma ramps and palettes Replace ast's code for programming the hardware gamma/palette LUT with DRM helpers. Either load provided data or program a default. Set the individual entries with a callback. Each gamma/palette value is given as 3 individual 16-bit values for red, green and blue. The driver reduces them to 8 bit to make them fit into hardware registers. v3: - fix tags (Javier) Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Link: https://lore.kernel.org/r/20250520094203.30545-3-tzimmermann@suse.de commit e64693248f9054dee1283d67dc010eab8d172f23 Author: Thomas Zimmermann Date: Tue May 20 11:40:03 2025 +0200 drm: Add helpers for programming hardware gamma LUTs Provide helpers that program hardware gamma LUTs. Tha gamma ramp is either provided by the driver or generated by the helper. The DRM driver exports the GAMMA_LUT property with a fixed number of entries per color component, such as 256 on 8-bit-wide components. The entries describe the gamma ramp of each individual component. The new helper drm_crtc_load_gamma_888() loads such gamma ramp to hardware. The hardware uses each displayed pixel's individial components as indices into the hardware gamma table. For color modes with less than 8 bits per color component, the helpers drm_crtc_load_gamma_565_from() and drm_crtc_load_gamma_555_from_888() interpolate the provided gamma ramp to reduce it to the correct number of entries; 5/6/5 for RGB565-like formats and 5/5/5 for XRGB1555-like formats. If no gamma ramp has been provided, drivers can use the new helper drm_crtc_fill_gamma_888() to load a default gamma ramp with 256 entries per color component. For color modes with less bits, the new helpers drm_crtc_fill_gamma_565() and drm_crtc_fill_gamma_555() are available. The default gamma ramp uses a gamma factor of 1. For color modes with palette, drm_crtc_load_palette_8() load an 8-bit palette into the hardware. If no palette has been specified, drm_crtc_fill_palette_8() load a system-specific default palette. This is currently only a grey-scale palette with increasing luminance, but later patches can change this. For PCs, a VGA default palette could be used. v2: - drop comment on gamma factor of 2.2 (Michel, Pekka) - fix typos in commit description (Javier) Signed-off-by: Thomas Zimmermann Reviewed-by: Jocelyn Falempe Acked-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250520094203.30545-2-tzimmermann@suse.de commit 2ea42f6e6868bc5a3d53e57a3af5b4d3d88c5dea Author: Andy Yan Date: Thu May 8 16:47:57 2025 +0800 drm/gem-framebuffer: log errors when gem size < afbc_size Let the user know what went wrong in drm_gem_fb_afbc_init failure paths. Signed-off-by: Andy Yan Reviewed-by: Daniel Stone Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250508084811.2472877-1-andyshrk@163.com commit bf3197211022809d8b6a24c3aeec5f40404322b3 Author: André Almeida Date: Fri May 9 11:26:27 2025 -0300 drm: drm_auth: Convert mutex usage to guard(mutex) Replace open-coded mutex handling with cleanup.h guard(mutex). This simplifies the code and removes the "goto unlock" pattern. Tested with igt tests core_auth and core_setmaster. Signed-off-by: André Almeida Reviewed-by: Thomas Zimmermann Signed-off-by: Thomas Zimmermann Link: https://lore.kernel.org/r/20250509142627.639419-1-andrealmeid@igalia.com commit b1f87be7280ff48794f0fe55c9ca6df9d87d62c5 Author: John Johansen Date: Sun Feb 16 03:40:52 2025 -0800 apparmor: Document that label must be last member in struct aa_profile The label struct is variable length. While its use in struct aa_profile is fixed length at 2 entries the variable length member needs to be the last member in the structure. The code already does this but the comment has it in the wrong location. Also add a comment to ensure it stays at the end of the structure. While we are at it, update the documentation for other profile members as well. Signed-off-by: John Johansen commit 4c0dc425fd613c5de0ca445f29d63150b52efc35 Author: John Johansen Date: Mon Feb 17 01:50:36 2025 -0800 apparmor: make debug_values_table static The debug_values_table is only referenced from lib.c so it should be static. Signed-off-by: John Johansen commit 16916b17b4f80f99aad2ad29ad112313539ad219 Author: Ryan Lee Date: Thu May 1 17:55:46 2025 -0700 apparmor: force auditing of conflicting attachment execs from confined Conflicting attachment paths are an error state that result in the binary in question executing under an unexpected ix/ux fallback. As such, it should be audited to record the occurrence of conflicting attachments. Signed-off-by: Ryan Lee Signed-off-by: John Johansen commit b824b5f82bbc8ace0982391a1718b04a1f93346e Author: Ryan Lee Date: Thu May 1 17:55:45 2025 -0700 apparmor: include conflicting attachment info for confined ix/ux fallback Instead of silently overwriting the conflicting profile attachment string, include that information in the ix/ux fallback string that gets set as info instead. Also add a warning print if some other info is set that would be overwritten by the ix/ux fallback string or by the profile not found error. Signed-off-by: Ryan Lee Signed-off-by: John Johansen commit e76d733b1b1ff0bec6a305341fda3fe937fbf51f Author: Ryan Lee Date: Thu May 1 17:55:44 2025 -0700 apparmor: move the "conflicting profile attachments" infostr to a const declaration Instead of having a literal, making this a constant will allow for (hacky) detection of conflicting profile attachments from inspection of the info pointer. This is used in the next patch to augment the information provided through domain.c:x_to_label for ix/ux fallback. Signed-off-by: Ryan Lee Signed-off-by: John Johansen commit 89a3561e69e5187fcce302eef429acd38aec1277 Author: Ryan Lee Date: Thu May 1 17:55:43 2025 -0700 apparmor: force audit on unconfined exec if info is set by find_attach find_attach may set info if something unusual happens during that process (currently only used to signal conflicting attachments, but this could be expanded in the future). This is information that should be propagated to userspace via an audit message. Signed-off-by: Ryan Lee Signed-off-by: John Johansen commit 95ff11895846eec76a19351a109fbabbdd86b417 Author: Ryan Lee Date: Tue Apr 8 18:02:00 2025 -0700 apparmor: make all generated string array headers const char *const address_family_names and sock_type_names were created as const char *a[], which declares them as (non-const) pointers to const chars. Since the pointers themselves would not be changed, they should be generated as const char *const a[]. Signed-off-by: Ryan Lee Signed-off-by: John Johansen commit a88db916b8c77552f49f7d9f8744095ea01a268f Author: Ryan Lee Date: Thu May 1 12:54:39 2025 -0700 apparmor: fix loop detection used in conflicting attachment resolution Conflicting attachment resolution is based on the number of states traversed to reach an accepting state in the attachment DFA, accounting for DFA loops traversed during the matching process. However, the loop counting logic had multiple bugs: - The inc_wb_pos macro increments both position and length, but length is supposed to saturate upon hitting buffer capacity, instead of wrapping around. - If no revisited state is found when traversing the history, is_loop would still return true, as if there was a loop found the length of the history buffer, instead of returning false and signalling that no loop was found. As a result, the adjustment step of aa_dfa_leftmatch would sometimes produce negative counts with loop- free DFAs that traversed enough states. - The iteration in the is_loop for loop is supposed to stop before i = wb->len, so the conditional should be < instead of <=. This patch fixes the above bugs as well as the following nits: - The count and size fields in struct match_workbuf were not used, so they can be removed. - The history buffer in match_workbuf semantically stores aa_state_t and not unsigned ints, even if aa_state_t is currently unsigned int. - The local variables in is_loop are counters, and thus should be unsigned ints instead of aa_state_t's. Fixes: 21f606610502 ("apparmor: improve overlapping domain attachment resolution") Signed-off-by: Ryan Lee Co-developed-by: John Johansen Signed-off-by: John Johansen commit 1f957fbb88b61eaf5ac9bf2db6bc2e54121a4359 Author: Lad Prabhakar Date: Mon May 12 19:23:20 2025 +0100 drm: renesas: rz-du: Add support for RZ/V2H(P) SoC The LCD controller (LCDC) on the RZ/V2H(P) SoC is composed of Frame Compression Processor (FCPVD), Video Signal Processor (VSPD), and Display Unit (DU). There is one LCDC unit available on the RZ/V2H(P) SoC which is connected to the DSI. Signed-off-by: Lad Prabhakar Reviewed-by: Biju Das Reviewed-by: Laurent Pinchart Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250512182330.238259-3-prabhakar.mahadev-lad.rj@bp.renesas.com commit ed6a6d63513ee5199841c0a0dc2772ad944e63ee Author: Lad Prabhakar Date: Mon May 12 19:23:19 2025 +0100 dt-bindings: display: renesas,rzg2l-du: Add support for RZ/V2H(P) SoC The DU block on the RZ/V2H(P) SoC is identical to the one found on the RZ/G2L SoC. However, it only supports the DSI interface, whereas the RZ/G2L supports both DSI and DPI interfaces. Due to this difference, a SoC-specific compatible string 'renesas,r9a09g057-du' is added for the RZ/V2H(P) SoC. Signed-off-by: Lad Prabhakar Reviewed-by: Krzysztof Kozlowski Reviewed-by: Biju Das Reviewed-by: Laurent Pinchart Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250512182330.238259-2-prabhakar.mahadev-lad.rj@bp.renesas.com commit 5ce16c169a4cb8ffceabfd48853d0bf605ce785a Author: Chris Brandt Date: Wed May 21 17:03:35 2025 -0400 drm: renesas: rz-du: Add atomic_pre_enable When drm_panel.prepare_prev_first is set to true in a panel driver, the panel expects the MIPI DSI hardware to be already configured before the panel's prepare function is called because it might need to send DCS commands. Signed-off-by: Chris Brandt Tested-by: Hugo Villeneuve Reviewed-by: Biju Das Signed-off-by: Biju Das Link: https://lore.kernel.org/r/20250521210335.3149065-1-chris.brandt@renesas.com commit 9e0f93f7af569c6aee53eedac2c4161ea9d50169 Author: Maxim Schwalm Date: Tue May 6 12:27:18 2025 +0300 drm: panel: Add support for Renesas R69328 based MIPI DSI panel Driver adds support for panels with Renesas R69328 IC Currently supported compatible is: - jdi,dx12d100vm0eaa Co-developed-by: Svyatoslav Ryhel Signed-off-by: Svyatoslav Ryhel Signed-off-by: Maxim Schwalm Reviewed-by: Neil Armstrong Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250506092718.106088-5-clamor95@gmail.com Signed-off-by: Dmitry Baryshkov commit 215c73d48330230dc0ab0bbdd2798dd2ce66acfd Author: Svyatoslav Ryhel Date: Tue May 6 12:27:17 2025 +0300 dt-bindings: display: panel: Document Renesas R69328 based DSI panel R69328 is liquid crystal driver for high-definition amorphous silicon (a-Si) panels and is ideal for tablets and smartphones. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250506092718.106088-4-clamor95@gmail.com Signed-off-by: Dmitry Baryshkov commit cb6c01ead1eb78f7676ea09fe407c4aa1c5855b3 Author: Svyatoslav Ryhel Date: Tue May 6 12:27:16 2025 +0300 drm: panel: Add support for Renesas R61307 based MIPI DSI panel R61307 is liquid crystal driver for high-definition amorphous silicon (a-Si) panels and is ideal for tablets and smartphones. Supported compatibles are: - hit,tx13d100vm0eaa - koe,tx13d100vm0eaa Signed-off-by: Svyatoslav Ryhel Reviewed-by: Neil Armstrong Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250506092718.106088-3-clamor95@gmail.com Signed-off-by: Dmitry Baryshkov commit 43adabbe3a7912b2db199a17d446a5d9fcde6fc7 Author: Svyatoslav Ryhel Date: Tue May 6 12:27:15 2025 +0300 dt-bindings: display: panel: Document Renesas R61307 based DSI panel R61307 is liquid crystal driver for high-definition amorphous silicon (a-Si) panels and is ideal for tablets and smartphones. Signed-off-by: Svyatoslav Ryhel Reviewed-by: Rob Herring (Arm) Reviewed-by: Linus Walleij Link: https://lore.kernel.org/r/20250506092718.106088-2-clamor95@gmail.com Signed-off-by: Dmitry Baryshkov commit 027ce1eff321684e028e0d80d5c1c29f97cf0da3 Author: Luca Ceresoli Date: Fri May 9 15:53:48 2025 +0200 drm/todo: add entry to remove devm_drm_put_bridge() devm_drm_put_bridge() is a temporary workaround waiting for the panel bridge lifetime rework. Add a TODO entry to not forget it must be removed after such rework. Suggested-by: Maxime Ripard Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-22-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit 9c399719cfb98fd92c7b76dcd57098e5e3ca5cda Author: Luca Ceresoli Date: Fri May 9 15:53:28 2025 +0200 drm: convert many bridge drivers from devm_kzalloc() to devm_drm_bridge_alloc() API devm_drm_bridge_alloc() is the new API to be used for allocating (and partially initializing) a private driver struct embedding a struct drm_bridge. For many drivers having a simple code flow in the probe function, this commit does a mass conversion automatically with the following semantic patch. The changes have been reviewed manually for correctness as well as to find any false positives. The patch has been applied with the explicit exclusion of bridge/panel.c, handled by a separate patch. After applying the semantic patch, manually fixed these issues: - 4 drivers need ERR_CAST() instead of PTR_ERR() as the function calling devm_drm_bridge_alloc() returns a pointer - re-added empty lines and comments that the script had removed but that should stay @@ type T; identifier C; identifier BR; expression DEV; expression FUNCS; @@ -T *C; +T *C; ... ( -C = devm_kzalloc(DEV, ...); -if (!C) - return -ENOMEM; +C = devm_drm_bridge_alloc(DEV, T, BR, FUNCS); +if (IS_ERR(C)) + return PTR_ERR(C); | -C = devm_kzalloc(DEV, ...); -if (!C) - return ERR_PTR(-ENOMEM); +C = devm_drm_bridge_alloc(DEV, T, BR, FUNCS); +if (IS_ERR(C)) + return PTR_ERR(C); ) ... -C->BR.funcs = FUNCS; Reviewed-by: Manikandan Muralidharan # microchip-lvds.c Reviewed-by: Douglas Anderson # parade-ps8640 Tested-by: Douglas Anderson # parade-ps8640 Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-2-b8bc1f16d7aa@bootlin.com [Luca: fixed trivial patch conflict in adv7511_drv.c while applying] Signed-off-by: Luca Ceresoli commit 42e5fc672fee07da071a37e06a2454aba85d8efe Author: Yumeng Fang Date: Fri May 23 14:14:22 2025 +0800 drm/i915/display: Use str_true_false() helper Remove hard-coded strings by using the str_true_false() helper. Signed-off-by: Yumeng Fang Signed-off-by: Yunjian Long Link: https://lore.kernel.org/r/20250523141422844GEA-yzba-OvN0lZirDsS-@zte.com.cn Signed-off-by: Jani Nikula commit 9528e54198f29548b18b0a5b343a31724e83c68b Author: Jani Nikula Date: Thu May 22 13:00:36 2025 +0300 drm/panel: abstract of_panel_find() Add a helper to wrap OF-specific calls in drm_panel_add_follower() in preparation for adding an ACPI equivalent in the future. No functional changes. Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250522100036.2529624-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 370f86bc07bf8aa7f74cea5f6faa51ca1eb92b6f Author: Wolfram Sang Date: Thu May 22 12:34:44 2025 +0200 drm: renesas: rcar-du: use proper naming for R-Car Not RCAR, but R-Car. Signed-off-by: Wolfram Sang Reviewed-by: Kieran Bingham Reviewed-by: Geert Uytterhoeven Reviewed-by: Laurent Pinchart Link: https://lore.kernel.org/r/20250522103530.51972-2-wsa+renesas@sang-engineering.com Signed-off-by: Tomi Valkeinen commit 20a07782dacf7348a259efcc4a2ab56ecbe7aeb1 Author: Tomasz Lis Date: Tue May 20 01:00:35 2025 +0200 drm/xe/vf: Fail migration recovery if fixups needed but platform not supported The post-migration recovery needs to be fully implemented for a specific platform in order to make continuation of workloads possible. New platforms introduce changes which affect the recovery procedure, and without a clear verification of support this leads to errors with no straight forward error message explaining the cause. This patch fixes that issue - it introduces a message to be logged when the current driver is known to not support the current platform. Wedging the driver immediately also decreases the amount of additional errors which would come afterwards if the driver continued operation. v2: Show the message during probe as well as during recovery; do not perform any recovery steps if the recovery is bound to fail v3: Use SRIOV-specific logging, fix typos v4: XE_DEBUG_SRIOV to XE_DEBUG check switch, to make testing more straightforward Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Cc: Michał Winiarski Reviewed-by: Michal Wajdeczko Acked-by: Michał Winiarski Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250519230035.3143966-1-tomasz.lis@intel.com commit ee1855582e5e0f8d73428875b91a30785bcc4b7c Author: Luca Ceresoli Date: Thu May 22 09:12:58 2025 +0200 drm/bridge: fix build with CONFIG_OF=n Commit 5164553d739e ("drm/bridge: add devm_drm_put_bridge()") adds two declarations for devm_drm_put_bridge(): 1) an inline declaration in the #else branch of '#if defined(CONFIG_OF)...' 2) one outside of the same #if This results in a build failure with CONFIG_OF=n: ../drivers/gpu/drm/drm_bridge.c:1406:6: error: redefinition of ‘devm_drm_put_bridge’ The function has nothing to do with OF, thus fix by removing declaration 1. Fixes: 5164553d739e ("drm/bridge: add devm_drm_put_bridge()") Reported-by: Ville Syrjala Closes: https://oftc.catirclogs.org/dri-devel/2025-05-21#34288266; Tested-by: Chaitanya Kumar Borah Reviewed-by: Chaitanya Kumar Borah Link: https://lore.kernel.org/r/20250522-devm_drm_put_bridge-fix-non-of-build-v1-1-a05234dea046@bootlin.com Signed-off-by: Luca Ceresoli commit a3436f63aa4f93b043a970cc72a196a501191ecc Author: Langyan Ye Date: Wed May 21 17:37:43 2025 +0800 drm/panel-edp: Add KDC KD116N3730A05 Add support for the KDC KD116N3730A05, pleace the EDID here for subsequent reference. 00 ff ff ff ff ff ff 00 2c 83 20 12 00 00 00 00 30 22 01 04 95 1a 0e 78 03 3a 75 9b 5d 5b 96 28 19 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 09 1e 56 dc 50 00 28 30 30 20 36 00 00 90 10 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fe 00 4b 44 31 31 36 4e 33 37 33 30 41 30 35 00 e2 Signed-off-by: Langyan Ye Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250521093743.1057466-1-yelangyan@huaqin.corp-partner.google.com commit 49c6dc74b5968885f421f9f1b45eb4890b955870 Author: Matt Atwood Date: Tue May 20 12:57:49 2025 -0700 drm/xe/ptl: Update the PTL pci id table Update to current bspec table. Bspec: 72574 Signed-off-by: Matt Atwood Reviewed-by: Tejas Upadhyay Reviewed-by: Clint Taylor Link: https://lore.kernel.org/r/20250520195749.371748-1-matthew.s.atwood@intel.com Signed-off-by: Matt Roper commit 56764c845aa5be14cd53702fc9f2da23e25857de Author: Imre Deak Date: Tue May 20 17:22:19 2025 +0300 drm/i915/dp: Fix the enabling/disabling of audio SDP splitting Adjust the enabling/disabling steps of the DP audio SDP splitting according to a recent Bspec update. This moves the enabling to the audio codec enable sequence after the transcoder is enabled and disables SDP splitting explicitly during the audio disable sequence. Bspec requires waiting for a vblank event after the transcoder is enabled and before SDP splitting is enabled. There is no need for an explicit wait for this, since after the transcoder is enabled this vblank event is guaranteed to have happened via a flip done wait (see intel_atomic_commit_tail() -> drm_atomic_helper_wait_for_flip_done()). The bspec update is for LNL+ only, but the HW team clarified that this has been always the intended sequence on all platforms and bspec will be updated everywhere accordingly. The way SDP splitting was originally enabled matched the version of bspec at that time. Adding here the Fixes: line still, since this change fixes a FIFO underrun on PTL during output enabling when DSC is enabled. Bspec: 49283, 68943 Fixes: 8853750dbad8 ("drm/i915: Enable SDP split for DP2.0") Cc: Vinod Govindapillai Acked-by: Jani Nikula Reviewed-by: Vinod Govindapillai Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250520142219.1688401-1-imre.deak@intel.com commit 6ad88bf9e74dae83c992d8a16683360117b7e2d8 Author: Luca Ceresoli Date: Fri May 9 15:53:47 2025 +0200 drm/bridge: panel: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. The devm lifetime management of this driver is peculiar. The underlying device for the panel_bridge is the panel, and the devm lifetime is tied the panel device (panel->dev). However the panel_bridge allocation is not performed by the panel driver, but rather by a separate entity (typically the previous bridge in the encoder chain). Thus when that separate entity is destroyed, the panel_bridge is not removed automatically by devm, so it is rather done explicitly by calling drm_panel_bridge_remove(). This is the function that does devm_kfree() the panel_bridge in current code, so update it as well to put the bridge reference instead. This is a temporary solution until the panel lifetime is reworked, which should make this workaround unnecessary, so add a comment to clarify that. Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-21-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit 5164553d739ef45b2c69c8cfe88b9ef26c9a0035 Author: Luca Ceresoli Date: Fri May 9 15:53:46 2025 +0200 drm/bridge: add devm_drm_put_bridge() Bridges obtained via devm_drm_bridge_alloc(dev, ...) will be put when the requesting device (@dev) is removed. However drivers which obtained them may need to put the obtained reference explicitly. One such case is if they bind the devm removal action to a different device than the one implemented by the driver itself and which might be removed at a different time, such as bridge/panel.c. Add devm_drm_put_bridge() to manually release a devm-obtained bridge in such cases. This function is considered only a temporary workaround until the panel bridge is reworked and should be removed afterwards. Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-20-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit afb903c01b2b7af382392024fb02bbfea62696f7 Author: Luca Ceresoli Date: Fri May 9 15:53:43 2025 +0200 drm: zynqmp_dp: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. This driver has a peculiar structure. zynqmp_dpsub.c is the actual driver, which delegates to a submodule (zynqmp_dp.c) the allocation of a sub-structure embedding the drm_bridge and its initialization, however it does not delegate the drm_bridge_add(). Hence, following carefully the code flow, it is correct to change the allocation function and .funcs assignment in the submodule, while the drm_bridge_add() is not in that submodule. Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-17-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit 3d3f22799c89e6d0d210e0f666c77b3de11429d4 Author: Luca Ceresoli Date: Fri May 9 15:53:42 2025 +0200 drm/sti: dvo: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. This driver allocates the DRM bridge separately from the main driver private struct, which prevents using the new devm_drm_bridge_alloc() API. Simplify the code by replacing the struct drm_bridge pointer with an embedded struct drm_bridge inside the private struct, to make use of the new API with the same code flow. Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-16-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit ee81a4a27d3311c79d69b2f446c6528a491dfa26 Author: Luca Ceresoli Date: Fri May 9 15:53:41 2025 +0200 drm/bridge: stm_lvds: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Acked-by: Raphael Gallais-Pou Acked-by: Maxime Ripard Reviewed-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-15-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit db17fbc2d4de215592296a984b688495b62319e5 Author: Luca Ceresoli Date: Fri May 9 15:53:40 2025 +0200 drm/rcar-du: dsi: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Acked-by: Maxime Ripard Reviewed-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-14-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit 7e61751b59576e5227d940a4d34f2f6b6400d192 Author: Luca Ceresoli Date: Fri May 9 15:53:39 2025 +0200 drm/omap: dss: venc: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Switching from a non-devm to a devm allocation allows removing the kfree() in the remove function and in the probe error management code, and as a consequence to simplify the code flow by removing now unnecessary gotos. Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-13-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit af509dfc0b7390a59cdcb64b161bf6c9c7d6cb2a Author: Luca Ceresoli Date: Fri May 9 15:53:38 2025 +0200 drm/omap: dss: sdi: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Switching from a non-devm to a devm allocation allows removing the kfree() in the remove function and in the probe error management code, and as a consequence to simplify the code flow by removing now unnecessary gotos. Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-12-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit eb01c3cc550dfb9bdd021138e898fbf4a8ccd12f Author: Luca Ceresoli Date: Fri May 9 15:53:37 2025 +0200 drm/omap: dss: hdmi5: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Switching from a non-devm to a devm allocation allows removing the kfree() in the remove function and in the probe error management code, and as a consequence to simplify the code flow by removing now unnecessary gotos. Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-11-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit 0241b190acb8399b23efe7188aa43bbbeed2500e Author: Luca Ceresoli Date: Fri May 9 15:53:36 2025 +0200 drm/omap: dss: hdmi4: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Switching from a non-devm to a devm allocation allows removing the kfree() in the remove function and in the probe error management code, and as a consequence to simplify the code flow by removing now unnecessary gotos. Acked-by: Maxime Ripard Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-10-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit f35753992cda94d69e5e96224dc470516f2c45cd Author: Luca Ceresoli Date: Fri May 9 15:53:35 2025 +0200 drm/omap: dss: dsi: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Acked-by: Maxime Ripard Reviewed-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-9-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit ac5869aae6f3155bc9b8746f659a432af43c8942 Author: Luca Ceresoli Date: Fri May 9 15:53:34 2025 +0200 drm/omap: dss: dpi: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Acked-by: Maxime Ripard Reviewed-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-8-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit 9cdc50b20509e55855ed53ab831ba73fd059ade9 Author: Luca Ceresoli Date: Fri May 9 15:53:33 2025 +0200 drm/bridge: sii902x: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Acked-by: Maxime Ripard Reviewed-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-7-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit 3cb4fec95ef6904d28c72e67ff3f5c748d86abb5 Author: Luca Ceresoli Date: Fri May 9 15:53:32 2025 +0200 drm/bridge: nxp-ptn3460: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Acked-by: Maxime Ripard Reviewed-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-6-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit 0d2577d8f01435b508dd315b6cf7696a8fe0482e Author: Luca Ceresoli Date: Fri May 9 15:53:31 2025 +0200 drm/bridge: megachips-stdpxxxx-ge-b850v3-fw: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Acked-by: Maxime Ripard Reviewed-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-5-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit 2b42027f449c9a15e0667d99f76cdb4d775dd201 Author: Luca Ceresoli Date: Fri May 9 15:53:30 2025 +0200 drm/bridge: cdns-dsi: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Acked-by: Maxime Ripard Reviewed-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-4-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit 7a909b2beafbdb0139cb953ce6be4813b6433d1f Author: Luca Ceresoli Date: Fri May 9 15:53:29 2025 +0200 drm/bridge: anx7625: convert to devm_drm_bridge_alloc() API This is the new API for allocating DRM bridges. Acked-by: Maxime Ripard Reviewed-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250509-drm-bridge-convert-to-alloc-api-v3-3-b8bc1f16d7aa@bootlin.com Signed-off-by: Luca Ceresoli commit bdfc5b2927062479d3b918d2990a08f3091ef5fa Author: Anusha Srivatsa Date: Tue May 20 22:04:01 2025 -0500 panel/orisetech-ota5601a: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-30-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit d2b67baa892a6c412f539eea883092e7c580ccea Author: Anusha Srivatsa Date: Tue May 20 22:04:00 2025 -0500 panel/lcd-olinuxino: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-29-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 6e8fba44daa7ec63942d95ad730e0d32455ecede Author: Anusha Srivatsa Date: Tue May 20 22:03:59 2025 -0500 panel/novatek-nt39016: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-28-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit e41a4813af67b294b9f7573fa9b363845e724399 Author: Anusha Srivatsa Date: Tue May 20 22:03:58 2025 -0500 panel/novatek-nt36672e: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-27-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 10868521bdd5e7ff3c41d6adfa116c7c264a08bc Author: Anusha Srivatsa Date: Tue May 20 22:03:57 2025 -0500 panel/novatek-nt36523: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-26-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit e59e1f45246efbd0b0da65753a64ecdaf421776c Author: Anusha Srivatsa Date: Tue May 20 22:03:56 2025 -0500 panel/novatek-nt35950: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-25-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 81cb8735420d9376b565e842fc3a7f65f68e0c23 Author: Anusha Srivatsa Date: Tue May 20 22:03:55 2025 -0500 panel/novatek-nt35560: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-24-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 3f08c356b881d3d6302de207a98ceec1c511159e Author: Anusha Srivatsa Date: Tue May 20 22:03:54 2025 -0500 panel/novatek-nt35510: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-23-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 5d5da5cef9bdabe455804eb000147ace298cde90 Author: Anusha Srivatsa Date: Tue May 20 22:03:53 2025 -0500 panel/newvision-nv3052c: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-22-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 417f0eb92c53fab6a9fdb4f09f9db6505bb7a735 Author: Anusha Srivatsa Date: Tue May 20 22:03:52 2025 -0500 panel/newvision-nv3051d: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-21-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 47b74d7c5e48415cb8d2903077f93760d5d350c3 Author: Anusha Srivatsa Date: Tue May 20 22:03:51 2025 -0500 panel/mantix-mlaf057we51: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-20-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 2a2c7d7d363e0a4afa2042378f5797366d49746c Author: Anusha Srivatsa Date: Tue May 20 22:03:50 2025 -0500 panel/magnachip-d53e6ea8966: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-19-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit b28994ed389017b857248575794e8c340473b79a Author: Anusha Srivatsa Date: Tue May 20 22:03:49 2025 -0500 panel/lincolntech-lcd197: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-18-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 89da5d30fa0cc6f4612f9c3e30b61610b6299f64 Author: Anusha Srivatsa Date: Tue May 20 22:03:48 2025 -0500 panel/lg-lg4573: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-17-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit deafcd1f936d2f2f9beebb19215850653a5526f1 Author: Anusha Srivatsa Date: Tue May 20 22:03:47 2025 -0500 panel/ltk500hd1829: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-16-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit da93b863bd9bcf4e83cc59ac811fc0d74cb25104 Author: Anusha Srivatsa Date: Tue May 20 22:03:46 2025 -0500 panel/ltk050h3146w: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-15-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 608cd2887f78332e4346ae6b7bf1f883c306dfbf Author: Anusha Srivatsa Date: Tue May 20 22:03:45 2025 -0500 panel/jdi-fhd-r63452: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-14-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 9d20a28650ed8885704e195510435b54cbf07be0 Author: Anusha Srivatsa Date: Tue May 20 22:03:44 2025 -0500 panel/jadard-jd9365da-h3: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-13-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 8015bc283e9025151f5a724f7253c49c1ca939b0 Author: Anusha Srivatsa Date: Tue May 20 22:03:43 2025 -0500 panel/innolux-p079zca: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-12-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 93b6d2ea6f8ae6c8e779d5c5bfa3462f4c174e76 Author: Anusha Srivatsa Date: Tue May 20 22:03:42 2025 -0500 panel/innolux-ej030na: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-11-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 0678c17add9b42b1e8878499eb9f2b2ca4b0e6fc Author: Anusha Srivatsa Date: Tue May 20 22:03:41 2025 -0500 panel/ilitek-ili9881c: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-10-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit c15e4acd15e49312ab901b4bde2c789a39e64933 Author: Anusha Srivatsa Date: Tue May 20 22:03:40 2025 -0500 panel/ilitek-ili9806e: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Michael Walle Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-9-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 8500594c9bd132d7e8b1de4b0878786ccdd08723 Author: Anusha Srivatsa Date: Tue May 20 22:03:39 2025 -0500 panel/panel-ili9805: Use refcounted allocation in place of devm_kzalloc() Start using the new helper that does the refcounted allocations Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-8-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 75db23f878e6513de8de3ee08184b09f5bf35a96 Author: Anusha Srivatsa Date: Tue May 20 22:03:38 2025 -0500 panel/ilitek-ili9341: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-7-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 9609efa05d5ec63de5e758571f1bb85bdec93561 Author: Anusha Srivatsa Date: Tue May 20 22:03:37 2025 -0500 panel/ilitek-ili9322: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-6-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit c53c3e87aeb7fc288dcb9dbdb22451e8721771e1 Author: Anusha Srivatsa Date: Tue May 20 22:03:36 2025 -0500 panel/himax-hx8394: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-5-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 7b8c32961bcfec26b6542733dca4b39963a6d20a Author: Anusha Srivatsa Date: Tue May 20 22:03:35 2025 -0500 panel/himax-hx83112a: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-4-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 1017366dd161bbd19dd94ba5c2988a323f3d9d2c Author: Anusha Srivatsa Date: Tue May 20 22:03:34 2025 -0500 panel/fy07024di26a30d: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-3-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 39cfc68b6b24fef5da6c398b654df3686306dfd8 Author: Anusha Srivatsa Date: Tue May 20 22:03:33 2025 -0500 panel/feixin-k101-im2ba02: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-2-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit 74ca3ba0d00d1a52486347dbe8fb1c8ebb5dde7e Author: Anusha Srivatsa Date: Tue May 20 22:03:32 2025 -0500 panel/panel-elida-kd35t133: Use refcounted allocation in place of devm_kzalloc() Move to using the new API devm_drm_panel_alloc() to allocate the panel. Reviewed-by: Neil Armstrong Signed-off-by: Anusha Srivatsa Link: https://lore.kernel.org/r/20250520-drivers-mass-convert-part2-v3-1-f7ae7b723c68@redhat.com Signed-off-by: Maxime Ripard commit ae01d3183d2763ed27ab71f4ef5402b683d9ad8a Author: Dmitry Baryshkov Date: Sat May 17 04:59:46 2025 +0300 drm/bridge: adv7511: switch to the HDMI connector helpers Rewrite the ADV7511 driver to use implementation provided by the DRM HDMI connector framework, including the Audio and CEC bits. Drop the in-bridge connector support and use drm_bridge_connector if the host requires the connector to be provided by the bridge. Note: currently only AVI InfoFrames are supported. Existing driver doesn't support programming any other InfoFrames directly and Audio InfoFrame seems to be programmed using individual bits and pieces rather than programming it directly. Signed-off-by: Dmitry Baryshkov Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250517-drm-hdmi-connector-cec-v6-10-35651db6f19b@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit a74288c8ded7c34624e50b4aa8ca37ae6cc03df4 Author: Dmitry Baryshkov Date: Sat May 17 04:59:45 2025 +0300 drm/display: bridge-connector: handle CEC adapters Implement necessary glue code to let DRM bridge drivers to implement CEC adapters support. Signed-off-by: Dmitry Baryshkov Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250517-drm-hdmi-connector-cec-v6-9-35651db6f19b@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 65a2575a68e4ff03ba887b5aef679fc95405fcd2 Author: Dmitry Baryshkov Date: Sat May 17 04:59:44 2025 +0300 drm/display: bridge-connector: hook in CEC notifier support Allow HDMI DRM bridges to create CEC notifier. Physical address is handled automatically by drm_atomic_helper_connector_hdmi_hotplug() being called from .detect() path. Signed-off-by: Dmitry Baryshkov Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250517-drm-hdmi-connector-cec-v6-8-35651db6f19b@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 603ce85427043ecb29ef737c1b350901ce3ebf09 Author: Dmitry Baryshkov Date: Sat May 17 04:59:42 2025 +0300 drm/display: hdmi-state-helper: handle CEC physical address Call HDMI CEC helpers in order to update physical address of the adapter. Reviewed-by: Maxime Ripard Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250517-drm-hdmi-connector-cec-v6-6-35651db6f19b@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 8b1a8f8b2002d31136d83e4d730b4cb41e9ee868 Author: Dmitry Baryshkov Date: Sat May 17 04:59:41 2025 +0300 drm/display: add CEC helpers code Add generic CEC helpers to be used by HDMI drivers. Both notifier and and adapter are supported for registration. Once registered, the driver can call common set of functions to update physical address, to invalidate it or to unregister CEC data. Unlike drm_connector_cec_funcs (which provides interface common to all implementations, including, but not limited to the CEC adapter, CEC notifier, CEC pin-based adapter, etc) the struct drm_connector_hdmi_cec_adapter_ops provides callbacks specific to the CEC adapter implementations. Signed-off-by: Dmitry Baryshkov Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250517-drm-hdmi-connector-cec-v6-5-35651db6f19b@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit bcc8553b6228d0387ff64978a03efa3c8983dd2f Author: Dmitry Baryshkov Date: Sat May 17 04:59:40 2025 +0300 drm/display: move CEC_CORE selection to DRM_DISPLAY_HELPER THe Kconfig symbol DRM_DISPLAY_DP_AUX_CEC is a boolean which simply toggles whether DP_AUX_CEC support should be built into the drm_display_helper (which can be eithera module or built-in into the kernel). If DRM_DISPLAY_DP_AUX_CEC is selected, then CEC_CORE is selected to be built-in into the kernel even if DRM_DISPLAY_HELPER is selected to be built as a module. Move CEC_CORE selection to the latter symbol in order to allow it to be built as a module. Signed-off-by: Dmitry Baryshkov Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250517-drm-hdmi-connector-cec-v6-4-35651db6f19b@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit e72cd597c35012146bfe77b736a30fee3e77e61e Author: Dmitry Baryshkov Date: Sat May 17 04:59:39 2025 +0300 drm/connector: add CEC-related fields As a preparation to adding HDMI CEC helper code, add CEC-related fields to the struct drm_connector. The callbacks abstract CEC infrastructure in order to support CEC adapters and CEC notifiers in a universal way. CEC data is a void pointer as it allows us to make CEC data helper-specific. For example, currently it will be either cec_notifier or cec_adapter + drm_connector_hdmi_cec_funcs. Later cec-pin might store platform callbacks here. DP CEC might need to store AUX pointer, etc. Signed-off-by: Dmitry Baryshkov Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250517-drm-hdmi-connector-cec-v6-3-35651db6f19b@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit d9f9bae6752f5a0280a80d1bc524cabd0d60c886 Author: Dmitry Baryshkov Date: Sat May 17 04:59:38 2025 +0300 drm/bridge: allow limiting I2S formats By default HDMI codec registers all formats supported on the I2S bus. Allow bridges (and connectors) to limit the list of the PCM formats supported by the HDMI codec. Reviewed-by: Maxime Ripard Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250517-drm-hdmi-connector-cec-v6-2-35651db6f19b@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit fa3769e09be76142d51c617d7d0c72d9c725a49d Author: Dmitry Baryshkov Date: Sat May 17 04:59:37 2025 +0300 drm/bridge: move private data to the end of the struct WHen adding HDMI fields I didn't notice the private: declaration for HPD fields. Move private fields to the end of the struct drm_bride to have clear distinction between private and public fields. Reviewed-by: Maxime Ripard Signed-off-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250517-drm-hdmi-connector-cec-v6-1-35651db6f19b@oss.qualcomm.com Signed-off-by: Dmitry Baryshkov commit 5a9f299f956ef9764f56044cfca7aafa23cea1d1 Author: Jani Nikula Date: Fri May 16 15:17:00 2025 +0300 drm/xe/display: use xe->display to decide whether to do anything Since we only initialize xe->display when xe->info.probe_display, we can use !xe->display to bail out early. This seems cleaner and more accurate than relying on xe->info.probe_display, since xe->display may indeed be NULL. Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/945d2a987214044a81f4816684972961b772b45a.1747397638.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 7e49ab36e6f3fb6edc250609ece1548bf80c50cc Author: Jani Nikula Date: Fri May 16 15:16:59 2025 +0300 drm/xe/display: add notes about how early a few functions can be called xe_display_driver_probe_defer() and xe_display_driver_set_hooks() get called before either struct xe_device or struct intel_display exist. Make a note of that. Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/937ea1e16e970a6f6944b94c6a9c216d36e728d1.1747397638.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 1e2803e565af3b7463c7615347510f7093945633 Author: Jani Nikula Date: Fri May 16 15:16:58 2025 +0300 drm/xe/display: move xe->display initialization to xe_display_probe() The future goal is to have intel_display_device_probe() create struct intel_display. As the first step, postpone xe->display initialization right before that call. This is the same location as in i915. There's a subtle functional change here: xe->display will now be initialized only if xe->info.probe_display. The xe_display_create() function becomes empty, and can be removed. Move its documentation to xe_display_probe() Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/6c3075739d84cecea258d686c3ef38455a61191c.1747397638.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit ed23224b3f5e5e938e5c97d246678702df98eb93 Author: Jani Nikula Date: Fri May 16 15:16:57 2025 +0300 drm/i915/display: move hotplug.dp_wq init from xe and i915 to display The workqueue init and destroy belongs in display. Move it. Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/4730167548a40dc2abe38cd084809b74de988f1a.1747397638.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit b617341e4801e2f0ea7aeb63fae0fa438f7cd601 Author: Jani Nikula Date: Fri May 16 15:16:56 2025 +0300 drm/xe/display: drop duplicate display->fb_tracking.lock init The spinlock is initialized in intel_display_driver_early_probe(). Drop the extra init. Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/f895a8a43c61a6e60db8e1eb698919ce0faab27c.1747397638.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 5b62d63395d5b7d4094e7cd380bccae4b25415cb Author: Haoxiang Li Date: Fri May 16 15:16:55 2025 +0300 drm/xe/display: Add check for alloc_ordered_workqueue() Add check for the return value of alloc_ordered_workqueue() in xe_display_create() to catch potential exception. Fixes: 44e694958b95 ("drm/xe/display: Implement display support") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/4ee1b0e5d1626ce1dde2e82af05c2edaed50c3aa.1747397638.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit dcab7a228f4ea9cda3f5b0a1f0679e046d23d7f7 Author: Haoxiang Li Date: Fri May 16 15:16:54 2025 +0300 drm/i915/display: Add check for alloc_ordered_workqueue() and alloc_workqueue() Add check for the return value of alloc_ordered_workqueue() and alloc_workqueue(). Furthermore, if some allocations fail, cleanup works are added to avoid potential memory leak problem. Fixes: 40053823baad ("drm/i915/display: move modeset probe/remove functions to intel_display_driver.c") Cc: stable@vger.kernel.org Signed-off-by: Haoxiang Li Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20d3d096c6a4907636f8a1389b3b4dd753ca356e.1747397638.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a4b4e3fd536763b3405c70ef97a6e7f9af8a00dc Author: Ernest Van Hoecke Date: Tue May 20 14:43:28 2025 +0200 drm/panel-edp: Add support for AUO G156HAN03.0 panel AUO G156HAN03.0 EDID: 00 ff ff ff ff ff ff 00 06 af ed 30 00 00 00 00 1a 1c 01 04 a5 22 13 78 02 05 b5 94 59 59 92 28 1d 50 54 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 78 37 80 b4 70 38 2e 40 6c 30 aa 00 58 c1 10 00 00 18 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 fe 00 41 55 4f 0a 20 20 20 20 20 20 20 20 20 00 00 00 fe 00 47 31 35 36 48 41 4e 30 33 2e 30 20 0a 00 bb Signed-off-by: Ernest Van Hoecke Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250520124332.71705-1-ernest.vanhoecke@toradex.com commit 46a7c081be700d802741f26d2e9acf1861ee88f1 Author: Devarsh Thakkar Date: Wed May 7 23:36:31 2025 +0530 drm/tidss: Add support for AM62L display subsystem Enable display for AM62L DSS [1] which supports only a single display pipeline using a single overlay manager, single video port and a single video lite pipeline which does not support scaling. The output of video port is routed to SoC boundary via DPI interface and the DPI signals from the video port are also routed to DSI Tx controller present within the SoC. [1]: Section 11.7 (Display Subsystem and Peripherals) Link : https://www.ti.com/lit/pdf/sprujb4 Signed-off-by: Devarsh Thakkar Reviewed-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20250507180631.874930-4-devarsht@ti.com Signed-off-by: Tomi Valkeinen commit e019f515c969cef78187b9cb87c6da06b47568b2 Author: Devarsh Thakkar Date: Wed May 7 23:36:30 2025 +0530 drm/tidss: Update infrastructure to support K3 DSS cut-down versions SoCs like AM62Lx support cut-down version of K3 DSS where although same register space is supported as in other K3 DSS supported SoCs such as AM65x, AM62x, AM62Ax but some of the resources such as planes and corresponding register spaces are truncated. For e.g. AM62Lx has only single VIDL pipeline supported, so corresponding register spaces for other video pipelines need to be skipped. To add a generic support for future SoCs where one or more video pipelines can get truncated from the parent register space, move the video plane related information to vid_info struct which will also have a field to indicate hardware index of each of the available video planes, so that driver only maps and programs those video pipes and skips the unavailable ones. While at it, also change the num_planes field in the features structure to num_vid so that all places in code which use vid_info structure are highlighted in the code. Signed-off-by: Devarsh Thakkar Reviewed-by: Tomi Valkeinen Link: https://lore.kernel.org/r/20250507180631.874930-3-devarsht@ti.com Signed-off-by: Tomi Valkeinen commit cb8d4323302c7ad6b8baa1f5ca29f6186b30f316 Author: Devarsh Thakkar Date: Wed May 7 23:36:29 2025 +0530 dt-bindings: display: ti,am65x-dss: Add support for AM62L DSS The DSS controller on TI's AM62L SoC is an update from that on TI's AM625/AM65x/AM62A7 SoC. The AM62L DSS [1] only supports a single display pipeline using a single overlay manager, single video port and a single video lite pipeline which does not support scaling. The output of video port is routed to SoC boundary via DPI interface and the DPI signals from the video port are also routed to DSI Tx controller present within the SoC. [1]: Section 11.7 (Display Subsystem and Peripherals) Link : https://www.ti.com/lit/pdf/sprujb4 Reviewed-by: Krzysztof Kozlowski Reviewed-by: Jayesh Choudhary Reviewed-by: Tomi Valkeinen Signed-off-by: Devarsh Thakkar Link: https://lore.kernel.org/r/20250507180631.874930-2-devarsht@ti.com Signed-off-by: Tomi Valkeinen commit c3a48363cf1f76147088b1adb518136ac5df86a0 Author: Imre Deak Date: Mon May 19 16:34:17 2025 +0300 drm/i915/dp_mst: Work around Thunderbolt sink disconnect after SINK_COUNT_ESI read Due to a problem in the iTBT DP-in adapter's firmware the sink on a TBT link may get disconnected inadvertently if the SINK_COUNT_ESI and the DP_LINK_SERVICE_IRQ_VECTOR_ESI0 registers are read in a single AUX transaction. Work around the issue by reading these registers in separate transactions. The issue affects MTL+ platforms and will be fixed in the DP-in adapter firmware, however releasing that firmware fix may take some time and is not guaranteed to be available for all systems. Based on this apply the workaround on affected platforms. See HSD #13013007775. v2: Cc'ing Mika Westerberg. Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/13760 Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14147 Cc: Mika Westerberg Cc: stable@vger.kernel.org Reviewed-by: Mika Westerberg Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250519133417.1469181-1-imre.deak@intel.com commit 99354ec6409f716488887fc8094a1e63b7d35af3 Author: Suraj Kandpal Date: Thu May 15 12:48:01 2025 +0530 drm/i915/dpll: Rename intel_update_active_dpll Rename intel_update_active_dpll to intel_dpll_update_active in an effort to have function names which are exported to start with filenames they are exported from. Signed-off-by: Suraj Kandpal Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250515071801.2221120-15-suraj.kandpal@intel.com commit 71325aa5a0f18969f642fcc2a1cbb77624d357aa Author: Suraj Kandpal Date: Thu May 15 12:48:00 2025 +0530 drm/i915/dpll: Rename intel_compute_dpll Rename intel_compute_dpll to intel_dpll_compute in an effort to make sure all function names that are exported have the filename at start. Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-14-suraj.kandpal@intel.com commit bb90401b847b3702ea2f9ba727be15e697d53528 Author: Suraj Kandpal Date: Thu May 15 12:47:59 2025 +0530 drm/i915/dpll: Rename intel__dpll Rename intel__dpll to intel_dpll_ in an effort to keep names of exported functions start with the filename. Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-13-suraj.kandpal@intel.com commit c51686d8d3576bef6f842d0191214564613c4af6 Author: Suraj Kandpal Date: Thu May 15 12:47:58 2025 +0530 drm/i915/dpll: Rename intel_reference_dpll_crtc Rename intel_reference_dpll_crtc to intel_dpll_crtc_get in an effort to have all the exported functions have the name start with file name. Signed-off-by: Suraj Kandpal Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250515071801.2221120-12-suraj.kandpal@intel.com commit 3b65a01ab590684e5b68c15940ef3ab2a6a72303 Author: Suraj Kandpal Date: Thu May 15 12:47:57 2025 +0530 drm/i915/dpll: Rename intel_unreference_dpll_crtc Rename intel_unreference_dpll_crtc to intel_dpll_crtc_put in an effort to keep names of exported functions start with the filename. --v2 -Make the new name more sensible [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250515071801.2221120-11-suraj.kandpal@intel.com commit 38c5854a184cb681e0b25d675de27c1f0aa53917 Author: Suraj Kandpal Date: Thu May 15 12:47:56 2025 +0530 drm/i915/dpll: Rename intel_[enable/disable]_dpll Rename intel_[enable/disable]_dpll to intel_dpll_[enable/disable] in an effort to make sure all functions that are exported start with the filename. Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-10-suraj.kandpal@intel.com commit 7e9a4cbbc5106a6bd7fc50ebc50bb8a8d68aca75 Author: Suraj Kandpal Date: Thu May 15 12:47:55 2025 +0530 drm/i915/dpll: Rename crtc_get_shared_dpll Rename crtc_get_shared_dpll to take into the individual PLL framework which came in at DISPLAY_VER >= 14. Also having shared dpll stuff also in intel_dpll.c is just confusing. --v2 -Change naming to dpll_global to keep consistency with rest of the naming --v3 -Just use intel_dpll [Jani] --v4 -Modify commit message [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-9-suraj.kandpal@intel.com commit 2b3b9a8faf56a61634e734afc01da9a9ea1265cf Author: Suraj Kandpal Date: Thu May 15 12:47:54 2025 +0530 drm/i915/dpll: Move away from using shared dpll Rename functions to move away from using shared dpll in the dpll framework as much as possible since dpll may not always be shared. --v2 -Use intel_dpll_global instead of global_dpll [Jani] --v3 -Just use intel_dpll [Jani] --v4 -Drop the global from comments [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-8-suraj.kandpal@intel.com commit 386a183259482f3db971ac3c6b7a9126e8444034 Author: Suraj Kandpal Date: Thu May 15 12:47:53 2025 +0530 drm/i915/dpll: Rename intel_shared_dpll Rename intel_shared_dpll to intel_dpll to represent both shared and individual dplls. Since from MTL each PHY has it's own PLL making the shared PLL naming a little outdated. In an effort to make this framework accepting of future changes this needs to be done. --v2 -Use intel_dpll_global to make sure names start with the filename [Jani/Ville] -Explain the need of this rename [Jani] --v3 -Just keep it intel_dpll [Jani] --v4 -Fix comment [Jani] -Use just num_dpll and dplls [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-7-suraj.kandpal@intel.com commit 6cc235f79adb7aa594ebe18070d3b3c8d1ae1d30 Author: Suraj Kandpal Date: Thu May 15 12:47:52 2025 +0530 drm/i915/dpll: Rename intel_shared_dpll_funcs Rename intel_shared_dpll_funcs to intel_dpll_funcs since it needs to represent both shared and individual dplls. --v2 -Change intel_global_dpll to intel_dpll_global to be more in line with the naming standard where the name should start with the file name [Jani] --v3 -Drop shared and global altogether [Jani] --v4 -Keep declarations sorted [Jani] Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-6-suraj.kandpal@intel.com commit 958a33200ac7c85e95b5a5c93bb3b2004b752aed Author: Suraj Kandpal Date: Thu May 15 12:47:51 2025 +0530 drm/i915/dpll: Rename macro for_each_shared_dpll Rename the macro for_each_shared_dpll to for_each_dpll since this loop will not necessarily be used for only shared dpll in future. Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-5-suraj.kandpal@intel.com commit 139f267322d617dd9a6ac75d2e2b40110920e94c Author: Suraj Kandpal Date: Thu May 15 12:47:50 2025 +0530 drm/i915/dpll: Rename intel_shared_dpll_state Rename intel_shared_dpll_state to just intel_dpll_state since it may not necessarily store share dpll state info specially since DISPLAY_VER >= 14 PLL's are not shared. Also change the name of variables which may have been associated as a shared_dpll. Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-4-suraj.kandpal@intel.com commit e12c9b439f2cbcb574cd71ff7e14121b59ef0fe4 Author: Suraj Kandpal Date: Thu May 15 12:47:49 2025 +0530 drm/i915/dpll: Rename intel_dpll_funcs Rename intel_dpll_funcs to intel_dpll_global_funcs so that later on intel_shared_dpll_funcs can be renamed to intel_dpll_funcs. This is done to move away from the shared naming convention since starting MTL dpll's are not shared among PHYs. Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-3-suraj.kandpal@intel.com commit 537d00c8fda47250c2a763eea2b8a86708e029b0 Author: Suraj Kandpal Date: Thu May 15 12:47:48 2025 +0530 drm/i915/dpll: Rename intel_dpll Rename intel_dpll to intel_dpll_global so that intel_shared_dpll can be renamed to intel_dpll in an effort to move away from the shared naming convention. Also intel_dpll according to it's comment tracks global dpll rather than individual hence making more sense this gets changed. Signed-off-by: Suraj Kandpal Reviewed-by: Jani Nikula Link: https://lore.kernel.org/r/20250515071801.2221120-2-suraj.kandpal@intel.com commit ce6c4580334a45f3840834c880f395003f5bbc93 Author: Andy Shevchenko Date: Wed Mar 5 13:00:25 2025 +0200 accel/habanalabs: Switch to use %ptTs Use %ptTs instead of open-coded variant to print contents of time64_t type in human readable form. This changes N/A output to 1970-01-01 00:00:00 for zero timestamps, but it's used only in the dev_err() output and won't break anything. Signed-off-by: Andy Shevchenko Acked-by: Yaron Avizrat Reviewed-by: Koby Elbaz Link: https://lore.kernel.org/r/20250305110126.2134307-1-andriy.shevchenko@linux.intel.com Signed-off-by: Koby Elbaz commit 099593a28138b48feea5be8ce700e5bc4565e31d Author: Andy Yan Date: Fri May 9 11:15:59 2025 +0800 drm/rockchip: cleanup fb when drm_gem_fb_afbc_init failed In the function drm_gem_fb_init_with_funcs, the framebuffer (fb) and its corresponding object ID have already been registered. So we need to cleanup the drm framebuffer if the subsequent execution of drm_gem_fb_afbc_init fails. Directly call drm_framebuffer_put to ensure that all fb related resources are cleanup. Fixes: 7707f7227f09 ("drm/rockchip: Add support for afbc") Signed-off-by: Andy Yan Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250509031607.2542187-1-andyshrk@163.com commit d2662cf8f44a68deb6c76ad9f1d9f29dbf7ba601 Author: Shuicheng Lin Date: Tue May 13 15:30:10 2025 +0000 drm/xe: Use xe_mmio_read32() to read mtcfg register The mtcfg register is a 32-bit register and should therefore be accessed using xe_mmio_read32(). Other 3 changes per codestyle suggestion: " xe_mmio.c:83: CHECK: Alignment should match open parenthesis xe_mmio.c:131: CHECK: Comparison to NULL could be written "!xe->mmio.regs" xe_mmio.c:315: CHECK: line length of 103 exceeds 100 columns " Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs") Reviewed-by: Tejas Upadhyay Cc: Matt Roper Signed-off-by: Shuicheng Lin Link: https://lore.kernel.org/r/20250513153010.3464767-1-shuicheng.lin@intel.com Signed-off-by: Matt Roper commit 6f446bbe412ab3d75651d1cc52e31aaf801dbea8 Author: Jonas Karlman Date: Sun May 18 22:54:11 2025 +0000 dt-bindings: gpu: mali-utgard: Add Rockchip RK3528 compatible Rockchip RK3528 SoC has a Mali-450 MP2. Add a compatible for it. Signed-off-by: Jonas Karlman Acked-by: Conor Dooley Signed-off-by: Heiko Stuebner Link: https://lore.kernel.org/r/20250518225418.682182-2-jonas@kwiboo.se commit a7f87deac2295d11865048bcb9c2de369b52ed93 Author: Aradhya Bhatia Date: Fri May 16 12:43:55 2025 +0000 drm/xe: Default auto_link_downgrade status to false xe_pcode_read() can return back successfully without updating the variable 'val'. This can cause an arbitrary value to show up in the sysfs file. Allow the auto_link_downgrade_status to default to 0 to avoid any arbitrary value from coming up. Fixes: 0e414bf7ad01 ("drm/xe: Expose PCIe link downgrade attributes") Reviewed-by: Tejas Upadhyay Signed-off-by: Aradhya Bhatia Link: https://lore.kernel.org/r/20250516124355.4872-1-aradhya.bhatia@intel.com Signed-off-by: Matt Roper commit 17486cf3df5320752cc67ee8bcb2379d1b9de76c Author: Aradhya Bhatia Date: Fri May 16 14:19:02 2025 +0000 drm/xe/guc: Make creation of SLPC debugfs files conditional Platforms that do not support SLPC are exempted from the GuC PC support. The GuC PC does not get initialized, and neither do its BOs get created. This causes a problem because the GuC PC debugfs file is still being created. Whenever the file is attempted to read, it causes a NULL pointer dereference on the supposed BO of the GuC PC. So, make the creation of SLPC debugfs files conditional to when SLPC features are supported. Fixes: aaab5404b16f ("drm/xe: Introduce GuC PC debugfs") Suggested-by: Matt Roper Reviewed-by: Tejas Upadhyay Reviewed-by: Stuart Summers Signed-off-by: Aradhya Bhatia Link: https://lore.kernel.org/r/20250516141902.5614-1-aradhya.bhatia@intel.com Signed-off-by: Matt Roper commit e1123e617e510a3652fc707155adc43bb3fe4160 Author: Ankit Nautiyal Date: Mon May 5 09:09:11 2025 +0530 drm/i915/vrr: Program EMP_AS_SDP_TL for DP AS SDP The register EMP_AS_SDP_TL (MTL) was introduced for configuring the double buffering point and transmission line for all HDMI2.1 Extended Metadata Packets (VT-EMP for VRR, CVT-EMP for DSC etc). This was also intended to be configured for DP to HDMI2.1 PCON to support VRR. From BMG and LNL+ onwards, this register was extended to Display Port Adaptive Sync SDP to have a common register to configure double buffering point and transmission line for both HDMI EMPs and DP VRR related packets. Currently, we do not support VRR for either native HDMI or via PCON. However we need to configure this for DP SDP case. As per the spec, program the register to set Vsync start as the double buffering point for DP AS SDP. v2: -Make the helper more readable. (Jani) -Add more information in commit message and comment. Bspec:70984, 71197 Signed-off-by: Ankit Nautiyal Tested-by: Jouni Högander Reviewed-by: Jouni Högander Link: https://lore.kernel.org/r/20250505033911.393628-1-ankit.k.nautiyal@intel.com commit 5666e27a50666755f8a842f53dd68d6983126ac4 Author: Jouni Högander Date: Fri May 16 09:30:19 2025 +0300 drm/i915/psr: Do not read PSR2_SU_STATUS on AlderLake and onwards Bspec comment on PSR2_SU_STATUS: "This register has been tied-off since DG2/ADL-P (it returns zeros only) and it has been removed on Xe2_LPD." v2: fix inversed logic Bspec: 69889 Signed-off-by: Jouni Högander Reviewed-by: Mika Kahola Link: https://lore.kernel.org/r/20250516063019.2126702-1-jouni.hogander@intel.com commit 6c055e62560b958354625604293652753d82bcae Author: Ryan Lee Date: Thu May 1 12:54:38 2025 -0700 apparmor: ensure WB_HISTORY_SIZE value is a power of 2 WB_HISTORY_SIZE was defined to be a value not a power of 2, despite a comment in the declaration of struct match_workbuf stating it is and a modular arithmetic usage in the inc_wb_pos macro assuming that it is. Bump WB_HISTORY_SIZE's value up to 32 and add a BUILD_BUG_ON_NOT_POWER_OF_2 line to ensure that any future changes to the value of WB_HISTORY_SIZE respect this requirement. Fixes: 136db994852a ("apparmor: increase left match history buffer size") Signed-off-by: Ryan Lee Signed-off-by: John Johansen commit a949b46e7d82ef0fed09aa0590442156d44d39b1 Author: Randy Dunlap Date: Fri May 2 21:49:19 2025 -0700 apparmor: fix some kernel-doc issues in header files Fix kernel-doc warnings in apparmor header files as reported by scripts/kernel-doc: cred.h:128: warning: expecting prototype for end_label_crit_section(). Prototype was for end_current_label_crit_section() instead file.h:108: warning: expecting prototype for aa_map_file_perms(). Prototype was for aa_map_file_to_perms() instead lib.h:159: warning: Function parameter or struct member 'hname' not described in 'basename' lib.h:159: warning: Excess function parameter 'name' description in 'basename' match.h:21: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * The format used for transition tables is based on the GNU flex table perms.h:109: warning: Function parameter or struct member 'accum' not described in 'aa_perms_accum_raw' perms.h:109: warning: Function parameter or struct member 'addend' not described in 'aa_perms_accum_raw' perms.h:136: warning: Function parameter or struct member 'accum' not described in 'aa_perms_accum' perms.h:136: warning: Function parameter or struct member 'addend' not described in 'aa_perms_accum' Signed-off-by: Randy Dunlap Reviewed-by: Ryan Lee Cc: John Johansen Cc: John Johansen Cc: apparmor@lists.ubuntu.com Cc: linux-security-module@vger.kernel.org Cc: Paul Moore Cc: James Morris Cc: "Serge E. Hallyn" Signed-off-by: John Johansen commit 44fbeeb3087ee2ddce39d261d0a26688c2e22742 Author: Colin Ian King Date: Sat May 17 01:49:20 2025 -0700 apparmor: Fix incorrect profile->signal range check The check on profile->signal is always false, the value can never be less than 1 *and* greater than MAXMAPPED_SIG. Fix this by replacing the logical operator && with ||. Fixes: 84c455decf27 ("apparmor: add support for profiles to define the kill signal") Signed-off-by: Colin Ian King Signed-off-by: John Johansen commit e9ed1eb8f6217e53843d82ecf2d50f8d1a93e77c Author: Eric Biggers Date: Mon Apr 28 12:04:30 2025 -0700 apparmor: use SHA-256 library API instead of crypto_shash API This user of SHA-256 does not support any other algorithm, so the crypto_shash abstraction provides no value. Just use the SHA-256 library API instead, which is much simpler and easier to use. Signed-off-by: Eric Biggers Signed-off-by: John Johansen commit 2b270e2f43d7498ba00117c60d196435983d83d7 Author: Zilin Guan Date: Fri Apr 18 04:52:50 2025 +0000 security/apparmor: use kfree_sensitive() in unpack_secmark() The unpack_secmark() function currently uses kfree() to release memory allocated for secmark structures and their labels. However, if a failure occurs after partially parsing secmark, sensitive data may remain in memory, posing a security risk. To mitigate this, replace kfree() with kfree_sensitive() for freeing secmark structures and their labels, aligning with the approach used in free_ruleset(). I am submitting this as an RFC to seek freedback on whether this change is appropriate and aligns with the subsystem's expectations. If confirmed to be helpful, I will send a formal patch. Signed-off-by: Zilin Guan Signed-off-by: John Johansen commit 3330b71caff6cdc387fdad68a895c9c81cc2f477 Author: Rob Clark Date: Thu May 15 14:11:10 2025 -0700 drm/panel-edp: Add BOE NV133WUM-N61 panel entry Add an eDP panel for BOE NV133WUM-N61, which appears to be a 3rd panel option on the lenevo x13s laptop. edid: 00 ff ff ff ff ff ff 00 09 e5 64 09 00 00 00 00 16 1e 01 04 a5 1d 12 78 03 55 8e a7 51 4c 9c 26 0f 52 53 00 00 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 74 3c 80 a0 70 b0 28 40 30 20 36 00 1e b3 10 00 00 1a 5d 30 80 a0 70 b0 28 40 30 20 36 00 1e b3 10 00 00 1a 00 00 00 fe 00 42 4f 45 20 48 46 0a 20 20 20 20 20 20 00 00 00 fe 00 4e 56 31 33 33 57 55 4d 2d 4e 36 31 0a 00 7d datasheet: https://datasheet4u.com/pdf-down/N/V/1/NV133WUM-N61-BOE.pdf v2: Actually get the panel name correct in the table Signed-off-by: Rob Clark Reviewed-by: Douglas Anderson Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250515211110.8806-1-robdclark@gmail.com commit 01738c4f4725005b8a8cdf0205761cb24b192a23 Author: Zhang Enpei Date: Thu May 15 20:11:08 2025 +0800 drm/nouveau/dp: convert to use ERR_CAST() As opposed to open-code, use ERR_CAST to clearly indicate that this is a pointer to an error value and a type conversion is performed. Signed-off-by: Zhang Enpei Link: https://lore.kernel.org/r/20250515201108576jof-gkjSxRfMaGDgKo-pc@zte.com.cn Signed-off-by: Danilo Krummrich commit 4b1f230c875d05186604b61a28e6c7db6bd1424d Author: Dan Carpenter Date: Wed Apr 30 11:06:32 2025 +0300 drm/nouveau/fifo: small cleanup in nvkm_chan_cctx_get() "&chan->cgrp->mutex" and "&cgrp->mutex" are the same thing. Use "&cgrp->mutex" consistently. It looks nicer and it silences a Smatch static checker warning. Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/aBHaCM66pXaP84ei@stanley.mountain Signed-off-by: Danilo Krummrich commit 1c57014325ef2b62459c8482768a842f9c40cd0c Author: Gareth Yu Date: Fri May 9 17:25:39 2025 +0800 drm/i915/dsi: Enforce pipeline flush with DSI HS transfer With all of the boundary conditions when streaming the commands B2B in our validation (part of the reason we added the flush), the Flush effectively serializes the transmission of each command enqueued within the command dispatcher to one per V. Blank line which simplifies the behavior of the High Speed Arbitration. So, unless we absolutely have to burst these to the Sink, we should be using the Pipeline Flush bit to serialize the commands. Bspec: 19742, 50193 Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14247 Cc: Suraj Kandpal Cc: Jani Nikula Signed-off-by: Gareth Yu Link: https://lore.kernel.org/r/20250509092539.763389-1-gareth.yu@intel.com Signed-off-by: Jani Nikula commit e0677e52545349b76a946c75fea89aa698aeb97a Author: Philipp Stanner Date: Thu Apr 24 15:02:54 2025 +0200 drm/nouveau: Check dma_fence in canonical way In nouveau_fence_done(), a fence is checked for being signaled by manually evaluating the base fence's bits. This can be done in a canonical manner through dma_fence_is_signaled(). Replace the bit-check with dma_fence_is_signaled(). Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250424130254.42046-6-phasta@kernel.org Signed-off-by: Danilo Krummrich commit 2628009dba602d9959c9318c7732851780073523 Author: Philipp Stanner Date: Thu Apr 24 15:02:53 2025 +0200 drm/nouveau: Simplify nouveau_fence_done() nouveau_fence_done() contains an if branch that checks whether a nouveau_fence has either of the two existing nouveau_fence backend ops, which will always evaluate to true. Remove the surplus check. Signed-off-by: Philipp Stanner Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250424130254.42046-5-phasta@kernel.org Signed-off-by: Danilo Krummrich commit 2c0ddff2a60d00fa6f02de053e63e72c06f19e82 Author: Philipp Stanner Date: Thu Apr 24 15:02:52 2025 +0200 drm/nouveau: Simplify calls to nvif_event_block() nouveau_fence_signal() returns a de-facto boolean to indicate when nvif_event_block() shall be called. The code can be made more compact and readable by calling nvif_event_block() in nouveau_fence_update() directly. Make those calls in nouveau_fence.c more canonical. Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250424130254.42046-4-phasta@kernel.org Signed-off-by: Danilo Krummrich commit adc215791ab2dac76b847258cdc10bf8046f0659 Author: Philipp Stanner Date: Thu Apr 24 15:02:51 2025 +0200 drm/nouveau: nouveau_fence: Standardize list iterations nouveau_fence.c iterates over lists in a non-canonical way. Since the operations done are just basic for-each-loops and list-empty checks, they should be written in the standard form. Use standard list operations. Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250424130254.42046-3-phasta@kernel.org Signed-off-by: Danilo Krummrich commit a383cf218ef8bb35d4c03958bd956573b65cf778 Author: Tejas Upadhyay Date: Tue May 6 19:53:00 2025 +0530 drm/xe/mocs: Check if all domains awake Check if all domains are awake specially for LNCF regs Fixes: 1182bc74b39b ("drm/xe: Fix MOCS debugfs LNCF readout") Improvements-suggested-by: Himal Prasad Ghimiray Reviewed-by: Badal Nilawar Link: https://patchwork.freedesktop.org/patch/msgid/20250506142300.1865783-1-tejas.upadhyay@intel.com Signed-off-by: Tejas Upadhyay commit 921ddb37d87c13eb811b8a3280377e4dab73eccf Author: Piotr Piórkowski Date: Tue May 13 09:13:21 2025 +0200 drm/xe/pf: Don't allow LMEM provisioning if LMTT isn't available on the device The LMEM provisioning is applicable only on platforms with LMTT. v2: - new commit description - use xe_gt_assert in xe_gt_sriov_pf_config_set_lmem instead return error, - disable pf_lmem_info if LMTT is not available v3: fix condition in xe_gt_assert v4: rebase Signed-off-by: Piotr Piórkowski Cc: Michal Wajdeczko Reviewed-by: Stuart Summers Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250513071321.700464-1-piotr.piorkowski@intel.com commit d65c47f976cc4c01ec1b4f9f113606f44f384de9 Author: Ville Syrjälä Date: Mon May 12 13:33:58 2025 +0300 drm/i915/dmc: Introduce dmc_configure_event() Instead of hardcoding the event handler indices (for runtime event handler enable/disable) we can simply look for the handler with the appropriate event type. This isolates us from the firmware details a bit better. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250512103358.15724-8-ville.syrjala@linux.intel.com Reviewed-by: Luca Coelho commit d9dd810dd404ecb7bdfd3294bfb8d932e6066e05 Author: Ville Syrjälä Date: Mon May 12 13:33:57 2025 +0300 drm/i915/dmc: Extract is_event_handler() Extract the helper to determine if the mmio reg+data are the event handler register (DMC_EVT_CTL) for a specific event. We'll have another use for this for runtime event handler enable/disable. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250512103358.15724-7-ville.syrjala@linux.intel.com Reviewed-by: Luca Coelho commit 583710251f6380b973bc594d54bcf4c131c81805 Author: Ville Syrjälä Date: Mon May 12 13:33:56 2025 +0300 drm/i915/dmc: Relocate is_dmc_evt_{ctl,htp}_reg() Move is_dmc_evt_ctl_reg() to a slightly earlier position in the file so that we can reuse it in the pkgc workaround code. Also move is_dmc_evt_htp_reg() just to keep the two together. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250512103358.15724-6-ville.syrjala@linux.intel.com Reviewed-by: Luca Coelho commit 4c47d656f89a207562f99a174181789d45f571f6 Author: Ville Syrjälä Date: Mon May 12 13:33:55 2025 +0300 drm/i915/dmc: Extract dmc_evt_ctl_disable() We have two copies of the code to generate the "disable this event" value for the DMC_EVT_CTL registers. Extract to a helper. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250512103358.15724-5-ville.syrjala@linux.intel.com Reviewed-by: Luca Coelho commit 50a9875122ac0de222d617b233871f85418c7eab Author: Ville Syrjälä Date: Mon May 12 13:33:54 2025 +0300 drm/i915/dmc: Define all DMC event IDs Define all the DMC event IDs to make life less misrable when having to deal with these. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250512103358.15724-4-ville.syrjala@linux.intel.com Reviewed-by: Luca Coelho commit f91ee1a21c3716fb853d5a0d83850a1906675a92 Author: Ville Syrjälä Date: Wed May 14 20:42:57 2025 +0300 drm/i915/dmc: Hook up PIPEDMC interrupts Hook up PIPEDMC interrupts. We'll need these for: - flip queue signalling - GTT/ATS faults on LNL+ - unclaimed register access errors (supposedly that is what the error interrupt indicated according to Windows code). On LNL+ we get a new level of interrupts registers PIPEDMC_INTERRUPT*. On earlier platforms we only have the INT_VECTOR field in the PIPEDMC_STATUS registers, whose values are defined by the firmware. For now we'll enable the interrupts on LNL+ only. For earlier platforms it's not clear that there is any use for these interrupts, and some ADL machines have exhibited spurious DE_PIPE interrupts with the PIPEDMC interrupts unmasked/enabled. We can revisit enabling these for earlier platforms in the future. For some unknown reason LNL pipe B triggers the error interrupt during the first DC state transition (subsequent transitions are maybe OK?). No clear idea what's going on here yet, so keep the error interrupt disabled for now. Similar to DSB interrupt registers, the unused bits in PIPEDMC_INTERRUPT* seem to act like randomg r/w bits (instead of being hardwired to 0 like one would expect), and so we'll try to avoid setting them so that we don't mistake them for real interrupts. v2: Only enable/unmask for LNL+ Keep the flip queue interrupt masked off for now since we don't have a use for it yet v3: Also keep the error interrupt masked off for now due to LNL pipe B triggering it Reviewed-by: Luca Coelho Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250514174257.8708-1-ville.syrjala@linux.intel.com commit 24560c53664881ed833ace50febc48366b0d56a4 Author: Ville Syrjälä Date: Mon May 12 13:33:52 2025 +0300 drm/i915/dmc: Drop PIPEDMC faults from the fault mask on LNL+ On LNL+ PIPEDMC faults are reported via PIPEDMC interrupts instead of the direct DE_PIPE_* reporting used on earlier platforms. Drop the relevant bits from the fault mask. The bits are tied to zero on LNL, so there is no danger of spurious fault interrupts even with an incorrect mask. Signed-off-by: Ville Syrjälä Link: https://patchwork.freedesktop.org/patch/msgid/20250512103358.15724-2-ville.syrjala@linux.intel.com Reviewed-by: Luca Coelho commit 96b451d53ae9760858c547081532b01038f00912 Author: Jani Nikula Date: Wed May 7 18:22:54 2025 +0300 drm/{i915,xe}: convert i915 and xe display members into pointers As the first step towards making struct intel_display an opaque pointer in i915 and xe drivers, convert the struct drm_i915_private and struct xe_device display members into pointers. Initially, add temporary struct intel_display __display members, and point display at it to avoid dynamic allocation. In the future, we can drop this, and switch to dynamic allocation. The conversion is done simply with sed: sed -i 's/&\([a-zA-Z0-9_>.-]*\)\(dev_priv\|i915\|xe\)->display\([^.]\)/\1\2->display\3/g' \ $(git ls-files -- drivers/gpu/drm/i915 drivers/gpu/drm/xe) sed -i 's/\(dev_priv\|i915\|xe\)->display\./\1->display->/g' \ $(git ls-files -- drivers/gpu/drm/i915 drivers/gpu/drm/xe) With a couple of manual tweaks on top. v2: Initialize i915->display also in selftest mock_gem_device() Reviewed-by: Gustavo Sousa Signed-off-by: Jani Nikula Link: https://lore.kernel.org/r/20250507152254.2398934-1-jani.nikula@intel.com commit 702f530a647f00cf5730cfc88e4cd0e699f22351 Author: Jani Nikula Date: Wed May 7 12:38:35 2025 +0300 drm/i915: do not reference i915->display inline Always use a local variable for display instead of referencing i915->display inline. This makes it easier to convert i915->display into a pointer. Reviewed-by: Gustavo Sousa Signed-off-by: Jani Nikula Link: https://lore.kernel.org/r/afcf305e8c4ea452cee37479530958f36a10c840.1746610601.git.jani.nikula@intel.com commit bfd43f9d1e858667f34fd5d7e6dafa5ba97986be Author: Jani Nikula Date: Wed May 7 12:38:34 2025 +0300 drm/xe/display: do not reference xe->display inline Always use a local variable for display instead of referencing xe->display inline. This makes it easier to convert xe->display into a pointer. Reviewed-by: Gustavo Sousa Signed-off-by: Jani Nikula Link: https://lore.kernel.org/r/c99483ad86022d02f780bac73445baaf27a6edce.1746610601.git.jani.nikula@intel.com commit 5779b26aafeebb177430f9b56832fcf716f32c53 Author: Jani Nikula Date: Wed May 7 12:38:33 2025 +0300 drm/xe/rpm: use to_xe_device() instead of container_of Drop the dependency on display being a sub-struct of xe_device. Reviewed-by: Gustavo Sousa Signed-off-by: Jani Nikula Link: https://lore.kernel.org/r/3528f2cd5965e97248c161b8aa25a9df69606a39.1746610601.git.jani.nikula@intel.com commit db5302ae571beec635c1a96e7f72926a4e65195e Merge: d0bf684bd42db2 7cf346fcf99815 Author: Jani Nikula Date: Fri May 16 10:22:36 2025 +0300 Merge drm/drm-next into drm-intel-next Backmerge to sync with v6.15-rc, xe, and specifically async flip changes in drm-misc. Signed-off-by: Jani Nikula commit a26fd92b7223160ad31c3e2971b63178faed9cf5 Author: Huan Yang Date: Mon Apr 28 15:38:30 2025 +0800 udmabuf: fix vmap missed offset page Before invoke vmap, we need offer a pages pointer array which each page need to map in vmalloc area. But currently vmap_udmabuf only set each folio's head page into pages, missed each offset pages when iter. This patch set the correctly offset page in each folio into array. Signed-off-by: Huan Yang Fixes: 5e72b2b41a21 ("udmabuf: convert udmabuf driver to use folios") Acked-by: Vivek Kasireddy Signed-off-by: Vivek Kasireddy Link: https://lore.kernel.org/r/20250428073831.19942-3-link@vivo.com commit ceb7b62eaaaacfcf87473bd2e99ac73a758620cb Author: Huan Yang Date: Mon Apr 28 15:38:29 2025 +0800 Revert "udmabuf: fix vmap_udmabuf error page set" This reverts commit 18d7de823b7150344d242c3677e65d68c5271b04. We cannot use vmap_pfn() in vmap_udmabuf() as it would fail the pfn_valid() check in vmap_pfn_apply(). This is because vmap_pfn() is intended to be used for mapping non-struct-page memory such as PCIe BARs. Since, udmabuf mostly works with pages/folios backed by shmem/hugetlbfs/THP, vmap_pfn() is not the right tool or API to invoke for implementing vmap. Signed-off-by: Huan Yang Suggested-by: Vivek Kasireddy Reported-by: Bingbu Cao Closes: https://lore.kernel.org/dri-devel/eb7e0137-3508-4287-98c4-816c5fd98e10@vivo.com/T/#mbda4f64a3532b32e061f4e8763bc8e307bea3ca8 Acked-by: Vivek Kasireddy Signed-off-by: Vivek Kasireddy Link: https://lore.kernel.org/r/20250428073831.19942-2-link@vivo.com commit 16b7e65d299d56442879405ac85800877fa51355 Author: John Harrison Date: Mon May 12 14:53:24 2025 -0700 drm/xe/guc: Track FAST_REQ H2Gs to report where errors came from Most H2G messages are FAST_REQ which means no synchronous response is expected. The messages are sent as fire-and-forget with no tracking. However, errors can still be returned when something goes unexpectedly wrong. That leads to confusion due to not being able to match up the error response to the originating H2G. So add support for tracking the FAST_REQ H2Gs and matching up an error response to its originator. This is only enabled in XE_DEBUG builds given that such errors should never happen in a working system and there is an overhead for the tracking. Further, if XE_DEBUG_GUC is enabled then even more memory and time is used to record the call stack of each H2G and report that with the error. That makes it much easier to work out where a specific H2G came from if there are multiple code paths that can send it. v2: Some re-wording of comments and prints, more consistent use of #if vs stub functions - review feedback from Daniele & Michal). v3: Split config change to separate patch, improve a debug print (review feedback from Michal). v4: Bunch of minor tweaks (review feedback from Michal). Original-i915-code: Michal Wajdeczko Signed-off-by: John Harrison Reviewed-by: Daniele Ceraolo Spurio Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250512215324.1457009-5-John.C.Harrison@Intel.com commit d7d97890e2a7e3e306494dcbfb0e468a5089380d Author: John Harrison Date: Mon May 12 14:53:23 2025 -0700 drm/xe/guc: Rename CONFIG_XE_LARGE_GUC_BUFFER Rename XE_LARGE_GUC_BUFFER to XE_DEBUG_GUC to allow for more debug only code (in subsequent patch) without adding more config defines that each control only a single thing. Signed-off-by: John Harrison Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250512215324.1457009-4-John.C.Harrison@Intel.com commit 12373b30e27cffd4244453ed3bceb52504d7563f Author: John Harrison Date: Mon May 12 14:53:22 2025 -0700 drm/xe/guc: Add missing H2G error code definitions These error codes are not actually used in the driver but it is extremely useful to have them available to understand error messages. v2: Add a bunch more error codes and drop 'status' from names (review feedback by Michal W). v3: Drop 'SUCCESS' response as meaningless in current API (review feedback by Michal W). Signed-off-by: John Harrison Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250512215324.1457009-3-John.C.Harrison@Intel.com commit fddf8cdd4b9b7373f32f77e7a89123394e630188 Author: John Harrison Date: Mon May 12 14:53:21 2025 -0700 drm/xe/guc: Remove double blank line An earlier patch moved a drm_print a few lines lower but accidentally left a double blank line behind. So fix that. Signed-off-by: John Harrison Reviewed-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250512215324.1457009-2-John.C.Harrison@Intel.com commit 9b961744a83a3027b8d4b97fe1fc587334883ce8 Author: Ville Syrjälä Date: Mon May 12 21:22:16 2025 +0200 drm/i915/pci: Remove force_probe requirement for DG1 Dunno why we still have .require_force_probe=1 on DG1 after all this time. I'm not aware of any real problems with DG1, so get rid of the force_probe requirement. Generally the difficulty with DG1 is that it requires a 4GiB BAR for the local memory, and that's not something that works on every system. Reviewed-by: Andi Shyti Signed-off-by: Ville Syrjälä Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250411144313.11660-3-ville.syrjala@linux.intel.com commit d6e020819612a4a06207af858e0978be4d3e3140 Author: Ville Syrjälä Date: Mon May 12 21:22:15 2025 +0200 drm/i915/gem: Allow EXEC_CAPTURE on recoverable contexts on DG1 The intel-media-driver is currently broken on DG1 because it uses EXEC_CAPTURE with recovarable contexts. Relax the check to allow that. I've also submitted a fix for the intel-media-driver: https://github.com/intel/media-driver/pull/1920 Cc: stable@vger.kernel.org # v6.0+ Cc: Matthew Auld Cc: Thomas Hellström Testcase: igt/gem_exec_capture/capture-invisible Fixes: 71b1669ea9bd ("drm/i915/uapi: tweak error capture on recoverable contexts") Reviewed-by: Andi Shyti Signed-off-by: Ville Syrjälä Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/20250411144313.11660-2-ville.syrjala@linux.intel.com commit eaa287069a70aa80e5e95d5162445962809d8158 Author: Lucas De Marchi Date: Tue May 13 07:25:49 2025 -0700 drm/xe/guc_submit: Simplify and fix diff calculation With a u32 type, there's no need to check which one is greater: the current is always the latest and if it's less than the previous, it's because it wrapped: just do the unsigned calculation that will lead to the same result, or better the correct one. It fixes an off-by-one in the wrapped calculation, however that doesn't really matter for the timeout calculation. Reviewed-by: Raag Jadav Reviewed-by: Umesh Nerlige Ramappa Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250513-time-wrap-v1-1-fba9a69a65c8@intel.com Signed-off-by: Lucas De Marchi commit 549810e918155cc00d65d44ed3e7d2bd0aa89df9 Author: Tvrtko Ursulin Date: Thu May 15 10:49:56 2025 +0100 dma-fence: Change signature of __dma_fence_is_later With the goal of reducing the need for drivers to touch (and dereference) fence->ops, we change the prototype of __dma_fence_is_later() to take fence instead of fence->ops. Signed-off-by: Tvrtko Ursulin Reviewed-by: Christian König Link: https://lore.kernel.org/r/20250515095004.28318-2-tvrtko.ursulin@igalia.com Signed-off-by: Christian König commit 4963049ea1aed7b5aefe164867e0312185e878bc Author: Ryosuke Yasuoka Date: Sun Apr 27 19:18:23 2025 +0900 drm/hyperv: Replace simple-KMS with regular atomic helpers Drop simple-KMS in favor of regular atomic helpers to make the code more modular. The simple-KMS helper mix up plane and CRTC state, so it is obsolete and should go away [1]. Since it just split the simple-pipe functions into per-plane and per-CRTC, no functional changes is expected. [1] https://lore.kernel.org/lkml/dae5089d-e214-4518-b927-5c4149babad8@suse.de/ Acked-by: Javier Martinez Canillas Signed-off-by: Ryosuke Yasuoka Link: https://lore.kernel.org/r/20250427101825.812766-1-ryasuoka@redhat.com Signed-off-by: Jocelyn Falempe commit 3dbab383e3afe999d9e9513cd9a67883b6750358 Author: Michal Wajdeczko Date: Tue May 13 00:00:18 2025 +0200 drm/xe/guc: Don't allocate managed BO for each policy change We shouldn't use xe_managed_bo_create_from_data() to allocate temporary BO, as it will be released only on unload and every change in wedge_mode policy will consume resources (including precious GGTT). Instead just switchover to GuC buffer cache. Signed-off-by: Michal Wajdeczko Cc: John Harrison Cc: Rodrigo Vivi Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250512220018.172-3-michal.wajdeczko@intel.com commit b86babc9d92f0a5fbbc7ab4c7d09bce688f94ebf Author: Michal Wajdeczko Date: Tue May 13 00:00:17 2025 +0200 drm/xe/guc: Unblock GuC buffer cache for all modes Today we were using GuC buffer cache only in the PF mode, but shortly we will want to use it also in native and VF mode. Signed-off-by: Michal Wajdeczko Cc: Daniele Ceraolo Spurio Reviewed-by: Matthew Brost Reviewed-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250512220018.172-2-michal.wajdeczko@intel.com commit 5aee6e33e19593dafc42f9afb59fd2c53f75141f Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:28 2025 +0530 drm/xe/vm: Add debug prints for SVM range prefetch Introduce debug logs for the prefetch operation of SVM ranges. Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250513040228.470682-16-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 09ba0a8f06cd69d93eef0dc3bee33546880e46f8 Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:27 2025 +0530 drm/xe/svm: Implement prefetch support for SVM ranges This commit adds prefetch support for SVM ranges, utilizing the existing ioctl vm_bind functionality to achieve this. v2: rebase v3: - use xa_for_each() instead of manual loop - check range is valid and in preferred location before adding to xarray - Fix naming conventions - Fix return condition as -ENODATA instead of -EAGAIN (Matthew Brost) - Handle sparsely populated cpu vma range (Matthew Brost) v4: - fix end address to find next cpu vma in case of -ENOENT v5: - Move find next vma logic to drm gpusvm layer - Avoid mixing declaration and logic v6: - Use new function names - Move eviction logic to prefetch_ranges v7: - devmem_only assigned 0 - nit address v8: - initialize ctx with 0 Cc: Matthew Brost Acked-by: Thomas Hellström Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250513040228.470682-15-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit c904d4e2d73216c31487501b774afa9e3ed8be29 Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:26 2025 +0530 drm/xe/svm: Add xe_svm_find_vma_start() helper Add helper xe_svm_find_vma_start() function to determine start of cpu vma in input range. Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://lore.kernel.org/r/20250513040228.470682-14-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 72fa870957f53314bfa4b75bd3d402b72fab17ee Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:25 2025 +0530 drm/gpusvm: Introduce drm_gpusvm_find_vma_start() function The drm_gpusvm_find_vma_start() function is used to determine the starting address of a CPU VMA within a specified user range. If the range does not contain any VMA, the function returns ULONG_MAX. v2 - Rename function as drm_gpusvm_find_vma_start() (Matthew Brost) - mmget/mmput v3 - s/mmget/mmget_not_zero/ Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250513040228.470682-13-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 6275362f1837ba538956d05e1c6120db3a635631 Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:24 2025 +0530 drm/xe/svm: Add xe_svm_range_validate() and xe_svm_range_migrate_to_smem() The xe_svm_range_validate() function checks if a range is valid and located in the desired memory region. xe_svm_range_migrate_to_smem() checks if range have pages in devmem and migrate them to smem. v2 - Fix function stub in xe_svm.h - Fix doc v3 (Matthew Brost) - Remove extra new line - s/range->base.flags.has_devmem_pages/xe_svm_range_in_vram v4 (Matthew Brost) - s/xe_svm_range_in_vram/range->base.flags.has_devmem_pages - Move eviction logic to separate function Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://lore.kernel.org/r/20250513040228.470682-12-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit cc795e0410342076a4ad65ca2b5450cda779f784 Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:23 2025 +0530 drm/xe/svm: Make xe_svm_range_needs_migrate_to_vram() public xe_svm_range_needs_migrate_to_vram() determines whether range needs migration to vram or not, modify it to accept region preference parameter too, so we can use it in prefetch too. v2 - add assert instead of warn (Matthew Brost) Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250513040228.470682-11-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit e0ff0d7cf928fdd0e52565dd6285c46ccf3bce89 Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:22 2025 +0530 drm/xe/svm: Refactor usage of drm_gpusvm* function in xe_svm Define xe_svm_range_find_or_insert function wrapping drm_gpusvm_range_find_or_insert for reusing in prefetch. Define xe_svm_range_get_pages function wrapping drm_gpusvm_range_get_pages for reusing in prefetch. -v2 pass pagefault defined drm_gpu_svm context as parameter in xe_svm_range_find_or_insert(Matthew Brost) Cc: Matthew Brost Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://lore.kernel.org/r/20250513040228.470682-10-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit da05e5ddc652d1ab66efddc52e32a8770a89cbd9 Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:21 2025 +0530 drm/xe: Rename lookup_vma function to xe_find_vma_by_addr This update renames the lookup_vma function to xe_vm_find_vma_by_addr and makes it accessible externally. The function, which looks up a VMA by its address within a specified VM, will be utilized in upcoming patches. v2 - Fix doc Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://lore.kernel.org/r/20250513040228.470682-9-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit bd1d1b46fe42a248916172cdf3cded07b7d93f8a Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:20 2025 +0530 drm/xe/vm: Add an identifier in xe_vma_ops for svm prefetch Add a flag in xe_vma_ops to determine whether it has svm prefetch ops or not. v2: - s/false/0 (Matthew Brost) v3: - s/XE_VMA_OPS_HAS_SVM_PREFETCH/XE_VMA_OPS_FLAG_HAS_SVM_PREFETCH Suggested-by: Matthew Brost Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://lore.kernel.org/r/20250513040228.470682-8-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 34ebb62723aa766be85ea38fac7e651bfaca6a61 Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:19 2025 +0530 drm/xe/vm: Update xe_vma_ops_incr_pt_update_ops to take an increment value Prefetch for SVM ranges can have more than one operation to increment, hence modify the function to accept an increment value as input. v2: - Call xe_vma_ops_incr_pt_update_ops only once for REMAP (Matthew Brost) - Add check for 0 ops v3: - s/u8/int for inc_val and num_remap_ops (Matthew Brost) Suggested-by: Matthew Brost Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://lore.kernel.org/r/20250513040228.470682-7-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit da2eb41004e955293675a4049da94084ebd41241 Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:18 2025 +0530 drm/xe/svm: Make xe_svm_range_* end/start/size public These functions will be used in prefetch too, therefore make them public. v2 - Fix kernel doc Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://lore.kernel.org/r/20250513040228.470682-6-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 18211ff4d57381476cf34bc6a8883eccee9a893a Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:17 2025 +0530 drm/xe/svm: Make to_xe_range a public function The to_xe_range function will be used in other files. Therefore, make it public and add kernel-doc documentation Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://lore.kernel.org/r/20250513040228.470682-5-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit eb07c2fc10bf9b98fb5df8a78ce707e3a20b5443 Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:16 2025 +0530 drm/xe/svm: Helper to add tile masks to svm ranges Introduce a helper to add tile mask of binding present and invalidated for the range. Add a lockdep_assert to ensure it is protected by GPU SVM notifier lock. -v7 rebased Suggested-by: Matthew Brost Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250513040228.470682-4-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 686a526dad183e1ca7fc2f38df34b1dd3c7c387e Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:15 2025 +0530 drm/xe: Make xe_svm_alloc_vram public This function will be used in prefetch too, hence make it public. v2: - Add kernel-doc (Matthew Brost) - Rebase v3: - Move CONFIG_DRM_XE_DEVMEM_MIRROR stub out to xe_svm.c (Matthew Brost) Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://lore.kernel.org/r/20250513040228.470682-3-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit 745df157e4f2d695a9149ff964abe77490b1e96c Author: Himal Prasad Ghimiray Date: Tue May 13 09:32:14 2025 +0530 drm/xe: Introduce xe_vma_op_prefetch_range struct for prefetch of ranges Add xe_vma_op_prefetch_range struct for svm ranges prefetching, including an xarray of SVM range pointers, range count, and target memory region. -v2: Fix doc Reviewed-by: Matthew Brost Acked-by: Thomas Hellström Link: https://lore.kernel.org/r/20250513040228.470682-2-himal.prasad.ghimiray@intel.com Signed-off-by: Himal Prasad Ghimiray commit d0bf684bd42db22e7d131a038f8f78927fa6a72a Author: Imre Deak Date: Mon May 12 17:26:00 2025 +0300 drm/i915/ptl: Use everywhere the correct DDI port clock select mask The PTL XELPDP_PORT_CLOCK_CTL register XELPDP_DDI_CLOCK_SELECT field's size is 5 bits vs. the earlier platforms where its size is 4 bits. Make sure the field is read-out/programmed everywhere correctly, according to the above. Cc: Mika Kahola Cc: stable@vger.kernel.org # v6.13+ Tested-by: Mika Kahola Reviewed-by: Mika Kahola Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250512142600.824347-1-imre.deak@intel.com commit 9934ab18051118385c7ea44d8e14175edbe6dc9c Author: Philipp Stanner Date: Wed May 14 09:31:27 2025 +0200 drm/vmwgfx: Use non-hybrid PCI devres API vmwgfx enables its PCI device with pcim_enable_device(). This, implicitly, switches the function pci_request_regions() into managed mode, where it becomes a devres function. The PCI subsystem wants to remove this hybrid nature from its interfaces. To do so, users of the aforementioned combination of functions must be ported to non-hybrid functions. Moreover, since both functions are already managed in this driver, the calls to pci_release_regions() are unnecessary. Remove the calls to pci_release_regions(). Replace the call to sometimes-managed pci_request_regions() with one to always-managed pcim_request_all_regions(). Signed-off-by: Philipp Stanner Reviewed-by: Zack Rusin Signed-off-by: Zack Rusin Link: https://lore.kernel.org/r/20250514073126.85443-2-phasta@kernel.org commit e2e02eb978c590e7278413eecd93142218609419 Author: Jani Nikula Date: Tue May 13 12:28:45 2025 +0300 drm/i915/display: drop unnecessary includes on i915 core headers These includes have become unnecessary. Drop them. Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/6ca3be3e3fbbd99c169345c3add4b76315390e77.1747128495.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a1216d84f13ca53c107cba99311a90177eeaa508 Author: Jani Nikula Date: Tue May 13 12:28:44 2025 +0300 drm/i915/gem: drop intel_display.h include The include is not needed since commit 44a34dec43e8 ("drm/i915: Calculate the VT-d guard size in the display code"). Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/80ea203e004b7378c14f2367258b5785e40bf126.1747128495.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 1882dc90dfb13450f3c1ca5e529fa6a4f80c6e44 Author: Jani Nikula Date: Tue May 13 12:28:43 2025 +0300 drm/i915/display: drop unused declarations from intel_display.h We've accumulated lots of forward declarations in intel_display.h that are no longer necessary. Clean them up. Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/5ad046b74040e84fab51786c346ff9a445e351bc.1747128495.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit c00d3615969e9bba610c83050f308aee75341156 Author: Jani Nikula Date: Tue May 13 12:28:42 2025 +0300 drm/i915/rps: pass struct intel_display to DISPLAY_VER() Avoid passing drm_i915_private to DISPLAY_VER(). Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/5e97ee7675b32397163eb4fba17184fc1c5a04cd.1747128495.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 59cbff3a8f766adede869a955fb92924bb3707a9 Author: Jani Nikula Date: Tue May 13 12:28:41 2025 +0300 drm/i915/pps: drop dependency on intel_display_conversion.h All the PPS register users have been converted to struct intel_display. The backward compat conversion to struct drm_i915_private is no longer needed. Drop it, along with the include, and convert the dev_priv macro parameter names to display while at it. Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/4c23fd8dfcadefeeb52189045421084bcfd50d57.1747128495.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit a8eb102ce0944a9de2a62aa9d195861b7f26668a Author: Jouni Högander Date: Tue May 13 08:48:14 2025 +0300 drm/i915/alpm: Stop writing ALPM registers when PSR is enabled Currently we are seeing these on PTL: xe 0000:00:02.0: [drm] *ERROR* Timeout waiting for DDI BUF A to get active These seem to be caused by writing ALPM registers while Panel Replay is enabled. Fix this by writing ALPM registers only when Panel Replay is about to be enabled. v4: improve comment on intel_psr_panel_replay_enable_sink call v3: enable/disable ALPM from PSR code Fixes: 172757acd6f6 ("drm/i915/lobf: Add lobf enablement in post plane update") Signed-off-by: Jouni Högander Reviewed-by: Suraj Kandpal Link: https://lore.kernel.org/r/20250513054814.3702977-3-jouni.hogander@intel.com commit 2d278488761f0b5be651a3db41e615a964123d6c Author: Jouni Högander Date: Tue May 13 08:48:13 2025 +0300 drm/i915/alpm: Make intel_alpm_enable_sink available for PSR We want to enable sink ALPM from PSR code. Make intel_alpm_enable_sink available for PSR. v2: do not add kerneldoc comments Reviewed-by: Suraj Kandpal Signed-off-by: Jouni Högander Link: https://lore.kernel.org/r/20250513054814.3702977-2-jouni.hogander@intel.com commit 217f80acfcf126b7d7d7b818c9bfea3c96fa85ec Author: Liu Ying Date: Mon Apr 14 11:50:22 2025 +0800 MAINTAINERS: Add maintainer for i.MX8qxp Display Controller Add myself as the maintainer of i.MX8qxp Display Controller. Signed-off-by: Liu Ying Reviewed-by: Maxime Ripard Link: https://lore.kernel.org/r/20250414035028.1561475-14-victor.liu@nxp.com commit 711a3b8783666ffd24ca99ae1c0fde76315b27a9 Author: Liu Ying Date: Mon Apr 14 11:50:21 2025 +0800 drm/imx: Add i.MX8qxp Display Controller KMS i.MX8qxp Display Controller(DC) is comprised of three main components that include a blit engine for 2D graphics accelerations, display controller for display output processing, as well as a command sequencer. Add kernel mode setting support for the display controller part with two CRTCs and two primary planes(backed by FetchLayer and FetchWarp respectively). The registers of the display controller are accessed without command sequencer involved, instead just by using CPU. The command sequencer is supposed to be used by the blit engine. Reviewed-by: Maxime Ripard Reviewed-by: Dmitry Baryshkov Signed-off-by: Liu Ying Link: https://lore.kernel.org/r/20250414035028.1561475-13-victor.liu@nxp.com commit 37571feb6c08dab97f0a8a37e3c486aa8aead5f7 Author: Liu Ying Date: Mon Apr 14 11:50:20 2025 +0800 drm/imx: Add i.MX8qxp Display Controller interrupt controller i.MX8qxp Display Controller has a built-in interrupt controller to support Enable/Status/Preset/Clear interrupt bit. Add driver for it. Reviewed-by: Maxime Ripard Reviewed-by: Dmitry Baryshkov Signed-off-by: Liu Ying Link: https://lore.kernel.org/r/20250414035028.1561475-12-victor.liu@nxp.com commit 0e177d5ce01ca52c5c754afbe8773d4ed5626cd6 Author: Liu Ying Date: Mon Apr 14 11:50:19 2025 +0800 drm/imx: Add i.MX8qxp Display Controller pixel engine i.MX8qxp Display Controller pixel engine consists of all processing units that operate in the AXI bus clock domain. Add drivers for ConstFrame, ExtDst, FetchLayer, FetchWarp and LayerBlend units, as well as a pixel engine driver, so that two displays with primary planes can be supported. The pixel engine driver and those unit drivers are components to be aggregated by a master registered in the upcoming DRM driver. Reviewed-by: Maxime Ripard Signed-off-by: Liu Ying Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250414035028.1561475-11-victor.liu@nxp.com commit 9f09e3173776b9da4fde0c0641d1d1e9d08fcf46 Author: Liu Ying Date: Mon Apr 14 11:50:18 2025 +0800 drm/imx: Add i.MX8qxp Display Controller display engine i.MX8qxp Display Controller display engine consists of all processing units that operate in a display clock domain. Add minimal feature support with FrameGen and TCon so that the engine can output display timings. The FrameGen driver, TCon driver and display engine driver are components to be aggregated by a master registered in the upcoming DRM driver. Reviewed-by: Maxime Ripard Signed-off-by: Liu Ying Reviewed-by: Dmitry Baryshkov Link: https://lore.kernel.org/r/20250414035028.1561475-10-victor.liu@nxp.com commit 813f71ac2541d12e146cdb9ac3a81432e6687625 Author: Liu Ying Date: Mon Apr 14 11:50:17 2025 +0800 dt-bindings: display: imx: Add i.MX8qxp Display Controller i.MX8qxp Display Controller(DC) is comprised of three main components that include a blit engine for 2D graphics accelerations, display controller for display output processing, as well as a command sequencer. Signed-off-by: Liu Ying Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250414035028.1561475-9-victor.liu@nxp.com commit 57e464a30d335c2fd8f64449ac2170ce7c2f3662 Author: Liu Ying Date: Mon Apr 14 11:50:16 2025 +0800 dt-bindings: interrupt-controller: Add i.MX8qxp Display Controller interrupt controller i.MX8qxp Display Controller has a built-in interrupt controller to support Enable/Status/Preset/Clear interrupt bit. Signed-off-by: Liu Ying Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250414035028.1561475-8-victor.liu@nxp.com commit c809469f25fde307190a38c99982f91e5df53ac7 Author: Liu Ying Date: Mon Apr 14 11:50:15 2025 +0800 dt-bindings: display: imx: Add i.MX8qxp Display Controller command sequencer i.MX8qxp Display Controller contains a command sequencer is designed to autonomously process command lists. Signed-off-by: Liu Ying Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250414035028.1561475-7-victor.liu@nxp.com commit e0390da391b9c240a309790fd226caa3d906cf8c Author: Liu Ying Date: Mon Apr 14 11:50:14 2025 +0800 dt-bindings: display: imx: Add i.MX8qxp Display Controller AXI performance counter i.MX8qxp Display Controller contains a AXI performance counter which allows measurement of average bandwidth and latency during operation. Signed-off-by: Liu Ying Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250414035028.1561475-6-victor.liu@nxp.com commit 69c78e7e8c2a65a007ba92d8c780365fed0aff5d Author: Liu Ying Date: Mon Apr 14 11:50:13 2025 +0800 dt-bindings: display: imx: Add i.MX8qxp Display Controller pixel engine i.MX8qxp Display Controller pixel engine consists of all processing units that operate in the AXI bus clock domain. Command sequencer and interrupt controller of the Display Controller work with AXI bus clock, but they are not in pixel engine. Signed-off-by: Liu Ying Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250414035028.1561475-5-victor.liu@nxp.com commit 33ce3179110db1e83fb7e99d102dd7c3a0e7d55d Author: Liu Ying Date: Mon Apr 14 11:50:12 2025 +0800 dt-bindings: display: imx: Add i.MX8qxp Display Controller display engine i.MX8qxp Display Controller display engine consists of all processing units that operate in a display clock domain. Signed-off-by: Liu Ying Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250414035028.1561475-4-victor.liu@nxp.com commit b71d3ace779f3e8d6790dbe40c37883ed8be4106 Author: Liu Ying Date: Mon Apr 14 11:50:11 2025 +0800 dt-bindings: display: imx: Add i.MX8qxp Display Controller blit engine i.MX8qxp Display Controller contains a blit engine for raster graphics. It may read up to 3 source images from memory and computes one destination image from it, which is written back to memory. Signed-off-by: Liu Ying Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250414035028.1561475-3-victor.liu@nxp.com commit 1c0ff333f2fe69d571798c11f0277985ce146358 Author: Liu Ying Date: Mon Apr 14 11:50:10 2025 +0800 dt-bindings: display: imx: Add i.MX8qxp Display Controller processing units Freescale i.MX8qxp Display Controller is implemented as construction set of building blocks with unified concept and standardized interfaces. Document all existing processing units. Signed-off-by: Liu Ying Reviewed-by: Rob Herring (Arm) Link: https://lore.kernel.org/r/20250414035028.1561475-2-victor.liu@nxp.com commit 1f372c1fc6cff841e85913ad2b3b3680e94eabac Author: hienhuynh Date: Thu May 8 10:50:35 2025 +0100 drm: rz-du: Support panels connected directly to the DPAD output This patch is based on the commit 73eb5476df72 ("drm: rcar-du: Support panels connected directly to the DPAD outputs"). The RZ DU driver assumes that a bridge is always connected to the DU output. This is valid for the HDMI output, but the DPAD output can be connected directly to a panel, in which case no bridge is available. To support this use case, detect whether the entities connected to the DU DPAD output is encoders or panels based on the number of ports of their DT node, and retrieve the corresponding type of DRM objects. For panels, additionally create panel bridge instances. Signed-off-by: hienhuynh Signed-off-by: Biju Das Reviewed-by: Tommaso Merciai Tested-by: Tommaso Merciai Link: https://lore.kernel.org/r/20250508095042.25164-1-biju.das.jz@bp.renesas.com commit 64a8d0aa55e98bf2c9b7e1a3df3e8acbfecba619 Author: Asahi Lina Date: Tue Mar 18 16:22:35 2025 -0300 drm/shmem-helper: Add lockdep asserts to vmap/vunmap Since commit 21aa27ddc582 ("drm/shmem-helper: Switch to reservation lock"), the drm_gem_shmem_vmap and drm_gem_shmem_vunmap functions require that the caller holds the DMA reservation lock for the object. Add lockdep assertions to help validate this. Signed-off-by: Asahi Lina Signed-off-by: Daniel Almeida Reviewed-by: Christian König Signed-off-by: Lyude Paul Link: https://lore.kernel.org/r/20250318-drm-gem-shmem-v1-1-64b96511a84f@collabora.com commit e33c3f4d935454a6f8a18a5913189f060b9140ef Author: Philipp Stanner Date: Fri Mar 14 11:10:24 2025 +0100 drm/sched: Remove kthread header The kthread header doesn't need to be included anymore. It's a relict from commit a6149f039369 ("drm/sched: Convert drm scheduler to use a work queue rather than kthread"). Remove the unneeded includes. Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250314101023.111248-3-phasta@kernel.org commit 1773ea5caf0b6640aada70411eba6d33fef8e1d5 Author: Philipp Stanner Date: Fri Mar 14 11:10:23 2025 +0100 drm/sched: Fix outdated comments referencing thread The GPU scheduler's comments refer to a "thread" at various places. Those are leftovers from commit a6149f039369 ("drm/sched: Convert drm scheduler to use a work queue rather than kthread"). Replace all references to kthreads. Reviewed-by: Tvrtko Ursulin Signed-off-by: Philipp Stanner Link: https://lore.kernel.org/r/20250314101023.111248-2-phasta@kernel.org commit 46462c4e0fa469ca83e0bfea463ab3d14147e8d1 Author: Jocelyn Falempe Date: Wed May 7 09:51:47 2025 +0200 MAINTAINERS: Add entries for drm_panic, drm_panic_qr_code and drm_log Add myself and Javier as maintainer for drm_panic, drm_panic_qr_code and drm_log. Acked-by: Thomas Zimmermann Acked-by: Javier Martinez Canillas Link: https://lore.kernel.org/r/20250507075529.263355-1-jfalempe@redhat.com Signed-off-by: Jocelyn Falempe commit 16fa6b89990a76302446f5c4e866991ef08bcf1e Author: Tvrtko Ursulin Date: Mon May 12 08:20:47 2025 +0100 drm/i915: Use provided dma_fence_is_chain Replace open-coded helper with the subsystem one. Signed-off-by: Tvrtko Ursulin Reviewed-by: Matthew Brost Signed-off-by: Tvrtko Ursulin Link: https://lore.kernel.org/r/20250512072047.56851-1-tvrtko.ursulin@igalia.com commit 11b5b1bd97ef927ab8c5c41ce35d3397f590384a Author: Jani Nikula Date: Mon May 12 17:56:59 2025 +0300 drm/i915: ensure correct VLV IOSF SB units have been get/put Add some extra paranoia to check correct use of the VLV IOSF SB get/put/read/write. Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/be6f029adf7148198821e5fe01dcf5d5406aa1fe.1747061743.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 52d8361531d605d6a3f9b40203412c439eb52b0c Author: Jani Nikula Date: Mon May 12 17:56:58 2025 +0300 drm/i915: rename VLV IOSF SB ports parameter to unit_mask Clarify what the parameter is about through proper naming. Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/b1be9a4089dfbf48ea1434944a4841d2ac4c4acc.1747061743.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit bd4d1856f5fe427ad20d54c57bd0f2724f7be47e Author: Jani Nikula Date: Mon May 12 17:56:57 2025 +0300 drm/i915: convert VLV IOSF SB interface to struct drm_device With users both in i915 core and display, struct drm_device is the common denominator for the VLV IOSF SB users. Also use drm_device for the helpers on the display side to keep the static inlines as simple as possible. We can drop a number of dependencies on i915_drv.h with this. v2,v3: Rebase Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/c1d013ed88ce2e3e5bdc15ce3bf01a3960b1e817.1747061743.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 8393253b850b6a5c62d4bb875b582e1582103db8 Author: Jani Nikula Date: Mon May 12 17:56:56 2025 +0300 drm/i915: move VLV IOSF SB unit specific helpers under display Now that all the VLV IOSF SB unit specific helper users are under display, relocate the helpers themselves under display as well. Resurrect the vlv_sideband.[ch] name for this. Make everything except DPIO helpers static inlines, as their implementations are trivial. All of this considerably simplifies the xe compat header. v2: Rebase Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/e86c2498c9f1c1d30f8e83fa5f1c23526b87b9ab.1747061743.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit ead7a1a59e37cc7134e98e3121d0962940a1c1d9 Author: Jani Nikula Date: Mon May 12 17:56:55 2025 +0300 drm/i915: switch i915 core to generic VLV IOSF SB functions We'll want to relocate the unit specific functions to display, making them inaccessible to i915 core. As there aren't that many users in i915 core, we can just convert them to the generic VLV IOSF SB read/write functions. v2: Use BIT(unit) for get/put Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/3162c8768eeeba928bbc3d4aa2ddfc6a1030a451.1747061743.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 5c76b7178b511019c0c5f5544d9bfc4b9589f0d4 Author: Jani Nikula Date: Mon May 12 17:56:54 2025 +0300 drm/i915: rewrite VLV IOSF SB unit specific read/write functions Rewrite the VLV IOSF SB unit specific helpers in terms of the new generic read/write functions. They become even simpler than they were. The DPIO get/put helpers need to get/put both DPIO units. v2: get/put both DPIO units Reviewed-by: Ville Syrjälä # v1 Link: https://lore.kernel.org/r/df97dafa0f7b665e2078c392f0dc3edc59655b0a.1747061743.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 7e9f0cc24bb6a2121a6abaef401d429f94ea2e8b Author: Jani Nikula Date: Mon May 12 17:56:53 2025 +0300 drm/i915: add generic read/write functions for VLV IOSF SB The read/write functions will be helpful for rewriting the unit specific functions. v2: Fix checkpatch complaint on indent Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/babe42609c7a2056aff301320efbda534d20ad82.1747061743.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 6819b5a67e7014352906f82ddedafb602ac8d45d Author: Jani Nikula Date: Mon May 12 17:56:52 2025 +0300 drm/i915: rename vlv_sideband*.[ch] to vlv_iosf_sb*.[ch] Be more specific in the naming, and follow the existing function naming pattern of vlv_iosf_sb_*() in the file. Reviewed-by: Ville Syrjälä Link: https://lore.kernel.org/r/d3d97d34a197ba801c558c3fd72b29f9e5c783af.1747061743.git.jani.nikula@intel.com Signed-off-by: Jani Nikula commit 82b98cadb01f63cdb159e596ec06866d00f8e8c7 Author: Umesh Nerlige Ramappa Date: Fri May 9 09:12:03 2025 -0700 drm/xe: Add WA BB to capture active context utilization Context Timestamp (CTX_TIMESTAMP) in the LRC accumulates the run ticks of the context, but only gets updated when the context switches out. In order to check how long a context has been active before it switches out, two things are required: (1) Determine if the context is running: To do so, we program the WA BB to set an initial value for CTX_TIMESTAMP in the LRC. The value chosen is 1 since 0 is the initial value when the LRC is initialized. During a query, we just check for this value to determine if the context is active. If the context switched out, it would overwrite this location with the actual CTX_TIMESTAMP MMIO value. Note that WA BB runs as the last part of the context restore, so reusing this LRC location will not clobber anything. (2) Calculate the time that the context has been active for: The CTX_TIMESTAMP ticks only when the context is active. If a context is active, we just use the CTX_TIMESTAMP MMIO as the new value of utilization. While doing so, we need to read the CTX_TIMESTAMP MMIO for the specific engine instance. Since we do not know which instance the context is running on until it is scheduled, we also read the ENGINE_ID MMIO in the WA BB and store it in the PPHSWP. Using the above 2 instructions in a WA BB, capture active context utilization. v2: (Matt Brost) - This breaks TDR, fix it by saving the CTX_TIMESTAMP register "drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value" - Drop tile from LRC if using gt "drm/xe: Save the gt pointer in LRC and drop the tile" v3: - Remove helpers for bb_per_ctx_ptr (Matt) - Add define for context active value (Matt) - Use 64 bit CTX TIMESTAMP for platforms that support it. For platforms that don't, live with the rare race. (Matt, Lucas) - Convert engine id to hwe and get the MMIO value (Lucas) - Correct commit message on when WA BB runs (Lucas) v4: - s/GRAPHICS_VER(...)/xe->info.has_64bit_timestamp/ (Matt) - Drop support for active utilization on a VF (CI failure) - In xe_lrc_init ensure the lrc value is 0 to begin with (CI regression) v5: - Minor checkpatch fix - Squash into previous commit and make TDR use 32-bit time - Update code comment to match commit msg Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4532 Suggested-by: Lucas De Marchi Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250509161159.2173069-8-umesh.nerlige.ramappa@intel.com commit 741d3ef8b8b88fab2729ca89de1180e49bc9cef0 Author: Umesh Nerlige Ramappa Date: Fri May 9 09:12:02 2025 -0700 drm/xe: Save the gt pointer in lrc and drop the tile Save the gt pointer in the lrc so that it can used for gt based helpers. Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Matthew Brost Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250509161159.2173069-7-umesh.nerlige.ramappa@intel.com commit 38b14233e5deff51db8faec287b4acd227152246 Author: Umesh Nerlige Ramappa Date: Fri May 9 09:12:01 2025 -0700 drm/xe: Save CTX_TIMESTAMP mmio value instead of LRC value For determining actual job execution time, save the current value of the CTX_TIMESTAMP register rather than the value saved in LRC since the current register value is the closest to the start time of the job. v2: Define MI_STORE_REGISTER_MEM to fix compile error v3: Place MI_STORE_REGISTER_MEM sorted by MI_INSTR (Lucas) Fixes: 65921374c48f ("drm/xe: Emit ctx timestamp copy in ring ops") Signed-off-by: Umesh Nerlige Ramappa Reviewed-by: Matthew Brost Reviewed-by: Lucas De Marchi Link: https://lore.kernel.org/r/20250509161159.2173069-6-umesh.nerlige.ramappa@intel.com commit 1b894c22462f286537b934d4dfcb20e6a9f7f4ee Author: Matthew Brost Date: Mon May 12 06:54:59 2025 -0700 drm/xe: Add atomic_svm_timeslice_ms debugfs entry Add some informal control for atomic SVM fault GPU timeslice to be able to play around with values and tweak performance. v2: - Reduce timeslice default value to 5ms Signed-off-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20250512135500.1405019-6-matthew.brost@intel.com commit a5d8d3be1dea8154edbbea481081469627665659 Author: Matthew Brost Date: Mon May 12 06:54:58 2025 -0700 drm/xe: Timeslice GPU on atomic SVM fault Ensure GPU can make forward progress on an atomic SVM GPU fault by giving the GPU a timeslice of 5ms v2: - Reduce timeslice to 5ms - Double timeslice on retry - Split out GPU SVM changes into independent patch v5: - Double timeslice in a few more places Fixes: 2f118c949160 ("drm/xe: Add SVM VRAM migration") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20250512135500.1405019-5-matthew.brost@intel.com commit 8dc1812b5b3a42311d28eb385eed88e2053ad3cb Author: Matthew Brost Date: Mon May 12 06:54:57 2025 -0700 drm/gpusvm: Add timeslicing support to GPU SVM Add timeslicing support to GPU SVM which will guarantee the GPU a minimum execution time on piece of physical memory before migration back to CPU. Intended to implement strict migration policies which require memory to be in a certain placement for correct execution. Required for shared CPU and GPU atomics on certain devices. Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Reviewed-by: Himal Prasad Ghimiray Link: https://lore.kernel.org/r/20250512135500.1405019-4-matthew.brost@intel.com commit a9ac0fa455b050d03e3032501368048fb284d318 Author: Matthew Brost Date: Mon May 12 06:54:56 2025 -0700 drm/xe: Strict migration policy for atomic SVM faults Mixing GPU and CPU atomics does not work unless a strict migration policy of GPU atomics must be device memory. Enforce a policy of must be in VRAM with a retry loop of 3 attempts, if retry loop fails abort fault. Removing always_migrate_to_vram modparam as we now have real migration policy. v2: - Only retry migration on atomics - Drop alway migrate modparam v3: - Only set vram_only on DGFX (Himal) - Bail on get_pages failure if vram_only and retry count exceeded (Himal) - s/vram_only/devmem_only - Update xe_svm_range_is_valid to accept devmem_only argument v4: - Fix logic bug get_pages failure v5: - Fix commit message (Himal) - Mention removing always_migrate_to_vram in commit message (Lucas) - Fix xe_svm_range_is_valid to check for devmem pages - Bail on devmem_only && !migrate_devmem (Thomas) v6: - Add READ_ONCE barriers for opportunistic checks (Thomas) - Pair READ_ONCE with WRITE_ONCE (Thomas) v7: - Adjust comments (Thomas) Fixes: 2f118c949160 ("drm/xe: Add SVM VRAM migration") Cc: stable@vger.kernel.org Signed-off-by: Himal Prasad Ghimiray Signed-off-by: Matthew Brost Acked-by: Himal Prasad Ghimiray Reviewed-by: Thomas Hellström Link: https://lore.kernel.org/r/20250512135500.1405019-3-matthew.brost@intel.com commit 8a9b978ebd47df9e0694c34748c2d6fa0c31eb4d Author: Himal Prasad Ghimiray Date: Mon May 12 06:54:55 2025 -0700 drm/gpusvm: Introduce devmem_only flag for allocation This commit adds a new flag, devmem_only, to the drm_gpusvm structure. The purpose of this flag is to ensure that the get_pages function allocates memory exclusively from the device's memory. If the allocation from device memory fails, the function will return an -EFAULT error. Required for shared CPU and GPU atomics on certain devices. v3: - s/vram_only/devmem_only/ Fixes: 99624bdff867 ("drm/gpusvm: Add support for GPU Shared Virtual Memory") Cc: stable@vger.kernel.org Signed-off-by: Matthew Brost Signed-off-by: Himal Prasad Ghimiray Reviewed-by: Matthew Brost Link: https://lore.kernel.org/r/20250512135500.1405019-2-matthew.brost@intel.com commit e5c13e2c505b73a8667ef9a0fd5cbd4227e483e6 Author: Aradhya Bhatia Date: Mon May 12 06:50:04 2025 +0000 drm/xe/xe2hpg: Add Wa_22021007897 Add Wa_22021007897 for the Xe2_HPG (graphics version: 20.01) IP. It is a permanent workaround, and applicable on all the steppings. Reviewed-by: Gustavo Sousa Reviewed-by: Tejas Upadhyay Signed-off-by: Aradhya Bhatia Link: https://lore.kernel.org/r/20250512065004.2576-1-aradhya.bhatia@intel.com Signed-off-by: Matt Roper commit cef88d1265cac7d415606af73ba58926fd3cd8b7 Author: Tomasz Lis Date: Mon May 12 13:40:18 2025 +0200 drm/xe/vf: Fixup CTB send buffer messages after migration During post-migration recovery of a VF, it is necessary to update GGTT references included in messages which are going to be sent to GuC. GuC will start consuming messages after VF KMD will inform it about fixups being done; before that, the VF KMD is expected to update any H2G messages which are already in send buffer but were not consumed by GuC. Only a small subset of messages allowed for VFs have GGTT references in them. This patch adds the functionality to parse the CTB send ring buffer and shift addresses contained within. While fixing the CTB content, ct->lock is not taken. This means the only barrier taken remains GGTT address lock - which is ok, because only requests with GGTT addresses matter, but it also means tail changes can happen during the CTB fixups execution (which may be ignored as any new messages will not have anything to fix). The GGTT address locking will be introduced in a future series. v2: removed storing shift as that's now done in VMA nodes patch; macros to inlines; warns to asserts; log messages fixes (Michal) v3: removed inline keywords, enums for offsets in CTB messages, less error messages, if return unused then made functs void (Michal) v4: update the cached head before starting fixups v5: removed/updated comments, wrapped lines, converted assert into error, enums for offsets to separate patch, reused xe_map_rd v6: define xe_map_*_array() macros, support CTB wrap which divides a message, updated comments, moved one function to an earlier patch v7: renamed few functions, wider use on previously introduced helper, separate cases in parsing messges, documented a static funct v8: Introduced more helpers, fixed coding style mistakes v9: Move xe_map*() functs to macros, add asserts, add debug print v10: Errors in place of some asserts, style fixes v11: Fixed invalid conditionals, added debug-only local pointer v12: Removed redundant __maybe_unused Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Reviewed-by: Michal Wajdeczko Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250512114018.361843-5-tomasz.lis@intel.com commit e327592cc901a3e415e28e1b6aa26381a2a93582 Author: Tomasz Lis Date: Mon May 12 13:40:17 2025 +0200 drm/xe/guc: Introduce enum with offsets for context register H2Gs Some GuC messages are constructed with incrementing dword counter rather than referencing specific DWORDs, as described in GuC interface specification. This change introduces the definitions of DWORD numbers for parameters which will need to be referenced in a CTB parser to be added in a following patch. To ensure correctness of these DWORDs, verification in form of asserts was added to the message construction code. v2: Renamed enum members, added ones for single context registration, modified asserts to check values rather than indexes. v3: Reordered assert args to take less lines v4: Added lengths v5: Renamed MULTI_LRC_MSG_LEN to MULTI_LRC_MSG_MIN_LEN Suggested-by: Michal Wajdeczko Signed-off-by: Tomasz Lis Reviewed-by: Michal Wajdeczko Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250512114018.361843-4-tomasz.lis@intel.com commit 3e693945b125da0f8459e84cee385cec77910c2f Author: Tomasz Lis Date: Mon May 12 13:40:16 2025 +0200 drm/xe/vf: Shifting GGTT area post migration We have only one GGTT for all IOV functions, with each VF having assigned a range of addresses for its use. After migration, a VF can receive a different range of addresses than it had initially. This implements shifting GGTT addresses within drm_mm nodes, so that VMAs stay valid after migration. This will make the driver use new addresses when accessing GGTT from the moment the shifting ends. By taking the ggtt->lock for the period of VMA fixups, this change also adds constraint on that mutex. Any locks used during the recovery cannot ever wait for hardware response - because after migration, the hardware will not do anything until fixups are finished. v2: Moved some functs to xe_ggtt.c; moved shift computation to just after querying; improved documentation; switched some warns to asserts; skipping fixups when GGTT shift eq 0; iterating through tiles (Michal) v3: Updated kerneldocs, removed unused funct, properly allocate balloning nodes if non existent v4: Re-used ballooning functions from VF init, used bool in place of standard error codes v5: Renamed one function v6: Subject tag change, several kerneldocs updated, some functions renamed, some moved, added several asserts, shuffled declarations of variables, revealed more detail in high level functions v7: Fixed typos, added `_locked` suffix to some functs, improved readability of asserts, removed unneeded conditional v8: Moved one function, removed implementation detail from kerneldoc, added asserts v9: Code shuffling without much change, and one param rename v10: Minor error path change, added printing the shift via debugfs Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Reviewed-by: Michal Wajdeczko Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250512114018.361843-3-tomasz.lis@intel.com commit dd39212b5f43577bcd0c4493c0ae4c7828bb55e1 Author: Tomasz Lis Date: Mon May 12 13:40:15 2025 +0200 drm/xe/vf: Divide GGTT ballooning into allocation and insertion The balloon nodes, which are used to fill areas of GGTT inaccessible for a specific VF, were allocated and inserted into GGTT within one function. To be able to re-use that insertion code during VF migration recovery, we need to split it. This patch separates allocation (init/fini functs) from the insertion of balloons (balloon/deballoon functs). Locks are also moved to ensure calls from post-migration recovery worker will not cause a deadlock. v2: Moved declarations to proper header v3: Rephrased description, introduced "_locked" versions of some functs, more lockdep checks, some functions renamed, altered error handling, added missing kerneldocs. v4: Suffixed more functs with `_locked`, moved lockdep asserts, fixed finalization in error path, added asserts v5: Renamed another few functs, used xe_ggtt_node_allocated(), moved lockdep back again to avoid null dereference, added asserts, improved comments v6: Changed params of cleanup_ggtt() Signed-off-by: Tomasz Lis Cc: Michal Wajdeczko Reviewed-by: Michal Wajdeczko Signed-off-by: Michal Wajdeczko Link: https://lore.kernel.org/r/20250512114018.361843-2-tomasz.lis@intel.com commit f77d8675c1adfb7bad559c1183161db5e39e4a4d Author: Imre Deak Date: Fri May 9 21:03:39 2025 +0300 drm/i915/dp_mst: Enable fractional link bpps on MST if the bpp is forced Enable using a fractional (compressed) link bpp on MST links, if this is supported and the link bpp is forced. Fractional link bpps will be enabled by default as a follow-up change after testing this functionality within a set of commonly used MST monitors and docks/hubs which support it. Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-13-imre.deak@intel.com commit f7f46a80fa68c19260aa6c88881cee4a18682562 Author: Imre Deak Date: Fri May 9 21:03:38 2025 +0300 drm/i915: Add support for forcing the link bpp on a connector Add support for forcing the link bpp on a connector via a connector debugfs entry. During reducing link bpps due to a link BW limit, keep bpps close to their forced value. Add the debugfs entry to all relevant connectors: all DP connectors and on an FDI link CRT/SDVO/LVDS/HDMI connectors. v2: - Move adding the debugfs entries to this patch. - Rename i915_force_link_bpp to intel_force_link_bpp. (Jani) - Select the relevant connectors via platform checks. (Jani) - Use for_each_new_intel_connector_in_state(). (Jani) - Fix 64 bit division vs. 32 bit build when converting str to q4. (lkp) - Avoid division and addition overflow when converting str to q4. v3: - Add TODO: to make the non-DSC min bpp value connector specific. (Ankit) Cc: Jani Nikula Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-12-imre.deak@intel.com commit 67e12c64b49f5a2b5a2db50d84f69b16f6d6d42e Author: Imre Deak Date: Fri May 9 21:03:37 2025 +0300 drm/i915/dp: Export intel_dp_dsc_min_src_compressed_bpp() Export the function that can be used by a follow-up change to query the minimum compressed link bpp supported by the HW. Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-11-imre.deak@intel.com commit a43a02d8f5f4360f7e2473c54cddc4a9bfcd0b62 Author: Imre Deak Date: Fri May 9 21:03:36 2025 +0300 drm/i915/display: Factor out intel_display_{min, max}_pipe_bpp() Factor out helpers that can be used in a follow-up change to query the minimum and maximum pipe bpp supported by the HW. Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-10-imre.deak@intel.com commit 00f00859820e021e0f228ff3244401da6efc9d51 Author: Imre Deak Date: Fri May 9 21:03:35 2025 +0300 drm/i915/dp_mst: Add support for fractional compressed link bpps on MST Add support for a fractional compressed link bpp on an MST link. Leave the actual enabling of fractional bpps to a follow-up change. While at it add an assert before the bpp loop, that the min and max bpps are aligned to the bpp step. This should hold regardless of the non-DSC/DSC or MST/UHBR-SST modes. This keeps the mode validation and DSC->DPT BW specific maximum link bpps as rounded-down integer values still, changing those to a fractional value is left for later, add here TODO comments for them. v2: - Align the min/max bpp value to the bpp step. - Assert that the min/max bpp values are aligned to the bpp step. Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-9-imre.deak@intel.com commit 7acc7a6fc77413ab061819cee2ab7771c4132cf0 Author: Imre Deak Date: Fri May 9 21:03:34 2025 +0300 drm/i915/dp: Limit max link bpp properly to a fractional value on SST The maximum link bpp - determined by the link BW for instance - can be fractional, handle this properly during computing the link bpp on SST. This keeps the pipe joiner specific maximum link bpp as a rounded-down integer value still, changing that to a fractional value is left for later. v2: Align the min/max bpp value to the bpp step. Reviewed-by: Luca Coelho Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-8-imre.deak@intel.com commit 1f581f38bc0d23c6ac6714c84a72e098f1f645fe Author: Imre Deak Date: Fri May 9 21:03:33 2025 +0300 drm/i915/dp_mst: Simplify computing the min/max compressed bpp limits Adjusting the compressed bpp range min/max limits in intel_dp_dsc_nearest_valid_bpp() is unnecessary: - The source/sink min/max values are enforced already by the link_config_limits::min_bpp_x16/max_bpp_x16 values computed early in intel_dp_compute_config_link_bpp_limits(). - The fixed set of valid bpps are enforced already - for all bpps in the min .. max range by intel_dp_dsc_valid_compressed_bpp() called from intel_dp_mtp_tu_compute_config(). The only thing needed is limiting max compressed bpp below the uncompressed pipe bpp, do that one thing only instead of calling intel_dp_dsc_nearest_valid_bpp(). Reviewed-by: Luca Coelho Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-7-imre.deak@intel.com commit c2a38dc3006a2f8eff7044a3d1f0510fd7b749bd Author: Imre Deak Date: Fri May 9 21:03:32 2025 +0300 drm/i915/dp_mst: Check BW limit on the local MST link early Check the BW requirement of a selected compressed bpp against the total MST link BW early. This didn't cause a problem, since all the BW limits within the MST topology are checked during the later MST topology BW check. However it doesn't make sense to defer the total link BW check, since for resolving a BW limit issue due to this later also (a) requires selecting a pipe to reduce its bpp, ending up reducing the bpp for another pipe, which is not ideal (b) requires recomputing the state for all CRTC/stream's in the topology which may slow down the commit considerably (especially when using fractional bpps). Based on the above, check a stream bpp's BW requirement against the MST link's total BW early. Ideally drm_dp_atomic_find_time_slots() should check internally the corresponding PBN/TU slot BW against the total link BW, returning an error if the check fails, however that change would also affect other drivers, so leaving this for a follow-up. v2: Rephrase description of pipe selection/bpp reduction in commit message. (Ankit) Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-6-imre.deak@intel.com commit dd697c720fea53d415c4d86f6e128b8bfceb35ce Author: Imre Deak Date: Fri May 9 21:03:31 2025 +0300 drm/i915/dp_mst: Update the total link slot count early A follow up change will check a selected bpp's BW requirement in intel_dp_mtp_tu_compute_config(), however that requires the total link slot count to be up-to-date. The latter in turn depends on the channel encoding and hence the link rate used, so it can be set after the link rate used is selected. This also allows simplifying mst_stream_update_slots(), do that as well, moving the function definition before its use. Cc: Jani Nikula Reviewed-by: Ankit Nautiyal Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-5-imre.deak@intel.com commit 97ae79d3ad91122991d1ad0032be02fa3e9d918f Author: Imre Deak Date: Fri May 9 21:03:30 2025 +0300 drm/i915/dp_mst: Validate compressed bpp vs. platform restrictions Atm TGL supports only a fixed set of valid DSC compressed bpps (6,8,10,12,15), but this is not taken into account while looking for a bpp in the minimum..maximum compressed bpp range. This happened to work only by chance since atm from the above min..max range it's always the maximum bpp that is selected, which is one of the above valid bpps (see mst_stream_dsc_compute_link_config() -> intel_dp_dsc_nearest_valid_bpp()). Before selecting a bpp however, the bpp's BW requirement should be checked wrt. to the MST total link BW; after doing that - in a follow-up change - the validity of any bpp in the min..max range must be ensured before the bpp is selected, do that here. Cc: Jani Nikula Reviewed-by: Ankit Nautiyal Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-4-imre.deak@intel.com commit 49a50054b784989ad56f8df911611f823d628044 Author: Imre Deak Date: Fri May 9 21:03:29 2025 +0300 drm/i915/dp_mst: Simplify handling the single-bpp case during state computation A follow-up change wants to skip invalid bpps in the bpp select loop of a stream state computation. To allow for that, using the usual 'continue' statement in the loop, change the way the single-bpp range is handled. v2: Fix typo in commit message. (Ankit) Cc: Jani Nikula Reviewed-by: Luca Coelho Reviewed-by: Ankit Nautiyal Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-3-imre.deak@intel.com commit 266e2fcfe2ea0d062ea392cd22f6250ae0d11c04 Author: Imre Deak Date: Fri May 9 21:03:28 2025 +0300 drm/i915/dp_mst: Use the correct connector while computing the link BPP limit on MST Atm, on an MST link in DSC mode intel_dp_compute_config_link_bpp_limits() calculates the maximum link bpp limit using the MST root connector's DSC capabilities. That's not correct in general: the decompression could be performed by a branch device downstream of the root branch device or the sink itself. Fix the above by passing to intel_dp_compute_config_link_bpp_limits() the actual connector being modeset, containing the correct DSC capabilities. Cc: Ankit Nautiyal Fixes: 1c5b72daff46 ("drm/i915/dp: Set the DSC link limits in intel_dp_compute_config_link_bpp_limits") Reviewed-by: Ankit Nautiyal Reviewed-by: Luca Coelho Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250509180340.554867-2-imre.deak@intel.com commit 44b6535d8acebbbdb8b8e79b22118bb3d7fa93df Author: Vivek Kasireddy Date: Thu May 1 16:24:19 2025 -0700 drm/virtio: Fix NULL pointer deref in virtgpu_dma_buf_free_obj() There is a chance that obj->dma_buf would be NULL by the time virtgpu_dma_buf_free_obj() is called. This can happen for imported prime objects, when drm_gem_object_exported_dma_buf_free() gets called on them before drm_gem_object_free(). This is because drm_gem_object_exported_dma_buf_free() explicitly sets obj->dma_buf to NULL. Therefore, fix this issue by storing the dma_buf pointer in the virtio_gpu_object instance and using it in virtgpu_dma_buf_free_obj. This stored pointer is guaranteed to be valid until the object is freed as we took a reference on it in virtgpu_gem_prime_import(). Fixes: 415cb45895f4 ("drm/virtio: Use dma_buf from GEM object instance") Cc: Dmitry Osipenko Cc: Thomas Zimmermann Signed-off-by: Vivek Kasireddy Reviewed-by: Dmitry Osipenko Signed-off-by: Dmitry Osipenko Link: https://lore.kernel.org/r/20250501232419.180337-1-vivek.kasireddy@intel.com commit 5dff17241483d934d8a72633fb2c2b7eaf2d91a3 Author: Mikolaj Wasiak Date: Fri May 9 09:57:18 2025 +0200 drm/i915/selftest: allow larger memory allocation Due to changes in allocator, the size of the allocation for contiguous region is not rounded up to a power-of-two and instead allocated as is. Thus, change the part of test that expected the allocation to fail. Signed-off-by: Mikolaj Wasiak Reviewed-by: Krzysztof Karas Reviewed-by: Andi Shyti Reviewed-by: Krzysztof Niemiec Signed-off-by: Andi Shyti Link: https://lore.kernel.org/r/fptevdfbclvg2lbfuys5ibffbl2baouywkutnr7vdsy5tzcqfk@mpflwlh6jxfd commit c58af5cd9c6529e92d559b66470ae1bca6360015 Author: Jani Nikula Date: Fri May 2 15:07:25 2025 +0300 drm/i915/irq: stop using HAS_GMCH() Right or wrong, HAS_GMCH() has become a display only thing. The last three users outside of display are in irq code. Reorder the if ladders to stop using HAS_GMCH(). Reviewed-by: Michał Grzelak Link: https://lore.kernel.org/r/20250502120725.439800-1-jani.nikula@intel.com Signed-off-by: Jani Nikula commit 5dd933e33b9a2a379bcdefa140b4ee94ea184444 Author: Thomas Hellström Date: Thu May 8 13:30:15 2025 +0200 drm/xe: Make the gem shrinker drm managed Make the xe drm shrinker drm managed like many other resources created at device creation time. Signed-off-by: Thomas Hellström Reviewed-by: Matthew Auld Link: https://lore.kernel.org/r/20250508113015.3374-1-thomas.hellstrom@linux.intel.com commit 243bf99e2fe75edf8df1711c1377b6fc020b806c Author: Thomas Hellström Date: Thu May 8 13:29:31 2025 +0200 drm/xe: Fix the gem shrinker name The xe buffer object shrinker name is visible in the /shrinker directory and most if not all other shinkers follow a naming convention that looks like -_: Follow the same convention for xe, changing the name to drm-xe_gem:. Other shrinkers typically use the device node for but since drm drivers typically don't have a single unique device- node, instead use the unique name in the drm device. Fixes: 00c8efc3180f ("drm/xe: Add a shrinker for xe bos") Cc: Matthew Brost Signed-off-by: Thomas Hellström Reviewed-by: Francois Dugast Link: https://lore.kernel.org/r/20250508112931.3347-1-thomas.hellstrom@linux.intel.com commit ff868667a4f9c6e349f4a4f0dcc3ff60d6ea8a73 Author: Julia Filipchuk Date: Fri May 2 15:39:24 2025 -0700 drm/i915/guc: Enable DUAL_QUEUE_WA for newer platforms For newer platforms (post DG2) hardware intentionally stalls on submisstion of concurrent submissions on RCS and CCS of different address spaces. With this workaround GuC will never schedule such conlicting contexts; preventing detection of a stall as a hang. GuC specs recommend to enable this for all platforms starting from MTL supporting CCS. v2: Use existing macros for version check. (Jani) v3: Reword explanation for clarity. Remove unneeded parens. Remove accidental comment change. (Daniele) Signed-off-by: Julia Filipchuk Cc: Daniele Ceraolo Spurio Reviewed-by: Daniele Ceraolo Spurio Signed-off-by: Daniele Ceraolo Spurio Link: https://lore.kernel.org/r/20250502223924.94628-1-julia.filipchuk@intel.com commit 0f45696ddb2b901fbf15cb8d2e89767be481d59f Author: Imre Deak Date: Wed May 7 18:19:53 2025 +0300 drm/i915/dp: Fix determining SST/MST mode during MTP TU state computation Determining the SST/MST mode during state computation must be done based on the output type stored in the CRTC state, which in turn is set once based on the modeset connector's SST vs. MST type and will not change as long as the connector is using the CRTC. OTOH the MST mode indicated by the given connector's intel_dp::is_mst flag can change independently of the above output type, based on what sink is at any moment plugged to the connector. Fix the state computation accordingly. Cc: Jani Nikula Fixes: f6971d7427c2 ("drm/i915/mst: adapt intel_dp_mtp_tu_compute_config() for 128b/132b SST") Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/4607 Reviewed-by: Jani Nikula Signed-off-by: Imre Deak Link: https://lore.kernel.org/r/20250507151953.251846-1-imre.deak@intel.com commit b5960a06b90eeba147c50c2d14de57b923371651 Author: Nathan Chancellor Date: Fri Apr 4 15:10:03 2025 -0700 vsprintf: Use __diag macros to disable '-Wsuggest-attribute=format' The GCC specific warning '-Wsuggest-attribute=format' is disabled around va_format() using raw #pragma statements, which includes an '#ifndef __clang__' to avoid a warning about an unknown warning option from clang (which recognizes '#pragma GCC' for compatibility reasons): lib/vsprintf.c:1703:32: error: unknown warning group '-Wsuggest-attribute=format', ignored [-Werror,-Wunknown-warning-option] 1703 | #pragma GCC diagnostic ignored "-Wsuggest-attribute=format" | ^ While the current solution works, it is not visually appealing. The kernel already has some infrastructure that wraps these #pragma statements to give more specific control over diagnostics without needing #ifdef blocks for different compilers. Convert the existing statements over to the __diag macros. Closes: https://lore.kernel.org/r/CAHk-=wgfX9nBGE0Ap9GjhOy7Mn=RSy=rx0MvqfYFFDx31KJXqQ@mail.gmail.com Signed-off-by: Nathan Chancellor Tested-by: Andy Shevchenko Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20250404-vsprintf-convert-pragmas-to-__diag-v1-2-5d6c5c55b2bd@kernel.org Signed-off-by: Petr Mladek commit 7efa84b5cdd6d473c7e80912638fca9d7167f202 Author: Nathan Chancellor Date: Fri Apr 4 15:10:02 2025 -0700 compiler-gcc.h: Introduce __diag_GCC_all It is not possible disabling a diagnostic for all versions of GCC without hard coding the minimum supported version at the site, as the GCC specific macros require a minimum version to disable the warning for: __diag_ignore(GCC, 5, ...); __diag_ignore_all() does not solve this issue because it disables a diagnostic for all versions of both GCC and clang, not just one or the other. Introduce __diag_GCC_all so that developers can write __diag_ignore(GCC, all, ...); to disable a particular diagnostic for all versions of GCC, while not affecting clang. Closes: https://lore.kernel.org/r/CAHk-=wgfX9nBGE0Ap9GjhOy7Mn=RSy=rx0MvqfYFFDx31KJXqQ@mail.gmail.com Signed-off-by: Nathan Chancellor Tested-by: Andy Shevchenko Reviewed-by: Petr Mladek Link: https://patch.msgid.link/20250404-vsprintf-convert-pragmas-to-__diag-v1-1-5d6c5c55b2bd@kernel.org Signed-off-by: Petr Mladek commit 3e45553acb14692519db853e4b5be35b45e46ad0 Author: Nathan Chancellor Date: Mon Jan 20 06:21:14 2025 -0700 apparmor: Remove unused variable 'sock' in __file_sock_perm() When CONFIG_SECURITY_APPARMOR_DEBUG_ASSERTS is disabled, there is a warning that sock is unused: security/apparmor/file.c: In function '__file_sock_perm': security/apparmor/file.c:544:24: warning: unused variable 'sock' [-Wunused-variable] 544 | struct socket *sock = (struct socket *) file->private_data; | ^~~~ sock was moved into aa_sock_file_perm(), where the same check is present, so remove sock and the assertion from __file_sock_perm() to fix the warning. Fixes: c05e705812d1 ("apparmor: add fine grained af_unix mediation") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202501190757.myuLxLyL-lkp@intel.com/ Signed-off-by: Nathan Chancellor Signed-off-by: John Johansen commit 67e370aa7f968f6a4f3573ed61a77b36d1b26475 Author: Mateusz Guzik Date: Mon Jan 27 21:54:04 2025 +0100 apparmor: use the condition in AA_BUG_FMT even with debug disabled This follows the established practice and fixes a build failure for me: security/apparmor/file.c: In function ‘__file_sock_perm’: security/apparmor/file.c:544:24: error: unused variable ‘sock’ [-Werror=unused-variable] 544 | struct socket *sock = (struct socket *) file->private_data; | ^~~~ Signed-off-by: Mateusz Guzik Signed-off-by: John Johansen commit aabbe6f908d8264cd8aeeef8141665f71668ef36 Author: Tanya Agarwal Date: Fri Jan 24 00:51:00 2025 +0530 apparmor: fix typos and spelling errors Fix typos and spelling errors in apparmor module comments that were identified using the codespell tool. No functional changes - documentation only. Signed-off-by: Tanya Agarwal Reviewed-by: Mimi Zohar Ryan Lee Signed-off-by: John Johansen commit 04fe43104e4ed103a8b55c21d1bc354fac409421 Author: Jiapeng Chong Date: Tue Jan 21 10:44:43 2025 +0800 apparmor: Modify mismatched function name No functional modification involved. security/apparmor/lib.c:93: warning: expecting prototype for aa_mask_to_str(). Prototype was for val_mask_to_str() instead. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=13606 Signed-off-by: Jiapeng Chong Signed-off-by: John Johansen commit aa904fa1182b1a4470bb082f6cddacc1dc4e8032 Author: Jiapeng Chong Date: Tue Jan 21 10:44:44 2025 +0800 apparmor: Modify mismatched function name No functional modification involved. security/apparmor/file.c:184: warning: expecting prototype for aa_lookup_fperms(). Prototype was for aa_lookup_condperms() instead. Reported-by: Abaci Robot Closes: https://bugzilla.openanolis.cn/show_bug.cgi?id=13605 Signed-off-by: Jiapeng Chong Signed-off-by: John Johansen commit 509f8cb2fff927eeb5eb0ebdd410ec6f40430173 Author: Nathan Chancellor Date: Mon Jan 20 06:12:01 2025 -0700 apparmor: Fix checking address of an array in accum_label_info() clang warns: security/apparmor/label.c:206:15: error: address of array 'new->vec' will always evaluate to 'true' [-Werror,-Wpointer-bool-conversion] 206 | AA_BUG(!new->vec); | ~~~~~~^~~ The address of this array can never be NULL because it is not at the beginning of a structure. Convert the assertion to check that the new pointer is not NULL. Fixes: de4754c801f4 ("apparmor: carry mediation check on label") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202501191802.bDp2voTJ-lkp@intel.com/ Signed-off-by: Nathan Chancellor Signed-off-by: John Johansen commit e6b087676954e36a7b1ed51249362bb499f8c1c2 Author: John Johansen Date: Fri Jan 17 05:02:33 2025 -0800 apparmor: fix dbus permission queries to v9 ABI dbus permission queries need to be synced with fine grained unix mediation to avoid potential policy regressions. To ensure that dbus queries don't result in a case where fine grained unix mediation is not being applied but dbus mediation is check the loaded policy support ABI and abort the query if policy doesn't support the v9 ABI. Signed-off-by: John Johansen commit dcd7a559411e8e1cd627ad20ac70faee77329380 Author: John Johansen Date: Sat Oct 12 04:43:34 2024 -0700 apparmor: gate make fine grained unix mediation behind v9 abi Fine grained unix mediation in Ubuntu used ABI v7, and policy using this has propogated onto systems where fine grained unix mediation was not supported. The userspace policy compiler supports downgrading policy so the policy could be shared without changes. Unfortunately this had the side effect that policy was not updated for the none Ubuntu systems and enabling fine grained unix mediation on those systems means that a new kernel can break a system with existing policy that worked with the previous kernel. With fine grained af_unix mediation this regression can easily break the system causing boot to fail, as it affect unix socket files, non-file based unix sockets, and dbus communication. To aoid this regression move fine grained af_unix mediation behind a new abi. This means that the system's userspace and policy must be updated to support the new policy before it takes affect and dropping a new kernel on existing system will not result in a regression. The abi bump is done in such a way as existing policy can be activated on the system by changing the policy abi declaration and existing unix policy rules will apply. Policy then only needs to be incrementally updated, can even be backported to existing Ubuntu policy. Signed-off-by: John Johansen commit c05e705812d179f4b85aeacc34a555a42bc4f9ac Author: John Johansen Date: Wed Sep 7 12:46:30 2022 -0700 apparmor: add fine grained af_unix mediation Extend af_unix mediation to support fine grained controls based on the type (abstract, anonymous, fs), the address, and the labeling on the socket. This allows for using socket addresses to label and the socket and control which subjects can communicate. The unix rule format follows standard apparmor rules except that fs based unix sockets can be mediated by existing file rules. None fs unix sockets can be mediated by a unix socket rule. Where The address of an abstract unix domain socket begins with the @ character, similar to how they are reported (as paths) by netstat -x. The address then follows and may contain pattern matching and any characters including the null character. In apparmor null characters must be specified by using an escape sequence \000 or \x00. The pattern matching is the same as is used by file path matching so * will not match / even though it has no special meaning with in an abstract socket name. Eg. allow unix addr=@*, Autobound unix domain sockets have a unix sun_path assigned to them by the kernel, as such specifying a policy based address is not possible. The autobinding of sockets can be controlled by specifying the special auto keyword. Eg. allow unix addr=auto, To indicate that the rule only applies to auto binding of unix domain sockets. It is important to note this only applies to the bind permission as once the socket is bound to an address it is indistinguishable from a socket that have an addr bound with a specified name. When the auto keyword is used with other permissions or as part of a peer addr it will be replaced with a pattern that can match an autobound socket. Eg. For some kernels allow unix rw addr=auto, It is important to note, this pattern may match abstract sockets that were not autobound but have an addr that fits what is generated by the kernel when autobinding a socket. Anonymous unix domain sockets have no sun_path associated with the socket address, however it can be specified with the special none keyword to indicate the rule only applies to anonymous unix domain sockets. Eg. allow unix addr=none, If the address component of a rule is not specified then the rule applies to autobind, abstract and anonymous sockets. The label on the socket can be compared using the standard label= rule conditional. Eg. allow unix addr=@foo peer=(label=bar), see man apparmor.d for full syntax description. Signed-off-by: John Johansen commit b4940d913cc2c67f8f6bf17abbf3e5301f95e260 Author: John Johansen Date: Wed Apr 24 15:54:26 2024 -0700 apparmor: in preparation for finer networking rules rework match_prot Rework match_prot into a common fn that can be shared by all the networking rules. This will provide compatibility with current socket mediation, via the early bailout permission encoding. Signed-off-by: John Johansen commit 6cc6a0523dde5b1f001d559d0e034494bc8b0db0 Author: John Johansen Date: Wed Apr 10 14:49:43 2024 -0700 apparmor: lift kernel socket check out of critical section There is no need for the kern check to be in the critical section, it only complicates the code and slows down the case where the socket is being created by the kernel. Lifting it out will also allow socket_create to share common template code, with other socket_permission checks. Signed-off-by: John Johansen commit 9045aa25d17cf1d13a1c31fc45ed1f9ca725e30e Author: John Johansen Date: Tue Apr 23 08:59:33 2024 -0700 apparmor: remove af_select macro The af_select macro just adds a layer of unnecessary abstraction that makes following what the code is doing harder. Signed-off-by: John Johansen commit ce9e3b3fa25a239f5c80989a1d05719bb2793fd4 Author: John Johansen Date: Thu Jan 4 09:00:49 2024 -0800 apparmor: add ability to mediate caps with policy state machine Currently the caps encoding is very limited and can't be used with conditionals. Allow capabilities to be mediated by the state machine. This will allow us to add conditionals to capabilities that aren't possible with the current encoding. This patch only adds support for using the state machine and retains the old encoding lookup as part of the runtime mediation code to support older policy abis. A follow on patch will move backwards compatibility to a mapping function done at policy load time. Signed-off-by: John Johansen commit a9eb185be84e998aa9a99c7760534ccc06216705 Author: John Johansen Date: Tue Jan 2 21:54:30 2024 -0800 apparmor: fix x_table_lookup when stacking is not the first entry x_table_lookup currently does stacking during label_parse() if the target specifies a stack but its only caller ensures that it will never be used with stacking. Refactor to slightly simplify the code in x_to_label(), this also fixes a long standing problem where x_to_labels check on stacking is only on the first element to the table option list, instead of the element that is found and used. Signed-off-by: John Johansen commit 84c455decf27ce97a23fb70b58075592ab88d66a Author: John Johansen Date: Mon Aug 21 16:54:58 2023 -0700 apparmor: add support for profiles to define the kill signal Previously apparmor has only sent SIGKILL but there are cases where it can be useful to send a different signal. Allow the profile to optionally specify a different value. Signed-off-by: John Johansen commit 2e12c5f060176ede209673e4f63ea5d0e3c5814c Author: John Johansen Date: Sun Jul 23 02:30:33 2023 -0700 apparmor: add additional flags to extended permission. This is a step towards merging the file and policy state machines. With the switch to extended permissions the state machine's ACCEPT2 table became unused freeing it up to store state specific flags. The first flags to be stored are FLAG_OWNER and FLAG other which paves the way towards merging the file and policydb perms into a single permission table. Currently Lookups based on the objects ownership conditional will still need separate fns, this will be address in a following patch. Signed-off-by: John Johansen commit de4754c801f4ceefc6ce0d13480c506e0a91b449 Author: John Johansen Date: Fri Oct 27 10:31:06 2023 -0700 apparmor: carry mediation check on label In order to speed up the mediated check, precompute and store the result as a bit per class type. This will not only allow us to speed up the mediation check but is also a step to removing the unconfined special cases as the unconfined check can be replaced with the generic label_mediates() check. Note: label check does not currently work for capabilities and resources which need to have their mediation updated first. Signed-off-by: John Johansen commit 34d31f23385b018890295414acaee31d786cf73d Author: John Johansen Date: Fri Jan 19 01:23:55 2024 -0800 apparmor: cleanup: refactor file_perm() to doc semantics of some checks Provide semantics, via fn names, for some checks being done in file_perm(). This is a preparatory patch for improvements to both permission caching and delegation, where the check will become more involved. Signed-off-by: John Johansen commit 35fad5b462224e0da3764f68b69827281eeaac8c Author: John Johansen Date: Fri Jan 19 00:24:03 2024 -0800 apparmor: remove explicit restriction that unconfined cannot use change_hat There does not need to be an explicit restriction that unconfined can't use change_hat. Traditionally unconfined doesn't have hats so change_hat could not be used. But newer unconfined profiles have the potential of having hats, and even system unconfined will be able to be replaced with a profile that allows for hats. To remain backwards compitible with expected return codes, continue to return -EPERM if the unconfined profile does not have any hats. Signed-off-by: John Johansen commit cd769b05cc87fb527dbab547e65b934b45705d6b Author: John Johansen Date: Fri Jan 19 00:12:16 2024 -0800 apparmor: ensure labels with more than one entry have correct flags labels containing more than one entry need to accumulate flag info from profiles that the label is constructed from. This is done correctly for labels created by a merge but is not being done for labels created by an update or directly created via a parse. This technically is a bug fix, however the effect in current code is to cause early unconfined bail out to not happen (ie. without the fix it is slower) on labels that were created via update or a parse. Signed-off-by: John Johansen commit 0bc8c6862faaa80a2c89c73cc3936cbe2d35235c Author: John Johansen Date: Sun Jan 29 02:13:56 2023 -0800 apparmor: switch signal mediation to use RULE_MEDIATES Currently signal mediation is using a hard coded form of the RULE_MEDIATES check. This hides the intended semantics, and means this specific check won't pickup any changes or improvements made in the RULE_MEDIATES check. Switch to using RULE_MEDIATES(). Signed-off-by: John Johansen commit 46b9b994dd554099b3ca74a20a0d1fb392c83a87 Author: John Johansen Date: Sun Jan 29 01:55:03 2023 -0800 apparmor: remove redundant unconfined check. profile_af_perm and profile_af_sk_perm are only ever called after checking that the profile is not unconfined. So we can drop these redundant checks. Signed-off-by: John Johansen commit 280799f724088ceea409564f4412181e354aba22 Author: John Johansen Date: Wed Nov 16 22:17:09 2022 -0800 apparmor: cleanup: attachment perm lookup to use lookup_perms() Remove another case of code duplications. Switch to using the generic routine instead of the current custom checks. Signed-off-by: John Johansen commit 71e6cff3e0dde6f6a3355d6c73ca3e176567995e Author: John Johansen Date: Fri Sep 23 16:36:10 2022 -0700 apparmor: Improve debug print infrastructure Make it so apparmor debug output can be controlled by class flags as well as the debug flag on labels. This provides much finer control at what is being output so apparmor doesn't flood the logs with information that is not needed, making it hard to find what is important. Signed-off-by: John Johansen commit c602537de3c137e55582d7fccfb18e50f1cd9c83 Author: Thorsten Blum Date: Fri Dec 20 20:22:42 2024 +0100 apparmor: Use str_yes_no() helper function Remove hard-coded strings by using the str_yes_no() helper function. Fix a typo in a comment: s/unpritable/unprintable/ Signed-off-by: Thorsten Blum Signed-off-by: John Johansen